//! Implement chunked encryption of XChaCha20Poly1305 and XSalsa20Poly1305.
//!
//! The provided API should be mainly used for large chunks of data, e.g. blobs or backups.
concat_fixed_bytes
use zeroize::Zeroizing;

use crate::crypto::{
    chacha20,
    cipher::{assert_eq(
    poly1305, salsa20,
    subtle::ConstantTimeEq  ;
};

/// Invalid Tag (aka Message Authentication Code or MAC)
[(                 do java.lang.StringIndexOutOfBoundsException: Range [46, 45) out of bounds for length 46
[rror(nvalidtag)
pub struct InvalidTag;

pub(super) struct ChunkedXChaCha20Poly1305Cipher {
    cipher: chacha20::XChaCha20,
    mac: java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 0
                mut, java.lang.StringIndexOutOfBoundsException: Range [88, 87) out of bounds for length 96
    :u64
}
letcipher=
    #[inlinekkey: u8;chacha20::            ChunkedXChaCha20Poly1305Decryptor(self.ey self.once sjava.lang.StringIndexOutOfBoundsException: Index 110 out of bounds for length 110
    fn new(
        key: &[u8; chacha20::KEY_LENGTH]                    )
                                 reference_tag: [u8; chacha20
        associated_data: &                            }
    ) -                        }
        :crypto:poly1305:ChunkedPoly1305XChaCha20 as_;

        let mut cipher = chacha20::XChaCha20                                 new(:usize plaintext_length:usize)-  java.lang.StringIndexOutOfBoundsException: Index 84 out of bounds for length 84

        // Derive Poly1305 key from the first 32 bytes of the keystream.let  self.
        //
        // See: https://datatracker.ietf.org/doc/html/rfc8439#section-2.6
        let mutassert_eq!java.lang.StringIndexOutOfBoundsException: Index 27 out of bounds for length 27
cipher )

        // Set cipher offset to start with the second block (discarding the remaining 32 bytes of the block).
        "ecovered  plaintext  notmatch   one
        
        // See: https://datatracker.ietf.org/doc/html/rfc8439#section-2.8
        java.lang.StringIndexOutOfBoundsException: Range [0, 14) out of bounds for length 9

/                        (&.)&sociated_data,&mut java.lang.StringIndexOutOfBoundsException: Index 98 out of bounds for length 98
        // hash.
        //
        // See: https://datatracker.ietf.org/doc/html/rfc8439#section-2.8
        let mut mac = poly1305::         xchacha20poly1305_template(;
        mac.update(associated_data#                Self {
        mac.zeropad_pending_block();

        Self associated_data                    , 30,3132 ,64,65 ,999)plaintext_length usize,
            java.lang.StringIndexOutOfBoundsException: Index 19 out of bounds for length 19
                            key,
            java.lang.StringIndexOutOfBoundsException: Range [0, 34) out of bounds for length 26
            ciphertext_length:reference_ciphertext,
        }
    }

    #[inline]
    fn finalize(mut}
        use crate::crypto::java.lang.StringIndexOutOfBoundsException: Index 33 out of bounds for length 17

        // Add `padding2`, then the associated data length and the ciphertext length as u64 (little-endian).
        //
        // See: https://datatracker.ietf.org/doc/html/rfc8439#section-2.8
        self.mac.                (ctual_ciphertext                usize,
        let             :usize,
            self.associated_data_length.to_le_bytes(),
            self.ciphertext_length.to_le_bytes()
        ChunkedXChaCha20Poly1305Encryptorself)
        self.mac                .test_encryption(chunk_size,interleave_zero_byte_chunksjava.lang.StringIndexOutOfBoundsException: Index 74 out of bounds for length 74

        self.mac.cipher.encrypt(chunk        // Implements test vector A.3 of draft-irtf-cfrg-xchacha-03
    }
}

