diff --git a/.gitignore b/.gitignore
index 44bef90f..fc4c16e3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -166,6 +166,7 @@ test/default/stream3
test/default/stream4
test/default/verify1
test/default/xchacha20
+test/default/shifumi128
test/js.done
testing
zig-cache
diff --git a/builds/msvc/vs2010/libsodium/libsodium.vcxproj b/builds/msvc/vs2010/libsodium/libsodium.vcxproj
index ab8bcb0a..864764b6 100644
--- a/builds/msvc/vs2010/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2010/libsodium/libsodium.vcxproj
@@ -182,6 +182,7 @@
+
@@ -267,6 +268,7 @@
+
diff --git a/builds/msvc/vs2010/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2010/libsodium/libsodium.vcxproj.filters
index 363a53bc..1ef254cb 100644
--- a/builds/msvc/vs2010/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2010/libsodium/libsodium.vcxproj.filters
@@ -339,6 +339,9 @@
crypto_aead\chacha20poly1305\sodium
+
+ crypto_zkp
+
crypto_secretstream\xchacha20poly1305
@@ -590,6 +593,9 @@
include\sodium
+
+ include\sodium
+
include\sodium\private
@@ -1033,6 +1039,9 @@
{80669cf5-3c9c-3c60-b409-9d8fb305bc77}
+
+ {782f92dd-85aa-35fb-919d-aabbca1c59f1}
+
{96da72eb-3aa0-3850-83eb-32788f91e5bd}
diff --git a/builds/msvc/vs2012/libsodium/libsodium.vcxproj b/builds/msvc/vs2012/libsodium/libsodium.vcxproj
index f0210427..89597d1e 100644
--- a/builds/msvc/vs2012/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2012/libsodium/libsodium.vcxproj
@@ -182,6 +182,7 @@
+
@@ -267,6 +268,7 @@
+
diff --git a/builds/msvc/vs2012/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2012/libsodium/libsodium.vcxproj.filters
index 363a53bc..1ef254cb 100644
--- a/builds/msvc/vs2012/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2012/libsodium/libsodium.vcxproj.filters
@@ -339,6 +339,9 @@
crypto_aead\chacha20poly1305\sodium
+
+ crypto_zkp
+
crypto_secretstream\xchacha20poly1305
@@ -590,6 +593,9 @@
include\sodium
+
+ include\sodium
+
include\sodium\private
@@ -1033,6 +1039,9 @@
{80669cf5-3c9c-3c60-b409-9d8fb305bc77}
+
+ {782f92dd-85aa-35fb-919d-aabbca1c59f1}
+
{96da72eb-3aa0-3850-83eb-32788f91e5bd}
diff --git a/builds/msvc/vs2013/libsodium/libsodium.vcxproj b/builds/msvc/vs2013/libsodium/libsodium.vcxproj
index d4d521a7..a7ace1e3 100644
--- a/builds/msvc/vs2013/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2013/libsodium/libsodium.vcxproj
@@ -182,6 +182,7 @@
+
@@ -267,6 +268,7 @@
+
diff --git a/builds/msvc/vs2013/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2013/libsodium/libsodium.vcxproj.filters
index 363a53bc..1ef254cb 100644
--- a/builds/msvc/vs2013/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2013/libsodium/libsodium.vcxproj.filters
@@ -339,6 +339,9 @@
crypto_aead\chacha20poly1305\sodium
+
+ crypto_zkp
+
crypto_secretstream\xchacha20poly1305
@@ -590,6 +593,9 @@
include\sodium
+
+ include\sodium
+
include\sodium\private
@@ -1033,6 +1039,9 @@
{80669cf5-3c9c-3c60-b409-9d8fb305bc77}
+
+ {782f92dd-85aa-35fb-919d-aabbca1c59f1}
+
{96da72eb-3aa0-3850-83eb-32788f91e5bd}
diff --git a/builds/msvc/vs2015/libsodium/libsodium.vcxproj b/builds/msvc/vs2015/libsodium/libsodium.vcxproj
index ab07ff28..869c0471 100644
--- a/builds/msvc/vs2015/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2015/libsodium/libsodium.vcxproj
@@ -182,6 +182,7 @@
+
@@ -267,6 +268,7 @@
+
