@ohos-ports/react-native-quick-crypto 0.0.0-stage → 1.1.8-beta.0

package/cpp/cipher/XChaCha20Poly1305Cipher.cpp

@@ -0,0 +1,158 @@
+#include "XChaCha20Poly1305Cipher.hpp"
+
+#include <cstring>
+#include <stdexcept>
+
+#include "NitroModules/ArrayBuffer.hpp"
+#include "QuickCryptoUtils.hpp"
+
+namespace margelo::nitro::crypto {
+
+XChaCha20Poly1305Cipher::~XChaCha20Poly1305Cipher() {
+#ifdef BLSALLOC_SODIUM
+  sodium_memzero(key_, kKeySize);
+  sodium_memzero(nonce_, kNonceSize);
+  sodium_memzero(auth_tag_, kTagSize);
+  if (!data_buffer_.empty()) {
+    sodium_memzero(data_buffer_.data(), data_buffer_.size());
+  }
+  if (!aad_.empty()) {
+    sodium_memzero(aad_.data(), aad_.size());
+  }
+#else
+  std::memset(key_, 0, kKeySize);
+  std::memset(nonce_, 0, kNonceSize);
+  std::memset(auth_tag_, 0, kTagSize);
+#endif
+  data_buffer_.clear();
+  aad_.clear();
+}
+
+void XChaCha20Poly1305Cipher::init(const std::shared_ptr<ArrayBuffer> cipher_key, const std::shared_ptr<ArrayBuffer> iv) {
+  if (cipher_key->size() != kKeySize) {
+    throw std::runtime_error("XChaCha20-Poly1305 key must be 32 bytes, got " + std::to_string(cipher_key->size()) + " bytes");
+  }
+
+  if (iv->size() != kNonceSize) {
+    throw std::runtime_error("XChaCha20-Poly1305 nonce must be 24 bytes, got " + std::to_string(iv->size()) + " bytes");
+  }
+
+  std::memcpy(key_, cipher_key->data(), kKeySize);
+  std::memcpy(nonce_, iv->data(), kNonceSize);
+
+  data_buffer_.clear();
+  aad_.clear();
+  is_finalized = false;
+}
+
+std::shared_ptr<ArrayBuffer> XChaCha20Poly1305Cipher::update(const std::shared_ptr<ArrayBuffer>& data) {
+  checkNotFinalized();
+#ifndef BLSALLOC_SODIUM
+  throw std::runtime_error("XChaCha20Poly1305Cipher: libsodium must be enabled (BLSALLOC_SODIUM)");
+#else
+  size_t data_len = data->size();
+
+  size_t old_size = data_buffer_.size();
+  data_buffer_.resize(old_size + data_len);
+  std::memcpy(data_buffer_.data() + old_size, data->data(), data_len);
+
+  return std::make_shared<NativeArrayBuffer>(nullptr, 0, nullptr);
+#endif
+}
+
+std::shared_ptr<ArrayBuffer> XChaCha20Poly1305Cipher::final() {
+  checkNotFinalized();
+#ifndef BLSALLOC_SODIUM
+  throw std::runtime_error("XChaCha20Poly1305Cipher: libsodium must be enabled (BLSALLOC_SODIUM)");
+#else
+  if (is_cipher) {
+    auto ciphertext = std::make_unique<uint8_t[]>(data_buffer_.size());
+
+    int result =
+        crypto_aead_xchacha20poly1305_ietf_encrypt_detached(ciphertext.get(), auth_tag_, nullptr, data_buffer_.data(), data_buffer_.size(),
+                                                            aad_.empty() ? nullptr : aad_.data(), aad_.size(), nullptr, nonce_, key_);
+
+    if (result != 0) {
+      sodium_memzero(ciphertext.get(), data_buffer_.size());
+      throw std::runtime_error("XChaCha20Poly1305Cipher: encryption failed");
+    }
+
+    is_finalized = true;
+    size_t ct_len = data_buffer_.size();
+    uint8_t* raw_ptr = ciphertext.get();
+    return std::make_shared<NativeArrayBuffer>(ciphertext.release(), ct_len, [raw_ptr]() { delete[] raw_ptr; });
