Experimental implementation of CTX

Cargo.toml

@@ -34,6 +34,7 @@ features = ["alloc"]
 default = [ "safe_api" ]
 safe_api = [ "getrandom", "ct-codecs" ]
 alloc = []
+experimental = []
 
 [dev-dependencies]
 hex = "0.4.0"

README.md

@@ -5,13 +5,16 @@
 Orion is a cryptography library written in pure Rust. It aims to provide easy and usable crypto while trying to minimize the use of unsafe code. You can read more about Orion in the [wiki](https://github.com/orion-rs/orion/wiki).
 
 Currently supports:
-* **AEAD**: (X)ChaCha20Poly1305.
+* **AEAD**: (X)ChaCha20-Poly1305.
 * **Hashing**: BLAKE2b, SHA2.
 * **KDF**: HKDF, PBKDF2, Argon2i.
 * **Key exchange**: X25519.
 * **MAC**: HMAC, Poly1305.
 * **Stream ciphers**: (X)ChaCha20.
 
+Experimental support (with `experimental` feature enabled):
+* **Committing AEAD**: (X)ChaCha20-Poly1305-BLAKE2b.
+
 ### Security
 This library has **not undergone any third-party security audit**. Usage is at **own risk**.
 
@@ -30,6 +33,7 @@ MSRV may be changed at any point and will not be considered a SemVer breaking ch
 - `serde`: Requires either `alloc` or `default`/`safe_api`.
 - `alloc`: Argon2i in `hazardous` when `default`/`safe_api` is not available.
 - `no_std`: Implicit feature that represents no heap allocations. Enabled by disabling default features and not selecting any additional features.
+- `experimental`: These APIs may contain breaking changes in any non SemVer-breaking crate releases.
 
 More detailed explanation of the features in the [wiki](https://github.com/orion-rs/orion/wiki/Crate-features).
 

src/hazardous/aead/chacha20poly1305.rs

@@ -123,10 +123,10 @@ use core::convert::TryInto;
 use zeroize::Zeroizing;
 
 /// The initial counter used for encryption and decryption.
-const ENC_CTR: u32 = 1;
+pub(crate) const ENC_CTR: u32 = 1;
 
 /// The initial counter used for Poly1305 key generation.
-const AUTH_CTR: u32 = 0;
+pub(crate) const AUTH_CTR: u32 = 0;
 
 /// The maximum size of the plaintext (see [RFC 8439](https://www.rfc-editor.org/rfc/rfc8439#section-2.8)).
 pub const P_MAX: u64 = (u32::MAX as u64) * 64;
@@ -147,7 +147,7 @@ pub(crate) fn poly1305_key_gen(
 }
 
 /// Authenticates the ciphertext, ad and their lengths.
-fn process_authentication(
+pub(crate) fn process_authentication(
     auth_ctx: &mut Poly1305,
     ad: &[u8],
     ciphertext: &[u8],

