react-native-quick-crypto 1.1.0 → 1.1.2

package/cpp/utils/HybridUtils.cpp

@@ -1,5 +1,8 @@
 #include "HybridUtils.hpp"
 
+#include <NitroModules/JSIConverter.hpp>
+#include <bit>
+#include <cstring>
 #include <openssl/crypto.h>
 #include <stdexcept>
 #include <string>
@@ -13,6 +16,25 @@ namespace margelo::nitro::crypto {
 namespace {
 
   constexpr char kHexChars[] = "0123456789abcdef";
+  constexpr bool kCanDirectCopyUtf16 = std::endian::native == std::endian::little && sizeof(char16_t) == 2;
+
+  // Probe if jsi::String::createFromUtf16() is available
+  // jsi::String::createFromUtf16(Runtime& runtime, const char16_t* utf16, size_t length)
+  // and
+  // jsi::String::createFromUtf16(Runtime& runtime, const std::u16string& utf16) are available in RN v0.79.0 and later:
+  // https://github.com/facebook/react-native/commit/d9d824055e9f24614abd5657f9fc89a6ab3f2da2
+  template <typename JSIString = facebook::jsi::String>
+  concept HasStringCreateFromUtf16 = requires(facebook::jsi::Runtime& runtime, const char16_t* utf16, size_t length) {
+    JSIString::createFromUtf16(runtime, utf16, length);
+  };
+
+  // Probe if jsi::String::getStringData() is available
+  // jsi::String::getStringData() is available in RN v0.78.0 and later:
+  // https://github.com/facebook/react-native/commit/c6f12254d16d87978383c08065a626d437e60450
+  template <typename JSIString = facebook::jsi::String>
+  concept HasStringGetStringData = requires(const JSIString& str, facebook::jsi::Runtime& runtime, void (*cb)(bool, const void*, size_t)) {
+    str.getStringData(runtime, cb);
+  };
 
   int hexCharToVal(char c) {
     if (c >= '0' && c <= '9')
@@ -86,6 +108,73 @@ namespace {
     return result;
   }
 
+  template <typename JSIString = facebook::jsi::String>
+  JSIString createUtf16LeString(facebook::jsi::Runtime& runtime, const uint8_t* data, size_t len) {
+    if constexpr (HasStringCreateFromUtf16<JSIString>) {
+      if constexpr (kCanDirectCopyUtf16) {
+        // Fast&direct copy path
+        return JSIString::createFromUtf16(runtime, reinterpret_cast<const char16_t*>(data), len / 2);
+      }
+      // Slow path for unexpected endianness/char16_t size
+      const size_t codeUnitCount = len / 2;
+      std::u16string result(codeUnitCount, u'\0');
+      if (codeUnitCount == 0) {
+        return JSIString::createFromUtf16(runtime, result);
+      }
+
+      for (size_t i = 0; i < codeUnitCount; i++) {
+        result[i] = static_cast<char16_t>(static_cast<uint16_t>(data[i * 2]) | (static_cast<uint16_t>(data[i * 2 + 1]) << 8));
+      }
+      return JSIString::createFromUtf16(runtime, result);
+    }
+    throw std::runtime_error("Unsupported encoding: utf16le");
+  }
+
+  template <typename JSIString = facebook::jsi::String>
+  std::vector<uint8_t> decodeUtf16Le(facebook::jsi::Runtime& runtime, const JSIString& str) {
+    if constexpr (HasStringGetStringData<JSIString>) {
+      std::vector<uint8_t> result;
+      // str.utf8() cannot preserve raw UTF-16 code units such as unpaired surrogates.
+      // Use jsi::String::getStringData() instead.
+      auto chunkCallback = [&result](bool isAscii, const void* data, size_t num) {
+        if (num == 0) {
+          return;
+        }
+
+        size_t offset = result.size();
+        result.resize(offset + (num * 2)); // This fills the buffer with '\0'
+
+        auto* dst = result.data() + offset;
+        if (isAscii) {
+          // Widen ASCII characters from char into char16_t
+          const auto* asciiSrc = reinterpret_cast<const char*>(data);
+          for (size_t i = 0; i < num; i++, dst += 2) {
+            *dst = asciiSrc[i];
+            // *(dst + 1) = '\0' is unnecessary because the buffer is zero filled in resize()
+          }
+          return;
+        }
+
+        const auto* utf16Src = reinterpret_cast<const char16_t*>(data);
+        if constexpr (kCanDirectCopyUtf16) {
+          // Fast&direct copy path
+          std::memcpy(dst, utf16Src, num * 2);
+          return;
+        }
+        // Slow path for unexpected endianness/char16_t size
+        for (size_t i = 0; i < num; i++) {
+          const uint16_t codeUnit = static_cast<uint16_t>(utf16Src[i]);
+          dst[i * 2 + 0] = static_cast<uint8_t>(codeUnit & 0xFFu);
+          dst[i * 2 + 1] = static_cast<uint8_t>(codeUnit >> 8);
+        }
+      };
+
+      str.getStringData(runtime, chunkCallback);
+      return result;
+    }
+    throw std::runtime_error("Unsupported encoding: utf16le");
+  }
+
   std::vector<uint8_t> decodeLatin1(const std::string& str) {
     std::vector<uint8_t> result;
     result.reserve(str.size());
@@ -142,56 +231,119 @@ bool HybridUtils::timingSafeEqual(const std::shared_ptr<ArrayBuffer>& a, const s
   return CRYPTO_memcmp(a->data(), b->data(), aLen) == 0;
 }
 
