feat: v0.2.4, update dependencies

Reviewed-on: #1

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "aes-gcm-stream"
-version = "0.1.1"
+version = "0.2.4"
 edition = "2021"
 authors = ["Hatter Jiang"]
 repository = "https://git.hatter.ink/hatter/aes-gcm-stream"
@@ -12,10 +12,12 @@ categories = ["cryptography"]
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
-aes = { version = "0.8.3", features = ["zeroize"] }
-zeroize = { version = "1.6.0", features = ["zeroize_derive"] }
+aes = { version = "0.8", features = ["zeroize"] }
+cipher = "0.4"
+ghash = "0.5"
+zeroize = { version = "1.6", features = ["zeroize_derive"] }
 
 [dev-dependencies]
-hex = "0.4.3"
-aes-gcm = { version = "0.10.2", features = ["zeroize"] }
-benchmark-simple = "0.1.8"
+hex = "0.4"
+benchmark-simple = "0.1"
+aes-gcm = { version = "0.10", features = ["zeroize"] }

README.md

@@ -1,6 +1,7 @@
 # aes-gcm-stream
 
-[Document](https://docs.rs/aes-gcm-stream/)
+[Crates](https://crates.io/crates/aes-gcm-stream)
+| [Document](https://docs.rs/aes-gcm-stream/)
 
 ## Encrypt
 
@@ -34,5 +35,17 @@ Ciphertext: 86c22c5122404b39683ca9b79b889fd00a6212d1be2ebc3f4f8f22f90b
 Plaintext: Hello  World!
 ```
 
+Benchmark @MacBook Pro (Retina, 15-inch, Late 2013/2 GHz Quad-Core Intel Core i7)
+```text
+$ cargo run --release --example bench
+AES128 encrypt         : 483.04 M/s
+AES192 encrypt         : 466.22 M/s
+AES256 encrypt         : 451.38 M/s
+AES256 en/decrypt      : 222.66 M/s
+AES256 encrypt aes-gcm : 547.63 M/s
+```
 
-> Thanks: https://developer.aliyun.com/article/952809
+
+> Thanks:
+> * https://developer.aliyun.com/article/952809
+> * https://crates.io/crates/aes-gcm

examples/bench.rs

@@ -2,7 +2,7 @@ use aes_gcm::{Aes256Gcm, KeyInit};
 use aes_gcm::aead::{Aead, Nonce};
 use benchmark_simple::{Bench, Options};
 
-use aes_gcm_stream::{Aes128GcmStreamEncryptor, Aes192GcmStreamEncryptor, Aes256GcmStreamEncryptor};
+use aes_gcm_stream::{Aes128GcmStreamEncryptor, Aes192GcmStreamEncryptor, Aes256GcmStreamDecryptor, Aes256GcmStreamEncryptor};
 
 fn test_aes128_encrypt(m: &mut [u8]) {
     let key = [0u8; 16];
@@ -31,6 +31,23 @@ fn test_aes256_encrypt(m: &mut [u8]) {
     encryptor.finalize();
 }
 
+fn test_aes256_encrypted_and_decrypt(m: &mut [u8]) {
+    let key = [0u8; 32];
+    let nonce = [0u8; 12];
+    let mut encryptor = Aes256GcmStreamEncryptor::new(key.clone(), &nonce);
+
+    let mut encrypted = encryptor.update(m);
+    let (last_block, tag) = encryptor.finalize();
+    encrypted.extend_from_slice(&last_block);
+    encrypted.extend_from_slice(&tag);
+
+    let mut decryptor = Aes256GcmStreamDecryptor::new(key, &nonce);
+    let mut decrypted = decryptor.update(&encrypted);
+    let last_block = decryptor.finalize().expect("decrypt failed");
+    decrypted.extend_from_slice(&last_block);
+    assert_eq!(m, decrypted.as_slice());
+}
+
 fn test_aes256_encrypt_aesgcm(m: &mut [u8]) {
     let key = [0u8; 32];
     let nonce = [0u8; 12];
@@ -64,6 +81,9 @@ fn main() {
     let res = bench.run(options, || test_aes256_encrypt(&mut m));
     println!("AES256 encrypt         : {}", res.throughput(m.len() as _));
 
+    let res = bench.run(options, || test_aes256_encrypted_and_decrypt(&mut m));
+    println!("AES256 en/decrypt      : {}", res.throughput(m.len() as _));
+
     let res = bench.run(options, || test_aes256_encrypt_aesgcm(&mut m));
     println!("AES256 encrypt aes-gcm : {}", res.throughput(m.len() as _));
 }

src/decryptor.rs

@@ -1,9 +1,11 @@
 use aes::{Aes128, Aes192, Aes256};
 use aes::cipher::{Block, BlockEncrypt, KeyInit};
 use aes::cipher::generic_array::GenericArray;
-use zeroize::ZeroizeOnDrop;
+use ghash::GHash;
+use ghash::universal_hash::UniversalHash;
+use zeroize::Zeroize;
 
-use crate::util::{gmul_128, inc_32, msb_s, normalize_nonce, u8to128};
+use crate::util::{AesBlock, BLOCK_SIZE, inc_32, msb_s, normalize_nonce, u8to128};
 
 macro_rules! define_aes_gcm_stream_decryptor_impl {
     (
@@ -11,14 +13,10 @@ macro_rules! define_aes_gcm_stream_decryptor_impl {
         $aesn:tt,
         $key_size:tt
     ) => {
-
-#[derive(ZeroizeOnDrop)]
 pub struct $module {
-    crypto: $aesn,
+    cipher: $aesn,
     message_buffer: Vec<u8>,
-    integrality_buffer: Vec<u8>,
-    ghash_key: u128,
-    ghash_val: u128,
+    ghash: GHash,
     init_nonce: u128,
     encryption_nonce: u128,
     adata_len: usize,
@@ -30,31 +28,31 @@ impl $module {
         let key = GenericArray::from(key);
         let aes = $aesn::new(&key);
 
+        let mut ghash_key = ghash::Key::default();
+        aes.encrypt_block(&mut ghash_key);
