0.8.0

* Use `globalThis` instead of `global`

* Update `standard`

.gitignore

@@ -1 +1,2 @@
 node_modules
+package-lock.json

.travis.yml

@@ -0,0 +1,18 @@
+language: node_js
+node_js:
+  - lts/*
+env:
+  global:
+    - MOZ_HEADLESS=1
+services:
+  - xvfb
+addons:
+  firefox: latest
+  chrome: stable
+cache:
+  npm: false
+
+script:
+  - npm test
+  - xvfb-run --auto-servernum npm run test-browser -- --browser chrome
+  - xvfb-run --auto-servernum npm run test-browser -- --browser firefox

README.md

@@ -1,31 +1,29 @@
-# sodium-javascript
+# `sodium-javascript`
 
-WIP - a pure javascript version of [sodium-native](https://github.com/mafintosh/sodium-native).
+[![Build Status](https://travis-ci.org/sodium-friends/sodium-javascript.svg?branch=master)](https://travis-ci.org/sodium-friends/sodium-javascript)
+
+> WIP - a pure javascript version of [sodium-native](https://github.com/sodium-friends/sodium-native).
 Based on tweetnacl
 
-```
-npm install sodium-javascript
-```
-
 ## Usage
 
 ``` js
-var sodium = require('sodium-javascript')
+const sodium = require('sodium-javascript')
 
-var key = new Buffer(sodium.crypto_secretbox_KEYBYTES)
-var nonce = new Buffer(sodium.crypto_secretbox_NONCEBYTES)
+const key = Buffer.alloc(sodium.crypto_secretbox_KEYBYTES)
+const nonce = Buffer.alloc(sodium.crypto_secretbox_NONCEBYTES)
 
 sodium.randombytes_buf(key)
 sodium.randombytes_buf(nonce)
 
-var message = new Buffer('Hello, World!')
-var cipher = new Buffer(message.length + sodium.crypto_secretbox_MACBYTES)
+const message = Buffer.from('Hello, World!')
+const cipher = Buffer.alloc(message.length + sodium.crypto_secretbox_MACBYTES)
 
 sodium.crypto_secretbox_easy(cipher, message, nonce, key)
 
 console.log('Encrypted:', cipher)
 
-var plainText = new Buffer(cipher.length - sodium.crypto_secretbox_MACBYTES)
+const plainText = Buffer.alloc(cipher.length - sodium.crypto_secretbox_MACBYTES)
 
 sodium.crypto_secretbox_open_easy(plainText, cipher, nonce, key)
 
@@ -34,9 +32,20 @@ console.log('Plaintext:', plainText.toString())
 
 ## API
 
-See [sodium-native](https://github.com/mafintosh/sodium-native).
-This is a work in progress so all functions are not implemented yet.
+See [sodium-native](https://github.com/sodium-friends/sodium-native).
+This is a work in progress so not all functions are implemented yet.
+
+This module is organised into individual submodules which can be required
+independently for smaller bundles in the browser. To leverage automatic
+switching between `sodium-javascript` and `sodium-native`, see
+[`sodium-universal`](https://github.com/sodium-friends/sodium-universal).
+
+## Install
+
+```
+npm install sodium-javascript
+```
 
 ## License
 
-MIT
+[MIT](LICENSE)

crypto_aead.js

@@ -1,6 +1,7 @@
+/* eslint-disable camelcase */
 const { crypto_stream_chacha20_ietf, crypto_stream_chacha20_ietf_xor_ic } = require('./crypto_stream_chacha20')
 const { crypto_verify_16 } = require('./crypto_verify')
-const Poly1305 = require('./poly1305.js')
+const Poly1305 = require('./internal/poly1305')
 const assert = require('nanoassert')
 
 const crypto_aead_chacha20poly1305_ietf_KEYBYTES = 32
@@ -29,7 +30,7 @@ function crypto_aead_chacha20poly1305_ietf_encrypt (c, m, ad, nsec, npub, k) {
 }
 
 function crypto_aead_chacha20poly1305_ietf_encrypt_detached (c, mac, m, ad, nsec, npub, k) {
-  if (ad === null) return crypto_aead_chacha20poly1305_ietf_encrypt(c, mac, m, new Uint8Array(0), nsec, npub, k)
+  if (ad === null) return crypto_aead_chacha20poly1305_ietf_encrypt_detached(c, mac, m, new Uint8Array(0), nsec, npub, k)
 
   assert(c.byteLength === m.byteLength, 'ciphertext should be same length than message')
   assert(npub.byteLength === crypto_aead_chacha20poly1305_ietf_NPUBBYTES,
@@ -90,7 +91,7 @@ function crypto_aead_chacha20poly1305_ietf_decrypt (m, nsec, c, ad, npub, k) {
 }
 
 function crypto_aead_chacha20poly1305_ietf_decrypt_detached (m, nsec, c, mac, ad, npub, k) {
-  if (ad === null) return crypto_aead_chacha20poly1305_ietf_decrypt(m, nsec, c, mac, new Uint8Array(0), npub, k)
+  if (ad === null) return crypto_aead_chacha20poly1305_ietf_decrypt_detached(m, nsec, c, mac, new Uint8Array(0), npub, k)
 
   assert(c.byteLength === m.byteLength, 'message should be same length than ciphertext')
   assert(npub.byteLength === crypto_aead_chacha20poly1305_ietf_NPUBBYTES,
@@ -130,7 +131,7 @@ function crypto_aead_chacha20poly1305_ietf_decrypt_detached (m, nsec, c, mac, ad
   computed_mac.fill(0)
   slen.fill(0)
 
-  if (ret !== 0) {
+  if (!ret) {
     m.fill(0)
     throw new Error('could not verify data')
   }

crypto_auth.js

@@ -0,0 +1,35 @@
+/* eslint-disable camelcase */
+const { crypto_verify_32 } = require('./crypto_verify')
+const Sha512 = require('sha512-universal')
+const assert = require('nanoassert')
+
+const crypto_auth_BYTES = 32
+const crypto_auth_KEYBYTES = 32
+
+function crypto_auth (out, input, k) {
+  assert(out.byteLength === crypto_auth_BYTES, "out should be 'crypto_auth_BYTES' in length")
+  assert(k.byteLength === crypto_auth_KEYBYTES, "key should be 'crypto_auth_KEYBYTES' in length")
+
+  const out0 = new Uint8Array(64)
+  const hmac = Sha512.HMAC(k)
+  hmac.update(input)
+  hmac.digest(out0)
+
+  out.set(out0.subarray(0, 32))
+}
+
+function crypto_auth_verify (h, input, k) {
+  assert(h.byteLength === crypto_auth_BYTES, "h should be 'crypto_auth_BYTES' in length")
+  assert(k.byteLength === crypto_auth_KEYBYTES, "key should be 'crypto_auth_KEYBYTES' in length")
+
+  const correct = Sha512.HMAC(k).update(input).digest()
+
+  return crypto_verify_32(h, 0, correct, 0)
+}
+
+module.exports = {
+  crypto_auth_BYTES,
+  crypto_auth_KEYBYTES,
+  crypto_auth,
+  crypto_auth_verify
+}

crypto_box.js

@@ -1,45 +1,59 @@
+/* eslint-disable camelcase */
 const { crypto_hash_sha512 } = require('./crypto_hash')
 const { crypto_scalarmult, crypto_scalarmult_base } = require('./crypto_scalarmult')
 const { randombytes } = require('./randombytes')
 const { crypto_generichash_batch } = require('./crypto_generichash')
-const { crypto_secretbox_open_easy, crypto_secretbox_easy } = require('./crypto_secretbox')
+const { crypto_stream_xsalsa20_MESSAGEBYTES_MAX } = require('./crypto_stream')
+const {
+  crypto_secretbox_open_easy,
+  crypto_secretbox_easy,
+  crypto_secretbox_detached,
+  crypto_secretbox_open_detached
+} = require('./crypto_secretbox')
 const xsalsa20 = require('xsalsa20')
 const assert = require('nanoassert')
 
-var crypto_box_PUBLICKEYBYTES = 32,
-    crypto_box_SECRETKEYBYTES = 32,
-    crypto_box_BEFORENMBYTES = 32,
-    crypto_box_NONCEBYTES = 24,
-    crypto_box_ZEROBYTES = 32,
-    crypto_box_BOXZEROBYTES = 16,
-    crypto_box_SEALBYTES = 48,
-    crypto_box_SEEDBYTES = 32,
-    crypto_box_BEFORENMBYTES = 32
+const crypto_box_PUBLICKEYBYTES = 32
+const crypto_box_SECRETKEYBYTES = 32
+const crypto_box_NONCEBYTES = 24
+const crypto_box_ZEROBYTES = 32
+const crypto_box_BOXZEROBYTES = 16
+const crypto_box_SEALBYTES = 48
+const crypto_box_SEEDBYTES = 32
+const crypto_box_BEFORENMBYTES = 32
+const crypto_box_MACBYTES = 16
+
+const crypto_box_curve25519xsalsa20poly1305_MACBYTES = 16
+
+const crypto_box_MESSAGEBYTES_MAX =
+  crypto_stream_xsalsa20_MESSAGEBYTES_MAX -
+  crypto_box_curve25519xsalsa20poly1305_MACBYTES
 
 module.exports = {
+  crypto_box_easy,
+  crypto_box_open_easy,
   crypto_box_keypair,
   crypto_box_seed_keypair,
   crypto_box_seal,
   crypto_box_seal_open,
   crypto_box_PUBLICKEYBYTES,
   crypto_box_SECRETKEYBYTES,
-  crypto_box_BEFORENMBYTES,
   crypto_box_NONCEBYTES,
   crypto_box_ZEROBYTES,
   crypto_box_BOXZEROBYTES,
   crypto_box_SEALBYTES,
   crypto_box_SEEDBYTES,
-  crypto_box_BEFORENMBYTES
+  crypto_box_BEFORENMBYTES,
+  crypto_box_MACBYTES
 }
 
-function crypto_box_keypair(pk, sk) {
+function crypto_box_keypair (pk, sk) {
   check(pk, crypto_box_PUBLICKEYBYTES)
   check(sk, crypto_box_SECRETKEYBYTES)
   randombytes(sk, 32)
   return crypto_scalarmult_base(pk, sk)
 }
-
-function crypto_box_seed_keypair(pk, sk, seed) {
+function crypto_box_seed_keypair (pk, sk, seed) {
   assert(pk.byteLength === crypto_box_PUBLICKEYBYTES, "pk should be 'crypto_box_PUBLICKEYBYTES' bytes")
   assert(sk.byteLength === crypto_box_SECRETKEYBYTES, "sk should be 'crypto_box_SECRETKEYBYTES' bytes")
   assert(sk.byteLength === crypto_box_SEEDBYTES, "sk should be 'crypto_box_SEEDBYTES' bytes")
@@ -52,7 +66,7 @@ function crypto_box_seed_keypair(pk, sk, seed) {
   return crypto_scalarmult_base(pk, sk)
 }
 
-function crypto_box_seal(c, m, pk) {
+function crypto_box_seal (c, m, pk) {
   check(c, crypto_box_SEALBYTES + m.length)
