0.7.1

* add crypto_auth_hmac methods

crypto_aead.js

@@ -30,7 +30,7 @@ function crypto_aead_chacha20poly1305_ietf_encrypt (c, m, ad, nsec, npub, k) {
 }
 
 function crypto_aead_chacha20poly1305_ietf_encrypt_detached (c, mac, m, ad, nsec, npub, k) {
-  if (ad === null) return crypto_aead_chacha20poly1305_ietf_encrypt(c, mac, m, new Uint8Array(0), nsec, npub, k)
+  if (ad === null) return crypto_aead_chacha20poly1305_ietf_encrypt_detached(c, mac, m, new Uint8Array(0), nsec, npub, k)
 
   assert(c.byteLength === m.byteLength, 'ciphertext should be same length than message')
   assert(npub.byteLength === crypto_aead_chacha20poly1305_ietf_NPUBBYTES,
@@ -91,7 +91,7 @@ function crypto_aead_chacha20poly1305_ietf_decrypt (m, nsec, c, ad, npub, k) {
 }
 
 function crypto_aead_chacha20poly1305_ietf_decrypt_detached (m, nsec, c, mac, ad, npub, k) {
-  if (ad === null) return crypto_aead_chacha20poly1305_ietf_decrypt(m, nsec, c, mac, new Uint8Array(0), npub, k)
+  if (ad === null) return crypto_aead_chacha20poly1305_ietf_decrypt_detached(m, nsec, c, mac, new Uint8Array(0), npub, k)
 
   assert(c.byteLength === m.byteLength, 'message should be same length than ciphertext')
   assert(npub.byteLength === crypto_aead_chacha20poly1305_ietf_NPUBBYTES,
@@ -131,7 +131,7 @@ function crypto_aead_chacha20poly1305_ietf_decrypt_detached (m, nsec, c, mac, ad
   computed_mac.fill(0)
   slen.fill(0)
 
-  if (ret !== 0) {
+  if (!ret) {
     m.fill(0)
     throw new Error('could not verify data')
   }

crypto_auth.js

@@ -1,72 +1,35 @@
 /* eslint-disable camelcase */
-const { crypto_verify_32, crypto_verify_64 } = require('./crypto_verify')
-const Sha256 = require('sha256-universal')
+const { crypto_verify_32 } = require('./crypto_verify')
 const Sha512 = require('sha512-universal')
 const assert = require('nanoassert')
 
-const crypto_auth_hmacsha256_BYTES = 32
-const crypto_auth_hmacsha256_KEYBYTES = 32
-const crypto_auth_hmacsha512_BYTES = 64
-const crypto_auth_hmacsha512_KEYBYTES = 32
-const crypto_auth_hmacsha512256_BYTES = 32
-const crypto_auth_hmacsha512256_KEYBYTES = 32
+const crypto_auth_BYTES = 32
+const crypto_auth_KEYBYTES = 32
 
-function crypto_auth_hmacsha256 (out, input, k) {
-  assert(out.byteLength === crypto_auth_hmacsha256_BYTES, "out should be 'crypto_auth_hmacsha256_BYTES' in length")
+function crypto_auth (out, input, k) {
+  assert(out.byteLength === crypto_auth_BYTES, "out should be 'crypto_auth_BYTES' in length")
+  assert(k.byteLength === crypto_auth_KEYBYTES, "key should be 'crypto_auth_KEYBYTES' in length")
 
