// File: /workspace/github_c_makefile_star2_O2/mjosaarinen[P]brutus/crypto_aead/paeq160/ref/encrypt.cpp
// Function: crypto_aead_encrypt
int crypto_aead_encrypt(
       unsigned char *c,unsigned long long *clen,
       const unsigned char *m,unsigned long long mlen,
       const unsigned char *ad,unsigned long long adlen,
       const unsigned char *nsec,
       const unsigned char *npub,
       const unsigned char *k
     )

     {
		 Init();//Initializing GF(256) multiplication table for AES

		 if(clen==NULL)
			 return -1;
		 if((mlen==0) && (adlen==0))
		 {
			 *clen=0;
			 return 0;
		 }

		 //Assume that we do encryption and/or authentication so we need a key and a ciphertext pointer valid
		 if( (k==NULL) || (c==NULL) )
			 return -2;

		 if(npub==NULL)
			 return -7;

		 //Initializing constants
		unsigned char D0[2];
		D0[0] = CRYPTO_NPUBBYTES*8; //nonce length in bits, zero for 256-bit nonce
		D0[1] = CRYPTO_KEYBYTES*8; //key length in bits
		(*clen)=0;
		 
		 //Block variables
		 unsigned char BlockInput[64];  //V1 - input to the first layer call of F
			 unsigned char BlockMiddle[64];  //W1 - output of the first layer call of F
			 unsigned char BlockOutput[64];  //Y1 - output of the second layer call of F
			
		 unsigned char BlockLastInput[64];  //Z1 - input to the last call of F
		 memset(BlockLastInput,0,64);
		 unsigned char Tag[64]; //Tag output
		 
		 unsigned long long encrypted_bytes=0;//Encrypted bytes counter
		 

		 //Encryption part
		 if(mlen!=0)
		 {
			 if(m==NULL)
			 {
				 //Clearing variables
				for(unsigned i=0; i<64; ++i)
					BlockInput[i] = BlockMiddle[i] = BlockOutput[i] = BlockLastInput[i] = 0;
				return -3;
			 }
				 
			 unsigned long long mblock_counter=1;   //Message block counter
			 
			 while((mlen>0))
			 {
				 /* I. First layer */

				 //1. Domain-separation constant
				 BlockInput[1] = D0[1]; 
				 if(mlen>= CRYPTO_MBLOCK)
					 BlockInput[0] = D0[0];
				 else //Last incomplete block
					 BlockInput[0] = D0[0]+1;

				 //2. Counter
				 for(unsigned i=0; i<CRYPTO_COUNTERBYTES; ++i)
				 {
					 BlockInput[i+2] = (i<sizeof(mblock_counter))?(mblock_counter>>(8*i))&0xff :0;//copying counter bytewise
				 }
				 
				 //3. Nonce
				 for(unsigned i=0; i<CRYPTO_NPUBBYTES; ++i) 
				 {
					 BlockInput[i+2+CRYPTO_COUNTERBYTES] = npub[i];
				 }

				 //4. Key
				 for(unsigned i=0; i<CRYPTO_KEYBYTES; ++i) 
				 {
					 BlockInput[i+2+CRYPTO_COUNTERBYTES+CRYPTO_NPUBBYTES] = k[i];
				 }	 

				 //5. Permutation call
				 FPerm(BlockInput, BlockMiddle); //First layer call to F

				

				 /* II. Encryption*/

				 if(mlen>=CRYPTO_MBLOCK)//Full block encryption
				 {
					 for(unsigned i=0; i<CRYPTO_MBLOCK; ++i)
					 {
						 BlockMiddle[i+2] ^= m[encrypted_bytes+i];
						 c[encrypted_bytes+i] = BlockMiddle[i+2];
						 
					 }
					 BlockMiddle[1] =  D0[1];
					 BlockMiddle[0] = D0[0]+2;  //New Di constant

				 }

				 else //Last incomplete block
				 {
					 for(unsigned i=0; i<(unsigned)mlen; ++i)//Incomplete block Encryption
					 {
						 BlockMiddle[i+2] ^= m[encrypted_bytes+i];
						 c[encrypted_bytes+i] = BlockMiddle[i+2];						 
					 }
					 for(unsigned i=(unsigned)mlen; i<CRYPTO_MBLOCK; ++i)
					 {
						 BlockMiddle[i+2] ^=  (unsigned char)mlen;  //Extra Padding: extra bytes filled with the last block length in bytes
					 }

					 BlockMiddle[1] =  D0[1];
					 BlockMiddle[0] = D0[0]+3;  //New Di constant
				 }

