rbnacl-libsodium 1.0.6 → 1.0.7

data/vendor/libsodium/src/libsodium/crypto_scalarmult/curve25519/sandy2x/ladder_base.h

@@ -0,0 +1,18 @@
+#ifndef ladder_base_H
+#define ladder_base_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "fe.h"
+#include "ladder_base_namespace.h"
+
+extern void ladder_base(fe *, const unsigned char *);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif //ifndef ladder_base_H
+

data/vendor/libsodium/src/libsodium/crypto_scalarmult/curve25519/sandy2x/ladder_base_namespace.h

@@ -0,0 +1,8 @@
+#ifndef ladder_base_namespace_H
+#define ladder_base_namespace_H
+
+#define  ladder_base  crypto_scalarmult_curve25519_sandy2x_ladder_base
+#define _ladder_base _crypto_scalarmult_curve25519_sandy2x_ladder_base
+
+#endif //ifndef ladder_base_namespace_H
+

data/vendor/libsodium/src/libsodium/crypto_scalarmult/curve25519/sandy2x/ladder_namespace.h

@@ -0,0 +1,8 @@
+#ifndef ladder_namespace_H
+#define ladder_namespace_H
+
+#define  ladder  crypto_scalarmult_curve25519_sandy2x_ladder
+#define _ladder _crypto_scalarmult_curve25519_sandy2x_ladder
+
+#endif //ifndef ladder_namespace_H
+

data/vendor/libsodium/src/libsodium/crypto_scalarmult/curve25519/sandy2x/sandy2x.S

@@ -0,0 +1,17 @@
+
+#ifdef HAVE_AVX_ASM
+
+#define IN_SANDY2X
+
+#include "consts.S"
+#include "fe51_mul.S"
+#include "fe51_nsquare.S"
+#include "fe51_pack.S"
+#include "ladder.S"
+#include "ladder_base.S"
+
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
+
+#endif

data/vendor/libsodium/src/libsodium/crypto_scalarmult/curve25519/scalarmult_curve25519.c

@@ -0,0 +1,67 @@
+
+#include "crypto_scalarmult_curve25519.h"
+#include "scalarmult_curve25519.h"
+#include "runtime.h"
+
+#ifdef HAVE_AVX_ASM
+# include "sandy2x/curve25519_sandy2x.h"
+#endif
+#ifdef HAVE_TI_MODE
+# include "donna_c64/curve25519_donna_c64.h"
+static const crypto_scalarmult_curve25519_implementation *implementation =
+    &crypto_scalarmult_curve25519_donna_c64_implementation;
+#else
+# include "ref10/curve25519_ref10.h"
+static const crypto_scalarmult_curve25519_implementation *implementation =
+    &crypto_scalarmult_curve25519_ref10_implementation;
+#endif
+
+int
+crypto_scalarmult_curve25519(unsigned char *q, const unsigned char *n,
+                             const unsigned char *p)
+{
+    size_t        i;
+    unsigned char d = 0;
+
+    if (implementation->mult(q, n, p) != 0) {
+        return -1;
+    }
+    for (i = 0; i < crypto_scalarmult_curve25519_BYTES; i++) {
+        d |= q[i];
+    }
+    return -(1 & ((d - 1) >> 8));
+}
+
+int
+crypto_scalarmult_curve25519_base(unsigned char *q, const unsigned char *n)
+{
+    return implementation->mult_base(q, n);
+}
+
+size_t
+crypto_scalarmult_curve25519_bytes(void)
+{
+    return crypto_scalarmult_curve25519_BYTES;
+}
+
+size_t
+crypto_scalarmult_curve25519_scalarbytes(void)
+{
+    return crypto_scalarmult_curve25519_SCALARBYTES;
+}
+
+int
+_crypto_scalarmult_curve25519_pick_best_implementation(void)
+{
+#ifdef HAVE_TI_MODE
+    implementation = &crypto_scalarmult_curve25519_donna_c64_implementation;
+#else
+    implementation = &crypto_scalarmult_curve25519_ref10_implementation;
+#endif
+#ifdef HAVE_AVX_ASM
+    if (sodium_runtime_has_avx()) {
+        implementation = &crypto_scalarmult_curve25519_sandy2x_implementation;
+    }
+#endif
+    return 0;
+}

data/vendor/libsodium/src/libsodium/crypto_scalarmult/curve25519/scalarmult_curve25519.h

