add crypto_pwhash test

* deprecate sodium-test ahrness

* prune dependencies

.gitignore

@@ -1 +1,2 @@
 node_modules
+package-lock.json

README.md

@@ -33,7 +33,7 @@ console.log('Plaintext:', plainText.toString())
 ## API
 
 See [sodium-native](https://github.com/sodium-friends/sodium-native).
-This is a work in progress so all functions are not implemented yet.
+This is a work in progress so not all functions are implemented yet.
 
 This module is organised into individual submodules which can be required
 independently for smaller bundles in the browser. To leverage automatic

crypto_aead.js

@@ -30,7 +30,7 @@ function crypto_aead_chacha20poly1305_ietf_encrypt (c, m, ad, nsec, npub, k) {
 }
 
 function crypto_aead_chacha20poly1305_ietf_encrypt_detached (c, mac, m, ad, nsec, npub, k) {
-  if (ad === null) return crypto_aead_chacha20poly1305_ietf_encrypt(c, mac, m, new Uint8Array(0), nsec, npub, k)
+  if (ad === null) return crypto_aead_chacha20poly1305_ietf_encrypt_detached(c, mac, m, new Uint8Array(0), nsec, npub, k)
 
   assert(c.byteLength === m.byteLength, 'ciphertext should be same length than message')
   assert(npub.byteLength === crypto_aead_chacha20poly1305_ietf_NPUBBYTES,
@@ -91,7 +91,7 @@ function crypto_aead_chacha20poly1305_ietf_decrypt (m, nsec, c, ad, npub, k) {
 }
 
 function crypto_aead_chacha20poly1305_ietf_decrypt_detached (m, nsec, c, mac, ad, npub, k) {
-  if (ad === null) return crypto_aead_chacha20poly1305_ietf_decrypt(m, nsec, c, mac, new Uint8Array(0), npub, k)
+  if (ad === null) return crypto_aead_chacha20poly1305_ietf_decrypt_detached(m, nsec, c, mac, new Uint8Array(0), npub, k)
 
   assert(c.byteLength === m.byteLength, 'message should be same length than ciphertext')
   assert(npub.byteLength === crypto_aead_chacha20poly1305_ietf_NPUBBYTES,

crypto_auth.js

@@ -0,0 +1,35 @@
+/* eslint-disable camelcase */
+const { crypto_verify_32 } = require('./crypto_verify')
+const Sha512 = require('sha512-universal')
+const assert = require('nanoassert')
+
+const crypto_auth_BYTES = 32
+const crypto_auth_KEYBYTES = 32
+
+function crypto_auth (out, input, k) {
+  assert(out.byteLength === crypto_auth_BYTES, "out should be 'crypto_auth_BYTES' in length")
+  assert(k.byteLength === crypto_auth_KEYBYTES, "key should be 'crypto_auth_KEYBYTES' in length")
+
+  const out0 = new Uint8Array(64)
+  const hmac = Sha512.HMAC(k)
+  hmac.update(input)
+  hmac.digest(out0)
+
+  out.set(out0.subarray(0, 32))
+}
+
+function crypto_auth_verify (h, input, k) {
+  assert(h.byteLength === crypto_auth_BYTES, "h should be 'crypto_auth_BYTES' in length")
+  assert(k.byteLength === crypto_auth_KEYBYTES, "key should be 'crypto_auth_KEYBYTES' in length")
+
+  const correct = Sha512.HMAC(k).update(input).digest()
+
+  return crypto_verify_32(h, 0, correct, 0)
+}
+
+module.exports = {
+  crypto_auth_BYTES,
+  crypto_auth_KEYBYTES,
+  crypto_auth,
+  crypto_auth_verify
+}

crypto_box.js

@@ -1,9 +1,15 @@
 /* eslint-disable camelcase */
 const { crypto_hash_sha512 } = require('./crypto_hash')
 const { crypto_scalarmult, crypto_scalarmult_base } = require('./crypto_scalarmult')
-const { randombytes } = require('./randombytes')
+const { randombytes_buf } = require('./randombytes')
 const { crypto_generichash_batch } = require('./crypto_generichash')
-const { crypto_secretbox_open_easy, crypto_secretbox_easy } = require('./crypto_secretbox')
+const { crypto_stream_xsalsa20_MESSAGEBYTES_MAX } = require('./crypto_stream')
+const {
+  crypto_secretbox_open_easy,
+  crypto_secretbox_easy,
+  crypto_secretbox_detached,
+  crypto_secretbox_open_detached
+} = require('./crypto_secretbox')
 const xsalsa20 = require('xsalsa20')
 const assert = require('nanoassert')
 
@@ -15,8 +21,19 @@ const crypto_box_BOXZEROBYTES = 16
 const crypto_box_SEALBYTES = 48
 const crypto_box_SEEDBYTES = 32
 const crypto_box_BEFORENMBYTES = 32
+const crypto_box_MACBYTES = 16
+
+const crypto_box_curve25519xsalsa20poly1305_MACBYTES = 16
+
+const crypto_box_MESSAGEBYTES_MAX =
+  crypto_stream_xsalsa20_MESSAGEBYTES_MAX -
+  crypto_box_curve25519xsalsa20poly1305_MACBYTES
 
 module.exports = {
+  crypto_box_easy,
+  crypto_box_open_easy,
+  crypto_box_detached,
+  crypto_box_open_detached,
   crypto_box_keypair,
   crypto_box_seed_keypair,
   crypto_box_seal,
@@ -28,16 +45,16 @@ module.exports = {
   crypto_box_BOXZEROBYTES,
   crypto_box_SEALBYTES,
   crypto_box_SEEDBYTES,
-  crypto_box_BEFORENMBYTES
+  crypto_box_BEFORENMBYTES,
+  crypto_box_MACBYTES
 }
 
 function crypto_box_keypair (pk, sk) {
   check(pk, crypto_box_PUBLICKEYBYTES)
   check(sk, crypto_box_SECRETKEYBYTES)
-  randombytes(sk, 32)
+  randombytes_buf(sk, 32)
   return crypto_scalarmult_base(pk, sk)
 }
-
 function crypto_box_seed_keypair (pk, sk, seed) {
   assert(pk.byteLength === crypto_box_PUBLICKEYBYTES, "pk should be 'crypto_box_PUBLICKEYBYTES' bytes")
   assert(sk.byteLength === crypto_box_SECRETKEYBYTES, "sk should be 'crypto_box_SECRETKEYBYTES' bytes")
@@ -95,6 +112,87 @@ function crypto_box_seal_open (m, c, pk, sk) {
   return crypto_secretbox_open_easy(m, c.subarray(epk.length), n, k)
 }
 
+function crypto_box_beforenm (k, pk, sk) {
+  const zero = new Uint8Array(16)
+  const s = new Uint8Array(32)
+
+  assert(crypto_scalarmult(s, sk, pk) === 0)
+
+  xsalsa20.core_hsalsa20(k, zero, s, xsalsa20.SIGMA)
+
+  return true
+}
+
+function crypto_box_detached_afternm (c, mac, m, n, k) {
+  return crypto_secretbox_detached(c, mac, m, n, k)
+}
+
+function crypto_box_detached (c, mac, m, n, pk, sk) {
+  check(mac, crypto_box_MACBYTES)
+  check(n, crypto_box_NONCEBYTES)
+  check(pk, crypto_box_PUBLICKEYBYTES)
+  check(sk, crypto_box_SECRETKEYBYTES)
+
+  const k = new Uint8Array(crypto_box_BEFORENMBYTES)
+
+  assert(crypto_box_beforenm(k, pk, sk))
+
+  const ret = crypto_box_detached_afternm(c, mac, m, n, k)
+  cleanup(k)
+
+  return ret
+}
+
+function crypto_box_easy (c, m, n, pk, sk) {
+  assert(
+    c.length >= m.length + crypto_box_MACBYTES,
+    "c should be at least 'm.length + crypto_box_MACBYTES' bytes"
+  )
+  assert(
+    m.length <= crypto_box_MESSAGEBYTES_MAX,
+    "m should be at most 'crypto_box_MESSAGEBYTES_MAX' bytes"
+  )
+
+  return crypto_box_detached(
+    c.subarray(crypto_box_MACBYTES, m.length + crypto_box_MACBYTES),
+    c.subarray(0, crypto_box_MACBYTES),
+    m,
+    n,
+    pk,
+    sk
+  )
+}
+
+function crypto_box_open_detached_afternm (m, c, mac, n, k) {
+  return crypto_secretbox_open_detached(m, c, mac, n, k)
+}
+
+function crypto_box_open_detached (m, c, mac, n, pk, sk) {
+  const k = new Uint8Array(crypto_box_BEFORENMBYTES)
+  assert(crypto_box_beforenm(k, pk, sk))
+
+  const ret = crypto_box_open_detached_afternm(m, c, mac, n, k)
+  cleanup(k)
+
+  return ret
+}
+
+function crypto_box_open_easy (m, c, n, pk, sk) {
+  assert(
+    c.length >= m.length + crypto_box_MACBYTES,
+    "c should be at least 'm.length + crypto_box_MACBYTES' bytes"
+  )
+
+  return crypto_box_open_detached(
+    m,
+    c.subarray(crypto_box_MACBYTES, m.length + crypto_box_MACBYTES),
+    c.subarray(0, crypto_box_MACBYTES),
+    n,
+    pk,
+    sk
+  )
+}
+
 function check (buf, len) {
   if (!buf || (len && buf.length < len)) throw new Error('Argument must be a buffer' + (len ? ' of length ' + len : ''))
 }

crypto_core.js

@@ -0,0 +1,269 @@
+const b4a = require('b4a')
+const assert = require('nanoassert')
+
+const {
+  ge25519_p3,
+  ge25519_p1p1,
+  ge25519_cached,
+  ge25519_frombytes,
+  ge25519_p3_tobytes,
+  ge25519_p1p1_to_p3,
+  ge25519_p3_to_cached,
+  ge25519_is_on_curve,
+  ge25519_is_canonical,
+  ge25519_is_on_main_subgroup,
+  ge25519_has_small_order,
+  ge25519_add_cached,
+  ge25519_sub_cached,
+  ge25519_from_uniform,
+  sc25519_reduce,
+  sc25519_mul,
+  sc25519_invert,
+  sc25519_is_canonical
+} = require('./fe25519_25.js')
+
+const { randombytes_buf } = require('./randombytes')
+
+const {
+  sodium_add,
+  sodium_sub,
+  sodium_is_zero,
+  sodium_memzero
+} = require('./utils')
+
+function crypto_core_ed25519_is_valid_point (p) {
+  const p_p3 = ge25519_p3()
+
+  if (ge25519_is_canonical(p) == 0 ||
+      ge25519_has_small_order(p) != 0 ||
+      ge25519_frombytes(p_p3, p) != 0 ||
+      ge25519_is_on_curve(p_p3) == 0 ||
+      ge25519_is_on_main_subgroup(p_p3) == 0) {
+    return false
+  }
+  return true
+}
+
+function crypto_core_ed25519_add (r, p, q) {
+  const p_p3 = ge25519_p3()
+  const q_p3 = ge25519_p3()
+  const r_p3 = ge25519_p3()
+
+  const r_p1p1 = ge25519_p1p1()
+  const q_cached = ge25519_cached()
+
+  if (ge25519_frombytes(p_p3, p) != 0 || ge25519_is_on_curve(p_p3) == 0 ||
+      ge25519_frombytes(q_p3, q) != 0 || ge25519_is_on_curve(q_p3) == 0) {
+    throw new Error('Operands must be valid points.')
+  }
+
+  ge25519_p3_to_cached(q_cached, q_p3)
+  ge25519_add_cached(r_p1p1, p_p3, q_cached)
+  ge25519_p1p1_to_p3(r_p3, r_p1p1)
+  ge25519_p3_tobytes(r, r_p3)
+}
+
+function crypto_core_ed25519_sub (r, p, q) {
+  const p_p3 = ge25519_p3()
+  const q_p3 = ge25519_p3()
+  const r_p3 = ge25519_p3()
+
+  const r_p1p1 = ge25519_p1p1()
+  const q_cached = ge25519_cached()
+
+  if (ge25519_frombytes(p_p3, p) != 0 || ge25519_is_on_curve(p_p3) == 0 ||
+      ge25519_frombytes(q_p3, q) != 0 || ge25519_is_on_curve(q_p3) == 0) {
+    throw new Error('Operands must be valid points.')
+  }
+  ge25519_p3_to_cached(q_cached, q_p3)
+  ge25519_sub_cached(r_p1p1, p_p3, q_cached)
+  ge25519_p1p1_to_p3(r_p3, r_p1p1)
+  ge25519_p3_tobytes(r, r_p3)
+}
+
+function crypto_core_ed25519_from_uniform (p, r) {
+  ge25519_from_uniform(p, r)
+}
+
+// const HASH_GE_L = 48
+
+// function _string_to_points (px, n, ctx, msg, msg_len, hash_alg) {
+//     const h = b4a.alloc(crypto_core_ed25519_HASHBYTES)
+//     const h_be = b4a.alloc(2 * HASH_GE_L)
+
+//     let i
+//     let j
+
+//     if (n > 2) {
+//         // abort(); /* LCOV_EXCL_LINE */
+//         throw new Error('abort')
+//     }
+//     if (core_h2c_string_to_hash(h_be, n * HASH_GE_L, ctx, msg, msg_len,
+//                                 hash_alg) != 0) {
+//         return -1;
+//     }
+//     COMPILER_ASSERT(sizeof h >= HASH_GE_L);
+//     for (i = 0U; i < n; i++) {
+//         for (j = 0U; j < HASH_GE_L; j++) {
+//             h[j] = h_be[i * HASH_GE_L + HASH_GE_L - 1U - j];
+//         }
+//         memset(&h[j], 0, (sizeof h) - j);
+//         ge25519_from_hash(&px[i * crypto_core_ed25519_BYTES], h);
+//     }
+//     return 0;
+// }
+
+// int
+// crypto_core_ed25519_from_string(unsigned char p[crypto_core_ed25519_BYTES],
+//                                 const char *ctx, msg,
+//                                 size_t msg_len, int hash_alg)
+// {
+//     return _string_to_points(p, 1, ctx, msg, msg_len, hash_alg);
+// }
+
+// int
+// crypto_core_ed25519_from_string_ro(unsigned char p[crypto_core_ed25519_BYTES],
+//                                    const char *ctx, msg,
+//                                    size_t msg_len, int hash_alg)
+// {
+//     unsigned char px[2 * crypto_core_ed25519_BYTES];
+
+//     if (_string_to_points(px, 2, ctx, msg, msg_len, hash_alg) != 0) {
+//         return -1;
+//     }
+//     return crypto_core_ed25519_add(p, &px[0], &px[crypto_core_ed25519_BYTES]);
+// }
+
+function crypto_core_ed25519_random (p) {
+  const h = b4a.alloc(crypto_core_ed25519_UNIFORMBYTES)
+
+  randombytes_buf(h)
+  crypto_core_ed25519_from_uniform(p, h)
+}
+
+function crypto_core_ed25519_scalar_random (r) {
+  do {
+    randombytes_buf(r, crypto_core_ed25519_SCALARBYTES)
+    r[crypto_core_ed25519_SCALARBYTES - 1] &= 0x1f
+  } while (sc25519_is_canonical(r) == 0 ||
+           sodium_is_zero(r, crypto_core_ed25519_SCALARBYTES))
+}
+
+function crypto_core_ed25519_scalar_invert (recip, s) {
+  sc25519_invert(recip, s)
+
+  if (sodium_is_zero(s, crypto_core_ed25519_SCALARBYTES)) {
+    throw new Error('Zero point')
+  }
+}
+
+/* 2^252+27742317777372353535851937790883648493 */
+const L = b4a.from([
+  0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, 0xd6, 0x9c, 0xf7,
+  0xa2, 0xde, 0xf9, 0xde, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10
+])
+
+function crypto_core_ed25519_scalar_negate (neg, s) {
+  const t_ = b4a.alloc(crypto_core_ed25519_NONREDUCEDSCALARBYTES)
+  const s_ = b4a.alloc(crypto_core_ed25519_NONREDUCEDSCALARBYTES)
+
+  assert(crypto_core_ed25519_NONREDUCEDSCALARBYTES >=
+          2 * crypto_core_ed25519_SCALARBYTES)
+
+  t_.fill(0)
+  s_.fill(0)
+
+  t_.set(L.subarray(0, crypto_core_ed25519_SCALARBYTES), crypto_core_ed25519_SCALARBYTES)
+  s_.set(s.subarray(0, crypto_core_ed25519_SCALARBYTES))
+
+  sodium_sub(t_, s_, crypto_core_ed25519_NONREDUCEDSCALARBYTES)
+  sc25519_reduce(t_)
+
+  neg.set(t_.subarray(0, crypto_core_ed25519_SCALARBYTES))
+}
+
+function crypto_core_ed25519_scalar_complement (comp, s) {
+  const t_ = b4a.alloc(crypto_core_ed25519_NONREDUCEDSCALARBYTES)
+  const s_ = b4a.alloc(crypto_core_ed25519_NONREDUCEDSCALARBYTES)
+
+  assert(crypto_core_ed25519_NONREDUCEDSCALARBYTES >=
+                  2 * crypto_core_ed25519_SCALARBYTES)
+
+  t_.fill(0)
+  s_.fill(0)
+  t_[0]++
+
+  t_.set(L.subarray(0, crypto_core_ed25519_SCALARBYTES), crypto_core_ed25519_SCALARBYTES)
+  s_.set(s.subarray(0, crypto_core_ed25519_SCALARBYTES))
+
+  sodium_sub(t_, s_, crypto_core_ed25519_NONREDUCEDSCALARBYTES)
+  sc25519_reduce(t_)
+
+  comp.set(t_.subarray(0, crypto_core_ed25519_SCALARBYTES))
+}
+
+function crypto_core_ed25519_scalar_add (z, x, y) {
+  const x_ = b4a.alloc(crypto_core_ed25519_NONREDUCEDSCALARBYTES)
+  const y_ = b4a.alloc(crypto_core_ed25519_NONREDUCEDSCALARBYTES)
+
+  x_.fill(0)
+  y_.fill(0)
+
+  x_.set(x.subarray(0, crypto_core_ed25519_SCALARBYTES))
+  y_.set(y.subarray(0, crypto_core_ed25519_SCALARBYTES))
+
+  sodium_add(x_, y_, crypto_core_ed25519_SCALARBYTES)
+  crypto_core_ed25519_scalar_reduce(z, x_)
+}
+
+function crypto_core_ed25519_scalar_sub (z, x, y) {
+  const yn = b4a.alloc(crypto_core_ed25519_SCALARBYTES)
+
+  crypto_core_ed25519_scalar_negate(yn, y)
+  crypto_core_ed25519_scalar_add(z, x, yn)
+}
+
+function crypto_core_ed25519_scalar_mul (z, x, y) {
+  sc25519_mul(z, x, y)
+}
+
+function crypto_core_ed25519_scalar_reduce (r, s) {
+  const t = b4a.alloc(crypto_core_ed25519_NONREDUCEDSCALARBYTES)
+
+  t.set(s)
+
+  sc25519_reduce(t)
+  r.set(t.subarray(0, crypto_core_ed25519_SCALARBYTES))
+  sodium_memzero(t)
+}
+
+function crypto_core_ed25519_scalar_is_canonical (s) {
+  return sc25519_is_canonical(s)
+}
+
+const crypto_core_ed25519_BYTES = 32
+const crypto_core_ed25519_UNIFORMBYTES = 32
+const crypto_core_ed25519_SCALARBYTES = 32
+const crypto_core_ed25519_NONREDUCEDSCALARBYTES = 64
+
+module.exports = {
+  crypto_core_ed25519_is_valid_point,
+  crypto_core_ed25519_add,
+  crypto_core_ed25519_sub,
+  crypto_core_ed25519_from_uniform,
+  crypto_core_ed25519_random,
+  crypto_core_ed25519_scalar_random,
+  crypto_core_ed25519_scalar_invert,
+  crypto_core_ed25519_scalar_negate,
+  crypto_core_ed25519_scalar_complement,
+  crypto_core_ed25519_scalar_add,
+  crypto_core_ed25519_scalar_sub,
+  crypto_core_ed25519_scalar_mul,
+  crypto_core_ed25519_scalar_reduce,
+  crypto_core_ed25519_scalar_is_canonical,
+  crypto_core_ed25519_BYTES,
+  crypto_core_ed25519_UNIFORMBYTES,
+  crypto_core_ed25519_SCALARBYTES,
+  crypto_core_ed25519_NONREDUCEDSCALARBYTES
+}

crypto_core_ristretto255.js

@@ -0,0 +1,147 @@
+const b4a = require('b4a')
+
+const { randombytes_buf } = require('./randombytes')
+const {
+  ge25519_p3,
+  ge25519_p1p1,
+  ge25519_cached,
+  ge25519_p3_to_cached,
+  ge25519_add_cached,
+  ge25519_p1p1_to_p3,
+  ge25519_sub_cached,
+  ristretto255_frombytes,
+  ristretto255_p3_tobytes,
+  ristretto255_from_hash,
+  sc25519_mul,
+  sc25519_is_canonical
+} = require('./fe25519_25')
+
+const {
+  crypto_core_ed25519_scalar_random,
+  crypto_core_ed25519_scalar_invert,
+  crypto_core_ed25519_scalar_negate,
+  crypto_core_ed25519_scalar_complement,
+  crypto_core_ed25519_scalar_add,
+  crypto_core_ed25519_scalar_sub,
+  crypto_core_ed25519_scalar_reduce
+} = require('./crypto_core')
+
+const crypto_core_ristretto255_BYTES = 32
+const crypto_core_ristretto255_NONREDUCEDSCALARBYTES = 64
+const crypto_core_ristretto255_HASHBYTES = 64
+const crypto_core_ristretto255_SCALARBYTES = 32
+
+module.exports = {
+  crypto_core_ristretto255_BYTES,
+  crypto_core_ristretto255_NONREDUCEDSCALARBYTES,
+  crypto_core_ristretto255_HASHBYTES,
+  crypto_core_ristretto255_SCALARBYTES,
+  crypto_core_ristretto255_is_valid_point,
+  crypto_core_ristretto255_add,
+  crypto_core_ristretto255_sub,
+  crypto_core_ristretto255_from_hash,
+  crypto_core_ristretto255_random,
+  crypto_core_ristretto255_scalar_random,
+  crypto_core_ristretto255_scalar_invert,
+  crypto_core_ristretto255_scalar_negate,
+  crypto_core_ristretto255_scalar_complement,
+  crypto_core_ristretto255_scalar_add,
+  crypto_core_ristretto255_scalar_sub,
+  crypto_core_ristretto255_scalar_mul,
+  crypto_core_ristretto255_scalar_reduce,
+  crypto_core_ristretto255_scalar_is_canonical
+}
+
+function crypto_core_ristretto255_is_valid_point (p) {
+  const p_p3 = ge25519_p3()
+
+  if (ristretto255_frombytes(p_p3, p) != 0) {
+    return false
+  }
+  return true
+}
+
+function crypto_core_ristretto255_add (r, p, q) {
+  const p_p3 = ge25519_p3()
+  const q_p3 = ge25519_p3()
+  const r_p3 = ge25519_p3()
+  const r_p1p1 = ge25519_p1p1()
+  const q_cached = ge25519_cached()
+
+  if (ristretto255_frombytes(p_p3, p) != 0 ||
+      ristretto255_frombytes(q_p3, q) != 0) {
+    return -1
+  }
+  ge25519_p3_to_cached(q_cached, q_p3)
+  ge25519_add_cached(r_p1p1, p_p3, q_cached)
+  ge25519_p1p1_to_p3(r_p3, r_p1p1)
+  ristretto255_p3_tobytes(r, r_p3)
+
+  return 0
+}
+
+function crypto_core_ristretto255_sub (r, p, q) {
+  const p_p3 = ge25519_p3()
+  const q_p3 = ge25519_p3()
+  const r_p3 = ge25519_p3()
+  const r_p1p1 = ge25519_p1p1()
+  const q_cached = ge25519_cached()
+
+  if (ristretto255_frombytes(p_p3, p) != 0 ||
+      ristretto255_frombytes(q_p3, q) != 0) {
+    return -1
+  }
+  ge25519_p3_to_cached(q_cached, q_p3)
+  ge25519_sub_cached(r_p1p1, p_p3, q_cached)
+  ge25519_p1p1_to_p3(r_p3, r_p1p1)
+  ristretto255_p3_tobytes(r, r_p3)
+
+  return 0
+}
+
+function crypto_core_ristretto255_from_hash (p, r) {
+  ristretto255_from_hash(p, r)
+  return 0
+}
+
+function crypto_core_ristretto255_random (p) {
+  const h = b4a.alloc(crypto_core_ristretto255_HASHBYTES)
+  randombytes_buf(h)
+  crypto_core_ristretto255_from_hash(p, h)
+}
+
+function crypto_core_ristretto255_scalar_random (r) {
+  crypto_core_ed25519_scalar_random(r)
+}
+
+function crypto_core_ristretto255_scalar_invert (recip, s) {
+  return crypto_core_ed25519_scalar_invert(recip, s)
+}
+
+function crypto_core_ristretto255_scalar_negate (neg, s) {
+  crypto_core_ed25519_scalar_negate(neg, s)
+}
+
+function crypto_core_ristretto255_scalar_complement (comp, s) {
+  crypto_core_ed25519_scalar_complement(comp, s)
+}
+
+function crypto_core_ristretto255_scalar_add (z, x, y) {
+  crypto_core_ed25519_scalar_add(z, x, y)
+}
+
+function crypto_core_ristretto255_scalar_sub (z, x, y) {
+  crypto_core_ed25519_scalar_sub(z, x, y)
+}
+
+function crypto_core_ristretto255_scalar_mul (z, x, y) {
+  sc25519_mul(z, x, y)
+}
+
+function crypto_core_ristretto255_scalar_reduce (r, s) {
+  crypto_core_ed25519_scalar_reduce(r, s)
+}
+
+function crypto_core_ristretto255_scalar_is_canonical (s) {
+  return sc25519_is_canonical(s)
+}

crypto_hash.js

@@ -14,6 +14,23 @@ function crypto_hash_sha512 (out, m, n) {
   return 0
 }
 
+function crypto_hash_sha512_state () {
+  return sha512()
+}
+
+function crypto_hash_sha512_update (state, m, n) {
+  if (n === undefined) n = m.byteLength
+  state.update(m.subarray(0, n))
+  return 0
+}
+
+function crypto_hash_sha512_final (state, out) {
+  assert(out.byteLength === crypto_hash_sha512_BYTES, "out must be 'crypto_hash_sha512_BYTES' bytes long")
+
+  state.digest(out)
+  return 0
+}
+
 function crypto_hash (out, m, n) {
   return crypto_hash_sha512(out, m, n)
 }
@@ -21,6 +38,9 @@ function crypto_hash (out, m, n) {
 module.exports = {
   crypto_hash,
   crypto_hash_sha512,
+  crypto_hash_sha512_state,
+  crypto_hash_sha512_update,
+  crypto_hash_sha512_final,
   crypto_hash_sha512_BYTES,
   crypto_hash_BYTES
 }

crypto_pwhash.js

@@ -0,0 +1,264 @@
+/* eslint-disable camelcase */
+const b4a = require('b4a')
+const argon2 = require('argon2hash-wasm')
+const { randombytes_buf } = require('./randombytes')
+
+const crypto_pwhash_argon2i_ALG_ARGON2I13 = 1
+const crypto_pwhash_argon2i_BYTES_MIN = 16
+const crypto_pwhash_argon2i_BYTES_MAX = 4294967295
+const crypto_pwhash_argon2i_PASSWD_MIN = 0
+const crypto_pwhash_argon2i_PASSWD_MAX = 4294967295
+const crypto_pwhash_argon2i_SALTBYTES = 16
+const crypto_pwhash_argon2i_STRBYTES = 128
+const crypto_pwhash_argon2i_STRPREFIX = '$argon2i$'
+const crypto_pwhash_argon2i_OPSLIMIT_MIN = 3
+const crypto_pwhash_argon2i_OPSLIMIT_MAX = 4294967295
+const crypto_pwhash_argon2i_MEMLIMIT_MIN = 8192
+const crypto_pwhash_argon2i_MEMLIMIT_MAX = 2147483648
+const crypto_pwhash_argon2i_OPSLIMIT_INTERACTIVE = 4
+const crypto_pwhash_argon2i_MEMLIMIT_INTERACTIVE = 33554432
+const crypto_pwhash_argon2i_OPSLIMIT_MODERATE = 6
+const crypto_pwhash_argon2i_MEMLIMIT_MODERATE = 134217728
+const crypto_pwhash_argon2i_OPSLIMIT_SENSITIVE = 8
+const crypto_pwhash_argon2i_MEMLIMIT_SENSITIVE = 536870912
+
+const crypto_pwhash_argon2id_ALG_ARGON2ID13 = 2
+const crypto_pwhash_argon2id_BYTES_MIN = 16
+const crypto_pwhash_argon2id_BYTES_MAX = 4294967295
+const crypto_pwhash_argon2id_PASSWD_MIN = 0
+const crypto_pwhash_argon2id_PASSWD_MAX = 4294967295
+const crypto_pwhash_argon2id_SALTBYTES = 16
+const crypto_pwhash_argon2id_STRBYTES = 128
+const crypto_pwhash_argon2id_STRPREFIX = '$argon2id$'
+const crypto_pwhash_argon2id_OPSLIMIT_MIN = 1
+const crypto_pwhash_argon2id_OPSLIMIT_MAX = 4294967295
+const crypto_pwhash_argon2id_MEMLIMIT_MIN = 8192
+const crypto_pwhash_argon2id_MEMLIMIT_MAX = 2147483648
+const crypto_pwhash_argon2id_OPSLIMIT_INTERACTIVE = 2
+const crypto_pwhash_argon2id_MEMLIMIT_INTERACTIVE = 67108864
+const crypto_pwhash_argon2id_OPSLIMIT_MODERATE = 3
+const crypto_pwhash_argon2id_MEMLIMIT_MODERATE = 268435456
+const crypto_pwhash_argon2id_OPSLIMIT_SENSITIVE = 4
+const crypto_pwhash_argon2id_MEMLIMIT_SENSITIVE = 1073741824
+
+const crypto_pwhash_ALG_ARGON2I13 = crypto_pwhash_argon2i_ALG_ARGON2I13
+const crypto_pwhash_ALG_ARGON2ID13 = crypto_pwhash_argon2id_ALG_ARGON2ID13
+const crypto_pwhash_ALG_DEFAULT = crypto_pwhash_ALG_ARGON2ID13
+const crypto_pwhash_BYTES_MIN = crypto_pwhash_argon2id_BYTES_MIN
+const crypto_pwhash_BYTES_MAX = crypto_pwhash_argon2id_BYTES_MAX
+const crypto_pwhash_PASSWD_MIN = crypto_pwhash_argon2id_PASSWD_MIN
+const crypto_pwhash_PASSWD_MAX = crypto_pwhash_argon2id_PASSWD_MAX
+const crypto_pwhash_SALTBYTES = crypto_pwhash_argon2id_SALTBYTES
+const crypto_pwhash_STRBYTES = crypto_pwhash_argon2id_STRBYTES
+const crypto_pwhash_STRPREFIX = crypto_pwhash_argon2id_STRPREFIX
+const crypto_pwhash_OPSLIMIT_MIN = crypto_pwhash_argon2id_OPSLIMIT_MIN
+const crypto_pwhash_OPSLIMIT_MAX = crypto_pwhash_argon2id_OPSLIMIT_MAX
+const crypto_pwhash_MEMLIMIT_MIN = crypto_pwhash_argon2id_MEMLIMIT_MIN
+const crypto_pwhash_MEMLIMIT_MAX = crypto_pwhash_argon2id_MEMLIMIT_MAX
+const crypto_pwhash_OPSLIMIT_INTERACTIVE = crypto_pwhash_argon2id_OPSLIMIT_INTERACTIVE
+const crypto_pwhash_MEMLIMIT_INTERACTIVE = crypto_pwhash_argon2id_MEMLIMIT_INTERACTIVE
+const crypto_pwhash_OPSLIMIT_MODERATE = crypto_pwhash_argon2id_OPSLIMIT_MODERATE
+const crypto_pwhash_MEMLIMIT_MODERATE = crypto_pwhash_argon2id_MEMLIMIT_MODERATE
+const crypto_pwhash_OPSLIMIT_SENSITIVE = crypto_pwhash_argon2id_OPSLIMIT_SENSITIVE
+const crypto_pwhash_MEMLIMIT_SENSITIVE = crypto_pwhash_argon2id_MEMLIMIT_SENSITIVE
+
+module.exports = {
+  crypto_pwhash_ALG_ARGON2I13,
+  crypto_pwhash_ALG_ARGON2ID13,
+  crypto_pwhash_ALG_DEFAULT,
+  crypto_pwhash_BYTES_MIN,
+  crypto_pwhash_BYTES_MAX,
+  crypto_pwhash_PASSWD_MIN,
+  crypto_pwhash_PASSWD_MAX,
+  crypto_pwhash_SALTBYTES,
+  crypto_pwhash_STRBYTES,
+  crypto_pwhash_STRPREFIX,
+  crypto_pwhash_OPSLIMIT_MIN,
+  crypto_pwhash_OPSLIMIT_MAX,
+  crypto_pwhash_MEMLIMIT_MIN,
+  crypto_pwhash_MEMLIMIT_MAX,
+  crypto_pwhash_OPSLIMIT_INTERACTIVE,
+  crypto_pwhash_MEMLIMIT_INTERACTIVE,
+  crypto_pwhash_OPSLIMIT_MODERATE,
+  crypto_pwhash_MEMLIMIT_MODERATE,
+  crypto_pwhash_OPSLIMIT_SENSITIVE,
+  crypto_pwhash_MEMLIMIT_SENSITIVE,
+  crypto_pwhash_argon2i,
+  crypto_pwhash_argon2id,
+  crypto_pwhash_argon2i_str,
+  crypto_pwhash_argon2id_str,
+  crypto_pwhash,
+  crypto_pwhash_str,
+  crypto_pwhash_str_verify,
+  crypto_pwhash_str_needs_rehash
+}
+
+function crypto_pwhash_argon2i (out, passwd, salt, passes, memory, alg) {
+  const outlen = out.byteLength
+  const passwdlen = passwd.byteLength
+  out.fill(0)
+
+  if (outlen > crypto_pwhash_argon2i_BYTES_MAX) {
+    throw new Error('Too large')
+  }
+
+  if (outlen < crypto_pwhash_argon2i_BYTES_MIN) {
+    throw new Error('Invalid opts')
+  }
+
+  if (passwdlen > crypto_pwhash_argon2i_PASSWD_MAX ||
+    passes > crypto_pwhash_argon2i_OPSLIMIT_MAX ||
+    memory > crypto_pwhash_argon2i_MEMLIMIT_MAX) {
+    throw new Error('Too large')
+  }
+
+  if (passwdlen < crypto_pwhash_argon2i_PASSWD_MIN ||
+    (passes && passes < crypto_pwhash_argon2i_OPSLIMIT_MIN) ||
+    (memory && memory < crypto_pwhash_argon2i_MEMLIMIT_MIN)) {
+    throw new Error('Invalid opts')
+  }
+
+  switch (alg) {
+    case crypto_pwhash_argon2i_ALG_ARGON2I13: {
+      const buf = argon2(passwd, salt, null, null, 'binary', { memory: memory >> 10, passes, outlen, type: argon2.ARGON2I })
+      out.set(buf)
+      return 0
+    }
+
+    default:
+      throw new Error('Invalid input')
+  }
+}
+
+function crypto_pwhash_argon2id (out, passwd, salt, passes, memory, alg) {
+  const outlen = out.byteLength
+  const passwdlen = passwd.byteLength
+  out.fill(0)
+
+  if (outlen > crypto_pwhash_argon2id_BYTES_MAX) {
+    throw new Error('Too large')
+  }
+
+  if (outlen < crypto_pwhash_argon2id_BYTES_MIN) {
+    throw new Error('Invalid opts')
+  }
+
+  if (passwdlen > crypto_pwhash_argon2id_PASSWD_MAX ||
+    passes > crypto_pwhash_argon2id_OPSLIMIT_MAX ||
+    memory > crypto_pwhash_argon2id_MEMLIMIT_MAX) {
+    throw new Error('Too large')
+  }
+
+  if (passwdlen < crypto_pwhash_argon2id_PASSWD_MIN ||
+    (passes && passes < crypto_pwhash_argon2id_OPSLIMIT_MIN) ||
+    (memory && memory < crypto_pwhash_argon2id_MEMLIMIT_MIN)) {
+    throw new Error('Invalid opts')
+  }
+
+  switch (alg) {
+    case crypto_pwhash_argon2id_ALG_ARGON2ID13: {
+      const buf = argon2(passwd, salt, null, null, 'binary', { memory: memory >> 10, passes, outlen, type: argon2.ARGON2ID })
+      out.set(buf)
+      return 0
+    }
+
+    default:
+      throw new Error('Invalid input')
+  }
+}
+
+function crypto_pwhash_argon2i_str (out, passwd, salt, passes, memory, alg) {
+  const outlen = 32
+  const passwdlen = passwd.byteLength
+
+  if (passwdlen > crypto_pwhash_argon2i_PASSWD_MAX ||
+    passes > crypto_pwhash_argon2i_OPSLIMIT_MAX ||
+    memory > crypto_pwhash_argon2i_MEMLIMIT_MAX) {
+    throw new Error('Too large')
+  }
+
+  if (passwdlen < crypto_pwhash_argon2i_PASSWD_MIN ||
+    (passes && passes < crypto_pwhash_argon2i_OPSLIMIT_MIN) ||
+    (memory && memory < crypto_pwhash_argon2i_MEMLIMIT_MIN)) {
+    throw new Error('Invalid opts')
+  }
+
+  switch (alg) {
+    case crypto_pwhash_argon2i_ALG_ARGON2I13:
+      return argon2(passwd, salt, null, null, { memory: memory >> 10, passes, outlen, type: argon2.ARGON2I })
+
+    default:
+      throw new Error('Invalid input')
+  }
+}
+
+function crypto_pwhash_argon2id_str (out, passwd, salt, passes, memory, alg) {
+  const outlen = 32
+  const passwdlen = passwd.byteLength
+
+  if (passwdlen > crypto_pwhash_argon2id_PASSWD_MAX ||
+    passes > crypto_pwhash_argon2id_OPSLIMIT_MAX ||
+    memory > crypto_pwhash_argon2id_MEMLIMIT_MAX) {
+    throw new Error('Too large')
+  }
+
+  if (passwdlen < crypto_pwhash_argon2id_PASSWD_MIN ||
+    (passes && passes < crypto_pwhash_argon2id_OPSLIMIT_MIN) ||
+    (memory && memory < crypto_pwhash_argon2id_MEMLIMIT_MIN)) {
+    throw new Error('Invalid opts')
+  }
+
+  switch (alg) {
+    case crypto_pwhash_argon2id_ALG_ARGON2ID13:
+      out.write(argon2(passwd, salt, null, null, { memory: memory >> 10, passes, outlen, type: argon2.ARGON2ID }))
+      return
+
+    default:
+      throw new Error('Invalid input')
+  }
+}
+
+function crypto_pwhash (out, passwd, salt, opslimit, memlimit, alg) {
+  switch (alg) {
+    case crypto_pwhash_argon2i_ALG_ARGON2I13:
+      return crypto_pwhash_argon2i(out, passwd, salt, opslimit, memlimit, alg)
+
+    case crypto_pwhash_argon2id_ALG_ARGON2ID13:
+      return crypto_pwhash_argon2id(out, passwd, salt, opslimit, memlimit, alg)
+  }
+}
+
+function crypto_pwhash_str (out, passwd, opslimit, memlimit) {
+  const salt = b4a.alloc(crypto_pwhash_SALTBYTES)
+  randombytes_buf(salt)
+
+  return crypto_pwhash_argon2id_str(out, passwd, salt, opslimit, memlimit, crypto_pwhash_ALG_DEFAULT)
+}
+
+function crypto_pwhash_str_verify (str, passwd) {
+  if (b4a.isBuffer(str)) return crypto_pwhash_str_verify(str.toString(), passwd)
+
+  if (str.slice(0, crypto_pwhash_argon2id_STRPREFIX.length) === crypto_pwhash_argon2id_STRPREFIX) {
+    return argon2.verify(str, passwd, null)
+  }
+
+  if (str.slice(0, crypto_pwhash_argon2i_STRPREFIX.length) === crypto_pwhash_argon2i_STRPREFIX) {
+    return argon2.verify(str, passwd, null)
+  }
+
+  return false
+}
+
+function crypto_pwhash_str_needs_rehash (str, opslimit, memlimit, type) {
+  memlimit >>= 10
+
+  if ((opslimit | memlimit) > 0xffffffff || (str.byteLength > crypto_pwhash_STRBYTES)) {
+    throw new Error('Invalid opts.')
+  }
+
+  try {
+    return argon2.needsRehash(str, opslimit, memlimit, type)
+  } catch {
+    return true
+  }
+}

crypto_scalarmult_ed25519.js

@@ -0,0 +1,398 @@
+const assert = require('nanoassert')
+const ec = require('./fe25519_25')
+
+const crypto_scalarmult_ed25519_BYTES = 32
+const crypto_scalarmult_ed25519_SCALARBYTES = 32
+
+module.exports = {
+  crypto_scalarmult_ed25519,
+  crypto_scalarmult_ed25519_noclamp,
+  crypto_scalarmult_ed25519_base,
+  crypto_scalarmult: crypto_scalarmult_curve25519,
+  crypto_scalarmult_base: crypto_scalarmult_curve25519_base,
+  crypto_scalarmult_ed25519_base_noclamp,
+  crypto_scalarmult_curve25519,
+  crypto_scalarmult_curve25519_1,
+  crypto_scalarmult_curve25519_base,
+  crypto_scalarmult_ristretto255,
+  crypto_scalarmult_ristretto255_base,
+  crypto_scalarmult_BYTES: crypto_scalarmult_ed25519_BYTES,
+  crypto_scalarmult_SCALARBYTES: crypto_scalarmult_ed25519_SCALARBYTES,
+  crypto_scalarmult_ed25519_BYTES,
+  crypto_scalarmult_ed25519_SCALARBYTES,
+  crypto_scalarmult_curve25519_BYTES: 32,
+  crypto_scalarmult_curve25519_SCALARBYTES: 32
+}
+
+const _121666buf = Buffer.alloc(32)
+_121666buf.writeUInt32LE(121666)
+
+const _121666 = ec.fe25519()
+ec.fe25519_frombytes(_121666, _121666buf)
+
+function _crypto_scalarmult_ed25519_is_inf (s) {
+  var c
+  var i
+
+  c = s[0] ^ 0x01
+  for (i = 1; i < 31; i++) {
+    c |= s[i]
+  }
+  c |= s[31] & 0x7f
+
+  return ((c - 1) >> 8) & 1
+}
+
+function _crypto_scalarmult_ed25519_clamp (k) {
+  k[0] &= 248
+  k[31] |= 64
+}
+
+function _crypto_scalarmult_ed25519 (q, n, p, clamp) {
+  var Q = ec.ge3()
+  var P = ec.ge3()
+  var t = q.slice()
+  var i
+
+  if (ec.ge25519_is_canonical(p) == 0 || ec.ge25519_has_small_order(p) != 0 ||
+      ec.ge25519_frombytes(P, p) != 0 || ec.ge25519_is_on_main_subgroup(P) == 0) {
+    throw new Error('Invalid base point')
+  }
+
+  for (i = 0; i < 32; ++i) {
+    t[i] = n[i]
+  }
+
+  if (clamp !== 0) {
+    _crypto_scalarmult_ed25519_clamp(t)
+  }
+
+  t[31] &= 127
+
+  ec.ge25519_scalarmult(Q, t, P)
+  ec.ge25519_p3_tobytes(q, Q)
+
+  if (_crypto_scalarmult_ed25519_is_inf(q) != 0 || sodium_is_zero(n, 32)) {
+    throw new Error('Point multiplication failed')
+  }
+
+  return 0
+}
+
+function crypto_scalarmult_ed25519 (q, n, p) {
+  assert(q instanceof Uint8Array && q.byteLength === 32)
+  assert(n instanceof Uint8Array && n.byteLength === 32)
+  assert(p instanceof Uint8Array && p.byteLength === 32)
+
+  return _crypto_scalarmult_ed25519(q, n, p, 1)
+}
+
+function crypto_scalarmult_ed25519_noclamp (q, n, p) {
+  assert(q instanceof Uint8Array && q.byteLength === 32)
+  assert(n instanceof Uint8Array && n.byteLength === 32)
+  assert(p instanceof Uint8Array && p.byteLength === 32)
+
+  return _crypto_scalarmult_ed25519(q, n, p, 0)
+}
+
+function _crypto_scalarmult_ed25519_base (q, n, clamp) {
+  var t = q.slice()
+  var Q = ec.ge3()
+  var i
+
+  for (i = 0; i < 32; ++i) {
+    t[i] = n[i]
+  }
+
+  if (clamp !== 0) {
+    _crypto_scalarmult_ed25519_clamp(t)
+  }
+
+  t[31] &= 127
+
+  ec.ge25519_scalarmult_base(Q, t)
+  ec.ge25519_p3_tobytes(q, Q)
+  if (_crypto_scalarmult_ed25519_is_inf(q) !== 0 || sodium_is_zero(n, 32)) {
+    return -1
+  }
+  return 0
+}
+
+function crypto_scalarmult_ed25519_base(q, n) {
+  assert(q instanceof Uint8Array && q.byteLength === 32)
+  assert(n instanceof Uint8Array && n.byteLength === 32)
+
+  return _crypto_scalarmult_ed25519_base(q, n, 1)
+}
+
+function crypto_scalarmult_ed25519_base_noclamp (q, n) {
+  return _crypto_scalarmult_ed25519_base(q, n, 0)
+}
+
+function crypto_scalarmult_ed25519_bytes () {
+  return crypto_scalarmult_ed25519_BYTES
+}
+
+function crypto_scalarmult_ed25519_scalarbytes () {
+  return crypto_scalarmult_ed25519_SCALARBYTES
+}
+
+function crypto_scalarmult_ristretto255 (q, n, p) {
+  assert(q instanceof Uint8Array && q.byteLength === 32)
+  assert(n instanceof Uint8Array && n.byteLength === 32)
+  assert(p instanceof Uint8Array && p.byteLength === 32)
+
+  var t = q.slice()
+  var Q = ec.ge3()
+  var P = ec.ge3()
+  var i
+
+  if (ec.ristretto255_frombytes(P, p) != 0) {
+    return -1
+  }
+  for (i = 0; i < 32; ++i) {
+    t[i] = n[i]
+  }
+  t[31] &= 127
+  ec.ge25519_scalarmult(Q, t, P)
+  ec.ristretto255_p3_tobytes(q, Q)
+  if (sodium_is_zero(q, 32)) {
+    return -1
+  }
+  return 0
+}
+
+function crypto_scalarmult_ristretto255_base (q, n) {
+  var t = q.slice
+  var Q = ec.ge3()
+  var i
+
+  for (i = 0; i < 32; ++i) {
+    t[i] = n[i]
+  }
+
+  t[31] &= 127
+
+  ec.ge25519_scalarmult_base(Q, t)
+  ec.ristretto255_p3_tobytes(q, Q)
+  if (sodium_is_zero(q, 32)) {
+    return -1
+  }
+  return 0
+}
+
+function crypto_scalarmult_ristretto255_bytes () {
+  return crypto_scalarmult_ristretto255_BYTES
+}
+
+function crypto_scalarmult_ristretto255_scalarbytes () {
+  return crypto_scalarmult_ristretto255_SCALARBYTES
+}
+
+function has_small_order (s) {
+  assert(s instanceof Uint8Array && s.byteLength === 32)
+
+  const blacklist = [
+    /* 0 (order 4) */
+    [ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 ],
+    /* 1 (order 1) */
+    [ 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 ],
+    /* 325606250916557431795983626356110631294008115727848805560023387167927233504
+       (order 8) */
+    [ 0xe0, 0xeb, 0x7a, 0x7c, 0x3b, 0x41, 0xb8, 0xae, 0x16, 0x56, 0xe3,
+      0xfa, 0xf1, 0x9f, 0xc4, 0x6a, 0xda, 0x09, 0x8d, 0xeb, 0x9c, 0x32,
+      0xb1, 0xfd, 0x86, 0x62, 0x05, 0x16, 0x5f, 0x49, 0xb8, 0x00 ],
+    /* 39382357235489614581723060781553021112529911719440698176882885853963445705823
+       (order 8) */
+    [ 0x5f, 0x9c, 0x95, 0xbc, 0xa3, 0x50, 0x8c, 0x24, 0xb1, 0xd0, 0xb1,
+      0x55, 0x9c, 0x83, 0xef, 0x5b, 0x04, 0x44, 0x5c, 0xc4, 0x58, 0x1c,
+      0x8e, 0x86, 0xd8, 0x22, 0x4e, 0xdd, 0xd0, 0x9f, 0x11, 0x57 ],
+    /* p-1 (order 2) */
+    [ 0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f ],
+    /* p (=0, order 4) */
+    [ 0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f ],
+    /* p+1 (=1, order 1) */
+    [ 0xee, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f ]
+  ]
+
+  const c = Buffer.alloc(7)
+
+  var k
+  var i, j
+
+  assert(blacklist.length === 7)
+  for (j = 0; j < 31; j++) {
+    for (i = 0; i < 7; i++) {
+      c[i] |= s[j] ^ blacklist[i][j]
+    }
+  }
+  for (i = 0; i < 7; i++) {
+    c[i] |= (s[j] & 0x7f) ^ blacklist[i][j]
+  }
+  k = 0
+  for (i = 0; i < 7; i++) {
+    k |= (c[i] - 1)
+  }
+  return ((k >> 8) & 1)
+}
+
+function crypto_scalarmult_curve25519 (q, n, p) {
+  var t = q.slice()
+  var i
+  var x1 = ec.fe25519()
+  var x2 = ec.fe25519()
+  var z2 = ec.fe25519()
+  var x3 = ec.fe25519()
+  var z3 = ec.fe25519()
+  var tmp0 = ec.fe25519()
+  var tmp1 = ec.fe25519()
+  var pos
+  var swap
+  var b
+
+  if (has_small_order(p)) {
+    return -1;
+  }
+  for (i = 0; i < 32; i++) {
+    t[i] = n[i]
+  }
+  t[0] &= 248
+  t[31] &= 127
+  t[31] |= 64
+  ec.fe25519_frombytes(x1, p)
+  ec.fe25519_1(x2)
+  ec.fe25519_0(z2)
+  ec.fe25519_copy(x3, x1)
+  ec.fe25519_1(z3)
+
+  for (pos = 254; pos >= 0; --pos) {
+    b = t[Math.floor(pos / 8)] >> (pos & 7)
+    b &= 1
+    swap ^= b
+
+    ec.fe25519_cswap(x2, x3, swap)
+    ec.fe25519_cswap(z2, z3, swap)
+    swap = b
+    ec.fe25519_sub(tmp0, x3, z3)
+
+    ec.fe25519_sub(tmp1, x2, z2)
+    ec.fe25519_add(x2, x2, z2)
+    ec.fe25519_add(z2, x3, z3)
+    ec.fe25519_mul(z3, tmp0, x2)
+    ec.fe25519_mul(z2, z2, tmp1)
+    ec.fe25519_sq(tmp0, tmp1)
+    ec.fe25519_sq(tmp1, x2)
+    ec.fe25519_add(x3, z3, z2)
+    ec.fe25519_sub(z2, z3, z2)
+    ec.fe25519_mul(x2, tmp1, tmp0)
+    ec.fe25519_sub(tmp1, tmp1, tmp0)
+    ec.fe25519_sq(z2, z2)
+    // TODO
+    // ec.fe25519_mul32(z3, tmp1, 121666)
+    ec.fe25519_mul(z3, tmp1, _121666)
+    ec.fe25519_sq(x3, x3)
+    ec.fe25519_add(tmp0, tmp0, z3)
+    ec.fe25519_mul(z3, x1, z2)
+    ec.fe25519_mul(z2, tmp1, tmp0)
+  }
+
+  ec.fe25519_cswap(x2, x3, swap)
+  ec.fe25519_cswap(z2, z3, swap)
+
+  ec.fe25519_invert(z2, z2)
+  ec.fe25519_mul(x2, x2, z2)
+  ec.fe25519_tobytes(q, x2)
+
+  return 0
+}
+
+function crypto_scalarmult_curve25519_1 (q, n, p) {
+  var t = q.slice()
+  var i
+  var x1 = ec.fe25519()
+  var x2 = ec.fe25519()
+  var z2 = ec.fe25519()
+  var x3 = ec.fe25519()
+  var z3 = ec.fe25519()
+  var pos
+  var swap
+  var b
+  var _q = Buffer.alloc(32)
+
+  if (has_small_order(p)) {
+    return -1;
+  }
+  t.set(n)
+  t[0] &= 248
+  t[31] &= 127
+  t[31] |= 64
+
+  ec.fe25519_frombytes(x1, p)
+  swap = ec.scalarmult_curve25519_inner_loop(x1, x2, t)
+
+  ec.fe25519_tobytes(q, x2)
+
+  return 0
+}
+
+function edwards_to_montgomery(montgomeryX, edwardsY, edwardsZ) {
+  var tempX = ec.fe25519()
+  var tempZ = ec.fe25519()
+
+  ec.fe25519_add(tempX, edwardsZ, edwardsY)
+  ec.fe25519_sub(tempZ, edwardsZ, edwardsY)
+  ec.fe25519_invert(tempZ, tempZ)
+  ec.fe25519_mul(montgomeryX, tempX, tempZ)
+}
+
+function crypto_scalarmult_curve25519_base (q, n) {
+  var t = q.slice()
+  var Q = ec.ge3()
+  const pk = ec.fe25519()
+
+  var i
+
+  for (i = 0; i < 32; i++) {
+    t[i] = n[i]
+  }
+
+  t[0] &= 248
+  t[31] |= 64
+  t[31] &= 127
+
+  ec.ge25519_scalarmult_base(Q, t)
+  edwards_to_montgomery(pk, Q[1], Q[2]);
+  ec.fe25519_tobytes(q, pk)
+
+  return 0
+}
+
+function print32 (num) {
+  if (num < 0) return print32(0x100000000 + num)
+  console.log(num.toString(16).padStart(16, '0'))
+}
+
+function printfe (fe) {
+  for (let i of fe) print32(i)
+}
+
+function sodium_is_zero (n) {
+  let i
+  let d = 0
+
+  for (let i = 0; i < n.length; i++) {
+    d |= n[i]
+  }
+
+  return 1 & ((d - 1) >> 8)
+}

crypto_secretbox.js

@@ -68,8 +68,8 @@ function crypto_secretbox_detached (o, mac, msg, n, k) {
 
   const tmp = new Uint8Array(msg.byteLength + mac.byteLength)
   crypto_secretbox_easy(tmp, msg, n, k)
-  o.set(tmp.subarray(0, msg.byteLength))
-  mac.set(tmp.subarray(msg.byteLength))
+  mac.set(tmp.subarray(0, mac.byteLength))
+  o.set(tmp.subarray(mac.byteLength))
   return true
 }
 
@@ -80,8 +80,8 @@ function crypto_secretbox_open_detached (msg, o, mac, n, k) {
   assert(k.byteLength === crypto_secretbox_KEYBYTES, "k must be 'crypto_secretbox_KEYBYTES' bytes")
 
   const tmp = new Uint8Array(o.byteLength + mac.byteLength)
-  tmp.set(o)
-  tmp.set(mac, msg.byteLength)
+  tmp.set(mac)
+  tmp.set(o, mac.byteLength)
   return crypto_secretbox_open_easy(msg, tmp, n, k)
 }
 

crypto_secretstream.js

@@ -0,0 +1,271 @@
+/* eslint-disable camelcase */
+const assert = require('nanoassert')
+const { randombytes_buf } = require('./randombytes')
+const {
+  crypto_stream_chacha20_ietf,
+  crypto_stream_chacha20_ietf_xor,
+  crypto_stream_chacha20_ietf_xor_ic,
+  crypto_stream_chacha20_ietf_KEYBYTES
+} = require('./crypto_stream_chacha20')
+const { crypto_core_hchacha20, crypto_core_hchacha20_INPUTBYTES } = require('./internal/hchacha20')
+const Poly1305 = require('./internal/poly1305')
+const { sodium_increment, sodium_is_zero, sodium_memcmp } = require('./helpers')
+
+const crypto_onetimeauth_poly1305_BYTES = 16
+const crypto_secretstream_xchacha20poly1305_COUNTERBYTES = 4
+const crypto_secretstream_xchacha20poly1305_INONCEBYTES = 8
+const crypto_aead_xchacha20poly1305_ietf_KEYBYTES = 32
+const crypto_secretstream_xchacha20poly1305_KEYBYTES = crypto_aead_xchacha20poly1305_ietf_KEYBYTES
+const crypto_aead_xchacha20poly1305_ietf_NPUBBYTES = 24
+const crypto_secretstream_xchacha20poly1305_HEADERBYTES = crypto_aead_xchacha20poly1305_ietf_NPUBBYTES
+const crypto_aead_xchacha20poly1305_ietf_ABYTES = 16
+const crypto_secretstream_xchacha20poly1305_ABYTES = 1 + crypto_aead_xchacha20poly1305_ietf_ABYTES
+const crypto_secretstream_xchacha20poly1305_MESSAGEBYTES_MAX = Number.MAX_SAFE_INTEGER
+const crypto_aead_chacha20poly1305_ietf_MESSAGEBYTES_MAX = Number.MAX_SAFE_INTEGER
+const crypto_secretstream_xchacha20poly1305_TAGBYTES = 1
+const crypto_secretstream_xchacha20poly1305_TAG_MESSAGE = new Uint8Array([0])
+const crypto_secretstream_xchacha20poly1305_TAG_PUSH = new Uint8Array([1])
+const crypto_secretstream_xchacha20poly1305_TAG_REKEY = new Uint8Array([2])
+const crypto_secretstream_xchacha20poly1305_TAG_FINAL = new Uint8Array([crypto_secretstream_xchacha20poly1305_TAG_PUSH | crypto_secretstream_xchacha20poly1305_TAG_REKEY])
+const crypto_secretstream_xchacha20poly1305_STATEBYTES = crypto_secretstream_xchacha20poly1305_KEYBYTES +
+  crypto_secretstream_xchacha20poly1305_INONCEBYTES + crypto_secretstream_xchacha20poly1305_COUNTERBYTES + 8
+
+const KEY_OFFSET = 0
+const NONCE_OFFSET = crypto_secretstream_xchacha20poly1305_KEYBYTES
+const PAD_OFFSET = NONCE_OFFSET + crypto_secretstream_xchacha20poly1305_INONCEBYTES + crypto_secretstream_xchacha20poly1305_COUNTERBYTES
+
+const _pad0 = new Uint8Array(16)
+
+function STORE64_LE (dest, int) {
+  let mul = 1
+  let i = 0
+  dest[0] = int & 0xFF
+  while (++i < 8 && (mul *= 0x100)) {
+    dest[i] = (int / mul) & 0xFF
+  }
+}
+
+function crypto_secretstream_xchacha20poly1305_counter_reset (state) {
+  assert(state.byteLength === crypto_secretstream_xchacha20poly1305_STATEBYTES,
+    'state is should be crypto_secretstream_xchacha20poly1305_STATEBYTES long')
+
+  const nonce = state.subarray(NONCE_OFFSET, PAD_OFFSET)
+  for (let i = 0; i < crypto_secretstream_xchacha20poly1305_COUNTERBYTES; i++) {
+    nonce[i] = 0
+  }
+  nonce[0] = 1
+}
+
+function crypto_secretstream_xchacha20poly1305_keygen (k) {
+  assert(k.length === crypto_secretstream_xchacha20poly1305_KEYBYTES)
+  randombytes_buf(k)
+}
+
+function crypto_secretstream_xchacha20poly1305_init_push (state, out, key) {
+  assert(state.byteLength === crypto_secretstream_xchacha20poly1305_STATEBYTES,
+    'state is should be crypto_secretstream_xchacha20poly1305_STATEBYTES long')
+  assert(out instanceof Uint8Array && out.length === crypto_secretstream_xchacha20poly1305_HEADERBYTES, 'out not byte array of length crypto_secretstream_xchacha20poly1305_HEADERBYTES')
+  assert(key instanceof Uint8Array && key.length === crypto_secretstream_xchacha20poly1305_KEYBYTES, 'key not byte array of length crypto_secretstream_xchacha20poly1305_KEYBYTES')
+
+  const k = state.subarray(KEY_OFFSET, NONCE_OFFSET)
+  const nonce = state.subarray(NONCE_OFFSET, PAD_OFFSET)
+  const pad = state.subarray(PAD_OFFSET)
+
+  randombytes_buf(out, crypto_secretstream_xchacha20poly1305_HEADERBYTES)
+  crypto_core_hchacha20(k, out, key, null)
+  crypto_secretstream_xchacha20poly1305_counter_reset(state)
+  for (let i = 0; i < crypto_secretstream_xchacha20poly1305_INONCEBYTES; i++) {
+    nonce[i + crypto_secretstream_xchacha20poly1305_COUNTERBYTES] = out[i + crypto_core_hchacha20_INPUTBYTES]
+  }
+  pad.fill(0)
+}
+
+function crypto_secretstream_xchacha20poly1305_init_pull (state, _in, key) {
+  assert(state.byteLength === crypto_secretstream_xchacha20poly1305_STATEBYTES,
+    'state is should be crypto_secretstream_xchacha20poly1305_STATEBYTES long')
+  assert(_in instanceof Uint8Array && _in.length === crypto_secretstream_xchacha20poly1305_HEADERBYTES,
+    '_in not byte array of length crypto_secretstream_xchacha20poly1305_HEADERBYTES')
+  assert(key instanceof Uint8Array && key.length === crypto_secretstream_xchacha20poly1305_KEYBYTES,
+    'key not byte array of length crypto_secretstream_xchacha20poly1305_KEYBYTES')
+
+  const k = state.subarray(KEY_OFFSET, NONCE_OFFSET)
+  const nonce = state.subarray(NONCE_OFFSET, PAD_OFFSET)
+  const pad = state.subarray(PAD_OFFSET)
+
+  crypto_core_hchacha20(k, _in, key, null)
+  crypto_secretstream_xchacha20poly1305_counter_reset(state)
+
+  for (let i = 0; i < crypto_secretstream_xchacha20poly1305_INONCEBYTES; i++) {
+    nonce[i + crypto_secretstream_xchacha20poly1305_COUNTERBYTES] = _in[i + crypto_core_hchacha20_INPUTBYTES]
+  }
+  pad.fill(0)
+}
+
+function crypto_secretstream_xchacha20poly1305_rekey (state) {
+  assert(state.byteLength === crypto_secretstream_xchacha20poly1305_STATEBYTES,
+    'state is should be crypto_secretstream_xchacha20poly1305_STATEBYTES long')
+
+  const k = state.subarray(KEY_OFFSET, NONCE_OFFSET)
+  const nonce = state.subarray(NONCE_OFFSET, PAD_OFFSET)
+
+  const new_key_and_inonce = new Uint8Array(
+    crypto_stream_chacha20_ietf_KEYBYTES + crypto_secretstream_xchacha20poly1305_INONCEBYTES)
+  let i
+  for (i = 0; i < crypto_stream_chacha20_ietf_KEYBYTES; i++) {
+    new_key_and_inonce[i] = k[i]
+  }
+  for (i = 0; i < crypto_secretstream_xchacha20poly1305_INONCEBYTES; i++) {
+    new_key_and_inonce[crypto_stream_chacha20_ietf_KEYBYTES + i] =
+      nonce[crypto_secretstream_xchacha20poly1305_COUNTERBYTES + i]
+  }
+  crypto_stream_chacha20_ietf_xor(new_key_and_inonce, new_key_and_inonce, nonce, k)
+  for (i = 0; i < crypto_stream_chacha20_ietf_KEYBYTES; i++) {
+    k[i] = new_key_and_inonce[i]
+  }
+  for (i = 0; i < crypto_secretstream_xchacha20poly1305_INONCEBYTES; i++) {
+    nonce[crypto_secretstream_xchacha20poly1305_COUNTERBYTES + i] =
+      new_key_and_inonce[crypto_stream_chacha20_ietf_KEYBYTES + i]
+  }
+  crypto_secretstream_xchacha20poly1305_counter_reset(state)
+}
+
+function crypto_secretstream_xchacha20poly1305_push (state, out, m, ad, tag) {
+  assert(state.byteLength === crypto_secretstream_xchacha20poly1305_STATEBYTES,
+    'state is should be crypto_secretstream_xchacha20poly1305_STATEBYTES long')
+  if (!ad) ad = new Uint8Array(0)
+
+  const k = state.subarray(KEY_OFFSET, NONCE_OFFSET)
+  const nonce = state.subarray(NONCE_OFFSET, PAD_OFFSET)
+
+  const block = new Uint8Array(64)
+  const slen = new Uint8Array(8)
+
+  assert(crypto_secretstream_xchacha20poly1305_MESSAGEBYTES_MAX <=
+    crypto_aead_chacha20poly1305_ietf_MESSAGEBYTES_MAX)
+
+  crypto_stream_chacha20_ietf(block, nonce, k)
+  const poly = new Poly1305(block)
+  block.fill(0)
+
+  poly.update(ad, 0, ad.byteLength)
+  poly.update(_pad0, 0, (0x10 - ad.byteLength) & 0xf)
+
+  block[0] = tag[0]
+  crypto_stream_chacha20_ietf_xor_ic(block, block, nonce, 1, k)
+
+  poly.update(block, 0, block.byteLength)
+  out[0] = block[0]
+
+  const c = out.subarray(1, out.byteLength)
+  crypto_stream_chacha20_ietf_xor_ic(c, m, nonce, 2, k)
+  poly.update(c, 0, m.byteLength)
+  poly.update(_pad0, 0, (0x10 - block.byteLength + m.byteLength) & 0xf)
+
+  STORE64_LE(slen, ad.byteLength)
+  poly.update(slen, 0, slen.byteLength)
+  STORE64_LE(slen, block.byteLength + m.byteLength)
+  poly.update(slen, 0, slen.byteLength)
+
+  const mac = out.subarray(1 + m.byteLength, out.byteLength)
+  poly.finish(mac, 0)
+
+  assert(crypto_onetimeauth_poly1305_BYTES >=
+    crypto_secretstream_xchacha20poly1305_INONCEBYTES)
+  xor_buf(nonce.subarray(crypto_secretstream_xchacha20poly1305_COUNTERBYTES, nonce.length),
+    mac, crypto_secretstream_xchacha20poly1305_INONCEBYTES)
+  sodium_increment(nonce)
+
+  if ((tag[0] & crypto_secretstream_xchacha20poly1305_TAG_REKEY) !== 0 ||
+    sodium_is_zero(nonce.subarray(0, crypto_secretstream_xchacha20poly1305_COUNTERBYTES))) {
+    crypto_secretstream_xchacha20poly1305_rekey(state)
+  }
+
+  return crypto_secretstream_xchacha20poly1305_ABYTES + m.byteLength
+}
+
+function crypto_secretstream_xchacha20poly1305_pull (state, m, tag, _in, ad) {
+  assert(state.byteLength === crypto_secretstream_xchacha20poly1305_STATEBYTES,
+    'state is should be crypto_secretstream_xchacha20poly1305_STATEBYTES long')
+  if (!ad) ad = new Uint8Array(0)
+
+  const k = state.subarray(KEY_OFFSET, NONCE_OFFSET)
+  const nonce = state.subarray(NONCE_OFFSET, PAD_OFFSET)
+
+  const block = new Uint8Array(64)
+  const slen = new Uint8Array(8)
+  const mac = new Uint8Array(crypto_onetimeauth_poly1305_BYTES)
+
+  assert(_in.byteLength >= crypto_secretstream_xchacha20poly1305_ABYTES,
+    'ciphertext is too short.')
+
+  const mlen = _in.byteLength - crypto_secretstream_xchacha20poly1305_ABYTES
+  crypto_stream_chacha20_ietf(block, nonce, k)
+  const poly = new Poly1305(block)
+  block.fill(0) // sodium_memzero(block, sizeof block);
+
+  poly.update(ad, 0, ad.byteLength)
+  poly.update(_pad0, 0, (0x10 - ad.byteLength) & 0xf)
+
+  block.fill(0) // memset(block, 0, sizeof block);
+  block[0] = _in[0]
+  crypto_stream_chacha20_ietf_xor_ic(block, block, nonce, 1, k)
+
+  tag[0] = block[0]
+  block[0] = _in[0]
+  poly.update(block, 0, block.byteLength)
+
+  const c = _in.subarray(1, _in.length)
+  poly.update(c, 0, mlen)
+
+  poly.update(_pad0, 0, (0x10 - block.byteLength + mlen) & 0xf)
+
+  STORE64_LE(slen, ad.byteLength)
+  poly.update(slen, 0, slen.byteLength)
+  STORE64_LE(slen, block.byteLength + m.byteLength)
+  poly.update(slen, 0, slen.byteLength)
+
+  poly.finish(mac, 0)
+  const stored_mac = _in.subarray(1 + mlen, _in.length)
+
+  if (!sodium_memcmp(mac, stored_mac)) {
+    mac.fill(0)
+    throw new Error('MAC could not be verified.')
+  }
+
+  crypto_stream_chacha20_ietf_xor_ic(m, c.subarray(0, m.length), nonce, 2, k)
+  xor_buf(nonce.subarray(crypto_secretstream_xchacha20poly1305_COUNTERBYTES, nonce.length),
+    mac, crypto_secretstream_xchacha20poly1305_INONCEBYTES)
+  sodium_increment(nonce)
+
+  if ((tag & crypto_secretstream_xchacha20poly1305_TAG_REKEY) !== 0 ||
+    sodium_is_zero(nonce.subarray(0, crypto_secretstream_xchacha20poly1305_COUNTERBYTES))) {
+    crypto_secretstream_xchacha20poly1305_rekey(state)
+  }
+
+  return mlen
+}
+
+function xor_buf (out, _in, n) {
+  for (let i = 0; i < n; i++) {
+    out[i] ^= _in[i]
+  }
+}
+
+module.exports = {
+  crypto_secretstream_xchacha20poly1305_keygen,
+  crypto_secretstream_xchacha20poly1305_init_push,
+  crypto_secretstream_xchacha20poly1305_init_pull,
+  crypto_secretstream_xchacha20poly1305_rekey,
+  crypto_secretstream_xchacha20poly1305_push,
+  crypto_secretstream_xchacha20poly1305_pull,
+  crypto_secretstream_xchacha20poly1305_STATEBYTES,
+  crypto_secretstream_xchacha20poly1305_ABYTES,
+  crypto_secretstream_xchacha20poly1305_HEADERBYTES,
+  crypto_secretstream_xchacha20poly1305_KEYBYTES,
+  crypto_secretstream_xchacha20poly1305_MESSAGEBYTES_MAX,
+  crypto_secretstream_xchacha20poly1305_TAGBYTES,
+  crypto_secretstream_xchacha20poly1305_TAG_MESSAGE,
+  crypto_secretstream_xchacha20poly1305_TAG_PUSH,
+  crypto_secretstream_xchacha20poly1305_TAG_REKEY,
+  crypto_secretstream_xchacha20poly1305_TAG_FINAL
+}

crypto_sign.js

@@ -8,11 +8,19 @@ const {
   inv25519, unpack25519
 } = require('./internal/ed25519')
 const { randombytes } = require('./randombytes')
+const { crypto_scalarmult_BYTES } = require('./crypto_scalarmult.js')
+const { crypto_hash_sha512_BYTES } = require('./crypto_hash.js')
+const assert = require('nanoassert')
 
-const crypto_sign_BYTES = 64
-const crypto_sign_PUBLICKEYBYTES = 32
-const crypto_sign_SECRETKEYBYTES = 64
-const crypto_sign_SEEDBYTES = 32
+const crypto_sign_ed25519_PUBLICKEYBYTES = 32
+const crypto_sign_ed25519_SECRETKEYBYTES = 64
+const crypto_sign_ed25519_SEEDBYTES = 32
+const crypto_sign_ed25519_BYTES = 64
+
+const crypto_sign_BYTES = crypto_sign_ed25519_BYTES
+const crypto_sign_PUBLICKEYBYTES = crypto_sign_ed25519_PUBLICKEYBYTES
+const crypto_sign_SECRETKEYBYTES = crypto_sign_ed25519_SECRETKEYBYTES
+const crypto_sign_SEEDBYTES = crypto_sign_ed25519_SEEDBYTES
 
 module.exports = {
   crypto_sign_keypair,
@@ -24,7 +32,16 @@ module.exports = {
   crypto_sign_BYTES,
   crypto_sign_PUBLICKEYBYTES,
   crypto_sign_SECRETKEYBYTES,
-  crypto_sign_SEEDBYTES
+  crypto_sign_SEEDBYTES,
+  crypto_sign_ed25519_PUBLICKEYBYTES,
+  crypto_sign_ed25519_SECRETKEYBYTES,
+  crypto_sign_ed25519_SEEDBYTES,
+  crypto_sign_ed25519_BYTES,
+  crypto_sign_ed25519_pk_to_curve25519,
+  crypto_sign_ed25519_sk_to_curve25519,
+  crypto_sign_ed25519_sk_to_pk,
+  unpackneg,
+  pack
 }
 
 function set25519 (r, a) {
@@ -85,6 +102,8 @@ function pack (r, p) {
 }
 
 function scalarmult (p, q, s) {
+  // don't mutate q
+  var h = [gf(q[0]), gf(q[1]), gf(q[2]), gf(q[3])]
   var b, i
   set25519(p[0], gf0)
   set25519(p[1], gf1)
@@ -92,10 +111,10 @@ function scalarmult (p, q, s) {
   set25519(p[3], gf0)
   for (i = 255; i >= 0; --i) {
     b = (s[(i / 8) | 0] >> (i & 7)) & 1
-    cswap(p, q, b)
-    add(q, p)
+    cswap(p, h, b)
+    add(h, p)
     add(p, p)
-    cswap(p, q, b)
+    cswap(p, h, b)
   }
 }
 
@@ -126,7 +145,6 @@ function crypto_sign_keypair (pk, sk, seeded) {
   pack(pk, p)
 
   for (i = 0; i < 32; i++) sk[i + 32] = pk[i]
-  return 0
 }
 
 function crypto_sign_seed_keypair (pk, sk, seed) {
@@ -248,7 +266,9 @@ function unpackneg (r, p) {
   M(chk, chk, den)
   if (!neq25519(chk, num)) return false
 
-  if (par25519(r[0]) === (p[31] >> 7)) Z(r[0], gf0, r[0])
+  if (par25519(r[0]) === (p[31] >> 7)) {
+    Z(r[0], gf(), r[0])
+  }
 
   M(r[3], r[0], r[1])
   return true
@@ -317,6 +337,133 @@ function neq25519 (a, b) {
   return crypto_verify_32(c, 0, d, 0)
 }
 
