ruby_nacl 0.1.0

data/ext/ruby_nacl/NaCl/crypto_scalarmult/curve25519/ref/smult.c

@@ -0,0 +1,265 @@
+/*
+version 20081011
+Matthew Dempsky
+Public domain.
+Derived from public domain code by D. J. Bernstein.
+*/
+
+#include "crypto_scalarmult.h"
+
+static void add(unsigned int out[32],const unsigned int a[32],const unsigned int b[32])
+{
+  unsigned int j;
+  unsigned int u;
+  u = 0;
+  for (j = 0;j < 31;++j) { u += a[j] + b[j]; out[j] = u & 255; u >>= 8; }
+  u += a[31] + b[31]; out[31] = u;
+}
+
+static void sub(unsigned int out[32],const unsigned int a[32],const unsigned int b[32])
+{
+  unsigned int j;
+  unsigned int u;
+  u = 218;
+  for (j = 0;j < 31;++j) {
+    u += a[j] + 65280 - b[j];
+    out[j] = u & 255;
+    u >>= 8;
+  }
+  u += a[31] - b[31];
+  out[31] = u;
+}
+
+static void squeeze(unsigned int a[32])
+{
+  unsigned int j;
+  unsigned int u;
+  u = 0;
+  for (j = 0;j < 31;++j) { u += a[j]; a[j] = u & 255; u >>= 8; }
+  u += a[31]; a[31] = u & 127;
+  u = 19 * (u >> 7);
+  for (j = 0;j < 31;++j) { u += a[j]; a[j] = u & 255; u >>= 8; }
+  u += a[31]; a[31] = u;
+}
+
+static const unsigned int minusp[32] = {
+ 19, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 128
+} ;
+
+static void freeze(unsigned int a[32])
+{
+  unsigned int aorig[32];
+  unsigned int j;
+  unsigned int negative;
+
+  for (j = 0;j < 32;++j) aorig[j] = a[j];
+  add(a,a,minusp);
+  negative = -((a[31] >> 7) & 1);
+  for (j = 0;j < 32;++j) a[j] ^= negative & (aorig[j] ^ a[j]);
+}
+
+static void mult(unsigned int out[32],const unsigned int a[32],const unsigned int b[32])
+{
+  unsigned int i;
+  unsigned int j;
+  unsigned int u;
+
+  for (i = 0;i < 32;++i) {
+    u = 0;
+    for (j = 0;j <= i;++j) u += a[j] * b[i - j];
+    for (j = i + 1;j < 32;++j) u += 38 * a[j] * b[i + 32 - j];
+    out[i] = u;
+  }
+  squeeze(out);
+}
+
+static void mult121665(unsigned int out[32],const unsigned int a[32])
+{
+  unsigned int j;
+  unsigned int u;
+
+  u = 0;
+  for (j = 0;j < 31;++j) { u += 121665 * a[j]; out[j] = u & 255; u >>= 8; }
+  u += 121665 * a[31]; out[31] = u & 127;
+  u = 19 * (u >> 7);
+  for (j = 0;j < 31;++j) { u += out[j]; out[j] = u & 255; u >>= 8; }
+  u += out[j]; out[j] = u;
+}
+
+static void square(unsigned int out[32],const unsigned int a[32])
+{
+  unsigned int i;
+  unsigned int j;
+  unsigned int u;
+