-  const hmac = Sha256.HMAC(key)
+  const out0 = new Uint8Array(64)
+  const hmac = Sha512.HMAC(k)
   hmac.update(input)
-  return hmac.digest(out)
-}
-
-function crypto_auth_hmacsha256_verify (h, input, k) {
-  const correct = Sha256.HMAC(k).update(input).digest()
-
-  return crypto_verify_32(h, 0, correct, 0) | sodium_memcmp(correct, h, 32)
-}
-
-function crypto_auth_hmacsha512 (out, input, k) {
-  assert(out.byteLength === crypto_auth_hmacsha512_BYTES, "out should be 'crypto_auth_hmacsha512_BYTES' in length")
-
-  const hmac = Sha512.HMAC(key)
-  hmac.update(input)
-  return hmac.digest(out)
-}
-
-function crypto_auth_hmacsha512_verify (h, input, k) {
-  const correct = Sha512.HMAC(k).update(input).digest()
-
-  return crypto_verify_64(h, 0, correct, 0) | sodium_memcmp(correct, h, 64)
-}
-
-function crypto_auth_hmacsha512256 (out, input, k) {
-  assert(out.byteLength === crypto_auth_hmacsha512_BYTES, "out should be 'crypto_auth_hmacsha512256_BYTES' in length")
-  
-  const out0 = Buffer.alloc(64)
-  const hmac = Sha512.HMAC(key)
-  hmac.update(input)
-  hmac.digest(out)
+  hmac.digest(out0)
 
   out.set(out0.subarray(0, 32))
 }
 
-function crypto_auth_hmacsha512256_verify (h, input, k) {
+function crypto_auth_verify (h, input, k) {
+  assert(h.byteLength === crypto_auth_BYTES, "h should be 'crypto_auth_BYTES' in length")
+  assert(k.byteLength === crypto_auth_KEYBYTES, "key should be 'crypto_auth_KEYBYTES' in length")
+
   const correct = Sha512.HMAC(k).update(input).digest()
 
-  return crypto_verify_32(h, 0, correct, 0) | sodium_memcmp(correct, h, 32)
+  return crypto_verify_32(h, 0, correct, 0)
 }
 
 module.exports = {
-  crypto_auth_hmacsha256_BYTES,
-  crypto_auth_hmacsha256_KEYBYTES,
-  crypto_auth_hmacsha512_BYTES,
-  crypto_auth_hmacsha512_KEYBYTES,
-  crypto_auth_hmacsha512256_BYTES,
-  crypto_auth_hmacsha512256_KEYBYTES,
-  crypto_auth_hmacsha256,
-  crypto_auth_hmacsha256_verify,
-  crypto_auth_hmacsha512,
-  crypto_auth_hmacsha512_verify,
-  crypto_auth_hmacsha512256,
-  crypto_auth_hmacsha512256_verify
+  crypto_auth_BYTES,
+  crypto_auth_KEYBYTES,
+  crypto_auth,
+  crypto_auth_verify
 }

crypto_box.js

@@ -3,7 +3,13 @@ const { crypto_hash_sha512 } = require('./crypto_hash')
 const { crypto_scalarmult, crypto_scalarmult_base } = require('./crypto_scalarmult')
 const { randombytes } = require('./randombytes')
 const { crypto_generichash_batch } = require('./crypto_generichash')
-const { crypto_secretbox_open_easy, crypto_secretbox_easy } = require('./crypto_secretbox')
+const { crypto_stream_xsalsa20_MESSAGEBYTES_MAX } = require('./crypto_stream')
+const {
+  crypto_secretbox_open_easy,
+  crypto_secretbox_easy,
+  crypto_secretbox_detached,
+  crypto_secretbox_open_detached
+} = require('./crypto_secretbox')
 const xsalsa20 = require('xsalsa20')
 const assert = require('nanoassert')
 
