add crypto_auth_hmac methods

.gitignore

@@ -1,2 +1 @@
 node_modules
-package-lock.json

README.md

@@ -33,7 +33,7 @@ console.log('Plaintext:', plainText.toString())
 ## API
 
 See [sodium-native](https://github.com/sodium-friends/sodium-native).
-This is a work in progress so not all functions are implemented yet.
+This is a work in progress so all functions are not implemented yet.
 
 This module is organised into individual submodules which can be required
 independently for smaller bundles in the browser. To leverage automatic

crypto_aead.js

@@ -30,7 +30,7 @@ function crypto_aead_chacha20poly1305_ietf_encrypt (c, m, ad, nsec, npub, k) {
 }
 
 function crypto_aead_chacha20poly1305_ietf_encrypt_detached (c, mac, m, ad, nsec, npub, k) {
-  if (ad === null) return crypto_aead_chacha20poly1305_ietf_encrypt_detached(c, mac, m, new Uint8Array(0), nsec, npub, k)
+  if (ad === null) return crypto_aead_chacha20poly1305_ietf_encrypt(c, mac, m, new Uint8Array(0), nsec, npub, k)
 
   assert(c.byteLength === m.byteLength, 'ciphertext should be same length than message')
   assert(npub.byteLength === crypto_aead_chacha20poly1305_ietf_NPUBBYTES,
@@ -91,7 +91,7 @@ function crypto_aead_chacha20poly1305_ietf_decrypt (m, nsec, c, ad, npub, k) {
 }
 
 function crypto_aead_chacha20poly1305_ietf_decrypt_detached (m, nsec, c, mac, ad, npub, k) {
-  if (ad === null) return crypto_aead_chacha20poly1305_ietf_decrypt_detached(m, nsec, c, mac, new Uint8Array(0), npub, k)
+  if (ad === null) return crypto_aead_chacha20poly1305_ietf_decrypt(m, nsec, c, mac, new Uint8Array(0), npub, k)
 
   assert(c.byteLength === m.byteLength, 'message should be same length than ciphertext')
   assert(npub.byteLength === crypto_aead_chacha20poly1305_ietf_NPUBBYTES,
@@ -131,7 +131,7 @@ function crypto_aead_chacha20poly1305_ietf_decrypt_detached (m, nsec, c, mac, ad
   computed_mac.fill(0)
   slen.fill(0)
 
-  if (!ret) {
+  if (ret !== 0) {
     m.fill(0)
     throw new Error('could not verify data')
   }

crypto_auth.js

@@ -1,35 +1,72 @@
 /* eslint-disable camelcase */
-const { crypto_verify_32 } = require('./crypto_verify')
+const { crypto_verify_32, crypto_verify_64 } = require('./crypto_verify')
+const Sha256 = require('sha256-universal')
 const Sha512 = require('sha512-universal')
 const assert = require('nanoassert')
 
-const crypto_auth_BYTES = 32
-const crypto_auth_KEYBYTES = 32
+const crypto_auth_hmacsha256_BYTES = 32
+const crypto_auth_hmacsha256_KEYBYTES = 32
+const crypto_auth_hmacsha512_BYTES = 64
+const crypto_auth_hmacsha512_KEYBYTES = 32
+const crypto_auth_hmacsha512256_BYTES = 32
+const crypto_auth_hmacsha512256_KEYBYTES = 32
 
-function crypto_auth (out, input, k) {
-  assert(out.byteLength === crypto_auth_BYTES, "out should be 'crypto_auth_BYTES' in length")
-  assert(k.byteLength === crypto_auth_KEYBYTES, "key should be 'crypto_auth_KEYBYTES' in length")
+function crypto_auth_hmacsha256 (out, input, k) {
+  assert(out.byteLength === crypto_auth_hmacsha256_BYTES, "out should be 'crypto_auth_hmacsha256_BYTES' in length")
 
