Vendor Monocypher 4.0.3 for Ed25519 and BLAKE2b

Message

Byte-identical to the official monocypher-4.0.3.tar.gz (SHA-512 in vendor/MONOCYPHER.md, matching monocypher.org's published digest and the GitHub release asset). Dual BSD-2-Clause / CC0-1.0; used under BSD-2-Clause. Only src/monocypher.{c,h}, src/optional/monocypher-ed25519.{c,h} and the licence, authors, changelog and readme are mirrored.

Changed

 vendor/MONOCYPHER.md                                |   56 +++
 vendor/monocypher/AUTHORS.md                        |   63 +++
 vendor/monocypher/CHANGELOG.md                      |  305 +++++++++++++++
 vendor/monocypher/LICENCE.md                        |  167 ++++++++
 vendor/monocypher/README.md                         |  164 ++++++++
 vendor/monocypher/src/monocypher.c                  | 2988 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 vendor/monocypher/src/monocypher.h                  |  321 +++++++++++++++
 vendor/monocypher/src/optional/monocypher-ed25519.c |  503 ++++++++++++++++++++++++
 vendor/monocypher/src/optional/monocypher-ed25519.h |  140 +++++++
 9 files changed, 4707 insertions(+)

Diff

vendor/MONOCYPHER.mdadded

@@ -0,0 +1,56 @@

# Monocypher vendor provenance

Version: 4.0.3 (released 2026-06-15).

Upstream: https://monocypher.org/ (source: https://github.com/LoupVaillant/Monocypher)

Archive: https://monocypher.org/download/monocypher-4.0.3.tar.gz

SHA512: 40904ada5c7ee4f7741733e38b69a30a4b0561cbffba5ffe7c2dce16136d540251ec0d9056ff606510d3b5b708fb8a40db7e0870d4a0b2dc17ba2bfb880f8965

The archive's SHA-512 matches the `.sha512` file published beside it on

monocypher.org, and the same tarball downloaded from the GitHub release

+10

(https://github.com/LoupVaillant/Monocypher/releases/download/4.0.3/monocypher-4.0.3.tar.gz)

+11

has the same digest.

+12

+13

Licence: dual BSD-2-Clause OR CC0-1.0, at the user's choice

+14

(`SPDX-License-Identifier: BSD-2-Clause OR CC0-1.0`). sigil-crypto uses it

+15

under BSD-2-Clause. The full text is in `monocypher/LICENCE.md`.

+16

+17

## What is mirrored

+18

+19

Under `monocypher/`, byte-identical to the archive:

+20

+21

src/monocypher.c core: BLAKE2b, EdDSA arithmetic, ...

+22

src/monocypher.h

+23

src/optional/monocypher-ed25519.c SHA-512 and Ed25519 (RFC 8032)

+24

src/optional/monocypher-ed25519.h

+25

LICENCE.md AUTHORS.md CHANGELOG.md README.md

+26

+27

No file is modified. Tests, docs and the build system are not mirrored.

+28

+29

## Why Monocypher

+30

+31

sigil-crypto needs Ed25519 verification and BLAKE2b-512 for minisign

+32

signatures. Mbed TLS 3.6 has neither EdDSA nor BLAKE2b.

+33

+34

- Small: about 3,500 lines of C99 for the two files, no allocation, no

+35

platform calls, so it compiles unchanged for wasm32-wasi.

+36

- Audited: Cure53 reviewed Monocypher in June 2020 and found no High or

+37

Critical issues (https://monocypher.org/quality-assurance/audit). That

+38

audit covered the 3.x line; the 4.x EdDSA API was reworked after it.

+39

- Tested upstream against RFC 8032 and Wycheproof-derived vectors, under

+40

sanitisers, Valgrind, TIS-CI and Frama-C.

+41

- 4.0.3 rather than 4.0.2: 4.0.3 fixes a timing leak in EdDSA/Ed25519

+42

signing. Verification only handles public data, but the signing entry

+43

point is exported too.

+44

+45

Alternatives considered: libsodium (what minisign itself uses, ISC, but

+46

tens of thousands of lines and a platform layer), TweetNaCl (public domain,

+47

smallest, but slow and not constant-time in places), and the SUPERCOP

+48

ref10 code (public domain, unmaintained as a library).

+49

+50

## Verification rules

+51

+52

`crypto_ed25519_check` checks the cofactored equation `[8](sB - hA - R) = 0`,

+53

rejects `S >= L`, and accepts non-canonical encodings of A and R. sigil-crypto's

+54

wrapper (`native/ed25519.c`) additionally rejects non-canonical encodings of A

+55

and R (RFC 8032 section 5.1.3) and small-order A and R (as libsodium does), so

+56

the accept set is RFC 8032 section 5.1.7 plus libsodium's small-order rule.

vendor/monocypher/AUTHORS.mdadded

@@ -0,0 +1,63 @@

Designers

---------

- **ChaCha20:** Daniel J. Bernstein.

- **Poly1305:** Daniel J. Bernstein.

- **BLAKE2:** Jean-Philippe Aumasson, Christian Winnerlein, Samuel Neves,

and Zooko Wilcox-O'Hearn.

- **Argon2:** Alex Biryukov, Daniel Dinu, and Dmitry Khovratovich.

- **X25519:** Daniel J. Bernstein.

+10

- **EdDSA:** Daniel J. Bernstein, Bo-Yin Yang, Niels Duif, Peter

+11

Schwabe, and Tanja Lange.

+12

+13

Implementors

+14

------------

+15

+16

- **ChaCha20:** Loup Vaillant, implemented from spec.

+17

- **Poly1305:** Loup Vaillant, implemented from spec.

+18

- **BLAKE2b:** Loup Vaillant, implemented from spec.

+19

- **Argon2i:** Loup Vaillant, implemented from spec.

+20

- **X25519:** Daniel J. Bernstein, taken and packaged from SUPERCOP

+21

ref10.

+22

- **EdDSA:** Loup Vaillant, with bits and pieces from SUPERCOP ref10.

+23

+24

Test suite

+25

----------

+26

+27

Designed and implemented by Loup Vaillant, using _libsodium_ (by many

+28

authors), and _ed25519-donna_ (by Andrew Moon —floodyberry).

+29

+30

Manual

+31

------

+32

+33

Loup Vaillant, Fabio Scotoni, and Michael Savage.

+34

+35

- Loup Vaillant did a first draft.

+36

- Fabio Scotoni rewrote the manual into proper man pages (and

+37

substantially changed it in the process).

+38

- Michael Savage did extensive editing and proofreading.

+39

+40

Thanks

+41

------

+42

+43

Fabio Scotoni provided much needed advice about testing, interface,

+44

packaging, and the general direction of the whole project. He also

+45

redesigned the monocypher.org style sheets.

+46

+47

Mike Pechkin and André Maroneze found bugs in earlier versions of

+48

Monocypher.

+49

+50

Andrew Moon clarified carry propagation in modular arithmetic, and

+51

provided advice and code that significantly simplified and improved

+52

Elligator2 mappings.

+53

+54

Mike Hamburg explained comb algorithms, including the signed

+55

all-bits-set comb described in his 2012 paper, Fast and compact

+56

elliptic-curve cryptography. This made EdDSA signatures over twice as

+57

fast.

+58

+59

Samuel Lucas found many typos in both the manual and the website.

+60

+61

Jens Alfke added some #ifdefs that enabled Monocypher to compile into

+62

a C++ namespace, preventing symbol collisions with similarly-named

+63

functions in other crypto libraries.

vendor/monocypher/CHANGELOG.mdadded

@@ -0,0 +1,305 @@

4.0.3

-----

2026/06/15

- Fixed timing leak vulnerability in EdDSA/Ed25519 signatures.

- Various minor documentation fixes.

- Various minor build system fixes.

- Various minor compiler warning fixes.

+10

+11

4.0.2

+12

-----

+13

2023/08/24

+14

+15

- Fixed multiple-lanes Argon2.

+16

- Improved Poly1305 performance.

+17

- Improved Argon2 performance.

+18

- Makefiles no longer override standard environment variables.

+19

+20

+21

4.0.1

+22

-----

+23

2023/03/06

+24

+25

- Fixed Ed25519 secret key size in function prototype.

+26

- Fixed soname (should have been changed in 4.0.0)

+27

- Added convenience sub-targets to makefile.

+28

- Briefly specified wire format of Elligator and incremental AEAD.

+29

+30

+31

4.0.0

+32

-----

+33

2023/02/20

+34

+35

- Fixed unsafe signature API.

+36

- Simpler, more flexible low-level signature API.

+37

- Fully specified, consensus-friendly signatures.

+38

- Added Argon2d and Argon2id, support multiple lanes.

+39

- Added safe and fast streaming AEAD.

+40

- Added HKDF-SHA-512 and documented BLAKE2b KDF.

+41

- More consistent and memorable function names.

+42

- POSIX makefile.

+43

+44

+45

3.1.3

+46

-----

+47

2022/04/25

+48

+49

- Fixed many typos in the documentation.

+50

- Fixed buffer overflow in speed benchmarks.

+51

- Fixed some MSVC warnings.

+52

- Fixed a minor violation of the Elligator2 reverse map specs.

+53

- Added `change-prefix.sh` to help changing the `crypto_` prefix.

+54

- Added the `MONOCYPHER_CPP_NAMESPACE` preprocessor definition to

+55

support namespaces for C++.

+56

- Deprecated `crypto_key_exchange()`

+57

- Use GitHub actions to automate the regular test suite.

+58

+59

+60

3.1.2

+61

-----

+62

2020/12/27

+63

+64

- Addressed issues from Cure53's audit:

+65

- MON-01-001: Clarified which CSPRNG to use on Darwin.

+66

- MON-01-002: Won't fix (nonce handling is a core design decision).

+67

- MON-01-004: Compared with Kleshni's implementation.

+68

- MON-01-005: Split a dedicated "advanced" folder in the manual.

+69

- Quality assurance for 2^255-19 arithmetic (elliptic curves):

+70

- Documented carry propagation.

+71

- Enforced slightly safer invariants.

+72

- Improved the speed of EdDSA signature generation.

+73

- Made the vectors.h header more compact and easier to modify.

+74

- TIS-CI integration.

+75

- Added speed benchmark for ed25519-donna.

+76

- Documented lengths limits of `crypto_ietf_chacha20()`

+77

+78

+79

3.1.1

+80

-----

+81

2020/06/15

+82

+83

- Various documentation fixes.

+84

- Fixed various compiler warnings.

+85

- Fixed some integer overflows (16-bit platforms only).

+86

+87

+88

3.1.0

+89

-----

+90

2020/04/03

+91

+92

- Added Elligator 2 mappings (hash to curve, curve to hash).

+93

- Added OPRF support (with scalar inversion).

+94

- Added Edwards25519 -> Curve25519 conversions.

+95

+96

+97

3.0.0

+98

-----

+99

2020/01/19

+100

+101

- Deprecated the incremental AEAD interface.

+102

- Deprecated the incremental Chacha20, added a direct interface.

+103

- Added IETF Chacha20 (96-bit nonce), as described in RFC 8439.

+104

- Moved deprecated interfaces to a separate `src/deprecated` folder.

+105

- Removed the `ED25519_SHA512` preprocessor flag.

+106

- `crypto_x25519()` and `crypto_key_exchange()` now return `void`.

+107

- Added a custom hash interface to EdDSA. Several instances of EdDSA

+108

can share the same binary.

+109

- Added optional support for HMAC SHA-512.

+110

- Moved SHA-512 operations to `src/optional/monocypher-ed25519.(h|c)`.

+111

- Optional support for Ed25519 no longer requires a preprocessor flag.

+112

Add `src/optional/monocypher-ed25519.(h|c)` to your project instead.

+113

+114

+115

2.0.6

+116

-----

+117

2019/10/21

+118

+119

- Added the `BLAKE2_NO_UNROLLING` preprocessor definition. Activating

+120

it makes the binary about 5KB smaller and speeds up processing times

+121

on many embedded processors.

+122

- Reduced the stack usage of signature verification by about

+123

40%. Signature verification now fits in smaller machines.

+124

- Fixed many implicit casts warnings.

+125

- Fixed the manual here and there.

