FM / src

/opt/canhelp/node_modules/@noble/ciphers/src/

/opt/canhelp/node_modules/@noble/ciphers/src

Name	Size	Mode	Actions
aes.ts	51641	0644	edit dl rm
chacha.ts	13816	0644	edit dl rm
ff1.ts	6053	0644	edit dl rm
index.ts	1058	0644	edit dl rm
salsa.ts	11244	0644	edit dl rm
utils.ts	17385	0644	edit dl rm
webcrypto.ts	4476	0644	edit dl rm
_arx.ts	10531	0644	edit dl rm
_poly1305.ts	11559	0644	edit dl rm
_polyval.ts	8106	0644	edit dl rm

Edit: /opt/canhelp/node_modules/@noble/ciphers/src/aes.ts (51641B)

/**
 * [AES](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard)
 * a.k.a. Advanced Encryption Standard
 * is a variant of Rijndael block cipher, standardized by NIST in 2001.
 * We provide the fastest available pure JS implementation.
 *
 * `cipher = encrypt(block, key)`
 *
 * Data is split into 128-bit blocks. Encrypted in 10/12/14 rounds (128/192/256 bits). In every round:
 * 1. **S-box**, table substitution
 * 2. **Shift rows**, cyclic shift left of all rows of data array
 * 3. **Mix columns**, multiplying every column by fixed polynomial
 * 4. **Add round key**, round_key xor i-th column of array
 *
 * Check out [FIPS-197](https://csrc.nist.gov/files/pubs/fips/197/final/docs/fips-197.pdf),
 * [NIST 800-38G](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38G.pdf)
 * and [original proposal](https://csrc.nist.gov/csrc/media/projects/cryptographic-standards-and-guidelines/documents/aes-development/rijndael-ammended.pdf)
 * @module
 */
import { ghash, polyval } from './_polyval.ts';
// prettier-ignore
import {
  abytes, anumber, clean, complexOverlapBytes, concatBytes,
  copyBytes, createView, equalBytes, getOutput, isAligned32, overlapBytes,
  u32, u64Lengths, u8, wrapCipher,
  type Cipher, type CipherWithOutput, type PRG, type Uint8ArrayBuffer
} from './utils.ts';

const BLOCK_SIZE = 16;
const BLOCK_SIZE32 = 4;
const EMPTY_BLOCK = /* @__PURE__ */ new Uint8Array(BLOCK_SIZE);
const ONE_BLOCK = /* @__PURE__ */ Uint8Array.from([
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
]);
const POLY = 0x11b; // 1 + x + x**3 + x**4 + x**8

function validateKeyLength(key: Uint8Array) {
  if (![16, 24, 32].includes(key.length))
    throw new Error('"aes key" expected Uint8Array of length 16/24/32, got length=' + key.length);
}

// TODO: remove multiplication, binary ops only
function mul2(n: number) {
  return (n << 1) ^ (POLY & -(n >> 7));
}

function mul(a: number, b: number) {
  let res = 0;
  for (; b > 0; b >>= 1) {
    // Montgomery ladder
    res ^= a & -(b & 1); // if (b&1) res ^=a (but const-time).
    a = mul2(a); // a = 2*a
  }
  return res;
}

// Increments bigint with wrap around
// NOTE: we cannot use u32 here since it may overflow on carry!
const incBytes = (data: Uint8Array, isLE: boolean, carry: number = 1) => {
  if (!Number.isSafeInteger(carry)) throw new Error('incBytes: wrong carry ' + carry);
  abytes(data);
  for (let i = 0; i < data.length; i++) {
    const pos = !isLE ? data.length - 1 - i : i;
    carry = (carry + (data[pos] & 0xff)) | 0;
    data[pos] = carry & 0xff;
    carry >>>= 8;
  }
};

// AES S-box is generated using finite field inversion,
// an affine transform, and xor of a constant 0x63.
const sbox = /* @__PURE__ */ (() => {
  const t = new Uint8Array(256);
  for (let i = 0, x = 1; i < 256; i++, x ^= mul2(x)) t[i] = x;
  const box = new Uint8Array(256);
  box[0] = 0x63; // first elm
  for (let i = 0; i < 255; i++) {
    let x = t[255 - i];
    x |= x << 8;
    box[t[i]] = (x ^ (x >> 4) ^ (x >> 5) ^ (x >> 6) ^ (x >> 7) ^ 0x63) & 0xff;
  }
  clean(t);
  return box;
})();

// Inverted S-box
const invSbox = /* @__PURE__ */ sbox.map((_, j) => sbox.indexOf(j));

// Rotate u32 by 8
const rotr32_8 = (n: number) => (n << 24) | (n >>> 8);
const rotl32_8 = (n: number) => (n << 8) | (n >>> 24);
// The byte swap operation for uint32 (LE<->BE)
const byteSwap = (word: number) =>
  ((word << 24) & 0xff000000) |
  ((word << 8) & 0xff0000) |
  ((word >>> 8) & 0xff00) |
  ((word >>> 24) & 0xff);

// T-table is optimization suggested in 5.2 of original proposal (missed from FIPS-197). Changes:
// - LE instead of BE
// - bigger tables: T0 and T1 are merged into T01 table and T2 & T3 into T23;
//   so index is u16, instead of u8. This speeds up things, unexpectedly
function genTtable(sbox: Uint8Array, fn: (n: number) => number) {
  if (sbox.length !== 256) throw new Error('Wrong sbox length');
  const T0 = new Uint32Array(256).map((_, j) => fn(sbox[j]));
  const T1 = T0.map(rotl32_8);
  const T2 = T1.map(rotl32_8);
  const T3 = T2.map(rotl32_8);
  const T01 = new Uint32Array(256 * 256);
  const T23 = new Uint32Array(256 * 256);
  const sbox2 = new Uint16Array(256 * 256);
  for (let i = 0; i < 256; i++) {
    for (let j = 0; j < 256; j++) {
      const idx = i * 256 + j;
      T01[idx] = T0[i] ^ T1[j];
      T23[idx] = T2[i] ^ T3[j];
      sbox2[idx] = (sbox[i] << 8) | sbox[j];
    }
  }
  return { sbox, sbox2, T0, T1, T2, T3, T01, T23 };
}

const tableEncoding = /* @__PURE__ */ genTtable(
  sbox,
  (s: number) => (mul(s, 3) << 24) | (s << 16) | (s << 8) | mul(s, 2)
);
const tableDecoding = /* @__PURE__ */ genTtable(
  invSbox,
  (s) => (mul(s, 11) << 24) | (mul(s, 13) << 16) | (mul(s, 9) << 8) | mul(s, 14)
);

const xPowers = /* @__PURE__ */ (() => {
  const p = new Uint8Array(16);
  for (let i = 0, x = 1; i < 16; i++, x = mul2(x)) p[i] = x;
  return p;
})();

/** Key expansion used in CTR. */
function expandKeyLE(key: Uint8Array): Uint32Array {
  abytes(key);
  const len = key.length;
  validateKeyLength(key);
  const { sbox2 } = tableEncoding;
  const toClean = [];
  if (!isAligned32(key)) toClean.push((key = copyBytes(key)));
  const k32 = u32(key);
  const Nk = k32.length;
  const subByte = (n: number) => applySbox(sbox2, n, n, n, n);
  const xk = new Uint32Array(len + 28); // expanded key
  xk.set(k32);
  // 4.3.1 Key expansion
  for (let i = Nk; i < xk.length; i++) {
    let t = xk[i - 1];
    if (i % Nk === 0) t = subByte(rotr32_8(t)) ^ xPowers[i / Nk - 1];
    else if (Nk > 6 && i % Nk === 4) t = subByte(t);
    xk[i] = xk[i - Nk] ^ t;
  }
  clean(...toClean);
  return xk;
}

