vendor/MONOCYPHER.md — sigil-crypto

1# Monocypher vendor provenance

3Version: 4.0.3 (released 2026-06-15).

4Upstream: https://monocypher.org/ (source: https://github.com/LoupVaillant/Monocypher)

5Archive: https://monocypher.org/download/monocypher-4.0.3.tar.gz

SHA512: 40904ada5c7ee4f7741733e38b69a30a4b0561cbffba5ffe7c2dce16136d540251ec0d9056ff606510d3b5b708fb8a40db7e0870d4a0b2dc17ba2bfb880f8965

8The archive's SHA-512 matches the `.sha512` file published beside it on

9monocypher.org, and the same tarball downloaded from the GitHub release

10(https://github.com/LoupVaillant/Monocypher/releases/download/4.0.3/monocypher-4.0.3.tar.gz)

11has the same digest.

13Licence: dual BSD-2-Clause OR CC0-1.0, at the user's choice

14(`SPDX-License-Identifier: BSD-2-Clause OR CC0-1.0`). sigil-crypto uses it

15under BSD-2-Clause. The full text is in `monocypher/LICENCE.md`.

17## What is mirrored

19Under `monocypher/`, byte-identical to the archive:

21 src/monocypher.c core: BLAKE2b, EdDSA arithmetic, ...

22 src/monocypher.h

23 src/optional/monocypher-ed25519.c SHA-512 and Ed25519 (RFC 8032)

24 src/optional/monocypher-ed25519.h

25 LICENCE.md AUTHORS.md CHANGELOG.md README.md

27No file is modified. Tests, docs and the build system are not mirrored.

29## Why Monocypher

31sigil-crypto needs Ed25519 verification and BLAKE2b-512 for minisign

32signatures. Mbed TLS 3.6 has neither EdDSA nor BLAKE2b.

34- Small: about 3,500 lines of C99 for the two files, no allocation, no

35 platform calls, so it compiles unchanged for wasm32-wasi.

36- Audited: Cure53 reviewed Monocypher in June 2020 and found no High or

37 Critical issues (https://monocypher.org/quality-assurance/audit). That

38 audit covered the 3.x line; the 4.x EdDSA API was reworked after it.

39- Tested upstream against RFC 8032 and Wycheproof-derived vectors, under

40 sanitisers, Valgrind, TIS-CI and Frama-C.

41- 4.0.3 rather than 4.0.2: 4.0.3 fixes a timing leak in EdDSA/Ed25519

42 signing. Verification only handles public data, but the signing entry

43 point is exported too.

45Alternatives considered: libsodium (what minisign itself uses, ISC; a much

46larger library with its own platform and entropy layer, which the wasm build

47would have to carry), TweetNaCl (public domain and smallest, but its

48verification skips the S < L check and it is not maintained as a library),

49and the SUPERCOP ref10 code (public domain, not packaged as a library).

50Monocypher 3.1.3 was reconsidered during review because its verification is

51cofactorless like libsodium's; it was not taken because 3.x lacks 4.0.3's

52signing timing fix (topics/monocypher-cofactored-verification-vs-libsodium

53in the estate notes).

55## Verification rules

57`crypto_ed25519_check` checks the cofactored equation `[8](sB - hA - R) = 0`,

58rejects `S >= L`, and accepts non-canonical encodings of A and R. sigil-crypto's

59wrapper (`native/ed25519-verify.c`) additionally rejects non-canonical encodings of A

60and R (RFC 8032 section 5.1.3) and small-order A and R (as libsodium does), so

61the accept set is RFC 8032 section 5.1.7 plus libsodium's small-order rule.