Add AEGIS-256 software support

src/libsodium/Makefile.am

@@ -7,6 +7,9 @@ libsodium_la_SOURCES = \
 	crypto_aead/aegis128l/soft/aead_aegis128l_soft.c \
 	crypto_aead/aegis128l/soft/aead_aegis128l_soft.h \
 	crypto_aead/aegis256/aead_aegis256.c \
+	crypto_aead/aegis256/aead_aegis256.h \
+	crypto_aead/aegis256/soft/aead_aegis256_soft.c \
+	crypto_aead/aegis256/soft/aead_aegis256_soft.h \
 	crypto_aead/aes256gcm/aead_aes256gcm.c \
 	crypto_aead/chacha20poly1305/sodium/aead_chacha20poly1305.c \
 	crypto_aead/xchacha20poly1305/sodium/aead_xchacha20poly1305.c \
@@ -231,6 +234,7 @@ libarmcrypto_la_SOURCES = \
 	crypto_aead/aegis128l/armcrypto/aead_aegis128l_armcrypto.c \
 	crypto_aead/aegis128l/armcrypto/aead_aegis128l_armcrypto.h \
 	crypto_aead/aegis256/armcrypto/aead_aegis256_armcrypto.c \
+	crypto_aead/aegis256/armcrypto/aead_aegis256_armcrypto.h \
 	crypto_aead/aes256gcm/armcrypto/aead_aes256gcm_armcrypto.c
 
 libaesni_la_LDFLAGS = $(libsodium_la_LDFLAGS)
@@ -240,6 +244,7 @@ libaesni_la_SOURCES = \
 	crypto_aead/aegis128l/aesni/aead_aegis128l_aesni.c \
 	crypto_aead/aegis128l/aesni/aead_aegis128l_aesni.h \
 	crypto_aead/aegis256/aesni/aead_aegis256_aesni.c \
+	crypto_aead/aegis256/aesni/aead_aegis256_aesni.h \
 	crypto_aead/aes256gcm/aesni/aead_aes256gcm_aesni.c
 
 libsse2_la_LDFLAGS = $(libsodium_la_LDFLAGS)

src/libsodium/crypto_aead/aegis128l/aesni/aead_aegis128l_aesni.c

@@ -1,12 +1,9 @@
-/*
- * AEGIS-128l based on https://bench.cr.yp.to/supercop/supercop-20200409.tar.xz
- */
-
 #include <errno.h>
 #include <stdlib.h>
 #include <string.h>
 
 #include "core.h"
+#include "crypto_aead_aegis128l.h"
 #include "crypto_verify_16.h"
 #include "export.h"
 #include "randombytes.h"
@@ -271,4 +268,5 @@ struct crypto_aead_aegis128l_implementation crypto_aead_aegis128l_aesni_implemen
     SODIUM_C99(.encrypt_detached =) aegis128l_encrypt_detached,
     SODIUM_C99(.decrypt_detached =) aegis128l_decrypt_detached
 };
+
 #endif

src/libsodium/crypto_aead/aegis128l/armcrypto/aead_aegis128l_armcrypto.c

@@ -259,4 +259,5 @@ struct crypto_aead_aegis128l_implementation crypto_aead_aegis128l_armcrypto_impl
     SODIUM_C99(.encrypt_detached =) aegis128l_encrypt_detached,
     SODIUM_C99(.decrypt_detached =) aegis128l_decrypt_detached
 };
+
 #endif

src/libsodium/crypto_aead/aegis256/aead_aegis256.c

@@ -2,9 +2,27 @@
 #include <errno.h>
 #include <stdlib.h>
 
+#include "core.h"
 #include "crypto_aead_aegis256.h"
 #include "private/common.h"
+#include "private/implementations.h"
 #include "randombytes.h"
+#include "runtime.h"
+
+#include "aead_aegis256.h"
+
+#include "soft/aead_aegis256_soft.h"
+
+#if defined(HAVE_ARMCRYPTO) && defined(NATIVE_LITTLE_ENDIAN)
+#include "armcrypto/aead_aegis256_armcrypto.h"
+#endif
+
+#if defined(HAVE_TMMINTRIN_H) && defined(HAVE_WMMINTRIN_H)
+#include "aesni/aead_aegis256_aesni.h"
+#endif
+
+static const crypto_aead_aegis256_implementation *implementation =
+    &crypto_aead_aegis256_soft_implementation;
 
 size_t
 crypto_aead_aegis256_keybytes(void)
@@ -42,42 +60,27 @@ crypto_aead_aegis256_keygen(unsigned char k[crypto_aead_aegis256_KEYBYTES])
     randombytes_buf(k, crypto_aead_aegis256_KEYBYTES);
 }
 
-#if !((defined(HAVE_TMMINTRIN_H) && defined(HAVE_WMMINTRIN_H)) || \
-      (defined(HAVE_ARMCRYPTO) && defined(NATIVE_LITTLE_ENDIAN)))
-
-#ifndef ENOSYS
-# define ENOSYS ENXIO
-#endif
-
-int
-crypto_aead_aegis256_encrypt_detached(unsigned char *c, unsigned char *mac,
-                                      unsigned long long *maclen_p, const unsigned char *m,
-                                      unsigned long long mlen, const unsigned char *ad,
-                                      unsigned long long adlen, const unsigned char *nsec,
-                                      const unsigned char *npub, const unsigned char *k)
-{
-    errno = ENOSYS;
-    return -1;
-}
-
 int
 crypto_aead_aegis256_encrypt(unsigned char *c, unsigned long long *clen_p, const unsigned char *m,
                              unsigned long long mlen, const unsigned char *ad,
                              unsigned long long adlen, const unsigned char *nsec,
                              const unsigned char *npub, const unsigned char *k)
 {
-    errno = ENOSYS;
-    return -1;
-}
+    unsigned long long clen = 0ULL;
+    int                ret;
 
