diff --git a/.github/ISSUE_TEMPLATE/bugs.md b/.github/ISSUE_TEMPLATE/bugs.md index c95ff9bc..245deae6 100644 --- a/.github/ISSUE_TEMPLATE/bugs.md +++ b/.github/ISSUE_TEMPLATE/bugs.md @@ -1,23 +1,34 @@ --- -name: "\U0001F41E Issues" -about: Bug reports +name: "\U0001F41E Bug report" +about: Report a bug in libsodium title: "" labels: "" assignees: "" --- -THE TRACKER IS DEDICATED TO KEEPING TRACK OF _BUGS_, -preferably after they have been already discussed and confirmed to be reproducible. +Thanks for taking the time to report a bug! -FOR ASSISTANCE, PLEASE CLOSE THIS FORM AND USE THE DISCUSSIONS SECTION INSTEAD: -https://github.com/jedisct1/libsodium/discussions +This tracker is for confirmed, reproducible bugs. If you're looking for help with installation, configuration, usage, or issues with third-party packages, the [Discussions](https://github.com/jedisct1/libsodium/discussions) section is a better place to start. -Installation, configuration, usage guidance and issues in 3rd party packages are not bugs, but individual assistance requests. +### Before you file -If the bug is not trivial to reproduce on any platform, please include ALL the steps required to reliably duplicate it, on a vanilla, generic install of macOS, Windows, OpenBSD or Ubuntu Linux system, in their most current version. +- Try reproducing the issue with the current `libsodium-stable` package, installed as documented at https://doc.libsodium.org/installation +- If the bug isn't obvious, please describe all the steps needed to reproduce it on a fresh install of macOS, Windows, OpenBSD, or Ubuntu Linux -Try to reproduce it using the current `libsodium-stable` package, installed as documented in https://doc.libsodium.org/installation . +### Not sure if it's a bug? -If you don't have any clear understanding of the issue or can't enumerate the steps to reproduce it, open a discussion instead: https://github.com/jedisct1/libsodium/discussions +No worries! Feel free to [start a discussion](https://github.com/jedisct1/libsodium/discussions) first and we can figure it out together. -Thank you! 😊🙏 +--- + +### How do we replicate the issue? + +(Describe the steps to reproduce the bug) + +### Expected behavior + +(What did you expect to happen?) + +### Actual behavior + +(What actually happened?) diff --git a/.github/ISSUE_TEMPLATE/suggestions.md b/.github/ISSUE_TEMPLATE/suggestions.md index 48437635..d0cbd650 100644 --- a/.github/ISSUE_TEMPLATE/suggestions.md +++ b/.github/ISSUE_TEMPLATE/suggestions.md @@ -1,22 +1,19 @@ --- name: "🙋🏽 Planned changes" -about: List of planned changes +about: Track planned changes (maintainers only) title: "" labels: "" assignees: "" --- -Please do not post features requests directly. +Hey there! Got an idea for libsodium? -The starting point should be a discussion, after having checked the roadmap: https://doc.libsodium.org/roadmap +This template is for tracking work that's already been planned. For new feature suggestions, here's the best path forward: -Suggestions should be raised as an "Ideas" discussion: https://github.com/jedisct1/libsodium/discussions +1. Check the [roadmap](https://doc.libsodium.org/roadmap) to see if it's already on our radar +2. Start an "Ideas" thread in [Discussions](https://github.com/jedisct1/libsodium/discussions) -We can then determine if the discussion needs to be escalated into a "planned change" or not. - -This will help us ensure that the issue tracker properly reflects ongoing or needed work on the project. - -Thank you! 😊🙏 +From there, we can chat about it and decide together if it should become a planned change. This helps keep the issue tracker focused on active work. --- diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 86bd7f81..0da24fe8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,7 +12,7 @@ jobs: tcc: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: Update packages list run: sudo apt-get update @@ -35,7 +35,7 @@ jobs: zig: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: Update packages list run: sudo apt-get update @@ -67,7 +67,7 @@ jobs: regular: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: Update packages list run: sudo apt-get update @@ -96,7 +96,7 @@ jobs: check-globals: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: Update packages list run: sudo apt-get update @@ -114,7 +114,7 @@ jobs: other-comp: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: Update packages list run: sudo apt-get update @@ -140,7 +140,7 @@ jobs: other-arch: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: Update packages list run: sudo apt-get update @@ -187,10 +187,73 @@ jobs: done exit $failed + aarch64-gcc: + runs-on: ubuntu-24.04-arm + steps: + - uses: actions/checkout@v6 + + - name: Update packages list + run: sudo apt-get update + + - name: Install dependencies + run: sudo apt-get install -y build-essential libtool autoconf automake + + - name: Autogen + run: ./autogen.sh -s + + - name: Compilation with GCC on aarch64 + run: | + env CPPFLAGS="-DDEV_MODE=1" ./configure --disable-dependency-tracking + make -j $(nproc) + make check + make distclean > /dev/null + + aarch64-gcc-crypto: + runs-on: ubuntu-24.04-arm + steps: + - uses: actions/checkout@v6 + + - name: Update packages list + run: sudo apt-get update + + - name: Install dependencies + run: sudo apt-get install -y build-essential libtool autoconf automake + + - name: Autogen + run: ./autogen.sh -s + + - name: Compilation with GCC on aarch64 with NEON and ARM Crypto extensions + run: | + env CFLAGS="-march=armv8-a+crypto" CPPFLAGS="-DDEV_MODE=1" ./configure --disable-dependency-tracking + make -j $(nproc) + make check + make distclean > /dev/null + + aarch64-gcc-sha3: + runs-on: ubuntu-24.04-arm + steps: + - uses: actions/checkout@v6 + + - name: Update packages list + run: sudo apt-get update + + - name: Install dependencies + run: sudo apt-get install -y build-essential libtool autoconf automake + + - name: Autogen + run: ./autogen.sh -s + + - name: Compilation with GCC on aarch64 with NEON, ARM Crypto, and SHA3 extensions + run: | + env CFLAGS="-march=armv8-a+crypto+sha3" CPPFLAGS="-DDEV_MODE=1" ./configure --disable-dependency-tracking + make -j $(nproc) + make check + make distclean > /dev/null + android: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: Update packages list run: sudo apt-get update diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 47727286..0046e135 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -26,13 +26,13 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v6 with: fetch-depth: 2 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v2 + uses: github/codeql-action/init@v4 with: languages: ${{ matrix.language }} @@ -43,6 +43,6 @@ jobs: make -j $(nproc) check - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v2 + uses: github/codeql-action/analyze@v4 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/dotnet-core.yml b/.github/workflows/dotnet-core.yml index 60458fda..c1edea53 100644 --- a/.github/workflows/dotnet-core.yml +++ b/.github/workflows/dotnet-core.yml @@ -15,7 +15,7 @@ jobs: build-windows-msvc: runs-on: windows-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: buildbase.bat run: buildbase.bat ..\vs2022\libsodium.sln 17 working-directory: builds/msvc/build/ @@ -40,7 +40,7 @@ jobs: uses: mlugg/setup-zig@v2 with: version: master - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: Build Android AAR run: sh ./dist-build/android-aar.sh @@ -147,7 +147,7 @@ jobs: build-apple: runs-on: macos-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: configure run: ./configure - name: build-xcframework @@ -181,7 +181,7 @@ jobs: DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 1 DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: 1 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - uses: actions/download-artifact@v4 with: name: build-win-x64 @@ -272,7 +272,7 @@ jobs: path: .libsodium-pack/bin/Release/*.nupkg - name: Attest Build Provenance - uses: actions/attest-build-provenance@897ed5eab6ed058a474202017ada7f40bfa52940 + uses: actions/attest-build-provenance@v3 with: subject-path: .libsodium-pack/bin/Release/*.nupkg @@ -287,7 +287,7 @@ jobs: DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 1 DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: 1 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - uses: actions/download-artifact@v4 with: name: nuget-package diff --git a/.gitignore b/.gitignore index c9898c0e..515a043e 100644 --- a/.gitignore +++ b/.gitignore @@ -109,6 +109,7 @@ test/default/chacha20 test/default/codecs test/default/core_ed25519 test/default/core_ed25519_h2c +test/default/core_keccak1600 test/default/core_ristretto255 test/default/core1 test/default/core2 @@ -122,13 +123,17 @@ test/default/generichash2 test/default/generichash3 test/default/hash test/default/hash3 +test/default/hash_sha3256 +test/default/hash_sha3512 test/default/ipcrypt test/default/kdf test/default/kdf_hkdf test/default/keygen +test/default/kem +test/default/kem_mlkem768 +test/default/kem_xwing test/default/kx test/default/metamorphic -test/default/kem_mlkem768 test/default/misuse test/default/onetimeauth test/default/onetimeauth2 @@ -168,6 +173,10 @@ test/default/stream3 test/default/stream4 test/default/verify1 test/default/xchacha20 +test/default/xof_shake128 +test/default/xof_shake256 +test/default/xof_turboshake128 +test/default/xof_turboshake256 test/js.done test/symbols/all-host-symbols.txt test/symbols/internal-host-symbols.txt diff --git a/ChangeLog b/ChangeLog index 09a32b50..0cbde750 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,12 @@ +* Version 1.0.21-stable + - Performance: SHA3 (Keccak1600) now leverages ARM SHA3 instructions when +available on ARM platforms. + - Performance: Argon2 has an optimized implementation for arch64 and +webassembly/SIMD. + - Export missing crypto_ipcrypt_nd_keygen() helper function. + - Fixed compilation with GCC on aarch64 and gcc 4.1 + - Libsodium can be directly used as a dependency in a Zig project. + * Version 1.0.21 This point release includes all the changes from 1.0.20-stable, which include a security fix for the `crypto_core_ed25519_is_valid_point()` @@ -15,6 +24,8 @@ for a wide range of applications, including key derivation, session encryption and more. * Version 1.0.20-stable + - XCFramework: cross-compilation is now forced on Apple Silicon to +avoid Rosetta-related build issues - The Fil-C compiler is supported out of the box - The CompCert compiler is supported out of the box - MSVC 2026 (Visual Studio 2026) is now supported @@ -51,6 +62,11 @@ compatibility with older runtimes fixed - `crypto_aead_aes256gcm_is_available` is exported to JavaScript - libsodium is now compatible with Emscripten 4.x + - Security: memory fences have been added after MAC verification in +AEAD to prevent speculative access to plaintext before authentication +is complete + - Assembly files now include .gnu.property notes for proper IBT and +Shadow Stack support when building with CET instrumentation * Version 1.0.20 This point release includes all the changes from 1.0.19-stable, diff --git a/THANKS b/THANKS index b962a786..9fd52e57 100644 --- a/THANKS +++ b/THANKS @@ -32,6 +32,7 @@ Alexander Morris (@alexpmorris) Amit Murthy (@amitmurthy) Andrew Bennett (@potatosalad) Andrew Lambert (@charonn0) +Brad Barden (@IAMB) Bruce Mitchener (@waywardmonkeys) Bruno Oliveira (@abstractj) Caolan McMahon (@caolan) diff --git a/appveyor.yml b/appveyor.yml index fe036e83..8f45b231 100644 --- a/appveyor.yml +++ b/appveyor.yml @@ -1,4 +1,4 @@ -version: 1.0.22.{build} +version: 1.0.23.{build} os: Visual Studio 2022 diff --git a/azure-pipelines.yml b/azure-pipelines.yml index 614a13e6..ed705e1b 100644 --- a/azure-pipelines.yml +++ b/azure-pipelines.yml @@ -45,8 +45,11 @@ jobs: - job: "windows_2019" pool: - vmImage: "windows-2019" + vmImage: "windows-2022" steps: + - powershell: | + choco install visualstudio2019buildtools --package-parameters "--add Microsoft.VisualStudio.Workload.VCTools --includeRecommended --quiet --wait" -y + displayName: Install VS2019 Build Tools - powershell: | cd builds\msvc\build & .\buildbase.bat ..\vs2019\libsodium.sln 16 @@ -64,10 +67,10 @@ jobs: - job: mingw64 pool: - vmImage: "windows-2019" + vmImage: "windows-2022" steps: - powershell: | - (New-Object Net.WebClient).DownloadFile("https://github.com/msys2/msys2-installer/releases/download/2025-08-30/msys2-base-x86_64-20250830.sfx.exe", "sfx.exe") + (New-Object Net.WebClient).DownloadFile("https://github.com/msys2/msys2-installer/releases/download/2025-12-13/msys2-base-x86_64-20251213.sfx.exe", "sfx.exe") .\sfx.exe -y -o\ del sfx.exe displayName: Install MSYS2 @@ -103,10 +106,10 @@ jobs: - job: mingw32 pool: - vmImage: "windows-2019" + vmImage: "windows-2022" steps: - powershell: | - (New-Object Net.WebClient).DownloadFile("https://github.com/msys2/msys2-installer/releases/download/2025-08-30/msys2-base-x86_64-20250830.sfx.exe", "sfx.exe") + (New-Object Net.WebClient).DownloadFile("https://github.com/msys2/msys2-installer/releases/download/2025-12-13/msys2-base-x86_64-20251213.sfx.exe", "sfx.exe") .\sfx.exe -y -o\ del sfx.exe displayName: Install MSYS2 diff --git a/build.zig b/build.zig index 546607c7..0ad8c867 100644 --- a/build.zig +++ b/build.zig @@ -1,12 +1,15 @@ const std = @import("std"); const fmt = std.fmt; -const Io = std.Io; -const Dir = Io.Dir; const heap = std.heap; const mem = std.mem; const Compile = std.Build.Step.Compile; const Target = std.Target; +// Zig 0.16+ uses std.Io.Dir, 0.15 uses std.fs +const is_zig_16 = @hasDecl(std, "Io") and @hasDecl(std.Io, "Dir"); +const Dir = if (is_zig_16) std.Io.Dir else std.fs.Dir; +const Io = if (is_zig_16) std.Io else void; + fn initLibConfig(b: *std.Build, target: std.Build.ResolvedTarget, lib: *Compile) void { lib.root_module.link_libc = true; lib.lto = null; @@ -166,15 +169,17 @@ fn initLibConfig(b: *std.Build, target: std.Build.ResolvedTarget, lib: *Compile) } pub fn build(b: *std.Build) !void { - var threaded: Io.Threaded = .init_single_threaded; - const io = threaded.io(); - + const io: Io = if (is_zig_16) b.graph.io else {}; const root_path = b.pathFromRoot("."); - var cwd = try Dir.openDirAbsolute(io, root_path, .{}); - defer cwd.close(io); + const cwd = try if (is_zig_16) Dir.cwd().openDir(io, root_path, .{}) else std.fs.cwd().openDir(root_path, .{}); const src_path = "src/libsodium"; - const src_dir = try cwd.openDir(io, src_path, .{ .iterate = true }); + const src_dir = if (is_zig_16) + try cwd.openDir(io, src_path, .{ .iterate = true }) + else if (@hasField(Dir.OpenOptions, "follow_symlinks")) + try cwd.openDir(src_path, .{ .iterate = true, .follow_symlinks = false }) + else + try cwd.openDir(src_path, .{ .iterate = true, .no_follow = true }); var target = b.standardTargetOptions(.{}); const optimize = b.standardOptimizeOption(.{}); @@ -235,9 +240,19 @@ pub fn build(b: *std.Build) !void { const prebuilt_version_file_path = "builds/msvc/version.h"; const version_file_path = "include/sodium/version.h"; - src_dir.access(io, version_file_path, .{ .read = true }) catch { - try Dir.copyFile(cwd, prebuilt_version_file_path, src_dir, version_file_path, io, .{}); - }; + if (is_zig_16) { + src_dir.access(io, version_file_path, .{}) catch { + try Dir.copyFile(cwd, prebuilt_version_file_path, src_dir, version_file_path, io, .{}); + }; + } else if (@hasField(Dir.OpenOptions, "follow_symlinks")) { + src_dir.access(version_file_path, .{ .read = true }) catch { + try cwd.copyFile(prebuilt_version_file_path, src_dir, version_file_path, .{}); + }; + } else { + src_dir.access(version_file_path, .{ .mode = .read_only }) catch { + try cwd.copyFile(prebuilt_version_file_path, src_dir, version_file_path, .{}); + }; + } for (libs.items) |lib| { b.installArtifact(lib); @@ -258,7 +273,7 @@ pub fn build(b: *std.Build) !void { const allocator = heap.page_allocator; var walker = try src_dir.walk(allocator); - while (try walker.next(io)) |entry| { + while (if (is_zig_16) try walker.next(io) else try walker.next()) |entry| { const name = entry.basename; if (mem.endsWith(u8, name, ".c")) { const full_path = try fmt.allocPrint(allocator, "{s}/{s}", .{ src_path, entry.path }); @@ -276,20 +291,43 @@ pub fn build(b: *std.Build) !void { const test_path = "test/default"; const out_bin_path = "zig-out/bin"; - const test_dir = try cwd.openDir(io, test_path, .{ .iterate = true }); - cwd.createDirPath(io, out_bin_path) catch {}; - const out_bin_dir = try cwd.openDir(io, out_bin_path, .{}); - try Dir.copyFile(test_dir, "run.sh", out_bin_dir, "run.sh", io, .{}); + const test_dir = if (is_zig_16) + try cwd.openDir(io, test_path, .{ .iterate = true }) + else if (@hasField(Dir.OpenOptions, "follow_symlinks")) + try cwd.openDir(test_path, .{ .iterate = true, .follow_symlinks = false }) + else + try cwd.openDir(test_path, .{ .iterate = true, .no_follow = true }); + + if (is_zig_16) { + cwd.createDirPath(io, out_bin_path) catch {}; + } else { + cwd.makePath(out_bin_path) catch {}; + } + const out_bin_dir = if (is_zig_16) + try cwd.openDir(io, out_bin_path, .{}) + else + try cwd.openDir(out_bin_path, .{}); + + if (is_zig_16) { + try Dir.copyFile(test_dir, "run.sh", out_bin_dir, "run.sh", io, .{}); + } else { + try test_dir.copyFile("run.sh", out_bin_dir, "run.sh", .{}); + } + const allocator = heap.page_allocator; var walker = try test_dir.walk(allocator); const test_step = b.step("test", "Run all libsodium tests"); if (build_tests) { - while (try walker.next(io)) |entry| { + while (if (is_zig_16) try walker.next(io) else try walker.next()) |entry| { const name = entry.basename; if (mem.endsWith(u8, name, ".exp")) { - try Dir.copyFile(test_dir, name, out_bin_dir, name, io, .{}); + if (is_zig_16) { + try Dir.copyFile(test_dir, name, out_bin_dir, name, io, .{}); + } else { + try test_dir.copyFile(name, out_bin_dir, name, .{}); + } continue; } if (!mem.endsWith(u8, name, ".c")) { diff --git a/builds/msvc/resource.rc b/builds/msvc/resource.rc index fc149b86..42d96656 100644 --- a/builds/msvc/resource.rc +++ b/builds/msvc/resource.rc @@ -4,8 +4,8 @@ #include "windows.h" //specify the version numbers for the dll's -#define LIBSODIUM_VERSION_STRING "1.0.22.0" -#define LIBSODIUM_VERSION_BIN 1,0,22,0 +#define LIBSODIUM_VERSION_STRING "1.0.23.0" +#define LIBSODIUM_VERSION_BIN 1,0,23,0 //specify the product name for the dlls based on the platform we are compiling for #if defined(x64) diff --git a/builds/msvc/version.h b/builds/msvc/version.h index 75261d83..c76915dc 100644 --- a/builds/msvc/version.h +++ b/builds/msvc/version.h @@ -4,7 +4,7 @@ #include "export.h" -#define SODIUM_VERSION_STRING "1.0.22" +#define SODIUM_VERSION_STRING "1.0.23" #define SODIUM_LIBRARY_VERSION_MAJOR 30 #define SODIUM_LIBRARY_VERSION_MINOR 0 diff --git a/builds/msvc/vs2010/libsodium/libsodium.vcxproj b/builds/msvc/vs2010/libsodium/libsodium.vcxproj index 1a9fdea3..f9816ab6 100644 --- a/builds/msvc/vs2010/libsodium/libsodium.vcxproj +++ b/builds/msvc/vs2010/libsodium/libsodium.vcxproj @@ -88,11 +88,13 @@ + + @@ -174,6 +176,7 @@ + @@ -189,9 +192,14 @@ + + + + + @@ -219,7 +227,6 @@ - @@ -231,6 +238,7 @@ + @@ -253,6 +261,7 @@ + @@ -268,6 +277,8 @@ + + @@ -296,6 +307,8 @@ + + @@ -355,7 +368,9 @@ + + diff --git a/builds/msvc/vs2010/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2010/libsodium/libsodium.vcxproj.filters index 80b49816..fc4770d8 100644 --- a/builds/msvc/vs2010/libsodium/libsodium.vcxproj.filters +++ b/builds/msvc/vs2010/libsodium/libsodium.vcxproj.filters @@ -84,6 +84,9 @@ crypto_pwhash\argon2 + + crypto_pwhash\argon2 + crypto_pwhash\argon2 @@ -99,6 +102,9 @@ crypto_pwhash\argon2 + + crypto_pwhash\argon2 + crypto_pwhash\argon2 @@ -342,6 +348,9 @@ crypto_hash\sha512\cp + + crypto_hash\sha3 + crypto_hash\sha256 @@ -387,6 +396,18 @@ crypto_aead\chacha20poly1305 + + crypto_kem + + + crypto_kem\xwing + + + crypto_kem\mlkem768 + + + crypto_kem\mlkem768\ref + crypto_secretstream\xchacha20poly1305 @@ -396,6 +417,9 @@ crypto_core\keccak1600\ref + + crypto_core\keccak1600\armsha3 + crypto_core\salsa\ref @@ -473,9 +497,6 @@ include\sodium - - include\sodium - include\sodium @@ -509,6 +530,9 @@ include\sodium + + include\sodium + include\sodium @@ -575,6 +599,9 @@ include\sodium + + include\sodium + include\sodium @@ -620,6 +647,12 @@ include\sodium + + include\sodium + + + include\sodium + include\sodium @@ -704,6 +737,12 @@ crypto_pwhash\argon2 + + crypto_pwhash\argon2 + + + crypto_pwhash\argon2 + crypto_pwhash\argon2 @@ -881,9 +920,15 @@ crypto_aead\aegis256 + + crypto_kem\mlkem768\ref + crypto_core\keccak1600\ref + + crypto_core\keccak1600\armsha3 + crypto_core\ed25519 @@ -985,6 +1030,9 @@ {85c1722f-2d65-30a8-aefb-ebf1cbfe185e} + + {855cc78f-1fe0-3ad2-a2ac-5e2b0c01c235} + {9462f285-fee0-3779-983b-2811dc621f7d} @@ -1015,6 +1063,9 @@ {8c7d8b62-7b4f-3eb9-85b7-18e8d925be14} + + {6df763e3-9707-3014-8cfe-2f9a8a83a872} + {8fb6a906-dbd6-3746-9b0f-f49e7028daec} @@ -1033,6 +1084,18 @@ {baf7d894-9298-391d-8dc2-e4c3010f5ddc} + + {b9009d4a-dd97-341d-aafb-eeeb77191a49} + + + {ab0c8a55-3e1f-307e-82be-8291a3b43735} + + + {70a10765-f8fb-3898-8514-966e48719bc4} + + + {2ef7c851-6598-3be5-88be-9ac5ec867cb0} + {898b6bd5-1360-3a34-adcd-0fade7561685} diff --git a/builds/msvc/vs2012/libsodium/libsodium.vcxproj b/builds/msvc/vs2012/libsodium/libsodium.vcxproj index 96354e31..56ec15fa 100644 --- a/builds/msvc/vs2012/libsodium/libsodium.vcxproj +++ b/builds/msvc/vs2012/libsodium/libsodium.vcxproj @@ -88,11 +88,13 @@ + + @@ -174,6 +176,7 @@ + @@ -189,9 +192,14 @@ + + + + + @@ -219,7 +227,6 @@ - @@ -231,6 +238,7 @@ + @@ -253,6 +261,7 @@ + @@ -268,6 +277,8 @@ + + @@ -296,6 +307,8 @@ + + @@ -355,7 +368,9 @@ + + diff --git a/builds/msvc/vs2012/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2012/libsodium/libsodium.vcxproj.filters index 80b49816..fc4770d8 100644 --- a/builds/msvc/vs2012/libsodium/libsodium.vcxproj.filters +++ b/builds/msvc/vs2012/libsodium/libsodium.vcxproj.filters @@ -84,6 +84,9 @@ crypto_pwhash\argon2 + + crypto_pwhash\argon2 + crypto_pwhash\argon2 @@ -99,6 +102,9 @@ crypto_pwhash\argon2 + + crypto_pwhash\argon2 + crypto_pwhash\argon2 @@ -342,6 +348,9 @@ crypto_hash\sha512\cp + + crypto_hash\sha3 + crypto_hash\sha256 @@ -387,6 +396,18 @@ crypto_aead\chacha20poly1305 + + crypto_kem + + + crypto_kem\xwing + + + crypto_kem\mlkem768 + + + crypto_kem\mlkem768\ref + crypto_secretstream\xchacha20poly1305 @@ -396,6 +417,9 @@ crypto_core\keccak1600\ref + + crypto_core\keccak1600\armsha3 + crypto_core\salsa\ref @@ -473,9 +497,6 @@ include\sodium - - include\sodium - include\sodium @@ -509,6 +530,9 @@ include\sodium + + include\sodium + include\sodium @@ -575,6 +599,9 @@ include\sodium + + include\sodium + include\sodium @@ -620,6 +647,12 @@ include\sodium + + include\sodium + + + include\sodium + include\sodium @@ -704,6 +737,12 @@ crypto_pwhash\argon2 + + crypto_pwhash\argon2 + + + crypto_pwhash\argon2 + crypto_pwhash\argon2 @@ -881,9 +920,15 @@ crypto_aead\aegis256 + + crypto_kem\mlkem768\ref + crypto_core\keccak1600\ref + + crypto_core\keccak1600\armsha3 + crypto_core\ed25519 @@ -985,6 +1030,9 @@ {85c1722f-2d65-30a8-aefb-ebf1cbfe185e} + + {855cc78f-1fe0-3ad2-a2ac-5e2b0c01c235} + {9462f285-fee0-3779-983b-2811dc621f7d} @@ -1015,6 +1063,9 @@ {8c7d8b62-7b4f-3eb9-85b7-18e8d925be14} + + {6df763e3-9707-3014-8cfe-2f9a8a83a872} + {8fb6a906-dbd6-3746-9b0f-f49e7028daec} @@ -1033,6 +1084,18 @@ {baf7d894-9298-391d-8dc2-e4c3010f5ddc} + + {b9009d4a-dd97-341d-aafb-eeeb77191a49} + + + {ab0c8a55-3e1f-307e-82be-8291a3b43735} + + + {70a10765-f8fb-3898-8514-966e48719bc4} + + + {2ef7c851-6598-3be5-88be-9ac5ec867cb0} + {898b6bd5-1360-3a34-adcd-0fade7561685} diff --git a/builds/msvc/vs2013/libsodium/libsodium.vcxproj b/builds/msvc/vs2013/libsodium/libsodium.vcxproj index be6f4d8e..2787fb75 100644 --- a/builds/msvc/vs2013/libsodium/libsodium.vcxproj +++ b/builds/msvc/vs2013/libsodium/libsodium.vcxproj @@ -88,11 +88,13 @@ + + @@ -174,6 +176,7 @@ + @@ -189,9 +192,14 @@ + + + + + @@ -219,7 +227,6 @@ - @@ -231,6 +238,7 @@ + @@ -253,6 +261,7 @@ + @@ -268,6 +277,8 @@ + + @@ -296,6 +307,8 @@ + + @@ -355,7 +368,9 @@ + + diff --git a/builds/msvc/vs2013/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2013/libsodium/libsodium.vcxproj.filters index 80b49816..fc4770d8 100644 --- a/builds/msvc/vs2013/libsodium/libsodium.vcxproj.filters +++ b/builds/msvc/vs2013/libsodium/libsodium.vcxproj.filters @@ -84,6 +84,9 @@ crypto_pwhash\argon2 + + crypto_pwhash\argon2 + crypto_pwhash\argon2 @@ -99,6 +102,9 @@ crypto_pwhash\argon2 + + crypto_pwhash\argon2 + crypto_pwhash\argon2 @@ -342,6 +348,9 @@ crypto_hash\sha512\cp + + crypto_hash\sha3 + crypto_hash\sha256 @@ -387,6 +396,18 @@ crypto_aead\chacha20poly1305 + + crypto_kem + + + crypto_kem\xwing + + + crypto_kem\mlkem768 + + + crypto_kem\mlkem768\ref + crypto_secretstream\xchacha20poly1305 @@ -396,6 +417,9 @@ crypto_core\keccak1600\ref + + crypto_core\keccak1600\armsha3 + crypto_core\salsa\ref @@ -473,9 +497,6 @@ include\sodium - - include\sodium - include\sodium @@ -509,6 +530,9 @@ include\sodium + + include\sodium + include\sodium @@ -575,6 +599,9 @@ include\sodium + + include\sodium + include\sodium @@ -620,6 +647,12 @@ include\sodium + + include\sodium + + + include\sodium + include\sodium @@ -704,6 +737,12 @@ crypto_pwhash\argon2 + + crypto_pwhash\argon2 + + + crypto_pwhash\argon2 + crypto_pwhash\argon2 @@ -881,9 +920,15 @@ crypto_aead\aegis256 + + crypto_kem\mlkem768\ref + crypto_core\keccak1600\ref + + crypto_core\keccak1600\armsha3 + crypto_core\ed25519 @@ -985,6 +1030,9 @@ {85c1722f-2d65-30a8-aefb-ebf1cbfe185e} + + {855cc78f-1fe0-3ad2-a2ac-5e2b0c01c235} + {9462f285-fee0-3779-983b-2811dc621f7d} @@ -1015,6 +1063,9 @@ {8c7d8b62-7b4f-3eb9-85b7-18e8d925be14} + + {6df763e3-9707-3014-8cfe-2f9a8a83a872} + {8fb6a906-dbd6-3746-9b0f-f49e7028daec} @@ -1033,6 +1084,18 @@ {baf7d894-9298-391d-8dc2-e4c3010f5ddc} + + {b9009d4a-dd97-341d-aafb-eeeb77191a49} + + + {ab0c8a55-3e1f-307e-82be-8291a3b43735} + + + {70a10765-f8fb-3898-8514-966e48719bc4} + + + {2ef7c851-6598-3be5-88be-9ac5ec867cb0} + {898b6bd5-1360-3a34-adcd-0fade7561685} diff --git a/builds/msvc/vs2015/libsodium/libsodium.vcxproj b/builds/msvc/vs2015/libsodium/libsodium.vcxproj index b92308c3..1c2502cd 100644 --- a/builds/msvc/vs2015/libsodium/libsodium.vcxproj +++ b/builds/msvc/vs2015/libsodium/libsodium.vcxproj @@ -88,11 +88,13 @@ + + @@ -174,6 +176,7 @@ + @@ -189,9 +192,14 @@ + + + + + @@ -219,7 +227,6 @@ - @@ -231,6 +238,7 @@ + @@ -253,6 +261,7 @@ + @@ -268,6 +277,8 @@ + + @@ -296,6 +307,8 @@ + + @@ -355,7 +368,9 @@ + + diff --git a/builds/msvc/vs2015/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2015/libsodium/libsodium.vcxproj.filters index 80b49816..fc4770d8 100644 --- a/builds/msvc/vs2015/libsodium/libsodium.vcxproj.filters +++ b/builds/msvc/vs2015/libsodium/libsodium.vcxproj.filters @@ -84,6 +84,9 @@ crypto_pwhash\argon2 + + crypto_pwhash\argon2 + crypto_pwhash\argon2 @@ -99,6 +102,9 @@ crypto_pwhash\argon2 + + crypto_pwhash\argon2 + crypto_pwhash\argon2 @@ -342,6 +348,9 @@ crypto_hash\sha512\cp + + crypto_hash\sha3 + crypto_hash\sha256 @@ -387,6 +396,18 @@ crypto_aead\chacha20poly1305 + + crypto_kem + + + crypto_kem\xwing + + + crypto_kem\mlkem768 + + + crypto_kem\mlkem768\ref + crypto_secretstream\xchacha20poly1305 @@ -396,6 +417,9 @@ crypto_core\keccak1600\ref + + crypto_core\keccak1600\armsha3 + crypto_core\salsa\ref @@ -473,9 +497,6 @@ include\sodium - - include\sodium - include\sodium @@ -509,6 +530,9 @@ include\sodium + + include\sodium + include\sodium @@ -575,6 +599,9 @@ include\sodium + + include\sodium + include\sodium @@ -620,6 +647,12 @@ include\sodium + + include\sodium + + + include\sodium + include\sodium @@ -704,6 +737,12 @@ crypto_pwhash\argon2 + + crypto_pwhash\argon2 + + + crypto_pwhash\argon2 + crypto_pwhash\argon2 @@ -881,9 +920,15 @@ crypto_aead\aegis256 + + crypto_kem\mlkem768\ref + crypto_core\keccak1600\ref + + crypto_core\keccak1600\armsha3 + crypto_core\ed25519 @@ -985,6 +1030,9 @@ {85c1722f-2d65-30a8-aefb-ebf1cbfe185e} + + {855cc78f-1fe0-3ad2-a2ac-5e2b0c01c235} + {9462f285-fee0-3779-983b-2811dc621f7d} @@ -1015,6 +1063,9 @@ {8c7d8b62-7b4f-3eb9-85b7-18e8d925be14} + + {6df763e3-9707-3014-8cfe-2f9a8a83a872} + {8fb6a906-dbd6-3746-9b0f-f49e7028daec} @@ -1033,6 +1084,18 @@ {baf7d894-9298-391d-8dc2-e4c3010f5ddc} + + {b9009d4a-dd97-341d-aafb-eeeb77191a49} + + + {ab0c8a55-3e1f-307e-82be-8291a3b43735} + + + {70a10765-f8fb-3898-8514-966e48719bc4} + + + {2ef7c851-6598-3be5-88be-9ac5ec867cb0} + {898b6bd5-1360-3a34-adcd-0fade7561685} diff --git a/builds/msvc/vs2017/libsodium/libsodium.vcxproj b/builds/msvc/vs2017/libsodium/libsodium.vcxproj index 2c3b7506..7ddc2b18 100644 --- a/builds/msvc/vs2017/libsodium/libsodium.vcxproj +++ b/builds/msvc/vs2017/libsodium/libsodium.vcxproj @@ -88,11 +88,13 @@ + + @@ -174,6 +176,7 @@ + @@ -189,9 +192,14 @@ + + + + + @@ -219,7 +227,6 @@ - @@ -231,6 +238,7 @@ + @@ -253,6 +261,7 @@ + @@ -268,6 +277,8 @@ + + @@ -296,6 +307,8 @@ + + @@ -355,7 +368,9 @@ + + diff --git a/builds/msvc/vs2017/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2017/libsodium/libsodium.vcxproj.filters index 80b49816..fc4770d8 100644 --- a/builds/msvc/vs2017/libsodium/libsodium.vcxproj.filters +++ b/builds/msvc/vs2017/libsodium/libsodium.vcxproj.filters @@ -84,6 +84,9 @@ crypto_pwhash\argon2 + + crypto_pwhash\argon2 + crypto_pwhash\argon2 @@ -99,6 +102,9 @@ crypto_pwhash\argon2 + + crypto_pwhash\argon2 + crypto_pwhash\argon2 @@ -342,6 +348,9 @@ crypto_hash\sha512\cp + + crypto_hash\sha3 + crypto_hash\sha256 @@ -387,6 +396,18 @@ crypto_aead\chacha20poly1305 + + crypto_kem + + + crypto_kem\xwing + + + crypto_kem\mlkem768 + + + crypto_kem\mlkem768\ref + crypto_secretstream\xchacha20poly1305 @@ -396,6 +417,9 @@ crypto_core\keccak1600\ref + + crypto_core\keccak1600\armsha3 + crypto_core\salsa\ref @@ -473,9 +497,6 @@ include\sodium - - include\sodium - include\sodium @@ -509,6 +530,9 @@ include\sodium + + include\sodium + include\sodium @@ -575,6 +599,9 @@ include\sodium + + include\sodium + include\sodium @@ -620,6 +647,12 @@ include\sodium + + include\sodium + + + include\sodium + include\sodium @@ -704,6 +737,12 @@ crypto_pwhash\argon2 + + crypto_pwhash\argon2 + + + crypto_pwhash\argon2 + crypto_pwhash\argon2 @@ -881,9 +920,15 @@ crypto_aead\aegis256 + + crypto_kem\mlkem768\ref + crypto_core\keccak1600\ref + + crypto_core\keccak1600\armsha3 + crypto_core\ed25519 @@ -985,6 +1030,9 @@ {85c1722f-2d65-30a8-aefb-ebf1cbfe185e} + + {855cc78f-1fe0-3ad2-a2ac-5e2b0c01c235} + {9462f285-fee0-3779-983b-2811dc621f7d} @@ -1015,6 +1063,9 @@ {8c7d8b62-7b4f-3eb9-85b7-18e8d925be14} + + {6df763e3-9707-3014-8cfe-2f9a8a83a872} + {8fb6a906-dbd6-3746-9b0f-f49e7028daec} @@ -1033,6 +1084,18 @@ {baf7d894-9298-391d-8dc2-e4c3010f5ddc} + + {b9009d4a-dd97-341d-aafb-eeeb77191a49} + + + {ab0c8a55-3e1f-307e-82be-8291a3b43735} + + + {70a10765-f8fb-3898-8514-966e48719bc4} + + + {2ef7c851-6598-3be5-88be-9ac5ec867cb0} + {898b6bd5-1360-3a34-adcd-0fade7561685} diff --git a/builds/msvc/vs2019/libsodium/libsodium.vcxproj b/builds/msvc/vs2019/libsodium/libsodium.vcxproj index 7fff9a3e..d964cd8f 100644 --- a/builds/msvc/vs2019/libsodium/libsodium.vcxproj +++ b/builds/msvc/vs2019/libsodium/libsodium.vcxproj @@ -112,11 +112,13 @@ + + @@ -198,6 +200,7 @@ + @@ -213,9 +216,14 @@ + + + + + @@ -243,7 +251,6 @@ - @@ -255,6 +262,7 @@ + @@ -277,6 +285,7 @@ + @@ -292,6 +301,8 @@ + + @@ -320,6 +331,8 @@ + + @@ -379,7 +392,9 @@ + + diff --git a/builds/msvc/vs2019/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2019/libsodium/libsodium.vcxproj.filters index 80b49816..fc4770d8 100644 --- a/builds/msvc/vs2019/libsodium/libsodium.vcxproj.filters +++ b/builds/msvc/vs2019/libsodium/libsodium.vcxproj.filters @@ -84,6 +84,9 @@ crypto_pwhash\argon2 + + crypto_pwhash\argon2 + crypto_pwhash\argon2 @@ -99,6 +102,9 @@ crypto_pwhash\argon2 + + crypto_pwhash\argon2 + crypto_pwhash\argon2 @@ -342,6 +348,9 @@ crypto_hash\sha512\cp + + crypto_hash\sha3 + crypto_hash\sha256 @@ -387,6 +396,18 @@ crypto_aead\chacha20poly1305 + + crypto_kem + + + crypto_kem\xwing + + + crypto_kem\mlkem768 + + + crypto_kem\mlkem768\ref + crypto_secretstream\xchacha20poly1305 @@ -396,6 +417,9 @@ crypto_core\keccak1600\ref + + crypto_core\keccak1600\armsha3 + crypto_core\salsa\ref @@ -473,9 +497,6 @@ include\sodium - - include\sodium - include\sodium @@ -509,6 +530,9 @@ include\sodium + + include\sodium + include\sodium @@ -575,6 +599,9 @@ include\sodium + + include\sodium + include\sodium @@ -620,6 +647,12 @@ include\sodium + + include\sodium + + + include\sodium + include\sodium @@ -704,6 +737,12 @@ crypto_pwhash\argon2 + + crypto_pwhash\argon2 + + + crypto_pwhash\argon2 + crypto_pwhash\argon2 @@ -881,9 +920,15 @@ crypto_aead\aegis256 + + crypto_kem\mlkem768\ref + crypto_core\keccak1600\ref + + crypto_core\keccak1600\armsha3 + crypto_core\ed25519 @@ -985,6 +1030,9 @@ {85c1722f-2d65-30a8-aefb-ebf1cbfe185e} + + {855cc78f-1fe0-3ad2-a2ac-5e2b0c01c235} + {9462f285-fee0-3779-983b-2811dc621f7d} @@ -1015,6 +1063,9 @@ {8c7d8b62-7b4f-3eb9-85b7-18e8d925be14} + + {6df763e3-9707-3014-8cfe-2f9a8a83a872} + {8fb6a906-dbd6-3746-9b0f-f49e7028daec} @@ -1033,6 +1084,18 @@ {baf7d894-9298-391d-8dc2-e4c3010f5ddc} + + {b9009d4a-dd97-341d-aafb-eeeb77191a49} + + + {ab0c8a55-3e1f-307e-82be-8291a3b43735} + + + {70a10765-f8fb-3898-8514-966e48719bc4} + + + {2ef7c851-6598-3be5-88be-9ac5ec867cb0} + {898b6bd5-1360-3a34-adcd-0fade7561685} diff --git a/builds/msvc/vs2022/libsodium/libsodium.vcxproj b/builds/msvc/vs2022/libsodium/libsodium.vcxproj index 84158421..8f4cf407 100644 --- a/builds/msvc/vs2022/libsodium/libsodium.vcxproj +++ b/builds/msvc/vs2022/libsodium/libsodium.vcxproj @@ -112,11 +112,13 @@ + + @@ -198,6 +200,7 @@ + @@ -213,9 +216,14 @@ + + + + + @@ -243,7 +251,6 @@ - @@ -255,6 +262,7 @@ + @@ -277,6 +285,7 @@ + @@ -292,6 +301,8 @@ + + @@ -320,6 +331,8 @@ + + @@ -379,7 +392,9 @@ + + diff --git a/builds/msvc/vs2022/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2022/libsodium/libsodium.vcxproj.filters index 80b49816..fc4770d8 100644 --- a/builds/msvc/vs2022/libsodium/libsodium.vcxproj.filters +++ b/builds/msvc/vs2022/libsodium/libsodium.vcxproj.filters @@ -84,6 +84,9 @@ crypto_pwhash\argon2 + + crypto_pwhash\argon2 + crypto_pwhash\argon2 @@ -99,6 +102,9 @@ crypto_pwhash\argon2 + + crypto_pwhash\argon2 + crypto_pwhash\argon2 @@ -342,6 +348,9 @@ crypto_hash\sha512\cp + + crypto_hash\sha3 + crypto_hash\sha256 @@ -387,6 +396,18 @@ crypto_aead\chacha20poly1305 + + crypto_kem + + + crypto_kem\xwing + + + crypto_kem\mlkem768 + + + crypto_kem\mlkem768\ref + crypto_secretstream\xchacha20poly1305 @@ -396,6 +417,9 @@ crypto_core\keccak1600\ref + + crypto_core\keccak1600\armsha3 + crypto_core\salsa\ref @@ -473,9 +497,6 @@ include\sodium - - include\sodium - include\sodium @@ -509,6 +530,9 @@ include\sodium + + include\sodium + include\sodium @@ -575,6 +599,9 @@ include\sodium + + include\sodium + include\sodium @@ -620,6 +647,12 @@ include\sodium + + include\sodium + + + include\sodium + include\sodium @@ -704,6 +737,12 @@ crypto_pwhash\argon2 + + crypto_pwhash\argon2 + + + crypto_pwhash\argon2 + crypto_pwhash\argon2 @@ -881,9 +920,15 @@ crypto_aead\aegis256 + + crypto_kem\mlkem768\ref + crypto_core\keccak1600\ref + + crypto_core\keccak1600\armsha3 + crypto_core\ed25519 @@ -985,6 +1030,9 @@ {85c1722f-2d65-30a8-aefb-ebf1cbfe185e} + + {855cc78f-1fe0-3ad2-a2ac-5e2b0c01c235} + {9462f285-fee0-3779-983b-2811dc621f7d} @@ -1015,6 +1063,9 @@ {8c7d8b62-7b4f-3eb9-85b7-18e8d925be14} + + {6df763e3-9707-3014-8cfe-2f9a8a83a872} + {8fb6a906-dbd6-3746-9b0f-f49e7028daec} @@ -1033,6 +1084,18 @@ {baf7d894-9298-391d-8dc2-e4c3010f5ddc} + + {b9009d4a-dd97-341d-aafb-eeeb77191a49} + + + {ab0c8a55-3e1f-307e-82be-8291a3b43735} + + + {70a10765-f8fb-3898-8514-966e48719bc4} + + + {2ef7c851-6598-3be5-88be-9ac5ec867cb0} + {898b6bd5-1360-3a34-adcd-0fade7561685} diff --git a/builds/msvc/vs2026/libsodium/libsodium.vcxproj b/builds/msvc/vs2026/libsodium/libsodium.vcxproj index ff60bfd5..915f2094 100644 --- a/builds/msvc/vs2026/libsodium/libsodium.vcxproj +++ b/builds/msvc/vs2026/libsodium/libsodium.vcxproj @@ -112,11 +112,13 @@ + + @@ -198,6 +200,7 @@ + @@ -213,9 +216,14 @@ + + + + + @@ -243,7 +251,6 @@ - @@ -255,6 +262,7 @@ + @@ -277,6 +285,7 @@ + @@ -292,6 +301,8 @@ + + @@ -320,6 +331,8 @@ + + @@ -379,7 +392,9 @@ + + diff --git a/builds/msvc/vs2026/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2026/libsodium/libsodium.vcxproj.filters index 80b49816..fc4770d8 100644 --- a/builds/msvc/vs2026/libsodium/libsodium.vcxproj.filters +++ b/builds/msvc/vs2026/libsodium/libsodium.vcxproj.filters @@ -84,6 +84,9 @@ crypto_pwhash\argon2 + + crypto_pwhash\argon2 + crypto_pwhash\argon2 @@ -99,6 +102,9 @@ crypto_pwhash\argon2 + + crypto_pwhash\argon2 + crypto_pwhash\argon2 @@ -342,6 +348,9 @@ crypto_hash\sha512\cp + + crypto_hash\sha3 + crypto_hash\sha256 @@ -387,6 +396,18 @@ crypto_aead\chacha20poly1305 + + crypto_kem + + + crypto_kem\xwing + + + crypto_kem\mlkem768 + + + crypto_kem\mlkem768\ref + crypto_secretstream\xchacha20poly1305 @@ -396,6 +417,9 @@ crypto_core\keccak1600\ref + + crypto_core\keccak1600\armsha3 + crypto_core\salsa\ref @@ -473,9 +497,6 @@ include\sodium - - include\sodium - include\sodium @@ -509,6 +530,9 @@ include\sodium + + include\sodium + include\sodium @@ -575,6 +599,9 @@ include\sodium + + include\sodium + include\sodium @@ -620,6 +647,12 @@ include\sodium + + include\sodium + + + include\sodium + include\sodium @@ -704,6 +737,12 @@ crypto_pwhash\argon2 + + crypto_pwhash\argon2 + + + crypto_pwhash\argon2 + crypto_pwhash\argon2 @@ -881,9 +920,15 @@ crypto_aead\aegis256 + + crypto_kem\mlkem768\ref + crypto_core\keccak1600\ref + + crypto_core\keccak1600\armsha3 + crypto_core\ed25519 @@ -985,6 +1030,9 @@ {85c1722f-2d65-30a8-aefb-ebf1cbfe185e} + + {855cc78f-1fe0-3ad2-a2ac-5e2b0c01c235} + {9462f285-fee0-3779-983b-2811dc621f7d} @@ -1015,6 +1063,9 @@ {8c7d8b62-7b4f-3eb9-85b7-18e8d925be14} + + {6df763e3-9707-3014-8cfe-2f9a8a83a872} + {8fb6a906-dbd6-3746-9b0f-f49e7028daec} @@ -1033,6 +1084,18 @@ {baf7d894-9298-391d-8dc2-e4c3010f5ddc} + + {b9009d4a-dd97-341d-aafb-eeeb77191a49} + + + {ab0c8a55-3e1f-307e-82be-8291a3b43735} + + + {70a10765-f8fb-3898-8514-966e48719bc4} + + + {2ef7c851-6598-3be5-88be-9ac5ec867cb0} + {898b6bd5-1360-3a34-adcd-0fade7561685} diff --git a/ci/appveyor/libsodium.vcxproj b/ci/appveyor/libsodium.vcxproj index 840e3248..347feeb7 100644 --- a/ci/appveyor/libsodium.vcxproj +++ b/ci/appveyor/libsodium.vcxproj @@ -336,11 +336,13 @@ + + @@ -422,6 +424,7 @@ + @@ -437,9 +440,14 @@ + + + + + @@ -467,7 +475,6 @@ - @@ -479,6 +486,7 @@ + @@ -501,6 +509,7 @@ + @@ -516,6 +525,8 @@ + + @@ -544,6 +555,8 @@ + + @@ -603,7 +616,9 @@ + + diff --git a/ci/appveyor/libsodium.vcxproj.filters b/ci/appveyor/libsodium.vcxproj.filters index 8d747b1e..469c8d9e 100644 --- a/ci/appveyor/libsodium.vcxproj.filters +++ b/ci/appveyor/libsodium.vcxproj.filters @@ -75,6 +75,9 @@ Source Files + + Source Files + Source Files @@ -90,6 +93,9 @@ Source Files + + Source Files + Source Files @@ -333,6 +339,9 @@ Source Files + + Source Files + Source Files @@ -378,6 +387,18 @@ Source Files + + Source Files + + + Source Files + + + Source Files + + + Source Files + Source Files @@ -387,6 +408,9 @@ Source Files + + Source Files + Source Files @@ -464,9 +488,6 @@ Header Files - - Header Files - Header Files @@ -500,6 +521,9 @@ Header Files + + Header Files + Header Files @@ -566,6 +590,9 @@ Header Files + + Header Files + Header Files @@ -611,6 +638,12 @@ Header Files + + Header Files + + + Header Files + Header Files @@ -695,6 +728,12 @@ Header Files + + Header Files + + + Header Files + Header Files @@ -872,9 +911,15 @@ Header Files + + Header Files + Header Files + + Header Files + Header Files diff --git a/ci/appveyor/msvc-scripts/process.bat b/ci/appveyor/msvc-scripts/process.bat index 8bf7b635..864930de 100755 --- a/ci/appveyor/msvc-scripts/process.bat +++ b/ci/appveyor/msvc-scripts/process.bat @@ -1,4 +1,4 @@ -cscript msvc-scripts/rep.vbs //Nologo s/@VERSION@/1.0.22/ < ..\..\src\libsodium\include\sodium\version.h.in > tmp +cscript msvc-scripts/rep.vbs //Nologo s/@VERSION@/1.0.23/ < ..\..\src\libsodium\include\sodium\version.h.in > tmp cscript msvc-scripts/rep.vbs //Nologo s/@SODIUM_LIBRARY_VERSION_MAJOR@/30/ < tmp > tmp2 cscript msvc-scripts/rep.vbs //Nologo s/@SODIUM_LIBRARY_VERSION_MINOR@/0/ < tmp2 > tmp3 cscript msvc-scripts/rep.vbs //Nologo s/@SODIUM_LIBRARY_MINIMAL_DEF@// < tmp3 > ..\..\src\libsodium\include\sodium\version.h diff --git a/configure.ac b/configure.ac index 6fd60ae7..ac378f13 100644 --- a/configure.ac +++ b/configure.ac @@ -1,5 +1,5 @@ AC_PREREQ([2.69]) -AC_INIT([libsodium],[1.0.22],[https://github.com/jedisct1/libsodium/issues],[libsodium],[https://libsodium.org]) +AC_INIT([libsodium],[1.0.23],[https://github.com/jedisct1/libsodium/issues],[libsodium],[https://libsodium.org]) AC_CONFIG_AUX_DIR([build-aux]) AC_CONFIG_MACRO_DIR([m4]) AC_CONFIG_SRCDIR([src/libsodium/sodium/version.c]) @@ -994,7 +994,7 @@ AC_SUBST([LIBTOOL_EXTRA_FLAGS]) TEST_LDFLAGS='' AS_IF([test "x$EMSCRIPTEN" != "x"],[ EXEEXT=.js - TEST_LDFLAGS='--pre-js pre.js.inc -s RESERVED_FUNCTION_POINTERS=8' + TEST_LDFLAGS='--pre-js pre.js.inc -sALLOW_TABLE_GROWTH' ]) AC_SUBST(TEST_LDFLAGS) AM_CONDITIONAL([EMSCRIPTEN], [test "x$EMSCRIPTEN" != "x"]) diff --git a/dist-build/android-aar.sh b/dist-build/android-aar.sh index 2984ebea..9accdae2 100755 --- a/dist-build/android-aar.sh +++ b/dist-build/android-aar.sh @@ -4,7 +4,7 @@ # # To simplify linking, library variants have distinct names: sodium, sodium-static, sodium-minimal and sodium-minimal-static. -SODIUM_VERSION="1.0.22.0" +SODIUM_VERSION="1.0.23.0" if [ -z "$ANDROID_NDK_HOME" ]; then echo "ANDROID_NDK_HOME must be set to the directory containing the Android NDK." diff --git a/dist-build/apple-xcframework.sh b/dist-build/apple-xcframework.sh index b805cbd2..9e3186ff 100755 --- a/dist-build/apple-xcframework.sh +++ b/dist-build/apple-xcframework.sh @@ -71,6 +71,21 @@ swift_module_map() { echo '}' } +# Move headers into a Clibsodium subdirectory to avoid module.modulemap collisions +# when multiple xcframeworks are used together (see swift-sodium issue #276) +reorganize_headers() { + local include_dir="$1" + if [ -d "$include_dir" ] && [ ! -d "$include_dir/Clibsodium" ]; then + mkdir -p "$include_dir/Clibsodium" + # Move all files and directories (except Clibsodium itself) into Clibsodium/ + for item in "$include_dir"/*; do + if [ "$(basename "$item")" != "Clibsodium" ]; then + mv "$item" "$include_dir/Clibsodium/" + fi + done + fi +} + build_macos() { export BASEDIR="${XCODEDIR}/Platforms/MacOSX.platform/Developer" export PATH="${BASEDIR}/usr/bin:$BASEDIR/usr/sbin:$PATH" @@ -420,6 +435,7 @@ echo "Bundling macOS targets..." mkdir -p "${PREFIX}/macos/lib" cp -a "${MACOS_X86_64_PREFIX}/include" "${PREFIX}/macos/" +reorganize_headers "${PREFIX}/macos/include" for ext in a dylib; do lipo -create \ "${MACOS_ARM64_PREFIX}/lib/libsodium.${ext}" \ @@ -432,6 +448,7 @@ echo "Bundling iOS targets..." mkdir -p "${PREFIX}/ios/lib" cp -a "${IOS64_PREFIX}/include" "${PREFIX}/ios/" +reorganize_headers "${PREFIX}/ios/include" for ext in a dylib; do LIBRARY_PATHS="$IOS64_PREFIX/lib/libsodium.${ext}" LIBRARY_PATHS="$LIBRARY_PATHS $IOS64E_PREFIX/lib/libsodium.${ext}" @@ -444,6 +461,7 @@ echo "Bundling watchOS targets..." mkdir -p "${PREFIX}/watchos/lib" cp -a "${WATCHOS64_32_PREFIX}/include" "${PREFIX}/watchos/" +reorganize_headers "${PREFIX}/watchos/include" for ext in a dylib; do lipo -create \ "${WATCHOS32_PREFIX}/lib/libsodium.${ext}" \ @@ -457,6 +475,7 @@ echo "Bundling tvOS targets..." mkdir -p "${PREFIX}/tvos/lib" cp -a "${TVOS_PREFIX}/include" "${PREFIX}/tvos/" +reorganize_headers "${PREFIX}/tvos/include" for ext in a dylib; do lipo -create \ "$TVOS_PREFIX/lib/libsodium.${ext}" \ @@ -469,6 +488,7 @@ if [ "$VISIONOS_SUPPORTED" = true ]; then mkdir -p "${PREFIX}/visionos/lib" cp -a "${VISIONOS_PREFIX}/include" "${PREFIX}/visionos/" + reorganize_headers "${PREFIX}/visionos/include" for ext in a dylib; do lipo -create \ "$VISIONOS_PREFIX/lib/libsodium.${ext}" \ @@ -481,6 +501,7 @@ echo "Bundling Catalyst targets..." mkdir -p "${PREFIX}/catalyst/lib" cp -a "${CATALYST_X86_64_PREFIX}/include" "${PREFIX}/catalyst/" +reorganize_headers "${PREFIX}/catalyst/include" for ext in a dylib; do if [ ! -f "${CATALYST_X86_64_PREFIX}/lib/libsodium.${ext}" ]; then continue @@ -497,6 +518,7 @@ if [ -z "$LIBSODIUM_SKIP_SIMULATORS" ]; then mkdir -p "${PREFIX}/ios-simulators/lib" cp -a "${IOS_SIMULATOR_X86_64_PREFIX}/include" "${PREFIX}/ios-simulators/" + reorganize_headers "${PREFIX}/ios-simulators/include" for ext in a dylib; do LIBRARY_PATHS="${IOS_SIMULATOR_ARM64_PREFIX}/lib/libsodium.${ext}" LIBRARY_PATHS="$LIBRARY_PATHS ${IOS_SIMULATOR_ARM64E_PREFIX}/lib/libsodium.${ext}" @@ -510,6 +532,7 @@ if [ -z "$LIBSODIUM_SKIP_SIMULATORS" ]; then mkdir -p "${PREFIX}/watchos-simulators/lib" cp -a "${WATCHOS_SIMULATOR_X86_64_PREFIX}/include" "${PREFIX}/watchos-simulators/" + reorganize_headers "${PREFIX}/watchos-simulators/include" for ext in a dylib; do lipo -create \ "${WATCHOS_SIMULATOR_ARM64_PREFIX}/lib/libsodium.${ext}" \ @@ -523,6 +546,7 @@ if [ -z "$LIBSODIUM_SKIP_SIMULATORS" ]; then mkdir -p "${PREFIX}/tvos-simulators/lib" cp -a "${TVOS_SIMULATOR_X86_64_PREFIX}/include" "${PREFIX}/tvos-simulators/" + reorganize_headers "${PREFIX}/tvos-simulators/include" for ext in a dylib; do lipo -create \ "${TVOS_SIMULATOR_ARM64_PREFIX}/lib/libsodium.${ext}" \ @@ -536,6 +560,7 @@ if [ -z "$LIBSODIUM_SKIP_SIMULATORS" ]; then mkdir -p "${PREFIX}/visionos-simulators/lib" cp -a "${VISIONOS_SIMULATOR_PREFIX}/include" "${PREFIX}/visionos-simulators/" + reorganize_headers "${PREFIX}/visionos-simulators/include" for ext in a dylib; do lipo -create \ "${VISIONOS_SIMULATOR_PREFIX}/lib/libsodium.${ext}" \ diff --git a/dist-build/emscripten-symbols.def b/dist-build/emscripten-symbols.def index 0efb6d11..1d7b33d1 100644 --- a/dist-build/emscripten-symbols.def +++ b/dist-build/emscripten-symbols.def @@ -288,6 +288,7 @@ _crypto_ipcrypt_nd_decrypt 1 1 _crypto_ipcrypt_nd_encrypt 1 1 _crypto_ipcrypt_nd_inputbytes 1 1 _crypto_ipcrypt_nd_keybytes 1 1 +_crypto_ipcrypt_nd_keygen 1 1 _crypto_ipcrypt_nd_outputbytes 1 1 _crypto_ipcrypt_nd_tweakbytes 1 1 _crypto_ipcrypt_ndx_decrypt 1 1 diff --git a/dist-build/emscripten.sh b/dist-build/emscripten.sh index c8712623..ecfe7817 100755 --- a/dist-build/emscripten.sh +++ b/dist-build/emscripten.sh @@ -1,26 +1,50 @@ #! /bin/sh export MAKE_FLAGS='-j4' -export EXPORTED_FUNCTIONS_STANDARD='["_malloc","_free","_crypto_aead_aegis128l_abytes","_crypto_aead_aegis128l_decrypt","_crypto_aead_aegis128l_decrypt_detached","_crypto_aead_aegis128l_encrypt","_crypto_aead_aegis128l_encrypt_detached","_crypto_aead_aegis128l_keybytes","_crypto_aead_aegis128l_keygen","_crypto_aead_aegis128l_messagebytes_max","_crypto_aead_aegis128l_npubbytes","_crypto_aead_aegis128l_nsecbytes","_crypto_aead_aegis256_abytes","_crypto_aead_aegis256_decrypt","_crypto_aead_aegis256_decrypt_detached","_crypto_aead_aegis256_encrypt","_crypto_aead_aegis256_encrypt_detached","_crypto_aead_aegis256_keybytes","_crypto_aead_aegis256_keygen","_crypto_aead_aegis256_messagebytes_max","_crypto_aead_aegis256_npubbytes","_crypto_aead_aegis256_nsecbytes","_crypto_aead_aes256gcm_is_available","_crypto_aead_chacha20poly1305_abytes","_crypto_aead_chacha20poly1305_decrypt","_crypto_aead_chacha20poly1305_decrypt_detached","_crypto_aead_chacha20poly1305_encrypt","_crypto_aead_chacha20poly1305_encrypt_detached","_crypto_aead_chacha20poly1305_ietf_abytes","_crypto_aead_chacha20poly1305_ietf_decrypt","_crypto_aead_chacha20poly1305_ietf_decrypt_detached","_crypto_aead_chacha20poly1305_ietf_encrypt","_crypto_aead_chacha20poly1305_ietf_encrypt_detached","_crypto_aead_chacha20poly1305_ietf_keybytes","_crypto_aead_chacha20poly1305_ietf_keygen","_crypto_aead_chacha20poly1305_ietf_messagebytes_max","_crypto_aead_chacha20poly1305_ietf_npubbytes","_crypto_aead_chacha20poly1305_ietf_nsecbytes","_crypto_aead_chacha20poly1305_keybytes","_crypto_aead_chacha20poly1305_keygen","_crypto_aead_chacha20poly1305_messagebytes_max","_crypto_aead_chacha20poly1305_npubbytes","_crypto_aead_chacha20poly1305_nsecbytes","_crypto_aead_xchacha20poly1305_ietf_abytes","_crypto_aead_xchacha20poly1305_ietf_decrypt","_crypto_aead_xchacha20poly1305_ietf_decrypt_detached","_crypto_aead_xchacha20poly1305_ietf_encrypt","_crypto_aead_xchacha20poly1305_ietf_encrypt_detached","_crypto_aead_xchacha20poly1305_ietf_keybytes","_crypto_aead_xchacha20poly1305_ietf_keygen","_crypto_aead_xchacha20poly1305_ietf_messagebytes_max","_crypto_aead_xchacha20poly1305_ietf_npubbytes","_crypto_aead_xchacha20poly1305_ietf_nsecbytes","_crypto_auth","_crypto_auth_bytes","_crypto_auth_keybytes","_crypto_auth_keygen","_crypto_auth_verify","_crypto_box_beforenm","_crypto_box_beforenmbytes","_crypto_box_detached","_crypto_box_detached_afternm","_crypto_box_easy","_crypto_box_easy_afternm","_crypto_box_keypair","_crypto_box_macbytes","_crypto_box_messagebytes_max","_crypto_box_noncebytes","_crypto_box_open_detached","_crypto_box_open_detached_afternm","_crypto_box_open_easy","_crypto_box_open_easy_afternm","_crypto_box_publickeybytes","_crypto_box_seal","_crypto_box_seal_open","_crypto_box_sealbytes","_crypto_box_secretkeybytes","_crypto_box_seed_keypair","_crypto_box_seedbytes","_crypto_generichash","_crypto_generichash_bytes","_crypto_generichash_bytes_max","_crypto_generichash_bytes_min","_crypto_generichash_final","_crypto_generichash_init","_crypto_generichash_keybytes","_crypto_generichash_keybytes_max","_crypto_generichash_keybytes_min","_crypto_generichash_keygen","_crypto_generichash_statebytes","_crypto_generichash_update","_crypto_hash","_crypto_hash_bytes","_crypto_ipcrypt_bytes","_crypto_ipcrypt_decrypt","_crypto_ipcrypt_encrypt","_crypto_ipcrypt_keybytes","_crypto_ipcrypt_keygen","_crypto_ipcrypt_nd_decrypt","_crypto_ipcrypt_nd_encrypt","_crypto_ipcrypt_nd_inputbytes","_crypto_ipcrypt_nd_keybytes","_crypto_ipcrypt_nd_outputbytes","_crypto_ipcrypt_nd_tweakbytes","_crypto_ipcrypt_ndx_decrypt","_crypto_ipcrypt_ndx_encrypt","_crypto_ipcrypt_ndx_inputbytes","_crypto_ipcrypt_ndx_keybytes","_crypto_ipcrypt_ndx_keygen","_crypto_ipcrypt_ndx_outputbytes","_crypto_ipcrypt_ndx_tweakbytes","_crypto_ipcrypt_pfx_bytes","_crypto_ipcrypt_pfx_decrypt","_crypto_ipcrypt_pfx_encrypt","_crypto_ipcrypt_pfx_keybytes","_crypto_ipcrypt_pfx_keygen","_crypto_kdf_bytes_max","_crypto_kdf_bytes_min","_crypto_kdf_contextbytes","_crypto_kdf_derive_from_key","_crypto_kdf_hkdf_sha256_bytes_max","_crypto_kdf_hkdf_sha256_bytes_min","_crypto_kdf_hkdf_sha256_expand","_crypto_kdf_hkdf_sha256_extract","_crypto_kdf_hkdf_sha256_extract_final","_crypto_kdf_hkdf_sha256_extract_init","_crypto_kdf_hkdf_sha256_extract_update","_crypto_kdf_hkdf_sha256_keybytes","_crypto_kdf_hkdf_sha256_keygen","_crypto_kdf_hkdf_sha256_statebytes","_crypto_kdf_hkdf_sha512_bytes_max","_crypto_kdf_hkdf_sha512_bytes_min","_crypto_kdf_hkdf_sha512_expand","_crypto_kdf_hkdf_sha512_extract","_crypto_kdf_hkdf_sha512_extract_final","_crypto_kdf_hkdf_sha512_extract_init","_crypto_kdf_hkdf_sha512_extract_update","_crypto_kdf_hkdf_sha512_keybytes","_crypto_kdf_hkdf_sha512_keygen","_crypto_kdf_hkdf_sha512_statebytes","_crypto_kdf_keybytes","_crypto_kdf_keygen","_crypto_kem_mlkem768_ciphertextbytes","_crypto_kem_mlkem768_dec","_crypto_kem_mlkem768_enc","_crypto_kem_mlkem768_enc_deterministic","_crypto_kem_mlkem768_keypair","_crypto_kem_mlkem768_publickeybytes","_crypto_kem_mlkem768_secretkeybytes","_crypto_kem_mlkem768_seed_keypair","_crypto_kem_mlkem768_seedbytes","_crypto_kem_mlkem768_sharedsecretbytes","_crypto_kx_client_session_keys","_crypto_kx_keypair","_crypto_kx_publickeybytes","_crypto_kx_secretkeybytes","_crypto_kx_seed_keypair","_crypto_kx_seedbytes","_crypto_kx_server_session_keys","_crypto_kx_sessionkeybytes","_crypto_scalarmult","_crypto_scalarmult_base","_crypto_scalarmult_bytes","_crypto_scalarmult_scalarbytes","_crypto_secretbox_detached","_crypto_secretbox_easy","_crypto_secretbox_keybytes","_crypto_secretbox_keygen","_crypto_secretbox_macbytes","_crypto_secretbox_messagebytes_max","_crypto_secretbox_noncebytes","_crypto_secretbox_open_detached","_crypto_secretbox_open_easy","_crypto_secretstream_xchacha20poly1305_abytes","_crypto_secretstream_xchacha20poly1305_headerbytes","_crypto_secretstream_xchacha20poly1305_init_pull","_crypto_secretstream_xchacha20poly1305_init_push","_crypto_secretstream_xchacha20poly1305_keybytes","_crypto_secretstream_xchacha20poly1305_keygen","_crypto_secretstream_xchacha20poly1305_messagebytes_max","_crypto_secretstream_xchacha20poly1305_pull","_crypto_secretstream_xchacha20poly1305_push","_crypto_secretstream_xchacha20poly1305_rekey","_crypto_secretstream_xchacha20poly1305_statebytes","_crypto_secretstream_xchacha20poly1305_tag_final","_crypto_secretstream_xchacha20poly1305_tag_message","_crypto_secretstream_xchacha20poly1305_tag_push","_crypto_secretstream_xchacha20poly1305_tag_rekey","_crypto_shorthash","_crypto_shorthash_bytes","_crypto_shorthash_keybytes","_crypto_shorthash_keygen","_crypto_sign","_crypto_sign_bytes","_crypto_sign_detached","_crypto_sign_ed25519_pk_to_curve25519","_crypto_sign_ed25519_sk_to_curve25519","_crypto_sign_final_create","_crypto_sign_final_verify","_crypto_sign_init","_crypto_sign_keypair","_crypto_sign_messagebytes_max","_crypto_sign_open","_crypto_sign_publickeybytes","_crypto_sign_secretkeybytes","_crypto_sign_seed_keypair","_crypto_sign_seedbytes","_crypto_sign_statebytes","_crypto_sign_update","_crypto_sign_verify_detached","_crypto_xof_shake128","_crypto_xof_shake128_blockbytes","_crypto_xof_shake128_domain_standard","_crypto_xof_shake128_init","_crypto_xof_shake128_init_with_domain","_crypto_xof_shake128_squeeze","_crypto_xof_shake128_statebytes","_crypto_xof_shake128_update","_crypto_xof_shake256","_crypto_xof_shake256_blockbytes","_crypto_xof_shake256_domain_standard","_crypto_xof_shake256_init","_crypto_xof_shake256_init_with_domain","_crypto_xof_shake256_squeeze","_crypto_xof_shake256_statebytes","_crypto_xof_shake256_update","_crypto_xof_turboshake128","_crypto_xof_turboshake128_blockbytes","_crypto_xof_turboshake128_domain_standard","_crypto_xof_turboshake128_init","_crypto_xof_turboshake128_init_with_domain","_crypto_xof_turboshake128_squeeze","_crypto_xof_turboshake128_statebytes","_crypto_xof_turboshake128_update","_crypto_xof_turboshake256","_crypto_xof_turboshake256_blockbytes","_crypto_xof_turboshake256_domain_standard","_crypto_xof_turboshake256_init","_crypto_xof_turboshake256_init_with_domain","_crypto_xof_turboshake256_squeeze","_crypto_xof_turboshake256_statebytes","_crypto_xof_turboshake256_update","_randombytes","_randombytes_buf","_randombytes_buf_deterministic","_randombytes_close","_randombytes_random","_randombytes_seedbytes","_randombytes_stir","_randombytes_uniform","_sodium_base64_encoded_len","_sodium_base642bin","_sodium_bin2base64","_sodium_bin2hex","_sodium_bin2ip","_sodium_hex2bin","_sodium_init","_sodium_ip2bin","_sodium_library_minimal","_sodium_library_version_major","_sodium_library_version_minor","_sodium_pad","_sodium_unpad","_sodium_version_string"]' -export EXPORTED_FUNCTIONS_SUMO='["_malloc","_free","_crypto_aead_aegis128l_abytes","_crypto_aead_aegis128l_decrypt","_crypto_aead_aegis128l_decrypt_detached","_crypto_aead_aegis128l_encrypt","_crypto_aead_aegis128l_encrypt_detached","_crypto_aead_aegis128l_keybytes","_crypto_aead_aegis128l_keygen","_crypto_aead_aegis128l_messagebytes_max","_crypto_aead_aegis128l_npubbytes","_crypto_aead_aegis128l_nsecbytes","_crypto_aead_aegis256_abytes","_crypto_aead_aegis256_decrypt","_crypto_aead_aegis256_decrypt_detached","_crypto_aead_aegis256_encrypt","_crypto_aead_aegis256_encrypt_detached","_crypto_aead_aegis256_keybytes","_crypto_aead_aegis256_keygen","_crypto_aead_aegis256_messagebytes_max","_crypto_aead_aegis256_npubbytes","_crypto_aead_aegis256_nsecbytes","_crypto_aead_aes256gcm_is_available","_crypto_aead_chacha20poly1305_abytes","_crypto_aead_chacha20poly1305_decrypt","_crypto_aead_chacha20poly1305_decrypt_detached","_crypto_aead_chacha20poly1305_encrypt","_crypto_aead_chacha20poly1305_encrypt_detached","_crypto_aead_chacha20poly1305_ietf_abytes","_crypto_aead_chacha20poly1305_ietf_decrypt","_crypto_aead_chacha20poly1305_ietf_decrypt_detached","_crypto_aead_chacha20poly1305_ietf_encrypt","_crypto_aead_chacha20poly1305_ietf_encrypt_detached","_crypto_aead_chacha20poly1305_ietf_keybytes","_crypto_aead_chacha20poly1305_ietf_keygen","_crypto_aead_chacha20poly1305_ietf_messagebytes_max","_crypto_aead_chacha20poly1305_ietf_npubbytes","_crypto_aead_chacha20poly1305_ietf_nsecbytes","_crypto_aead_chacha20poly1305_keybytes","_crypto_aead_chacha20poly1305_keygen","_crypto_aead_chacha20poly1305_messagebytes_max","_crypto_aead_chacha20poly1305_npubbytes","_crypto_aead_chacha20poly1305_nsecbytes","_crypto_aead_xchacha20poly1305_ietf_abytes","_crypto_aead_xchacha20poly1305_ietf_decrypt","_crypto_aead_xchacha20poly1305_ietf_decrypt_detached","_crypto_aead_xchacha20poly1305_ietf_encrypt","_crypto_aead_xchacha20poly1305_ietf_encrypt_detached","_crypto_aead_xchacha20poly1305_ietf_keybytes","_crypto_aead_xchacha20poly1305_ietf_keygen","_crypto_aead_xchacha20poly1305_ietf_messagebytes_max","_crypto_aead_xchacha20poly1305_ietf_npubbytes","_crypto_aead_xchacha20poly1305_ietf_nsecbytes","_crypto_auth","_crypto_auth_bytes","_crypto_auth_hmacsha256","_crypto_auth_hmacsha256_bytes","_crypto_auth_hmacsha256_final","_crypto_auth_hmacsha256_init","_crypto_auth_hmacsha256_keybytes","_crypto_auth_hmacsha256_keygen","_crypto_auth_hmacsha256_statebytes","_crypto_auth_hmacsha256_update","_crypto_auth_hmacsha256_verify","_crypto_auth_hmacsha512","_crypto_auth_hmacsha512_bytes","_crypto_auth_hmacsha512_final","_crypto_auth_hmacsha512_init","_crypto_auth_hmacsha512_keybytes","_crypto_auth_hmacsha512_keygen","_crypto_auth_hmacsha512_statebytes","_crypto_auth_hmacsha512_update","_crypto_auth_hmacsha512_verify","_crypto_auth_hmacsha512256","_crypto_auth_hmacsha512256_bytes","_crypto_auth_hmacsha512256_final","_crypto_auth_hmacsha512256_init","_crypto_auth_hmacsha512256_keybytes","_crypto_auth_hmacsha512256_keygen","_crypto_auth_hmacsha512256_statebytes","_crypto_auth_hmacsha512256_update","_crypto_auth_hmacsha512256_verify","_crypto_auth_keybytes","_crypto_auth_keygen","_crypto_auth_primitive","_crypto_auth_verify","_crypto_box","_crypto_box_afternm","_crypto_box_beforenm","_crypto_box_beforenmbytes","_crypto_box_boxzerobytes","_crypto_box_curve25519xchacha20poly1305_beforenm","_crypto_box_curve25519xchacha20poly1305_beforenmbytes","_crypto_box_curve25519xchacha20poly1305_detached","_crypto_box_curve25519xchacha20poly1305_detached_afternm","_crypto_box_curve25519xchacha20poly1305_easy","_crypto_box_curve25519xchacha20poly1305_easy_afternm","_crypto_box_curve25519xchacha20poly1305_keypair","_crypto_box_curve25519xchacha20poly1305_macbytes","_crypto_box_curve25519xchacha20poly1305_messagebytes_max","_crypto_box_curve25519xchacha20poly1305_noncebytes","_crypto_box_curve25519xchacha20poly1305_open_detached","_crypto_box_curve25519xchacha20poly1305_open_detached_afternm","_crypto_box_curve25519xchacha20poly1305_open_easy","_crypto_box_curve25519xchacha20poly1305_open_easy_afternm","_crypto_box_curve25519xchacha20poly1305_publickeybytes","_crypto_box_curve25519xchacha20poly1305_seal","_crypto_box_curve25519xchacha20poly1305_seal_open","_crypto_box_curve25519xchacha20poly1305_sealbytes","_crypto_box_curve25519xchacha20poly1305_secretkeybytes","_crypto_box_curve25519xchacha20poly1305_seed_keypair","_crypto_box_curve25519xchacha20poly1305_seedbytes","_crypto_box_curve25519xsalsa20poly1305","_crypto_box_curve25519xsalsa20poly1305_afternm","_crypto_box_curve25519xsalsa20poly1305_beforenm","_crypto_box_curve25519xsalsa20poly1305_beforenmbytes","_crypto_box_curve25519xsalsa20poly1305_boxzerobytes","_crypto_box_curve25519xsalsa20poly1305_keypair","_crypto_box_curve25519xsalsa20poly1305_macbytes","_crypto_box_curve25519xsalsa20poly1305_messagebytes_max","_crypto_box_curve25519xsalsa20poly1305_noncebytes","_crypto_box_curve25519xsalsa20poly1305_open","_crypto_box_curve25519xsalsa20poly1305_open_afternm","_crypto_box_curve25519xsalsa20poly1305_publickeybytes","_crypto_box_curve25519xsalsa20poly1305_secretkeybytes","_crypto_box_curve25519xsalsa20poly1305_seed_keypair","_crypto_box_curve25519xsalsa20poly1305_seedbytes","_crypto_box_curve25519xsalsa20poly1305_zerobytes","_crypto_box_detached","_crypto_box_detached_afternm","_crypto_box_easy","_crypto_box_easy_afternm","_crypto_box_keypair","_crypto_box_macbytes","_crypto_box_messagebytes_max","_crypto_box_noncebytes","_crypto_box_open","_crypto_box_open_afternm","_crypto_box_open_detached","_crypto_box_open_detached_afternm","_crypto_box_open_easy","_crypto_box_open_easy_afternm","_crypto_box_primitive","_crypto_box_publickeybytes","_crypto_box_seal","_crypto_box_seal_open","_crypto_box_sealbytes","_crypto_box_secretkeybytes","_crypto_box_seed_keypair","_crypto_box_seedbytes","_crypto_box_zerobytes","_crypto_core_ed25519_add","_crypto_core_ed25519_bytes","_crypto_core_ed25519_from_string","_crypto_core_ed25519_from_string_ro","_crypto_core_ed25519_hashbytes","_crypto_core_ed25519_is_valid_point","_crypto_core_ed25519_nonreducedscalarbytes","_crypto_core_ed25519_random","_crypto_core_ed25519_scalar_add","_crypto_core_ed25519_scalar_complement","_crypto_core_ed25519_scalar_invert","_crypto_core_ed25519_scalar_is_canonical","_crypto_core_ed25519_scalar_mul","_crypto_core_ed25519_scalar_negate","_crypto_core_ed25519_scalar_random","_crypto_core_ed25519_scalar_reduce","_crypto_core_ed25519_scalar_sub","_crypto_core_ed25519_scalarbytes","_crypto_core_ed25519_sub","_crypto_core_ed25519_uniformbytes","_crypto_core_hchacha20","_crypto_core_hchacha20_constbytes","_crypto_core_hchacha20_inputbytes","_crypto_core_hchacha20_keybytes","_crypto_core_hchacha20_outputbytes","_crypto_core_hsalsa20","_crypto_core_hsalsa20_constbytes","_crypto_core_hsalsa20_inputbytes","_crypto_core_hsalsa20_keybytes","_crypto_core_hsalsa20_outputbytes","_crypto_core_keccak1600_extract_bytes","_crypto_core_keccak1600_init","_crypto_core_keccak1600_permute_12","_crypto_core_keccak1600_permute_24","_crypto_core_keccak1600_statebytes","_crypto_core_keccak1600_xor_bytes","_crypto_core_ristretto255_add","_crypto_core_ristretto255_bytes","_crypto_core_ristretto255_from_hash","_crypto_core_ristretto255_from_string","_crypto_core_ristretto255_from_string_ro","_crypto_core_ristretto255_hashbytes","_crypto_core_ristretto255_is_valid_point","_crypto_core_ristretto255_nonreducedscalarbytes","_crypto_core_ristretto255_random","_crypto_core_ristretto255_scalar