libsodium_nif (libsodium v3.0.1)
View SourceNative libsodium bindings.
Every function maps directly onto the libsodium function of the same name;
the namespace modules such as libsodium_crypto_box document each operation
and supply argument defaults. Lengths are in bytes. Invalid argument types or
lengths raise badarg, and libsodium failures are returned as their integer
status code (usually -1) to match the historical port driver.
Calls that process more than 65536 bytes move to a dirty CPU scheduler, password hashing always runs on one, and streaming updates yield to other processes whenever their timeslice is exhausted.
Summary
Types
A crypto_aead_aes256gcm_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
A crypto_auth_hmacsha256_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
A crypto_auth_hmacsha512_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
A crypto_auth_hmacsha512256_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
A crypto_core_keccak1600_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
A crypto_generichash_blake2b_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
A crypto_generichash_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
A crypto_hash_sha256_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
A crypto_hash_sha512_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
A crypto_hash_sha3256_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
A crypto_hash_sha3512_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
A crypto_kdf_hkdf_sha256_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
A crypto_kdf_hkdf_sha512_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
A crypto_onetimeauth_poly1305_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
A crypto_onetimeauth_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
A crypto_secretstream_xchacha20poly1305_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
A crypto_sign_ed25519ph_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
A crypto_sign_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
A crypto_xof_shake128_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
A crypto_xof_shake256_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
A crypto_xof_turboshake128_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
A crypto_xof_turboshake256_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
16-byte comparison
Return crypto_verify_16_bytes(), in bytes.
Compare X and Y in constant time; returns 0 when they are equal and -1 otherwise.
32-byte comparison
Return crypto_verify_32_bytes(), in bytes.
Compare X and Y in constant time; returns 0 when they are equal and -1 otherwise.
64-byte comparison
Return crypto_verify_64_bytes(), in bytes.
Compare X and Y in constant time; returns 0 when they are equal and -1 otherwise.
AEGIS-128L
Return crypto_aead_aegis128l_abytes(), in bytes.
Verify and decrypt the ciphertext C with the additional data AD
(default empty), nonce NPub, and key K.
Verify the detached abytes/0 byte tag MAC and decrypt C with the
additional data AD (default empty), nonce NPub, and key K.
Returns the plaintext, or -1 when verification fails.
Encrypt and authenticate M together with the additional data AD
(default empty) using the npubbytes/0 byte nonce NPub and the
keybytes/0 byte key K.
Encrypt and authenticate M with the additional data AD (default
empty), nonce NPub, and key K, returning the ciphertext and the
abytes/0 byte authentication tag separately as {C, MAC}, or -1
on failure.
Return crypto_aead_aegis128l_keybytes(), in bytes.
Generate a random keybytes/0 byte key.
Return crypto_aead_aegis128l_messagebytes_max(), in bytes.
Return crypto_aead_aegis128l_npubbytes(), in bytes.
Return crypto_aead_aegis128l_nsecbytes(), in bytes.
AEGIS-256
Return crypto_aead_aegis256_abytes(), in bytes.
Verify and decrypt the ciphertext C with the additional data AD
(default empty), nonce NPub, and key K.
Verify the detached abytes/0 byte tag MAC and decrypt C with the
additional data AD (default empty), nonce NPub, and key K.
Returns the plaintext, or -1 when verification fails.
Encrypt and authenticate M together with the additional data AD
(default empty) using the npubbytes/0 byte nonce NPub and the
keybytes/0 byte key K.
Encrypt and authenticate M with the additional data AD (default
empty), nonce NPub, and key K, returning the ciphertext and the
abytes/0 byte authentication tag separately as {C, MAC}, or -1
on failure.
Return crypto_aead_aegis256_keybytes(), in bytes.
Generate a random keybytes/0 byte key.
Return crypto_aead_aegis256_messagebytes_max(), in bytes.
Return crypto_aead_aegis256_npubbytes(), in bytes.
Return crypto_aead_aegis256_nsecbytes(), in bytes.
AES256-GCM
Return crypto_aead_aes256gcm_abytes(), in bytes.
Expand the key K into a precomputed state for the _afternm functions.
Verify and decrypt the ciphertext C with the additional data AD,
nonce NPub, and key K.
Like decrypt/4, using a state precomputed by beforenm/1.
Verify the detached tag MAC and decrypt C with the additional data
AD. Returns the plaintext, or -1 when verification fails.
Like decrypt_detached/5, using a state precomputed by beforenm/1.
Encrypt and authenticate M together with the additional data AD
using the nonce NPub and key K.
Like encrypt/4, using a state precomputed by beforenm/1.
Encrypt and authenticate M with the additional data AD, returning
the ciphertext and the authentication tag separately as {C, MAC}.
Like encrypt_detached/4, using a state precomputed by beforenm/1.
Return 1 when the CPU supports hardware-accelerated AES256-GCM, otherwise 0.
Return crypto_aead_aes256gcm_keybytes(), in bytes.
Generate a random keybytes/0 byte key.
Return crypto_aead_aes256gcm_messagebytes_max(), in bytes.
Return crypto_aead_aes256gcm_npubbytes(), in bytes.
Return crypto_aead_aes256gcm_nsecbytes(), in bytes.
Return crypto_aead_aes256gcm_statebytes(), in bytes.
Argon2i password hashing
Return the algorithm identifier for Argon2i version 1.3, the only Alg accepted by
crypto_pwhash_argon2i/6.
Return crypto_pwhash_argon2i_bytes_max(), in bytes.
Return crypto_pwhash_argon2i_bytes_min(), in bytes.
Derive an Outlen byte key from Passwd and the salt Salt (at least
saltbytes/0 bytes; only the first saltbytes/0 are used) with the
cost parameters Opslimit and Memlimit. Alg must be
alg_argon2i13/0.
Return crypto_pwhash_argon2i_memlimit_interactive(), in bytes.
Return crypto_pwhash_argon2i_memlimit_max(), in bytes.
Return crypto_pwhash_argon2i_memlimit_min(), in bytes.
Return crypto_pwhash_argon2i_memlimit_moderate(), in bytes.
Return crypto_pwhash_argon2i_memlimit_sensitive(), in bytes.
Return crypto_pwhash_argon2i_opslimit_interactive(), in bytes.
Return crypto_pwhash_argon2i_opslimit_max(), in bytes.
Return crypto_pwhash_argon2i_opslimit_min(), in bytes.
Return crypto_pwhash_argon2i_opslimit_moderate(), in bytes.
Return crypto_pwhash_argon2i_opslimit_sensitive(), in bytes.
Return crypto_pwhash_argon2i_passwd_max(), in bytes.
Return crypto_pwhash_argon2i_passwd_min(), in bytes.
Return crypto_pwhash_argon2i_saltbytes(), in bytes.
Hash Passwd for storage with the cost parameters Opslimit and
Memlimit and a random salt.
Check whether Str was hashed with Argon2i and exactly the cost
parameters Opslimit and Memlimit.
Check Passwd against Str, an Argon2i string produced by str/3.
Return crypto_pwhash_argon2i_strbytes(), in bytes.
Return crypto_pwhash_argon2i_strprefix() as a binary.
Argon2id password hashing
Return the algorithm identifier for Argon2id version 1.3, the only Alg accepted by
crypto_pwhash_argon2id/6.
Return crypto_pwhash_argon2id_bytes_max(), in bytes.
Return crypto_pwhash_argon2id_bytes_min(), in bytes.
Derive an Outlen byte key from Passwd and the salt Salt (at least
saltbytes/0 bytes; only the first saltbytes/0 are used) with the
cost parameters Opslimit and Memlimit. Alg must be
alg_argon2id13/0.
Return crypto_pwhash_argon2id_memlimit_interactive(), in bytes.
Return crypto_pwhash_argon2id_memlimit_max(), in bytes.
Return crypto_pwhash_argon2id_memlimit_min(), in bytes.
Return crypto_pwhash_argon2id_memlimit_moderate(), in bytes.
Return crypto_pwhash_argon2id_memlimit_sensitive(), in bytes.
Return crypto_pwhash_argon2id_opslimit_interactive(), in bytes.
Return crypto_pwhash_argon2id_opslimit_max(), in bytes.
Return crypto_pwhash_argon2id_opslimit_min(), in bytes.
Return crypto_pwhash_argon2id_opslimit_moderate(), in bytes.
Return crypto_pwhash_argon2id_opslimit_sensitive(), in bytes.
Return crypto_pwhash_argon2id_passwd_max(), in bytes.
Return crypto_pwhash_argon2id_passwd_min(), in bytes.
Return crypto_pwhash_argon2id_saltbytes(), in bytes.
Hash Passwd for storage with the cost parameters Opslimit and
Memlimit and a random salt.
Check whether Str was hashed with Argon2id and exactly the cost
parameters Opslimit and Memlimit.
Check Passwd against Str, an Argon2id string produced by str/3.
Return crypto_pwhash_argon2id_strbytes(), in bytes.
Return crypto_pwhash_argon2id_strprefix() as a binary.
BLAKE2b
Return crypto_generichash_blake2b_bytes(), in bytes.
Return crypto_generichash_blake2b_bytes_max(), in bytes.
Return crypto_generichash_blake2b_bytes_min(), in bytes.
Hash In with the optional Key, producing Outlen bytes.
Finish the streaming hash in State, producing Outlen bytes. The
length should match the one passed to init/2 (default bytes/0).
Start a streaming hash with the optional Key that will produce
Outlen bytes. Defaults to bytes/0 bytes of output and no key.
Start a streaming hash with the optional Key, the saltbytes/0 byte
Salt, and the personalbytes/0 byte Personal that will produce
Outlen bytes. Defaults to bytes/0 bytes of output and no key.
Return crypto_generichash_blake2b_keybytes(), in bytes.
Return crypto_generichash_blake2b_keybytes_max(), in bytes.
Return crypto_generichash_blake2b_keybytes_min(), in bytes.
Generate a random keybytes/0 byte key.
Return crypto_generichash_blake2b_personalbytes(), in bytes.
Hash In with the optional Key, the saltbytes/0 byte Salt, and the
personalbytes/0 byte Personal, producing Outlen bytes.
Return crypto_generichash_blake2b_saltbytes(), in bytes.
Return crypto_generichash_blake2b_statebytes(), in bytes.
Absorb In into State and return the updated state.
BLAKE2b key derivation
Return crypto_kdf_blake2b_bytes_max(), in bytes.
Return crypto_kdf_blake2b_bytes_min(), in bytes.
Return crypto_kdf_blake2b_contextbytes(), in bytes.
Derive the SubkeyLen byte subkey number SubkeyId for the
contextbytes/0 byte context Ctx from the keybytes/0 byte master
key Key.
Return crypto_kdf_blake2b_keybytes(), in bytes.
ChaCha20 stream cipher
Return CLen bytes of keystream for the noncebytes/0 byte nonce N and the keybytes/0 byte key
K.
Return CLen bytes of IETF ChaCha20 keystream for the
ietf_noncebytes/0 byte nonce N and the ietf_keybytes/0 byte key
K. CLen must not exceed ietf_messagebytes_max/0.
Return crypto_stream_chacha20_ietf_keybytes(), in bytes.
Generate a random ietf_keybytes/0 byte key.
Return crypto_stream_chacha20_ietf_messagebytes_max(), in bytes.
Return crypto_stream_chacha20_ietf_noncebytes(), in bytes.
Encrypt or decrypt M with IETF ChaCha20 using the nonce N and key
K, starting at block counter 0.
Like ietf_xor/3, but start at the 32-bit block counter IC. Raises
badarg when the message would overflow the block counter.
Return crypto_stream_chacha20_keybytes(), in bytes.
Generate a random keybytes/0 byte key.
Return crypto_stream_chacha20_messagebytes_max(), in bytes.
Return crypto_stream_chacha20_noncebytes(), in bytes.
Encrypt or decrypt M by combining it with the keystream for the nonce
N and key K, starting at block counter 0.
Like 'xor'/3, but start at the 64-byte block counter IC, so the
message is combined with the keystream from byte IC * 64 onwards.
ChaCha20-Poly1305
Return crypto_aead_chacha20poly1305_abytes(), in bytes.
Verify and decrypt the ciphertext C produced by encrypt/4 with the
additional data AD (default empty), nonce NPub, and key K.
Like decrypt/4, verifying the detached tag MAC for C. Returns
the plaintext, or -1 when verification fails.
Encrypt and authenticate M together with the additional data AD
(default empty) using the original construction with the
npubbytes/0 byte nonce NPub and the keybytes/0 byte key K.
Like encrypt/4, returning the ciphertext and the abytes/0 byte
authentication tag separately as {C, MAC}, or -1 on failure.
Return crypto_aead_chacha20poly1305_ietf_abytes(), in bytes.
Verify and decrypt the ciphertext C with the additional data AD
(default empty), nonce NPub, and key K.
Verify the detached tag MAC and decrypt C with the additional data
AD (default empty). Returns the plaintext, or -1 when
verification fails.
Encrypt and authenticate M together with the additional data AD
(default empty) using the ietf_npubbytes/0 byte nonce NPub and
the ietf_keybytes/0 byte key K.
Encrypt and authenticate M with the additional data AD (default
empty), returning the ciphertext and the ietf_abytes/0 byte
authentication tag separately as {C, MAC}, or -1 on failure.
Return crypto_aead_chacha20poly1305_ietf_keybytes(), in bytes.
Generate a random ietf_keybytes/0 byte key.
Return crypto_aead_chacha20poly1305_ietf_messagebytes_max(), in bytes.
Return crypto_aead_chacha20poly1305_ietf_npubbytes(), in bytes.
Return crypto_aead_chacha20poly1305_ietf_nsecbytes(), in bytes.
Return crypto_aead_chacha20poly1305_keybytes(), in bytes.
Generate a random keybytes/0 byte key.
Return crypto_aead_chacha20poly1305_messagebytes_max(), in bytes.
Return crypto_aead_chacha20poly1305_npubbytes(), in bytes.
Return crypto_aead_chacha20poly1305_nsecbytes(), in bytes.
CPU features
Return 1 if the CPU supports x86 AES-NI instructions, otherwise 0.
Return 1 if the CPU supports the ARMv8 cryptography extensions (AES, SHA), otherwise 0.
Return 1 if the CPU and operating system support x86 AVX2, otherwise 0.
Return 1 if the CPU and operating system support x86 AVX-512F, otherwise 0.
Return 1 if the CPU and operating system support x86 AVX, otherwise 0.
Return 1 if the CPU supports ARM NEON (Advanced SIMD), otherwise 0.
Return 1 if the CPU supports x86 carry-less multiplication (PCLMULQDQ), otherwise 0.
Return 1 if the CPU supports the x86 RDRAND instruction, otherwise 0.
Return 1 if the CPU supports x86 SSE2, otherwise 0.
Return 1 if the CPU supports x86 SSE3, otherwise 0.
Return 1 if the CPU supports x86 SSE4.1, otherwise 0.
Return 1 if the CPU supports x86 SSSE3, otherwise 0.
Ed25519 point multiplication
Multiply the base point by the clamped scalar N. Returns -1 when
N is zero.
Multiply the base point by the scalar N without clamping. Returns
-1 when the result is the identity.
Return crypto_scalarmult_ed25519_bytes(), in bytes.
Multiply the point P by the clamped scalar N. Returns -1 when P
is invalid or of small order, or when the result is the identity.
Multiply the point P by the scalar N without clamping. Returns -1
when P is invalid or of small order, or when the result is the
identity.
Return crypto_scalarmult_ed25519_scalarbytes(), in bytes.
Ed25519 signatures
Return crypto_sign_ed25519_bytes(), in bytes.
Sign M with the secret key SK, returning the bytes/0 byte
signature followed by the message.
Sign M with the secret key SK, returning only the bytes/0 byte signature.
Finish the streaming message in State and sign it with the secret key
SK, returning the bytes/0 byte Ed25519ph signature.
Finish the streaming message in State and verify its Ed25519ph
signature Sig with the public key PK. Returns 0 when the signature
is valid and -1 otherwise.
Start a streaming Ed25519ph signature, returning a new state. Same as
libsodium_crypto_sign_ed25519ph:init/0.
Generate a random key pair. Returns {PK, SK}.
Return crypto_sign_ed25519_messagebytes_max(), in bytes.
Verify the signed message SM with the public key PK and return the
message without its signature, or -1 when the signature is invalid.
Convert the Ed25519 public key Ed25519PK into an X25519 public key.
Returns -1 when the key is not a valid point of prime order (for
example a small-order point).
Return crypto_sign_ed25519_publickeybytes(), in bytes.
Return crypto_sign_ed25519_secretkeybytes(), in bytes.
Deterministically derive a key pair from the seedbytes/0 byte Seed.
Returns {PK, SK}.
Return crypto_sign_ed25519_seedbytes(), in bytes.
Convert the Ed25519 secret key Ed25519SK into an X25519 secret key.
Extract the publickeybytes/0 byte public key from the secret key SK.
Extract the seedbytes/0 byte seed from the secret key SK.
Return crypto_sign_ed25519ph_statebytes(), the size of a streaming state, in bytes.
Absorb the message chunk M into State and return the updated state.
Verify the detached signature Sig of M with the public key PK.
Returns 0 when the signature is valid and -1 otherwise.
Ed25519ph signatures
Finish the streaming message in State and sign it with the Ed25519
secret key SK, returning a
libsodium_crypto_sign_ed25519:bytes/0 byte signature.
Finish the streaming message in State and verify its signature Sig
with the Ed25519 public key PK. Returns 0 when the signature is
valid and -1 otherwise.
Start a streaming Ed25519ph signature, returning a new state.
Return crypto_sign_ed25519ph_statebytes(), in bytes.
Absorb the message chunk M into State and return the updated state.
Edwards25519 arithmetic
Return the point P + Q, or -1 when either input is not a point on the curve.
Return crypto_core_ed25519_bytes(), in bytes.
Map the hashbytes/0 byte string H to a point. Deprecated and
undocumented by libsodium; use from_uniform/1 instead.
Map the uniformbytes/0 byte string R (such as the output of a hash
function) to a point on the main subgroup using Elligator 2.
Return crypto_core_ed25519_hashbytes(), in bytes.
Return 1 when P is the canonical encoding of a point on the main
subgroup (excluding small-order points), otherwise 0.
Return crypto_core_ed25519_nonreducedscalarbytes(), in bytes.
Return a random point on the main subgroup.
Return X + Y mod L.
Return 1 - S mod L, so that S + Comp = 1 (mod L).
Return the multiplicative inverse of the scalar S modulo L, or -1 when S is zero.
Return X * Y mod L.
Return -S mod L.
Return a random scalar in [0, L).
Reduce the nonreducedscalarbytes/0 byte little-endian integer S
modulo L. S should be sampled from at least 317 bits (such as a
64-byte hash) for the result to be close to uniform.
Return X - Y mod L.
Return crypto_core_ed25519_scalarbytes(), in bytes.
Return the point P - Q, or -1 when either input is not a point on the curve.
Return crypto_core_ed25519_uniformbytes(), in bytes.
Encrypted streams
Return crypto_secretstream_xchacha20poly1305_abytes(), in bytes.
Return crypto_secretstream_xchacha20poly1305_headerbytes(), in bytes.
Start decrypting a stream from the headerbytes/0 byte Header
produced by init_push/1 and the key K.
Start an encrypted stream with the keybytes/0 byte key K.
Return crypto_secretstream_xchacha20poly1305_keybytes(), in bytes.
Generate a random keybytes/0 byte key.
Return crypto_secretstream_xchacha20poly1305_messagebytes_max(), in bytes.
Verify and decrypt the next ciphertext C (at least abytes/0
bytes) with the additional data AD using the stream State.
Encrypt M with the additional data AD (may be empty) and the tag
Tag (an integer from 0 to 255, normally one of the tag_*
constants) using the stream State.
Explicitly derive a new key for the stream State and return the
updated state. The receiver must call rekey/1 at the same point in
the stream.
Return crypto_secretstream_xchacha20poly1305_statebytes(), in bytes.
Return crypto_secretstream_xchacha20poly1305_tag_final().
Return crypto_secretstream_xchacha20poly1305_tag_message().
Return crypto_secretstream_xchacha20poly1305_tag_push().
Return crypto_secretstream_xchacha20poly1305_tag_rekey().
Generic hashing
Return crypto_generichash_bytes(), in bytes.
Return crypto_generichash_bytes_max(), in bytes.
Return crypto_generichash_bytes_min(), in bytes.
Hash In with the optional Key, producing Outlen bytes.
Finish the streaming hash in State, producing Outlen bytes. The
length must match the one passed to init/2 (default bytes/0).
Start a streaming hash with the optional Key that will produce
Outlen bytes. Defaults to bytes/0 bytes of output and no key.
Return crypto_generichash_keybytes(), in bytes.
Return crypto_generichash_keybytes_max(), in bytes.
Return crypto_generichash_keybytes_min(), in bytes.
Generate a random keybytes/0 byte key.
Return crypto_generichash_primitive() as an atom.
Return crypto_generichash_statebytes(), in bytes.
Absorb In into State and return the updated state.
Hashing (SHA-512)
Return crypto_hash_bytes(), in bytes.
Hash In, returning a bytes/0 byte digest.
Return crypto_hash_primitive() as an atom.
HChaCha20 core
Return crypto_core_hchacha20_constbytes(), in bytes.
Compute the HChaCha20 core of the inputbytes/0 byte input In
with the keybytes/0 byte key K and the constbytes/0 byte constant
C, returning outputbytes/0 bytes.
Return crypto_core_hchacha20_inputbytes(), in bytes.
Return crypto_core_hchacha20_keybytes(), in bytes.
Return crypto_core_hchacha20_outputbytes(), in bytes.
Helpers
Return (A + B) mod 2^(8 * byte_size(A)), treating both as unsigned
little-endian numbers. Raises badarg unless both have the same length.
Return the length of the Base64 Variant encoding of BinLen bytes,
including one extra byte for libsodium's trailing NUL; the binary
returned by bin2base64/2 is one byte shorter.
Decode the Base64 B64 using Variant, skipping any characters in
Ignore. Variant defaults to original and Ignore to <<>>.
Return the Base64 encoding of Bin using Variant, in constant time.
Variant defaults to original.
Return the lowercase hexadecimal encoding of Bin, in constant time.
Format the 16-byte address Bin as text: IPv4-mapped addresses as
dotted IPv4, others as compressed IPv6 (RFC 5952).
Compare B1 and B2 as unsigned little-endian numbers in constant time.
Returns -1 if B1 is less than B2, 1 if it is greater, and 0 if
they are equal. Raises badarg unless both have the same length.
Decode the hexadecimal Hex (either case), skipping any characters in
Ignore between byte pairs. Ignore defaults to <<>>, so no
separators are accepted.
Return N plus one, treating it as an unsigned little-endian number of
the same length; the carry out of the last byte is discarded, so an
all-255 binary wraps around to zero.
Parse the IPv4 or IPv6 address Ip (an IPv6 address may carry a
%zone suffix, which is discarded) into its 16-byte IPv6 form; IPv4
addresses become IPv4-mapped IPv6 addresses. Returns -1 if Ip is
not a valid address.
Return 1 if every byte of N is zero (checked in constant time), otherwise 0.
Compare the secrets B1 and B2 in constant time. Returns 0 when they
are equal and -1 otherwise; this is not a lexicographic comparison.
Raises badarg unless both have the same length.
Pad UnpaddedBuf to a multiple of Blocksize bytes using the ISO/IEC
7816-4 scheme (a 16#80 byte followed by zeros); at least one byte is
always added. Raises badarg if Blocksize is 0 or the padded length
would overflow.
Return (A - B) mod 2^(8 * byte_size(A)), treating both as unsigned
little-endian numbers. Raises badarg unless both have the same length.
Remove the ISO/IEC 7816-4 padding added by pad/2 from PaddedBuf.
Returns -1 if the padding is invalid or Blocksize is 0 or larger
than PaddedBuf.
HKDF-SHA-256
Return crypto_kdf_hkdf_sha256_bytes_max(), in bytes.
Return crypto_kdf_hkdf_sha256_bytes_min(), in bytes.
Derive OutLen bytes from the keybytes/0 byte pseudorandom key PRK
for the context Ctx (default empty).
Extract a keybytes/0 byte pseudorandom key from the input keying
material IKM and the optional Salt (default empty).
Finish the streaming extraction in State, returning a keybytes/0 byte pseudorandom key.
Start a streaming extraction with the optional Salt (default empty) and return its state.
Absorb the input keying material IKM into State and return the updated state.
Return crypto_kdf_hkdf_sha256_keybytes(), in bytes.
Generate a random keybytes/0 byte pseudorandom key.
Return crypto_kdf_hkdf_sha256_statebytes(), in bytes.
HKDF-SHA-512
Return crypto_kdf_hkdf_sha512_bytes_max(), in bytes.
Return crypto_kdf_hkdf_sha512_bytes_min(), in bytes.
Derive OutLen bytes from the keybytes/0 byte pseudorandom key PRK
for the context Ctx (default empty).
Extract a keybytes/0 byte pseudorandom key from the input keying
material IKM and the optional Salt (default empty).
Finish the streaming extraction in State, returning a keybytes/0 byte pseudorandom key.
Start a streaming extraction with the optional Salt (default empty) and return its state.
Absorb the input keying material IKM into State and return the updated state.
Return crypto_kdf_hkdf_sha512_keybytes(), in bytes.
Generate a random keybytes/0 byte pseudorandom key.
Return crypto_kdf_hkdf_sha512_statebytes(), in bytes.
HMAC-SHA-256
Return crypto_auth_hmacsha256_bytes(), in bytes.
Compute the bytes/0 byte authentication tag of In under the keybytes/0 byte key K.
Finish the streaming authenticator in State, returning a bytes/0 byte tag.
Start a streaming authenticator keyed with Key, which may be of any
length, and return its state.
Return crypto_auth_hmacsha256_keybytes(), in bytes.
Generate a random keybytes/0 byte key.
Return crypto_auth_hmacsha256_statebytes(), in bytes.
Absorb In into State and return the updated state.
Check in constant time that H is the tag of In under the key K.
Returns 0 when it is valid and -1 otherwise.
HMAC-SHA-512
Return crypto_auth_hmacsha512_bytes(), in bytes.
Compute the bytes/0 byte authentication tag of In under the keybytes/0 byte key K.
Finish the streaming authenticator in State, returning a bytes/0 byte tag.
Start a streaming authenticator keyed with Key, which may be of any
length, and return its state.
Return crypto_auth_hmacsha512_keybytes(), in bytes.
Generate a random keybytes/0 byte key.
Return crypto_auth_hmacsha512_statebytes(), in bytes.
Absorb In into State and return the updated state.
Check in constant time that H is the tag of In under the key K.
Returns 0 when it is valid and -1 otherwise.
HMAC-SHA-512-256
Return crypto_auth_hmacsha512256_bytes(), in bytes.
Compute the bytes/0 byte authentication tag of In under the keybytes/0 byte key K.
Finish the streaming authenticator in State, returning a bytes/0 byte tag.
Start a streaming authenticator keyed with Key, which may be of any
length, and return its state.
Return crypto_auth_hmacsha512256_keybytes(), in bytes.
Generate a random keybytes/0 byte key.
Return crypto_auth_hmacsha512256_statebytes(), in bytes.
Absorb In into State and return the updated state.
Check in constant time that H is the tag of In under the key K.
Returns 0 when it is valid and -1 otherwise.
HSalsa20 core
Return crypto_core_hsalsa20_constbytes(), in bytes.
Compute the HSalsa20 core of the inputbytes/0 byte input In
with the keybytes/0 byte key K and the constbytes/0 byte constant
C, returning outputbytes/0 bytes.
Return crypto_core_hsalsa20_inputbytes(), in bytes.
Return crypto_core_hsalsa20_keybytes(), in bytes.
Return crypto_core_hsalsa20_outputbytes(), in bytes.
IP address encryption
Return crypto_ipcrypt_bytes(), in bytes.
Decrypt the bytes/0 byte address In produced by encrypt/2 with the key K.
Deterministically encrypt the bytes/0 byte address In with the
keybytes/0 byte key K, returning another bytes/0 byte address.
Return crypto_ipcrypt_keybytes(), in bytes.