+  for (i = 0;i < 32;++i) {
+    u = 0;
+    for (j = 0;j < i - j;++j) u += a[j] * a[i - j];
+    for (j = i + 1;j < i + 32 - j;++j) u += 38 * a[j] * a[i + 32 - j];
+    u *= 2;
+    if ((i & 1) == 0) {
+      u += a[i / 2] * a[i / 2];
+      u += 38 * a[i / 2 + 16] * a[i / 2 + 16];
+    }
+    out[i] = u;
+  }
+  squeeze(out);
+}
+
+static void select(unsigned int p[64],unsigned int q[64],const unsigned int r[64],const unsigned int s[64],unsigned int b)
+{
+  unsigned int j;
+  unsigned int t;
+  unsigned int bminus1;
+
+  bminus1 = b - 1;
+  for (j = 0;j < 64;++j) {
+    t = bminus1 & (r[j] ^ s[j]);
+    p[j] = s[j] ^ t;
+    q[j] = r[j] ^ t;
+  }
+}
+
+static void mainloop(unsigned int work[64],const unsigned char e[32])
+{
+  unsigned int xzm1[64];
+  unsigned int xzm[64];
+  unsigned int xzmb[64];
+  unsigned int xzm1b[64];
+  unsigned int xznb[64];
+  unsigned int xzn1b[64];
+  unsigned int a0[64];
+  unsigned int a1[64];
+  unsigned int b0[64];
+  unsigned int b1[64];
+  unsigned int c1[64];
+  unsigned int r[32];
+  unsigned int s[32];
+  unsigned int t[32];
+  unsigned int u[32];
+  unsigned int i;
+  unsigned int j;
+  unsigned int b;
+  int pos;
+
+  for (j = 0;j < 32;++j) xzm1[j] = work[j];
+  xzm1[32] = 1;
+  for (j = 33;j < 64;++j) xzm1[j] = 0;
+
+  xzm[0] = 1;
+  for (j = 1;j < 64;++j) xzm[j] = 0;
+
+  for (pos = 254;pos >= 0;--pos) {
+    b = e[pos / 8] >> (pos & 7);
+    b &= 1;
+    select(xzmb,xzm1b,xzm,xzm1,b);
+    add(a0,xzmb,xzmb + 32);
+    sub(a0 + 32,xzmb,xzmb + 32);
+    add(a1,xzm1b,xzm1b + 32);
+    sub(a1 + 32,xzm1b,xzm1b + 32);
+    square(b0,a0);
+    square(b0 + 32,a0 + 32);
+    mult(b1,a1,a0 + 32);
+    mult(b1 + 32,a1 + 32,a0);
+    add(c1,b1,b1 + 32);
+    sub(c1 + 32,b1,b1 + 32);
+    square(r,c1 + 32);
+    sub(s,b0,b0 + 32);
+    mult121665(t,s);
+    add(u,t,b0);
+    mult(xznb,b0,b0 + 32);
+    mult(xznb + 32,s,u);
+    square(xzn1b,c1);
+    mult(xzn1b + 32,r,work);
+    select(xzm,xzm1,xznb,xzn1b,b);
+  }
+
+  for (j = 0;j < 64;++j) work[j] = xzm[j];
+}
+
+static void recip(unsigned int out[32],const unsigned int z[32])
+{
+  unsigned int z2[32];
+  unsigned int z9[32];
+  unsigned int z11[32];
+  unsigned int z2_5_0[32];
+  unsigned int z2_10_0[32];
+  unsigned int z2_20_0[32];
+  unsigned int z2_50_0[32];
+  unsigned int z2_100_0[32];
+  unsigned int t0[32];
+  unsigned int t1[32];