-  const out0 = new Uint8Array(64)
-  const hmac = Sha512.HMAC(k)
+  const hmac = Sha256.HMAC(key)
   hmac.update(input)
-  hmac.digest(out0)
+  return hmac.digest(out)
+}
+
+function crypto_auth_hmacsha256_verify (h, input, k) {
+  const correct = Sha256.HMAC(k).update(input).digest()
+
+  return crypto_verify_32(h, 0, correct, 0) | sodium_memcmp(correct, h, 32)
+}
+
+function crypto_auth_hmacsha512 (out, input, k) {
+  assert(out.byteLength === crypto_auth_hmacsha512_BYTES, "out should be 'crypto_auth_hmacsha512_BYTES' in length")
+
+  const hmac = Sha512.HMAC(key)
+  hmac.update(input)
+  return hmac.digest(out)
+}
+
+function crypto_auth_hmacsha512_verify (h, input, k) {
+  const correct = Sha512.HMAC(k).update(input).digest()
+
+  return crypto_verify_64(h, 0, correct, 0) | sodium_memcmp(correct, h, 64)
+}
+
+function crypto_auth_hmacsha512256 (out, input, k) {
+  assert(out.byteLength === crypto_auth_hmacsha512_BYTES, "out should be 'crypto_auth_hmacsha512256_BYTES' in length")
+  
+  const out0 = Buffer.alloc(64)
+  const hmac = Sha512.HMAC(key)
+  hmac.update(input)
+  hmac.digest(out)
 
   out.set(out0.subarray(0, 32))
 }
 
-function crypto_auth_verify (h, input, k) {
-  assert(h.byteLength === crypto_auth_BYTES, "h should be 'crypto_auth_BYTES' in length")
-  assert(k.byteLength === crypto_auth_KEYBYTES, "key should be 'crypto_auth_KEYBYTES' in length")
-
+function crypto_auth_hmacsha512256_verify (h, input, k) {
   const correct = Sha512.HMAC(k).update(input).digest()
 
-  return crypto_verify_32(h, 0, correct, 0)
+  return crypto_verify_32(h, 0, correct, 0) | sodium_memcmp(correct, h, 32)
 }
 
 module.exports = {
-  crypto_auth_BYTES,
-  crypto_auth_KEYBYTES,
-  crypto_auth,
-  crypto_auth_verify
+  crypto_auth_hmacsha256_BYTES,
+  crypto_auth_hmacsha256_KEYBYTES,
+  crypto_auth_hmacsha512_BYTES,
+  crypto_auth_hmacsha512_KEYBYTES,
+  crypto_auth_hmacsha512256_BYTES,
+  crypto_auth_hmacsha512256_KEYBYTES,
+  crypto_auth_hmacsha256,
+  crypto_auth_hmacsha256_verify,
+  crypto_auth_hmacsha512,
+  crypto_auth_hmacsha512_verify,
+  crypto_auth_hmacsha512256,
+  crypto_auth_hmacsha512256_verify
 }

crypto_box.js

@@ -3,13 +3,7 @@ const { crypto_hash_sha512 } = require('./crypto_hash')
 const { crypto_scalarmult, crypto_scalarmult_base } = require('./crypto_scalarmult')
 const { randombytes } = require('./randombytes')
 const { crypto_generichash_batch } = require('./crypto_generichash')
-const { crypto_stream_xsalsa20_MESSAGEBYTES_MAX } = require('./crypto_stream')
-const {
-  crypto_secretbox_open_easy,
-  crypto_secretbox_easy,
-  crypto_secretbox_detached,
-  crypto_secretbox_open_detached
-} = require('./crypto_secretbox')
+const { crypto_secretbox_open_easy, crypto_secretbox_easy } = require('./crypto_secretbox')
 const xsalsa20 = require('xsalsa20')
 const assert = require('nanoassert')
 
@@ -21,17 +15,8 @@ const crypto_box_BOXZEROBYTES = 16
 const crypto_box_SEALBYTES = 48
 const crypto_box_SEEDBYTES = 32
 const crypto_box_BEFORENMBYTES = 32
-const crypto_box_MACBYTES = 16
-
-const crypto_box_curve25519xsalsa20poly1305_MACBYTES = 16
-
-const crypto_box_MESSAGEBYTES_MAX =
-  crypto_stream_xsalsa20_MESSAGEBYTES_MAX -
-  crypto_box_curve25519xsalsa20poly1305_MACBYTES
 