src/hazardous/cae/chacha20poly1305blake2b.rs

@@ -0,0 +1,262 @@
+// MIT License
+
+// Copyright (c) 2023 The orion Developers
+
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
+//! # About
+//! This provides a fully committing AEAD, using the CTX construction proposed by Chan and Rogaway,
+//! in the ["On Committing Authenticated Encryption"] paper. Specifically, CTX is instantiated with BLAKE2b-256.
+//!
+//! A fully committing AEAD is important if attacks like the [partitioning oracle attack] are a part of the threat model.
+//!
+//! # Parameters:
+//! - `secret_key`: The secret key.
+//! - `nonce`: The nonce value.
+//! - `ad`: Additional data to authenticate (this is not encrypted and can be [`None`]).
+//! - `ciphertext_with_tag`: The encrypted data with the corresponding 32 byte
+//!   BLAKE2b tag appended to it.
+//! - `plaintext`: The data to be encrypted.
+//! - `dst_out`: Destination array that will hold the
+//!   `ciphertext_with_tag`/`plaintext` after encryption/decryption.
+//!
+//! `ad`: "A typical use for these data is to authenticate version numbers,
+//! timestamps or monotonically increasing counters in order to discard previous
+//! messages and prevent replay attacks." See [libsodium docs] for more information.
+//!
+//! `nonce`: "Counters and LFSRs are both acceptable ways of generating unique
+//! nonces, as is encrypting a counter using a block cipher with a 64-bit block
+//! size such as DES.  Note that it is not acceptable to use a truncation of a
+//! counter encrypted with block ciphers with 128-bit or 256-bit blocks,
+//! because such a truncation may repeat after a short time." See [RFC] for more information.
+//!
+//! `dst_out`: The output buffer may have a capacity greater than the input. If this is the case,
+//! only the first input length amount of bytes in `dst_out` are modified, while the rest remain untouched.
+//!
+//! # Errors:
+//! An error will be returned if:
+//! - The length of `dst_out` is less than `plaintext` + [`TAG_SIZE`] when calling [`seal()`].
+//! - The length of `dst_out` is less than `ciphertext_with_tag` - [`TAG_SIZE`] when
+//!   calling [`open()`].
+//! - The length of `ciphertext_with_tag` is not at least [`TAG_SIZE`].
+//! - The received tag does not match the calculated tag when  calling [`open()`].
+//! - `plaintext.len()` + [`TAG_SIZE`] overflows when  calling [`seal()`].
+//! - Converting `usize` to `u64` would be a lossy conversion.
+//! - `plaintext.len() >` [`P_MAX`]
+//! - `ad.len() >` [`A_MAX`]
+//! - `ciphertext_with_tag.len() >` [`C_MAX`]
+//!
+//! # Panics:
+//! A panic will occur if:
+//! - More than `2^32-1 * 64` bytes of data are processed.
+//!
+//! # Security:
+//! - It is critical for security that a given nonce is not re-used with a given
+//!   key. Should this happen, the security of all data that has been encrypted
+//!   with that given key is compromised.
+//! - Only a nonce for XChaCha20Poly1305 is big enough to be randomly generated
+//!   using a CSPRNG.
+//! - To securely generate a strong key, use [`SecretKey::generate()`].
+//! - The length of the `plaintext` is not hidden, only its contents.
+//!
+//! # Recommendation:
+//! - It is recommended to use [`XChaCha20Poly1305-BLAKE2b`] when possible.
+//!
+//! # Example:
+//! ```rust
+//! # #[cfg(feature = "safe_api")] {
+//! use orion::hazardous::cae;
+//!
+//! let secret_key = cae::chacha20poly1305blake2b::SecretKey::generate();
+//!
+//! // WARNING: This nonce is only meant for demonstration and should not
+//! // be repeated. Please read the security section.
+//! let nonce = cae::chacha20poly1305blake2b::Nonce::from([0u8; 12]);
+//! let ad = "Additional data".as_bytes();
+//! let message = "Data to protect".as_bytes();
+//!
+//! // Length of the above message is 15 and then we accommodate 32 for the BLAKE2b
+//! // tag.
+//!
+//! let mut dst_out_ct = [0u8; 15 + 32];
+//! let mut dst_out_pt = [0u8; 15];
+//! // Encrypt and place ciphertext + tag in dst_out_ct
+//! cae::chacha20poly1305blake2b::seal(&secret_key, &nonce, message, Some(&ad), &mut dst_out_ct)?;
+//! // Verify tag, if correct then decrypt and place message in dst_out_pt
+//! cae::chacha20poly1305blake2b::open(&secret_key, &nonce, &dst_out_ct, Some(&ad), &mut dst_out_pt)?;
+//!
+//! assert_eq!(dst_out_pt.as_ref(), message.as_ref());
+//! # }
+//! # Ok::<(), orion::errors::UnknownCryptoError>(())
+//! ```
+//! [`SecretKey::generate()`]: super::stream::chacha20::SecretKey::generate
+//! [`XChaCha20Poly1305-BLAKE2b`]: xchacha20poly1305blake2b
+//! [`TAG_SIZE`]: chacha20poly1305blake2b::TAG_SIZE
+//! [`seal()`]: chacha20poly1305blake2b::seal
+//! [`open()`]: chacha20poly1305blake2b::open
+//! [RFC]: https://tools.ietf.org/html/rfc8439#section-3
+//! [libsodium docs]: https://download.libsodium.org/doc/secret-key_cryptography/aead#additional-data
+//! [`P_MAX`]: chacha20poly1305blake2b::P_MAX
+//! [`A_MAX`]: chacha20poly1305blake2b::A_MAX
+//! [`C_MAX`]: chacha20poly1305blake2b::C_MAX
+//! ["On Committing Authenticated Encryption"]: https://eprint.iacr.org/2022/1260
+//! [partitioning oracle attack]: https://www.usenix.org/conference/usenixsecurity21/presentation/len
+
+use crate::errors::UnknownCryptoError;
+use crate::hazardous::aead;
+use crate::hazardous::aead::chacha20poly1305::{poly1305_key_gen, process_authentication, ENC_CTR};
+use crate::hazardous::hash::blake2::blake2b::Blake2b;
+use crate::hazardous::mac::poly1305::Poly1305;
+use crate::hazardous::mac::poly1305::POLY1305_OUTSIZE;
+use crate::hazardous::stream::chacha20::{self, ChaCha20, CHACHA_BLOCKSIZE};
+use crate::util;
+use zeroize::Zeroizing;
+
+pub use crate::hazardous::aead::chacha20poly1305::A_MAX;
+pub use crate::hazardous::aead::chacha20poly1305::P_MAX;
+pub use crate::hazardous::stream::chacha20::{Nonce, SecretKey};
+
+/// The size of the BLAKE2b authentication tag.
+pub const TAG_SIZE: usize = 32;
+
+/// The maximum size of the ciphertext.
+pub const C_MAX: u64 = P_MAX + (TAG_SIZE as u64);
+
+#[must_use = "SECURITY WARNING: Ignoring a Result can have real security implications."]
+/// CTX ChaCha20Poly1305 with BLAKE2b-256.
+pub fn seal(
+    secret_key: &SecretKey,
+    nonce: &Nonce,
+    plaintext: &[u8],
+    ad: Option<&[u8]>,
+    dst_out: &mut [u8],
+) -> Result<(), UnknownCryptoError> {
+    if u64::try_from(plaintext.len()).map_err(|_| UnknownCryptoError)? > P_MAX {
+        return Err(UnknownCryptoError);
+    }
+
+    let ad = ad.unwrap_or(&[0u8; 0]);
+    #[allow(clippy::absurd_extreme_comparisons)]
+    if u64::try_from(ad.len()).map_err(|_| UnknownCryptoError)? > A_MAX {
+        return Err(UnknownCryptoError);
+    }
+
+    match plaintext.len().checked_add(TAG_SIZE) {
+        Some(out_min_len) => {
+            if dst_out.len() < out_min_len {
+                return Err(UnknownCryptoError);
+            }
+        }
+        None => return Err(UnknownCryptoError),
+    };
+
+    aead::chacha20poly1305::seal(
+        secret_key,
+        nonce,
+        plaintext,
+        Some(ad),
+        &mut dst_out[..plaintext.len() + POLY1305_OUTSIZE],
+    )?;
+
+    let mut blake2b = Blake2b::new(32)?;
+    blake2b.update(secret_key.unprotected_as_bytes())?;
+    blake2b.update(nonce.as_ref())?;
+    blake2b.update(ad)?;
+    blake2b.update(&dst_out[plaintext.len()..plaintext.len() + POLY1305_OUTSIZE])?;
+    let tag = blake2b.finalize()?;
+
+    dst_out[plaintext.len()..plaintext.len() + TAG_SIZE].copy_from_slice(tag.as_ref());
+
+    Ok(())
+}
+
+#[must_use = "SECURITY WARNING: Ignoring a Result can have real security implications."]
+/// CTX ChaCha20Poly1305 with BLAKE2b-256.
+pub fn open(
+    secret_key: &SecretKey,
+    nonce: &Nonce,
+    ciphertext_with_tag: &[u8],
+    ad: Option<&[u8]>,
+    dst_out: &mut [u8],
+) -> Result<(), UnknownCryptoError> {
+    if u64::try_from(ciphertext_with_tag.len()).map_err(|_| UnknownCryptoError)? > C_MAX {
+        return Err(UnknownCryptoError);
+    }
+    let ad = ad.unwrap_or(&[0u8; 0]);
+    #[allow(clippy::absurd_extreme_comparisons)]
+    if u64::try_from(ad.len()).map_err(|_| UnknownCryptoError)? > A_MAX {
+        return Err(UnknownCryptoError);
+    }
+    if ciphertext_with_tag.len() < TAG_SIZE {
+        return Err(UnknownCryptoError);
+    }
+    if dst_out.len() < ciphertext_with_tag.len() - TAG_SIZE {
+        return Err(UnknownCryptoError);
+    }
+
+    let mut blake2b = Blake2b::new(32)?;
+    blake2b.update(secret_key.unprotected_as_bytes())?;
+    blake2b.update(nonce.as_ref())?;
+    blake2b.update(ad)?;
+
+    let mut dec_ctx =
+        ChaCha20::new(secret_key.unprotected_as_bytes(), nonce.as_ref(), true).unwrap();
+    let mut tmp = Zeroizing::new([0u8; CHACHA_BLOCKSIZE]);
+    let mut auth_ctx = Poly1305::new(&poly1305_key_gen(&mut dec_ctx, &mut tmp));
+
+    let ciphertext_len = ciphertext_with_tag.len() - TAG_SIZE;
+    process_authentication(&mut auth_ctx, ad, &ciphertext_with_tag[..ciphertext_len])?;
+
+    blake2b.update(auth_ctx.finalize()?.unprotected_as_bytes())?;
+
+    util::secure_cmp(
+        blake2b.finalize()?.as_ref(),
+        &ciphertext_with_tag[ciphertext_len..],
+    )?;
+
+    if ciphertext_len != 0 {
+        dst_out[..ciphertext_len].copy_from_slice(&ciphertext_with_tag[..ciphertext_len]);
+        chacha20::xor_keystream(
+            &mut dec_ctx,
+            ENC_CTR,
+            tmp.as_mut(),
+            &mut dst_out[..ciphertext_len],
+        )?;
+    }
+
+    Ok(())
+}
+
+// Testing public functions in the module.
+#[cfg(test)]
+#[cfg(feature = "safe_api")]
+mod public {
+    use super::*;
+    use crate::test_framework::aead_interface::{test_diff_params_err, AeadTestRunner};
+
+    #[quickcheck]
+    #[cfg(feature = "safe_api")]
+    fn prop_aead_interface(input: Vec<u8>, ad: Vec<u8>) -> bool {
+        let secret_key = SecretKey::generate();
+        let nonce = Nonce::from_slice(&[0u8; chacha20::IETF_CHACHA_NONCESIZE]).unwrap();
+        AeadTestRunner(seal, open, secret_key, nonce, &input, None, TAG_SIZE, &ad);
+        test_diff_params_err(&seal, &open, &input, TAG_SIZE);
+        true
+    }
+}