-int
-crypto_aead_aegis256_decrypt_detached(unsigned char *m, unsigned char *nsec, const unsigned char *c,
-                                      unsigned long long clen, const unsigned char *mac,
-                                      const unsigned char *ad, unsigned long long adlen,
-                                      const unsigned char *npub, const unsigned char *k)
-{
-    errno = ENOSYS;
-    return -1;
+    if (mlen > crypto_aead_aegis256_MESSAGEBYTES_MAX) {
+        sodium_misuse();
+    }
+    ret =
+        crypto_aead_aegis256_encrypt_detached(c, c + mlen, NULL, m, mlen, ad, adlen, nsec, npub, k);
+    if (clen_p != NULL) {
+        if (ret == 0) {
+            clen = mlen + 16ULL;
+        }
+        *clen_p = clen;
+    }
+    return ret;
 }
 
 int
@@ -86,14 +89,58 @@ crypto_aead_aegis256_decrypt(unsigned char *m, unsigned long long *mlen_p, unsig
                              const unsigned char *ad, unsigned long long adlen,
                              const unsigned char *npub, const unsigned char *k)
 {
-    errno = ENOSYS;
-    return -1;
+    unsigned long long mlen = 0ULL;
+    int                ret  = -1;
+
+    if (clen >= 16ULL) {
+        ret = crypto_aead_aegis256_decrypt_detached(m, nsec, c, clen - 16ULL, c + clen - 16ULL, ad,
+                                                    adlen, npub, k);
+    }
+    if (mlen_p != NULL) {
+        if (ret == 0) {
+            mlen = clen - 16ULL;
+        }
+        *mlen_p = mlen;
+    }
+    return ret;
 }
 
 int
-crypto_aead_aegis256_is_available(void)
+crypto_aead_aegis256_encrypt_detached(unsigned char *c, unsigned char *mac,
+                                      unsigned long long *maclen_p, const unsigned char *m,
+                                      unsigned long long mlen, const unsigned char *ad,
+                                      unsigned long long adlen, const unsigned char *nsec,
+                                      const unsigned char *npub, const unsigned char *k)
 {
-    return 0;
+    return implementation->encrypt_detached(c, mac, maclen_p, m, mlen, ad, adlen, nsec, npub, k);
 }
 
+int
+crypto_aead_aegis256_decrypt_detached(unsigned char *m, unsigned char *nsec, const unsigned char *c,
+                                      unsigned long long clen, const unsigned char *mac,
+                                      const unsigned char *ad, unsigned long long adlen,
+                                      const unsigned char *npub, const unsigned char *k)
+{
+    return implementation->decrypt_detached(m, nsec, c, clen, mac, ad, adlen, npub, k);
+}
+
+int
+_crypto_aead_aegis256_pick_best_implementation(void)
+{
+    implementation = &crypto_aead_aegis256_soft_implementation;
+
+#if defined(HAVE_ARMCRYPTO) && defined(NATIVE_LITTLE_ENDIAN)
+    if (sodium_runtime_has_armcrypto()) {
+        implementation = &crypto_aead_aegis256_armcrypto_implementation;
+        return 0;
+    }
 #endif
+
+#if defined(HAVE_TMMINTRIN_H) && defined(HAVE_WMMINTRIN_H)
+    if (sodium_runtime_has_aesni()) {
+        implementation = &crypto_aead_aegis256_aesni_implementation;
+        return 0;
+    }
+#endif
+    return 0; /* LCOV_EXCL_LINE */
+}

src/libsodium/crypto_aead/aegis256/aead_aegis256.h

@@ -0,0 +1,16 @@
+#ifndef aead_aegis256_H
+#define aead_aegis256_H
+
+typedef struct crypto_aead_aegis256_implementation {
+    int (*encrypt_detached)(unsigned char *c, unsigned char *mac, unsigned long long *maclen_p,
+                            const unsigned char *m, unsigned long long mlen,
+                            const unsigned char *ad, unsigned long long adlen,
+                            const unsigned char *nsec, const unsigned char *npub,
+                            const unsigned char *k);
+    int (*decrypt_detached)(unsigned char *m, unsigned char *nsec, const unsigned char *c,
+                            unsigned long long clen, const unsigned char *mac,
+                            const unsigned char *ad, unsigned long long adlen,
+                            const unsigned char *npub, const unsigned char *k);
+} crypto_aead_aegis256_implementation;
+
+#endif

src/libsodium/crypto_aead/aegis256/aesni/aead_aegis256_aesni.c

@@ -1,7 +1,3 @@
-/*
- * AEGIS-256 based on https://bench.cr.yp.to/supercop/supercop-20190816.tar.xz
- */
-
 #include <errno.h>
 #include <stdlib.h>
 #include <string.h>
@@ -16,6 +12,8 @@
 
 #include "private/common.h"
 
+#include "aead_aegis256_aesni.h"
+
 #if defined(HAVE_TMMINTRIN_H) && defined(HAVE_WMMINTRIN_H)
 
 #ifdef __GNUC__
@@ -36,7 +34,7 @@ typedef __m128i aes_block_t;
 #define AES_ENC(A, B)             _mm_aesenc_si128((A), (B))
 
 static inline void
-crypto_aead_aegis256_update(aes_block_t *const state, const aes_block_t data)
+aegis256_update(aes_block_t *const state, const aes_block_t data)
 {
     aes_block_t tmp;
 