   check(pk, crypto_box_PUBLICKEYBYTES)
 
@@ -61,7 +75,7 @@ function crypto_box_seal(c, m, pk) {
   crypto_box_keypair(epk, esk)
 
   var n = new Uint8Array(crypto_box_NONCEBYTES)
-  crypto_generichash_batch(n, [ epk, pk ])
+  crypto_generichash_batch(n, [epk, pk])
 
   var s = new Uint8Array(crypto_box_PUBLICKEYBYTES)
   crypto_scalarmult(s, esk, pk)
@@ -75,7 +89,7 @@ function crypto_box_seal(c, m, pk) {
   cleanup(esk)
 }
 
-function crypto_box_seal_open(m, c, pk, sk) {
+function crypto_box_seal_open (m, c, pk, sk) {
   check(c, crypto_box_SEALBYTES)
   check(m, c.length - crypto_box_SEALBYTES)
   check(pk, crypto_box_PUBLICKEYBYTES)
@@ -84,7 +98,7 @@ function crypto_box_seal_open(m, c, pk, sk) {
   var epk = c.subarray(0, crypto_box_PUBLICKEYBYTES)
 
   var n = new Uint8Array(crypto_box_NONCEBYTES)
-  crypto_generichash_batch(n, [ epk, pk ])
+  crypto_generichash_batch(n, [epk, pk])
 
   var s = new Uint8Array(crypto_box_PUBLICKEYBYTES)
   crypto_scalarmult(s, sk, epk)
@@ -96,10 +110,91 @@ function crypto_box_seal_open(m, c, pk, sk) {
   return crypto_secretbox_open_easy(m, c.subarray(epk.length), n, k)
 }
 
+function crypto_box_beforenm (k, pk, sk) {
+  const zero = new Uint8Array(16)
+  const s = new Uint8Array(32)
+
+  assert(crypto_scalarmult(s, sk, pk) === 0)
+
+  xsalsa20.core_hsalsa20(k, zero, s, xsalsa20.SIGMA)
+
+  return true
+}
+
+function crypto_box_detached_afternm (c, mac, m, n, k) {
+  return crypto_secretbox_detached(c, mac, m, n, k)
+}
+
+function crypto_box_detached (c, mac, m, n, pk, sk) {
+  check(mac, crypto_box_MACBYTES)
+  check(n, crypto_box_NONCEBYTES)
+  check(pk, crypto_box_PUBLICKEYBYTES)
+  check(sk, crypto_box_SECRETKEYBYTES)
+
+  const k = new Uint8Array(crypto_box_BEFORENMBYTES)
+
+  assert(crypto_box_beforenm(k, pk, sk))
+
+  const ret = crypto_box_detached_afternm(c, mac, m, n, k)
+  cleanup(k)
+
+  return ret
+}
+
+function crypto_box_easy (c, m, n, pk, sk) {
+  assert(
+    c.length >= m.length + crypto_box_MACBYTES,
+    "c should be at least 'm.length + crypto_box_MACBYTES' bytes"
+  )
+  assert(
+    m.length <= crypto_box_MESSAGEBYTES_MAX,
+    "m should be at most 'crypto_box_MESSAGEBYTES_MAX' bytes"
+  )
+
+  return crypto_box_detached(
+    c.subarray(crypto_box_MACBYTES, m.length + crypto_box_MACBYTES),
+    c.subarray(0, crypto_box_MACBYTES),
+    m,
+    n,
+    pk,
+    sk
+  )
+}
+
+function crypto_box_open_detached_afternm (m, c, mac, n, k) {
+  return crypto_secretbox_open_detached(m, c, mac, n, k)
+}
+
+function crypto_box_open_detached (m, c, mac, n, pk, sk) {
+  const k = new Uint8Array(crypto_box_BEFORENMBYTES)
+  assert(crypto_box_beforenm(k, pk, sk))
+
+  const ret = crypto_box_open_detached_afternm(m, c, mac, n, k)
+  cleanup(k)
+
+  return ret
+}
+
+function crypto_box_open_easy (m, c, n, pk, sk) {
+  assert(
+    c.length >= m.length + crypto_box_MACBYTES,
+    "c should be at least 'm.length + crypto_box_MACBYTES' bytes"
+  )
+
+  return crypto_box_open_detached(
+    m,
+    c.subarray(crypto_box_MACBYTES, m.length + crypto_box_MACBYTES),
+    c.subarray(0, crypto_box_MACBYTES),
+    n,
+    pk,
+    sk
+  )
+}
+
 function check (buf, len) {
   if (!buf || (len && buf.length < len)) throw new Error('Argument must be a buffer' + (len ? ' of length ' + len : ''))
 }
 
-function cleanup(arr) {
-  for (var i = 0; i < arr.length; i++) arr[i] = 0;
+function cleanup (arr) {
+  for (let i = 0; i < arr.length; i++) arr[i] = 0
 }

crypto_generichash.js

@@ -31,6 +31,6 @@ module.exports.crypto_generichash_instance = function (key, outlen) {
   return blake2b(outlen, key)
 }
 
-blake2b.ready(function (err) {
+blake2b.ready(function (_) {
   module.exports.crypto_generichash_WASM_LOADED = blake2b.WASM_LOADED
 })

crypto_hash.js

@@ -1,10 +1,11 @@
-const sha512 = require('sha512-wasm')
+/* eslint-disable camelcase */
+const sha512 = require('sha512-universal')
 const assert = require('nanoassert')
 
 if (new Uint16Array([1])[0] !== 1) throw new Error('Big endian architecture is not supported.')
 
-var crypto_hash_sha512_BYTES = 64
-var crypto_hash_BYTES = crypto_hash_sha512_BYTES
+const crypto_hash_sha512_BYTES = 64
+const crypto_hash_BYTES = crypto_hash_sha512_BYTES
 
 function crypto_hash_sha512 (out, m, n) {
   assert(out.byteLength === crypto_hash_sha512_BYTES, "out must be 'crypto_hash_sha512_BYTES' bytes long")

crypto_hash_sha256.js

@@ -1,9 +1,10 @@
-const sha256 = require('sha256-wasm')
+/* eslint-disable camelcase */
+const sha256 = require('sha256-universal')
 const assert = require('nanoassert')
 
 if (new Uint16Array([1])[0] !== 1) throw new Error('Big endian architecture is not supported.')
 
-var crypto_hash_sha256_BYTES = 32
+const crypto_hash_sha256_BYTES = 32
 
 function crypto_hash_sha256 (out, m, n) {
   assert(out.byteLength === crypto_hash_sha256_BYTES, "out must be 'crypto_hash_sha256_BYTES' bytes long")

crypto_kdf.js

@@ -1,6 +1,7 @@
-var assert = require('nanoassert')
-var randombytes_buf = require('./randombytes').randombytes_buf
-var blake2b = require('blake2b')
+/* eslint-disable camelcase */
+const assert = require('nanoassert')
+const randombytes_buf = require('./randombytes').randombytes_buf
+const blake2b = require('blake2b')
 
 module.exports.crypto_kdf_PRIMITIVE = 'blake2b'
 module.exports.crypto_kdf_BYTES_MIN = 16
@@ -8,7 +9,7 @@ module.exports.crypto_kdf_BYTES_MAX = 64
 module.exports.crypto_kdf_CONTEXTBYTES = 8
 module.exports.crypto_kdf_KEYBYTES = 32
 
-function STORE64_LE(dest, int) {
+function STORE64_LE (dest, int) {
   var mul = 1
   var i = 0
   dest[0] = int & 0xFF

crypto_kx.js

@@ -1,11 +1,12 @@
+/* eslint-disable camelcase */
 const { crypto_scalarmult_base } = require('./crypto_scalarmult')
 const { crypto_generichash } = require('./crypto_generichash')
 const { randombytes_buf } = require('./randombytes')
 const assert = require('nanoassert')
 
-var crypto_kx_SEEDBYTES = 32
-var crypto_kx_PUBLICKEYBYTES = 32
-var crypto_kx_SECRETKEYBYTES = 32
+const crypto_kx_SEEDBYTES = 32
+const crypto_kx_PUBLICKEYBYTES = 32
+const crypto_kx_SECRETKEYBYTES = 32
 
 function crypto_kx_keypair (pk, sk) {
   assert(pk.byteLength === crypto_kx_PUBLICKEYBYTES, "pk must be 'crypto_kx_PUBLICKEYBYTES' bytes")

crypto_onetimeauth.js

@@ -1,20 +1,36 @@
-const poly1305 = require('./poly1305')
+/* eslint-disable camelcase */
+const assert = require('nanoassert')
+const Poly1305 = require('./internal/poly1305')
 const { crypto_verify_16 } = require('./crypto_verify')
 
+const crypto_onetimeauth_BYTES = 16
+const crypto_onetimeauth_KEYBYTES = 32
+const crypto_onetimeauth_PRIMITIVE = 'poly1305'
+
 module.exports = {
   crypto_onetimeauth,
-  crypto_onetimeauth_verify
+  crypto_onetimeauth_verify,
+  crypto_onetimeauth_BYTES,
+  crypto_onetimeauth_KEYBYTES,
+  crypto_onetimeauth_PRIMITIVE
 }
 
-function crypto_onetimeauth(out, outpos, m, mpos, n, k) {
-  var s = new poly1305(k);
-  s.update(m, mpos, n);
-  s.finish(out, outpos);
-  return 0;
+function crypto_onetimeauth (mac, msg, key) {
+  assert(mac.byteLength === crypto_onetimeauth_BYTES, "mac must be 'crypto_onetimeauth_BYTES' bytes")
+  assert(msg.byteLength != null, 'msg must be buffer')
+  assert(key.byteLength === crypto_onetimeauth_KEYBYTES, "key must be 'crypto_onetimeauth_KEYBYTES' bytes")
+
+  var s = new Poly1305(key)
+  s.update(msg, 0, msg.byteLength)
+  s.finish(mac, 0)
 }
 
-function crypto_onetimeauth_verify(h, hpos, m, mpos, n, k) {
-  var x = new Uint8Array(16);
-  crypto_onetimeauth(x,0,m,mpos,n,k);
-  return crypto_verify_16(h,hpos,x,0);
+function crypto_onetimeauth_verify (mac, msg, key) {
+  assert(mac.byteLength === crypto_onetimeauth_BYTES, "mac must be 'crypto_onetimeauth_BYTES' bytes")
+  assert(msg.byteLength != null, 'msg must be buffer')
+  assert(key.byteLength === crypto_onetimeauth_KEYBYTES, "key must be 'crypto_onetimeauth_KEYBYTES' bytes")
+
+  var tmp = new Uint8Array(16)
+  crypto_onetimeauth(tmp, msg, key)
+  return crypto_verify_16(mac, 0, tmp, 0)
 }

crypto_scalarmult.js

@@ -1,9 +1,8 @@
-const { _9, _121665, gf, inv25519, pack25519, unpack25519, sel25519, A, M, Z, S } = require('./ed25519.js')
+/* eslint-disable camelcase, one-var */
+const { _9, _121665, gf, inv25519, pack25519, unpack25519, sel25519, A, M, Z, S } = require('./internal/ed25519')
 
-var crypto_scalarmult_BYTES = 32
-var crypto_scalarmult_SCALARBYTES = 32
-var crypto_scalarmult_BYTES = 32
-var crypto_scalarmult_SCALARBYTES = 32
+const crypto_scalarmult_BYTES = 32
+const crypto_scalarmult_SCALARBYTES = 32
 
 module.exports = {
   crypto_scalarmult,
@@ -19,7 +18,7 @@ function crypto_scalarmult (q, n, p) {