src/hazardous/cae/mod.rs

@@ -0,0 +1,33 @@
+// MIT License
+
+// Copyright (c) 2023 The orion Developers
+
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
+#![cfg_attr(docsrs, doc(cfg(feature = "experimental")))]
+
+/// Fully-committing ChaCha20-Poly1305 with BLAKE2b based on the [CTX] construction by John Chan & Phillip Rogaway.
+///
+/// [CTX]: https://eprint.iacr.org/2022/1260
+pub mod chacha20poly1305blake2b;
+
+/// Fully-committing XChaCha20-Poly1305 with BLAKE2b based on the [CTX] construction by John Chan & Phillip Rogaway.
+///
+/// [CTX]: https://eprint.iacr.org/2022/1260
+pub mod xchacha20poly1305blake2b;

src/hazardous/cae/xchacha20poly1305blake2b.rs

@@ -0,0 +1,246 @@
+// MIT License
+
+// Copyright (c) 2023 The orion Developers
+
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
+//! # About
+//! This provides a fully committing AEAD, using the CTX construction proposed by Chan and Rogaway,
+//! in the ["On Committing Authenticated Encryption"] paper. Specifically, CTX is instantiated with BLAKE2b-256.
+//!
+//! A fully committing AEAD is important if attacks like the [partitioning oracle attack] are a part of the threat model.
+//!
+//! # Parameters:
+//! - `secret_key`: The secret key.
+//! - `nonce`: The nonce value.
+//! - `ad`: Additional data to authenticate (this is not encrypted and can be [`None`]).
+//! - `ciphertext_with_tag`: The encrypted data with the corresponding 32 byte
+//!   BLAKE2b tag appended to it.
+//! - `plaintext`: The data to be encrypted.
+//! - `dst_out`: Destination array that will hold the
+//!   `ciphertext_with_tag`/`plaintext` after encryption/decryption.
+//!
+//! `ad`: "A typical use for these data is to authenticate version numbers,
+//! timestamps or monotonically increasing counters in order to discard previous
+//! messages and prevent replay attacks." See [libsodium docs] for more information.
+//!
+//! `dst_out`: The output buffer may have a capacity greater than the input. If this is the case,
+//! only the first input length amount of bytes in `dst_out` are modified, while the rest remain untouched.
+//!
+//! # Errors:
+//! An error will be returned if:
+//! - The length of `dst_out` is less than `plaintext` + [`TAG_SIZE`] when calling [`seal()`].
+//! - The length of `dst_out` is less than `ciphertext_with_tag` - [`TAG_SIZE`] when
+//!   calling [`open()`].
+//! - The length of `ciphertext_with_tag` is not at least [`TAG_SIZE`].
+//! - The received tag does not match the calculated tag when  calling [`open()`].
+//! - `plaintext.len()` + [`TAG_SIZE`] overflows when  calling [`seal()`].
+//! - Converting `usize` to `u64` would be a lossy conversion.
+//! - `plaintext.len() >` [`P_MAX`]
+//! - `ad.len() >` [`A_MAX`]
+//! - `ciphertext_with_tag.len() >` [`C_MAX`]
+//!
+//! # Panics:
+//! A panic will occur if:
+//! - More than `2^32-1 * 64` bytes of data are processed.
+//!
+//! # Security:
+//! - It is critical for security that a given nonce is not re-used with a given
+//!   key. Should this happen, the security of all data that has been encrypted
+//!   with that given key is compromised.
+//! - Only a nonce for XChaCha20Poly1305 is big enough to be randomly generated
+//!   using a CSPRNG. [`Nonce::generate()`] can be used for this.
+//! - To securely generate a strong key, use [`SecretKey::generate()`].
+//! - The length of the `plaintext` is not hidden, only its contents.
+//!
+//! # Example:
+//! ```rust
+//! # #[cfg(feature = "safe_api")] {
+//! use orion::hazardous::cae;
+//!
+//! let secret_key = cae::xchacha20poly1305blake2b::SecretKey::generate();
+//! let nonce = cae::xchacha20poly1305blake2b::Nonce::generate();
+//! let ad = "Additional data".as_bytes();
+//! let message = "Data to protect".as_bytes();
+//!
+//! // Length of the above message is 15 and then we accommodate 32 for the BLAKE2b
+//! // tag.
+//!
+//! let mut dst_out_ct = [0u8; 15 + 32];
+//! let mut dst_out_pt = [0u8; 15];
+//! // Encrypt and place ciphertext + tag in dst_out_ct
+//! cae::xchacha20poly1305blake2b::seal(&secret_key, &nonce, message, Some(&ad), &mut dst_out_ct)?;
+//! // Verify tag, if correct then decrypt and place message in dst_out_pt
+//! cae::xchacha20poly1305blake2b::open(&secret_key, &nonce, &dst_out_ct, Some(&ad), &mut dst_out_pt)?;
+//!
+//! assert_eq!(dst_out_pt.as_ref(), message.as_ref());
+//! # }
+//! # Ok::<(), orion::errors::UnknownCryptoError>(())
+//! ```
+//! [`SecretKey::generate()`]: super::stream::chacha20::SecretKey::generate
+//! [`Nonce::generate()`]: super::stream::xchacha20::Nonce::generate
+//! [`TAG_SIZE`]: xchacha20poly1305blake2b::TAG_SIZE
+//! [`seal()`]: xchacha20poly1305blake2b::seal
+//! [`open()`]: xchacha20poly1305blake2b::open
+//! [RFC]: https://tools.ietf.org/html/rfc8439#section-3
+//! [libsodium docs]: https://download.libsodium.org/doc/secret-key_cryptography/aead#additional-data
+//! [`P_MAX`]: xchacha20poly1305blake2b::P_MAX
+//! [`A_MAX`]: xchacha20poly1305blake2b::A_MAX
+//! [`C_MAX`]: xchacha20poly1305blake2b::C_MAX
+//! ["On Committing Authenticated Encryption"]: https://eprint.iacr.org/2022/1260
