0.5.6

Secret Key is a random nonce, and public key is a point on elliptic
curve.

`crypto_box_seal`/`crypto_box_seal_open` are implemented using existing
primitives and newly exported `core_hsalsa20` in `xsalsa20`

crypto_kdf.js

@@ -6,7 +6,7 @@ module.exports.crypto_kdf_PRIMITIVE = 'blake2b'
 module.exports.crypto_kdf_BYTES_MIN = 16
 module.exports.crypto_kdf_BYTES_MAX = 64
 module.exports.crypto_kdf_CONTEXTBYTES = 8
-module.exports.crypto_kdf_KEYBYTES = 64
+module.exports.crypto_kdf_KEYBYTES = 32
 
 function STORE64_LE(dest, int) {
   var mul = 1
@@ -29,7 +29,7 @@ module.exports.crypto_kdf_derive_from_key = function crypto_kdf_derive_from_key
   STORE64_LE(salt, subkey_id)
 
   var outlen = Math.min(subkey.length, module.exports.crypto_kdf_BYTES_MAX)
-  blake2b(outlen, key, salt, ctx_padded, true)
+  blake2b(outlen, key.subarray(0, module.exports.crypto_kdf_KEYBYTES), salt, ctx_padded, true)
     .final(subkey)
 }
 

crypto_shorthash.js

@@ -5,13 +5,8 @@ exports.crypto_shorthash_BYTES = siphash.BYTES
 exports.crypto_shorthash_KEYBYTES = siphash.KEYBYTES
 exports.crypto_shorthash_WASM_SUPPORTED = siphash.WASM_SUPPORTED
 exports.crypto_shorthash_WASM_LOADED = siphash.WASM_LOADED
-exports.crypto_shorthash_ready = siphash.ready
 exports.crypto_shorthash = shorthash
 
-siphash.ready(function () {
-  exports.crypto_shorthash_WASM_LOADED = siphash.WASM_LOADED
-})
-
 function shorthash (out, data, key, noAssert) {
   siphash(data, key, out, noAssert)
 }

index.js

@@ -1,5 +1,7 @@
 'use strict';
 
+var xsalsa20 = require('xsalsa20')
+
 // Based on https://github.com/dchest/tweetnacl-js/blob/6dcbcaf5f5cbfd313f2dcfe763db35c828c8ff5b/nacl-fast.js.
 
 var sodium = module.exports
@@ -1601,7 +1603,7 @@ function crypto_sign(sm, m, sk) {
 function crypto_sign_detached(sig, m, sk) {
   var sm = new Uint8Array(m.length + crypto_sign_BYTES)
   crypto_sign(sm, m, sk)
-  for (var i = 0; i < 32; i++) sig[i] = sm[i]
+  for (var i = 0; i < crypto_sign_BYTES; i++) sig[i] = sm[i]
 }
 
 function unpackneg(r, p) {
@@ -1682,11 +1684,11 @@ function crypto_sign_open(msg, sm, pk) {
 
 function crypto_sign_verify_detached (sig, m, pk) {
   check(sig, crypto_sign_BYTES)
-  var sm = new Uint8Array(m.length + sig.length)
+  var sm = new Uint8Array(m.length + crypto_sign_BYTES)
   var i = 0
-  for (i = 0; i < 64; i++) sm[i] = m[i]
+  for (i = 0; i < crypto_sign_BYTES; i++) sm[i] = sig[i]
-  for (i = 0; i < m.length; i++) sm[i + 64] = m[i]
+  for (i = 0; i < m.length; i++) sm[i + crypto_sign_BYTES] = m[i]
-  return crypto_sign_open(sm, m, pk)
+  return crypto_sign_open(m, sm, pk)
 }
 
 function crypto_secretbox_detached (o, mac, msg, n, k) {
@@ -1736,6 +1738,57 @@ function crypto_secretbox_open_easy(msg, box, n, k) {
   return true
 }
 
