rbnacl-libsodium 1.0.11 → 1.0.13

data/vendor/libsodium/src/libsodium/crypto_secretbox/crypto_secretbox.c

@@ -1,5 +1,6 @@
 
 #include "crypto_secretbox.h"
+#include "randombytes.h"
 
 size_t
 crypto_secretbox_keybytes(void)
@@ -52,3 +53,9 @@ crypto_secretbox_open(unsigned char *m, const unsigned char *c,
 {
     return crypto_secretbox_xsalsa20poly1305_open(m, c, clen, n, k);
 }
+
+void
+crypto_secretbox_keygen(unsigned char k[crypto_secretbox_KEYBYTES])
+{
+    randombytes_buf(k, crypto_secretbox_KEYBYTES);
+}

data/vendor/libsodium/src/libsodium/crypto_secretbox/crypto_secretbox_easy.c

@@ -9,6 +9,7 @@
 #include "crypto_onetimeauth_poly1305.h"
 #include "crypto_secretbox.h"
 #include "crypto_stream_salsa20.h"
+#include "private/common.h"
 #include "utils.h"
 
 int
@@ -25,15 +26,15 @@ crypto_secretbox_detached(unsigned char *c, unsigned char *mac,
 
     crypto_core_hsalsa20(subkey, n, k, NULL);
 
-    if (((uintptr_t) c >= (uintptr_t) m &&
+    if (((uintptr_t) c > (uintptr_t) m &&
          (uintptr_t) c - (uintptr_t) m < mlen) ||
-        ((uintptr_t) m >= (uintptr_t) c &&
+        ((uintptr_t) m > (uintptr_t) c &&
          (uintptr_t) m - (uintptr_t) c < mlen)) {
         memmove(c, m, mlen);
         m = c;
     }
     memset(block0, 0U, crypto_secretbox_ZEROBYTES);
-    (void) sizeof(int[64U >= crypto_secretbox_ZEROBYTES ? 1 : -1]);
+    COMPILER_ASSERT(64U >= crypto_secretbox_ZEROBYTES);
     mlen0 = mlen;
     if (mlen0 > 64U - crypto_secretbox_ZEROBYTES) {
         mlen0 = 64U - crypto_secretbox_ZEROBYTES;
@@ -44,8 +45,8 @@ crypto_secretbox_detached(unsigned char *c, unsigned char *mac,
     crypto_stream_salsa20_xor(block0, block0,
                               mlen0 + crypto_secretbox_ZEROBYTES,
                               n + 16, subkey);
-    (void) sizeof(int[crypto_secretbox_ZEROBYTES >=
-                      crypto_onetimeauth_poly1305_KEYBYTES ? 1 : -1]);
+    COMPILER_ASSERT(crypto_secretbox_ZEROBYTES >=
+                    crypto_onetimeauth_poly1305_KEYBYTES);
     crypto_onetimeauth_poly1305_init(&state, block0);
 
     for (i = 0U; i < mlen0; i++) {

data/vendor/libsodium/src/libsodium/crypto_secretbox/xchacha20poly1305/secretbox_xchacha20poly1305.c