+//! [partitioning oracle attack]: https://www.usenix.org/conference/usenixsecurity21/presentation/len
+
+use crate::errors::UnknownCryptoError;
+use crate::hazardous::aead;
+pub use crate::hazardous::aead::chacha20poly1305::A_MAX;
+pub use crate::hazardous::aead::chacha20poly1305::P_MAX;
+use crate::hazardous::aead::chacha20poly1305::{poly1305_key_gen, process_authentication, ENC_CTR};
+pub use crate::hazardous::cae::chacha20poly1305blake2b::{C_MAX, TAG_SIZE};
+use crate::hazardous::hash::blake2::blake2b::Blake2b;
+use crate::hazardous::mac::poly1305::{Poly1305, POLY1305_OUTSIZE};
+use crate::hazardous::stream::chacha20::{self, ChaCha20, CHACHA_BLOCKSIZE};
+use crate::hazardous::stream::xchacha20::subkey_and_nonce;
+pub use crate::hazardous::stream::{chacha20::SecretKey, xchacha20::Nonce};
+use crate::util;
+use zeroize::Zeroizing;
+
+#[must_use = "SECURITY WARNING: Ignoring a Result can have real security implications."]
+/// CTX XChaCha20Poly1305 with BLAKE2b-256.
+pub fn seal(
+    secret_key: &SecretKey,
+    nonce: &Nonce,
+    plaintext: &[u8],
+    ad: Option<&[u8]>,
+    dst_out: &mut [u8],
+) -> Result<(), UnknownCryptoError> {
+    if u64::try_from(plaintext.len()).map_err(|_| UnknownCryptoError)? > P_MAX {
+        return Err(UnknownCryptoError);
+    }
+
+    let ad = ad.unwrap_or(&[0u8; 0]);
+    #[allow(clippy::absurd_extreme_comparisons)]
+    if u64::try_from(ad.len()).map_err(|_| UnknownCryptoError)? > A_MAX {
+        return Err(UnknownCryptoError);
+    }
+
+    match plaintext.len().checked_add(TAG_SIZE) {
+        Some(out_min_len) => {
+            if dst_out.len() < out_min_len {
+                return Err(UnknownCryptoError);
+            }
+        }
+        None => return Err(UnknownCryptoError),
+    };
+
+    let (subkey, ietf_nonce) = subkey_and_nonce(secret_key, nonce);
+    aead::chacha20poly1305::seal(
+        &subkey,
+        &ietf_nonce,
+        plaintext,
+        Some(ad),
+        &mut dst_out[..plaintext.len() + POLY1305_OUTSIZE],
+    )?;
+
+    let mut blake2b = Blake2b::new(32)?;
+    blake2b.update(secret_key.unprotected_as_bytes())?;
+    blake2b.update(nonce.as_ref())?;
+    blake2b.update(ad)?;
+    blake2b.update(&dst_out[plaintext.len()..plaintext.len() + POLY1305_OUTSIZE])?;
+    let tag = blake2b.finalize()?;
+
+    dst_out[plaintext.len()..plaintext.len() + TAG_SIZE].copy_from_slice(tag.as_ref());
+
+    Ok(())
+}
+
+#[must_use = "SECURITY WARNING: Ignoring a Result can have real security implications."]
+/// CTX XChaCha20Poly1305 with BLAKE2b-256.
+pub fn open(
+    secret_key: &SecretKey,
+    nonce: &Nonce,
+    ciphertext_with_tag: &[u8],
+    ad: Option<&[u8]>,
+    dst_out: &mut [u8],
+) -> Result<(), UnknownCryptoError> {
+    if u64::try_from(ciphertext_with_tag.len()).map_err(|_| UnknownCryptoError)? > C_MAX {
+        return Err(UnknownCryptoError);
+    }
+    let ad = ad.unwrap_or(&[0u8; 0]);
+    #[allow(clippy::absurd_extreme_comparisons)]
+    if u64::try_from(ad.len()).map_err(|_| UnknownCryptoError)? > A_MAX {
+        return Err(UnknownCryptoError);
+    }
+    if ciphertext_with_tag.len() < TAG_SIZE {
+        return Err(UnknownCryptoError);
+    }
+    if dst_out.len() < ciphertext_with_tag.len() - TAG_SIZE {
+        return Err(UnknownCryptoError);
+    }
+
+    let mut blake2b = Blake2b::new(32)?;
+    blake2b.update(secret_key.unprotected_as_bytes())?;
+    blake2b.update(nonce.as_ref())?;
+    blake2b.update(ad)?;
+
+    let (subkey, ietf_nonce) = subkey_and_nonce(secret_key, nonce);
+    let mut dec_ctx =
+        ChaCha20::new(subkey.unprotected_as_bytes(), ietf_nonce.as_ref(), true).unwrap();
+    let mut tmp = Zeroizing::new([0u8; CHACHA_BLOCKSIZE]);
+    let mut auth_ctx = Poly1305::new(&poly1305_key_gen(&mut dec_ctx, &mut tmp));
+
+    let ciphertext_len = ciphertext_with_tag.len() - TAG_SIZE;
+    process_authentication(&mut auth_ctx, ad, &ciphertext_with_tag[..ciphertext_len])?;
+
+    blake2b.update(auth_ctx.finalize()?.unprotected_as_bytes())?;
+
+    util::secure_cmp(
+        blake2b.finalize()?.as_ref(),
+        &ciphertext_with_tag[ciphertext_len..],
+    )?;
+
+    if ciphertext_len != 0 {
+        dst_out[..ciphertext_len].copy_from_slice(&ciphertext_with_tag[..ciphertext_len]);
+        chacha20::xor_keystream(
+            &mut dec_ctx,
+            ENC_CTR,
+            tmp.as_mut(),
+            &mut dst_out[..ciphertext_len],
+        )?;
+    }
+
+    Ok(())
+}
+
+// Testing public functions in the module.
+#[cfg(test)]
+#[cfg(feature = "safe_api")]
+mod public {
+    use super::*;
+    use crate::test_framework::aead_interface::{test_diff_params_err, AeadTestRunner};
+
+    #[quickcheck]
+    #[cfg(feature = "safe_api")]
+    fn prop_aead_interface(input: Vec<u8>, ad: Vec<u8>) -> bool {
+        let secret_key = SecretKey::generate();
+        let nonce = Nonce::generate();
+        AeadTestRunner(seal, open, secret_key, nonce, &input, None, TAG_SIZE, &ad);
+        test_diff_params_err(&seal, &open, &input, TAG_SIZE);
+        true
+    }
+}

