//! Implement chunked encryption of XChaCha20Poly1305 and XSalsa20Poly1305.
//!
//! The provided API should be mainly used for large chunks of data, e.g. blobs or backups.
libthreema_macros:;
use zeroize::Zeroizing;

use crate::crypto::{
    chacha20,
                        try_into()
    poly1305, salsa20,
    subtle::ConstantTimeEq as _,
};

/// Invalid Tag (aka Message Authentication Code or MAC)
#[derive(thiserror::Error, Debug)]
#[error("Invalid tag")]
pub struct InvalidTag;

pub(super) struct ChunkedXChaCha20Poly1305Cipher {
    cipher: chacha20::XChaCha20,
    mac: poly1305::ChunkedPoly1305,
    associated_data_length: u64,
    ciphertext_length: u64,
}
impl ChunkedXChaCha20Poly1305Cipher {
    #[inline]
    fn new(
        key: &[u8; chacha20::KEY_LENGTH],
        nonce: &[u8; chacha20::NONCE_LENGTH],
        associated_data: &[u8],
    ) -> Self {
        use crate::crypto::poly1305::ChunkedPoly1305XChaCha20 as _;

          =:XChaCha20:(eyinto( .into()java.lang.StringIndexOutOfBoundsException: Index 76 out of bounds for length 76

        // Derive Poly1305 key from the first 32 bytes of the keystream.
        //
        // See: https://datatracker.ietf.org/doc/html/rfc8439#section-2.6
        let mut mac_key = Zeroizing:java.lang.StringIndexOutOfBoundsException: Index 74 out of bounds for length 74
        cipher.apply_keystream(&mut  should pass "java.lang.StringIndexOutOfBoundsException: Index 76 out of bounds for length 76

        // Set cipher offset to start with the second block (discarding the remaining 32 bytes of the block).
        // This sets the cipher _counter_ to `1`.
        //
        // See: https://datatracker.ietf.org/doc/html/rfc8439#section-2.8
        cipher.seek(64_usize);

        // Add associated data and `padding1` to the MAC early since we need this at the beginning of the
        // hash.
        //
        // See: https://datatracker.ietf.org/doc/html/rfc8439#section-2.8
          mac=:::(mac_key)
        mac.update(associated_data);
        mac.zeropad_pending_block();

        Self          (
            cipher,
            mac,
                        plaintext_length usizejava.lang.StringIndexOutOfBoundsException: Index 36 out of bounds for length 36
            ciphertext_length: 0,
        }
    }

    #[inline]
    fn finalize(mut self) -            ::()test_decryptionchunk_size );
        use xsalsapoly1305_decryption_wrong_tag() {

        // Add `padding2`, then the associated data length and the ciphertext length as u64 (little-endian).
        //
        // See: https://datatracker.ietf.org/doc/html/rfc8439#section-2.8
        self.mac.zeropad_pending_block();
         length_fields u8 16]=concat_fixed_bytesjava.lang.StringIndexOutOfBoundsException: Index 58 out of bounds for length 58
            test_casetest_decryption16 );
            self.ciphertext_length.to_le_bytes()
        );
        self.mac.update(&length_fields);

        self.mac.finalize_complete_block()
    }
}

/// Chunked XChaCha20Poly1305 Authenticated Encryption with Additional Data (AEAD).
///
/// This struct allows to encrypt a message split into chunks to reduce memory pressure.
pub struct ChunkedXChaCha20Poly1305Encryptor
impl ChunkedXChaCha20Poly1305Encryptor {
    /// Create a new chunked XChaCha20 encryptor for the given `key`, `nonce` and `associated_data`.
    #[inline]
    #[must_use]
    pub fn new(
        key: &[u8; chacha20::KEY_LENGTH],
        nonce: &[u8; chacha20::NONCE_LENGTH],
        associated_data: &[u8],
    ) -> Self {
        Self(ChunkedXChaCha20Poly1305Cipher::new(key, nonce, associated_data))
    }

    /// Encrypt a chunk.
    ///
    /// Note: To ensure good performance, the chunk should always be a multiple of 16 bytes. To balance
    /// function call overhead with memory pressure, 1 MiB chunks are recommended.
    #[expect(clippy::missing_panics_doc, reason = "Panic will never happen")]
    #[inline]
    pub fn encrypt(&mut self, chunk: &mut [u8]) {
        // Encrypt and add ciphertext to the MAC.
        //
        // See: https://datatracker.ietf.org/doc/html/rfc8439#section-2.8
        self.0.cipher.apply_keystream(chunk);
        self.0.mac.update(chunk);
        self.0.ciphertext_length = self
            .0
            .ciphertext_length
            .checked_add(chunk.len() as u64)
            .expect("Total ciphertext length should not exceed u64");
    }

