fixes #4477 (libsodium: update to 1.0.20)

11 files changed, 464 insertions, 270 deletions

diff --git a/libs/libsodium/src/include/sodium/private/asm_cet.h b/libs/libsodium/src/include/sodium/private/asm_cet.h
new file mode 100644
index 0000000000..4428c97f32
--- /dev/null
+++ b/libs/libsodium/src/include/sodium/private/asm_cet.h
@@ -0,0 +1,11 @@
+#ifndef asm_cet_H
+#define asm_cet_H 1
+
+#if HAVE_CET_H
+# include <cet.h>
+#endif
+#ifndef _CET_ENDBR
+# define _CET_ENDBR
+#endif
+
+#endif
diff --git a/libs/libsodium/src/include/sodium/private/chacha20_ietf_ext.h b/libs/libsodium/src/include/sodium/private/chacha20_ietf_ext.h
index d03cfd3329..d863013650 100644
--- a/libs/libsodium/src/include/sodium/private/chacha20_ietf_ext.h
+++ b/libs/libsodium/src/include/sodium/private/chacha20_ietf_ext.h
@@ -3,6 +3,8 @@
 

 #include <stdint.h>

 

+#include "private/quirks.h"

+

 /* The ietf_ext variant allows the internal counter to overflow into the IV */

 

 int crypto_stream_chacha20_ietf_ext(unsigned char *c, unsigned long long clen,

diff --git a/libs/libsodium/src/include/sodium/private/common.h b/libs/libsodium/src/include/sodium/private/common.h
index aaf6030248..0ed3c63456 100644
--- a/libs/libsodium/src/include/sodium/private/common.h
+++ b/libs/libsodium/src/include/sodium/private/common.h
@@ -1,7 +1,7 @@
 #ifndef common_H

 #define common_H 1

 

-#if !defined(_MSC_VER) && 0

+#if !defined(_MSC_VER) && !defined(DEV_MODE) && 1

 # warning *** This is unstable, untested, development code.

 # warning It might not compile. It might not work as expected.

 # warning It might be totally insecure.

@@ -20,6 +20,8 @@
 #include <stdlib.h>

 #include <string.h>

 

+#include "private/quirks.h"

+

 #define COMPILER_ASSERT(X) (void) sizeof(char[(X) ? 1 : -1])

 

 #ifdef HAVE_TI_MODE

@@ -226,24 +228,40 @@ xor_buf(unsigned char *out, const unsigned char *in, size_t n)
 # endif

 #endif

 

-#if defined(_MSC_VER) && \

-    (defined(_M_X64) || defined(_M_AMD64) || defined(_M_IX86))

+#ifdef _MSC_VER

 

-# include <intrin.h>

+# if defined(_M_X64) || defined(_M_IX86)

+#  include <intrin.h>

+

+#  define HAVE_INTRIN_H    1

+#  define HAVE_MMINTRIN_H  1

+#  define HAVE_EMMINTRIN_H 1

+#  define HAVE_PMMINTRIN_H 1

+#  define HAVE_TMMINTRIN_H 1

+#  define HAVE_SMMINTRIN_H 1

+#  define HAVE_AVXINTRIN_H 1

+#  if _MSC_VER >= 1600

+#   define HAVE_WMMINTRIN_H 1

+#  endif

+#  if _MSC_VER >= 1700 && defined(_M_X64)

+#   define HAVE_AVX2INTRIN_H 1

+#  endif

+#  if _MSC_VER >= 1910 && defined(_M_X64)

+#   define HAVE_AVX512FINTRIN_H 1

+#  endif

+

+# elif defined(_M_ARM64)

+

+#  ifndef __ARM_ARCH

+#   define __ARM_ARCH 1

+#  endif

+#  ifndef __ARM_NEON

+#   define __ARM_NEON 1

+#  endif

+#  define HAVE_ARMCRYPTO 1

+

+# endif /* _MSC_VER */

 

-# define HAVE_INTRIN_H    1

-# define HAVE_MMINTRIN_H  1

-# define HAVE_EMMINTRIN_H 1

-# define HAVE_PMMINTRIN_H 1

-# define HAVE_TMMINTRIN_H 1

-# define HAVE_SMMINTRIN_H 1

-# define HAVE_AVXINTRIN_H 1

-# if _MSC_VER >= 1600

-#  define HAVE_WMMINTRIN_H 1

-# endif

-# if _MSC_VER >= 1700 && defined(_M_X64)

-#  define HAVE_AVX2INTRIN_H 1

-# endif

 #elif defined(HAVE_INTRIN_H)

 # include <intrin.h>

 #endif

@@ -258,4 +276,12 @@ extern void ct_unpoison(const void *, size_t);
 # define UNPOISON(X, L) (void) 0

 #endif

 

+#ifdef HAVE_GCC_MEMORY_FENCES

+# define ACQUIRE_FENCE __atomic_thread_fence(__ATOMIC_ACQUIRE)

+#elif defined(HAVE_C11_MEMORY_FENCES)

+# define ACQUIRE_FENCE atomic_thread_fence(memory_order_acquire)

+#else

+# define ACQUIRE_FENCE (void) 0

+#endif

+

 #endif

diff --git a/libs/libsodium/src/include/sodium/private/ed25519_ref10.h b/libs/libsodium/src/include/sodium/private/ed25519_ref10.h
index cbf258e0c1..9477df3ca4 100644
--- a/libs/libsodium/src/include/sodium/private/ed25519_ref10.h
+++ b/libs/libsodium/src/include/sodium/private/ed25519_ref10.h
@@ -4,6 +4,8 @@
 #include <stddef.h>

 #include <stdint.h>

 

+#include "private/quirks.h"

+

 /*

  fe means field element.

  Here the field is \Z/(2^255-19).

@@ -25,7 +27,6 @@ void fe25519_tobytes(unsigned char *s, const fe25519 h);
 # include "ed25519_ref10_fe_25_5.h"

 #endif

 

-

 /*

  ge means group element.