@@ -15,8 +21,17 @@ const crypto_box_BOXZEROBYTES = 16
 const crypto_box_SEALBYTES = 48
 const crypto_box_SEEDBYTES = 32
 const crypto_box_BEFORENMBYTES = 32
+const crypto_box_MACBYTES = 16
+
+const crypto_box_curve25519xsalsa20poly1305_MACBYTES = 16
+
+const crypto_box_MESSAGEBYTES_MAX =
+  crypto_stream_xsalsa20_MESSAGEBYTES_MAX -
+  crypto_box_curve25519xsalsa20poly1305_MACBYTES
 
 module.exports = {
+  crypto_box_easy,
+  crypto_box_open_easy,
   crypto_box_keypair,
   crypto_box_seed_keypair,
   crypto_box_seal,
@@ -28,7 +43,8 @@ module.exports = {
   crypto_box_BOXZEROBYTES,
   crypto_box_SEALBYTES,
   crypto_box_SEEDBYTES,
-  crypto_box_BEFORENMBYTES
+  crypto_box_BEFORENMBYTES,
+  crypto_box_MACBYTES
 }
 
 function crypto_box_keypair (pk, sk) {
@@ -37,7 +53,6 @@ function crypto_box_keypair (pk, sk) {
   randombytes(sk, 32)
   return crypto_scalarmult_base(pk, sk)
 }
-
 function crypto_box_seed_keypair (pk, sk, seed) {
   assert(pk.byteLength === crypto_box_PUBLICKEYBYTES, "pk should be 'crypto_box_PUBLICKEYBYTES' bytes")
   assert(sk.byteLength === crypto_box_SECRETKEYBYTES, "sk should be 'crypto_box_SECRETKEYBYTES' bytes")
@@ -95,6 +110,87 @@ function crypto_box_seal_open (m, c, pk, sk) {
   return crypto_secretbox_open_easy(m, c.subarray(epk.length), n, k)
 }
 
+function crypto_box_beforenm (k, pk, sk) {
+  const zero = new Uint8Array(16)
+  const s = new Uint8Array(32)
+
+  assert(crypto_scalarmult(s, sk, pk) === 0)
+
+  xsalsa20.core_hsalsa20(k, zero, s, xsalsa20.SIGMA)
+
+  return true
+}
+
+function crypto_box_detached_afternm (c, mac, m, n, k) {
+  return crypto_secretbox_detached(c, mac, m, n, k)
+}
+
+function crypto_box_detached (c, mac, m, n, pk, sk) {
+  check(mac, crypto_box_MACBYTES)
+  check(n, crypto_box_NONCEBYTES)
+  check(pk, crypto_box_PUBLICKEYBYTES)
+  check(sk, crypto_box_SECRETKEYBYTES)
+
+  const k = new Uint8Array(crypto_box_BEFORENMBYTES)
+
+  assert(crypto_box_beforenm(k, pk, sk))
+
+  const ret = crypto_box_detached_afternm(c, mac, m, n, k)
+  cleanup(k)
+
+  return ret
+}
+
+function crypto_box_easy (c, m, n, pk, sk) {
+  assert(
+    c.length >= m.length + crypto_box_MACBYTES,
+    "c should be at least 'm.length + crypto_box_MACBYTES' bytes"
+  )
+  assert(
+    m.length <= crypto_box_MESSAGEBYTES_MAX,
+    "m should be at most 'crypto_box_MESSAGEBYTES_MAX' bytes"
+  )
+
+  return crypto_box_detached(
+    c.subarray(crypto_box_MACBYTES, m.length + crypto_box_MACBYTES),
+    c.subarray(0, crypto_box_MACBYTES),
+    m,
+    n,
+    pk,
+    sk
+  )
+}
+
+function crypto_box_open_detached_afternm (m, c, mac, n, k) {
+  return crypto_secretbox_open_detached(m, c, mac, n, k)
+}
+
+function crypto_box_open_detached (m, c, mac, n, pk, sk) {
+  const k = new Uint8Array(crypto_box_BEFORENMBYTES)
+  assert(crypto_box_beforenm(k, pk, sk))
+
+  const ret = crypto_box_open_detached_afternm(m, c, mac, n, k)
+  cleanup(k)
+
+  return ret
+}
+
+function crypto_box_open_easy (m, c, n, pk, sk) {
+  assert(
+    c.length >= m.length + crypto_box_MACBYTES,
+    "c should be at least 'm.length + crypto_box_MACBYTES' bytes"
+  )
+
+  return crypto_box_open_detached(
+    m,
+    c.subarray(crypto_box_MACBYTES, m.length + crypto_box_MACBYTES),
+    c.subarray(0, crypto_box_MACBYTES),
+    n,
+    pk,
+    sk
+  )
+}
+
 function check (buf, len) {
   if (!buf || (len && buf.length < len)) throw new Error('Argument must be a buffer' + (len ? ' of length ' + len : ''))
 }

