rbnacl-libsodium 0.4.5 → 0.5.0

data/vendor/libsodium/src/libsodium/crypto_pwhash/scryptxsalsa208sha256/sysendian.h

@@ -0,0 +1,146 @@
+#ifndef _SYSENDIAN_H_
+#define _SYSENDIAN_H_
+
+#include <stdint.h>
+
+/* Avoid namespace collisions with BSD <sys/endian.h>. */
+#define be16dec scrypt_be16dec
+#define be16enc scrypt_be16enc
+#define be32dec scrypt_be32dec
+#define be32enc scrypt_be32enc
+#define be64dec scrypt_be64dec
+#define be64enc scrypt_be64enc
+#define le16dec scrypt_le16dec
+#define le16enc scrypt_le16enc
+#define le32dec scrypt_le32dec
+#define le32enc scrypt_le32enc
+#define le64dec scrypt_le64dec
+#define le64enc scrypt_le64enc
+
+static inline uint16_t
+be16dec(const void *pp)
+{
+	const uint8_t *p = (uint8_t const *)pp;
+
+	return ((uint16_t)(p[1]) + ((uint16_t)(p[0]) << 8));
+}
+
+static inline void
+be16enc(void *pp, uint16_t x)
+{
+	uint8_t * p = (uint8_t *)pp;
+
+	p[1] = x & 0xff;
+	p[0] = (x >> 8) & 0xff;
+}
+
+static inline uint32_t
+be32dec(const void *pp)
+{
+	const uint8_t *p = (uint8_t const *)pp;
+
+	return ((uint32_t)(p[3]) + ((uint32_t)(p[2]) << 8) +
+	    ((uint32_t)(p[1]) << 16) + ((uint32_t)(p[0]) << 24));
+}
+
+static inline void
+be32enc(void *pp, uint32_t x)
+{
+	uint8_t * p = (uint8_t *)pp;
+
+	p[3] = x & 0xff;
+	p[2] = (x >> 8) & 0xff;
+	p[1] = (x >> 16) & 0xff;
+	p[0] = (x >> 24) & 0xff;
+}
+
+static inline uint64_t
+be64dec(const void *pp)
+{
+	const uint8_t *p = (uint8_t const *)pp;
+
+	return ((uint64_t)(p[7]) + ((uint64_t)(p[6]) << 8) +
+	    ((uint64_t)(p[5]) << 16) + ((uint64_t)(p[4]) << 24) +
+	    ((uint64_t)(p[3]) << 32) + ((uint64_t)(p[2]) << 40) +
+	    ((uint64_t)(p[1]) << 48) + ((uint64_t)(p[0]) << 56));
+}
+
+static inline void
+be64enc(void *pp, uint64_t x)
+{
+	uint8_t * p = (uint8_t *)pp;
+
+	p[7] = x & 0xff;
+	p[6] = (x >> 8) & 0xff;
+	p[5] = (x >> 16) & 0xff;
+	p[4] = (x >> 24) & 0xff;
+	p[3] = (x >> 32) & 0xff;
+	p[2] = (x >> 40) & 0xff;
+	p[1] = (x >> 48) & 0xff;
+	p[0] = (x >> 56) & 0xff;
+}
+
+static inline uint16_t
+le16dec(const void *pp)
+{
+	const uint8_t *p = (uint8_t const *)pp;
+
+	return ((uint16_t)(p[0]) + ((uint16_t)(p[1]) << 8));
+}
+
+static inline void
+le16enc(void *pp, uint16_t x)
+{
+	uint8_t * p = (uint8_t *)pp;
+
+	p[0] = x & 0xff;
+	p[1] = (x >> 8) & 0xff;
+}
+
+static inline uint32_t
+le32dec(const void *pp)
+{
+	const uint8_t *p = (uint8_t const *)pp;
+
+	return ((uint32_t)(p[0]) + ((uint32_t)(p[1]) << 8) +
+	    ((uint32_t)(p[2]) << 16) + ((uint32_t)(p[3]) << 24));
+}
+
+static inline void
+le32enc(void *pp, uint32_t x)
+{
+	uint8_t * p = (uint8_t *)pp;
+
+	p[0] = x & 0xff;
+	p[1] = (x >> 8) & 0xff;
+	p[2] = (x >> 16) & 0xff;
+	p[3] = (x >> 24) & 0xff;
+}
+
+static inline uint64_t
+le64dec(const void *pp)
+{
+	const uint8_t *p = (uint8_t const *)pp;
+
+	return ((uint64_t)(p[0]) + ((uint64_t)(p[1]) << 8) +
+	    ((uint64_t)(p[2]) << 16) + ((uint64_t)(p[3]) << 24) +
+	    ((uint64_t)(p[4]) << 32) + ((uint64_t)(p[5]) << 40) +
+	    ((uint64_t)(p[6]) << 48) + ((uint64_t)(p[7]) << 56));
+}
+
+static inline void
+le64enc(void *pp, uint64_t x)
+{
+	uint8_t * p = (uint8_t *)pp;
+
+	p[0] = x & 0xff;
+	p[1] = (x >> 8) & 0xff;
+	p[2] = (x >> 16) & 0xff;
+	p[3] = (x >> 24) & 0xff;
+	p[4] = (x >> 32) & 0xff;
+	p[5] = (x >> 40) & 0xff;
+	p[6] = (x >> 48) & 0xff;
+	p[7] = (x >> 56) & 0xff;
+}
+
+#endif /* !_SYSENDIAN_H_ */