+  int i;
+
+  /* 2 */ square(z2,z);
+  /* 4 */ square(t1,z2);
+  /* 8 */ square(t0,t1);
+  /* 9 */ mult(z9,t0,z);
+  /* 11 */ mult(z11,z9,z2);
+  /* 22 */ square(t0,z11);
+  /* 2^5 - 2^0 = 31 */ mult(z2_5_0,t0,z9);
+
+  /* 2^6 - 2^1 */ square(t0,z2_5_0);
+  /* 2^7 - 2^2 */ square(t1,t0);
+  /* 2^8 - 2^3 */ square(t0,t1);
+  /* 2^9 - 2^4 */ square(t1,t0);
+  /* 2^10 - 2^5 */ square(t0,t1);
+  /* 2^10 - 2^0 */ mult(z2_10_0,t0,z2_5_0);
+
+  /* 2^11 - 2^1 */ square(t0,z2_10_0);
+  /* 2^12 - 2^2 */ square(t1,t0);
+  /* 2^20 - 2^10 */ for (i = 2;i < 10;i += 2) { square(t0,t1); square(t1,t0); }
+  /* 2^20 - 2^0 */ mult(z2_20_0,t1,z2_10_0);
+
+  /* 2^21 - 2^1 */ square(t0,z2_20_0);
+  /* 2^22 - 2^2 */ square(t1,t0);
+  /* 2^40 - 2^20 */ for (i = 2;i < 20;i += 2) { square(t0,t1); square(t1,t0); }
+  /* 2^40 - 2^0 */ mult(t0,t1,z2_20_0);
+
+  /* 2^41 - 2^1 */ square(t1,t0);
+  /* 2^42 - 2^2 */ square(t0,t1);
+  /* 2^50 - 2^10 */ for (i = 2;i < 10;i += 2) { square(t1,t0); square(t0,t1); }
+  /* 2^50 - 2^0 */ mult(z2_50_0,t0,z2_10_0);
+
+  /* 2^51 - 2^1 */ square(t0,z2_50_0);
+  /* 2^52 - 2^2 */ square(t1,t0);
+  /* 2^100 - 2^50 */ for (i = 2;i < 50;i += 2) { square(t0,t1); square(t1,t0); }
+  /* 2^100 - 2^0 */ mult(z2_100_0,t1,z2_50_0);
+
+  /* 2^101 - 2^1 */ square(t1,z2_100_0);
+  /* 2^102 - 2^2 */ square(t0,t1);
+  /* 2^200 - 2^100 */ for (i = 2;i < 100;i += 2) { square(t1,t0); square(t0,t1); }
+  /* 2^200 - 2^0 */ mult(t1,t0,z2_100_0);
+
+  /* 2^201 - 2^1 */ square(t0,t1);
+  /* 2^202 - 2^2 */ square(t1,t0);
+  /* 2^250 - 2^50 */ for (i = 2;i < 50;i += 2) { square(t0,t1); square(t1,t0); }
+  /* 2^250 - 2^0 */ mult(t0,t1,z2_50_0);
+
+  /* 2^251 - 2^1 */ square(t1,t0);
+  /* 2^252 - 2^2 */ square(t0,t1);
+  /* 2^253 - 2^3 */ square(t1,t0);
+  /* 2^254 - 2^4 */ square(t0,t1);
+  /* 2^255 - 2^5 */ square(t1,t0);
+  /* 2^255 - 21 */ mult(out,t1,z11);
+}
+
+int crypto_scalarmult(unsigned char *q,
+  const unsigned char *n,
+  const unsigned char *p)
+{
+  unsigned int work[96];
+  unsigned char e[32];
+  unsigned int i;
+  for (i = 0;i < 32;++i) e[i] = n[i];
+  e[0] &= 248;
+  e[31] &= 127;
+  e[31] |= 64;
+  for (i = 0;i < 32;++i) work[i] = p[i];
+  mainloop(work,e);
+  recip(work + 32,work + 32);
+  mult(work + 64,work,work + 32);
+  freeze(work + 64);
+  for (i = 0;i < 32;++i) q[i] = work[64 + i];
+  return 0;
+}

