react-native-quick-crypto 1.0.0-beta.20 → 1.0.0-beta.22

package/QuickCrypto.podspec

@@ -26,23 +26,53 @@ Pod::Spec.new do |s|
     # cocoapod for Sodium has not been updated for a while, so we need to build it ourselves
     # https://github.com/jedisct1/swift-sodium/issues/264#issuecomment-2864963850
     s.prepare_command = <<-CMD
+      set -e  # Exit on any error
+      set -x  # Print commands as they execute
+
       # Create ios directory if it doesn't exist
       mkdir -p ios
 
-      # Download libsodium
-      curl -L -s -o ios/libsodium.tar.gz https://download.libsodium.org/libsodium/releases/libsodium-1.0.20-stable.tar.gz
+      # Download libsodium with verbose output
+      echo "Downloading libsodium..."
+      curl -L -v -o ios/libsodium.tar.gz https://download.libsodium.org/libsodium/releases/libsodium-1.0.20-stable.tar.gz
+
+      # Verify download
+      if [ ! -f ios/libsodium.tar.gz ]; then
+        echo "ERROR: Failed to download libsodium.tar.gz"
+        exit 1
+      fi
+
+      echo "Download size: $(wc -c < ios/libsodium.tar.gz) bytes"
 
       # Clean previous extraction
       rm -rf ios/libsodium-stable
 
       # Extract the full tarball
+      echo "Extracting libsodium..."
       tar -xzf ios/libsodium.tar.gz -C ios
 
+      # Verify extraction
+      if [ ! -d ios/libsodium-stable ]; then
+        echo "ERROR: Failed to extract libsodium"
+        exit 1
+      fi
+
       # Run configure and make to generate all headers including private ones
-      cd ios/libsodium-stable && \
-      ./configure --disable-shared --enable-static && \
+      echo "Configuring libsodium..."
+      cd ios/libsodium-stable
+      ./configure --disable-shared --enable-static
+
+      echo "Building libsodium..."
       make -j$(sysctl -n hw.ncpu)
 
+      # Verify build success
+      if [ ! -f src/libsodium/.libs/libsodium.a ]; then
+        echo "ERROR: libsodium build failed - static library not found"
+        exit 1
+      fi
+
+      echo "libsodium build completed successfully"
+
       # Cleanup
       cd ../../
       rm -f ios/libsodium.tar.gz
@@ -63,11 +93,44 @@ Pod::Spec.new do |s|
     # implementation (C++)
     "cpp/**/*.{hpp,cpp}",
     # dependencies (C++)
-    "deps/**/*.{hpp,cpp}",
-    # dependencies (C)
+    "deps/**/*.{h,cc}",
+    # dependencies (C) - exclude BLAKE3 x86 SIMD files (only use portable + NEON for ARM)
     "deps/**/*.{h,c}",
   ]
 
+  # Exclude BLAKE3 x86-specific SIMD implementations (SSE2, SSE4.1, AVX2, AVX-512)
+  # These use Intel intrinsics that don't compile on ARM
+  # Also exclude example files, TBB files, test files, and non-C directories
+  s.exclude_files = [
+    "deps/blake3/c/blake3_sse2.c",
+    "deps/blake3/c/blake3_sse41.c",
+    "deps/blake3/c/blake3_avx2.c",
+    "deps/blake3/c/blake3_avx512.c",
+    "deps/blake3/c/blake3_sse2_x86-64_unix.S",
+    "deps/blake3/c/blake3_sse41_x86-64_unix.S",
+    "deps/blake3/c/blake3_avx2_x86-64_unix.S",
+    "deps/blake3/c/blake3_avx512_x86-64_unix.S",
+    "deps/blake3/c/blake3_sse2_x86-64_windows_gnu.S",
+    "deps/blake3/c/blake3_sse41_x86-64_windows_gnu.S",
+    "deps/blake3/c/blake3_avx2_x86-64_windows_gnu.S",
+    "deps/blake3/c/blake3_avx512_x86-64_windows_gnu.S",
+    "deps/blake3/c/blake3_sse2_x86-64_windows_msvc.asm",
+    "deps/blake3/c/blake3_sse41_x86-64_windows_msvc.asm",
+    "deps/blake3/c/blake3_avx2_x86-64_windows_msvc.asm",
+    "deps/blake3/c/blake3_avx512_x86-64_windows_msvc.asm",
+    "deps/blake3/c/main.c",
+    "deps/blake3/c/example.c",
+    "deps/blake3/c/example_tbb.c",
+    "deps/blake3/c/blake3_tbb.cpp",
+    # Exclude non-C parts of BLAKE3 repo (Rust, benchmarks, tools, etc.)
+    "deps/blake3/src/**/*",
+    "deps/blake3/b3sum/**/*",
+    "deps/blake3/benches/**/*",
+    "deps/blake3/reference_impl/**/*",
+    "deps/blake3/tools/**/*",
+    "deps/blake3/test_vectors/**/*",
+  ]
+
   if sodium_enabled
     base_source_files += ["ios/libsodium-stable/src/libsodium/**/*.{h,c}"]
   end
@@ -82,6 +145,14 @@ Pod::Spec.new do |s|
     "CLANG_ALLOW_NON_MODULAR_INCLUDES_IN_FRAMEWORK_MODULES" => "YES"
   }
 
