Bitsliced HiAE

A protected implementation of the HiAE authenticated encryption algorithm for platforms without hardware AES support.

Side channels are mitigated by evaluating the AESL round function using the same AES circuits as bitsliced AEGIS.

No table lookups or secret-dependent branches are performed anywhere.

HiAE only spends only two AES rounds per 16-byte block, and its update function turns out to batch cleanly into six-lane bitsliced rounds.

Decryption is slower than encryption by design: HiAE feeds the recovered plaintext back into its state, which halves the number of AES evaluations that can be batched.

API

#include <hiae.h>

int hiae_encrypt_detached(uint8_t *c, uint8_t *mac, const uint8_t *m, size_t mlen,
                          const uint8_t *ad, size_t adlen, const uint8_t *npub,
                          const uint8_t *k);
int hiae_decrypt_detached(uint8_t *m, const uint8_t *c, size_t clen, const uint8_t *mac,
                          const uint8_t *ad, size_t adlen, const uint8_t *npub,
                          const uint8_t *k);
int hiae_encrypt(uint8_t *c, const uint8_t *m, size_t mlen, const uint8_t *ad,
                 size_t adlen, const uint8_t *npub, const uint8_t *k);
int hiae_decrypt(uint8_t *m, const uint8_t *c, size_t clen, const uint8_t *ad,
                 size_t adlen, const uint8_t *npub, const uint8_t *k);
int hiae_mac(uint8_t *mac, const uint8_t *data, size_t datalen, const uint8_t *npub,
             const uint8_t *k);
int hiae_stream(uint8_t *out, size_t outlen, const uint8_t *npub, const uint8_t *k);

Keys are 32 bytes, nonces 16 bytes, tags 16 bytes (hiae_KEYBYTES, hiae_NPUBBYTES, hiae_ABYTES).