react-native-quick-crypto 1.0.0-beta.2 → 1.0.0-beta.21

package/QuickCrypto.podspec

@@ -2,7 +2,7 @@ require "json"
 
 package = JSON.parse(File.read(File.join(__dir__, "package.json")))
 
-Pod::UI.puts "[QuickCrypto] crypto just got quicker 💨"
+Pod::UI.puts "[QuickCrypto]  💨 crypto just got quicker"
 
 Pod::Spec.new do |s|
   s.name         = "QuickCrypto"
@@ -12,23 +12,159 @@ Pod::Spec.new do |s|
   s.license      = package["license"]
   s.authors      = package["authors"]
 
-  s.platforms    = { :ios => min_ios_version_supported }
-  s.source       = { :git => "https://github.com/margelo/react-native-quick-crypto.git", :tag => "#{s.version}" }
+  s.ios.deployment_target = min_ios_version_supported
+  s.visionos.deployment_target = 1.0
+  s.macos.deployment_target = 10.13
+  s.tvos.deployment_target = 13.4
 
-  s.source_files = [
+  s.source = { :git => "https://github.com/margelo/react-native-quick-crypto.git", :tag => "#{s.version}" }
+
+  sodium_enabled = ENV['SODIUM_ENABLED'] == '1'
+  Pod::UI.puts("[QuickCrypto]  🧂 has libsodium #{sodium_enabled ? "enabled" : "disabled"}!")
+
+  if sodium_enabled
+    # cocoapod for Sodium has not been updated for a while, so we need to build it ourselves
+    # https://github.com/jedisct1/swift-sodium/issues/264#issuecomment-2864963850
+    s.prepare_command = <<-CMD
+      set -e  # Exit on any error
+      set -x  # Print commands as they execute
+
+      # Create ios directory if it doesn't exist
+      mkdir -p ios
+
+      # Download libsodium with verbose output
+      echo "Downloading libsodium..."
+      curl -L -v -o ios/libsodium.tar.gz https://download.libsodium.org/libsodium/releases/libsodium-1.0.20-stable.tar.gz
+
+      # Verify download
+      if [ ! -f ios/libsodium.tar.gz ]; then
+        echo "ERROR: Failed to download libsodium.tar.gz"
+        exit 1
+      fi
+
+      echo "Download size: $(wc -c < ios/libsodium.tar.gz) bytes"
+
+      # Clean previous extraction
+      rm -rf ios/libsodium-stable
+
+      # Extract the full tarball
+      echo "Extracting libsodium..."
+      tar -xzf ios/libsodium.tar.gz -C ios
+
+      # Verify extraction
+      if [ ! -d ios/libsodium-stable ]; then
+        echo "ERROR: Failed to extract libsodium"
+        exit 1
+      fi
+
+      # Run configure and make to generate all headers including private ones
+      echo "Configuring libsodium..."
+      cd ios/libsodium-stable
+      ./configure --disable-shared --enable-static
+
+      echo "Building libsodium..."
+      make -j$(sysctl -n hw.ncpu)
+
+      # Verify build success
+      if [ ! -f src/libsodium/.libs/libsodium.a ]; then
+        echo "ERROR: libsodium build failed - static library not found"
+        exit 1
+      fi
+
+      echo "libsodium build completed successfully"
+
+      # Cleanup
+      cd ../../
+      rm -f ios/libsodium.tar.gz
+    CMD
+  else
+    s.prepare_command = <<-CMD
+      # Clean up libsodium files if they exist
+      rm -rf ios/libsodium-stable
+      rm -f ios/libsodium.tar.gz
+    CMD
+  end
+
+  base_source_files = [
     # implementation (Swift)
     "ios/**/*.{swift}",
     # ios (Objective-C++)
     "ios/**/*.{h,m,mm}",
     # implementation (C++)
     "cpp/**/*.{hpp,cpp}",
+    # dependencies (C++)
+    "deps/**/*.{h,cc}",
+    # dependencies (C) - exclude BLAKE3 x86 SIMD files (only use portable + NEON for ARM)
+    "deps/**/*.{h,c}",
   ]
 