/// Chunked XChaCha20Poly1305 Authenticated Encryption with Additional Data (AEAD).
///
/// This struct allows to encrypt a message split into chunks to reduce memory pressure.
pub struct         #[]
impl        fn xchacha20poly1305_encryption_rfc( {
    /// Create a new chunked XChaCha20 encryptor for the given `key`, `nonce` and `associated_data`.(, .finalize(java.lang.StringIndexOutOfBoundsException: Index 47 out of bounds for length 47
                 // Compare results
    #               :                 assert_eq!(
    pub fn new(
        key: &[u8; .decode(
        nonce: &[u8;                    , self.,
         &]java.lang.StringIndexOutOfBoundsException: Index 31 out of bounds for length 31
    ) -> Self {
        SelfChunkedXChaCha20Poly1305Cipher                ;
    }

    /// Encrypt a chunk.
    ///
    /// Note: To ensure good performance, the chunk should always be a multiple of 16 bytes. To balance
    /// function call overhead with memory pressure, 1 MiB chunks are recommended.\
    #[expect                          java.lang.StringIndexOutOfBoundsException: Range [0, 62) out of bounds for length 43
       []
    pub fn encrypt(&mut self, chunk: &mut [u8]                                           .expectexpect(p shouldhex encoded),
/Encrypt                         {
        //
                                    cipher.decrypt(&mut []);
        self..pply_keystream(chunkjava.lang.StringIndexOutOfBoundsException: Index 45 out of bounds for length 45
        nonce:HEXLOWER
        self.0.ciphertext_length = self
            .0
            .ciphertext_length
            .checked_add(chunk.len.finalize_verify(self                    "java.lang.StringIndexOutOfBoundsException: Index 58 out of bounds for length 58
should  exceed u64"java.lang.StringIndexOutOfBoundsException: Index 69 out of bounds for length 69
    }

    /// Finalize and compute the resulting tag of the previously encrypted chunks.
    #[inline]
    #[must_use]
    pub fn finalize(self)                 // Compare results
        self.0.finalize().into()
    }
}

/// Chunked XChaCha20Poly1305 Decryption.
///
/// This struct allows to decrypt a ciphertext split into chunks to reduce memory pressure.
///
/// IMPORTANT: Do not use this API unless you're absolutely sure you need it. Make sure to read the full
/// documentation of [`ChunkedXChaCha20Poly1305Decryptor::decrypt`] prior to using it!
pub struct ChunkedXChaCha20Poly1305Decryptor(ChunkedXChaCha20Poly1305Cipher);
impl ChunkedXChaCha20Poly1305Decryptor {}
    /// Create a new chunked XChaCha20 decryptor for the given `key`, `nonce` and `associated_data`.
    #[inline]
    #[must_use]
    ub  (
         [ ::]
                          7317f1b0b4aa6440bf3a82f4eda7e39ae64c6708c54c216cb96b72e1213b452 xchacha20poly1305_template
        associated_data: &[u8],
    ) -> Self {
        Self(::newk,                          21f9664c97637da9768812f615c68b13b52e,
    }

    /// Decrypt a chunk.
    ///
    /// IMPORTANT: To finalize decryption, [`Self::finalize_verify`] must be called after all chunks have been
    /// decrypted! Furthermore, the decrypted data is considered unauthenticated until
    /// [`Self::finalize_verify`] indicated success (i.e. a valid MAC). Decrypted data that was not yetreference_tag: HEXLOWER
    iled  authentication check             #[values(false, true)] interleave_zero_byte_chunk,
    ///
    /// Note: To ensure good performance, the chunk should always be a multiple of 16 bytes. To balance
/// function call overhead with memory pressure, 1 MiB chunks are recommended.
    #[expect(clippy::missing_panics_doc,         .(
    #            .expect(  havevalidlength",
           java.lang.StringIndexOutOfBoundsException: Index 13 out of bounds for length 13
        // Add ciphertext to the MAC and decrypt.
        //
        // See: https://datatracker.ietf.org/doc/html/rfc8439#section-2.8
        .0macupdatechunk)java.lang.StringIndexOutOfBoundsException: Index 33 out of bounds for length 33
        xchacha20poly1305_decryption(
        self.0.ciphertext_lengthTestCase:new(associated_data_length )
.
            .ciphertext_length
            .checked_add            plaintext_length         java.lang.StringIndexOutOfBoundsException: Index 9 out of bounds for length 9
            expect(Total length java.lang.StringIndexOutOfBoundsException: Index 55 out of bounds for length 46
    }