// Apply tables
function apply0123(
  T01: Uint32Array,
  T23: Uint32Array,
  s0: number,
  s1: number,
  s2: number,
  s3: number
) {
  return (
    T01[((s0 << 8) & 0xff00) | ((s1 >>> 8) & 0xff)] ^
    T23[((s2 >>> 8) & 0xff00) | ((s3 >>> 24) & 0xff)]
  );
}

function applySbox(sbox2: Uint16Array, s0: number, s1: number, s2: number, s3: number) {
  return (
    sbox2[(s0 & 0xff) | (s1 & 0xff00)] |
    (sbox2[((s2 >>> 16) & 0xff) | ((s3 >>> 16) & 0xff00)] << 16)
  );
}

// Can't be merged with encrypt: arg positions for apply0123 / applySbox are different
function decrypt(
  xk: Uint32Array,
  s0: number,
  s1: number,
  s2: number,
  s3: number
): {
  s0: number;
  s1: number;
  s2: number;
  s3: number;
} {
  const { sbox2, T01, T23 } = tableDecoding;
  let k = 0;
  ((s0 ^= xk[k++]), (s1 ^= xk[k++]), (s2 ^= xk[k++]), (s3 ^= xk[k++]));
  const rounds = xk.length / 4 - 2;
  for (let i = 0; i < rounds; i++) {
    const t0 = xk[k++] ^ apply0123(T01, T23, s0, s3, s2, s1);
    const t1 = xk[k++] ^ apply0123(T01, T23, s1, s0, s3, s2);
    const t2 = xk[k++] ^ apply0123(T01, T23, s2, s1, s0, s3);
    const t3 = xk[k++] ^ apply0123(T01, T23, s3, s2, s1, s0);
    ((s0 = t0), (s1 = t1), (s2 = t2), (s3 = t3));
  }
  // Last round
  const t0: number = xk[k++] ^ applySbox(sbox2, s0, s3, s2, s1);
  const t1: number = xk[k++] ^ applySbox(sbox2, s1, s0, s3, s2);
  const t2: number = xk[k++] ^ applySbox(sbox2, s2, s1, s0, s3);
  const t3: number = xk[k++] ^ applySbox(sbox2, s3, s2, s1, s0);
  return { s0: t0, s1: t1, s2: t2, s3: t3 };
}

// TODO: investigate merging with ctr32
function ctrCounter(
  xk: Uint32Array,
  nonce: Uint8Array,
  src: Uint8Array,
  dst?: Uint8Array
): Uint8Array {
  abytes(nonce, BLOCK_SIZE, 'nonce');
  abytes(src);
  const srcLen = src.length;
  dst = getOutput(srcLen, dst);
  complexOverlapBytes(src, dst);
  const ctr = nonce;
  const c32 = u32(ctr);
  // Fill block (empty, ctr=0)
  let { s0, s1, s2, s3 } = encrypt(xk, c32[0], c32[1], c32[2], c32[3]);
  const src32 = u32(src);
  const dst32 = u32(dst);
  // process blocks
  for (let i = 0; i + 4 <= src32.length; i += 4) {
    dst32[i + 0] = src32[i + 0] ^ s0;
    dst32[i + 1] = src32[i + 1] ^ s1;
    dst32[i + 2] = src32[i + 2] ^ s2;
    dst32[i + 3] = src32[i + 3] ^ s3;
    incBytes(ctr, false, 1); // Full 128 bit counter with wrap around
    ({ s0, s1, s2, s3 } = encrypt(xk, c32[0], c32[1], c32[2], c32[3]));
  }
  // leftovers (less than block)
  // It's possible to handle > u32 fast, but is it worth it?
  const start = BLOCK_SIZE * Math.floor(src32.length / BLOCK_SIZE32);
  if (start < srcLen) {
    const b32 = new Uint32Array([s0, s1, s2, s3]);
    const buf = u8(b32);
    for (let i = start, pos = 0; i < srcLen; i++, pos++) dst[i] = src[i] ^ buf[pos];
    clean(b32);
  }
  return dst;
}

// AES CTR with overflowing 32 bit counter
// It's possible to do 32le significantly simpler (and probably faster) by using u32.
// But, we need both, and perf bottleneck is in ghash anyway.
function ctr32(
  xk: Uint32Array,
  isLE: boolean,
  nonce: Uint8Array,
  src: Uint8Array,
  dst?: Uint8Array
): Uint8Array {
  abytes(nonce, BLOCK_SIZE, 'nonce');
  abytes(src);
  dst = getOutput(src.length, dst);
  const ctr = nonce; // write new value to nonce, so it can be re-used
  const c32 = u32(ctr);
  const view = createView(ctr);
  const src32 = u32(src);
  const dst32 = u32(dst);
  const ctrPos = isLE ? 0 : 12;
  const srcLen = src.length;
  // Fill block (empty, ctr=0)
  let ctrNum = view.getUint32(ctrPos, isLE); // read current counter value
  let { s0, s1, s2, s3 } = encrypt(xk, c32[0], c32[1], c32[2], c32[3]);
  // process blocks
  for (let i = 0; i + 4 <= src32.length; i += 4) {
    dst32[i + 0] = src32[i + 0] ^ s0;
    dst32[i + 1] = src32[i + 1] ^ s1;
    dst32[i + 2] = src32[i + 2] ^ s2;
    dst32[i + 3] = src32[i + 3] ^ s3;
    ctrNum = (ctrNum + 1) >>> 0; // u32 wrap
    view.setUint32(ctrPos, ctrNum, isLE);
    ({ s0, s1, s2, s3 } = encrypt(xk, c32[0], c32[1], c32[2], c32[3]));
  }
  // leftovers (less than a block)
  const start = BLOCK_SIZE * Math.floor(src32.length / BLOCK_SIZE32);
  if (start < srcLen) {
    const b32 = new Uint32Array([s0, s1, s2, s3]);
    const buf = u8(b32);
    for (let i = start, pos = 0; i < srcLen; i++, pos++) dst[i] = src[i] ^ buf[pos];
    clean(b32);
  }
  return dst;
}

/**
 * **CTR** (Counter Mode): Turns a block cipher into a stream cipher using a counter and IV (nonce).
 * Efficient and parallelizable. Requires a unique nonce per encryption. Unauthenticated: needs MAC.
 */
export const ctr: ((key: Uint8Array, nonce: Uint8Array) => CipherWithOutput) & {
  blockSize: number;
  nonceLength: number;
} = /* @__PURE__ */ wrapCipher(
  { blockSize: 16, nonceLength: 16 },
  function aesctr(key: Uint8Array, nonce: Uint8Array): CipherWithOutput {
    function processCtr(buf: Uint8Array, dst?: Uint8Array) {
      abytes(buf);
      if (dst !== undefined) {
        abytes(dst);
        if (!isAligned32(dst)) throw new Error('unaligned destination');
      }
      const xk = expandKeyLE(key);
      const n = copyBytes(nonce); // align + avoid changing
      const toClean = [xk, n];
      if (!isAligned32(buf)) toClean.push((buf = copyBytes(buf)));
      const out = ctrCounter(xk, n, buf, dst);
      clean(...toClean);
      return out;
    }
    return {
      encrypt: (plaintext: Uint8Array, dst?: Uint8Array) => processCtr(plaintext, dst),
      decrypt: (ciphertext: Uint8Array, dst?: Uint8Array) => processCtr(ciphertext, dst),
    };
  }
);

