cheng/libsodium
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,636 Commits 1 Branch 0 Tags 32 MiB
623cbfc168
Commit Graph

1315 Commits

Author SHA1 Message Date
Frank Denis
9cd732c88d Indent 2017-02-23 11:12:18 +01:00
Frank Denis
0ccc6d7661 Indent 2017-02-23 11:06:27 +01:00
Frank Denis
32a084222a Indent 2017-02-23 10:57:18 +01:00
Frank Denis
9626d7af59 Indent, remove duplicate includes 2017-02-23 10:51:42 +01:00
Frank Denis
61adf7f777 Leverage COMPILER_ASSERT 2017-02-23 10:49:53 +01:00
Frank Denis
02c2def25e inline 2017-02-23 10:40:42 +01:00
Frank Denis
5535ff8946 Indent 2017-02-23 10:38:37 +01:00
Frank Denis
68466a7ed7 Ident, reuse COMPILER_ASSERT 2017-02-23 10:37:57 +01:00
Frank Denis
14d54b9d22 Do not invent your own types 2017-02-23 10:34:32 +01:00
Frank Denis
a60ac31ba4 Clean up the aes128ctr code 2017-02-23 10:30:44 +01:00
Frank Denis
2be6fc4800 Indent 2017-02-23 10:14:13 +01:00
Frank Denis
2838bcd04c Indent 2017-02-23 10:12:43 +01:00
Frank Denis
a70446a127 Indent 2017-02-23 10:12:04 +01:00
Frank Denis
6980d47ec2 Indent 2017-02-23 10:09:08 +01:00
Frank Denis
2a24a27afa Indent 2017-02-23 09:57:09 +01:00
Frank Denis
a1c4cf5b3c Indent 2017-02-23 09:47:12 +01:00
Frank Denis
cad6561799 Indent 2017-02-23 09:42:15 +01:00
Frank Denis
9fbd5c0c18 Indent 2017-02-23 09:39:59 +01:00
Frank Denis
b25cffb7f1 Indent 2017-02-23 09:39:02 +01:00
Frank Denis
5a843719b1 Use inlined functions instead of macros 2017-02-23 09:35:41 +01:00
Frank Denis
fe3ed40a76 Reuse ROTR64 2017-02-23 09:27:47 +01:00
Frank Denis
a3d7bc065e Reuse macros 2017-02-23 09:24:15 +01:00
Frank Denis
c06418a382 Indent 2017-02-23 09:05:47 +01:00
Frank Denis
05349aa14d Avoid multiple definitions of ROTL/ROTR macros 2017-02-23 09:01:50 +01:00
Frank Denis
9fdca4a8c9 There's pretty much nothing left from the original code 2017-02-20 21:13:59 +01:00
Frank Denis
f5673c7cc0 Avoid negating unsigned values 2017-02-20 21:12:33 +01:00
Frank Denis
76e8776839 Merge a couple more files 2017-02-20 10:32:23 +01:00
Frank Denis
bb67b383ef Drop the _api suffixes 2017-02-20 09:50:34 +01:00
Frank Denis
7e5d64834c untab 2017-02-19 21:17:42 +01:00
Frank Denis
7f7e7235c5 Add a keygen function to all the primitives 2017-02-19 21:15:54 +01:00
Frank Denis
fe3e60392c C++ compat 2017-02-19 19:03:18 +01:00
Frank Denis
eb5ff7270e Use the IETF ChaCha20 version for randombytes_buf_deterministic() 
It doesn't make any difference except by limiting the maximum
length to 256 Gb. But the code for the IETF version has a higher
probability to already be used by something else than the original
version.
Enforcing a 256 Gb limit can also prevent surprises from happening
in other implementations.
 2017-02-19 18:55:32 +01:00
Frank Denis
4c6b0ac762 Add aliases for stream_chacha20 sizes, similar to chacha20poly1305 2017-02-19 18:54:25 +01:00
Frank Denis
cafb0a695b Add randombytes_buf_deterministic() 2017-02-19 18:40:29 +01:00
Frank Denis
70c2796ae5 + crypto_kdf high-level API 
This is a common need, and people end up reimplementing HKDF.

So, add a crypto_kdf() API similiar to libhydrogen's. The later has a
higher limit for the output length using BLAKE2X if required.