Generate a random keybytes/0 byte key for encrypt/2.
Decrypt the nd_outputbytes/0 byte output In of nd_encrypt/2 with
the key K, returning the nd_inputbytes/0 byte address.
Encrypt the nd_inputbytes/0 byte address In with the
nd_keybytes/0 byte key K and the nd_tweakbytes/0 byte tweak T.
Returns nd_outputbytes/0 bytes: the tweak followed by the encrypted
address. The tweak must be random and should not repeat for a key.
Return crypto_ipcrypt_nd_inputbytes(), in bytes.
Return crypto_ipcrypt_nd_keybytes(), in bytes.
Generate a random nd_keybytes/0 byte key for nd_encrypt/2.
Return crypto_ipcrypt_nd_outputbytes(), in bytes.
Return crypto_ipcrypt_nd_tweakbytes(), in bytes.
Decrypt the ndx_outputbytes/0 byte output In of ndx_encrypt/2
with the key K, returning the ndx_inputbytes/0 byte address.
Encrypt the ndx_inputbytes/0 byte address In with the
ndx_keybytes/0 byte key K and the ndx_tweakbytes/0 byte tweak
T. Returns ndx_outputbytes/0 bytes: the tweak followed by the
encrypted address. The tweak must be random and should not repeat for
a key.
Return crypto_ipcrypt_ndx_inputbytes(), in bytes.
Return crypto_ipcrypt_ndx_keybytes(), in bytes.
Generate a random ndx_keybytes/0 byte key for ndx_encrypt/2.
Return crypto_ipcrypt_ndx_outputbytes(), in bytes.
Return crypto_ipcrypt_ndx_tweakbytes(), in bytes.
Return crypto_ipcrypt_pfx_bytes(), in bytes.
Decrypt the pfx_bytes/0 byte address In produced by pfx_encrypt/2 with the key K.
Encrypt the pfx_bytes/0 byte address In with the pfx_keybytes/0
byte key K, preserving prefixes: addresses that share their first
bits share the first bits of their encryptions, and IPv4 addresses
stay IPv4-mapped.
Return crypto_ipcrypt_pfx_keybytes(), in bytes.
Generate a random pfx_keybytes/0 byte key for pfx_encrypt/2.
Keccak-f[1600] permutation
Return Length bytes of State starting at byte Offset.
Offset + Length must not exceed 200.
Return the all-zero permutation state.
Apply the 12-round Keccak-p[1600,12] permutation used by TurboSHAKE
to State and return the new state.
Apply the 24-round Keccak-f[1600] permutation to State and return the new state.
Return crypto_core_keccak1600_statebytes(), in bytes.
XOR Bytes into State starting at byte Offset and return the
new state. Offset + byte_size(Bytes) must not exceed 200.
Key derivation
Return crypto_kdf_bytes_max(), in bytes.
Return crypto_kdf_bytes_min(), in bytes.
Return crypto_kdf_contextbytes(), in bytes.
Derive the SubkeyLen byte subkey number SubkeyId for the
contextbytes/0 byte context Ctx from the keybytes/0 byte master
key Key.
Return crypto_kdf_keybytes(), in bytes.
Generate a random keybytes/0 byte master key.
Return crypto_kdf_primitive() as an atom.
Key encapsulation
Return crypto_kem_ciphertextbytes(), in bytes.
Decapsulate the ciphertext CT with the secret key SK and return the
shared secret SS.
Encapsulate a fresh random shared secret to the public key PK.
Returns {CT, SS}, where CT is sent to the holder of the secret
key, or -1 when PK is invalid.
Generate a random key pair. Returns {PK, SK}.
Return crypto_kem_primitive() as an atom.
Return crypto_kem_publickeybytes(), in bytes.
Return crypto_kem_secretkeybytes(), in bytes.
Deterministically derive a key pair from the seedbytes/0 byte Seed,
which must be secret and uniformly random. Returns {PK, SK}.
Return crypto_kem_seedbytes(), in bytes.
Return crypto_kem_sharedsecretbytes(), in bytes.
Key exchange
Compute the client's session keys from its key pair ClientPK and
ClientSK and the server's public key ServerPK.
Generate a random key pair. Returns {PK, SK}.
Return crypto_kx_primitive() as an atom.
Return crypto_kx_publickeybytes(), in bytes.
Return crypto_kx_secretkeybytes(), in bytes.
Deterministically derive a key pair from the seedbytes/0 byte Seed.
Returns {PK, SK}.
Return crypto_kx_seedbytes(), in bytes.
Compute the server's session keys from its key pair ServerPK and
ServerSK and the client's public key ClientPK.
Return crypto_kx_sessionkeybytes(), in bytes.
Library version
Return 1 if libsodium was built in minimal mode (without the
functions omitted by --enable-minimal), otherwise 0.
Return the major version of the libsodium library ABI.
Return the minor version of the libsodium library ABI.
Return the libsodium release version, such as <<"1.0.22">>.
ML-KEM-768 key encapsulation
Return crypto_kem_mlkem768_ciphertextbytes(), in bytes.
Decapsulate the ciphertext CT with the secret key SK and return the
shared secret SS.
Encapsulate a fresh random shared secret to the public key PK.
Returns {CT, SS}, or -1 when PK is not a valid encoding.
Encapsulate to the public key PK using the 32-byte Seed (the
FIPS 203 message m) instead of fresh randomness. Seed must be
secret, uniformly random, and never reused. Returns {CT, SS}, or -1
when PK is not a valid encoding.
Generate a random key pair. Returns {PK, SK}.
Return crypto_kem_mlkem768_publickeybytes(), in bytes.
Return crypto_kem_mlkem768_secretkeybytes(), in bytes.
Deterministically derive a key pair from the seedbytes/0 byte Seed
(the FIPS 203 d || z), which must be secret and uniformly random.
Returns {PK, SK}.
Return crypto_kem_mlkem768_seedbytes(), in bytes.
Return crypto_kem_mlkem768_sharedsecretbytes(), in bytes.
One-time authentication
Return crypto_onetimeauth_bytes(), in bytes.
Compute the bytes/0 byte tag of In under the one-time keybytes/0 byte key K.
Finish the streaming authenticator in State, returning a bytes/0 byte tag.
Start a streaming authenticator with the one-time keybytes/0 byte Key.
Return crypto_onetimeauth_keybytes(), in bytes.
Generate a random keybytes/0 byte key.
Return crypto_onetimeauth_primitive() as an atom.
Return crypto_onetimeauth_statebytes(), in bytes.
Absorb In into State and return the updated state.
Check in constant time that H is the tag of In under the key K.
Returns 0 when it is valid and -1 otherwise.
Password hashing
Return the algorithm identifier for Argon2i version 1.3 (crypto_pwhash_ALG_ARGON2I13).
Return the algorithm identifier for Argon2id version 1.3 (crypto_pwhash_ALG_ARGON2ID13).
Return the identifier of the recommended algorithm (currently Argon2id 1.3).
Return crypto_pwhash_bytes_max(), in bytes.
Return crypto_pwhash_bytes_min(), in bytes.
Derive an Outlen byte key from Passwd and the salt Salt (at least
saltbytes/0 bytes; only the first saltbytes/0 are used) with the
cost parameters Opslimit and Memlimit and the algorithm Alg
(alg_argon2i13/0, alg_argon2id13/0 or alg_default/0).
Return crypto_pwhash_memlimit_interactive(), in bytes.
Return crypto_pwhash_memlimit_max(), in bytes.
Return crypto_pwhash_memlimit_min(), in bytes.
Return crypto_pwhash_memlimit_moderate(), in bytes.
Return crypto_pwhash_memlimit_sensitive(), in bytes.
Return crypto_pwhash_opslimit_interactive(), in bytes.
Return crypto_pwhash_opslimit_max(), in bytes.
Return crypto_pwhash_opslimit_min(), in bytes.
Return crypto_pwhash_opslimit_moderate(), in bytes.
Return crypto_pwhash_opslimit_sensitive(), in bytes.
Return crypto_pwhash_passwd_max(), in bytes.
Return crypto_pwhash_passwd_min(), in bytes.
Return the names of the supported primitives as a binary, such as <<"argon2id,argon2i">>.
Return crypto_pwhash_saltbytes(), in bytes.
Hash Passwd for storage using the default algorithm with the cost
parameters Opslimit and Memlimit and a random salt.
Like str/3, but hash Passwd with the algorithm Alg
(alg_argon2i13/0 or alg_argon2id13/0). Returns -1 on failure.
Check whether Str (an Argon2i or Argon2id string) was hashed with
exactly the cost parameters Opslimit and Memlimit.
Check Passwd against Str, a string produced by str/3 or
str_alg/4 (Argon2i and Argon2id strings are both accepted).
Return crypto_pwhash_strbytes(), in bytes.
Return crypto_pwhash_strprefix() as a binary.
Point multiplication
Compute the public key for the secret scalar N by multiplying the
base point. Returns -1 on failure.
Return crypto_scalarmult_bytes(), in bytes.
Multiply the point P by the secret scalar N, producing a shared
secret. Returns -1 when P is a low-order point.
Return crypto_scalarmult_primitive() as an atom.
Return crypto_scalarmult_scalarbytes(), in bytes.
Poly1305
Return crypto_onetimeauth_poly1305_bytes(), in bytes.
Compute the bytes/0 byte tag of In under the one-time keybytes/0 byte key K.
Finish the streaming authenticator in State, returning a bytes/0 byte tag.
Start a streaming authenticator with the one-time keybytes/0 byte Key.
Return crypto_onetimeauth_poly1305_keybytes(), in bytes.
Generate a random keybytes/0 byte key.
Return crypto_onetimeauth_poly1305_statebytes(), in bytes.
Absorb In into State and return the updated state.
Check in constant time that H is the tag of In under the key K.
Returns 0 when it is valid and -1 otherwise.
Public-key authenticated encryption
Like crypto_box/4, using the shared key K precomputed by beforenm/2.
Precompute the beforenmbytes/0 byte shared key for the public key PK
and the secret key SK, for use with the _afternm functions.
Return crypto_box_beforenmbytes(), in bytes.
Return crypto_box_boxzerobytes(), in bytes.
NaCl-compatible encryption of M, which must start with zerobytes/0
zero bytes, using the nonce N, the recipient's public key PK, and
the sender's secret key SK.
Like easy/4, but returns the ciphertext and the macbytes/0 byte
authentication tag separately as {C, MAC}.
Like detached/4, using the shared key K precomputed by beforenm/2.
Returns {C, MAC}.
Encrypt and authenticate M with the nonce N, the recipient's public
key PK, and the sender's secret key SK.
Like easy/4, using the shared key K precomputed by beforenm/2.
Generate a random key pair. Returns {PK, SK}.
Return crypto_box_macbytes(), in bytes.
Return crypto_box_messagebytes_max(), in bytes.
Return crypto_box_noncebytes(), in bytes.
NaCl-compatible verification and decryption of C, which must start
with boxzerobytes/0 zero bytes, using the nonce N, the sender's
public key PK, and the recipient's secret key SK.
Like open/4, using the shared key K precomputed by beforenm/2.
Returns -1 when verification fails.
Verify the detached tag MAC and decrypt C with the nonce N, the
sender's public key PK, and the recipient's secret key SK.
Like open_detached/5, using the shared key K precomputed by
beforenm/2. Returns -1 when verification fails.
Verify and decrypt C, produced by easy/4, with the nonce N, the
sender's public key PK, and the recipient's secret key SK.
Like open_easy/4, using the shared key K precomputed by
beforenm/2. Returns -1 when verification fails.
Return crypto_box_primitive() as an atom.
Return crypto_box_publickeybytes(), in bytes.
Anonymously encrypt M for the recipient's public key PK using a new
ephemeral key pair. The result is sealbytes/0 bytes longer than M;
only the recipient can open it, but the sender cannot be identified.
Open the sealed box C with the recipient's key pair PK and SK.
Return crypto_box_sealbytes(), in bytes.
Return crypto_box_secretkeybytes(), in bytes.
Deterministically derive a key pair from the seedbytes/0 byte Seed.
Returns {PK, SK}.
Return crypto_box_seedbytes(), in bytes.
Return crypto_box_zerobytes(), in bytes.
Public-key signatures
Return crypto_sign_bytes(), in bytes.
Sign M with the secret key SK, returning the bytes/0 byte
signature followed by the message.
Sign M with the secret key SK, returning only the bytes/0 byte signature.
Finish the streaming message in State and sign it with the secret key
SK, returning the bytes/0 byte Ed25519ph signature.
Finish the streaming message in State and verify its Ed25519ph
signature Sig with the public key PK. Returns 0 when the signature
is valid and -1 otherwise.
Start a streaming Ed25519ph signature, returning a new state.
Generate a random key pair. Returns {PK, SK}.
Return crypto_sign_messagebytes_max(), in bytes.
Verify the signed message SM with the public key PK and return the
message without its signature, or -1 when the signature is invalid.
Return crypto_sign_primitive() as an atom.
Return crypto_sign_publickeybytes(), in bytes.
Return crypto_sign_secretkeybytes(), in bytes.
Deterministically derive a key pair from the seedbytes/0 byte Seed.
Returns {PK, SK}.
Return crypto_sign_seedbytes(), in bytes.
Return crypto_sign_statebytes(), in bytes.
Absorb the message chunk M into State and return the updated state.
Verify the detached signature Sig of M with the public key PK.
Returns 0 when the signature is valid and -1 otherwise.
Random data
Return Size random bytes.
Return Size bytes deterministically derived from the seedbytes/0 byte
Seed. The same seed always produces the same output.
Release resources held by the generator (such as an open
/dev/urandom descriptor). Returns 0 on success or -1 on failure.
Return the name of the active random number generator implementation, such as sysrandom.
Return a random integer between 0 and 16#ffffffff (inclusive).
Return Size random bytes; equivalent to buf/1.
Return randombytes_seedbytes(), in bytes.
Select the generator implementation for the whole VM: sysrandom uses the
operating system directly, while internal (also called salsa20) uses
a ChaCha20-based generator seeded from it. Returns 0 on success.
Reseed the generator. Rarely needed; libsodium reseeds automatically after a fork.
Return a uniformly distributed random integer between 0 and
UpperBound - 1 (inclusive), avoiding modulo bias. Returns 0 when
UpperBound is less than 2.
Ristretto255 arithmetic
Return the element P + Q, or -1 when either input is not a valid encoding.
Return crypto_core_ristretto255_bytes(), in bytes.
Map the hashbytes/0 byte uniform string H (such as a SHA-512
digest) to a group element.
Return crypto_core_ristretto255_hashbytes(), in bytes.
Return 1 when P is a valid canonical ristretto255 encoding, otherwise 0.
Return crypto_core_ristretto255_nonreducedscalarbytes(), in bytes.
Return a random group element.
Return X + Y mod L.
Return 1 - S mod L, so that S + Comp = 1 (mod L).
Return the multiplicative inverse of the scalar S modulo L, or -1 when S is zero.
Return X * Y mod L.
Return -S mod L.
Return a random scalar in [0, L).
Reduce the nonreducedscalarbytes/0 byte little-endian integer S
modulo L. S should be sampled from at least 317 bits (such as a
64-byte hash) for the result to be close to uniform.
Return X - Y mod L.
Return crypto_core_ristretto255_scalarbytes(), in bytes.
Return the element P - Q, or -1 when either input is not a valid encoding.
Ristretto255 point multiplication
Multiply the generator by the scalar N. Returns -1 when the result
is the identity.
Return crypto_scalarmult_ristretto255_bytes(), in bytes.
Multiply the element P by the scalar N. Returns -1 when P is
not a valid encoding or when the result is the identity.
Return crypto_scalarmult_ristretto255_scalarbytes(), in bytes.
Salsa20 core
Return crypto_core_salsa20_constbytes(), in bytes.
Compute the Salsa20 core of the inputbytes/0 byte input In
with the keybytes/0 byte key K and the constbytes/0 byte constant
C, returning outputbytes/0 bytes.
Return crypto_core_salsa20_inputbytes(), in bytes.
Return crypto_core_salsa20_keybytes(), in bytes.
Return crypto_core_salsa20_outputbytes(), in bytes.
Salsa20 stream cipher
Return CLen bytes of keystream for the noncebytes/0 byte nonce N and the keybytes/0 byte key
K.
Return crypto_stream_salsa20_keybytes(), in bytes.
Generate a random keybytes/0 byte key.
Return crypto_stream_salsa20_messagebytes_max(), in bytes.
Return crypto_stream_salsa20_noncebytes(), in bytes.
Encrypt or decrypt M by combining it with the keystream for the nonce
N and key K, starting at block counter 0.
Like 'xor'/3, but start at the 64-byte block counter IC, so the
message is combined with the keystream from byte IC * 64 onwards.
Salsa20/12 core
Return crypto_core_salsa2012_constbytes(), in bytes.
Compute the Salsa20/12 core of the inputbytes/0 byte input In
with the keybytes/0 byte key K and the constbytes/0 byte constant
C, returning outputbytes/0 bytes.
Return crypto_core_salsa2012_inputbytes(), in bytes.
Return crypto_core_salsa2012_keybytes(), in bytes.
Return crypto_core_salsa2012_outputbytes(), in bytes.
Salsa20/12 stream cipher
Return CLen bytes of keystream for the noncebytes/0 byte nonce N and the keybytes/0 byte key
K.
Return crypto_stream_salsa2012_keybytes(), in bytes.
Generate a random keybytes/0 byte key.
Return crypto_stream_salsa2012_messagebytes_max(), in bytes.
Return crypto_stream_salsa2012_noncebytes(), in bytes.
Encrypt or decrypt M by combining it with the keystream for the nonce
N and key K.
Scrypt password hashing
Return crypto_pwhash_scryptsalsa208sha256_bytes_max(), in bytes.
Return crypto_pwhash_scryptsalsa208sha256_bytes_min(), in bytes.
Derive an Outlen byte key from Passwd and the saltbytes/0 byte
Salt with the cost parameters Opslimit and Memlimit.
Compute raw scrypt over Passwd and Salt with the CPU/memory cost
N (a power of two greater than one), block size R, and
parallelism P, producing Buflen bytes.
Return crypto_pwhash_scryptsalsa208sha256_memlimit_interactive(), in bytes.
Return crypto_pwhash_scryptsalsa208sha256_memlimit_max(), in bytes.
Return crypto_pwhash_scryptsalsa208sha256_memlimit_min(), in bytes.
Return crypto_pwhash_scryptsalsa208sha256_memlimit_sensitive(), in bytes.
Return crypto_pwhash_scryptsalsa208sha256_opslimit_interactive(), in bytes.
Return crypto_pwhash_scryptsalsa208sha256_opslimit_max(), in bytes.
Return crypto_pwhash_scryptsalsa208sha256_opslimit_min(), in bytes.
Return crypto_pwhash_scryptsalsa208sha256_opslimit_sensitive(), in bytes.
Return crypto_pwhash_scryptsalsa208sha256_passwd_max(), in bytes.
Return crypto_pwhash_scryptsalsa208sha256_passwd_min(), in bytes.
Return crypto_pwhash_scryptsalsa208sha256_saltbytes(), in bytes.
Hash Passwd for storage with the cost parameters Opslimit and
Memlimit and a random salt.
Check whether Str was hashed with exactly the parameters that
Opslimit and Memlimit select.
Check Passwd against Str, a $7$ string produced by str/3.
Return crypto_pwhash_scryptsalsa208sha256_strbytes(), in bytes.
Return crypto_pwhash_scryptsalsa208sha256_strprefix() as a binary.
Secret-key authenticated encryption
Return crypto_secretbox_boxzerobytes(), in bytes.
NaCl compatibility interface: encrypt M, which must start with
zerobytes/0 zero bytes, with the nonce N and key K.
Encrypt and authenticate M with the nonce N and key K, returning
the ciphertext and the macbytes/0 byte authentication tag
separately as {C, MAC}, or -1 on failure.
Encrypt and authenticate M with the noncebytes/0 byte nonce N
and the keybytes/0 byte key K.
Return crypto_secretbox_keybytes(), in bytes.
Generate a random keybytes/0 byte key.
Return crypto_secretbox_macbytes(), in bytes.
Return crypto_secretbox_messagebytes_max(), in bytes.
Return crypto_secretbox_noncebytes(), in bytes.
NaCl compatibility interface: verify and decrypt C, which must
start with boxzerobytes/0 zero bytes, with the nonce N and key
K.
Verify the detached tag MAC and decrypt C with the nonce N and
key K. Returns the plaintext, or -1 when verification fails.
Verify and decrypt the ciphertext C produced by easy/3 with the
nonce N and key K. Returns the plaintext, or -1 when
verification fails or C is shorter than macbytes/0.
Return crypto_secretbox_primitive() as an atom.
Return crypto_secretbox_zerobytes(), in bytes.
Secret-key authentication
Return crypto_auth_bytes(), in bytes.
Compute the bytes/0 byte authentication tag of In under the keybytes/0 byte key K.
Return crypto_auth_keybytes(), in bytes.
Generate a random keybytes/0 byte key.
Return crypto_auth_primitive() as an atom.
Check in constant time that H is the tag of In under the key K.
Returns 0 when it is valid and -1 otherwise.
SHA3-256
Return crypto_hash_sha3256_bytes(), in bytes.
Hash In, returning a bytes/0 byte digest.
Finish the streaming hash in State, returning a bytes/0 byte digest.
Start a streaming hash, returning its state.
Return crypto_hash_sha3256_statebytes(), in bytes.
Absorb In into State and return the updated state.
SHA3-512
Return crypto_hash_sha3512_bytes(), in bytes.
Hash In, returning a bytes/0 byte digest.
Finish the streaming hash in State, returning a bytes/0 byte digest.
Start a streaming hash, returning its state.
Return crypto_hash_sha3512_statebytes(), in bytes.
Absorb In into State and return the updated state.
SHA-256
Return crypto_hash_sha256_bytes(), in bytes.
Hash In, returning a bytes/0 byte digest.
Finish the streaming hash in State, returning a bytes/0 byte digest.
Start a streaming hash, returning a statebytes/0 byte state.
Return crypto_hash_sha256_statebytes(), in bytes.
Absorb In into State and return the updated state.
SHA-512
Return crypto_hash_sha512_bytes(), in bytes.
Hash In, returning a bytes/0 byte digest.
Finish the streaming hash in State, returning a bytes/0 byte digest.
Start a streaming hash, returning a statebytes/0 byte state.
Return crypto_hash_sha512_statebytes(), in bytes.
Absorb In into State and return the updated state.
SHAKE128 extendable-output function
Return crypto_xof_shake128_blockbytes(), in bytes.
Hash In with SHAKE128 and the standard domain byte, returning
Outlen bytes of output.
Return crypto_xof_shake128_domain_standard().
Start a streaming SHAKE128 hash with the standard domain byte domain_standard/0.
Start a streaming SHAKE128 hash with the domain separation byte
Domain (an integer from 0 to 255).
Read the next Outlen bytes of output from State.
Return crypto_xof_shake128_statebytes(), in bytes.
Absorb In into State and return the updated state.
SHAKE256 extendable-output function
Return crypto_xof_shake256_blockbytes(), in bytes.
Hash In with SHAKE256 and the standard domain byte, returning
Outlen bytes of output.
Return crypto_xof_shake256_domain_standard().
Start a streaming SHAKE256 hash with the standard domain byte domain_standard/0.
Start a streaming SHAKE256 hash with the domain separation byte
Domain (an integer from 0 to 255).
Read the next Outlen bytes of output from State.
Return crypto_xof_shake256_statebytes(), in bytes.
Absorb In into State and return the updated state.
Short-input hashing
Return crypto_shorthash_bytes(), in bytes.
Hash In under the keybytes/0 byte key K, returning bytes/0 bytes.
Return crypto_shorthash_keybytes(), in bytes.
Generate a random keybytes/0 byte key.
Return crypto_shorthash_primitive() as an atom.
SipHash-2-4
Return crypto_shorthash_siphash24_bytes(), in bytes.
Hash In under the keybytes/0 byte key K, returning bytes/0 bytes.
Return crypto_shorthash_siphash24_keybytes(), in bytes.
SipHash-2-4 (128-bit)
Return crypto_shorthash_siphashx24_bytes(), in bytes.
Hash In under the keybytes/0 byte key K, returning bytes/0 bytes.
Return crypto_shorthash_siphashx24_keybytes(), in bytes.
Stream cipher
Return CLen bytes of keystream for the noncebytes/0 byte nonce N and the keybytes/0 byte key
K.
Return crypto_stream_keybytes(), in bytes.
Generate a random keybytes/0 byte key.
Return crypto_stream_messagebytes_max(), in bytes.
Return crypto_stream_noncebytes(), in bytes.
Return crypto_stream_primitive() as an atom.
Encrypt or decrypt M by combining it with the keystream for the nonce
N and key K.
TurboSHAKE128 extendable-output function
Return crypto_xof_turboshake128_blockbytes(), in bytes.
Hash In with TurboSHAKE128 and the standard domain byte, returning
Outlen bytes of output.
Return crypto_xof_turboshake128_domain_standard().
Start a streaming TurboSHAKE128 hash with the standard domain byte domain_standard/0.
Start a streaming TurboSHAKE128 hash with the domain separation byte
Domain (an integer from 0 to 255).
Read the next Outlen bytes of output from State.
Return crypto_xof_turboshake128_statebytes(), in bytes.
Absorb In into State and return the updated state.
TurboSHAKE256 extendable-output function
Return crypto_xof_turboshake256_blockbytes(), in bytes.
Hash In with TurboSHAKE256 and the standard domain byte, returning
Outlen bytes of output.
Return crypto_xof_turboshake256_domain_standard().
Start a streaming TurboSHAKE256 hash with the standard domain byte domain_standard/0.
Start a streaming TurboSHAKE256 hash with the domain separation byte
Domain (an integer from 0 to 255).
Read the next Outlen bytes of output from State.
Return crypto_xof_turboshake256_statebytes(), in bytes.
Absorb In into State and return the updated state.
X25519 point multiplication
Compute the public key for the clamped secret scalar N by multiplying
the base point. Returns -1 on failure.
Return crypto_scalarmult_curve25519_bytes(), in bytes.
Multiply the point P by the clamped secret scalar N, producing a
shared secret. Returns -1 when P is a low-order point.
Return crypto_scalarmult_curve25519_scalarbytes(), in bytes.
X25519-XChaCha20-Poly1305 box
Precompute the beforenmbytes/0 byte shared key for the public key PK
and the secret key SK, for use with the _afternm functions.
Return crypto_box_curve25519xchacha20poly1305_beforenmbytes(), in bytes.
Like easy/4, but returns the ciphertext and the macbytes/0 byte
authentication tag separately as {C, MAC}.
Like detached/4, using the shared key K precomputed by beforenm/2.
Returns {C, MAC}.
Encrypt and authenticate M with the nonce N, the recipient's public
key PK, and the sender's secret key SK.
Like easy/4, using the shared key K precomputed by beforenm/2.
Generate a random key pair. Returns {PK, SK}.
Return crypto_box_curve25519xchacha20poly1305_macbytes(), in bytes.
Return crypto_box_curve25519xchacha20poly1305_messagebytes_max(), in bytes.
Return crypto_box_curve25519xchacha20poly1305_noncebytes(), in bytes.
Verify the detached tag MAC and decrypt C with the nonce N, the
sender's public key PK, and the recipient's secret key SK.
Like open_detached/5, using the shared key K precomputed by
beforenm/2. Returns -1 when verification fails.
Verify and decrypt C, produced by easy/4, with the nonce N, the
sender's public key PK, and the recipient's secret key SK.
Like open_easy/4, using the shared key K precomputed by
beforenm/2. Returns -1 when verification fails.
Return crypto_box_curve25519xchacha20poly1305_publickeybytes(), in bytes.
Anonymously encrypt M for the recipient's public key PK using a new
ephemeral key pair. The result is sealbytes/0 bytes longer than M.
Open the sealed box C with the recipient's key pair PK and SK.
Return crypto_box_curve25519xchacha20poly1305_sealbytes(), in bytes.
Return crypto_box_curve25519xchacha20poly1305_secretkeybytes(), in bytes.
Deterministically derive a key pair from the seedbytes/0 byte Seed.
