Scrypt performance jumps as expected. For example, on a machine with 4 logical cores:
$ time OMP_NUM_THREADS=1 ./test.exe
Threads: 1
Key: DCF073537D25A10C9733...
real 0m17.959s
user 0m16.165s
sys 0m1.759s
$ time OMP_NUM_THREADS=4 ./test.exe
Threads: 4
Key: B37A0127DBE178ED604F...
real 0m4.488s
user 0m15.391s
sys 0m1.981s
Travis is having infrastructure problems since it migrated in November 2017. Our OS X and iOS tests hang for days. When the current job hangs, new jobs that enter the queue later hang too because the original job is still waiting.
The subsequent hangs effect Android and Linux, too. Our Travis scripts test Android, Linux, OS X and iOS. A hang effects everything.
We are going to disable Travis OS X and iOS tests until things improve.
Fix Environment setup for android to match the new unified headers.
Adjust the Makefile accordingly.
Updated the test scripts and travis to test these changes.
This check-in adds three additional functions for backwards compatibility: crypto_box_unchecked, crypto_box_open_unchecked and crypto_box_beforenm_unchecked. The functions can be used for interoperability with downlevel clients, like old versions of NaCl and libsodium. It should also help some cryptocurrencies, like Bitcoin, Ethereum, Monero and Zcash.
Also see https://eprint.iacr.org/2017/806.pdf (low order element attack) and https://github.com/jedisct1/libsodium/issues/662 (Zcash break).
TweetNaCl is a compact reimplementation of the NaCl library by Daniel J. Bernstein, Bernard van Gastel, Wesley Janssen, Tanja Lange, Peter Schwabe and Sjaak Smetsers. The library is less than 20 KB in size and provides 25 of the NaCl library functions.
The compact library uses curve25519, XSalsa20, Poly1305 and SHA-512 as default primitives, and includes both x25519 key exchange and ed25519 signatures. The complete list of functions can be found in TweetNaCl: A crypto library in 100 tweets (20140917), Table 1, page 5.
Crypto++ retained the function names and signatures but switched to data types provided by <stdint.h> to promote interoperability with Crypto++ and avoid size problems on platforms like Cygwin. For example, NaCl typdef'd u64 as an unsigned long long, but Cygwin, MinGW and MSYS are LP64 systems (not LLP64 systems). In addition, Crypto++ was missing NaCl's signed 64-bit integer i64.
Crypto++ enforces the 0-key restriction due to small points. The TweetNaCl library allowed the 0-keys to small points. Also see RFC 7748, Elliptic Curves for Security, Section 6.
TweetNaCl is well written but not well optimized. It runs 2x to 3x slower than optimized routines from libsodium. However, the library is still 2x to 4x faster than the algorithms NaCl was designed to replace.
The Crypto++ wrapper for TweetNaCl requires OS features. That is, NO_OS_DEPENDENCE cannot be defined. It is due to TweetNaCl's internal function randombytes. Crypto++ used DefaultAutoSeededRNG within randombytes, so OS integration must be enabled. You can use another generator like RDRAND to avoid the restriction.
This is initial testing support for N4713, "Working Draft, Standard for Programming Language C++". We know GCC uses -std=c++20 and -std=gnu++20, so we can start testing things
Jeffrey Walton
Felix Barz