+  } else {
+    if (data_buffer_.empty()) {
+      is_finalized = true;
+      return std::make_shared<NativeArrayBuffer>(nullptr, 0, nullptr);
+    }
+
+    auto plaintext = std::make_unique<uint8_t[]>(data_buffer_.size());
+
+    int result =
+        crypto_aead_xchacha20poly1305_ietf_decrypt_detached(plaintext.get(), nullptr, data_buffer_.data(), data_buffer_.size(), auth_tag_,
+                                                            aad_.empty() ? nullptr : aad_.data(), aad_.size(), nonce_, key_);
+
+    if (result != 0) {
+      sodium_memzero(plaintext.get(), data_buffer_.size());
+      throw std::runtime_error("XChaCha20Poly1305Cipher: decryption failed - authentication tag mismatch");
+    }
+
+    is_finalized = true;
+    size_t pt_len = data_buffer_.size();
+    uint8_t* raw_ptr = plaintext.get();
+    return std::make_shared<NativeArrayBuffer>(plaintext.release(), pt_len, [raw_ptr]() { delete[] raw_ptr; });
+  }
+#endif
+}
+
+bool XChaCha20Poly1305Cipher::setAAD(const std::shared_ptr<ArrayBuffer>& data, std::optional<double> plaintextLength) {
+#ifndef BLSALLOC_SODIUM
+  throw std::runtime_error("XChaCha20Poly1305Cipher: libsodium must be enabled (BLSALLOC_SODIUM)");
+#else
+  aad_.resize(data->size());
+  std::memcpy(aad_.data(), data->data(), data->size());
+  return true;
+#endif
+}
+
+std::shared_ptr<ArrayBuffer> XChaCha20Poly1305Cipher::getAuthTag() {
+#ifndef BLSALLOC_SODIUM
+  throw std::runtime_error("XChaCha20Poly1305Cipher: libsodium must be enabled (BLSALLOC_SODIUM)");
+#else
+  if (!is_cipher) {
+    throw std::runtime_error("getAuthTag can only be called during encryption");
+  }
+  if (!is_finalized) {
+    throw std::runtime_error("getAuthTag must be called after final()");
+  }
+
+  auto tag_copy = std::make_unique<uint8_t[]>(kTagSize);
+  std::memcpy(tag_copy.get(), auth_tag_, kTagSize);
+  uint8_t* raw_ptr = tag_copy.get();
+  return std::make_shared<NativeArrayBuffer>(tag_copy.release(), kTagSize, [raw_ptr]() { delete[] raw_ptr; });
+#endif
+}
+
+bool XChaCha20Poly1305Cipher::setAuthTag(const std::shared_ptr<ArrayBuffer>& tag) {
+#ifndef BLSALLOC_SODIUM
+  throw std::runtime_error("XChaCha20Poly1305Cipher: libsodium must be enabled (BLSALLOC_SODIUM)");
+#else
+  if (is_cipher) {
+    throw std::runtime_error("setAuthTag can only be called during decryption");
+  }
+
+  if (tag->size() != kTagSize) {
+    throw std::runtime_error("XChaCha20-Poly1305 tag must be 16 bytes, got " + std::to_string(tag->size()) + " bytes");
+  }
+
+  std::memcpy(auth_tag_, tag->data(), kTagSize);
+  return true;
+#endif
+}
+
+bool XChaCha20Poly1305Cipher::setAutoPadding(bool autoPad) {
+  throw std::runtime_error("setAutoPadding is not supported for xchacha20-poly1305");
+}
+
+} // namespace margelo::nitro::crypto

package/cpp/cipher/XChaCha20Poly1305Cipher.hpp

@@ -0,0 +1,42 @@
+#pragma once
+
+#ifdef BLSALLOC_SODIUM
+#include "sodium.h"
+#else
+#define crypto_aead_xchacha20poly1305_ietf_KEYBYTES 32U
