From c60d78a9552a9d047326f90061aab445da72929d Mon Sep 17 00:00:00 2001
From: Hansaem Wi <hansaemw@gmail.com>
Date: Tue, 3 Nov 2026 13:35:16 +0900
Subject: [PATCH] eax: support nonces of any length

EAX takes a nonce of any length, but `Eax` fixed it to the 16-byte
block size. Add a `NonceSize` type parameter (default `U16`, so
existing code is unchanged) to `Eax` and `online::Eax`, as `AesGcm`
does.

Test with the Wycheproof `aes_eax_test.json` groups whose nonce is not
16 bytes (0 to 257 bytes, 18 vectors per key size), through both the
one-shot and the online API.

Closes #239

Assisted-by: Claude Code:claude-opus-5-5
---
 eax/src/lib.rs                              |  53 ++++++++++---
 eax/src/online.rs                           |  24 ++++--
 eax/tests/data/wycheproof-128_nonce-len.blb | Bin 0 -> 2099 bytes
 eax/tests/data/wycheproof-192_nonce-len.blb | Bin 0 -> 2243 bytes
 eax/tests/data/wycheproof-256_nonce-len.blb | Bin 0 -> 2387 bytes
 eax/tests/wycheproof.rs                     |  79 +++++++++++++++++++-
 6 files changed, 136 insertions(+), 20 deletions(-)
 create mode 100644 eax/tests/data/wycheproof-128_nonce-len.blb
 create mode 100644 eax/tests/data/wycheproof-192_nonce-len.blb
 create mode 100644 eax/tests/data/wycheproof-256_nonce-len.blb

diff --git a/eax/src/lib.rs b/eax/src/lib.rs
index c58794f7..2d9e8aad 100644
--- a/eax/src/lib.rs
+++ b/eax/src/lib.rs
@@ -125,6 +125,29 @@
 //! assert_eq!(buffer.as_ref(), b"plaintext message");
 //! # }
 //! ```
+//!
+//! ## Custom Nonce Length
+//!
+//! EAX accepts nonces of any length. The nonce is 16 bytes long by default;
+//! the third generic argument of `Eax` sets another length:
+//!
+//! ```
+//! # #[cfg(feature = "alloc")]
+//! # {
+//! use aes::Aes128;
+//! use eax::Eax;
+//! use eax::aead::{Aead, KeyInit, array::Array};
+//! use eax::aead::consts::{U12, U16};
+//!
+//! let key = Array::from_slice(b"very secret key.");
+//! let cipher = Eax::<Aes128, U16, U12>::new(key);
+//!
+//! let nonce = Array::from_slice(b"unique nonce"); // 96-bits; unique per message
+//! let ciphertext = cipher.encrypt(nonce, b"plaintext message".as_ref()).unwrap();
+//! let plaintext = cipher.decrypt(nonce, ciphertext.as_ref()).unwrap();
+//! assert_eq!(&plaintext, b"plaintext message");
+//! # }
+//! ```
 
 mod traits;
 
@@ -133,7 +156,9 @@ pub use cipher;
 
 use aead::{TagPosition, inout::InOutBuf};
 use cipher::{
-    BlockCipherEncrypt, BlockSizeUser, InnerIvInit, StreamCipherCore, array::Array, consts::U16,
+    BlockCipherEncrypt, BlockSizeUser, InnerIvInit, StreamCipherCore,
+    array::{Array, ArraySize},
+    consts::U16,
 };
 use cmac::{Cmac, Mac, digest::Output};
 use core::{fmt, marker::PhantomData};
@@ -167,52 +192,60 @@ type Ctr128BE<C> = ctr::CtrCore<C, ctr::flavors::Ctr128BE>;
 /// ## Type parameters
 /// - `Cipher`: block cipher.
 /// - `M`: size of MAC tag, valid values: up to `U16`.
+/// - `NonceSize`: size of nonce, any length (default `U16`).
 #[derive(Clone)]
-pub struct Eax<Cipher, M = U16>
+pub struct Eax<Cipher, M = U16, NonceSize = U16>
 where
     Cipher: BlockSizeUser<BlockSize = U16> + BlockCipherEncrypt + Clone + KeyInit,
     M: TagSize,
+    NonceSize: ArraySize,
 {
     /// Encryption key
     key: Key<Cipher>,
     _tag_size: PhantomData<M>,
+    _nonce_size: PhantomData<NonceSize>,
 }
 
-impl<Cipher, M> KeySizeUser for Eax<Cipher, M>
+impl<Cipher, M, NonceSize> KeySizeUser for Eax<Cipher, M, NonceSize>
 where
     Cipher: BlockSizeUser<BlockSize = U16> + BlockCipherEncrypt + Clone + KeyInit,
     M: TagSize,
+    NonceSize: ArraySize,
 {
     type KeySize = Cipher::KeySize;
 }
 