function validateBlockDecrypt(data: Uint8Array) {
  abytes(data);
  if (data.length % BLOCK_SIZE !== 0) {
    throw new Error(
      'aes-(cbc/ecb).decrypt ciphertext should consist of blocks with size ' + BLOCK_SIZE
    );
  }
}

function validatePCKS(data: Uint8Array, pcks5: boolean) {
  if (!pcks5) return data;
  const len = data.length;
  if (!len) throw new Error('aes/pcks5: empty ciphertext not allowed');
  const lastByte = data[len - 1];
  if (lastByte <= 0 || lastByte > 16) throw new Error('aes/pcks5: wrong padding');
  const out = data.subarray(0, -lastByte);
  for (let i = 0; i < lastByte; i++)
    if (data[len - i - 1] !== lastByte) throw new Error('aes/pcks5: wrong padding');
  return out;
}

function padPCKS(left: Uint8Array) {
  const tmp = new Uint8Array(16);
  const tmp32 = u32(tmp);
  tmp.set(left);
  const paddingByte = BLOCK_SIZE - left.length;
  for (let i = BLOCK_SIZE - paddingByte; i < BLOCK_SIZE; i++) tmp[i] = paddingByte;
  return tmp32;
}

/** Options for ECB and CBC. */
export type BlockOpts = { disablePadding?: boolean };

/**
 * **ECB** (Electronic Codebook): Deterministic encryption; identical plaintext blocks yield
 * identical ciphertexts. Not secure due to pattern leakage.
 * See [AES Penguin](https://words.filippo.io/the-ecb-penguin/).
 */
export const ecb: ((key: Uint8Array, opts?: BlockOpts) => CipherWithOutput) & {
  blockSize: number;
} = /* @__PURE__ */ wrapCipher(
  { blockSize: 16 },
  function aesecb(key: Uint8Array, opts: BlockOpts = {}): CipherWithOutput {
    const pcks5 = !opts.disablePadding;
    return {
      encrypt(plaintext: Uint8Array, dst?: Uint8Array) {
        const { b, o, out: _out } = validateBlockEncrypt(plaintext, pcks5, dst);
        const xk = expandKeyLE(key);
        let i = 0;
        for (; i + 4 <= b.length; ) {
          const { s0, s1, s2, s3 } = encrypt(xk, b[i + 0], b[i + 1], b[i + 2], b[i + 3]);
          ((o[i++] = s0), (o[i++] = s1), (o[i++] = s2), (o[i++] = s3));
        }
        if (pcks5) {
          const tmp32 = padPCKS(plaintext.subarray(i * 4));
          const { s0, s1, s2, s3 } = encrypt(xk, tmp32[0], tmp32[1], tmp32[2], tmp32[3]);
          ((o[i++] = s0), (o[i++] = s1), (o[i++] = s2), (o[i++] = s3));
        }
        clean(xk);
        return _out;
      },
      decrypt(ciphertext: Uint8Array, dst?: Uint8Array) {
        validateBlockDecrypt(ciphertext);
        const xk = expandKeyDecLE(key);
        dst = getOutput(ciphertext.length, dst);
        const toClean: (Uint8Array | Uint32Array)[] = [xk];
        if (!isAligned32(ciphertext)) toClean.push((ciphertext = copyBytes(ciphertext)));
        complexOverlapBytes(ciphertext, dst);
        const b = u32(ciphertext);
        const o = u32(dst);
        for (let i = 0; i + 4 <= b.length; ) {
          const { s0, s1, s2, s3 } = decrypt(xk, b[i + 0], b[i + 1], b[i + 2], b[i + 3]);
          ((o[i++] = s0), (o[i++] = s1), (o[i++] = s2), (o[i++] = s3));
        }
        clean(...toClean);
        return validatePCKS(dst, pcks5);
      },
    };
  }
);

/**
 * **CBC** (Cipher Block Chaining): Each plaintext block is XORed with the
 * previous block of ciphertext before encryption.
 * Hard to use: requires proper padding and an IV. Unauthenticated: needs MAC.
 */
export const cbc: ((key: Uint8Array, iv: Uint8Array, opts?: BlockOpts) => CipherWithOutput) & {
  blockSize: number;
  nonceLength: number;
} = /* @__PURE__ */ wrapCipher(
  { blockSize: 16, nonceLength: 16 },
  function aescbc(key: Uint8Array, iv: Uint8Array, opts: BlockOpts = {}): CipherWithOutput {
    const pcks5 = !opts.disablePadding;
    return {
      encrypt(plaintext: Uint8Array, dst?: Uint8Array) {
        const xk = expandKeyLE(key);
        const { b, o, out: _out } = validateBlockEncrypt(plaintext, pcks5, dst);
        let _iv = iv;
        const toClean: (Uint8Array | Uint32Array)[] = [xk];
        if (!isAligned32(_iv)) toClean.push((_iv = copyBytes(_iv)));
        const n32 = u32(_iv);
        // prettier-ignore
        let s0 = n32[0], s1 = n32[1], s2 = n32[2], s3 = n32[3];
        let i = 0;
        for (; i + 4 <= b.length; ) {
          ((s0 ^= b[i + 0]), (s1 ^= b[i + 1]), (s2 ^= b[i + 2]), (s3 ^= b[i + 3]));
          ({ s0, s1, s2, s3 } = encrypt(xk, s0, s1, s2, s3));
          ((o[i++] = s0), (o[i++] = s1), (o[i++] = s2), (o[i++] = s3));
        }
        if (pcks5) {
          const tmp32 = padPCKS(plaintext.subarray(i * 4));
          ((s0 ^= tmp32[0]), (s1 ^= tmp32[1]), (s2 ^= tmp32[2]), (s3 ^= tmp32[3]));
          ({ s0, s1, s2, s3 } = encrypt(xk, s0, s1, s2, s3));
          ((o[i++] = s0), (o[i++] = s1), (o[i++] = s2), (o[i++] = s3));
        }
        clean(...toClean);
        return _out;
      },
      decrypt(ciphertext: Uint8Array, dst?: Uint8Array) {
        validateBlockDecrypt(ciphertext);
        const xk = expandKeyDecLE(key);
        let _iv = iv;
        const toClean: (Uint8Array | Uint32Array)[] = [xk];
        if (!isAligned32(_iv)) toClean.push((_iv = copyBytes(_iv)));
        const n32 = u32(_iv);
        dst = getOutput(ciphertext.length, dst);
        if (!isAligned32(ciphertext)) toClean.push((ciphertext = copyBytes(ciphertext)));
        complexOverlapBytes(ciphertext, dst);
        const b = u32(ciphertext);
        const o = u32(dst);
        // prettier-ignore
        let s0 = n32[0], s1 = n32[1], s2 = n32[2], s3 = n32[3];
        for (let i = 0; i + 4 <= b.length; ) {
          // prettier-ignore
          const ps0 = s0, ps1 = s1, ps2 = s2, ps3 = s3;
          ((s0 = b[i + 0]), (s1 = b[i + 1]), (s2 = b[i + 2]), (s3 = b[i + 3]));
          const { s0: o0, s1: o1, s2: o2, s3: o3 } = decrypt(xk, s0, s1, s2, s3);
          ((o[i++] = o0 ^ ps0), (o[i++] = o1 ^ ps1), (o[i++] = o2 ^ ps2), (o[i++] = o3 ^ ps3));
        }
        clean(...toClean);
        return validatePCKS(dst, pcks5);
      },
    };
  }
);