+  # Add cpp subdirectories to header search paths
+  cpp_headers = [
+    "\"$(PODS_TARGET_SRCROOT)/cpp/utils\"",
+    "\"$(PODS_TARGET_SRCROOT)/deps/ncrypto\"",
+    "\"$(PODS_TARGET_SRCROOT)/deps/blake3/c\"",
+    "\"$(PODS_TARGET_SRCROOT)/deps/fastpbkdf2\""
+  ]
+
   if sodium_enabled
     sodium_headers = [
       "\"$(PODS_TARGET_SRCROOT)/ios/libsodium-stable/src/libsodium/include\"",
@@ -90,8 +161,10 @@ Pod::Spec.new do |s|
       "\"$(PODS_ROOT)/../../packages/react-native-quick-crypto/ios/libsodium-stable/src/libsodium/include\"",
       "\"$(PODS_ROOT)/../../packages/react-native-quick-crypto/ios/libsodium-stable/src/libsodium/include/sodium\""
     ]
-    xcconfig["HEADER_SEARCH_PATHS"] = sodium_headers.join(' ')
+    xcconfig["HEADER_SEARCH_PATHS"] = (cpp_headers + sodium_headers).join(' ')
     xcconfig["GCC_PREPROCESSOR_DEFINITIONS"] = "$(inherited) BLSALLOC_SODIUM=1"
+  else
+    xcconfig["HEADER_SEARCH_PATHS"] = cpp_headers.join(' ')
   end
 
   s.pod_target_xcconfig = xcconfig
@@ -102,6 +175,6 @@ Pod::Spec.new do |s|
 
   s.dependency "React-jsi"
   s.dependency "React-callinvoker"
-  s.dependency "OpenSSL-Universal"
+  s.dependency "OpenSSL-Universal", "3.3.3001"
   install_modules_dependencies(s)
 end

package/android/CMakeLists.txt

@@ -1,26 +1,51 @@
+cmake_minimum_required(VERSION 3.10.0)
 project(QuickCrypto)
-cmake_minimum_required(VERSION 3.9.0)
 
 set(PACKAGE_NAME QuickCrypto)
 set(CMAKE_VERBOSE_MAKEFILE ON)
 set(CMAKE_CXX_STANDARD 20)
 
+# BLAKE3 sources - architecture-specific SIMD support
+set(BLAKE3_SOURCES
+  ../deps/blake3/c/blake3.c
+  ../deps/blake3/c/blake3_dispatch.c
+  ../deps/blake3/c/blake3_portable.c
+)
+
+if(CMAKE_ANDROID_ARCH_ABI STREQUAL "arm64-v8a")
+  # ARM64 uses NEON intrinsics (auto-detected via IS_AARCH64 in blake3_impl.h)
+  list(APPEND BLAKE3_SOURCES ../deps/blake3/c/blake3_neon.c)
+elseif(CMAKE_ANDROID_ARCH_ABI STREQUAL "x86" OR CMAKE_ANDROID_ARCH_ABI STREQUAL "x86_64")
+  # Disable x86 SIMD - would require assembly files we don't compile
+  # Falls back to portable C implementation
+  add_definitions(-DBLAKE3_NO_SSE2 -DBLAKE3_NO_SSE41 -DBLAKE3_NO_AVX2 -DBLAKE3_NO_AVX512)
+endif()
+
 # Define C++ library and add all sources
 add_library(
   ${PACKAGE_NAME} SHARED
   src/main/cpp/cpp-adapter.cpp
+  ../cpp/blake3/HybridBlake3.cpp
   ../cpp/cipher/CCMCipher.cpp
+  ../cpp/cipher/GCMCipher.cpp
   ../cpp/cipher/HybridCipher.cpp
+  ../cpp/cipher/HybridRsaCipher.cpp
   ../cpp/cipher/OCBCipher.cpp
   ../cpp/cipher/XSalsa20Cipher.cpp
   ../cpp/cipher/ChaCha20Cipher.cpp
   ../cpp/cipher/ChaCha20Poly1305Cipher.cpp
+  ../cpp/ec/HybridEcKeyPair.cpp
   ../cpp/ed25519/HybridEdKeyPair.cpp
   ../cpp/hash/HybridHash.cpp
   ../cpp/hmac/HybridHmac.cpp
+  ../cpp/keys/HybridKeyObjectHandle.cpp
+  ../cpp/keys/KeyObjectData.cpp
   ../cpp/pbkdf2/HybridPbkdf2.cpp
   ../cpp/random/HybridRandom.cpp
+  ../cpp/rsa/HybridRsaKeyPair.cpp
+  ${BLAKE3_SOURCES}
   ../deps/fastpbkdf2/fastpbkdf2.c
+  ../deps/ncrypto/ncrypto.cc
 )
 