+126

- Lots of small nitpicks.

+127

+128

+129

2.0.5

+130

-----

+131

2018/08/23

+132

+133

- Faster EdDSA signatures and verification. Like, 4 times as fast.

+134

+135

+136

2.0.4

+137

-----

+138

2018/06/24

+139

+140

- Corrected a critical vulnerability found by Mike Pechkin in EdDSA,

+141

where crypto_check() was accepting invalid signatures. The current

+142

fix removes a buggy optimisation, effectively halving the performance

+143

of EdDSA.

+144

- The test suite no longer tries to allocate zero bytes (some platforms

+145

fail such an allocation).

+146

+147

2.0.3

+148

-----

+149

2018/06/16

+150

+151

- Corrected undefined behaviour in BLAKE2b.

+152

- Improved the test suite (faster, better coverage).

+153

+154

2.0.2

+155

-----

+156

2018/04/23

+157

+158

- Corrected a couple failures to wipe secret buffers.

+159

- Corrected a bug that prevented compilation in Ed25519 mode.

+160

- Adjusted the number of test vectors in the test suite.

+161

- Improved tests for incremental interfaces.

+162

- Replaced the GNU all permissive licence by a public domain dedication

+163

(Creative Commons CC-0). The BSD licence remains as a fallback.

+164

+165

2.0.1

+166

-----

+167

2018/03/07

+168

+169

- Followed a systematic pattern for the loading code of symmetric

+170

crypto. It is now easier to review.

+171

- Tweaked Poly1305 code to make it easier to prove correct.

+172

+173

2.0.0

+174

-----

+175

2018/02/14

+176

+177

- Changed the authenticated encryption format. It now conforms to

+178

RFC 7539, with one exception: it uses XChacha20 initialisation instead

+179

of the IETF version of Chacha20. This new format conforms to

+180

libsodium's `crypto_aead_xchacha20poly1305_ietf_encrypt`.

+181

- Removed `crypto_lock_encrypt()` and `crypto_lock_auth()`.

+182

- Renamed `crypto_lock_aead_auth()` to `crypto_lock_auth_ad()`.

+183

- Renamed `crypto_unlock_aead_auth()` to `crypto_unlock_auth_ad()`.

+184

- Added `crypto_lock_auth_message()` and `crypto_unlock_auth_message()`.

+185

- Renamed `crypto_aead_lock` to `crypto_lock_aead`.

+186

- Renamed `crypto_aead_unlock` to `crypto_unlock_aead`.

+187

+188

The format change facilitates optimisation by aligning data to block

+189

boundaries. The API changes increase consistency.

+190

+191

1.1.0

+192

-----

+193

2018/02/06

+194

+195

- Rewrote the manual into proper man pages.

+196

- Added incremental interfaces for authenticated encryption and

+197

signatures.

+198

- Replaced `crypto_memcmp()` by 3 fixed size buffer comparisons (16, 32,

+199

and 64 bytes), to make sure the generated code remains constant time.

+200

- A couple breaking API changes, easily fixed by renaming the affected

+201

functions.

+202

+203

1.0.1

+204

-----

+205

2017/07/23

+206

+207

- Optimised the loading and unloading code of the symmetric crypto

+208

(BLAKE2b, SHA-512, Chacha20, and Poly1305).

+209

- Fused self-contained tests together for easier analysis with Frama-C

+210

and the TIS interpreter.

+211

+212

1.0

+213

---

+214

2017/07/18

+215

+216

- Renamed `crypto_chacha20_Xinit` to `crypto_chacha20_x_init`, for

+217

consistency reasons (snake case everywhere).

+218

- Fixed signed integer overflow detected by UBSan.

+219

- Doubled the speed of EdDSA by performing the scalar product in

+220

Montgomery space.

+221

+222

0.8

+223

---

+224

2017/07/06

+225

+226

- Added about a hundred lines of code to improve performance of public

+227

key cryptography. Diffie-Hellman is now 20% faster than before.

+228

The effects are less pronounced for EdDSA.

+229

- Added random self-consistency tests.

+230

- Added a speed benchmark against libsodium.

+231

+232

0.7

+233

---

+234

2017/06/07

+235

+236

- Slightly changed the authenticated encryption API. Functions are

+237

now all in "detached" mode. The reason is better support for

+238

authenticated encryption _without_ additional data.

+239

- Rewrote BLAKE2b from spec so it can use the same licence as

+240

everything else.

+241

- Added random tests that compare Monocypher with libsodium and

+242

ed25519-donna.

+243

- Added explicit support for Frama-C analysis (this doesn't affect the

+244

source code).

+245

+246

0.6

+247

---

+248

2017/03/17

+249

+250

- Fixed incorrect Poly1305 output on empty messages. (Found by Mike

+251

Pechkin.)

+252

+253

0.5

+254

---

+255

2017/03/10

+256

+257

- Fixed many undefined behaviours in Curve25519 that occur whenever

+258

we perform a left shift on a signed negative integer. It doesn't

+259

affect the generated code, but you never know. (Found with Frama-C

+260

by André Maroneze.)

+261

+262

Fun fact: TweetNaCl and ref10 have the same bug. Libsodium has

+263

corrected the issue, though.

+264

+265

For those who don't comprehend the magnitude of this madness, the

+266

expression `-1 << 3` is undefined in C. This is explained in

+267

section 6.5.7(§4) of the C11 standard.

+268

+269

0.4

+270

---

+271

2017/03/09

+272

+273

- Fixed critical bug causing Argon2i to fail whenever it uses more

+274

than 512 blocks. It was reading uninitialised memory and the

+275

results were incorrect. (Found by Mike Pechkin.)

+276

- Fixed an undefined behaviour in Curve25519 (`fe_tobytes()`). It was

+277

accessing uninitialised memory before throwing it away. It didn't

+278

affect the compiled code nor the results, but you never know.

+279

(Found with [Frama-C](http://frama-c.com) by André Maroneze.)

+280

+281

0.3

+282

---

+283

2017/02/27

+284

+285

- Got the invariants of Poly1305 right and put them in the comments.

+286

There was no bug, but that was lucky (turned out the IETF test

+287

vectors were designed to trigger the bugs I was afraid of).

+288

- Simplified Poly1305 finalisation (replaced conditional subtraction

+289

by a carry propagation).

+290

- Made a few cosmetic changes here and there.

+291

+292

0.2

+293

---

+294

????/??/??

+295

+296

- Public interface significantly reworked. Removed redundant, hard to

+297

mess up constructions.

+298

- Added AEAD.

+299

- Sped up Curve25519 by a factor of more than 6 (switched to ref10

+300

arithmetic).

+301

- Added various test vectors and completed the consistency tests.

+302

+303

0.1

+304

---

+305

2016/??/??

vendor/monocypher/LICENCE.mdadded

@@ -0,0 +1,167 @@

Monocypher as a whole is dual-licensed. Choose whichever licence you

want from the two licences listed below.

The first licence is a regular 2-clause BSD licence. The second licence

is the CC-0 from Creative Commons. It is intended to release Monocypher

to the public domain. The BSD licence serves as a fallback option.

See the individual files for specific information about who contributed

to what file during which years. See below for special notes.

+10

+11

Licence 1 (2-clause BSD)

+12

------------------------

+13

+14

+15

+16

+17

+18

+19

Redistribution and use in source and binary forms, with or without

+20

modification, are permitted provided that the following conditions are

+21

met:

+22

+23

1. Redistributions of source code must retain the above copyright

+24

notice, this list of conditions and the following disclaimer.

+25

+26

2. Redistributions in binary form must reproduce the above copyright

+27

notice, this list of conditions and the following disclaimer in the

+28

documentation and/or other materials provided with the

+29

distribution.

+30

+31

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS

+32

"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT

+33

LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR

+34

A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT

+35

HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

+36

SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT

+37

LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

+38

DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

+39

THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

+40

(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

+41

OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+42

+43

+44

Licence 2 (CC-0)

+45

----------------

+46

+47

> CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE

+48

> LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN

+49

> ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS

+50

> INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES

+51

> REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS

+52

> PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM

+53

> THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED

+54

> HEREUNDER.

+55

+56

### Statement of Purpose

+57

+58

The laws of most jurisdictions throughout the world automatically confer

+59

exclusive Copyright and Related Rights (defined below) upon the creator

+60

and subsequent owner(s) (each and all, an "owner") of an original work

+61

of authorship and/or a database (each, a "Work").

+62

+63

Certain owners wish to permanently relinquish those rights to a Work for

+64

the purpose of contributing to a commons of creative, cultural and

+65

scientific works ("Commons") that the public can reliably and without

+66

fear of later claims of infringement build upon, modify, incorporate in

+67

other works, reuse and redistribute as freely as possible in any form

+68

whatsoever and for any purposes, including without limitation commercial

+69

purposes. These owners may contribute to the Commons to promote the

+70

ideal of a free culture and the further production of creative, cultural

+71

and scientific works, or to gain reputation or greater distribution for

+72

their Work in part through the use and efforts of others.

+73

+74

For these and/or other purposes and motivations, and without any

+75

expectation of additional consideration or compensation, the person

+76

associating CC0 with a Work (the "Affirmer"), to the extent that he or

+77

she is an owner of Copyright and Related Rights in the Work, voluntarily

+78

elects to apply CC0 to the Work and publicly distribute the Work under

+79

its terms, with knowledge of his or her Copyright and Related Rights in

+80

the Work and the meaning and intended legal effect of CC0 on those

+81

rights.

+82

+83

1. **Copyright and Related Rights.** A Work made available under CC0 may

+84

be protected by copyright and related or neighboring rights

+85

("Copyright and Related Rights"). Copyright and Related Rights

+86

include, but are not limited to, the following:

+87

+88

- the right to reproduce, adapt, distribute, perform, display,

+89

communicate, and translate a Work;

+90

- moral rights retained by the original author(s) and/or

+91

performer(s); publicity and privacy rights pertaining to a person's

+92

image or likeness depicted in a Work;

+93

- rights protecting against unfair competition in regards to a Work,

+94

subject to the limitations in paragraph 4(a), below;

+95

- rights protecting the extraction, dissemination, use and reuse of

+96

data in a Work;

+97

- database rights (such as those arising under Directive 96/9/EC of

+98

the European Parliament and of the Council of 11 March 1996 on the

+99

legal protection of databases, and under any national

+100

implementation thereof, including any amended or successor version

+101

of such directive); and

+102

- other similar, equivalent or corresponding rights throughout the

+103

world based on applicable law or treaty, and any national

+104

implementations thereof.

+105

+106

2. **Waiver.** To the greatest extent permitted by, but not in

+107

contravention of, applicable law, Affirmer hereby overtly, fully,

+108

permanently, irrevocably and unconditionally waives, abandons, and

+109

surrenders all of Affirmer's Copyright and Related Rights and

+110

associated claims and causes of action, whether now known or unknown

+111

(including existing as well as future claims and causes of action),

+112

in the Work (i) in all territories worldwide, (ii) for the maximum

+113

duration provided by applicable law or treaty (including future time

+114

extensions), (iii) in any current or future medium and for any number

+115

of copies, and (iv) for any purpose whatsoever, including without

+116

limitation commercial, advertising or promotional purposes (the

+117

"Waiver"). Affirmer makes the Waiver for the benefit of each member

+118

of the public at large and to the detriment of Affirmer's heirs and

+119

successors, fully intending that such Waiver shall not be subject to

+120

revocation, rescission, cancellation, termination, or any other legal

+121

or equitable action to disrupt the quiet enjoyment of the Work by the

+122

public as contemplated by Affirmer's express Statement of Purpose.