 

@@ -81,35 +82,58 @@ int ge25519_frombytes(ge25519_p3 *h, const unsigned char *s);
 

 int ge25519_frombytes_negate_vartime(ge25519_p3 *h, const unsigned char *s);

 

-void ge25519_p3_to_cached(ge25519_cached *r, const ge25519_p3 *p);

-

 void ge25519_p1p1_to_p2(ge25519_p2 *r, const ge25519_p1p1 *p);

 

 void ge25519_p1p1_to_p3(ge25519_p3 *r, const ge25519_p1p1 *p);

 

-void ge25519_add(ge25519_p1p1 *r, const ge25519_p3 *p, const ge25519_cached *q);

+void ge25519_p2_to_p3(ge25519_p3 *r, const ge25519_p2 *p);

 

-void ge25519_sub(ge25519_p1p1 *r, const ge25519_p3 *p, const ge25519_cached *q);

+void ge25519_p3_add(ge25519_p3 *r, const ge25519_p3 *p, const ge25519_p3 *q);

+

+void ge25519_p3_sub(ge25519_p3 *r, const ge25519_p3 *p, const ge25519_p3 *q);

 

 void ge25519_scalarmult_base(ge25519_p3 *h, const unsigned char *a);

 

 void ge25519_double_scalarmult_vartime(ge25519_p2 *r, const unsigned char *a,

                                        const ge25519_p3 *A,

-                                       const unsigned char *b);

+                                       const unsigned char *b,

+                                       const ge25519_p3 *B);

 

 void ge25519_scalarmult(ge25519_p3 *h, const unsigned char *a,

                         const ge25519_p3 *p);

 

+void ge25519_clear_cofactor(ge25519_p3 *p3);

+

 int ge25519_is_canonical(const unsigned char *s);

 

 int ge25519_is_on_curve(const ge25519_p3 *p);

 

 int ge25519_is_on_main_subgroup(const ge25519_p3 *p);

 

-int ge25519_has_small_order(const unsigned char s[32]);

+int ge25519_has_small_order(const ge25519_p3 *p);

 

 void ge25519_from_uniform(unsigned char s[32], const unsigned char r[32]);

 

+void ge25519_from_hash(unsigned char s[32], const unsigned char h[64]);

+

+int ge25519_from_string(unsigned char p[32],

+                    const char *ctx, const unsigned char *msg,

+                    size_t msg_len, int hash_alg);

+

+int ge25519_from_string_ro(unsigned char p[32],

+                       const char *ctx, const unsigned char *msg,

+                       size_t msg_len, int hash_alg);

+

+/*

+ Ristretto group

+ */

+

+int ristretto255_frombytes(ge25519_p3 *h, const unsigned char *s);

+

+void ristretto255_p3_tobytes(unsigned char *s, const ge25519_p3 *h);

+

+void ristretto255_from_hash(unsigned char s[32], const unsigned char h[64]);

+

 /*

  The set of scalars is \Z/l

  where l = 2^252 + 27742317777372353535851937790883648493.

@@ -117,11 +141,18 @@ void ge25519_from_uniform(unsigned char s[32], const unsigned char r[32]);
 

 void sc25519_invert(unsigned char recip[32], const unsigned char s[32]);

 

+void sc25519_negate(unsigned char neg[32], const unsigned char s[32]);

+

 void sc25519_reduce(unsigned char s[64]);

 

+void sc25519_mul(unsigned char s[32], const unsigned char a[32],

+                 const unsigned char b[32]);

+

 void sc25519_muladd(unsigned char s[32], const unsigned char a[32],

                     const unsigned char b[32], const unsigned char c[32]);

 

 int sc25519_is_canonical(const unsigned char s[32]);

 

+void ge25519_clear_cofactor(ge25519_p3 *p3);

+

 #endif

diff --git a/libs/libsodium/src/include/sodium/private/ed25519_ref10_fe_25_5.h b/libs/libsodium/src/include/sodium/private/ed25519_ref10_fe_25_5.h
index ffb689e4a4..4e933dba06 100644
--- a/libs/libsodium/src/include/sodium/private/ed25519_ref10_fe_25_5.h
+++ b/libs/libsodium/src/include/sodium/private/ed25519_ref10_fe_25_5.h
@@ -1,6 +1,7 @@
 #include <string.h>

 

 #include "private/common.h"

+#include "private/quirks.h"

 #include "utils.h"

 

 /*

@@ -147,29 +148,35 @@ fe25519_neg(fe25519 h, const fe25519 f)
 static void

 fe25519_cmov(fe25519 f, const fe25519 g, unsigned int b)

 {

-    const uint32_t mask = (uint32_t) (-(int32_t) b);

-

-    int32_t f0 = f[0];

-    int32_t f1 = f[1];

-    int32_t f2 = f[2];

-    int32_t f3 = f[3];

-    int32_t f4 = f[4];

-    int32_t f5 = f[5];

-    int32_t f6 = f[6];

-    int32_t f7 = f[7];

-    int32_t f8 = f[8];

-    int32_t f9 = f[9];

-

-    int32_t x0 = f0 ^ g[0];

-    int32_t x1 = f1 ^ g[1];

-    int32_t x2 = f2 ^ g[2];

-    int32_t x3 = f3 ^ g[3];

-    int32_t x4 = f4 ^ g[4];

-    int32_t x5 = f5 ^ g[5];

-    int32_t x6 = f6 ^ g[6];

-    int32_t x7 = f7 ^ g[7];

-    int32_t x8 = f8 ^ g[8];

-    int32_t x9 = f9 ^ g[9];

+    uint32_t mask = (uint32_t) (-(int32_t) b);

+    int32_t  f0, f1, f2, f3, f4, f5, f6, f7, f8, f9;

+    int32_t  x0, x1, x2, x3, x4, x5, x6, x7, x8, x9;

+

+    f0 = f[0];

+    f1 = f[1];

+    f2 = f[2];

+    f3 = f[3];

+    f4 = f[4];

+    f5 = f[5];

+    f6 = f[6];

+    f7 = f[7];

+    f8 = f[8];

+    f9 = f[9];

+

+    x0 = f0 ^ g[0];

+    x1 = f1 ^ g[1];

+    x2 = f2 ^ g[2];

+    x3 = f3 ^ g[3];

+    x4 = f4 ^ g[4];

