Merge branch 'master' of github.com:jedisct1/libsodium

* 'master' of github.com:jedisct1/libsodium: (46 commits)
  Update ChangeLog
  apple-xcframework: move headers into a Clibsodium subdirectory
  Change crypto_core_ed25519_from_string to take a binary string
  Add hardware acceleration for SHA256 on aarch64
  core_ed25519_h2c.c test: verify y coordinate as well
  Add NEON optimizations for Argon2
  Add WASM SIMD implementations of Argon2
  Emscripten: add an option to compile with SIMD
  Just use sodium_memcmp
  Add a high-level crypto_kem API mapping to xwing
  Add X-Wing
  Add back symbols for Intel implementations
  Cleanup symbols
  Remove SHA3 wrapper
  ml-kem: remove internal SHA3 implememtation
  Add new symbols
  Add support for SHA3
  JavaScript: faster randomness generation
  Compatibility with gcc 4.x
  Set emscripten reserved memory to 80MB
  ...

.github/ISSUE_TEMPLATE/bugs.md

@@ -1,23 +1,34 @@
 ---
-name: "\U0001F41E Issues"
-about: Bug reports
+name: "\U0001F41E Bug report"
+about: Report a bug in libsodium
 title: ""
 labels: ""
 assignees: ""
 ---
 
-THE TRACKER IS DEDICATED TO KEEPING TRACK OF _BUGS_,
-preferably after they have been already discussed and confirmed to be reproducible.
+Thanks for taking the time to report a bug!
 
-FOR ASSISTANCE, PLEASE CLOSE THIS FORM AND USE THE DISCUSSIONS SECTION INSTEAD:
-https://github.com/jedisct1/libsodium/discussions
+This tracker is for confirmed, reproducible bugs. If you're looking for help with installation, configuration, usage, or issues with third-party packages, the [Discussions](https://github.com/jedisct1/libsodium/discussions) section is a better place to start.
 
-Installation, configuration, usage guidance and issues in 3rd party packages are not bugs, but individual assistance requests.
+### Before you file
 
-If the bug is not trivial to reproduce on any platform, please include ALL the steps required to reliably duplicate it, on a vanilla, generic install of macOS, Windows, OpenBSD or Ubuntu Linux system, in their most current version.
+- Try reproducing the issue with the current `libsodium-stable` package, installed as documented at https://doc.libsodium.org/installation
+- If the bug isn't obvious, please describe all the steps needed to reproduce it on a fresh install of macOS, Windows, OpenBSD, or Ubuntu Linux
 
-Try to reproduce it using the current `libsodium-stable` package, installed as documented in https://doc.libsodium.org/installation .
+### Not sure if it's a bug?
 
-If you don't have any clear understanding of the issue or can't enumerate the steps to reproduce it, open a discussion instead: https://github.com/jedisct1/libsodium/discussions
+No worries! Feel free to [start a discussion](https://github.com/jedisct1/libsodium/discussions) first and we can figure it out together.
 
-Thank you! 😊🙏
+---
+
+### How do we replicate the issue?
+
+(Describe the steps to reproduce the bug)
+
+### Expected behavior
+
+(What did you expect to happen?)
+
+### Actual behavior
+
+(What actually happened?)

.github/ISSUE_TEMPLATE/suggestions.md

@@ -1,22 +1,19 @@
 ---
 name: "🙋🏽 Planned changes"
-about: List of planned changes
+about: Track planned changes (maintainers only)
 title: ""
 labels: ""
 assignees: ""
 ---
 
-Please do not post features requests directly.
+Hey there! Got an idea for libsodium?
 
-The starting point should be a discussion, after having checked the roadmap: https://doc.libsodium.org/roadmap
+This template is for tracking work that's already been planned. For new feature suggestions, here's the best path forward:
 
-Suggestions should be raised as an "Ideas" discussion: https://github.com/jedisct1/libsodium/discussions
+1. Check the [roadmap](https://doc.libsodium.org/roadmap) to see if it's already on our radar
+2. Start an "Ideas" thread in [Discussions](https://github.com/jedisct1/libsodium/discussions)
 
-We can then determine if the discussion needs to be escalated into a "planned change" or not.
-
-This will help us ensure that the issue tracker properly reflects ongoing or needed work on the project.
-
-Thank you! 😊🙏
+From there, we can chat about it and decide together if it should become a planned change. This helps keep the issue tracker focused on active work.
 
 ---
 

.github/workflows/ci.yml

@@ -12,7 +12,7 @@ jobs:
   tcc:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Update packages list
         run: sudo apt-get update
@@ -35,7 +35,7 @@ jobs:
   zig:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Update packages list
         run: sudo apt-get update
@@ -67,7 +67,7 @@ jobs:
   regular:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Update packages list
         run: sudo apt-get update
@@ -96,7 +96,7 @@ jobs:
   check-globals:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Update packages list
         run: sudo apt-get update
@@ -114,7 +114,7 @@ jobs:
   other-comp:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Update packages list
         run: sudo apt-get update
@@ -140,7 +140,7 @@ jobs:
   other-arch:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Update packages list
         run: sudo apt-get update
@@ -187,10 +187,73 @@ jobs:
           done
           exit $failed
 
+  aarch64-gcc:
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Update packages list
+        run: sudo apt-get update
+
+      - name: Install dependencies
+        run: sudo apt-get install -y build-essential libtool autoconf automake
+
+      - name: Autogen
+        run: ./autogen.sh -s
+
+      - name: Compilation with GCC on aarch64
+        run: |
+          env CPPFLAGS="-DDEV_MODE=1" ./configure --disable-dependency-tracking
+          make -j $(nproc)
+          make check
+          make distclean > /dev/null
+
+  aarch64-gcc-crypto:
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Update packages list
+        run: sudo apt-get update
+
+      - name: Install dependencies
+        run: sudo apt-get install -y build-essential libtool autoconf automake
+
+      - name: Autogen
+        run: ./autogen.sh -s
+
+      - name: Compilation with GCC on aarch64 with NEON and ARM Crypto extensions
+        run: |
+          env CFLAGS="-march=armv8-a+crypto" CPPFLAGS="-DDEV_MODE=1" ./configure --disable-dependency-tracking
+          make -j $(nproc)
+          make check
+          make distclean > /dev/null
+
+  aarch64-gcc-sha3:
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Update packages list
+        run: sudo apt-get update
+
+      - name: Install dependencies
+        run: sudo apt-get install -y build-essential libtool autoconf automake
+
+      - name: Autogen
+        run: ./autogen.sh -s
+
+      - name: Compilation with GCC on aarch64 with NEON, ARM Crypto, and SHA3 extensions
+        run: |
+          env CFLAGS="-march=armv8-a+crypto+sha3" CPPFLAGS="-DDEV_MODE=1" ./configure --disable-dependency-tracking
+          make -j $(nproc)
+          make check
+          make distclean > /dev/null
+
   android:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Update packages list
         run: sudo apt-get update

.github/workflows/codeql-analysis.yml

@@ -26,13 +26,13 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         fetch-depth: 2
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v4
       with:
         languages: ${{ matrix.language }}
 
@@ -43,6 +43,6 @@ jobs:
         make -j $(nproc) check
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v4
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/dotnet-core.yml

@@ -15,7 +15,7 @@ jobs:
   build-windows-msvc:
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: buildbase.bat
         run: buildbase.bat ..\vs2022\libsodium.sln 17
         working-directory: builds/msvc/build/
@@ -40,7 +40,7 @@ jobs:
         uses: mlugg/setup-zig@v2
         with:
           version: master
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Build Android AAR
         run: sh ./dist-build/android-aar.sh
@@ -147,7 +147,7 @@ jobs:
   build-apple:
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: configure
         run: ./configure
       - name: build-xcframework
@@ -181,7 +181,7 @@ jobs:
       DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 1
       DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: 1
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: actions/download-artifact@v4
         with:
           name: build-win-x64
@@ -272,7 +272,7 @@ jobs:
           path: .libsodium-pack/bin/Release/*.nupkg
 
       - name: Attest Build Provenance
-        uses: actions/attest-build-provenance@897ed5eab6ed058a474202017ada7f40bfa52940
+        uses: actions/attest-build-provenance@v3
         with:
          subject-path: .libsodium-pack/bin/Release/*.nupkg
 
@@ -287,7 +287,7 @@ jobs:
       DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 1
       DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: 1
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: actions/download-artifact@v4
         with:
           name: nuget-package

.gitignore

@@ -109,6 +109,7 @@ test/default/chacha20
 test/default/codecs
 test/default/core_ed25519
 test/default/core_ed25519_h2c
+test/default/core_keccak1600
 test/default/core_ristretto255
 test/default/core1
 test/default/core2
@@ -122,13 +123,17 @@ test/default/generichash2
 test/default/generichash3
 test/default/hash
 test/default/hash3
+test/default/hash_sha3256
+test/default/hash_sha3512
 test/default/ipcrypt
 test/default/kdf
 test/default/kdf_hkdf
 test/default/keygen
+test/default/kem
+test/default/kem_mlkem768
+test/default/kem_xwing
 test/default/kx
 test/default/metamorphic
-test/default/kem_mlkem768
 test/default/misuse
 test/default/onetimeauth
 test/default/onetimeauth2
@@ -168,6 +173,10 @@ test/default/stream3
 test/default/stream4
 test/default/verify1
 test/default/xchacha20
+test/default/xof_shake128
+test/default/xof_shake256
+test/default/xof_turboshake128
+test/default/xof_turboshake256
 test/js.done
 test/symbols/all-host-symbols.txt
 test/symbols/internal-host-symbols.txt

ChangeLog

@@ -1,3 +1,12 @@
+* Version 1.0.21-stable
+ - Performance: SHA3 (Keccak1600) now leverages ARM SHA3 instructions when
+available on ARM platforms.
+ - Performance: Argon2 has an optimized implementation for arch64 and
+webassembly/SIMD.
+ - Export missing crypto_ipcrypt_nd_keygen() helper function.
+ - Fixed compilation with GCC on aarch64 and gcc 4.1
+ - Libsodium can be directly used as a dependency in a Zig project.
+
 * Version 1.0.21
   This point release includes all the changes from 1.0.20-stable, which
 include a security fix for the `crypto_core_ed25519_is_valid_point()`
@@ -15,6 +24,8 @@ for a wide range of applications, including key derivation, session encryption
 and more.
 
 * Version 1.0.20-stable
+ - XCFramework: cross-compilation is now forced on Apple Silicon to
+avoid Rosetta-related build issues
  - The Fil-C compiler is supported out of the box
  - The CompCert compiler is supported out of the box
  - MSVC 2026 (Visual Studio 2026) is now supported
@@ -51,6 +62,11 @@ compatibility with older runtimes
 fixed
  - `crypto_aead_aes256gcm_is_available` is exported to JavaScript
  - libsodium is now compatible with Emscripten 4.x
+ - Security: memory fences have been added after MAC verification in
+AEAD to prevent speculative access to plaintext before authentication
+is complete
+ - Assembly files now include .gnu.property notes for proper IBT and
+Shadow Stack support when building with CET instrumentation
 
 * Version 1.0.20
   This point release includes all the changes from 1.0.19-stable,

THANKS

@@ -32,6 +32,7 @@ Alexander Morris (@alexpmorris)
 Amit Murthy (@amitmurthy)
 Andrew Bennett (@potatosalad)
 Andrew Lambert (@charonn0)
+Brad Barden (@IAMB)
 Bruce Mitchener (@waywardmonkeys)
 Bruno Oliveira (@abstractj)
 Caolan McMahon (@caolan)

appveyor.yml

@@ -1,4 +1,4 @@
-version: 1.0.22.{build}
+version: 1.0.23.{build}
 
 os: Visual Studio 2022
 

azure-pipelines.yml

@@ -45,8 +45,11 @@ jobs:
 
   - job: "windows_2019"
     pool:
-      vmImage: "windows-2019"
+      vmImage: "windows-2022"
     steps:
+      - powershell: |
+          choco install visualstudio2019buildtools --package-parameters "--add Microsoft.VisualStudio.Workload.VCTools --includeRecommended --quiet --wait" -y
+        displayName: Install VS2019 Build Tools
       - powershell: |
           cd builds\msvc\build
           & .\buildbase.bat ..\vs2019\libsodium.sln 16
@@ -64,10 +67,10 @@ jobs:
 
   - job: mingw64
     pool:
-      vmImage: "windows-2019"
+      vmImage: "windows-2022"
     steps:
       - powershell: |
-          (New-Object Net.WebClient).DownloadFile("https://github.com/msys2/msys2-installer/releases/download/2025-08-30/msys2-base-x86_64-20250830.sfx.exe", "sfx.exe")
+          (New-Object Net.WebClient).DownloadFile("https://github.com/msys2/msys2-installer/releases/download/2025-12-13/msys2-base-x86_64-20251213.sfx.exe", "sfx.exe")
           .\sfx.exe -y -o\
           del sfx.exe
         displayName: Install MSYS2
@@ -103,10 +106,10 @@ jobs:
 
   - job: mingw32
     pool:
-      vmImage: "windows-2019"
+      vmImage: "windows-2022"
     steps:
       - powershell: |
-          (New-Object Net.WebClient).DownloadFile("https://github.com/msys2/msys2-installer/releases/download/2025-08-30/msys2-base-x86_64-20250830.sfx.exe", "sfx.exe")
+          (New-Object Net.WebClient).DownloadFile("https://github.com/msys2/msys2-installer/releases/download/2025-12-13/msys2-base-x86_64-20251213.sfx.exe", "sfx.exe")
           .\sfx.exe -y -o\
           del sfx.exe
         displayName: Install MSYS2

build.zig

@@ -1,12 +1,15 @@
 const std = @import("std");
 const fmt = std.fmt;
-const Io = std.Io;
-const Dir = Io.Dir;
 const heap = std.heap;
 const mem = std.mem;
 const Compile = std.Build.Step.Compile;
 const Target = std.Target;
 
+// Zig 0.16+ uses std.Io.Dir, 0.15 uses std.fs
+const is_zig_16 = @hasDecl(std, "Io") and @hasDecl(std.Io, "Dir");
+const Dir = if (is_zig_16) std.Io.Dir else std.fs.Dir;
+const Io = if (is_zig_16) std.Io else void;
+
 fn initLibConfig(b: *std.Build, target: std.Build.ResolvedTarget, lib: *Compile) void {
     lib.root_module.link_libc = true;
     lib.lto = null;
@@ -166,15 +169,17 @@ fn initLibConfig(b: *std.Build, target: std.Build.ResolvedTarget, lib: *Compile)
 }
 
 pub fn build(b: *std.Build) !void {
-    var threaded: Io.Threaded = .init_single_threaded;
-    const io = threaded.io();
-
+    const io: Io = if (is_zig_16) b.graph.io else {};
     const root_path = b.pathFromRoot(".");
-    var cwd = try Dir.openDirAbsolute(io, root_path, .{});
-    defer cwd.close(io);
+    const cwd = try if (is_zig_16) Dir.cwd().openDir(io, root_path, .{}) else std.fs.cwd().openDir(root_path, .{});
 
     const src_path = "src/libsodium";
-    const src_dir = try cwd.openDir(io, src_path, .{ .iterate = true });
+    const src_dir = if (is_zig_16)
+        try cwd.openDir(io, src_path, .{ .iterate = true })
+    else if (@hasField(Dir.OpenOptions, "follow_symlinks"))
+        try cwd.openDir(src_path, .{ .iterate = true, .follow_symlinks = false })
+    else
+        try cwd.openDir(src_path, .{ .iterate = true, .no_follow = true });
 
     var target = b.standardTargetOptions(.{});
     const optimize = b.standardOptimizeOption(.{});
@@ -235,9 +240,19 @@ pub fn build(b: *std.Build) !void {
     const prebuilt_version_file_path = "builds/msvc/version.h";
     const version_file_path = "include/sodium/version.h";
 
-    src_dir.access(io, version_file_path, .{ .read = true }) catch {
-        try Dir.copyFile(cwd, prebuilt_version_file_path, src_dir, version_file_path, io, .{});
-    };
+    if (is_zig_16) {
+        src_dir.access(io, version_file_path, .{}) catch {
+            try Dir.copyFile(cwd, prebuilt_version_file_path, src_dir, version_file_path, io, .{});
+        };
+    } else if (@hasField(Dir.OpenOptions, "follow_symlinks")) {
+        src_dir.access(version_file_path, .{ .read = true }) catch {
+            try cwd.copyFile(prebuilt_version_file_path, src_dir, version_file_path, .{});
+        };
+    } else {
+        src_dir.access(version_file_path, .{ .mode = .read_only }) catch {
+            try cwd.copyFile(prebuilt_version_file_path, src_dir, version_file_path, .{});
+        };
+    }
 
     for (libs.items) |lib| {
         b.installArtifact(lib);
@@ -258,7 +273,7 @@ pub fn build(b: *std.Build) !void {
         const allocator = heap.page_allocator;
 
         var walker = try src_dir.walk(allocator);
-        while (try walker.next(io)) |entry| {
+        while (if (is_zig_16) try walker.next(io) else try walker.next()) |entry| {
             const name = entry.basename;
             if (mem.endsWith(u8, name, ".c")) {
                 const full_path = try fmt.allocPrint(allocator, "{s}/{s}", .{ src_path, entry.path });
@@ -276,20 +291,43 @@ pub fn build(b: *std.Build) !void {
 
     const test_path = "test/default";
     const out_bin_path = "zig-out/bin";
-    const test_dir = try cwd.openDir(io, test_path, .{ .iterate = true });
-    cwd.createDirPath(io, out_bin_path) catch {};
-    const out_bin_dir = try cwd.openDir(io, out_bin_path, .{});
-    try Dir.copyFile(test_dir, "run.sh", out_bin_dir, "run.sh", io, .{});
+    const test_dir = if (is_zig_16)
+        try cwd.openDir(io, test_path, .{ .iterate = true })
+    else if (@hasField(Dir.OpenOptions, "follow_symlinks"))
+        try cwd.openDir(test_path, .{ .iterate = true, .follow_symlinks = false })
+    else
+        try cwd.openDir(test_path, .{ .iterate = true, .no_follow = true });
+
+    if (is_zig_16) {
+        cwd.createDirPath(io, out_bin_path) catch {};
+    } else {
+        cwd.makePath(out_bin_path) catch {};
+    }
+    const out_bin_dir = if (is_zig_16)
+        try cwd.openDir(io, out_bin_path, .{})
+    else
+        try cwd.openDir(out_bin_path, .{});
+
+    if (is_zig_16) {
+        try Dir.copyFile(test_dir, "run.sh", out_bin_dir, "run.sh", io, .{});
+    } else {
+        try test_dir.copyFile("run.sh", out_bin_dir, "run.sh", .{});
+    }
+
     const allocator = heap.page_allocator;
     var walker = try test_dir.walk(allocator);
 
     const test_step = b.step("test", "Run all libsodium tests");
 
     if (build_tests) {
-        while (try walker.next(io)) |entry| {
+        while (if (is_zig_16) try walker.next(io) else try walker.next()) |entry| {
             const name = entry.basename;
             if (mem.endsWith(u8, name, ".exp")) {
-                try Dir.copyFile(test_dir, name, out_bin_dir, name, io, .{});
+                if (is_zig_16) {
+                    try Dir.copyFile(test_dir, name, out_bin_dir, name, io, .{});
+                } else {
+                    try test_dir.copyFile(name, out_bin_dir, name, .{});
+                }
                 continue;
             }
             if (!mem.endsWith(u8, name, ".c")) {

builds/msvc/resource.rc

@@ -4,8 +4,8 @@
 #include "windows.h"
 
 //specify the version numbers for the dll's
-#define LIBSODIUM_VERSION_STRING "1.0.22.0"
-#define LIBSODIUM_VERSION_BIN 1,0,22,0
+#define LIBSODIUM_VERSION_STRING "1.0.23.0"
+#define LIBSODIUM_VERSION_BIN 1,0,23,0
 
 //specify the product name for the dlls based on the platform we are compiling for
 #if defined(x64)

builds/msvc/version.h

@@ -4,7 +4,7 @@
 
 #include "export.h"
 
-#define SODIUM_VERSION_STRING "1.0.22"
+#define SODIUM_VERSION_STRING "1.0.23"
 
 #define SODIUM_LIBRARY_VERSION_MAJOR 30
 #define SODIUM_LIBRARY_VERSION_MINOR 0

builds/msvc/vs2010/libsodium/libsodium.vcxproj

@@ -88,11 +88,13 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_secretbox\xchacha20poly1305\secretbox_xchacha20poly1305.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\crypto_pwhash.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blake2b-long.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-wasm32.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-core.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-avx512f.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-ref.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-ssse3.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2i.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-neon.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2id.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-avx2.c" />
@@ -174,6 +176,7 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\crypto_hash.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha512\hash_sha512.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha512\cp\hash_sha512_cp.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha3\hash_sha3.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha256\hash_sha256.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha256\cp\hash_sha256_cp.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\xchacha20poly1305\aead_xchacha20poly1305.c" />
@@ -189,9 +192,14 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\aes256gcm\aesni\aead_aes256gcm_aesni.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\aes256gcm\armcrypto\aead_aes256gcm_armcrypto.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\chacha20poly1305\aead_chacha20poly1305.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\crypto_kem.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\xwing\kem_xwing.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\kem_mlkem768.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_secretstream\xchacha20poly1305\secretstream_xchacha20poly1305.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\keccak1600.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\salsa\ref\core_salsa_ref.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\hchacha20\core_hchacha20.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\hsalsa20\core_hsalsa20.c" />
@@ -219,7 +227,6 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_aead_aegis256.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash_sha512.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\core.h" />
-    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\version.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\export.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_salsa20.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_shorthash_siphash24.h" />
@@ -231,6 +238,7 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_aead_xchacha20poly1305.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_stream_salsa20.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_onetimeauth_poly1305.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_mlkem768.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_scalarmult_ristretto255.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kx.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash.h" />
@@ -253,6 +261,7 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_aead_aes256gcm.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_salsa2012.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_secretbox_xchacha20poly1305.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_keccak1600.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_scalarmult.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash.h" />
@@ -268,6 +277,8 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash_argon2id.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_secretstream_xchacha20poly1305.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash_scryptsalsa208sha256.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash_sha3.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_xwing.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_sign_ed25519.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_onetimeauth.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_verify_64.h" />
@@ -296,6 +307,8 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\private\implementations.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-ref.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-avx2.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-neon.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-wasm32.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-ssse3.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-encoding.h" />
@@ -355,7 +368,9 @@
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\implementations.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\aegis256_armcrypto.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\aegis256_soft.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\core_h2c.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\ref10\fe_25_5\constants.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\ref10\fe_25_5\fe.h" />

builds/msvc/vs2010/libsodium/libsodium.vcxproj.filters

@@ -84,6 +84,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blake2b-long.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-wasm32.c">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-core.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
@@ -99,6 +102,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2i.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-neon.c">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2id.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
@@ -342,6 +348,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha512\cp\hash_sha512_cp.c">
       <Filter>crypto_hash\sha512\cp</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha3\hash_sha3.c">
+      <Filter>crypto_hash\sha3</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha256\hash_sha256.c">
       <Filter>crypto_hash\sha256</Filter>
     </ClCompile>
@@ -387,6 +396,18 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\chacha20poly1305\aead_chacha20poly1305.c">
       <Filter>crypto_aead\chacha20poly1305</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\crypto_kem.c">
+      <Filter>crypto_kem</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\xwing\kem_xwing.c">
+      <Filter>crypto_kem\xwing</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\kem_mlkem768.c">
+      <Filter>crypto_kem\mlkem768</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.c">
+      <Filter>crypto_kem\mlkem768\ref</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_secretstream\xchacha20poly1305\secretstream_xchacha20poly1305.c">
       <Filter>crypto_secretstream\xchacha20poly1305</Filter>
     </ClCompile>
@@ -396,6 +417,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.c">
       <Filter>crypto_core\keccak1600\ref</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.c">
+      <Filter>crypto_core\keccak1600\armsha3</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\salsa\ref\core_salsa_ref.c">
       <Filter>crypto_core\salsa\ref</Filter>
     </ClCompile>
@@ -473,9 +497,6 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\core.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
-    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\version.h">
-      <Filter>include\sodium</Filter>
-    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\export.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -509,6 +530,9 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_onetimeauth_poly1305.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_mlkem768.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_scalarmult_ristretto255.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -575,6 +599,9 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_secretbox_xchacha20poly1305.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_keccak1600.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -620,6 +647,12 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash_scryptsalsa208sha256.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash_sha3.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_xwing.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_sign_ed25519.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -704,6 +737,12 @@
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-avx2.h">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-neon.h">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-wasm32.h">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2.h">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClInclude>
@@ -881,9 +920,15 @@
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\aegis256_soft.h">
       <Filter>crypto_aead\aegis256</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.h">
+      <Filter>crypto_kem\mlkem768\ref</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.h">
       <Filter>crypto_core\keccak1600\ref</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.h">
+      <Filter>crypto_core\keccak1600\armsha3</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\core_h2c.h">
       <Filter>crypto_core\ed25519</Filter>
     </ClInclude>
@@ -985,6 +1030,9 @@
     <Filter Include="crypto_core\keccak1600">
       <UniqueIdentifier>{85c1722f-2d65-30a8-aefb-ebf1cbfe185e}</UniqueIdentifier>
     </Filter>
+    <Filter Include="crypto_core\keccak1600\armsha3">
+      <UniqueIdentifier>{855cc78f-1fe0-3ad2-a2ac-5e2b0c01c235}</UniqueIdentifier>
+    </Filter>
     <Filter Include="crypto_core\keccak1600\ref">
       <UniqueIdentifier>{9462f285-fee0-3779-983b-2811dc621f7d}</UniqueIdentifier>
     </Filter>
@@ -1015,6 +1063,9 @@
     <Filter Include="crypto_hash\sha256\cp">
       <UniqueIdentifier>{8c7d8b62-7b4f-3eb9-85b7-18e8d925be14}</UniqueIdentifier>
     </Filter>
+    <Filter Include="crypto_hash\sha3">
+      <UniqueIdentifier>{6df763e3-9707-3014-8cfe-2f9a8a83a872}</UniqueIdentifier>
+    </Filter>
     <Filter Include="crypto_hash\sha512">
       <UniqueIdentifier>{8fb6a906-dbd6-3746-9b0f-f49e7028daec}</UniqueIdentifier>
     </Filter>
@@ -1033,6 +1084,18 @@
     <Filter Include="crypto_kdf\hkdf">
       <UniqueIdentifier>{baf7d894-9298-391d-8dc2-e4c3010f5ddc}</UniqueIdentifier>
     </Filter>
+    <Filter Include="crypto_kem">
+      <UniqueIdentifier>{b9009d4a-dd97-341d-aafb-eeeb77191a49}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="crypto_kem\mlkem768">
+      <UniqueIdentifier>{ab0c8a55-3e1f-307e-82be-8291a3b43735}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="crypto_kem\mlkem768\ref">
+      <UniqueIdentifier>{70a10765-f8fb-3898-8514-966e48719bc4}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="crypto_kem\xwing">
+      <UniqueIdentifier>{2ef7c851-6598-3be5-88be-9ac5ec867cb0}</UniqueIdentifier>
+    </Filter>
     <Filter Include="crypto_kx">
       <UniqueIdentifier>{898b6bd5-1360-3a34-adcd-0fade7561685}</UniqueIdentifier>
     </Filter>

builds/msvc/vs2012/libsodium/libsodium.vcxproj

@@ -88,11 +88,13 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_secretbox\xchacha20poly1305\secretbox_xchacha20poly1305.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\crypto_pwhash.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blake2b-long.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-wasm32.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-core.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-avx512f.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-ref.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-ssse3.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2i.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-neon.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2id.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-avx2.c" />
@@ -174,6 +176,7 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\crypto_hash.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha512\hash_sha512.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha512\cp\hash_sha512_cp.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha3\hash_sha3.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha256\hash_sha256.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha256\cp\hash_sha256_cp.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\xchacha20poly1305\aead_xchacha20poly1305.c" />
@@ -189,9 +192,14 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\aes256gcm\aesni\aead_aes256gcm_aesni.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\aes256gcm\armcrypto\aead_aes256gcm_armcrypto.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\chacha20poly1305\aead_chacha20poly1305.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\crypto_kem.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\xwing\kem_xwing.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\kem_mlkem768.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_secretstream\xchacha20poly1305\secretstream_xchacha20poly1305.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\keccak1600.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\salsa\ref\core_salsa_ref.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\hchacha20\core_hchacha20.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\hsalsa20\core_hsalsa20.c" />
@@ -219,7 +227,6 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_aead_aegis256.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash_sha512.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\core.h" />
-    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\version.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\export.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_salsa20.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_shorthash_siphash24.h" />
@@ -231,6 +238,7 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_aead_xchacha20poly1305.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_stream_salsa20.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_onetimeauth_poly1305.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_mlkem768.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_scalarmult_ristretto255.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kx.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash.h" />
@@ -253,6 +261,7 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_aead_aes256gcm.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_salsa2012.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_secretbox_xchacha20poly1305.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_keccak1600.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_scalarmult.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash.h" />
@@ -268,6 +277,8 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash_argon2id.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_secretstream_xchacha20poly1305.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash_scryptsalsa208sha256.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash_sha3.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_xwing.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_sign_ed25519.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_onetimeauth.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_verify_64.h" />
@@ -296,6 +307,8 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\private\implementations.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-ref.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-avx2.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-neon.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-wasm32.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-ssse3.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-encoding.h" />
@@ -355,7 +368,9 @@
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\implementations.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\aegis256_armcrypto.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\aegis256_soft.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\core_h2c.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\ref10\fe_25_5\constants.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\ref10\fe_25_5\fe.h" />

builds/msvc/vs2012/libsodium/libsodium.vcxproj.filters

@@ -84,6 +84,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blake2b-long.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-wasm32.c">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-core.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
@@ -99,6 +102,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2i.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-neon.c">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2id.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
@@ -342,6 +348,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha512\cp\hash_sha512_cp.c">
       <Filter>crypto_hash\sha512\cp</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha3\hash_sha3.c">
+      <Filter>crypto_hash\sha3</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha256\hash_sha256.c">
       <Filter>crypto_hash\sha256</Filter>
     </ClCompile>
@@ -387,6 +396,18 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\chacha20poly1305\aead_chacha20poly1305.c">
       <Filter>crypto_aead\chacha20poly1305</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\crypto_kem.c">
+      <Filter>crypto_kem</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\xwing\kem_xwing.c">
+      <Filter>crypto_kem\xwing</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\kem_mlkem768.c">
+      <Filter>crypto_kem\mlkem768</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.c">
+      <Filter>crypto_kem\mlkem768\ref</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_secretstream\xchacha20poly1305\secretstream_xchacha20poly1305.c">
       <Filter>crypto_secretstream\xchacha20poly1305</Filter>
     </ClCompile>
@@ -396,6 +417,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.c">
       <Filter>crypto_core\keccak1600\ref</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.c">
+      <Filter>crypto_core\keccak1600\armsha3</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\salsa\ref\core_salsa_ref.c">
       <Filter>crypto_core\salsa\ref</Filter>
     </ClCompile>
@@ -473,9 +497,6 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\core.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
-    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\version.h">
-      <Filter>include\sodium</Filter>
-    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\export.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -509,6 +530,9 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_onetimeauth_poly1305.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_mlkem768.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_scalarmult_ristretto255.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -575,6 +599,9 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_secretbox_xchacha20poly1305.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_keccak1600.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -620,6 +647,12 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash_scryptsalsa208sha256.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash_sha3.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_xwing.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_sign_ed25519.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -704,6 +737,12 @@
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-avx2.h">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-neon.h">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-wasm32.h">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2.h">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClInclude>
@@ -881,9 +920,15 @@
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\aegis256_soft.h">
       <Filter>crypto_aead\aegis256</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.h">
+      <Filter>crypto_kem\mlkem768\ref</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.h">
       <Filter>crypto_core\keccak1600\ref</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.h">
+      <Filter>crypto_core\keccak1600\armsha3</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\core_h2c.h">
       <Filter>crypto_core\ed25519</Filter>
     </ClInclude>
@@ -985,6 +1030,9 @@
     <Filter Include="crypto_core\keccak1600">
       <UniqueIdentifier>{85c1722f-2d65-30a8-aefb-ebf1cbfe185e}</UniqueIdentifier>
     </Filter>
+    <Filter Include="crypto_core\keccak1600\armsha3">
+      <UniqueIdentifier>{855cc78f-1fe0-3ad2-a2ac-5e2b0c01c235}</UniqueIdentifier>
+    </Filter>
     <Filter Include="crypto_core\keccak1600\ref">
       <UniqueIdentifier>{9462f285-fee0-3779-983b-2811dc621f7d}</UniqueIdentifier>
     </Filter>
@@ -1015,6 +1063,9 @@
     <Filter Include="crypto_hash\sha256\cp">
       <UniqueIdentifier>{8c7d8b62-7b4f-3eb9-85b7-18e8d925be14}</UniqueIdentifier>
     </Filter>
+    <Filter Include="crypto_hash\sha3">
+      <UniqueIdentifier>{6df763e3-9707-3014-8cfe-2f9a8a83a872}</UniqueIdentifier>
+    </Filter>
     <Filter Include="crypto_hash\sha512">
       <UniqueIdentifier>{8fb6a906-dbd6-3746-9b0f-f49e7028daec}</UniqueIdentifier>
     </Filter>
@@ -1033,6 +1084,18 @@
     <Filter Include="crypto_kdf\hkdf">
       <UniqueIdentifier>{baf7d894-9298-391d-8dc2-e4c3010f5ddc}</UniqueIdentifier>
     </Filter>
+    <Filter Include="crypto_kem">
+      <UniqueIdentifier>{b9009d4a-dd97-341d-aafb-eeeb77191a49}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="crypto_kem\mlkem768">
+      <UniqueIdentifier>{ab0c8a55-3e1f-307e-82be-8291a3b43735}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="crypto_kem\mlkem768\ref">
+      <UniqueIdentifier>{70a10765-f8fb-3898-8514-966e48719bc4}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="crypto_kem\xwing">
+      <UniqueIdentifier>{2ef7c851-6598-3be5-88be-9ac5ec867cb0}</UniqueIdentifier>
+    </Filter>
     <Filter Include="crypto_kx">
       <UniqueIdentifier>{898b6bd5-1360-3a34-adcd-0fade7561685}</UniqueIdentifier>
     </Filter>

