rbnacl-libsodium 1.0.11 → 1.0.13

data/vendor/libsodium/src/libsodium/crypto_shorthash/siphash24/shorthash_siphashx24.c

@@ -0,0 +1,11 @@
+#include "crypto_shorthash_siphash24.h"
+
+size_t
+crypto_shorthash_siphashx24_bytes(void) {
+    return crypto_shorthash_siphashx24_BYTES;
+}
+
+size_t
+crypto_shorthash_siphashx24_keybytes(void) {
+    return crypto_shorthash_siphashx24_KEYBYTES;
+}

data/vendor/libsodium/src/libsodium/crypto_sign/crypto_sign.c

@@ -1,6 +1,12 @@
 
 #include "crypto_sign.h"
 
+size_t
+crypto_sign_statebytes(void)
+{
+    return sizeof(crypto_sign_state);
+}
+
 size_t
 crypto_sign_bytes(void)
 {
@@ -74,3 +80,30 @@ crypto_sign_verify_detached(const unsigned char *sig, const unsigned char *m,
 {
     return crypto_sign_ed25519_verify_detached(sig, m, mlen, pk);
 }
+
+int
+crypto_sign_init(crypto_sign_state *state)
+{
+    return crypto_sign_ed25519ph_init(state);
+}
+
+int
+crypto_sign_update(crypto_sign_state *state, const unsigned char *m,
+                   unsigned long long mlen)
+{
+    return crypto_sign_ed25519ph_update(state, m, mlen);
+}
+
+int
+crypto_sign_final_create(crypto_sign_state *state, unsigned char *sig,
+                         unsigned long long *siglen_p, const unsigned char *sk)
+{
+    return crypto_sign_ed25519ph_final_create(state, sig, siglen_p, sk);
+}
+
+int
+crypto_sign_final_verify(crypto_sign_state *state, unsigned char *sig,
+                         const unsigned char *pk)
+{
+    return crypto_sign_ed25519ph_final_verify(state, sig, pk);
+}

data/vendor/libsodium/src/libsodium/crypto_sign/ed25519/ref10/ed25519_ref10.h

@@ -0,0 +1,18 @@
+#ifndef ed25519_ref10_H
+#define ed25519_ref10_H
+
+void _crypto_sign_ed25519_ref10_hinit(crypto_hash_sha512_state *hs,
+                                      int prehashed);
+
+int _crypto_sign_ed25519_detached(unsigned char *sig,
+                                  unsigned long long *siglen_p,
+                                  const unsigned char *m,
+                                  unsigned long long mlen,
+                                  const unsigned char *sk, int prehashed);
+
+int _crypto_sign_ed25519_verify_detached(const unsigned char *sig,
+                                         const unsigned char *m,
+                                         unsigned long long   mlen,
+                                         const unsigned char *pk,
+                                         int prehashed);
+#endif

data/vendor/libsodium/src/libsodium/crypto_sign/ed25519/ref10/keypair.c

@@ -1,32 +1,35 @@
 
 #include <string.h>
 
-#include "crypto_sign_ed25519.h"
 #include "crypto_hash_sha512.h"
 #include "crypto_scalarmult_curve25519.h"
+#include "crypto_sign_ed25519.h"
+#include "private/curve25519_ref10.h"
 #include "randombytes.h"
 #include "utils.h"
-#include "private/curve25519_ref10.h"
 
-int crypto_sign_ed25519_seed_keypair(unsigned char *pk, unsigned char *sk,
-                                     const unsigned char *seed)
+int
+crypto_sign_ed25519_seed_keypair(unsigned char *pk, unsigned char *sk,
+                                 const unsigned char *seed)
 {
     ge_p3 A;
 
-    crypto_hash_sha512(sk,seed,32);
+    crypto_hash_sha512(sk, seed, 32);
     sk[0] &= 248;
     sk[31] &= 63;
     sk[31] |= 64;
 
-    ge_scalarmult_base(&A,sk);
-    ge_p3_tobytes(pk,&A);
+    ge_scalarmult_base(&A, sk);
+    ge_p3_tobytes(pk, &A);
 
     memmove(sk, seed, 32);
     memmove(sk + 32, pk, 32);
+
     return 0;
 }
 
-int crypto_sign_ed25519_keypair(unsigned char *pk, unsigned char *sk)
+int
+crypto_sign_ed25519_keypair(unsigned char *pk, unsigned char *sk)
 {
     unsigned char seed[32];
     int           ret;
@@ -38,8 +41,9 @@ int crypto_sign_ed25519_keypair(unsigned char *pk, unsigned char *sk)
     return ret;
 }
 