+    x5 = f5 ^ g[5];

+    x6 = f6 ^ g[6];

+    x7 = f7 ^ g[7];

+    x8 = f8 ^ g[8];

+    x9 = f9 ^ g[9];

+

+#ifdef HAVE_INLINE_ASM

+    __asm__ __volatile__("" : "+r"(mask));

+#endif

 

     x0 &= mask;

     x1 &= mask;

@@ -197,40 +204,47 @@ fe25519_cmov(fe25519 f, const fe25519 g, unsigned int b)
 static void

 fe25519_cswap(fe25519 f, fe25519 g, unsigned int b)

 {

-    const uint32_t mask = (uint32_t) (-(int64_t) b);

-

-    int32_t f0 = f[0];

-    int32_t f1 = f[1];

-    int32_t f2 = f[2];

-    int32_t f3 = f[3];

-    int32_t f4 = f[4];

-    int32_t f5 = f[5];

-    int32_t f6 = f[6];

-    int32_t f7 = f[7];

-    int32_t f8 = f[8];

-    int32_t f9 = f[9];

-

-    int32_t g0 = g[0];

-    int32_t g1 = g[1];

-    int32_t g2 = g[2];

-    int32_t g3 = g[3];

-    int32_t g4 = g[4];

-    int32_t g5 = g[5];

-    int32_t g6 = g[6];

-    int32_t g7 = g[7];

-    int32_t g8 = g[8];

-    int32_t g9 = g[9];

-

-    int32_t x0 = f0 ^ g0;

-    int32_t x1 = f1 ^ g1;

-    int32_t x2 = f2 ^ g2;

-    int32_t x3 = f3 ^ g3;

-    int32_t x4 = f4 ^ g4;

-    int32_t x5 = f5 ^ g5;

-    int32_t x6 = f6 ^ g6;

-    int32_t x7 = f7 ^ g7;

-    int32_t x8 = f8 ^ g8;

-    int32_t x9 = f9 ^ g9;

+    uint32_t mask = (uint32_t) (-(int64_t) b);

+    int32_t  f0, f1, f2, f3, f4, f5, f6, f7, f8, f9;

+    int32_t  g0, g1, g2, g3, g4, g5, g6, g7, g8, g9;

+    int32_t  x0, x1, x2, x3, x4, x5, x6, x7, x8, x9;

+

+    f0 = f[0];

+    f1 = f[1];

+    f2 = f[2];

+    f3 = f[3];

+    f4 = f[4];

+    f5 = f[5];

+    f6 = f[6];

+    f7 = f[7];

+    f8 = f[8];

+    f9 = f[9];

+

+    g0 = g[0];

+    g1 = g[1];

+    g2 = g[2];

+    g3 = g[3];

+    g4 = g[4];

+    g5 = g[5];

+    g6 = g[6];

+    g7 = g[7];

+    g8 = g[8];

+    g9 = g[9];

+

+    x0 = f0 ^ g0;

+    x1 = f1 ^ g1;

+    x2 = f2 ^ g2;

+    x3 = f3 ^ g3;

+    x4 = f4 ^ g4;

+    x5 = f5 ^ g5;

+    x6 = f6 ^ g6;

+    x7 = f7 ^ g7;

+    x8 = f8 ^ g8;

+    x9 = f9 ^ g9;

+

+#ifdef HAVE_INLINE_ASM

+    __asm__ __volatile__("" : "+r"(mask));

+#endif

 

     x0 &= mask;

     x1 &= mask;

@@ -273,27 +287,7 @@ fe25519_cswap(fe25519 f, fe25519 g, unsigned int b)
 static inline void

 fe25519_copy(fe25519 h, const fe25519 f)

 {

-    int32_t f0 = f[0];

-    int32_t f1 = f[1];

-    int32_t f2 = f[2];

-    int32_t f3 = f[3];

-    int32_t f4 = f[4];

-    int32_t f5 = f[5];

-    int32_t f6 = f[6];

-    int32_t f7 = f[7];

-    int32_t f8 = f[8];

-    int32_t f9 = f[9];

-

-    h[0] = f0;

-    h[1] = f1;

-    h[2] = f2;

-    h[3] = f3;

-    h[4] = f4;

-    h[5] = f5;

-    h[6] = f6;

-    h[7] = f7;

-    h[8] = f8;

-    h[9] = f9;

+    memcpy(h, f, 10 * sizeof h[0]);

 }

 

 /*

@@ -978,8 +972,8 @@ fe25519_sq2(fe25519 h, const fe25519 f)
     h[9] = (int32_t) h9;

 }

 

-static void

-fe25519_scalar_product(fe25519 h, const fe25519 f, uint32_t n)

+static inline void

+fe25519_mul32(fe25519 h, const fe25519 f, uint32_t n)

 {

     int64_t sn = (int64_t) n;

     int32_t f0 = f[0];

diff --git a/libs/libsodium/src/include/sodium/private/ed25519_ref10_fe_51.h b/libs/libsodium/src/include/sodium/private/ed25519_ref10_fe_51.h
index 28363083d9..ec6f3f3c40 100644
--- a/libs/libsodium/src/include/sodium/private/ed25519_ref10_fe_51.h
+++ b/libs/libsodium/src/include/sodium/private/ed25519_ref10_fe_51.h
@@ -1,6 +1,7 @@
 #include <string.h>

 

 #include "private/common.h"

+#include "private/quirks.h"

 #include "utils.h"

 

 /*

@@ -108,19 +109,50 @@ fe25519_neg(fe25519 h, const fe25519 f)
 static void

 fe25519_cmov(fe25519 f, const fe25519 g, unsigned int b)

 {

-    const uint64_t mask = (uint64_t) (-(int64_t) b);

+#ifdef HAVE_AMD64_ASM

+    uint64_t t0, t1, t2;

+

+    __asm__ __volatile__

+    (

+        "test      %[c],     %[c]\n"

+        "movq     (%[b]),    %[t0]\n"

+        "cmoveq   (%[a]),    %[t0]\n"

+        "movq    8(%[b]),    %[t1]\n"

+        "cmoveq  8(%[a]),    %[t1]\n"

+        "movq   16(%[b]),    %[t2]\n"