-impl<Cipher, M> KeyInit for Eax<Cipher, M>
+impl<Cipher, M, NonceSize> KeyInit for Eax<Cipher, M, NonceSize>
 where
     Cipher: BlockSizeUser<BlockSize = U16> + BlockCipherEncrypt + Clone + KeyInit,
     M: TagSize,
+    NonceSize: ArraySize,
 {
     fn new(key: &Key<Cipher>) -> Self {
         Self {
             key: key.clone(),
             _tag_size: PhantomData,
+            _nonce_size: PhantomData,
         }
     }
 }
 
-impl<Cipher, M> AeadCore for Eax<Cipher, M>
+impl<Cipher, M, NonceSize> AeadCore for Eax<Cipher, M, NonceSize>
 where
     Cipher: BlockSizeUser<BlockSize = U16> + BlockCipherEncrypt + Clone + KeyInit,
     M: TagSize,
+    NonceSize: ArraySize,
 {
-    type NonceSize = Cipher::BlockSize;
+    type NonceSize = NonceSize;
     type TagSize = M;
     const TAG_POSITION: TagPosition = TagPosition::Postfix;
 }
 
-impl<Cipher, M> AeadInOut for Eax<Cipher, M>
+impl<Cipher, M, NonceSize> AeadInOut for Eax<Cipher, M, NonceSize>
 where
     Cipher: BlockSizeUser<BlockSize = U16> + BlockCipherEncrypt + Clone + KeyInit,
     M: TagSize,
+    NonceSize: ArraySize,
 {
     fn encrypt_inout_detached(
         &self,
@@ -285,20 +318,22 @@ where
     }
 }
 
-impl<Cipher, M> fmt::Debug for Eax<Cipher, M>
+impl<Cipher, M, NonceSize> fmt::Debug for Eax<Cipher, M, NonceSize>
 where
     Cipher: BlockSizeUser<BlockSize = U16> + BlockCipherEncrypt + Clone + KeyInit,
     M: TagSize,
+    NonceSize: ArraySize,
 {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> Result<(), fmt::Error> {
         f.debug_struct("Eax").finish_non_exhaustive()
     }
 }
 
-impl<Cipher, M> Eax<Cipher, M>
+impl<Cipher, M, NonceSize> Eax<Cipher, M, NonceSize>
 where
     Cipher: BlockSizeUser<BlockSize = U16> + BlockCipherEncrypt + Clone + KeyInit,
     M: TagSize,
+    NonceSize: ArraySize,
 {
     /// CMAC/OMAC1
     ///
diff --git a/eax/src/online.rs b/eax/src/online.rs
index b139aa08..b78213e3 100644
--- a/eax/src/online.rs
+++ b/eax/src/online.rs
@@ -60,7 +60,8 @@
 use crate::{Cmac, Error, Nonce, Tag, TagSize};
 use aead::consts::U16;
 use cipher::{
-    BlockCipherEncrypt, BlockSizeUser, Key, KeyInit, KeyIvInit, StreamCipher, array::Array,
+    BlockCipherEncrypt, BlockSizeUser, Key, KeyInit, KeyIvInit, StreamCipher,
+    array::{Array, ArraySize},
     typenum::Unsigned,
 };
 use cmac::Mac;
@@ -150,31 +151,35 @@ impl CipherOp for Decrypt {}
 /// [`Eax`]: ../struct.Eax.html
 /// [`Decrypt`]: struct.Decrypt.html
 /// [`finish`]: #method.finish
-pub struct Eax<Cipher, Op, M = U16>
+pub struct Eax<Cipher, Op, M = U16, NonceSize = U16>
 where
     Cipher: BlockSizeUser<BlockSize = U16> + BlockCipherEncrypt + Clone + KeyInit,
     Op: CipherOp,
     M: TagSize,
+    NonceSize: ArraySize,
 {
     imp: EaxImpl<Cipher, M>,
     /// Denotes whether this stream is used for encryption or decryption.
     marker: PhantomData<Op>,
+    _nonce_size: PhantomData<NonceSize>,
 }
 
-impl<Cipher, Op, M> Eax<Cipher, Op, M>
+impl<Cipher, Op, M, NonceSize> Eax<Cipher, Op, M, NonceSize>
 where
     Cipher: BlockSizeUser<BlockSize = U16> + BlockCipherEncrypt + Clone + KeyInit,
     Op: CipherOp,
     M: TagSize,
+    NonceSize: ArraySize,
 {
     /// Creates a stateful EAX instance that is capable of processing both
     /// the associated data and the plaintext in an "on-line" fashion.
-    pub fn with_key_and_nonce(key: &Key<Cipher>, nonce: &Nonce<Cipher::BlockSize>) -> Self {
+    pub fn with_key_and_nonce(key: &Key<Cipher>, nonce: &Nonce<NonceSize>) -> Self {
         let imp = EaxImpl::<Cipher, M>::with_key_and_nonce(key, nonce);
 
         Self {
             imp,
             marker: PhantomData,
+            _nonce_size: PhantomData,
         }
     }
 
