react-native-quick-crypto 1.0.0-beta.8 → 1.0.0

package/QuickCrypto.podspec

@@ -17,9 +17,75 @@ Pod::Spec.new do |s|
   s.macos.deployment_target = 10.13
   s.tvos.deployment_target = 13.4
 
-  s.source       = { :git => "https://github.com/margelo/react-native-quick-crypto.git", :tag => "#{s.version}" }
+  s.source = { :git => "https://github.com/margelo/react-native-quick-crypto.git", :tag => "#{s.version}" }
 
-  s.source_files = [
+  sodium_enabled = ENV['SODIUM_ENABLED'] == '1'
+  Pod::UI.puts("[QuickCrypto]  🧂 has libsodium #{sodium_enabled ? "enabled" : "disabled"}!")
+
+  if sodium_enabled
+    # cocoapod for Sodium has not been updated for a while, so we need to build it ourselves
+    # https://github.com/jedisct1/swift-sodium/issues/264#issuecomment-2864963850
+    s.prepare_command = <<-CMD
+      set -e  # Exit on any error
+      set -x  # Print commands as they execute
+
+      # Create ios directory if it doesn't exist
+      mkdir -p ios
+
+      # Download libsodium with verbose output
+      echo "Downloading libsodium..."
+      curl -L -v -o ios/libsodium.tar.gz https://download.libsodium.org/libsodium/releases/libsodium-1.0.20-stable.tar.gz
+
+      # Verify download
+      if [ ! -f ios/libsodium.tar.gz ]; then
+        echo "ERROR: Failed to download libsodium.tar.gz"
+        exit 1
+      fi
+
+      echo "Download size: $(wc -c < ios/libsodium.tar.gz) bytes"
+
+      # Clean previous extraction
+      rm -rf ios/libsodium-stable
+
+      # Extract the full tarball
+      echo "Extracting libsodium..."
+      tar -xzf ios/libsodium.tar.gz -C ios
+
+      # Verify extraction
+      if [ ! -d ios/libsodium-stable ]; then
+        echo "ERROR: Failed to extract libsodium"
+        exit 1
+      fi
+
+      # Run configure and make to generate all headers including private ones
+      echo "Configuring libsodium..."
+      cd ios/libsodium-stable
+      ./configure --disable-shared --enable-static
+
+      echo "Building libsodium..."
+      make -j$(sysctl -n hw.ncpu)
+
+      # Verify build success
+      if [ ! -f src/libsodium/.libs/libsodium.a ]; then
+        echo "ERROR: libsodium build failed - static library not found"
+        exit 1
+      fi
+
+      echo "libsodium build completed successfully"
+
+      # Cleanup
+      cd ../../
+      rm -f ios/libsodium.tar.gz
+    CMD
+  else
+    s.prepare_command = <<-CMD
+      # Clean up libsodium files if they exist
+      rm -rf ios/libsodium-stable
+      rm -f ios/libsodium.tar.gz
+    CMD
+  end
+
+  base_source_files = [
     # implementation (Swift)
     "ios/**/*.{swift}",
     # ios (Objective-C++)
@@ -27,15 +93,88 @@ Pod::Spec.new do |s|
     # implementation (C++)
     "cpp/**/*.{hpp,cpp}",
     # dependencies (C++)
-    "deps/**/*.{hpp,cpp}",
-    # dependencies (C)
+    "deps/**/*.{h,cc}",
+    # dependencies (C) - exclude BLAKE3 x86 SIMD files (only use portable + NEON for ARM)
     "deps/**/*.{h,c}",
   ]
 