builds/msvc/vs2013/libsodium/libsodium.vcxproj

@@ -88,11 +88,13 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_secretbox\xchacha20poly1305\secretbox_xchacha20poly1305.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\crypto_pwhash.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blake2b-long.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-wasm32.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-core.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-avx512f.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-ref.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-ssse3.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2i.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-neon.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2id.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-avx2.c" />
@@ -174,6 +176,7 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\crypto_hash.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha512\hash_sha512.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha512\cp\hash_sha512_cp.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha3\hash_sha3.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha256\hash_sha256.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha256\cp\hash_sha256_cp.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\xchacha20poly1305\aead_xchacha20poly1305.c" />
@@ -189,9 +192,14 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\aes256gcm\aesni\aead_aes256gcm_aesni.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\aes256gcm\armcrypto\aead_aes256gcm_armcrypto.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\chacha20poly1305\aead_chacha20poly1305.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\crypto_kem.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\xwing\kem_xwing.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\kem_mlkem768.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_secretstream\xchacha20poly1305\secretstream_xchacha20poly1305.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\keccak1600.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\salsa\ref\core_salsa_ref.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\hchacha20\core_hchacha20.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\hsalsa20\core_hsalsa20.c" />
@@ -219,7 +227,6 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_aead_aegis256.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash_sha512.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\core.h" />
-    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\version.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\export.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_salsa20.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_shorthash_siphash24.h" />
@@ -231,6 +238,7 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_aead_xchacha20poly1305.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_stream_salsa20.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_onetimeauth_poly1305.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_mlkem768.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_scalarmult_ristretto255.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kx.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash.h" />
@@ -253,6 +261,7 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_aead_aes256gcm.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_salsa2012.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_secretbox_xchacha20poly1305.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_keccak1600.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_scalarmult.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash.h" />
@@ -268,6 +277,8 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash_argon2id.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_secretstream_xchacha20poly1305.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash_scryptsalsa208sha256.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash_sha3.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_xwing.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_sign_ed25519.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_onetimeauth.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_verify_64.h" />
@@ -296,6 +307,8 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\private\implementations.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-ref.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-avx2.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-neon.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-wasm32.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-ssse3.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-encoding.h" />
@@ -355,7 +368,9 @@
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\implementations.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\aegis256_armcrypto.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\aegis256_soft.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\core_h2c.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\ref10\fe_25_5\constants.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\ref10\fe_25_5\fe.h" />

builds/msvc/vs2013/libsodium/libsodium.vcxproj.filters

@@ -84,6 +84,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blake2b-long.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-wasm32.c">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-core.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
@@ -99,6 +102,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2i.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-neon.c">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2id.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
@@ -342,6 +348,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha512\cp\hash_sha512_cp.c">
       <Filter>crypto_hash\sha512\cp</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha3\hash_sha3.c">
+      <Filter>crypto_hash\sha3</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha256\hash_sha256.c">
       <Filter>crypto_hash\sha256</Filter>
     </ClCompile>
@@ -387,6 +396,18 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\chacha20poly1305\aead_chacha20poly1305.c">
       <Filter>crypto_aead\chacha20poly1305</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\crypto_kem.c">
+      <Filter>crypto_kem</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\xwing\kem_xwing.c">
+      <Filter>crypto_kem\xwing</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\kem_mlkem768.c">
+      <Filter>crypto_kem\mlkem768</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.c">
+      <Filter>crypto_kem\mlkem768\ref</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_secretstream\xchacha20poly1305\secretstream_xchacha20poly1305.c">
       <Filter>crypto_secretstream\xchacha20poly1305</Filter>
     </ClCompile>
@@ -396,6 +417,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.c">
       <Filter>crypto_core\keccak1600\ref</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.c">
+      <Filter>crypto_core\keccak1600\armsha3</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\salsa\ref\core_salsa_ref.c">
       <Filter>crypto_core\salsa\ref</Filter>
     </ClCompile>
@@ -473,9 +497,6 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\core.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
-    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\version.h">
-      <Filter>include\sodium</Filter>
-    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\export.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -509,6 +530,9 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_onetimeauth_poly1305.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_mlkem768.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_scalarmult_ristretto255.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -575,6 +599,9 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_secretbox_xchacha20poly1305.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_keccak1600.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -620,6 +647,12 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash_scryptsalsa208sha256.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash_sha3.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_xwing.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_sign_ed25519.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -704,6 +737,12 @@
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-avx2.h">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-neon.h">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-wasm32.h">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2.h">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClInclude>
@@ -881,9 +920,15 @@
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\aegis256_soft.h">
       <Filter>crypto_aead\aegis256</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.h">
+      <Filter>crypto_kem\mlkem768\ref</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.h">
       <Filter>crypto_core\keccak1600\ref</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.h">
+      <Filter>crypto_core\keccak1600\armsha3</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\core_h2c.h">
       <Filter>crypto_core\ed25519</Filter>
     </ClInclude>
@@ -985,6 +1030,9 @@
     <Filter Include="crypto_core\keccak1600">
       <UniqueIdentifier>{85c1722f-2d65-30a8-aefb-ebf1cbfe185e}</UniqueIdentifier>
     </Filter>
+    <Filter Include="crypto_core\keccak1600\armsha3">
+      <UniqueIdentifier>{855cc78f-1fe0-3ad2-a2ac-5e2b0c01c235}</UniqueIdentifier>
+    </Filter>
     <Filter Include="crypto_core\keccak1600\ref">
       <UniqueIdentifier>{9462f285-fee0-3779-983b-2811dc621f7d}</UniqueIdentifier>
     </Filter>
@@ -1015,6 +1063,9 @@
     <Filter Include="crypto_hash\sha256\cp">
       <UniqueIdentifier>{8c7d8b62-7b4f-3eb9-85b7-18e8d925be14}</UniqueIdentifier>
     </Filter>
+    <Filter Include="crypto_hash\sha3">
+      <UniqueIdentifier>{6df763e3-9707-3014-8cfe-2f9a8a83a872}</UniqueIdentifier>
+    </Filter>
     <Filter Include="crypto_hash\sha512">
       <UniqueIdentifier>{8fb6a906-dbd6-3746-9b0f-f49e7028daec}</UniqueIdentifier>
     </Filter>
@@ -1033,6 +1084,18 @@
     <Filter Include="crypto_kdf\hkdf">
       <UniqueIdentifier>{baf7d894-9298-391d-8dc2-e4c3010f5ddc}</UniqueIdentifier>
     </Filter>
+    <Filter Include="crypto_kem">
+      <UniqueIdentifier>{b9009d4a-dd97-341d-aafb-eeeb77191a49}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="crypto_kem\mlkem768">
+      <UniqueIdentifier>{ab0c8a55-3e1f-307e-82be-8291a3b43735}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="crypto_kem\mlkem768\ref">
+      <UniqueIdentifier>{70a10765-f8fb-3898-8514-966e48719bc4}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="crypto_kem\xwing">
+      <UniqueIdentifier>{2ef7c851-6598-3be5-88be-9ac5ec867cb0}</UniqueIdentifier>
+    </Filter>
     <Filter Include="crypto_kx">
       <UniqueIdentifier>{898b6bd5-1360-3a34-adcd-0fade7561685}</UniqueIdentifier>
     </Filter>

builds/msvc/vs2015/libsodium/libsodium.vcxproj

@@ -88,11 +88,13 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_secretbox\xchacha20poly1305\secretbox_xchacha20poly1305.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\crypto_pwhash.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blake2b-long.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-wasm32.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-core.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-avx512f.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-ref.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-ssse3.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2i.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-neon.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2id.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-avx2.c" />
@@ -174,6 +176,7 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\crypto_hash.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha512\hash_sha512.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha512\cp\hash_sha512_cp.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha3\hash_sha3.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha256\hash_sha256.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha256\cp\hash_sha256_cp.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\xchacha20poly1305\aead_xchacha20poly1305.c" />
@@ -189,9 +192,14 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\aes256gcm\aesni\aead_aes256gcm_aesni.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\aes256gcm\armcrypto\aead_aes256gcm_armcrypto.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\chacha20poly1305\aead_chacha20poly1305.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\crypto_kem.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\xwing\kem_xwing.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\kem_mlkem768.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_secretstream\xchacha20poly1305\secretstream_xchacha20poly1305.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\keccak1600.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\salsa\ref\core_salsa_ref.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\hchacha20\core_hchacha20.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\hsalsa20\core_hsalsa20.c" />
@@ -219,7 +227,6 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_aead_aegis256.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash_sha512.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\core.h" />
-    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\version.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\export.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_salsa20.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_shorthash_siphash24.h" />
@@ -231,6 +238,7 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_aead_xchacha20poly1305.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_stream_salsa20.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_onetimeauth_poly1305.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_mlkem768.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_scalarmult_ristretto255.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kx.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash.h" />
@@ -253,6 +261,7 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_aead_aes256gcm.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_salsa2012.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_secretbox_xchacha20poly1305.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_keccak1600.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_scalarmult.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash.h" />
@@ -268,6 +277,8 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash_argon2id.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_secretstream_xchacha20poly1305.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash_scryptsalsa208sha256.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash_sha3.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_xwing.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_sign_ed25519.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_onetimeauth.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_verify_64.h" />
@@ -296,6 +307,8 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\private\implementations.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-ref.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-avx2.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-neon.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-wasm32.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-ssse3.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-encoding.h" />
@@ -355,7 +368,9 @@
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\implementations.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\aegis256_armcrypto.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\aegis256_soft.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\core_h2c.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\ref10\fe_25_5\constants.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\ref10\fe_25_5\fe.h" />

builds/msvc/vs2015/libsodium/libsodium.vcxproj.filters

@@ -84,6 +84,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blake2b-long.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-wasm32.c">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-core.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
@@ -99,6 +102,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2i.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-neon.c">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2id.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
@@ -342,6 +348,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha512\cp\hash_sha512_cp.c">
       <Filter>crypto_hash\sha512\cp</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha3\hash_sha3.c">
+      <Filter>crypto_hash\sha3</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha256\hash_sha256.c">
       <Filter>crypto_hash\sha256</Filter>
     </ClCompile>
@@ -387,6 +396,18 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\chacha20poly1305\aead_chacha20poly1305.c">
       <Filter>crypto_aead\chacha20poly1305</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\crypto_kem.c">
+      <Filter>crypto_kem</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\xwing\kem_xwing.c">
+      <Filter>crypto_kem\xwing</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\kem_mlkem768.c">
+      <Filter>crypto_kem\mlkem768</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.c">
+      <Filter>crypto_kem\mlkem768\ref</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_secretstream\xchacha20poly1305\secretstream_xchacha20poly1305.c">
       <Filter>crypto_secretstream\xchacha20poly1305</Filter>
     </ClCompile>
@@ -396,6 +417,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.c">
       <Filter>crypto_core\keccak1600\ref</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.c">
+      <Filter>crypto_core\keccak1600\armsha3</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\salsa\ref\core_salsa_ref.c">
       <Filter>crypto_core\salsa\ref</Filter>
     </ClCompile>
@@ -473,9 +497,6 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\core.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
-    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\version.h">
-      <Filter>include\sodium</Filter>
-    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\export.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -509,6 +530,9 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_onetimeauth_poly1305.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_mlkem768.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_scalarmult_ristretto255.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -575,6 +599,9 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_secretbox_xchacha20poly1305.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_keccak1600.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -620,6 +647,12 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash_scryptsalsa208sha256.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash_sha3.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_xwing.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_sign_ed25519.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -704,6 +737,12 @@
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-avx2.h">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-neon.h">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-wasm32.h">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2.h">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClInclude>
@@ -881,9 +920,15 @@
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\aegis256_soft.h">
       <Filter>crypto_aead\aegis256</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.h">
+      <Filter>crypto_kem\mlkem768\ref</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.h">
       <Filter>crypto_core\keccak1600\ref</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.h">
+      <Filter>crypto_core\keccak1600\armsha3</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\core_h2c.h">
       <Filter>crypto_core\ed25519</Filter>
     </ClInclude>
@@ -985,6 +1030,9 @@
     <Filter Include="crypto_core\keccak1600">
       <UniqueIdentifier>{85c1722f-2d65-30a8-aefb-ebf1cbfe185e}</UniqueIdentifier>
     </Filter>
+    <Filter Include="crypto_core\keccak1600\armsha3">
+      <UniqueIdentifier>{855cc78f-1fe0-3ad2-a2ac-5e2b0c01c235}</UniqueIdentifier>
+    </Filter>
     <Filter Include="crypto_core\keccak1600\ref">
       <UniqueIdentifier>{9462f285-fee0-3779-983b-2811dc621f7d}</UniqueIdentifier>
     </Filter>
@@ -1015,6 +1063,9 @@
     <Filter Include="crypto_hash\sha256\cp">
       <UniqueIdentifier>{8c7d8b62-7b4f-3eb9-85b7-18e8d925be14}</UniqueIdentifier>
     </Filter>
+    <Filter Include="crypto_hash\sha3">
+      <UniqueIdentifier>{6df763e3-9707-3014-8cfe-2f9a8a83a872}</UniqueIdentifier>
+    </Filter>
     <Filter Include="crypto_hash\sha512">
       <UniqueIdentifier>{8fb6a906-dbd6-3746-9b0f-f49e7028daec}</UniqueIdentifier>
     </Filter>
@@ -1033,6 +1084,18 @@
     <Filter Include="crypto_kdf\hkdf">
       <UniqueIdentifier>{baf7d894-9298-391d-8dc2-e4c3010f5ddc}</UniqueIdentifier>
     </Filter>
+    <Filter Include="crypto_kem">
+      <UniqueIdentifier>{b9009d4a-dd97-341d-aafb-eeeb77191a49}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="crypto_kem\mlkem768">
+      <UniqueIdentifier>{ab0c8a55-3e1f-307e-82be-8291a3b43735}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="crypto_kem\mlkem768\ref">
+      <UniqueIdentifier>{70a10765-f8fb-3898-8514-966e48719bc4}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="crypto_kem\xwing">
+      <UniqueIdentifier>{2ef7c851-6598-3be5-88be-9ac5ec867cb0}</UniqueIdentifier>
+    </Filter>
     <Filter Include="crypto_kx">
       <UniqueIdentifier>{898b6bd5-1360-3a34-adcd-0fade7561685}</UniqueIdentifier>
     </Filter>

builds/msvc/vs2017/libsodium/libsodium.vcxproj

@@ -88,11 +88,13 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_secretbox\xchacha20poly1305\secretbox_xchacha20poly1305.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\crypto_pwhash.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blake2b-long.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-wasm32.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-core.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-avx512f.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-ref.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-ssse3.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2i.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-neon.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2id.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-avx2.c" />
@@ -174,6 +176,7 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\crypto_hash.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha512\hash_sha512.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha512\cp\hash_sha512_cp.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha3\hash_sha3.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha256\hash_sha256.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha256\cp\hash_sha256_cp.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\xchacha20poly1305\aead_xchacha20poly1305.c" />
@@ -189,9 +192,14 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\aes256gcm\aesni\aead_aes256gcm_aesni.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\aes256gcm\armcrypto\aead_aes256gcm_armcrypto.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\chacha20poly1305\aead_chacha20poly1305.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\crypto_kem.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\xwing\kem_xwing.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\kem_mlkem768.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_secretstream\xchacha20poly1305\secretstream_xchacha20poly1305.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\keccak1600.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\salsa\ref\core_salsa_ref.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\hchacha20\core_hchacha20.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\hsalsa20\core_hsalsa20.c" />
@@ -219,7 +227,6 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_aead_aegis256.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash_sha512.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\core.h" />
-    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\version.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\export.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_salsa20.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_shorthash_siphash24.h" />
@@ -231,6 +238,7 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_aead_xchacha20poly1305.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_stream_salsa20.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_onetimeauth_poly1305.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_mlkem768.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_scalarmult_ristretto255.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kx.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash.h" />
@@ -253,6 +261,7 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_aead_aes256gcm.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_salsa2012.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_secretbox_xchacha20poly1305.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_keccak1600.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_scalarmult.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash.h" />
@@ -268,6 +277,8 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash_argon2id.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_secretstream_xchacha20poly1305.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash_scryptsalsa208sha256.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash_sha3.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_xwing.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_sign_ed25519.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_onetimeauth.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_verify_64.h" />
@@ -296,6 +307,8 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\private\implementations.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-ref.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-avx2.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-neon.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-wasm32.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-ssse3.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-encoding.h" />
@@ -355,7 +368,9 @@
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\implementations.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\aegis256_armcrypto.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\aegis256_soft.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\core_h2c.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\ref10\fe_25_5\constants.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\ref10\fe_25_5\fe.h" />

builds/msvc/vs2017/libsodium/libsodium.vcxproj.filters

@@ -84,6 +84,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blake2b-long.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-wasm32.c">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-core.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
@@ -99,6 +102,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2i.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-neon.c">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2id.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
@@ -342,6 +348,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha512\cp\hash_sha512_cp.c">
       <Filter>crypto_hash\sha512\cp</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha3\hash_sha3.c">
+      <Filter>crypto_hash\sha3</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha256\hash_sha256.c">
       <Filter>crypto_hash\sha256</Filter>
     </ClCompile>
@@ -387,6 +396,18 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\chacha20poly1305\aead_chacha20poly1305.c">
       <Filter>crypto_aead\chacha20poly1305</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\crypto_kem.c">
+      <Filter>crypto_kem</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\xwing\kem_xwing.c">
+      <Filter>crypto_kem\xwing</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\kem_mlkem768.c">
+      <Filter>crypto_kem\mlkem768</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.c">
+      <Filter>crypto_kem\mlkem768\ref</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_secretstream\xchacha20poly1305\secretstream_xchacha20poly1305.c">
       <Filter>crypto_secretstream\xchacha20poly1305</Filter>
     </ClCompile>
@@ -396,6 +417,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.c">
       <Filter>crypto_core\keccak1600\ref</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.c">
+      <Filter>crypto_core\keccak1600\armsha3</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\salsa\ref\core_salsa_ref.c">
       <Filter>crypto_core\salsa\ref</Filter>
     </ClCompile>
@@ -473,9 +497,6 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\core.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
-    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\version.h">
-      <Filter>include\sodium</Filter>
-    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\export.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -509,6 +530,9 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_onetimeauth_poly1305.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_mlkem768.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_scalarmult_ristretto255.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -575,6 +599,9 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_secretbox_xchacha20poly1305.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_keccak1600.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -620,6 +647,12 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash_scryptsalsa208sha256.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash_sha3.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_xwing.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_sign_ed25519.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -704,6 +737,12 @@
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-avx2.h">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-neon.h">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-wasm32.h">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2.h">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClInclude>
@@ -881,9 +920,15 @@
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\aegis256_soft.h">
       <Filter>crypto_aead\aegis256</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.h">
+      <Filter>crypto_kem\mlkem768\ref</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.h">
       <Filter>crypto_core\keccak1600\ref</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.h">
+      <Filter>crypto_core\keccak1600\armsha3</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\core_h2c.h">
       <Filter>crypto_core\ed25519</Filter>
     </ClInclude>
@@ -985,6 +1030,9 @@
     <Filter Include="crypto_core\keccak1600">
       <UniqueIdentifier>{85c1722f-2d65-30a8-aefb-ebf1cbfe185e}</UniqueIdentifier>
     </Filter>
+    <Filter Include="crypto_core\keccak1600\armsha3">
+      <UniqueIdentifier>{855cc78f-1fe0-3ad2-a2ac-5e2b0c01c235}</UniqueIdentifier>
+    </Filter>
     <Filter Include="crypto_core\keccak1600\ref">
       <UniqueIdentifier>{9462f285-fee0-3779-983b-2811dc621f7d}</UniqueIdentifier>
     </Filter>
@@ -1015,6 +1063,9 @@
     <Filter Include="crypto_hash\sha256\cp">
       <UniqueIdentifier>{8c7d8b62-7b4f-3eb9-85b7-18e8d925be14}</UniqueIdentifier>
     </Filter>
+    <Filter Include="crypto_hash\sha3">
+      <UniqueIdentifier>{6df763e3-9707-3014-8cfe-2f9a8a83a872}</UniqueIdentifier>
+    </Filter>
     <Filter Include="crypto_hash\sha512">
       <UniqueIdentifier>{8fb6a906-dbd6-3746-9b0f-f49e7028daec}</UniqueIdentifier>
     </Filter>
@@ -1033,6 +1084,18 @@
     <Filter Include="crypto_kdf\hkdf">
       <UniqueIdentifier>{baf7d894-9298-391d-8dc2-e4c3010f5ddc}</UniqueIdentifier>
     </Filter>
+    <Filter Include="crypto_kem">
+      <UniqueIdentifier>{b9009d4a-dd97-341d-aafb-eeeb77191a49}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="crypto_kem\mlkem768">
+      <UniqueIdentifier>{ab0c8a55-3e1f-307e-82be-8291a3b43735}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="crypto_kem\mlkem768\ref">
+      <UniqueIdentifier>{70a10765-f8fb-3898-8514-966e48719bc4}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="crypto_kem\xwing">
+      <UniqueIdentifier>{2ef7c851-6598-3be5-88be-9ac5ec867cb0}</UniqueIdentifier>
+    </Filter>
     <Filter Include="crypto_kx">
       <UniqueIdentifier>{898b6bd5-1360-3a34-adcd-0fade7561685}</UniqueIdentifier>
     </Filter>

builds/msvc/vs2019/libsodium/libsodium.vcxproj

@@ -112,11 +112,13 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_secretbox\xchacha20poly1305\secretbox_xchacha20poly1305.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\crypto_pwhash.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blake2b-long.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-wasm32.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-core.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-avx512f.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-ref.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-ssse3.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2i.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-neon.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2id.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-avx2.c" />
@@ -198,6 +200,7 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\crypto_hash.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha512\hash_sha512.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha512\cp\hash_sha512_cp.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha3\hash_sha3.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha256\hash_sha256.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha256\cp\hash_sha256_cp.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\xchacha20poly1305\aead_xchacha20poly1305.c" />
@@ -213,9 +216,14 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\aes256gcm\aesni\aead_aes256gcm_aesni.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\aes256gcm\armcrypto\aead_aes256gcm_armcrypto.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\chacha20poly1305\aead_chacha20poly1305.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\crypto_kem.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\xwing\kem_xwing.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\kem_mlkem768.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_secretstream\xchacha20poly1305\secretstream_xchacha20poly1305.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\keccak1600.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\salsa\ref\core_salsa_ref.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\hchacha20\core_hchacha20.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\hsalsa20\core_hsalsa20.c" />
@@ -243,7 +251,6 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_aead_aegis256.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash_sha512.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\core.h" />
-    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\version.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\export.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_salsa20.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_shorthash_siphash24.h" />
@@ -255,6 +262,7 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_aead_xchacha20poly1305.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_stream_salsa20.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_onetimeauth_poly1305.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_mlkem768.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_scalarmult_ristretto255.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kx.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash.h" />
@@ -277,6 +285,7 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_aead_aes256gcm.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_salsa2012.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_secretbox_xchacha20poly1305.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_keccak1600.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_scalarmult.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash.h" />
@@ -292,6 +301,8 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash_argon2id.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_secretstream_xchacha20poly1305.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash_scryptsalsa208sha256.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash_sha3.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_xwing.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_sign_ed25519.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_onetimeauth.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_verify_64.h" />
@@ -320,6 +331,8 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\private\implementations.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-ref.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-avx2.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-neon.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-wasm32.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-ssse3.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-encoding.h" />
@@ -379,7 +392,9 @@
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\implementations.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\aegis256_armcrypto.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\aegis256_soft.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\core_h2c.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\ref10\fe_25_5\constants.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\ref10\fe_25_5\fe.h" />

builds/msvc/vs2019/libsodium/libsodium.vcxproj.filters

@@ -84,6 +84,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blake2b-long.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-wasm32.c">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-core.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
@@ -99,6 +102,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2i.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-neon.c">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2id.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
@@ -342,6 +348,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha512\cp\hash_sha512_cp.c">
       <Filter>crypto_hash\sha512\cp</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha3\hash_sha3.c">
+      <Filter>crypto_hash\sha3</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha256\hash_sha256.c">
       <Filter>crypto_hash\sha256</Filter>
     </ClCompile>
@@ -387,6 +396,18 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\chacha20poly1305\aead_chacha20poly1305.c">
       <Filter>crypto_aead\chacha20poly1305</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\crypto_kem.c">
+      <Filter>crypto_kem</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\xwing\kem_xwing.c">
+      <Filter>crypto_kem\xwing</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\kem_mlkem768.c">
+      <Filter>crypto_kem\mlkem768</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.c">
+      <Filter>crypto_kem\mlkem768\ref</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_secretstream\xchacha20poly1305\secretstream_xchacha20poly1305.c">
       <Filter>crypto_secretstream\xchacha20poly1305</Filter>
     </ClCompile>
@@ -396,6 +417,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.c">
       <Filter>crypto_core\keccak1600\ref</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.c">
+      <Filter>crypto_core\keccak1600\armsha3</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\salsa\ref\core_salsa_ref.c">
       <Filter>crypto_core\salsa\ref</Filter>
     </ClCompile>
@@ -473,9 +497,6 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\core.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
-    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\version.h">
-      <Filter>include\sodium</Filter>
-    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\export.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -509,6 +530,9 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_onetimeauth_poly1305.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_mlkem768.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_scalarmult_ristretto255.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -575,6 +599,9 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_secretbox_xchacha20poly1305.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_keccak1600.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -620,6 +647,12 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash_scryptsalsa208sha256.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash_sha3.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_xwing.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_sign_ed25519.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -704,6 +737,12 @@
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-avx2.h">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-neon.h">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-wasm32.h">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2.h">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClInclude>
@@ -881,9 +920,15 @@
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\aegis256_soft.h">
       <Filter>crypto_aead\aegis256</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.h">
+      <Filter>crypto_kem\mlkem768\ref</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.h">
       <Filter>crypto_core\keccak1600\ref</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.h">
+      <Filter>crypto_core\keccak1600\armsha3</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\core_h2c.h">
       <Filter>crypto_core\ed25519</Filter>
     </ClInclude>
@@ -985,6 +1030,9 @@
     <Filter Include="crypto_core\keccak1600">
       <UniqueIdentifier>{85c1722f-2d65-30a8-aefb-ebf1cbfe185e}</UniqueIdentifier>
     </Filter>
+    <Filter Include="crypto_core\keccak1600\armsha3">
+      <UniqueIdentifier>{855cc78f-1fe0-3ad2-a2ac-5e2b0c01c235}</UniqueIdentifier>
+    </Filter>
     <Filter Include="crypto_core\keccak1600\ref">
       <UniqueIdentifier>{9462f285-fee0-3779-983b-2811dc621f7d}</UniqueIdentifier>
     </Filter>
@@ -1015,6 +1063,9 @@
     <Filter Include="crypto_hash\sha256\cp">
       <UniqueIdentifier>{8c7d8b62-7b4f-3eb9-85b7-18e8d925be14}</UniqueIdentifier>
     </Filter>
+    <Filter Include="crypto_hash\sha3">
+      <UniqueIdentifier>{6df763e3-9707-3014-8cfe-2f9a8a83a872}</UniqueIdentifier>
+    </Filter>
     <Filter Include="crypto_hash\sha512">
       <UniqueIdentifier>{8fb6a906-dbd6-3746-9b0f-f49e7028daec}</UniqueIdentifier>
     </Filter>
@@ -1033,6 +1084,18 @@
     <Filter Include="crypto_kdf\hkdf">
       <UniqueIdentifier>{baf7d894-9298-391d-8dc2-e4c3010f5ddc}</UniqueIdentifier>
     </Filter>
+    <Filter Include="crypto_kem">
+      <UniqueIdentifier>{b9009d4a-dd97-341d-aafb-eeeb77191a49}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="crypto_kem\mlkem768">
+      <UniqueIdentifier>{ab0c8a55-3e1f-307e-82be-8291a3b43735}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="crypto_kem\mlkem768\ref">
+      <UniqueIdentifier>{70a10765-f8fb-3898-8514-966e48719bc4}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="crypto_kem\xwing">
+      <UniqueIdentifier>{2ef7c851-6598-3be5-88be-9ac5ec867cb0}</UniqueIdentifier>
+    </Filter>
     <Filter Include="crypto_kx">
       <UniqueIdentifier>{898b6bd5-1360-3a34-adcd-0fade7561685}</UniqueIdentifier>
     </Filter>

builds/msvc/vs2022/libsodium/libsodium.vcxproj

@@ -112,11 +112,13 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_secretbox\xchacha20poly1305\secretbox_xchacha20poly1305.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\crypto_pwhash.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blake2b-long.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-wasm32.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-core.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-avx512f.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-ref.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-ssse3.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2i.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-neon.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2id.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-avx2.c" />
@@ -198,6 +200,7 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\crypto_hash.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha512\hash_sha512.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha512\cp\hash_sha512_cp.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha3\hash_sha3.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha256\hash_sha256.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha256\cp\hash_sha256_cp.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\xchacha20poly1305\aead_xchacha20poly1305.c" />
@@ -213,9 +216,14 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\aes256gcm\aesni\aead_aes256gcm_aesni.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\aes256gcm\armcrypto\aead_aes256gcm_armcrypto.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\chacha20poly1305\aead_chacha20poly1305.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\crypto_kem.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\xwing\kem_xwing.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\kem_mlkem768.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_secretstream\xchacha20poly1305\secretstream_xchacha20poly1305.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\keccak1600.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\salsa\ref\core_salsa_ref.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\hchacha20\core_hchacha20.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\hsalsa20\core_hsalsa20.c" />
@@ -243,7 +251,6 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_aead_aegis256.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash_sha512.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\core.h" />
-    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\version.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\export.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_salsa20.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_shorthash_siphash24.h" />
@@ -255,6 +262,7 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_aead_xchacha20poly1305.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_stream_salsa20.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_onetimeauth_poly1305.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_mlkem768.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_scalarmult_ristretto255.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kx.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash.h" />
@@ -277,6 +285,7 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_aead_aes256gcm.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_salsa2012.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_secretbox_xchacha20poly1305.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_keccak1600.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_scalarmult.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash.h" />
@@ -292,6 +301,8 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash_argon2id.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_secretstream_xchacha20poly1305.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash_scryptsalsa208sha256.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash_sha3.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_xwing.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_sign_ed25519.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_onetimeauth.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_verify_64.h" />
@@ -320,6 +331,8 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\private\implementations.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-ref.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-avx2.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-neon.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-wasm32.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-ssse3.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-encoding.h" />
@@ -379,7 +392,9 @@
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\implementations.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\aegis256_armcrypto.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\aegis256_soft.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\core_h2c.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\ref10\fe_25_5\constants.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\ref10\fe_25_5\fe.h" />

builds/msvc/vs2022/libsodium/libsodium.vcxproj.filters

@@ -84,6 +84,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blake2b-long.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-wasm32.c">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-core.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
@@ -99,6 +102,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2i.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-neon.c">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2id.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
@@ -342,6 +348,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha512\cp\hash_sha512_cp.c">
       <Filter>crypto_hash\sha512\cp</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha3\hash_sha3.c">
+      <Filter>crypto_hash\sha3</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha256\hash_sha256.c">
       <Filter>crypto_hash\sha256</Filter>
     </ClCompile>
@@ -387,6 +396,18 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\chacha20poly1305\aead_chacha20poly1305.c">
       <Filter>crypto_aead\chacha20poly1305</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\crypto_kem.c">
+      <Filter>crypto_kem</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\xwing\kem_xwing.c">
+      <Filter>crypto_kem\xwing</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\kem_mlkem768.c">
+      <Filter>crypto_kem\mlkem768</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.c">
+      <Filter>crypto_kem\mlkem768\ref</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_secretstream\xchacha20poly1305\secretstream_xchacha20poly1305.c">
       <Filter>crypto_secretstream\xchacha20poly1305</Filter>
     </ClCompile>
@@ -396,6 +417,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.c">
       <Filter>crypto_core\keccak1600\ref</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.c">
+      <Filter>crypto_core\keccak1600\armsha3</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\salsa\ref\core_salsa_ref.c">
       <Filter>crypto_core\salsa\ref</Filter>
     </ClCompile>
@@ -473,9 +497,6 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\core.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
-    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\version.h">
-      <Filter>include\sodium</Filter>
-    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\export.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -509,6 +530,9 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_onetimeauth_poly1305.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_mlkem768.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_scalarmult_ristretto255.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -575,6 +599,9 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_secretbox_xchacha20poly1305.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_keccak1600.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -620,6 +647,12 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash_scryptsalsa208sha256.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash_sha3.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_xwing.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_sign_ed25519.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -704,6 +737,12 @@
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-avx2.h">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-neon.h">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-wasm32.h">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2.h">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClInclude>
@@ -881,9 +920,15 @@
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\aegis256_soft.h">
       <Filter>crypto_aead\aegis256</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.h">
+      <Filter>crypto_kem\mlkem768\ref</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.h">
       <Filter>crypto_core\keccak1600\ref</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.h">
+      <Filter>crypto_core\keccak1600\armsha3</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\core_h2c.h">
       <Filter>crypto_core\ed25519</Filter>
     </ClInclude>
@@ -985,6 +1030,9 @@
     <Filter Include="crypto_core\keccak1600">
       <UniqueIdentifier>{85c1722f-2d65-30a8-aefb-ebf1cbfe185e}</UniqueIdentifier>
     </Filter>
+    <Filter Include="crypto_core\keccak1600\armsha3">
+      <UniqueIdentifier>{855cc78f-1fe0-3ad2-a2ac-5e2b0c01c235}</UniqueIdentifier>
+    </Filter>
     <Filter Include="crypto_core\keccak1600\ref">
       <UniqueIdentifier>{9462f285-fee0-3779-983b-2811dc621f7d}</UniqueIdentifier>
     </Filter>
@@ -1015,6 +1063,9 @@
     <Filter Include="crypto_hash\sha256\cp">
       <UniqueIdentifier>{8c7d8b62-7b4f-3eb9-85b7-18e8d925be14}</UniqueIdentifier>
     </Filter>
+    <Filter Include="crypto_hash\sha3">
+      <UniqueIdentifier>{6df763e3-9707-3014-8cfe-2f9a8a83a872}</UniqueIdentifier>
+    </Filter>
     <Filter Include="crypto_hash\sha512">
       <UniqueIdentifier>{8fb6a906-dbd6-3746-9b0f-f49e7028daec}</UniqueIdentifier>
     </Filter>
@@ -1033,6 +1084,18 @@
     <Filter Include="crypto_kdf\hkdf">
       <UniqueIdentifier>{baf7d894-9298-391d-8dc2-e4c3010f5ddc}</UniqueIdentifier>
     </Filter>
+    <Filter Include="crypto_kem">
+      <UniqueIdentifier>{b9009d4a-dd97-341d-aafb-eeeb77191a49}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="crypto_kem\mlkem768">
+      <UniqueIdentifier>{ab0c8a55-3e1f-307e-82be-8291a3b43735}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="crypto_kem\mlkem768\ref">
+      <UniqueIdentifier>{70a10765-f8fb-3898-8514-966e48719bc4}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="crypto_kem\xwing">
+      <UniqueIdentifier>{2ef7c851-6598-3be5-88be-9ac5ec867cb0}</UniqueIdentifier>
+    </Filter>
     <Filter Include="crypto_kx">
       <UniqueIdentifier>{898b6bd5-1360-3a34-adcd-0fade7561685}</UniqueIdentifier>
     </Filter>