   var z = new Uint8Array(32)
   var x = new Float64Array(80), r, i
   var a = gf(), b = gf(), c = gf(),
-      d = gf(), e = gf(), f = gf()
+    d = gf(), e = gf(), f = gf()
   for (i = 0; i < 31; i++) z[i] = n[i]
   z[31] = (n[31] & 127) | 64
   z[0] &= 248

crypto_secretbox.js

@@ -1,11 +1,13 @@
-var { crypto_stream, crypto_stream_xor } = require('./crypto_stream')
-var { crypto_onetimeauth, crypto_onetimeauth_verify } = require('./crypto_onetimeauth')
+/* eslint-disable camelcase */
+const assert = require('nanoassert')
+const { crypto_stream, crypto_stream_xor } = require('./crypto_stream')
+const { crypto_onetimeauth, crypto_onetimeauth_verify, crypto_onetimeauth_BYTES, crypto_onetimeauth_KEYBYTES } = require('./crypto_onetimeauth')
 
-var crypto_secretbox_KEYBYTES = 32,
-    crypto_secretbox_NONCEBYTES = 24,
-    crypto_secretbox_ZEROBYTES = 32,
-    crypto_secretbox_BOXZEROBYTES = 16,
-    crypto_secretbox_MACBYTES = 16
+const crypto_secretbox_KEYBYTES = 32
+const crypto_secretbox_NONCEBYTES = 24
+const crypto_secretbox_ZEROBYTES = 32
+const crypto_secretbox_BOXZEROBYTES = 16
+const crypto_secretbox_MACBYTES = 16
 
 module.exports = {
   crypto_secretbox,
@@ -21,73 +23,89 @@ module.exports = {
   crypto_secretbox_MACBYTES
 }
 
-function crypto_secretbox (c, m, d, n, k) {
-  var i
-  if (d < 32) return -1
+function crypto_secretbox (c, m, n, k) {
+  assert(c.byteLength === m.byteLength, "c must be 'm.byteLength' bytes")
+  const mlen = m.byteLength
+  assert(mlen >= crypto_secretbox_ZEROBYTES, "mlen must be at least 'crypto_secretbox_ZEROBYTES'")
+  assert(n.byteLength === crypto_secretbox_NONCEBYTES, "n must be 'crypto_secretbox_NONCEBYTES' bytes")
+  assert(k.byteLength === crypto_secretbox_KEYBYTES, "k must be 'crypto_secretbox_KEYBYTES' bytes")
+
   crypto_stream_xor(c, m, n, k)
-  crypto_onetimeauth(c, 16, c, 32, d - 32, c)
-  for (i = 0; i < 16; i++) c[i] = 0
-  return 0
+  crypto_onetimeauth(
+    c.subarray(crypto_secretbox_BOXZEROBYTES, crypto_secretbox_BOXZEROBYTES + crypto_onetimeauth_BYTES),
+    c.subarray(crypto_secretbox_BOXZEROBYTES + crypto_onetimeauth_BYTES, c.byteLength),
+    c.subarray(0, crypto_onetimeauth_KEYBYTES)
+  )
+  c.fill(0, 0, crypto_secretbox_BOXZEROBYTES)
 }
 
-function crypto_secretbox_open (m, c, d, n, k) {
-  var i
-  var x = new Uint8Array(32)
-  if (d < 32) return -1
+function crypto_secretbox_open (m, c, n, k) {
+  assert(c.byteLength === m.byteLength, "c must be 'm.byteLength' bytes")
+  const mlen = m.byteLength
+  assert(mlen >= crypto_secretbox_ZEROBYTES, "mlen must be at least 'crypto_secretbox_ZEROBYTES'")
+  assert(n.byteLength === crypto_secretbox_NONCEBYTES, "n must be 'crypto_secretbox_NONCEBYTES' bytes")
+  assert(k.byteLength === crypto_secretbox_KEYBYTES, "k must be 'crypto_secretbox_KEYBYTES' bytes")
+
+  const x = new Uint8Array(crypto_onetimeauth_KEYBYTES)
   crypto_stream(x, n, k)
-  if (crypto_onetimeauth_verify(c, 16, c, 32, d - 32, x) !== 0) return -1
+  const validMac = crypto_onetimeauth_verify(
+    c.subarray(crypto_secretbox_BOXZEROBYTES, crypto_secretbox_BOXZEROBYTES + crypto_onetimeauth_BYTES),
+    c.subarray(crypto_secretbox_BOXZEROBYTES + crypto_onetimeauth_BYTES, c.byteLength),
+    x
+  )
+
+  if (validMac === false) return false
   crypto_stream_xor(m, c, n, k)
-  for (i = 0; i < 32; i++) m[i] = 0
-  return 0
-}
-
-function crypto_secretbox_detached (o, mac, msg, n, k) {
-  check(mac, crypto_secretbox_MACBYTES)
-  var tmp = new Uint8Array(msg.length + mac.length)
-  crypto_secretbox_easy(tmp, msg, n, k)
-  o.set(tmp.subarray(0, msg.length))
-  mac.set(tmp.subarray(msg.length))
-}
-
-function crypto_secretbox_open_detached (msg, o, mac, n, k) {
-  check(mac, crypto_secretbox_MACBYTES)
-  var tmp = new Uint8Array(o.length + mac.length)
-  tmp.set(o)
-  tmp.set(mac, msg.length)
-  return crypto_secretbox_open_easy(msg, tmp, n, k)
-}
-
-function crypto_secretbox_easy(o, msg, n, k) {
-  check(msg, 0)
-  check(o, msg.length + crypto_secretbox_MACBYTES)
-  check(n, crypto_secretbox_NONCEBYTES)
-  check(k, crypto_secretbox_KEYBYTES)
-
-  var i
-  var m = new Uint8Array(crypto_secretbox_ZEROBYTES + msg.length)
-  var c = new Uint8Array(m.length)
-  for (i = 0; i < msg.length; i++) m[i + crypto_secretbox_ZEROBYTES] = msg[i]
-  crypto_secretbox(c, m, m.length, n, k)
-  for (i = crypto_secretbox_BOXZEROBYTES; i < c.length; i++) o[i - crypto_secretbox_BOXZEROBYTES] = c[i]
-}
-
-function crypto_secretbox_open_easy(msg, box, n, k) {
-  check(box, crypto_secretbox_MACBYTES)
-  check(msg, box.length - crypto_secretbox_MACBYTES)
-  check(n, crypto_secretbox_NONCEBYTES)
-  check(k, crypto_secretbox_KEYBYTES)
-
-  var i
-  var c = new Uint8Array(crypto_secretbox_BOXZEROBYTES + box.length)
-  var m = new Uint8Array(c.length)
-  for (i = 0; i < box.length; i++) c[i + crypto_secretbox_BOXZEROBYTES] = box[i]
-  if (c.length < 32) return false
-  if (crypto_secretbox_open(m, c, c.length, n, k) !== 0) return false
-
-  for (i = crypto_secretbox_ZEROBYTES; i < m.length; i++) msg[i - crypto_secretbox_ZEROBYTES] = m[i]
+  m.fill(0, 0, 32)
   return true
 }
 
-function check (buf, len) {
-  if (!buf || (len && buf.length < len)) throw new Error('Argument must be a buffer' + (len ? ' of length ' + len : ''))
+function crypto_secretbox_detached (o, mac, msg, n, k) {
+  assert(o.byteLength === msg.byteLength, "o must be 'msg.byteLength' bytes")
+  assert(mac.byteLength === crypto_secretbox_MACBYTES, "mac must be 'crypto_secretbox_MACBYTES' bytes")
+  assert(n.byteLength === crypto_secretbox_NONCEBYTES, "n must be 'crypto_secretbox_NONCEBYTES' bytes")
+  assert(k.byteLength === crypto_secretbox_KEYBYTES, "k must be 'crypto_secretbox_KEYBYTES' bytes")
+
+  const tmp = new Uint8Array(msg.byteLength + mac.byteLength)
+  crypto_secretbox_easy(tmp, msg, n, k)
+  mac.set(tmp.subarray(0, mac.byteLength))
+  o.set(tmp.subarray(mac.byteLength))
+  return true
+}
+
+function crypto_secretbox_open_detached (msg, o, mac, n, k) {
+  assert(o.byteLength === msg.byteLength, "o must be 'msg.byteLength' bytes")
+  assert(mac.byteLength === crypto_secretbox_MACBYTES, "mac must be 'crypto_secretbox_MACBYTES' bytes")
+  assert(n.byteLength === crypto_secretbox_NONCEBYTES, "n must be 'crypto_secretbox_NONCEBYTES' bytes")
+  assert(k.byteLength === crypto_secretbox_KEYBYTES, "k must be 'crypto_secretbox_KEYBYTES' bytes")
+
+  const tmp = new Uint8Array(o.byteLength + mac.byteLength)
+  tmp.set(mac)
+  tmp.set(o, mac.byteLength)
+  return crypto_secretbox_open_easy(msg, tmp, n, k)
+}
+
+function crypto_secretbox_easy (o, msg, n, k) {
+  assert(o.byteLength === msg.byteLength + crypto_secretbox_MACBYTES, "o must be 'msg.byteLength + crypto_secretbox_MACBYTES' bytes")
+  assert(n.byteLength === crypto_secretbox_NONCEBYTES, "n must be 'crypto_secretbox_NONCEBYTES' bytes")
+  assert(k.byteLength === crypto_secretbox_KEYBYTES, "k must be 'crypto_secretbox_KEYBYTES' bytes")
+
+  const m = new Uint8Array(crypto_secretbox_ZEROBYTES + msg.byteLength)
+  const c = new Uint8Array(m.byteLength)
+  m.set(msg, crypto_secretbox_ZEROBYTES)
+  crypto_secretbox(c, m, n, k)
+  o.set(c.subarray(crypto_secretbox_BOXZEROBYTES))
+}
+
+function crypto_secretbox_open_easy (msg, box, n, k) {
+  assert(box.byteLength === msg.byteLength + crypto_secretbox_MACBYTES, "box must be 'msg.byteLength + crypto_secretbox_MACBYTES' bytes")
+  assert(n.byteLength === crypto_secretbox_NONCEBYTES, "n must be 'crypto_secretbox_NONCEBYTES' bytes")
+  assert(k.byteLength === crypto_secretbox_KEYBYTES, "k must be 'crypto_secretbox_KEYBYTES' bytes")
+
+  const c = new Uint8Array(crypto_secretbox_BOXZEROBYTES + box.byteLength)
+  const m = new Uint8Array(c.byteLength)
+  c.set(box, crypto_secretbox_BOXZEROBYTES)
+  if (crypto_secretbox_open(m, c, n, k) === false) return false
+  msg.set(m.subarray(crypto_secretbox_ZEROBYTES))
+  return true
 }

crypto_secretstream.js

@@ -0,0 +1,271 @@
+/* eslint-disable camelcase */
+const assert = require('nanoassert')
+const { randombytes_buf } = require('./randombytes')
+const {
+  crypto_stream_chacha20_ietf,
+  crypto_stream_chacha20_ietf_xor,
+  crypto_stream_chacha20_ietf_xor_ic,
+  crypto_stream_chacha20_ietf_KEYBYTES
+} = require('./crypto_stream_chacha20')
+const { crypto_core_hchacha20, crypto_core_hchacha20_INPUTBYTES } = require('./internal/hchacha20')
+const Poly1305 = require('./internal/poly1305')
+const { sodium_increment, sodium_is_zero, sodium_memcmp } = require('./helpers')
+
+const crypto_onetimeauth_poly1305_BYTES = 16
+const crypto_secretstream_xchacha20poly1305_COUNTERBYTES = 4