@@ -196,10 +201,11 @@ where
     }
 }
 
-impl<Cipher, M> Eax<Cipher, Encrypt, M>
+impl<Cipher, M, NonceSize> Eax<Cipher, Encrypt, M, NonceSize>
 where
     Cipher: BlockSizeUser<BlockSize = U16> + BlockCipherEncrypt + Clone + KeyInit,
     M: TagSize,
+    NonceSize: ArraySize,
 {
     /// Applies encryption to the plaintext.
     #[inline]
@@ -217,10 +223,11 @@ where
     }
 }
 
-impl<Cipher, M> Eax<Cipher, Decrypt, M>
+impl<Cipher, M, NonceSize> Eax<Cipher, Decrypt, M, NonceSize>
 where
     Cipher: BlockSizeUser<BlockSize = U16> + BlockCipherEncrypt + Clone + KeyInit,
     M: TagSize,
+    NonceSize: ArraySize,
 {
     /// Applies decryption to the ciphertext **without** verifying the
     /// authenticity of decrypted message.
@@ -267,11 +274,12 @@ where
     }
 }
 
-impl<Cipher, Op, M> fmt::Debug for Eax<Cipher, Op, M>
+impl<Cipher, Op, M, NonceSize> fmt::Debug for Eax<Cipher, Op, M, NonceSize>
 where
     Cipher: BlockSizeUser<BlockSize = U16> + BlockCipherEncrypt + Clone + KeyInit,
     Op: CipherOp,
     M: TagSize,
+    NonceSize: ArraySize,
 {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> Result<(), fmt::Error> {
         f.debug_struct("Eax").finish_non_exhaustive()
@@ -302,7 +310,7 @@ where
 {
     /// Creates a stateful EAX instance that is capable of processing both
     /// the associated data and the plaintext in an "on-line" fashion.
-    fn with_key_and_nonce(key: &Key<Cipher>, nonce: &Nonce<Cipher::BlockSize>) -> Self {
+    fn with_key_and_nonce(key: &Key<Cipher>, nonce: &[u8]) -> Self {
         let prepend_cmac = |key, init_val, data| {
             let mut cmac = <Cmac<Cipher> as KeyInit>::new(key);
             cmac.update(&[0; 15]);
diff --git a/eax/tests/data/wycheproof-128_nonce-len.blb b/eax/tests/data/wycheproof-128_nonce-len.blb
new file mode 100644
index 0000000000000000000000000000000000000000..0e86d0d8ebb16c02c592950eae302ec0765b7c1e
GIT binary patch
literal 2099
zcmV-32+a3d03g2H`&t1Wyo6v6%PDLXuMHSOid1@(>WJLrY;1)903enJmweY%YaRaI
z40EGeQI{Y%PNWvBJTFnFZhe9#G;K~8vkVAFC#@V=D#9HS00K24nDy6_2~y&9zU;Y}
z*aX5s@F2?L9NG0%ChG%&LHtC@!Q~jW;0E5+QxOhr#bqe~5YY*V^2IKctuTMmhl3ca
z4=bw}PyOX1R#hpfz7ZP?Eo~tG-$E!h9-;UaSW**fG=TRQ4i;we++{C!2>Xu>03ao?
zE-0)H_Uh0gYC9r`$N)g;C}J%hZh4J{Wv+89Odek|t4C*7|D-GrY$s!pq;9MrsO}N6
zZG7v07wVzpxH>HM82h{g{cZwVag*y;_5d)zj|g6Bo(}V4Vt~OO&#mym=P4Qg!G5n$