+        "cmoveq 16(%[a]),    %[t2]\n"

+        "movq      %[t0],   (%[a])\n"

+        "movq      %[t1],  8(%[a])\n"

+        "movq   24(%[b]),    %[t0]\n"

+        "cmoveq 24(%[a]),    %[t0]\n"

+        "movq   32(%[b]),    %[t1]\n"

+        "cmoveq 32(%[a]),    %[t1]\n"

+        "movq      %[t2], 16(%[a])\n"

+        "movq      %[t0], 24(%[a])\n"

+        "movq      %[t1], 32(%[a])\n"

+      : [ t0 ] "=&r"(t0), [ t1 ] "=&r"(t1), [ t2 ] "=&r"(t2)

+      : [ a ] "r"(f), [ b ] "r"(g), [ c ] "r"(b)

+      : "cc", "memory");

+#else

+    uint64_t mask = (uint64_t) (-(int64_t) b);

+    uint64_t f0, f1, f2, f3, f4;

+    uint64_t x0, x1, x2, x3, x4;

 

-    uint64_t f0 = f[0];

-    uint64_t f1 = f[1];

-    uint64_t f2 = f[2];

-    uint64_t f3 = f[3];

-    uint64_t f4 = f[4];

+    f0 = f[0];

+    f1 = f[1];

+    f2 = f[2];

+    f3 = f[3];

+    f4 = f[4];

+

+    x0 = f0 ^ g[0];

+    x1 = f1 ^ g[1];

+    x2 = f2 ^ g[2];

+    x3 = f3 ^ g[3];

+    x4 = f4 ^ g[4];

 

-    uint64_t x0 = f0 ^ g[0];

-    uint64_t x1 = f1 ^ g[1];

-    uint64_t x2 = f2 ^ g[2];

-    uint64_t x3 = f3 ^ g[3];

-    uint64_t x4 = f4 ^ g[4];

+# ifdef HAVE_INLINE_ASM

+    __asm__ __volatile__("" : "+r"(mask));

+# endif

 

     x0 &= mask;

     x1 &= mask;

@@ -133,6 +165,7 @@ fe25519_cmov(fe25519 f, const fe25519 g, unsigned int b)
     f[2] = f2 ^ x2;

     f[3] = f3 ^ x3;

     f[4] = f4 ^ x4;

+#endif

 }

 

 /*

@@ -145,25 +178,32 @@ Preconditions: b in {0,1}.
 static void

 fe25519_cswap(fe25519 f, fe25519 g, unsigned int b)

 {

-    const uint64_t mask = (uint64_t) (-(int64_t) b);

-

-    uint64_t f0 = f[0];

-    uint64_t f1 = f[1];

-    uint64_t f2 = f[2];

-    uint64_t f3 = f[3];

-    uint64_t f4 = f[4];

-

-    uint64_t g0 = g[0];

-    uint64_t g1 = g[1];

-    uint64_t g2 = g[2];

-    uint64_t g3 = g[3];

-    uint64_t g4 = g[4];

-

-    uint64_t x0 = f0 ^ g0;

-    uint64_t x1 = f1 ^ g1;

-    uint64_t x2 = f2 ^ g2;

-    uint64_t x3 = f3 ^ g3;

-    uint64_t x4 = f4 ^ g4;

+    uint64_t mask = (uint64_t) (-(int64_t) b);

+    uint64_t f0, f1, f2, f3, f4;

+    uint64_t g0, g1, g2, g3, g4;

+    uint64_t x0, x1, x2, x3, x4;

+

+    f0 = f[0];

+    f1 = f[1];

+    f2 = f[2];

+    f3 = f[3];

+    f4 = f[4];

+

+    g0 = g[0];

+    g1 = g[1];

+    g2 = g[2];

+    g3 = g[3];

+    g4 = g[4];

+

+    x0 = f0 ^ g0;

+    x1 = f1 ^ g1;

+    x2 = f2 ^ g2;

+    x3 = f3 ^ g3;

+    x4 = f4 ^ g4;

+

+# ifdef HAVE_INLINE_ASM

+    __asm__ __volatile__("" : "+r"(mask));

+# endif

 

     x0 &= mask;

     x1 &= mask;

@@ -191,17 +231,7 @@ fe25519_cswap(fe25519 f, fe25519 g, unsigned int b)
 static inline void

 fe25519_copy(fe25519 h, const fe25519 f)

 {

-    uint64_t f0 = f[0];

-    uint64_t f1 = f[1];

-    uint64_t f2 = f[2];

-    uint64_t f3 = f[3];

-    uint64_t f4 = f[4];

-

-    h[0] = f0;

-    h[1] = f1;

-    h[2] = f2;

-    h[3] = f3;

-    h[4] = f4;

+    memcpy(h, f, 5 * sizeof h[0]);

 }

 

 /*

@@ -243,80 +273,57 @@ static void
 fe25519_mul(fe25519 h, const fe25519 f, const fe25519 g)

 {

     const uint64_t mask = 0x7ffffffffffffULL;

-    uint128_t r0, r1, r2, r3, r4, carry;

-    uint64_t  f0, f1, f2, f3, f4;

-    uint64_t  f1_19, f2_19, f3_19, f4_19;

-    uint64_t  g0, g1, g2, g3, g4;

+    uint128_t r0, r1, r2, r3, r4;

+    uint128_t f0, f1, f2, f3, f4;

+    uint128_t f1_19, f2_19, f3_19, f4_19;

+    uint128_t g0, g1, g2, g3, g4;

     uint64_t  r00, r01, r02, r03, r04;

+    uint64_t  carry;

 

-    f0 = f[0];

-    f1 = f[1];

-    f2 = f[2];

-    f3 = f[3];

-    f4 = f[4];

+    f0 = (uint128_t) f[0];

+    f1 = (uint128_t) f[1];

+    f2 = (uint128_t) f[2];

+    f3 = (uint128_t) f[3];

+    f4 = (uint128_t) f[4];

 

-    g0 = g[0];

-    g1 = g[1];

-    g2 = g[2];

-    g3 = g[3];

-    g4 = g[4];

+    g0 = (uint128_t) g[0];