@@ -50,8 +48,7 @@ crypto_aead_aegis256_update(aes_block_t *const state, const aes_block_t data)
 }
 
 static void
-crypto_aead_aegis256_init(const unsigned char *key, const unsigned char *nonce,
-                          aes_block_t *const state)
+aegis256_init(const unsigned char *key, const unsigned char *nonce, aes_block_t *const state)
 {
     static CRYPTO_ALIGN(16)
         const uint8_t c0_[] = { 0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1,
@@ -78,16 +75,16 @@ crypto_aead_aegis256_init(const unsigned char *key, const unsigned char *nonce,
     state[5] = AES_BLOCK_XOR(k2, c0);
 
     for (i = 0; i < 4; i++) {
-        crypto_aead_aegis256_update(state, k1);
-        crypto_aead_aegis256_update(state, k2);
-        crypto_aead_aegis256_update(state, kxn1);
-        crypto_aead_aegis256_update(state, kxn2);
+        aegis256_update(state, k1);
+        aegis256_update(state, k2);
+        aegis256_update(state, kxn1);
+        aegis256_update(state, kxn2);
     }
 }
 
 static void
-crypto_aead_aegis256_mac(unsigned char *mac, unsigned long long adlen, unsigned long long mlen,
-                         aes_block_t *const state)
+aegis256_mac(unsigned char *mac, unsigned long long adlen, unsigned long long mlen,
+             aes_block_t *const state)
 {
     aes_block_t tmp;
     int         i;
@@ -96,7 +93,7 @@ crypto_aead_aegis256_mac(unsigned char *mac, unsigned long long adlen, unsigned
     tmp = AES_BLOCK_XOR(tmp, state[3]);
 
     for (i = 0; i < 7; i++) {
-        crypto_aead_aegis256_update(state, tmp);
+        aegis256_update(state, tmp);
     }
 
     tmp = AES_BLOCK_XOR(state[5], state[4]);
@@ -109,17 +106,16 @@ crypto_aead_aegis256_mac(unsigned char *mac, unsigned long long adlen, unsigned
 }
 
 static inline void
-crypto_aead_aegis256_absorb(const unsigned char *const src, aes_block_t *const state)
+aegis256_absorb(const unsigned char *const src, aes_block_t *const state)
 {
     aes_block_t msg;
 
     msg = AES_BLOCK_LOAD(src);
-    crypto_aead_aegis256_update(state, msg);
+    aegis256_update(state, msg);
 }
 
 static void
-crypto_aead_aegis256_enc(unsigned char *const dst, const unsigned char *const src,
-                         aes_block_t *const state)
+aegis256_enc(unsigned char *const dst, const unsigned char *const src, aes_block_t *const state)
 {
     aes_block_t msg;
     aes_block_t tmp;
@@ -131,12 +127,11 @@ crypto_aead_aegis256_enc(unsigned char *const dst, const unsigned char *const sr
     tmp = AES_BLOCK_XOR(tmp, AES_BLOCK_AND(state[2], state[3]));
     AES_BLOCK_STORE((aes_block_t *) (void *) dst, tmp);
 
-    crypto_aead_aegis256_update(state, msg);
+    aegis256_update(state, msg);
 }
 
 static void
-crypto_aead_aegis256_dec(unsigned char *const dst, const unsigned char *const src,
-                         aes_block_t *const state)
+aegis256_dec(unsigned char *const dst, const unsigned char *const src, aes_block_t *const state)
 {
     aes_block_t msg;
 
@@ -147,15 +142,14 @@ crypto_aead_aegis256_dec(unsigned char *const dst, const unsigned char *const sr
     msg = AES_BLOCK_XOR(msg, AES_BLOCK_AND(state[2], state[3]));
     AES_BLOCK_STORE((aes_block_t *) (void *) dst, msg);
 
-    crypto_aead_aegis256_update(state, msg);
+    aegis256_update(state, msg);
 }
 
-int
-crypto_aead_aegis256_encrypt_detached(unsigned char *c, unsigned char *mac,
-                                      unsigned long long *maclen_p, const unsigned char *m,
-                                      unsigned long long mlen, const unsigned char *ad,
-                                      unsigned long long adlen, const unsigned char *nsec,
-                                      const unsigned char *npub, const unsigned char *k)
+static int
+aegis256_encrypt_detached(unsigned char *c, unsigned char *mac, unsigned long long *maclen_p,
+                          const unsigned char *m, unsigned long long mlen, const unsigned char *ad,
+                          unsigned long long adlen, const unsigned char *nsec,
+                          const unsigned char *npub, const unsigned char *k)
 {
     aes_block_t                    state[6];
     CRYPTO_ALIGN(16) unsigned char src[16];
@@ -163,27 +157,27 @@ crypto_aead_aegis256_encrypt_detached(unsigned char *c, unsigned char *mac,
     unsigned long long             i;
 
     (void) nsec;
-    crypto_aead_aegis256_init(k, npub, state);
+    aegis256_init(k, npub, state);
 
     for (i = 0ULL; i + 16ULL <= adlen; i += 16ULL) {
-        crypto_aead_aegis256_absorb(ad + i, state);
+        aegis256_absorb(ad + i, state);
     }
     if (adlen & 0xf) {
         memset(src, 0, 16);
         memcpy(src, ad + i, adlen & 0xf);
-        crypto_aead_aegis256_absorb(src, state);
+        aegis256_absorb(src, state);
     }
     for (i = 0ULL; i + 16ULL <= mlen; i += 16ULL) {
-        crypto_aead_aegis256_enc(c + i, m + i, state);
+        aegis256_enc(c + i, m + i, state);
     }
     if (mlen & 0xf) {
         memset(src, 0, 16);
         memcpy(src, m + i, mlen & 0xf);
-        crypto_aead_aegis256_enc(dst, src, state);
+        aegis256_enc(dst, src, state);
         memcpy(c + i, dst, mlen & 0xf);
     }
 
-    crypto_aead_aegis256_mac(mac, adlen, mlen, state);
+    aegis256_mac(mac, adlen, mlen, state);
     sodium_memzero(state, sizeof state);
     sodium_memzero(src, sizeof src);
     sodium_memzero(dst, sizeof dst);
@@ -194,34 +188,11 @@ crypto_aead_aegis256_encrypt_detached(unsigned char *c, unsigned char *mac,
     return 0;
 }
 