z@6ws1J0;GH!yAC*NS^u5b5`u^sT;?=JTv?Y%_VCJiZtxVupUyTAQn}>W-or`g<)3#
z{Wp2mC>TPu6NvWt1bQl&MRfo^g?le-)(FYYpd@T`4600_oL?M$am$i(@Yu+^Ww#1m
zHEYV8-P4}^IWl<UJ5GQmU~yo8Hs~F0l1)xX0Q)C#@GGar&pKD0RwPg*LI80fyH^|*
z0Wz@2)zOg9yftmy7$ug(K+gg)l@7*h!~lK;JK?q&3UPnOOoyIt)-A+FC`nZZ<qc*c
zao*>Zq^&04#Q1EsvI@q%ooFpBiUrBq*mb6n8%gR4^znR`rSgCtE>*K^8b(e?z~!G@
zaGlIl>J?_h!=d+i$7$-%L4Fr6UgoGQb?GfpTN^rT&KK9ah85>Ywk|XuF!024#)els
zFH*51Q}>#X!s_b_uj*<b;UZxC(^aJ!4FS6!Z>2cG7+w4~Hg8slCs9Y!`2c_b*#h3`
zv30-*GMY2Ltj$~wv!<a^p-~Qfuuq_`_s&9yQw_GL52ya6f~tK+*VS%tjVrLl?bFg`
zNYggMVh*KVfFO%t2sfK$d+^)}ahfBh%?;`6MFWqrw9w|%dgvPt>sgDFK&7;@)!%hO
zn3c`Rx0v<;fG?9tzW<dSIxNwAO6(4Ztdhb$)lZOAzG7o0q%9yq<BGoW-F0&$j9Txr
z?8;Oa21`8q;7yd&)xn!E0DuH6b~~QPNdvsQitH8Uc%!LR<cAL1_AQ+}fyDXkVN{2B
zb$6VjJkF1ErCg`49gTs1#=5Kk@0KiD4Wl{EfkJvcS%4&+ksFgrXwH4JB0&Hsy)nIk
zyuGdRZxv^2<Z`??A^T|La*elXFuVy^uI+EHJ~KV1uRTb_fV3q4J!SyRR;35Xt=4(#
zo?UcHV%Z(fZ?-5;K_GtGzT+5|zndvJO6;giP0T3oNQT7zize_z;F`%L%)6~Z*8@iY
zAW~R7dlB9R94=fT6z(8Wdq63UhC^<xa5^~nX=x7v4NUS4FD(}iyW!C6agOiiGUOoO
zai%NH>F#8K80|Y8Vw@mA@;Z`Db;W<~j&<Jsm%d2o&oTndWs2PjPf)T;TKVu303e`c
z3__XDW9(ii5KfR}B!56iev~4OGm6gW>Gi;VBKrn%$(v+GWH*e6{U1)x*bjCf*gPG2
zm&899BnhOdRtdqe2zy_yvH&2+@Oz=wRaB|HKsgLB#ZsI=(<I6jFvgD9Y<FJSyB&m(
zFa|EU&fBfuHu*k68Da|hAl|kjGgX^cM`i-Gt*lqae-O}wRDI=JycGZ-*qCkbBp%Z#
zb%MacImaZ+Krm#_NP}=c7YpznY%OOcp9x1C3HX=PVix<gBsSy3{2-4%Qsc*5SoO;$
zA5o7=(+U6p03cf1?);Cb%Hp}E+dp4yg6SYCOZg5~w-4QhN!NA2iQYQ^03b3<?QGFr
z%v(1>R30M1irGMOv~h2KMDx2MqGW(+>%1O6YRP9Uw3#watqdbeR6tZ9B7`@qDCU|&
z8S>WE1<9llfB^bF^J&j1>EMVtJT-suV9VQ&*?WGXu^;2#c068^i)&wQhhkgz$ck1K
zM0DQ$wjXh^FMGfim{;|dOOEkkx+MT0+y#U7GqK^$W^63aw%iC$KvB<7>Me25@6)N>
z!wD~&i!S4ZqZ@H=GF>}a_I|4@yC5N_>z@X{r^~b_CRU$t>g$03a}rpzYzInYv(Nup
zDnS~Uq-q_{-ZJ14Xv$SWl@f{Zh$Ld!z5EY|e#e)#CXCr|hRcM0Gbb6Lj)DFw#Xf@A
zc$XU-8}0jTG5LS#)BAsY4`ZLShkv1w>N&r^ZAVIiVH@h{h@ZSa9EGT^{pvf&I>od~
znSN8bG`%U^iaz*r03b)<V$Li({e}7)jvua4741M^ID?ggeO>KqYs>;8bAv!Sm<CXu
zN2PQr<8%=Ay02*<R{%4Q%Y0$K$gPVN%jRJOg91573P7l@Kt6ofA6<SgQZIedp%Kb3
z4H1rMP|Kuy-KDSO-uw)K;GF6t_W?hhpWf)B-&kWTCD5zx*|sE5L-~^PxfMj5q{$;C
zxf2KAv+1At%X!`g=%aSU&4pwPb-i2dRyYus#37$JCX0U#5_E3~*o_+zJgK(4D8{+3
zV7!({?J*xI3Q1*k+sGq3`$C=bgnYq9w9i{|AHc^Ug{_eFR6DjenbMn1KL;{JX~&Tu
zE=o|Zq~gm=*1B7*3v5237IS+&=C?{0){92gK9zK(!>Do+j&s`RGaU}J&Fna)0{PZr
z&O#+>LwW2aL*aZ@D&8vfa#f;;bdicp{%=|UAkzhy_GkzY@5xS~4Gag813-aR_lPyY
d7KA|J5pjxePByveItLjc;OQL+i_1ZDO~`B~>V*IR