We can implement the same strategy later in libsodium if needed.
 2017-02-19 18:13:10 +01:00
Frank Denis
7555ae37f0 blake2 -> blake2b 2017-02-19 17:15:41 +01:00
Frank Denis
e0150faf56 Always zero the argon2 output buffer prior to doing anything 
This is consistent with what we are doing with scrypt.
On error/misuse, the buffer is zeroed; this may prevent bugs with
reused/invalid buffers.
 2017-02-19 12:40:28 +01:00
Frank Denis
2c6fb87708 Set crypto_pwhash_scryptsalsa208sha256_BYTES_MIN to 128 bits 2017-02-19 12:31:05 +01:00
Frank Denis
2e4e1c66a0 Complete 08c0e03f83 2017-02-19 12:23:37 +01:00
Emil Bay
08c0e03f83 WIP: crypto_pwhash constants (#464) 
* Test exposed constraint constants on crypto_pwhash

This includes the following constants for crypto_pwhash, crypto_pwhash_argon2i,
and crypto_pwhash_scryptsalsa208sha256:

- crypto_pwhash_BYTES_MIN
- crypto_pwhash_BYTES_MAX
- crypto_pwhash_PASSWD_MIN
- crypto_pwhash_PASSWD_MAX
- crypto_pwhash_OPSLIMIT_MIN
- crypto_pwhash_OPSLIMIT_MAX
- crypto_pwhash_MEMLIMIT_MIN
- crypto_pwhash_MEMLIMIT_MAX

* Expose constraint constants for crypto_pwhash

* Expose constant methods for crypto_pwhash
 2017-02-19 11:19:01 +01:00
Frank Denis
20d1d048fd Merge a couple files 
These are unlikely to have multiple implementations ever, unlike their
underlying primitives, so move them one folder up instead and take it
as an opportunity to merge small files.
 2017-02-18 21:53:32 +01:00
Frank Denis
a329340d90 Remove the NaCl-like APIs from *xchacha20 additions 
These APIs were useful with the salsa20 constructions for compatibility
with NaCl, but they are tricky to use and don't provide any benefits over
the _easy APIs.

Having them around was good for consistency with the salsa20-based ones,
but this is code that is unlikely to be used in actual projects.

So, don't include them, unless people actually ask for them.
 2017-02-18 21:22:39 +01:00
Frank Denis
4c2cf071f8 Include <intrin.h> on Visual Studio for __cpuid() 2017-02-16 09:24:33 +01:00
Frank Denis
727dae49e2 Back out locks in randombytes_salsa20 
These functions were not supposed to be thread-safe, and we can't
use crit_*() in the randombytes implementations anyway.
 2017-02-10 18:01:06 +01:00
Frank Denis
d5fc01b317 Merge branch 'master' of https://github.com/jedisct1/libsodium 
* 'master' of https://github.com/jedisct1/libsodium:
  C++ compat
 2017-02-04 11:41:49 +01:00
Frank Denis
5095fc9afa Reorder 2017-02-04 11:40:20 +01:00
Frank DENIS
e59bfee281 C++ compat 2017-01-31 17:14:12 +01:00
Frank Denis
8439df646b Favor the Windows API over pthreads on mingw 2017-01-26 20:34:46 +01:00
Frank Denis
de3c0ff85e Indent 2017-01-18 20:03:26 +01:00
Frank Denis
f053b98b64 Use getrandom() on dietlibc -- via Felix von Leitner 2017-01-18 20:00:25 +01:00
Frank Denis
3633726d56 Indent 2017-01-13 19:28:18 +01:00
Frank Denis
1686da3d3c Remove the non-IETF versions of crypto_aead_xchacha20poly1305 2017-01-13 19:24:48 +01:00
Frank Denis
4e8832ed57 Merge branch 'master' of https://github.com/jedisct1/libsodium 
* 'master' of https://github.com/jedisct1/libsodium:
  Indent
  xchacha20poly1305: optimize and be compatible with ietf chacha20poly1305 (#461)
 2016-12-27 21:03:12 +01:00
Frank DENIS
24fd77ded3 Indent 2016-12-24 02:24:24 +01:00
Jason A. Donenfeld
6abad20323 xchacha20poly1305: optimize and be compatible with ietf chacha20poly1305 (#461) 
Due to SSL, the IETF version of chacha20poly1305 is going to be the one
that's in libraries places. While the 12-byte nonce thing is a little
weird, it has other benefits, like adding padding to the auth tag, which
might help fend off certain attacks.

But more importantly, since chacha20poly1305 in the IETF construction is
lots of places, it would be useful to be able to build xchacha20poly1305
out of it. Fortunately it's very easy to make hchacha20 (either
stand-alone, or out of the normal chacha20 block function), and then
that can be composed with an existing library's chacha20poly1305. It
looks a bit like this:

    xchacha20poly1305(input, key, nonce) {
        new_key = hchacha20(key, nonce)
        return chacha20poly1305(input, new_key, nonce + 16)
    }

This is also an efficient way to do it, since it means hchacha20 must
only be computed once.