+  # Exclude BLAKE3 x86-specific SIMD implementations (SSE2, SSE4.1, AVX2, AVX-512)
+  # These use Intel intrinsics that don't compile on ARM
+  # Also exclude example files, TBB files, test files, and non-C directories
+  s.exclude_files = [
+    "deps/blake3/c/blake3_sse2.c",
+    "deps/blake3/c/blake3_sse41.c",
+    "deps/blake3/c/blake3_avx2.c",
+    "deps/blake3/c/blake3_avx512.c",
+    "deps/blake3/c/blake3_sse2_x86-64_unix.S",
+    "deps/blake3/c/blake3_sse41_x86-64_unix.S",
+    "deps/blake3/c/blake3_avx2_x86-64_unix.S",
+    "deps/blake3/c/blake3_avx512_x86-64_unix.S",
+    "deps/blake3/c/blake3_sse2_x86-64_windows_gnu.S",
+    "deps/blake3/c/blake3_sse41_x86-64_windows_gnu.S",
+    "deps/blake3/c/blake3_avx2_x86-64_windows_gnu.S",
+    "deps/blake3/c/blake3_avx512_x86-64_windows_gnu.S",
+    "deps/blake3/c/blake3_sse2_x86-64_windows_msvc.asm",
+    "deps/blake3/c/blake3_sse41_x86-64_windows_msvc.asm",
+    "deps/blake3/c/blake3_avx2_x86-64_windows_msvc.asm",
+    "deps/blake3/c/blake3_avx512_x86-64_windows_msvc.asm",
+    "deps/blake3/c/main.c",
+    "deps/blake3/c/example.c",
+    "deps/blake3/c/example_tbb.c",
+    "deps/blake3/c/blake3_tbb.cpp",
+    # Exclude non-C parts of BLAKE3 repo (Rust, benchmarks, tools, etc.)
+    "deps/blake3/src/**/*",
+    "deps/blake3/b3sum/**/*",
+    "deps/blake3/benches/**/*",
+    "deps/blake3/reference_impl/**/*",
+    "deps/blake3/tools/**/*",
+    "deps/blake3/test_vectors/**/*",
+  ]
+
+  if sodium_enabled
+    base_source_files += ["ios/libsodium-stable/src/libsodium/**/*.{h,c}"]
+  end
+
+  s.source_files = base_source_files
+
+  xcconfig = {
+    # C++ compiler flags, mainly for folly.
+    "GCC_PREPROCESSOR_DEFINITIONS" => "$(inherited) FOLLY_NO_CONFIG FOLLY_CFG_NO_COROUTINES",
+    # Set C++ standard to C++20
+    "CLANG_CXX_LANGUAGE_STANDARD" => "c++20",
+    "CLANG_ALLOW_NON_MODULAR_INCLUDES_IN_FRAMEWORK_MODULES" => "YES"
+  }
+
+  if sodium_enabled
+    sodium_headers = [
+      "\"$(PODS_TARGET_SRCROOT)/ios/libsodium-stable/src/libsodium/include\"",
+      "\"$(PODS_TARGET_SRCROOT)/ios/libsodium-stable/src/libsodium/include/sodium\"",
+      "\"$(PODS_TARGET_SRCROOT)/ios/libsodium-stable\"",
+      "\"$(PODS_ROOT)/../../packages/react-native-quick-crypto/ios/libsodium-stable/src/libsodium/include\"",
+      "\"$(PODS_ROOT)/../../packages/react-native-quick-crypto/ios/libsodium-stable/src/libsodium/include/sodium\""
+    ]
+    xcconfig["HEADER_SEARCH_PATHS"] = sodium_headers.join(' ')
+    xcconfig["GCC_PREPROCESSOR_DEFINITIONS"] = "$(inherited) BLSALLOC_SODIUM=1"
+  end
+
+  s.pod_target_xcconfig = xcconfig
+
   # Add all files generated by Nitrogen
-  load 'nitrogen/generated/ios/QuickCrypto+autolinking.rb'
+  load "nitrogen/generated/ios/QuickCrypto+autolinking.rb"
   add_nitrogen_files(s)
 