-int
-crypto_aead_aegis256_encrypt(unsigned char *c, unsigned long long *clen_p, const unsigned char *m,
-                             unsigned long long mlen, const unsigned char *ad,
-                             unsigned long long adlen, const unsigned char *nsec,
-                             const unsigned char *npub, const unsigned char *k)
-{
-    unsigned long long clen = 0ULL;
-    int                ret;
-
-    if (mlen > crypto_aead_aegis256_MESSAGEBYTES_MAX) {
-        sodium_misuse();
-    }
-    ret =
-        crypto_aead_aegis256_encrypt_detached(c, c + mlen, NULL, m, mlen, ad, adlen, nsec, npub, k);
-    if (clen_p != NULL) {
-        if (ret == 0) {
-            clen = mlen + 16ULL;
-        }
-        *clen_p = clen;
-    }
-    return ret;
-}
-
-int
-crypto_aead_aegis256_decrypt_detached(unsigned char *m, unsigned char *nsec, const unsigned char *c,
-                                      unsigned long long clen, const unsigned char *mac,
-                                      const unsigned char *ad, unsigned long long adlen,
-                                      const unsigned char *npub, const unsigned char *k)
+static int
+aegis256_decrypt_detached(unsigned char *m, unsigned char *nsec, const unsigned char *c,
+                          unsigned long long clen, const unsigned char *mac,
+                          const unsigned char *ad, unsigned long long adlen,
+                          const unsigned char *npub, const unsigned char *k)
 {
     aes_block_t                    state[6];
     CRYPTO_ALIGN(16) unsigned char src[16];
@@ -233,29 +204,29 @@ crypto_aead_aegis256_decrypt_detached(unsigned char *m, unsigned char *nsec, con
 
     (void) nsec;
     mlen = clen;
-    crypto_aead_aegis256_init(k, npub, state);
+    aegis256_init(k, npub, state);
 
     for (i = 0ULL; i + 16ULL <= adlen; i += 16ULL) {
-        crypto_aead_aegis256_absorb(ad + i, state);
+        aegis256_absorb(ad + i, state);
     }
     if (adlen & 0xf) {
         memset(src, 0, 16);
         memcpy(src, ad + i, adlen & 0xf);
-        crypto_aead_aegis256_absorb(src, state);
+        aegis256_absorb(src, state);
     }
     if (m != NULL) {
         for (i = 0ULL; i + 16ULL <= mlen; i += 16ULL) {
-            crypto_aead_aegis256_dec(m + i, c + i, state);
+            aegis256_dec(m + i, c + i, state);
         }
     } else {
         for (i = 0ULL; i + 16ULL <= mlen; i += 16ULL) {
-            crypto_aead_aegis256_dec(dst, c + i, state);
+            aegis256_dec(dst, c + i, state);
         }
     }
     if (mlen & 0xf) {
         memset(src, 0, 16);
         memcpy(src, c + i, mlen & 0xf);
-        crypto_aead_aegis256_dec(dst, src, state);
+        aegis256_dec(dst, src, state);
         if (m != NULL) {
             memcpy(m + i, dst, mlen & 0xf);
         }
@@ -264,7 +235,7 @@ crypto_aead_aegis256_decrypt_detached(unsigned char *m, unsigned char *nsec, con
             AES_BLOCK_XOR(state[0], AES_BLOCK_LOAD((const aes_block_t *) (const void *) dst));
     }
 
-    crypto_aead_aegis256_mac(computed_mac, adlen, mlen, state);
+    aegis256_mac(computed_mac, adlen, mlen, state);
     sodium_memzero(state, sizeof state);
     sodium_memzero(src, sizeof src);
     sodium_memzero(dst, sizeof dst);
@@ -280,32 +251,9 @@ crypto_aead_aegis256_decrypt_detached(unsigned char *m, unsigned char *nsec, con
     return 0;
 }
 
-int
-crypto_aead_aegis256_decrypt(unsigned char *m, unsigned long long *mlen_p, unsigned char *nsec,
-                             const unsigned char *c, unsigned long long clen,
-                             const unsigned char *ad, unsigned long long adlen,
-                             const unsigned char *npub, const unsigned char *k)
-{
-    unsigned long long mlen = 0ULL;
-    int                ret  = -1;
-
-    if (clen >= 16ULL) {
-        ret = crypto_aead_aegis256_decrypt_detached(m, nsec, c, clen - 16ULL, c + clen - 16ULL, ad,
-                                                    adlen, npub, k);
-    }
-    if (mlen_p != NULL) {
-        if (ret == 0) {
-            mlen = clen - 16ULL;
-        }
-        *mlen_p = mlen;
-    }
-    return ret;
-}
-
-int
-crypto_aead_aegis256_is_available(void)
-{
-    return sodium_runtime_has_aesni();
-}
+struct crypto_aead_aegis256_implementation crypto_aead_aegis256_aesni_implementation = {
+    SODIUM_C99(.encrypt_detached =) aegis256_encrypt_detached,
+    SODIUM_C99(.decrypt_detached =) aegis256_decrypt_detached
+};
 
 #endif

src/libsodium/crypto_aead/aegis256/aesni/aead_aegis256_aesni.h

@@ -0,0 +1,6 @@
+#include <stdint.h>
+
+#include "../aead_aegis256.h"
+#include "crypto_aead_aegis256.h"
+
+extern struct crypto_aead_aegis256_implementation crypto_aead_aegis256_aesni_implementation;

src/libsodium/crypto_aead/aegis256/armcrypto/aead_aegis256_armcrypto.c

@@ -12,6 +12,8 @@
 
 #include "private/common.h"
 
+#include "aead_aegis256_armcrypto.h"
+
 #if defined(HAVE_ARMCRYPTO) && defined(NATIVE_LITTLE_ENDIAN)
 
 # include <arm_neon.h>
@@ -25,7 +27,7 @@ typedef uint8x16_t aes_block_t;
 #define AES_ENC(A, B)             veorq_u8(vaesmcq_u8(vaeseq_u8((A), vmovq_n_u8(0))), (B))
 
 static inline void
-crypto_aead_aegis256_update(aes_block_t *const state, const aes_block_t data)
+aegis256_update(aes_block_t *const state, const aes_block_t data)
 {
     aes_block_t tmp;
 