/**
 * CFB: Cipher Feedback Mode. The input for the block cipher is the previous cipher output.
 * Unauthenticated: needs MAC.
 */
export const cfb: ((key: Uint8Array, iv: Uint8Array) => CipherWithOutput) & {
  blockSize: number;
  nonceLength: number;
} = /* @__PURE__ */ wrapCipher(
  { blockSize: 16, nonceLength: 16 },
  function aescfb(key: Uint8Array, iv: Uint8Array): CipherWithOutput {
    function processCfb(src: Uint8Array, isEncrypt: boolean, dst?: Uint8Array) {
      abytes(src);
      const srcLen = src.length;
      dst = getOutput(srcLen, dst);
      if (overlapBytes(src, dst)) throw new Error('overlapping src and dst not supported.');
      const xk = expandKeyLE(key);
      let _iv = iv;
      const toClean: (Uint8Array | Uint32Array)[] = [xk];
      if (!isAligned32(_iv)) toClean.push((_iv = copyBytes(_iv)));
      if (!isAligned32(src)) toClean.push((src = copyBytes(src)));
      const src32 = u32(src);
      const dst32 = u32(dst);
      const next32 = isEncrypt ? dst32 : src32;
      const n32 = u32(_iv);
      // prettier-ignore
      let s0 = n32[0], s1 = n32[1], s2 = n32[2], s3 = n32[3];
      for (let i = 0; i + 4 <= src32.length; ) {
        const { s0: e0, s1: e1, s2: e2, s3: e3 } = encrypt(xk, s0, s1, s2, s3);
        dst32[i + 0] = src32[i + 0] ^ e0;
        dst32[i + 1] = src32[i + 1] ^ e1;
        dst32[i + 2] = src32[i + 2] ^ e2;
        dst32[i + 3] = src32[i + 3] ^ e3;
        ((s0 = next32[i++]), (s1 = next32[i++]), (s2 = next32[i++]), (s3 = next32[i++]));
      }
      // leftovers (less than block)
      const start = BLOCK_SIZE * Math.floor(src32.length / BLOCK_SIZE32);
      if (start < srcLen) {
        ({ s0, s1, s2, s3 } = encrypt(xk, s0, s1, s2, s3));
        const buf = u8(new Uint32Array([s0, s1, s2, s3]));
        for (let i = start, pos = 0; i < srcLen; i++, pos++) dst[i] = src[i] ^ buf[pos];
        clean(buf);
      }
      clean(...toClean);
      return dst;
    }
    return {
      encrypt: (plaintext: Uint8Array, dst?: Uint8Array) => processCfb(plaintext, true, dst),
      decrypt: (ciphertext: Uint8Array, dst?: Uint8Array) => processCfb(ciphertext, false, dst),
    };
  }
);

// TODO: merge with chacha, however gcm has bitLen while chacha has byteLen
function computeTag(
  fn: typeof ghash,
  isLE: boolean,
  key: Uint8Array,
  data: Uint8Array,
  AAD?: Uint8Array
) {
  const aadLength = AAD ? AAD.length : 0;
  const h = fn.create(key, data.length + aadLength);
  if (AAD) h.update(AAD);
  const num = u64Lengths(8 * data.length, 8 * aadLength, isLE);
  h.update(data);
  h.update(num);
  const res = h.digest();
  clean(num);
  return res;
}

/**
 * **GCM** (Galois/Counter Mode): Combines CTR mode with polynomial MAC. Efficient and widely used.
 * Not perfect:
 * a) conservative key wear-out is `2**32` (4B) msgs.
 * b) key wear-out under random nonces is even smaller: `2**23` (8M) messages for `2**-50` chance.
 * c) MAC can be forged: see Poly1305 documentation.
 */
export const gcm: ((key: Uint8Array, nonce: Uint8Array, AAD?: Uint8Array) => Cipher) & {
  blockSize: number;
  nonceLength: number;
  tagLength: number;
  varSizeNonce: true;
} = /* @__PURE__ */ wrapCipher(
  { blockSize: 16, nonceLength: 12, tagLength: 16, varSizeNonce: true },
  function aesgcm(key: Uint8Array, nonce: Uint8Array, AAD?: Uint8Array): Cipher {
    // NIST 800-38d doesn't enforce minimum nonce length.
    // We enforce 8 bytes for compat with openssl.
    // 12 bytes are recommended. More than 12 bytes would be converted into 12.
    if (nonce.length < 8) throw new Error('aes/gcm: invalid nonce length');
    const tagLength = 16;
    function _computeTag(authKey: Uint8Array, tagMask: Uint8Array, data: Uint8Array) {
      const tag = computeTag(ghash, false, authKey, data, AAD);
      for (let i = 0; i < tagMask.length; i++) tag[i] ^= tagMask[i];
      return tag;
    }
    function deriveKeys() {
      const xk = expandKeyLE(key);
      const authKey = EMPTY_BLOCK.slice();
      const counter = EMPTY_BLOCK.slice();
      ctr32(xk, false, counter, counter, authKey);
      // NIST 800-38d, page 15: different behavior for 96-bit and non-96-bit nonces
      if (nonce.length === 12) {
        counter.set(nonce);
      } else {
        const nonceLen = EMPTY_BLOCK.slice();
        const view = createView(nonceLen);
        view.setBigUint64(8, BigInt(nonce.length * 8), false);
        // ghash(nonce || u64be(0) || u64be(nonceLen*8))
        const g = ghash.create(authKey).update(nonce).update(nonceLen);
        g.digestInto(counter); // digestInto doesn't trigger '.destroy'
        g.destroy();
      }
      const tagMask = ctr32(xk, false, counter, EMPTY_BLOCK);
      return { xk, authKey, counter, tagMask };
    }
    return {
      encrypt(plaintext: Uint8Array) {
        const { xk, authKey, counter, tagMask } = deriveKeys();
        const out = new Uint8Array(plaintext.length + tagLength);
        const toClean: (Uint8Array | Uint32Array)[] = [xk, authKey, counter, tagMask];
        if (!isAligned32(plaintext)) toClean.push((plaintext = copyBytes(plaintext)));
        ctr32(xk, false, counter, plaintext, out.subarray(0, plaintext.length));
        const tag = _computeTag(authKey, tagMask, out.subarray(0, out.length - tagLength));
        toClean.push(tag);
        out.set(tag, plaintext.length);
        clean(...toClean);
        return out;
      },
      decrypt(ciphertext: Uint8Array) {
        const { xk, authKey, counter, tagMask } = deriveKeys();
        const toClean: (Uint8Array | Uint32Array)[] = [xk, authKey, tagMask, counter];
        if (!isAligned32(ciphertext)) toClean.push((ciphertext = copyBytes(ciphertext)));
        const data = ciphertext.subarray(0, -tagLength);
        const passedTag = ciphertext.subarray(-tagLength);
        const tag = _computeTag(authKey, tagMask, data);
        toClean.push(tag);
        if (!equalBytes(tag, passedTag)) throw new Error('aes/gcm: invalid ghash tag');
        const out = ctr32(xk, false, counter, data);
        clean(...toClean);
        return out;
      },
    };
  }
);

const limit = (name: string, min: number, max: number) => (value: number) => {
  if (!Number.isSafeInteger(value) || min > value || value > max) {
    const minmax = '[' + min + '..' + max + ']';
    throw new Error('' + name + ': expected value in range ' + minmax + ', got ' + value);
  }
};