@@ -0,0 +1,11 @@
+
+#ifndef scalarmult_poly1305_H
+#define scalarmult_poly1305_H
+
+typedef struct crypto_scalarmult_curve25519_implementation {
+    int (*mult)(unsigned char *q, const unsigned char *n,
+                const unsigned char *p);
+    int (*mult_base)(unsigned char *q, const unsigned char *n);
+} crypto_scalarmult_curve25519_implementation;
+
+#endif

data/vendor/libsodium/src/libsodium/crypto_secretbox/xsalsa20poly1305/ref/box_xsalsa20poly1305.c

@@ -1,8 +1,8 @@
-#include "api.h"
 #include "crypto_onetimeauth_poly1305.h"
+#include "crypto_secretbox_xsalsa20poly1305.h"
 #include "crypto_stream_xsalsa20.h"
 
-int crypto_secretbox(
+int crypto_secretbox_xsalsa20poly1305(
   unsigned char *c,
   const unsigned char *m,unsigned long long mlen,
   const unsigned char *n,
@@ -17,7 +17,7 @@ int crypto_secretbox(
   return 0;
 }
 
-int crypto_secretbox_open(
+int crypto_secretbox_xsalsa20poly1305_open(
   unsigned char *m,
   const unsigned char *c,unsigned long long clen,
   const unsigned char *n,

data/vendor/libsodium/src/libsodium/crypto_shorthash/siphash24/ref/shorthash_siphash24.c

@@ -1,4 +1,4 @@
-#include "api.h"
+#include "crypto_shorthash_siphash24.h"
 #include "crypto_uint64.h"
 #include "crypto_uint32.h"
 #include "crypto_uint8.h"
@@ -35,7 +35,8 @@ typedef crypto_uint8   u8;
     v2 += v1; v1=ROTL(v1,17); v1 ^= v2; v2=ROTL(v2,32); \
   } while(0)
 
-int crypto_shorthash(unsigned char *out,const unsigned char *in,unsigned long long inlen,const unsigned char *k)
+int crypto_shorthash_siphash24(unsigned char *out, const unsigned char *in,
+                               unsigned long long inlen, const unsigned char *k)
 {
   /* "somepseudorandomlygeneratedbytes" */
   u64 v0 = 0x736f6d6570736575ULL;

data/vendor/libsodium/src/libsodium/crypto_sign/ed25519/ref10/ge.h

@@ -70,6 +70,7 @@ typedef struct {
 #define ge_sub crypto_sign_ed25519_ref10_ge_sub
 #define ge_scalarmult_base crypto_sign_ed25519_ref10_ge_scalarmult_base
 #define ge_double_scalarmult_vartime crypto_sign_ed25519_ref10_ge_double_scalarmult_vartime
+#define ge_scalarmult_vartime crypto_sign_ed25519_ref10_ge_scalarmult_vartime
 
 extern void ge_tobytes(unsigned char *,const ge_p2 *);
 extern void ge_p3_tobytes(unsigned char *,const ge_p3 *);
@@ -91,5 +92,6 @@ extern void ge_add(ge_p1p1 *,const ge_p3 *,const ge_cached *);
 extern void ge_sub(ge_p1p1 *,const ge_p3 *,const ge_cached *);
 extern void ge_scalarmult_base(ge_p3 *,const unsigned char *);
 extern void ge_double_scalarmult_vartime(ge_p2 *,const unsigned char *,const ge_p3 *,const unsigned char *);
+extern void ge_scalarmult_vartime(ge_p3 *,const unsigned char *,const ge_p3 *);
 