-std::string HybridUtils::bufferToString(const std::shared_ptr<ArrayBuffer>& buffer, const std::string& encoding) {
-  const auto* data = reinterpret_cast<const uint8_t*>(buffer->data());
-  size_t len = buffer->size();
-
-  if (encoding == "hex") {
-    return encodeHex(data, len);
-  }
-  if (encoding == "base64") {
-    return encodeBase64(data, len);
+facebook::jsi::Value HybridUtils::bufferToJsiString(facebook::jsi::Runtime& runtime, const facebook::jsi::Value&,
+                                                    const facebook::jsi::Value* args, size_t argCount) {
+  // Runtime argument check from react-native-nitro-modules/cpp/core/HybridFunction.hpp
+  if (argCount != 4) [[unlikely]] {
+    throw facebook::jsi::JSError(runtime,
+                                 "`Utils.bufferToString(...)` expected 4 arguments, but received " + std::to_string(argCount) + "!");
   }
-  if (encoding == "base64url") {
-    return encodeBase64Url(data, len);
-  }
-  if (encoding == "utf8" || encoding == "utf-8") {
-    return std::string(reinterpret_cast<const char*>(data), len);
-  }
-  if (encoding == "latin1" || encoding == "binary") {
-    return encodeLatin1(data, len);
-  }
-  if (encoding == "ascii") {
-    std::string result(reinterpret_cast<const char*>(data), len);
-    for (auto& c : result) {
-      c &= 0x7F;
+
+  // Exception wrapper from react-native-nitro-modules/cpp/core/HybridFunction.hpp
+  try {
+    // bufferToString(buffer: ArrayBuffer, encoding: string, start: number, end: number): string;
+    // Defined in utils/conversion.ts
+    auto buffer = JSIConverter<std::shared_ptr<ArrayBuffer>>::fromJSI(runtime, args[0]);
+    std::string encoding = JSIConverter<std::string>::fromJSI(runtime, args[1]);
+    const size_t bufferSize = buffer->size();
+    // `start` and `end` are normalized in the TS code
+    // so it's safe to use `static_cast<size_t>` here
+    const size_t start = static_cast<size_t>(JSIConverter<double>::fromJSI(runtime, args[2]));
+    const size_t end = static_cast<size_t>(JSIConverter<double>::fromJSI(runtime, args[3]));
+    if (start > end || end > bufferSize) {
+      // This should never happen if called from the TS wrapper
+      // Add this check to avoid out of bounds access
+      throw std::runtime_error("Invalid start/end value");
     }
-    return result;
+    const size_t offset = start;
+    const size_t length = end - start;
+
+    const auto* data = reinterpret_cast<const uint8_t*>(buffer->data() + offset);
+
+    if (encoding == "hex") {
+      return facebook::jsi::String::createFromUtf8(runtime, encodeHex(data, length));
+    }
+    if (encoding == "base64") {
+      return facebook::jsi::String::createFromUtf8(runtime, encodeBase64(data, length));
+    }
+    if (encoding == "base64url") {
+      return facebook::jsi::String::createFromUtf8(runtime, encodeBase64Url(data, length));
+    }
+    if (encoding == "utf8" || encoding == "utf-8") {
+      return facebook::jsi::String::createFromUtf8(runtime, data, length);
+    }
+    if (encoding == "latin1" || encoding == "binary") {
+      return facebook::jsi::String::createFromUtf8(runtime, encodeLatin1(data, length));
+    }
+    if (encoding == "ascii") {
+      std::string result(reinterpret_cast<const char*>(data), length);
+      for (auto& c : result) {
+        c &= 0x7F;
+      }
+      return facebook::jsi::String::createFromUtf8(runtime, result);
+    }
+    if (encoding == "utf16le") {
+      return createUtf16LeString(runtime, data, length);
+    }
+    throw std::runtime_error("Unsupported encoding: " + encoding);
+  } catch (const std::exception& exception) {
+    throw facebook::jsi::JSError(runtime, "Utils.bufferToString(...): " + std::string(exception.what()));
+  } catch (...) {
+    throw facebook::jsi::JSError(runtime,
+                                 "`Utils.bufferToString(...)` threw an unknown " + TypeInfo::getCurrentExceptionName() + " error.");
   }
-  throw std::runtime_error("Unsupported encoding: " + encoding);
 }
 