+        let ghash = GHash::new(&ghash_key);
+        ghash_key.zeroize();
+
         let mut s = Self {
-            crypto: aes,
+            cipher: aes,
             message_buffer: vec![],
-            integrality_buffer: vec![],
-            ghash_key: 0,
-            ghash_val: 0,
+            ghash,
             init_nonce: 0,
             encryption_nonce: 0,
             adata_len: 0,
             message_len: 0,
         };
-        let (ghash_key, normalized_nonce) = s.normalize_nonce(nonce);
-        s.ghash_key = ghash_key;
+        let (_, normalized_nonce) = s.normalize_nonce(nonce);
         s.init_nonce = normalized_nonce;
         s.encryption_nonce = normalized_nonce;
         s
     }
 
     pub fn init_adata(&mut self, adata: &[u8]) {
-        self.integrality_buffer.extend_from_slice(adata);
-        self.adata_len += adata.len();
-
-        let adata_bit_len = self.adata_len * 8;
-        let v = 128 * ((adata_bit_len + 128 - 1) / 128) - adata_bit_len;
-        self.integrality_buffer.extend_from_slice(&vec![0x00; v / 8]);
+        if adata.len() > 0 {
+            self.adata_len += adata.len();
+            self.ghash.update_padded(adata);
+        }
     }
 
     pub fn update(&mut self, bytes: &[u8]) -> Vec<u8> {
@@ -65,21 +63,27 @@ impl $module {
             return Vec::with_capacity(0);
         }
         let blocks_count = (message_buffer_len / 16) - 1;
-        let mut plaintext_message = Vec::with_capacity(blocks_count * 16);
-        for i in 0..blocks_count {
-            self.encryption_nonce = inc_32(self.encryption_nonce);
-            let mut ctr = self.encryption_nonce.to_be_bytes();
-            let block = Block::<$aesn>::from_mut_slice(&mut ctr);
-            self.crypto.encrypt_block(block);
-            let chunk = &message_buffer_slice[i * 16..(i + 1) * 16];
-            let y = u8to128(chunk) ^ u8to128(&block.as_slice());
-            plaintext_message.extend_from_slice(&y.to_be_bytes());
-        }
-        self.integrality_buffer.extend_from_slice(&message_buffer_slice[0..blocks_count * 16]);
-        self.message_buffer = message_buffer_slice[blocks_count * 16..].to_vec();
-        self.message_len += plaintext_message.len();
 
-        self.update_integrality_buffer();
+        let mut blocks = Vec::with_capacity(blocks_count);
+        for _ in 0..blocks_count {
+            self.encryption_nonce = inc_32(self.encryption_nonce);
+            let ctr = self.encryption_nonce.to_be_bytes();
+            blocks.push(Block::<AesBlock>::clone_from_slice(&ctr));
+        }
+        self.cipher.encrypt_blocks(&mut blocks);
+
+        let encrypted_message = &message_buffer_slice[0..blocks_count * BLOCK_SIZE];
+        self.ghash.update_padded(encrypted_message);
+        let mut plaintext_message = encrypted_message.to_vec();
+        for i in 0..blocks_count {
+            let chunk = &mut plaintext_message[i * BLOCK_SIZE..(i + 1) * BLOCK_SIZE];
+            let block = blocks[i].as_slice();
+            for k in 0..BLOCK_SIZE {
+                chunk[k] ^= block[k];
+            }
+        }
+        self.message_buffer = message_buffer_slice[blocks_count * BLOCK_SIZE..].to_vec();
+        self.message_len += plaintext_message.len();
 
         plaintext_message
     }
@@ -91,25 +95,22 @@ impl $module {
             // last block and this block len is less than 128 bits
             self.encryption_nonce = inc_32(self.encryption_nonce);
             let mut ctr = self.encryption_nonce.to_be_bytes();
-            let block = Block::<$aesn>::from_mut_slice(&mut ctr);
-            self.crypto.encrypt_block(block);
+            let block = Block::<AesBlock>::from_mut_slice(&mut ctr);
+            self.cipher.encrypt_block(block);
 
             let chunk = &self.message_buffer[0..message_buffer_len - 16];
             let msb = msb_s(chunk.len() * 8, block.as_slice());
             let y = u8to128(chunk) ^ u8to128(&msb);
             plaintext_message.extend_from_slice(&y.to_be_bytes()[16 - chunk.len()..16]);
-            self.integrality_buffer.extend_from_slice(&self.message_buffer[0..message_buffer_len - 16]);
+            self.ghash.update_padded(&self.message_buffer[0..message_buffer_len - 16]);
             self.message_len += plaintext_message.len();
         }
         let adata_bit_len = self.adata_len * 8;
         let message_bit_len = self.message_len * 8;
-        let u = 128 * ((message_bit_len + 128 - 1) / 128) - message_bit_len;
-        self.integrality_buffer.extend_from_slice(&vec![0x00; u / 8]);
-        self.integrality_buffer.extend_from_slice(&(adata_bit_len as u64).to_be_bytes());