-function check (buf, len) {
-  if (!buf || (len && buf.length < len)) throw new Error('Argument must be a buffer' + (len ? ' of length ' + len : ''))
+function ed25519_mul_l (p, q) {
+  scalarmult(p, q, L)
+}
+
+function ed25519_is_on_main_subgroup (p) {
+  var pl = [gf(), gf(), gf(), gf()]
+
+  ed25519_mul_l(pl, p)
+
+  var zero = 0
+  for (let i = 0; i < 16; i++) {
+    zero |= (pl[0][i] & 0xffff)
+  }
+
+  return zero === 0
+}
+
+function crypto_sign_ed25519_pk_to_curve25519 (x25519_pk, ed25519_pk) {
+  check(x25519_pk, crypto_sign_PUBLICKEYBYTES)
+  check(ed25519_pk, crypto_sign_ed25519_PUBLICKEYBYTES)
+
+  var a = [gf(), gf(), gf(), gf()]
+  var x = gf([1])
+  var one_minus_y = gf([1])
+
+  assert(
+    isSmallOrder(ed25519_pk) &&
+    unpackneg(a, ed25519_pk) &&
+    ed25519_is_on_main_subgroup(a), 'Cannot convert key: bad point')
+
+  for (let i = 0; i < a.length; i++) {
+    pack25519(x25519_pk, a[i])
+  }
+
+  Z(one_minus_y, one_minus_y, a[1])
+  A(x, x, a[1])
+  inv25519(one_minus_y, one_minus_y)
+  M(x, x, one_minus_y)
+  pack25519(x25519_pk, x)
+
+  return 0
+}
+
+function isSmallOrder (s) {
+  Uint8Array.from([])
+
+  var bad_points = [
+    // 0 (order 4)
+    Uint8Array.from([0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00]),
+
+    // 1 (order 1)
+    Uint8Array.from([0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00]),
+
+    // 2707385501144840649318225287225658788936804267575313519463743609750303402022(order 8)
+    Uint8Array.from([0x26, 0xe8, 0x95, 0x8f, 0xc2, 0xb2, 0x27, 0xb0, 0x45, 0xc3,
+      0xf4, 0x89, 0xf2, 0xef, 0x98, 0xf0, 0xd5, 0xdf, 0xac, 0x05, 0xd3,
+      0xc6, 0x33, 0x39, 0xb1, 0x38, 0x02, 0x88, 0x6d, 0x53, 0xfc, 0x05]),
+
+    // 55188659117513257062467267217118295137698188065244968500265048394206261417927 (order 8)
+    Uint8Array.from([0xc7, 0x17, 0x6a, 0x70, 0x3d, 0x4d, 0xd8, 0x4f, 0xba, 0x3c,
+      0x0b, 0x76, 0x0d, 0x10, 0x67, 0x0f, 0x2a, 0x20, 0x53, 0xfa, 0x2c,
+      0x39, 0xcc, 0xc6, 0x4e, 0xc7, 0xfd, 0x77, 0x92, 0xac, 0x03, 0x7a]),
+
+    // p-1 (order 2)
+    Uint8Array.from([0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f]),
+
+    //  p (=0 order 4)
+    Uint8Array.from([0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f]),
+
+    // p + 1 (=1 order 1)
+    Uint8Array.from([0xee, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f])
+  ]
+
+  var c = new Uint8Array(7)
+  var j
+
+  check(bad_points, 7)
+  for (let i = 0; i < bad_points.length; i++) {
+    for (j = 0; j < 31; j++) {
+      c[i] |= s[j] ^ bad_points[i][j]
+    }
+  }
+
+  for (let i = 0; i < bad_points.length; i++) {
+    c[i] |= (s[j] & 0x7f) ^ bad_points[i][j]
+  }
+
+  var k = 0
+  for (let i = 0; i < bad_points.length; i++) {
+    k |= (c[i] - 1)
+  }
+
+  return ((k >> 8) & 1) === 0
+}
+
+function crypto_sign_ed25519_sk_to_pk (pk, sk) {
+  check(pk, crypto_sign_ed25519_PUBLICKEYBYTES)
+  pk.set(sk.subarray(crypto_sign_ed25519_SEEDBYTES))
+  return pk
+}
+
+function crypto_sign_ed25519_sk_to_curve25519 (curveSk, edSk) {
+  assert(curveSk && curveSk.byteLength === crypto_scalarmult_BYTES, "curveSk must be 'crypto_sign_SECRETKEYBYTES' long")
+  assert(edSk && edSk.byteLength === crypto_sign_ed25519_SECRETKEYBYTES, "edSk must be 'crypto_sign_ed25519_SECRETKEYBYTES' long")
+
+  var h = new Uint8Array(crypto_hash_sha512_BYTES)
+  crypto_hash(h, edSk, 32)
+
+  h[0] &= 248
+  h[31] &= 127
+  h[31] |= 64
+
+  curveSk.set(h.subarray(0, crypto_scalarmult_BYTES))
+  h.fill(0)
+  return curveSk
+}
+
+function check (buf, len, arg = 'Argument') {
+  if (!buf || (len && buf.length < len)) throw new Error(arg + ' must be a buffer' + (len ? ' of length ' + len : ''))
 }

crypto_sign_ed25519.js

@@ -0,0 +1,377 @@
+const { sodium_memzero } = require('./utils')
+const { randombytes_buf } = require('./randombytes')
+const ec = require('./fe25519_25')
+const {
+  crypto_hash_sha512,
+  crypto_hash_sha512_update,
+  crypto_hash_sha512_state,
+  crypto_hash_sha512_final,
+  crypto_hash_sha512_BYTES
+} = require('./crypto_hash.js')
+const { crypto_verify_32 } = require('./crypto_verify')
+const {
+  crypto_scalarmult_base,
+  crypto_scalarmult_curve25519_BYTES
+} = require('./crypto_scalarmult_ed25519')
+
+var crypto_sign_ed25519_BYTES = 64
+var crypto_sign_ed25519_SEEDBYTES = 32
+var crypto_sign_ed25519_PUBLICKEYBYTES = 32
+var crypto_sign_ed25519_SECRETKEYBYTES = 64
+var crypto_sign_ed25519_MESSAGEBYTES_MAX = Number.MAX_SAFE_INTEGER
+
+const crypto_sign_BYTES = crypto_sign_ed25519_BYTES
+const crypto_sign_PUBLICKEYBYTES = crypto_sign_ed25519_PUBLICKEYBYTES
+const crypto_sign_SECRETKEYBYTES = crypto_sign_ed25519_SECRETKEYBYTES
+const crypto_sign_SEEDBYTES = crypto_sign_ed25519_SEEDBYTES
+
+
+function crypto_sign_seed_keypair (pk, sk, seed) {
+  const A = ec.ge25519_p3()
+
+  crypto_hash_sha512(sk, seed, 32)
+  sk[0] &= 248
+  sk[31] &= 127
+  sk[31] |= 64
+
+  ec.ge25519_scalarmult_base(A, sk)
+  ec.ge25519_p3_tobytes(pk, A)
+
+  sk.set(seed)
+  sk.set(pk, 32)
+}
+
+function crypto_sign_keypair (pk, sk) {
+  const seed = Buffer.alloc(32)
+
+  randombytes_buf(seed)
+  crypto_sign_seed_keypair(pk, sk, seed)
+  sodium_memzero(seed)
+}
+
+function crypto_sign_ed25519_pk_to_curve25519 (curve25519_pk, ed25519_pk) {
+  const A = ec.ge25519_p3()
+  const x = ec.fe25519()
+  const one_minus_y = ec.fe25519()
+
+  if (ec.ge25519_has_small_order(ed25519_pk) != 0 ||
+      ec.ge25519_frombytes_negate_vartime(A, ed25519_pk) != 0 ||
+      ec.ge25519_is_on_main_subgroup(A) == 0) {
+      throw new Error('Invalid public key')
+  }
+
+  ec.fe25519_1(one_minus_y)
+  ec.fe25519_sub(one_minus_y, one_minus_y, A[1])
+  ec.fe25519_1(x)
+  ec.fe25519_add(x, x, A[1])
+  ec.fe25519_invert(one_minus_y, one_minus_y)
+  ec.fe25519_mul(x, x, one_minus_y)
+  ec.fe25519_tobytes(curve25519_pk, x)
+}
+
+function crypto_sign_ed25519_sk_to_curve25519 (curve25519_sk, ed25519_sk) {
+    const h = Buffer.alloc(crypto_hash_sha512_BYTES)
+
+    crypto_hash_sha512(h, ed25519_sk, 32)
+    h[0] &= 248
+    h[31] &= 127
+    h[31] |= 64
+    curve25519_sk.set(h.subarray(0, crypto_scalarmult_curve25519_BYTES))
+
+    sodium_memzero(h)
+}
+
+function _crypto_sign_ed25519_ref10_hinit (hs, prehashed) {
+  const DOM2PREFIX = Buffer.from('SigEd25519 no Ed25519 collisions  ')
+  DOM2PREFIX[30] = 1
+  DOM2PREFIX[31] = 0
+
+  if (prehashed) {
+    crypto_hash_sha512_update(hs, DOM2PREFIX, DOM2PREFIX.byteLength)
+  }
+}
+
+function _crypto_sign_ed25519_clamp (k) {
+  k[0] &= 248
+  k[31] &= 127
+  k[31] |= 64
+}
+
+function _crypto_sign_ed25519_detached (sig, m, sk, prehashed) {
+  var state = crypto_hash_sha512_state()
+  var az = Buffer.alloc(64)
+  var nonce = Buffer.alloc(64)
+  var hram = Buffer.alloc(64)
+  var R = ec.ge3()
+
+  _crypto_sign_ed25519_ref10_hinit(state, prehashed)
+
+  crypto_hash_sha512(az, sk, 32)
+  crypto_hash_sha512_update(state, az.subarray(32), 32)
+  crypto_hash_sha512_update(state, m)
+  crypto_hash_sha512_final(state, nonce)
+
+  sig.set(sk.subarray(32, 64), 32)
+
+  ec.sc25519_reduce(nonce)
+  ec.ge25519_scalarmult_base(R, nonce)
+  ec.ge25519_p3_tobytes(sig, R)
+
+  state = crypto_hash_sha512_state()
+  _crypto_sign_ed25519_ref10_hinit(state, prehashed)
+  crypto_hash_sha512_update(state, sig, 64)
+  crypto_hash_sha512_update(state, m)
+  crypto_hash_sha512_final(state, hram)
+
+  ec.sc25519_reduce(hram)
+  _crypto_sign_ed25519_clamp(az)
+  ec.sc25519_muladd(sig.subarray(32), hram, az, nonce)
+
+  sodium_memzero(az)
+  sodium_memzero(nonce)
+
+  return 0
+}
+
+function crypto_sign_ed25519_detached (sig, m, sk) {
+  return _crypto_sign_ed25519_detached(sig, m, sk, 0)
+}
+
+function crypto_sign_detached (sig, m, sk) {
+  return _crypto_sign_ed25519_detached(sig, m, sk, 0)
+}
+
+function crypto_sign_ed25519 (sm, m, sk) {
+  sm.set(m, crypto_sign_ed25519_BYTES)
+
+  /* LCOV_EXCL_START */
+  if (crypto_sign_detached(sm, sm.subarray(crypto_sign_ed25519_BYTES), sk) !== 0) {
+    sm.fill(0, m.byteLength + crypto_sign_ed25519_BYTES)
+    return -1
+  }
+  /* LCOV_EXCL_STOP */
+  return m.byteLength + 64
+}
+
+function crypto_sign (sm, m, sk) {
+  return crypto_sign_ed25519(sm, m, sk)
+}
+
+function _crypto_sign_ed25519_verify_detached(sig, m, pk, prehashed) {
+  var hs = crypto_hash_sha512_state()
+  var h = Buffer.alloc(64)
+  var rcheck = Buffer.alloc(32)
+  var A = ec.ge3()
+  var R = ec.ge2()
+
+  if ((sig[63] & 240) &&
+      ec.sc25519_is_canonical(sig + 32) == 0) {
+    return false
+  }
+  if (ec.ge25519_has_small_order(sig.subarray(0, 32)) != 0) {
+    return false
+  }
+  if (ec.ge25519_is_canonical(pk) == 0 ||
+      ec.ge25519_has_small_order(pk) != 0) {
+    return false
+  }
+
+  if (ec.ge25519_frombytes_negate_vartime(A, pk) !== 0) {
+  }
+  ec.ge25519_tobytes(rcheck, A)
+
+  _crypto_sign_ed25519_ref10_hinit(hs, prehashed)
+  crypto_hash_sha512_update(hs, sig, 32)
+  crypto_hash_sha512_update(hs, pk, 32)
+  crypto_hash_sha512_update(hs, m)
+  crypto_hash_sha512_final(hs, h)
+  ec.sc25519_reduce(h)
+
+  ec.ge25519_double_scalarmult_vartime(R, h, A, sig.subarray(32))
+  ec.ge25519_tobytes(rcheck, R)
+
+  return crypto_verify_32(rcheck, 0, sig, 0)
+}
+
+function crypto_sign_ed25519_verify_detached (sig, m, pk) {
+  return _crypto_sign_ed25519_verify_detached(sig, m, pk, 0);
+}
+
+function crypto_sign_ed25519_open (m, sm, pk) {
+  if (sm.byteLength < 64 || sm.byteLength - 64 > crypto_sign_ed25519_MESSAGEBYTES_MAX) {
+    return false
+  }
+
+  if (!crypto_sign_ed25519_verify_detached(sm, sm.subarray(64), pk)) {
+    if (m.byteLength) m.fill(0)
+    return false
+  }
+
+  if (m.byteLength) {
+    m.set(sm.subarray(64))
+  }
+
+  return true
+}
+
+function crypto_sign_ed25519_sk_to_pk (pk, sk) {
+  pk.set(sk.subarray(crypto_sign_ed25519_SEEDBYTES))
+}
+
+function crypto_sign_open (m, sm, pk) {
+  return crypto_sign_ed25519_open(m, sm, pk)
+}
+
+function crypto_sign_verify_detached (m, sm, pk) {
+  return crypto_sign_ed25519_verify_detached(m, sm, pk)
+}
+
+function _crypto_sign_ristretto25519_detached (sig, m, sk, prehashed) {
+  var state = crypto_hash_sha512_state()
+  var az = Buffer.alloc(64)
+  var nonce = Buffer.alloc(64)
+  var hram = Buffer.alloc(64)
+  var R = ec.ge3()
+
+  _crypto_sign_ed25519_ref10_hinit(state, prehashed)
+
+  crypto_hash_sha512(az, sk, 32)
+  crypto_hash_sha512_update(state, az.subarray(32), 32)
+  crypto_hash_sha512_update(state, m)
+  crypto_hash_sha512_final(state, nonce)
+
+  sig.set(sk.subarray(32, 64), 32)
+
+  ec.sc25519_reduce(nonce)
+  ec.ge25519_scalarmult_base(R, nonce)
+  ec.ristretto255_p3_tobytes(sig, R)
+
+  state = crypto_hash_sha512_state()
+  _crypto_sign_ed25519_ref10_hinit(state, prehashed)
+  crypto_hash_sha512_update(state, sig, 64)
+  crypto_hash_sha512_update(state, m)
+  crypto_hash_sha512_final(state, hram)
+
+  ec.sc25519_reduce(hram)
+  az[31] &= 127
+  // az[0] &= 248
+  // az[0] |= 1
+  // console.log(az[31] & 128)
+  // console.log(nonce[31] & 128)
+  // console.log(hram[31] & 128)
+  ec.sc25519_muladd(sig.subarray(32), hram, az, nonce)
+
+  sodium_memzero(az)
+  sodium_memzero(nonce)
+
+  return 0
+
+  var rcheck = Buffer.alloc(32)
+  var A = ec.ge3()
+  var _A = ec.ge3()
+  var h = Buffer.alloc(64)
+  var hs = crypto_hash_sha512_state()
+  var pk = sk.subarray(32).slice()
+  // pk[31] &= 127
+  ec.ristretto255_frombytes(A, pk, true)
+  ec.ge25519_scalarmult_base(_A, az)
+  ec.ge25519_p3_add(_A, _A, A)
+  ec.ge25519_p3_tobytes(rcheck, _A)
+  // console.log(rcheck.toString('hex'))
+
+  _crypto_sign_ed25519_ref10_hinit(hs, prehashed)
+  crypto_hash_sha512_update(hs, sig, 32)
+  crypto_hash_sha512_update(hs, pk, 32)
+  crypto_hash_sha512_update(hs, m)
+  crypto_hash_sha512_final(hs, h)
+  ec.sc25519_reduce(h)
+
+  ec.ge25519_double_scalarmult_vartime(R, h, A, sig.subarray(32))
+  ec.ristretto255_p3_tobytes(rcheck, R)
+
+}
+
+function _crypto_sign_ristretto25519_verify_detached(sig, m, pk, prehashed) {
+  var hs = crypto_hash_sha512_state()
+  var h = Buffer.alloc(64)
+  var rcheck = Buffer.alloc(32)
+  var A = ec.ge3()
+  var R = ec.ge3()
+
+  // #ifdef ED25519_COMPAT
+  // if (sig[63] & 224) {
+  //   return -1
+  // }
+  // #else
+  if ((sig[63] & 240) &&
+      ec.sc25519_is_canonical(sig + 32) == 0) {
+    return false
+  }
+  if (ec.ge25519_has_small_order(sig) != 0) {
+    return false
+  }
+  if (ec.ge25519_is_canonical(pk) == 0 ||
+      ec.ge25519_has_small_order(pk) != 0) {
+    return false
+  }
+  // #endif
+  if (ec.ristretto255_frombytes(A, pk, true) !== 0) {
+    return false
+  }
+
+  _crypto_sign_ed25519_ref10_hinit(hs, prehashed)
+  crypto_hash_sha512_update(hs, sig, 32)
+  crypto_hash_sha512_update(hs, pk, 32)
+  crypto_hash_sha512_update(hs, m)
+  crypto_hash_sha512_final(hs, h)
+  ec.sc25519_reduce(h)
+
+  ec.ge25519_double_scalarmult_vartime(R, h, A, sig.subarray(32))
+  ec.ristretto255_p3_tobytes(rcheck, R)
+
+  return crypto_verify_32(rcheck, 0, sig, 0)// | sodium_memcmp(sig.subarray(0, 32), rcheck.subarray(0, 32))
+}
+
+function crypto_sign_ristretto25519_detached (sig, m, sk) {
+  return _crypto_sign_ristretto25519_detached(sig, m, sk)
+}
+
+function crypto_sign_ristretto25519_verify_detached (sig, m, pk) {
+  return _crypto_sign_ristretto25519_verify_detached(sig, m, pk, 0)
+}
+
+function crypto_sign_ristretto25519 (sm, m, sk) {
+  var siglen
+
+  sm.set(m.subarray(0, mlen), crypto_sign_ristretto25519_BYTES)
+
+  /* LCOV_EXCL_START */
+  if (crypto_sign_ristretto25519_detached(sm, sm.subarray(crypto_sign_ristretto25519_BYTES), mlen, sk) !== 0) {
+    sm.fill(0, mlen + crypto_sign_ristretto25519_BYTES)
+    return -1
+  }
+  /* LCOV_EXCL_STOP */
+  return m.byteLength + 64
+}
+
+module.exports = {
+  crypto_sign_keypair,
+  crypto_sign_seed_keypair,
+  crypto_sign_ed25519_pk_to_curve25519,
+  crypto_sign_ed25519_sk_to_curve25519,
+  crypto_sign_ed25519_sk_to_pk,
+  crypto_sign,
+  crypto_sign_open,
+  crypto_sign_ed25519_detached,
+  crypto_sign_detached,
+  crypto_sign_ristretto25519_detached,
+  crypto_sign_ristretto25519_verify_detached,
+  crypto_sign_verify_detached,
+  crypto_sign_BYTES,
+  crypto_sign_PUBLICKEYBYTES,
+  crypto_sign_SECRETKEYBYTES,
+  crypto_sign_SEEDBYTES,
+  crypto_sign_ed25519_PUBLICKEYBYTES,
+  crypto_sign_ed25519_SECRETKEYBYTES,
+  crypto_sign_ed25519_SEEDBYTES
+}

crypto_stream.js

@@ -3,9 +3,12 @@ const xsalsa20 = require('xsalsa20')
 
 if (new Uint16Array([1])[0] !== 1) throw new Error('Big endian architecture is not supported.')
 
+if (new Uint16Array([1])[0] !== 1) throw new Error('Big endian architecture is not supported.')
+
 exports.crypto_stream_KEYBYTES = 32
 exports.crypto_stream_NONCEBYTES = 24
 exports.crypto_stream_PRIMITIVE = 'xsalsa20'
+exports.crypto_stream_xsalsa20_MESSAGEBYTES_MAX = Number.MAX_SAFE_INTEGER
 
 exports.crypto_stream = function (c, nonce, key) {
   c.fill(0)

crypto_tweak.js

@@ -0,0 +1,216 @@
+const b4a = require('b4a')
+
+const {
+  crypto_scalarmult_ed25519,
+  crypto_scalarmult_ed25519_noclamp,
+  crypto_scalarmult_ed25519_base,
+  crypto_scalarmult_ed25519_base_noclamp,
+  crypto_scalarmult_ed25519_SCALARBYTES
+} = require('./crypto_scalarmult_ed25519')
+
+const {
+  crypto_sign_keypair_seed,
+  crypto_sign_ed25519_PUBLICKEYBYTES
+} = require('./crypto_sign_ed25519')
+
+const {
+  crypto_hash_sha512_state,
+  crypto_hash_sha512_update,
+  crypto_hash_sha512_final,
+  crypto_hash
+} = require('./crypto_hash')
+
+const {
+  crypto_core_ed25519_is_valid_point,
+  crypto_core_ed25519_scalar_reduce,
+  crypto_core_ed25519_scalar_add,
+  crypto_core_ed25519_scalar_mul,
+  crypto_core_ed25519_add
+} = require('./crypto_core')
+
+const { curve25519_h: COFACTOR } = require('./fe25519_25')
+
+const { sodium_memzero } = require('./utils')
+
+/*
+  *EXPERIMENTAL API*
+
+  This module is an experimental implementation of a key tweaking protocol
+  over ed25519 keys. The signature algorithm has been reimplemented from
+  libsodium, but the nonce generation algorithm is *non-standard*.
+
+  Use at your own risk
+*/
+
+const crypto_tweak_ed25519_BYTES = crypto_sign_ed25519_PUBLICKEYBYTES
+const crypto_tweak_ed25519_SCALARBYTES = crypto_scalarmult_ed25519_SCALARBYTES
+
+function _crypto_tweak_nonce (nonce, n, m, mlen) {
+  // dom2(x, y) with x = 0 (not prehashed) and y = "crypto_tweak_ed25519"
+  const prefix = b4a.alloc(54)
+
+  prefix.write('SigEd25519 no Ed25519 collisions\x00\x14crypto_tweak_ed25519')
+
+  const hs = crypto_hash_sha512_state()
+
+  crypto_hash_sha512_update(hs, prefix)
+  crypto_hash_sha512_update(hs, n, 32)
+  crypto_hash_sha512_update(hs, m, m.byteLength)
+  crypto_hash_sha512_final(hs, nonce)
+}
+
+function _crypto_sign_ed25519_clamp (k) {
+  k[0] &= 248
+  k[31] &= 127
+  k[31] |= 64
+}
+
+function _crypto_tweak_ed25519(q, n, ns) {
+  sodium_memzero(q)
+
+  crypto_hash(n, ns)
+  n[31] &= 127 // clear highest bit
+
+  crypto_scalarmult_ed25519_base_noclamp(q, n)
+
+  // hash tweak until we get a valid tweaked q
+  while (crypto_core_ed25519_is_valid_point(q) != 1) {
+    crypto_hash(n, n, 32)
+    n[31] &= 127 // clear highest bit
+
+    crypto_scalarmult_ed25519_base_noclamp(q, n)
+  }
+}
+
+function crypto_tweak_ed25519_base (n, q, ns) {
+  sodium_memzero(q)
+
+  const n64 = b4a.alloc(64)
+  _crypto_tweak_ed25519(q, n64, ns)
+
+  n.set(n64.subarray(0, 32))
+}
+
+// TODO: check pk is correct if we pass it
+function crypto_tweak_ed25519_sign_detached (sig, m, n, pk = null) {
+  const hs = crypto_hash_sha512_state()
+
+  const nonce = b4a.alloc(64)
+  const R = b4a.alloc(32)
+  const hram = b4a.alloc(64)
+  const _pk = b4a.alloc(32)
+
+  // check if pk was passed
+  if (pk === null) {
+    pk = _pk
+
+    // derive pk from scalar
+    crypto_scalarmult_ed25519_base_noclamp(pk, n)
+  }
+
+  _crypto_tweak_nonce(nonce, n, m)
+  crypto_core_ed25519_scalar_reduce(nonce, nonce)
+
+  // R = G ^ nonce : curve point from nonce
+  crypto_scalarmult_ed25519_base_noclamp(R, nonce)
+
+  // generate challenge as h(ram) = hash(R, pk, message)
+  crypto_hash_sha512_update(hs, R, 32)
+  crypto_hash_sha512_update(hs, pk, 32)
+  crypto_hash_sha512_update(hs, m, m.byteLength)
+
+  crypto_hash_sha512_final(hs, hram)
+
+  crypto_core_ed25519_scalar_reduce(hram, hram)
+
+  // sig = nonce + n * h(ram)
+  crypto_core_ed25519_scalar_mul(sig.subarray(0, 32), hram.subarray(0, 32), n)
+  crypto_core_ed25519_scalar_add(sig.subarray(32, 64), nonce.subarray(0, 32), sig)
+
+  sig.set(R)
+
+  return 0
+}
+
+// get scalar from secret key
+function crypto_tweak_ed25519_sk_to_scalar (n, sk) {
+  const n64 = b4a.alloc(64)
+
+  // get sk scalar from seed, cf. crypto_sign_keypair_seed
+  crypto_hash(n64, sk, 32)
+  _crypto_sign_ed25519_clamp(n64)
+
+  n.set(n64.subarray(0, 32))
+}
+
+// tweak a secret key
+function crypto_tweak_ed25519_scalar (scalar_out, scalar, ns) {
+  const q = b4a.alloc(32)
+  const n = b4a.alloc(64)
+
+  const n32 = n.subarray(0, 32)
+
+  _crypto_tweak_ed25519(q, n, ns)
+  crypto_tweak_ed25519_scalar_add(scalar_out, n32, scalar)
+}
+
+// tweak a public key
+function crypto_tweak_ed25519_pk (tpk, pk, ns) {
+  const n = b4a.alloc(64)
+  const q = b4a.alloc(32)
+
+  _crypto_tweak_ed25519(q, n, ns)
+  return crypto_core_ed25519_add(tpk, q, pk)
+}
+
+function crypto_tweak_ed25519_keypair (pk, scalar_out, scalar, ns) {
+  const n64 = b4a.alloc(64)
+
+  crypto_hash(n64, ns)
+  n64[31] &= 127 // clear highest bit
+
+  crypto_tweak_ed25519_scalar_add(scalar_out, scalar, n64)
+  crypto_scalarmult_ed25519_base_noclamp(pk, scalar_out)
+
+  // hash tweak until we get a valid tweaked point
+  while (crypto_core_ed25519_is_valid_point(pk) != 1) {
+    crypto_hash(n64, n64, 32)
+    n64[31] &= 127 // clear highest bit
+
+    crypto_tweak_ed25519_scalar_add(scalar_out, scalar, n64)
+    crypto_scalarmult_ed25519_base_noclamp(pk, scalar_out)
+  }
+}
+
+// add tweak to scalar
+function crypto_tweak_ed25519_scalar_add (scalar_out, scalar, n) {
+  crypto_core_ed25519_scalar_add(scalar_out, scalar, n)
+}
+
+// add tweak point to public key
+function crypto_tweak_ed25519_pk_add (tpk, pk, q) {
+  crypto_core_ed25519_add(tpk, pk, q)
+}
+
+// add tweak to scalar
+function crypto_tweak_ed25519_scalar_mul (scalar_out, scalar, n) {
+  crypto_core_ed25519_scalar_mul(scalar_out, scalar, n)
+}
+
+// add tweak point to public key
+function crypto_tweak_ed25519_publickey_mul (tpk, pk, n) {
+  crypto_scalarmult_ed25519_noclamp(tpk, n, pk)
+}
+
+module.exports = {
+  crypto_tweak_ed25519_base,
+  crypto_tweak_ed25519_sign_detached,
+  crypto_tweak_ed25519_sk_to_scalar,
+  crypto_tweak_ed25519_scalar,
+  crypto_tweak_ed25519_pk,
+  crypto_tweak_ed25519_keypair,
+  crypto_tweak_ed25519_scalar_add,
+  crypto_tweak_ed25519_pk_add,
+  crypto_tweak_ed25519_BYTES,
+  crypto_tweak_ed25519_SCALARBYTES
+}

ed-wasm.js

@@ -0,0 +1,236 @@
+const sodium = require('./')
+const native = require('sodium-native')
+const { crypto_scalarmult_ed25519, crypto_scalarmult_ed25519_base, crypto_scalarmult_curve25519, crypto_scalarmult_curve25519_1, crypto_scalarmult_curve25519_base } = require('./crypto_scalarmult_ed25519')
+const { crypto_sign, crypto_sign_open, crypto_sign_verify_detached } = require('./crypto_sign_ed25519')
+const sign = require('./crypto_sign')
+const ed = require('./ed25519')
+const ec = require('./fe25519_25')
+const { crypto_tweak_ed25519 } = require('./crypto_tweak')
+
+console.log(crypto_scalarmult_ed25519)
+let sm = Buffer.alloc(1024 + sodium.crypto_sign_BYTES)
+let sm1 = Buffer.alloc(1024 + sodium.crypto_sign_BYTES)
+let skpk = Buffer.alloc(sodium.crypto_sign_SECRETKEYBYTES)
+let pk = Buffer.alloc(sodium.crypto_sign_PUBLICKEYBYTES)
+let sk = Buffer.alloc(sodium.crypto_sign_SECRETKEYBYTES)
+let smlen
+let smlen1
+let i
+let test
+
+// sig.fill(0)
+
+var an = Buffer.from([
+  0x77, 0x07, 0x6d, 0x0a, 0x73, 0x18, 0xa5, 0x7d, 0x3c, 0x16, 0xc1,
+  0x72, 0x51, 0xb2, 0x66, 0x45, 0xdf, 0x4c, 0x2f, 0x87, 0xeb, 0xc0,
+  0x99, 0x2a, 0xb1, 0x77, 0xfb, 0xa5, 0x1d, 0xb9, 0x2c, 0x2a
+])
+
+var bn = Buffer.from([
+  0x5d, 0xab, 0x08, 0x7e, 0x62, 0x4a, 0x8a, 0x4b, 0x79, 0xe1, 0x7f,
+  0x8b, 0x83, 0x80, 0x0e, 0xe6, 0x6f, 0x3b, 0xb1, 0x29, 0x26, 0x18,
+  0xb6, 0xfd, 0x1c, 0x2f, 0x8b, 0x27, 0xff, 0x88, 0xe0, 0xeb
+])
+
+var bobpk = Buffer.from('de9edb7d7b7dc1b4d35b61c2ece435373f8343c85b78674dadfc7e146f882b4f', 'hex')
+
+var cn = Buffer.from([
+  190,  24, 150, 125,  14, 254,  19,  44,
+   55, 112, 156,   5, 141, 230,  91,  84,
+  110, 130, 213,  39, 249, 107, 145, 140,
+  226,  38,  16,  80, 186, 183, 134, 239
+])
+
+const res = Buffer.alloc(32)
+
+var fixtures = require('./crypto_sign.json').map(a => parseTest(a))
+var pass = true
+
+// test = parseTest(fixture)
+
+// console.time('hello')
+// for (let test of fixtures) {
+//   skpk.set(test.sk)
+//   skpk.set(test.pk, sodium.crypto_sign_SEEDBYTES)
+//   smlen = sodium.crypto_sign(sm, test.m, skpk)
+//   sodium.crypto_sign_open(test.m, sm.subarray(0, smlen), test.pk)
+// }
+// console.timeEnd('hello')
+
+// console.time('ed')
+// for (let test of fixtures) {
+//   skpk.set(test.sk)
+//   skpk.set(test.pk, sodium.crypto_sign_SEEDBYTES)
+//   smlen = crypto_sign(sm, test.m, skpk)
+//   crypto_sign_open(test.m, sm.subarray(0, smlen), test.pk)
+// }
+// console.timeEnd('ed')
+
+// for (let i = 0; i < fixtures.length; i++) {
+//   let pass = true
+
+//   sm.fill(0)
+//   sm1.fill(0)
+//   test = fixtures[i]
+//   skpk.set(test.sk)
+//   skpk.set(test.pk, sodium.crypto_sign_SEEDBYTES)
+//   smlen = sodium.crypto_sign(sm, test.m, skpk)
+//   smlen1 = crypto_sign(sm1, test.m, skpk)
+
+//   pass &= sodium.crypto_sign_open(test.m, sm1.subarray(0, smlen1), test.pk)
+//   pass &= crypto_sign_open(test.m, sm.subarray(0, smlen), test.pk)
+
+//   if (Buffer.compare(sm, sm1) !== 0 || !pass) console.log('test fails at fixture #' + i)
+// }
+
+// //////////////////////////////
+// sodium.crypto_scalarmult(res, an, bn)
+// console.log(res.toString('hex'))
+
+function main () {
+  const b = 3;
+  const pos = 21;
+  const p = ec.ge2();
+  const res = Buffer.alloc(32)
+  // static char     hex[32];
+
+  // printf("hello\n");
+  ec.ge25519_cmov8_base(p, pos, b);
+  // printf("hello\n");
+  ec.ge25519_tobytes(res, p);
+
+  console.log(res.toString('hex'))
+}
+console.log('====================')
+main()
+console.log('====================')
+
+/////////////////////////////////////////
+
+res.fill(0)
+crypto_scalarmult_curve25519(res, an, bobpk)
+console.log(res.toString('hex'))
+
+// console.time('whole')
+crypto_scalarmult_curve25519_1(res, an, bobpk)
+// console.timeEnd('whole')
+console.log('scmult wasm', res.toString('hex'))
+
+native.crypto_scalarmult(res, an, bobpk)
+console.log('scmult nati', res.toString('hex'))
+
+sodium.crypto_scalarmult(res, an, bobpk)
+console.log('scmult js  ', res.toString('hex'))
+
+sodium.crypto_scalarmult_base(res, an)
+console.log('scmultb js', res.toString('hex'))
+
+// const basepoint = Buffer.alloc(32)
+// res.fill(0)
+// native.crypto_scalarmult_base(basepoint, res)
+// console.log('---------------', basepoint.toString('hex'))
+
+native.crypto_scalarmult_base(res, an)
+console.log('scmultb nat', res.toString('hex'))
+
+// res.fill(0)
+// const p = ec.ge3()
+// ec.ge25519_scalarmult_base(p, an)
+// ec.ge25519_tobytes(res, p)
+crypto_scalarmult_curve25519_base(res, an)
+console.log('scmultb was', res.toString('hex'))
+
+native.crypto_scalarmult(res, fixtures[1].sk, fixtures[1].pk)
+console.log(res.toString('hex'))
+
+crypto_scalarmult_curve25519(res, fixtures[1].sk, fixtures[1].pk)
+console.log('wasm naive', res.toString('hex'))
+
+crypto_scalarmult_curve25519_1(res, fixtures[1].sk, fixtures[1].pk)
+console.log('wasm inner loop', res.toString('hex'))
+
+native.crypto_scalarmult(res, fixtures[1].sk, fixtures[1].pk)
+console.log('native', res.toString('hex'))
+
+crypto_scalarmult_ed25519(res, fixtures[1].sk, fixtures[1].pk)
+console.log(res.toString('hex'))
+
+const tweak = Buffer.alloc(32)
+const ns = Buffer.alloc(32)
+
+native.crypto_generichash(ns, Buffer.from('namespace'))
+crypto_tweak_ed25519(tweak, fixtures[1].pk, ns)
+console.log('js', tweak.toString('hex'))
+
+native.experimental_crypto_tweak_ed25519(tweak, fixtures[1].pk, ns)
+console.log('native', tweak.toString('hex'))
+
+// const a = Buffer.alloc(32)
+// a[i] = 9
+// crypto_scalarmult_curve25519_base(res, an)
+// console.log(res.toString('hex'))
+
+
+// console.time('hello')
+// for (let test of fixtures) {
+//   sodium.crypto_scalarmult(res, test.sk, test.pk)
+// }
+// console.timeEnd('hello')
+// console.log(res.toString('hex'))
+
+// const res1 = Buffer.from(res)
+// console.time('ed')
+// for (let test of fixtures) {
+//   crypto_scalarmult_curve25519(res, test.sk, test.pk)
+// }
+// console.timeEnd('ed')
+
+// console.time('wasm')
+// for (let test of fixtures) {
+//   crypto_scalarmult_curve25519_1(res1, test.sk, test.pk)
+// }
+// console.timeEnd('wasm')
+
+// console.time('native')
+// for (let test of fixtures) {
+//   native.crypto_scalarmult(res1, test.sk, test.pk)
+// }
+// console.timeEnd('native')
+// console.log(res.toString('hex'))
+// console.log(res1.toString('hex'))
+
+/////////////////////////////////////////
+
+// console.log(sm.toString('hex'))
+
+native.crypto_sign_keypair(pk, sk)
+
+let sig = Buffer.alloc(sodium.crypto_sign_BYTES + 32)
+const m = Buffer.alloc(32)
+const m2 = Buffer.alloc(32)
+for (let i = 0; i < 32; i++) m[i] = i
+
+crypto_sign(sig, m, sk)
+// pass &= smlen === sodium.crypto_sign_BYTES + test.m.byteLength
+// pass &= Buffer.compare(test.sig, sm.subarray(0, 64)) === 0
+// pass &= sodium.crypto_sign_open(test.m, sm.subarray(0, smlen), test.pk)
+console.log('sig', sig.toString('hex'))
+
+console.log(sodium.crypto_sign_open(m2, sig, pk))
+console.log(crypto_sign_open(m2, sig, pk))
+console.log(m2.toString('hex'))
+
+// // pass &= sig.byteLength !== 0 && sig.byteLength <= sodium.crypto_sign_BYTES
+// // pass &= Buffer.compare(test.sig, sig) === 0
+// pass &= sodium.crypto_sign_verify_detached(sig, test.m.subarray(0, i), test.pk)
+
+function parseTest (t) {
+  return {
+    sk: Buffer.from(t[0]),
+    pk: Buffer.from(t[1]),
+    sig: Buffer.from(t[2]),
+    m: Buffer.from(t[3])
+  }
+}
+
+// 92a009a9f0d4cab8720e820b5f642540a2b27b5416503f8fb3762223ebdb69da085ac1e43e15996e458f3613d0f11d8c387b2eaeb4302aeeb00d291612bb0c00720

ed25519.js

@@ -0,0 +1,483 @@
+if (new Uint16Array([1])[0] !== 1) throw new Error('Big endian architecture is not supported.')
+
+var gf = function(init) {
+  var i, r = new Float64Array(16);
+  if (init) for (i = 0; i < init.length; i++) r[i] = init[i];
+  return r;
+}
+
+var _0 = new Uint8Array(16);
+var _9 = new Uint8Array(32); _9[0] = 9;
+
+var gf0 = gf(),
+    gf1 = gf([1]),
+    _121665 = gf([0xdb41, 1]),
+    D = gf([0x78a3, 0x1359, 0x4dca, 0x75eb, 0xd8ab, 0x4141, 0x0a4d, 0x0070, 0xe898, 0x7779, 0x4079, 0x8cc7, 0xfe73, 0x2b6f, 0x6cee, 0x5203]),
+    D2 = gf([0xf159, 0x26b2, 0x9b94, 0xebd6, 0xb156, 0x8283, 0x149a, 0x00e0, 0xd130, 0xeef3, 0x80f2, 0x198e, 0xfce7, 0x56df, 0xd9dc, 0x2406]),
+    X = gf([0xd51a, 0x8f25, 0x2d60, 0xc956, 0xa7b2, 0x9525, 0xc760, 0x692c, 0xdc5c, 0xfdd6, 0xe231, 0xc0a4, 0x53fe, 0xcd6e, 0x36d3, 0x2169]),
+    Y = gf([0x6658, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666]),
+    I = gf([0xa0b0, 0x4a0e, 0x1b27, 0xc4ee, 0xe478, 0xad2f, 0x1806, 0x2f43, 0xd7a7, 0x3dfb, 0x0099, 0x2b4d, 0xdf0b, 0x4fc1, 0x2480, 0x2b83]);
+
+function A(o, a, b) {
+  for (var i = 0; i < 16; i++) o[i] = a[i] + b[i];
+}
+
+function Z(o, a, b) {
+  for (var i = 0; i < 16; i++) o[i] = a[i] - b[i];
+}
+
+function M(o, a, b) {
+  var v, c,
+    t0 = 0,  t1 = 0,  t2 = 0,  t3 = 0,  t4 = 0,  t5 = 0,  t6 = 0,  t7 = 0,
+    t8 = 0,  t9 = 0, t10 = 0, t11 = 0, t12 = 0, t13 = 0, t14 = 0, t15 = 0,
+    t16 = 0, t17 = 0, t18 = 0, t19 = 0, t20 = 0, t21 = 0, t22 = 0, t23 = 0,
+    t24 = 0, t25 = 0, t26 = 0, t27 = 0, t28 = 0, t29 = 0, t30 = 0,
+    b0 = b[0],
+    b1 = b[1],
+    b2 = b[2],
+    b3 = b[3],
+    b4 = b[4],
+    b5 = b[5],
+    b6 = b[6],
+    b7 = b[7],
+    b8 = b[8],
+    b9 = b[9],
+    b10 = b[10],
+    b11 = b[11],
+    b12 = b[12],
+    b13 = b[13],
+    b14 = b[14],
+    b15 = b[15];
+
+  v = a[0];
+  t0 += v * b0;
+  t1 += v * b1;
+  t2 += v * b2;
+  t3 += v * b3;
+  t4 += v * b4;
+  t5 += v * b5;
+  t6 += v * b6;
+  t7 += v * b7;
+  t8 += v * b8;
+  t9 += v * b9;
+  t10 += v * b10;
+  t11 += v * b11;
+  t12 += v * b12;
+  t13 += v * b13;
+  t14 += v * b14;
+  t15 += v * b15;
+  v = a[1];
+  t1 += v * b0;
+  t2 += v * b1;
+  t3 += v * b2;
+  t4 += v * b3;
+  t5 += v * b4;
+  t6 += v * b5;
+  t7 += v * b6;
+  t8 += v * b7;
+  t9 += v * b8;
+  t10 += v * b9;
+  t11 += v * b10;
+  t12 += v * b11;
+  t13 += v * b12;
+  t14 += v * b13;
+  t15 += v * b14;
+  t16 += v * b15;
+  v = a[2];
+  t2 += v * b0;
+  t3 += v * b1;
+  t4 += v * b2;
+  t5 += v * b3;
+  t6 += v * b4;
+  t7 += v * b5;
+  t8 += v * b6;
+  t9 += v * b7;
+  t10 += v * b8;
+  t11 += v * b9;
+  t12 += v * b10;
+  t13 += v * b11;
+  t14 += v * b12;
+  t15 += v * b13;
+  t16 += v * b14;
+  t17 += v * b15;
+  v = a[3];
+  t3 += v * b0;
+  t4 += v * b1;
+  t5 += v * b2;
+  t6 += v * b3;
+  t7 += v * b4;
+  t8 += v * b5;
+  t9 += v * b6;
+  t10 += v * b7;
+  t11 += v * b8;
+  t12 += v * b9;
+  t13 += v * b10;
+  t14 += v * b11;
+  t15 += v * b12;
+  t16 += v * b13;
+  t17 += v * b14;
+  t18 += v * b15;
+  v = a[4];
+  t4 += v * b0;
+  t5 += v * b1;
+  t6 += v * b2;
+  t7 += v * b3;
+  t8 += v * b4;
+  t9 += v * b5;
+  t10 += v * b6;
+  t11 += v * b7;
+  t12 += v * b8;
+  t13 += v * b9;
+  t14 += v * b10;
+  t15 += v * b11;
+  t16 += v * b12;
+  t17 += v * b13;
+  t18 += v * b14;
+  t19 += v * b15;
+  v = a[5];
+  t5 += v * b0;
+  t6 += v * b1;
+  t7 += v * b2;
+  t8 += v * b3;
+  t9 += v * b4;
+  t10 += v * b5;
+  t11 += v * b6;
+  t12 += v * b7;
+  t13 += v * b8;
+  t14 += v * b9;
+  t15 += v * b10;
+  t16 += v * b11;
+  t17 += v * b12;
+  t18 += v * b13;
+  t19 += v * b14;
+  t20 += v * b15;
+  v = a[6];
+  t6 += v * b0;
+  t7 += v * b1;
+  t8 += v * b2;
+  t9 += v * b3;
+  t10 += v * b4;
+  t11 += v * b5;
+  t12 += v * b6;
+  t13 += v * b7;
+  t14 += v * b8;
+  t15 += v * b9;
+  t16 += v * b10;
+  t17 += v * b11;
+  t18 += v * b12;
+  t19 += v * b13;
+  t20 += v * b14;
+  t21 += v * b15;
+  v = a[7];
+  t7 += v * b0;
+  t8 += v * b1;
+  t9 += v * b2;
+  t10 += v * b3;
+  t11 += v * b4;
+  t12 += v * b5;
+  t13 += v * b6;
+  t14 += v * b7;
+  t15 += v * b8;
+  t16 += v * b9;
+  t17 += v * b10;
+  t18 += v * b11;
+  t19 += v * b12;
+  t20 += v * b13;
+  t21 += v * b14;
+  t22 += v * b15;
+  v = a[8];
+  t8 += v * b0;
+  t9 += v * b1;
+  t10 += v * b2;
+  t11 += v * b3;
+  t12 += v * b4;
+  t13 += v * b5;
+  t14 += v * b6;
+  t15 += v * b7;
+  t16 += v * b8;
+  t17 += v * b9;
+  t18 += v * b10;
+  t19 += v * b11;
+  t20 += v * b12;
+  t21 += v * b13;
+  t22 += v * b14;
+  t23 += v * b15;
+  v = a[9];
+  t9 += v * b0;
+  t10 += v * b1;
+  t11 += v * b2;
+  t12 += v * b3;
+  t13 += v * b4;
+  t14 += v * b5;
+  t15 += v * b6;
+  t16 += v * b7;
+  t17 += v * b8;
+  t18 += v * b9;
+  t19 += v * b10;
+  t20 += v * b11;
+  t21 += v * b12;
+  t22 += v * b13;
+  t23 += v * b14;
+  t24 += v * b15;
+  v = a[10];
+  t10 += v * b0;
+  t11 += v * b1;
+  t12 += v * b2;
+  t13 += v * b3;
+  t14 += v * b4;
+  t15 += v * b5;
+  t16 += v * b6;
+  t17 += v * b7;
+  t18 += v * b8;
+  t19 += v * b9;
+  t20 += v * b10;
+  t21 += v * b11;
+  t22 += v * b12;
+  t23 += v * b13;
+  t24 += v * b14;
+  t25 += v * b15;
+  v = a[11];
+  t11 += v * b0;
+  t12 += v * b1;
+  t13 += v * b2;
+  t14 += v * b3;
+  t15 += v * b4;
+  t16 += v * b5;
+  t17 += v * b6;
+  t18 += v * b7;
+  t19 += v * b8;
+  t20 += v * b9;
+  t21 += v * b10;
+  t22 += v * b11;
+  t23 += v * b12;
+  t24 += v * b13;
+  t25 += v * b14;
+  t26 += v * b15;
+  v = a[12];
+  t12 += v * b0;
+  t13 += v * b1;
+  t14 += v * b2;
+  t15 += v * b3;
+  t16 += v * b4;
+  t17 += v * b5;
+  t18 += v * b6;
+  t19 += v * b7;
+  t20 += v * b8;
+  t21 += v * b9;
+  t22 += v * b10;
+  t23 += v * b11;
+  t24 += v * b12;
+  t25 += v * b13;
+  t26 += v * b14;
+  t27 += v * b15;
+  v = a[13];
+  t13 += v * b0;
+  t14 += v * b1;
+  t15 += v * b2;
+  t16 += v * b3;
+  t17 += v * b4;
+  t18 += v * b5;
+  t19 += v * b6;
+  t20 += v * b7;
+  t21 += v * b8;
+  t22 += v * b9;
+  t23 += v * b10;
+  t24 += v * b11;
+  t25 += v * b12;
+  t26 += v * b13;
+  t27 += v * b14;
+  t28 += v * b15;
+  v = a[14];
+  t14 += v * b0;
+  t15 += v * b1;
+  t16 += v * b2;
+  t17 += v * b3;
+  t18 += v * b4;
+  t19 += v * b5;
+  t20 += v * b6;
+  t21 += v * b7;
+  t22 += v * b8;
+  t23 += v * b9;
+  t24 += v * b10;
+  t25 += v * b11;
+  t26 += v * b12;
+  t27 += v * b13;
+  t28 += v * b14;
+  t29 += v * b15;
+  v = a[15];
+  t15 += v * b0;
+  t16 += v * b1;
+  t17 += v * b2;
+  t18 += v * b3;
+  t19 += v * b4;
+  t20 += v * b5;
+  t21 += v * b6;
+  t22 += v * b7;
+  t23 += v * b8;
+  t24 += v * b9;
+  t25 += v * b10;
+  t26 += v * b11;
+  t27 += v * b12;
+  t28 += v * b13;
+  t29 += v * b14;
+  t30 += v * b15;
+
+  t0  += 38 * t16;
+  t1  += 38 * t17;
+  t2  += 38 * t18;
+  t3  += 38 * t19;
+  t4  += 38 * t20;
+  t5  += 38 * t21;
+  t6  += 38 * t22;
+  t7  += 38 * t23;
+  t8  += 38 * t24;
+  t9  += 38 * t25;
+  t10 += 38 * t26;
+  t11 += 38 * t27;
+  t12 += 38 * t28;
+  t13 += 38 * t29;
+  t14 += 38 * t30;
+  // t15 left as is
+
+  // first car
+  c = 1;
+  v =  t0 + c + 65535; c = Math.floor(v / 65536);  t0 = v - c * 65536;
+  v =  t1 + c + 65535; c = Math.floor(v / 65536);  t1 = v - c * 65536;
+  v =  t2 + c + 65535; c = Math.floor(v / 65536);  t2 = v - c * 65536;
+  v =  t3 + c + 65535; c = Math.floor(v / 65536);  t3 = v - c * 65536;
+  v =  t4 + c + 65535; c = Math.floor(v / 65536);  t4 = v - c * 65536;
+  v =  t5 + c + 65535; c = Math.floor(v / 65536);  t5 = v - c * 65536;
+  v =  t6 + c + 65535; c = Math.floor(v / 65536);  t6 = v - c * 65536;
+  v =  t7 + c + 65535; c = Math.floor(v / 65536);  t7 = v - c * 65536;
+  v =  t8 + c + 65535; c = Math.floor(v / 65536);  t8 = v - c * 65536;
+  v =  t9 + c + 65535; c = Math.floor(v / 65536);  t9 = v - c * 65536;
+  v = t10 + c + 65535; c = Math.floor(v / 65536); t10 = v - c * 65536;
+  v = t11 + c + 65535; c = Math.floor(v / 65536); t11 = v - c * 65536;
+  v = t12 + c + 65535; c = Math.floor(v / 65536); t12 = v - c * 65536;
+  v = t13 + c + 65535; c = Math.floor(v / 65536); t13 = v - c * 65536;
+  v = t14 + c + 65535; c = Math.floor(v / 65536); t14 = v - c * 65536;
+  v = t15 + c + 65535; c = Math.floor(v / 65536); t15 = v - c * 65536;
+  t0 += c-1 + 37 * (c-1);
+
+  // second car
+  c = 1;
+  v =  t0 + c + 65535; c = Math.floor(v / 65536);  t0 = v - c * 65536;
+  v =  t1 + c + 65535; c = Math.floor(v / 65536);  t1 = v - c * 65536;
+  v =  t2 + c + 65535; c = Math.floor(v / 65536);  t2 = v - c * 65536;
+  v =  t3 + c + 65535; c = Math.floor(v / 65536);  t3 = v - c * 65536;
+  v =  t4 + c + 65535; c = Math.floor(v / 65536);  t4 = v - c * 65536;
+  v =  t5 + c + 65535; c = Math.floor(v / 65536);  t5 = v - c * 65536;
+  v =  t6 + c + 65535; c = Math.floor(v / 65536);  t6 = v - c * 65536;
+  v =  t7 + c + 65535; c = Math.floor(v / 65536);  t7 = v - c * 65536;
+  v =  t8 + c + 65535; c = Math.floor(v / 65536);  t8 = v - c * 65536;
+  v =  t9 + c + 65535; c = Math.floor(v / 65536);  t9 = v - c * 65536;
+  v = t10 + c + 65535; c = Math.floor(v / 65536); t10 = v - c * 65536;
+  v = t11 + c + 65535; c = Math.floor(v / 65536); t11 = v - c * 65536;
+  v = t12 + c + 65535; c = Math.floor(v / 65536); t12 = v - c * 65536;
+  v = t13 + c + 65535; c = Math.floor(v / 65536); t13 = v - c * 65536;
+  v = t14 + c + 65535; c = Math.floor(v / 65536); t14 = v - c * 65536;
+  v = t15 + c + 65535; c = Math.floor(v / 65536); t15 = v - c * 65536;
+  t0 += c-1 + 37 * (c-1);
+
+  o[ 0] = t0;
+  o[ 1] = t1;
+  o[ 2] = t2;
+  o[ 3] = t3;
+  o[ 4] = t4;
+  o[ 5] = t5;
+  o[ 6] = t6;
+  o[ 7] = t7;
+  o[ 8] = t8;
+  o[ 9] = t9;
+  o[10] = t10;
+  o[11] = t11;
+  o[12] = t12;
+  o[13] = t13;
+  o[14] = t14;
+  o[15] = t15;
+}
+
+function S(o, a) {
+  M(o, a, a);
+}
+
+function sel25519(p, q, b) {
+  var t, c = ~(b-1);
+  for (var i = 0; i < 16; i++) {
+    t = c & (p[i] ^ q[i]);
+    p[i] ^= t;
+    q[i] ^= t;
+  }
+}
+
+function pack25519(o, n) {
+  var i, j, b;
+  var m = gf(), t = gf();
+  for (i = 0; i < 16; i++) t[i] = n[i];
+  car25519(t);
+  car25519(t);
+  car25519(t);
+  for (j = 0; j < 2; j++) {
+    m[0] = t[0] - 0xffed;
+    for (i = 1; i < 15; i++) {
+      m[i] = t[i] - 0xffff - ((m[i-1]>>16) & 1);
+      m[i-1] &= 0xffff;
+    }
+    m[15] = t[15] - 0x7fff - ((m[14]>>16) & 1);
+    b = (m[15]>>16) & 1;
+    m[14] &= 0xffff;
+    sel25519(t, m, 1-b);
+  }
+  for (i = 0; i < 16; i++) {
+    o[2*i] = t[i] & 0xff;
+    o[2*i+1] = t[i]>>8;
+  }
+}
+
+function unpack25519(o, n) {
+  var i;
+  for (i = 0; i < 16; i++) o[i] = n[2*i] + (n[2*i+1] << 8);
+  o[15] &= 0x7fff;
+}
+
+function inv25519(o, i) {
+  var c = gf();
+  var a;
+  for (a = 0; a < 16; a++) c[a] = i[a];
+  for (a = 253; a >= 0; a--) {
+    S(c, c);
+    if(a !== 2 && a !== 4) M(c, c, i);
+  }
+  for (a = 0; a < 16; a++) o[a] = c[a];
+}
+
+function car25519(o) {
+  var i, v, c = 1;
+  for (i = 0; i < 16; i++) {
+    v = o[i] + c + 65535;
+    c = Math.floor(v / 65536);
+    o[i] = v - c * 65536;
+  }
+  o[0] += c-1 + 37 * (c-1);
+}
+
+module.exports = {
+  gf,
+  A,
+  Z,
+  M,
+  S,
+  sel25519,
+  pack25519,
+  unpack25519,
+  inv25519,
+  gf0,
+  gf1,
+  _9,
+  _121665,
+  D,
+  D2,
+  X,
+  Y,
+  I
+}

fe-test.js

@@ -0,0 +1,333 @@
+const ec = require('./fe25519_25.js')
+const sodium = require('./')
+const invert = require('./fe25519_25/fe25519_invert')({
+  imports: {
+    debug: {
+      log (...args) {
+        console.log(...args.map(int => (int >>> 0).toString(16).padStart(8, '0')))
+      },
+      log_tee (arg) {
+        console.log((arg >>> 0).toString(16).padStart(8, '0'))
+        return arg
+      }
+    }
+  }
+})
+const pow = require('./fe25519_25/fe25519_pow22523')({
+  imports: {
+    debug: {
+      log (...args) {
+        console.log(...args.map(int => (int >>> 0).toString(16).padStart(8, '0')))
+      },
+      log_tee (arg) {
+        console.log((arg >>> 0).toString(16).padStart(8, '0'))
+        return arg
+      }
+    }
+  }
+})
+
+// const crypto = require('crypto')
+
+var f = new Int32Array(10)
+var g = new Int32Array(10)
+var h = new Int32Array(10)
+
+var a = ec.ge3()
+var r = ec.ge3()
+
+function wasm_inv (h, f) {
+  var buf = Buffer.from(f.buffer)
+
+  invert.memory.set(buf)
+  invert.exports.fe25519_invert(40, 0)
+
+  buf = Buffer.from(invert.memory.slice(40, 80))
+  for (let i = 0; i < 10; i++) {
+    h[i] = buf.readUInt32LE(4 * i)
+  }
+}
+
+function wasm_pow (h, f) {
+  var buf = Buffer.from(f.buffer)
+
+  pow.memory.set(buf)
+  pow.exports.fe25519_pow22523(40, 0)
+
+  buf = Buffer.from(pow.memory.slice(40, 80))
+  for (let i = 0; i < 10; i++) {
+    h[i] = buf.readUInt32LE(4 * i)
+  }
+}
+
+f[0] = 23983080
+a[2][0] = 1
+
+// ec.fe25519_neg(g, f)
+// ec.fe25519_reduce(g, g)
+// ec.fe25519_add(h, f, g)
+// ec.fe25519_reduce(h, h)
+
+// ec.fe25519_sub(h, f, g)
+// ec.fe25519_reduce(h, h)
+// console.log(h)
+
+// ec.fe25519_add(h, f, f)
+// ec.fe25519_reduce(h, h)
+// console.log(h)
+
+// g[0] = 2
+// for (let i = 1; i < 10; i++) g[i] = 0
+// ec.fe25519_mul(h, f, g)
+// console.log(h)
+// ec.fe25519_reduce(h, h)
+// console.log(h)
+
+var an = Buffer.from([
+  171,  69, 129,  47,  90,  82, 223, 134,
+    6, 147,  54,  76,  55, 148, 252,  37,
+  234, 216, 113,  62, 223,  49,  33,  36,
+  172, 246,  18, 226,  50, 249, 198, 231
+])
+
+var bn = Buffer.from([
+  226,  38,  16,  80, 186, 183, 134, 239,
+  190,  24, 150, 125,  14, 254,  19,  44,
+   55, 112, 156,   5, 141, 230,  91,  84,
+  110, 130, 213,  39, 249, 107, 145, 140
+])
+
+var cn = Buffer.from([
+  190,  24, 150, 125,  14, 254,  19,  44,
+   55, 112, 156,   5, 141, 230,  91,  84,
+  110, 130, 213,  39, 249, 107, 145, 140,
+  226,  38,  16,  80, 186, 183, 134, 239
+])
+
+var s = Buffer.from([
+  190,  24, 150, 125,  14, 254,  19,  44,
+   55, 112, 156,   5, 141, 230,  91,  84,
+  110, 130, 213,  39, 249, 107, 145, 140,
+  226,  38,  16,  80, 186, 183, 134, 239,
+  190,  24, 150, 125,  14, 254,  19,  44,
+   55, 112, 156,   5, 141, 230,  91,  84,
+  110, 130, 213,  39, 249, 107, 145, 140,
+  226,  38,  16,  80, 186, 183, 134, 239
+])
+
+const p = Buffer.from([
+  0x38, 0xf4, 0x69, 0x6f, 0xcf, 0x62, 0xa0, 0xfd,
+  0x5a, 0xb7, 0x6e, 0x9f, 0xcb, 0xcd, 0x95, 0x3f,
+  0xed, 0xba, 0x30, 0xb2, 0x64, 0x42, 0xa4, 0x52,
+  0x27, 0xa6, 0x3e, 0xd2, 0xc8, 0xac, 0xa4, 0xed
+])
+
+const pk_test = Buffer.from('d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a', 'hex')
+
+function signedInt (i) {
+  return i < 0 ? 2 ** 32 + i : i
+}
+
+// console.log(Uint8Array.from(an))
+// console.log(Uint8Array.from(bn))
+
+// console.log(an.toString('hex'))
+// console.log(bn.toString('hex'))
+
+// for (let i = 0; i < 25; i++) an[i] = bn[i] = i
+// var correct = true
+
+// var dn = Buffer.alloc(32)
+
+const mod =  2n ** 252n + 27742317777372353535851937790883648493n
+const res = Buffer.alloc(32)
+const res1 = Buffer.alloc(32)
+
+var a = new Int32Array(10)
+var b = new Int32Array(10)
+var c = new Int32Array(10)
+var g = new Int32Array(10)
+const ge = ec.ge3()
+const gf = ec.ge3()
+
+///////////////////////////////////////////
+ec.fe25519_frombytes(a, an)
+ec.fe25519_frombytes(b, bn)
+
+ec.fe25519_mul(c, b, a)
+// // console.log('\na __________')
+// // for (let i = 0; i < 10; i++) console.log(`a${i}:`, signedInt(a[i]).toString(16).padStart(8, '0'))
+// // console.log('\nb __________')
+// // for (let i = 0; i < 10; i++) console.log(`b${i}:`, signedInt(b[i]).toString(16).padStart(8, '0'))
+// ec.fe25519_frombytes(c, bn)
+ec.fe25519_tobytes(res, c)
+console.log('tess  :', res.toString('hex'))
+
+
+console.time('standard')
+for (let i = 0; i < 10000; i++) ec.fe25519_invert(b, a)
+console.timeEnd('standard')
+
+ec.fe25519_tobytes(res, b)
+console.log('tess  :', res.toString('hex'))
+
+console.time('pure invert')
+for (let i = 0; i < 10000; i++) ec.fe25519_invert_1(b, a)
+console.timeEnd('pure invert')
+ec.fe25519_tobytes(res, b)
+console.log('tess  :', res.toString('hex'))
+
+ec.fe25519_pow22523(a, a)
+ec.fe25519_tobytes(res, a)
+console.log('fe_p25:', res.toString('hex'))
+
+ec.fe25519_cneg(a, a, 1)
+ec.fe25519_tobytes(res, a)
+console.log('fe_cng:', res.toString('hex'))
+
+ec.sc25519_mul(res, an, bn)
+console.log('sc_mul:', res.toString('hex'))
+
+ec.sc25519_muladd(res, an, bn, cn)
+console.log('sc_mad:', res.toString('hex'))
+
+ec.sc25519_reduce(s)
+console.log('sc_red:', s.subarray(0, 32).toString('hex'))
+
+ec.sc25519_invert(res, cn)
+console.log('sc_inv:', res.toString('hex'))
+
+ec.ge25519_mont_to_ed(g, c, a, b)
+ec.fe25519_tobytes(res, g)
+console.log('g_m2ex:', res.toString('hex'))
+ec.fe25519_tobytes(res, c)
+console.log('g_m2ey:', res.toString('hex'))
+
+ec.ge25519_frombytes(ge, p)
+ec.ge25519_p3_tobytes(res, ge)
+console.log("p     :", res.toString('hex'))
+
+ec.ge25519_mul_l(gf, ge)
+ec.ge25519_p3_tobytes(res, gf)
+console.log("mul_l :", res.toString('hex'))
+
+ec.ge25519_scalarmult_base(gf, cn)
+ec.ge25519_p3_tobytes(res, gf)
+console.log("smultb:", res.toString('hex'))
+
+ec.ge25519_scalarmult(ge, bn, gf)
+ec.ge25519_p3_tobytes(res, ge)
+console.log("smult :", res.toString('hex'))
+
+ec.ge25519_double_scalarmult_vartime(gf, an, ge, bn)
+ec.ge25519_p3_tobytes(res, gf)
+console.log("smdbl :", res.toString('hex'))
+
+ec.ge25519_frombytes_negate_vartime(gf, pk_test)
+ec.ge25519_p3_tobytes(res, gf)
+console.log("smdbl :", res.toString('hex'))
+
+console.log('canon :', ec.sc25519_is_canonical(bn))
+
+/////////////////////////////////////////////////////
+
+// console.log(((BigInt(ahex) * BigInt(ahex)) % mod).toString(16))
+// console.log(res1.toString('hex'))
+
+// const b = new Float64Array(16)
+// const bi = new Float64Array(16)
+// sodium.unpack25519(b, an)
+// console.log(b)
+// sodium.inv25519(bi, b)
+// console.log(b)
+// sodium.pack(res1, bi)
+
+
+// console.log(res.toString('hex'))
+// console.log(res1.toString('hex'))
+
+
+// for (let j = 0; j < 10000; j++) {
+//   var an = crypto.randomBytes(32)
+//   var bn = crypto.randomBytes(32)
+//   var cn = crypto.randomBytes(32)
+//   dn.fill(0)
+
+//   ec.fe25519_invert(dn, an, bn, cn)
+//   var res = reverseEndian(dn)
+
+//   var bi = (((BigInt('0x' + reverseEndian(an)) * BigInt('0x' + reverseEndian(bn))) +  BigInt('0x' + reverseEndian(cn))) % mod).toString(16).padStart(res.length, '0')
+
+//   correct &= res === bi
+// }
+
+// console.log(correct === 1)
+
+// function reverseEndian (buf) {
+//   var str = ''
+//   let i = buf.length - 1
+
+//   while (buf[i] === 0) i--
+//   if (i === -1) return '0'
+
+//   for (; i >= 0; i--) {
+//     str += buf[i].toString(16).padStart(2, '0')
+//   }
+
+//   return str
+// }
+
+// const a237 = new Array(
+//   0x0003e6b1n,
+//   0x001d0353n,
+//   0x00033a5dn,
+//   0x000fcd68n,
+//   0x000cd8c5n,
+//   0x00172cd9n,
+//   0x000dcf66n,
+//   0x0014afffn,
+//   0x0009f453n,
+//   0x0006399cn,
+//   0x000e9672n,
+//   0x000ee4een
+// )
+// var a237 = []
+// a237 = Array.from(a237).map(BigInt)
+
+// var s = Buffer.alloc(32)
+
+// s[0]  = Number(a237[0] >> 0n)
+// s[1]  = Number(a237[0] >> 8n)
+// s[2]  = Number((a237[0] >> 16n) | (a237[1] *  (1n << 5n)))
+// s[3]  = Number(a237[1] >> 3n)
+// s[4]  = Number(a237[1] >> 11n)
+// s[5]  = Number((a237[1] >> 19n) | (a237[2] *  (1n << 2n)))
+// s[6]  = Number(a237[2] >> 6n)
+// s[7]  = Number((a237[2] >> 14n) | (a237[3] *  (1n << 7n)))
+// s[8]  = Number(a237[3] >> 1n)
+// s[9]  = Number(a237[3] >> 9n)
+// s[10] = Number((a237[3] >> 17n) | (a237[4] *  (1n << 4n)))
+// s[11] = Number(a237[4] >> 4n)
+// s[12] = Number(a237[4] >> 12n)
+// s[13] = Number((a237[4] >> 20n) | (a237[5] *  (1n << 1n)))
+// s[14] = Number(a237[5] >> 7n)
+// s[15] = Number((a237[5] >> 15n) | (a237[6] *  (1n << 6n)))
+// s[16] = Number(a237[6] >> 2n)
+// s[17] = Number(a237[6] >> 10n)
+// s[18] = Number((a237[6] >> 18n) | (a237[7] *  (1n << 3n)))
+// s[19] = Number(a237[7] >> 5n)
+// s[20] = Number(a237[7] >> 13n)
+// s[21] = Number(a237[8] >> 0n)
+// s[22] = Number(a237[8] >> 8n)
+// s[23] = Number((a237[8] >> 16n) | (a237[9] *  (1n << 5n)))
+// s[24] = Number(a237[9] >> 3n)
+// s[25] = Number(a237[9] >> 11n)
+// s[26] = Number((a237[9] >> 19n) | (a237[10] *  (1n << 2n)))
+// s[27] = Number(a237[10]  >> 6n)
+// s[28] = Number((a237[10] >> 14n) | (a237[11] *  (1n << 7n)))
+// s[29] = Number(a237[11]  >> 1n)
+// s[30] = Number(a237[11]  >> 9n)
+// s[31] = Number(a237[11]  >> 17n)
+
+// console.log(reverseEndian(s))
+// // console.log(a237.reduce((acc, a, i) => acc + a * 1n << (20n * BigInt(i))).toString(16))

fe25519_25/fe25519_mul.js

@@ -0,0 +1,61 @@
+
+module.exports = loadWebAssembly
+
+loadWebAssembly.supported = typeof WebAssembly !== 'undefined'
+
+function loadWebAssembly (opts) {
+  if (!loadWebAssembly.supported) return null
+
+  var imp = opts && opts.imports
+  var wasm = toUint8Array('AGFzbQEAAAABHwJgFX5+fn5+fn5+fn5+fn5+fn5+fn5+fwBgA39/fwACGAICanMFdGFibGUBcAAEAmpzA21lbQIAAQMDAgABBw8BC2ZlMjU1MTlfbXVsAAEJBwEAQQELAQAK/hACkBABhgF+IACnrCEAIAGnrCEBIAKnrCECIAOnrCEDIASnrCEEIAWnrCEFIAanrCEGIAenrCEHIAinrCEIIAmnrCEJIAqnrCEKIAunrCELIAynrCEMIA2nrCENIA6nrCEOIA+nrCEPIBCnrCEQIBGnrCERIBKnrCESIBOnrCETQhMgC34gC0KAgICACINCAYZCE359ISlCEyAMfiAMQoCAgIAIg0IBhkITfn0hKkITIA1+IA1CgICAgAiDQgGGQhN+fSErQhMgDn4gDkKAgICACINCAYZCE359ISxCEyAPfiAPQoCAgIAIg0IBhkITfn0hLUITIBB+IBBCgICAgAiDQgGGQhN+fSEuQhMgEX4gEUKAgICACINCAYZCE359IS9CEyASfiASQoCAgIAIg0IBhkITfn0hMEITIBN+IBNCgICAgAiDQgGGQhN+fSExQgIgAX4gAUKAgICACINCAYZCAn59ITJCAiADfiADQoCAgIAIg0IBhkICfn0hM0ICIAV+IAVCgICAgAiDQgGGQgJ+fSE0QgIgB34gB0KAgICACINCAYZCAn59ITVCAiAJfiAJQoCAgIAIg0IBhkICfn0hNiApp6whKSAqp6whKiArp6whKyAsp6whLCAtp6whLSAup6whLiAvp6whLyAwp6whMCAxp6whMSAyp6whMiAzp6whMyA0p6whNCA1p6whNSA2p6whNiAAIAp+ITcgACALfiE4IAAgDH4hOSAAIA1+ITogACAOfiE7IAAgD34hPCAAIBB+IT0gACARfiE+IAAgEn4hPyAAIBN+IUAgASAKfiFBIDIgC34hQiABIAx+IUMgMiANfiFEIAEgDn4hRSAyIA9+IUYgASAQfiFHIDIgEX4hSCABIBJ+IUkgMiAxfiFKIAIgCn4hSyACIAt+IUwgAiAMfiFNIAIgDX4hTiACIA5+IU8gAiAPfiFQIAIgEH4hUSACIBF+IVIgAiAwfiFTIAIgMX4hVCADIAp+IVUgMyALfiFWIAMgDH4hVyAzIA1+IVggAyAOfiFZIDMgD34hWiADIBB+IVsgMyAvfiFcIAMgMH4hXSAzIDF+IV4gBCAKfiFfIAQgC34hYCAEIAx+IWEgBCANfiFiIAQgDn4hYyAEIA9+IWQgBCAufiFlIAQgL34hZiAEIDB+IWcgBCAxfiFoIAUgCn4haSA0IAt+IWogBSAMfiFrIDQgDX4hbCAFIA5+IW0gNCAtfiFuIAUgLn4hbyA0IC9+IXAgBSAwfiFxIDQgMX4hciAGIAp+IXMgBiALfiF0IAYgDH4hdSAGIA1+IXYgBiAsfiF3IAYgLX4heCAGIC5+IXkgBiAvfiF6IAYgMH4heyAGIDF+IXwgByAKfiF9IDUgC34hfiAHIAx+IX8gNSArfiGAASAHICx+IYEBIDUgLX4hggEgByAufiGDASA1IC9+IYQBIAcgMH4hhQEgNSAxfiGGASAIIAp+IYcBIAggC34hiAEgCCAqfiGJASAIICt+IYoBIAggLH4hiwEgCCAtfiGMASAIIC5+IY0BIAggL34hjgEgCCAwfiGPASAIIDF+IZABIAkgCn4hkQEgNiApfiGSASAJICp+IZMBIDYgK34hlAEgCSAsfiGVASA2IC1+IZYBIAkgLn4hlwEgNiAvfiGYASAJIDB+IZkBIDYgMX4hmgEgNyBKIFMgXCBlIG4gdyCAASCJASCSAXx8fHx8fHx8fCEVIDggQSBUIF0gZiBvIHgggQEgigEgkwF8fHx8fHx8fHwhFiA5IEIgSyBeIGcgcCB5IIIBIIsBIJQBfHx8fHx8fHx8IRcgOiBDIEwgVSBoIHEgeiCDASCMASCVAXx8fHx8fHx8fCEYIDsgRCBNIFYgXyByIHsghAEgjQEglgF8fHx8fHx8fHwhGSA8IEUgTiBXIGAgaSB8IIUBII4BIJcBfHx8fHx8fHx8IRogPSBGIE8gWCBhIGogcyCGASCPASCYAXx8fHx8fHx8fCEbID4gRyBQIFkgYiBrIHQgfSCQASCZAXx8fHx8fHx8fCEcID8gSCBRIFogYyBsIHUgfiCHASCaAXx8fHx8fHx8fCEdIEAgSSBSIFsgZCBtIHYgfyCIASCRAXx8fHx8fHx8fCEeIBVCAUIZhnxCGochHyAWIB98IRYgFSAfQgFCGoZ+fSEVIBlCAUIZhnxCGochIyAaICN8IRogGSAjQgFCGoZ+fSEZIBZCAUIYhnxCGYchICAXICB8IRcgFiAgQgFCGYZ+fSEWIBpCAUIYhnxCGYchJCAbICR8IRsgGiAkQgFCGYZ+fSEaIBdCAUIZhnxCGochISAYICF8IRggFyAhQgFCGoZ+fSEXIBtCAUIZhnxCGochJSAcICV8IRwgGyAlQgFCGoZ+fSEbIBhCAUIYhnxCGYchIiAZICJ8IRkgGCAiQgFCGYZ+fSEYIBxCAUIYhnxCGYchJiAdICZ8IR0gHCAmQgFCGYZ+fSEcIBlCAUIZhnxCGochIyAaICN8IRogGSAjQgFCGoZ+fSEZIB1CAUIZhnxCGochJyAeICd8IR4gHSAnQgFCGoZ+fSEdIB5CAUIYhnxCGYchKCAVIChCE358IRUgHiAoQgFCGYZ+fSEeIBVCAUIZhnxCGochHyAWIB98IRYgFSAfQgFCGoZ+fSEVIBQgFT4CACAUIBY+AgQgFCAXPgIIIBQgGD4CDCAUIBk+AhAgFCAaPgIUIBQgGz4CGCAUIBw+AhwgFCAdPgIgIBQgHj4CJAtqACABNQIAIAE1AgQgATUCCCABNQIMIAE1AhAgATUCFCABNQIYIAE1AhwgATUCICABNQIkIAI1AgAgAjUCBCACNQIIIAI1AgwgAjUCECACNQIUIAI1AhggAjUCHCACNQIgIAI1AiQgABAACw==')
+  var ready = null
+
+  var mod = {
+    buffer: wasm,
+    memory: null,
+    exports: null,
+    realloc: realloc,
+    onload: onload
+  }
+
+  onload(function () {})
+
+  return mod
+
+  function realloc (size) {
+    mod.exports.memory.grow(Math.max(0, Math.ceil(Math.abs(size - mod.memory.length) / 65536)))
+    mod.memory = new Uint8Array(mod.exports.memory.buffer)
+  }
+
+  function onload (cb) {
+    if (mod.exports) return cb()
+
+    if (ready) {
+      ready.then(cb.bind(null, null)).catch(cb)
+      return
+    }
+
+    try {
+      if (opts && opts.async) throw new Error('async')
+      setup({instance: new WebAssembly.Instance(new WebAssembly.Module(wasm), imp)})
+    } catch (err) {
+      ready = WebAssembly.instantiate(wasm, imp).then(setup)
+    }
+
+    onload(cb)
+  }
+
+  function setup (w) {
+    mod.exports = w.instance.exports
+    mod.memory = mod.exports.memory && mod.exports.memory.buffer && new Uint8Array(mod.exports.memory.buffer)
+  }
+}
+
+function toUint8Array (s) {
+  if (typeof atob === 'function') return new Uint8Array(atob(s).split('').map(charCodeAt))
+  return (require('buf' + 'fer').Buffer).from(s, 'base64')
+}
+
+function charCodeAt (c) {
+  return c.charCodeAt(0)
+}

