chore: checkpoint before Python removal

vendor/aes-gcm/.cargo-checksum.json

@@ -0,0 +1 @@
+{"files":{".cargo_vcs_info.json":"eae7b633402a41733812a3705a0c22fb73cf86ac53c41f900d2c9b9cfeaa6731","CHANGELOG.md":"8b877289aed51a5c313286e2387abc4f17b3e6c284dc04eaf0f98846ccb18534","Cargo.toml":"cc58c8b539bdfdfa7f665340209afcf428962b8368c6b0beef3809dac3559506","Cargo.toml.orig":"515687dfeea618632d79fbbf2fb85570622306a7eec5344ae0594714eb6bb844","LICENSE-APACHE":"a9040321c3712d8fd0b09cf52b17445de04a23a10165049ae187cd39e5c86be5","LICENSE-MIT":"3c0dfa33fd2e6976038555b52095699452653b1fcabe113074f14e0848a6b11e","README.md":"20c9c6169af0c2b9ef737de89cf3d2d36f7122bdb8e4b6d95ccb4b04e75afecc","src/lib.rs":"9261306cb6e8ce08a3559d69b2c301b9c0474234b3ff4b92e3e3c8cd7937f479","tests/aes128gcm.rs":"fef2d95b49d245714256370207f6ce324bf90c7eb06dc742f9908470b39ae616","tests/aes256gcm.rs":"eac354157fa0574e58d569cfd541222bb1e4a0ca9561e2a578e3e1101214bbbc","tests/common/mod.rs":"f54a4dd4147b2e726139606e2afe6bf36444d5eff44a6fea61fb633e326985ba","tests/data/wycheproof-128.blb":"50031c7935b9c0608955601ca0aa573de58517aaa4986fc16550a91fa286ff8b","tests/data/wycheproof-256.blb":"d301c0cc24dccb3cdcb9db71b55e694d7dc31b166bf830ce2b3fc896567e1e1c","tests/other_ivlen.rs":"4ef546d000ba162c8a795f35a1c7eb9e6a6d563e0cc1214071ecb6573f79a3a2"},"package":"831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1"}

vendor/aes-gcm/.cargo_vcs_info.json

@@ -0,0 +1,6 @@
+{
+  "git": {
+    "sha1": "fa8197f11d79a079fcb1f6ef67fa9119ce6939b9"
+  },
+  "path_in_vcs": "aes-gcm"
+}