+const crypto_secretstream_xchacha20poly1305_INONCEBYTES = 8
+const crypto_aead_xchacha20poly1305_ietf_KEYBYTES = 32
+const crypto_secretstream_xchacha20poly1305_KEYBYTES = crypto_aead_xchacha20poly1305_ietf_KEYBYTES
+const crypto_aead_xchacha20poly1305_ietf_NPUBBYTES = 24
+const crypto_secretstream_xchacha20poly1305_HEADERBYTES = crypto_aead_xchacha20poly1305_ietf_NPUBBYTES
+const crypto_aead_xchacha20poly1305_ietf_ABYTES = 16
+const crypto_secretstream_xchacha20poly1305_ABYTES = 1 + crypto_aead_xchacha20poly1305_ietf_ABYTES
+const crypto_secretstream_xchacha20poly1305_MESSAGEBYTES_MAX = Number.MAX_SAFE_INTEGER
+const crypto_aead_chacha20poly1305_ietf_MESSAGEBYTES_MAX = Number.MAX_SAFE_INTEGER
+const crypto_secretstream_xchacha20poly1305_TAGBYTES = 1
+const crypto_secretstream_xchacha20poly1305_TAG_MESSAGE = new Uint8Array([0])
+const crypto_secretstream_xchacha20poly1305_TAG_PUSH = new Uint8Array([1])
+const crypto_secretstream_xchacha20poly1305_TAG_REKEY = new Uint8Array([2])
+const crypto_secretstream_xchacha20poly1305_TAG_FINAL = new Uint8Array([crypto_secretstream_xchacha20poly1305_TAG_PUSH | crypto_secretstream_xchacha20poly1305_TAG_REKEY])
+const crypto_secretstream_xchacha20poly1305_STATEBYTES = crypto_secretstream_xchacha20poly1305_KEYBYTES +
+  crypto_secretstream_xchacha20poly1305_INONCEBYTES + crypto_secretstream_xchacha20poly1305_COUNTERBYTES + 8
+
+const KEY_OFFSET = 0
+const NONCE_OFFSET = crypto_secretstream_xchacha20poly1305_KEYBYTES
+const PAD_OFFSET = NONCE_OFFSET + crypto_secretstream_xchacha20poly1305_INONCEBYTES + crypto_secretstream_xchacha20poly1305_COUNTERBYTES
+
+const _pad0 = new Uint8Array(16)
+
+function STORE64_LE (dest, int) {
+  let mul = 1
+  let i = 0
+  dest[0] = int & 0xFF
+  while (++i < 8 && (mul *= 0x100)) {
+    dest[i] = (int / mul) & 0xFF
+  }
+}
+
+function crypto_secretstream_xchacha20poly1305_counter_reset (state) {
+  assert(state.byteLength === crypto_secretstream_xchacha20poly1305_STATEBYTES,
+    'state is should be crypto_secretstream_xchacha20poly1305_STATEBYTES long')
+
+  const nonce = state.subarray(NONCE_OFFSET, PAD_OFFSET)
+  for (let i = 0; i < crypto_secretstream_xchacha20poly1305_COUNTERBYTES; i++) {
+    nonce[i] = 0
+  }
+  nonce[0] = 1
+}
+
+function crypto_secretstream_xchacha20poly1305_keygen (k) {
+  assert(k.length === crypto_secretstream_xchacha20poly1305_KEYBYTES)
+  randombytes_buf(k)
+}
+
+function crypto_secretstream_xchacha20poly1305_init_push (state, out, key) {
+  assert(state.byteLength === crypto_secretstream_xchacha20poly1305_STATEBYTES,
+    'state is should be crypto_secretstream_xchacha20poly1305_STATEBYTES long')
+  assert(out instanceof Uint8Array && out.length === crypto_secretstream_xchacha20poly1305_HEADERBYTES, 'out not byte array of length crypto_secretstream_xchacha20poly1305_HEADERBYTES')
+  assert(key instanceof Uint8Array && key.length === crypto_secretstream_xchacha20poly1305_KEYBYTES, 'key not byte array of length crypto_secretstream_xchacha20poly1305_KEYBYTES')
+
+  const k = state.subarray(KEY_OFFSET, NONCE_OFFSET)
+  const nonce = state.subarray(NONCE_OFFSET, PAD_OFFSET)
+  const pad = state.subarray(PAD_OFFSET)
+
+  randombytes_buf(out, crypto_secretstream_xchacha20poly1305_HEADERBYTES)
+  crypto_core_hchacha20(k, out, key, null)
+  crypto_secretstream_xchacha20poly1305_counter_reset(state)
+  for (let i = 0; i < crypto_secretstream_xchacha20poly1305_INONCEBYTES; i++) {
+    nonce[i + crypto_secretstream_xchacha20poly1305_COUNTERBYTES] = out[i + crypto_core_hchacha20_INPUTBYTES]
+  }
+  pad.fill(0)
+}
+
+function crypto_secretstream_xchacha20poly1305_init_pull (state, _in, key) {
+  assert(state.byteLength === crypto_secretstream_xchacha20poly1305_STATEBYTES,
+    'state is should be crypto_secretstream_xchacha20poly1305_STATEBYTES long')
+  assert(_in instanceof Uint8Array && _in.length === crypto_secretstream_xchacha20poly1305_HEADERBYTES,
+    '_in not byte array of length crypto_secretstream_xchacha20poly1305_HEADERBYTES')
+  assert(key instanceof Uint8Array && key.length === crypto_secretstream_xchacha20poly1305_KEYBYTES,
+    'key not byte array of length crypto_secretstream_xchacha20poly1305_KEYBYTES')
+
+  const k = state.subarray(KEY_OFFSET, NONCE_OFFSET)
+  const nonce = state.subarray(NONCE_OFFSET, PAD_OFFSET)
+  const pad = state.subarray(PAD_OFFSET)
+
+  crypto_core_hchacha20(k, _in, key, null)
+  crypto_secretstream_xchacha20poly1305_counter_reset(state)
+
+  for (let i = 0; i < crypto_secretstream_xchacha20poly1305_INONCEBYTES; i++) {
+    nonce[i + crypto_secretstream_xchacha20poly1305_COUNTERBYTES] = _in[i + crypto_core_hchacha20_INPUTBYTES]
+  }
+  pad.fill(0)
+}
+
+function crypto_secretstream_xchacha20poly1305_rekey (state) {
+  assert(state.byteLength === crypto_secretstream_xchacha20poly1305_STATEBYTES,
+    'state is should be crypto_secretstream_xchacha20poly1305_STATEBYTES long')
+
+  const k = state.subarray(KEY_OFFSET, NONCE_OFFSET)
+  const nonce = state.subarray(NONCE_OFFSET, PAD_OFFSET)
+
+  const new_key_and_inonce = new Uint8Array(
+    crypto_stream_chacha20_ietf_KEYBYTES + crypto_secretstream_xchacha20poly1305_INONCEBYTES)
+  let i
+  for (i = 0; i < crypto_stream_chacha20_ietf_KEYBYTES; i++) {
+    new_key_and_inonce[i] = k[i]
+  }
+  for (i = 0; i < crypto_secretstream_xchacha20poly1305_INONCEBYTES; i++) {
+    new_key_and_inonce[crypto_stream_chacha20_ietf_KEYBYTES + i] =
+      nonce[crypto_secretstream_xchacha20poly1305_COUNTERBYTES + i]
+  }
+  crypto_stream_chacha20_ietf_xor(new_key_and_inonce, new_key_and_inonce, nonce, k)
+  for (i = 0; i < crypto_stream_chacha20_ietf_KEYBYTES; i++) {
+    k[i] = new_key_and_inonce[i]
+  }
+  for (i = 0; i < crypto_secretstream_xchacha20poly1305_INONCEBYTES; i++) {
+    nonce[crypto_secretstream_xchacha20poly1305_COUNTERBYTES + i] =
+      new_key_and_inonce[crypto_stream_chacha20_ietf_KEYBYTES + i]
+  }
+  crypto_secretstream_xchacha20poly1305_counter_reset(state)
+}
+
+function crypto_secretstream_xchacha20poly1305_push (state, out, m, ad, tag) {
+  assert(state.byteLength === crypto_secretstream_xchacha20poly1305_STATEBYTES,
+    'state is should be crypto_secretstream_xchacha20poly1305_STATEBYTES long')
+  if (!ad) ad = new Uint8Array(0)
+
+  const k = state.subarray(KEY_OFFSET, NONCE_OFFSET)
+  const nonce = state.subarray(NONCE_OFFSET, PAD_OFFSET)
+
+  const block = new Uint8Array(64)
+  const slen = new Uint8Array(8)
+
+  assert(crypto_secretstream_xchacha20poly1305_MESSAGEBYTES_MAX <=
+    crypto_aead_chacha20poly1305_ietf_MESSAGEBYTES_MAX)
+
+  crypto_stream_chacha20_ietf(block, nonce, k)
+  const poly = new Poly1305(block)
+  block.fill(0)
+
+  poly.update(ad, 0, ad.byteLength)
+  poly.update(_pad0, 0, (0x10 - ad.byteLength) & 0xf)
+
+  block[0] = tag[0]
+  crypto_stream_chacha20_ietf_xor_ic(block, block, nonce, 1, k)
+
+  poly.update(block, 0, block.byteLength)
+  out[0] = block[0]
+
+  const c = out.subarray(1, out.byteLength)
+  crypto_stream_chacha20_ietf_xor_ic(c, m, nonce, 2, k)
+  poly.update(c, 0, m.byteLength)
+  poly.update(_pad0, 0, (0x10 - block.byteLength + m.byteLength) & 0xf)
+
+  STORE64_LE(slen, ad.byteLength)
+  poly.update(slen, 0, slen.byteLength)
+  STORE64_LE(slen, block.byteLength + m.byteLength)
+  poly.update(slen, 0, slen.byteLength)
+
+  const mac = out.subarray(1 + m.byteLength, out.byteLength)
+  poly.finish(mac, 0)
+
+  assert(crypto_onetimeauth_poly1305_BYTES >=
+    crypto_secretstream_xchacha20poly1305_INONCEBYTES)
+  xor_buf(nonce.subarray(crypto_secretstream_xchacha20poly1305_COUNTERBYTES, nonce.length),
+    mac, crypto_secretstream_xchacha20poly1305_INONCEBYTES)
+  sodium_increment(nonce)
+
+  if ((tag[0] & crypto_secretstream_xchacha20poly1305_TAG_REKEY) !== 0 ||
+    sodium_is_zero(nonce.subarray(0, crypto_secretstream_xchacha20poly1305_COUNTERBYTES))) {
+    crypto_secretstream_xchacha20poly1305_rekey(state)
+  }
+
+  return crypto_secretstream_xchacha20poly1305_ABYTES + m.byteLength
+}
+
+function crypto_secretstream_xchacha20poly1305_pull (state, m, tag, _in, ad) {
+  assert(state.byteLength === crypto_secretstream_xchacha20poly1305_STATEBYTES,
+    'state is should be crypto_secretstream_xchacha20poly1305_STATEBYTES long')
+  if (!ad) ad = new Uint8Array(0)
+
+  const k = state.subarray(KEY_OFFSET, NONCE_OFFSET)
+  const nonce = state.subarray(NONCE_OFFSET, PAD_OFFSET)
+
+  const block = new Uint8Array(64)
+  const slen = new Uint8Array(8)
+  const mac = new Uint8Array(crypto_onetimeauth_poly1305_BYTES)
+
+  assert(_in.byteLength >= crypto_secretstream_xchacha20poly1305_ABYTES,
+    'ciphertext is too short.')