-std::shared_ptr<ArrayBuffer> HybridUtils::stringToBuffer(const std::string& str, const std::string& encoding) {
-  if (encoding == "hex") {
-    auto decoded = decodeHex(str);
-    return ArrayBuffer::move(std::move(decoded));
-  }
-  if (encoding == "base64" || encoding == "base64url") {
-    auto decoded = decodeBase64(str);
-    return ArrayBuffer::move(std::move(decoded));
+facebook::jsi::Value HybridUtils::jsiStringToBuffer(facebook::jsi::Runtime& runtime, const facebook::jsi::Value&,
+                                                    const facebook::jsi::Value* args, size_t argCount) {
+  // Runtime argument check from react-native-nitro-modules/cpp/core/HybridFunction.hpp
+  if (argCount != 2) [[unlikely]] {
+    throw facebook::jsi::JSError(runtime,
+                                 "`Utils.stringToBuffer(...)` expected 2 arguments, but received " + std::to_string(argCount) + "!");
   }
-  if (encoding == "utf8" || encoding == "utf-8") {
-    return ArrayBuffer::copy(reinterpret_cast<const uint8_t*>(str.data()), str.size());
-  }
-  if (encoding == "latin1" || encoding == "binary") {
-    auto decoded = decodeLatin1(str);
-    return ArrayBuffer::move(std::move(decoded));
-  }
-  if (encoding == "ascii") {
-    auto decoded = decodeLatin1(str);
-    return ArrayBuffer::move(std::move(decoded));
+
+  // Exception wrapper from react-native-nitro-modules/cpp/core/HybridFunction.hpp
+  try {
+    // stringToBuffer(str: string, encoding: string): ArrayBuffer; Defined in utils/conversion.ts
+    auto str = args[0].asString(runtime);
+    std::string encoding = JSIConverter<std::string>::fromJSI(runtime, args[1]);
+
+    if (encoding == "hex") {
+      auto decoded = decodeHex(str.utf8(runtime));
+      return JSIConverter<std::shared_ptr<ArrayBuffer>>::toJSI(runtime, ArrayBuffer::move(std::move(decoded)));
+    }
+    if (encoding == "base64" || encoding == "base64url") {
+      auto decoded = decodeBase64(str.utf8(runtime));
+      return JSIConverter<std::shared_ptr<ArrayBuffer>>::toJSI(runtime, ArrayBuffer::move(std::move(decoded)));
+    }
+    if (encoding == "utf8" || encoding == "utf-8") {
+      auto utf8Str = str.utf8(runtime);
+      return JSIConverter<std::shared_ptr<ArrayBuffer>>::toJSI(
+          runtime, ArrayBuffer::copy(reinterpret_cast<const uint8_t*>(utf8Str.data()), utf8Str.size()));
+    }
+    if (encoding == "latin1" || encoding == "binary" || encoding == "ascii") {
+      auto decoded = decodeLatin1(str.utf8(runtime));
+      return JSIConverter<std::shared_ptr<ArrayBuffer>>::toJSI(runtime, ArrayBuffer::move(std::move(decoded)));
+    }
+    if (encoding == "utf16le") {
+      auto decoded = decodeUtf16Le(runtime, str);
+      return JSIConverter<std::shared_ptr<ArrayBuffer>>::toJSI(runtime, ArrayBuffer::move(std::move(decoded)));
+    }
+    throw std::runtime_error("Unsupported encoding: " + encoding);
+  } catch (const std::exception& exception) {
+    throw facebook::jsi::JSError(runtime, "Utils.stringToBuffer(...): " + std::string(exception.what()));
+  } catch (...) {
+    throw facebook::jsi::JSError(runtime,
+                                 "`Utils.stringToBuffer(...)` threw an unknown " + TypeInfo::getCurrentExceptionName() + " error.");
   }
-  throw std::runtime_error("Unsupported encoding: " + encoding);
+}
+
+void HybridUtils::loadHybridMethods() {
+  HybridUtilsSpec::loadHybridMethods();
+  registerHybrids(this, [](Prototype& prototype) {
+    prototype.registerRawHybridMethod("bufferToString", 4, &HybridUtils::bufferToJsiString);
+    prototype.registerRawHybridMethod("stringToBuffer", 2, &HybridUtils::jsiStringToBuffer);
+  });
 }
 