+function crypto_box_keypair(pk, sk) {
+  check(pk, crypto_box_PUBLICKEYBYTES)
+  check(sk, crypto_box_SECRETKEYBYTES)
+  randombytes(sk, 32)
+  return crypto_scalarmult_base(pk, sk)
+}
+
+function crypto_box_seal(c, m, pk) {
+  check(c, crypto_box_SEALBYTES + m.length)
+  check(pk, crypto_box_PUBLICKEYBYTES)
+
+  var epk = c.subarray(0, crypto_box_PUBLICKEYBYTES)
+  var esk = new Uint8Array(crypto_box_SECRETKEYBYTES)
+  crypto_box_keypair(epk, esk)
+
+  var n = new Uint8Array(crypto_box_NONCEBYTES)
+  sodium.crypto_generichash_batch(n, [ epk, pk ])
+
+  var s = new Uint8Array(crypto_box_PUBLICKEYBYTES)
+  crypto_scalarmult(s, esk, pk)
+
+  var k = new Uint8Array(crypto_box_BEFORENMBYTES)
+  var zero = new Uint8Array(16)
+  xsalsa20.core_hsalsa20(k, zero, s, xsalsa20.SIGMA)
+
+  crypto_secretbox_easy(c.subarray(epk.length), m, n, k)
+
+  cleanup(esk)
+}
+
+function crypto_box_seal_open(m, c, pk, sk) {
+  check(c, crypto_box_SEALBYTES)
+  check(m, c.length - crypto_box_SEALBYTES)
+  check(pk, crypto_box_PUBLICKEYBYTES)
+  check(sk, crypto_box_SECRETKEYBYTES)
+
+  var epk = c.subarray(0, crypto_box_PUBLICKEYBYTES)
+
+  var n = new Uint8Array(crypto_box_NONCEBYTES)
+  sodium.crypto_generichash_batch(n, [ epk, pk ])
+
+  var s = new Uint8Array(crypto_box_PUBLICKEYBYTES)
+  crypto_scalarmult(s, sk, epk)
+
+  var k = new Uint8Array(crypto_box_BEFORENMBYTES)
+  var zero = new Uint8Array(16)
+  xsalsa20.core_hsalsa20(k, zero, s, xsalsa20.SIGMA)
+
+  return crypto_secretbox_open_easy(m, c.subarray(epk.length), n, k)
+}
+
 var crypto_secretbox_KEYBYTES = 32,
     crypto_secretbox_NONCEBYTES = 24,
     crypto_secretbox_ZEROBYTES = 32,
@@ -1748,6 +1801,8 @@ var crypto_secretbox_KEYBYTES = 32,
     crypto_box_NONCEBYTES = crypto_secretbox_NONCEBYTES,
     crypto_box_ZEROBYTES = crypto_secretbox_ZEROBYTES,
     crypto_box_BOXZEROBYTES = crypto_secretbox_BOXZEROBYTES,
+    crypto_box_SEALBYTES = 48,
+    crypto_box_BEFORENMBYTES = 32,
     crypto_sign_BYTES = 64,
     crypto_sign_PUBLICKEYBYTES = 32,
     crypto_sign_SECRETKEYBYTES = 64,
@@ -1788,6 +1843,18 @@ sodium.crypto_secretbox_open_easy = crypto_secretbox_open_easy
 sodium.crypto_secretbox_detached = crypto_secretbox_detached
 sodium.crypto_secretbox_open_detached = crypto_secretbox_open_detached
 
+sodium.crypto_box_PUBLICKEYBYTES = crypto_box_PUBLICKEYBYTES
+sodium.crypto_box_SECRETKEYBYTES = crypto_box_SECRETKEYBYTES
+sodium.crypto_box_SEALBYTES = crypto_box_SEALBYTES
+sodium.crypto_box_BEFORENMBYTES = crypto_box_BEFORENMBYTES
+sodium.crypto_box_keypair = crypto_box_keypair
+sodium.crypto_box_seal = crypto_box_seal
+sodium.crypto_box_seal_open = crypto_box_seal_open
+
+sodium.sodium_malloc = function (n) {
+  return new Uint8Array(n)
+}
+
 function cleanup(arr) {
   for (var i = 0; i < arr.length; i++) arr[i] = 0;
 }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "sodium-javascript",
-  "version": "0.5.0",
+  "version": "0.5.6",
   "description": "WIP - a pure javascript version of sodium-native",
   "main": "index.js",
   "dependencies": {
@@ -12,7 +12,13 @@
   "devDependencies": {
     "browser-run": "^4.0.2",
     "browserify": "^14.1.0",
-    "sodium-test": "^0.6.0"
+    "sodium-test": "^0.7.0"
+  },
+  "browser": {
+    "crypto": false
+  },
+  "react-native": {
+    "crypto": "crypto"
   },
   "scripts": {
     "browser": "browserify test.js | browser-run",

randombytes.js

@@ -1,9 +1,9 @@
 var assert = require('nanoassert')
 var randombytes = (function () {
   var QUOTA = 65536 // limit for QuotaExceededException
-  var crypto = typeof window !== 'undefined' ? (window.crypto || window.msCrypto) : null
+  var crypto = typeof global !== 'undefined' ? crypto = (global.crypto || global.msCrypto) : null
 
-  function windowBytes (out, n) {
+  function browserBytes (out, n) {
     for (var i = 0; i < n; i += QUOTA) {
       crypto.getRandomValues(out.subarray(i, i + Math.min(n - i, QUOTA)))
     }
@@ -18,10 +18,10 @@ var randombytes = (function () {
   }
 
   if (crypto && crypto.getRandomValues) {
-    return windowBytes
+    return browserBytes
   } else if (typeof require !== 'undefined') {
     // Node.js.
-    crypto = require('cry' + 'pto');
+    crypto = require('crypto')
     if (crypto && crypto.randomBytes) {
       return nodeBytes
     }