https://badmickey.netlify.app/assets/crew/vendor/tweetnacl.js

11
12(function(nacl) {
13'use strict';
14
15// Ported in 2014 by Dmitry Chestnykh and Devi Mandiri.
16// Public domain.
17//
18// Implementation derived from TweetNaCl version 20140427.
19// See for details: http://tweetnacl.cr.yp.to/
20
21var gf = function(init) {
22  var i, r = new Float64Array(16);
23  if (init) for (i = 0; i < init.length; i++) r[i] = init[i];
24  return r;
25};
26
27//  Pluggable, initialized in high-level API below.
28var randombytes = function(/* x, n */) { throw new Error('no PRNG'); };
29
30var _0 = new Uint8Array(16);
31var _9 = new Uint8Array(32); _9[0] = 9;
32
33var gf0 = gf(),
34    gf1 = gf([1]),
35    _121665 = gf([0xdb41, 1]),
36    D = gf([0x78a3, 0x1359, 0x4dca, 0x75eb, 0xd8ab, 0x4141, 0x0a4d, 0x0070, 0xe898, 0x7779, 0x4079, 0x8cc7, 0xfe73, 0x2b6f, 0x6cee, 0x5203]),
37    D2 = gf([0xf159, 0x26b2, 0x9b94, 0xebd6, 0xb156, 0x8283, 0x149a, 0x00e0, 0xd130, 0xeef3, 0x80f2, 0x198e, 0xfce7, 0x56df, 0xd9dc, 0x2406]),
38    X = gf([0xd51a, 0x8f25, 0x2d60, 0xc956, 0xa7b2, 0x9525, 0xc760, 0x692c, 0xdc5c, 0xfdd6, 0xe231, 0xc0a4, 0x53fe, 0xcd6e, 0x36d3, 0x2169]),
39    Y = gf([0x6658, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666]),
40    I = gf([0xa0b0, 0x4a0e, 0x1b27, 0xc4ee, 0xe478, 0xad2f, 0x1806, 0x2f43, 0xd7a7, 0x3dfb, 0x0099, 0x2b4d, 0xdf0b, 0x4fc1, 0x2480, 0x2b83]);
41
42function ts64(x, i, h, l) {
43  x[i]   = (h >> 24) & 0xff;
44  x[i+1] = (h >> 16) & 0xff;
45  x[i+2] = (h >>  8) & 0xff;
46  x[i+3] = h & 0xff;
47  x[i+4] = (l >> 24)  & 0xff;
48  x[i+5] = (l >> 16)  & 0xff;
49  x[i+6] = (l >>  8)  & 0xff;
50  x[i+7] = l & 0xff;
51}
52
53function vn(x, xi, y, yi, n) {
54  var i,d = 0;
55  for (i = 0; i < n; i++) d |= x[xi+i]^y[yi+i];
56  return (1 & ((d - 1) >>> 8)) - 1;
57}
58
59function crypto_verify_16(x, xi, y, yi) {
60  return vn(x,xi,y,yi,16);
61}
62
63function crypto_verify_32(x, xi, y, yi) {
64  return vn(x,xi,y,yi,32);
65}
66
67function core_salsa20(o, p, k, c) {
68  var j0  = c[ 0] & 0xff | (c[ 1] & 0xff)<<8 | (c[ 2] & 0xff)<<16 | (c[ 3] & 0xff)<<24,
69      j1  = k[ 0] & 0xff | (k[ 1] & 0xff)<<8 | (k[ 2] & 0xff)<<16 | (k[ 3] & 0xff)<<24,
70      j2  = k[ 4] & 0xff | (k[ 5] & 0xff)<<8 | (k[ 6] & 0xff)<<16 | (k[ 7] & 0xff)<<24,
71      j3  = k[ 8] & 0xff | (k[ 9] & 0xff)<<8 | (k[10] & 0xff)<<16 | (k[11] & 0xff)<<24,
72      j4  = k[12] & 0xff | (k[13] & 0xff)<<8 | (k[14] & 0xff)<<16 | (k[15] & 0xff)<<24,
73      j5  = c[ 4] & 0xff | (c[ 5] & 0xff)<<8 | (c[ 6] & 0xff)<<16 | (c[ 7] & 0xff)<<24,