vendor/aes-gcm/CHANGELOG.md

@@ -0,0 +1,179 @@
+# Changelog
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## 0.10.3 (2023-09-21)
+### Security
+- Avoid exposing plaintext on tag verification failure ([#551])
+
+[#551]: https://github.com/RustCrypto/AEADs/pull/551
+
+## 0.10.2 (2023-05-20)
+### Added
+- `rand_core` feature to all crates ([#467])
+- Support for partial tag sizes ([#501])
+- `ArrayVec` support ([#503])
+
+[#467]: https://github.com/RustCrypto/AEADs/pull/467
+[#501]: https://github.com/RustCrypto/AEADs/pull/501
+[#503]: https://github.com/RustCrypto/AEADs/pull/503
+
+## 0.10.1 (2022-07-31)
+### Fixed
+- rustdoc typos and formatting ([#461], [#462])
+
+[#461]: https://github.com/RustCrypto/AEADs/pull/461
+[#462]: https://github.com/RustCrypto/AEADs/pull/462
+
+## 0.10.0 (2022-07-31)
+### Added
+- `getrandom` feature ([#446])
+
+### Changed
+- Bump `aes` dependency to v0.8 ([#430])
+- Rust 2021 edition upgrade; MSRV 1.56+ ([#435])
+- Bump `aead` dependency to v0.5 ([#444])
+- Bump `ghash` dependency to v0.5 ([#454])
+
+[#435]: https://github.com/RustCrypto/AEADs/pull/435
+[#444]: https://github.com/RustCrypto/AEADs/pull/444
+[#446]: https://github.com/RustCrypto/AEADs/pull/446
+[#454]: https://github.com/RustCrypto/AEADs/pull/454
+
+## 0.9.4 (2021-08-28)
+### Changed
+- Relax `subtle` and `zeroize` requirements ([#360])
+
+[#360]: https://github.com/RustCrypto/AEADs/pull/360
+
+## 0.9.3 (2021-07-20)
+### Changed
+- Pin `zeroize` dependency to v1.3 and `subtle` to v2.4 ([#349])
+
+[#349]: https://github.com/RustCrypto/AEADs/pull/349
+
+## 0.9.2 (2021-05-31)
+### Added
+- Nightly-only `armv8` feature ([#318])
+
+[#318]: https://github.com/RustCrypto/AEADs/pull/318
+
+## 0.9.1 (2021-05-04)
+### Added
+- `force-soft` feature ([#305])
+
+[#305]: https://github.com/RustCrypto/AEADs/pull/305
+
+## 0.9.0 (2021-04-29)
+### Added
+- Wycheproof test vectors ([#274])
+
+### Changed
+- Bump `aead` crate dependency to v0.4 ([#270])
+- Bump `aes` crate dependency to v0.7; MSRV 1.49+ ([#283])
+- Bump `ctr` crate dependency to v0.7 ([#283])
+- Bump `ghash` crate dependency to v0.4 ([#284])
+
+[#270]: https://github.com/RustCrypto/AEADs/pull/270
+[#274]: https://github.com/RustCrypto/AEADs/pull/274
+[#283]: https://github.com/RustCrypto/AEADs/pull/283
+[#284]: https://github.com/RustCrypto/AEADs/pull/284
+
+## 0.8.0 (2020-10-16)
+### Changed
+- Replace `block-cipher`/`stream-cipher` with `cipher` crate ([#229])
+- Bump `aes` dependency to v0.6 ([#229])
+- Use `ctr::Ctr32BE` ([#227])
+
+[#229]: https://github.com/RustCrypto/AEADs/pull/229
+[#227]: https://github.com/RustCrypto/AEADs/pull/227
+
+## 0.7.0 (2020-09-17)
+### Added
+- Optional `std` feature; disabled by default ([#217])
+
+### Changed
+- Renamed generic parameters to `Aes` and `NonceSize` ([#166])
+- Upgrade `aes` to v0.5; `block-cipher` to v0.8 ([#209])
+
+[#217]: https://github.com/RustCrypto/AEADs/pull/217
+[#209]: https://github.com/RustCrypto/AEADs/pull/209
+[#166]: https://github.com/RustCrypto/AEADs/pull/166
+
+## 0.6.0 (2020-06-06)
+### Changed
+- Bump `aead` crate dependency to v0.3.0; MSRV 1.41+ ([#140])
+
+[#140]: https://github.com/RustCrypto/AEADs/pull/140
+
+## 0.5.0 (2020-03-15)
+### Added
+- Support for non-96-bit nonces ([#126])
+
+### Changed
+- `AesGcm` type is now generic around nonce size ([#126])
+
+[#126]:  https://github.com/RustCrypto/AEADs/pull/126
+
+## 0.4.2 (2020-03-09)
+### Fixed
+- Off-by-one error in `debug_assert` for `BlockCipher::ParBlocks` ([#104])
+
+[#104]: https://github.com/RustCrypto/AEADs/pull/104
+
+## 0.4.1 (2020-03-07) - YANKED, see [#104]
+### Added
+- Support instantiation from an existing cipher instance ([#101])
+
+[#101]: https://github.com/RustCrypto/AEADs/pull/101
+
+## 0.4.0 (2020-03-07) - YANKED, see [#104]
+### Added
+- `aes` cargo feature; 3rd-party AES crate support ([#96])
+
+### Changed
+- Make generic around `BlockCipher::ParBlocks` ([#97])
+
+[#96]: https://github.com/RustCrypto/AEADs/pull/96
+[#97]: https://github.com/RustCrypto/AEADs/pull/97
+
+## 0.3.2 (2020-02-27)
+### Fixed
+- Wording in documentation about security audit ([#84])
+
+[#84]: https://github.com/RustCrypto/AEADs/pull/84
+
+## 0.3.1 (2020-02-26)
+### Added
+- Notes about NCC audit to documentation ([#80])
+
+[#80]: https://github.com/RustCrypto/AEADs/pull/80
+
+## 0.3.0 (2019-11-26)
+### Added
+- `heapless` feature ([#51])
+
+[#51]: https://github.com/RustCrypto/AEADs/pull/51
+
+## 0.2.1 (2019-11-26)
+### Added
+- Document in-place API ([#49])
+
+[#49]: https://github.com/RustCrypto/AEADs/pull/49
+
+## 0.2.0 (2019-11-26)
+### Changed
+- Upgrade `aead` crate to v0.2; `alloc` now optional ([#43])
+
+[#43]: https://github.com/RustCrypto/AEADs/pull/43
+
+## 0.1.1 (2019-11-14)
+### Changed
+- Upgrade `zeroize` to 1.0 ([#36])
+
+[#36]: https://github.com/RustCrypto/AEADs/pull/36
+
+## 0.1.0 (2019-10-06)
+- Initial release

vendor/aes-gcm/Cargo.toml

@@ -0,0 +1,100 @@
+# THIS FILE IS AUTOMATICALLY GENERATED BY CARGO
+#
+# When uploading crates to the registry Cargo will automatically
+# "normalize" Cargo.toml files for maximal compatibility
+# with all versions of Cargo and also rewrite `path` dependencies
+# to registry (e.g., crates.io) dependencies.
+#
+# If you are reading this file be aware that the original Cargo.toml
+# will likely look very different (and much more reasonable).
+# See Cargo.toml.orig for the original contents.
+
+[package]
+edition = "2021"
+rust-version = "1.56"
+name = "aes-gcm"
+version = "0.10.3"
+authors = ["RustCrypto Developers"]
+description = """
+Pure Rust implementation of the AES-GCM (Galois/Counter Mode)
+Authenticated Encryption with Associated Data (AEAD) Cipher
+with optional architecture-specific hardware acceleration
+"""
+documentation = "https://docs.rs/aes-gcm"
+readme = "README.md"
+keywords = [
+    "aead",
+    "aes",
+    "encryption",
+    "gcm",
+    "ghash",
+]
+categories = [
+    "cryptography",
+    "no-std",
+]
+license = "Apache-2.0 OR MIT"
+repository = "https://github.com/RustCrypto/AEADs"
+resolver = "1"
+
+[package.metadata.docs.rs]
+all-features = true
+rustdoc-args = [
+    "--cfg",
+    "docsrs",
+]
+
+[dependencies.aead]
+version = "0.5"
+default-features = false
+
+[dependencies.aes]
+version = "0.8"
+optional = true
+
+[dependencies.cipher]
+version = "0.4"
+
+[dependencies.ctr]
+version = "0.9"
+
+[dependencies.ghash]
+version = "0.5"
+default-features = false
+
+[dependencies.subtle]
+version = "2"
+default-features = false
+
+[dependencies.zeroize]
+version = "1"
+optional = true
+default-features = false
+
+[dev-dependencies.aead]
+version = "0.5"
+features = ["dev"]
+default-features = false
+
+[dev-dependencies.hex-literal]
+version = "0.3"
+
+[features]
+alloc = ["aead/alloc"]
+arrayvec = ["aead/arrayvec"]
+default = [
+    "aes",
+    "alloc",
+    "getrandom",
+]
+getrandom = [
+    "aead/getrandom",
+    "rand_core",
+]
+heapless = ["aead/heapless"]
+rand_core = ["aead/rand_core"]
+std = [
+    "aead/std",
+    "alloc",
+]
+stream = ["aead/stream"]