+
+  const mlen = _in.byteLength - crypto_secretstream_xchacha20poly1305_ABYTES
+  crypto_stream_chacha20_ietf(block, nonce, k)
+  const poly = new Poly1305(block)
+  block.fill(0) // sodium_memzero(block, sizeof block);
+
+  poly.update(ad, 0, ad.byteLength)
+  poly.update(_pad0, 0, (0x10 - ad.byteLength) & 0xf)
+
+  block.fill(0) // memset(block, 0, sizeof block);
+  block[0] = _in[0]
+  crypto_stream_chacha20_ietf_xor_ic(block, block, nonce, 1, k)
+
+  tag[0] = block[0]
+  block[0] = _in[0]
+  poly.update(block, 0, block.byteLength)
+
+  const c = _in.subarray(1, _in.length)
+  poly.update(c, 0, mlen)
+
+  poly.update(_pad0, 0, (0x10 - block.byteLength + mlen) & 0xf)
+
+  STORE64_LE(slen, ad.byteLength)
+  poly.update(slen, 0, slen.byteLength)
+  STORE64_LE(slen, block.byteLength + m.byteLength)
+  poly.update(slen, 0, slen.byteLength)
+
+  poly.finish(mac, 0)
+  const stored_mac = _in.subarray(1 + mlen, _in.length)
+
+  if (!sodium_memcmp(mac, stored_mac)) {
+    mac.fill(0)
+    throw new Error('MAC could not be verified.')
+  }
+
+  crypto_stream_chacha20_ietf_xor_ic(m, c.subarray(0, m.length), nonce, 2, k)
+  xor_buf(nonce.subarray(crypto_secretstream_xchacha20poly1305_COUNTERBYTES, nonce.length),
+    mac, crypto_secretstream_xchacha20poly1305_INONCEBYTES)
+  sodium_increment(nonce)
+
+  if ((tag & crypto_secretstream_xchacha20poly1305_TAG_REKEY) !== 0 ||
+    sodium_is_zero(nonce.subarray(0, crypto_secretstream_xchacha20poly1305_COUNTERBYTES))) {
+    crypto_secretstream_xchacha20poly1305_rekey(state)
+  }
+
+  return mlen
+}
+
+function xor_buf (out, _in, n) {
+  for (let i = 0; i < n; i++) {
+    out[i] ^= _in[i]
+  }
+}
+
+module.exports = {
+  crypto_secretstream_xchacha20poly1305_keygen,
+  crypto_secretstream_xchacha20poly1305_init_push,
+  crypto_secretstream_xchacha20poly1305_init_pull,
+  crypto_secretstream_xchacha20poly1305_rekey,
+  crypto_secretstream_xchacha20poly1305_push,
+  crypto_secretstream_xchacha20poly1305_pull,
+  crypto_secretstream_xchacha20poly1305_STATEBYTES,
+  crypto_secretstream_xchacha20poly1305_ABYTES,
+  crypto_secretstream_xchacha20poly1305_HEADERBYTES,
+  crypto_secretstream_xchacha20poly1305_KEYBYTES,
+  crypto_secretstream_xchacha20poly1305_MESSAGEBYTES_MAX,
+  crypto_secretstream_xchacha20poly1305_TAGBYTES,
+  crypto_secretstream_xchacha20poly1305_TAG_MESSAGE,
+  crypto_secretstream_xchacha20poly1305_TAG_PUSH,
+  crypto_secretstream_xchacha20poly1305_TAG_REKEY,
+  crypto_secretstream_xchacha20poly1305_TAG_FINAL
+}

crypto_sign.js

@@ -1,3 +1,4 @@
+/* eslint-disable camelcase, one-var */
 const { crypto_verify_32 } = require('./crypto_verify')
 const { crypto_hash } = require('./crypto_hash')
 const {
@@ -5,13 +6,21 @@ const {
   X, Y, I, A, Z, M, S,
   sel25519, pack25519,
   inv25519, unpack25519
-} = require('./ed25519')
+} = require('./internal/ed25519')
 const { randombytes } = require('./randombytes')
+const { crypto_scalarmult_BYTES } = require('./crypto_scalarmult.js')
+const { crypto_hash_sha512_BYTES } = require('./crypto_hash.js')
+const assert = require('nanoassert')
 
-const crypto_sign_BYTES = 64,
-    crypto_sign_PUBLICKEYBYTES = 32,
-    crypto_sign_SECRETKEYBYTES = 64,
-    crypto_sign_SEEDBYTES = 32
+const crypto_sign_ed25519_PUBLICKEYBYTES = 32
+const crypto_sign_ed25519_SECRETKEYBYTES = 64
+const crypto_sign_ed25519_SEEDBYTES = 32
+const crypto_sign_ed25519_BYTES = 64
+
+const crypto_sign_BYTES = crypto_sign_ed25519_BYTES
+const crypto_sign_PUBLICKEYBYTES = crypto_sign_ed25519_PUBLICKEYBYTES
+const crypto_sign_SECRETKEYBYTES = crypto_sign_ed25519_SECRETKEYBYTES
+const crypto_sign_SEEDBYTES = crypto_sign_ed25519_SEEDBYTES
 
 module.exports = {
   crypto_sign_keypair,
@@ -23,110 +32,119 @@ module.exports = {
   crypto_sign_BYTES,
   crypto_sign_PUBLICKEYBYTES,
   crypto_sign_SECRETKEYBYTES,
-  crypto_sign_SEEDBYTES
+  crypto_sign_SEEDBYTES,
+  crypto_sign_ed25519_PUBLICKEYBYTES,
+  crypto_sign_ed25519_SECRETKEYBYTES,
+  crypto_sign_ed25519_SEEDBYTES,
+  crypto_sign_ed25519_BYTES,
+  crypto_sign_ed25519_pk_to_curve25519,
+  crypto_sign_ed25519_sk_to_curve25519,
+  crypto_sign_ed25519_sk_to_pk,
+  unpackneg,
+  pack
 }
 
-function set25519(r, a) {
-  var i;
-  for (i = 0; i < 16; i++) r[i] = a[i]|0;
+function set25519 (r, a) {
+  for (let i = 0; i < 16; i++) r[i] = a[i] | 0
 }
 
-function pow2523(o, i) {
-  var c = gf();
-  var a;
-  for (a = 0; a < 16; a++) c[a] = i[a];
+function pow2523 (o, i) {
+  var c = gf()
+  var a
+  for (a = 0; a < 16; a++) c[a] = i[a]
   for (a = 250; a >= 0; a--) {
-      S(c, c);
-      if(a !== 1) M(c, c, i);
+    S(c, c)
+    if (a !== 1) M(c, c, i)
   }
-  for (a = 0; a < 16; a++) o[a] = c[a];
+  for (a = 0; a < 16; a++) o[a] = c[a]
 }
 
-function add(p, q) {
+function add (p, q) {
   var a = gf(), b = gf(), c = gf(),
-      d = gf(), e = gf(), f = gf(),
-      g = gf(), h = gf(), t = gf();
+    d = gf(), e = gf(), f = gf(),
+    g = gf(), h = gf(), t = gf()
 
-  Z(a, p[1], p[0]);
-  Z(t, q[1], q[0]);
-  M(a, a, t);
-  A(b, p[0], p[1]);
-  A(t, q[0], q[1]);
-  M(b, b, t);
-  M(c, p[3], q[3]);
-  M(c, c, D2);
-  M(d, p[2], q[2]);
-  A(d, d, d);
-  Z(e, b, a);
-  Z(f, d, c);
-  A(g, d, c);
-  A(h, b, a);
+  Z(a, p[1], p[0])
+  Z(t, q[1], q[0])
+  M(a, a, t)
+  A(b, p[0], p[1])
+  A(t, q[0], q[1])
+  M(b, b, t)
+  M(c, p[3], q[3])
+  M(c, c, D2)
+  M(d, p[2], q[2])
+  A(d, d, d)
+  Z(e, b, a)
+  Z(f, d, c)
+  A(g, d, c)
+  A(h, b, a)
 
-  M(p[0], e, f);
-  M(p[1], h, g);
-  M(p[2], g, f);
-  M(p[3], e, h);
+  M(p[0], e, f)
+  M(p[1], h, g)
+  M(p[2], g, f)
+  M(p[3], e, h)
 }
 
-function cswap(p, q, b) {
-  var i;
+function cswap (p, q, b) {
+  var i
   for (i = 0; i < 4; i++) {
-    sel25519(p[i], q[i], b);
+    sel25519(p[i], q[i], b)
   }
 }
 
-function pack(r, p) {
-  var tx = gf(), ty = gf(), zi = gf();
-  inv25519(zi, p[2]);
-  M(tx, p[0], zi);
-  M(ty, p[1], zi);
-  pack25519(r, ty);
-  r[31] ^= par25519(tx) << 7;
+function pack (r, p) {
+  var tx = gf(), ty = gf(), zi = gf()
+  inv25519(zi, p[2])
+  M(tx, p[0], zi)
+  M(ty, p[1], zi)
+  pack25519(r, ty)
+  r[31] ^= par25519(tx) << 7
 }
 
-function scalarmult(p, q, s) {
-  var b, i;
-  set25519(p[0], gf0);
-  set25519(p[1], gf1);
-  set25519(p[2], gf1);
-  set25519(p[3], gf0);
+function scalarmult (p, q, s) {
+  // don't mutate q
+  var h = [gf(q[0]), gf(q[1]), gf(q[2]), gf(q[3])]
+  var b, i
+  set25519(p[0], gf0)
+  set25519(p[1], gf1)
+  set25519(p[2], gf1)
+  set25519(p[3], gf0)
   for (i = 255; i >= 0; --i) {
-    b = (s[(i/8)|0] >> (i&7)) & 1;
-    cswap(p, q, b);
-    add(q, p);
-    add(p, p);
-    cswap(p, q, b);
+    b = (s[(i / 8) | 0] >> (i & 7)) & 1
+    cswap(p, h, b)
+    add(h, p)
+    add(p, p)
+    cswap(p, h, b)
   }
 }
 
-function scalarbase(p, s) {
-  var q = [gf(), gf(), gf(), gf()];
-  set25519(q[0], X);
-  set25519(q[1], Y);
-  set25519(q[2], gf1);
-  M(q[3], X, Y);
-  scalarmult(p, q, s);
+function scalarbase (p, s) {
+  var q = [gf(), gf(), gf(), gf()]
+  set25519(q[0], X)
+  set25519(q[1], Y)
+  set25519(q[2], gf1)
+  M(q[3], X, Y)
+  scalarmult(p, q, s)
 }
 
-function crypto_sign_keypair(pk, sk, seeded) {
+function crypto_sign_keypair (pk, sk, seeded) {
   check(pk, crypto_sign_PUBLICKEYBYTES)
   check(sk, crypto_sign_SECRETKEYBYTES)
 
-  var d = new Uint8Array(64);
-  var p = [gf(), gf(), gf(), gf()];
-  var i;
+  var d = new Uint8Array(64)
+  var p = [gf(), gf(), gf(), gf()]
+  var i
 
-  if (!seeded) randombytes(sk, 32);
-  crypto_hash(d, sk, 32);
-  d[0] &= 248;
-  d[31] &= 127;
-  d[31] |= 64;
+  if (!seeded) randombytes(sk, 32)
+  crypto_hash(d, sk, 32)
+  d[0] &= 248
+  d[31] &= 127
+  d[31] |= 64
 