 } // namespace margelo::nitro::crypto

package/cpp/utils/HybridUtils.hpp

@@ -10,8 +10,15 @@ class HybridUtils : public HybridUtilsSpec {
 
  public:
   bool timingSafeEqual(const std::shared_ptr<ArrayBuffer>& a, const std::shared_ptr<ArrayBuffer>& b) override;
-  std::string bufferToString(const std::shared_ptr<ArrayBuffer>& buffer, const std::string& encoding) override;
-  std::shared_ptr<ArrayBuffer> stringToBuffer(const std::string& str, const std::string& encoding) override;
+
+ protected:
+  void loadHybridMethods() override;
+
+ private:
+  facebook::jsi::Value bufferToJsiString(facebook::jsi::Runtime& runtime, const facebook::jsi::Value& thisArg,
+                                         const facebook::jsi::Value* args, size_t argCount);
+  facebook::jsi::Value jsiStringToBuffer(facebook::jsi::Runtime& runtime, const facebook::jsi::Value& thisArg,
+                                         const facebook::jsi::Value* args, size_t argCount);
 };
 
 } // namespace margelo::nitro::crypto

package/cpp/utils/QuickCryptoUtils.hpp

@@ -2,11 +2,16 @@
 
 #include <algorithm>
 #include <cctype>
+#include <cmath>
+#include <cstddef>
+#include <cstdint>
 #include <limits>
 #include <openssl/bn.h>
+#include <openssl/crypto.h>
 #include <openssl/err.h>
 #include <openssl/evp.h>
 #include <string>
+#include <type_traits>
 #include <vector>
 
 #include "Macros.hpp"
@@ -68,6 +73,73 @@ inline bool CheckIsInt32(double value) {
   return (value >= std::numeric_limits<int32_t>::lowest() && value <= std::numeric_limits<int32_t>::max());
 }
 
