Rework AsconEngine

- efficient buffering
- AeadParameters support
- underflow check for decryption
improved OutputSize methods

2 files changed, 486 insertions, 321 deletions

diff --git a/crypto/src/crypto/engines/AsconEngine.cs b/crypto/src/crypto/engines/AsconEngine.cs
index 43b5eff15..aff8499dc 100644
--- a/crypto/src/crypto/engines/AsconEngine.cs
+++ b/crypto/src/crypto/engines/AsconEngine.cs
@@ -1,6 +1,5 @@
 using System;
 using System.Diagnostics;
-using System.IO;
 #if NETSTANDARD1_0_OR_GREATER || NETCOREAPP1_0_OR_GREATER
 using System.Runtime.CompilerServices;
 #endif
@@ -24,7 +23,7 @@ namespace Org.BouncyCastle.Crypto.Engines
         {
             ascon80pq,
             ascon128a,
-            ascon128
+            ascon128,
         }
 
         private enum State
@@ -40,8 +39,6 @@ namespace Org.BouncyCastle.Crypto.Engines
             DecFinal       = 8,
         }
 
-        private readonly MemoryStream message = new MemoryStream();
-
         private readonly AsconParameters asconParameters;
         private readonly int CRYPTO_KEYBYTES;
         private readonly int CRYPTO_ABYTES;
@@ -61,7 +58,9 @@ namespace Org.BouncyCastle.Crypto.Engines
         private ulong x4;
         private string algorithmName;
         private State m_state = State.Uninitialized;
+        private byte[] initialAssociatedText;
 
+        private readonly int m_bufferSizeDecrypt;
         private readonly byte[] m_buf;
         private int m_bufPos = 0;
 
@@ -96,7 +95,8 @@ namespace Org.BouncyCastle.Crypto.Engines
             }
             nr = (ASCON_AEAD_RATE == 8) ? 6 : 8;
 
-            m_buf = new byte[ASCON_AEAD_RATE];
+            m_bufferSizeDecrypt = ASCON_AEAD_RATE + CRYPTO_ABYTES;
+            m_buf = new byte[m_bufferSizeDecrypt];
         }
 
         public int GetKeyBytesSize()
@@ -113,16 +113,35 @@ namespace Org.BouncyCastle.Crypto.Engines
 
         public void Init(bool forEncryption, ICipherParameters parameters)
         {
-            if (!(parameters is ParametersWithIV withIV))
-                throw new ArgumentException("ASCON Init parameters must include an IV");
+            KeyParameter key;
+            byte[] npub;
+
+            if (parameters is AeadParameters aeadParameters)
+            {
+                key = aeadParameters.Key;
+                npub = aeadParameters.GetNonce();
+                initialAssociatedText = aeadParameters.GetAssociatedText();
+
+                int macSizeBits = aeadParameters.MacSize;
+                if (macSizeBits != CRYPTO_ABYTES * 8)
+                    throw new ArgumentException("Invalid value for MAC size: " + macSizeBits);
+            }
+            else if (parameters is ParametersWithIV withIV)
+            {
+                key = withIV.Parameters as KeyParameter;
+                npub = withIV.GetIV();
+                initialAssociatedText = null;
+            }
+            else
+            {
+                throw new ArgumentException("invalid parameters passed to Ascon");
+            }
 
-            byte[] npub = withIV.GetIV();
+            if (key == null)
+                throw new ArgumentException("Ascon Init parameters must include a key");
             if (npub == null || npub.Length != CRYPTO_ABYTES)
                 throw new ArgumentException(asconParameters + " requires exactly " + CRYPTO_ABYTES + " bytes of IV");
 
-            if (!(withIV.Parameters is KeyParameter key))
-                throw new ArgumentException("ASCON Init parameters must include a key");
-
             byte[] k = key.GetKey();
             if (k.Length != CRYPTO_KEYBYTES)
                 throw new ArgumentException(asconParameters + " key must be " + CRYPTO_KEYBYTES + " bytes long");
@@ -147,7 +166,7 @@ namespace Org.BouncyCastle.Crypto.Engines
 
             m_state = forEncryption ? State.EncInit : State.DecInit;
 
-            Reset(false);
+            Reset(true);
         }
 
         public void ProcessAadByte(byte input)
@@ -204,7 +223,7 @@ namespace Org.BouncyCastle.Crypto.Engines
                 len -= ASCON_AEAD_RATE;
             }
 
-            Array.Copy(inBytes, inOff, m_buf, m_bufPos, len);
+            Array.Copy(inBytes, inOff, m_buf, 0, len);
             m_bufPos = len;
 #endif
         }
@@ -273,9 +292,84 @@ namespace Org.BouncyCastle.Crypto.Engines
 #else
             bool forEncryption = CheckData();
 