+123

+124

3. **Public License Fallback.** Should any part of the Waiver for any

+125

reason be judged legally invalid or ineffective under applicable law,

+126

then the Waiver shall be preserved to the maximum extent permitted

+127

taking into account Affirmer's express Statement of Purpose. In

+128

addition, to the extent the Waiver is so judged Affirmer hereby

+129

grants to each affected person a royalty-free, non transferable, non

+130

sublicensable, non exclusive, irrevocable and unconditional license

+131

to exercise Affirmer's Copyright and Related Rights in the Work (i)

+132

in all territories worldwide, (ii) for the maximum duration provided

+133

by applicable law or treaty (including future time extensions), (iii)

+134

in any current or future medium and for any number of copies, and

+135

(iv) for any purpose whatsoever, including without limitation

+136

commercial, advertising or promotional purposes (the "License"). The

+137

License shall be deemed effective as of the date CC0 was applied by

+138

Affirmer to the Work. Should any part of the License for any reason

+139

be judged legally invalid or ineffective under applicable law, such

+140

partial invalidity or ineffectiveness shall not invalidate the

+141

remainder of the License, and in such case Affirmer hereby affirms

+142

that he or she will not (i) exercise any of his or her remaining

+143

Copyright and Related Rights in the Work or (ii) assert any

+144

associated claims and causes of action with respect to the Work, in

+145

either case contrary to Affirmer's express Statement of Purpose.

+146

+147

4. **Limitations and Disclaimers.**

+148

+149

- No trademark or patent rights held by Affirmer are waived,

+150

abandoned, surrendered, licensed or otherwise affected by this

+151

document.

+152

- Affirmer offers the Work as-is and makes no representations or

+153

warranties of any kind concerning the Work, express, implied,

+154

statutory or otherwise, including without limitation warranties of

+155

title, merchantability, fitness for a particular purpose, non

+156

infringement, or the absence of latent or other defects, accuracy,

+157

or the present or absence of errors, whether or not discoverable,

+158

all to the greatest extent permissible under applicable law.

+159

- Affirmer disclaims responsibility for clearing rights of other

+160

persons that may apply to the Work or any use thereof, including

+161

without limitation any person's Copyright and Related Rights in the

+162

Work. Further, Affirmer disclaims responsibility for obtaining any

+163

necessary consents, permissions or other rights required for any

+164

use of the Work.

+165

- Affirmer understands and acknowledges that Creative Commons is not

+166

a party to this document and has no duty or obligation with respect

+167

to this CC0 or use of the Work.

vendor/monocypher/README.mdadded

@@ -0,0 +1,164 @@

Monocypher

----------

Monocypher is an easy to use, easy to deploy, auditable crypto library

written in portable C. It approaches the size of [TweetNaCl][] and the

speed of [libsodium][].

[Official site.](https://monocypher.org/)

[Official releases.](https://monocypher.org/download/)

+10

+11

[libsodium]: https://libsodium.org

+12

[TweetNaCl]: https://tweetnacl.cr.yp.to/

+13

+14

+15

Features

+16

--------

+17

+18

- [Authenticated Encryption][AEAD] with XChaCha20 and Poly1305

+19

(RFC 8439).

+20

- [Hashing and key derivation][HASH] with BLAKE2b (and [SHA-512][]).

+21

- [Password Hashing][PWH] with Argon2.

+22

- [Public Key Cryptography][PKC] with X25519 key exchanges.

+23

- [Public Key Signatures][EDDSA] with EdDSA and [Ed25519][].

+24

- [Steganography and PAKE][STEG] with [Elligator 2][ELLI].

+25

+26

[AEAD]: https://monocypher.org/manual/aead

+27

[HASH]: https://monocypher.org/manual/blake2b

+28

[SHA-512]: https://monocypher.org/manual/sha512

+29

[PWH]: https://monocypher.org/manual/argon2

+30

[PKC]: https://monocypher.org/manual/x25519

+31

[EDDSA]: https://monocypher.org/manual/eddsa

+32

[Ed25519]: https://monocypher.org/manual/ed25519

+33

[STEG]: https://monocypher.org/manual/elligator

+34

[ELLI]: https://elligator.org

+35

+36

+37

Manual

+38

------

+39

+40

The manual can be found at https://monocypher.org/manual/, and in the

+41

`doc/` folder.

+42

+43

+44

Installation

+45

------------

+46

+47

### Option 1: grab the sources

+48

+49

The easiest way to use Monocypher is to include `src/monocypher.h` and

+50

`src/monocypher.c` directly into your project. They compile as C (since

+51

C99) and C++ (since C++98).

+52

+53

If you need the optional SHA-512 or Ed25519, grab

+54

`src/optional/monocypher-ed25519.h` and

+55

`src/optional/monocypher-ed25519.c` as well.

+56

+57

### Option 2: grab the library

+58

+59

Run `make`, then grab the `src/monocypher.h` header and either the

+60

`lib/libmonocypher.a` or `lib/libmonocypher.so` library. The default

+61

compiler is `gcc -std=c99`, and the default flags are `-pedantic -Wall

+62

-Wextra -O3 -march=native`. If they don't work on your platform, you

+63

can change them like this:

+64

+65

$ make CC="clang -std=c11" CFLAGS="-O2"

+66

+67

### Option 3: install it on your system

+68

+69

Run `make`, then `make install` as root. This will install Monocypher in

+70

`/usr/local` by default. This can be changed with `PREFIX` and

+71

`DESTDIR`:

+72

+73

$ make install PREFIX="/opt"

+74

+75

Once installed, you may use `pkg-config` to compile and link your

+76

program. For instance:

+77

+78

$ gcc program.c $(pkg-config monocypher --cflags) -c

+79

$ gcc program.o $(pkg-config monocypher --libs) -o program

+80

+81

If for any reason you wish to avoid installing the man pages or the

+82

`pkg-config` file, you can use the following installation sub targets

+83

instead: `install-lib`, `install-doc`, and `install-pc`.

+84

+85

+86

Test suite

+87

----------

+88

+89

$ make test

+90

+91

It should display a nice printout of all the tests, ending with "All

+92

tests OK!". If you see "failure" or "Error" anywhere, something has gone

+93

wrong.

+94

+95

*Do not* use Monocypher without running those tests at least once.

+96

+97

The same test suite can be run under Clang sanitisers and Valgrind, and

+98

be checked for code coverage:

+99

+100

$ tests/test.sh

+101

$ tests/coverage.sh

+102

+103

+104

### Serious auditing

+105

+106

The code may be analysed more formally with [Frama-c][] and the

+107

[TIS interpreter][TIS]. To analyse the code with Frama-c, run:

+108

+109

$ tests/formal-analysis.sh

+110

$ tests/frama-c.sh

+111

+112

This will have Frama-c parse, and analyse the code, then launch a GUI.

+113

You must have Frama-c installed. See `frama-c.sh` for the recommended

+114

settings. To run the code under the TIS interpreter, run

+115

+116

$ tests/formal-analysis.sh

+117

$ tis-interpreter.sh --cc -Dvolatile= tests/formal-analysis/*.c

+118

+119

Notes:

+120

+121

- `tis-interpreter.sh` is part of TIS. If it is not in your path,

+122

adjust the command accordingly.

+123

+124

- The TIS interpreter sometimes fails to evaluate correct programs when

+125

they use the `volatile` keyword (which is only used as an attempt to

+126

prevent dead store elimination for memory wipes). The `-cc

+127

-Dvolatile=` option works around that bug by ignoring `volatile`

+128

altogether.

+129

+130

[Frama-c]:https://frama-c.com/

+131

[TIS]: https://trust-in-soft.com/tis-interpreter/

+132

+133

+134

Customisation

+135

-------------

+136

+137

Monocypher has optional compatibility with Ed25519. To have that, add

+138

`monocypher-ed25519.h` and `monocypher-ed25519.c` provided in

+139

`src/optional` to your project. If you compile or install Monocypher

+140

with the makefile, they will be automatically included.

+141

+142

Monocypher also has the `BLAKE2_NO_UNROLLING` preprocessor flag, which

+143

is activated by compiling monocypher.c with the `-DBLAKE2_NO_UNROLLING`

+144

option.

+145

+146

The `-DBLAKE2_NO_UNROLLING` option is a performance tweak. By default,

+147

Monocypher unrolls the BLAKE2b inner loop, because doing so is over 25%

+148

faster on modern processors. Some embedded processors however, run the

+149

unrolled loop _slower_ (possibly because of the cost of fetching 5KB of

+150

additional code). If you're using an embedded platform, try this

+151

option. The binary will be about 5KB smaller, and in some cases faster.

+152

+153

The `MONOCYPHER_CPP_NAMESPACE` preprocessor definition allows C++ users

+154

who compile Monocypher as C++ to wrap it in a namespace. When it is not

+155

defined (the default), we assume Monocypher is compiled as C, and an

+156

`extern "C"` declaration is added when we detect that the header is

+157

included in C++ code.

+158

+159

The `change-prefix.sh` script can rename all functions by replacing

+160

`crypto_` by a chosen prefix, so you can avoid name clashes. For

+161

instance, the following command changes all instances of `crypto_` by

+162

`foobar_` (note the absence of the underscore):

+163

+164

./change-prefix.sh foobar

vendor/monocypher/src/monocypher.cadded

@@ -0,0 +1,2988 @@

// Monocypher version 4.0.3

//

// This file is dual-licensed. Choose whichever licence you want from

// the two licences listed below.

//

// The first licence is a regular 2-clause BSD licence. The second licence

// is the CC-0 from Creative Commons. It is intended to release Monocypher

// to the public domain. The BSD licence serves as a fallback option.

//

+10

// SPDX-License-Identifier: BSD-2-Clause OR CC0-1.0

+11

//

+12

// ------------------------------------------------------------------------

+13

//

+14

+15

+16

//

+17

//

+18

// Redistribution and use in source and binary forms, with or without

+19

// modification, are permitted provided that the following conditions are

+20

// met:

+21

//

+22

// 1. Redistributions of source code must retain the above copyright

+23

// notice, this list of conditions and the following disclaimer.

+24

//

+25

// 2. Redistributions in binary form must reproduce the above copyright

+26

// notice, this list of conditions and the following disclaimer in the

+27

// documentation and/or other materials provided with the

+28

// distribution.

+29

//

+30

// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS

+31

// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT

+32

// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR

+33

// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT

+34

// HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

+35

// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT

+36

// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

+37

// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

+38

// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

+39

// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

+40

// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+41

//

+42

// ------------------------------------------------------------------------

+43

//

+44

// Written in 2017-2020 by Loup Vaillant

+45

//

+46

// To the extent possible under law, the author(s) have dedicated all copyright

+47

// and related neighboring rights to this software to the public domain

+48

// worldwide. This software is distributed without any warranty.

+49

//

+50

// You should have received a copy of the CC0 Public Domain Dedication along

+51

// with this software. If not, see

+52

// <https://creativecommons.org/publicdomain/zero/1.0/>

+53

+54

#include "monocypher.h"

+55

+56

#ifdef MONOCYPHER_CPP_NAMESPACE

+57

namespace MONOCYPHER_CPP_NAMESPACE {

+58

#endif

+59

+60

/////////////////

+61

/// Utilities ///

+62

/////////////////

+63

#define FOR_T(type, i, start, end) for (type i = (start); i < (end); i++)

+64

#define FOR(i, start, end) FOR_T(size_t, i, start, end)

+65

#define COPY(dst, src, size) FOR(_i_, 0, size) (dst)[_i_] = (src)[_i_]

+66

#define ZERO(buf, size) FOR(_i_, 0, size) (buf)[_i_] = 0

+67

#define WIPE_CTX(ctx) crypto_wipe(ctx , sizeof(*(ctx)))

+68

#define WIPE_BUFFER(buffer) crypto_wipe(buffer, sizeof(buffer))

+69

#define MIN(a, b) ((a) <= (b) ? (a) : (b))

+70

#define MAX(a, b) ((a) >= (b) ? (a) : (b))

+71

+72

typedef int8_t i8;

+73

typedef uint8_t u8;

+74

typedef int16_t i16;

+75

typedef uint32_t u32;

+76

typedef int32_t i32;

+77

typedef int64_t i64;

+78

typedef uint64_t u64;

+79

+80

static const u8 zero[128] = {0};

+81

+82

// returns the smallest positive integer y such that

+83

// (x + y) % pow_2 == 0

+84

// Basically, y is the "gap" missing to align x.

+85

// Only works when pow_2 is a power of 2.

