diff --git a/.gitignore b/.gitignore
index c13fb713..11232be7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -73,6 +73,7 @@
 /src/fill
 /src/fill2
 /src/fs_perms
+/src/fscrypt-crypt-util
 /src/fssum
 /src/fstest
 /src/fsync-err
diff --git a/src/Makefile b/src/Makefile
index 4057d7b3..9d3d2529 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -27,7 +27,8 @@ LINUX_TARGETS = xfsctl bstat t_mtab getdevicesize preallo_rw_pattern_reader \
 	renameat2 t_getcwd e4compact test-nextquota punch-alternating \
 	attr-list-by-handle-cursor-test listxattr dio-interleaved t_dir_type \
 	dio-invalidate-cache stat_test t_encrypted_d_revalidate \
-	attr_replace_test swapon mkswap t_attr_corruption t_open_tmpfiles
+	attr_replace_test swapon mkswap t_attr_corruption t_open_tmpfiles \
+	fscrypt-crypt-util
 
 SUBDIRS = log-writes perf
 
diff --git a/src/fscrypt-crypt-util.c b/src/fscrypt-crypt-util.c
new file mode 100644
index 00000000..715e2bf2
--- /dev/null
+++ b/src/fscrypt-crypt-util.c
@@ -0,0 +1,1645 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * fscrypt-crypt-util.c - utility for verifying fscrypt-encrypted data
+ *
+ * Copyright 2019 Google LLC
+ */
+
+/*
+ * This program implements all crypto algorithms supported by fscrypt (a.k.a.
+ * ext4, f2fs, and ubifs encryption), for the purpose of verifying the
+ * correctness of the ciphertext stored on-disk.  See usage() below.
+ *
+ * All algorithms are implemented in portable C code to avoid depending on
+ * libcrypto (OpenSSL), and because some fscrypt-supported algorithms aren't
+ * available in libcrypto anyway (e.g. Adiantum).  For simplicity, all crypto
+ * code here tries to follow the mathematical definitions directly, without
+ * optimizing for performance or worrying about following security best
+ * practices such as mitigating side-channel attacks.  So, only use this program
+ * for testing!
+ */
+
+#include <asm/byteorder.h>
+#include <errno.h>
+#include <getopt.h>
+#include <limits.h>
+#include <linux/types.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#define PROGRAM_NAME "fscrypt-crypt-util"
+
+/*
+ * Define to enable the tests of the crypto code in this file.  If enabled, you
+ * must link this program with OpenSSL (-lcrypto) v1.1.0 or later, and your
+ * kernel needs CONFIG_CRYPTO_USER_API_SKCIPHER=y and CONFIG_CRYPTO_ADIANTUM=y.
+ */
+#undef ENABLE_ALG_TESTS
+
+#define NUM_ALG_TEST_ITERATIONS	10000
+
+static void usage(FILE *fp)
+{
+	fputs(
+"Usage: " PROGRAM_NAME " [OPTION]... CIPHER MASTER_KEY\n"
+"\n"
+"Utility for verifying fscrypt-encrypted data.  This program encrypts\n"
+"(or decrypts) the data on stdin using the given CIPHER with the given\n"
+"MASTER_KEY (or a key derived from it, if a KDF is specified), and writes the\n"
+"resulting ciphertext (or plaintext) to stdout.\n"
+"\n"
+"CIPHER can be AES-256-XTS, AES-256-CTS-CBC, AES-128-CBC-ESSIV, AES-128-CTS-CBC,\n"
+"or Adiantum.  MASTER_KEY must be a hex string long enough for the cipher.\n"
+"\n"
+"WARNING: this program is only meant for testing, not for \"real\" use!\n"
+"\n"
+"Options:\n"
+"  --block-size=BLOCK_SIZE     Encrypt each BLOCK_SIZE bytes independently.\n"
+"                                Default: 4096 bytes\n"
+"  --decrypt                   Decrypt instead of encrypt\n"
+"  --file-nonce=NONCE          File's nonce as a 32-character hex string\n"
+"  --kdf=KDF                   Key derivation function to use: AES-128-ECB\n"
+"                                or none.  Default: none\n"
+"  --help                      Show this help\n"
+"  --padding=PADDING           If last block is partial, zero-pad it to next\n"
+"                                PADDING-byte boundary.  Default: BLOCK_SIZE\n"
+	, fp);
+}
+
+/*----------------------------------------------------------------------------*
+ *                                 Utilities                                  *
+ *----------------------------------------------------------------------------*/
+
+#define ARRAY_SIZE(A)		(sizeof(A) / sizeof((A)[0]))
+#define MIN(x, y)		((x) < (y) ? (x) : (y))
+#define MAX(x, y)		((x) > (y) ? (x) : (y))
+#define ROUND_DOWN(x, y)	((x) & ~((y) - 1))
+#define ROUND_UP(x, y)		(((x) + (y) - 1) & ~((y) - 1))
+#define DIV_ROUND_UP(n, d)	(((n) + (d) - 1) / (d))
+#define STATIC_ASSERT(e)	((void)sizeof(char[1 - 2*!(e)]))
+
+typedef __u8			u8;
+typedef __u16			u16;
+typedef __u32			u32;
+typedef __u64			u64;
+
+#define cpu_to_le32		__cpu_to_le32
+#define cpu_to_be32		__cpu_to_be32
+#define cpu_to_le64		__cpu_to_le64
+#define cpu_to_be64		__cpu_to_be64
+#define le32_to_cpu		__le32_to_cpu
+#define be32_to_cpu		__be32_to_cpu
+#define le64_to_cpu		__le64_to_cpu
+#define be64_to_cpu		__be64_to_cpu
+
+#define DEFINE_UNALIGNED_ACCESS_HELPERS(type, native_type)	\
+static inline native_type __attribute__((unused))		\
+get_unaligned_##type(const void *p)				\
+{								\
+	__##type x;						\
+								\
+	memcpy(&x, p, sizeof(x));				\
+	return type##_to_cpu(x);				\
+}								\
+								\
+static inline void __attribute__((unused))			\
+put_unaligned_##type(native_type v, void *p)			\
+{								\
+	__##type x = cpu_to_##type(v);				\
+								\
+	memcpy(p, &x, sizeof(x));				\
+}
+
+DEFINE_UNALIGNED_ACCESS_HELPERS(le32, u32)
+DEFINE_UNALIGNED_ACCESS_HELPERS(be32, u32)
+DEFINE_UNALIGNED_ACCESS_HELPERS(le64, u64)
+DEFINE_UNALIGNED_ACCESS_HELPERS(be64, u64)
+
+static inline bool is_power_of_2(unsigned long v)
+{
+	return v != 0 && (v & (v - 1)) == 0;
+}
+
+static inline u32 rol32(u32 v, int n)
+{
+	return (v << n) | (v >> (32 - n));
+}
+
+static inline u32 ror32(u32 v, int n)
+{
+	return (v >> n) | (v << (32 - n));
+}
+
+static inline u64 ror64(u64 v, int n)
+{
+	return (v >> n) | (v << (64 - n));
+}
+
+static inline void xor(u8 *res, const u8 *a, const u8 *b, size_t count)
+{
+	while (count--)
+		*res++ = *a++ ^ *b++;
+}
+
+static void __attribute__((noreturn, format(printf, 2, 3)))
+do_die(int err, const char *format, ...)