Unfortuantely, non-IETF xchacha20poly1305 means that you deprive
virtually all other libraries that only support the more common
IETF construction the ability the ability to interoperate with
libsodium, through the simple construction. Rather, it forces
everyone to reimplement the AEAD part.

So, this commit adds a xchacha20poly1305 that uses the IETF construction
with the padding.

While we're at it, we redefine xchacha20poly1305 in terms of
chacha20poly1305, which gives the same output, but computes one less
hchacha20 and is generally a lot cleaner and simpler to understand.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2016-12-24 02:17:33 +01:00
Frank Denis
c5735ef215 Merge branch 'master' of https://github.com/jedisct1/libsodium 
* 'master' of https://github.com/jedisct1/libsodium:
  Check if atomic operations are supported
  Remove a whitespace following trailing backslash in a Makefile
 2016-12-17 19:00:59 +01:00
Frank Denis
d54b0b8d69 Do not include xchacha20poly1305 in minimal mode 2016-12-17 18:59:17 +01:00
Frank Denis
db97a35502 Check if atomic operations are supported 2016-12-16 16:37:12 +01:00
Frank Denis
4c6f704084 Remove a whitespace following trailing backslash in a Makefile 2016-12-16 16:20:30 +01:00
Frank Denis
9d2ac5f747 Correct an assertion and prefer compile-time assertions 2016-12-11 20:28:03 +01:00
Frank Denis
9979762bbe Indent 2016-12-11 00:01:40 +01:00
Winston Durand
9cae7b6b7c fixed GCC2 bug seeing empty statement (#449) 2016-11-30 06:52:18 +01:00
Frank Denis
157c4a80c1 + crypto_aead_xchacha20poly1305 2016-11-26 21:29:26 +01:00
Frank Denis
8b7f03ddf7 Indent 2016-11-26 21:16:42 +01:00
Frank Denis
184110ccc5 + crypto_box_curve25519xchacha20poly1305_* 2016-11-26 21:06:23 +01:00
Frank Denis
54a1357ce3 Indent 2016-11-26 20:24:58 +01:00
Frank Denis
2ace041fd9 Add secretbox_xchacha20poly1305_easy 2016-11-26 19:45:24 +01:00
Frank Denis
d4f384e388 Make crypto_secretbox_xsalsa20poly1305_open() as __warn_unused_result__ 2016-11-26 19:44:51 +01:00
Frank Denis
669ed597d0 Rename box_x*poly1305.c -> secretbox_x*poly1305.c for consistency 2016-11-26 14:12:47 +01:00
Frank Denis
2848984edf + secretbox_xchacha20poly1305 2016-11-26 14:04:23 +01:00
Frank Denis
a86ac590d6 Reformat to make the style more consistent 2016-11-26 13:40:34 +01:00
Frank Denis
5eed910c11 Cast the scalar instead of the coefficient 2016-10-30 01:13:22 +02:00
Frank Denis
71f0693ee7 Argon2i: fix encoding issues 
For compatibility with hashes might have been encoded using other libraries.
 2016-10-26 22:50:38 +02:00
Frank Denis
aff4aaeabf Change the garbage value to 0xdb 
If that garbage value becomes the LSB of a pointer, the pointer is more
likely to be unaligned, an trigger more bugs.
 2016-10-15 18:54:56 +02:00
Frank Denis
49741c59e8 Allows RANDOMBYTES_DEFAULT_IMPLEMENTATION to be overriden 2016-10-13 22:57:01 +02:00
Frank Denis
583c16707c + crypto_stream_xchacha20 2016-09-30 22:57:56 +02:00
Frank Denis
42dc78b38b Indent 2016-09-30 08:40:15 +02:00
Frank Denis
b20d227f37 Avoid collision with a possibly existing int128 type definition 2016-09-30 08:36:50 +02:00
Frank Denis
53ee1fe758 Remove commented out code and avoid inconsistent indentation 2016-09-30 08:30:22 +02:00
Frank Denis
f257413772 uint32 -> uint32_t 2016-09-30 08:26:24 +02:00
Robert Spychala
94ea419247 add preprocessor flag to skip blocking /dev/random during libsodium init (#429) 2016-09-20 21:13:07 +02:00
Frank Denis
26e8b0253f Argon2: check that m_cost/t_cost/lanes decode to uint32 2016-09-18 09:33:35 +02:00
Frank Denis
6035c0779b Back to dev mode 2016-08-04 02:28:21 +02:00
Frank Denis
2f4f718cd9 Remove dev flag 2016-07-31 16:34:11 +02:00
Frank Denis
19a9d18b9c _MSC_VER > 1600 -> _MSC_VER >= 1700 for consistency 2016-07-24 19:58:00 +02:00
Jan-E
6b739fc821 Fix VS2010 (and VC9) x64 build 2016-07-24 02:13:22 +02:00
Frank Denis
89918e94f1 crit_{enter,leave} can fail 2016-07-06 12:03:08 +02:00
Frank Denis
29492143ab Warn if the library is being compiled in a custom way 2016-07-02 10:07:38 +02:00
Frank Denis
2cc0bab0e3 Update comment 2016-06-29 15:31:23 +02:00
Frank Denis
648f46d22a Expose sodium_crit_enter() and sodium_crit_leave() internally 2016-06-29 15:28:15 +02:00
Frank Denis
5a3ff833fd Slightly change how the length of argon2 strings is checked 2016-06-19 23:26:08 +02:00
Frank Denis
6fad3644b5 Nits 2016-06-15 16:00:59 +02:00
Aaron Zauner
77c05fce0c document why RtlGenRandom is used 2016-06-15 21:50:33 +08:00
Frank Denis
aaf6854edf Remove extra space 2016-06-08 08:34:45 +02:00
Frank Denis
9c12da0362 Don't include <immintrin.h> if it is not needed 
Some environments provide <wmmintrin.h> but not <immintrin.h>
 2016-05-26 06:08:26 -07:00
Frank Denis
fa4e4bf174 Fix & simplify MADV_DO{NO}DUMP alternatives 2016-05-18 22:12:07 +02:00
Lev Serebryakov
7a4c4459f8 Support madvise() on FreeBSD 
FreeBSD have madvise() behaviors equivalent to MADV_DONTDUMP and MADV_DODUMP but with its own names.
Add definitions for these behaviors used in sodium_mlock() and sodium_munlock() if FreeBSD names are found and Linux ones don't.
 2016-05-18 23:04:09 +03:00
Frank Denis
f01299a91b Indent 2016-05-17 23:05:04 +02:00
Samuel Neves
998bacf375 don't crash on Win32 2016-05-17 21:40:56 +01:00
Frank Denis
efb81c7290 CRLF 2016-05-17 01:41:06 +02:00
Thomas Waldmann
b9c266181b fix avx2 feature detection, fixes #395 
cpuid needed to get called with EAX = 7 to get the "extended features"
(not with EAX = 1 for the "features").
 2016-05-17 01:28:03 +02:00
Frank Denis
263101cfaf sandy2x: don't mix VEX and non-VEX instructions 2016-05-17 00:24:33 +02:00
Frank Denis
080dcadb69 Merge pull request #396 from langboost/master 
Fixing a small documentation typo
 2016-05-16 23:42:20 +02:00
Frank Denis
f361d1ccec sandy2x: clean the upper halves of the AVX registers 
On Linux, with dynamic linking, upper AVX registers are not 0, which
introduces a massive performance penalty due to state transitions.