+86

// Note: we use ~x+1 instead of -x to avoid compiler warnings

+87

static size_t gap(size_t x, size_t pow_2)

+88

{

+89

return (~x + 1) & (pow_2 - 1);

+90

}

+91

+92

static u32 load24_le(const u8 s[3])

+93

{

+94

return

+95

((u32)s[0] << 0) |

+96

((u32)s[1] << 8) |

+97

((u32)s[2] << 16);

+98

}

+99

+100

static u32 load32_le(const u8 s[4])

+101

{

+102

return

+103

((u32)s[0] << 0) |

+104

((u32)s[1] << 8) |

+105

((u32)s[2] << 16) |

+106

((u32)s[3] << 24);

+107

}

+108

+109

static u64 load64_le(const u8 s[8])

+110

{

+111

return load32_le(s) | ((u64)load32_le(s+4) << 32);

+112

}

+113

+114

static void store32_le(u8 out[4], u32 in)

+115

{

+116

out[0] = (u8)(in );

+117

out[1] = (u8)(in >> 8);

+118

out[2] = (u8)(in >> 16);

+119

out[3] = (u8)(in >> 24);

+120

}

+121

+122

static void store64_le(u8 out[8], u64 in)

+123

{

+124

store32_le(out , (u32)(in ));

+125

store32_le(out + 4, (u32)(in >> 32));

+126

}

+127

+128

static void load32_le_buf (u32 *dst, const u8 *src, size_t size) {

+129

FOR(i, 0, size) { dst[i] = load32_le(src + i*4); }

+130

}

+131

static void load64_le_buf (u64 *dst, const u8 *src, size_t size) {

+132

FOR(i, 0, size) { dst[i] = load64_le(src + i*8); }

+133

}

+134

static void store32_le_buf(u8 *dst, const u32 *src, size_t size) {

+135

FOR(i, 0, size) { store32_le(dst + i*4, src[i]); }

+136

}

+137

static void store64_le_buf(u8 *dst, const u64 *src, size_t size) {

+138

FOR(i, 0, size) { store64_le(dst + i*8, src[i]); }

+139

}

+140

+141

static u64 rotr64(u64 x, u64 n) { return (x >> n) ^ (x << (64 - n)); }

+142

static u32 rotl32(u32 x, u32 n) { return (x << n) ^ (x >> (32 - n)); }

+143

+144

static int neq0(u64 diff)

+145

{

+146

// constant time comparison to zero

+147

// return diff != 0 ? -1 : 0

+148

u64 half = (diff >> 32) | ((u32)diff); // half < 2^32

+149

u64 eq0 = 1 & ((half - 1) >> 32); // half == 0 ? 1 : 0

+150

return (int)eq0 - 1; // half == 0 ? 0 : -1

+151

}

+152

+153

static u64 x16(const u8 a[16], const u8 b[16])

+154

{

+155

return (load64_le(a + 0) ^ load64_le(b + 0))

+156

| (load64_le(a + 8) ^ load64_le(b + 8));

+157

}

+158

static u64 x32(const u8 a[32],const u8 b[32]){return x16(a,b)| x16(a+16, b+16);}

+159

static u64 x64(const u8 a[64],const u8 b[64]){return x32(a,b)| x32(a+32, b+32);}

+160

int crypto_verify16(const u8 a[16], const u8 b[16]){ return neq0(x16(a, b)); }

+161

int crypto_verify32(const u8 a[32], const u8 b[32]){ return neq0(x32(a, b)); }

+162

int crypto_verify64(const u8 a[64], const u8 b[64]){ return neq0(x64(a, b)); }

+163

+164

void crypto_wipe(void *secret, size_t size)

+165

{

+166

volatile u8 *v_secret = (u8*)secret;

+167

ZERO(v_secret, size);

+168

}

+169

+170

/////////////////

+171

/// Chacha 20 ///

+172

/////////////////

+173

#define QUARTERROUND(a, b, c, d) \

+174

a += b; d = rotl32(d ^ a, 16); \

+175

c += d; b = rotl32(b ^ c, 12); \

+176

a += b; d = rotl32(d ^ a, 8); \

+177

c += d; b = rotl32(b ^ c, 7)

+178

+179

static void chacha20_rounds(u32 out[16], const u32 in[16])

+180

{

+181

// The temporary variables make Chacha20 10% faster.

+182

u32 t0 = in[ 0]; u32 t1 = in[ 1]; u32 t2 = in[ 2]; u32 t3 = in[ 3];

+183

u32 t4 = in[ 4]; u32 t5 = in[ 5]; u32 t6 = in[ 6]; u32 t7 = in[ 7];

+184

u32 t8 = in[ 8]; u32 t9 = in[ 9]; u32 t10 = in[10]; u32 t11 = in[11];

+185

u32 t12 = in[12]; u32 t13 = in[13]; u32 t14 = in[14]; u32 t15 = in[15];

+186

+187

FOR (i, 0, 10) { // 20 rounds, 2 rounds per loop.

+188

QUARTERROUND(t0, t4, t8 , t12); // column 0

+189

QUARTERROUND(t1, t5, t9 , t13); // column 1

+190

QUARTERROUND(t2, t6, t10, t14); // column 2

+191

QUARTERROUND(t3, t7, t11, t15); // column 3

+192

QUARTERROUND(t0, t5, t10, t15); // diagonal 0

+193

QUARTERROUND(t1, t6, t11, t12); // diagonal 1

+194

QUARTERROUND(t2, t7, t8 , t13); // diagonal 2

+195

QUARTERROUND(t3, t4, t9 , t14); // diagonal 3

+196

}

+197

out[ 0] = t0; out[ 1] = t1; out[ 2] = t2; out[ 3] = t3;

+198

out[ 4] = t4; out[ 5] = t5; out[ 6] = t6; out[ 7] = t7;

+199

out[ 8] = t8; out[ 9] = t9; out[10] = t10; out[11] = t11;

+200

out[12] = t12; out[13] = t13; out[14] = t14; out[15] = t15;

+201

}

+202

+203

static const u8 *chacha20_constant = (const u8*)"expand 32-byte k"; // 16 bytes

+204

+205

void crypto_chacha20_h(u8 out[32], const u8 key[32], const u8 in [16])

+206

{

+207

u32 block[16];

+208

load32_le_buf(block , chacha20_constant, 4);

+209

load32_le_buf(block + 4, key , 8);

+210

load32_le_buf(block + 12, in , 4);

+211

+212

chacha20_rounds(block, block);

+213

+214

// prevent reversal of the rounds by revealing only half of the buffer.

+215

store32_le_buf(out , block , 4); // constant

+216

store32_le_buf(out+16, block+12, 4); // counter and nonce

+217

WIPE_BUFFER(block);

+218

}

+219

+220

u64 crypto_chacha20_djb(u8 *cipher_text, const u8 *plain_text,

+221

size_t text_size, const u8 key[32], const u8 nonce[8],

+222

u64 ctr)

+223

{

+224

u32 input[16];

+225

load32_le_buf(input , chacha20_constant, 4);

+226

load32_le_buf(input + 4, key , 8);

+227

load32_le_buf(input + 14, nonce , 2);

+228

input[12] = (u32) ctr;

+229

input[13] = (u32)(ctr >> 32);

+230

+231

// Whole blocks

+232

u32 pool[16];

+233

size_t nb_blocks = text_size >> 6;

+234

FOR (i, 0, nb_blocks) {

+235

chacha20_rounds(pool, input);

+236

if (plain_text != NULL) {

+237

FOR (j, 0, 16) {

+238

u32 p = pool[j] + input[j];

+239

store32_le(cipher_text, p ^ load32_le(plain_text));

+240

cipher_text += 4;

+241

plain_text += 4;

+242

}

+243

} else {

+244

FOR (j, 0, 16) {

+245

u32 p = pool[j] + input[j];

+246

store32_le(cipher_text, p);

+247

cipher_text += 4;

+248

}

+249

}

+250

input[12]++;

+251

if (input[12] == 0) {

+252

input[13]++;

+253

}

+254

}

+255

text_size &= 63;

+256

+257

// Last (incomplete) block

+258

if (text_size > 0) {

+259

if (plain_text == NULL) {

+260

plain_text = zero;

+261

}

+262

chacha20_rounds(pool, input);

+263

u8 tmp[64];

+264

FOR (i, 0, 16) {

+265

store32_le(tmp + i*4, pool[i] + input[i]);

+266

}

+267

FOR (i, 0, text_size) {

+268

cipher_text[i] = tmp[i] ^ plain_text[i];

+269

}

+270

WIPE_BUFFER(tmp);

+271

}

+272

ctr = input[12] + ((u64)input[13] << 32) + (text_size > 0);

+273

+274

WIPE_BUFFER(pool);

+275

WIPE_BUFFER(input);

+276

return ctr;

+277

}

+278

+279

u32 crypto_chacha20_ietf(u8 *cipher_text, const u8 *plain_text,

+280

size_t text_size,

+281

const u8 key[32], const u8 nonce[12], u32 ctr)

+282

{

+283

u64 big_ctr = ctr + ((u64)load32_le(nonce) << 32);

+284

return (u32)crypto_chacha20_djb(cipher_text, plain_text, text_size,

+285

key, nonce + 4, big_ctr);

+286

}

+287

+288

u64 crypto_chacha20_x(u8 *cipher_text, const u8 *plain_text,

+289

size_t text_size,

+290

const u8 key[32], const u8 nonce[24], u64 ctr)

+291

{

+292

u8 sub_key[32];

+293

crypto_chacha20_h(sub_key, key, nonce);

+294

ctr = crypto_chacha20_djb(cipher_text, plain_text, text_size,

+295

sub_key, nonce + 16, ctr);

+296

WIPE_BUFFER(sub_key);

+297

return ctr;

+298

}

+299

+300

/////////////////

+301

/// Poly 1305 ///

+302

/////////////////

+303

+304

// h = (h + c) * r

+305

// preconditions:

+306

// ctx->h <= 4_ffffffff_ffffffff_ffffffff_ffffffff

+307

// ctx->r <= 0ffffffc_0ffffffc_0ffffffc_0fffffff

+308

// end <= 1

+309

// Postcondition:

+310

// ctx->h <= 4_ffffffff_ffffffff_ffffffff_ffffffff

+311

static void poly_blocks(crypto_poly1305_ctx *ctx, const u8 *in,

+312

size_t nb_blocks, unsigned end)

+313

{

+314

// Local all the things!

+315

const u32 r0 = ctx->r[0];

+316

const u32 r1 = ctx->r[1];

+317

const u32 r2 = ctx->r[2];

+318

const u32 r3 = ctx->r[3];

+319

const u32 rr0 = (r0 >> 2) * 5; // lose 2 bits...