crypto_onetimeauth.js

@@ -23,7 +23,6 @@ function crypto_onetimeauth (mac, msg, key) {
   var s = new Poly1305(key)
   s.update(msg, 0, msg.byteLength)
   s.finish(mac, 0)
-  return true
 }
 
 function crypto_onetimeauth_verify (mac, msg, key) {
@@ -33,5 +32,5 @@ function crypto_onetimeauth_verify (mac, msg, key) {
 
   var tmp = new Uint8Array(16)
   crypto_onetimeauth(tmp, msg, key)
-  return crypto_verify_16(mac, 0, tmp, 0) === 0
+  return crypto_verify_16(mac, 0, tmp, 0)
 }

crypto_secretbox.js

@@ -37,7 +37,6 @@ function crypto_secretbox (c, m, n, k) {
     c.subarray(0, crypto_onetimeauth_KEYBYTES)
   )
   c.fill(0, 0, crypto_secretbox_BOXZEROBYTES)
-  return 0
 }
 
 function crypto_secretbox_open (m, c, n, k) {
@@ -69,8 +68,8 @@ function crypto_secretbox_detached (o, mac, msg, n, k) {
 
   const tmp = new Uint8Array(msg.byteLength + mac.byteLength)
   crypto_secretbox_easy(tmp, msg, n, k)
-  o.set(tmp.subarray(0, msg.byteLength))
-  mac.set(tmp.subarray(msg.byteLength))
+  mac.set(tmp.subarray(0, mac.byteLength))
+  o.set(tmp.subarray(mac.byteLength))
   return true
 }
 
@@ -81,8 +80,8 @@ function crypto_secretbox_open_detached (msg, o, mac, n, k) {
   assert(k.byteLength === crypto_secretbox_KEYBYTES, "k must be 'crypto_secretbox_KEYBYTES' bytes")
 
   const tmp = new Uint8Array(o.byteLength + mac.byteLength)
-  tmp.set(o)
-  tmp.set(mac, msg.byteLength)
+  tmp.set(mac)
+  tmp.set(o, mac.byteLength)
   return crypto_secretbox_open_easy(msg, tmp, n, k)
 }
 
@@ -94,9 +93,8 @@ function crypto_secretbox_easy (o, msg, n, k) {
   const m = new Uint8Array(crypto_secretbox_ZEROBYTES + msg.byteLength)
   const c = new Uint8Array(m.byteLength)
   m.set(msg, crypto_secretbox_ZEROBYTES)
-  if (crypto_secretbox(c, m, n, k) === false) return false
+  crypto_secretbox(c, m, n, k)
   o.set(c.subarray(crypto_secretbox_BOXZEROBYTES))
-  return true
 }
 
 function crypto_secretbox_open_easy (msg, box, n, k) {

crypto_sign.js

@@ -8,11 +8,19 @@ const {
   inv25519, unpack25519
 } = require('./internal/ed25519')
 const { randombytes } = require('./randombytes')
+const { crypto_scalarmult_BYTES } = require('./crypto_scalarmult.js')
+const { crypto_hash_sha512_BYTES } = require('./crypto_hash.js')
+const assert = require('nanoassert')
 