literal 0
HcmV?d00001

diff --git a/eax/tests/data/wycheproof-192_nonce-len.blb b/eax/tests/data/wycheproof-192_nonce-len.blb
new file mode 100644
index 0000000000000000000000000000000000000000..4cf6d00f6e57d8db87fcba9dbda770e6e1e664af
GIT binary patch
literal 2243
zcmV;!2t4;%05DJ)>!0s}<#h{V7g+EiK0aT}p(jYR4zw8m4ciJ0dp6P;+7h(@03f{L
zbI|625;qq`=4I^cs3R~TA&U2qLXUtX)92wrjGxa}j3H(=)(&$RGz5FYo19>Sgx~eJ
z00QG8qg0@`fUhCzM-=|<&#${8CNMgS^+Uvfl2$Sif<?T)T>(-nn0hgzJ);;-yc5qx
zHq3lQ<zS}(5L5he=Nnn>voKhri5tDB(Cx2IhR{XAIey}E{+&89MpiJqw!B{EbUpDo
zYBXb$C$d-x?3{t!Y77n-z5^!GJKQW}WQ`N_03d)zN;*4$m0<4T&U$(?>IXnrZW^dW
z;`%p9<Vp&p%XD3q^c)q<-xI_GEd8v{96?Gje`hU);Zdqd3&8Hk_G?~S?sTsaWGmzU
z7_cG+a7a*FAe3Sj?*K6GWD>_K1I9!80#;fI;x~$u5y2XS248?s;&ISu89MepJYYsy
ztpaFLUwGWOrh5z`<3;<VErtsm7>3ZyOkJ@wF!!wH!@&$c`FH-leaM2i=Xvis7w?lK
zs2FZ5qJunL&TH(%_SgVEE)nDzQNjdZ$7rzE8r5!hzQA4tc=?@MV&|FnGUR7oC?gl7
zv)Zy4tBPqIAhU#@knYt%{V2fIb+z1fevh;>*z5-Cmr?5q#Q30#z2-<T5wVV=oH$7p
zll|4^<g1HH0V$<FN$qT@7zt9R4Vf{B!QF_Fr2u|$Qz3X0!;rYtSiW)k(XY69asRxd
zsX-n-dcKQ?boqxCde7@pmf@Q~i&z@g%CL-$$Q?k<z8qze`&T>HqsD+9j*C-Lhs3-K
zXE|3N9APXMJkkY-+}Eynxo0P&YGKH<zVOKRwsk}3f@ekgyi>pBw!J3b1ncL&?vRM@
z?loB97L|$|1haI2Vl1|2PiZnR%)Jj#m?fq2SfNU+1WMw9YqH7es;UQn7?Fvm8pBz)
zJd6n6A^?B@q3sX{wJtX74{#8iXxeh_duLpQUOq`y(%kvcFK1n8Gxm4g%vk!)g?5?J
z<Jk(_xW>hNortyH&oyo2z_vdQfFO$|6w&{F_3sEDe{E*n12RDwR_d18M+VtoL|7@7
z5CCYZ)ZJ_82o8_%^*a>^nG43AJNqO6iy&yVYPGt$i5wJn7*`JF+|SpiJ$s}T|9&td
zk(ITEXzPh%YaYV0F*9jKHlN1Gdx%LG6s9N|L$vD!YG=9T0DuHJ*mKm%*Br7^cuUbn
zNTig`wHNE2K5sJ7o6(K>_;<&y!XX3FLYY3-y0IfNVG!Tjaw!x#3}7A>s!q+`fQ;BX
zvVbJ$GF=uJQ3>_y-U1EOA(~tjRPKYQEMTrZDglmpS1|34^aR+tO1hQIkEY}`zmCb|
z1+!9J{bs_xk%2D&2*5AS?Q%hneQY;y)&uo+EoN%)Nig}W?FUQVah}_#3&^cUUw*wi
zrs;}I50)s_vpy^7?zp_OKN6A0C~1;*cpoVMAVi1!1?Wvl=}kDdGtLG&bwE17!Ww;j
zV3#~>64i`Z>>fY)7J6Fy3$UNX!2vd=(|j<L|FYF_i2*FT;}qoMZR`!%;<?C+Q@gG}
zMuYHrugZUwD$d+j#8VY8b(8ffdq7+A>&+R_fS9ZV03Z<I<dSI~yJdqU@t7fK2R=X<
zpJ16uBn;xFTk*7#@p}Gz*;u8WR|d0|(ix(YYvpk;gG~#z0T&2mr-3;_iWLKCT52gC
zy>xuh2)mssqW~apdEtvn%~}J~rT5{e(D8#nygZJv3vBw2p>>SuHHTCF+Zy2S0~G{o
zQ&_+BVwix%FbfxPn8>slzjUm_yk)ifJqf85|8cF?R1l8`T)f(tF~a~L#IfL9qt%i5
zR6b<hKgNQrKr_lQaqJO}a?B}}4{Q>WCv$mcqEH_c&V<>R9ErXcg)j>k(i1lWTzjer
zAscWnr+}<{3BHe>(H{T+03aLJs{^7=2ep5l7d(z_SD`SvcGZ-o-;rCltA1@7jRH$2
zmNRS{gD9y003g;cFegIR9fCfok-0Q5)rmldtbMqeA4~UgQ$Pc)g4bQPmrIEIMEbsr
z5XO`Dh@faNxZHc=$|(1!9;Q7<(*@kQgyavqn=!sBfB=Yq{9?knYNqXUS!Nwtw2b1w
zZa*ym$wTe^dvG{H`HJ40t26Z8vT5Sexh&e_X{T6Afa|*H9=$@oc%56WD*XT;S?yFo
zs^Dj`vVAZ1DhuinK)#yVYJZt+n9G-!3>pU^Gx*L=oL$<>((2>99BEZUV=xeuOj-S=
zsR(--_qeaF-*~Z*!S8rf<J*A%Ba}2ZS1O>flXput1n2;9L*98jt#!9;?2V})3<!M#
z&e?ZBTNsWvJ>x4-Mz_(qrW_&JN<XFvp@YtJ``t~XwnuP|=PlbxqXwh`c)D;}qyief
z?>6dSn<IckY#|)<mq*7dXE@gF$@0mm-pN4zy|Q({B9-(F;bIU5@d8!^03Zn-&Fu%c
z_tRR@BE0Qa%I84K_t1m-Pa@;ah<@OYD(U%GtHIH=@V<#+qef|J9z(1!E?=sF-%*y*
z7+ti=QNNZVAYv9e)(vkzg96VEBRsq+B4_q~QN}6J>>iSM#b-B|3+Jj>#v7ZNS`)q@
z=7xkWEbaEc8TSTpK=aae=dvf6I5K0DSwIYGWg8o#CeQ;l9S<SADCJA0jy?m?VV3W@
zwa-X;S7#1t_k{vm2;$PW5Y750e1O%U_PC0Gn{bXM;?|C=-x&%Hgdsbh%W~Ek@|S2(
zy{a02=A}JY6mso%^E3W3-Kmj#!N}vJ>0^@$V6xLTLp+7Lxz)zl=iP;Tbx~}_N($M-
z0A+UCc9f^{e1Ob=I^T<kgtQYoBzX6MS67Xoh{_rP3Zfk>XRgt7lsns^=?rv-Cc8Zr
zLX(`rAy*JCPNYN}IsXX&AnQ$zpu}FauPIoTTk*z+qd+JR-Ad>m=ofYG!pJoTnj0ml
Rc1ONRtl)5SI_$}+&_SSvM4JEr