-        self.integrality_buffer.extend_from_slice(&(message_bit_len as u64).to_be_bytes());
-
-        self.update_integrality_buffer();
-        assert!(self.integrality_buffer.is_empty());
+        let mut adata_and_message_len = Vec::with_capacity(BLOCK_SIZE);
+        adata_and_message_len.extend_from_slice(&(adata_bit_len as u64).to_be_bytes());
+        adata_and_message_len.extend_from_slice(&(message_bit_len as u64).to_be_bytes());
+        self.ghash.update_padded(&adata_and_message_len);
 
         let tag = self.calculate_tag();
         let message_tag = &self.message_buffer[message_buffer_len - 16..];
@@ -124,30 +125,18 @@ impl $module {
 
     fn calculate_tag(&mut self) -> Vec<u8> {
         let mut bs = self.init_nonce.to_be_bytes().clone();
-        let block = Block::<$aesn>::from_mut_slice(&mut bs);
-        self.crypto.encrypt_block(block);
-        let tag_trunk = self.ghash_val.to_be_bytes();
+        let block = Block::<AesBlock>::from_mut_slice(&mut bs);
+        self.cipher.encrypt_block(block);
+        let ghash = self.ghash.clone().finalize();
+        let tag_trunk = ghash.as_slice();
         let y = u8to128(&tag_trunk) ^ u8to128(&block.as_slice());
         y.to_be_bytes().to_vec()
     }
 
-    fn update_integrality_buffer(&mut self) {
-        let integrality_buffer_slice = self.integrality_buffer.as_slice();
-        let integrality_buffer_slice_len = integrality_buffer_slice.len();
-        if integrality_buffer_slice_len >= 16 {
-            let blocks_count = integrality_buffer_slice_len / 16;
-            for i in 0..blocks_count {
-                let buf = &integrality_buffer_slice[i * 16..(i + 1) * 16];
-                self.ghash_val = gmul_128(self.ghash_val ^ u8to128(buf), self.ghash_key)
-            }
-            self.integrality_buffer = integrality_buffer_slice[blocks_count * 16..].to_vec();
-        }
-    }
-
     fn ghash_key(&mut self) -> u128 {
-        let mut block = [0u8; 16];
-        let block = Block::<$aesn>::from_mut_slice(&mut block);
-        self.crypto.encrypt_block(block);
+        let mut block = [0u8; BLOCK_SIZE];
+        let block = Block::<AesBlock>::from_mut_slice(&mut block);
+        self.cipher.encrypt_block(block);
         u8to128(&block.as_slice())
     }
 

src/encryptor.rs

@@ -1,9 +1,11 @@
 use aes::{Aes128, Aes192, Aes256};
 use aes::cipher::{Block, BlockEncrypt, KeyInit};
 use aes::cipher::generic_array::GenericArray;
-use zeroize::ZeroizeOnDrop;
+use ghash::GHash;
+use ghash::universal_hash::UniversalHash;
+use zeroize::Zeroize;
 
-use crate::util::{gmul_128, inc_32, msb_s, normalize_nonce, u8to128};
+use crate::util::{AesBlock, BLOCK_SIZE, inc_32, msb_s, normalize_nonce, u8to128};
 
 macro_rules! define_aes_gcm_stream_encryptor_impl {
     (
@@ -11,14 +13,10 @@ macro_rules! define_aes_gcm_stream_encryptor_impl {
         $aesn:tt,
         $key_size:tt
     ) => {
-
-#[derive(ZeroizeOnDrop)]
 pub struct $module {
-    crypto: $aesn,
+    cipher: $aesn,
     message_buffer: Vec<u8>,
-    integrality_buffer: Vec<u8>,
-    ghash_key: u128,
-    ghash_val: u128,
+    ghash: GHash,
     init_nonce: u128,
     encryption_nonce: u128,
     adata_len: usize,
@@ -30,117 +28,106 @@ impl $module {
         let key = GenericArray::from(key);
         let aes = $aesn::new(&key);
 
+        let mut ghash_key = ghash::Key::default();
+        aes.encrypt_block(&mut ghash_key);
+        let ghash = GHash::new(&ghash_key);
+        ghash_key.zeroize();
+
         let mut s = Self {
-            crypto: aes,
+            cipher: aes,
             message_buffer: vec![],
-            integrality_buffer: vec![],
-            ghash_key: 0,
-            ghash_val: 0,
+            ghash,
             init_nonce: 0,
             encryption_nonce: 0,
             adata_len: 0,
             message_len: 0,
         };
-        let (ghash_key, normalized_nonce) = s.normalize_nonce(nonce);
-        s.ghash_key = ghash_key;
+        let (_, normalized_nonce) = s.normalize_nonce(nonce);
         s.init_nonce = normalized_nonce;
         s.encryption_nonce = normalized_nonce;
         s
     }
 
     pub fn init_adata(&mut self, adata: &[u8]) {
-        self.integrality_buffer.extend_from_slice(adata);
-        self.adata_len += adata.len();
-
-        let adata_bit_len = self.adata_len * 8;
-        let v = 128 * ((adata_bit_len + 128 - 1) / 128) - adata_bit_len;
-        self.integrality_buffer.extend_from_slice(&vec![0x00; v / 8]);
+        if adata.len() > 0 {
+            self.adata_len += adata.len();
+            self.ghash.update_padded(adata);