+#define crypto_aead_xchacha20poly1305_ietf_NPUBBYTES 24U
+#define crypto_aead_xchacha20poly1305_ietf_ABYTES 16U
+#endif
+
+#include <vector>
+
+#include "HybridCipher.hpp"
+
+namespace margelo::nitro::crypto {
+
+class XChaCha20Poly1305Cipher : public HybridCipher {
+ public:
+  XChaCha20Poly1305Cipher() : HybridObject(TAG) {}
+  ~XChaCha20Poly1305Cipher();
+
+  void init(const std::shared_ptr<ArrayBuffer> cipher_key, const std::shared_ptr<ArrayBuffer> iv) override;
+  std::shared_ptr<ArrayBuffer> update(const std::shared_ptr<ArrayBuffer>& data) override;
+  std::shared_ptr<ArrayBuffer> final() override;
+  bool setAAD(const std::shared_ptr<ArrayBuffer>& data, std::optional<double> plaintextLength) override;
+  std::shared_ptr<ArrayBuffer> getAuthTag() override;
+  bool setAuthTag(const std::shared_ptr<ArrayBuffer>& tag) override;
+  bool setAutoPadding(bool autoPad) override;
+
+ private:
+  static constexpr size_t kKeySize = crypto_aead_xchacha20poly1305_ietf_KEYBYTES;
+  static constexpr size_t kNonceSize = crypto_aead_xchacha20poly1305_ietf_NPUBBYTES;
+  static constexpr size_t kTagSize = crypto_aead_xchacha20poly1305_ietf_ABYTES;
+
+  uint8_t key_[kKeySize];
+  uint8_t nonce_[kNonceSize];
+  std::vector<uint8_t> aad_;
+  std::vector<uint8_t> data_buffer_;
+  uint8_t auth_tag_[kTagSize];
+};
+
+} // namespace margelo::nitro::crypto

package/cpp/cipher/XSalsa20Cipher.cpp

@@ -0,0 +1,127 @@
+#include <algorithm>
+#include <cstring>   // For std::memcpy
+#include <memory>    // For std::unique_ptr
+#include <stdexcept> // For std::runtime_error
+
+#include "NitroModules/ArrayBuffer.hpp"
+#include "QuickCryptoUtils.hpp"
+#include "XSalsa20Cipher.hpp"
+
+namespace margelo::nitro::crypto {
+
+/**
+ * Initialize the cipher with a key and a nonce (using iv argument as nonce)
+ */
+void XSalsa20Cipher::init(const std::shared_ptr<ArrayBuffer> cipher_key, const std::shared_ptr<ArrayBuffer> iv) {
+  // Validate key size
+  if (cipher_key->size() < crypto_stream_KEYBYTES) {
+    throw std::runtime_error("XSalsa20 key too short: expected " + std::to_string(crypto_stream_KEYBYTES) + " bytes, got " +
+                             std::to_string(cipher_key->size()) + " bytes.");
+  }
+  // Validate nonce size
+  if (iv->size() < crypto_stream_NONCEBYTES) {
+    throw std::runtime_error("XSalsa20 nonce too short: expected " + std::to_string(crypto_stream_NONCEBYTES) + " bytes, got " +
+                             std::to_string(iv->size()) + " bytes.");
+  }
+
+  // Copy key and nonce data
+  std::memcpy(key, cipher_key->data(), crypto_stream_KEYBYTES);
+  std::memcpy(nonce, iv->data(), crypto_stream_NONCEBYTES);
+
+  // Reset streaming state so a re-init'd cipher does not accidentally reuse
+  // keystream bytes from a previous session.
+  block_counter = 0;
+  leftover_offset = kSalsa20BlockBytes;
+
+  is_finalized = false;
+}
+
+/**
+ * xsalsa20 update — encrypts/decrypts `data` while keeping the keystream
+ * advancing across successive update() calls.