diff --git a/builds/msvc/vs2015/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2015/libsodium/libsodium.vcxproj.filters
index 363a53bc..1ef254cb 100644
--- a/builds/msvc/vs2015/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2015/libsodium/libsodium.vcxproj.filters
@@ -339,6 +339,9 @@
crypto_aead\chacha20poly1305\sodium
+
+ crypto_zkp
+
crypto_secretstream\xchacha20poly1305
@@ -590,6 +593,9 @@
include\sodium
+
+ include\sodium
+
include\sodium\private
@@ -1033,6 +1039,9 @@
{80669cf5-3c9c-3c60-b409-9d8fb305bc77}
+
+ {782f92dd-85aa-35fb-919d-aabbca1c59f1}
+
{96da72eb-3aa0-3850-83eb-32788f91e5bd}
diff --git a/builds/msvc/vs2017/libsodium/libsodium.vcxproj b/builds/msvc/vs2017/libsodium/libsodium.vcxproj
index 0de45ab3..a664f250 100644
--- a/builds/msvc/vs2017/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2017/libsodium/libsodium.vcxproj
@@ -182,6 +182,7 @@
+
@@ -267,6 +268,7 @@
+
diff --git a/builds/msvc/vs2017/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2017/libsodium/libsodium.vcxproj.filters
index 363a53bc..1ef254cb 100644
--- a/builds/msvc/vs2017/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2017/libsodium/libsodium.vcxproj.filters
@@ -339,6 +339,9 @@
crypto_aead\chacha20poly1305\sodium
+
+ crypto_zkp
+
crypto_secretstream\xchacha20poly1305
@@ -590,6 +593,9 @@
include\sodium
+
+ include\sodium
+
include\sodium\private
@@ -1033,6 +1039,9 @@
{80669cf5-3c9c-3c60-b409-9d8fb305bc77}
+
+ {782f92dd-85aa-35fb-919d-aabbca1c59f1}
+
{96da72eb-3aa0-3850-83eb-32788f91e5bd}
diff --git a/builds/msvc/vs2019/libsodium/libsodium.vcxproj b/builds/msvc/vs2019/libsodium/libsodium.vcxproj
index 519d448e..ce7393a9 100644
--- a/builds/msvc/vs2019/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2019/libsodium/libsodium.vcxproj
@@ -206,6 +206,7 @@
+
@@ -291,6 +292,7 @@
+
diff --git a/builds/msvc/vs2019/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2019/libsodium/libsodium.vcxproj.filters
index 363a53bc..1ef254cb 100644
--- a/builds/msvc/vs2019/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2019/libsodium/libsodium.vcxproj.filters
@@ -339,6 +339,9 @@
crypto_aead\chacha20poly1305\sodium
+
+ crypto_zkp
+
crypto_secretstream\xchacha20poly1305
@@ -590,6 +593,9 @@
include\sodium
+
+ include\sodium
+
include\sodium\private
@@ -1033,6 +1039,9 @@
{80669cf5-3c9c-3c60-b409-9d8fb305bc77}
+
+ {782f92dd-85aa-35fb-919d-aabbca1c59f1}
+
{96da72eb-3aa0-3850-83eb-32788f91e5bd}
diff --git a/builds/msvc/vs2022/libsodium/libsodium.vcxproj b/builds/msvc/vs2022/libsodium/libsodium.vcxproj
index 2aedf72c..68d121df 100644
--- a/builds/msvc/vs2022/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2022/libsodium/libsodium.vcxproj
@@ -135,6 +135,7 @@
+
@@ -220,6 +221,7 @@
+
diff --git a/builds/msvc/vs2022/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2022/libsodium/libsodium.vcxproj.filters
index 363a53bc..1ef254cb 100644
--- a/builds/msvc/vs2022/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2022/libsodium/libsodium.vcxproj.filters
@@ -339,6 +339,9 @@
crypto_aead\chacha20poly1305\sodium
+
+ crypto_zkp
+
crypto_secretstream\xchacha20poly1305
@@ -590,6 +593,9 @@
include\sodium
+
+ include\sodium
+
include\sodium\private
@@ -1033,6 +1039,9 @@
{80669cf5-3c9c-3c60-b409-9d8fb305bc77}
+
+ {782f92dd-85aa-35fb-919d-aabbca1c59f1}
+