+    g1 = (uint128_t) g[1];

+    g2 = (uint128_t) g[2];

+    g3 = (uint128_t) g[3];

+    g4 = (uint128_t) g[4];

 

     f1_19 = 19ULL * f1;

     f2_19 = 19ULL * f2;

     f3_19 = 19ULL * f3;

     f4_19 = 19ULL * f4;

 

-    r0  = ((uint128_t) f0   ) * ((uint128_t) g0);

-    r0 += ((uint128_t) f1_19) * ((uint128_t) g4);

-    r0 += ((uint128_t) f2_19) * ((uint128_t) g3);

-    r0 += ((uint128_t) f3_19) * ((uint128_t) g2);

-    r0 += ((uint128_t) f4_19) * ((uint128_t) g1);

-

-    r1  = ((uint128_t) f0   ) * ((uint128_t) g1);

-    r1 += ((uint128_t) f1   ) * ((uint128_t) g0);

-    r1 += ((uint128_t) f2_19) * ((uint128_t) g4);

-    r1 += ((uint128_t) f3_19) * ((uint128_t) g3);

-    r1 += ((uint128_t) f4_19) * ((uint128_t) g2);

-

-    r2  = ((uint128_t) f0   ) * ((uint128_t) g2);

-    r2 += ((uint128_t) f1   ) * ((uint128_t) g1);

-    r2 += ((uint128_t) f2   ) * ((uint128_t) g0);

-    r2 += ((uint128_t) f3_19) * ((uint128_t) g4);

-    r2 += ((uint128_t) f4_19) * ((uint128_t) g3);

-

-    r3  = ((uint128_t) f0   ) * ((uint128_t) g3);

-    r3 += ((uint128_t) f1   ) * ((uint128_t) g2);

-    r3 += ((uint128_t) f2   ) * ((uint128_t) g1);

-    r3 += ((uint128_t) f3   ) * ((uint128_t) g0);

-    r3 += ((uint128_t) f4_19) * ((uint128_t) g4);

-

-    r4  = ((uint128_t) f0   ) * ((uint128_t) g4);

-    r4 += ((uint128_t) f1   ) * ((uint128_t) g3);

-    r4 += ((uint128_t) f2   ) * ((uint128_t) g2);

-    r4 += ((uint128_t) f3   ) * ((uint128_t) g1);

-    r4 += ((uint128_t) f4   ) * ((uint128_t) g0);

+    r0 = f0 * g0 + f1_19 * g4 + f2_19 * g3 + f3_19 * g2 + f4_19 * g1;

+    r1 = f0 * g1 +    f1 * g0 + f2_19 * g4 + f3_19 * g3 + f4_19 * g2;

+    r2 = f0 * g2 +    f1 * g1 +    f2 * g0 + f3_19 * g4 + f4_19 * g3;

+    r3 = f0 * g3 +    f1 * g2 +    f2 * g1 +    f3 * g0 + f4_19 * g4;

+    r4 = f0 * g4 +    f1 * g3 +    f2 * g2 +    f3 * g1 +    f4 * g0;

 

     r00    = ((uint64_t) r0) & mask;

-    carry  = r0 >> 51;

+    carry  = (uint64_t) (r0 >> 51);

     r1    += carry;

     r01    = ((uint64_t) r1) & mask;

-    carry  = r1 >> 51;

+    carry  = (uint64_t) (r1 >> 51);

     r2    += carry;

     r02    = ((uint64_t) r2) & mask;

-    carry  = r2 >> 51;

+    carry  = (uint64_t) (r2 >> 51);

     r3    += carry;

     r03    = ((uint64_t) r3) & mask;

-    carry  = r3 >> 51;

+    carry  = (uint64_t) (r3 >> 51);

     r4    += carry;

     r04    = ((uint64_t) r4) & mask;

-    carry  = r4 >> 51;

-    r00   += 19ULL * (uint64_t) carry;

+    carry  = (uint64_t) (r4 >> 51);

+    r00   += 19ULL * carry;

     carry  = r00 >> 51;

     r00   &= mask;

-    r01   += (uint64_t) carry;

+    r01   += carry;

     carry  = r01 >> 51;

     r01   &= mask;

-    r02   += (uint64_t) carry;

+    r02   += carry;

 

     h[0] = r00;

     h[1] = r01;

@@ -334,16 +341,17 @@ static void
 fe25519_sq(fe25519 h, const fe25519 f)

 {

     const uint64_t mask = 0x7ffffffffffffULL;

-    uint128_t r0, r1, r2, r3, r4, carry;

-    uint64_t  f0, f1, f2, f3, f4;

-    uint64_t  f0_2, f1_2, f1_38, f2_38, f3_38, f3_19, f4_19;

+    uint128_t r0, r1, r2, r3, r4;

+    uint128_t f0, f1, f2, f3, f4;

+    uint128_t f0_2, f1_2, f1_38, f2_38, f3_38, f3_19, f4_19;

     uint64_t  r00, r01, r02, r03, r04;

+    uint64_t  carry;

 

-    f0 = f[0];

-    f1 = f[1];

-    f2 = f[2];

-    f3 = f[3];

-    f4 = f[4];

+    f0 = (uint128_t) f[0];

+    f1 = (uint128_t) f[1];

+    f2 = (uint128_t) f[2];

+    f3 = (uint128_t) f[3];

+    f4 = (uint128_t) f[4];

 

     f0_2 = f0 << 1;

     f1_2 = f1 << 1;

@@ -355,47 +363,33 @@ fe25519_sq(fe25519 h, const fe25519 f)
     f3_19 = 19ULL * f3;

     f4_19 = 19ULL * f4;

 

-    r0  = ((uint128_t) f0   ) * ((uint128_t) f0);

-    r0 += ((uint128_t) f1_38) * ((uint128_t) f4);

-    r0 += ((uint128_t) f2_38) * ((uint128_t) f3);

-

-    r1  = ((uint128_t) f0_2 ) * ((uint128_t) f1);

-    r1 += ((uint128_t) f2_38) * ((uint128_t) f4);

-    r1 += ((uint128_t) f3_19) * ((uint128_t) f3);