 module.exports = {
-  crypto_box_easy,
-  crypto_box_open_easy,
   crypto_box_keypair,
   crypto_box_seed_keypair,
   crypto_box_seal,
@@ -43,8 +28,7 @@ module.exports = {
   crypto_box_BOXZEROBYTES,
   crypto_box_SEALBYTES,
   crypto_box_SEEDBYTES,
-  crypto_box_BEFORENMBYTES,
-  crypto_box_MACBYTES
+  crypto_box_BEFORENMBYTES
 }
 
 function crypto_box_keypair (pk, sk) {
@@ -53,6 +37,7 @@ function crypto_box_keypair (pk, sk) {
   randombytes(sk, 32)
   return crypto_scalarmult_base(pk, sk)
 }
+
 function crypto_box_seed_keypair (pk, sk, seed) {
   assert(pk.byteLength === crypto_box_PUBLICKEYBYTES, "pk should be 'crypto_box_PUBLICKEYBYTES' bytes")
   assert(sk.byteLength === crypto_box_SECRETKEYBYTES, "sk should be 'crypto_box_SECRETKEYBYTES' bytes")
@@ -110,87 +95,6 @@ function crypto_box_seal_open (m, c, pk, sk) {
   return crypto_secretbox_open_easy(m, c.subarray(epk.length), n, k)
 }
 
-function crypto_box_beforenm (k, pk, sk) {
-  const zero = new Uint8Array(16)
-  const s = new Uint8Array(32)
-
-  assert(crypto_scalarmult(s, sk, pk) === 0)
-
-  xsalsa20.core_hsalsa20(k, zero, s, xsalsa20.SIGMA)
-
-  return true
-}
-
-function crypto_box_detached_afternm (c, mac, m, n, k) {
-  return crypto_secretbox_detached(c, mac, m, n, k)
-}
-
-function crypto_box_detached (c, mac, m, n, pk, sk) {
-  check(mac, crypto_box_MACBYTES)
-  check(n, crypto_box_NONCEBYTES)
-  check(pk, crypto_box_PUBLICKEYBYTES)
-  check(sk, crypto_box_SECRETKEYBYTES)
-
-  const k = new Uint8Array(crypto_box_BEFORENMBYTES)
-
-  assert(crypto_box_beforenm(k, pk, sk))
-
-  const ret = crypto_box_detached_afternm(c, mac, m, n, k)
-  cleanup(k)
-
-  return ret
-}
-
-function crypto_box_easy (c, m, n, pk, sk) {
-  assert(
-    c.length >= m.length + crypto_box_MACBYTES,
-    "c should be at least 'm.length + crypto_box_MACBYTES' bytes"
-  )
-  assert(
-    m.length <= crypto_box_MESSAGEBYTES_MAX,
-    "m should be at most 'crypto_box_MESSAGEBYTES_MAX' bytes"
-  )
-
-  return crypto_box_detached(
-    c.subarray(crypto_box_MACBYTES, m.length + crypto_box_MACBYTES),
-    c.subarray(0, crypto_box_MACBYTES),
-    m,
-    n,
-    pk,
-    sk
-  )
-}
-
-function crypto_box_open_detached_afternm (m, c, mac, n, k) {
-  return crypto_secretbox_open_detached(m, c, mac, n, k)
-}
-
-function crypto_box_open_detached (m, c, mac, n, pk, sk) {
-  const k = new Uint8Array(crypto_box_BEFORENMBYTES)
-  assert(crypto_box_beforenm(k, pk, sk))
-
-  const ret = crypto_box_open_detached_afternm(m, c, mac, n, k)
-  cleanup(k)
-
-  return ret
-}
-
-function crypto_box_open_easy (m, c, n, pk, sk) {
-  assert(
-    c.length >= m.length + crypto_box_MACBYTES,
-    "c should be at least 'm.length + crypto_box_MACBYTES' bytes"
-  )
-
-  return crypto_box_open_detached(
-    m,
-    c.subarray(crypto_box_MACBYTES, m.length + crypto_box_MACBYTES),
-    c.subarray(0, crypto_box_MACBYTES),
-    n,
-    pk,
-    sk
-  )
-}
-
 function check (buf, len) {
   if (!buf || (len && buf.length < len)) throw new Error('Argument must be a buffer' + (len ? ' of length ' + len : ''))
 }