data/vendor/libsodium/src/libsodium/crypto_scalarmult/curve25519/donna_c64/api.h

@@ -4,6 +4,6 @@
 #define crypto_scalarmult_curve25519_implementation_name \
     crypto_scalarmult_curve25519_donna_c64_implementation_name
 
-#define crypto_scalarmult crypto_scalarmult_curve25519_donna_c64
-#define crypto_scalarmult_base crypto_scalarmult_curve25519_donna_c64_base
+#define crypto_scalarmult crypto_scalarmult_curve25519
+#define crypto_scalarmult_base crypto_scalarmult_curve25519_base
 

data/vendor/libsodium/src/libsodium/crypto_scalarmult/curve25519/donna_c64/smult_curve25519_donna_c64.c

@@ -189,14 +189,44 @@ fsquare_times(felem output, const felem in, limb count) {
   output[4] = r4;
 }
 
+#if !defined(CPU_ALIGNED_ACCESS_REQUIRED) && defined(NATIVE_LITTLE_ENDIAN)
+# define U8TO64(p)    (*((const uint64_t *) (p)))
+# define U64TO8(p, v) (*((uint64_t *) (p)) = (v))
+#else
+static force_inline uint64_t
+U8TO64(const unsigned char *p) {
+    return
+        (((uint64_t)(p[0] & 0xff)      ) |
+         ((uint64_t)(p[1] & 0xff) <<  8) |
+         ((uint64_t)(p[2] & 0xff) << 16) |
+         ((uint64_t)(p[3] & 0xff) << 24) |
+         ((uint64_t)(p[4] & 0xff) << 32) |
+         ((uint64_t)(p[5] & 0xff) << 40) |
+         ((uint64_t)(p[6] & 0xff) << 48) |
+         ((uint64_t)(p[7] & 0xff) << 56));
+}
+
+static force_inline void
+U64TO8(unsigned char *p, uint64_t v) {
+    p[0] = (v      ) & 0xff;
+    p[1] = (v >>  8) & 0xff;
+    p[2] = (v >> 16) & 0xff;
+    p[3] = (v >> 24) & 0xff;
+    p[4] = (v >> 32) & 0xff;
+    p[5] = (v >> 40) & 0xff;
+    p[6] = (v >> 48) & 0xff;
+    p[7] = (v >> 56) & 0xff;
+}
+#endif
+
 /* Take a little-endian, 32-byte number and expand it into polynomial form */
 static void
 fexpand(limb *output, const u8 *in) {
-  output[0] = *((const uint64_t *)(in)) & 0x7ffffffffffff;
-  output[1] = (*((const uint64_t *)(in+6)) >> 3) & 0x7ffffffffffff;
-  output[2] = (*((const uint64_t *)(in+12)) >> 6) & 0x7ffffffffffff;
-  output[3] = (*((const uint64_t *)(in+19)) >> 1) & 0x7ffffffffffff;
-  output[4] = (*((const uint64_t *)(in+25)) >> 4) & 0xfffffffffffff;
+  output[0] = U8TO64(in) & 0x7ffffffffffff;
+  output[1] = (U8TO64(in+6) >> 3) & 0x7ffffffffffff;
+  output[2] = (U8TO64(in+12) >> 6) & 0x7ffffffffffff;
+  output[3] = (U8TO64(in+19) >> 1) & 0x7ffffffffffff;
+  output[4] = (U8TO64(in+25) >> 4) & 0xfffffffffffff;
 }
 