/**
 * **SIV** (Synthetic IV): GCM with nonce-misuse resistance.
 * Repeating nonces reveal only the fact plaintexts are identical.
 * Also suffers from GCM issues: key wear-out limits & MAC forging.
 * See [RFC 8452](https://www.rfc-editor.org/rfc/rfc8452).
 */
export const gcmsiv: ((key: Uint8Array, nonce: Uint8Array, AAD?: Uint8Array) => Cipher) & {
  blockSize: number;
  nonceLength: number;
  tagLength: number;
  varSizeNonce: true;
} = /* @__PURE__ */ wrapCipher(
  { blockSize: 16, nonceLength: 12, tagLength: 16, varSizeNonce: true },
  function aessiv(key: Uint8Array, nonce: Uint8Array, AAD?: Uint8Array): Cipher {
    const tagLength = 16;
    // From RFC 8452: Section 6
    const AAD_LIMIT = limit('AAD', 0, 2 ** 36);
    const PLAIN_LIMIT = limit('plaintext', 0, 2 ** 36);
    const NONCE_LIMIT = limit('nonce', 12, 12);
    const CIPHER_LIMIT = limit('ciphertext', 16, 2 ** 36 + 16);
    abytes(key);
    validateKeyLength(key);
    NONCE_LIMIT(nonce.length);
    if (AAD !== undefined) AAD_LIMIT(AAD.length);
    function deriveKeys() {
      const xk = expandKeyLE(key);
      const encKey = new Uint8Array(key.length);
      const authKey = new Uint8Array(16);
      const toClean: (Uint8Array | Uint32Array)[] = [xk, encKey];
      let _nonce = nonce;
      if (!isAligned32(_nonce)) toClean.push((_nonce = copyBytes(_nonce)));
      const n32 = u32(_nonce);
      // prettier-ignore
      let s0 = 0, s1 = n32[0], s2 = n32[1], s3 = n32[2];
      let counter = 0;
      for (const derivedKey of [authKey, encKey].map(u32)) {
        const d32 = u32(derivedKey);
        for (let i = 0; i < d32.length; i += 2) {
          // aes(u32le(0) || nonce)[:8] || aes(u32le(1) || nonce)[:8] ...
          const { s0: o0, s1: o1 } = encrypt(xk, s0, s1, s2, s3);
          d32[i + 0] = o0;
          d32[i + 1] = o1;
          s0 = ++counter; // increment counter inside state
        }
      }
      const res = { authKey, encKey: expandKeyLE(encKey) };
      // Cleanup
      clean(...toClean);
      return res;
    }
    function _computeTag(encKey: Uint32Array, authKey: Uint8Array, data: Uint8Array) {
      const tag = computeTag(polyval, true, authKey, data, AAD);
      // Compute the expected tag by XORing S_s and the nonce, clearing the
      // most significant bit of the last byte and encrypting with the
      // message-encryption key.
      for (let i = 0; i < 12; i++) tag[i] ^= nonce[i];
      tag[15] &= 0x7f; // Clear the highest bit
      // encrypt tag as block
      const t32 = u32(tag);
      // prettier-ignore
      let s0 = t32[0], s1 = t32[1], s2 = t32[2], s3 = t32[3];
      ({ s0, s1, s2, s3 } = encrypt(encKey, s0, s1, s2, s3));
      ((t32[0] = s0), (t32[1] = s1), (t32[2] = s2), (t32[3] = s3));
      return tag;
    }
    // actual decrypt/encrypt of message.
    function processSiv(encKey: Uint32Array, tag: Uint8Array, input: Uint8Array) {
      let block = copyBytes(tag);
      block[15] |= 0x80; // Force highest bit
      const res = ctr32(encKey, true, block, input);
      // Cleanup
      clean(block);
      return res;
    }
    return {
      encrypt(plaintext: Uint8Array) {
        PLAIN_LIMIT(plaintext.length);
        const { encKey, authKey } = deriveKeys();
        const tag = _computeTag(encKey, authKey, plaintext);
        const toClean: (Uint8Array | Uint32Array)[] = [encKey, authKey, tag];
        if (!isAligned32(plaintext)) toClean.push((plaintext = copyBytes(plaintext)));
        const out = new Uint8Array(plaintext.length + tagLength);
        out.set(tag, plaintext.length);
        out.set(processSiv(encKey, tag, plaintext));
        // Cleanup
        clean(...toClean);
        return out;
      },
      decrypt(ciphertext: Uint8Array) {
        CIPHER_LIMIT(ciphertext.length);
        const tag = ciphertext.subarray(-tagLength);
        const { encKey, authKey } = deriveKeys();
        const toClean: (Uint8Array | Uint32Array)[] = [encKey, authKey];
        if (!isAligned32(ciphertext)) toClean.push((ciphertext = copyBytes(ciphertext)));
        const plaintext = processSiv(encKey, tag, ciphertext.subarray(0, -tagLength));
        const expectedTag = _computeTag(encKey, authKey, plaintext);
        toClean.push(expectedTag);
        if (!equalBytes(tag, expectedTag)) {
          clean(...toClean);
          throw new Error('invalid polyval tag');
        }
        // Cleanup
        clean(...toClean);
        return plaintext;
      },
    };
  }
);

function isBytes32(a: unknown): a is Uint32Array {
  return (
    a instanceof Uint32Array || (ArrayBuffer.isView(a) && a.constructor.name === 'Uint32Array')
  );
}

function encryptBlock(xk: Uint32Array, block: Uint8Array): Uint8Array {
  abytes(block, 16, 'block');
  if (!isBytes32(xk)) throw new Error('_encryptBlock accepts result of expandKeyLE');
  const b32 = u32(block);
  let { s0, s1, s2, s3 } = encrypt(xk, b32[0], b32[1], b32[2], b32[3]);
  ((b32[0] = s0), (b32[1] = s1), (b32[2] = s2), (b32[3] = s3));
  return block;
}

function decryptBlock(xk: Uint32Array, block: Uint8Array): Uint8Array {
  abytes(block, 16, 'block');
  if (!isBytes32(xk)) throw new Error('_decryptBlock accepts result of expandKeyLE');
  const b32 = u32(block);
  let { s0, s1, s2, s3 } = decrypt(xk, b32[0], b32[1], b32[2], b32[3]);
  ((b32[0] = s0), (b32[1] = s1), (b32[2] = s2), (b32[3] = s3));
  return block;
}

/**
 * AES-W (base for AESKW/AESKWP).
 * Specs: [SP800-38F](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf),
 * [RFC 3394](https://www.rfc-editor.org/rfc/rfc3394),
 * [RFC 5649](https://www.rfc-editor.org/rfc/rfc5649).
 */
const AESW = {
  /*
  High-level pseudocode:
  ```
  A: u64 = IV
  out = []
  for (let i=0, ctr = 0; i<6; i++) {
    for (const chunk of chunks(plaintext, 8)) {
      A ^= swapEndianess(ctr++)
      [A, res] = chunks(encrypt(A || chunk), 8);
      out ||= res
    }
  }
  out = A || out
  ```
  Decrypt is the same, but reversed.
  */
  encrypt(kek: Uint8Array, out: Uint8Array) {
    // Size is limited to 4GB, otherwise ctr will overflow and we'll need to switch to bigints.
    // If you need it larger, open an issue.
    if (out.length >= 2 ** 32) throw new Error('plaintext should be less than 4gb');
    const xk = expandKeyLE(kek);
    if (out.length === 16) encryptBlock(xk, out);
    else {
      const o32 = u32(out);
      // prettier-ignore
      let a0 = o32[0], a1 = o32[1]; // A
      for (let j = 0, ctr = 1; j < 6; j++) {
        for (let pos = 2; pos < o32.length; pos += 2, ctr++) {
          const { s0, s1, s2, s3 } = encrypt(xk, a0, a1, o32[pos], o32[pos + 1]);
          // A = MSB(64, B) ^ t where t = (n*j)+i
          ((a0 = s0), (a1 = s1 ^ byteSwap(ctr)), (o32[pos] = s2), (o32[pos + 1] = s3));
        }
      }
      ((o32[0] = a0), (o32[1] = a1)); // out = A || out
    }
    xk.fill(0);
  },
  decrypt(kek: Uint8Array, out: Uint8Array) {
    if (out.length - 8 >= 2 ** 32) throw new Error('ciphertext should be less than 4gb');
    const xk = expandKeyDecLE(kek);
    const chunks = out.length / 8 - 1; // first chunk is IV
    if (chunks === 1) decryptBlock(xk, out);
    else {
      const o32 = u32(out);
      // prettier-ignore
      let a0 = o32[0], a1 = o32[1]; // A
      for (let j = 0, ctr = chunks * 6; j < 6; j++) {
        for (let pos = chunks * 2; pos >= 1; pos -= 2, ctr--) {
          a1 ^= byteSwap(ctr);
          const { s0, s1, s2, s3 } = decrypt(xk, a0, a1, o32[pos], o32[pos + 1]);
          ((a0 = s0), (a1 = s1), (o32[pos] = s2), (o32[pos + 1] = s3));
        }
      }
      ((o32[0] = a0), (o32[1] = a1));
    }
    xk.fill(0);
  },
};