@@ -39,8 +41,7 @@ crypto_aead_aegis256_update(aes_block_t *const state, const aes_block_t data)
 }
 
 static void
-crypto_aead_aegis256_init(const unsigned char *key, const unsigned char *nonce,
-                          aes_block_t *const state)
+aegis256_init(const unsigned char *key, const unsigned char *nonce, aes_block_t *const state)
 {
     static CRYPTO_ALIGN(16) const unsigned char c0_[] = {
         0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1, 0x20, 0x11, 0x31, 0x42,
@@ -69,16 +70,16 @@ crypto_aead_aegis256_init(const unsigned char *key, const unsigned char *nonce,
     state[5] = AES_BLOCK_XOR(k2, c0);
 
     for (i = 0; i < 4; i++) {
-        crypto_aead_aegis256_update(state, k1);
-        crypto_aead_aegis256_update(state, k2);
-        crypto_aead_aegis256_update(state, kxn1);
-        crypto_aead_aegis256_update(state, kxn2);
+        aegis256_update(state, k1);
+        aegis256_update(state, k2);
+        aegis256_update(state, kxn1);
+        aegis256_update(state, kxn2);
     }
 }
 
 static void
-crypto_aead_aegis256_mac(unsigned char *mac, unsigned long long adlen, unsigned long long mlen,
-                         aes_block_t *const state)
+aegis256_mac(unsigned char *mac, unsigned long long adlen, unsigned long long mlen,
+             aes_block_t *const state)
 {
     aes_block_t tmp;
     int        i;
@@ -87,7 +88,7 @@ crypto_aead_aegis256_mac(unsigned char *mac, unsigned long long adlen, unsigned
     tmp = AES_BLOCK_XOR(tmp, state[3]);
 
     for (i = 0; i < 7; i++) {
-        crypto_aead_aegis256_update(state, tmp);
+        aegis256_update(state, tmp);
     }
 
     tmp = AES_BLOCK_XOR(state[5], state[4]);
@@ -100,18 +101,16 @@ crypto_aead_aegis256_mac(unsigned char *mac, unsigned long long adlen, unsigned
 }
 
 static inline void
-crypto_aead_aegis256_absorb(const unsigned char *const src, aes_block_t *const state)
+aegis256_absorb(const unsigned char *const src, aes_block_t *const state)
 {
     aes_block_t msg;
 
     msg = AES_BLOCK_LOAD(src);
-    crypto_aead_aegis256_update(state, msg);
+    aegis256_update(state, msg);
 }
 
 static void
-crypto_aead_aegis256_enc(unsigned char *const       dst,
-                         const unsigned char *const src,
-                         aes_block_t *const         state)
+aegis256_enc(unsigned char *const dst, const unsigned char *const src, aes_block_t *const state)
 {
     aes_block_t msg;
     aes_block_t tmp;
@@ -123,13 +122,11 @@ crypto_aead_aegis256_enc(unsigned char *const       dst,
     tmp = AES_BLOCK_XOR(tmp, AES_BLOCK_AND(state[2], state[3]));
     AES_BLOCK_STORE(dst, tmp);
 
-    crypto_aead_aegis256_update(state, msg);
+    aegis256_update(state, msg);
 }
 
 static void
-crypto_aead_aegis256_dec(unsigned char *const       dst,
-                         const unsigned char *const src,
-                         aes_block_t *const         state)
+aegis256_dec(unsigned char *const dst, const unsigned char *const src, aes_block_t *const state)
 {
     aes_block_t msg;
 
@@ -140,15 +137,14 @@ crypto_aead_aegis256_dec(unsigned char *const       dst,
     msg = AES_BLOCK_XOR(msg, AES_BLOCK_AND(state[2], state[3]));
     AES_BLOCK_STORE(dst, msg);
 
-    crypto_aead_aegis256_update(state, msg);
+    aegis256_update(state, msg);
 }
 
-int
-crypto_aead_aegis256_encrypt_detached(unsigned char *c, unsigned char *mac,
-                                      unsigned long long *maclen_p, const unsigned char *m,
-                                      unsigned long long mlen, const unsigned char *ad,
-                                      unsigned long long adlen, const unsigned char *nsec,
-                                      const unsigned char *npub, const unsigned char *k)
+static int
+aegis256_encrypt_detached(unsigned char *c, unsigned char *mac, unsigned long long *maclen_p,
+                          const unsigned char *m, unsigned long long mlen, const unsigned char *ad,
+                          unsigned long long adlen, const unsigned char *nsec,
+                          const unsigned char *npub, const unsigned char *k)
 {
     aes_block_t                    state[6];
     CRYPTO_ALIGN(16) unsigned char src[16];
@@ -156,27 +152,27 @@ crypto_aead_aegis256_encrypt_detached(unsigned char *c, unsigned char *mac,
     unsigned long long i;
 
     (void) nsec;
-    crypto_aead_aegis256_init(k, npub, state);
+    aegis256_init(k, npub, state);
 
     for (i = 0ULL; i + 16ULL <= adlen; i += 16ULL) {
-        crypto_aead_aegis256_absorb(ad + i, state);
+        aegis256_absorb(ad + i, state);
     }
     if (adlen & 0xf) {
         memset(src, 0, 16);
         memcpy(src, ad + i, adlen & 0xf);
-        crypto_aead_aegis256_absorb(src, state);
+        aegis256_absorb(src, state);
     }
     for (i = 0ULL; i + 16ULL <= mlen; i += 16ULL) {
-        crypto_aead_aegis256_enc(c + i, m + i, state);
+        aegis256_enc(c + i, m + i, state);
     }
     if (mlen & 0xf) {
         memset(src, 0, 16);
         memcpy(src, m + i, mlen & 0xf);
-        crypto_aead_aegis256_enc(dst, src, state);
+        aegis256_enc(dst, src, state);
         memcpy(c + i, dst, mlen & 0xf);
     }
 