{96da72eb-3aa0-3850-83eb-32788f91e5bd}
diff --git a/libsodium.vcxproj b/libsodium.vcxproj
index 500f518a..a87a9c19 100644
--- a/libsodium.vcxproj
+++ b/libsodium.vcxproj
@@ -420,6 +420,7 @@
+
@@ -505,6 +506,7 @@
+
diff --git a/libsodium.vcxproj.filters b/libsodium.vcxproj.filters
index 42bef65f..5425d204 100644
--- a/libsodium.vcxproj.filters
+++ b/libsodium.vcxproj.filters
@@ -330,6 +330,9 @@
Source Files
+
+ Source Files
+
Source Files
@@ -581,6 +584,9 @@
Header Files
+
+ Header Files
+
Header Files
diff --git a/src/libsodium/Makefile.am b/src/libsodium/Makefile.am
index f6e67f2d..57cd3aa1 100644
--- a/src/libsodium/Makefile.am
+++ b/src/libsodium/Makefile.am
@@ -86,6 +86,7 @@ libsodium_la_SOURCES = \
crypto_stream/salsa20/stream_salsa20.h \
crypto_stream/xsalsa20/stream_xsalsa20.c \
crypto_verify/sodium/verify.c \
+ crypto_zkp/shifumi128.c \
include/sodium/private/chacha20_ietf_ext.h \
include/sodium/private/common.h \
include/sodium/private/ed25519_ref10.h \
diff --git a/src/libsodium/crypto_zkp/shifumi128.c b/src/libsodium/crypto_zkp/shifumi128.c
new file mode 100644
index 00000000..9cf0044e
--- /dev/null
+++ b/src/libsodium/crypto_zkp/shifumi128.c
@@ -0,0 +1,51 @@
+#include "crypto_shorthash_siphash24.h"
+#include "crypto_verify_16.h"
+#include "crypto_zkp_shifumi128.h"
+#include "randombytes.h"
+
+size_t
+crypto_zkp_shifumi128_secretbytes(void)
+{
+ return crypto_zkp_shifumi128_SECRETBYTES;
+}
+
+size_t
+crypto_zkp_shifumi128_bytes(void)
+{
+ return crypto_zkp_shifumi128_BYTES;
+}
+
+void
+crypto_zkp_shufumi128_pick(crypto_zkp_shifumi128_commitment *commitment)
+{
+ *commitment = (int) randombytes_uniform(3);
+}
+
+int
+crypto_zkp_shifumi128_commit(unsigned char secret[crypto_zkp_shifumi128_SECRETBYTES],
+ unsigned char proof[crypto_zkp_shifumi128_BYTES],
+ const crypto_zkp_shifumi128_commitment commitment)
+{
+ const unsigned char s[1] = { (const unsigned char) commitment };
+
+ if (commitment < 0 || commitment > 2) {
+ return -1;
+ }
+ randombytes_buf(secret, crypto_zkp_shifumi128_SECRETBYTES);
+ crypto_shorthash_siphashx24(proof, s, sizeof s, secret);
+
+ return 0;
+}
+
+int
+crypto_zkp_shifumi128_verify(const unsigned char secret[crypto_zkp_shifumi128_SECRETBYTES],
+ const unsigned char proof[crypto_zkp_shifumi128_BYTES],
+ const crypto_zkp_shifumi128_commitment commitment)
+{
+ const unsigned char s[1] = { (const unsigned char) commitment };
+ unsigned char computed_proof[crypto_zkp_shifumi128_BYTES];
+
+ crypto_shorthash_siphashx24(computed_proof, s, sizeof s, secret);
+
+ return crypto_verify_16(computed_proof, proof);
+}
diff --git a/src/libsodium/include/Makefile.am b/src/libsodium/include/Makefile.am
index d639c634..000a2443 100644
--- a/src/libsodium/include/Makefile.am
+++ b/src/libsodium/include/Makefile.am
@@ -59,6 +59,7 @@ SODIUM_EXPORT = \
sodium/crypto_verify_16.h \
sodium/crypto_verify_32.h \
sodium/crypto_verify_64.h \
+ sodium/crypto_zkp_shifumi128.h \
sodium/export.h \
sodium/randombytes.h \
sodium/randombytes_internal_random.h \
diff --git a/src/libsodium/include/sodium.h b/src/libsodium/include/sodium.h
index 610d6328..e2b1a1f6 100644
--- a/src/libsodium/include/sodium.h
+++ b/src/libsodium/include/sodium.h
@@ -49,6 +49,7 @@
#include "sodium/crypto_verify_16.h"
#include "sodium/crypto_verify_32.h"
#include "sodium/crypto_verify_64.h"
+#include "sodium/crypto_zkp_shifumi128.h"
#include "sodium/randombytes.h"
#include "sodium/randombytes_internal_random.h"
#include "sodium/randombytes_sysrandom.h"
diff --git a/src/libsodium/include/sodium/crypto_zkp_shifumi128.h b/src/libsodium/include/sodium/crypto_zkp_shifumi128.h
new file mode 100644
index 00000000..85b0d0e7
--- /dev/null
+++ b/src/libsodium/include/sodium/crypto_zkp_shifumi128.h
@@ -0,0 +1,43 @@
+#ifndef crypto_zkp_shifumi128_H
+#define crypto_zkp_shifumi128_H
+
+#include
+#include "export.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef enum crypto_zkp_shifumi128_commitment {
+ crypto_zkp_shifumi128_ROCK,
+ crypto_zkp_shifumi128_PAPER,
+ crypto_zkp_shifumi128_SCISSORS
+} crypto_zkp_shifumi128_commitment;
+
+#define crypto_zkp_shifumi128_SECRETBYTES 16
+#define crypto_zkp_shifumi128_BYTES 16
+
+SODIUM_EXPORT
+size_t crypto_zkp_shifumi128_secretbytes(void);
+
+SODIUM_EXPORT
+size_t crypto_zkp_shifumi128_bytes(void);
+
+SODIUM_EXPORT
+void crypto_zkp_shufumi128_pick(crypto_zkp_shifumi128_commitment *commitment);
+
+SODIUM_EXPORT
+int crypto_zkp_shifumi128_commit(unsigned char secret[crypto_zkp_shifumi128_SECRETBYTES],
+ unsigned char proof[crypto_zkp_shifumi128_BYTES],
+ const crypto_zkp_shifumi128_commitment commitment);
+
+SODIUM_EXPORT
+int crypto_zkp_shifumi128_verify(const unsigned char secret[crypto_zkp_shifumi128_SECRETBYTES],
+ const unsigned char proof[crypto_zkp_shifumi128_BYTES],
+ const crypto_zkp_shifumi128_commitment commitment);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/test/default/Makefile.am b/test/default/Makefile.am
index a593c137..c90d487c 100644
--- a/test/default/Makefile.am
+++ b/test/default/Makefile.am
@@ -84,7 +84,8 @@ EXTRA_DIST = \
stream3.exp \
stream4.exp \
verify1.exp \
- xchacha20.exp
+ xchacha20.exp \
+ shifumi128.exp
DISTCLEANFILES = \
aead_aegis128l.res \
@@ -168,7 +169,8 @@ DISTCLEANFILES = \
stream3.res \
stream4.res \
verify1.res \
- xchacha20.res
+ xchacha20.res \
+ shifumi128.res
AM_CPPFLAGS = \
-DTEST_SRCDIR=\"@srcdir@\" \
@@ -249,7 +251,8 @@ TESTS_TARGETS = \
stream2 \
stream3 \
stream4 \
- verify1
+ verify1 \
+ shifumi128
if !EMSCRIPTEN
TESTS_TARGETS += \
@@ -507,6 +510,9 @@ verify1_LDADD = $(TESTS_LDADD)
xchacha20_SOURCE = cmptest.h xchacha20.c
xchacha20_LDADD = $(TESTS_LDADD)
+shifumi128_SOURC = cmptest.h shifumi128.c
+shifumi128_LDADD = $(TESTS_LDADD)
+
if !MINIMAL
TESTS_TARGETS += \
core_ed25519 \
diff --git a/test/default/shifumi128.c b/test/default/shifumi128.c
new file mode 100644
index 00000000..4da87989
--- /dev/null
+++ b/test/default/shifumi128.c
@@ -0,0 +1,20 @@
+#define TEST_NAME "shifumi128"
+#include "cmptest.h"
+
+int
+main(void)
+{
+ unsigned char secret[crypto_zkp_shifumi128_SECRETBYTES];
+ unsigned char proof[crypto_zkp_shifumi128_BYTES];
+ crypto_zkp_shifumi128_commitment move;
+
+ crypto_zkp_shufumi128_pick(&move);
+ crypto_zkp_shifumi128_commit(secret, proof, move);
+
+ assert(crypto_zkp_shifumi128_verify(secret, proof, move) == 0);
+
+ crypto_zkp_shifumi128_commit(secret, proof, crypto_zkp_shifumi128_ROCK);
+
+ assert(crypto_zkp_shifumi128_verify(secret, proof,
+ crypto_zkp_shifumi128_PAPER) == -1);
+}
diff --git a/test/default/shifumi128.exp b/test/default/shifumi128.exp
new file mode 100644
index 00000000..e69de29b