+ *
+ * Implementation notes:
+ *   1. First, drain any unused keystream bytes left over from the previous
+ *      chunk's trailing partial block.
+ *   2. Then process as many aligned whole 64-byte blocks as possible by
+ *      jumping the keystream to `block_counter` via crypto_stream_xsalsa20_xor_ic.
+ *   3. For the remaining tail (< 64 bytes), generate one full keystream
+ *      block, XOR the requested prefix, and stash the unused suffix for the
+ *      next update() call.
+ */
+std::shared_ptr<ArrayBuffer> XSalsa20Cipher::update(const std::shared_ptr<ArrayBuffer>& data) {
+  checkNotFinalized();
+#ifndef BLSALLOC_SODIUM
+  throw std::runtime_error("XSalsa20Cipher: libsodium must be enabled to use this cipher (BLSALLOC_SODIUM is not defined).");
+#else
+  const std::size_t data_size = data->size();
+
+  if (data_size == 0) {
+    return std::make_shared<NativeArrayBuffer>(nullptr, 0, nullptr);
+  }
+
+  // Owning buffer: prevents leaking `output` if we throw on the way out.
+  auto output = std::make_unique<uint8_t[]>(data_size);
+  const uint8_t* input = data->data();
+  std::size_t pos = 0;
+
+  // (1) Drain any unused keystream from the previous update()'s tail block.
+  if (leftover_offset < kSalsa20BlockBytes) {
+    const std::size_t avail = kSalsa20BlockBytes - leftover_offset;
+    const std::size_t take = std::min(avail, data_size);
+    for (std::size_t i = 0; i < take; ++i) {
+      output[i] = input[i] ^ leftover_keystream[leftover_offset + i];
+    }
+    leftover_offset += take;
+    pos = take;
+  }
+
+  // (2) Encrypt the aligned whole blocks at the current block counter.
+  const std::size_t remaining = data_size - pos;
+  const std::size_t whole_blocks = remaining / kSalsa20BlockBytes;
+  const std::size_t whole_bytes = whole_blocks * kSalsa20BlockBytes;
+  if (whole_bytes > 0) {
+    int rc = crypto_stream_xsalsa20_xor_ic(output.get() + pos, input + pos, whole_bytes, nonce, block_counter, key);
+    if (rc != 0) {
+      throw std::runtime_error("XSalsa20Cipher: crypto_stream_xsalsa20_xor_ic failed");
+    }
+    block_counter += whole_blocks;
+    pos += whole_bytes;
+  }
+
+  // (3) For any trailing partial block, generate one full keystream block,
+  //     XOR the requested prefix, and stash the unused keystream bytes for
+  //     the next update() call.
+  const std::size_t tail = data_size - pos;
+  if (tail > 0) {
+    uint8_t zeros[kSalsa20BlockBytes] = {};
+    int rc = crypto_stream_xsalsa20_xor_ic(leftover_keystream, zeros, kSalsa20BlockBytes, nonce, block_counter, key);
+    if (rc != 0) {
+      throw std::runtime_error("XSalsa20Cipher: crypto_stream_xsalsa20_xor_ic failed");
+    }
+    for (std::size_t i = 0; i < tail; ++i) {
+      output[pos + i] = input[pos + i] ^ leftover_keystream[i];
+    }
+    leftover_offset = tail;
+    block_counter += 1;
+  }
+
+  uint8_t* raw = output.release();
+  return std::make_shared<NativeArrayBuffer>(raw, data_size, [=]() { delete[] raw; });
+#endif
+}
+
+/**
+ * xsalsa20 does not have a final step, returns empty buffer
+ */
