From e1087aa973eae7545c299ae5b2d3c4f6705a8c2a Mon Sep 17 00:00:00 2001
From: Christian Bundy <christianbundy@fraction.io>
Date: Thu, 3 Sep 2020 08:29:24 -0700
Subject: [PATCH] Finish adding crypto_auth and crypto_auth_verify

This builds on heaps of work by @chm-diederichs and is basically just
the cherry on top that exposes all of the underlying work that they've
done. The changes from this commit:

- Expose crypto_auth() and crypto_auth_verify().
- Fix 'crypto_auth_hmacsha512_BYTES' typo.
- Change output in crypto_auth_hmacsha512256().
- Change crypto_verify_n() to return booleans.
---
 crypto_auth.js   | 35 +++++++++++++++++++++++++----------
 crypto_verify.js |  4 ----
 2 files changed, 25 insertions(+), 14 deletions(-)

diff --git a/crypto_auth.js b/crypto_auth.js
index 3b8099f..4b4005a 100644
--- a/crypto_auth.js
+++ b/crypto_auth.js
@@ -1,9 +1,12 @@
 /* eslint-disable camelcase */
 const { crypto_verify_32, crypto_verify_64 } = require('./crypto_verify')
+const { sodium_memcmp } = require('./helpers')
 const Sha256 = require('sha256-universal')
 const Sha512 = require('sha512-universal')
 const assert = require('nanoassert')
 
+const crypto_auth_BYTES = 32
+const crypto_auth_KEYBYTES = 32
 const crypto_auth_hmacsha256_BYTES = 32
 const crypto_auth_hmacsha256_KEYBYTES = 32
 const crypto_auth_hmacsha512_BYTES = 64
@@ -14,7 +17,7 @@ const crypto_auth_hmacsha512256_KEYBYTES = 32
 function crypto_auth_hmacsha256 (out, input, k) {
   assert(out.byteLength === crypto_auth_hmacsha256_BYTES, "out should be 'crypto_auth_hmacsha256_BYTES' in length")
 
-  const hmac = Sha256.HMAC(key)
+  const hmac = Sha256.HMAC(k)
   hmac.update(input)
   return hmac.digest(out)
 }
@@ -28,7 +31,7 @@ function crypto_auth_hmacsha256_verify (h, input, k) {
 function crypto_auth_hmacsha512 (out, input, k) {
   assert(out.byteLength === crypto_auth_hmacsha512_BYTES, "out should be 'crypto_auth_hmacsha512_BYTES' in length")
 
-  const hmac = Sha512.HMAC(key)
+  const hmac = Sha512.HMAC(k)
   hmac.update(input)
   return hmac.digest(out)
 }
@@ -40,12 +43,12 @@ function crypto_auth_hmacsha512_verify (h, input, k) {
 }
 
 function crypto_auth_hmacsha512256 (out, input, k) {
-  assert(out.byteLength === crypto_auth_hmacsha512_BYTES, "out should be 'crypto_auth_hmacsha512256_BYTES' in length")
-  
-  const out0 = Buffer.alloc(64)
-  const hmac = Sha512.HMAC(key)
+  assert(out.byteLength === crypto_auth_hmacsha512256_BYTES, "out should be 'crypto_auth_hmacsha512256_BYTES' in length")
+
+  const out0 = new Uint8Array(64)
+  const hmac = Sha512.HMAC(k)
   hmac.update(input)
-  hmac.digest(out)
+  hmac.digest(out0)
 
   out.set(out0.subarray(0, 32))
 }
@@ -53,20 +56,32 @@ function crypto_auth_hmacsha512256 (out, input, k) {
 function crypto_auth_hmacsha512256_verify (h, input, k) {
   const correct = Sha512.HMAC(k).update(input).digest()
 
-  return crypto_verify_32(h, 0, correct, 0) | sodium_memcmp(correct, h, 32)
+  return crypto_verify_32(h, 0, correct, 0) | sodium_memcmp(correct.subarray(32), h, 32)
+}
+
+function crypto_auth (out, input, k) {
+  return crypto_auth_hmacsha512256(out, input, k)
+}
+
+function crypto_auth_verify (h, input, k) {
+  return crypto_auth_hmacsha512256_verify(h, input, k)
 }
 
 module.exports = {
+  crypto_auth_BYTES,
+  crypto_auth_KEYBYTES,
   crypto_auth_hmacsha256_BYTES,
   crypto_auth_hmacsha256_KEYBYTES,
   crypto_auth_hmacsha512_BYTES,
   crypto_auth_hmacsha512_KEYBYTES,
   crypto_auth_hmacsha512256_BYTES,
   crypto_auth_hmacsha512256_KEYBYTES,
+  crypto_auth,
+  crypto_auth_verify,
   crypto_auth_hmacsha256,
   crypto_auth_hmacsha256_verify,
   crypto_auth_hmacsha512,
-  crypto_auth_hmacsha512_verify,
   crypto_auth_hmacsha512256,
-  crypto_auth_hmacsha512256_verify
+  crypto_auth_hmacsha512256_verify,
+  crypto_auth_hmacsha512_verify
 }
diff --git a/crypto_verify.js b/crypto_verify.js
index d32120f..afa666d 100644
--- a/crypto_verify.js
+++ b/crypto_verify.js
@@ -27,7 +27,3 @@ function crypto_verify_32 (x, xi, y, yi) {
 function crypto_verify_64 (x, xi, y, yi) {
   return vn(x, xi, y, yi, 64) === 0
 }
-
-function crypto_verify_64 (x, xi, y, yi) {
-  return vn(x, xi, y, yi, 64)
-}