AtlatestRenderedmarkdown

sigil-crypto / tree / vendorMONOCYPHER.md

Read the source

Readme

Monocypher vendor provenance

Version: 4.0.3 (released 2026-06-15). Upstream: https://monocypher.org/ (source: https://github.com/LoupVaillant/Monocypher) Archive: https://monocypher.org/download/monocypher-4.0.3.tar.gz SHA512: 40904ada5c7ee4f7741733e38b69a30a4b0561cbffba5ffe7c2dce16136d540251ec0d9056ff606510d3b5b708fb8a40db7e0870d4a0b2dc17ba2bfb880f8965

The archive's SHA-512 matches the .sha512 file published beside it on monocypher.org, and the same tarball downloaded from the GitHub release (https://github.com/LoupVaillant/Monocypher/releases/download/4.0.3/monocypher-4.0.3.tar.gz) has the same digest.

Licence: dual BSD-2-Clause OR CC0-1.0, at the user's choice (SPDX-License-Identifier: BSD-2-Clause OR CC0-1.0). sigil-crypto uses it under BSD-2-Clause. The full text is in monocypher/LICENCE.md.

What is mirrored

Under monocypher/, byte-identical to the archive:

src/monocypher.c                  core: BLAKE2b, EdDSA arithmetic, ...
src/monocypher.h
src/optional/monocypher-ed25519.c SHA-512 and Ed25519 (RFC 8032)
src/optional/monocypher-ed25519.h
LICENCE.md  AUTHORS.md  CHANGELOG.md  README.md

No file is modified. Tests, docs and the build system are not mirrored.

Why Monocypher

sigil-crypto needs Ed25519 verification and BLAKE2b-512 for minisign signatures. Mbed TLS 3.6 has neither EdDSA nor BLAKE2b.

  • Small: about 3,500 lines of C99 for the two files, no allocation, no platform calls, so it compiles unchanged for wasm32-wasi.
  • Audited: Cure53 reviewed Monocypher in June 2020 and found no High or Critical issues (https://monocypher.org/quality-assurance/audit). That audit covered the 3.x line; the 4.x EdDSA API was reworked after it.
  • Tested upstream against RFC 8032 and Wycheproof-derived vectors, under sanitisers, Valgrind, TIS-CI and Frama-C.
  • 4.0.3 rather than 4.0.2: 4.0.3 fixes a timing leak in EdDSA/Ed25519 signing. Verification only handles public data, but the signing entry point is exported too.

Alternatives considered: libsodium (what minisign itself uses, ISC; a much larger library with its own platform and entropy layer, which the wasm build would have to carry), TweetNaCl (public domain and smallest, but its verification skips the S < L check and it is not maintained as a library), and the SUPERCOP ref10 code (public domain, not packaged as a library). Monocypher 3.1.3 was reconsidered during review because its verification is cofactorless like libsodium's; it was not taken because 3.x lacks 4.0.3's signing timing fix (topics/monocypher-cofactored-verification-vs-libsodium in the estate notes).

Verification rules

crypto_ed25519_check checks the cofactored equation [8](sB - hA - R) = 0, rejects S >= L, and accepts non-canonical encodings of A and R. sigil-crypto's wrapper (native/ed25519-verify.c) additionally rejects non-canonical encodings of A and R (RFC 8032 section 5.1.3) and small-order A and R (as libsodium does), so the accept set is RFC 8032 section 5.1.7 plus libsodium's small-order rule.