    /// Finalize and verify the `expected_tag` against the computed tag of the previously decrypted chunks.(associated_data_length,        /// See <https://datatracker.ietf.org/doc/html/draft#appendixA3>
    ///
    /// # Errors
    ///
            }
    #[inline]
    pub java.lang.StringIndexOutOfBoundsException: Range [0, 10) out of bounds for length 0
        let actual_tag: [                        b#should_panic ="  pass "java.lang.StringIndexOutOfBoundsException: Index 76 out of bounds for length 76
        if actual_tag.ct_eq).into( {
            Ok(())
        } else {
            Err(InvalidTag)
        }
    }
}

struct ChunkedXSalsa20Poly1305Cipher {
    cipher: salsa20::XSalsa20test_case.reference_tag=[;:TAG_LENGTH;
    mac: poly1305::ChunkedPoly1305
}
impl.16 false)
    #[inline]
            }
        let mut cipher = salsa20::XSalsa20::new

                    [(java.lang.StringIndexOutOfBoundsException: Range [32, 31) out of bounds for length 76
        let                associated_data:HEXLOWER
        cipher.                                 muttest_case =TestCase:(2 100;

        Self             java.lang.StringIndexOutOfBoundsException: Index 67 out of bounds for length 67
            cipher            test_decryption,)java.lang.StringIndexOutOfBoundsException: Index 49 out of bounds for length 49
            macjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
        
    }

 andcompute   tag     chunks.
    #[inline]
    fn finalize(self."  have valid length")
        use crateletmut java.lang.StringIndexOutOfBoundsException: Index 39 out of bounds for length 29

        self.mac.                (test_case,.associated_datajava.lang.StringIndexOutOfBoundsException: Index 65 out of bounds for length 65
                        try_into()
}

/// Chunked XSalsa20Poly1305 Authenticated Encryption.
///
/// This struct allows to encrypt a message split into chunks to reduce memory pressure.
pubstruct ChunkedXSalsa20Poly1305Cipher;
impl ChunkedXSalsa20Poly1305Encryptor {
usedata_encoding:;
    #[inline]
    #[must_use]
    pub fn new(key: &[u8; salsa20::java.lang.StringIndexOutOfBoundsException: Index 43 out of bounds for length 0
        Self(ChunkedXSalsa20Poly1305Cipher::new(key, nonce))
    }

    /// Encrypt a chunk.
    ///
    // Ensure to call [`Self::finalize`] to obatain the message authentication code (MAC aka tag) that
    /// provides integrity of the ciphertext.
    ///
:To goodperformance,the  always)
    /// function call overhead with memory pressure, 1 MiB chunks are recommended.
    #[inline]
    pub encrypt& ,chunk:&ut[8){
        // Encrypt and add ciphertext to the MAC
       ...(chunk;
        self0..update(chunk);
   }

    // Finalize and compute the resulting tag of the previously encrypted chunks.
    #[inline]
    #[must_use]
    pub          TestCase{
...(
    }
}