literal 0
HcmV?d00001

diff --git a/eax/tests/data/wycheproof-256_nonce-len.blb b/eax/tests/data/wycheproof-256_nonce-len.blb
new file mode 100644
index 0000000000000000000000000000000000000000..583b5979f6447aabeee11230b8a1bb2a179c9c7a
GIT binary patch
literal 2387
zcmV-Z39R;706>7cF_Opw&X!)Ian=6^Jn-~8YAUsMvIs(M5kQ;?xv&^brN52+SW?02
z5;vUy03b~%I{B#nO29PnOB6Fq7Op_dR<?juF1Jt!^+-!hxC8o7W9!!HxgTn_uJn;=
zc4BiFnc_agiG{q)?yF$&00Jr^jKpBo|3xEQJS36F=A$H$)<99@zbmbhx3BS}yaiPY
zs2%jVZ>#hi634I(VC0Rr;Zhh+2e0k@!?waU7$egF5WX`A_bM!E?J!_CDP$r0PzMT;
z$08ZPxvg<(%-Im&P7^>`)av_9;Lpd?+nK2KOBL6%p9;*4rk7)|8Nq3vhi6I{FUuP^
zsh)ATM?kHc03cMGHd^@;^RR&v9LsBhRfs^u25u%=l#f8*UN`zc58fML9pZ5)m0VQq
z*QD0cK6vgx0urd+PzUXYvp*VekhT#|o(RtUmIv~}cD>Kr#m=1980N99^8Hw-b}VJ{
z8vrm6@$C7=1%zf@n&t1}dFS^xe(Gr!(y<Xx_D}v&&4Y~UiQP~JVxsO#OGOUuXd#Y-
zt{yJhmcG~_f+PyA2>Je;KrXc$Mw+PWo@`X8G@Gtaq7M!@ClR}$6)Zwe1GZ-!aTo-t
zz5`H-UokftZ_)rhuv3|mhN6N`Ld=XHI<ihIm!^fS%qr6+VpWb+rN=2=0q~k?6KM&-
zSm8AS?o^2NlI|o0oo%Nyth$U5>49H)<$F<&rrN%g;OLyLiI;0YZv3f%CXtG@WY~;r
z>;mYSi!0?0Kag+vt^Lu3^K<7`7)rft{DZv)u^#%OrvQGt?0LY3)E;0h2@ifiNlk0>
z`k~xy@T-c5>RmO|CbCGvt%w6r;v@DK4L8h|RpA6#<($2390@Md9dgXauONUP#XuC@
z`a}ABSP4V&oyMrY;HOkUd-`?{USH<TGcC@HX52eq&medwJCfJ(@p-H^cKD=JV0#`8
zvf*+1sWypL#a5-{Vw9I)z{4RMo&}FUTOANJz_EVdutY~^_zESs!M8#5wF*rzQX*@r
z9B;P)7}gL#qZ92(C?m`UTL6Fn(3XHPfxhpa0FU@xUEDa`tnl!j<@ex!9zc1^WYFA?
zUS|=_Ng=0*edlf_c>Tt981WcYhQI2aOlVzD<hz=JfFNIUOaub`4SKicg-M|oreb;^
zHkG7FHAnMhmv#7>Tpa$jbKtaZQTP6#{v6wKB%#Zj^CB8bVY^4z>s?mPzh>D|wd@uq
zhoHZODt)n5-z7km=ziK{(A+Ifg%B{q;j(<nB4x8iOe|L`*!+z9C@mWp&I7x(XL#~m
zMJP230DuH8TFe=&xs(gHO+iaV=M#pc3ARB=3lo%+*VZ!2@n=upB@x5=*1~gH<`a8N
z)h_%?_;Kc9G*MA~YCLEp4=Q<)YJeniHEikef-W$Cm=~kD9-%h?t1@-A^KpuVTF|jF
zze~He9^_`hu%XLZCPGcT$kDb*@+XCmdYl1dqNEz1#CO)j-G?Y)*Ax=rS2FergVeNs
z;XoHT{U~-NgjeI_!z0_P*k0YJ?5%^RNo|ko3y7|(E_5iEp8;NKx1C-??5H+MILY?2
zf!(11Akncr>dxBJVuc;ZcG$7qAV6Hsuq8Xo)_@H=F>3RrX*U%ZX%L|DqP#)VE`R2S
z@q9q4R4M&G7mGNB^2U~zUWkbS0!3S0o<eqHDd-JIiDxQ6;q5rDS5t)>c^6(v;UCt|