vendor/aes-gcm/LICENSE-APACHE

@@ -0,0 +1,201 @@
+                              Apache License
+                        Version 2.0, January 2004
+                     http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.
+
+   "Licensor" shall mean the copyright owner or entity authorized by
+   the copyright owner that is granting the License.
+
+   "Legal Entity" shall mean the union of the acting entity and all
+   other entities that control, are controlled by, or are under common
+   control with that entity. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.
+
+   "You" (or "Your") shall mean an individual or Legal Entity
+   exercising permissions granted by this License.
+
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.
+
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.
+
+   "Work" shall mean the work of authorship, whether in Source or
+   Object form, made available under the License, as indicated by a
+   copyright notice that is included in or attached to the work
+   (an example is provided in the Appendix below).
+
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.
+
+   "Contribution" shall mean any work of authorship, including
+   the original version of the Work and any modifications or additions
+   to that Work or Derivative Works thereof, that is intentionally
+   submitted to Licensor for inclusion in the Work by the copyright owner
+   or by an individual or Legal Entity authorized to submit on behalf of
+   the copyright owner. For the purposes of this definition, "submitted"
+   means any form of electronic, verbal, or written communication sent
+   to the Licensor or its representatives, including but not limited to
+   communication on electronic mailing lists, source code control systems,
+   and issue tracking systems that are managed by, or on behalf of, the
+   Licensor for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise
+   designated in writing by the copyright owner as "Not a Contribution."
+
+   "Contributor" shall mean Licensor and any individual or Legal Entity
+   on behalf of whom a Contribution has been received by Licensor and
+   subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:
+
+   (a) You must give any other recipients of the Work or
+       Derivative Works a copy of this License; and
+
+   (b) You must cause any modified files to carry prominent notices
+       stating that You changed the files; and
+
+   (c) You must retain, in the Source form of any Derivative Works
+       that You distribute, all copyright, patent, trademark, and
+       attribution notices from the Source form of the Work,
+       excluding those notices that do not pertain to any part of
+       the Derivative Works; and
+
+   (d) If the Work includes a "NOTICE" text file as part of its
+       distribution, then any Derivative Works that You distribute must
+       include a readable copy of the attribution notices contained
+       within such NOTICE file, excluding those notices that do not
+       pertain to any part of the Derivative Works, in at least one
+       of the following places: within a NOTICE text file distributed
+       as part of the Derivative Works; within the Source form or
+       documentation, if provided along with the Derivative Works; or,
+       within a display generated by the Derivative Works, if and
+       wherever such third-party notices normally appear. The contents
+       of the NOTICE file are for informational purposes only and
+       do not modify the License. You may add Your own attribution
+       notices within Derivative Works that You distribute, alongside
+       or as an addendum to the NOTICE text from the Work, provided
+       that such additional attribution notices cannot be construed
+       as modifying the License.
+
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+   To apply the Apache License to your work, attach the following
+   boilerplate notice, with the fields enclosed by brackets "[]"
+   replaced with your own identifying information. (Don't include
+   the brackets!)  The text should be enclosed in the appropriate
+   comment syntax for the file format. We also recommend that a
+   file or class name and description of purpose be included on the
+   same "printed page" as the copyright notice for easier
+   identification within third-party archives.
+
+Copyright [yyyy] [name of copyright owner]
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

vendor/aes-gcm/LICENSE-MIT

@@ -0,0 +1,25 @@
+Copyright (c) 2019 The RustCrypto Project Developers
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.