 #endif

data/vendor/libsodium/src/libsodium/crypto_sign/ed25519/ref10/ge_double_scalarmult.c

@@ -94,3 +94,45 @@ void ge_double_scalarmult_vartime(ge_p2 *r,const unsigned char *a,const ge_p3 *A
     ge_p1p1_to_p2(r,&t);
   }
 }
+
+void ge_scalarmult_vartime(ge_p3 *r,const unsigned char *a,const ge_p3 *A)
+{
+  signed char aslide[256];
+  ge_cached Ai[8];
+  ge_p1p1 t;
+  ge_p3 u;
+  ge_p3 A2;
+  int i;
+
+  slide(aslide,a);
+
+  ge_p3_to_cached(&Ai[0],A);
+  ge_p3_dbl(&t,A); ge_p1p1_to_p3(&A2,&t);
+  ge_add(&t,&A2,&Ai[0]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[1],&u);
+  ge_add(&t,&A2,&Ai[1]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[2],&u);
+  ge_add(&t,&A2,&Ai[2]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[3],&u);
+  ge_add(&t,&A2,&Ai[3]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[4],&u);
+  ge_add(&t,&A2,&Ai[4]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[5],&u);
+  ge_add(&t,&A2,&Ai[5]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[6],&u);
+  ge_add(&t,&A2,&Ai[6]); ge_p1p1_to_p3(&u,&t); ge_p3_to_cached(&Ai[7],&u);
+
+  ge_p3_0(r);
+
+  for (i = 255;i >= 0;--i) {
+    if (aslide[i]) break;
+  }
+
+  for (;i >= 0;--i) {
+    ge_p3_dbl(&t,r);
+
+    if (aslide[i] > 0) {
+      ge_p1p1_to_p3(&u,&t);
+      ge_add(&t,&u,&Ai[aslide[i]/2]);
+    } else if (aslide[i] < 0) {
+      ge_p1p1_to_p3(&u,&t);
+      ge_sub(&t,&u,&Ai[(-aslide[i])/2]);
+    }
+
+   ge_p1p1_to_p3(r,&t);
+  }
+}

data/vendor/libsodium/src/libsodium/crypto_sign/ed25519/ref10/keypair.c

@@ -1,16 +1,16 @@
 
 #include <string.h>
 
-#include "api.h"
+#include "crypto_sign_ed25519.h"
 #include "crypto_hash_sha512.h"
 #include "crypto_scalarmult_curve25519.h"
-#include "randombytes.h"
-#include "utils.h"
 #include "fe.h"
 #include "ge.h"
+#include "randombytes.h"
+#include "utils.h"
 
-int crypto_sign_seed_keypair(unsigned char *pk, unsigned char *sk,
-                             const unsigned char *seed)
+int crypto_sign_ed25519_seed_keypair(unsigned char *pk, unsigned char *sk,
+                                     const unsigned char *seed)
 {
     ge_p3 A;
 
@@ -27,13 +27,13 @@ int crypto_sign_seed_keypair(unsigned char *pk, unsigned char *sk,
     return 0;
 }
 
-int crypto_sign_keypair(unsigned char *pk, unsigned char *sk)
+int crypto_sign_ed25519_keypair(unsigned char *pk, unsigned char *sk)
 {
     unsigned char seed[32];
     int           ret;
 
     randombytes_buf(seed, sizeof seed);
-    ret = crypto_sign_seed_keypair(pk, sk, seed);
+    ret = crypto_sign_ed25519_seed_keypair(pk, sk, seed);
     sodium_memzero(seed, sizeof seed);
 
     return ret;