Returns {PK, SK}.
Return crypto_box_curve25519xchacha20poly1305_seedbytes(), in bytes.
X25519-XSalsa20-Poly1305 box
Like crypto_box_curve25519xsalsa20poly1305/4, using the shared key K
precomputed by beforenm/2.
Precompute the beforenmbytes/0 byte shared key for the public key PK
and the secret key SK, for use with afternm/3 and open_afternm/3.
Return crypto_box_curve25519xsalsa20poly1305_beforenmbytes(), in bytes.
Return crypto_box_curve25519xsalsa20poly1305_boxzerobytes(), in bytes.
Encrypt M, which must start with zerobytes/0 zero bytes, using the
nonce N, the recipient's public key PK, and the sender's secret key
SK.
Generate a random key pair. Returns {PK, SK}.
Return crypto_box_curve25519xsalsa20poly1305_macbytes(), in bytes.
Return crypto_box_curve25519xsalsa20poly1305_messagebytes_max(), in bytes.
Return crypto_box_curve25519xsalsa20poly1305_noncebytes(), in bytes.
Verify and decrypt C, which must start with boxzerobytes/0 zero
bytes, using the nonce N, the sender's public key PK, and the
recipient's secret key SK.
Like open/4, using the shared key K precomputed by beforenm/2.
Returns -1 when verification fails.
Return crypto_box_curve25519xsalsa20poly1305_publickeybytes(), in bytes.
Return crypto_box_curve25519xsalsa20poly1305_secretkeybytes(), in bytes.
Deterministically derive a key pair from the seedbytes/0 byte Seed.
Returns {PK, SK}.
Return crypto_box_curve25519xsalsa20poly1305_seedbytes(), in bytes.
Return crypto_box_curve25519xsalsa20poly1305_zerobytes(), in bytes.
X-Wing key encapsulation
Return crypto_kem_xwing_ciphertextbytes(), in bytes.
Decapsulate the ciphertext CT with the secret key SK and return the
shared secret SS.
Encapsulate a fresh random shared secret to the public key PK.
Returns {CT, SS}, or -1 when PK is invalid.
Encapsulate to the public key PK using the 64-byte Seed (the
ML-KEM-768 encapsulation seed followed by the ephemeral X25519 secret
key) instead of fresh randomness. Seed must be secret, uniformly
random, and never reused. Returns {CT, SS}, or -1 when PK is
invalid.
Generate a random key pair. Returns {PK, SK}.
Return crypto_kem_xwing_publickeybytes(), in bytes.
Return crypto_kem_xwing_secretkeybytes(), in bytes.
Deterministically derive a key pair from the seedbytes/0 byte Seed,
which must be secret and uniformly random. Returns {PK, SK}.
Return crypto_kem_xwing_seedbytes(), in bytes.
Return crypto_kem_xwing_sharedsecretbytes(), in bytes.
XChaCha20 stream cipher
Return CLen bytes of keystream for the noncebytes/0 byte nonce N and the keybytes/0 byte key
K.
Return crypto_stream_xchacha20_keybytes(), in bytes.
Generate a random keybytes/0 byte key.
Return crypto_stream_xchacha20_messagebytes_max(), in bytes.
Return crypto_stream_xchacha20_noncebytes(), in bytes.
Encrypt or decrypt M by combining it with the keystream for the nonce
N and key K, starting at block counter 0.
Like 'xor'/3, but start at the 64-byte block counter IC, so the
message is combined with the keystream from byte IC * 64 onwards.
XChaCha20-Poly1305
Return crypto_aead_xchacha20poly1305_ietf_abytes(), in bytes.
Verify and decrypt the ciphertext C with the additional data AD
(default empty), nonce NPub, and key K.
Verify the detached tag MAC and decrypt C with the additional data
AD (default empty). Returns the plaintext, or -1 when
verification fails.
Encrypt and authenticate M together with the additional data AD
(default empty) using the ietf_npubbytes/0 byte nonce NPub and
the ietf_keybytes/0 byte key K.
Encrypt and authenticate M with the additional data AD (default
empty), returning the ciphertext and the ietf_abytes/0 byte
authentication tag separately as {C, MAC}, or -1 on failure.
Return crypto_aead_xchacha20poly1305_ietf_keybytes(), in bytes.
Generate a random ietf_keybytes/0 byte key.
Return crypto_aead_xchacha20poly1305_ietf_messagebytes_max(), in bytes.
Return crypto_aead_xchacha20poly1305_ietf_npubbytes(), in bytes.
Return crypto_aead_xchacha20poly1305_ietf_nsecbytes(), in bytes.
XChaCha20-Poly1305 secret box
Encrypt and authenticate M with the nonce N and key K, returning
the ciphertext and the macbytes/0 byte authentication tag
separately as {C, MAC}, or -1 on failure.
Encrypt and authenticate M with the noncebytes/0 byte nonce N
and the keybytes/0 byte key K.
Return crypto_secretbox_xchacha20poly1305_keybytes(), in bytes.
Return crypto_secretbox_xchacha20poly1305_macbytes(), in bytes.
Return crypto_secretbox_xchacha20poly1305_messagebytes_max(), in bytes.
Return crypto_secretbox_xchacha20poly1305_noncebytes(), in bytes.
Verify the detached tag MAC and decrypt C with the nonce N and
key K. Returns the plaintext, or -1 when verification fails.
Verify and decrypt the ciphertext C produced by easy/3 with the
nonce N and key K. Returns the plaintext, or -1 when
verification fails or C is shorter than macbytes/0.
XSalsa20 stream cipher
Return CLen bytes of keystream for the noncebytes/0 byte nonce N and the keybytes/0 byte key
K.
Return crypto_stream_xsalsa20_keybytes(), in bytes.
Generate a random keybytes/0 byte key.
Return crypto_stream_xsalsa20_messagebytes_max(), in bytes.
Return crypto_stream_xsalsa20_noncebytes(), in bytes.
Encrypt or decrypt M by combining it with the keystream for the nonce
N and key K, starting at block counter 0.
Like 'xor'/3, but start at the 64-byte block counter IC, so the
message is combined with the keystream from byte IC * 64 onwards.
XSalsa20-Poly1305 secret box
Return crypto_secretbox_xsalsa20poly1305_boxzerobytes(), in bytes.
Encrypt M, which must start with zerobytes/0 zero bytes, with the
noncebytes/0 byte nonce N and the keybytes/0 byte key K.
Return crypto_secretbox_xsalsa20poly1305_keybytes(), in bytes.
Generate a random keybytes/0 byte key.
Return crypto_secretbox_xsalsa20poly1305_macbytes(), in bytes.
Return crypto_secretbox_xsalsa20poly1305_messagebytes_max(), in bytes.
Return crypto_secretbox_xsalsa20poly1305_noncebytes(), in bytes.
Verify and decrypt C, which must start with boxzerobytes/0 zero
bytes, with the nonce N and key K.
Return crypto_secretbox_xsalsa20poly1305_zerobytes(), in bytes.
Types
-opaque crypto_aead_aes256gcm_state()
A crypto_aead_aes256gcm_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
-opaque crypto_auth_hmacsha256_state()
A crypto_auth_hmacsha256_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
-opaque crypto_auth_hmacsha512_state()
A crypto_auth_hmacsha512_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
-opaque crypto_auth_hmacsha512256_state()
A crypto_auth_hmacsha512256_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
-opaque crypto_core_keccak1600_state()
A crypto_core_keccak1600_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
-opaque crypto_generichash_blake2b_state()
A crypto_generichash_blake2b_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
-opaque crypto_generichash_state()
A crypto_generichash_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
-opaque crypto_hash_sha256_state()
A crypto_hash_sha256_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
-opaque crypto_hash_sha512_state()
A crypto_hash_sha512_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
-opaque crypto_hash_sha3256_state()
A crypto_hash_sha3256_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
-opaque crypto_hash_sha3512_state()
A crypto_hash_sha3512_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
-opaque crypto_kdf_hkdf_sha256_state()
A crypto_kdf_hkdf_sha256_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
-opaque crypto_kdf_hkdf_sha512_state()
A crypto_kdf_hkdf_sha512_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
-opaque crypto_onetimeauth_poly1305_state()
A crypto_onetimeauth_poly1305_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
-opaque crypto_onetimeauth_state()
A crypto_onetimeauth_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
-opaque crypto_secretstream_xchacha20poly1305_state()
A crypto_secretstream_xchacha20poly1305_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
-opaque crypto_sign_ed25519ph_state()
A crypto_sign_ed25519ph_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
-opaque crypto_sign_state()
A crypto_sign_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
-opaque crypto_xof_shake128_state()
A crypto_xof_shake128_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
-opaque crypto_xof_shake256_state()
A crypto_xof_shake256_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
-opaque crypto_xof_turboshake128_state()
A crypto_xof_turboshake128_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
-opaque crypto_xof_turboshake256_state()
A crypto_xof_turboshake256_state held by the NIF. Each operation returns a new resource and
leaves its arguments unchanged.
16-byte comparison
-spec crypto_verify_16_bytes() -> Result when Result :: 16.
Return crypto_verify_16_bytes(), in bytes.
-spec crypto_verify_16_crypto_verify_16(X, Y) -> Result
when X :: <<_:128>>, Y :: <<_:128>>, Result :: 0 | -1.
Compare X and Y in constant time; returns 0 when they are equal and -1 otherwise.
32-byte comparison
-spec crypto_verify_32_bytes() -> Result when Result :: 32.
Return crypto_verify_32_bytes(), in bytes.
-spec crypto_verify_32_crypto_verify_32(X, Y) -> Result
when X :: <<_:256>>, Y :: <<_:256>>, Result :: 0 | -1.
Compare X and Y in constant time; returns 0 when they are equal and -1 otherwise.
64-byte comparison
-spec crypto_verify_64_bytes() -> Result when Result :: 64.
Return crypto_verify_64_bytes(), in bytes.
-spec crypto_verify_64_crypto_verify_64(X, Y) -> Result
when X :: <<_:512>>, Y :: <<_:512>>, Result :: 0 | -1.
Compare X and Y in constant time; returns 0 when they are equal and -1 otherwise.
AEGIS-128L
-spec crypto_aead_aegis128l_abytes() -> Result when Result :: 32.
Return crypto_aead_aegis128l_abytes(), in bytes.
-spec crypto_aead_aegis128l_decrypt(Nsec, C, Ad, Npub, K) -> Result when Nsec :: <<>>, C :: binary(), Ad :: binary(), Npub :: <<_:128>>, K :: <<_:128>>, Result :: binary() | -1.
Verify and decrypt the ciphertext C with the additional data AD
(default empty), nonce NPub, and key K.
-spec crypto_aead_aegis128l_decrypt_detached(Nsec, C, Mac, Ad, Npub, K) -> Result when Nsec :: <<>>, C :: binary(), Mac :: <<_:256>>, Ad :: binary(), Npub :: <<_:128>>, K :: <<_:128>>, Result :: binary() | -1.
Verify the detached abytes/0 byte tag MAC and decrypt C with the
additional data AD (default empty), nonce NPub, and key K.
Returns the plaintext, or -1 when verification fails.
-spec crypto_aead_aegis128l_encrypt(M, Ad, Nsec, Npub, K) -> Result when M :: binary(), Ad :: binary(), Nsec :: <<>>, Npub :: <<_:128>>, K :: <<_:128>>, Result :: binary() | -1.
Encrypt and authenticate M together with the additional data AD
(default empty) using the npubbytes/0 byte nonce NPub and the
keybytes/0 byte key K.
-spec crypto_aead_aegis128l_encrypt_detached(M, Ad, Nsec, Npub, K) -> Result when M :: binary(), Ad :: binary(), Nsec :: <<>>, Npub :: <<_:128>>, K :: <<_:128>>, Result :: {binary(), <<_:256>>} | -1.
Encrypt and authenticate M with the additional data AD (default
empty), nonce NPub, and key K, returning the ciphertext and the
abytes/0 byte authentication tag separately as {C, MAC}, or -1
on failure.
-spec crypto_aead_aegis128l_keybytes() -> Result when Result :: 16.
Return crypto_aead_aegis128l_keybytes(), in bytes.
-spec crypto_aead_aegis128l_keygen() -> Result when Result :: <<_:128>>.
Generate a random keybytes/0 byte key.
-spec crypto_aead_aegis128l_messagebytes_max() -> Result when Result :: non_neg_integer().
Return crypto_aead_aegis128l_messagebytes_max(), in bytes.
-spec crypto_aead_aegis128l_npubbytes() -> Result when Result :: 16.
Return crypto_aead_aegis128l_npubbytes(), in bytes.
-spec crypto_aead_aegis128l_nsecbytes() -> Result when Result :: 0.
Return crypto_aead_aegis128l_nsecbytes(), in bytes.
AEGIS-256
-spec crypto_aead_aegis256_abytes() -> Result when Result :: 32.
Return crypto_aead_aegis256_abytes(), in bytes.
-spec crypto_aead_aegis256_decrypt(Nsec, C, Ad, Npub, K) -> Result when Nsec :: <<>>, C :: binary(), Ad :: binary(), Npub :: <<_:256>>, K :: <<_:256>>, Result :: binary() | -1.
Verify and decrypt the ciphertext C with the additional data AD
(default empty), nonce NPub, and key K.
-spec crypto_aead_aegis256_decrypt_detached(Nsec, C, Mac, Ad, Npub, K) -> Result when Nsec :: <<>>, C :: binary(), Mac :: <<_:256>>, Ad :: binary(), Npub :: <<_:256>>, K :: <<_:256>>, Result :: binary() | -1.
Verify the detached abytes/0 byte tag MAC and decrypt C with the
additional data AD (default empty), nonce NPub, and key K.
Returns the plaintext, or -1 when verification fails.
-spec crypto_aead_aegis256_encrypt(M, Ad, Nsec, Npub, K) -> Result when M :: binary(), Ad :: binary(), Nsec :: <<>>, Npub :: <<_:256>>, K :: <<_:256>>, Result :: binary() | -1.
Encrypt and authenticate M together with the additional data AD
(default empty) using the npubbytes/0 byte nonce NPub and the
keybytes/0 byte key K.
-spec crypto_aead_aegis256_encrypt_detached(M, Ad, Nsec, Npub, K) -> Result when M :: binary(), Ad :: binary(), Nsec :: <<>>, Npub :: <<_:256>>, K :: <<_:256>>, Result :: {binary(), <<_:256>>} | -1.
Encrypt and authenticate M with the additional data AD (default
empty), nonce NPub, and key K, returning the ciphertext and the
abytes/0 byte authentication tag separately as {C, MAC}, or -1
on failure.
-spec crypto_aead_aegis256_keybytes() -> Result when Result :: 32.
Return crypto_aead_aegis256_keybytes(), in bytes.
-spec crypto_aead_aegis256_keygen() -> Result when Result :: <<_:256>>.
Generate a random keybytes/0 byte key.
-spec crypto_aead_aegis256_messagebytes_max() -> Result when Result :: non_neg_integer().
Return crypto_aead_aegis256_messagebytes_max(), in bytes.
-spec crypto_aead_aegis256_npubbytes() -> Result when Result :: 32.
Return crypto_aead_aegis256_npubbytes(), in bytes.
-spec crypto_aead_aegis256_nsecbytes() -> Result when Result :: 0.
Return crypto_aead_aegis256_nsecbytes(), in bytes.
AES256-GCM
-spec crypto_aead_aes256gcm_abytes() -> Result when Result :: 16.
Return crypto_aead_aes256gcm_abytes(), in bytes.
-spec crypto_aead_aes256gcm_beforenm(K) -> Result when K :: <<_:256>>, Result :: crypto_aead_aes256gcm_state() | -1.
Expand the key K into a precomputed state for the _afternm functions.
-spec crypto_aead_aes256gcm_decrypt(Nsec, C, Ad, Npub, K) -> Result when Nsec :: <<>>, C :: binary(), Ad :: binary(), Npub :: <<_:96>>, K :: <<_:256>>, Result :: binary() | -1.
Verify and decrypt the ciphertext C with the additional data AD,
nonce NPub, and key K.
-spec crypto_aead_aes256gcm_decrypt_afternm(Nsec, C, Ad, Npub, Ctx) -> Result when Nsec :: <<>>, C :: binary(), Ad :: binary(), Npub :: <<_:96>>, Ctx :: crypto_aead_aes256gcm_state(), Result :: binary() | -1.
Like decrypt/4, using a state precomputed by beforenm/1.
-spec crypto_aead_aes256gcm_decrypt_detached(Nsec, C, Mac, Ad, Npub, K) -> Result when Nsec :: <<>>, C :: binary(), Mac :: <<_:128>>, Ad :: binary(), Npub :: <<_:96>>, K :: <<_:256>>, Result :: binary() | -1.
Verify the detached tag MAC and decrypt C with the additional data
AD. Returns the plaintext, or -1 when verification fails.
-spec crypto_aead_aes256gcm_decrypt_detached_afternm(Nsec, C, Mac, Ad, Npub, Ctx) -> Result when Nsec :: <<>>, C :: binary(), Mac :: <<_:128>>, Ad :: binary(), Npub :: <<_:96>>, Ctx :: crypto_aead_aes256gcm_state(), Result :: binary() | -1.
Like decrypt_detached/5, using a state precomputed by beforenm/1.
-spec crypto_aead_aes256gcm_encrypt(M, Ad, Nsec, Npub, K) -> Result when M :: binary(), Ad :: binary(), Nsec :: <<>>, Npub :: <<_:96>>, K :: <<_:256>>, Result :: binary() | -1.
Encrypt and authenticate M together with the additional data AD
using the nonce NPub and key K.
-spec crypto_aead_aes256gcm_encrypt_afternm(M, Ad, Nsec, Npub, Ctx) -> Result when M :: binary(), Ad :: binary(), Nsec :: <<>>, Npub :: <<_:96>>, Ctx :: crypto_aead_aes256gcm_state(), Result :: binary() | -1.
Like encrypt/4, using a state precomputed by beforenm/1.
-spec crypto_aead_aes256gcm_encrypt_detached(M, Ad, Nsec, Npub, K) -> Result when M :: binary(), Ad :: binary(), Nsec :: <<>>, Npub :: <<_:96>>, K :: <<_:256>>, Result :: {binary(), <<_:128>>} | -1.
Encrypt and authenticate M with the additional data AD, returning
the ciphertext and the authentication tag separately as {C, MAC}.
-spec crypto_aead_aes256gcm_encrypt_detached_afternm(M, Ad, Nsec, Npub, Ctx) -> Result when M :: binary(), Ad :: binary(), Nsec :: <<>>, Npub :: <<_:96>>, Ctx :: crypto_aead_aes256gcm_state(), Result :: {binary(), <<_:128>>} | -1.
Like encrypt_detached/4, using a state precomputed by beforenm/1.
-spec crypto_aead_aes256gcm_is_available() -> Result when Result :: integer().
Return 1 when the CPU supports hardware-accelerated AES256-GCM, otherwise 0.
-spec crypto_aead_aes256gcm_keybytes() -> Result when Result :: 32.
Return crypto_aead_aes256gcm_keybytes(), in bytes.
-spec crypto_aead_aes256gcm_keygen() -> Result when Result :: <<_:256>>.
Generate a random keybytes/0 byte key.
-spec crypto_aead_aes256gcm_messagebytes_max() -> Result when Result :: non_neg_integer().
Return crypto_aead_aes256gcm_messagebytes_max(), in bytes.
-spec crypto_aead_aes256gcm_npubbytes() -> Result when Result :: 12.
Return crypto_aead_aes256gcm_npubbytes(), in bytes.
-spec crypto_aead_aes256gcm_nsecbytes() -> Result when Result :: 0.
Return crypto_aead_aes256gcm_nsecbytes(), in bytes.
-spec crypto_aead_aes256gcm_statebytes() -> Result when Result :: 512.
Return crypto_aead_aes256gcm_statebytes(), in bytes.
Argon2i password hashing
-spec crypto_pwhash_argon2i_alg_argon2i13() -> Result when Result :: 1.
Return the algorithm identifier for Argon2i version 1.3, the only Alg accepted by
crypto_pwhash_argon2i/6.
-spec crypto_pwhash_argon2i_bytes_max() -> Result when Result :: 4294967295.
Return crypto_pwhash_argon2i_bytes_max(), in bytes.
-spec crypto_pwhash_argon2i_bytes_min() -> Result when Result :: 16.
Return crypto_pwhash_argon2i_bytes_min(), in bytes.
-spec crypto_pwhash_argon2i_crypto_pwhash_argon2i(Outlen, Passwd, Salt, Opslimit, Memlimit, Alg) -> Result when Outlen :: non_neg_integer(), Passwd :: binary(), Salt :: binary(), Opslimit :: non_neg_integer(), Memlimit :: non_neg_integer(), Alg :: integer(), Result :: binary() | -1.
Derive an Outlen byte key from Passwd and the salt Salt (at least
saltbytes/0 bytes; only the first saltbytes/0 are used) with the
cost parameters Opslimit and Memlimit. Alg must be
alg_argon2i13/0.
-spec crypto_pwhash_argon2i_memlimit_interactive() -> Result when Result :: 33554432.
Return crypto_pwhash_argon2i_memlimit_interactive(), in bytes.
-spec crypto_pwhash_argon2i_memlimit_max() -> Result when Result :: non_neg_integer().
Return crypto_pwhash_argon2i_memlimit_max(), in bytes.
-spec crypto_pwhash_argon2i_memlimit_min() -> Result when Result :: 8192.
Return crypto_pwhash_argon2i_memlimit_min(), in bytes.
-spec crypto_pwhash_argon2i_memlimit_moderate() -> Result when Result :: 134217728.
Return crypto_pwhash_argon2i_memlimit_moderate(), in bytes.
-spec crypto_pwhash_argon2i_memlimit_sensitive() -> Result when Result :: 536870912.
Return crypto_pwhash_argon2i_memlimit_sensitive(), in bytes.
-spec crypto_pwhash_argon2i_opslimit_interactive() -> Result when Result :: 4.
Return crypto_pwhash_argon2i_opslimit_interactive(), in bytes.
-spec crypto_pwhash_argon2i_opslimit_max() -> Result when Result :: 4294967295.
Return crypto_pwhash_argon2i_opslimit_max(), in bytes.
-spec crypto_pwhash_argon2i_opslimit_min() -> Result when Result :: 3.
Return crypto_pwhash_argon2i_opslimit_min(), in bytes.
-spec crypto_pwhash_argon2i_opslimit_moderate() -> Result when Result :: 6.
Return crypto_pwhash_argon2i_opslimit_moderate(), in bytes.
-spec crypto_pwhash_argon2i_opslimit_sensitive() -> Result when Result :: 8.
Return crypto_pwhash_argon2i_opslimit_sensitive(), in bytes.
-spec crypto_pwhash_argon2i_passwd_max() -> Result when Result :: 4294967295.
Return crypto_pwhash_argon2i_passwd_max(), in bytes.
-spec crypto_pwhash_argon2i_passwd_min() -> Result when Result :: 0.
Return crypto_pwhash_argon2i_passwd_min(), in bytes.
-spec crypto_pwhash_argon2i_saltbytes() -> Result when Result :: 16.
Return crypto_pwhash_argon2i_saltbytes(), in bytes.
-spec crypto_pwhash_argon2i_str(Passwd, Opslimit, Memlimit) -> Result when Passwd :: binary(), Opslimit :: non_neg_integer(), Memlimit :: non_neg_integer(), Result :: binary() | -1.
Hash Passwd for storage with the cost parameters Opslimit and
Memlimit and a random salt.
-spec crypto_pwhash_argon2i_str_needs_rehash(Str, Opslimit, Memlimit) -> Result when Str :: binary(), Opslimit :: non_neg_integer(), Memlimit :: non_neg_integer(), Result :: -1 | 0 | 1.
Check whether Str was hashed with Argon2i and exactly the cost
parameters Opslimit and Memlimit.
-spec crypto_pwhash_argon2i_str_verify(Str, Passwd) -> Result when Str :: binary(), Passwd :: binary(), Result :: 0 | -1.
Check Passwd against Str, an Argon2i string produced by str/3.
-spec crypto_pwhash_argon2i_strbytes() -> Result when Result :: 128.
Return crypto_pwhash_argon2i_strbytes(), in bytes.
-spec crypto_pwhash_argon2i_strprefix() -> Result when Result :: binary().
Return crypto_pwhash_argon2i_strprefix() as a binary.
Argon2id password hashing
-spec crypto_pwhash_argon2id_alg_argon2id13() -> Result when Result :: 2.
Return the algorithm identifier for Argon2id version 1.3, the only Alg accepted by
crypto_pwhash_argon2id/6.
-spec crypto_pwhash_argon2id_bytes_max() -> Result when Result :: 4294967295.
Return crypto_pwhash_argon2id_bytes_max(), in bytes.
-spec crypto_pwhash_argon2id_bytes_min() -> Result when Result :: 16.
Return crypto_pwhash_argon2id_bytes_min(), in bytes.
-spec crypto_pwhash_argon2id_crypto_pwhash_argon2id(Outlen, Passwd, Salt, Opslimit, Memlimit, Alg) -> Result when Outlen :: non_neg_integer(), Passwd :: binary(), Salt :: binary(), Opslimit :: non_neg_integer(), Memlimit :: non_neg_integer(), Alg :: integer(), Result :: binary() | -1.
Derive an Outlen byte key from Passwd and the salt Salt (at least
saltbytes/0 bytes; only the first saltbytes/0 are used) with the
cost parameters Opslimit and Memlimit. Alg must be
alg_argon2id13/0.
-spec crypto_pwhash_argon2id_memlimit_interactive() -> Result when Result :: 67108864.
Return crypto_pwhash_argon2id_memlimit_interactive(), in bytes.
-spec crypto_pwhash_argon2id_memlimit_max() -> Result when Result :: non_neg_integer().
Return crypto_pwhash_argon2id_memlimit_max(), in bytes.
-spec crypto_pwhash_argon2id_memlimit_min() -> Result when Result :: 8192.
Return crypto_pwhash_argon2id_memlimit_min(), in bytes.
-spec crypto_pwhash_argon2id_memlimit_moderate() -> Result when Result :: 268435456.
Return crypto_pwhash_argon2id_memlimit_moderate(), in bytes.
-spec crypto_pwhash_argon2id_memlimit_sensitive() -> Result when Result :: 1073741824.
Return crypto_pwhash_argon2id_memlimit_sensitive(), in bytes.
-spec crypto_pwhash_argon2id_opslimit_interactive() -> Result when Result :: 2.
Return crypto_pwhash_argon2id_opslimit_interactive(), in bytes.
-spec crypto_pwhash_argon2id_opslimit_max() -> Result when Result :: 4294967295.
Return crypto_pwhash_argon2id_opslimit_max(), in bytes.
-spec crypto_pwhash_argon2id_opslimit_min() -> Result when Result :: 1.
Return crypto_pwhash_argon2id_opslimit_min(), in bytes.
-spec crypto_pwhash_argon2id_opslimit_moderate() -> Result when Result :: 3.
Return crypto_pwhash_argon2id_opslimit_moderate(), in bytes.
-spec crypto_pwhash_argon2id_opslimit_sensitive() -> Result when Result :: 4.
Return crypto_pwhash_argon2id_opslimit_sensitive(), in bytes.
-spec crypto_pwhash_argon2id_passwd_max() -> Result when Result :: 4294967295.
Return crypto_pwhash_argon2id_passwd_max(), in bytes.
-spec crypto_pwhash_argon2id_passwd_min() -> Result when Result :: 0.
Return crypto_pwhash_argon2id_passwd_min(), in bytes.
-spec crypto_pwhash_argon2id_saltbytes() -> Result when Result :: 16.
Return crypto_pwhash_argon2id_saltbytes(), in bytes.
-spec crypto_pwhash_argon2id_str(Passwd, Opslimit, Memlimit) -> Result when Passwd :: binary(), Opslimit :: non_neg_integer(), Memlimit :: non_neg_integer(), Result :: binary() | -1.
Hash Passwd for storage with the cost parameters Opslimit and
Memlimit and a random salt.