-

-    r2  = ((uint128_t) f0_2 ) * ((uint128_t) f2);

-    r2 += ((uint128_t) f1   ) * ((uint128_t) f1);

-    r2 += ((uint128_t) f3_38) * ((uint128_t) f4);

-

-    r3  = ((uint128_t) f0_2 ) * ((uint128_t) f3);

-    r3 += ((uint128_t) f1_2 ) * ((uint128_t) f2);

-    r3 += ((uint128_t) f4_19) * ((uint128_t) f4);

-

-    r4  = ((uint128_t) f0_2 ) * ((uint128_t) f4);

-    r4 += ((uint128_t) f1_2 ) * ((uint128_t) f3);

-    r4 += ((uint128_t) f2   ) * ((uint128_t) f2);

+    r0 =   f0 * f0 + f1_38 * f4 + f2_38 * f3;

+    r1 = f0_2 * f1 + f2_38 * f4 + f3_19 * f3;

+    r2 = f0_2 * f2 +    f1 * f1 + f3_38 * f4;

+    r3 = f0_2 * f3 +  f1_2 * f2 + f4_19 * f4;

+    r4 = f0_2 * f4 +  f1_2 * f3 +    f2 * f2;

 

     r00    = ((uint64_t) r0) & mask;

-    carry  = r0 >> 51;

+    carry  = (uint64_t) (r0 >> 51);

     r1    += carry;

     r01    = ((uint64_t) r1) & mask;

-    carry  = r1 >> 51;

+    carry  = (uint64_t) (r1 >> 51);

     r2    += carry;

     r02    = ((uint64_t) r2) & mask;

-    carry  = r2 >> 51;

+    carry  = (uint64_t) (r2 >> 51);

     r3    += carry;

     r03    = ((uint64_t) r3) & mask;

-    carry  = r3 >> 51;

+    carry  = (uint64_t) (r3 >> 51);

     r4    += carry;

     r04    = ((uint64_t) r4) & mask;

-    carry  = r4 >> 51;

-    r00   += 19ULL * (uint64_t) carry;

+    carry  = (uint64_t) (r4 >> 51);

+    r00   += 19ULL * carry;

     carry  = r00 >> 51;

     r00   &= mask;

-    r01   += (uint64_t) carry;

+    r01   += carry;

     carry  = r01 >> 51;

     r01   &= mask;

-    r02   += (uint64_t) carry;

+    r02   += carry;

 

     h[0] = r00;

     h[1] = r01;

@@ -413,16 +407,17 @@ static void
 fe25519_sq2(fe25519 h, const fe25519 f)

 {

     const uint64_t mask = 0x7ffffffffffffULL;

-    uint128_t r0, r1, r2, r3, r4, carry;

-    uint64_t  f0, f1, f2, f3, f4;

-    uint64_t  f0_2, f1_2, f1_38, f2_38, f3_38, f3_19, f4_19;

+    uint128_t r0, r1, r2, r3, r4;

+    uint128_t f0, f1, f2, f3, f4;

+    uint128_t f0_2, f1_2, f1_38, f2_38, f3_38, f3_19, f4_19;

     uint64_t  r00, r01, r02, r03, r04;

+    uint64_t  carry;

 

-    f0 = f[0];

-    f1 = f[1];

-    f2 = f[2];

-    f3 = f[3];

-    f4 = f[4];

+    f0 = (uint128_t) f[0];

+    f1 = (uint128_t) f[1];

+    f2 = (uint128_t) f[2];

+    f3 = (uint128_t) f[3];

+    f4 = (uint128_t) f[4];

 

     f0_2 = f0 << 1;

     f1_2 = f1 << 1;

@@ -434,25 +429,11 @@ fe25519_sq2(fe25519 h, const fe25519 f)
     f3_19 = 19ULL * f3;

     f4_19 = 19ULL * f4;

 

-    r0  = ((uint128_t) f0   ) * ((uint128_t) f0);

-    r0 += ((uint128_t) f1_38) * ((uint128_t) f4);

-    r0 += ((uint128_t) f2_38) * ((uint128_t) f3);

-

-    r1  = ((uint128_t) f0_2 ) * ((uint128_t) f1);

-    r1 += ((uint128_t) f2_38) * ((uint128_t) f4);

-    r1 += ((uint128_t) f3_19) * ((uint128_t) f3);

-

-    r2  = ((uint128_t) f0_2 ) * ((uint128_t) f2);

-    r2 += ((uint128_t) f1   ) * ((uint128_t) f1);

-    r2 += ((uint128_t) f3_38) * ((uint128_t) f4);

-

-    r3  = ((uint128_t) f0_2 ) * ((uint128_t) f3);

-    r3 += ((uint128_t) f1_2 ) * ((uint128_t) f2);

-    r3 += ((uint128_t) f4_19) * ((uint128_t) f4);

-

-    r4  = ((uint128_t) f0_2 ) * ((uint128_t) f4);

-    r4 += ((uint128_t) f1_2 ) * ((uint128_t) f3);

-    r4 += ((uint128_t) f2   ) * ((uint128_t) f2);

+    r0 =   f0 * f0 + f1_38 * f4 + f2_38 * f3;

+    r1 = f0_2 * f1 + f2_38 * f4 + f3_19 * f3;

+    r2 = f0_2 * f2 +    f1 * f1 + f3_38 * f4;

+    r3 = f0_2 * f3 +  f1_2 * f2 + f4_19 * f4;

+    r4 = f0_2 * f4 +  f1_2 * f3 +    f2 * f2;

 

     r0 <<= 1;

     r1 <<= 1;

@@ -461,26 +442,26 @@ fe25519_sq2(fe25519 h, const fe25519 f)
     r4 <<= 1;

 

     r00    = ((uint64_t) r0) & mask;

-    carry  = r0 >> 51;

+    carry  = (uint64_t) (r0 >> 51);

     r1    += carry;

     r01    = ((uint64_t) r1) & mask;

-    carry  = r1 >> 51;

+    carry  = (uint64_t) (r1 >> 51);

     r2    += carry;

     r02    = ((uint64_t) r2) & mask;

-    carry  = r2 >> 51;