+        }
     }
 
-    pub fn update(&mut self, bytes: &[u8]) -> Vec<u8> {
-        self.message_buffer.extend_from_slice(bytes);
+    pub fn update(&mut self, message: &[u8]) -> Vec<u8> {
+        self.message_buffer.extend_from_slice(message);
         let message_buffer_slice = self.message_buffer.as_slice();
-        let message_buffer_len = message_buffer_slice.len();
-        if message_buffer_len < 16 {
+        if message_buffer_slice.len() < BLOCK_SIZE {
             return Vec::with_capacity(0);
         }
-        let blocks_count = message_buffer_len / 16;
-        let mut encrypted_message = Vec::with_capacity(blocks_count * 16);
-        for i in 0..blocks_count {
+        let blocks_count = message_buffer_slice.len() / BLOCK_SIZE;
+        let mut blocks = Vec::with_capacity(blocks_count);
+        for _ in 0..blocks_count {
             self.encryption_nonce = inc_32(self.encryption_nonce);
-            let mut ctr = self.encryption_nonce.to_be_bytes();
-            let block = Block::<$aesn>::from_mut_slice(&mut ctr);
-            self.crypto.encrypt_block(block);
-            let chunk = &message_buffer_slice[i * 16..(i + 1) * 16];
-            let y = u8to128(chunk) ^ u8to128(&block.as_slice());
-            encrypted_message.extend_from_slice(&y.to_be_bytes());
+            let ctr = self.encryption_nonce.to_be_bytes();
+            blocks.push(Block::<AesBlock>::clone_from_slice(&ctr));
         }
-        self.message_buffer = message_buffer_slice[blocks_count * 16..].to_vec();
-        self.integrality_buffer.extend_from_slice(&encrypted_message);
-        self.message_len += encrypted_message.len();
+        self.cipher.encrypt_blocks(&mut blocks);
 
-        self.update_integrality_buffer();
+        let mut encrypted_message = message_buffer_slice[0..blocks_count * BLOCK_SIZE].to_vec();
+        for i in 0..blocks_count {
+            let chunk = &mut encrypted_message[i * BLOCK_SIZE..(i + 1) * BLOCK_SIZE];
+            let block = blocks[i].as_slice();
+            for k in 0..BLOCK_SIZE {
+                chunk[k] ^= block[k];
+            }
+        }
+        self.ghash.update_padded(&encrypted_message);
+        self.message_buffer = message_buffer_slice[blocks_count * BLOCK_SIZE..].to_vec();
+        self.message_len += encrypted_message.len();
 
         encrypted_message
     }
 
     pub fn finalize(&mut self) -> (Vec<u8>, Vec<u8>) {
-        let mut encrypted_message = Vec::with_capacity(16);
+        let mut final_encrypted_message = Vec::with_capacity(BLOCK_SIZE);
         if !self.message_buffer.is_empty() {
-            // last block and this block len is less than 128 bits
+            // last block and this block len may less than 128 bits (16 bytes)
             self.encryption_nonce = inc_32(self.encryption_nonce);
             let mut ctr = self.encryption_nonce.to_be_bytes();
-            let block = Block::<$aesn>::from_mut_slice(&mut ctr);
-            self.crypto.encrypt_block(block);
+            let block = Block::<AesBlock>::from_mut_slice(&mut ctr);
+            self.cipher.encrypt_block(block);
 
             let chunk = self.message_buffer.as_slice();
             let msb = msb_s(chunk.len() * 8, block.as_slice());
             let y = u8to128(chunk) ^ u8to128(&msb);
-            encrypted_message.extend_from_slice(&y.to_be_bytes()[16 - chunk.len()..16]);
-            self.integrality_buffer.extend_from_slice(&encrypted_message);
-            self.message_len += encrypted_message.len();
+            final_encrypted_message.extend_from_slice(&y.to_be_bytes()[16 - chunk.len()..16]);
+            self.ghash.update_padded(&final_encrypted_message);
+            self.message_len += final_encrypted_message.len();
         }
         let adata_bit_len = self.adata_len * 8;
         let message_bit_len = self.message_len * 8;
-        let u = 128 * ((message_bit_len + 128 - 1) / 128) - message_bit_len;
-        self.integrality_buffer.extend_from_slice(&vec![0x00; u / 8]);
-        self.integrality_buffer.extend_from_slice(&(adata_bit_len as u64).to_be_bytes());
-        self.integrality_buffer.extend_from_slice(&(message_bit_len as u64).to_be_bytes());
+        let mut adata_and_message_len = Vec::with_capacity(BLOCK_SIZE);
+        adata_and_message_len.extend_from_slice(&(adata_bit_len as u64).to_be_bytes());
+        adata_and_message_len.extend_from_slice(&(message_bit_len as u64).to_be_bytes());
+        self.ghash.update_padded(&adata_and_message_len);
 
-        self.update_integrality_buffer();
-        assert!(self.integrality_buffer.is_empty());
 