builds/msvc/vs2026/libsodium/libsodium.vcxproj

@@ -112,11 +112,13 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_secretbox\xchacha20poly1305\secretbox_xchacha20poly1305.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\crypto_pwhash.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blake2b-long.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-wasm32.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-core.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-avx512f.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-ref.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-ssse3.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2i.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-neon.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2id.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-avx2.c" />
@@ -198,6 +200,7 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\crypto_hash.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha512\hash_sha512.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha512\cp\hash_sha512_cp.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha3\hash_sha3.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha256\hash_sha256.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha256\cp\hash_sha256_cp.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\xchacha20poly1305\aead_xchacha20poly1305.c" />
@@ -213,9 +216,14 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\aes256gcm\aesni\aead_aes256gcm_aesni.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\aes256gcm\armcrypto\aead_aes256gcm_armcrypto.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\chacha20poly1305\aead_chacha20poly1305.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\crypto_kem.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\xwing\kem_xwing.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\kem_mlkem768.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_secretstream\xchacha20poly1305\secretstream_xchacha20poly1305.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\keccak1600.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.c" />
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\salsa\ref\core_salsa_ref.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\hchacha20\core_hchacha20.c" />
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\hsalsa20\core_hsalsa20.c" />
@@ -243,7 +251,6 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_aead_aegis256.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash_sha512.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\core.h" />
-    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\version.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\export.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_salsa20.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_shorthash_siphash24.h" />
@@ -255,6 +262,7 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_aead_xchacha20poly1305.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_stream_salsa20.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_onetimeauth_poly1305.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_mlkem768.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_scalarmult_ristretto255.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kx.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash.h" />
@@ -277,6 +285,7 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_aead_aes256gcm.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_salsa2012.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_secretbox_xchacha20poly1305.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_keccak1600.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_scalarmult.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash.h" />
@@ -292,6 +301,8 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash_argon2id.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_secretstream_xchacha20poly1305.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash_scryptsalsa208sha256.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash_sha3.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_xwing.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_sign_ed25519.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_onetimeauth.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_verify_64.h" />
@@ -320,6 +331,8 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\private\implementations.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-ref.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-avx2.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-neon.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-wasm32.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-ssse3.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-encoding.h" />
@@ -379,7 +392,9 @@
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\implementations.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\aegis256_armcrypto.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\aegis256_soft.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.h" />
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\core_h2c.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\ref10\fe_25_5\constants.h" />
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\ref10\fe_25_5\fe.h" />

builds/msvc/vs2026/libsodium/libsodium.vcxproj.filters

@@ -84,6 +84,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blake2b-long.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-wasm32.c">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-core.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
@@ -99,6 +102,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2i.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-neon.c">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2id.c">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClCompile>
@@ -342,6 +348,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha512\cp\hash_sha512_cp.c">
       <Filter>crypto_hash\sha512\cp</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha3\hash_sha3.c">
+      <Filter>crypto_hash\sha3</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_hash\sha256\hash_sha256.c">
       <Filter>crypto_hash\sha256</Filter>
     </ClCompile>
@@ -387,6 +396,18 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_aead\chacha20poly1305\aead_chacha20poly1305.c">
       <Filter>crypto_aead\chacha20poly1305</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\crypto_kem.c">
+      <Filter>crypto_kem</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\xwing\kem_xwing.c">
+      <Filter>crypto_kem\xwing</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\kem_mlkem768.c">
+      <Filter>crypto_kem\mlkem768</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.c">
+      <Filter>crypto_kem\mlkem768\ref</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_secretstream\xchacha20poly1305\secretstream_xchacha20poly1305.c">
       <Filter>crypto_secretstream\xchacha20poly1305</Filter>
     </ClCompile>
@@ -396,6 +417,9 @@
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.c">
       <Filter>crypto_core\keccak1600\ref</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.c">
+      <Filter>crypto_core\keccak1600\armsha3</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\..\..\src\libsodium\crypto_core\salsa\ref\core_salsa_ref.c">
       <Filter>crypto_core\salsa\ref</Filter>
     </ClCompile>
@@ -473,9 +497,6 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\core.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
-    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\version.h">
-      <Filter>include\sodium</Filter>
-    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\export.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -509,6 +530,9 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_onetimeauth_poly1305.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_mlkem768.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_scalarmult_ristretto255.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -575,6 +599,9 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_secretbox_xchacha20poly1305.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_core_keccak1600.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -620,6 +647,12 @@
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_pwhash_scryptsalsa208sha256.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_hash_sha3.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_kem_xwing.h">
+      <Filter>include\sodium</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\include\sodium\crypto_sign_ed25519.h">
       <Filter>include\sodium</Filter>
     </ClInclude>
@@ -704,6 +737,12 @@
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-avx2.h">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-neon.h">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-wasm32.h">
+      <Filter>crypto_pwhash\argon2</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_pwhash\argon2\argon2.h">
       <Filter>crypto_pwhash\argon2</Filter>
     </ClInclude>
@@ -881,9 +920,15 @@
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_aead\aegis256\aegis256_soft.h">
       <Filter>crypto_aead\aegis256</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.h">
+      <Filter>crypto_kem\mlkem768\ref</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.h">
       <Filter>crypto_core\keccak1600\ref</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.h">
+      <Filter>crypto_core\keccak1600\armsha3</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\..\..\src\libsodium\crypto_core\ed25519\core_h2c.h">
       <Filter>crypto_core\ed25519</Filter>
     </ClInclude>
@@ -985,6 +1030,9 @@
     <Filter Include="crypto_core\keccak1600">
       <UniqueIdentifier>{85c1722f-2d65-30a8-aefb-ebf1cbfe185e}</UniqueIdentifier>
     </Filter>
+    <Filter Include="crypto_core\keccak1600\armsha3">
+      <UniqueIdentifier>{855cc78f-1fe0-3ad2-a2ac-5e2b0c01c235}</UniqueIdentifier>
+    </Filter>
     <Filter Include="crypto_core\keccak1600\ref">
       <UniqueIdentifier>{9462f285-fee0-3779-983b-2811dc621f7d}</UniqueIdentifier>
     </Filter>
@@ -1015,6 +1063,9 @@
     <Filter Include="crypto_hash\sha256\cp">
       <UniqueIdentifier>{8c7d8b62-7b4f-3eb9-85b7-18e8d925be14}</UniqueIdentifier>
     </Filter>
+    <Filter Include="crypto_hash\sha3">
+      <UniqueIdentifier>{6df763e3-9707-3014-8cfe-2f9a8a83a872}</UniqueIdentifier>
+    </Filter>
     <Filter Include="crypto_hash\sha512">
       <UniqueIdentifier>{8fb6a906-dbd6-3746-9b0f-f49e7028daec}</UniqueIdentifier>
     </Filter>
@@ -1033,6 +1084,18 @@
     <Filter Include="crypto_kdf\hkdf">
       <UniqueIdentifier>{baf7d894-9298-391d-8dc2-e4c3010f5ddc}</UniqueIdentifier>
     </Filter>
+    <Filter Include="crypto_kem">
+      <UniqueIdentifier>{b9009d4a-dd97-341d-aafb-eeeb77191a49}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="crypto_kem\mlkem768">
+      <UniqueIdentifier>{ab0c8a55-3e1f-307e-82be-8291a3b43735}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="crypto_kem\mlkem768\ref">
+      <UniqueIdentifier>{70a10765-f8fb-3898-8514-966e48719bc4}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="crypto_kem\xwing">
+      <UniqueIdentifier>{2ef7c851-6598-3be5-88be-9ac5ec867cb0}</UniqueIdentifier>
+    </Filter>
     <Filter Include="crypto_kx">
       <UniqueIdentifier>{898b6bd5-1360-3a34-adcd-0fade7561685}</UniqueIdentifier>
     </Filter>

ci/appveyor/libsodium.vcxproj

@@ -336,11 +336,13 @@
     <ClCompile Include="..\..\src\libsodium\crypto_secretbox\xchacha20poly1305\secretbox_xchacha20poly1305.c" />
     <ClCompile Include="..\..\src\libsodium\crypto_pwhash\crypto_pwhash.c" />
     <ClCompile Include="..\..\src\libsodium\crypto_pwhash\argon2\blake2b-long.c" />
+    <ClCompile Include="..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-wasm32.c" />
     <ClCompile Include="..\..\src\libsodium\crypto_pwhash\argon2\argon2-core.c" />
     <ClCompile Include="..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-avx512f.c" />
     <ClCompile Include="..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-ref.c" />
     <ClCompile Include="..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-ssse3.c" />
     <ClCompile Include="..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2i.c" />
+    <ClCompile Include="..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-neon.c" />
     <ClCompile Include="..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2id.c" />
     <ClCompile Include="..\..\src\libsodium\crypto_pwhash\argon2\argon2.c" />
     <ClCompile Include="..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-avx2.c" />
@@ -422,6 +424,7 @@
     <ClCompile Include="..\..\src\libsodium\crypto_hash\crypto_hash.c" />
     <ClCompile Include="..\..\src\libsodium\crypto_hash\sha512\hash_sha512.c" />
     <ClCompile Include="..\..\src\libsodium\crypto_hash\sha512\cp\hash_sha512_cp.c" />
+    <ClCompile Include="..\..\src\libsodium\crypto_hash\sha3\hash_sha3.c" />
     <ClCompile Include="..\..\src\libsodium\crypto_hash\sha256\hash_sha256.c" />
     <ClCompile Include="..\..\src\libsodium\crypto_hash\sha256\cp\hash_sha256_cp.c" />
     <ClCompile Include="..\..\src\libsodium\crypto_aead\xchacha20poly1305\aead_xchacha20poly1305.c" />
@@ -437,9 +440,14 @@
     <ClCompile Include="..\..\src\libsodium\crypto_aead\aes256gcm\aesni\aead_aes256gcm_aesni.c" />
     <ClCompile Include="..\..\src\libsodium\crypto_aead\aes256gcm\armcrypto\aead_aes256gcm_armcrypto.c" />
     <ClCompile Include="..\..\src\libsodium\crypto_aead\chacha20poly1305\aead_chacha20poly1305.c" />
+    <ClCompile Include="..\..\src\libsodium\crypto_kem\crypto_kem.c" />
+    <ClCompile Include="..\..\src\libsodium\crypto_kem\xwing\kem_xwing.c" />
+    <ClCompile Include="..\..\src\libsodium\crypto_kem\mlkem768\kem_mlkem768.c" />
+    <ClCompile Include="..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.c" />
     <ClCompile Include="..\..\src\libsodium\crypto_secretstream\xchacha20poly1305\secretstream_xchacha20poly1305.c" />
     <ClCompile Include="..\..\src\libsodium\crypto_core\keccak1600\keccak1600.c" />
     <ClCompile Include="..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.c" />
+    <ClCompile Include="..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.c" />
     <ClCompile Include="..\..\src\libsodium\crypto_core\salsa\ref\core_salsa_ref.c" />
     <ClCompile Include="..\..\src\libsodium\crypto_core\hchacha20\core_hchacha20.c" />
     <ClCompile Include="..\..\src\libsodium\crypto_core\hsalsa20\core_hsalsa20.c" />
@@ -467,7 +475,6 @@
     <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_aead_aegis256.h" />
     <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_hash_sha512.h" />
     <ClInclude Include="..\..\src\libsodium\include\sodium\core.h" />
-    <ClInclude Include="..\..\src\libsodium\include\sodium\version.h" />
     <ClInclude Include="..\..\src\libsodium\include\sodium\export.h" />
     <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_core_salsa20.h" />
     <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_shorthash_siphash24.h" />
@@ -479,6 +486,7 @@
     <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_aead_xchacha20poly1305.h" />
     <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_stream_salsa20.h" />
     <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_onetimeauth_poly1305.h" />
+    <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_kem_mlkem768.h" />
     <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_scalarmult_ristretto255.h" />
     <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_kx.h" />
     <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_hash.h" />
@@ -501,6 +509,7 @@
     <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_aead_aes256gcm.h" />
     <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_core_salsa2012.h" />
     <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_secretbox_xchacha20poly1305.h" />
+    <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_kem.h" />
     <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_core_keccak1600.h" />
     <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_scalarmult.h" />
     <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_pwhash.h" />
@@ -516,6 +525,8 @@
     <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_pwhash_argon2id.h" />
     <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_secretstream_xchacha20poly1305.h" />
     <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_pwhash_scryptsalsa208sha256.h" />
+    <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_hash_sha3.h" />
+    <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_kem_xwing.h" />
     <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_sign_ed25519.h" />
     <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_onetimeauth.h" />
     <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_verify_64.h" />
@@ -544,6 +555,8 @@
     <ClInclude Include="..\..\src\libsodium\include\sodium\private\implementations.h" />
     <ClInclude Include="..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-ref.h" />
     <ClInclude Include="..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-avx2.h" />
+    <ClInclude Include="..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-neon.h" />
+    <ClInclude Include="..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-wasm32.h" />
     <ClInclude Include="..\..\src\libsodium\crypto_pwhash\argon2\argon2.h" />
     <ClInclude Include="..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-ssse3.h" />
     <ClInclude Include="..\..\src\libsodium\crypto_pwhash\argon2\argon2-encoding.h" />
@@ -603,7 +616,9 @@
     <ClInclude Include="..\..\src\libsodium\crypto_aead\aegis256\implementations.h" />
     <ClInclude Include="..\..\src\libsodium\crypto_aead\aegis256\aegis256_armcrypto.h" />
     <ClInclude Include="..\..\src\libsodium\crypto_aead\aegis256\aegis256_soft.h" />
+    <ClInclude Include="..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.h" />
     <ClInclude Include="..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.h" />
+    <ClInclude Include="..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.h" />
     <ClInclude Include="..\..\src\libsodium\crypto_core\ed25519\core_h2c.h" />
     <ClInclude Include="..\..\src\libsodium\crypto_core\ed25519\ref10\fe_25_5\constants.h" />
     <ClInclude Include="..\..\src\libsodium\crypto_core\ed25519\ref10\fe_25_5\fe.h" />

ci/appveyor/libsodium.vcxproj.filters

@@ -75,6 +75,9 @@
     <ClCompile Include="..\..\src\libsodium\crypto_pwhash\argon2\blake2b-long.c">
       <Filter>Source Files</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-wasm32.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\src\libsodium\crypto_pwhash\argon2\argon2-core.c">
       <Filter>Source Files</Filter>
     </ClCompile>
@@ -90,6 +93,9 @@
     <ClCompile Include="..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2i.c">
       <Filter>Source Files</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\src\libsodium\crypto_pwhash\argon2\argon2-fill-block-neon.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\src\libsodium\crypto_pwhash\argon2\pwhash_argon2id.c">
       <Filter>Source Files</Filter>
     </ClCompile>
@@ -333,6 +339,9 @@
     <ClCompile Include="..\..\src\libsodium\crypto_hash\sha512\cp\hash_sha512_cp.c">
       <Filter>Source Files</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\src\libsodium\crypto_hash\sha3\hash_sha3.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\src\libsodium\crypto_hash\sha256\hash_sha256.c">
       <Filter>Source Files</Filter>
     </ClCompile>
@@ -378,6 +387,18 @@
     <ClCompile Include="..\..\src\libsodium\crypto_aead\chacha20poly1305\aead_chacha20poly1305.c">
       <Filter>Source Files</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\src\libsodium\crypto_kem\crypto_kem.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\src\libsodium\crypto_kem\xwing\kem_xwing.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\src\libsodium\crypto_kem\mlkem768\kem_mlkem768.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\src\libsodium\crypto_secretstream\xchacha20poly1305\secretstream_xchacha20poly1305.c">
       <Filter>Source Files</Filter>
     </ClCompile>
@@ -387,6 +408,9 @@
     <ClCompile Include="..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.c">
       <Filter>Source Files</Filter>
     </ClCompile>
+    <ClCompile Include="..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
     <ClCompile Include="..\..\src\libsodium\crypto_core\salsa\ref\core_salsa_ref.c">
       <Filter>Source Files</Filter>
     </ClCompile>
@@ -464,9 +488,6 @@
     <ClInclude Include="..\..\src\libsodium\include\sodium\core.h">
       <Filter>Header Files</Filter>
     </ClInclude>
-    <ClInclude Include="..\..\src\libsodium\include\sodium\version.h">
-      <Filter>Header Files</Filter>
-    </ClInclude>
     <ClInclude Include="..\..\src\libsodium\include\sodium\export.h">
       <Filter>Header Files</Filter>
     </ClInclude>
@@ -500,6 +521,9 @@
     <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_onetimeauth_poly1305.h">
       <Filter>Header Files</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_kem_mlkem768.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_scalarmult_ristretto255.h">
       <Filter>Header Files</Filter>
     </ClInclude>
@@ -566,6 +590,9 @@
     <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_secretbox_xchacha20poly1305.h">
       <Filter>Header Files</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_kem.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_core_keccak1600.h">
       <Filter>Header Files</Filter>
     </ClInclude>
@@ -611,6 +638,12 @@
     <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_pwhash_scryptsalsa208sha256.h">
       <Filter>Header Files</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_hash_sha3.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+    <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_kem_xwing.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\src\libsodium\include\sodium\crypto_sign_ed25519.h">
       <Filter>Header Files</Filter>
     </ClInclude>
@@ -695,6 +728,12 @@
     <ClInclude Include="..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-avx2.h">
       <Filter>Header Files</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-neon.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+    <ClInclude Include="..\..\src\libsodium\crypto_pwhash\argon2\blamka-round-wasm32.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\src\libsodium\crypto_pwhash\argon2\argon2.h">
       <Filter>Header Files</Filter>
     </ClInclude>
@@ -872,9 +911,15 @@
     <ClInclude Include="..\..\src\libsodium\crypto_aead\aegis256\aegis256_soft.h">
       <Filter>Header Files</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\src\libsodium\crypto_kem\mlkem768\ref\kem_mlkem768_ref.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\src\libsodium\crypto_core\keccak1600\ref\keccak1600_ref.h">
       <Filter>Header Files</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\src\libsodium\crypto_core\keccak1600\armsha3\keccak1600_armsha3.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\src\libsodium\crypto_core\ed25519\core_h2c.h">
       <Filter>Header Files</Filter>
     </ClInclude>

ci/appveyor/msvc-scripts/process.bat

@@ -1,4 +1,4 @@
-cscript msvc-scripts/rep.vbs //Nologo s/@VERSION@/1.0.22/ < ..\..\src\libsodium\include\sodium\version.h.in > tmp
+cscript msvc-scripts/rep.vbs //Nologo s/@VERSION@/1.0.23/ < ..\..\src\libsodium\include\sodium\version.h.in > tmp
 cscript msvc-scripts/rep.vbs //Nologo s/@SODIUM_LIBRARY_VERSION_MAJOR@/30/ < tmp > tmp2
 cscript msvc-scripts/rep.vbs //Nologo s/@SODIUM_LIBRARY_VERSION_MINOR@/0/ < tmp2 > tmp3
 cscript msvc-scripts/rep.vbs //Nologo s/@SODIUM_LIBRARY_MINIMAL_DEF@// < tmp3 > ..\..\src\libsodium\include\sodium\version.h

configure.ac

@@ -1,5 +1,5 @@
 AC_PREREQ([2.69])
-AC_INIT([libsodium],[1.0.22],[https://github.com/jedisct1/libsodium/issues],[libsodium],[https://libsodium.org])
+AC_INIT([libsodium],[1.0.23],[https://github.com/jedisct1/libsodium/issues],[libsodium],[https://libsodium.org])
 AC_CONFIG_AUX_DIR([build-aux])
 AC_CONFIG_MACRO_DIR([m4])
 AC_CONFIG_SRCDIR([src/libsodium/sodium/version.c])
@@ -994,7 +994,7 @@ AC_SUBST([LIBTOOL_EXTRA_FLAGS])
 TEST_LDFLAGS=''
 AS_IF([test "x$EMSCRIPTEN" != "x"],[
   EXEEXT=.js
-  TEST_LDFLAGS='--pre-js pre.js.inc -s RESERVED_FUNCTION_POINTERS=8'
+  TEST_LDFLAGS='--pre-js pre.js.inc -sALLOW_TABLE_GROWTH'
 ])
 AC_SUBST(TEST_LDFLAGS)
 AM_CONDITIONAL([EMSCRIPTEN], [test "x$EMSCRIPTEN" != "x"])

dist-build/android-aar.sh

@@ -4,7 +4,7 @@
 #
 # To simplify linking, library variants have distinct names: sodium, sodium-static, sodium-minimal and sodium-minimal-static.
 
-SODIUM_VERSION="1.0.22.0"
+SODIUM_VERSION="1.0.23.0"
 
 if [ -z "$ANDROID_NDK_HOME" ]; then
   echo "ANDROID_NDK_HOME must be set to the directory containing the Android NDK."

dist-build/apple-xcframework.sh

@@ -71,6 +71,21 @@ swift_module_map() {
   echo '}'
 }
 
+# Move headers into a Clibsodium subdirectory to avoid module.modulemap collisions
+# when multiple xcframeworks are used together (see swift-sodium issue #276)
+reorganize_headers() {
+  local include_dir="$1"
+  if [ -d "$include_dir" ] && [ ! -d "$include_dir/Clibsodium" ]; then
+    mkdir -p "$include_dir/Clibsodium"
+    # Move all files and directories (except Clibsodium itself) into Clibsodium/
+    for item in "$include_dir"/*; do
+      if [ "$(basename "$item")" != "Clibsodium" ]; then
+        mv "$item" "$include_dir/Clibsodium/"
+      fi
+    done
+  fi
+}
+
 build_macos() {
   export BASEDIR="${XCODEDIR}/Platforms/MacOSX.platform/Developer"
   export PATH="${BASEDIR}/usr/bin:$BASEDIR/usr/sbin:$PATH"
@@ -420,6 +435,7 @@ echo "Bundling macOS targets..."
 
 mkdir -p "${PREFIX}/macos/lib"
 cp -a "${MACOS_X86_64_PREFIX}/include" "${PREFIX}/macos/"
+reorganize_headers "${PREFIX}/macos/include"
 for ext in a dylib; do
   lipo -create \
     "${MACOS_ARM64_PREFIX}/lib/libsodium.${ext}" \
@@ -432,6 +448,7 @@ echo "Bundling iOS targets..."
 
 mkdir -p "${PREFIX}/ios/lib"
 cp -a "${IOS64_PREFIX}/include" "${PREFIX}/ios/"
+reorganize_headers "${PREFIX}/ios/include"
 for ext in a dylib; do
   LIBRARY_PATHS="$IOS64_PREFIX/lib/libsodium.${ext}"
   LIBRARY_PATHS="$LIBRARY_PATHS $IOS64E_PREFIX/lib/libsodium.${ext}"
@@ -444,6 +461,7 @@ echo "Bundling watchOS targets..."
 
 mkdir -p "${PREFIX}/watchos/lib"
 cp -a "${WATCHOS64_32_PREFIX}/include" "${PREFIX}/watchos/"
+reorganize_headers "${PREFIX}/watchos/include"
 for ext in a dylib; do
   lipo -create \
     "${WATCHOS32_PREFIX}/lib/libsodium.${ext}" \
@@ -457,6 +475,7 @@ echo "Bundling tvOS targets..."
 
 mkdir -p "${PREFIX}/tvos/lib"
 cp -a "${TVOS_PREFIX}/include" "${PREFIX}/tvos/"
+reorganize_headers "${PREFIX}/tvos/include"
 for ext in a dylib; do
   lipo -create \
     "$TVOS_PREFIX/lib/libsodium.${ext}" \
@@ -469,6 +488,7 @@ if [ "$VISIONOS_SUPPORTED" = true ]; then
 
   mkdir -p "${PREFIX}/visionos/lib"
   cp -a "${VISIONOS_PREFIX}/include" "${PREFIX}/visionos/"
+  reorganize_headers "${PREFIX}/visionos/include"
   for ext in a dylib; do
     lipo -create \
       "$VISIONOS_PREFIX/lib/libsodium.${ext}" \
@@ -481,6 +501,7 @@ echo "Bundling Catalyst targets..."
 
 mkdir -p "${PREFIX}/catalyst/lib"
 cp -a "${CATALYST_X86_64_PREFIX}/include" "${PREFIX}/catalyst/"
+reorganize_headers "${PREFIX}/catalyst/include"
 for ext in a dylib; do
   if [ ! -f "${CATALYST_X86_64_PREFIX}/lib/libsodium.${ext}" ]; then
     continue
@@ -497,6 +518,7 @@ if [ -z "$LIBSODIUM_SKIP_SIMULATORS" ]; then
 
   mkdir -p "${PREFIX}/ios-simulators/lib"
   cp -a "${IOS_SIMULATOR_X86_64_PREFIX}/include" "${PREFIX}/ios-simulators/"
+  reorganize_headers "${PREFIX}/ios-simulators/include"
   for ext in a dylib; do
     LIBRARY_PATHS="${IOS_SIMULATOR_ARM64_PREFIX}/lib/libsodium.${ext}"
     LIBRARY_PATHS="$LIBRARY_PATHS ${IOS_SIMULATOR_ARM64E_PREFIX}/lib/libsodium.${ext}"
@@ -510,6 +532,7 @@ if [ -z "$LIBSODIUM_SKIP_SIMULATORS" ]; then
 
   mkdir -p "${PREFIX}/watchos-simulators/lib"
   cp -a "${WATCHOS_SIMULATOR_X86_64_PREFIX}/include" "${PREFIX}/watchos-simulators/"
+  reorganize_headers "${PREFIX}/watchos-simulators/include"
   for ext in a dylib; do
     lipo -create \
       "${WATCHOS_SIMULATOR_ARM64_PREFIX}/lib/libsodium.${ext}" \
@@ -523,6 +546,7 @@ if [ -z "$LIBSODIUM_SKIP_SIMULATORS" ]; then
 
   mkdir -p "${PREFIX}/tvos-simulators/lib"
   cp -a "${TVOS_SIMULATOR_X86_64_PREFIX}/include" "${PREFIX}/tvos-simulators/"
+  reorganize_headers "${PREFIX}/tvos-simulators/include"
   for ext in a dylib; do
     lipo -create \
       "${TVOS_SIMULATOR_ARM64_PREFIX}/lib/libsodium.${ext}" \
@@ -536,6 +560,7 @@ if [ -z "$LIBSODIUM_SKIP_SIMULATORS" ]; then
 
     mkdir -p "${PREFIX}/visionos-simulators/lib"
     cp -a "${VISIONOS_SIMULATOR_PREFIX}/include" "${PREFIX}/visionos-simulators/"
+    reorganize_headers "${PREFIX}/visionos-simulators/include"
     for ext in a dylib; do
       lipo -create \
         "${VISIONOS_SIMULATOR_PREFIX}/lib/libsodium.${ext}" \

dist-build/emscripten-symbols.def

@@ -288,6 +288,7 @@ _crypto_ipcrypt_nd_decrypt 1 1
 _crypto_ipcrypt_nd_encrypt 1 1
 _crypto_ipcrypt_nd_inputbytes 1 1
 _crypto_ipcrypt_nd_keybytes 1 1
+_crypto_ipcrypt_nd_keygen 1 1
 _crypto_ipcrypt_nd_outputbytes 1 1
 _crypto_ipcrypt_nd_tweakbytes 1 1
 _crypto_ipcrypt_ndx_decrypt 1 1

dist-build/generate-emscripten-symbols.sh

@@ -2,7 +2,7 @@
 
 set -e
 
-LIBSODIUM=${LIBSODIUM:-/tmp/sodium/lib/libsodium.28.dylib}
+LIBSODIUM=${LIBSODIUM:-/tmp/sodium/lib/libsodium.30.dylib}
 
 symbols() {
   {

packaging/dotnet-core/libsodium.pkgproj

@@ -9,7 +9,7 @@
 
   <PropertyGroup>
     <PackageId>libsodium</PackageId>
-    <Version>1.0.22.0</Version>
+    <Version>1.0.23.0</Version>
     <Authors>Frank Denis</Authors>
     <Description>Internal implementation package not meant for direct consumption. Please do not reference directly.</Description>
     <Copyright>&#169; $([System.DateTime]::UtcNow.ToString(yyyy)) Frank Denis</Copyright>

src/libsodium/Makefile.am

@@ -32,6 +32,8 @@ libsodium_la_SOURCES = \
 	crypto_core/keccak1600/keccak1600.c \
 	crypto_core/keccak1600/ref/keccak1600_ref.c \
 	crypto_core/keccak1600/ref/keccak1600_ref.h \
+	crypto_core/keccak1600/armsha3/keccak1600_armsha3.c \
+	crypto_core/keccak1600/armsha3/keccak1600_armsha3.h \
 	crypto_core/salsa/ref/core_salsa_ref.c \
 	crypto_core/softaes/softaes.c \
 	crypto_generichash/crypto_generichash.c \
@@ -48,6 +50,7 @@ libsodium_la_SOURCES = \
 	crypto_hash/sha256/cp/hash_sha256_cp.c \
 	crypto_hash/sha512/hash_sha512.c \
 	crypto_hash/sha512/cp/hash_sha512_cp.c \
+	crypto_hash/sha3/hash_sha3.c \
 	crypto_ipcrypt/crypto_ipcrypt.c \
 	crypto_ipcrypt/ipcrypt_soft.c \
 	crypto_ipcrypt/ipcrypt_soft.h \
@@ -56,9 +59,11 @@ libsodium_la_SOURCES = \
 	crypto_kdf/crypto_kdf.c \
 	crypto_kdf/hkdf/kdf_hkdf_sha256.c \
 	crypto_kdf/hkdf/kdf_hkdf_sha512.c \
+	crypto_kem/crypto_kem.c \
 	crypto_kem/mlkem768/kem_mlkem768.c \
 	crypto_kem/mlkem768/ref/kem_mlkem768_ref.c \
 	crypto_kem/mlkem768/ref/kem_mlkem768_ref.h \
+	crypto_kem/xwing/kem_xwing.c \
 	crypto_kx/crypto_kx.c \
 	crypto_onetimeauth/crypto_onetimeauth.c \
 	crypto_onetimeauth/poly1305/onetimeauth_poly1305.c \
@@ -72,11 +77,13 @@ libsodium_la_SOURCES = \
 	crypto_pwhash/argon2/argon2-encoding.c \
 	crypto_pwhash/argon2/argon2-encoding.h \
 	crypto_pwhash/argon2/argon2-fill-block-ref.c \
+	crypto_pwhash/argon2/argon2-fill-block-wasm32.c \
 	crypto_pwhash/argon2/argon2.c \
 	crypto_pwhash/argon2/argon2.h \
 	crypto_pwhash/argon2/blake2b-long.c \
 	crypto_pwhash/argon2/blake2b-long.h \
 	crypto_pwhash/argon2/blamka-round-ref.h \
+	crypto_pwhash/argon2/blamka-round-wasm32.h \
 	crypto_pwhash/argon2/pwhash_argon2i.c \
 	crypto_pwhash/argon2/pwhash_argon2id.c \
 	crypto_pwhash/crypto_pwhash.c \
@@ -260,7 +267,9 @@ libarmcrypto_la_SOURCES = \
 	crypto_aead/aegis256/aegis256_armcrypto.h \
 	crypto_aead/aes256gcm/armcrypto/aead_aes256gcm_armcrypto.c \
 	crypto_ipcrypt/ipcrypt_armcrypto.c \
-	crypto_ipcrypt/ipcrypt_armcrypto.h
+	crypto_ipcrypt/ipcrypt_armcrypto.h \
+	crypto_pwhash/argon2/argon2-fill-block-neon.c \
+	crypto_pwhash/argon2/blamka-round-neon.h
 
 libaesni_la_LDFLAGS = $(libsodium_la_LDFLAGS)
 libaesni_la_CPPFLAGS = $(libsodium_la_CPPFLAGS) \

src/libsodium/crypto_aead/aegis128l/aegis128l_common.h

@@ -242,8 +242,12 @@ decrypt_detached(uint8_t *m, const uint8_t *c, size_t clen, const uint8_t *mac,
             ret = crypto_verify_32(computed_mac, mac);
         }
     }
-    if (ret != 0 && m != NULL) {
-        memset(m, 0, mlen);
+    if (ret != 0) {
+        if (m != NULL) {
+            memset(m, 0, mlen);
+        }
+        return ret;
     }
-    return ret;
+    ACQUIRE_FENCE;
+    return 0;
 }

src/libsodium/crypto_aead/aegis256/aegis256_common.h

@@ -225,8 +225,12 @@ decrypt_detached(uint8_t *m, const uint8_t *c, size_t clen, const uint8_t *mac,
             ret = crypto_verify_32(computed_mac, mac);
         }
     }
-    if (ret != 0 && m != NULL) {
-        memset(m, 0, mlen);
+    if (ret != 0) {
+        if (m != NULL) {
+            memset(m, 0, mlen);
+        }
+        return ret;
     }
-    return ret;
+    ACQUIRE_FENCE;
+    return 0;
 }

src/libsodium/crypto_aead/aes256gcm/aesni/aead_aes256gcm_aesni.c

@@ -935,6 +935,7 @@ crypto_aead_aes256gcm_decrypt_detached_afternm(unsigned char *m, unsigned char *
         memset(m, 0xd0, m_len);
         return -1;
     }
+    ACQUIRE_FENCE;
     return 0;
 }
 

src/libsodium/crypto_aead/aes256gcm/armcrypto/aead_aes256gcm_armcrypto.c

@@ -953,6 +953,7 @@ crypto_aead_aes256gcm_decrypt_detached_afternm(unsigned char *m, unsigned char *
         memset(m, 0xd0, m_len);
         return -1;
     }
+    ACQUIRE_FENCE;
     return 0;
 }
 

src/libsodium/crypto_aead/chacha20poly1305/aead_chacha20poly1305.c

@@ -208,6 +208,7 @@ crypto_aead_chacha20poly1305_decrypt_detached(unsigned char *m,
         memset(m, 0, mlen);
         return -1;
     }
+    ACQUIRE_FENCE;
     crypto_stream_chacha20_xor_ic(m, c, mlen, npub, 1U, k);
 
     return 0;
@@ -292,6 +293,7 @@ crypto_aead_chacha20poly1305_ietf_decrypt_detached(unsigned char *m,
         memset(m, 0, mlen);
         return -1;
     }
+    ACQUIRE_FENCE;
     crypto_stream_chacha20_ietf_xor_ic(m, c, mlen, npub, 1U, k);
 
     return 0;

src/libsodium/crypto_aead/xchacha20poly1305/aead_xchacha20poly1305.c

@@ -112,6 +112,7 @@ _decrypt_detached(unsigned char *m,
         memset(m, 0, mlen);
         return -1;
     }
+    ACQUIRE_FENCE;
     crypto_stream_chacha20_ietf_ext_xor_ic(m, c, mlen, npub, 1U, k);
 
     return 0;

src/libsodium/crypto_core/ed25519/core_ed25519.c

@@ -61,7 +61,8 @@ crypto_core_ed25519_sub(unsigned char *r,
 
 static int
 _string_to_points(unsigned char * const px, const size_t n,
-                  const char *ctx, const unsigned char *msg, size_t msg_len,
+                  const unsigned char *ctx, size_t ctx_len,
+                  const unsigned char *msg, size_t msg_len,
                   int hash_alg)
 {
     unsigned char h[crypto_core_ed25519_HASHBYTES];
@@ -71,7 +72,7 @@ _string_to_points(unsigned char * const px, const size_t n,
     if (n > 2U) {
         abort(); /* LCOV_EXCL_LINE */
     }
-    if (core_h2c_string_to_hash(h_be, n * HASH_GE_L, ctx, msg, msg_len,
+    if (core_h2c_string_to_hash(h_be, n * HASH_GE_L, ctx, ctx_len, msg, msg_len,
                                 hash_alg) != 0) {
         return -1;
     }
@@ -88,20 +89,22 @@ _string_to_points(unsigned char * const px, const size_t n,
 
 int
 crypto_core_ed25519_from_string(unsigned char p[crypto_core_ed25519_BYTES],
-                                const char *ctx, const unsigned char *msg,
-                                size_t msg_len, int hash_alg)
+                                const unsigned char *ctx, size_t ctx_len,
+                                const unsigned char *msg, size_t msg_len,
+                                int hash_alg)
 {
-    return _string_to_points(p, 1, ctx, msg, msg_len, hash_alg);
+    return _string_to_points(p, 1, ctx, ctx_len, msg, msg_len, hash_alg);
 }
 
 int
 crypto_core_ed25519_from_string_ro(unsigned char p[crypto_core_ed25519_BYTES],
-                                   const char *ctx, const unsigned char *msg,
-                                   size_t msg_len, int hash_alg)
+                                   const unsigned char *ctx, size_t ctx_len,
+                                   const unsigned char *msg, size_t msg_len,
+                                   int hash_alg)
 {
     unsigned char px[2 * crypto_core_ed25519_BYTES];
 