+  # Exclude BLAKE3 x86-specific SIMD implementations (SSE2, SSE4.1, AVX2, AVX-512)
+  # These use Intel intrinsics that don't compile on ARM
+  # Also exclude example files, TBB files, test files, and non-C directories
+  s.exclude_files = [
+    "deps/blake3/c/blake3_sse2.c",
+    "deps/blake3/c/blake3_sse41.c",
+    "deps/blake3/c/blake3_avx2.c",
+    "deps/blake3/c/blake3_avx512.c",
+    "deps/blake3/c/blake3_sse2_x86-64_unix.S",
+    "deps/blake3/c/blake3_sse41_x86-64_unix.S",
+    "deps/blake3/c/blake3_avx2_x86-64_unix.S",
+    "deps/blake3/c/blake3_avx512_x86-64_unix.S",
+    "deps/blake3/c/blake3_sse2_x86-64_windows_gnu.S",
+    "deps/blake3/c/blake3_sse41_x86-64_windows_gnu.S",
+    "deps/blake3/c/blake3_avx2_x86-64_windows_gnu.S",
+    "deps/blake3/c/blake3_avx512_x86-64_windows_gnu.S",
+    "deps/blake3/c/blake3_sse2_x86-64_windows_msvc.asm",
+    "deps/blake3/c/blake3_sse41_x86-64_windows_msvc.asm",
+    "deps/blake3/c/blake3_avx2_x86-64_windows_msvc.asm",
+    "deps/blake3/c/blake3_avx512_x86-64_windows_msvc.asm",
+    "deps/blake3/c/main.c",
+    "deps/blake3/c/example.c",
+    "deps/blake3/c/example_tbb.c",
+    "deps/blake3/c/blake3_tbb.cpp",
+    # Exclude non-C parts of BLAKE3 repo (Rust, benchmarks, tools, etc.)
+    "deps/blake3/src/**/*",
+    "deps/blake3/b3sum/**/*",
+    "deps/blake3/benches/**/*",
+    "deps/blake3/reference_impl/**/*",
+    "deps/blake3/tools/**/*",
+    "deps/blake3/test_vectors/**/*",
+  ]
+
+  if sodium_enabled
+    base_source_files += ["ios/libsodium-stable/src/libsodium/**/*.{h,c}"]
+  end
+
+  s.source_files = base_source_files
+
+  xcconfig = {
+    # C++ compiler flags, mainly for folly.
+    "GCC_PREPROCESSOR_DEFINITIONS" => "$(inherited) FOLLY_NO_CONFIG FOLLY_CFG_NO_COROUTINES",
+    # Set C++ standard to C++20
+    "CLANG_CXX_LANGUAGE_STANDARD" => "c++20",
+    "CLANG_ALLOW_NON_MODULAR_INCLUDES_IN_FRAMEWORK_MODULES" => "YES"
+  }
+
+  # Add cpp subdirectories to header search paths
+  cpp_headers = [
+    "\"$(PODS_TARGET_SRCROOT)/cpp/utils\"",
+    "\"$(PODS_TARGET_SRCROOT)/deps/ncrypto\"",
+    "\"$(PODS_TARGET_SRCROOT)/deps/blake3/c\"",
+    "\"$(PODS_TARGET_SRCROOT)/deps/fastpbkdf2\""
+  ]
+
+  if sodium_enabled
+    sodium_headers = [
+      "\"$(PODS_TARGET_SRCROOT)/ios/libsodium-stable/src/libsodium/include\"",
+      "\"$(PODS_TARGET_SRCROOT)/ios/libsodium-stable/src/libsodium/include/sodium\"",
+      "\"$(PODS_TARGET_SRCROOT)/ios/libsodium-stable\"",
+      "\"$(PODS_ROOT)/../../packages/react-native-quick-crypto/ios/libsodium-stable/src/libsodium/include\"",
+      "\"$(PODS_ROOT)/../../packages/react-native-quick-crypto/ios/libsodium-stable/src/libsodium/include/sodium\""
+    ]
+    xcconfig["HEADER_SEARCH_PATHS"] = (cpp_headers + sodium_headers).join(' ')
+    xcconfig["GCC_PREPROCESSOR_DEFINITIONS"] = "$(inherited) BLSALLOC_SODIUM=1"
+  else
+    xcconfig["HEADER_SEARCH_PATHS"] = cpp_headers.join(' ')
+  end
+
+  s.pod_target_xcconfig = xcconfig
+
   # Add all files generated by Nitrogen
-  load 'nitrogen/generated/ios/QuickCrypto+autolinking.rb'
+  load "nitrogen/generated/ios/QuickCrypto+autolinking.rb"
   add_nitrogen_files(s)
 
-  s.dependency "OpenSSL-Universal"
+  s.dependency "React-jsi"
+  s.dependency "React-callinvoker"
+  s.dependency "OpenSSL-Universal", "3.3.3001"
   install_modules_dependencies(s)
 end

package/README.md

@@ -1,12 +1,16 @@
-<a href="https://margelo.io">
-  <img src="./docs/img/banner.svg" width="100%" />
+<a href="https://margelo.com">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="./docs/img/banner-dark.png" />
+    <source media="(prefers-color-scheme: light)" srcset="./docs/img/banner-light.png" />
+    <img alt="react-native-quick-crypto" src="./docs/img/banner-light.png" />
+  </picture>
 </a>
 
 # ⚡️ react-native-quick-crypto
 
 A fast implementation of Node's `crypto` module.
 