+  s.dependency "React-jsi"
+  s.dependency "React-callinvoker"
+  s.dependency "OpenSSL-Universal", "3.3.3001"
   install_modules_dependencies(s)
-  s.dependency "OpenSSL-Universal"
-
 end

package/README.md

@@ -1,12 +1,18 @@
-<a href="https://margelo.io">
-  <img src="./docs/img/banner.svg" width="100%" />
+<a href="https://margelo.com">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="./docs/img/banner-dark.png" />
+    <source media="(prefers-color-scheme: light)" srcset="./docs/img/banner-light.png" />
+    <img alt="react-native-quick-crypto" src="./docs/img/banner-light.png" />
+  </picture>
 </a>
 
 # ⚡️ react-native-quick-crypto
 
 A fast implementation of Node's `crypto` module.
 
-> Note: This version `1.x` is undergoing a major refactor, porting to New Architecture, Bridgeless, and [`Nitro Modules`](https://github.com/mrousavy/react-native-nitro) and is incomplete compared to the `0.x` version.  Status, as always, will be represented in [implementation-coverage.md](../blob/main/docs/implementation-coverage.md).
+> Note: This version `1.x` is undergoing a major refactor, porting to New Architecture, Bridgeless, and [`Nitro Modules`](https://github.com/mrousavy/react-native-nitro) and is incomplete compared to the `0.x` version.  Status, as always, will be represented in [implementation-coverage.md](../main/docs/implementation-coverage.md).
+
+> Note: Minimum supported version of React Native is `0.75`.  If you need to use earlier versions, please use `0.x` versions of this library.
 
 ## Features
 
@@ -24,8 +30,8 @@ QuickCrypto can be used as a drop-in replacement for your Web3/Crypto apps to sp
 
 | Version | RN Architecture | Modules |
 | ------- | ------ | ------- |
-| `1.x`     | new [->](https://github.com/reactwg/react-native-new-architecture/blob/main/docs/enable-apps.md)  | Nitro Modules [->](https://github.com/margelo/react-native-nitro) |
-| `0.x`     | old  | Bridge & JSI |
+| `1.x`     | new [->](https://github.com/reactwg/react-native-new-architecture/blob/main/docs/enable-apps.md)  | Nitro Modules [->](https://github.com/mrousavy/nitro) |
+| `0.x`     | old, new 🤞  | Bridge & JSI |
 
 ## Benchmarks
 
@@ -59,7 +65,7 @@ Creating a Wallet took 289 ms
 </h3>
 
 ```sh
-yarn add react-native-quick-crypto
+bun add react-native-quick-crypto react-native-nitro-modules
 cd ios && pod install
 ```
 

package/android/CMakeLists.txt

@@ -1,44 +1,105 @@
-cmake_minimum_required(VERSION 3.9.0)
-
+cmake_minimum_required(VERSION 3.10.0)
 project(QuickCrypto)
-set(PACKAGE_NAME QuickCrypto)
 
+set(PACKAGE_NAME QuickCrypto)
 set(CMAKE_VERBOSE_MAKEFILE ON)
 set(CMAKE_CXX_STANDARD 20)
 