src/hazardous/mod.rs

@@ -44,3 +44,7 @@ pub mod stream;
 
 /// Elliptic-Curve Cryptography.
 pub mod ecc;
+
+#[cfg(feature = "experimental")]
+/// Fully-committing Authenticated Encryption. __WARNING:__ Experimental feature.
+pub mod cae;

src/test_framework/aead_interface.rs

@@ -65,7 +65,7 @@ pub fn AeadTestRunner<Sealer, Opener, Key, Nonce>(
 }
 
 #[cfg(feature = "safe_api")]
-/// Related bug: https://github.com/orion-rs/orion/issues/52
+/// Related bug: <https://github.com/orion-rs/orion/issues/52>
 /// Test dst_out mutable array sizes when using seal().
 fn seal_dst_out_length<Sealer, Key, Nonce>(
     sealer: &Sealer,
@@ -95,7 +95,7 @@ fn seal_dst_out_length<Sealer, Key, Nonce>(
 }
 
 #[cfg(feature = "safe_api")]
-/// Related bug: https://github.com/orion-rs/orion/issues/52
+/// Related bug: <https://github.com/orion-rs/orion/issues/52>
 /// Test input sizes when using seal().
 fn seal_plaintext_length<Sealer, Key, Nonce>(
     sealer: &Sealer,
@@ -122,7 +122,7 @@ fn seal_plaintext_length<Sealer, Key, Nonce>(
 }
 
 #[cfg(feature = "safe_api")]
-/// Related bug: https://github.com/orion-rs/orion/issues/52
+/// Related bug: <https://github.com/orion-rs/orion/issues/52>
 /// Test dst_out mutable array sizes when using open().
 fn open_dst_out_length<Sealer, Opener, Key, Nonce>(
     sealer: &Sealer,

tests/aead/wycheproof_aead.rs

@@ -8,33 +8,33 @@ use std::{fs::File, io::BufReader};
 #[allow(non_snake_case)]
 #[derive(Serialize, Deserialize, Debug)]
 pub(crate) struct WycheproofAeadTests {
-    algorithm: String,
-    numberOfTests: u64,
-    testGroups: Vec<AeadTestGroup>,
+    pub(crate) algorithm: String,
+    pub(crate) numberOfTests: u64,
+    pub(crate) testGroups: Vec<AeadTestGroup>,
 }
 
 #[allow(non_snake_case)]
 #[derive(Serialize, Deserialize, Debug)]
 pub(crate) struct AeadTestGroup {
-    ivSize: u64,
-    keySize: u64,
-    tagSize: u64,
-    tests: Vec<TestVector>,
+    pub(crate) ivSize: u64,
+    pub(crate) keySize: u64,
+    pub(crate) tagSize: u64,
+    pub(crate) tests: Vec<TestVector>,
 }
 
 #[allow(non_snake_case)]
 #[derive(Serialize, Deserialize, Debug)]
 pub(crate) struct TestVector {
-    tcId: u64,
-    comment: String,
-    key: String,
-    iv: String,
-    aad: String,
-    msg: String,
-    ct: String,
-    tag: String,
-    result: String,
-    flags: Vec<String>,
+    pub(crate) tcId: u64,
+    pub(crate) comment: String,
+    pub(crate) key: String,
+    pub(crate) iv: String,
+    pub(crate) aad: String,
+    pub(crate) msg: String,
+    pub(crate) ct: String,
+    pub(crate) tag: String,
+    pub(crate) result: String,
+    pub(crate) flags: Vec<String>,
 }
 