+// Validate a JS-side `double` intended to be an unsigned integer in
+// [minValue, maxValue], then cast it to T. Rejects NaN, +/-Infinity, negative
+// values, and fractional values BEFORE the cast — `static_cast<uint32_t>(NaN)`
+// and friends are undefined behavior in C++, and the audit found ~20 sites
+// that did the cast naked. Throws `std::runtime_error` carrying `paramName`
+// on any failure so JS callers see a descriptive, actionable message.
+//
+// The helper is templated so callers pick the destination type
+// (uint32_t, uint64_t, size_t, ...). T must be an unsigned integer type.
+template <typename T>
+T validateUInt(double value, const char* paramName, T minValue = 0, T maxValue = std::numeric_limits<T>::max()) {
+  static_assert(std::is_integral_v<T> && std::is_unsigned_v<T>, "validateUInt: T must be an unsigned integer type");
+
+  if (std::isnan(value)) {
+    throw std::runtime_error(std::string(paramName) + " must be a finite number, got NaN");
+  }
+  if (std::isinf(value)) {
+    throw std::runtime_error(std::string(paramName) + std::string(" must be a finite number, got ") +
+                             (value > 0 ? "+Infinity" : "-Infinity"));
+  }
+  if (value < 0) {
+    throw std::runtime_error(std::string(paramName) + " must be non-negative, got " + std::to_string(value));
+  }
+  if (value != std::floor(value)) {
+    throw std::runtime_error(std::string(paramName) + " must be an integer, got " + std::to_string(value));
+  }
+  if (value < static_cast<double>(minValue) || value > static_cast<double>(maxValue)) {
+    throw std::runtime_error(std::string(paramName) + " out of range [" + std::to_string(minValue) + ", " + std::to_string(maxValue) +
+                             "], got " + std::to_string(value));
+  }
+  return static_cast<T>(value);
+}
+
+// Securely zero a memory range using OPENSSL_cleanse, which the compiler is
+// guaranteed not to optimize away even when the buffer is about to leave
+// scope. Use this for any memory that held secrets — keys, derived bits,
+// shared secrets, plaintext, PEM/DER private-key strings, IV/nonce material.
+//
+// Plain std::memset is unsafe for this purpose: under -O2 the compiler will
+// see that the memset writes are dead (the memory is freed or going out of
+// scope right after) and elide them, leaving the secret on the heap.
+//
+// Overloads cover the common shapes: raw pointer + size, vector, string,
+// fixed-size array. The audit found ~30 sites that need this — XSalsa20,
+// XChaCha20-Poly1305, all KDFs, DH/ECDH shared secrets, RSA/EC/Ed/DSA DER
+// private-key strings — and they get swept in Phase 2.
+inline void secureZero(void* ptr, std::size_t size) {
+  if (ptr != nullptr && size > 0) {
+    OPENSSL_cleanse(ptr, size);
+  }
+}
+
+inline void secureZero(std::vector<uint8_t>& vec) {
+  secureZero(vec.data(), vec.size());
+}
+
+inline void secureZero(std::string& s) {
+  if (!s.empty()) {
+    secureZero(s.data(), s.size());
+  }
+}
+
+template <std::size_t N>
+inline void secureZero(uint8_t (&arr)[N]) {
+  secureZero(static_cast<void*>(arr), N);
+}
+
 // Function to convert a string to lowercase
 inline std::string toLower(std::string s) {
   std::transform(s.begin(), s.end(), s.begin(), [](unsigned char c) { return static_cast<char>(std::tolower(c)); });

package/deps/blake3/README.md

@@ -176,14 +176,13 @@ See [`c/README.md`](c/README.md).
 
 ### Other implementations
 
-We post links to third-party bindings and implementations on the
-[@BLAKE3team Twitter account](https://twitter.com/BLAKE3team) whenever
-we hear about them. Some highlights include [an optimized Go
+There are too many implementations out there for us to keep track of,
+but some highlights include [an optimized Go
 implementation](https://github.com/zeebo/blake3), [Wasm bindings for
 Node.js and browsers](https://github.com/connor4312/blake3), [binary
 wheels for Python](https://github.com/oconnor663/blake3-py), [.NET
-bindings](https://github.com/xoofx/Blake3.NET), and [JNI
-bindings](https://github.com/sken77/BLAKE3jni).
+bindings](https://github.com/xoofx/Blake3.NET), and [a pure Java
+implementation](https://commons.apache.org/proper/commons-codec/apidocs/org/apache/commons/codec/digest/Blake3.html).
 