_add","_crypto_core_ristretto255_scalar_complement","_crypto_core_ristretto255_scalar_invert","_crypto_core_ristretto255_scalar_is_canonical","_crypto_core_ristretto255_scalar_mul","_crypto_core_ristretto255_scalar_negate","_crypto_core_ristretto255_scalar_random","_crypto_core_ristretto255_scalar_reduce","_crypto_core_ristretto255_scalar_sub","_crypto_core_ristretto255_scalarbytes","_crypto_core_ristretto255_sub","_crypto_core_salsa20","_crypto_core_salsa20_constbytes","_crypto_core_salsa20_inputbytes","_crypto_core_salsa20_keybytes","_crypto_core_salsa20_outputbytes","_crypto_core_salsa2012","_crypto_core_salsa2012_constbytes","_crypto_core_salsa2012_inputbytes","_crypto_core_salsa2012_keybytes","_crypto_core_salsa2012_outputbytes","_crypto_core_salsa208","_crypto_core_salsa208_constbytes","_crypto_core_salsa208_inputbytes","_crypto_core_salsa208_keybytes","_crypto_core_salsa208_outputbytes","_crypto_generichash","_crypto_generichash_blake2b","_crypto_generichash_blake2b_bytes","_crypto_generichash_blake2b_bytes_max","_crypto_generichash_blake2b_bytes_min","_crypto_generichash_blake2b_final","_crypto_generichash_blake2b_init","_crypto_generichash_blake2b_init_salt_personal","_crypto_generichash_blake2b_keybytes","_crypto_generichash_blake2b_keybytes_max","_crypto_generichash_blake2b_keybytes_min","_crypto_generichash_blake2b_keygen","_crypto_generichash_blake2b_personalbytes","_crypto_generichash_blake2b_salt_personal","_crypto_generichash_blake2b_saltbytes","_crypto_generichash_blake2b_statebytes","_crypto_generichash_blake2b_update","_crypto_generichash_bytes","_crypto_generichash_bytes_max","_crypto_generichash_bytes_min","_crypto_generichash_final","_crypto_generichash_init","_crypto_generichash_keybytes","_crypto_generichash_keybytes_max","_crypto_generichash_keybytes_min","_crypto_generichash_keygen","_crypto_generichash_primitive","_crypto_generichash_statebytes","_crypto_generichash_update","_crypto_hash","_crypto_hash_bytes","_crypto_hash_primitive","_crypto_hash_sha256","_crypto_hash_sha256_bytes","_crypto_hash_sha256_final","_crypto_hash_sha256_init","_crypto_hash_sha256_statebytes","_crypto_hash_sha256_update","_crypto_hash_sha512","_crypto_hash_sha512_bytes","_crypto_hash_sha512_final","_crypto_hash_sha512_init","_crypto_hash_sha512_statebytes","_crypto_hash_sha512_update","_crypto_ipcrypt_bytes","_crypto_ipcrypt_decrypt","_crypto_ipcrypt_encrypt","_crypto_ipcrypt_keybytes","_crypto_ipcrypt_keygen","_crypto_ipcrypt_nd_decrypt","_crypto_ipcrypt_nd_encrypt","_crypto_ipcrypt_nd_inputbytes","_crypto_ipcrypt_nd_keybytes","_crypto_ipcrypt_nd_outputbytes","_crypto_ipcrypt_nd_tweakbytes","_crypto_ipcrypt_ndx_decrypt","_crypto_ipcrypt_ndx_encrypt","_crypto_ipcrypt_ndx_inputbytes","_crypto_ipcrypt_ndx_keybytes","_crypto_ipcrypt_ndx_keygen","_crypto_ipcrypt_ndx_outputbytes","_crypto_ipcrypt_ndx_tweakbytes","_crypto_ipcrypt_pfx_bytes","_crypto_ipcrypt_pfx_decrypt","_crypto_ipcrypt_pfx_encrypt","_crypto_ipcrypt_pfx_keybytes","_crypto_ipcrypt_pfx_keygen","_crypto_kdf_blake2b_bytes_max","_crypto_kdf_blake2b_bytes_min","_crypto_kdf_blake2b_contextbytes","_crypto_kdf_blake2b_derive_from_key","_crypto_kdf_blake2b_keybytes","_crypto_kdf_bytes_max","_crypto_kdf_bytes_min","_crypto_kdf_contextbytes","_crypto_kdf_derive_from_key","_crypto_kdf_hkdf_sha256_bytes_max","_crypto_kdf_hkdf_sha256_bytes_min","_crypto_kdf_hkdf_sha256_expand","_crypto_kdf_hkdf_sha256_extract","_crypto_kdf_hkdf_sha256_extract_final","_crypto_kdf_hkdf_sha256_extract_init","_crypto_kdf_hkdf_sha256_extract_update","_crypto_kdf_hkdf_sha256_keybytes","_crypto_kdf_hkdf_sha256_keygen","_crypto_kdf_hkdf_sha256_statebytes","_crypto_kdf_hkdf_sha512_bytes_max","_crypto_kdf_hkdf_sha512_bytes_min","_crypto_kdf_hkdf_sha512_expand","_crypto_kdf_hkdf_sha512_extract","_crypto_kdf_hkdf_sha512_extract_final","_crypto_kdf_hkdf_sha512_extract_init","_crypto_kdf_hkdf_sha512_extract_update","_crypto_kdf_hkdf_sha512_keybytes","_crypto_kdf_hkdf_sha512_keygen","_crypto_kdf_hkdf_sha512_statebytes","_crypto_kdf_keybytes","_crypto_kdf_keygen","_crypto_kdf_primitive","_crypto_kem_mlkem768_ciphertextbytes","_crypto_kem_mlkem768_dec","_crypto_kem_mlkem768_enc","_crypto_kem_mlkem768_enc_deterministic","_crypto_kem_mlkem768_keypair","_crypto_kem_mlkem768_publickeybytes","_crypto_kem_mlkem768_secretkeybytes","_crypto_kem_mlkem768_seed_keypair","_crypto_kem_mlkem768_seedbytes","_crypto_kem_mlkem768_sharedsecretbytes","_crypto_kx_client_session_keys","_crypto_kx_keypair","_crypto_kx_primitive","_crypto_kx_publickeybytes","_crypto_kx_secretkeybytes","_crypto_kx_seed_keypair","_crypto_kx_seedbytes","_crypto_kx_server_session_keys","_crypto_kx_sessionkeybytes","_crypto_onetimeauth","_crypto_onetimeauth_bytes","_crypto_onetimeauth_final","_crypto_onetimeauth_init","_crypto_onetimeauth_keybytes","_crypto_onetimeauth_keygen","_crypto_onetimeauth_poly1305","_crypto_onetimeauth_poly1305_bytes","_crypto_onetimeauth_poly1305_final","_crypto_onetimeauth_poly1305_init","_crypto_onetimeauth_poly1305_keybytes","_crypto_onetimeauth_poly1305_keygen","_crypto_onetimeauth_poly1305_statebytes","_crypto_onetimeauth_poly1305_update","_crypto_onetimeauth_poly1305_verify","_crypto_onetimeauth_primitive","_crypto_onetimeauth_statebytes","_crypto_onetimeauth_update","_crypto_onetimeauth_verify","_crypto_pwhash","_crypto_pwhash_alg_argon2i13","_crypto_pwhash_alg_argon2id13","_crypto_pwhash_alg_default","_crypto_pwhash_argon2i","_crypto_pwhash_argon2i_alg_argon2i13","_crypto_pwhash_argon2i_bytes_max","_crypto_pwhash_argon2i_bytes_min","_crypto_pwhash_argon2i_memlimit_interactive","_crypto_pwhash_argon2i_memlimit_max","_crypto_pwhash_argon2i_memlimit_min","_crypto_pwhash_argon2i_memlimit_moderate","_crypto_pwhash_argon2i_memlimit_sensitive","_crypto_pwhash_argon2i_opslimit_interactive","_crypto_pwhash_argon2i_opslimit_max","_crypto_pwhash_argon2i_opslimit_min","_crypto_pwhash_argon2i_opslimit_moderate","_crypto_pwhash_argon2i_opslimit_sensitive","_crypto_pwhash_argon2i_passwd_max","_crypto_pwhash_argon2i_passwd_min","_crypto_pwhash_argon2i_saltbytes","_crypto_pwhash_argon2i_str","_crypto_pwhash_argon2i_str_needs_rehash","_crypto_pwhash_argon2i_str_verify","_crypto_pwhash_argon2i_strbytes","_crypto_pwhash_argon2i_strprefix","_crypto_pwhash_argon2id","_crypto_pwhash_argon2id_alg_argon2id13","_crypto_pwhash_argon2id_bytes_max","_crypto_pwhash_argon2id_bytes_min","_crypto_pwhash_argon2id_memlimit_interactive","_crypto_pwhash_argon2id_memlimit_max","_crypto_pwhash_argon2id_memlimit_min","_crypto_pwhash_argon2id_memlimit_moderate","_crypto_pwhash_argon2id_memlimit_sensitive","_crypto_pwhash_argon2id_opslimit_interactive","_crypto_pwhash_argon2id_opslimit_max","_crypto_pwhash_argon2id_opslimit_min","_crypto_pwhash_argon2id_opslimit_moderate","_crypto_pwhash_argon2id_opslimit_sensitive","_crypto_pwhash_argon2id_passwd_max","_crypto_pwhash_argon2id_passwd_min","_crypto_pwhash_argon2id_saltbytes","_crypto_pwhash_argon2id_str","_crypto_pwhash_argon2id_str_needs_rehash","_crypto_pwhash_argon2id_str_verify","_crypto_pwhash_argon2id_strbytes","_crypto_pwhash_argon2id_strprefix","_crypto_pwhash_bytes_max","_crypto_pwhash_bytes_min","_crypto_pwhash_memlimit_interactive","_crypto_pwhash_memlimit_max","_crypto_pwhash_memlimit_min","_crypto_pwhash_memlimit_moderate","_crypto_pwhash_memlimit_sensitive","_crypto_pwhash_opslimit_interactive","_crypto_pwhash_opslimit_max","_crypto_pwhash_opslimit_min","_crypto_pwhash_opslimit_moderate","_crypto_pwhash_opslimit_sensitive","_crypto_pwhash_passwd_max","_crypto_pwhash_passwd_min","_crypto_pwhash_primitive","_crypto_pwhash_saltbytes","_crypto_pwhash_scryptsalsa208sha256","_crypto_pwhash_scryptsalsa208sha256_bytes_max","_crypto_pwhash_scryptsalsa208sha256_bytes_min","_crypto_pwhash_scryptsalsa208sha256_ll","_crypto_pwhash_scryptsalsa208sha256_memlimit_interactive","_crypto_pwhash_scryptsalsa208sha256_memlimit_max","_crypto_pwhash_scryptsalsa208sha256_memlimit_min","_crypto_pwhash_scryptsalsa208sha256_memlimit_sensitive","_crypto_pwhash_scryptsalsa208sha256_opslimit_interactive","_crypto_pwhash_scryptsalsa208sha256_opslimit_max","_crypto_pwhash_scryptsalsa208sha256_opslimit_min","_crypto_pwhash_scryptsalsa208sha256_opslimit_sensitive","_crypto_pwhash_scryptsalsa208sha256_passwd_max","_crypto_pwhash_scryptsalsa208sha256_passwd_min","_crypto_pwhash_scryptsalsa208sha256_saltbytes","_crypto_pwhash_scryptsalsa208sha256_str","_crypto_pwhash_scryptsalsa208sha256_str_needs_rehash","_crypto_pwhash_scryptsalsa208sha256_str_verify","_crypto_pwhash_scryptsalsa208sha256_strbytes","_crypto_pwhash_scryptsalsa208sha256_strprefix","_crypto_pwhash_str","_crypto_pwhash_str_alg","_crypto_pwhash_str_needs_rehash","_crypto_pwhash_str_verify","_crypto_pwhash_strbytes","_crypto_pwhash_strprefix","_crypto_scalarmult","_crypto_scalarmult_base","_crypto_scalarmult_bytes","_crypto_scalarmult_curve25519","_crypto_scalarmult_curve25519_base","_crypto_scalarmult_curve25519_bytes","_crypto_scalarmult_curve25519_scalarbytes","_crypto_scalarmult_ed25519","_crypto_scalarmult_ed25519_base","_crypto_scalarmult_ed25519_base_noclamp","_crypto_scalarmult_ed25519_bytes","_crypto_scalarmult_ed25519_noclamp","_crypto_scalarmult_ed25519_scalarbytes","_crypto_scalarmult_primitive","_crypto_scalarmult_ristretto255","_crypto_scalarmult_ristretto255_base","_crypto_scalarmult_ristretto255_bytes","_crypto_scalarmult_ristretto255_scalarbytes","_crypto_scalarmult_scalarbytes","_crypto_secretbox","_crypto_secretbox_boxzerobytes","_crypto_secretbox_detached","_crypto_secretbox_easy","_crypto_secretbox_keybytes","_crypto_secretbox_keygen","_crypto_secretbox_macbytes","_crypto_secretbox_messagebytes_max","_crypto_secretbox_noncebytes","_crypto_secretbox_open","_crypto_secretbox_open_detached","_crypto_secretbox_open_easy","_crypto_secretbox_primitive","_crypto_secretbox_xchacha20poly1305_detached","_crypto_secretbox_xchacha20poly1305_easy","_crypto_secretbox_xchacha20poly1305_keybytes","_crypto_secretbox_xchacha20poly1305_macbytes","_crypto_secretbox_xchacha20poly1305_messagebytes_max","_crypto_secretbox_xchacha20poly1305_noncebytes","_crypto_secretbox_xchacha20poly1305_open_detached","_crypto_secretbox_xchacha20poly1305_open_easy","_crypto_secretbox_xsalsa20poly1305","_crypto_secretbox_xsalsa20poly1305_boxzerobytes","_crypto_secretbox_xsalsa20poly1305_keybytes","_crypto_secretbox_xsalsa20poly1305_keygen","_crypto_secretbox_xsalsa20poly1305_macbytes","_crypto_secretbox_xsalsa20poly1305_messagebytes_max","_crypto_secretbox_xsalsa20poly1305_noncebytes","_crypto_secretbox_xsalsa20poly1305_open","_crypto_secretbox_xsalsa20poly1305_zerobytes","_crypto_secretbox_zerobytes","_crypto_secretstream_xchacha20poly1305_abytes","_crypto_secretstream_xchacha20poly1305_headerbytes","_crypto_secretstream_xchacha20poly1305_init_pull","_crypto_secretstream_xchacha20poly1305_init_push","_crypto_secretstream_xchacha20poly1305_keybytes","_crypto_secretstream_xchacha20poly1305_keygen","_crypto_secretstream_xchacha20poly1305_messagebytes_max","_crypto_secretstream_xchacha20poly1305_pull","_crypto_secretstream_xchacha20poly1305_push","_crypto_secretstream_xchacha20poly1305_rekey","_crypto_secretstream_xchacha20poly1305_statebytes","_crypto_secretstream_xchacha20poly1305_tag_final","_crypto_secretstream_xchacha20poly1305_tag_message","_crypto_secretstream_xchacha20poly1305_tag_push","_crypto_secretstream_xchacha20poly1305_tag_rekey","_crypto_shorthash","_crypto_shorthash_bytes","_crypto_shorthash_keybytes","_crypto_shorthash_keygen","_crypto_shorthash_primitive","_crypto_shorthash_siphash24","_crypto_shorthash_siphash24_bytes","_crypto_shorthash_siphash24_keybytes","_crypto_shorthash_siphashx24","_crypto_shorthash_siphashx24_bytes","_crypto_shorthash_siphashx24_keybytes","_crypto_sign","_crypto_sign_bytes","_crypto_sign_detached","_crypto_sign_ed25519","_crypto_sign_ed25519_bytes","_crypto_sign_ed25519_detached","_crypto_sign_ed25519_keypair","_crypto_sign_ed25519_messagebytes_max","_crypto_sign_ed25519_open","_crypto_sign_ed25519_pk_to_curve25519","_crypto_sign_ed25519_publickeybytes","_crypto_sign_ed25519_secretkeybytes","_crypto_sign_ed25519_seed_keypair","_crypto_sign_ed25519_seedbytes","_crypto_sign_ed25519_sk_to_curve25519","_crypto_sign_ed25519_sk_to_pk","_crypto_sign_ed25519_sk_to_seed","_crypto_sign_ed25519_verify_detached","_crypto_sign_ed25519ph_final_create","_crypto_sign_ed25519ph_final_verify","_crypto_sign_ed25519ph_init","_crypto_sign_ed25519ph_statebytes","_crypto_sign_ed25519ph_update","_crypto_sign_final_create","_crypto_sign_final_verify","_crypto_sign_init","_crypto_sign_keypair","_crypto_sign_messagebytes_max","_crypto_sign_open","_crypto_sign_primitive","_crypto_sign_publickeybytes","_crypto_sign_secretkeybytes","_crypto_sign_seed_keypair","_crypto_sign_seedbytes","_crypto_sign_statebytes","_crypto_sign_update","_crypto_sign_verify_detached","_crypto_stream","_crypto_stream_chacha20","_crypto_stream_chacha20_ietf","_crypto_stream_chacha20_ietf_keybytes","_crypto_stream_chacha20_ietf_keygen","_crypto_stream_chacha20_ietf_messagebytes_max","_crypto_stream_chacha20_ietf_noncebytes","_crypto_stream_chacha20_ietf_xor","_crypto_stream_chacha20_ietf_xor_ic","_crypto_stream_chacha20_keybytes","_crypto_stream_chacha20_keygen","_crypto_stream_chacha20_messagebytes_max","_crypto_stream_chacha20_noncebytes","_crypto_stream_chacha20_xor","_crypto_stream_chacha20_xor_ic","_crypto_stream_keybytes","_crypto_stream_keygen","_crypto_stream_messagebytes_max","_crypto_stream_noncebytes","_crypto_stream_primitive","_crypto_stream_salsa20","_crypto_stream_salsa20_keybytes","_crypto_stream_salsa20_keygen","_crypto_stream_salsa20_messagebytes_max","_crypto_stream_salsa20_noncebytes","_crypto_stream_salsa20_xor","_crypto_stream_salsa20_xor_ic","_crypto_stream_salsa2012","_crypto_stream_salsa2012_keybytes","_crypto_stream_salsa2012_keygen","_crypto_stream_salsa2012_messagebytes_max","_crypto_stream_salsa2012_noncebytes","_crypto_stream_salsa2012_xor","_crypto_stream_salsa208","_crypto_stream_salsa208_keybytes","_crypto_stream_salsa208_keygen","_crypto_stream_salsa208_messagebytes_max","_crypto_stream_salsa208_noncebytes","_crypto_stream_salsa208_xor","_crypto_stream_xchacha20","_crypto_stream_xchacha20_keybytes","_crypto_stream_xchacha20_keygen","_crypto_stream_xchacha20_messagebytes_max","_crypto_stream_xchacha20_noncebytes","_crypto_stream_xchacha20_xor","_crypto_stream_xchacha20_xor_ic","_crypto_stream_xor","_crypto_stream_xsalsa20","_crypto_stream_xsalsa20_keybytes","_crypto_stream_xsalsa20_keygen","_crypto_stream_xsalsa20_messagebytes_max","_crypto_stream_xsalsa20_noncebytes","_crypto_stream_xsalsa20_xor","_crypto_stream_xsalsa20_xor_ic","_crypto_verify_16","_crypto_verify_16_bytes","_crypto_verify_32","_crypto_verify_32_bytes","_crypto_verify_64","_crypto_verify_64_bytes","_crypto_xof_shake128","_crypto_xof_shake128_blockbytes","_crypto_xof_shake128_domain_standard","_crypto_xof_shake128_init","_crypto_xof_shake128_init_with_domain","_crypto_xof_shake128_squeeze","_crypto_xof_shake128_statebytes","_crypto_xof_shake128_update","_crypto_xof_shake256","_crypto_xof_shake256_blockbytes","_crypto_xof_shake256_domain_standard","_crypto_xof_shake256_init","_crypto_xof_shake256_init_with_domain","_crypto_xof_shake256_squeeze","_crypto_xof_shake256_statebytes","_crypto_xof_shake256_update","_crypto_xof_turboshake128","_crypto_xof_turboshake128_blockbytes","_crypto_xof_turboshake128_domain_standard","_crypto_xof_turboshake128_init","_crypto_xof_turboshake128_init_with_domain","_crypto_xof_turboshake128_squeeze","_crypto_xof_turboshake128_statebytes","_crypto_xof_turboshake128_update","_crypto_xof_turboshake256","_crypto_xof_turboshake256_blockbytes","_crypto_xof_turboshake256_domain_standard","_crypto_xof_turboshake256_init","_crypto_xof_turboshake256_init_with_domain","_crypto_xof_turboshake256_squeeze","_crypto_xof_turboshake256_statebytes","_crypto_xof_turboshake256_update","_randombytes","_randombytes_buf","_randombytes_buf_deterministic","_randombytes_close","_randombytes_implementation_name","_randombytes_random","_randombytes_seedbytes","_randombytes_stir","_randombytes_uniform","_sodium_base64_encoded_len","_sodium_base642bin","_sodium_bin2base64","_sodium_bin2hex","_sodium_bin2ip","_sodium_hex2bin","_sodium_init","_sodium_ip2bin","_sodium_library_minimal","_sodium_library_version_major","_sodium_library_version_minor","_sodium_pad","_sodium_unpad","_sodium_version_string"]' +export EXPORTED_FUNCTIONS_STANDARD='["_malloc","_free","_crypto_aead_aegis128l_abytes","_crypto_aead_aegis128l_decrypt","_crypto_aead_aegis128l_decrypt_detached","_crypto_aead_aegis128l_encrypt","_crypto_aead_aegis128l_encrypt_detached","_crypto_aead_aegis128l_keybytes","_crypto_aead_aegis128l_keygen","_crypto_aead_aegis128l_messagebytes_max","_crypto_aead_aegis128l_npubbytes","_crypto_aead_aegis128l_nsecbytes","_crypto_aead_aegis256_abytes","_crypto_aead_aegis256_decrypt","_crypto_aead_aegis256_decrypt_detached","_crypto_aead_aegis256_encrypt","_crypto_aead_aegis256_encrypt_detached","_crypto_aead_aegis256_keybytes","_crypto_aead_aegis256_keygen","_crypto_aead_aegis256_messagebytes_max","_crypto_aead_aegis256_npubbytes","_crypto_aead_aegis256_nsecbytes","_crypto_aead_aes256gcm_is_available","_crypto_aead_chacha20poly1305_abytes","_crypto_aead_chacha20poly1305_decrypt","_crypto_aead_chacha20poly1305_decrypt_detached","_crypto_aead_chacha20poly1305_encrypt","_crypto_aead_chacha20poly1305_encrypt_detached","_crypto_aead_chacha20poly1305_ietf_abytes","_crypto_aead_chacha20poly1305_ietf_decrypt","_crypto_aead_chacha20poly1305_ietf_decrypt_detached","_crypto_aead_chacha20poly1305_ietf_encrypt","_crypto_aead_chacha20poly1305_ietf_encrypt_detached","_crypto_aead_chacha20poly1305_ietf_keybytes","_crypto_aead_chacha20poly1305_ietf_keygen","_crypto_aead_chacha20poly1305_ietf_messagebytes_max","_crypto_aead_chacha20poly1305_ietf_npubbytes","_crypto_aead_chacha20poly1305_ietf_nsecbytes","_crypto_aead_chacha20poly1305_keybytes","_crypto_aead_chacha20poly1305_keygen","_crypto_aead_chacha20poly1305_messagebytes_max","_crypto_aead_chacha20poly1305_npubbytes","_crypto_aead_chacha20poly1305_nsecbytes","_crypto_aead_xchacha20poly1305_ietf_abytes","_crypto_aead_xchacha20poly1305_ietf_decrypt","_crypto_aead_xchacha20poly1305_ietf_decrypt_detached","_crypto_aead_xchacha20poly1305_ietf_encrypt","_crypto_aead_xchacha20poly1305_ietf_encrypt_detached","_crypto_aead_xchacha20poly1305_ietf_keybytes","_crypto_aead_xchacha20poly1305_ietf_keygen","_crypto_aead_xchacha20poly1305_ietf_messagebytes_max","_crypto_aead_xchacha20poly1305_ietf_npubbytes","_crypto_aead_xchacha20poly1305_ietf_nsecbytes","_crypto_auth","_crypto_auth_bytes","_crypto_auth_keybytes","_crypto_auth_keygen","_crypto_auth_verify","_crypto_box_beforenm","_crypto_box_beforenmbytes","_crypto_box_detached","_crypto_box_detached_afternm","_crypto_box_easy","_crypto_box_easy_afternm","_crypto_box_keypair","_crypto_box_macbytes","_crypto_box_messagebytes_max","_crypto_box_noncebytes","_crypto_box_open_detached","_crypto_box_open_detached_afternm","_crypto_box_open_easy","_crypto_box_open_easy_afternm","_crypto_box_publickeybytes","_crypto_box_seal","_crypto_box_seal_open","_crypto_box_sealbytes","_crypto_box_secretkeybytes","_crypto_box_seed_keypair","_crypto_box_seedbytes","_crypto_generichash","_crypto_generichash_bytes","_crypto_generichash_bytes_max","_crypto_generichash_bytes_min","_crypto_generichash_final","_crypto_generichash_init","_crypto_generichash_keybytes","_crypto_generichash_keybytes_max","_crypto_generichash_keybytes_min","_crypto_generichash_keygen","_crypto_generichash_statebytes","_crypto_generichash_update","_crypto_hash","_crypto_hash_bytes","_crypto_ipcrypt_bytes","_crypto_ipcrypt_decrypt","_crypto_ipcrypt_encrypt","_crypto_ipcrypt_keybytes","_crypto_ipcrypt_keygen","_crypto_ipcrypt_nd_decrypt","_crypto_ipcrypt_nd_encrypt","_crypto_ipcrypt_nd_inputbytes","_crypto_ipcrypt_nd_keybytes","_crypto_ipcrypt_nd_keygen","_crypto_ipcrypt_nd_outputbytes","_crypto_ipcrypt_nd_tweakbytes","_crypto_ipcrypt_ndx_decrypt","_crypto_ipcrypt_ndx_encrypt","_crypto_ipcrypt_ndx_inputbytes","_crypto_ipcrypt_ndx_keybytes","_crypto_ipcrypt_ndx_keygen","_crypto_ipcrypt_ndx_outputbytes","_crypto_ipcrypt_ndx_tweakbytes","_crypto_ipcrypt_pfx_bytes","_crypto_ipcrypt_pfx_decrypt","_crypto_ipcrypt_pfx_encrypt","_crypto_ipcrypt_pfx_keybytes","_crypto_ipcrypt_pfx_keygen","_crypto_kdf_bytes_max","_crypto_kdf_bytes_min","_crypto_kdf_contextbytes","_crypto_kdf_derive_from_key","_crypto_kdf_hkdf_sha256_bytes_max","_crypto_kdf_hkdf_sha256_bytes_min","_crypto_kdf_hkdf_sha256_expand","_crypto_kdf_hkdf_sha256_extract","_crypto_kdf_hkdf_sha256_extract_final","_crypto_kdf_hkdf_sha256_extract_init","_crypto_kdf_hkdf_sha256_extract_update","_crypto_kdf_hkdf_sha256_keybytes","_crypto_kdf_hkdf_sha256_keygen","_crypto_kdf_hkdf_sha256_statebytes","_crypto_kdf_hkdf_sha512_bytes_max","_crypto_kdf_hkdf_sha512_bytes_min","_crypto_kdf_hkdf_sha512_expand","_crypto_kdf_hkdf_sha512_extract","_crypto_kdf_hkdf_sha512_extract_final","_crypto_kdf_hkdf_sha512_extract_init","_crypto_kdf_hkdf_sha512_extract_update","_crypto_kdf_hkdf_sha512_keybytes","_crypto_kdf_hkdf_sha512_keygen","_crypto_kdf_hkdf_sha512_statebytes","_crypto_kdf_keybytes","_crypto_kdf_keygen","_crypto_kem_mlkem768_ciphertextbytes","_crypto_kem_mlkem768_dec","_crypto_kem_mlkem768_enc","_crypto_kem_mlkem768_enc_deterministic","_crypto_kem_mlkem768_keypair","_crypto_kem_mlkem768_publickeybytes","_crypto_kem_mlkem768_secretkeybytes","_crypto_kem_mlkem768_seed_keypair","_crypto_kem_mlkem768_seedbytes","_crypto_kem_mlkem768_sharedsecretbytes","_crypto_kx_client_session_keys","_crypto_kx_keypair","_crypto_kx_publickeybytes","_crypto_kx_secretkeybytes","_crypto_kx_seed_keypair","_crypto_kx_seedbytes","_crypto_kx_server_session_keys","_crypto_kx_sessionkeybytes","_crypto_scalarmult","_crypto_scalarmult_base","_crypto_scalarmult_bytes","_crypto_scalarmult_scalarbytes","_crypto_secretbox_detached","_crypto_secretbox_easy","_crypto_secretbox_keybytes","_crypto_secretbox_keygen","_crypto_secretbox_macbytes","_crypto_secretbox_messagebytes_max","_crypto_secretbox_noncebytes","_crypto_secretbox_open_detached","_crypto_secretbox_open_easy","_crypto_secretstream_xchacha20poly1305_abytes","_crypto_secretstream_xchacha20poly1305_headerbytes","_crypto_secretstream_xchacha20poly1305_init_pull","_crypto_secretstream_xchacha20poly1305_init_push","_crypto_secretstream_xchacha20poly1305_keybytes","_crypto_secretstream_xchacha20poly1305_keygen","_crypto_secretstream_xchacha20poly1305_messagebytes_max","_crypto_secretstream_xchacha20poly1305_pull","_crypto_secretstream_xchacha20poly1305_push","_crypto_secretstream_xchacha20poly1305_rekey","_crypto_secretstream_xchacha20poly1305_statebytes","_crypto_secretstream_xchacha20poly1305_tag_final","_crypto_secretstream_xchacha20poly1305_tag_message","_crypto_secretstream_xchacha20poly1305_tag_push","_crypto_secretstream_xchacha20poly1305_tag_rekey","_crypto_shorthash","_crypto_shorthash_bytes","_crypto_shorthash_keybytes","_crypto_shorthash_keygen","_crypto_sign","_crypto_sign_bytes","_crypto_sign_detached","_crypto_sign_ed25519_pk_to_curve25519","_crypto_sign_ed25519_sk_to_curve25519","_crypto_sign_final_create","_crypto_sign_final_verify","_crypto_sign_init","_crypto_sign_keypair","_crypto_sign_messagebytes_max","_crypto_sign_open","_crypto_sign_publickeybytes","_crypto_sign_secretkeybytes","_crypto_sign_seed_keypair","_crypto_sign_seedbytes","_crypto_sign_statebytes","_crypto_sign_update","_crypto_sign_verify_detached","_crypto_xof_shake128","_crypto_xof_shake128_blockbytes","_crypto_xof_shake128_domain_standard","_crypto_xof_shake128_init","_crypto_xof_shake128_init_with_domain","_crypto_xof_shake128_squeeze","_crypto_xof_shake128_statebytes","_crypto_xof_shake128_update","_crypto_xof_shake256","_crypto_xof_shake256_blockbytes","_crypto_xof_shake256_domain_standard","_crypto_xof_shake256_init","_crypto_xof_shake256_init_with_domain","_crypto_xof_shake256_squeeze","_crypto_xof_shake256_statebytes","_crypto_xof_shake256_update","_crypto_xof_turboshake128","_crypto_xof_turboshake128_blockbytes","_crypto_xof_turboshake128_domain_standard","_crypto_xof_turboshake128_init","_crypto_xof_turboshake128_init_with_domain","_crypto_xof_turboshake128_squeeze","_crypto_xof_turboshake128_statebytes","_crypto_xof_turboshake128_update","_crypto_xof_turboshake256","_crypto_xof_turboshake256_blockbytes","_crypto_xof_turboshake256_domain_standard","_crypto_xof_turboshake256_init","_crypto_xof_turboshake256_init_with_domain","_crypto_xof_turboshake256_squeeze","_crypto_xof_turboshake256_statebytes","_crypto_xof_turboshake256_update","_randombytes","_randombytes_buf","_randombytes_buf_deterministic","_randombytes_close","_randombytes_random","_randombytes_seedbytes","_randombytes_stir","_randombytes_uniform","_sodium_base64_encoded_len","_sodium_base642bin","_sodium_bin2base64","_sodium_bin2hex","_sodium_bin2ip","_sodium_hex2bin","_sodium_init","_sodium_ip2bin","_sodium_library_minimal","_sodium_library_version_major","_sodium_library_version_minor","_sodium_pad","_sodium_unpad","_sodium_version_string"]' +export EXPORTED_FUNCTIONS_SUMO='["_malloc","_free","_crypto_aead_aegis128l_abytes","_crypto_aead_aegis128l_decrypt","_crypto_aead_aegis128l_decrypt_detached","_crypto_aead_aegis128l_encrypt","_crypto_aead_aegis128l_encrypt_detached","_crypto_aead_aegis128l_keybytes","_crypto_aead_aegis128l_keygen","_crypto_aead_aegis128l_messagebytes_max","_crypto_aead_aegis128l_npubbytes","_crypto_aead_aegis128l_nsecbytes","_crypto_aead_aegis256_abytes","_crypto_aead_aegis256_decrypt","_crypto_aead_aegis256_decrypt_detached","_crypto_aead_aegis256_encrypt","_crypto_aead_aegis256_encrypt_detached","_crypto_aead_aegis256_keybytes","_crypto_aead_aegis256_keygen","_crypto_aead_aegis256_messagebytes_max","_crypto_aead_aegis256_npubbytes","_crypto_aead_aegis256_nsecbytes","_crypto_aead_aes256gcm_is_available","_crypto_aead_chacha20poly1305_abytes","_crypto_aead_chacha20poly1305_decrypt","_crypto_aead_chacha20poly1305_decrypt_detached","_crypto_aead_chacha20poly1305_encrypt","_crypto_aead_chacha20poly1305_encrypt_detached","_crypto_aead_chacha20poly1305_ietf_abytes","_crypto_aead_chacha20poly1305_ietf_decrypt","_crypto_aead_chacha20poly1305_ietf_decrypt_detached","_crypto_aead_chacha20poly1305_ietf_encrypt","_crypto_aead_chacha20poly1305_ietf_encrypt_detached","_crypto_aead_chacha20poly1305_ietf_keybytes","_crypto_aead_chacha20poly1305_ietf_keygen","_crypto_aead_chacha20poly1305_ietf_messagebytes_max","_crypto_aead_chacha20poly1305_ietf_npubbytes","_crypto_aead_chacha20poly1305_ietf_nsecbytes","_crypto_aead_chacha20poly1305_keybytes","_crypto_aead_chacha20poly1305_keygen","_crypto_aead_chacha20poly1305_messagebytes_max","_crypto_aead_chacha20poly1305_npubbytes","_crypto_aead_chacha20poly1305_nsecbytes","_crypto_aead_xchacha20poly1305_ietf_abytes","_crypto_aead_xchacha20poly1305_ietf_decrypt","_crypto_aead_xchacha20poly1305_ietf_decrypt_detached","_crypto_aead_xchacha20poly1305_ietf_encrypt","_crypto_aead_xchacha20poly1305_ietf_encrypt_detached","_crypto_aead_xchacha20poly1305_ietf_keybytes","_crypto_aead_xchacha20poly1305_ietf_keygen","_crypto_aead_xchacha20poly1305_ietf_messagebytes_max","_crypto_aead_xchacha20poly1305_ietf_npubbytes","_crypto_aead_xchacha20poly1305_ietf_nsecbytes","_crypto_auth","_crypto_auth_bytes","_crypto_auth_hmacsha256","_crypto_auth_hmacsha256_bytes","_crypto_auth_hmacsha256_final","_crypto_auth_hmacsha256_init","_crypto_auth_hmacsha256_keybytes","_crypto_auth_hmacsha256_keygen","_crypto_auth_hmacsha256_statebytes","_crypto_auth_hmacsha256_update","_crypto_auth_hmacsha256_verify","_crypto_auth_hmacsha512","_crypto_auth_hmacsha512_bytes","_crypto_auth_hmacsha512_final","_crypto_auth_hmacsha512_init","_crypto_auth_hmacsha512_keybytes","_crypto_auth_hmacsha512_keygen","_crypto_auth_hmacsha512_statebytes","_crypto_auth_hmacsha512_update","_crypto_auth_hmacsha512_verify","_crypto_auth_hmacsha512256","_crypto_auth_hmacsha512256_bytes","_crypto_auth_hmacsha512256_final","_crypto_auth_hmacsha512256_init","_crypto_auth_hmacsha512256_keybytes","_crypto_auth_hmacsha512256_keygen","_crypto_auth_hmacsha512256_statebytes","_crypto_auth_hmacsha512256_update","_crypto_auth_hmacsha512256_verify","_crypto_auth_keybytes","_crypto_auth_keygen","_crypto_auth_primitive","_crypto_auth_verify","_crypto_box","_crypto_box_afternm","_crypto_box_beforenm","_crypto_box_beforenmbytes","_crypto_box_boxzerobytes","_crypto_box_curve25519xchacha20poly1305_beforenm","_crypto_box_curve25519xchacha20poly1305_beforenmbytes","_crypto_box_curve25519xchacha20poly1305_detached","_crypto_box_curve25519xchacha20poly1305_detached_afternm","_crypto_box_curve25519xchacha20poly1305_easy","_crypto_box_curve25519xchacha20poly1305_easy_afternm","_crypto_box_curve25519xchacha20poly1305_keypair","_crypto_box_curve25519xchacha20poly1305_macbytes","_crypto_box_curve25519xchacha20poly1305_messagebytes_max","_crypto_box_curve25519xchacha20poly1305_noncebytes","_crypto_box_curve25519xchacha20poly1305_open_detached","_crypto_box_curve25519xchacha20poly1305_open_detached_afternm","_crypto_box_curve25519xchacha20poly1305_open_easy","_crypto_box_curve25519xchacha20poly1305_open_easy_afternm","_crypto_box_curve25519xchacha20poly1305_publickeybytes","_crypto_box_curve25519xchacha20poly1305_seal","_crypto_box_curve25519xchacha20poly1305_seal_open","_crypto_box_curve25519xchacha20poly1305_sealbytes","_crypto_box_curve25519xchacha20poly1305_secretkeybytes","_crypto_box_curve25519xchacha20poly1305_seed_keypair","_crypto_box_curve25519xchacha20poly1305_seedbytes","_crypto_box_curve25519xsalsa20poly1305","_crypto_box_curve25519xsalsa20poly1305_afternm","_crypto_box_curve25519xsalsa20poly1305_beforenm","_crypto_box_curve25519xsalsa20poly1305_beforenmbytes","_crypto_box_curve25519xsalsa20poly1305_boxzerobytes","_crypto_box_curve25519xsalsa20poly1305_keypair","_crypto_box_curve25519xsalsa20poly1305_macbytes","_crypto_box_curve25519xsalsa20poly1305_messagebytes_max","_crypto_box_curve25519xsalsa20poly1305_noncebytes","_crypto_box_curve25519xsalsa20poly1305_open","_crypto_box_curve25519xsalsa20poly1305_open_afternm","_crypto_box_curve25519xsalsa20poly1305_publickeybytes","_crypto_box_curve25519xsalsa20poly1305_secretkeybytes","_crypto_box_curve25519xsalsa20poly1305_seed_keypair","_crypto_box_curve25519xsalsa20poly1305_seedbytes","_crypto_box_curve25519xsalsa20poly1305_zerobytes","_crypto_box_detached","_crypto_box_detached_afternm","_crypto_box_easy","_crypto_box_easy_afternm","_crypto_box_keypair","_crypto_box_macbytes","_crypto_box_messagebytes_max","_crypto_box_noncebytes","_crypto_box_open","_crypto_box_open_afternm","_crypto_box_open_detached","_crypto_box_open_detached_afternm","_crypto_box_open_easy","_crypto_box_open_easy_afternm","_crypto_box_primitive","_crypto_box_publickeybytes","_crypto_box_seal","_crypto_box_seal_open","_crypto_box_sealbytes","_crypto_box_secretkeybytes","_crypto_box_seed_keypair","_crypto_box_seedbytes","_crypto_box_zerobytes","_crypto_core_ed25519_add","_crypto_core_ed25519_bytes","_crypto_core_ed25519_from_string","_crypto_core_ed25519_from_string_ro","_crypto_core_ed25519_hashbytes","_crypto_core_ed25519_is_valid_point","_crypto_core_ed25519_nonreducedscalarbytes","_crypto_core_ed25519_random","_crypto_core_ed25519_scalar_add","_crypto_core_