-> Note: This version `1.x` is undergoing a major refactor, porting to New Architecture, Bridgeless, and [`Nitro Modules`](https://github.com/mrousavy/react-native-nitro) and is incomplete compared to the `0.x` version.  Status, as always, will be represented in [implementation-coverage.md](../main/docs/implementation-coverage.md).
+> Note: This version `1.x` completed a major refactor, porting to OpenSSL 3.3+, New Architecture, Bridgeless, and [`Nitro Modules`](https://github.com/mrousavy/react-native-nitro).  It should be at or above feature-parity compared to the `0.x` version.  Status, as always, will be represented in [implementation-coverage.md](../main/docs/implementation-coverage.md).
 
 > Note: Minimum supported version of React Native is `0.75`.  If you need to use earlier versions, please use `0.x` versions of this library.
 
@@ -26,31 +30,16 @@ QuickCrypto can be used as a drop-in replacement for your Web3/Crypto apps to sp
 
 | Version | RN Architecture | Modules |
 | ------- | ------ | ------- |
-| `1.x`     | new [->](https://github.com/reactwg/react-native-new-architecture/blob/main/docs/enable-apps.md)  | Nitro Modules [->](https://github.com/margelo/react-native-nitro) |
-| `0.x`     | old  | Bridge & JSI |
+| `1.x`     | new [->](https://github.com/reactwg/react-native-new-architecture/blob/main/docs/enable-apps.md)  | Nitro Modules [->](https://github.com/mrousavy/nitro) |
+| `0.x`     | old, new 🤞  | Bridge & JSI |
 
-## Benchmarks
-
-For example, creating a Wallet using ethers.js uses complex algorithms to generate a private-key/mnemonic-phrase pair:
-
-```ts
-const start = performance.now();
-const wallet = ethers.Wallet.createRandom();
-const end = performance.now();
-console.log(`Creating a Wallet took ${end - start} ms.`);
-```
-
-**Without** react-native-quick-crypto 🐢:
+## Migration
 
-```
-Creating a Wallet took 16862 ms
-```
+Our goal in refactoring to v1.0 was to maintain API compatibility.  If you are upgrading to v1.0 from v0.x, and find any discrepancies, please open an issue in this repo.
 
-**With** react-native-quick-crypto ⚡️:
+## Benchmarks
 
-```
-Creating a Wallet took 289 ms
-```
+There is a benchmark suite in the Example app in this repo that has benchmarks of algorithms against their pure JS counterparts.  This is not meant to disparage the other libraries.  On the contrary, they perform amazingly well when used in a server-side Node environment.  This library exists because React Native does not have that environment nor the Node Crypto API implementation at hand.  So the benchmark suite is there to show you the speedup vs. the alternative of using a pure JS library on React Native.
 
 ---
 
@@ -150,8 +139,6 @@ const hashed = QuickCrypto.createHash('sha256')
 
 ## Limitations
 
-As the library uses JSI for synchronous native methods access, remote debugging (e.g. with Chrome) is no longer possible. Instead, you should use [Flipper](https://fbflipper.com).
-
 Not all cryptographic algorithms are supported yet. See the [implementation coverage](./docs/implementation-coverage.md) document for more details. If you need a specific algorithm, please open a `feature request` issue and we'll see what we can do.
 
 ## Community Discord
@@ -160,7 +147,7 @@ Not all cryptographic algorithms are supported yet. See the [implementation cove
 
 ## Adopting at scale
 
-react-native-quick-crypto was built at Margelo, an elite app development agency. For enterprise support or other business inquiries, contact us at <a href="mailto:hello@margelo.io?subject=Adopting react-native-quick-crypto at scale">hello@margelo.io</a>!
+`react-native-quick-crypto` was built at Margelo, an elite app development agency. For enterprise support or other business inquiries, contact us at <a href="mailto:hello@margelo.io?subject=Adopting react-native-quick-crypto at scale">hello@margelo.io</a>!
 