fe25519_25/fe25519_mul.wat

@@ -0,0 +1,440 @@
+(module
+  (import "js" "table" (table 4 anyfunc))
+  (import "js" "mem" (memory 1))
+  
+  (elem (i32.const 1) $fe_mul)
+
+  ;; (func $i32.log (import "debug" "log") (param i32))
+  ;; (func $i32.log_tee (import "debug" "log_tee") (param i32) (result i32))
+  ;; ;; No i64 interop with JS yet - but maybe coming with WebAssembly BigInt
+  ;; ;; So we can instead fake this by splitting the i64 into two i32 limbs,
+  ;; ;; however these are WASM functions using i32x2.log:
+  ;; (func $i32x2.log (import "debug" "log") (param i32) (param i32))
+  ;; (func $f32.log (import "debug" "log") (param f32))
+  ;; (func $f32.log_tee (import "debug" "log_tee") (param f32) (result f32))
+  ;; (func $f64.log (import "debug" "log") (param f64))
+  ;; (func $f64.log_tee (import "debug" "log_tee") (param f64) (result f64))  
+  
+  ;; ;; i64 logging by splitting into two i32 limbs
+  ;; (func $i64.log
+  ;;   (param $0 i64)
+  ;;   (call $i32x2.log
+  ;;     ;; Upper limb
+  ;;     (i32.wrap/i64
+  ;;       (i64.shr_s (get_local $0)
+  ;;         (i64.const 32)))
+  ;;     ;; Lower limb
+  ;;     (i32.wrap/i64 (get_local $0))))
+
+  ;; (func $i64.log_tee
+  ;;   (param $0 i64)
+  ;;   (result i64)
+  ;;   (call $i64.log (get_local $0))
+  ;;   (return (get_local $0)))
+
+  (func $fe_mul
+    (param $f0 i64)
+    (param $f1 i64)
+    (param $f2 i64)
+    (param $f3 i64)
+    (param $f4 i64)
+    (param $f5 i64)
+    (param $f6 i64)
+    (param $f7 i64)
+    (param $f8 i64)
+    (param $f9 i64)
+
+    (param $g0 i64)
+    (param $g1 i64)
+    (param $g2 i64)
+    (param $g3 i64)
+    (param $g4 i64)
+    (param $g5 i64)
+    (param $g6 i64)
+    (param $g7 i64)
+    (param $g8 i64)
+    (param $g9 i64)
+
+    (param $h i32)
+
+    (local $h0 i64)
+    (local $h1 i64)
+    (local $h2 i64)
+    (local $h3 i64)
+    (local $h4 i64)
+    (local $h5 i64)
+    (local $h6 i64)
+    (local $h7 i64)
+    (local $h8 i64)
+    (local $h9 i64)
+    
+    (local $carry0 i64)
+    (local $carry1 i64)
+    (local $carry2 i64)
+    (local $carry3 i64)
+    (local $carry4 i64)
+    (local $carry5 i64)
+    (local $carry6 i64)
+    (local $carry7 i64)
+    (local $carry8 i64)
+    (local $carry9 i64)
+
+    (local $g1_19 i64)
+    (local $g2_19 i64)
+    (local $g3_19 i64)
+    (local $g4_19 i64)
+    (local $g5_19 i64)
+    (local $g6_19 i64)
+    (local $g7_19 i64)
+    (local $g8_19 i64)
+    (local $g9_19 i64)
+    (local $f1_2  i64)
+    (local $f3_2  i64)
+    (local $f5_2  i64)
+    (local $f7_2  i64)
+    (local $f9_2  i64)
+
+    (local $f0g0    i64)
+    (local $f0g1    i64)
+    (local $f0g2    i64)
+    (local $f0g3    i64)
+    (local $f0g4    i64)
+    (local $f0g5    i64)
+    (local $f0g6    i64)
+    (local $f0g7    i64)
+    (local $f0g8    i64)
+    (local $f0g9    i64)
+    (local $f1g0    i64)
+    (local $f1g1_2  i64)
+    (local $f1g2    i64)
+    (local $f1g3_2  i64)
+    (local $f1g4    i64)
+    (local $f1g5_2  i64)
+    (local $f1g6    i64)
+    (local $f1g7_2  i64)
+    (local $f1g8    i64)
+    (local $f1g9_38 i64)
+    (local $f2g0    i64)
+    (local $f2g1    i64)
+    (local $f2g2    i64)
+    (local $f2g3    i64)
+    (local $f2g4    i64)
+    (local $f2g5    i64)
+    (local $f2g6    i64)
+    (local $f2g7    i64)
+    (local $f2g8_19 i64)
+    (local $f2g9_19 i64)
+    (local $f3g0    i64)
+    (local $f3g1_2  i64)
+    (local $f3g2    i64)
+    (local $f3g3_2  i64)
+    (local $f3g4    i64)
+    (local $f3g5_2  i64)
+    (local $f3g6    i64)
+    (local $f3g7_38 i64)
+    (local $f3g8_19 i64)
+    (local $f3g9_38 i64)
+    (local $f4g0    i64)
+    (local $f4g1    i64)
+    (local $f4g2    i64)
+    (local $f4g3    i64)
+    (local $f4g4    i64)
+    (local $f4g5    i64)
+    (local $f4g6_19 i64)
+    (local $f4g7_19 i64)
+    (local $f4g8_19 i64)
+    (local $f4g9_19 i64)
+    (local $f5g0    i64)
+    (local $f5g1_2  i64)
+    (local $f5g2    i64)
+    (local $f5g3_2  i64)
+    (local $f5g4    i64)
+    (local $f5g5_38 i64)
+    (local $f5g6_19 i64)
+    (local $f5g7_38 i64)
+    (local $f5g8_19 i64)
+    (local $f5g9_38 i64)
+    (local $f6g0    i64)
+    (local $f6g1    i64)
+    (local $f6g2    i64)
+    (local $f6g3    i64)
+    (local $f6g4_19 i64)
+    (local $f6g5_19 i64)
+    (local $f6g6_19 i64)
+    (local $f6g7_19 i64)
+    (local $f6g8_19 i64)
+    (local $f6g9_19 i64)
+    (local $f7g0    i64)
+    (local $f7g1_2  i64)
+    (local $f7g2    i64)
+    (local $f7g3_38 i64)
+    (local $f7g4_19 i64)
+    (local $f7g5_38 i64)
+    (local $f7g6_19 i64)
+    (local $f7g7_38 i64)
+    (local $f7g8_19 i64)
+    (local $f7g9_38 i64)
+    (local $f8g0    i64)
+    (local $f8g1    i64)
+    (local $f8g2_19 i64)
+    (local $f8g3_19 i64)
+    (local $f8g4_19 i64)
+    (local $f8g5_19 i64)
+    (local $f8g6_19 i64)
+    (local $f8g7_19 i64)
+    (local $f8g8_19 i64)
+    (local $f8g9_19 i64)
+    (local $f9g0    i64)
+    (local $f9g1_38 i64)
+    (local $f9g2_19 i64)
+    (local $f9g3_38 i64)
+    (local $f9g4_19 i64)
+    (local $f9g5_38 i64)
+    (local $f9g6_19 i64)
+    (local $f9g7_38 i64)
+    (local $f9g8_19 i64)
+    (local $f9g9_38 i64)
+
+    (set_local $f0 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f0))))
+    (set_local $f1 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f1))))
+    (set_local $f2 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f2))))
+    (set_local $f3 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f3))))
+    (set_local $f4 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f4))))
+    (set_local $f5 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f5))))
+    (set_local $f6 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f6))))
+    (set_local $f7 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f7))))
+    (set_local $f8 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f8))))
+    (set_local $f9 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f9))))
+
+    (set_local $g0 (i64.extend_s/i32 (i32.wrap/i64 (get_local $g0))))
+    (set_local $g1 (i64.extend_s/i32 (i32.wrap/i64 (get_local $g1))))
+    (set_local $g2 (i64.extend_s/i32 (i32.wrap/i64 (get_local $g2))))
+    (set_local $g3 (i64.extend_s/i32 (i32.wrap/i64 (get_local $g3))))
+    (set_local $g4 (i64.extend_s/i32 (i32.wrap/i64 (get_local $g4))))
+    (set_local $g5 (i64.extend_s/i32 (i32.wrap/i64 (get_local $g5))))
+    (set_local $g6 (i64.extend_s/i32 (i32.wrap/i64 (get_local $g6))))
+    (set_local $g7 (i64.extend_s/i32 (i32.wrap/i64 (get_local $g7))))
+    (set_local $g8 (i64.extend_s/i32 (i32.wrap/i64 (get_local $g8))))
+    (set_local $g9 (i64.extend_s/i32 (i32.wrap/i64 (get_local $g9))))
+
+    (set_local $g1_19 (i64.sub (i64.mul (i64.const 19) (get_local $g1)) (i64.mul (i64.shl (i64.and (get_local $g1) (i64.const 0x80000000)) (i64.const 1)) (i64.const 19))))
+    (set_local $g2_19 (i64.sub (i64.mul (i64.const 19) (get_local $g2)) (i64.mul (i64.shl (i64.and (get_local $g2) (i64.const 0x80000000)) (i64.const 1)) (i64.const 19))))
+    (set_local $g3_19 (i64.sub (i64.mul (i64.const 19) (get_local $g3)) (i64.mul (i64.shl (i64.and (get_local $g3) (i64.const 0x80000000)) (i64.const 1)) (i64.const 19))))
+    (set_local $g4_19 (i64.sub (i64.mul (i64.const 19) (get_local $g4)) (i64.mul (i64.shl (i64.and (get_local $g4) (i64.const 0x80000000)) (i64.const 1)) (i64.const 19))))
+    (set_local $g5_19 (i64.sub (i64.mul (i64.const 19) (get_local $g5)) (i64.mul (i64.shl (i64.and (get_local $g5) (i64.const 0x80000000)) (i64.const 1)) (i64.const 19))))
+    (set_local $g6_19 (i64.sub (i64.mul (i64.const 19) (get_local $g6)) (i64.mul (i64.shl (i64.and (get_local $g6) (i64.const 0x80000000)) (i64.const 1)) (i64.const 19))))
+    (set_local $g7_19 (i64.sub (i64.mul (i64.const 19) (get_local $g7)) (i64.mul (i64.shl (i64.and (get_local $g7) (i64.const 0x80000000)) (i64.const 1)) (i64.const 19))))
+    (set_local $g8_19 (i64.sub (i64.mul (i64.const 19) (get_local $g8)) (i64.mul (i64.shl (i64.and (get_local $g8) (i64.const 0x80000000)) (i64.const 1)) (i64.const 19))))
+    (set_local $g9_19 (i64.sub (i64.mul (i64.const 19) (get_local $g9)) (i64.mul (i64.shl (i64.and (get_local $g9) (i64.const 0x80000000)) (i64.const 1)) (i64.const 19))))
+
+    (set_local $f1_2 (i64.sub (i64.mul (i64.const 2) (get_local $f1)) (i64.mul (i64.shl (i64.and (get_local $f1) (i64.const 0x80000000)) (i64.const 1)) (i64.const 2))))
+    (set_local $f3_2 (i64.sub (i64.mul (i64.const 2) (get_local $f3)) (i64.mul (i64.shl (i64.and (get_local $f3) (i64.const 0x80000000)) (i64.const 1)) (i64.const 2))))
+    (set_local $f5_2 (i64.sub (i64.mul (i64.const 2) (get_local $f5)) (i64.mul (i64.shl (i64.and (get_local $f5) (i64.const 0x80000000)) (i64.const 1)) (i64.const 2))))
+    (set_local $f7_2 (i64.sub (i64.mul (i64.const 2) (get_local $f7)) (i64.mul (i64.shl (i64.and (get_local $f7) (i64.const 0x80000000)) (i64.const 1)) (i64.const 2))))
+    (set_local $f9_2 (i64.sub (i64.mul (i64.const 2) (get_local $f9)) (i64.mul (i64.shl (i64.and (get_local $f9) (i64.const 0x80000000)) (i64.const 1)) (i64.const 2))))
+
+    (set_local $g1_19 (i64.extend_s/i32 (i32.wrap/i64 (get_local $g1_19))))
+    (set_local $g2_19 (i64.extend_s/i32 (i32.wrap/i64 (get_local $g2_19))))
+    (set_local $g3_19 (i64.extend_s/i32 (i32.wrap/i64 (get_local $g3_19))))
+    (set_local $g4_19 (i64.extend_s/i32 (i32.wrap/i64 (get_local $g4_19))))
+    (set_local $g5_19 (i64.extend_s/i32 (i32.wrap/i64 (get_local $g5_19))))
+    (set_local $g6_19 (i64.extend_s/i32 (i32.wrap/i64 (get_local $g6_19))))
+    (set_local $g7_19 (i64.extend_s/i32 (i32.wrap/i64 (get_local $g7_19))))
+    (set_local $g8_19 (i64.extend_s/i32 (i32.wrap/i64 (get_local $g8_19))))
+    (set_local $g9_19 (i64.extend_s/i32 (i32.wrap/i64 (get_local $g9_19))))
+
+    (set_local $f1_2 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f1_2))))
+    (set_local $f3_2 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f3_2))))
+    (set_local $f5_2 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f5_2))))
+    (set_local $f7_2 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f7_2))))
+    (set_local $f9_2 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f9_2))))
+
+    (set_local $f0g0    (i64.mul (get_local $f0  ) (get_local $g0)))
+    (set_local $f0g1    (i64.mul (get_local $f0  ) (get_local $g1)))
+    (set_local $f0g2    (i64.mul (get_local $f0  ) (get_local $g2)))
+    (set_local $f0g3    (i64.mul (get_local $f0  ) (get_local $g3)))
+    (set_local $f0g4    (i64.mul (get_local $f0  ) (get_local $g4)))
+    (set_local $f0g5    (i64.mul (get_local $f0  ) (get_local $g5)))
+    (set_local $f0g6    (i64.mul (get_local $f0  ) (get_local $g6)))
+    (set_local $f0g7    (i64.mul (get_local $f0  ) (get_local $g7)))
+    (set_local $f0g8    (i64.mul (get_local $f0  ) (get_local $g8)))
+    (set_local $f0g9    (i64.mul (get_local $f0  ) (get_local $g9)))
+    (set_local $f1g0    (i64.mul (get_local $f1  ) (get_local $g0)))
+    (set_local $f1g1_2  (i64.mul (get_local $f1_2) (get_local $g1)))
+    (set_local $f1g2    (i64.mul (get_local $f1  ) (get_local $g2)))
+    (set_local $f1g3_2  (i64.mul (get_local $f1_2) (get_local $g3)))
+    (set_local $f1g4    (i64.mul (get_local $f1  ) (get_local $g4)))
+    (set_local $f1g5_2  (i64.mul (get_local $f1_2) (get_local $g5)))
+    (set_local $f1g6    (i64.mul (get_local $f1  ) (get_local $g6)))
+    (set_local $f1g7_2  (i64.mul (get_local $f1_2) (get_local $g7)))
+    (set_local $f1g8    (i64.mul (get_local $f1  ) (get_local $g8)))
+    (set_local $f1g9_38 (i64.mul (get_local $f1_2) (get_local $g9_19)))
+    (set_local $f2g0    (i64.mul (get_local $f2  ) (get_local $g0)))
+    (set_local $f2g1    (i64.mul (get_local $f2  ) (get_local $g1)))
+    (set_local $f2g2    (i64.mul (get_local $f2  ) (get_local $g2)))
+    (set_local $f2g3    (i64.mul (get_local $f2  ) (get_local $g3)))
+    (set_local $f2g4    (i64.mul (get_local $f2  ) (get_local $g4)))
+    (set_local $f2g5    (i64.mul (get_local $f2  ) (get_local $g5)))
+    (set_local $f2g6    (i64.mul (get_local $f2  ) (get_local $g6)))
+    (set_local $f2g7    (i64.mul (get_local $f2  ) (get_local $g7)))
+    (set_local $f2g8_19 (i64.mul (get_local $f2  ) (get_local $g8_19)))
+    (set_local $f2g9_19 (i64.mul (get_local $f2  ) (get_local $g9_19)))
+    (set_local $f3g0    (i64.mul (get_local $f3  ) (get_local $g0)))
+    (set_local $f3g1_2  (i64.mul (get_local $f3_2) (get_local $g1)))
+    (set_local $f3g2    (i64.mul (get_local $f3  ) (get_local $g2)))
+    (set_local $f3g3_2  (i64.mul (get_local $f3_2) (get_local $g3)))
+    (set_local $f3g4    (i64.mul (get_local $f3  ) (get_local $g4)))
+    (set_local $f3g5_2  (i64.mul (get_local $f3_2) (get_local $g5)))
+    (set_local $f3g6    (i64.mul (get_local $f3  ) (get_local $g6)))
+    (set_local $f3g7_38 (i64.mul (get_local $f3_2) (get_local $g7_19)))
+    (set_local $f3g8_19 (i64.mul (get_local $f3  ) (get_local $g8_19)))
+    (set_local $f3g9_38 (i64.mul (get_local $f3_2) (get_local $g9_19)))
+    (set_local $f4g0    (i64.mul (get_local $f4) (get_local $g0)))
+    (set_local $f4g1    (i64.mul (get_local $f4) (get_local $g1)))
+    (set_local $f4g2    (i64.mul (get_local $f4) (get_local $g2)))
+    (set_local $f4g3    (i64.mul (get_local $f4) (get_local $g3)))
+    (set_local $f4g4    (i64.mul (get_local $f4) (get_local $g4)))
+    (set_local $f4g5    (i64.mul (get_local $f4) (get_local $g5)))
+    (set_local $f4g6_19 (i64.mul (get_local $f4) (get_local $g6_19)))
+    (set_local $f4g7_19 (i64.mul (get_local $f4) (get_local $g7_19)))
+    (set_local $f4g8_19 (i64.mul (get_local $f4) (get_local $g8_19)))
+    (set_local $f4g9_19 (i64.mul (get_local $f4) (get_local $g9_19)))
+    (set_local $f5g0    (i64.mul (get_local $f5) (get_local $g0)))
+    (set_local $f5g1_2  (i64.mul (get_local $f5_2) (get_local $g1)))
+    (set_local $f5g2    (i64.mul (get_local $f5) (get_local $g2)))
+    (set_local $f5g3_2  (i64.mul (get_local $f5_2) (get_local $g3)))
+    (set_local $f5g4    (i64.mul (get_local $f5) (get_local $g4)))
+    (set_local $f5g5_38 (i64.mul (get_local $f5_2) (get_local $g5_19)))
+    (set_local $f5g6_19 (i64.mul (get_local $f5) (get_local $g6_19)))
+    (set_local $f5g7_38 (i64.mul (get_local $f5_2) (get_local $g7_19)))
+    (set_local $f5g8_19 (i64.mul (get_local $f5) (get_local $g8_19)))
+    (set_local $f5g9_38 (i64.mul (get_local $f5_2) (get_local $g9_19)))
+    (set_local $f6g0    (i64.mul (get_local $f6) (get_local $g0)))
+    (set_local $f6g1    (i64.mul (get_local $f6) (get_local $g1)))
+    (set_local $f6g2    (i64.mul (get_local $f6) (get_local $g2)))
+    (set_local $f6g3    (i64.mul (get_local $f6) (get_local $g3)))
+    (set_local $f6g4_19 (i64.mul (get_local $f6) (get_local $g4_19)))
+    (set_local $f6g5_19 (i64.mul (get_local $f6) (get_local $g5_19)))
+    (set_local $f6g6_19 (i64.mul (get_local $f6) (get_local $g6_19)))
+    (set_local $f6g7_19 (i64.mul (get_local $f6) (get_local $g7_19)))
+    (set_local $f6g8_19 (i64.mul (get_local $f6) (get_local $g8_19)))
+    (set_local $f6g9_19 (i64.mul (get_local $f6) (get_local $g9_19)))
+    (set_local $f7g0    (i64.mul (get_local $f7) (get_local $g0)))
+    (set_local $f7g1_2  (i64.mul (get_local $f7_2) (get_local $g1)))
+    (set_local $f7g2    (i64.mul (get_local $f7) (get_local $g2)))
+    (set_local $f7g3_38 (i64.mul (get_local $f7_2) (get_local $g3_19)))
+    (set_local $f7g4_19 (i64.mul (get_local $f7) (get_local $g4_19)))
+    (set_local $f7g5_38 (i64.mul (get_local $f7_2) (get_local $g5_19)))
+    (set_local $f7g6_19 (i64.mul (get_local $f7) (get_local $g6_19)))
+    (set_local $f7g7_38 (i64.mul (get_local $f7_2) (get_local $g7_19)))
+    (set_local $f7g8_19 (i64.mul (get_local $f7) (get_local $g8_19)))
+    (set_local $f7g9_38 (i64.mul (get_local $f7_2) (get_local $g9_19)))
+    (set_local $f8g0    (i64.mul (get_local $f8) (get_local $g0)))
+    (set_local $f8g1    (i64.mul (get_local $f8) (get_local $g1)))
+    (set_local $f8g2_19 (i64.mul (get_local $f8) (get_local $g2_19)))
+    (set_local $f8g3_19 (i64.mul (get_local $f8) (get_local $g3_19)))
+    (set_local $f8g4_19 (i64.mul (get_local $f8) (get_local $g4_19)))
+    (set_local $f8g5_19 (i64.mul (get_local $f8) (get_local $g5_19)))
+    (set_local $f8g6_19 (i64.mul (get_local $f8) (get_local $g6_19)))
+    (set_local $f8g7_19 (i64.mul (get_local $f8) (get_local $g7_19)))
+    (set_local $f8g8_19 (i64.mul (get_local $f8) (get_local $g8_19)))
+    (set_local $f8g9_19 (i64.mul (get_local $f8) (get_local $g9_19)))
+    (set_local $f9g0    (i64.mul (get_local $f9) (get_local $g0)))
+    (set_local $f9g1_38 (i64.mul (get_local $f9_2) (get_local $g1_19)))
+    (set_local $f9g2_19 (i64.mul (get_local $f9) (get_local $g2_19)))
+    (set_local $f9g3_38 (i64.mul (get_local $f9_2) (get_local $g3_19)))
+    (set_local $f9g4_19 (i64.mul (get_local $f9) (get_local $g4_19)))
+    (set_local $f9g5_38 (i64.mul (get_local $f9_2) (get_local $g5_19)))
+    (set_local $f9g6_19 (i64.mul (get_local $f9) (get_local $g6_19)))
+    (set_local $f9g7_38 (i64.mul (get_local $f9_2) (get_local $g7_19)))
+    (set_local $f9g8_19 (i64.mul (get_local $f9) (get_local $g8_19)))
+    (set_local $f9g9_38 (i64.mul (get_local $f9_2) (get_local $g9_19)))
+
+    (set_local $h0 (i64.add (get_local $f0g0) (i64.add (get_local $f1g9_38) (i64.add (get_local $f2g8_19) (i64.add (get_local $f3g7_38) (i64.add (get_local $f4g6_19) (i64.add (get_local $f5g5_38) (i64.add (get_local $f6g4_19) (i64.add (get_local $f7g3_38) (i64.add (get_local $f8g2_19) (get_local $f9g1_38)))))))))))
+    (set_local $h1 (i64.add (get_local $f0g1) (i64.add (get_local $f1g0) (i64.add (get_local $f2g9_19) (i64.add (get_local $f3g8_19) (i64.add (get_local $f4g7_19) (i64.add (get_local $f5g6_19) (i64.add (get_local $f6g5_19) (i64.add (get_local $f7g4_19) (i64.add (get_local $f8g3_19) (get_local $f9g2_19)))))))))))
+    (set_local $h2 (i64.add (get_local $f0g2) (i64.add (get_local $f1g1_2) (i64.add (get_local $f2g0) (i64.add (get_local $f3g9_38) (i64.add (get_local $f4g8_19) (i64.add (get_local $f5g7_38) (i64.add (get_local $f6g6_19) (i64.add (get_local $f7g5_38) (i64.add (get_local $f8g4_19) (get_local $f9g3_38)))))))))))
+    (set_local $h3 (i64.add (get_local $f0g3) (i64.add (get_local $f1g2) (i64.add (get_local $f2g1) (i64.add (get_local $f3g0) (i64.add (get_local $f4g9_19) (i64.add (get_local $f5g8_19) (i64.add (get_local $f6g7_19) (i64.add (get_local $f7g6_19) (i64.add (get_local $f8g5_19) (get_local $f9g4_19)))))))))))
+    (set_local $h4 (i64.add (get_local $f0g4) (i64.add (get_local $f1g3_2) (i64.add (get_local $f2g2) (i64.add (get_local $f3g1_2) (i64.add (get_local $f4g0) (i64.add (get_local $f5g9_38) (i64.add (get_local $f6g8_19) (i64.add (get_local $f7g7_38) (i64.add (get_local $f8g6_19) (get_local $f9g5_38)))))))))))
+    (set_local $h5 (i64.add (get_local $f0g5) (i64.add (get_local $f1g4) (i64.add (get_local $f2g3) (i64.add (get_local $f3g2) (i64.add (get_local $f4g1) (i64.add (get_local $f5g0) (i64.add (get_local $f6g9_19) (i64.add (get_local $f7g8_19) (i64.add (get_local $f8g7_19) (get_local $f9g6_19)))))))))))
+    (set_local $h6 (i64.add (get_local $f0g6) (i64.add (get_local $f1g5_2) (i64.add (get_local $f2g4) (i64.add (get_local $f3g3_2) (i64.add (get_local $f4g2) (i64.add (get_local $f5g1_2) (i64.add (get_local $f6g0) (i64.add (get_local $f7g9_38) (i64.add (get_local $f8g8_19) (get_local $f9g7_38)))))))))))
+    (set_local $h7 (i64.add (get_local $f0g7) (i64.add (get_local $f1g6) (i64.add (get_local $f2g5) (i64.add (get_local $f3g4) (i64.add (get_local $f4g3) (i64.add (get_local $f5g2) (i64.add (get_local $f6g1) (i64.add (get_local $f7g0) (i64.add (get_local $f8g9_19) (get_local $f9g8_19)))))))))))
+    (set_local $h8 (i64.add (get_local $f0g8) (i64.add (get_local $f1g7_2) (i64.add (get_local $f2g6) (i64.add (get_local $f3g5_2) (i64.add (get_local $f4g4) (i64.add (get_local $f5g3_2) (i64.add (get_local $f6g2) (i64.add (get_local $f7g1_2) (i64.add (get_local $f8g0) (get_local $f9g9_38)))))))))))
+    (set_local $h9 (i64.add (get_local $f0g9) (i64.add (get_local $f1g8) (i64.add (get_local $f2g7) (i64.add (get_local $f3g6) (i64.add (get_local $f4g5) (i64.add (get_local $f5g4) (i64.add (get_local $f6g3) (i64.add (get_local $f7g2) (i64.add (get_local $f8g1) (get_local $f9g0)))))))))))
+
+    (set_local $carry0 (i64.shr_s (i64.add (get_local $h0) (i64.shl (i64.const 1) (i64.const 25))) (i64.const 26)))
+    (set_local $h1 (i64.add (get_local $h1) (get_local $carry0)))
+    (set_local $h0 (i64.sub (get_local $h0) (i64.mul (get_local $carry0) (i64.shl (i64.const 1) (i64.const 26)))))
+    (set_local $carry4 (i64.shr_s (i64.add (get_local $h4) (i64.shl (i64.const 1) (i64.const 25))) (i64.const 26)))
+    (set_local $h5 (i64.add (get_local $h5) (get_local $carry4)))
+    (set_local $h4 (i64.sub (get_local $h4) (i64.mul (get_local $carry4) (i64.shl (i64.const 1) (i64.const 26)))))
+
+    (set_local $carry1 (i64.shr_s (i64.add (get_local $h1) (i64.shl (i64.const 1) (i64.const 24))) (i64.const 25)))
+    (set_local $h2 (i64.add (get_local $h2) (get_local $carry1)))
+    (set_local $h1 (i64.sub (get_local $h1) (i64.mul (get_local $carry1) (i64.shl (i64.const 1) (i64.const 25)))))
+    (set_local $carry5 (i64.shr_s (i64.add (get_local $h5) (i64.shl (i64.const 1) (i64.const 24))) (i64.const 25)))
+    (set_local $h6 (i64.add (get_local $h6) (get_local $carry5)))
+    (set_local $h5 (i64.sub (get_local $h5) (i64.mul (get_local $carry5) (i64.shl (i64.const 1) (i64.const 25)))))
+
+    (set_local $carry2 (i64.shr_s (i64.add (get_local $h2) (i64.shl (i64.const 1) (i64.const 25))) (i64.const 26)))
+    (set_local $h3 (i64.add (get_local $h3) (get_local $carry2)))
+    (set_local $h2 (i64.sub (get_local $h2) (i64.mul (get_local $carry2) (i64.shl (i64.const 1) (i64.const 26)))))
+    (set_local $carry6 (i64.shr_s (i64.add (get_local $h6) (i64.shl (i64.const 1) (i64.const 25))) (i64.const 26)))
+    (set_local $h7 (i64.add (get_local $h7) (get_local $carry6)))
+    (set_local $h6 (i64.sub (get_local $h6) (i64.mul (get_local $carry6) (i64.shl (i64.const 1) (i64.const 26)))))
+
+    (set_local $carry3 (i64.shr_s (i64.add (get_local $h3) (i64.shl (i64.const 1) (i64.const 24))) (i64.const 25)))
+    (set_local $h4 (i64.add (get_local $h4) (get_local $carry3)))
+    (set_local $h3 (i64.sub (get_local $h3) (i64.mul (get_local $carry3) (i64.shl (i64.const 1) (i64.const 25)))))
+    (set_local $carry7 (i64.shr_s (i64.add (get_local $h7) (i64.shl (i64.const 1) (i64.const 24))) (i64.const 25)))
+    (set_local $h8 (i64.add (get_local $h8) (get_local $carry7)))
+    (set_local $h7 (i64.sub (get_local $h7) (i64.mul (get_local $carry7) (i64.shl (i64.const 1) (i64.const 25)))))
+
+    (set_local $carry4 (i64.shr_s (i64.add (get_local $h4) (i64.shl (i64.const 1) (i64.const 25))) (i64.const 26)))
+    (set_local $h5 (i64.add (get_local $h5) (get_local $carry4)))
+    (set_local $h4 (i64.sub (get_local $h4) (i64.mul (get_local $carry4) (i64.shl (i64.const 1) (i64.const 26)))))
+    (set_local $carry8 (i64.shr_s (i64.add (get_local $h8) (i64.shl (i64.const 1) (i64.const 25))) (i64.const 26)))
+    (set_local $h9 (i64.add (get_local $h9) (get_local $carry8)))
+    (set_local $h8 (i64.sub (get_local $h8) (i64.mul (get_local $carry8) (i64.shl (i64.const 1) (i64.const 26)))))
+
+    (set_local $carry9 (i64.shr_s (i64.add (get_local $h9) (i64.shl (i64.const 1) (i64.const 24))) (i64.const 25)))
+    (set_local $h0 (i64.add (get_local $h0) (i64.mul (get_local $carry9) (i64.const 19))))
+    (set_local $h9 (i64.sub (get_local $h9) (i64.mul (get_local $carry9) (i64.shl (i64.const 1) (i64.const 25)))))
+
+    (set_local $carry0 (i64.shr_s (i64.add (get_local $h0) (i64.shl (i64.const 1) (i64.const 25))) (i64.const 26)))
+    (set_local $h1 (i64.add (get_local $h1) (get_local $carry0)))
+    (set_local $h0 (i64.sub (get_local $h0) (i64.mul (get_local $carry0) (i64.shl (i64.const 1) (i64.const 26)))))
+
+    (i64.store32 offset=0  (get_local $h) (get_local $h0))
+    (i64.store32 offset=4  (get_local $h) (get_local $h1))
+    (i64.store32 offset=8  (get_local $h) (get_local $h2))
+    (i64.store32 offset=12 (get_local $h) (get_local $h3))
+    (i64.store32 offset=16 (get_local $h) (get_local $h4))
+    (i64.store32 offset=20 (get_local $h) (get_local $h5))
+    (i64.store32 offset=24 (get_local $h) (get_local $h6))
+    (i64.store32 offset=28 (get_local $h) (get_local $h7))
+    (i64.store32 offset=32 (get_local $h) (get_local $h8))
+    (i64.store32 offset=36 (get_local $h) (get_local $h9)))
+
+  (func $fe25519_mul (export "fe25519_mul") (param $h i32) (param $f i32) (param $g i32)
+    (i64.load32_u offset=0  (get_local $f))
+    (i64.load32_u offset=4  (get_local $f))
+    (i64.load32_u offset=8  (get_local $f))
+    (i64.load32_u offset=12 (get_local $f))
+    (i64.load32_u offset=16 (get_local $f))
+    (i64.load32_u offset=20 (get_local $f))
+    (i64.load32_u offset=24 (get_local $f))
+    (i64.load32_u offset=28 (get_local $f))
+    (i64.load32_u offset=32 (get_local $f))
+    (i64.load32_u offset=36 (get_local $f))
+    (i64.load32_u offset=0  (get_local $g))
+    (i64.load32_u offset=4  (get_local $g))
+    (i64.load32_u offset=8  (get_local $g))
+    (i64.load32_u offset=12 (get_local $g))
+    (i64.load32_u offset=16 (get_local $g))
+    (i64.load32_u offset=20 (get_local $g))
+    (i64.load32_u offset=24 (get_local $g))
+    (i64.load32_u offset=28 (get_local $g))
+    (i64.load32_u offset=32 (get_local $g))
+    (i64.load32_u offset=36 (get_local $g))
+    (get_local $h)
+    (call $fe_mul)))

fe25519_25/fe25519_mul32.js

@@ -0,0 +1,61 @@
+
+module.exports = loadWebAssembly
+
+loadWebAssembly.supported = typeof WebAssembly !== 'undefined'
+
+function loadWebAssembly (opts) {
+  if (!loadWebAssembly.supported) return null
+
+  var imp = opts && opts.imports
+  var wasm = toUint8Array('AGFzbQEAAAABFgJgDH5+fn5+fn5+fn5/fwBgA39/fwADAwIAAQUDAQABBxoCBm1lbW9yeQIADWZlMjU1MTlfbXVsMzIAAQrcBAKeBAEVfiAKrCEMIACnrCEAIAGnrCEBIAKnrCECIAOnrCEDIASnrCEEIAWnrCEFIAanrCEGIAenrCEHIAinrCEIIAmnrCEJIAAgDH4hDSABIAx+IQ4gAiAMfiEPIAMgDH4hECAEIAx+IREgBSAMfiESIAYgDH4hEyAHIAx+IRQgCCAMfiEVIAkgDH4hFiAWQgFCGIZ8QhmHISAgDSAgQhN+fCENIBYgIEIBQhmGfn0hFiAOQgFCGIZ8QhmHIRggDyAYfCEPIA4gGEIBQhmGfn0hDiAQQgFCGIZ8QhmHIRogESAafCERIBAgGkIBQhmGfn0hECASQgFCGIZ8QhmHIRwgEyAcfCETIBIgHEIBQhmGfn0hEiAUQgFCGIZ8QhmHIR4gFSAefCEVIBQgHkIBQhmGfn0hFCANQgFCGYZ8QhqHIRcgDiAXfCEOIA0gF0IBQhqGfn0hDSAPQgFCGYZ8QhqHIRkgECAZfCEQIA8gGUIBQhqGfn0hDyARQgFCGYZ8QhqHIRsgEiAbfCESIBEgG0IBQhqGfn0hESATQgFCGYZ8QhqHIR0gFCAdfCEUIBMgHUIBQhqGfn0hEyAVQgFCGYZ8QhqHIR8gFiAffCEWIBUgH0IBQhqGfn0hFSALIA0+AgAgCyAOPgIEIAsgDz4CCCALIBA+AgwgCyARPgIQIAsgEj4CFCALIBM+AhggCyAUPgIcIAsgFT4CICALIBY+AiQLOgAgATUCACABNQIEIAE1AgggATUCDCABNQIQIAE1AhQgATUCGCABNQIcIAE1AiAgATUCJCACIAAQAAs=')
+  var ready = null
+
+  var mod = {
+    buffer: wasm,
+    memory: null,
+    exports: null,
+    realloc: realloc,
+    onload: onload
+  }
+
+  onload(function () {})
+
+  return mod
+
+  function realloc (size) {
+    mod.exports.memory.grow(Math.max(0, Math.ceil(Math.abs(size - mod.memory.length) / 65536)))
+    mod.memory = new Uint8Array(mod.exports.memory.buffer)
+  }
+
+  function onload (cb) {
+    if (mod.exports) return cb()
+
+    if (ready) {
+      ready.then(cb.bind(null, null)).catch(cb)
+      return
+    }
+
+    try {
+      if (opts && opts.async) throw new Error('async')
+      setup({instance: new WebAssembly.Instance(new WebAssembly.Module(wasm), imp)})
+    } catch (err) {
+      ready = WebAssembly.instantiate(wasm, imp).then(setup)
+    }
+
+    onload(cb)
+  }
+
+  function setup (w) {
+    mod.exports = w.instance.exports
+    mod.memory = mod.exports.memory && mod.exports.memory.buffer && new Uint8Array(mod.exports.memory.buffer)
+  }
+}
+
+function toUint8Array (s) {
+  if (typeof atob === 'function') return new Uint8Array(atob(s).split('').map(charCodeAt))
+  return (require('buf' + 'fer').Buffer).from(s, 'base64')
+}
+
+function charCodeAt (c) {
+  return c.charCodeAt(0)
+}

fe25519_25/fe25519_mul32.wat

@@ -0,0 +1,161 @@
+(module
+  (memory $0 1)
+  (export "memory" (memory $0))
+
+  ;; (func $i32.log (import "debug" "log") (param i32))
+  ;; (func $i32.log_tee (import "debug" "log_tee") (param i32) (result i32))
+  ;; ;; No i64 interop with JS yet - but maybe coming with WebAssembly BigInt
+  ;; ;; So we can instead fake this by splitting the i64 into two i32 limbs,
+  ;; ;; however these are WASM functions using i32x2.log:
+  ;; (func $i32x2.log (import "debug" "log") (param i32) (param i32))
+  ;; (func $f32.log (import "debug" "log") (param f32))
+  ;; (func $f32.log_tee (import "debug" "log_tee") (param f32) (result f32))
+  ;; (func $f64.log (import "debug" "log") (param f64))
+  ;; (func $f64.log_tee (import "debug" "log_tee") (param f64) (result f64))  
+  
+  ;; ;; i64 logging by splitting into two i32 limbs
+  ;; (func $i64.log
+  ;;   (param $0 i64)
+  ;;   (call $i32x2.log
+  ;;     ;; Upper limb
+  ;;     (i32.wrap/i64
+  ;;       (i64.shr_s (get_local $0)
+  ;;         (i64.const 32)))
+  ;;     ;; Lower limb
+  ;;     (i32.wrap/i64 (get_local $0))))
+
+  ;; (func $i64.log_tee
+  ;;   (param $0 i64)
+  ;;   (result i64)
+  ;;   (call $i64.log (get_local $0))
+  ;;   (return (get_local $0)))
+
+  (func $fe_mul32
+    (param $f0 i64)
+    (param $f1 i64)
+    (param $f2 i64)
+    (param $f3 i64)
+    (param $f4 i64)
+    (param $f5 i64)
+    (param $f6 i64)
+    (param $f7 i64)
+    (param $f8 i64)
+    (param $f9 i64)
+
+    (param $n i32)
+
+    (param $h i32)
+
+    (local $sn i64)
+
+    (local $h0 i64)
+    (local $h1 i64)
+    (local $h2 i64)
+    (local $h3 i64)
+    (local $h4 i64)
+    (local $h5 i64)
+    (local $h6 i64)
+    (local $h7 i64)
+    (local $h8 i64)
+    (local $h9 i64)
+    
+    (local $carry0 i64)
+    (local $carry1 i64)
+    (local $carry2 i64)
+    (local $carry3 i64)
+    (local $carry4 i64)
+    (local $carry5 i64)
+    (local $carry6 i64)
+    (local $carry7 i64)
+    (local $carry8 i64)
+    (local $carry9 i64)
+
+    (set_local $sn (i64.extend_s/i32 (get_local $n)))
+
+    (set_local $f0 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f0))))
+    (set_local $f1 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f1))))
+    (set_local $f2 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f2))))
+    (set_local $f3 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f3))))
+    (set_local $f4 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f4))))
+    (set_local $f5 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f5))))
+    (set_local $f6 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f6))))
+    (set_local $f7 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f7))))
+    (set_local $f8 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f8))))
+    (set_local $f9 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f9))))
+
+    (set_local $h0 (i64.mul (get_local $f0) (get_local $sn)))
+    (set_local $h1 (i64.mul (get_local $f1) (get_local $sn)))
+    (set_local $h2 (i64.mul (get_local $f2) (get_local $sn)))
+    (set_local $h3 (i64.mul (get_local $f3) (get_local $sn)))
+    (set_local $h4 (i64.mul (get_local $f4) (get_local $sn)))
+    (set_local $h5 (i64.mul (get_local $f5) (get_local $sn)))
+    (set_local $h6 (i64.mul (get_local $f6) (get_local $sn)))
+    (set_local $h7 (i64.mul (get_local $f7) (get_local $sn)))
+    (set_local $h8 (i64.mul (get_local $f8) (get_local $sn)))
+    (set_local $h9 (i64.mul (get_local $f9) (get_local $sn)))
+
+    (set_local $carry9 (i64.shr_s (i64.add (get_local $h9) (i64.shl (i64.const 1) (i64.const 24))) (i64.const 25)))
+    (set_local $h0 (i64.add (get_local $h0) (i64.mul (get_local $carry9) (i64.const 19))))
+    (set_local $h9 (i64.sub (get_local $h9) (i64.mul (get_local $carry9) (i64.shl (i64.const 1) (i64.const 25)))))
+
+    (set_local $carry1 (i64.shr_s (i64.add (get_local $h1) (i64.shl (i64.const 1) (i64.const 24))) (i64.const 25)))
+    (set_local $h2 (i64.add (get_local $h2) (get_local $carry1)))
+    (set_local $h1 (i64.sub (get_local $h1) (i64.mul (get_local $carry1) (i64.shl (i64.const 1) (i64.const 25)))))
+
+    (set_local $carry3 (i64.shr_s (i64.add (get_local $h3) (i64.shl (i64.const 1) (i64.const 24))) (i64.const 25)))
+    (set_local $h4 (i64.add (get_local $h4) (get_local $carry3)))
+    (set_local $h3 (i64.sub (get_local $h3) (i64.mul (get_local $carry3) (i64.shl (i64.const 1) (i64.const 25)))))
+
+    (set_local $carry5 (i64.shr_s (i64.add (get_local $h5) (i64.shl (i64.const 1) (i64.const 24))) (i64.const 25)))
+    (set_local $h6 (i64.add (get_local $h6) (get_local $carry5)))
+    (set_local $h5 (i64.sub (get_local $h5) (i64.mul (get_local $carry5) (i64.shl (i64.const 1) (i64.const 25)))))
+
+    (set_local $carry7 (i64.shr_s (i64.add (get_local $h7) (i64.shl (i64.const 1) (i64.const 24))) (i64.const 25)))
+    (set_local $h8 (i64.add (get_local $h8) (get_local $carry7)))
+    (set_local $h7 (i64.sub (get_local $h7) (i64.mul (get_local $carry7) (i64.shl (i64.const 1) (i64.const 25)))))
+
+    (set_local $carry0 (i64.shr_s (i64.add (get_local $h0) (i64.shl (i64.const 1) (i64.const 25))) (i64.const 26)))
+    (set_local $h1 (i64.add (get_local $h1) (get_local $carry0)))
+    (set_local $h0 (i64.sub (get_local $h0) (i64.mul (get_local $carry0) (i64.shl (i64.const 1) (i64.const 26)))))
+
+    (set_local $carry2 (i64.shr_s (i64.add (get_local $h2) (i64.shl (i64.const 1) (i64.const 25))) (i64.const 26)))
+    (set_local $h3 (i64.add (get_local $h3) (get_local $carry2)))
+    (set_local $h2 (i64.sub (get_local $h2) (i64.mul (get_local $carry2) (i64.shl (i64.const 1) (i64.const 26)))))
+
+    (set_local $carry4 (i64.shr_s (i64.add (get_local $h4) (i64.shl (i64.const 1) (i64.const 25))) (i64.const 26)))
+    (set_local $h5 (i64.add (get_local $h5) (get_local $carry4)))
+    (set_local $h4 (i64.sub (get_local $h4) (i64.mul (get_local $carry4) (i64.shl (i64.const 1) (i64.const 26)))))
+
+    (set_local $carry6 (i64.shr_s (i64.add (get_local $h6) (i64.shl (i64.const 1) (i64.const 25))) (i64.const 26)))
+    (set_local $h7 (i64.add (get_local $h7) (get_local $carry6)))
+    (set_local $h6 (i64.sub (get_local $h6) (i64.mul (get_local $carry6) (i64.shl (i64.const 1) (i64.const 26)))))
+
+    (set_local $carry8 (i64.shr_s (i64.add (get_local $h8) (i64.shl (i64.const 1) (i64.const 25))) (i64.const 26)))
+    (set_local $h9 (i64.add (get_local $h9) (get_local $carry8)))
+    (set_local $h8 (i64.sub (get_local $h8) (i64.mul (get_local $carry8) (i64.shl (i64.const 1) (i64.const 26)))))
+
+    (i64.store32 offset=0  (get_local $h) (get_local $h0))
+    (i64.store32 offset=4  (get_local $h) (get_local $h1))
+    (i64.store32 offset=8  (get_local $h) (get_local $h2))
+    (i64.store32 offset=12 (get_local $h) (get_local $h3))
+    (i64.store32 offset=16 (get_local $h) (get_local $h4))
+    (i64.store32 offset=20 (get_local $h) (get_local $h5))
+    (i64.store32 offset=24 (get_local $h) (get_local $h6))
+    (i64.store32 offset=28 (get_local $h) (get_local $h7))
+    (i64.store32 offset=32 (get_local $h) (get_local $h8))
+    (i64.store32 offset=36 (get_local $h) (get_local $h9)))
+
+  (func $fe25519_mul32 (export "fe25519_mul32") (param $h i32) (param $f i32) (param $n i32)
+    (i64.load32_u offset=0  (get_local $f))
+    (i64.load32_u offset=4  (get_local $f))
+    (i64.load32_u offset=8  (get_local $f))
+    (i64.load32_u offset=12 (get_local $f))
+    (i64.load32_u offset=16 (get_local $f))
+    (i64.load32_u offset=20 (get_local $f))
+    (i64.load32_u offset=24 (get_local $f))
+    (i64.load32_u offset=28 (get_local $f))
+    (i64.load32_u offset=32 (get_local $f))
+    (i64.load32_u offset=36 (get_local $f))
+    (get_local $n)
+    (get_local $h)
+    (call $fe_mul32)))

fe25519_25/fe25519_sq.js

@@ -0,0 +1,61 @@
+
+module.exports = loadWebAssembly
+
+loadWebAssembly.supported = typeof WebAssembly !== 'undefined'
+
+function loadWebAssembly (opts) {
+  if (!loadWebAssembly.supported) return null
+
+  var imp = opts && opts.imports
+  var wasm = toUint8Array('AGFzbQEAAAABQQtgAX8AYAF/AX9gAn9/AGABfQBgAX0BfWABfABgAXwBfGABfgBgAX4BfmANfn5+fn5+fn5+fn9/fwBgBH9/f38AAngJAmpzBXRhYmxlAXAAAQJqcwNtZW0CAAEFZGVidWcDbG9nAAAFZGVidWcHbG9nX3RlZQABBWRlYnVnA2xvZwACBWRlYnVnA2xvZwADBWRlYnVnB2xvZ190ZWUABAVkZWJ1ZwNsb2cABQVkZWJ1Zwdsb2dfdGVlAAYDBQQHCAkKBwYBAnNxAAoJBwEAQQILAQkK3goEDQAgAEIgh6cgAKcQAgsJACAAEAcgAA8LhgoCAX9ZfgJAA0AgAKesIQAgAaesIQEgAqesIQIgA6esIQMgBKesIQQgBaesIQUgBqesIQYgB6esIQcgCKesIQggCaesIQkgAEICfiEjIAFCAn4hJCACQgJ+ISUgA0ICfiEmIARCAn4hJyAFQgJ+ISggBkICfiEpIAdCAn4hKiAFQiZ+ISsgBkITfiEsIAdCJn4hLSAIQhN+IS4gCUImfiEvIAAgAH4hMCAjIAF+ITEgIyACfiEyICMgA34hMyAjIAR+ITQgIyAFfiE1ICMgBn4hNiAjIAd+ITcgIyAIfiE4ICMgCX4hOSAkIAF+ITogJCACfiE7ICQgJn4hPCAkIAR+IT0gJCAofiE+ICQgBn4hPyAkICp+IUAgJCAIfiFBICQgL34hQiACIAJ+IUMgJSADfiFEICUgBH4hRSAlIAV+IUYgJSAGfiFHICUgB34hSCAlIC5+IUkgAiAvfiFKICYgA34hSyAmIAR+IUwgJiAofiFNICYgBn4hTiAmIC1+IU8gJiAufiFQICYgL34hUSAEIAR+IVIgJyAFfiFTICcgLH4hVCAEIC1+IVUgJyAufiFWIAQgL34hVyAFICt+IVggKCAsfiFZICggLX4hWiAoIC5+IVsgKCAvfiFcIAYgLH4hXSAGIC1+IV4gKSAufiFfIAYgL34hYCAHIC1+IWEgKiAufiFiICogL34hYyAIIC5+IWQgCCAvfiFlIAkgL34hZiAwIEIgSSBPIFQgWHx8fHx8IQ8gMSBKIFAgVSBZfHx8fCEQIDIgOiBRIFYgWiBdfHx8fHwhESAzIDsgVyBbIF58fHx8IRIgNCA8IEMgXCBfIGF8fHx8fCETIDUgPSBEIGAgYnx8fHwhFCA2ID4gRSBLIGMgZHx8fHx8IRUgNyA/IEYgTCBlfHx8fCEWIDggQCBHIE0gUiBmfHx8fHwhFyA5IEEgSCBOIFN8fHx8IRggDSALRg0BIA1BAWohDQwACwsgCkEBRgRAIA8gD3whDyAQIBB8IRAgESARfCERIBIgEnwhEiATIBN8IRMgFCAUfCEUIBUgFXwhFSAWIBZ8IRYgFyAXfCEXIBggGHwhGAsgD0IBQhmGfEIahyEZIBAgGXwhECAPIBlCAUIahn59IQ8gE0IBQhmGfEIahyEdIBQgHXwhFCATIB1CAUIahn59IRMgEEIBQhiGfEIZhyEaIBEgGnwhESAQIBpCAUIZhn59IRAgFEIBQhiGfEIZhyEeIBUgHnwhFSAUIB5CAUIZhn59IRQgEUIBQhmGfEIahyEbIBIgG3whEiARIBtCAUIahn59IREgFUIBQhmGfEIahyEfIBYgH3whFiAVIB9CAUIahn59IRUgEkIBQhiGfEIZhyEcIBMgHHwhEyASIBxCAUIZhn59IRIgFkIBQhiGfEIZhyEgIBcgIHwhFyAWICBCAUIZhn59IRYgE0IBQhmGfEIahyEdIBQgHXwhFCATIB1CAUIahn59IRMgF0IBQhmGfEIahyEhIBggIXwhGCAXICFCAUIahn59IRcgGEIBQhiGfEIZhyEiIA8gIkITfnwhDyAYICJCAUIZhn59IRggD0IBQhmGfEIahyEZIBAgGXwhECAPIBlCAUIahn59IQ8gDCAPPgIAIAwgED4CBCAMIBE+AgggDCASPgIMIAwgEz4CECAMIBQ+AhQgDCAVPgIYIAwgFj4CHCAMIBc+AiAgDCAYPgIkCzwAIAE1AgAgATUCBCABNQIIIAE1AgwgATUCECABNQIUIAE1AhggATUCHCABNQIgIAE1AiQgAiADIAAQCQs=')
+  var ready = null
+
+  var mod = {
+    buffer: wasm,
+    memory: null,
+    exports: null,
+    realloc: realloc,
+    onload: onload
+  }
+
+  onload(function () {})
+
+  return mod
+
+  function realloc (size) {
+    mod.exports.memory.grow(Math.max(0, Math.ceil(Math.abs(size - mod.memory.length) / 65536)))
+    mod.memory = new Uint8Array(mod.exports.memory.buffer)
+  }
+
+  function onload (cb) {
+    if (mod.exports) return cb()
+
+    if (ready) {
+      ready.then(cb.bind(null, null)).catch(cb)
+      return
+    }
+
+    try {
+      if (opts && opts.async) throw new Error('async')
+      setup({instance: new WebAssembly.Instance(new WebAssembly.Module(wasm), imp)})
+    } catch (err) {
+      ready = WebAssembly.instantiate(wasm, imp).then(setup)
+    }
+
+    onload(cb)
+  }
+
+  function setup (w) {
+    mod.exports = w.instance.exports
+    mod.memory = mod.exports.memory && mod.exports.memory.buffer && new Uint8Array(mod.exports.memory.buffer)
+  }
+}
+
+function toUint8Array (s) {
+  if (typeof atob === 'function') return new Uint8Array(atob(s).split('').map(charCodeAt))
+  return (require('buf' + 'fer').Buffer).from(s, 'base64')
+}
+
+function charCodeAt (c) {
+  return c.charCodeAt(0)
+}

fe25519_25/fe25519_sq.wat

@@ -0,0 +1,328 @@
+(module
+  (import "js" "table" (table 1 anyfunc))
+  (import "js" "mem" (memory 1))
+
+  (elem (i32.const 2) $fe_sq)
+
+  (func $i32.log (import "debug" "log") (param i32))
+  (func $i32.log_tee (import "debug" "log_tee") (param i32) (result i32))
+  ;; No i64 interop with JS yet - but maybe coming with WebAssembly BigInt
+  ;; So we can instead fake this by splitting the i64 into two i32 limbs,
+  ;; however these are WASM functions using i32x2.log:
+  (func $i32x2.log (import "debug" "log") (param i32) (param i32))
+  (func $f32.log (import "debug" "log") (param f32))
+  (func $f32.log_tee (import "debug" "log_tee") (param f32) (result f32))
+  (func $f64.log (import "debug" "log") (param f64))
+  (func $f64.log_tee (import "debug" "log_tee") (param f64) (result f64))
+  
+  ;; i64 logging by splitting into two i32 limbs
+  (func $i64.log
+    (param $0 i64)
+    (call $i32x2.log
+      ;; Upper limb
+      (i32.wrap/i64
+        (i64.shr_s (get_local $0)
+          (i64.const 32)))
+      ;; Lower limb
+      (i32.wrap/i64 (get_local $0))))
+
+  (func $i64.log_tee
+    (param $0 i64)
+    (result i64)
+    (call $i64.log (get_local $0))
+    (return (get_local $0)))
+
+  (func $fe_sq 
+    (param $f0 i64)
+    (param $f1 i64)
+    (param $f2 i64)
+    (param $f3 i64)
+    (param $f4 i64)
+    (param $f5 i64)
+    (param $f6 i64)
+    (param $f7 i64)
+    (param $f8 i64)
+    (param $f9 i64)
+    
+    (param $double i32)
+    (param $repeat i32)
+
+    (param $h i32)
+
+    (local $count i32)
+    (local $tmp i64)
+
+    (local $h0 i64)
+    (local $h1 i64)
+    (local $h2 i64)
+    (local $h3 i64)
+    (local $h4 i64)
+    (local $h5 i64)
+    (local $h6 i64)
+    (local $h7 i64)
+    (local $h8 i64)
+    (local $h9 i64)
+    
+    (local $carry0 i64)
+    (local $carry1 i64)
+    (local $carry2 i64)
+    (local $carry3 i64)
+    (local $carry4 i64)
+    (local $carry5 i64)
+    (local $carry6 i64)
+    (local $carry7 i64)
+    (local $carry8 i64)
+    (local $carry9 i64)
+
+    (local $f0_2 i64)
+    (local $f1_2 i64)
+    (local $f2_2 i64)
+    (local $f3_2 i64)
+    (local $f4_2 i64)
+    (local $f5_2 i64)
+    (local $f6_2 i64)
+    (local $f7_2 i64)
+
+    (local $f5_38 i64)
+    (local $f6_19 i64)
+    (local $f7_38 i64)
+    (local $f8_19 i64)
+    (local $f9_38 i64)
+
+    (local $f0f0 i64)
+    (local $f0f1_2 i64)
+    (local $f0f2_2 i64)
+    (local $f0f3_2 i64)
+    (local $f0f4_2 i64)
+    (local $f0f5_2 i64)
+    (local $f0f6_2 i64)
+    (local $f0f7_2 i64)
+    (local $f0f8_2 i64)
+    (local $f0f9_2 i64)
+    (local $f1f1_2 i64)
+    (local $f1f2_2 i64)
+    (local $f1f3_4 i64)
+    (local $f1f4_2 i64)
+    (local $f1f5_4 i64)
+    (local $f1f6_2 i64)
+    (local $f1f7_4 i64)
+    (local $f1f8_2 i64)
+    (local $f1f9_76 i64)
+    (local $f2f2 i64)
+    (local $f2f3_2 i64)
+    (local $f2f4_2 i64)
+    (local $f2f5_2 i64)
+    (local $f2f6_2 i64)
+    (local $f2f7_2 i64)
+    (local $f2f8_38 i64)
+    (local $f2f9_38 i64)
+    (local $f3f3_2 i64)
+    (local $f3f4_2 i64)
+    (local $f3f5_4 i64)
+    (local $f3f6_2 i64)
+    (local $f3f7_76 i64)
+    (local $f3f8_38 i64)
+    (local $f3f9_76 i64)
+    (local $f4f4 i64)
+    (local $f4f5_2 i64)
+    (local $f4f6_38 i64)
+    (local $f4f7_38 i64)
+    (local $f4f8_38 i64)
+    (local $f4f9_38 i64)
+    (local $f5f5_38 i64)
+    (local $f5f6_38 i64)
+    (local $f5f7_76 i64)
+    (local $f5f8_38 i64)
+    (local $f5f9_76 i64)
+    (local $f6f6_19 i64)
+    (local $f6f7_38 i64)
+    (local $f6f8_38 i64)
+    (local $f6f9_38 i64)
+    (local $f7f7_38 i64)
+    (local $f7f8_38 i64)
+    (local $f7f9_76 i64)
+    (local $f8f8_19 i64)
+    (local $f8f9_38 i64)
+    (local $f9f9_38 i64)
+
+    (block $end
+        (loop $again
+            (set_local $f0 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f0))))
+            (set_local $f1 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f1))))
+            (set_local $f2 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f2))))
+            (set_local $f3 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f3))))
+            (set_local $f4 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f4))))
+            (set_local $f5 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f5))))
+            (set_local $f6 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f6))))
+            (set_local $f7 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f7))))
+            (set_local $f8 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f8))))
+            (set_local $f9 (i64.extend_s/i32 (i32.wrap/i64 (get_local $f9))))
+
+            (set_local $f0_2 (i64.mul (i64.const 2 (get_local $f0))))
+            (set_local $f1_2 (i64.mul (i64.const 2 (get_local $f1))))
+            (set_local $f2_2 (i64.mul (i64.const 2 (get_local $f2))))
+            (set_local $f3_2 (i64.mul (i64.const 2 (get_local $f3))))
+            (set_local $f4_2 (i64.mul (i64.const 2 (get_local $f4))))
+            (set_local $f5_2 (i64.mul (i64.const 2 (get_local $f5))))
+            (set_local $f6_2 (i64.mul (i64.const 2 (get_local $f6))))
+            (set_local $f7_2 (i64.mul (i64.const 2 (get_local $f7))))
+
+            (set_local $f5_38 (i64.mul (i64.const 38 (get_local $f5))))
+            (set_local $f6_19 (i64.mul (i64.const 19 (get_local $f6))))
+            (set_local $f7_38 (i64.mul (i64.const 38 (get_local $f7))))
+            (set_local $f8_19 (i64.mul (i64.const 19 (get_local $f8))))
+            (set_local $f9_38 (i64.mul (i64.const 38 (get_local $f9))))
+            
+            (set_local $f0f0    (i64.mul (get_local $f0)   (get_local $f0)))
+            (set_local $f0f1_2  (i64.mul (get_local $f0_2) (get_local $f1)))
+            (set_local $f0f2_2  (i64.mul (get_local $f0_2) (get_local $f2)))
+            (set_local $f0f3_2  (i64.mul (get_local $f0_2) (get_local $f3)))
+            (set_local $f0f4_2  (i64.mul (get_local $f0_2) (get_local $f4)))
+            (set_local $f0f5_2  (i64.mul (get_local $f0_2) (get_local $f5)))
+            (set_local $f0f6_2  (i64.mul (get_local $f0_2) (get_local $f6)))
+            (set_local $f0f7_2  (i64.mul (get_local $f0_2) (get_local $f7)))
+            (set_local $f0f8_2  (i64.mul (get_local $f0_2) (get_local $f8)))
+            (set_local $f0f9_2  (i64.mul (get_local $f0_2) (get_local $f9)))
+            (set_local $f1f1_2  (i64.mul (get_local $f1_2) (get_local $f1)))
+            (set_local $f1f2_2  (i64.mul (get_local $f1_2) (get_local $f2)))
+            (set_local $f1f3_4  (i64.mul (get_local $f1_2) (get_local $f3_2)))
+            (set_local $f1f4_2  (i64.mul (get_local $f1_2) (get_local $f4)))
+            (set_local $f1f5_4  (i64.mul (get_local $f1_2) (get_local $f5_2)))
+            (set_local $f1f6_2  (i64.mul (get_local $f1_2) (get_local $f6)))
+            (set_local $f1f7_4  (i64.mul (get_local $f1_2) (get_local $f7_2)))
+            (set_local $f1f8_2  (i64.mul (get_local $f1_2) (get_local $f8)))
+            (set_local $f1f9_76 (i64.mul (get_local $f1_2) (get_local $f9_38)))
+            (set_local $f2f2    (i64.mul (get_local $f2)   (get_local $f2)))
+            (set_local $f2f3_2  (i64.mul (get_local $f2_2) (get_local $f3)))
+            (set_local $f2f4_2  (i64.mul (get_local $f2_2) (get_local $f4)))
+            (set_local $f2f5_2  (i64.mul (get_local $f2_2) (get_local $f5)))
+            (set_local $f2f6_2  (i64.mul (get_local $f2_2) (get_local $f6)))
+            (set_local $f2f7_2  (i64.mul (get_local $f2_2) (get_local $f7)))
+            (set_local $f2f8_38 (i64.mul (get_local $f2_2) (get_local $f8_19)))
+            (set_local $f2f9_38 (i64.mul (get_local $f2) (get_local $f9_38)))
+            (set_local $f3f3_2  (i64.mul (get_local $f3_2) (get_local $f3)))
+            (set_local $f3f4_2  (i64.mul (get_local $f3_2) (get_local $f4)))
+            (set_local $f3f5_4  (i64.mul (get_local $f3_2) (get_local $f5_2)))
+            (set_local $f3f6_2  (i64.mul (get_local $f3_2) (get_local $f6)))
+            (set_local $f3f7_76 (i64.mul (get_local $f3_2) (get_local $f7_38)))
+            (set_local $f3f8_38 (i64.mul (get_local $f3_2) (get_local $f8_19)))
+            (set_local $f3f9_76 (i64.mul (get_local $f3_2) (get_local $f9_38)))
+            (set_local $f4f4    (i64.mul (get_local $f4)   (get_local $f4)))
+            (set_local $f4f5_2  (i64.mul (get_local $f4_2) (get_local $f5)))
+            (set_local $f4f6_38 (i64.mul (get_local $f4_2) (get_local $f6_19)))
+            (set_local $f4f7_38 (i64.mul (get_local $f4)   (get_local $f7_38)))
+            (set_local $f4f8_38 (i64.mul (get_local $f4_2) (get_local $f8_19)))
+            (set_local $f4f9_38 (i64.mul (get_local $f4)   (get_local $f9_38)))
+            (set_local $f5f5_38 (i64.mul (get_local $f5)   (get_local $f5_38)))
+            (set_local $f5f6_38 (i64.mul (get_local $f5_2) (get_local $f6_19)))
+            (set_local $f5f7_76 (i64.mul (get_local $f5_2) (get_local $f7_38)))
+            (set_local $f5f8_38 (i64.mul (get_local $f5_2) (get_local $f8_19)))
+            (set_local $f5f9_76 (i64.mul (get_local $f5_2) (get_local $f9_38)))
+            (set_local $f6f6_19 (i64.mul (get_local $f6)   (get_local $f6_19)))
+            (set_local $f6f7_38 (i64.mul (get_local $f6)   (get_local $f7_38)))
+            (set_local $f6f8_38 (i64.mul (get_local $f6_2) (get_local $f8_19)))
+            (set_local $f6f9_38 (i64.mul (get_local $f6)   (get_local $f9_38)))
+            (set_local $f7f7_38 (i64.mul (get_local $f7)   (get_local $f7_38)))
+            (set_local $f7f8_38 (i64.mul (get_local $f7_2) (get_local $f8_19)))
+            (set_local $f7f9_76 (i64.mul (get_local $f7_2) (get_local $f9_38)))
+            (set_local $f8f8_19 (i64.mul (get_local $f8)   (get_local $f8_19)))
+            (set_local $f8f9_38 (i64.mul (get_local $f8)   (get_local $f9_38)))
+            (set_local $f9f9_38 (i64.mul (get_local $f9)   (get_local $f9_38)))
+
+            (set_local $h0 (i64.add (get_local $f0f0)   (i64.add (get_local $f1f9_76) (i64.add (get_local $f2f8_38) (i64.add (get_local $f3f7_76) (i64.add (get_local $f4f6_38) (get_local $f5f5_38)))))))
+            (set_local $h1 (i64.add (get_local $f0f1_2) (i64.add (get_local $f2f9_38) (i64.add (get_local $f3f8_38) (i64.add (get_local $f4f7_38) (get_local $f5f6_38))))))
+            (set_local $h2 (i64.add (get_local $f0f2_2) (i64.add (get_local $f1f1_2)  (i64.add (get_local $f3f9_76) (i64.add (get_local $f4f8_38) (i64.add (get_local $f5f7_76) (get_local $f6f6_19)))))))
+            (set_local $h3 (i64.add (get_local $f0f3_2) (i64.add (get_local $f1f2_2)  (i64.add (get_local $f4f9_38) (i64.add (get_local $f5f8_38) (get_local $f6f7_38))))))
+            (set_local $h4 (i64.add (get_local $f0f4_2) (i64.add (get_local $f1f3_4)  (i64.add (get_local $f2f2)    (i64.add (get_local $f5f9_76) (i64.add (get_local $f6f8_38) (get_local $f7f7_38)))))))
+            (set_local $h5 (i64.add (get_local $f0f5_2) (i64.add (get_local $f1f4_2)  (i64.add (get_local $f2f3_2)  (i64.add (get_local $f6f9_38) (get_local $f7f8_38))))))
+            (set_local $h6 (i64.add (get_local $f0f6_2) (i64.add (get_local $f1f5_4)  (i64.add (get_local $f2f4_2)  (i64.add (get_local $f3f3_2)  (i64.add (get_local $f7f9_76) (get_local $f8f8_19)))))))
+            (set_local $h7 (i64.add (get_local $f0f7_2) (i64.add (get_local $f1f6_2)  (i64.add (get_local $f2f5_2)  (i64.add (get_local $f3f4_2)  (get_local $f8f9_38))))))
+            (set_local $h8 (i64.add (get_local $f0f8_2) (i64.add (get_local $f1f7_4)  (i64.add (get_local $f2f6_2)  (i64.add (get_local $f3f5_4)  (i64.add (get_local $f4f4)    (get_local $f9f9_38)))))))
+            (set_local $h9 (i64.add (get_local $f0f9_2) (i64.add (get_local $f1f8_2)  (i64.add (get_local $f2f7_2)  (i64.add (get_local $f3f6_2)  (get_local $f4f5_2 ))))))
+
+            (br_if $end (i32.eq (get_local $count) (get_local $repeat)))
+            (set_local $count (i32.add (get_local $count) (i32.const 1)))
+            (br $again)))
+
+    (if (i32.eq (get_local $double) (i32.const 1))
+      (then
+        (set_local $h0 (i64.add (get_local $h0) (get_local $h0)))
+        (set_local $h1 (i64.add (get_local $h1) (get_local $h1)))
+        (set_local $h2 (i64.add (get_local $h2) (get_local $h2)))
+        (set_local $h3 (i64.add (get_local $h3) (get_local $h3)))
+        (set_local $h4 (i64.add (get_local $h4) (get_local $h4)))
+        (set_local $h5 (i64.add (get_local $h5) (get_local $h5)))
+        (set_local $h6 (i64.add (get_local $h6) (get_local $h6)))
+        (set_local $h7 (i64.add (get_local $h7) (get_local $h7)))
+        (set_local $h8 (i64.add (get_local $h8) (get_local $h8)))
+        (set_local $h9 (i64.add (get_local $h9) (get_local $h9)))))
+
+    (set_local $carry0 (i64.shr_s (i64.add (get_local $h0) (i64.shl (i64.const 1) (i64.const 25))) (i64.const 26)))
+    (set_local $h1 (i64.add (get_local $h1) (get_local $carry0)))
+    (set_local $h0 (i64.sub (get_local $h0) (i64.mul (get_local $carry0) (i64.shl (i64.const 1) (i64.const 26)))))
+    (set_local $carry4 (i64.shr_s (i64.add (get_local $h4) (i64.shl (i64.const 1) (i64.const 25))) (i64.const 26)))
+    (set_local $h5 (i64.add (get_local $h5) (get_local $carry4)))
+    (set_local $h4 (i64.sub (get_local $h4) (i64.mul (get_local $carry4) (i64.shl (i64.const 1) (i64.const 26)))))
+
+    (set_local $carry1 (i64.shr_s (i64.add (get_local $h1) (i64.shl (i64.const 1) (i64.const 24))) (i64.const 25)))
+    (set_local $h2 (i64.add (get_local $h2) (get_local $carry1)))
+    (set_local $h1 (i64.sub (get_local $h1) (i64.mul (get_local $carry1) (i64.shl (i64.const 1) (i64.const 25)))))
+    (set_local $carry5 (i64.shr_s (i64.add (get_local $h5) (i64.shl (i64.const 1) (i64.const 24))) (i64.const 25)))
+    (set_local $h6 (i64.add (get_local $h6) (get_local $carry5)))
+    (set_local $h5 (i64.sub (get_local $h5) (i64.mul (get_local $carry5) (i64.shl (i64.const 1) (i64.const 25)))))
+    
+    (set_local $carry2 (i64.shr_s (i64.add (get_local $h2) (i64.shl (i64.const 1) (i64.const 25))) (i64.const 26)))
+    (set_local $h3 (i64.add (get_local $h3) (get_local $carry2)))
+    (set_local $h2 (i64.sub (get_local $h2) (i64.mul (get_local $carry2) (i64.shl (i64.const 1) (i64.const 26)))))
+    (set_local $carry6 (i64.shr_s (i64.add (get_local $h6) (i64.shl (i64.const 1) (i64.const 25))) (i64.const 26)))
+    (set_local $h7 (i64.add (get_local $h7) (get_local $carry6)))
+    (set_local $h6 (i64.sub (get_local $h6) (i64.mul (get_local $carry6) (i64.shl (i64.const 1) (i64.const 26)))))
+
+    (set_local $carry3 (i64.shr_s (i64.add (get_local $h3) (i64.shl (i64.const 1) (i64.const 24))) (i64.const 25)))
+    (set_local $h4 (i64.add (get_local $h4) (get_local $carry3)))
+    (set_local $h3 (i64.sub (get_local $h3) (i64.mul (get_local $carry3) (i64.shl (i64.const 1) (i64.const 25)))))
+    (set_local $carry7 (i64.shr_s (i64.add (get_local $h7) (i64.shl (i64.const 1) (i64.const 24))) (i64.const 25)))
+    (set_local $h8 (i64.add (get_local $h8) (get_local $carry7)))
+    (set_local $h7 (i64.sub (get_local $h7) (i64.mul (get_local $carry7) (i64.shl (i64.const 1) (i64.const 25)))))
+
+    (set_local $carry4 (i64.shr_s (i64.add (get_local $h4) (i64.shl (i64.const 1) (i64.const 25))) (i64.const 26)))
+    (set_local $h5 (i64.add (get_local $h5) (get_local $carry4)))
+    (set_local $h4 (i64.sub (get_local $h4) (i64.mul (get_local $carry4) (i64.shl (i64.const 1) (i64.const 26)))))
+    (set_local $carry8 (i64.shr_s (i64.add (get_local $h8) (i64.shl (i64.const 1) (i64.const 25))) (i64.const 26)))
+    (set_local $h9 (i64.add (get_local $h9) (get_local $carry8)))
+    (set_local $h8 (i64.sub (get_local $h8) (i64.mul (get_local $carry8) (i64.shl (i64.const 1) (i64.const 26)))))
+
+    (set_local $carry9 (i64.shr_s (i64.add (get_local $h9) (i64.shl (i64.const 1) (i64.const 24))) (i64.const 25)))
+    (set_local $h0 (i64.add (get_local $h0) (i64.mul (get_local $carry9) (i64.const 19))))
+    (set_local $h9 (i64.sub (get_local $h9) (i64.mul (get_local $carry9) (i64.shl (i64.const 1) (i64.const 25)))))
+
+    (set_local $carry0 (i64.shr_s (i64.add (get_local $h0) (i64.shl (i64.const 1) (i64.const 25))) (i64.const 26)))
+    (set_local $h1 (i64.add (get_local $h1) (get_local $carry0)))
+    (set_local $h0 (i64.sub (get_local $h0) (i64.mul (get_local $carry0) (i64.shl (i64.const 1) (i64.const 26)))))
+
+    (i64.store32 offset=0  (get_local $h) (get_local $h0))
+    (i64.store32 offset=4  (get_local $h) (get_local $h1))
+    (i64.store32 offset=8  (get_local $h) (get_local $h2))
+    (i64.store32 offset=12 (get_local $h) (get_local $h3))
+    (i64.store32 offset=16 (get_local $h) (get_local $h4))
+    (i64.store32 offset=20 (get_local $h) (get_local $h5))
+    (i64.store32 offset=24 (get_local $h) (get_local $h6))
+    (i64.store32 offset=28 (get_local $h) (get_local $h7))
+    (i64.store32 offset=32 (get_local $h) (get_local $h8))
+    (i64.store32 offset=36 (get_local $h) (get_local $h9)))
+    
+  (func $sq (export "sq")   (param $h i32) (param $f i32) (param $double i32) (param $repeat i32)
+    (i64.load32_u offset=0  (get_local $f))
+    (i64.load32_u offset=4  (get_local $f))
+    (i64.load32_u offset=8  (get_local $f))
+    (i64.load32_u offset=12 (get_local $f))
+    (i64.load32_u offset=16 (get_local $f))
+    (i64.load32_u offset=20 (get_local $f))
+    (i64.load32_u offset=24 (get_local $f))
+    (i64.load32_u offset=28 (get_local $f))
+    (i64.load32_u offset=32 (get_local $f))
+    (i64.load32_u offset=36 (get_local $f))
+    (get_local $double)
+    (get_local $repeat)
+    (get_local $h)
+    (call $fe_sq)))