-        let tag = self.calculate_tag();
+        let tag = self.compute_tag();
 
-        (encrypted_message, tag)
+        (final_encrypted_message, tag)
     }
 
-    fn calculate_tag(&mut self) -> Vec<u8> {
+    fn compute_tag(&mut self) -> Vec<u8> {
         let mut bs = self.init_nonce.to_be_bytes().clone();
-        let block = Block::<$aesn>::from_mut_slice(&mut bs);
-        self.crypto.encrypt_block(block);
-        let tag_trunk = self.ghash_val.to_be_bytes();
+        let block = Block::<AesBlock>::from_mut_slice(&mut bs);
+        self.cipher.encrypt_block(block);
+        let ghash = self.ghash.clone().finalize();
+        let tag_trunk = ghash.as_slice();
         let y = u8to128(&tag_trunk) ^ u8to128(&block.as_slice());
         y.to_be_bytes().to_vec()
     }
 
-    fn update_integrality_buffer(&mut self) {
-        let integrality_buffer_slice = self.integrality_buffer.as_slice();
-        let integrality_buffer_slice_len = integrality_buffer_slice.len();
-        if integrality_buffer_slice_len >= 16 {
-            let blocks_count = integrality_buffer_slice_len / 16;
-            for i in 0..blocks_count {
-                let buf = &integrality_buffer_slice[i * 16..(i + 1) * 16];
-                self.ghash_val = gmul_128(self.ghash_val ^ u8to128(buf), self.ghash_key)
-            }
-            self.integrality_buffer = integrality_buffer_slice[blocks_count * 16..].to_vec();
-        }
-    }
-
     fn ghash_key(&mut self) -> u128 {
-        let mut block = [0u8; 16];
-        let block = Block::<$aesn>::from_mut_slice(&mut block);
-        self.crypto.encrypt_block(block);
+        let mut block = [0u8; BLOCK_SIZE];
+        let block = Block::<AesBlock>::from_mut_slice(&mut block);
+        self.cipher.encrypt_block(block);
         u8to128(&block.as_slice())
     }
 

src/lib.rs

@@ -1,3 +1,5 @@
+use zeroize::Zeroize;
+
 /// This library is created for AES/GCM stream encrypt or decrypt
 ///
 /// Structs for encryption:
@@ -22,22 +24,103 @@ mod util;
 mod encryptor;
 mod decryptor;
 
+pub fn aes_gcm_encrypt(key: &[u8], nonce: &[u8], message: &[u8]) -> Result<Vec<u8>, String> {
+    match key.len() {
+        16 => aes_128_gcm_encrypt(key, nonce, message),
+        24 => aes_192_gcm_encrypt(key, nonce, message),
+        32 => aes_256_gcm_encrypt(key, nonce, message),
+        _ => Err(format!("Bad key length")),
+    }
+}
+
+pub fn aes_gcm_decrypt(key: &[u8], nonce: &[u8], message: &[u8]) -> Result<Vec<u8>, String> {
+    match key.len() {
+        16 => aes_128_gcm_decrypt(key, nonce, message),
+        24 => aes_192_gcm_decrypt(key, nonce, message),
+        32 => aes_256_gcm_decrypt(key, nonce, message),
+        _ => Err(format!("Bad key length")),
+    }
+}
+
+pub fn aes_128_gcm_decrypt(key: &[u8], nonce: &[u8], message: &[u8]) -> Result<Vec<u8>, String> {
+    let mut key: [u8; 16] = key.try_into().map_err(|_| format!("Bad key length"))?;
+    let mut gcm_stream = Aes128GcmStreamDecryptor::new(key, nonce);
+    let mut first_block = gcm_stream.update(message);
+    let final_block = gcm_stream.finalize()?;
+    first_block.extend_from_slice(&final_block);
+    key.zeroize();
+    Ok(first_block)
+}
+
+pub fn aes_192_gcm_decrypt(key: &[u8], nonce: &[u8], message: &[u8]) -> Result<Vec<u8>, String> {
+    let mut key: [u8; 24] = key.try_into().map_err(|_| format!("Bad key length"))?;
+    let mut gcm_stream = Aes192GcmStreamDecryptor::new(key, nonce);
+    let mut first_block = gcm_stream.update(message);
+    let final_block = gcm_stream.finalize()?;
+    first_block.extend_from_slice(&final_block);
+    key.zeroize();
+    Ok(first_block)
+}
+
+pub fn aes_256_gcm_decrypt(key: &[u8], nonce: &[u8], message: &[u8]) -> Result<Vec<u8>, String> {
+    let mut key: [u8; 32] = key.try_into().map_err(|_| format!("Bad key length"))?;
+    let mut gcm_stream = Aes256GcmStreamDecryptor::new(key, nonce);
+    let mut first_block = gcm_stream.update(message);
+    let final_block = gcm_stream.finalize()?;
+    first_block.extend_from_slice(&final_block);
+    key.zeroize();
+    Ok(first_block)
+}
+
+pub fn aes_128_gcm_encrypt(key: &[u8], nonce: &[u8], message: &[u8]) -> Result<Vec<u8>, String> {
+    let mut key: [u8; 16] = key.try_into().map_err(|_| format!("Bad key length"))?;
+    let mut gcm_stream = Aes128GcmStreamEncryptor::new(key, nonce);
+    let mut first_block = gcm_stream.update(message);
+    let (last_block, tag) = gcm_stream.finalize();
+    first_block.extend_from_slice(&last_block);
+    first_block.extend_from_slice(&tag);
+    key.zeroize();
+    Ok(first_block)