vendor/aes-gcm/README.md

@@ -0,0 +1,61 @@
+# RustCrypto: AES-GCM
+
+[![crate][crate-image]][crate-link]
+[![Docs][docs-image]][docs-link]
+![Apache2/MIT licensed][license-image]
+![Rust Version][rustc-image]
+[![Project Chat][chat-image]][chat-link]
+[![Build Status][build-image]][build-link]
+
+Pure Rust implementation of the AES-GCM
+[Authenticated Encryption with Associated Data (AEAD)][1] cipher.
+
+[Documentation][docs-link]
+
+## Security Notes
+
+This crate has received one [security audit by NCC Group][2], with no significant
+findings. We would like to thank [MobileCoin][3] for funding the audit.
+
+All implementations contained in the crate are designed to execute in constant
+time, either by relying on hardware intrinsics (i.e. AES-NI and CLMUL on
+x86/x86_64), or using a portable implementation which is only constant time
+on processors which implement constant-time multiplication.
+
+It is not suitable for use on processors with a variable-time multiplication
+operation (e.g. short circuit on multiply-by-zero / multiply-by-one, such as
+certain 32-bit PowerPC CPUs and some non-ARM microcontrollers).
+
+## License
+
+Licensed under either of:
+
+ * [Apache License, Version 2.0](http://www.apache.org/licenses/LICENSE-2.0)
+ * [MIT license](http://opensource.org/licenses/MIT)
+
+at your option.
+
+### Contribution
+
+Unless you explicitly state otherwise, any contribution intentionally submitted
+for inclusion in the work by you, as defined in the Apache-2.0 license, shall be
+dual licensed as above, without any additional terms or conditions.
+
+[//]: # (badges)
+
+[crate-image]: https://buildstats.info/crate/aes-gcm
+[crate-link]: https://crates.io/crates/aes-gcm
+[docs-image]: https://docs.rs/aes-gcm/badge.svg
+[docs-link]: https://docs.rs/aes-gcm/
+[license-image]: https://img.shields.io/badge/license-Apache2.0/MIT-blue.svg
+[rustc-image]: https://img.shields.io/badge/rustc-1.56+-blue.svg
+[chat-image]: https://img.shields.io/badge/zulip-join_chat-blue.svg
+[chat-link]: https://rustcrypto.zulipchat.com/#narrow/stream/260038-AEADs
+[build-image]: https://github.com/RustCrypto/AEADs/workflows/aes-gcm/badge.svg?branch=master&event=push
+[build-link]: https://github.com/RustCrypto/AEADs/actions
+
+[//]: # (general links)
+
+[1]: https://en.wikipedia.org/wiki/Authenticated_encryption
+[2]: https://research.nccgroup.com/2020/02/26/public-report-rustcrypto-aes-gcm-and-chacha20poly1305-implementation-review/
+[3]: https://www.mobilecoin.com/