fe25519_25/sc25519_mul.js

@@ -0,0 +1,61 @@
+
+module.exports = loadWebAssembly
+
+loadWebAssembly.supported = typeof WebAssembly !== 'undefined'
+
+function loadWebAssembly (opts) {
+  if (!loadWebAssembly.supported) return null
+
+  var imp = opts && opts.imports
+  var wasm = toUint8Array('AGFzbQEAAAABIwJgGX9+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn4AYAN/f38AAg4BAmpzBXRhYmxlAXAAAQMCAQEFAwEAAQcYAgZtZW1vcnkCAAtzYzI1NTE5X211bAAACugPAeUPAUh+IAE1AgAhBCABNQIEIQUgATUCCCEGIAE1AgwhByABNQIQIQggATUCFCEJIAE1AhghCiABNQIcIQsgATUCICEMIAE1AiQhDSABNQIoIQ4gATUCLCEPIAI1AgAhECACNQIEIREgAjUCCCESIAI1AgwhEyACNQIQIRQgAjUCFCEVIAI1AhghFiACNQIcIRcgAjUCICEYIAI1AiQhGSACNQIoIRogAjUCLCEbIASnrCEEIAWnrCEFIAanrCEGIAenrCEHIAinrCEIIAmnrCEJIAqnrCEKIAunrCELIAynrCEMIA2nrCENIA6nrCEOIA+nrCEPIBCnrCEQIBGnrCERIBKnrCESIBOnrCETIBSnrCEUIBWnrCEVIBanrCEWIBenrCEXIBinrCEYIBmnrCEZIBqnrCEaIBunrCEbIAQgEH4hHCAEIBF+IAUgEH58IR0gBCASfiAFIBF+IAYgEH58fCEeIAQgE34gBSASfiAGIBF+IAcgEH58fHwhHyAEIBR+IAUgE34gBiASfiAHIBF+IAggEH58fHx8ISAgBCAVfiAFIBR+IAYgE34gByASfiAIIBF+IAkgEH58fHx8fCEhIAQgFn4gBSAVfiAGIBR+IAcgE34gCCASfiAJIBF+IAogEH58fHx8fHwhIiAEIBd+IAUgFn4gBiAVfiAHIBR+IAggE34gCSASfiAKIBF+IAsgEH58fHx8fHx8ISMgBCAYfiAFIBd+IAYgFn4gByAVfiAIIBR+IAkgE34gCiASfiALIBF+IAwgEH58fHx8fHx8fCEkIAQgGX4gBSAYfiAGIBd+IAcgFn4gCCAVfiAJIBR+IAogE34gCyASfiAMIBF+IA0gEH58fHx8fHx8fHwhJSAEIBp+IAUgGX4gBiAYfiAHIBd+IAggFn4gCSAVfiAKIBR+IAsgE34gDCASfiANIBF+IA4gEH58fHx8fHx8fHx8ISYgBCAbfiAFIBp+IAYgGX4gByAYfiAIIBd+IAkgFn4gCiAVfiALIBR+IAwgE34gDSASfiAOIBF+IA8gEH58fHx8fHx8fHx8fCEnIAUgG34gBiAafiAHIBl+IAggGH4gCSAXfiAKIBZ+IAsgFX4gDCAUfiANIBN+IA4gEn4gDyARfnx8fHx8fHx8fHwhKCAGIBt+IAcgGn4gCCAZfiAJIBh+IAogF34gCyAWfiAMIBV+IA0gFH4gDiATfiAPIBJ+fHx8fHx8fHx8ISkgByAbfiAIIBp+IAkgGX4gCiAYfiALIBd+IAwgFn4gDSAVfiAOIBR+IA8gE358fHx8fHx8fCEqIAggG34gCSAafiAKIBl+IAsgGH4gDCAXfiANIBZ+IA4gFX4gDyAUfnx8fHx8fHwhKyAJIBt+IAogGn4gCyAZfiAMIBh+IA0gF34gDiAWfiAPIBV+fHx8fHx8ISwgCiAbfiALIBp+IAwgGX4gDSAYfiAOIBd+IA8gFn58fHx8fCEtIAsgG34gDCAafiANIBl+IA4gGH4gDyAXfnx8fHwhLiAMIBt+IA0gGn4gDiAZfiAPIBh+fHx8IS8gDSAbfiAOIBp+IA8gGX58fCEwIA4gG34gDyAafnwhMSAPIBt+ITJCACEzIBxCAUIUhnxCFYchNCAdIDR8IR0gHCA0QgFCFYZ+fSEcIB5CAUIUhnxCFYchNiAfIDZ8IR8gHiA2QgFCFYZ+fSEeICBCAUIUhnxCFYchOCAhIDh8ISEgICA4QgFCFYZ+fSEgICJCAUIUhnxCFYchOiAjIDp8ISMgIiA6QgFCFYZ+fSEiICRCAUIUhnxCFYchPCAlIDx8ISUgJCA8QgFCFYZ+fSEkICZCAUIUhnxCFYchPiAnID58IScgJiA+QgFCFYZ+fSEmIChCAUIUhnxCFYchQCApIEB8ISkgKCBAQgFCFYZ+fSEoICpCAUIUhnxCFYchQiArIEJ8ISsgKiBCQgFCFYZ+fSEqICxCAUIUhnxCFYchRCAtIER8IS0gLCBEQgFCFYZ+fSEsIC5CAUIUhnxCFYchRiAvIEZ8IS8gLiBGQgFCFYZ+fSEuIDBCAUIUhnxCFYchSCAxIEh8ITEgMCBIQgFCFYZ+fSEwIDJCAUIUhnxCFYchSiAzIEp8ITMgMiBKQgFCFYZ+fSEyIB1CAUIUhnxCFYchNSAeIDV8IR4gHSA1QgFCFYZ+fSEdIB9CAUIUhnxCFYchNyAgIDd8ISAgHyA3QgFCFYZ+fSEfICFCAUIUhnxCFYchOSAiIDl8ISIgISA5QgFCFYZ+fSEhICNCAUIUhnxCFYchOyAkIDt8ISQgIyA7QgFCFYZ+fSEjICVCAUIUhnxCFYchPSAmID18ISYgJSA9QgFCFYZ+fSElICdCAUIUhnxCFYchPyAoID98ISggJyA/QgFCFYZ+fSEnIClCAUIUhnxCFYchQSAqIEF8ISogKSBBQgFCFYZ+fSEpICtCAUIUhnxCFYchQyAsIEN8ISwgKyBDQgFCFYZ+fSErIC1CAUIUhnxCFYchRSAuIEV8IS4gLSBFQgFCFYZ+fSEtIC9CAUIUhnxCFYchRyAwIEd8ITAgLyBHQgFCFYZ+fSEvIDFCAUIUhnxCFYchSSAyIEl8ITIgMSBJQgFCFYZ+fSExIAAgHCAdIB4gHyAgICEgIiAjICQgJSAmICcgKCApICogKyAsIC0gLiAvIDAgMSAyIDNBABEAAAs=')
+  var ready = null
+
+  var mod = {
+    buffer: wasm,
+    memory: null,
+    exports: null,
+    realloc: realloc,
+    onload: onload
+  }
+
+  onload(function () {})
+
+  return mod
+
+  function realloc (size) {
+    mod.exports.memory.grow(Math.max(0, Math.ceil(Math.abs(size - mod.memory.length) / 65536)))
+    mod.memory = new Uint8Array(mod.exports.memory.buffer)
+  }
+
+  function onload (cb) {
+    if (mod.exports) return cb()
+
+    if (ready) {
+      ready.then(cb.bind(null, null)).catch(cb)
+      return
+    }
+
+    try {
+      if (opts && opts.async) throw new Error('async')
+      setup({instance: new WebAssembly.Instance(new WebAssembly.Module(wasm), imp)})
+    } catch (err) {
+      ready = WebAssembly.instantiate(wasm, imp).then(setup)
+    }
+
+    onload(cb)
+  }
+
+  function setup (w) {
+    mod.exports = w.instance.exports
+    mod.memory = mod.exports.memory && mod.exports.memory.buffer && new Uint8Array(mod.exports.memory.buffer)
+  }
+}
+
+function toUint8Array (s) {
+  if (typeof atob === 'function') return new Uint8Array(atob(s).split('').map(charCodeAt))
+  return (require('buf' + 'fer').Buffer).from(s, 'base64')
+}
+
+function charCodeAt (c) {
+  return c.charCodeAt(0)
+}

fe25519_25/sc25519_mul.wat

@@ -0,0 +1,308 @@
+(module
+  (import "js" "table" (table 1 anyfunc))
+  (type $to_void (func
+    (param $s i32)
+    (param $s0 i64)
+    (param $s1 i64)
+    (param $s2 i64)
+    (param $s3 i64)
+    (param $s4 i64)
+    (param $s5 i64)
+    (param $s6 i64)
+    (param $s7 i64)
+    (param $s8 i64)
+    (param $s9 i64)
+    (param $s10 i64)
+    (param $s11 i64)
+    (param $s12 i64)
+    (param $s13 i64)
+    (param $s14 i64)
+    (param $s15 i64)
+    (param $s16 i64)
+    (param $s17 i64)
+    (param $s18 i64)
+    (param $s19 i64)
+    (param $s20 i64)
+    (param $s21 i64)
+    (param $s22 i64)
+    (param $s23 i64)))
+
+  (memory $0 1)
+  (export "memory" (memory $0))
+  
+  (func $sc25519_mul (export "sc25519_mul") (param $s i32) (param $a i32) (param $b i32)
+    (local $tmp i64)
+
+    (local $a0 i64)
+    (local $a1 i64)
+    (local $a2 i64)
+    (local $a3 i64)
+    (local $a4 i64)
+    (local $a5 i64)
+    (local $a6 i64)
+    (local $a7 i64)
+    (local $a8 i64)
+    (local $a9 i64)
+    (local $a10 i64)
+    (local $a11 i64)
+
+    (local $b0 i64)
+    (local $b1 i64)
+    (local $b2 i64)
+    (local $b3 i64)
+    (local $b4 i64)
+    (local $b5 i64)
+    (local $b6 i64)
+    (local $b7 i64)
+    (local $b8 i64)
+    (local $b9 i64)
+    (local $b10 i64)
+    (local $b11 i64)
+
+    (local $s0 i64)
+    (local $s1 i64)
+    (local $s2 i64)
+    (local $s3 i64)
+    (local $s4 i64)
+    (local $s5 i64)
+    (local $s6 i64)
+    (local $s7 i64)
+    (local $s8 i64)
+    (local $s9 i64)
+    (local $s10 i64)
+    (local $s11 i64)
+    (local $s12 i64)
+    (local $s13 i64)
+    (local $s14 i64)
+    (local $s15 i64)
+    (local $s16 i64)
+    (local $s17 i64)
+    (local $s18 i64)
+    (local $s19 i64)
+    (local $s20 i64)
+    (local $s21 i64)
+    (local $s22 i64)
+    (local $s23 i64)
+
+    (local $carry0 i64)
+    (local $carry1 i64)
+    (local $carry2 i64)
+    (local $carry3 i64)
+    (local $carry4 i64)
+    (local $carry5 i64)
+    (local $carry6 i64)
+    (local $carry7 i64)
+    (local $carry8 i64)
+    (local $carry9 i64)
+    (local $carry10 i64)
+    (local $carry11 i64)
+    (local $carry12 i64)
+    (local $carry13 i64)
+    (local $carry14 i64)
+    (local $carry15 i64)
+    (local $carry16 i64)
+    (local $carry17 i64)
+    (local $carry18 i64)
+    (local $carry19 i64)
+    (local $carry20 i64)
+    (local $carry21 i64)
+    (local $carry22 i64)
+
+    (set_local $a0 (i64.load32_u offset=0  (get_local $a)))
+    (set_local $a1 (i64.load32_u offset=4  (get_local $a)))
+    (set_local $a2 (i64.load32_u offset=8  (get_local $a)))
+    (set_local $a3 (i64.load32_u offset=12 (get_local $a)))
+    (set_local $a4 (i64.load32_u offset=16 (get_local $a)))
+    (set_local $a5 (i64.load32_u offset=20 (get_local $a)))
+    (set_local $a6 (i64.load32_u offset=24 (get_local $a)))
+    (set_local $a7 (i64.load32_u offset=28 (get_local $a)))
+    (set_local $a8 (i64.load32_u offset=32 (get_local $a)))
+    (set_local $a9 (i64.load32_u offset=36 (get_local $a)))
+    (set_local $a10 (i64.load32_u offset=40 (get_local $a)))
+    (set_local $a11 (i64.load32_u offset=44 (get_local $a)))
+
+    (set_local $b0 (i64.load32_u offset=0  (get_local $b)))
+    (set_local $b1 (i64.load32_u offset=4  (get_local $b)))
+    (set_local $b2 (i64.load32_u offset=8  (get_local $b)))
+    (set_local $b3 (i64.load32_u offset=12 (get_local $b)))
+    (set_local $b4 (i64.load32_u offset=16 (get_local $b)))
+    (set_local $b5 (i64.load32_u offset=20 (get_local $b)))
+    (set_local $b6 (i64.load32_u offset=24 (get_local $b)))
+    (set_local $b7 (i64.load32_u offset=28 (get_local $b)))
+    (set_local $b8 (i64.load32_u offset=32 (get_local $b)))
+    (set_local $b9 (i64.load32_u offset=36 (get_local $b)))
+    (set_local $b10 (i64.load32_u offset=40 (get_local $b)))
+    (set_local $b11 (i64.load32_u offset=44 (get_local $b)))
+
+    (set_local $a0 (i64.extend_s/i32 (i32.wrap/i64 (get_local $a0))))
+    (set_local $a1 (i64.extend_s/i32 (i32.wrap/i64 (get_local $a1))))
+    (set_local $a2 (i64.extend_s/i32 (i32.wrap/i64 (get_local $a2))))
+    (set_local $a3 (i64.extend_s/i32 (i32.wrap/i64 (get_local $a3))))
+    (set_local $a4 (i64.extend_s/i32 (i32.wrap/i64 (get_local $a4))))
+    (set_local $a5 (i64.extend_s/i32 (i32.wrap/i64 (get_local $a5))))
+    (set_local $a6 (i64.extend_s/i32 (i32.wrap/i64 (get_local $a6))))
+    (set_local $a7 (i64.extend_s/i32 (i32.wrap/i64 (get_local $a7))))
+    (set_local $a8 (i64.extend_s/i32 (i32.wrap/i64 (get_local $a8))))
+    (set_local $a9 (i64.extend_s/i32 (i32.wrap/i64 (get_local $a9))))
+    (set_local $a10 (i64.extend_s/i32 (i32.wrap/i64 (get_local $a10))))
+    (set_local $a11 (i64.extend_s/i32 (i32.wrap/i64 (get_local $a11))))
+
+    (set_local $b0 (i64.extend_s/i32 (i32.wrap/i64 (get_local $b0))))
+    (set_local $b1 (i64.extend_s/i32 (i32.wrap/i64 (get_local $b1))))
+    (set_local $b2 (i64.extend_s/i32 (i32.wrap/i64 (get_local $b2))))
+    (set_local $b3 (i64.extend_s/i32 (i32.wrap/i64 (get_local $b3))))
+    (set_local $b4 (i64.extend_s/i32 (i32.wrap/i64 (get_local $b4))))
+    (set_local $b5 (i64.extend_s/i32 (i32.wrap/i64 (get_local $b5))))
+    (set_local $b6 (i64.extend_s/i32 (i32.wrap/i64 (get_local $b6))))
+    (set_local $b7 (i64.extend_s/i32 (i32.wrap/i64 (get_local $b7))))
+    (set_local $b8 (i64.extend_s/i32 (i32.wrap/i64 (get_local $b8))))
+    (set_local $b9 (i64.extend_s/i32 (i32.wrap/i64 (get_local $b9))))
+    (set_local $b10 (i64.extend_s/i32 (i32.wrap/i64 (get_local $b10))))
+    (set_local $b11 (i64.extend_s/i32 (i32.wrap/i64 (get_local $b11))))
+
+    (set_local $s0  (i64.mul (get_local $a0) (get_local $b0)))
+    (set_local $s1  (i64.add (i64.mul (get_local $a0) (get_local $b1 )) (i64.mul (get_local $a1) (get_local $b0))))
+    (set_local $s2  (i64.add (i64.mul (get_local $a0) (get_local $b2 )) (i64.add (i64.mul (get_local $a1) (get_local $b1 )) (i64.mul (get_local $a2) (get_local $b0)))))
+    (set_local $s3  (i64.add (i64.mul (get_local $a0) (get_local $b3 )) (i64.add (i64.mul (get_local $a1) (get_local $b2 )) (i64.add (i64.mul (get_local $a2) (get_local $b1)) (i64.mul (get_local $a3) (get_local $b0))))))
+    (set_local $s4  (i64.add (i64.mul (get_local $a0) (get_local $b4 )) (i64.add (i64.mul (get_local $a1) (get_local $b3 )) (i64.add (i64.mul (get_local $a2) (get_local $b2)) (i64.add (i64.mul (get_local $a3) (get_local $b1)) (i64.mul (get_local $a4) (get_local $b0)))))))
+    (set_local $s5  (i64.add (i64.mul (get_local $a0) (get_local $b5 )) (i64.add (i64.mul (get_local $a1) (get_local $b4 )) (i64.add (i64.mul (get_local $a2) (get_local $b3)) (i64.add (i64.mul (get_local $a3) (get_local $b2)) (i64.add (i64.mul (get_local $a4) (get_local $b1)) (i64.mul (get_local $a5) (get_local $b0))))))))
+    (set_local $s6  (i64.add (i64.mul (get_local $a0) (get_local $b6 )) (i64.add (i64.mul (get_local $a1) (get_local $b5 )) (i64.add (i64.mul (get_local $a2) (get_local $b4)) (i64.add (i64.mul (get_local $a3) (get_local $b3)) (i64.add (i64.mul (get_local $a4) (get_local $b2)) (i64.add (i64.mul (get_local $a5) (get_local $b1)) (i64.mul (get_local $a6) (get_local $b0)))))))))
+    (set_local $s7  (i64.add (i64.mul (get_local $a0) (get_local $b7 )) (i64.add (i64.mul (get_local $a1) (get_local $b6 )) (i64.add (i64.mul (get_local $a2) (get_local $b5)) (i64.add (i64.mul (get_local $a3) (get_local $b4)) (i64.add (i64.mul (get_local $a4) (get_local $b3)) (i64.add (i64.mul (get_local $a5) (get_local $b2)) (i64.add (i64.mul (get_local $a6) (get_local $b1)) (i64.mul (get_local $a7) (get_local $b0))))))))))
+    (set_local $s8  (i64.add (i64.mul (get_local $a0) (get_local $b8 )) (i64.add (i64.mul (get_local $a1) (get_local $b7 )) (i64.add (i64.mul (get_local $a2) (get_local $b6)) (i64.add (i64.mul (get_local $a3) (get_local $b5)) (i64.add (i64.mul (get_local $a4) (get_local $b4)) (i64.add (i64.mul (get_local $a5) (get_local $b3)) (i64.add (i64.mul (get_local $a6) (get_local $b2)) (i64.add (i64.mul (get_local $a7) (get_local $b1)) (i64.mul (get_local $a8) (get_local $b0)))))))))))
+    (set_local $s9  (i64.add (i64.mul (get_local $a0) (get_local $b9 )) (i64.add (i64.mul (get_local $a1) (get_local $b8 )) (i64.add (i64.mul (get_local $a2) (get_local $b7)) (i64.add (i64.mul (get_local $a3) (get_local $b6)) (i64.add (i64.mul (get_local $a4) (get_local $b5)) (i64.add (i64.mul (get_local $a5) (get_local $b4)) (i64.add (i64.mul (get_local $a6) (get_local $b3)) (i64.add (i64.mul (get_local $a7) (get_local $b2)) (i64.add (i64.mul (get_local $a8) (get_local $b1)) (i64.mul (get_local $a9) (get_local $b0))))))))))))
+    (set_local $s10 (i64.add (i64.mul (get_local $a0) (get_local $b10)) (i64.add (i64.mul (get_local $a1) (get_local $b9 )) (i64.add (i64.mul (get_local $a2) (get_local $b8)) (i64.add (i64.mul (get_local $a3) (get_local $b7)) (i64.add (i64.mul (get_local $a4) (get_local $b6)) (i64.add (i64.mul (get_local $a5) (get_local $b5)) (i64.add (i64.mul (get_local $a6) (get_local $b4)) (i64.add (i64.mul (get_local $a7) (get_local $b3)) (i64.add (i64.mul (get_local $a8) (get_local $b2)) (i64.add (i64.mul (get_local $a9) (get_local $b1)) (i64.mul (get_local $a10) (get_local $b0)))))))))))))
+    (set_local $s11 (i64.add (i64.mul (get_local $a0) (get_local $b11)) (i64.add (i64.mul (get_local $a1) (get_local $b10)) (i64.add (i64.mul (get_local $a2) (get_local $b9)) (i64.add (i64.mul (get_local $a3) (get_local $b8)) (i64.add (i64.mul (get_local $a4) (get_local $b7)) (i64.add (i64.mul (get_local $a5) (get_local $b6)) (i64.add (i64.mul (get_local $a6) (get_local $b5)) (i64.add (i64.mul (get_local $a7) (get_local $b4)) (i64.add (i64.mul (get_local $a8) (get_local $b3)) (i64.add (i64.mul (get_local $a9) (get_local $b2)) (i64.add (i64.mul (get_local $a10) (get_local $b1)) (i64.mul (get_local $a11) (get_local $b0))))))))))))))
+    (set_local $s12 (i64.add (i64.mul (get_local $a1) (get_local $b11)) (i64.add (i64.mul (get_local $a2) (get_local $b10)) (i64.add (i64.mul (get_local $a3) (get_local $b9)) (i64.add (i64.mul (get_local $a4) (get_local $b8)) (i64.add (i64.mul (get_local $a5) (get_local $b7)) (i64.add (i64.mul (get_local $a6) (get_local $b6)) (i64.add (i64.mul (get_local $a7) (get_local $b5)) (i64.add (i64.mul (get_local $a8) (get_local $b4)) (i64.add (i64.mul (get_local $a9) (get_local $b3)) (i64.add (i64.mul (get_local $a10) (get_local $b2)) (i64.mul (get_local $a11) (get_local $b1)))))))))))))
+    (set_local $s13 (i64.add (i64.mul (get_local $a2) (get_local $b11)) (i64.add (i64.mul (get_local $a3) (get_local $b10)) (i64.add (i64.mul (get_local $a4) (get_local $b9)) (i64.add (i64.mul (get_local $a5) (get_local $b8)) (i64.add (i64.mul (get_local $a6) (get_local $b7)) (i64.add (i64.mul (get_local $a7) (get_local $b6)) (i64.add (i64.mul (get_local $a8) (get_local $b5)) (i64.add (i64.mul (get_local $a9) (get_local $b4)) (i64.add (i64.mul (get_local $a10) (get_local $b3)) (i64.mul (get_local $a11) (get_local $b2))))))))))))
+    (set_local $s14 (i64.add (i64.mul (get_local $a3) (get_local $b11)) (i64.add (i64.mul (get_local $a4) (get_local $b10)) (i64.add (i64.mul (get_local $a5) (get_local $b9)) (i64.add (i64.mul (get_local $a6) (get_local $b8)) (i64.add (i64.mul (get_local $a7) (get_local $b7)) (i64.add (i64.mul (get_local $a8) (get_local $b6)) (i64.add (i64.mul (get_local $a9) (get_local $b5)) (i64.add (i64.mul (get_local $a10) (get_local $b4)) (i64.mul (get_local $a11) (get_local $b3)))))))))))
+    (set_local $s15 (i64.add (i64.mul (get_local $a4) (get_local $b11)) (i64.add (i64.mul (get_local $a5) (get_local $b10)) (i64.add (i64.mul (get_local $a6) (get_local $b9)) (i64.add (i64.mul (get_local $a7) (get_local $b8)) (i64.add (i64.mul (get_local $a8) (get_local $b7)) (i64.add (i64.mul (get_local $a9) (get_local $b6)) (i64.add (i64.mul (get_local $a10) (get_local $b5)) (i64.mul (get_local $a11) (get_local $b4))))))))))
+    (set_local $s16 (i64.add (i64.mul (get_local $a5) (get_local $b11)) (i64.add (i64.mul (get_local $a6) (get_local $b10)) (i64.add (i64.mul (get_local $a7) (get_local $b9)) (i64.add (i64.mul (get_local $a8) (get_local $b8)) (i64.add (i64.mul (get_local $a9) (get_local $b7)) (i64.add (i64.mul (get_local $a10) (get_local $b6)) (i64.mul (get_local $a11) (get_local $b5)))))))))
+    (set_local $s17 (i64.add (i64.mul (get_local $a6) (get_local $b11)) (i64.add (i64.mul (get_local $a7) (get_local $b10)) (i64.add (i64.mul (get_local $a8) (get_local $b9)) (i64.add (i64.mul (get_local $a9) (get_local $b8)) (i64.add (i64.mul (get_local $a10) (get_local $b7)) (i64.mul (get_local $a11) (get_local $b6))))))))
+    (set_local $s18 (i64.add (i64.mul (get_local $a7) (get_local $b11)) (i64.add (i64.mul (get_local $a8) (get_local $b10)) (i64.add (i64.mul (get_local $a9) (get_local $b9)) (i64.add (i64.mul (get_local $a10) (get_local $b8)) (i64.mul (get_local $a11) (get_local $b7)))))))
+    (set_local $s19 (i64.add (i64.mul (get_local $a8) (get_local $b11)) (i64.add (i64.mul (get_local $a9) (get_local $b10)) (i64.add (i64.mul (get_local $a10) (get_local $b9)) (i64.mul (get_local $a11) (get_local $b8))))))
+    (set_local $s20 (i64.add (i64.mul (get_local $a9) (get_local $b11)) (i64.add (i64.mul (get_local $a10) (get_local $b10))  (i64.mul (get_local $a11) (get_local $b9)))))
+    (set_local $s21 (i64.add (i64.mul (get_local $a10) (get_local $b11)) (i64.mul (get_local $a11) (get_local $b10))))
+    (set_local $s22 (i64.mul (get_local $a11) (get_local $b11)))
+    (set_local $s23 (i64.const 0))
+
+    (set_local $carry0 (i64.shr_s (i64.add (get_local $s0) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s1 (i64.add (get_local $s1) (get_local $carry0)))
+    (set_local $s0 (i64.sub (get_local $s0) (i64.mul (get_local $carry0) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry2 (i64.shr_s (i64.add (get_local $s2) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s3 (i64.add (get_local $s3) (get_local $carry2)))
+    (set_local $s2 (i64.sub (get_local $s2) (i64.mul (get_local $carry2) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry4 (i64.shr_s (i64.add (get_local $s4) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s5 (i64.add (get_local $s5) (get_local $carry4)))
+    (set_local $s4 (i64.sub (get_local $s4) (i64.mul (get_local $carry4) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry6 (i64.shr_s (i64.add (get_local $s6) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s7 (i64.add (get_local $s7) (get_local $carry6)))
+    (set_local $s6 (i64.sub (get_local $s6) (i64.mul (get_local $carry6) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry8 (i64.shr_s (i64.add (get_local $s8) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s9 (i64.add (get_local $s9) (get_local $carry8)))
+    (set_local $s8 (i64.sub (get_local $s8) (i64.mul (get_local $carry8) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry10 (i64.shr_s (i64.add (get_local $s10) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s11 (i64.add (get_local $s11) (get_local $carry10)))
+    (set_local $s10 (i64.sub (get_local $s10) (i64.mul (get_local $carry10) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry12 (i64.shr_s (i64.add (get_local $s12) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s13 (i64.add (get_local $s13) (get_local $carry12)))
+    (set_local $s12 (i64.sub (get_local $s12) (i64.mul (get_local $carry12) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry14 (i64.shr_s (i64.add (get_local $s14) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s15 (i64.add (get_local $s15) (get_local $carry14)))
+    (set_local $s14 (i64.sub (get_local $s14) (i64.mul (get_local $carry14) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry16 (i64.shr_s (i64.add (get_local $s16) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s17 (i64.add (get_local $s17) (get_local $carry16)))
+    (set_local $s16 (i64.sub (get_local $s16) (i64.mul (get_local $carry16) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry18 (i64.shr_s (i64.add (get_local $s18) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s19 (i64.add (get_local $s19) (get_local $carry18)))
+    (set_local $s18 (i64.sub (get_local $s18) (i64.mul (get_local $carry18) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry20 (i64.shr_s (i64.add (get_local $s20) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s21 (i64.add (get_local $s21) (get_local $carry20)))
+    (set_local $s20 (i64.sub (get_local $s20) (i64.mul (get_local $carry20) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry22 (i64.shr_s (i64.add (get_local $s22) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s23 (i64.add (get_local $s23) (get_local $carry22)))
+    (set_local $s22 (i64.sub (get_local $s22) (i64.mul (get_local $carry22) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry1 (i64.shr_s (i64.add (get_local $s1) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s2 (i64.add (get_local $s2) (get_local $carry1)))
+    (set_local $s1 (i64.sub (get_local $s1) (i64.mul (get_local $carry1) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry3 (i64.shr_s (i64.add (get_local $s3) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s4 (i64.add (get_local $s4) (get_local $carry3)))
+    (set_local $s3 (i64.sub (get_local $s3) (i64.mul (get_local $carry3) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry5 (i64.shr_s (i64.add (get_local $s5) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s6 (i64.add (get_local $s6) (get_local $carry5)))
+    (set_local $s5 (i64.sub (get_local $s5) (i64.mul (get_local $carry5) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry7 (i64.shr_s (i64.add (get_local $s7) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s8 (i64.add (get_local $s8) (get_local $carry7)))
+    (set_local $s7 (i64.sub (get_local $s7) (i64.mul (get_local $carry7) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry9 (i64.shr_s (i64.add (get_local $s9) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s10 (i64.add (get_local $s10) (get_local $carry9)))
+    (set_local $s9 (i64.sub (get_local $s9) (i64.mul (get_local $carry9) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry11 (i64.shr_s (i64.add (get_local $s11) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s12 (i64.add (get_local $s12) (get_local $carry11)))
+    (set_local $s11 (i64.sub (get_local $s11) (i64.mul (get_local $carry11) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry13 (i64.shr_s (i64.add (get_local $s13) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s14 (i64.add (get_local $s14) (get_local $carry13)))
+    (set_local $s13 (i64.sub (get_local $s13) (i64.mul (get_local $carry13) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry15 (i64.shr_s (i64.add (get_local $s15) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s16 (i64.add (get_local $s16) (get_local $carry15)))
+    (set_local $s15 (i64.sub (get_local $s15) (i64.mul (get_local $carry15) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry17 (i64.shr_s (i64.add (get_local $s17) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s18 (i64.add (get_local $s18) (get_local $carry17)))
+    (set_local $s17 (i64.sub (get_local $s17) (i64.mul (get_local $carry17) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry19 (i64.shr_s (i64.add (get_local $s19) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s20 (i64.add (get_local $s20) (get_local $carry19)))
+    (set_local $s19 (i64.sub (get_local $s19) (i64.mul (get_local $carry19) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry21 (i64.shr_s (i64.add (get_local $s21) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s22 (i64.add (get_local $s22) (get_local $carry21)))
+    (set_local $s21 (i64.sub (get_local $s21) (i64.mul (get_local $carry21) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (get_local $s)
+    (get_local $s0)
+    (get_local $s1)
+    (get_local $s2)
+    (get_local $s3)
+    (get_local $s4)
+    (get_local $s5)
+    (get_local $s6)
+    (get_local $s7)
+    (get_local $s8)
+    (get_local $s9)
+    (get_local $s10)
+    (get_local $s11)
+    (get_local $s12)
+    (get_local $s13)
+    (get_local $s14)
+    (get_local $s15)
+    (get_local $s16)
+    (get_local $s17)
+    (get_local $s18)
+    (get_local $s19)
+    (get_local $s20)
+    (get_local $s21)
+    (get_local $s22)
+    (get_local $s23)
+    (i32.const 0)
+    (call_indirect (type $to_void))))
+
+;;  TODO: export muladd and call in reduce

fe25519_25/sc25519_muladd.js

@@ -0,0 +1,61 @@
+
+module.exports = loadWebAssembly
+
+loadWebAssembly.supported = typeof WebAssembly !== 'undefined'
+
+function loadWebAssembly (opts) {
+  if (!loadWebAssembly.supported) return null
+
+  var imp = opts && opts.imports
+  var wasm = toUint8Array('AGFzbQEAAAABTQtgGX9+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn4AYAF/AGABfwF/YAJ/fwBgAX0AYAF9AX1gAXwAYAF8AXxgAX4AYAF+AX5gBH9/f38AAm4IAmpzBXRhYmxlAXAAAQVkZWJ1ZwNsb2cAAQVkZWJ1Zwdsb2dfdGVlAAIFZGVidWcDbG9nAAMFZGVidWcDbG9nAAQFZGVidWcHbG9nX3RlZQAFBWRlYnVnA2xvZwAGBWRlYnVnB2xvZ190ZWUABwMEAwgJCgUDAQABBxsCBm1lbW9yeQIADnNjMjU1MTlfbXVsYWRkAAkKwBEDDQAgAEIgh6cgAKcQAgsJACAAEAcgAA8LpREBVH4gATUCACEFIAE1AgQhBiABNQIIIQcgATUCDCEIIAE1AhAhCSABNQIUIQogATUCGCELIAE1AhwhDCABNQIgIQ0gATUCJCEOIAE1AighDyABNQIsIRAgAjUCACERIAI1AgQhEiACNQIIIRMgAjUCDCEUIAI1AhAhFSACNQIUIRYgAjUCGCEXIAI1AhwhGCACNQIgIRkgAjUCJCEaIAI1AighGyACNQIsIRwgAzUCACEdIAM1AgQhHiADNQIIIR8gAzUCDCEgIAM1AhAhISADNQIUISIgAzUCGCEjIAM1AhwhJCADNQIgISUgAzUCJCEmIAM1AighJyADNQIsISggBaesIQUgBqesIQYgB6esIQcgCKesIQggCaesIQkgCqesIQogC6esIQsgDKesIQwgDaesIQ0gDqesIQ4gD6esIQ8gEKesIRAgEaesIREgEqesIRIgE6esIRMgFKesIRQgFaesIRUgFqesIRYgF6esIRcgGKesIRggGaesIRkgGqesIRogG6esIRsgHKesIRwgHaesIR0gHqesIR4gH6esIR8gIKesISAgIaesISEgIqesISIgI6esISMgJKesISQgJaesISUgJqesISYgJ6esIScgKKesISggHSAFIBF+fCEpIB4gBSASfiAGIBF+fHwhKiAfIAUgE34gBiASfiAHIBF+fHx8ISsgICAFIBR+IAYgE34gByASfiAIIBF+fHx8fCEsICEgBSAVfiAGIBR+IAcgE34gCCASfiAJIBF+fHx8fHwhLSAiIAUgFn4gBiAVfiAHIBR+IAggE34gCSASfiAKIBF+fHx8fHx8IS4gIyAFIBd+IAYgFn4gByAVfiAIIBR+IAkgE34gCiASfiALIBF+fHx8fHx8fCEvICQgBSAYfiAGIBd+IAcgFn4gCCAVfiAJIBR+IAogE34gCyASfiAMIBF+fHx8fHx8fHwhMCAlIAUgGX4gBiAYfiAHIBd+IAggFn4gCSAVfiAKIBR+IAsgE34gDCASfiANIBF+fHx8fHx8fHx8ITEgJiAFIBp+IAYgGX4gByAYfiAIIBd+IAkgFn4gCiAVfiALIBR+IAwgE34gDSASfiAOIBF+fHx8fHx8fHx8fCEyICcgBSAbfiAGIBp+IAcgGX4gCCAYfiAJIBd+IAogFn4gCyAVfiAMIBR+IA0gE34gDiASfiAPIBF+fHx8fHx8fHx8fHwhMyAoIAUgHH4gBiAbfiAHIBp+IAggGX4gCSAYfiAKIBd+IAsgFn4gDCAVfiANIBR+IA4gE34gDyASfiAQIBF+fHx8fHx8fHx8fHx8ITQgBiAcfiAHIBt+IAggGn4gCSAZfiAKIBh+IAsgF34gDCAWfiANIBV+IA4gFH4gDyATfiAQIBJ+fHx8fHx8fHx8fCE1IAcgHH4gCCAbfiAJIBp+IAogGX4gCyAYfiAMIBd+IA0gFn4gDiAVfiAPIBR+IBAgE358fHx8fHx8fHwhNiAIIBx+IAkgG34gCiAafiALIBl+IAwgGH4gDSAXfiAOIBZ+IA8gFX4gECAUfnx8fHx8fHx8ITcgCSAcfiAKIBt+IAsgGn4gDCAZfiANIBh+IA4gF34gDyAWfiAQIBV+fHx8fHx8fCE4IAogHH4gCyAbfiAMIBp+IA0gGX4gDiAYfiAPIBd+IBAgFn58fHx8fHwhOSALIBx+IAwgG34gDSAafiAOIBl+IA8gGH4gECAXfnx8fHx8ITogDCAcfiANIBt+IA4gGn4gDyAZfiAQIBh+fHx8fCE7IA0gHH4gDiAbfiAPIBp+IBAgGX58fHwhPCAOIBx+IA8gG34gECAafnx8IT0gDyAcfiAQIBt+fCE+IBAgHH4hP0IAIUAgKUIBQhSGfEIVhyFBICogQXwhKiApIEFCAUIVhn59ISkgK0IBQhSGfEIVhyFDICwgQ3whLCArIENCAUIVhn59ISsgLUIBQhSGfEIVhyFFIC4gRXwhLiAtIEVCAUIVhn59IS0gL0IBQhSGfEIVhyFHIDAgR3whMCAvIEdCAUIVhn59IS8gMUIBQhSGfEIVhyFJIDIgSXwhMiAxIElCAUIVhn59ITEgM0IBQhSGfEIVhyFLIDQgS3whNCAzIEtCAUIVhn59ITMgNUIBQhSGfEIVhyFNIDYgTXwhNiA1IE1CAUIVhn59ITUgN0IBQhSGfEIVhyFPIDggT3whOCA3IE9CAUIVhn59ITcgOUIBQhSGfEIVhyFRIDogUXwhOiA5IFFCAUIVhn59ITkgO0IBQhSGfEIVhyFTIDwgU3whPCA7IFNCAUIVhn59ITsgPUIBQhSGfEIVhyFVID4gVXwhPiA9IFVCAUIVhn59IT0gP0IBQhSGfEIVhyFXIEAgV3whQCA/IFdCAUIVhn59IT8gKkIBQhSGfEIVhyFCICsgQnwhKyAqIEJCAUIVhn59ISogLEIBQhSGfEIVhyFEIC0gRHwhLSAsIERCAUIVhn59ISwgLkIBQhSGfEIVhyFGIC8gRnwhLyAuIEZCAUIVhn59IS4gMEIBQhSGfEIVhyFIIDEgSHwhMSAwIEhCAUIVhn59ITAgMkIBQhSGfEIVhyFKIDMgSnwhMyAyIEpCAUIVhn59ITIgNEIBQhSGfEIVhyFMIDUgTHwhNSA0IExCAUIVhn59ITQgNkIBQhSGfEIVhyFOIDcgTnwhNyA2IE5CAUIVhn59ITYgOEIBQhSGfEIVhyFQIDkgUHwhOSA4IFBCAUIVhn59ITggOkIBQhSGfEIVhyFSIDsgUnwhOyA6IFJCAUIVhn59ITogPEIBQhSGfEIVhyFUID0gVHwhPSA8IFRCAUIVhn59ITwgPkIBQhSGfEIVhyFWID8gVnwhPyA+IFZCAUIVhn59IT4gACApICogKyAsIC0gLiAvIDAgMSAyIDMgNCA1IDYgNyA4IDkgOiA7IDwgPSA+ID8gQEEAEQAACw==')
+  var ready = null
+
+  var mod = {
+    buffer: wasm,
+    memory: null,
+    exports: null,
+    realloc: realloc,
+    onload: onload
+  }
+
+  onload(function () {})
+
+  return mod
+
+  function realloc (size) {
+    mod.exports.memory.grow(Math.max(0, Math.ceil(Math.abs(size - mod.memory.length) / 65536)))
+    mod.memory = new Uint8Array(mod.exports.memory.buffer)
+  }
+
+  function onload (cb) {
+    if (mod.exports) return cb()
+
+    if (ready) {
+      ready.then(cb.bind(null, null)).catch(cb)
+      return
+    }
+
+    try {
+      if (opts && opts.async) throw new Error('async')
+      setup({instance: new WebAssembly.Instance(new WebAssembly.Module(wasm), imp)})
+    } catch (err) {
+      ready = WebAssembly.instantiate(wasm, imp).then(setup)
+    }
+
+    onload(cb)
+  }
+
+  function setup (w) {
+    mod.exports = w.instance.exports
+    mod.memory = mod.exports.memory && mod.exports.memory.buffer && new Uint8Array(mod.exports.memory.buffer)
+  }
+}
+
+function toUint8Array (s) {
+  if (typeof atob === 'function') return new Uint8Array(atob(s).split('').map(charCodeAt))
+  return (require('buf' + 'fer').Buffer).from(s, 'base64')
+}
+
+function charCodeAt (c) {
+  return c.charCodeAt(0)
+}

fe25519_25/sc25519_muladd.wat

@@ -0,0 +1,373 @@
+(module
+  (import "js" "table" (table 1 anyfunc))
+    (type $to_void (func
+    (param $s i32)
+    (param $s0 i64)
+    (param $s1 i64)
+    (param $s2 i64)
+    (param $s3 i64)
+    (param $s4 i64)
+    (param $s5 i64)
+    (param $s6 i64)
+    (param $s7 i64)
+    (param $s8 i64)
+    (param $s9 i64)
+    (param $s10 i64)
+    (param $s11 i64)
+    (param $s12 i64)
+    (param $s13 i64)
+    (param $s14 i64)
+    (param $s15 i64)
+    (param $s16 i64)
+    (param $s17 i64)
+    (param $s18 i64)
+    (param $s19 i64)
+    (param $s20 i64)
+    (param $s21 i64)
+    (param $s22 i64)
+    (param $s23 i64)))
+
+  (func $i32.log (import "debug" "log") (param i32))
+  (func $i32.log_tee (import "debug" "log_tee") (param i32) (result i32))
+  ;; No i64 interop with JS yet - but maybe coming with WebAssembly BigInt
+  ;; So we can instead fake this by splitting the i64 into two i32 limbs,
+  ;; however these are WASM functions using i32x2.log:
+  (func $i32x2.log (import "debug" "log") (param i32) (param i32))
+  (func $f32.log (import "debug" "log") (param f32))
+  (func $f32.log_tee (import "debug" "log_tee") (param f32) (result f32))
+  (func $f64.log (import "debug" "log") (param f64))
+  (func $f64.log_tee (import "debug" "log_tee") (param f64) (result f64))
+
+  ;; i64 logging by splitting into two i32 limbs
+  (func $i64.log
+    (param $0 i64)
+    (call $i32x2.log
+      ;; Upper limb
+      (i32.wrap/i64
+        (i64.shr_s (get_local $0)
+          (i64.const 32)))
+      ;; Lower limb
+      (i32.wrap/i64 (get_local $0))))
+
+  (func $i64.log_tee
+    (param $0 i64)
+    (result i64)
+    (call $i64.log (get_local $0))
+    (return (get_local $0)))
+
+  (memory $0 1)
+  (export "memory" (memory $0))
+  
+  (func $sc25519_muladd (export "sc25519_muladd") (param $s i32) (param $a i32) (param $b i32) (param $c i32)
+    (local $tmp i64)
+
+    (local $a0 i64)
+    (local $a1 i64)
+    (local $a2 i64)
+    (local $a3 i64)
+    (local $a4 i64)
+    (local $a5 i64)
+    (local $a6 i64)
+    (local $a7 i64)
+    (local $a8 i64)
+    (local $a9 i64)
+    (local $a10 i64)
+    (local $a11 i64)
+
+    (local $b0 i64)
+    (local $b1 i64)
+    (local $b2 i64)
+    (local $b3 i64)
+    (local $b4 i64)
+    (local $b5 i64)
+    (local $b6 i64)
+    (local $b7 i64)
+    (local $b8 i64)
+    (local $b9 i64)
+    (local $b10 i64)
+    (local $b11 i64)
+
+    (local $c0 i64)
+    (local $c1 i64)
+    (local $c2 i64)
+    (local $c3 i64)
+    (local $c4 i64)
+    (local $c5 i64)
+    (local $c6 i64)
+    (local $c7 i64)
+    (local $c8 i64)
+    (local $c9 i64)
+    (local $c10 i64)
+    (local $c11 i64)
+
+    (local $s0 i64)
+    (local $s1 i64)
+    (local $s2 i64)
+    (local $s3 i64)
+    (local $s4 i64)
+    (local $s5 i64)
+    (local $s6 i64)
+    (local $s7 i64)
+    (local $s8 i64)
+    (local $s9 i64)
+    (local $s10 i64)
+    (local $s11 i64)
+    (local $s12 i64)
+    (local $s13 i64)
+    (local $s14 i64)
+    (local $s15 i64)
+    (local $s16 i64)
+    (local $s17 i64)
+    (local $s18 i64)
+    (local $s19 i64)
+    (local $s20 i64)
+    (local $s21 i64)
+    (local $s22 i64)
+    (local $s23 i64)
+
+    (local $carry0 i64)
+    (local $carry1 i64)
+    (local $carry2 i64)
+    (local $carry3 i64)
+    (local $carry4 i64)
+    (local $carry5 i64)
+    (local $carry6 i64)
+    (local $carry7 i64)
+    (local $carry8 i64)
+    (local $carry9 i64)
+    (local $carry10 i64)
+    (local $carry11 i64)
+    (local $carry12 i64)
+    (local $carry13 i64)
+    (local $carry14 i64)
+    (local $carry15 i64)
+    (local $carry16 i64)
+    (local $carry17 i64)
+    (local $carry18 i64)
+    (local $carry19 i64)
+    (local $carry20 i64)
+    (local $carry21 i64)
+    (local $carry22 i64)
+
+    (set_local $a0 (i64.load32_u offset=0  (get_local $a)))
+    (set_local $a1 (i64.load32_u offset=4  (get_local $a)))
+    (set_local $a2 (i64.load32_u offset=8  (get_local $a)))
+    (set_local $a3 (i64.load32_u offset=12 (get_local $a)))
+    (set_local $a4 (i64.load32_u offset=16 (get_local $a)))
+    (set_local $a5 (i64.load32_u offset=20 (get_local $a)))
+    (set_local $a6 (i64.load32_u offset=24 (get_local $a)))
+    (set_local $a7 (i64.load32_u offset=28 (get_local $a)))
+    (set_local $a8 (i64.load32_u offset=32 (get_local $a)))
+    (set_local $a9 (i64.load32_u offset=36 (get_local $a)))
+    (set_local $a10 (i64.load32_u offset=40 (get_local $a)))
+    (set_local $a11 (i64.load32_u offset=44 (get_local $a)))
+
+    (set_local $b0 (i64.load32_u offset=0  (get_local $b)))
+    (set_local $b1 (i64.load32_u offset=4  (get_local $b)))
+    (set_local $b2 (i64.load32_u offset=8  (get_local $b)))
+    (set_local $b3 (i64.load32_u offset=12 (get_local $b)))
+    (set_local $b4 (i64.load32_u offset=16 (get_local $b)))
+    (set_local $b5 (i64.load32_u offset=20 (get_local $b)))
+    (set_local $b6 (i64.load32_u offset=24 (get_local $b)))
+    (set_local $b7 (i64.load32_u offset=28 (get_local $b)))
+    (set_local $b8 (i64.load32_u offset=32 (get_local $b)))
+    (set_local $b9 (i64.load32_u offset=36 (get_local $b)))
+    (set_local $b10 (i64.load32_u offset=40 (get_local $b)))
+    (set_local $b11 (i64.load32_u offset=44 (get_local $b)))
+ 
+    (set_local $c0 (i64.load32_u offset=0  (get_local $c)))
+    (set_local $c1 (i64.load32_u offset=4  (get_local $c)))
+    (set_local $c2 (i64.load32_u offset=8  (get_local $c)))
+    (set_local $c3 (i64.load32_u offset=12 (get_local $c)))
+    (set_local $c4 (i64.load32_u offset=16 (get_local $c)))
+    (set_local $c5 (i64.load32_u offset=20 (get_local $c)))
+    (set_local $c6 (i64.load32_u offset=24 (get_local $c)))
+    (set_local $c7 (i64.load32_u offset=28 (get_local $c)))
+    (set_local $c8 (i64.load32_u offset=32 (get_local $c)))
+    (set_local $c9 (i64.load32_u offset=36 (get_local $c)))
+    (set_local $c10 (i64.load32_u offset=40 (get_local $c)))
+    (set_local $c11 (i64.load32_u offset=44 (get_local $c)))
+
+    (set_local $a0 (i64.extend_s/i32 (i32.wrap/i64 (get_local $a0))))
+    (set_local $a1 (i64.extend_s/i32 (i32.wrap/i64 (get_local $a1))))
+    (set_local $a2 (i64.extend_s/i32 (i32.wrap/i64 (get_local $a2))))
+    (set_local $a3 (i64.extend_s/i32 (i32.wrap/i64 (get_local $a3))))
+    (set_local $a4 (i64.extend_s/i32 (i32.wrap/i64 (get_local $a4))))
+    (set_local $a5 (i64.extend_s/i32 (i32.wrap/i64 (get_local $a5))))
+    (set_local $a6 (i64.extend_s/i32 (i32.wrap/i64 (get_local $a6))))
+    (set_local $a7 (i64.extend_s/i32 (i32.wrap/i64 (get_local $a7))))
+    (set_local $a8 (i64.extend_s/i32 (i32.wrap/i64 (get_local $a8))))
+    (set_local $a9 (i64.extend_s/i32 (i32.wrap/i64 (get_local $a9))))
+    (set_local $a10 (i64.extend_s/i32 (i32.wrap/i64 (get_local $a10))))
+    (set_local $a11 (i64.extend_s/i32 (i32.wrap/i64 (get_local $a11))))
+
+    (set_local $b0 (i64.extend_s/i32 (i32.wrap/i64 (get_local $b0))))
+    (set_local $b1 (i64.extend_s/i32 (i32.wrap/i64 (get_local $b1))))
+    (set_local $b2 (i64.extend_s/i32 (i32.wrap/i64 (get_local $b2))))
+    (set_local $b3 (i64.extend_s/i32 (i32.wrap/i64 (get_local $b3))))
+    (set_local $b4 (i64.extend_s/i32 (i32.wrap/i64 (get_local $b4))))
+    (set_local $b5 (i64.extend_s/i32 (i32.wrap/i64 (get_local $b5))))
+    (set_local $b6 (i64.extend_s/i32 (i32.wrap/i64 (get_local $b6))))
+    (set_local $b7 (i64.extend_s/i32 (i32.wrap/i64 (get_local $b7))))
+    (set_local $b8 (i64.extend_s/i32 (i32.wrap/i64 (get_local $b8))))
+    (set_local $b9 (i64.extend_s/i32 (i32.wrap/i64 (get_local $b9))))
+    (set_local $b10 (i64.extend_s/i32 (i32.wrap/i64 (get_local $b10))))
+    (set_local $b11 (i64.extend_s/i32 (i32.wrap/i64 (get_local $b11))))
+
+    (set_local $c0 (i64.extend_s/i32 (i32.wrap/i64 (get_local $c0))))
+    (set_local $c1 (i64.extend_s/i32 (i32.wrap/i64 (get_local $c1))))
+    (set_local $c2 (i64.extend_s/i32 (i32.wrap/i64 (get_local $c2))))
+    (set_local $c3 (i64.extend_s/i32 (i32.wrap/i64 (get_local $c3))))
+    (set_local $c4 (i64.extend_s/i32 (i32.wrap/i64 (get_local $c4))))
+    (set_local $c5 (i64.extend_s/i32 (i32.wrap/i64 (get_local $c5))))
+    (set_local $c6 (i64.extend_s/i32 (i32.wrap/i64 (get_local $c6))))
+    (set_local $c7 (i64.extend_s/i32 (i32.wrap/i64 (get_local $c7))))
+    (set_local $c8 (i64.extend_s/i32 (i32.wrap/i64 (get_local $c8))))
+    (set_local $c9 (i64.extend_s/i32 (i32.wrap/i64 (get_local $c9))))
+    (set_local $c10 (i64.extend_s/i32 (i32.wrap/i64 (get_local $c10))))
+    (set_local $c11 (i64.extend_s/i32 (i32.wrap/i64 (get_local $c11))))
+
+    (set_local $s0  (i64.add (get_local $c0 ) (i64.mul (get_local $a0) (get_local $b0))))
+    (set_local $s1  (i64.add (get_local $c1 ) (i64.add (i64.mul (get_local $a0) (get_local $b1 )) (i64.mul (get_local $a1) (get_local $b0)))))
+    (set_local $s2  (i64.add (get_local $c2 ) (i64.add (i64.mul (get_local $a0) (get_local $b2 )) (i64.add (i64.mul (get_local $a1) (get_local $b1 )) (i64.mul (get_local $a2) (get_local $b0))))))
+    (set_local $s3  (i64.add (get_local $c3 ) (i64.add (i64.mul (get_local $a0) (get_local $b3 )) (i64.add (i64.mul (get_local $a1) (get_local $b2 )) (i64.add (i64.mul (get_local $a2) (get_local $b1)) (i64.mul (get_local $a3) (get_local $b0)))))))
+    (set_local $s4  (i64.add (get_local $c4 ) (i64.add (i64.mul (get_local $a0) (get_local $b4 )) (i64.add (i64.mul (get_local $a1) (get_local $b3 )) (i64.add (i64.mul (get_local $a2) (get_local $b2)) (i64.add (i64.mul (get_local $a3) (get_local $b1)) (i64.mul (get_local $a4) (get_local $b0))))))))
+    (set_local $s5  (i64.add (get_local $c5 ) (i64.add (i64.mul (get_local $a0) (get_local $b5 )) (i64.add (i64.mul (get_local $a1) (get_local $b4 )) (i64.add (i64.mul (get_local $a2) (get_local $b3)) (i64.add (i64.mul (get_local $a3) (get_local $b2)) (i64.add (i64.mul (get_local $a4) (get_local $b1)) (i64.mul (get_local $a5) (get_local $b0)))))))))
+    (set_local $s6  (i64.add (get_local $c6 ) (i64.add (i64.mul (get_local $a0) (get_local $b6 )) (i64.add (i64.mul (get_local $a1) (get_local $b5 )) (i64.add (i64.mul (get_local $a2) (get_local $b4)) (i64.add (i64.mul (get_local $a3) (get_local $b3)) (i64.add (i64.mul (get_local $a4) (get_local $b2)) (i64.add (i64.mul (get_local $a5) (get_local $b1)) (i64.mul (get_local $a6) (get_local $b0))))))))))
+    (set_local $s7  (i64.add (get_local $c7 ) (i64.add (i64.mul (get_local $a0) (get_local $b7 )) (i64.add (i64.mul (get_local $a1) (get_local $b6 )) (i64.add (i64.mul (get_local $a2) (get_local $b5)) (i64.add (i64.mul (get_local $a3) (get_local $b4)) (i64.add (i64.mul (get_local $a4) (get_local $b3)) (i64.add (i64.mul (get_local $a5) (get_local $b2)) (i64.add (i64.mul (get_local $a6) (get_local $b1)) (i64.mul (get_local $a7) (get_local $b0)))))))))))
+    (set_local $s8  (i64.add (get_local $c8 ) (i64.add (i64.mul (get_local $a0) (get_local $b8 )) (i64.add (i64.mul (get_local $a1) (get_local $b7 )) (i64.add (i64.mul (get_local $a2) (get_local $b6)) (i64.add (i64.mul (get_local $a3) (get_local $b5)) (i64.add (i64.mul (get_local $a4) (get_local $b4)) (i64.add (i64.mul (get_local $a5) (get_local $b3)) (i64.add (i64.mul (get_local $a6) (get_local $b2)) (i64.add (i64.mul (get_local $a7) (get_local $b1)) (i64.mul (get_local $a8) (get_local $b0))))))))))))
+    (set_local $s9  (i64.add (get_local $c9 ) (i64.add (i64.mul (get_local $a0) (get_local $b9 )) (i64.add (i64.mul (get_local $a1) (get_local $b8 )) (i64.add (i64.mul (get_local $a2) (get_local $b7)) (i64.add (i64.mul (get_local $a3) (get_local $b6)) (i64.add (i64.mul (get_local $a4) (get_local $b5)) (i64.add (i64.mul (get_local $a5) (get_local $b4)) (i64.add (i64.mul (get_local $a6) (get_local $b3)) (i64.add (i64.mul (get_local $a7) (get_local $b2)) (i64.add (i64.mul (get_local $a8) (get_local $b1)) (i64.mul (get_local $a9) (get_local $b0)))))))))))))
+    (set_local $s10 (i64.add (get_local $c10) (i64.add (i64.mul (get_local $a0) (get_local $b10)) (i64.add (i64.mul (get_local $a1) (get_local $b9 )) (i64.add (i64.mul (get_local $a2) (get_local $b8)) (i64.add (i64.mul (get_local $a3) (get_local $b7)) (i64.add (i64.mul (get_local $a4) (get_local $b6)) (i64.add (i64.mul (get_local $a5) (get_local $b5)) (i64.add (i64.mul (get_local $a6) (get_local $b4)) (i64.add (i64.mul (get_local $a7) (get_local $b3)) (i64.add (i64.mul (get_local $a8) (get_local $b2)) (i64.add (i64.mul (get_local $a9) (get_local $b1)) (i64.mul (get_local $a10) (get_local $b0))))))))))))))
+    (set_local $s11 (i64.add (get_local $c11) (i64.add (i64.mul (get_local $a0) (get_local $b11)) (i64.add (i64.mul (get_local $a1) (get_local $b10)) (i64.add (i64.mul (get_local $a2) (get_local $b9)) (i64.add (i64.mul (get_local $a3) (get_local $b8)) (i64.add (i64.mul (get_local $a4) (get_local $b7)) (i64.add (i64.mul (get_local $a5) (get_local $b6)) (i64.add (i64.mul (get_local $a6) (get_local $b5)) (i64.add (i64.mul (get_local $a7) (get_local $b4)) (i64.add (i64.mul (get_local $a8) (get_local $b3)) (i64.add (i64.mul (get_local $a9) (get_local $b2)) (i64.add (i64.mul (get_local $a10) (get_local $b1)) (i64.mul (get_local $a11) (get_local $b0)))))))))))))))
+    (set_local $s12 (i64.add (i64.mul (get_local $a1) (get_local $b11)) (i64.add (i64.mul (get_local $a2) (get_local $b10)) (i64.add (i64.mul (get_local $a3) (get_local $b9)) (i64.add (i64.mul (get_local $a4) (get_local $b8)) (i64.add (i64.mul (get_local $a5) (get_local $b7)) (i64.add (i64.mul (get_local $a6) (get_local $b6)) (i64.add (i64.mul (get_local $a7) (get_local $b5)) (i64.add (i64.mul (get_local $a8) (get_local $b4)) (i64.add (i64.mul (get_local $a9) (get_local $b3)) (i64.add (i64.mul (get_local $a10) (get_local $b2)) (i64.mul (get_local $a11) (get_local $b1)))))))))))))
+    (set_local $s13 (i64.add (i64.mul (get_local $a2) (get_local $b11)) (i64.add (i64.mul (get_local $a3) (get_local $b10)) (i64.add (i64.mul (get_local $a4) (get_local $b9)) (i64.add (i64.mul (get_local $a5) (get_local $b8)) (i64.add (i64.mul (get_local $a6) (get_local $b7)) (i64.add (i64.mul (get_local $a7) (get_local $b6)) (i64.add (i64.mul (get_local $a8) (get_local $b5)) (i64.add (i64.mul (get_local $a9) (get_local $b4)) (i64.add (i64.mul (get_local $a10) (get_local $b3)) (i64.mul (get_local $a11) (get_local $b2))))))))))))
+    (set_local $s14 (i64.add (i64.mul (get_local $a3) (get_local $b11)) (i64.add (i64.mul (get_local $a4) (get_local $b10)) (i64.add (i64.mul (get_local $a5) (get_local $b9)) (i64.add (i64.mul (get_local $a6) (get_local $b8)) (i64.add (i64.mul (get_local $a7) (get_local $b7)) (i64.add (i64.mul (get_local $a8) (get_local $b6)) (i64.add (i64.mul (get_local $a9) (get_local $b5)) (i64.add (i64.mul (get_local $a10) (get_local $b4)) (i64.mul (get_local $a11) (get_local $b3)))))))))))
+    (set_local $s15 (i64.add (i64.mul (get_local $a4) (get_local $b11)) (i64.add (i64.mul (get_local $a5) (get_local $b10)) (i64.add (i64.mul (get_local $a6) (get_local $b9)) (i64.add (i64.mul (get_local $a7) (get_local $b8)) (i64.add (i64.mul (get_local $a8) (get_local $b7)) (i64.add (i64.mul (get_local $a9) (get_local $b6)) (i64.add (i64.mul (get_local $a10) (get_local $b5)) (i64.mul (get_local $a11) (get_local $b4))))))))))
+    (set_local $s16 (i64.add (i64.mul (get_local $a5) (get_local $b11)) (i64.add (i64.mul (get_local $a6) (get_local $b10)) (i64.add (i64.mul (get_local $a7) (get_local $b9)) (i64.add (i64.mul (get_local $a8) (get_local $b8)) (i64.add (i64.mul (get_local $a9) (get_local $b7)) (i64.add (i64.mul (get_local $a10) (get_local $b6)) (i64.mul (get_local $a11) (get_local $b5)))))))))
+    (set_local $s17 (i64.add (i64.mul (get_local $a6) (get_local $b11)) (i64.add (i64.mul (get_local $a7) (get_local $b10)) (i64.add (i64.mul (get_local $a8) (get_local $b9)) (i64.add (i64.mul (get_local $a9) (get_local $b8)) (i64.add (i64.mul (get_local $a10) (get_local $b7)) (i64.mul (get_local $a11) (get_local $b6))))))))
+    (set_local $s18 (i64.add (i64.mul (get_local $a7) (get_local $b11)) (i64.add (i64.mul (get_local $a8) (get_local $b10)) (i64.add (i64.mul (get_local $a9) (get_local $b9)) (i64.add (i64.mul (get_local $a10) (get_local $b8)) (i64.mul (get_local $a11) (get_local $b7)))))))
+    (set_local $s19 (i64.add (i64.mul (get_local $a8) (get_local $b11)) (i64.add (i64.mul (get_local $a9) (get_local $b10)) (i64.add (i64.mul (get_local $a10) (get_local $b9)) (i64.mul (get_local $a11) (get_local $b8))))))
+    (set_local $s20 (i64.add (i64.mul (get_local $a9) (get_local $b11)) (i64.add (i64.mul (get_local $a10) (get_local $b10))  (i64.mul (get_local $a11) (get_local $b9)))))
+    (set_local $s21 (i64.add (i64.mul (get_local $a10) (get_local $b11)) (i64.mul (get_local $a11) (get_local $b10))))
+    (set_local $s22 (i64.mul (get_local $a11) (get_local $b11)))
+    (set_local $s23 (i64.const 0))
+
+    (set_local $carry0 (i64.shr_s (i64.add (get_local $s0) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s1 (i64.add (get_local $s1) (get_local $carry0)))
+    (set_local $s0 (i64.sub (get_local $s0) (i64.mul (get_local $carry0) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry2 (i64.shr_s (i64.add (get_local $s2) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s3 (i64.add (get_local $s3) (get_local $carry2)))
+    (set_local $s2 (i64.sub (get_local $s2) (i64.mul (get_local $carry2) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry4 (i64.shr_s (i64.add (get_local $s4) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s5 (i64.add (get_local $s5) (get_local $carry4)))
+    (set_local $s4 (i64.sub (get_local $s4) (i64.mul (get_local $carry4) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry6 (i64.shr_s (i64.add (get_local $s6) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s7 (i64.add (get_local $s7) (get_local $carry6)))
+    (set_local $s6 (i64.sub (get_local $s6) (i64.mul (get_local $carry6) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry8 (i64.shr_s (i64.add (get_local $s8) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s9 (i64.add (get_local $s9) (get_local $carry8)))
+    (set_local $s8 (i64.sub (get_local $s8) (i64.mul (get_local $carry8) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry10 (i64.shr_s (i64.add (get_local $s10) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s11 (i64.add (get_local $s11) (get_local $carry10)))
+    (set_local $s10 (i64.sub (get_local $s10) (i64.mul (get_local $carry10) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry12 (i64.shr_s (i64.add (get_local $s12) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s13 (i64.add (get_local $s13) (get_local $carry12)))
+    (set_local $s12 (i64.sub (get_local $s12) (i64.mul (get_local $carry12) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry14 (i64.shr_s (i64.add (get_local $s14) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s15 (i64.add (get_local $s15) (get_local $carry14)))
+    (set_local $s14 (i64.sub (get_local $s14) (i64.mul (get_local $carry14) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry16 (i64.shr_s (i64.add (get_local $s16) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s17 (i64.add (get_local $s17) (get_local $carry16)))
+    (set_local $s16 (i64.sub (get_local $s16) (i64.mul (get_local $carry16) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry18 (i64.shr_s (i64.add (get_local $s18) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s19 (i64.add (get_local $s19) (get_local $carry18)))
+    (set_local $s18 (i64.sub (get_local $s18) (i64.mul (get_local $carry18) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry20 (i64.shr_s (i64.add (get_local $s20) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s21 (i64.add (get_local $s21) (get_local $carry20)))
+    (set_local $s20 (i64.sub (get_local $s20) (i64.mul (get_local $carry20) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry22 (i64.shr_s (i64.add (get_local $s22) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s23 (i64.add (get_local $s23) (get_local $carry22)))
+    (set_local $s22 (i64.sub (get_local $s22) (i64.mul (get_local $carry22) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry1 (i64.shr_s (i64.add (get_local $s1) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s2 (i64.add (get_local $s2) (get_local $carry1)))
+    (set_local $s1 (i64.sub (get_local $s1) (i64.mul (get_local $carry1) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry3 (i64.shr_s (i64.add (get_local $s3) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s4 (i64.add (get_local $s4) (get_local $carry3)))
+    (set_local $s3 (i64.sub (get_local $s3) (i64.mul (get_local $carry3) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry5 (i64.shr_s (i64.add (get_local $s5) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s6 (i64.add (get_local $s6) (get_local $carry5)))
+    (set_local $s5 (i64.sub (get_local $s5) (i64.mul (get_local $carry5) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry7 (i64.shr_s (i64.add (get_local $s7) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s8 (i64.add (get_local $s8) (get_local $carry7)))
+    (set_local $s7 (i64.sub (get_local $s7) (i64.mul (get_local $carry7) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry9 (i64.shr_s (i64.add (get_local $s9) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s10 (i64.add (get_local $s10) (get_local $carry9)))
+    (set_local $s9 (i64.sub (get_local $s9) (i64.mul (get_local $carry9) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry11 (i64.shr_s (i64.add (get_local $s11) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s12 (i64.add (get_local $s12) (get_local $carry11)))
+    (set_local $s11 (i64.sub (get_local $s11) (i64.mul (get_local $carry11) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry13 (i64.shr_s (i64.add (get_local $s13) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s14 (i64.add (get_local $s14) (get_local $carry13)))
+    (set_local $s13 (i64.sub (get_local $s13) (i64.mul (get_local $carry13) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry15 (i64.shr_s (i64.add (get_local $s15) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s16 (i64.add (get_local $s16) (get_local $carry15)))
+    (set_local $s15 (i64.sub (get_local $s15) (i64.mul (get_local $carry15) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry17 (i64.shr_s (i64.add (get_local $s17) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s18 (i64.add (get_local $s18) (get_local $carry17)))
+    (set_local $s17 (i64.sub (get_local $s17) (i64.mul (get_local $carry17) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry19 (i64.shr_s (i64.add (get_local $s19) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s20 (i64.add (get_local $s20) (get_local $carry19)))
+    (set_local $s19 (i64.sub (get_local $s19) (i64.mul (get_local $carry19) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry21 (i64.shr_s (i64.add (get_local $s21) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s22 (i64.add (get_local $s22) (get_local $carry21)))
+    (set_local $s21 (i64.sub (get_local $s21) (i64.mul (get_local $carry21) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (get_local $s)
+    (get_local $s0)
+    (get_local $s1)
+    (get_local $s2)
+    (get_local $s3)
+    (get_local $s4)
+    (get_local $s5)
+    (get_local $s6)
+    (get_local $s7)
+    (get_local $s8)
+    (get_local $s9)
+    (get_local $s10)
+    (get_local $s11)
+    (get_local $s12)
+    (get_local $s13)
+    (get_local $s14)
+    (get_local $s15)
+    (get_local $s16)
+    (get_local $s17)
+    (get_local $s18)
+    (get_local $s19)
+    (get_local $s20)
+    (get_local $s21)
+    (get_local $s22)
+    (get_local $s23)
+    (i32.const 0)
+    (call_indirect (type $to_void))))

fe25519_25/sc_reduce.js

@@ -0,0 +1,61 @@
+
+module.exports = loadWebAssembly
+
+loadWebAssembly.supported = typeof WebAssembly !== 'undefined'
+
+function loadWebAssembly (opts) {
+  if (!loadWebAssembly.supported) return null
+
+  var imp = opts && opts.imports
+  var wasm = toUint8Array('AGFzbQEAAAABRgpgAX8AYAF/AX9gAn9/AGABfQBgAX0BfWABfABgAXwBfGABfgBgAX4BfmAZf35+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fgACbggCanMFdGFibGUBcAABBWRlYnVnA2xvZwAABWRlYnVnB2xvZ190ZWUAAQVkZWJ1ZwNsb2cAAgVkZWJ1ZwNsb2cAAwVkZWJ1Zwdsb2dfdGVlAAQFZGVidWcDbG9nAAUFZGVidWcHbG9nX3RlZQAGAwUEBwgJAAUDAQABBycDBm1lbW9yeQIACXNjX3JlZHVjZQAJDnNjMjU1MTlfcmVkdWNlAAoJBwEAQQALAQkKkhgEDQAgAEIgh6cgAKcQAgsJACAAEAcgAA8L+BYBEX4gDCAYQpPYKH58IQwgDSAYQpjaHH58IQ0gDiAYQuf2J358IQ4gDyAYQq3zPH59IQ8gECAYQtGrCH58IRAgESAYQv3eKX59IREgCyAXQpPYKH58IQsgDCAXQpjaHH58IQwgDSAXQuf2J358IQ0gDiAXQq3zPH59IQ4gDyAXQtGrCH58IQ8gECAXQv3eKX59IRAgCiAWQpPYKH58IQogCyAWQpjaHH58IQsgDCAWQuf2J358IQwgDSAWQq3zPH59IQ0gDiAWQtGrCH58IQ4gDyAWQv3eKX59IQ8gCSAVQpPYKH58IQkgCiAVQpjaHH58IQogCyAVQuf2J358IQsgDCAVQq3zPH59IQwgDSAVQtGrCH58IQ0gDiAVQv3eKX59IQ4gCCAUQpPYKH58IQggCSAUQpjaHH58IQkgCiAUQuf2J358IQogCyAUQq3zPH59IQsgDCAUQtGrCH58IQwgDSAUQv3eKX59IQ0gByATQpPYKH58IQcgCCATQpjaHH58IQggCSATQuf2J358IQkgCiATQq3zPH59IQogCyATQtGrCH58IQsgDCATQv3eKX59IQwgB0IBQhSGfEIVhyEfIAggH3whCCAHIB9CAUIVhn59IQcgCUIBQhSGfEIVhyEhIAogIXwhCiAJICFCAUIVhn59IQkgC0IBQhSGfEIVhyEjIAwgI3whDCALICNCAUIVhn59IQsgDUIBQhSGfEIVhyElIA4gJXwhDiANICVCAUIVhn59IQ0gD0IBQhSGfEIVhyEnIBAgJ3whECAPICdCAUIVhn59IQ8gEUIBQhSGfEIVhyEpIBIgKXwhEiARIClCAUIVhn59IREgCEIBQhSGfEIVhyEgIAkgIHwhCSAIICBCAUIVhn59IQggCkIBQhSGfEIVhyEiIAsgInwhCyAKICJCAUIVhn59IQogDEIBQhSGfEIVhyEkIA0gJHwhDSAMICRCAUIVhn59IQwgDkIBQhSGfEIVhyEmIA8gJnwhDyAOICZCAUIVhn59IQ4gEEIBQhSGfEIVhyEoIBEgKHwhESAQIChCAUIVhn59IRAgBiASQpPYKH58IQYgByASQpjaHH58IQcgCCASQuf2J358IQggCSASQq3zPH59IQkgCiASQtGrCH58IQogCyASQv3eKX59IQsgBSARQpPYKH58IQUgBiARQpjaHH58IQYgByARQuf2J358IQcgCCARQq3zPH59IQggCSARQtGrCH58IQkgCiARQv3eKX59IQogBCAQQpPYKH58IQQgBSAQQpjaHH58IQUgBiAQQuf2J358IQYgByAQQq3zPH59IQcgCCAQQtGrCH58IQggCSAQQv3eKX59IQkgAyAPQpPYKH58IQMgBCAPQpjaHH58IQQgBSAPQuf2J358IQUgBiAPQq3zPH59IQYgByAPQtGrCH58IQcgCCAPQv3eKX59IQggAiAOQpPYKH58IQIgAyAOQpjaHH58IQMgBCAOQuf2J358IQQgBSAOQq3zPH59IQUgBiAOQtGrCH58IQYgByAOQv3eKX59IQcgASANQpPYKH58IQEgAiANQpjaHH58IQIgAyANQuf2J358IQMgBCANQq3zPH59IQQgBSANQtGrCH58IQUgBiANQv3eKX59IQZCACENIAFCAUIUhnxCFYchGSACIBl8IQIgASAZQgFCFYZ+fSEBIANCAUIUhnxCFYchGyAEIBt8IQQgAyAbQgFCFYZ+fSEDIAVCAUIUhnxCFYchHSAGIB18IQYgBSAdQgFCFYZ+fSEFIAdCAUIUhnxCFYchHyAIIB98IQggByAfQgFCFYZ+fSEHIAlCAUIUhnxCFYchISAKICF8IQogCSAhQgFCFYZ+fSEJIAtCAUIUhnxCFYchIyAMICN8IQwgCyAjQgFCFYZ+fSELIAJCAUIUhnxCFYchGiADIBp8IQMgAiAaQgFCFYZ+fSECIARCAUIUhnxCFYchHCAFIBx8IQUgBCAcQgFCFYZ+fSEEIAZCAUIUhnxCFYchHiAHIB58IQcgBiAeQgFCFYZ+fSEGIAhCAUIUhnxCFYchICAJICB8IQkgCCAgQgFCFYZ+fSEIIApCAUIUhnxCFYchIiALICJ8IQsgCiAiQgFCFYZ+fSEKIAxCAUIUhnxCFYchJCANICR8IQ0gDCAkQgFCFYZ+fSEMIAEgDUKT2Ch+fCEBIAIgDUKY2hx+fCECIAMgDULn9id+fCEDIAQgDUKt8zx+fSEEIAUgDULRqwh+fCEFIAYgDUL93il+fSEGQgAhDSABQhWHIRkgAiAZfCECIAEgGUIBQhWGfn0hASACQhWHIRogAyAafCEDIAIgGkIBQhWGfn0hAiADQhWHIRsgBCAbfCEEIAMgG0IBQhWGfn0hAyAEQhWHIRwgBSAcfCEFIAQgHEIBQhWGfn0hBCAFQhWHIR0gBiAdfCEGIAUgHUIBQhWGfn0hBSAGQhWHIR4gByAefCEHIAYgHkIBQhWGfn0hBiAHQhWHIR8gCCAffCEIIAcgH0IBQhWGfn0hByAIQhWHISAgCSAgfCEJIAggIEIBQhWGfn0hCCAJQhWHISEgCiAhfCEKIAkgIUIBQhWGfn0hCSAKQhWHISIgCyAifCELIAogIkIBQhWGfn0hCiALQhWHISMgDCAjfCEMIAsgI0IBQhWGfn0hCyAMQhWHISQgDSAkfCENIAwgJEIBQhWGfn0hDCABIA1Ck9gofnwhASACIA1CmNocfnwhAiADIA1C5/YnfnwhAyAEIA1CrfM8fn0hBCAFIA1C0asIfnwhBSAGIA1C/d4pfn0hBiABQhWHIRkgAiAZfCECIAEgGUIBQhWGfn0hASACQhWHIRogAyAafCEDIAIgGkIBQhWGfn0hAiADQhWHIRsgBCAbfCEEIAMgG0IBQhWGfn0hAyAEQhWHIRwgBSAcfCEFIAQgHEIBQhWGfn0hBCAFQhWHIR0gBiAdfCEGIAUgHUIBQhWGfn0hBSAGQhWHIR4gByAefCEHIAYgHkIBQhWGfn0hBiAHQhWHIR8gCCAffCEIIAcgH0IBQhWGfn0hByAIQhWHISAgCSAgfCEJIAggIEIBQhWGfn0hCCAJQhWHISEgCiAhfCEKIAkgIUIBQhWGfn0hCSAKQhWHISIgCyAifCELIAogIkIBQhWGfn0hCiALQhWHISMgDCAjfCEMIAsgI0IBQhWGfn0hCyAAIAFC/wGDIAFCgP4Dg4QgASACQiB+QhCGhEKAgPwHg4QgAkIVhkKAgID4D4OEIAJCFYZCgICAgPAfg4QgAkIVhiADQgR+QiiGhEKAgICAgOA/g4QgA0IqhkKAgICAgIDA/wCDhCADQiqGIARCgAF+QjiGhEKAgICAgICAgH+DhDcDACAAIARCAYdC/wGDIARCAYdCgP4Dg4QgBEIBhyAFQhB+QhCGhEKAgPwHg4QgBUIUhkKAgID4D4OEIAVCFIZCgICAgPAfg4QgBUIUhiAGQgJ+QiiGhEKAgICAgOA/g4QgBkIphkKAgICAgIDA/wCDhCAGQimGIAdCwAB+QjiGhEKAgICAgICAgH+DhDcDCCAAIAdCAodC/wGDIAdCAodCgP4Dg4QgB0IChyAIQgh+QhCGhEKAgPwHg4QgCEIThkKAgID4D4OEIAhCE4ZCgICAgPAfg4QgCUIohkKAgICAgOA/g4QgCUIohkKAgICAgIDA/wCDhCAJQiiGIApCIH5COIaEQoCAgICAgICAf4OENwMQIAAgCkIDh0L/AYMgCkIDh0KA/gODhCAKQgOHIAtCBH5CEIaEQoCA/AeDhCALQhKGQoCAgPgPg4QgC0IShiAMQoABfkIghoRCgICAgPAfg4QgDEInhkKAgICAgOA/g4QgDEInhkKAgICAgIDA/wCDhCAMQieGQoCAgICAgICAf4OENwMYC34AIAAgADUCACAANQIEIAA1AgggADUCDCAANQIQIAA1AhQgADUCGCAANQIcIAA1AiAgADUCJCAANQIoIAA1AiwgADUCMCAANQI0IAA1AjggADUCPCAANQJAIAA1AkQgADUCSCAANQJMIAA1AlAgADUCVCAANQJYIAA1AlwQCQs=')
+  var ready = null
+
+  var mod = {
+    buffer: wasm,
+    memory: null,
+    exports: null,
+    realloc: realloc,
+    onload: onload
+  }
+
+  onload(function () {})
+
+  return mod
+
+  function realloc (size) {
+    mod.exports.memory.grow(Math.max(0, Math.ceil(Math.abs(size - mod.memory.length) / 65536)))
+    mod.memory = new Uint8Array(mod.exports.memory.buffer)
+  }
+
+  function onload (cb) {
+    if (mod.exports) return cb()
+
+    if (ready) {
+      ready.then(cb.bind(null, null)).catch(cb)
+      return
+    }
+
+    try {
+      if (opts && opts.async) throw new Error('async')
+      setup({instance: new WebAssembly.Instance(new WebAssembly.Module(wasm), imp)})
+    } catch (err) {
+      ready = WebAssembly.instantiate(wasm, imp).then(setup)
+    }
+
+    onload(cb)
+  }
+
+  function setup (w) {
+    mod.exports = w.instance.exports
+    mod.memory = mod.exports.memory && mod.exports.memory.buffer && new Uint8Array(mod.exports.memory.buffer)
+  }
+}
+
+function toUint8Array (s) {
+  if (typeof atob === 'function') return new Uint8Array(atob(s).split('').map(charCodeAt))
+  return (require('buf' + 'fer').Buffer).from(s, 'base64')
+}
+
+function charCodeAt (c) {
+  return c.charCodeAt(0)
+}