data/ext/ruby_nacl/NaCl/crypto_scalarmult/measure.c

@@ -0,0 +1,61 @@
+#include <stdlib.h>
+#include "randombytes.h"
+#include "cpucycles.h"
+#include "crypto_scalarmult.h"
+
+extern void printentry(long long,const char *,long long *,long long);
+extern unsigned char *alignedcalloc(unsigned long long);
+extern const char *primitiveimplementation;
+extern const char *implementationversion;
+extern const char *sizenames[];
+extern const long long sizes[];
+extern void allocate(void);
+extern void measure(void);
+
+const char *primitiveimplementation = crypto_scalarmult_IMPLEMENTATION;
+const char *implementationversion = crypto_scalarmult_VERSION;
+const char *sizenames[] = { "outputbytes", "scalarbytes", 0 };
+const long long sizes[] = { crypto_scalarmult_BYTES, crypto_scalarmult_SCALARBYTES };
+
+static unsigned char *m;
+static unsigned char *n;
+static unsigned char *p;
+static unsigned char *q;
+
+void preallocate(void)
+{
+}
+
+void allocate(void)
+{
+  m = alignedcalloc(crypto_scalarmult_SCALARBYTES);
+  n = alignedcalloc(crypto_scalarmult_SCALARBYTES);
+  p = alignedcalloc(crypto_scalarmult_BYTES);
+  q = alignedcalloc(crypto_scalarmult_BYTES);
+}
+
+#define TIMINGS 63
+static long long cycles[TIMINGS + 1];
+
+void measure(void)
+{
+  int i;
+  int loop;
+
+  for (loop = 0;loop < LOOPS;++loop) {
+    randombytes(m,crypto_scalarmult_SCALARBYTES);
+    randombytes(n,crypto_scalarmult_SCALARBYTES);
+    for (i = 0;i <= TIMINGS;++i) {
+      cycles[i] = cpucycles();
+      crypto_scalarmult_base(p,m);
+    }
+    for (i = 0;i < TIMINGS;++i) cycles[i] = cycles[i + 1] - cycles[i];
+    printentry(-1,"base_cycles",cycles,TIMINGS);
+    for (i = 0;i <= TIMINGS;++i) {
+      cycles[i] = cpucycles();
+      crypto_scalarmult(q,n,p);
+    }
+    for (i = 0;i < TIMINGS;++i) cycles[i] = cycles[i + 1] - cycles[i];
+    printentry(-1,"cycles",cycles,TIMINGS);
+  }
+}