Thanks to to Tung Chou and Samuel Neves for catching this, and to
@theakman2 for his initial report.
 2016-05-16 23:34:03 +02:00
Jeff R
0b8cb8a543 Fixing a small documentation typo 2016-05-16 16:05:24 -05:00
Frank Denis
593599a11a Align loops 2016-05-16 12:25:35 +02:00
Frank Denis
c303c1f709 sandy2x: align branch targets 2016-05-16 12:20:15 +02:00
Frank Denis
c752eb55d9 On ancient Linux kernels, block on /dev/random before using /dev/urandom 2016-05-15 17:26:22 +02:00
Frank Denis
248f381404 Rewrite aesni_key256_expand() for clarity 2016-05-05 19:10:11 +02:00
Frank Denis
a37d2b87bf Rename REDUCE4 to MULREDUCE4 for clarity 2016-05-04 23:31:09 +02:00
Frank Denis
0f053aea52 Grammar 2016-05-04 23:09:07 +02:00
Frank Denis
44cd974be2 Remove extra CRLF 2016-04-30 11:20:14 +02:00
Frank Denis
7a667edbd0 NativeClient: use get_random_bytes directly instead of the wrapper 2016-04-29 10:51:13 +02:00
Frank Denis
681176e187 abort() if nacl_secure_random() ever returns 0 but the wrong size 2016-04-29 10:08:45 +02:00
Frank Denis
fbad64f6ef Disable asm on native client 2016-04-28 21:31:18 +02:00
Frank Denis
5f3b59c8b0 Tabify 2016-04-27 11:37:21 +02:00
Frank Denis
46539b9381 Indent 2016-04-27 00:11:00 +02:00
Frank Denis
ffd5987e7c Proper lock test on Windows 2016-04-26 01:43:00 +02:00
Frank Denis
d908d08b0d Simplify the fallback _sodium_crit_enter() code 2016-04-25 20:15:33 +02:00
Frank Denis
f8ff8ebf66 Add locks around sodium_init() 2016-04-25 18:33:11 +02:00
Frank Denis
14211cd7ea Update include guard 2016-04-22 12:01:56 +02:00
Frank Denis
b2586f5402 Use the same convention for include guards everywhere 2016-04-22 11:46:37 +02:00
Frank Denis
801fbde757 scrypt/sse - Note that B's layout is permuted compared to nosse 2016-04-21 20:37:11 +02:00
Frank Denis
2de4b3f514 Hand-roll zeroing instead of relying on memset() 2016-04-21 17:17:24 +02:00
Frank Denis
492d4b1dd6 Repair NativeClient support 2016-04-18 21:40:18 +02:00
Frank Denis
8ab4334945 if -> ifdef 2016-04-18 16:53:34 +02:00
Frank Denis
531ce5bd32 Do not use getrandom(2) on SLES11 service pack 4 2016-04-14 17:21:42 +02:00
Frank Denis
34aeee6ba5 Replace two more memcpy() with a local loop 2016-04-12 07:30:54 +02:00
Frank Denis
d7294320c4 sha{512,256}: use a local loop instead of if + memcpy() 
Compilers can't figure out the max inlen value, so help them with an
explicit AND.