-    if (_string_to_points(px, 2, ctx, msg, msg_len, hash_alg) != 0) {
+    if (_string_to_points(px, 2, ctx, ctx_len, msg, msg_len, hash_alg) != 0) {
         return -1;
     }
     return crypto_core_ed25519_add(p, &px[0], &px[crypto_core_ed25519_BYTES]);

src/libsodium/crypto_core/ed25519/core_h2c.c

@@ -1,7 +1,6 @@
 #include <assert.h>
 #include <errno.h>
 #include <stdlib.h>
-#include <string.h>
 
 #include "core_h2c.h"
 #include "crypto_hash_sha256.h"
@@ -12,7 +11,8 @@
 #define HASH_BLOCKBYTES 64U
 
 static int
-core_h2c_string_to_hash_sha256(unsigned char *h, const size_t h_len, const char *ctx,
+core_h2c_string_to_hash_sha256(unsigned char *h, const size_t h_len,
+                               const unsigned char *ctx, size_t ctx_len,
                                const unsigned char *msg, size_t msg_len)
 {
     crypto_hash_sha256_state st;
@@ -21,7 +21,6 @@ core_h2c_string_to_hash_sha256(unsigned char *h, const size_t h_len, const char
     unsigned char            ux[HASH_BYTES] = { 0 };
     unsigned char            t[3] = { 0U, (unsigned char) h_len, 0U};
     unsigned char            ctx_len_u8;
-    size_t                   ctx_len = ctx != NULL ? strlen(ctx) : 0U;
     size_t                   i, j;
 
     assert(h_len <= 0xff);
@@ -30,9 +29,9 @@ core_h2c_string_to_hash_sha256(unsigned char *h, const size_t h_len, const char
         crypto_hash_sha256_update(&st,
                                   (const unsigned char *) "H2C-OVERSIZE-DST-",
                                   sizeof "H2C-OVERSIZE-DST-" - 1U);
-        crypto_hash_sha256_update(&st, (const unsigned char *) ctx, ctx_len);
+        crypto_hash_sha256_update(&st, ctx, ctx_len);
         crypto_hash_sha256_final(&st, u0);
-        ctx = (const char *) u0;
+        ctx = u0;
         ctx_len = HASH_BYTES;
         COMPILER_ASSERT(HASH_BYTES <= (size_t) 0xff);
     }
@@ -41,7 +40,7 @@ core_h2c_string_to_hash_sha256(unsigned char *h, const size_t h_len, const char
     crypto_hash_sha256_update(&st, empty_block, sizeof empty_block);
     crypto_hash_sha256_update(&st, msg, msg_len);
     crypto_hash_sha256_update(&st, t, 3U);
-    crypto_hash_sha256_update(&st, (const unsigned char *) ctx, ctx_len);
+    crypto_hash_sha256_update(&st, ctx, ctx_len);
     crypto_hash_sha256_update(&st, &ctx_len_u8, 1U);
     crypto_hash_sha256_final(&st, u0);
 
@@ -53,7 +52,7 @@ core_h2c_string_to_hash_sha256(unsigned char *h, const size_t h_len, const char
         crypto_hash_sha256_init(&st);
         crypto_hash_sha256_update(&st, ux, HASH_BYTES);
         crypto_hash_sha256_update(&st, &t[2], 1U);
-        crypto_hash_sha256_update(&st, (const unsigned char *) ctx, ctx_len);
+        crypto_hash_sha256_update(&st, ctx, ctx_len);
         crypto_hash_sha256_update(&st, &ctx_len_u8, 1U);
         crypto_hash_sha256_final(&st, ux);
         memcpy(&h[i], ux, h_len - i >= (sizeof ux) ? (sizeof ux) : h_len - i);
@@ -68,7 +67,8 @@ core_h2c_string_to_hash_sha256(unsigned char *h, const size_t h_len, const char
 #define HASH_BLOCKBYTES 128U
 
 static int
-core_h2c_string_to_hash_sha512(unsigned char *h, const size_t h_len, const char *ctx,
+core_h2c_string_to_hash_sha512(unsigned char *h, const size_t h_len,
+                               const unsigned char *ctx, size_t ctx_len,
                                const unsigned char *msg, size_t msg_len)
 {
     crypto_hash_sha512_state st;
@@ -77,7 +77,6 @@ core_h2c_string_to_hash_sha512(unsigned char *h, const size_t h_len, const char
     unsigned char            ux[HASH_BYTES] = { 0 };
     unsigned char            t[3] = { 0U, (unsigned char) h_len, 0U};
     unsigned char            ctx_len_u8;
-    size_t                   ctx_len = ctx != NULL ? strlen(ctx) : 0U;
     size_t                   i, j;
 
     assert(h_len <= 0xff);
@@ -86,9 +85,9 @@ core_h2c_string_to_hash_sha512(unsigned char *h, const size_t h_len, const char
         crypto_hash_sha512_update(&st,
                                   (const unsigned char *) "H2C-OVERSIZE-DST-",
                                   sizeof "H2C-OVERSIZE-DST-" - 1U);
-        crypto_hash_sha512_update(&st, (const unsigned char *) ctx, ctx_len);
+        crypto_hash_sha512_update(&st, ctx, ctx_len);
         crypto_hash_sha512_final(&st, u0);
-        ctx = (const char *) u0;
+        ctx = u0;
         ctx_len = HASH_BYTES;
         COMPILER_ASSERT(HASH_BYTES <= (size_t) 0xff);
     }
@@ -97,7 +96,7 @@ core_h2c_string_to_hash_sha512(unsigned char *h, const size_t h_len, const char
     crypto_hash_sha512_update(&st, empty_block, sizeof empty_block);
     crypto_hash_sha512_update(&st, msg, msg_len);
     crypto_hash_sha512_update(&st, t, 3U);
-    crypto_hash_sha512_update(&st, (const unsigned char *) ctx, ctx_len);
+    crypto_hash_sha512_update(&st, ctx, ctx_len);
     crypto_hash_sha512_update(&st, &ctx_len_u8, 1U);
     crypto_hash_sha512_final(&st, u0);
 
@@ -109,7 +108,7 @@ core_h2c_string_to_hash_sha512(unsigned char *h, const size_t h_len, const char
         crypto_hash_sha512_init(&st);
         crypto_hash_sha512_update(&st, ux, HASH_BYTES);
         crypto_hash_sha512_update(&st, &t[2], 1U);
-        crypto_hash_sha512_update(&st, (const unsigned char *) ctx, ctx_len);
+        crypto_hash_sha512_update(&st, ctx, ctx_len);
         crypto_hash_sha512_update(&st, &ctx_len_u8, 1U);
         crypto_hash_sha512_final(&st, ux);
         memcpy(&h[i], ux, h_len - i >= (sizeof ux) ? (sizeof ux) : h_len - i);
@@ -118,14 +117,15 @@ core_h2c_string_to_hash_sha512(unsigned char *h, const size_t h_len, const char
 }
 
 int
-core_h2c_string_to_hash(unsigned char *h, const size_t h_len, const char *ctx,
+core_h2c_string_to_hash(unsigned char *h, const size_t h_len,
+                        const unsigned char *ctx, size_t ctx_len,
                         const unsigned char *msg, size_t msg_len, int hash_alg)
 {
     switch (hash_alg) {
     case CORE_H2C_SHA256:
-        return core_h2c_string_to_hash_sha256(h, h_len, ctx, msg, msg_len);
+        return core_h2c_string_to_hash_sha256(h, h_len, ctx, ctx_len, msg, msg_len);
     case CORE_H2C_SHA512:
-        return core_h2c_string_to_hash_sha512(h, h_len, ctx, msg, msg_len);
+        return core_h2c_string_to_hash_sha512(h, h_len, ctx, ctx_len, msg, msg_len);
     default:
         errno = EINVAL;
         return -1;

src/libsodium/crypto_core/ed25519/core_h2c.h

@@ -6,7 +6,8 @@
 #define CORE_H2C_SHA256 1
 #define CORE_H2C_SHA512 2
 
-int core_h2c_string_to_hash(unsigned char *h, const size_t h_len, const char *ctx,
+int core_h2c_string_to_hash(unsigned char *h, const size_t h_len,
+                            const unsigned char *ctx, size_t ctx_len,
                             const unsigned char *msg, size_t msg_len,
                             int hash_alg);
 #endif

src/libsodium/crypto_core/ed25519/core_ristretto255.c

@@ -65,12 +65,13 @@ crypto_core_ristretto255_from_hash(unsigned char *p, const unsigned char *r)
 
 static int
 _string_to_element(unsigned char *p,
-                   const char *ctx, const unsigned char *msg, size_t msg_len,
+                   const unsigned char *ctx, size_t ctx_len,
+                   const unsigned char *msg, size_t msg_len,
                    int hash_alg)
 {
     unsigned char h[crypto_core_ristretto255_HASHBYTES];
 
-    if (core_h2c_string_to_hash(h, sizeof h, ctx, msg, msg_len,
+    if (core_h2c_string_to_hash(h, sizeof h, ctx, ctx_len, msg, msg_len,
                                 hash_alg) != 0) {
         return -1;
     }
@@ -81,18 +82,20 @@ _string_to_element(unsigned char *p,
 
 int
 crypto_core_ristretto255_from_string(unsigned char p[crypto_core_ristretto255_BYTES],
-                                     const char *ctx, const unsigned char *msg,
-                                     size_t msg_len, int hash_alg)
+                                     const unsigned char *ctx, size_t ctx_len,
+                                     const unsigned char *msg, size_t msg_len,
+                                     int hash_alg)
 {
-    return _string_to_element(p, ctx, msg, msg_len, hash_alg);
+    return _string_to_element(p, ctx, ctx_len, msg, msg_len, hash_alg);
 }
 
 int
 crypto_core_ristretto255_from_string_ro(unsigned char p[crypto_core_ristretto255_BYTES],
-                                        const char *ctx, const unsigned char *msg,
-                                        size_t msg_len, int hash_alg)
+                                        const unsigned char *ctx, size_t ctx_len,
+                                        const unsigned char *msg, size_t msg_len,
+                                        int hash_alg)
 {
-    return crypto_core_ristretto255_from_string(p, ctx, msg, msg_len, hash_alg);
+    return crypto_core_ristretto255_from_string(p, ctx, ctx_len, msg, msg_len, hash_alg);
 }
 
 void
@@ -169,14 +172,15 @@ crypto_core_ristretto255_scalar_is_canonical(const unsigned char *s)
 
 int
 crypto_core_ristretto255_scalar_from_string(unsigned char *s,
-                                            const char *ctx, const unsigned char *msg,
-                                            size_t msg_len, int hash_alg)
+                                            const unsigned char *ctx, size_t ctx_len,
+                                            const unsigned char *msg, size_t msg_len,
+                                            int hash_alg)
 {
     unsigned char h[crypto_core_ristretto255_NONREDUCEDSCALARBYTES];
     unsigned char h_be[HASH_SC_L];
     size_t        i;
 
-    if (core_h2c_string_to_hash(h_be, sizeof h_be, ctx, msg, msg_len,
+    if (core_h2c_string_to_hash(h_be, sizeof h_be, ctx, ctx_len, msg, msg_len,
                                 hash_alg) != 0) {
         return -1;
     }

src/libsodium/crypto_core/keccak1600/armsha3/keccak1600_armsha3.c

@@ -0,0 +1,276 @@
+#include <stdint.h>
+#include <string.h>
+
+#include "keccak1600_armsha3.h"
+#include "private/common.h"
+
+#if defined(__ARM_FEATURE_SHA3)
+
+#include <arm_neon.h>
+
+#ifdef __clang__
+# pragma clang attribute push(__attribute__((target("neon,sha3"))), apply_to = function)
+#elif defined(__GNUC__)
+# pragma GCC target("+simd+sha3")
+#endif
+
+#define KECCAK1600_STATEBYTES 200
+
+static const uint64_t RC[24] = {
+    0x0000000000000001ULL, 0x0000000000008082ULL, 0x800000000000808aULL, 0x8000000080008000ULL,
+    0x000000000000808bULL, 0x0000000080000001ULL, 0x8000000080008081ULL, 0x8000000000008009ULL,
+    0x000000000000008aULL, 0x0000000000000088ULL, 0x0000000080008009ULL, 0x000000008000000aULL,
+    0x000000008000808bULL, 0x800000000000008bULL, 0x8000000000008089ULL, 0x8000000000008003ULL,
+    0x8000000000008002ULL, 0x8000000000000080ULL, 0x000000000000800aULL, 0x800000008000000aULL,
+    0x8000000080008081ULL, 0x8000000000008080ULL, 0x0000000080000001ULL, 0x8000000080008008ULL
+};
+
+#define ROUND(A, E, rc_idx)                                                    \
+    do {                                                                       \
+        uint64x2_t rc = vdupq_n_u64(RC[rc_idx]);                               \
+        Ca = veor3q_u64(A##ba, veor3q_u64(A##ga, A##ka, A##ma), A##sa);        \
+        Ce = veor3q_u64(A##be, veor3q_u64(A##ge, A##ke, A##me), A##se);        \
+        Ci = veor3q_u64(A##bi, veor3q_u64(A##gi, A##ki, A##mi), A##si);        \
+        Co = veor3q_u64(A##bo, veor3q_u64(A##go, A##ko, A##mo), A##so);        \
+        Cu = veor3q_u64(A##bu, veor3q_u64(A##gu, A##ku, A##mu), A##su);        \
+        Da = vrax1q_u64(Cu, Ce);                                               \
+        De = vrax1q_u64(Ca, Ci);                                               \
+        Di = vrax1q_u64(Ce, Co);                                               \
+        Do = vrax1q_u64(Ci, Cu);                                               \
+        Du = vrax1q_u64(Co, Ca);                                               \
+        Ba = veorq_u64(A##ba, Da);                                             \
+        Be = vxarq_u64(A##ge, De, 64 - 44);                                    \
+        Bi = vxarq_u64(A##ki, Di, 64 - 43);                                    \
+        Bo = vxarq_u64(A##mo, Do, 64 - 21);                                    \
+        Bu = vxarq_u64(A##su, Du, 64 - 14);                                    \
+        E##ba = veorq_u64(vbcaxq_u64(Ba, Bi, Be), rc);                         \
+        E##be = vbcaxq_u64(Be, Bo, Bi);                                        \
+        E##bi = vbcaxq_u64(Bi, Bu, Bo);                                        \
+        E##bo = vbcaxq_u64(Bo, Ba, Bu);                                        \
+        E##bu = vbcaxq_u64(Bu, Be, Ba);                                        \
+        Ba = vxarq_u64(A##bo, Do, 64 - 28);                                    \
+        Be = vxarq_u64(A##gu, Du, 64 - 20);                                    \
+        Bi = vxarq_u64(A##ka, Da, 64 - 3);                                     \
+        Bo = vxarq_u64(A##me, De, 64 - 45);                                    \
+        Bu = vxarq_u64(A##si, Di, 64 - 61);                                    \
+        E##ga = vbcaxq_u64(Ba, Bi, Be);                                        \
+        E##ge = vbcaxq_u64(Be, Bo, Bi);                                        \
+        E##gi = vbcaxq_u64(Bi, Bu, Bo);                                        \
+        E##go = vbcaxq_u64(Bo, Ba, Bu);                                        \
+        E##gu = vbcaxq_u64(Bu, Be, Ba);                                        \
+        Ba = vxarq_u64(A##be, De, 64 - 1);                                     \
+        Be = vxarq_u64(A##gi, Di, 64 - 6);                                     \
+        Bi = vxarq_u64(A##ko, Do, 64 - 25);                                    \
+        Bo = vxarq_u64(A##mu, Du, 64 - 8);                                     \
+        Bu = vxarq_u64(A##sa, Da, 64 - 18);                                    \
+        E##ka = vbcaxq_u64(Ba, Bi, Be);                                        \
+        E##ke = vbcaxq_u64(Be, Bo, Bi);                                        \
+        E##ki = vbcaxq_u64(Bi, Bu, Bo);                                        \
+        E##ko = vbcaxq_u64(Bo, Ba, Bu);                                        \
+        E##ku = vbcaxq_u64(Bu, Be, Ba);                                        \
+        Ba = vxarq_u64(A##bu, Du, 64 - 27);                                    \
+        Be = vxarq_u64(A##ga, Da, 64 - 36);                                    \
+        Bi = vxarq_u64(A##ke, De, 64 - 10);                                    \
+        Bo = vxarq_u64(A##mi, Di, 64 - 15);                                    \
+        Bu = vxarq_u64(A##so, Do, 64 - 56);                                    \
+        E##ma = vbcaxq_u64(Ba, Bi, Be);                                        \
+        E##me = vbcaxq_u64(Be, Bo, Bi);                                        \
+        E##mi = vbcaxq_u64(Bi, Bu, Bo);                                        \
+        E##mo = vbcaxq_u64(Bo, Ba, Bu);                                        \
+        E##mu = vbcaxq_u64(Bu, Be, Ba);                                        \
+        Ba = vxarq_u64(A##bi, Di, 64 - 62);                                    \
+        Be = vxarq_u64(A##go, Do, 64 - 55);                                    \
+        Bi = vxarq_u64(A##ku, Du, 64 - 39);                                    \
+        Bo = vxarq_u64(A##ma, Da, 64 - 41);                                    \
+        Bu = vxarq_u64(A##se, De, 64 - 2);                                     \
+        E##sa = vbcaxq_u64(Ba, Bi, Be);                                        \
+        E##se = vbcaxq_u64(Be, Bo, Bi);                                        \
+        E##si = vbcaxq_u64(Bi, Bu, Bo);                                        \
+        E##so = vbcaxq_u64(Bo, Ba, Bu);                                        \
+        E##su = vbcaxq_u64(Bu, Be, Ba);                                        \
+    } while (0)
+
+static void
+keccakf_24_rounds(uint64_t st[25])
+{
+    uint64x2_t Aba, Abe, Abi, Abo, Abu;
+    uint64x2_t Aga, Age, Agi, Ago, Agu;
+    uint64x2_t Aka, Ake, Aki, Ako, Aku;
+    uint64x2_t Ama, Ame, Ami, Amo, Amu;
+    uint64x2_t Asa, Ase, Asi, Aso, Asu;
+    uint64x2_t Eba, Ebe, Ebi, Ebo, Ebu;
+    uint64x2_t Ega, Ege, Egi, Ego, Egu;
+    uint64x2_t Eka, Eke, Eki, Eko, Eku;
+    uint64x2_t Ema, Eme, Emi, Emo, Emu;
+    uint64x2_t Esa, Ese, Esi, Eso, Esu;
+    uint64x2_t Ca, Ce, Ci, Co, Cu;
+    uint64x2_t Da, De, Di, Do, Du;
+    uint64x2_t Ba, Be, Bi, Bo, Bu;
+
+    Aba = vdupq_n_u64(st[0]);  Abe = vdupq_n_u64(st[1]);
+    Abi = vdupq_n_u64(st[2]);  Abo = vdupq_n_u64(st[3]);
+    Abu = vdupq_n_u64(st[4]);
+    Aga = vdupq_n_u64(st[5]);  Age = vdupq_n_u64(st[6]);
+    Agi = vdupq_n_u64(st[7]);  Ago = vdupq_n_u64(st[8]);
+    Agu = vdupq_n_u64(st[9]);
+    Aka = vdupq_n_u64(st[10]); Ake = vdupq_n_u64(st[11]);
+    Aki = vdupq_n_u64(st[12]); Ako = vdupq_n_u64(st[13]);
+    Aku = vdupq_n_u64(st[14]);
+    Ama = vdupq_n_u64(st[15]); Ame = vdupq_n_u64(st[16]);
+    Ami = vdupq_n_u64(st[17]); Amo = vdupq_n_u64(st[18]);
+    Amu = vdupq_n_u64(st[19]);
+    Asa = vdupq_n_u64(st[20]); Ase = vdupq_n_u64(st[21]);
+    Asi = vdupq_n_u64(st[22]); Aso = vdupq_n_u64(st[23]);
+    Asu = vdupq_n_u64(st[24]);
+
+    ROUND(A, E, 0);  ROUND(E, A, 1);
+    ROUND(A, E, 2);  ROUND(E, A, 3);
+    ROUND(A, E, 4);  ROUND(E, A, 5);
+    ROUND(A, E, 6);  ROUND(E, A, 7);
+    ROUND(A, E, 8);  ROUND(E, A, 9);
+    ROUND(A, E, 10); ROUND(E, A, 11);
+    ROUND(A, E, 12); ROUND(E, A, 13);
+    ROUND(A, E, 14); ROUND(E, A, 15);
+    ROUND(A, E, 16); ROUND(E, A, 17);
+    ROUND(A, E, 18); ROUND(E, A, 19);
+    ROUND(A, E, 20); ROUND(E, A, 21);
+    ROUND(A, E, 22); ROUND(E, A, 23);
+
+    st[0]  = vgetq_lane_u64(Aba, 0); st[1]  = vgetq_lane_u64(Abe, 0);
+    st[2]  = vgetq_lane_u64(Abi, 0); st[3]  = vgetq_lane_u64(Abo, 0);
+    st[4]  = vgetq_lane_u64(Abu, 0);
+    st[5]  = vgetq_lane_u64(Aga, 0); st[6]  = vgetq_lane_u64(Age, 0);
+    st[7]  = vgetq_lane_u64(Agi, 0); st[8]  = vgetq_lane_u64(Ago, 0);
+    st[9]  = vgetq_lane_u64(Agu, 0);
+    st[10] = vgetq_lane_u64(Aka, 0); st[11] = vgetq_lane_u64(Ake, 0);
+    st[12] = vgetq_lane_u64(Aki, 0); st[13] = vgetq_lane_u64(Ako, 0);
+    st[14] = vgetq_lane_u64(Aku, 0);
+    st[15] = vgetq_lane_u64(Ama, 0); st[16] = vgetq_lane_u64(Ame, 0);
+    st[17] = vgetq_lane_u64(Ami, 0); st[18] = vgetq_lane_u64(Amo, 0);
+    st[19] = vgetq_lane_u64(Amu, 0);
+    st[20] = vgetq_lane_u64(Asa, 0); st[21] = vgetq_lane_u64(Ase, 0);
+    st[22] = vgetq_lane_u64(Asi, 0); st[23] = vgetq_lane_u64(Aso, 0);
+    st[24] = vgetq_lane_u64(Asu, 0);
+}
+
+static void
+keccakf_12_rounds(uint64_t st[25])
+{
+    uint64x2_t Aba, Abe, Abi, Abo, Abu;
+    uint64x2_t Aga, Age, Agi, Ago, Agu;
+    uint64x2_t Aka, Ake, Aki, Ako, Aku;
+    uint64x2_t Ama, Ame, Ami, Amo, Amu;
+    uint64x2_t Asa, Ase, Asi, Aso, Asu;
+    uint64x2_t Eba, Ebe, Ebi, Ebo, Ebu;
+    uint64x2_t Ega, Ege, Egi, Ego, Egu;
+    uint64x2_t Eka, Eke, Eki, Eko, Eku;
+    uint64x2_t Ema, Eme, Emi, Emo, Emu;
+    uint64x2_t Esa, Ese, Esi, Eso, Esu;
+    uint64x2_t Ca, Ce, Ci, Co, Cu;
+    uint64x2_t Da, De, Di, Do, Du;
+    uint64x2_t Ba, Be, Bi, Bo, Bu;
+
+    Aba = vdupq_n_u64(st[0]);  Abe = vdupq_n_u64(st[1]);
+    Abi = vdupq_n_u64(st[2]);  Abo = vdupq_n_u64(st[3]);
+    Abu = vdupq_n_u64(st[4]);
+    Aga = vdupq_n_u64(st[5]);  Age = vdupq_n_u64(st[6]);
+    Agi = vdupq_n_u64(st[7]);  Ago = vdupq_n_u64(st[8]);
+    Agu = vdupq_n_u64(st[9]);
+    Aka = vdupq_n_u64(st[10]); Ake = vdupq_n_u64(st[11]);
+    Aki = vdupq_n_u64(st[12]); Ako = vdupq_n_u64(st[13]);
+    Aku = vdupq_n_u64(st[14]);
+    Ama = vdupq_n_u64(st[15]); Ame = vdupq_n_u64(st[16]);
+    Ami = vdupq_n_u64(st[17]); Amo = vdupq_n_u64(st[18]);
+    Amu = vdupq_n_u64(st[19]);
+    Asa = vdupq_n_u64(st[20]); Ase = vdupq_n_u64(st[21]);
+    Asi = vdupq_n_u64(st[22]); Aso = vdupq_n_u64(st[23]);
+    Asu = vdupq_n_u64(st[24]);
+
+    ROUND(A, E, 12); ROUND(E, A, 13);
+    ROUND(A, E, 14); ROUND(E, A, 15);
+    ROUND(A, E, 16); ROUND(E, A, 17);
+    ROUND(A, E, 18); ROUND(E, A, 19);
+    ROUND(A, E, 20); ROUND(E, A, 21);
+    ROUND(A, E, 22); ROUND(E, A, 23);
+
+    st[0]  = vgetq_lane_u64(Aba, 0); st[1]  = vgetq_lane_u64(Abe, 0);
+    st[2]  = vgetq_lane_u64(Abi, 0); st[3]  = vgetq_lane_u64(Abo, 0);
+    st[4]  = vgetq_lane_u64(Abu, 0);
+    st[5]  = vgetq_lane_u64(Aga, 0); st[6]  = vgetq_lane_u64(Age, 0);
+    st[7]  = vgetq_lane_u64(Agi, 0); st[8]  = vgetq_lane_u64(Ago, 0);
+    st[9]  = vgetq_lane_u64(Agu, 0);
+    st[10] = vgetq_lane_u64(Aka, 0); st[11] = vgetq_lane_u64(Ake, 0);
+    st[12] = vgetq_lane_u64(Aki, 0); st[13] = vgetq_lane_u64(Ako, 0);
+    st[14] = vgetq_lane_u64(Aku, 0);
+    st[15] = vgetq_lane_u64(Ama, 0); st[16] = vgetq_lane_u64(Ame, 0);
+    st[17] = vgetq_lane_u64(Ami, 0); st[18] = vgetq_lane_u64(Amo, 0);
+    st[19] = vgetq_lane_u64(Amu, 0);
+    st[20] = vgetq_lane_u64(Asa, 0); st[21] = vgetq_lane_u64(Ase, 0);
+    st[22] = vgetq_lane_u64(Asi, 0); st[23] = vgetq_lane_u64(Aso, 0);
+    st[24] = vgetq_lane_u64(Asu, 0);
+}
+
+void
+keccak1600_armsha3_permute_24(void *state)
+{
+    uint64_t     st[25];
+    unsigned int i;
+
+    for (i = 0U; i < 25U; i++) {
+        st[i] = LOAD64_LE((const unsigned char *) state + i * 8U);
+    }
+
+    keccakf_24_rounds(st);
+
+    for (i = 0U; i < 25U; i++) {
+        STORE64_LE((unsigned char *) state + i * 8U, st[i]);
+    }
+}
+
+void
+keccak1600_armsha3_permute_12(void *state)
+{
+    uint64_t     st[25];
+    unsigned int i;
+
+    for (i = 0U; i < 25U; i++) {
+        st[i] = LOAD64_LE((const unsigned char *) state + i * 8U);
+    }
+
+    keccakf_12_rounds(st);
+
+    for (i = 0U; i < 25U; i++) {
+        STORE64_LE((unsigned char *) state + i * 8U, st[i]);
+    }
+}
+
+void
+keccak1600_armsha3_init(void *state)
+{
+    memset(state, 0, KECCAK1600_STATEBYTES);
+}
+
+void
+keccak1600_armsha3_xor_bytes(void *state, const unsigned char *data, size_t offset, size_t length)
+{
+    unsigned char *st = (unsigned char *) state;
+    size_t         i;
+
+    for (i = 0U; i < length; i++) {
+        st[offset + i] ^= data[i];
+    }
+}
+
+void
+keccak1600_armsha3_extract_bytes(const void *state, unsigned char *data, size_t offset, size_t length)
+{
+    const unsigned char *st = (const unsigned char *) state;
+
+    memcpy(data, st + offset, length);
+}
+
+#ifdef __clang__
+# pragma clang attribute pop
+#endif
+
+#endif /* __ARM_FEATURE_SHA3 */

src/libsodium/crypto_core/keccak1600/armsha3/keccak1600_armsha3.h

@@ -0,0 +1,20 @@
+#ifndef keccak1600_armsha3_H
+#define keccak1600_armsha3_H
+
+#include <stddef.h>
+
+#include "private/quirks.h"
+
+void keccak1600_armsha3_init(void *state);
+
+void keccak1600_armsha3_xor_bytes(void *state, const unsigned char *bytes,
+                                  size_t offset, size_t length);
+
+void keccak1600_armsha3_extract_bytes(const void *state, unsigned char *bytes,
+                                      size_t offset, size_t length);
+
+void keccak1600_armsha3_permute_24(void *state);
+
+void keccak1600_armsha3_permute_12(void *state);
+
+#endif /* keccak1600_armsha3_H */

src/libsodium/crypto_core/keccak1600/keccak1600.c

@@ -1,6 +1,21 @@
 #include "crypto_core_keccak1600.h"
 #include "ref/keccak1600_ref.h"
 
+#ifdef __ARM_FEATURE_SHA3
+# include "armsha3/keccak1600_armsha3.h"
+# define keccak1600_init          keccak1600_armsha3_init
+# define keccak1600_xor_bytes     keccak1600_armsha3_xor_bytes
+# define keccak1600_extract_bytes keccak1600_armsha3_extract_bytes
+# define keccak1600_permute_24    keccak1600_armsha3_permute_24
+# define keccak1600_permute_12    keccak1600_armsha3_permute_12
+#else
+# define keccak1600_init          keccak1600_ref_init
+# define keccak1600_xor_bytes     keccak1600_ref_xor_bytes
+# define keccak1600_extract_bytes keccak1600_ref_extract_bytes
+# define keccak1600_permute_24    keccak1600_ref_permute_24
+# define keccak1600_permute_12    keccak1600_ref_permute_12
+#endif
+
 size_t
 crypto_core_keccak1600_statebytes(void)
 {
@@ -10,7 +25,7 @@ crypto_core_keccak1600_statebytes(void)
 void
 crypto_core_keccak1600_init(crypto_core_keccak1600_state *state)
 {
-    keccak1600_ref_init(state->opaque);
+    keccak1600_init(state->opaque);
 }
 
 void
@@ -18,7 +33,7 @@ crypto_core_keccak1600_xor_bytes(crypto_core_keccak1600_state *state,
                                  const unsigned char *bytes, size_t offset,
                                  size_t length)
 {
-    keccak1600_ref_xor_bytes(state->opaque, bytes, offset, length);
+    keccak1600_xor_bytes(state->opaque, bytes, offset, length);
 }
 
 void
@@ -26,17 +41,17 @@ crypto_core_keccak1600_extract_bytes(const crypto_core_keccak1600_state *state,
                                      unsigned char *bytes, size_t offset,
                                      size_t length)
 {
-    keccak1600_ref_extract_bytes(state->opaque, bytes, offset, length);
+    keccak1600_extract_bytes(state->opaque, bytes, offset, length);
 }
 
 void
 crypto_core_keccak1600_permute_24(crypto_core_keccak1600_state *state)
 {
-    keccak1600_ref_permute_24(state->opaque);
+    keccak1600_permute_24(state->opaque);
 }
 
 void
 crypto_core_keccak1600_permute_12(crypto_core_keccak1600_state *state)
 {
-    keccak1600_ref_permute_12(state->opaque);
+    keccak1600_permute_12(state->opaque);
 }

src/libsodium/crypto_hash/sha256/cp/hash_sha256_cp.c

@@ -37,6 +37,11 @@
 #include "private/common.h"
 #include "utils.h"
 
+#if defined(__aarch64__) && defined(__ARM_FEATURE_SHA2)
+# define HAVE_SHA256_ARMCRYPTO 1
+# include <arm_neon.h>
+#endif
+
 static void
 be32enc_vect(unsigned char *dst, const uint32_t *src, size_t len)
 {
@@ -47,6 +52,158 @@ be32enc_vect(unsigned char *dst, const uint32_t *src, size_t len)
     }
 }
 