+std::shared_ptr<ArrayBuffer> XSalsa20Cipher::final() {
+  checkNotFinalized();
+#ifndef BLSALLOC_SODIUM
+  throw std::runtime_error("XSalsa20Cipher: libsodium must be enabled to use this cipher (BLSALLOC_SODIUM is not defined).");
+#else
+  is_finalized = true;
+  return std::make_shared<NativeArrayBuffer>(nullptr, 0, nullptr);
+#endif
+}
+
+} // namespace margelo::nitro::crypto

package/cpp/cipher/XSalsa20Cipher.hpp

@@ -0,0 +1,55 @@
+#pragma once
+
+#if BLSALLOC_SODIUM
+#include "sodium.h"
+#else
+// Define XSalsa20 constants when sodium is disabled (for compilation purposes)
+#define crypto_stream_KEYBYTES 32   // XSalsa20 key size (32 bytes)
+#define crypto_stream_NONCEBYTES 24 // XSalsa20 nonce size (24 bytes)
+#endif
+
+#include <cstddef>
+#include <cstdint>
+
+#include "HybridCipher.hpp"
+#include "NitroModules/ArrayBuffer.hpp"
+#include "QuickCryptoUtils.hpp"
+
+namespace margelo::nitro::crypto {
+
+class XSalsa20Cipher : public HybridCipher {
+ public:
+  XSalsa20Cipher() : HybridObject(TAG) {}
+  ~XSalsa20Cipher() override {
+    // Wipe key material and any cached keystream bytes before the heap is
+    // returned. Without this the secret-bearing bytes persist on the heap
+    // until overwritten — see audit HIGH finding (XSalsa20Cipher.hpp:19-22).
+    // The base-class unique_ptr ctx frees itself; we don't touch it here.
+    secureZero(key);
+    secureZero(nonce);
+    secureZero(leftover_keystream);
+  }
+
+  void init(const std::shared_ptr<ArrayBuffer> cipher_key, const std::shared_ptr<ArrayBuffer> iv) override;
+  std::shared_ptr<ArrayBuffer> update(const std::shared_ptr<ArrayBuffer>& data) override;
+  std::shared_ptr<ArrayBuffer> final() override;
+
+ private:
+  // Salsa20 (and therefore XSalsa20) processes the keystream in 64-byte blocks.
+  static constexpr std::size_t kSalsa20BlockBytes = 64;
+
+  uint8_t key[crypto_stream_KEYBYTES];
+  uint8_t nonce[crypto_stream_NONCEBYTES];
+
+  // Streaming state — keeps the keystream advancing across multiple update()
+  // calls. Without this, every update() would restart at block 0, producing
+  // identical keystream for each chunk (a two-time-pad break).
+  uint8_t leftover_keystream[kSalsa20BlockBytes] = {};
+  // 0..kSalsa20BlockBytes; the sentinel value kSalsa20BlockBytes means "no
+  // leftover keystream available — start the next chunk on a block boundary".
+  std::size_t leftover_offset = kSalsa20BlockBytes;
+  // Index of the next 64-byte keystream block to consume.
+  uint64_t block_counter = 0;
+};
+
+} // namespace margelo::nitro::crypto

package/cpp/cipher/XSalsa20Poly1305Cipher.cpp

@@ -0,0 +1,138 @@
+#include "XSalsa20Poly1305Cipher.hpp"
+
+#include <cstring>
+#include <stdexcept>
+
+#include "NitroModules/ArrayBuffer.hpp"
+#include "QuickCryptoUtils.hpp"
+
+namespace margelo::nitro::crypto {
+
+XSalsa20Poly1305Cipher::~XSalsa20Poly1305Cipher() {
+  // Always wipe via OPENSSL_cleanse (even when libsodium is enabled) so the
+  // non-sodium `std::memset` fallback can't be optimized away by the
+  // compiler. Audit MEDIUM finding (XSalsa20Poly1305Cipher.cpp:20-22).