 ## Contributing
 

package/android/CMakeLists.txt

@@ -1,18 +1,53 @@
+cmake_minimum_required(VERSION 3.10.0)
 project(QuickCrypto)
-cmake_minimum_required(VERSION 3.9.0)
 
 set(PACKAGE_NAME QuickCrypto)
 set(CMAKE_VERBOSE_MAKEFILE ON)
 set(CMAKE_CXX_STANDARD 20)
 
+# BLAKE3 sources - architecture-specific SIMD support
+set(BLAKE3_SOURCES
+  ../deps/blake3/c/blake3.c
+  ../deps/blake3/c/blake3_dispatch.c
+  ../deps/blake3/c/blake3_portable.c
+)
+
+if(CMAKE_ANDROID_ARCH_ABI STREQUAL "arm64-v8a")
+  # ARM64 uses NEON intrinsics (auto-detected via IS_AARCH64 in blake3_impl.h)
+  list(APPEND BLAKE3_SOURCES ../deps/blake3/c/blake3_neon.c)
+elseif(CMAKE_ANDROID_ARCH_ABI STREQUAL "x86" OR CMAKE_ANDROID_ARCH_ABI STREQUAL "x86_64")
+  # Disable x86 SIMD - would require assembly files we don't compile
+  # Falls back to portable C implementation
+  add_definitions(-DBLAKE3_NO_SSE2 -DBLAKE3_NO_SSE41 -DBLAKE3_NO_AVX2 -DBLAKE3_NO_AVX512)
+endif()
+
 # Define C++ library and add all sources
 add_library(
   ${PACKAGE_NAME} SHARED
   src/main/cpp/cpp-adapter.cpp
+  ../cpp/blake3/HybridBlake3.cpp
+  ../cpp/cipher/CCMCipher.cpp
+  ../cpp/cipher/GCMCipher.cpp
+  ../cpp/cipher/HybridCipher.cpp
+  ../cpp/cipher/HybridRsaCipher.cpp
+  ../cpp/cipher/OCBCipher.cpp
+  ../cpp/cipher/XSalsa20Cipher.cpp
+  ../cpp/cipher/ChaCha20Cipher.cpp
+  ../cpp/cipher/ChaCha20Poly1305Cipher.cpp
+  ../cpp/ec/HybridEcKeyPair.cpp
   ../cpp/ed25519/HybridEdKeyPair.cpp
+  ../cpp/hash/HybridHash.cpp
+  ../cpp/hmac/HybridHmac.cpp
+  ../cpp/keys/HybridKeyObjectHandle.cpp
+  ../cpp/keys/KeyObjectData.cpp
   ../cpp/pbkdf2/HybridPbkdf2.cpp
   ../cpp/random/HybridRandom.cpp
+  ../cpp/rsa/HybridRsaKeyPair.cpp
+  ../cpp/sign/HybridSignHandle.cpp
+  ../cpp/sign/HybridVerifyHandle.cpp
+  ${BLAKE3_SOURCES}
   ../deps/fastpbkdf2/fastpbkdf2.c
+  ../deps/ncrypto/ncrypto.cc
 )
 
 # add Nitrogen specs
@@ -21,11 +56,21 @@ include(${CMAKE_SOURCE_DIR}/../nitrogen/generated/android/QuickCrypto+autolinkin
 # local includes
 include_directories(
   "src/main/cpp"
+  "../cpp/blake3"
+  "../cpp/cipher"
+  "../cpp/ec"
   "../cpp/ed25519"
+  "../cpp/hash"
+  "../cpp/hmac"
+  "../cpp/keys"
   "../cpp/pbkdf2"
   "../cpp/random"
+  "../cpp/rsa"
+  "../cpp/sign"
   "../cpp/utils"
+  "../deps/blake3/c"
   "../deps/fastpbkdf2"
+  "../deps/ncrypto"
 )
 
 # Third party libraries (Prefabs)
@@ -36,20 +81,30 @@ find_package(openssl REQUIRED CONFIG)
 # Link all libraries together
 target_link_libraries(
   ${PACKAGE_NAME}
-  ${LOG_LIB}                             # <-- Logcat logger
-  android                                # <-- Android core
-  openssl::crypto                        # <-- OpenSSL (Crypto)
+  ${LOG_LIB}                               # <-- Logcat logger
+  android                                  # <-- Android core
+  openssl::crypto                          # <-- OpenSSL   (Crypto)
+  openssl::ssl                             # <-- OpenSSL   (SSL)
+)
+
+if(SODIUM_ENABLED)
+  add_definitions(-DBLSALLOC_SODIUM)
+  find_package(sodium REQUIRED CONFIG)
+  target_link_libraries(
+    ${PACKAGE_NAME}
+    sodium::sodium
   )
+endif()
 
