<?php

if (class_exists('ParagonIE_Sodium_Core_AEGIS_State128L', false)) {
    return;
}

if (!defined('SODIUM_COMPAT_AEGIS_C0')) {
    define('SODIUM_COMPAT_AEGIS_C0', "\x00\x01\x01\x02\x03\x05\x08\x0d\x15\x22\x37\x59\x90\xe9\x79\x62");
}
if (!defined('SODIUM_COMPAT_AEGIS_C1')) {
    define('SODIUM_COMPAT_AEGIS_C1', "\xdb\x3d\x18\x55\x6d\xc2\x2f\xf1\x20\x11\x31\x42\x73\xb5\x28\xdd");
}

class ParagonIE_Sodium_Core_AEGIS_State128L
{
     
    protected $state;
    public function __construct()
    {
        $this->state = array_fill(0, 8, '');
    }

    



    public function getState()
    {
        return array_values($this->state);
    }

    






    public static function initForUnitTests(array $input)
    {
        if (count($input) < 8) {
            throw new SodiumException('invalid input');
        }
        $state = new self();
        for ($i = 0; $i < 8; ++$i) {
            $state->state[$i] = $input[$i];
        }
        return $state;
    }

    




    public static function init($key, $nonce)
    {
        $state = new self();

         
        $state->state[0] = $key ^ $nonce;
         
        $state->state[1] = SODIUM_COMPAT_AEGIS_C1;
         
        $state->state[2] = SODIUM_COMPAT_AEGIS_C0;
         
        $state->state[3] = SODIUM_COMPAT_AEGIS_C1;
         
        $state->state[4] = $key ^ $nonce;
         
        $state->state[5] = $key ^ SODIUM_COMPAT_AEGIS_C0;
         
        $state->state[6] = $key ^ SODIUM_COMPAT_AEGIS_C1;
         
        $state->state[7] = $key ^ SODIUM_COMPAT_AEGIS_C0;

         
        for ($i = 0; $i < 10; ++$i) {
            $state->update($nonce, $key);
        }
        return $state;
    }

    



    public function absorb($ai)
    {
        if (ParagonIE_Sodium_Core_Util::strlen($ai) !== 32) {
            throw new SodiumException('Input must be two AES blocks in size');
        }
        $t0 = ParagonIE_Sodium_Core_Util::substr($ai, 0, 16);
        $t1 = ParagonIE_Sodium_Core_Util::substr($ai, 16, 16);
        return $this->update($t0, $t1);
    }


    




    public function dec($ci)
    {
        if (ParagonIE_Sodium_Core_Util::strlen($ci) !== 32) {
            throw new SodiumException('Input must be two AES blocks in size');
        }

         
        $z0 = $this->state[6]
            ^ $this->state[1]
            ^ ParagonIE_Sodium_Core_Util::andStrings($this->state[2], $this->state[3]);
         
        $z1 = $this->state[2]
            ^ $this->state[5]
            ^ ParagonIE_Sodium_Core_Util::andStrings($this->state[6], $this->state[7]);

         
        $t0 = ParagonIE_Sodium_Core_Util::substr($ci, 0, 16);
        $t1 = ParagonIE_Sodium_Core_Util::substr($ci, 16, 16);

         
         
        $out0 = $t0 ^ $z0;
        $out1 = $t1 ^ $z1;

         
         
        $this->update($out0, $out1);
        return $out0 . $out1;
    }

    



    public function decPartial($cn)
    {
        $len = ParagonIE_Sodium_Core_Util::strlen($cn);

         
        $z0 = $this->state[6]
            ^ $this->state[1]
            ^ ParagonIE_Sodium_Core_Util::andStrings($this->state[2], $this->state[3]);
         
        $z1 = $this->state[2]
            ^ $this->state[5]
            ^ ParagonIE_Sodium_Core_Util::andStrings($this->state[6], $this->state[7]);

         
        $cn = str_pad($cn, 32, "\0", STR_PAD_RIGHT);
        $t0 = ParagonIE_Sodium_Core_Util::substr($cn, 0, 16);
        $t1 = ParagonIE_Sodium_Core_Util::substr($cn, 16, 16);
         
         
        $out0 = $t0 ^ $z0;
        $out1 = $t1 ^ $z1;

         
        $xn = ParagonIE_Sodium_Core_Util::substr($out0 . $out1, 0, $len);

         
        $padded = str_pad($xn, 32, "\0", STR_PAD_RIGHT);
        $v0 = ParagonIE_Sodium_Core_Util::substr($padded, 0, 16);
        $v1 = ParagonIE_Sodium_Core_Util::substr($padded, 16, 16);
         
        $this->update($v0, $v1);

         
        return $xn;
    }

    




    public function enc($xi)
    {
        if (ParagonIE_Sodium_Core_Util::strlen($xi) !== 32) {
            throw new SodiumException('Input must be two AES blocks in size');
        }

         
        $z0 = $this->state[6]
            ^ $this->state[1]
            ^ ParagonIE_Sodium_Core_Util::andStrings($this->state[2], $this->state[3]);
         
        $z1 = $this->state[2]
            ^ $this->state[5]
            ^ ParagonIE_Sodium_Core_Util::andStrings($this->state[6], $this->state[7]);

         
        $t0 = ParagonIE_Sodium_Core_Util::substr($xi, 0, 16);
        $t1 = ParagonIE_Sodium_Core_Util::substr($xi, 16, 16);

         
         
        $out0 = $t0 ^ $z0;
        $out1 = $t1 ^ $z1;

         
         
        $this->update($t0, $t1);

         
        return $out0 . $out1;
    }

    




    public function finalize($ad_len_bits, $msg_len_bits)
    {
        $encoded = ParagonIE_Sodium_Core_Util::store64_le($ad_len_bits) .
            ParagonIE_Sodium_Core_Util::store64_le($msg_len_bits);
        $t = $this->state[2] ^ $encoded;
        for ($i = 0; $i < 7; ++$i) {
            $this->update($t, $t);
        }
        return ($this->state[0] ^ $this->state[1] ^ $this->state[2] ^ $this->state[3]) .
            ($this->state[4] ^ $this->state[5] ^ $this->state[6] ^ $this->state[7]);
    }

    




    public function update($m0, $m1)
    {
        









        list($s_0, $s_1) = ParagonIE_Sodium_Core_AES::doubleRound(
            $this->state[7], $this->state[0] ^ $m0,
            $this->state[0], $this->state[1]
        );

        list($s_2, $s_3) = ParagonIE_Sodium_Core_AES::doubleRound(
            $this->state[1], $this->state[2],
            $this->state[2], $this->state[3]
        );

        list($s_4, $s_5) = ParagonIE_Sodium_Core_AES::doubleRound(
            $this->state[3], $this->state[4] ^ $m1,
            $this->state[4], $this->state[5]
        );
        list($s_6, $s_7) = ParagonIE_Sodium_Core_AES::doubleRound(
            $this->state[5], $this->state[6],
            $this->state[6], $this->state[7]
        );

        









        $this->state[0] = $s_0;
        $this->state[1] = $s_1;
        $this->state[2] = $s_2;
        $this->state[3] = $s_3;
        $this->state[4] = $s_4;
        $this->state[5] = $s_5;
        $this->state[6] = $s_6;
        $this->state[7] = $s_7;
        return $this;
    }
}