data/ext/ruby_nacl/NaCl/crypto_scalarmult/try.c

@@ -0,0 +1,126 @@
+/*
+ * crypto_scalarmult/try.c version 20090118
+ * D. J. Bernstein
+ * Public domain.
+ */
+
+#include <stdlib.h>
+#include "crypto_scalarmult.h"
+
+extern unsigned char *alignedcalloc(unsigned long long);
+
+const char *primitiveimplementation = crypto_scalarmult_IMPLEMENTATION;
+
+#define mlen crypto_scalarmult_SCALARBYTES
+#define nlen crypto_scalarmult_SCALARBYTES
+#define plen crypto_scalarmult_BYTES
+#define qlen crypto_scalarmult_BYTES
+#define rlen crypto_scalarmult_BYTES
+
+static unsigned char *m;
+static unsigned char *n;
+static unsigned char *p;
+static unsigned char *q;
+static unsigned char *r;
+
+static unsigned char *m2;
+static unsigned char *n2;
+static unsigned char *p2;
+static unsigned char *q2;
+static unsigned char *r2;
+
+void preallocate(void)
+{
+}
+
+void allocate(void)
+{
+  m = alignedcalloc(mlen);
+  n = alignedcalloc(nlen);
+  p = alignedcalloc(plen);
+  q = alignedcalloc(qlen);
+  r = alignedcalloc(rlen);
+  m2 = alignedcalloc(mlen + crypto_scalarmult_BYTES);
+  n2 = alignedcalloc(nlen + crypto_scalarmult_BYTES);
+  p2 = alignedcalloc(plen + crypto_scalarmult_BYTES);
+  q2 = alignedcalloc(qlen + crypto_scalarmult_BYTES);
+  r2 = alignedcalloc(rlen + crypto_scalarmult_BYTES);
+}
+
+void predoit(void)
+{
+}
+
+void doit(void)
+{
+  crypto_scalarmult(q,n,p);
+  crypto_scalarmult_base(r,n);
+}
+
+char checksum[crypto_scalarmult_BYTES * 2 + 1];
+
+const char *checksum_compute(void)
+{
+  long long i;
+  long long j;
+  long long tests;
+
+  for (i = 0;i < mlen;++i) m[i] = i;
+  for (i = 0;i < nlen;++i) n[i] = i + 1;
+  for (i = 0;i < plen;++i) p[i] = i + 2;
+  for (i = 0;i < qlen;++i) q[i] = i + 3;
+  for (i = 0;i < rlen;++i) r[i] = i + 4;
+
+  for (i = -16;i < 0;++i) p[i] = random();
+  for (i = -16;i < 0;++i) n[i] = random();
+  for (i = plen;i < plen + 16;++i) p[i] = random();
+  for (i = nlen;i < nlen + 16;++i) n[i] = random();
+  for (i = -16;i < plen + 16;++i) p2[i] = p[i];
+  for (i = -16;i < nlen + 16;++i) n2[i] = n[i];
+
+  if (crypto_scalarmult_base(p,n) != 0) return "crypto_scalarmult_base returns nonzero";
+
+  for (i = -16;i < nlen + 16;++i) if (n2[i] != n[i]) return "crypto_scalarmult_base overwrites input";
+  for (i = -16;i < 0;++i) if (p2[i] != p[i]) return "crypto_scalarmult_base writes before output";
+  for (i = plen;i < plen + 16;++i) if (p2[i] != p[i]) return "crypto_scalarmult_base writes after output";
+
+  for (tests = 0;tests < 100;++tests) {
+    for (i = -16;i < 0;++i) q[i] = random();
+    for (i = -16;i < 0;++i) p[i] = random();
+    for (i = -16;i < 0;++i) m[i] = random();
+    for (i = qlen;i < qlen + 16;++i) q[i] = random();
+    for (i = plen;i < plen + 16;++i) p[i] = random();
+    for (i = mlen;i < mlen + 16;++i) m[i] = random();
+    for (i = -16;i < qlen + 16;++i) q2[i] = q[i];
+    for (i = -16;i < plen + 16;++i) p2[i] = p[i];
+    for (i = -16;i < mlen + 16;++i) m2[i] = m[i];
+
+    if (crypto_scalarmult(q,m,p) != 0) return "crypto_scalarmult returns nonzero";
+
+    for (i = -16;i < mlen + 16;++i) if (m2[i] != m[i]) return "crypto_scalarmult overwrites n input";
+    for (i = -16;i < plen + 16;++i) if (p2[i] != p[i]) return "crypto_scalarmult overwrites p input";
+    for (i = -16;i < 0;++i) if (q2[i] != q[i]) return "crypto_scalarmult writes before output";
+    for (i = qlen;i < qlen + 16;++i) if (q2[i] != q[i]) return "crypto_scalarmult writes after output";
+
+    if (crypto_scalarmult(m2,m2,p) != 0) return "crypto_scalarmult returns nonzero";
+    for (i = 0;i < qlen;++i) if (q[i] != m2[i]) return "crypto_scalarmult does not handle n overlap";
+    for (i = 0;i < qlen;++i) m2[i] = m[i];
+
+    if (crypto_scalarmult(p2,m2,p2) != 0) return "crypto_scalarmult returns nonzero";
+    for (i = 0;i < qlen;++i) if (q[i] != p2[i]) return "crypto_scalarmult does not handle p overlap";
+
+    if (crypto_scalarmult(r,n,q) != 0) return "crypto_scalarmult returns nonzero";
+    if (crypto_scalarmult(q,n,p) != 0) return "crypto_scalarmult returns nonzero";
+    if (crypto_scalarmult(p,m,q) != 0) return "crypto_scalarmult returns nonzero";
+    for (j = 0;j < plen;++j) if (p[j] != r[j]) return "crypto_scalarmult not associative";
+    for (j = 0;j < mlen;++j) m[j] ^= q[j % qlen];
+    for (j = 0;j < nlen;++j) n[j] ^= p[j % plen];
+  }
+
+  for (i = 0;i < crypto_scalarmult_BYTES;++i) {
+    checksum[2 * i] = "0123456789abcdef"[15 & (p[i] >> 4)];
+    checksum[2 * i + 1] = "0123456789abcdef"[15 & p[i]];
+  }
+  checksum[2 * i] = 0;
+  return 0;
+}

data/ext/ruby_nacl/NaCl/crypto_scalarmult/wrapper-base.cpp

@@ -0,0 +1,11 @@
+#include <string>
+using std::string;
+#include "crypto_scalarmult.h"
+
+string crypto_scalarmult_base(const string &n)
+{
+  unsigned char q[crypto_scalarmult_BYTES];
+  if (n.size() != crypto_scalarmult_SCALARBYTES) throw "incorrect scalar length";
+  crypto_scalarmult_base(q,(const unsigned char *) n.c_str());
+  return string((char *) q,sizeof q);
+}