-int crypto_sign_ed25519_pk_to_curve25519(unsigned char *curve25519_pk,
-                                         const unsigned char *ed25519_pk)
+int
+crypto_sign_ed25519_pk_to_curve25519(unsigned char *curve25519_pk,
+                                     const unsigned char *ed25519_pk)
 {
     ge_p3 A;
     fe    x;
@@ -59,14 +63,15 @@ int crypto_sign_ed25519_pk_to_curve25519(unsigned char *curve25519_pk,
     return 0;
 }
 
-int crypto_sign_ed25519_sk_to_curve25519(unsigned char *curve25519_sk,
-                                         const unsigned char *ed25519_sk)
+int
+crypto_sign_ed25519_sk_to_curve25519(unsigned char *curve25519_sk,
+                                     const unsigned char *ed25519_sk)
 {
     unsigned char h[crypto_hash_sha512_BYTES];
 
     crypto_hash_sha512(h, ed25519_sk,
                        crypto_sign_ed25519_SECRETKEYBYTES -
-                       crypto_sign_ed25519_PUBLICKEYBYTES);
+                           crypto_sign_ed25519_PUBLICKEYBYTES);
     h[0] &= 248;
     h[31] &= 127;
     h[31] |= 64;

data/vendor/libsodium/src/libsodium/crypto_sign/ed25519/ref10/obsolete.c

@@ -6,12 +6,13 @@
 #include "crypto_hash_sha512.h"
 #include "crypto_sign_edwards25519sha512batch.h"
 #include "crypto_verify_32.h"
+#include "private/curve25519_ref10.h"
 #include "randombytes.h"
 #include "utils.h"
-#include "private/curve25519_ref10.h"
 
-int crypto_sign_edwards25519sha512batch_keypair(unsigned char *pk,
-                                                unsigned char *sk)
+int
+crypto_sign_edwards25519sha512batch_keypair(unsigned char *pk,
+                                            unsigned char *sk)
 {
     ge_p3 A;
 
@@ -26,18 +27,19 @@ int crypto_sign_edwards25519sha512batch_keypair(unsigned char *pk,
     return 0;
 }
 
-int crypto_sign_edwards25519sha512batch(unsigned char *sm,
-                                        unsigned long long *smlen_p,
-                                        const unsigned char *m,
-                                        unsigned long long mlen,
-                                        const unsigned char *sk)
+int
+crypto_sign_edwards25519sha512batch(unsigned char       *sm,
+                                    unsigned long long  *smlen_p,
+                                    const unsigned char *m,
+                                    unsigned long long   mlen,
+                                    const unsigned char *sk)
 {
     crypto_hash_sha512_state hs;
-    unsigned char nonce[64];
-    unsigned char hram[64];
-    unsigned char sig[64];
-    ge_p3 A;
-    ge_p3 R;
+    unsigned char            nonce[64];
+    unsigned char            hram[64];
+    unsigned char            sig[64];
+    ge_p3                    A;
+    ge_p3                    R;
 
     crypto_hash_sha512_init(&hs);
     crypto_hash_sha512_update(&hs, sk + 32, 32);
@@ -63,21 +65,22 @@ int crypto_sign_edwards25519sha512batch(unsigned char *sm,
     return 0;
 }
 
-int crypto_sign_edwards25519sha512batch_open(unsigned char *m,
-                                             unsigned long long *mlen_p,
-                                             const unsigned char *sm,
-                                             unsigned long long smlen,
-                                             const unsigned char *pk)
+int
+crypto_sign_edwards25519sha512batch_open(unsigned char       *m,
+                                         unsigned long long  *mlen_p,
+                                         const unsigned char *sm,
+                                         unsigned long long   smlen,
+                                         const unsigned char *pk)
 {
-    unsigned char h[64];
-    unsigned char t1[32], t2[32];
+    unsigned char      h[64];
+    unsigned char      t1[32], t2[32];
     unsigned long long mlen;
-    ge_cached Ai;
-    ge_p1p1 csa;
-    ge_p2 cs;
-    ge_p3 A;
-    ge_p3 R;
-    ge_p3 cs3;
+    ge_cached          Ai;
+    ge_p1p1            csa;
+    ge_p2              cs;
+    ge_p3              A;
+    ge_p3              R;
+    ge_p3              cs3;
 