+{
+	va_list va;
+
+	va_start(va, format);
+	fputs("[" PROGRAM_NAME "] ERROR: ", stderr);
+	vfprintf(stderr, format, va);
+	if (err)
+		fprintf(stderr, ": %s", strerror(errno));
+	putc('\n', stderr);
+	va_end(va);
+	exit(1);
+}
+
+#define die(format, ...)	do_die(0,     (format), ##__VA_ARGS__)
+#define die_errno(format, ...)	do_die(errno, (format), ##__VA_ARGS__)
+
+static __attribute__((noreturn)) void
+assertion_failed(const char *expr, const char *file, int line)
+{
+	die("Assertion failed: %s at %s:%d", expr, file, line);
+}
+
+#define ASSERT(e) ({ if (!(e)) assertion_failed(#e, __FILE__, __LINE__); })
+
+static void *xmalloc(size_t size)
+{
+	void *p = malloc(size);
+
+	ASSERT(p != NULL);
+	return p;
+}
+
+static int hexchar2bin(char c)
+{
+	if (c >= 'a' && c <= 'f')
+		return 10 + c - 'a';
+	if (c >= 'A' && c <= 'F')
+		return 10 + c - 'A';
+	if (c >= '0' && c <= '9')
+		return c - '0';
+	return -1;
+}
+
+static int hex2bin(const char *hex, u8 *bin, int max_bin_size)
+{
+	size_t len = strlen(hex);
+	size_t i;
+
+	if (len & 1)
+		return -1;
+	len /= 2;
+	if (len > max_bin_size)
+		return -1;
+
+	for (i = 0; i < len; i++) {
+		int high = hexchar2bin(hex[2 * i]);
+		int low = hexchar2bin(hex[2 * i + 1]);
+
+		if (high < 0 || low < 0)
+			return -1;
+		bin[i] = (high << 4) | low;
+	}
+	return len;
+}
+
+static size_t xread(int fd, void *buf, size_t count)
+{
+	const size_t orig_count = count;
+
+	while (count) {
+		ssize_t res = read(fd, buf, count);
+
+		if (res < 0)
+			die_errno("read error");
+		if (res == 0)
+			break;
+		buf += res;
+		count -= res;
+	}
+	return orig_count - count;
+}
+
+static void full_write(int fd, const void *buf, size_t count)
+{
+	while (count) {
+		ssize_t res = write(fd, buf, count);
+
+		if (res < 0)
+			die_errno("write error");
+		buf += res;
+		count -= res;
+	}
+}
+
+#ifdef ENABLE_ALG_TESTS
+static void rand_bytes(u8 *buf, size_t count)
+{
+	while (count--)
+		*buf++ = rand();
+}
+#endif
+
+/*----------------------------------------------------------------------------*
+ *                          Finite field arithmetic                           *
+ *----------------------------------------------------------------------------*/
+
+/* Multiply a GF(2^8) element by the polynomial 'x' */
+static inline u8 gf2_8_mul_x(u8 b)
+{
+	return (b << 1) ^ ((b & 0x80) ? 0x1B : 0);
+}
+
+/* Multiply four packed GF(2^8) elements by the polynomial 'x' */
+static inline u32 gf2_8_mul_x_4way(u32 w)
+{
+	return ((w & 0x7F7F7F7F) << 1) ^ (((w & 0x80808080) >> 7) * 0x1B);
+}
+
+/* Element of GF(2^128) */
+typedef struct {
+	__le64 lo;
+	__le64 hi;
+} ble128;
+
+/* Multiply a GF(2^128) element by the polynomial 'x' */
+static inline void gf2_128_mul_x(ble128 *t)
+{
+	u64 lo = le64_to_cpu(t->lo);
+	u64 hi = le64_to_cpu(t->hi);
+
+	t->hi = cpu_to_le64((hi << 1) | (lo >> 63));
+	t->lo = cpu_to_le64((lo << 1) ^ ((hi & (1ULL << 63)) ? 0x87 : 0));
+}
+
+/*----------------------------------------------------------------------------*
+ *                             Group arithmetic                               *
+ *----------------------------------------------------------------------------*/
+
+/* Element of Z/(2^{128}Z)  (a.k.a. the integers modulo 2^128) */
+typedef struct {
+	__le64 lo;
+	__le64 hi;
+} le128;
+
+static inline void le128_add(le128 *res, const le128 *a, const le128 *b)
+{
+	u64 a_lo = le64_to_cpu(a->lo);
+	u64 b_lo = le64_to_cpu(b->lo);
+
+	res->lo = cpu_to_le64(a_lo + b_lo);
+	res->hi = cpu_to_le64(le64_to_cpu(a->hi) + le64_to_cpu(b->hi) +
+			      (a_lo + b_lo < a_lo));
+}
+
+static inline void le128_sub(le128 *res, const le128 *a, const le128 *b)
+{
+	u64 a_lo = le64_to_cpu(a->lo);
+	u64 b_lo = le64_to_cpu(b->lo);
+
+	res->lo = cpu_to_le64(a_lo - b_lo);
+	res->hi = cpu_to_le64(le64_to_cpu(a->hi) - le64_to_cpu(b->hi) -
+			      (a_lo - b_lo > a_lo));
+}
+
+/*----------------------------------------------------------------------------*
+ *                              AES block cipher                              *
+ *----------------------------------------------------------------------------*/
+
+/*
+ * Reference: "FIPS 197, Advanced Encryption Standard"
+ *	https://nvlpubs.nist.gov/nistpubs/fips/nist.fips.197.pdf
+ */
+
+#define AES_BLOCK_SIZE		16
+#define AES_128_KEY_SIZE	16
+#define AES_192_KEY_SIZE	24
+#define AES_256_KEY_SIZE	32
+
+static inline void AddRoundKey(u32 state[4], const u32 *rk)
+{
+	int i;
+
+	for (i = 0; i < 4; i++)
+		state[i] ^= rk[i];
+}
+
+static const u8 aes_sbox[256] = {
+	0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b,
+	0xfe, 0xd7, 0xab, 0x76, 0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0,
+	0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0, 0xb7, 0xfd, 0x93, 0x26,
+	0x36, 0x3f, 0xf7, 0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15,
+	0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe2,
+	0xeb, 0x27, 0xb2, 0x75, 0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0,
+	0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84, 0x53, 0xd1, 0x00, 0xed,
+	0x20, 0xfc, 0xb1, 0x5b, 0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf,
+	0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, 0x45, 0xf9, 0x02, 0x7f,
+	0x50, 0x3c, 0x9f, 0xa8, 0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5,
+	0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2, 0xcd, 0x0c, 0x13, 0xec,
+	0x5f, 0x97, 0x44, 0x17, 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73,
+	0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88, 0x46, 0xee, 0xb8, 0x14,
+	0xde, 0x5e, 0x0b, 0xdb, 0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c,
+	0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79, 0xe7, 0xc8, 0x37, 0x6d,
+	0x8d, 0xd5, 0x4e, 0xa9, 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08,
+	0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6, 0xe8, 0xdd, 0x74, 0x1f,
+	0x4b, 0xbd, 0x8b, 0x8a, 0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e,
+	0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e, 0xe1, 0xf8, 0x98, 0x11,
+	0x69, 0xd9, 0x8e, 0x94, 0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf,
+	0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 0x41, 0x99, 0x2d, 0x0f,
+	0xb0, 0x54, 0xbb, 0x16,
+};
+
+static u8 aes_inverse_sbox[256];
+
+static void aes_init(void)
+{
+	int i;
+
+	for (i = 0; i < 256; i++)
+		aes_inverse_sbox[aes_sbox[i]] = i;
+}
+
+static inline u32 DoSubWord(u32 w, const u8 sbox[256])
+{
+	return ((u32)sbox[(u8)(w >> 24)] << 24) |
+	       ((u32)sbox[(u8)(w >> 16)] << 16) |
+	       ((u32)sbox[(u8)(w >>  8)] <<  8) |
+	       ((u32)sbox[(u8)(w >>  0)] <<  0);
+}