 /* Take a fully reduced polynomial form number and contract it into a
@@ -251,10 +281,10 @@ fcontract(u8 *output, const felem input) {
   t[4] += t[3] >> 51; t[3] &= 0x7ffffffffffff;
   t[4] &= 0x7ffffffffffff;
 
-  *((uint64_t *)(output)) = t[0] | (t[1] << 51);
-  *((uint64_t *)(output+8)) = (t[1] >> 13) | (t[2] << 38);
-  *((uint64_t *)(output+16)) = (t[2] >> 26) | (t[3] << 25);
-  *((uint64_t *)(output+24)) = (t[3] >> 39) | (t[4] << 12);
+  U64TO8(output, t[0] | (t[1] << 51));
+  U64TO8(output + 8, (t[1] >> 13) | (t[2] << 38));
+  U64TO8(output + 16, (t[2] >> 26) | (t[3] << 25));
+  U64TO8(output + 24, (t[3] >> 39) | (t[4] << 12));
 }
 
 /* Input: Q, Q', Q-Q'

data/vendor/libsodium/src/libsodium/crypto_scalarmult/curve25519/ref/api.h

@@ -4,5 +4,5 @@
 #define crypto_scalarmult_curve25519_implementation_name \
     crypto_scalarmult_curve25519_ref_implementation_name
 
-#define crypto_scalarmult crypto_scalarmult_curve25519_ref
-#define crypto_scalarmult_base crypto_scalarmult_curve25519_ref_base
+#define crypto_scalarmult crypto_scalarmult_curve25519
+#define crypto_scalarmult_base crypto_scalarmult_curve25519_base

data/vendor/libsodium/src/libsodium/crypto_secretbox/crypto_secretbox.c

@@ -25,6 +25,12 @@ crypto_secretbox_boxzerobytes(void)
     return crypto_secretbox_BOXZEROBYTES;
 }
 
+size_t
+crypto_secretbox_macbytes(void)
+{
+    return crypto_secretbox_MACBYTES;
+}
+
 const char *
 crypto_secretbox_primitive(void)
 {

data/vendor/libsodium/src/libsodium/crypto_secretbox/crypto_secretbox_easy.c

@@ -0,0 +1,94 @@
+
+#include <assert.h>
+#include <limits.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "crypto_secretbox.h"
+#include "utils.h"
+
+int
+crypto_secretbox_easy(unsigned char *c, const unsigned char *m,
+                      unsigned long long mlen, const unsigned char *n,
+                      const unsigned char *k)
+{
+    unsigned char *c_boxed;
+    unsigned char *m_boxed;
+    size_t         c_boxed_len;
+    size_t         m_boxed_len;
+    int            rc;
+
+    if (mlen > SIZE_MAX - crypto_secretbox_ZEROBYTES) {
+        return -1;
+    }
+    (void) sizeof(char[crypto_secretbox_ZEROBYTES >=
+                       crypto_secretbox_BOXZEROBYTES ? 1 : -1]);
+    m_boxed_len = (size_t) mlen + crypto_secretbox_ZEROBYTES;
+    if ((m_boxed = (unsigned char *) malloc((size_t) m_boxed_len)) == NULL) {
+        return -1;
+    }
+    c_boxed_len = (size_t) mlen + crypto_secretbox_ZEROBYTES;
+    if ((c_boxed = (unsigned char *) malloc(c_boxed_len)) == NULL) {
+        free(m_boxed);
+        return -1;
+    }
+    memset(m_boxed, 0, crypto_secretbox_ZEROBYTES);
+    memcpy(m_boxed + crypto_secretbox_ZEROBYTES, m, mlen);
+    rc = crypto_secretbox(c_boxed, m_boxed, m_boxed_len, n, k);
+    sodium_memzero(m_boxed, m_boxed_len);
+    free(m_boxed);
+    if (rc != 0) {
+        free(c_boxed);
+        return -1;
+    }
+    assert(m_boxed_len - crypto_secretbox_BOXZEROBYTES ==
+           mlen + crypto_secretbox_MACBYTES);
+    memcpy(c, c_boxed + crypto_secretbox_BOXZEROBYTES,
+           mlen + crypto_secretbox_MACBYTES);
+    free(c_boxed);
+
+    return 0;
+}
+
+int
+crypto_secretbox_open_easy(unsigned char *m, const unsigned char *c,
+                           unsigned long long clen, const unsigned char *n,
+                           const unsigned char *k)
+{
+    unsigned char *c_boxed;
+    unsigned char *m_boxed;
+    size_t         c_boxed_len;
+    size_t         m_boxed_len;
+    int            rc;
+
+    (void) sizeof(int[crypto_secretbox_BOXZEROBYTES + crypto_secretbox_MACBYTES
+                      == crypto_secretbox_ZEROBYTES]);
+    if (clen < crypto_secretbox_MACBYTES ||
+        clen > SIZE_MAX - crypto_secretbox_BOXZEROBYTES) {
+        return -1;
+    }
+    c_boxed_len = clen + crypto_secretbox_BOXZEROBYTES;
+    if ((c_boxed = (unsigned char *) malloc(c_boxed_len)) == NULL) {
+        return -1;
+    }
+    memset(c_boxed, 0, crypto_secretbox_BOXZEROBYTES);
+    memcpy(c_boxed + crypto_secretbox_BOXZEROBYTES, c, clen);
+    m_boxed_len = c_boxed_len + crypto_secretbox_MACBYTES;
+    if ((m_boxed = (unsigned char *) malloc(m_boxed_len)) == NULL) {
+        free(c_boxed);
+        return -1;
+    }
+    rc = crypto_secretbox_open(m_boxed, c_boxed,
+                               (unsigned long long) c_boxed_len, n, k);
+    free(c_boxed);
+    if (rc != 0) {
+        free(m_boxed);
+        return -1;
+    }
+    memcpy(m, m_boxed + crypto_secretbox_ZEROBYTES,
+           clen - crypto_secretbox_MACBYTES);
+    free(m_boxed);
+
+    return 0;
+}

