Preliminary kx api

Missing dependent apis and tests

crypto_kx.js

@@ -0,0 +1,79 @@
+var assert = require('nanoassert')
+var randombytes_buf = require('./randombytes').randombytes_buf
+var generichash = require('./crypto_generichash')
+var crypto_scalarmult_base = require('./crypto_scalarmult').crypto_scalarmult_base
+
+exports.crypto_kx_PUBLICKEYBYTES = 32
+exports.crypto_kx_SECRETKEYBYTES = 32
+exports.crypto_kx_SEEDBYTES = 32
+exports.crypto_kx_SESSIONKEYBYTES = 32
+exports.crypto_kx_PRIMITIVE = ''
+
+exports.crypto_kx_keypair = function (pk, sk) {
+  assert(sk.byteLength >= exports.crypto_kx_SECRETKEYBYTES, 'sk must be at least crypto_kx_SECRETKEYBYTES')
+  assert(pk.byteLength >= exports.crypto_kx_PUBLICKEYBYTES, 'pk must be at least crypto_kx_PUBLICKEYBYTES')
+
+  randombytes_buf(sk.subarray(0, exports.crypto_kx_SECRETKEYBYTES))
+
+  crypto_scalarmult_base(
+    pk.subarray(0, exports.crypto_kx_PUBLICKEYBYTES),
+    sk.subarray(0, exports.crypto_kx_SECRETKEYBYTES)
+  )
+}
+
+exports.crypto_kx_seed_keypair = function (pk, sk, seed) {
+  assert(sk.byteLength >= exports.crypto_kx_SECRETKEYBYTES, 'sk must be at least crypto_kx_SECRETKEYBYTES')
+  assert(pk.byteLength >= exports.crypto_kx_PUBLICKEYBYTES, 'pk must be at least crypto_kx_PUBLICKEYBYTES')
+  assert(seed.byteLength >= exports.crypto_kx_SEEDBYTES, 'seed must be at least crypto_kx_SEEDBYTES')
+
+  generichash.crypto_generichash(
+    sk.subarray(0, exports.crypto_kx_SECRETKEYBYTES),
+    seed.subarray(0, exports.crypto_kx_SEEDBYTES)
+  )
+
+  crypto_scalarmult_base(
+    pk.subarray(0, exports.crypto_kx_PUBLICKEYBYTES),
+    sk.subarray(0, exports.crypto_kx_SECRETKEYBYTES)
+  )
+}
+
+exports.crypto_kx_client_session_keys = calc.bind(null, false)
+
+exports.crypto_kx_server_session_keys = calc.bind(null, true)
+
+
+function calc (server, rx, tx, pk, sk, remote_pk) {
+  if (rx == null) rx = tx
+  if (tx == null) tx = rx
+
+  assert(rx >= exports.crypto_kx_SESSIONKEYBYTES, 'rx must be at least crypto_kx_SESSIONKEYBYTES')
+  assert(tx >= exports.crypto_kx_SESSIONKEYBYTES, 'tx should be at least crypto_kx_SESSIONKEYBYTES')
+  assert(sk.byteLength >= exports.crypto_kx_SECRETKEYBYTES, 'sk must be at least crypto_kx_SECRETKEYBYTES')
+  assert(pk.byteLength >= exports.crypto_kx_PUBLICKEYBYTES, 'pk must be at least crypto_kx_PUBLICKEYBYTES')
+  assert(remote_pk.byteLength >= exports.crypto_kx_PUBLICKEYBYTES, 'remote_pk must be at least crypto_kx_PUBLICKEYBYTES')
+
+  rx = rx.subarray(0, exports.crypto_kx_SESSIONKEYBYTES)
+  tx = tx.subarray(0, exports.crypto_kx_SESSIONKEYBYTES)
+
+  sk = sk.subarray(0, exports.crypto_kx_SECRETKEYBYTES)
+  pk = pk.subarray(0, exports.crypto_kx_PUBLICKEYBYTES)
+  remote_pk = remote_pk.subarray(0, exports.crypto_kx_PUBLICKEYBYTES)
+
+  var keys = new Uint8Array(2 * exports.crypto_kx_SESSIONKEYBYTES)
+  var hash = generichash.crypto_generichash_instance(null, keys.byteLength)
+  var q = new Uint8Array(scalarmult.crypto_scalarmult_BYTES)
+
+  scalarmult.crypto_scalamult(q, sk, remote_pk)
+
+  hash.update(q)
+  q.fill(0)
+  // if server, then remote_pk == client_pk
+  hash.update(server ? remote_pk : pk)
+  hash.update(server ? pk : remote_pk)
+  hash.final(keys)
+
+  // TODO clear out hash
+
+  rx.set(keys.subarray(0, exports.crypto_kx_SESSIONKEYBYTES))
+  tx.set(keys.subarray(exports.crypto_kx_SESSIONKEYBYTES))
+}

index.js

@@ -1601,7 +1601,7 @@ function crypto_sign(sm, m, sk) {
 function crypto_sign_detached(sig, m, sk) {
   var sm = new Uint8Array(m.length + crypto_sign_BYTES)
   crypto_sign(sm, m, sk)
-  for (var i = 0; i < 32; i++) sig[i] = sm[i]
+  for (var i = 0; i < crypto_sign_BYTES; i++) sig[i] = sm[i]
 }
 
 function unpackneg(r, p) {
@@ -1682,11 +1682,11 @@ function crypto_sign_open(msg, sm, pk) {
 
 function crypto_sign_verify_detached (sig, m, pk) {
   check(sig, crypto_sign_BYTES)
-  var sm = new Uint8Array(m.length + sig.length)
+  var sm = new Uint8Array(m.length + crypto_sign_BYTES)
   var i = 0
-  for (i = 0; i < 64; i++) sm[i] = m[i]
-  for (i = 0; i < m.length; i++) sm[i + 64] = m[i]
-  return crypto_sign_open(sm, m, pk)
+  for (i = 0; i < crypto_sign_BYTES; i++) sm[i] = sig[i]
+  for (i = 0; i < m.length; i++) sm[i + crypto_sign_BYTES] = m[i]
+  return crypto_sign_open(m, sm, pk)
 }
 
 function crypto_secretbox_detached (o, mac, msg, n, k) {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "sodium-javascript",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "WIP - a pure javascript version of sodium-native",
   "main": "index.js",
   "dependencies": {
@@ -12,7 +12,7 @@
   "devDependencies": {
     "browser-run": "^4.0.2",
     "browserify": "^14.1.0",
-    "sodium-test": "^0.6.0"
+    "sodium-test": "^0.7.0"
   },
   "scripts": {
     "browser": "browserify test.js | browser-run",

randombytes.js

@@ -1,9 +1,9 @@
 var assert = require('nanoassert')
 var randombytes = (function () {
   var QUOTA = 65536 // limit for QuotaExceededException
-  var crypto = typeof window !== 'undefined' ? (window.crypto || window.msCrypto) : null
+  var crypto = typeof global !== 'undefined' ? crypto = (global.crypto || global.msCrypto) : null
 
-  function windowBytes (out, n) {
+  function browserBytes (out, n) {
     for (var i = 0; i < n; i += QUOTA) {
       crypto.getRandomValues(out.subarray(i, i + Math.min(n - i, QUOTA)))
     }
@@ -18,7 +18,7 @@ var randombytes = (function () {
   }
 
   if (crypto && crypto.getRandomValues) {
-    return windowBytes
+    return browserBytes
   } else if (typeof require !== 'undefined') {
     // Node.js.
     crypto = require('cry' + 'pto');