 fn wycheproof_runner(path: &str) {

tests/cae/ctx_test_vectors.rs

@@ -0,0 +1,113 @@
+use hex::decode;
+use serde::{Deserialize, Serialize};
+use std::{fs::File, io::BufReader};
+
+use orion::hazardous::cae::chacha20poly1305blake2b::{self, SecretKey, TAG_SIZE};
+use orion::hazardous::cae::xchacha20poly1305blake2b;
+
+#[allow(non_snake_case)]
+#[derive(Serialize, Deserialize, Debug)]
+pub(crate) struct TestVector {
+    pub(crate) Key: String,
+    pub(crate) Nonce: String,
+    pub(crate) Ad: String,
+    pub(crate) Msg: String,
+    pub(crate) Ciphertext: String,
+    pub(crate) CommitmentTag: String,
+    pub(crate) Result: String,
+    pub(crate) Comment: String,
+}
+
+pub(crate) fn custom_ctx_runner(path: &str) {
+    let file = File::open(path).unwrap();
+    let reader = BufReader::new(file);
+    let tests: Vec<TestVector> = serde_json::from_reader(reader).unwrap();
+
+    let is_ietf = match decode(&tests[0].Nonce).unwrap().len() {
+        12 => true,
+        24 => false,
+        _ => panic!("Unexpected nonce length"),
+    };
+
+    for test in tests.iter() {
+        let should_test_pass: bool = match test.Result.as_str() {
+            "true" => true,
+            "false" => false,
+            _ => panic!("Unexpected test outcome for custom CTX tests"),
+        };
+
+        let key = SecretKey::from_slice(&decode(&test.Key).unwrap()).unwrap();
+        let nonce = &decode(&test.Nonce).unwrap();
+        let aad = &decode(&test.Ad).unwrap();
+        let input = &decode(&test.Msg).unwrap();
+        let mut dst_ct_out = vec![0u8; input.len() + TAG_SIZE];
+        let mut dst_pt_out = vec![0u8; input.len()];
+
+        // Test vectors have ciphertext appended with underlying AE tag.
+        // So we remove this and append the BLAKE2b commitment tag instead.
+        let mut output = vec![0u8; dst_ct_out.len()];
+        output[..input.len()].copy_from_slice(&decode(&test.Ciphertext).unwrap()[..input.len()]);
+        output[input.len()..].copy_from_slice(&decode(&test.CommitmentTag).unwrap());
+
+        if test.Comment == "wrong Poly1305 tag" {
+            // This test is for implementations that internally cannot re-compute the Poly1305 tag
+            // due to lack of access to such an API (and consequently also store this alongside the
+            // commitment tag). Orion does re-compute the Poly1305 tag, so this test vector won't pass
+            // as we re-compute it internally and don't accept it from the outside.
+            continue;
+        }
+
+        if should_test_pass {
+            if is_ietf {
+                let nonce = chacha20poly1305blake2b::Nonce::from_slice(nonce).unwrap();
+                chacha20poly1305blake2b::seal(&key, &nonce, input, Some(aad), &mut dst_ct_out)
+                    .unwrap();
+                chacha20poly1305blake2b::open(
+                    &key,
+                    &nonce,
+                    &dst_ct_out,
+                    Some(aad),
+                    &mut dst_pt_out,
+                )
+                .unwrap();
+            } else {
+                let nonce = xchacha20poly1305blake2b::Nonce::from_slice(nonce).unwrap();
+                xchacha20poly1305blake2b::seal(&key, &nonce, input, Some(aad), &mut dst_ct_out)
+                    .unwrap();
+                xchacha20poly1305blake2b::open(
+                    &key,
+                    &nonce,
+                    &dst_ct_out,
+                    Some(aad),
+                    &mut dst_pt_out,
+                )
+                .unwrap();
+            }
+
+            assert_eq!(dst_ct_out, output);
+            assert_eq!(dst_pt_out[..].as_ref(), input);
+        } else {
+            if is_ietf {
+                let nonce = chacha20poly1305blake2b::Nonce::from_slice(nonce).unwrap();
+                assert!(chacha20poly1305blake2b::open(
+                    &key,
+                    &nonce,
+                    &output,
+                    Some(aad),
+                    &mut dst_pt_out
+                )
+                .is_err())
+            } else {
+                let nonce = xchacha20poly1305blake2b::Nonce::from_slice(nonce).unwrap();
+                assert!(xchacha20poly1305blake2b::open(
+                    &key,
+                    &nonce,
+                    &output,
+                    Some(aad),
+                    &mut dst_pt_out
+                )
+                .is_err())
+            }
+        }
+    }
+}

tests/cae/mod.rs

@@ -0,0 +1,82 @@
+use crate::aead::wycheproof_aead::WycheproofAeadTests;
+use hex::decode;
+use orion::hazardous::cae::{
+    chacha20poly1305blake2b::{self, SecretKey},
+    xchacha20poly1305blake2b,
+};
+use std::{fs::File, io::BufReader};
+mod ctx_test_vectors;
+use crate::cae::ctx_test_vectors::custom_ctx_runner;
+
+/// This test runner tests that CTX variants of ChaCha20Poly1305 XChaCha20Poly1305
+/// (with BLAKE2b) produce the same ciphertext as the non-CTX variants of them.
+/// Since CTX does not modify how the ciphertext is produced.
+fn wycheproof_runner(path: &str) {
+    let file = File::open(path).unwrap();
+    let reader = BufReader::new(file);
+    let tests: WycheproofAeadTests = serde_json::from_reader(reader).unwrap();
+
+    let is_ietf = match tests.algorithm.as_str() {
+        "CHACHA20-POLY1305" => true,
+        "XCHACHA20-POLY1305" => false,
+        _ => panic!("Unexpected name for Wycheproof algorithm"),
+    };
+
+    for test_group in tests.testGroups.iter() {
+        for test in test_group.tests.iter() {
+            match test.result.as_str() {
+                "valid" => true,
+                // The only thing we want to test for CTX is that it still produces
+                // ciphertexts matching the underlying AE. Therefor, invalid test cases
+                // are of no interest here.
+                "invalid" => continue,
+                _ => panic!("Unexpected test outcome for Wycheproof test"),
+            };
+
+            let input = &decode(&test.msg).unwrap();
+            let output = &decode(&test.ct).unwrap();
+            let key = SecretKey::from_slice(&decode(&test.key).unwrap()).unwrap();
+            let aad = &decode(&test.aad).unwrap();
+
+            let mut dst_ct_out = vec![0u8; input.len() + 32];
+
+            if is_ietf {
+                let nonce =
+                    chacha20poly1305blake2b::Nonce::from_slice(&decode(&test.iv).unwrap()).unwrap();
+                chacha20poly1305blake2b::seal(&key, &nonce, input, Some(aad), &mut dst_ct_out)
+                    .unwrap();
+            } else {
+                let nonce = xchacha20poly1305blake2b::Nonce::from_slice(&decode(&test.iv).unwrap())
+                    .unwrap();
+                xchacha20poly1305blake2b::seal(&key, &nonce, input, Some(aad), &mut dst_ct_out)
+                    .unwrap();
+            }
+
+            assert_eq!(dst_ct_out[..input.len()].as_ref(), output);
+        }
+    }
+}
+
+#[test]
+fn test_ctx_equivalence_ctx_chacha20() {
+    wycheproof_runner(
+        "./tests/test_data/third_party/google/wycheproof/wycheproof_chacha20_poly1305_test.json",
+    );
+}
+
+#[test]
+fn test_ctx_equivalence_ctx_xchacha20() {
+    wycheproof_runner(
+        "./tests/test_data/third_party/google/wycheproof/wycheproof_xchacha20_poly1305_test.json",
+    );
+}
+
+#[test]
+fn test_ctx_custom_chacha20() {
+    custom_ctx_runner("./tests/test_data/experimental/ctx_chacha20_poly1305_blake2b_256.json");
+}
+
+#[test]
+fn test_ctx_custom_xchacha20() {
+    custom_ctx_runner("./tests/test_data/experimental/ctx_xchacha20_poly1305_blake2b_256.json");
+}

tests/mod.rs

@@ -14,6 +14,10 @@ pub mod mac;
 #[cfg(test)]
 pub mod stream;
 