 if(ReactAndroid_VERSION_MINOR GREATER_EQUAL 76)
   target_link_libraries(
     ${PACKAGE_NAME}
-    ReactAndroid::reactnative             # <-- RN: Native Modules umbrella prefab
+    ReactAndroid::reactnative              # <-- RN: Native Modules umbrella prefab
   )
 else()
   target_link_libraries(
     ${PACKAGE_NAME}
-    ReactAndroid::turbomodulejsijni
-    ReactAndroid::react_nativemodule_core  # <-- RN: React Native native module core
+    ReactAndroid::react_nativemodule_core  # <-- RN: TurboModules Core
+    ReactAndroid::turbomodulejsijni        # <-- RN: TurboModules utils (e.g. CallInvokerHolder)
   )
 endif()

package/android/build.gradle

@@ -37,6 +37,9 @@ def getExtOrIntegerDefault(name) {
   return rootProject.ext.has(name) ? rootProject.ext.get(name) : (project.properties["QuickCrypto_" + name]).toInteger()
 }
 
+def sodiumEnabled = hasProperty('sodiumEnabled') ? project.property('sodiumEnabled').toBoolean() : false // Default to false
+logger.warn("[QuickCrypto] Has libsodium ${sodiumEnabled ? "enabled" : "disabled"}!")
+
 android {
   namespace "com.margelo.nitro.quickcrypto"
   ndkVersion getExtOrDefault("ndkVersion")
@@ -50,7 +53,9 @@ android {
     externalNativeBuild {
       cmake {
         cppFlags "-frtti -fexceptions -Wall -fstack-protector-all"
-        arguments "-DANDROID_STL=c++_shared"
+        arguments "-DANDROID_STL=c++_shared",
+                  "-DSODIUM_ENABLED=${sodiumEnabled}",
+                  "-DANDROID_SUPPORT_FLEXIBLE_PAGE_SIZES=ON"
         abiFilters (*reactNativeArchitectures())
 
         buildTypes {
@@ -138,7 +143,12 @@ dependencies {
   implementation project(":react-native-nitro-modules")
 
   // Add a dependency on OpenSSL
-  implementation 'io.github.ronickg:openssl:3.3.2'
+  implementation 'io.github.ronickg:openssl:3.3.2-1'
+
+  if (sodiumEnabled) {
+    // Add a dependency on libsodium
+    implementation 'io.github.ronickg:sodium:1.0.20-1'
+  }
 }
 
 if (isNewArchitectureEnabled()) {

package/android/src/main/java/com/margelo/nitro/quickcrypto/QuickCryptoPackage.java

@@ -8,8 +8,6 @@ import com.facebook.react.bridge.NativeModule;
 import com.facebook.react.bridge.ReactApplicationContext;
 import com.facebook.react.module.model.ReactModuleInfoProvider;
 import com.facebook.react.TurboReactPackage;
-import com.margelo.nitro.core.HybridObject;
-import com.margelo.nitro.core.HybridObjectRegistry;
 
 import java.util.HashMap;
 import java.util.function.Supplier;

package/app.plugin.js

@@ -0,0 +1,3 @@
+const { createRNQCPlugin } = require('./lib/commonjs/expo-plugin/withRNQC');
+const pkg = require('./package.json');
+module.exports = createRNQCPlugin(pkg.name, pkg.version);