Unify the name of the input pointer by the way.
 2016-04-12 02:14:45 +02:00
Frank Denis
bbf1e17983 Avoid bit shifting with signed values 2016-04-12 00:51:41 +02:00
Frank Denis
50e11be472 memcpy(): pointers must be valid even if the size is 0 2016-04-12 00:41:37 +02:00
Frank Denis
0a590b07b2 Decryption functions can now accept a NULL pointer for the output 
This checks the MAC without writing the decrypted message.
 2016-04-11 18:33:50 +02:00
Frank Denis
80310ef56c Set randombytes_implementation to NULL by default, to cope with Visual Studio 2008 2016-04-08 17:50:18 +02:00
Frank Denis
a53a9c98d2 Back to dev mode 2016-04-08 08:25:42 +02:00
Frank Denis
22ab28be0a Require Visual Studio 2010+ for AESNI 2016-04-07 18:57:07 +02:00
Frank Denis
292969b3b5 Argon2: initialize ctx{.pwd,.pwdlen} in the verify function 
Keep initializing the length for clarity;
Compilers know how to optimize this out.
 2016-04-07 08:19:50 +02:00
Frank Denis
1818267d64 Return -1 if crypto_generichash_final() is called twice 2016-04-06 01:00:49 +02:00
Frank Denis
97b09aba0b Move curve25519_ref10.h to include/sodium/private/ 2016-04-04 18:03:08 +02:00
Frank Denis
8df895b3ec include/sodium/private.h -> include/sodium/private/common.h 2016-04-04 17:16:32 +02:00
Frank Denis
3927cad829 Relocate sodium/common.h 2016-04-04 16:28:40 +02:00
Frank Denis
501ec7a679 Adjust another relative path for sodium/common.h 2016-04-04 08:44:59 +02:00
David Renshaw
c3b68c12d6 Fix up relative includes of sodium/common.h 2016-04-04 03:18:24 +00:00
Frank Denis
1550026a9a Explain why blake2b_param_set_digest_length() is not needed 2016-04-03 13:52:55 +02:00
Frank Denis
0716b7701e Initialize constant 2016-04-02 12:17:47 +02:00
Frank Denis
1853248f0a Consistency 2016-04-02 12:08:41 +02:00
Frank Denis
e50f1e95ab Reuse STORE64_LE whenever possible 2016-04-02 11:46:53 +02:00
Frank Denis
6ee06a9242 Include missing structures definitions 2016-04-02 09:01:03 +02:00
Frank Denis
698efbdc23 Consistency 2016-04-02 01:20:38 +02:00
Frank Denis
531c51e7a3 Stronger types for >= 16 bits shifts 2016-04-02 01:06:04 +02:00
Frank Denis
ca71815db3 ((unsigned long long) 1) -> 1ULL 2016-04-02 00:57:33 +02:00