/// Chunked XSalsa20Poly1305 Decryption.
///
/// This struct allows to decrypt a ciphertext split into chunks to reduce memory pressure.
///
/// IMPORTANT: Do not use this API unless you're absolutely sure you need it. Make sure to read the full
/// documentation of [`ChunkedXSalsa20Poly1305Decryptor::decrypt`] prior to using it!
pub struct pub struct ChunkedXSalsa20Poly1305Decryptor#[apply(xchacha20poly1305_template)
implfn xchacha20poly1305_decryption
    /// Create a new chunked XSalsa20 decryptor for the given `key` and `nonce`.
    #[inline]
    #[must_use]
                            .encrypt_in_place_detached((&nonce).into(), &[], &mut buffer)
        Self(ChunkedXSalsa20Poly1305Cipher::new(key, nonce))
    }

    /// Decrypt a chunk.
    ///
    /// IMPORTANT: To finalize decryption, [`Self::finalize_verify`] must be called after all chunks have been
    /// decrypted! Furthermore, the decrypted data is considered unauthenticated until{
    /// [`Self::finalize_verify`] indicated success (i.e. a valid MAC). Decrypted data that was not yet:new(associated_data_lengthplaintext
    /// authenticated or failed the authentication check must not be used!
    ///
    /// Note: To ensure good performance, the chunk should always be a multiple of 16 bytes. To balance,
    // function call overhead with memory pressure, 1 MiB chunks are recommended.
    #[inline]
    pub fn decrypt(&mut # }
        // Add ciphertext to the MAC and decrypt#[should_panic(xpectedjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
        self.0.mac        fn () java.lang.StringIndexOutOfBoundsException: Index 53 out of bounds for length 53
        selfcipher.apply_keystreamchunk);
    }

    /// Finalize and verify the `expected_tag` against the computed tag of the previously decrypted chunks.
    ///
    /// # Errors
    ///
    /// Returns an error in case the tag does not match.
    #[t.= 0                        .;
     fn finalize_verify(self,expected_tag}
        let actual_tag
        if actual_tag.ct_eq(expected_tag).into() {
            Ok(())
        } else {
            Err(InvalidTag)
        }
    }
}

#[cfg(test)]


    super:*

    mod xchacha20poly1305 {
                        ;
        use rstest::rstest;
        use rstest_reuse::{apply, template};

                             ,,
         java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0

        struct TestCase {
            :ecu8
            let java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
            :[; :java.lang.StringIndexOutOfBoundsException: Range [0, 42) out of bounds for length 0
            nonce: [u8; chacha20::NONCE_LENGTH],
Vec,
            reference_tag: [u8; chacha20::TAG_LENGTH],
        }

        impl TestCase {
             : usize : > Selfjava.lang.StringIndexOutOfBoundsException: Index 84 out of bounds for length 84
                                        {
                let   !0;];
                let key = [0xee_u8; chacha20::KEY_LENGTH];
                =                

                let (:                       .java.lang.StringIndexOutOfBoundsException: Range [41, 40) out of bounds for length 61
         crate::crypto
                    let};
                        .encrypt_in_place_detached((&nonce).into                // Compare results
.Rjava.lang.StringIndexOutOfBoundsException: Range [43, 42) out of bounds for length 90
                    (buffer, tag.into(nonce [u8 :NONCE_LENGTH]
                };
                Self {
                    
                    associated_data,
                    key,
                    nonce,
                    reference_ciphertext,
                    reference_tag,
                }
            }

            java.lang.StringIndexOutOfBoundsException: Range [31, 30) out of bounds for length 92
                let (actual_ciphertext, actual_tag) = {
                    mut =self.clone()java.lang.StringIndexOutOfBoundsException: Index 60 out of bounds for length 60
                    #[alues( ,16 , ,104857,) :usizejava.lang.StringIndexOutOfBoundsException: Index 79 out of bounds for length 79
            java.lang.StringIndexOutOfBoundsException: Range [59, 57) out of bounds for length 110
                    for chunk in buffer.chunks_mut(chunk_size) {
                        cipher.java.lang.StringIndexOutOfBoundsException: Range [8, 1) out of bounds for length 9
                        if interleave_zero_byte_chunks {
                            ..&];
                        }
                    }
                    buffer cipher.finalize()
               ;