-const crypto_sign_BYTES = 64
-const crypto_sign_PUBLICKEYBYTES = 32
-const crypto_sign_SECRETKEYBYTES = 64
-const crypto_sign_SEEDBYTES = 32
+const crypto_sign_ed25519_PUBLICKEYBYTES = 32
+const crypto_sign_ed25519_SECRETKEYBYTES = 64
+const crypto_sign_ed25519_SEEDBYTES = 32
+const crypto_sign_ed25519_BYTES = 64
+
+const crypto_sign_BYTES = crypto_sign_ed25519_BYTES
+const crypto_sign_PUBLICKEYBYTES = crypto_sign_ed25519_PUBLICKEYBYTES
+const crypto_sign_SECRETKEYBYTES = crypto_sign_ed25519_SECRETKEYBYTES
+const crypto_sign_SEEDBYTES = crypto_sign_ed25519_SEEDBYTES
 
 module.exports = {
   crypto_sign_keypair,
@@ -24,7 +32,16 @@ module.exports = {
   crypto_sign_BYTES,
   crypto_sign_PUBLICKEYBYTES,
   crypto_sign_SECRETKEYBYTES,
-  crypto_sign_SEEDBYTES
+  crypto_sign_SEEDBYTES,
+  crypto_sign_ed25519_PUBLICKEYBYTES,
+  crypto_sign_ed25519_SECRETKEYBYTES,
+  crypto_sign_ed25519_SEEDBYTES,
+  crypto_sign_ed25519_BYTES,
+  crypto_sign_ed25519_pk_to_curve25519,
+  crypto_sign_ed25519_sk_to_curve25519,
+  crypto_sign_ed25519_sk_to_pk,
+  unpackneg,
+  pack
 }
 
 function set25519 (r, a) {
@@ -85,6 +102,8 @@ function pack (r, p) {
 }
 
 function scalarmult (p, q, s) {
+  // don't mutate q
+  var h = [gf(q[0]), gf(q[1]), gf(q[2]), gf(q[3])]
   var b, i
   set25519(p[0], gf0)
   set25519(p[1], gf1)
@@ -92,10 +111,10 @@ function scalarmult (p, q, s) {
   set25519(p[3], gf0)
   for (i = 255; i >= 0; --i) {
     b = (s[(i / 8) | 0] >> (i & 7)) & 1
-    cswap(p, q, b)
-    add(q, p)
+    cswap(p, h, b)
+    add(h, p)
     add(p, p)
-    cswap(p, q, b)
+    cswap(p, h, b)
   }
 }
 
@@ -126,7 +145,6 @@ function crypto_sign_keypair (pk, sk, seeded) {
   pack(pk, p)
 
   for (i = 0; i < 32; i++) sk[i + 32] = pk[i]
-  return 0
 }
 
 function crypto_sign_seed_keypair (pk, sk, seed) {
@@ -242,16 +260,18 @@ function unpackneg (r, p) {
 
   S(chk, r[0])
   M(chk, chk, den)
-  if (neq25519(chk, num)) M(r[0], r[0], I)
+  if (!neq25519(chk, num)) M(r[0], r[0], I)
 
   S(chk, r[0])
   M(chk, chk, den)
-  if (neq25519(chk, num)) return -1
+  if (!neq25519(chk, num)) return false
 
-  if (par25519(r[0]) === (p[31] >> 7)) Z(r[0], gf0, r[0])
+  if (par25519(r[0]) === (p[31] >> 7)) {
+    Z(r[0], gf(), r[0])
+  }
 
   M(r[3], r[0], r[1])
-  return 0
+  return true
 }
 
 /* eslint-disable no-unused-vars */
@@ -270,7 +290,7 @@ function crypto_sign_open (msg, sm, pk) {
   mlen = -1
   if (n < 64) return false
 