@@ -0,0 +1,170 @@
+
+#include <assert.h>
+#include <limits.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "crypto_core_hchacha20.h"
+#include "crypto_onetimeauth_poly1305.h"
+#include "crypto_secretbox_xchacha20poly1305.h"
+#include "crypto_stream_chacha20.h"
+#include "private/common.h"
+#include "utils.h"
+
+#define crypto_secretbox_xchacha20poly1305_ZEROBYTES 32U
+
+int
+crypto_secretbox_xchacha20poly1305_detached(unsigned char *c,
+                                            unsigned char *mac,
+                                            const unsigned char *m,
+                                            unsigned long long mlen,
+                                            const unsigned char *n,
+                                            const unsigned char *k)
+{
+    crypto_onetimeauth_poly1305_state state;
+    unsigned char                     block0[64U];
+    unsigned char                     subkey[crypto_stream_chacha20_KEYBYTES];
+    unsigned long long                i;
+    unsigned long long                mlen0;
+
+    crypto_core_hchacha20(subkey, n, k, NULL);
+
+    if (((uintptr_t) c > (uintptr_t) m &&
+         (uintptr_t) c - (uintptr_t) m < mlen) ||
+        ((uintptr_t) m > (uintptr_t) c &&
+         (uintptr_t) m - (uintptr_t) c < mlen)) {
+        memmove(c, m, mlen);
+        m = c;
+    }
+    memset(block0, 0U, crypto_secretbox_xchacha20poly1305_ZEROBYTES);
+    COMPILER_ASSERT(64U >= crypto_secretbox_xchacha20poly1305_ZEROBYTES);
+    mlen0 = mlen;
+    if (mlen0 > 64U - crypto_secretbox_xchacha20poly1305_ZEROBYTES) {
+        mlen0 = 64U - crypto_secretbox_xchacha20poly1305_ZEROBYTES;
+    }
+    for (i = 0U; i < mlen0; i++) {
+        block0[i + crypto_secretbox_xchacha20poly1305_ZEROBYTES] = m[i];
+    }
+    crypto_stream_chacha20_xor(block0, block0,
+                               mlen0 + crypto_secretbox_xchacha20poly1305_ZEROBYTES,
+                               n + 16, subkey);
+    COMPILER_ASSERT(crypto_secretbox_xchacha20poly1305_ZEROBYTES >=
+                    crypto_onetimeauth_poly1305_KEYBYTES);
+    crypto_onetimeauth_poly1305_init(&state, block0);
+
+    for (i = 0U; i < mlen0; i++) {
+        c[i] = block0[crypto_secretbox_xchacha20poly1305_ZEROBYTES + i];
+    }
+    sodium_memzero(block0, sizeof block0);
+    if (mlen > mlen0) {
+        crypto_stream_chacha20_xor_ic(c + mlen0, m + mlen0, mlen - mlen0,
+                                      n + 16, 1U, subkey);
+    }
+    sodium_memzero(subkey, sizeof subkey);
+
+    crypto_onetimeauth_poly1305_update(&state, c, mlen);
+    crypto_onetimeauth_poly1305_final(&state, mac);
+    sodium_memzero(&state, sizeof state);
+
+    return 0;
+}
+
+int
+crypto_secretbox_xchacha20poly1305_easy(unsigned char *c,
+                                        const unsigned char *m,
+                                        unsigned long long mlen,
+                                        const unsigned char *n,
+                                        const unsigned char *k)
+{
+    if (mlen > SIZE_MAX - crypto_secretbox_xchacha20poly1305_MACBYTES) {
+        return -1;
+    }
+    return crypto_secretbox_xchacha20poly1305_detached
+        (c + crypto_secretbox_xchacha20poly1305_MACBYTES, c, m, mlen, n, k);
+}
+
+int
+crypto_secretbox_xchacha20poly1305_open_detached(unsigned char *m,
+                                                 const unsigned char *c,
+                                                 const unsigned char *mac,
+                                                 unsigned long long clen,
+                                                 const unsigned char *n,
+                                                 const unsigned char *k)
+{
+    unsigned char      block0[64U];
+    unsigned char      subkey[crypto_stream_chacha20_KEYBYTES];
+    unsigned long long i;
+    unsigned long long mlen0;
+
+    crypto_core_hchacha20(subkey, n, k, NULL);
+    crypto_stream_chacha20(block0, crypto_stream_chacha20_KEYBYTES,
+                           n + 16, subkey);
+    if (crypto_onetimeauth_poly1305_verify(mac, c, clen, block0) != 0) {
+        sodium_memzero(subkey, sizeof subkey);
+        return -1;
+    }
+    if (m == NULL) {
+        return 0;
+    }
+    if (((uintptr_t) c >= (uintptr_t) m &&
+         (uintptr_t) c - (uintptr_t) m < clen) ||
+        ((uintptr_t) m >= (uintptr_t) c &&
+         (uintptr_t) m - (uintptr_t) c < clen)) {
+        memmove(m, c, clen);
+        c = m;
+    }
+    mlen0 = clen;
+    if (mlen0 > 64U - crypto_secretbox_xchacha20poly1305_ZEROBYTES) {
+        mlen0 = 64U - crypto_secretbox_xchacha20poly1305_ZEROBYTES;
+    }
+    for (i = 0U; i < mlen0; i++) {
+        block0[crypto_secretbox_xchacha20poly1305_ZEROBYTES + i] = c[i];
+    }
+    crypto_stream_chacha20_xor(block0, block0,
+                              crypto_secretbox_xchacha20poly1305_ZEROBYTES + mlen0,
+                              n + 16, subkey);
+    for (i = 0U; i < mlen0; i++) {
+        m[i] = block0[i + crypto_secretbox_xchacha20poly1305_ZEROBYTES];
+    }
+    if (clen > mlen0) {
+        crypto_stream_chacha20_xor_ic(m + mlen0, c + mlen0, clen - mlen0,
+                                      n + 16, 1U, subkey);
+    }
+    sodium_memzero(subkey, sizeof subkey);
+
+    return 0;
+}
+
+int
+crypto_secretbox_xchacha20poly1305_open_easy(unsigned char *m,
+                                             const unsigned char *c,
+                                             unsigned long long clen,
+                                             const unsigned char *n,
+                                             const unsigned char *k)
+{
+    if (clen < crypto_secretbox_xchacha20poly1305_MACBYTES) {
+        return -1;
+    }
+    return crypto_secretbox_xchacha20poly1305_open_detached
+        (m, c + crypto_secretbox_xchacha20poly1305_MACBYTES, c,
+         clen - crypto_secretbox_xchacha20poly1305_MACBYTES, n, k);
+}
+
+size_t
+crypto_secretbox_xchacha20poly1305_keybytes(void)
+{
+    return crypto_secretbox_xchacha20poly1305_KEYBYTES;
+}
+
+size_t
+crypto_secretbox_xchacha20poly1305_noncebytes(void)
+{
+    return crypto_secretbox_xchacha20poly1305_NONCEBYTES;
+}
+
+size_t
+crypto_secretbox_xchacha20poly1305_macbytes(void)
+{
+    return crypto_secretbox_xchacha20poly1305_MACBYTES;
+}