package/cpp/blake3/HybridBlake3.cpp

@@ -0,0 +1,118 @@
+#include "HybridBlake3.hpp"
+
+#include <NitroModules/ArrayBuffer.hpp>
+#include <cstring>
+#include <stdexcept>
+
+#include "Utils.hpp"
+
+namespace margelo::nitro::crypto {
+
+void HybridBlake3::initHash() {
+  blake3_hasher_init(&hasher);
+  mode = Mode::Hash;
+  key = std::nullopt;
+  context = std::nullopt;
+  initialized = true;
+}
+
+void HybridBlake3::initKeyed(const std::shared_ptr<ArrayBuffer>& keyBuffer) {
+  if (!keyBuffer || keyBuffer->size() != BLAKE3_KEY_LEN) {
+    throw std::runtime_error("BLAKE3 key must be exactly 32 bytes");
+  }
+
+  std::array<uint8_t, BLAKE3_KEY_LEN> keyArray;
+  std::memcpy(keyArray.data(), keyBuffer->data(), BLAKE3_KEY_LEN);
+
+  blake3_hasher_init_keyed(&hasher, keyArray.data());
+  mode = Mode::Keyed;
+  key = keyArray;
+  context = std::nullopt;
+  initialized = true;
+}
+
+void HybridBlake3::initDeriveKey(const std::string& ctx) {
+  if (ctx.empty()) {
+    throw std::runtime_error("BLAKE3 context must be a non-empty string");
+  }
+
+  blake3_hasher_init_derive_key(&hasher, ctx.c_str());
+  mode = Mode::DeriveKey;
+  key = std::nullopt;
+  context = ctx;
+  initialized = true;
+}
+
+void HybridBlake3::update(const std::shared_ptr<ArrayBuffer>& data) {
+  if (!initialized) {
+    throw std::runtime_error("BLAKE3 hasher not initialized");
+  }
+  if (!data) {
+    return;
+  }
+  blake3_hasher_update(&hasher, data->data(), data->size());
+}
+
+std::shared_ptr<ArrayBuffer> HybridBlake3::digest(std::optional<double> length) {
+  if (!initialized) {
+    throw std::runtime_error("BLAKE3 hasher not initialized");
+  }
+
+  size_t outLen = BLAKE3_OUT_LEN;
+  if (length.has_value()) {
+    double len = length.value();
+    if (len <= 0 || len > 65535) {
+      throw std::runtime_error("BLAKE3 output length must be between 1 and 65535");
+    }
+    outLen = static_cast<size_t>(len);
+  }
+
+  auto output = new uint8_t[outLen];
+  blake3_hasher_finalize(&hasher, output, outLen);
+
+  return std::make_shared<margelo::nitro::NativeArrayBuffer>(output, outLen, [=]() { delete[] output; });
+}
+
+void HybridBlake3::reset() {
+  if (!initialized) {
+    throw std::runtime_error("BLAKE3 hasher not initialized");
+  }
+
+  switch (mode) {
+    case Mode::Hash:
+      blake3_hasher_init(&hasher);
+      break;
+    case Mode::Keyed:
+      if (key.has_value()) {
+        blake3_hasher_init_keyed(&hasher, key->data());
+      }
+      break;
+    case Mode::DeriveKey:
+      if (context.has_value()) {
+        blake3_hasher_init_derive_key(&hasher, context->c_str());
+      }
+      break;
+  }
+}
+
+std::shared_ptr<HybridBlake3Spec> HybridBlake3::copy() {
+  if (!initialized) {
+    throw std::runtime_error("BLAKE3 hasher not initialized");
+  }
+
+  auto copied = std::make_shared<HybridBlake3>();
+
+  std::memcpy(&copied->hasher, &hasher, sizeof(blake3_hasher));
+  copied->initialized = true;
+  copied->mode = mode;
+  copied->key = key;
+  copied->context = context;
+
+  return copied;
+}
+
+std::string HybridBlake3::getVersion() {
+  return std::string(blake3_version());
+}
+
+} // namespace margelo::nitro::crypto

package/cpp/blake3/HybridBlake3.hpp

@@ -0,0 +1,35 @@
+#pragma once
+
+#include <memory>
+#include <optional>
+#include <string>
+
+#include "HybridBlake3Spec.hpp"
+#include "blake3.h"
+
+namespace margelo::nitro::crypto {
+
+class HybridBlake3 : public HybridBlake3Spec {
+ public:
+  HybridBlake3() : HybridObject(TAG) {}
+  ~HybridBlake3() = default;
+
+ public:
+  void initHash() override;
+  void initKeyed(const std::shared_ptr<ArrayBuffer>& key) override;
+  void initDeriveKey(const std::string& context) override;
+  void update(const std::shared_ptr<ArrayBuffer>& data) override;
+  std::shared_ptr<ArrayBuffer> digest(std::optional<double> length) override;
+  void reset() override;
+  std::shared_ptr<HybridBlake3Spec> copy() override;
+  std::string getVersion() override;
+
+ private:
+  blake3_hasher hasher;
+  bool initialized = false;
+  enum class Mode { Hash, Keyed, DeriveKey } mode = Mode::Hash;
+  std::optional<std::array<uint8_t, BLAKE3_KEY_LEN>> key;
+  std::optional<std::string> context;
+};
+
+} // namespace margelo::nitro::crypto