const AESKW_IV = /* @__PURE__ */ new Uint8Array(8).fill(0xa6); // A6A6A6A6A6A6A6A6

/**
 * AES-KW (key-wrap). Injects static IV into plaintext, adds counter, encrypts 6 times.
 * Reduces block size from 16 to 8 bytes.
 * For padded version, use aeskwp.
 * [RFC 3394](https://www.rfc-editor.org/rfc/rfc3394/),
 * [NIST.SP.800-38F](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf).
 */
export const aeskw: ((kek: Uint8Array) => Cipher) & {
  blockSize: number;
} = /* @__PURE__ */ wrapCipher(
  { blockSize: 8 },
  (kek: Uint8Array): Cipher => ({
    encrypt(plaintext: Uint8Array) {
      if (!plaintext.length || plaintext.length % 8 !== 0)
        throw new Error('invalid plaintext length');
      if (plaintext.length === 8)
        throw new Error('8-byte keys not allowed in AESKW, use AESKWP instead');
      const out = concatBytes(AESKW_IV, plaintext);
      AESW.encrypt(kek, out);
      return out;
    },
    decrypt(ciphertext: Uint8Array) {
      // ciphertext must be at least 24 bytes and a multiple of 8 bytes
      // 24 because should have at least two block (1 iv + 2).
      // Replace with 16 to enable '8-byte keys'
      if (ciphertext.length % 8 !== 0 || ciphertext.length < 3 * 8)
        throw new Error('invalid ciphertext length');
      const out = copyBytes(ciphertext);
      AESW.decrypt(kek, out);
      if (!equalBytes(out.subarray(0, 8), AESKW_IV)) throw new Error('integrity check failed');
      out.subarray(0, 8).fill(0); // ciphertext.subarray(0, 8) === IV, but we clean it anyway
      return out.subarray(8);
    },
  })
);

/*
We don't support 8-byte keys. The rabbit hole:

- Wycheproof says: "NIST SP 800-38F does not define the wrapping of 8 byte keys.
  RFC 3394 Section 2  on the other hand specifies that 8 byte keys are wrapped
  by directly encrypting one block with AES."
    - https://github.com/C2SP/wycheproof/blob/master/doc/key_wrap.md
    - "RFC 3394 specifies in Section 2, that the input for the key wrap
      algorithm must be at least two blocks and otherwise the constant
      field and key are simply encrypted with ECB as a single block"
- What RFC 3394 actually says (in Section 2):
    - "Before being wrapped, the key data is parsed into n blocks of 64 bits.
      The only restriction the key wrap algorithm places on n is that n be
      at least two"
    - "For key data with length less than or equal to 64 bits, the constant
      field used in this specification and the key data form a single
      128-bit codebook input making this key wrap unnecessary."
- Which means "assert(n >= 2)" and "use something else for 8 byte keys"
- NIST SP800-38F actually prohibits 8-byte in "5.3.1 Mandatory Limits".
  It states that plaintext for KW should be "2 to 2^54 -1 semiblocks".
- So, where does "directly encrypt single block with AES" come from?
    - Not RFC 3394. Pseudocode of key wrap in 2.2 explicitly uses
      loop of 6 for any code path
    - There is a weird W3C spec:
      https://www.w3.org/TR/2002/REC-xmlenc-core-20021210/Overview.html#kw-aes128
    - This spec is outdated, as admitted by Wycheproof authors
    - There is RFC 5649 for padded key wrap, which is padding construction on
      top of AESKW. In '4.1.2' it says: "If the padded plaintext contains exactly
      eight octets, then prepend the AIV as defined in Section 3 above to P[1] and
      encrypt the resulting 128-bit block using AES in ECB mode [Modes] with key
      K (the KEK).  In this case, the output is two 64-bit blocks C[0] and C[1]:"
    - Browser subtle crypto is actually crashes on wrapping keys less than 16 bytes:
      `Error: error:1C8000E6:Provider routines::invalid input length] { opensslErrorStack: [ 'error:030000BD:digital envelope routines::update error' ]`

In the end, seems like a bug in Wycheproof.
The 8-byte check can be easily disabled inside of AES_W.
*/

const AESKWP_IV = 0xa65959a6; // single u32le value

/**
 * AES-KW, but with padding and allows random keys.
 * Second u32 of IV is used as counter for length.
 * [RFC 5649](https://www.rfc-editor.org/rfc/rfc5649)
 */
export const aeskwp: ((kek: Uint8Array) => Cipher) & {
  blockSize: number;
} = /* @__PURE__ */ wrapCipher(
  { blockSize: 8 },
  (kek: Uint8Array): Cipher => ({
    encrypt(plaintext: Uint8Array) {
      if (!plaintext.length) throw new Error('invalid plaintext length');
      const padded = Math.ceil(plaintext.length / 8) * 8;
      const out = new Uint8Array(8 + padded);
      out.set(plaintext, 8);
      const out32 = u32(out);
      out32[0] = AESKWP_IV;
      out32[1] = byteSwap(plaintext.length);
      AESW.encrypt(kek, out);
      return out;
    },
    decrypt(ciphertext: Uint8Array) {
      // 16 because should have at least one block
      if (ciphertext.length < 16) throw new Error('invalid ciphertext length');
      const out = copyBytes(ciphertext);
      const o32 = u32(out);
      AESW.decrypt(kek, out);
      const len = byteSwap(o32[1]) >>> 0;
      const padded = Math.ceil(len / 8) * 8;
      if (o32[0] !== AESKWP_IV || out.length - 8 !== padded)
        throw new Error('integrity check failed');
      for (let i = len; i < padded; i++)
        if (out[8 + i] !== 0) throw new Error('integrity check failed');
      out.subarray(0, 8).fill(0); // ciphertext.subarray(0, 8) === IV, but we clean it anyway
      return out.subarray(8, 8 + len);
    },
  })
);