-            message.Write(inBytes, inOff, len);
+            int resultLength = 0;
+
+            if (forEncryption)
+            {
+                if (m_bufPos > 0)
+                {
+                    int available = ASCON_AEAD_RATE - m_bufPos;
+                    if (len < available)
+                    {
+                        Array.Copy(inBytes, inOff, m_buf, m_bufPos, len);
+                        m_bufPos += len;
+                        return 0;
+                    }
+
+                    Array.Copy(inBytes, inOff, m_buf, m_bufPos, available);
+                    inOff += available;
+                    len -= available;
+
+                    ProcessBufferEncrypt(m_buf, 0, outBytes, outOff);
+                    resultLength = ASCON_AEAD_RATE;
+                    //m_bufPos = 0;
+                }
+
+                while (len >= ASCON_AEAD_RATE)
+                {
+                    ProcessBufferEncrypt(inBytes, inOff, outBytes, outOff + resultLength);
+                    inOff += ASCON_AEAD_RATE;
+                    len -= ASCON_AEAD_RATE;
+                    resultLength += ASCON_AEAD_RATE;
+                }
+            }
+            else
+            {
+                int available = m_bufferSizeDecrypt - m_bufPos;
+                if (len < available)
+                {
+                    Array.Copy(inBytes, inOff, m_buf, m_bufPos, len);
+                    m_bufPos += len;
+                    return 0;
+                }
+
+                if (m_bufPos >= ASCON_AEAD_RATE)
+                {
+                    ProcessBufferDecrypt(m_buf, 0, outBytes, outOff);
+                    m_bufPos -= ASCON_AEAD_RATE;
+                    Array.Copy(m_buf, ASCON_AEAD_RATE, m_buf, 0, m_bufPos);
+                    resultLength = ASCON_AEAD_RATE;
 
-            return ProcessBytes(forEncryption, outBytes, outOff);
+                    available += ASCON_AEAD_RATE;
+                    if (len < available)
+                    {
+                        Array.Copy(inBytes, inOff, m_buf, m_bufPos, len);
+                        m_bufPos += len;
+                        return resultLength;
+                    }
+                }
+
+                available = ASCON_AEAD_RATE - m_bufPos;
+                Array.Copy(inBytes, inOff, m_buf, m_bufPos, available);
+                inOff += available;
+                len -= available;
+                ProcessBufferDecrypt(m_buf, 0, outBytes, outOff + resultLength);
+                resultLength += ASCON_AEAD_RATE;
+                //m_bufPos = 0;
+
+                while (len >= m_bufferSizeDecrypt)
+                {
+                    ProcessBufferDecrypt(inBytes, inOff, outBytes, outOff + resultLength);
+                    inOff += ASCON_AEAD_RATE;
+                    len -= ASCON_AEAD_RATE;
+                    resultLength += ASCON_AEAD_RATE;
+                }
+            }
+
+            Array.Copy(inBytes, inOff, m_buf, 0, len);
+            m_bufPos = len;
+
+            return resultLength;
 #endif
         }
 
@@ -284,9 +378,80 @@ namespace Org.BouncyCastle.Crypto.Engines
         {
             bool forEncryption = CheckData();
 
-            message.Write(input);
+            int resultLength = 0;
+
+            if (forEncryption)
+            {
+                if (m_bufPos > 0)
+                {
+                    int available = ASCON_AEAD_RATE - m_bufPos;
+                    if (input.Length < available)
+                    {
+                        input.CopyTo(m_buf.AsSpan(m_bufPos));
+                        m_bufPos += input.Length;
+                        return 0;
+                    }
+
+                    input[..available].CopyTo(m_buf.AsSpan(m_bufPos));
+                    input = input[available..];
+
+                    ProcessBufferEncrypt(m_buf, output);
+                    resultLength = ASCON_AEAD_RATE;
+                    //m_bufPos = 0;
+                }
+
+                while (input.Length >= ASCON_AEAD_RATE)
+                {
+                    ProcessBufferEncrypt(input, output[resultLength..]);
+                    input = input[ASCON_AEAD_RATE..];
+                    resultLength += ASCON_AEAD_RATE;
+                }
+            }
+            else
+            {
+                int available = m_bufferSizeDecrypt - m_bufPos;
+                if (input.Length < available)
+                {
+                    input.CopyTo(m_buf.AsSpan(m_bufPos));
+                    m_bufPos += input.Length;
+                    return 0;
+                }
+
+                if (m_bufPos >= ASCON_AEAD_RATE)
+                {
+                    ProcessBufferDecrypt(m_buf, output);
+                    m_bufPos -= ASCON_AEAD_RATE;
+                    m_buf.AsSpan(0, m_bufPos).CopyFrom(m_buf.AsSpan(ASCON_AEAD_RATE));
+                    resultLength = ASCON_AEAD_RATE;
+
+                    available += ASCON_AEAD_RATE;
+                    if (input.Length < available)
+                    {
+                        input.CopyTo(m_buf.AsSpan(m_bufPos));
+                        m_bufPos += input.Length;
+                        return resultLength;
+                    }
+                }
+
+                available = ASCON_AEAD_RATE - m_bufPos;
+                input[..available].CopyTo(m_buf.AsSpan(m_bufPos));
+                input = input[available..];
+                ProcessBufferDecrypt(m_buf, output[resultLength..]);
+                resultLength += ASCON_AEAD_RATE;
+                //m_bufPos = 0;
+
+                while (input.Length >= m_bufferSizeDecrypt)
+                {
+                    ProcessBufferDecrypt(input, output[resultLength..]);
+                    input = input[ASCON_AEAD_RATE..];
+                    resultLength += ASCON_AEAD_RATE;
+                }
+            }
 
-            return ProcessBytes(forEncryption, output);
+            input.CopyTo(m_buf);
+            m_bufPos = input.Length;
+
+            return resultLength;
         }
 #endif
 
@@ -297,36 +462,41 @@ namespace Org.BouncyCastle.Crypto.Engines
 #else
             bool forEncryption = CheckData();
 
-            byte[] input = message.GetBuffer();
-            int len = Convert.ToInt32(message.Length);
-
+            int resultLength;
             if (forEncryption)
             {
-                Check.OutputLength(outBytes, outOff, len + CRYPTO_ABYTES, "output buffer too short");
-                ascon_final(true, outBytes, outOff, input, 0, len);
-                mac = new byte[16];
+                resultLength = m_bufPos + CRYPTO_ABYTES;
+                Check.OutputLength(outBytes, outOff, resultLength, "output buffer too short");
+
+                ProcessFinalEncrypt(m_buf, 0, m_bufPos, outBytes, outOff);
+
+                mac = new byte[CRYPTO_ABYTES];
                 Pack.UInt64_To_BE(x3, mac, 0);
                 Pack.UInt64_To_BE(x4, mac, 8);
-                Array.Copy(mac, 0, outBytes, len + outOff, 16);
+                Array.Copy(mac, 0, outBytes, outOff + m_bufPos, CRYPTO_ABYTES);
+
                 Reset(false);
-                return len + CRYPTO_ABYTES;
             }
             else
             {
-                // TODO Check for underflow i.e. total input < CRYPTO_ABYTES
-                Check.OutputLength(outBytes, outOff, len - CRYPTO_ABYTES, "output buffer too short");
-                len -= CRYPTO_ABYTES;
-                ascon_final(false, outBytes, outOff, input, 0, len);
-                x3 ^= Pack.BE_To_UInt64(input, len);
-                x4 ^= Pack.BE_To_UInt64(input, len + 8);
-                ulong result = x3 | x4;
+                if (m_bufPos < CRYPTO_ABYTES)
+                    throw new InvalidCipherTextException("data too short");
+
+                m_bufPos -= CRYPTO_ABYTES;
+
+                resultLength = m_bufPos;
+                Check.OutputLength(outBytes, outOff, resultLength, "output buffer too short");
+
+                ProcessFinalDecrypt(m_buf, 0, m_bufPos, outBytes, outOff);
 
-                if (result != 0UL)
+                x3 ^= Pack.BE_To_UInt64(m_buf, m_bufPos);
+                x4 ^= Pack.BE_To_UInt64(m_buf, m_bufPos + 8);
+                if ((x3 | x4) != 0UL)
                     throw new InvalidCipherTextException("mac check in " + AlgorithmName + " failed");
 
                 Reset(true);
-                return len;
             }
+            return resultLength;
 #endif
         }
 
@@ -335,41 +505,41 @@ namespace Org.BouncyCastle.Crypto.Engines
         {
             bool forEncryption = CheckData();
 
-            byte[] input = message.GetBuffer();
-            int len = Convert.ToInt32(message.Length);
-
+            int resultLength;
             if (forEncryption)
             {
-                Check.OutputLength(output, len + CRYPTO_ABYTES, "output buffer too short");
-                ascon_final(true, output, input.AsSpan(0, len));
-                mac = new byte[CRYPTO_ABYTES];
-                Pack.UInt64_To_BE(x3, mac, 0);
-                Pack.UInt64_To_BE(x4, mac, 8);
+                resultLength = m_bufPos + CRYPTO_ABYTES;
+                Check.OutputLength(output, resultLength, "output buffer too short");
 
-                FinishData(State.EncFinal);
+                ProcessFinalEncrypt(m_buf.AsSpan(0, m_bufPos), output);
+
+                mac = new byte[CRYPTO_ABYTES];
+                Pack.UInt64_To_BE(x3, mac.AsSpan());
+                Pack.UInt64_To_BE(x4, mac.AsSpan(8));
+                mac.CopyTo(output[m_bufPos..]);
 
-                mac.AsSpan(0, CRYPTO_ABYTES).CopyTo(output[len..]);
                 Reset(false);
-                return len + CRYPTO_ABYTES;
             }
             else
             {
-                // TODO Check for underflow i.e. total input < CRYPTO_ABYTES
-                Check.OutputLength(output, len - CRYPTO_ABYTES, "output buffer too short");
-                len -= CRYPTO_ABYTES;
-                ascon_final(false, output, input.AsSpan(0, len));
-                x3 ^= Pack.BE_To_UInt64(input, len);
-                x4 ^= Pack.BE_To_UInt64(input, len + 8);
-                ulong result = x3 | x4;
+                if (m_bufPos < CRYPTO_ABYTES)
+                    throw new InvalidCipherTextException("data too short");
+
+                m_bufPos -= CRYPTO_ABYTES;
 
-                FinishData(State.DecFinal);
+                resultLength = m_bufPos;
+                Check.OutputLength(output, resultLength, "output buffer too short");
 
-                if (result != 0UL)
+                ProcessFinalDecrypt(m_buf.AsSpan(0, m_bufPos), output);
+
+                x3 ^= Pack.BE_To_UInt64(m_buf.AsSpan(m_bufPos));
+                x4 ^= Pack.BE_To_UInt64(m_buf.AsSpan(m_bufPos + 8));
+                if ((x3 | x4) != 0UL)
                     throw new InvalidCipherTextException("mac check in " + AlgorithmName + " failed");
 
                 Reset(true);
-                return len;
             }
+            return resultLength;
         }
 #endif
 
@@ -380,15 +550,21 @@ namespace Org.BouncyCastle.Crypto.Engines
 
         public int GetUpdateOutputSize(int len)
         {
-            int total = Convert.ToInt32(message.Length + System.Math.Max(0, len));
+            int total = System.Math.Max(0, len);
 
             switch (m_state)
             {
             case State.DecInit:
             case State.DecAad:
+                total = System.Math.Max(0, total - CRYPTO_ABYTES);
+                break;
             case State.DecData:
             case State.DecFinal:
-                total = System.Math.Max(0, total - CRYPTO_ABYTES);
+                total = System.Math.Max(0, total + m_bufPos - CRYPTO_ABYTES);
+                break;
+            case State.EncData:
+            case State.EncFinal:
+                total += m_bufPos;
                 break;
             default:
                 break;
@@ -399,15 +575,19 @@ namespace Org.BouncyCastle.Crypto.Engines
 
         public int GetOutputSize(int len)
         {
-            int total = Convert.ToInt32(message.Length + System.Math.Max(0, len));
+            int total = System.Math.Max(0, len);
 
             switch (m_state)
             {
             case State.DecInit:
             case State.DecAad:
+                return System.Math.Max(0, total - CRYPTO_ABYTES);
             case State.DecData:
             case State.DecFinal:
-                return System.Math.Max(0, total - CRYPTO_ABYTES);
+                return System.Math.Max(0, total + m_bufPos - CRYPTO_ABYTES);
+            case State.EncData:
+            case State.EncFinal:
+                return total + m_bufPos + CRYPTO_ABYTES;
             default:
                 return total + CRYPTO_ABYTES;
             }
@@ -495,6 +675,28 @@ namespace Org.BouncyCastle.Crypto.Engines
 
         private void FinishData(State nextState)
         {
+            switch (asconParameters)
+            {
+            case AsconParameters.ascon128:
+                x1 ^= K1;
+                x2 ^= K2;
+                break;
+            case AsconParameters.ascon128a:
+                x2 ^= K1;
+                x3 ^= K2;
+                break;
+            case AsconParameters.ascon80pq:
+                x1 ^= (K0 << 32 | K1 >> 32);
+                x2 ^= (K1 << 32 | K2 >> 32);
+                x3 ^=  K2 << 32;
+                break;
+            default:
+                throw new InvalidOperationException();
+            }
+            P(12);
+            x3 ^= K1;
+            x4 ^= K2;
+
             m_state = nextState;
         }
 
@@ -558,342 +760,244 @@ namespace Org.BouncyCastle.Crypto.Engines
         }
 
 #if NETCOREAPP2_1_OR_GREATER || NETSTANDARD2_1_OR_GREATER
-        private int ProcessBytes(bool forEncryption, Span<byte> output)
+        private void ProcessBufferAad(ReadOnlySpan<byte> buffer)
         {
-            int msgLen = Convert.ToInt32(message.Length);
-            int outLen = 0;
-            if (forEncryption)
+            Debug.Assert(buffer.Length >= ASCON_AEAD_RATE);
+
+            x0 ^= Pack.BE_To_UInt64(buffer);
+            if (ASCON_AEAD_RATE == 16)
             {
-                if (msgLen >= ASCON_AEAD_RATE)
-                {
-                    byte[] input = message.GetBuffer();
-                    outLen = (msgLen / ASCON_AEAD_RATE) * ASCON_AEAD_RATE;
-                    Check.OutputLength(output, outLen, "output buffer is too short");
-                    ascon_encrypt(output, input.AsSpan(0, outLen));
-                    message.SetLength(0);
-                    message.Write(input, outLen, msgLen - outLen);
-                }
+                x1 ^= Pack.BE_To_UInt64(buffer[8..]);
             }
-            else
-            {
-                if (msgLen - CRYPTO_ABYTES >= ASCON_AEAD_RATE)
-                {
-                    byte[] input = message.GetBuffer();
-                    outLen = ((msgLen - CRYPTO_ABYTES) / ASCON_AEAD_RATE) * ASCON_AEAD_RATE;
-                    Check.OutputLength(output, outLen, "output buffer is too short");
-                    ascon_decrypt(output, input.AsSpan(0, outLen));
-                    message.SetLength(0);
-                    message.Write(input, outLen, msgLen - outLen);
-                }
-            }
-            return outLen;
+            P(nr);
         }
 
-        private void ProcessBufferAad(ReadOnlySpan<byte> aad)
+        private void ProcessBufferDecrypt(ReadOnlySpan<byte> buffer, Span<byte> output)
         {
-            Debug.Assert(aad.Length >= ASCON_AEAD_RATE);
+            Debug.Assert(buffer.Length >= ASCON_AEAD_RATE);
 
-            x0 ^= Pack.BE_To_UInt64(aad);
+            Check.OutputLength(output, ASCON_AEAD_RATE, "output buffer too short");
+
+            {
+                ulong c0 = Pack.BE_To_UInt64(buffer);
+                Pack.UInt64_To_BE(x0 ^ c0, output);
+                x0 = c0;
+            }
             if (ASCON_AEAD_RATE == 16)
             {
-                x1 ^= Pack.BE_To_UInt64(aad[8..]);
+                ulong c1 = Pack.BE_To_UInt64(buffer[8..]);
+                Pack.UInt64_To_BE(x1 ^ c1, output[8..]);
+                x1 = c1;
             }
             P(nr);
         }
 
-        private void ascon_encrypt(Span<byte> c, ReadOnlySpan<byte> m)
+        private void ProcessBufferEncrypt(ReadOnlySpan<byte> buffer, Span<byte> output)
         {
-            /* full plaintext blocks */
-            while (m.Length >= ASCON_AEAD_RATE)
+            Debug.Assert(buffer.Length >= ASCON_AEAD_RATE);
+
+            Check.OutputLength(output, ASCON_AEAD_RATE, "output buffer too short");
+
             {
-                x0 ^= Pack.BE_To_UInt64(m);
-                Pack.UInt64_To_BE(x0, c);
-                if (ASCON_AEAD_RATE == 16)
-                {
-                    x1 ^= Pack.BE_To_UInt64(m[8..]);
-                    Pack.UInt64_To_BE(x1, c[8..]);
-                }
-                P(nr);
-                m = m[ASCON_AEAD_RATE..];
-                c = c[ASCON_AEAD_RATE..];
+                x0 ^= Pack.BE_To_UInt64(buffer);
+                Pack.UInt64_To_BE(x0, output);
+            }
+            if (ASCON_AEAD_RATE == 16)
+            {
+                x1 ^= Pack.BE_To_UInt64(buffer[8..]);
+                Pack.UInt64_To_BE(x1, output[8..]);
             }
+            P(nr);
         }
 
-        private void ascon_decrypt(Span<byte> m, ReadOnlySpan<byte> c)
+        private void ProcessFinalDecrypt(ReadOnlySpan<byte> input, Span<byte> output)
         {
-            /* full ciphertext blocks */
-            while (c.Length >= ASCON_AEAD_RATE)
+            Debug.Assert(input.Length < ASCON_AEAD_RATE);
+
+            if (input.Length >= 8) // ASCON_AEAD_RATE == 16 is implied
             {
-                ulong cx = Pack.BE_To_UInt64(c);
+                ulong cx = Pack.BE_To_UInt64(input);
                 x0 ^= cx;
-                Pack.UInt64_To_BE(x0, m);
+                Pack.UInt64_To_BE(x0, output);
                 x0 = cx;
-                if (ASCON_AEAD_RATE == 16)
+                input = input[8..];
+                output = output[8..];
+                x1 ^= PAD(input.Length);
+                if (!input.IsEmpty)
                 {
-                    cx = Pack.BE_To_UInt64(c[8..]);
+                    cx = Pack.BE_To_UInt64_High(input);
+                    x1 ^= cx;
+                    Pack.UInt64_To_BE_High(x1, output[..input.Length]);
+                    x1 &= ulong.MaxValue >> (input.Length << 3);
                     x1 ^= cx;
-                    Pack.UInt64_To_BE(x1, m[8..]);
-                    x1 = cx;
-                }
-                P(nr);
-                c = c[ASCON_AEAD_RATE..];
-                m = m[ASCON_AEAD_RATE..];
-            }
-        }
-
-        private void ascon_final(bool forEncryption, Span<byte> output, ReadOnlySpan<byte> input)
-        {
-            if (forEncryption)
-            {
-                /* final plaintext block */
-                if (ASCON_AEAD_RATE == 16 && input.Length >= 8)
-                {
-                    x0 ^= Pack.BE_To_UInt64(input);
-                    Pack.UInt64_To_BE(x0, output);
-                    input = input[8..];
-                    output = output[8..];
-                    x1 ^= PAD(input.Length);
-                    if (!input.IsEmpty)
-                    {
-                        x1 ^= Pack.BE_To_UInt64_High(input);
-                        Pack.UInt64_To_BE_High(x1, output[..input.Length]);
-                    }
-                }
-                else
-                {
-                    x0 ^= PAD(input.Length);
-                    if (!input.IsEmpty)
-                    {
-                        x0 ^= Pack.BE_To_UInt64_High(input);
-                        Pack.UInt64_To_BE_High(x0, output[..input.Length]);
-                    }
                 }
             }
             else
             {
-                /* final ciphertext block */
-                if (ASCON_AEAD_RATE == 16 && input.Length >= 8)
+                x0 ^= PAD(input.Length);
+                if (!input.IsEmpty)
                 {
-                    ulong cx = Pack.BE_To_UInt64(input);
+                    ulong cx = Pack.BE_To_UInt64_High(input);
+                    x0 ^= cx;
+                    Pack.UInt64_To_BE_High(x0, output[..input.Length]);
+                    x0 &= ulong.MaxValue >> (input.Length << 3);
                     x0 ^= cx;
-                    Pack.UInt64_To_BE(x0, output);
-                    x0 = cx;
-                    input = input[8..];
-                    output = output[8..];
-                    x1 ^= PAD(input.Length);
-                    if (!input.IsEmpty)
-                    {
-                        cx = Pack.BE_To_UInt64_High(input);
-                        x1 ^= cx;
-                        Pack.UInt64_To_BE_High(x1, output[..input.Length]);
-                        x1 &= ulong.MaxValue >> (input.Length << 3);
-                        x1 ^= cx;
-                    }
-                }
-                else
-                {
-                    x0 ^= PAD(input.Length);
-                    if (!input.IsEmpty)
-                    {
-                        ulong cx = Pack.BE_To_UInt64_High(input);
-                        x0 ^= cx;
-                        Pack.UInt64_To_BE_High(x0, output[..input.Length]);
-                        x0 &= ulong.MaxValue >> (input.Length << 3);
-                        x0 ^= cx;
-                    }
                 }
             }
-            /* finalize */
-            switch (asconParameters)
-            {
-            case AsconParameters.ascon128:
-                x1 ^= K1;
-                x2 ^= K2;
-                break;
-            case AsconParameters.ascon128a:
-                x2 ^= K1;
-                x3 ^= K2;
-                break;
-            case AsconParameters.ascon80pq:
-                x1 ^= (K0 << 32 | K1 >> 32);
-                x2 ^= (K1 << 32 | K2 >> 32);
-                x3 ^=  K2 << 32;
-                break;
-            }
-            P(12);
-            x3 ^= K1;
-            x4 ^= K2;
+
+            FinishData(State.DecFinal);
         }
-#else
-        private int ProcessBytes(bool forEncryption, byte[] output, int outOff)
+
+        private void ProcessFinalEncrypt(ReadOnlySpan<byte> input, Span<byte> output)
         {
-            int msgLen = Convert.ToInt32(message.Length);
-            int outLen = 0;
-            if (forEncryption)
+            Debug.Assert(input.Length < ASCON_AEAD_RATE);
+
+            if (input.Length >= 8) // ASCON_AEAD_RATE == 16 is implied
             {
-                if (msgLen >= ASCON_AEAD_RATE)
+                x0 ^= Pack.BE_To_UInt64(input);
+                Pack.UInt64_To_BE(x0, output);
+                input = input[8..];
+                output = output[8..];
+                x1 ^= PAD(input.Length);
+                if (!input.IsEmpty)
                 {
-                    byte[] input = message.GetBuffer();
-                    outLen = (msgLen / ASCON_AEAD_RATE) * ASCON_AEAD_RATE;
-                    Check.OutputLength(output, outOff, outLen, "output buffer is too short");
-                    ascon_encrypt(output, outOff, input, 0, outLen);
-                    message.SetLength(0);
-                    message.Write(input, outLen, msgLen - outLen);
+                    x1 ^= Pack.BE_To_UInt64_High(input);
+                    Pack.UInt64_To_BE_High(x1, output[..input.Length]);
                 }
             }
             else
             {
-                if (msgLen - CRYPTO_ABYTES >= ASCON_AEAD_RATE)
+                x0 ^= PAD(input.Length);
+                if (!input.IsEmpty)
                 {
-                    byte[] input = message.GetBuffer();
-                    outLen = ((msgLen - CRYPTO_ABYTES) / ASCON_AEAD_RATE) * ASCON_AEAD_RATE;
-                    Check.OutputLength(output, outOff, outLen, "output buffer is too short");
-                    ascon_decrypt(output, outOff, input, 0, outLen);
-                    message.SetLength(0);
-                    message.Write(input, outLen, msgLen - outLen);
+                    x0 ^= Pack.BE_To_UInt64_High(input);
+                    Pack.UInt64_To_BE_High(x0, output[..input.Length]);
                 }
             }
-            return outLen;
-        }
 
-        private void ProcessBufferAad(byte[] aad, int aadOff)
+            FinishData(State.EncFinal);
+        }
+#else
+        private void ProcessBufferAad(byte[] buffer, int bufOff)
         {
-            Debug.Assert(aad.Length - ASCON_AEAD_RATE >= aadOff);
+            Debug.Assert(bufOff <= buffer.Length - ASCON_AEAD_RATE);
+
+            x0 ^= Pack.BE_To_UInt64(buffer, bufOff);
 
-            x0 ^= Pack.BE_To_UInt64(aad, aadOff);
             if (ASCON_AEAD_RATE == 16)
             {
-                x1 ^= Pack.BE_To_UInt64(aad, aadOff + 8);
+                x1 ^= Pack.BE_To_UInt64(buffer, bufOff + 8);
             }
+
             P(nr);
         }
 
-        private void ascon_encrypt(byte[] c, int cOff, byte[] m, int mOff, int mlen)
+        private void ProcessBufferDecrypt(byte[] buffer, int bufOff, byte[] output, int outOff)
         {
-            /* full plaintext blocks */
-            while (mlen >= ASCON_AEAD_RATE)
+            Debug.Assert(bufOff <= buffer.Length - ASCON_AEAD_RATE);
+
+            Check.OutputLength(output, outOff, ASCON_AEAD_RATE, "output buffer too short");
+
+            ulong t0 = Pack.BE_To_UInt64(buffer, bufOff);
+            Pack.UInt64_To_BE(x0 ^ t0, output, outOff);
+            x0 = t0;
+
+            if (ASCON_AEAD_RATE == 16)
             {
-                x0 ^= Pack.BE_To_UInt64(m, mOff);
-                Pack.UInt64_To_BE(x0, c, cOff);
-                if (ASCON_AEAD_RATE == 16)
-                {
-                    x1 ^= Pack.BE_To_UInt64(m, mOff + 8);
-                    Pack.UInt64_To_BE(x1, c, cOff + 8);
-                }
-                P(nr);
-                mOff += ASCON_AEAD_RATE;
-                cOff += ASCON_AEAD_RATE;
-                mlen -= ASCON_AEAD_RATE;
+                ulong t1 = Pack.BE_To_UInt64(buffer, bufOff + 8);
+                Pack.UInt64_To_BE(x1 ^ t1, output, outOff + 8);
+                x1 = t1;
             }
+
+            P(nr);
         }
 
-        private void ascon_decrypt(byte[] m, int mOff, byte[] c, int cOff, int clen)
+        private void ProcessBufferEncrypt(byte[] buffer, int bufOff, byte[] output, int outOff)
         {
-            /* full ciphertext blocks */
-            while (clen >= ASCON_AEAD_RATE)
+            Debug.Assert(bufOff <= buffer.Length - ASCON_AEAD_RATE);
+
+            Check.OutputLength(output, outOff, ASCON_AEAD_RATE, "output buffer too short");
+
+            x0 ^= Pack.BE_To_UInt64(buffer, bufOff);
+            Pack.UInt64_To_BE(x0, output, outOff);
+
+            if (ASCON_AEAD_RATE == 16)
             {
-                ulong cx = Pack.BE_To_UInt64(c, cOff);
-                x0 ^= cx;
-                Pack.UInt64_To_BE(x0, m, mOff);
-                x0 = cx;
-                if (ASCON_AEAD_RATE == 16)
-                {
-                    cx = Pack.BE_To_UInt64(c, cOff + 8);
-                    x1 ^= cx;
-                    Pack.UInt64_To_BE(x1, m, mOff + 8);
-                    x1 = cx;
-                }
-                P(nr);
-                mOff += ASCON_AEAD_RATE;
-                cOff += ASCON_AEAD_RATE;
-                clen -= ASCON_AEAD_RATE;
+                x1 ^= Pack.BE_To_UInt64(buffer, bufOff + 8);
+                Pack.UInt64_To_BE(x1, output, outOff + 8);
             }
+
+            P(nr);
         }
 
-        private void ascon_final(bool forEncryption, byte[] c, int cOff, byte[] m, int mOff, int mlen)
+        private void ProcessFinalDecrypt(byte[] input, int inOff, int inLen, byte[] output, int outOff)
         {
-            if (forEncryption)
+            Debug.Assert(inLen < ASCON_AEAD_RATE);
+
+            if (inLen >= 8) // ASCON_AEAD_RATE == 16 is implied
             {
-                /* final plaintext block */
-                if (ASCON_AEAD_RATE == 16 && mlen >= 8)
+                ulong c0 = Pack.BE_To_UInt64(input, inOff);
+                x0 ^= c0;
+                Pack.UInt64_To_BE(x0, output, outOff);
+                x0 = c0;
+                inOff += 8;
+                outOff += 8;
+                inLen -= 8;
+                x1 ^= PAD(inLen);
+                if (inLen != 0)
                 {
-                    x0 ^= Pack.BE_To_UInt64(m, mOff);
-                    Pack.UInt64_To_BE(x0, c, cOff);
-                    mOff += 8;
-                    cOff += 8;
-                    mlen -= 8;
-                    x1 ^= PAD(mlen);
-                    if (mlen != 0)
-                    {
-                        x1 ^= Pack.BE_To_UInt64_High(m, mOff, mlen);
-                        Pack.UInt64_To_BE_High(x1, c, cOff, mlen);
-                    }
-                }
-                else
-                {
-                    x0 ^= PAD(mlen);
-                    if (mlen != 0)
-                    {
-                        x0 ^= Pack.BE_To_UInt64_High(m, mOff, mlen);
-                        Pack.UInt64_To_BE_High(x0, c, cOff, mlen);
-                    }
+                    ulong c1 = Pack.BE_To_UInt64_High(input, inOff, inLen);
+                    x1 ^= c1;
+                    Pack.UInt64_To_BE_High(x1, output, outOff, inLen);
+                    x1 &= ulong.MaxValue >> (inLen << 3);
+                    x1 ^= c1;
                 }
             }
             else
             {
-                /* final ciphertext block */
-                if (ASCON_AEAD_RATE == 16 && mlen >= 8)
+                x0 ^= PAD(inLen);
+                if (inLen != 0)
                 {
-                    ulong cx = Pack.BE_To_UInt64(m, mOff);
-                    x0 ^= cx;
-                    Pack.UInt64_To_BE(x0, c, cOff);
-                    x0 = cx;
-                    mOff += 8;
-                    cOff += 8;
-                    mlen -= 8;
-                    x1 ^= PAD(mlen);
-                    if (mlen != 0)
-                    {
-                        cx = Pack.BE_To_UInt64_High(m, mOff, mlen);
-                        x1 ^= cx;
-                        Pack.UInt64_To_BE_High(x1, c, cOff, mlen);
-                        x1 &= ulong.MaxValue >> (mlen << 3);
-                        x1 ^= cx;
-                    }
+                    ulong c0 = Pack.BE_To_UInt64_High(input, inOff, inLen);
+                    x0 ^= c0;
+                    Pack.UInt64_To_BE_High(x0, output, outOff, inLen);
+                    x0 &= ulong.MaxValue >> (inLen << 3);
+                    x0 ^= c0;
                 }
-                else
+            }
+
+            FinishData(State.DecFinal);
+        }
+
+        private void ProcessFinalEncrypt(byte[] input, int inOff, int inLen, byte[] output, int outOff)
+        {
+            Debug.Assert(inLen < ASCON_AEAD_RATE);
+
+            if (inLen >= 8) // ASCON_AEAD_RATE == 16 is implied
+            {
+                x0 ^= Pack.BE_To_UInt64(input, inOff);
+                Pack.UInt64_To_BE(x0, output, outOff);
+                inOff += 8;
+                outOff += 8;
+                inLen -= 8;
+                x1 ^= PAD(inLen);
+                if (inLen != 0)
                 {
-                    x0 ^= PAD(mlen);
-                    if (mlen != 0)
-                    {
-                        ulong cx = Pack.BE_To_UInt64_High(m, mOff, mlen);
-                        x0 ^= cx;
-                        Pack.UInt64_To_BE_High(x0, c, cOff, mlen);
-                        x0 &= ulong.MaxValue >> (mlen << 3);
-                        x0 ^= cx;
-                    }
+                    x1 ^= Pack.BE_To_UInt64_High(input, inOff, inLen);
+                    Pack.UInt64_To_BE_High(x1, output, outOff, inLen);
                 }
             }
-            /* finalize */
-            switch (asconParameters)
+            else
             {
-            case AsconParameters.ascon128:
-                x1 ^= K1;
-                x2 ^= K2;
-                break;
-            case AsconParameters.ascon128a:
-                x2 ^= K1;
-                x3 ^= K2;
-                break;
-            case AsconParameters.ascon80pq:
-                x1 ^= (K0 << 32 | K1 >> 32);
-                x2 ^= (K1 << 32 | K2 >> 32);
-                x3 ^=  K2 << 32;
-                break;
+                x0 ^= PAD(inLen);
+                if (inLen != 0)
+                {
+                    x0 ^= Pack.BE_To_UInt64_High(input, inOff, inLen);
+                    Pack.UInt64_To_BE_High(x0, output, outOff, inLen);
+                }
             }
-            P(12);
-            x3 ^= K1;
-            x4 ^= K2;
+
+            FinishData(State.EncFinal);
         }
 #endif
 
@@ -904,8 +1008,6 @@ namespace Org.BouncyCastle.Crypto.Engines
                 mac = null;
             }
 
-            message.SetLength(0);
-
             Arrays.Clear(m_buf);
             m_bufPos = 0;
 
@@ -929,6 +1031,15 @@ namespace Org.BouncyCastle.Crypto.Engines
             }
 
             ascon_aeadinit();
+
+            if (initialAssociatedText != null)
+            {
+#if NETCOREAPP2_1_OR_GREATER || NETSTANDARD2_1_OR_GREATER
+                ProcessAadBytes(initialAssociatedText);
+#else
+                ProcessAadBytes(initialAssociatedText, 0, initialAssociatedText.Length);
+#endif
+            }
         }
 
         private static ulong PAD(int i)
diff --git a/crypto/test/src/crypto/test/AsconTest.cs b/crypto/test/src/crypto/test/AsconTest.cs
index 59e5aaa6d..5e426bbfe 100644
--- a/crypto/test/src/crypto/test/AsconTest.cs
+++ b/crypto/test/src/crypto/test/AsconTest.cs
@@ -19,6 +19,60 @@ namespace Org.BouncyCastle.Crypto.Tests
     {
         public override string Name => "ASCON";
 
+        [Test, Explicit]
+        public void BenchAuth80pq()
+        {
+            var parameters = new AeadParameters(new KeyParameter(new byte[20]), 128, new byte[16], null);
+            var engine = new AsconEngine(AsconEngine.AsconParameters.ascon80pq);
+            engine.Init(false, parameters);
+
+            byte[] data = new byte[1024];
+            for (int i = 0; i < 1024 * 1024; ++i)
+            {
+#if NET6_0_OR_GREATER
+                engine.ProcessAadBytes(data.AsSpan(0, 1024));
+#else
+                engine.ProcessAadBytes(data, 0, 1024);
+#endif
+            }
+        }
+
+        [Test, Explicit]
+        public void BenchDecrypt80pq()
+        {
+            var parameters = new AeadParameters(new KeyParameter(new byte[20]), 128, new byte[16], null);
+            var engine = new AsconEngine(AsconEngine.AsconParameters.ascon80pq);
+            engine.Init(false, parameters);
+
+            byte[] data = new byte[1024];
+            for (int i = 0; i < 1024 * 1024; ++i)
+            {
+#if NET6_0_OR_GREATER
+                engine.ProcessBytes(data.AsSpan(0, 1024), data);
+#else
+                engine.ProcessBytes(data, 0, 1024, data, 0);
+#endif
+            }
+        }
+
+        [Test, Explicit]
+        public void BenchEncrypt80pq()
+        {
+            var parameters = new AeadParameters(new KeyParameter(new byte[20]), 128, new byte[16], null);
+            var engine = new AsconEngine(AsconEngine.AsconParameters.ascon80pq);
+            engine.Init(true, parameters);
+
+            byte[] data = new byte[engine.GetUpdateOutputSize(1024)];
+            for (int i = 0; i < 1024 * 1024; ++i)
+            {
+#if NET6_0_OR_GREATER
+                engine.ProcessBytes(data.AsSpan(0, 1024), data);
+#else
+                engine.ProcessBytes(data, 0, 1024, data, 0);
+#endif
+            }
+        }
+
         [Test]
         public override void PerformTest()
         {