fe25519_25/sc_reduce.wat

@@ -0,0 +1,542 @@
+(module
+  (import "js" "table" (table 1 anyfunc))
+  (elem (i32.const 0) $sc_reduce)
+
+  (func $i32.log (import "debug" "log") (param i32))
+  (func $i32.log_tee (import "debug" "log_tee") (param i32) (result i32))
+  ;; No i64 interop with JS yet - but maybe coming with WebAssembly BigInt
+  ;; So we can instead fake this by splitting the i64 into two i32 limbs,
+  ;; however these are WASM functions using i32x2.log:
+  (func $i32x2.log (import "debug" "log") (param i32) (param i32))
+  (func $f32.log (import "debug" "log") (param f32))
+  (func $f32.log_tee (import "debug" "log_tee") (param f32) (result f32))
+  (func $f64.log (import "debug" "log") (param f64))
+  (func $f64.log_tee (import "debug" "log_tee") (param f64) (result f64))
+
+  ;; i64 logging by splitting into two i32 limbs
+  (func $i64.log
+    (param $0 i64)
+    (call $i32x2.log
+      ;; Upper limb
+      (i32.wrap/i64
+        (i64.shr_s (get_local $0)
+          (i64.const 32)))
+      ;; Lower limb
+      (i32.wrap/i64 (get_local $0))))
+
+  (func $i64.log_tee
+    (param $0 i64)
+    (result i64)
+    (call $i64.log (get_local $0))
+    (return (get_local $0)))
+
+  (memory $0 1)
+  (export "memory" (memory $0))
+
+  (func $sc_reduce (export "sc_reduce")
+    (param $s i32)
+
+    (param $s0 i64)
+    (param $s1 i64)
+    (param $s2 i64)
+    (param $s3 i64)
+    (param $s4 i64)
+    (param $s5 i64)
+    (param $s6 i64)
+    (param $s7 i64)
+    (param $s8 i64)
+    (param $s9 i64)
+    (param $s10 i64)
+    (param $s11 i64)
+    (param $s12 i64)
+    (param $s13 i64)
+    (param $s14 i64)
+    (param $s15 i64)
+    (param $s16 i64)
+    (param $s17 i64)
+    (param $s18 i64)
+    (param $s19 i64)
+    (param $s20 i64)
+    (param $s21 i64)
+    (param $s22 i64)
+    (param $s23 i64)
+
+    (local $carry0 i64)
+    (local $carry1 i64)
+    (local $carry2 i64)
+    (local $carry3 i64)
+    (local $carry4 i64)
+    (local $carry5 i64)
+    (local $carry6 i64)
+    (local $carry7 i64)
+    (local $carry8 i64)
+    (local $carry9 i64)
+    (local $carry10 i64)
+    (local $carry11 i64)
+    (local $carry12 i64)
+    (local $carry13 i64)
+    (local $carry14 i64)
+    (local $carry15 i64)
+    (local $carry16 i64)
+
+    (set_local $s11 (i64.add (get_local $s11) (i64.mul (get_local $s23) (i64.const 666643))))
+    (set_local $s12 (i64.add (get_local $s12) (i64.mul (get_local $s23) (i64.const 470296))))
+    (set_local $s13 (i64.add (get_local $s13) (i64.mul (get_local $s23) (i64.const 654183))))
+    (set_local $s14 (i64.sub (get_local $s14) (i64.mul (get_local $s23) (i64.const 997805))))
+    (set_local $s15 (i64.add (get_local $s15) (i64.mul (get_local $s23) (i64.const 136657))))
+    (set_local $s16 (i64.sub (get_local $s16) (i64.mul (get_local $s23) (i64.const 683901))))
+
+    (set_local $s10 (i64.add (get_local $s10) (i64.mul (get_local $s22) (i64.const 666643))))
+    (set_local $s11 (i64.add (get_local $s11) (i64.mul (get_local $s22) (i64.const 470296))))
+    (set_local $s12 (i64.add (get_local $s12) (i64.mul (get_local $s22) (i64.const 654183))))
+    (set_local $s13 (i64.sub (get_local $s13) (i64.mul (get_local $s22) (i64.const 997805))))
+    (set_local $s14 (i64.add (get_local $s14) (i64.mul (get_local $s22) (i64.const 136657))))
+    (set_local $s15 (i64.sub (get_local $s15) (i64.mul (get_local $s22) (i64.const 683901))))
+
+    (set_local $s9  (i64.add (get_local $s9 ) (i64.mul (get_local $s21) (i64.const 666643))))
+    (set_local $s10 (i64.add (get_local $s10) (i64.mul (get_local $s21) (i64.const 470296))))
+    (set_local $s11 (i64.add (get_local $s11) (i64.mul (get_local $s21) (i64.const 654183))))
+    (set_local $s12 (i64.sub (get_local $s12) (i64.mul (get_local $s21) (i64.const 997805))))
+    (set_local $s13 (i64.add (get_local $s13) (i64.mul (get_local $s21) (i64.const 136657))))
+    (set_local $s14 (i64.sub (get_local $s14) (i64.mul (get_local $s21) (i64.const 683901))))
+
+    (set_local $s8  (i64.add (get_local $s8 ) (i64.mul (get_local $s20) (i64.const 666643))))
+    (set_local $s9  (i64.add (get_local $s9 ) (i64.mul (get_local $s20) (i64.const 470296))))
+    (set_local $s10 (i64.add (get_local $s10) (i64.mul (get_local $s20) (i64.const 654183))))
+    (set_local $s11 (i64.sub (get_local $s11) (i64.mul (get_local $s20) (i64.const 997805))))
+    (set_local $s12 (i64.add (get_local $s12) (i64.mul (get_local $s20) (i64.const 136657))))
+    (set_local $s13 (i64.sub (get_local $s13) (i64.mul (get_local $s20) (i64.const 683901))))
+
+    (set_local $s7  (i64.add (get_local $s7 ) (i64.mul (get_local $s19) (i64.const 666643))))
+    (set_local $s8  (i64.add (get_local $s8 ) (i64.mul (get_local $s19) (i64.const 470296))))
+    (set_local $s9  (i64.add (get_local $s9 ) (i64.mul (get_local $s19) (i64.const 654183))))
+    (set_local $s10 (i64.sub (get_local $s10) (i64.mul (get_local $s19) (i64.const 997805))))
+    (set_local $s11 (i64.add (get_local $s11) (i64.mul (get_local $s19) (i64.const 136657))))
+    (set_local $s12 (i64.sub (get_local $s12) (i64.mul (get_local $s19) (i64.const 683901))))
+
+    (set_local $s6  (i64.add (get_local $s6 ) (i64.mul (get_local $s18) (i64.const 666643))))
+    (set_local $s7  (i64.add (get_local $s7 ) (i64.mul (get_local $s18) (i64.const 470296))))
+    (set_local $s8  (i64.add (get_local $s8 ) (i64.mul (get_local $s18) (i64.const 654183))))
+    (set_local $s9  (i64.sub (get_local $s9 ) (i64.mul (get_local $s18) (i64.const 997805))))
+    (set_local $s10 (i64.add (get_local $s10) (i64.mul (get_local $s18) (i64.const 136657))))
+    (set_local $s11 (i64.sub (get_local $s11) (i64.mul (get_local $s18) (i64.const 683901))))
+
+    (set_local $carry6 (i64.shr_s (i64.add (get_local $s6) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s7 (i64.add (get_local $s7) (get_local $carry6)))
+    (set_local $s6 (i64.sub (get_local $s6) (i64.mul (get_local $carry6) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry8 (i64.shr_s (i64.add (get_local $s8) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s9 (i64.add (get_local $s9) (get_local $carry8)))
+    (set_local $s8 (i64.sub (get_local $s8) (i64.mul (get_local $carry8) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry10 (i64.shr_s (i64.add (get_local $s10) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s11 (i64.add (get_local $s11) (get_local $carry10)))
+    (set_local $s10 (i64.sub (get_local $s10) (i64.mul (get_local $carry10) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry12 (i64.shr_s (i64.add (get_local $s12) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s13 (i64.add (get_local $s13) (get_local $carry12)))
+    (set_local $s12 (i64.sub (get_local $s12) (i64.mul (get_local $carry12) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry14 (i64.shr_s (i64.add (get_local $s14) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s15 (i64.add (get_local $s15) (get_local $carry14)))
+    (set_local $s14 (i64.sub (get_local $s14) (i64.mul (get_local $carry14) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry16 (i64.shr_s (i64.add (get_local $s16) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s17 (i64.add (get_local $s17) (get_local $carry16)))
+    (set_local $s16 (i64.sub (get_local $s16) (i64.mul (get_local $carry16) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry7 (i64.shr_s (i64.add (get_local $s7) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s8 (i64.add (get_local $s8) (get_local $carry7)))
+    (set_local $s7 (i64.sub (get_local $s7) (i64.mul (get_local $carry7) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry9 (i64.shr_s (i64.add (get_local $s9) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s10 (i64.add (get_local $s10) (get_local $carry9)))
+    (set_local $s9 (i64.sub (get_local $s9) (i64.mul (get_local $carry9) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry11 (i64.shr_s (i64.add (get_local $s11) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s12 (i64.add (get_local $s12) (get_local $carry11)))
+    (set_local $s11 (i64.sub (get_local $s11) (i64.mul (get_local $carry11) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry13 (i64.shr_s (i64.add (get_local $s13) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s14 (i64.add (get_local $s14) (get_local $carry13)))
+    (set_local $s13 (i64.sub (get_local $s13) (i64.mul (get_local $carry13) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry15 (i64.shr_s (i64.add (get_local $s15) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s16 (i64.add (get_local $s16) (get_local $carry15)))
+    (set_local $s15 (i64.sub (get_local $s15) (i64.mul (get_local $carry15) (i64.shl (i64.const 1) (i64.const 21)))))
+    
+    (set_local $s5 (i64.add (get_local $s5 ) (i64.mul (get_local $s17) (i64.const 666643))))
+    (set_local $s6 (i64.add (get_local $s6 ) (i64.mul (get_local $s17) (i64.const 470296))))
+    (set_local $s7 (i64.add (get_local $s7 ) (i64.mul (get_local $s17) (i64.const 654183))))
+    (set_local $s8 (i64.sub (get_local $s8 ) (i64.mul (get_local $s17) (i64.const 997805))))
+    (set_local $s9 (i64.add (get_local $s9 ) (i64.mul (get_local $s17) (i64.const 136657))))
+    (set_local $s10 (i64.sub (get_local $s10) (i64.mul (get_local $s17) (i64.const 683901))))
+
+    (set_local $s4 (i64.add (get_local $s4) (i64.mul (get_local $s16) (i64.const 666643))))
+    (set_local $s5 (i64.add (get_local $s5) (i64.mul (get_local $s16) (i64.const 470296))))
+    (set_local $s6 (i64.add (get_local $s6) (i64.mul (get_local $s16) (i64.const 654183))))
+    (set_local $s7 (i64.sub (get_local $s7) (i64.mul (get_local $s16) (i64.const 997805))))
+    (set_local $s8 (i64.add (get_local $s8) (i64.mul (get_local $s16) (i64.const 136657))))
+    (set_local $s9 (i64.sub (get_local $s9) (i64.mul (get_local $s16) (i64.const 683901))))
+
+    (set_local $s3 (i64.add (get_local $s3) (i64.mul (get_local $s15) (i64.const 666643))))
+    (set_local $s4 (i64.add (get_local $s4) (i64.mul (get_local $s15) (i64.const 470296))))
+    (set_local $s5 (i64.add (get_local $s5) (i64.mul (get_local $s15) (i64.const 654183))))
+    (set_local $s6 (i64.sub (get_local $s6) (i64.mul (get_local $s15) (i64.const 997805))))
+    (set_local $s7 (i64.add (get_local $s7) (i64.mul (get_local $s15) (i64.const 136657))))
+    (set_local $s8 (i64.sub (get_local $s8) (i64.mul (get_local $s15) (i64.const 683901))))
+
+    (set_local $s2 (i64.add (get_local $s2) (i64.mul (get_local $s14) (i64.const 666643))))
+    (set_local $s3 (i64.add (get_local $s3) (i64.mul (get_local $s14) (i64.const 470296))))
+    (set_local $s4 (i64.add (get_local $s4) (i64.mul (get_local $s14) (i64.const 654183))))
+    (set_local $s5 (i64.sub (get_local $s5) (i64.mul (get_local $s14) (i64.const 997805))))
+    (set_local $s6 (i64.add (get_local $s6) (i64.mul (get_local $s14) (i64.const 136657))))
+    (set_local $s7 (i64.sub (get_local $s7) (i64.mul (get_local $s14) (i64.const 683901))))
+
+    (set_local $s1 (i64.add (get_local $s1) (i64.mul (get_local $s13) (i64.const 666643))))
+    (set_local $s2 (i64.add (get_local $s2) (i64.mul (get_local $s13) (i64.const 470296))))
+    (set_local $s3 (i64.add (get_local $s3) (i64.mul (get_local $s13) (i64.const 654183))))
+    (set_local $s4 (i64.sub (get_local $s4) (i64.mul (get_local $s13) (i64.const 997805))))
+    (set_local $s5 (i64.add (get_local $s5) (i64.mul (get_local $s13) (i64.const 136657))))
+    (set_local $s6 (i64.sub (get_local $s6) (i64.mul (get_local $s13) (i64.const 683901))))
+
+    (set_local $s0 (i64.add (get_local $s0) (i64.mul (get_local $s12) (i64.const 666643))))
+    (set_local $s1 (i64.add (get_local $s1) (i64.mul (get_local $s12) (i64.const 470296))))
+    (set_local $s2 (i64.add (get_local $s2) (i64.mul (get_local $s12) (i64.const 654183))))
+    (set_local $s3 (i64.sub (get_local $s3) (i64.mul (get_local $s12) (i64.const 997805))))
+    (set_local $s4 (i64.add (get_local $s4) (i64.mul (get_local $s12) (i64.const 136657))))
+    (set_local $s5 (i64.sub (get_local $s5) (i64.mul (get_local $s12) (i64.const 683901))))
+    (set_local $s12 (i64.const 0))
+
+    (set_local $carry0 (i64.shr_s (i64.add (get_local $s0) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s1 (i64.add (get_local $s1) (get_local $carry0)))
+    (set_local $s0 (i64.sub (get_local $s0) (i64.mul (get_local $carry0) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry2 (i64.shr_s (i64.add (get_local $s2) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s3 (i64.add (get_local $s3) (get_local $carry2)))
+    (set_local $s2 (i64.sub (get_local $s2) (i64.mul (get_local $carry2) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry4 (i64.shr_s (i64.add (get_local $s4) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s5 (i64.add (get_local $s5) (get_local $carry4)))
+    (set_local $s4 (i64.sub (get_local $s4) (i64.mul (get_local $carry4) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry6 (i64.shr_s (i64.add (get_local $s6) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s7 (i64.add (get_local $s7) (get_local $carry6)))
+    (set_local $s6 (i64.sub (get_local $s6) (i64.mul (get_local $carry6) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry8 (i64.shr_s (i64.add (get_local $s8) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s9 (i64.add (get_local $s9) (get_local $carry8)))
+    (set_local $s8 (i64.sub (get_local $s8) (i64.mul (get_local $carry8) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry10 (i64.shr_s (i64.add (get_local $s10) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s11 (i64.add (get_local $s11) (get_local $carry10)))
+    (set_local $s10 (i64.sub (get_local $s10) (i64.mul (get_local $carry10) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry1 (i64.shr_s (i64.add (get_local $s1) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s2 (i64.add (get_local $s2) (get_local $carry1)))
+    (set_local $s1 (i64.sub (get_local $s1) (i64.mul (get_local $carry1) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry3 (i64.shr_s (i64.add (get_local $s3) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s4 (i64.add (get_local $s4) (get_local $carry3)))
+    (set_local $s3 (i64.sub (get_local $s3) (i64.mul (get_local $carry3) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry5 (i64.shr_s (i64.add (get_local $s5) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s6 (i64.add (get_local $s6) (get_local $carry5)))
+    (set_local $s5 (i64.sub (get_local $s5) (i64.mul (get_local $carry5) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry7 (i64.shr_s (i64.add (get_local $s7) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s8 (i64.add (get_local $s8) (get_local $carry7)))
+    (set_local $s7 (i64.sub (get_local $s7) (i64.mul (get_local $carry7) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry9 (i64.shr_s (i64.add (get_local $s9) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s10 (i64.add (get_local $s10) (get_local $carry9)))
+    (set_local $s9 (i64.sub (get_local $s9) (i64.mul (get_local $carry9) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry11 (i64.shr_s (i64.add (get_local $s11) (i64.shl (i64.const 1) (i64.const 20))) (i64.const 21)))
+    (set_local $s12 (i64.add (get_local $s12) (get_local $carry11)))
+    (set_local $s11 (i64.sub (get_local $s11) (i64.mul (get_local $carry11) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $s0 (i64.add (get_local $s0) (i64.mul (get_local $s12) (i64.const 666643))))
+    (set_local $s1 (i64.add (get_local $s1) (i64.mul (get_local $s12) (i64.const 470296))))
+    (set_local $s2 (i64.add (get_local $s2) (i64.mul (get_local $s12) (i64.const 654183))))
+    (set_local $s3 (i64.sub (get_local $s3) (i64.mul (get_local $s12) (i64.const 997805))))
+    (set_local $s4 (i64.add (get_local $s4) (i64.mul (get_local $s12) (i64.const 136657))))
+    (set_local $s5 (i64.sub (get_local $s5) (i64.mul (get_local $s12) (i64.const 683901))))
+    (set_local $s12 (i64.const 0))
+
+    (set_local $carry0 (i64.shr_s (get_local $s0) (i64.const 21)))
+    (set_local $s1 (i64.add (get_local $s1) (get_local $carry0)))
+    (set_local $s0 (i64.sub (get_local $s0) (i64.mul (get_local $carry0) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry1 (i64.shr_s (get_local $s1) (i64.const 21)))
+    (set_local $s2 (i64.add (get_local $s2) (get_local $carry1)))
+    (set_local $s1 (i64.sub (get_local $s1) (i64.mul (get_local $carry1) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry2 (i64.shr_s (get_local $s2) (i64.const 21)))
+    (set_local $s3 (i64.add (get_local $s3) (get_local $carry2)))
+    (set_local $s2 (i64.sub (get_local $s2) (i64.mul (get_local $carry2) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry3 (i64.shr_s (get_local $s3) (i64.const 21)))
+    (set_local $s4 (i64.add (get_local $s4) (get_local $carry3)))
+    (set_local $s3 (i64.sub (get_local $s3) (i64.mul (get_local $carry3) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry4 (i64.shr_s (get_local $s4) (i64.const 21)))
+    (set_local $s5 (i64.add (get_local $s5) (get_local $carry4)))
+    (set_local $s4 (i64.sub (get_local $s4) (i64.mul (get_local $carry4) (i64.shl (i64.const 1) (i64.const 21)))))
+    
+    (set_local $carry5 (i64.shr_s (get_local $s5) (i64.const 21)))
+    (set_local $s6 (i64.add (get_local $s6) (get_local $carry5)))
+    (set_local $s5 (i64.sub (get_local $s5) (i64.mul (get_local $carry5) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry6 (i64.shr_s (get_local $s6) (i64.const 21)))
+    (set_local $s7 (i64.add (get_local $s7) (get_local $carry6)))
+    (set_local $s6 (i64.sub (get_local $s6) (i64.mul (get_local $carry6) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry7 (i64.shr_s (get_local $s7) (i64.const 21)))
+    (set_local $s8 (i64.add (get_local $s8) (get_local $carry7)))
+    (set_local $s7 (i64.sub (get_local $s7) (i64.mul (get_local $carry7) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry8 (i64.shr_s (get_local $s8) (i64.const 21)))
+    (set_local $s9 (i64.add (get_local $s9) (get_local $carry8)))
+    (set_local $s8 (i64.sub (get_local $s8) (i64.mul (get_local $carry8) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry9 (i64.shr_s (get_local $s9) (i64.const 21)))
+    (set_local $s10 (i64.add (get_local $s10) (get_local $carry9)))
+    (set_local $s9 (i64.sub (get_local $s9) (i64.mul (get_local $carry9) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry10 (i64.shr_s (get_local $s10) (i64.const 21)))
+    (set_local $s11 (i64.add (get_local $s11) (get_local $carry10)))
+    (set_local $s10 (i64.sub (get_local $s10) (i64.mul (get_local $carry10) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry11 (i64.shr_s (get_local $s11) (i64.const 21)))
+    (set_local $s12 (i64.add (get_local $s12) (get_local $carry11)))
+    (set_local $s11 (i64.sub (get_local $s11) (i64.mul (get_local $carry11) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $s0 (i64.add (get_local $s0) (i64.mul (get_local $s12) (i64.const 666643))))
+    (set_local $s1 (i64.add (get_local $s1) (i64.mul (get_local $s12) (i64.const 470296))))
+    (set_local $s2 (i64.add (get_local $s2) (i64.mul (get_local $s12) (i64.const 654183))))
+    (set_local $s3 (i64.sub (get_local $s3) (i64.mul (get_local $s12) (i64.const 997805))))
+    (set_local $s4 (i64.add (get_local $s4) (i64.mul (get_local $s12) (i64.const 136657))))
+    (set_local $s5 (i64.sub (get_local $s5) (i64.mul (get_local $s12) (i64.const 683901))))
+
+    (set_local $carry0 (i64.shr_s (get_local $s0) (i64.const 21)))
+    (set_local $s1 (i64.add (get_local $s1) (get_local $carry0)))
+    (set_local $s0 (i64.sub (get_local $s0) (i64.mul (get_local $carry0) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry1 (i64.shr_s (get_local $s1) (i64.const 21)))
+    (set_local $s2 (i64.add (get_local $s2) (get_local $carry1)))
+    (set_local $s1 (i64.sub (get_local $s1) (i64.mul (get_local $carry1) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry2 (i64.shr_s (get_local $s2) (i64.const 21)))
+    (set_local $s3 (i64.add (get_local $s3) (get_local $carry2)))
+    (set_local $s2 (i64.sub (get_local $s2) (i64.mul (get_local $carry2) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry3 (i64.shr_s (get_local $s3) (i64.const 21)))
+    (set_local $s4 (i64.add (get_local $s4) (get_local $carry3)))
+    (set_local $s3 (i64.sub (get_local $s3) (i64.mul (get_local $carry3) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry4 (i64.shr_s (get_local $s4) (i64.const 21)))
+    (set_local $s5 (i64.add (get_local $s5) (get_local $carry4)))
+    (set_local $s4 (i64.sub (get_local $s4) (i64.mul (get_local $carry4) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry5 (i64.shr_s (get_local $s5) (i64.const 21)))
+    (set_local $s6 (i64.add (get_local $s6) (get_local $carry5)))
+    (set_local $s5 (i64.sub (get_local $s5) (i64.mul (get_local $carry5) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry6 (i64.shr_s (get_local $s6) (i64.const 21)))
+    (set_local $s7 (i64.add (get_local $s7) (get_local $carry6)))
+    (set_local $s6 (i64.sub (get_local $s6) (i64.mul (get_local $carry6) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry7 (i64.shr_s (get_local $s7) (i64.const 21)))
+    (set_local $s8 (i64.add (get_local $s8) (get_local $carry7)))
+    (set_local $s7 (i64.sub (get_local $s7) (i64.mul (get_local $carry7) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry8 (i64.shr_s (get_local $s8) (i64.const 21)))
+    (set_local $s9 (i64.add (get_local $s9) (get_local $carry8)))
+    (set_local $s8 (i64.sub (get_local $s8) (i64.mul (get_local $carry8) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry9 (i64.shr_s (get_local $s9) (i64.const 21)))
+    (set_local $s10 (i64.add (get_local $s10) (get_local $carry9)))
+    (set_local $s9 (i64.sub (get_local $s9) (i64.mul (get_local $carry9) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (set_local $carry10 (i64.shr_s (get_local $s10) (i64.const 21)))
+    (set_local $s11 (i64.add (get_local $s11) (get_local $carry10)))
+    (set_local $s10 (i64.sub (get_local $s10) (i64.mul (get_local $carry10) (i64.shl (i64.const 1) (i64.const 21)))))
+
+    (get_local $s)
+
+    (i64.and (get_local $s0) (i64.const 0xff))
+    (i64.and (get_local $s0) (i64.const 0xff00))
+    (i64.or)
+    (get_local $s0)
+    (i64.shl (i64.mul (get_local $s1) (i64.const 32)) (i64.const 16))
+    (i64.or)
+    (i64.const 0xff0000)
+    (i64.and)
+    (i64.or)
+    (i64.shl (get_local $s1) (i64.const 21))
+    (i64.const 0xff000000)
+    (i64.and)
+    (i64.or)
+    (i64.shl (get_local $s1) (i64.const 21))
+    (i64.const 0xff00000000)
+    (i64.and)
+    (i64.or)
+    (i64.shl (get_local $s1) (i64.const 21))
+    (i64.shl (i64.mul (get_local $s2) (i64.const 4)) (i64.const 40))
+    (i64.or)
+    (i64.const 0xff0000000000)
+    (i64.and)
+    (i64.or)
+    (i64.shl (get_local $s2) (i64.const 42))
+    (i64.const 0xff000000000000)
+    (i64.and)
+    (i64.or)
+    (i64.shl (get_local $s2) (i64.const 42))
+    (i64.shl (i64.mul (get_local $s3) (i64.const 128)) (i64.const 56))
+    (i64.or)
+    (i64.const 0xff00000000000000)
+    (i64.and)
+    (i64.or)
+
+    (i64.store offset=0)
+
+    (get_local $s)
+
+    (i64.and (i64.shr_s (get_local $s3) (i64.const 1)) (i64.const 0xff))
+    (i64.and (i64.shr_s (get_local $s3) (i64.const 1)) (i64.const 0xff00))
+    (i64.or)
+    (i64.shr_s (get_local $s3) (i64.const 1))
+    (i64.shl (i64.mul (get_local $s4) (i64.const 16)) (i64.const 16))
+    (i64.or)
+    (i64.const 0xff0000)
+    (i64.and)
+    (i64.or)
+    (i64.shl (get_local $s4) (i64.const 20))
+    (i64.const 0xff000000)
+    (i64.and)
+    (i64.or)
+    (i64.shl (get_local $s4) (i64.const 20))
+    (i64.const 0xff00000000)
+    (i64.and)
+    (i64.or)
+    (i64.shl (get_local $s4) (i64.const 20))
+    (i64.shl (i64.mul (get_local $s5) (i64.const 2)) (i64.const 40))
+    (i64.or)
+    (i64.const 0xff0000000000)
+    (i64.and)
+    (i64.or)
+    (i64.shl (get_local $s5) (i64.const 41))
+    (i64.const 0xff000000000000)
+    (i64.and)
+    (i64.or)
+    (i64.shl (get_local $s5) (i64.const 41))
+    (i64.shl (i64.mul (get_local $s6) (i64.const 64)) (i64.const 56))
+    (i64.or)
+    (i64.const 0xff00000000000000)
+    (i64.and)
+    (i64.or)
+
+    (i64.store offset=8)
+
+    (get_local $s)
+
+    (i64.and (i64.shr_s (get_local $s6) (i64.const 2)) (i64.const 0xff))
+    (i64.and (i64.shr_s (get_local $s6) (i64.const 2)) (i64.const 0xff00))
+    (i64.or)
+    (i64.shr_s (get_local $s6) (i64.const 2))
+    (i64.shl (i64.mul (get_local $s7) (i64.const 8)) (i64.const 16))
+    (i64.or)
+    (i64.const 0xff0000)
+    (i64.and)
+    (i64.or)
+    (i64.shl (get_local $s7) (i64.const 19))
+    (i64.const 0xff000000)
+    (i64.and)
+    (i64.or)
+    (i64.shl (get_local $s7) (i64.const 19))
+    (i64.const 0xff00000000)
+    (i64.and)
+    (i64.or)
+    (i64.shl (get_local $s8) (i64.const 40))
+    (i64.const 0xff0000000000)
+    (i64.and)
+    (i64.or)
+    (i64.shl (get_local $s8) (i64.const 40))
+    (i64.const 0xff000000000000)
+    (i64.and)
+    (i64.or)
+    (i64.shl (get_local $s8) (i64.const 40))
+    (i64.shl (i64.mul (get_local $s9) (i64.const 32)) (i64.const 56))
+    (i64.or)
+    (i64.const 0xff00000000000000)
+    (i64.and)
+    (i64.or)
+
+    (i64.store offset=16)
+
+    (get_local $s)
+
+    (i64.and (i64.shr_s (get_local $s9) (i64.const 3)) (i64.const 0xff))
+    (i64.and (i64.shr_s (get_local $s9) (i64.const 3)) (i64.const 0xff00))
+    (i64.or)
+    (i64.shr_s (get_local $s9) (i64.const 3))
+    (i64.shl (i64.mul (get_local $s10) (i64.const 4)) (i64.const 16))
+    (i64.or)
+    (i64.const 0xff0000)
+    (i64.and)
+    (i64.or)
+    (i64.shl (get_local $s10) (i64.const 18))
+    (i64.const 0xff000000)
+    (i64.and)
+    (i64.or)
+    (i64.shl (get_local $s10) (i64.const 18))
+    (i64.shl (i64.mul (get_local $s11) (i64.const 128)) (i64.const 32))
+    (i64.or)
+    (i64.const 0xff00000000)
+    (i64.and)
+    (i64.or)
+    (i64.shl (get_local $s11) (i64.const 39))
+    (i64.const 0xff0000000000)
+    (i64.and)
+    (i64.or)
+    (i64.shl (get_local $s11) (i64.const 39))
+    (i64.const 0xff000000000000)
+    (i64.and)
+    (i64.or)
+    (i64.shl (get_local $s11) (i64.const 39))
+    (i64.const 0xff00000000000000)
+    (i64.and)
+    (i64.or)
+
+    (i64.store offset=24))
+
+  (func $sc25519_reduce (export "sc25519_reduce") (param $s i32)
+    (get_local $s)
+    (i64.load32_u offset=0  (get_local $s))
+    (i64.load32_u offset=4  (get_local $s))
+    (i64.load32_u offset=8  (get_local $s))
+    (i64.load32_u offset=12 (get_local $s))
+    (i64.load32_u offset=16 (get_local $s))
+    (i64.load32_u offset=20 (get_local $s))
+    (i64.load32_u offset=24 (get_local $s))
+    (i64.load32_u offset=28 (get_local $s))
+    (i64.load32_u offset=32 (get_local $s))
+    (i64.load32_u offset=36 (get_local $s))
+    (i64.load32_u offset=40 (get_local $s))
+    (i64.load32_u offset=44 (get_local $s))
+    (i64.load32_u offset=48 (get_local $s))
+    (i64.load32_u offset=52 (get_local $s))
+    (i64.load32_u offset=56 (get_local $s))
+    (i64.load32_u offset=60 (get_local $s))
+    (i64.load32_u offset=64 (get_local $s))
+    (i64.load32_u offset=68 (get_local $s))
+    (i64.load32_u offset=72 (get_local $s))
+    (i64.load32_u offset=76 (get_local $s))
+    (i64.load32_u offset=80 (get_local $s))
+    (i64.load32_u offset=84 (get_local $s))
+    (i64.load32_u offset=88 (get_local $s))
+    (i64.load32_u offset=92 (get_local $s))
+    (call $sc_reduce)))
+
+    

fe25519_25/scalarmult_curve25519.js

@@ -0,0 +1,61 @@
+
+module.exports = loadWebAssembly
+
+loadWebAssembly.supported = typeof WebAssembly !== 'undefined'
+
+function loadWebAssembly (opts) {
+  if (!loadWebAssembly.supported) return null
+
+  var imp = opts && opts.imports
+  var wasm = toUint8Array('AGFzbQEAAAABZg1gFX5+fn5+fn5+fn5+fn5+fn5+fn5+fwBgDX5+fn5+fn5+fn5/f38AYAt+fn5+fn5+fn5+fwBgAX8AYAF/AX9gAn9/AGABfQBgAX0BfWABfABgAXwBfGABfgBgAX4BfmADf39/AAJ4CQJqcwV0YWJsZQFwAAMCanMDbWVtAgABBWRlYnVnA2xvZwADBWRlYnVnB2xvZ190ZWUABAVkZWJ1ZwNsb2cABQVkZWJ1ZwNsb2cABgVkZWJ1Zwdsb2dfdGVlAAcFZGVidWcDbG9nAAgFZGVidWcHbG9nX3RlZQAJAwQDCgsMBw4BCnNjYWxhcm11bHQACQqLGQMNACAAQiCHpyAApxACCwkAIAAQByAADwvwGAIHf0x+QZADIQZBuAMhB0HgAyEIQYgEIQkgAikDACEMIAIpAwghDSACKQMQIQ4gAikDGCEPIAE1AgAhECABNQIEIREgATUCCCESIAE1AgwhEyABNQIQIRQgATUCFCEVIAE1AhghFiABNQIcIRcgATUCICEYIAE1AiQhGUIBIRpCACEbQgAhHEIAIR1CACEeQgAhH0IAISBCACEhQgAhIkIAISMgATUCACEuIAE1AgQhLyABNQIIITAgATUCDCExIAE1AhAhMiABNQIUITMgATUCGCE0IAE1AhwhNSABNQIgITYgATUCJCE3QgAhJEIAISVCACEmQgAhJ0IAIShCACEpQgAhKkIAIStCACEsQgAhLUIBIThCACE5QgAhOkIAITtCACE8QgAhPUIAIT5CACE/QgAhQEIAIUFB/gEhBQJAA0AgBUEASA0BAkACQAJAAkACQAJAIAVBwABuDgMEAwIBCwsgDyELDAMLIA4hCwwCCyANIQsMAQsgDCELCyALIAVBCG5BCHBBCGytiEL/AYMgBUEHca2IQgGDpyEEIAMgBHMhA0EAIANrrSEKIBogLoUgCoMhQiAbIC+FIAqDIUMgHCAwhSAKgyFEIB0gMYUgCoMhRSAeIDKFIAqDIUYgHyAzhSAKgyFHICAgNIUgCoMhSCAhIDWFIAqDIUkgIiA2hSAKgyFKICMgN4UgCoMhSyAaIEKFIRogGyBDhSEbIBwgRIUhHCAdIEWFIR0gHiBGhSEeIB8gR4UhHyAgIEiFISAgISBJhSEhICIgSoUhIiAjIEuFISMgLiBChSEuIC8gQ4UhLyAwIESFITAgMSBFhSExIDIgRoUhMiAzIEeFITMgNCBIhSE0IDUgSYUhNSA2IEqFITYgNyBLhSE3IDggJIUgCoMhQiA5ICWFIAqDIUMgOiAmhSAKgyFEIDsgJ4UgCoMhRSA8ICiFIAqDIUYgPSAphSAKgyFHID4gKoUgCoMhSCA/ICuFIAqDIUkgQCAshSAKgyFKIEEgLYUgCoMhSyAkIEKFISQgJSBDhSElICYgRIUhJiAnIEWFIScgKCBGhSEoICkgR4UhKSAqIEiFISogKyBJhSErICwgSoUhLCAtIEuFIS0gOCBChSE4IDkgQ4UhOSA6IESFITogOyBFhSE7IDwgRoUhPCA9IEeFIT0gPiBIhSE+ID8gSYUhPyBAIEqFIUAgQSBLhSFBIAQhAyAuIDh9IUIgLyA5fSFDIDAgOn0hRCAxIDt9IUUgMiA8fSFGIDMgPX0hRyA0ID59IUggNSA/fSFJIDYgQH0hSiA3IEF9IUsgGiAkfSFMIBsgJX0hTSAcICZ9IU4gHSAnfSFPIB4gKH0hUCAfICl9IVEgICAqfSFSICEgK30hUyAiICx9IVQgIyAtfSFVIBogJHwhGiAbICV8IRsgHCAmfCEcIB0gJ3whHSAeICh8IR4gHyApfCEfICAgKnwhICAhICt8ISEgIiAsfCEiICMgLXwhIyAuIDh8ISQgLyA5fCElIDAgOnwhJiAxIDt8IScgMiA8fCEoIDMgPXwhKSA0ID58ISogNSA/fCErIDYgQHwhLCA3IEF8IS0gGiAbIBwgHSAeIB8gICAhICIgIyBCIEMgRCBFIEYgRyBIIEkgSiBLIAZBAREAACBMIE0gTiBPIFAgUSBSIFMgVCBVICQgJSAmICcgKCApICogKyAsIC0gB0EBEQAAIEwgTSBOIE8gUCBRIFIgUyBUIFVBAEEAIAhBAhEBACAaIBsgHCAdIB4gHyAgICEgIiAjQQBBACAJQQIRAQAgBjUCACE4IAY1AgQhOSAGNQIIITogBjUCDCE7IAY1AhAhPCAGNQIUIT0gBjUCGCE+IAY1AhwhPyAGNQIgIUAgBjUCJCFBIAc1AgAhJCAHNQIEISUgBzUCCCEmIAc1AgwhJyAHNQIQISggBzUCFCEpIAc1AhghKiAHNQIcISsgBzUCICEsIAc1AiQhLSAINQIAIUIgCDUCBCFDIAg1AgghRCAINQIMIUUgCDUCECFGIAg1AhQhRyAINQIYIUggCDUCHCFJIAg1AiAhSiAINQIkIUsgCTUCACFMIAk1AgQhTSAJNQIIIU4gCTUCDCFPIAk1AhAhUCAJNQIUIVEgCTUCGCFSIAk1AhwhUyAJNQIgIVQgCTUCJCFVIDggJHwhLiA5ICV8IS8gOiAmfCEwIDsgJ3whMSA8ICh8ITIgPSApfCEzID4gKnwhNCA/ICt8ITUgQCAsfCE2IEEgLXwhNyA4ICR9ISQgOSAlfSElIDogJn0hJiA7ICd9IScgPCAofSEoID0gKX0hKSA+ICp9ISogPyArfSErIEAgLH0hLCBBIC19IS0gTCBNIE4gTyBQIFEgUiBTIFQgVSBCIEMgRCBFIEYgRyBIIEkgSiBLIAZBAREAACBMIEJ9IUwgTSBDfSFNIE4gRH0hTiBPIEV9IU8gUCBGfSFQIFEgR30hUSBSIEh9IVIgUyBJfSFTIFQgSn0hVCBVIEt9IVUgJCAlICYgJyAoICkgKiArICwgLUEAQQAgB0ECEQEAQsK2B0IAQgBCAEIAQgBCAEIAQgBCACBMIE0gTiBPIFAgUSBSIFMgVCBVIAhBAREAACAuIC8gMCAxIDIgMyA0IDUgNiA3QQBBACAJQQIRAQAgBjUCACEaIAY1AgQhGyAGNQIIIRwgBjUCDCEdIAY1AhAhHiAGNQIUIR8gBjUCGCEgIAY1AhwhISAGNQIgISIgBjUCJCEjIAc1AgAhJCAHNQIEISUgBzUCCCEmIAc1AgwhJyAHNQIQISggBzUCFCEpIAc1AhghKiAHNQIcISsgBzUCICEsIAc1AiQhLSAINQIAITggCDUCBCE5IAg1AgghOiAINQIMITsgCDUCECE8IAg1AhQhPSAINQIYIT4gCDUCHCE/IAg1AiAhQCAINQIkIUEgCTUCACEuIAk1AgQhLyAJNQIIITAgCTUCDCExIAk1AhAhMiAJNQIUITMgCTUCGCE0IAk1AhwhNSAJNQIgITYgCTUCJCE3IEIgOHwhQiBDIDl8IUMgRCA6fCFEIEUgO3whRSBGIDx8IUYgRyA9fCFHIEggPnwhSCBJID98IUkgSiBAfCFKIEsgQXwhSyAQIBEgEiATIBQgFSAWIBcgGCAZICQgJSAmICcgKCApICogKyAsIC0gB0EBEQAAIEIgQyBEIEUgRiBHIEggSSBKIEsgTCBNIE4gTyBQIFEgUiBTIFQgVSAGQQERAAAgBjUCACEkIAY1AgQhJSAGNQIIISYgBjUCDCEnIAY1AhAhKCAGNQIUISkgBjUCGCEqIAY1AhwhKyAGNQIgISwgBjUCJCEtIAc1AgAhOCAHNQIEITkgBzUCCCE6IAc1AgwhOyAHNQIQITwgBzUCFCE9IAc1AhghPiAHNQIcIT8gBzUCICFAIAc1AiQhQSAFQQFrIQUMAAsLQQAgA2utIQogGiAuhSAKgyFCIBsgL4UgCoMhQyAcIDCFIAqDIUQgHSAxhSAKgyFFIB4gMoUgCoMhRiAfIDOFIAqDIUcgICA0hSAKgyFIICEgNYUgCoMhSSAiIDaFIAqDIUogIyA3hSAKgyFLIBogQoUhGiAbIEOFIRsgHCBEhSEcIB0gRYUhHSAeIEaFIR4gHyBHhSEfICAgSIUhICAhIEmFISEgIiBKhSEiICMgS4UhIyAuIEKFIS4gLyBDhSEvIDAgRIUhMCAxIEWFITEgMiBGhSEyIDMgR4UhMyA0IEiFITQgNSBJhSE1IDYgSoUhNiA3IEuFITcgJCA4hSAKgyFCICUgOYUgCoMhQyAmIDqFIAqDIUQgJyA7hSAKgyFFICggPIUgCoMhRiApID2FIAqDIUcgKiA+hSAKgyFIICsgP4UgCoMhSSAsIECFIAqDIUogLSBBhSAKgyFLICQgQoUhJCAlIEOFISUgJiBEhSEmICcgRYUhJyAoIEaFISggKSBHhSEpICogSIUhKiArIEmFISsgLCBKhSEsIC0gS4UhLSA4IEKFITggOSBDhSE5IDogRIUhOiA7IEWFITsgPCBGhSE8ID0gR4UhPSA+IEiFIT4gPyBJhSE/IEAgSoUhQCBBIEuFIUEgJCAlICYgJyAoICkgKiArICwgLSAGQQMRAgAgBjUCACAGNQIEIAY1AgggBjUCDCAGNQIQIAY1AhQgBjUCGCAGNQIcIAY1AiAgBjUCJCAaIBsgHCAdIB4gHyAgICEgIiAjIABBAREAAAs=')
+  var ready = null
+
+  var mod = {
+    buffer: wasm,
+    memory: null,
+    exports: null,
+    realloc: realloc,
+    onload: onload
+  }
+
+  onload(function () {})
+
+  return mod
+
+  function realloc (size) {
+    mod.exports.memory.grow(Math.max(0, Math.ceil(Math.abs(size - mod.memory.length) / 65536)))
+    mod.memory = new Uint8Array(mod.exports.memory.buffer)
+  }
+
+  function onload (cb) {
+    if (mod.exports) return cb()
+
+    if (ready) {
+      ready.then(cb.bind(null, null)).catch(cb)
+      return
+    }
+
+    try {
+      if (opts && opts.async) throw new Error('async')
+      setup({instance: new WebAssembly.Instance(new WebAssembly.Module(wasm), imp)})
+    } catch (err) {
+      ready = WebAssembly.instantiate(wasm, imp).then(setup)
+    }
+
+    onload(cb)
+  }
+
+  function setup (w) {
+    mod.exports = w.instance.exports
+    mod.memory = mod.exports.memory && mod.exports.memory.buffer && new Uint8Array(mod.exports.memory.buffer)
+  }
+}
+
+function toUint8Array (s) {
+  if (typeof atob === 'function') return new Uint8Array(atob(s).split('').map(charCodeAt))
+  return (require('buf' + 'fer').Buffer).from(s, 'base64')
+}
+
+function charCodeAt (c) {
+  return c.charCodeAt(0)
+}

index.js

@@ -11,21 +11,31 @@
 forward(require('./randombytes'))
 forward(require('./memory'))
 forward(require('./helpers'))
-forward(require('./crypto_verify'))
+forward(require('./utils'))
+forward(require('./crypto_aead'))
+forward(require('./crypto_auth'))
 forward(require('./crypto_box'))
+forward(require('./crypto_core'))
+forward(require('./crypto_core_ristretto255'))
 forward(require('./crypto_generichash'))
 forward(require('./crypto_hash'))
 forward(require('./crypto_hash_sha256'))
 forward(require('./crypto_kdf'))
 forward(require('./crypto_kx'))
-forward(require('./crypto_aead'))
+forward(require('./crypto_pwhash'))
 forward(require('./crypto_onetimeauth'))
+forward(require('./crypto_scalarmult_ed25519'))
+// forward(require('./crypto_scalarmult'))
 forward(require('./crypto_scalarmult'))
 forward(require('./crypto_secretbox'))
+forward(require('./crypto_secretstream'))
 forward(require('./crypto_shorthash'))
-forward(require('./crypto_sign'))
+// forward(require('./crypto_sign'))
+forward(require('./crypto_sign_ed25519'))
 forward(require('./crypto_stream'))
 forward(require('./crypto_stream_chacha20'))
+forward(require('./crypto_tweak'))
+forward(require('./crypto_verify'))
 
 function forward (submodule) {
   Object.keys(submodule).forEach(function (prop) {

internal/hchacha20.js

@@ -0,0 +1,128 @@
+/* eslint-disable camelcase */
+const { sodium_malloc } = require('../memory')
+const assert = require('nanoassert')
+
+if (new Uint16Array([1])[0] !== 1) throw new Error('Big endian architecture is not supported.')
+
+const crypto_core_hchacha20_OUTPUTBYTES = 32
+const crypto_core_hchacha20_INPUTBYTES = 16
+const crypto_core_hchacha20_KEYBYTES = 32
+const crypto_core_hchacha20_CONSTBYTES = 16
+
+function ROTL32 (x, b) {
+  x &= 0xFFFFFFFF
+  b &= 0xFFFFFFFF
+  return (x << b) | (x >>> (32 - b))
+}
+
+function LOAD32_LE (src, offset) {
+  assert(src instanceof Uint8Array, 'src not byte array')
+  let w = src[offset]
+  w |= src[offset + 1] << 8
+  w |= src[offset + 2] << 16
+  w |= src[offset + 3] << 24
+  return w
+}
+
+function STORE32_LE (dest, int, offset) {
+  assert(dest instanceof Uint8Array, 'dest not byte array')
+  var mul = 1
+  var i = 0
+  dest[offset] = int & 0xFF // grab bottom byte
+  while (++i < 4 && (mul *= 0x100)) {
+    dest[offset + i] = (int / mul) & 0xFF
+  }
+}
+
+function QUARTERROUND (l, A, B, C, D) {
+  l[A] += l[B]
+  l[D] = ROTL32(l[D] ^ l[A], 16)
+  l[C] += l[D]
+  l[B] = ROTL32(l[B] ^ l[C], 12)
+  l[A] += l[B]
+  l[D] = ROTL32(l[D] ^ l[A], 8)
+  l[C] += l[D]
+  l[B] = ROTL32(l[B] ^ l[C], 7)
+}
+
+function crypto_core_hchacha20 (out, _in, k, c) {
+  assert(out instanceof Uint8Array && out.length === 32, 'out is not an array of 32 bytes')
+  assert(k instanceof Uint8Array && k.length === 32, 'k is not an array of 32 bytes')
+  assert(c === null || (c instanceof Uint8Array && c.length === 16), 'c is not null or an array of 16 bytes')
+
+  let i = 0
+  const x = new Uint32Array(16)
+  if (!c) {
+    x[0] = 0x61707865
+    x[1] = 0x3320646E
+    x[2] = 0x79622D32
+    x[3] = 0x6B206574
+  } else {
+    x[0] = LOAD32_LE(c, 0)
+    x[1] = LOAD32_LE(c, 4)
+    x[2] = LOAD32_LE(c, 8)
+    x[3] = LOAD32_LE(c, 12)
+  }
+  x[4] = LOAD32_LE(k, 0)
+  x[5] = LOAD32_LE(k, 4)
+  x[6] = LOAD32_LE(k, 8)
+  x[7] = LOAD32_LE(k, 12)
+  x[8] = LOAD32_LE(k, 16)
+  x[9] = LOAD32_LE(k, 20)
+  x[10] = LOAD32_LE(k, 24)
+  x[11] = LOAD32_LE(k, 28)
+  x[12] = LOAD32_LE(_in, 0)
+  x[13] = LOAD32_LE(_in, 4)
+  x[14] = LOAD32_LE(_in, 8)
+  x[15] = LOAD32_LE(_in, 12)
+
+  for (i = 0; i < 10; i++) {
+    QUARTERROUND(x, 0, 4, 8, 12)
+    QUARTERROUND(x, 1, 5, 9, 13)
+    QUARTERROUND(x, 2, 6, 10, 14)
+    QUARTERROUND(x, 3, 7, 11, 15)
+    QUARTERROUND(x, 0, 5, 10, 15)
+    QUARTERROUND(x, 1, 6, 11, 12)
+    QUARTERROUND(x, 2, 7, 8, 13)
+    QUARTERROUND(x, 3, 4, 9, 14)
+  }
+
+  STORE32_LE(out, x[0], 0)
+  STORE32_LE(out, x[1], 4)
+  STORE32_LE(out, x[2], 8)
+  STORE32_LE(out, x[3], 12)
+  STORE32_LE(out, x[12], 16)
+  STORE32_LE(out, x[13], 20)
+  STORE32_LE(out, x[14], 24)
+  STORE32_LE(out, x[15], 28)
+
+  return 0
+}
+
+function crypto_core_hchacha20_outputbytes () {
+  return crypto_core_hchacha20_OUTPUTBYTES
+}
+
+function crypto_core_hchacha20_inputbytes () {
+  return crypto_core_hchacha20_INPUTBYTES
+}
+
+function crypto_core_hchacha20_keybytes () {
+  return crypto_core_hchacha20_KEYBYTES
+}
+
+function crypto_core_hchacha20_constbytes () {
+  return crypto_core_hchacha20_CONSTBYTES
+}
+
+module.exports = {
+  crypto_core_hchacha20_INPUTBYTES,
+  LOAD32_LE,
+  STORE32_LE,
+  QUARTERROUND,
+  crypto_core_hchacha20,
+  crypto_core_hchacha20_outputbytes,
+  crypto_core_hchacha20_inputbytes,
+  crypto_core_hchacha20_keybytes,
+  crypto_core_hchacha20_constbytes
+}

memory.js

@@ -1,21 +1,28 @@
 /* eslint-disable camelcase */
-var MessageChannel = global.MessageChannel
-if (MessageChannel == null) ({ MessageChannel } = require('worker' + '_threads'))
 
 function sodium_malloc (n) {
   return new Uint8Array(n)
 }
 
-const sink = new MessageChannel()
 function sodium_free (n) {
   sodium_memzero(n)
-  sink.port1.postMessage(n.buffer, [n.buffer])
+  loadSink().port1.postMessage(n.buffer, [n.buffer])
 }
 
 function sodium_memzero (arr) {
   arr.fill(0)
 }
 
+var sink
+
+function loadSink () {
+  if (sink) return sink
+  var MessageChannel = globalThis.MessageChannel
+  if (MessageChannel == null) ({ MessageChannel } = require('worker' + '_threads'))
+  sink = new MessageChannel()
+  return sink
+}
+
 module.exports = {
   sodium_malloc,
   sodium_free,

package.json

@@ -1,37 +1,38 @@
 {
   "name": "sodium-javascript",
-  "version": "0.6.3",
+  "version": "0.8.0",
   "description": "WIP - a pure javascript version of sodium-native",
   "main": "index.js",
   "dependencies": {
+    "argon2hash-wasm": "^1.0.0",
     "blake2b": "^2.1.1",
     "chacha20-universal": "^1.0.4",
     "nanoassert": "^2.0.0",
-    "sha256-universal": "^1.0.1",
-    "sha512-universal": "^1.0.1",
+    "sha256-universal": "^1.1.0",
+    "sha512-universal": "^1.1.0",
     "siphash24": "^1.0.1",
     "xsalsa20": "^1.0.0"
   },
   "devDependencies": {
+    "brittle": "^3.2.1",
+    "browser-run": "^4.0.2",
     "browserify": "^16.5.1",
-    "sodium-test": "^0.9.0",
-    "standard": "^14.3.4",
-    "tape-run": "^7.0.0"
+    "sodium-native": "^3.4.1",
+    "standard": "^15.0.1"
   },
   "standard": {
     "ignore": [
-      "/internal/**/*.js"
+      "/internal/**/*.js",
+      "/test/fixtures/*.js"
     ]
   },
   "browser": {
-    "crypto": false
-  },
-  "react-native": {
-    "crypto": "crypto"
+    "crypto": false,
+    "worker_threads": false
   },
   "scripts": {
     "pretest": "standard",
-    "test": "node test.js",
+    "test": "brittle test/*.js",
     "test-browser": "browserify test.js | tape-run"
   },
   "repository": {

poly1305.js

@@ -0,0 +1,360 @@
+/*
+* Port of Andrew Moon's Poly1305-donna-16. Public domain.
+* https://github.com/floodyberry/poly1305-donna
+*/
+
+if (new Uint16Array([1])[0] !== 1) throw new Error('Big endian architecture is not supported.')
+
+var poly1305 = function(key) {
+  this.buffer = new Uint8Array(16);
+  this.r = new Uint16Array(10);
+  this.h = new Uint16Array(10);
+  this.pad = new Uint16Array(8);
+  this.leftover = 0;
+  this.fin = 0;
+
+  var t0, t1, t2, t3, t4, t5, t6, t7;
+
+  t0 = key[ 0] & 0xff | (key[ 1] & 0xff) << 8; this.r[0] = ( t0                     ) & 0x1fff;
+  t1 = key[ 2] & 0xff | (key[ 3] & 0xff) << 8; this.r[1] = ((t0 >>> 13) | (t1 <<  3)) & 0x1fff;
+  t2 = key[ 4] & 0xff | (key[ 5] & 0xff) << 8; this.r[2] = ((t1 >>> 10) | (t2 <<  6)) & 0x1f03;
+  t3 = key[ 6] & 0xff | (key[ 7] & 0xff) << 8; this.r[3] = ((t2 >>>  7) | (t3 <<  9)) & 0x1fff;
+  t4 = key[ 8] & 0xff | (key[ 9] & 0xff) << 8; this.r[4] = ((t3 >>>  4) | (t4 << 12)) & 0x00ff;
+  this.r[5] = ((t4 >>>  1)) & 0x1ffe;
+  t5 = key[10] & 0xff | (key[11] & 0xff) << 8; this.r[6] = ((t4 >>> 14) | (t5 <<  2)) & 0x1fff;
+  t6 = key[12] & 0xff | (key[13] & 0xff) << 8; this.r[7] = ((t5 >>> 11) | (t6 <<  5)) & 0x1f81;
+  t7 = key[14] & 0xff | (key[15] & 0xff) << 8; this.r[8] = ((t6 >>>  8) | (t7 <<  8)) & 0x1fff;
+  this.r[9] = ((t7 >>>  5)) & 0x007f;
+
+  this.pad[0] = key[16] & 0xff | (key[17] & 0xff) << 8;
+  this.pad[1] = key[18] & 0xff | (key[19] & 0xff) << 8;
+  this.pad[2] = key[20] & 0xff | (key[21] & 0xff) << 8;
+  this.pad[3] = key[22] & 0xff | (key[23] & 0xff) << 8;
+  this.pad[4] = key[24] & 0xff | (key[25] & 0xff) << 8;
+  this.pad[5] = key[26] & 0xff | (key[27] & 0xff) << 8;
+  this.pad[6] = key[28] & 0xff | (key[29] & 0xff) << 8;
+  this.pad[7] = key[30] & 0xff | (key[31] & 0xff) << 8;
+};
+
+poly1305.prototype.blocks = function(m, mpos, bytes) {
+  var hibit = this.fin ? 0 : (1 << 11);
+  var t0, t1, t2, t3, t4, t5, t6, t7, c;
+  var d0, d1, d2, d3, d4, d5, d6, d7, d8, d9;
+
+  var h0 = this.h[0],
+      h1 = this.h[1],
+      h2 = this.h[2],
+      h3 = this.h[3],
+      h4 = this.h[4],
+      h5 = this.h[5],
+      h6 = this.h[6],
+      h7 = this.h[7],
+      h8 = this.h[8],
+      h9 = this.h[9];
+
+  var r0 = this.r[0],
+      r1 = this.r[1],
+      r2 = this.r[2],
+      r3 = this.r[3],
+      r4 = this.r[4],
+      r5 = this.r[5],
+      r6 = this.r[6],
+      r7 = this.r[7],
+      r8 = this.r[8],
+      r9 = this.r[9];
+
+  while (bytes >= 16) {
+    t0 = m[mpos+ 0] & 0xff | (m[mpos+ 1] & 0xff) << 8; h0 += ( t0                     ) & 0x1fff;
+    t1 = m[mpos+ 2] & 0xff | (m[mpos+ 3] & 0xff) << 8; h1 += ((t0 >>> 13) | (t1 <<  3)) & 0x1fff;
+    t2 = m[mpos+ 4] & 0xff | (m[mpos+ 5] & 0xff) << 8; h2 += ((t1 >>> 10) | (t2 <<  6)) & 0x1fff;
+    t3 = m[mpos+ 6] & 0xff | (m[mpos+ 7] & 0xff) << 8; h3 += ((t2 >>>  7) | (t3 <<  9)) & 0x1fff;
+    t4 = m[mpos+ 8] & 0xff | (m[mpos+ 9] & 0xff) << 8; h4 += ((t3 >>>  4) | (t4 << 12)) & 0x1fff;
+    h5 += ((t4 >>>  1)) & 0x1fff;
+    t5 = m[mpos+10] & 0xff | (m[mpos+11] & 0xff) << 8; h6 += ((t4 >>> 14) | (t5 <<  2)) & 0x1fff;
+    t6 = m[mpos+12] & 0xff | (m[mpos+13] & 0xff) << 8; h7 += ((t5 >>> 11) | (t6 <<  5)) & 0x1fff;
+    t7 = m[mpos+14] & 0xff | (m[mpos+15] & 0xff) << 8; h8 += ((t6 >>>  8) | (t7 <<  8)) & 0x1fff;
+    h9 += ((t7 >>> 5)) | hibit;
+
+    c = 0;
+
+    d0 = c;
+    d0 += h0 * r0;
+    d0 += h1 * (5 * r9);
+    d0 += h2 * (5 * r8);
+    d0 += h3 * (5 * r7);
+    d0 += h4 * (5 * r6);
+    c = (d0 >>> 13); d0 &= 0x1fff;
+    d0 += h5 * (5 * r5);
+    d0 += h6 * (5 * r4);
+    d0 += h7 * (5 * r3);
+    d0 += h8 * (5 * r2);
+    d0 += h9 * (5 * r1);
+    c += (d0 >>> 13); d0 &= 0x1fff;
+
+    d1 = c;
+    d1 += h0 * r1;
+    d1 += h1 * r0;
+    d1 += h2 * (5 * r9);
+    d1 += h3 * (5 * r8);
+    d1 += h4 * (5 * r7);
+    c = (d1 >>> 13); d1 &= 0x1fff;
+    d1 += h5 * (5 * r6);
+    d1 += h6 * (5 * r5);
+    d1 += h7 * (5 * r4);
+    d1 += h8 * (5 * r3);
+    d1 += h9 * (5 * r2);
+    c += (d1 >>> 13); d1 &= 0x1fff;
+
+    d2 = c;
+    d2 += h0 * r2;
+    d2 += h1 * r1;
+    d2 += h2 * r0;
+    d2 += h3 * (5 * r9);
+    d2 += h4 * (5 * r8);
+    c = (d2 >>> 13); d2 &= 0x1fff;
+    d2 += h5 * (5 * r7);
+    d2 += h6 * (5 * r6);
+    d2 += h7 * (5 * r5);
+    d2 += h8 * (5 * r4);
+    d2 += h9 * (5 * r3);
+    c += (d2 >>> 13); d2 &= 0x1fff;
+
+    d3 = c;
+    d3 += h0 * r3;
+    d3 += h1 * r2;
+    d3 += h2 * r1;
+    d3 += h3 * r0;
+    d3 += h4 * (5 * r9);
+    c = (d3 >>> 13); d3 &= 0x1fff;
+    d3 += h5 * (5 * r8);
+    d3 += h6 * (5 * r7);
+    d3 += h7 * (5 * r6);
+    d3 += h8 * (5 * r5);
+    d3 += h9 * (5 * r4);
+    c += (d3 >>> 13); d3 &= 0x1fff;
+
+    d4 = c;
+    d4 += h0 * r4;
+    d4 += h1 * r3;
+    d4 += h2 * r2;
+    d4 += h3 * r1;
+    d4 += h4 * r0;
+    c = (d4 >>> 13); d4 &= 0x1fff;
+    d4 += h5 * (5 * r9);
+    d4 += h6 * (5 * r8);
+    d4 += h7 * (5 * r7);
+    d4 += h8 * (5 * r6);
+    d4 += h9 * (5 * r5);
+    c += (d4 >>> 13); d4 &= 0x1fff;
+
+    d5 = c;
+    d5 += h0 * r5;
+    d5 += h1 * r4;
+    d5 += h2 * r3;
+    d5 += h3 * r2;
+    d5 += h4 * r1;
+    c = (d5 >>> 13); d5 &= 0x1fff;
+    d5 += h5 * r0;
+    d5 += h6 * (5 * r9);
+    d5 += h7 * (5 * r8);
+    d5 += h8 * (5 * r7);
+    d5 += h9 * (5 * r6);
+    c += (d5 >>> 13); d5 &= 0x1fff;
+
+    d6 = c;
+    d6 += h0 * r6;
+    d6 += h1 * r5;
+    d6 += h2 * r4;
+    d6 += h3 * r3;
+    d6 += h4 * r2;
+    c = (d6 >>> 13); d6 &= 0x1fff;
+    d6 += h5 * r1;
+    d6 += h6 * r0;
+    d6 += h7 * (5 * r9);
+    d6 += h8 * (5 * r8);
+    d6 += h9 * (5 * r7);
+    c += (d6 >>> 13); d6 &= 0x1fff;
+
+    d7 = c;
+    d7 += h0 * r7;
+    d7 += h1 * r6;
+    d7 += h2 * r5;
+    d7 += h3 * r4;
+    d7 += h4 * r3;
+    c = (d7 >>> 13); d7 &= 0x1fff;
+    d7 += h5 * r2;
+    d7 += h6 * r1;
+    d7 += h7 * r0;
+    d7 += h8 * (5 * r9);
+    d7 += h9 * (5 * r8);
+    c += (d7 >>> 13); d7 &= 0x1fff;
+
+    d8 = c;
+    d8 += h0 * r8;
+    d8 += h1 * r7;
+    d8 += h2 * r6;
+    d8 += h3 * r5;
+    d8 += h4 * r4;
+    c = (d8 >>> 13); d8 &= 0x1fff;
+    d8 += h5 * r3;
+    d8 += h6 * r2;
+    d8 += h7 * r1;
+    d8 += h8 * r0;
+    d8 += h9 * (5 * r9);
+    c += (d8 >>> 13); d8 &= 0x1fff;
+
+    d9 = c;
+    d9 += h0 * r9;
+    d9 += h1 * r8;
+    d9 += h2 * r7;
+    d9 += h3 * r6;
+    d9 += h4 * r5;
+    c = (d9 >>> 13); d9 &= 0x1fff;
+    d9 += h5 * r4;
+    d9 += h6 * r3;
+    d9 += h7 * r2;
+    d9 += h8 * r1;
+    d9 += h9 * r0;
+    c += (d9 >>> 13); d9 &= 0x1fff;
+
+    c = (((c << 2) + c)) | 0;
+    c = (c + d0) | 0;
+    d0 = c & 0x1fff;
+    c = (c >>> 13);
+    d1 += c;
+
+    h0 = d0;
+    h1 = d1;
+    h2 = d2;
+    h3 = d3;
+    h4 = d4;
+    h5 = d5;
+    h6 = d6;
+    h7 = d7;
+    h8 = d8;
+    h9 = d9;
+
+    mpos += 16;
+    bytes -= 16;
+  }
+  this.h[0] = h0;
+  this.h[1] = h1;
+  this.h[2] = h2;
+  this.h[3] = h3;
+  this.h[4] = h4;
+  this.h[5] = h5;
+  this.h[6] = h6;
+  this.h[7] = h7;
+  this.h[8] = h8;
+  this.h[9] = h9;
+};
+
+poly1305.prototype.finish = function(mac, macpos) {
+  var g = new Uint16Array(10);
+  var c, mask, f, i;
+
+  if (this.leftover) {
+    i = this.leftover;
+    this.buffer[i++] = 1;
+    for (; i < 16; i++) this.buffer[i] = 0;
+    this.fin = 1;
+    this.blocks(this.buffer, 0, 16);
+  }
+
+  c = this.h[1] >>> 13;
+  this.h[1] &= 0x1fff;
+  for (i = 2; i < 10; i++) {
+    this.h[i] += c;
+    c = this.h[i] >>> 13;
+    this.h[i] &= 0x1fff;
+  }
+  this.h[0] += (c * 5);
+  c = this.h[0] >>> 13;
+  this.h[0] &= 0x1fff;
+  this.h[1] += c;
+  c = this.h[1] >>> 13;
+  this.h[1] &= 0x1fff;
+  this.h[2] += c;
+
+  g[0] = this.h[0] + 5;
+  c = g[0] >>> 13;
+  g[0] &= 0x1fff;
+  for (i = 1; i < 10; i++) {
+    g[i] = this.h[i] + c;
+    c = g[i] >>> 13;
+    g[i] &= 0x1fff;
+  }
+  g[9] -= (1 << 13);
+
+  mask = (c ^ 1) - 1;
+  for (i = 0; i < 10; i++) g[i] &= mask;
+  mask = ~mask;
+  for (i = 0; i < 10; i++) this.h[i] = (this.h[i] & mask) | g[i];
+
+  this.h[0] = ((this.h[0]       ) | (this.h[1] << 13)                    ) & 0xffff;
+  this.h[1] = ((this.h[1] >>>  3) | (this.h[2] << 10)                    ) & 0xffff;
+  this.h[2] = ((this.h[2] >>>  6) | (this.h[3] <<  7)                    ) & 0xffff;
+  this.h[3] = ((this.h[3] >>>  9) | (this.h[4] <<  4)                    ) & 0xffff;
+  this.h[4] = ((this.h[4] >>> 12) | (this.h[5] <<  1) | (this.h[6] << 14)) & 0xffff;
+  this.h[5] = ((this.h[6] >>>  2) | (this.h[7] << 11)                    ) & 0xffff;
+  this.h[6] = ((this.h[7] >>>  5) | (this.h[8] <<  8)                    ) & 0xffff;
+  this.h[7] = ((this.h[8] >>>  8) | (this.h[9] <<  5)                    ) & 0xffff;
+
+  f = this.h[0] + this.pad[0];
+  this.h[0] = f & 0xffff;
+  for (i = 1; i < 8; i++) {
+    f = (((this.h[i] + this.pad[i]) | 0) + (f >>> 16)) | 0;
+    this.h[i] = f & 0xffff;
+  }
+
+  mac[macpos+ 0] = (this.h[0] >>> 0) & 0xff;
+  mac[macpos+ 1] = (this.h[0] >>> 8) & 0xff;
+  mac[macpos+ 2] = (this.h[1] >>> 0) & 0xff;
+  mac[macpos+ 3] = (this.h[1] >>> 8) & 0xff;
+  mac[macpos+ 4] = (this.h[2] >>> 0) & 0xff;
+  mac[macpos+ 5] = (this.h[2] >>> 8) & 0xff;
+  mac[macpos+ 6] = (this.h[3] >>> 0) & 0xff;
+  mac[macpos+ 7] = (this.h[3] >>> 8) & 0xff;
+  mac[macpos+ 8] = (this.h[4] >>> 0) & 0xff;
+  mac[macpos+ 9] = (this.h[4] >>> 8) & 0xff;
+  mac[macpos+10] = (this.h[5] >>> 0) & 0xff;
+  mac[macpos+11] = (this.h[5] >>> 8) & 0xff;
+  mac[macpos+12] = (this.h[6] >>> 0) & 0xff;
+  mac[macpos+13] = (this.h[6] >>> 8) & 0xff;
+  mac[macpos+14] = (this.h[7] >>> 0) & 0xff;
+  mac[macpos+15] = (this.h[7] >>> 8) & 0xff;
+};
+
+poly1305.prototype.update = function(m, mpos, bytes) {
+  var i, want;
+
+  if (this.leftover) {
+    want = (16 - this.leftover);
+    if (want > bytes)
+      want = bytes;
+    for (i = 0; i < want; i++)
+      this.buffer[this.leftover + i] = m[mpos+i];
+    bytes -= want;
+    mpos += want;
+    this.leftover += want;
+    if (this.leftover < 16)
+      return;
+    this.blocks(this.buffer, 0, 16);
+    this.leftover = 0;
+  }
+
+  if (bytes >= 16) {
+    want = bytes - (bytes % 16);
+    this.blocks(m, mpos, want);
+    mpos += want;
+    bytes -= want;
+  }
+
+  if (bytes) {
+    for (i = 0; i < bytes; i++)
+      this.buffer[this.leftover + i] = m[mpos+i];
+    this.leftover += bytes;
+  }
+};
+
+module.exports = poly1305

randombytes.js

@@ -1,8 +1,16 @@
 var assert = require('nanoassert')
 
+const {
+  crypto_stream_chacha20_ietf,
+  crypto_stream_chacha20_ietf_KEYBYTES,
+  crypto_stream_chacha20_ietf_NONCEBYTES
+} = require('./crypto_stream_chacha20')
+
+const randombytes_SEEDBYTES = 32
+
 var randombytes = (function () {
   var QUOTA = 65536 // limit for QuotaExceededException
-  var crypto = global.crypto || global.msCrypto
+  var crypto = globalThis.crypto || globalThis.msCrypto
 
   function browserBytes (out, n) {
     for (let i = 0; i < n; i += QUOTA) {
@@ -34,7 +42,21 @@ Object.defineProperty(module.exports, 'randombytes', {
   value: randombytes
 })
 