data/vendor/libsodium/src/libsodium/crypto_secretbox/xsalsa20poly1305/secretbox_xsalsa20poly1305.c

@@ -0,0 +1,83 @@
+#include "crypto_onetimeauth_poly1305.h"
+#include "crypto_secretbox_xsalsa20poly1305.h"
+#include "crypto_stream_xsalsa20.h"
+#include "randombytes.h"
+
+int
+crypto_secretbox_xsalsa20poly1305(unsigned char *c, const unsigned char *m,
+                                  unsigned long long mlen,
+                                  const unsigned char *n,
+                                  const unsigned char *k)
+{
+    int i;
+
+    if (mlen < 32) {
+        return -1;
+    }
+    crypto_stream_xsalsa20_xor(c, m, mlen, n, k);
+    crypto_onetimeauth_poly1305(c + 16, c + 32, mlen - 32, c);
+    for (i = 0; i < 16; ++i) {
+        c[i] = 0;
+    }
+    return 0;
+}
+
+int
+crypto_secretbox_xsalsa20poly1305_open(unsigned char *m, const unsigned char *c,
+                                       unsigned long long clen,
+                                       const unsigned char *n,
+                                       const unsigned char *k)
+{
+    unsigned char subkey[32];
+    int           i;
+
+    if (clen < 32) {
+        return -1;
+    }
+    crypto_stream_xsalsa20(subkey, 32, n, k);
+    if (crypto_onetimeauth_poly1305_verify(c + 16, c + 32,
+                                           clen - 32, subkey) != 0) {
+        return -1;
+    }
+    crypto_stream_xsalsa20_xor(m, c, clen, n, k);
+    for (i = 0; i < 32; ++i) {
+        m[i] = 0;
+    }
+    return 0;
+}
+
+size_t
+crypto_secretbox_xsalsa20poly1305_keybytes(void)
+{
+    return crypto_secretbox_xsalsa20poly1305_KEYBYTES;
+}
+
+size_t
+crypto_secretbox_xsalsa20poly1305_noncebytes(void)
+{
+    return crypto_secretbox_xsalsa20poly1305_NONCEBYTES;
+}
+
+size_t
+crypto_secretbox_xsalsa20poly1305_zerobytes(void)
+{
+    return crypto_secretbox_xsalsa20poly1305_ZEROBYTES;
+}
+
+size_t
+crypto_secretbox_xsalsa20poly1305_boxzerobytes(void)
+{
+    return crypto_secretbox_xsalsa20poly1305_BOXZEROBYTES;
+}
+
+size_t
+crypto_secretbox_xsalsa20poly1305_macbytes(void)
+{
+    return crypto_secretbox_xsalsa20poly1305_MACBYTES;
+}
+
+void
+crypto_secretbox_xsalsa20poly1305_keygen(unsigned char k[crypto_secretbox_xsalsa20poly1305_KEYBYTES])
+{
+    randombytes_buf(k, crypto_secretbox_xsalsa20poly1305_KEYBYTES);
+}