+#ifdef HAVE_SHA256_ARMCRYPTO
+
+static const uint32_t Krnd[64] = {
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1,
+    0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
+    0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786,
+    0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,
+    0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
+    0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b,
+    0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a,
+    0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
+    0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
+};
+
+static void
+SHA256_Transform(uint32_t state[8], const uint8_t block[64], uint32_t W[64],
+                 uint32_t S[8])
+{
+    uint32x4_t STATE0, STATE1;
+    uint32x4_t ABCD_SAVE, EFGH_SAVE;
+    uint32x4_t MSG0, MSG1, MSG2, MSG3;
+    uint32x4_t TMP0, TMP1, TMP2;
+
+    (void) W;
+    (void) S;
+
+    STATE0 = vld1q_u32(&state[0]);
+    STATE1 = vld1q_u32(&state[4]);
+
+    ABCD_SAVE = STATE0;
+    EFGH_SAVE = STATE1;
+
+    MSG0 = vreinterpretq_u32_u8(vrev32q_u8(vld1q_u8(&block[0])));
+    MSG1 = vreinterpretq_u32_u8(vrev32q_u8(vld1q_u8(&block[16])));
+    MSG2 = vreinterpretq_u32_u8(vrev32q_u8(vld1q_u8(&block[32])));
+    MSG3 = vreinterpretq_u32_u8(vrev32q_u8(vld1q_u8(&block[48])));
+
+    TMP0 = vaddq_u32(MSG0, vld1q_u32(&Krnd[0]));
+    TMP2 = STATE0;
+    STATE0 = vsha256hq_u32(STATE0, STATE1, TMP0);
+    STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP0);
+    MSG0 = vsha256su0q_u32(MSG0, MSG1);
+
+    TMP1 = vaddq_u32(MSG1, vld1q_u32(&Krnd[4]));
+    TMP2 = STATE0;
+    STATE0 = vsha256hq_u32(STATE0, STATE1, TMP1);
+    STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP1);
+    MSG0 = vsha256su1q_u32(MSG0, MSG2, MSG3);
+    MSG1 = vsha256su0q_u32(MSG1, MSG2);
+
+    TMP0 = vaddq_u32(MSG2, vld1q_u32(&Krnd[8]));
+    TMP2 = STATE0;
+    STATE0 = vsha256hq_u32(STATE0, STATE1, TMP0);
+    STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP0);
+    MSG1 = vsha256su1q_u32(MSG1, MSG3, MSG0);
+    MSG2 = vsha256su0q_u32(MSG2, MSG3);
+
+    TMP1 = vaddq_u32(MSG3, vld1q_u32(&Krnd[12]));
+    TMP2 = STATE0;
+    STATE0 = vsha256hq_u32(STATE0, STATE1, TMP1);
+    STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP1);
+    MSG2 = vsha256su1q_u32(MSG2, MSG0, MSG1);
+    MSG3 = vsha256su0q_u32(MSG3, MSG0);
+
+    TMP0 = vaddq_u32(MSG0, vld1q_u32(&Krnd[16]));
+    TMP2 = STATE0;
+    STATE0 = vsha256hq_u32(STATE0, STATE1, TMP0);
+    STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP0);
+    MSG3 = vsha256su1q_u32(MSG3, MSG1, MSG2);
+    MSG0 = vsha256su0q_u32(MSG0, MSG1);
+
+    TMP1 = vaddq_u32(MSG1, vld1q_u32(&Krnd[20]));
+    TMP2 = STATE0;
+    STATE0 = vsha256hq_u32(STATE0, STATE1, TMP1);
+    STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP1);
+    MSG0 = vsha256su1q_u32(MSG0, MSG2, MSG3);
+    MSG1 = vsha256su0q_u32(MSG1, MSG2);
+
+    TMP0 = vaddq_u32(MSG2, vld1q_u32(&Krnd[24]));
+    TMP2 = STATE0;
+    STATE0 = vsha256hq_u32(STATE0, STATE1, TMP0);
+    STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP0);
+    MSG1 = vsha256su1q_u32(MSG1, MSG3, MSG0);
+    MSG2 = vsha256su0q_u32(MSG2, MSG3);
+
+    TMP1 = vaddq_u32(MSG3, vld1q_u32(&Krnd[28]));
+    TMP2 = STATE0;
+    STATE0 = vsha256hq_u32(STATE0, STATE1, TMP1);
+    STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP1);
+    MSG2 = vsha256su1q_u32(MSG2, MSG0, MSG1);
+    MSG3 = vsha256su0q_u32(MSG3, MSG0);
+
+    TMP0 = vaddq_u32(MSG0, vld1q_u32(&Krnd[32]));
+    TMP2 = STATE0;
+    STATE0 = vsha256hq_u32(STATE0, STATE1, TMP0);
+    STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP0);
+    MSG3 = vsha256su1q_u32(MSG3, MSG1, MSG2);
+    MSG0 = vsha256su0q_u32(MSG0, MSG1);
+
+    TMP1 = vaddq_u32(MSG1, vld1q_u32(&Krnd[36]));
+    TMP2 = STATE0;
+    STATE0 = vsha256hq_u32(STATE0, STATE1, TMP1);
+    STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP1);
+    MSG0 = vsha256su1q_u32(MSG0, MSG2, MSG3);
+    MSG1 = vsha256su0q_u32(MSG1, MSG2);
+
+    TMP0 = vaddq_u32(MSG2, vld1q_u32(&Krnd[40]));
+    TMP2 = STATE0;
+    STATE0 = vsha256hq_u32(STATE0, STATE1, TMP0);
+    STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP0);
+    MSG1 = vsha256su1q_u32(MSG1, MSG3, MSG0);
+    MSG2 = vsha256su0q_u32(MSG2, MSG3);
+
+    TMP1 = vaddq_u32(MSG3, vld1q_u32(&Krnd[44]));
+    TMP2 = STATE0;
+    STATE0 = vsha256hq_u32(STATE0, STATE1, TMP1);
+    STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP1);
+    MSG2 = vsha256su1q_u32(MSG2, MSG0, MSG1);
+    MSG3 = vsha256su0q_u32(MSG3, MSG0);
+
+    TMP0 = vaddq_u32(MSG0, vld1q_u32(&Krnd[48]));
+    TMP2 = STATE0;
+    STATE0 = vsha256hq_u32(STATE0, STATE1, TMP0);
+    STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP0);
+    MSG3 = vsha256su1q_u32(MSG3, MSG1, MSG2);
+
+    TMP1 = vaddq_u32(MSG1, vld1q_u32(&Krnd[52]));
+    TMP2 = STATE0;
+    STATE0 = vsha256hq_u32(STATE0, STATE1, TMP1);
+    STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP1);
+
+    TMP0 = vaddq_u32(MSG2, vld1q_u32(&Krnd[56]));
+    TMP2 = STATE0;
+    STATE0 = vsha256hq_u32(STATE0, STATE1, TMP0);
+    STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP0);
+
+    TMP1 = vaddq_u32(MSG3, vld1q_u32(&Krnd[60]));
+    TMP2 = STATE0;
+    STATE0 = vsha256hq_u32(STATE0, STATE1, TMP1);
+    STATE1 = vsha256h2q_u32(STATE1, TMP2, TMP1);
+
+    STATE0 = vaddq_u32(STATE0, ABCD_SAVE);
+    STATE1 = vaddq_u32(STATE1, EFGH_SAVE);
+
+    vst1q_u32(&state[0], STATE0);
+    vst1q_u32(&state[4], STATE1);
+}
+
+#else
+
 static void
 be32dec_vect(uint32_t *dst, const unsigned char *src, size_t len)
 {
@@ -144,6 +301,8 @@ SHA256_Transform(uint32_t state[8], const uint8_t block[64], uint32_t W[64],
     }
 }
 
+#endif
+
 static const uint8_t PAD[64] = { 0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
                                  0,    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
                                  0,    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,

src/libsodium/crypto_hash/sha3/hash_sha3.c

@@ -0,0 +1,175 @@
+#include <stdint.h>
+#include <string.h>
+
+#include "crypto_core_keccak1600.h"
+#include "crypto_hash_sha3.h"
+#include "private/common.h"
+#include "utils.h"
+
+#define SHA3_256_RATE 136
+#define SHA3_512_RATE 72
+#define SHA3_DOMAIN   0x06
+
+typedef enum { SHA3_PHASE_ABSORBING = 0, SHA3_PHASE_FINALIZED = 1 } sha3_phase;
+
+typedef struct sha3_state_internal_ {
+    crypto_core_keccak1600_state state;
+    size_t                       offset;
+    size_t                       rate;
+    size_t                       outlen;
+    uint8_t                      phase;
+} sha3_state_internal;
+
+static int
+sha3_init(sha3_state_internal *state, size_t rate, size_t outlen)
+{
+    crypto_core_keccak1600_init(&state->state);
+    state->offset = 0;
+    state->rate   = rate;
+    state->outlen = outlen;
+    state->phase  = SHA3_PHASE_ABSORBING;
+
+    return 0;
+}
+
+static int
+sha3_update(sha3_state_internal *state, const unsigned char *in, size_t inlen)
+{
+    size_t consumed = 0;
+    size_t chunk_size;
+
+    while (consumed < inlen) {
+        if (state->offset == state->rate) {
+            crypto_core_keccak1600_permute_24(&state->state);
+            state->offset = 0;
+        }
+        chunk_size = state->rate - state->offset;
+        if (chunk_size > inlen - consumed) {
+            chunk_size = inlen - consumed;
+        }
+        crypto_core_keccak1600_xor_bytes(&state->state, &in[consumed], state->offset, chunk_size);
+        state->offset += chunk_size;
+        consumed += chunk_size;
+    }
+
+    return 0;
+}
+
+static int
+sha3_final(sha3_state_internal *state, unsigned char *out)
+{
+    unsigned char pad;
+
+    if (state->offset == state->rate) {
+        crypto_core_keccak1600_permute_24(&state->state);
+        state->offset = 0;
+    }
+
+    if (state->offset == state->rate - 1) {
+        pad = (unsigned char) (SHA3_DOMAIN ^ 0x80);
+        crypto_core_keccak1600_xor_bytes(&state->state, &pad, state->offset, 1);
+    } else {
+        pad = SHA3_DOMAIN;
+        crypto_core_keccak1600_xor_bytes(&state->state, &pad, state->offset, 1);
+        pad = 0x80;
+        crypto_core_keccak1600_xor_bytes(&state->state, &pad, state->rate - 1, 1);
+    }
+
+    crypto_core_keccak1600_permute_24(&state->state);
+
+    crypto_core_keccak1600_extract_bytes(&state->state, out, 0, state->outlen);
+
+    sodium_memzero(state, sizeof *state);
+
+    return 0;
+}
+
+size_t
+crypto_hash_sha3256_bytes(void)
+{
+    return crypto_hash_sha3256_BYTES;
+}
+
+size_t
+crypto_hash_sha3256_statebytes(void)
+{
+    return sizeof(crypto_hash_sha3256_state);
+}
+
+int
+crypto_hash_sha3256_init(crypto_hash_sha3256_state *state)
+{
+    COMPILER_ASSERT(sizeof(crypto_hash_sha3256_state) >= sizeof(sha3_state_internal));
+    return sha3_init((sha3_state_internal *) (void *) state,
+                     SHA3_256_RATE, crypto_hash_sha3256_BYTES);
+}
+
+int
+crypto_hash_sha3256_update(crypto_hash_sha3256_state *state,
+                           const unsigned char *in, unsigned long long inlen)
+{
+    return sha3_update((sha3_state_internal *) (void *) state, in, (size_t) inlen);
+}
+
+int
+crypto_hash_sha3256_final(crypto_hash_sha3256_state *state, unsigned char *out)
+{
+    return sha3_final((sha3_state_internal *) (void *) state, out);
+}
+
+int
+crypto_hash_sha3256(unsigned char *out, const unsigned char *in, unsigned long long inlen)
+{
+    crypto_hash_sha3256_state state;
+
+    crypto_hash_sha3256_init(&state);
+    crypto_hash_sha3256_update(&state, in, inlen);
+    crypto_hash_sha3256_final(&state, out);
+
+    return 0;
+}
+
+size_t
+crypto_hash_sha3512_bytes(void)
+{
+    return crypto_hash_sha3512_BYTES;
+}
+
+size_t
+crypto_hash_sha3512_statebytes(void)
+{
+    return sizeof(crypto_hash_sha3512_state);
+}
+
+int
+crypto_hash_sha3512_init(crypto_hash_sha3512_state *state)
+{
+    COMPILER_ASSERT(sizeof(crypto_hash_sha3512_state) >= sizeof(sha3_state_internal));
+    return sha3_init((sha3_state_internal *) (void *) state,
+                     SHA3_512_RATE, crypto_hash_sha3512_BYTES);
+}
+
+int
+crypto_hash_sha3512_update(crypto_hash_sha3512_state *state,
+                           const unsigned char *in, unsigned long long inlen)
+{
+    return sha3_update((sha3_state_internal *) (void *) state, in, (size_t) inlen);
+}
+
+int
+crypto_hash_sha3512_final(crypto_hash_sha3512_state *state, unsigned char *out)
+{
+    return sha3_final((sha3_state_internal *) (void *) state, out);
+}
+
+int
+crypto_hash_sha3512(unsigned char *out, const unsigned char *in, unsigned long long inlen)
+{
+    crypto_hash_sha3512_state state;
+
+    crypto_hash_sha3512_init(&state);
+    crypto_hash_sha3512_update(&state, in, inlen);
+    crypto_hash_sha3512_final(&state, out);
+
+    return 0;
+}

src/libsodium/crypto_ipcrypt/crypto_ipcrypt.c

@@ -98,6 +98,12 @@ crypto_ipcrypt_keygen(unsigned char k[crypto_ipcrypt_KEYBYTES])
     randombytes_buf(k, crypto_ipcrypt_KEYBYTES);
 }
 
+void
+crypto_ipcrypt_nd_keygen(unsigned char k[crypto_ipcrypt_ND_KEYBYTES])
+{
+    randombytes_buf(k, crypto_ipcrypt_ND_KEYBYTES);
+}
+
 void
 crypto_ipcrypt_ndx_keygen(unsigned char k[crypto_ipcrypt_NDX_KEYBYTES])
 {

src/libsodium/crypto_ipcrypt/ipcrypt_aesni.c

@@ -308,7 +308,7 @@ pfx_set_bit(uint8_t ip16[16], const unsigned int bit_index, const uint8_t bit_va
     uint8_t       mask       = (uint8_t) -((bit_value & 1));
 
 #    if defined(__GNUC__) || defined(__clang__)
-    __asm__ __volatile__("" : "+r"(mask)::);
+    __asm__ __volatile__("" : "+r"(mask) :);
 #    endif
     ip16[byte_index] = (ip16[byte_index] & ~bit_mask) | (bit_mask & mask);
 }

src/libsodium/crypto_ipcrypt/ipcrypt_armcrypto.c

@@ -37,7 +37,7 @@ typedef uint64x2_t BlockVec;
 #    define XOR128_3(a, b, c) veorq_u64(veorq_u64((a), (b)), (c))
 #    define SET64x2(a, b)     vsetq_lane_u64((uint64_t) (a), vmovq_n_u64((uint64_t) (b)), 1)
 #    define BYTESHL128(a, b) \
-        vreinterpretq_u64_u8(vextq_s8(vdupq_n_s8(0), vreinterpretq_s8_u64(a), 16 - (b)))
+        vreinterpretq_u64_u8(vextq_u8(vdupq_n_u8(0), vreinterpretq_u8_u64(a), 16 - (b)))
 
 #    define AES_XENCRYPT(block_vec, rkey) \
         vreinterpretq_u64_u8(             \
@@ -340,7 +340,7 @@ pfx_set_bit(uint8_t ip16[16], const unsigned int bit_index, const uint8_t bit_va
     uint8_t       mask       = (uint8_t) -((bit_value & 1));
 
 #    if defined(__GNUC__) || defined(__clang__)
-    __asm__ __volatile__("" : "+r"(mask)::);
+    __asm__ __volatile__("" : "+r"(mask) :);
 #    endif
     ip16[byte_index] = (ip16[byte_index] & ~bit_mask) | (bit_mask & mask);
 }
@@ -348,12 +348,12 @@ pfx_set_bit(uint8_t ip16[16], const unsigned int bit_index, const uint8_t bit_va
 static void
 pfx_shift_left(uint8_t ip16[16])
 {
-    BlockVec       v       = LOAD128(ip16);
-    const BlockVec shl     = vshlq_n_u8(vreinterpretq_u8_u64(v), 1);
-    const BlockVec msb     = vshrq_n_u8(vreinterpretq_u8_u64(v), 7);
-    const BlockVec zero    = vdupq_n_u8(0);
-    const BlockVec carries = vextq_u8(vreinterpretq_u8_u64(msb), zero, 1);
-    v                      = vreinterpretq_u64_u8(vorrq_u8(shl, carries));
+    BlockVec         v       = LOAD128(ip16);
+    const uint8x16_t shl     = vshlq_n_u8(vreinterpretq_u8_u64(v), 1);
+    const uint8x16_t msb     = vshrq_n_u8(vreinterpretq_u8_u64(v), 7);
+    const uint8x16_t zero    = vdupq_n_u8(0);
+    const uint8x16_t carries = vextq_u8(msb, zero, 1);
+    v                        = vreinterpretq_u64_u8(vorrq_u8(shl, carries));
     STORE128(ip16, v);
 }
 

src/libsodium/crypto_ipcrypt/ipcrypt_soft.c

@@ -284,7 +284,7 @@ pfx_set_bit(uint8_t ip16[16], const unsigned int bit_index, const uint8_t bit_va
     uint8_t       mask       = (uint8_t) -((bit_value & 1));
 
 #if defined(__GNUC__) || defined(__clang__)
-    __asm__ __volatile__("" : "+r"(mask)::);
+    __asm__ __volatile__("" : "+r"(mask) :);
 #endif
     ip16[byte_index] = (ip16[byte_index] & ~bit_mask) | (bit_mask & mask);
 }

src/libsodium/crypto_kem/crypto_kem.c

@@ -0,0 +1,62 @@
+#include "crypto_kem.h"
+
+size_t
+crypto_kem_publickeybytes(void)
+{
+    return crypto_kem_PUBLICKEYBYTES;
+}
+
+size_t
+crypto_kem_secretkeybytes(void)
+{
+    return crypto_kem_SECRETKEYBYTES;
+}
+
+size_t
+crypto_kem_ciphertextbytes(void)
+{
+    return crypto_kem_CIPHERTEXTBYTES;
+}
+
+size_t
+crypto_kem_sharedsecretbytes(void)
+{
+    return crypto_kem_SHAREDSECRETBYTES;
+}
+
+size_t
+crypto_kem_seedbytes(void)
+{
+    return crypto_kem_SEEDBYTES;
+}
+
+const char *
+crypto_kem_primitive(void)
+{
+    return crypto_kem_PRIMITIVE;
+}
+
+int
+crypto_kem_seed_keypair(unsigned char *pk, unsigned char *sk,
+                        const unsigned char *seed)
+{
+    return crypto_kem_xwing_seed_keypair(pk, sk, seed);
+}
+
+int
+crypto_kem_keypair(unsigned char *pk, unsigned char *sk)
+{
+    return crypto_kem_xwing_keypair(pk, sk);
+}
+
+int
+crypto_kem_enc(unsigned char *ct, unsigned char *ss, const unsigned char *pk)
+{
+    return crypto_kem_xwing_enc(ct, ss, pk);
+}
+
+int
+crypto_kem_dec(unsigned char *ss, const unsigned char *ct, const unsigned char *sk)
+{
+    return crypto_kem_xwing_dec(ss, ct, sk);
+}

src/libsodium/crypto_kem/mlkem768/ref/kem_mlkem768_ref.c

@@ -1,9 +1,8 @@
 #include <stdint.h>
 #include <string.h>
 
-#include "crypto_core_keccak1600.h"
+#include "crypto_hash_sha3.h"
 #include "crypto_kem_mlkem768.h"
-#include "crypto_verify_32.h"
 #include "crypto_xof_shake128.h"
 #include "crypto_xof_shake256.h"
 #include "kem_mlkem768_ref.h"
@@ -25,9 +24,6 @@
 #define MLKEM768_POLYCOMPRESSEDBYTES_DV    128
 #define MLKEM768_POLYVECCOMPRESSEDBYTES_DU (MLKEM768_K * MLKEM768_POLYCOMPRESSEDBYTES_DU)
 
-#define SHA3_512_RATE 72
-#define SHA3_DOMAIN   0x06
-
 typedef struct poly {
     int16_t coeffs[MLKEM768_N];
 } poly;
@@ -201,58 +197,6 @@ poly_csubq(poly *r)
     }
 }
 
-static void
-sha3_256(unsigned char out[32], const unsigned char *in, size_t inlen)
-{
-    crypto_xof_shake256_state state;
-
-    crypto_xof_shake256_init_with_domain(&state, SHA3_DOMAIN);
-    crypto_xof_shake256_update(&state, in, inlen);
-    crypto_xof_shake256_squeeze(&state, out, 32);
-}
-
-static void
-sha3_512(unsigned char out[64], const unsigned char *in, size_t inlen)
-{
-    crypto_core_keccak1600_state state;
-    size_t                       offset   = 0;
-    size_t                       consumed = 0;
-    size_t                       chunk_size;
-    unsigned char                pad;
-
-    crypto_core_keccak1600_init(&state);
-
-    while (consumed < inlen) {
-        if (offset == SHA3_512_RATE) {
-            crypto_core_keccak1600_permute_24(&state);
-            offset = 0;
-        }
-        chunk_size = SHA3_512_RATE - offset;
-        if (chunk_size > inlen - consumed) {
-            chunk_size = inlen - consumed;
-        }
-        crypto_core_keccak1600_xor_bytes(&state, &in[consumed], offset, chunk_size);
-        offset += chunk_size;
-        consumed += chunk_size;
-    }
-    if (offset == SHA3_512_RATE) {
-        crypto_core_keccak1600_permute_24(&state);
-        offset = 0;
-    }
-    if (offset == SHA3_512_RATE - 1) {
-        pad = SHA3_DOMAIN | 0x80;
-        crypto_core_keccak1600_xor_bytes(&state, &pad, offset, 1);
-    } else {
-        pad = SHA3_DOMAIN;
-        crypto_core_keccak1600_xor_bytes(&state, &pad, offset, 1);
-        pad = 0x80;
-        crypto_core_keccak1600_xor_bytes(&state, &pad, SHA3_512_RATE - 1, 1);
-    }
-
-    crypto_core_keccak1600_permute_24(&state);
-    crypto_core_keccak1600_extract_bytes(&state, out, 0, 64);
-}
-
 static void
 poly_cbd_eta2(poly *r, const unsigned char buf[128])
 {
@@ -620,7 +564,7 @@ indcpa_keypair(unsigned char       pk[crypto_kem_mlkem768_PUBLICKEYBYTES],
     unsigned int   i;
     uint8_t        nonce = 0;
 
-    sha3_512(buf, seed, 33);
+    crypto_hash_sha3512(buf, seed, 33);
 
     gen_matrix(a, publicseed, 0);
 
@@ -755,8 +699,8 @@ mlkem768_ref_seed_keypair(unsigned char *pk, unsigned char *sk, const unsigned c
 
     indcpa_keypair(pk, sk, indseed);
     memcpy(sk + MLKEM768_POLYVECBYTES, pk, crypto_kem_mlkem768_PUBLICKEYBYTES);
-    sha3_256(sk + MLKEM768_POLYVECBYTES + crypto_kem_mlkem768_PUBLICKEYBYTES, pk,
-             crypto_kem_mlkem768_PUBLICKEYBYTES);
+    crypto_hash_sha3256(sk + MLKEM768_POLYVECBYTES + crypto_kem_mlkem768_PUBLICKEYBYTES, pk,
+                        crypto_kem_mlkem768_PUBLICKEYBYTES);
     memcpy(sk + MLKEM768_POLYVECBYTES + crypto_kem_mlkem768_PUBLICKEYBYTES + 32, seed + 32, 32);
 
     return 0;
@@ -785,9 +729,9 @@ mlkem768_ref_enc_deterministic(unsigned char *ct, unsigned char *ss, const unsig
     }
 
     memcpy(buf, seed, 32);
-    sha3_256(buf + 32, pk, crypto_kem_mlkem768_PUBLICKEYBYTES);
+    crypto_hash_sha3256(buf + 32, pk, crypto_kem_mlkem768_PUBLICKEYBYTES);
 
-    sha3_512(kr, buf, 64);
+    crypto_hash_sha3512(kr, buf, 64);
 
     indcpa_enc(ct, buf, pk, kr + 32);
 
@@ -816,57 +760,27 @@ mlkem768_ref_dec(unsigned char *ss, const unsigned char *ct, const unsigned char
     const unsigned char *hpk = sk + MLKEM768_POLYVECBYTES + crypto_kem_mlkem768_PUBLICKEYBYTES;
     const unsigned char *z   = sk + MLKEM768_POLYVECBYTES + crypto_kem_mlkem768_PUBLICKEYBYTES + 32;
     int                  fail;
+    unsigned int         fail_mask;
     crypto_xof_shake256_state state;
 
     indcpa_dec(buf, ct, sk);
 
     memcpy(buf + 32, hpk, 32);
 
-    sha3_512(kr, buf, 64);
+    crypto_hash_sha3512(kr, buf, 64);
 
     indcpa_enc(cmp, buf, pk, kr + 32);
 
-    fail = crypto_verify_32(ct, cmp);
-    fail |= crypto_verify_32(ct + 32, cmp + 32);
-    fail |= crypto_verify_32(ct + 64, cmp + 64);
-    fail |= crypto_verify_32(ct + 96, cmp + 96);
-    fail |= crypto_verify_32(ct + 128, cmp + 128);
-    fail |= crypto_verify_32(ct + 160, cmp + 160);
-    fail |= crypto_verify_32(ct + 192, cmp + 192);
-    fail |= crypto_verify_32(ct + 224, cmp + 224);
-    fail |= crypto_verify_32(ct + 256, cmp + 256);
-    fail |= crypto_verify_32(ct + 288, cmp + 288);
-    fail |= crypto_verify_32(ct + 320, cmp + 320);
-    fail |= crypto_verify_32(ct + 352, cmp + 352);
-    fail |= crypto_verify_32(ct + 384, cmp + 384);
-    fail |= crypto_verify_32(ct + 416, cmp + 416);
-    fail |= crypto_verify_32(ct + 448, cmp + 448);
-    fail |= crypto_verify_32(ct + 480, cmp + 480);
-    fail |= crypto_verify_32(ct + 512, cmp + 512);
-    fail |= crypto_verify_32(ct + 544, cmp + 544);
-    fail |= crypto_verify_32(ct + 576, cmp + 576);
-    fail |= crypto_verify_32(ct + 608, cmp + 608);
-    fail |= crypto_verify_32(ct + 640, cmp + 640);
-    fail |= crypto_verify_32(ct + 672, cmp + 672);
-    fail |= crypto_verify_32(ct + 704, cmp + 704);
-    fail |= crypto_verify_32(ct + 736, cmp + 736);
-    fail |= crypto_verify_32(ct + 768, cmp + 768);
-    fail |= crypto_verify_32(ct + 800, cmp + 800);
-    fail |= crypto_verify_32(ct + 832, cmp + 832);
-    fail |= crypto_verify_32(ct + 864, cmp + 864);
-    fail |= crypto_verify_32(ct + 896, cmp + 896);
-    fail |= crypto_verify_32(ct + 928, cmp + 928);
-    fail |= crypto_verify_32(ct + 960, cmp + 960);
-    fail |= crypto_verify_32(ct + 992, cmp + 992);
-    fail |= crypto_verify_32(ct + 1024, cmp + 1024);
-    fail |= crypto_verify_32(ct + 1056, cmp + 1056);
+    fail = sodium_memcmp(ct, cmp, crypto_kem_mlkem768_CIPHERTEXTBYTES);
+    fail_mask = (unsigned int) fail;
+    fail_mask >>= (sizeof(fail_mask) * 8U - 1U);
 
     crypto_xof_shake256_init(&state);
     crypto_xof_shake256_update(&state, z, 32);
     crypto_xof_shake256_update(&state, ct, crypto_kem_mlkem768_CIPHERTEXTBYTES);
     crypto_xof_shake256_squeeze(&state, k_bar, crypto_kem_mlkem768_SHAREDSECRETBYTES);
 
-    cmov(kr, k_bar, crypto_kem_mlkem768_SHAREDSECRETBYTES, (unsigned char) (fail != 0));
+    cmov(kr, k_bar, crypto_kem_mlkem768_SHAREDSECRETBYTES, (unsigned char) fail_mask);
 
     memcpy(ss, kr, crypto_kem_mlkem768_SHAREDSECRETBYTES);
 

src/libsodium/crypto_kem/xwing/kem_xwing.c

@@ -0,0 +1,208 @@
+#include <stdint.h>
+#include <string.h>
+
+#include "crypto_hash_sha3.h"
+#include "crypto_kem_mlkem768.h"
+#include "crypto_kem_xwing.h"
+#include "crypto_scalarmult_curve25519.h"
+#include "crypto_xof_shake256.h"
+#include "private/common.h"
+#include "randombytes.h"
+#include "utils.h"
+
+static const unsigned char xwing_label[6] = { 0x5c, 0x2e, 0x2f, 0x2f, 0x5e, 0x5c };
+
+static void
+expand_decaps_key(unsigned char       pk_mlkem[crypto_kem_mlkem768_PUBLICKEYBYTES],
+                  unsigned char       sk_mlkem[crypto_kem_mlkem768_SECRETKEYBYTES],
+                  unsigned char       pk_x25519[crypto_scalarmult_curve25519_BYTES],
+                  unsigned char       sk_x25519[crypto_scalarmult_curve25519_SCALARBYTES],
+                  const unsigned char seed[crypto_kem_xwing_SEEDBYTES])
+{
+    unsigned char expanded[96];
+    unsigned char mlkem_seed[crypto_kem_mlkem768_SEEDBYTES];
+
+    crypto_xof_shake256(expanded, 96, seed, crypto_kem_xwing_SEEDBYTES);
+
+    memcpy(mlkem_seed, expanded, 64);
+    memcpy(sk_x25519, expanded + 64, 32);
+
+    crypto_kem_mlkem768_seed_keypair(pk_mlkem, sk_mlkem, mlkem_seed);
+    crypto_scalarmult_curve25519_base(pk_x25519, sk_x25519);
+
+    sodium_memzero(expanded, sizeof expanded);
+    sodium_memzero(mlkem_seed, sizeof mlkem_seed);
+}
+
+static void
+combiner(unsigned char       ss[crypto_kem_xwing_SHAREDSECRETBYTES],
+         const unsigned char ss_mlkem[crypto_kem_mlkem768_SHAREDSECRETBYTES],
+         const unsigned char ss_x25519[crypto_scalarmult_curve25519_BYTES],
+         const unsigned char ct_x25519[crypto_scalarmult_curve25519_BYTES],
+         const unsigned char pk_x25519[crypto_scalarmult_curve25519_BYTES])
+{
+    crypto_hash_sha3256_state state;
+
+    crypto_hash_sha3256_init(&state);
+    crypto_hash_sha3256_update(&state, ss_mlkem, crypto_kem_mlkem768_SHAREDSECRETBYTES);
+    crypto_hash_sha3256_update(&state, ss_x25519, crypto_scalarmult_curve25519_BYTES);
+    crypto_hash_sha3256_update(&state, ct_x25519, crypto_scalarmult_curve25519_BYTES);
+    crypto_hash_sha3256_update(&state, pk_x25519, crypto_scalarmult_curve25519_BYTES);
+    crypto_hash_sha3256_update(&state, xwing_label, sizeof xwing_label);
+    crypto_hash_sha3256_final(&state, ss);
+}
+
+size_t
+crypto_kem_xwing_publickeybytes(void)
+{
+    return crypto_kem_xwing_PUBLICKEYBYTES;
+}
+
+size_t
+crypto_kem_xwing_secretkeybytes(void)
+{
+    return crypto_kem_xwing_SECRETKEYBYTES;
+}
+
+size_t
+crypto_kem_xwing_ciphertextbytes(void)
+{
+    return crypto_kem_xwing_CIPHERTEXTBYTES;
+}
+
+size_t
+crypto_kem_xwing_sharedsecretbytes(void)
+{
+    return crypto_kem_xwing_SHAREDSECRETBYTES;
+}
+
+size_t
+crypto_kem_xwing_seedbytes(void)
+{
+    return crypto_kem_xwing_SEEDBYTES;
+}
+
+int
+crypto_kem_xwing_seed_keypair(unsigned char *pk, unsigned char *sk, const unsigned char *seed)
+{
+    unsigned char pk_mlkem[crypto_kem_mlkem768_PUBLICKEYBYTES];
+    unsigned char sk_mlkem[crypto_kem_mlkem768_SECRETKEYBYTES];
+    unsigned char pk_x25519[crypto_scalarmult_curve25519_BYTES];
+    unsigned char sk_x25519[crypto_scalarmult_curve25519_SCALARBYTES];
+
+    expand_decaps_key(pk_mlkem, sk_mlkem, pk_x25519, sk_x25519, seed);
+
+    memcpy(pk, pk_mlkem, crypto_kem_mlkem768_PUBLICKEYBYTES);
+    memcpy(pk + crypto_kem_mlkem768_PUBLICKEYBYTES, pk_x25519, crypto_scalarmult_curve25519_BYTES);
+
+    memcpy(sk, seed, crypto_kem_xwing_SEEDBYTES);
+
+    sodium_memzero(sk_mlkem, sizeof sk_mlkem);
+    sodium_memzero(sk_x25519, sizeof sk_x25519);
+
+    return 0;
+}
+
+int
+crypto_kem_xwing_keypair(unsigned char *pk, unsigned char *sk)
+{
+    unsigned char seed[crypto_kem_xwing_SEEDBYTES];
+
+    randombytes_buf(seed, crypto_kem_xwing_SEEDBYTES);
+    crypto_kem_xwing_seed_keypair(pk, sk, seed);
+
+    sodium_memzero(seed, sizeof seed);
+
+    return 0;
+}
+
+int
+crypto_kem_xwing_enc_deterministic(unsigned char *ct, unsigned char *ss, const unsigned char *pk,
+                                   const unsigned char *seed)
+{
+    const unsigned char *pk_mlkem  = pk;
+    const unsigned char *pk_x25519 = pk + crypto_kem_mlkem768_PUBLICKEYBYTES;
+
+    const unsigned char *seed_mlkem  = seed;
+    const unsigned char *sk_e_x25519 = seed + 32;
+
+    unsigned char ct_mlkem[crypto_kem_mlkem768_CIPHERTEXTBYTES];
+    unsigned char ss_mlkem[crypto_kem_mlkem768_SHAREDSECRETBYTES];
+    unsigned char ct_x25519[crypto_scalarmult_curve25519_BYTES];
+    unsigned char ss_x25519[crypto_scalarmult_curve25519_BYTES];
+
+    if (crypto_kem_mlkem768_enc_deterministic(ct_mlkem, ss_mlkem, pk_mlkem, seed_mlkem) != 0) {
+        return -1;
+    }
+
+    crypto_scalarmult_curve25519_base(ct_x25519, sk_e_x25519);
+
+    if (crypto_scalarmult_curve25519(ss_x25519, sk_e_x25519, pk_x25519) != 0) {
+        sodium_memzero(ss_mlkem, sizeof ss_mlkem);
+        return -1;
+    }
+
+    memcpy(ct, ct_mlkem, crypto_kem_mlkem768_CIPHERTEXTBYTES);
+    memcpy(ct + crypto_kem_mlkem768_CIPHERTEXTBYTES, ct_x25519, crypto_scalarmult_curve25519_BYTES);
+
+    combiner(ss, ss_mlkem, ss_x25519, ct_x25519, pk_x25519);
+
+    sodium_memzero(ss_mlkem, sizeof ss_mlkem);
+    sodium_memzero(ss_x25519, sizeof ss_x25519);
+
+    return 0;
+}
+
+int
+crypto_kem_xwing_enc(unsigned char *ct, unsigned char *ss, const unsigned char *pk)
+{
+    unsigned char seed[64];
+
+    randombytes_buf(seed, 64);
+    if (crypto_kem_xwing_enc_deterministic(ct, ss, pk, seed) != 0) {
+        sodium_memzero(seed, sizeof seed);
+        return -1;
+    }
+    sodium_memzero(seed, sizeof seed);
+
+    return 0;
+}
+
+int
+crypto_kem_xwing_dec(unsigned char *ss, const unsigned char *ct, const unsigned char *sk)
+{
+    unsigned char pk_mlkem[crypto_kem_mlkem768_PUBLICKEYBYTES];
+    unsigned char sk_mlkem[crypto_kem_mlkem768_SECRETKEYBYTES];
+    unsigned char pk_x25519[crypto_scalarmult_curve25519_BYTES];
+    unsigned char sk_x25519[crypto_scalarmult_curve25519_SCALARBYTES];
+
+    const unsigned char *ct_mlkem  = ct;
+    const unsigned char *ct_x25519 = ct + crypto_kem_mlkem768_CIPHERTEXTBYTES;
+
+    unsigned char ss_mlkem[crypto_kem_mlkem768_SHAREDSECRETBYTES];
+    unsigned char ss_x25519[crypto_scalarmult_curve25519_BYTES];
+
+    expand_decaps_key(pk_mlkem, sk_mlkem, pk_x25519, sk_x25519, sk);
+
+    if (crypto_kem_mlkem768_dec(ss_mlkem, ct_mlkem, sk_mlkem) != 0) {
+        sodium_memzero(sk_mlkem, sizeof sk_mlkem);
+        sodium_memzero(sk_x25519, sizeof sk_x25519);
+        return -1;
+    }
+
+    if (crypto_scalarmult_curve25519(ss_x25519, sk_x25519, ct_x25519) != 0) {
+        sodium_memzero(ss_mlkem, sizeof ss_mlkem);
+        sodium_memzero(sk_mlkem, sizeof sk_mlkem);
+        sodium_memzero(sk_x25519, sizeof sk_x25519);
+        return -1;
+    }
+
+    combiner(ss, ss_mlkem, ss_x25519, ct_x25519, pk_x25519);
+
+    sodium_memzero(ss_mlkem, sizeof ss_mlkem);
+    sodium_memzero(ss_x25519, sizeof ss_x25519);
+    sodium_memzero(sk_mlkem, sizeof sk_mlkem);
+    sodium_memzero(sk_x25519, sizeof sk_x25519);
+
+    return 0;
+}