-module.exports.randombytes_buf = function (out) {
+function randombytes_buf (out) {
   assert(out, 'out must be given')
   randombytes(out, out.byteLength)
 }
+
+function randombytes_buf_deterministic (buf, seed) {
+  const nonce = Buffer.alloc(crypto_stream_chacha20_ietf_NONCEBYTES)
+  nonce.write('LibsodiumDRG')
+
+  assert(randombytes_SEEDBYTES === crypto_stream_chacha20_ietf_KEYBYTES)
+  crypto_stream_chacha20_ietf(buf, nonce, seed)
+}
+
+module.exports = {
+  randombytes_buf,
+  randombytes_buf_deterministic,
+  randombytes_SEEDBYTES
+}

test.js

@@ -1,3 +0,0 @@
-require('sodium-test')(require('.'))
-
-if (typeof window !== 'undefined') window.close()

test/crypto_aead_chacha20poly1305_ietf.js

@@ -0,0 +1,285 @@
+/* eslint-disable camelcase */
+const test = require('brittle')
+const b4a = require('b4a')
+const sodium = require('..')
+
+test('constants', function (t) {
+  t.is(typeof sodium.crypto_aead_chacha20poly1305_ietf_ABYTES, 'number')
+  t.is(typeof sodium.crypto_aead_chacha20poly1305_ietf_KEYBYTES, 'number')
+  t.is(typeof sodium.crypto_aead_chacha20poly1305_ietf_NPUBBYTES, 'number')
+  t.is(typeof sodium.crypto_aead_chacha20poly1305_ietf_NSECBYTES, 'number')
+  t.is(sodium.crypto_aead_chacha20poly1305_ietf_NSECBYTES, 0)
+  t.is(typeof sodium.crypto_aead_chacha20poly1305_ietf_MESSAGEBYTES_MAX, 'number')
+  t.is(sodium.crypto_aead_chacha20poly1305_ietf_MESSAGEBYTES_MAX, Number.MAX_SAFE_INTEGER) // to make sure, see note in binding.cc
+})
+
+test('ported from libsodium', function (t) {
+  const mlen = 114
+  const adlen = 12
+  const clen = mlen + sodium.crypto_aead_chacha20poly1305_ietf_ABYTES
+
+  const firstkey = b4a.from([
+    0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87,
+    0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f,
+    0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97,
+    0x98, 0x99, 0x9a, 0x9b, 0x9c, 0x9d, 0x9e, 0x9f
+  ])
+
+  const message = b4a.from('Ladies and Gentlemen of the class of \'99: If I could offer you only one tip for the future, sunscreen would be it.')
+
+  const m = sodium.sodium_malloc(mlen)
+  const nonce = b4a.from([
+    0x07, 0x00, 0x00, 0x00, 0x40, 0x41, 0x42, 0x43,
+    0x44, 0x45, 0x46, 0x47
+  ])
+  t.is(nonce.length, sodium.crypto_aead_chacha20poly1305_ietf_NPUBBYTES)
+
+  const ad = b4a.from([
+    0x50, 0x51, 0x52, 0x53, 0xc0, 0xc1, 0xc2, 0xc3,
+    0xc4, 0xc5, 0xc6, 0xc7
+  ])
+  t.is(ad.length, adlen)
+
+  const c = sodium.sodium_malloc(clen)
+  const detachedc = sodium.sodium_malloc(mlen)
+
+  const mac = sodium.sodium_malloc(sodium.crypto_aead_chacha20poly1305_ietf_ABYTES)
+
+  const m2 = sodium.sodium_malloc(mlen)
+
+  let foundclen = 0
+  let foundmaclen = 0
+  let m2len = 0
+
+  let i = 0
+
+  t.is(message.length, mlen)
+  b4a.copy(message, m)
+
+  foundclen = sodium.crypto_aead_chacha20poly1305_ietf_encrypt(c, m, ad, null, nonce, firstkey)
+  t.is(foundclen, mlen + sodium.crypto_aead_chacha20poly1305_ietf_ABYTES)
+
+  const exp1 = new Uint8Array([
+    0xd3, 0x1a, 0x8d, 0x34, 0x64, 0x8e, 0x60, 0xdb, 0x7b, 0x86, 0xaf, 0xbc,
+    0x53, 0xef, 0x7e, 0xc2, 0xa4, 0xad, 0xed, 0x51, 0x29, 0x6e, 0x08, 0xfe,
+    0xa9, 0xe2, 0xb5, 0xa7, 0x36, 0xee, 0x62, 0xd6, 0x3d, 0xbe, 0xa4, 0x5e,
+    0x8c, 0xa9, 0x67, 0x12, 0x82, 0xfa, 0xfb, 0x69, 0xda, 0x92, 0x72, 0x8b,
+    0x1a, 0x71, 0xde, 0x0a, 0x9e, 0x06, 0x0b, 0x29, 0x05, 0xd6, 0xa5, 0xb6,
+    0x7e, 0xcd, 0x3b, 0x36, 0x92, 0xdd, 0xbd, 0x7f, 0x2d, 0x77, 0x8b, 0x8c,
+    0x98, 0x03, 0xae, 0xe3, 0x28, 0x09, 0x1b, 0x58, 0xfa, 0xb3, 0x24, 0xe4,
+    0xfa, 0xd6, 0x75, 0x94, 0x55, 0x85, 0x80, 0x8b, 0x48, 0x31, 0xd7, 0xbc,
+    0x3f, 0xf4, 0xde, 0xf0, 0x8e, 0x4b, 0x7a, 0x9d, 0xe5, 0x76, 0xd2, 0x65,
+    0x86, 0xce, 0xc6, 0x4b, 0x61, 0x16, 0x1a, 0xe1, 0x0b, 0x59, 0x4f, 0x09,
+    0xe2, 0x6a, 0x7e, 0x90, 0x2e, 0xcb, 0xd0, 0x60, 0x06, 0x91
+  ])
+
+  t.alike(c, exp1)
+
+  foundmaclen = sodium.crypto_aead_chacha20poly1305_ietf_encrypt_detached(detachedc, mac, m, ad, null, nonce, firstkey)
+
+  t.is(foundmaclen, sodium.crypto_aead_chacha20poly1305_ietf_ABYTES)
+  const exp0 = c.slice(0, mlen)
+
+  t.alike(detachedc, exp0)
+
+  m2len = sodium.crypto_aead_chacha20poly1305_ietf_decrypt(m2, null, c, ad, nonce, firstkey)
+  t.is(m2len, mlen)
+
+  t.alike(m, m2)
+
+  m2.fill(0)
+  sodium.crypto_aead_chacha20poly1305_ietf_decrypt_detached(m2, null, c.slice(0, mlen), mac, ad, nonce, firstkey)
+
+  t.alike(m, m2)
+
+  for (i = 0; i < clen; i++) {
+    c[i] ^= (i + 1)
+    t.exception.all(_ => sodium.crypto_aead_chacha20poly1305_ietf_decrypt(m2, null, c, ad, nonce, firstkey))
+    if (b4a.equals(m, m2)) t.fail()
+    c[i] ^= (i + 1)
+  }
+
+  foundclen = sodium.crypto_aead_chacha20poly1305_ietf_encrypt(c, m, null, null, nonce, firstkey)
+  t.is(foundclen, clen)
+
+  const exp2 = new Uint8Array([
+    0xd3, 0x1a, 0x8d, 0x34, 0x64, 0x8e, 0x60, 0xdb, 0x7b, 0x86, 0xaf, 0xbc,
+    0x53, 0xef, 0x7e, 0xc2, 0xa4, 0xad, 0xed, 0x51, 0x29, 0x6e, 0x08, 0xfe,
+    0xa9, 0xe2, 0xb5, 0xa7, 0x36, 0xee, 0x62, 0xd6, 0x3d, 0xbe, 0xa4, 0x5e,
+    0x8c, 0xa9, 0x67, 0x12, 0x82, 0xfa, 0xfb, 0x69, 0xda, 0x92, 0x72, 0x8b,
+    0x1a, 0x71, 0xde, 0x0a, 0x9e, 0x06, 0x0b, 0x29, 0x05, 0xd6, 0xa5, 0xb6,
+    0x7e, 0xcd, 0x3b, 0x36, 0x92, 0xdd, 0xbd, 0x7f, 0x2d, 0x77, 0x8b, 0x8c,
+    0x98, 0x03, 0xae, 0xe3, 0x28, 0x09, 0x1b, 0x58, 0xfa, 0xb3, 0x24, 0xe4,
+    0xfa, 0xd6, 0x75, 0x94, 0x55, 0x85, 0x80, 0x8b, 0x48, 0x31, 0xd7, 0xbc,
+    0x3f, 0xf4, 0xde, 0xf0, 0x8e, 0x4b, 0x7a, 0x9d, 0xe5, 0x76, 0xd2, 0x65,
+    0x86, 0xce, 0xc6, 0x4b, 0x61, 0x16, 0x6a, 0x23, 0xa4, 0x68, 0x1f, 0xd5,
+    0x94, 0x56, 0xae, 0xa1, 0xd2, 0x9f, 0x82, 0x47, 0x72, 0x16
+  ])
+
+  t.alike(c, exp2)
+
+  m2len = sodium.crypto_aead_chacha20poly1305_ietf_decrypt(m2, null, c, null, nonce, firstkey)
+  t.is(m2len, mlen)
+
+  t.alike(m2, m)
+
+  b4a.copy(m, c)
+
+  foundclen = sodium.crypto_aead_chacha20poly1305_ietf_encrypt(c, c.slice(0, mlen), null, null, nonce, firstkey)
+
+  t.is(foundclen, clen, 'clen is properly set (adlen=0)')
+
+  const exp3 = new Uint8Array([
+    0xd3, 0x1a, 0x8d, 0x34, 0x64, 0x8e, 0x60, 0xdb, 0x7b, 0x86, 0xaf, 0xbc,
+    0x53, 0xef, 0x7e, 0xc2, 0xa4, 0xad, 0xed, 0x51, 0x29, 0x6e, 0x08, 0xfe,
+    0xa9, 0xe2, 0xb5, 0xa7, 0x36, 0xee, 0x62, 0xd6, 0x3d, 0xbe, 0xa4, 0x5e,
+    0x8c, 0xa9, 0x67, 0x12, 0x82, 0xfa, 0xfb, 0x69, 0xda, 0x92, 0x72, 0x8b,
+    0x1a, 0x71, 0xde, 0x0a, 0x9e, 0x06, 0x0b, 0x29, 0x05, 0xd6, 0xa5, 0xb6,
+    0x7e, 0xcd, 0x3b, 0x36, 0x92, 0xdd, 0xbd, 0x7f, 0x2d, 0x77, 0x8b, 0x8c,
+    0x98, 0x03, 0xae, 0xe3, 0x28, 0x09, 0x1b, 0x58, 0xfa, 0xb3, 0x24, 0xe4,
+    0xfa, 0xd6, 0x75, 0x94, 0x55, 0x85, 0x80, 0x8b, 0x48, 0x31, 0xd7, 0xbc,
+    0x3f, 0xf4, 0xde, 0xf0, 0x8e, 0x4b, 0x7a, 0x9d, 0xe5, 0x76, 0xd2, 0x65,
+    0x86, 0xce, 0xc6, 0x4b, 0x61, 0x16, 0x6a, 0x23, 0xa4, 0x68, 0x1f, 0xd5,
+    0x94, 0x56, 0xae, 0xa1, 0xd2, 0x9f, 0x82, 0x47, 0x72, 0x16
+  ])
+
+  t.alike(c, exp3)
+
+  const decrypted = sodium.sodium_malloc(c.byteLength - sodium.crypto_aead_chacha20poly1305_ietf_ABYTES)
+  m2len = sodium.crypto_aead_chacha20poly1305_ietf_decrypt(decrypted, null, c, null, nonce, firstkey)
+  t.is(m2len, mlen, 'm2len is properly set (adlen=0)')
+
+  t.alike(m, decrypted, 'm == c (adlen=0)')
+})
+
+test.skip('keygen', function (t) {
+  const key1 = sodium.sodium_malloc(sodium.crypto_aead_chacha20poly1305_ietf_KEYBYTES)
+  const key2 = sodium.sodium_malloc(sodium.crypto_aead_chacha20poly1305_ietf_KEYBYTES)
+
+  sodium.crypto_aead_chacha20poly1305_ietf_keygen(key1)
+  sodium.crypto_aead_chacha20poly1305_ietf_keygen(key2)
+
+  t.unlike(key1, key2)
+})
+
+test.skip('different keys', function (t) {
+  const m = b4a.from('Ladies and Gentlemen of the class of \'99: If I could offer you only one tip for the future, sunscreen would be it.')
+
+  const key1 = sodium.sodium_malloc(sodium.crypto_aead_chacha20poly1305_ietf_KEYBYTES)
+  const key2 = sodium.sodium_malloc(sodium.crypto_aead_chacha20poly1305_ietf_KEYBYTES)
+  sodium.crypto_aead_chacha20poly1305_ietf_keygen(key1)
+  sodium.crypto_aead_chacha20poly1305_ietf_keygen(key2)
+
+  const nonce = sodium.sodium_malloc(sodium.crypto_aead_chacha20poly1305_ietf_NPUBBYTES)
+  sodium.randombytes_buf(nonce)
+
+  const clen = m.byteLength + sodium.crypto_aead_chacha20poly1305_ietf_ABYTES
+  const c1 = sodium.sodium_malloc(clen)
+  const c2 = sodium.sodium_malloc(clen)
+
+  const m1 = sodium.sodium_malloc(m.byteLength)
+  const m2 = sodium.sodium_malloc(m.byteLength)
+
+  t.is(sodium.crypto_aead_chacha20poly1305_ietf_encrypt(c1, m, null, null, nonce, key1), clen)
+  t.absent(c1.equals(c2))
+  t.absent(c1.equals(m))
+  t.is(sodium.crypto_aead_chacha20poly1305_ietf_encrypt(c2, m, null, null, nonce, key2), clen)
+  t.absent(c1.equals(c2))
+  t.absent(c2.equals(m))
+
+  t.exception.all(_ => sodium.crypto_aead_chacha20poly1305_ietf_decrypt(m1, null, c1, null, nonce, key2))
+  t.exception.all(_ => sodium.crypto_aead_chacha20poly1305_ietf_decrypt(m2, null, c2, null, nonce, key1))
+
+  t.is(sodium.crypto_aead_chacha20poly1305_ietf_decrypt(m1, null, c1, null, nonce, key1), m.byteLength)
+  t.ok(m.equals(m1))
+  t.is(sodium.crypto_aead_chacha20poly1305_ietf_decrypt(m2, null, c2, null, nonce, key2), m.byteLength)
+  t.ok(m.equals(m2))
+})
+
+test.skip('different nonce', function (t) {
+  const m = b4a.from('Ladies and Gentlemen of the class of \'99: If I could offer you only one tip for the future, sunscreen would be it.')
+
+  const key = sodium.sodium_malloc(sodium.crypto_aead_chacha20poly1305_ietf_KEYBYTES)
+  sodium.crypto_aead_chacha20poly1305_ietf_keygen(key)
+
+  const n1 = sodium.sodium_malloc(sodium.crypto_aead_chacha20poly1305_ietf_NPUBBYTES)
+  const n2 = sodium.sodium_malloc(sodium.crypto_aead_chacha20poly1305_ietf_NPUBBYTES)
+  sodium.randombytes_buf(n1)
+  sodium.randombytes_buf(n2)
+
+  const clen = m.byteLength + sodium.crypto_aead_chacha20poly1305_ietf_ABYTES
+  const c1 = sodium.sodium_malloc(clen)
+  const c2 = sodium.sodium_malloc(clen)
+
+  const m1 = sodium.sodium_malloc(m.byteLength)
+  const m2 = sodium.sodium_malloc(m.byteLength)
+
+  t.is(sodium.crypto_aead_chacha20poly1305_ietf_encrypt(c1, m, null, null, n1, key), clen)
+  t.absent(c1.equals(c2))
+  t.absent(c1.equals(m))
+  t.is(sodium.crypto_aead_chacha20poly1305_ietf_encrypt(c2, m, null, null, n2, key), clen)
+  t.absent(c1.equals(c2))
+  t.absent(c2.equals(m))
+
+  t.exception.all(_ => sodium.crypto_aead_chacha20poly1305_ietf_decrypt(m1, null, c1, null, n2, key))
+  t.exception.all(_ => sodium.crypto_aead_chacha20poly1305_ietf_decrypt(m2, null, c2, null, n1, key))
+
+  t.is(sodium.crypto_aead_chacha20poly1305_ietf_decrypt(m1, null, c1, null, n1, key), m.byteLength)
+  t.ok(m.equals(m1))
+  t.is(sodium.crypto_aead_chacha20poly1305_ietf_decrypt(m2, null, c2, null, n2, key), m.byteLength)
+  t.ok(m.equals(m2))
+})
+
+test.skip('detached -> non-detached', function (t) {
+  const m = b4a.from('Ladies and Gentlemen of the class of \'99: If I could offer you only one tip for the future, sunscreen would be it.')
+  m.secure = true
+
+  const key = sodium.sodium_malloc(sodium.crypto_aead_chacha20poly1305_ietf_KEYBYTES)
+  sodium.crypto_aead_chacha20poly1305_ietf_keygen(key)
+
+  const nonce = sodium.sodium_malloc(sodium.crypto_aead_chacha20poly1305_ietf_NPUBBYTES)
+  sodium.randombytes_buf(nonce)
+
+  const mac = sodium.sodium_malloc(sodium.crypto_aead_chacha20poly1305_ietf_ABYTES)
+  const clen = m.byteLength
+  const c = sodium.sodium_malloc(clen)
+
+  t.is(sodium.crypto_aead_chacha20poly1305_ietf_encrypt_detached(c, mac, m, null, null, nonce, key), mac.byteLength)
+
+  const m1 = sodium.sodium_malloc(m.byteLength)
+  t.is(sodium.crypto_aead_chacha20poly1305_ietf_decrypt(m1, null, b4a.concat([c, mac]), null, nonce, key), m.byteLength)
+
+  t.alike(m, m1)
+})
+
+test.skip('non-detached -> detached', function (t) {
+  const m = b4a.from('Ladies and Gentlemen of the class of \'99: If I could offer you only one tip for the future, sunscreen would be it.')
+  m.secure = true
+
+  const key = sodium.sodium_malloc(sodium.crypto_aead_chacha20poly1305_ietf_KEYBYTES)
+  sodium.crypto_aead_chacha20poly1305_ietf_keygen(key)
+
+  const nonce = sodium.sodium_malloc(sodium.crypto_aead_chacha20poly1305_ietf_NPUBBYTES)
+  sodium.randombytes_buf(nonce)
+
+  const clen = m.byteLength + sodium.crypto_aead_chacha20poly1305_ietf_ABYTES
+  const c = sodium.sodium_malloc(clen)
+
+  t.is(sodium.crypto_aead_chacha20poly1305_ietf_encrypt(c, m, null, null, nonce, key), c.byteLength)
+
+  const m1 = sodium.sodium_malloc(m.byteLength)
+  const csub = c.subarray(0, clen - sodium.crypto_aead_chacha20poly1305_ietf_ABYTES)
+  const macsub = c.subarray(csub.byteLength)
+  sodium.crypto_aead_chacha20poly1305_ietf_decrypt_detached(m1, null, csub, macsub, null, nonce, key)
+
+  t.alike(m, m1)
+})
+
+/**
+ * Need to test in-place encryption
+ * detach can talk to non detach
+ * encrypt - decrypt
+ * different nonce
+ * different key
+ * return values
+ */

test/crypto_auth.js

@@ -0,0 +1,219 @@
+/* eslint-disable camelcase */
+const test = require('brittle')
+const sodium = require('..')
+
+test('crypto_auth', function (t) {
+  const key = Buffer.alloc(sodium.crypto_auth_KEYBYTES)
+  sodium.randombytes_buf(key)
+
+  const mac = Buffer.alloc(sodium.crypto_auth_BYTES)
+  const value = Buffer.from('Hej, Verden')
+
+  sodium.crypto_auth(mac, value, key)
+
+  t.not(mac, Buffer.alloc(mac.length), 'mac not blank')
+  t.absent(sodium.crypto_auth_verify(Buffer.alloc(mac.length), value, key), 'does not verify')
+  t.ok(sodium.crypto_auth_verify(mac, value, key), 'verifies')
+})
+
+test('crypto_auth #1', t => {
+  // "Test Case 2" from RFC 4231
+  const key = stringToArray('Jefe', 32)
+  const c = stringToArray('what do ya want for nothing?')
+  const c1 = stringToArray('wwhat do ya want for nothing')
+
+  const a = new Uint8Array(sodium.crypto_auth_BYTES)
+
+  const exp = [
+    new Uint8Array([
+      0x16, 0x4b, 0x7a, 0x7b, 0xfc, 0xf8, 0x19, 0xe2,
+      0xe3, 0x95, 0xfb, 0xe7, 0x3b, 0x56, 0xe0, 0xa3,
+      0x87, 0xbd, 0x64, 0x22, 0x2e, 0x83, 0x1f, 0xd6,
+      0x10, 0x27, 0x0c, 0xd7, 0xea, 0x25, 0x05, 0x54
+    ]),
+    new Uint8Array([
+      0x7b, 0x9d, 0x83, 0x38, 0xeb, 0x1e, 0x3d, 0xdd,
+      0xba, 0x8a, 0x9a, 0x35, 0x08, 0xd0, 0x34, 0xa1,
+      0xec, 0xbe, 0x75, 0x11, 0x37, 0xfa, 0x1b, 0xcb,
+      0xa0, 0xf9, 0x2a, 0x3e, 0x6d, 0xfc, 0x79, 0x80
+    ]),
+    new Uint8Array([
+      0xb9, 0xd1, 0x4c, 0x51, 0xa6, 0xd4, 0xdd, 0x41,
+      0x60, 0x4e, 0xb0, 0x6c, 0x9c, 0x24, 0x0f, 0x1f,
+      0x64, 0xf1, 0x43, 0xb5, 0xcf, 0xde, 0xa3, 0x71,
+      0x29, 0xb2, 0x8b, 0xb7, 0x5d, 0x13, 0x71, 0xd3
+    ])
+  ]
+
+  sodium.crypto_auth(a, c, key)
+  t.alike(a, exp[0])
+  t.ok(sodium.crypto_auth_verify(exp[0], c, key))
+
+  a.fill(0)
+  sodium.crypto_auth(a, c1, key)
+  t.alike(a, exp[1])
+  t.ok(sodium.crypto_auth_verify(exp[1], c1, key))
+
+  // Empty message tests
+  a.fill(0)
+  sodium.crypto_auth(a, new Uint8Array(0), key)
+  t.alike(a, exp[2])
+  t.ok(sodium.crypto_auth_verify(exp[2], new Uint8Array(0), key))
+  t.end()
+})
+
+test('crypto_auth', function (t) {
+  const key = stringToArray('Jefe', 32)
+  const c = stringToArray('what do ya want for nothing?')
+  const a = new Uint8Array(sodium.crypto_auth_BYTES)
+  const expected = new Uint8Array([
+    0x16, 0x4b, 0x7a, 0x7b, 0xfc, 0xf8, 0x19, 0xe2, 0xe3, 0x95, 0xfb, 0xe7,
+    0x3b, 0x56, 0xe0, 0xa3, 0x87, 0xbd, 0x64, 0x22, 0x2e, 0x83, 0x1f, 0xd6,
+    0x10, 0x27, 0x0c, 0xd7, 0xea, 0x25, 0x05, 0x54
+  ])
+
+  sodium.crypto_auth(a, c, key)
+
+  t.alike(a, expected)
+  t.ok(sodium.crypto_auth_verify(a, c, key))
+
+  c[Math.floor(Math.random() * c.length)] += 1
+  t.absent(sodium.crypto_auth_verify(a, c, key))
+
+  t.end()
+})
+
+test('wrong keylength', t => {
+  const a = new Uint8Array(32)
+  const c = new Uint8Array(0)
+
+  for (let i = 0; i < 128; i++) {
+    if (i === 32) continue
+    const k = new Uint8Array(i)
+    try {
+      sodium.crypto_auth(a, c, k)
+      t.fail('failed on test #' + i)
+    } catch (e) {
+      try {
+        sodium.crypto_auth_verify(a, c, k)
+        t.fail('failed on test #' + i)
+      } catch (e) {
+        try {
+          sodium.crypto_auth_verify(k, c, a)
+          t.fail('failed on test #' + i)
+        } catch {}
+      }
+    }
+  }
+
+  t.pass('should not accept bad input length')
+  t.end()
+})
+
+test('crypto_auth constants', t => {
+  t.is(sodium.crypto_auth_BYTES, 32)
+  t.is(sodium.crypto_auth_KEYBYTES, 32)
+  t.end()
+})
+
+test('rfc4231 test case #6', t => {
+  const keys = [
+    new Uint8Array([
+      0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
+      0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
+      0x0b, 0x0b, 0x0b, 0x0b, 0x00, 0x00, 0x00, 0x00,
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+    ]),
+    new Uint8Array([
+      0x4a, 0x65, 0x66, 0x65, 0x00, 0x00, 0x00, 0x00,
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+    ]),
+    new Uint8Array([
+      0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
+      0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
+      0xaa, 0xaa, 0xaa, 0xaa, 0x00, 0x00, 0x00, 0x00,
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+    ]),
+    new Uint8Array([
+      0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
+      0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10,
+      0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18,
+      0x19, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+    ])
+  ]
+
+  const data = [
+    new Uint8Array([
+      0x48, 0x69, 0x20, 0x54, 0x68, 0x65, 0x72, 0x65
+    ]),
+    new Uint8Array([
+      0x77, 0x68, 0x61, 0x74, 0x20, 0x64, 0x6f, 0x20,
+      0x79, 0x61, 0x20, 0x77, 0x61, 0x6e, 0x74, 0x20,
+      0x66, 0x6f, 0x72, 0x20, 0x6e, 0x6f, 0x74, 0x68,
+      0x69, 0x6e, 0x67, 0x3f
+    ]),
+    new Uint8Array([
+      0xdd, 0xdd, 0xdd, 0xdd, 0xdd, 0xdd, 0xdd, 0xdd,
+      0xdd, 0xdd, 0xdd, 0xdd, 0xdd, 0xdd, 0xdd, 0xdd,
+      0xdd, 0xdd, 0xdd, 0xdd, 0xdd, 0xdd, 0xdd, 0xdd,
+      0xdd, 0xdd, 0xdd, 0xdd, 0xdd, 0xdd, 0xdd, 0xdd,
+      0xdd, 0xdd, 0xdd, 0xdd, 0xdd, 0xdd, 0xdd, 0xdd,
+      0xdd, 0xdd, 0xdd, 0xdd, 0xdd, 0xdd, 0xdd, 0xdd,
+      0xdd, 0xdd
+    ]),
+    new Uint8Array([
+      0xcd, 0xcd, 0xcd, 0xcd, 0xcd, 0xcd, 0xcd, 0xcd,
+      0xcd, 0xcd, 0xcd, 0xcd, 0xcd, 0xcd, 0xcd, 0xcd,
+      0xcd, 0xcd, 0xcd, 0xcd, 0xcd, 0xcd, 0xcd, 0xcd,
+      0xcd, 0xcd, 0xcd, 0xcd, 0xcd, 0xcd, 0xcd, 0xcd,
+      0xcd, 0xcd, 0xcd, 0xcd, 0xcd, 0xcd, 0xcd, 0xcd,
+      0xcd, 0xcd, 0xcd, 0xcd, 0xcd, 0xcd, 0xcd, 0xcd,
+      0xcd, 0xcd
+    ])
+  ]
+
+  const exp = [
+    new Uint8Array([
+      0x87, 0xaa, 0x7c, 0xde, 0xa5, 0xef, 0x61, 0x9d,
+      0x4f, 0xf0, 0xb4, 0x24, 0x1a, 0x1d, 0x6c, 0xb0,
+      0x23, 0x79, 0xf4, 0xe2, 0xce, 0x4e, 0xc2, 0x78,
+      0x7a, 0xd0, 0xb3, 0x05, 0x45, 0xe1, 0x7c, 0xde
+    ]),
+    new Uint8Array([
+      0x16, 0x4b, 0x7a, 0x7b, 0xfc, 0xf8, 0x19, 0xe2,
+      0xe3, 0x95, 0xfb, 0xe7, 0x3b, 0x56, 0xe0, 0xa3,
+      0x87, 0xbd, 0x64, 0x22, 0x2e, 0x83, 0x1f, 0xd6,
+      0x10, 0x27, 0x0c, 0xd7, 0xea, 0x25, 0x05, 0x54
+    ]),
+    new Uint8Array([
+      0xfa, 0x73, 0xb0, 0x08, 0x9d, 0x56, 0xa2, 0x84,
+      0xef, 0xb0, 0xf0, 0x75, 0x6c, 0x89, 0x0b, 0xe9,
+      0xb1, 0xb5, 0xdb, 0xdd, 0x8e, 0xe8, 0x1a, 0x36,
+      0x55, 0xf8, 0x3e, 0x33, 0xb2, 0x27, 0x9d, 0x39
+    ]),
+    new Uint8Array([
+      0xb0, 0xba, 0x46, 0x56, 0x37, 0x45, 0x8c, 0x69,
+      0x90, 0xe5, 0xa8, 0xc5, 0xf6, 0x1d, 0x4a, 0xf7,
+      0xe5, 0x76, 0xd9, 0x7f, 0xf9, 0x4b, 0x87, 0x2d,
+      0xe7, 0x6f, 0x80, 0x50, 0x36, 0x1e, 0xe3, 0xdb
+    ])
+  ]
+
+  const a = new Uint8Array(sodium.crypto_auth_BYTES)
+
+  for (let i = 0; i < keys.length; i++) {
+    sodium.crypto_auth(a, data[i], keys[i])
+    t.alike(a, exp[i])
+    t.ok(sodium.crypto_auth_verify(exp[i], data[i], keys[i]))
+  }
+
+  t.end()
+})
+
+function stringToArray (s, size = s.length) {
+  const array = new Uint8Array(size)
+  array.set(s.split('').map((c) => c.charCodeAt(0)))
+  return array
+}

test/crypto_box.js

@@ -0,0 +1,305 @@
+/* eslint-disable camelcase */
+const test = require('brittle')
+const sodium = require('..')
+
+test('crypto_box_seed_keypair', function (t) {
+  const pk = Buffer.alloc(sodium.crypto_box_PUBLICKEYBYTES)
+  const sk = Buffer.alloc(sodium.crypto_box_SECRETKEYBYTES)
+  const seed = Buffer.alloc(sodium.crypto_box_SEEDBYTES, 'lo')
+
+  t.exception.all(function () {
+    sodium.crypto_box_seed_keypair()
+  }, 'should validate input')
+
+  t.exception.all(function () {
+    sodium.crypto_box_seed_keypair(Buffer.alloc(0), Buffer.alloc(0), Buffer.alloc(0))
+  }, 'should validate input length')
+
+  sodium.crypto_box_seed_keypair(pk, sk, seed)
+
+  const eSk = '8661a95d21b134adc02881022ad86d37f32a230d537b525b997bce27aa745afc'
+  const ePk = '425c5ba523e70411c77300bb48dd846562e6c1fcf0142d81d2567d650ce76c3b'
+
+  t.alike(pk.toString('hex'), ePk, 'seeded public key')
+  t.alike(sk.toString('hex'), eSk, 'seeded secret key')
+})
+
+test('crypto_box_keypair', function (t) {
+  const pk = Buffer.alloc(sodium.crypto_box_PUBLICKEYBYTES)
+  const sk = Buffer.alloc(sodium.crypto_box_SECRETKEYBYTES)
+
+  sodium.crypto_box_keypair(pk, sk)
+
+  t.not(pk, Buffer.alloc(pk.length), 'made public key')
+  t.not(sk, Buffer.alloc(sk.length), 'made secret key')
+
+  t.exception.all(function () {
+    sodium.crypto_box_keypair()
+  }, 'should validate input')
+
+  t.exception.all(function () {
+    sodium.crypto_box_keypair(Buffer.alloc(0), Buffer.alloc(0))
+  }, 'should validate input length')
+})
+
+test('crypto_box_detached', function (t) {
+  const pk = Buffer.alloc(sodium.crypto_box_PUBLICKEYBYTES)
+  const sk = Buffer.alloc(sodium.crypto_box_SECRETKEYBYTES)
+  const nonce = Buffer.alloc(sodium.crypto_box_NONCEBYTES)
+
+  sodium.crypto_box_keypair(pk, sk)
+
+  const message = Buffer.from('Hello, World!')
+  const mac = Buffer.alloc(sodium.crypto_box_MACBYTES)
+  const cipher = Buffer.alloc(message.length)
+
+  sodium.crypto_box_detached(cipher, mac, message, nonce, pk, sk)
+
+  t.not(cipher, Buffer.alloc(cipher.length), 'not blank')
+
+  const plain = Buffer.alloc(cipher.length)
+  t.absent(sodium.crypto_box_open_detached(plain, cipher, Buffer.alloc(mac.length), nonce, pk, sk), 'does not decrypt')
+  t.ok(sodium.crypto_box_open_detached(plain, cipher, mac, nonce, pk, sk), 'decrypts')
+  t.alike(plain, message, 'same message')
+})
+
+test('crypto_box_easy', function (t) {
+  const pk = Buffer.alloc(sodium.crypto_box_PUBLICKEYBYTES)
+  const sk = Buffer.alloc(sodium.crypto_box_SECRETKEYBYTES)
+  const nonce = Buffer.alloc(sodium.crypto_box_NONCEBYTES)
+
+  sodium.crypto_box_keypair(pk, sk)
+
+  const message = Buffer.from('Hello, World!')
+  const cipher = Buffer.alloc(message.length + sodium.crypto_box_MACBYTES)
+
+  sodium.crypto_box_easy(cipher, message, nonce, pk, sk)
+
+  t.not(cipher, Buffer.alloc(cipher.length), 'not blank')
+
+  const plain = Buffer.alloc(cipher.length - sodium.crypto_box_MACBYTES)
+  t.absent(sodium.crypto_box_open_easy(plain, Buffer.alloc(cipher.length), nonce, pk, sk), 'does not decrypt')
+  t.ok(sodium.crypto_box_open_easy(plain, cipher, nonce, pk, sk), 'decrypts')
+  t.alike(plain, message, 'same message')
+})
+
+test('crypto_box_seal', function (t) {
+  const pk = Buffer.alloc(sodium.crypto_box_PUBLICKEYBYTES)
+  const sk = Buffer.alloc(sodium.crypto_box_SECRETKEYBYTES)
+
+  sodium.crypto_box_keypair(pk, sk)
+
+  const pk2 = Buffer.alloc(sodium.crypto_box_PUBLICKEYBYTES)
+  const sk2 = Buffer.alloc(sodium.crypto_box_SECRETKEYBYTES)
+
+  sodium.crypto_box_keypair(pk2, sk2)
+
+  const message = Buffer.from('Hello, sealed World!')
+  const cipher = Buffer.alloc(message.length + sodium.crypto_box_SEALBYTES)
+
+  sodium.crypto_box_seal(cipher, message, pk)
+  t.not(cipher, message, 'did not encrypt!')
+
+  t.not(cipher, Buffer.alloc(cipher.length), 'not blank')
+
+  const plain = Buffer.alloc(cipher.length - sodium.crypto_box_SEALBYTES)
+  t.absent(sodium.crypto_box_seal_open(plain, cipher, pk2, sk2), 'does not decrypt')
+  t.ok(sodium.crypto_box_seal_open(plain, cipher, pk, sk), 'decrypts')
+  t.alike(plain, message, 'same message')
+})
+
+test('crypto_box_seal/crypto_box_seal_open self-decrypt', function (t) {
+  const pubKey = Buffer.alloc(sodium.crypto_box_PUBLICKEYBYTES)
+  const secret = Buffer.alloc(sodium.crypto_box_SECRETKEYBYTES)
+
+  sodium.crypto_box_keypair(pubKey, secret)
+
+  const msg = Buffer.from('hello world')
+  const cipher = Buffer.alloc(sodium.crypto_box_SEALBYTES + msg.length)
+  sodium.crypto_box_seal(cipher, msg, pubKey)
+
+  const out = Buffer.alloc(cipher.length - sodium.crypto_box_SEALBYTES)
+  sodium.crypto_box_seal_open(out, cipher, pubKey, secret)
+  t.alike(out.toString(), msg.toString())
+  t.end()
+})
+
+test('crypto_box_seal_open cross-decrypt', function (t) {
+  const pubKey = Buffer.from(
+    'e0bb844ae3f48bb04323c8dfe7c34cf86608db2e2112f927953060c80506287f', 'hex')
+  const secret = Buffer.from(
+    '036a9de1ecc9d152cf39fed1b3e15bf761ae39a299031adc011cc9809041abfa', 'hex')
+  const cipher = Buffer.from(
+    '249912e916ad8bcf96a3f9b750da2703' +
+    '2eccdf83b5cff0d6a59a8bbe0bcd5823' +
+    '5de9fbca55bd5416c754e5e0e0fe2f0c' +
+    '4e50df0cb302f1c4378f80', 'hex')
+
+  const out = Buffer.alloc(cipher.length - sodium.crypto_box_SEALBYTES)
+  sodium.crypto_box_seal_open(out, cipher, pubKey, secret)
+  t.alike(out.toString(), 'hello world')
+  t.end()
+})
+
+test('crypto_box_seed_keypair', function (t) {
+  const seed = Buffer.from([
+    0x77, 0x07, 0x6d, 0x0a, 0x73, 0x18, 0xa5,
+    0x7d, 0x3c, 0x16, 0xc1, 0x72, 0x51, 0xb2,
+    0x66, 0x45, 0xdf, 0x4c, 0x2f, 0x87, 0xeb,
+    0xc0, 0x99, 0x2a, 0xb1, 0x77, 0xfb, 0xa5,
+    0x1d, 0xb9, 0x2c, 0x2a
+  ])
+
+  const expPk = Buffer.from([
+    0xed, 0x77, 0x49, 0xb4, 0xd9, 0x89, 0xf6, 0x95,
+    0x7f, 0x3b, 0xfd, 0xe6, 0xc5, 0x67, 0x67, 0xe9,
+    0x88, 0xe2, 0x1c, 0x9f, 0x87, 0x84, 0xd9, 0x1d,
+    0x61, 0x00, 0x11, 0xcd, 0x55, 0x3f, 0x9b, 0x06
+  ])
+
+  const expSk = Buffer.from([
+    0xac, 0xcd, 0x44, 0xeb, 0x8e, 0x93, 0x31, 0x9c,
+    0x05, 0x70, 0xbc, 0x11, 0x00, 0x5c, 0x0e, 0x01,
+    0x89, 0xd3, 0x4f, 0xf0, 0x2f, 0x6c, 0x17, 0x77,
+    0x34, 0x11, 0xad, 0x19, 0x12, 0x93, 0xc9, 0x8f
+  ])
+
+  const sk = Buffer.alloc(32)
+  const pk = Buffer.alloc(32)
+
+  sodium.crypto_box_seed_keypair(pk, sk, seed)
+
+  t.alike(pk, expPk)
+  t.alike(sk, expSk)
+
+  t.end()
+})
+
+test('crypto_box_easy', (t) => {
+  const alicesk = new Uint8Array([
+    0x77, 0x07, 0x6d, 0x0a, 0x73, 0x18, 0xa5, 0x7d, 0x3c, 0x16, 0xc1, 0x72,
+    0x51, 0xb2, 0x66, 0x45, 0xdf, 0x4c, 0x2f, 0x87, 0xeb, 0xc0, 0x99, 0x2a,
+    0xb1, 0x77, 0xfb, 0xa5, 0x1d, 0xb9, 0x2c, 0x2a
+  ])
+  const bobpk = new Uint8Array([
+    0xde, 0x9e, 0xdb, 0x7d, 0x7b, 0x7d, 0xc1, 0xb4, 0xd3, 0x5b, 0x61, 0xc2,
+    0xec, 0xe4, 0x35, 0x37, 0x3f, 0x83, 0x43, 0xc8, 0x5b, 0x78, 0x67, 0x4d,
+    0xad, 0xfc, 0x7e, 0x14, 0x6f, 0x88, 0x2b, 0x4f
+  ])
+  const nonce = new Uint8Array([
+    0x69, 0x69, 0x6e, 0xe9, 0x55, 0xb6, 0x2b, 0x73, 0xcd, 0x62, 0xbd, 0xa8,
+    0x75, 0xfc, 0x73, 0xd6, 0x82, 0x19, 0xe0, 0x03, 0x6b, 0x7a, 0x0b, 0x37
+  ])
+  const m = new Uint8Array([
+    0xbe, 0x07, 0x5f, 0xc5, 0x3c, 0x81, 0xf2, 0xd5, 0xcf, 0x14, 0x13, 0x16,
+    0xeb, 0xeb, 0x0c, 0x7b, 0x52, 0x28, 0xc5, 0x2a, 0x4c, 0x62, 0xcb, 0xd4,
+    0x4b, 0x66, 0x84, 0x9b, 0x64, 0x24, 0x4f, 0xfc, 0xe5, 0xec, 0xba, 0xaf,
+    0x33, 0xbd, 0x75, 0x1a, 0x1a, 0xc7, 0x28, 0xd4, 0x5e, 0x6c, 0x61, 0x29,
+    0x6c, 0xdc, 0x3c, 0x01, 0x23, 0x35, 0x61, 0xf4, 0x1d, 0xb6, 0x6c, 0xce,
+    0x31, 0x4a, 0xdb, 0x31, 0x0e, 0x3b, 0xe8, 0x25, 0x0c, 0x46, 0xf0, 0x6d,
+    0xce, 0xea, 0x3a, 0x7f, 0xa1, 0x34, 0x80, 0x57, 0xe2, 0xf6, 0x55, 0x6a,
+    0xd6, 0xb1, 0x31, 0x8a, 0x02, 0x4a, 0x83, 0x8f, 0x21, 0xaf, 0x1f, 0xde,
+    0x04, 0x89, 0x77, 0xeb, 0x48, 0xf5, 0x9f, 0xfd, 0x49, 0x24, 0xca, 0x1c,
+    0x60, 0x90, 0x2e, 0x52, 0xf0, 0xa0, 0x89, 0xbc, 0x76, 0x89, 0x70, 0x40,
+    0xe0, 0x82, 0xf9, 0x37, 0x76, 0x38, 0x48, 0x64, 0x5e, 0x07, 0x05
+  ])
+
+  const c = new Uint8Array(147)
+  sodium.crypto_box_easy(c, m, nonce, bobpk, alicesk)
+
+  const expected1 = new Uint8Array([
+    0xf3, 0xff, 0xc7, 0x70, 0x3f, 0x94, 0x00, 0xe5, 0x2a, 0x7d, 0xfb, 0x4b,
+    0x3d, 0x33, 0x05, 0xd9, 0x8e, 0x99, 0x3b, 0x9f, 0x48, 0x68, 0x12, 0x73,
+    0xc2, 0x96, 0x50, 0xba, 0x32, 0xfc, 0x76, 0xce, 0x48, 0x33, 0x2e, 0xa7,
+    0x16, 0x4d, 0x96, 0xa4, 0x47, 0x6f, 0xb8, 0xc5, 0x31, 0xa1, 0x18, 0x6a,
+    0xc0, 0xdf, 0xc1, 0x7c, 0x98, 0xdc, 0xe8, 0x7b, 0x4d, 0xa7, 0xf0, 0x11,
+    0xec, 0x48, 0xc9, 0x72, 0x71, 0xd2, 0xc2, 0x0f, 0x9b, 0x92, 0x8f, 0xe2,
+    0x27, 0x0d, 0x6f, 0xb8, 0x63, 0xd5, 0x17, 0x38, 0xb4, 0x8e, 0xee, 0xe3,
+    0x14, 0xa7, 0xcc, 0x8a, 0xb9, 0x32, 0x16, 0x45, 0x48, 0xe5, 0x26, 0xae,
+    0x90, 0x22, 0x43, 0x68, 0x51, 0x7a, 0xcf, 0xea, 0xbd, 0x6b, 0xb3, 0x73,
+    0x2b, 0xc0, 0xe9, 0xda, 0x99, 0x83, 0x2b, 0x61, 0xca, 0x01, 0xb6, 0xde,
+    0x56, 0x24, 0x4a, 0x9e, 0x88, 0xd5, 0xf9, 0xb3, 0x79, 0x73, 0xf6, 0x22,
+    0xa4, 0x3d, 0x14, 0xa6, 0x59, 0x9b, 0x1f, 0x65, 0x4c, 0xb4, 0x5a, 0x74,
+    0xe3, 0x55, 0xa5
+  ])
+
+  t.alike(c, expected1, 'encrypts correctly')
+
+  // This test isn't found upstream, but it seems necessary to have at least
+  // one crypto_box_open_easy() working since the next test diverges.
+  const o = new Uint8Array(131)
+  t.ok(sodium.crypto_box_open_easy(o, expected1, nonce, bobpk, alicesk))
+  t.alike(o, m, 'decrypts correctly')
+
+  const guardPage = new Uint8Array(0)
+
+  t.execution(() => sodium.crypto_box_easy(
+    c.subarray(0, sodium.crypto_box_MACBYTES),
+    guardPage,
+    nonce,
+    bobpk,
+    alicesk
+  ))
+
+  const expected2 = new Uint8Array([
+    0x25, 0x39, 0x12, 0x1d, 0x8e, 0x23, 0x4e, 0x65, 0x2d, 0x65, 0x1f, 0xa4,
+    0xc8, 0xcf, 0xf8, 0x80, 0x8e
+  ])
+
+  t.alike(c.subarray(0, expected2.length), expected2)
+
+  t.ok(sodium.crypto_box_open_easy(
+    new Uint8Array(0),
+    c.subarray(0, sodium.crypto_box_MACBYTES),
+    nonce,
+    bobpk,
+    alicesk
+  ))
+
+  c[Math.floor(Math.random() * sodium.crypto_box_MACBYTES)] += 1
+
+  t.absent(sodium.crypto_box_open_easy(new Uint8Array(0), c.subarray(0, sodium.crypto_box_MACBYTES), nonce, bobpk, alicesk))
+
+  t.end()
+})
+
+/* eslint-disable camelcase */
+test('crypto_box_easy2', t => {
+  const alicepk = new Uint8Array(sodium.crypto_box_PUBLICKEYBYTES)
+  const alicesk = new Uint8Array(sodium.crypto_box_SECRETKEYBYTES)
+  const bobpk = new Uint8Array(sodium.crypto_box_PUBLICKEYBYTES)
+  const bobsk = new Uint8Array(sodium.crypto_box_SECRETKEYBYTES)
+  const nonce = new Uint8Array(sodium.crypto_box_NONCEBYTES)
+  const m_size = 7 + Math.floor(Math.random() * 1000)
+  const m = new Uint8Array(m_size)
+  const m2 = new Uint8Array(m_size)
+  const c = new Uint8Array(sodium.crypto_box_MACBYTES + m_size)
+
+  sodium.crypto_box_keypair(alicepk, alicesk)
+  sodium.crypto_box_keypair(bobpk, bobsk)
+
+  const mlen = Math.floor(Math.random() * m_size) + 1
+  sodium.randombytes_buf(m.subarray(0, mlen))
+  sodium.randombytes_buf(nonce.subarray(0, sodium.crypto_box_NONCEBYTES))
+
+  t.execution(() => sodium.crypto_box_easy(c.subarray(0, mlen + sodium.crypto_box_MACBYTES), m.subarray(0, mlen), nonce, bobpk, alicesk))
+
+  t.ok(sodium.crypto_box_open_easy(m2.subarray(0, mlen), c.subarray(0, mlen + sodium.crypto_box_MACBYTES), nonce, alicepk, bobsk))
+  t.alike(m.subarray(0, mlen), m2.subarray(0, mlen))
+
+  for (let i = sodium.crypto_box_MACBYTES; i < mlen + sodium.crypto_box_MACBYTES - 1; i++) {
+    if (sodium.crypto_box_open_easy(m2.subarray(0, i - sodium.crypto_box_MACBYTES), c.subarray(0, i), nonce, alicepk, bobsk)) {
+      t.fail('short open() should fail.')
+    }
+  }
+
+  c.set(m.subarray(0, mlen))
+  t.execution(() => sodium.crypto_box_easy(c.subarray(0, mlen + sodium.crypto_box_MACBYTES), c.subarray(0, mlen), nonce, bobpk, alicesk))
+
+  t.unlike(m.subarray(0, mlen), c.subarray(0, mlen))
+  t.unlike(m.subarray(0, mlen), c.subarray(sodium.crypto_box_MACBYTES, sodium.crypto_box_MACBYTES + mlen))
+
+  t.ok(sodium.crypto_box_open_easy(c.subarray(0, mlen), c.subarray(0, mlen + sodium.crypto_box_MACBYTES), nonce, alicepk, bobsk))
+
+  t.end()
+})

test/crypto_generichash.js

@@ -0,0 +1,133 @@
+/* eslint-disable camelcase */
+const test = require('brittle')
+const sodium = require('..')
+
+test('crypto_generichash', function (t) {
+  const buf = Buffer.from('Hello, World!')
+
+  const out = Buffer.alloc(sodium.crypto_generichash_BYTES)
+  sodium.crypto_generichash(out, buf)
+
+  t.alike(out.toString('hex'), '511bc81dde11180838c562c82bb35f3223f46061ebde4a955c27b3f489cf1e03', 'hashed buffer')
+
+  const min = Buffer.alloc(sodium.crypto_generichash_BYTES_MIN)
+  sodium.crypto_generichash(min, buf)
+
+  t.alike(min.toString('hex'), '3895c59e4aeb0903396b5be3fbec69fe', 'hashed buffer min')
+
+  const max = Buffer.alloc(sodium.crypto_generichash_BYTES_MAX)
+  sodium.crypto_generichash(max, buf)
+
+  const res = '7dfdb888af71eae0e6a6b751e8e3413d767ef4fa52a7993daa9ef097f7aa3d949199c113caa37c94f80cf3b22f7d9d6e4f5def4ff927830cffe4857c34be3d89'
+  t.alike(max.toString('hex'), res, 'hashed buffer max')
+})
+
+test('crypto_generichash with key', function (t) {
+  const buf = Buffer.from('Hello, World!')
+  const key = Buffer.alloc(sodium.crypto_generichash_KEYBYTES)
+
+  key.fill('lo')
+
+  const out = Buffer.alloc(sodium.crypto_generichash_BYTES)
+  sodium.crypto_generichash(out, buf, key)
+
+  t.alike(out.toString('hex'), 'f4113fe33d43c24c54627d40efa1a78838d4a6d689fd6e83c213848904fffa8c', 'hashed buffer')
+
+  const min = Buffer.alloc(sodium.crypto_generichash_BYTES_MIN)
+  sodium.crypto_generichash(min, buf, key)
+
+  t.alike(min.toString('hex'), 'c8226257b0d1c3dcf4bbc3ef79574689', 'hashed buffer min')
+
+  const max = Buffer.alloc(sodium.crypto_generichash_BYTES_MAX)
+  sodium.crypto_generichash(max, buf, key)
+
+  const res = '763eda46f4c6c61abb4310eb8a488950e9e0667b2fca03c463dc7489e94f065b7af6063fe86b0441c3eb9052800121d55730412abb2cbe0761b1d66f9b047c1c'
+  t.alike(max.toString('hex'), res, 'hashed buffer max')
+})
+
+test.skip('crypto_generichash_state', function (t) {
+  const state = Buffer.alloc(sodium.crypto_generichash_STATEBYTES)
+  sodium.crypto_generichash_init(state, null, sodium.crypto_generichash_BYTES)
+
+  const buf = Buffer.from('Hej, Verden')
+
+  for (let i = 0; i < 10; i++) sodium.crypto_generichash_update(state, buf)
+
+  const out = Buffer.alloc(sodium.crypto_generichash_BYTES)
+  sodium.crypto_generichash_final(state, out)
+
+  t.alike(out.toString('hex'), 'cbc20f347f5dfe37dc13231cbf7eaa4ec48e585ec055a96839b213f62bd8ce00', 'streaming hash')
+})
+
+test.skip('crypto_generichash state with key', function (t) {
+  const key = Buffer.alloc(sodium.crypto_generichash_KEYBYTES)
+  key.fill('lo')
+
+  const state = Buffer.alloc(sodium.crypto_generichash_STATEBYTES)
+  sodium.crypto_generichash_init(state, key, sodium.crypto_generichash_BYTES)
+
+  const buf = Buffer.from('Hej, Verden')
+
+  for (let i = 0; i < 10; i++) sodium.crypto_generichash_update(state, buf)
+
+  const out = Buffer.alloc(sodium.crypto_generichash_BYTES)
+  sodium.crypto_generichash_final(state, out)
+
+  t.alike(out.toString('hex'), '405f14acbeeb30396b8030f78e6a84bab0acf08cb1376aa200a500f669f675dc', 'streaming keyed hash')
+})
+
+test.skip('crypto_generichash state with hash length', function (t) {
+  const state = Buffer.alloc(sodium.crypto_generichash_STATEBYTES)
+  sodium.crypto_generichash_init(state, null, sodium.crypto_generichash_BYTES_MIN)
+
+  const buf = Buffer.from('Hej, Verden')
+
+  for (let i = 0; i < 10; i++) sodium.crypto_generichash_update(state, buf)
+
+  const out = Buffer.alloc(sodium.crypto_generichash_BYTES_MIN)
+  sodium.crypto_generichash_final(state, out)
+
+  t.alike(out.toString('hex'), 'decacdcc3c61948c79d9f8dee5b6aa99', 'streaming short hash')
+})
+
+test.skip('crypto_generichash state with key and hash length', function (t) {
+  const key = Buffer.alloc(sodium.crypto_generichash_KEYBYTES)
+  key.fill('lo')
+
+  const state = Buffer.alloc(sodium.crypto_generichash_STATEBYTES)
+  sodium.crypto_generichash_init(state, key, sodium.crypto_generichash_BYTES_MIN)
+
+  const buf = Buffer.from('Hej, Verden')
+
+  for (let i = 0; i < 10; i++) sodium.crypto_generichash_update(state, buf)
+
+  const out = Buffer.alloc(sodium.crypto_generichash_BYTES_MIN)
+  sodium.crypto_generichash_final(state, out)
+
+  t.alike(out.toString('hex'), 'fb43f0ab6872cbfd39ec4f8a1bc6fb37', 'streaming short keyed hash')
+})
+
+test('crypto_generichash_batch', function (t) {
+  const buf = Buffer.from('Hej, Verden')
+  const batch = []
+  for (let i = 0; i < 10; i++) batch.push(buf)
+
+  const out = Buffer.alloc(sodium.crypto_generichash_BYTES)
+  sodium.crypto_generichash_batch(out, batch)
+
+  t.alike(out.toString('hex'), 'cbc20f347f5dfe37dc13231cbf7eaa4ec48e585ec055a96839b213f62bd8ce00', 'batch hash')
+})
+
+test('crypto_generichash_batch with key', function (t) {
+  const key = Buffer.alloc(sodium.crypto_generichash_KEYBYTES)
+  key.fill('lo')
+
+  const buf = Buffer.from('Hej, Verden')
+  const batch = []
+  for (let i = 0; i < 10; i++) batch.push(buf)
+
+  const out = Buffer.alloc(sodium.crypto_generichash_BYTES)
+  sodium.crypto_generichash_batch(out, batch, key)
+
+  t.alike(out.toString('hex'), '405f14acbeeb30396b8030f78e6a84bab0acf08cb1376aa200a500f669f675dc', 'batch keyed hash')
+})

test/crypto_hash.js

@@ -0,0 +1,17 @@
+/* eslint-disable camelcase */
+const test = require('brittle')
+const sodium = require('..')
+
+test('crypto_hash', function (t) {
+  const out = Buffer.alloc(sodium.crypto_hash_BYTES)
+  const inp = Buffer.from('Hej, Verden!')
+
+  t.exception.all(function () {
+    sodium.crypto_hash(Buffer.alloc(0), inp)
+  }, 'throws on bad input')
+
+  sodium.crypto_hash(out, inp)
+
+  const result = 'bcf8e6d11dec2da6e93abb99a73c8e9c387886a5f84fbca5e25af85af26ee39161b7e0c9f9cf547f2aef40523f1aab80e26ec3c630db43ce78adc8c058dc5d16'
+  t.alike(out.toString('hex'), result, 'hashed the string')
+})

test/crypto_hash_sha256.js

@@ -0,0 +1,32 @@
+/* eslint-disable camelcase */
+const test = require('brittle')
+const sodium = require('..')
+
+test('crypto_hash_sha256', function (t) {
+  const out = Buffer.alloc(sodium.crypto_hash_sha256_BYTES)
+  const inp = Buffer.from('Hej, Verden!')
+
+  t.exception.all(function () {
+    sodium.crypto_hash(Buffer.alloc(0), inp)
+  }, 'throws on bad input')
+
+  sodium.crypto_hash_sha256(out, inp)
+
+  const result = 'f0704b1e832b05d01223952fb2512181af4f843ce7bb6b443afd5ea028010e6c'
+  t.alike(out.toString('hex'), result, 'hashed the string')
+})
+
+test.skip('crypto_hash_sha256_state', function (t) {
+  const state = Buffer.alloc(sodium.crypto_hash_sha256_STATEBYTES)
+  sodium.crypto_hash_sha256_init(state)
+
+  const buf = Buffer.from('Hej, Verden!')
+
+  for (let i = 0; i < 10; i++) sodium.crypto_hash_sha256_update(state, buf)
+
+  const out = Buffer.alloc(sodium.crypto_hash_sha256_BYTES)
+  sodium.crypto_hash_sha256_final(state, out)
+
+  const result = '14207db33c6ac7d39ca5fe0e74432fa7a2ed15caf7f6ab5ef68d24017a899974'
+  t.alike(out.toString('hex'), result, 'hashed the string')
+})

test/crypto_hash_sha512.js

@@ -0,0 +1,32 @@
+/* eslint-disable camelcase */
+const test = require('brittle')
+const sodium = require('..')
+
+test('crypto_hash_sha512', function (t) {
+  const out = Buffer.alloc(sodium.crypto_hash_sha512_BYTES)
+  const inp = Buffer.from('Hej, Verden!')
+
+  t.exception.all(function () {
+    sodium.crypto_hash(Buffer.alloc(0), inp)
+  }, 'throws on bad input')
+
+  sodium.crypto_hash_sha512(out, inp)
+
+  const result = 'bcf8e6d11dec2da6e93abb99a73c8e9c387886a5f84fbca5e25af85af26ee39161b7e0c9f9cf547f2aef40523f1aab80e26ec3c630db43ce78adc8c058dc5d16'
+  t.alike(out.toString('hex'), result, 'hashed the string')
+})
+
+test.skip('crypto_hash_sha512_state', function (t) {
+  const state = Buffer.alloc(sodium.crypto_hash_sha512_STATEBYTES)
+  sodium.crypto_hash_sha512_init(state)
+
+  const buf = Buffer.from('Hej, Verden!')
+
+  for (let i = 0; i < 10; i++) sodium.crypto_hash_sha512_update(state, buf)
+
+  const out = Buffer.alloc(sodium.crypto_hash_sha512_BYTES)
+  sodium.crypto_hash_sha512_final(state, out)
+
+  const result = 'a0a9b965c23be41fa8c344f483da39bedcf88b7f25cdc0bc9ea335fa264dc3db51f08c1d0f5f6f0ffb08a1d8643e2a1cd0ea8f03408ca03711c751d61787a229'
+  t.alike(out.toString('hex'), result, 'hashed the string')
+})

test/crypto_kdf.js

@@ -0,0 +1,71 @@
+/* eslint-disable camelcase */
+const test = require('brittle')
+const sodium = require('..')
+
+test('crypto_kdf_keygen', function (t) {
+  const key = Buffer.alloc(sodium.crypto_kdf_KEYBYTES)
+
+  t.exception.all(function () {
+    sodium.crypto_kdf_keygen(Buffer.alloc(1))
+  })
+
+  sodium.crypto_kdf_keygen(key)
+
+  t.not(key, Buffer.alloc(key.length))
+})
+
+test('crypto_kdf_derive_from_key', function (t) {
+  const key = Buffer.alloc(sodium.crypto_kdf_KEYBYTES)
+
+  sodium.crypto_kdf_keygen(key)
+
+  const subkey = Buffer.alloc(sodium.crypto_kdf_BYTES_MIN)
+
+  sodium.crypto_kdf_derive_from_key(subkey, 0, Buffer.from('context_'), key)
+  t.not(subkey, Buffer.alloc(subkey.length))
+
+  const subkey2 = Buffer.alloc(sodium.crypto_kdf_BYTES_MIN)
+
+  sodium.crypto_kdf_derive_from_key(subkey2, 1, Buffer.from('context_'), key)
+  t.not(subkey, subkey2)
+
+  sodium.crypto_kdf_derive_from_key(subkey2, 0, Buffer.from('context_'), key)
+  t.alike(subkey, subkey2)
+})
+
+test('test vectors', function (assert) {
+  const fixtures = require('./fixtures/crypto_kdf.json')
+
+  for (let i = 0; i < fixtures.length; i++) {
+    const key = Buffer.from(fixtures[i].key, 'hex')
+    const subkeyLen = fixtures[i].subkey_len
+    const id = fixtures[i].id
+    const context = Buffer.from(fixtures[i].context, 'hex')
+
+    const shouldError = fixtures[i].error
+
+    const actual = Buffer.alloc(subkeyLen)
+
+    try {
+      sodium.crypto_kdf_derive_from_key(actual, id, context, key)
+      const expected = Buffer.from(fixtures[i].subkey, 'hex')
+      if (Buffer.compare(actual, expected) !== 0) {
+        assert.fail('Failed on fixture #' + i)
+      }
+    } catch (ex) {
+      if (shouldError === false) assert.fail('Failed on fixture #' + i)
+    }
+  }
+
+  assert.pass('Passed all fixtures')
+  assert.end()
+})
+
+test('constants', function (t) {
+  t.ok(sodium.crypto_kdf_PRIMITIVE)
+  t.ok(sodium.crypto_kdf_BYTES_MAX > 0)
+  t.ok(sodium.crypto_kdf_BYTES_MIN <= sodium.crypto_kdf_BYTES_MAX)
+  t.ok(sodium.crypto_kdf_CONTEXTBYTES > 0)
+  t.ok(sodium.crypto_kdf_KEYBYTES >= 16)
+  t.end()
+})

test/crypto_kx.js

@@ -0,0 +1,265 @@
+/* eslint-disable camelcase */
+const test = require('brittle')
+const sodium = require('..')
+
+test('crypto_kx_seed_keypair', function (t) {
+  const pk = Buffer.alloc(sodium.crypto_kx_PUBLICKEYBYTES)
+  const sk = Buffer.alloc(sodium.crypto_kx_SECRETKEYBYTES)
+  const seed = Buffer.alloc(sodium.crypto_kx_SEEDBYTES, 'lo')
+
+  t.exception.all(function () {
+    sodium.crypto_kx_seed_keypair()
+  }, 'should validate input')
+
+  t.exception.all(function () {
+    sodium.crypto_kx_seed_keypair(Buffer.alloc(0), Buffer.alloc(0), Buffer.alloc(0))
+  }, 'should validate input length')
+
+  sodium.crypto_kx_seed_keypair(pk, sk, seed)
+
+  const eSk = '768475983073421d5b1676c4aabb24fdf17c3a5f19e6e9e9cdefbfeb45ceb153'
+  const ePk = '0cd703bbd6b1d46dc431a1fc4f1f7724c64b1d4c471e8c17de4966c9e15bf85e'
+
+  t.alike(pk.toString('hex'), ePk, 'seeded public key')
+  t.alike(sk.toString('hex'), eSk, 'seeded secret key')
+})
+
+test('crypto_kx_keypair', function (t) {
+  const pk = Buffer.alloc(sodium.crypto_kx_PUBLICKEYBYTES)
+  const sk = Buffer.alloc(sodium.crypto_kx_SECRETKEYBYTES)
+
+  sodium.crypto_kx_keypair(pk, sk)
+
+  t.not(pk, Buffer.alloc(pk.length), 'made public key')
+  t.not(sk, Buffer.alloc(sk.length), 'made secret key')
+
+  t.exception.all(function () {
+    sodium.crypto_kx_keypair()
+  }, 'should validate input')
+
+  t.exception.all(function () {
+    sodium.crypto_kx_keypair(Buffer.alloc(0), Buffer.alloc(0))
+  }, 'should validate input length')
+})
+
+test.skip('crypto_kx_client_session_keys', function (t) {
+  const clientPk = Buffer.alloc(sodium.crypto_kx_PUBLICKEYBYTES)
+  const clientSk = Buffer.alloc(sodium.crypto_kx_SECRETKEYBYTES)
+  const serverPk = Buffer.alloc(sodium.crypto_kx_PUBLICKEYBYTES)
+  const serverSk = Buffer.alloc(sodium.crypto_kx_SECRETKEYBYTES)
+
+  const serverRx = Buffer.alloc(sodium.crypto_kx_SESSIONKEYBYTES)
+  const serverTx = Buffer.alloc(sodium.crypto_kx_SESSIONKEYBYTES)
+
+  const clientRx = Buffer.alloc(sodium.crypto_kx_SESSIONKEYBYTES)
+  const clientTx = Buffer.alloc(sodium.crypto_kx_SESSIONKEYBYTES)
+
+  sodium.crypto_kx_keypair(serverPk, serverSk)
+  sodium.crypto_kx_keypair(clientPk, clientSk)
+
+  t.exception.all(function () {
+    sodium.crypto_kx_client_session_keys()
+  }, 'should validate')
+
+  t.exception.all(function () {
+    sodium.crypto_kx_server_session_keys()
+  }, 'should validate')
+
+  sodium.crypto_kx_client_session_keys(clientRx, clientTx, clientPk, clientSk, serverPk)
+  sodium.crypto_kx_server_session_keys(serverRx, serverTx, serverPk, serverSk, clientPk)
+
+  t.alike(clientRx, serverTx)
+  t.alike(clientTx, serverRx)
+})
+
+test.skip('crypto_kx_client_session_keys one NULL', function (t) {
+  const clientPk = Buffer.alloc(sodium.crypto_kx_PUBLICKEYBYTES)
+  const clientSk = Buffer.alloc(sodium.crypto_kx_SECRETKEYBYTES)
+  const serverPk = Buffer.alloc(sodium.crypto_kx_PUBLICKEYBYTES)
+  const serverSk = Buffer.alloc(sodium.crypto_kx_SECRETKEYBYTES)
+
+  const serverRx = Buffer.alloc(sodium.crypto_kx_SESSIONKEYBYTES)
+  const serverTx = Buffer.alloc(sodium.crypto_kx_SESSIONKEYBYTES)
+
+  const clientRx = Buffer.alloc(sodium.crypto_kx_SESSIONKEYBYTES)
+  const clientTx = Buffer.alloc(sodium.crypto_kx_SESSIONKEYBYTES)
+
+  sodium.crypto_kx_keypair(serverPk, serverSk)
+  sodium.crypto_kx_keypair(clientPk, clientSk)
+
+  t.exception.all(function () {
+    sodium.crypto_kx_client_session_keys()
+  }, 'should validate')
+
+  t.exception.all(function () {
+    sodium.crypto_kx_server_session_keys()
+  }, 'should validate')
+
+  t.exception(function () {
+    sodium.crypto_kx_server_session_keys(null, null, clientPk, clientSk, serverPk)
+  }, 'should validate')
+
+  t.exception(function () {
+    sodium.crypto_kx_client_session_keys(null, null, clientPk, clientSk, serverPk)
+  }, 'should validate')
+
+  sodium.crypto_kx_client_session_keys(clientRx, null, clientPk, clientSk, serverPk)
+  sodium.crypto_kx_server_session_keys(null, serverTx, serverPk, serverSk, clientPk)
+
+  t.alike(clientRx, serverTx)
+
+  sodium.crypto_kx_client_session_keys(null, clientTx, clientPk, clientSk, serverPk)
+  sodium.crypto_kx_server_session_keys(serverRx, null, serverPk, serverSk, clientPk)
+  t.alike(clientTx, serverRx)
+})
+
+test('crypto_kx constants', function (t) {
+  t.alike(typeof sodium.crypto_kx_SESSIONKEYBYTES, 'number')
+  t.alike(typeof sodium.crypto_kx_PUBLICKEYBYTES, 'number')
+  t.alike(typeof sodium.crypto_kx_SECRETKEYBYTES, 'number')
+  t.alike(typeof sodium.crypto_kx_SEEDBYTES, 'number')
+  t.alike(typeof sodium.crypto_kx_PRIMITIVE, 'string')
+
+  t.is(sodium.crypto_kx_SEEDBYTES, 32)
+  t.is(sodium.crypto_kx_PUBLICKEYBYTES, 32)
+  t.is(sodium.crypto_kx_SESSIONKEYBYTES, 32)
+  t.is(sodium.crypto_kx_SECRETKEYBYTES, 32)
+
+  t.end()
+})
+
+/* eslint-disable camelcase */
+test.skip('libsodium', function (t) {
+  const small_order_p = new Uint8Array([
+    0xe0, 0xeb, 0x7a, 0x7c, 0x3b, 0x41, 0xb8, 0xae, 0x16, 0x56, 0xe3,
+    0xfa, 0xf1, 0x9f, 0xc4, 0x6a, 0xda, 0x09, 0x8d, 0xeb, 0x9c, 0x32,
+    0xb1, 0xfd, 0x86, 0x62, 0x05, 0x16, 0x5f, 0x49, 0xb8, 0x00
+  ])
+
+  const seed = new Uint8Array(sodium.crypto_kx_SEEDBYTES)
+  const client_pk = new Uint8Array(sodium.crypto_kx_PUBLICKEYBYTES)
+  const client_sk = new Uint8Array(sodium.crypto_kx_SECRETKEYBYTES)
+  const client_rx = new Uint8Array(sodium.crypto_kx_SESSIONKEYBYTES)
+  const client_tx = new Uint8Array(sodium.crypto_kx_SESSIONKEYBYTES)
+  const server_pk = new Uint8Array(sodium.crypto_kx_PUBLICKEYBYTES)
+  const server_sk = new Uint8Array(sodium.crypto_kx_SECRETKEYBYTES)
+  const server_rx = new Uint8Array(sodium.crypto_kx_SESSIONKEYBYTES)
+  const server_tx = new Uint8Array(sodium.crypto_kx_SESSIONKEYBYTES)
+
+  for (let i = 0; i < sodium.crypto_kx_SEEDBYTES; i++) {
+    seed[i] = i
+  }
+
+  sodium.crypto_kx_seed_keypair(client_pk, client_sk, seed)
+
+  const exp1 = new Uint8Array([
+    0x0e, 0x02, 0x16, 0x22, 0x3f, 0x14, 0x71, 0x43, 0xd3, 0x26, 0x15,
+    0xa9, 0x11, 0x89, 0xc2, 0x88, 0xc1, 0x72, 0x8c, 0xba, 0x3c, 0xc5,
+    0xf9, 0xf6, 0x21, 0xb1, 0x02, 0x6e, 0x03, 0xd8, 0x31, 0x29
+  ])
+
+  const exp2 = new Uint8Array([
+    0xcb, 0x2f, 0x51, 0x60, 0xfc, 0x1f, 0x7e, 0x05, 0xa5, 0x5e, 0xf4,
+    0x9d, 0x34, 0x0b, 0x48, 0xda, 0x2e, 0x5a, 0x78, 0x09, 0x9d, 0x53,
+    0x39, 0x33, 0x51, 0xcd, 0x57, 0x9d, 0xd4, 0x25, 0x03, 0xd6
+  ])
+
+  t.alike(client_pk, exp1, 'client_pk')
+  t.alike(client_sk, exp2, 'client_pk')
+
+  sodium.crypto_kx_keypair(server_pk, server_sk)
+
+  t.exception(() => {
+    sodium.crypto_kx_client_session_keys(client_rx, client_tx, client_pk, client_sk, small_order_p)
+  })
+
+  t.execution(() => {
+    sodium.crypto_kx_client_session_keys(client_rx, client_tx, client_pk, client_sk, server_pk)
+  })
+
+  t.exception(() => sodium.crypto_kx_server_session_keys(server_rx, server_tx, server_pk, server_sk, small_order_p))
+  t.execution(() => {
+    sodium.crypto_kx_server_session_keys(server_rx, server_tx, server_pk, server_sk, client_pk)
+  })
+
+  t.alike(server_rx, client_tx)
+  t.alike(server_tx, client_rx)
+
+  sodium.sodium_increment(client_pk)
+
+  t.execution(() => {
+    sodium.crypto_kx_server_session_keys(server_rx, server_tx, server_pk, server_sk, client_pk)
+  })
+
+  t.unlike(server_rx, client_tx)
+  t.unlike(server_tx, client_rx)
+
+  sodium.crypto_kx_keypair(client_pk, client_sk)
+
+  t.execution(() => {
+    sodium.crypto_kx_server_session_keys(server_rx, server_tx, server_pk, server_sk, client_pk)
+  })
+
+  t.unlike(server_rx, client_tx)
+  t.unlike(server_tx, client_rx)
+
+  sodium.crypto_kx_seed_keypair(client_pk, client_sk, seed)
+  sodium.sodium_increment(seed)
+
+  sodium.crypto_kx_seed_keypair(server_pk, server_sk, seed)
+  t.execution(() => {
+    sodium.crypto_kx_server_session_keys(server_rx, server_tx, server_pk, server_sk, client_pk)
+  })
+
+  const exp3 = new Uint8Array([
+    0x62, 0xc8, 0xf4, 0xfa, 0x81, 0x80, 0x0a, 0xbd, 0x05, 0x77, 0xd9,
+    0x99, 0x18, 0xd1, 0x29, 0xb6, 0x5d, 0xeb, 0x78, 0x9a, 0xf8, 0xc8,
+    0x35, 0x1f, 0x39, 0x1f, 0xeb, 0x0c, 0xbf, 0x23, 0x86, 0x04
+  ])
+
+  const exp4 = new Uint8Array([
+    0x74, 0x95, 0x19, 0xc6, 0x80, 0x59, 0xbc, 0xe6, 0x9f, 0x7c, 0xfc,
+    0xc7, 0xb3, 0x87, 0xa3, 0xde, 0x1a, 0x1e, 0x82, 0x37, 0xd1, 0x10,
+    0x99, 0x13, 0x23, 0xbf, 0x62, 0x87, 0x01, 0x15, 0x73, 0x1a
+  ])
+
+  t.alike(server_rx, exp3)
+  t.alike(server_tx, exp4)
+
+  t.execution(() => {
+    sodium.crypto_kx_client_session_keys(client_rx, client_tx, client_pk, client_sk, server_pk)
+  })
+
+  const exp5 = new Uint8Array([
+    0x74, 0x95, 0x19, 0xc6, 0x80, 0x59, 0xbc, 0xe6, 0x9f, 0x7c, 0xfc,
+    0xc7, 0xb3, 0x87, 0xa3, 0xde, 0x1a, 0x1e, 0x82, 0x37, 0xd1, 0x10,
+    0x99, 0x13, 0x23, 0xbf, 0x62, 0x87, 0x01, 0x15, 0x73, 0x1a
+  ])
+
+  const exp6 = new Uint8Array([
+    0x62, 0xc8, 0xf4, 0xfa, 0x81, 0x80, 0x0a, 0xbd, 0x05, 0x77, 0xd9,
+    0x99, 0x18, 0xd1, 0x29, 0xb6, 0x5d, 0xeb, 0x78, 0x9a, 0xf8, 0xc8,
+    0x35, 0x1f, 0x39, 0x1f, 0xeb, 0x0c, 0xbf, 0x23, 0x86, 0x04
+  ])
+
+  t.alike(client_rx, exp5)
+  t.alike(client_tx, exp6)
+
+  sodium.randombytes_buf(client_rx)
+  sodium.randombytes_buf(client_tx)
+  sodium.randombytes_buf(server_rx)
+  sodium.randombytes_buf(server_tx)
+
+  t.execution(() => sodium.crypto_kx_client_session_keys(client_rx, null,
+    client_pk, client_sk, server_pk))
+  t.execution(() => sodium.crypto_kx_client_session_keys(null, client_tx,
+    client_pk, client_sk, server_pk))
+  t.execution(() => sodium.crypto_kx_server_session_keys(server_rx, null,
+    server_pk, server_sk, client_pk))
+  t.execution(() => sodium.crypto_kx_server_session_keys(null, server_tx,
+    server_pk, server_sk, client_pk))
+
+  t.alike(client_rx, client_tx)
+  t.alike(client_tx, server_rx)
+  t.alike(server_rx, server_tx)
+})

test/crypto_onetimeauth.js

@@ -0,0 +1,37 @@
+/* eslint-disable camelcase */
+const test = require('brittle')
+const sodium = require('..')
+
+test('crypto_onetimeauth', function (t) {
+  const key = Buffer.alloc(sodium.crypto_onetimeauth_KEYBYTES)
+  const mac = Buffer.alloc(sodium.crypto_onetimeauth_BYTES)
+  const value = Buffer.from('Hello, World!')
+
+  sodium.randombytes_buf(key)
+  sodium.crypto_onetimeauth(mac, value, key)
+
+  t.not(mac, Buffer.alloc(mac.length), 'not blank')
+  t.absent(sodium.crypto_onetimeauth_verify(Buffer.alloc(mac.length), value, key), 'does not verify')
+  t.ok(sodium.crypto_onetimeauth_verify(mac, value, key), 'verifies')
+})
+
+test.skip('crypto_onetimeauth_state', function (t) {
+  const key = Buffer.alloc(sodium.crypto_onetimeauth_KEYBYTES, 'lo')
+  const state = Buffer.alloc(sodium.crypto_onetimeauth_STATEBYTES)
+
+  t.exception.all(function () {
+    sodium.crypto_onetimeauth_init(state)
+  }, 'key required')
+
+  key[0] = 42
+
+  sodium.crypto_onetimeauth_init(state, key)
+  const value = Buffer.from('Hello, World!')
+
+  for (let i = 0; i < 10; i++) sodium.crypto_onetimeauth_update(state, value)
+
+  const mac = Buffer.alloc(sodium.crypto_onetimeauth_BYTES)
+  sodium.crypto_onetimeauth_final(state, mac)
+
+  t.alike(mac.toString('hex'), 'ac35df70e6b95051e015de11a6cbf4ab', 'streaming mac')
+})