data/vendor/libsodium/src/libsodium/crypto_shorthash/crypto_shorthash.c

@@ -1,5 +1,6 @@
 
 #include "crypto_shorthash.h"
+#include "randombytes.h"
 
 size_t
 crypto_shorthash_bytes(void)
@@ -25,3 +26,9 @@ crypto_shorthash(unsigned char *out, const unsigned char *in,
 {
     return crypto_shorthash_siphash24(out, in, inlen, k);
 }
+
+void
+crypto_shorthash_keygen(unsigned char k[crypto_shorthash_KEYBYTES])
+{
+    randombytes_buf(k, crypto_shorthash_KEYBYTES);
+}

data/vendor/libsodium/src/libsodium/crypto_shorthash/siphash24/ref/shorthash_siphash24_ref.c

@@ -0,0 +1,65 @@
+#include "crypto_shorthash_siphash24.h"
+#include "private/common.h"
+#include "shorthash_siphash_ref.h"
+
+int
+crypto_shorthash_siphash24(unsigned char *out, const unsigned char *in,
+                           unsigned long long inlen, const unsigned char *k)
+{
+    /* "somepseudorandomlygeneratedbytes" */
+    uint64_t       v0 = 0x736f6d6570736575ULL;
+    uint64_t       v1 = 0x646f72616e646f6dULL;
+    uint64_t       v2 = 0x6c7967656e657261ULL;
+    uint64_t       v3 = 0x7465646279746573ULL;
+    uint64_t       b;
+    uint64_t       k0 = LOAD64_LE(k);
+    uint64_t       k1 = LOAD64_LE(k + 8);
+    uint64_t       m;
+    const uint8_t *end  = in + inlen - (inlen % sizeof(uint64_t));
+    const int      left = inlen & 7;
+
+    b = ((uint64_t) inlen) << 56;
+    v3 ^= k1;
+    v2 ^= k0;
+    v1 ^= k1;
+    v0 ^= k0;
+    for (; in != end; in += 8) {
+        m = LOAD64_LE(in);
+        v3 ^= m;
+        SIPROUND;
+        SIPROUND;
+        v0 ^= m;
+    }
+    switch (left) {
+    case 7:
+        b |= ((uint64_t) in[6]) << 48;
+    case 6:
+        b |= ((uint64_t) in[5]) << 40;
+    case 5:
+        b |= ((uint64_t) in[4]) << 32;
+    case 4:
+        b |= ((uint64_t) in[3]) << 24;
+    case 3:
+        b |= ((uint64_t) in[2]) << 16;
+    case 2:
+        b |= ((uint64_t) in[1]) << 8;
+    case 1:
+        b |= ((uint64_t) in[0]);
+        break;
+    case 0:
+        break;
+    }
+    v3 ^= b;
+    SIPROUND;
+    SIPROUND;
+    v0 ^= b;
+    v2 ^= 0xff;
+    SIPROUND;
+    SIPROUND;
+    SIPROUND;
+    SIPROUND;
+    b = v0 ^ v1 ^ v2 ^ v3;
+    STORE64_LE(out, b);
+
+    return 0;
+}

data/vendor/libsodium/src/libsodium/crypto_shorthash/siphash24/ref/shorthash_siphash_ref.h