 ## Contributing
 
@@ -202,7 +201,7 @@ Alternatively, it is licensed under any of the following:
 
 * [Bazel](https://github.com/bazelbuild/bazel/releases/tag/6.4.0)
 * [Cargo](https://github.com/rust-lang/cargo/pull/14137)
-* [Ccache](https://github.com/ccache/ccache/pull/519)
+* [Ccache](https://ccache.dev/releasenotes.html#_ccache_4_0)
 * [Chia](https://github.com/Chia-Network/chia-blockchain/blob/main/CHANGELOG.md#10beta8-aka-beta-18---2020-07-16)
 * [Clickhouse](https://github.com/ClickHouse/ClickHouse/blob/master/rust/chcache/Cargo.toml#L7)
 * [Farcaster](https://www.farcaster.xyz/)
@@ -220,7 +219,7 @@ Alternatively, it is licensed under any of the following:
 
 ## Miscellany
 
-- [@veorq] and [@oconnor663] did [an interview with Cryptography FM](https://www.cryptography.fm/3).
+- [@veorq] and [@oconnor663] did [an interview with Cryptography FM](https://cryptography.fireside.fm/3).
 - [@oconnor663] did [an interview with Saito](https://www.youtube.com/watch?v=cJkmIt7yN_E).
 
 [@oconnor663]: https://github.com/oconnor663

package/deps/blake3/c/blake3.c

@@ -1,6 +1,7 @@
 #include <assert.h>
 #include <stdbool.h>
 #include <string.h>
+#include <stdint.h>
 
 #include "blake3.h"
 #include "blake3_impl.h"
@@ -303,8 +304,8 @@ size_t blake3_compress_subtree_wide(const uint8_t *input, size_t input_len,
   uint8_t *right_cvs = &cv_array[degree * BLAKE3_OUT_LEN];
 
   // Recurse!
-  size_t left_n = -1;
-  size_t right_n = -1;
+  size_t left_n = SIZE_MAX;
+  size_t right_n = SIZE_MAX;
 
 #if defined(BLAKE3_USE_TBB)
   blake3_compress_subtree_wide_join_tbb(

package/deps/blake3/c/blake3.h

@@ -30,7 +30,7 @@
 extern "C" {
 #endif
 
-#define BLAKE3_VERSION_STRING "1.8.2"
+#define BLAKE3_VERSION_STRING "1.8.5"
 #define BLAKE3_KEY_LEN 32
 #define BLAKE3_OUT_LEN 32
 #define BLAKE3_BLOCK_LEN 64
@@ -38,7 +38,7 @@ extern "C" {
 #define BLAKE3_MAX_DEPTH 54
 
 // This struct is a private implementation detail. It has to be here because
-// it's part of blake3_hasher below.
+// it's part of the blake3_hasher structure defined below.
 typedef struct {
   uint32_t cv[8];
   uint64_t chunk_counter;

package/deps/blake3/c/blake3_dispatch.c

@@ -89,7 +89,6 @@ static void cpuidex(uint32_t out[4], uint32_t id, uint32_t sid) {
 #endif
 }
 
-#endif
 
 enum cpu_feature {
   SSE2 = 1 << 0,
@@ -164,6 +163,7 @@ static
 #endif
   }
 }
+#endif
 
 void blake3_compress_in_place(uint32_t cv[8],
                               const uint8_t block[BLAKE3_BLOCK_LEN],
@@ -235,7 +235,7 @@ void blake3_xof_many(const uint32_t cv[8],
 #if defined(IS_X86)
   const enum cpu_feature features = get_cpu_features();
   MAYBE_UNUSED(features);
-#if !defined(_WIN32) && !defined(BLAKE3_NO_AVX512)
+#if !defined(_WIN32) && !defined(__CYGWIN__) && !defined(BLAKE3_NO_AVX512)
   if (features & AVX512VL) {
     blake3_xof_many_avx512(cv, block, block_len, counter, flags, out, outblocks);
     return;

package/deps/blake3/c/blake3_impl.h

@@ -309,7 +309,7 @@ void blake3_hash_many_avx512(const uint8_t *const *inputs, size_t num_inputs,
                              uint8_t flags, uint8_t flags_start,
                              uint8_t flags_end, uint8_t *out);
 