vendor/aes-gcm/src/lib.rs

@@ -0,0 +1,373 @@
+#![no_std]
+#![cfg_attr(docsrs, feature(doc_cfg))]
+#![doc = include_str!("../README.md")]
+#![doc(
+    html_logo_url = "https://raw.githubusercontent.com/RustCrypto/meta/master/logo.svg",
+    html_favicon_url = "https://raw.githubusercontent.com/RustCrypto/meta/master/logo.svg"
+)]
+#![deny(unsafe_code)]
+#![warn(missing_docs, rust_2018_idioms)]
+
+//! # Usage
+//!
+//! Simple usage (allocating, no associated data):
+//!
+//! ```
+//! use aes_gcm::{
+//!     aead::{Aead, AeadCore, KeyInit, OsRng},
+//!     Aes256Gcm, Nonce, Key // Or `Aes128Gcm`
+//! };
+//!
+//! # fn gen_key() -> Result<(), core::array::TryFromSliceError> {
+//! // The encryption key can be generated randomly:
+//! # #[cfg(all(feature = "getrandom", feature = "std"))] {
+//! let key = Aes256Gcm::generate_key(OsRng);
+//! # }
+//!
+//! // Transformed from a byte array:
+//! let key: &[u8; 32] = &[42; 32];
+//! let key: &Key<Aes256Gcm> = key.into();
+//!
+//! // Note that you can get byte array from slice using the `TryInto` trait:
+//! let key: &[u8] = &[42; 32];
+//! let key: [u8; 32] = key.try_into()?;
+//! # Ok(()) }
+//!
+//! # fn main() -> Result<(), aes_gcm::Error> {
+//! // Alternatively, the key can be transformed directly from a byte slice
+//! // (panicks on length mismatch):
+//! # let key: &[u8] = &[42; 32];
+//! let key = Key::<Aes256Gcm>::from_slice(key);
+//!
+//! let cipher = Aes256Gcm::new(&key);
+//! let nonce = Aes256Gcm::generate_nonce(&mut OsRng); // 96-bits; unique per message
+//! let ciphertext = cipher.encrypt(&nonce, b"plaintext message".as_ref())?;
+//! let plaintext = cipher.decrypt(&nonce, ciphertext.as_ref())?;
+//! assert_eq!(&plaintext, b"plaintext message");
+//! # Ok(())
+//! # }
+//! ```
+//!
+//! ## In-place Usage (eliminates `alloc` requirement)
+//!
+//! This crate has an optional `alloc` feature which can be disabled in e.g.
+//! microcontroller environments that don't have a heap.
+//!
+//! The [`AeadInPlace::encrypt_in_place`] and [`AeadInPlace::decrypt_in_place`]
+//! methods accept any type that impls the [`aead::Buffer`] trait which
+//! contains the plaintext for encryption or ciphertext for decryption.
+//!
+//! Note that if you enable the `heapless` feature of this crate,
+//! you will receive an impl of [`aead::Buffer`] for `heapless::Vec`
+//! (re-exported from the [`aead`] crate as [`aead::heapless::Vec`]),
+//! which can then be passed as the `buffer` parameter to the in-place encrypt
+//! and decrypt methods:
+//!
+#![cfg_attr(
+    all(feature = "getrandom", feature = "heapless", feature = "std"),
+    doc = "```"
+)]
+#![cfg_attr(
+    not(all(feature = "getrandom", feature = "heapless", feature = "std")),
+    doc = "```ignore"
+)]
+//! # fn main() -> Result<(), Box<dyn std::error::Error>> {
+//! use aes_gcm::{
+//!     aead::{AeadCore, AeadInPlace, KeyInit, OsRng, heapless::Vec},
+//!     Aes256Gcm, Nonce, // Or `Aes128Gcm`
+//! };
+//!
+//! let key = Aes256Gcm::generate_key(&mut OsRng);
+//! let cipher = Aes256Gcm::new(&key);
+//! let nonce = Aes256Gcm::generate_nonce(&mut OsRng); // 96-bits; unique per message
+//!
+//! let mut buffer: Vec<u8, 128> = Vec::new(); // Note: buffer needs 16-bytes overhead for auth tag
+//! buffer.extend_from_slice(b"plaintext message");
+//!
+//! // Encrypt `buffer` in-place, replacing the plaintext contents with ciphertext
+//! cipher.encrypt_in_place(&nonce, b"", &mut buffer)?;
+//!
+//! // `buffer` now contains the message ciphertext
+//! assert_ne!(&buffer, b"plaintext message");
+//!
+//! // Decrypt `buffer` in-place, replacing its ciphertext context with the original plaintext
+//! cipher.decrypt_in_place(&nonce, b"", &mut buffer)?;
+//! assert_eq!(&buffer, b"plaintext message");
+//! # Ok(())
+//! # }
+//! ```
+//!
+//! Similarly, enabling the `arrayvec` feature of this crate will provide an impl of
+//! [`aead::Buffer`] for `arrayvec::ArrayVec` (re-exported from the [`aead`] crate as
+//! [`aead::arrayvec::ArrayVec`]).
+
+pub use aead::{self, AeadCore, AeadInPlace, Error, Key, KeyInit, KeySizeUser};
+
+#[cfg(feature = "aes")]
+pub use aes;
+
+use cipher::{
+    consts::{U0, U16},
+    generic_array::{ArrayLength, GenericArray},
+    BlockCipher, BlockEncrypt, BlockSizeUser, InnerIvInit, StreamCipherCore,
+};
+use core::marker::PhantomData;
+use ghash::{universal_hash::UniversalHash, GHash};
+
+#[cfg(feature = "zeroize")]
+use zeroize::Zeroize;
+
+#[cfg(feature = "aes")]
+use aes::{cipher::consts::U12, Aes128, Aes256};
+
+/// Maximum length of associated data.
+pub const A_MAX: u64 = 1 << 36;
+
+/// Maximum length of plaintext.
+pub const P_MAX: u64 = 1 << 36;
+
+/// Maximum length of ciphertext.
+pub const C_MAX: u64 = (1 << 36) + 16;
+
+/// AES-GCM nonces.
+pub type Nonce<NonceSize> = GenericArray<u8, NonceSize>;
+
+/// AES-GCM tags.
+pub type Tag<TagSize = U16> = GenericArray<u8, TagSize>;
+
+/// Trait implemented for valid tag sizes, i.e.
+/// [`U12`][consts::U12], [`U13`][consts::U13], [`U14`][consts::U14],
+/// [`U15`][consts::U15] and [`U16`][consts::U16].
+pub trait TagSize: private::SealedTagSize {}
+
+impl<T: private::SealedTagSize> TagSize for T {}
+
+mod private {
+    use aead::generic_array::ArrayLength;
+    use cipher::{consts, Unsigned};
+
+    // Sealed traits stop other crates from implementing any traits that use it.
+    pub trait SealedTagSize: ArrayLength<u8> + Unsigned {}
+
+    impl SealedTagSize for consts::U12 {}
+    impl SealedTagSize for consts::U13 {}
+    impl SealedTagSize for consts::U14 {}
+    impl SealedTagSize for consts::U15 {}
+    impl SealedTagSize for consts::U16 {}
+}
+
+/// AES-GCM with a 128-bit key and 96-bit nonce.
+#[cfg(feature = "aes")]
+#[cfg_attr(docsrs, doc(cfg(feature = "aes")))]
+pub type Aes128Gcm = AesGcm<Aes128, U12>;
+
+/// AES-GCM with a 256-bit key and 96-bit nonce.
+#[cfg(feature = "aes")]
+#[cfg_attr(docsrs, doc(cfg(feature = "aes")))]
+pub type Aes256Gcm = AesGcm<Aes256, U12>;
+
+/// AES block.
+type Block = GenericArray<u8, U16>;
+
+/// Counter mode with a 32-bit big endian counter.
+type Ctr32BE<Aes> = ctr::CtrCore<Aes, ctr::flavors::Ctr32BE>;
+
+/// AES-GCM: generic over an underlying AES implementation and nonce size.
+///
+/// This type is generic to support substituting alternative AES implementations
+/// (e.g. embedded hardware implementations)