+# BLAKE3 sources - architecture-specific SIMD support
+set(BLAKE3_SOURCES
+  ../deps/blake3/c/blake3.c
+  ../deps/blake3/c/blake3_dispatch.c
+  ../deps/blake3/c/blake3_portable.c
+)
+
+if(CMAKE_ANDROID_ARCH_ABI STREQUAL "arm64-v8a")
+  # ARM64 uses NEON intrinsics (auto-detected via IS_AARCH64 in blake3_impl.h)
+  list(APPEND BLAKE3_SOURCES ../deps/blake3/c/blake3_neon.c)
+elseif(CMAKE_ANDROID_ARCH_ABI STREQUAL "x86" OR CMAKE_ANDROID_ARCH_ABI STREQUAL "x86_64")
+  # Disable x86 SIMD - would require assembly files we don't compile
+  # Falls back to portable C implementation
+  add_definitions(-DBLAKE3_NO_SSE2 -DBLAKE3_NO_SSE41 -DBLAKE3_NO_AVX2 -DBLAKE3_NO_AVX512)
+endif()
+
 # Define C++ library and add all sources
 add_library(
   ${PACKAGE_NAME} SHARED
   src/main/cpp/cpp-adapter.cpp
+  ../cpp/blake3/HybridBlake3.cpp
+  ../cpp/cipher/CCMCipher.cpp
+  ../cpp/cipher/HybridCipher.cpp
+  ../cpp/cipher/OCBCipher.cpp
+  ../cpp/cipher/XSalsa20Cipher.cpp
+  ../cpp/cipher/ChaCha20Cipher.cpp
+  ../cpp/cipher/ChaCha20Poly1305Cipher.cpp
+  ../cpp/ec/HybridEcKeyPair.cpp
+  ../cpp/ed25519/HybridEdKeyPair.cpp
+  ../cpp/hash/HybridHash.cpp
+  ../cpp/hmac/HybridHmac.cpp
+  ../cpp/keys/HybridKeyObjectHandle.cpp
+  ../cpp/keys/KeyObjectData.cpp
+  ../cpp/pbkdf2/HybridPbkdf2.cpp
   ../cpp/random/HybridRandom.cpp
+  ../cpp/rsa/HybridRsaKeyPair.cpp
+  ${BLAKE3_SOURCES}
+  ../deps/fastpbkdf2/fastpbkdf2.c
+  ../deps/ncrypto/ncrypto.cc
 )
 
-include_directories(../cpp)
+# add Nitrogen specs
 include(${CMAKE_SOURCE_DIR}/../nitrogen/generated/android/QuickCrypto+autolinking.cmake)
 
+# local includes
+include_directories(
+  "src/main/cpp"
+  "../cpp/blake3"
+  "../cpp/cipher"
+  "../cpp/ec"
+  "../cpp/ed25519"
+  "../cpp/hash"
+  "../cpp/hmac"
+  "../cpp/keys"
+  "../cpp/pbkdf2"
+  "../cpp/random"
+  "../cpp/rsa"
+  "../cpp/utils"
+  "../deps/blake3/c"
+  "../deps/fastpbkdf2"
+  "../deps/ncrypto"
+)
+
 # Third party libraries (Prefabs)
 find_library(LOG_LIB log)
 
-find_package(ReactAndroid REQUIRED CONFIG)
-find_package(fbjni REQUIRED CONFIG)
 find_package(openssl REQUIRED CONFIG)
 
 # Link all libraries together
 target_link_libraries(
   ${PACKAGE_NAME}
-  ${LOG_LIB}                             # <-- Logcat logger
-  android                                # <-- Android core
-  fbjni::fbjni                           # <-- Facebook C++ JNI helpers
-  openssl::crypto                        # <-- OpenSSL (Crypto)
-  ReactAndroid::jsi
-  ReactAndroid::turbomodulejsijni
-  ReactAndroid::react_nativemodule_core
-  ReactAndroid::react_render_core
-  ReactAndroid::runtimeexecutor
-  ReactAndroid::fabricjni
-  ReactAndroid::react_debug
-  ReactAndroid::react_render_core
-  ReactAndroid::react_render_componentregistry
-  ReactAndroid::rrc_view
-  ReactAndroid::folly_runtime
+  ${LOG_LIB}                               # <-- Logcat logger
+  android                                  # <-- Android core
+  openssl::crypto                          # <-- OpenSSL   (Crypto)
+  openssl::ssl                             # <-- OpenSSL   (SSL)
+)
+
+if(SODIUM_ENABLED)
+  add_definitions(-DBLSALLOC_SODIUM)
+  find_package(sodium REQUIRED CONFIG)
+  target_link_libraries(
+    ${PACKAGE_NAME}
+    sodium::sodium
+  )
+endif()
+
+if(ReactAndroid_VERSION_MINOR GREATER_EQUAL 76)
+  target_link_libraries(
+    ${PACKAGE_NAME}
+    ReactAndroid::reactnative              # <-- RN: Native Modules umbrella prefab
+  )
+else()
+  target_link_libraries(
+    ${PACKAGE_NAME}
+    ReactAndroid::react_nativemodule_core  # <-- RN: TurboModules Core
+    ReactAndroid::turbomodulejsijni        # <-- RN: TurboModules utils (e.g. CallInvokerHolder)
   )
+endif()