+320

const u32 rr1 = (r1 >> 2) + r1; // rr1 == (r1 >> 2) * 5

+321

const u32 rr2 = (r2 >> 2) + r2; // rr1 == (r2 >> 2) * 5

+322

const u32 rr3 = (r3 >> 2) + r3; // rr1 == (r3 >> 2) * 5

+323

const u32 rr4 = r0 & 3; // ...recover 2 bits

+324

u32 h0 = ctx->h[0];

+325

u32 h1 = ctx->h[1];

+326

u32 h2 = ctx->h[2];

+327

u32 h3 = ctx->h[3];

+328

u32 h4 = ctx->h[4];

+329

+330

FOR (i, 0, nb_blocks) {

+331

// h + c, without carry propagation

+332

const u64 s0 = (u64)h0 + load32_le(in); in += 4;

+333

const u64 s1 = (u64)h1 + load32_le(in); in += 4;

+334

const u64 s2 = (u64)h2 + load32_le(in); in += 4;

+335

const u64 s3 = (u64)h3 + load32_le(in); in += 4;

+336

const u32 s4 = h4 + end;

+337

+338

// (h + c) * r, without carry propagation

+339

const u64 x0 = s0*r0+ s1*rr3+ s2*rr2+ s3*rr1+ s4*rr0;

+340

const u64 x1 = s0*r1+ s1*r0 + s2*rr3+ s3*rr2+ s4*rr1;

+341

const u64 x2 = s0*r2+ s1*r1 + s2*r0 + s3*rr3+ s4*rr2;

+342

const u64 x3 = s0*r3+ s1*r2 + s2*r1 + s3*r0 + s4*rr3;

+343

const u32 x4 = s4*rr4;

+344

+345

// partial reduction modulo 2^130 - 5

+346

const u32 u5 = (u32)(x3 >> 32) + x4; // u5 <= 7ffffff5

+347

const u64 u0 = (u32)(u5 >> 2) * 5 + (x0 & 0xffffffff);

+348

const u64 u1 = (u32)(u0 >> 32) + (x1 & 0xffffffff) + (x0 >> 32);

+349

const u64 u2 = (u32)(u1 >> 32) + (x2 & 0xffffffff) + (x1 >> 32);

+350

const u64 u3 = (u32)(u2 >> 32) + (x3 & 0xffffffff) + (x2 >> 32);

+351

const u32 u4 = (u32)(u3 >> 32) + (u5 & 3); // u4 <= 4

+352

+353

// Update the hash

+354

h0 = u0 & 0xffffffff;

+355

h1 = u1 & 0xffffffff;

+356

h2 = u2 & 0xffffffff;

+357

h3 = u3 & 0xffffffff;

+358

h4 = u4;

+359

}

+360

ctx->h[0] = h0;

+361

ctx->h[1] = h1;

+362

ctx->h[2] = h2;

+363

ctx->h[3] = h3;

+364

ctx->h[4] = h4;

+365

}

+366

+367

void crypto_poly1305_init(crypto_poly1305_ctx *ctx, const u8 key[32])

+368

{

+369

ZERO(ctx->h, 5); // Initial hash is zero

+370

ctx->c_idx = 0;

+371

// load r and pad (r has some of its bits cleared)

+372

load32_le_buf(ctx->r , key , 4);

+373

load32_le_buf(ctx->pad, key+16, 4);

+374

FOR (i, 0, 1) { ctx->r[i] &= 0x0fffffff; }

+375

FOR (i, 1, 4) { ctx->r[i] &= 0x0ffffffc; }

+376

}

+377

+378

void crypto_poly1305_update(crypto_poly1305_ctx *ctx,

+379

const u8 *message, size_t message_size)

+380

{

+381

// Avoid undefined NULL pointer increments with empty messages

+382

if (message_size == 0) {

+383

return;

+384

}

+385

+386

// Align ourselves with block boundaries

+387

size_t aligned = MIN(gap(ctx->c_idx, 16), message_size);

+388

FOR (i, 0, aligned) {

+389

ctx->c[ctx->c_idx] = *message;

+390

ctx->c_idx++;

+391

message++;

+392

message_size--;

+393

}

+394

+395

// If block is complete, process it

+396

if (ctx->c_idx == 16) {

+397

poly_blocks(ctx, ctx->c, 1, 1);

+398

ctx->c_idx = 0;

+399

}

+400

+401

// Process the message block by block

+402

size_t nb_blocks = message_size >> 4;

+403

poly_blocks(ctx, message, nb_blocks, 1);

+404

message += nb_blocks << 4;

+405

message_size &= 15;

+406

+407

// remaining bytes (we never complete a block here)

+408

FOR (i, 0, message_size) {

+409

ctx->c[ctx->c_idx] = message[i];

+410

ctx->c_idx++;

+411

}

+412

}

+413

+414

void crypto_poly1305_final(crypto_poly1305_ctx *ctx, u8 mac[16])

+415

{

+416

// Process the last block (if any)

+417

// We move the final 1 according to remaining input length

+418

// (this will add less than 2^130 to the last input block)

+419

if (ctx->c_idx != 0) {

+420

ZERO(ctx->c + ctx->c_idx, 16 - ctx->c_idx);

+421

ctx->c[ctx->c_idx] = 1;

+422

poly_blocks(ctx, ctx->c, 1, 0);

+423

}

+424

+425

// check if we should subtract 2^130-5 by performing the

+426

// corresponding carry propagation.

+427

u64 c = 5;

+428

FOR (i, 0, 4) {

+429

c += ctx->h[i];

+430

c >>= 32;

+431

}

+432

c += ctx->h[4];

+433

c = (c >> 2) * 5; // shift the carry back to the beginning

+434

// c now indicates how many times we should subtract 2^130-5 (0 or 1)

+435

FOR (i, 0, 4) {

+436

c += (u64)ctx->h[i] + ctx->pad[i];

+437

store32_le(mac + i*4, (u32)c);

+438

c = c >> 32;

+439

}

+440

WIPE_CTX(ctx);

+441

}

+442

+443

void crypto_poly1305(u8 mac[16], const u8 *message,

+444

size_t message_size, const u8 key[32])

+445

{

+446

crypto_poly1305_ctx ctx;

+447

crypto_poly1305_init (&ctx, key);

+448

crypto_poly1305_update(&ctx, message, message_size);

+449

crypto_poly1305_final (&ctx, mac);

+450

}

+451

+452

////////////////

+453

/// BLAKE2 b ///

+454

////////////////

+455

static const u64 iv[8] = {

+456

0x6a09e667f3bcc908, 0xbb67ae8584caa73b,

+457

0x3c6ef372fe94f82b, 0xa54ff53a5f1d36f1,

+458

0x510e527fade682d1, 0x9b05688c2b3e6c1f,

+459

0x1f83d9abfb41bd6b, 0x5be0cd19137e2179,

+460

};

+461

+462

static void blake2b_compress(crypto_blake2b_ctx *ctx, int is_last_block)

+463

{

+464

static const u8 sigma[12][16] = {

+465

{ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },

+466

{ 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 },

+467

{ 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 },

+468

{ 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 },

+469

{ 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 },

+470

{ 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 },

+471

{ 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 },

+472

{ 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 },

+473

{ 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 },

+474

{ 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0 },

+475

{ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },

+476

{ 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 },

+477

};

+478

+479

// increment input offset

+480

u64 *x = ctx->input_offset;

+481

size_t y = ctx->input_idx;

+482

x[0] += y;

+483

if (x[0] < y) {

+484

x[1]++;

+485

}

+486

+487

// init work vector

+488

u64 v0 = ctx->hash[0]; u64 v8 = iv[0];

+489

u64 v1 = ctx->hash[1]; u64 v9 = iv[1];

+490

u64 v2 = ctx->hash[2]; u64 v10 = iv[2];

+491

u64 v3 = ctx->hash[3]; u64 v11 = iv[3];

+492

u64 v4 = ctx->hash[4]; u64 v12 = iv[4] ^ ctx->input_offset[0];

+493

u64 v5 = ctx->hash[5]; u64 v13 = iv[5] ^ ctx->input_offset[1];

+494

u64 v6 = ctx->hash[6]; u64 v14 = iv[6] ^ (u64)~(is_last_block - 1);

+495

u64 v7 = ctx->hash[7]; u64 v15 = iv[7];

+496

+497

// mangle work vector

+498

u64 *input = ctx->input;

+499

#define BLAKE2_G(a, b, c, d, x, y) \

Showing the first 500 of 2989 diff lines for this file. This diff is INCOMPLETE; read the file or clone the repository for the rest.

vendor/monocypher/src/monocypher.hadded

@@ -0,0 +1,321 @@

// Monocypher version 4.0.3

//

// This file is dual-licensed. Choose whichever licence you want from

// the two licences listed below.

//

// The first licence is a regular 2-clause BSD licence. The second licence

// is the CC-0 from Creative Commons. It is intended to release Monocypher

// to the public domain. The BSD licence serves as a fallback option.

//

+10

// SPDX-License-Identifier: BSD-2-Clause OR CC0-1.0

+11

//

+12

// ------------------------------------------------------------------------

+13

//

+14

+15

+16

//

+17

//

+18

// Redistribution and use in source and binary forms, with or without

+19

// modification, are permitted provided that the following conditions are

+20

// met:

+21

//

+22

// 1. Redistributions of source code must retain the above copyright

+23

// notice, this list of conditions and the following disclaimer.

+24

//

+25

// 2. Redistributions in binary form must reproduce the above copyright

+26

// notice, this list of conditions and the following disclaimer in the

+27

// documentation and/or other materials provided with the

+28

// distribution.

+29

//

+30

// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS

+31

// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT

+32

// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR

+33

// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT

+34

// HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

+35

// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT

+36

// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

+37

// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

+38

// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

+39

// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

+40

// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+41

//

+42

// ------------------------------------------------------------------------

+43

//

+44

// Written in 2017-2019 by Loup Vaillant

+45

//

+46

// To the extent possible under law, the author(s) have dedicated all copyright

+47

// and related neighboring rights to this software to the public domain

+48

// worldwide. This software is distributed without any warranty.

+49

//

+50

// You should have received a copy of the CC0 Public Domain Dedication along

+51

// with this software. If not, see

+52

// <https://creativecommons.org/publicdomain/zero/1.0/>

+53

+54

#ifndef MONOCYPHER_H

+55

#define MONOCYPHER_H

+56

+57

#include <stddef.h>

+58

#include <stdint.h>

+59

+60

#ifdef MONOCYPHER_CPP_NAMESPACE

+61

namespace MONOCYPHER_CPP_NAMESPACE {

+62

#elif defined(__cplusplus)

+63

extern "C" {

+64

#endif

+65

+66

// Constant time comparisons

+67

// -------------------------

+68

+69

// Return 0 if a and b are equal, -1 otherwise

+70

int crypto_verify16(const uint8_t a[16], const uint8_t b[16]);

+71

int crypto_verify32(const uint8_t a[32], const uint8_t b[32]);

+72

int crypto_verify64(const uint8_t a[64], const uint8_t b[64]);

+73

+74

+75

// Erase sensitive data

+76

// --------------------

+77

void crypto_wipe(void *secret, size_t size);

+78

+79

+80

// Authenticated encryption

+81

// ------------------------

+82

void crypto_aead_lock(uint8_t *cipher_text,

+83

uint8_t mac [16],

+84

const uint8_t key [32],

+85

const uint8_t nonce[24],

+86

const uint8_t *ad, size_t ad_size,

+87

const uint8_t *plain_text, size_t text_size);

+88

int crypto_aead_unlock(uint8_t *plain_text,

+89

const uint8_t mac [16],

+90

const uint8_t key [32],

+91

const uint8_t nonce[24],

+92

const uint8_t *ad, size_t ad_size,

+93

const uint8_t *cipher_text, size_t text_size);

+94

+95

// Authenticated stream

+96

// --------------------

+97

typedef struct {

+98

uint64_t counter;

+99

uint8_t key[32];

+100

uint8_t nonce[8];

+101

} crypto_aead_ctx;

+102

+103

void crypto_aead_init_x(crypto_aead_ctx *ctx,

+104

const uint8_t key[32], const uint8_t nonce[24]);

+105

void crypto_aead_init_djb(crypto_aead_ctx *ctx,

+106

const uint8_t key[32], const uint8_t nonce[8]);

+107

void crypto_aead_init_ietf(crypto_aead_ctx *ctx,

+108

const uint8_t key[32], const uint8_t nonce[12]);

+109

+110

void crypto_aead_write(crypto_aead_ctx *ctx,

+111

uint8_t *cipher_text,

+112

uint8_t mac[16],

+113

const uint8_t *ad , size_t ad_size,

+114

const uint8_t *plain_text, size_t text_size);

+115

int crypto_aead_read(crypto_aead_ctx *ctx,

+116

uint8_t *plain_text,

+117

const uint8_t mac[16],

+118

const uint8_t *ad , size_t ad_size,

+119

const uint8_t *cipher_text, size_t text_size);

+120

+121

+122

// General purpose hash (BLAKE2b)

+123

// ------------------------------

+124

+125

// Direct interface

+126

void crypto_blake2b(uint8_t *hash, size_t hash_size,

+127

const uint8_t *message, size_t message_size);

+128

+129

void crypto_blake2b_keyed(uint8_t *hash, size_t hash_size,

+130

const uint8_t *key, size_t key_size,

+131

const uint8_t *message, size_t message_size);

+132

+133

// Incremental interface

+134

typedef struct {

+135

// Do not rely on the size or contents of this type,

+136

// for they may change without notice.