test/crypto_pwhash.js

@@ -0,0 +1,226 @@
+const test = require('brittle')
+const sodium = require('..')
+
+test('constants', function (t) {
+  t.ok(sodium.crypto_pwhash_ALG_ARGON2I13 != null, 'crypto_pwhash_ALG_ARGON2I13 is defined')
+  t.ok(sodium.crypto_pwhash_ALG_ARGON2ID13 != null, 'crypto_pwhash_ALG_ARGON2ID13 is defined')
+  t.ok(sodium.crypto_pwhash_ALG_DEFAULT === sodium.crypto_pwhash_ALG_ARGON2ID13, 'crypto_pwhash_ALG_DEFAULT is crypto_pwhash_ALG_ARGON2ID13')
+  t.ok(sodium.crypto_pwhash_BYTES_MIN != null, 'crypto_pwhash_BYTES_MIN is defined')
+  t.ok(sodium.crypto_pwhash_BYTES_MAX != null, 'crypto_pwhash_BYTES_MAX is defined')
+  t.ok(sodium.crypto_pwhash_PASSWD_MIN != null, 'crypto_pwhash_PASSWD_MIN is defined')
+  t.ok(sodium.crypto_pwhash_PASSWD_MAX != null, 'crypto_pwhash_PASSWD_MAX is defined')
+  t.ok(sodium.crypto_pwhash_SALTBYTES != null, 'crypto_pwhash_SALTBYTES is defined')
+  t.ok(sodium.crypto_pwhash_STRBYTES != null, 'crypto_pwhash_STRBYTES is defined')
+
+  t.ok(sodium.crypto_pwhash_OPSLIMIT_MIN != null, 'crypto_pwhash_OPSLIMIT_MIN is defined')
+  t.ok(sodium.crypto_pwhash_OPSLIMIT_MAX != null, 'crypto_pwhash_OPSLIMIT_MAX is defined')
+  t.ok(sodium.crypto_pwhash_MEMLIMIT_MIN != null, 'crypto_pwhash_MEMLIMIT_MIN is defined')
+  t.ok(sodium.crypto_pwhash_MEMLIMIT_MAX != null, 'crypto_pwhash_MEMLIMIT_MAX is defined')
+  t.ok(sodium.crypto_pwhash_OPSLIMIT_INTERACTIVE != null, 'crypto_pwhash_OPSLIMIT_INTERACTIVE is defined')
+  t.ok(sodium.crypto_pwhash_MEMLIMIT_INTERACTIVE != null, 'crypto_pwhash_MEMLIMIT_INTERACTIVE is defined')
+  t.ok(sodium.crypto_pwhash_OPSLIMIT_MODERATE != null, 'crypto_pwhash_OPSLIMIT_MODERATE is defined')
+  t.ok(sodium.crypto_pwhash_MEMLIMIT_MODERATE != null, 'crypto_pwhash_MEMLIMIT_MODERATE is defined')
+  t.ok(sodium.crypto_pwhash_OPSLIMIT_SENSITIVE != null, 'crypto_pwhash_OPSLIMIT_SENSITIVE is defined')
+  t.ok(sodium.crypto_pwhash_MEMLIMIT_SENSITIVE != null, 'crypto_pwhash_MEMLIMIT_SENSITIVE is defined')
+})
+
+test('crypto_pwhash', function (t) {
+  const output = Buffer.alloc(32) // can be any size
+  const passwd = Buffer.from('Hej, Verden!')
+  const salt = Buffer.alloc(sodium.crypto_pwhash_SALTBYTES, 'lo')
+  const opslimit = sodium.crypto_pwhash_OPSLIMIT_INTERACTIVE
+  const memlimit = sodium.crypto_pwhash_MEMLIMIT_INTERACTIVE
+  const algo = sodium.crypto_pwhash_ALG_DEFAULT
+
+  sodium.crypto_pwhash(output, passwd, salt, opslimit, memlimit, algo)
+
+  t.alike(output.toString('hex'), 'f0236e17ec70050fc989f19d8ce640301e8f912154b4f0afc1552cdf246e659f', 'hashes password')
+
+  salt[0] = 0
+  sodium.crypto_pwhash(output, passwd, salt, opslimit, memlimit, algo)
+
+  t.alike(output.toString('hex'), 'df73f15d217196311d4b1aa6fba339905ffe581dee4bd3a95ec2bb7c52991d65', 'diff salt -> diff hash')
+})
+
+test('crypto_pwhash_str', function (t) {
+  const output = Buffer.alloc(sodium.crypto_pwhash_STRBYTES)
+  const passwd = Buffer.from('Hej, Verden!')
+  const opslimit = sodium.crypto_pwhash_OPSLIMIT_INTERACTIVE
+  const memlimit = sodium.crypto_pwhash_MEMLIMIT_INTERACTIVE
+
+  t.exception.all(function () {
+    sodium.crypto_pwhash_str(output, passwd)
+  }, 'should throw on missing args')
+
+  sodium.crypto_pwhash_str(output, passwd, opslimit, memlimit)
+
+  t.not(output, Buffer.alloc(output.length), 'not blank')
+  t.absent(sodium.crypto_pwhash_str_verify(Buffer.alloc(output.length), passwd), 'does not verify')
+  t.ok(sodium.crypto_pwhash_str_verify(output, passwd), 'verifies')
+})
+
+test('crypto_pwhash_str_needs_rehash', function (t) {
+  const passwd = Buffer.from('secret')
+  const weakMem = Buffer.alloc(sodium.crypto_pwhash_STRBYTES)
+  const weakOps = Buffer.alloc(sodium.crypto_pwhash_STRBYTES)
+  const malformed = Buffer.alloc(sodium.crypto_pwhash_STRBYTES)
+  const good = Buffer.alloc(sodium.crypto_pwhash_STRBYTES)
+  const weakAlg = Buffer.alloc(sodium.crypto_pwhash_STRBYTES)
+  weakAlg.set(Buffer.from('$argon2id$v=19$m=8,t=1,p=1$DF4Tce8BK5di0gKeMBb2Fw$uNE4oyvyA0z68RPUom2NXu/KyGvpFppyUoN6pwFBtRU'))
+
+  sodium.crypto_pwhash_str(weakMem, passwd, sodium.crypto_pwhash_OPSLIMIT_MODERATE, sodium.crypto_pwhash_MEMLIMIT_INTERACTIVE)
+  sodium.crypto_pwhash_str(weakOps, passwd, sodium.crypto_pwhash_OPSLIMIT_INTERACTIVE, sodium.crypto_pwhash_MEMLIMIT_MODERATE)
+  sodium.crypto_pwhash_str(malformed, passwd, sodium.crypto_pwhash_OPSLIMIT_MODERATE, sodium.crypto_pwhash_MEMLIMIT_MODERATE)
+  sodium.crypto_pwhash_str(good, passwd, sodium.crypto_pwhash_OPSLIMIT_MODERATE, sodium.crypto_pwhash_MEMLIMIT_MODERATE)
+
+  const first$ = malformed.indexOf('$')
+  const second$ = malformed.indexOf('$', first$ + 1)
+  malformed.fill('p=,m=,', first$, second$, 'ascii')
+
+  t.ok(sodium.crypto_pwhash_str_needs_rehash(weakMem, sodium.crypto_pwhash_OPSLIMIT_MODERATE, sodium.crypto_pwhash_MEMLIMIT_MODERATE))
+  t.ok(sodium.crypto_pwhash_str_needs_rehash(weakOps, sodium.crypto_pwhash_OPSLIMIT_MODERATE, sodium.crypto_pwhash_MEMLIMIT_MODERATE))
+  t.ok(sodium.crypto_pwhash_str_needs_rehash(weakAlg, sodium.crypto_pwhash_OPSLIMIT_MODERATE, sodium.crypto_pwhash_MEMLIMIT_MODERATE))
+  t.absent(sodium.crypto_pwhash_str_needs_rehash(good, sodium.crypto_pwhash_OPSLIMIT_MODERATE, sodium.crypto_pwhash_MEMLIMIT_MODERATE))
+  t.ok(sodium.crypto_pwhash_str_needs_rehash(
+    , sodium.crypto_pwhash_OPSLIMIT_MODERATE, sodium.crypto_pwhash_MEMLIMIT_MODERATE))
+})
+
+test('crypto_pwhash_async', function (t) {
+  t.plan(4)
+
+  const output = Buffer.alloc(32) // can be any size
+  const passwd = Buffer.from('Hej, Verden!')
+  const salt = Buffer.alloc(sodium.crypto_pwhash_SALTBYTES, 'lo')
+  const opslimit = sodium.crypto_pwhash_OPSLIMIT_INTERACTIVE
+  const memlimit = sodium.crypto_pwhash_MEMLIMIT_INTERACTIVE
+  const algo = sodium.crypto_pwhash_ALG_DEFAULT
+
+  sodium.crypto_pwhash_async(output, passwd, salt, opslimit, memlimit, algo, function (err) {
+    t.absent(err)
+    t.alike(output.toString('hex'), 'f0236e17ec70050fc989f19d8ce640301e8f912154b4f0afc1552cdf246e659f', 'hashes password')
+
+    salt[0] = 0
+
+    sodium.crypto_pwhash_async(output, passwd, salt, opslimit, memlimit, algo, function (err) {
+      t.absent(err)
+      t.alike(output.toString('hex'), 'df73f15d217196311d4b1aa6fba339905ffe581dee4bd3a95ec2bb7c52991d65', 'diff salt -> diff hash')
+    })
+  })
+})
+
+test('crypto_pwhash_str_async', function (t) {
+  t.plan(7)
+
+  const output = Buffer.alloc(sodium.crypto_pwhash_STRBYTES)
+  const passwd = Buffer.from('Hej, Verden!')
+  const opslimit = sodium.crypto_pwhash_OPSLIMIT_INTERACTIVE
+  const memlimit = sodium.crypto_pwhash_MEMLIMIT_INTERACTIVE
+
+  t.exception.all(function () {
+    sodium.crypto_pwhash_str_async(output, passwd)
+  }, 'should throw on missing args')
+
+  sodium.crypto_pwhash_str_async(output, passwd, opslimit, memlimit, function (err) {
+    t.absent(err)
+    t.not(output, Buffer.alloc(output.length), 'not blank')
+
+    sodium.crypto_pwhash_str_verify_async(Buffer.alloc(output.length), passwd, function (err, bool) {
+      t.absent(err)
+      t.ok(bool === false, 'does not verify')
+
+      sodium.crypto_pwhash_str_verify_async(output, passwd, function (err, bool) {
+        t.absent(err)
+        t.ok(bool === true, 'verifies')
+      })
+    })
+  })
+})
+
+test('crypto_pwhash limits', function (t) {
+  const output = Buffer.alloc(sodium.crypto_pwhash_STRBYTES)
+  const passwd = Buffer.from('Hej, Verden!')
+  const opslimit = Number.MAX_SAFE_INTEGER
+  const memlimit = Number.MAX_SAFE_INTEGER
+
+  t.exception.all(function () {
+    sodium.crypto_pwhash_str(output, passwd, opslimit, memlimit)
+  }, 'should throw on large limits')
+  t.exception.all(function () {
+    sodium.crypto_pwhash_str(output, passwd, -1, -1)
+  }, 'should throw on negative limits')
+})
+
+test('crypto_pwhash_async uncaughtException', function (t) {
+  t.plan(1)
+
+  const output = Buffer.alloc(32) // can be any size
+  const passwd = Buffer.from('Hej, Verden!')
+  const salt = Buffer.alloc(sodium.crypto_pwhash_SALTBYTES, 'lo')
+  const opslimit = sodium.crypto_pwhash_OPSLIMIT_INTERACTIVE
+  const memlimit = sodium.crypto_pwhash_MEMLIMIT_INTERACTIVE
+  const algo = sodium.crypto_pwhash_ALG_DEFAULT
+
+  process.once('uncaughtException', listener)
+
+  sodium.crypto_pwhash_async(output, passwd, salt, opslimit, memlimit, algo, exception)
+
+  function exception () {
+    throw new Error('caught')
+  }
+
+  function listener (err) {
+    if (err.message !== 'caught') {
+      t.fail()
+    } else {
+      t.pass()
+    }
+  }
+})
+
+test('crypto_pwhash_str_async uncaughtException', function (t) {
+  t.plan(1)
+
+  const output = Buffer.alloc(sodium.crypto_pwhash_STRBYTES) // can be any size
+  const passwd = Buffer.from('Hej, Verden!')
+  const opslimit = sodium.crypto_pwhash_OPSLIMIT_INTERACTIVE
+  const memlimit = sodium.crypto_pwhash_MEMLIMIT_INTERACTIVE
+
+  process.once('uncaughtException', listener)
+
+  sodium.crypto_pwhash_str_async(output, passwd, opslimit, memlimit, exception)
+
+  function exception () {
+    throw new Error('caught')
+  }
+
+  function listener (err) {
+    if (err.message === 'caught') {
+      t.pass()
+    } else {
+      t.fail()
+    }
+  }
+})
+
+test('crypto_pwhash_str_verify_async uncaughtException', function (t) {
+  t.plan(1)
+
+  const output = Buffer.alloc(sodium.crypto_pwhash_STRBYTES) // can be any size
+  const passwd = Buffer.from('Hej, Verden!')
+
+  process.once('uncaughtException', listener)
+
+  sodium.crypto_pwhash_str_verify_async(output, passwd, exception)
+
+  function exception () {
+    throw new Error('caught')
+  }
+
+  function listener (err) {
+    if (err.message === 'caught') {
+      t.pass()
+    } else {
+      t.fail()
+    }
+  }
+})

test/crypto_scalarmult.js

@@ -0,0 +1,39 @@
+/* eslint-disable camelcase */
+const test = require('brittle')
+const sodium = require('..')
+
+test('crypto_scalarmult_base', function (t) {
+  const keys = keyPair()
+
+  t.not(keys.secretKey, Buffer.alloc(keys.secretKey.length), 'secret key not blank')
+  t.not(keys.publicKey, Buffer.alloc(keys.publicKey.length), 'public key not blank')
+})
+
+test('crypto_scalarmult', function (t) {
+  const peer1 = keyPair()
+  const peer2 = keyPair()
+
+  t.not(peer1.secretKey, peer2.secretKey, 'diff secret keys')
+  t.not(peer1.publicKey, peer2.publicKey, 'diff public keys')
+
+  const shared1 = Buffer.alloc(sodium.crypto_scalarmult_BYTES)
+  const shared2 = Buffer.alloc(sodium.crypto_scalarmult_BYTES)
+
+  sodium.crypto_scalarmult(shared1, peer1.secretKey, peer2.publicKey)
+  sodium.crypto_scalarmult(shared2, peer2.secretKey, peer1.publicKey)
+
+  t.alike(shared1, shared2, 'same shared secret')
+})
+
+function keyPair () {
+  const secretKey = Buffer.alloc(sodium.crypto_scalarmult_SCALARBYTES)
+  sodium.randombytes_buf(secretKey)
+
+  const publicKey = Buffer.alloc(sodium.crypto_scalarmult_BYTES)
+  sodium.crypto_scalarmult_base(publicKey, secretKey)
+
+  return {
+    publicKey,
+    secretKey
+  }
+}

test/crypto_secretbox.js

@@ -0,0 +1,72 @@
+/* eslint-disable camelcase */
+const test = require('brittle')
+const sodium = require('..')
+
+test('crypto_secretbox_easy', function (t) {
+  const message = Buffer.from('Hej, Verden!')
+  const output = Buffer.alloc(message.length + sodium.crypto_secretbox_MACBYTES)
+
+  const key = Buffer.alloc(sodium.crypto_secretbox_KEYBYTES)
+  sodium.randombytes_buf(key)
+
+  const nonce = Buffer.alloc(sodium.crypto_secretbox_NONCEBYTES)
+  sodium.randombytes_buf(nonce)
+
+  t.exception.all(function () {
+    sodium.crypto_secretbox_easy(Buffer.alloc(0), message, nonce, key)
+  }, 'throws if output is too small')
+
+  t.exception.all(function () {
+    sodium.crypto_secretbox_easy(Buffer.alloc(message.length), message, nonce, key)
+  }, 'throws if output is too small')
+
+  sodium.crypto_secretbox_easy(output, message, nonce, key)
+  t.not(output, Buffer.alloc(output.length))
+
+  const result = Buffer.alloc(output.length - sodium.crypto_secretbox_MACBYTES)
+  t.absent(sodium.crypto_secretbox_open_easy(result, output, Buffer.alloc(sodium.crypto_secretbox_NONCEBYTES), key), 'could not decrypt')
+  t.ok(sodium.crypto_secretbox_open_easy(result, output, nonce, key), 'could decrypt')
+
+  t.alike(result, message, 'decrypted message is correct')
+})
+
+test('crypto_secretbox_easy overwrite buffer', function (t) {
+  const output = Buffer.alloc(Buffer.byteLength('Hej, Verden!') + sodium.crypto_secretbox_MACBYTES)
+  output.write('Hej, Verden!', sodium.crypto_secretbox_MACBYTES)
+
+  const key = Buffer.alloc(sodium.crypto_secretbox_KEYBYTES)
+  sodium.randombytes_buf(key)
+
+  const nonce = Buffer.alloc(sodium.crypto_secretbox_NONCEBYTES)
+  sodium.randombytes_buf(nonce)
+
+  sodium.crypto_secretbox_easy(output, output.slice(sodium.crypto_secretbox_MACBYTES), nonce, key)
+  t.not(output, Buffer.alloc(output.length))
+
+  t.ok(sodium.crypto_secretbox_open_easy(output.slice(sodium.crypto_secretbox_MACBYTES), output, nonce, key), 'could decrypt')
+  t.alike(output.slice(sodium.crypto_secretbox_MACBYTES), Buffer.from('Hej, Verden!'), 'decrypted message is correct')
+})
+
+test('crypto_secretbox_detached', function (t) {
+  const message = Buffer.from('Hej, Verden!')
+  const output = Buffer.alloc(message.length)
+  const mac = Buffer.alloc(sodium.crypto_secretbox_MACBYTES)
+
+  const key = Buffer.alloc(sodium.crypto_secretbox_KEYBYTES)
+  sodium.randombytes_buf(key)
+
+  const nonce = Buffer.alloc(sodium.crypto_secretbox_NONCEBYTES)
+  sodium.randombytes_buf(nonce)
+
+  sodium.crypto_secretbox_detached(output, mac, message, nonce, key)
+
+  t.not(mac, Buffer.alloc(mac.length), 'mac not blank')
+  t.not(output, Buffer.alloc(output.length), 'output not blank')
+
+  const result = Buffer.alloc(output.length)
+
+  t.absent(sodium.crypto_secretbox_open_detached(result, output, mac, nonce, Buffer.alloc(key.length)), 'could not decrypt')
+  t.ok(sodium.crypto_secretbox_open_detached(result, output, mac, nonce, key), 'could decrypt')
+
+  t.alike(result, message, 'decrypted message is correct')
+})

test/crypto_secretstream.js

@@ -0,0 +1,148 @@
+/* eslint-disable camelcase */
+const test = require('brittle')
+const sodium = require('..')
+
+test('constants', function (t) {
+  t.alike(typeof sodium.crypto_secretstream_xchacha20poly1305_ABYTES, 'number', 'crypto_secretstream_xchacha20poly1305_ABYTES is number')
+  t.alike(typeof sodium.crypto_secretstream_xchacha20poly1305_HEADERBYTES, 'number', 'crypto_secretstream_xchacha20poly1305_HEADERBYTES is number')
+  t.alike(typeof sodium.crypto_secretstream_xchacha20poly1305_KEYBYTES, 'number', 'crypto_secretstream_xchacha20poly1305_KEYBYTES is number')
+  t.alike(typeof sodium.crypto_secretstream_xchacha20poly1305_MESSAGEBYTES_MAX, 'bigint', 'crypto_secretstream_xchacha20poly1305_MESSAGEBYTES_MAX is number')
+
+  t.ok(typeof sodium.crypto_secretstream_xchacha20poly1305_TAG_MESSAGE === 'number', 'crypto_secretstream_xchacha20poly1305_TAG_MESSAGE is Buffer')
+  t.ok(typeof sodium.crypto_secretstream_xchacha20poly1305_TAG_PUSH === 'number', 'crypto_secretstream_xchacha20poly1305_TAG_PUSH is Buffer')
+  t.ok(typeof sodium.crypto_secretstream_xchacha20poly1305_TAG_REKEY === 'number', 'crypto_secretstream_xchacha20poly1305_TAG_REKEY is Buffer')
+  t.ok(typeof sodium.crypto_secretstream_xchacha20poly1305_TAG_FINAL === 'number', 'crypto_secretstream_xchacha20poly1305_TAG_FINAL is Buffer')
+})
+
+test.skip('crypto_secretstream', function (t) {
+  const state = Buffer.alloc(sodium.crypto_secretstream_xchacha20poly1305_STATEBYTES)
+
+  const header = Buffer.alloc(sodium.crypto_secretstream_xchacha20poly1305_HEADERBYTES)
+  const ad = Buffer.alloc(Math.floor(Math.random() * 100))
+  sodium.randombytes_buf(ad)
+
+  const m1 = Buffer.alloc(Math.floor(Math.random() * 1000))
+  sodium.randombytes_buf(m1)
+
+  const m2 = Buffer.alloc(Math.floor(Math.random() * 1000))
+  sodium.randombytes_buf(m2)
+
+  const m3 = Buffer.alloc(Math.floor(Math.random() * 1000))
+  sodium.randombytes_buf(m3)
+
+  const m4 = Buffer.alloc(Math.floor(Math.random() * 1000))
+  sodium.randombytes_buf(m4)
+
+  const m1_ = Buffer.from(m1)
+  const m2_ = Buffer.from(m2)
+  const m3_ = Buffer.from(m3)
+  const m4_ = Buffer.from(m4)
+
+  const c1 = Buffer.alloc(m1.length + sodium.crypto_secretstream_xchacha20poly1305_ABYTES)
+  const c2 = Buffer.alloc(m2.length + sodium.crypto_secretstream_xchacha20poly1305_ABYTES)
+  const c3 = Buffer.alloc(m3.length + sodium.crypto_secretstream_xchacha20poly1305_ABYTES)
+  const c4 = Buffer.alloc(m4.length + sodium.crypto_secretstream_xchacha20poly1305_ABYTES)
+
+  const key = Buffer.alloc(sodium.crypto_secretstream_xchacha20poly1305_KEYBYTES)
+  let ret
+  const tag = Buffer.alloc(sodium.crypto_secretstream_xchacha20poly1305_TAGBYTES, 0xdb)
+
+  sodium.crypto_secretstream_xchacha20poly1305_keygen(key)
+
+  sodium.crypto_secretstream_xchacha20poly1305_init_push(state, header, key)
+  t.unlike(header.toString('hex'), '000000000000000000000000000000000000000000000000')
+  ret = sodium.crypto_secretstream_xchacha20poly1305_push(state, c1, m1, null, sodium.crypto_secretstream_xchacha20poly1305_TAG_MESSAGE)
+  t.alike(ret, m1.length + sodium.crypto_secretstream_xchacha20poly1305_ABYTES)
+  ret = sodium.crypto_secretstream_xchacha20poly1305_push(state, c2, m2, ad.slice(0, 0), sodium.crypto_secretstream_xchacha20poly1305_TAG_MESSAGE)
+  t.alike(ret, m2.length + sodium.crypto_secretstream_xchacha20poly1305_ABYTES)
+  ret = sodium.crypto_secretstream_xchacha20poly1305_push(state, c3, m3, ad, sodium.crypto_secretstream_xchacha20poly1305_TAG_MESSAGE)
+  t.alike(ret, m3.length + sodium.crypto_secretstream_xchacha20poly1305_ABYTES)
+  ret = sodium.crypto_secretstream_xchacha20poly1305_push(state, c4, m4, null, sodium.crypto_secretstream_xchacha20poly1305_TAG_FINAL)
+  t.alike(ret, m4.length + sodium.crypto_secretstream_xchacha20poly1305_ABYTES)
+
+  sodium.crypto_secretstream_xchacha20poly1305_init_pull(state, header, key)
+  m1.fill(0)
+  tag.fill(0xdb)
+  ret = sodium.crypto_secretstream_xchacha20poly1305_pull(state, m1, tag, c1, null)
+  t.alike(ret, c1.length - sodium.crypto_secretstream_xchacha20poly1305_ABYTES)
+  t.alike(tag[0], sodium.crypto_secretstream_xchacha20poly1305_TAG_MESSAGE)
+  t.ok(m1.equals(m1_))
+
+  m2.fill(0)
+  tag.fill(0xdb)
+  ret = sodium.crypto_secretstream_xchacha20poly1305_pull(state, m2, tag, c2, null)
+  t.alike(ret, c2.length - sodium.crypto_secretstream_xchacha20poly1305_ABYTES)
+  t.alike(tag[0], sodium.crypto_secretstream_xchacha20poly1305_TAG_MESSAGE)
+  t.ok(m2.equals(m2_))
+
+  if (ad.length > 0) {
+    t.exception.all(function () {
+      sodium.crypto_secretstream_xchacha20poly1305_pull(state, m3, tag, c3, null)
+    })
+  }
+
+  m3.fill(0)
+  tag.fill(0xdb)
+  ret = sodium.crypto_secretstream_xchacha20poly1305_pull(state, m3, tag, c3, ad)
+  t.alike(ret, c3.length - sodium.crypto_secretstream_xchacha20poly1305_ABYTES)
+  t.alike(tag[0], sodium.crypto_secretstream_xchacha20poly1305_TAG_MESSAGE)
+  t.ok(m3.equals(m3_))
+
+  m4.fill(0)
+  tag.fill(0xdb)
+  ret = sodium.crypto_secretstream_xchacha20poly1305_pull(state, m4, tag, c4, null)
+  t.alike(ret, c4.length - sodium.crypto_secretstream_xchacha20poly1305_ABYTES)
+  t.alike(tag[0], sodium.crypto_secretstream_xchacha20poly1305_TAG_FINAL)
+  t.ok(m4.equals(m4_))
+
+  t.exception.all(function () {
+    sodium.crypto_secretstream_xchacha20poly1305_pull(state, m4, tag, c4, null)
+  }, 'previous with FINAL tag')
+
+  t.exception.all(function () {
+    sodium.crypto_secretstream_xchacha20poly1305_pull(state, m2, tag, c2, null)
+  }, 'previous with without tag')
+
+  t.exception.all(function () {
+    sodium.crypto_secretstream_xchacha20poly1305_pull(state, m2, tag, c2.slice(0, Math.random() * sodium.crypto_secretstream_xchacha20poly1305_ABYTES | 0), null) // fixme
+  }, 'short ciphertext')
+
+  t.exception.all(function () {
+    sodium.crypto_secretstream_xchacha20poly1305_pull(state, m2, tag, c2.slice(0, sodium.crypto_secretstream_xchacha20poly1305_ABYTES), null)
+  }, 'empty ciphertext')
+
+  /* without explicit rekeying */
+
+  sodium.crypto_secretstream_xchacha20poly1305_init_push(state, header, key)
+  sodium.crypto_secretstream_xchacha20poly1305_push(state, c1, m1, null, sodium.crypto_secretstream_xchacha20poly1305_TAG_REKEY)
+  sodium.crypto_secretstream_xchacha20poly1305_push(state, c2, m2, null, sodium.crypto_secretstream_xchacha20poly1305_TAG_MESSAGE)
+
+  sodium.crypto_secretstream_xchacha20poly1305_init_pull(state, header, key)
+  tag.fill(0xdb)
+  sodium.crypto_secretstream_xchacha20poly1305_pull(state, m1, tag, c1, null)
+  t.alike(tag[0], sodium.crypto_secretstream_xchacha20poly1305_TAG_REKEY)
+  tag.fill(0xdb)
+  sodium.crypto_secretstream_xchacha20poly1305_pull(state, m2, tag, c2, null)
+  t.alike(tag[0], sodium.crypto_secretstream_xchacha20poly1305_TAG_MESSAGE)
+
+  /* with explicit rekeying */
+
+  sodium.crypto_secretstream_xchacha20poly1305_init_push(state, header, key)
+  sodium.crypto_secretstream_xchacha20poly1305_push(state, c1, m1, null, sodium.crypto_secretstream_xchacha20poly1305_TAG_MESSAGE)
+  sodium.crypto_secretstream_xchacha20poly1305_rekey(state)
+  sodium.crypto_secretstream_xchacha20poly1305_push(state, c2, m2, null, sodium.crypto_secretstream_xchacha20poly1305_TAG_MESSAGE)
+
+  sodium.crypto_secretstream_xchacha20poly1305_init_pull(state, header, key)
+  tag.fill(0xdb)
+  sodium.crypto_secretstream_xchacha20poly1305_pull(state, m1, tag, c1, null)
+  t.alike(tag[0], sodium.crypto_secretstream_xchacha20poly1305_TAG_MESSAGE)
+
+  t.exception.all(function () {
+    sodium.crypto_secretstream_xchacha20poly1305_pull(state, m2, tag, c2, null)
+  })
+
+  sodium.crypto_secretstream_xchacha20poly1305_rekey(state)
+  tag.fill(0xdb)
+  sodium.crypto_secretstream_xchacha20poly1305_pull(state, m2, tag, c2, null)
+  t.alike(tag[0], sodium.crypto_secretstream_xchacha20poly1305_TAG_MESSAGE)
+})

test/crypto_shorthash.js

@@ -0,0 +1,214 @@
+/* eslint-disable camelcase */
+const test = require('brittle')
+const sodium = require('..')
+
+const vectors = [ // generated from https://github.com/jedisct1/siphash-js/blob/master/test/index.js
+  ['aON1dHrq90SbG8Hx', 'v7LyiwuCrB7EgAibPve6Yg2gLmggxE6j7ocR37EudrH_P9XX2rQK', [147, 73, 50, 63, 71, 98, 203, 42]],
+  ['YOT4AG5F7ONRW5na', '4Ks1pPO_2wGYR-gfJShqUO-FirA9c5cF4oKwvStp2Ix5hHUg2klPofVJ8TZoBdFfgTh8', [138, 27, 129, 27, 185, 163, 160, 153]],
+  ['63UlqXfSckA3Dv8S', 'bMQudI8yVdDx5ScGQCMQy4K_QXYCq1w1eC', [6, 78, 44, 167, 186, 29, 113, 244]],
+  ['P3hpmZEuwfDO_uZ-', 'Wh8yRitk__n4MsETCTRFrB4bjWRtPjUZVLPnywlvv5nTMA2C71', [241, 171, 151, 44, 166, 163, 156, 234]],
+  ['d9oTrpd-a_Na4b6w', 'f-NT', [182, 147, 203, 88, 65, 57, 119, 203]],
+  ['fe88HBnyyEiuIJ8G', 'KSWP9sFkhSdGsha0Fmd5raCf_eA5gnV1', [218, 10, 3, 10, 16, 50, 241, 229]],
+  ['o6LxtnACG0RGQ3z-', 'k8zMl', [16, 158, 19, 145, 214, 142, 177, 55]],
+  ['AHGkoQQ6xdf90MD9', 'HC9bz8XUYkan0jxYSaj0vP-cs324Y4PrnAXutwKBgIko5oOOOViJSjLD2m8WenV8HdF78J', [157, 186, 255, 238, 165, 21, 187, 163]],
+  ['TlVmpfbZMFkeuENo', '5is', [166, 36, 114, 58, 101, 106, 79, 30]],
+  ['iBLscVfsPM1xrSFJ', 'J-aH-', [14, 91, 64, 158, 190, 247, 72, 26]],
+  ['hUehErdKolgd0erH', 'DhS94w_07-vaAXo_msv8Fk57slIHnuxy3iv4Yymh5k', [45, 207, 192, 24, 158, 243, 93, 68]],
+  ['B-aq-09jmO0z_PUD', '1p2IMG4A1NMyWsfUS02VK8fOEhn', [161, 224, 65, 80, 91, 44, 131, 177]],
+  ['fyNYE8SMJvYrDgao', 'HWCtQs19BHZcH', [122, 114, 254, 14, 124, 226, 23, 173]],
+  ['5vQHK_yJlJez45N5', '8YJwfpxwbH9h-N27i-uTUUK2Vt', [142, 216, 87, 77, 16, 17, 8, 199]],
+  ['q7Oo0g9DDjLJ_pyV', 'jQFAHtrTUDaCaSIcis5h2j4fyOJpJGfdZBMTO5GOAAB4AwZtutDenNZ', [230, 111, 182, 25, 233, 231, 14, 141]],
+  ['IUle6P8g2uyX_8ms', 'hOKGFGrsAux60CQmbOjQd-EzQBKUjLbDUhhtsKt3ZY4', [64, 247, 102, 236, 211, 145, 4, 152]],
+  ['-bZa23onpInwqNWG', 'DNbtZuulH9', [247, 2, 142, 172, 208, 100, 60, 127]],
+  ['1xjmLXTmVJwse8M-', 'j1_Hh', [197, 81, 6, 184, 57, 173, 83, 126]],
+  ['Ey7hygEVd8RxZdtX', 'GNRDNJDu00L', [137, 196, 184, 4, 146, 27, 188, 191]],
+  ['weTzikz4EGUbhSgC', 'g1SXT7b4Zz6q2tQykV1tZS', [105, 39, 69, 220, 198, 210, 96, 240]],
+  ['OjSaplYVoQPDXG7S', 'QCk4v3D9s6R471p0xa--Vv00vzIaMpJ1S48Qnz6uzhmtke99HmWcY9vapyjdWVS', [183, 208, 142, 194, 95, 247, 239, 122]],
+  ['4g2ZB-SA-HlqJT7D', 'N5Ht5QIk6KziyTE4-q5eNkqGdQgg8fxkr4w-ARqRgdaZd3XpbePGGb4jPFo3', [127, 245, 152, 248, 155, 148, 212, 127]],
+  ['CXOF2EKm5CDPYpNC', 'xkY0T8bPF4JFq6Mu0K5YtFp7KfOni', [124, 172, 24, 66, 198, 236, 234, 226]],
+  ['ID4UzFBiztXW--b0', 'qyICNMPaivgDmX', [46, 95, 156, 18, 186, 88, 188, 122]],
+  ['TaGesMDe_0UNGzcp', 'nlNv', [103, 245, 211, 70, 87, 104, 0, 17]],
+  ['lMDS8Vcs-8aCV9hJ', 'KW44Qk', [69, 47, 130, 50, 196, 101, 206, 62]],
+  ['BmQCaB-c777zvFsc', 'o-tr2zQVbtrmkH4rCCAXoXFt8KwAWo4YFpK', [123, 168, 235, 94, 113, 233, 190, 213]],
+  ['OQlCpJOLmsouyme1', 'aRk9nyHhXlad-TpIemD2VTRiHVlzSysY7uKof9ApR5DejFjT-Bmdzl_z', [89, 201, 222, 238, 50, 99, 249, 215]],
+  ['t6Wl3FKDhr9FAMzz', 'BLu17bk_iQtpGv1N4A', [80, 7, 121, 129, 115, 84, 153, 140]],
+  ['XU5km7La0ujNVvlV', 'OUEAH4yu6SXQ4I8zjn07NuB_AudmoewXc39HqgN8rc', [220, 180, 100, 142, 210, 176, 72, 108]],
+  ['zDKBNpM2cdf0HwkK', 'dEqgpqTRc', [221, 42, 57, 242, 197, 147, 27, 81]],
+  ['yZGrKEShM0z7Vvns', 'sgUtgxRQpMl_o6iuZqomKhJxaSBCD_NBHa2lqX3cWfq8byu', [211, 179, 114, 59, 129, 223, 168, 65]],
+  ['4-wM8GXg1a7hyerE', 'djJ3-b2', [157, 165, 254, 119, 109, 239, 114, 115]],
+  ['jD3Y4PgdExHU2JaY', 'uQC59dKTf3unOGu-Lg9IgmC8MTSg-BcH-', [249, 179, 174, 181, 118, 232, 40, 255]],
+  ['dZhRW8ubIZovieQg', 'GCbxph1HICSKgHLafk_8TRjGdZa7jnJOu', [73, 24, 76, 226, 201, 86, 43, 223]],
+  ['P9hudzT3H87QzC9E', 'Vfeo26fUa3sLk6BNM', [31, 150, 174, 223, 224, 214, 127, 107]],
+  ['ocfdt04Np8Bs5hn9', 'dQiaUqksbXOWmBPt2kBn0ARiVkr3r4mBwypQq', [203, 253, 155, 6, 148, 92, 81, 212]],
+  ['UuQ68x330IdojsLI', 'pb6-OdmVdQ1gLP8E1szvlf0T6aOQp-EQHPW-tAKQ8Xj', [23, 158, 11, 26, 216, 251, 17, 229]],
+  ['T4ec6Q68QKiuIARL', 'BeLjFIoODtDg5vLMLBN1Sae', [250, 103, 43, 65, 80, 229, 66, 116]],
+  ['xmZBUpwjJwnXZAp6', 'WS2F3Nzg2s7TqVIygm8W1tQyNc6DFy', [186, 206, 177, 250, 182, 139, 138, 19]],
+  ['4qB6m0d_ryzb3w6q', '2Nr1sd1phWDB9gnuYOLUsjvX9jxntScWyRlX3Nj_xs8MV10LGgSgfRBKVGnO', [97, 101, 207, 79, 55, 205, 142, 253]],
+  ['SmVONU3BEODnkbdM', 'G4WIU3UrBqbN6_nccFrIyx_TdXx-W80YzWw', [33, 147, 134, 20, 73, 169, 2, 107]],
+  ['zseM9_-0y7B9URxM', 'us8B1DmHxOF10ue3jm2VfoJ250h364zRd2U8VIm2Lbkf3OWprSUpLF4ePjdj5aS', [80, 47, 98, 151, 139, 175, 78, 166]],
+  ['WY_sEWLFAybHSwX4', 'vLJyXNkHCYGHWsvhXcU2sWYzgFYlWF7A_ZjFg8kJ4wwuJ', [132, 67, 168, 204, 90, 10, 169, 235]],
+  ['maWrEov1bBjSq2Zn', 'sCP9zPakZ_wZ8hcQu-G6nN', [136, 204, 107, 221, 66, 198, 31, 201]],
+  ['tXInZHO-x4AWxKTp', 'JQUM_O-E4-YI6dhxo', [36, 245, 166, 183, 31, 222, 192, 96]],
+  ['OqaQt_b1hvU-atC3', 'X7Ou8cKo17xHlq_5gwM56GZrCSJBReeA60pDj2hUer6', [169, 107, 175, 79, 116, 24, 153, 93]],
+  ['nHdnXHGmGknC8FfC', 'cRupnAESNmU', [18, 200, 205, 81, 7, 32, 8, 213]],
+  ['59n9lAJdrxIz3joe', 'WBPr', [75, 153, 152, 122, 242, 233, 165, 255]],
+  ['q-PAAgkE9z2xed85', 'AFOQD_H7MO3q3cxLa7TOUd89kpH03SpjpqmzY6AX16-uZFYcZZBb8D', [45, 4, 101, 133, 174, 99, 42, 4]],
+  ['tBzStZxn2ZqlQfBf', 'nZdIaI7-bdqqh6aU7w4HfDCByX-x4_3q9Jf', [253, 49, 199, 224, 50, 253, 75, 144]],
+  ['rH8Nn75LyYC0hjVG', 'IrDPpL-dkoh6VTy7pOtKKdAD9dLwUnE-', [76, 2, 97, 127, 190, 74, 74, 5]],
+  ['F-pI7AhpS1V-48eT', 'Ao7hV41P08Zq4C1szyOVN7K1iWW8z', [121, 76, 85, 13, 162, 105, 174, 114]],
+  ['Khje_RmXXmJ3CAb1', 'TvMx3ISTfIQ', [237, 102, 92, 182, 242, 45, 27, 178]],
+  ['G1KRzk-KMqCk-kbD', 'imHZWdBz01lGR3m1zuO74berNn68uFZR3kcoWEaMhVjJ1g', [165, 3, 34, 126, 199, 101, 203, 184]],
+  ['wJhnTtBLcy_1rZay', 'qbZ6oK0a4eWf2ud1sEnKLeguOmYsbG4aOTdlMdrf', [226, 169, 14, 147, 180, 88, 90, 132]],
+  ['vVl9fhjkwASu2WXe', '8-CjQylw18IKWgAL2mMxo', [30, 193, 202, 34, 74, 172, 72, 42]],
+  ['m2Qx2Dtbvwv3qjNJ', 'WrIqIIsHqbgm3Qfg03QvaVG9G6fz2zxjnfNZUVuX8XUtjz4LQuj3VZNh', [237, 163, 64, 58, 187, 234, 117, 106]],
+  ['5R1maUgHiPQ0ZoaD', 'SZJ6uMXnMuLll2xOfHcy_DE', [209, 26, 182, 131, 19, 180, 5, 55]],
+  ['dDBufcmObAK1dKYw', 'ayjd0F5mqWsVF0MtUNJYo8S8GhuCsMCnEU6k3H9z0f8', [126, 244, 206, 245, 56, 4, 39, 63]],
+  ['o_YPVOjQ7Xw0G9OD', 'UPF-HW1hJukwdVvhCl7IZJzy7a', [30, 211, 48, 214, 88, 189, 59, 33]],
+  ['oule-vFYlFJfsXU3', '8ORL7DUv28-yVfUw_cJ3imWP-iXrQRmzZRp0jtspwW_qm-rXmc1aBsbvbAut8', [66, 62, 243, 87, 153, 23, 230, 113]],
+  ['kEPlQxhC27GQcJeb', 'wL-dAWvwZapITZZvgW46', [153, 83, 52, 252, 33, 23, 48, 216]],
+  ['GFilE6NpBPWE25uB', 'RzoQCcd5NVeDbd2cx', [144, 101, 221, 104, 142, 244, 87, 216]],
+  ['sENqlFHs0NvkY28u', 'Gm2ojB-BJBdL', [75, 226, 42, 7, 94, 14, 215, 52]],
+  ['mxiOr15qouOEhzHS', 'SChjLg6SXpEb9', [174, 64, 56, 79, 211, 158, 21, 229]],
+  ['pFL_Sbx5RW0fuPHO', 'hdb8HqaxEN99N4V1STTpnR4kr9F-lONwKp2TcOCopBFnDrjITz3jHPM4WKIYyw59US', [108, 66, 228, 165, 111, 142, 78, 201]],
+  ['sMgAXpCtVqeFm14R', 'dNPnh6shnGYEZuN0id', [101, 147, 101, 20, 126, 33, 84, 255]],
+  ['nTu9mRGqYc1SOPk7', 'ogL8VEqgoMkh6YNgTzvF4f87wHvmRhzncGPunN2ZJ5p3qUqZeJ3', [253, 16, 23, 144, 34, 207, 28, 82]],
+  ['d5jDH8Ppk82zj_vd', '5sfq9Q_0P0H', [197, 245, 4, 89, 247, 26, 240, 77]],
+  ['bEEUPVwdHlYwYL6o', 'AGoiVTE9foWm2MZqsn3dfS1XQiQW0QJwLXi6oXR2L9nMnPCPG_oF', [186, 203, 217, 87, 4, 177, 20, 242]],
+  ['JbKhWuTfRMWb4hFD', 'NTNhYIahQ769TsCDwFyfOYZ8x6np58jg9hMAHFH-BMv7hBwESi596D4aDuyPabFGbqcG', [60, 79, 166, 97, 146, 213, 223, 59]],
+  ['hvCtw1q_GJUBFW_X', 'uL5zgFM9WUTyO25dzVCmSVOxbpV70ZPurKK-CPUAmP', [127, 4, 233, 105, 7, 183, 123, 61]],
+  ['hWxh0P6EXlm4yYKA', 'NUgrOoTOfqaB6JDZj', [96, 255, 249, 149, 117, 178, 189, 183]],
+  ['TLHDMak8qeH3ABaV', 'HW-7PPunyMCinXt8QjQUuJUzZZQs1-T9ADR-6y', [46, 167, 85, 216, 34, 240, 131, 74]],
+  ['uE4OfzzqHVDH8lbd', '8KCUyGtkcG-T8gA3lpplC13LsnFZ', [18, 9, 33, 96, 47, 132, 243, 76]],
+  ['ocjA0Quge9vdCDbH', 'tLlU03I9CDBbP1Pnl6KM3MW34TNzuuZYv0u-uU-l7RtFF0OmGoySyg_yc7vWswGkz', [124, 174, 227, 126, 197, 91, 232, 11]],
+  ['TDVmxGeyDULfxyrz', 'A57Y0_L6K4TTzQx1-Yr1E6fVAZi31RyipeK0Q4uqwXXfRLo4tz2a5PSqN3-bdQ4f2', [53, 212, 137, 227, 12, 85, 50, 251]],
+  ['8OhqW3sA7s1vqEDr', 'jlFquRWvL07TyLjW9ZNk81gxkvs4u1WLkNhOQVLOjFjw3iecMjun5Yk0xcruo', [147, 130, 134, 67, 235, 29, 115, 34]],
+  ['9kPcY6rfhPzSzEGn', 'nS1kAxpsghzJJXiCzhNycDk2_EJ_yIT97fV2kxXTtfZ9p0', [178, 109, 176, 237, 184, 79, 209, 89]],
+  ['AJJ_yoEL8WyEtA1U', 'vFNErhfCk1TZiTFMA6J8D', [26, 63, 142, 247, 30, 50, 167, 102]],
+  ['PBr4drRAJTaWv5Um', '5quc8Vd2rHVNk2NoDxk3TL', [150, 113, 209, 153, 101, 74, 42, 2]],
+  ['MnODoRJI2FgZrvLs', 'gqJ_7HnrfiqYkenyvhe53SB1vTBgMiMB3kxF5', [205, 11, 216, 157, 130, 39, 60, 161]],
+  ['iSxQPJpp_s0ws-4b', 'K-J', [46, 78, 209, 241, 112, 90, 91, 181]],
+  ['ZMm2tCGDJ04A3I_6', 'gw-wcFYO1G2KEqJagWAic2l2d1FoTVXVT', [22, 60, 166, 216, 76, 146, 36, 22]],
+  ['Hxf6qsSIV6blPdB1', 'GTWOerCQdUMkL6it6hEEPKBcOe_9f_B618ivjeM3BKfjzRQ8rvcGjUUJnsljerca6', [122, 74, 100, 36, 79, 173, 4, 91]],
+  ['U5gXdMrRYUdxuDjK', 'siy9CxY2BbhazTqBWwFrtBLh', [79, 92, 248, 231, 189, 215, 27, 51]],
+  ['YJiK_B-TENJsVnd_', 'Ohyz8XU06XWewcgTX-PffLVdatU3UFl6CYe', [22, 147, 91, 237, 188, 184, 70, 223]],
+  ['J7wVNfLdkCCtndH5', '1Vw163YqXwP8cPXIy5dSkcIoClBep7gWb0qGJzHM8h_hzk2GFtZyLKk', [123, 221, 220, 145, 75, 144, 103, 74]],
+  ['elId3b7ZyOg6HVif', 'N89kQR7VMUgF4DyWhpTo_ZW2lERbNqFa1RdXjaUctO1FdevDAZaA', [39, 244, 17, 57, 240, 193, 34, 112]],
+  ['ydBueYO29jaUsEVU', 'HMcnfvYjjz8Uf8bUhxXlAYHcyO7x5NHE_gc3bcWSMWJD2JdryrUBBdYj1', [252, 15, 32, 244, 143, 126, 130, 34]],
+  ['fVprx-PzTSx6CUcX', 'Q', [253, 22, 240, 135, 62, 55, 219, 1]],
+  ['9ORMwecQjlob9aTT', '2cpq2XTWPk5sVLlN4OR5y6X_rTRFNUURgrwnWDg76u927cYud6PS-17UTgd3TO9g3K4', [15, 124, 108, 136, 56, 254, 85, 250]],
+  ['-V3BEGXuTWtFOMv4', '8l6qcZXfG9iSywi1IgwJ_PkZh0Bg2iR1cbGps_sWPdKXbIvDDX-3IeTTg', [111, 8, 18, 99, 6, 72, 56, 232]],
+  ['Cbvx4_KdboiNHs6P', 'nzUo0UnqKn05adw5g0jtBN703bUgb8UxywfC93I7KN', [85, 17, 95, 157, 77, 25, 206, 45]],
+  ['SDPzfgeqkvmi62JH', 'Z6kJuDD-8FSz1VwOuPeoSJ6X-4hpib563UjYxtFcB4SvhQr-Hstg5OhMi4iZZ', [153, 35, 172, 58, 141, 180, 95, 97]],
+  ['mBJlhP6D3M2raEjD', 'ogtg66jr2KLCFO2RvodOXw0mt4XS6BOnLhBI_gDV0', [85, 231, 198, 97, 240, 108, 230, 150]],
+  ['Sz-mxKc7KGM7SDaf', 'ecQ-7-3VddOdMSeKUbZE1t6Aa67pYGXjQeOckq1l50GkvfomFr', [18, 241, 24, 133, 142, 74, 218, 178]],
+  ['_5ck5scojT4oyJEq', '43oLkeixGHShTMUhtI', [35, 190, 107, 33, 2, 165, 11, 34]],
+  ['48ulC82W4qv49InN', '8HQyT55TtmGahy6w', [2, 70, 28, 124, 164, 101, 100, 185]],
+  ['-exgd5coAHqBu3ga', 'vRfqYthbUNh', [48, 188, 141, 96, 138, 114, 132, 143]],
+  ['hJEBugObOX06pplH', 'oYYZ-v', [153, 112, 89, 5, 46, 138, 209, 254]],
+  ['eSDsC63oTtVfi_F7', 'BVmyPas409CmRHiRRiTPjJL87KgJefuDK6lEh5isghLl7l3a4Xmxa', [21, 198, 30, 251, 173, 36, 165, 82]],
+  ['KZtUPWMUr469RWL8', 'F9K6TUd6j7Dm25rAS7cqOKDtSnnxj0hYKVTMFQ6CfA5218gPeZo', [203, 233, 183, 39, 57, 54, 60, 173]],
+  ['0TeBxGk-V7RPSZML', 'kmL1fKqHwAoxI1b_ap8I9fGZMmcx3gIMiglxLLPFWOoDNUGe', [193, 7, 13, 148, 71, 231, 166, 135]],
+  ['PWYY82PNqwshPHiv', 'Ya4LyHqxIxK8GaND9FIzqugleh-QELha_ntbRJixl6hZI5m3RfdrcntjiPJ', [27, 177, 64, 55, 129, 165, 132, 108]],
+  ['PtCub86vGwNj1tcv', 'qR08eqAeNrrUYDl18C-wttqMDk', [66, 134, 247, 100, 38, 3, 7, 125]],
+  ['3eqQxzhNdv2kJqy5', '0wxAd9NT-Z8xFzomFwgMqMVbaUg', [36, 191, 165, 105, 211, 159, 155, 13]],
+  ['MgEjpTNPFFwes6Sm', '7SCVGNJYZhtnbiLZAE5TrsL5K1X', [208, 79, 201, 49, 48, 3, 227, 199]],
+  ['vSofRAYxXUU1qjhl', 'HATE-YsASxySRkK5aJR4yV0mxx1YAuEgM5tUqyJDc7cLL', [61, 205, 183, 24, 68, 135, 7, 74]],
+  ['kIUe96sZ6LV464T_', 'rjwrCOQAzLFbIM_3M7KfDQ1A6r3nkebk-dgqORG0Uy-n89_apYNLVTbdr3yuzXKOTfkRh', [83, 214, 143, 126, 145, 218, 225, 186]],
+  ['8wao85IcCu1mC-Rc', 'AdVncBX6wkLXqMQPol3tNDPd5HJ', [161, 223, 243, 36, 219, 75, 215, 63]],
+  ['NRVNeO5wysG3DRuU', 'Mr8vhiVPo5GpI6sho4R09k8D-vFgcghF3-kF', [246, 119, 57, 225, 254, 189, 182, 180]],
+  ['VHJZOECxfyxVyufk', 'TMB3UMDEIs-vj_9aDBNDzT6HkHcwQQhr4EnG6A1AD9JkHENVAAQnS7s', [117, 85, 69, 116, 56, 27, 123, 62]],
+  ['TUfnTd3pmaJzSdD4', 'VoRGCJgaGEhPSGRl0EPKWIzN7CRpD49CiyjC7y_4xRpppMNlR4v', [3, 116, 140, 4, 113, 208, 78, 186]],
+  ['-I1YgwmWxehyB6kv', 'IplQLxea3JGywQn3XMNWrqVbE', [137, 251, 109, 201, 11, 101, 132, 97]],
+  ['4ic5nM5lbfMOXDRR', 'TfVtpOoAQt1IxL0qJtAQoCJJThyxncIagOvKSpxjD7RDmh7YQBHWPkuv5lpSzpN', [192, 203, 84, 99, 85, 184, 122, 44]],
+  ['NYOq6hIu2C-aZPhE', 'QQa0EWIHXqbrkq3nBeXt6yEj12z', [40, 199, 197, 21, 82, 53, 100, 58]],
+  ['nC93tajnfzk6bMtM', 'p9gbEB4nMHXDqmOC413rI4Z', [200, 140, 102, 143, 89, 170, 219, 32]],
+  ['ZCCkYIbGOzXa5GRO', '2f9VGQeb4AtW6SwPjAGxxjyHNw3-MZj2BfxttNLxM0Tv_rpXO8TUH4YASb', [0, 174, 100, 194, 149, 35, 81, 12]],
+  ['oapO2W6hces4Pfkc', 'oEyf5eqpM-N7LBp3C5vejvO7M87OzT4MHdwJz', [140, 195, 199, 20, 207, 60, 104, 240]],
+  ['__daPiDXrnPpS7eO', '1_tnhApr6nZbWIEPja0jAJ6LbTvD6oAEvPyrLYQ', [255, 244, 76, 119, 124, 124, 146, 214]],
+  ['5iIExqPt5W-ZpudD', 'jNbLiDmQdN5X7HEOfgnAi5A7s1pGXwP41hX1Z', [149, 68, 125, 203, 174, 150, 66, 31]],
+  ['gD_J-R8tOb977BtL', 'f7A81Qbh8gQhfRpOmtz5-ZJqBxiQJ6myBhGfqK7BVaGBL_W2MvfB', [106, 38, 140, 196, 141, 190, 232, 110]],
+  ['ZxHO4JJ8p45jTUXU', 'fs4Oy8mPZS6919SZ7gDyKIILDkXnPt8SsXkfBd-Mnm4wO6alw-veQD9', [209, 53, 104, 100, 102, 136, 84, 134]],
+  ['2bVzT0moojGNQgIX', 'nuyb-AgYY-rsmhtdav3LC7meSPy1dCosjSw0YAvgP', [1, 201, 247, 25, 104, 147, 148, 252]],
+  ['FicyyNT0BRua05i9', 'TG4leSS_mcrZ_L68GKFdxc4-McFCCtdG7QpbPu_MolD5luE6n3dKlPzb9MvfvkiZKi', [136, 150, 66, 224, 178, 235, 114, 238]],
+  ['g5Qaf7mQAIxuHR0O', 'A6u5gtb1yMSiGlWVt3exYsRS', [169, 20, 115, 32, 43, 71, 21, 193]],
+  ['aOACI6GP6u4WFyxp', '1eEx55L3E9MZga7l1WzpnKfI', [177, 26, 15, 27, 217, 101, 69, 195]],
+  ['Rr2jLg-asIQrlaRJ', 'rgALEbs', [163, 103, 250, 90, 4, 46, 69, 32]],
+  ['p8qW0oYzj5zi55s5', 'V1ZCoK73ifwcnzPjQEN7Q79MtZCskcpqiE3gfbqYPYRmy-q0lPxopkZZp2lNWKkpL_q5z', [29, 121, 240, 174, 51, 38, 238, 123]],
+  ['wA0cNUJOhIMpiopE', 'U2RE2L2zZysyOTcsj5_JosVDaMRtUxkRWVCeBH0AeodMvYGBcHizhxc2QM89', [40, 230, 148, 164, 7, 168, 3, 46]],
+  ['zBCN1w4ypWCEfpwC', 'VRcTwONsyRQIy2ymVniMmry', [184, 177, 56, 54, 152, 189, 120, 222]],
+  ['i8cumEDwOxSXT0gL', 'ifKav', [53, 190, 193, 228, 179, 41, 246, 171]],
+  ['g3EswbaCSNMsegzm', 'rTFnEuEDlwBB0Dw_q3-FUSaTCEjWe0pOPZDIWD35Us08Qa-nulc57YjDoGphUfBamq', [157, 64, 119, 179, 60, 147, 48, 17]],
+  ['iYsckWoQTk5ap8YO', 'wIyTqa43-_GiZlHJ8UXcD_tnqKikH5DZUWxdQ1xjYMyzCr2JvKKRBm8BbcDl_Q8p', [96, 237, 170, 183, 48, 45, 116, 106]],
+  ['Iyk5MoAjoWq4n8bG', 'IV2N5MC6kvk95ykEzb3jj0A7Sv0jjif45SR1avc0bRWot2aW', [99, 23, 149, 225, 242, 204, 47, 7]],
+  ['NfzdRXCegRRsHHYj', '5uLBPbyFQqiv', [136, 45, 110, 192, 36, 204, 171, 218]],
+  ['YiJTXegVwaNDtlpl', 'DbwKoF3CI5kd2JRKwfyuLpeGd6sFhqI0t43C2ph', [188, 126, 147, 191, 9, 114, 107, 60]],
+  ['ZuUlFM-yEzZ9XHKj', 'errecd71', [158, 231, 84, 47, 149, 227, 92, 111]],
+  ['EtEXELa6V_NSjvEh', 'yrTjrRuW8mJc3utw2JUH7iIW-J5vF3t9GC1-ZvRmO8UXNsG8-I3Iqgtinzoabqqbs1yvR', [186, 52, 144, 215, 104, 246, 174, 71]],
+  ['q2uA_VwMnaBtAgTx', 'uJOymuDgBBS9Ec56JRGmKYsMHoGLCKA5wzwhtYf-g8-IT7UsAX1JHFGSV0EF', [176, 65, 188, 134, 212, 6, 97, 186]],
+  ['4RmqR10QiIZDDKNO', 'oWY0Aj2CDCWuEFhdNHq2RFcGJD0sSRxK5K', [114, 28, 238, 228, 122, 40, 82, 13]],
+  ['a9DfUPCLyQ_yrNIa', '5G-6AVe7CBJl-NuuUN_7TN', [95, 206, 124, 185, 194, 207, 227, 111]],
+  ['8oB5yG87C2v5j0_4', '1S-aiUNRJ2c', [123, 42, 242, 79, 90, 36, 208, 81]],
+  ['ZA2ZT22NXwD_UvTM', 'UpV3pLYniWPm-PnWUAbBNeO4V-zuuw6IZQ1ZprLsC_LjGdSJP7rZCnoPz', [189, 209, 102, 128, 246, 141, 212, 109]],
+  ['ycz6aiuQFGKxZVsM', 'fBuJp4_A_hiq--4uBhxjXfT3nRaYEJ8azW2_FKooXdSVRv2Y03VoWzPzG', [241, 127, 162, 199, 73, 10, 75, 24]],
+  ['eAmt0pClMyL8Sk69', 'JFzXjfJhEMUCYEDrBKRM9OFFK0PSX', [176, 167, 43, 60, 16, 69, 194, 2]],
+  ['CTFnU2nwy9s1_kBj', 'hEHqR0idFTzbvG193aLYj6y2DFPi2UKQut_A--43PdN1XF', [6, 84, 156, 248, 125, 55, 230, 121]],
+  ['CAhom0f872WEDXP6', 'dmX', [203, 98, 175, 172, 19, 3, 244, 177]],
+  ['aON1dHrq90SbG8Hx', 'v7LyiwuCrB7EgAibPve6Yg2gLmggxE6j7ocR37EudrH_P9XX2rQK', [147, 73, 50, 63, 71, 98, 203, 42]]
+]
+
+test('crypto_shorthash', function (t) {
+  const out = Buffer.alloc(sodium.crypto_shorthash_BYTES)
+  const inp = Buffer.from('Hej, Verden!')
+  const key = Buffer.alloc(sodium.crypto_shorthash_KEYBYTES)
+
+  t.exception.all(function () {
+    sodium.crypto_shorthash(Buffer.alloc(0), inp)
+  }, 'throws on bad input')
+
+  sodium.crypto_shorthash(out, inp, key)
+
+  const result = '6a29984f782e684e'
+  t.alike(out.toString('hex'), result, 'hashed the string')
+})
+
+test('constants', function (assert) {
+  assert.ok(sodium.crypto_shorthash_PRIMITIVE)
+  assert.ok(sodium.crypto_shorthash_KEYBYTES > 0)
+  assert.ok(sodium.crypto_shorthash_BYTES > 0)
+  assert.end()
+})
+
+test('crypto_shorthash fixtures', function (assert) {
+  run(assert)
+})
+
+test('crypto_shorthash fixtures (wasm)', function (assert) {
+  if (!sodium.crypto_shorthash_WASM_SUPPORTED) {
+    assert.pass('wasm not supported')
+    assert.end()
+    return
+  }
+
+  assert.ok(sodium.crypto_shorthash_WASM_LOADED)
+  run(assert)
+})
+
+function run (assert) {
+  for (let i = 0; i < vectors.length; i++) {
+    const v = vectors[i]
+    const key = Buffer.from(v[0])
+    const message = Buffer.from(v[1])
+    const expected = Buffer.from(v[2])
+    const out = Buffer.alloc(sodium.crypto_shorthash_BYTES)
+
+    sodium.crypto_shorthash(out, message, key)
+    if (Buffer.compare(out, expected) !== 0) {
+      assert.fail('Failed on fixture #' + i)
+      assert.end()
+      return
+    }
+  }
+
+  assert.pass('Passed all fixtures')
+  assert.end()
+}

test/crypto_sign.js

@@ -0,0 +1,334 @@
+/* eslint-disable camelcase */
+const test = require('brittle')
+const sodium = require('..')
+const fixtures = require('./fixtures/crypto_sign.json')
+
+test('crypto_sign_ed25519_sk_to_pk', function (t) {
+  const pk = Buffer.alloc(sodium.crypto_sign_PUBLICKEYBYTES)
+  const pke = Buffer.alloc(sodium.crypto_sign_PUBLICKEYBYTES)
+  const sk = Buffer.alloc(sodium.crypto_sign_SECRETKEYBYTES)
+
+  sodium.crypto_sign_keypair(pk, sk)
+  sodium.crypto_sign_ed25519_sk_to_pk(pke, sk)
+
+  t.ok(pk.equals(pke))
+})
+
+test('crypto_sign_seed_keypair', function (t) {
+  const pk = Buffer.alloc(sodium.crypto_sign_PUBLICKEYBYTES)
+  const sk = Buffer.alloc(sodium.crypto_sign_SECRETKEYBYTES)
+  const seed = Buffer.alloc(sodium.crypto_sign_SEEDBYTES, 'lo')
+
+  t.exception.all(function () {
+    sodium.crypto_sign_seed_keypair()
+  }, 'should validate input')
+
+  t.exception.all(function () {
+    sodium.crypto_sign_seed_keypair(Buffer.alloc(0), Buffer.alloc(0), Buffer.alloc(0))
+  }, 'should validate input length')
+
+  sodium.crypto_sign_seed_keypair(pk, sk, seed)
+
+  const eSk = '6c6f6c6f6c6f6c6f6c6f6c6f6c6f6c6f6c6f6c6f6c6f6c6f6c6f6c6f6c6f6c6f41eb5b4dba29b19e391d9a4d1a4a879b27958ff3734e10cfbf1f46d68f4d3038'
+  const ePk = '41eb5b4dba29b19e391d9a4d1a4a879b27958ff3734e10cfbf1f46d68f4d3038'
+
+  t.alike(pk.toString('hex'), ePk, 'seeded public key')
+  t.alike(sk.toString('hex'), eSk, 'seeded secret key')
+})
+
+test('crypto_sign_keypair', function (t) {
+  const pk = Buffer.alloc(sodium.crypto_sign_PUBLICKEYBYTES)
+  const sk = Buffer.alloc(sodium.crypto_sign_SECRETKEYBYTES)
+
+  sodium.crypto_sign_keypair(pk, sk)
+
+  t.not(pk, Buffer.alloc(pk.length), 'made public key')
+  t.not(sk, Buffer.alloc(sk.length), 'made secret key')
+
+  t.exception.all(function () {
+    sodium.crypto_sign_keypair()
+  }, 'should validate input')
+
+  t.exception.all(function () {
+    sodium.crypto_sign_keypair(Buffer.alloc(0), Buffer.alloc(0))
+  }, 'should validate input length')
+})
+
+test('crypto_sign', function (t) {
+  const pk = Buffer.alloc(sodium.crypto_sign_PUBLICKEYBYTES)
+  const sk = Buffer.alloc(sodium.crypto_sign_SECRETKEYBYTES)
+
+  sodium.crypto_sign_keypair(pk, sk)
+
+  const message = Buffer.from('Hello, World!')
+  const signedMessage = Buffer.alloc(message.length + sodium.crypto_sign_BYTES)
+
+  sodium.crypto_sign(signedMessage, message, sk)
+
+  t.alike(signedMessage.slice(-message.length), message, 'contains message')
+
+  const output = Buffer.alloc(message.length)
+
+  t.absent(sodium.crypto_sign_open(output, Buffer.alloc(signedMessage.length), pk), 'was not signed')
+  t.ok(sodium.crypto_sign_open(output, signedMessage, pk), 'was signed')
+
+  t.alike(output, message, 'same message')
+})
+
+test('crypto_sign_detached', function (t) {
+  const pk = Buffer.alloc(sodium.crypto_sign_PUBLICKEYBYTES)
+  const sk = Buffer.alloc(sodium.crypto_sign_SECRETKEYBYTES)
+
+  sodium.crypto_sign_keypair(pk, sk)
+
+  const message = Buffer.from('Hello, World!')
+  const signature = Buffer.alloc(sodium.crypto_sign_BYTES)
+
+  sodium.crypto_sign_detached(signature, message, sk)
+
+  t.absent(sodium.crypto_sign_verify_detached(Buffer.concat([Buffer.alloc(1), signature]), message, pk), 'was not signed')
+  t.ok(sodium.crypto_sign_verify_detached(signature, message, pk), 'was signed')
+})
+
+test('crypto_sign_open fixtures', function (t) {
+  for (let i = 0; i < fixtures.length; i++) {
+    const publicKey = new Uint8Array(fixtures[i][1])
+    const message = new Uint8Array(fixtures[i][3])
+    const signed = new Uint8Array([].concat(fixtures[i][2], fixtures[i][3]))
+
+    if (!sodium.crypto_sign_open(message, signed, publicKey)) {
+      t.fail('Failed on fixture #' + i)
+      t.end()
+      return
+    }
+  }
+
+  t.pass('Passed all fixtures')
+  t.end()
+})
+
+test('crypto_sign fixtures', function (t) {
+  const fixtures = require('./fixtures/crypto_sign.json')
+
+  for (let i = 0; i < fixtures.length; i++) {
+    const secretKey = new Uint8Array([].concat(fixtures[i][0], fixtures[i][1]))
+    const message = new Uint8Array(fixtures[i][3])
+
+    const expected = new Uint8Array([].concat(fixtures[i][2], fixtures[i][3]))
+    const actual = new Uint8Array(sodium.crypto_sign_BYTES + message.length)
+
+    sodium.crypto_sign(actual, message, secretKey)
+
+    if (Buffer.compare(actual, expected) !== 0) {
+      t.fail('Failed on fixture #' + i)
+      t.end()
+      return
+    }
+  }
+
+  t.pass('Passed all fixtures')
+  t.end()
+})
+
+test('crypto_sign_verify_detached fixtures', function (t) {
+  const fixtures = require('./fixtures/crypto_sign.json')
+
+  for (let i = 0; i < fixtures.length; i++) {
+    const publicKey = new Uint8Array(fixtures[i][1])
+    const message = new Uint8Array(fixtures[i][3])
+    const signature = new Uint8Array(fixtures[i][2])
+
+    if (!sodium.crypto_sign_verify_detached(signature, message, publicKey)) {
+      t.fail('Failed on fixture #' + i)
+      t.end()
+      return
+    }
+  }
+
+  t.pass('Passed all fixtures')
+  t.end()
+})
+
+test('crypto_sign_detached fixtures', function (t) {
+  const fixtures = require('./fixtures/crypto_sign.json')
+
+  for (let i = 0; i < fixtures.length; i++) {
+    const secretKey = new Uint8Array([].concat(fixtures[i][0], fixtures[i][1]))
+    const message = new Uint8Array(fixtures[i][3])
+
+    const expected = new Uint8Array(fixtures[i][2])
+    const actual = new Uint8Array(sodium.crypto_sign_BYTES)
+
+    sodium.crypto_sign_detached(actual, message, secretKey)
+
+    if (Buffer.compare(actual, expected) !== 0) {
+      t.fail('Failed on fixture #' + i)
+      t.end()
+      return
+    }
+  }
+
+  t.pass('Passed all fixtures')
+  t.end()
+})
+
+/* eslint-disable camelcase */
+test('libsodium', function (t) {
+  const sig = new Uint8Array(sodium.crypto_sign_BYTES)
+  const sm = new Uint8Array(1024 + sodium.crypto_sign_BYTES)
+  const skpk = new Uint8Array(sodium.crypto_sign_SECRETKEYBYTES)
+  const pk = new Uint8Array(sodium.crypto_sign_PUBLICKEYBYTES)
+  const sk = new Uint8Array(sodium.crypto_sign_SECRETKEYBYTES)
+
+  let smlen
+  let i
+  let test
+
+  sig.fill(0)
+
+  let pass = true
+  for (i = 0; i < fixtures.length; i++) {
+    test = parseTest(fixtures[i])
+
+    skpk.set(test.sk)
+    skpk.set(test.pk, sodium.crypto_sign_SEEDBYTES)
+
+    smlen = sodium.crypto_sign_BYTES + test.m.byteLength
+
+    sodium.crypto_sign(sm.subarray(0, test.m.byteLength + sodium.crypto_sign_BYTES), test.m, skpk)
+    pass &= Buffer.compare(test.sig, sm.subarray(0, 64)) === 0
+    pass &= sodium.crypto_sign_open(test.m, sm.subarray(0, smlen), test.pk)
+
+    sodium.crypto_sign_detached(sig, test.m, skpk)
+
+    pass &= sig.byteLength !== 0 && sig.byteLength <= sodium.crypto_sign_BYTES
+    pass &= Buffer.compare(test.sig, sig) === 0
+    pass &= sodium.crypto_sign_verify_detached(sig, test.m.subarray(0, i), test.pk)
+
+    if (!pass) t.fail('failed on fixture #' + i)
+  }
+  t.pass('passed all fixtures')
+
+  for (let j = 1; j < 8; j++) {
+    sig[63] ^= (j << 5)
+
+    t.absent(sodium.crypto_sign_verify_detached(sig, test.m.subarray(0, i), test.pk))
+
+    sig[63] ^= (j << 5)
+  }
+
+  pk.fill(0)
+  t.absent(sodium.crypto_sign_verify_detached(sig, test.m.subarray(0, i), pk))
+
+  sig.subarray(0, 32).fill(0xff)
+  sig[0] = 0xdb
+
+  t.absent(sodium.crypto_sign_verify_detached(sig, test.m.subarray(0, i), pk))
+  sodium.crypto_sign_detached(sig, test.m.subarray(0, i), skpk)
+
+  hex2bin(pk, '3eee494fb9eac773144e34b0c755affaf33ea782c0722e5ea8b150e61209ab36')
+  t.absent(sodium.crypto_sign_verify_detached(sig, test.m.subarray(0, i), pk))
+
+  hex2bin(pk, '0200000000000000000000000000000000000000000000000000000000000000')
+  t.absent(sodium.crypto_sign_verify_detached(sig, test.m.subarray(0, i), pk))
+
+  hex2bin(pk, '0500000000000000000000000000000000000000000000000000000000000000')
+  t.absent(sodium.crypto_sign_verify_detached(sig, test.m.subarray(0, i), pk))
+
+  const keypair_seed = new Uint8Array([
+    0x42, 0x11, 0x51, 0xa4, 0x59, 0xfa, 0xea, 0xde, 0x3d, 0x24, 0x71,
+    0x15, 0xf9, 0x4a, 0xed, 0xae, 0x42, 0x31, 0x81, 0x24, 0x09, 0x5a,
+    0xfa, 0xbe, 0x4d, 0x14, 0x51, 0xa5, 0x59, 0xfa, 0xed, 0xee
+  ])
+
+  t.execution(() => sodium.crypto_sign_seed_keypair(pk, sk, keypair_seed))
+  t.execution(() => sodium.crypto_sign_keypair(pk, sk))
+
+  t.ok(sodium.crypto_sign_BYTES > 0)
+  t.ok(sodium.crypto_sign_SEEDBYTES > 0)
+  t.ok(sodium.crypto_sign_PUBLICKEYBYTES > 0)
+  t.ok(sodium.crypto_sign_SECRETKEYBYTES > 0)
+  t.is(sodium.crypto_sign_BYTES, 64)
+  t.is(sodium.crypto_sign_SEEDBYTES, 32)
+  t.is(sodium.crypto_sign_PUBLICKEYBYTES, 32)
+  t.is(sodium.crypto_sign_SECRETKEYBYTES, 64)
+
+  t.end()
+})
+
+test('ed25519 convert', function (t) {
+  const keypair_seed = new Uint8Array([
+    0x42, 0x11, 0x51, 0xa4, 0x59, 0xfa, 0xea, 0xde, 0x3d, 0x24, 0x71,
+    0x15, 0xf9, 0x4a, 0xed, 0xae, 0x42, 0x31, 0x81, 0x24, 0x09, 0x5a,
+    0xfa, 0xbe, 0x4d, 0x14, 0x51, 0xa5, 0x59, 0xfa, 0xed, 0xee
+  ])
+
+  const ed25519_pk = new Uint8Array(sodium.crypto_sign_PUBLICKEYBYTES)
+  const ed25519_skpk = new Uint8Array(sodium.crypto_sign_SECRETKEYBYTES)
+  const curve25519_pk = new Uint8Array(sodium.crypto_scalarmult_BYTES)
+  const curve25519_pk2 = new Uint8Array(sodium.crypto_scalarmult_BYTES)
+  const curve25519_sk = new Uint8Array(sodium.crypto_scalarmult_BYTES)
+
+  t.ok(sodium.crypto_sign_SEEDBYTES <= sodium.crypto_hash_sha512_BYTES)
+
+  sodium.crypto_sign_seed_keypair(ed25519_pk, ed25519_skpk, keypair_seed)
+  sodium.crypto_sign_ed25519_pk_to_curve25519(curve25519_pk, ed25519_pk)
+  sodium.crypto_sign_ed25519_sk_to_curve25519(curve25519_sk, ed25519_skpk)
+
+  const expected_pk = new Uint8Array([
+    0xf1, 0x81, 0x4f, 0x0e, 0x8f, 0xf1, 0x04, 0x3d, 0x8a, 0x44, 0xd2, 0x5b,
+    0xab, 0xff, 0x3c, 0xed, 0xca, 0xe6, 0xc2, 0x2c, 0x3e, 0xda, 0xa4, 0x8f,
+    0x85, 0x7a, 0xe7, 0x0d, 0xe2, 0xba, 0xae, 0x50
+  ])
+
+  const expected_sk = new Uint8Array([
+    0x80, 0x52, 0x03, 0x03, 0x76, 0xd4, 0x71, 0x12, 0xbe, 0x7f, 0x73, 0xed,
+    0x7a, 0x01, 0x92, 0x93, 0xdd, 0x12, 0xad, 0x91, 0x0b, 0x65, 0x44, 0x55,
+    0x79, 0x8b, 0x46, 0x67, 0xd7, 0x3d, 0xe1, 0x66
+  ])
+
+  t.alike(curve25519_pk, expected_pk)
+  t.alike(curve25519_sk, expected_sk)
+
+  for (let i = 0; i < 500; i++) {
+    sodium.crypto_sign_keypair(ed25519_pk, ed25519_skpk)
+    sodium.crypto_sign_ed25519_pk_to_curve25519(curve25519_pk, ed25519_pk)
+
+    sodium.crypto_sign_ed25519_sk_to_curve25519(curve25519_sk, ed25519_skpk)
+    sodium.crypto_scalarmult_base(curve25519_pk2, curve25519_sk)
+    if (Buffer.compare(curve25519_pk, curve25519_pk2) !== 0) t.fail()
+  }
+  t.pass('passed all cases')
+
+  ed25519_pk.fill(0)
+  t.exception(() => {
+    sodium.crypto_sign_ed25519_pk_to_curve25519(curve25519_pk, ed25519_pk)
+  })
+
+  t.exception(() => {
+    ed25519_pk[0] = 2
+    sodium.crypto_sign_ed25519_pk_to_curve25519(curve25519_pk, ed25519_pk)
+  })
+
+  t.exception(() => {
+    ed25519_pk[0] = 5
+    sodium.crypto_sign_ed25519_pk_to_curve25519(curve25519_pk, ed25519_pk)
+  })
+
+  t.end()
+})
+
+function parseTest (t) {
+  return {
+    sk: new Uint8Array(t[0]),
+    pk: new Uint8Array(t[1]),
+    sig: new Uint8Array(t[2]),
+    m: new Uint8Array(t[3])
+  }
+}
+
+function hex2bin (buf, hex) {
+  for (let i = 0; i < hex.length / 2; i++) {
+    buf[i] = Number('0x' + hex.slice(2 * i, 2 * i + 1))
+  }
+}

test/crypto_stream.js

@@ -0,0 +1,213 @@
+/* eslint-disable camelcase */
+const test = require('brittle')
+const sodium = require('..')
+
+test('crypto_stream', function (t) {
+  const buf = Buffer.alloc(50)
+  const nonce = random(sodium.crypto_stream_NONCEBYTES)
+  const key = random(sodium.crypto_stream_KEYBYTES)
+
+  sodium.crypto_stream(buf, nonce, key)
+
+  t.not(buf, Buffer.alloc(50), 'contains noise now')
+  const copy = Buffer.from(buf.toString('hex'), 'hex')
+
+  sodium.crypto_stream(buf, nonce, key)
+  t.alike(buf, copy, 'predictable from nonce, key')
+})
+
+test('crypto_stream_xor', function (t) {
+  const message = Buffer.from('Hello, World!')
+  const nonce = random(sodium.crypto_stream_NONCEBYTES)
+  const key = random(sodium.crypto_stream_KEYBYTES)
+
+  sodium.crypto_stream_xor(message, message, nonce, key)
+
+  t.not(message, Buffer.from('Hello, World!'), 'encrypted')
+
+  sodium.crypto_stream_xor(message, message, nonce, key)
+
+  t.alike(message, Buffer.from('Hello, World!'), 'decrypted')
+})
+
+test.skip('crypto_stream_xor state', function (t) {
+  const message = Buffer.from('Hello, world!')
+  const nonce = random(sodium.crypto_stream_NONCEBYTES)
+  const key = random(sodium.crypto_stream_KEYBYTES)
+
+  const out = Buffer.alloc(message.length)
+
+  const state = Buffer.alloc(sodium.crypto_stream_xor_STATEBYTES)
+  sodium.crypto_stream_xor_init(state, nonce, key)
+
+  for (let i = 0; i < message.length; i++) {
+    sodium.crypto_stream_xor_update(state, out.slice(i, i + 1), message.slice(i, i + 1))
+  }
+
+  sodium.crypto_stream_xor_final(state)
+  sodium.crypto_stream_xor(out, out, nonce, key)
+  t.alike(out, message, 'decrypted')
+})
+
+test.skip('crypto_stream_xor state with empty buffers', function (t) {
+  const message = Buffer.from('Hello, world!')
+  const nonce = random(sodium.crypto_stream_NONCEBYTES)
+  const key = random(sodium.crypto_stream_KEYBYTES)
+
+  const out = Buffer.alloc(message.length)
+
+  const state = Buffer.alloc(sodium.crypto_stream_xor_STATEBYTES)
+  sodium.crypto_stream_xor_init(state, nonce, key)
+
+  sodium.crypto_stream_xor_update(state, Buffer.alloc(0), Buffer.alloc(0))
+
+  for (let i = 0; i < message.length; i++) {
+    sodium.crypto_stream_xor_update(state, out.slice(i, i + 1), message.slice(i, i + 1))
+    sodium.crypto_stream_xor_update(state, Buffer.alloc(0), Buffer.alloc(0))
+  }
+
+  sodium.crypto_stream_xor_final(state)
+  sodium.crypto_stream_xor(out, out, nonce, key)
+  t.alike(out, message, 'decrypted')
+})
+
+test.skip('crypto_stream_xor state long stream', function (t) {
+  const nonce = random(sodium.crypto_stream_NONCEBYTES)
+  const key = random(sodium.crypto_stream_KEYBYTES)
+
+  const encState = Buffer.alloc(sodium.crypto_stream_xor_STATEBYTES)
+  const decState = Buffer.alloc(sodium.crypto_stream_xor_STATEBYTES)
+
+  sodium.crypto_stream_xor_init(encState, nonce, key)
+  sodium.crypto_stream_xor_init(decState, nonce, key)
+  const plain = []
+  const encrypted = []
+  const decrypted = []
+
+  for (let i = 0; i < 1000; i++) {
+    const next = random(61)
+    plain.push(next)
+
+    const enc = Buffer.alloc(61)
+    sodium.crypto_stream_xor_update(encState, enc, next)
+    encrypted.push(enc)
+
+    const dec = Buffer.alloc(61)
+    sodium.crypto_stream_xor_update(decState, dec, enc)
+    decrypted.push(dec)
+  }
+
+  const enc2 = Buffer.alloc(1000 * 61)
+  sodium.crypto_stream_xor(enc2, Buffer.concat(plain), nonce, key)
+
+  t.alike(Buffer.concat(encrypted), enc2, 'same as encrypting all at once')
+  t.alike(Buffer.concat(decrypted), Buffer.concat(plain), 'decrypts')
+})
+
+test.skip('crypto_stream_xor state long stream (random chunks)', function (t) {
+  const nonce = random(sodium.crypto_stream_NONCEBYTES)
+  const key = random(sodium.crypto_stream_KEYBYTES)
+
+  const encState = Buffer.alloc(sodium.crypto_stream_xor_STATEBYTES)
+  const decState = Buffer.alloc(sodium.crypto_stream_xor_STATEBYTES)
+
+  sodium.crypto_stream_xor_init(encState, nonce, key)
+  sodium.crypto_stream_xor_init(decState, nonce, key)
+  const plain = []
+  const encrypted = []
+  const decrypted = []
+
+  for (let i = 0; i < 10000; i++) {
+    const len = Math.floor(Math.random() * 256)
+    const next = random(len)
+    plain.push(next)
+
+    const enc = Buffer.alloc(len)
+    sodium.crypto_stream_xor_update(encState, enc, next)
+    encrypted.push(enc)
+
+    const dec = Buffer.alloc(len)
+    sodium.crypto_stream_xor_update(decState, dec, enc)
+    decrypted.push(dec)
+  }
+
+  const enc2 = Buffer.alloc(Buffer.concat(plain).length)
+  sodium.crypto_stream_xor(enc2, Buffer.concat(plain), nonce, key)
+
+  t.alike(Buffer.concat(encrypted), enc2, 'same as encrypting all at once')
+  t.alike(Buffer.concat(decrypted), Buffer.concat(plain), 'decrypts')
+})
+
+test.skip('crypto_stream_xor state long stream (random chunks) with empty buffers', function (t) {
+  const nonce = random(sodium.crypto_stream_NONCEBYTES)
+  const key = random(sodium.crypto_stream_KEYBYTES)
+
+  const encState = Buffer.alloc(sodium.crypto_stream_xor_STATEBYTES)
+  const decState = Buffer.alloc(sodium.crypto_stream_xor_STATEBYTES)
+
+  sodium.crypto_stream_xor_init(encState, nonce, key)
+  sodium.crypto_stream_xor_init(decState, nonce, key)
+  const plain = []
+  const encrypted = []
+  const decrypted = []
+
+  for (let i = 0; i < 10000; i++) {
+    const len = Math.floor(Math.random() * 256)
+    const next = random(len)
+    plain.push(next)
+
+    sodium.crypto_stream_xor_update(encState, Buffer.alloc(0), Buffer.alloc(0))
+
+    const enc = Buffer.alloc(len)
+    sodium.crypto_stream_xor_update(encState, enc, next)
+    encrypted.push(enc)
+
+    const dec = Buffer.alloc(len)
+    sodium.crypto_stream_xor_update(decState, dec, enc)
+    decrypted.push(dec)
+    sodium.crypto_stream_xor_update(decState, Buffer.alloc(0), Buffer.alloc(0))
+  }
+
+  const enc2 = Buffer.alloc(Buffer.concat(plain).length)
+  sodium.crypto_stream_xor(enc2, Buffer.concat(plain), nonce, key)
+
+  t.alike(Buffer.concat(encrypted), enc2, 'same as encrypting all at once')
+  t.alike(Buffer.concat(decrypted), Buffer.concat(plain), 'decrypts')
+})
+
+test.skip('crypto_stream_xor state after GC', function (t) {
+  const message = Buffer.from('Hello, world!')
+  let nonce = random(sodium.crypto_stream_NONCEBYTES)
+  let key = random(sodium.crypto_stream_KEYBYTES)
+
+  const out = Buffer.alloc(message.length)
+
+  const state = Buffer.alloc(sodium.crypto_stream_xor_STATEBYTES)
+  sodium.crypto_stream_xor_init(state, nonce, key)
+
+  const nonceCopy = Buffer.from(nonce.toString('hex'), 'hex')
+  const keyCopy = Buffer.from(key.toString('hex'), 'hex')
+  nonce = null
+  key = null
+
+  forceGC()
+
+  for (let i = 0; i < message.length; i++) {
+    sodium.crypto_stream_xor_update(state, out.slice(i, i + 1), message.slice(i, i + 1))
+  }
+
+  sodium.crypto_stream_xor_final(state)
+  sodium.crypto_stream_xor(out, out, nonceCopy, keyCopy)
+  t.alike(out, message, 'decrypted')
+})
+
+function random (n) {
+  const buf = Buffer.alloc(n)
+  sodium.randombytes_buf(buf)
+  return buf
+}
+
+function forceGC () {
+  require('v8').setFlagsFromString('--expose-gc')
+  require('vm').runInNewContext('gc')()
+}