package/android/build.gradle

@@ -7,7 +7,7 @@ buildscript {
   }
 
   dependencies {
-    classpath "com.android.tools.build:gradle:8.2.2"
+    classpath "com.android.tools.build:gradle:8.7.3"
     classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:${kotlinVersion}"
   }
 }
@@ -37,6 +37,9 @@ def getExtOrIntegerDefault(name) {
   return rootProject.ext.has(name) ? rootProject.ext.get(name) : (project.properties["QuickCrypto_" + name]).toInteger()
 }
 
+def sodiumEnabled = hasProperty('sodiumEnabled') ? project.property('sodiumEnabled').toBoolean() : false // Default to false
+logger.warn("[QuickCrypto] Has libsodium ${sodiumEnabled ? "enabled" : "disabled"}!")
+
 android {
   namespace "com.margelo.nitro.quickcrypto"
   ndkVersion getExtOrDefault("ndkVersion")
@@ -49,9 +52,20 @@ android {
 
     externalNativeBuild {
       cmake {
-        cppFlags "-O2 -frtti -fexceptions -Wall -fstack-protector-all"
-        arguments "-DANDROID_STL=c++_shared"
+        cppFlags "-frtti -fexceptions -Wall -fstack-protector-all"
+        arguments "-DANDROID_STL=c++_shared",
+                  "-DSODIUM_ENABLED=${sodiumEnabled}",
+                  "-DANDROID_SUPPORT_FLEXIBLE_PAGE_SIZES=ON"
         abiFilters (*reactNativeArchitectures())
+
+        buildTypes {
+          debug {
+            cppFlags "-O1 -g"
+          }
+          release {
+            cppFlags "-O2"
+          }
+        }
       }
     }
   }
@@ -67,6 +81,27 @@ android {
     prefab true
   }
 
+packagingOptions {
+    excludes = [
+            "META-INF",
+            "META-INF/**",
+            "**/libc++_shared.so",
+            "**/libfbjni.so",
+            "**/libjsi.so",
+            "**/libfolly_json.so",
+            "**/libfolly_runtime.so",
+            "**/libglog.so",
+            "**/libhermes.so",
+            "**/libhermes-executor-debug.so",
+            "**/libhermes_executor.so",
+            "**/libreactnative.so",
+            "**/libreactnativejni.so",
+            "**/libturbomodulejsijni.so",
+            "**/libreact_nativemodule_core.so",
+            "**/libjscexecutor.so"
+    ]
+  }
+
   buildTypes {
     release {
       minifyEnabled false
@@ -104,8 +139,16 @@ dependencies {
   //noinspection GradleDynamicVersion
   implementation "com.facebook.react:react-native:+"
 
+  // Add a dependency on NitroModules
   implementation project(":react-native-nitro-modules")
-  implementation "com.android.ndk.thirdparty:openssl:1.1.1q-beta-1"
+
+  // Add a dependency on OpenSSL
+  implementation 'io.github.ronickg:openssl:3.3.2-1'
+
+  if (sodiumEnabled) {
+    // Add a dependency on libsodium
+    implementation 'io.github.ronickg:sodium:1.0.20-1'
+  }
 }
 
 if (isNewArchitectureEnabled()) {

package/android/src/main/cpp/cpp-adapter.cpp

@@ -1,15 +1,8 @@
+#include <fbjni/fbjni.h>
 #include <jni.h>
 
-#include "random/HybridRandom.hpp"
-#include <NitroModules/HybridObjectRegistry.hpp>
-
-using namespace margelo::nitro::crypto;
-using namespace margelo::crypto;
+#include "QuickCryptoOnLoad.hpp"
 