data/vendor/libsodium/src/libsodium/crypto_sign/ed25519/ref10/obsolete.c

@@ -0,0 +1,113 @@
+
+#include <limits.h>
+#include <stdint.h>
+#include <string.h>
+
+#include "crypto_hash_sha512.h"
+#include "crypto_sign_edwards25519sha512batch.h"
+#include "crypto_verify_32.h"
+#include "fe.h"
+#include "ge.h"
+#include "randombytes.h"
+#include "sc.h"
+#include "utils.h"
+
+int crypto_sign_edwards25519sha512batch_keypair(unsigned char *pk,
+                                                unsigned char *sk)
+{
+    ge_p3 A;
+
+    randombytes_buf(sk, 32);
+    crypto_hash_sha512(sk, sk, 32);
+    sk[0] &= 248;
+    sk[31] &= 63;
+    sk[31] |= 64;
+    ge_scalarmult_base(&A, sk);
+    ge_p3_tobytes(pk, &A);
+
+    return 0;
+}
+
+int crypto_sign_edwards25519sha512batch(unsigned char *sm,
+                                        unsigned long long *smlen_p,
+                                        const unsigned char *m,
+                                        unsigned long long mlen,
+                                        const unsigned char *sk)
+{
+    crypto_hash_sha512_state hs;
+    unsigned char nonce[64];
+    unsigned char hram[64];
+    unsigned char sig[64];
+    ge_p3 A;
+    ge_p3 R;
+
+    crypto_hash_sha512_init(&hs);
+    crypto_hash_sha512_update(&hs, sk + 32, 32);
+    crypto_hash_sha512_update(&hs, m, mlen);
+    crypto_hash_sha512_final(&hs, nonce);
+    ge_scalarmult_base(&A, sk);
+    ge_p3_tobytes(sig + 32, &A);
+    sc_reduce(nonce);
+    ge_scalarmult_base(&R, nonce);
+    ge_p3_tobytes(sig, &R);
+    crypto_hash_sha512_init(&hs);
+    crypto_hash_sha512_update(&hs, sig, 32);
+    crypto_hash_sha512_update(&hs, m, mlen);
+    crypto_hash_sha512_final(&hs, hram);
+    sc_reduce(hram);
+    sc_muladd(sig + 32, hram, nonce, sk);
+    sodium_memzero(hram, sizeof hram);
+    memmove(sm + 32, m, (size_t) mlen);
+    memcpy(sm, sig, 32);
+    memcpy(sm + 32 + mlen, sig + 32, 32);
+    *smlen_p = mlen + 64U;
+
+    return 0;
+}
+
+int crypto_sign_edwards25519sha512batch_open(unsigned char *m,
+                                             unsigned long long *mlen_p,
+                                             const unsigned char *sm,
+                                             unsigned long long smlen,
+                                             const unsigned char *pk)
+{
+    unsigned char h[64];
+    unsigned char t1[32], t2[32];
+    unsigned long long mlen;
+    ge_cached Ai;
+    ge_p1p1 csa;
+    ge_p2 cs;
+    ge_p3 A;
+    ge_p3 R;
+    ge_p3 cs3;
+
+    *mlen_p = 0;
+    if (smlen < 64 || smlen > SIZE_MAX) {
+        return -1;
+    }
+    mlen = smlen - 64;
+    if (sm[smlen - 1] & 224) {
+        return -1;
+    }
+    if (ge_frombytes_negate_vartime(&A, pk) != 0 ||
+        ge_frombytes_negate_vartime(&R, sm) != 0) {
+        return -1;
+    }
+    ge_p3_to_cached(&Ai, &A);
+    crypto_hash_sha512(h, sm, mlen + 32);
+    sc_reduce(h);
+    ge_scalarmult_vartime(&cs3, h, &R);
+    ge_add(&csa, &cs3, &Ai);
+    ge_p1p1_to_p2(&cs, &csa);
+    ge_tobytes(t1, &cs);
+    t1[31] ^= 1 << 7;
+    ge_scalarmult_base(&R, sm + 32 + mlen);
+    ge_p3_tobytes(t2, &R);
+    if (crypto_verify_32(t1, t2) != 0) {
+        return -1;
+    }
+    *mlen_p = mlen;
+    memmove(m, sm + 64, mlen);
+
+    return 0;
+}