-#if !defined(_WIN32)
+#if !defined(_WIN32) && !defined(__CYGWIN__)
 void blake3_xof_many_avx512(const uint32_t cv[8],
                             const uint8_t block[BLAKE3_BLOCK_LEN],
                             uint8_t block_len, uint64_t counter, uint8_t flags,

package/deps/blake3/c/blake3_neon.c

@@ -243,10 +243,11 @@ INLINE void load_counters4(uint64_t counter, bool increment_counter,
       counter_high(counter + (mask & 2)), counter_high(counter + (mask & 3)));
 }
 
-void blake3_hash4_neon(const uint8_t *const *inputs, size_t blocks,
-                       const uint32_t key[8], uint64_t counter,
-                       bool increment_counter, uint8_t flags,
-                       uint8_t flags_start, uint8_t flags_end, uint8_t *out) {
+static void blake3_hash4_neon(const uint8_t *const *inputs, size_t blocks,
+                              const uint32_t key[8], uint64_t counter,
+                              bool increment_counter, uint8_t flags,
+                              uint8_t flags_start, uint8_t flags_end, 
+                              uint8_t *out) {
   uint32x4_t h_vecs[8] = {
       set1_128(key[0]), set1_128(key[1]), set1_128(key[2]), set1_128(key[3]),
       set1_128(key[4]), set1_128(key[5]), set1_128(key[6]), set1_128(key[7]),

package/deps/ncrypto/include/ncrypto/version.h

@@ -3,12 +3,12 @@
 #ifndef NCRYPTO_VERSION_H_
 #define NCRYPTO_VERSION_H_
 
-#define NCRYPTO_VERSION "1.1.3"  // x-release-please-version
+#define NCRYPTO_VERSION "1.1.4"  // x-release-please-version
 
 enum {
   NCRYPTO_VERSION_MAJOR = 1,     // x-release-please-major
   NCRYPTO_VERSION_MINOR = 1,     // x-release-please-minor
-  NCRYPTO_VERSION_REVISION = 3,  // x-release-please-patch
+  NCRYPTO_VERSION_REVISION = 4,  // x-release-please-patch
 };
 
 #endif  // NCRYPTO_VERSION_H_

package/deps/ncrypto/include/ncrypto.h

@@ -690,6 +690,8 @@ class DataPointer final {
   bool isSecure() const { return secure_; }
 
  private:
+  void free();
+
   void* data_ = nullptr;
   size_t len_ = 0;
   bool secure_ = false;
@@ -897,6 +899,9 @@ class EVPKeyPointer final {
     DER,
     PEM,
     JWK,
+    RAW_PUBLIC,
+    RAW_PRIVATE,
+    RAW_SEED,
   };
 
   enum class PKParseError { NOT_RECOGNIZED, NEED_PASSPHRASE, FAILED };
@@ -906,6 +911,7 @@ class EVPKeyPointer final {
     bool output_key_object = false;
     PKFormatType format = PKFormatType::DER;
     PKEncodingType type = PKEncodingType::PKCS8;
+    int ec_point_form = POINT_CONVERSION_UNCOMPRESSED;
     AsymmetricKeyEncodingConfig() = default;
     AsymmetricKeyEncodingConfig(bool output_key_object,
                                 PKFormatType format,
@@ -1620,8 +1626,9 @@ int NoPasswordCallback(char* buf, int size, int rwflag, void* u);
 
 int PasswordCallback(char* buf, int size, int rwflag, void* u);
 
-bool SafeX509SubjectAltNamePrint(const BIOPointer& out, X509_EXTENSION* ext);
-bool SafeX509InfoAccessPrint(const BIOPointer& out, X509_EXTENSION* ext);
+bool SafeX509SubjectAltNamePrint(const BIOPointer& out,
+                                 const X509_EXTENSION* ext);
+bool SafeX509InfoAccessPrint(const BIOPointer& out, const X509_EXTENSION* ext);
 
 // ============================================================================
 // SPKAC