crypto_onetimeauth.js

@@ -23,6 +23,7 @@ function crypto_onetimeauth (mac, msg, key) {
   var s = new Poly1305(key)
   s.update(msg, 0, msg.byteLength)
   s.finish(mac, 0)
+  return true
 }
 
 function crypto_onetimeauth_verify (mac, msg, key) {
@@ -32,5 +33,5 @@ function crypto_onetimeauth_verify (mac, msg, key) {
 
   var tmp = new Uint8Array(16)
   crypto_onetimeauth(tmp, msg, key)
-  return crypto_verify_16(mac, 0, tmp, 0)
+  return crypto_verify_16(mac, 0, tmp, 0) === 0
 }

crypto_secretbox.js

@@ -37,6 +37,7 @@ function crypto_secretbox (c, m, n, k) {
     c.subarray(0, crypto_onetimeauth_KEYBYTES)
   )
   c.fill(0, 0, crypto_secretbox_BOXZEROBYTES)
+  return 0
 }
 
 function crypto_secretbox_open (m, c, n, k) {
@@ -68,8 +69,8 @@ function crypto_secretbox_detached (o, mac, msg, n, k) {
 
   const tmp = new Uint8Array(msg.byteLength + mac.byteLength)
   crypto_secretbox_easy(tmp, msg, n, k)
-  mac.set(tmp.subarray(0, mac.byteLength))
-  o.set(tmp.subarray(mac.byteLength))
+  o.set(tmp.subarray(0, msg.byteLength))
+  mac.set(tmp.subarray(msg.byteLength))
   return true
 }
 
@@ -80,8 +81,8 @@ function crypto_secretbox_open_detached (msg, o, mac, n, k) {
   assert(k.byteLength === crypto_secretbox_KEYBYTES, "k must be 'crypto_secretbox_KEYBYTES' bytes")
 
   const tmp = new Uint8Array(o.byteLength + mac.byteLength)
-  tmp.set(mac)
-  tmp.set(o, mac.byteLength)
+  tmp.set(o)
+  tmp.set(mac, msg.byteLength)
   return crypto_secretbox_open_easy(msg, tmp, n, k)
 }
 
@@ -93,8 +94,9 @@ function crypto_secretbox_easy (o, msg, n, k) {
   const m = new Uint8Array(crypto_secretbox_ZEROBYTES + msg.byteLength)
   const c = new Uint8Array(m.byteLength)
   m.set(msg, crypto_secretbox_ZEROBYTES)
-  crypto_secretbox(c, m, n, k)
+  if (crypto_secretbox(c, m, n, k) === false) return false
   o.set(c.subarray(crypto_secretbox_BOXZEROBYTES))
+  return true
 }
 
 function crypto_secretbox_open_easy (msg, box, n, k) {

crypto_sign.js

@@ -8,19 +8,11 @@ const {
   inv25519, unpack25519
 } = require('./internal/ed25519')
 const { randombytes } = require('./randombytes')
-const { crypto_scalarmult_BYTES } = require('./crypto_scalarmult.js')
-const { crypto_hash_sha512_BYTES } = require('./crypto_hash.js')
-const assert = require('nanoassert')
 
-const crypto_sign_ed25519_PUBLICKEYBYTES = 32
-const crypto_sign_ed25519_SECRETKEYBYTES = 64
-const crypto_sign_ed25519_SEEDBYTES = 32
-const crypto_sign_ed25519_BYTES = 64
-
-const crypto_sign_BYTES = crypto_sign_ed25519_BYTES
-const crypto_sign_PUBLICKEYBYTES = crypto_sign_ed25519_PUBLICKEYBYTES
-const crypto_sign_SECRETKEYBYTES = crypto_sign_ed25519_SECRETKEYBYTES
-const crypto_sign_SEEDBYTES = crypto_sign_ed25519_SEEDBYTES
+const crypto_sign_BYTES = 64
+const crypto_sign_PUBLICKEYBYTES = 32
+const crypto_sign_SECRETKEYBYTES = 64
+const crypto_sign_SEEDBYTES = 32
 