data/vendor/libsodium/src/libsodium/crypto_sign/ed25519/ref10/open.c

@@ -1,17 +1,20 @@
 
 #include <limits.h>
+#include <stdint.h>
 #include <string.h>
 
-#include "api.h"
 #include "crypto_hash_sha512.h"
+#include "crypto_sign_ed25519.h"
 #include "crypto_verify_32.h"
 #include "ge.h"
 #include "sc.h"
 #include "utils.h"
 
 int
-crypto_sign_verify_detached(const unsigned char *sig, const unsigned char *m,
-                            unsigned long long mlen, const unsigned char *pk)
+crypto_sign_ed25519_verify_detached(const unsigned char *sig,
+                                    const unsigned char *m,
+                                    unsigned long long mlen,
+                                    const unsigned char *pk)
 {
     crypto_hash_sha512_state hs;
     unsigned char h[64];
@@ -48,9 +51,9 @@ crypto_sign_verify_detached(const unsigned char *sig, const unsigned char *m,
 }
 
 int
-crypto_sign_open(unsigned char *m, unsigned long long *mlen_p,
-                 const unsigned char *sm, unsigned long long smlen,
-                 const unsigned char *pk)
+crypto_sign_ed25519_open(unsigned char *m, unsigned long long *mlen_p,
+                         const unsigned char *sm, unsigned long long smlen,
+                         const unsigned char *pk)
 {
     unsigned long long mlen;
 
@@ -58,7 +61,7 @@ crypto_sign_open(unsigned char *m, unsigned long long *mlen_p,
         goto badsig;
     }
     mlen = smlen - 64;
-    if (crypto_sign_verify_detached(sm, sm + 64, mlen, pk) != 0) {
+    if (crypto_sign_ed25519_verify_detached(sm, sm + 64, mlen, pk) != 0) {
         memset(m, 0, mlen);
         goto badsig;
     }

data/vendor/libsodium/src/libsodium/crypto_sign/ed25519/ref10/sign.c

@@ -1,16 +1,16 @@
 
 #include <string.h>
 
-#include "api.h"
 #include "crypto_hash_sha512.h"
+#include "crypto_sign_ed25519.h"
 #include "ge.h"
 #include "sc.h"
 #include "utils.h"
 
 int
-crypto_sign_detached(unsigned char *sig, unsigned long long *siglen_p,
-                     const unsigned char *m, unsigned long long mlen,
-                     const unsigned char *sk)
+crypto_sign_ed25519_detached(unsigned char *sig, unsigned long long *siglen_p,
+                             const unsigned char *m, unsigned long long mlen,
+                             const unsigned char *sk)
 {
     crypto_hash_sha512_state hs;
     unsigned char az[64];
@@ -43,7 +43,6 @@ crypto_sign_detached(unsigned char *sig, unsigned long long *siglen_p,
     sc_muladd(sig + 32, hram, az, nonce);
 
     sodium_memzero(az, sizeof az);
-    sodium_memzero(nonce, sizeof nonce);
 
     if (siglen_p != NULL) {
         *siglen_p = 64U;
@@ -52,16 +51,17 @@ crypto_sign_detached(unsigned char *sig, unsigned long long *siglen_p,
 }
 
 int
-crypto_sign(unsigned char *sm, unsigned long long *smlen_p,
-            const unsigned char *m, unsigned long long mlen,
-            const unsigned char *sk)
+crypto_sign_ed25519(unsigned char *sm, unsigned long long *smlen_p,
+                    const unsigned char *m, unsigned long long mlen,
+                    const unsigned char *sk)
 {
     unsigned long long siglen;
 
     memmove(sm + crypto_sign_ed25519_BYTES, m, mlen);
 /* LCOV_EXCL_START */
-    if (crypto_sign_detached(sm, &siglen, sm + crypto_sign_ed25519_BYTES,
-                             mlen, sk) != 0 ||
+    if (crypto_sign_ed25519_detached(sm, &siglen,
+                                     sm + crypto_sign_ed25519_BYTES,
+                                     mlen, sk) != 0 ||
         siglen != crypto_sign_ed25519_BYTES) {
         if (smlen_p != NULL) {
             *smlen_p = 0;