+///
+/// It is NOT intended to be instantiated with any block cipher besides AES!
+/// Doing so runs the risk of unintended cryptographic properties!
+///
+/// The `NonceSize` generic parameter can be used to instantiate AES-GCM with other
+/// nonce sizes, however it's recommended to use it with `typenum::U12`,
+/// the default of 96-bits.
+///
+/// The `TagSize` generic parameter can be used to instantiate AES-GCM with other
+/// authorization tag sizes, however it's recommended to use it with `typenum::U16`,
+/// the default of 128-bits.
+///
+/// If in doubt, use the built-in [`Aes128Gcm`] and [`Aes256Gcm`] type aliases.
+#[derive(Clone)]
+pub struct AesGcm<Aes, NonceSize, TagSize = U16>
+where
+    TagSize: self::TagSize,
+{
+    /// Encryption cipher.
+    cipher: Aes,
+
+    /// GHASH authenticator.
+    ghash: GHash,
+
+    /// Length of the nonce.
+    nonce_size: PhantomData<NonceSize>,
+
+    /// Length of the tag.
+    tag_size: PhantomData<TagSize>,
+}
+
+impl<Aes, NonceSize, TagSize> KeySizeUser for AesGcm<Aes, NonceSize, TagSize>
+where
+    Aes: KeySizeUser,
+    TagSize: self::TagSize,
+{
+    type KeySize = Aes::KeySize;
+}
+
+impl<Aes, NonceSize, TagSize> KeyInit for AesGcm<Aes, NonceSize, TagSize>
+where
+    Aes: BlockSizeUser<BlockSize = U16> + BlockEncrypt + KeyInit,
+    TagSize: self::TagSize,
+{
+    fn new(key: &Key<Self>) -> Self {
+        Aes::new(key).into()
+    }
+}
+
+impl<Aes, NonceSize, TagSize> From<Aes> for AesGcm<Aes, NonceSize, TagSize>
+where
+    Aes: BlockSizeUser<BlockSize = U16> + BlockEncrypt,
+    TagSize: self::TagSize,
+{
+    fn from(cipher: Aes) -> Self {
+        let mut ghash_key = ghash::Key::default();
+        cipher.encrypt_block(&mut ghash_key);
+
+        let ghash = GHash::new(&ghash_key);
+
+        #[cfg(feature = "zeroize")]
+        ghash_key.zeroize();
+
+        Self {
+            cipher,
+            ghash,
+            nonce_size: PhantomData,
+            tag_size: PhantomData,
+        }
+    }
+}
+
+impl<Aes, NonceSize, TagSize> AeadCore for AesGcm<Aes, NonceSize, TagSize>
+where
+    NonceSize: ArrayLength<u8>,
+    TagSize: self::TagSize,
+{
+    type NonceSize = NonceSize;
+    type TagSize = TagSize;
+    type CiphertextOverhead = U0;
+}
+
+impl<Aes, NonceSize, TagSize> AeadInPlace for AesGcm<Aes, NonceSize, TagSize>
+where
+    Aes: BlockCipher + BlockSizeUser<BlockSize = U16> + BlockEncrypt,
+    NonceSize: ArrayLength<u8>,
+    TagSize: self::TagSize,
+{
+    fn encrypt_in_place_detached(
+        &self,
+        nonce: &Nonce<NonceSize>,
+        associated_data: &[u8],
+        buffer: &mut [u8],
+    ) -> Result<Tag<TagSize>, Error> {
+        if buffer.len() as u64 > P_MAX || associated_data.len() as u64 > A_MAX {
+            return Err(Error);
+        }
+
+        let (ctr, mask) = self.init_ctr(nonce);
+
+        // TODO(tarcieri): interleave encryption with GHASH
+        // See: <https://github.com/RustCrypto/AEADs/issues/74>
+        ctr.apply_keystream_partial(buffer.into());
+
+        let full_tag = self.compute_tag(mask, associated_data, buffer);
+        Ok(Tag::clone_from_slice(&full_tag[..TagSize::to_usize()]))
+    }
+
+    fn decrypt_in_place_detached(
+        &self,
+        nonce: &Nonce<NonceSize>,
+        associated_data: &[u8],
+        buffer: &mut [u8],
+        tag: &Tag<TagSize>,
+    ) -> Result<(), Error> {
+        if buffer.len() as u64 > C_MAX || associated_data.len() as u64 > A_MAX {
+            return Err(Error);
+        }
+
+        let (ctr, mask) = self.init_ctr(nonce);
+
+        // TODO(tarcieri): interleave encryption with GHASH
+        // See: <https://github.com/RustCrypto/AEADs/issues/74>
+        let expected_tag = self.compute_tag(mask, associated_data, buffer);
+
+        use subtle::ConstantTimeEq;
+        if expected_tag[..TagSize::to_usize()].ct_eq(tag).into() {
+            ctr.apply_keystream_partial(buffer.into());
+            Ok(())
+        } else {
+            Err(Error)
+        }
+    }
+}
+
+impl<Aes, NonceSize, TagSize> AesGcm<Aes, NonceSize, TagSize>
+where
+    Aes: BlockCipher + BlockSizeUser<BlockSize = U16> + BlockEncrypt,
+    NonceSize: ArrayLength<u8>,
+    TagSize: self::TagSize,
+{
+    /// Initialize counter mode.
+    ///
+    /// See algorithm described in Section 7.2 of NIST SP800-38D:
+    /// <https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf>
+    ///
+    /// > Define a block, J0, as follows:
+    /// > If len(IV)=96, then J0 = IV || 0{31} || 1.
+    /// > If len(IV) ≠ 96, then let s = 128 ⎡len(IV)/128⎤-len(IV), and
+    /// >     J0=GHASH(IV||0s+64||[len(IV)]64).
+    fn init_ctr(&self, nonce: &Nonce<NonceSize>) -> (Ctr32BE<&Aes>, Block) {
+        let j0 = if NonceSize::to_usize() == 12 {
+            let mut block = ghash::Block::default();
+            block[..12].copy_from_slice(nonce);
+            block[15] = 1;
+            block
+        } else {
+            let mut ghash = self.ghash.clone();
+            ghash.update_padded(nonce);
+
+            let mut block = ghash::Block::default();
+            let nonce_bits = (NonceSize::to_usize() as u64) * 8;
+            block[8..].copy_from_slice(&nonce_bits.to_be_bytes());
+            ghash.update(&[block]);
+            ghash.finalize()
+        };
+
+        let mut ctr = Ctr32BE::inner_iv_init(&self.cipher, &j0);
+        let mut tag_mask = Block::default();
+        ctr.write_keystream_block(&mut tag_mask);
+        (ctr, tag_mask)
+    }
+
+    /// Authenticate the given plaintext and associated data using GHASH.
+    fn compute_tag(&self, mask: Block, associated_data: &[u8], buffer: &[u8]) -> Tag {
+        let mut ghash = self.ghash.clone();
+        ghash.update_padded(associated_data);
+        ghash.update_padded(buffer);
+
+        let associated_data_bits = (associated_data.len() as u64) * 8;
+        let buffer_bits = (buffer.len() as u64) * 8;
+
+        let mut block = ghash::Block::default();
+        block[..8].copy_from_slice(&associated_data_bits.to_be_bytes());
+        block[8..].copy_from_slice(&buffer_bits.to_be_bytes());
+        ghash.update(&[block]);
+
+        let mut tag = ghash.finalize();
+        for (a, b) in tag.as_mut_slice().iter_mut().zip(mask.as_slice()) {
+            *a ^= *b;
+        }
+
+        tag
+    }
+}