-spec crypto_pwhash_argon2id_str_needs_rehash(Str, Opslimit, Memlimit) -> Result when Str :: binary(), Opslimit :: non_neg_integer(), Memlimit :: non_neg_integer(), Result :: -1 | 0 | 1.
Check whether Str was hashed with Argon2id and exactly the cost
parameters Opslimit and Memlimit.
-spec crypto_pwhash_argon2id_str_verify(Str, Passwd) -> Result when Str :: binary(), Passwd :: binary(), Result :: 0 | -1.
Check Passwd against Str, an Argon2id string produced by str/3.
-spec crypto_pwhash_argon2id_strbytes() -> Result when Result :: 128.
Return crypto_pwhash_argon2id_strbytes(), in bytes.
-spec crypto_pwhash_argon2id_strprefix() -> Result when Result :: binary().
Return crypto_pwhash_argon2id_strprefix() as a binary.
BLAKE2b
-spec crypto_generichash_blake2b_bytes() -> Result when Result :: 32.
Return crypto_generichash_blake2b_bytes(), in bytes.
-spec crypto_generichash_blake2b_bytes_max() -> Result when Result :: 64.
Return crypto_generichash_blake2b_bytes_max(), in bytes.
-spec crypto_generichash_blake2b_bytes_min() -> Result when Result :: 16.
Return crypto_generichash_blake2b_bytes_min(), in bytes.
-spec crypto_generichash_blake2b_crypto_generichash_blake2b(Outlen, In, Key) -> Result when Outlen :: 16..64, In :: binary(), Key :: binary(), Result :: binary() | -1.
Hash In with the optional Key, producing Outlen bytes.
-spec crypto_generichash_blake2b_final(State, Outlen) -> Result when State :: crypto_generichash_blake2b_state(), Outlen :: 16..64, Result :: binary() | -1.
Finish the streaming hash in State, producing Outlen bytes. The
length should match the one passed to init/2 (default bytes/0).
-spec crypto_generichash_blake2b_init(Key, Outlen) -> Result when Key :: binary(), Outlen :: 16..64, Result :: crypto_generichash_blake2b_state() | -1.
Start a streaming hash with the optional Key that will produce
Outlen bytes. Defaults to bytes/0 bytes of output and no key.
-spec crypto_generichash_blake2b_init_salt_personal(Key, Outlen, Salt, Personal) -> Result when Key :: binary(), Outlen :: 16..64, Salt :: <<_:128>>, Personal :: <<_:128>>, Result :: crypto_generichash_blake2b_state() | -1.
Start a streaming hash with the optional Key, the saltbytes/0 byte
Salt, and the personalbytes/0 byte Personal that will produce
Outlen bytes. Defaults to bytes/0 bytes of output and no key.
-spec crypto_generichash_blake2b_keybytes() -> Result when Result :: 32.
Return crypto_generichash_blake2b_keybytes(), in bytes.
-spec crypto_generichash_blake2b_keybytes_max() -> Result when Result :: 64.
Return crypto_generichash_blake2b_keybytes_max(), in bytes.
-spec crypto_generichash_blake2b_keybytes_min() -> Result when Result :: 16.
Return crypto_generichash_blake2b_keybytes_min(), in bytes.
-spec crypto_generichash_blake2b_keygen() -> Result when Result :: <<_:256>>.
Generate a random keybytes/0 byte key.
-spec crypto_generichash_blake2b_personalbytes() -> Result when Result :: 16.
Return crypto_generichash_blake2b_personalbytes(), in bytes.
-spec crypto_generichash_blake2b_salt_personal(Outlen, In, Key, Salt, Personal) -> Result when Outlen :: 16..64, In :: binary(), Key :: binary(), Salt :: <<_:128>>, Personal :: <<_:128>>, Result :: binary() | -1.
Hash In with the optional Key, the saltbytes/0 byte Salt, and the
personalbytes/0 byte Personal, producing Outlen bytes.
-spec crypto_generichash_blake2b_saltbytes() -> Result when Result :: 16.
Return crypto_generichash_blake2b_saltbytes(), in bytes.
-spec crypto_generichash_blake2b_statebytes() -> Result when Result :: 384.
Return crypto_generichash_blake2b_statebytes(), in bytes.
-spec crypto_generichash_blake2b_update(State, In) -> Result when State :: crypto_generichash_blake2b_state(), In :: binary(), Result :: crypto_generichash_blake2b_state() | -1.
Absorb In into State and return the updated state.
BLAKE2b key derivation
-spec crypto_kdf_blake2b_bytes_max() -> Result when Result :: 64.
Return crypto_kdf_blake2b_bytes_max(), in bytes.
-spec crypto_kdf_blake2b_bytes_min() -> Result when Result :: 16.
Return crypto_kdf_blake2b_bytes_min(), in bytes.
-spec crypto_kdf_blake2b_contextbytes() -> Result when Result :: 8.
Return crypto_kdf_blake2b_contextbytes(), in bytes.
-spec crypto_kdf_blake2b_derive_from_key(SubkeyLen, SubkeyId, Ctx, Key) -> Result when SubkeyLen :: non_neg_integer(), SubkeyId :: non_neg_integer(), Ctx :: <<_:64>>, Key :: <<_:256>>, Result :: binary() | -1.
Derive the SubkeyLen byte subkey number SubkeyId for the
contextbytes/0 byte context Ctx from the keybytes/0 byte master
key Key.
-spec crypto_kdf_blake2b_keybytes() -> Result when Result :: 32.
Return crypto_kdf_blake2b_keybytes(), in bytes.
ChaCha20 stream cipher
-spec crypto_stream_chacha20_crypto_stream_chacha20(Clen, N, K) -> Result when Clen :: non_neg_integer(), N :: <<_:64>>, K :: <<_:256>>, Result :: binary().
Return CLen bytes of keystream for the noncebytes/0 byte nonce N and the keybytes/0 byte key
K.
-spec crypto_stream_chacha20_ietf(Clen, N, K) -> Result when Clen :: non_neg_integer(), N :: <<_:96>>, K :: <<_:256>>, Result :: binary().
Return CLen bytes of IETF ChaCha20 keystream for the
ietf_noncebytes/0 byte nonce N and the ietf_keybytes/0 byte key
K. CLen must not exceed ietf_messagebytes_max/0.
-spec crypto_stream_chacha20_ietf_keybytes() -> Result when Result :: 32.
Return crypto_stream_chacha20_ietf_keybytes(), in bytes.
-spec crypto_stream_chacha20_ietf_keygen() -> Result when Result :: <<_:256>>.
Generate a random ietf_keybytes/0 byte key.
-spec crypto_stream_chacha20_ietf_messagebytes_max() -> Result when Result :: non_neg_integer().
Return crypto_stream_chacha20_ietf_messagebytes_max(), in bytes.
-spec crypto_stream_chacha20_ietf_noncebytes() -> Result when Result :: 12.
Return crypto_stream_chacha20_ietf_noncebytes(), in bytes.
-spec crypto_stream_chacha20_ietf_xor(M, N, K) -> Result when M :: binary(), N :: <<_:96>>, K :: <<_:256>>, Result :: binary().
Encrypt or decrypt M with IETF ChaCha20 using the nonce N and key
K, starting at block counter 0.
-spec crypto_stream_chacha20_ietf_xor_ic(M, N, Ic, K) -> Result when M :: binary(), N :: <<_:96>>, Ic :: 0..4294967295, K :: <<_:256>>, Result :: binary().
Like ietf_xor/3, but start at the 32-bit block counter IC. Raises
badarg when the message would overflow the block counter.
-spec crypto_stream_chacha20_keybytes() -> Result when Result :: 32.
Return crypto_stream_chacha20_keybytes(), in bytes.
-spec crypto_stream_chacha20_keygen() -> Result when Result :: <<_:256>>.
Generate a random keybytes/0 byte key.
-spec crypto_stream_chacha20_messagebytes_max() -> Result when Result :: non_neg_integer().
Return crypto_stream_chacha20_messagebytes_max(), in bytes.
-spec crypto_stream_chacha20_noncebytes() -> Result when Result :: 8.
Return crypto_stream_chacha20_noncebytes(), in bytes.
-spec crypto_stream_chacha20_xor(M, N, K) -> Result when M :: binary(), N :: <<_:64>>, K :: <<_:256>>, Result :: binary().
Encrypt or decrypt M by combining it with the keystream for the nonce
N and key K, starting at block counter 0.
-spec crypto_stream_chacha20_xor_ic(M, N, Ic, K) -> Result when M :: binary(), N :: <<_:64>>, Ic :: non_neg_integer(), K :: <<_:256>>, Result :: binary().
Like 'xor'/3, but start at the 64-byte block counter IC, so the
message is combined with the keystream from byte IC * 64 onwards.
ChaCha20-Poly1305
-spec crypto_aead_chacha20poly1305_abytes() -> Result when Result :: 16.
Return crypto_aead_chacha20poly1305_abytes(), in bytes.
-spec crypto_aead_chacha20poly1305_decrypt(Nsec, C, Ad, Npub, K) -> Result when Nsec :: <<>>, C :: binary(), Ad :: binary(), Npub :: <<_:64>>, K :: <<_:256>>, Result :: binary() | -1.
Verify and decrypt the ciphertext C produced by encrypt/4 with the
additional data AD (default empty), nonce NPub, and key K.
-spec crypto_aead_chacha20poly1305_decrypt_detached(Nsec, C, Mac, Ad, Npub, K) -> Result when Nsec :: <<>>, C :: binary(), Mac :: <<_:128>>, Ad :: binary(), Npub :: <<_:64>>, K :: <<_:256>>, Result :: binary() | -1.
Like decrypt/4, verifying the detached tag MAC for C. Returns
the plaintext, or -1 when verification fails.
-spec crypto_aead_chacha20poly1305_encrypt(M, Ad, Nsec, Npub, K) -> Result when M :: binary(), Ad :: binary(), Nsec :: <<>>, Npub :: <<_:64>>, K :: <<_:256>>, Result :: binary() | -1.
Encrypt and authenticate M together with the additional data AD
(default empty) using the original construction with the
npubbytes/0 byte nonce NPub and the keybytes/0 byte key K.
-spec crypto_aead_chacha20poly1305_encrypt_detached(M, Ad, Nsec, Npub, K) -> Result when M :: binary(), Ad :: binary(), Nsec :: <<>>, Npub :: <<_:64>>, K :: <<_:256>>, Result :: {binary(), <<_:128>>} | -1.
Like encrypt/4, returning the ciphertext and the abytes/0 byte
authentication tag separately as {C, MAC}, or -1 on failure.
-spec crypto_aead_chacha20poly1305_ietf_abytes() -> Result when Result :: 16.
Return crypto_aead_chacha20poly1305_ietf_abytes(), in bytes.
-spec crypto_aead_chacha20poly1305_ietf_decrypt(Nsec, C, Ad, Npub, K) -> Result when Nsec :: <<>>, C :: binary(), Ad :: binary(), Npub :: <<_:96>>, K :: <<_:256>>, Result :: binary() | -1.
Verify and decrypt the ciphertext C with the additional data AD
(default empty), nonce NPub, and key K.
-spec crypto_aead_chacha20poly1305_ietf_decrypt_detached(Nsec, C, Mac, Ad, Npub, K) -> Result when Nsec :: <<>>, C :: binary(), Mac :: <<_:128>>, Ad :: binary(), Npub :: <<_:96>>, K :: <<_:256>>, Result :: binary() | -1.
Verify the detached tag MAC and decrypt C with the additional data
AD (default empty). Returns the plaintext, or -1 when
verification fails.
-spec crypto_aead_chacha20poly1305_ietf_encrypt(M, Ad, Nsec, Npub, K) -> Result when M :: binary(), Ad :: binary(), Nsec :: <<>>, Npub :: <<_:96>>, K :: <<_:256>>, Result :: binary() | -1.
Encrypt and authenticate M together with the additional data AD
(default empty) using the ietf_npubbytes/0 byte nonce NPub and
the ietf_keybytes/0 byte key K.
-spec crypto_aead_chacha20poly1305_ietf_encrypt_detached(M, Ad, Nsec, Npub, K) -> Result when M :: binary(), Ad :: binary(), Nsec :: <<>>, Npub :: <<_:96>>, K :: <<_:256>>, Result :: {binary(), <<_:128>>} | -1.
Encrypt and authenticate M with the additional data AD (default
empty), returning the ciphertext and the ietf_abytes/0 byte
authentication tag separately as {C, MAC}, or -1 on failure.
-spec crypto_aead_chacha20poly1305_ietf_keybytes() -> Result when Result :: 32.
Return crypto_aead_chacha20poly1305_ietf_keybytes(), in bytes.
-spec crypto_aead_chacha20poly1305_ietf_keygen() -> Result when Result :: <<_:256>>.
Generate a random ietf_keybytes/0 byte key.
-spec crypto_aead_chacha20poly1305_ietf_messagebytes_max() -> Result when Result :: non_neg_integer().
Return crypto_aead_chacha20poly1305_ietf_messagebytes_max(), in bytes.
-spec crypto_aead_chacha20poly1305_ietf_npubbytes() -> Result when Result :: 12.
Return crypto_aead_chacha20poly1305_ietf_npubbytes(), in bytes.
-spec crypto_aead_chacha20poly1305_ietf_nsecbytes() -> Result when Result :: 0.
Return crypto_aead_chacha20poly1305_ietf_nsecbytes(), in bytes.
-spec crypto_aead_chacha20poly1305_keybytes() -> Result when Result :: 32.
Return crypto_aead_chacha20poly1305_keybytes(), in bytes.
-spec crypto_aead_chacha20poly1305_keygen() -> Result when Result :: <<_:256>>.
Generate a random keybytes/0 byte key.
-spec crypto_aead_chacha20poly1305_messagebytes_max() -> Result when Result :: non_neg_integer().
Return crypto_aead_chacha20poly1305_messagebytes_max(), in bytes.
-spec crypto_aead_chacha20poly1305_npubbytes() -> Result when Result :: 8.
Return crypto_aead_chacha20poly1305_npubbytes(), in bytes.
-spec crypto_aead_chacha20poly1305_nsecbytes() -> Result when Result :: 0.
Return crypto_aead_chacha20poly1305_nsecbytes(), in bytes.
CPU features
-spec runtime_has_aesni() -> Result when Result :: 0 | 1.
Return 1 if the CPU supports x86 AES-NI instructions, otherwise 0.
See libsodium_runtime.
-spec runtime_has_armcrypto() -> Result when Result :: 0 | 1.
Return 1 if the CPU supports the ARMv8 cryptography extensions (AES, SHA), otherwise 0.
See libsodium_runtime.
-spec runtime_has_avx2() -> Result when Result :: 0 | 1.
Return 1 if the CPU and operating system support x86 AVX2, otherwise 0.
See libsodium_runtime.
-spec runtime_has_avx512f() -> Result when Result :: 0 | 1.
Return 1 if the CPU and operating system support x86 AVX-512F, otherwise 0.
See libsodium_runtime.
-spec runtime_has_avx() -> Result when Result :: 0 | 1.
Return 1 if the CPU and operating system support x86 AVX, otherwise 0.
See libsodium_runtime.
-spec runtime_has_neon() -> Result when Result :: 0 | 1.
Return 1 if the CPU supports ARM NEON (Advanced SIMD), otherwise 0.
See libsodium_runtime.
-spec runtime_has_pclmul() -> Result when Result :: 0 | 1.
Return 1 if the CPU supports x86 carry-less multiplication (PCLMULQDQ), otherwise 0.
See libsodium_runtime.
-spec runtime_has_rdrand() -> Result when Result :: 0 | 1.
Return 1 if the CPU supports the x86 RDRAND instruction, otherwise 0.
See libsodium_runtime.
-spec runtime_has_sse2() -> Result when Result :: 0 | 1.
Return 1 if the CPU supports x86 SSE2, otherwise 0.
See libsodium_runtime.
-spec runtime_has_sse3() -> Result when Result :: 0 | 1.
Return 1 if the CPU supports x86 SSE3, otherwise 0.
See libsodium_runtime.
-spec runtime_has_sse41() -> Result when Result :: 0 | 1.
Return 1 if the CPU supports x86 SSE4.1, otherwise 0.
See libsodium_runtime.
-spec runtime_has_ssse3() -> Result when Result :: 0 | 1.
Return 1 if the CPU supports x86 SSSE3, otherwise 0.
See libsodium_runtime.
Ed25519 point multiplication
-spec crypto_scalarmult_ed25519_base(N) -> Result when N :: <<_:256>>, Result :: <<_:256>> | -1.
Multiply the base point by the clamped scalar N. Returns -1 when
N is zero.
-spec crypto_scalarmult_ed25519_base_noclamp(N) -> Result when N :: <<_:256>>, Result :: <<_:256>> | -1.
Multiply the base point by the scalar N without clamping. Returns
-1 when the result is the identity.
-spec crypto_scalarmult_ed25519_bytes() -> Result when Result :: 32.
Return crypto_scalarmult_ed25519_bytes(), in bytes.
-spec crypto_scalarmult_ed25519_crypto_scalarmult_ed25519(N, P) -> Result
when
N :: <<_:256>>,
P :: <<_:256>>,
Result :: <<_:256>> | -1.
Multiply the point P by the clamped scalar N. Returns -1 when P
is invalid or of small order, or when the result is the identity.
-spec crypto_scalarmult_ed25519_noclamp(N, P) -> Result
when N :: <<_:256>>, P :: <<_:256>>, Result :: <<_:256>> | -1.
Multiply the point P by the scalar N without clamping. Returns -1
when P is invalid or of small order, or when the result is the
identity.
-spec crypto_scalarmult_ed25519_scalarbytes() -> Result when Result :: 32.
Return crypto_scalarmult_ed25519_scalarbytes(), in bytes.
Ed25519 signatures
-spec crypto_sign_ed25519_bytes() -> Result when Result :: 64.
Return crypto_sign_ed25519_bytes(), in bytes.
-spec crypto_sign_ed25519_crypto_sign_ed25519(M, Sk) -> Result when M :: binary(), Sk :: <<_:512>>, Result :: binary() | -1.
Sign M with the secret key SK, returning the bytes/0 byte
signature followed by the message.
-spec crypto_sign_ed25519_detached(M, Sk) -> Result when M :: binary(), Sk :: <<_:512>>, Result :: <<_:512>> | -1.
Sign M with the secret key SK, returning only the bytes/0 byte signature.
-spec crypto_sign_ed25519_final_create(State, Sk) -> Result when State :: crypto_sign_ed25519ph_state(), Sk :: <<_:512>>, Result :: <<_:512>> | -1.
Finish the streaming message in State and sign it with the secret key
SK, returning the bytes/0 byte Ed25519ph signature.
-spec crypto_sign_ed25519_final_verify(State, Sig, Pk) -> Result when State :: crypto_sign_ed25519ph_state(), Sig :: <<_:512>>, Pk :: <<_:256>>, Result :: 0 | -1.
Finish the streaming message in State and verify its Ed25519ph
signature Sig with the public key PK. Returns 0 when the signature
is valid and -1 otherwise.
-spec crypto_sign_ed25519_init() -> Result when Result :: crypto_sign_ed25519ph_state() | -1.
Start a streaming Ed25519ph signature, returning a new state. Same as
libsodium_crypto_sign_ed25519ph:init/0.
-spec crypto_sign_ed25519_keypair() -> Result when Result :: {<<_:256>>, <<_:512>>} | -1.
Generate a random key pair. Returns {PK, SK}.
-spec crypto_sign_ed25519_messagebytes_max() -> Result when Result :: non_neg_integer().
Return crypto_sign_ed25519_messagebytes_max(), in bytes.
-spec crypto_sign_ed25519_open(Sm, Pk) -> Result when Sm :: binary(), Pk :: <<_:256>>, Result :: binary() | -1.
Verify the signed message SM with the public key PK and return the
message without its signature, or -1 when the signature is invalid.
-spec crypto_sign_ed25519_pk_to_curve25519(Ed25519Pk) -> Result
when Ed25519Pk :: <<_:256>>, Result :: <<_:256>> | -1.
Convert the Ed25519 public key Ed25519PK into an X25519 public key.
Returns -1 when the key is not a valid point of prime order (for
example a small-order point).
-spec crypto_sign_ed25519_publickeybytes() -> Result when Result :: 32.
Return crypto_sign_ed25519_publickeybytes(), in bytes.
-spec crypto_sign_ed25519_secretkeybytes() -> Result when Result :: 64.
Return crypto_sign_ed25519_secretkeybytes(), in bytes.
-spec crypto_sign_ed25519_seed_keypair(Seed) -> Result
when Seed :: <<_:256>>, Result :: {<<_:256>>, <<_:512>>} | -1.
Deterministically derive a key pair from the seedbytes/0 byte Seed.
Returns {PK, SK}.
-spec crypto_sign_ed25519_seedbytes() -> Result when Result :: 32.
Return crypto_sign_ed25519_seedbytes(), in bytes.
-spec crypto_sign_ed25519_sk_to_curve25519(Ed25519Sk) -> Result
when Ed25519Sk :: <<_:512>>, Result :: <<_:256>> | -1.
Convert the Ed25519 secret key Ed25519SK into an X25519 secret key.
-spec crypto_sign_ed25519_sk_to_pk(Sk) -> Result when Sk :: <<_:512>>, Result :: <<_:256>> | -1.
Extract the publickeybytes/0 byte public key from the secret key SK.
-spec crypto_sign_ed25519_sk_to_seed(Sk) -> Result when Sk :: <<_:512>>, Result :: <<_:256>> | -1.
Extract the seedbytes/0 byte seed from the secret key SK.
-spec crypto_sign_ed25519_statebytes() -> Result when Result :: 208.
Return crypto_sign_ed25519ph_statebytes(), the size of a streaming state, in bytes.
-spec crypto_sign_ed25519_update(State, M) -> Result when State :: crypto_sign_ed25519ph_state(), M :: binary(), Result :: crypto_sign_ed25519ph_state() | -1.
Absorb the message chunk M into State and return the updated state.
-spec crypto_sign_ed25519_verify_detached(Sig, M, Pk) -> Result when Sig :: <<_:512>>, M :: binary(), Pk :: <<_:256>>, Result :: 0 | -1.
Verify the detached signature Sig of M with the public key PK.
Returns 0 when the signature is valid and -1 otherwise.
Ed25519ph signatures
-spec crypto_sign_ed25519ph_final_create(State, Sk) -> Result when State :: crypto_sign_ed25519ph_state(), Sk :: <<_:512>>, Result :: <<_:512>> | -1.
Finish the streaming message in State and sign it with the Ed25519
secret key SK, returning a
libsodium_crypto_sign_ed25519:bytes/0 byte signature.
-spec crypto_sign_ed25519ph_final_verify(State, Sig, Pk) -> Result when State :: crypto_sign_ed25519ph_state(), Sig :: <<_:512>>, Pk :: <<_:256>>, Result :: 0 | -1.
Finish the streaming message in State and verify its signature Sig
with the Ed25519 public key PK. Returns 0 when the signature is
valid and -1 otherwise.
-spec crypto_sign_ed25519ph_init() -> Result when Result :: crypto_sign_ed25519ph_state() | -1.
Start a streaming Ed25519ph signature, returning a new state.
-spec crypto_sign_ed25519ph_statebytes() -> Result when Result :: 208.
Return crypto_sign_ed25519ph_statebytes(), in bytes.
-spec crypto_sign_ed25519ph_update(State, M) -> Result when State :: crypto_sign_ed25519ph_state(), M :: binary(), Result :: crypto_sign_ed25519ph_state() | -1.
Absorb the message chunk M into State and return the updated state.
Edwards25519 arithmetic
-spec crypto_core_ed25519_add(P, Q) -> Result
when P :: <<_:256>>, Q :: <<_:256>>, Result :: <<_:256>> | -1.
Return the point P + Q, or -1 when either input is not a point on the curve.
-spec crypto_core_ed25519_bytes() -> Result when Result :: 32.
Return crypto_core_ed25519_bytes(), in bytes.
-spec crypto_core_ed25519_from_hash(H) -> Result when H :: <<_:512>>, Result :: <<_:256>> | -1.
Map the hashbytes/0 byte string H to a point. Deprecated and
undocumented by libsodium; use from_uniform/1 instead.
-spec crypto_core_ed25519_from_uniform(R) -> Result when R :: <<_:256>>, Result :: <<_:256>> | -1.
Map the uniformbytes/0 byte string R (such as the output of a hash
function) to a point on the main subgroup using Elligator 2.
-spec crypto_core_ed25519_hashbytes() -> Result when Result :: 64.
Return crypto_core_ed25519_hashbytes(), in bytes.
-spec crypto_core_ed25519_is_valid_point(P) -> Result when P :: <<_:256>>, Result :: 0 | 1.
Return 1 when P is the canonical encoding of a point on the main
subgroup (excluding small-order points), otherwise 0.
-spec crypto_core_ed25519_nonreducedscalarbytes() -> Result when Result :: 64.
Return crypto_core_ed25519_nonreducedscalarbytes(), in bytes.
-spec crypto_core_ed25519_random() -> Result when Result :: <<_:256>>.
Return a random point on the main subgroup.
-spec crypto_core_ed25519_scalar_add(X, Y) -> Result
when X :: <<_:256>>, Y :: <<_:256>>, Result :: <<_:256>>.
Return X + Y mod L.
-spec crypto_core_ed25519_scalar_complement(S) -> Result when S :: <<_:256>>, Result :: <<_:256>>.
Return 1 - S mod L, so that S + Comp = 1 (mod L).
-spec crypto_core_ed25519_scalar_invert(S) -> Result when S :: <<_:256>>, Result :: <<_:256>> | -1.
Return the multiplicative inverse of the scalar S modulo L, or -1 when S is zero.
-spec crypto_core_ed25519_scalar_mul(X, Y) -> Result
when X :: <<_:256>>, Y :: <<_:256>>, Result :: <<_:256>>.
Return X * Y mod L.
-spec crypto_core_ed25519_scalar_negate(S) -> Result when S :: <<_:256>>, Result :: <<_:256>>.
Return -S mod L.
-spec crypto_core_ed25519_scalar_random() -> Result when Result :: <<_:256>>.
Return a random scalar in [0, L).
-spec crypto_core_ed25519_scalar_reduce(S) -> Result when S :: <<_:512>>, Result :: <<_:256>>.
Reduce the nonreducedscalarbytes/0 byte little-endian integer S
modulo L. S should be sampled from at least 317 bits (such as a
64-byte hash) for the result to be close to uniform.
-spec crypto_core_ed25519_scalar_sub(X, Y) -> Result
when X :: <<_:256>>, Y :: <<_:256>>, Result :: <<_:256>>.
Return X - Y mod L.
-spec crypto_core_ed25519_scalarbytes() -> Result when Result :: 32.
Return crypto_core_ed25519_scalarbytes(), in bytes.
-spec crypto_core_ed25519_sub(P, Q) -> Result
when P :: <<_:256>>, Q :: <<_:256>>, Result :: <<_:256>> | -1.
Return the point P - Q, or -1 when either input is not a point on the curve.
-spec crypto_core_ed25519_uniformbytes() -> Result when Result :: 32.
Return crypto_core_ed25519_uniformbytes(), in bytes.
Encrypted streams
-spec crypto_secretstream_xchacha20poly1305_abytes() -> Result when Result :: 17.
Return crypto_secretstream_xchacha20poly1305_abytes(), in bytes.
-spec crypto_secretstream_xchacha20poly1305_headerbytes() -> Result when Result :: 24.
Return crypto_secretstream_xchacha20poly1305_headerbytes(), in bytes.
-spec crypto_secretstream_xchacha20poly1305_init_pull(Header, K) -> Result when Header :: <<_:192>>, K :: <<_:256>>, Result :: crypto_secretstream_xchacha20poly1305_state() | -1.
Start decrypting a stream from the headerbytes/0 byte Header
produced by init_push/1 and the key K.
-spec crypto_secretstream_xchacha20poly1305_init_push(K) -> Result when K :: <<_:256>>, Result :: {crypto_secretstream_xchacha20poly1305_state(), <<_:192>>} | -1.
Start an encrypted stream with the keybytes/0 byte key K.
-spec crypto_secretstream_xchacha20poly1305_keybytes() -> Result when Result :: 32.
Return crypto_secretstream_xchacha20poly1305_keybytes(), in bytes.
