rbnacl-libsodium 1.0.11 → 1.0.13

data/vendor/libsodium/src/libsodium/crypto_aead/aes256gcm/aesni/aead_aes256gcm_aesni.c

@@ -12,15 +12,19 @@
 
 #include "crypto_aead_aes256gcm.h"
 #include "export.h"
+#include "private/common.h"
+#include "private/sse2_64_32.h"
+#include "randombytes.h"
 #include "runtime.h"
 #include "utils.h"
 
-#if (defined(HAVE_TMMINTRIN_H) && defined(HAVE_WMMINTRIN_H)) || \
-    (defined(_MSC_VER) && _MSC_VER >= 1600 && (defined(_M_X64) || defined(_M_AMD64) || defined(_M_IX86)))
+#if defined(HAVE_TMMINTRIN_H) && defined(HAVE_WMMINTRIN_H)
 
-#pragma GCC target("ssse3")
-#pragma GCC target("aes")
-#pragma GCC target("pclmul")
+# ifdef __GNUC__
+#  pragma GCC target("ssse3")
+#  pragma GCC target("aes")
+#  pragma GCC target("pclmul")
+# endif
 
 #include <tmmintrin.h>
 #include <wmmintrin.h>
@@ -96,12 +100,21 @@ static inline void
 aesni_encrypt1(unsigned char *out, __m128i nv, const __m128i *rkeys)
 {
     __m128i temp = _mm_xor_si128(nv, rkeys[0]);
-    int     roundctr;
 
-#pragma unroll(13)
-    for (roundctr = 1; roundctr < 14; roundctr++) {
-        temp = _mm_aesenc_si128(temp, rkeys[roundctr]);
-    }
+    temp = _mm_aesenc_si128(temp, rkeys[1]);
+    temp = _mm_aesenc_si128(temp, rkeys[2]);
+    temp = _mm_aesenc_si128(temp, rkeys[3]);
+    temp = _mm_aesenc_si128(temp, rkeys[4]);
+    temp = _mm_aesenc_si128(temp, rkeys[5]);
+    temp = _mm_aesenc_si128(temp, rkeys[6]);
+    temp = _mm_aesenc_si128(temp, rkeys[7]);
+    temp = _mm_aesenc_si128(temp, rkeys[8]);
+    temp = _mm_aesenc_si128(temp, rkeys[9]);
+    temp = _mm_aesenc_si128(temp, rkeys[10]);
+    temp = _mm_aesenc_si128(temp, rkeys[11]);
+    temp = _mm_aesenc_si128(temp, rkeys[12]);
+    temp = _mm_aesenc_si128(temp, rkeys[13]);
+
     temp = _mm_aesenclast_si128(temp, rkeys[14]);
     _mm_storeu_si128((__m128i *) out, temp);
 }
@@ -479,7 +492,7 @@ crypto_aead_aes256gcm_beforenm(crypto_aead_aes256gcm_state *ctx_,
     __m128i        zero = _mm_setzero_si128();
     unsigned char *H = ctx->H;
 
-    (void) sizeof(int[(sizeof *ctx_) >= (sizeof *ctx) ? 1 : -1]);
+    COMPILER_ASSERT((sizeof *ctx_) >= (sizeof *ctx));
     aesni_key256_expand(k, rkeys);
     aesni_encrypt1(H, zero, rkeys);
 
@@ -562,7 +575,7 @@ crypto_aead_aes256gcm_encrypt_detached_afternm(unsigned char *c,
         }                                                                                            \
     } while(0)
 
-/* remainder loop, with the slower GCM update to accomodate partial blocks */
+/* remainder loop, with the slower GCM update to accommodate partial blocks */
 #define LOOPRMD128                                           \
     do {                                                     \
         const int iter = 8;                                  \
@@ -1043,3 +1056,9 @@ crypto_aead_aes256gcm_statebytes(void)
 {
     return (sizeof(crypto_aead_aes256gcm_state) + (size_t) 15U) & ~(size_t) 15U;
 }
+
+void
+crypto_aead_aes256gcm_keygen(unsigned char k[crypto_aead_aes256gcm_KEYBYTES])
+{
+    randombytes_buf(k, crypto_aead_aes256gcm_KEYBYTES);
+}

data/vendor/libsodium/src/libsodium/crypto_aead/chacha20poly1305/sodium/aead_chacha20poly1305.c

@@ -8,6 +8,7 @@
 #include "crypto_onetimeauth_poly1305.h"
 #include "crypto_stream_chacha20.h"
 #include "crypto_verify_16.h"
+#include "randombytes.h"
 #include "utils.h"
 