+137

uint64_t hash[8];

+138

uint64_t input_offset[2];

+139

uint64_t input[16];

+140

size_t input_idx;

+141

size_t hash_size;

+142

} crypto_blake2b_ctx;

+143

+144

void crypto_blake2b_init(crypto_blake2b_ctx *ctx, size_t hash_size);

+145

void crypto_blake2b_keyed_init(crypto_blake2b_ctx *ctx, size_t hash_size,

+146

const uint8_t *key, size_t key_size);

+147

void crypto_blake2b_update(crypto_blake2b_ctx *ctx,

+148

const uint8_t *message, size_t message_size);

+149

void crypto_blake2b_final(crypto_blake2b_ctx *ctx, uint8_t *hash);

+150

+151

+152

// Password key derivation (Argon2)

+153

// --------------------------------

+154

#define CRYPTO_ARGON2_D 0

+155

#define CRYPTO_ARGON2_I 1

+156

#define CRYPTO_ARGON2_ID 2

+157

+158

typedef struct {

+159

uint32_t algorithm; // Argon2d, Argon2i, Argon2id

+160

uint32_t nb_blocks; // memory hardness, >= 8 * nb_lanes

+161

uint32_t nb_passes; // CPU hardness, >= 1 (>= 3 recommended for Argon2i)

+162

uint32_t nb_lanes; // parallelism level (single threaded anyway)

+163

} crypto_argon2_config;

+164

+165

typedef struct {

+166

const uint8_t *pass;

+167

const uint8_t *salt;

+168

uint32_t pass_size;

+169

uint32_t salt_size; // 16 bytes recommended

+170

} crypto_argon2_inputs;

+171

+172

typedef struct {

+173

const uint8_t *key; // may be NULL if no key

+174

const uint8_t *ad; // may be NULL if no additional data

+175

uint32_t key_size; // 0 if no key (32 bytes recommended otherwise)

+176

uint32_t ad_size; // 0 if no additional data

+177

} crypto_argon2_extras;

+178

+179

extern const crypto_argon2_extras crypto_argon2_no_extras;

+180

+181

void crypto_argon2(uint8_t *hash, uint32_t hash_size, void *work_area,

+182

crypto_argon2_config config,

+183

crypto_argon2_inputs inputs,

+184

crypto_argon2_extras extras);

+185

+186

+187

// Key exchange (X-25519)

+188

// ----------------------

+189

+190

// Shared secrets are not quite random.

+191

// Hash them to derive an actual shared key.

+192

void crypto_x25519_public_key(uint8_t public_key[32],

+193

const uint8_t secret_key[32]);

+194

void crypto_x25519(uint8_t raw_shared_secret[32],

+195

const uint8_t your_secret_key [32],

+196

const uint8_t their_public_key [32]);

+197

+198

// Conversion to EdDSA

+199

void crypto_x25519_to_eddsa(uint8_t eddsa[32], const uint8_t x25519[32]);

+200

+201

// scalar "division"

+202

// Used for OPRF. Be aware that exponential blinding is less secure

+203

// than Diffie-Hellman key exchange.

+204

void crypto_x25519_inverse(uint8_t blind_salt [32],

+205

const uint8_t private_key[32],

+206

const uint8_t curve_point[32]);

+207

+208

// "Dirty" versions of x25519_public_key().

+209

// Use with crypto_elligator_rev().

+210

// Leaks 3 bits of the private key.

+211

void crypto_x25519_dirty_small(uint8_t pk[32], const uint8_t sk[32]);

+212

void crypto_x25519_dirty_fast (uint8_t pk[32], const uint8_t sk[32]);

+213

+214

+215

// Signatures

+216

// ----------

+217

+218

// EdDSA with curve25519 + BLAKE2b

+219

void crypto_eddsa_key_pair(uint8_t secret_key[64],

+220

uint8_t public_key[32],

+221

uint8_t seed[32]);

+222

void crypto_eddsa_sign(uint8_t signature [64],

+223

const uint8_t secret_key[64],

+224

const uint8_t *message, size_t message_size);

+225

int crypto_eddsa_check(const uint8_t signature [64],

+226

const uint8_t public_key[32],

+227

const uint8_t *message, size_t message_size);

+228

+229

// Conversion to X25519

+230

void crypto_eddsa_to_x25519(uint8_t x25519[32], const uint8_t eddsa[32]);

+231

+232

// EdDSA building blocks

+233

void crypto_eddsa_trim_scalar(uint8_t out[32], const uint8_t in[32]);

+234

void crypto_eddsa_reduce(uint8_t reduced[32], const uint8_t expanded[64]);

+235

void crypto_eddsa_mul_add(uint8_t r[32],

+236

const uint8_t a[32],

+237

const uint8_t b[32],

+238

const uint8_t c[32]);

+239

void crypto_eddsa_scalarbase(uint8_t point[32], const uint8_t scalar[32]);

+240

int crypto_eddsa_check_equation(const uint8_t signature[64],

+241

const uint8_t public_key[32],

+242

const uint8_t h_ram[32]);

+243

+244

+245

// Chacha20

+246

// --------

+247

+248

// Specialised hash.

+249

// Used to hash X25519 shared secrets.

+250

void crypto_chacha20_h(uint8_t out[32],

+251

const uint8_t key[32],

+252

const uint8_t in [16]);

+253

+254

// Unauthenticated stream cipher.

+255

// Don't forget to add authentication.

+256

uint64_t crypto_chacha20_djb(uint8_t *cipher_text,

+257

const uint8_t *plain_text,

+258

size_t text_size,

+259

const uint8_t key[32],

+260

const uint8_t nonce[8],

+261

uint64_t ctr);

+262

uint32_t crypto_chacha20_ietf(uint8_t *cipher_text,

+263

const uint8_t *plain_text,

+264

size_t text_size,

+265

const uint8_t key[32],

+266

const uint8_t nonce[12],

+267

uint32_t ctr);

+268

uint64_t crypto_chacha20_x(uint8_t *cipher_text,

+269

const uint8_t *plain_text,

+270

size_t text_size,

+271

const uint8_t key[32],

+272

const uint8_t nonce[24],

+273

uint64_t ctr);

+274

+275

+276

// Poly 1305

+277

// ---------

+278

+279

// This is a *one time* authenticator.

+280

// Disclosing the mac reveals the key.

+281

// See crypto_lock() on how to use it properly.

+282

+283

// Direct interface

+284

void crypto_poly1305(uint8_t mac[16],

+285

const uint8_t *message, size_t message_size,

+286

const uint8_t key[32]);

+287

+288

// Incremental interface

+289

typedef struct {

+290

// Do not rely on the size or contents of this type,

+291

// for they may change without notice.

+292

uint8_t c[16]; // chunk of the message

+293

size_t c_idx; // How many bytes are there in the chunk.

+294

uint32_t r [4]; // constant multiplier (from the secret key)

+295

uint32_t pad[4]; // random number added at the end (from the secret key)

+296

uint32_t h [5]; // accumulated hash

+297

} crypto_poly1305_ctx;

+298

+299

void crypto_poly1305_init (crypto_poly1305_ctx *ctx, const uint8_t key[32]);

+300

void crypto_poly1305_update(crypto_poly1305_ctx *ctx,

+301

const uint8_t *message, size_t message_size);

+302

void crypto_poly1305_final (crypto_poly1305_ctx *ctx, uint8_t mac[16]);

+303

+304

+305

// Elligator 2

+306

// -----------

+307

+308

// Elligator mappings proper

+309

void crypto_elligator_map(uint8_t curve [32], const uint8_t hidden[32]);

+310

int crypto_elligator_rev(uint8_t hidden[32], const uint8_t curve [32],

+311

uint8_t tweak);

+312

+313

// Easy to use key pair generation

+314

void crypto_elligator_key_pair(uint8_t hidden[32], uint8_t secret_key[32],

+315

uint8_t seed[32]);

+316

+317

#ifdef __cplusplus

+318

}

+319

#endif

+320

+321

#endif // MONOCYPHER_H

vendor/monocypher/src/optional/monocypher-ed25519.cadded

@@ -0,0 +1,503 @@

// Monocypher version 4.0.3

//

// This file is dual-licensed. Choose whichever licence you want from

// the two licences listed below.

//

// The first licence is a regular 2-clause BSD licence. The second licence

// is the CC-0 from Creative Commons. It is intended to release Monocypher

// to the public domain. The BSD licence serves as a fallback option.

//

+10

// SPDX-License-Identifier: BSD-2-Clause OR CC0-1.0

+11

//

+12

// ------------------------------------------------------------------------

+13

//

+14

+15

+16

//

+17

//

+18

// Redistribution and use in source and binary forms, with or without

+19

// modification, are permitted provided that the following conditions are

+20

// met:

+21

//

+22

// 1. Redistributions of source code must retain the above copyright

+23

// notice, this list of conditions and the following disclaimer.

+24

//

+25

// 2. Redistributions in binary form must reproduce the above copyright

+26

// notice, this list of conditions and the following disclaimer in the

+27

// documentation and/or other materials provided with the

+28

// distribution.

+29

//

+30

// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS

+31

// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT

+32

// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR

+33

// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT

+34

// HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

+35

// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT

+36

// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

+37

// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

+38

// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

+39

// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

+40

// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+41

//

+42

// ------------------------------------------------------------------------

+43

//

+44

// Written in 2017-2019 by Loup Vaillant

+45

//

+46

// To the extent possible under law, the author(s) have dedicated all copyright

+47

// and related neighboring rights to this software to the public domain

+48

// worldwide. This software is distributed without any warranty.

+49

//

+50

// You should have received a copy of the CC0 Public Domain Dedication along

+51

// with this software. If not, see

+52

// <https://creativecommons.org/publicdomain/zero/1.0/>

+53

+54

#include "monocypher-ed25519.h"

+55

+56

#ifdef MONOCYPHER_CPP_NAMESPACE

+57

namespace MONOCYPHER_CPP_NAMESPACE {

+58

#endif

+59

+60

/////////////////

+61

/// Utilities ///

+62

/////////////////

+63

#define FOR(i, min, max) for (size_t i = min; i < max; i++)

+64

#define COPY(dst, src, size) FOR(_i_, 0, size) (dst)[_i_] = (src)[_i_]

+65

#define ZERO(buf, size) FOR(_i_, 0, size) (buf)[_i_] = 0

+66

#define WIPE_CTX(ctx) crypto_wipe(ctx , sizeof(*(ctx)))

+67

#define WIPE_BUFFER(buffer) crypto_wipe(buffer, sizeof(buffer))

+68

#define MIN(a, b) ((a) <= (b) ? (a) : (b))

+69

typedef uint8_t u8;

+70

typedef uint64_t u64;

+71

+72

// Returns the smallest positive integer y such that

+73

// (x + y) % pow_2 == 0

+74

// Basically, it's how many bytes we need to add to "align" x.

+75

// Only works when pow_2 is a power of 2.