     *mlen_p = 0;
     if (smlen < 64 || smlen > SIZE_MAX) {

data/vendor/libsodium/src/libsodium/crypto_sign/ed25519/ref10/open.c

@@ -6,19 +6,20 @@
 #include "crypto_hash_sha512.h"
 #include "crypto_sign_ed25519.h"
 #include "crypto_verify_32.h"
-#include "utils.h"
+#include "ed25519_ref10.h"
 #include "private/curve25519_ref10.h"
+#include "utils.h"
 
 #ifndef ED25519_COMPAT
 static int
 crypto_sign_check_S_lt_L(const unsigned char *S)
 {
     /* 2^252+27742317777372353535851937790883648493 */
-    static const unsigned char L[32] =
-      { 0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58,
-        0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14,
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10 };
+    static const unsigned char L[32] = {
+        0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, 0xd6, 0x9c, 0xf7,
+        0xa2, 0xde, 0xf9, 0xde, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10
+    };
     unsigned char c = 0;
     unsigned char n = 1;
     unsigned int  i = 32;
@@ -35,31 +36,60 @@ crypto_sign_check_S_lt_L(const unsigned char *S)
 static int
 small_order(const unsigned char R[32])
 {
-    CRYPTO_ALIGN(16) static const unsigned char blacklist[][32] = {
+    CRYPTO_ALIGN(16)
+    static const unsigned char blacklist[][32] = {
         /* 0 (order 4) */
-        { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
+        { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
         /* 1 (order 1) */
-        { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
-        /* 2707385501144840649318225287225658788936804267575313519463743609750303402022 (order 8) */
-        { 0x26, 0xe8, 0x95, 0x8f, 0xc2, 0xb2, 0x27, 0xb0, 0x45, 0xc3, 0xf4, 0x89, 0xf2, 0xef, 0x98, 0xf0, 0xd5, 0xdf, 0xac, 0x05, 0xd3, 0xc6, 0x33, 0x39, 0xb1, 0x38, 0x02, 0x88, 0x6d, 0x53, 0xfc, 0x05 },
-        /* 55188659117513257062467267217118295137698188065244968500265048394206261417927 (order 8) */
-        { 0xc7, 0x17, 0x6a, 0x70, 0x3d, 0x4d, 0xd8, 0x4f, 0xba, 0x3c, 0x0b, 0x76, 0x0d, 0x10, 0x67, 0x0f, 0x2a, 0x20, 0x53, 0xfa, 0x2c, 0x39, 0xcc, 0xc6, 0x4e, 0xc7, 0xfd, 0x77, 0x92, 0xac, 0x03, 0x7a },
+        { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
+        /* 2707385501144840649318225287225658788936804267575313519463743609750303402022
+           (order 8) */
+        { 0x26, 0xe8, 0x95, 0x8f, 0xc2, 0xb2, 0x27, 0xb0, 0x45, 0xc3, 0xf4,
+          0x89, 0xf2, 0xef, 0x98, 0xf0, 0xd5, 0xdf, 0xac, 0x05, 0xd3, 0xc6,
+          0x33, 0x39, 0xb1, 0x38, 0x02, 0x88, 0x6d, 0x53, 0xfc, 0x05 },
+        /* 55188659117513257062467267217118295137698188065244968500265048394206261417927
+           (order 8) */
+        { 0xc7, 0x17, 0x6a, 0x70, 0x3d, 0x4d, 0xd8, 0x4f, 0xba, 0x3c, 0x0b,
+          0x76, 0x0d, 0x10, 0x67, 0x0f, 0x2a, 0x20, 0x53, 0xfa, 0x2c, 0x39,
+          0xcc, 0xc6, 0x4e, 0xc7, 0xfd, 0x77, 0x92, 0xac, 0x03, 0x7a },
         /* p-1 (order 2) */
-        { 0x13, 0xe8, 0x95, 0x8f, 0xc2, 0xb2, 0x27, 0xb0, 0x45, 0xc3, 0xf4, 0x89, 0xf2, 0xef, 0x98, 0xf0, 0xd5, 0xdf, 0xac, 0x05, 0xd3, 0xc6, 0x33, 0x39, 0xb1, 0x38, 0x02, 0x88, 0x6d, 0x53, 0xfc, 0x85 },
+        { 0x13, 0xe8, 0x95, 0x8f, 0xc2, 0xb2, 0x27, 0xb0, 0x45, 0xc3, 0xf4,
+          0x89, 0xf2, 0xef, 0x98, 0xf0, 0xd5, 0xdf, 0xac, 0x05, 0xd3, 0xc6,
+          0x33, 0x39, 0xb1, 0x38, 0x02, 0x88, 0x6d, 0x53, 0xfc, 0x85 },
         /* p (order 4) */
-        { 0xb4, 0x17, 0x6a, 0x70, 0x3d, 0x4d, 0xd8, 0x4f, 0xba, 0x3c, 0x0b, 0x76, 0x0d, 0x10, 0x67, 0x0f, 0x2a, 0x20, 0x53, 0xfa, 0x2c, 0x39, 0xcc, 0xc6, 0x4e, 0xc7, 0xfd, 0x77, 0x92, 0xac, 0x03, 0xfa },
+        { 0xb4, 0x17, 0x6a, 0x70, 0x3d, 0x4d, 0xd8, 0x4f, 0xba, 0x3c, 0x0b,
+          0x76, 0x0d, 0x10, 0x67, 0x0f, 0x2a, 0x20, 0x53, 0xfa, 0x2c, 0x39,
+          0xcc, 0xc6, 0x4e, 0xc7, 0xfd, 0x77, 0x92, 0xac, 0x03, 0xfa },
         /* p+1 (order 1) */
-        { 0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
-        /* p+2707385501144840649318225287225658788936804267575313519463743609750303402022 (order 8) */
-        { 0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
-        /* p+55188659117513257062467267217118295137698188065244968500265048394206261417927 (order 8) */
-        { 0xee, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
+        { 0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+          0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+          0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
+        /* p+2707385501144840649318225287225658788936804267575313519463743609750303402022
+           (order 8) */
+        { 0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+          0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+          0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
+        /* p+55188659117513257062467267217118295137698188065244968500265048394206261417927
+           (order 8) */
+        { 0xee, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+          0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+          0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
         /* 2p-1 (order 2) */
-        { 0xd9, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
+        { 0xd9, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+          0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+          0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
         /* 2p (order 4) */
-        { 0xda, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
+        { 0xda, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+          0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+          0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
         /* 2p+1 (order 1) */
-        { 0xdb, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }
+        { 0xdb, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+          0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+          0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }
     };
     size_t        i, j;
     unsigned char c;
@@ -78,22 +108,22 @@ small_order(const unsigned char R[32])
 #endif
 