ed25519_scalar_complement","_crypto_core_ed25519_scalar_invert","_crypto_core_ed25519_scalar_is_canonical","_crypto_core_ed25519_scalar_mul","_crypto_core_ed25519_scalar_negate","_crypto_core_ed25519_scalar_random","_crypto_core_ed25519_scalar_reduce","_crypto_core_ed25519_scalar_sub","_crypto_core_ed25519_scalarbytes","_crypto_core_ed25519_sub","_crypto_core_ed25519_uniformbytes","_crypto_core_hchacha20","_crypto_core_hchacha20_constbytes","_crypto_core_hchacha20_inputbytes","_crypto_core_hchacha20_keybytes","_crypto_core_hchacha20_outputbytes","_crypto_core_hsalsa20","_crypto_core_hsalsa20_constbytes","_crypto_core_hsalsa20_inputbytes","_crypto_core_hsalsa20_keybytes","_crypto_core_hsalsa20_outputbytes","_crypto_core_keccak1600_extract_bytes","_crypto_core_keccak1600_init","_crypto_core_keccak1600_permute_12","_crypto_core_keccak1600_permute_24","_crypto_core_keccak1600_statebytes","_crypto_core_keccak1600_xor_bytes","_crypto_core_ristretto255_add","_crypto_core_ristretto255_bytes","_crypto_core_ristretto255_from_hash","_crypto_core_ristretto255_from_string","_crypto_core_ristretto255_from_string_ro","_crypto_core_ristretto255_hashbytes","_crypto_core_ristretto255_is_valid_point","_crypto_core_ristretto255_nonreducedscalarbytes","_crypto_core_ristretto255_random","_crypto_core_ristretto255_scalar_add","_crypto_core_ristretto255_scalar_complement","_crypto_core_ristretto255_scalar_invert","_crypto_core_ristretto255_scalar_is_canonical","_crypto_core_ristretto255_scalar_mul","_crypto_core_ristretto255_scalar_negate","_crypto_core_ristretto255_scalar_random","_crypto_core_ristretto255_scalar_reduce","_crypto_core_ristretto255_scalar_sub","_crypto_core_ristretto255_scalarbytes","_crypto_core_ristretto255_sub","_crypto_core_salsa20","_crypto_core_salsa20_constbytes","_crypto_core_salsa20_inputbytes","_crypto_core_salsa20_keybytes","_crypto_core_salsa20_outputbytes","_crypto_core_salsa2012","_crypto_core_salsa2012_constbytes","_crypto_core_salsa2012_inputbytes","_crypto_core_salsa2012_keybytes","_crypto_core_salsa2012_outputbytes","_crypto_core_salsa208","_crypto_core_salsa208_constbytes","_crypto_core_salsa208_inputbytes","_crypto_core_salsa208_keybytes","_crypto_core_salsa208_outputbytes","_crypto_generichash","_crypto_generichash_blake2b","_crypto_generichash_blake2b_bytes","_crypto_generichash_blake2b_bytes_max","_crypto_generichash_blake2b_bytes_min","_crypto_generichash_blake2b_final","_crypto_generichash_blake2b_init","_crypto_generichash_blake2b_init_salt_personal","_crypto_generichash_blake2b_keybytes","_crypto_generichash_blake2b_keybytes_max","_crypto_generichash_blake2b_keybytes_min","_crypto_generichash_blake2b_keygen","_crypto_generichash_blake2b_personalbytes","_crypto_generichash_blake2b_salt_personal","_crypto_generichash_blake2b_saltbytes","_crypto_generichash_blake2b_statebytes","_crypto_generichash_blake2b_update","_crypto_generichash_bytes","_crypto_generichash_bytes_max","_crypto_generichash_bytes_min","_crypto_generichash_final","_crypto_generichash_init","_crypto_generichash_keybytes","_crypto_generichash_keybytes_max","_crypto_generichash_keybytes_min","_crypto_generichash_keygen","_crypto_generichash_primitive","_crypto_generichash_statebytes","_crypto_generichash_update","_crypto_hash","_crypto_hash_bytes","_crypto_hash_primitive","_crypto_hash_sha256","_crypto_hash_sha256_bytes","_crypto_hash_sha256_final","_crypto_hash_sha256_init","_crypto_hash_sha256_statebytes","_crypto_hash_sha256_update","_crypto_hash_sha512","_crypto_hash_sha512_bytes","_crypto_hash_sha512_final","_crypto_hash_sha512_init","_crypto_hash_sha512_statebytes","_crypto_hash_sha512_update","_crypto_ipcrypt_bytes","_crypto_ipcrypt_decrypt","_crypto_ipcrypt_encrypt","_crypto_ipcrypt_keybytes","_crypto_ipcrypt_keygen","_crypto_ipcrypt_nd_decrypt","_crypto_ipcrypt_nd_encrypt","_crypto_ipcrypt_nd_inputbytes","_crypto_ipcrypt_nd_keybytes","_crypto_ipcrypt_nd_keygen","_crypto_ipcrypt_nd_outputbytes","_crypto_ipcrypt_nd_tweakbytes","_crypto_ipcrypt_ndx_decrypt","_crypto_ipcrypt_ndx_encrypt","_crypto_ipcrypt_ndx_inputbytes","_crypto_ipcrypt_ndx_keybytes","_crypto_ipcrypt_ndx_keygen","_crypto_ipcrypt_ndx_outputbytes","_crypto_ipcrypt_ndx_tweakbytes","_crypto_ipcrypt_pfx_bytes","_crypto_ipcrypt_pfx_decrypt","_crypto_ipcrypt_pfx_encrypt","_crypto_ipcrypt_pfx_keybytes","_crypto_ipcrypt_pfx_keygen","_crypto_kdf_blake2b_bytes_max","_crypto_kdf_blake2b_bytes_min","_crypto_kdf_blake2b_contextbytes","_crypto_kdf_blake2b_derive_from_key","_crypto_kdf_blake2b_keybytes","_crypto_kdf_bytes_max","_crypto_kdf_bytes_min","_crypto_kdf_contextbytes","_crypto_kdf_derive_from_key","_crypto_kdf_hkdf_sha256_bytes_max","_crypto_kdf_hkdf_sha256_bytes_min","_crypto_kdf_hkdf_sha256_expand","_crypto_kdf_hkdf_sha256_extract","_crypto_kdf_hkdf_sha256_extract_final","_crypto_kdf_hkdf_sha256_extract_init","_crypto_kdf_hkdf_sha256_extract_update","_crypto_kdf_hkdf_sha256_keybytes","_crypto_kdf_hkdf_sha256_keygen","_crypto_kdf_hkdf_sha256_statebytes","_crypto_kdf_hkdf_sha512_bytes_max","_crypto_kdf_hkdf_sha512_bytes_min","_crypto_kdf_hkdf_sha512_expand","_crypto_kdf_hkdf_sha512_extract","_crypto_kdf_hkdf_sha512_extract_final","_crypto_kdf_hkdf_sha512_extract_init","_crypto_kdf_hkdf_sha512_extract_update","_crypto_kdf_hkdf_sha512_keybytes","_crypto_kdf_hkdf_sha512_keygen","_crypto_kdf_hkdf_sha512_statebytes","_crypto_kdf_keybytes","_crypto_kdf_keygen","_crypto_kdf_primitive","_crypto_kem_mlkem768_ciphertextbytes","_crypto_kem_mlkem768_dec","_crypto_kem_mlkem768_enc","_crypto_kem_mlkem768_enc_deterministic","_crypto_kem_mlkem768_keypair","_crypto_kem_mlkem768_publickeybytes","_crypto_kem_mlkem768_secretkeybytes","_crypto_kem_mlkem768_seed_keypair","_crypto_kem_mlkem768_seedbytes","_crypto_kem_mlkem768_sharedsecretbytes","_crypto_kx_client_session_keys","_crypto_kx_keypair","_crypto_kx_primitive","_crypto_kx_publickeybytes","_crypto_kx_secretkeybytes","_crypto_kx_seed_keypair","_crypto_kx_seedbytes","_crypto_kx_server_session_keys","_crypto_kx_sessionkeybytes","_crypto_onetimeauth","_crypto_onetimeauth_bytes","_crypto_onetimeauth_final","_crypto_onetimeauth_init","_crypto_onetimeauth_keybytes","_crypto_onetimeauth_keygen","_crypto_onetimeauth_poly1305","_crypto_onetimeauth_poly1305_bytes","_crypto_onetimeauth_poly1305_final","_crypto_onetimeauth_poly1305_init","_crypto_onetimeauth_poly1305_keybytes","_crypto_onetimeauth_poly1305_keygen","_crypto_onetimeauth_poly1305_statebytes","_crypto_onetimeauth_poly1305_update","_crypto_onetimeauth_poly1305_verify","_crypto_onetimeauth_primitive","_crypto_onetimeauth_statebytes","_crypto_onetimeauth_update","_crypto_onetimeauth_verify","_crypto_pwhash","_crypto_pwhash_alg_argon2i13","_crypto_pwhash_alg_argon2id13","_crypto_pwhash_alg_default","_crypto_pwhash_argon2i","_crypto_pwhash_argon2i_alg_argon2i13","_crypto_pwhash_argon2i_bytes_max","_crypto_pwhash_argon2i_bytes_min","_crypto_pwhash_argon2i_memlimit_interactive","_crypto_pwhash_argon2i_memlimit_max","_crypto_pwhash_argon2i_memlimit_min","_crypto_pwhash_argon2i_memlimit_moderate","_crypto_pwhash_argon2i_memlimit_sensitive","_crypto_pwhash_argon2i_opslimit_interactive","_crypto_pwhash_argon2i_opslimit_max","_crypto_pwhash_argon2i_opslimit_min","_crypto_pwhash_argon2i_opslimit_moderate","_crypto_pwhash_argon2i_opslimit_sensitive","_crypto_pwhash_argon2i_passwd_max","_crypto_pwhash_argon2i_passwd_min","_crypto_pwhash_argon2i_saltbytes","_crypto_pwhash_argon2i_str","_crypto_pwhash_argon2i_str_needs_rehash","_crypto_pwhash_argon2i_str_verify","_crypto_pwhash_argon2i_strbytes","_crypto_pwhash_argon2i_strprefix","_crypto_pwhash_argon2id","_crypto_pwhash_argon2id_alg_argon2id13","_crypto_pwhash_argon2id_bytes_max","_crypto_pwhash_argon2id_bytes_min","_crypto_pwhash_argon2id_memlimit_interactive","_crypto_pwhash_argon2id_memlimit_max","_crypto_pwhash_argon2id_memlimit_min","_crypto_pwhash_argon2id_memlimit_moderate","_crypto_pwhash_argon2id_memlimit_sensitive","_crypto_pwhash_argon2id_opslimit_interactive","_crypto_pwhash_argon2id_opslimit_max","_crypto_pwhash_argon2id_opslimit_min","_crypto_pwhash_argon2id_opslimit_moderate","_crypto_pwhash_argon2id_opslimit_sensitive","_crypto_pwhash_argon2id_passwd_max","_crypto_pwhash_argon2id_passwd_min","_crypto_pwhash_argon2id_saltbytes","_crypto_pwhash_argon2id_str","_crypto_pwhash_argon2id_str_needs_rehash","_crypto_pwhash_argon2id_str_verify","_crypto_pwhash_argon2id_strbytes","_crypto_pwhash_argon2id_strprefix","_crypto_pwhash_bytes_max","_crypto_pwhash_bytes_min","_crypto_pwhash_memlimit_interactive","_crypto_pwhash_memlimit_max","_crypto_pwhash_memlimit_min","_crypto_pwhash_memlimit_moderate","_crypto_pwhash_memlimit_sensitive","_crypto_pwhash_opslimit_interactive","_crypto_pwhash_opslimit_max","_crypto_pwhash_opslimit_min","_crypto_pwhash_opslimit_moderate","_crypto_pwhash_opslimit_sensitive","_crypto_pwhash_passwd_max","_crypto_pwhash_passwd_min","_crypto_pwhash_primitive","_crypto_pwhash_saltbytes","_crypto_pwhash_scryptsalsa208sha256","_crypto_pwhash_scryptsalsa208sha256_bytes_max","_crypto_pwhash_scryptsalsa208sha256_bytes_min","_crypto_pwhash_scryptsalsa208sha256_ll","_crypto_pwhash_scryptsalsa208sha256_memlimit_interactive","_crypto_pwhash_scryptsalsa208sha256_memlimit_max","_crypto_pwhash_scryptsalsa208sha256_memlimit_min","_crypto_pwhash_scryptsalsa208sha256_memlimit_sensitive","_crypto_pwhash_scryptsalsa208sha256_opslimit_interactive","_crypto_pwhash_scryptsalsa208sha256_opslimit_max","_crypto_pwhash_scryptsalsa208sha256_opslimit_min","_crypto_pwhash_scryptsalsa208sha256_opslimit_sensitive","_crypto_pwhash_scryptsalsa208sha256_passwd_max","_crypto_pwhash_scryptsalsa208sha256_passwd_min","_crypto_pwhash_scryptsalsa208sha256_saltbytes","_crypto_pwhash_scryptsalsa208sha256_str","_crypto_pwhash_scryptsalsa208sha256_str_needs_rehash","_crypto_pwhash_scryptsalsa208sha256_str_verify","_crypto_pwhash_scryptsalsa208sha256_strbytes","_crypto_pwhash_scryptsalsa208sha256_strprefix","_crypto_pwhash_str","_crypto_pwhash_str_alg","_crypto_pwhash_str_needs_rehash","_crypto_pwhash_str_verify","_crypto_pwhash_strbytes","_crypto_pwhash_strprefix","_crypto_scalarmult","_crypto_scalarmult_base","_crypto_scalarmult_bytes","_crypto_scalarmult_curve25519","_crypto_scalarmult_curve25519_base","_crypto_scalarmult_curve25519_bytes","_crypto_scalarmult_curve25519_scalarbytes","_crypto_scalarmult_ed25519","_crypto_scalarmult_ed25519_base","_crypto_scalarmult_ed25519_base_noclamp","_crypto_scalarmult_ed25519_bytes","_crypto_scalarmult_ed25519_noclamp","_crypto_scalarmult_ed25519_scalarbytes","_crypto_scalarmult_primitive","_crypto_scalarmult_ristretto255","_crypto_scalarmult_ristretto255_base","_crypto_scalarmult_ristretto255_bytes","_crypto_scalarmult_ristretto255_scalarbytes","_crypto_scalarmult_scalarbytes","_crypto_secretbox","_crypto_secretbox_boxzerobytes","_crypto_secretbox_detached","_crypto_secretbox_easy","_crypto_secretbox_keybytes","_crypto_secretbox_keygen","_crypto_secretbox_macbytes","_crypto_secretbox_messagebytes_max","_crypto_secretbox_noncebytes","_crypto_secretbox_open","_crypto_secretbox_open_detached","_crypto_secretbox_open_easy","_crypto_secretbox_primitive","_crypto_secretbox_xchacha20poly1305_detached","_crypto_secretbox_xchacha20poly1305_easy","_crypto_secretbox_xchacha20poly1305_keybytes","_crypto_secretbox_xchacha20poly1305_macbytes","_crypto_secretbox_xchacha20poly1305_messagebytes_max","_crypto_secretbox_xchacha20poly1305_noncebytes","_crypto_secretbox_xchacha20poly1305_open_detached","_crypto_secretbox_xchacha20poly1305_open_easy","_crypto_secretbox_xsalsa20poly1305","_crypto_secretbox_xsalsa20poly1305_boxzerobytes","_crypto_secretbox_xsalsa20poly1305_keybytes","_crypto_secretbox_xsalsa20poly1305_keygen","_crypto_secretbox_xsalsa20poly1305_macbytes","_crypto_secretbox_xsalsa20poly1305_messagebytes_max","_crypto_secretbox_xsalsa20poly1305_noncebytes","_crypto_secretbox_xsalsa20poly1305_open","_crypto_secretbox_xsalsa20poly1305_zerobytes","_crypto_secretbox_zerobytes","_crypto_secretstream_xchacha20poly1305_abytes","_crypto_secretstream_xchacha20poly1305_headerbytes","_crypto_secretstream_xchacha20poly1305_init_pull","_crypto_secretstream_xchacha20poly1305_init_push","_crypto_secretstream_xchacha20poly1305_keybytes","_crypto_secretstream_xchacha20poly1305_keygen","_crypto_secretstream_xchacha20poly1305_messagebytes_max","_crypto_secretstream_xchacha20poly1305_pull","_crypto_secretstream_xchacha20poly1305_push","_crypto_secretstream_xchacha20poly1305_rekey","_crypto_secretstream_xchacha20poly1305_statebytes","_crypto_secretstream_xchacha20poly1305_tag_final","_crypto_secretstream_xchacha20poly1305_tag_message","_crypto_secretstream_xchacha20poly1305_tag_push","_crypto_secretstream_xchacha20poly1305_tag_rekey","_crypto_shorthash","_crypto_shorthash_bytes","_crypto_shorthash_keybytes","_crypto_shorthash_keygen","_crypto_shorthash_primitive","_crypto_shorthash_siphash24","_crypto_shorthash_siphash24_bytes","_crypto_shorthash_siphash24_keybytes","_crypto_shorthash_siphashx24","_crypto_shorthash_siphashx24_bytes","_crypto_shorthash_siphashx24_keybytes","_crypto_sign","_crypto_sign_bytes","_crypto_sign_detached","_crypto_sign_ed25519","_crypto_sign_ed25519_bytes","_crypto_sign_ed25519_detached","_crypto_sign_ed25519_keypair","_crypto_sign_ed25519_messagebytes_max","_crypto_sign_ed25519_open","_crypto_sign_ed25519_pk_to_curve25519","_crypto_sign_ed25519_publickeybytes","_crypto_sign_ed25519_secretkeybytes","_crypto_sign_ed25519_seed_keypair","_crypto_sign_ed25519_seedbytes","_crypto_sign_ed25519_sk_to_curve25519","_crypto_sign_ed25519_sk_to_pk","_crypto_sign_ed25519_sk_to_seed","_crypto_sign_ed25519_verify_detached","_crypto_sign_ed25519ph_final_create","_crypto_sign_ed25519ph_final_verify","_crypto_sign_ed25519ph_init","_crypto_sign_ed25519ph_statebytes","_crypto_sign_ed25519ph_update","_crypto_sign_final_create","_crypto_sign_final_verify","_crypto_sign_init","_crypto_sign_keypair","_crypto_sign_messagebytes_max","_crypto_sign_open","_crypto_sign_primitive","_crypto_sign_publickeybytes","_crypto_sign_secretkeybytes","_crypto_sign_seed_keypair","_crypto_sign_seedbytes","_crypto_sign_statebytes","_crypto_sign_update","_crypto_sign_verify_detached","_crypto_stream","_crypto_stream_chacha20","_crypto_stream_chacha20_ietf","_crypto_stream_chacha20_ietf_keybytes","_crypto_stream_chacha20_ietf_keygen","_crypto_stream_chacha20_ietf_messagebytes_max","_crypto_stream_chacha20_ietf_noncebytes","_crypto_stream_chacha20_ietf_xor","_crypto_stream_chacha20_ietf_xor_ic","_crypto_stream_chacha20_keybytes","_crypto_stream_chacha20_keygen","_crypto_stream_chacha20_messagebytes_max","_crypto_stream_chacha20_noncebytes","_crypto_stream_chacha20_xor","_crypto_stream_chacha20_xor_ic","_crypto_stream_keybytes","_crypto_stream_keygen","_crypto_stream_messagebytes_max","_crypto_stream_noncebytes","_crypto_stream_primitive","_crypto_stream_salsa20","_crypto_stream_salsa20_keybytes","_crypto_stream_salsa20_keygen","_crypto_stream_salsa20_messagebytes_max","_crypto_stream_salsa20_noncebytes","_crypto_stream_salsa20_xor","_crypto_stream_salsa20_xor_ic","_crypto_stream_salsa2012","_crypto_stream_salsa2012_keybytes","_crypto_stream_salsa2012_keygen","_crypto_stream_salsa2012_messagebytes_max","_crypto_stream_salsa2012_noncebytes","_crypto_stream_salsa2012_xor","_crypto_stream_salsa208","_crypto_stream_salsa208_keybytes","_crypto_stream_salsa208_keygen","_crypto_stream_salsa208_messagebytes_max","_crypto_stream_salsa208_noncebytes","_crypto_stream_salsa208_xor","_crypto_stream_xchacha20","_crypto_stream_xchacha20_keybytes","_crypto_stream_xchacha20_keygen","_crypto_stream_xchacha20_messagebytes_max","_crypto_stream_xchacha20_noncebytes","_crypto_stream_xchacha20_xor","_crypto_stream_xchacha20_xor_ic","_crypto_stream_xor","_crypto_stream_xsalsa20","_crypto_stream_xsalsa20_keybytes","_crypto_stream_xsalsa20_keygen","_crypto_stream_xsalsa20_messagebytes_max","_crypto_stream_xsalsa20_noncebytes","_crypto_stream_xsalsa20_xor","_crypto_stream_xsalsa20_xor_ic","_crypto_verify_16","_crypto_verify_16_bytes","_crypto_verify_32","_crypto_verify_32_bytes","_crypto_verify_64","_crypto_verify_64_bytes","_crypto_xof_shake128","_crypto_xof_shake128_blockbytes","_crypto_xof_shake128_domain_standard","_crypto_xof_shake128_init","_crypto_xof_shake128_init_with_domain","_crypto_xof_shake128_squeeze","_crypto_xof_shake128_statebytes","_crypto_xof_shake128_update","_crypto_xof_shake256","_crypto_xof_shake256_blockbytes","_crypto_xof_shake256_domain_standard","_crypto_xof_shake256_init","_crypto_xof_shake256_init_with_domain","_crypto_xof_shake256_squeeze","_crypto_xof_shake256_statebytes","_crypto_xof_shake256_update","_crypto_xof_turboshake128","_crypto_xof_turboshake128_blockbytes","_crypto_xof_turboshake128_domain_standard","_crypto_xof_turboshake128_init","_crypto_xof_turboshake128_init_with_domain","_crypto_xof_turboshake128_squeeze","_crypto_xof_turboshake128_statebytes","_crypto_xof_turboshake128_update","_crypto_xof_turboshake256","_crypto_xof_turboshake256_blockbytes","_crypto_xof_turboshake256_domain_standard","_crypto_xof_turboshake256_init","_crypto_xof_turboshake256_init_with_domain","_crypto_xof_turboshake256_squeeze","_crypto_xof_turboshake256_statebytes","_crypto_xof_turboshake256_update","_randombytes","_randombytes_buf","_randombytes_buf_deterministic","_randombytes_close","_randombytes_implementation_name","_randombytes_random","_randombytes_seedbytes","_randombytes_stir","_randombytes_uniform","_sodium_base64_encoded_len","_sodium_base642bin","_sodium_bin2base64","_sodium_bin2hex","_sodium_bin2ip","_sodium_hex2bin","_sodium_init","_sodium_ip2bin","_sodium_library_minimal","_sodium_library_version_major","_sodium_library_version_minor","_sodium_pad","_sodium_unpad","_sodium_version_string"]' export EXPORTED_RUNTIME_METHODS='["UTF8ToString","getValue","setValue","HEAPU8"]' export JS_RESERVED_MEMORY_STANDARD=16MB -export JS_RESERVED_MEMORY_SUMO=48MB +export JS_RESERVED_MEMORY_SUMO=80MB export JS_RESERVED_MEMORY_TESTS=16MB export WASM_INITIAL_MEMORY=4MB -export LDFLAGS="-s RESERVED_FUNCTION_POINTERS=8" +export LDFLAGS="-sALLOW_TABLE_GROWTH" export LDFLAGS="${LDFLAGS} -s ALLOW_MEMORY_GROWTH=1" export LDFLAGS="${LDFLAGS} -s SINGLE_FILE=1 -s SINGLE_FILE_BINARY_ENCODE=0" export LDFLAGS="${LDFLAGS} -s ASSERTIONS=0" -export LDFLAGS="${LDFLAGS} -s AGGRESSIVE_VARIABLE_ELIMINATION=1 -s ALIASING_FUNCTION_POINTERS=1" export LDFLAGS="${LDFLAGS} -s DISABLE_EXCEPTION_CATCHING=1" -export LDFLAGS="${LDFLAGS} -s ELIMINATE_DUPLICATE_FUNCTIONS=1" export LDFLAGS="${LDFLAGS} -s NODEJS_CATCH_EXIT=0" export LDFLAGS="${LDFLAGS} -s NODEJS_CATCH_REJECTION=0" export LDFLAGS="${LDFLAGS} -s WASM_BIGINT=0" +export LDFLAGS="${LDFLAGS} -flto" +export CFLAGS="${CFLAGS:+${CFLAGS} }-flto" + +# Parse arguments +BUILD_TYPE="" +ENABLE_SIMD="no" + +for arg in "$@"; do + case "$arg" in + --standard|--sumo|--browser-tests|--tests) + BUILD_TYPE="$arg" + ;; + --simd) + ENABLE_SIMD="yes" + ;; + *) + echo "Unknown argument: $arg" + echo "Usage: $0 [--simd]" + echo " := --standard | --sumo | --browser-tests | --tests" + echo "Options:" + echo " --simd Enable WebAssembly SIMD128 (faster Argon2, requires WASM SIMD support)" + echo + exit 1 + ;; + esac +done echo -if [ "$1" = "--standard" ]; then +if [ "$BUILD_TYPE" = "--standard" ]; then export EXPORTED_FUNCTIONS="$EXPORTED_FUNCTIONS_STANDARD" export LDFLAGS="${LDFLAGS} ${LDFLAGS_DIST}" export LDFLAGS_JS="-s TOTAL_MEMORY=${JS_RESERVED_MEMORY_STANDARD}" @@ -29,7 +53,7 @@ if [ "$1" = "--standard" ]; then export CONFIG_EXTRA="--enable-minimal" export DIST='yes' echo "Building a standard distribution in [${PREFIX}]" -elif [ "$1" = "--sumo" ]; then +elif [ "$BUILD_TYPE" = "--sumo" ]; then export EXPORTED_FUNCTIONS="$EXPORTED_FUNCTIONS_SUMO" export LDFLAGS="${LDFLAGS} ${LDFLAGS_DIST}" export LDFLAGS_JS="-s TOTAL_MEMORY=${JS_RESERVED_MEMORY_SUMO}" @@ -37,7 +61,7 @@ elif [ "$1" = "--sumo" ]; then export DONE_FILE="$(pwd)/js-sumo.done" export DIST='yes' echo "Building a sumo distribution in [${PREFIX}]" -elif [ "$1" = "--browser-tests" ]; then +elif [ "$BUILD_TYPE" = "--browser-tests" ]; then export EXPORTED_FUNCTIONS="$EXPORTED_FUNCTIONS_SUMO" export CPPFLAGS="${CPPFLAGS} -s FORCE_FILESYSTEM=1" export LDFLAGS="${LDFLAGS}" @@ -47,7 +71,7 @@ elif [ "$1" = "--browser-tests" ]; then export BROWSER_TESTS='yes' export DIST='no' echo "Building tests for web browsers in [${PREFIX}]" -elif [ "$1" = "--tests" ]; then +elif [ "$BUILD_TYPE" = "--tests" ]; then echo "Building for testing" export EXPORTED_FUNCTIONS="$EXPORTED_FUNCTIONS_SUMO" export CPPFLAGS="${CPPFLAGS} -s FORCE_FILESYSTEM=1 -DBENCHMARKS -DITERATIONS=10" @@ -58,17 +82,30 @@ elif [ "$1" = "--tests" ]; then export DIST='no' echo "Building for testing in [${PREFIX}]" else - echo "Usage: $0 " + echo "Usage: $0 [--simd]" echo " := --standard | --sumo | --browser-tests | --tests" + echo "Options:" + echo " --simd Enable WebAssembly SIMD128 (faster Argon2, requires WASM SIMD support)" echo exit 1 fi + +if [ "$ENABLE_SIMD" = "yes" ]; then + echo "SIMD128 enabled" +fi export JS_EXPORTS_FLAGS="-s EXPORTED_FUNCTIONS=${EXPORTED_FUNCTIONS} -s EXPORTED_RUNTIME_METHODS=${EXPORTED_RUNTIME_METHODS}" rm -f "$DONE_FILE" echo +if [ "$ENABLE_SIMD" = "yes" ]; then + export SIMD_CFLAGS="-msimd128" +else + export SIMD_CFLAGS="" +fi + +# First build without SIMD for asm.js fallback (always needed) emconfigure ./configure $CONFIG_EXTRA --disable-shared --prefix="$PREFIX" \ --without-pthreads \ --disable-ssp --disable-asm --disable-pie && @@ -79,12 +116,23 @@ if [ "$DIST" = yes ]; then emccLibsodium() { outFile="${1}" shift - emcc "$CFLAGS" --llvm-lto 1 $CPPFLAGS $LDFLAGS $JS_EXPORTS_FLAGS "${@}" \ + emcc $CPPFLAGS $LDFLAGS $JS_EXPORTS_FLAGS "${@}" \ "${PREFIX}/lib/libsodium.a" -o "${outFile}" || exit 1 } emmake make $MAKE_FLAGS install || exit 1 + + # Build asm.js fallback (without SIMD) emccLibsodium "${PREFIX}/lib/libsodium.asm.tmp.js" -Oz -s WASM=0 $LDFLAGS_JS - emccLibsodium "${PREFIX}/lib/libsodium.wasm.tmp.js" -O3 -s WASM=1 -s EVAL_CTORS=1 -s INITIAL_MEMORY=${WASM_INITIAL_MEMORY} + + if [ "$ENABLE_SIMD" = "yes" ]; then + # Rebuild with SIMD for WASM + emmake make clean + export CFLAGS="${CFLAGS:+$CFLAGS }${SIMD_CFLAGS}" + emmake make $MAKE_FLAGS install || exit 1 + fi + + # Build WASM (with SIMD if enabled) + emccLibsodium "${PREFIX}/lib/libsodium.wasm.tmp.js" -O3 ${SIMD_CFLAGS} -s WASM=1 -s EVAL_CTORS=2 -s INITIAL_MEMORY=${WASM_INITIAL_MEMORY} # Build the output file by concatenating parts to preserve null bytes # (command substitution in heredoc strips null bytes from WASM binary) @@ -120,6 +168,20 @@ if [ "$DIST" = yes ]; then }; randomValuesStandard(); Module.getRandomValue = randomValuesStandard; + Module.getRandomBytes = function(ptr, size) { + var heapu8 = Module.HEAPU8; + var chunk = 65536; + while (size > chunk) { + var buf = new Uint8Array(chunk); + crypto_.getRandomValues(buf); + heapu8.set(buf, ptr); + ptr += chunk; + size -= chunk; + } + var buf = new Uint8Array(size); + crypto_.getRandomValues(buf); + heapu8.set(buf, ptr); + }; } catch (e) { try { var crypto = require('crypto'); @@ -129,6 +191,10 @@ if [ "$DIST" = yes ]; then }; randomValueNodeJS(); Module.getRandomValue = randomValueNodeJS; + Module.getRandomBytes = function(ptr, size) { + var buf = crypto['randomBytes'](size); + Module.HEAPU8.set(buf, ptr); + }; } catch (e) { throw 'No secure random number generator found'; } diff --git a/dist-build/generate-emscripten-symbols.sh b/dist-build/generate-emscripten-symbols.sh index 67e7b7ec..7f60a0ac 100755 --- a/dist-build/generate-emscripten-symbols.sh +++ b/dist-build/generate-emscripten-symbols.sh @@ -2,7 +2,7 @@ set -e -LIBSODIUM=${LIBSODIUM:-/tmp/sodium/lib/libsodium.28.dylib} +LIBSODIUM=${LIBSODIUM:-/tmp/sodium/lib/libsodium.30.dylib} symbols() { { diff --git a/packaging/dotnet-core/libsodium.pkgproj b/packaging/dotnet-core/libsodium.pkgproj index 15015275..16ec4483 100644 --- a/packaging/dotnet-core/libsodium.pkgproj +++ b/packaging/dotnet-core/libsodium.pkgproj @@ -9,7 +9,7 @@ libsodium - 1.0.22.0 + 1.0.23.0 Frank Denis Internal implementation package not meant for direct consumption. Please do not reference directly. © $([System.DateTime]::UtcNow.ToString(yyyy)) Frank Denis diff --git a/src/libsodium/Makefile.am b/src/libsodium/Makefile.am index 9680cf6d..4531a986 100644 --- a/src/libsodium/Makefile.am +++ b/src/libsodium/Makefile.am @@ -32,6 +32,8 @@ libsodium_la_SOURCES = \ crypto_core/keccak1600/keccak1600.c \ crypto_core/keccak1600/ref/keccak1600_ref.c \ crypto_core/keccak1600/ref/keccak1600_ref.h \ + crypto_core/keccak1600/armsha3/keccak1600_armsha3.c \ + crypto_core/keccak1600/armsha3/keccak1600_armsha3.h \ crypto_core/salsa/ref/core_salsa_ref.c \ crypto_core/softaes/softaes.c \ crypto_generichash/crypto_generichash.c \ @@ -48,6 +50,7 @@ libsodium_la_SOURCES = \ crypto_hash/sha256/cp/hash_sha256_cp.c \ crypto_hash/sha512/hash_sha512.c \ crypto_hash/sha512/cp/hash_sha512_cp.c \ + crypto_hash/sha3/hash_sha3.c \ crypto_ipcrypt/crypto_ipcrypt.c \ crypto_ipcrypt/ipcrypt_soft.c \ crypto_ipcrypt/ipcrypt_soft.h \ @@ -56,9 +59,11 @@ libsodium_la_SOURCES = \ crypto_kdf/crypto_kdf.c \ crypto_kdf/hkdf/kdf_hkdf_sha256.c \ crypto_kdf/hkdf/kdf_hkdf_sha512.c \ + crypto_kem/crypto_kem.c \ crypto_kem/mlkem768/kem_mlkem768.c \ crypto_kem/mlkem768/ref/kem_mlkem768_ref.c \ crypto_kem/mlkem768/ref/kem_mlkem768_ref.h \ + crypto_kem/xwing/kem_xwing.c \ crypto_kx/crypto_kx.c \ crypto_onetimeauth/crypto_onetimeauth.c \ crypto_onetimeauth/poly1305/onetimeauth_poly1305.c \ @@ -72,11 +77,13 @@ libsodium_la_SOURCES = \ crypto_pwhash/argon2/argon2-encoding.c \ crypto_pwhash/argon2/argon2-encoding.h \ crypto_pwhash/argon2/argon2-fill-block-ref.c \ + crypto_pwhash/argon2/argon2-fill-block-wasm32.c \ crypto_pwhash/argon2/argon2.c \ crypto_pwhash/argon2/argon2.h \ crypto_pwhash/argon2/blake2b-long.c \ crypto_pwhash/argon2/blake2b-long.h \ crypto_pwhash/argon2/blamka-round-ref.h \ + crypto_pwhash/argon2/blamka-round-wasm32.h \ crypto_pwhash/argon2/pwhash_argon2i.c \ crypto_pwhash/argon2/pwhash_argon2id.c \ crypto_pwhash/crypto_pwhash.c \ @@ -260,7 +267,9 @@ libarmcrypto_la_SOURCES = \ crypto_aead/aegis256/aegis256_armcrypto.h \ crypto_aead/aes256gcm/armcrypto/aead_aes256gcm_armcrypto.c \ crypto_ipcrypt/ipcrypt_armcrypto.c \ - crypto_ipcrypt/ipcrypt_armcrypto.h + crypto_ipcrypt/ipcrypt_armcrypto.h \ + crypto_pwhash/argon2/argon2-fill-block-neon.c \ + crypto_pwhash/argon2/blamka-round-neon.h libaesni_la_LDFLAGS = $(libsodium_la_LDFLAGS) libaesni_la_CPPFLAGS = $(libsodium_la_CPPFLAGS) \ diff --git a/src/libsodium/crypto_aead/aegis128l/aegis128l_common.h b/src/libsodium/crypto_aead/aegis128l/aegis128l_common.h index cfdbaf32..3b6dfcbb 100644 --- a/src/libsodium/crypto_aead/aegis128l/aegis128l_common.h +++ b/src/libsodium/crypto_aead/aegis128l/aegis128l_common.h @@ -242,8 +242,12 @@ decrypt_detached(uint8_t *m, const uint8_t *c, size_t clen, const uint8_t *mac, ret = crypto_verify_32(computed_mac, mac); } } - if (ret != 0 && m != NULL) { - memset(m, 0, mlen); + if (ret != 0) { + if (m != NULL) { + memset(m, 0, mlen); + } + return ret; } - return ret; + ACQUIRE_FENCE; + return 0; } diff --git a/src/libsodium/crypto_aead/aegis256/aegis256_common.h b/src/libsodium/crypto_aead/aegis256/aegis256_common.h index 508c5adb..96e8bc6a 100644 --- a/src/libsodium/crypto_aead/aegis256/aegis256_common.h +++ b/src/libsodium/crypto_aead/aegis256/aegis256_common.h @@ -225,8 +225,12 @@ decrypt_detached(uint8_t *m, const uint8_t *c, size_t clen, const uint8_t *mac, ret = crypto_verify_32(computed_mac, mac); } } - if (ret != 0 && m != NULL) { - memset(m, 0, mlen); + if (ret != 0) { + if (m != NULL) { + memset(m, 0, mlen); + } + return ret; } - return ret; + ACQUIRE_FENCE; + return 0; } diff --git a/src/libsodium/crypto_aead/aes256gcm/aesni/aead_aes256gcm_aesni.c b/src/libsodium/crypto_aead/aes256gcm/aesni/aead_aes256gcm_aesni.c index b2ac748d..b9ce4b94 100644 --- a/src/libsodium/crypto_aead/aes256gcm/aesni/aead_aes256gcm_aesni.c +++ b/src/libsodium/crypto_aead/aes256gcm/aesni/aead_aes256gcm_aesni.c @@ -935,6 +935,7 @@ crypto_aead_aes256gcm_decrypt_detached_afternm(unsigned char *m, unsigned char * memset(m, 0xd0, m_len); return -1; } + ACQUIRE_FENCE; return 0; } diff --git a/src/libsodium/crypto_aead/aes256gcm/armcrypto/aead_aes256gcm_armcrypto.c b/src/libsodium/crypto_aead/aes256gcm/armcrypto/aead_aes256gcm_armcrypto.c index 8455f169..f7d7a5f1 100644 --- a/src/libsodium/crypto_aead/aes256gcm/armcrypto/aead_aes256gcm_armcrypto.c +++ b/src/libsodium/crypto_aead/aes256gcm/armcrypto/aead_aes256gcm_armcrypto.c @@ -953,6 +953,7 @@ crypto_aead_aes256gcm_decrypt_detached_afternm(unsigned char *m, unsigned char * memset(m, 0xd0, m_len); return -1; } + ACQUIRE_FENCE; return 0; } diff --git a/src/libsodium/crypto_aead/chacha20poly1305/aead_chacha20poly1305.c b/src/libsodium/crypto_aead/chacha20poly1305/aead_chacha20poly1305.c index c3540879..84c1e56f 100644 --- a/src/libsodium/crypto_aead/chacha20poly1305/aead_chacha20poly1305.c +++ b/src/libsodium/crypto_aead/chacha20poly1305/aead_chacha20poly1305.c @@ -208,6 +208,7 @@ crypto_aead_chacha20poly1305_decrypt_detached(unsigned char *m, memset(m, 0, mlen); return -1; } + ACQUIRE_FENCE; crypto_stream_chacha20_xor_ic(m, c, mlen, npub, 1U, k); return 0; @@ -292,6 +293,7 @@ crypto_aead_chacha20poly1305_ietf_decrypt_detached(unsigned char *m, memset(m, 0, mlen); return -1; } + ACQUIRE_FENCE; crypto_stream_chacha20_ietf_xor_ic(m, c, mlen, npub, 1U, k); return 0; diff --git a/src/libsodium/crypto_aead/xchacha20poly1305/aead_xchacha20poly1305.c b/src/libsodium/crypto_aead/xchacha20poly1305/aead_xchacha20poly1305.c index 07e36557..a4397ad0 100644 --- a/src/libsodium/crypto_aead/xchacha20poly1305/aead_xchacha20poly1305.c +++ b/src/libsodium/crypto_aead/xchacha20poly1305/aead_xchacha20poly1305.c @@ -112,6 +112,7 @@ _decrypt_detached(unsigned char *m, memset(m, 0, mlen); return -1; } + ACQUIRE_FENCE; crypto_stream_chacha20_ietf_ext_xor_ic(m, c, mlen, npub, 1U, k); return 0; diff --git a/src/libsodium/crypto_core/ed25519/core_ed25519.c b/src/libsodium/crypto_core/ed25519/core_ed25519.c index 93fd800d..41b517b8 100644 --- a/src/libsodium/crypto_core/ed25519/core_ed25519.c +++ b/src/libsodium/crypto_core/ed25519/core_ed25519.c @@ -61,7 +61,8 @@ crypto_core_ed25519_sub(unsigned char *r, static int _string_to_points(unsigned char * const px, const size_t n, - const char *ctx, const unsigned char *msg, size_t msg_len, + const unsigned char *ctx, size_t ctx_len, + const unsigned char *msg, size_t msg_len, int hash_alg) { unsigned char h[crypto_core_ed25519_HASHBYTES]; @@ -71,7 +72,7 @@ _string_to_points(unsigned char * const px, const size_t n, if (n > 2U) { abort(); /* LCOV_EXCL_LINE */ } - if (core_h2c_string_to_hash(h_be, n * HASH_GE_L, ctx, msg, msg_len, + if (core_h2c_string_to_hash(h_be, n * HASH_GE_L, ctx, ctx_len, msg, msg_len, hash_alg) != 0) { return -1; } @@ -88,20 +89,22 @@ _string_to_points(unsigned char * const px, const size_t n, int crypto_core_ed25519_from_string(unsigned char p[crypto_core_ed25519_BYTES], - const char *ctx, const unsigned char *msg, - size_t msg_len, int hash_alg) + const unsigned char *ctx, size_t ctx_len, + const unsigned char *msg, size_t msg_len, + int hash_alg) { - return _string_to_points(p, 1, ctx, msg, msg_len, hash_alg); + return _string_to_points(p, 