 module.exports = {
   crypto_sign_keypair,
@@ -32,16 +24,7 @@ module.exports = {
   crypto_sign_BYTES,
   crypto_sign_PUBLICKEYBYTES,
   crypto_sign_SECRETKEYBYTES,
-  crypto_sign_SEEDBYTES,
-  crypto_sign_ed25519_PUBLICKEYBYTES,
-  crypto_sign_ed25519_SECRETKEYBYTES,
-  crypto_sign_ed25519_SEEDBYTES,
-  crypto_sign_ed25519_BYTES,
-  crypto_sign_ed25519_pk_to_curve25519,
-  crypto_sign_ed25519_sk_to_curve25519,
-  crypto_sign_ed25519_sk_to_pk,
-  unpackneg,
-  pack
+  crypto_sign_SEEDBYTES
 }
 
 function set25519 (r, a) {
@@ -102,8 +85,6 @@ function pack (r, p) {
 }
 
 function scalarmult (p, q, s) {
-  // don't mutate q
-  var h = [gf(q[0]), gf(q[1]), gf(q[2]), gf(q[3])]
   var b, i
   set25519(p[0], gf0)
   set25519(p[1], gf1)
@@ -111,10 +92,10 @@ function scalarmult (p, q, s) {
   set25519(p[3], gf0)
   for (i = 255; i >= 0; --i) {
     b = (s[(i / 8) | 0] >> (i & 7)) & 1
-    cswap(p, h, b)
-    add(h, p)
+    cswap(p, q, b)
+    add(q, p)
     add(p, p)
-    cswap(p, h, b)
+    cswap(p, q, b)
   }
 }
 
@@ -145,6 +126,7 @@ function crypto_sign_keypair (pk, sk, seeded) {
   pack(pk, p)
 
   for (i = 0; i < 32; i++) sk[i + 32] = pk[i]
+  return 0
 }
 
 function crypto_sign_seed_keypair (pk, sk, seed) {
@@ -260,18 +242,16 @@ function unpackneg (r, p) {
 
   S(chk, r[0])
   M(chk, chk, den)
-  if (!neq25519(chk, num)) M(r[0], r[0], I)
+  if (neq25519(chk, num)) M(r[0], r[0], I)
 
   S(chk, r[0])
   M(chk, chk, den)
-  if (!neq25519(chk, num)) return false
+  if (neq25519(chk, num)) return -1
 
-  if (par25519(r[0]) === (p[31] >> 7)) {
-    Z(r[0], gf(), r[0])
-  }
+  if (par25519(r[0]) === (p[31] >> 7)) Z(r[0], gf0, r[0])
 
   M(r[3], r[0], r[1])
-  return true
+  return 0
 }
 
 /* eslint-disable no-unused-vars */
@@ -290,7 +270,7 @@ function crypto_sign_open (msg, sm, pk) {
   mlen = -1
   if (n < 64) return false
 
-  if (!unpackneg(q, pk)) return false
+  if (unpackneg(q, pk)) return false
 
   for (i = 0; i < n; i++) m[i] = sm[i]
   for (i = 0; i < 32; i++) m[i + 32] = pk[i]
@@ -303,7 +283,7 @@ function crypto_sign_open (msg, sm, pk) {
   pack(t, p)
 
   n -= 64
-  if (!crypto_verify_32(sm, 0, t, 0)) {
+  if (crypto_verify_32(sm, 0, t, 0)) {
     for (i = 0; i < n; i++) m[i] = 0
     return false
     // throw new Error('crypto_sign_open failed')
@@ -337,133 +317,6 @@ function neq25519 (a, b) {
   return crypto_verify_32(c, 0, d, 0)
 }
 