 JNIEXPORT jint JNICALL JNI_OnLoad(JavaVM* vm, void*) {
-  HybridObjectRegistry::registerHybridObjectConstructor(
-    "Random", []() -> std::shared_ptr<HybridObject> { return std::make_shared<HybridRandom>();
-  });
-
-  return JNI_VERSION_1_2;
+  return facebook::jni::initialize(vm, [=] { margelo::nitro::crypto::initialize(vm); });
 }

package/android/src/main/java/com/margelo/nitro/quickcrypto/QuickCryptoPackage.java

@@ -1,6 +1,7 @@
 package com.margelo.nitro.quickcrypto;
 
 import android.util.Log;
+
 import androidx.annotation.Nullable;
 
 import com.facebook.react.bridge.NativeModule;
@@ -9,19 +10,10 @@ import com.facebook.react.module.model.ReactModuleInfoProvider;
 import com.facebook.react.TurboReactPackage;
 
 import java.util.HashMap;
+import java.util.function.Supplier;
 
 public class QuickCryptoPackage extends TurboReactPackage {
   private static final String TAG = "QuickCrypto";
-  static {
-    try {
-      Log.i(TAG, "Loading C++ library...");
-      System.loadLibrary(TAG);
-      Log.i(TAG, "Successfully loaded C++ library!");
-    } catch (Throwable e) {
-      Log.e(TAG, "Failed to load C++ library! Is it properly installed and linked?", e);
-      throw e;
-    }
-  }
 
   @Nullable
   @Override
@@ -35,4 +27,15 @@ public class QuickCryptoPackage extends TurboReactPackage {
       return new HashMap<>();
     };
   }
+
+  static {
+    try {
+      Log.i(TAG, "Loading C++ library...");
+      System.loadLibrary(TAG);
+      Log.i(TAG, "Successfully loaded C++ library!");
+    } catch (Throwable e) {
+      Log.e(TAG, "Failed to load C++ library! Is it properly installed and linked?", e);
+      throw e;
+    }
+  }
 }

package/app.plugin.js

@@ -0,0 +1,3 @@
+const { createRNQCPlugin } = require('./lib/commonjs/expo-plugin/withRNQC');
+const pkg = require('./package.json');
+module.exports = createRNQCPlugin(pkg.name, pkg.version);

package/cpp/blake3/HybridBlake3.cpp

@@ -0,0 +1,118 @@
+#include "HybridBlake3.hpp"
+
+#include <NitroModules/ArrayBuffer.hpp>
+#include <cstring>
+#include <stdexcept>
+
+#include "Utils.hpp"
+
+namespace margelo::nitro::crypto {
+
+void HybridBlake3::initHash() {
+  blake3_hasher_init(&hasher);
+  mode = Mode::Hash;
+  key = std::nullopt;
+  context = std::nullopt;
+  initialized = true;
+}
+
+void HybridBlake3::initKeyed(const std::shared_ptr<ArrayBuffer>& keyBuffer) {
+  if (!keyBuffer || keyBuffer->size() != BLAKE3_KEY_LEN) {
+    throw std::runtime_error("BLAKE3 key must be exactly 32 bytes");
+  }
+
+  std::array<uint8_t, BLAKE3_KEY_LEN> keyArray;
+  std::memcpy(keyArray.data(), keyBuffer->data(), BLAKE3_KEY_LEN);
+
+  blake3_hasher_init_keyed(&hasher, keyArray.data());
+  mode = Mode::Keyed;
+  key = keyArray;
+  context = std::nullopt;
+  initialized = true;
+}
+
+void HybridBlake3::initDeriveKey(const std::string& ctx) {
+  if (ctx.empty()) {
+    throw std::runtime_error("BLAKE3 context must be a non-empty string");
+  }
+
+  blake3_hasher_init_derive_key(&hasher, ctx.c_str());
+  mode = Mode::DeriveKey;
+  key = std::nullopt;
+  context = ctx;
+  initialized = true;
+}
+
+void HybridBlake3::update(const std::shared_ptr<ArrayBuffer>& data) {
+  if (!initialized) {
+    throw std::runtime_error("BLAKE3 hasher not initialized");
+  }
+  if (!data) {
+    return;
+  }
+  blake3_hasher_update(&hasher, data->data(), data->size());
+}
+
+std::shared_ptr<ArrayBuffer> HybridBlake3::digest(std::optional<double> length) {
+  if (!initialized) {
+    throw std::runtime_error("BLAKE3 hasher not initialized");
+  }
+
+  size_t outLen = BLAKE3_OUT_LEN;
+  if (length.has_value()) {
+    double len = length.value();
+    if (len <= 0 || len > 65535) {
+      throw std::runtime_error("BLAKE3 output length must be between 1 and 65535");
+    }
+    outLen = static_cast<size_t>(len);
+  }
+
+  auto output = new uint8_t[outLen];
+  blake3_hasher_finalize(&hasher, output, outLen);
+
+  return std::make_shared<margelo::nitro::NativeArrayBuffer>(output, outLen, [=]() { delete[] output; });
+}
+
+void HybridBlake3::reset() {
+  if (!initialized) {
+    throw std::runtime_error("BLAKE3 hasher not initialized");
+  }
+
+  switch (mode) {
+    case Mode::Hash:
+      blake3_hasher_init(&hasher);
+      break;
+    case Mode::Keyed:
+      if (key.has_value()) {
+        blake3_hasher_init_keyed(&hasher, key->data());
+      }
+      break;
+    case Mode::DeriveKey:
+      if (context.has_value()) {
+        blake3_hasher_init_derive_key(&hasher, context->c_str());
+      }
+      break;
+  }
+}
+
+std::shared_ptr<HybridBlake3Spec> HybridBlake3::copy() {
+  if (!initialized) {
+    throw std::runtime_error("BLAKE3 hasher not initialized");
+  }
+
+  auto copied = std::make_shared<HybridBlake3>();
+
+  std::memcpy(&copied->hasher, &hasher, sizeof(blake3_hasher));
+  copied->initialized = true;
+  copied->mode = mode;
+  copied->key = key;
+  copied->context = context;
+
+  return copied;
+}
+
+std::string HybridBlake3::getVersion() {
+  return std::string(blake3_version());
+}
+
+} // namespace margelo::nitro::crypto

package/cpp/blake3/HybridBlake3.hpp

@@ -0,0 +1,35 @@
+#pragma once
+
+#include <memory>
+#include <optional>
+#include <string>
+
+#include "HybridBlake3Spec.hpp"
+#include "blake3.h"
+
+namespace margelo::nitro::crypto {
+
+class HybridBlake3 : public HybridBlake3Spec {
+ public:
+  HybridBlake3() : HybridObject(TAG) {}
+  ~HybridBlake3() = default;
+
+ public:
+  void initHash() override;
+  void initKeyed(const std::shared_ptr<ArrayBuffer>& key) override;
+  void initDeriveKey(const std::string& context) override;
+  void update(const std::shared_ptr<ArrayBuffer>& data) override;
+  std::shared_ptr<ArrayBuffer> digest(std::optional<double> length) override;
+  void reset() override;
+  std::shared_ptr<HybridBlake3Spec> copy() override;
+  std::string getVersion() override;
+
+ private:
+  blake3_hasher hasher;
+  bool initialized = false;
+  enum class Mode { Hash, Keyed, DeriveKey } mode = Mode::Hash;
+  std::optional<std::array<uint8_t, BLAKE3_KEY_LEN>> key;
+  std::optional<std::string> context;
+};
+
+} // namespace margelo::nitro::crypto