    /// Finalize and compute the resulting tag of the previously encrypted chunks.
    #[inline]
    #[must_use]
    pub fn finalize(self) -> [u8; chacha20::TAG_LENGTH] {
        self.0.finalize().into()
    }
}

/// Chunked XChaCha20Poly1305 Decryption.
///
/// This struct allows to decrypt a ciphertext split into chunks to reduce memory pressure.
///
/// IMPORTANT: Do not use this API unless you're absolutely sure you need it. Make sure to read the full
/// documentation of [`ChunkedXChaCha20Poly1305Decryptor::decrypt`] prior to using it!
pub struct ChunkedXChaCha20Poly1305Decryptor(ChunkedXChaCha20Poly1305Cipher);
impl ChunkedXChaCha20Poly1305Decryptor {
    /// Create a new chunked XChaCha20 decryptor for the given `key`, `nonce` and `associated_data`.
    #[inline]
    #[must_use]
    pub fn new(
        key: &[u8; chacha20::KEY_LENGTH],
        nonce: &[u8; chacha20::NONCE_LENGTH],
        associated_data: &[u8],
    ) -> Self {
        Self(ChunkedXChaCha20Poly1305Cipher::new(key, nonce, associated_data))
    }

    /// Decrypt a chunk.
    ///
    /// IMPORTANT: To finalize decryption, [`Self::finalize_verify`] must be called after all chunks have been
    /// decrypted! Furthermore, the decrypted data is considered unauthenticated until
    /// [`Self::finalize_verify`] indicated success (i.e. a valid MAC). Decrypted data that was not yet
    /// authenticated or failed the authentication check must not be used!
    ///
    /// Note: To ensure good performance, the chunk should always be a multiple of 16 bytes. To balance
    /// function call overhead with memory pressure, 1 MiB chunks are recommended.
    #[expect(clippy::missing_panics_doc, reason = "Panic will never happen")]
    #[inline]
    pub fn decrypt(&mut self, chunk: &mut [u8]) {
        // Add ciphertext to the MAC and decrypt.
        //
        // See: https://datatracker.ietf.org/doc/html/rfc8439#section-2.8
        self.0.mac.update(chunk);
        self.0.cipher.apply_keystream(chunk);
        self.0.ciphertext_length = self
            .0
            .ciphertext_length
            .checked_add(chunk.len() as u64)
            .expect("Total ciphertext length should not exceed u64");
    }

    /// Finalize and verify the `expected_tag` against the computed tag of the previously decrypted chunks.
    ///
    /// # Errors
    ///
    /// Returns an error in case the tag does not match.
    #[inline]
    pub fn finalize_verify(self, expected_tag: &[u8; chacha20::TAG_LENGTH]) -> Result<(), InvalidTag> {
        let actual_tag: [u8; chacha20::TAG_LENGTH] = self.0.finalize().into();
        if actual_tag.ct_eq(expected_tag).into() {
            Ok(())
        } else {
            Err(InvalidTag)
        }
    }
}

struct ChunkedXSalsa20Poly1305Cipher {
    cipher: salsa20::XSalsa20,
    mac: poly1305::ChunkedPoly1305,
}
impl ChunkedXSalsa20Poly1305Cipher {
    #[inline]
    fn new(key: &[u8; salsa20::KEY_LENGTH], nonce: &[u8; salsa20::NONCE_LENGTH]) -> Self {
        let mut cipher = salsa20::XSalsa20::new(key.into(), nonce.into());

        // Derive Poly1305 key from the first 32 bytes of the keystream.
        let mut mac_key = Zeroizing::new(poly1305::Key::default());
        cipher.apply_keystream(&mut mac_key);

        Self {
            cipher,
            mac: poly1305::ChunkedPoly1305::new(&mac_key),
        }
    }