data/vendor/libsodium/src/libsodium/crypto_secretbox/xsalsa20poly1305/ref/api.h

@@ -7,6 +7,5 @@
 #define crypto_secretbox_NONCEBYTES crypto_secretbox_xsalsa20poly1305_NONCEBYTES
 #define crypto_secretbox_ZEROBYTES crypto_secretbox_xsalsa20poly1305_ZEROBYTES
 #define crypto_secretbox_BOXZEROBYTES crypto_secretbox_xsalsa20poly1305_BOXZEROBYTES
-#define crypto_secretbox_PRIMITIVE "xsalsa20poly1305"
 #define crypto_secretbox_IMPLEMENTATION crypto_secretbox_xsalsa20poly1305_IMPLEMENTATION
 #define crypto_secretbox_VERSION crypto_secretbox_xsalsa20poly1305_VERSION

data/vendor/libsodium/src/libsodium/crypto_secretbox/xsalsa20poly1305/secretbox_xsalsa20poly1305_api.c

@@ -20,7 +20,7 @@ crypto_secretbox_xsalsa20poly1305_boxzerobytes(void) {
     return crypto_secretbox_xsalsa20poly1305_BOXZEROBYTES;
 }
 
-const char *
-crypto_secretbox_xsalsa20poly1305_primitive(void) {
-    return "xsalsa20poly1305";
+size_t
+crypto_secretbox_xsalsa20poly1305_macbytes(void) {
+    return crypto_secretbox_xsalsa20poly1305_MACBYTES;
 }

data/vendor/libsodium/src/libsodium/crypto_shorthash/siphash24/ref/api.h

@@ -3,6 +3,5 @@
 
 #define crypto_shorthash crypto_shorthash_siphash24
 #define crypto_shorthash_BYTES crypto_shorthash_siphash24_BYTES
-#define crypto_shorthash_PRIMITIVE "siphash24"
 #define crypto_shorthash_IMPLEMENTATION crypto_shorthash_siphash24_IMPLEMENTATION
 #define crypto_shorthash_VERSION crypto_shorthash_siphash24_VERSION

data/vendor/libsodium/src/libsodium/crypto_shorthash/siphash24/shorthash_siphash24_api.c

@@ -5,7 +5,7 @@ crypto_shorthash_siphash24_bytes(void) {
     return crypto_shorthash_siphash24_BYTES;
 }
 
-const char *
-crypto_shorthash_siphash24_primitive(void) {
-    return "siphash24";
+size_t
+crypto_shorthash_siphash24_keybytes(void) {
+    return crypto_shorthash_siphash24_KEYBYTES;
 }

data/vendor/libsodium/src/libsodium/crypto_sign/ed25519/ref10/api.h

@@ -9,6 +9,5 @@
 #define crypto_sign_SEEDBYTES crypto_sign_ed25519_SEEDBYTES
 #define crypto_sign_PUBLICKEYBYTES crypto_sign_ed25519_PUBLICKEYBYTES
 #define crypto_sign_SECRETKEYBYTES crypto_sign_ed25519_SECRETKEYBYTES
-#define crypto_sign_PRIMITIVE "ed25519"
 #define crypto_sign_IMPLEMENTATION crypto_sign_ed25519_IMPLEMENTATION
 #define crypto_sign_VERSION crypto_sign_ed25519_VERSION

data/vendor/libsodium/src/libsodium/crypto_sign/ed25519/ref10/ge_scalarmult_base.c