src/libsodium/crypto_pwhash/argon2/argon2-core.c

@@ -45,7 +45,12 @@
 # define MAP_POPULATE 0
 #endif
 
+#if (defined(__aarch64__) || defined(_M_ARM64)) && \
+    (defined(__ARM_NEON) || defined(__ARM_NEON__))
+static fill_segment_fn fill_segment = argon2_fill_segment_neon;
+#else
 static fill_segment_fn fill_segment = argon2_fill_segment_ref;
+#endif
 
 static void
 load_block(block *dst, const void *input)
@@ -496,6 +501,10 @@ static int
 argon2_pick_best_implementation(void)
 {
 /* LCOV_EXCL_START */
+#if defined(__wasm_simd128__)
+    fill_segment = argon2_fill_segment_wasm32;
+    return 0;
+#endif
 #if defined(HAVE_AVX512FINTRIN_H) && defined(HAVE_AVX2INTRIN_H) && \
     defined(HAVE_TMMINTRIN_H) && defined(HAVE_SMMINTRIN_H)
     if (sodium_runtime_has_avx512f()) {
@@ -516,7 +525,12 @@ argon2_pick_best_implementation(void)
         return 0;
     }
 #endif
+#if (defined(__aarch64__) || defined(_M_ARM64)) && \
+    (defined(__ARM_NEON) || defined(__ARM_NEON__))
+    fill_segment = argon2_fill_segment_neon;
+#else
     fill_segment = argon2_fill_segment_ref;
+#endif
 
     return 0;
     /* LCOV_EXCL_STOP */

src/libsodium/crypto_pwhash/argon2/argon2-core.h

@@ -258,6 +258,10 @@ void argon2_fill_segment_avx2(const argon2_instance_t *instance,
                               argon2_position_t        position);
 void argon2_fill_segment_ssse3(const argon2_instance_t *instance,
                                argon2_position_t        position);
+void argon2_fill_segment_wasm32(const argon2_instance_t *instance,
+                                argon2_position_t        position);
+void argon2_fill_segment_neon(const argon2_instance_t *instance,
+                              argon2_position_t        position);
 void argon2_fill_segment_ref(const argon2_instance_t *instance,
                              argon2_position_t        position);
 

src/libsodium/crypto_pwhash/argon2/argon2-fill-block-neon.c

@@ -0,0 +1,216 @@
+/*
+ * Argon2 source code package
+ *
+ * Written by Daniel Dinu and Dmitry Khovratovich, 2015
+ *
+ * This work is licensed under a Creative Commons CC0 1.0 License/Waiver.
+ *
+ * You should have received a copy of the CC0 Public Domain Dedication along
+ * with
+ * this software. If not, see
+ * <http://creativecommons.org/publicdomain/zero/1.0/>.
+ *
+ * AARCH64 NEON implementation ported from SSSE3 version.
+ */
+
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "argon2-core.h"
+#include "argon2.h"
+#include "private/common.h"
+
+#if (defined(__aarch64__) || defined(_M_ARM64)) && \
+    (defined(__ARM_NEON) || defined(__ARM_NEON__))
+
+# include <arm_neon.h>
+# include "blamka-round-neon.h"
+
+static void
+fill_block(uint64x2_t *state, const uint8_t *ref_block, uint8_t *next_block)
+{
+    uint64x2_t block_XY[ARGON2_OWORDS_IN_BLOCK];
+    uint32_t   i;
+
+    for (i = 0; i < ARGON2_OWORDS_IN_BLOCK; i++) {
+        block_XY[i] = state[i] = veorq_u64(
+            state[i], vld1q_u64((const uint64_t *) (&ref_block[16 * i])));
+    }
+
+    for (i = 0; i < 8; ++i) {
+        BLAKE2_ROUND_NEON(state[8 * i + 0], state[8 * i + 1], state[8 * i + 2],
+                          state[8 * i + 3], state[8 * i + 4], state[8 * i + 5],
+                          state[8 * i + 6], state[8 * i + 7]);
+    }
+
+    for (i = 0; i < 8; ++i) {
+        BLAKE2_ROUND_NEON(state[8 * 0 + i], state[8 * 1 + i], state[8 * 2 + i],
+                          state[8 * 3 + i], state[8 * 4 + i], state[8 * 5 + i],
+                          state[8 * 6 + i], state[8 * 7 + i]);
+    }
+
+    for (i = 0; i < ARGON2_OWORDS_IN_BLOCK; i++) {
+        state[i] = veorq_u64(state[i], block_XY[i]);
+        vst1q_u64((uint64_t *) (&next_block[16 * i]), state[i]);
+    }
+}
+
+static void
+fill_block_with_xor(uint64x2_t *state, const uint8_t *ref_block,
+                    uint8_t *next_block)
+{
+    uint64x2_t block_XY[ARGON2_OWORDS_IN_BLOCK];
+    uint32_t   i;
+
+    for (i = 0; i < ARGON2_OWORDS_IN_BLOCK; i++) {
+        state[i] = veorq_u64(
+            state[i], vld1q_u64((const uint64_t *) (&ref_block[16 * i])));
+        block_XY[i] = veorq_u64(
+            state[i], vld1q_u64((const uint64_t *) (&next_block[16 * i])));
+    }
+
+    for (i = 0; i < 8; ++i) {
+        BLAKE2_ROUND_NEON(state[8 * i + 0], state[8 * i + 1], state[8 * i + 2],
+                          state[8 * i + 3], state[8 * i + 4], state[8 * i + 5],
+                          state[8 * i + 6], state[8 * i + 7]);
+    }
+
+    for (i = 0; i < 8; ++i) {
+        BLAKE2_ROUND_NEON(state[8 * 0 + i], state[8 * 1 + i], state[8 * 2 + i],
+                          state[8 * 3 + i], state[8 * 4 + i], state[8 * 5 + i],
+                          state[8 * 6 + i], state[8 * 7 + i]);
+    }
+
+    for (i = 0; i < ARGON2_OWORDS_IN_BLOCK; i++) {
+        state[i] = veorq_u64(state[i], block_XY[i]);
+        vst1q_u64((uint64_t *) (&next_block[16 * i]), state[i]);
+    }
+}
+
+static void
+generate_addresses(const argon2_instance_t *instance,
+                   const argon2_position_t *position, uint64_t *pseudo_rands)
+{
+    block    address_block, input_block, tmp_block;
+    uint32_t i;
+
+    init_block_value(&address_block, 0);
+    init_block_value(&input_block, 0);
+
+    if (instance != NULL && position != NULL) {
+        input_block.v[0] = position->pass;
+        input_block.v[1] = position->lane;
+        input_block.v[2] = position->slice;
+        input_block.v[3] = instance->memory_blocks;
+        input_block.v[4] = instance->passes;
+        input_block.v[5] = instance->type;
+
+        for (i = 0; i < instance->segment_length; ++i) {
+            if (i % ARGON2_ADDRESSES_IN_BLOCK == 0) {
+                uint64x2_t zero_block[ARGON2_OWORDS_IN_BLOCK];
+                uint64x2_t zero2_block[ARGON2_OWORDS_IN_BLOCK];
+
+                memset(zero_block, 0, sizeof(zero_block));
+                memset(zero2_block, 0, sizeof(zero2_block));
+                init_block_value(&address_block, 0);
+                init_block_value(&tmp_block, 0);
+
+                input_block.v[6]++;
+
+                fill_block_with_xor(zero_block, (uint8_t *) &input_block.v,
+                                    (uint8_t *) &tmp_block.v);
+                fill_block_with_xor(zero2_block, (uint8_t *) &tmp_block.v,
+                                    (uint8_t *) &address_block.v);
+            }
+
+            pseudo_rands[i] = address_block.v[i % ARGON2_ADDRESSES_IN_BLOCK];
+        }
+    }
+}
+
+void
+argon2_fill_segment_neon(const argon2_instance_t *instance,
+                         argon2_position_t        position)
+{
+    block     *ref_block = NULL, *curr_block = NULL;
+    uint64_t   pseudo_rand, ref_index, ref_lane;
+    uint32_t   prev_offset, curr_offset;
+    uint32_t   starting_index, i;
+    uint64x2_t state[ARGON2_OWORDS_IN_BLOCK];
+    int        data_independent_addressing = 1;
+
+    uint64_t *pseudo_rands = NULL;
+
+    if (instance == NULL) {
+        return;
+    }
+
+    if (instance->type == Argon2_id &&
+        (position.pass != 0 || position.slice >= ARGON2_SYNC_POINTS / 2)) {
+        data_independent_addressing = 0;
+    }
+
+    pseudo_rands = instance->pseudo_rands;
+
+    if (data_independent_addressing) {
+        generate_addresses(instance, &position, pseudo_rands);
+    }
+
+    starting_index = 0;
+
+    if ((0 == position.pass) && (0 == position.slice)) {
+        starting_index = 2;
+    }
+
+    curr_offset = position.lane * instance->lane_length +
+                  position.slice * instance->segment_length + starting_index;
+
+    if (0 == curr_offset % instance->lane_length) {
+        prev_offset = curr_offset + instance->lane_length - 1;
+    } else {
+        prev_offset = curr_offset - 1;
+    }
+
+    memcpy(state, ((instance->region->memory + prev_offset)->v),
+           ARGON2_BLOCK_SIZE);
+
+    for (i = starting_index; i < instance->segment_length;
+         ++i, ++curr_offset, ++prev_offset) {
+        if (curr_offset % instance->lane_length == 1) {
+            prev_offset = curr_offset - 1;
+        }
+
+        if (data_independent_addressing) {
+#pragma warning(push)
+#pragma warning(disable : 6385)
+            pseudo_rand = pseudo_rands[i];
+#pragma warning(pop)
+        } else {
+            pseudo_rand = instance->region->memory[prev_offset].v[0];
+        }
+
+        ref_lane = ((pseudo_rand >> 32)) % instance->lanes;
+
+        if ((position.pass == 0) && (position.slice == 0)) {
+            ref_lane = position.lane;
+        }
+
+        position.index = i;
+        ref_index = index_alpha(instance, &position, pseudo_rand & 0xFFFFFFFF,
+                                ref_lane == position.lane);
+
+        ref_block = instance->region->memory +
+                    instance->lane_length * ref_lane + ref_index;
+        curr_block = instance->region->memory + curr_offset;
+        if (position.pass != 0) {
+            fill_block_with_xor(state, (uint8_t *) ref_block->v,
+                                (uint8_t *) curr_block->v);
+        } else {
+            fill_block(state, (uint8_t *) ref_block->v,
+                       (uint8_t *) curr_block->v);
+        }
+    }
+}
+
+#endif

src/libsodium/crypto_pwhash/argon2/argon2-fill-block-wasm32.c

@@ -0,0 +1,214 @@
+/*
+ * Argon2 source code package
+ *
+ * Written by Daniel Dinu and Dmitry Khovratovich, 2015
+ *
+ * This work is licensed under a Creative Commons CC0 1.0 License/Waiver.
+ *
+ * You should have received a copy of the CC0 Public Domain Dedication along
+ * with
+ * this software. If not, see
+ * <http://creativecommons.org/publicdomain/zero/1.0/>.
+ *
+ * WebAssembly SIMD port of the SSSE3 implementation.
+ */
+
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "argon2-core.h"
+#include "argon2.h"
+#include "private/common.h"
+
+#if defined(__wasm_simd128__)
+
+#include <wasm_simd128.h>
+
+#include "blamka-round-wasm32.h"
+
+static void
+fill_block(v128_t *state, const uint8_t *ref_block, uint8_t *next_block)
+{
+    v128_t   block_XY[ARGON2_OWORDS_IN_BLOCK];
+    uint32_t i;
+
+    for (i = 0; i < ARGON2_OWORDS_IN_BLOCK; i++) {
+        block_XY[i] = state[i] = wasm_v128_xor(
+            state[i], wasm_v128_load((const v128_t *) (&ref_block[16 * i])));
+    }
+
+    for (i = 0; i < 8; ++i) {
+        BLAKE2_ROUND_WASM(state[8 * i + 0], state[8 * i + 1], state[8 * i + 2],
+                          state[8 * i + 3], state[8 * i + 4], state[8 * i + 5],
+                          state[8 * i + 6], state[8 * i + 7]);
+    }
+
+    for (i = 0; i < 8; ++i) {
+        BLAKE2_ROUND_WASM(state[8 * 0 + i], state[8 * 1 + i], state[8 * 2 + i],
+                          state[8 * 3 + i], state[8 * 4 + i], state[8 * 5 + i],
+                          state[8 * 6 + i], state[8 * 7 + i]);
+    }
+
+    for (i = 0; i < ARGON2_OWORDS_IN_BLOCK; i++) {
+        state[i] = wasm_v128_xor(state[i], block_XY[i]);
+        wasm_v128_store((v128_t *) (&next_block[16 * i]), state[i]);
+    }
+}
+
+static void
+fill_block_with_xor(v128_t *state, const uint8_t *ref_block,
+                    uint8_t *next_block)
+{
+    v128_t   block_XY[ARGON2_OWORDS_IN_BLOCK];
+    uint32_t i;
+
+    for (i = 0; i < ARGON2_OWORDS_IN_BLOCK; i++) {
+        state[i] = wasm_v128_xor(
+            state[i], wasm_v128_load((const v128_t *) (&ref_block[16 * i])));
+        block_XY[i] = wasm_v128_xor(
+            state[i], wasm_v128_load((const v128_t *) (&next_block[16 * i])));
+    }
+
+    for (i = 0; i < 8; ++i) {
+        BLAKE2_ROUND_WASM(state[8 * i + 0], state[8 * i + 1], state[8 * i + 2],
+                          state[8 * i + 3], state[8 * i + 4], state[8 * i + 5],
+                          state[8 * i + 6], state[8 * i + 7]);
+    }
+
+    for (i = 0; i < 8; ++i) {
+        BLAKE2_ROUND_WASM(state[8 * 0 + i], state[8 * 1 + i], state[8 * 2 + i],
+                          state[8 * 3 + i], state[8 * 4 + i], state[8 * 5 + i],
+                          state[8 * 6 + i], state[8 * 7 + i]);
+    }
+
+    for (i = 0; i < ARGON2_OWORDS_IN_BLOCK; i++) {
+        state[i] = wasm_v128_xor(state[i], block_XY[i]);
+        wasm_v128_store((v128_t *) (&next_block[16 * i]), state[i]);
+    }
+}
+
+static void
+generate_addresses(const argon2_instance_t *instance,
+                   const argon2_position_t *position, uint64_t *pseudo_rands)
+{
+    block    address_block, input_block, tmp_block;
+    uint32_t i;
+
+    init_block_value(&address_block, 0);
+    init_block_value(&input_block, 0);
+
+    if (instance != NULL && position != NULL) {
+        input_block.v[0] = position->pass;
+        input_block.v[1] = position->lane;
+        input_block.v[2] = position->slice;
+        input_block.v[3] = instance->memory_blocks;
+        input_block.v[4] = instance->passes;
+        input_block.v[5] = instance->type;
+
+        for (i = 0; i < instance->segment_length; ++i) {
+            if (i % ARGON2_ADDRESSES_IN_BLOCK == 0) {
+                v128_t zero_block[ARGON2_OWORDS_IN_BLOCK];
+                v128_t zero2_block[ARGON2_OWORDS_IN_BLOCK];
+
+                memset(zero_block, 0, sizeof(zero_block));
+                memset(zero2_block, 0, sizeof(zero2_block));
+                init_block_value(&address_block, 0);
+                init_block_value(&tmp_block, 0);
+                input_block.v[6]++;
+                fill_block_with_xor(zero_block, (uint8_t *) &input_block.v,
+                                    (uint8_t *) &tmp_block.v);
+                fill_block_with_xor(zero2_block, (uint8_t *) &tmp_block.v,
+                                    (uint8_t *) &address_block.v);
+            }
+
+            pseudo_rands[i] = address_block.v[i % ARGON2_ADDRESSES_IN_BLOCK];
+        }
+    }
+}
+
+void
+argon2_fill_segment_wasm32(const argon2_instance_t *instance,
+                           argon2_position_t        position)
+{
+    block    *ref_block = NULL, *curr_block = NULL;
+    uint64_t  pseudo_rand, ref_index, ref_lane;
+    uint32_t  prev_offset, curr_offset;
+    uint32_t  starting_index, i;
+    v128_t    state[ARGON2_OWORDS_IN_BLOCK];
+    int       data_independent_addressing = 1;
+
+    uint64_t *pseudo_rands = NULL;
+
+    if (instance == NULL) {
+        return;
+    }
+
+    if (instance->type == Argon2_id &&
+        (position.pass != 0 || position.slice >= ARGON2_SYNC_POINTS / 2)) {
+        data_independent_addressing = 0;
+    }
+
+    pseudo_rands = instance->pseudo_rands;
+
+    if (data_independent_addressing) {
+        generate_addresses(instance, &position, pseudo_rands);
+    }
+
+    starting_index = 0;
+
+    if ((0 == position.pass) && (0 == position.slice)) {
+        starting_index = 2;
+    }
+
+    curr_offset = position.lane * instance->lane_length +
+                  position.slice * instance->segment_length + starting_index;
+
+    if (0 == curr_offset % instance->lane_length) {
+        prev_offset = curr_offset + instance->lane_length - 1;
+    } else {
+        prev_offset = curr_offset - 1;
+    }
+
+    memcpy(state, ((instance->region->memory + prev_offset)->v),
+           ARGON2_BLOCK_SIZE);
+
+    for (i = starting_index; i < instance->segment_length;
+         ++i, ++curr_offset, ++prev_offset) {
+        if (curr_offset % instance->lane_length == 1) {
+            prev_offset = curr_offset - 1;
+        }
+
+        if (data_independent_addressing) {
+#pragma warning(push)
+#pragma warning(disable : 6385)
+            pseudo_rand = pseudo_rands[i];
+#pragma warning(pop)
+        } else {
+            pseudo_rand = instance->region->memory[prev_offset].v[0];
+        }
+
+        ref_lane = ((pseudo_rand >> 32)) % instance->lanes;
+
+        if ((position.pass == 0) && (position.slice == 0)) {
+            ref_lane = position.lane;
+        }
+
+        position.index = i;
+        ref_index = index_alpha(instance, &position, pseudo_rand & 0xFFFFFFFF,
+                                ref_lane == position.lane);
+
+        ref_block = instance->region->memory +
+                    instance->lane_length * ref_lane + ref_index;
+        curr_block = instance->region->memory + curr_offset;
+        if (position.pass != 0) {
+            fill_block_with_xor(state, (uint8_t *) ref_block->v,
+                                (uint8_t *) curr_block->v);
+        } else {
+            fill_block(state, (uint8_t *) ref_block->v,
+                       (uint8_t *) curr_block->v);
+        }
+    }
+}
+
+#endif

src/libsodium/crypto_pwhash/argon2/blamka-round-neon.h

@@ -0,0 +1,161 @@
+#ifndef blamka_round_neon_H
+#define blamka_round_neon_H
+
+#include <arm_neon.h>
+
+#include "private/common.h"
+
+static inline uint64x2_t
+fBlaMka_neon(uint64x2_t x, uint64x2_t y)
+{
+    const uint32x2_t x_lo = vmovn_u64(x);
+    const uint32x2_t y_lo = vmovn_u64(y);
+    const uint64x2_t z    = vmull_u32(x_lo, y_lo);
+
+    return vaddq_u64(vaddq_u64(x, y), vaddq_u64(z, z));
+}
+
+static inline uint64x2_t
+rotr64_32_neon(uint64x2_t x)
+{
+    return vreinterpretq_u64_u32(vrev64q_u32(vreinterpretq_u32_u64(x)));
+}
+
+static inline uint64x2_t
+rotr64_24_neon(uint64x2_t x)
+{
+    static const uint8_t rot24_tbl[16] = {
+        3, 4, 5, 6, 7, 0, 1, 2,
+        11, 12, 13, 14, 15, 8, 9, 10
+    };
+    const uint8x16_t tbl = vld1q_u8(rot24_tbl);
+    return vreinterpretq_u64_u8(vqtbl1q_u8(vreinterpretq_u8_u64(x), tbl));
+}
+
+static inline uint64x2_t
+rotr64_16_neon(uint64x2_t x)
+{
+    static const uint8_t rot16_tbl[16] = {
+        2, 3, 4, 5, 6, 7, 0, 1,
+        10, 11, 12, 13, 14, 15, 8, 9
+    };
+    const uint8x16_t tbl = vld1q_u8(rot16_tbl);
+    return vreinterpretq_u64_u8(vqtbl1q_u8(vreinterpretq_u8_u64(x), tbl));
+}
+
+static inline uint64x2_t
+rotr64_63_neon(uint64x2_t x)
+{
+    return veorq_u64(vshrq_n_u64(x, 63), vaddq_u64(x, x));
+}
+
+#define G1_NEON(A0, B0, C0, D0, A1, B1, C1, D1) \
+    do {                                        \
+        A0 = fBlaMka_neon(A0, B0);              \
+        A1 = fBlaMka_neon(A1, B1);              \
+                                                \
+        D0 = veorq_u64(D0, A0);                 \
+        D1 = veorq_u64(D1, A1);                 \
+                                                \
+        D0 = rotr64_32_neon(D0);                \
+        D1 = rotr64_32_neon(D1);                \
+                                                \
+        C0 = fBlaMka_neon(C0, D0);              \
+        C1 = fBlaMka_neon(C1, D1);              \
+                                                \
+        B0 = veorq_u64(B0, C0);                 \
+        B1 = veorq_u64(B1, C1);                 \
+                                                \
+        B0 = rotr64_24_neon(B0);                \
+        B1 = rotr64_24_neon(B1);                \
+    } while ((void) 0, 0)
+
+#define G2_NEON(A0, B0, C0, D0, A1, B1, C1, D1) \
+    do {                                        \
+        A0 = fBlaMka_neon(A0, B0);              \
+        A1 = fBlaMka_neon(A1, B1);              \
+                                                \
+        D0 = veorq_u64(D0, A0);                 \
+        D1 = veorq_u64(D1, A1);                 \
+                                                \
+        D0 = rotr64_16_neon(D0);                \
+        D1 = rotr64_16_neon(D1);                \
+                                                \
+        C0 = fBlaMka_neon(C0, D0);              \
+        C1 = fBlaMka_neon(C1, D1);              \
+                                                \
+        B0 = veorq_u64(B0, C0);                 \
+        B1 = veorq_u64(B1, C1);                 \
+                                                \
+        B0 = rotr64_63_neon(B0);                \
+        B1 = rotr64_63_neon(B1);                \
+    } while ((void) 0, 0)
+
+#define DIAGONALIZE_NEON(A0, B0, C0, D0, A1, B1, C1, D1) \
+    do {                                                 \
+        uint64x2_t t0, t1;                               \
+                                                         \
+        t0 = vreinterpretq_u64_u8(                       \
+            vextq_u8(vreinterpretq_u8_u64(B0),           \
+                     vreinterpretq_u8_u64(B1), 8));      \
+        t1 = vreinterpretq_u64_u8(                       \
+            vextq_u8(vreinterpretq_u8_u64(B1),           \
+                     vreinterpretq_u8_u64(B0), 8));      \
+        B0 = t0;                                         \
+        B1 = t1;                                         \
+                                                         \
+        t0 = C0;                                         \
+        C0 = C1;                                         \
+        C1 = t0;                                         \
+                                                         \
+        t0 = vreinterpretq_u64_u8(                       \
+            vextq_u8(vreinterpretq_u8_u64(D0),           \
+                     vreinterpretq_u8_u64(D1), 8));      \
+        t1 = vreinterpretq_u64_u8(                       \
+            vextq_u8(vreinterpretq_u8_u64(D1),           \
+                     vreinterpretq_u8_u64(D0), 8));      \
+        D0 = t1;                                         \
+        D1 = t0;                                         \
+    } while ((void) 0, 0)
+
+#define UNDIAGONALIZE_NEON(A0, B0, C0, D0, A1, B1, C1, D1) \
+    do {                                                   \
+        uint64x2_t t0, t1;                                 \
+                                                           \
+        t0 = vreinterpretq_u64_u8(                         \
+            vextq_u8(vreinterpretq_u8_u64(B1),             \
+                     vreinterpretq_u8_u64(B0), 8));        \
+        t1 = vreinterpretq_u64_u8(                         \
+            vextq_u8(vreinterpretq_u8_u64(B0),             \
+                     vreinterpretq_u8_u64(B1), 8));        \
+        B0 = t0;                                           \
+        B1 = t1;                                           \
+                                                           \
+        t0 = C0;                                           \
+        C0 = C1;                                           \
+        C1 = t0;                                           \
+                                                           \
+        t0 = vreinterpretq_u64_u8(                         \
+            vextq_u8(vreinterpretq_u8_u64(D1),             \
+                     vreinterpretq_u8_u64(D0), 8));        \
+        t1 = vreinterpretq_u64_u8(                         \
+            vextq_u8(vreinterpretq_u8_u64(D0),             \
+                     vreinterpretq_u8_u64(D1), 8));        \
+        D0 = t1;                                           \
+        D1 = t0;                                           \
+    } while ((void) 0, 0)
+
+#define BLAKE2_ROUND_NEON(A0, A1, B0, B1, C0, C1, D0, D1)   \
+    do {                                                    \
+        G1_NEON(A0, B0, C0, D0, A1, B1, C1, D1);            \
+        G2_NEON(A0, B0, C0, D0, A1, B1, C1, D1);            \
+                                                            \
+        DIAGONALIZE_NEON(A0, B0, C0, D0, A1, B1, C1, D1);   \
+                                                            \
+        G1_NEON(A0, B0, C0, D0, A1, B1, C1, D1);            \
+        G2_NEON(A0, B0, C0, D0, A1, B1, C1, D1);            \
+                                                            \
+        UNDIAGONALIZE_NEON(A0, B0, C0, D0, A1, B1, C1, D1); \
+    } while ((void) 0, 0)
+
+#endif

src/libsodium/crypto_pwhash/argon2/blamka-round-wasm32.h

@@ -0,0 +1,134 @@
+#ifndef blamka_round_wasm32_H
+#define blamka_round_wasm32_H
+
+#include <wasm_simd128.h>
+#include "private/common.h"
+
+static inline v128_t
+fBlaMka_wasm(v128_t x, v128_t y)
+{
+    const v128_t z = wasm_u64x2_extmul_low_u32x4(x, y);
+    return wasm_i64x2_add(wasm_i64x2_add(x, y), wasm_i64x2_add(z, z));
+}
+
+static inline v128_t
+rotr64_32_wasm(v128_t x)
+{
+    return wasm_i32x4_shuffle(x, x, 1, 0, 3, 2);
+}
+
+static inline v128_t
+rotr64_24_wasm(v128_t x)
+{
+    return wasm_v128_or(wasm_u64x2_shr(x, 24), wasm_i64x2_shl(x, 40));
+}
+
+static inline v128_t
+rotr64_16_wasm(v128_t x)
+{
+    return wasm_v128_or(wasm_u64x2_shr(x, 16), wasm_i64x2_shl(x, 48));
+}
+
+static inline v128_t
+rotr64_63_wasm(v128_t x)
+{
+    return wasm_v128_or(wasm_u64x2_shr(x, 63), wasm_i64x2_shl(x, 1));
+}
+
+#define G1_WASM(A0, B0, C0, D0, A1, B1, C1, D1) \
+    do {                                        \
+        A0 = fBlaMka_wasm(A0, B0);              \
+        A1 = fBlaMka_wasm(A1, B1);              \
+                                                \
+        D0 = wasm_v128_xor(D0, A0);             \
+        D1 = wasm_v128_xor(D1, A1);             \
+                                                \
+        D0 = rotr64_32_wasm(D0);                \
+        D1 = rotr64_32_wasm(D1);                \
+                                                \
+        C0 = fBlaMka_wasm(C0, D0);              \
+        C1 = fBlaMka_wasm(C1, D1);              \
+                                                \
+        B0 = wasm_v128_xor(B0, C0);             \
+        B1 = wasm_v128_xor(B1, C1);             \
+                                                \
+        B0 = rotr64_24_wasm(B0);                \
+        B1 = rotr64_24_wasm(B1);                \
+    } while ((void) 0, 0)
+
+#define G2_WASM(A0, B0, C0, D0, A1, B1, C1, D1) \
+    do {                                        \
+        A0 = fBlaMka_wasm(A0, B0);              \
+        A1 = fBlaMka_wasm(A1, B1);              \
+                                                \
+        D0 = wasm_v128_xor(D0, A0);             \
+        D1 = wasm_v128_xor(D1, A1);             \
+                                                \
+        D0 = rotr64_16_wasm(D0);                \
+        D1 = rotr64_16_wasm(D1);                \
+                                                \
+        C0 = fBlaMka_wasm(C0, D0);              \
+        C1 = fBlaMka_wasm(C1, D1);              \
+                                                \
+        B0 = wasm_v128_xor(B0, C0);             \
+        B1 = wasm_v128_xor(B1, C1);             \
+                                                \
+        B0 = rotr64_63_wasm(B0);                \
+        B1 = rotr64_63_wasm(B1);                \
+    } while ((void) 0, 0)
+
+static inline v128_t
+wasm_alignr_8(v128_t a, v128_t b)
+{
+    return wasm_i8x16_shuffle(b, a, 8, 9, 10, 11, 12, 13, 14, 15,
+                              16, 17, 18, 19, 20, 21, 22, 23);
+}
+
+#define DIAGONALIZE_WASM(A0, B0, C0, D0, A1, B1, C1, D1) \
+    do {                                                 \
+        v128_t t0 = wasm_alignr_8(B1, B0);               \
+        v128_t t1 = wasm_alignr_8(B0, B1);               \
+        B0        = t0;                                  \
+        B1        = t1;                                  \
+                                                         \
+        t0 = C0;                                         \
+        C0 = C1;                                         \
+        C1 = t0;                                         \
+                                                         \
+        t0 = wasm_alignr_8(D1, D0);                      \
+        t1 = wasm_alignr_8(D0, D1);                      \
+        D0 = t1;                                         \
+        D1 = t0;                                         \
+    } while ((void) 0, 0)
+
+#define UNDIAGONALIZE_WASM(A0, B0, C0, D0, A1, B1, C1, D1) \
+    do {                                                   \
+        v128_t t0 = wasm_alignr_8(B0, B1);                 \
+        v128_t t1 = wasm_alignr_8(B1, B0);                 \
+        B0        = t0;                                    \
+        B1        = t1;                                    \
+                                                           \
+        t0 = C0;                                           \
+        C0 = C1;                                           \
+        C1 = t0;                                           \
+                                                           \
+        t0 = wasm_alignr_8(D0, D1);                        \
+        t1 = wasm_alignr_8(D1, D0);                        \
+        D0 = t1;                                           \
+        D1 = t0;                                           \
+    } while ((void) 0, 0)
+
+#define BLAKE2_ROUND_WASM(A0, A1, B0, B1, C0, C1, D0, D1)   \
+    do {                                                    \
+        G1_WASM(A0, B0, C0, D0, A1, B1, C1, D1);            \
+        G2_WASM(A0, B0, C0, D0, A1, B1, C1, D1);            \
+                                                            \
+        DIAGONALIZE_WASM(A0, B0, C0, D0, A1, B1, C1, D1);   \
+                                                            \
+        G1_WASM(A0, B0, C0, D0, A1, B1, C1, D1);            \
+        G2_WASM(A0, B0, C0, D0, A1, B1, C1, D1);            \
+                                                            \
+        UNDIAGONALIZE_WASM(A0, B0, C0, D0, A1, B1, C1, D1); \
+    } while ((void) 0, 0)
+
+#endif

src/libsodium/crypto_secretbox/crypto_secretbox_easy.c

@@ -115,6 +115,7 @@ crypto_secretbox_open_detached(unsigned char *m, const unsigned char *c,
     if (m == NULL) {
         return 0;
     }
+    ACQUIRE_FENCE;
 
     /*
      * Allow the m and c buffers to partially overlap, by calling

src/libsodium/crypto_secretbox/xchacha20poly1305/secretbox_xchacha20poly1305.c

@@ -124,6 +124,7 @@ crypto_secretbox_xchacha20poly1305_open_detached(unsigned char *m,
     if (m == NULL) {
         return 0;
     }
+    ACQUIRE_FENCE;
 