 #include "private/common.h"
@@ -195,7 +196,7 @@ crypto_aead_chacha20poly1305_decrypt_detached(unsigned char *m,
     crypto_onetimeauth_poly1305_final(&state, computed_mac);
     sodium_memzero(&state, sizeof state);
 
-    (void) sizeof(int[sizeof computed_mac == 16U ? 1 : -1]);
+    COMPILER_ASSERT(sizeof computed_mac == 16U);
     ret = crypto_verify_16(computed_mac, mac);
     sodium_memzero(computed_mac, sizeof computed_mac);
     if (m == NULL) {
@@ -279,7 +280,7 @@ crypto_aead_chacha20poly1305_ietf_decrypt_detached(unsigned char *m,
     crypto_onetimeauth_poly1305_final(&state, computed_mac);
     sodium_memzero(&state, sizeof state);
 
-    (void) sizeof(int[sizeof computed_mac == 16U ? 1 : -1]);
+    COMPILER_ASSERT(sizeof computed_mac == 16U);
     ret = crypto_verify_16(computed_mac, mac);
     sodium_memzero(computed_mac, sizeof computed_mac);
     if (m == NULL) {
@@ -325,41 +326,61 @@ crypto_aead_chacha20poly1305_ietf_decrypt(unsigned char *m,
 }
 
 size_t
-crypto_aead_chacha20poly1305_ietf_keybytes(void) {
+crypto_aead_chacha20poly1305_ietf_keybytes(void)
+{
     return crypto_aead_chacha20poly1305_ietf_KEYBYTES;
 }
 
 size_t
-crypto_aead_chacha20poly1305_ietf_npubbytes(void) {
+crypto_aead_chacha20poly1305_ietf_npubbytes(void)
+{
     return crypto_aead_chacha20poly1305_ietf_NPUBBYTES;
 }
 
 size_t
-crypto_aead_chacha20poly1305_ietf_nsecbytes(void) {
+crypto_aead_chacha20poly1305_ietf_nsecbytes(void)
+{
     return crypto_aead_chacha20poly1305_ietf_NSECBYTES;
 }
 
 size_t
-crypto_aead_chacha20poly1305_ietf_abytes(void) {
+crypto_aead_chacha20poly1305_ietf_abytes(void)
+{
     return crypto_aead_chacha20poly1305_ietf_ABYTES;
 }
 
+void
+crypto_aead_chacha20poly1305_ietf_keygen(unsigned char k[crypto_aead_chacha20poly1305_ietf_KEYBYTES])
+{
+    randombytes_buf(k, crypto_aead_chacha20poly1305_ietf_KEYBYTES);
+}
+
 size_t
-crypto_aead_chacha20poly1305_keybytes(void) {
+crypto_aead_chacha20poly1305_keybytes(void)
+{
     return crypto_aead_chacha20poly1305_KEYBYTES;
 }
 
 size_t
-crypto_aead_chacha20poly1305_npubbytes(void) {
+crypto_aead_chacha20poly1305_npubbytes(void)
+{
     return crypto_aead_chacha20poly1305_NPUBBYTES;
 }
 
 size_t
-crypto_aead_chacha20poly1305_nsecbytes(void) {
+crypto_aead_chacha20poly1305_nsecbytes(void)
+{
     return crypto_aead_chacha20poly1305_NSECBYTES;
 }
 
 size_t
-crypto_aead_chacha20poly1305_abytes(void) {
+crypto_aead_chacha20poly1305_abytes(void)
+{
     return crypto_aead_chacha20poly1305_ABYTES;
 }
+
+void
+crypto_aead_chacha20poly1305_keygen(unsigned char k[crypto_aead_chacha20poly1305_KEYBYTES])
+{
+    randombytes_buf(k, crypto_aead_chacha20poly1305_KEYBYTES);
+}

data/vendor/libsodium/src/libsodium/crypto_aead/xchacha20poly1305/sodium/aead_xchacha20poly1305.c