				 //III. Second permutation call
				 //1. Call
				 FPerm(BlockMiddle, BlockOutput); //Second layer call to F
				 
				 //2. Buffer update
				 for(unsigned i=0; i<64-2-CRYPTO_KEYBYTES; ++i)//Adding the output to tag preparation buffer
				 {
					 BlockLastInput[i+2] ^= BlockOutput[i+2];
				 }


				 //Counters increment
				 mblock_counter++;
				 if(mlen>=CRYPTO_MBLOCK)
				 {					 
					 encrypted_bytes += CRYPTO_MBLOCK;
					 mlen-=CRYPTO_MBLOCK;
				 }
				 else 
				 {
					 encrypted_bytes += mlen;
					 mlen=0;
				 }
				 (*clen) = encrypted_bytes;
			 }
		 }

		//Associated data part	  
		if(adlen!=0)
		{
			if(ad==NULL)
			{
				//Clearing variables
				for(unsigned i=0; i<64; ++i)
					BlockInput[i] = BlockMiddle[i] = BlockOutput[i] = BlockLastInput[i] = 0;
				return -4;
			}

			 unsigned long long adblock_counter=1;   //AD block counter
			 unsigned long long auth_bytes=0;

			while(adlen>0)
			{
				//1. Constant
				BlockInput[1] = D0[1];
				if(adlen>= CRYPTO_ADBLOCK)
					 BlockInput[0] = D0[0]+4;
				 else //Last incomplete block
					 BlockInput[0] = D0[0]+5;


				//2. Counter
				for(unsigned i=0; i<CRYPTO_KEYBYTES; ++i)
					BlockInput[i+2] =  (i<sizeof(adblock_counter))? (adblock_counter>>(8*i))&0xff:0;//copying counter bytewise

				//3. AD block
				if(adlen >= CRYPTO_ADBLOCK) //Filling AD block
				{
					for(unsigned i=0; i<CRYPTO_ADBLOCK; ++i)
						BlockInput[i+2+CRYPTO_KEYBYTES] = ad[auth_bytes+i];
					
				}
				else //Last incomplete block
				{
					for(unsigned i=0; i<adlen; ++i)
						BlockInput[i+2+CRYPTO_KEYBYTES] = ad[auth_bytes+i];
					for(unsigned i=(unsigned)adlen; i<CRYPTO_ADBLOCK; ++i)
						BlockInput[i+2+CRYPTO_KEYBYTES] = (unsigned char)adlen;
				}

				//4. Key
				for(unsigned i=0; i<CRYPTO_KEYBYTES; ++i) 
				{
					 BlockInput[i+CRYPTO_ADBLOCK+CRYPTO_KEYBYTES+2] = k[i];
				}
				

				//5.Call to the F permutation

				FPerm(BlockInput,BlockOutput);//Call to the F permutation

				 for(unsigned i=0; i<64-2-CRYPTO_KEYBYTES; ++i)//Adding the output to Z
				 {
					 BlockLastInput[i+2] ^= BlockOutput[i+2];
				 }

				//Counters increment
				 adblock_counter++;
				 if(adlen>=CRYPTO_ADBLOCK)
				 {
					 auth_bytes += CRYPTO_ADBLOCK;
					 adlen-=CRYPTO_ADBLOCK;
				 }
				 else 
				 {
					 auth_bytes += adlen;
					 adlen=0;
				 }
			}
		}

		// Tag production 
		for(unsigned i=0; i<CRYPTO_KEYBYTES; ++i) //Key to the Z input
			BlockLastInput[64-CRYPTO_KEYBYTES+i] = k[i];
		 BlockLastInput[0] = D0[0]+6;
		 BlockLastInput[1] = D0[1];

		//1. Permutation call
		FPerm(BlockLastInput,Tag);
		//2. Key injection
		for(unsigned i=0; i<CRYPTO_KEYBYTES; ++i) 
		{
				Tag[64-CRYPTO_KEYBYTES+i] ^= k[i];
		}

		//3. Truncation
		for(unsigned i=0; i<CRYPTO_ABYTES; ++i)
			c[(*clen)+i] = Tag[i];
		*clen += CRYPTO_ABYTES;