data/ext/ruby_nacl/NaCl/crypto_scalarmult/wrapper-mult.cpp

@@ -0,0 +1,12 @@
+#include <string>
+using std::string;
+#include "crypto_scalarmult.h"
+
+string crypto_scalarmult(const string &n,const string &p)
+{
+  unsigned char q[crypto_scalarmult_BYTES];
+  if (n.size() != crypto_scalarmult_SCALARBYTES) throw "incorrect scalar length";
+  if (p.size() != crypto_scalarmult_BYTES) throw "incorrect element length";
+  crypto_scalarmult(q,(const unsigned char *) n.c_str(),(const unsigned char *) p.c_str());
+  return string((char *) q,sizeof q);
+}

data/ext/ruby_nacl/NaCl/crypto_secretbox/measure.c

@@ -0,0 +1,75 @@
+#include <stdlib.h>
+#include "randombytes.h"
+#include "cpucycles.h"
+#include "crypto_secretbox.h"
+
+extern void printentry(long long,const char *,long long *,long long);
+extern unsigned char *alignedcalloc(unsigned long long);
+extern const char *primitiveimplementation;
+extern const char *implementationversion;
+extern const char *sizenames[];
+extern const long long sizes[];
+extern void allocate(void);
+extern void measure(void);
+
+const char *primitiveimplementation = crypto_secretbox_IMPLEMENTATION;
+const char *implementationversion = crypto_secretbox_VERSION;
+const char *sizenames[] = { "keybytes", "noncebytes", "zerobytes", "boxzerobytes", 0 };
+const long long sizes[] = { crypto_secretbox_KEYBYTES, crypto_secretbox_NONCEBYTES, crypto_secretbox_ZEROBYTES, crypto_secretbox_BOXZEROBYTES };
+
+#define MAXTEST_BYTES 4096
+
+static unsigned char *k;
+static unsigned char *n;
+static unsigned char *m;
+static unsigned char *c;
+
+void preallocate(void)
+{
+}
+
+void allocate(void)
+{
+  k = alignedcalloc(crypto_secretbox_KEYBYTES);
+  n = alignedcalloc(crypto_secretbox_NONCEBYTES);
+  m = alignedcalloc(MAXTEST_BYTES + crypto_secretbox_ZEROBYTES);
+  c = alignedcalloc(MAXTEST_BYTES + crypto_secretbox_ZEROBYTES);
+}
+
+#define TIMINGS 15
+static long long cycles[TIMINGS + 1];
+
+void measure(void)
+{
+  int i;
+  int loop;
+  int mlen;
+
+  for (loop = 0;loop < LOOPS;++loop) {
+    for (mlen = 0;mlen <= MAXTEST_BYTES;mlen += 1 + mlen / 8) {
+      randombytes(k,crypto_secretbox_KEYBYTES);
+      randombytes(n,crypto_secretbox_NONCEBYTES);
+      randombytes(m + crypto_secretbox_ZEROBYTES,mlen);
+      randombytes(c,mlen + crypto_secretbox_ZEROBYTES);
+      for (i = 0;i <= TIMINGS;++i) {
+        cycles[i] = cpucycles();
+	crypto_secretbox(c,m,mlen + crypto_secretbox_ZEROBYTES,n,k);
+      }
+      for (i = 0;i < TIMINGS;++i) cycles[i] = cycles[i + 1] - cycles[i];
+      printentry(mlen,"cycles",cycles,TIMINGS);
+      for (i = 0;i <= TIMINGS;++i) {
+        cycles[i] = cpucycles();
+	crypto_secretbox_open(m,c,mlen + crypto_secretbox_ZEROBYTES,n,k);
+      }
+      for (i = 0;i < TIMINGS;++i) cycles[i] = cycles[i + 1] - cycles[i];
+      printentry(mlen,"open_cycles",cycles,TIMINGS);
+      ++c[crypto_secretbox_ZEROBYTES];
+      for (i = 0;i <= TIMINGS;++i) {
+        cycles[i] = cpucycles();
+	crypto_secretbox_open(m,c,mlen + crypto_secretbox_ZEROBYTES,n,k);
+      }
+      for (i = 0;i < TIMINGS;++i) cycles[i] = cycles[i + 1] - cycles[i];
+      printentry(mlen,"forgery_open_cycles",cycles,TIMINGS);
+    }
+  }
+}