+  secureZero(key_);
+  secureZero(nonce_);
+  secureZero(auth_tag_);
+  secureZero(data_buffer_);
+  data_buffer_.clear();
+}
+
+void XSalsa20Poly1305Cipher::init(const std::shared_ptr<ArrayBuffer> cipher_key, const std::shared_ptr<ArrayBuffer> iv) {
+  if (cipher_key->size() != kKeySize) {
+    throw std::runtime_error("XSalsa20-Poly1305 key must be 32 bytes, got " + std::to_string(cipher_key->size()) + " bytes");
+  }
+
+  if (iv->size() != kNonceSize) {
+    throw std::runtime_error("XSalsa20-Poly1305 nonce must be 24 bytes, got " + std::to_string(iv->size()) + " bytes");
+  }
+
+  std::memcpy(key_, cipher_key->data(), kKeySize);
+  std::memcpy(nonce_, iv->data(), kNonceSize);
+
+  data_buffer_.clear();
+  is_finalized = false;
+}
+
+std::shared_ptr<ArrayBuffer> XSalsa20Poly1305Cipher::update(const std::shared_ptr<ArrayBuffer>& data) {
+  checkNotFinalized();
+#ifndef BLSALLOC_SODIUM
+  throw std::runtime_error("XSalsa20Poly1305Cipher: libsodium must be enabled (BLSALLOC_SODIUM)");
+#else
+  size_t data_len = data->size();
+
+  size_t old_size = data_buffer_.size();
+  data_buffer_.resize(old_size + data_len);
+  std::memcpy(data_buffer_.data() + old_size, data->data(), data_len);
+
+  return std::make_shared<NativeArrayBuffer>(nullptr, 0, nullptr);
+#endif
+}
+
+std::shared_ptr<ArrayBuffer> XSalsa20Poly1305Cipher::final() {
+  checkNotFinalized();
+#ifndef BLSALLOC_SODIUM
+  throw std::runtime_error("XSalsa20Poly1305Cipher: libsodium must be enabled (BLSALLOC_SODIUM)");
+#else
+  if (is_cipher) {
+    auto ciphertext = std::make_unique<uint8_t[]>(data_buffer_.size());
+
+    int result = crypto_secretbox_detached(ciphertext.get(), auth_tag_, data_buffer_.data(), data_buffer_.size(), nonce_, key_);
+
+    if (result != 0) {
+      sodium_memzero(ciphertext.get(), data_buffer_.size());
+      throw std::runtime_error("XSalsa20Poly1305Cipher: encryption failed");
+    }
+
+    is_finalized = true;
+    size_t ct_len = data_buffer_.size();
+    uint8_t* raw_ptr = ciphertext.get();
+    return std::make_shared<NativeArrayBuffer>(ciphertext.release(), ct_len, [raw_ptr]() { delete[] raw_ptr; });
+  } else {
+    if (data_buffer_.empty()) {
+      is_finalized = true;
+      return std::make_shared<NativeArrayBuffer>(nullptr, 0, nullptr);
+    }
+
+    auto plaintext = std::make_unique<uint8_t[]>(data_buffer_.size());
+
+    int result = crypto_secretbox_open_detached(plaintext.get(), data_buffer_.data(), auth_tag_, data_buffer_.size(), nonce_, key_);
+
+    if (result != 0) {
+      sodium_memzero(plaintext.get(), data_buffer_.size());
+      throw std::runtime_error("XSalsa20Poly1305Cipher: decryption failed - authentication tag mismatch");
+    }
+
+    is_finalized = true;
+    size_t pt_len = data_buffer_.size();
+    uint8_t* raw_ptr = plaintext.get();
+    return std::make_shared<NativeArrayBuffer>(plaintext.release(), pt_len, [raw_ptr]() { delete[] raw_ptr; });
+  }
+#endif
+}
+
+bool XSalsa20Poly1305Cipher::setAAD(const std::shared_ptr<ArrayBuffer>& data, std::optional<double> plaintextLength) {