-  scalarbase(p, d);
-  pack(pk, p);
+  scalarbase(p, d)
+  pack(pk, p)
 
-  for (i = 0; i < 32; i++) sk[i+32] = pk[i];
-  return 0;
+  for (i = 0; i < 32; i++) sk[i + 32] = pk[i]
 }
 
 function crypto_sign_seed_keypair (pk, sk, seed) {
@@ -135,162 +153,167 @@ function crypto_sign_seed_keypair (pk, sk, seed) {
   return crypto_sign_keypair(pk, sk, true)
 }
 
-var L = new Float64Array([0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, 0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x10]);
+var L = new Float64Array([0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, 0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x10])
 
-function modL(r, x) {
-  var carry, i, j, k;
+function modL (r, x) {
+  var carry, i, j, k
   for (i = 63; i >= 32; --i) {
-    carry = 0;
+    carry = 0
     for (j = i - 32, k = i - 12; j < k; ++j) {
-      x[j] += carry - 16 * x[i] * L[j - (i - 32)];
-      carry = (x[j] + 128) >> 8;
-      x[j] -= carry * 256;
+      x[j] += carry - 16 * x[i] * L[j - (i - 32)]
+      carry = (x[j] + 128) >> 8
+      x[j] -= carry * 256
     }
-    x[j] += carry;
-    x[i] = 0;
+    x[j] += carry
+    x[i] = 0
   }
-  carry = 0;
+  carry = 0
   for (j = 0; j < 32; j++) {
-    x[j] += carry - (x[31] >> 4) * L[j];
-    carry = x[j] >> 8;
-    x[j] &= 255;
+    x[j] += carry - (x[31] >> 4) * L[j]
+    carry = x[j] >> 8
+    x[j] &= 255
   }
-  for (j = 0; j < 32; j++) x[j] -= carry * L[j];
+  for (j = 0; j < 32; j++) x[j] -= carry * L[j]
   for (i = 0; i < 32; i++) {
-    x[i+1] += x[i] >> 8;
-    r[i] = x[i] & 255;
+    x[i + 1] += x[i] >> 8
+    r[i] = x[i] & 255
   }
 }
 
-function reduce(r) {
-  var x = new Float64Array(64), i;
-  for (i = 0; i < 64; i++) x[i] = r[i];
-  for (i = 0; i < 64; i++) r[i] = 0;
-  modL(r, x);
+function reduce (r) {
+  var x = new Float64Array(64)
+  for (let i = 0; i < 64; i++) x[i] = r[i]
+  for (let i = 0; i < 64; i++) r[i] = 0
+  modL(r, x)
 }
 
 // Note: difference from C - smlen returned, not passed as argument.
-function crypto_sign(sm, m, sk) {
+function crypto_sign (sm, m, sk) {
   check(sm, crypto_sign_BYTES + m.length)
   check(m, 0)
   check(sk, crypto_sign_SECRETKEYBYTES)
   var n = m.length
 
-  var d = new Uint8Array(64), h = new Uint8Array(64), r = new Uint8Array(64);
-  var i, j, x = new Float64Array(64);
-  var p = [gf(), gf(), gf(), gf()];
+  var d = new Uint8Array(64), h = new Uint8Array(64), r = new Uint8Array(64)
+  var i, j, x = new Float64Array(64)
+  var p = [gf(), gf(), gf(), gf()]
 
-  crypto_hash(d, sk, 32);
-  d[0] &= 248;
-  d[31] &= 127;
-  d[31] |= 64;
+  crypto_hash(d, sk, 32)
+  d[0] &= 248
+  d[31] &= 127
+  d[31] |= 64
 
-  var smlen = n + 64;
-  for (i = 0; i < n; i++) sm[64 + i] = m[i];
-  for (i = 0; i < 32; i++) sm[32 + i] = d[32 + i];
+  var smlen = n + 64
+  for (i = 0; i < n; i++) sm[64 + i] = m[i]
+  for (i = 0; i < 32; i++) sm[32 + i] = d[32 + i]
 
-  crypto_hash(r, sm.subarray(32), n+32);
-  reduce(r);
-  scalarbase(p, r);
-  pack(sm, p);
+  crypto_hash(r, sm.subarray(32), n + 32)
+  reduce(r)
+  scalarbase(p, r)
+  pack(sm, p)
 
-  for (i = 32; i < 64; i++) sm[i] = sk[i];
-  crypto_hash(h, sm, n + 64);
-  reduce(h);
+  for (i = 32; i < 64; i++) sm[i] = sk[i]
+  crypto_hash(h, sm, n + 64)
+  reduce(h)
 
-  for (i = 0; i < 64; i++) x[i] = 0;
-  for (i = 0; i < 32; i++) x[i] = r[i];
+  for (i = 0; i < 64; i++) x[i] = 0
+  for (i = 0; i < 32; i++) x[i] = r[i]
   for (i = 0; i < 32; i++) {
     for (j = 0; j < 32; j++) {
-      x[i+j] += h[i] * d[j];
+      x[i + j] += h[i] * d[j]
     }
   }
 
-  modL(sm.subarray(32), x);
+  modL(sm.subarray(32), x)
   return smlen
 }
 
-function crypto_sign_detached(sig, m, sk) {
+function crypto_sign_detached (sig, m, sk) {
   var sm = new Uint8Array(m.length + crypto_sign_BYTES)
   crypto_sign(sm, m, sk)
-  for (var i = 0; i < crypto_sign_BYTES; i++) sig[i] = sm[i]
+  for (let i = 0; i < crypto_sign_BYTES; i++) sig[i] = sm[i]
 }
 
-function unpackneg(r, p) {
+function unpackneg (r, p) {
   var t = gf(), chk = gf(), num = gf(),
-      den = gf(), den2 = gf(), den4 = gf(),
-      den6 = gf();
+    den = gf(), den2 = gf(), den4 = gf(),
+    den6 = gf()
 
-  set25519(r[2], gf1);
-  unpack25519(r[1], p);
-  S(num, r[1]);
-  M(den, num, D);
-  Z(num, num, r[2]);
-  A(den, r[2], den);
+  set25519(r[2], gf1)
+  unpack25519(r[1], p)
+  S(num, r[1])
+  M(den, num, D)
+  Z(num, num, r[2])
+  A(den, r[2], den)
 
-  S(den2, den);
-  S(den4, den2);
-  M(den6, den4, den2);
-  M(t, den6, num);
-  M(t, t, den);
+  S(den2, den)
+  S(den4, den2)
+  M(den6, den4, den2)
+  M(t, den6, num)
+  M(t, t, den)
 
-  pow2523(t, t);
-  M(t, t, num);
-  M(t, t, den);
-  M(t, t, den);
-  M(r[0], t, den);
+  pow2523(t, t)
+  M(t, t, num)
+  M(t, t, den)
+  M(t, t, den)
+  M(r[0], t, den)
 
-  S(chk, r[0]);
-  M(chk, chk, den);
-  if (neq25519(chk, num)) M(r[0], r[0], I);
+  S(chk, r[0])
+  M(chk, chk, den)
+  if (!neq25519(chk, num)) M(r[0], r[0], I)
 
-  S(chk, r[0]);
-  M(chk, chk, den);
-  if (neq25519(chk, num)) return -1;
+  S(chk, r[0])
+  M(chk, chk, den)
+  if (!neq25519(chk, num)) return false
 
-  if (par25519(r[0]) === (p[31]>>7)) Z(r[0], gf0, r[0]);
+  if (par25519(r[0]) === (p[31] >> 7)) {
+    Z(r[0], gf(), r[0])
+  }
 
-  M(r[3], r[0], r[1]);
-  return 0;
+  M(r[3], r[0], r[1])
+  return true
 }
 
-function crypto_sign_open(msg, sm, pk) {
+/* eslint-disable no-unused-vars */
+function crypto_sign_open (msg, sm, pk) {
   check(msg, sm.length - crypto_sign_BYTES)
   check(sm, crypto_sign_BYTES)
   check(pk, crypto_sign_PUBLICKEYBYTES)
   var n = sm.length
   var m = new Uint8Array(sm.length)
 
-  var i, mlen;
-  var t = new Uint8Array(32), h = new Uint8Array(64);
+  var i, mlen
+  var t = new Uint8Array(32), h = new Uint8Array(64)
   var p = [gf(), gf(), gf(), gf()],
-      q = [gf(), gf(), gf(), gf()];
+    q = [gf(), gf(), gf(), gf()]
 
-  mlen = -1;
-  if (n < 64) return false;
+  mlen = -1
+  if (n < 64) return false
 
-  if (unpackneg(q, pk)) return false;
+  if (!unpackneg(q, pk)) return false
 
-  for (i = 0; i < n; i++) m[i] = sm[i];
-  for (i = 0; i < 32; i++) m[i+32] = pk[i];
-  crypto_hash(h, m, n);
-  reduce(h);
-  scalarmult(p, q, h);
+  for (i = 0; i < n; i++) m[i] = sm[i]
+  for (i = 0; i < 32; i++) m[i + 32] = pk[i]
+  crypto_hash(h, m, n)
+  reduce(h)
+  scalarmult(p, q, h)
 
-  scalarbase(q, sm.subarray(32));
-  add(p, q);
-  pack(t, p);
+  scalarbase(q, sm.subarray(32))
+  add(p, q)
+  pack(t, p)
 
-  n -= 64;
-  if (crypto_verify_32(sm, 0, t, 0)) {
-    for (i = 0; i < n; i++) m[i] = 0;
-    return false;
+  n -= 64
+  if (!crypto_verify_32(sm, 0, t, 0)) {
+    for (i = 0; i < n; i++) m[i] = 0
+    return false
+    // throw new Error('crypto_sign_open failed')
   }
 
-  for (i = 0; i < n; i++) msg[i] = sm[i + 64];
-  mlen = n;
-  return true;
+  for (i = 0; i < n; i++) msg[i] = sm[i + 64]
+  mlen = n
+  return true
 }
+/* eslint-enable no-unused-vars */
 
 function crypto_sign_verify_detached (sig, m, pk) {
   check(sig, crypto_sign_BYTES)
@@ -301,19 +324,146 @@ function crypto_sign_verify_detached (sig, m, pk) {
   return crypto_sign_open(m, sm, pk)
 }
 
-function par25519(a) {
-  var d = new Uint8Array(32);
-  pack25519(d, a);
-  return d[0] & 1;
+function par25519 (a) {
+  var d = new Uint8Array(32)
+  pack25519(d, a)
+  return d[0] & 1
 }
 
-function neq25519(a, b) {
-  var c = new Uint8Array(32), d = new Uint8Array(32);
-  pack25519(c, a);
-  pack25519(d, b);
-  return crypto_verify_32(c, 0, d, 0);
+function neq25519 (a, b) {
+  var c = new Uint8Array(32), d = new Uint8Array(32)
+  pack25519(c, a)
+  pack25519(d, b)
+  return crypto_verify_32(c, 0, d, 0)