+
+static inline u32 SubWord(u32 w)
+{
+	return DoSubWord(w, aes_sbox);
+}
+
+static inline u32 InvSubWord(u32 w)
+{
+	return DoSubWord(w, aes_inverse_sbox);
+}
+
+static inline void SubBytes(u32 state[4])
+{
+	int i;
+
+	for (i = 0; i < 4; i++)
+		state[i] = SubWord(state[i]);
+}
+
+static inline void InvSubBytes(u32 state[4])
+{
+	int i;
+
+	for (i = 0; i < 4; i++)
+		state[i] = InvSubWord(state[i]);
+}
+
+static inline void DoShiftRows(u32 state[4], int direction)
+{
+	u32 newstate[4];
+	int i;
+
+	for (i = 0; i < 4; i++)
+		newstate[i] = (state[(i + direction*0) & 3] & 0xff) |
+			      (state[(i + direction*1) & 3] & 0xff00) |
+			      (state[(i + direction*2) & 3] & 0xff0000) |
+			      (state[(i + direction*3) & 3] & 0xff000000);
+	memcpy(state, newstate, 16);
+}
+
+static inline void ShiftRows(u32 state[4])
+{
+	DoShiftRows(state, 1);
+}
+
+static inline void InvShiftRows(u32 state[4])
+{
+	DoShiftRows(state, -1);
+}
+
+/*
+ * Mix one column by doing the following matrix multiplication in GF(2^8):
+ *
+ *     | 2 3 1 1 |   | w[0] |
+ *     | 1 2 3 1 |   | w[1] |
+ *     | 1 1 2 3 | x | w[2] |
+ *     | 3 1 1 2 |   | w[3] |
+ *
+ * a.k.a. w[i] = 2*w[i] + 3*w[(i+1)%4] + w[(i+2)%4] + w[(i+3)%4]
+ */
+static inline u32 MixColumn(u32 w)
+{
+	u32 _2w0_w2 = gf2_8_mul_x_4way(w) ^ ror32(w, 16);
+	u32 _3w1_w3 = ror32(_2w0_w2 ^ w, 8);
+
+	return _2w0_w2 ^ _3w1_w3;
+}
+
+/*
+ *           ( | 5 0 4 0 |   | w[0] | )
+ *          (  | 0 5 0 4 |   | w[1] |  )
+ * MixColumn(  | 4 0 5 0 | x | w[2] |  )
+ *           ( | 0 4 0 5 |   | w[3] | )
+ */
+static inline u32 InvMixColumn(u32 w)
+{
+	u32 _4w = gf2_8_mul_x_4way(gf2_8_mul_x_4way(w));
+
+	return MixColumn(_4w ^ w ^ ror32(_4w, 16));
+}
+
+static inline void MixColumns(u32 state[4])
+{
+	int i;
+
+	for (i = 0; i < 4; i++)
+		state[i] = MixColumn(state[i]);
+}
+
+static inline void InvMixColumns(u32 state[4])
+{
+	int i;
+
+	for (i = 0; i < 4; i++)
+		state[i] = InvMixColumn(state[i]);
+}
+
+struct aes_key {
+	u32 round_keys[15 * 4];
+	int nrounds;
+};
+
+/* Expand an AES key */
+static void aes_setkey(struct aes_key *k, const u8 *key, int keysize)
+{
+	const int N = keysize / 4;
+	u32 * const rk = k->round_keys;
+	u8 rcon = 1;
+	int i;
+
+	ASSERT(keysize == 16 || keysize == 24 || keysize == 32);
+	k->nrounds = 6 + N;
+	for (i = 0; i < 4 * (k->nrounds + 1); i++) {
+		if (i < N) {
+			rk[i] = get_unaligned_le32(&key[i * sizeof(__le32)]);
+		} else if (i % N == 0) {
+			rk[i] = rk[i - N] ^ SubWord(ror32(rk[i - 1], 8)) ^ rcon;
+			rcon = gf2_8_mul_x(rcon);
+		} else if (N > 6 && i % N == 4) {
+			rk[i] = rk[i - N] ^ SubWord(rk[i - 1]);
+		} else {
+			rk[i] = rk[i - N] ^ rk[i - 1];
+		}
+	}
+}
+
+/* Encrypt one 16-byte block with AES */
+static void aes_encrypt(const struct aes_key *k, const u8 src[AES_BLOCK_SIZE],
+			u8 dst[AES_BLOCK_SIZE])
+{
+	u32 state[4];
+	int i;
+
+	for (i = 0; i < 4; i++)
+		state[i] = get_unaligned_le32(&src[i * sizeof(__le32)]);
+
+	AddRoundKey(state, k->round_keys);
+	for (i = 1; i < k->nrounds; i++) {
+		SubBytes(state);
+		ShiftRows(state);
+		MixColumns(state);
+		AddRoundKey(state, &k->round_keys[4 * i]);
+	}
+	SubBytes(state);
+	ShiftRows(state);
+	AddRoundKey(state, &k->round_keys[4 * i]);
+
+	for (i = 0; i < 4; i++)
+		put_unaligned_le32(state[i], &dst[i * sizeof(__le32)]);
+}
+
+/* Decrypt one 16-byte block with AES */
+static void aes_decrypt(const struct aes_key *k, const u8 src[AES_BLOCK_SIZE],
+			u8 dst[AES_BLOCK_SIZE])
+{
+	u32 state[4];
+	int i;
+
+	for (i = 0; i < 4; i++)
+		state[i] = get_unaligned_le32(&src[i * sizeof(__le32)]);
+
+	AddRoundKey(state, &k->round_keys[4 * k->nrounds]);
+	InvShiftRows(state);
+	InvSubBytes(state);
+	for (i = k->nrounds - 1; i >= 1; i--) {
+		AddRoundKey(state, &k->round_keys[4 * i]);
+		InvMixColumns(state);
+		InvShiftRows(state);
+		InvSubBytes(state);
+	}
+	AddRoundKey(state, k->round_keys);
+
+	for (i = 0; i < 4; i++)
+		put_unaligned_le32(state[i], &dst[i * sizeof(__le32)]);
+}
+
+#ifdef ENABLE_ALG_TESTS
+#include <openssl/aes.h>
+static void test_aes_keysize(int keysize)
+{
+	unsigned long num_tests = NUM_ALG_TEST_ITERATIONS;
+
+	while (num_tests--) {
+		struct aes_key k;
+		AES_KEY ref_k;
+		u8 key[AES_256_KEY_SIZE];
+		u8 ptext[AES_BLOCK_SIZE];
+		u8 ctext[AES_BLOCK_SIZE];
+		u8 ref_ctext[AES_BLOCK_SIZE];
+		u8 decrypted[AES_BLOCK_SIZE];
+
+		rand_bytes(key, keysize);
+		rand_bytes(ptext, AES_BLOCK_SIZE);
+
+		aes_setkey(&k, key, keysize);
+		aes_encrypt(&k, ptext, ctext);
+
+		ASSERT(AES_set_encrypt_key(key, keysize*8, &ref_k) == 0);
+		AES_encrypt(ptext, ref_ctext, &ref_k);
+
+		ASSERT(memcmp(ctext, ref_ctext, AES_BLOCK_SIZE) == 0);
+
+		aes_decrypt(&k, ctext, decrypted);
+		ASSERT(memcmp(ptext, decrypted, AES_BLOCK_SIZE) == 0);
+	}
+}
+
+static void test_aes(void)
+{
+	test_aes_keysize(AES_128_KEY_SIZE);
+	test_aes_keysize(AES_192_KEY_SIZE);
+	test_aes_keysize(AES_256_KEY_SIZE);
+}
+#endif /* ENABLE_ALG_TESTS */
+
+/*----------------------------------------------------------------------------*
+ *                                  SHA-256                                   *
+ *----------------------------------------------------------------------------*/
+
+/*
+ * Reference: "FIPS 180-2, Secure Hash Standard"
+ *	https://csrc.nist.gov/csrc/media/publications/fips/180/2/archive/2002-08-01/documents/fips180-2withchangenotice.pdf
+ */
+
+#define SHA256_DIGEST_SIZE	32
+#define SHA256_BLOCK_SIZE	64
+
+#define Ch(x, y, z)	(((x) & (y)) ^ (~(x) & (z)))
+#define Maj(x, y, z)	(((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z)))
+#define Sigma256_0(x)	(ror32((x),  2) ^ ror32((x), 13) ^ ror32((x), 22))
+#define Sigma256_1(x)	(ror32((x),  6) ^ ror32((x), 11) ^ ror32((x), 25))
+#define sigma256_0(x)	(ror32((x),  7) ^ ror32((x), 18) ^ ((x) >>  3))
+#define sigma256_1(x)	(ror32((x), 17) ^ ror32((x), 19) ^ ((x) >> 10))
+
+static const u32 sha256_iv[8] = {
+	0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c,
+	0x1f83d9ab, 0x5be0cd19,
+};
+
+static const u32 sha256_round_constants[64] = {
+	0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1,
+	0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
+	0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786,
+	0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+	0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,
+	0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
+	0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b,
+	0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+	0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a,
+	0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