+}
+
+pub fn aes_192_gcm_encrypt(key: &[u8], nonce: &[u8], message: &[u8]) -> Result<Vec<u8>, String> {
+    let mut key: [u8; 24] = key.try_into().map_err(|_| format!("Bad key length"))?;
+    let mut gcm_stream = Aes192GcmStreamEncryptor::new(key, nonce);
+    let mut first_block = gcm_stream.update(message);
+    let (last_block, tag) = gcm_stream.finalize();
+    first_block.extend_from_slice(&last_block);
+    first_block.extend_from_slice(&tag);
+    key.zeroize();
+    Ok(first_block)
+}
+
+pub fn aes_256_gcm_encrypt(key: &[u8], nonce: &[u8], message: &[u8]) -> Result<Vec<u8>, String> {
+    let mut key: [u8; 32] = key.try_into().map_err(|_| format!("Bad key length"))?;
+    let mut gcm_stream = Aes256GcmStreamEncryptor::new(key, nonce);
+    let mut first_block = gcm_stream.update(message);
+    let (last_block, tag) = gcm_stream.finalize();
+    first_block.extend_from_slice(&last_block);
+    first_block.extend_from_slice(&tag);
+    key.zeroize();
+    Ok(first_block)
+}
+
 #[test]
 fn test128() {
     use aes_gcm::{aead::{Aead, Nonce, Payload}, Aes128Gcm, KeyInit};
     let knp = vec![
-        ([0; 16], [0; 12], &[] as &[u8], b"Hello World!" as &[u8]),
-        ([0; 16], [0; 12], &[1; 16], b"Hello World!" as &[u8]),
-        ([0; 16], [0; 12], &[1; 17], b"Hello World!" as &[u8]),
-        ([0; 16], [0; 12], &[1; 32], b"Hello World!" as &[u8]),
-        ([0; 16], [0; 12], &[1; 64], b"Hello World!" as &[u8]),
-        ([0; 16], [0; 12], &[1, 2, 3], b"Hello World!" as &[u8]),
+        ([1; 16], [0; 12], &[] as &[u8], b"Hello World!" as &[u8]),
+        ([2; 16], [0; 12], &[1; 16], b"Hello World!" as &[u8]),
+        ([3; 16], [0; 12], &[1; 17], b"Hello World!" as &[u8]),
+        ([4; 16], [0; 12], &[1; 32], b"Hello World!" as &[u8]),
+        ([5; 16], [0; 12], &[1; 64], b"Hello World!" as &[u8]),
+        ([6; 16], [0; 12], &[1, 2, 3], b"Hello World!" as &[u8]),
         ([1; 16], [0; 12], &[], b"Hello World!"),
-        ([0; 16], [1; 12], &[], b"Hello World!"),
+        ([7; 16], [1; 12], &[], b"Hello World!"),
         ([1; 16], [1; 12], &[], b"Hello World ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~!"),
         ([1; 16], [1; 12], &[0; 129], b"Hello World ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~!"),
         ([0xff; 16], [0; 12], &[], b"Hello World!"),
-        ([0; 16], [0xff; 12], &[], b"Hello World!"),
+        ([8; 16], [0xff; 12], &[], b"Hello World!"),
         ([0xff; 16], [0xff; 12], &[], b"Hello World ~~~~~~~~~~~~~~~~~\
         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\
         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\
@@ -102,18 +185,18 @@ fn test128() {
 #[test]
 fn test192() {
     let knp = vec![
-        ([0; 24], [0; 12], &[] as &[u8], b"Hello World!" as &[u8]),
-        ([0; 24], [0; 12], &[1; 16], b"Hello World!" as &[u8]),
-        ([0; 24], [0; 12], &[1; 17], b"Hello World!" as &[u8]),
-        ([0; 24], [0; 12], &[1; 32], b"Hello World!" as &[u8]),
-        ([0; 24], [0; 12], &[1; 64], b"Hello World!" as &[u8]),
-        ([0; 24], [0; 12], &[1, 2, 3], b"Hello World!" as &[u8]),
+        ([1; 24], [0; 12], &[] as &[u8], b"Hello World!" as &[u8]),
+        ([2; 24], [0; 12], &[1; 16], b"Hello World!" as &[u8]),
+        ([3; 24], [0; 12], &[1; 17], b"Hello World!" as &[u8]),
+        ([4; 24], [0; 12], &[1; 32], b"Hello World!" as &[u8]),
+        ([5; 24], [0; 12], &[1; 64], b"Hello World!" as &[u8]),
+        ([6; 24], [0; 12], &[1, 2, 3], b"Hello World!" as &[u8]),
         ([1; 24], [0; 12], &[], b"Hello World!"),
-        ([0; 24], [1; 12], &[], b"Hello World!"),
+        ([8; 24], [1; 12], &[], b"Hello World!"),
         ([1; 24], [1; 12], &[], b"Hello World ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~!"),
         ([1; 24], [1; 12], &[0; 129], b"Hello World ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~!"),
         ([0xff; 24], [0; 12], &[], b"Hello World!"),
-        ([0; 24], [0xff; 12], &[], b"Hello World!"),
+        ([9; 24], [0xff; 12], &[], b"Hello World!"),
         ([0xff; 24], [0xff; 12], &[], b"Hello World ~~~~~~~~~~~~~~~~~\
         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\
         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\
@@ -164,18 +247,18 @@ fn test192() {
 fn test256() {
     use aes_gcm::{aead::{Aead, Nonce, Payload}, Aes256Gcm, KeyInit};
     let knp = vec![
-        ([0; 32], [0; 12], &[] as &[u8], b"Hello World!" as &[u8]),
-        ([0; 32], [0; 12], &[1; 16], b"Hello World!" as &[u8]),
-        ([0; 32], [0; 12], &[1; 17], b"Hello World!" as &[u8]),
-        ([0; 32], [0; 12], &[1; 32], b"Hello World!" as &[u8]),
-        ([0; 32], [0; 12], &[1; 64], b"Hello World!" as &[u8]),
-        ([0; 32], [0; 12], &[1, 2, 3], b"Hello World!" as &[u8]),
+        ([1; 32], [0; 12], &[] as &[u8], b"Hello World!" as &[u8]),
+        ([2; 32], [0; 12], &[1; 16], b"Hello World!" as &[u8]),
+        ([3; 32], [0; 12], &[1; 17], b"Hello World!" as &[u8]),
+        ([4; 32], [0; 12], &[1; 32], b"Hello World!" as &[u8]),
+        ([5; 32], [0; 12], &[1; 64], b"Hello World!" as &[u8]),
+        ([6; 32], [0; 12], &[1, 2, 3], b"Hello World!" as &[u8]),
         ([1; 32], [0; 12], &[], b"Hello World!"),
-        ([0; 32], [1; 12], &[], b"Hello World!"),
+        ([7; 32], [1; 12], &[], b"Hello World!"),
         ([1; 32], [1; 12], &[], b"Hello World ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~!"),
         ([1; 32], [1; 12], &[0; 129], b"Hello World ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~!"),
         ([0xff; 32], [0; 12], &[], b"Hello World!"),
-        ([0; 32], [0xff; 12], &[], b"Hello World!"),
+        ([8; 32], [0xff; 12], &[], b"Hello World!"),
         ([0xff; 32], [0xff; 12], &[], b"Hello World ~~~~~~~~~~~~~~~~~\
         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\
         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\
@@ -198,6 +281,7 @@ fn test256() {
     ];
 
     for (key, nonce, aad, plaintext) in knp {
+        println!("======= {} {} {} {}", hex::encode(key), hex::encode(nonce), hex::encode(aad), hex::encode(plaintext));
         // encrypt
         let mut ciphertext = vec![];
         let mut encryptor = Aes256GcmStreamEncryptor::new(key.clone(), &nonce);
@@ -248,7 +332,7 @@ fn test256_stream() {
     // encrypt
     let mut ciphertext = vec![];
     let mut encryptor = Aes256GcmStreamEncryptor::new(key.clone(), &nonce);
-    for i in 0..1024 {
+    for i in 0..1025 {
         plaintext.extend_from_slice(&[(i % 128) as u8]);
         ciphertext.extend_from_slice(&encryptor.update(&[(i % 128) as u8]));
     }
@@ -278,3 +362,108 @@ fn test256_stream() {
     let decrypted_plaintext = cipher.decrypt(&decrypt_nonce, ciphertext.as_slice()).expect("decrypt1");
     assert_eq!(plaintext, decrypted_plaintext.as_slice());
 }
+
+#[test]
+fn test128_stream_and_array() {
+    let key = [0u8; 16];
+    let nonce = [0; 12];
+
+    let mut plaintext = vec![];
+    // encrypt
+    let mut ciphertext = vec![];
+    let mut encryptor = Aes128GcmStreamEncryptor::new(key.clone(), &nonce);
+    for i in 0..1025 {
+        plaintext.extend_from_slice(&[(i % 128) as u8]);
+        ciphertext.extend_from_slice(&encryptor.update(&[(i % 128) as u8]));
+    }
+    let (last_block, tag) = encryptor.finalize();
+    ciphertext.extend_from_slice(&last_block);
+    ciphertext.extend_from_slice(&tag);
+
+    let encrypted = aes_128_gcm_encrypt(&key, &nonce, &plaintext).unwrap();
+    let decrypted = aes_128_gcm_decrypt(&key, &nonce, &ciphertext).unwrap();
+    assert_eq!(ciphertext, encrypted);
+    assert_eq!(plaintext, decrypted);
+
+    let encrypted = aes_gcm_encrypt(&key, &nonce, &plaintext).unwrap();
+    let decrypted = aes_gcm_decrypt(&key, &nonce, &ciphertext).unwrap();
+    assert_eq!(ciphertext, encrypted);
+    assert_eq!(plaintext, decrypted);
+}
+
+#[test]
+fn test192_stream_and_array() {
+    let key = [0u8; 24];
+    let nonce = [0; 12];
+
+    let mut plaintext = vec![];
+    // encrypt
+    let mut ciphertext = vec![];
+    let mut encryptor = Aes192GcmStreamEncryptor::new(key.clone(), &nonce);
+    for i in 0..1025 {
+        plaintext.extend_from_slice(&[(i % 128) as u8]);
+        ciphertext.extend_from_slice(&encryptor.update(&[(i % 128) as u8]));
+    }
+    let (last_block, tag) = encryptor.finalize();
+    ciphertext.extend_from_slice(&last_block);
+    ciphertext.extend_from_slice(&tag);
+
+    let encrypted = aes_192_gcm_encrypt(&key, &nonce, &plaintext).unwrap();
+    let decrypted = aes_192_gcm_decrypt(&key, &nonce, &ciphertext).unwrap();
+    assert_eq!(ciphertext, encrypted);
+    assert_eq!(plaintext, decrypted);
+
+    let encrypted = aes_gcm_encrypt(&key, &nonce, &plaintext).unwrap();
+    let decrypted = aes_gcm_decrypt(&key, &nonce, &ciphertext).unwrap();
+    assert_eq!(ciphertext, encrypted);
+    assert_eq!(plaintext, decrypted);
+}
+
+#[test]
+fn test256_stream_and_array() {
+    let key = [0u8; 32];
+    let nonce = [0; 12];
+
+    let mut plaintext = vec![];
+    // encrypt
+    let mut ciphertext = vec![];
+    let mut encryptor = Aes256GcmStreamEncryptor::new(key.clone(), &nonce);
+    for i in 0..1025 {