@@ -0,0 +1,153 @@
+
+#include <stdint.h>
+#include <stdlib.h>
+#include <limits.h>
+#include <string.h>
+
+#include "crypto_aead_xchacha20poly1305.h"
+#include "crypto_aead_chacha20poly1305.h"
+#include "crypto_core_hchacha20.h"
+#include "randombytes.h"
+#include "utils.h"
+
+#include "private/common.h"
+
+int
+crypto_aead_xchacha20poly1305_ietf_encrypt_detached(unsigned char *c,
+                                                    unsigned char *mac,
+                                                    unsigned long long *maclen_p,
+                                                    const unsigned char *m,
+                                                    unsigned long long mlen,
+                                                    const unsigned char *ad,
+                                                    unsigned long long adlen,
+                                                    const unsigned char *nsec,
+                                                    const unsigned char *npub,
+                                                    const unsigned char *k)
+{
+    unsigned char k2[crypto_core_hchacha20_OUTPUTBYTES];
+    unsigned char npub2[crypto_aead_chacha20poly1305_ietf_NPUBBYTES] = { 0 };
+    int           ret;
+
+    crypto_core_hchacha20(k2, npub, k, NULL);
+    memcpy(npub2 + 4, npub + crypto_core_hchacha20_INPUTBYTES,
+           crypto_aead_chacha20poly1305_ietf_NPUBBYTES - 4);
+    ret = crypto_aead_chacha20poly1305_ietf_encrypt_detached
+        (c, mac, maclen_p, m, mlen, ad, adlen, nsec, npub2, k2);
+    sodium_memzero(k2, crypto_core_hchacha20_OUTPUTBYTES);
+
+    return ret;
+}
+
+int
+crypto_aead_xchacha20poly1305_ietf_encrypt(unsigned char *c,
+                                           unsigned long long *clen_p,
+                                           const unsigned char *m,
+                                           unsigned long long mlen,
+                                           const unsigned char *ad,
+                                           unsigned long long adlen,
+                                           const unsigned char *nsec,
+                                           const unsigned char *npub,
+                                           const unsigned char *k)
+{
+    unsigned long long clen = 0ULL;
+    int                ret;
+
+    if (mlen > UINT64_MAX - crypto_aead_xchacha20poly1305_ietf_ABYTES) {
+        abort(); /* LCOV_EXCL_LINE */
+    }
+    ret = crypto_aead_xchacha20poly1305_ietf_encrypt_detached
+        (c, c + mlen, NULL, m, mlen, ad, adlen, nsec, npub, k);
+    if (clen_p != NULL) {
+        if (ret == 0) {
+            clen = mlen + crypto_aead_xchacha20poly1305_ietf_ABYTES;
+        }
+        *clen_p = clen;
+    }
+    return ret;
+}
+
+int
+crypto_aead_xchacha20poly1305_ietf_decrypt_detached(unsigned char *m,
+                                                    unsigned char *nsec,
+                                                    const unsigned char *c,
+                                                    unsigned long long clen,
+                                                    const unsigned char *mac,
+                                                    const unsigned char *ad,
+                                                    unsigned long long adlen,
+                                                    const unsigned char *npub,
+                                                    const unsigned char *k)
+{
+    unsigned char k2[crypto_core_hchacha20_OUTPUTBYTES];
+    unsigned char npub2[crypto_aead_chacha20poly1305_ietf_NPUBBYTES] = { 0 };
+    int           ret;
+
+    crypto_core_hchacha20(k2, npub, k, NULL);
+    memcpy(npub2 + 4, npub + crypto_core_hchacha20_INPUTBYTES,
+           crypto_aead_chacha20poly1305_ietf_NPUBBYTES - 4);
+    ret = crypto_aead_chacha20poly1305_ietf_decrypt_detached
+        (m, nsec, c, clen, mac, ad, adlen, npub2, k2);
+    sodium_memzero(k2, crypto_core_hchacha20_OUTPUTBYTES);
+
+    return ret;
+
+}
+
+int
+crypto_aead_xchacha20poly1305_ietf_decrypt(unsigned char *m,
+                                           unsigned long long *mlen_p,
+                                           unsigned char *nsec,
+                                           const unsigned char *c,
+                                           unsigned long long clen,
+                                           const unsigned char *ad,
+                                           unsigned long long adlen,
+                                           const unsigned char *npub,
+                                           const unsigned char *k)
+{
+    unsigned long long mlen = 0ULL;
+    int                ret = -1;
+
+    if (clen >= crypto_aead_xchacha20poly1305_ietf_ABYTES) {
+        ret = crypto_aead_xchacha20poly1305_ietf_decrypt_detached
+            (m, nsec,
+             c, clen - crypto_aead_xchacha20poly1305_ietf_ABYTES,
+             c + clen - crypto_aead_xchacha20poly1305_ietf_ABYTES,
+             ad, adlen, npub, k);
+    }
+    if (mlen_p != NULL) {
+        if (ret == 0) {
+            mlen = clen - crypto_aead_xchacha20poly1305_ietf_ABYTES;
+        }
+        *mlen_p = mlen;
+    }
+    return ret;
+}
+
+size_t
+crypto_aead_xchacha20poly1305_ietf_keybytes(void)
+{
+    return crypto_aead_xchacha20poly1305_ietf_KEYBYTES;
+}
+
+size_t
+crypto_aead_xchacha20poly1305_ietf_npubbytes(void)
+{
+    return crypto_aead_xchacha20poly1305_ietf_NPUBBYTES;
+}
+
+size_t
+crypto_aead_xchacha20poly1305_ietf_nsecbytes(void)
+{
+    return crypto_aead_xchacha20poly1305_ietf_NSECBYTES;
+}
+
+size_t
+crypto_aead_xchacha20poly1305_ietf_abytes(void)
+{
+    return crypto_aead_xchacha20poly1305_ietf_ABYTES;
+}
+
+void
+crypto_aead_xchacha20poly1305_ietf_keygen(unsigned char k[crypto_aead_xchacha20poly1305_ietf_KEYBYTES])
+{
+    randombytes_buf(k, crypto_aead_xchacha20poly1305_ietf_KEYBYTES);
+}