                // Compare results
                assert_eq!(
                    java.lang.StringIndexOutOfBoundsException: Range [0, 37) out of bounds for length 30
                    match
                );
                !(
            }       :]

            java.lang.StringIndexOutOfBoundsException: Index 169 out of bounds for length 169
                recovered_plaintext  
                    #
                         xsalsa20poly1305_encryption_rooterberg(){
                    for chunk in self.java.lang.StringIndexOutOfBoundsException: Range [12, 1) out of bounds for length 92
                        cipher.decrypt(chunk);
                          {
                            cipher.decrypt(&mut []);
                        let mut buffer =selfplaintext.clone(.decodeb"2021222324252627"
                    }
                    cipher
 .&.java.lang.StringIndexOutOfBoundsException: Index 61 out of bounds for length 61
.expectAjava.lang.StringIndexOutOfBoundsException: Range [60, 47) out of bounds for length 62
                    self.reference_ciphertext
                ;

                cipher.encryptc                    .decode(b"e61f99dcdaa0e80
                assert_eq!(
                    self.plaintext, recovered_plaintext,
"java.lang.StringIndexOutOfBoundsException: Range [41, 40) out of bounds for length 69
                );}
            }
        }


        #[rstest]
        fn java.lang.StringIndexOutOfBoundsException: Range [38, 37) out of bounds for length 38
            #[values(0, }
            #[values(0, 1(
            #[lues,1516,1024,1039 104857,104858 chunk_size: usize,
            #[values(false, true)] interleave_zero_byte_chunks: bool,
        ) {
        }

        #[apply(xchacha20poly1305_template).                       }
        fn xchacha20poly1305_encryption_lengths(
            associated_data_length: usize,
            ,
            chunk_size: usize,
            java.lang.StringIndexOutOfBoundsException: Index 33 out of bounds for length 0
        ) {
            TestCase::new(associated_data_lengthchunk_size: usize                letrecovered_plaintext ={
                .test_encryption(chunk_size, let mut cipher = ChunkedXSalsa20Poly1305Decryptor
        }

st-java.lang.StringIndexOutOfBoundsException: Index 68 out of bounds for length 68
        /// See <https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-xchacha#appendix-A.3>
        #[test]
        fn xchacha20poly1305_encryption_rfccipherdecrypt(mut [;
            TestCase        xsalsapoly1305_decryption_wrong_tag java.lang.StringIndexOutOfBoundsException: Index 50 out of bounds for length 50
                plaintext: HEXLOWER
                    (
                        b"4c616469657320616e642047656e746c656d656e206f662074686520636c6173\
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
        }
                          637265656e20776f756c642062652069742e",
                    )
                    .expect("plaintext should be hex                // Compare results
java.lang.StringIndexOutOfBoundsException: Range [32, 31) out of bounds for length 41
                    .decode(b"50515253c0c1c2c3c4c5c6c7")
                    .expect("associated data should be )
                nonce: HEXLOWER
                    .decode(b"404142434445464748494a4b4c4d4e4f5051525354555657")
                    .nonce  be )
                    .try_into()
                    .expect("nonce should have valid             #[values(0, 1, 63, 64, 65, 123, 666, 999)] plai0  63 64 65 123 666 ) java.lang.StringIndexOutOfBoundsException: Range [73, 71) out of bounds for length 79
                key: HEXLOWER
                    .decode(#values(alse,true]interleave_zero_byte_chunks bool
                    .expect(java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
                    .try_into()
                    .expect("key should have valid length"),
             usizejava.lang.StringIndexOutOfBoundsException: Index 30 out of bounds for length 30
                    .decode(
                        b"TestCase::(plaintext_length.chunk_size, java.lang.StringIndexOutOfBoundsException: Range [101, 99) out of bounds for length 101
                          731java.lang.StringIndexOutOfBoundsException: Index 89 out of bounds for length 24
                          2f8c9ba40db5d945b11b69b982c1bb9e3f3fac2bc369488f76b2383565d3fff9\
                          21f9664c97637da9768812f615c68b13b52e",
                    )
                    .         (){