test/crypto_stream_chacha20.js

@@ -0,0 +1,284 @@
+/* eslint-disable camelcase */
+const test = require('brittle')
+const sodium = require('..')
+
+const tests = [
+  ['0000000000000000000000000000000000000000000000000000000000000000', '0000000000000000', '76b8e0ada0f13d90405d6ae55386bd28bdd219b8a08ded1aa836efcc8b770dc7da41597c5157488d7724e03fb8d84a376a43b8f41518a11cc387b669b2ee65869f07e7be5551387a98ba977c732d080dcb0f29a048e3656912c6533e32ee7aed29b721769ce64e43d57133b074d839d531ed1f28510afb45ace10a1f4b794d6f2d09a0e663266ce1ae7ed1081968a0758e718e997bd362c6b0c34634a9a0b35d'],
+  ['0000000000000000000000000000000000000000000000000000000000000001', '0000000000000000', '4540f05a9f1fb296d7736e7b208e3c96eb4fe1834688d2604f450952ed432d41bbe2a0b6ea7566d2a5d1e7e20d42af2c53d792b1c43fea817e9ad275ae5469633aeb5224ecf849929b9d828db1ced4dd832025e8018b8160b82284f3c949aa5a8eca00bbb4a73bdad192b5c42f73f2fd4e273644c8b36125a64addeb006c13a096d68b9ff7b57e7090f880392effd5b297a83bbaf2fbe8cf5d4618965e3dc776'],
+  ['0000000000000000000000000000000000000000000000000000000000000000', '0000000000000001', 'de9cba7bf3d69ef5e786dc63973f653a0b49e015adbff7134fcb7df137821031e85a050278a7084527214f73efc7fa5b5277062eb7a0433e445f41e31afab757283547e3d3d30ee0371c1e6025ff4c91b794a291cf7568d48ff84b37329e2730b12738a072a2b2c7169e326fe4893a7b2421bb910b79599a7ce4fbaee86be427c5ee0e8225eb6f48231fd504939d59eac8bd106cc138779b893c54da8758f62a'],
+  ['0000000000000000000000000000000000000000000000000000000000000000', '0100000000000000', 'ef3fdfd6c61578fbf5cf35bd3dd33b8009631634d21e42ac33960bd138e50d32111e4caf237ee53ca8ad6426194a88545ddc497a0b466e7d6bbdb0041b2f586b5305e5e44aff19b235936144675efbe4409eb7e8e5f1430f5f5836aeb49bb5328b017c4b9dc11f8a03863fa803dc71d5726b2b6b31aa32708afe5af1d6b690584d58792b271e5fdb92c486051c48b79a4d48a109bb2d0477956e74c25e93c3c2'],
+  ['000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f', '0001020304050607', 'f798a189f195e66982105ffb640bb7757f579da31602fc93ec01ac56f85ac3c134a4547b733b46413042c9440049176905d3be59ea1c53f15916155c2be8241a38008b9a26bc35941e2444177c8ade6689de95264986d95889fb60e84629c9bd9a5acb1cc118be563eb9b3a4a472f82e09a7e778492b562ef7130e88dfe031c79db9d4f7c7a899151b9a475032b63fc385245fe054e3dd5a97a5f576fe064025']
+]
+
+const vectors = [
+  'f7010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101',
+  'f798a189040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404',
+  'f798a189f195e6070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707',
+  'f798a189f195e66982100a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a',
+  'f798a189f195e66982105ffb640d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d',
+  'f798a189f195e66982105ffb640bb775101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010',
+  'f798a189f195e66982105ffb640bb7757f579d131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313',
+  'f798a189f195e66982105ffb640bb7757f579da31602161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616',
+  'f798a189f195e66982105ffb640bb7757f579da31602fc93ec191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919',
+  'f798a189f195e66982105ffb640bb7757f579da31602fc93ec01ac561c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c',
+  'f798a189f195e66982105ffb640bb7757f579da31602fc93ec01ac56f85ac31f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f',
+  'f798a189f195e66982105ffb640bb7757f579da31602fc93ec01ac56f85ac3c134a4222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222',
+  'f798a189f195e66982105ffb640bb7757f579da31602fc93ec01ac56f85ac3c134a4547b73252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525',
+  'f798a189f195e66982105ffb640bb7757f579da31602fc93ec01ac56f85ac3c134a4547b733b4641282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828',
+  'f798a189f195e66982105ffb640bb7757f579da31602fc93ec01ac56f85ac3c134a4547b733b46413042c92b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b',
+  'f798a189f195e66982105ffb640bb7757f579da31602fc93ec01ac56f85ac3c134a4547b733b46413042c94400492e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e',
+  'f798a189f195e66982105ffb640bb7757f579da31602fc93ec01ac56f85ac3c134a4547b733b46413042c9440049176905313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131',
+  'f798a189f195e66982105ffb640bb7757f579da31602fc93ec01ac56f85ac3c134a4547b733b46413042c9440049176905d3be59343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434',
+  'f798a189f195e66982105ffb640bb7757f579da31602fc93ec01ac56f85ac3c134a4547b733b46413042c9440049176905d3be59ea1c53373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737',
+  'f798a189f195e66982105ffb640bb7757f579da31602fc93ec01ac56f85ac3c134a4547b733b46413042c9440049176905d3be59ea1c53f159163a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a',
+  'f798a189f195e66982105ffb640bb7757f579da31602fc93ec01ac56f85ac3c134a4547b733b46413042c9440049176905d3be59ea1c53f15916155c2b3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d',
+  'f798a189f195e66982105ffb640bb7757f579da31602fc93ec01ac56f85ac3c134a4547b733b46413042c9440049176905d3be59ea1c53f15916155c2be8241a404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040'
+]
+
+test('constants', function (t) {
+  t.ok(sodium.crypto_stream_chacha20_KEYBYTES > 0)
+  t.ok(sodium.crypto_stream_chacha20_NONCEBYTES > 0)
+  t.ok(sodium.crypto_stream_chacha20_MESSAGEBYTES_MAX > 0)
+})
+
+test('libsodium crypto_stream_chacha20', function (t) {
+  const key = Buffer.alloc(sodium.crypto_stream_chacha20_KEYBYTES)
+  const nonce = Buffer.alloc(sodium.crypto_stream_chacha20_NONCEBYTES)
+
+  const out = Buffer.alloc(160)
+
+  for (let i = 0; i < tests.length; i++) {
+    key.write(tests[i][0], 0, key.byteLength, 'hex')
+    nonce.write(tests[i][1], 0, nonce.byteLength, 'hex')
+    sodium.crypto_stream_chacha20(out, nonce, key)
+    t.alike(out, Buffer.from(tests[i][2], 'hex'))
+    for (let plen = 0; plen < out.byteLength; plen++) {
+      const part = Buffer.alloc(plen)
+      sodium.crypto_stream_chacha20_xor(part, out.subarray(0, plen), nonce, key)
+      if (part.every(b => b === 0) === false) return t.fail()
+    }
+  }
+
+  for (let plen = 1, i = 0; plen < 66; plen += 3, i++) {
+    out.fill(plen & 0xff)
+    sodium.crypto_stream_chacha20(out.subarray(0, plen), nonce, key)
+    if (out.equals(Buffer.from(vectors[i], 'hex')) === false) return t.fail()
+  }
+
+  sodium.randombytes_buf(out)
+  sodium.crypto_stream_chacha20(out, nonce, key)
+  t.alike(out, Buffer.from('f798a189f195e66982105ffb640bb7757f579da31602fc93ec01ac56f85ac3c134a4547b733b46413042c9440049176905d3be59ea1c53f15916155c2be8241a38008b9a26bc35941e2444177c8ade6689de95264986d95889fb60e84629c9bd9a5acb1cc118be563eb9b3a4a472f82e09a7e778492b562ef7130e88dfe031c79db9d4f7c7a899151b9a475032b63fc385245fe054e3dd5a97a5f576fe064025', 'hex'))
+
+  t.execution(() => sodium.crypto_stream_chacha20(out.subarray(0, 0), nonce, key))
+  t.execution(() => sodium.crypto_stream_chacha20_xor(out.subarray(0, 0), Buffer.alloc(0), nonce, key))
+  t.execution(() => sodium.crypto_stream_chacha20_xor(out.subarray(0, 0), Buffer.alloc(0), nonce, key))
+  t.execution(() => sodium.crypto_stream_chacha20_xor_ic(out.subarray(0, 0), Buffer.alloc(0), nonce, 1, key))
+
+  out.fill(0x42)
+  sodium.crypto_stream_chacha20_xor(out, out, nonce, key)
+  t.alike(out, Buffer.from('b5dae3cbb3d7a42bc0521db92649f5373d15dfe15440bed1ae43ee14ba18818376e616393179040372008b06420b552b4791fc1ba85e11b31b54571e69aa66587a42c9d864fe77d65c6606553ec89c24cb9cd7640bc49b1acbb922aa046b8bffd818895e835afc147cfbf1e6e630ba6c4be5a53a0b69146cb5514cca9da27385dffb96b585eadb5759d8051270f47d81c7661da216a19f18d5e7b734bc440267', 'hex'))
+
+  sodium.crypto_stream_chacha20_xor_ic(out, out, nonce, 0, key)
+  t.alike(out, Buffer.from('42424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242', 'hex'))
+
+  sodium.crypto_stream_chacha20_xor_ic(out, out, nonce, 1, key)
+  t.alike(out, Buffer.from('7a42c9d864fe77d65c6606553ec89c24cb9cd7640bc49b1acbb922aa046b8bffd818895e835afc147cfbf1e6e630ba6c4be5a53a0b69146cb5514cca9da27385dffb96b585eadb5759d8051270f47d81c7661da216a19f18d5e7b734bc440267918c466e1428f08745f37a99c77c7f2b1b244bd4162e8b86e4a8bf85358202954ced04b52fef7b3ba787744e715554285ecb0ed6e133c528d69d346abc0ce8b0', 'hex'))
+})
+
+test('crypto_stream_chacha20', function (t) {
+  const buf = Buffer.alloc(50)
+  const nonce = random(sodium.crypto_stream_chacha20_NONCEBYTES)
+  const key = random(sodium.crypto_stream_chacha20_KEYBYTES)
+
+  sodium.crypto_stream_chacha20(buf, nonce, key)
+
+  t.unlike(buf, Buffer.alloc(50), 'contains noise now')
+  const copy = Buffer.from(buf.toString('hex'), 'hex')
+
+  sodium.crypto_stream_chacha20(buf, nonce, key)
+  t.alike(buf, copy, 'predictable from nonce, key')
+
+  t.end()
+})
+
+test.skip('crypto_stream_chacha20_xor state', function (t) {
+  const message = Buffer.from('Hello, world!')
+  const nonce = random(sodium.crypto_stream_chacha20_NONCEBYTES)
+  const key = random(sodium.crypto_stream_chacha20_KEYBYTES)
+
+  const out = Buffer.alloc(message.length)
+
+  const state = Buffer.alloc(sodium.crypto_stream_chacha20_xor_STATEBYTES)
+  sodium.crypto_stream_chacha20_xor_init(state, nonce, key)
+
+  for (let i = 0; i < message.length; i++) {
+    sodium.crypto_stream_chacha20_xor_update(state, out.slice(i, i + 1), message.slice(i, i + 1))
+  }
+
+  sodium.crypto_stream_chacha20_xor_final(state)
+  sodium.crypto_stream_chacha20_xor(out, out, nonce, key)
+  t.alike(out, message, 'decrypted')
+})
+
+test.skip('crypto_stream_chacha20_xor state with empty buffers', function (t) {
+  const message = Buffer.from('Hello, world!')
+  const nonce = random(sodium.crypto_stream_chacha20_NONCEBYTES)
+  const key = random(sodium.crypto_stream_chacha20_KEYBYTES)
+
+  const out = Buffer.alloc(message.length)
+
+  const state = Buffer.alloc(sodium.crypto_stream_chacha20_xor_STATEBYTES)
+  sodium.crypto_stream_chacha20_xor_init(state, nonce, key)
+
+  sodium.crypto_stream_chacha20_xor_update(state, Buffer.alloc(0), Buffer.alloc(0))
+
+  for (let i = 0; i < message.length; i++) {
+    sodium.crypto_stream_chacha20_xor_update(state, out.slice(i, i + 1), message.slice(i, i + 1))
+    sodium.crypto_stream_chacha20_xor_update(state, Buffer.alloc(0), Buffer.alloc(0))
+  }
+
+  sodium.crypto_stream_chacha20_xor_final(state)
+  sodium.crypto_stream_chacha20_xor(out, out, nonce, key)
+  t.alike(out, message, 'decrypted')
+})
+
+test.skip('crypto_stream_chacha20_xor state long stream', function (t) {
+  const nonce = random(sodium.crypto_stream_chacha20_NONCEBYTES)
+  const key = random(sodium.crypto_stream_chacha20_KEYBYTES)
+
+  const encState = Buffer.alloc(sodium.crypto_stream_chacha20_xor_STATEBYTES)
+  const decState = Buffer.alloc(sodium.crypto_stream_chacha20_xor_STATEBYTES)
+
+  sodium.crypto_stream_chacha20_xor_init(encState, nonce, key)
+  sodium.crypto_stream_chacha20_xor_init(decState, nonce, key)
+  const plain = []
+  const encrypted = []
+  const decrypted = []
+
+  for (let i = 0; i < 1000; i++) {
+    const next = random(61)
+    plain.push(next)
+
+    const enc = Buffer.alloc(61)
+    sodium.crypto_stream_chacha20_xor_update(encState, enc, next)
+    encrypted.push(enc)
+
+    const dec = Buffer.alloc(61)
+    sodium.crypto_stream_chacha20_xor_update(decState, dec, enc)
+    decrypted.push(dec)
+  }
+
+  const enc2 = Buffer.alloc(1000 * 61)
+  sodium.crypto_stream_chacha20_xor(enc2, Buffer.concat(plain), nonce, key)
+
+  t.alike(Buffer.concat(encrypted), enc2, 'same as encrypting all at once')
+  t.alike(Buffer.concat(decrypted), Buffer.concat(plain), 'decrypts')
+})
+
+test.skip('crypto_stream_chacha20_xor state long stream (random chunks)', function (t) {
+  const nonce = random(sodium.crypto_stream_chacha20_NONCEBYTES)
+  const key = random(sodium.crypto_stream_chacha20_KEYBYTES)
+
+  const encState = Buffer.alloc(sodium.crypto_stream_chacha20_xor_STATEBYTES)
+  const decState = Buffer.alloc(sodium.crypto_stream_chacha20_xor_STATEBYTES)
+
+  sodium.crypto_stream_chacha20_xor_init(encState, nonce, key)
+  sodium.crypto_stream_chacha20_xor_init(decState, nonce, key)
+  const plain = []
+  const encrypted = []
+  const decrypted = []
+
+  for (let i = 0; i < 10000; i++) {
+    const len = Math.floor(Math.random() * 256)
+    const next = random(len)
+    plain.push(next)
+
+    const enc = Buffer.alloc(len)
+    sodium.crypto_stream_chacha20_xor_update(encState, enc, next)
+    encrypted.push(enc)
+
+    const dec = Buffer.alloc(len)
+    sodium.crypto_stream_chacha20_xor_update(decState, dec, enc)
+    decrypted.push(dec)
+  }
+
+  const enc2 = Buffer.alloc(Buffer.concat(plain).length)
+  sodium.crypto_stream_chacha20_xor(enc2, Buffer.concat(plain), nonce, key)
+
+  t.alike(Buffer.concat(encrypted), enc2, 'same as encrypting all at once')
+  t.alike(Buffer.concat(decrypted), Buffer.concat(plain), 'decrypts')
+})
+
+test.skip('crypto_stream_chacha20_xor state long stream (random chunks) with empty buffers', function (t) {
+  const nonce = random(sodium.crypto_stream_chacha20_NONCEBYTES)
+  const key = random(sodium.crypto_stream_chacha20_KEYBYTES)
+
+  const encState = Buffer.alloc(sodium.crypto_stream_chacha20_xor_STATEBYTES)
+  const decState = Buffer.alloc(sodium.crypto_stream_chacha20_xor_STATEBYTES)
+
+  sodium.crypto_stream_chacha20_xor_init(encState, nonce, key)
+  sodium.crypto_stream_chacha20_xor_init(decState, nonce, key)
+  const plain = []
+  const encrypted = []
+  const decrypted = []
+
+  for (let i = 0; i < 10000; i++) {
+    const len = Math.floor(Math.random() * 256)
+    const next = random(len)
+    plain.push(next)
+
+    sodium.crypto_stream_chacha20_xor_update(encState, Buffer.alloc(0), Buffer.alloc(0))
+
+    const enc = Buffer.alloc(len)
+    sodium.crypto_stream_chacha20_xor_update(encState, enc, next)
+    encrypted.push(enc)
+
+    const dec = Buffer.alloc(len)
+    sodium.crypto_stream_chacha20_xor_update(decState, dec, enc)
+    decrypted.push(dec)
+    sodium.crypto_stream_chacha20_xor_update(decState, Buffer.alloc(0), Buffer.alloc(0))
+  }
+
+  const enc2 = Buffer.alloc(Buffer.concat(plain).length)
+  sodium.crypto_stream_chacha20_xor(enc2, Buffer.concat(plain), nonce, key)
+
+  t.alike(Buffer.concat(encrypted), enc2, 'same as encrypting all at once')
+  t.alike(Buffer.concat(decrypted), Buffer.concat(plain), 'decrypts')
+})
+
+test.skip('crypto_stream_chacha20_xor state after GC', function (t) {
+  const message = Buffer.from('Hello, world!')
+  let nonce = random(sodium.crypto_stream_chacha20_NONCEBYTES)
+  let key = random(sodium.crypto_stream_chacha20_KEYBYTES)
+
+  const out = Buffer.alloc(message.length)
+
+  const state = Buffer.alloc(sodium.crypto_stream_chacha20_xor_STATEBYTES)
+  sodium.crypto_stream_chacha20_xor_init(state, nonce, key)
+
+  const nonceCopy = Buffer.from(nonce.toString('hex'), 'hex')
+  const keyCopy = Buffer.from(key.toString('hex'), 'hex')
+  nonce = null
+  key = null
+
+  forceGC()
+
+  for (let i = 0; i < message.length; i++) {
+    sodium.crypto_stream_chacha20_xor_update(state, out.slice(i, i + 1), message.slice(i, i + 1))
+  }
+
+  sodium.crypto_stream_chacha20_xor_final(state)
+  sodium.crypto_stream_chacha20_xor(out, out, nonceCopy, keyCopy)
+  t.alike(out, message, 'decrypted')
+})
+
+function random (n) {
+  const buf = Buffer.alloc(n)
+  sodium.randombytes_buf(buf)
+  return buf
+}
+
+function forceGC () {
+  require('v8').setFlagsFromString('--expose-gc')
+  require('vm').runInNewContext('gc')()
+}

test/crypto_stream_chacha20_ietf.js

@@ -0,0 +1,303 @@
+/* eslint-disable camelcase */
+const test = require('brittle')
+const sodium = require('..')
+
+const tests = [
+  ['0000000000000000000000000000000000000000000000000000000000000000', '000000000000000000000000', 0, '76b8e0ada0f13d90405d6ae55386bd28bdd219b8a08ded1aa836efcc8b770dc7da41597c5157488d7724e03fb8d84a376a43b8f41518a11cc387b669b2ee65869f07e7be5551387a98ba977c732d080dcb0f29a048e3656912c6533e32ee7aed29b721769ce64e43d57133b074d839d531ed1f28510afb45ace10a1f4b794d6f2d09a0e663266ce1ae7ed1081968a0758e718e997bd362c6b0c34634a9a0b35d'],
+  ['0000000000000000000000000000000000000000000000000000000000000000', '000000000000000000000000', 1, '9f07e7be5551387a98ba977c732d080dcb0f29a048e3656912c6533e32ee7aed29b721769ce64e43d57133b074d839d531ed1f28510afb45ace10a1f4b794d6f2d09a0e663266ce1ae7ed1081968a0758e718e997bd362c6b0c34634a9a0b35d012737681f7b5d0f281e3afde458bc1e73d2d313c9cf94c05ff3716240a248f21320a058d7b3566bd520daaa3ed2bf0ac5b8b120fb852773c3639734b45c91a4'],
+  ['0000000000000000000000000000000000000000000000000000000000000001', '000000000000000000000000', 1, '3aeb5224ecf849929b9d828db1ced4dd832025e8018b8160b82284f3c949aa5a8eca00bbb4a73bdad192b5c42f73f2fd4e273644c8b36125a64addeb006c13a096d68b9ff7b57e7090f880392effd5b297a83bbaf2fbe8cf5d4618965e3dc776cd430d9b4e7eda8a767fb0e860319aadb5fd96a855de1fbfc92cb0489190cfdd87da6dbf1f736a2d499941ca097e5170bd685578611323120cebf296181ed4f5'],
+  ['00ff000000000000000000000000000000000000000000000000000000000000', '000000000000000000000000', 2, '72d54dfbf12ec44b362692df94137f328fea8da73990265ec1bbbea1ae9af0ca13b25aa26cb4a648cb9b9d1be65b2c0924a66c54d545ec1b7374f4872e99f096bf74dbd52cc4fc95ceb6097fe5e65358c9dbc0a5ecbf7894a132a9a54ae3e951f2e9f209aa9c3d9a877ac9dab62433d2961a17d103e455dfb7337c90f6857aad233065955a212b5c7a8eab4dc8a629e5b6b8ba914afd06de7177054b33d21c96'],
+  ['0000000000000000000000000000000000000000000000000000000000000000', '000000000000000000000002', 0, 'c2c64d378cd536374ae204b9ef933fcd1a8b2288b3dfa49672ab765b54ee27c78a970e0e955c14f3a88e741b97c286f75f8fc299e8148362fa198a39531bed6d1a91288c874ec254f322c2a197340c55bb3e9b3998f7de2309486a0bb494abd20c9c5ef99c1370d61e77f408ac5514f49202bcc6828d45409d2d1416f8ae106b06ebd2541256264fa415bd54cb12e1d4449ed85299a1b7a249b75ff6c89b2e3f'],
+  ['000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f', '000000090000004a00000000', 1, '10f1e7e4d13b5915500fdd1fa32071c4c7d1f4c733c068030422aa9ac3d46c4ed2826446079faa0914c2d705d98b02a2b5129cd1de164eb9cbd083e8a2503c4e0a88837739d7bf4ef8ccacb0ea2bb9d69d56c394aa351dfda5bf459f0a2e9fe8e721f89255f9c486bf21679c683d4f9c5cf2fa27865526005b06ca374c86af3bdcbfbdcb83be65862ed5c20eae5a43241d6a92da6dca9a156be25297f51c2718'],
+  ['000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f', '000000090000004a00000000', 0xfeffffff, '75924bad7831b25662dbac54b46827990b6168ae990e7bd7e1fd2ad282bf23ef052c7d1a0a6c1ef862070943a0d4da24705fbc006dfb85e2af18c0a264d772a44c70fbedac9d6a6867ff6be0a32826507f2c784101583211c9e2453d4cc8b283d5e86682bd4bf511271b91dbd351415f5a009d1f78b64085a9a4341be7d42e2679d57e2747097f0129950e2c9e9ca1356022d45da252af71ac37f351a2e77911']
+]
+
+const vectors = [
+  '8a010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101',
+  '8adc91fd040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404',
+  '8adc91fd9ff4f0070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707070707',
+  '8adc91fd9ff4f0f51b0f0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a',
+  '8adc91fd9ff4f0f51b0fad50ff0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d',
+  '8adc91fd9ff4f0f51b0fad50ff15d637101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010',
+  '8adc91fd9ff4f0f51b0fad50ff15d637e40efd131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313',
+  '8adc91fd9ff4f0f51b0fad50ff15d637e40efda206cc161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616',
+  '8adc91fd9ff4f0f51b0fad50ff15d637e40efda206cc52c783191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919191919',
+  '8adc91fd9ff4f0f51b0fad50ff15d637e40efda206cc52c783a742001c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c',
+  '8adc91fd9ff4f0f51b0fad50ff15d637e40efda206cc52c783a74200503c151f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f',
+  '8adc91fd9ff4f0f51b0fad50ff15d637e40efda206cc52c783a74200503c1582cd98222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222',
+  '8adc91fd9ff4f0f51b0fad50ff15d637e40efda206cc52c783a74200503c1582cd9833367d252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525',
+  '8adc91fd9ff4f0f51b0fad50ff15d637e40efda206cc52c783a74200503c1582cd9833367d0a54d5282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828282828',
+  '8adc91fd9ff4f0f51b0fad50ff15d637e40efda206cc52c783a74200503c1582cd9833367d0a54d57d3c9e2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b',
+  '8adc91fd9ff4f0f51b0fad50ff15d637e40efda206cc52c783a74200503c1582cd9833367d0a54d57d3c9e998f492e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e2e',
+  '8adc91fd9ff4f0f51b0fad50ff15d637e40efda206cc52c783a74200503c1582cd9833367d0a54d57d3c9e998f490ee69c313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131',
+  '8adc91fd9ff4f0f51b0fad50ff15d637e40efda206cc52c783a74200503c1582cd9833367d0a54d57d3c9e998f490ee69ca34c1f343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434343434',
+  '8adc91fd9ff4f0f51b0fad50ff15d637e40efda206cc52c783a74200503c1582cd9833367d0a54d57d3c9e998f490ee69ca34c1ff9e939373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737373737',
+  '8adc91fd9ff4f0f51b0fad50ff15d637e40efda206cc52c783a74200503c1582cd9833367d0a54d57d3c9e998f490ee69ca34c1ff9e939a755843a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a',
+  '8adc91fd9ff4f0f51b0fad50ff15d637e40efda206cc52c783a74200503c1582cd9833367d0a54d57d3c9e998f490ee69ca34c1ff9e939a75584c52d693d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d',
+  '8adc91fd9ff4f0f51b0fad50ff15d637e40efda206cc52c783a74200503c1582cd9833367d0a54d57d3c9e998f490ee69ca34c1ff9e939a75584c52d690a35d4404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040404040'
+]
+
+test('constants', function (t) {
+  t.ok(sodium.crypto_stream_chacha20_ietf_KEYBYTES > 0)
+  t.ok(sodium.crypto_stream_chacha20_ietf_NONCEBYTES > 0)
+  t.ok(sodium.crypto_stream_chacha20_ietf_MESSAGEBYTES_MAX > 0)
+})
+
+test('libsodium crypto_stream_chacha20_ietf', function (t) {
+  const key = Buffer.alloc(sodium.crypto_stream_chacha20_ietf_KEYBYTES)
+  const nonce = Buffer.alloc(sodium.crypto_stream_chacha20_ietf_NONCEBYTES)
+
+  const out = Buffer.alloc(160)
+
+  for (let i = 0; i < tests.length; i++) {
+    key.write(tests[i][0], 0, key.byteLength, 'hex')
+    nonce.write(tests[i][1], 0, nonce.byteLength, 'hex')
+    out.fill(0)
+    sodium.crypto_stream_chacha20_ietf_xor_ic(out, out, nonce, tests[i][2], key)
+    t.alike(out, Buffer.from(tests[i][3], 'hex'), 'crypto_stream_chacha20_ietf_xor_ic vector ' + i)
+    for (let plen = 0; plen < out.byteLength; plen++) {
+      const part = Buffer.alloc(plen)
+      sodium.crypto_stream_chacha20_ietf_xor_ic(part, out.subarray(0, plen), nonce, tests[i][2], key)
+      if (part.every(b => b === 0) === false) return t.fail()
+    }
+  }
+
+  for (let plen = 1, i = 0; plen < 66; plen += 3, i++) {
+    out.fill(plen & 0xff)
+    sodium.crypto_stream_chacha20_ietf(out.subarray(0, plen), nonce, key)
+    if (out.equals(Buffer.from(vectors[i], 'hex')) === false) return t.fail()
+  }
+
+  sodium.randombytes_buf(out)
+  sodium.crypto_stream_chacha20_ietf(out, nonce, key)
+  t.alike(out, Buffer.from('8adc91fd9ff4f0f51b0fad50ff15d637e40efda206cc52c783a74200503c1582cd9833367d0a54d57d3c9e998f490ee69ca34c1ff9e939a75584c52d690a35d410f1e7e4d13b5915500fdd1fa32071c4c7d1f4c733c068030422aa9ac3d46c4ed2826446079faa0914c2d705d98b02a2b5129cd1de164eb9cbd083e8a2503c4e0a88837739d7bf4ef8ccacb0ea2bb9d69d56c394aa351dfda5bf459f0a2e9fe8', 'hex'))
+
+  t.execution(() => sodium.crypto_stream_chacha20_ietf(out.subarray(0, 0), nonce, key))
+  t.execution(() => sodium.crypto_stream_chacha20_ietf_xor(out.subarray(0, 0), Buffer.alloc(0), nonce, key))
+  t.execution(() => sodium.crypto_stream_chacha20_ietf_xor(out.subarray(0, 0), Buffer.alloc(0), nonce, key))
+  t.execution(() => sodium.crypto_stream_chacha20_ietf_xor_ic(out.subarray(0, 0), Buffer.alloc(0), nonce, 1, key))
+
+  out.fill(0x42)
+  sodium.crypto_stream_chacha20_ietf_xor(out, out, nonce, key)
+  t.alike(out, Buffer.from('c89ed3bfddb6b2b7594def12bd579475a64cbfe0448e1085c1e50042127e57c08fda71743f4816973f7edcdbcd0b4ca4dee10e5dbbab7be517c6876f2b48779652b3a5a693791b57124d9f5de16233868593b68571822a414660e8d881962e0c90c0260445dde84b568095479bc940e0f750de939c540cfb8992c1aae0127e0c48cac1357b95fd0cba8eeef2a869fb94df1481d6e8775fbfe7fd07dd486cddaa', 'hex'))
+
+  sodium.crypto_stream_chacha20_ietf_xor_ic(out, out, nonce, 0, key)
+  t.alike(out, Buffer.from('42424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242424242', 'hex'))
+
+  sodium.crypto_stream_chacha20_ietf_xor_ic(out, out, nonce, 1, key)
+  t.alike(out, Buffer.from('52b3a5a693791b57124d9f5de16233868593b68571822a414660e8d881962e0c90c0260445dde84b568095479bc940e0f750de939c540cfb8992c1aae0127e0c48cac1357b95fd0cba8eeef2a869fb94df1481d6e8775fbfe7fd07dd486cddaaa563bad017bb86c4fd6325de2a7f0dde1eb0b865c4176442194488750ec4ed799efdff89c1fc27c46c97804cec1801665f28d0982f88d85729a010d5b75e655a', 'hex'))
+})
+
+test('crypto_stream_chacha20_ietf', function (t) {
+  const buf = Buffer.alloc(50)
+  const nonce = random(sodium.crypto_stream_chacha20_ietf_NONCEBYTES)
+  const key = random(sodium.crypto_stream_chacha20_ietf_KEYBYTES)
+
+  sodium.crypto_stream_chacha20_ietf(buf, nonce, key)
+
+  t.unlike(buf, Buffer.alloc(50), 'contains noise now')
+  const copy = Buffer.from(buf.toString('hex'), 'hex')
+
+  sodium.crypto_stream_chacha20_ietf(buf, nonce, key)
+  t.alike(buf, copy, 'predictable from nonce, key')
+
+  t.end()
+})
+
+test('crypto_stream_chacha20_ietf_xor', function (t) {
+  const message = Buffer.from('Hello, World!')
+  const nonce = random(sodium.crypto_stream_chacha20_ietf_NONCEBYTES)
+  const key = random(sodium.crypto_stream_chacha20_ietf_KEYBYTES)
+
+  sodium.crypto_stream_chacha20_ietf_xor(message, message, nonce, key)
+
+  t.unlike(message, Buffer.from('Hello, World!'), 'encrypted')
+
+  sodium.crypto_stream_chacha20_ietf_xor(message, message, nonce, key)
+
+  t.alike(message, Buffer.from('Hello, World!'), 'decrypted')
+
+  t.end()
+})
+
+test.skip('crypto_stream_chacha20_ietf_xor state', function (t) {
+  const message = Buffer.from('Hello, world!')
+  const nonce = random(sodium.crypto_stream_chacha20_ietf_NONCEBYTES)
+  const key = random(sodium.crypto_stream_chacha20_ietf_KEYBYTES)
+
+  const out = Buffer.alloc(message.length)
+
+  const state = Buffer.alloc(sodium.crypto_stream_chacha20_ietf_xor_STATEBYTES)
+  sodium.crypto_stream_chacha20_ietf_xor_init(state, nonce, key)
+
+  for (let i = 0; i < message.length; i++) {
+    sodium.crypto_stream_chacha20_ietf_xor_update(state, out.slice(i, i + 1), message.slice(i, i + 1))
+  }
+
+  sodium.crypto_stream_chacha20_ietf_xor_final(state)
+  sodium.crypto_stream_chacha20_ietf_xor(out, out, nonce, key)
+  t.alike(out, message, 'decrypted')
+})
+
+test.skip('crypto_stream_chacha20_ietf_xor state with empty buffers', function (t) {
+  const message = Buffer.from('Hello, world!')
+  const nonce = random(sodium.crypto_stream_chacha20_ietf_NONCEBYTES)
+  const key = random(sodium.crypto_stream_chacha20_ietf_KEYBYTES)
+
+  const out = Buffer.alloc(message.length)
+
+  const state = Buffer.alloc(sodium.crypto_stream_chacha20_ietf_xor_STATEBYTES)
+  sodium.crypto_stream_chacha20_ietf_xor_init(state, nonce, key)
+
+  sodium.crypto_stream_chacha20_ietf_xor_update(state, Buffer.alloc(0), Buffer.alloc(0))
+
+  for (let i = 0; i < message.length; i++) {
+    sodium.crypto_stream_chacha20_ietf_xor_update(state, out.slice(i, i + 1), message.slice(i, i + 1))
+    sodium.crypto_stream_chacha20_ietf_xor_update(state, Buffer.alloc(0), Buffer.alloc(0))
+  }
+
+  sodium.crypto_stream_chacha20_ietf_xor_final(state)
+  sodium.crypto_stream_chacha20_ietf_xor(out, out, nonce, key)
+  t.alike(out, message, 'decrypted')
+})
+
+test.skip('crypto_stream_chacha20_ietf_xor state long stream', function (t) {
+  const nonce = random(sodium.crypto_stream_chacha20_ietf_NONCEBYTES)
+  const key = random(sodium.crypto_stream_chacha20_ietf_KEYBYTES)
+
+  const encState = Buffer.alloc(sodium.crypto_stream_chacha20_ietf_xor_STATEBYTES)
+  const decState = Buffer.alloc(sodium.crypto_stream_chacha20_ietf_xor_STATEBYTES)
+
+  sodium.crypto_stream_chacha20_ietf_xor_init(encState, nonce, key)
+  sodium.crypto_stream_chacha20_ietf_xor_init(decState, nonce, key)
+  const plain = []
+  const encrypted = []
+  const decrypted = []
+
+  for (let i = 0; i < 1000; i++) {
+    const next = random(61)
+    plain.push(next)
+
+    const enc = Buffer.alloc(61)
+    sodium.crypto_stream_chacha20_ietf_xor_update(encState, enc, next)
+    encrypted.push(enc)
+
+    const dec = Buffer.alloc(61)
+    sodium.crypto_stream_chacha20_ietf_xor_update(decState, dec, enc)
+    decrypted.push(dec)
+  }
+
+  const enc2 = Buffer.alloc(1000 * 61)
+  sodium.crypto_stream_chacha20_ietf_xor(enc2, Buffer.concat(plain), nonce, key)
+
+  t.alike(Buffer.concat(encrypted), enc2, 'same as encrypting all at once')
+  t.alike(Buffer.concat(decrypted), Buffer.concat(plain), 'decrypts')
+})
+
+test.skip('crypto_stream_chacha20_ietf_xor state long stream (random chunks)', function (t) {
+  const nonce = random(sodium.crypto_stream_chacha20_ietf_NONCEBYTES)
+  const key = random(sodium.crypto_stream_chacha20_ietf_KEYBYTES)
+
+  const encState = Buffer.alloc(sodium.crypto_stream_chacha20_ietf_xor_STATEBYTES)
+  const decState = Buffer.alloc(sodium.crypto_stream_chacha20_ietf_xor_STATEBYTES)
+
+  sodium.crypto_stream_chacha20_ietf_xor_init(encState, nonce, key)
+  sodium.crypto_stream_chacha20_ietf_xor_init(decState, nonce, key)
+  const plain = []
+  const encrypted = []
+  const decrypted = []
+
+  for (let i = 0; i < 10000; i++) {
+    const len = Math.floor(Math.random() * 256)
+    const next = random(len)
+    plain.push(next)
+
+    const enc = Buffer.alloc(len)
+    sodium.crypto_stream_chacha20_ietf_xor_update(encState, enc, next)
+    encrypted.push(enc)
+
+    const dec = Buffer.alloc(len)
+    sodium.crypto_stream_chacha20_ietf_xor_update(decState, dec, enc)
+    decrypted.push(dec)
+  }
+
+  const enc2 = Buffer.alloc(Buffer.concat(plain).length)
+  sodium.crypto_stream_chacha20_ietf_xor(enc2, Buffer.concat(plain), nonce, key)
+
+  t.alike(Buffer.concat(encrypted), enc2, 'same as encrypting all at once')
+  t.alike(Buffer.concat(decrypted), Buffer.concat(plain), 'decrypts')
+})
+
+test.skip('crypto_stream_chacha20_ietf_xor state long stream (random chunks) with empty buffers', function (t) {
+  const nonce = random(sodium.crypto_stream_chacha20_ietf_NONCEBYTES)
+  const key = random(sodium.crypto_stream_chacha20_ietf_KEYBYTES)
+
+  const encState = Buffer.alloc(sodium.crypto_stream_chacha20_ietf_xor_STATEBYTES)
+  const decState = Buffer.alloc(sodium.crypto_stream_chacha20_ietf_xor_STATEBYTES)
+
+  sodium.crypto_stream_chacha20_ietf_xor_init(encState, nonce, key)
+  sodium.crypto_stream_chacha20_ietf_xor_init(decState, nonce, key)
+  const plain = []
+  const encrypted = []
+  const decrypted = []
+
+  for (let i = 0; i < 10000; i++) {
+    const len = Math.floor(Math.random() * 256)
+    const next = random(len)
+    plain.push(next)
+
+    sodium.crypto_stream_chacha20_ietf_xor_update(encState, Buffer.alloc(0), Buffer.alloc(0))
+
+    const enc = Buffer.alloc(len)
+    sodium.crypto_stream_chacha20_ietf_xor_update(encState, enc, next)
+    encrypted.push(enc)
+
+    const dec = Buffer.alloc(len)
+    sodium.crypto_stream_chacha20_ietf_xor_update(decState, dec, enc)
+    decrypted.push(dec)
+    sodium.crypto_stream_chacha20_ietf_xor_update(decState, Buffer.alloc(0), Buffer.alloc(0))
+  }
+
+  const enc2 = Buffer.alloc(Buffer.concat(plain).length)
+  sodium.crypto_stream_chacha20_ietf_xor(enc2, Buffer.concat(plain), nonce, key)
+
+  t.alike(Buffer.concat(encrypted), enc2, 'same as encrypting all at once')
+  t.alike(Buffer.concat(decrypted), Buffer.concat(plain), 'decrypts')
+})
+
+test.skip('crypto_stream_chacha20_xor state after GC', function (t) {
+  const message = Buffer.from('Hello, world!')
+  let nonce = random(sodium.crypto_stream_chacha20_ietf_NONCEBYTES)
+  let key = random(sodium.crypto_stream_chacha20_ietf_KEYBYTES)
+
+  const out = Buffer.alloc(message.length)
+
+  const state = Buffer.alloc(sodium.crypto_stream_chacha20_ietf_xor_STATEBYTES)
+  sodium.crypto_stream_chacha20_ietf_xor_init(state, nonce, key)
+
+  const nonceCopy = Buffer.from(nonce.toString('hex'), 'hex')
+  const keyCopy = Buffer.from(key.toString('hex'), 'hex')
+  nonce = null
+  key = null
+
+  forceGC()
+
+  for (let i = 0; i < message.length; i++) {
+    sodium.crypto_stream_chacha20_ietf_xor_update(state, out.slice(i, i + 1), message.slice(i, i + 1))
+  }
+
+  sodium.crypto_stream_chacha20_ietf_xor_final(state)
+  sodium.crypto_stream_chacha20_ietf_xor(out, out, nonceCopy, keyCopy)
+  t.alike(out, message, 'decrypted')
+})
+
+function random (n) {
+  const buf = Buffer.alloc(n)
+  sodium.randombytes_buf(buf)
+  return buf
+}
+
+function forceGC () {
+  require('v8').setFlagsFromString('--expose-gc')
+  require('vm').runInNewContext('gc')()
+}

test/crypto_tweak_ed25519.js

@@ -0,0 +1,113 @@
+const test = require('brittle')
+const sodium = require('..')
+const fixtures = require('./fixtures/crypto_tweak_ed25519_sign.js')
+
+test('crypto_tweak', function (t) {
+  const pk = Buffer.alloc(sodium.crypto_sign_PUBLICKEYBYTES)
+  const sk = Buffer.alloc(sodium.crypto_sign_SECRETKEYBYTES)
+
+  sodium.crypto_sign_keypair(pk, sk)
+
+  const tpk = Buffer.alloc(sodium.crypto_tweak_ed25519_BYTES)
+  const tsk = Buffer.alloc(sodium.crypto_tweak_ed25519_SCALARBYTES)
+
+  const tkpk = Buffer.alloc(sodium.crypto_tweak_ed25519_BYTES)
+  const tksk = Buffer.alloc(sodium.crypto_tweak_ed25519_SCALARBYTES)
+
+  const point = Buffer.alloc(sodium.crypto_tweak_ed25519_BYTES)
+  const tweak = Buffer.alloc(sodium.crypto_tweak_ed25519_SCALARBYTES)
+
+  const ns = Buffer.alloc(32)
+  sodium.crypto_generichash(ns, Buffer.from('namespace'))
+
+  t.exception.all(function () {
+    sodium.crypto_tweak_ed25519_base()
+  }, 'should validate input')
+
+  t.exception.all(function () {
+    sodium.crypto_tweak_ed25519_base(Buffer.alloc(0), Buffer.alloc(0), ns)
+  }, 'should validate input length')
+
+  sodium.crypto_tweak_ed25519_base(tweak, point, ns)
+
+  const _sk = sk.subarray(0, 32)
+  sodium.crypto_tweak_ed25519_sk_to_scalar(_sk, sk)
+
+  sodium.crypto_tweak_ed25519_pk(tpk, pk, ns)
+  sodium.crypto_tweak_ed25519_scalar(tsk, _sk, ns)
+
+  sodium.crypto_tweak_ed25519_keypair(tkpk, tksk, _sk, ns)
+
+  sodium.crypto_tweak_ed25519_pk_add(pk, pk, point)
+  sodium.crypto_tweak_ed25519_scalar_add(_sk, _sk, tweak)
+
+  t.alike(pk, tpk, 'tweak public key')
+  t.alike(_sk, tsk, 'tweak secret key')
+  t.alike(pk, tkpk, 'tweak keypair public key')
+  t.alike(_sk, tksk, 'tweak keypair secret key')
+})
+
+test('crypto_tweak_sign', function (t) {
+  const pk = Buffer.alloc(sodium.crypto_sign_PUBLICKEYBYTES)
+  const sk = Buffer.alloc(sodium.crypto_sign_SECRETKEYBYTES)
+
+  sodium.crypto_sign_keypair(pk, sk)
+
+  const tpk = Buffer.alloc(sodium.crypto_tweak_ed25519_BYTES)
+  const tsk = Buffer.alloc(sodium.crypto_tweak_ed25519_SCALARBYTES)
+
+  const point = Buffer.alloc(sodium.crypto_tweak_ed25519_BYTES)
+  const tweak = Buffer.alloc(sodium.crypto_tweak_ed25519_SCALARBYTES)
+
+  const ns = Buffer.alloc(32)
+  sodium.crypto_generichash(ns, Buffer.from('namespace'))
+
+  sodium.crypto_tweak_ed25519_base(tweak, point, ns)
+
+  sodium.crypto_tweak_ed25519_pk(tpk, pk, ns)
+  sodium.crypto_tweak_ed25519_sk_to_scalar(tsk, sk)
+  sodium.crypto_tweak_ed25519_scalar(tsk, tsk, ns)
+
+  sodium.crypto_tweak_ed25519_pk_add(pk, pk, point)
+
+  const _sk = sk.subarray(0, 32)
+  sodium.crypto_tweak_ed25519_sk_to_scalar(_sk, sk)
+  sodium.crypto_tweak_ed25519_scalar_add(_sk, _sk, tweak)
+
+  const m = Buffer.from('test message')
+  const sig = Buffer.alloc(sodium.crypto_sign_BYTES)
+
+  sodium.crypto_tweak_ed25519_sign_detached(sig, m, _sk)
+  t.ok(sodium.crypto_sign_verify_detached(sig, m, pk))
+  t.ok(sodium.crypto_sign_verify_detached(sig, m, tpk))
+
+  sodium.crypto_tweak_ed25519_sign_detached(sig, m, tsk)
+  t.ok(sodium.crypto_sign_verify_detached(sig, m, pk))
+  t.ok(sodium.crypto_sign_verify_detached(sig, m, tpk))
+})
+
+test('crypto_tweak sign fixtures', t => {
+  for (const f of fixtures) {
+    const [sk, n, m, sig, tweak, tpk, tn] = f.map(Buffer.from)
+
+    const signature = Buffer.alloc(64)
+    const scalar = Buffer.alloc(32)
+    const pk = Buffer.alloc(32)
+
+    sodium.crypto_tweak_ed25519_sk_to_scalar(scalar, sk)
+    t.alike(scalar, n)
+
+    sodium.crypto_tweak_ed25519_sign_detached(signature, m, n)
+    t.alike(signature, sig)
+
+    sodium.randombytes_buf(signature)
+    sodium.crypto_sign_ed25519_sk_to_pk(pk, sk)
+
+    sodium.crypto_tweak_ed25519_sign_detached(signature, m, n, pk)
+    t.alike(signature, sig)
+
+    sodium.crypto_tweak_ed25519_keypair(pk, scalar, n, tweak)
+    t.alike(pk, tpk)
+    t.alike(scalar, tn)
+  }
+})

test/fixtures/crypto_kdf.json

@@ -0,0 +1,78 @@
+[
+  {"error": false, "id":0, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":64, "subkey":"a0c724404728c8bb95e5433eb6a9716171144d61efb23e74b873fcbeda51d8071b5d70aae12066dfc94ce943f145aa176c055040c3dd73b0a15e36254d450614"},
+  {"error": false, "id":1, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":64, "subkey":"02507f144fa9bf19010bf7c70b235b4c2663cc00e074f929602a5e2c10a780757d2a3993d06debc378a90efdac196dd841817b977d67b786804f6d3cd585bab5"},
+  {"error": false, "id":2, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":64, "subkey":"1944da61ff18dc2028c3578ac85be904931b83860896598f62468f1cb5471c6a344c945dbc62c9aaf70feb62472d17775ea5db6ed5494c68b7a9a59761f39614"},
+  {"error": false, "id":3, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":64, "subkey":"131c0ca1633ed074986215b264f6e0474f362c52b029effc7b0f75977ee89cc95d85c3db87f7e399197a25411592beeeb7e5128a74646a460ecd6deb4994b71e"},
+  {"error": false, "id":4, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":64, "subkey":"a7023a0bf9be245d078aed26bcde0465ff0cc0961196a5482a0ff4ff8b4015971e13611f50529cb408f5776b14a90e7c3dd9160a22211db64ff4b5c0b9953680"},
+  {"error": false, "id":5, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":64, "subkey":"50f49313f3a05b2e565c13feedb44daa675cafd42c2b2cf9edbce9c949fbfc3f175dcb738671509ae2ea66fb85e552394d479afa7fa3affe8791744796b94176"},
+  {"error": false, "id":6, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":64, "subkey":"13b58d6d69780089293862cd59a1a8a4ef79bb850e3f3ba41fb22446a7dd1dc4da4667d37b33bf1225dcf8173c4c349a5d911c5bd2db9c5905ed70c11e809e3b"},
+  {"error": false, "id":7, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":64, "subkey":"15d44b4b44ffa006eeceeb508c98a970aaa573d65905687b9e15854dec6d49c612757e149f78268f727660dedf9abce22a9691feb20a01b0525f4b47a3cf19db"},
+  {"error": false, "id":8, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":64, "subkey":"9aebba11c5428ae8225716369e30a48943be39159a899f804e9963ef78822e186c21fe95bb0b85e60ef03a6f58d0b9d06e91f79d0ab998450b8810c73ca935b4"},
+  {"error": false, "id":9, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":64, "subkey":"70f9b83e463fb441e7a4c43275125cd5b19d8e2e4a5d179a39f5db10bbce745a199104563d308cf8d4c6b27bbb759ded232f5bdb7c367dd632a9677320dfe416"},
+  {"error": true, "id":0, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":0, "subkey":null},
+  {"error": true, "id":1, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":1, "subkey":null},
+  {"error": true, "id":2, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":2, "subkey":null},
+  {"error": true, "id":3, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":3, "subkey":null},
+  {"error": true, "id":4, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":4, "subkey":null},
+  {"error": true, "id":5, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":5, "subkey":null},
+  {"error": true, "id":6, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":6, "subkey":null},
+  {"error": true, "id":7, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":7, "subkey":null},
+  {"error": true, "id":8, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":8, "subkey":null},
+  {"error": true, "id":9, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":9, "subkey":null},
+  {"error": true, "id":10, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":10, "subkey":null},
+  {"error": true, "id":11, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":11, "subkey":null},
+  {"error": true, "id":12, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":12, "subkey":null},
+  {"error": true, "id":13, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":13, "subkey":null},
+  {"error": true, "id":14, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":14, "subkey":null},
+  {"error": true, "id":15, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":15, "subkey":null},
+  {"error": false, "id":16, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":16, "subkey":"a529216624ef9161e4cf117272aafff2"},
+  {"error": false, "id":17, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":17, "subkey":"068bd6940b80c6cc2530a68c31d9f4e323"},
+  {"error": false, "id":18, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":18, "subkey":"0acf4f6c74a590c8a1c0997ec9a1a3f48b2a"},
+  {"error": false, "id":19, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":19, "subkey":"ac17a37ce74c0efece75f9337de20795dbadcc"},
+  {"error": false, "id":20, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":20, "subkey":"268214dc9477a2e3c1022829f934ab992a5a3d84"},
+  {"error": false, "id":21, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":21, "subkey":"33b76197b4531665e494760909eda1cc570e7da9bb"},
+  {"error": false, "id":22, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":22, "subkey":"3d4efbc569ca7f858ad4f49c56b820986a406e6eebbc"},
+  {"error": false, "id":23, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":23, "subkey":"983fea27520f507c40231f9557908f07c095bdf4a4ce5d"},
+  {"error": false, "id":24, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":24, "subkey":"94d678717625e011995c7355f2092267dee47bf0722dd380"},
+  {"error": false, "id":25, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":25, "subkey":"198901896c4f51e74ffa8b2805415c6eaba5accfc85a6e6b34"},
+  {"error": false, "id":26, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":26, "subkey":"4ffabb81d49021f85ef5d2a713ab02ae86bc2e7d1522f5e077fe"},
+  {"error": false, "id":27, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":27, "subkey":"eebc3d55b3f4fc8b64d2474063254da7db98e7398dfdd510e28075"},
+  {"error": false, "id":28, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":28, "subkey":"22c134b9d664e1bdb14dc309a936bf1512b19e4f5175642efb1a0df7"},
+  {"error": false, "id":29, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":29, "subkey":"4b179762bfc8e27a9e575113faa76247b9c046d6f22d5a02e2910a299b"},
+  {"error": false, "id":30, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":30, "subkey":"abc45eb2b031307b8822c7e59a43f4108850c34a7445936bc848422251c4"},
+  {"error": false, "id":31, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":31, "subkey":"d6565bd3265b6373f4f6a6b6458e981006da5e9d532ce94ca4737e188995e9"},
+  {"error": false, "id":32, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":32, "subkey":"154b291f11196737f8b7f491e4ca11764e0227d34f94295408a869f007aa8618"},
+  {"error": false, "id":33, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":33, "subkey":"e9dd395570e09ebb523ffc6ba098a38b17bc4944f14bd3725bdd7edbd8bcff54fb"},
+  {"error": false, "id":34, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":34, "subkey":"7248294d37159e85bacde68c7762a673794c91b811e05f4e3b9e3ecc82bfcf63a2cd"},
+  {"error": false, "id":35, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":35, "subkey":"d060ee4d93f8de6d9ae60fca9596413455183a1f83c7a2381227cec8f7a217e4072f85"},
+  {"error": false, "id":36, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":36, "subkey":"20790290347b9b0f413a954f40e52e270b3b45417e96c8733161672188701c08dd76cc3d"},
+  {"error": false, "id":37, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":37, "subkey":"7674188112a1ab8d3926d468be8e51d788ce4144bb20ff842034e4d1ddab3929a4f1a13a74"},
+  {"error": false, "id":38, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":38, "subkey":"a2ab1f980a47472d8a539f20410cc9bf143d941331ab2259ea73684c0608939c5b23e9cbcb3d"},
+  {"error": false, "id":39, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":39, "subkey":"f4cfbe3050f15ebbaf8d2f3bf3a678c01fc21ee1f4be07d0744c7fbf4835ea9d9472a3d785c24c"},
+  {"error": false, "id":40, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":40, "subkey":"66efa5dfe3efd4cc8ca25f2d622c97a20a192d7add965f26b002b7eb81aae4203c0e5f07fd945845"},
+  {"error": false, "id":41, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":41, "subkey":"ad5d8031055c96dc9db10285206d7edc38d3af85736df8a3b5fdd30a318e80c28d9b26c95a60fa3e68"},
+  {"error": false, "id":42, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":42, "subkey":"9107c8a57a2c9ca40158f33ca0bfb64c095d2f21ca98bb7138477599330a36cdfc2ae5751e370d0e024e"},
+  {"error": false, "id":43, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":43, "subkey":"b0c190177358b955ebebc5e0b86ec91dde3b6f1982ea4d68ec5ec3bdd6527c362e5275600b263601c98452"},
+  {"error": false, "id":44, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":44, "subkey":"31bfaaad4adde0f87d87372e398c42cb7befe065ab2957ebb91ef9dc534b410783899b2e1e84221286f3bab4"},
+  {"error": false, "id":45, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":45, "subkey":"2258dd1f3e516cb8e3d1f6c45808573c365192f073698939721af8961a02a8bdd002a31fd239b9498663a01f27"},
+  {"error": false, "id":46, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":46, "subkey":"7c7a88016610493bb44a9432a88b50f97e2e94383972ff95da826692d96c52d82f86899b3561ec9c95a8b1bf3213"},
+  {"error": false, "id":47, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":47, "subkey":"3929dc7473be4c633be9e08801a8abd284dc0c6154c5c81a4c18259699dd86753c5e14fbd723be46ebb04f4ab3058c"},
+  {"error": false, "id":48, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":48, "subkey":"30b720220015fa60daa69c83f9754d772b1b2dd12ab6baaa2f4edab458d4d251c1cddb8c4a554f3eb13969316b890fbd"},
+  {"error": false, "id":49, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":49, "subkey":"33fa2412a5c3294d49e964419e96d043a2099a72b3351e3bed0f07e12255c95b509ea9bf2963a4c0fe9cc2314dbc44f673"},
+  {"error": false, "id":50, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":50, "subkey":"ca891d2c82a6a8f833dc1a05f190bab6de221307eab1dd2c88341d4d2537a2fc0056b0d04d8104fd3fe89e1ea20877893e81"},
+  {"error": false, "id":51, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":51, "subkey":"fd78ac89a64d03672ad99d663f2613d15277cda1636e334a1706b7211ff1f3a3b3d2e671e391c75e3d242c482ce7e1b8b427ed"},
+  {"error": false, "id":52, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":52, "subkey":"36a6072743d3aafd3ee89344b9ef92cb58a2853ae92b20283520439fcb55afffd3d4b5e4e8c92a85d3cf74497bdcf68bbf1fcf93"},
+  {"error": false, "id":53, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":53, "subkey":"a90afcfaffec1105ad05fdaa9473fb5daf1bf8fb376b7326db46ef4c120c553188c69131933371d409eb56d66d5adca618e1dac65b"},
+  {"error": false, "id":54, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":54, "subkey":"9b990d1fcddbdb5e5c7a48a6a2a666e02e7d4d4a814ece40660d99e1c02d5f023c56ae82526fc6dc8c933d0add92fc376efcddd55a42"},
+  {"error": false, "id":55, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":55, "subkey":"ec545dcf456d1b0907c07418a42bf2b3d668b4797ba6874bf0d563f5f429a820f02177dd4d05e639a06807c9619fee54ffe07712493543"},
+  {"error": false, "id":56, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":56, "subkey":"b0106957626894586682a275f69ed4533e2f94334cc0430394b68d82679aca00dd579e712bdd2d7f5bbce9a050269739bd8427b75b06027f"},
+  {"error": false, "id":57, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":57, "subkey":"05751bfeebb480c9bca0d25d8197e2673845f405d7fb9793e29169ac19956c525f6e637f3d5ea50597b04342afed4ca16f988b4f21a34f1902"},
+  {"error": false, "id":58, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":58, "subkey":"7b4e4294d3f64085b5c09be73548f1f5cb5c6f04e57ce6cdd3077e2fb37640bf1ca0c6393b87d48a6b7e3e42628bd30fca132ded03ce51f71d9d"},
+  {"error": false, "id":59, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":59, "subkey":"082d248862cbfd71a634769a4b1cf52a4af47ace5b9ea4d583ca52207efc7234a6d321788130cbdec122579ad03afe00bc68c9fb3f68dd0532a96f"},
+  {"error": false, "id":60, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":60, "subkey":"a2b39b4428d981013e8a9c0e41b3eed504983fc18dc4b60332b1ab28b9705228147bdb95cc17889d5f0f9cfb7fd16f9d414b1a829346a8922e945b40"},
+  {"error": false, "id":61, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":61, "subkey":"efbf0f8bda1b9ef24fe389f1cf0c0c8a08bca03fc95badabb79a487d8ce1351683f59183aa6229f880d69ad60114ac128f69b2be250109972ab1f3fc3b"},
+  {"error": false, "id":62, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":62, "subkey":"dfe0ba2a6de25fa06b47375e9d9cf6c6fa1493a8a2a81c28d6e09bc161057b445659db76e92e349ff44f34a2a9e3bcaa6b84b21bae56f1499c170ab81af0"},
+  {"error": false, "id":63, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":63, "subkey":"02f9cbdb10759314515b01379c474ad74a1b575137bd3949776dbcfc3e18060cb13ee1f6dcf86035768fc7be63e01de321cacbfade209900dd94273fd8e176"},
+  {"error": false, "id":64, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":64, "subkey":"06ae14308eeeda62a00cb6d5edf18d1707029515db98f472bbf0617419301b1d4f4f2ab65849446be46f87e1d31c6c74283897b9976f70d8a16253ac927e0d9f"},
+  {"error": true, "id":65, "context":"4b44462074657374", "key":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "subkey_len":65, "subkey":null}
+]

test/fixtures/mprotect_noaccess.js

@@ -0,0 +1,6 @@
+/* eslint-disable */
+const sodium = require('../..')
+const buf = sodium.sodium_malloc(1)
+sodium.sodium_mprotect_noaccess(buf)
+buf[0]
+process.send('read')

test/fixtures/mprotect_readonly.js

@@ -0,0 +1,8 @@
+/* eslint-disable */
+const sodium = require('../..')
+const buf = sodium.sodium_malloc(1)
+sodium.sodium_mprotect_readonly(buf)
+buf[0]
+process.send('read')
+buf[0] = 1
+process.send('write')

test/fixtures/mprotect_readwrite.js

@@ -0,0 +1,11 @@
+/* eslint-disable */
+const sodium = require('../..')
+const buf = sodium.sodium_malloc(1)
+sodium.sodium_mprotect_noaccess(buf)
+sodium.sodium_mprotect_readwrite(buf)
+buf[0]
+process.send('read')
+buf[0] = 1
+process.send('write')
+sodium.sodium_mprotect_readonly(buf)
+process.send(buf[0] === 1 ? 'did_write' : 'did_not_write')

test/helpers.js

@@ -0,0 +1,103 @@
+/* eslint-disable camelcase */
+const test = require('brittle')
+const sodium = require('..')
+
+test('sodium_memcmp', function (t) {
+  const b1 = Buffer.from([0, 1, 2, 3])
+  const b2 = Buffer.from([3, 2, 1, 0])
+
+  t.exception.all(_ => sodium.sodium_memcmp(), 'no args')
+  t.exception.all(_ => sodium.sodium_memcmp(b1), 'arg mismatch')
+  t.exception.all(_ => sodium.sodium_memcmp(b1, b2.slice(1)), 'length mismatch')
+  t.ok(sodium.sodium_memcmp(Buffer.alloc(0), Buffer.alloc(0)))
+  t.ok(sodium.sodium_memcmp(Buffer.alloc(5), Buffer.alloc(5)))
+  t.ok(sodium.sodium_memcmp(b1, b1))
+  t.absent(sodium.sodium_memcmp(b2, b1))
+  t.absent(sodium.sodium_memcmp(b1, b2))
+})
+
+test.skip('sodium_compare', function (t) {
+  const one = Buffer.from([1])
+  const two = Buffer.from([2])
+  const three = Buffer.from([3])
+
+  t.is(sodium.sodium_compare(Buffer.alloc(0), Buffer.alloc(0)), 0)
+  t.is(sodium.sodium_compare(one, one), 0)
+  t.is(sodium.sodium_compare(two, two), 0)
+  t.is(sodium.sodium_compare(three, three), 0)
+
+  t.is(sodium.sodium_compare(one, two), -1)
+  t.is(sodium.sodium_compare(one, three), -1)
+  t.is(sodium.sodium_compare(two, one), 1)
+  t.is(sodium.sodium_compare(three, one), 1)
+
+  t.is(sodium.sodium_compare(two, three), -1)
+  t.is(sodium.sodium_compare(three, two), 1)
+})
+
+test.skip('sodium_add', function (t) {
+  const large = Buffer.alloc(32)
+  large[23] = 0b00000011
+  const largeLessOne = Buffer.alloc(32)
+  largeLessOne[23] = 0b00000001
+
+  const c = Buffer.from(large)
+
+  sodium.sodium_add(c, largeLessOne)
+  t.ok(large[23], 4)
+
+  const overflow = Buffer.alloc(56, 0xff)
+  const one = Buffer.alloc(56)
+  one[0] = 1
+  sodium.sodium_add(overflow, one)
+
+  t.ok(sodium.sodium_is_zero(overflow))
+})
+
+test.skip('sub', function (t) {
+  const large = Buffer.alloc(32)
+  large[23] = 0b00000011
+  const largeLessOne = Buffer.alloc(32)
+  largeLessOne[23] = 0b00000001
+
+  const c = Buffer.from(large)
+
+  sodium.sodium_sub(c, largeLessOne)
+  t.ok(large[23], 2)
+
+  const overflow = Buffer.alloc(56, 0x00)
+  const one = Buffer.alloc(56)
+  one[0] = 1
+  sodium.sodium_sub(overflow, one)
+
+  t.ok(sodium.sodium_memcmp(overflow, Buffer.alloc(56, 0xff)))
+})
+
+test('sodium_increment', function (t) {
+  const zero = Buffer.alloc(4)
+  sodium.sodium_increment(zero)
+
+  t.ok(zero[0], 1)
+
+  const overflow = Buffer.alloc(56, 0xff)
+  sodium.sodium_increment(overflow)
+
+  t.ok(sodium.sodium_is_zero(overflow))
+})
+
+test('sodium_is_zero', function (t) {
+  const buf = Buffer.from([0, 0, 0, 1])
+
+  t.exception.all(_ => sodium.sodium_is_zero(), 'no args')
+  t.exception.all(_ => sodium.sodium_is_zero(null), 'missing buf')
+
+  t.ok(sodium.sodium_is_zero(Buffer.alloc(0)), 'empty buffer')
+  t.ok(sodium.sodium_is_zero(buf.subarray(0, 0)), 'zero bytes')
+  t.ok(sodium.sodium_is_zero(buf.subarray(0, 1)), 'one byte')
+  t.ok(sodium.sodium_is_zero(buf.subarray(0, 2)), 'two bytes')
+  t.ok(sodium.sodium_is_zero(buf.subarray(0, 3)), '3 bytes')
+  t.absent(sodium.sodium_is_zero(buf), 'first non-zero byte')
+  t.ok(sodium.sodium_is_zero(buf.subarray(1, 2)), 'view')
+  t.ok(sodium.sodium_is_zero(buf.subarray(1, 2)), 'view')
+  t.absent(sodium.sodium_is_zero(buf.subarray(3)), 'view')
+})

test/memory.js

@@ -0,0 +1,126 @@
+/* eslint-disable camelcase */
+const test = require('brittle')
+const sodium = require('..')
+const fork = require('child_process').fork
+
+test.skip('sodium_mprotect_noaccess', function (t) {
+  t.plan(1)
+  const p = fork(require.resolve('./fixtures/mprotect_noaccess'))
+
+  p.on('message', function () {
+    t.fail()
+  })
+  p.on('exit', function (code, signal) {
+    t.ok(p.signalCode !== null || p.exitCode > 0)
+  })
+})
+
+test.skip('sodium_mprotect_readonly', function (t) {
+  t.plan(2)
+  const p = fork(require.resolve('./fixtures/mprotect_readonly'))
+
+  p.on('message', function (msg) {
+    t.ok(msg === 'read')
+  })
+  p.on('exit', function (code, signal) {
+    t.ok(p.signalCode !== null || p.exitCode > 0)
+  })
+})
+
+test.skip('sodium_mprotect_readwrite', function (t) {
+  t.plan(4)
+  const p = fork(require.resolve('./fixtures/mprotect_readwrite'))
+
+  p.on('message', function (msg) {
+    switch (msg) {
+      case 'read': t.pass()
+        break
+      case 'write': t.pass()
+        break
+      case 'did_write': t.pass()
+        break
+      case 'did_not_write': t.fail()
+        break
+      default: t.fail()
+        break
+    }
+  })
+  p.on('exit', function (code, signal) {
+    t.ok(p.signalCode === null || p.exitCode === 0)
+  })
+})
+
+test('sodium_memzero', function (t) {
+  const buf = Buffer.alloc(10, 0xab)
+  const exp = Buffer.alloc(10, 0xab)
+  const zero = Buffer.alloc(10)
+
+  t.alike(buf, exp, 'buffers start out with same content')
+  t.unlike(buf, zero, 'buffer is not zero')
+
+  sodium.sodium_memzero(buf)
+  t.unlike(buf, exp, 'buffers are not longer the same')
+  t.alike(buf, zero, 'buffer is now zeroed')
+})
+
+test.skip('sodium_mlock / sodium_munlock', function (t) {
+  const buf = Buffer.alloc(10, 0x18)
+  const exp = Buffer.alloc(10, 0x18)
+
+  sodium.sodium_mlock(buf)
+  t.absent(buf.secure)
+  t.alike(buf, exp, 'mlock did not corrupt data')
+  sodium.sodium_munlock(buf)
+  t.absent(buf.secure)
+  t.alike(buf, Buffer.alloc(10), 'munlock did zero data')
+})
+
+test('sodium_malloc', function (t) {
+  const empty = sodium.sodium_malloc(0)
+  const small = sodium.sodium_malloc(1)
+  const large = sodium.sodium_malloc(1e8)
+
+  // sodium-javascript does not set secure prop
+
+  // t.ok(empty.secure)
+  // t.ok(small.secure)
+  // t.ok(large.secure)
+
+  t.ok(empty.length === 0, 'has correct size')
+  t.ok(small.length === 1, 'has correct size')
+  t.ok(large.length === 1e8, 'has correct size')
+
+  // const expected = Buffer.from([0xdb])
+  // expected.secure = true
+  // t.alike(small, expected, 'has canary content')
+
+  // test gc
+  for (let i = 0; i < 1e3; i++) {
+    if (sodium.sodium_malloc(256).length !== 256) {
+      t.fail('allocated incorrect size')
+    }
+  }
+  t.ok(empty.length === 0, 'retained correct size')
+  t.ok(small.length === 1, 'retained correct size')
+  t.ok(large.length === 1e8, 'retained correct size')
+})
+
+test('sodium_free', function (t) {
+  if (process.version.startsWith('v10')) {
+    t.comment('Skipping free test on v10')
+    return
+  }
+  const buf = sodium.sodium_malloc(1)
+  t.ok(buf.byteLength === 1)
+  sodium.sodium_free(buf)
+  t.ok(buf.byteLength === 0)
+})
+
+test.skip('sodium_malloc bounds', function (t) {
+  t.throws(function () {
+    sodium.sodium_malloc(-1)
+  }, 'too small')
+  t.throws(function () {
+    sodium.sodium_malloc(Number.MAX_SAFE_INTEGER)
+  }, 'too large')
+})

test/randombytes.js

@@ -0,0 +1,111 @@
+/* eslint-disable camelcase */
+const test = require('brittle')
+const sodium = require('..')
+
+test.skip('constants', function (t) {
+  t.alike(typeof sodium.randombytes_SEEDBYTES, 'number', 'randombytes_SEEDBYTES is number')
+})
+
+test.skip('randombytes_random', function (t) {
+  for (let i = 0; i < 1e6; i++) {
+    const n = sodium.randombytes_random()
+    if (n > 0xffffffff || n < 0) t.fail()
+  }
+})
+
+test.skip('randombytes_uniform', function (t) {
+  const p = 5381
+  for (let i = 0; i < 1e6; i++) {
+    const n = sodium.randombytes_uniform(5381)
+    if (n >= p || n < 0) t.fail()
+  }
+})
+
+test('randombytes_buf', function (t) {
+  let buf = null
+
+  buf = Buffer.alloc(10)
+  sodium.randombytes_buf(buf)
+  t.not(buf, Buffer.alloc(10), 'not blank')
+
+  buf = Buffer.alloc(1024)
+  sodium.randombytes_buf(buf)
+  t.not(buf, Buffer.alloc(1024), 'large not blank')
+})
+
+test.skip('randombytes_deterministic', function (t) {
+  const seed1 = Buffer.allocUnsafe(sodium.randombytes_SEEDBYTES)
+  const seed2 = Buffer.allocUnsafe(sodium.randombytes_SEEDBYTES)
+  const buf1 = Buffer.alloc(10)
+  const buf2 = Buffer.alloc(10)
+
+  for (let i = 0; i < 1e6; i++) {
+    sodium.randombytes_buf(seed1)
+    sodium.randombytes_buf(seed2)
+
+    sodium.randombytes_buf_deterministic(buf1, seed1)
+    sodium.randombytes_buf_deterministic(buf2, seed1)
+    if (!buf1.equals(buf2)) t.fail('should equal')
+
+    sodium.randombytes_buf_deterministic(buf1, seed1)
+    sodium.randombytes_buf_deterministic(buf2, seed2)
+    if (buf1.equals(buf2)) t.fail('should not equal')
+
+    sodium.randombytes_buf_deterministic(buf1, seed2)
+    sodium.randombytes_buf_deterministic(buf2, seed1)
+    if (buf1.equals(buf2)) t.fail('should not equal')
+
+    sodium.randombytes_buf_deterministic(buf1, seed2)
+    sodium.randombytes_buf_deterministic(buf2, seed2)
+    if (!buf1.equals(buf2)) t.fail('should equal')
+  }
+})
+
+test.skip('Various test cases', function (t) {
+  sodium.randombytes_buf(Buffer.alloc(0))
+  sodium.randombytes_buf(new Uint8Array(16))
+
+  t.throws(function () {
+    sodium.randombytes_buf([])
+  })
+
+  t.end()
+})
+
+test('Generates random bytes', function (t) {
+  const bufConst = Buffer.alloc(64)
+  sodium.randombytes_buf(bufConst)
+
+  const buf1 = Buffer.alloc(64)
+  for (let i = 0; i < 1e4; i++) {
+    sodium.randombytes_buf(buf1)
+    if (Buffer.compare(buf1, bufConst) === 0) {
+      t.fail('Constant buffer should not be equal')
+      t.end()
+      return
+    }
+  }
+
+  t.pass('Generated unique buffers')
+  t.end()
+})
+
+test('Exceed quota', function (t) {
+  const buf = Buffer.alloc(1 << 17)
+  sodium.randombytes_buf(buf)
+
+  const scores = new Array(256)
+  scores.fill(0)
+
+  for (const b of buf) {
+    scores[b]++
+  }
+
+  scores
+    .map(cnt => cnt / 256)
+    .forEach(cnt => {
+      if (cnt < 1 && cnt > 3) t.fail('Statistically unreasonable')
+    })
+
+  t.end()
+})