class _AesCtrDRBG implements PRG {
  readonly blockLen: number;
  private key: Uint8Array;
  private nonce: Uint8Array;
  private state: Uint8Array;
  private reseedCnt: number;
  constructor(keyLen: number, seed: Uint8Array, personalization?: Uint8Array) {
    this.blockLen = ctr.blockSize;
    const keyLenBytes = keyLen / 8;
    const nonceLen = 16;
    this.state = new Uint8Array(keyLenBytes + nonceLen);
    this.key = this.state.subarray(0, keyLenBytes);
    this.nonce = this.state.subarray(keyLenBytes, keyLenBytes + nonceLen);
    this.reseedCnt = 1;
    incBytes(this.nonce, false, 1);
    this.addEntropy(seed, personalization);
  }
  private update(data?: Uint8Array) {
    // cannot re-use state here, because we will wipe current key
    ctr(this.key, this.nonce).encrypt(new Uint8Array(this.state.length), this.state);
    if (data) {
      abytes(data);
      for (let i = 0; i < data.length; i++) this.state[i] ^= data[i];
    }
    incBytes(this.nonce, false, 1);
  }
  addEntropy(seed: Uint8Array, info?: Uint8Array): void {
    abytes(seed, this.state.length, 'seed');
    const _seed = seed.slice();
    if (info) {
      abytes(info);
      if (info.length > _seed.length) throw new Error('info length is too big');
      for (let i = 0; i < info.length; i++) _seed[i] ^= info[i];
    }
    this.update(_seed);
    _seed.fill(0);
    this.reseedCnt = 1;
  }
  randomBytes(len: number, info?: Uint8Array): Uint8Array {
    anumber(len);
    if (this.reseedCnt++ >= 2 ** 48) throw new Error('entropy exhausted');
    if (info) this.update(info);
    const res = new Uint8Array(len);
    ctr(this.key, this.nonce).encrypt(res, res);
    incBytes(this.nonce, false, Math.ceil(len / this.blockLen));
    this.update(info);
    return res;
  }
  clean(): void {
    this.state.fill(0);
    this.reseedCnt = 0;
  }
}

export type AesCtrDrbg = (seed: Uint8Array, personalization?: Uint8Array) => _AesCtrDRBG;

const createAesDrbg: (keyLen: number) => AesCtrDrbg = (keyLen) => {
  return (seed, personalization = undefined) => new _AesCtrDRBG(keyLen, seed, personalization);
};

/**
 * AES-CTR DRBG 128-bit - CSPRNG (cryptographically secure pseudorandom number generator).
 * It's best to limit usage to non-production, non-critical cases: for example, test-only.
 */
export const rngAesCtrDrbg128: AesCtrDrbg = /* @__PURE__ */ createAesDrbg(128);
/**
 * AES-CTR DRBG 256-bit - CSPRNG (cryptographically secure pseudorandom number generator).
 * It's best to limit usage to non-production, non-critical cases: for example, test-only.
 */
export const rngAesCtrDrbg256: AesCtrDrbg = /* @__PURE__ */ createAesDrbg(256);

//#region CMAC

/**
 * Left-shift by one bit and conditionally XOR with 0x87:
 * ```
 * if MSB(L) is equal to 0
 * then    K1 := L << 1;
 * else    K1 := (L << 1) XOR const_Rb;
 * ```
 *
 * Specs: [RFC 4493, Section 2.3](https://www.rfc-editor.org/rfc/rfc4493.html#section-2.3),
 *        [RFC 5297 Section 2.3](https://datatracker.ietf.org/doc/html/rfc5297.html#section-2.3)
 *
 * @returns modified `block` (for chaining)
 */
function dbl<T extends Uint8Array>(block: T): T {
  let carry = 0;

// Left shift by 1 bit
  for (let i = BLOCK_SIZE - 1; i >= 0; i--) {
    const newCarry = (block[i] & 0x80) >>> 7;
    block[i] = (block[i] << 1) | carry;
    carry = newCarry;
  }

// XOR with 0x87 if there was a carry from the most significant bit
  if (carry) {
    block[BLOCK_SIZE - 1] ^= 0x87;
  }

return block;
}

/**
 * `a XOR b`, running in-site on `a`.
 * @param a left operand and output
 * @param b right operand
 * @returns `a` (for chaining)
 */
function xorBlock<T extends Uint8Array>(a: T, b: Uint8Array): T {
  if (a.length !== b.length) throw new Error('xorBlock: blocks must have same length');
  for (let i = 0; i < a.length; i++) {
    a[i] = a[i] ^ b[i];
  }
  return a;
}

/**
 * xorend as defined in [RFC 5297 Section 2.1](https://datatracker.ietf.org/doc/html/rfc5297.html#section-2.1).
 *
 * ```
 * leftmost(A, len(A)-len(B)) || (rightmost(A, len(B)) xor B)
 * ```
 */
function xorend<T extends Uint8Array>(a: T, b: Uint8Array): T {
  if (b.length > a.length) {
    throw new Error('xorend: len(B) must be less than or equal to len(A)');
  }
  // keep leftmost part of `a` unchanged
  // and xor only the rightmost part:
  const offset = a.length - b.length;
  for (let i = 0; i < b.length; i++) {
    a[offset + i] = a[offset + i] ^ b[i];
  }
  return a;
}

/**
 * Internal CMAC class.
 */
class _CMAC {
  private buffer: Uint8Array;
  private destroyed: boolean;
  private k1: Uint8Array;
  private k2: Uint8Array;
  private xk: Uint32Array;

constructor(key: Uint8Array) {
    abytes(key);
    validateKeyLength(key);
    this.xk = expandKeyLE(key);
    this.buffer = new Uint8Array(0);
    this.destroyed = false;
    // L = AES_encrypt(K, const_Zero)
    const L = new Uint8Array(BLOCK_SIZE);
    encryptBlock(this.xk, L);
    // Generate subkeys K1 and K2 from the main key according to
    // [RFC 4493, Section 2.3](https://www.rfc-editor.org/rfc/rfc4493.html#section-2.3)
    // K1
    this.k1 = dbl(L);
    this.k2 = dbl(new Uint8Array(this.k1));
  }

update(data: Uint8Array): _CMAC {
    const { destroyed, buffer } = this;
    if (destroyed) throw new Error('CMAC instance was destroyed');
    abytes(data);
    const newBuffer = new Uint8Array(buffer.length + data.length);
    newBuffer.set(buffer);
    newBuffer.set(data, buffer.length);
    this.buffer = newBuffer;
    return this;
  }

// see https://www.rfc-editor.org/rfc/rfc4493.html#section-2.4
  digest(): Uint8ArrayBuffer {
    if (this.destroyed) throw new Error('CMAC instance was destroyed');
    const { buffer } = this;
    const msgLen = buffer.length;

// Step 2:
    let n = Math.ceil(msgLen / BLOCK_SIZE); // n := ceil(len/const_Bsize);

// Step 3:
    let flag: boolean; // denoting if last block is complete or not
    if (n === 0) {
      n = 1;
      flag = false;
    } else {
      flag = msgLen % BLOCK_SIZE === 0; // if len mod const_Bsize is 0
    }

// Step 4:
    const lastBlockStart = (n - 1) * BLOCK_SIZE;
    const lastBlockData = buffer.subarray(lastBlockStart);
    let m_last: Uint8ArrayBuffer;
    if (flag) {
      // M_last := M_n XOR K1;
      m_last = xorBlock(new Uint8Array(lastBlockData), this.k1);
    } else {
      // M_last := padding(M_n) XOR K2;
      //
      // [...] padding(x) is the concatenation of x and a single '1',
      // followed by the minimum number of '0's, so that the total length is
      // equal to 128 bits.
      const padded = new Uint8Array(BLOCK_SIZE);
      padded.set(lastBlockData);
      padded[lastBlockData.length] = 0x80; // single '1' bit
      m_last = xorBlock(padded, this.k2);
    }

// Step 5:
    let x = new Uint8Array(BLOCK_SIZE); // X := const_Zero;