+  throw std::runtime_error("AAD is not supported for xsalsa20-poly1305 (use xchacha20-poly1305 instead)");
+}
+
+std::shared_ptr<ArrayBuffer> XSalsa20Poly1305Cipher::getAuthTag() {
+#ifndef BLSALLOC_SODIUM
+  throw std::runtime_error("XSalsa20Poly1305Cipher: libsodium must be enabled (BLSALLOC_SODIUM)");
+#else
+  if (!is_cipher) {
+    throw std::runtime_error("getAuthTag can only be called during encryption");
+  }
+  if (!is_finalized) {
+    throw std::runtime_error("getAuthTag must be called after final()");
+  }
+
+  auto tag_copy = std::make_unique<uint8_t[]>(kTagSize);
+  std::memcpy(tag_copy.get(), auth_tag_, kTagSize);
+  uint8_t* raw_ptr = tag_copy.get();
+  return std::make_shared<NativeArrayBuffer>(tag_copy.release(), kTagSize, [raw_ptr]() { delete[] raw_ptr; });
+#endif
+}
+
+bool XSalsa20Poly1305Cipher::setAuthTag(const std::shared_ptr<ArrayBuffer>& tag) {
+#ifndef BLSALLOC_SODIUM
+  throw std::runtime_error("XSalsa20Poly1305Cipher: libsodium must be enabled (BLSALLOC_SODIUM)");
+#else
+  if (is_cipher) {
+    throw std::runtime_error("setAuthTag can only be called during decryption");
+  }
+
+  if (tag->size() != kTagSize) {
+    throw std::runtime_error("XSalsa20-Poly1305 tag must be 16 bytes, got " + std::to_string(tag->size()) + " bytes");
+  }
+
+  std::memcpy(auth_tag_, tag->data(), kTagSize);
+  return true;
+#endif
+}
+
+bool XSalsa20Poly1305Cipher::setAutoPadding(bool autoPad) {
+  throw std::runtime_error("setAutoPadding is not supported for xsalsa20-poly1305");
+}
+
+} // namespace margelo::nitro::crypto

package/cpp/cipher/XSalsa20Poly1305Cipher.hpp

@@ -0,0 +1,41 @@
+#pragma once
+
+#ifdef BLSALLOC_SODIUM
+#include "sodium.h"
+#else
+#define crypto_secretbox_xsalsa20poly1305_KEYBYTES 32U
+#define crypto_secretbox_xsalsa20poly1305_NONCEBYTES 24U
+#define crypto_secretbox_xsalsa20poly1305_MACBYTES 16U
+#endif
+
+#include <vector>
+
+#include "HybridCipher.hpp"
+
+namespace margelo::nitro::crypto {
+
+class XSalsa20Poly1305Cipher : public HybridCipher {
+ public:
+  XSalsa20Poly1305Cipher() : HybridObject(TAG) {}
+  ~XSalsa20Poly1305Cipher();
+
+  void init(const std::shared_ptr<ArrayBuffer> cipher_key, const std::shared_ptr<ArrayBuffer> iv) override;
+  std::shared_ptr<ArrayBuffer> update(const std::shared_ptr<ArrayBuffer>& data) override;
+  std::shared_ptr<ArrayBuffer> final() override;
+  bool setAAD(const std::shared_ptr<ArrayBuffer>& data, std::optional<double> plaintextLength) override;
+  std::shared_ptr<ArrayBuffer> getAuthTag() override;
+  bool setAuthTag(const std::shared_ptr<ArrayBuffer>& tag) override;
+  bool setAutoPadding(bool autoPad) override;
+
+ private:
+  static constexpr size_t kKeySize = crypto_secretbox_xsalsa20poly1305_KEYBYTES;
+  static constexpr size_t kNonceSize = crypto_secretbox_xsalsa20poly1305_NONCEBYTES;
+  static constexpr size_t kTagSize = crypto_secretbox_xsalsa20poly1305_MACBYTES;
+
+  uint8_t key_[kKeySize];
+  uint8_t nonce_[kNonceSize];
+  std::vector<uint8_t> data_buffer_;
+  uint8_t auth_tag_[kTagSize];
+};
+
+} // namespace margelo::nitro::crypto