 }
 
-function check (buf, len) {
-  if (!buf || (len && buf.length < len)) throw new Error('Argument must be a buffer' + (len ? ' of length ' + len : ''))
+function ed25519_mul_l (p, q) {
+  scalarmult(p, q, L)
+}
+
+function ed25519_is_on_main_subgroup (p) {
+  var pl = [gf(), gf(), gf(), gf()]
+
+  ed25519_mul_l(pl, p)
+
+  var zero = 0
+  for (let i = 0; i < 16; i++) {
+    zero |= (pl[0][i] & 0xffff)
+  }
+
+  return zero === 0
+}
+
+function crypto_sign_ed25519_pk_to_curve25519 (x25519_pk, ed25519_pk) {
+  check(x25519_pk, crypto_sign_PUBLICKEYBYTES)
+  check(ed25519_pk, crypto_sign_ed25519_PUBLICKEYBYTES)
+
+  var a = [gf(), gf(), gf(), gf()]
+  var x = gf([1])
+  var one_minus_y = gf([1])
+
+  assert(
+    isSmallOrder(ed25519_pk) &&
+    unpackneg(a, ed25519_pk) &&
+    ed25519_is_on_main_subgroup(a), 'Cannot convert key: bad point')
+
+  for (let i = 0; i < a.length; i++) {
+    pack25519(x25519_pk, a[i])
+  }
+
+  Z(one_minus_y, one_minus_y, a[1])
+  A(x, x, a[1])
+  inv25519(one_minus_y, one_minus_y)
+  M(x, x, one_minus_y)
+  pack25519(x25519_pk, x)
+
+  return 0
+}
+
+function isSmallOrder (s) {
+  Uint8Array.from([])
+
+  var bad_points = [
+    // 0 (order 4)
+    Uint8Array.from([0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00]),
+
+    // 1 (order 1)
+    Uint8Array.from([0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00]),
+
+    // 2707385501144840649318225287225658788936804267575313519463743609750303402022(order 8)
+    Uint8Array.from([0x26, 0xe8, 0x95, 0x8f, 0xc2, 0xb2, 0x27, 0xb0, 0x45, 0xc3,
+      0xf4, 0x89, 0xf2, 0xef, 0x98, 0xf0, 0xd5, 0xdf, 0xac, 0x05, 0xd3,
+      0xc6, 0x33, 0x39, 0xb1, 0x38, 0x02, 0x88, 0x6d, 0x53, 0xfc, 0x05]),
+
+    // 55188659117513257062467267217118295137698188065244968500265048394206261417927 (order 8)
+    Uint8Array.from([0xc7, 0x17, 0x6a, 0x70, 0x3d, 0x4d, 0xd8, 0x4f, 0xba, 0x3c,
+      0x0b, 0x76, 0x0d, 0x10, 0x67, 0x0f, 0x2a, 0x20, 0x53, 0xfa, 0x2c,
+      0x39, 0xcc, 0xc6, 0x4e, 0xc7, 0xfd, 0x77, 0x92, 0xac, 0x03, 0x7a]),
+
+    // p-1 (order 2)
+    Uint8Array.from([0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f]),
+
+    //  p (=0 order 4)
+    Uint8Array.from([0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f]),
+
+    // p + 1 (=1 order 1)
+    Uint8Array.from([0xee, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f])
+  ]
+
+  var c = new Uint8Array(7)
+  var j
+
+  check(bad_points, 7)
+  for (let i = 0; i < bad_points.length; i++) {
+    for (j = 0; j < 31; j++) {
+      c[i] |= s[j] ^ bad_points[i][j]
+    }
+  }
+
+  for (let i = 0; i < bad_points.length; i++) {
+    c[i] |= (s[j] & 0x7f) ^ bad_points[i][j]
+  }
+
+  var k = 0
+  for (let i = 0; i < bad_points.length; i++) {
+    k |= (c[i] - 1)
+  }
+
+  return ((k >> 8) & 1) === 0
+}
+
+function crypto_sign_ed25519_sk_to_pk (pk, sk) {
+  check(pk, crypto_sign_ed25519_PUBLICKEYBYTES)
+  pk.set(sk.subarray(crypto_sign_ed25519_SEEDBYTES))
+  return pk
+}
+
+function crypto_sign_ed25519_sk_to_curve25519 (curveSk, edSk) {
+  assert(curveSk && curveSk.byteLength === crypto_scalarmult_BYTES, "curveSk must be 'crypto_sign_SECRETKEYBYTES' long")
+  assert(edSk && edSk.byteLength === crypto_sign_ed25519_SECRETKEYBYTES, "edSk must be 'crypto_sign_ed25519_SECRETKEYBYTES' long")
+
+  var h = new Uint8Array(crypto_hash_sha512_BYTES)
+  crypto_hash(h, edSk, 32)
+
+  h[0] &= 248
+  h[31] &= 127
+  h[31] |= 64
+
+  curveSk.set(h.subarray(0, crypto_scalarmult_BYTES))
+  h.fill(0)
+  return curveSk
+}
+
+function check (buf, len, arg = 'Argument') {
+  if (!buf || (len && buf.length < len)) throw new Error(arg + ' must be a buffer' + (len ? ' of length ' + len : ''))
 }

crypto_stream.js

@@ -1,10 +1,12 @@
-var xsalsa20 = require('xsalsa20')
+/* eslint-disable camelcase */
+const xsalsa20 = require('xsalsa20')
 
 if (new Uint16Array([1])[0] !== 1) throw new Error('Big endian architecture is not supported.')
 
 exports.crypto_stream_KEYBYTES = 32
 exports.crypto_stream_NONCEBYTES = 24
 exports.crypto_stream_PRIMITIVE = 'xsalsa20'
+exports.crypto_stream_xsalsa20_MESSAGEBYTES_MAX = Number.MAX_SAFE_INTEGER
 
 exports.crypto_stream = function (c, nonce, key) {
   c.fill(0)
@@ -12,7 +14,7 @@ exports.crypto_stream = function (c, nonce, key) {
 }
 
 exports.crypto_stream_xor = function (c, m, nonce, key) {
-  var xor = xsalsa20(nonce, key)
+  const xor = xsalsa20(nonce, key)
 
   xor.update(m, c)
   xor.final()

crypto_verify.js

@@ -1,34 +1,29 @@
-const assert = require('nanoassert')
-
+/* eslint-disable camelcase */
 module.exports = {
   crypto_verify_16,
   crypto_verify_32,
-  sodium_memcmp,
-  sodium_is_zero
+  crypto_verify_64
 }
 
 function vn (x, xi, y, yi, n) {
-  var i, d = 0
-  for (i = 0; i < n; i++) d |= x[xi + i] ^ y[yi + i]
+  var d = 0
+  for (let i = 0; i < n; i++) d |= x[xi + i] ^ y[yi + i]
   return (1 & ((d - 1) >>> 8)) - 1
 }
 
-function crypto_verify_16(x, xi, y, yi) {
-  return vn(x, xi, y, yi, 16)
+// Make non enumerable as this is an internal function
+Object.defineProperty(module.exports, 'vn', {
+  value: vn
+})
+
+function crypto_verify_16 (x, xi, y, yi) {
+  return vn(x, xi, y, yi, 16) === 0
 }
 
-function crypto_verify_32(x, xi, y, yi) {
-  return vn(x, xi, y, yi, 32)
+function crypto_verify_32 (x, xi, y, yi) {
+  return vn(x, xi, y, yi, 32) === 0
 }
 
-function sodium_memcmp (a, b) {
-  assert(a.byteLength === b.byteLength, 'buffers must be the same size')
-
-  return vn(a, 0, b, 0, a.byteLength) === 0
-}
-
-function sodium_is_zero (arr) {
-  var d = 0
-  for (let i = 0; i < arr.length; i++) d |= arr[i]
-  return d === 0
+function crypto_verify_64 (x, xi, y, yi) {
+  return vn(x, xi, y, yi, 64) === 0
 }

example.js

@@ -1,19 +1,19 @@
-var sodium = require('./')
+const sodium = require('./')
 
-var key = new Buffer(sodium.crypto_secretbox_KEYBYTES)
-var nonce = new Buffer(sodium.crypto_secretbox_NONCEBYTES)
+const key = Buffer.alloc(sodium.crypto_secretbox_KEYBYTES)
+const nonce = Buffer.alloc(sodium.crypto_secretbox_NONCEBYTES)
 
 sodium.randombytes_buf(key)
 sodium.randombytes_buf(nonce)
 
-var message = new Buffer('Hello, World!')
-var cipher = new Buffer(message.length + sodium.crypto_secretbox_MACBYTES)
+const message = Buffer.from('Hello, World!')
+const cipher = Buffer.alloc(message.length + sodium.crypto_secretbox_MACBYTES)
 
 sodium.crypto_secretbox_easy(cipher, message, nonce, key)
 
 console.log('Encrypted:', cipher)
 
-var plainText = new Buffer(cipher.length - sodium.crypto_secretbox_MACBYTES)
+const plainText = Buffer.alloc(cipher.length - sodium.crypto_secretbox_MACBYTES)
 
 sodium.crypto_secretbox_open_easy(plainText, cipher, nonce, key)
 

helpers.js

@@ -0,0 +1,31 @@
+/* eslint-disable camelcase */
+const assert = require('nanoassert')
+const { vn } = require('./crypto_verify')
+
+function sodium_increment (n) {
+  const nlen = n.byteLength
+  var c = 1
+  for (var i = 0; i < nlen; i++) {
+    c += n[i]
+    n[i] = c
+    c >>= 8
+  }
+}
+
+function sodium_memcmp (a, b) {
+  assert(a.byteLength === b.byteLength, 'buffers must be the same size')
+
+  return vn(a, 0, b, 0, a.byteLength) === 0
+}
+
+function sodium_is_zero (arr) {
+  var d = 0
+  for (let i = 0; i < arr.length; i++) d |= arr[i]
+  return d === 0
+}
+
+module.exports = {
+  sodium_increment,
+  sodium_memcmp,
+  sodium_is_zero
+}

index.js

@@ -2,24 +2,17 @@
 
 // Based on https://github.com/dchest/tweetnacl-js/blob/6dcbcaf5f5cbfd313f2dcfe763db35c828c8ff5b/nacl-fast.js.
 
-var sodium = module.exports
-
 // Ported in 2014 by Dmitry Chestnykh and Devi Mandiri.
 // Public domain.
 //
 // Implementation derived from TweetNaCl version 20140427.
 // See for details: http://tweetnacl.cr.yp.to/
 
-// also forwarded at the bottom but randombytes is non-enumerable
-
-sodium.sodium_memzero = function (arr) {
-  arr.fill(0)
-}
-
-sodium.sodium_malloc = function (n) {
-  return new Uint8Array(n)
-}
-
+forward(require('./randombytes'))
+forward(require('./memory'))
+forward(require('./helpers'))
+forward(require('./crypto_verify'))
+forward(require('./crypto_auth'))
 forward(require('./crypto_box'))
 forward(require('./crypto_generichash'))
 forward(require('./crypto_hash'))
@@ -30,12 +23,11 @@ forward(require('./crypto_aead'))
 forward(require('./crypto_onetimeauth'))
 forward(require('./crypto_scalarmult'))
 forward(require('./crypto_secretbox'))
+forward(require('./crypto_secretstream'))
 forward(require('./crypto_shorthash'))
 forward(require('./crypto_sign'))
 forward(require('./crypto_stream'))
 forward(require('./crypto_stream_chacha20'))
-forward(require('./crypto_verify'))
-forward(require('./randombytes'))
 
 function forward (submodule) {
   Object.keys(submodule).forEach(function (prop) {

internal/hchacha20.js

@@ -0,0 +1,128 @@
+/* eslint-disable camelcase */
+const { sodium_malloc } = require('../memory')
+const assert = require('nanoassert')
+
+if (new Uint16Array([1])[0] !== 1) throw new Error('Big endian architecture is not supported.')
+
+const crypto_core_hchacha20_OUTPUTBYTES = 32
+const crypto_core_hchacha20_INPUTBYTES = 16
+const crypto_core_hchacha20_KEYBYTES = 32
+const crypto_core_hchacha20_CONSTBYTES = 16
+
+function ROTL32 (x, b) {
+  x &= 0xFFFFFFFF
+  b &= 0xFFFFFFFF
+  return (x << b) | (x >>> (32 - b))
+}
+
+function LOAD32_LE (src, offset) {
+  assert(src instanceof Uint8Array, 'src not byte array')
+  let w = src[offset]
+  w |= src[offset + 1] << 8
+  w |= src[offset + 2] << 16
+  w |= src[offset + 3] << 24
+  return w
+}
+
+function STORE32_LE (dest, int, offset) {
+  assert(dest instanceof Uint8Array, 'dest not byte array')
+  var mul = 1
+  var i = 0
+  dest[offset] = int & 0xFF // grab bottom byte
+  while (++i < 4 && (mul *= 0x100)) {
+    dest[offset + i] = (int / mul) & 0xFF
+  }
+}
+
+function QUARTERROUND (l, A, B, C, D) {
+  l[A] += l[B]
+  l[D] = ROTL32(l[D] ^ l[A], 16)
+  l[C] += l[D]
+  l[B] = ROTL32(l[B] ^ l[C], 12)
+  l[A] += l[B]
+  l[D] = ROTL32(l[D] ^ l[A], 8)
+  l[C] += l[D]
+  l[B] = ROTL32(l[B] ^ l[C], 7)
+}
+
+function crypto_core_hchacha20 (out, _in, k, c) {
+  assert(out instanceof Uint8Array && out.length === 32, 'out is not an array of 32 bytes')
+  assert(k instanceof Uint8Array && k.length === 32, 'k is not an array of 32 bytes')
+  assert(c === null || (c instanceof Uint8Array && c.length === 16), 'c is not null or an array of 16 bytes')
+
+  let i = 0
+  const x = new Uint32Array(16)
+  if (!c) {
+    x[0] = 0x61707865
+    x[1] = 0x3320646E
+    x[2] = 0x79622D32
+    x[3] = 0x6B206574
+  } else {
+    x[0] = LOAD32_LE(c, 0)
+    x[1] = LOAD32_LE(c, 4)
+    x[2] = LOAD32_LE(c, 8)
+    x[3] = LOAD32_LE(c, 12)
+  }
+  x[4] = LOAD32_LE(k, 0)
+  x[5] = LOAD32_LE(k, 4)
+  x[6] = LOAD32_LE(k, 8)
+  x[7] = LOAD32_LE(k, 12)
+  x[8] = LOAD32_LE(k, 16)
+  x[9] = LOAD32_LE(k, 20)
+  x[10] = LOAD32_LE(k, 24)
+  x[11] = LOAD32_LE(k, 28)
+  x[12] = LOAD32_LE(_in, 0)
+  x[13] = LOAD32_LE(_in, 4)
+  x[14] = LOAD32_LE(_in, 8)
+  x[15] = LOAD32_LE(_in, 12)
+
+  for (i = 0; i < 10; i++) {
+    QUARTERROUND(x, 0, 4, 8, 12)
+    QUARTERROUND(x, 1, 5, 9, 13)
+    QUARTERROUND(x, 2, 6, 10, 14)
+    QUARTERROUND(x, 3, 7, 11, 15)
+    QUARTERROUND(x, 0, 5, 10, 15)
+    QUARTERROUND(x, 1, 6, 11, 12)
+    QUARTERROUND(x, 2, 7, 8, 13)
+    QUARTERROUND(x, 3, 4, 9, 14)
+  }
+
+  STORE32_LE(out, x[0], 0)
+  STORE32_LE(out, x[1], 4)
+  STORE32_LE(out, x[2], 8)
+  STORE32_LE(out, x[3], 12)
+  STORE32_LE(out, x[12], 16)
+  STORE32_LE(out, x[13], 20)
+  STORE32_LE(out, x[14], 24)
+  STORE32_LE(out, x[15], 28)
+
+  return 0
+}
+
+function crypto_core_hchacha20_outputbytes () {
+  return crypto_core_hchacha20_OUTPUTBYTES
+}
+
+function crypto_core_hchacha20_inputbytes () {
+  return crypto_core_hchacha20_INPUTBYTES
+}
+
+function crypto_core_hchacha20_keybytes () {
+  return crypto_core_hchacha20_KEYBYTES
+}
+
+function crypto_core_hchacha20_constbytes () {
+  return crypto_core_hchacha20_CONSTBYTES
+}
+
+module.exports = {
+  crypto_core_hchacha20_INPUTBYTES,
+  LOAD32_LE,
+  STORE32_LE,
+  QUARTERROUND,
+  crypto_core_hchacha20,
+  crypto_core_hchacha20_outputbytes,
+  crypto_core_hchacha20_inputbytes,
+  crypto_core_hchacha20_keybytes,
+  crypto_core_hchacha20_constbytes
+}

memory.js

@@ -0,0 +1,30 @@
+/* eslint-disable camelcase */
+
+function sodium_malloc (n) {
+  return new Uint8Array(n)
+}
+
+function sodium_free (n) {
+  sodium_memzero(n)
+  loadSink().port1.postMessage(n.buffer, [n.buffer])
+}
+
+function sodium_memzero (arr) {
+  arr.fill(0)
+}
+
+var sink
+
+function loadSink () {
+  if (sink) return sink
+  var MessageChannel = globalThis.MessageChannel
+  if (MessageChannel == null) ({ MessageChannel } = require('worker' + '_threads'))
+  sink = new MessageChannel()
+  return sink
+}
+
+module.exports = {
+  sodium_malloc,
+  sodium_free,
+  sodium_memzero
+}

package.json

@@ -1,41 +1,49 @@
 {
   "name": "sodium-javascript",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "WIP - a pure javascript version of sodium-native",
   "main": "index.js",
   "dependencies": {
     "blake2b": "^2.1.1",
     "chacha20-universal": "^1.0.4",
-    "nanoassert": "^1.0.0",
-    "sha256-wasm": "^1.3.0",
-    "sha512-wasm": "^1.2.0",
+    "nanoassert": "^2.0.0",
+    "sha256-universal": "^1.1.0",
+    "sha512-universal": "^1.1.0",
     "siphash24": "^1.0.1",
     "xsalsa20": "^1.0.0"
   },
   "devDependencies": {
-    "browser-run": "^4.0.2",
-    "browserify": "^14.1.0",
-    "sodium-test": "^0.9.0"
+    "browserify": "^16.5.1",
+    "sodium-test": "^0.10.0",
+    "standard": "^15.0.1",
+    "tape-run": "^7.0.0"
+  },
+  "standard": {
+    "ignore": [
+      "/internal/**/*.js"
+    ]
   },
   "browser": {
-    "crypto": false
-  },
-  "react-native": {
-    "crypto": "crypto"
+    "crypto": false,
+    "worker_threads": false
   },
   "scripts": {
-    "browser": "browserify test.js | browser-run",
-    "browser-manual": "browserify test.js | browser-run -p 1234",
-    "test": "node test.js"
+    "pretest": "standard",
+    "test": "node test.js",
+    "test-browser": "browserify test.js | tape-run"
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/mafintosh/sodium-javascript.git"
+    "url": "git+https://github.com/sodium-friends/sodium-javascript.git"
   },
-  "author": "Mathias Buus (@mafintosh)",
+  "contributors": [
+    "Christophe Diederichs <chm-diederichs@hyperdivision.dk>",
+    "Emil Bay <github@tixz.dk> (http://bayes.dk)",
+    "Mathias Buus <mathiasbuus@gmail.com> (https://mafinto.sh)"
+  ],
   "license": "MIT",
   "bugs": {
-    "url": "https://github.com/mafintosh/sodium-javascript/issues"
+    "url": "https://github.com/sodium-friends/sodium-javascript/issues"
   },
-  "homepage": "https://github.com/mafintosh/sodium-javascript"
+  "homepage": "https://github.com/sodium-friends/sodium-javascript#readme"
 }

randombytes.js

@@ -1,40 +1,40 @@
 var assert = require('nanoassert')
+
 var randombytes = (function () {
   var QUOTA = 65536 // limit for QuotaExceededException
-  var crypto = typeof global !== 'undefined' ? crypto = (global.crypto || global.msCrypto) : null
+  var crypto = globalThis.crypto || globalThis.msCrypto
 
   function browserBytes (out, n) {
-    for (var i = 0; i < n; i += QUOTA) {
-      crypto.getRandomValues(out.subarray(i, i + Math.min(n - i, QUOTA)))
+    for (let i = 0; i < n; i += QUOTA) {
+      crypto.getRandomValues(new Uint8Array(out.buffer, i + out.byteOffset, Math.min(n - i, QUOTA)))
     }
   }
 
   function nodeBytes (out, n) {
-    out.set(crypto.randomBytes(n))
+    new Uint8Array(out.buffer, out.byteOffset, n).set(crypto.randomBytes(n))
   }
 
   function noImpl () {
     throw new Error('No secure random number generator available')
   }
 
-  if (crypto && crypto.getRandomValues) {
-    return browserBytes
-  } else if (typeof require !== 'undefined') {
-    // Node.js.
-    crypto = require('crypto')
-    if (crypto && crypto.randomBytes) {
-      return nodeBytes
-    }
+  if (crypto && crypto.getRandomValues) return browserBytes
+
+  if (require != null) {
+    // Node.js. Bust Browserify
+    crypto = require('cry' + 'pto')
+    if (crypto && crypto.randomBytes) return nodeBytes
   }
 
   return noImpl
 })()
 
+// Make non enumerable as this is an internal function
 Object.defineProperty(module.exports, 'randombytes', {
   value: randombytes
 })
 
 module.exports.randombytes_buf = function (out) {
   assert(out, 'out must be given')
-  randombytes(out, out.length)
+  randombytes(out, out.byteLength)
 }

test.js

@@ -1,3 +1,3 @@
 require('sodium-test')(require('.'))
 
-if (typeof window !== 'undefined') window.close()
+if ((typeof window !== 'undefined') && window.close) window.close()