+	0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+};
+
+/* Compute the SHA-256 digest of the given buffer */
+static void sha256(const u8 *in, size_t inlen, u8 out[SHA256_DIGEST_SIZE])
+{
+	const size_t msglen = ROUND_UP(inlen + 9, SHA256_BLOCK_SIZE);
+	u8 * const msg = xmalloc(msglen);
+	u32 H[8];
+	int i;
+
+	/* super naive way of handling the padding */
+	memcpy(msg, in, inlen);
+	memset(&msg[inlen], 0, msglen - inlen);
+	msg[inlen] = 0x80;
+	put_unaligned_be64((u64)inlen * 8, &msg[msglen - sizeof(__be64)]);
+	in = msg;
+
+	memcpy(H, sha256_iv, sizeof(H));
+	do {
+		u32 a = H[0], b = H[1], c = H[2], d = H[3],
+		    e = H[4], f = H[5], g = H[6], h = H[7];
+		u32 W[64];
+
+		for (i = 0; i < 16; i++)
+			W[i] = get_unaligned_be32(&in[i * sizeof(__be32)]);
+		for (; i < ARRAY_SIZE(W); i++)
+			W[i] = sigma256_1(W[i - 2]) + W[i - 7] +
+			       sigma256_0(W[i - 15]) + W[i - 16];
+		for (i = 0; i < ARRAY_SIZE(W); i++) {
+			u32 T1 = h + Sigma256_1(e) + Ch(e, f, g) +
+				 sha256_round_constants[i] + W[i];
+			u32 T2 = Sigma256_0(a) + Maj(a, b, c);
+
+			h = g; g = f; f = e; e = d + T1;
+			d = c; c = b; b = a; a = T1 + T2;
+		}
+		H[0] += a; H[1] += b; H[2] += c; H[3] += d;
+		H[4] += e; H[5] += f; H[6] += g; H[7] += h;
+	} while ((in += SHA256_BLOCK_SIZE) != &msg[msglen]);
+
+	for (i = 0; i < ARRAY_SIZE(H); i++)
+		put_unaligned_be32(H[i], &out[i * sizeof(__be32)]);
+	free(msg);
+}
+
+#ifdef ENABLE_ALG_TESTS
+#include <openssl/sha.h>
+static void test_sha2(void)
+{
+	unsigned long num_tests = NUM_ALG_TEST_ITERATIONS;
+
+	while (num_tests--) {
+		u8 in[4096];
+		u8 digest[SHA256_DIGEST_SIZE];
+		u8 ref_digest[SHA256_DIGEST_SIZE];
+		const size_t inlen = rand() % (1 + sizeof(in));
+
+		rand_bytes(in, inlen);
+
+		sha256(in, inlen, digest);
+		SHA256(in, inlen, ref_digest);
+		ASSERT(memcmp(digest, ref_digest, SHA256_DIGEST_SIZE) == 0);
+	}
+}
+#endif /* ENABLE_ALG_TESTS */
+
+/*----------------------------------------------------------------------------*
+ *                            AES encryption modes                            *
+ *----------------------------------------------------------------------------*/
+
+static void aes_256_xts_crypt(const u8 key[2 * AES_256_KEY_SIZE],
+			      const u8 iv[AES_BLOCK_SIZE], const u8 *src,
+			      u8 *dst, size_t nbytes, bool decrypting)
+{
+	struct aes_key tweak_key, cipher_key;
+	ble128 t;
+	size_t i;
+
+	ASSERT(nbytes % AES_BLOCK_SIZE == 0);
+	aes_setkey(&cipher_key, key, AES_256_KEY_SIZE);
+	aes_setkey(&tweak_key, &key[AES_256_KEY_SIZE], AES_256_KEY_SIZE);
+	aes_encrypt(&tweak_key, iv, (u8 *)&t);
+	for (i = 0; i < nbytes; i += AES_BLOCK_SIZE) {
+		xor(&dst[i], &src[i], (const u8 *)&t, AES_BLOCK_SIZE);
+		if (decrypting)
+			aes_decrypt(&cipher_key, &dst[i], &dst[i]);
+		else
+			aes_encrypt(&cipher_key, &dst[i], &dst[i]);
+		xor(&dst[i], &dst[i], (const u8 *)&t, AES_BLOCK_SIZE);
+		gf2_128_mul_x(&t);
+	}
+}
+
+static void aes_256_xts_encrypt(const u8 key[2 * AES_256_KEY_SIZE],
+				const u8 iv[AES_BLOCK_SIZE], const u8 *src,
+				u8 *dst, size_t nbytes)
+{
+	aes_256_xts_crypt(key, iv, src, dst, nbytes, false);
+}
+
+static void aes_256_xts_decrypt(const u8 key[2 * AES_256_KEY_SIZE],
+				const u8 iv[AES_BLOCK_SIZE], const u8 *src,
+				u8 *dst, size_t nbytes)
+{
+	aes_256_xts_crypt(key, iv, src, dst, nbytes, true);
+}
+
+#ifdef ENABLE_ALG_TESTS
+#include <openssl/evp.h>
+static void test_aes_256_xts(void)
+{
+	unsigned long num_tests = NUM_ALG_TEST_ITERATIONS;
+	EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new();
+
+	ASSERT(ctx != NULL);
+	while (num_tests--) {
+		u8 key[2 * AES_256_KEY_SIZE];
+		u8 iv[AES_BLOCK_SIZE];
+		u8 ptext[512];
+		u8 actual_ctext[sizeof(ptext)];
+		u8 expected_ctext[sizeof(ptext)];
+		u8 decrypted[sizeof(ptext)];
+		const size_t datalen = ROUND_DOWN(rand() % (1 + sizeof(ptext)),
+						  AES_BLOCK_SIZE);
+		int outl;
+
+		rand_bytes(key, sizeof(key));
+		rand_bytes(iv, sizeof(iv));
+		rand_bytes(ptext, datalen);
+
+		aes_256_xts_encrypt(key, iv, ptext, actual_ctext, datalen);
+		ASSERT(EVP_EncryptInit_ex(ctx, EVP_aes_256_xts(),
+					  NULL, key, iv) > 0);
+		ASSERT(EVP_EncryptUpdate(ctx, expected_ctext, &outl,
+					 ptext, datalen) > 0);
+		ASSERT(outl == datalen);
+		ASSERT(memcmp(actual_ctext, expected_ctext, datalen) == 0);
+
+		aes_256_xts_decrypt(key, iv, actual_ctext, decrypted, datalen);
+		ASSERT(memcmp(ptext, decrypted, datalen) == 0);
+	}
+	EVP_CIPHER_CTX_free(ctx);
+}
+#endif /* ENABLE_ALG_TESTS */
+
+static void aes_cbc_encrypt(const struct aes_key *k,
+			    const u8 iv[AES_BLOCK_SIZE],
+			    const u8 *src, u8 *dst, size_t nbytes)
+{
+	size_t i;
+
+	ASSERT(nbytes % AES_BLOCK_SIZE == 0);
+	for (i = 0; i < nbytes; i += AES_BLOCK_SIZE) {
+		xor(&dst[i], &src[i], (i == 0 ? iv : &dst[i - AES_BLOCK_SIZE]),
+		    AES_BLOCK_SIZE);
+		aes_encrypt(k, &dst[i], &dst[i]);
+	}
+}
+
+static void aes_cbc_decrypt(const struct aes_key *k,
+			    const u8 iv[AES_BLOCK_SIZE],
+			    const u8 *src, u8 *dst, size_t nbytes)
+{
+	size_t i = nbytes;
+
+	ASSERT(i % AES_BLOCK_SIZE == 0);
+	while (i) {
+		i -= AES_BLOCK_SIZE;
+		aes_decrypt(k, &src[i], &dst[i]);
+		xor(&dst[i], &dst[i], (i == 0 ? iv : &src[i - AES_BLOCK_SIZE]),
+		    AES_BLOCK_SIZE);
+	}
+}
+
+static void aes_cts_cbc_encrypt(const u8 *key, int keysize,
+				const u8 iv[AES_BLOCK_SIZE],
+				const u8 *src, u8 *dst, size_t nbytes)
+{
+	const size_t offset = ROUND_DOWN(nbytes - 1, AES_BLOCK_SIZE);
+	const size_t final_bsize = nbytes - offset;
+	struct aes_key k;
+	u8 *pad;
+	u8 buf[AES_BLOCK_SIZE];
+
+	ASSERT(nbytes >= AES_BLOCK_SIZE);
+
+	aes_setkey(&k, key, keysize);
+
+	if (nbytes == AES_BLOCK_SIZE)
+		return aes_cbc_encrypt(&k, iv, src, dst, nbytes);
+
+	aes_cbc_encrypt(&k, iv, src, dst, offset);
+	pad = &dst[offset - AES_BLOCK_SIZE];
+
+	memcpy(buf, pad, AES_BLOCK_SIZE);
+	xor(buf, buf, &src[offset], final_bsize);
+	memcpy(&dst[offset], pad, final_bsize);
+	aes_encrypt(&k, buf, pad);
+}
+
+static void aes_cts_cbc_decrypt(const u8 *key, int keysize,
+				const u8 iv[AES_BLOCK_SIZE],
+				const u8 *src, u8 *dst, size_t nbytes)
+{
+	const size_t offset = ROUND_DOWN(nbytes - 1, AES_BLOCK_SIZE);
+	const size_t final_bsize = nbytes - offset;
+	struct aes_key k;
+	u8 *pad;
+
+	ASSERT(nbytes >= AES_BLOCK_SIZE);
+
+	aes_setkey(&k, key, keysize);
+
+	if (nbytes == AES_BLOCK_SIZE)
+		return aes_cbc_decrypt(&k, iv, src, dst, nbytes);
+
+	pad = &dst[offset - AES_BLOCK_SIZE];
+	aes_decrypt(&k, &src[offset - AES_BLOCK_SIZE], pad);
+	xor(&dst[offset], &src[offset], pad, final_bsize);
+	xor(pad, pad, &dst[offset], final_bsize);
+
+	aes_cbc_decrypt(&k, (offset == AES_BLOCK_SIZE ?