     /*
      * Allow the m and c buffers to partially overlap, by calling

src/libsodium/crypto_secretbox/xsalsa20poly1305/secretbox_xsalsa20poly1305.c

@@ -2,6 +2,7 @@
 #include "crypto_secretbox_xsalsa20poly1305.h"
 #include "crypto_stream_xsalsa20.h"
 #include "randombytes.h"
+#include "private/common.h"
 
 int
 crypto_secretbox_xsalsa20poly1305(unsigned char *c, const unsigned char *m,
@@ -39,6 +40,7 @@ crypto_secretbox_xsalsa20poly1305_open(unsigned char *m, const unsigned char *c,
                                            clen - 32, subkey) != 0) {
         return -1;
     }
+    ACQUIRE_FENCE;
     crypto_stream_xsalsa20_xor(m, c, clen, n, k);
     for (i = 0; i < 32; ++i) {
         m[i] = 0;

src/libsodium/crypto_secretstream/xchacha20poly1305/secretstream_xchacha20poly1305.c

@@ -241,6 +241,7 @@ crypto_secretstream_xchacha20poly1305_pull
         return -1;
     }
 
+    ACQUIRE_FENCE;
     crypto_stream_chacha20_ietf_xor_ic(m, c, mlen, state->nonce, 2U, state->k);
     XOR_BUF(STATE_INONCE(state), mac,
             crypto_secretstream_xchacha20poly1305_INONCEBYTES);

src/libsodium/include/Makefile.am

@@ -26,13 +26,16 @@ SODIUM_EXPORT = \
 	sodium/crypto_generichash_blake2b.h \
 	sodium/crypto_hash.h \
 	sodium/crypto_hash_sha256.h \
+	sodium/crypto_hash_sha3.h \
 	sodium/crypto_hash_sha512.h \
 	sodium/crypto_ipcrypt.h \
 	sodium/crypto_kdf.h \
 	sodium/crypto_kdf_blake2b.h \
 	sodium/crypto_kdf_hkdf_sha256.h \
 	sodium/crypto_kdf_hkdf_sha512.h \
+	sodium/crypto_kem.h \
 	sodium/crypto_kem_mlkem768.h \
+	sodium/crypto_kem_xwing.h \
 	sodium/crypto_kx.h \
 	sodium/crypto_onetimeauth.h \
 	sodium/crypto_onetimeauth_poly1305.h \

src/libsodium/include/sodium.h

@@ -26,13 +26,16 @@
 #include "sodium/crypto_generichash_blake2b.h"
 #include "sodium/crypto_hash.h"
 #include "sodium/crypto_hash_sha256.h"
+#include "sodium/crypto_hash_sha3.h"
 #include "sodium/crypto_hash_sha512.h"
 #include "sodium/crypto_ipcrypt.h"
 #include "sodium/crypto_kdf.h"
 #include "sodium/crypto_kdf_hkdf_sha256.h"
 #include "sodium/crypto_kdf_hkdf_sha512.h"
 #include "sodium/crypto_kdf_blake2b.h"
+#include "sodium/crypto_kem.h"
 #include "sodium/crypto_kem_mlkem768.h"
+#include "sodium/crypto_kem_xwing.h"
 #include "sodium/crypto_kx.h"
 #include "sodium/crypto_onetimeauth.h"
 #include "sodium/crypto_onetimeauth_poly1305.h"

src/libsodium/include/sodium/crypto_core_ed25519.h

@@ -47,14 +47,16 @@ int crypto_core_ed25519_sub(unsigned char *r,
 
 SODIUM_EXPORT
 int crypto_core_ed25519_from_string(unsigned char p[crypto_core_ed25519_BYTES],
-                                    const char *ctx, const unsigned char *msg,
-                                    size_t msg_len, int hash_alg)
+                                    const unsigned char *ctx, size_t ctx_len,
+                                    const unsigned char *msg, size_t msg_len,
+                                    int hash_alg)
             __attribute__ ((nonnull(1)));
 
 SODIUM_EXPORT
 int crypto_core_ed25519_from_string_ro(unsigned char p[crypto_core_ed25519_BYTES],
-                                       const char *ctx, const unsigned char *msg,
-                                       size_t msg_len, int hash_alg)
+                                       const unsigned char *ctx, size_t ctx_len,
+                                       const unsigned char *msg, size_t msg_len,
+                                       int hash_alg)
             __attribute__ ((nonnull(1)));
 
 SODIUM_EXPORT

src/libsodium/include/sodium/crypto_core_ristretto255.h

@@ -48,16 +48,16 @@ int crypto_core_ristretto255_from_hash(unsigned char *p,
 
 SODIUM_EXPORT
 int crypto_core_ristretto255_from_string(unsigned char p[crypto_core_ristretto255_BYTES],
-                                         const char *ctx,
-                                         const unsigned char *msg,
-                                         size_t msg_len, int hash_alg)
+                                         const unsigned char *ctx, size_t ctx_len,
+                                         const unsigned char *msg, size_t msg_len,
+                                         int hash_alg)
             __attribute__ ((nonnull(1)));
 
 SODIUM_EXPORT
 int crypto_core_ristretto255_from_string_ro(unsigned char p[crypto_core_ristretto255_BYTES],
-                                            const char *ctx,
-                                            const unsigned char *msg,
-                                            size_t msg_len, int hash_alg)
+                                            const unsigned char *ctx, size_t ctx_len,
+                                            const unsigned char *msg, size_t msg_len,
+                                            int hash_alg)
             __attribute__ ((nonnull(1)));
 
 SODIUM_EXPORT

src/libsodium/include/sodium/crypto_hash_sha3.h

@@ -0,0 +1,80 @@
+#ifndef crypto_hash_sha3_H
+#define crypto_hash_sha3_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "export.h"
+
+#ifdef __cplusplus
+# ifdef __GNUC__
+#  pragma GCC diagnostic ignored "-Wlong-long"
+# endif
+extern "C" {
+#endif
+
+typedef struct CRYPTO_ALIGN(16) crypto_hash_sha3256_state {
+    unsigned char opaque[256];
+} crypto_hash_sha3256_state;
+
+SODIUM_EXPORT
+size_t crypto_hash_sha3256_statebytes(void);
+
+#define crypto_hash_sha3256_BYTES 32U
+SODIUM_EXPORT
+size_t crypto_hash_sha3256_bytes(void);
+
+SODIUM_EXPORT
+int crypto_hash_sha3256(unsigned char *out, const unsigned char *in,
+                        unsigned long long inlen) __attribute__ ((nonnull(1)));
+
+SODIUM_EXPORT
+int crypto_hash_sha3256_init(crypto_hash_sha3256_state *state)
+            __attribute__ ((nonnull));
+
+SODIUM_EXPORT
+int crypto_hash_sha3256_update(crypto_hash_sha3256_state *state,
+                               const unsigned char *in,
+                               unsigned long long inlen)
+            __attribute__ ((nonnull(1)));
+
+SODIUM_EXPORT
+int crypto_hash_sha3256_final(crypto_hash_sha3256_state *state,
+                              unsigned char *out)
+            __attribute__ ((nonnull));
+
+typedef struct CRYPTO_ALIGN(16) crypto_hash_sha3512_state {
+    unsigned char opaque[256];
+} crypto_hash_sha3512_state;
+
+SODIUM_EXPORT
+size_t crypto_hash_sha3512_statebytes(void);
+
+#define crypto_hash_sha3512_BYTES 64U
+SODIUM_EXPORT
+size_t crypto_hash_sha3512_bytes(void);
+
+SODIUM_EXPORT
+int crypto_hash_sha3512(unsigned char *out, const unsigned char *in,
+                        unsigned long long inlen) __attribute__ ((nonnull(1)));
+
+SODIUM_EXPORT
+int crypto_hash_sha3512_init(crypto_hash_sha3512_state *state)
+            __attribute__ ((nonnull));
+
+SODIUM_EXPORT
+int crypto_hash_sha3512_update(crypto_hash_sha3512_state *state,
+                               const unsigned char *in,
+                               unsigned long long inlen)
+            __attribute__ ((nonnull(1)));
+
+SODIUM_EXPORT
+int crypto_hash_sha3512_final(crypto_hash_sha3512_state *state,
+                              unsigned char *out)
+            __attribute__ ((nonnull));
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

src/libsodium/include/sodium/crypto_ipcrypt.h

@@ -63,6 +63,10 @@ size_t crypto_ipcrypt_pfx_bytes(void);
 SODIUM_EXPORT
 void crypto_ipcrypt_keygen(unsigned char k[crypto_ipcrypt_KEYBYTES]) __attribute__((nonnull));
 
+SODIUM_EXPORT
+void crypto_ipcrypt_nd_keygen(unsigned char k[crypto_ipcrypt_ND_KEYBYTES])
+    __attribute__((nonnull));
+
 SODIUM_EXPORT
 void crypto_ipcrypt_ndx_keygen(unsigned char k[crypto_ipcrypt_NDX_KEYBYTES])
     __attribute__((nonnull));

src/libsodium/include/sodium/crypto_kem.h

@@ -0,0 +1,70 @@
+#ifndef crypto_kem_H
+#define crypto_kem_H
+
+/*
+ * THREAD SAFETY: crypto_kem_keypair() is thread-safe,
+ * provided that sodium_init() was called before.
+ *
+ * Other functions are always thread-safe.
+ */
+
+#include <stddef.h>
+
+#include "crypto_kem_xwing.h"
+#include "export.h"
+
+#ifdef __cplusplus
+# ifdef __GNUC__
+#  pragma GCC diagnostic ignored "-Wlong-long"
+# endif
+extern "C" {
+#endif
+
+#define crypto_kem_PUBLICKEYBYTES crypto_kem_xwing_PUBLICKEYBYTES
+SODIUM_EXPORT
+size_t crypto_kem_publickeybytes(void);
+
+#define crypto_kem_SECRETKEYBYTES crypto_kem_xwing_SECRETKEYBYTES
+SODIUM_EXPORT
+size_t crypto_kem_secretkeybytes(void);
+
+#define crypto_kem_CIPHERTEXTBYTES crypto_kem_xwing_CIPHERTEXTBYTES
+SODIUM_EXPORT
+size_t crypto_kem_ciphertextbytes(void);
+
+#define crypto_kem_SHAREDSECRETBYTES crypto_kem_xwing_SHAREDSECRETBYTES
+SODIUM_EXPORT
+size_t crypto_kem_sharedsecretbytes(void);
+
+#define crypto_kem_SEEDBYTES crypto_kem_xwing_SEEDBYTES
+SODIUM_EXPORT
+size_t crypto_kem_seedbytes(void);
+
+#define crypto_kem_PRIMITIVE "xwing"
+SODIUM_EXPORT
+const char *crypto_kem_primitive(void);
+
+SODIUM_EXPORT
+int crypto_kem_seed_keypair(unsigned char *pk, unsigned char *sk,
+                            const unsigned char *seed)
+            __attribute__ ((nonnull));
+
+SODIUM_EXPORT
+int crypto_kem_keypair(unsigned char *pk, unsigned char *sk)
+            __attribute__ ((nonnull));
+
+SODIUM_EXPORT
+int crypto_kem_enc(unsigned char *ct, unsigned char *ss,
+                   const unsigned char *pk)
+            __attribute__ ((warn_unused_result)) __attribute__ ((nonnull));
+
+SODIUM_EXPORT
+int crypto_kem_dec(unsigned char *ss, const unsigned char *ct,
+                   const unsigned char *sk)
+            __attribute__ ((warn_unused_result)) __attribute__ ((nonnull));
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

src/libsodium/include/sodium/crypto_kem_xwing.h

@@ -0,0 +1,69 @@
+#ifndef crypto_kem_xwing_H
+#define crypto_kem_xwing_H
+
+#include <stddef.h>
+
+#include "export.h"
+
+#ifdef __cplusplus
+#    ifdef __GNUC__
+#        pragma GCC diagnostic ignored "-Wlong-long"
+#    endif
+extern "C" {
+#endif
+
+#define crypto_kem_xwing_PUBLICKEYBYTES 1216U
+SODIUM_EXPORT
+size_t crypto_kem_xwing_publickeybytes(void);
+
+#define crypto_kem_xwing_SECRETKEYBYTES 32U
+SODIUM_EXPORT
+size_t crypto_kem_xwing_secretkeybytes(void);
+
+#define crypto_kem_xwing_CIPHERTEXTBYTES 1120U
+SODIUM_EXPORT
+size_t crypto_kem_xwing_ciphertextbytes(void);
+
+#define crypto_kem_xwing_SHAREDSECRETBYTES 32U
+SODIUM_EXPORT
+size_t crypto_kem_xwing_sharedsecretbytes(void);
+
+#define crypto_kem_xwing_SEEDBYTES 32U
+SODIUM_EXPORT
+size_t crypto_kem_xwing_seedbytes(void);
+
+SODIUM_EXPORT
+int crypto_kem_xwing_seed_keypair(unsigned char       pk[crypto_kem_xwing_PUBLICKEYBYTES],
+                                  unsigned char       sk[crypto_kem_xwing_SECRETKEYBYTES],
+                                  const unsigned char seed[crypto_kem_xwing_SEEDBYTES])
+    __attribute__((nonnull));
+
+SODIUM_EXPORT
+int crypto_kem_xwing_keypair(unsigned char pk[crypto_kem_xwing_PUBLICKEYBYTES],
+                             unsigned char sk[crypto_kem_xwing_SECRETKEYBYTES])
+    __attribute__((nonnull));
+
+SODIUM_EXPORT
+int crypto_kem_xwing_enc(unsigned char       ct[crypto_kem_xwing_CIPHERTEXTBYTES],
+                         unsigned char       ss[crypto_kem_xwing_SHAREDSECRETBYTES],
+                         const unsigned char pk[crypto_kem_xwing_PUBLICKEYBYTES])
+    __attribute__((warn_unused_result)) __attribute__((nonnull));
+
+SODIUM_EXPORT
+int crypto_kem_xwing_enc_deterministic(unsigned char       ct[crypto_kem_xwing_CIPHERTEXTBYTES],
+                                       unsigned char       ss[crypto_kem_xwing_SHAREDSECRETBYTES],
+                                       const unsigned char pk[crypto_kem_xwing_PUBLICKEYBYTES],
+                                       const unsigned char seed[64])
+    __attribute__((warn_unused_result)) __attribute__((nonnull));
+
+SODIUM_EXPORT
+int crypto_kem_xwing_dec(unsigned char       ss[crypto_kem_xwing_SHAREDSECRETBYTES],
+                         const unsigned char ct[crypto_kem_xwing_CIPHERTEXTBYTES],
+                         const unsigned char sk[crypto_kem_xwing_SECRETKEYBYTES])
+    __attribute__((warn_unused_result)) __attribute__((nonnull));
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

src/libsodium/include/sodium/crypto_xof_shake128.h

@@ -24,7 +24,7 @@ size_t crypto_xof_shake128_statebytes(void);
 SODIUM_EXPORT
 unsigned char crypto_xof_shake128_domain_standard(void);
 
-typedef struct CRYPTO_ALIGN(64) crypto_xof_shake128_state {
+typedef struct CRYPTO_ALIGN(16) crypto_xof_shake128_state {
     unsigned char opaque[256];
 } crypto_xof_shake128_state;
 

src/libsodium/include/sodium/crypto_xof_shake256.h

@@ -20,7 +20,7 @@ size_t crypto_xof_shake256_statebytes(void);
 SODIUM_EXPORT
 unsigned char crypto_xof_shake256_domain_standard(void);
 
-typedef struct CRYPTO_ALIGN(64) crypto_xof_shake256_state {
+typedef struct CRYPTO_ALIGN(16) crypto_xof_shake256_state {
     unsigned char opaque[256];
 } crypto_xof_shake256_state;
 

src/libsodium/include/sodium/crypto_xof_turboshake128.h

@@ -20,7 +20,7 @@ size_t crypto_xof_turboshake128_statebytes(void);
 SODIUM_EXPORT
 unsigned char crypto_xof_turboshake128_domain_standard(void);
 
-typedef struct CRYPTO_ALIGN(64) crypto_xof_turboshake128_state {
+typedef struct CRYPTO_ALIGN(16) crypto_xof_turboshake128_state {
     unsigned char opaque[256];
 } crypto_xof_turboshake128_state;
 

src/libsodium/include/sodium/crypto_xof_turboshake256.h

@@ -20,7 +20,7 @@ size_t crypto_xof_turboshake256_statebytes(void);
 SODIUM_EXPORT
 unsigned char crypto_xof_turboshake256_domain_standard(void);
 
-typedef struct CRYPTO_ALIGN(64) crypto_xof_turboshake256_state {
+typedef struct CRYPTO_ALIGN(16) crypto_xof_turboshake256_state {
     unsigned char opaque[256];
 } crypto_xof_turboshake256_state;
 

src/libsodium/include/sodium/private/quirks.h

@@ -70,6 +70,11 @@
 #define ge25519_scalarmult _sodium_ge25519_scalarmult
 #define ge25519_scalarmult_base _sodium_ge25519_scalarmult_base
 #define ge25519_tobytes _sodium_ge25519_tobytes
+#define keccak1600_armsha3_extract_bytes _sodium_keccak1600_armsha3_extract_bytes
+#define keccak1600_armsha3_init _sodium_keccak1600_armsha3_init
+#define keccak1600_armsha3_permute_12 _sodium_keccak1600_armsha3_permute_12
+#define keccak1600_armsha3_permute_24 _sodium_keccak1600_armsha3_permute_24
+#define keccak1600_armsha3_xor_bytes _sodium_keccak1600_armsha3_xor_bytes
 #define keccak1600_ref_extract_bytes _sodium_keccak1600_ref_extract_bytes
 #define keccak1600_ref_init _sodium_keccak1600_ref_init
 #define keccak1600_ref_permute_12 _sodium_keccak1600_ref_permute_12

src/libsodium/randombytes/randombytes.c

@@ -65,6 +65,20 @@ javascript_stir(void)
                 };
                 randomValuesStandard();
                 Module.getRandomValue = randomValuesStandard;
+                Module.getRandomBytes = function(ptr, size) {
+                    var heapu8 = Module.HEAPU8;
+                    var chunk = 65536;
+                    while (size > chunk) {
+                        var buf = new Uint8Array(chunk);
+                        crypto_.getRandomValues(buf);
+                        heapu8.set(buf, ptr);
+                        ptr += chunk;
+                        size -= chunk;
+                    }
+                    var buf = new Uint8Array(size);
+                    crypto_.getRandomValues(buf);
+                    heapu8.set(buf, ptr);
+                };
             } catch (e) {
                 try {
                     var crypto = require('crypto');
@@ -74,22 +88,41 @@ javascript_stir(void)
                     };
                     randomValueNodeJS();
                     Module.getRandomValue = randomValueNodeJS;
+                    Module.getRandomBytes = function(ptr, size) {
+                        var buf = crypto['randomBytes'](size);
+                        Module.HEAPU8.set(buf, ptr);
+                    };
                 } catch (e) {
                     throw 'No secure random number generator found';
                 }
             }
         }
+        if (Module.getRandomBytes === undefined) {
+            Module.getRandomBytes = function(ptr, size) {
+                var heapu8 = Module.HEAPU8;
+                for (var i = 0; i < size; i++) {
+                    heapu8[ptr + i] = Module.getRandomValue() & 0xff;
+                }
+            };
+        }
     });
 }
 
 static void
 javascript_buf(void * const buf, const size_t size)
 {
-    unsigned char *p = (unsigned char *) buf;
-    size_t         i;
-
-    for (i = (size_t) 0U; i < size; i++) {
-        p[i] = (unsigned char) randombytes_random();
+    if (size > (size_t) 0U) {
+        EM_ASM({
+            if (Module.getRandomBytes === undefined) {
+                Module.getRandomBytes = function(ptr, size) {
+                    var heapu8 = Module.HEAPU8;
+                    for (var i = 0; i < size; i++) {
+                        heapu8[ptr + i] = Module.getRandomValue() & 0xff;
+                    }
+                };
+            }
+            Module.getRandomBytes($0, $1);
+        }, buf, size);
     }
 }
 #endif

test/default/Makefile.am

@@ -44,10 +44,14 @@ EXTRA_DIST = \
 	generichash3.exp \
 	hash.exp \
 	hash3.exp \
+	hash_sha3256.exp \
+	hash_sha3512.exp \
 	ipcrypt.exp \
 	kdf.exp \
 	kdf_hkdf.exp \
+	kem.exp \
 	kem_mlkem768.exp \
+	kem_xwing.exp \
 	keygen.exp \
 	kx.exp \
 	metamorphic.exp \
@@ -136,10 +140,14 @@ DISTCLEANFILES = \
 	hash.res \
 	hash2.res \
 	hash3.res \
+	hash_sha3256.res \
+	hash_sha3512.res \
 	ipcrypt.res \
 	kdf.res \
 	kdf_hkdf.res \
+	kem.res \
 	kem_mlkem768.res \
+	kem_xwing.res \
 	keygen.res \
 	kx.res \
 	metamorphic.res \
@@ -234,9 +242,13 @@ TESTS_TARGETS = \
 	generichash3 \
 	hash \
 	hash3 \
+	hash_sha3256 \
+	hash_sha3512 \
 	ipcrypt \
 	kdf \
+	kem \
 	kem_mlkem768 \
+	kem_xwing \
 	keygen \
 	kx \
 	metamorphic \
@@ -406,6 +418,12 @@ hash_LDADD                = $(TESTS_LDADD)
 hash3_SOURCE              = cmptest.h hash3.c
 hash3_LDADD               = $(TESTS_LDADD)
 
+hash_sha3256_SOURCE       = cmptest.h hash_sha3256.c
+hash_sha3256_LDADD        = $(TESTS_LDADD)
+
+hash_sha3512_SOURCE       = cmptest.h hash_sha3512.c
+hash_sha3512_LDADD        = $(TESTS_LDADD)
+
 ipcrypt_SOURCE            = cmptest.h ipcrypt.c
 ipcrypt_LDADD             = $(TESTS_LDADD)
 
@@ -415,9 +433,15 @@ kdf_LDADD                 = $(TESTS_LDADD)
 kdf_hkdf_SOURCE            = cmptest.h kdf_hkdf.c
 kdf_hkdf_LDADD             = $(TESTS_LDADD)
 
+kem_SOURCE                 = cmptest.h kem.c
+kem_LDADD                  = $(TESTS_LDADD)
+
 kem_mlkem768_SOURCE        = cmptest.h kem_mlkem768.c
 kem_mlkem768_LDADD         = $(TESTS_LDADD)
 
+kem_xwing_SOURCE           = cmptest.h kem_xwing.c
+kem_xwing_LDADD            = $(TESTS_LDADD)
+
 keygen_SOURCE             = cmptest.h keygen.c
 keygen_LDADD              = $(TESTS_LDADD)
 

test/default/core_ed25519_h2c.c

@@ -4,20 +4,25 @@
 typedef struct TestData_ {
     int         ro;
     const char *msg;
+    const char  tv_x[64 + 1];
     const char  tv_y[64 + 1];
 } TestData;
 
 static TestData test_data[] = {
     { 0, "",
+      "1ff2b70ecf862799e11b7ae744e3489aa058ce805dd323a936375a84695e76da",
       "222e314d04a4d5725e9f2aff9fb2a6b69ef375a1214eb19021ceab2d687f0f9b" },
     { 0, "abc",
+      "5f13cc69c891d86927eb37bd4afc6672360007c63f68a33ab423a3aa040fd2a8",
       "67732d50f9a26f73111dd1ed5dba225614e538599db58ba30aaea1f5c827fa42" },
     { 0, "abcdef0123456789",
+      "1dd2fefce934ecfd7aae6ec998de088d7dd03316aa1847198aecf699ba6613f1",
       "2f8a6c24dd1adde73909cada6a4a137577b0f179d336685c4a955a0a8e1a86fb" },
     { 0,
       "q128_"
       "qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq"
       "qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq",
+      "35fbdc5143e8a97afd3096f2b843e07df72e15bfca2eaf6879bf97c5d3362f73",
       "2af6ff6ef5ebba128b0774f4296cb4c2279a074658b083b8dcca91f57a603450" },
     { 0,
       "a512_"
@@ -29,17 +34,22 @@ static TestData test_data[] = {
       "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
       "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
       "aaaaaaaa",
+      "6e5e1f37e99345887fc12111575fc1c3e36df4b289b8759d23af14d774b66bff",
       "2c90c3d39eb18ff291d33441b35f3262cdd307162cc97c31bfcc7a4245891a37" },
     { 1, "",
+      "3c3da6925a3c3c268448dcabb47ccde5439559d9599646a8260e47b1e4822fc6",
       "09a6c8561a0b22bef63124c588ce4c62ea83a3c899763af26d795302e115dc21" },
     { 1, "abc",
+      "608040b42285cc0d72cbb3985c6b04c935370c7361f4b7fbdb1ae7f8c1a8ecad",
       "1a8395b88338f22e435bbd301183e7f20a5f9de643f11882fb237f88268a5531" },
     { 1, "abcdef0123456789",
+      "6d7fabf47a2dc03fe7d47f7dddd21082c5fb8f86743cd020f3fb147d57161472",
       "53060a3d140e7fbcda641ed3cf42c88a75411e648a1add71217f70ea8ec561a6" },
     { 1,
       "q128_"
       "qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq"
       "qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq",
+      "5fb0b92acedd16f3bcb0ef83f5c7b7a9466b5f1e0d8d217421878ea3686f8524",
       "2eca15e355fcfa39d2982f67ddb0eea138e2994f5956ed37b7f72eea5e89d2f7" },
     { 1,
       "a512_"
@@ -51,6 +61,7 @@ static TestData test_data[] = {
       "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
       "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
       "aaaaaaaa",
+      "0efcfde5898a839b00997fbe40d2ebe950bc81181afbd5cd6b9618aa336c1e8c",
       "6dc2fc04f266c5c27f236a80b14f92ccd051ef1ff027f26a07f8c0f327d8f995" }
 };
 
@@ -59,12 +70,16 @@ static TestData test_data[] = {
 int
 main(void)
 {
+    unsigned char *expected_xr, *expected_x;
     unsigned char *expected_yr, *expected_y, *y;
+    unsigned char  expected_x_sign;
     char *         expected_y_hex, *y_hex;
     char *         oversized_ctx;
     size_t         i, j;
     size_t         oversized_ctx_len = 500U;
 
+    expected_xr = (unsigned char *) sodium_malloc(crypto_core_ed25519_BYTES);
+    expected_x  = (unsigned char *) sodium_malloc(crypto_core_ed25519_BYTES);
     expected_yr = (unsigned char *) sodium_malloc(crypto_core_ed25519_BYTES);
     expected_y  = (unsigned char *) sodium_malloc(crypto_core_ed25519_BYTES);
     y           = (unsigned char *) sodium_malloc(crypto_core_ed25519_BYTES);
@@ -72,6 +87,13 @@ main(void)
         (char *) sodium_malloc(crypto_core_ed25519_BYTES * 2U + 1U);
     y_hex = (char *) sodium_malloc(crypto_core_ed25519_BYTES * 2U + 1U);
     for (i = 0U; i < (sizeof test_data) / (sizeof test_data[0]); i++) {
+        sodium_hex2bin(expected_xr, crypto_core_ed25519_BYTES,
+                       test_data[i].tv_x, (size_t) -1U, NULL, NULL, NULL);
+        for (j = 0; j < crypto_core_ed25519_BYTES; j++) {
+            expected_x[j] = expected_xr[crypto_core_ed25519_BYTES - 1U - j];
+        }
+        expected_x_sign = expected_x[0] & 1;
+
         sodium_hex2bin(expected_yr, crypto_core_ed25519_BYTES,
                        test_data[i].tv_y, (size_t) -1U, NULL, NULL, NULL);
         for (j = 0; j < crypto_core_ed25519_BYTES; j++) {
@@ -79,19 +101,26 @@ main(void)
         }
         if (test_data[i].ro == 0) {
             if (crypto_core_ed25519_from_string(
-                    y, "QUUX-V01-CS02-with-edwards25519_XMD:SHA-512_ELL2_NU_",
+                    y,
+                    (const unsigned char *) "QUUX-V01-CS02-with-edwards25519_XMD:SHA-512_ELL2_NU_",
+                    sizeof("QUUX-V01-CS02-with-edwards25519_XMD:SHA-512_ELL2_NU_") - 1U,
                     (const unsigned char *) test_data[i].msg,
                     strlen(test_data[i].msg), H2CHASH) != 0) {
                 printf("crypto_core_ed25519_from_string() failed\n");
             }
         } else {
             if (crypto_core_ed25519_from_string_ro(
-                    y, "QUUX-V01-CS02-with-edwards25519_XMD:SHA-512_ELL2_RO_",
+                    y,
+                    (const unsigned char *) "QUUX-V01-CS02-with-edwards25519_XMD:SHA-512_ELL2_RO_",
+                    sizeof("QUUX-V01-CS02-with-edwards25519_XMD:SHA-512_ELL2_RO_") - 1U,
                     (const unsigned char *) test_data[i].msg,
                     strlen(test_data[i].msg), H2CHASH) != 0) {
                 printf("crypto_core_ed25519_from_string_ro() failed\n");
             }
         }
+        if (((y[crypto_core_ed25519_BYTES - 1U] >> 7) & 1) != expected_x_sign) {
+            printf("Test #%u failed - x sign bit mismatch\n", (unsigned) i);
+        }
         y[crypto_core_ed25519_BYTES - 1U] &= 0x7f;
         if (memcmp(y, expected_y, crypto_core_ed25519_BYTES) != 0) {
             sodium_bin2hex(expected_y_hex, crypto_core_ed25519_BYTES * 2U + 1U,
@@ -103,38 +132,41 @@ main(void)
         }
     }
 
-    if (crypto_core_ed25519_from_string(y, NULL, (const unsigned char *) "msg",
+    if (crypto_core_ed25519_from_string(y, NULL, 0U, (const unsigned char *) "msg",
                                         3U, H2CHASH) != 0 ||
-        crypto_core_ed25519_from_string(y, "", guard_page, 0U, H2CHASH) != 0 ||
+        crypto_core_ed25519_from_string(y, (const unsigned char *) "", 0U,
+                                        guard_page, 0U, H2CHASH) != 0 ||
         crypto_core_ed25519_from_string_ro(
-            y, NULL, (const unsigned char *) "msg", 3U, H2CHASH) != 0 ||
-        crypto_core_ed25519_from_string_ro(y, "", guard_page, 0U,
-                                           H2CHASH) != 0) {
+            y, NULL, 0U, (const unsigned char *) "msg", 3U, H2CHASH) != 0 ||
+        crypto_core_ed25519_from_string_ro(y, (const unsigned char *) "", 0U,
+                                           guard_page, 0U, H2CHASH) != 0) {
         printf("Failed with empty parameters");
     }
 
     oversized_ctx = (char *) sodium_malloc(oversized_ctx_len);
-    memset(oversized_ctx, 'X', oversized_ctx_len - 1U);
-    oversized_ctx[oversized_ctx_len - 1U] = 0;
-    crypto_core_ed25519_from_string(y, oversized_ctx,
+    memset(oversized_ctx, 'X', oversized_ctx_len);
+    crypto_core_ed25519_from_string(y, (const unsigned char *) oversized_ctx,
+                                    oversized_ctx_len - 1U,
                                     (const unsigned char *) "msg", 3U,
                                     H2CHASH);
     sodium_bin2hex(y_hex, crypto_core_ed25519_BYTES * 2U + 1U, y,
                    crypto_core_ed25519_BYTES);
     printf("NU with oversized context: %s\n", y_hex);
-    crypto_core_ed25519_from_string_ro(y, oversized_ctx,
+    crypto_core_ed25519_from_string_ro(y, (const unsigned char *) oversized_ctx,
+                                       oversized_ctx_len - 1U,
                                        (const unsigned char *) "msg", 3U,
                                        H2CHASH);
     sodium_bin2hex(y_hex, crypto_core_ed25519_BYTES * 2U + 1U, y,
                    crypto_core_ed25519_BYTES);
     printf("RO with oversized context: %s\n", y_hex);
-
     sodium_free(oversized_ctx);
     sodium_free(y_hex);
     sodium_free(expected_y_hex);
     sodium_free(y);
     sodium_free(expected_y);
     sodium_free(expected_yr);
+    sodium_free(expected_x);
+    sodium_free(expected_xr);
 
     printf("OK\n");
 

