aead

commit 7918ee473057e5b8e1617a0d238d39c72ffb6a97
parent 6f9458d482b41e9418644ee8f65324ee72fe1e92
Author: Jared Tobin <jared@jtobin.io>
Date:   Sun,  6 Sep 2026 18:45:11 +0400

lib: support newer chacha

Diffstat:
M
flake.lock
 | 
8
++++----
M
lib/Crypto/AEAD/ChaCha20Poly1305.hs
 | 
15
+++++++++------
M
ppad-aead.cabal
 | 
4
++--

3 files changed, 15 insertions(+), 12 deletions(-)
diff --git a/flake.lock b/flake.lock
@@ -85,11 +85,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1783709359,
-        "narHash": "sha256-Xl31mWwQfJcfztw5v1NeaUlYn2vAaSVcambpCeemT7I=",
+        "lastModified": 1788702071,
+        "narHash": "sha256-B0a9eLZBsHTrsr/SNyPhpiq1NzjvTFsb1Kdr1mRmxXM=",
         "ref": "master",
-        "rev": "2beeb81459bc33ad074321e9ced4ba3880edf747",
-        "revCount": 36,
+        "rev": "46cb61870a875f2c4e1633bc4d2cba1ddffa461d",
+        "revCount": 41,
         "type": "git",
         "url": "git://git.ppad.tech/chacha.git"
       },
diff --git a/lib/Crypto/AEAD/ChaCha20Poly1305.hs b/lib/Crypto/AEAD/ChaCha20Poly1305.hs
@@ -98,9 +98,10 @@ pad16 (BI.PS _ _ l)
 
 -- | Error values.
 data Error =
-    InvalidKey    -- ^ the provided key was not 256 bits long
-  | InvalidNonce  -- ^ the provided nonce was not 96 bits long
-  | InvalidMAC    -- ^ the provided MAC does not authenticate the ciphertext
+    InvalidKey      -- ^ the provided key was not 256 bits long
+  | InvalidNonce    -- ^ the provided nonce was not 96 bits long
+  | InvalidMAC      -- ^ the provided MAC does not authenticate the ciphertext
+  | CounterOverflow -- ^ cipher exhausted
   deriving (Eq, Show)
 
 -- RFC8439 2.8
@@ -122,7 +123,7 @@ encrypt
   :: BS.ByteString -- ^ arbitrary-length additional authenticated data
   -> BS.ByteString -- ^ 256-bit key
   -> BS.ByteString -- ^ 96-bit nonce
-  -> BS.ByteString -- ^ arbitrary-length plaintext
+  -> BS.ByteString -- ^ arbitrary-length (technically, ~256 GiB) plaintext
   -> Either Error (BS.ByteString, BS.ByteString) -- ^ (ciphertext, 128-bit MAC)
 encrypt aad key nonce plaintext
   | BS.length key  /= 32  = Left InvalidKey
@@ -130,8 +131,9 @@ encrypt aad key nonce plaintext
   | otherwise = do
       otk <- _poly1305_key_gen key nonce
       case ChaCha20.cipher key 1 nonce plaintext of
-        Left ChaCha20.InvalidKey -> Left InvalidKey     -- impossible, but..
-        Left ChaCha20.InvalidNonce -> Left InvalidNonce -- ditto
+        Left ChaCha20.InvalidKey      -> Left InvalidKey -- impossible, but..
+        Left ChaCha20.InvalidNonce    -> Left InvalidNonce -- ditto
+        Left ChaCha20.CounterOverflow -> Left CounterOverflow
         Right cip -> do
           let md0 = aad <> pad16 aad
               md1 = md0 <> cip <> pad16 cip
@@ -171,6 +173,7 @@ decrypt aad key nonce (cip, mac)
           | ct_eq mac tag -> case ChaCha20.cipher key 1 nonce cip of
               Left ChaCha20.InvalidKey -> Left InvalidKey
               Left ChaCha20.InvalidNonce -> Left InvalidNonce
+              Left ChaCha20.CounterOverflow -> Left CounterOverflow
               Right v -> pure v
           | otherwise ->
               Left InvalidMAC
diff --git a/ppad-aead.cabal b/ppad-aead.cabal
@@ -1,6 +1,6 @@
 cabal-version:      3.0
 name:               ppad-aead
-version:            0.3.5
+version:            0.3.6
 synopsis:           A pure AEAD-ChaCha20-Poly1305 construction
 license:            MIT
 license-file:       LICENSE
@@ -38,7 +38,7 @@ library
   build-depends:
       base >= 4.9 && < 5
     , bytestring >= 0.9 && < 0.13
-    , ppad-chacha >= 0.2.2 && < 0.3
+    , ppad-chacha >= 0.3 && < 0.4
     , ppad-poly1305 >= 0.4.6 && < 0.5
 
 test-suite aead-tests