+			     iv : &src[offset - 2 * AES_BLOCK_SIZE]),
+			pad, pad, AES_BLOCK_SIZE);
+	aes_cbc_decrypt(&k, iv, src, dst, offset - AES_BLOCK_SIZE);
+}
+
+static void aes_256_cts_cbc_encrypt(const u8 key[AES_256_KEY_SIZE],
+				    const u8 iv[AES_BLOCK_SIZE],
+				    const u8 *src, u8 *dst, size_t nbytes)
+{
+	aes_cts_cbc_encrypt(key, AES_256_KEY_SIZE, iv, src, dst, nbytes);
+}
+
+static void aes_256_cts_cbc_decrypt(const u8 key[AES_256_KEY_SIZE],
+				    const u8 iv[AES_BLOCK_SIZE],
+				    const u8 *src, u8 *dst, size_t nbytes)
+{
+	aes_cts_cbc_decrypt(key, AES_256_KEY_SIZE, iv, src, dst, nbytes);
+}
+
+#ifdef ENABLE_ALG_TESTS
+#include <openssl/modes.h>
+static void aes_block128_f(const unsigned char in[16],
+			   unsigned char out[16], const void *key)
+{
+	aes_encrypt(key, in, out);
+}
+
+static void test_aes_256_cts_cbc(void)
+{
+	unsigned long num_tests = NUM_ALG_TEST_ITERATIONS;
+
+	while (num_tests--) {
+		u8 key[AES_256_KEY_SIZE];
+		u8 iv[AES_BLOCK_SIZE];
+		u8 iv_copy[AES_BLOCK_SIZE];
+		u8 ptext[512];
+		u8 actual_ctext[sizeof(ptext)];
+		u8 expected_ctext[sizeof(ptext)];
+		u8 decrypted[sizeof(ptext)];
+		const size_t datalen = 16 + (rand() % (sizeof(ptext) - 15));
+		struct aes_key k;
+
+		rand_bytes(key, sizeof(key));
+		rand_bytes(iv, sizeof(iv));
+		rand_bytes(ptext, datalen);
+
+		aes_256_cts_cbc_encrypt(key, iv, ptext, actual_ctext, datalen);
+
+		/* OpenSSL doesn't allow datalen=AES_BLOCK_SIZE; Linux does */
+		if (datalen != AES_BLOCK_SIZE) {
+			aes_setkey(&k, key, sizeof(key));
+			memcpy(iv_copy, iv, sizeof(iv));
+			ASSERT(CRYPTO_cts128_encrypt_block(ptext,
+							   expected_ctext,
+							   datalen, &k, iv_copy,
+							   aes_block128_f)
+			       == datalen);
+			ASSERT(memcmp(actual_ctext, expected_ctext,
+				      datalen) == 0);
+		}
+		aes_256_cts_cbc_decrypt(key, iv, actual_ctext, decrypted,
+					datalen);
+		ASSERT(memcmp(ptext, decrypted, datalen) == 0);
+	}
+}
+#endif /* ENABLE_ALG_TESTS */
+
+static void essiv_generate_iv(const u8 orig_key[AES_128_KEY_SIZE],
+			      const u8 orig_iv[AES_BLOCK_SIZE],
+			      u8 real_iv[AES_BLOCK_SIZE])
+{
+	u8 essiv_key[SHA256_DIGEST_SIZE];
+	struct aes_key essiv;
+
+	/* AES encrypt the original IV using a hash of the original key */
+	STATIC_ASSERT(SHA256_DIGEST_SIZE == AES_256_KEY_SIZE);
+	sha256(orig_key, AES_128_KEY_SIZE, essiv_key);
+	aes_setkey(&essiv, essiv_key, AES_256_KEY_SIZE);
+	aes_encrypt(&essiv, orig_iv, real_iv);
+}
+
+static void aes_128_cbc_essiv_encrypt(const u8 key[AES_128_KEY_SIZE],
+				      const u8 iv[AES_BLOCK_SIZE],
+				      const u8 *src, u8 *dst, size_t nbytes)
+{
+	struct aes_key k;
+	u8 real_iv[AES_BLOCK_SIZE];
+
+	aes_setkey(&k, key, AES_128_KEY_SIZE);
+	essiv_generate_iv(key, iv, real_iv);
+	aes_cbc_encrypt(&k, real_iv, src, dst, nbytes);
+}
+
+static void aes_128_cbc_essiv_decrypt(const u8 key[AES_128_KEY_SIZE],
+				      const u8 iv[AES_BLOCK_SIZE],
+				      const u8 *src, u8 *dst, size_t nbytes)
+{
+	struct aes_key k;
+	u8 real_iv[AES_BLOCK_SIZE];
+
+	aes_setkey(&k, key, AES_128_KEY_SIZE);
+	essiv_generate_iv(key, iv, real_iv);
+	aes_cbc_decrypt(&k, real_iv, src, dst, nbytes);
+}
+
+static void aes_128_cts_cbc_encrypt(const u8 key[AES_128_KEY_SIZE],
+				    const u8 iv[AES_BLOCK_SIZE],
+				    const u8 *src, u8 *dst, size_t nbytes)
+{
+	aes_cts_cbc_encrypt(key, AES_128_KEY_SIZE, iv, src, dst, nbytes);
+}
+
+static void aes_128_cts_cbc_decrypt(const u8 key[AES_128_KEY_SIZE],
+				    const u8 iv[AES_BLOCK_SIZE],
+				    const u8 *src, u8 *dst, size_t nbytes)
+{
+	aes_cts_cbc_decrypt(key, AES_128_KEY_SIZE, iv, src, dst, nbytes);
+}
+
+/*----------------------------------------------------------------------------*
+ *                           XChaCha12 stream cipher                          *
+ *----------------------------------------------------------------------------*/
+
+/*
+ * References:
+ *   - "XChaCha: eXtended-nonce ChaCha and AEAD_XChaCha20_Poly1305"
+ *	https://tools.ietf.org/html/draft-arciszewski-xchacha-03
+ *
+ *   - "ChaCha, a variant of Salsa20"
+ *	https://cr.yp.to/chacha/chacha-20080128.pdf
+ *
+ *   - "Extending the Salsa20 nonce"
+ *	https://cr.yp.to/snuffle/xsalsa-20081128.pdf
+ */
+
+#define CHACHA_KEY_SIZE		32
+#define XCHACHA_KEY_SIZE	CHACHA_KEY_SIZE
+#define XCHACHA_NONCE_SIZE	24
+
+static void chacha_init_state(u32 state[16], const u8 key[CHACHA_KEY_SIZE],
+			      const u8 iv[16])
+{
+	static const u8 consts[16] = "expand 32-byte k";
+	int i;
+
+	for (i = 0; i < 4; i++)
+		state[i] = get_unaligned_le32(&consts[i * sizeof(__le32)]);
+	for (i = 0; i < 8; i++)
+		state[4 + i] = get_unaligned_le32(&key[i * sizeof(__le32)]);
+	for (i = 0; i < 4; i++)
+		state[12 + i] = get_unaligned_le32(&iv[i * sizeof(__le32)]);
+}
+
+#define CHACHA_QUARTERROUND(a, b, c, d)		\
+	do {					\
+		a += b; d = rol32(d ^ a, 16);	\
+		c += d; b = rol32(b ^ c, 12);	\
+		a += b; d = rol32(d ^ a, 8);	\
+		c += d; b = rol32(b ^ c, 7);	\
+	} while (0)
+
+static void chacha_permute(u32 x[16], int nrounds)
+{
+	do {
+		/* column round */
+		CHACHA_QUARTERROUND(x[0], x[4], x[8], x[12]);
+		CHACHA_QUARTERROUND(x[1], x[5], x[9], x[13]);
+		CHACHA_QUARTERROUND(x[2], x[6], x[10], x[14]);
+		CHACHA_QUARTERROUND(x[3], x[7], x[11], x[15]);
+
+		/* diagonal round */
+		CHACHA_QUARTERROUND(x[0], x[5], x[10], x[15]);
+		CHACHA_QUARTERROUND(x[1], x[6], x[11], x[12]);
+		CHACHA_QUARTERROUND(x[2], x[7], x[8], x[13]);
+		CHACHA_QUARTERROUND(x[3], x[4], x[9], x[14]);
+	} while ((nrounds -= 2) != 0);
+}
+
+static void xchacha(const u8 key[XCHACHA_KEY_SIZE],
+		    const u8 nonce[XCHACHA_NONCE_SIZE],
+		    const u8 *src, u8 *dst, size_t nbytes, int nrounds)
+{
+	u32 state[16];
+	u8 real_key[CHACHA_KEY_SIZE];
+	u8 real_iv[16] = { 0 };
+	size_t i, j;
+
+	/* Compute real key using original key and first 128 nonce bits */
+	chacha_init_state(state, key, nonce);
+	chacha_permute(state, nrounds);
+	for (i = 0; i < 8; i++) /* state words 0..3, 12..15 */
+		put_unaligned_le32(state[(i < 4 ? 0 : 8) + i],
+				   &real_key[i * sizeof(__le32)]);
+
+	/* Now do regular ChaCha, using real key and remaining nonce bits */
+	memcpy(&real_iv[8], nonce + 16, 8);
+	chacha_init_state(state, real_key, real_iv);
+	for (i = 0; i < nbytes; i += 64) {
+		u32 x[16];
+		__le32 keystream[16];
+
+		memcpy(x, state, 64);
+		chacha_permute(x, nrounds);
+		for (j = 0; j < 16; j++)
+			keystream[j] = cpu_to_le32(x[j] + state[j]);
+		xor(&dst[i], &src[i], (u8 *)keystream, MIN(nbytes - i, 64));
+		if (++state[12] == 0)
+			state[13]++;
+	}
+}
+
+static void xchacha12(const u8 key[XCHACHA_KEY_SIZE],
+		      const u8 nonce[XCHACHA_NONCE_SIZE],
+		      const u8 *src, u8 *dst, size_t nbytes)
+{
+	xchacha(key, nonce, src, dst, nbytes, 12);
+}
+
+/*----------------------------------------------------------------------------*
+ *                                 Poly1305                                   *
+ *----------------------------------------------------------------------------*/
+
+/*
+ * Note: this is only the Poly1305 ε-almost-∆-universal hash function, not the
+ * full Poly1305 MAC.  I.e., it doesn't add anything at the end.