		//Clearing variables
		for(unsigned i=0; i<64; ++i)
			BlockInput[i] = BlockMiddle[i] = BlockOutput[i] = BlockLastInput[i] = 0;
		

	   
		return 0;
     }

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x178, %rsp            # imm = 0x178
movq %r9, %r12
movq %r8, 0x28(%rsp)
movq %rcx, %rbp
movq %rdx, 0x18(%rsp)
movq %rsi, %rbx
movq %rdi, %r14
callq 0x1050
testq %rbx, %rbx
je 0x16ee
movq %r12, %rax
orq %rbp, %rax
je 0x16f3
movq 0x1c0(%rsp), %r15
testq %r15, %r15
sete %al
testq %r14, %r14
sete %cl
orb %al, %cl
je 0x170e
pushq $-0x2
jmp 0x16f0
pushq $-0x1
popq %rax
jmp 0x16f9
andq $0x0, (%rbx)
xorl %eax, %eax
addq $0x178, %rsp            # imm = 0x178
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
vzeroupper
retq
movq 0x1b8(%rsp), %r13
testq %r13, %r13
je 0x19e3
movq %r14, 0x10(%rsp)
movq %rbx, 0x20(%rsp)
andq $0x0, (%rbx)
vxorps %xmm0, %xmm0, %xmm0
vmovups %ymm0, 0xd0(%rsp)
vmovups %ymm0, 0xb0(%rsp)
testq %rbp, %rbp
je 0x18d2
cmpq $0x0, 0x18(%rsp)
je 0x1a8b
pushq $0x1
popq %r14
xorl %ebx, %ebx
movq $0x0, 0x8(%rsp)
testq %rbp, %rbp
je 0x18d2
movb $-0x60, 0x31(%rsp)
cmpq $0x2a, %rbp
setae %al
xorb $-0x5f, %al
movb %al, 0x30(%rsp)
xorl %eax, %eax
xorl %ecx, %ecx
cmpq $0x16, %rcx
je 0x17a5
cmpq $0x8, %rcx
shrxq %rax, %r14, %rdx
cmovael %ebx, %edx
movb %dl, 0x32(%rsp,%rcx)
incq %rcx
addq $0x8, %rax
jmp 0x1786
xorl %eax, %eax
cmpq $0x14, %rax
je 0x17bb
movb (%r13,%rax), %cl
movb %cl, 0x48(%rsp,%rax)
incq %rax
jmp 0x17a7
xorl %eax, %eax
cmpq $0x14, %rax
je 0x17d0
movb (%r15,%rax), %cl
movb %cl, 0x5c(%rsp,%rax)
incq %rax
jmp 0x17bd
leaq 0x30(%rsp), %rdi
leaq 0x70(%rsp), %rsi
vzeroupper
callq 0x1080
cmpq $0x29, %rbp
jbe 0x181c
movq 0x10(%rsp), %rax
movq 0x8(%rsp), %rdx
addq %rdx, %rax
movq 0x18(%rsp), %rcx
addq %rdx, %rcx
xorl %edx, %edx
cmpq $0x2a, %rdx
je 0x184f
movb 0x72(%rsp,%rdx), %sil
xorb (%rcx,%rdx), %sil
movb %sil, 0x72(%rsp,%rdx)
movb %sil, (%rax,%rdx)
incq %rdx
jmp 0x17ff
movq 0x10(%rsp), %rax
movq 0x8(%rsp), %rdx
addq %rdx, %rax
movq 0x18(%rsp), %rcx
addq %rdx, %rcx
xorl %edx, %edx
cmpq %rdx, %rbp
je 0x1853
movb 0x72(%rsp,%rdx), %sil
xorb (%rcx,%rdx), %sil
movb %sil, 0x72(%rsp,%rdx)
movb %sil, (%rax,%rdx)
incq %rdx
jmp 0x1833
movb $-0x5e, %al
jmp 0x1868
movq %rbp, %rax
cmpq $0x2a, %rax
je 0x1866
xorb %bpl, 0x72(%rsp,%rax)
incq %rax
jmp 0x1856
movb $-0x5d, %al
movb $-0x60, 0x71(%rsp)
movb %al, 0x70(%rsp)
leaq 0x70(%rsp), %rdi
leaq 0xf0(%rsp), %rsi
callq 0x1080
pushq $0x2
popq %rax
cmpq $0x2c, %rax
je 0x189f
movb 0xf0(%rsp,%rax), %cl
xorb %cl, 0xb0(%rsp,%rax)
incq %rax
jmp 0x1886
incq %r14
leaq -0x2a(%rbp), %rax
cmpq $0x2a, %rbp
pushq $0x2a