+#[cfg(all(feature = "safe_api", feature = "experimental"))]
+#[cfg(test)]
+pub mod cae;
+
 use hex::decode;
 
 use std::{

tests/test_data/experimental/ctx_chacha20_poly1305_blake2b_256.json

@@ -0,0 +1,102 @@
+[
+  {
+    "Key": "89EB0D6A8A691DAE2CD15ED0369931CE0A949ECAFA5C3F93F8121833646E15C3",
+    "Nonce": "89EB0D6A8A691DAE2CD15ED0",
+    "Ad": "4164646974696F6E616C2064617461",
+    "Msg": "48656C6C6F2C20776F726C6421",
+    "Ciphertext": "CC09FDB2D367799D765F7B34D4DE655B73A6E8B95D863C9D9FD5B23013",
+    "CommitmentTag": "15EED404676A43C49B6E9819676D0B84616C7CEA717DA59D3822262B4C9751F1",
+    "Result": "true",
+    "Comment": ""
+  },
+  {
+    "Key": "4E8C71D217B0FEC6382063F9E7615D4905131244F389FB5FD994EE354DAAC0F7",
+    "Nonce": "AC0DA6BCA96CFF68CC267A88",
+    "Ad": "",
+    "Msg": "48656C6C6F2C20776F726C6421",
+    "Ciphertext": "C3ED7FCB54829597D6C6FBDEF68CE739D1E4B74665EAE1BD32EFBF2E87",
+    "CommitmentTag": "F57C7F4EFC9C8DC28278695456F55D7D44D63CA31571805614E497E5924F39EF",
+    "Result": "true",
+    "Comment": "empty AD"
+  },
+  {
+    "Key": "3A4C0005C8E42599987AC76A471FAECBABEF25ACD9BE24F37ED2AE5E9AC11272",
+    "Nonce": "FB5BC82AFEBB98C9F64C464F",
+    "Ad": "4164646974696F6E616C2064617461",
+    "Msg": "",
+    "Ciphertext": "616F5495AC532F1B59BF1601BB02D757",
+    "CommitmentTag": "57C86B406C13FA59DC71134E4028260FA4CB928F8DF030D2E58A5721595770FD",
+    "Result": "true",
+    "Comment": "empty Msg"
+  },
+  {
+    "Key": "0DD43C54C150276FD00C2168A583C3C880D43476005284FA88C2DFA12FD38499",
+    "Nonce": "A84D7477DCD6EB343E0F7602",
+    "Ad": "",
+    "Msg": "",
+    "Ciphertext": "A473E7D2D3FBE9F2EAF1F9174D4DD247",
+    "CommitmentTag": "64AE62B254F174AA762270C2E94AB1582CE146220ABEBDBFCC4D4C7B369805FE",
+    "Result": "true",
+    "Comment": "empty AD+Msg"
+  },
+  {
+    "Key": "0000000000000000000000000000000000000000000000000000000000000000",
+    "Nonce": "027FAFAB15476DBA39B258CB",
+    "Ad": "4164646974696F6E616C2064617461",
+    "Msg": "48656C6C6F2C20776F726C6421",
+    "Ciphertext": "8033FCDBE983FD46C9FB1CB89FE1C1447E755A140FC8448E12EC08D853",
+    "CommitmentTag": "B4E8A508D071CDD83C72949E0319E5B089B589BD37D99138521EF5E48A463DA3",
+    "Result": "false",
+    "Comment": "wrong key"
+  },
+  {
+    "Key": "F18C4A93F0F6ECB0C235E21FCB18560040A0E17C49A8C1F4DBAADE0992156ABA",
+    "Nonce": "000000000000000000000000",
+    "Ad": "4164646974696F6E616C2064617461",
+    "Msg": "48656C6C6F2C20776F726C6421",
+    "Ciphertext": "5802223F4D75F49824C08EB77FE3D79DE28E1B14C5D50A565CB4358FB9",
+    "CommitmentTag": "FBB8B729A8857863B5FA342F084CD7F28165D3EFDD52239841B0D6FB69DE8A91",
+    "Result": "false",
+    "Comment": "wrong nonce"
+  },
+  {
+    "Key": "040F4879A93C867697F032D270BB1ACDAB51D0E4F32243BD9548E5D74E87B44A",
+    "Nonce": "A8E73CC899987A7943F051D8",
+    "Ad": "4064646974696F6E616C2064617461",
+    "Msg": "48656C6C6F2C20776F726C6421",
+    "Ciphertext": "EC49F3FF4F1CE4D7D961CE7213D0139322804FAB3E1AD9F7BD3DF17EAB",
+    "CommitmentTag": "3AE71C6E9A969E238AB449DD2F08884983115A43F30912923D8513E74D60694C",
+    "Result": "false",
+    "Comment": "wrong AD"
+  },
+  {
+    "Key": "FBC5C531A6B1F1009DB21BBF9C46F5458D5D15A810D7F0D636A9F587F9EEDCAB",
+    "Nonce": "EAA440F1F3C0B262BBD85FFE",
+    "Ad": "4164646974696F6E616C2064617461",
+    "Msg": "48656C6C6F2C20776F726C6421",
+    "Ciphertext": "AAB5DAD67444A2FC1E6DC1B989FC4EB8B43D5619356C4C064F93DEF84C",
+    "CommitmentTag": "DF75EF365B0C171E517FCA3F872AFA6DB37B805E9E61DBCD1B1FA82A6EF89AD5",
+    "Result": "false",
+    "Comment": "wrong ciphertext"
+  },
+  {
+    "Key": "63C6A179A81C8337957A6DF27B0986D2168B50313B87478BD3E36249FC7AB9D3",
+    "Nonce": "35E2C6DBBE23E353C1E83A09",
+    "Ad": "4164646974696F6E616C2064617461",
+    "Msg": "48656C6C6F2C20776F726C6421",
+    "Ciphertext": "1FCEC02BC5152E1CC311E6337BCEF3DF5105ACC82E3449EFD9C1B8A170",
+    "CommitmentTag": "0052312D91A0F5696D1B0E93837D0AD42C1C6166845B29DF91AD42CCD84FEED2",
+    "Result": "false",
+    "Comment": "wrong Poly1305 tag"
+  },
+  {
+    "Key": "7D68487B1BBB8D5A77D01CAF5FD3FB53CDABFE49427EC1B2D2564C14641F6AAC",
+    "Nonce": "7363B6891408E6A54B4F5DCF",
+    "Ad": "4164646974696F6E616C2064617461",
+    "Msg": "48656C6C6F2C20776F726C6421",
+    "Ciphertext": "843DCFC91BBB17BD0138D12368C4E153928768009E38BE40EF89281910",
+    "CommitmentTag": "D57EE470CB566A204489A070ED3F4F76A0D1C21122023BB8E6E325A600A7C660",
+    "Result": "false",
+    "Comment": "wrong CommitmentTag"
+  }
+]