-  if (unpackneg(q, pk)) return false
+  if (!unpackneg(q, pk)) return false
 
   for (i = 0; i < n; i++) m[i] = sm[i]
   for (i = 0; i < 32; i++) m[i + 32] = pk[i]
@@ -283,7 +303,7 @@ function crypto_sign_open (msg, sm, pk) {
   pack(t, p)
 
   n -= 64
-  if (crypto_verify_32(sm, 0, t, 0)) {
+  if (!crypto_verify_32(sm, 0, t, 0)) {
     for (i = 0; i < n; i++) m[i] = 0
     return false
     // throw new Error('crypto_sign_open failed')
@@ -317,6 +337,133 @@ function neq25519 (a, b) {
   return crypto_verify_32(c, 0, d, 0)
 }
 
-function check (buf, len) {
-  if (!buf || (len && buf.length < len)) throw new Error('Argument must be a buffer' + (len ? ' of length ' + len : ''))
+function ed25519_mul_l (p, q) {
+  scalarmult(p, q, L)
+}
+
+function ed25519_is_on_main_subgroup (p) {
+  var pl = [gf(), gf(), gf(), gf()]
+
+  ed25519_mul_l(pl, p)
+
+  var zero = 0
+  for (let i = 0; i < 16; i++) {
+    zero |= (pl[0][i] & 0xffff)
+  }
+
+  return zero === 0
+}
+
+function crypto_sign_ed25519_pk_to_curve25519 (x25519_pk, ed25519_pk) {
+  check(x25519_pk, crypto_sign_PUBLICKEYBYTES)
+  check(ed25519_pk, crypto_sign_ed25519_PUBLICKEYBYTES)
+
+  var a = [gf(), gf(), gf(), gf()]
+  var x = gf([1])
+  var one_minus_y = gf([1])
+
+  assert(
+    isSmallOrder(ed25519_pk) &&
+    unpackneg(a, ed25519_pk) &&
+    ed25519_is_on_main_subgroup(a), 'Cannot convert key: bad point')
+
+  for (let i = 0; i < a.length; i++) {
+    pack25519(x25519_pk, a[i])
+  }
+
+  Z(one_minus_y, one_minus_y, a[1])
+  A(x, x, a[1])
+  inv25519(one_minus_y, one_minus_y)
+  M(x, x, one_minus_y)
+  pack25519(x25519_pk, x)
+
+  return 0
+}
+
+function isSmallOrder (s) {
+  Uint8Array.from([])
+
+  var bad_points = [
+    // 0 (order 4)
+    Uint8Array.from([0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00]),
+
+    // 1 (order 1)
+    Uint8Array.from([0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00]),
+
+    // 2707385501144840649318225287225658788936804267575313519463743609750303402022(order 8)
+    Uint8Array.from([0x26, 0xe8, 0x95, 0x8f, 0xc2, 0xb2, 0x27, 0xb0, 0x45, 0xc3,
+      0xf4, 0x89, 0xf2, 0xef, 0x98, 0xf0, 0xd5, 0xdf, 0xac, 0x05, 0xd3,
+      0xc6, 0x33, 0x39, 0xb1, 0x38, 0x02, 0x88, 0x6d, 0x53, 0xfc, 0x05]),
+
+    // 55188659117513257062467267217118295137698188065244968500265048394206261417927 (order 8)
+    Uint8Array.from([0xc7, 0x17, 0x6a, 0x70, 0x3d, 0x4d, 0xd8, 0x4f, 0xba, 0x3c,
+      0x0b, 0x76, 0x0d, 0x10, 0x67, 0x0f, 0x2a, 0x20, 0x53, 0xfa, 0x2c,
+      0x39, 0xcc, 0xc6, 0x4e, 0xc7, 0xfd, 0x77, 0x92, 0xac, 0x03, 0x7a]),
+
+    // p-1 (order 2)
+    Uint8Array.from([0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f]),
+
+    //  p (=0 order 4)
+    Uint8Array.from([0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f]),
+
+    // p + 1 (=1 order 1)
+    Uint8Array.from([0xee, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f])
+  ]
+
+  var c = new Uint8Array(7)
+  var j
+
+  check(bad_points, 7)
+  for (let i = 0; i < bad_points.length; i++) {
+    for (j = 0; j < 31; j++) {
+      c[i] |= s[j] ^ bad_points[i][j]
+    }
+  }
+
+  for (let i = 0; i < bad_points.length; i++) {
+    c[i] |= (s[j] & 0x7f) ^ bad_points[i][j]
+  }
+
+  var k = 0
+  for (let i = 0; i < bad_points.length; i++) {
+    k |= (c[i] - 1)
+  }
+
+  return ((k >> 8) & 1) === 0
+}
+
+function crypto_sign_ed25519_sk_to_pk (pk, sk) {
+  check(pk, crypto_sign_ed25519_PUBLICKEYBYTES)
+  pk.set(sk.subarray(crypto_sign_ed25519_SEEDBYTES))
+  return pk
+}
+
+function crypto_sign_ed25519_sk_to_curve25519 (curveSk, edSk) {
+  assert(curveSk && curveSk.byteLength === crypto_scalarmult_BYTES, "curveSk must be 'crypto_sign_SECRETKEYBYTES' long")
+  assert(edSk && edSk.byteLength === crypto_sign_ed25519_SECRETKEYBYTES, "edSk must be 'crypto_sign_ed25519_SECRETKEYBYTES' long")
+
+  var h = Buffer.alloc(crypto_hash_sha512_BYTES)
+  crypto_hash(h, edSk, 32)
+
+  h[0] &= 248
+  h[31] &= 127
+  h[31] |= 64
+
+  curveSk.set(h.subarray(0, crypto_scalarmult_BYTES))
+  h.fill(0)
+  return curveSk
+}
+
+function check (buf, len, arg = 'Argument') {
+  if (!buf || (len && buf.length < len)) throw new Error(arg + ' must be a buffer' + (len ? ' of length ' + len : ''))
 }