data/ext/ruby_nacl/NaCl/crypto_secretbox/try.c

@@ -0,0 +1,129 @@
+/*
+ * crypto_secretbox/try.c version 20090118
+ * D. J. Bernstein
+ * Public domain.
+ */
+
+#include "crypto_secretbox.h"
+
+extern unsigned char *alignedcalloc(unsigned long long);
+
+const char *primitiveimplementation = crypto_secretbox_IMPLEMENTATION;
+
+#define MAXTEST_BYTES 10000
+#define CHECKSUM_BYTES 4096
+#define TUNE_BYTES 1536
+
+static unsigned char *k;
+static unsigned char *n;
+static unsigned char *m;
+static unsigned char *c;
+static unsigned char *t;
+static unsigned char *k2;
+static unsigned char *n2;
+static unsigned char *m2;
+static unsigned char *c2;
+static unsigned char *t2;
+
+#define klen crypto_secretbox_KEYBYTES
+#define nlen crypto_secretbox_NONCEBYTES
+
+void preallocate(void)
+{
+}
+
+void allocate(void)
+{
+  k = alignedcalloc(klen);
+  n = alignedcalloc(nlen);
+  m = alignedcalloc(MAXTEST_BYTES + crypto_secretbox_ZEROBYTES);
+  c = alignedcalloc(MAXTEST_BYTES + crypto_secretbox_ZEROBYTES);
+  t = alignedcalloc(MAXTEST_BYTES + crypto_secretbox_ZEROBYTES);
+  k2 = alignedcalloc(klen);
+  n2 = alignedcalloc(nlen);
+  m2 = alignedcalloc(MAXTEST_BYTES + crypto_secretbox_ZEROBYTES);
+  c2 = alignedcalloc(MAXTEST_BYTES + crypto_secretbox_ZEROBYTES);
+  t2 = alignedcalloc(MAXTEST_BYTES + crypto_secretbox_ZEROBYTES);
+}
+
+void predoit(void)
+{
+}
+
+void doit(void)
+{
+  crypto_secretbox(c,m,TUNE_BYTES + crypto_secretbox_ZEROBYTES,n,k);
+  crypto_secretbox_open(t,c,TUNE_BYTES + crypto_secretbox_ZEROBYTES,n,k);
+}
+
+char checksum[klen * 2 + 1];
+
+const char *checksum_compute(void)
+{
+  long long i;
+  long long j;
+
+  for (j = 0;j < crypto_secretbox_ZEROBYTES;++j) m[j] = 0;
+
+  for (i = 0;i < CHECKSUM_BYTES;++i) {
+    long long mlen = i + crypto_secretbox_ZEROBYTES;
+    long long tlen = i + crypto_secretbox_ZEROBYTES;
+    long long clen = i + crypto_secretbox_ZEROBYTES;
+
+    for (j = -16;j < 0;++j) k[j] = random();
+    for (j = -16;j < 0;++j) n[j] = random();
+    for (j = -16;j < 0;++j) m[j] = random();
+    for (j = klen;j < klen + 16;++j) k[j] = random();
+    for (j = nlen;j < nlen + 16;++j) n[j] = random();
+    for (j = mlen;j < mlen + 16;++j) m[j] = random();
+    for (j = -16;j < klen + 16;++j) k2[j] = k[j];
+    for (j = -16;j < nlen + 16;++j) n2[j] = n[j];
+    for (j = -16;j < mlen + 16;++j) m2[j] = m[j];
+    for (j = -16;j < clen + 16;++j) c2[j] = c[j] = random();
+
+    if (crypto_secretbox(c,m,mlen,n,k) != 0) return "crypto_secretbox returns nonzero";
+
+    for (j = -16;j < mlen + 16;++j) if (m2[j] != m[j]) return "crypto_secretbox overwrites m";
+    for (j = -16;j < nlen + 16;++j) if (n2[j] != n[j]) return "crypto_secretbox overwrites n";
+    for (j = -16;j < klen + 16;++j) if (k2[j] != k[j]) return "crypto_secretbox overwrites k";
+    for (j = -16;j < 0;++j) if (c2[j] != c[j]) return "crypto_secretbox writes before output";