vendor/aes-gcm/target/package/tmp-registry/index/ae/s-/aes-gcm

@@ -0,0 +1 @@
+{"name":"aes-gcm","vers":"0.10.3","deps":[{"name":"aead","req":"^0.5","features":[],"optional":false,"default_features":false,"target":null,"kind":"normal","registry":"https://github.com/rust-lang/crates.io-index","package":null,"public":null,"artifact":null,"bindep_target":null,"lib":false},{"name":"aes","req":"^0.8","features":[],"optional":true,"default_features":true,"target":null,"kind":"normal","registry":"https://github.com/rust-lang/crates.io-index","package":null,"public":null,"artifact":null,"bindep_target":null,"lib":false},{"name":"cipher","req":"^0.4","features":[],"optional":false,"default_features":true,"target":null,"kind":"normal","registry":"https://github.com/rust-lang/crates.io-index","package":null,"public":null,"artifact":null,"bindep_target":null,"lib":false},{"name":"ctr","req":"^0.9","features":[],"optional":false,"default_features":true,"target":null,"kind":"normal","registry":"https://github.com/rust-lang/crates.io-index","package":null,"public":null,"artifact":null,"bindep_target":null,"lib":false},{"name":"ghash","req":"^0.5","features":[],"optional":false,"default_features":false,"target":null,"kind":"normal","registry":"https://github.com/rust-lang/crates.io-index","package":null,"public":null,"artifact":null,"bindep_target":null,"lib":false},{"name":"subtle","req":"^2","features":[],"optional":false,"default_features":false,"target":null,"kind":"normal","registry":"https://github.com/rust-lang/crates.io-index","package":null,"public":null,"artifact":null,"bindep_target":null,"lib":false},{"name":"zeroize","req":"^1","features":[],"optional":true,"default_features":false,"target":null,"kind":"normal","registry":"https://github.com/rust-lang/crates.io-index","package":null,"public":null,"artifact":null,"bindep_target":null,"lib":false},{"name":"aead","req":"^0.5","features":["dev"],"optional":false,"default_features":false,"target":null,"kind":"dev","registry":"https://github.com/rust-lang/crates.io-index","package":null,"public":null,"artifact":null,"bindep_target":null,"lib":false},{"name":"hex-literal","req":"^0.3","features":[],"optional":false,"default_features":true,"target":null,"kind":"dev","registry":"https://github.com/rust-lang/crates.io-index","package":null,"public":null,"artifact":null,"bindep_target":null,"lib":false}],"features":{"alloc":["aead/alloc"],"arrayvec":["aead/arrayvec"],"default":["aes","alloc","getrandom"],"getrandom":["aead/getrandom","rand_core"],"heapless":["aead/heapless"],"rand_core":["aead/rand_core"],"std":["aead/std","alloc"],"stream":["aead/stream"]},"features2":null,"cksum":"82404db5d02944dbd19d378d0ba0d3fd2bee995c71bb711fddb05d73ee4eef28","yanked":null,"links":null,"rust_version":null,"v":2}