-spec crypto_secretstream_xchacha20poly1305_keygen() -> Result when Result :: <<_:256>>.
Generate a random keybytes/0 byte key.
-spec crypto_secretstream_xchacha20poly1305_messagebytes_max() -> Result when Result :: non_neg_integer().
Return crypto_secretstream_xchacha20poly1305_messagebytes_max(), in bytes.
-spec crypto_secretstream_xchacha20poly1305_pull(State, C, Ad) -> Result when State :: crypto_secretstream_xchacha20poly1305_state(), C :: binary(), Ad :: binary(), Result :: {binary(), binary(), 0..255} | -1.
Verify and decrypt the next ciphertext C (at least abytes/0
bytes) with the additional data AD using the stream State.
-spec crypto_secretstream_xchacha20poly1305_push(State, M, Ad, Tag) -> Result when State :: crypto_secretstream_xchacha20poly1305_state(), M :: binary(), Ad :: binary(), Tag :: 0..255, Result :: {crypto_secretstream_xchacha20poly1305_state(), binary()} | -1.
Encrypt M with the additional data AD (may be empty) and the tag
Tag (an integer from 0 to 255, normally one of the tag_*
constants) using the stream State.
-spec crypto_secretstream_xchacha20poly1305_rekey(State) -> Result when State :: crypto_secretstream_xchacha20poly1305_state(), Result :: crypto_secretstream_xchacha20poly1305_state().
Explicitly derive a new key for the stream State and return the
updated state. The receiver must call rekey/1 at the same point in
the stream.
-spec crypto_secretstream_xchacha20poly1305_statebytes() -> Result when Result :: 52.
Return crypto_secretstream_xchacha20poly1305_statebytes(), in bytes.
-spec crypto_secretstream_xchacha20poly1305_tag_final() -> Result when Result :: 3.
Return crypto_secretstream_xchacha20poly1305_tag_final().
-spec crypto_secretstream_xchacha20poly1305_tag_message() -> Result when Result :: 0.
Return crypto_secretstream_xchacha20poly1305_tag_message().
-spec crypto_secretstream_xchacha20poly1305_tag_push() -> Result when Result :: 1.
Return crypto_secretstream_xchacha20poly1305_tag_push().
-spec crypto_secretstream_xchacha20poly1305_tag_rekey() -> Result when Result :: 2.
Return crypto_secretstream_xchacha20poly1305_tag_rekey().
Generic hashing
-spec crypto_generichash_bytes() -> Result when Result :: 32.
Return crypto_generichash_bytes(), in bytes.
-spec crypto_generichash_bytes_max() -> Result when Result :: 64.
Return crypto_generichash_bytes_max(), in bytes.
-spec crypto_generichash_bytes_min() -> Result when Result :: 16.
Return crypto_generichash_bytes_min(), in bytes.
-spec crypto_generichash_crypto_generichash(Outlen, In, Key) -> Result when Outlen :: 16..64, In :: binary(), Key :: binary(), Result :: binary() | -1.
Hash In with the optional Key, producing Outlen bytes.
-spec crypto_generichash_final(State, Outlen) -> Result when State :: crypto_generichash_state(), Outlen :: 16..64, Result :: binary() | -1.
Finish the streaming hash in State, producing Outlen bytes. The
length must match the one passed to init/2 (default bytes/0).
-spec crypto_generichash_init(Key, Outlen) -> Result when Key :: binary(), Outlen :: 16..64, Result :: crypto_generichash_state() | -1.
Start a streaming hash with the optional Key that will produce
Outlen bytes. Defaults to bytes/0 bytes of output and no key.
-spec crypto_generichash_keybytes() -> Result when Result :: 32.
Return crypto_generichash_keybytes(), in bytes.
-spec crypto_generichash_keybytes_max() -> Result when Result :: 64.
Return crypto_generichash_keybytes_max(), in bytes.
-spec crypto_generichash_keybytes_min() -> Result when Result :: 16.
Return crypto_generichash_keybytes_min(), in bytes.
-spec crypto_generichash_keygen() -> Result when Result :: <<_:256>>.
Generate a random keybytes/0 byte key.
-spec crypto_generichash_primitive() -> Result when Result :: blake2b.
Return crypto_generichash_primitive() as an atom.
-spec crypto_generichash_statebytes() -> Result when Result :: 384.
Return crypto_generichash_statebytes(), in bytes.
-spec crypto_generichash_update(State, In) -> Result when State :: crypto_generichash_state(), In :: binary(), Result :: crypto_generichash_state() | -1.
Absorb In into State and return the updated state.
Hashing (SHA-512)
-spec crypto_hash_bytes() -> Result when Result :: 64.
Return crypto_hash_bytes(), in bytes.
-spec crypto_hash_crypto_hash(In) -> Result when In :: binary(), Result :: <<_:512>> | -1.
Hash In, returning a bytes/0 byte digest.
-spec crypto_hash_primitive() -> Result when Result :: sha512.
Return crypto_hash_primitive() as an atom.
HChaCha20 core
-spec crypto_core_hchacha20_constbytes() -> Result when Result :: 16.
Return crypto_core_hchacha20_constbytes(), in bytes.
-spec crypto_core_hchacha20_crypto_core_hchacha20(In, K, C) -> Result
when
In :: <<_:128>>,
K :: <<_:256>>,
C :: <<_:128>>,
Result :: <<_:256>>.
Compute the HChaCha20 core of the inputbytes/0 byte input In
with the keybytes/0 byte key K and the constbytes/0 byte constant
C, returning outputbytes/0 bytes.
-spec crypto_core_hchacha20_inputbytes() -> Result when Result :: 16.
Return crypto_core_hchacha20_inputbytes(), in bytes.
-spec crypto_core_hchacha20_keybytes() -> Result when Result :: 32.
Return crypto_core_hchacha20_keybytes(), in bytes.
-spec crypto_core_hchacha20_outputbytes() -> Result when Result :: 32.
Return crypto_core_hchacha20_outputbytes(), in bytes.
Helpers
Return (A + B) mod 2^(8 * byte_size(A)), treating both as unsigned
little-endian numbers. Raises badarg unless both have the same length.
See libsodium_utils.
-spec utils_base64_encoded_len(BinLen, Variant) -> Result when BinLen :: non_neg_integer(), Variant :: original | original_no_padding | urlsafe | urlsafe_no_padding | integer(), Result :: non_neg_integer().
Return the length of the Base64 Variant encoding of BinLen bytes,
including one extra byte for libsodium's trailing NUL; the binary
returned by bin2base64/2 is one byte shorter.
See libsodium_utils.
-spec utils_base642bin(B64, Ignore, Variant) -> Result when B64 :: binary(), Ignore :: binary(), Variant :: original | original_no_padding | urlsafe | urlsafe_no_padding | integer(), Result :: binary() | -1.
Decode the Base64 B64 using Variant, skipping any characters in
Ignore. Variant defaults to original and Ignore to <<>>.
See libsodium_utils.
-spec utils_bin2base64(Bin, Variant) -> Result when Bin :: binary(), Variant :: original | original_no_padding | urlsafe | urlsafe_no_padding | integer(), Result :: binary().
Return the Base64 encoding of Bin using Variant, in constant time.
Variant defaults to original.
See libsodium_utils.
Return the lowercase hexadecimal encoding of Bin, in constant time.
See libsodium_utils.
-spec utils_bin2ip(Bin) -> Result when Bin :: <<_:128>>, Result :: binary().
Format the 16-byte address Bin as text: IPv4-mapped addresses as
dotted IPv4, others as compressed IPv6 (RFC 5952).
See libsodium_utils.
Compare B1 and B2 as unsigned little-endian numbers in constant time.
Returns -1 if B1 is less than B2, 1 if it is greater, and 0 if
they are equal. Raises badarg unless both have the same length.
See libsodium_utils.
-spec utils_hex2bin(Hex, Ignore) -> Result when Hex :: binary(), Ignore :: binary(), Result :: binary() | -1.
Decode the hexadecimal Hex (either case), skipping any characters in
Ignore between byte pairs. Ignore defaults to <<>>, so no
separators are accepted.
See libsodium_utils.
Return N plus one, treating it as an unsigned little-endian number of
the same length; the carry out of the last byte is discarded, so an
all-255 binary wraps around to zero.
See libsodium_utils.
-spec utils_ip2bin(Ip) -> Result when Ip :: binary(), Result :: <<_:128>> | -1.
Parse the IPv4 or IPv6 address Ip (an IPv6 address may carry a
%zone suffix, which is discarded) into its 16-byte IPv6 form; IPv4
addresses become IPv4-mapped IPv6 addresses. Returns -1 if Ip is
not a valid address.
See libsodium_utils.
-spec utils_is_zero(N) -> Result when N :: binary(), Result :: 0 | 1.
Return 1 if every byte of N is zero (checked in constant time), otherwise 0.
See libsodium_utils.
Compare the secrets B1 and B2 in constant time. Returns 0 when they
are equal and -1 otherwise; this is not a lexicographic comparison.
Raises badarg unless both have the same length.
See libsodium_utils.
-spec utils_pad(UnpaddedBuf, Blocksize) -> Result when UnpaddedBuf :: binary(), Blocksize :: pos_integer(), Result :: binary() | -1.
Pad UnpaddedBuf to a multiple of Blocksize bytes using the ISO/IEC
7816-4 scheme (a 16#80 byte followed by zeros); at least one byte is
always added. Raises badarg if Blocksize is 0 or the padded length
would overflow.
See libsodium_utils.
Return (A - B) mod 2^(8 * byte_size(A)), treating both as unsigned
little-endian numbers. Raises badarg unless both have the same length.
See libsodium_utils.
-spec utils_unpad(PaddedBuf, Blocksize) -> Result when PaddedBuf :: binary(), Blocksize :: non_neg_integer(), Result :: binary() | -1.
Remove the ISO/IEC 7816-4 padding added by pad/2 from PaddedBuf.
Returns -1 if the padding is invalid or Blocksize is 0 or larger
than PaddedBuf.
See libsodium_utils.
HKDF-SHA-256
-spec crypto_kdf_hkdf_sha256_bytes_max() -> Result when Result :: 8160.
Return crypto_kdf_hkdf_sha256_bytes_max(), in bytes.
-spec crypto_kdf_hkdf_sha256_bytes_min() -> Result when Result :: 0.
Return crypto_kdf_hkdf_sha256_bytes_min(), in bytes.
-spec crypto_kdf_hkdf_sha256_expand(OutLen, Ctx, Prk) -> Result when OutLen :: non_neg_integer(), Ctx :: binary(), Prk :: <<_:256>>, Result :: binary() | -1.
Derive OutLen bytes from the keybytes/0 byte pseudorandom key PRK
for the context Ctx (default empty).
-spec crypto_kdf_hkdf_sha256_extract(Salt, Ikm) -> Result when Salt :: binary(), Ikm :: binary(), Result :: <<_:256>> | -1.
Extract a keybytes/0 byte pseudorandom key from the input keying
material IKM and the optional Salt (default empty).
-spec crypto_kdf_hkdf_sha256_extract_final(State) -> Result when State :: crypto_kdf_hkdf_sha256_state(), Result :: <<_:256>> | -1.
Finish the streaming extraction in State, returning a keybytes/0 byte pseudorandom key.
-spec crypto_kdf_hkdf_sha256_extract_init(Salt) -> Result when Salt :: binary(), Result :: crypto_kdf_hkdf_sha256_state() | -1.
Start a streaming extraction with the optional Salt (default empty) and return its state.
-spec crypto_kdf_hkdf_sha256_extract_update(State, Ikm) -> Result when State :: crypto_kdf_hkdf_sha256_state(), Ikm :: binary(), Result :: crypto_kdf_hkdf_sha256_state() | -1.
Absorb the input keying material IKM into State and return the updated state.
-spec crypto_kdf_hkdf_sha256_keybytes() -> Result when Result :: 32.
Return crypto_kdf_hkdf_sha256_keybytes(), in bytes.
-spec crypto_kdf_hkdf_sha256_keygen() -> Result when Result :: <<_:256>>.
Generate a random keybytes/0 byte pseudorandom key.
-spec crypto_kdf_hkdf_sha256_statebytes() -> Result when Result :: 208.
Return crypto_kdf_hkdf_sha256_statebytes(), in bytes.
HKDF-SHA-512
-spec crypto_kdf_hkdf_sha512_bytes_max() -> Result when Result :: 16320.
Return crypto_kdf_hkdf_sha512_bytes_max(), in bytes.
-spec crypto_kdf_hkdf_sha512_bytes_min() -> Result when Result :: 0.
Return crypto_kdf_hkdf_sha512_bytes_min(), in bytes.
-spec crypto_kdf_hkdf_sha512_expand(OutLen, Ctx, Prk) -> Result when OutLen :: non_neg_integer(), Ctx :: binary(), Prk :: <<_:512>>, Result :: binary() | -1.
Derive OutLen bytes from the keybytes/0 byte pseudorandom key PRK
for the context Ctx (default empty).
-spec crypto_kdf_hkdf_sha512_extract(Salt, Ikm) -> Result when Salt :: binary(), Ikm :: binary(), Result :: <<_:512>> | -1.
Extract a keybytes/0 byte pseudorandom key from the input keying
material IKM and the optional Salt (default empty).
-spec crypto_kdf_hkdf_sha512_extract_final(State) -> Result when State :: crypto_kdf_hkdf_sha512_state(), Result :: <<_:512>> | -1.
Finish the streaming extraction in State, returning a keybytes/0 byte pseudorandom key.
-spec crypto_kdf_hkdf_sha512_extract_init(Salt) -> Result when Salt :: binary(), Result :: crypto_kdf_hkdf_sha512_state() | -1.
Start a streaming extraction with the optional Salt (default empty) and return its state.
-spec crypto_kdf_hkdf_sha512_extract_update(State, Ikm) -> Result when State :: crypto_kdf_hkdf_sha512_state(), Ikm :: binary(), Result :: crypto_kdf_hkdf_sha512_state() | -1.
Absorb the input keying material IKM into State and return the updated state.
-spec crypto_kdf_hkdf_sha512_keybytes() -> Result when Result :: 64.
Return crypto_kdf_hkdf_sha512_keybytes(), in bytes.
-spec crypto_kdf_hkdf_sha512_keygen() -> Result when Result :: <<_:512>>.
Generate a random keybytes/0 byte pseudorandom key.
-spec crypto_kdf_hkdf_sha512_statebytes() -> Result when Result :: 416.
Return crypto_kdf_hkdf_sha512_statebytes(), in bytes.
HMAC-SHA-256
-spec crypto_auth_hmacsha256_bytes() -> Result when Result :: 32.
Return crypto_auth_hmacsha256_bytes(), in bytes.
-spec crypto_auth_hmacsha256_crypto_auth_hmacsha256(In, K) -> Result when In :: binary(), K :: <<_:256>>, Result :: <<_:256>> | -1.
Compute the bytes/0 byte authentication tag of In under the keybytes/0 byte key K.
-spec crypto_auth_hmacsha256_final(State) -> Result when State :: crypto_auth_hmacsha256_state(), Result :: <<_:256>> | -1.
Finish the streaming authenticator in State, returning a bytes/0 byte tag.
-spec crypto_auth_hmacsha256_init(Key) -> Result when Key :: binary(), Result :: crypto_auth_hmacsha256_state() | -1.
Start a streaming authenticator keyed with Key, which may be of any
length, and return its state.
-spec crypto_auth_hmacsha256_keybytes() -> Result when Result :: 32.
Return crypto_auth_hmacsha256_keybytes(), in bytes.
-spec crypto_auth_hmacsha256_keygen() -> Result when Result :: <<_:256>>.
Generate a random keybytes/0 byte key.
-spec crypto_auth_hmacsha256_statebytes() -> Result when Result :: 208.
Return crypto_auth_hmacsha256_statebytes(), in bytes.
-spec crypto_auth_hmacsha256_update(State, In) -> Result when State :: crypto_auth_hmacsha256_state(), In :: binary(), Result :: crypto_auth_hmacsha256_state() | -1.
Absorb In into State and return the updated state.
-spec crypto_auth_hmacsha256_verify(H, In, K) -> Result when H :: <<_:256>>, In :: binary(), K :: <<_:256>>, Result :: 0 | -1.
Check in constant time that H is the tag of In under the key K.
Returns 0 when it is valid and -1 otherwise.
HMAC-SHA-512
-spec crypto_auth_hmacsha512_bytes() -> Result when Result :: 64.
Return crypto_auth_hmacsha512_bytes(), in bytes.
-spec crypto_auth_hmacsha512_crypto_auth_hmacsha512(In, K) -> Result when In :: binary(), K :: <<_:256>>, Result :: <<_:512>> | -1.
Compute the bytes/0 byte authentication tag of In under the keybytes/0 byte key K.
-spec crypto_auth_hmacsha512_final(State) -> Result when State :: crypto_auth_hmacsha512_state(), Result :: <<_:512>> | -1.
Finish the streaming authenticator in State, returning a bytes/0 byte tag.
-spec crypto_auth_hmacsha512_init(Key) -> Result when Key :: binary(), Result :: crypto_auth_hmacsha512_state() | -1.
Start a streaming authenticator keyed with Key, which may be of any
length, and return its state.
-spec crypto_auth_hmacsha512_keybytes() -> Result when Result :: 32.
Return crypto_auth_hmacsha512_keybytes(), in bytes.
-spec crypto_auth_hmacsha512_keygen() -> Result when Result :: <<_:256>>.
Generate a random keybytes/0 byte key.
-spec crypto_auth_hmacsha512_statebytes() -> Result when Result :: 416.
Return crypto_auth_hmacsha512_statebytes(), in bytes.
-spec crypto_auth_hmacsha512_update(State, In) -> Result when State :: crypto_auth_hmacsha512_state(), In :: binary(), Result :: crypto_auth_hmacsha512_state() | -1.
Absorb In into State and return the updated state.
-spec crypto_auth_hmacsha512_verify(H, In, K) -> Result when H :: <<_:512>>, In :: binary(), K :: <<_:256>>, Result :: 0 | -1.
Check in constant time that H is the tag of In under the key K.
Returns 0 when it is valid and -1 otherwise.
HMAC-SHA-512-256
-spec crypto_auth_hmacsha512256_bytes() -> Result when Result :: 32.
Return crypto_auth_hmacsha512256_bytes(), in bytes.
-spec crypto_auth_hmacsha512256_crypto_auth_hmacsha512256(In, K) -> Result when In :: binary(), K :: <<_:256>>, Result :: <<_:256>> | -1.
Compute the bytes/0 byte authentication tag of In under the keybytes/0 byte key K.
-spec crypto_auth_hmacsha512256_final(State) -> Result when State :: crypto_auth_hmacsha512256_state(), Result :: <<_:256>> | -1.
Finish the streaming authenticator in State, returning a bytes/0 byte tag.
-spec crypto_auth_hmacsha512256_init(Key) -> Result when Key :: binary(), Result :: crypto_auth_hmacsha512256_state() | -1.
Start a streaming authenticator keyed with Key, which may be of any
length, and return its state.
-spec crypto_auth_hmacsha512256_keybytes() -> Result when Result :: 32.
Return crypto_auth_hmacsha512256_keybytes(), in bytes.
-spec crypto_auth_hmacsha512256_keygen() -> Result when Result :: <<_:256>>.
Generate a random keybytes/0 byte key.
-spec crypto_auth_hmacsha512256_statebytes() -> Result when Result :: 416.
Return crypto_auth_hmacsha512256_statebytes(), in bytes.
-spec crypto_auth_hmacsha512256_update(State, In) -> Result when State :: crypto_auth_hmacsha512256_state(), In :: binary(), Result :: crypto_auth_hmacsha512256_state() | -1.
Absorb In into State and return the updated state.
-spec crypto_auth_hmacsha512256_verify(H, In, K) -> Result when H :: <<_:256>>, In :: binary(), K :: <<_:256>>, Result :: 0 | -1.
Check in constant time that H is the tag of In under the key K.
Returns 0 when it is valid and -1 otherwise.
HSalsa20 core
-spec crypto_core_hsalsa20_constbytes() -> Result when Result :: 16.
Return crypto_core_hsalsa20_constbytes(), in bytes.
-spec crypto_core_hsalsa20_crypto_core_hsalsa20(In, K, C) -> Result
when
In :: <<_:128>>,
K :: <<_:256>>,
C :: <<_:128>>,
Result :: <<_:256>>.
Compute the HSalsa20 core of the inputbytes/0 byte input In
with the keybytes/0 byte key K and the constbytes/0 byte constant
C, returning outputbytes/0 bytes.
-spec crypto_core_hsalsa20_inputbytes() -> Result when Result :: 16.
Return crypto_core_hsalsa20_inputbytes(), in bytes.
-spec crypto_core_hsalsa20_keybytes() -> Result when Result :: 32.
Return crypto_core_hsalsa20_keybytes(), in bytes.
-spec crypto_core_hsalsa20_outputbytes() -> Result when Result :: 32.
Return crypto_core_hsalsa20_outputbytes(), in bytes.
IP address encryption
-spec crypto_ipcrypt_bytes() -> Result when Result :: 16.
Return crypto_ipcrypt_bytes(), in bytes.
-spec crypto_ipcrypt_decrypt(In, K) -> Result when In :: <<_:128>>, K :: <<_:128>>, Result :: <<_:128>>.
Decrypt the bytes/0 byte address In produced by encrypt/2 with the key K.
-spec crypto_ipcrypt_encrypt(In, K) -> Result when In :: <<_:128>>, K :: <<_:128>>, Result :: <<_:128>>.
Deterministically encrypt the bytes/0 byte address In with the
keybytes/0 byte key K, returning another bytes/0 byte address.
-spec crypto_ipcrypt_keybytes() -> Result when Result :: 16.
Return crypto_ipcrypt_keybytes(), in bytes.
-spec crypto_ipcrypt_keygen() -> Result when Result :: <<_:128>>.
Generate a random keybytes/0 byte key for encrypt/2.
-spec crypto_ipcrypt_nd_decrypt(In, K) -> Result
when In :: <<_:192>>, K :: <<_:128>>, Result :: <<_:128>>.
Decrypt the nd_outputbytes/0 byte output In of nd_encrypt/2 with
the key K, returning the nd_inputbytes/0 byte address.
-spec crypto_ipcrypt_nd_encrypt(In, T, K) -> Result
when
In :: <<_:128>>,
T :: <<_:64>>,
K :: <<_:128>>,
Result :: <<_:192>>.
Encrypt the nd_inputbytes/0 byte address In with the
nd_keybytes/0 byte key K and the nd_tweakbytes/0 byte tweak T.
Returns nd_outputbytes/0 bytes: the tweak followed by the encrypted
address. The tweak must be random and should not repeat for a key.
-spec crypto_ipcrypt_nd_inputbytes() -> Result when Result :: 16.
Return crypto_ipcrypt_nd_inputbytes(), in bytes.
-spec crypto_ipcrypt_nd_keybytes() -> Result when Result :: 16.
Return crypto_ipcrypt_nd_keybytes(), in bytes.
-spec crypto_ipcrypt_nd_keygen() -> Result when Result :: <<_:128>>.
Generate a random nd_keybytes/0 byte key for nd_encrypt/2.
-spec crypto_ipcrypt_nd_outputbytes() -> Result when Result :: 24.
Return crypto_ipcrypt_nd_outputbytes(), in bytes.
-spec crypto_ipcrypt_nd_tweakbytes() -> Result when Result :: 8.
Return crypto_ipcrypt_nd_tweakbytes(), in bytes.
-spec crypto_ipcrypt_ndx_decrypt(In, K) -> Result
when In :: <<_:256>>, K :: <<_:256>>, Result :: <<_:128>>.
Decrypt the ndx_outputbytes/0 byte output In of ndx_encrypt/2
with the key K, returning the ndx_inputbytes/0 byte address.
-spec crypto_ipcrypt_ndx_encrypt(In, T, K) -> Result
when
In :: <<_:128>>,
T :: <<_:128>>,
K :: <<_:256>>,
Result :: <<_:256>>.
Encrypt the ndx_inputbytes/0 byte address In with the
ndx_keybytes/0 byte key K and the ndx_tweakbytes/0 byte tweak
T. Returns ndx_outputbytes/0 bytes: the tweak followed by the
encrypted address. The tweak must be random and should not repeat for
a key.
-spec crypto_ipcrypt_ndx_inputbytes() -> Result when Result :: 16.
Return crypto_ipcrypt_ndx_inputbytes(), in bytes.
-spec crypto_ipcrypt_ndx_keybytes() -> Result when Result :: 32.
Return crypto_ipcrypt_ndx_keybytes(), in bytes.
-spec crypto_ipcrypt_ndx_keygen() -> Result when Result :: <<_:256>>.
Generate a random ndx_keybytes/0 byte key for ndx_encrypt/2.
-spec crypto_ipcrypt_ndx_outputbytes() -> Result when Result :: 32.
Return crypto_ipcrypt_ndx_outputbytes(), in bytes.
-spec crypto_ipcrypt_ndx_tweakbytes() -> Result when Result :: 16.
Return crypto_ipcrypt_ndx_tweakbytes(), in bytes.
-spec crypto_ipcrypt_pfx_bytes() -> Result when Result :: 16.
Return crypto_ipcrypt_pfx_bytes(), in bytes.
-spec crypto_ipcrypt_pfx_decrypt(In, K) -> Result
when In :: <<_:128>>, K :: <<_:256>>, Result :: <<_:128>>.
Decrypt the pfx_bytes/0 byte address In produced by pfx_encrypt/2 with the key K.
-spec crypto_ipcrypt_pfx_encrypt(In, K) -> Result
when In :: <<_:128>>, K :: <<_:256>>, Result :: <<_:128>>.
Encrypt the pfx_bytes/0 byte address In with the pfx_keybytes/0
byte key K, preserving prefixes: addresses that share their first
bits share the first bits of their encryptions, and IPv4 addresses
stay IPv4-mapped.
-spec crypto_ipcrypt_pfx_keybytes() -> Result when Result :: 32.
Return crypto_ipcrypt_pfx_keybytes(), in bytes.
-spec crypto_ipcrypt_pfx_keygen() -> Result when Result :: <<_:256>>.
Generate a random pfx_keybytes/0 byte key for pfx_encrypt/2.
Keccak-f[1600] permutation
-spec crypto_core_keccak1600_extract_bytes(State, Offset, Length) -> Result when State :: crypto_core_keccak1600_state(), Offset :: non_neg_integer(), Length :: non_neg_integer(), Result :: binary().
Return Length bytes of State starting at byte Offset.
Offset + Length must not exceed 200.
-spec crypto_core_keccak1600_init() -> Result when Result :: crypto_core_keccak1600_state().
Return the all-zero permutation state.
-spec crypto_core_keccak1600_permute_12(State) -> Result when State :: crypto_core_keccak1600_state(), Result :: crypto_core_keccak1600_state().
Apply the 12-round Keccak-p[1600,12] permutation used by TurboSHAKE
to State and return the new state.
-spec crypto_core_keccak1600_permute_24(State) -> Result when State :: crypto_core_keccak1600_state(), Result :: crypto_core_keccak1600_state().
Apply the 24-round Keccak-f[1600] permutation to State and return the new state.
-spec crypto_core_keccak1600_statebytes() -> Result when Result :: 224.
Return crypto_core_keccak1600_statebytes(), in bytes.
-spec crypto_core_keccak1600_xor_bytes(State, Bytes, Offset) -> Result when State :: crypto_core_keccak1600_state(), Bytes :: binary(), Offset :: non_neg_integer(), Result :: crypto_core_keccak1600_state().
XOR Bytes into State starting at byte Offset and return the
new state. Offset + byte_size(Bytes) must not exceed 200.
Key derivation
-spec crypto_kdf_bytes_max() -> Result when Result :: 64.
Return crypto_kdf_bytes_max(), in bytes.
See libsodium_crypto_kdf.
-spec crypto_kdf_bytes_min() -> Result when Result :: 16.
Return crypto_kdf_bytes_min(), in bytes.
See libsodium_crypto_kdf.
-spec crypto_kdf_contextbytes() -> Result when Result :: 8.
Return crypto_kdf_contextbytes(), in bytes.