+    carry  = (uint64_t) (r2 >> 51);

     r3    += carry;

     r03    = ((uint64_t) r3) & mask;

-    carry  = r3 >> 51;

+    carry  = (uint64_t) (r3 >> 51);

     r4    += carry;

     r04    = ((uint64_t) r4) & mask;

-    carry  = r4 >> 51;

-    r00   += 19ULL * (uint64_t) carry;

+    carry  = (uint64_t) (r4 >> 51);

+    r00   += 19ULL * carry;

     carry  = r00 >> 51;

     r00   &= mask;

-    r01   += (uint64_t) carry;

+    r01   += carry;

     carry  = r01 >> 51;

     r01   &= mask;

-    r02   += (uint64_t) carry;

+    r02   += carry;

 

     h[0] = r00;

     h[1] = r01;

@@ -489,8 +470,8 @@ fe25519_sq2(fe25519 h, const fe25519 f)
     h[4] = r04;

 }

 

-static void

-fe25519_scalar_product(fe25519 h, const fe25519 f, uint32_t n)

+static inline void

+fe25519_mul32(fe25519 h, const fe25519 f, uint32_t n)

 {

     const uint64_t mask = 0x7ffffffffffffULL;

     uint128_t a;

diff --git a/libs/libsodium/src/include/sodium/private/implementations.h b/libs/libsodium/src/include/sodium/private/implementations.h
index 926c3a61a6..b322dbadf3 100644
--- a/libs/libsodium/src/include/sodium/private/implementations.h
+++ b/libs/libsodium/src/include/sodium/private/implementations.h
@@ -1,11 +1,15 @@
 #ifndef implementations_H

 #define implementations_H

 

+#include "private/quirks.h"

+

 int _crypto_generichash_blake2b_pick_best_implementation(void);

 int _crypto_onetimeauth_poly1305_pick_best_implementation(void);

 int _crypto_pwhash_argon2_pick_best_implementation(void);

 int _crypto_scalarmult_curve25519_pick_best_implementation(void);

 int _crypto_stream_chacha20_pick_best_implementation(void);

 int _crypto_stream_salsa20_pick_best_implementation(void);

+int _crypto_aead_aegis128l_pick_best_implementation(void);

+int _crypto_aead_aegis256_pick_best_implementation(void);

 

 #endif

diff --git a/libs/libsodium/src/include/sodium/private/mutex.h b/libs/libsodium/src/include/sodium/private/mutex.h
index 03433173eb..0e198c7aa0 100644
--- a/libs/libsodium/src/include/sodium/private/mutex.h
+++ b/libs/libsodium/src/include/sodium/private/mutex.h
@@ -1,6 +1,8 @@
 #ifndef mutex_H

 #define mutex_H 1

 

+#include "private/quirks.h"

+

 extern int sodium_crit_enter(void);

 extern int sodium_crit_leave(void);

 