@@ -1,6 +1,12 @@
 #include "ge.h"
 #include "crypto_uint32.h"
 
+#ifdef __cplusplus
+# if __GNUC__
+#  pragma GCC diagnostic ignored "-Wlong-long"
+# endif
+#endif
+
 static unsigned char equal(signed char b,signed char c)
 {
   unsigned char ub = b;

data/vendor/libsodium/src/libsodium/crypto_sign/ed25519/ref10/keypair.c

@@ -1,3 +1,6 @@
+
+#include <string.h>
+
 #include "api.h"
 #include "randombytes.h"
 #include "crypto_hash_sha512.h"
@@ -7,7 +10,6 @@ int crypto_sign_seed_keypair(unsigned char *pk, unsigned char *sk,
                              const unsigned char *seed)
 {
     ge_p3 A;
-    int i;
 
     crypto_hash_sha512(sk,seed,32);
     sk[0] &= 248;
@@ -17,8 +19,8 @@ int crypto_sign_seed_keypair(unsigned char *pk, unsigned char *sk,
     ge_scalarmult_base(&A,sk);
     ge_p3_tobytes(pk,&A);
 
-    for (i = 0;i < 32;++i) sk[i] = seed[i];
-    for (i = 0;i < 32;++i) sk[32 + i] = pk[i];
+    memmove(sk, seed, 32);
+    memmove(sk + 32, pk, 32);
     return 0;
 }
 

data/vendor/libsodium/src/libsodium/crypto_sign/ed25519/ref10/open.c

@@ -1,3 +1,6 @@
+
+#include <string.h>
+
 #include "api.h"
 #include "crypto_hash_sha512.h"
 #include "crypto_verify_32.h"
@@ -10,31 +13,38 @@ int crypto_sign_open(
   const unsigned char *pk
 )
 {
+  crypto_hash_sha512_state hs;
   unsigned char h[64];
-  unsigned char checkr[32];
+  unsigned char rcheck[32];
+  unsigned int  i;
+  unsigned char d = 0;
   ge_p3 A;
   ge_p2 R;
-  unsigned long long i;
 
-  *mlen = -1;
-  if (smlen < 64) return -1;
-  if (sm[63] & 224) return -1;
-  if (ge_frombytes_negate_vartime(&A,pk) != 0) return -1;
+  if (smlen < 64) goto badsig;
+  if (sm[63] & 224) goto badsig;
+  if (ge_frombytes_negate_vartime(&A,pk) != 0) goto badsig;
+
+  for (i = 0; i < 32; ++i) d |= pk[i];
+  if (d == 0) return -1;
 
-  for (i = 0;i < smlen;++i) m[i] = sm[i];
-  for (i = 0;i < 32;++i) m[32 + i] = pk[i];
-  crypto_hash_sha512(h,m,smlen);
+  crypto_hash_sha512_init(&hs);
+  crypto_hash_sha512_update(&hs, sm, 32);
+  crypto_hash_sha512_update(&hs, pk, 32);
+  crypto_hash_sha512_update(&hs, sm + 64, smlen - 64);
+  crypto_hash_sha512_final(&hs, h);
   sc_reduce(h);
 
-  ge_double_scalarmult_vartime(&R,h,&A,sm + 32);
-  ge_tobytes(checkr,&R);
-  if (crypto_verify_32(checkr,sm) != 0) {
-    for (i = 0;i < smlen;++i) m[i] = 0;
-    return -1;
+  ge_double_scalarmult_vartime(&R,h,&A,sm+32);
+  ge_tobytes(rcheck,&R);
+  if (crypto_verify_32(rcheck,sm) == 0) {
+    memmove(m, sm + 64,smlen - 64);
+    *mlen = smlen - 64;
+    return 0;
   }
 
-  for (i = 0;i < smlen - 64;++i) m[i] = sm[64 + i];
-  for (i = smlen - 64;i < smlen;++i) m[i] = 0;
-  *mlen = smlen - 64;
-  return 0;
+badsig:
+  *mlen = 0;
+  memset(m, 0, smlen - 64);
+  return -1;
 }