See libsodium_crypto_kdf.
-spec crypto_kdf_derive_from_key(SubkeyLen, SubkeyId, Ctx, Key) -> Result when SubkeyLen :: non_neg_integer(), SubkeyId :: non_neg_integer(), Ctx :: <<_:64>>, Key :: <<_:256>>, Result :: binary() | -1.
Derive the SubkeyLen byte subkey number SubkeyId for the
contextbytes/0 byte context Ctx from the keybytes/0 byte master
key Key.
See libsodium_crypto_kdf.
-spec crypto_kdf_keybytes() -> Result when Result :: 32.
Return crypto_kdf_keybytes(), in bytes.
See libsodium_crypto_kdf.
-spec crypto_kdf_keygen() -> Result when Result :: <<_:256>>.
Generate a random keybytes/0 byte master key.
See libsodium_crypto_kdf.
-spec crypto_kdf_primitive() -> Result when Result :: blake2b.
Return crypto_kdf_primitive() as an atom.
See libsodium_crypto_kdf.
Key encapsulation
-spec crypto_kem_ciphertextbytes() -> Result when Result :: 1120.
Return crypto_kem_ciphertextbytes(), in bytes.
See libsodium_crypto_kem.
-spec crypto_kem_dec(Ct, Sk) -> Result when Ct :: <<_:8960>>, Sk :: <<_:256>>, Result :: <<_:256>> | -1.
Decapsulate the ciphertext CT with the secret key SK and return the
shared secret SS.
See libsodium_crypto_kem.
-spec crypto_kem_enc(Pk) -> Result when Pk :: <<_:9728>>, Result :: {<<_:8960>>, <<_:256>>} | -1.
Encapsulate a fresh random shared secret to the public key PK.
Returns {CT, SS}, where CT is sent to the holder of the secret
key, or -1 when PK is invalid.
See libsodium_crypto_kem.
-spec crypto_kem_keypair() -> Result when Result :: {<<_:9728>>, <<_:256>>} | -1.
Generate a random key pair. Returns {PK, SK}.
See libsodium_crypto_kem.
-spec crypto_kem_primitive() -> Result when Result :: xwing.
Return crypto_kem_primitive() as an atom.
See libsodium_crypto_kem.
-spec crypto_kem_publickeybytes() -> Result when Result :: 1216.
Return crypto_kem_publickeybytes(), in bytes.
See libsodium_crypto_kem.
-spec crypto_kem_secretkeybytes() -> Result when Result :: 32.
Return crypto_kem_secretkeybytes(), in bytes.
See libsodium_crypto_kem.
-spec crypto_kem_seed_keypair(Seed) -> Result
when Seed :: <<_:256>>, Result :: {<<_:9728>>, <<_:256>>} | -1.
Deterministically derive a key pair from the seedbytes/0 byte Seed,
which must be secret and uniformly random. Returns {PK, SK}.
See libsodium_crypto_kem.
-spec crypto_kem_seedbytes() -> Result when Result :: 32.
Return crypto_kem_seedbytes(), in bytes.
See libsodium_crypto_kem.
Key exchange
-spec crypto_kx_client_session_keys(ClientPk, ClientSk, ServerPk) -> Result
when
ClientPk :: <<_:256>>,
ClientSk :: <<_:256>>,
ServerPk :: <<_:256>>,
Result :: {<<_:256>>, <<_:256>>} | -1.
Compute the client's session keys from its key pair ClientPK and
ClientSK and the server's public key ServerPK.
See libsodium_crypto_kx.
-spec crypto_kx_keypair() -> Result when Result :: {<<_:256>>, <<_:256>>} | -1.
Generate a random key pair. Returns {PK, SK}.
See libsodium_crypto_kx.
-spec crypto_kx_primitive() -> Result when Result :: x25519blake2b.
Return crypto_kx_primitive() as an atom.
See libsodium_crypto_kx.
-spec crypto_kx_publickeybytes() -> Result when Result :: 32.
Return crypto_kx_publickeybytes(), in bytes.
See libsodium_crypto_kx.
-spec crypto_kx_secretkeybytes() -> Result when Result :: 32.
Return crypto_kx_secretkeybytes(), in bytes.
See libsodium_crypto_kx.
-spec crypto_kx_seed_keypair(Seed) -> Result
when Seed :: <<_:256>>, Result :: {<<_:256>>, <<_:256>>} | -1.
Deterministically derive a key pair from the seedbytes/0 byte Seed.
Returns {PK, SK}.
See libsodium_crypto_kx.
-spec crypto_kx_seedbytes() -> Result when Result :: 32.
Return crypto_kx_seedbytes(), in bytes.
See libsodium_crypto_kx.
-spec crypto_kx_server_session_keys(ServerPk, ServerSk, ClientPk) -> Result
when
ServerPk :: <<_:256>>,
ServerSk :: <<_:256>>,
ClientPk :: <<_:256>>,
Result :: {<<_:256>>, <<_:256>>} | -1.
Compute the server's session keys from its key pair ServerPK and
ServerSK and the client's public key ClientPK.
See libsodium_crypto_kx.
-spec crypto_kx_sessionkeybytes() -> Result when Result :: 32.
Return crypto_kx_sessionkeybytes(), in bytes.
See libsodium_crypto_kx.
Library version
-spec version_library_minimal() -> Result when Result :: 0 | 1.
Return 1 if libsodium was built in minimal mode (without the
functions omitted by --enable-minimal), otherwise 0.
See libsodium_version.
-spec version_library_version_major() -> Result when Result :: non_neg_integer().
Return the major version of the libsodium library ABI.
See libsodium_version.
-spec version_library_version_minor() -> Result when Result :: non_neg_integer().
Return the minor version of the libsodium library ABI.
See libsodium_version.
-spec version_version_string() -> Result when Result :: binary().
Return the libsodium release version, such as <<"1.0.22">>.
See libsodium_version.
ML-KEM-768 key encapsulation
-spec crypto_kem_mlkem768_ciphertextbytes() -> Result when Result :: 1088.
Return crypto_kem_mlkem768_ciphertextbytes(), in bytes.
-spec crypto_kem_mlkem768_dec(Ct, Sk) -> Result
when Ct :: <<_:8704>>, Sk :: <<_:19200>>, Result :: <<_:256>> | -1.
Decapsulate the ciphertext CT with the secret key SK and return the
shared secret SS.
-spec crypto_kem_mlkem768_enc(Pk) -> Result
when Pk :: <<_:9472>>, Result :: {<<_:8704>>, <<_:256>>} | -1.
Encapsulate a fresh random shared secret to the public key PK.
Returns {CT, SS}, or -1 when PK is not a valid encoding.
-spec crypto_kem_mlkem768_enc_deterministic(Pk, Seed) -> Result
when
Pk :: <<_:9472>>,
Seed :: <<_:256>>,
Result :: {<<_:8704>>, <<_:256>>} | -1.
Encapsulate to the public key PK using the 32-byte Seed (the
FIPS 203 message m) instead of fresh randomness. Seed must be
secret, uniformly random, and never reused. Returns {CT, SS}, or -1
when PK is not a valid encoding.
-spec crypto_kem_mlkem768_keypair() -> Result when Result :: {<<_:9472>>, <<_:19200>>} | -1.
Generate a random key pair. Returns {PK, SK}.
-spec crypto_kem_mlkem768_publickeybytes() -> Result when Result :: 1184.
Return crypto_kem_mlkem768_publickeybytes(), in bytes.
-spec crypto_kem_mlkem768_secretkeybytes() -> Result when Result :: 2400.
Return crypto_kem_mlkem768_secretkeybytes(), in bytes.
-spec crypto_kem_mlkem768_seed_keypair(Seed) -> Result
when
Seed :: <<_:512>>,
Result :: {<<_:9472>>, <<_:19200>>} | -1.
Deterministically derive a key pair from the seedbytes/0 byte Seed
(the FIPS 203 d || z), which must be secret and uniformly random.
Returns {PK, SK}.
-spec crypto_kem_mlkem768_seedbytes() -> Result when Result :: 64.
Return crypto_kem_mlkem768_seedbytes(), in bytes.
One-time authentication
-spec crypto_onetimeauth_bytes() -> Result when Result :: 16.
Return crypto_onetimeauth_bytes(), in bytes.
-spec crypto_onetimeauth_crypto_onetimeauth(In, K) -> Result when In :: binary(), K :: <<_:256>>, Result :: <<_:128>> | -1.
Compute the bytes/0 byte tag of In under the one-time keybytes/0 byte key K.
-spec crypto_onetimeauth_final(State) -> Result when State :: crypto_onetimeauth_state(), Result :: <<_:128>> | -1.
Finish the streaming authenticator in State, returning a bytes/0 byte tag.
-spec crypto_onetimeauth_init(Key) -> Result when Key :: <<_:256>>, Result :: crypto_onetimeauth_state() | -1.
Start a streaming authenticator with the one-time keybytes/0 byte Key.
-spec crypto_onetimeauth_keybytes() -> Result when Result :: 32.
Return crypto_onetimeauth_keybytes(), in bytes.
-spec crypto_onetimeauth_keygen() -> Result when Result :: <<_:256>>.
Generate a random keybytes/0 byte key.
-spec crypto_onetimeauth_primitive() -> Result when Result :: poly1305.
Return crypto_onetimeauth_primitive() as an atom.
-spec crypto_onetimeauth_statebytes() -> Result when Result :: 256.
Return crypto_onetimeauth_statebytes(), in bytes.
-spec crypto_onetimeauth_update(State, In) -> Result when State :: crypto_onetimeauth_state(), In :: binary(), Result :: crypto_onetimeauth_state() | -1.
Absorb In into State and return the updated state.
-spec crypto_onetimeauth_verify(H, In, K) -> Result when H :: <<_:128>>, In :: binary(), K :: <<_:256>>, Result :: 0 | -1.
Check in constant time that H is the tag of In under the key K.
Returns 0 when it is valid and -1 otherwise.
Password hashing
-spec crypto_pwhash_alg_argon2i13() -> Result when Result :: 1.
Return the algorithm identifier for Argon2i version 1.3 (crypto_pwhash_ALG_ARGON2I13).
-spec crypto_pwhash_alg_argon2id13() -> Result when Result :: 2.
Return the algorithm identifier for Argon2id version 1.3 (crypto_pwhash_ALG_ARGON2ID13).
-spec crypto_pwhash_alg_default() -> Result when Result :: 2.
Return the identifier of the recommended algorithm (currently Argon2id 1.3).
-spec crypto_pwhash_bytes_max() -> Result when Result :: 4294967295.
Return crypto_pwhash_bytes_max(), in bytes.
-spec crypto_pwhash_bytes_min() -> Result when Result :: 16.
Return crypto_pwhash_bytes_min(), in bytes.
-spec crypto_pwhash_crypto_pwhash(Outlen, Passwd, Salt, Opslimit, Memlimit, Alg) -> Result when Outlen :: non_neg_integer(), Passwd :: binary(), Salt :: binary(), Opslimit :: non_neg_integer(), Memlimit :: non_neg_integer(), Alg :: integer(), Result :: binary() | -1.
Derive an Outlen byte key from Passwd and the salt Salt (at least
saltbytes/0 bytes; only the first saltbytes/0 are used) with the
cost parameters Opslimit and Memlimit and the algorithm Alg
(alg_argon2i13/0, alg_argon2id13/0 or alg_default/0).
-spec crypto_pwhash_memlimit_interactive() -> Result when Result :: 67108864.
Return crypto_pwhash_memlimit_interactive(), in bytes.
-spec crypto_pwhash_memlimit_max() -> Result when Result :: non_neg_integer().
Return crypto_pwhash_memlimit_max(), in bytes.
-spec crypto_pwhash_memlimit_min() -> Result when Result :: 8192.
Return crypto_pwhash_memlimit_min(), in bytes.
-spec crypto_pwhash_memlimit_moderate() -> Result when Result :: 268435456.
Return crypto_pwhash_memlimit_moderate(), in bytes.
-spec crypto_pwhash_memlimit_sensitive() -> Result when Result :: 1073741824.
Return crypto_pwhash_memlimit_sensitive(), in bytes.
-spec crypto_pwhash_opslimit_interactive() -> Result when Result :: 2.
Return crypto_pwhash_opslimit_interactive(), in bytes.
-spec crypto_pwhash_opslimit_max() -> Result when Result :: 4294967295.
Return crypto_pwhash_opslimit_max(), in bytes.
-spec crypto_pwhash_opslimit_min() -> Result when Result :: 1.
Return crypto_pwhash_opslimit_min(), in bytes.
-spec crypto_pwhash_opslimit_moderate() -> Result when Result :: 3.
Return crypto_pwhash_opslimit_moderate(), in bytes.
-spec crypto_pwhash_opslimit_sensitive() -> Result when Result :: 4.
Return crypto_pwhash_opslimit_sensitive(), in bytes.
-spec crypto_pwhash_passwd_max() -> Result when Result :: 4294967295.
Return crypto_pwhash_passwd_max(), in bytes.
-spec crypto_pwhash_passwd_min() -> Result when Result :: 0.
Return crypto_pwhash_passwd_min(), in bytes.
-spec crypto_pwhash_primitive() -> Result when Result :: binary().
Return the names of the supported primitives as a binary, such as <<"argon2id,argon2i">>.
-spec crypto_pwhash_saltbytes() -> Result when Result :: 16.
Return crypto_pwhash_saltbytes(), in bytes.
-spec crypto_pwhash_str(Passwd, Opslimit, Memlimit) -> Result when Passwd :: binary(), Opslimit :: non_neg_integer(), Memlimit :: non_neg_integer(), Result :: binary() | -1.
Hash Passwd for storage using the default algorithm with the cost
parameters Opslimit and Memlimit and a random salt.
-spec crypto_pwhash_str_alg(Passwd, Opslimit, Memlimit, Alg) -> Result when Passwd :: binary(), Opslimit :: non_neg_integer(), Memlimit :: non_neg_integer(), Alg :: integer(), Result :: binary() | -1.
Like str/3, but hash Passwd with the algorithm Alg
(alg_argon2i13/0 or alg_argon2id13/0). Returns -1 on failure.
-spec crypto_pwhash_str_needs_rehash(Str, Opslimit, Memlimit) -> Result when Str :: binary(), Opslimit :: non_neg_integer(), Memlimit :: non_neg_integer(), Result :: -1 | 0 | 1.
Check whether Str (an Argon2i or Argon2id string) was hashed with
exactly the cost parameters Opslimit and Memlimit.
-spec crypto_pwhash_str_verify(Str, Passwd) -> Result when Str :: binary(), Passwd :: binary(), Result :: 0 | -1.
Check Passwd against Str, a string produced by str/3 or
str_alg/4 (Argon2i and Argon2id strings are both accepted).
-spec crypto_pwhash_strbytes() -> Result when Result :: 128.
Return crypto_pwhash_strbytes(), in bytes.
-spec crypto_pwhash_strprefix() -> Result when Result :: binary().
Return crypto_pwhash_strprefix() as a binary.
Point multiplication
-spec crypto_scalarmult_base(N) -> Result when N :: <<_:256>>, Result :: <<_:256>> | -1.
Compute the public key for the secret scalar N by multiplying the
base point. Returns -1 on failure.
-spec crypto_scalarmult_bytes() -> Result when Result :: 32.
Return crypto_scalarmult_bytes(), in bytes.
-spec crypto_scalarmult_crypto_scalarmult(N, P) -> Result
when
N :: <<_:256>>,
P :: <<_:256>>,
Result :: <<_:256>> | -1.
Multiply the point P by the secret scalar N, producing a shared
secret. Returns -1 when P is a low-order point.
-spec crypto_scalarmult_primitive() -> Result when Result :: curve25519.
Return crypto_scalarmult_primitive() as an atom.
-spec crypto_scalarmult_scalarbytes() -> Result when Result :: 32.
Return crypto_scalarmult_scalarbytes(), in bytes.
Poly1305
-spec crypto_onetimeauth_poly1305_bytes() -> Result when Result :: 16.
Return crypto_onetimeauth_poly1305_bytes(), in bytes.
-spec crypto_onetimeauth_poly1305_crypto_onetimeauth_poly1305(In, K) -> Result when In :: binary(), K :: <<_:256>>, Result :: <<_:128>> | -1.
Compute the bytes/0 byte tag of In under the one-time keybytes/0 byte key K.
-spec crypto_onetimeauth_poly1305_final(State) -> Result when State :: crypto_onetimeauth_poly1305_state(), Result :: <<_:128>> | -1.
Finish the streaming authenticator in State, returning a bytes/0 byte tag.
-spec crypto_onetimeauth_poly1305_init(Key) -> Result when Key :: <<_:256>>, Result :: crypto_onetimeauth_poly1305_state() | -1.
Start a streaming authenticator with the one-time keybytes/0 byte Key.
-spec crypto_onetimeauth_poly1305_keybytes() -> Result when Result :: 32.
Return crypto_onetimeauth_poly1305_keybytes(), in bytes.
-spec crypto_onetimeauth_poly1305_keygen() -> Result when Result :: <<_:256>>.
Generate a random keybytes/0 byte key.
-spec crypto_onetimeauth_poly1305_statebytes() -> Result when Result :: 256.
Return crypto_onetimeauth_poly1305_statebytes(), in bytes.
-spec crypto_onetimeauth_poly1305_update(State, In) -> Result when State :: crypto_onetimeauth_poly1305_state(), In :: binary(), Result :: crypto_onetimeauth_poly1305_state() | -1.
Absorb In into State and return the updated state.
-spec crypto_onetimeauth_poly1305_verify(H, In, K) -> Result when H :: <<_:128>>, In :: binary(), K :: <<_:256>>, Result :: 0 | -1.
Check in constant time that H is the tag of In under the key K.
Returns 0 when it is valid and -1 otherwise.
Public-key authenticated encryption
-spec crypto_box_afternm(M, N, K) -> Result when M :: binary(), N :: <<_:192>>, K :: <<_:256>>, Result :: binary() | -1.
Like crypto_box/4, using the shared key K precomputed by beforenm/2.
See libsodium_crypto_box.
-spec crypto_box_beforenm(Pk, Sk) -> Result
when Pk :: <<_:256>>, Sk :: <<_:256>>, Result :: <<_:256>> | -1.
Precompute the beforenmbytes/0 byte shared key for the public key PK
and the secret key SK, for use with the _afternm functions.
See libsodium_crypto_box.
-spec crypto_box_beforenmbytes() -> Result when Result :: 32.
Return crypto_box_beforenmbytes(), in bytes.
See libsodium_crypto_box.
-spec crypto_box_boxzerobytes() -> Result when Result :: 16.
Return crypto_box_boxzerobytes(), in bytes.
See libsodium_crypto_box.
-spec crypto_box_crypto_box(M, N, Pk, Sk) -> Result when M :: binary(), N :: <<_:192>>, Pk :: <<_:256>>, Sk :: <<_:256>>, Result :: binary() | -1.
NaCl-compatible encryption of M, which must start with zerobytes/0
zero bytes, using the nonce N, the recipient's public key PK, and
the sender's secret key SK.
See libsodium_crypto_box.
-spec crypto_box_detached(M, N, Pk, Sk) -> Result when M :: binary(), N :: <<_:192>>, Pk :: <<_:256>>, Sk :: <<_:256>>, Result :: {binary(), <<_:128>>} | -1.
Like easy/4, but returns the ciphertext and the macbytes/0 byte
authentication tag separately as {C, MAC}.
See libsodium_crypto_box.
-spec crypto_box_detached_afternm(M, N, K) -> Result when M :: binary(), N :: <<_:192>>, K :: <<_:256>>, Result :: {binary(), <<_:128>>} | -1.
Like detached/4, using the shared key K precomputed by beforenm/2.
Returns {C, MAC}.
See libsodium_crypto_box.
-spec crypto_box_easy(M, N, Pk, Sk) -> Result when M :: binary(), N :: <<_:192>>, Pk :: <<_:256>>, Sk :: <<_:256>>, Result :: binary() | -1.
Encrypt and authenticate M with the nonce N, the recipient's public
key PK, and the sender's secret key SK.
See libsodium_crypto_box.
-spec crypto_box_easy_afternm(M, N, K) -> Result when M :: binary(), N :: <<_:192>>, K :: <<_:256>>, Result :: binary() | -1.
Like easy/4, using the shared key K precomputed by beforenm/2.
See libsodium_crypto_box.
-spec crypto_box_keypair() -> Result when Result :: {<<_:256>>, <<_:256>>} | -1.
Generate a random key pair. Returns {PK, SK}.
See libsodium_crypto_box.
-spec crypto_box_macbytes() -> Result when Result :: 16.
Return crypto_box_macbytes(), in bytes.
See libsodium_crypto_box.
-spec crypto_box_messagebytes_max() -> Result when Result :: non_neg_integer().
Return crypto_box_messagebytes_max(), in bytes.
See libsodium_crypto_box.
-spec crypto_box_noncebytes() -> Result when Result :: 24.
Return crypto_box_noncebytes(), in bytes.
See libsodium_crypto_box.
-spec crypto_box_open(C, N, Pk, Sk) -> Result when C :: binary(), N :: <<_:192>>, Pk :: <<_:256>>, Sk :: <<_:256>>, Result :: binary() | -1.
NaCl-compatible verification and decryption of C, which must start
with boxzerobytes/0 zero bytes, using the nonce N, the sender's
public key PK, and the recipient's secret key SK.
See libsodium_crypto_box.
-spec crypto_box_open_afternm(C, N, K) -> Result when C :: binary(), N :: <<_:192>>, K :: <<_:256>>, Result :: binary() | -1.
Like open/4, using the shared key K precomputed by beforenm/2.
Returns -1 when verification fails.
See libsodium_crypto_box.
-spec crypto_box_open_detached(C, Mac, N, Pk, Sk) -> Result when C :: binary(), Mac :: <<_:128>>, N :: <<_:192>>, Pk :: <<_:256>>, Sk :: <<_:256>>, Result :: binary() | -1.
Verify the detached tag MAC and decrypt C with the nonce N, the
sender's public key PK, and the recipient's secret key SK.
See libsodium_crypto_box.
-spec crypto_box_open_detached_afternm(C, Mac, N, K) -> Result when C :: binary(), Mac :: <<_:128>>, N :: <<_:192>>, K :: <<_:256>>, Result :: binary() | -1.
Like open_detached/5, using the shared key K precomputed by
beforenm/2. Returns -1 when verification fails.
See libsodium_crypto_box.
-spec crypto_box_open_easy(C, N, Pk, Sk) -> Result when C :: binary(), N :: <<_:192>>, Pk :: <<_:256>>, Sk :: <<_:256>>, Result :: binary() | -1.
Verify and decrypt C, produced by easy/4, with the nonce N, the
sender's public key PK, and the recipient's secret key SK.
See libsodium_crypto_box.
-spec crypto_box_open_easy_afternm(C, N, K) -> Result when C :: binary(), N :: <<_:192>>, K :: <<_:256>>, Result :: binary() | -1.
Like open_easy/4, using the shared key K precomputed by
beforenm/2. Returns -1 when verification fails.
See libsodium_crypto_box.
-spec crypto_box_primitive() -> Result when Result :: curve25519xsalsa20poly1305.
Return crypto_box_primitive() as an atom.
See libsodium_crypto_box.
-spec crypto_box_publickeybytes() -> Result when Result :: 32.
Return crypto_box_publickeybytes(), in bytes.
See libsodium_crypto_box.
-spec crypto_box_seal(M, Pk) -> Result when M :: binary(), Pk :: <<_:256>>, Result :: binary() | -1.
Anonymously encrypt M for the recipient's public key PK using a new
ephemeral key pair. The result is sealbytes/0 bytes longer than M;
only the recipient can open it, but the sender cannot be identified.
See libsodium_crypto_box.
-spec crypto_box_seal_open(C, Pk, Sk) -> Result when C :: binary(), Pk :: <<_:256>>, Sk :: <<_:256>>, Result :: binary() | -1.
Open the sealed box C with the recipient's key pair PK and SK.
See libsodium_crypto_box.
-spec crypto_box_sealbytes() -> Result when Result :: 48.
Return crypto_box_sealbytes(), in bytes.
See libsodium_crypto_box.
-spec crypto_box_secretkeybytes() -> Result when Result :: 32.
Return crypto_box_secretkeybytes(), in bytes.
See libsodium_crypto_box.
-spec crypto_box_seed_keypair(Seed) -> Result
when Seed :: <<_:256>>, Result :: {<<_:256>>, <<_:256>>} | -1.
Deterministically derive a key pair from the seedbytes/0 byte Seed.
Returns {PK, SK}.
See libsodium_crypto_box.
-spec crypto_box_seedbytes() -> Result when Result :: 32.
Return crypto_box_seedbytes(), in bytes.
See libsodium_crypto_box.
-spec crypto_box_zerobytes() -> Result when Result :: 32.
Return crypto_box_zerobytes(), in bytes.
See libsodium_crypto_box.
Public-key signatures
-spec crypto_sign_bytes() -> Result when Result :: 64.
Return crypto_sign_bytes(), in bytes.
-spec crypto_sign_crypto_sign(M, Sk) -> Result when M :: binary(), Sk :: <<_:512>>, Result :: binary() | -1.
Sign M with the secret key SK, returning the bytes/0 byte
signature followed by the message.
-spec crypto_sign_detached(M, Sk) -> Result when M :: binary(), Sk :: <<_:512>>, Result :: <<_:512>> | -1.
Sign M with the secret key SK, returning only the bytes/0 byte signature.
-spec crypto_sign_final_create(State, Sk) -> Result when State :: crypto_sign_state(), Sk :: <<_:512>>, Result :: <<_:512>> | -1.
Finish the streaming message in State and sign it with the secret key
SK, returning the bytes/0 byte Ed25519ph signature.
-spec crypto_sign_final_verify(State, Sig, Pk) -> Result when State :: crypto_sign_state(), Sig :: <<_:512>>, Pk :: <<_:256>>, Result :: 0 | -1.
Finish the streaming message in State and verify its Ed25519ph
signature Sig with the public key PK. Returns 0 when the signature
is valid and -1 otherwise.
-spec crypto_sign_init() -> Result when Result :: crypto_sign_state() | -1.
Start a streaming Ed25519ph signature, returning a new state.
-spec crypto_sign_keypair() -> Result when Result :: {<<_:256>>, <<_:512>>} | -1.
Generate a random key pair. Returns {PK, SK}.
-spec crypto_sign_messagebytes_max() -> Result when Result :: non_neg_integer().
Return crypto_sign_messagebytes_max(), in bytes.
-spec crypto_sign_open(Sm, Pk) -> Result when Sm :: binary(), Pk :: <<_:256>>, Result :: binary() | -1.
Verify the signed message SM with the public key PK and return the
message without its signature, or -1 when the signature is invalid.
-spec crypto_sign_primitive() -> Result when Result :: ed25519.
Return crypto_sign_primitive() as an atom.
-spec crypto_sign_publickeybytes() -> Result when Result :: 32.
Return crypto_sign_publickeybytes(), in bytes.
-spec crypto_sign_secretkeybytes() -> Result when Result :: 64.
Return crypto_sign_secretkeybytes(), in bytes.
-spec crypto_sign_seed_keypair(Seed) -> Result
when Seed :: <<_:256>>, Result :: {<<_:256>>, <<_:512>>} | -1.
Deterministically derive a key pair from the seedbytes/0 byte Seed.
Returns {PK, SK}.
-spec crypto_sign_seedbytes() -> Result when Result :: 32.
Return crypto_sign_seedbytes(), in bytes.
-spec crypto_sign_statebytes() -> Result when Result :: 208.
Return crypto_sign_statebytes(), in bytes.
-spec crypto_sign_update(State, M) -> Result when State :: crypto_sign_state(), M :: binary(), Result :: crypto_sign_state() | -1.
Absorb the message chunk M into State and return the updated state.
-spec crypto_sign_verify_detached(Sig, M, Pk) -> Result when Sig :: <<_:512>>, M :: binary(), Pk :: <<_:256>>, Result :: 0 | -1.
Verify the detached signature Sig of M with the public key PK.
Returns 0 when the signature is valid and -1 otherwise.
Random data
-spec randombytes_buf(Size) -> Result when Size :: non_neg_integer(), Result :: binary().
Return Size random bytes.
-spec randombytes_buf_deterministic(Size, Seed) -> Result when Size :: non_neg_integer(), Seed :: <<_:256>>, Result :: binary().
Return Size bytes deterministically derived from the seedbytes/0 byte
Seed. The same seed always produces the same output.
-spec randombytes_close() -> Result when Result :: 0 | -1.
Release resources held by the generator (such as an open
/dev/urandom descriptor). Returns 0 on success or -1 on failure.
-spec randombytes_implementation_name() -> Result when Result :: atom().
Return the name of the active random number generator implementation, such as sysrandom.
-spec randombytes_random() -> Result when Result :: 0..4294967295.
Return a random integer between 0 and 16#ffffffff (inclusive).
-spec randombytes_randombytes(Size) -> Result when Size :: non_neg_integer(), Result :: binary().
Return Size random bytes; equivalent to buf/1.
-spec randombytes_seedbytes() -> Result when Result :: 32.
Return randombytes_seedbytes(), in bytes.
-spec randombytes_set_implementation(Impl) -> Result
when Impl :: internal | salsa20 | sysrandom, Result :: 0 | -1.
Select the generator implementation for the whole VM: sysrandom uses the
operating system directly, while internal (also called salsa20) uses
a ChaCha20-based generator seeded from it. Returns 0 on success.
-spec randombytes_stir() -> Result when Result :: ok.
Reseed the generator. Rarely needed; libsodium reseeds automatically after a fork.
-spec randombytes_uniform(UpperBound) -> Result
when UpperBound :: 0..4294967295, Result :: 0..4294967294.
Return a uniformly distributed random integer between 0 and
UpperBound - 1 (inclusive), avoiding modulo bias. Returns 0 when
UpperBound is less than 2.
Ristretto255 arithmetic
-spec crypto_core_ristretto255_add(P, Q) -> Result
when P :: <<_:256>>, Q :: <<_:256>>, Result :: <<_:256>> | -1.
Return the element P + Q, or -1 when either input is not a valid encoding.
-spec crypto_core_ristretto255_bytes() -> Result when Result :: 32.
Return crypto_core_ristretto255_bytes(), in bytes.
-spec crypto_core_ristretto255_from_hash(H) -> Result when H :: <<_:512>>, Result :: <<_:256>> | -1.
Map the hashbytes/0 byte uniform string H (such as a SHA-512
digest) to a group element.
-spec crypto_core_ristretto255_hashbytes() -> Result when Result :: 64.
Return crypto_core_ristretto255_hashbytes(), in bytes.
-spec crypto_core_ristretto255_is_valid_point(P) -> Result when P :: <<_:256>>, Result :: 0 | 1.
Return 1 when P is a valid canonical ristretto255 encoding, otherwise 0.
-spec crypto_core_ristretto255_nonreducedscalarbytes() -> Result when Result :: 64.
Return crypto_core_ristretto255_nonreducedscalarbytes(), in bytes.
-spec crypto_core_ristretto255_random() -> Result when Result :: <<_:256>>.
Return a random group element.
-spec crypto_core_ristretto255_scalar_add(X, Y) -> Result
when X :: <<_:256>>, Y :: <<_:256>>, Result :: <<_:256>>.
Return X + Y mod L.
-spec crypto_core_ristretto255_scalar_complement(S) -> Result when S :: <<_:256>>, Result :: <<_:256>>.
Return 1 - S mod L, so that S + Comp = 1 (mod L).
-spec crypto_core_ristretto255_scalar_invert(S) -> Result when S :: <<_:256>>, Result :: <<_:256>> | -1.
Return the multiplicative inverse of the scalar S modulo L, or -1 when S is zero.
-spec crypto_core_ristretto255_scalar_mul(X, Y) -> Result
when X :: <<_:256>>, Y :: <<_:256>>, Result :: <<_:256>>.
Return X * Y mod L.
-spec crypto_core_ristretto255_scalar_negate(S) -> Result when S :: <<_:256>>, Result :: <<_:256>>.
Return -S mod L.
-spec crypto_core_ristretto255_scalar_random() -> Result when Result :: <<_:256>>.
Return a random scalar in [0, L).
-spec crypto_core_ristretto255_scalar_reduce(S) -> Result when S :: <<_:512>>, Result :: <<_:256>>.
Reduce the nonreducedscalarbytes/0 byte little-endian integer S
modulo L. S should be sampled from at least 317 bits (such as a
64-byte hash) for the result to be close to uniform.
-spec crypto_core_ristretto255_scalar_sub(X, Y) -> Result
when X :: <<_:256>>, Y :: <<_:256>>, Result :: <<_:256>>.
Return X - Y mod L.
-spec crypto_core_ristretto255_scalarbytes() -> Result when Result :: 32.
Return crypto_core_ristretto255_scalarbytes(), in bytes.
-spec crypto_core_ristretto255_sub(P, Q) -> Result
when P :: <<_:256>>, Q :: <<_:256>>, Result :: <<_:256>> | -1.
Return the element P - Q, or -1 when either input is not a valid encoding.
Ristretto255 point multiplication
-spec crypto_scalarmult_ristretto255_base(N) -> Result when N :: <<_:256>>, Result :: <<_:256>> | -1.
Multiply the generator by the scalar N. Returns -1 when the result
is the identity.
-spec crypto_scalarmult_ristretto255_bytes() -> Result when Result :: 32.
Return crypto_scalarmult_ristretto255_bytes(), in bytes.
-spec crypto_scalarmult_ristretto255_crypto_scalarmult_ristretto255(N, P) -> Result
when
N :: <<_:256>>,
P :: <<_:256>>,
Result :: <<_:256>> | -1.
Multiply the element P by the scalar N. Returns -1 when P is
not a valid encoding or when the result is the identity.
-spec crypto_scalarmult_ristretto255_scalarbytes() -> Result when Result :: 32.
Return crypto_scalarmult_ristretto255_scalarbytes(), in bytes.
Salsa20 core
-spec crypto_core_salsa20_constbytes() -> Result when Result :: 16.
Return crypto_core_salsa20_constbytes(), in bytes.
-spec crypto_core_salsa20_crypto_core_salsa20(In, K, C) -> Result
when
In :: <<_:128>>,
K :: <<_:256>>,
C :: <<_:128>>,
Result :: <<_:512>>.
Compute the Salsa20 core of the inputbytes/0 byte input In
with the keybytes/0 byte key K and the constbytes/0 byte constant
C, returning outputbytes/0 bytes.
-spec crypto_core_salsa20_inputbytes() -> Result when Result :: 16.
Return crypto_core_salsa20_inputbytes(), in bytes.
-spec crypto_core_salsa20_keybytes() -> Result when Result :: 32.
Return crypto_core_salsa20_keybytes(), in bytes.
-spec crypto_core_salsa20_outputbytes() -> Result when Result :: 64.
Return crypto_core_salsa20_outputbytes(), in bytes.
Salsa20 stream cipher
-spec crypto_stream_salsa20_crypto_stream_salsa20(Clen, N, K) -> Result when Clen :: non_neg_integer(), N :: <<_:64>>, K :: <<_:256>>, Result :: binary().
Return CLen bytes of keystream for the noncebytes/0 byte nonce N and the keybytes/0 byte key
K.
-spec crypto_stream_salsa20_keybytes() -> Result when Result :: 32.
Return crypto_stream_salsa20_keybytes(), in bytes.
-spec crypto_stream_salsa20_keygen() -> Result when Result :: <<_:256>>.
Generate a random keybytes/0 byte key.
-spec crypto_stream_salsa20_messagebytes_max() -> Result when Result :: non_neg_integer().
Return crypto_stream_salsa20_messagebytes_max(), in bytes.
-spec crypto_stream_salsa20_noncebytes() -> Result when Result :: 8.
Return crypto_stream_salsa20_noncebytes(), in bytes.
-spec crypto_stream_salsa20_xor(M, N, K) -> Result when M :: binary(), N :: <<_:64>>, K :: <<_:256>>, Result :: binary().
Encrypt or decrypt M by combining it with the keystream for the nonce
N and key K, starting at block counter 0.
-spec crypto_stream_salsa20_xor_ic(M, N, Ic, K) -> Result when M :: binary(), N :: <<_:64>>, Ic :: non_neg_integer(), K :: <<_:256>>, Result :: binary().
Like 'xor'/3, but start at the 64-byte block counter IC, so the
message is combined with the keystream from byte IC * 64 onwards.
Salsa20/12 core
-spec crypto_core_salsa2012_constbytes() -> Result when Result :: 16.
Return crypto_core_salsa2012_constbytes(), in bytes.
-spec crypto_core_salsa2012_crypto_core_salsa2012(In, K, C) -> Result
when
In :: <<_:128>>,
K :: <<_:256>>,
C :: <<_:128>>,
Result :: <<_:512>>.
Compute the Salsa20/12 core of the inputbytes/0 byte input In
with the keybytes/0 byte key K and the constbytes/0 byte constant
C, returning outputbytes/0 bytes.
-spec crypto_core_salsa2012_inputbytes() -> Result when Result :: 16.
Return crypto_core_salsa2012_inputbytes(), in bytes.
-spec crypto_core_salsa2012_keybytes() -> Result when Result :: 32.
Return crypto_core_salsa2012_keybytes(), in bytes.
-spec crypto_core_salsa2012_outputbytes() -> Result when Result :: 64.
Return crypto_core_salsa2012_outputbytes(), in bytes.
Salsa20/12 stream cipher
-spec crypto_stream_salsa2012_crypto_stream_salsa2012(Clen, N, K) -> Result when Clen :: non_neg_integer(), N :: <<_:64>>, K :: <<_:256>>, Result :: binary().
Return CLen bytes of keystream for the noncebytes/0 byte nonce N and the keybytes/0 byte key
K.
-spec crypto_stream_salsa2012_keybytes() -> Result when Result :: 32.
Return crypto_stream_salsa2012_keybytes(), in bytes.
-spec crypto_stream_salsa2012_keygen() -> Result when Result :: <<_:256>>.
Generate a random keybytes/0 byte key.
-spec crypto_stream_salsa2012_messagebytes_max() -> Result when Result :: non_neg_integer().
Return crypto_stream_salsa2012_messagebytes_max(), in bytes.
-spec crypto_stream_salsa2012_noncebytes() -> Result when Result :: 8.
Return crypto_stream_salsa2012_noncebytes(), in bytes.
-spec crypto_stream_salsa2012_xor(M, N, K) -> Result when M :: binary(), N :: <<_:64>>, K :: <<_:256>>, Result :: binary().
Encrypt or decrypt M by combining it with the keystream for the nonce
N and key K.
Scrypt password hashing
-spec crypto_pwhash_scryptsalsa208sha256_bytes_max() -> Result when Result :: non_neg_integer().
Return crypto_pwhash_scryptsalsa208sha256_bytes_max(), in bytes.
-spec crypto_pwhash_scryptsalsa208sha256_bytes_min() -> Result when Result :: 16.
Return crypto_pwhash_scryptsalsa208sha256_bytes_min(), in bytes.
-spec crypto_pwhash_scryptsalsa208sha256_crypto_pwhash_scryptsalsa208sha256(Outlen, Passwd, Salt, Opslimit, Memlimit) -> Result when Outlen :: non_neg_integer(), Passwd :: binary(), Salt :: <<_:256>>, Opslimit :: non_neg_integer(), Memlimit :: non_neg_integer(), Result :: binary() | -1.
Derive an Outlen byte key from Passwd and the saltbytes/0 byte
Salt with the cost parameters Opslimit and Memlimit.
-spec crypto_pwhash_scryptsalsa208sha256_ll(Passwd, Salt, N, R, P, Buflen) -> Result when Passwd :: binary(), Salt :: binary(), N :: non_neg_integer(), R :: 0..4294967295, P :: 0..4294967295, Buflen :: non_neg_integer(), Result :: binary() | -1.
Compute raw scrypt over Passwd and Salt with the CPU/memory cost
N (a power of two greater than one), block size R, and
parallelism P, producing Buflen bytes.
-spec crypto_pwhash_scryptsalsa208sha256_memlimit_interactive() -> Result when Result :: 16777216.
Return crypto_pwhash_scryptsalsa208sha256_memlimit_interactive(), in bytes.
-spec crypto_pwhash_scryptsalsa208sha256_memlimit_max() -> Result when Result :: non_neg_integer().
Return crypto_pwhash_scryptsalsa208sha256_memlimit_max(), in bytes.
-spec crypto_pwhash_scryptsalsa208sha256_memlimit_min() -> Result when Result :: 16777216.
Return crypto_pwhash_scryptsalsa208sha256_memlimit_min(), in bytes.
-spec crypto_pwhash_scryptsalsa208sha256_memlimit_sensitive() -> Result when Result :: 1073741824.
Return crypto_pwhash_scryptsalsa208sha256_memlimit_sensitive(), in bytes.
-spec crypto_pwhash_scryptsalsa208sha256_opslimit_interactive() -> Result when Result :: 524288.
Return crypto_pwhash_scryptsalsa208sha256_opslimit_interactive(), in bytes.
-spec crypto_pwhash_scryptsalsa208sha256_opslimit_max() -> Result when Result :: 4294967295.
Return crypto_pwhash_scryptsalsa208sha256_opslimit_max(), in bytes.
-spec crypto_pwhash_scryptsalsa208sha256_opslimit_min() -> Result when Result :: 32768.
Return crypto_pwhash_scryptsalsa208sha256_opslimit_min(), in bytes.
-spec crypto_pwhash_scryptsalsa208sha256_opslimit_sensitive() -> Result when Result :: 33554432.
Return crypto_pwhash_scryptsalsa208sha256_opslimit_sensitive(), in bytes.
-spec crypto_pwhash_scryptsalsa208sha256_passwd_max() -> Result when Result :: non_neg_integer().
Return crypto_pwhash_scryptsalsa208sha256_passwd_max(), in bytes.
-spec crypto_pwhash_scryptsalsa208sha256_passwd_min() -> Result when Result :: 0.
Return crypto_pwhash_scryptsalsa208sha256_passwd_min(), in bytes.
-spec crypto_pwhash_scryptsalsa208sha256_saltbytes() -> Result when Result :: 32.
Return crypto_pwhash_scryptsalsa208sha256_saltbytes(), in bytes.
-spec crypto_pwhash_scryptsalsa208sha256_str(Passwd, Opslimit, Memlimit) -> Result when Passwd :: binary(), Opslimit :: non_neg_integer(), Memlimit :: non_neg_integer(), Result :: binary() | -1.
Hash Passwd for storage with the cost parameters Opslimit and
Memlimit and a random salt.
-spec crypto_pwhash_scryptsalsa208sha256_str_needs_rehash(Str, Opslimit, Memlimit) -> Result when Str :: binary(), Opslimit :: non_neg_integer(), Memlimit :: non_neg_integer(), Result :: -1 | 0 | 1.
Check whether Str was hashed with exactly the parameters that
Opslimit and Memlimit select.
-spec crypto_pwhash_scryptsalsa208sha256_str_verify(Str, Passwd) -> Result when Str :: binary(), Passwd :: binary(), Result :: 0 | -1.
Check Passwd against Str, a $7$ string produced by str/3.
-spec crypto_pwhash_scryptsalsa208sha256_strbytes() -> Result when Result :: 102.
Return crypto_pwhash_scryptsalsa208sha256_strbytes(), in bytes.
-spec crypto_pwhash_scryptsalsa208sha256_strprefix() -> Result when Result :: binary().
Return crypto_pwhash_scryptsalsa208sha256_strprefix() as a binary.
Secret-key authenticated encryption
-spec crypto_secretbox_boxzerobytes() -> Result when Result :: 16.
Return crypto_secretbox_boxzerobytes(), in bytes.
-spec crypto_secretbox_crypto_secretbox(M, N, K) -> Result when M :: binary(), N :: <<_:192>>, K :: <<_:256>>, Result :: binary() | -1.
NaCl compatibility interface: encrypt M, which must start with
zerobytes/0 zero bytes, with the nonce N and key K.
-spec crypto_secretbox_detached(M, N, K) -> Result when M :: binary(), N :: <<_:192>>, K :: <<_:256>>, Result :: {binary(), <<_:128>>} | -1.
Encrypt and authenticate M with the nonce N and key K, returning
the ciphertext and the macbytes/0 byte authentication tag
separately as {C, MAC}, or -1 on failure.
-spec crypto_secretbox_easy(M, N, K) -> Result when M :: binary(), N :: <<_:192>>, K :: <<_:256>>, Result :: binary() | -1.
Encrypt and authenticate M with the noncebytes/0 byte nonce N
and the keybytes/0 byte key K.
-spec crypto_secretbox_keybytes() -> Result when Result :: 32.
Return crypto_secretbox_keybytes(), in bytes.
-spec crypto_secretbox_keygen() -> Result when Result :: <<_:256>>.
Generate a random keybytes/0 byte key.
-spec crypto_secretbox_macbytes() -> Result when Result :: 16.
Return crypto_secretbox_macbytes(), in bytes.
-spec crypto_secretbox_messagebytes_max() -> Result when Result :: non_neg_integer().
Return crypto_secretbox_messagebytes_max(), in bytes.
-spec crypto_secretbox_noncebytes() -> Result when Result :: 24.
Return crypto_secretbox_noncebytes(), in bytes.
-spec crypto_secretbox_open(C, N, K) -> Result when C :: binary(), N :: <<_:192>>, K :: <<_:256>>, Result :: binary() | -1.
NaCl compatibility interface: verify and decrypt C, which must
start with boxzerobytes/0 zero bytes, with the nonce N and key
K.
-spec crypto_secretbox_open_detached(C, Mac, N, K) -> Result when C :: binary(), Mac :: <<_:128>>, N :: <<_:192>>, K :: <<_:256>>, Result :: binary() | -1.
Verify the detached tag MAC and decrypt C with the nonce N and
key K. Returns the plaintext, or -1 when verification fails.
-spec crypto_secretbox_open_easy(C, N, K) -> Result when C :: binary(), N :: <<_:192>>, K :: <<_:256>>, Result :: binary() | -1.
Verify and decrypt the ciphertext C produced by easy/3 with the
nonce N and key K. Returns the plaintext, or -1 when
verification fails or C is shorter than macbytes/0.
-spec crypto_secretbox_primitive() -> Result when Result :: xsalsa20poly1305.
Return crypto_secretbox_primitive() as an atom.
-spec crypto_secretbox_zerobytes() -> Result when Result :: 32.
Return crypto_secretbox_zerobytes(), in bytes.
Secret-key authentication
-spec crypto_auth_bytes() -> Result when Result :: 32.
Return crypto_auth_bytes(), in bytes.
-spec crypto_auth_crypto_auth(In, K) -> Result when In :: binary(), K :: <<_:256>>, Result :: <<_:256>> | -1.
Compute the bytes/0 byte authentication tag of In under the keybytes/0 byte key K.
-spec crypto_auth_keybytes() -> Result when Result :: 32.
Return crypto_auth_keybytes(), in bytes.
-spec crypto_auth_keygen() -> Result when Result :: <<_:256>>.
Generate a random keybytes/0 byte key.
-spec crypto_auth_primitive() -> Result when Result :: hmacsha512256.
Return crypto_auth_primitive() as an atom.
-spec crypto_auth_verify(H, In, K) -> Result when H :: <<_:256>>, In :: binary(), K :: <<_:256>>, Result :: 0 | -1.
Check in constant time that H is the tag of In under the key K.
Returns 0 when it is valid and -1 otherwise.
SHA3-256
-spec crypto_hash_sha3256_bytes() -> Result when Result :: 32.
Return crypto_hash_sha3256_bytes(), in bytes.
-spec crypto_hash_sha3256_crypto_hash_sha3256(In) -> Result when In :: binary(), Result :: <<_:256>> | -1.
Hash In, returning a bytes/0 byte digest.
-spec crypto_hash_sha3256_final(State) -> Result when State :: crypto_hash_sha3256_state(), Result :: <<_:256>> | -1.
Finish the streaming hash in State, returning a bytes/0 byte digest.
-spec crypto_hash_sha3256_init() -> Result when Result :: crypto_hash_sha3256_state() | -1.
Start a streaming hash, returning its state.
-spec crypto_hash_sha3256_statebytes() -> Result when Result :: 256.
Return crypto_hash_sha3256_statebytes(), in bytes.
-spec crypto_hash_sha3256_update(State, In) -> Result when State :: crypto_hash_sha3256_state(), In :: binary(), Result :: crypto_hash_sha3256_state() | -1.
Absorb In into State and return the updated state.
SHA3-512
-spec crypto_hash_sha3512_bytes() -> Result when Result :: 64.
Return crypto_hash_sha3512_bytes(), in bytes.
-spec crypto_hash_sha3512_crypto_hash_sha3512(In) -> Result when In :: binary(), Result :: <<_:512>> | -1.
Hash In, returning a bytes/0 byte digest.
-spec crypto_hash_sha3512_final(State) -> Result when State :: crypto_hash_sha3512_state(), Result :: <<_:512>> | -1.
Finish the streaming hash in State, returning a bytes/0 byte digest.
-spec crypto_hash_sha3512_init() -> Result when Result :: crypto_hash_sha3512_state() | -1.
Start a streaming hash, returning its state.
-spec crypto_hash_sha3512_statebytes() -> Result when Result :: 256.
Return crypto_hash_sha3512_statebytes(), in bytes.
-spec crypto_hash_sha3512_update(State, In) -> Result when State :: crypto_hash_sha3512_state(), In :: binary(), Result :: crypto_hash_sha3512_state() | -1.
Absorb In into State and return the updated state.
SHA-256
-spec crypto_hash_sha256_bytes() -> Result when Result :: 32.
Return crypto_hash_sha256_bytes(), in bytes.
-spec crypto_hash_sha256_crypto_hash_sha256(In) -> Result when In :: binary(), Result :: <<_:256>> | -1.
Hash In, returning a bytes/0 byte digest.
-spec crypto_hash_sha256_final(State) -> Result when State :: crypto_hash_sha256_state(), Result :: <<_:256>> | -1.
Finish the streaming hash in State, returning a bytes/0 byte digest.
-spec crypto_hash_sha256_init() -> Result when Result :: crypto_hash_sha256_state() | -1.
Start a streaming hash, returning a statebytes/0 byte state.
-spec crypto_hash_sha256_statebytes() -> Result when Result :: 104.
Return crypto_hash_sha256_statebytes(), in bytes.
-spec crypto_hash_sha256_update(State, In) -> Result when State :: crypto_hash_sha256_state(), In :: binary(), Result :: crypto_hash_sha256_state() | -1.
Absorb In into State and return the updated state.
SHA-512
-spec crypto_hash_sha512_bytes() -> Result when Result :: 64.
Return crypto_hash_sha512_bytes(), in bytes.
-spec crypto_hash_sha512_crypto_hash_sha512(In) -> Result when In :: binary(), Result :: <<_:512>> | -1.
Hash In, returning a bytes/0 byte digest.
-spec crypto_hash_sha512_final(State) -> Result when State :: crypto_hash_sha512_state(), Result :: <<_:512>> | -1.
Finish the streaming hash in State, returning a bytes/0 byte digest.
-spec crypto_hash_sha512_init() -> Result when Result :: crypto_hash_sha512_state() | -1.
Start a streaming hash, returning a statebytes/0 byte state.
-spec crypto_hash_sha512_statebytes() -> Result when Result :: 208.
Return crypto_hash_sha512_statebytes(), in bytes.
-spec crypto_hash_sha512_update(State, In) -> Result when State :: crypto_hash_sha512_state(), In :: binary(), Result :: crypto_hash_sha512_state() | -1.
Absorb In into State and return the updated state.
SHAKE128 extendable-output function
-spec crypto_xof_shake128_blockbytes() -> Result when Result :: 168.
Return crypto_xof_shake128_blockbytes(), in bytes.
-spec crypto_xof_shake128_crypto_xof_shake128(Outlen, In) -> Result when Outlen :: non_neg_integer(), In :: binary(), Result :: binary() | -1.
Hash In with SHAKE128 and the standard domain byte, returning
Outlen bytes of output.
-spec crypto_xof_shake128_domain_standard() -> Result when Result :: 31.
Return crypto_xof_shake128_domain_standard().
-spec crypto_xof_shake128_init() -> Result when Result :: crypto_xof_shake128_state() | -1.
Start a streaming SHAKE128 hash with the standard domain byte domain_standard/0.
-spec crypto_xof_shake128_init_with_domain(Domain) -> Result when Domain :: 0..255, Result :: crypto_xof_shake128_state() | -1.
Start a streaming SHAKE128 hash with the domain separation byte
Domain (an integer from 0 to 255).
-spec crypto_xof_shake128_squeeze(State, Outlen) -> Result when State :: crypto_xof_shake128_state(), Outlen :: non_neg_integer(), Result :: {crypto_xof_shake128_state(), binary()} | -1.
Read the next Outlen bytes of output from State.
-spec crypto_xof_shake128_statebytes() -> Result when Result :: 256.
Return crypto_xof_shake128_statebytes(), in bytes.
-spec crypto_xof_shake128_update(State, In) -> Result when State :: crypto_xof_shake128_state(), In :: binary(), Result :: crypto_xof_shake128_state() | -1.
Absorb In into State and return the updated state.
SHAKE256 extendable-output function
-spec crypto_xof_shake256_blockbytes() -> Result when Result :: 136.
Return crypto_xof_shake256_blockbytes(), in bytes.
-spec crypto_xof_shake256_crypto_xof_shake256(Outlen, In) -> Result when Outlen :: non_neg_integer(), In :: binary(), Result :: binary() | -1.
Hash In with SHAKE256 and the standard domain byte, returning
Outlen bytes of output.
-spec crypto_xof_shake256_domain_standard() -> Result when Result :: 31.
Return crypto_xof_shake256_domain_standard().
-spec crypto_xof_shake256_init() -> Result when Result :: crypto_xof_shake256_state() | -1.
Start a streaming SHAKE256 hash with the standard domain byte domain_standard/0.
-spec crypto_xof_shake256_init_with_domain(Domain) -> Result when Domain :: 0..255, Result :: crypto_xof_shake256_state() | -1.
Start a streaming SHAKE256 hash with the domain separation byte
Domain (an integer from 0 to 255).
-spec crypto_xof_shake256_squeeze(State, Outlen) -> Result when State :: crypto_xof_shake256_state(), Outlen :: non_neg_integer(), Result :: {crypto_xof_shake256_state(), binary()} | -1.
Read the next Outlen bytes of output from State.
-spec crypto_xof_shake256_statebytes() -> Result when Result :: 256.
Return crypto_xof_shake256_statebytes(), in bytes.
-spec crypto_xof_shake256_update(State, In) -> Result when State :: crypto_xof_shake256_state(), In :: binary(), Result :: crypto_xof_shake256_state() | -1.
Absorb In into State and return the updated state.
Short-input hashing
-spec crypto_shorthash_bytes() -> Result when Result :: 8.
Return crypto_shorthash_bytes(), in bytes.
-spec crypto_shorthash_crypto_shorthash(In, K) -> Result when In :: binary(), K :: <<_:128>>, Result :: <<_:64>> | -1.
Hash In under the keybytes/0 byte key K, returning bytes/0 bytes.
-spec crypto_shorthash_keybytes() -> Result when Result :: 16.
Return crypto_shorthash_keybytes(), in bytes.
-spec crypto_shorthash_keygen() -> Result when Result :: <<_:128>>.
Generate a random keybytes/0 byte key.
-spec crypto_shorthash_primitive() -> Result when Result :: siphash24.
Return crypto_shorthash_primitive() as an atom.
SipHash-2-4
-spec crypto_shorthash_siphash24_bytes() -> Result when Result :: 8.
Return crypto_shorthash_siphash24_bytes(), in bytes.
-spec crypto_shorthash_siphash24_crypto_shorthash_siphash24(In, K) -> Result when In :: binary(), K :: <<_:128>>, Result :: <<_:64>> | -1.
Hash In under the keybytes/0 byte key K, returning bytes/0 bytes.
-spec crypto_shorthash_siphash24_keybytes() -> Result when Result :: 16.
Return crypto_shorthash_siphash24_keybytes(), in bytes.