@@ -0,0 +1,24 @@
+#ifndef shorthash_siphash_H
+#define shorthash_siphash_H
+
+#include "private/common.h"
+
+#define SIPROUND             \
+    do {                     \
+        v0 += v1;            \
+        v1 = ROTL64(v1, 13); \
+        v1 ^= v0;            \
+        v0 = ROTL64(v0, 32); \
+        v2 += v3;            \
+        v3 = ROTL64(v3, 16); \
+        v3 ^= v2;            \
+        v0 += v3;            \
+        v3 = ROTL64(v3, 21); \
+        v3 ^= v0;            \
+        v2 += v1;            \
+        v1 = ROTL64(v1, 17); \
+        v1 ^= v2;            \
+        v2 = ROTL64(v2, 32); \
+    } while (0)
+
+#endif

data/vendor/libsodium/src/libsodium/crypto_shorthash/siphash24/ref/shorthash_siphashx24_ref.c

@@ -0,0 +1,71 @@
+#include "crypto_shorthash_siphash24.h"
+#include "private/common.h"
+#include "shorthash_siphash_ref.h"
+
+int
+crypto_shorthash_siphashx24(unsigned char *out, const unsigned char *in,
+                            unsigned long long inlen, const unsigned char *k)
+{
+    uint64_t       v0 = 0x736f6d6570736575ULL;
+    uint64_t       v1 = 0x646f72616e646f83ULL;
+    uint64_t       v2 = 0x6c7967656e657261ULL;
+    uint64_t       v3 = 0x7465646279746573ULL;
+    uint64_t       b;
+    uint64_t       k0 = LOAD64_LE(k);
+    uint64_t       k1 = LOAD64_LE(k + 8);
+    uint64_t       m;
+    const uint8_t *end  = in + inlen - (inlen % sizeof(uint64_t));
+    const int      left = inlen & 7;
+
+    b = ((uint64_t) inlen) << 56;
+    v3 ^= k1;
+    v2 ^= k0;
+    v1 ^= k1;
+    v0 ^= k0;
+    for (; in != end; in += 8) {
+        m = LOAD64_LE(in);
+        v3 ^= m;
+        SIPROUND;
+        SIPROUND;
+        v0 ^= m;
+    }
+    switch (left) {
+    case 7:
+        b |= ((uint64_t) in[6]) << 48;
+    case 6:
+        b |= ((uint64_t) in[5]) << 40;
+    case 5:
+        b |= ((uint64_t) in[4]) << 32;
+    case 4:
+        b |= ((uint64_t) in[3]) << 24;
+    case 3:
+        b |= ((uint64_t) in[2]) << 16;
+    case 2:
+        b |= ((uint64_t) in[1]) << 8;
+    case 1:
+        b |= ((uint64_t) in[0]);
+        break;
+    case 0:
+        break;
+    }
+    v3 ^= b;
+    SIPROUND;
+    SIPROUND;
+    v0 ^= b;
+    v2 ^= 0xee;
+    SIPROUND;
+    SIPROUND;
+    SIPROUND;
+    SIPROUND;
+    b = v0 ^ v1 ^ v2 ^ v3;
+    STORE64_LE(out, b);
+    v1 ^= 0xdd;
+    SIPROUND;
+    SIPROUND;
+    SIPROUND;
+    SIPROUND;
+    b = v0 ^ v1 ^ v2 ^ v3;
+    STORE64_LE(out + 8, b);
+
+    return 0;
+}