+ */
+
+#define POLY1305_KEY_SIZE	16
+#define POLY1305_BLOCK_SIZE	16
+
+static void poly1305(const u8 key[POLY1305_KEY_SIZE],
+		     const u8 *msg, size_t msglen, le128 *out)
+{
+	const u32 limb_mask = 0x3ffffff;	/* limbs are base 2^26 */
+	const u64 r0 = (get_unaligned_le32(key +  0) >> 0) & 0x3ffffff;
+	const u64 r1 = (get_unaligned_le32(key +  3) >> 2) & 0x3ffff03;
+	const u64 r2 = (get_unaligned_le32(key +  6) >> 4) & 0x3ffc0ff;
+	const u64 r3 = (get_unaligned_le32(key +  9) >> 6) & 0x3f03fff;
+	const u64 r4 = (get_unaligned_le32(key + 12) >> 8) & 0x00fffff;
+	u32 h0 = 0, h1 = 0, h2 = 0, h3 = 0, h4 = 0;
+	u32 g0, g1, g2, g3, g4, ge_p_mask;
+
+	/* Partial block support is not necessary for Adiantum */
+	ASSERT(msglen % POLY1305_BLOCK_SIZE == 0);
+
+	while (msglen) {
+		u64 d0, d1, d2, d3, d4;
+
+		/* h += *msg */
+		h0 += (get_unaligned_le32(msg +  0) >> 0) & limb_mask;
+		h1 += (get_unaligned_le32(msg +  3) >> 2) & limb_mask;
+		h2 += (get_unaligned_le32(msg +  6) >> 4) & limb_mask;
+		h3 += (get_unaligned_le32(msg +  9) >> 6) & limb_mask;
+		h4 += (get_unaligned_le32(msg + 12) >> 8) | (1 << 24);
+
+		/* h *= r */
+		d0 = h0*r0 + h1*5*r4 + h2*5*r3 + h3*5*r2 + h4*5*r1;
+		d1 = h0*r1 + h1*r0   + h2*5*r4 + h3*5*r3 + h4*5*r2;
+		d2 = h0*r2 + h1*r1   + h2*r0   + h3*5*r4 + h4*5*r3;
+		d3 = h0*r3 + h1*r2   + h2*r1   + h3*r0   + h4*5*r4;
+		d4 = h0*r4 + h1*r3   + h2*r2   + h3*r1   + h4*r0;
+
+		/* (partial) h %= 2^130 - 5 */
+		d1 += d0 >> 26;		h0 = d0 & limb_mask;
+		d2 += d1 >> 26;		h1 = d1 & limb_mask;
+		d3 += d2 >> 26;		h2 = d2 & limb_mask;
+		d4 += d3 >> 26;		h3 = d3 & limb_mask;
+		h0 += (d4 >> 26) * 5;	h4 = d4 & limb_mask;
+		h1 += h0 >> 26;		h0 &= limb_mask;
+
+		msg += POLY1305_BLOCK_SIZE;
+		msglen -= POLY1305_BLOCK_SIZE;
+	}
+
+	/* fully carry h */
+	h2 += (h1 >> 26);	h1 &= limb_mask;
+	h3 += (h2 >> 26);	h2 &= limb_mask;
+	h4 += (h3 >> 26);	h3 &= limb_mask;
+	h0 += (h4 >> 26) * 5;	h4 &= limb_mask;
+	h1 += (h0 >> 26);	h0 &= limb_mask;
+
+	/* if (h >= 2^130 - 5) h -= 2^130 - 5; */
+	g0 = h0 + 5;
+	g1 = h1 + (g0 >> 26);	g0 &= limb_mask;
+	g2 = h2 + (g1 >> 26);	g1 &= limb_mask;
+	g3 = h3 + (g2 >> 26);	g2 &= limb_mask;
+	g4 = h4 + (g3 >> 26);	g3 &= limb_mask;
+	ge_p_mask = ~((g4 >> 26) - 1); /* all 1's if h >= 2^130 - 5, else 0 */
+	h0 = (h0 & ~ge_p_mask) | (g0 & ge_p_mask);
+	h1 = (h1 & ~ge_p_mask) | (g1 & ge_p_mask);
+	h2 = (h2 & ~ge_p_mask) | (g2 & ge_p_mask);
+	h3 = (h3 & ~ge_p_mask) | (g3 & ge_p_mask);
+	h4 = (h4 & ~ge_p_mask) | (g4 & ge_p_mask & limb_mask);
+
+	/* h %= 2^128 */
+	out->lo = cpu_to_le64(((u64)h2 << 52) | ((u64)h1 << 26) | h0);
+	out->hi = cpu_to_le64(((u64)h4 << 40) | ((u64)h3 << 14) | (h2 >> 12));
+}
+
+/*----------------------------------------------------------------------------*
+ *                          Adiantum encryption mode                          *
+ *----------------------------------------------------------------------------*/
+
+/*
+ * Reference: "Adiantum: length-preserving encryption for entry-level processors"
+ *	https://tosc.iacr.org/index.php/ToSC/article/view/7360
+ */
+
+#define ADIANTUM_KEY_SIZE	32
+#define ADIANTUM_IV_SIZE	32
+#define ADIANTUM_HASH_KEY_SIZE	((2 * POLY1305_KEY_SIZE) + NH_KEY_SIZE)
+
+#define NH_KEY_SIZE		1072
+#define NH_KEY_WORDS		(NH_KEY_SIZE / sizeof(u32))
+#define NH_BLOCK_SIZE		1024
+#define NH_HASH_SIZE		32
+#define NH_MESSAGE_UNIT		16
+
+static u64 nh_pass(const u32 *key, const u8 *msg, size_t msglen)
+{
+	u64 sum = 0;
+
+	ASSERT(msglen % NH_MESSAGE_UNIT == 0);
+	while (msglen) {
+		sum += (u64)(u32)(get_unaligned_le32(msg +  0) + key[0]) *
+			    (u32)(get_unaligned_le32(msg +  8) + key[2]);
+		sum += (u64)(u32)(get_unaligned_le32(msg +  4) + key[1]) *
+			    (u32)(get_unaligned_le32(msg + 12) + key[3]);
+		key += NH_MESSAGE_UNIT / sizeof(key[0]);
+		msg += NH_MESSAGE_UNIT;
+		msglen -= NH_MESSAGE_UNIT;
+	}
+	return sum;
+}
+
+/* NH ε-almost-universal hash function */
+static void nh(const u32 *key, const u8 *msg, size_t msglen,
+	       u8 result[NH_HASH_SIZE])
+{
+	size_t i;
+
+	for (i = 0; i < NH_HASH_SIZE; i += sizeof(__le64)) {
+		put_unaligned_le64(nh_pass(key, msg, msglen), &result[i]);
+		key += NH_MESSAGE_UNIT / sizeof(key[0]);
+	}
+}
+
+/* Adiantum's ε-almost-∆-universal hash function */
+static void adiantum_hash(const u8 key[ADIANTUM_HASH_KEY_SIZE],
+			  const u8 iv[ADIANTUM_IV_SIZE],
+			  const u8 *msg, size_t msglen, le128 *result)
+{
+	const u8 *header_poly_key = key;
+	const u8 *msg_poly_key = header_poly_key + POLY1305_KEY_SIZE;
+	const u8 *nh_key = msg_poly_key + POLY1305_KEY_SIZE;
+	u32 nh_key_words[NH_KEY_WORDS];
+	u8 header[ADIANTUM_IV_SIZE + POLY1305_BLOCK_SIZE];
+	const size_t num_nh_blocks = DIV_ROUND_UP(msglen, NH_BLOCK_SIZE);
+	u8 *nh_hashes = xmalloc(num_nh_blocks * NH_HASH_SIZE);
+	const size_t padded_msglen = ROUND_UP(msglen, NH_MESSAGE_UNIT);
+	u8 *padded_msg = xmalloc(padded_msglen);
+	le128 hash1, hash2;
+	size_t i;
+
+	for (i = 0; i < NH_KEY_WORDS; i++)
+		nh_key_words[i] = get_unaligned_le32(&nh_key[i * sizeof(u32)]);
+
+	/* Hash tweak and message length with first Poly1305 key */
+	put_unaligned_le64((u64)msglen * 8, header);
+	put_unaligned_le64(0, &header[sizeof(__le64)]);
+	memcpy(&header[POLY1305_BLOCK_SIZE], iv, ADIANTUM_IV_SIZE);
+	poly1305(header_poly_key, header, sizeof(header), &hash1);
+
+	/* Hash NH hashes of message blocks using second Poly1305 key */
+	/* (using a super naive way of handling the padding) */
+	memcpy(padded_msg, msg, msglen);
+	memset(&padded_msg[msglen], 0, padded_msglen - msglen);
+	for (i = 0; i < num_nh_blocks; i++) {
+		nh(nh_key_words, &padded_msg[i * NH_BLOCK_SIZE],
+		   MIN(NH_BLOCK_SIZE, padded_msglen - (i * NH_BLOCK_SIZE)),
+		   &nh_hashes[i * NH_HASH_SIZE]);
+	}
+	poly1305(msg_poly_key, nh_hashes, num_nh_blocks * NH_HASH_SIZE, &hash2);
+