 int
-crypto_sign_ed25519_verify_detached(const unsigned char *sig,
-                                    const unsigned char *m,
-                                    unsigned long long mlen,
-                                    const unsigned char *pk)
+_crypto_sign_ed25519_verify_detached(const unsigned char *sig,
+                                     const unsigned char *m,
+                                     unsigned long long   mlen,
+                                     const unsigned char *pk,
+                                     int prehashed)
 {
     crypto_hash_sha512_state hs;
-    unsigned char h[64];
-    unsigned char rcheck[32];
-    unsigned int  i;
-    unsigned char d = 0;
-    ge_p3 A;
-    ge_p2 R;
+    unsigned char            h[64];
+    unsigned char            rcheck[32];
+    unsigned int             i;
+    unsigned char            d = 0;
+    ge_p3                    A;
+    ge_p2                    R;
 
 #ifndef ED25519_COMPAT
-    if (crypto_sign_check_S_lt_L(sig + 32) != 0 ||
-        small_order(sig) != 0) {
+    if (crypto_sign_check_S_lt_L(sig + 32) != 0 || small_order(sig) != 0) {
         return -1;
     }
 #else
@@ -110,7 +140,7 @@ crypto_sign_ed25519_verify_detached(const unsigned char *sig,
     if (d == 0) {
         return -1;
     }
-    crypto_hash_sha512_init(&hs);
+    _crypto_sign_ed25519_ref10_hinit(&hs, prehashed);
     crypto_hash_sha512_update(&hs, sig, 32);
     crypto_hash_sha512_update(&hs, pk, 32);
     crypto_hash_sha512_update(&hs, m, mlen);
@@ -124,6 +154,15 @@ crypto_sign_ed25519_verify_detached(const unsigned char *sig,
            sodium_memcmp(sig, rcheck, 32);
 }
 