-function ed25519_mul_l (p, q) {
-  scalarmult(p, q, L)
-}
-
-function ed25519_is_on_main_subgroup (p) {
-  var pl = [gf(), gf(), gf(), gf()]
-
-  ed25519_mul_l(pl, p)
-
-  var zero = 0
-  for (let i = 0; i < 16; i++) {
-    zero |= (pl[0][i] & 0xffff)
-  }
-
-  return zero === 0
-}
-
-function crypto_sign_ed25519_pk_to_curve25519 (x25519_pk, ed25519_pk) {
-  check(x25519_pk, crypto_sign_PUBLICKEYBYTES)
-  check(ed25519_pk, crypto_sign_ed25519_PUBLICKEYBYTES)
-
-  var a = [gf(), gf(), gf(), gf()]
-  var x = gf([1])
-  var one_minus_y = gf([1])
-
-  assert(
-    isSmallOrder(ed25519_pk) &&
-    unpackneg(a, ed25519_pk) &&
-    ed25519_is_on_main_subgroup(a), 'Cannot convert key: bad point')
-
-  for (let i = 0; i < a.length; i++) {
-    pack25519(x25519_pk, a[i])
-  }
-
-  Z(one_minus_y, one_minus_y, a[1])
-  A(x, x, a[1])
-  inv25519(one_minus_y, one_minus_y)
-  M(x, x, one_minus_y)
-  pack25519(x25519_pk, x)
-
-  return 0
-}
-
-function isSmallOrder (s) {
-  Uint8Array.from([])
-
-  var bad_points = [
-    // 0 (order 4)
-    Uint8Array.from([0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00]),
-
-    // 1 (order 1)
-    Uint8Array.from([0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00]),
-
-    // 2707385501144840649318225287225658788936804267575313519463743609750303402022(order 8)
-    Uint8Array.from([0x26, 0xe8, 0x95, 0x8f, 0xc2, 0xb2, 0x27, 0xb0, 0x45, 0xc3,
-      0xf4, 0x89, 0xf2, 0xef, 0x98, 0xf0, 0xd5, 0xdf, 0xac, 0x05, 0xd3,
-      0xc6, 0x33, 0x39, 0xb1, 0x38, 0x02, 0x88, 0x6d, 0x53, 0xfc, 0x05]),
-
-    // 55188659117513257062467267217118295137698188065244968500265048394206261417927 (order 8)
-    Uint8Array.from([0xc7, 0x17, 0x6a, 0x70, 0x3d, 0x4d, 0xd8, 0x4f, 0xba, 0x3c,
-      0x0b, 0x76, 0x0d, 0x10, 0x67, 0x0f, 0x2a, 0x20, 0x53, 0xfa, 0x2c,
-      0x39, 0xcc, 0xc6, 0x4e, 0xc7, 0xfd, 0x77, 0x92, 0xac, 0x03, 0x7a]),
-
-    // p-1 (order 2)
-    Uint8Array.from([0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
-      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
-      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f]),
-
-    //  p (=0 order 4)
-    Uint8Array.from([0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
-      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
-      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f]),
-
-    // p + 1 (=1 order 1)
-    Uint8Array.from([0xee, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
-      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
-      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f])
-  ]
-
-  var c = new Uint8Array(7)
-  var j
-
-  check(bad_points, 7)
-  for (let i = 0; i < bad_points.length; i++) {
-    for (j = 0; j < 31; j++) {
-      c[i] |= s[j] ^ bad_points[i][j]
-    }
-  }
-
-  for (let i = 0; i < bad_points.length; i++) {
-    c[i] |= (s[j] & 0x7f) ^ bad_points[i][j]
-  }
-
-  var k = 0
-  for (let i = 0; i < bad_points.length; i++) {
-    k |= (c[i] - 1)
-  }
-
-  return ((k >> 8) & 1) === 0
-}
-
-function crypto_sign_ed25519_sk_to_pk (pk, sk) {
-  check(pk, crypto_sign_ed25519_PUBLICKEYBYTES)
-  pk.set(sk.subarray(crypto_sign_ed25519_SEEDBYTES))
-  return pk
-}
-
-function crypto_sign_ed25519_sk_to_curve25519 (curveSk, edSk) {
-  assert(curveSk && curveSk.byteLength === crypto_scalarmult_BYTES, "curveSk must be 'crypto_sign_SECRETKEYBYTES' long")
-  assert(edSk && edSk.byteLength === crypto_sign_ed25519_SECRETKEYBYTES, "edSk must be 'crypto_sign_ed25519_SECRETKEYBYTES' long")
-
-  var h = new Uint8Array(crypto_hash_sha512_BYTES)
-  crypto_hash(h, edSk, 32)
-
-  h[0] &= 248
-  h[31] &= 127
-  h[31] |= 64
-
-  curveSk.set(h.subarray(0, crypto_scalarmult_BYTES))
-  h.fill(0)
-  return curveSk
-}
-
-function check (buf, len, arg = 'Argument') {
-  if (!buf || (len && buf.length < len)) throw new Error(arg + ' must be a buffer' + (len ? ' of length ' + len : ''))
+function check (buf, len) {
+  if (!buf || (len && buf.length < len)) throw new Error('Argument must be a buffer' + (len ? ' of length ' + len : ''))
 }