1, ctx, ctx_len, msg, msg_len, hash_alg); } int crypto_core_ed25519_from_string_ro(unsigned char p[crypto_core_ed25519_BYTES], - const char *ctx, const unsigned char *msg, - size_t msg_len, int hash_alg) + const unsigned char *ctx, size_t ctx_len, + const unsigned char *msg, size_t msg_len, + int hash_alg) { unsigned char px[2 * crypto_core_ed25519_BYTES]; - if (_string_to_points(px, 2, ctx, msg, msg_len, hash_alg) != 0) { + if (_string_to_points(px, 2, ctx, ctx_len, msg, msg_len, hash_alg) != 0) { return -1; } return crypto_core_ed25519_add(p, &px[0], &px[crypto_core_ed25519_BYTES]); diff --git a/src/libsodium/crypto_core/ed25519/core_h2c.c b/src/libsodium/crypto_core/ed25519/core_h2c.c index 37f3ed59..58f6626f 100644 --- a/src/libsodium/crypto_core/ed25519/core_h2c.c +++ b/src/libsodium/crypto_core/ed25519/core_h2c.c @@ -1,7 +1,6 @@ #include #include #include -#include #include "core_h2c.h" #include "crypto_hash_sha256.h" @@ -12,7 +11,8 @@ #define HASH_BLOCKBYTES 64U static int -core_h2c_string_to_hash_sha256(unsigned char *h, const size_t h_len, const char *ctx, +core_h2c_string_to_hash_sha256(unsigned char *h, const size_t h_len, + const unsigned char *ctx, size_t ctx_len, const unsigned char *msg, size_t msg_len) { crypto_hash_sha256_state st; @@ -21,7 +21,6 @@ core_h2c_string_to_hash_sha256(unsigned char *h, const size_t h_len, const char unsigned char ux[HASH_BYTES] = { 0 }; unsigned char t[3] = { 0U, (unsigned char) h_len, 0U}; unsigned char ctx_len_u8; - size_t ctx_len = ctx != NULL ? strlen(ctx) : 0U; size_t i, j; assert(h_len <= 0xff); @@ -30,9 +29,9 @@ core_h2c_string_to_hash_sha256(unsigned char *h, const size_t h_len, const char crypto_hash_sha256_update(&st, (const unsigned char *) "H2C-OVERSIZE-DST-", sizeof "H2C-OVERSIZE-DST-" - 1U); - crypto_hash_sha256_update(&st, (const unsigned char *) ctx, ctx_len); + crypto_hash_sha256_update(&st, ctx, ctx_len); crypto_hash_sha256_final(&st, u0); - ctx = (const char *) u0; + ctx = u0; ctx_len = HASH_BYTES; COMPILER_ASSERT(HASH_BYTES <= (size_t) 0xff); } @@ -41,7 +40,7 @@ core_h2c_string_to_hash_sha256(unsigned char *h, const size_t h_len, const char crypto_hash_sha256_update(&st, empty_block, sizeof empty_block); crypto_hash_sha256_update(&st, msg, msg_len); crypto_hash_sha256_update(&st, t, 3U); - crypto_hash_sha256_update(&st, (const unsigned char *) ctx, ctx_len); + crypto_hash_sha256_update(&st, ctx, ctx_len); crypto_hash_sha256_update(&st, &ctx_len_u8, 1U); crypto_hash_sha256_final(&st, u0); @@ -53,7 +52,7 @@ core_h2c_string_to_hash_sha256(unsigned char *h, const size_t h_len, const char crypto_hash_sha256_init(&st); crypto_hash_sha256_update(&st, ux, HASH_BYTES); crypto_hash_sha256_update(&st, &t[2], 1U); - crypto_hash_sha256_update(&st, (const unsigned char *) ctx, ctx_len); + crypto_hash_sha256_update(&st, ctx, ctx_len); crypto_hash_sha256_update(&st, &ctx_len_u8, 1U); crypto_hash_sha256_final(&st, ux); memcpy(&h[i], ux, h_len - i >= (sizeof ux) ? (sizeof ux) : h_len - i); @@ -68,7 +67,8 @@ core_h2c_string_to_hash_sha256(unsigned char *h, const size_t h_len, const char #define HASH_BLOCKBYTES 128U static int -core_h2c_string_to_hash_sha512(unsigned char *h, const size_t h_len, const char *ctx, +core_h2c_string_to_hash_sha512(unsigned char *h, const size_t h_len, + const unsigned char *ctx, size_t ctx_len, const unsigned char *msg, size_t msg_len) { crypto_hash_sha512_state st; @@ -77,7 +77,6 @@ core_h2c_string_to_hash_sha512(unsigned char *h, const size_t h_len, const char unsigned char ux[HASH_BYTES] = { 0 }; unsigned char t[3] = { 0U, (unsigned char) h_len, 0U}; unsigned char ctx_len_u8; - size_t ctx_len = ctx != NULL ? strlen(ctx) : 0U; size_t i, j; assert(h_len <= 0xff); @@ -86,9 +85,9 @@ core_h2c_string_to_hash_sha512(unsigned char *h, const size_t h_len, const char crypto_hash_sha512_update(&st, (const unsigned char *) "H2C-OVERSIZE-DST-", sizeof "H2C-OVERSIZE-DST-" - 1U); - crypto_hash_sha512_update(&st, (const unsigned char *) ctx, ctx_len); + crypto_hash_sha512_update(&st, ctx, ctx_len); crypto_hash_sha512_final(&st, u0); - ctx = (const char *) u0; + ctx = u0; ctx_len = HASH_BYTES; COMPILER_ASSERT(HASH_BYTES <= (size_t) 0xff); } @@ -97,7 +96,7 @@ core_h2c_string_to_hash_sha512(unsigned char *h, const size_t h_len, const char crypto_hash_sha512_update(&st, empty_block, sizeof empty_block); crypto_hash_sha512_update(&st, msg, msg_len); crypto_hash_sha512_update(&st, t, 3U); - crypto_hash_sha512_update(&st, (const unsigned char *) ctx, ctx_len); + crypto_hash_sha512_update(&st, ctx, ctx_len); crypto_hash_sha512_update(&st, &ctx_len_u8, 1U); crypto_hash_sha512_final(&st, u0); @@ -109,7 +108,7 @@ core_h2c_string_to_hash_sha512(unsigned char *h, const size_t h_len, const char crypto_hash_sha512_init(&st); crypto_hash_sha512_update(&st, ux, HASH_BYTES); crypto_hash_sha512_update(&st, &t[2], 1U); - crypto_hash_sha512_update(&st, (const unsigned char *) ctx, ctx_len); + crypto_hash_sha512_update(&st, ctx, ctx_len); crypto_hash_sha512_update(&st, &ctx_len_u8, 1U); crypto_hash_sha512_final(&st, ux); memcpy(&h[i], ux, h_len - i >= (sizeof ux) ? (sizeof ux) : h_len - i); @@ -118,14 +117,15 @@ core_h2c_string_to_hash_sha512(unsigned char *h, const size_t h_len, const char } int -core_h2c_string_to_hash(unsigned char *h, const size_t h_len, const char *ctx, +core_h2c_string_to_hash(unsigned char *h, const size_t h_len, + const unsigned char *ctx, size_t ctx_len, const unsigned char *msg, size_t msg_len, int hash_alg) { switch (hash_alg) { case CORE_H2C_SHA256: - return core_h2c_string_to_hash_sha256(h, h_len, ctx, msg, msg_len); + return core_h2c_string_to_hash_sha256(h, h_len, ctx, ctx_len, msg, msg_len); case CORE_H2C_SHA512: - return core_h2c_string_to_hash_sha512(h, h_len, ctx, msg, msg_len); + return core_h2c_string_to_hash_sha512(h, h_len, ctx, ctx_len, msg, msg_len); default: errno = EINVAL; return -1; diff --git a/src/libsodium/crypto_core/ed25519/core_h2c.h b/src/libsodium/crypto_core/ed25519/core_h2c.h index e595b80c..e10760ec 100644 --- a/src/libsodium/crypto_core/ed25519/core_h2c.h +++ b/src/libsodium/crypto_core/ed25519/core_h2c.h @@ -6,7 +6,8 @@ #define CORE_H2C_SHA256 1 #define CORE_H2C_SHA512 2 -int core_h2c_string_to_hash(unsigned char *h, const size_t h_len, const char *ctx, +int core_h2c_string_to_hash(unsigned char *h, const size_t h_len, + const unsigned char *ctx, size_t ctx_len, const unsigned char *msg, size_t msg_len, int hash_alg); #endif diff --git a/src/libsodium/crypto_core/ed25519/core_ristretto255.c b/src/libsodium/crypto_core/ed25519/core_ristretto255.c index 6d3a85cd..9cf57fd6 100644 --- a/src/libsodium/crypto_core/ed25519/core_ristretto255.c +++ b/src/libsodium/crypto_core/ed25519/core_ristretto255.c @@ -65,12 +65,13 @@ crypto_core_ristretto255_from_hash(unsigned char *p, const unsigned char *r) static int _string_to_element(unsigned char *p, - const char *ctx, const unsigned char *msg, size_t msg_len, + const unsigned char *ctx, size_t ctx_len, + const unsigned char *msg, size_t msg_len, int hash_alg) { unsigned char h[crypto_core_ristretto255_HASHBYTES]; - if (core_h2c_string_to_hash(h, sizeof h, ctx, msg, msg_len, + if (core_h2c_string_to_hash(h, sizeof h, ctx, ctx_len, msg, msg_len, hash_alg) != 0) { return -1; } @@ -81,18 +82,20 @@ _string_to_element(unsigned char *p, int crypto_core_ristretto255_from_string(unsigned char p[crypto_core_ristretto255_BYTES], - const char *ctx, const unsigned char *msg, - size_t msg_len, int hash_alg) + const unsigned char *ctx, size_t ctx_len, + const unsigned char *msg, size_t msg_len, + int hash_alg) { - return _string_to_element(p, ctx, msg, msg_len, hash_alg); + return _string_to_element(p, ctx, ctx_len, msg, msg_len, hash_alg); } int crypto_core_ristretto255_from_string_ro(unsigned char p[crypto_core_ristretto255_BYTES], - const char *ctx, const unsigned char *msg, - size_t msg_len, int hash_alg) + const unsigned char *ctx, size_t ctx_len, + const unsigned char *msg, size_t msg_len, + int hash_alg) { - return crypto_core_ristretto255_from_string(p, ctx, msg, msg_len, hash_alg); + return crypto_core_ristretto255_from_string(p, ctx, ctx_len, msg, msg_len, hash_alg); } void @@ -169,14 +172,15 @@ crypto_core_ristretto255_scalar_is_canonical(const unsigned char *s) int crypto_core_ristretto255_scalar_from_string(unsigned char *s, - const char *ctx, const unsigned char *msg, - size_t msg_len, int hash_alg) + const unsigned char *ctx, size_t ctx_len, + const unsigned char *msg, size_t msg_len, + int hash_alg) { unsigned char h[crypto_core_ristretto255_NONREDUCEDSCALARBYTES]; unsigned char h_be[HASH_SC_L]; size_t i; - if (core_h2c_string_to_hash(h_be, sizeof h_be, ctx, msg, msg_len, + if (core_h2c_string_to_hash(h_be, sizeof h_be, ctx, ctx_len, msg, msg_len, hash_alg) != 0) { return -1; } diff --git a/src/libsodium/crypto_core/keccak1600/armsha3/keccak1600_armsha3.c b/src/libsodium/crypto_core/keccak1600/armsha3/keccak1600_armsha3.c new file mode 100644 index 00000000..12c105cd --- /dev/null +++ b/src/libsodium/crypto_core/keccak1600/armsha3/keccak1600_armsha3.c @@ -0,0 +1,276 @@ +#include +#include + +#include "keccak1600_armsha3.h" +#include "private/common.h" + +#if defined(__ARM_FEATURE_SHA3) + +#include + +#ifdef __clang__ +# pragma clang attribute push(__attribute__((target("neon,sha3"))), apply_to = function) +#elif defined(__GNUC__) +# pragma GCC target("+simd+sha3") +#endif + +#define KECCAK1600_STATEBYTES 200 + +static const uint64_t RC[24] = { + 0x0000000000000001ULL, 0x0000000000008082ULL, 0x800000000000808aULL, 0x8000000080008000ULL, + 0x000000000000808bULL, 0x0000000080000001ULL, 0x8000000080008081ULL, 0x8000000000008009ULL, + 0x000000000000008aULL, 0x0000000000000088ULL, 0x0000000080008009ULL, 0x000000008000000aULL, + 0x000000008000808bULL, 0x800000000000008bULL, 0x8000000000008089ULL, 0x8000000000008003ULL, + 0x8000000000008002ULL, 0x8000000000000080ULL, 0x000000000000800aULL, 0x800000008000000aULL, + 0x8000000080008081ULL, 0x8000000000008080ULL, 0x0000000080000001ULL, 0x8000000080008008ULL +}; + +#define ROUND(A, E, rc_idx) \ + do { \ + uint64x2_t rc = vdupq_n_u64(RC[rc_idx]); \ + Ca = veor3q_u64(A##ba, veor3q_u64(A##ga, A##ka, A##ma), A##sa); \ + Ce = veor3q_u64(A##be, veor3q_u64(A##ge, A##ke, A##me), A##se); \ + Ci = veor3q_u64(A##bi, veor3q_u64(A##gi, A##ki, A##mi), A##si); \ + Co = veor3q_u64(A##bo, veor3q_u64(A##go, A##ko, A##mo), A##so); \ + Cu = veor3q_u64(A##bu, veor3q_u64(A##gu, A##ku, A##mu), A##su); \ + Da = vrax1q_u64(Cu, Ce); \ + De = vrax1q_u64(Ca, Ci); \ + Di = vrax1q_u64(Ce, Co); \ + Do = vrax1q_u64(Ci, Cu); \ + Du = vrax1q_u64(Co, Ca); \ + Ba = veorq_u64(A##ba, Da); \ + Be = vxarq_u64(A##ge, De, 64 - 44); \ + Bi = vxarq_u64(A##ki, Di, 64 - 43); \ + Bo = vxarq_u64(A##mo, Do, 64 - 21); \ + Bu = vxarq_u64(A##su, Du, 64 - 14); \ + E##ba = veorq_u64(vbcaxq_u64(Ba, Bi, Be), rc); \ + E##be = vbcaxq_u64(Be, Bo, Bi); \ + E##bi = vbcaxq_u64(Bi, Bu, Bo); \ + E##bo = vbcaxq_u64(Bo, Ba, Bu); \ + E##bu = vbcaxq_u64(Bu, Be, Ba); \ + Ba = vxarq_u64(A##bo, Do, 64 - 28); \ + Be = vxarq_u64(A##gu, Du, 64 - 20); \ + Bi = vxarq_u64(A##ka, Da, 64 - 3); \ + Bo = vxarq_u64(A##me, De, 64 - 45); \ + Bu = vxarq_u64(A##si, Di, 64 - 61); \ + E##ga = vbcaxq_u64(Ba, Bi, Be); \ + E##ge = vbcaxq_u64(Be, Bo, Bi); \ + E##gi = vbcaxq_u64(Bi, Bu, Bo); \ + E##go = vbcaxq_u64(Bo, Ba, Bu); \ + E##gu = vbcaxq_u64(Bu, Be, Ba); \ + Ba = vxarq_u64(A##be, De, 64 - 1); \ + Be = vxarq_u64(A##gi, Di, 64 - 6); \ + Bi = vxarq_u64(A##ko, Do, 64 - 25); \ + Bo = vxarq_u64(A##mu, Du, 64 - 8); \ + Bu = vxarq_u64(A##sa, Da, 64 - 18); \ + E##ka = vbcaxq_u64(Ba, Bi, Be); \ + E##ke = vbcaxq_u64(Be, Bo, Bi); \ + E##ki = vbcaxq_u64(Bi, Bu, Bo); \ + E##ko = vbcaxq_u64(Bo, Ba, Bu); \ + E##ku = vbcaxq_u64(Bu, Be, Ba); \ + Ba = vxarq_u64(A##bu, Du, 64 - 27); \ + Be = vxarq_u64(A##ga, Da, 64 - 36); \ + Bi = vxarq_u64(A##ke, De, 64 - 10); \ + Bo = vxarq_u64(A##mi, Di, 64 - 15); \ + Bu = vxarq_u64(A##so, Do, 64 - 56); \ + E##ma = vbcaxq_u64(Ba, Bi, Be); \ + E##me = vbcaxq_u64(Be, Bo, Bi); \ + E##mi = vbcaxq_u64(Bi, Bu, Bo); \ + E##mo = vbcaxq_u64(Bo, Ba, Bu); \ + E##mu = vbcaxq_u64(Bu, Be, Ba); \ + Ba = vxarq_u64(A##bi, Di, 64 - 62); \ + Be = vxarq_u64(A##go, Do, 64 - 55); \ + Bi = vxarq_u64(A##ku, Du, 64 - 39); \ + Bo = vxarq_u64(A##ma, Da, 64 - 41); \ + Bu = vxarq_u64(A##se, De, 64 - 2); \ + E##sa = vbcaxq_u64(Ba, Bi, Be); \ + E##se = vbcaxq_u64(Be, Bo, Bi); \ + E##si = vbcaxq_u64(Bi, Bu, Bo); \ + E##so = vbcaxq_u64(Bo, Ba, Bu); \ + E##su = vbcaxq_u64(Bu, Be, Ba); \ + } while (0) + +static void +keccakf_24_rounds(uint64_t st[25]) +{ + uint64x2_t Aba, Abe, Abi, Abo, Abu; + uint64x2_t Aga, Age, Agi, Ago, Agu; + uint64x2_t Aka, Ake, Aki, Ako, Aku; + uint64x2_t Ama, Ame, Ami, Amo, Amu; + uint64x2_t Asa, Ase, Asi, Aso, Asu; + uint64x2_t Eba, Ebe, Ebi, Ebo, Ebu; + uint64x2_t Ega, Ege, Egi, Ego, Egu; + uint64x2_t Eka, Eke, Eki, Eko, Eku; + uint64x2_t Ema, Eme, Emi, Emo, Emu; + uint64x2_t Esa, Ese, Esi, Eso, Esu; + uint64x2_t Ca, Ce, Ci, Co, Cu; + uint64x2_t Da, De, Di, Do, Du; + uint64x2_t Ba, Be, Bi, Bo, Bu; + + Aba = vdupq_n_u64(st[0]); Abe = vdupq_n_u64(st[1]); + Abi = vdupq_n_u64(st[2]); Abo = vdupq_n_u64(st[3]); + Abu = vdupq_n_u64(st[4]); + Aga = vdupq_n_u64(st[5]); Age = vdupq_n_u64(st[6]); + Agi = vdupq_n_u64(st[7]); Ago = vdupq_n_u64(st[8]); + Agu = vdupq_n_u64(st[9]); + Aka = vdupq_n_u64(st[10]); Ake = vdupq_n_u64(st[11]); + Aki = vdupq_n_u64(st[12]); Ako = vdupq_n_u64(st[13]); + Aku = vdupq_n_u64(st[14]); + Ama = vdupq_n_u64(st[15]); Ame = vdupq_n_u64(st[16]); + Ami = vdupq_n_u64(st[17]); Amo = vdupq_n_u64(st[18]); + Amu = vdupq_n_u64(st[19]); + Asa = vdupq_n_u64(st[20]); Ase = vdupq_n_u64(st[21]); + Asi = vdupq_n_u64(st[22]); Aso = vdupq_n_u64(st[23]); + Asu = vdupq_n_u64(st[24]); + + ROUND(A, E, 0); ROUND(E, A, 1); + ROUND(A, E, 2); ROUND(E, A, 3); + ROUND(A, E, 4); ROUND(E, A, 5); + ROUND(A, E, 6); ROUND(E, A, 7); + ROUND(A, E, 8); ROUND(E, A, 9); + ROUND(A, E, 10); ROUND(E, A, 11); + ROUND(A, E, 12); ROUND(E, A, 13); + ROUND(A, E, 14); ROUND(E, A, 15); + ROUND(A, E, 16); ROUND(E, A, 17); + ROUND(A, E, 18); ROUND(E, A, 19); + ROUND(A, E, 20); ROUND(E, A, 21); + ROUND(A, E, 22); ROUND(E, A, 23); + + st[0] = vgetq_lane_u64(Aba, 0); st[1] = vgetq_lane_u64(Abe, 0); + st[2] = vgetq_lane_u64(Abi, 0); st[3] = vgetq_lane_u64(Abo, 0); + st[4] = vgetq_lane_u64(Abu, 0); + st[5] = vgetq_lane_u64(Aga, 0); st[6] = vgetq_lane_u64(Age, 0); + st[7] = vgetq_lane_u64(Agi, 0); st[8] = vgetq_lane_u64(Ago, 0); + st[9] = vgetq_lane_u64(Agu, 0); + st[10] = vgetq_lane_u64(Aka, 0); st[11] = vgetq_lane_u64(Ake, 0); + st[12] = vgetq_lane_u64(Aki, 0); st[13] = vgetq_lane_u64(Ako, 0); + st[14] = vgetq_lane_u64(Aku, 0); + st[15] = vgetq_lane_u64(Ama, 0); st[16] = vgetq_lane_u64(Ame, 0); + st[17] = vgetq_lane_u64(Ami, 0); st[18] = vgetq_lane_u64(Amo, 0); + st[19] = vgetq_lane_u64(Amu, 0); + st[20] = vgetq_lane_u64(Asa, 0); st[21] = vgetq_lane_u64(Ase, 0); + st[22] = vgetq_lane_u64(Asi, 0); st[23] = vgetq_lane_u64(Aso, 0); + st[24] = vgetq_lane_u64(Asu, 0); +} + +static void +keccakf_12_rounds(uint64_t st[25]) +{ + uint64x2_t Aba, Abe, Abi, Abo, Abu; + uint64x2_t Aga, Age, Agi, Ago, Agu; + uint64x2_t Aka, Ake, Aki, Ako, Aku; + uint64x2_t Ama, Ame, Ami, Amo, Amu; + uint64x2_t Asa, Ase, Asi, Aso, Asu; + uint64x2_t Eba, Ebe, Ebi, Ebo, Ebu; + uint64x2_t Ega, Ege, Egi, Ego, Egu; + uint64x2_t Eka, Eke, Eki, Eko, Eku; + uint64x2_t Ema, Eme, Emi, Emo, Emu; + uint64x2_t Esa, Ese, Esi, Eso, Esu; + uint64x2_t Ca, Ce, Ci, Co, Cu; + uint64x2_t Da, De, Di, Do, Du; + uint64x2_t Ba, Be, Bi, Bo, Bu; + + Aba = vdupq_n_u64(st[0]); Abe = vdupq_n_u64(st[1]); + Abi = vdupq_n_u64(st[2]); Abo = vdupq_n_u64(st[3]); + Abu = vdupq_n_u64(st[4]); + Aga = vdupq_n_u64(st[5]); Age = vdupq_n_u64(st[6]); + Agi = vdupq_n_u64(st[7]); Ago = vdupq_n_u64(st[8]); + Agu = vdupq_n_u64(st[9]); + Aka = vdupq_n_u64(st[10]); Ake = vdupq_n_u64(st[11]); + Aki = vdupq_n_u64(st[12]); Ako = vdupq_n_u64(st[13]); + Aku = vdupq_n_u64(st[14]); + Ama = vdupq_n_u64(st[15]); Ame = vdupq_n_u64(st[16]); + Ami = vdupq_n_u64(st[17]); Amo = vdupq_n_u64(st[18]); + Amu = vdupq_n_u64(st[19]); + Asa = vdupq_n_u64(st[20]); Ase = vdupq_n_u64(st[21]); + Asi = vdupq_n_u64(st[22]); Aso = vdupq_n_u64(st[23]); + Asu = vdupq_n_u64(st[24]); + + ROUND(A, E, 12); ROUND(E, A, 13); + ROUND(A, E, 14); ROUND(E, A, 15); + ROUND(A, E, 16); ROUND(E, A, 17); + ROUND(A, E, 18); ROUND(E, A, 19); + ROUND(A, E, 20); ROUND(E, A, 21); + ROUND(A, E, 22); ROUND(E, A, 23); + + st[0] = vgetq_lane_u64(Aba, 0); st[1] = vgetq_lane_u64(Abe, 0); + st[2] = vgetq_lane_u64(Abi, 0); st[3] = vgetq_lane_u64(Abo, 0); + st[4] = vgetq_lane_u64(Abu, 0); + st[5] = vgetq_lane_u64(Aga, 0); st[6] = vgetq_lane_u64(Age, 0); + st[7] = vgetq_lane_u64(Agi, 0); st[8] = vgetq_lane_u64(Ago, 0); + st[9] = vgetq_lane_u64(Agu, 0); + st[10] = vgetq_lane_u64(Aka, 0); st[11] = vgetq_lane_u64(Ake, 0); + st[12] = vgetq_lane_u64(Aki, 0); st[13] = vgetq_lane_u64(Ako, 0); + st[14] = vgetq_lane_u64(Aku, 0); + st[15] = vgetq_lane_u64(Ama, 0); st[16] = vgetq_lane_u64(Ame, 0); + st[17] = vgetq_lane_u64(Ami, 0); st[18] = vgetq_lane_u64(Amo, 0); + st[19] = vgetq_lane_u64(Amu, 0); + st[20] = vgetq_lane_u64(Asa, 0); st[21] = vgetq_lane_u64(Ase, 0); + st[22] = vgetq_lane_u64(Asi, 0); st[23] = vgetq_lane_u64(Aso, 0); + st[24] = vgetq_lane_u64(Asu, 0); +} + +void +keccak1600_armsha3_permute_24(void *state) +{ + uint64_t st[25]; + unsigned int i; + + for (i = 0U; i < 25U; i++) { + st[i] = LOAD64_LE((const unsigned char *) state + i * 8U); + } + + keccakf_24_rounds(st); + + for (i = 0U; i < 25U; i++) { + STORE64_LE((unsigned char *) state + i * 8U, st[i]); + } +} + +void +keccak1600_armsha3_permute_12(void *state) +{ + uint64_t st[25]; + unsigned int i; + + for (i = 0U; i < 25U; i++) { + st[i] = LOAD64_LE((const unsigned char *) state + i * 8U); + } + + keccakf_12_rounds(st); + + for (i = 0U; i < 25U; i++) { + STORE64_LE((unsigned char *) state + i * 8U, st[i]); + } +} + +void +keccak1600_armsha3_init(void *state) +{ + memset(state, 0, KECCAK1600_STATEBYTES); +} + +void +keccak1600_armsha3_xor_bytes(void *state, const unsigned char *data, size_t offset, size_t length) +{ + unsigned char *st = (unsigned char *) state; + size_t i; + + for (i = 0U; i < length; i++) { + st[offset + i] ^= data[i]; + } +} + +void +keccak1600_armsha3_extract_bytes(const void *state, unsigned char *data, size_t offset, size_t length) +{ + const unsigned char *st = (const unsigned char *) state; + + memcpy(data, st + offset, length); +} + +#ifdef __clang__ +# pragma clang attribute pop +#endif + +#endif /* __ARM_FEATURE_SHA3 */ diff --git a/src/libsodium/crypto_core/keccak1600/armsha3/keccak1600_armsha3.h b/src/libsodium/crypto_core/keccak1600/armsha3/keccak1600_armsha3.h new file mode 100644 index 00000000..10d9584a --- /dev/null +++ b/src/libsodium/crypto_core/keccak1600/armsha3/keccak1600_armsha3.h @@ -0,0 +1,20 @@ +#ifndef keccak1600_armsha3_H +#define keccak1600_armsha3_H + +#include + +#include "private/quirks.h" + +void keccak1600_armsha3_init(void *state); + +void keccak1600_armsha3_xor_bytes(void *state, const unsigned char *bytes, + size_t offset, size_t length); + +void keccak1600_armsha3_extract_bytes(const void *state, unsigned char *bytes, + size_t offset, size_t length); + +void keccak1600_armsha3_permute_24(void *state); + +void keccak1600_armsha3_permute_12(void *state); + +#endif /* keccak1600_armsha3_H */ diff --git a/src/libsodium/crypto_core/keccak1600/keccak1600.c b/src/libsodium/crypto_core/keccak1600/keccak1600.c index d1eeadb4..70459d11 100644 --- a/src/libsodium/crypto_core/keccak1600/keccak1600.c +++ b/src/libsodium/crypto_core/keccak1600/keccak1600.c @@ -1,6 +1,21 @@ #include "crypto_core_keccak1600.h" #include "ref/keccak1600_ref.h" +#ifdef __ARM_FEATURE_SHA3 +# include "armsha3/keccak1600_armsha3.h" +# define keccak1600_init keccak1600_armsha3_init +# define keccak1600_xor_bytes keccak1600_armsha3_xor_bytes +# define keccak1600_extract_bytes keccak1600_armsha3_extract_bytes +# define keccak1600_permute_24 keccak1600_armsha3_permute_24 +# define keccak1600_permute_12 keccak1600_armsha3_permute_12 +#else +# define keccak1600_init keccak1600_ref_init +# define keccak1600_xor_bytes keccak1600_ref_xor_bytes +# define keccak1600_extract_bytes keccak1600_ref_extract_bytes +# define keccak1600_permute_24 keccak1600_ref_permute_24 +# define keccak1600_permute_12 keccak1600_ref_permute_12 +#endif + size_t crypto_core_keccak1600_statebytes(void) { @@ -10,7 +25,7 @@ crypto_core_keccak1600_statebytes(void) void crypto_core_keccak1600_init(crypto_core_keccak1600_state *state) { - keccak1600_ref_init(state->opaque); + keccak1600_init(state->opaque); } void @@ -18,7 +33,7 @@ crypto_core_keccak1600_xor_bytes(crypto_core_keccak1600_state *state, const unsigned char *bytes, size_t offset, size_t length) { - keccak1600_ref_xor_bytes(state->opaque, bytes, offset, length); + keccak1600_xor_bytes(state->opaque, bytes, offset, length); } void @@ -26,17 +41,17 @@ crypto_core_keccak1600_extract_bytes(const crypto_core_keccak1600_state *state, unsigned char *bytes, size_t offset, size_t length) { - keccak1600_ref_extract_bytes(state->opaque, bytes, offset, length); + keccak1600_extract_bytes(state->opaque, bytes, offset, length); } void crypto_core_keccak1600_permute_24(crypto_core_keccak1600_state *state) { - keccak1600_ref_permute_24(state->opaque); + keccak1600_permute_24(state->opaque); } void crypto_core_keccak1600_permute_12(crypto_core_keccak1600_state *state) { - keccak1600_ref_permute_12(state->opaque); + keccak1600_permute_12(state->opaque); } diff --git a/src/libsodium/crypto_hash/sha256/cp/hash_sha256_cp.c b/src/libsodium/crypto_hash/sha256/cp/hash_sha256_cp.c index 394c3914..5fa89242 100644 --- a/src/libsodium/crypto_hash/sha256/cp/hash_sha256_cp.c +++ b/src/libsodium/crypto_hash/sha256/cp/hash_sha256_cp.c @@ -37,6 +37,11 @@ #include "private/common.h" #include "utils.h" +#if defined(__aarch64__) && defined(__ARM_FEATURE_SHA2) +# define HAVE_SHA256_ARMCRYPTO 1 +# include +#endif + static void be32enc_vect(unsigned char *dst, const uint32_t *src, size_t len) { @@ -47,6 +52,158 @@ be32enc_vect(unsigned char *dst, const uint32_t *src, size_t len) } } +#ifdef HAVE_SHA256_ARMCRYPTO + +static const uint32_t Krnd[64] = { + 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, + 0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, + 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786, + 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, + 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, + 0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, + 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b, + 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070, + 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, + 0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, + 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2 +}; + +static void +SHA256_Transform(uint32_t state[8], const uint8_t block[64], uint32_t W[64], + uint32_t S[8]) +{ + uint32x4_t STATE0, STATE1; + uint32x4_t ABCD_SAVE, EFGH_SAVE; + uint32x4_t MSG0, MSG1, MSG2, MSG3; + uint32x4_t TMP0, TMP1, TMP2; + + (void) W; + (void) S; + + STATE0 = vld1q_u32(&state[0]); + STATE1 = vld1q_u32(&state[4]); + + ABCD_SAVE = STATE0; + EFGH_SAVE = STATE1; + + MSG0 = vreinterpretq_u32_u8(vrev32q_u8(vld1q_u8(&block[0]))); + MSG1 = vreinterpretq_u32_u8(vrev32q_u8(vld1q_u8(&block[16]))); + MSG2 = vreinterpretq_u32_u8(vrev32q_u8(vld1q_u8(&block[32]))); + MSG3 = vreinterpretq_u32_u8(vrev32q_u8(vld1q_u8(&block[48]))); + + TMP0 = vaddq_u32(MSG0, vld1q_u32(&Krnd[0])); + TMP2 = STATE0; + STATE0 = vsha256hq_u32(STATE0, STATE1, TMP0); + STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP0); + MSG0 = vsha256su0q_u32(MSG0, MSG1); + + TMP1 = vaddq_u32(MSG1, vld1q_u32(&Krnd[4])); + TMP2 = STATE0; + STATE0 = vsha256hq_u32(STATE0, STATE1, TMP1); + STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP1); + MSG0 = vsha256su1q_u32(MSG0, MSG2, MSG3); + MSG1 = vsha256su0q_u32(MSG1, MSG2); + + TMP0 = vaddq_u32(MSG2, vld1q_u32(&Krnd[8])); + TMP2 = STATE0; + STATE0 = vsha256hq_u32(STATE0, STATE1, TMP0); + STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP0); + MSG1 = vsha256su1q_u32(MSG1, MSG3, MSG0); + MSG2 = vsha256su0q_u32(MSG2, MSG3); + + TMP1 = vaddq_u32(MSG3, vld1q_u32(&Krnd[12])); + TMP2 = STATE0; + STATE0 = vsha256hq_u32(STATE0, STATE1, TMP1); + STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP1); + MSG2 = vsha256su1q_u32(MSG2, MSG0, MSG1); + MSG3 = vsha256su0q_u32(MSG3, MSG0); + + TMP0 = vaddq_u32(MSG0, vld1q_u32(&Krnd[16])); + TMP2 = STATE0; + STATE0 = vsha256hq_u32(STATE0, STATE1, TMP0); + STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP0); + MSG3 = vsha256su1q_u32(MSG3, MSG1, MSG2); + MSG0 = vsha256su0q_u32(MSG0, MSG1); + + TMP1 = vaddq_u32(MSG1, vld1q_u32(&Krnd[20])); + TMP2 = STATE0; + STATE0 = vsha256hq_u32(STATE0, STATE1, TMP1); + STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP1); + MSG0 = vsha256su1q_u32(MSG0, MSG2, MSG3); + MSG1 = vsha256su0q_u32(MSG1, MSG2); + + TMP0 = vaddq_u32(MSG2, vld1q_u32(&Krnd[24])); + TMP2 = STATE0; + STATE0 = vsha256hq_u32(STATE0, STATE1, TMP0); + STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP0); + MSG1 = vsha256su1q_u32(MSG1, MSG3, MSG0); + MSG2 = vsha256su0q_u32(MSG2, MSG3); + + TMP1 = vaddq_u32(MSG3, vld1q_u32(&Krnd[28])); + TMP2 = STATE0; + STATE0 = vsha256hq_u32(STATE0, STATE1, TMP1); + STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP1); + MSG2 = vsha256su1q_u32(MSG2, MSG0, MSG1); + MSG3 = vsha256su0q_u32(MSG3, MSG0); + + TMP0 = vaddq_u32(MSG0, vld1q_u32(&Krnd[32])); + TMP2 = STATE0; + STATE0 = vsha256hq_u32(STATE0, STATE1, TMP0); + STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP0); + MSG3 = vsha256su1q_u32(MSG3, MSG1, MSG2); + MSG0 = vsha256su0q_u32(MSG0, MSG1); + + TMP1 = vaddq_u32(MSG1, vld1q_u32(&Krnd[36])); + TMP2 = STATE0; + STATE0 = vsha256hq_u32(STATE0, STATE1, TMP1); + STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP1); + MSG0 = vsha256su1q_u32(MSG0, MSG2, MSG3); + MSG1 = vsha256su0q_u32(MSG1, MSG2); + + TMP0 = vaddq_u32(MSG2, vld1q_u32(&Krnd[40])); + TMP2 = STATE0; + STATE0 = vsha256hq_u32(STATE0, STATE1, TMP0); + STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP0); + MSG1 = vsha256su1q_u32(MSG1, MSG3, MSG0); + MSG2 = vsha256su0q_u32(MSG2, MSG3); + + TMP1 = vaddq_u32(MSG3, vld1q_u32(&Krnd[44])); + TMP2 = STATE0; + STATE0 = vsha256hq_u32(STATE0, STATE1, TMP1); + STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP1); + MSG2 = vsha256su1q_u32(MSG2, MSG0, MSG1); + MSG3 = vsha256su0q_u32(MSG3, MSG0); + + TMP0 = vaddq_u32(MSG0, vld1q_u32(&Krnd[48])); + TMP2 = STATE0; + STATE0 = vsha256hq_u32(STATE0, STATE1, TMP0); + STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP0); + MSG3 = vsha256su1q_u32(MSG3, MSG1, MSG2); + + TMP1 = vaddq_u32(MSG1, vld1q_u32(&Krnd[52])); + TMP2 = STATE0; + STATE0 = vsha256hq_u32(STATE0, STATE1, TMP1); + STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP1); + + TMP0 = vaddq_u32(MSG2, vld1q_u32(&Krnd[56])); + TMP2 = STATE0; + STATE0 = vsha256hq_u32(STATE0, STATE1, TMP0); + STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP0); + + TMP1 = vaddq_u32(MSG3, vld1q_u32(&Krnd[60])); + TMP2 = STATE0; + STATE0 = vsha256hq_u32(STATE0, STATE1, TMP1); + STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP1); + + STATE0 = vaddq_u32(STATE0, ABCD_SAVE); + STATE1 = vaddq_u32(STATE1, EFGH_SAVE); + + vst1q_u32(&state[0], STATE0); + vst1q_u32(&state[4], STATE1); +} + +#else + static void be32dec_vect(uint32_t *dst, const unsigned char *src, size_t len) { @@ -144,6 +301,8 @@ SHA256_Transform(uint32_t state[8], const uint8_t block[64], uint32_t W[64], } } +#endif + static const uint8_t PAD[64] = { 0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, diff --git a/src/libsodium/crypto_hash/sha3/hash_sha3.c b/src/libsodium/crypto_hash/sha3/hash_sha3.c new file mode 100644 index 00000000..888555e5 --- /dev/null +++ b/src/libsodium/crypto_hash/sha3/hash_sha3.c @@ -0,0 +1,175 @@ +#include +#include + +#include "crypto_core_keccak1600.h" +#include "crypto_hash_sha3.h" +#include "private/common.h" +#include "utils.h" + +#define SHA3_256_RATE 136 +#define SHA3_512_RATE 72 +#define SHA3_DOMAIN 0x06 + +typedef enum { SHA3_PHASE_ABSORBING = 0, SHA3_PHASE_FINALIZED = 1 } sha3_phase; + +typedef struct sha3_state_internal_ { + crypto_core_keccak1600_state state; + size_t offset; + size_t rate; + size_t outlen; + uint8_t phase; +} sha3_state_internal; + +static int +sha3_init(sha3_state_internal *state, size_t rate, size_t outlen) +{ + crypto_core_keccak1600_init(&state->state); + state->offset = 0; + state->rate = rate; + state->outlen = outlen; + state->phase = SHA3_PHASE_ABSORBING; + + return 0; +} + +static int +sha3_update(sha3_state_internal *state, const unsigned char *in, size_t inlen) +{ + size_t consumed = 0; + size_t chunk_size; + + while (consumed < inlen) { + if (state->offset == state->rate) { + crypto_core_keccak1600_permute_24(&state->state); + state->offset = 0; + } + chunk_size = state->rate - state->offset; + if (chunk_size > inlen - consumed) { + chunk_size = inlen - consumed; + } + crypto_core_keccak1600_xor_bytes(&state->state, &in[consumed], state->offset, chunk_size); + state->offset += chunk_size; + consumed += chunk_size; + } + + return 0; +} + +static int +sha3_final(sha3_state_internal *state, unsigned char *out) +{ + unsigned char pad; + + if (state->offset == state->rate) { + crypto_core_keccak1600_permute_24(&state->state); + state->offset = 0; + } + + if (state->offset == state->rate - 1) { + pad = (unsigned char) (SHA3_DOMAIN ^ 0x80); + crypto_core_keccak1600_xor_bytes(&state->state, &pad, state->offset, 1); + } else { + pad = SHA3_DOMAIN; + crypto_core_keccak1600_xor_bytes(&state->state, &pad, state->offset, 1); + pad = 0x80; + crypto_core_keccak1600_xor_bytes(&state->state, &pad, state->rate - 1, 1); + } + + crypto_core_keccak1600_permute_24(&state->state); + + crypto_core_keccak1600_extract_bytes(&state->state, out, 0, state->outlen); + + sodium_memzero(state, sizeof *state); + + return 0; +} + +size_t +crypto_hash_sha3256_bytes(void) +{ + return crypto_hash_sha3256_BYTES; +} + +size_t +crypto_hash_sha3256_statebytes(void) +{ + return sizeof(crypto_hash_sha3256_state); +} + +int +crypto_hash_sha3256_init(crypto_hash_sha3256_state *state) +{ + COMPILER_ASSERT(sizeof(crypto_hash_sha3256_state) >= sizeof(sha3_state_internal)); + return sha3_init((sha3_state_internal *) (void *) state, + SHA3_256_RATE, crypto_hash_sha3256_BYTES); +} + +int +crypto_hash_sha3256_update(crypto_hash_sha3256_state *state, + const unsigned char *in, unsigned long long inlen) +{ + return sha3_update((sha3_state_internal *) (void *) state, in, (size_t) inlen); +} + +int +crypto_hash_sha3256_final(crypto_hash_sha3256_state *state, unsigned char *out) +{ + return sha3_final((sha3_state_internal *) (void *) state, out); +} + +int +crypto_hash_sha3256(unsigned char *out, const unsigned char *in, unsigned long long inlen) +{ + crypto_hash_sha3256_state state; + + crypto_hash_sha3256_init(&state); + crypto_hash_sha3256_update(&state, in, inlen); + crypto_hash_sha3256_final(&state, out); + + return 0; +} + +size_t +crypto_hash_sha3512_bytes(void) +{ + return crypto_hash_sha3512_BYTES; +} + +size_t +crypto_hash_sha3512_statebytes(void) +{ + return sizeof(crypto_hash_sha3512_state); +} + +int +crypto_hash_sha3512_init(crypto_hash_sha3512_state *state) +{ + COMPILER_ASSERT(sizeof(crypto_hash_sha3512_state) >= sizeof(sha3_state_internal)); + return sha3_init((sha3_state_internal *) (void *) state, + SHA3_512_RATE, crypto_hash_sha3512_BYTES); +} + +int +crypto_hash_sha3512_update(crypto_hash_sha3512_state *state, + const unsigned char *in, unsigned long long inlen) +{ + return sha3_update((sha3_state_internal *) (void *) state, in, (size_t) inlen); +} + +int +crypto_hash_sha3512_final(crypto_hash_sha3512_state *state, unsigned char *out) +{ + return sha3_final((sha3_state_internal *) (void *) state, out); +} + +int +crypto_hash_sha3512(unsigned char *out, const unsigned char *in, unsigned long long inlen) +{ + crypto_hash_sha3512_state state; + + crypto_hash_sha3512_init(&state); + crypto_hash_sha3512_update(&state, in, inlen); + crypto_hash_sha3512_final(&state, out); + + return 0; +} diff --git a/src/libsodium/crypto_ipcrypt/crypto_ipcrypt.c b/src/libsodium/crypto_ipcrypt/crypto_ipcrypt.c index af403586..219bb69b 100644 --- a/src/libsodium/crypto_ipcrypt/crypto_ipcrypt.c +++ b/src/libsodium/crypto_ipcrypt/crypto_ipcrypt.c @@ -98,6 +98,12 @@ crypto_ipcrypt_keygen(unsigned char k[crypto_ipcrypt_KEYBYTES]) randombytes_buf(k, crypto_ipcrypt_KEYBYTES); } +void +crypto_ipcrypt_nd_keygen(unsigned char k[crypto_ipcrypt_ND_KEYBYTES]) +{ + randombytes_buf(k, crypto_ipcrypt_ND_KEYBYTES); +} + void crypto_ipcrypt_ndx_keygen(unsigned char k[crypto_ipcrypt_NDX_KEYBYTES]) { diff --git a/src/libsodium/crypto_ipcrypt/ipcrypt_aesni.c b/src/libsodium/crypto_ipcrypt/ipcrypt_aesni.c index e86081b3..c072d19b 100644 --- a/src/libsodium/crypto_ipcrypt/ipcrypt_aesni.c +++ b/src/libsodium/crypto_ipcrypt/ipcrypt_aesni.c @@ -308,7 +308,7 @@ pfx_set_bit(uint8_t ip16[16], const unsigned int bit_index, const uint8_t bit_va uint8_t mask = (uint8_t) -((bit_value & 1)); # if defined(__GNUC__) || defined(__clang__) - __asm__ __volatile__("" : "+r"(mask)::); + __asm__ __volatile__("" : "+r"(mask) :); # endif ip16[byte_index] = (ip16[byte_index] & ~bit_mask) | (bit_mask & mask); } diff --git a/src/libsodium/crypto_ipcrypt/ipcrypt_armcrypto.c b/src/libsodium/crypto_ipcrypt/ipcrypt_armcrypto.c index c5a27e92..53c65ce9 100644 --- a/src/libsodium/crypto_ipcrypt/ipcrypt_armcrypto.c +++ b/src/libsodium/crypto_ipcrypt/ipcrypt_armcrypto.c @@ -37,7 +37,7 @@ typedef uint64x2_t BlockVec; # define XOR128_3(a, b, c) veorq_u64(veorq_u64((a), (b)), (c)) # define SET64x2(a, b) vsetq_lane_u64((uint64_t) (a), vmovq_n_u64((uint64_t) (b)), 1) # define BYTESHL128(a, b) \ - vreinterpretq_u64_u8(vextq_s8(vdupq_n_s8(0), vreinterpretq_s8_u64(a), 16 - (b))) + vreinterpretq_u64_u8(vextq_u8(vdupq_n_u8(0), vreinterpretq_u8_u64(a), 16 - (b))) # define AES_XENCRYPT(block_vec, rkey) \ vreinterpretq_u64_u8( \ @@ -340,7 +340,7 @@ pfx_set_bit(uint8_t ip16[16], const unsigned int bit_index, const uint8_t bit_va uint8_t mask = (uint8_t) -((bit_value & 1)); # if defined(__GNUC__) || defined(__clang__) - __asm__ __volatile__("" : "+r"(mask)::); + __asm__ __volatile__("" : "+r"(mask) :); # endif ip16[byte_index] = (ip16[byte_index] & ~bit_mask) | (bit_mask & mask); } @@ -348,12 +348,12 @@ pfx_set_bit(uint8_t ip16[16], const unsigned int bit_index, const uint8_t bit_va static void pfx_shift_left(uint8_t ip16[16]) { - BlockVec v = LOAD128(ip16); - const BlockVec shl = vshlq_n_u8(vreinterpretq_u8_u64(v), 1); - const BlockVec msb = vshrq_n_u8(vreinterpretq_u8_u64(v), 7); - const BlockVec zero = vdupq_n_u8(0); - const BlockVec carries = vextq_u8(vreinterpretq_u8_u64(msb), zero, 1); - v = vreinterpretq_u64_u8(vorrq_u8(shl, carries)); + BlockVec v = LOAD128(ip16); + const uint8x16_t shl = vshlq_n_u8(vreinterpretq_u8_u64(v), 1); + const uint8x16_t msb = vshrq_n_u8(vreinterpretq_u8_u64(v), 7); + const uint8x16_t zero = vdupq_n_u8(0); + const uint8x16_t carries = vextq_u8(msb, zero, 1); + v = vreinterpretq_u64_u8(vorrq_u8(shl, carries)); STORE128(ip16, v); } diff --git a/src/libsodium/crypto_ipcrypt/ipcrypt_soft.c b/src/libsodium/crypto_ipcrypt/ipcrypt_soft.c index 8f1fd8a8..3aa67370 100644 --- a/src/libsodium/crypto_ipcrypt/ipcrypt_soft.c +++ b/src/libsodium/crypto_ipcrypt/ipcrypt_soft.c @@ -284,7 +284,7 @@ pfx_set_bit(uint8_t ip16[16], const unsigned int bit_index, const uint8_t bit_va uint8_t mask = (uint8_t) -((bit_value & 1)); #if defined(__GNUC__) || defined(__clang__) - __asm__ __volatile__("" : "+r"(mask)::); + __asm__ __volatile__("" : "+r"(mask) :); #endif ip16[byte_index] = (ip16[byte_index] & ~bit_mask) | (bit_mask & mask); } diff --git a/src/libsodium/crypto_kem/crypto_kem.c b/src/libsodium/crypto_kem/crypto_kem.c new file mode 100644 index 00000000..68a430b9 --- /dev/null +++ b/src/libsodium/crypto_kem/crypto_kem.c @@ -0,0 +1,62 @@ +#include "crypto_kem.h" + +size_t +crypto_kem_publickeybytes(void) +{ + return crypto_kem_PUBLICKEYBYTES; +} + +size_t +crypto_kem_secretkeybytes(void) +{ + return crypto_kem_SECRETKEYBYTES; +} + +size_t +crypto_kem_ciphertextbytes(void) +{ + return crypto_kem_CIPHERTEXTBYTES; +} + +size_t +crypto_kem_sharedsecretbytes(void) +{ + return crypto_kem_SHAREDSECRETBYTES; +} + +size_t +crypto_kem_seedbytes(void) +{ + return crypto_kem_SEEDBYTES; +} + +const char * +crypto_kem_primitive(void) +{ + return crypto_kem_PRIMITIVE; +} + +int +crypto_kem_seed_keypair(unsigned char *pk, unsigned char *sk, + const unsigned char *seed) +{ + return crypto_kem_xwing_seed_keypair(pk, sk, seed); +} + +int +crypto_kem_keypair(unsigned char *pk, unsigned char *sk) +{ + return crypto_kem_xwing_keypair(pk, sk); +} + +int +crypto_kem_enc(unsigned char *ct, unsigned char *ss, const unsigned char *pk) +{ + return crypto_kem_xwing_enc(ct, ss, pk); +} + +int +crypto_kem_dec(unsigned char *ss, const unsigned char *ct, const unsigned char *sk) +{ + return crypto_kem_xwing_dec(ss, ct, sk); +} diff --git a/src/libsodium/crypto_kem/mlkem768/ref/kem_mlkem768_ref.c b/src/libsodium/crypto_kem/mlkem768/ref/kem_mlkem768_ref.c index b3327157..4c2c4e93 100644 --- a/src/libsodium/crypto_kem/mlkem768/ref/kem_mlkem768_ref.c +++ b/src/libsodium/crypto_kem/mlkem768/ref/kem_mlkem768_ref.c @@ -1,9 +1,8 @@ #include #include -#include "crypto_core_keccak1600.h" +#include "crypto_hash_sha3.h" #include "crypto_kem_mlkem768.h" -#include "crypto_verify_32.h" #include "crypto_xof_shake128.h" #include "crypto_xof_shake256.h" #include "kem_mlkem768_ref.h" @@ -25,9 +24,6 @@ #define MLKEM768_POLYCOMPRESSEDBYTES_DV 128 #define MLKEM768_POLYVECCOMPRESSEDBYTES_DU (MLKEM768_K * MLKEM768_POLYCOMPRESSEDBYTES_DU) -#define SHA3_512_RATE 72 -#define SHA3_DOMAIN 0x06 - typedef struct poly { int16_t coeffs[MLKEM768_N]; } poly; @@ -201,58 +197,6 @@ poly_csubq(poly *r) } } -static void -sha3_256(unsigned char out[32], const unsigned char *in, size_t inlen) -{ - crypto_xof_shake256_state state; - - crypto_xof_shake256_init_with_domain(&state, SHA3_DOMAIN); - crypto_xof_shake256_update(&state, in, inlen); - crypto_xof_shake256_squeeze(&state, out, 32); -} - -static void -sha3_512(unsigned char out[64], const unsigned char *in, size_t inlen) -{ - crypto_core_keccak1600_state state; - size_t offset = 0; - size_t consumed = 0; - size_t chunk_size; - unsigned char pad; - - crypto_core_keccak1600_init(&state); - - while (consumed < inlen) { - if (offset == SHA3_512_RATE) { - crypto_core_keccak1600_permute_24(&state); - offset = 0; - } - chunk_size = SHA3_512_RATE - offset; - if (chunk_size > inlen - consumed) { - chunk_size = inlen - consumed; - } - crypto_core_keccak1600_xor_bytes(&state, &in[consumed], offset, chunk_size); - offset += chunk_size; - consumed += chunk_size; - } - if (offset == SHA3_512_RATE) { - crypto_core_keccak1600_permute_24(&state); - offset = 0; - } - if (offset == SHA3_512_RATE - 1) { - pad = SHA3_DOMAIN | 0x80; - crypto_core_keccak1600_xor_bytes(&state, &pad, offset, 1); - } else { - pad = SHA3_DOMAIN; - crypto_core_keccak1600_xor_bytes(&state, &pad, offset, 1); - pad = 0x80; - crypto_core_keccak1600_xor_bytes(&state, &pad, SHA3_512_RATE - 1, 1); - } - - crypto_core_keccak1600_permute_24(&state); - crypto_core_keccak1600_extract_bytes(&state, out, 0, 64); -} - static void poly_cbd_eta2(poly *r, const unsigned char buf[128]) { @@ -620,7 +564,7 @@ indcpa_keypair(unsigned char pk[crypto_kem_mlkem768_PUBLICKEYBYTES], unsigned int i; uint8_t nonce = 0; - sha3_512(buf, seed, 33); + crypto_hash_sha3512(buf, seed, 33); gen_matrix(a, publicseed, 0); @@ -755,8 +699,8 @@ mlkem768_ref_seed_keypair(unsigned char *pk, unsigned char *sk, const unsigned c indcpa_keypair(pk, sk, indseed); memcpy(sk + MLKEM768_POLYVECBYTES, pk, crypto_kem_mlkem768_PUBLICKEYBYTES); - sha3_256(sk + MLKEM768_POLYVECBYTES + crypto_kem_mlkem768_PUBLICKEYBYTES, pk, - crypto_kem_mlkem768_PUBLICKEYBYTES); + crypto_hash_sha3256(sk + MLKEM768_POLYVECBYTES + crypto_kem_mlkem768_PUBLICKEYBYTES, pk, + crypto_kem_mlkem768_PUBLICKEYBYTES); memcpy(sk + MLKEM768_POLYVECBYTES + crypto_kem_mlkem768_PUBLICKEYBYTES + 32, seed + 32, 32); return 0; @@ -785,9 +729,9 @@ mlkem768_ref_enc_deterministic(unsigned char *ct, unsigned char *ss, const unsig } memcpy(buf, seed, 32); - sha3_256(buf + 32, pk, crypto_kem_mlkem768_PUBLICKEYBYTES); + crypto_hash_sha3256(buf + 32, pk, crypto_kem_mlkem768_PUBLICKEYBYTES); - sha3_512(kr, buf, 64); + crypto_hash_sha3512(kr, buf, 64); indcpa_enc(ct, buf, pk, kr + 32); @@ -816,57 +760,27 @@ mlkem768_ref_dec(unsigned char *ss, const unsigned char *ct, const unsigned char const unsigned char *hpk = sk + MLKEM768_POLYVECBYTES + crypto_kem_mlkem768_PUBLICKEYBYTES; const unsigned char *z = sk + MLKEM768_POLYVECBYTES + crypto_kem_mlkem768_PUBLICKEYBYTES + 32; int fail; + unsigned int fail_mask; crypto_xof_shake256_state state; indcpa_dec(buf, ct, sk); memcpy(buf + 32, hpk, 32); - sha3_512(kr, buf, 64); + crypto_hash_sha3512(kr, buf, 64); indcpa_enc(cmp, buf, pk, kr + 32); - fail = crypto_verify_32(ct, cmp); - fail |= crypto_verify_32(ct + 32, cmp + 32); - fail |= crypto_verify_32(ct + 64, cmp + 64); - fail |= crypto_verify_32(ct + 96, cmp + 96); - fail |= crypto_verify_32(ct + 128, cmp + 128); - fail |= crypto_verify_32(ct + 160, cmp + 160); - fail |= crypto_verify_32(ct + 192, cmp + 192); - fail |= crypto_verify_32(ct + 224, cmp + 224); - fail |= crypto_verify_32(ct + 256, cmp + 256); - fail |= crypto_verify_32(ct + 288, cmp + 288); - fail |= crypto_verify_32(ct + 320, cmp + 320); - fail |= crypto_verify_32(ct + 352, cmp + 352); - fail |= crypto_verify_32(ct + 384, cmp + 384); - fail |= crypto_verify_32(ct + 416, cmp + 416); - fail |= crypto_verify_32(ct + 448, cmp + 448); - fail |= crypto_verify_32(ct + 480, cmp + 480); - fail |= crypto_verify_32(ct + 512, cmp + 512); - fail |= crypto_verify_32(ct + 544, cmp + 544); - fail |= crypto_verify_32(ct + 576, cmp + 576); - fail |= crypto_verify_32(ct + 608, cmp + 608); - fail |= crypto_verify_32(ct + 640, cmp + 640); - fail |= crypto_verify_32(ct + 672, cmp + 672); - fail |= crypto_verify_32(ct + 704, cmp + 704); - fail |= crypto_verify_32(ct + 736, cmp + 736); - fail |= crypto_verify_32(ct + 768, cmp + 768); - fail |= crypto_verify_32(ct + 800, cmp + 800); - fail |= crypto_verify_32(ct + 832, cmp + 832); - fail |= crypto_verify_32(ct + 864, cmp + 864); - fail |= crypto_verify_32(ct + 896, cmp + 896); - fail |= crypto_verify_32(ct + 928, cmp + 928); - fail |= crypto_verify_32(ct + 960, cmp + 960); - fail |= crypto_verify_32(ct + 992, cmp + 992); - fail |= crypto_verify_32(ct + 1024, cmp + 1024); - fail |= crypto_verify_32(ct + 1056, cmp + 1056); + fail = sodium_memcmp(ct, cmp, crypto_kem_mlkem768_CIPHERTEXTBYTES); + fail_mask = (unsigned int) fail; + fail_mask >>= (sizeof(fail_mask) * 8U - 1U); crypto_xof_shake256_init(&state); crypto_xof_shake256_update(&state, z, 32); crypto_xof_shake256_update(&state, ct, crypto_kem_mlkem768_CIPHERTEXTBYTES); crypto_xof_shake256_squeeze(&state, k_bar, crypto_kem_mlkem768_SHAREDSECRETBYTES); - cmov(kr, k_bar, crypto_kem_mlkem768_SHAREDSECRETBYTES, (unsigned char) (fail != 0)); + cmov(kr, k_bar, crypto_kem_mlkem768_SHAREDSECRETBYTES, (unsigned char) fail_mask); memcpy(ss, kr, crypto_kem_mlkem768_SHAREDSECRETBYTES); diff --git a/src/libsodium/crypto_kem/xwing/kem_xwing.c b/src/libsodium/crypto_kem/xwing/kem_xwing.c new file mode 100644 index 00000000..1c965109 --- /dev/null +++ b/src/libsodium/crypto_kem/xwing/kem_xwing.c @@ -0,0 +1,208 @@ +#include +#include + +#include "crypto_hash_sha3.h" +#include "crypto_kem_mlkem768.h" +#include "crypto_kem_xwing.h" +#include "crypto_scalarmult_curve25519.h" +#include "crypto_xof_shake256.h" +#include "private/common.h" +#include "randombytes.h" +#include "utils.h" + +static const unsigned char xwing_label[6] = { 0x5c, 0x2e, 0x2f, 0x2f, 0x5e, 0x5c }; + +static void +expand_decaps_key(unsigned char pk_mlkem[crypto_kem_mlkem768_PUBLICKEYBYTES], + unsigned char sk_mlkem[crypto_kem_mlkem768_SECRETKEYBYTES], + unsigned char pk_x25519[crypto_scalarmult_curve25519_BYTES], + unsigned char sk_x25519[crypto_scalarmult_curve25519_SCALARBYTES], + const unsigned char seed[crypto_kem_xwing_SEEDBYTES]) +{ + unsigned char expanded[96]; + unsigned char mlkem_seed[crypto_kem_mlkem768_SEEDBYTES]; + + crypto_xof_shake256(expanded, 96, seed, crypto_kem_xwing_SEEDBYTES); + + memcpy(mlkem_seed, expanded, 64); + memcpy(sk_x25519, expanded + 64, 32); + + crypto_kem_mlkem768_seed_keypair(pk_mlkem, sk_mlkem, mlkem_seed); + crypto_scalarmult_curve25519_base(pk_x25519, sk_x25519); + + sodium_memzero(expanded, sizeof expanded); + sodium_memzero(mlkem_seed, sizeof mlkem_seed); +} + +static void +combiner(unsigned char ss[crypto_kem_xwing_SHAREDSECRETBYTES], + const unsigned char ss_mlkem[crypto_kem_mlkem768_SHAREDSECRETBYTES], + const unsigned char ss_x25519[crypto_scalarmult_curve25519_BYTES], + const unsigned char ct_x25519[crypto_scalarmult_curve25519_BYTES], + const unsigned char pk_x25519[crypto_scalarmult_curve25519_BYTES]) +{ + crypto_hash_sha3256_state state; + + crypto_hash_sha3256_init(&state); + crypto_hash_sha3256_update(&state, ss_mlkem, crypto_kem_mlkem768_SHAREDSECRETBYTES); + crypto_hash_sha3256_update(&state, ss_x25519, crypto_scalarmult_curve25519_BYTES); + crypto_hash_sha3256_update(&state, ct_x25519, crypto_scalarmult_curve25519_BYTES); + crypto_hash_sha3256_update(&state, pk_x25519, crypto_scalarmult_curve25519_BYTES); + crypto_hash_sha3256_update(&state, xwing_label, sizeof xwing_label); + crypto_hash_sha3256_final(&state, ss); +} + +size_t +crypto_kem_xwing_publickeybytes(void) +{ + return crypto_kem_xwing_PUBLICKEYBYTES; +} + +size_t +crypto_kem_xwing_secretkeybytes(void) +{ + return crypto_kem_xwing_SECRETKEYBYTES; +} + +size_t +crypto_kem_xwing_ciphertextbytes(void) +{ + return crypto_kem_xwing_CIPHERTEXTBYTES; +} + +size_t +crypto_kem_xwing_sharedsecretbytes(void) +{ + return crypto_kem_xwing_SHAREDSECRETBYTES; +} + +size_t +crypto_kem_xwing_seedbytes(void) +{ + return crypto_kem_xwing_SEEDBYTES; +} + +int +crypto_kem_xwing_seed_keypair(unsigned char *pk, unsigned char *sk, const unsigned char *seed) +{ + unsigned char pk_mlkem[crypto_kem_mlkem768_PUBLICKEYBYTES]; + unsigned char sk_mlkem[crypto_kem_mlkem768_SECRETKEYBYTES]; + unsigned char pk_x25519[crypto_scalarmult_curve25519_BYTES]; + unsigned char sk_x25519[crypto_scalarmult_curve25519_SCALARBYTES]; + + expand_decaps_key(pk_mlkem, sk_mlkem, pk_x25519, sk_x25519, seed); + + memcpy(pk, pk_mlkem, crypto_kem_mlkem768_PUBLICKEYBYTES); + memcpy(pk + crypto_kem_mlkem768_PUBLICKEYBYTES, pk_x25519, crypto_scalarmult_curve25519_BYTES); + + memcpy(sk, seed, crypto_kem_xwing_SEEDBYTES); + + sodium_memzero(sk_mlkem, sizeof sk_mlkem); + sodium_memzero(sk_x25519, sizeof sk_x25519); + + return 0; +} + +int +crypto_kem_xwing_keypair(unsigned char *pk, unsigned char *sk) +{ + unsigned char seed[crypto_kem_xwing_SEEDBYTES]; + + randombytes_buf(seed, crypto_kem_xwing_SEEDBYTES); + crypto_kem_xwing_seed_keypair(pk, sk, seed); + + sodium_memzero(seed, sizeof seed); + + return 0; +} + +int +crypto_kem_xwing_enc_deterministic(unsigned char *ct, unsigned char *ss, const unsigned char *pk, + const unsigned char *seed) +{ + const unsigned char *pk_mlkem = pk; + const unsigned char *pk_x25519 = pk + crypto_kem_mlkem768_PUBLICKEYBYTES; + + const unsigned char *seed_mlkem = seed; + const unsigned char *sk_e_x25519 = seed + 32; + + unsigned char ct_mlkem[crypto_kem_mlkem768_CIPHERTEXTBYTES]; + unsigned char ss_mlkem[crypto_kem_mlkem768_SHAREDSECRETBYTES]; + unsigned char ct_x25519[crypto_scalarmult_curve25519_BYTES]; + unsigned char ss_x25519[crypto_scalarmult_curve25519_BYTES]; + + if (crypto_kem_mlkem768_enc_deterministic(ct_mlkem, ss_mlkem, pk_mlkem, seed_mlkem) != 0) { + return -1; + } + + crypto_scalarmult_curve25519_base(ct_x25519, sk_e_x25519); + + if (crypto_scalarmult_curve25519(ss_x25519, sk_e_x25519, pk_x25519) != 0) { + sodium_memzero(ss_mlkem, sizeof ss_mlkem); + return -1; + } + + memcpy(ct, ct_mlkem, crypto_kem_mlkem768_CIPHERTEXTBYTES); + memcpy(ct + crypto_kem_mlkem768_CIPHERTEXTBYTES, ct_x25519, crypto_scalarmult_curve25519_BYTES); + + combiner(ss, ss_mlkem, ss_x25519, ct_x25519, pk_x25519); + + sodium_memzero(ss_mlkem, sizeof ss_mlkem); + sodium_memzero(ss_x25519, sizeof ss_x25519); + + return 0; +} + +int +crypto_kem_xwing_enc(unsigned char *ct, unsigned char *ss, const unsigned char *pk) +{ + unsigned char seed[64]; + + randombytes_buf(seed, 64); + if (crypto_kem_xwing_enc_deterministic(ct, ss, pk, seed) != 0) { + sodium_memzero(seed, sizeof seed); + return -1; + } + sodium_memzero(seed, sizeof seed); + + return 0; +} + +int +crypto_kem_xwing_dec(unsigned char *ss, const unsigned char *ct, const unsigned char *sk) +{ + unsigned char pk_mlkem[crypto_kem_mlkem768_PUBLICKEYBYTES]; + unsigned char sk_mlkem[crypto_kem_mlkem768_SECRETKEYBYTES]; + unsigned char pk_x25519[crypto_scalarmult_curve25519_BYTES]; + unsigned char sk_x25519[crypto_scalarmult_curve25519_SCALARBYTES]; + + const unsigned char *ct_mlkem = ct; + const unsigned char *ct_x25519 = ct + crypto_kem_mlkem768_CIPHERTEXTBYTES; + + unsigned char ss_mlkem[crypto_kem_mlkem768_SHAREDSECRETBYTES]; + unsigned char ss_x25519[crypto_scalarmult_curve25519_BYTES]; + + expand_decaps_key(pk_mlkem, sk_mlkem, pk_x25519, sk_x25519, sk); + + if (crypto_kem_mlkem768_dec(ss_mlkem, ct_mlkem, sk_mlkem) != 0) { + sodium_memzero(sk_mlkem, sizeof sk_mlkem); + sodium_memzero(sk_x25519, sizeof sk_x25519); + return -1; + } + + if (crypto_scalarmult_curve25519(ss_x25519, sk_x25519, ct_x25519) != 0) { + sodium_memzero(ss_mlkem, sizeof ss_mlkem); + sodium_memzero(sk_mlkem, sizeof sk_mlkem); + sodium_memzero(sk_x25519, sizeof sk_x25519); + return -1; + } + + combiner(ss, ss_mlkem, ss_x25519, ct_x25519, pk_x25519); + + sodium_memzero(ss_mlkem, sizeof ss_mlkem); + sodium_memzero(ss_x25519, sizeof ss_x25519); + sodium_memzero(sk_mlkem, sizeof sk_mlkem); + sodium_memzero(sk_x25519, sizeof sk_x25519); + + return 0; +} diff --git a/src/libsodium/crypto_pwhash/argon2/argon2-core.c b/src/libsodium/crypto_pwhash/argon2/argon2-core.c index 984dbc52..e6dc4eac 100644 --- a/src/libsodium/crypto_pwhash/argon2/argon2-core.c +++ b/src/libsodium/crypto_pwhash/argon2/argon2-core.c @@ -45,7 +45,12 @@ # define MAP_POPULATE 0 #endif +#if (defined(__aarch64__) || defined(_M_ARM64)) && \ + (defined(__ARM_NEON) || defined(__ARM_NEON__)) +static fill_segment_fn fill_segment = argon2_fill_segment_neon; +#else static fill_segment_fn fill_segment = argon2_fill_segment_ref; +#endif static void load_block(block *dst, const void *input) @@ -496,6 +501,10 @@ static int argon2_pick_best_implementation(void) { /* LCOV_EXCL_START */ +#if defined(__wasm_simd128__) + fill_segment = argon2_fill_segment_wasm32; + return 0; +#endif #if defined(HAVE_AVX512FINTRIN_H) && defined(HAVE_AVX2INTRIN_H) && \ defined(HAVE_TMMINTRIN_H) && defined(HAVE_SMMINTRIN_H) if (sodium_runtime_has_avx512f()) { @@ -516,7 +525,12 @@ argon2_pick_best_implementation(void) return 0; } #endif +#if (defined(__aarch64__) || defined(_M_ARM64)) && \ + (defined(__ARM_NEON) || defined(__ARM_NEON__)) + fill_segment = argon2_fill_segment_neon; +#else fill_segment = argon2_fill_segment_ref; +#endif return 0; /* LCOV_EXCL_STOP */ diff --git a/src/libsodium/crypto_pwhash/argon2/argon2-core.h b/src/libsodium/crypto_pwhash/argon2/argon2-core.h index a4b3eafb..ecc2029d 100644 --- a/src/libsodium/crypto_pwhash/argon2/argon2-core.h +++ b/src/libsodium/crypto_pwhash/argon2/argon2-core.h @@ -258,6 +258,10 @@ void argon2_fill_segment_avx2(const argon2_instance_t *instance, argon2_position_t position); void argon2_fill_segment_ssse3(const argon2_instance_t *instance, argon2_position_t position); +void argon2_fill_segment_wasm32(const argon2_instance_t *instance, + argon2_position_t position); +void argon2_fill_segment_neon(const argon2_instance_t *instance, + argon2_position_t position); void argon2_fill_segment_ref(const argon2_instance_t *instance, argon2_position_t position); diff --git a/src/libsodium/crypto_pwhash/argon2/argon2-fill-block-neon.c b/src/libsodium/crypto_pwhash/argon2/argon2-fill-block-neon.c new file mode 100644 index 00000000..3e3fec7a --- /dev/null +++ b/src/libsodium/crypto_pwhash/argon2/argon2-fill-block-neon.c @@ -0,0 +1,216 @@ +/* + * Argon2 source code package + * + * Written by Daniel Dinu and Dmitry Khovratovich, 2015 + * + * This work is licensed under a Creative Commons CC0 1.0 License/Waiver. + * + * You should have received a copy of the CC0 Public Domain Dedication along + * with + * this software. If not, see + * . + * + * AARCH64 NEON implementation ported from SSSE3 version. + */ + +#include +#include +#include + +#include "argon2-core.h" +#include "argon2.h" +#include "private/common.h" + +#if (defined(__aarch64__) || defined(_M_ARM64)) && \ + (defined(__ARM_NEON) || defined(__ARM_NEON__)) + +# include +# include "blamka-round-neon.h" + +static void +fill_block(uint64x2_t *state, const uint8_t *ref_block, uint8_t *next_block) +{ + uint64x2_t block_XY[ARGON2_OWORDS_IN_BLOCK]; + uint32_t i; + + for (i = 0; i < ARGON2_OWORDS_IN_BLOCK; i++) { + block_XY[i] = state[i] = veorq_u64( + state[i], vld1q_u64((const uint64_t *) (&ref_block[16 * i]))); + } + + for (i = 0; i < 8; ++i) { + BLAKE2_ROUND_NEON(state[8 * i + 0], state[8 * i + 1], state[8 * i + 2], + state[8 * i + 3], state[8 * i + 4], state[8 * i + 5], + state[8 * i + 6], state[8 * i + 7]); + } + + for (i = 0; i < 8; ++i) { + BLAKE2_ROUND_NEON(state[8 * 0 + i], state[8 * 1 + i], state[8 * 2 + i], + state[8 * 3 + i], state[8 * 4 + i], state[8 * 5 + i], + state[8 * 6 + i], state[8 * 7 + i]); + } + + for (i = 0; i < ARGON2_OWORDS_IN_BLOCK; i++) { + state[i] = veorq_u64(state[i], block_XY[i]); + vst1q_u64((uint64_t *) (&next_block[16 * i]), state[i]); + } +} + +static void +fill_block_with_xor(uint64x2_t *state, const uint8_t *ref_block, + uint8_t *next_block) +{ + uint64x2_t block_XY[ARGON2_OWORDS_IN_BLOCK]; + uint32_t i; + + for (i = 0; i < ARGON2_OWORDS_IN_BLOCK; i++) { + state[i] = veorq_u64( + state[i], vld1q_u64((const uint64_t *) (&ref_block[16 * i]))); + block_XY[i] = veorq_u64( + state[i], vld1q_u64((const uint64_t *) (&next_block[16 * i]))); + } + + for (i = 0; i < 8; ++i) { + BLAKE2_ROUND_NEON(state[8 * i + 0], state[8 * i + 1], state[8 * i + 2], + state[8 * i + 3], state[8 * i + 4], state[8 * i + 5], + state[8 * i + 6], state[8 * i + 7]); + } + + for (i = 0; i < 8; ++i) { + BLAKE2_ROUND_NEON(state[8 * 0 + i], state[8 * 1 + i], state[8 * 2 + i], + state[8 * 3 + i], state[8 * 4 + i], state[8 * 5 + i], + state[8 * 6 + i], state[8 * 7 + i]); + } + + for (i = 0; i < ARGON2_OWORDS_IN_BLOCK; i++) { + state[i] = veorq_u64(state[i], block_XY[i]); + vst1q_u64((uint64_t *) (&next_block[16 * i]), state[i]); + } +} + +static void +generate_addresses(const argon2_instance_t *instance, + const argon2_position_t *position, uint64_t *pseudo_rands) +{ + block address_block, input_block, tmp_block; + uint32_t i; + + init_block_value(&address_block, 0); + init_block_value(&input_block, 0); + + if (instance != NULL && position != NULL) { + input_block.v[0] = position->pass; + input_block.v[1] = position->lane; + input_block.v[2] = position->slice; + input_block.v[3] = instance->memory_blocks; + input_block.v[4] = instance->passes; + input_block.v[5] = instance->type; + + for (i = 0; i < instance->segment_length; ++i) { + if (i % ARGON2_ADDRESSES_IN_BLOCK == 0) { + uint64x2_t zero_block[ARGON2_OWORDS_IN_BLOCK]; + uint64x2_t zero2_block[ARGON2_OWORDS_IN_BLOCK]; + + memset(zero_block, 0, sizeof(zero_block)); + memset(zero2_block, 0, sizeof(zero2_block)); + init_block_value(&address_block, 0); + init_block_value(&tmp_block, 0); + + input_block.v[6]++; + + fill_block_with_xor(zero_block, (uint8_t *) &input_block.v, + (uint8_t *) &tmp_block.v); + fill_block_with_xor(zero2_block, (uint8_t *) &tmp_block.v, + (uint8_t *) &address_block.v); + } + + pseudo_rands[i] = address_block.v[i % ARGON2_ADDRESSES_IN_BLOCK]; + } + } +} + +void +argon2_fill_segment_neon(const argon2_instance_t *instance, + argon2_position_t position) +{ + block *ref_block = NULL, *curr_block = NULL; + uint64_t pseudo_rand, ref_index, ref_lane; + uint32_t prev_offset, curr_offset; + uint32_t starting_index, i; + uint64x2_t state[ARGON2_OWORDS_IN_BLOCK]; + int data_independent_addressing = 1; + + uint64_t *pseudo_rands = NULL; + + if (instance == NULL) { + return; + } + + if (instance->type == Argon2_id && + (position.pass != 0 || position.slice >= ARGON2_SYNC_POINTS / 2)) { + data_independent_addressing = 0; + } + + pseudo_rands = instance->pseudo_rands; + + if (data_independent_addressing) { + generate_addresses(instance, &position, pseudo_rands); + } + + starting_index = 0; + + if ((0 == position.pass) && (0 == position.slice)) { + starting_index = 2; + } + + curr_offset = position.lane * instance->lane_length + + position.slice * instance->segment_length + starting_index; + + if (0 == curr_offset % instance->lane_length) { + prev_offset = curr_offset + instance->lane_length - 1; + } else { + prev_offset = curr_offset - 1; + } + + memcpy(state, ((instance->region->memory + prev_offset)->v), + ARGON2_BLOCK_SIZE); + + for (i = starting_index; i < instance->segment_length; + ++i, ++curr_offset, ++prev_offset) { + if (curr_offset % instance->lane_length == 1) { + prev_offset = curr_offset - 1; + } + + if (data_independent_addressing) { +#pragma warning(push) +#pragma warning(disable : 6385) + pseudo_rand = pseudo_rands[i]; +#pragma warning(pop) + } else { + pseudo_rand = instance->region->memory[prev_offset].v[0]; + } + + ref_lane = ((pseudo_rand >> 32)) % instance->lanes; + + if ((position.pass == 0) && (position.slice == 0)) { + ref_lane = position.lane; + } + + position.index = i; + ref_index = index_alpha(instance, &position, pseudo_rand & 0xFFFFFFFF, + ref_lane == position.lane); + + ref_block = instance->region->memory + + instance->lane_length * ref_lane + ref_index; + curr_block = instance->region->memory + curr_offset; + if (position.pass != 0) { + fill_block_with_xor(state, (uint8_t *) ref_block->v, + (uint8_t *) curr_block->v); + } else { + fill_block(state, (uint8_t *) ref_block->v, + (uint8_t *) curr_block->v); + } + } +} + +#endif diff --git a/src/libsodium/crypto_pwhash/argon2/argon2-fill-block-wasm32.c b/src/libsodium/crypto_pwhash/argon2/argon2-fill-block-wasm32.c new file mode 100644 index 00000000..d8d65d8b --- /dev/null +++ b/src/libsodium/crypto_pwhash/argon2/argon2-fill-block-wasm32.c @@ -0,0 +1,214 @@ +/* + * Argon2 source code package + * + * Written by Daniel Dinu and Dmitry Khovratovich, 2015 + * + * This work is licensed under a Creative Commons CC0 1.0 License/Waiver. + * + * You should have received a copy of the CC0 Public Domain Dedication along + * with + * this software. If not, see + * . + * + * WebAssembly SIMD port of the SSSE3 implementation. + */ + +#include +#include +#include + +#include "argon2-core.h" +#include "argon2.h" +#include "private/common.h" + +#if defined(__wasm_simd128__) + +#include + +#include "blamka-round-wasm32.h" + +static void +fill_block(v128_t *state, const uint8_t *ref_block, uint8_t *next_block) +{ + v128_t block_XY[ARGON2_OWORDS_IN_BLOCK]; + uint32_t i; + + for (i = 0; i < ARGON2_OWORDS_IN_BLOCK; i++) { + block_XY[i] = state[i] = wasm_v128_xor( + state[i], wasm_v128_load((const v128_t *) (&ref_block[16 * i]))); + } + + for (i = 0; i < 8; ++i) { + BLAKE2_ROUND_WASM(state[8 * i + 0], state[8 * i + 1], state[8 * i + 2], + state[8 * i + 3], state[8 * i + 4], state[8 * i + 5], + state[8 * i + 6], state[8 * i + 7]); + } + + for (i = 0; i < 8; ++i) { + BLAKE2_ROUND_WASM(state[8 * 0 + i], state[8 * 1 + i], state[8 * 2 + i], + state[8 * 3 + i], state[8 * 4 + i], state[8 * 5 + i], + state[8 * 6 + i], state[8 * 7 + i]); + } + + for (i = 0; i < ARGON2_OWORDS_IN_BLOCK; i++) { + state[i] = wasm_v128_xor(state[i], block_XY[i]); + wasm_v128_store((v128_t *) (&next_block[16 * i]), state[i]); + } +} + +static void +fill_block_with_xor(v128_t *state, const uint8_t *ref_block, + uint8_t *next_block) +{ + v128_t block_XY[ARGON2_OWORDS_IN_BLOCK]; + uint32_t i; + + for (i = 0; i < ARGON2_OWORDS_IN_BLOCK; i++) { + state[i] = wasm_v128_xor( + state[i], wasm_v128_load((const v128_t *) (&ref_block[16 * i]))); + block_XY[i] = wasm_v128_xor( + state[i], wasm_v128_load((const v128_t *) (&next_block[16 * i]))); + } + + for (i = 0; i < 8; ++i) { + BLAKE2_ROUND_WASM(state[8 * i + 0], state[8 * i + 1], state[8 * i + 2], + state[8 * i + 3], state[8 * i + 4], state[8 * i + 5], + state[8 * i + 6], state[8 * i + 7]); + } + + for (i = 0; i < 8; ++i) { + BLAKE2_ROUND_WASM(state[8 * 0 + i], state[8 * 1 + i], state[8 * 2 + i], + state[8 * 3 + i], state[8 * 4 + i], state[8 * 5 + i], + state[8 * 6 + i], state[8 * 7 + i]); + } + + for (i = 0; i < ARGON2_OWORDS_IN_BLOCK; i++) { + state[i] = wasm_v128_xor(state[i], block_XY[i]); + wasm_v128_store((v128_t *) (&next_block[16 * i]), state[i]); + } +} + +static void +generate_addresses(const argon2_instance_t *instance, + const argon2_position_t *position, uint64_t *pseudo_rands) +{ + block address_block, input_block, tmp_block; + uint32_t i; + + init_block_value(&address_block, 0); + init_block_value(&input_block, 0); + + if (instance != NULL && position != NULL) { + input_block.v[0] = position->pass; + input_block.v[1] = position->lane; + input_block.v[2] = position->slice; + input_block.v[3] = instance->memory_blocks; + input_block.v[4] = instance->passes; + input_block.v[5] = instance->type; + + for (i = 0; i < instance->segment_length; ++i) { + if (i % ARGON2_ADDRESSES_IN_BLOCK == 0) { + v128_t zero_block[ARGON2_OWORDS_IN_BLOCK]; + v128_t zero2_block[ARGON2_OWORDS_IN_BLOCK]; + + memset(zero_block, 0, sizeof(zero_block)); + memset(zero2_block, 0, sizeof(zero2_block)); + init_block_value(&address_block, 0); + init_block_value(&tmp_block, 0); + input_block.v[6]++; + fill_block_with_xor(zero_block, (uint8_t *) &input_block.v, + (uint8_t *) &tmp_block.v); + fill_block_with_xor(zero2_block, (uint8_t *) &tmp_block.v, + (uint8_t *) &address_block.v); + } + + pseudo_rands[i] = address_block.v[i % ARGON2_ADDRESSES_IN_BLOCK]; + } + } +} + +void +argon2_fill_segment_wasm32(const argon2_instance_t *instance, + argon2_position_t position) +{ + block *ref_block = NULL, *curr_block = NULL; + uint64_t pseudo_rand, ref_index, ref_lane; + uint32_t prev_offset, curr_offset; + uint32_t starting_index, i; + v128_t state[ARGON2_OWORDS_IN_BLOCK]; + int data_independent_addressing = 1; + + uint64_t *pseudo_rands = NULL; + + if (instance == NULL) { + return; + } + + if (instance->type == Argon2_id && + (position.pass != 0 || position.slice >= ARGON2_SYNC_POINTS / 2)) { + data_independent_addressing = 0; + } + + pseudo_rands = instance->pseudo_rands; + + if (data_independent_addressing) { + generate_addresses(instance, &position, pseudo_rands); + } + + starting_index = 0; + + if ((0 == position.pass) && (0 == position.slice)) { + starting_index = 2; + } + + curr_offset = position.lane * instance->lane_length + + position.slice * instance->segment_length + starting_index; + + if (0 == curr_offset % instance->lane_length) { + prev_offset = curr_offset + instance->lane_length - 1; + } else { + prev_offset = curr_offset - 1; + } + + memcpy(state, ((instance->region->memory + prev_offset)->v), + ARGON2_BLOCK_SIZE); + + for (i = starting_index; i < instance->segment_length; + ++i, ++curr_offset, ++prev_offset) { + if (curr_offset % instance->lane_length == 1) { + prev_offset = curr_offset - 1; + } + + if (data_independent_addressing) { +#pragma warning(push) +#pragma warning(disable : 6385) + pseudo_rand = pseudo_rands[i]; +#pragma warning(pop) + } else { + pseudo_rand = instance->region->memory[prev_offset].v[0]; + } + + ref_lane = ((pseudo_rand >> 32)) % instance->lanes; + + if ((position.pass == 0) && (position.slice == 0)) { + ref_lane = position.lane; + } + + position.index = i; + ref_index = index_alpha(instance, &position, pseudo_rand & 0xFFFFFFFF, + ref_lane == position.lane); + + ref_block = instance->region->memory + + instance->lane_length * ref_lane + ref_index; + curr_block = instance->region->memory + curr_offset; + if (position.pass != 0) { + fill_block_with_xor(state, (uint8_t *) ref_block->v, + (uint8_t *) curr_block->v); + } else { + fill_block(state, (uint8_t *) ref_block->v, + (uint8_t *) curr_block->v); + } + } +} + +#endif diff --git a/src/libsodium/crypto_pwhash/argon2/blamka-round-neon.h b/src/libsodium/crypto_pwhash/argon2/blamka-round-neon.h new file mode 100644 index 00000000..3362fe72 --- /dev/null +++ b/src/libsodium/crypto_pwhash/argon2/blamka-round-neon.h @@ -0,0 +1,161 @@ +#ifndef blamka_round_neon_H +#define blamka_round_neon_H + +#include + +#include "private/common.h" + +static inline uint64x2_t +fBlaMka_neon(uint64x2_t x, uint64x2_t y) +{ + const uint32x2_t x_lo = vmovn_u64(x); + const uint32x2_t y_lo = vmovn_u64(y); + const uint64x2_t z = vmull_u32(x_lo, y_lo); + + return vaddq_u64(vaddq_u64(x, y), vaddq_u64(z, z)); +} + +static inline uint64x2_t +rotr64_32_neon(uint64x2_t x) +{ + return vreinterpretq_u64_u32(vrev64q_u32(vreinterpretq_u32_u64(x))); +} + +static inline uint64x2_t +rotr64_24_neon(uint64x2_t x) +{ + static const uint8_t rot24_tbl[16] = { + 3, 4, 5, 6, 7, 0, 1, 2, + 11, 12, 13, 14, 15, 8, 9, 10 + }; + const uint8x16_t tbl = vld1q_u8(rot24_tbl); + return vreinterpretq_u64_u8(vqtbl1q_u8(vreinterpretq_u8_u64(x), tbl)); +} + +static inline uint64x2_t +rotr64_16_neon(uint64x2_t x) +{ + static const uint8_t rot16_tbl[16] = { + 2, 3, 4, 5, 6, 7, 0, 1, + 10, 11, 12, 13, 14, 15, 8, 9 + }; + const uint8x16_t tbl = vld1q_u8(rot16_tbl); + return vreinterpretq_u64_u8(vqtbl1q_u8(vreinterpretq_u8_u64(x), tbl)); +} + +static inline uint64x2_t +rotr64_63_neon(uint64x2_t x) +{ + return veorq_u64(vshrq_n_u64(x, 63), vaddq_u64(x, x)); +} + +#define G1_NEON(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + A0 = fBlaMka_neon(A0, B0); \ + A1 = fBlaMka_neon(A1, B1); \ + \ + D0 = veorq_u64(D0, A0); \ + D1 = veorq_u64(D1, A1); \ + \ + D0 = rotr64_32_neon(D0); \ + D1 = rotr64_32_neon(D1); \ + \ + C0 = fBlaMka_neon(C0, D0); \ + C1 = fBlaMka_neon(C1, D1); \ + \ + B0 = veorq_u64(B0, C0); \ + B1 = veorq_u64(B1, C1); \ + \ + B0 = rotr64_24_neon(B0); \ + B1 = rotr64_24_neon(B1); \ + } while ((void) 0, 0) + +#define G2_NEON(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + A0 = fBlaMka_neon(A0, B0); \ + A1 = fBlaMka_neon(A1, B1); \ + \ + D0 = veorq_u64(D0, A0); \ + D1 = veorq_u64(D1, A1); \ + \ + D0 = rotr64_16_neon(D0); \ + D1 = rotr64_16_neon(D1); \ + \ + C0 = fBlaMka_neon(C0, D0); \ + C1 = fBlaMka_neon(C1, D1); \ + \ + B0 = veorq_u64(B0, C0); \ + B1 = veorq_u64(B1, C1); \ + \ + B0 = rotr64_63_neon(B0); \ + B1 = rotr64_63_neon(B1); \ + } while ((void) 0, 0) + +#define DIAGONALIZE_NEON(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + uint64x2_t t0, t1; \ + \ + t0 = vreinterpretq_u64_u8( \ + vextq_u8(vreinterpretq_u8_u64(B0), \ + vreinterpretq_u8_u64(B1), 8)); \ + t1 = vreinterpretq_u64_u8( \ + vextq_u8(vreinterpretq_u8_u64(B1), \ + vreinterpretq_u8_u64(B0), 8)); \ + B0 = t0; \ + B1 = t1; \ + \ + t0 = C0; \ + C0 = C1; \ + C1 = t0; \ + \ + t0 = vreinterpretq_u64_u8( \ + vextq_u8(vreinterpretq_u8_u64(D0), \ + vreinterpretq_u8_u64(D1), 8)); \ + t1 = vreinterpretq_u64_u8( \ + vextq_u8(vreinterpretq_u8_u64(D1), \ + vreinterpretq_u8_u64(D0), 8)); \ + D0 = t1; \ + D1 = t0; \ + } while ((void) 0, 0) + +#define UNDIAGONALIZE_NEON(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + uint64x2_t t0, t1; \ + \ + t0 = vreinterpretq_u64_u8( \ + vextq_u8(vreinterpretq_u8_u64(B1), \ + vreinterpretq_u8_u64(B0), 8)); \ + t1 = vreinterpretq_u64_u8( \ + vextq_u8(vreinterpretq_u8_u64(B0), \ + vreinterpretq_u8_u64(B1), 8)); \ + B0 = t0; \ + B1 = t1; \ + \ + t0 = C0; \ + C0 = C1; \ + C1 = t0; \ + \ + t0 = vreinterpretq_u64_u8( \ + vextq_u8(vreinterpretq_u8_u64(D1), \ + vreinterpretq_u8_u64(D0), 8)); \ + t1 = vreinterpretq_u64_u8( \ + vextq_u8(vreinterpretq_u8_u64(D0), \ + vreinterpretq_u8_u64(D1), 8)); \ + D0 = t1; \ + D1 = t0; \ + } while ((void) 0, 0) + +#define BLAKE2_ROUND_NEON(A0, A1, B0, B1, C0, C1, D0, D1) \ + do { \ + G1_NEON(A0, B0, C0, D0, A1, B1, C1, D1); \ + G2_NEON(A0, B0, C0, D0, A1, B1, C1, D1); \ + \ + DIAGONALIZE_NEON(A0, B0, C0, D0, A1, B1, C1, D1); \ + \ + G1_NEON(A0, B0, C0, D0, A1, B1, C1, D1); \ + G2_NEON(A0, B0, C0, D0, A1, B1, C1, D1); \ + \ + UNDIAGONALIZE_NEON(A0, B0, C0, D0, A1, B1, C1, D1); \ + } while ((void) 0, 0) + +#endif diff --git a/src/libsodium/crypto_pwhash/argon2/blamka-round-wasm32.h b/src/libsodium/crypto_pwhash/argon2/blamka-round-wasm32.h new file mode 100644 index 00000000..ee334977 --- /dev/null +++ b/src/libsodium/crypto_pwhash/argon2/blamka-round-wasm32.h @@ -0,0 +1,134 @@ +#ifndef blamka_round_wasm32_H +#define blamka_round_wasm32_H + +#include +#include "private/common.h" + +static inline v128_t +fBlaMka_wasm(v128_t x, v128_t y) +{ + const v128_t z = wasm_u64x2_extmul_low_u32x4(x, y); + return wasm_i64x2_add(wasm_i64x2_add(x, y), wasm_i64x2_add(z, z)); +} + +static inline v128_t +rotr64_32_wasm(v128_t x) +{ + return wasm_i32x4_shuffle(x, x, 1, 0, 3, 2); +} + +static inline v128_t +rotr64_24_wasm(v128_t x) +{ + return wasm_v128_or(wasm_u64x2_shr(x, 24), wasm_i64x2_shl(x, 40)); +} + +static inline v128_t +rotr64_16_wasm(v128_t x) +{ + return wasm_v128_or(wasm_u64x2_shr(x, 16), wasm_i64x2_shl(x, 48)); +} + +static inline v128_t +rotr64_63_wasm(v128_t x) +{ + return wasm_v128_or(wasm_u64x2_shr(x, 63), wasm_i64x2_shl(x, 1)); +} + +#define G1_WASM(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + A0 = fBlaMka_wasm(A0, B0); \ + A1 = fBlaMka_wasm(A1, B1); \ + \ + D0 = wasm_v128_xor(D0, A0); \ + D1 = wasm_v128_xor(D1, A1); \ + \ + D0 = rotr64_32_wasm(D0); \ + D1 = rotr64_32_wasm(D1); \ + \ + C0 = fBlaMka_wasm(C0, D0); \ + C1 = fBlaMka_wasm(C1, D1); \ + \ + B0 = wasm_v128_xor(B0, C0); \ + B1 = wasm_v128_xor(B1, C1); \ + \ + B0 = rotr64_24_wasm(B0); \ + B1 = rotr64_24_wasm(B1); \ + } while ((void) 0, 0) + +#define G2_WASM(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + A0 = fBlaMka_wasm(A0, B0); \ + A1 = fBlaMka_wasm(A1, B1); \ + \ + D0 = wasm_v128_xor(D0, A0); \ + D1 = wasm_v128_xor(D1, A1); \ + \ + D0 = rotr64_16_wasm(D0); \ + D1 = rotr64_16_wasm(D1); \ + \ + C0 = fBlaMka_wasm(C0, D0); \ + C1 = fBlaMka_wasm(C1, D1); \ + \ + B0 = wasm_v128_xor(B0, C0); \ + B1 = wasm_v128_xor(B1, C1); \ + \ + B0 = rotr64_63_wasm(B0); \ + B1 = rotr64_63_wasm(B1); \ + } while ((void) 0, 0) + +static inline v128_t +wasm_alignr_8(v128_t a, v128_t b) +{ + return wasm_i8x16_shuffle(b, a, 8, 9, 10, 11, 12, 13, 14, 15, + 16, 17, 18, 19, 20, 21, 22, 23); +} + +#define DIAGONALIZE_WASM(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + v128_t t0 = wasm_alignr_8(B1, B0); \ + v128_t t1 = wasm_alignr_8(B0, B1); \ + B0 = t0; \ + B1 = t1; \ + \ + t0 = C0; \ + C0 = C1; \ + C1 = t0; \ + \ + t0 = wasm_alignr_8(D1, D0); \ + t1 = wasm_alignr_8(D0, D1); \ + D0 = t1; \ + D1 = t0; \ + } while ((void) 0, 0) + +#define UNDIAGONALIZE_WASM(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + v128_t t0 = wasm_alignr_8(B0, B1); \ + v128_t t1 = wasm_alignr_8(B1, B0); \ + B0 = t0; \ + B1 = t1; \ + \ + t0 = C0; \ + C0 = C1; \ + C1 = t0; \ + \ + t0 = wasm_alignr_8(D0, D1); \ + t1 = wasm_alignr_8(D1, D0); \ + D0 = t1; \ + D1 = t0; \ + } while ((void) 0, 0) + +#define BLAKE2_ROUND_WASM(A0, A1, B0, B1, C0, C1, D0, D1) \ + do { \ + G1_WASM(A0, B0, C0, D0, A1, B1, C1, D1); \ + G2_WASM(A0, B0, C0, D0, A1, B1, C1, D1); \ + \ + DIAGONALIZE_WASM(A0, B0, C0, D0, A1, B1, C1, D1); \ + \ + G1_WASM(A0, B0, C0, D0, A1, B1, C1, D1); \ + G2_WASM(A0, B0, C0, D0, A1, B1, C1, D1); \ + \ + UNDIAGONALIZE_WASM(A0, B0, C0, D0, A1, B1, C1, D1); \ + } while ((void) 0, 0) + +#endif diff --git a/src/libsodium/crypto_secretbox/crypto_secretbox_easy.c b/src/libsodium/crypto_secretbox/crypto_secretbox_easy.c index 365be738..d1e7748b 100644 --- a/src/libsodium/crypto_secretbox/crypto_secretbox_easy.c +++ b/src/libsodium/crypto_secretbox/crypto_secretbox_easy.c @@ -115,6 +115,7 @@ crypto_secretbox_open_detached(unsigned char *m, const unsigned char *c, if (m == NULL) { return 0; } + ACQUIRE_FENCE; /* * Allow the m and c buffers to partially overlap, by calling diff --git a/src/libsodium/crypto_secretbox/xchacha20poly1305/secretbox_xchacha20poly1305.c b/src/libsodium/crypto_secretbox/xchacha20poly1305/secretbox_xchacha20poly1305.c index 129ab0f9..4b9e27b0 100644 --- a/src/libsodium/crypto_secretbox/xchacha20poly1305/secretbox_xchacha20poly1305.c +++ b/src/libsodium/crypto_secretbox/xchacha20poly1305/secretbox_xchacha20poly1305.c @@ -124,6 +124,7 @@ crypto_secretbox_xchacha20poly1305_open_detached(unsigned char *m, if (m == NULL) { return 0; } + ACQUIRE_FENCE; /* * Allow the m and c buffers to partially overlap, by calling diff --git a/src/libsodium/crypto_secretbox/xsalsa20poly1305/secretbox_xsalsa20poly1305.c b/src/libsodium/crypto_secretbox/xsalsa20poly1305/secretbox_xsalsa20poly1305.c index 7240050d..929cbad5 100644 --- a/src/libsodium/crypto_secretbox/xsalsa20poly1305/secretbox_xsalsa20poly1305.c +++ b/src/libsodium/crypto_secretbox/xsalsa20poly1305/secretbox_xsalsa20poly1305.c @@ -2,6 +2,7 @@ #include "crypto_secretbox_xsalsa20poly1305.h" #include "crypto_stream_xsalsa20.h" #include "randombytes.h" +#include "private/common.h" int crypto_secretbox_xsalsa20poly1305(unsigned char *c, const unsigned char *m, @@ -39,6 +40,7 @@ crypto_secretbox_xsalsa20poly1305_open(unsigned char *m, const unsigned char *c, clen - 32, subkey) != 0) { return -1; } + ACQUIRE_FENCE; crypto_stream_xsalsa20_xor(m, c, clen, n, k); for (i = 0; i < 32; ++i) { m[i] = 0; diff --git a/src/libsodium/crypto_secretstream/xchacha20poly1305/secretstream_xchacha20poly1305.c b/src/libsodium/crypto_secretstream/xchacha20poly1305/secretstream_xchacha20poly1305.c index aa5a3459..c6616ded 100644 --- a/src/libsodium/crypto_secretstream/xchacha20poly1305/secretstream_xchacha20poly1305.c +++ b/src/libsodium/crypto_secretstream/xchacha20poly1305/secretstream_xchacha20poly1305.c @@ -241,6 +241,7 @@ crypto_secretstream_xchacha20poly1305_pull return -1; } + ACQUIRE_FENCE; crypto_stream_chacha20_ietf_xor_ic(m, c, mlen, state->nonce, 2U, state->k); XOR_BUF(STATE_INONCE(state), mac, crypto_secretstream_xchacha20poly1305_INONCEBYTES); diff --git a/src/libsodium/include/Makefile.am b/src/libsodium/include/Makefile.am index db1c7bc7..011f9b0f 100644 --- a/src/libsodium/include/Makefile.am +++ b/src/libsodium/include/Makefile.am @@ -26,13 +26,16 @@ SODIUM_EXPORT = \ sodium/crypto_generichash_blake2b.h \ sodium/crypto_hash.h \ sodium/crypto_hash_sha256.h \ + sodium/crypto_hash_sha3.h \ sodium/crypto_hash_sha512.h \ sodium/crypto_ipcrypt.h \ sodium/crypto_kdf.h \ sodium/crypto_kdf_blake2b.h \ sodium/crypto_kdf_hkdf_sha256.h \ sodium/crypto_kdf_hkdf_sha512.h \ + sodium/crypto_kem.h \ sodium/crypto_kem_mlkem768.h \ + sodium/crypto_kem_xwing.h \ sodium/crypto_kx.h \ sodium/crypto_onetimeauth.h \ sodium/crypto_onetimeauth_poly1305.h \ diff --git a/src/libsodium/include/sodium.h b/src/libsodium/include/sodium.h index bf1ad011..4d918f5e 100644 --- a/src/libsodium/include/sodium.h +++ b/src/libsodium/include/sodium.h @@ -26,13 +26,16 @@ #include "sodium/crypto_generichash_blake2b.h" #include "sodium/crypto_hash.h" #include "sodium/crypto_hash_sha256.h" +#include "sodium/crypto_hash_sha3.h" #include "sodium/crypto_hash_sha512.h" #include "sodium/crypto_ipcrypt.h" #include "sodium/crypto_kdf.h" #include "sodium/crypto_kdf_hkdf_sha256.h" #include "sodium/crypto_kdf_hkdf_sha512.h" #include "sodium/crypto_kdf_blake2b.h" +#include "sodium/crypto_kem.h" #include "sodium/crypto_kem_mlkem768.h" +#include "sodium/crypto_kem_xwing.h" #include "sodium/crypto_kx.h" #include "sodium/crypto_onetimeauth.h" #include "sodium/crypto_onetimeauth_poly1305.h" diff --git a/src/libsodium/include/sodium/crypto_core_ed25519.h b/src/libsodium/include/sodium/crypto_core_ed25519.h index d2bfb295..9114017e 100644 --- a/src/libsodium/include/sodium/crypto_core_ed25519.h +++ b/src/libsodium/include/sodium/crypto_core_ed25519.h @@ -47,14 +47,16 @@ int crypto_core_ed25519_sub(unsigned char *r, SODIUM_EXPORT int crypto_core_ed25519_from_string(unsigned char p[crypto_core_ed25519_BYTES], - const char *ctx, const unsigned char *msg, - size_t msg_len, int hash_alg) + const unsigned char *ctx, size_t ctx_len, + const unsigned char *msg, size_t msg_len, + int hash_alg) __attribute__ ((nonnull(1))); SODIUM_EXPORT int crypto_core_ed25519_from_string_ro(unsigned char p[crypto_core_ed25519_BYTES], - const char *ctx, const unsigned char *msg, - size_t msg_len, int hash_alg) + const unsigned char *ctx, size_t ctx_len, + const unsigned char *msg, size_t msg_len, + int hash_alg) __attribute__ ((nonnull(1))); SODIUM_EXPORT diff --git a/src/libsodium/include/sodium/crypto_core_ristretto255.h b/src/libsodium/include/sodium/crypto_core_ristretto255.h index 5fc3a1be..30c7faee 100644 --- a/src/libsodium/include/sodium/crypto_core_ristretto255.h +++ b/src/libsodium/include/sodium/crypto_core_ristretto255.h @@ -48,16 +48,16 @@ int crypto_core_ristretto255_from_hash(unsigned char *p, SODIUM_EXPORT int crypto_core_ristretto255_from_string(unsigned char p[crypto_core_ristretto255_BYTES], - const char *ctx, - const unsigned char *msg, - size_t msg_len, int hash_alg) + const unsigned char *ctx, size_t ctx_len, + const unsigned char *msg, size_t msg_len, + int hash_alg) __attribute__ ((nonnull(1))); SODIUM_EXPORT int crypto_core_ristretto255_from_string_ro(unsigned char p[crypto_core_ristretto255_BYTES], - const char *ctx, - const unsigned char *msg, - size_t msg_len, int hash_alg) + const unsigned char *ctx, size_t ctx_len, + const unsigned char *msg, size_t msg_len, + int hash_alg) __attribute__ ((nonnull(1))); SODIUM_EXPORT diff --git a/src/libsodium/include/sodium/crypto_hash_sha3.h b/src/libsodium/include/sodium/crypto_hash_sha3.h new file mode 100644 index 00000000..d018296f --- /dev/null +++ b/src/libsodium/include/sodium/crypto_hash_sha3.h @@ -0,0 +1,80 @@ +#ifndef crypto_hash_sha3_H +#define crypto_hash_sha3_H + +#include +#include + +#include "export.h" + +#ifdef __cplusplus +# ifdef __GNUC__ +# pragma GCC diagnostic ignored "-Wlong-long" +# endif +extern "C" { +#endif + +typedef struct CRYPTO_ALIGN(16) crypto_hash_sha3256_state { + unsigned char opaque[256]; +} crypto_hash_sha3256_state; + +SODIUM_EXPORT +size_t crypto_hash_sha3256_statebytes(void); + +#define crypto_hash_sha3256_BYTES 32U +SODIUM_EXPORT +size_t crypto_hash_sha3256_bytes(void); + +SODIUM_EXPORT +int crypto_hash_sha3256(unsigned char *out, const unsigned char *in, + unsigned long long inlen) __attribute__ ((nonnull(1))); + +SODIUM_EXPORT +int crypto_hash_sha3256_init(crypto_hash_sha3256_state *state) + __attribute__ ((nonnull)); + +SODIUM_EXPORT +int crypto_hash_sha3256_update(crypto_hash_sha3256_state *state, + const unsigned char *in, + unsigned long long inlen) + __attribute__ ((nonnull(1))); + +SODIUM_EXPORT +int crypto_hash_sha3256_final(crypto_hash_sha3256_state *state, + unsigned char *out) + __attribute__ ((nonnull)); + +typedef struct CRYPTO_ALIGN(16) crypto_hash_sha3512_state { + unsigned char opaque[256]; +} crypto_hash_sha3512_state; + +SODIUM_EXPORT +size_t crypto_hash_sha3512_statebytes(void); + +#define crypto_hash_sha3512_BYTES 64U +SODIUM_EXPORT +size_t crypto_hash_sha3512_bytes(void); + +SODIUM_EXPORT +int crypto_hash_sha3512(unsigned char *out, const unsigned char *in, + unsigned long long inlen) __attribute__ ((nonnull(1))); + +SODIUM_EXPORT +int crypto_hash_sha3512_init(crypto_hash_sha3512_state *state) + __attribute__ ((nonnull)); + +SODIUM_EXPORT +int crypto_hash_sha3512_update(crypto_hash_sha3512_state *state, + const unsigned char *in, + unsigned long long inlen) + __attribute__ ((nonnull(1))); + +SODIUM_EXPORT +int crypto_hash_sha3512_final(crypto_hash_sha3512_state *state, + unsigned char *out) + __attribute__ ((nonnull)); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/src/libsodium/include/sodium/crypto_ipcrypt.h b/src/libsodium/include/sodium/crypto_ipcrypt.h index 8b2271ed..65f526d2 100644 --- a/src/libsodium/include/sodium/crypto_ipcrypt.h +++ b/src/libsodium/include/sodium/crypto_ipcrypt.h @@ -63,6 +63,10 @@ size_t crypto_ipcrypt_pfx_bytes(void); SODIUM_EXPORT void crypto_ipcrypt_keygen(unsigned char k[crypto_ipcrypt_KEYBYTES]) __attribute__((nonnull)); +SODIUM_EXPORT +void crypto_ipcrypt_nd_keygen(unsigned char k[crypto_ipcrypt_ND_KEYBYTES]) + __attribute__((nonnull)); + SODIUM_EXPORT void crypto_ipcrypt_ndx_keygen(unsigned char k[crypto_ipcrypt_NDX_KEYBYTES]) __attribute__((nonnull)); diff --git a/src/libsodium/include/sodium/crypto_kem.h b/src/libsodium/include/sodium/crypto_kem.h new file mode 100644 index 00000000..ff289e87 --- /dev/null +++ b/src/libsodium/include/sodium/crypto_kem.h @@ -0,0 +1,70 @@ +#ifndef crypto_kem_H +#define crypto_kem_H + +/* + * THREAD SAFETY: crypto_kem_keypair() is thread-safe, + * provided that sodium_init() was called before. + * + * Other functions are always thread-safe. + */ + +#include + +#include "crypto_kem_xwing.h" +#include "export.h" + +#ifdef __cplusplus +# ifdef __GNUC__ +# pragma GCC diagnostic ignored "-Wlong-long" +# endif +extern "C" { +#endif + +#define crypto_kem_PUBLICKEYBYTES crypto_kem_xwing_PUBLICKEYBYTES +SODIUM_EXPORT +size_t crypto_kem_publickeybytes(void); + +#define crypto_kem_SECRETKEYBYTES crypto_kem_xwing_SECRETKEYBYTES +SODIUM_EXPORT +size_t crypto_kem_secretkeybytes(void); + +#define crypto_kem_CIPHERTEXTBYTES crypto_kem_xwing_CIPHERTEXTBYTES +SODIUM_EXPORT +size_t crypto_kem_ciphertextbytes(void); + +#define crypto_kem_SHAREDSECRETBYTES crypto_kem_xwing_SHAREDSECRETBYTES +SODIUM_EXPORT +size_t crypto_kem_sharedsecretbytes(void); + +#define crypto_kem_SEEDBYTES crypto_kem_xwing_SEEDBYTES +SODIUM_EXPORT +size_t crypto_kem_seedbytes(void); + +#define crypto_kem_PRIMITIVE "xwing" +SODIUM_EXPORT +const char *crypto_kem_primitive(void); + +SODIUM_EXPORT +int crypto_kem_seed_keypair(unsigned char *pk, unsigned char *sk, + const unsigned char *seed) + __attribute__ ((nonnull)); + +SODIUM_EXPORT +int crypto_kem_keypair(unsigned char *pk, unsigned char *sk) + __attribute__ ((nonnull)); + +SODIUM_EXPORT +int crypto_kem_enc(unsigned char *ct, unsigned char *ss, + const unsigned char *pk) + __attribute__ ((warn_unused_result)) __attribute__ ((nonnull)); + +SODIUM_EXPORT +int crypto_kem_dec(unsigned char *ss, const unsigned char *ct, + const unsigned char *sk) + __attribute__ ((warn_unused_result)) __attribute__ ((nonnull)); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/src/libsodium/include/sodium/crypto_kem_xwing.h b/src/libsodium/include/sodium/crypto_kem_xwing.h new file mode 100644 index 00000000..d1be2d08 --- /dev/null +++ b/src/libsodium/include/sodium/crypto_kem_xwing.h @@ -0,0 +1,69 @@ +#ifndef crypto_kem_xwing_H +#define crypto_kem_xwing_H + +#include + +#include "export.h" + +#ifdef __cplusplus +# ifdef __GNUC__ +# pragma GCC diagnostic ignored "-Wlong-long" +# endif +extern "C" { +#endif + +#define crypto_kem_xwing_PUBLICKEYBYTES 1216U +SODIUM_EXPORT +size_t crypto_kem_xwing_publickeybytes(void); + +#define crypto_kem_xwing_SECRETKEYBYTES 32U +SODIUM_EXPORT +size_t crypto_kem_xwing_secretkeybytes(void); + +#define crypto_kem_xwing_CIPHERTEXTBYTES 1120U +SODIUM_EXPORT +size_t crypto_kem_xwing_ciphertextbytes(void); + +#define crypto_kem_xwing_SHAREDSECRETBYTES 32U +SODIUM_EXPORT +size_t crypto_kem_xwing_sharedsecretbytes(void); + +#define crypto_kem_xwing_SEEDBYTES 32U +SODIUM_EXPORT +size_t crypto_kem_xwing_seedbytes(void); + +SODIUM_EXPORT +int crypto_kem_xwing_seed_keypair(unsigned char pk[crypto_kem_xwing_PUBLICKEYBYTES], + unsigned char sk[crypto_kem_xwing_SECRETKEYBYTES], + const unsigned char seed[crypto_kem_xwing_SEEDBYTES]) + __attribute__((nonnull)); + +SODIUM_EXPORT +int crypto_kem_xwing_keypair(unsigned char pk[crypto_kem_xwing_PUBLICKEYBYTES], + unsigned char sk[crypto_kem_xwing_SECRETKEYBYTES]) + __attribute__((nonnull)); + +SODIUM_EXPORT +int crypto_kem_xwing_enc(unsigned char ct[crypto_kem_xwing_CIPHERTEXTBYTES], + unsigned char ss[crypto_kem_xwing_SHAREDSECRETBYTES], + const unsigned char pk[crypto_kem_xwing_PUBLICKEYBYTES]) + __attribute__((warn_unused_result)) __attribute__((nonnull)); + +SODIUM_EXPORT +int crypto_kem_xwing_enc_deterministic(unsigned char ct[crypto_kem_xwing_CIPHERTEXTBYTES], + unsigned char ss[crypto_kem_xwing_SHAREDSECRETBYTES], + const unsigned char pk[crypto_kem_xwing_PUBLICKEYBYTES], + const unsigned char seed[64]) + __attribute__((warn_unused_result)) __attribute__((nonnull)); + +SODIUM_EXPORT +int crypto_kem_xwing_dec(unsigned char ss[crypto_kem_xwing_SHAREDSECRETBYTES], + const unsigned char ct[crypto_kem_xwing_CIPHERTEXTBYTES], + const unsigned char sk[crypto_kem_xwing_SECRETKEYBYTES]) + __attribute__((warn_unused_result)) __attribute__((nonnull)); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/src/libsodium/include/sodium/crypto_xof_shake128.h b/src/libsodium/include/sodium/crypto_xof_shake128.h index 2a33239a..aed16a77 100644 --- a/src/libsodium/include/sodium/crypto_xof_shake128.h +++ b/src/libsodium/include/sodium/crypto_xof_shake128.h @@ -24,7 +24,7 @@ size_t crypto_xof_shake128_statebytes(void); SODIUM_EXPORT unsigned char crypto_xof_shake128_domain_standard(void); -typedef struct CRYPTO_ALIGN(64) crypto_xof_shake128_state { +typedef struct CRYPTO_ALIGN(16) crypto_xof_shake128_state { unsigned char opaque[256]; } crypto_xof_shake128_state; diff --git a/src/libsodium/include/sodium/crypto_xof_shake256.h b/src/libsodium/include/sodium/crypto_xof_shake256.h index 05401b0e..9f4bfc72 100644 --- a/src/libsodium/include/sodium/crypto_xof_shake256.h +++ b/src/libsodium/include/sodium/crypto_xof_shake256.h @@ -20,7 +20,7 @@ size_t crypto_xof_shake256_statebytes(void); SODIUM_EXPORT unsigned char crypto_xof_shake256_domain_standard(void); -typedef struct CRYPTO_ALIGN(64) crypto_xof_shake256_state { +typedef struct CRYPTO_ALIGN(16) crypto_xof_shake256_state { unsigned char opaque[256]; } crypto_xof_shake256_state; diff --git a/src/libsodium/include/sodium/crypto_xof_turboshake128.h b/src/libsodium/include/sodium/crypto_xof_turboshake128.h index f097bb73..f8c3e30d 100644 --- a/src/libsodium/include/sodium/crypto_xof_turboshake128.h +++ b/src/libsodium/include/sodium/crypto_xof_turboshake128.h @@ -20,7 +20,7 @@ size_t crypto_xof_turboshake128_statebytes(void); SODIUM_EXPORT unsigned char crypto_xof_turboshake128_domain_standard(void); -typedef struct CRYPTO_ALIGN(64) crypto_xof_turboshake128_state { +typedef struct CRYPTO_ALIGN(16) crypto_xof_turboshake128_state { unsigned char opaque[256]; } crypto_xof_turboshake128_state; diff --git a/src/libsodium/include/sodium/crypto_xof_turboshake256.h b/src/libsodium/include/sodium/crypto_xof_turboshake256.h index 40d6465a..b325067d 100644 --- a/src/libsodium/include/sodium/crypto_xof_turboshake256.h +++ b/src/libsodium/include/sodium/crypto_xof_turboshake256.h @@ -20,7 +20,7 @@ size_t crypto_xof_turboshake256_statebytes(void); SODIUM_EXPORT unsigned char crypto_xof_turboshake256_domain_standard(void); -typedef struct CRYPTO_ALIGN(64) crypto_xof_turboshake256_state { +typedef struct CRYPTO_ALIGN(16) crypto_xof_turboshake256_state { unsigned char opaque[256]; } crypto_xof_turboshake256_state; diff --git a/src/libsodium/include/sodium/private/quirks.h b/src/libsodium/include/sodium/private/quirks.h index b155bc39..82ec2c5a 100644 --- a/src/libsodium/include/sodium/private/quirks.h +++ b/src/libsodium/include/sodium/private/quirks.h @@ -70,6 +70,11 @@ #define ge25519_scalarmult _sodium_ge25519_scalarmult #define ge25519_scalarmult_base _sodium_ge25519_scalarmult_base #define ge25519_tobytes _sodium_ge25519_tobytes +#define keccak1600_armsha3_extract_bytes _sodium_keccak1600_armsha3_extract_bytes +#define keccak1600_armsha3_init _sodium_keccak1600_armsha3_init +#define keccak1600_armsha3_permute_12 _sodium_keccak1600_armsha3_permute_12 +#define keccak1600_armsha3_permute_24 _sodium_keccak1600_armsha3_permute_24 +#define keccak1600_armsha3_xor_bytes _sodium_keccak1600_armsha3_xor_bytes #define keccak1600_ref_extract_bytes _sodium_keccak1600_ref_extract_bytes #define keccak1600_ref_init _sodium_keccak1600_ref_init #define keccak1600_ref_permute_12 _sodium_keccak1600_ref_permute_12 diff --git a/src/libsodium/randombytes/randombytes.c b/src/libsodium/randombytes/randombytes.c index 85c24454..5ccb6703 100644 --- a/src/libsodium/randombytes/randombytes.c +++ b/src/libsodium/randombytes/randombytes.c @@ -65,6 +65,20 @@ javascript_stir(void) }; randomValuesStandard(); Module.getRandomValue = randomValuesStandard; + Module.getRandomBytes = function(ptr, size) { + var heapu8 = Module.HEAPU8; + var chunk = 65536; + while (size > chunk) { + var buf = new Uint8Array(chunk); + crypto_.getRandomValues(buf); + heapu8.set(buf, ptr); + ptr += chunk; + size -= chunk; + } + var buf = new Uint8Array(size); + crypto_.getRandomValues(buf); + heapu8.set(buf, ptr); + }; } catch (e) { try { var crypto = require('crypto'); @@ -74,22 +88,41 @@ javascript_stir(void) }; randomValueNodeJS(); Module.getRandomValue = randomValueNodeJS; + Module.getRandomBytes = function(ptr, size) { + var buf = crypto['randomBytes'](size); + Module.HEAPU8.set(buf, ptr); + }; } catch (e) { throw 'No secure random number generator found'; } } } + if (Module.getRandomBytes === undefined) { + Module.getRandomBytes = function(ptr, size) { + var heapu8 = Module.HEAPU8; + for (var i = 0; i < size; i++) { + heapu8[ptr + i] = Module.getRandomValue() & 0xff; + } + }; + } }); } static void javascript_buf(void * const buf, const size_t size) { - unsigned char *p = (unsigned char *) buf; - size_t i; - - for (i = (size_t) 0U; i < size; i++) { - p[i] = (unsigned char) randombytes_random(); + if (size > (size_t) 0U) { + EM_ASM({ + if (Module.getRandomBytes === undefined) { + Module.getRandomBytes = function(ptr, size) { + var heapu8 = Module.HEAPU8; + for (var i = 0; i < size; i++) { + heapu8[ptr + i] = Module.getRandomValue() & 0xff; + } + }; + } + Module.getRandomBytes($0, $1); + }, buf, size); } } #endif diff --git a/test/default/Makefile.am b/test/default/Makefile.am index d95a6b5c..5c018f3d 100644 --- a/test/default/Makefile.am +++ b/test/default/Makefile.am @@ -44,10 +44,14 @@ EXTRA_DIST = \ generichash3.exp \ hash.exp \ hash3.exp \ + hash_sha3256.exp \ + hash_sha3512.exp \ ipcrypt.exp \ kdf.exp \ kdf_hkdf.exp \ + kem.exp \ kem_mlkem768.exp \ + kem_xwing.exp \ keygen.exp \ kx.exp \ metamorphic.exp \ @@ -136,10 +140,14 @@ DISTCLEANFILES = \ hash.res \ hash2.res \ hash3.res \ + hash_sha3256.res \ + hash_sha3512.res \ ipcrypt.res \ kdf.res \ kdf_hkdf.res \ + kem.res \ kem_mlkem768.res \ + kem_xwing.res \ keygen.res \ kx.res \ metamorphic.res \ @@ -234,9 +242,13 @@ TESTS_TARGETS = \ generichash3 \ hash \ hash3 \ + hash_sha3256 \ + hash_sha3512 \ ipcrypt \ kdf \ + kem \ kem_mlkem768 \ + kem_xwing \ keygen \ kx \ metamorphic \ @@ -406,6 +418,12 @@ hash_LDADD = $(TESTS_LDADD) hash3_SOURCE = cmptest.h hash3.c hash3_LDADD = $(TESTS_LDADD) +hash_sha3256_SOURCE = cmptest.h hash_sha3256.c +hash_sha3256_LDADD = $(TESTS_LDADD) + +hash_sha3512_SOURCE = cmptest.h hash_sha3512.c +hash_sha3512_LDADD = $(TESTS_LDADD) + ipcrypt_SOURCE = cmptest.h ipcrypt.c ipcrypt_LDADD = $(TESTS_LDADD) @@ -415,9 +433,15 @@ kdf_LDADD = $(TESTS_LDADD) kdf_hkdf_SOURCE = cmptest.h kdf_hkdf.c kdf_hkdf_LDADD = $(TESTS_LDADD) +kem_SOURCE = cmptest.h kem.c +kem_LDADD = $(TESTS_LDADD) + kem_mlkem768_SOURCE = cmptest.h kem_mlkem768.c kem_mlkem768_LDADD = $(TESTS_LDADD) +kem_xwing_SOURCE = cmptest.h kem_xwing.c +kem_xwing_LDADD = $(TESTS_LDADD) + keygen_SOURCE = cmptest.h keygen.c keygen_LDADD = $(TESTS_LDADD) diff --git a/test/default/core_ed25519_h2c.c b/test/default/core_ed25519_h2c.c index e4e65b98..6a70cf5b 100644 --- a/test/default/core_ed25519_h2c.c +++ b/test/default/core_ed25519_h2c.c @@ -4,20 +4,25 @@ typedef struct TestData_ { int ro; const char *msg; + const char tv_x[64 + 1]; const char tv_y[64 + 1]; } TestData; static TestData test_data[] = { { 0, "", + "1ff2b70ecf862799e11b7ae744e3489aa058ce805dd323a936375a84695e76da", "222e314d04a4d5725e9f2aff9fb2a6b69ef375a1214eb19021ceab2d687f0f9b" }, { 0, "abc", + "5f13cc69c891d86927eb37bd4afc6672360007c63f68a33ab423a3aa040fd2a8", "67732d50f9a26f73111dd1ed5dba225614e538599db58ba30aaea1f5c827fa42" }, { 0, "abcdef0123456789", + "1dd2fefce934ecfd7aae6ec998de088d7dd03316aa1847198aecf699ba6613f1", "2f8a6c24dd1adde73909cada6a4a137577b0f179d336685c4a955a0a8e1a86fb" }, { 0, "q128_" "qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq" "qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq", + "35fbdc5143e8a97afd3096f2b843e07df72e15bfca2eaf6879bf97c5d3362f73", "2af6ff6ef5ebba128b0774f4296cb4c2279a074658b083b8dcca91f57a603450" }, { 0, "a512_" @@ -29,17 +34,22 @@ static TestData test_data[] = { "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" "aaaaaaaa", + "6e5e1f37e99345887fc12111575fc1c3e36df4b289b8759d23af14d774b66bff", "2c90c3d39eb18ff291d33441b35f3262cdd307162cc97c31bfcc7a4245891a37" }, { 1, "", + "3c3da6925a3c3c268448dcabb47ccde5439559d9599646a8260e47b1e4822fc6", "09a6c8561a0b22bef63124c588ce4c62ea83a3c899763af26d795302e115dc21" }, { 1, "abc", + "608040b42285cc0d72cbb3985c6b04c935370c7361f4b7fbdb1ae7f8c1a8ecad", "1a8395b88338f22e435bbd301183e7f20a5f9de643f11882fb237f88268a5531" }, { 1, "abcdef0123456789", + "6d7fabf47a2dc03fe7d47f7dddd21082c5fb8f86743cd020f3fb147d57161472", "53060a3d140e7fbcda641ed3cf42c88a75411e648a1add71217f70ea8ec561a6" }, { 1, "q128_" "qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq" "qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq", + "5fb0b92acedd16f3bcb0ef83f5c7b7a9466b5f1e0d8d217421878ea3686f8524", "2eca15e355fcfa39d2982f67ddb0eea138e2994f5956ed37b7f72eea5e89d2f7" }, { 1, "a512_" @@ -51,6 +61,7 @@ static TestData