 # add Nitrogen specs
@@ -29,14 +54,20 @@ include(${CMAKE_SOURCE_DIR}/../nitrogen/generated/android/QuickCrypto+autolinkin
 # local includes
 include_directories(
   "src/main/cpp"
+  "../cpp/blake3"
   "../cpp/cipher"
+  "../cpp/ec"
   "../cpp/ed25519"
   "../cpp/hash"
   "../cpp/hmac"
+  "../cpp/keys"
   "../cpp/pbkdf2"
   "../cpp/random"
+  "../cpp/rsa"
   "../cpp/utils"
+  "../deps/blake3/c"
   "../deps/fastpbkdf2"
+  "../deps/ncrypto"
 )
 
 # Third party libraries (Prefabs)
@@ -50,6 +81,7 @@ target_link_libraries(
   ${LOG_LIB}                               # <-- Logcat logger
   android                                  # <-- Android core
   openssl::crypto                          # <-- OpenSSL   (Crypto)
+  openssl::ssl                             # <-- OpenSSL   (SSL)
 )
 
 if(SODIUM_ENABLED)

package/cpp/blake3/HybridBlake3.cpp

@@ -0,0 +1,118 @@
+#include "HybridBlake3.hpp"
+
+#include <NitroModules/ArrayBuffer.hpp>
+#include <cstring>
+#include <stdexcept>
+
+#include "Utils.hpp"
+
+namespace margelo::nitro::crypto {
+
+void HybridBlake3::initHash() {
+  blake3_hasher_init(&hasher);
+  mode = Mode::Hash;
+  key = std::nullopt;
+  context = std::nullopt;
+  initialized = true;
+}
+
+void HybridBlake3::initKeyed(const std::shared_ptr<ArrayBuffer>& keyBuffer) {
+  if (!keyBuffer || keyBuffer->size() != BLAKE3_KEY_LEN) {
+    throw std::runtime_error("BLAKE3 key must be exactly 32 bytes");
+  }
+
+  std::array<uint8_t, BLAKE3_KEY_LEN> keyArray;
+  std::memcpy(keyArray.data(), keyBuffer->data(), BLAKE3_KEY_LEN);
+
+  blake3_hasher_init_keyed(&hasher, keyArray.data());
+  mode = Mode::Keyed;
+  key = keyArray;
+  context = std::nullopt;
+  initialized = true;
+}
+
+void HybridBlake3::initDeriveKey(const std::string& ctx) {
+  if (ctx.empty()) {
+    throw std::runtime_error("BLAKE3 context must be a non-empty string");
+  }
+
+  blake3_hasher_init_derive_key(&hasher, ctx.c_str());
+  mode = Mode::DeriveKey;
+  key = std::nullopt;
+  context = ctx;
+  initialized = true;
+}
+
+void HybridBlake3::update(const std::shared_ptr<ArrayBuffer>& data) {
+  if (!initialized) {
+    throw std::runtime_error("BLAKE3 hasher not initialized");
+  }
+  if (!data) {
+    return;
+  }
+  blake3_hasher_update(&hasher, data->data(), data->size());
+}
+
+std::shared_ptr<ArrayBuffer> HybridBlake3::digest(std::optional<double> length) {
+  if (!initialized) {
+    throw std::runtime_error("BLAKE3 hasher not initialized");
+  }
+
+  size_t outLen = BLAKE3_OUT_LEN;
+  if (length.has_value()) {
+    double len = length.value();
+    if (len <= 0 || len > 65535) {
+      throw std::runtime_error("BLAKE3 output length must be between 1 and 65535");
+    }
+    outLen = static_cast<size_t>(len);
+  }
+
+  auto output = new uint8_t[outLen];
+  blake3_hasher_finalize(&hasher, output, outLen);
+
+  return std::make_shared<margelo::nitro::NativeArrayBuffer>(output, outLen, [=]() { delete[] output; });
+}
+
+void HybridBlake3::reset() {
+  if (!initialized) {
+    throw std::runtime_error("BLAKE3 hasher not initialized");
+  }
+
+  switch (mode) {
+    case Mode::Hash:
+      blake3_hasher_init(&hasher);
+      break;
+    case Mode::Keyed:
+      if (key.has_value()) {
+        blake3_hasher_init_keyed(&hasher, key->data());
+      }
+      break;
+    case Mode::DeriveKey:
+      if (context.has_value()) {
+        blake3_hasher_init_derive_key(&hasher, context->c_str());
+      }
+      break;
+  }
+}
+
+std::shared_ptr<HybridBlake3Spec> HybridBlake3::copy() {
+  if (!initialized) {
+    throw std::runtime_error("BLAKE3 hasher not initialized");
+  }
+
+  auto copied = std::make_shared<HybridBlake3>();
+
+  std::memcpy(&copied->hasher, &hasher, sizeof(blake3_hasher));
+  copied->initialized = true;
+  copied->mode = mode;
+  copied->key = key;
+  copied->context = context;
+
+  return copied;
+}
+
+std::string HybridBlake3::getVersion() {
+  return std::string(blake3_version());
+}
+
+} // namespace margelo::nitro::crypto