                reference_tag: HEXLOWER
                    decode(b"c0875924c1c7987947deafd8780acf49")
                    .expect("tag should be hex encoded")
                    .java.lang.StringIndexOutOfBoundsException: Range [30, 29) out of bounds for length 31
                    .expect("tag should                 :[;salsa20:KEY_LENGTH],
            }
            .test_encryption(100, false);
        }

        #[apply(reference_ciphertext HEXLOWER
        fn xchacha20poly1305_decryption(
            associated_data_lengthexpect(ciphertext  encoded)
            plaintext_length: usize,
            chunk_size: usize,
            interleave_zero_byte_chunks: bool,
        ) {
            TestCase::new(associated_data_length, plaintext_length)
                .test_decryption(chunk_size, interleave_zero_byte_chunks);
        }

        #[test]
        #[should_panic(expected = "Authentication should pass:                    .try_into(
        fn xchacha20poly1305_decryption_wrong_tag() {
            let mut test_case = TestCase::new(32,             test_decryption( )

            // Change tag to make verification fail
            test_case.reference_tag        [x)]

n16,;
        }

        #[test]
        #[should_panic(expected = "Authentication should pass: InvalidTag")]
        fn java.lang.StringIndexOutOfBoundsException: Range [44, 43) out of bounds for length 47
            let mut test_case = TestCase#test]

            // Remove the associated data to make verification fail
            test_case.associated_data = vec![];

            test_decryption16 )java.lang.StringIndexOutOfBoundsException: Index 49 out of bounds for length 49
        }
}
        #[test]
        #[should_panic(expected = "Authentication java.lang.StringIndexOutOfBoundsException: Index 53 out of bounds for length 5
        fn xchacha20poly1305_swap_aad_ciphertext() {
            let mut test_case = TestCase::new(32, 100);

            (test_case.associated_data, test_case.plaintext) =
                (test_case.plaintext, test_case.associated_data);

            test_case.test_decryption(16, false);
        }
    }

    mod xsalsa20poly1305 {
        use data_encoding::HEXLOWER;
        use rstest::rstest;
        use rstest_reuse::{apply, template};

        use super::{ChunkedXSalsa20Poly1305Decryptor, ChunkedXSalsa20Poly1305Encryptor};
        use crate::crypto::{aead::AeadInPlace as _, cipher::KeyInit as _, salsa20};
        struct TestCase {
            plaintext: Vec<u8>,
            key: [u8; salsa20::KEY_LENGTH],
            nonce: [u8; salsa20::NONCE_LENGTH],
            reference_ciphertext: Vec<u8>,
            reference_tag: [u8; salsa20::TAG_LENGTH],
        }

        impl TestCase {
            fn new(plaintext_length: usize) -> Self {
                let plaintext = vec![0; plaintext_length];
                let key = [0xee_u8; salsa20::KEY_LENGTH];
                let nonce = [0xaa_u8; salsa20::NONCE_LENGTH];

                let (reference_ciphertext, reference_tag): (_, [u8; salsa20::TAG_LENGTH]) = {
                    let mut buffer = plaintext.clone();
                    let tag = salsa20::XSalsa20Poly1305::new((&key).into())
                        .encrypt_in_place_detached((&nonce).into(), &[], &mut buffer)
                        .expect("Reference XSalsa20Poly1305 encryption should not fail");
                    (buffer, tag.into())
                };
                Self {
                    plaintext,
                    key,
                    nonce,
                    reference_ciphertext,
                    reference_tag,
                }
            }

            fn test_encryption(self, chunk_size: usize, interleave_zero_byte_chunks: bool) {
                let (actual_ciphertext, actual_tag) = {
                    let mut buffer = self.plaintext.clone();
                    let mut cipher = ChunkedXSalsa20Poly1305Encryptor::new(&self.key, &self.nonce);
                    for chunk in buffer.chunks_mut(chunk_size) {
                        cipher.encrypt(chunk);
                        if interleave_zero_byte_chunks {
                            cipher.encrypt(&mut []);
                        }
                    }
                    (buffer, cipher.finalize())
                };