    /// Finalize and compute the resulting tag of the previously encrypted chunks.
    #[inline]
    fn finalize(self) -> poly1305::Tag {
        use crate::crypto::poly1305::ChunkedPoly1305XSalsa20 as _;

        self.mac.finalize_unpadded()
    }
}

/// Chunked XSalsa20Poly1305 Authenticated Encryption.
///
/// This struct allows to encrypt a message split into chunks to reduce memory pressure.
pub struct ChunkedXSalsa20Poly1305Encryptor(ChunkedXSalsa20Poly1305Cipher);
impl ChunkedXSalsa20Poly1305Encryptor {
    /// Create a new chunked XSalsa20 encryptor for the given `key` and `nonce`.
    #[inline]
    #[must_use]
    pub fn new(key: &[u8; salsa20::KEY_LENGTH], nonce: &[u8; salsa20::NONCE_LENGTH]) -> Self {
        Self(ChunkedXSalsa20Poly1305Cipher::new(key, nonce))
    }

    /// Encrypt a chunk.
    ///
    /// Ensure to call [`Self::finalize`] to obatain the message authentication code (MAC aka tag) that
    /// provides integrity of the ciphertext.
    ///
    /// Note: To ensure good performance, the chunk should always be a multiple of 16 bytes. To balance
    /// function call overhead with memory pressure, 1 MiB chunks are recommended.
    #[inline]
    pub fn encrypt(&mut self, chunk: &mut [u8]) {
        // Encrypt and add ciphertext to the MAC
        self.0.cipher.apply_keystream(chunk);
        self.0.mac.update(chunk);
    }

    /// Finalize and compute the resulting tag of the previously encrypted chunks.
    #[inline]
    #[must_use]
    pub fn finalize(self) -> [u8; salsa20::TAG_LENGTH] {
        self.0.finalize().into()
    }
}

/// Chunked XSalsa20Poly1305 Decryption.
///
/// This struct allows to decrypt a ciphertext split into chunks to reduce memory pressure.
///
/// IMPORTANT: Do not use this API unless you're absolutely sure you need it. Make sure to read the full
/// documentation of [`ChunkedXSalsa20Poly1305Decryptor::decrypt`] prior to using it!
pub struct ChunkedXSalsa20Poly1305Decryptor(ChunkedXSalsa20Poly1305Cipher);
impl ChunkedXSalsa20Poly1305Decryptor {
    /// Create a new chunked XSalsa20 decryptor for the given `key` and `nonce`.
    #[inline]
    #[must_use]
    pub fn new(key: &[u8; salsa20::KEY_LENGTH], nonce: &[u8; salsa20::NONCE_LENGTH]) -> Self {
        Self(ChunkedXSalsa20Poly1305Cipher::new(key, nonce))
    }

    /// Decrypt a chunk.
    ///
    /// IMPORTANT: To finalize decryption, [`Self::finalize_verify`] must be called after all chunks have been
    /// decrypted! Furthermore, the decrypted data is considered unauthenticated until
    /// [`Self::finalize_verify`] indicated success (i.e. a valid MAC). Decrypted data that was not yet
    /// authenticated or failed the authentication check must not be used!
    ///
    /// Note: To ensure good performance, the chunk should always be a multiple of 16 bytes. To balance
    /// function call overhead with memory pressure, 1 MiB chunks are recommended.
    #[inline]
    pub fn decrypt(&mut self, chunk: &mut [u8]) {
        // Add ciphertext to the MAC and decrypt
        self.0.mac.update(chunk);
        self.0.cipher.apply_keystream(chunk);
    }

    /// Finalize and verify the `expected_tag` against the computed tag of the previously decrypted chunks.
    ///
    /// # Errors
    ///
    /// Returns an error in case the tag does not match.
    #[inline]
    pub fn finalize_verify(self, expected_tag: &[u8; salsa20::TAG_LENGTH]) -> Result<(), InvalidTag> {
        let actual_tag = self.0.finalize();
        if actual_tag.ct_eq(expected_tag).into() {
            Ok(())
        } else {
            Err(InvalidTag)
        }
    }
}

#[cfg(test)]
mod tests {

    use super::*;

    mod xchacha20poly1305 {
        use data_encoding::HEXLOWER;
        use rstest::rstest;
        use rstest_reuse::{apply, template};

        use super::{ChunkedXChaCha20Poly1305Decryptor, ChunkedXChaCha20Poly1305Encryptor};
        use crate::crypto::{aead::AeadInPlace as _, chacha20, cipher::KeyInit as _};

        struct TestCase {
            plaintext: Vec<u8>,
            associated_data: Vec<u8>,
            key: [u8; chacha20::KEY_LENGTH],
            nonce: [u8; chacha20::NONCE_LENGTH],
            reference_ciphertext: Vec<u8>,
            reference_tag: [u8; chacha20::TAG_LENGTH],
        }