package/cpp/blake3/HybridBlake3.hpp

@@ -0,0 +1,35 @@
+#pragma once
+
+#include <memory>
+#include <optional>
+#include <string>
+
+#include "HybridBlake3Spec.hpp"
+#include "blake3.h"
+
+namespace margelo::nitro::crypto {
+
+class HybridBlake3 : public HybridBlake3Spec {
+ public:
+  HybridBlake3() : HybridObject(TAG) {}
+  ~HybridBlake3() = default;
+
+ public:
+  void initHash() override;
+  void initKeyed(const std::shared_ptr<ArrayBuffer>& key) override;
+  void initDeriveKey(const std::string& context) override;
+  void update(const std::shared_ptr<ArrayBuffer>& data) override;
+  std::shared_ptr<ArrayBuffer> digest(std::optional<double> length) override;
+  void reset() override;
+  std::shared_ptr<HybridBlake3Spec> copy() override;
+  std::string getVersion() override;
+
+ private:
+  blake3_hasher hasher;
+  bool initialized = false;
+  enum class Mode { Hash, Keyed, DeriveKey } mode = Mode::Hash;
+  std::optional<std::array<uint8_t, BLAKE3_KEY_LEN>> key;
+  std::optional<std::string> context;
+};
+
+} // namespace margelo::nitro::crypto

package/cpp/cipher/GCMCipher.cpp

@@ -0,0 +1,68 @@
+#include "GCMCipher.hpp"
+#include "Utils.hpp"
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <stdexcept>
+
+namespace margelo::nitro::crypto {
+
+void GCMCipher::init(const std::shared_ptr<ArrayBuffer> cipher_key, const std::shared_ptr<ArrayBuffer> iv) {
+  // Clean up any existing context
+  if (ctx) {
+    EVP_CIPHER_CTX_free(ctx);
+    ctx = nullptr;
+  }
+
+  // 1. Get cipher implementation by name
+  const EVP_CIPHER* cipher = EVP_get_cipherbyname(cipher_type.c_str());
+  if (!cipher) {
+    throw std::runtime_error("Unknown cipher " + cipher_type);
+  }
+
+  // 2. Create a new context
+  ctx = EVP_CIPHER_CTX_new();
+  if (!ctx) {
+    throw std::runtime_error("Failed to create cipher context");
+  }
+
+  // 3. Initialize with cipher type only (no key/IV yet)
+  if (EVP_CipherInit_ex(ctx, cipher, nullptr, nullptr, nullptr, is_cipher) != 1) {
+    unsigned long err = ERR_get_error();
+    char err_buf[256];
+    ERR_error_string_n(err, err_buf, sizeof(err_buf));
+    EVP_CIPHER_CTX_free(ctx);
+    ctx = nullptr;
+    throw std::runtime_error("GCMCipher: Failed initial CipherInit setup: " + std::string(err_buf));
+  }
+
+  // 4. Set IV length for non-standard IV sizes (GCM default is 96 bits/12 bytes)
+  auto native_iv = ToNativeArrayBuffer(iv);
+  size_t iv_len = native_iv->size();
+
+  if (iv_len != 12) { // Only set if not the default length
+    if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, static_cast<int>(iv_len), nullptr) != 1) {
+      unsigned long err = ERR_get_error();
+      char err_buf[256];
+      ERR_error_string_n(err, err_buf, sizeof(err_buf));
+      EVP_CIPHER_CTX_free(ctx);
+      ctx = nullptr;
+      throw std::runtime_error("GCMCipher: Failed to set IV length: " + std::string(err_buf));
+    }
+  }
+
+  // 5. Now set the key and IV
+  auto native_key = ToNativeArrayBuffer(cipher_key);
+  const unsigned char* key_ptr = reinterpret_cast<const unsigned char*>(native_key->data());
+  const unsigned char* iv_ptr = reinterpret_cast<const unsigned char*>(native_iv->data());
+
+  if (EVP_CipherInit_ex(ctx, nullptr, nullptr, key_ptr, iv_ptr, is_cipher) != 1) {
+    unsigned long err = ERR_get_error();
+    char err_buf[256];
+    ERR_error_string_n(err, err_buf, sizeof(err_buf));
+    EVP_CIPHER_CTX_free(ctx);
+    ctx = nullptr;
+    throw std::runtime_error("GCMCipher: Failed to set key/IV: " + std::string(err_buf));
+  }
+}
+
+} // namespace margelo::nitro::crypto