// Step 6:
    for (let i = 0; i < n - 1; i++) {
      const m_i = buffer.subarray(i * BLOCK_SIZE, (i + 1) * BLOCK_SIZE); // M_i
      xorBlock(x, m_i); // Y := X XOR M_i;
      encryptBlock(this.xk, x); // X := AES-128(K,Y);
    }

// Step 7:
    xorBlock(x, m_last); // Y := M_last XOR X;
    encryptBlock(this.xk, x); // T := AES-128(K,Y);

// cleanup:
    clean(m_last);

return x; // T
  }

destroy(): void {
    const { buffer, destroyed, xk, k1, k2 } = this;
    if (destroyed) return;
    this.destroyed = true;
    clean(buffer, xk, k1, k2);
  }
}

/**
 * AES-CMAC (Cipher-based Message Authentication Code).
 * Specs: [RFC 4493](https://www.rfc-editor.org/rfc/rfc4493.html).
 */
export const cmac: {
  (key: Uint8Array, message: Uint8Array): Uint8Array;
  create(key: Uint8Array): _CMAC;
} = (key: Uint8Array, message: Uint8Array): Uint8Array => new _CMAC(key).update(message).digest();
cmac.create = (key: Uint8Array): _CMAC => new _CMAC(key);

/**
 * S2V (Synthetic Initialization Vector) function as described in [RFC 5297 Section 2.4](https://datatracker.ietf.org/doc/html/rfc5297.html#section-2.4).
 *
 * ```
 * S2V(K, S1, ..., Sn) {
 *   if n = 0 then
 *     return V = AES-CMAC(K, <one>)
 *   fi
 *   D = AES-CMAC(K, <zero>)
 *   for i = 1 to n-1 do
 *     D = dbl(D) xor AES-CMAC(K, Si)
 *   done
 *   if len(Sn) >= 128 then
 *     T = Sn xorend D
 *   else
 *     T = dbl(D) xor pad(Sn)
 *   fi
 *   return V = AES-CMAC(K, T)
 * }
 * ```
 *
 * S2V takes a key and a vector of strings S1, S2, ..., Sn and returns a 128-bit string.
 * The S2V function is used to generate a synthetic IV for AES-SIV.
 *
 * @param key - AES key (128, 192, or 256 bits)
 * @param strings - Array of byte arrays to process
 * @returns 128-bit synthetic IV
 */
function s2v(key: Uint8Array, strings: Uint8Array[]): Uint8Array {
  validateKeyLength(key);
  const len = strings.length;
  if (len > 127) {
    // see https://datatracker.ietf.org/doc/html/rfc5297.html#section-7
    throw new Error('s2v: number of input strings must be less than or equal to 127');
  }

if (len === 0) return cmac(key, ONE_BLOCK);

// D = AES-CMAC(K, <zero>)
  let d = cmac(key, EMPTY_BLOCK);

// for i = 1 to n-1 do
  //   D = dbl(D) xor AES-CMAC(K, Si)
  for (let i = 0; i < len - 1; i++) {
    dbl(d);
    const cmacResult = cmac(key, strings[i]);
    xorBlock(d, cmacResult);
    clean(cmacResult);
  }

const s_n = strings[len - 1];
  let t: Uint8Array;

// if len(Sn) >= 128 then
  if (s_n.byteLength >= BLOCK_SIZE) {
    // T = Sn xorend D
    t = xorend(Uint8Array.from(s_n), d);
  } else {
    // pad(Sn):
    const paddedSn = new Uint8Array(BLOCK_SIZE);
    paddedSn.set(s_n);
    paddedSn[s_n.length] = 0x80; // padding: 0x80 followed by zeros

// T = dbl(D) xor pad(Sn)
    t = xorBlock(dbl(d), paddedSn);
    clean(paddedSn);
  }

// V = AES-CMAC(K, T)
  const result = cmac(key, t);
  clean(d, t);
  return result;
}

/** Use `gcmsiv` or `aessiv`. */
export const siv: () => never = () => {
  throw new Error('"siv" from v1 is now "gcmsiv"');
};

/**
 * **SIV**: Synthetic Initialization Vector (SIV) Authenticated Encryption
 * Nonce is derived from the plaintext and AAD using the S2V function.
 * See [RFC 5297](https://datatracker.ietf.org/doc/html/rfc5297.html).
 */
export const aessiv: ((key: Uint8Array, ...AAD: Uint8Array[]) => Cipher) & {
  blockSize: number;
  tagLength: number;
} = /* @__PURE__ */ wrapCipher(
  { blockSize: 16, tagLength: 16 },
  function aessiv(key: Uint8Array, ...AAD: Uint8Array[]): Cipher {
    // From RFC 5297: Section 6.1, 6.2, 6.3:
    const PLAIN_LIMIT = limit('plaintext', 0, 2 ** 132);
    const CIPHER_LIMIT = limit('ciphertext', 16, 2 ** 132 + 16);
    if (AAD.length > 126) {
      // see https://datatracker.ietf.org/doc/html/rfc5297.html#section-7
      throw new Error('"AAD" number of elements must be less than or equal to 126');
    }
    AAD.forEach((aad) => abytes(aad));
    abytes(key);
    if (![32, 48, 64].includes(key.length))
      throw new Error('"aes key" expected Uint8Array of length 32/48/64, got length=' + key.length);

// The key is split into equal halves, K1 = leftmost(K, len(K)/2) and
    // K2 = rightmost(K, len(K)/2).  K1 is used for S2V and K2 is used for CTR.
    const k1 = key.subarray(0, key.length / 2);
    const k2 = key.subarray(key.length / 2);

return {
      // https://datatracker.ietf.org/doc/html/rfc5297.html#section-2.6
      encrypt(plaintext: Uint8Array) {
        PLAIN_LIMIT(plaintext.length);

const v = s2v(k1, [...AAD, plaintext]);

// clear out the 31st and 63rd (rightmost) bit:
        const q = Uint8Array.from(v);
        q[8] &= 0x7f;
        q[12] &= 0x7f;

// encrypt:
        const c = ctr(k2, q).encrypt(plaintext);

return concatBytes(v, c);
      },
      // https://datatracker.ietf.org/doc/html/rfc5297.html#section-2.7
      decrypt(ciphertext: Uint8Array) {
        CIPHER_LIMIT(ciphertext.length);
        const v = ciphertext.subarray(0, BLOCK_SIZE);
        const c = ciphertext.subarray(BLOCK_SIZE);

// clear out the 31st and 63rd (rightmost) bit:
        const q = Uint8Array.from(v);
        q[8] &= 0x7f;
        q[12] &= 0x7f;

// decrypt:
        const p = ctr(k2, q).decrypt(c);

// verify tag:
        const t = s2v(k1, [...AAD, p]);

if (equalBytes(t, v)) {
          return p;
        } else {
          throw new Error('invalid siv tag');
        }
      },
    };
  }
);
//#endregion

/** Unsafe low-level internal methods. May change at any time. */
export const unsafe: {
  expandKeyLE: typeof expandKeyLE;
  expandKeyDecLE: typeof expandKeyDecLE;
  encrypt: typeof encrypt;
  decrypt: typeof decrypt;
  encryptBlock: typeof encryptBlock;
  decryptBlock: typeof decryptBlock;
  ctrCounter: typeof ctrCounter;
  ctr32: typeof ctr32;
  dbl: typeof dbl;
  xorBlock: typeof xorBlock;
  xorend: typeof xorend;
  s2v: typeof s2v;
} = {
  expandKeyLE,
  expandKeyDecLE,
  encrypt,
  decrypt,
  encryptBlock,
  decryptBlock,
  ctrCounter,
  ctr32,
  dbl,
  xorBlock,
  xorend,
  s2v,
};

cmd: