Chaskey cipher

Chaskey is a lightweight 128-bit encryption algorithm (please follow this link for details http://mouha.be/chaskey/)
This project provides C++ and JavaScript implementations of Chaskey algorithm with two modes of operations: CBC and MAC.
Design of both C++ and JavaScript versions follows high-granular decomposition on the following abstractions:

• Block – a block of bits stored as an array of integers (32x4)
• Formatter – formats input string of bits as blocks, either buffering them or with zero-copy direct access
• Cipher – implements forward and reverse transformations of the underlying block
• Cbc – Cipher Block Chaining mode of operation
• Mac – Message Authentication mode of operation
• Cloc – Confidentiality and Authentication mode of operation, see https://eprint.iacr.org/2014/157.pdf

In C++ primitives are implemented as templates, so that a cipher instance ultimately appears as Cbc<Cipher<N>,Formatter> or Mac<Cipher<N>,Formatter>, where N is a number of transformation rounds, set equal to 8 in Chaskey8 class.
In JavaScript same primitives are implemented as objects . Online demo is available on http://hutorny.in.ua/chaskey/

Usage

C++

#inlcude <chaskey.hpp>

// MAC
crypto::chaskey::Cipher8::Mac mac;  // instantiate a cipher in MAC mode 
mac.set(key);                       // set the key
mac.init();                         // init  cipher if instance is reused
mac.update(message,length,false);   // make as many calls as needed with any message length 
mac.update(message,length,true);    // make one final call 
mac.write(ouput);                   // write signature to the output or     
mac.verify(tag);                    // verify against a signature

// CBC
crypto::chaskey::Cipher8::Cbc cbc;  // instantiate a cipher in CBC mode
cbc.set(key);                       // set the key
cbc.init(nonce, strlen(nonce));     // init  cipher with a nonce 
while(in) {                         
    char msg[chunk_size];            
    size_t len = in.read(msg,sizeof(msg)).gcount();         // read input by chunks
    cbc.encrypt(out, (const uint8_t*)msg, len, in.eof());   // and encrypt or
    //cbc.encrypt(out, (const uint8_t*)msg, len, in.eof()); // decrypt data
}

// CLOC
crypto::chaskey::Cipher8::Cloc cloc;    // instantiate a cipher in CLOC mode
cloc.set(key);                          // set the key
cloc.init();                            // inity before  reusing instance
cloc.update(ad, length, false);         // feed AD by chunks
cloc.update(ad, length, true);          // feed last AD chunk
cloc.nonce(nonce, length);              // apply noce
cloc.encrypt(out, datachunk, false);    // feed data by chunks
cloc.encrypt(out, lastdatachunk, true); // feed last data chunk

JavaScript

// MAC
var mac = new ChaskeyCipher.Mac();  // instantiate a cipher in MAC mode
mac.set(key);                       // set the key
var cif = mac.sign(message);        // sign the message

// CBC
var cbc = new ChaskeyCipher.Cbc();  // instantiate a cipher in CBC mode
cbc.set(key);                       // set the key
cbc.init(nonce);                    // init  cipher with a nonce
var cif = cbc.encrypt(message);     // encrypt the message

Perfromace

Table below lists benchmarking results for 1M operations on a 32-bytes-long message.

Values are give in ms, All binaries were compiled with gcc option -O3 -- Optimize most.
^*NodeMCU, MSP430 and Arduino Mega results are extrapolated from tests with 100K operations

Next table shows same results in normilized form - clock cycles per one operation

State size, including the key, dervied keys and formatter's buffer, bytes: