mirrors/libsodium
2
0
Fork 0
mirror of https://github.com/jedisct1/libsodium.git synced 2026-09-25 04:09:58 +03:00
Code Issues Packages Projects Releases Wiki Activity
4,701 Commits 8 Branches 43 Tags
master
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Frank Denis c960b3b0c6 Emscripten: simplify randomness extraction 
Use getentropy() for small buffers and WASI random_get for
larger buffers.
 2026-09-22 10:39:29 +02:00
Frank Denis 57d44b9549 Faster sodium_memcmp and sodium_is_ezro 2026-09-20 12:33:37 +02:00
Frank Denis f6bd914086 Use arc4random when it's safe on Apple operating systems 2026-09-06 23:19:44 +02:00
Frank Denis 403efe612e x86: check if we can use an xgetbv inline asm implementation 
This only checks whether a call to the instruction can be made,
not that a supported function ABI can be used with asm code
like HAVE_AVX_ASM does.

The former can work while the later fails (which still allows
intrinsics-based AVX code to work).
 2026-08-31 08:00:08 +02:00
Frank Denis 9608bca840 Add evex flags for old LLVM versions, for chacha and salsa 
Fixes #1553
 2026-08-27 18:17:47 +02:00
Frank Denis b8cb059f63 Add a build option to remove the freestanding libc 2026-08-27 12:42:24 +02:00
Frank Denis 09dc85e866 Add AI-POLICY.md 2026-08-26 21:38:15 +02:00
Frank Denis a2338c6004 Backport CI fixes from stable 2026-08-26 20:50:24 +02:00
Frank Denis 6e0cc2b948 emscripten: build native ESM module 2026-08-26 15:34:34 +02:00
Frank Denis e93a5919f4 emscripten: remove LTO 2026-08-26 15:33:18 +02:00
Frank Denis d25a2a4659 emscriptenb: HEAPU8 is globally defined 2026-08-26 14:54:30 +02:00
Frank Denis 783cbf6330 emscripten: add -sEXPORTED_RUNTIME_METHODS 2026-08-26 14:39:58 +02:00
Frank Denis ee2972b83e Remove support for WASI 
Freestanding WebAssembly is enough, and WASI has always been a
pain to support.
 2026-08-26 14:25:41 +02:00
Frank Denis e6324db75c sodium_bin2ip: no need to copy an extra byte 2026-08-13 07:30:25 +02:00
Frank Denis b81ab0783e Update for zig-current 
Keep compat with previous version for now

Fixes #1551
 2026-07-31 17:23:45 +02:00
Frank Denis 7014b204b6 Interleave stream encryption and Poly1305 on cache-sized chunks 2026-07-12 19:49:37 +02:00
Frank Denis f17fa784e0 Merge branch 'master' of github.com:jedisct1/libsodium 
* 'master' of github.com:jedisct1/libsodium:
  Always use STORE32_LE for unaligned stores, even when it's a noop
 2026-07-12 15:00:50 +02:00
Frank Denis 5e261847ce Add NEON implementations of salsa20 and chacha20 2026-07-12 15:00:34 +02:00
Frank Denis f5c49665fa Always use STORE32_LE for unaligned stores, even when it's a noop 2026-07-12 14:36:25 +02:00
Frank Denis 931db45728 Add AVX-512 implementations of salsa20 and chacha20 2026-07-12 13:53:53 +02:00
Frank Denis 984c9f3828 Include unistd.h unconditionally on !windows 2026-07-08 22:12:29 +02:00
Frank Denis 66360d57df wasmer syntax for volumes seems to have changed 2026-07-08 21:56:14 +02:00
Frank Denis d4c60aee3e x25519: no need to normalize g in the ladder's subtraction 2026-07-03 13:20:32 +02:00
Frank Denis 19368ed0c9 Avoid unneeded u128 conversion 2026-07-03 13:20:02 +02:00
Frank Denis 95a428090f Add a compile-time option to set the max webassembly memory 2026-06-23 18:22:40 +02:00
Frank Denis 8e3be8615b CI: trigger CodeQL properly 
Reported by Nicolas IOOSS - Thanks!

Fixes #1539
 2026-06-11 15:11:24 +02:00
Frank Denis 3591adef1c For translate-c, use .Debug optlevel 2026-05-31 18:49:33 +02:00
Frank Denis 33ec70b372 Replace softaes with a bitsliced implementation 2026-05-31 14:32:14 +02:00
Frank Denis 63b30034a6 Update for zig-current 2026-05-27 14:01:56 +02:00
Frank Denis cb20f6d9cd SipHash: help the compiler a little bit 2026-05-04 10:34:04 +02:00
Frank Denis 10f787b53f @cimport is no more 2026-05-02 14:20:50 +02:00
Frank Denis f1f5745f50 Improve Keccak performance 2026-05-02 13:06:13 +02:00
Frank Denis df8802b013 Fix: sodium_misuse() callback runs under global lock and can deadlock 
SUMMARY
`src/libsodium/sodium/core.c` invokes the process-global misuse callback from `sodium_misuse()` while still holding the library-wide critical section. If the application-installed callback re-enters any API path that acquires the same lock, including `sodium_set_misuse_handler()`, execution deadlocks before `abort()` is reached. This breaks the intended fail-stop behavior of misuse handling.

PROVENANCE
Verified from the provided finding, reproduced locally from the committed control flow, and documented for Swival Security Scanner (https://swival.dev).

PRECONDITIONS
- A caller installs a misuse handler via `sodium_set_misuse_handler()`.
- The handler re-enters an API path that takes the same global critical section, including `sodium_set_misuse_handler()`.

PROOF
1. `sodium_set_misuse_handler()` writes the global `_misuse_handler` under `sodium_crit_enter()` / `sodium_crit_leave()` in `src/libsodium/sodium/core.c:170` and `src/libsodium/sodium/core.c:174`.
2. `sodium_misuse()` acquires that same critical section, copies `_misuse_handler`, and invokes `handler()` before releasing the lock in `src/libsodium/sodium/core.c:155` and `src/libsodium/sodium/core.c:160`.
3. The pthread-backed critical section in this file is non-recursive (`src/libsodium/sodium/core.c:89`), so a callback that calls `sodium_set_misuse_handler()` blocks in `sodium_crit_enter()` waiting on the lock already held by `sodium_misuse()`.
4. Because `sodium_misuse()` is waiting for the callback to return, it never reaches `abort()`, converting a fail-stop misuse path into a hang.
5. Reproduction confirmed this with a minimal pthread harness: the handler printed `handler: before reentry` and then hung until terminated by `timeout`.

WHY THIS IS A REAL BUG
The callback target is application-controlled through an exported setter, and `sodium_misuse()` calls it on a misuse path without enforcing any non-reentrancy contract. On pthread targets, a handler that performs a supported API call can permanently block process termination. That is a reachable behavioral failure, not a theoretical lock-order concern.

FIX REQUIREMENT
Load `_misuse_handler` while holding the lock, release the critical section, and only then invoke the callback. This removes lock-dependent behavior from arbitrary user code while preserving synchronized access to the global handler pointer.
 2026-04-16 23:00:13 +02:00
Frank Denis 83edcb43b1 Sync ChangeLog 2026-04-09 23:56:17 +02:00
Frank Denis 15a405652a CI: add an extra persist-credentials: false 2026-04-09 23:01:10 +02:00
Frank Denis af7289f16a Update GitHub actions 2026-04-09 23:00:10 +02:00
Frank Denis d3d28edf45 Include <core.h> to get sodium_misuse 2026-04-09 22:18:01 +02:00
Frank Denis 286fb1205f Allow NULL pointers (with length=0) with shorthash 2026-04-09 22:17:57 +02:00
Frank Denis 35df98abf0 Reject impossible lengths in crypto_box 2026-04-09 22:17:50 +02:00
Frank Denis 51be825e1a Add some zeroing 2026-04-09 22:17:47 +02:00
Frank Denis 65957fb00f Add some message size guards in AEGIS, for consistency 2026-04-09 22:17:43 +02:00
Frank Denis e700428672 Update msys2 2026-04-09 22:17:39 +02:00
Frank Denis c902df07e3 Fix compilation on ARM with very old gcc versions 2026-04-09 00:08:56 +02:00
Frank Denis 266e731c46 Merge branch 'master' of github.com:jedisct1/libsodium 
* 'master' of github.com:jedisct1/libsodium:
  Pin
 2026-04-09 00:00:17 +02:00
Frank Denis 09cb475ee0 Unify AES key expansion code on ARM 2026-04-08 23:59:53 +02:00
Frank Denis ad61cc6ace Remove trailing comma 2026-04-08 23:58:23 +02:00
Frank Denis 38395ff8b9 Pin 2026-04-08 23:00:33 +02:00
Frank Denis 0681744528 Call sodium_misuse on ridiculously high base64 input lengths 2026-04-08 21:42:08 +02:00
Frank Denis 45174d6570 Add version consistency check to CI 2026-04-08 21:42:04 +02:00
Frank Denis caeea3fc0a Do not strip debug builds 2026-04-08 12:06:28 +02:00
Frank Denis 3eafe0ac91 Merge branch 'master' of github.com:jedisct1/libsodium 
* 'master' of github.com:jedisct1/libsodium:
  Add conftest files to .gitignore
  Only build test-vectors on demand
 2026-04-08 10:04:40 +02:00
Frank Denis 11cd77c5cd Avoid unaligned reads, even on x86_64 where they are safe 2026-04-08 12:03:28 +02:00
Frank Denis 4a6a7a010d Add test vectors from Rooterberg and Wycheproof test suites 
Closes #1517
 2026-04-08 12:00:28 +02:00
Frank Denis c5bd9080bc Add conftest files to .gitignore 2026-04-08 09:41:30 +02:00
Frank Denis b33f57b6ad Only build test-vectors on demand 2026-04-08 09:36:22 +02:00
Frank Denis 3e039f7c03 Add code comments about why variable-time is fine for public inputs 2026-04-08 07:54:27 +02:00
Frank Denis ad53cae4c3 ML-KEM: wipe ephemeral seeds and harden invalid-pk test 2026-04-08 00:55:41 +02:00
Frank Denis f54f20abbf sha3: make post-final misuse safe and deterministic 2026-04-08 00:16:01 +02:00
Frank Denis fd52fd61a2 C++ compat 2026-04-05 21:59:25 +02:00
Frank Denis a728a02c51 Revert "local-dynamic is enough" 
This reverts commit 462e9a648b.
 2026-04-05 21:27:01 +02:00
Frank Denis 9f181dfc25 Remove ctype usage 2026-04-05 21:26:55 +02:00
Frank Denis 1573e29bf3 Refactor IPv6 zone ID parsing and reject malformed zone identifiers 2026-04-05 21:26:49 +02:00
Frank Denis 6b726ca29c gcc on FreeBSD can produce bogus code for isspace 2026-04-05 21:26:41 +02:00
Frank Denis 7fd99d8800 defined _AIX -> defined(_AIX) 2026-04-05 21:26:27 +02:00
Frank Denis 591326921c Define TLS as _Thread_local only if not properly autoconfigured 2026-04-05 21:26:20 +02:00
Frank Denis dd7d516503 Use AC_COMPILE_IFELSE → AC_LINK_IFELSE in ax_tls.m4 
On AIX, _Thread_local may compile but not link
 2026-04-05 21:26:11 +02:00
Frank Denis fef6efea2e Some AIX versions define a macro named ip_len 
So, workaround that by using ip_len_ :/
 2026-04-05 21:24:46 +02:00
Frank Denis cb797420ed Revert "No need to include the hkdf headers twice" 
This reverts commit 7d15af325d.
 2026-03-31 23:00:09 +02:00
Frank Denis 6911920a66 Add AI policy 2026-03-31 12:00:39 +02:00
Frank Denis 597886af2f Properly test crypto_kdf_hkdf_sha*_keygen 2026-03-29 19:59:44 +02:00
Frank Denis a615d0ed74 base64: reject signed chars 2026-03-29 09:21:42 +02:00
Frank Denis 7d15af325d No need to include the hkdf headers twice 2026-03-26 23:54:27 +08:00
Frank Denis 38aeb9d930 Avoid an MSVC warning in sodium_base64_ENCODED_LEN macro 
Reported by @valveri , thanks!

Fixes #1526
Fixes #1527
 2026-03-24 23:00:43 +08:00
Frank Denis f3b5cbfddd Restrict evex512 to clang 18-21 only 2026-03-16 20:52:14 +01:00
Frank Denis 16ca46a454 Add support for zwasm 2026-03-15 17:58:38 +01:00
Frank Denis f9cc229180 Simplify zig test path 2026-03-15 17:53:44 +01:00
Frank Denis 6684febd90 Add a couple more tests 2026-03-15 14:17:11 +01:00
Frank Denis 178763f174 Add some coverage exclusions 2026-03-15 13:32:12 +01:00
Frank Denis fc98842884 Relax crypto_auth_hmacsha{256,512}_init to accept NULL pointers 2026-03-15 13:06:59 +01:00
Frank Denis 51d4fb7637 Add a couple more tests 2026-03-15 12:48:47 +01:00
Frank Denis 06f2ca6068 Add some additional tests for HKDF and Salsa20/12 2026-03-15 12:47:48 +01:00
Frank Denis 3052baa7eb Add LCOV markers 2026-03-15 12:41:11 +01:00
Frank Denis 7c6843a2d5 wasmer: --mapdir= was renamed to --volume= 2026-03-15 12:33:11 +01:00
Frank Denis eabccb959f Add some ending CRLF 2026-03-14 19:38:20 +01:00
Frank Denis cf263497ed MSVC: allow the compiler to inline anything relevant 2026-03-14 19:20:46 +01:00
Frank Denis da1424fa9a Add inlilne hints for aegis hot paths 2026-03-14 19:20:15 +01:00
Frank Denis 6a79fae4cb Update for zig 0.16 2026-03-12 18:50:01 +01:00
Frank Denis 5224134ce4 Add .swival to .gitignore 2026-02-26 00:02:29 +01:00
Frank Denis 3d9d8f5001 Regen emscripten 2026-02-20 23:41:12 +01:00
Frank Denis 84e25e8f81 Format 2026-02-20 23:32:12 +01:00
Frank Denis 354e997bba Adjust KAT order 2026-02-20 23:31:12 +01:00
Frank Denis af0dd1b4ac Indent 2026-02-20 23:27:12 +01:00
Frank Denis 38a82863f1 crypto_core_*_from_string: drop the _ro suffix 2026-02-20 23:23:12 +01:00
Frank Denis 8bb79ae24d Rename crypto_core_*_from_string to crypto_core_*_from_string_nu 
RO should be the default
 2026-02-20 23:19:12 +01:00
Frank Denis 44cf631d04 Add argon2_fill_segment_neon to the quirks 2026-02-20 23:12:12 +01:00
Frank Denis 530252d9a3 Add crypto_core_ed25519_scalar_from_string 2026-02-20 23:06:12 +01:00
Frank Denis 78c80a9f73 Update emscripten symbols 2026-02-20 23:00:12 +01:00
Frank Denis 1cde0d85d9 Add tests for crypto_core_ristretto255_from_string_ro 
Using test vectors from RFC 9497. Suggested by @wmcelderry, thanks!

Fixes #1515
 2026-02-20 12:24:47 +01:00
Frank Denis babd0c3e59 Remove crypto_core_ristretto255_from_string 2026-02-20 12:05:55 +01:00
Frank Denis ed661cd1fc More fixes for MSVC/aarch64 2026-02-10 23:05:40 +01:00