+        plaintext.extend_from_slice(&[(i % 128) as u8]);
+        ciphertext.extend_from_slice(&encryptor.update(&[(i % 128) as u8]));
+    }
+    let (last_block, tag) = encryptor.finalize();
+    ciphertext.extend_from_slice(&last_block);
+    ciphertext.extend_from_slice(&tag);
+
+    let encrypted = aes_256_gcm_encrypt(&key, &nonce, &plaintext).unwrap();
+    let decrypted = aes_256_gcm_decrypt(&key, &nonce, &ciphertext).unwrap();
+    assert_eq!(ciphertext, encrypted);
+    assert_eq!(plaintext, decrypted);
+
+    let encrypted = aes_gcm_encrypt(&key, &nonce, &plaintext).unwrap();
+    let decrypted = aes_gcm_decrypt(&key, &nonce, &ciphertext).unwrap();
+    assert_eq!(ciphertext, encrypted);
+    assert_eq!(plaintext, decrypted);
+}
+
+#[test]
+fn test125_ab_nonce() {
+    let key = hex::decode("faf6a891866fac550ef548b4e5f6fbc98fccc6827cd943cc8d7539747f1d87bd").unwrap();
+    let key: [u8; 32] = key.try_into().map_err(|_| format!("Bad key length")).unwrap();
+    let nonce = hex::decode("cea500817694e16e734f07df422f6f52582d844e623746a96c5fbb4be2a38a6e").unwrap();
+    let ciphertext = hex::decode("c52dadf683c02e81d842f6563b").unwrap();
+    let tag = hex::decode("cc9062944525de37d3aa588c6a5676a2").unwrap();
+    let aad = b"firstName:";
+
+    let mut gcm_stream = Aes256GcmStreamDecryptor::new(key, &nonce);
+    gcm_stream.init_adata(&aad[..]);
+    let mut first_block = gcm_stream.update(&ciphertext);
+    let second_block = gcm_stream.update(&tag);
+    let final_block = gcm_stream.finalize().unwrap();
+
+    first_block.extend_from_slice(&second_block);
+    first_block.extend_from_slice(&final_block);
+
+    assert_eq!("John --- TEST", String::from_utf8(first_block).unwrap());
+}

src/util.rs

@@ -1,3 +1,15 @@
+use cipher::BlockSizeUser;
+use cipher::consts::U16;
+
+pub(crate) struct AesBlock {}
+
+impl BlockSizeUser for AesBlock {
+    type BlockSize = U16;
+}
+
+pub(crate) const BLOCK_SIZE: usize = 16;
+
+
 // R = 11100001 || 0(120)
 const R: u128 = 0b11100001 << 120;
 
@@ -27,18 +39,29 @@ pub(crate) fn ghash(key: u128, messages: &[u128]) -> u128 {
 }
 
 pub(crate) fn normalize_nonce(ghash_key: u128, nonce_bytes: &[u8]) -> (u128, u128) {
-    let nonce = u8to128(nonce_bytes);
     let normalized_nonce = match nonce_bytes.len() == 12 {
         true => {
+            let nonce = u8to128(nonce_bytes);
             nonce << 32 | 0x00000001
         }
         false => {
             let mut iv_padding = vec![];
-            // s = 128[len(iv) / 128] - len(iv)
-            let s = 128 * (((nonce_bytes.len() * 8) + 128 - 1) / 128) - (nonce_bytes.len() * 8);
-            iv_padding.push(nonce << s);
-            iv_padding.push((nonce_bytes.len() * 8) as u128);
-            ghash(ghash_key, &iv_padding)
+            iv_padding.extend_from_slice(nonce_bytes);
+            let left_len = nonce_bytes.len() - 16 * (nonce_bytes.len() / 16);
+            let tobe_padding_len = if left_len == 0 { 0 } else { 16 - left_len };
+            for _ in 0..tobe_padding_len { iv_padding.push(0); }
+
+            let mut block = ghash::Block::default();
+            let nonce_bits = (nonce_bytes.len() as u64) * 8;
+            block[8..].copy_from_slice(&nonce_bits.to_be_bytes());
+            iv_padding.extend_from_slice(block.as_slice());
+
+            let mut iv_padding_u128 = vec![];
+            let block_count = iv_padding.len() / 16;
+            for i in 0..block_count {
+                iv_padding_u128.push(u8to128(&iv_padding[i * 16..(i + 1) * 16]));
+            }
+            ghash(ghash_key, &iv_padding_u128)
         }
     };
     (ghash_key, normalized_nonce)
@@ -69,4 +92,30 @@ pub(crate) fn inc_32(bits: u128) -> u128 {
     let mut lsb = (bits & 0xffffffff) as u32;
     lsb = lsb.wrapping_add(1);
     msb << 32 | lsb as u128
+}
+
+#[test]
+fn test_normalize_nonce() {
+    use aes_gcm::KeyInit;
+    use ghash::Key;
+    use ghash::GHash;
+    use ghash::universal_hash::UniversalHash;
+    let ghash_key = [1u8; 16];
+    let key = Key::from(ghash_key);
+    let mut ghash = GHash::new(&key);
+
+    let nonce = [1u8; 22];
+    ghash.update_padded(&nonce);
+
+    let mut block = ghash::Block::default();
+    let nonce_bits = (nonce.len() as u64) * 8;
+    block[8..].copy_from_slice(&nonce_bits.to_be_bytes());
+    ghash.update(&[block]);
+    let final_nonce = ghash.finalize();
+    let final_nonce_bytes = final_nonce.as_slice();
+    let final_nonce1 = u8to128(final_nonce_bytes);
+
+    let (_, final_nonce2) = normalize_nonce(u8to128(&ghash_key), &nonce);
+
+    assert_eq!(final_nonce1, final_nonce2);
 }