crypto_stream.js

@@ -6,6 +6,7 @@ if (new Uint16Array([1])[0] !== 1) throw new Error('Big endian architecture is n
 exports.crypto_stream_KEYBYTES = 32
 exports.crypto_stream_NONCEBYTES = 24
 exports.crypto_stream_PRIMITIVE = 'xsalsa20'
+exports.crypto_stream_xsalsa20_MESSAGEBYTES_MAX = Number.MAX_SAFE_INTEGER
 
 exports.crypto_stream = function (c, nonce, key) {
   c.fill(0)

crypto_verify.js

@@ -1,7 +1,8 @@
 /* eslint-disable camelcase */
 module.exports = {
   crypto_verify_16,
-  crypto_verify_32
+  crypto_verify_32,
+  crypto_verify_64
 }
 
 function vn (x, xi, y, yi, n) {
@@ -16,13 +17,13 @@ Object.defineProperty(module.exports, 'vn', {
 })
 
 function crypto_verify_16 (x, xi, y, yi) {
-  return vn(x, xi, y, yi, 16)
+  return vn(x, xi, y, yi, 16) === 0
 }
 
 function crypto_verify_32 (x, xi, y, yi) {
-  return vn(x, xi, y, yi, 32)
+  return vn(x, xi, y, yi, 32) === 0
 }
 
 function crypto_verify_64 (x, xi, y, yi) {
-  return vn(x, xi, y, yi, 64)
+  return vn(x, xi, y, yi, 64) === 0
 }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "sodium-javascript",
-  "version": "0.6.2",
+  "version": "0.7.1",
   "description": "WIP - a pure javascript version of sodium-native",
   "main": "index.js",
   "dependencies": {
@@ -14,7 +14,7 @@
   },
   "devDependencies": {
     "browserify": "^16.5.1",
-    "sodium-test": "^0.9.0",
+    "sodium-test": "^0.10.0",
     "standard": "^14.3.4",
     "tape-run": "^7.0.0"
   },