+	/* Add the two hashes together to get the final hash */
+	le128_add(result, &hash1, &hash2);
+
+	free(nh_hashes);
+	free(padded_msg);
+}
+
+static void adiantum_crypt(const u8 key[ADIANTUM_KEY_SIZE],
+			   const u8 iv[ADIANTUM_IV_SIZE], const u8 *src,
+			   u8 *dst, size_t nbytes, bool decrypting)
+{
+	u8 subkeys[AES_256_KEY_SIZE + ADIANTUM_HASH_KEY_SIZE] = { 0 };
+	struct aes_key aes_key;
+	union {
+		u8 nonce[XCHACHA_NONCE_SIZE];
+		le128 block;
+	} u = { .nonce = { 1 } };
+	const size_t bulk_len = nbytes - sizeof(u.block);
+	le128 hash;
+
+	ASSERT(nbytes >= sizeof(u.block));
+
+	/* Derive subkeys */
+	xchacha12(key, u.nonce, subkeys, subkeys, sizeof(subkeys));
+	aes_setkey(&aes_key, subkeys, AES_256_KEY_SIZE);
+
+	/* Hash left part and add to right part */
+	adiantum_hash(&subkeys[AES_256_KEY_SIZE], iv, src, bulk_len, &hash);
+	memcpy(&u.block, &src[bulk_len], sizeof(u.block));
+	le128_add(&u.block, &u.block, &hash);
+
+	if (!decrypting) /* Encrypt right part with block cipher */
+		aes_encrypt(&aes_key, u.nonce, u.nonce);
+
+	/* Encrypt left part with stream cipher, using the computed nonce */
+	u.nonce[sizeof(u.block)] = 1;
+	xchacha12(key, u.nonce, src, dst, bulk_len);
+
+	if (decrypting) /* Decrypt right part with block cipher */
+		aes_decrypt(&aes_key, u.nonce, u.nonce);
+
+	/* Finalize right part by subtracting hash of left part */
+	adiantum_hash(&subkeys[AES_256_KEY_SIZE], iv, dst, bulk_len, &hash);
+	le128_sub(&u.block, &u.block, &hash);
+	memcpy(&dst[bulk_len], &u.block, sizeof(u.block));
+}
+
+static void adiantum_encrypt(const u8 key[ADIANTUM_KEY_SIZE],
+			     const u8 iv[ADIANTUM_IV_SIZE],
+			     const u8 *src, u8 *dst, size_t nbytes)
+{
+	adiantum_crypt(key, iv, src, dst, nbytes, false);
+}
+
+static void adiantum_decrypt(const u8 key[ADIANTUM_KEY_SIZE],
+			     const u8 iv[ADIANTUM_IV_SIZE],
+			     const u8 *src, u8 *dst, size_t nbytes)
+{
+	adiantum_crypt(key, iv, src, dst, nbytes, true);
+}
+
+#ifdef ENABLE_ALG_TESTS
+#include <linux/if_alg.h>
+#include <sys/socket.h>
+#define SOL_ALG 279
+static void af_alg_crypt(int algfd, int op, const u8 *key, size_t keylen,
+			 const u8 *iv, size_t ivlen,
+			 const u8 *src, u8 *dst, size_t datalen)
+{
+	size_t controllen = CMSG_SPACE(sizeof(int)) +
+			    CMSG_SPACE(sizeof(struct af_alg_iv) + ivlen);
+	u8 *control = xmalloc(controllen);
+	struct iovec iov = { .iov_base = (u8 *)src, .iov_len = datalen };
+	struct msghdr msg = {
+		.msg_iov = &iov,
+		.msg_iovlen = 1,
+		.msg_control = control,
+		.msg_controllen = controllen,
+	};
+	struct cmsghdr *cmsg;
+	struct af_alg_iv *algiv;
+	int reqfd;
+
+	memset(control, 0, controllen);
+
+	cmsg = CMSG_FIRSTHDR(&msg);
+	cmsg->cmsg_len = CMSG_LEN(sizeof(int));
+	cmsg->cmsg_level = SOL_ALG;
+	cmsg->cmsg_type = ALG_SET_OP;
+	*(int *)CMSG_DATA(cmsg) = op;
+
+	cmsg = CMSG_NXTHDR(&msg, cmsg);
+	cmsg->cmsg_len = CMSG_LEN(sizeof(struct af_alg_iv) + ivlen);
+	cmsg->cmsg_level = SOL_ALG;
+	cmsg->cmsg_type = ALG_SET_IV;
+	algiv = (struct af_alg_iv *)CMSG_DATA(cmsg);
+	algiv->ivlen = ivlen;
+	memcpy(algiv->iv, iv, ivlen);
+
+	if (setsockopt(algfd, SOL_ALG, ALG_SET_KEY, key, keylen) != 0)
+		die_errno("can't set key on AF_ALG socket");
+
+	reqfd = accept(algfd, NULL, NULL);
+	if (reqfd < 0)
+		die_errno("can't accept() AF_ALG socket");
+	if (sendmsg(reqfd, &msg, 0) != datalen)
+		die_errno("can't sendmsg() AF_ALG request socket");
+	if (xread(reqfd, dst, datalen) != datalen)
+		die("short read from AF_ALG request socket");
+	close(reqfd);
+
+	free(control);
+}
+
+static void test_adiantum(void)
+{
+	int algfd = socket(AF_ALG, SOCK_SEQPACKET, 0);
+	struct sockaddr_alg addr = {
+		.salg_type = "skcipher",
+		.salg_name = "adiantum(xchacha12,aes)",
+	};
+	unsigned long num_tests = NUM_ALG_TEST_ITERATIONS;
+
+	if (algfd < 0)
+		die_errno("can't create AF_ALG socket");
+	if (bind(algfd, (struct sockaddr *)&addr, sizeof(addr)) != 0)
+		die_errno("can't bind AF_ALG socket to Adiantum algorithm");
+
+	while (num_tests--) {
+		u8 key[ADIANTUM_KEY_SIZE];
+		u8 iv[ADIANTUM_IV_SIZE];
+		u8 ptext[4096];
+		u8 actual_ctext[sizeof(ptext)];
+		u8 expected_ctext[sizeof(ptext)];
+		u8 decrypted[sizeof(ptext)];
+		const size_t datalen = 16 + (rand() % (sizeof(ptext) - 15));
+
+		rand_bytes(key, sizeof(key));
+		rand_bytes(iv, sizeof(iv));
+		rand_bytes(ptext, datalen);
+
+		adiantum_encrypt(key, iv, ptext, actual_ctext, datalen);
+		af_alg_crypt(algfd, ALG_OP_ENCRYPT, key, sizeof(key),
+			     iv, sizeof(iv), ptext, expected_ctext, datalen);
+		ASSERT(memcmp(actual_ctext, expected_ctext, datalen) == 0);
+
+		adiantum_decrypt(key, iv, actual_ctext, decrypted, datalen);
+		ASSERT(memcmp(ptext, decrypted, datalen) == 0);
+	}
+	close(algfd);
+}
+#endif /* ENABLE_ALG_TESTS */
+
+/*----------------------------------------------------------------------------*
+ *                               Main program                                 *
+ *----------------------------------------------------------------------------*/
+
+#define FILE_NONCE_SIZE		16
+#define MAX_KEY_SIZE		64
+
+static const struct fscrypt_cipher {
+	const char *name;
+	void (*encrypt)(const u8 *key, const u8 *iv, const u8 *src,
+			u8 *dst, size_t nbytes);
+	void (*decrypt)(const u8 *key, const u8 *iv, const u8 *src,
+			u8 *dst, size_t nbytes);
+	int keysize;
+	int min_input_size;
+} fscrypt_ciphers[] = {
+	{
+		.name = "AES-256-XTS",
+		.encrypt = aes_256_xts_encrypt,
+		.decrypt = aes_256_xts_decrypt,
+		.keysize = 2 * AES_256_KEY_SIZE,
+		.min_input_size = AES_BLOCK_SIZE,
+	}, {
+		.name = "AES-256-CTS-CBC",
+		.encrypt = aes_256_cts_cbc_encrypt,
+		.decrypt = aes_256_cts_cbc_decrypt,
+		.keysize = AES_256_KEY_SIZE,
+		.min_input_size = AES_BLOCK_SIZE,
+	}, {
+		.name = "AES-128-CBC-ESSIV",
+		.encrypt = aes_128_cbc_essiv_encrypt,
+		.decrypt = aes_128_cbc_essiv_decrypt,