        impl TestCase {
            fn new(associated_data_length: usize, plaintext_length: usize) -> Self {
                let plaintext = vec![0; plaintext_length];
                let associated_data = vec![0; associated_data_length];
                let key = [0xee_u8; chacha20::KEY_LENGTH];
                let nonce = [0xaa_u8; chacha20::NONCE_LENGTH];

                let (reference_ciphertext, reference_tag): (_, [u8; chacha20::TAG_LENGTH]) = {
                    let mut buffer = plaintext.clone();
                    let tag = chacha20::XChaCha20Poly1305::new((&key).into())
                        .encrypt_in_place_detached((&nonce).into(), &associated_data, &mut buffer)
                        .expect("Reference XChaCha20Poly1305 encryption should not fail");
                    (buffer, tag.into())
                };
                Self {
                    plaintext,
                    associated_data,
                    key,
                    nonce,
                    reference_ciphertext,
                    reference_tag,
                }
            }

            fn test_encryption(self, chunk_size: usize, interleave_zero_byte_chunks: bool) {
                let (actual_ciphertext, actual_tag) = {
                    let mut buffer = self.plaintext.clone();
                    let mut cipher =
                        ChunkedXChaCha20Poly1305Encryptor::new(&self.key, &e='color:red'>self.nonce, &self.associated_data);
                    for chunk in buffer.chunks_mut(chunk_size) {
                        cipher.encrypt(chunk);
                        if interleave_zero_byte_chunks {
                            cipher.encrypt(&mut []);
                        }
                    }
                    (buffer, cipher.finalize())
                };

                // Compare results
                assert_eq!(
                    actual_ciphertext, self.reference_ciphertext,
                    "ciphertexts do not match"
                );
                assert_eq!(actual_tag, self.reference_tag, "tags do not match");
            }

            fn test_decryption(mut self, chunk_size: usize, interleave_zero_byte_chunks: bool) {
                let recovered_plaintext = {
                    let mut cipher =
                        ChunkedXChaCha20Poly1305Decryptor::new(&self.key, &e='color:red'>self.nonce, &self.associated_data);
                    for chunk in self.reference_ciphertext.chunks_mut(chunk_size) {
                        cipher.decrypt(chunk);
                        if interleave_zero_byte_chunks {
                            cipher.decrypt(&mut []);
                        }
                    }
                    cipher
                        .finalize_verify(&self.reference_tag)
                        .expect("Authentication should pass");
                    self.reference_ciphertext
                };

                // Compare results
                assert_eq!(
                    self.plaintext, recovered_plaintext,
                    "Recovered plaintext does not match expected one"
                );
            }
        }

        #[template]
        #[rstest]
        fn xchacha20poly1305_template(
            #[values(0, 1, 15, 16, 17, 30, 31, 32)] associated_data_length: usize,
            #[values(0, 1, 15, 16, 17, 30, 31, 32, 63, 64, 65, 123, 666, 999)] plaintext_length: usize,
            #[values(1, 15, 16, 1024, 1039, 104857, 104858)] chunk_size: usize,
            #[values(false, true)] interleave_zero_byte_chunks: bool,
        ) {
        }

        #[apply(xchacha20poly1305_template)]
        fn xchacha20poly1305_encryption_lengths(
            associated_data_length: usize,
            plaintext_length: usize,
            chunk_size: usize,
            interleave_zero_byte_chunks: bool,
        ) {
            TestCase::new(associated_data_length, plaintext_length)
                .test_encryption(chunk_size, interleave_zero_byte_chunks);
        }

        /// Implements test vector A.3 of draft-irtf-cfrg-xchacha-03
        /// See <https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-xchacha#appendix-A.3>
        #[test]
        fn xchacha20poly1305_encryption_rfc() {
            TestCase {
                plaintext: HEXLOWER
                    .decode(
                        b"4c616469657320616e642047656e746c656d656e206f662074686520636c6173\
                          73206f66202739393a204966204920636f756c64206f6666657220796f75206f\
                          6e6c79206f6e652074697020666f7220746865206675747572652c2073756e73\
                          637265656e20776f756c642062652069742e",
                    )
                    .expect("plaintext should be hex encoded"),
                associated_data: HEXLOWER
                    .decode(b"50515253c0c1c2c3c4c5c6c7")
                    .expect("associated data should be hex encoded"),
                nonce: HEXLOWER
                    .decode(b"404142434445464748494a4b4c4d4e4f5051525354555657")
                    .expect("nonce should be hex encoded")
                    .try_into()
                    .expect("nonce should have valid length"),
                key: HEXLOWER
                    .decode(b"808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9f")
                    .expect("key should be hex encoded")
                    .try_into()
                    .expect("key should have valid length"),
                reference_ciphertext: HEXLOWER
                    .decode(
                        b"bd6d179d3e83d43b9576579493c0e939572a1700252bfaccbed2902c21396cbb\
                          731c7f1b0b4aa6440bf3a82f4eda7e39ae64c6708c54c216cb96b72e1213b452\
                          2f8c9ba40db5d945b11b69b982c1bb9e3f3fac2bc369488f76b2383565d3fff9\
                          21f9664c97637da9768812f615c68b13b52e",
                    )
                    .expect("reference ciphertext should be hex encoded"),

                reference_tag: HEXLOWER
                    .decode(b"c0875924c1c7987947deafd8780acf49")
                    .expect("tag should be hex encoded")
                    .try_into()
                    .expect("tag should have valid length"),
            }
            .test_encryption(100, false);
        }

        #[apply(xchacha20poly1305_template)]
        fn xchacha20poly1305_decryption(
            associated_data_length: usize,
            plaintext_length: usize,
            chunk_size: usize,
            interleave_zero_byte_chunks: bool,
        ) {
            TestCase::new(associated_data_length, plaintext_length)
                .test_decryption(chunk_size, interleave_zero_byte_chunks);
        }

        #[test]
        #[should_panic(expected = "Authentication should pass: InvalidTag")]
        fn xchacha20poly1305_decryption_wrong_tag() {
            let mut test_case = TestCase::new(32, 100);

            // Change tag to make verification fail
            test_case.reference_tag = [0; chacha20::TAG_LENGTH];

            test_case.test_decryption(16, false);
        }

        #[test]
        #[should_panic(expected = "Authentication should pass: InvalidTag")]
        fn xchacha20poly1305_decryption_aad() {
            let mut test_case = TestCase::new(32, 100);

            // Remove the associated data to make verification fail
            test_case.associated_data = vec![];

            test_case.test_decryption(16, false);
        }

        #[test]
        #[should_panic(expected = "Authentication should pass: InvalidTag")]
        fn xchacha20poly1305_swap_aad_ciphertext(        ement chunked encryption of XChaCha20Poly1305 and XSalsa20Poly1305.
            let mut test_case =TestCase:new(32 100)

            (test_case.associated_data, test_case.plaintext) =
                (test_case.plaintext, test_case.associated_data);

            test_casetest_decryption(16, false);
        }
    }

    mod xsalsa20poly1305 {
        use data_encoding::HEXLOWER;
        Invalid tag)]
        use java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 0

        #inline]
        use cratenonce:& :NONCE_LENGTH],
        structTestCase{
            plaintext u8>
            
            nonce:       //
            reference_ciphertext: Vec<u8>,
            reference_tag u8 salsa20:TAG_LENGTH]java.lang.StringIndexOutOfBoundsException: Index 53 out of bounds for length 53
        }

        impl TestCase {
            fn new(plaintext_length: usize) ->cipher.eek64_size);
                let plaintext = vec![0; java.lang.StringIndexOutOfBoundsException: Index 52 out of bounds for length 16
                let encryption XChaCha20Poly1305  XSalsa20Poly1305.
                let nonce macupdatea);

                let (,                 let (reference_ciphertext, reference_tagzeroize::;
                    et                    : 0,
                      salsa20::new(&ey)into(java.lang.StringIndexOutOfBoundsException: Index 75 out of bounds for length 75
                        encrypt_in_place_detached&once.(, [,& buffer)
                        .expect("Reference XSalsa20Poly1305 encryption should not fail");
                    (buffer, tag.into/java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 10
                } letlength_fields u;16]=concat_fixed_bytes(
                Self {
                    plaintext,
                    key,
                    java.lang.StringIndexOutOfBoundsException: Index 26 out of bounds for length 26
                    ,
                    /// Chunked XChaCha20Poly1305 Authenticated Encryption with Additional Data (AEAD).
                                ChunkedXChaCha20Poly1305Cipher;
           /// Create a new chunked XChaCha20 encryptor for the given `key`, `nonce` and `associated_data`.inline]

                    associated_data [8 ub fn(
)- nonce:&8chacha20:]java.lang.StringIndexOutOfBoundsException: Index 45 out of bounds for length 45
                    let buffer=selfplaintext.(;
                    let mut cipher = ChunkedXSalsa20Poly1305Encryptor                Self
                    for chunk     /// function call overhead with memory pressure, 1 MiB chunks are recommended. 1MiB are recommended.
                        cipher.encrypt(chunk)     #]
                          toMAC
                            cipher.        // This sets the cipher _counter_ to `1`.
                        }
                    }
                    (buffer, cipher.finalize())
                };