package/cpp/cipher/GCMCipher.hpp

@@ -0,0 +1,14 @@
+#pragma once
+
+#include "HybridCipher.hpp"
+
+namespace margelo::nitro::crypto {
+
+class GCMCipher : public HybridCipher {
+ public:
+  GCMCipher() : HybridObject(TAG) {}
+
+  void init(const std::shared_ptr<ArrayBuffer> cipher_key, const std::shared_ptr<ArrayBuffer> iv) override;
+};
+
+} // namespace margelo::nitro::crypto

package/cpp/cipher/HybridCipherFactory.hpp

@@ -7,6 +7,7 @@
 #include "CCMCipher.hpp"
 #include "ChaCha20Cipher.hpp"
 #include "ChaCha20Poly1305Cipher.hpp"
+#include "GCMCipher.hpp"
 #include "HybridCipherFactorySpec.hpp"
 #include "OCBCipher.hpp"
 #include "Utils.hpp"
@@ -40,12 +41,21 @@ class HybridCipherFactory : public HybridCipherFactorySpec {
           // Pass tag length (default 16 if not present)
           size_t tag_len = args.authTagLen.has_value() ? static_cast<size_t>(args.authTagLen.value()) : 16;
           std::static_pointer_cast<OCBCipher>(cipherInstance)->init(args.cipherKey, args.iv, tag_len);
+          EVP_CIPHER_free(cipher);
           return cipherInstance;
         }
         case EVP_CIPH_CCM_MODE: {
           cipherInstance = std::make_shared<CCMCipher>();
           cipherInstance->setArgs(args);
           cipherInstance->init(args.cipherKey, args.iv);
+          EVP_CIPHER_free(cipher);
+          return cipherInstance;
+        }
+        case EVP_CIPH_GCM_MODE: {
+          cipherInstance = std::make_shared<GCMCipher>();
+          cipherInstance->setArgs(args);
+          cipherInstance->init(args.cipherKey, args.iv);
+          EVP_CIPHER_free(cipher);
           return cipherInstance;
         }
         case EVP_CIPH_STREAM_CIPHER: {
@@ -55,12 +65,14 @@ class HybridCipherFactory : public HybridCipherFactorySpec {
             cipherInstance = std::make_shared<ChaCha20Cipher>();
             cipherInstance->setArgs(args);
             cipherInstance->init(args.cipherKey, args.iv);
+            EVP_CIPHER_free(cipher);
             return cipherInstance;
           }
           if (cipherName == "chacha20-poly1305") {
             cipherInstance = std::make_shared<ChaCha20Poly1305Cipher>();
             cipherInstance->setArgs(args);
             cipherInstance->init(args.cipherKey, args.iv);
+            EVP_CIPHER_free(cipher);
             return cipherInstance;
           }
         }
@@ -69,6 +81,7 @@ class HybridCipherFactory : public HybridCipherFactorySpec {
           cipherInstance = std::make_shared<HybridCipher>();
           cipherInstance->setArgs(args);
           cipherInstance->init(args.cipherKey, args.iv);
+          EVP_CIPHER_free(cipher);
           return cipherInstance;
         }
       }