+		.keysize = AES_128_KEY_SIZE,
+		.min_input_size = AES_BLOCK_SIZE,
+	}, {
+		.name = "AES-128-CTS-CBC",
+		.encrypt = aes_128_cts_cbc_encrypt,
+		.decrypt = aes_128_cts_cbc_decrypt,
+		.keysize = AES_128_KEY_SIZE,
+		.min_input_size = AES_BLOCK_SIZE,
+	}, {
+		.name = "Adiantum",
+		.encrypt = adiantum_encrypt,
+		.decrypt = adiantum_decrypt,
+		.keysize = ADIANTUM_KEY_SIZE,
+		.min_input_size = AES_BLOCK_SIZE,
+	}
+};
+
+static const struct fscrypt_cipher *find_fscrypt_cipher(const char *name)
+{
+	size_t i;
+
+	for (i = 0; i < ARRAY_SIZE(fscrypt_ciphers); i++) {
+		if (strcmp(fscrypt_ciphers[i].name, name) == 0)
+			return &fscrypt_ciphers[i];
+	}
+	return NULL;
+}
+
+struct fscrypt_iv {
+	union {
+		__le64 block_num;
+		u8 bytes[32];
+	};
+};
+
+static void crypt_loop(const struct fscrypt_cipher *cipher, const u8 *key,
+		       struct fscrypt_iv *iv, bool decrypting,
+		       size_t block_size, size_t padding)
+{
+	u8 *buf = xmalloc(block_size);
+	size_t res;
+
+	while ((res = xread(STDIN_FILENO, buf, block_size)) > 0) {
+		size_t crypt_len = block_size;
+
+		if (padding > 0)
+			crypt_len = MIN(ROUND_UP(res, padding), crypt_len);
+
+		crypt_len = MAX(crypt_len, cipher->min_input_size);
+
+		memset(&buf[res], 0, crypt_len - res);
+
+		if (decrypting)
+			cipher->decrypt(key, iv->bytes, buf, buf, crypt_len);
+		else
+			cipher->encrypt(key, iv->bytes, buf, buf, crypt_len);
+
+		full_write(STDOUT_FILENO, buf, crypt_len);
+
+		iv->block_num = cpu_to_le64(le64_to_cpu(iv->block_num) + 1);
+	}
+	free(buf);
+}
+
+/* The supported key derivation functions */
+enum kdf_algorithm {
+	KDF_NONE,
+	KDF_AES_128_ECB,
+};
+
+static enum kdf_algorithm parse_kdf_algorithm(const char *arg)
+{
+	if (strcmp(arg, "none") == 0)
+		return KDF_NONE;
+	if (strcmp(arg, "AES-128-ECB") == 0)
+		return KDF_AES_128_ECB;
+	die("Unknown KDF: %s", arg);
+}
+
+/*
+ * Get the key and starting IV with which the encryption will actually be done.
+ * If a KDF was specified, a subkey is derived from the master key and file
+ * nonce.  Otherwise, the master key is used directly.
+ */
+static void get_key_and_iv(const u8 *master_key, size_t master_key_size,
+			   enum kdf_algorithm kdf,
+			   const u8 nonce[FILE_NONCE_SIZE],
+			   u8 *real_key, size_t real_key_size,
+			   struct fscrypt_iv *iv)
+{
+	bool nonce_in_iv = false;
+	struct aes_key aes_key;
+	size_t i;
+
+	ASSERT(real_key_size <= master_key_size);
+
+	memset(iv, 0, sizeof(*iv));
+
+	switch (kdf) {
+	case KDF_NONE:
+		memcpy(real_key, master_key, real_key_size);
+		nonce_in_iv = true;
+		break;
+	case KDF_AES_128_ECB:
+		if (nonce == NULL)
+			die("--file-nonce is required with --kdf=AES-128-ECB");
+		STATIC_ASSERT(FILE_NONCE_SIZE == AES_128_KEY_SIZE);
+		ASSERT(real_key_size % AES_BLOCK_SIZE == 0);
+		aes_setkey(&aes_key, nonce, AES_128_KEY_SIZE);
+		for (i = 0; i < real_key_size; i += AES_BLOCK_SIZE)
+			aes_encrypt(&aes_key, &master_key[i], &real_key[i]);
+		break;
+	default:
+		ASSERT(0);
+	}
+
+	if (nonce_in_iv && nonce != NULL)
+		memcpy(&iv->bytes[8], nonce, FILE_NONCE_SIZE);
+}
+
+enum {
+	OPT_BLOCK_SIZE,
+	OPT_DECRYPT,
+	OPT_FILE_NONCE,
+	OPT_HELP,
+	OPT_KDF,
+	OPT_PADDING,
+};
+
+static const struct option longopts[] = {
+	{ "block-size",      required_argument, NULL, OPT_BLOCK_SIZE },
+	{ "decrypt",         no_argument,       NULL, OPT_DECRYPT },
+	{ "file-nonce",      required_argument, NULL, OPT_FILE_NONCE },
+	{ "help",            no_argument,       NULL, OPT_HELP },
+	{ "kdf",             required_argument, NULL, OPT_KDF },
+	{ "padding",         required_argument, NULL, OPT_PADDING },
+	{ NULL, 0, NULL, 0 },
+};
+
+int main(int argc, char *argv[])
+{
+	size_t block_size = 4096;
+	bool decrypting = false;
+	u8 _file_nonce[FILE_NONCE_SIZE];
+	u8 *file_nonce = NULL;
+	enum kdf_algorithm kdf = KDF_NONE;
+	size_t padding = 0;
+	const struct fscrypt_cipher *cipher;
+	u8 master_key[MAX_KEY_SIZE];
+	int master_key_size;
+	u8 real_key[MAX_KEY_SIZE];
+	struct fscrypt_iv iv;
+	char *tmp;
+	int c;
+
+	aes_init();
+
+#ifdef ENABLE_ALG_TESTS
+	test_aes();
+	test_sha2();
+	test_aes_256_xts();
+	test_aes_256_cts_cbc();
+	test_adiantum();
+#endif
+
+	while ((c = getopt_long(argc, argv, "", longopts, NULL)) != -1) {
+		switch (c) {
+		case OPT_BLOCK_SIZE:
+			block_size = strtoul(optarg, &tmp, 10);
+			if (block_size <= 0 || *tmp)
+				die("Invalid block size: %s", optarg);
+			break;
+		case OPT_DECRYPT:
+			decrypting = true;
+			break;
+		case OPT_FILE_NONCE:
+			if (hex2bin(optarg, _file_nonce, FILE_NONCE_SIZE) !=
+			    FILE_NONCE_SIZE)
+				die("Invalid file nonce: %s", optarg);
+			file_nonce = _file_nonce;
+			break;
+		case OPT_HELP:
+			usage(stdout);
+			return 0;
+		case OPT_KDF:
+			kdf = parse_kdf_algorithm(optarg);
+			break;
+		case OPT_PADDING:
+			padding = strtoul(optarg, &tmp, 10);
+			if (padding <= 0 || *tmp || !is_power_of_2(padding) ||
+			    padding > INT_MAX)
+				die("Invalid padding amount: %s", optarg);
+			break;
+		default:
+			usage(stderr);
+			return 2;
+		}
+	}
+	argc -= optind;
+	argv += optind;
+
+	if (argc != 2) {
+		usage(stderr);
+		return 2;
+	}
+
+	cipher = find_fscrypt_cipher(argv[0]);
+	if (cipher == NULL)
+		die("Unknown cipher: %s", argv[0]);
+
+	if (block_size < cipher->min_input_size)
+		die("Block size of %zu bytes is too small for cipher %s",
+		    block_size, cipher->name);
+
+	master_key_size = hex2bin(argv[1], master_key, MAX_KEY_SIZE);
+	if (master_key_size < 0)
+		die("Invalid master_key: %s", argv[1]);
+	if (master_key_size < cipher->keysize)
+		die("Master key is too short for cipher %s", cipher->name);
+
+	get_key_and_iv(master_key, master_key_size, kdf, file_nonce,
+		       real_key, cipher->keysize, &iv);
+
+	crypt_loop(cipher, real_key, &iv, decrypting, block_size, padding);
+	return 0;
+}