test_data[] = { "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" "aaaaaaaa", + "0efcfde5898a839b00997fbe40d2ebe950bc81181afbd5cd6b9618aa336c1e8c", "6dc2fc04f266c5c27f236a80b14f92ccd051ef1ff027f26a07f8c0f327d8f995" } }; @@ -59,12 +70,16 @@ static TestData test_data[] = { int main(void) { + unsigned char *expected_xr, *expected_x; unsigned char *expected_yr, *expected_y, *y; + unsigned char expected_x_sign; char * expected_y_hex, *y_hex; char * oversized_ctx; size_t i, j; size_t oversized_ctx_len = 500U; + expected_xr = (unsigned char *) sodium_malloc(crypto_core_ed25519_BYTES); + expected_x = (unsigned char *) sodium_malloc(crypto_core_ed25519_BYTES); expected_yr = (unsigned char *) sodium_malloc(crypto_core_ed25519_BYTES); expected_y = (unsigned char *) sodium_malloc(crypto_core_ed25519_BYTES); y = (unsigned char *) sodium_malloc(crypto_core_ed25519_BYTES); @@ -72,6 +87,13 @@ main(void) (char *) sodium_malloc(crypto_core_ed25519_BYTES * 2U + 1U); y_hex = (char *) sodium_malloc(crypto_core_ed25519_BYTES * 2U + 1U); for (i = 0U; i < (sizeof test_data) / (sizeof test_data[0]); i++) { + sodium_hex2bin(expected_xr, crypto_core_ed25519_BYTES, + test_data[i].tv_x, (size_t) -1U, NULL, NULL, NULL); + for (j = 0; j < crypto_core_ed25519_BYTES; j++) { + expected_x[j] = expected_xr[crypto_core_ed25519_BYTES - 1U - j]; + } + expected_x_sign = expected_x[0] & 1; + sodium_hex2bin(expected_yr, crypto_core_ed25519_BYTES, test_data[i].tv_y, (size_t) -1U, NULL, NULL, NULL); for (j = 0; j < crypto_core_ed25519_BYTES; j++) { @@ -79,19 +101,26 @@ main(void) } if (test_data[i].ro == 0) { if (crypto_core_ed25519_from_string( - y, "QUUX-V01-CS02-with-edwards25519_XMD:SHA-512_ELL2_NU_", + y, + (const unsigned char *) "QUUX-V01-CS02-with-edwards25519_XMD:SHA-512_ELL2_NU_", + sizeof("QUUX-V01-CS02-with-edwards25519_XMD:SHA-512_ELL2_NU_") - 1U, (const unsigned char *) test_data[i].msg, strlen(test_data[i].msg), H2CHASH) != 0) { printf("crypto_core_ed25519_from_string() failed\n"); } } else { if (crypto_core_ed25519_from_string_ro( - y, "QUUX-V01-CS02-with-edwards25519_XMD:SHA-512_ELL2_RO_", + y, + (const unsigned char *) "QUUX-V01-CS02-with-edwards25519_XMD:SHA-512_ELL2_RO_", + sizeof("QUUX-V01-CS02-with-edwards25519_XMD:SHA-512_ELL2_RO_") - 1U, (const unsigned char *) test_data[i].msg, strlen(test_data[i].msg), H2CHASH) != 0) { printf("crypto_core_ed25519_from_string_ro() failed\n"); } } + if (((y[crypto_core_ed25519_BYTES - 1U] >> 7) & 1) != expected_x_sign) { + printf("Test #%u failed - x sign bit mismatch\n", (unsigned) i); + } y[crypto_core_ed25519_BYTES - 1U] &= 0x7f; if (memcmp(y, expected_y, crypto_core_ed25519_BYTES) != 0) { sodium_bin2hex(expected_y_hex, crypto_core_ed25519_BYTES * 2U + 1U, @@ -103,38 +132,41 @@ main(void) } } - if (crypto_core_ed25519_from_string(y, NULL, (const unsigned char *) "msg", + if (crypto_core_ed25519_from_string(y, NULL, 0U, (const unsigned char *) "msg", 3U, H2CHASH) != 0 || - crypto_core_ed25519_from_string(y, "", guard_page, 0U, H2CHASH) != 0 || + crypto_core_ed25519_from_string(y, (const unsigned char *) "", 0U, + guard_page, 0U, H2CHASH) != 0 || crypto_core_ed25519_from_string_ro( - y, NULL, (const unsigned char *) "msg", 3U, H2CHASH) != 0 || - crypto_core_ed25519_from_string_ro(y, "", guard_page, 0U, - H2CHASH) != 0) { + y, NULL, 0U, (const unsigned char *) "msg", 3U, H2CHASH) != 0 || + crypto_core_ed25519_from_string_ro(y, (const unsigned char *) "", 0U, + guard_page, 0U, H2CHASH) != 0) { printf("Failed with empty parameters"); } oversized_ctx = (char *) sodium_malloc(oversized_ctx_len); - memset(oversized_ctx, 'X', oversized_ctx_len - 1U); - oversized_ctx[oversized_ctx_len - 1U] = 0; - crypto_core_ed25519_from_string(y, oversized_ctx, + memset(oversized_ctx, 'X', oversized_ctx_len); + crypto_core_ed25519_from_string(y, (const unsigned char *) oversized_ctx, + oversized_ctx_len - 1U, (const unsigned char *) "msg", 3U, H2CHASH); sodium_bin2hex(y_hex, crypto_core_ed25519_BYTES * 2U + 1U, y, crypto_core_ed25519_BYTES); printf("NU with oversized context: %s\n", y_hex); - crypto_core_ed25519_from_string_ro(y, oversized_ctx, + crypto_core_ed25519_from_string_ro(y, (const unsigned char *) oversized_ctx, + oversized_ctx_len - 1U, (const unsigned char *) "msg", 3U, H2CHASH); sodium_bin2hex(y_hex, crypto_core_ed25519_BYTES * 2U + 1U, y, crypto_core_ed25519_BYTES); printf("RO with oversized context: %s\n", y_hex); - sodium_free(oversized_ctx); sodium_free(y_hex); sodium_free(expected_y_hex); sodium_free(y); sodium_free(expected_y); sodium_free(expected_yr); + sodium_free(expected_x); + sodium_free(expected_xr); printf("OK\n"); diff --git a/test/default/hash_sha3256.c b/test/default/hash_sha3256.c new file mode 100644 index 00000000..fef5660c --- /dev/null +++ b/test/default/hash_sha3256.c @@ -0,0 +1,131 @@ + +#define TEST_NAME "hash_sha3256" +#include "cmptest.h" + +int +main(void) +{ + static const unsigned char msg_abc[] = { 0x61, 0x62, 0x63 }; + + static const unsigned char msg_fox[] = { + 0x54, 0x68, 0x65, 0x20, 0x71, 0x75, 0x69, 0x63, 0x6b, 0x20, 0x62, 0x72, + 0x6f, 0x77, 0x6e, 0x20, 0x66, 0x6f, 0x78, 0x20, 0x6a, 0x75, 0x6d, 0x70, + 0x73, 0x20, 0x6f, 0x76, 0x65, 0x72, 0x20, 0x74, 0x68, 0x65, 0x20, 0x6c, + 0x61, 0x7a, 0x79, 0x20, 0x64, 0x6f, 0x67 + }; + + static const unsigned char out_empty[32] = { + 0xa7, 0xff, 0xc6, 0xf8, 0xbf, 0x1e, 0xd7, 0x66, 0x51, 0xc1, 0x47, 0x56, + 0xa0, 0x61, 0xd6, 0x62, 0xf5, 0x80, 0xff, 0x4d, 0xe4, 0x3b, 0x49, 0xfa, + 0x82, 0xd8, 0x0a, 0x4b, 0x80, 0xf8, 0x43, 0x4a + }; + + static const unsigned char out_abc[32] = { + 0x3a, 0x98, 0x5d, 0xa7, 0x4f, 0xe2, 0x25, 0xb2, 0x04, 0x5c, 0x17, 0x2d, + 0x6b, 0xd3, 0x90, 0xbd, 0x85, 0x5f, 0x08, 0x6e, 0x3e, 0x9d, 0x52, 0x5b, + 0x46, 0xbf, 0xe2, 0x45, 0x11, 0x43, 0x15, 0x32 + }; + + static const unsigned char out_fox[32] = { + 0x69, 0x07, 0x0d, 0xda, 0x01, 0x97, 0x5c, 0x8c, 0x12, 0x0c, 0x3a, 0xad, + 0xa1, 0xb2, 0x82, 0x39, 0x4e, 0x7f, 0x03, 0x2f, 0xa9, 0xcf, 0x32, 0xf4, + 0xcb, 0x22, 0x59, 0xa0, 0x89, 0x7d, 0xfc, 0x04 + }; + + unsigned char out[32]; + crypto_hash_sha3256_state state; + size_t i; + + assert(crypto_hash_sha3256_bytes() == 32); + assert(crypto_hash_sha3256_statebytes() > 0); + + crypto_hash_sha3256(out, NULL, 0); + assert(memcmp(out, out_empty, 32) == 0); + printf("SHA3-256(\"\") = "); + for (i = 0; i < 32; i++) { + printf("%02x", out[i]); + } + printf("\n"); + + crypto_hash_sha3256(out, msg_abc, 3); + assert(memcmp(out, out_abc, 32) == 0); + printf("SHA3-256(\"abc\") = "); + for (i = 0; i < 32; i++) { + printf("%02x", out[i]); + } + printf("\n"); + + crypto_hash_sha3256(out, msg_fox, 43); + assert(memcmp(out, out_fox, 32) == 0); + printf("SHA3-256(\"The quick brown fox...\") = "); + for (i = 0; i < 32; i++) { + printf("%02x", out[i]); + } + printf("\n"); + + crypto_hash_sha3256_init(&state); + crypto_hash_sha3256_update(&state, msg_abc, 3); + crypto_hash_sha3256_final(&state, out); + assert(memcmp(out, out_abc, 32) == 0); + printf("Streaming API test passed\n"); + + crypto_hash_sha3256_init(&state); + crypto_hash_sha3256_update(&state, msg_abc, 1); + crypto_hash_sha3256_update(&state, msg_abc + 1, 1); + crypto_hash_sha3256_update(&state, msg_abc + 2, 1); + crypto_hash_sha3256_final(&state, out); + assert(memcmp(out, out_abc, 32) == 0); + printf("Chunked update test passed\n"); + + { + unsigned char msg_rate[136]; + unsigned char out_rate[32]; + unsigned char out_rate_stream[32]; + + memset(msg_rate, 0xAB, sizeof msg_rate); + crypto_hash_sha3256(out_rate, msg_rate, sizeof msg_rate); + + crypto_hash_sha3256_init(&state); + crypto_hash_sha3256_update(&state, msg_rate, sizeof msg_rate); + crypto_hash_sha3256_final(&state, out_rate_stream); + + assert(memcmp(out_rate, out_rate_stream, 32) == 0); + printf("Rate boundary test passed\n"); + } + + { + unsigned char msg_rate_plus1[137]; + unsigned char out_rate_plus1[32]; + unsigned char out_rate_plus1_stream[32]; + + memset(msg_rate_plus1, 0xCD, sizeof msg_rate_plus1); + crypto_hash_sha3256(out_rate_plus1, msg_rate_plus1, sizeof msg_rate_plus1); + + crypto_hash_sha3256_init(&state); + crypto_hash_sha3256_update(&state, msg_rate_plus1, 100); + crypto_hash_sha3256_update(&state, msg_rate_plus1 + 100, 37); + crypto_hash_sha3256_final(&state, out_rate_plus1_stream); + + assert(memcmp(out_rate_plus1, out_rate_plus1_stream, 32) == 0); + printf("Rate+1 boundary test passed\n"); + } + + { + unsigned char msg_rate_minus1[135]; + unsigned char out1[32], out2[32]; + + memset(msg_rate_minus1, 0xEF, sizeof msg_rate_minus1); + crypto_hash_sha3256(out1, msg_rate_minus1, sizeof msg_rate_minus1); + + crypto_hash_sha3256_init(&state); + crypto_hash_sha3256_update(&state, msg_rate_minus1, sizeof msg_rate_minus1); + crypto_hash_sha3256_final(&state, out2); + + assert(memcmp(out1, out2, 32) == 0); + printf("Rate-1 boundary test passed\n"); + } + + printf("OK\n"); + + return 0; +} diff --git a/test/default/hash_sha3256.exp b/test/default/hash_sha3256.exp new file mode 100644 index 00000000..01031e7a --- /dev/null +++ b/test/default/hash_sha3256.exp @@ -0,0 +1,9 @@ +SHA3-256("") = a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a +SHA3-256("abc") = 3a985da74fe225b2045c172d6bd390bd855f086e3e9d525b46bfe24511431532 +SHA3-256("The quick brown fox...") = 69070dda01975c8c120c3aada1b282394e7f032fa9cf32f4cb2259a0897dfc04 +Streaming API test passed +Chunked update test passed +Rate boundary test passed +Rate+1 boundary test passed +Rate-1 boundary test passed +OK diff --git a/test/default/hash_sha3512.c b/test/default/hash_sha3512.c new file mode 100644 index 00000000..ae858cbd --- /dev/null +++ b/test/default/hash_sha3512.c @@ -0,0 +1,140 @@ + +#define TEST_NAME "hash_sha3512" +#include "cmptest.h" + +int +main(void) +{ + static const unsigned char msg_abc[] = { 0x61, 0x62, 0x63 }; + + static const unsigned char msg_fox[] = { + 0x54, 0x68, 0x65, 0x20, 0x71, 0x75, 0x69, 0x63, 0x6b, 0x20, 0x62, 0x72, + 0x6f, 0x77, 0x6e, 0x20, 0x66, 0x6f, 0x78, 0x20, 0x6a, 0x75, 0x6d, 0x70, + 0x73, 0x20, 0x6f, 0x76, 0x65, 0x72, 0x20, 0x74, 0x68, 0x65, 0x20, 0x6c, + 0x61, 0x7a, 0x79, 0x20, 0x64, 0x6f, 0x67 + }; + + static const unsigned char out_empty[64] = { + 0xa6, 0x9f, 0x73, 0xcc, 0xa2, 0x3a, 0x9a, 0xc5, 0xc8, 0xb5, 0x67, 0xdc, + 0x18, 0x5a, 0x75, 0x6e, 0x97, 0xc9, 0x82, 0x16, 0x4f, 0xe2, 0x58, 0x59, + 0xe0, 0xd1, 0xdc, 0xc1, 0x47, 0x5c, 0x80, 0xa6, 0x15, 0xb2, 0x12, 0x3a, + 0xf1, 0xf5, 0xf9, 0x4c, 0x11, 0xe3, 0xe9, 0x40, 0x2c, 0x3a, 0xc5, 0x58, + 0xf5, 0x00, 0x19, 0x9d, 0x95, 0xb6, 0xd3, 0xe3, 0x01, 0x75, 0x85, 0x86, + 0x28, 0x1d, 0xcd, 0x26 + }; + + static const unsigned char out_abc[64] = { + 0xb7, 0x51, 0x85, 0x0b, 0x1a, 0x57, 0x16, 0x8a, 0x56, 0x93, 0xcd, 0x92, + 0x4b, 0x6b, 0x09, 0x6e, 0x08, 0xf6, 0x21, 0x82, 0x74, 0x44, 0xf7, 0x0d, + 0x88, 0x4f, 0x5d, 0x02, 0x40, 0xd2, 0x71, 0x2e, 0x10, 0xe1, 0x16, 0xe9, + 0x19, 0x2a, 0xf3, 0xc9, 0x1a, 0x7e, 0xc5, 0x76, 0x47, 0xe3, 0x93, 0x40, + 0x57, 0x34, 0x0b, 0x4c, 0xf4, 0x08, 0xd5, 0xa5, 0x65, 0x92, 0xf8, 0x27, + 0x4e, 0xec, 0x53, 0xf0 + }; + + static const unsigned char out_fox[64] = { + 0x01, 0xde, 0xdd, 0x5d, 0xe4, 0xef, 0x14, 0x64, 0x24, 0x45, 0xba, 0x5f, + 0x5b, 0x97, 0xc1, 0x5e, 0x47, 0xb9, 0xad, 0x93, 0x13, 0x26, 0xe4, 0xb0, + 0x72, 0x7c, 0xd9, 0x4c, 0xef, 0xc4, 0x4f, 0xff, 0x23, 0xf0, 0x7b, 0xf5, + 0x43, 0x13, 0x99, 0x39, 0xb4, 0x91, 0x28, 0xca, 0xf4, 0x36, 0xdc, 0x1b, + 0xde, 0xe5, 0x4f, 0xcb, 0x24, 0x02, 0x3a, 0x08, 0xd9, 0x40, 0x3f, 0x9b, + 0x4b, 0xf0, 0xd4, 0x50 + }; + + unsigned char out[64]; + crypto_hash_sha3512_state state; + size_t i; + + assert(crypto_hash_sha3512_bytes() == 64); + assert(crypto_hash_sha3512_statebytes() > 0); + + crypto_hash_sha3512(out, NULL, 0); + assert(memcmp(out, out_empty, 64) == 0); + printf("SHA3-512(\"\") = "); + for (i = 0; i < 64; i++) { + printf("%02x", out[i]); + } + printf("\n"); + + crypto_hash_sha3512(out, msg_abc, 3); + assert(memcmp(out, out_abc, 64) == 0); + printf("SHA3-512(\"abc\") = "); + for (i = 0; i < 64; i++) { + printf("%02x", out[i]); + } + printf("\n"); + + crypto_hash_sha3512(out, msg_fox, 43); + assert(memcmp(out, out_fox, 64) == 0); + printf("SHA3-512(\"The quick brown fox...\") = "); + for (i = 0; i < 64; i++) { + printf("%02x", out[i]); + } + printf("\n"); + + crypto_hash_sha3512_init(&state); + crypto_hash_sha3512_update(&state, msg_abc, 3); + crypto_hash_sha3512_final(&state, out); + assert(memcmp(out, out_abc, 64) == 0); + printf("Streaming API test passed\n"); + + crypto_hash_sha3512_init(&state); + crypto_hash_sha3512_update(&state, msg_abc, 1); + crypto_hash_sha3512_update(&state, msg_abc + 1, 1); + crypto_hash_sha3512_update(&state, msg_abc + 2, 1); + crypto_hash_sha3512_final(&state, out); + assert(memcmp(out, out_abc, 64) == 0); + printf("Chunked update test passed\n"); + + { + unsigned char msg_rate[72]; + unsigned char out_rate[64]; + unsigned char out_rate_stream[64]; + + memset(msg_rate, 0xAB, sizeof msg_rate); + crypto_hash_sha3512(out_rate, msg_rate, sizeof msg_rate); + + crypto_hash_sha3512_init(&state); + crypto_hash_sha3512_update(&state, msg_rate, sizeof msg_rate); + crypto_hash_sha3512_final(&state, out_rate_stream); + + assert(memcmp(out_rate, out_rate_stream, 64) == 0); + printf("Rate boundary test passed\n"); + } + + { + unsigned char msg_rate_plus1[73]; + unsigned char out_rate_plus1[64]; + unsigned char out_rate_plus1_stream[64]; + + memset(msg_rate_plus1, 0xCD, sizeof msg_rate_plus1); + crypto_hash_sha3512(out_rate_plus1, msg_rate_plus1, sizeof msg_rate_plus1); + + crypto_hash_sha3512_init(&state); + crypto_hash_sha3512_update(&state, msg_rate_plus1, 50); + crypto_hash_sha3512_update(&state, msg_rate_plus1 + 50, 23); + crypto_hash_sha3512_final(&state, out_rate_plus1_stream); + + assert(memcmp(out_rate_plus1, out_rate_plus1_stream, 64) == 0); + printf("Rate+1 boundary test passed\n"); + } + + { + unsigned char msg_rate_minus1[71]; + unsigned char out1[64], out2[64]; + + memset(msg_rate_minus1, 0xEF, sizeof msg_rate_minus1); + crypto_hash_sha3512(out1, msg_rate_minus1, sizeof msg_rate_minus1); + + crypto_hash_sha3512_init(&state); + crypto_hash_sha3512_update(&state, msg_rate_minus1, sizeof msg_rate_minus1); + crypto_hash_sha3512_final(&state, out2); + + assert(memcmp(out1, out2, 64) == 0); + printf("Rate-1 boundary test passed\n"); + } + + printf("OK\n"); + + return 0; +} diff --git a/test/default/hash_sha3512.exp b/test/default/hash_sha3512.exp new file mode 100644 index 00000000..c19eb9d3 --- /dev/null +++ b/test/default/hash_sha3512.exp @@ -0,0 +1,9 @@ +SHA3-512("") = a69f73cca23a9ac5c8b567dc185a756e97c982164fe25859e0d1dcc1475c80a615b2123af1f5f94c11e3e9402c3ac558f500199d95b6d3e301758586281dcd26 +SHA3-512("abc") = b751850b1a57168a5693cd924b6b096e08f621827444f70d884f5d0240d2712e10e116e9192af3c91a7ec57647e3934057340b4cf408d5a56592f8274eec53f0 +SHA3-512("The quick brown fox...") = 01dedd5de4ef14642445ba5f5b97c15e47b9ad931326e4b0727cd94cefc44fff23f07bf543139939b49128caf436dc1bdee54fcb24023a08d9403f9b4bf0d450 +Streaming API test passed +Chunked update test passed +Rate boundary test passed +Rate+1 boundary test passed +Rate-1 boundary test passed +OK diff --git a/test/default/ipcrypt.c b/test/default/ipcrypt.c index f072b77a..49108c8d 100644 --- a/test/default/ipcrypt.c +++ b/test/default/ipcrypt.c @@ -58,6 +58,7 @@ int main(void) { unsigned char key[crypto_ipcrypt_KEYBYTES]; + unsigned char nd_key[crypto_ipcrypt_ND_KEYBYTES]; unsigned char ndx_key[crypto_ipcrypt_NDX_KEYBYTES]; unsigned char pfx_key[crypto_ipcrypt_PFX_KEYBYTES]; unsigned char input[crypto_ipcrypt_BYTES]; @@ -632,6 +633,7 @@ main(void) printf("\nfunctional tests\n"); crypto_ipcrypt_keygen(key); + crypto_ipcrypt_nd_keygen(nd_key); crypto_ipcrypt_ndx_keygen(ndx_key); crypto_ipcrypt_pfx_keygen(pfx_key); printf("OK: Key generation functions\n"); diff --git a/test/default/kem.c b/test/default/kem.c new file mode 100644 index 00000000..79a55eac --- /dev/null +++ b/test/default/kem.c @@ -0,0 +1,70 @@ +#define TEST_NAME "kem" +#include "cmptest.h" + +static void +tv_kem(void) +{ + unsigned char *pk; + unsigned char *sk; + unsigned char *seed; + unsigned char *ct; + unsigned char *ss_enc; + unsigned char *ss_dec; + int i; + + pk = (unsigned char *) sodium_malloc(crypto_kem_PUBLICKEYBYTES); + sk = (unsigned char *) sodium_malloc(crypto_kem_SECRETKEYBYTES); + seed = (unsigned char *) sodium_malloc(crypto_kem_SEEDBYTES); + ct = (unsigned char *) sodium_malloc(crypto_kem_CIPHERTEXTBYTES); + ss_enc = (unsigned char *) sodium_malloc(crypto_kem_SHAREDSECRETBYTES); + ss_dec = (unsigned char *) sodium_malloc(crypto_kem_SHAREDSECRETBYTES); + + printf("primitive: %s\n", crypto_kem_primitive()); + + assert(crypto_kem_publickeybytes() == crypto_kem_PUBLICKEYBYTES); + assert(crypto_kem_secretkeybytes() == crypto_kem_SECRETKEYBYTES); + assert(crypto_kem_ciphertextbytes() == crypto_kem_CIPHERTEXTBYTES); + assert(crypto_kem_sharedsecretbytes() == crypto_kem_SHAREDSECRETBYTES); + assert(crypto_kem_seedbytes() == crypto_kem_SEEDBYTES); + + printf("constants: ok\n"); + + for (i = 0; i < (int) crypto_kem_SEEDBYTES; i++) { + seed[i] = (unsigned char) i; + } + crypto_kem_seed_keypair(pk, sk, seed); + + assert(crypto_kem_enc(ct, ss_enc, pk) == 0); + assert(crypto_kem_dec(ss_dec, ct, sk) == 0); + + if (memcmp(ss_enc, ss_dec, crypto_kem_SHAREDSECRETBYTES) != 0) { + printf("ERROR: shared secrets don't match!\n"); + } else { + printf("shared secrets match: ok\n"); + } + + crypto_kem_keypair(pk, sk); + assert(crypto_kem_enc(ct, ss_enc, pk) == 0); + assert(crypto_kem_dec(ss_dec, ct, sk) == 0); + + if (memcmp(ss_enc, ss_dec, crypto_kem_SHAREDSECRETBYTES) != 0) { + printf("ERROR: shared secrets don't match (random keys)!\n"); + } else { + printf("random keypair test: ok\n"); + } + + sodium_free(ss_dec); + sodium_free(ss_enc); + sodium_free(ct); + sodium_free(seed); + sodium_free(sk); + sodium_free(pk); +} + +int +main(void) +{ + tv_kem(); + + return 0; +} diff --git a/test/default/kem.exp b/test/default/kem.exp new file mode 100644 index 00000000..b2d52334 --- /dev/null +++ b/test/default/kem.exp @@ -0,0 +1,4 @@ +primitive: xwing +constants: ok +shared secrets match: ok +random keypair test: ok diff --git a/test/default/kem_xwing.c b/test/default/kem_xwing.c new file mode 100644 index 00000000..c008c97e --- /dev/null +++ b/test/default/kem_xwing.c @@ -0,0 +1,217 @@ +#define TEST_NAME "kem_xwing" +#include "cmptest.h" + +static const char tv0_seed[] = + "0000000000000000000000000000000000000000000000000000000000000000"; +static const char tv0_randomness[] = + "6464646464646464646464646464646464646464646464646464646464646464" + "6464646464646464646464646464646464646464646464646464646464646464"; +static const char tv0_ek_prefix[] = + "3d209f716752f6408e7f89bceef97ac388530045377927644ef046c0a7cae978"; +static const char tv0_ct_prefix[] = + "d81018a94f8078e02105beaa814e003390befa4589bb614f7739"; +static const char tv0_ss[] = + "e5ba94031ea6efd69c09c254f6d9783136ba6037e2d4c43bcccf19d6f3f4343a"; + +static const char tv1_seed[] = + "0101010101010101010101010101010101010101010101010101010101010101"; +static const char tv1_randomness[] = + "6565656565656565656565656565656565656565656565656565656565656565" + "6565656565656565656565656565656565656565656565656565656565656565"; +static const char tv1_ek_prefix[] = + "ec7b50cddc8360f98b189bac73d395ef947b37d8453886a253269f7b18b9eb78"; +static const char tv1_ct_prefix[] = + "600ecf4026683898d0e339eeea9ebd437a4a802952bf32bfa326"; +static const char tv1_ss[] = + "750300db25bff9620e893c2c6fcab9bf04d7f2e543b5b39420485626fa274908"; + +static const char tv2_seed[] = + "0202020202020202020202020202020202020202020202020202020202020202"; +static const char tv2_randomness[] = + "6666666666666666666666666666666666666666666666666666666666666666" + "6666666666666666666666666666666666666666666666666666666666666666"; +static const char tv2_ek_prefix[] = + "08118d8819772292c976ec971ee3039195800c823544484595cc63450b9db941"; +static const char tv2_ct_prefix[] = + "413c55d5710bae6376761dada807daffd4dc45f9f70d825e0d46"; +static const char tv2_ss[] = + "87292f18b2e7af74bb8839ddee15e832d2f4bfac14dc84f824906d951436aafa"; + +static int +test_kat_vector(const char *seed_hex, const char *randomness_hex, + const char *ek_prefix_hex, const char *ct_prefix_hex, + const char *ss_hex) +{ + unsigned char seed[crypto_kem_xwing_SEEDBYTES]; + unsigned char pk[crypto_kem_xwing_PUBLICKEYBYTES]; + unsigned char sk[crypto_kem_xwing_SECRETKEYBYTES]; + unsigned char randomness[64]; + unsigned char ct[crypto_kem_xwing_CIPHERTEXTBYTES]; + unsigned char ss_enc[crypto_kem_xwing_SHAREDSECRETBYTES]; + unsigned char ss_dec[crypto_kem_xwing_SHAREDSECRETBYTES]; + unsigned char expected_ek_prefix[32]; + unsigned char expected_ct_prefix[26]; + unsigned char expected_ss[32]; + char hex[65]; + + sodium_hex2bin(seed, sizeof seed, seed_hex, strlen(seed_hex), NULL, NULL, NULL); + sodium_hex2bin(randomness, sizeof randomness, randomness_hex, strlen(randomness_hex), + NULL, NULL, NULL); + sodium_hex2bin(expected_ek_prefix, sizeof expected_ek_prefix, ek_prefix_hex, + strlen(ek_prefix_hex), NULL, NULL, NULL); + sodium_hex2bin(expected_ct_prefix, sizeof expected_ct_prefix, ct_prefix_hex, + strlen(ct_prefix_hex), NULL, NULL, NULL); + sodium_hex2bin(expected_ss, sizeof expected_ss, ss_hex, strlen(ss_hex), NULL, NULL, NULL); + + crypto_kem_xwing_seed_keypair(pk, sk, seed); + + if (memcmp(pk, expected_ek_prefix, 32) != 0) { + sodium_bin2hex(hex, sizeof hex, pk, 32); + printf("pk mismatch: got %s\n", hex); + return -1; + } + + assert(crypto_kem_xwing_enc_deterministic(ct, ss_enc, pk, randomness) == 0); + + if (memcmp(ct, expected_ct_prefix, 26) != 0) { + sodium_bin2hex(hex, sizeof hex, ct, 26); + printf("ct mismatch: got %s\n", hex); + return -1; + } + + if (memcmp(ss_enc, expected_ss, 32) != 0) { + sodium_bin2hex(hex, sizeof hex, ss_enc, 32); + printf("ss_enc mismatch: got %s\n", hex); + return -1; + } + + assert(crypto_kem_xwing_dec(ss_dec, ct, sk) == 0); + + if (memcmp(ss_dec, expected_ss, 32) != 0) { + sodium_bin2hex(hex, sizeof hex, ss_dec, 32); + printf("ss_dec mismatch: got %s\n", hex); + return -1; + } + + return 0; +} + +static void +tv_kem_xwing(void) +{ + unsigned char *pk; + unsigned char *sk; + unsigned char *seed; + unsigned char *ct; + unsigned char *ss_enc; + unsigned char *ss_dec; + unsigned char *randomness; + char hex[65]; + int i; + + pk = (unsigned char *) sodium_malloc(crypto_kem_xwing_PUBLICKEYBYTES); + sk = (unsigned char *) sodium_malloc(crypto_kem_xwing_SECRETKEYBYTES); + seed = (unsigned char *) sodium_malloc(crypto_kem_xwing_SEEDBYTES); + ct = (unsigned char *) sodium_malloc(crypto_kem_xwing_CIPHERTEXTBYTES); + ss_enc = (unsigned char *) sodium_malloc(crypto_kem_xwing_SHAREDSECRETBYTES); + ss_dec = (unsigned char *) sodium_malloc(crypto_kem_xwing_SHAREDSECRETBYTES); + randomness = (unsigned char *) sodium_malloc(64); + + for (i = 0; i < (int) crypto_kem_xwing_SEEDBYTES; i++) { + seed[i] = (unsigned char) i; + } + crypto_kem_xwing_seed_keypair(pk, sk, seed); + + sodium_bin2hex(hex, sizeof hex, pk, 32); + printf("pk (first 32 bytes): [%s]\n", hex); + sodium_bin2hex(hex, sizeof hex, sk, 32); + printf("sk: [%s]\n", hex); + + for (i = 0; i < 64; i++) { + randomness[i] = (unsigned char)(i + 64); + } + assert(crypto_kem_xwing_enc_deterministic(ct, ss_enc, pk, randomness) == 0); + + sodium_bin2hex(hex, sizeof hex, ct, 32); + printf("ct (first 32 bytes): [%s]\n", hex); + sodium_bin2hex(hex, sizeof hex, ss_enc, crypto_kem_xwing_SHAREDSECRETBYTES); + printf("ss_enc: [%s]\n", hex); + + assert(crypto_kem_xwing_dec(ss_dec, ct, sk) == 0); + + sodium_bin2hex(hex, sizeof hex, ss_dec, crypto_kem_xwing_SHAREDSECRETBYTES); + printf("ss_dec: [%s]\n", hex); + + if (memcmp(ss_enc, ss_dec, crypto_kem_xwing_SHAREDSECRETBYTES) != 0) { + printf("ERROR: shared secrets don't match!\n"); + } else { + printf("shared secrets match: ok\n"); + } + + crypto_kem_xwing_keypair(pk, sk); + assert(crypto_kem_xwing_enc(ct, ss_enc, pk) == 0); + assert(crypto_kem_xwing_dec(ss_dec, ct, sk) == 0); + if (memcmp(ss_enc, ss_dec, crypto_kem_xwing_SHAREDSECRETBYTES) != 0) { + printf("ERROR: shared secrets don't match (random keys)!\n"); + } else { + printf("random keypair test: ok\n"); + } + + assert(crypto_kem_xwing_publickeybytes() == crypto_kem_xwing_PUBLICKEYBYTES); + assert(crypto_kem_xwing_secretkeybytes() == crypto_kem_xwing_SECRETKEYBYTES); + assert(crypto_kem_xwing_ciphertextbytes() == crypto_kem_xwing_CIPHERTEXTBYTES); + assert(crypto_kem_xwing_sharedsecretbytes() == crypto_kem_xwing_SHAREDSECRETBYTES); + assert(crypto_kem_xwing_seedbytes() == crypto_kem_xwing_SEEDBYTES); + + assert(crypto_kem_xwing_PUBLICKEYBYTES == 1216U); + assert(crypto_kem_xwing_SECRETKEYBYTES == 32U); + assert(crypto_kem_xwing_CIPHERTEXTBYTES == 1120U); + assert(crypto_kem_xwing_SHAREDSECRETBYTES == 32U); + assert(crypto_kem_xwing_SEEDBYTES == 32U); + + printf("constants: ok\n"); + + sodium_free(randomness); + sodium_free(ss_dec); + sodium_free(ss_enc); + sodium_free(ct); + sodium_free(seed); + sodium_free(sk); + sodium_free(pk); + + printf("tv_kem_xwing: ok\n"); +} + +static void +tv_kem_xwing_kat(void) +{ + printf("IETF KAT vector 0: "); + if (test_kat_vector(tv0_seed, tv0_randomness, tv0_ek_prefix, tv0_ct_prefix, tv0_ss) == 0) { + printf("ok\n"); + } else { + printf("FAILED\n"); + } + + printf("IETF KAT vector 1: "); + if (test_kat_vector(tv1_seed, tv1_randomness, tv1_ek_prefix, tv1_ct_prefix, tv1_ss) == 0) { + printf("ok\n"); + } else { + printf("FAILED\n"); + } + + printf("IETF KAT vector 2: "); + if (test_kat_vector(tv2_seed, tv2_randomness, tv2_ek_prefix, tv2_ct_prefix, tv2_ss) == 0) { + printf("ok\n"); + } else { + printf("FAILED\n"); + } +} + +int +main(void) +{ + tv_kem_xwing(); + tv_kem_xwing_kat(); + + return 0; +} diff --git a/test/default/kem_xwing.exp b/test/default/kem_xwing.exp new file mode 100644 index 00000000..0f74c945 --- /dev/null +++ b/test/default/kem_xwing.exp @@ -0,0 +1,12 @@ +pk (first 32 bytes): [6f54098a0a0e641146614b6960ba60d8603d62f447f9ab499b47bd6906cc40b0] +sk: [000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f] +ct (first 32 bytes): [332c248ecac774a5b9e28b7018565b7e07b57733b8e68a432084b39b9221e497] +ss_enc: [f285b028f4de617b6adf9eccbd811327848dd44ac7078c15390b16682576ad8c] +ss_dec: [f285b028f4de617b6adf9eccbd811327848dd44ac7078c15390b16682576ad8c] +shared secrets match: ok +random keypair test: ok +constants: ok +tv_kem_xwing: ok +IETF KAT vector 0: ok +IETF KAT vector 1: ok +IETF KAT vector 2: ok diff --git a/test/symbols/all-symbols.txt b/test/symbols/all-symbols.txt index cea505aa..8d1b7a2c 100644 --- a/test/symbols/all-symbols.txt +++ b/test/symbols/all-symbols.txt @@ -2,10 +2,7 @@ argon2_ctx argon2_decode_string argon2_encode_string argon2_fill_memory_blocks -argon2_fill_segment_avx2 -argon2_fill_segment_avx512f argon2_fill_segment_ref -argon2_fill_segment_ssse3 argon2_finalize argon2_hash argon2_initialize @@ -18,10 +15,7 @@ argon2id_hash_encoded argon2id_hash_raw argon2id_verify blake2b -blake2b_compress_avx2 blake2b_compress_ref -blake2b_compress_sse41 -blake2b_compress_ssse3 blake2b_final blake2b_init blake2b_init_key @@ -38,7 +32,6 @@ crypto_aead_aegis128l_decrypt crypto_aead_aegis128l_decrypt_detached crypto_aead_aegis128l_encrypt crypto_aead_aegis128l_encrypt_detached -crypto_aead_aegis128l_is_available crypto_aead_aegis128l_keybytes crypto_aead_aegis128l_keygen crypto_aead_aegis128l_messagebytes_max @@ -49,7 +42,6 @@ crypto_aead_aegis256_decrypt crypto_aead_aegis256_decrypt_detached crypto_aead_aegis256_encrypt crypto_aead_aegis256_encrypt_detached -crypto_aead_aegis256_is_available crypto_aead_aegis256_keybytes crypto_aead_aegis256_keygen crypto_aead_aegis256_messagebytes_max @@ -204,7 +196,6 @@ crypto_core_ed25519_add crypto_core_ed25519_bytes crypto_core_ed25519_from_string crypto_core_ed25519_from_string_ro -crypto_core_ed25519_from_uniform crypto_core_ed25519_hashbytes crypto_core_ed25519_is_valid_point crypto_core_ed25519_nonreducedscalarbytes @@ -311,6 +302,18 @@ crypto_hash_sha256_final crypto_hash_sha256_init crypto_hash_sha256_statebytes crypto_hash_sha256_update +crypto_hash_sha3256 +crypto_hash_sha3256_bytes +crypto_hash_sha3256_final +crypto_hash_sha3256_init +crypto_hash_sha3256_statebytes +crypto_hash_sha3256_update +crypto_hash_sha3512 +crypto_hash_sha3512_bytes +crypto_hash_sha3512_final +crypto_hash_sha3512_init +crypto_hash_sha3512_statebytes +crypto_hash_sha3512_update crypto_hash_sha512 crypto_hash_sha512_bytes crypto_hash_sha512_final @@ -326,6 +329,7 @@ crypto_ipcrypt_nd_decrypt crypto_ipcrypt_nd_encrypt crypto_ipcrypt_nd_inputbytes crypto_ipcrypt_nd_keybytes +crypto_ipcrypt_nd_keygen crypto_ipcrypt_nd_outputbytes crypto_ipcrypt_nd_tweakbytes crypto_ipcrypt_ndx_decrypt @@ -382,6 +386,16 @@ crypto_kem_mlkem768_secretkeybytes crypto_kem_mlkem768_seed_keypair crypto_kem_mlkem768_seedbytes crypto_kem_mlkem768_sharedsecretbytes +crypto_kem_xwing_ciphertextbytes +crypto_kem_xwing_dec +crypto_kem_xwing_enc +crypto_kem_xwing_enc_deterministic +crypto_kem_xwing_keypair +crypto_kem_xwing_publickeybytes +crypto_kem_xwing_secretkeybytes +crypto_kem_xwing_seed_keypair +crypto_kem_xwing_seedbytes +crypto_kem_xwing_sharedsecretbytes crypto_kx_client_session_keys crypto_kx_keypair crypto_kx_primitive @@ -502,13 +516,10 @@ crypto_pwhash_strbytes crypto_pwhash_strprefix crypto_scalarmult crypto_scalarmult_base -crypto_scalarmult_base_noclamp crypto_scalarmult_bytes crypto_scalarmult_curve25519 crypto_scalarmult_curve25519_base -crypto_scalarmult_curve25519_base_noclamp crypto_scalarmult_curve25519_bytes -crypto_scalarmult_curve25519_noclamp crypto_scalarmult_curve25519_scalarbytes crypto_scalarmult_ed25519 crypto_scalarmult_ed25519_base @@ -516,7 +527,6 @@ crypto_scalarmult_ed25519_base_noclamp crypto_scalarmult_ed25519_bytes crypto_scalarmult_ed25519_noclamp crypto_scalarmult_ed25519_scalarbytes -crypto_scalarmult_noclamp crypto_scalarmult_primitive crypto_scalarmult_ristretto255 crypto_scalarmult_ristretto255_base @@ -585,7 +595,6 @@ crypto_sign_bytes crypto_sign_detached crypto_sign_ed25519 crypto_sign_ed25519_bytes -crypto_sign_ed25519_contextbytes_max crypto_sign_ed25519_detached crypto_sign_ed25519_keypair crypto_sign_ed25519_messagebytes_max @@ -600,8 +609,6 @@ crypto_sign_ed25519_sk_to_pk crypto_sign_ed25519_sk_to_seed crypto_sign_ed25519_verify_detached crypto_sign_ed25519ph_final_create -crypto_sign_ed25519ph_final_ctx_create -crypto_sign_ed25519ph_final_ctx_verify crypto_sign_ed25519ph_final_verify crypto_sign_ed25519ph_init crypto_sign_ed25519ph_statebytes @@ -721,7 +728,6 @@ escrypt_free_region escrypt_gensalt_r escrypt_init_local escrypt_kdf_nosse -escrypt_kdf_sse escrypt_parse_setting escrypt_r fe25519_frombytes @@ -746,6 +752,11 @@ ge25519_p3_tobytes ge25519_scalarmult ge25519_scalarmult_base ge25519_tobytes +keccak1600_armsha3_extract_bytes +keccak1600_armsha3_init +keccak1600_armsha3_permute_12 +keccak1600_armsha3_permute_24 +keccak1600_armsha3_xor_bytes keccak1600_ref_extract_bytes keccak1600_ref_init keccak1600_ref_permute_12 @@ -825,14 +836,8 @@ sodium_runtime_has_sse2 sodium_runtime_has_sse3 sodium_runtime_has_sse41 sodium_runtime_has_ssse3 -sodium_scalarmult_curve25519_sandy2x_fe51_mul -sodium_scalarmult_curve25519_sandy2x_fe51_nsquare -sodium_scalarmult_curve25519_sandy2x_fe51_pack -sodium_scalarmult_curve25519_sandy2x_ladder sodium_set_misuse_handler sodium_stackzero -sodium_stream_salsa20_xmm6 -sodium_stream_salsa20_xmm6_xor_ic sodium_sub sodium_unpad sodium_version_string