+int
+crypto_sign_ed25519_verify_detached(const unsigned char *sig,
+                                    const unsigned char *m,
+                                    unsigned long long   mlen,
+                                    const unsigned char *pk)
+{
+    return _crypto_sign_ed25519_verify_detached(sig, m, mlen, pk, 0);
+}
+
 int
 crypto_sign_ed25519_open(unsigned char *m, unsigned long long *mlen_p,
                          const unsigned char *sm, unsigned long long smlen,

data/vendor/libsodium/src/libsodium/crypto_sign/ed25519/ref10/sign.c

@@ -3,26 +3,43 @@
 
 #include "crypto_hash_sha512.h"
 #include "crypto_sign_ed25519.h"
-#include "utils.h"
+#include "ed25519_ref10.h"
 #include "private/curve25519_ref10.h"
+#include "utils.h"
+
+void
+_crypto_sign_ed25519_ref10_hinit(crypto_hash_sha512_state *hs, int prehashed)
+{
+    static const unsigned char DOM2PREFIX[32 + 2] = {
+        'S', 'i', 'g', 'E', 'd', '2', '5', '5', '1', '9', ' ',
+        'n', 'o', ' ',
+        'E', 'd', '2', '5', '5', '1', '9', ' ',
+        'c', 'o', 'l', 'l', 'i', 's', 'i', 'o', 'n', 's', 1, 0
+    };
+
+    crypto_hash_sha512_init(hs);
+    if (prehashed) {
+        crypto_hash_sha512_update(hs, DOM2PREFIX, sizeof DOM2PREFIX);
+    }
+}
 
 int
-crypto_sign_ed25519_detached(unsigned char *sig, unsigned long long *siglen_p,
-                             const unsigned char *m, unsigned long long mlen,
-                             const unsigned char *sk)
+_crypto_sign_ed25519_detached(unsigned char *sig, unsigned long long *siglen_p,
+                              const unsigned char *m, unsigned long long mlen,
+                              const unsigned char *sk, int prehashed)
 {
     crypto_hash_sha512_state hs;
-    unsigned char az[64];
-    unsigned char nonce[64];
-    unsigned char hram[64];
-    ge_p3 R;
+    unsigned char            az[64];
+    unsigned char            nonce[64];
+    unsigned char            hram[64];
+    ge_p3                    R;
 
     crypto_hash_sha512(az, sk, 32);
     az[0] &= 248;
     az[31] &= 63;
     az[31] |= 64;
 
-    crypto_hash_sha512_init(&hs);
+    _crypto_sign_ed25519_ref10_hinit(&hs, prehashed);
     crypto_hash_sha512_update(&hs, az + 32, 32);
     crypto_hash_sha512_update(&hs, m, mlen);
     crypto_hash_sha512_final(&hs, nonce);
@@ -33,7 +50,7 @@ crypto_sign_ed25519_detached(unsigned char *sig, unsigned long long *siglen_p,
     ge_scalarmult_base(&R, nonce);
     ge_p3_tobytes(sig, &R);
 
-    crypto_hash_sha512_init(&hs);
+    _crypto_sign_ed25519_ref10_hinit(&hs, prehashed);
     crypto_hash_sha512_update(&hs, sig, 64);
     crypto_hash_sha512_update(&hs, m, mlen);
     crypto_hash_sha512_final(&hs, hram);
@@ -49,6 +66,14 @@ crypto_sign_ed25519_detached(unsigned char *sig, unsigned long long *siglen_p,
     return 0;
 }
 
+int
+crypto_sign_ed25519_detached(unsigned char *sig, unsigned long long *siglen_p,
+                             const unsigned char *m, unsigned long long mlen,
+                             const unsigned char *sk)
+{
+    return _crypto_sign_ed25519_detached(sig, siglen_p, m, mlen, sk, 0);
+}
+
 int
 crypto_sign_ed25519(unsigned char *sm, unsigned long long *smlen_p,
                     const unsigned char *m, unsigned long long mlen,
@@ -57,10 +82,9 @@ crypto_sign_ed25519(unsigned char *sm, unsigned long long *smlen_p,
     unsigned long long siglen;
 
     memmove(sm + crypto_sign_ed25519_BYTES, m, mlen);
-/* LCOV_EXCL_START */
-    if (crypto_sign_ed25519_detached(sm, &siglen,
-                                     sm + crypto_sign_ed25519_BYTES,
-                                     mlen, sk) != 0 ||
+    /* LCOV_EXCL_START */
+    if (crypto_sign_ed25519_detached(
+            sm, &siglen, sm + crypto_sign_ed25519_BYTES, mlen, sk) != 0 ||
         siglen != crypto_sign_ed25519_BYTES) {
         if (smlen_p != NULL) {
             *smlen_p = 0;
@@ -68,7 +92,7 @@ crypto_sign_ed25519(unsigned char *sm, unsigned long long *smlen_p,
         memset(sm, 0, mlen + crypto_sign_ed25519_BYTES);
         return -1;
     }
-/* LCOV_EXCL_STOP */
+    /* LCOV_EXCL_STOP */
 
     if (smlen_p != NULL) {
         *smlen_p = mlen + siglen;