tests/test_data/experimental/ctx_xchacha20_poly1305_blake2b_256.json

@@ -0,0 +1,102 @@
+[
+  {
+    "Key": "89EB0D6A8A691DAE2CD15ED0369931CE0A949ECAFA5C3F93F8121833646E15C3",
+    "Nonce": "89EB0D6A8A691DAE2CD15ED0369931CE0A949ECAFA5C3F93",
+    "Ad": "4164646974696F6E616C2064617461",
+    "Msg": "48656C6C6F2C20776F726C6421",
+    "Ciphertext": "3708B655EED215C5A38C053B77867C51B5BABF145855635C3E35403C71",
+    "CommitmentTag": "9459401208674E36E2B2AD3AC3227626260314B25B102F5992F4E5F0629905C2",
+    "Result": "true",
+    "Comment": ""
+  },
+  {
+    "Key": "4E8C71D217B0FEC6382063F9E7615D4905131244F389FB5FD994EE354DAAC0F7",
+    "Nonce": "AD83F02749CB1D750F4659A1FE0061BBE10401332DA292E5",
+    "Ad": "",
+    "Msg": "48656C6C6F2C20776F726C6421",
+    "Ciphertext": "EBF32DAC34486BED02A75603F5C3D8BCDA9779C437680D86B8855945D1",
+    "CommitmentTag": "69A64AC49FC8123898C76A84DE17824F6BEA63B614580455C97B8D5AA7D23A80",
+    "Result": "true",
+    "Comment": "empty AD"
+  },
+  {
+    "Key": "3A4C0005C8E42599987AC76A471FAECBABEF25ACD9BE24F37ED2AE5E9AC11272",
+    "Nonce": "1D33723B61107F0B6ACA4E03D20CFB2A83BF038B871D1B18",
+    "Ad": "4164646974696F6E616C2064617461",
+    "Msg": "",
+    "Ciphertext": "2228CB429C172CC2F02E1E3579F27ABB",
+    "CommitmentTag": "9A5DBC6E488925C2DCFE20F304FF106657FB1700B4903B99E132082C9A950C11",
+    "Result": "true",
+    "Comment": "empty Msg"
+  },
+  {
+    "Key": "0DD43C54C150276FD00C2168A583C3C880D43476005284FA88C2DFA12FD38499",
+    "Nonce": "9293F234F3A2FB681A79D5EBC1215C3E626848097446E524",
+    "Ad": "",
+    "Msg": "",
+    "Ciphertext": "E482764C67BCF5DF7AD657929AD3DFC1",
+    "CommitmentTag": "D291A4C6588DBEA8C918AE683FD64B38A636B321795CD406996DB049800747E8",
+    "Result": "true",
+    "Comment": "empty AD+Msg"
+  },
+  {
+    "Key": "0000000000000000000000000000000000000000000000000000000000000000",
+    "Nonce": "4F671669C92762BB6BB9FF97511CAED84F6EEE73BB79A003",
+    "Ad": "4164646974696F6E616C2064617461",
+    "Msg": "48656C6C6F2C20776F726C6421",
+    "Ciphertext": "700621747C713CEF1A940CB728E00328111AEC1051492F0A96334DC078",
+    "CommitmentTag": "A0EE79539B7DBEFE9F3085EF809B5C97AD58D2A47F45B81007AA9D859B46609C",
+    "Result": "false",
+    "Comment": "wrong key"
+  },
+  {
+    "Key": "F18C4A93F0F6ECB0C235E21FCB18560040A0E17C49A8C1F4DBAADE0992156ABA",
+    "Nonce": "000000000000000000000000000000000000000000000000",
+    "Ad": "4164646974696F6E616C2064617461",
+    "Msg": "48656C6C6F2C20776F726C6421",
+    "Ciphertext": "6844BE24D897BA3461AE0C5BD31CF21A548EBEACE54A09D745CE5F7702",
+    "CommitmentTag": "06E83D7B2FBD5D5AFC4B7022388A9DE328BC17889A0A4B3067EA1C94AD0ECC91",
+    "Result": "false",
+    "Comment": "wrong nonce"
+  },
+  {
+    "Key": "040F4879A93C867697F032D270BB1ACDAB51D0E4F32243BD9548E5D74E87B44A",
+    "Nonce": "7ACCD6D1E8990FC969833E6684178AEC9D7D7E1C8F6EDD2B",
+    "Ad": "4064646974696F6E616C2064617461",
+    "Msg": "48656C6C6F2C20776F726C6421",
+    "Ciphertext": "22BA99B85CD8B9355A341F231C446269FF901361E980BBFC733210C1E5",
+    "CommitmentTag": "4589A7C9A6E7358AA53C982BBE99C092AC607862EC971DEE2930C2AE6DD136AE",
+    "Result": "false",
+    "Comment": "wrong AD"
+  },
+  {
+    "Key": "FBC5C531A6B1F1009DB21BBF9C46F5458D5D15A810D7F0D636A9F587F9EEDCAB",
+    "Nonce": "A4BC3FC8C02799742CAFD077F8E82F1B0843331510DF220D",
+    "Ad": "4164646974696F6E616C2064617461",
+    "Msg": "48656C6C6F2C20776F726C6421",
+    "Ciphertext": "46DB95A356F07B2319E951E6BF942A3F8E1E044F4452DA4ED7666662E9",
+    "CommitmentTag": "85FC687767EBB0D058E8F3A41A3ABEDDF2BD70666030EDBEB842D0F19FE5B80B",
+    "Result": "false",
+    "Comment": "wrong ciphertext"
+  },
+  {
+    "Key": "63C6A179A81C8337957A6DF27B0986D2168B50313B87478BD3E36249FC7AB9D3",
+    "Nonce": "DA3E1569010DCD6FBFE2FD5B53481131F4A8FEDDB63C7089",
+    "Ad": "4164646974696F6E616C2064617461",
+    "Msg": "48656C6C6F2C20776F726C6421",
+    "Ciphertext": "897BFAF887BF6910054A0744FCC67F84A011CB7076B38F77423D58E843",
+    "CommitmentTag": "F28B3B6E914D76345CAC901A5A6C21D752A9C17DDAFE2A67A803572A2844F13B",
+    "Result": "false",
+    "Comment": "wrong Poly1305 tag"
+  },
+  {
+    "Key": "7D68487B1BBB8D5A77D01CAF5FD3FB53CDABFE49427EC1B2D2564C14641F6AAC",
+    "Nonce": "4E37EA2C2AE2573E8812F74F90A1DEFAF9C94D8E0780CD2A",
+    "Ad": "4164646974696F6E616C2064617461",
+    "Msg": "48656C6C6F2C20776F726C6421",
+    "Ciphertext": "B730C342DC147A48EB2E2A49C1DEEE88F7C11FC0C8F7A622D1C803DD61",
+    "CommitmentTag": "526AB73D0CA848EBC75855C524FE963D348DAC34F2BD48610ECF9BC49F40A804",
+    "Result": "false",
+    "Comment": "wrong CommitmentTag"
+  }
+]