+    for (j = clen;j < clen + 16;++j) if (c2[j] != c[j]) return "crypto_secretbox writes after output";
+    for (j = 0;j < crypto_secretbox_BOXZEROBYTES;++j)
+      if (c[j] != 0) return "crypto_secretbox does not clear extra bytes";
+
+    for (j = -16;j < 0;++j) c[j] = random();
+    for (j = clen;j < clen + 16;++j) c[j] = random();
+    for (j = -16;j < clen + 16;++j) c2[j] = c[j];
+    for (j = -16;j < tlen + 16;++j) t2[j] = t[j] = random();
+
+    if (crypto_secretbox_open(t,c,clen,n,k) != 0) return "crypto_secretbox_open returns nonzero";
+
+    for (j = -16;j < clen + 16;++j) if (c2[j] != c[j]) return "crypto_secretbox_open overwrites c";
+    for (j = -16;j < nlen + 16;++j) if (n2[j] != n[j]) return "crypto_secretbox_open overwrites n";
+    for (j = -16;j < klen + 16;++j) if (k2[j] != k[j]) return "crypto_secretbox_open overwrites k";
+    for (j = -16;j < 0;++j) if (t2[j] != t[j]) return "crypto_secretbox_open writes before output";
+    for (j = tlen;j < tlen + 16;++j) if (t2[j] != t[j]) return "crypto_secretbox_open writes after output";
+    for (j = 0;j < crypto_secretbox_ZEROBYTES;++j)
+      if (t[j] != 0) return "crypto_secretbox_open does not clear extra bytes";
+    
+    for (j = 0;j < i;++j) if (t[j] != m[j]) return "plaintext does not match";
+    
+    for (j = 0;j < i;++j)
+      k[j % klen] ^= c[j + crypto_secretbox_BOXZEROBYTES];
+    crypto_secretbox(c,m,mlen,n,k);
+    for (j = 0;j < i;++j)
+      n[j % nlen] ^= c[j + crypto_secretbox_BOXZEROBYTES];
+    crypto_secretbox(c,m,mlen,n,k);
+    if (i == 0) m[crypto_secretbox_ZEROBYTES + 0] = 0;
+    m[crypto_secretbox_ZEROBYTES + i] = m[crypto_secretbox_ZEROBYTES + 0];
+    for (j = 0;j < i;++j)
+      m[j + crypto_secretbox_ZEROBYTES] ^= c[j + crypto_secretbox_BOXZEROBYTES];
+  }
+
+  for (i = 0;i < klen;++i) {
+    checksum[2 * i] = "0123456789abcdef"[15 & (k[i] >> 4)];
+    checksum[2 * i + 1] = "0123456789abcdef"[15 & k[i]];
+  }
+  checksum[2 * i] = 0;
+  return 0;
+}

data/ext/ruby_nacl/NaCl/crypto_secretbox/wrapper-box.cpp

@@ -0,0 +1,19 @@
+#include <string>
+using std::string;
+#include "crypto_secretbox.h"
+
+string crypto_secretbox(const string &m,const string &n,const string &k)
+{
+  if (k.size() != crypto_secretbox_KEYBYTES) throw "incorrect key length";
+  if (n.size() != crypto_secretbox_NONCEBYTES) throw "incorrect nonce length";
+  size_t mlen = m.size() + crypto_secretbox_ZEROBYTES;
+  unsigned char mpad[mlen];
+  for (int i = 0;i < crypto_secretbox_ZEROBYTES;++i) mpad[i] = 0;
+  for (int i = crypto_secretbox_ZEROBYTES;i < mlen;++i) mpad[i] = m[i - crypto_secretbox_ZEROBYTES];
+  unsigned char cpad[mlen];
+  crypto_secretbox(cpad,mpad,mlen,(const unsigned char *) n.c_str(),(const unsigned char *) k.c_str());
+  return string(
+    (char *) cpad + crypto_secretbox_BOXZEROBYTES,
+    mlen - crypto_secretbox_BOXZEROBYTES
+  );
+}