+76

// Note: we use ~x+1 instead of -x to avoid compiler warnings

+77

static size_t align(size_t x, size_t pow_2)

+78

{

+79

return (~x + 1) & (pow_2 - 1);

+80

}

+81

+82

static u64 load64_be(const u8 s[8])

+83

{

+84

return((u64)s[0] << 56)

+85

| ((u64)s[1] << 48)

+86

| ((u64)s[2] << 40)

+87

| ((u64)s[3] << 32)

+88

| ((u64)s[4] << 24)

+89

| ((u64)s[5] << 16)

+90

| ((u64)s[6] << 8)

+91

| (u64)s[7];

+92

}

+93

+94

static void store64_be(u8 out[8], u64 in)

+95

{

+96

out[0] = (u8)(in >> 56);

+97

out[1] = (u8)(in >> 48);

+98

out[2] = (u8)(in >> 40);

+99

out[3] = (u8)(in >> 32);

+100

out[4] = (u8)(in >> 24);

+101

out[5] = (u8)(in >> 16);

+102

out[6] = (u8)(in >> 8);

+103

out[7] = (u8) in ;

+104

}

+105

+106

static void load64_be_buf (u64 *dst, const u8 *src, size_t size) {

+107

FOR(i, 0, size) { dst[i] = load64_be(src + i*8); }

+108

}

+109

+110

///////////////

+111

/// SHA 512 ///

+112

///////////////

+113

static u64 rot(u64 x, int c ) { return (x >> c) | (x << (64 - c)); }

+114

static u64 ch (u64 x, u64 y, u64 z) { return (x & y) ^ (~x & z); }

+115

static u64 maj(u64 x, u64 y, u64 z) { return (x & y) ^ ( x & z) ^ (y & z); }

+116

static u64 big_sigma0(u64 x) { return rot(x, 28) ^ rot(x, 34) ^ rot(x, 39); }

+117

static u64 big_sigma1(u64 x) { return rot(x, 14) ^ rot(x, 18) ^ rot(x, 41); }

+118

static u64 lit_sigma0(u64 x) { return rot(x, 1) ^ rot(x, 8) ^ (x >> 7); }

+119

static u64 lit_sigma1(u64 x) { return rot(x, 19) ^ rot(x, 61) ^ (x >> 6); }

+120

+121

static const u64 K[80] = {

+122

0x428a2f98d728ae22,0x7137449123ef65cd,0xb5c0fbcfec4d3b2f,0xe9b5dba58189dbbc,

+123

0x3956c25bf348b538,0x59f111f1b605d019,0x923f82a4af194f9b,0xab1c5ed5da6d8118,

+124

0xd807aa98a3030242,0x12835b0145706fbe,0x243185be4ee4b28c,0x550c7dc3d5ffb4e2,

+125

0x72be5d74f27b896f,0x80deb1fe3b1696b1,0x9bdc06a725c71235,0xc19bf174cf692694,

+126

0xe49b69c19ef14ad2,0xefbe4786384f25e3,0x0fc19dc68b8cd5b5,0x240ca1cc77ac9c65,

+127

0x2de92c6f592b0275,0x4a7484aa6ea6e483,0x5cb0a9dcbd41fbd4,0x76f988da831153b5,

+128

0x983e5152ee66dfab,0xa831c66d2db43210,0xb00327c898fb213f,0xbf597fc7beef0ee4,

+129

0xc6e00bf33da88fc2,0xd5a79147930aa725,0x06ca6351e003826f,0x142929670a0e6e70,

+130

0x27b70a8546d22ffc,0x2e1b21385c26c926,0x4d2c6dfc5ac42aed,0x53380d139d95b3df,

+131

0x650a73548baf63de,0x766a0abb3c77b2a8,0x81c2c92e47edaee6,0x92722c851482353b,

+132

0xa2bfe8a14cf10364,0xa81a664bbc423001,0xc24b8b70d0f89791,0xc76c51a30654be30,

+133

0xd192e819d6ef5218,0xd69906245565a910,0xf40e35855771202a,0x106aa07032bbd1b8,

+134

0x19a4c116b8d2d0c8,0x1e376c085141ab53,0x2748774cdf8eeb99,0x34b0bcb5e19b48a8,

+135

0x391c0cb3c5c95a63,0x4ed8aa4ae3418acb,0x5b9cca4f7763e373,0x682e6ff3d6b2b8a3,

+136

0x748f82ee5defb2fc,0x78a5636f43172f60,0x84c87814a1f0ab72,0x8cc702081a6439ec,

+137

0x90befffa23631e28,0xa4506cebde82bde9,0xbef9a3f7b2c67915,0xc67178f2e372532b,

+138

0xca273eceea26619c,0xd186b8c721c0c207,0xeada7dd6cde0eb1e,0xf57d4f7fee6ed178,

+139

0x06f067aa72176fba,0x0a637dc5a2c898a6,0x113f9804bef90dae,0x1b710b35131c471b,

+140

0x28db77f523047d84,0x32caab7b40c72493,0x3c9ebe0a15c9bebc,0x431d67c49c100d4c,

+141

0x4cc5d4becb3e42b6,0x597f299cfc657e2a,0x5fcb6fab3ad6faec,0x6c44198c4a475817

+142

};

+143

+144

static void sha512_compress(crypto_sha512_ctx *ctx)

+145

{

+146

u64 a = ctx->hash[0]; u64 b = ctx->hash[1];

+147

u64 c = ctx->hash[2]; u64 d = ctx->hash[3];

+148

u64 e = ctx->hash[4]; u64 f = ctx->hash[5];

+149

u64 g = ctx->hash[6]; u64 h = ctx->hash[7];

+150

+151

FOR (j, 0, 16) {

+152

u64 in = K[j] + ctx->input[j];

+153

u64 t1 = big_sigma1(e) + ch (e, f, g) + h + in;

+154

u64 t2 = big_sigma0(a) + maj(a, b, c);

+155

h = g; g = f; f = e; e = d + t1;

+156

d = c; c = b; b = a; a = t1 + t2;

+157

}

+158

size_t i16 = 0;

+159

FOR(i, 1, 5) {

+160

i16 += 16;

+161

FOR (j, 0, 16) {

+162

ctx->input[j] += lit_sigma1(ctx->input[(j- 2) & 15]);

+163

ctx->input[j] += lit_sigma0(ctx->input[(j-15) & 15]);

+164

ctx->input[j] += ctx->input[(j- 7) & 15];

+165

u64 in = K[i16 + j] + ctx->input[j];

+166

u64 t1 = big_sigma1(e) + ch (e, f, g) + h + in;

+167

u64 t2 = big_sigma0(a) + maj(a, b, c);

+168

h = g; g = f; f = e; e = d + t1;

+169

d = c; c = b; b = a; a = t1 + t2;

+170

}

+171

}

+172

+173

ctx->hash[0] += a; ctx->hash[1] += b;

+174

ctx->hash[2] += c; ctx->hash[3] += d;

+175

ctx->hash[4] += e; ctx->hash[5] += f;

+176

ctx->hash[6] += g; ctx->hash[7] += h;

+177

}

+178

+179

// Write 1 input byte

+180

static void sha512_set_input(crypto_sha512_ctx *ctx, u8 input)

+181

{

+182

size_t word = ctx->input_idx >> 3;

+183

size_t byte = ctx->input_idx & 7;

+184

ctx->input[word] |= (u64)input << (8 * (7 - byte));

+185

}

+186

+187

// Increment a 128-bit "word".

+188

static void sha512_incr(u64 x[2], u64 y)

+189

{

+190

x[1] += y;

+191

if (x[1] < y) {

+192

x[0]++;

+193

}

+194

}

+195

+196

void crypto_sha512_init(crypto_sha512_ctx *ctx)

+197

{

+198

ctx->hash[0] = 0x6a09e667f3bcc908;

+199

ctx->hash[1] = 0xbb67ae8584caa73b;

+200

ctx->hash[2] = 0x3c6ef372fe94f82b;

+201

ctx->hash[3] = 0xa54ff53a5f1d36f1;

+202

ctx->hash[4] = 0x510e527fade682d1;

+203

ctx->hash[5] = 0x9b05688c2b3e6c1f;

+204

ctx->hash[6] = 0x1f83d9abfb41bd6b;

+205

ctx->hash[7] = 0x5be0cd19137e2179;

+206

ctx->input_size[0] = 0;

+207

ctx->input_size[1] = 0;

+208

ctx->input_idx = 0;

+209

ZERO(ctx->input, 16);

+210

}

+211

+212

void crypto_sha512_update(crypto_sha512_ctx *ctx,

+213

const u8 *message, size_t message_size)

+214

{

+215

// Avoid undefined NULL pointer increments with empty messages

+216

if (message_size == 0) {

+217

return;

+218

}

+219

+220

// Align ourselves with word boundaries

+221

if ((ctx->input_idx & 7) != 0) {

+222

size_t nb_bytes = MIN(align(ctx->input_idx, 8), message_size);

+223

FOR (i, 0, nb_bytes) {

+224

sha512_set_input(ctx, message[i]);

+225

ctx->input_idx++;

+226

}

+227

message += nb_bytes;

+228

message_size -= nb_bytes;

+229

}

+230

+231

// Align ourselves with block boundaries

+232

if ((ctx->input_idx & 127) != 0) {

+233

size_t nb_words = MIN(align(ctx->input_idx, 128), message_size) >> 3;

+234

load64_be_buf(ctx->input + (ctx->input_idx >> 3), message, nb_words);

+235

ctx->input_idx += nb_words << 3;

+236

message += nb_words << 3;

+237

message_size -= nb_words << 3;

+238

}

+239

+240

// Compress block if needed

+241

if (ctx->input_idx == 128) {

+242

sha512_incr(ctx->input_size, 1024); // size is in bits

+243

sha512_compress(ctx);

+244

ctx->input_idx = 0;

+245

ZERO(ctx->input, 16);

+246

}

+247

+248

// Process the message block by block

+249

FOR (i, 0, message_size >> 7) { // number of blocks

+250

load64_be_buf(ctx->input, message, 16);

+251

sha512_incr(ctx->input_size, 1024); // size is in bits

+252

sha512_compress(ctx);

+253

ctx->input_idx = 0;

+254

ZERO(ctx->input, 16);

+255

message += 128;

+256

}

+257

message_size &= 127;

+258

+259

if (message_size != 0) {

+260

// Remaining words

+261

size_t nb_words = message_size >> 3;

+262

load64_be_buf(ctx->input, message, nb_words);

+263

ctx->input_idx += nb_words << 3;

+264

message += nb_words << 3;

+265

message_size -= nb_words << 3;

+266

+267

// Remaining bytes

+268

FOR (i, 0, message_size) {

+269

sha512_set_input(ctx, message[i]);

+270

ctx->input_idx++;

+271

}

+272

}

+273

}

+274

+275

void crypto_sha512_final(crypto_sha512_ctx *ctx, u8 hash[64])

+276

{

+277

// Add padding bit

+278

if (ctx->input_idx == 0) {

+279

ZERO(ctx->input, 16);

+280

}

+281

sha512_set_input(ctx, 128);

+282

+283

// Update size

+284

sha512_incr(ctx->input_size, ctx->input_idx * 8);

+285

+286

// Compress penultimate block (if any)

+287

if (ctx->input_idx > 111) {

+288

sha512_compress(ctx);

+289

ZERO(ctx->input, 14);

+290

}

+291

// Compress last block

+292

ctx->input[14] = ctx->input_size[0];

+293

ctx->input[15] = ctx->input_size[1];

+294

sha512_compress(ctx);

+295

+296

// Copy hash to output (big endian)

+297

FOR (i, 0, 8) {

+298

store64_be(hash + i*8, ctx->hash[i]);

+299

}

+300

+301

WIPE_CTX(ctx);

+302

}

+303

+304

void crypto_sha512(u8 hash[64], const u8 *message, size_t message_size)

+305

{

+306

crypto_sha512_ctx ctx;

+307

crypto_sha512_init (&ctx);

+308

crypto_sha512_update(&ctx, message, message_size);

+309

crypto_sha512_final (&ctx, hash);

+310

}

+311

+312

////////////////////

+313

/// HMAC SHA 512 ///

+314

////////////////////

+315

void crypto_sha512_hmac_init(crypto_sha512_hmac_ctx *ctx,

+316

const u8 *key, size_t key_size)

+317

{

+318

// hash key if it is too long

+319

if (key_size > 128) {

+320

crypto_sha512(ctx->key, key, key_size);

+321

key = ctx->key;

+322

key_size = 64;

+323

}

+324

// Compute inner key: padded key XOR 0x36

+325

FOR (i, 0, key_size) { ctx->key[i] = key[i] ^ 0x36; }

+326

FOR (i, key_size, 128) { ctx->key[i] = 0x36; }

+327

// Start computing inner hash

+328

crypto_sha512_init (&ctx->ctx);

+329

crypto_sha512_update(&ctx->ctx, ctx->key, 128);

+330

}

+331

+332

void crypto_sha512_hmac_update(crypto_sha512_hmac_ctx *ctx,

+333

const u8 *message, size_t message_size)

+334

{

+335

crypto_sha512_update(&ctx->ctx, message, message_size);

+336

}

+337

+338

void crypto_sha512_hmac_final(crypto_sha512_hmac_ctx *ctx, u8 hmac[64])

+339

{

+340

// Finish computing inner hash

+341

crypto_sha512_final(&ctx->ctx, hmac);

+342

// Compute outer key: padded key XOR 0x5c

+343

FOR (i, 0, 128) {

+344

ctx->key[i] ^= 0x36 ^ 0x5c;

+345

}

+346

// Compute outer hash

+347

crypto_sha512_init (&ctx->ctx);

+348

crypto_sha512_update(&ctx->ctx, ctx->key , 128);

+349

crypto_sha512_update(&ctx->ctx, hmac, 64);

+350

crypto_sha512_final (&ctx->ctx, hmac); // outer hash

+351

WIPE_CTX(ctx);

+352

}

+353

+354

void crypto_sha512_hmac(u8 hmac[64], const u8 *key, size_t key_size,

+355

const u8 *message, size_t message_size)

+356

{

+357

crypto_sha512_hmac_ctx ctx;

+358

crypto_sha512_hmac_init (&ctx, key, key_size);

+359

crypto_sha512_hmac_update(&ctx, message, message_size);

+360

crypto_sha512_hmac_final (&ctx, hmac);

+361

}

+362

+363

////////////////////

+364

/// HKDF SHA 512 ///

+365

////////////////////

+366

void crypto_sha512_hkdf_expand(u8 *okm, size_t okm_size,

+367

const u8 *prk, size_t prk_size,

+368

const u8 *info, size_t info_size)

+369

{

+370

int not_first = 0;

+371

u8 ctr = 1;

+372

u8 blk[64];

+373

+374

while (okm_size > 0) {

+375

size_t out_size = MIN(okm_size, sizeof(blk));

+376

+377

crypto_sha512_hmac_ctx ctx;

+378

crypto_sha512_hmac_init(&ctx, prk , prk_size);

+379

if (not_first) {

+380

// For some reason HKDF uses some kind of CBC mode.