SipHash-2-4 (128-bit)
-spec crypto_shorthash_siphashx24_bytes() -> Result when Result :: 16.
Return crypto_shorthash_siphashx24_bytes(), in bytes.
-spec crypto_shorthash_siphashx24_crypto_shorthash_siphashx24(In, K) -> Result when In :: binary(), K :: <<_:128>>, Result :: <<_:128>> | -1.
Hash In under the keybytes/0 byte key K, returning bytes/0 bytes.
-spec crypto_shorthash_siphashx24_keybytes() -> Result when Result :: 16.
Return crypto_shorthash_siphashx24_keybytes(), in bytes.
Stream cipher
-spec crypto_stream_crypto_stream(Clen, N, K) -> Result when Clen :: non_neg_integer(), N :: <<_:192>>, K :: <<_:256>>, Result :: binary().
Return CLen bytes of keystream for the noncebytes/0 byte nonce N and the keybytes/0 byte key
K.
-spec crypto_stream_keybytes() -> Result when Result :: 32.
Return crypto_stream_keybytes(), in bytes.
-spec crypto_stream_keygen() -> Result when Result :: <<_:256>>.
Generate a random keybytes/0 byte key.
-spec crypto_stream_messagebytes_max() -> Result when Result :: non_neg_integer().
Return crypto_stream_messagebytes_max(), in bytes.
-spec crypto_stream_noncebytes() -> Result when Result :: 24.
Return crypto_stream_noncebytes(), in bytes.
-spec crypto_stream_primitive() -> Result when Result :: xsalsa20.
Return crypto_stream_primitive() as an atom.
-spec crypto_stream_xor(M, N, K) -> Result when M :: binary(), N :: <<_:192>>, K :: <<_:256>>, Result :: binary().
Encrypt or decrypt M by combining it with the keystream for the nonce
N and key K.
TurboSHAKE128 extendable-output function
-spec crypto_xof_turboshake128_blockbytes() -> Result when Result :: 168.
Return crypto_xof_turboshake128_blockbytes(), in bytes.
-spec crypto_xof_turboshake128_crypto_xof_turboshake128(Outlen, In) -> Result when Outlen :: non_neg_integer(), In :: binary(), Result :: binary() | -1.
Hash In with TurboSHAKE128 and the standard domain byte, returning
Outlen bytes of output.
-spec crypto_xof_turboshake128_domain_standard() -> Result when Result :: 31.
Return crypto_xof_turboshake128_domain_standard().
-spec crypto_xof_turboshake128_init() -> Result when Result :: crypto_xof_turboshake128_state() | -1.
Start a streaming TurboSHAKE128 hash with the standard domain byte domain_standard/0.
-spec crypto_xof_turboshake128_init_with_domain(Domain) -> Result when Domain :: 0..255, Result :: crypto_xof_turboshake128_state() | -1.
Start a streaming TurboSHAKE128 hash with the domain separation byte
Domain (an integer from 0 to 255).
-spec crypto_xof_turboshake128_squeeze(State, Outlen) -> Result when State :: crypto_xof_turboshake128_state(), Outlen :: non_neg_integer(), Result :: {crypto_xof_turboshake128_state(), binary()} | -1.
Read the next Outlen bytes of output from State.
-spec crypto_xof_turboshake128_statebytes() -> Result when Result :: 256.
Return crypto_xof_turboshake128_statebytes(), in bytes.
-spec crypto_xof_turboshake128_update(State, In) -> Result when State :: crypto_xof_turboshake128_state(), In :: binary(), Result :: crypto_xof_turboshake128_state() | -1.
Absorb In into State and return the updated state.
TurboSHAKE256 extendable-output function
-spec crypto_xof_turboshake256_blockbytes() -> Result when Result :: 136.
Return crypto_xof_turboshake256_blockbytes(), in bytes.
-spec crypto_xof_turboshake256_crypto_xof_turboshake256(Outlen, In) -> Result when Outlen :: non_neg_integer(), In :: binary(), Result :: binary() | -1.
Hash In with TurboSHAKE256 and the standard domain byte, returning
Outlen bytes of output.
-spec crypto_xof_turboshake256_domain_standard() -> Result when Result :: 31.
Return crypto_xof_turboshake256_domain_standard().
-spec crypto_xof_turboshake256_init() -> Result when Result :: crypto_xof_turboshake256_state() | -1.
Start a streaming TurboSHAKE256 hash with the standard domain byte domain_standard/0.
-spec crypto_xof_turboshake256_init_with_domain(Domain) -> Result when Domain :: 0..255, Result :: crypto_xof_turboshake256_state() | -1.
Start a streaming TurboSHAKE256 hash with the domain separation byte
Domain (an integer from 0 to 255).
-spec crypto_xof_turboshake256_squeeze(State, Outlen) -> Result when State :: crypto_xof_turboshake256_state(), Outlen :: non_neg_integer(), Result :: {crypto_xof_turboshake256_state(), binary()} | -1.
Read the next Outlen bytes of output from State.
-spec crypto_xof_turboshake256_statebytes() -> Result when Result :: 256.
Return crypto_xof_turboshake256_statebytes(), in bytes.
-spec crypto_xof_turboshake256_update(State, In) -> Result when State :: crypto_xof_turboshake256_state(), In :: binary(), Result :: crypto_xof_turboshake256_state() | -1.
Absorb In into State and return the updated state.
X25519 point multiplication
-spec crypto_scalarmult_curve25519_base(N) -> Result when N :: <<_:256>>, Result :: <<_:256>> | -1.
Compute the public key for the clamped secret scalar N by multiplying
the base point. Returns -1 on failure.
-spec crypto_scalarmult_curve25519_bytes() -> Result when Result :: 32.
Return crypto_scalarmult_curve25519_bytes(), in bytes.
-spec crypto_scalarmult_curve25519_crypto_scalarmult_curve25519(N, P) -> Result
when
N :: <<_:256>>,
P :: <<_:256>>,
Result :: <<_:256>> | -1.
Multiply the point P by the clamped secret scalar N, producing a
shared secret. Returns -1 when P is a low-order point.
-spec crypto_scalarmult_curve25519_scalarbytes() -> Result when Result :: 32.
Return crypto_scalarmult_curve25519_scalarbytes(), in bytes.
X25519-XChaCha20-Poly1305 box
-spec crypto_box_curve25519xchacha20poly1305_beforenm(Pk, Sk) -> Result
when
Pk :: <<_:256>>,
Sk :: <<_:256>>,
Result :: <<_:256>> | -1.
Precompute the beforenmbytes/0 byte shared key for the public key PK
and the secret key SK, for use with the _afternm functions.
-spec crypto_box_curve25519xchacha20poly1305_beforenmbytes() -> Result when Result :: 32.
Return crypto_box_curve25519xchacha20poly1305_beforenmbytes(), in bytes.
-spec crypto_box_curve25519xchacha20poly1305_detached(M, N, Pk, Sk) -> Result when M :: binary(), N :: <<_:192>>, Pk :: <<_:256>>, Sk :: <<_:256>>, Result :: {binary(), <<_:128>>} | -1.
Like easy/4, but returns the ciphertext and the macbytes/0 byte
authentication tag separately as {C, MAC}.
-spec crypto_box_curve25519xchacha20poly1305_detached_afternm(M, N, K) -> Result when M :: binary(), N :: <<_:192>>, K :: <<_:256>>, Result :: {binary(), <<_:128>>} | -1.
Like detached/4, using the shared key K precomputed by beforenm/2.
Returns {C, MAC}.
-spec crypto_box_curve25519xchacha20poly1305_easy(M, N, Pk, Sk) -> Result when M :: binary(), N :: <<_:192>>, Pk :: <<_:256>>, Sk :: <<_:256>>, Result :: binary() | -1.
Encrypt and authenticate M with the nonce N, the recipient's public
key PK, and the sender's secret key SK.
-spec crypto_box_curve25519xchacha20poly1305_easy_afternm(M, N, K) -> Result when M :: binary(), N :: <<_:192>>, K :: <<_:256>>, Result :: binary() | -1.
Like easy/4, using the shared key K precomputed by beforenm/2.
-spec crypto_box_curve25519xchacha20poly1305_keypair() -> Result
when Result :: {<<_:256>>, <<_:256>>} | -1.
Generate a random key pair. Returns {PK, SK}.
-spec crypto_box_curve25519xchacha20poly1305_macbytes() -> Result when Result :: 16.
Return crypto_box_curve25519xchacha20poly1305_macbytes(), in bytes.
-spec crypto_box_curve25519xchacha20poly1305_messagebytes_max() -> Result when Result :: non_neg_integer().
Return crypto_box_curve25519xchacha20poly1305_messagebytes_max(), in bytes.
-spec crypto_box_curve25519xchacha20poly1305_noncebytes() -> Result when Result :: 24.
Return crypto_box_curve25519xchacha20poly1305_noncebytes(), in bytes.
-spec crypto_box_curve25519xchacha20poly1305_open_detached(C, Mac, N, Pk, Sk) -> Result when C :: binary(), Mac :: <<_:128>>, N :: <<_:192>>, Pk :: <<_:256>>, Sk :: <<_:256>>, Result :: binary() | -1.
Verify the detached tag MAC and decrypt C with the nonce N, the
sender's public key PK, and the recipient's secret key SK.
-spec crypto_box_curve25519xchacha20poly1305_open_detached_afternm(C, Mac, N, K) -> Result when C :: binary(), Mac :: <<_:128>>, N :: <<_:192>>, K :: <<_:256>>, Result :: binary() | -1.
Like open_detached/5, using the shared key K precomputed by
beforenm/2. Returns -1 when verification fails.
-spec crypto_box_curve25519xchacha20poly1305_open_easy(C, N, Pk, Sk) -> Result when C :: binary(), N :: <<_:192>>, Pk :: <<_:256>>, Sk :: <<_:256>>, Result :: binary() | -1.
Verify and decrypt C, produced by easy/4, with the nonce N, the
sender's public key PK, and the recipient's secret key SK.
-spec crypto_box_curve25519xchacha20poly1305_open_easy_afternm(C, N, K) -> Result when C :: binary(), N :: <<_:192>>, K :: <<_:256>>, Result :: binary() | -1.
Like open_easy/4, using the shared key K precomputed by
beforenm/2. Returns -1 when verification fails.
-spec crypto_box_curve25519xchacha20poly1305_publickeybytes() -> Result when Result :: 32.
Return crypto_box_curve25519xchacha20poly1305_publickeybytes(), in bytes.
-spec crypto_box_curve25519xchacha20poly1305_seal(M, Pk) -> Result when M :: binary(), Pk :: <<_:256>>, Result :: binary() | -1.
Anonymously encrypt M for the recipient's public key PK using a new
ephemeral key pair. The result is sealbytes/0 bytes longer than M.
-spec crypto_box_curve25519xchacha20poly1305_seal_open(C, Pk, Sk) -> Result when C :: binary(), Pk :: <<_:256>>, Sk :: <<_:256>>, Result :: binary() | -1.
Open the sealed box C with the recipient's key pair PK and SK.
-spec crypto_box_curve25519xchacha20poly1305_sealbytes() -> Result when Result :: 48.
Return crypto_box_curve25519xchacha20poly1305_sealbytes(), in bytes.
-spec crypto_box_curve25519xchacha20poly1305_secretkeybytes() -> Result when Result :: 32.
Return crypto_box_curve25519xchacha20poly1305_secretkeybytes(), in bytes.
-spec crypto_box_curve25519xchacha20poly1305_seed_keypair(Seed) -> Result
when
Seed :: <<_:256>>,
Result :: {<<_:256>>, <<_:256>>} | -1.
Deterministically derive a key pair from the seedbytes/0 byte Seed.
Returns {PK, SK}.
-spec crypto_box_curve25519xchacha20poly1305_seedbytes() -> Result when Result :: 32.
Return crypto_box_curve25519xchacha20poly1305_seedbytes(), in bytes.
X25519-XSalsa20-Poly1305 box
-spec crypto_box_curve25519xsalsa20poly1305_afternm(M, N, K) -> Result when M :: binary(), N :: <<_:192>>, K :: <<_:256>>, Result :: binary() | -1.
Like crypto_box_curve25519xsalsa20poly1305/4, using the shared key K
precomputed by beforenm/2.
-spec crypto_box_curve25519xsalsa20poly1305_beforenm(Pk, Sk) -> Result
when
Pk :: <<_:256>>,
Sk :: <<_:256>>,
Result :: <<_:256>> | -1.
Precompute the beforenmbytes/0 byte shared key for the public key PK
and the secret key SK, for use with afternm/3 and open_afternm/3.
-spec crypto_box_curve25519xsalsa20poly1305_beforenmbytes() -> Result when Result :: 32.
Return crypto_box_curve25519xsalsa20poly1305_beforenmbytes(), in bytes.
-spec crypto_box_curve25519xsalsa20poly1305_boxzerobytes() -> Result when Result :: 16.
Return crypto_box_curve25519xsalsa20poly1305_boxzerobytes(), in bytes.
-spec crypto_box_curve25519xsalsa20poly1305_crypto_box_curve25519xsalsa20poly1305(M, N, Pk, Sk) -> Result when M :: binary(), N :: <<_:192>>, Pk :: <<_:256>>, Sk :: <<_:256>>, Result :: binary() | -1.
Encrypt M, which must start with zerobytes/0 zero bytes, using the
nonce N, the recipient's public key PK, and the sender's secret key
SK.
-spec crypto_box_curve25519xsalsa20poly1305_keypair() -> Result
when Result :: {<<_:256>>, <<_:256>>} | -1.
Generate a random key pair. Returns {PK, SK}.
-spec crypto_box_curve25519xsalsa20poly1305_macbytes() -> Result when Result :: 16.
Return crypto_box_curve25519xsalsa20poly1305_macbytes(), in bytes.
-spec crypto_box_curve25519xsalsa20poly1305_messagebytes_max() -> Result when Result :: non_neg_integer().
Return crypto_box_curve25519xsalsa20poly1305_messagebytes_max(), in bytes.
-spec crypto_box_curve25519xsalsa20poly1305_noncebytes() -> Result when Result :: 24.
Return crypto_box_curve25519xsalsa20poly1305_noncebytes(), in bytes.
-spec crypto_box_curve25519xsalsa20poly1305_open(C, N, Pk, Sk) -> Result when C :: binary(), N :: <<_:192>>, Pk :: <<_:256>>, Sk :: <<_:256>>, Result :: binary() | -1.
Verify and decrypt C, which must start with boxzerobytes/0 zero
bytes, using the nonce N, the sender's public key PK, and the
recipient's secret key SK.
-spec crypto_box_curve25519xsalsa20poly1305_open_afternm(C, N, K) -> Result when C :: binary(), N :: <<_:192>>, K :: <<_:256>>, Result :: binary() | -1.
Like open/4, using the shared key K precomputed by beforenm/2.
Returns -1 when verification fails.
-spec crypto_box_curve25519xsalsa20poly1305_publickeybytes() -> Result when Result :: 32.
Return crypto_box_curve25519xsalsa20poly1305_publickeybytes(), in bytes.
-spec crypto_box_curve25519xsalsa20poly1305_secretkeybytes() -> Result when Result :: 32.
Return crypto_box_curve25519xsalsa20poly1305_secretkeybytes(), in bytes.
-spec crypto_box_curve25519xsalsa20poly1305_seed_keypair(Seed) -> Result
when
Seed :: <<_:256>>,
Result :: {<<_:256>>, <<_:256>>} | -1.
Deterministically derive a key pair from the seedbytes/0 byte Seed.
Returns {PK, SK}.
-spec crypto_box_curve25519xsalsa20poly1305_seedbytes() -> Result when Result :: 32.
Return crypto_box_curve25519xsalsa20poly1305_seedbytes(), in bytes.
-spec crypto_box_curve25519xsalsa20poly1305_zerobytes() -> Result when Result :: 32.
Return crypto_box_curve25519xsalsa20poly1305_zerobytes(), in bytes.
X-Wing key encapsulation
-spec crypto_kem_xwing_ciphertextbytes() -> Result when Result :: 1120.
Return crypto_kem_xwing_ciphertextbytes(), in bytes.
-spec crypto_kem_xwing_dec(Ct, Sk) -> Result
when Ct :: <<_:8960>>, Sk :: <<_:256>>, Result :: <<_:256>> | -1.
Decapsulate the ciphertext CT with the secret key SK and return the
shared secret SS.
-spec crypto_kem_xwing_enc(Pk) -> Result when Pk :: <<_:9728>>, Result :: {<<_:8960>>, <<_:256>>} | -1.
Encapsulate a fresh random shared secret to the public key PK.
Returns {CT, SS}, or -1 when PK is invalid.
-spec crypto_kem_xwing_enc_deterministic(Pk, Seed) -> Result
when
Pk :: <<_:9728>>,
Seed :: <<_:512>>,
Result :: {<<_:8960>>, <<_:256>>} | -1.
Encapsulate to the public key PK using the 64-byte Seed (the
ML-KEM-768 encapsulation seed followed by the ephemeral X25519 secret
key) instead of fresh randomness. Seed must be secret, uniformly
random, and never reused. Returns {CT, SS}, or -1 when PK is
invalid.
-spec crypto_kem_xwing_keypair() -> Result when Result :: {<<_:9728>>, <<_:256>>} | -1.
Generate a random key pair. Returns {PK, SK}.
-spec crypto_kem_xwing_publickeybytes() -> Result when Result :: 1216.
Return crypto_kem_xwing_publickeybytes(), in bytes.
-spec crypto_kem_xwing_secretkeybytes() -> Result when Result :: 32.
Return crypto_kem_xwing_secretkeybytes(), in bytes.
-spec crypto_kem_xwing_seed_keypair(Seed) -> Result
when Seed :: <<_:256>>, Result :: {<<_:9728>>, <<_:256>>} | -1.
Deterministically derive a key pair from the seedbytes/0 byte Seed,
which must be secret and uniformly random. Returns {PK, SK}.
-spec crypto_kem_xwing_seedbytes() -> Result when Result :: 32.
Return crypto_kem_xwing_seedbytes(), in bytes.
XChaCha20 stream cipher
-spec crypto_stream_xchacha20_crypto_stream_xchacha20(Clen, N, K) -> Result when Clen :: non_neg_integer(), N :: <<_:192>>, K :: <<_:256>>, Result :: binary().
Return CLen bytes of keystream for the noncebytes/0 byte nonce N and the keybytes/0 byte key
K.
-spec crypto_stream_xchacha20_keybytes() -> Result when Result :: 32.
Return crypto_stream_xchacha20_keybytes(), in bytes.
-spec crypto_stream_xchacha20_keygen() -> Result when Result :: <<_:256>>.
Generate a random keybytes/0 byte key.
-spec crypto_stream_xchacha20_messagebytes_max() -> Result when Result :: non_neg_integer().
Return crypto_stream_xchacha20_messagebytes_max(), in bytes.
-spec crypto_stream_xchacha20_noncebytes() -> Result when Result :: 24.
Return crypto_stream_xchacha20_noncebytes(), in bytes.
-spec crypto_stream_xchacha20_xor(M, N, K) -> Result when M :: binary(), N :: <<_:192>>, K :: <<_:256>>, Result :: binary().
Encrypt or decrypt M by combining it with the keystream for the nonce
N and key K, starting at block counter 0.
-spec crypto_stream_xchacha20_xor_ic(M, N, Ic, K) -> Result when M :: binary(), N :: <<_:192>>, Ic :: non_neg_integer(), K :: <<_:256>>, Result :: binary().
Like 'xor'/3, but start at the 64-byte block counter IC, so the
message is combined with the keystream from byte IC * 64 onwards.
XChaCha20-Poly1305
-spec crypto_aead_xchacha20poly1305_ietf_abytes() -> Result when Result :: 16.
Return crypto_aead_xchacha20poly1305_ietf_abytes(), in bytes.
-spec crypto_aead_xchacha20poly1305_ietf_decrypt(Nsec, C, Ad, Npub, K) -> Result when Nsec :: <<>>, C :: binary(), Ad :: binary(), Npub :: <<_:192>>, K :: <<_:256>>, Result :: binary() | -1.
Verify and decrypt the ciphertext C with the additional data AD
(default empty), nonce NPub, and key K.
-spec crypto_aead_xchacha20poly1305_ietf_decrypt_detached(Nsec, C, Mac, Ad, Npub, K) -> Result when Nsec :: <<>>, C :: binary(), Mac :: <<_:128>>, Ad :: binary(), Npub :: <<_:192>>, K :: <<_:256>>, Result :: binary() | -1.
Verify the detached tag MAC and decrypt C with the additional data
AD (default empty). Returns the plaintext, or -1 when
verification fails.
-spec crypto_aead_xchacha20poly1305_ietf_encrypt(M, Ad, Nsec, Npub, K) -> Result when M :: binary(), Ad :: binary(), Nsec :: <<>>, Npub :: <<_:192>>, K :: <<_:256>>, Result :: binary() | -1.
Encrypt and authenticate M together with the additional data AD
(default empty) using the ietf_npubbytes/0 byte nonce NPub and
the ietf_keybytes/0 byte key K.
-spec crypto_aead_xchacha20poly1305_ietf_encrypt_detached(M, Ad, Nsec, Npub, K) -> Result when M :: binary(), Ad :: binary(), Nsec :: <<>>, Npub :: <<_:192>>, K :: <<_:256>>, Result :: {binary(), <<_:128>>} | -1.
Encrypt and authenticate M with the additional data AD (default
empty), returning the ciphertext and the ietf_abytes/0 byte
authentication tag separately as {C, MAC}, or -1 on failure.
-spec crypto_aead_xchacha20poly1305_ietf_keybytes() -> Result when Result :: 32.
Return crypto_aead_xchacha20poly1305_ietf_keybytes(), in bytes.
-spec crypto_aead_xchacha20poly1305_ietf_keygen() -> Result when Result :: <<_:256>>.
Generate a random ietf_keybytes/0 byte key.
-spec crypto_aead_xchacha20poly1305_ietf_messagebytes_max() -> Result when Result :: non_neg_integer().
Return crypto_aead_xchacha20poly1305_ietf_messagebytes_max(), in bytes.
-spec crypto_aead_xchacha20poly1305_ietf_npubbytes() -> Result when Result :: 24.
Return crypto_aead_xchacha20poly1305_ietf_npubbytes(), in bytes.
-spec crypto_aead_xchacha20poly1305_ietf_nsecbytes() -> Result when Result :: 0.
Return crypto_aead_xchacha20poly1305_ietf_nsecbytes(), in bytes.
XChaCha20-Poly1305 secret box
-spec crypto_secretbox_xchacha20poly1305_detached(M, N, K) -> Result when M :: binary(), N :: <<_:192>>, K :: <<_:256>>, Result :: {binary(), <<_:128>>} | -1.
Encrypt and authenticate M with the nonce N and key K, returning
the ciphertext and the macbytes/0 byte authentication tag
separately as {C, MAC}, or -1 on failure.
-spec crypto_secretbox_xchacha20poly1305_easy(M, N, K) -> Result when M :: binary(), N :: <<_:192>>, K :: <<_:256>>, Result :: binary() | -1.
Encrypt and authenticate M with the noncebytes/0 byte nonce N
and the keybytes/0 byte key K.
-spec crypto_secretbox_xchacha20poly1305_keybytes() -> Result when Result :: 32.
Return crypto_secretbox_xchacha20poly1305_keybytes(), in bytes.
-spec crypto_secretbox_xchacha20poly1305_macbytes() -> Result when Result :: 16.
Return crypto_secretbox_xchacha20poly1305_macbytes(), in bytes.
-spec crypto_secretbox_xchacha20poly1305_messagebytes_max() -> Result when Result :: non_neg_integer().
Return crypto_secretbox_xchacha20poly1305_messagebytes_max(), in bytes.
-spec crypto_secretbox_xchacha20poly1305_noncebytes() -> Result when Result :: 24.
Return crypto_secretbox_xchacha20poly1305_noncebytes(), in bytes.
-spec crypto_secretbox_xchacha20poly1305_open_detached(C, Mac, N, K) -> Result when C :: binary(), Mac :: <<_:128>>, N :: <<_:192>>, K :: <<_:256>>, Result :: binary() | -1.
Verify the detached tag MAC and decrypt C with the nonce N and
key K. Returns the plaintext, or -1 when verification fails.
-spec crypto_secretbox_xchacha20poly1305_open_easy(C, N, K) -> Result when C :: binary(), N :: <<_:192>>, K :: <<_:256>>, Result :: binary() | -1.
Verify and decrypt the ciphertext C produced by easy/3 with the
nonce N and key K. Returns the plaintext, or -1 when
verification fails or C is shorter than macbytes/0.
XSalsa20 stream cipher
-spec crypto_stream_xsalsa20_crypto_stream_xsalsa20(Clen, N, K) -> Result when Clen :: non_neg_integer(), N :: <<_:192>>, K :: <<_:256>>, Result :: binary().
Return CLen bytes of keystream for the noncebytes/0 byte nonce N and the keybytes/0 byte key
K.
-spec crypto_stream_xsalsa20_keybytes() -> Result when Result :: 32.
Return crypto_stream_xsalsa20_keybytes(), in bytes.
-spec crypto_stream_xsalsa20_keygen() -> Result when Result :: <<_:256>>.
Generate a random keybytes/0 byte key.
-spec crypto_stream_xsalsa20_messagebytes_max() -> Result when Result :: non_neg_integer().
Return crypto_stream_xsalsa20_messagebytes_max(), in bytes.
-spec crypto_stream_xsalsa20_noncebytes() -> Result when Result :: 24.
Return crypto_stream_xsalsa20_noncebytes(), in bytes.
-spec crypto_stream_xsalsa20_xor(M, N, K) -> Result when M :: binary(), N :: <<_:192>>, K :: <<_:256>>, Result :: binary().
Encrypt or decrypt M by combining it with the keystream for the nonce
N and key K, starting at block counter 0.
-spec crypto_stream_xsalsa20_xor_ic(M, N, Ic, K) -> Result when M :: binary(), N :: <<_:192>>, Ic :: non_neg_integer(), K :: <<_:256>>, Result :: binary().
Like 'xor'/3, but start at the 64-byte block counter IC, so the
message is combined with the keystream from byte IC * 64 onwards.
XSalsa20-Poly1305 secret box
-spec crypto_secretbox_xsalsa20poly1305_boxzerobytes() -> Result when Result :: 16.
Return crypto_secretbox_xsalsa20poly1305_boxzerobytes(), in bytes.
-spec crypto_secretbox_xsalsa20poly1305_crypto_secretbox_xsalsa20poly1305(M, N, K) -> Result when M :: binary(), N :: <<_:192>>, K :: <<_:256>>, Result :: binary() | -1.
Encrypt M, which must start with zerobytes/0 zero bytes, with the
noncebytes/0 byte nonce N and the keybytes/0 byte key K.
-spec crypto_secretbox_xsalsa20poly1305_keybytes() -> Result when Result :: 32.
Return crypto_secretbox_xsalsa20poly1305_keybytes(), in bytes.
-spec crypto_secretbox_xsalsa20poly1305_keygen() -> Result when Result :: <<_:256>>.
Generate a random keybytes/0 byte key.
-spec crypto_secretbox_xsalsa20poly1305_macbytes() -> Result when Result :: 16.
Return crypto_secretbox_xsalsa20poly1305_macbytes(), in bytes.
-spec crypto_secretbox_xsalsa20poly1305_messagebytes_max() -> Result when Result :: non_neg_integer().
Return crypto_secretbox_xsalsa20poly1305_messagebytes_max(), in bytes.
-spec crypto_secretbox_xsalsa20poly1305_noncebytes() -> Result when Result :: 24.
Return crypto_secretbox_xsalsa20poly1305_noncebytes(), in bytes.
-spec crypto_secretbox_xsalsa20poly1305_open(C, N, K) -> Result when C :: binary(), N :: <<_:192>>, K :: <<_:256>>, Result :: binary() | -1.
Verify and decrypt C, which must start with boxzerobytes/0 zero
bytes, with the nonce N and key K.
-spec crypto_secretbox_xsalsa20poly1305_zerobytes() -> Result when Result :: 32.
Return crypto_secretbox_xsalsa20poly1305_zerobytes(), in bytes.