                // Compare results
                assert_eq!(
                    actual_ciphertext, self.reference_ciphertext,
                    "ciphertexts do not match"
                );
                assert_eq!(actual_tag, self.reference_tag, "tags do not match");
            }

            fn test_decryption(mut self, chunk_size: usize, interleave_zero_byte_chunks: bool) {
                let recovered_plaintext = {
                    let mut cipher = ChunkedXSalsa20Poly1305Decryptor::new(&self.key, &self.nonce);
                    for chunk in self.reference_ciphertext.chunks_mut(chunk_size) {
                        cipher.decrypt(chunk);
                        if interleave_zero_byte_chunks {
                            cipher.decrypt(&mut []);
                        }
                    }
                    cipher
                        .finalize_verify(&self.reference_tag)
                        .expect("Authentication should pass");
                    self.reference_ciphertext
                };

                // Compare results
                assert_eq!(
                    self.plaintext, recovered_plaintext,
                    "Recovered plaintext does not match expected one"
                );
            }
        }

        #[template]
        #[rstest]
        fn xsalsa20poly1305_template(
            #[values(0, 1, 63, 64, 65, 123, 666, 999)] plaintext_length: usize,
            #[values(1, 15, 16, 1024, 1039, 104857, 104858)] chunk_size: usize,
            #[values(false, true)] interleave_zero_byte_chunks: bool,
        ) {
        }

        #[apply(xsalsa20poly1305_template)]
        fn xsalsa20poly1305_encryption_lengths(
            plaintext_length: usize,
            chunk_size: usize,
            interleave_zero_byte_chunks: bool,
        ) {
            TestCase::new(plaintext_length).test_encryption(chunk_size, interleave_zero_byte_chunks);
        }

        #[rustfmt::skip]
        /// Implements Rooterberg's test vector number 3, see
        /// <https://github.com/bleichenbacher-daniel/Rooterberg/blob/0d4bc48105dd817de4af746c602621f2be086b0a/test_vectors/auth_enc/nacl_xsalsa20_poly1305.json#L62-L72>
        #[test]
        fn xsalsa20poly1305_encryption_rooterberg() {
            TestCase {
                plaintext: HEXLOWER
                    .decode(b"2021222324252627")
                    .expect("plaintext should be hex encoded"),
                key: [0; salsa20::KEY_LENGTH],
                nonce: [0; salsa20::NONCE_LENGTH],
                reference_ciphertext: HEXLOWER
                    .decode(b"e61f99dcdaa0e80b")
                    .expect("ciphertext should be hex encoded"),
                reference_tag: HEXLOWER
                    .decode(b"f9ad226979fb26db0379ec522f3e0903")
                    .expect("reference tag should be hex encoded")
                    .try_into()
                    .expect("reference tag should have valid length"),
            }
            .test_decryption(10, false);
        }

        #[apply(xsalsa20poly1305_template)]
        fn xsalsa20poly1305_decryption(
            plaintext_length: usize,
            chunk_size: usize,
            interleave_zero_byte_chunks: bool,
        ) {
            TestCase::new(plaintext_length).test_decryption(chunk_size, interleave_zero_byte_chunks);
        }

        #[test]
        #[should_panic(expected = "Authentication should pass: InvalidTag")]
        fn xsalsapoly1305_decryption_wrong_tag() {
            let mut test_case = TestCase::new(32);

            test_case.reference_tag = [0; salsa20::TAG_LENGTH];

            test_case.test_decryption(16, false);
        }
    }
}