+381

// For some reason CTR mode alone wasn't enough.

+382

// Like what, they didn't trust HMAC in 2010? Really??

+383

crypto_sha512_hmac_update(&ctx, blk , sizeof(blk));

+384

}

+385

crypto_sha512_hmac_update(&ctx, info, info_size);

+386

crypto_sha512_hmac_update(&ctx, &ctr, 1);

+387

crypto_sha512_hmac_final(&ctx, blk);

+388

+389

COPY(okm, blk, out_size);

+390

+391

not_first = 1;

+392

okm += out_size;

+393

okm_size -= out_size;

+394

ctr++;

+395

}

+396

WIPE_BUFFER(blk);

+397

}

+398

+399

void crypto_sha512_hkdf(u8 *okm , size_t okm_size,

+400

const u8 *ikm , size_t ikm_size,

+401

const u8 *salt, size_t salt_size,

+402

const u8 *info, size_t info_size)

+403

{

+404

// Extract

+405

u8 prk[64];

+406

crypto_sha512_hmac(prk, salt, salt_size, ikm, ikm_size);

+407

+408

// Expand

+409

crypto_sha512_hkdf_expand(okm, okm_size, prk, sizeof(prk), info, info_size);

+410

+411

WIPE_BUFFER(prk);

+412

}

+413

+414

///////////////

+415

/// Ed25519 ///

+416

///////////////

+417

void crypto_ed25519_key_pair(u8 secret_key[64], u8 public_key[32], u8 seed[32])

+418

{

+419

u8 a[64];

+420

COPY(a, seed, 32); // a[ 0..31] = seed

+421

crypto_wipe(seed, 32);

+422

COPY(secret_key, a, 32); // secret key = seed

+423

crypto_sha512(a, a, 32); // a[ 0..31] = scalar

+424

crypto_eddsa_trim_scalar(a, a); // a[ 0..31] = trimmed scalar

+425

crypto_eddsa_scalarbase(public_key, a); // public key = [trimmed scalar]B

+426

COPY(secret_key + 32, public_key, 32); // secret key includes public half

+427

WIPE_BUFFER(a);

+428

}

+429

+430

static void hash_reduce(u8 h[32],

+431

const u8 *a, size_t a_size,

+432

const u8 *b, size_t b_size,

+433

const u8 *c, size_t c_size,

+434

const u8 *d, size_t d_size)

+435

{

+436

u8 hash[64];

+437

crypto_sha512_ctx ctx;

+438

crypto_sha512_init (&ctx);

+439

crypto_sha512_update(&ctx, a, a_size);

+440

crypto_sha512_update(&ctx, b, b_size);

+441

crypto_sha512_update(&ctx, c, c_size);

+442

crypto_sha512_update(&ctx, d, d_size);

+443

crypto_sha512_final (&ctx, hash);

+444

crypto_eddsa_reduce(h, hash);

+445

}

+446

+447

static void ed25519_dom_sign(u8 signature[64], const u8 secret_key[64],

+448

const u8 *dom, size_t dom_size,

+449

const u8 *message, size_t message_size)

+450

{

+451

u8 a[64]; // secret scalar and prefix

+452

u8 r[32]; // secret deterministic "random" nonce

+453

u8 h[32]; // publically verifiable hash of the message (not wiped)

+454

u8 R[32]; // first half of the signature (allows overlapping inputs)

+455

const u8 *pk = secret_key + 32;

+456

+457

crypto_sha512(a, secret_key, 32);

+458

crypto_eddsa_trim_scalar(a, a);

+459

hash_reduce(r, dom, dom_size, a + 32, 32, message, message_size, 0, 0);

+460

crypto_eddsa_scalarbase(R, r);

+461

hash_reduce(h, dom, dom_size, R, 32, pk, 32, message, message_size);

+462

COPY(signature, R, 32);

+463

crypto_eddsa_mul_add(signature + 32, h, a, r);

+464

+465

WIPE_BUFFER(a);

+466

WIPE_BUFFER(r);

+467

}

+468

+469

void crypto_ed25519_sign(u8 signature [64], const u8 secret_key[64],

+470

const u8 *message, size_t message_size)

+471

{

+472

ed25519_dom_sign(signature, secret_key, 0, 0, message, message_size);

+473

}

+474

+475

int crypto_ed25519_check(const u8 signature[64], const u8 public_key[32],

+476

const u8 *msg, size_t msg_size)

+477

{

+478

u8 h_ram[32];

+479

hash_reduce(h_ram, signature, 32, public_key, 32, msg, msg_size, 0, 0);

+480

return crypto_eddsa_check_equation(signature, public_key, h_ram);

+481

}

+482

+483

static const u8 domain[34] = "SigEd25519 no Ed25519 collisions\1";

+484

+485

void crypto_ed25519_ph_sign(uint8_t signature[64], const uint8_t secret_key[64],

+486

const uint8_t message_hash[64])

+487

{

+488

ed25519_dom_sign(signature, secret_key, domain, sizeof(domain),

+489

message_hash, 64);

+490

}

+491

+492

int crypto_ed25519_ph_check(const uint8_t sig[64], const uint8_t pk[32],

+493

const uint8_t msg_hash[64])

+494

{

+495

u8 h_ram[32];

+496

hash_reduce(h_ram, domain, sizeof(domain), sig, 32, pk, 32, msg_hash, 64);

+497

return crypto_eddsa_check_equation(sig, pk, h_ram);

+498

}

+499

Showing the first 500 of 504 diff lines for this file. This diff is INCOMPLETE; read the file or clone the repository for the rest.

vendor/monocypher/src/optional/monocypher-ed25519.hadded

@@ -0,0 +1,140 @@

// Monocypher version 4.0.3

//

// This file is dual-licensed. Choose whichever licence you want from

// the two licences listed below.

//

// The first licence is a regular 2-clause BSD licence. The second licence

// is the CC-0 from Creative Commons. It is intended to release Monocypher

// to the public domain. The BSD licence serves as a fallback option.

//

+10

// SPDX-License-Identifier: BSD-2-Clause OR CC0-1.0

+11

//

+12

// ------------------------------------------------------------------------

+13

//

+14

+15

+16

//

+17

//

+18

// Redistribution and use in source and binary forms, with or without

+19

// modification, are permitted provided that the following conditions are

+20

// met:

+21

//

+22

// 1. Redistributions of source code must retain the above copyright

+23

// notice, this list of conditions and the following disclaimer.

+24

//

+25

// 2. Redistributions in binary form must reproduce the above copyright

+26

// notice, this list of conditions and the following disclaimer in the

+27

// documentation and/or other materials provided with the

+28

// distribution.

+29

//

+30

// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS

+31

// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT

+32

// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR

+33

// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT

+34

// HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

+35

// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT

+36

// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

+37

// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

+38

// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

+39

// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

+40

// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+41

//

+42

// ------------------------------------------------------------------------

+43

//

+44

// Written in 2017-2019 by Loup Vaillant

+45

//

+46

// To the extent possible under law, the author(s) have dedicated all copyright

+47

// and related neighboring rights to this software to the public domain

+48

// worldwide. This software is distributed without any warranty.

+49

//

+50

// You should have received a copy of the CC0 Public Domain Dedication along

+51

// with this software. If not, see

+52

// <https://creativecommons.org/publicdomain/zero/1.0/>

+53

+54

#ifndef ED25519_H

+55

#define ED25519_H

+56

+57

#include "monocypher.h"

+58

+59

#ifdef MONOCYPHER_CPP_NAMESPACE

+60

namespace MONOCYPHER_CPP_NAMESPACE {

+61

#elif defined(__cplusplus)

+62

extern "C" {

+63

#endif

+64

+65

////////////////////////

+66

/// Type definitions ///

+67

////////////////////////

+68

+69

// Do not rely on the size or content on any of those types,

+70

// they may change without notice.

+71

typedef struct {

+72

uint64_t hash[8];

+73

uint64_t input[16];

+74

uint64_t input_size[2];

+75

size_t input_idx;

+76

} crypto_sha512_ctx;

+77

+78

typedef struct {

+79

uint8_t key[128];

+80

crypto_sha512_ctx ctx;

+81

} crypto_sha512_hmac_ctx;

+82

+83

+84

// SHA 512

+85

// -------

+86

void crypto_sha512_init (crypto_sha512_ctx *ctx);

+87

void crypto_sha512_update(crypto_sha512_ctx *ctx,

+88

const uint8_t *message, size_t message_size);

+89

void crypto_sha512_final (crypto_sha512_ctx *ctx, uint8_t hash[64]);

+90

void crypto_sha512(uint8_t hash[64],

+91

const uint8_t *message, size_t message_size);

+92

+93

// SHA 512 HMAC

+94

// ------------

+95

void crypto_sha512_hmac_init(crypto_sha512_hmac_ctx *ctx,

+96

const uint8_t *key, size_t key_size);

+97

void crypto_sha512_hmac_update(crypto_sha512_hmac_ctx *ctx,

+98

const uint8_t *message, size_t message_size);

+99

void crypto_sha512_hmac_final(crypto_sha512_hmac_ctx *ctx, uint8_t hmac[64]);

+100

void crypto_sha512_hmac(uint8_t hmac[64],

+101

const uint8_t *key , size_t key_size,

+102

const uint8_t *message, size_t message_size);

+103

+104

// SHA 512 HKDF

+105

// ------------

+106

void crypto_sha512_hkdf_expand(uint8_t *okm, size_t okm_size,

+107

const uint8_t *prk, size_t prk_size,

+108

const uint8_t *info, size_t info_size);

+109

void crypto_sha512_hkdf(uint8_t *okm , size_t okm_size,

+110

const uint8_t *ikm , size_t ikm_size,

+111

const uint8_t *salt, size_t salt_size,

+112

const uint8_t *info, size_t info_size);

+113

+114

// Ed25519

+115

// -------

+116

// Signatures (EdDSA with curve25519 + SHA-512)

+117

// --------------------------------------------

+118

void crypto_ed25519_key_pair(uint8_t secret_key[64],

+119

uint8_t public_key[32],

+120

uint8_t seed[32]);

+121

void crypto_ed25519_sign(uint8_t signature [64],

+122

const uint8_t secret_key[64],

+123

const uint8_t *message, size_t message_size);

+124

int crypto_ed25519_check(const uint8_t signature [64],

+125

const uint8_t public_key[32],

+126

const uint8_t *message, size_t message_size);

+127

+128

// Pre-hash variants

+129

void crypto_ed25519_ph_sign(uint8_t signature [64],

+130

const uint8_t secret_key [64],

+131

const uint8_t message_hash[64]);

+132

int crypto_ed25519_ph_check(const uint8_t signature [64],

+133

const uint8_t public_key [32],

+134

const uint8_t message_hash[64]);

+135

+136

#ifdef __cplusplus

+137

}

+138

#endif

+139

+140

#endif // ED25519_H