zfCE2)uEd1w&_s-0e88f903dp(k)FGi4>V~C%a~;tRLejbD1?^z2?J|2^I%Ip%`}r@
z>q%7%zUafxh%hXIW{{#l2|lqSLsNd}=^P(%TZSeB_}cl@;n&u35~<dXTC9^;2vHDV
zOaLG=@3oAP=*I$ahYr9G;^G28TFNM59xK@`e;6<JQ?cmliix1xbfsUAe~Y0N;^A0R
zKoMAk_LH$yRz92iI|s_kFMoWhoBmPwo+JLXsYZ+a&=3R=A(`(X;okrtg5%}{(!P(%
zw@+h@9&qwZK;JUKIwE*7YCM*0?lKxe_OW@3j!Tu_Y+?#ryuK1R(Lg_pq<fl_1%hNw
zj?bJeMCcQPcc?d<ToJ1Nf9x5BZ1Dg903fk{VE~9OYeAi#?F@^2jhaAqV9^O?#!xu}
zrBdDEs0r=q+DQ&xT*Ko@+L@MdfS7{-03gE@BU3@%zptTEYqk(Xr}036hhh+E)4+Rp
zVY@)+rE5CD@QHO;Fb<cSqMJ4|Y7GWJH=+qTpF|jVc?H!wez@Ss*3hHC1Q)$ms}icv
zPp`x{fB@i5B}Z*+)fq69#eptR$_(}tFs@S71~;pC>3cW3WiEN!Lm6~_x)C3%vS&92
z8n`#~<xGYQblmT$@!0?Djtl@Gaw$cf%sfLAIixgu%U%q2KxZb;^z;3i+yR?nD=xNf
z=yUF((g9V9{UZVxJuSU6<Ulf&O;V%W=14qc2@Z4^Zh|987;^oJThn6!)1)vWh(Lh=
zt?f8j@^D|iex$neS=9b*UxhD)jtez^-Ss}oAK|Md!<+AA-H;l<Da6r`&cCjy1YN>P
zQ}p<y4_@kUuNE`v#=^ZyEXnv0jrw4+u$mbz(?2Y+06-h8l1^LPjG<4bEL5K~4to7c
zt270i1BiYM0=>Ey*do4nT&@iwp{2xA03h>fP>v{Phw2cGz!N~;15rR@;tda0O^1~)
z%8HHv(v}u8%-Mn_WFt&`c~rVsS_scT^M>Sa>}e(BG*1H*e+2u>ph_pMkBqfas}J?a
zWsTg@g95OObBE8)Ux_1ExfWB;$1^a_=e-K8GxH~F0bT=M<wNN0{-*$R|LpA~S=g-n
zc3gjD{p^oiL`Vwbh|{m+DHX{>V`&fa1||3%-~P_I`B{X5LRO^COyq*2;3G{D9?4N+
z_z!FXh1G55ii{CW_$!w}>9XQrIcKC!!P&iJb&TqXP1)A_ii9DBI?!c#;q<FvQWf)^
zZZ+_|rs1m!SbXexzGdZQSFvFDdF6ox<>8x0*o2SSQ>_g89D5OL_57<jfy*O=YPt67
zL2~ABZot!iDo=f@0>OD(ZO5E={kde_Gj2--BtPp`{?3d6-uYA_1^V2Vezb-jql6<?
zDCv>_AY1!_L$biU5djztSodUl(Lho*m!cBEgYw3QJFoc=BA-0Y7*Z8k)GP%jzHLeG
FZFe&gjOhRX

literal 0
HcmV?d00001

diff --git a/eax/tests/wycheproof.rs b/eax/tests/wycheproof.rs
index 31ea4356..29a6681d 100644
--- a/eax/tests/wycheproof.rs
+++ b/eax/tests/wycheproof.rs
@@ -1,13 +1,86 @@
-//! Test vectors from Wycheproof (`aes_eax_test.json`): the groups with a
-//! 128-bit nonce and a 128-bit tag, for AES-128, AES-192 and AES-256.
+//! Test vectors from Wycheproof (`aes_eax_test.json`) with a 128-bit tag, for
+//! AES-128, AES-192 and AES-256.
 #![cfg(feature = "alloc")]
 