-    crypto_aead_aegis256_mac(mac, adlen, mlen, state);
+    aegis256_mac(mac, adlen, mlen, state);
     sodium_memzero(state, sizeof state);
     sodium_memzero(src, sizeof src);
     sodium_memzero(dst, sizeof dst);
@@ -187,34 +183,11 @@ crypto_aead_aegis256_encrypt_detached(unsigned char *c, unsigned char *mac,
     return 0;
 }
 
-int
-crypto_aead_aegis256_encrypt(unsigned char *c, unsigned long long *clen_p, const unsigned char *m,
-                             unsigned long long mlen, const unsigned char *ad,
-                             unsigned long long adlen, const unsigned char *nsec,
-                             const unsigned char *npub, const unsigned char *k)
-{
-    unsigned long long clen = 0ULL;
-    int                ret;
-
-    if (mlen > crypto_aead_aegis256_MESSAGEBYTES_MAX) {
-        sodium_misuse();
-    }
-    ret = crypto_aead_aegis256_encrypt_detached(c, c + mlen, NULL, m, mlen,
-                                                ad, adlen, nsec, npub, k);
-    if (clen_p != NULL) {
-        if (ret == 0) {
-            clen = mlen + 16ULL;
-        }
-        *clen_p = clen;
-    }
-    return ret;
-}
-
-int
-crypto_aead_aegis256_decrypt_detached(unsigned char *m, unsigned char *nsec, const unsigned char *c,
-                                      unsigned long long clen, const unsigned char *mac,
-                                      const unsigned char *ad, unsigned long long adlen,
-                                      const unsigned char *npub, const unsigned char *k)
+static int
+aegis256_decrypt_detached(unsigned char *m, unsigned char *nsec, const unsigned char *c,
+                          unsigned long long clen, const unsigned char *mac,
+                          const unsigned char *ad, unsigned long long adlen,
+                          const unsigned char *npub, const unsigned char *k)
 {
     aes_block_t                    state[6];
     CRYPTO_ALIGN(16) unsigned char src[16];
@@ -226,29 +199,29 @@ crypto_aead_aegis256_decrypt_detached(unsigned char *m, unsigned char *nsec, con
 
     (void) nsec;
     mlen = clen;
-    crypto_aead_aegis256_init(k, npub, state);
+    aegis256_init(k, npub, state);
 
     for (i = 0ULL; i + 16ULL <= adlen; i += 16ULL) {
-        crypto_aead_aegis256_absorb(ad + i, state);
+        aegis256_absorb(ad + i, state);
     }
     if (adlen & 0xf) {
         memset(src, 0, 16);
         memcpy(src, ad + i, adlen & 0xf);
-        crypto_aead_aegis256_absorb(src, state);
+        aegis256_absorb(src, state);
     }
     if (m != NULL) {
         for (i = 0ULL; i + 16ULL <= mlen; i += 16ULL) {
-            crypto_aead_aegis256_dec(m + i, c + i, state);
+            aegis256_dec(m + i, c + i, state);
         }
     } else {
         for (i = 0ULL; i + 16ULL <= mlen; i += 16ULL) {
-            crypto_aead_aegis256_dec(dst, c + i, state);
+            aegis256_dec(dst, c + i, state);
         }
     }
     if (mlen & 0xf) {
         memset(src, 0, 16);
         memcpy(src, c + i, mlen & 0xf);
-        crypto_aead_aegis256_dec(dst, src, state);
+        aegis256_dec(dst, src, state);
         if (m != NULL) {
             memcpy(m + i, dst, mlen & 0xf);
         }
@@ -256,7 +229,7 @@ crypto_aead_aegis256_decrypt_detached(unsigned char *m, unsigned char *nsec, con
         state[0] = AES_BLOCK_XOR(state[0], AES_BLOCK_LOAD(dst));
     }
 
-    crypto_aead_aegis256_mac(computed_mac, adlen, mlen, state);
+    aegis256_mac(computed_mac, adlen, mlen, state);
     sodium_memzero(state, sizeof state);
     sodium_memzero(src, sizeof src);
     sodium_memzero(dst, sizeof dst);
@@ -272,32 +245,9 @@ crypto_aead_aegis256_decrypt_detached(unsigned char *m, unsigned char *nsec, con
     return 0;
 }
 
-int
-crypto_aead_aegis256_decrypt(unsigned char *m, unsigned long long *mlen_p, unsigned char *nsec,
-                             const unsigned char *c, unsigned long long clen,
-                             const unsigned char *ad, unsigned long long adlen,
-                             const unsigned char *npub, const unsigned char *k)
-{
-    unsigned long long mlen = 0ULL;
-    int                ret  = -1;
-
-    if (clen >= 16ULL) {
-        ret = crypto_aead_aegis256_decrypt_detached(m, nsec, c, clen - 16ULL, c + clen - 16ULL, ad,
-                                                    adlen, npub, k);
-    }
-    if (mlen_p != NULL) {
-        if (ret == 0) {
-            mlen = clen - 16ULL;
-        }
-        *mlen_p = mlen;
-    }
-    return ret;
-}
-
-int
-crypto_aead_aegis256_is_available(void)
-{
-    return sodium_runtime_has_armcrypto();
-}
+struct crypto_aead_aegis256_implementation crypto_aead_aegis256_armcrypto_implementation = {
+    SODIUM_C99(.encrypt_detached =) aegis256_encrypt_detached,
+    SODIUM_C99(.decrypt_detached =) aegis256_decrypt_detached
+};
 