test/default/hash_sha3256.c

@@ -0,0 +1,131 @@
+
+#define TEST_NAME "hash_sha3256"
+#include "cmptest.h"
+
+int
+main(void)
+{
+    static const unsigned char msg_abc[] = { 0x61, 0x62, 0x63 };
+
+    static const unsigned char msg_fox[] = {
+        0x54, 0x68, 0x65, 0x20, 0x71, 0x75, 0x69, 0x63, 0x6b, 0x20, 0x62, 0x72,
+        0x6f, 0x77, 0x6e, 0x20, 0x66, 0x6f, 0x78, 0x20, 0x6a, 0x75, 0x6d, 0x70,
+        0x73, 0x20, 0x6f, 0x76, 0x65, 0x72, 0x20, 0x74, 0x68, 0x65, 0x20, 0x6c,
+        0x61, 0x7a, 0x79, 0x20, 0x64, 0x6f, 0x67
+    };
+
+    static const unsigned char out_empty[32] = {
+        0xa7, 0xff, 0xc6, 0xf8, 0xbf, 0x1e, 0xd7, 0x66, 0x51, 0xc1, 0x47, 0x56,
+        0xa0, 0x61, 0xd6, 0x62, 0xf5, 0x80, 0xff, 0x4d, 0xe4, 0x3b, 0x49, 0xfa,
+        0x82, 0xd8, 0x0a, 0x4b, 0x80, 0xf8, 0x43, 0x4a
+    };
+
+    static const unsigned char out_abc[32] = {
+        0x3a, 0x98, 0x5d, 0xa7, 0x4f, 0xe2, 0x25, 0xb2, 0x04, 0x5c, 0x17, 0x2d,
+        0x6b, 0xd3, 0x90, 0xbd, 0x85, 0x5f, 0x08, 0x6e, 0x3e, 0x9d, 0x52, 0x5b,
+        0x46, 0xbf, 0xe2, 0x45, 0x11, 0x43, 0x15, 0x32
+    };
+
+    static const unsigned char out_fox[32] = {
+        0x69, 0x07, 0x0d, 0xda, 0x01, 0x97, 0x5c, 0x8c, 0x12, 0x0c, 0x3a, 0xad,
+        0xa1, 0xb2, 0x82, 0x39, 0x4e, 0x7f, 0x03, 0x2f, 0xa9, 0xcf, 0x32, 0xf4,
+        0xcb, 0x22, 0x59, 0xa0, 0x89, 0x7d, 0xfc, 0x04
+    };
+
+    unsigned char             out[32];
+    crypto_hash_sha3256_state state;
+    size_t                    i;
+
+    assert(crypto_hash_sha3256_bytes() == 32);
+    assert(crypto_hash_sha3256_statebytes() > 0);
+
+    crypto_hash_sha3256(out, NULL, 0);
+    assert(memcmp(out, out_empty, 32) == 0);
+    printf("SHA3-256(\"\") = ");
+    for (i = 0; i < 32; i++) {
+        printf("%02x", out[i]);
+    }
+    printf("\n");
+
+    crypto_hash_sha3256(out, msg_abc, 3);
+    assert(memcmp(out, out_abc, 32) == 0);
+    printf("SHA3-256(\"abc\") = ");
+    for (i = 0; i < 32; i++) {
+        printf("%02x", out[i]);
+    }
+    printf("\n");
+
+    crypto_hash_sha3256(out, msg_fox, 43);
+    assert(memcmp(out, out_fox, 32) == 0);
+    printf("SHA3-256(\"The quick brown fox...\") = ");
+    for (i = 0; i < 32; i++) {
+        printf("%02x", out[i]);
+    }
+    printf("\n");
+
+    crypto_hash_sha3256_init(&state);
+    crypto_hash_sha3256_update(&state, msg_abc, 3);
+    crypto_hash_sha3256_final(&state, out);
+    assert(memcmp(out, out_abc, 32) == 0);
+    printf("Streaming API test passed\n");
+
+    crypto_hash_sha3256_init(&state);
+    crypto_hash_sha3256_update(&state, msg_abc, 1);
+    crypto_hash_sha3256_update(&state, msg_abc + 1, 1);
+    crypto_hash_sha3256_update(&state, msg_abc + 2, 1);
+    crypto_hash_sha3256_final(&state, out);
+    assert(memcmp(out, out_abc, 32) == 0);
+    printf("Chunked update test passed\n");
+
+    {
+        unsigned char msg_rate[136];
+        unsigned char out_rate[32];
+        unsigned char out_rate_stream[32];
+
+        memset(msg_rate, 0xAB, sizeof msg_rate);
+        crypto_hash_sha3256(out_rate, msg_rate, sizeof msg_rate);
+
+        crypto_hash_sha3256_init(&state);
+        crypto_hash_sha3256_update(&state, msg_rate, sizeof msg_rate);
+        crypto_hash_sha3256_final(&state, out_rate_stream);
+
+        assert(memcmp(out_rate, out_rate_stream, 32) == 0);
+        printf("Rate boundary test passed\n");
+    }
+
+    {
+        unsigned char msg_rate_plus1[137];
+        unsigned char out_rate_plus1[32];
+        unsigned char out_rate_plus1_stream[32];
+
+        memset(msg_rate_plus1, 0xCD, sizeof msg_rate_plus1);
+        crypto_hash_sha3256(out_rate_plus1, msg_rate_plus1, sizeof msg_rate_plus1);
+
+        crypto_hash_sha3256_init(&state);
+        crypto_hash_sha3256_update(&state, msg_rate_plus1, 100);
+        crypto_hash_sha3256_update(&state, msg_rate_plus1 + 100, 37);
+        crypto_hash_sha3256_final(&state, out_rate_plus1_stream);
+
+        assert(memcmp(out_rate_plus1, out_rate_plus1_stream, 32) == 0);
+        printf("Rate+1 boundary test passed\n");
+    }
+
+    {
+        unsigned char msg_rate_minus1[135];
+        unsigned char out1[32], out2[32];
+
+        memset(msg_rate_minus1, 0xEF, sizeof msg_rate_minus1);
+        crypto_hash_sha3256(out1, msg_rate_minus1, sizeof msg_rate_minus1);
+
+        crypto_hash_sha3256_init(&state);
+        crypto_hash_sha3256_update(&state, msg_rate_minus1, sizeof msg_rate_minus1);
+        crypto_hash_sha3256_final(&state, out2);
+
+        assert(memcmp(out1, out2, 32) == 0);
+        printf("Rate-1 boundary test passed\n");
+    }
+
+    printf("OK\n");
+
+    return 0;
+}

test/default/hash_sha3256.exp

@@ -0,0 +1,9 @@
+SHA3-256("") = a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
+SHA3-256("abc") = 3a985da74fe225b2045c172d6bd390bd855f086e3e9d525b46bfe24511431532
+SHA3-256("The quick brown fox...") = 69070dda01975c8c120c3aada1b282394e7f032fa9cf32f4cb2259a0897dfc04
+Streaming API test passed
+Chunked update test passed
+Rate boundary test passed
+Rate+1 boundary test passed
+Rate-1 boundary test passed
+OK

test/default/hash_sha3512.c

@@ -0,0 +1,140 @@
+
+#define TEST_NAME "hash_sha3512"
+#include "cmptest.h"
+
+int
+main(void)
+{
+    static const unsigned char msg_abc[] = { 0x61, 0x62, 0x63 };
+
+    static const unsigned char msg_fox[] = {
+        0x54, 0x68, 0x65, 0x20, 0x71, 0x75, 0x69, 0x63, 0x6b, 0x20, 0x62, 0x72,
+        0x6f, 0x77, 0x6e, 0x20, 0x66, 0x6f, 0x78, 0x20, 0x6a, 0x75, 0x6d, 0x70,
+        0x73, 0x20, 0x6f, 0x76, 0x65, 0x72, 0x20, 0x74, 0x68, 0x65, 0x20, 0x6c,
+        0x61, 0x7a, 0x79, 0x20, 0x64, 0x6f, 0x67
+    };
+
+    static const unsigned char out_empty[64] = {
+        0xa6, 0x9f, 0x73, 0xcc, 0xa2, 0x3a, 0x9a, 0xc5, 0xc8, 0xb5, 0x67, 0xdc,
+        0x18, 0x5a, 0x75, 0x6e, 0x97, 0xc9, 0x82, 0x16, 0x4f, 0xe2, 0x58, 0x59,
+        0xe0, 0xd1, 0xdc, 0xc1, 0x47, 0x5c, 0x80, 0xa6, 0x15, 0xb2, 0x12, 0x3a,
+        0xf1, 0xf5, 0xf9, 0x4c, 0x11, 0xe3, 0xe9, 0x40, 0x2c, 0x3a, 0xc5, 0x58,
+        0xf5, 0x00, 0x19, 0x9d, 0x95, 0xb6, 0xd3, 0xe3, 0x01, 0x75, 0x85, 0x86,
+        0x28, 0x1d, 0xcd, 0x26
+    };
+
+    static const unsigned char out_abc[64] = {
+        0xb7, 0x51, 0x85, 0x0b, 0x1a, 0x57, 0x16, 0x8a, 0x56, 0x93, 0xcd, 0x92,
+        0x4b, 0x6b, 0x09, 0x6e, 0x08, 0xf6, 0x21, 0x82, 0x74, 0x44, 0xf7, 0x0d,
+        0x88, 0x4f, 0x5d, 0x02, 0x40, 0xd2, 0x71, 0x2e, 0x10, 0xe1, 0x16, 0xe9,
+        0x19, 0x2a, 0xf3, 0xc9, 0x1a, 0x7e, 0xc5, 0x76, 0x47, 0xe3, 0x93, 0x40,
+        0x57, 0x34, 0x0b, 0x4c, 0xf4, 0x08, 0xd5, 0xa5, 0x65, 0x92, 0xf8, 0x27,
+        0x4e, 0xec, 0x53, 0xf0
+    };
+
+    static const unsigned char out_fox[64] = {
+        0x01, 0xde, 0xdd, 0x5d, 0xe4, 0xef, 0x14, 0x64, 0x24, 0x45, 0xba, 0x5f,
+        0x5b, 0x97, 0xc1, 0x5e, 0x47, 0xb9, 0xad, 0x93, 0x13, 0x26, 0xe4, 0xb0,
+        0x72, 0x7c, 0xd9, 0x4c, 0xef, 0xc4, 0x4f, 0xff, 0x23, 0xf0, 0x7b, 0xf5,
+        0x43, 0x13, 0x99, 0x39, 0xb4, 0x91, 0x28, 0xca, 0xf4, 0x36, 0xdc, 0x1b,
+        0xde, 0xe5, 0x4f, 0xcb, 0x24, 0x02, 0x3a, 0x08, 0xd9, 0x40, 0x3f, 0x9b,
+        0x4b, 0xf0, 0xd4, 0x50
+    };
+
+    unsigned char             out[64];
+    crypto_hash_sha3512_state state;
+    size_t                    i;
+
+    assert(crypto_hash_sha3512_bytes() == 64);
+    assert(crypto_hash_sha3512_statebytes() > 0);
+
+    crypto_hash_sha3512(out, NULL, 0);
+    assert(memcmp(out, out_empty, 64) == 0);
+    printf("SHA3-512(\"\") = ");
+    for (i = 0; i < 64; i++) {
+        printf("%02x", out[i]);
+    }
+    printf("\n");
+
+    crypto_hash_sha3512(out, msg_abc, 3);
+    assert(memcmp(out, out_abc, 64) == 0);
+    printf("SHA3-512(\"abc\") = ");
+    for (i = 0; i < 64; i++) {
+        printf("%02x", out[i]);
+    }
+    printf("\n");
+
+    crypto_hash_sha3512(out, msg_fox, 43);
+    assert(memcmp(out, out_fox, 64) == 0);
+    printf("SHA3-512(\"The quick brown fox...\") = ");
+    for (i = 0; i < 64; i++) {
+        printf("%02x", out[i]);
+    }
+    printf("\n");
+
+    crypto_hash_sha3512_init(&state);
+    crypto_hash_sha3512_update(&state, msg_abc, 3);
+    crypto_hash_sha3512_final(&state, out);
+    assert(memcmp(out, out_abc, 64) == 0);
+    printf("Streaming API test passed\n");
+
+    crypto_hash_sha3512_init(&state);
+    crypto_hash_sha3512_update(&state, msg_abc, 1);
+    crypto_hash_sha3512_update(&state, msg_abc + 1, 1);
+    crypto_hash_sha3512_update(&state, msg_abc + 2, 1);
+    crypto_hash_sha3512_final(&state, out);
+    assert(memcmp(out, out_abc, 64) == 0);
+    printf("Chunked update test passed\n");
+
+    {
+        unsigned char msg_rate[72];
+        unsigned char out_rate[64];
+        unsigned char out_rate_stream[64];
+
+        memset(msg_rate, 0xAB, sizeof msg_rate);
+        crypto_hash_sha3512(out_rate, msg_rate, sizeof msg_rate);
+
+        crypto_hash_sha3512_init(&state);
+        crypto_hash_sha3512_update(&state, msg_rate, sizeof msg_rate);
+        crypto_hash_sha3512_final(&state, out_rate_stream);
+
+        assert(memcmp(out_rate, out_rate_stream, 64) == 0);
+        printf("Rate boundary test passed\n");
+    }
+
+    {
+        unsigned char msg_rate_plus1[73];
+        unsigned char out_rate_plus1[64];
+        unsigned char out_rate_plus1_stream[64];
+
+        memset(msg_rate_plus1, 0xCD, sizeof msg_rate_plus1);
+        crypto_hash_sha3512(out_rate_plus1, msg_rate_plus1, sizeof msg_rate_plus1);
+
+        crypto_hash_sha3512_init(&state);
+        crypto_hash_sha3512_update(&state, msg_rate_plus1, 50);
+        crypto_hash_sha3512_update(&state, msg_rate_plus1 + 50, 23);
+        crypto_hash_sha3512_final(&state, out_rate_plus1_stream);
+
+        assert(memcmp(out_rate_plus1, out_rate_plus1_stream, 64) == 0);
+        printf("Rate+1 boundary test passed\n");
+    }
+
+    {
+        unsigned char msg_rate_minus1[71];
+        unsigned char out1[64], out2[64];
+
+        memset(msg_rate_minus1, 0xEF, sizeof msg_rate_minus1);
+        crypto_hash_sha3512(out1, msg_rate_minus1, sizeof msg_rate_minus1);
+
+        crypto_hash_sha3512_init(&state);
+        crypto_hash_sha3512_update(&state, msg_rate_minus1, sizeof msg_rate_minus1);
+        crypto_hash_sha3512_final(&state, out2);
+
+        assert(memcmp(out1, out2, 64) == 0);
+        printf("Rate-1 boundary test passed\n");
+    }
+
+    printf("OK\n");
+
+    return 0;
+}

test/default/hash_sha3512.exp

@@ -0,0 +1,9 @@
+SHA3-512("") = a69f73cca23a9ac5c8b567dc185a756e97c982164fe25859e0d1dcc1475c80a615b2123af1f5f94c11e3e9402c3ac558f500199d95b6d3e301758586281dcd26
+SHA3-512("abc") = b751850b1a57168a5693cd924b6b096e08f621827444f70d884f5d0240d2712e10e116e9192af3c91a7ec57647e3934057340b4cf408d5a56592f8274eec53f0
+SHA3-512("The quick brown fox...") = 01dedd5de4ef14642445ba5f5b97c15e47b9ad931326e4b0727cd94cefc44fff23f07bf543139939b49128caf436dc1bdee54fcb24023a08d9403f9b4bf0d450
+Streaming API test passed
+Chunked update test passed
+Rate boundary test passed
+Rate+1 boundary test passed
+Rate-1 boundary test passed
+OK

test/default/ipcrypt.c

@@ -58,6 +58,7 @@ int
 main(void)
 {
     unsigned char key[crypto_ipcrypt_KEYBYTES];
+    unsigned char nd_key[crypto_ipcrypt_ND_KEYBYTES];
     unsigned char ndx_key[crypto_ipcrypt_NDX_KEYBYTES];
     unsigned char pfx_key[crypto_ipcrypt_PFX_KEYBYTES];
     unsigned char input[crypto_ipcrypt_BYTES];
@@ -632,6 +633,7 @@ main(void)
     printf("\nfunctional tests\n");
 
     crypto_ipcrypt_keygen(key);
+    crypto_ipcrypt_nd_keygen(nd_key);
     crypto_ipcrypt_ndx_keygen(ndx_key);
     crypto_ipcrypt_pfx_keygen(pfx_key);
     printf("OK: Key generation functions\n");

test/default/kem.c

@@ -0,0 +1,70 @@
+#define TEST_NAME "kem"
+#include "cmptest.h"
+
+static void
+tv_kem(void)
+{
+    unsigned char *pk;
+    unsigned char *sk;
+    unsigned char *seed;
+    unsigned char *ct;
+    unsigned char *ss_enc;
+    unsigned char *ss_dec;
+    int            i;
+
+    pk = (unsigned char *) sodium_malloc(crypto_kem_PUBLICKEYBYTES);
+    sk = (unsigned char *) sodium_malloc(crypto_kem_SECRETKEYBYTES);
+    seed = (unsigned char *) sodium_malloc(crypto_kem_SEEDBYTES);
+    ct = (unsigned char *) sodium_malloc(crypto_kem_CIPHERTEXTBYTES);
+    ss_enc = (unsigned char *) sodium_malloc(crypto_kem_SHAREDSECRETBYTES);
+    ss_dec = (unsigned char *) sodium_malloc(crypto_kem_SHAREDSECRETBYTES);
+
+    printf("primitive: %s\n", crypto_kem_primitive());
+
+    assert(crypto_kem_publickeybytes() == crypto_kem_PUBLICKEYBYTES);
+    assert(crypto_kem_secretkeybytes() == crypto_kem_SECRETKEYBYTES);
+    assert(crypto_kem_ciphertextbytes() == crypto_kem_CIPHERTEXTBYTES);
+    assert(crypto_kem_sharedsecretbytes() == crypto_kem_SHAREDSECRETBYTES);
+    assert(crypto_kem_seedbytes() == crypto_kem_SEEDBYTES);
+
+    printf("constants: ok\n");
+
+    for (i = 0; i < (int) crypto_kem_SEEDBYTES; i++) {
+        seed[i] = (unsigned char) i;
+    }
+    crypto_kem_seed_keypair(pk, sk, seed);
+
+    assert(crypto_kem_enc(ct, ss_enc, pk) == 0);
+    assert(crypto_kem_dec(ss_dec, ct, sk) == 0);
+
+    if (memcmp(ss_enc, ss_dec, crypto_kem_SHAREDSECRETBYTES) != 0) {
+        printf("ERROR: shared secrets don't match!\n");
+    } else {
+        printf("shared secrets match: ok\n");
+    }
+
+    crypto_kem_keypair(pk, sk);
+    assert(crypto_kem_enc(ct, ss_enc, pk) == 0);
+    assert(crypto_kem_dec(ss_dec, ct, sk) == 0);
+
+    if (memcmp(ss_enc, ss_dec, crypto_kem_SHAREDSECRETBYTES) != 0) {
+        printf("ERROR: shared secrets don't match (random keys)!\n");
+    } else {
+        printf("random keypair test: ok\n");
+    }
+
+    sodium_free(ss_dec);
+    sodium_free(ss_enc);
+    sodium_free(ct);
+    sodium_free(seed);
+    sodium_free(sk);
+    sodium_free(pk);
+}
+
+int
+main(void)
+{
+    tv_kem();
+
+    return 0;
+}

test/default/kem.exp

@@ -0,0 +1,4 @@
+primitive: xwing
+constants: ok
+shared secrets match: ok
+random keypair test: ok

test/default/kem_xwing.c

@@ -0,0 +1,217 @@
+#define TEST_NAME "kem_xwing"
+#include "cmptest.h"
+
+static const char tv0_seed[] =
+    "0000000000000000000000000000000000000000000000000000000000000000";
+static const char tv0_randomness[] =
+    "6464646464646464646464646464646464646464646464646464646464646464"
+    "6464646464646464646464646464646464646464646464646464646464646464";
+static const char tv0_ek_prefix[] =
+    "3d209f716752f6408e7f89bceef97ac388530045377927644ef046c0a7cae978";
+static const char tv0_ct_prefix[] =
+    "d81018a94f8078e02105beaa814e003390befa4589bb614f7739";
+static const char tv0_ss[] =
+    "e5ba94031ea6efd69c09c254f6d9783136ba6037e2d4c43bcccf19d6f3f4343a";
+
+static const char tv1_seed[] =
+    "0101010101010101010101010101010101010101010101010101010101010101";
+static const char tv1_randomness[] =
+    "6565656565656565656565656565656565656565656565656565656565656565"
+    "6565656565656565656565656565656565656565656565656565656565656565";
+static const char tv1_ek_prefix[] =
+    "ec7b50cddc8360f98b189bac73d395ef947b37d8453886a253269f7b18b9eb78";
+static const char tv1_ct_prefix[] =
+    "600ecf4026683898d0e339eeea9ebd437a4a802952bf32bfa326";
+static const char tv1_ss[] =
+    "750300db25bff9620e893c2c6fcab9bf04d7f2e543b5b39420485626fa274908";
+
+static const char tv2_seed[] =
+    "0202020202020202020202020202020202020202020202020202020202020202";
+static const char tv2_randomness[] =
+    "6666666666666666666666666666666666666666666666666666666666666666"
+    "6666666666666666666666666666666666666666666666666666666666666666";
+static const char tv2_ek_prefix[] =
+    "08118d8819772292c976ec971ee3039195800c823544484595cc63450b9db941";
+static const char tv2_ct_prefix[] =
+    "413c55d5710bae6376761dada807daffd4dc45f9f70d825e0d46";
+static const char tv2_ss[] =
+    "87292f18b2e7af74bb8839ddee15e832d2f4bfac14dc84f824906d951436aafa";
+
+static int
+test_kat_vector(const char *seed_hex, const char *randomness_hex,
+                const char *ek_prefix_hex, const char *ct_prefix_hex,
+                const char *ss_hex)
+{
+    unsigned char seed[crypto_kem_xwing_SEEDBYTES];
+    unsigned char pk[crypto_kem_xwing_PUBLICKEYBYTES];
+    unsigned char sk[crypto_kem_xwing_SECRETKEYBYTES];
+    unsigned char randomness[64];
+    unsigned char ct[crypto_kem_xwing_CIPHERTEXTBYTES];
+    unsigned char ss_enc[crypto_kem_xwing_SHAREDSECRETBYTES];
+    unsigned char ss_dec[crypto_kem_xwing_SHAREDSECRETBYTES];
+    unsigned char expected_ek_prefix[32];
+    unsigned char expected_ct_prefix[26];
+    unsigned char expected_ss[32];
+    char          hex[65];
+
+    sodium_hex2bin(seed, sizeof seed, seed_hex, strlen(seed_hex), NULL, NULL, NULL);
+    sodium_hex2bin(randomness, sizeof randomness, randomness_hex, strlen(randomness_hex),
+                   NULL, NULL, NULL);
+    sodium_hex2bin(expected_ek_prefix, sizeof expected_ek_prefix, ek_prefix_hex,
+                   strlen(ek_prefix_hex), NULL, NULL, NULL);
+    sodium_hex2bin(expected_ct_prefix, sizeof expected_ct_prefix, ct_prefix_hex,
+                   strlen(ct_prefix_hex), NULL, NULL, NULL);
+    sodium_hex2bin(expected_ss, sizeof expected_ss, ss_hex, strlen(ss_hex), NULL, NULL, NULL);
+
+    crypto_kem_xwing_seed_keypair(pk, sk, seed);
+
+    if (memcmp(pk, expected_ek_prefix, 32) != 0) {
+        sodium_bin2hex(hex, sizeof hex, pk, 32);
+        printf("pk mismatch: got %s\n", hex);
+        return -1;
+    }
+
+    assert(crypto_kem_xwing_enc_deterministic(ct, ss_enc, pk, randomness) == 0);
+
+    if (memcmp(ct, expected_ct_prefix, 26) != 0) {
+        sodium_bin2hex(hex, sizeof hex, ct, 26);
+        printf("ct mismatch: got %s\n", hex);
+        return -1;
+    }
+
+    if (memcmp(ss_enc, expected_ss, 32) != 0) {
+        sodium_bin2hex(hex, sizeof hex, ss_enc, 32);
+        printf("ss_enc mismatch: got %s\n", hex);
+        return -1;
+    }
+
+    assert(crypto_kem_xwing_dec(ss_dec, ct, sk) == 0);
+
+    if (memcmp(ss_dec, expected_ss, 32) != 0) {
+        sodium_bin2hex(hex, sizeof hex, ss_dec, 32);
+        printf("ss_dec mismatch: got %s\n", hex);
+        return -1;
+    }
+
+    return 0;
+}
+
+static void
+tv_kem_xwing(void)
+{
+    unsigned char *pk;
+    unsigned char *sk;
+    unsigned char *seed;
+    unsigned char *ct;
+    unsigned char *ss_enc;
+    unsigned char *ss_dec;
+    unsigned char *randomness;
+    char           hex[65];
+    int            i;
+
+    pk = (unsigned char *) sodium_malloc(crypto_kem_xwing_PUBLICKEYBYTES);
+    sk = (unsigned char *) sodium_malloc(crypto_kem_xwing_SECRETKEYBYTES);
+    seed = (unsigned char *) sodium_malloc(crypto_kem_xwing_SEEDBYTES);
+    ct = (unsigned char *) sodium_malloc(crypto_kem_xwing_CIPHERTEXTBYTES);
+    ss_enc = (unsigned char *) sodium_malloc(crypto_kem_xwing_SHAREDSECRETBYTES);
+    ss_dec = (unsigned char *) sodium_malloc(crypto_kem_xwing_SHAREDSECRETBYTES);
+    randomness = (unsigned char *) sodium_malloc(64);
+
+    for (i = 0; i < (int) crypto_kem_xwing_SEEDBYTES; i++) {
+        seed[i] = (unsigned char) i;
+    }
+    crypto_kem_xwing_seed_keypair(pk, sk, seed);
+
+    sodium_bin2hex(hex, sizeof hex, pk, 32);
+    printf("pk (first 32 bytes): [%s]\n", hex);
+    sodium_bin2hex(hex, sizeof hex, sk, 32);
+    printf("sk: [%s]\n", hex);
+
+    for (i = 0; i < 64; i++) {
+        randomness[i] = (unsigned char)(i + 64);
+    }
+    assert(crypto_kem_xwing_enc_deterministic(ct, ss_enc, pk, randomness) == 0);
+
+    sodium_bin2hex(hex, sizeof hex, ct, 32);
+    printf("ct (first 32 bytes): [%s]\n", hex);
+    sodium_bin2hex(hex, sizeof hex, ss_enc, crypto_kem_xwing_SHAREDSECRETBYTES);
+    printf("ss_enc: [%s]\n", hex);
+
+    assert(crypto_kem_xwing_dec(ss_dec, ct, sk) == 0);
+
+    sodium_bin2hex(hex, sizeof hex, ss_dec, crypto_kem_xwing_SHAREDSECRETBYTES);
+    printf("ss_dec: [%s]\n", hex);
+
+    if (memcmp(ss_enc, ss_dec, crypto_kem_xwing_SHAREDSECRETBYTES) != 0) {
+        printf("ERROR: shared secrets don't match!\n");
+    } else {
+        printf("shared secrets match: ok\n");
+    }
+
+    crypto_kem_xwing_keypair(pk, sk);
+    assert(crypto_kem_xwing_enc(ct, ss_enc, pk) == 0);
+    assert(crypto_kem_xwing_dec(ss_dec, ct, sk) == 0);
+    if (memcmp(ss_enc, ss_dec, crypto_kem_xwing_SHAREDSECRETBYTES) != 0) {
+        printf("ERROR: shared secrets don't match (random keys)!\n");
+    } else {
+        printf("random keypair test: ok\n");
+    }
+
+    assert(crypto_kem_xwing_publickeybytes() == crypto_kem_xwing_PUBLICKEYBYTES);
+    assert(crypto_kem_xwing_secretkeybytes() == crypto_kem_xwing_SECRETKEYBYTES);
+    assert(crypto_kem_xwing_ciphertextbytes() == crypto_kem_xwing_CIPHERTEXTBYTES);
+    assert(crypto_kem_xwing_sharedsecretbytes() == crypto_kem_xwing_SHAREDSECRETBYTES);
+    assert(crypto_kem_xwing_seedbytes() == crypto_kem_xwing_SEEDBYTES);
+
+    assert(crypto_kem_xwing_PUBLICKEYBYTES == 1216U);
+    assert(crypto_kem_xwing_SECRETKEYBYTES == 32U);
+    assert(crypto_kem_xwing_CIPHERTEXTBYTES == 1120U);
+    assert(crypto_kem_xwing_SHAREDSECRETBYTES == 32U);
+    assert(crypto_kem_xwing_SEEDBYTES == 32U);
+
+    printf("constants: ok\n");
+
+    sodium_free(randomness);
+    sodium_free(ss_dec);
+    sodium_free(ss_enc);
+    sodium_free(ct);
+    sodium_free(seed);
+    sodium_free(sk);
+    sodium_free(pk);
+
+    printf("tv_kem_xwing: ok\n");
+}
+
+static void
+tv_kem_xwing_kat(void)
+{
+    printf("IETF KAT vector 0: ");
+    if (test_kat_vector(tv0_seed, tv0_randomness, tv0_ek_prefix, tv0_ct_prefix, tv0_ss) == 0) {
+        printf("ok\n");
+    } else {
+        printf("FAILED\n");
+    }
+
+    printf("IETF KAT vector 1: ");
+    if (test_kat_vector(tv1_seed, tv1_randomness, tv1_ek_prefix, tv1_ct_prefix, tv1_ss) == 0) {
+        printf("ok\n");
+    } else {
+        printf("FAILED\n");
+    }
+
+    printf("IETF KAT vector 2: ");
+    if (test_kat_vector(tv2_seed, tv2_randomness, tv2_ek_prefix, tv2_ct_prefix, tv2_ss) == 0) {
+        printf("ok\n");
+    } else {
+        printf("FAILED\n");
+    }
+}
+
+int
+main(void)
+{
+    tv_kem_xwing();
+    tv_kem_xwing_kat();
+
+    return 0;
+}

test/default/kem_xwing.exp

@@ -0,0 +1,12 @@
+pk (first 32 bytes): [6f54098a0a0e641146614b6960ba60d8603d62f447f9ab499b47bd6906cc40b0]
+sk: [000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f]
+ct (first 32 bytes): [332c248ecac774a5b9e28b7018565b7e07b57733b8e68a432084b39b9221e497]
+ss_enc: [f285b028f4de617b6adf9eccbd811327848dd44ac7078c15390b16682576ad8c]
+ss_dec: [f285b028f4de617b6adf9eccbd811327848dd44ac7078c15390b16682576ad8c]
+shared secrets match: ok
+random keypair test: ok
+constants: ok
+tv_kem_xwing: ok
+IETF KAT vector 0: ok
+IETF KAT vector 1: ok
+IETF KAT vector 2: ok

test/symbols/all-symbols.txt

@@ -2,10 +2,7 @@ argon2_ctx
 argon2_decode_string
 argon2_encode_string
 argon2_fill_memory_blocks
-argon2_fill_segment_avx2
-argon2_fill_segment_avx512f
 argon2_fill_segment_ref
-argon2_fill_segment_ssse3
 argon2_finalize
 argon2_hash
 argon2_initialize
@@ -18,10 +15,7 @@ argon2id_hash_encoded
 argon2id_hash_raw
 argon2id_verify
 blake2b
-blake2b_compress_avx2
 blake2b_compress_ref
-blake2b_compress_sse41
-blake2b_compress_ssse3
 blake2b_final
 blake2b_init
 blake2b_init_key
@@ -38,7 +32,6 @@ crypto_aead_aegis128l_decrypt
 crypto_aead_aegis128l_decrypt_detached
 crypto_aead_aegis128l_encrypt
 crypto_aead_aegis128l_encrypt_detached
-crypto_aead_aegis128l_is_available
 crypto_aead_aegis128l_keybytes
 crypto_aead_aegis128l_keygen
 crypto_aead_aegis128l_messagebytes_max
@@ -49,7 +42,6 @@ crypto_aead_aegis256_decrypt
 crypto_aead_aegis256_decrypt_detached
 crypto_aead_aegis256_encrypt
 crypto_aead_aegis256_encrypt_detached
-crypto_aead_aegis256_is_available
 crypto_aead_aegis256_keybytes
 crypto_aead_aegis256_keygen
 crypto_aead_aegis256_messagebytes_max
@@ -204,7 +196,6 @@ crypto_core_ed25519_add
 crypto_core_ed25519_bytes
 crypto_core_ed25519_from_string
 crypto_core_ed25519_from_string_ro
-crypto_core_ed25519_from_uniform
 crypto_core_ed25519_hashbytes
 crypto_core_ed25519_is_valid_point
 crypto_core_ed25519_nonreducedscalarbytes
@@ -311,6 +302,18 @@ crypto_hash_sha256_final
 crypto_hash_sha256_init
 crypto_hash_sha256_statebytes
 crypto_hash_sha256_update
+crypto_hash_sha3256
+crypto_hash_sha3256_bytes
+crypto_hash_sha3256_final
+crypto_hash_sha3256_init
+crypto_hash_sha3256_statebytes
+crypto_hash_sha3256_update
+crypto_hash_sha3512
+crypto_hash_sha3512_bytes
+crypto_hash_sha3512_final
+crypto_hash_sha3512_init
+crypto_hash_sha3512_statebytes
+crypto_hash_sha3512_update
 crypto_hash_sha512
 crypto_hash_sha512_bytes
 crypto_hash_sha512_final
@@ -326,6 +329,7 @@ crypto_ipcrypt_nd_decrypt
 crypto_ipcrypt_nd_encrypt
 crypto_ipcrypt_nd_inputbytes
 crypto_ipcrypt_nd_keybytes
+crypto_ipcrypt_nd_keygen
 crypto_ipcrypt_nd_outputbytes
 crypto_ipcrypt_nd_tweakbytes
 crypto_ipcrypt_ndx_decrypt
@@ -382,6 +386,16 @@ crypto_kem_mlkem768_secretkeybytes
 crypto_kem_mlkem768_seed_keypair
 crypto_kem_mlkem768_seedbytes
 crypto_kem_mlkem768_sharedsecretbytes
+crypto_kem_xwing_ciphertextbytes
+crypto_kem_xwing_dec
+crypto_kem_xwing_enc
+crypto_kem_xwing_enc_deterministic
+crypto_kem_xwing_keypair
+crypto_kem_xwing_publickeybytes
+crypto_kem_xwing_secretkeybytes
+crypto_kem_xwing_seed_keypair
+crypto_kem_xwing_seedbytes
+crypto_kem_xwing_sharedsecretbytes
 crypto_kx_client_session_keys
 crypto_kx_keypair
 crypto_kx_primitive
@@ -502,13 +516,10 @@ crypto_pwhash_strbytes
 crypto_pwhash_strprefix
 crypto_scalarmult
 crypto_scalarmult_base
-crypto_scalarmult_base_noclamp
 crypto_scalarmult_bytes
 crypto_scalarmult_curve25519
 crypto_scalarmult_curve25519_base
-crypto_scalarmult_curve25519_base_noclamp
 crypto_scalarmult_curve25519_bytes
-crypto_scalarmult_curve25519_noclamp
 crypto_scalarmult_curve25519_scalarbytes
 crypto_scalarmult_ed25519
 crypto_scalarmult_ed25519_base
@@ -516,7 +527,6 @@ crypto_scalarmult_ed25519_base_noclamp
 crypto_scalarmult_ed25519_bytes
 crypto_scalarmult_ed25519_noclamp
 crypto_scalarmult_ed25519_scalarbytes
-crypto_scalarmult_noclamp
 crypto_scalarmult_primitive
 crypto_scalarmult_ristretto255
 crypto_scalarmult_ristretto255_base
@@ -585,7 +595,6 @@ crypto_sign_bytes
 crypto_sign_detached
 crypto_sign_ed25519
 crypto_sign_ed25519_bytes
-crypto_sign_ed25519_contextbytes_max
 crypto_sign_ed25519_detached
 crypto_sign_ed25519_keypair
 crypto_sign_ed25519_messagebytes_max
@@ -600,8 +609,6 @@ crypto_sign_ed25519_sk_to_pk
 crypto_sign_ed25519_sk_to_seed
 crypto_sign_ed25519_verify_detached
 crypto_sign_ed25519ph_final_create
-crypto_sign_ed25519ph_final_ctx_create
-crypto_sign_ed25519ph_final_ctx_verify
 crypto_sign_ed25519ph_final_verify
 crypto_sign_ed25519ph_init
 crypto_sign_ed25519ph_statebytes
@@ -721,7 +728,6 @@ escrypt_free_region
 escrypt_gensalt_r
 escrypt_init_local
 escrypt_kdf_nosse
-escrypt_kdf_sse
 escrypt_parse_setting
 escrypt_r
 fe25519_frombytes
@@ -746,6 +752,11 @@ ge25519_p3_tobytes
 ge25519_scalarmult
 ge25519_scalarmult_base
 ge25519_tobytes
+keccak1600_armsha3_extract_bytes
+keccak1600_armsha3_init
+keccak1600_armsha3_permute_12
+keccak1600_armsha3_permute_24
+keccak1600_armsha3_xor_bytes
 keccak1600_ref_extract_bytes
 keccak1600_ref_init
 keccak1600_ref_permute_12
@@ -825,14 +836,8 @@ sodium_runtime_has_sse2
 sodium_runtime_has_sse3
 sodium_runtime_has_sse41
 sodium_runtime_has_ssse3
-sodium_scalarmult_curve25519_sandy2x_fe51_mul
-sodium_scalarmult_curve25519_sandy2x_fe51_nsquare
-sodium_scalarmult_curve25519_sandy2x_fe51_pack
-sodium_scalarmult_curve25519_sandy2x_ladder
 sodium_set_misuse_handler
 sodium_stackzero
-sodium_stream_salsa20_xmm6
-sodium_stream_salsa20_xmm6_xor_ic
 sodium_sub
 sodium_unpad
 sodium_version_string