diff --git a/libs/libsodium/src/include/sodium/private/quirks.h b/libs/libsodium/src/include/sodium/private/quirks.h
new file mode 100644
index 0000000000..ffd861ee43
--- /dev/null
+++ b/libs/libsodium/src/include/sodium/private/quirks.h
@@ -0,0 +1,87 @@
+/* This is an automatically generated file */
+
+#ifndef quirks_H
+#ifndef NO_QUIRKS
+
+#define argon2_ctx _sodium_argon2_ctx
+#define argon2_decode_string _sodium_argon2_decode_string
+#define argon2_encode_string _sodium_argon2_encode_string
+#define argon2_fill_memory_blocks _sodium_argon2_fill_memory_blocks
+#define argon2_fill_segment_avx2 _sodium_argon2_fill_segment_avx2
+#define argon2_fill_segment_avx512f _sodium_argon2_fill_segment_avx512f
+#define argon2_fill_segment_ref _sodium_argon2_fill_segment_ref
+#define argon2_fill_segment_ssse3 _sodium_argon2_fill_segment_ssse3
+#define argon2_finalize _sodium_argon2_finalize
+#define argon2_hash _sodium_argon2_hash
+#define argon2_initialize _sodium_argon2_initialize
+#define argon2_validate_inputs _sodium_argon2_validate_inputs
+#define argon2_verify _sodium_argon2_verify
+#define argon2i_hash_encoded _sodium_argon2i_hash_encoded
+#define argon2i_hash_raw _sodium_argon2i_hash_raw
+#define argon2i_verify _sodium_argon2i_verify
+#define argon2id_hash_encoded _sodium_argon2id_hash_encoded
+#define argon2id_hash_raw _sodium_argon2id_hash_raw
+#define argon2id_verify _sodium_argon2id_verify
+#define blake2b _sodium_blake2b
+#define blake2b_compress_avx2 _sodium_blake2b_compress_avx2
+#define blake2b_compress_ref _sodium_blake2b_compress_ref
+#define blake2b_compress_sse41 _sodium_blake2b_compress_sse41
+#define blake2b_compress_ssse3 _sodium_blake2b_compress_ssse3
+#define blake2b_final _sodium_blake2b_final
+#define blake2b_init _sodium_blake2b_init
+#define blake2b_init_key _sodium_blake2b_init_key
+#define blake2b_init_key_salt_personal _sodium_blake2b_init_key_salt_personal
+#define blake2b_init_param _sodium_blake2b_init_param
+#define blake2b_init_salt_personal _sodium_blake2b_init_salt_personal
+#define blake2b_long _sodium_blake2b_long
+#define blake2b_pick_best_implementation _sodium_blake2b_pick_best_implementation
+#define blake2b_salt_personal _sodium_blake2b_salt_personal
+#define blake2b_update _sodium_blake2b_update
+#define core_h2c_string_to_hash _sodium_core_h2c_string_to_hash
+#define escrypt_PBKDF2_SHA256 _sodium_escrypt_PBKDF2_SHA256
+#define escrypt_alloc_region _sodium_escrypt_alloc_region
+#define escrypt_free_local _sodium_escrypt_free_local
+#define escrypt_free_region _sodium_escrypt_free_region
+#define escrypt_gensalt_r _sodium_escrypt_gensalt_r
+#define escrypt_init_local _sodium_escrypt_init_local
+#define escrypt_kdf_nosse _sodium_escrypt_kdf_nosse
+#define escrypt_kdf_sse _sodium_escrypt_kdf_sse
+#define escrypt_parse_setting _sodium_escrypt_parse_setting
+#define escrypt_r _sodium_escrypt_r
+#define fe25519_frombytes _sodium_fe25519_frombytes
+#define fe25519_invert _sodium_fe25519_invert
+#define fe25519_tobytes _sodium_fe25519_tobytes
+#define ge25519_clear_cofactor _sodium_ge25519_clear_cofactor
+#define ge25519_double_scalarmult_vartime _sodium_ge25519_double_scalarmult_vartime
+#define ge25519_from_hash _sodium_ge25519_from_hash
+#define ge25519_from_string _sodium_ge25519_from_string
+#define ge25519_from_string_ro _sodium_ge25519_from_string_ro
+#define ge25519_from_uniform _sodium_ge25519_from_uniform
+#define ge25519_frombytes _sodium_ge25519_frombytes
+#define ge25519_frombytes_negate_vartime _sodium_ge25519_frombytes_negate_vartime
+#define ge25519_has_small_order _sodium_ge25519_has_small_order
+#define ge25519_is_canonical _sodium_ge25519_is_canonical
+#define ge25519_is_on_curve _sodium_ge25519_is_on_curve
+#define ge25519_is_on_main_subgroup _sodium_ge25519_is_on_main_subgroup
+#define ge25519_p1p1_to_p2 _sodium_ge25519_p1p1_to_p2
+#define ge25519_p1p1_to_p3 _sodium_ge25519_p1p1_to_p3
+#define ge25519_p2_to_p3 _sodium_ge25519_p2_to_p3
+#define ge25519_p3_add _sodium_ge25519_p3_add
+#define ge25519_p3_sub _sodium_ge25519_p3_sub
+#define ge25519_p3_tobytes _sodium_ge25519_p3_tobytes
+#define ge25519_scalarmult _sodium_ge25519_scalarmult
+#define ge25519_scalarmult_base _sodium_ge25519_scalarmult_base
+#define ge25519_tobytes _sodium_ge25519_tobytes
+#define ristretto255_from_hash _sodium_ristretto255_from_hash
+#define ristretto255_frombytes _sodium_ristretto255_frombytes
+#define ristretto255_p3_tobytes _sodium_ristretto255_p3_tobytes
+#define sc25519_invert _sodium_sc25519_invert
+#define sc25519_is_canonical _sodium_sc25519_is_canonical
+#define sc25519_mul _sodium_sc25519_mul
+#define sc25519_muladd _sodium_sc25519_muladd
+#define sc25519_negate _sodium_sc25519_negate
+#define sc25519_reduce _sodium_sc25519_reduce
+#define softaes_block_encrypt _sodium_softaes_block_encrypt
+
+#endif
+#endif
diff --git a/libs/libsodium/src/include/sodium/private/softaes.h b/libs/libsodium/src/include/sodium/private/softaes.h
new file mode 100644
index 0000000000..f7a2bd24e4
--- /dev/null
+++ b/libs/libsodium/src/include/sodium/private/softaes.h
@@ -0,0 +1,56 @@
+#ifndef softaes_H
+#define softaes_H 1
+
+#include <stdint.h>
+
+#include "private/common.h"
+
+typedef struct SoftAesBlock {
+    uint32_t w0;
+    uint32_t w1;
+    uint32_t w2;
+    uint32_t w3;
+} SoftAesBlock;
+
+SoftAesBlock softaes_block_encrypt(const SoftAesBlock block, const SoftAesBlock rk);
+
+static inline SoftAesBlock
+softaes_block_load(const uint8_t in[16])
+{
+    const SoftAesBlock out = { LOAD32_LE(in + 0), LOAD32_LE(in + 4), LOAD32_LE(in + 8),
+                               LOAD32_LE(in + 12) };
+    return out;
+}
+
+static inline SoftAesBlock
+softaes_block_load64x2(const uint64_t a, const uint64_t b)
+{
+    const SoftAesBlock out = { (uint32_t) b, (uint32_t) (b >> 32), (uint32_t) a,
+                               (uint32_t) (a >> 32) };
+    return out;
+}
+
+static inline void
+softaes_block_store(uint8_t out[16], const SoftAesBlock in)
+{
+    STORE32_LE(out + 0, in.w0);
+    STORE32_LE(out + 4, in.w1);
+    STORE32_LE(out + 8, in.w2);
+    STORE32_LE(out + 12, in.w3);
+}
+
+static inline SoftAesBlock
+softaes_block_xor(const SoftAesBlock a, const SoftAesBlock b)
+{
+    const SoftAesBlock out = { a.w0 ^ b.w0, a.w1 ^ b.w1, a.w2 ^ b.w2, a.w3 ^ b.w3 };
+    return out;
+}
+
+static inline SoftAesBlock
+softaes_block_and(const SoftAesBlock a, const SoftAesBlock b)
+{
+    const SoftAesBlock out = { a.w0 & b.w0, a.w1 & b.w1, a.w2 & b.w2, a.w3 & b.w3 };
+    return out;
+}
+
+#endif
diff --git a/libs/libsodium/src/include/sodium/private/sse2_64_32.h b/libs/libsodium/src/include/sodium/private/sse2_64_32.h
index 8c4889a05e..bea6713d1b 100644
--- a/libs/libsodium/src/include/sodium/private/sse2_64_32.h
+++ b/libs/libsodium/src/include/sodium/private/sse2_64_32.h
@@ -1,7 +1,7 @@
 #ifndef sse2_64_32_H

 #define sse2_64_32_H 1

 

-#include "common.h"

+#include "private/common.h"

 

 #ifdef HAVE_INTRIN_H

 # include <intrin.h>

@@ -9,7 +9,7 @@
 

 #if defined(HAVE_EMMINTRIN_H) && \

     !(defined(__amd64) || defined(__amd64__) || defined(__x86_64__) || \

-      defined(_M_X64) || defined(_M_AMD64))

+      defined(_M_X64))

 

 # include <emmintrin.h>

 # include <stdint.h>