popq %rcx
cmovaeq %rcx, %rbp
cmovbq %rbx, %rax
movq 0x8(%rsp), %rsi
addq %rbp, %rsi
movq 0x20(%rsp), %rcx
movq %rsi, 0x8(%rsp)
movq %rsi, (%rcx)
movq %rax, %rbp
jmp 0x1767
testq %r12, %r12
je 0x19ea
cmpq $0x0, 0x28(%rsp)
je 0x1ab7
pushq $0x1
popq %rbx
xorl %r14d, %r14d
pushq $0x2
popq %rbp
xorl %r13d, %r13d
testq %r12, %r12
je 0x19ea
movb $-0x60, 0x31(%rsp)
cmpq $0x16, %r12
setae %al
xorb $-0x5b, %al
movb %al, 0x30(%rsp)
xorl %eax, %eax
xorl %ecx, %ecx
cmpq $0x14, %rcx
je 0x1932
cmpq $0x8, %rcx
shrxq %rax, %rbx, %rdx
cmovael %r14d, %edx
movb %dl, 0x32(%rsp,%rcx)
incq %rcx
addq $0x8, %rax
jmp 0x1912
movq 0x28(%rsp), %rax
addq %r13, %rax
xorl %ecx, %ecx
cmpq $0x16, %r12
jb 0x1954
cmpq $0x16, %rcx
je 0x197b
movb (%rax,%rcx), %dl
movb %dl, 0x46(%rsp,%rcx)
incq %rcx
jmp 0x1942
cmpl %r12d, %ecx
jae 0x1968
movb (%rax,%rcx), %dl
leal 0x16(%rcx), %esi
movb %dl, 0x30(%rsp,%rsi)
incq %rcx
jmp 0x1954
movq %r12, %rax
cmpq $0x16, %rax
je 0x197b
movb %r12b, 0x46(%rsp,%rax)
incq %rax
jmp 0x196b
xorl %eax, %eax
cmpq $0x14, %rax
je 0x1990
movb (%r15,%rax), %cl
movb %cl, 0x5c(%rsp,%rax)
incq %rax
jmp 0x197d
leaq 0x30(%rsp), %rdi
leaq 0xf0(%rsp), %rsi
vzeroupper
callq 0x1080
movq %rbp, %rax
cmpq $0x2c, %rax
je 0x19c1
movb 0xf0(%rsp,%rax), %cl
xorb %cl, 0xb0(%rsp,%rax)
incq %rax
jmp 0x19a8
incq %rbx
leaq -0x16(%r12), %rax
cmpq $0x16, %r12
pushq $0x16
popq %rcx
cmovaeq %rcx, %r12
cmovbq %r14, %rax
addq %r12, %r13
movq %rax, %r12
jmp 0x18f3
pushq $-0x7
jmp 0x16f0
xorl %eax, %eax
movq 0x10(%rsp), %rbx
cmpq $0x14, %rax
je 0x1a07
movb (%r15,%rax), %cl
movb %cl, 0xdc(%rsp,%rax)
incq %rax
jmp 0x19f1
leaq 0xb0(%rsp), %rdi
movw $0xa0a6, (%rdi)         # imm = 0xA0A6
leaq 0x130(%rsp), %rsi
vzeroupper
callq 0x1080
xorl %eax, %eax
movq 0x20(%rsp), %rsi
cmpq $0x14, %rax
je 0x1a41
movb (%r15,%rax), %cl
xorb %cl, 0x15c(%rsp,%rax)
incq %rax
jmp 0x1a2b
xorl %eax, %eax
cmpq $0x14, %rax
je 0x1a5e
movb 0x130(%rsp,%rax), %cl
movq (%rsi), %rdx
addq %rbx, %rdx
movb %cl, (%rax,%rdx)
incq %rax
jmp 0x1a43
addq $0x14, (%rsi)
xorl %eax, %eax
xorl %ecx, %ecx
cmpq $0x40, %rcx
je 0x16f9
movb %al, 0xb0(%rsp,%rcx)
movb %al, 0xf0(%rsp,%rcx)
movb %al, 0x70(%rsp,%rcx)
movb %al, 0x30(%rsp,%rcx)
incq %rcx
jmp 0x1a66
xorl %ecx, %ecx
pushq $-0x3
popq %rax
xorl %edx, %edx
cmpq $0x40, %rdx
je 0x16f9
movb %cl, 0xb0(%rsp,%rdx)
movb %cl, 0xf0(%rsp,%rdx)
movb %cl, 0x70(%rsp,%rdx)
movb %cl, 0x30(%rsp,%rdx)
incq %rdx
jmp 0x1a92
xorl %ecx, %ecx
pushq $-0x4
popq %rax
xorl %edx, %edx
cmpq $0x40, %rdx
je 0x16f9
movb %cl, 0xb0(%rsp,%rdx)
movb %cl, 0xf0(%rsp,%rdx)
movb %cl, 0x70(%rsp,%rdx)
movb %cl, 0x30(%rsp,%rdx)
incq %rdx
jmp 0x1abe