vendor/aes-gcm/tests/common/mod.rs

@@ -0,0 +1,97 @@
+//! Common functionality shared by tests
+
+/// Test vectors
+#[derive(Debug)]
+pub struct TestVector<K: 'static> {
+    pub key: &'static K,
+    pub nonce: &'static [u8; 12],
+    pub aad: &'static [u8],
+    pub plaintext: &'static [u8],
+    pub ciphertext: &'static [u8],
+    pub tag: &'static [u8; 16],
+}
+
+#[macro_export]
+macro_rules! tests {
+    ($aead:ty, $vectors:expr) => {
+        #[test]
+        fn encrypt() {
+            for vector in $vectors {
+                let key = GenericArray::from_slice(vector.key);
+                let nonce = GenericArray::from_slice(vector.nonce);
+                let payload = Payload {
+                    msg: vector.plaintext,
+                    aad: vector.aad,
+                };
+
+                let cipher = <$aead>::new(key);
+                let ciphertext = cipher.encrypt(nonce, payload).unwrap();
+                let (ct, tag) = ciphertext.split_at(ciphertext.len() - 16);
+                assert_eq!(vector.ciphertext, ct);
+                assert_eq!(vector.tag, tag);
+            }
+        }
+
+        #[test]
+        fn decrypt() {
+            for vector in $vectors {
+                let key = GenericArray::from_slice(vector.key);
+                let nonce = GenericArray::from_slice(vector.nonce);
+                let mut ciphertext = Vec::from(vector.ciphertext);
+                ciphertext.extend_from_slice(vector.tag);
+
+                let payload = Payload {
+                    msg: &ciphertext,
+                    aad: vector.aad,
+                };
+
+                let cipher = <$aead>::new(key);
+                let plaintext = cipher.decrypt(nonce, payload).unwrap();
+
+                assert_eq!(vector.plaintext, plaintext.as_slice());
+            }
+        }
+
+        #[test]
+        fn decrypt_modified() {
+            let vector = &$vectors[0];
+            let key = GenericArray::from_slice(vector.key);
+            let nonce = GenericArray::from_slice(vector.nonce);
+
+            let mut ciphertext = Vec::from(vector.ciphertext);
+            ciphertext.extend_from_slice(vector.tag);
+
+            // Tweak the first byte
+            ciphertext[0] ^= 0xaa;
+
+            let payload = Payload {
+                msg: &ciphertext,
+                aad: vector.aad,
+            };
+
+            let cipher = <$aead>::new(key);
+            assert!(cipher.decrypt(nonce, payload).is_err());
+        }
+
+        #[test]
+        fn decrypt_in_place_detached_modified() {
+            let vector = &$vectors.iter().last().unwrap();
+            let key = GenericArray::from_slice(vector.key);
+            let nonce = GenericArray::from_slice(vector.nonce);
+
+            let mut buffer = Vec::from(vector.ciphertext);
+            assert!(!buffer.is_empty());
+
+            // Tweak the first byte
+            let mut tag = GenericArray::clone_from_slice(vector.tag);
+            tag[0] ^= 0xaa;
+
+            let cipher = <$aead>::new(key);
+            assert!(cipher
+                .decrypt_in_place_detached(nonce, &[], &mut buffer, &tag)
+                .is_err());
+
+            assert_eq!(vector.ciphertext, buffer);
+        }
+    };
+}

vendor/aes-gcm/tests/other_ivlen.rs

@@ -0,0 +1,77 @@
+//! Tests for AES-GCM when used with non-96-bit nonces.
+//!
+//! Vectors taken from NIST CAVS vectors' `gcmEncryptExtIV128.rsp` file:
+//! <https://csrc.nist.gov/Projects/cryptographic-algorithm-validation-program/CAVP-TESTING-BLOCK-CIPHER-MODES>
+
+use aead::{
+    generic_array::{typenum, GenericArray},
+    Aead, KeyInit,
+};
+use aes::Aes128;
+use aes_gcm::AesGcm;
+use hex_literal::hex;
+
+/// Based on the following `gcmEncryptExtIV128.rsp` test vector:
+///
+/// [Keylen = 128]
+/// [IVlen = 8]
+/// [PTlen = 128]
+/// [AADlen = 0]
+/// [Taglen = 128]
+///
+/// Count = 0
+mod ivlen8 {
+    use super::*;
+
+    type Aes128GcmWith8BitNonce = AesGcm<Aes128, typenum::U1>;
+
+    #[test]
+    fn encrypt() {
+        let key = hex!("15b2d414826453f9e1c7dd0b69d8d1eb");
+        let nonce = hex!("b6");
+        let plaintext = hex!("8cfa255530c6fbc19d51bd4aeb39c91b");
+
+        let ciphertext = Aes128GcmWith8BitNonce::new(&key.into())
+            .encrypt(GenericArray::from_slice(&nonce), &plaintext[..])
+            .unwrap();
+
+        let (ct, tag) = ciphertext.split_at(ciphertext.len() - 16);
+        assert_eq!(hex!("4822cb98bd5f5d921ee19285c9032375"), ct);
+        assert_eq!(hex!("8a40670ebac98cf4e9cc1bf8f803167d"), tag);
+    }
+}
+
+/// Based on the following `gcmEncryptExtIV128.rsp` test vector:
+///
+/// [Keylen = 128]
+/// [IVlen = 1024]
+/// [PTlen = 128]
+/// [AADlen = 0]
+/// [Taglen = 128]
+///
+/// Count = 0
+mod ivlen1024 {
+    use super::*;
+
+    type Aes128GcmWith1024BitNonce = AesGcm<Aes128, typenum::U128>;
+
+    #[test]
+    fn encrypt() {
+        let key = hex!("71eebc49c8fb773b2224eaff3ad68714");
+        let nonce = hex!(
+            "07e961e67784011f72faafd95b0eb64089c8de15ad685ec57e63d56e679d3e20
+             2b18b75fcbbec3185ffc41653bc2ac4ae6ae8be8c85636f353a9d19a86100d0b
+             d035cc6bdefcab4318ac7b1a08b819427ad8f6abc782466c6ebd4d6a0dd76e78
+             389b0a2a66506bb85f038ffc1da220c24f3817c7b2d02c5e8fc5e7e3be5074bc"
+        );
+        let plaintext = hex!("705da82292143d2c949dc4ba014f6396");
+
+        let ciphertext = Aes128GcmWith1024BitNonce::new(&key.into())
+            .encrypt(GenericArray::from_slice(&nonce), &plaintext[..])
+            .unwrap();
+
+        let (ct, tag) = ciphertext.split_at(ciphertext.len() - 16);
+        assert_eq!(hex!("032363cf0828a03553478bec0f51f372"), ct);
+        assert_eq!(hex!("c681b2c568feaa21900bc44b86aeb946"), tag);
+    }
+}