crypto_stream.js

@@ -6,7 +6,6 @@ if (new Uint16Array([1])[0] !== 1) throw new Error('Big endian architecture is n
 exports.crypto_stream_KEYBYTES = 32
 exports.crypto_stream_NONCEBYTES = 24
 exports.crypto_stream_PRIMITIVE = 'xsalsa20'
-exports.crypto_stream_xsalsa20_MESSAGEBYTES_MAX = Number.MAX_SAFE_INTEGER
 
 exports.crypto_stream = function (c, nonce, key) {
   c.fill(0)

crypto_verify.js

@@ -1,8 +1,7 @@
 /* eslint-disable camelcase */
 module.exports = {
   crypto_verify_16,
-  crypto_verify_32,
-  crypto_verify_64
+  crypto_verify_32
 }
 
 function vn (x, xi, y, yi, n) {
@@ -17,13 +16,13 @@ Object.defineProperty(module.exports, 'vn', {
 })
 
 function crypto_verify_16 (x, xi, y, yi) {
-  return vn(x, xi, y, yi, 16) === 0
+  return vn(x, xi, y, yi, 16)
 }
 
 function crypto_verify_32 (x, xi, y, yi) {
-  return vn(x, xi, y, yi, 32) === 0
+  return vn(x, xi, y, yi, 32)
 }
 
 function crypto_verify_64 (x, xi, y, yi) {
-  return vn(x, xi, y, yi, 64) === 0
+  return vn(x, xi, y, yi, 64)
 }

memory.js

@@ -1,28 +1,21 @@
 /* eslint-disable camelcase */
+var MessageChannel = global.MessageChannel
+if (MessageChannel == null) ({ MessageChannel } = require('worker' + '_threads'))
 
 function sodium_malloc (n) {
   return new Uint8Array(n)
 }
 
+const sink = new MessageChannel()
 function sodium_free (n) {
   sodium_memzero(n)
-  loadSink().port1.postMessage(n.buffer, [n.buffer])
+  sink.port1.postMessage(n.buffer, [n.buffer])
 }
 
 function sodium_memzero (arr) {
   arr.fill(0)
 }
 
-var sink
-
-function loadSink () {
-  if (sink) return sink
-  var MessageChannel = globalThis.MessageChannel
-  if (MessageChannel == null) ({ MessageChannel } = require('worker' + '_threads'))
-  sink = new MessageChannel()
-  return sink
-}
-
 module.exports = {
   sodium_malloc,
   sodium_free,

package.json

@@ -1,6 +1,6 @@
 {
   "name": "sodium-javascript",
-  "version": "0.7.4",
+  "version": "0.6.2",
   "description": "WIP - a pure javascript version of sodium-native",
   "main": "index.js",
   "dependencies": {
@@ -14,8 +14,8 @@
   },
   "devDependencies": {
     "browserify": "^16.5.1",
-    "sodium-test": "^0.10.0",
-    "standard": "^15.0.1",
+    "sodium-test": "^0.9.0",
+    "standard": "^14.3.4",
     "tape-run": "^7.0.0"
   },
   "standard": {
@@ -24,8 +24,10 @@
     ]
   },
   "browser": {
-    "crypto": false,
-    "worker_threads": false
+    "crypto": false
+  },
+  "react-native": {
+    "crypto": "crypto"
   },
   "scripts": {
     "pretest": "standard",

randombytes.js

@@ -2,7 +2,7 @@ var assert = require('nanoassert')
 
 var randombytes = (function () {
   var QUOTA = 65536 // limit for QuotaExceededException
-  var crypto = globalThis.crypto || globalThis.msCrypto
+  var crypto = global.crypto || global.msCrypto
 
   function browserBytes (out, n) {
     for (let i = 0; i < n; i += QUOTA) {

test.js

@@ -1,3 +1,3 @@
 require('sodium-test')(require('.'))
 
-if ((typeof window !== 'undefined') && window.close) window.close()
+if (typeof window !== 'undefined') window.close()