 #endif

src/libsodium/crypto_aead/aegis256/armcrypto/aead_aegis256_armcrypto.h

@@ -0,0 +1,6 @@
+#include <stdint.h>
+
+#include "../aead_aegis256.h"
+#include "crypto_aead_aegis256.h"
+
+extern struct crypto_aead_aegis256_implementation crypto_aead_aegis256_armcrypto_implementation;

src/libsodium/crypto_aead/aegis256/soft/aead_aegis256_soft.c

@@ -0,0 +1,246 @@
+#include <errno.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "core.h"
+#include "crypto_aead_aegis256.h"
+#include "crypto_verify_16.h"
+#include "export.h"
+#include "randombytes.h"
+#include "runtime.h"
+#include "utils.h"
+
+#include "private/common.h"
+#include "private/softaes.h"
+
+#include "aead_aegis256_soft.h"
+
+typedef SoftAesBlock aes_block_t;
+#define AES_BLOCK_XOR(A, B)       softaes_block_xor((A), (B))
+#define AES_BLOCK_AND(A, B)       softaes_block_and((A), (B))
+#define AES_BLOCK_LOAD(A)         softaes_block_load(A)
+#define AES_BLOCK_LOAD_64x2(A, B) softaes_block_load64x2((A), (B))
+#define AES_BLOCK_STORE(A, B)     softaes_block_store((A), (B))
+#define AES_ENC(A, B)             softaes_block_encrypt((A), (B))
+
+static inline void
+aegis256_update(aes_block_t *const state, const aes_block_t data)
+{
+    aes_block_t tmp;
+
+    tmp      = AES_ENC(state[5], state[0]);
+    state[5] = AES_ENC(state[4], state[5]);
+    state[4] = AES_ENC(state[3], state[4]);
+    state[3] = AES_ENC(state[2], state[3]);
+    state[2] = AES_ENC(state[1], state[2]);
+    state[1] = AES_ENC(state[0], state[1]);
+    state[0] = AES_BLOCK_XOR(tmp, data);
+}
+
+static void
+aegis256_init(const unsigned char *key, const unsigned char *nonce, aes_block_t *const state)
+{
+    static CRYPTO_ALIGN(16)
+        const unsigned char c0_[] = { 0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1,
+                                      0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd };
+    static CRYPTO_ALIGN(16)
+        const unsigned char c1_[] = { 0x00, 0x01, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d,
+                                      0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62 };
+    const aes_block_t       c0    = AES_BLOCK_LOAD(c0_);
+    const aes_block_t       c1    = AES_BLOCK_LOAD(c1_);
+    aes_block_t             k1, k2;
+    aes_block_t             kxn1, kxn2;
+    int                     i;
+
+    k1   = AES_BLOCK_LOAD(&key[0]);
+    k2   = AES_BLOCK_LOAD(&key[16]);
+    kxn1 = AES_BLOCK_XOR(k1, AES_BLOCK_LOAD(&nonce[0]));
+    kxn2 = AES_BLOCK_XOR(k2, AES_BLOCK_LOAD(&nonce[16]));
+
+    state[0] = kxn1;
+    state[1] = kxn2;
+    state[2] = c0;
+    state[3] = c1;
+    state[4] = AES_BLOCK_XOR(k1, c1);
+    state[5] = AES_BLOCK_XOR(k2, c0);
+
+    for (i = 0; i < 4; i++) {
+        aegis256_update(state, k1);
+        aegis256_update(state, k2);
+        aegis256_update(state, kxn1);
+        aegis256_update(state, kxn2);
+    }
+}
+
+static void
+aegis256_mac(unsigned char *mac, unsigned long long adlen, unsigned long long mlen,
+             aes_block_t *const state)
+{
+    aes_block_t tmp;
+    int         i;
+
+    tmp = AES_BLOCK_LOAD_64x2(mlen << 3, adlen << 3);
+    tmp = AES_BLOCK_XOR(tmp, state[3]);
+
+    for (i = 0; i < 7; i++) {
+        aegis256_update(state, tmp);
+    }
+
+    tmp = AES_BLOCK_XOR(state[5], state[4]);
+    tmp = AES_BLOCK_XOR(tmp, state[3]);
+    tmp = AES_BLOCK_XOR(tmp, state[2]);
+    tmp = AES_BLOCK_XOR(tmp, state[1]);
+    tmp = AES_BLOCK_XOR(tmp, state[0]);
+
+    AES_BLOCK_STORE(mac, tmp);
+}
+
+static inline void
+aegis256_absorb(const unsigned char *const src, aes_block_t *const state)
+{
+    aes_block_t msg;
+
+    msg = AES_BLOCK_LOAD(src);
+    aegis256_update(state, msg);
+}
+
+static void
+aegis256_enc(unsigned char *const dst, const unsigned char *const src, aes_block_t *const state)
+{
+    aes_block_t msg;
+    aes_block_t tmp;
+
+    msg = AES_BLOCK_LOAD(src);
+    tmp = AES_BLOCK_XOR(msg, state[5]);
+    tmp = AES_BLOCK_XOR(tmp, state[4]);
+    tmp = AES_BLOCK_XOR(tmp, state[1]);
+    tmp = AES_BLOCK_XOR(tmp, AES_BLOCK_AND(state[2], state[3]));
+    AES_BLOCK_STORE(dst, tmp);
+
+    aegis256_update(state, msg);
+}
+
+static void
+aegis256_dec(unsigned char *const dst, const unsigned char *const src, aes_block_t *const state)
+{
+    aes_block_t msg;
+
+    msg = AES_BLOCK_LOAD(src);
+    msg = AES_BLOCK_XOR(msg, state[5]);
+    msg = AES_BLOCK_XOR(msg, state[4]);
+    msg = AES_BLOCK_XOR(msg, state[1]);
+    msg = AES_BLOCK_XOR(msg, AES_BLOCK_AND(state[2], state[3]));
+    AES_BLOCK_STORE(dst, msg);
+
+    aegis256_update(state, msg);
+}
+
+static int
+aegis256_encrypt_detached(unsigned char *c, unsigned char *mac, unsigned long long *maclen_p,
+                          const unsigned char *m, unsigned long long mlen, const unsigned char *ad,
+                          unsigned long long adlen, const unsigned char *nsec,
+                          const unsigned char *npub, const unsigned char *k)
+{
+    aes_block_t                    state[6];
+    CRYPTO_ALIGN(16) unsigned char src[16];
+    CRYPTO_ALIGN(16) unsigned char dst[16];
+    unsigned long long             i;
+
+    (void) nsec;
+    aegis256_init(k, npub, state);
+
+    for (i = 0ULL; i + 16ULL <= adlen; i += 16ULL) {
+        aegis256_absorb(ad + i, state);
+    }
+    if (adlen & 0xf) {
+        memset(src, 0, 16);
+        memcpy(src, ad + i, adlen & 0xf);
+        aegis256_absorb(src, state);
+    }
+    for (i = 0ULL; i + 16ULL <= mlen; i += 16ULL) {
+        aegis256_enc(c + i, m + i, state);
+    }
+    if (mlen & 0xf) {
+        memset(src, 0, 16);
+        memcpy(src, m + i, mlen & 0xf);
+        aegis256_enc(dst, src, state);
+        memcpy(c + i, dst, mlen & 0xf);
+    }
+
+    aegis256_mac(mac, adlen, mlen, state);
+    sodium_memzero(state, sizeof state);
+    sodium_memzero(src, sizeof src);
+    sodium_memzero(dst, sizeof dst);
+
+    if (maclen_p != NULL) {
+        *maclen_p = 16ULL;
+    }
+    return 0;
+}
+
+static int
+aegis256_decrypt_detached(unsigned char *m, unsigned char *nsec, const unsigned char *c,
+                          unsigned long long clen, const unsigned char *mac,
+                          const unsigned char *ad, unsigned long long adlen,
+                          const unsigned char *npub, const unsigned char *k)
+{
+    aes_block_t                    state[6];
+    CRYPTO_ALIGN(16) unsigned char src[16];
+    CRYPTO_ALIGN(16) unsigned char dst[16];
+    CRYPTO_ALIGN(16) unsigned char computed_mac[16];
+    unsigned long long             i;
+    unsigned long long             mlen;
+    int                            ret;
+
+    (void) nsec;
+    mlen = clen;
+    aegis256_init(k, npub, state);
+
+    for (i = 0ULL; i + 16ULL <= adlen; i += 16ULL) {
+        aegis256_absorb(ad + i, state);
+    }
+    if (adlen & 0xf) {
+        memset(src, 0, 16);
+        memcpy(src, ad + i, adlen & 0xf);
+        aegis256_absorb(src, state);
+    }
+    if (m != NULL) {
+        for (i = 0ULL; i + 16ULL <= mlen; i += 16ULL) {
+            aegis256_dec(m + i, c + i, state);
+        }
+    } else {
+        for (i = 0ULL; i + 16ULL <= mlen; i += 16ULL) {
+            aegis256_dec(dst, c + i, state);
+        }
+    }
+    if (mlen & 0xf) {
+        memset(src, 0, 16);
+        memcpy(src, c + i, mlen & 0xf);
+        aegis256_dec(dst, src, state);
+        if (m != NULL) {
+            memcpy(m + i, dst, mlen & 0xf);
+        }
+        memset(dst, 0, mlen & 0xf);
+        state[0] = AES_BLOCK_XOR(state[0], AES_BLOCK_LOAD(dst));
+    }
+
+    aegis256_mac(computed_mac, adlen, mlen, state);
+    sodium_memzero(state, sizeof state);
+    sodium_memzero(src, sizeof src);
+    sodium_memzero(dst, sizeof dst);
+    ret = crypto_verify_16(computed_mac, mac);
+    sodium_memzero(computed_mac, sizeof computed_mac);
+    if (m == NULL) {
+        return ret;
+    }
+    if (ret != 0) {
+        memset(m, 0, mlen);
+        return -1;
+    }
+    return 0;
+}
+
+struct crypto_aead_aegis256_implementation crypto_aead_aegis256_soft_implementation = {
+    SODIUM_C99(.encrypt_detached =) aegis256_encrypt_detached,
+    SODIUM_C99(.decrypt_detached =) aegis256_decrypt_detached
+};