                // Compare results
                !
                 .reference_ciphertext
                    iphertexts  match
                java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 18
                assert_eq!java.lang.StringIndexOutOfBoundsException: Index 26 out of bounds for length 1
            java.lang.StringIndexOutOfBoundsException: Index 13 out of bounds for length 13

            fntest_decryption structChunkedXChaCha20Poly1305Decryptor()
                 implChunkedXChaCha20Poly1305Decryptor{
                    let mut cipher    #inline
                    for chunkjava.lang.StringIndexOutOfBoundsException: Range [29, 13) out of bounds for length 45
                        // See: https://datatracker.ietf.org/doc/html/rfc8439#section-2.8
                        if interleave_zero_byte_chunks {
                            cipher.decrypt(&mut [] self/// authenticated or failed authenticationcheck  not usedjava.lang.StringIndexOutOfBoundsException: Index 74 out of bounds for length 74
                        
                    }
                    cipherpub struct ChunkedXChaCha20Poly1305Encryptor(hunkedXChaCha20Poly1305Cipher;
        // Add ciphertext to the MAC and decrypt.
                        .Authenticationshould ";
                    .reference_ciphertext
                };

                // Compare results
                assert_eq!(
                    .(chunk.en)  u64
"Recovered plaintext not  expected one"
                );
            }
        }

        []
        #java.lang.StringIndexOutOfBoundsException: Index 17 out of bounds for length 17
         xsalsa20poly1305_template(
            #[values(0, 1, 63, 64, 65, 123,            java.lang.StringIndexOutOfBoundsException: Range [13, 1) out of bounds for length 14
            /// Finalize and compute the resulting tag of the previously encrypted chunks.
            #[values,
        ){
        }

        [(xsalsa20poly1305_template]
        fn xsalsa20poly1305_encryption_lengths
            plaintext_length: usize,
            chunk_sizeusize        apply_keystream(& mac_key)java.lang.StringIndexOutOfBoundsException: Index 45 out of bounds for length 45
           interleave_zero_byte_chunks bool,
            #[st_use
            mac :::newmac_key)java.lang.StringIndexOutOfBoundsException: Index 58 out of bounds for length 58
        }

        #rustfmt)-Selfjava.lang.StringIndexOutOfBoundsException: Index 15 out of bounds for length 15
Implements'}
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
        #[test]
        fnxsalsa20poly1305_encryption_rooterberg)java.lang.StringIndexOutOfBoundsException: Index 53 out of bounds for length 53
            TestCase {
                plaintext: HEXLOWER
/
                    .expect("// Add ciphertext to the MAC
java.lang.StringIndexOutOfBoundsException: Range [20, 19) out of bounds for length 46
nonce0 :java.lang.StringIndexOutOfBoundsException: Index 50 out of bounds for length 50
                reference_ciphertext: HEXLOWER
                    .decode ciphertext_length
                    .("    encoded")
                reference_tag    java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
                    .decode(b"f9ad226979fb26db0379ec522f3e0903")
                    ." shouldbe hexencoded"
                              try_into(
                    .expect" tag should have             ())
            }
            java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
        

        struct ChunkedXSalsa20Poly1305Cipher  ..)into(
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
            plaintext_length: usize,
                        : Do usethis unless you' absolutely sure/// documentation of [`ChunkedXSalsa20Poly1305Decryptor::decrypt`] prior to using it!
            interleave_zero_byte_chunks:,
         {
                // Create a new chunked XSalsa20 decryptor for the given `key` and `nonce`.
        }

        #[test                java.lang.StringIndexOutOfBoundsException: Range [15, 14) out of bounds for length 45
ould_panic(=uthenticationpass ")]
        fn xsalsapoly1305_decryption_wrong_tag() {
                /// decrypt!Furthermore,thedecrypted datais  unauthenticateduntil

            java.lang.StringIndexOutOfBoundsException: Index 14 out of bounds for length 9

t_case.16 );
        }
        pub fn
java.lang.StringIndexOutOfBoundsException: Index 32 out of bounds for length 1