+use aead::{
+    array::ArraySize,
+    consts::{U0, U4, U8, U12, U16, U20, U32, U64, U128, U257},
+    dev::{TestVector, blobby, pass_test},
+};
 use aes::{Aes128, Aes192, Aes256};
-use eax::Eax;
+use eax::{
+    Eax, KeyInit, Tag,
+    cipher::{BlockCipherEncrypt, BlockSizeUser},
+    online::{Decrypt, Eax as EaxOnline, Encrypt},
+};
 
+// The groups with a 128-bit nonce.
 aead::new_pass_test!(aes128_pass, "wycheproof-128_pass", Eax<Aes128>);
 aead::new_fail_test!(aes128_fail, "wycheproof-128_fail", Eax<Aes128>);
 aead::new_pass_test!(aes192_pass, "wycheproof-192_pass", Eax<Aes192>);
 aead::new_fail_test!(aes192_fail, "wycheproof-192_fail", Eax<Aes192>);
 aead::new_pass_test!(aes256_pass, "wycheproof-256_pass", Eax<Aes256>);
 aead::new_fail_test!(aes256_fail, "wycheproof-256_fail", Eax<Aes256>);
+
+/// Checks a vector with both `Eax` and `online::Eax` using an `N`-byte nonce.
+fn nonce_len_test<C, N>(i: usize, tv: &TestVector)
+where
+    C: BlockSizeUser<BlockSize = U16> + BlockCipherEncrypt + Clone + KeyInit,
+    N: ArraySize,
+{
+    if let Err(reason) = pass_test::<Eax<C, U16, N>>(tv) {
+        panic!("\nFailed test #{i}\nreason:\t{reason:?}\ntest vector:\t{tv:?}\n");
+    }
+
+    let key = tv.key.try_into().expect("wrong key size");
+    let nonce = tv.nonce.try_into().expect("wrong nonce size");
+    let (ct, tag) = tv.ciphertext.split_at(tv.plaintext.len());
+    let tag: &Tag<U16> = tag.try_into().expect("wrong tag size");
+
+    let mut buf = tv.plaintext.to_vec();
+    let mut cipher = EaxOnline::<C, Encrypt, U16, N>::with_key_and_nonce(key, nonce);
+    cipher.update_assoc(tv.aad);
+    cipher.encrypt(&mut buf);
+    assert_eq!(buf, ct, "online encryption, test #{i}");
+    assert_eq!(&cipher.finish(), tag, "online tag, test #{i}");
+
+    let mut cipher = EaxOnline::<C, Decrypt, U16, N>::with_key_and_nonce(key, nonce);
+    cipher.update_assoc(tv.aad);
+    cipher.decrypt_unauthenticated_hazmat(&mut buf);
+    assert_eq!(buf, tv.plaintext, "online decryption, test #{i}");
+    assert!(cipher.finish(tag).is_ok(), "online tag check, test #{i}");
+}
+
+/// The groups with a nonce that is not 128 bits long (0 to 257 bytes).
+macro_rules! new_nonce_len_test {
+    ($name:ident, $test_name:expr, $cipher:ty) => {
+        #[test]
+        fn $name() {
+            blobby::parse_into_structs!(
+                include_bytes!(concat!("data/", $test_name, ".blb"));
+                static TEST_VECTORS: &[
+                    TestVector { key, nonce, aad, plaintext, ciphertext }
+                ];
+            );
+
+            for (i, tv) in TEST_VECTORS.iter().enumerate() {
+                match tv.nonce.len() {
+                    0 => nonce_len_test::<$cipher, U0>(i, tv),
+                    4 => nonce_len_test::<$cipher, U4>(i, tv),
+                    8 => nonce_len_test::<$cipher, U8>(i, tv),
+                    12 => nonce_len_test::<$cipher, U12>(i, tv),
+                    20 => nonce_len_test::<$cipher, U20>(i, tv),
+                    32 => nonce_len_test::<$cipher, U32>(i, tv),
+                    64 => nonce_len_test::<$cipher, U64>(i, tv),
+                    128 => nonce_len_test::<$cipher, U128>(i, tv),
+                    257 => nonce_len_test::<$cipher, U257>(i, tv),
+                    n => panic!("no test for a {n}-byte nonce"),
+                }
+            }
+        }
+    };
+}
+
+new_nonce_len_test!(aes128_nonce_len, "wycheproof-128_nonce-len", Aes128);
+new_nonce_len_test!(aes192_nonce_len, "wycheproof-192_nonce-len", Aes192);
+new_nonce_len_test!(aes256_nonce_len, "wycheproof-256_nonce-len", Aes256);