src/libsodium/crypto_aead/aegis256/soft/aead_aegis256_soft.h

@@ -0,0 +1,7 @@
+#include <stdint.h>
+
+#include "../aead_aegis256.h"
+#include "crypto_aead_aegis256.h"
+
+extern struct crypto_aead_aegis256_implementation
+    crypto_aead_aegis256_soft_implementation;

src/libsodium/include/sodium/crypto_aead_aegis256.h

@@ -11,9 +11,6 @@
 extern "C" {
 #endif
 
-SODIUM_EXPORT
-int crypto_aead_aegis256_is_available(void);
-
 #define crypto_aead_aegis256_KEYBYTES  32U
 SODIUM_EXPORT
 size_t crypto_aead_aegis256_keybytes(void);

src/libsodium/include/sodium/private/implementations.h

@@ -10,5 +10,6 @@ int _crypto_scalarmult_curve25519_pick_best_implementation(void);
 int _crypto_stream_chacha20_pick_best_implementation(void);
 int _crypto_stream_salsa20_pick_best_implementation(void);
 int _crypto_aead_aegis128l_pick_best_implementation(void);
+int _crypto_aead_aegis256_pick_best_implementation(void);
 
 #endif

src/libsodium/sodium/core.c

@@ -46,6 +46,7 @@ sodium_init(void)
     _crypto_stream_chacha20_pick_best_implementation();
     _crypto_stream_salsa20_pick_best_implementation();
     _crypto_aead_aegis128l_pick_best_implementation();
+    _crypto_aead_aegis256_pick_best_implementation();
     initialized = 1;
     if (sodium_crit_leave() != 0) {
         return -1; /* LCOV_EXCL_LINE */