data/vendor/libsodium/src/libsodium/crypto_auth/crypto_auth.c

@@ -1,5 +1,6 @@
 
 #include "crypto_auth.h"
+#include "randombytes.h"
 
 size_t
 crypto_auth_bytes(void)
@@ -32,3 +33,9 @@ crypto_auth_verify(const unsigned char *h, const unsigned char *in,
 {
     return crypto_auth_hmacsha512256_verify(h, in, inlen, k);
 }
+
+void
+crypto_auth_keygen(unsigned char k[crypto_auth_KEYBYTES])
+{
+    randombytes_buf(k, crypto_auth_KEYBYTES);
+}

data/vendor/libsodium/src/libsodium/crypto_auth/hmacsha256/{cp/hmac_hmacsha256.c → auth_hmacsha256.c}

@@ -1,44 +1,41 @@
 
-/*-
- * Copyright 2005,2007,2009 Colin Percival
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- */
+#include <stddef.h>
+#include <stdint.h>
+#include <string.h>
 
 #include "crypto_auth_hmacsha256.h"
 #include "crypto_hash_sha256.h"
+#include "crypto_verify_32.h"
+#include "randombytes.h"
 #include "utils.h"
 
-#include <sys/types.h>
+size_t
+crypto_auth_hmacsha256_bytes(void)
+{
+    return crypto_auth_hmacsha256_BYTES;
+}
 
-#include <stdint.h>
-#include <string.h>
+size_t
+crypto_auth_hmacsha256_keybytes(void)
+{
+    return crypto_auth_hmacsha256_KEYBYTES;
+}
+
+size_t
+crypto_auth_hmacsha256_statebytes(void)
+{
+    return sizeof(crypto_auth_hmacsha256_state);
+}
+
+void
+crypto_auth_hmacsha256_keygen(unsigned char k[crypto_auth_hmacsha256_KEYBYTES])
+{
+    randombytes_buf(k, crypto_auth_hmacsha256_KEYBYTES);
+}
 
 int
 crypto_auth_hmacsha256_init(crypto_auth_hmacsha256_state *state,
-                            const unsigned char *key,
-                            size_t keylen)
+                            const unsigned char *key, size_t keylen)
 {
     unsigned char pad[64];
     unsigned char khash[32];
@@ -48,7 +45,7 @@ crypto_auth_hmacsha256_init(crypto_auth_hmacsha256_state *state,
         crypto_hash_sha256_init(&state->ictx);
         crypto_hash_sha256_update(&state->ictx, key, keylen);
         crypto_hash_sha256_final(&state->ictx, khash);
-        key = khash;
+        key    = khash;
         keylen = 32;
     }
     crypto_hash_sha256_init(&state->ictx);
@@ -73,8 +70,7 @@ crypto_auth_hmacsha256_init(crypto_auth_hmacsha256_state *state,
 
 int
 crypto_auth_hmacsha256_update(crypto_auth_hmacsha256_state *state,
-                              const unsigned char *in,
-                              unsigned long long inlen)
+                              const unsigned char *in, unsigned long long inlen)
 {
     crypto_hash_sha256_update(&state->ictx, in, inlen);
 
@@ -83,7 +79,7 @@ crypto_auth_hmacsha256_update(crypto_auth_hmacsha256_state *state,
 
 int
 crypto_auth_hmacsha256_final(crypto_auth_hmacsha256_state *state,
-                             unsigned char *out)
+                             unsigned char                *out)
 {
     unsigned char ihash[32];
 
@@ -108,3 +104,15 @@ crypto_auth_hmacsha256(unsigned char *out, const unsigned char *in,
 
     return 0;
 }
+
+int
+crypto_auth_hmacsha256_verify(const unsigned char *h, const unsigned char *in,
+                              unsigned long long inlen, const unsigned char *k)
+{
+    unsigned char correct[32];
+
+    crypto_auth_hmacsha256(correct, in, inlen, k);
+
+    return crypto_verify_32(h, correct) | (-(h == correct)) |
+           sodium_memcmp(correct, h, 32);
+}