74      j6  = p[ 0] & 0xff | (p[ 1] & 0xff)<<8 | (p[ 2] & 0xff)<<16 | (p[ 3] & 0xff)<<24,
75      j7  = p[ 4] & 0xff | (p[ 5] & 0xff)<<8 | (p[ 6] & 0xff)<<16 | (p[ 7] & 0xff)<<24,
76      j8  = p[ 8] & 0xff | (p[ 9] & 0xff)<<8 | (p[10] & 0xff)<<16 | (p[11] & 0xff)<<24,
77      j9  = p[12] & 0xff | (p[13] & 0xff)<<8 | (p[14] & 0xff)<<16 | (p[15] & 0xff)<<24,
78      j10 = c[ 8] & 0xff | (c[ 9] & 0xff)<<8 | (c[10] & 0xff)<<16 | (c[11] & 0xff)<<24,
79      j11 = k[16] & 0xff | (k[17] & 0xff)<<8 | (k[18] & 0xff)<<16 | (k[19] & 0xff)<<24,
80      j12 = k[20] & 0xff | (k[21] & 0xff)<<8 | (k[22] & 0xff)<<16 | (k[23] & 0xff)<<24,
81      j13 = k[24] & 0xff | (k[25] & 0xff)<<8 | (k[26] & 0xff)<<16 | (k[27] & 0xff)<<24,
82      j14 = k[28] & 0xff | (k[29] & 0xff)<<8 | (k[30] & 0xff)<<16 | (k[31] & 0xff)<<24,
83      j15 = c[12] & 0xff | (c[13] & 0xff)<<8 | (c[14] & 0xff)<<16 | (c[15] & 0xff)<<24;
84
85  var x0 = j0, x1 = j1, x2 = j2, x3 = j3, x4 = j4, x5 = j5, x6 = j6, x7 = j7,
86      x8 = j8, x9 = j9, x10 = j10, x11 = j11, x12 = j12, x13 = j13, x14 = j14,
87      x15 = j15, u;
88
89  for (var i = 0; i < 20; i += 2) {
90    u = x0 + x12 | 0;
91    x4 ^= u<<7 | u>>>(32-7);
92    u = x4 + x0 | 0;
93    x8 ^= u<<9 | u>>>(32-9);
94    u = x8 + x4 | 0;
95    x12 ^= u<<13 | u>>>(32-13);
96    u = x12 + x8 | 0;
97    x0 ^= u<<18 | u>>>(32-18);
98
99    u = x5 + x1 | 0;
100    x9 ^= u<<7 | u>>>(32-7);
101    u = x9 + x5 | 0;
102    x13 ^= u<<9 | u>>>(32-9);
103    u = x13 + x9 | 0;
104    x1 ^= u<<13 | u>>>(32-13);
105    u = x1 + x13 | 0;
106    x5 ^= u<<18 | u>>>(32-18);
107
108    u = x10 + x6 | 0;
109    x14 ^= u<<7 | u>>>(32-7);
110    u = x14 + x10 | 0;
111    x2 ^= u<<9 | u>>>(32-9);
112    u = x2 + x14 | 0;
113    x6 ^= u<<13 | u>>>(32-13);
114    u = x6 + x2 | 0;
115    x10 ^= u<<18 | u>>>(32-18);
116
117    u = x15 + x11 | 0;
118    x3 ^= u<<7 | u>>>(32-7);
119    u = x3 + x15 | 0;
120    x7 ^= u<<9 | u>>>(32-9);
121    u = x7 + x3 | 0;
122    x11 ^= u<<13 | u>>>(32-13);
123    u = x11 + x7 | 0;
124    x15 ^= u<<18 | u>>>(32-18);
125
126    u = x0 + x3 | 0;
127    x1 ^= u<<7 | u>>>(32-7);
128    u = x1 + x0 | 0;
129    x2 ^= u<<9 | u>>>(32-9);
130    u = x2 + x1 | 0;
131    x3 ^= u<<13 | u>>>(32-13);
132    u = x3 + x2 | 0;
133    x0 ^= u<<18 | u>>>(32-18);
134
135    u = x5 + x4 | 0;
136    x6 ^= u<<7 | u>>>(32-7);
137    u = x6 + x5 | 0;
138    x7 ^= u<<9 | u>>>(32-9);
139    u = x7 + x6 | 0;
140    x4 ^= u<<13 | u>>>(32-13);
141    u = x4 + x7 | 0;
142    x5 ^= u<<18 | u>>>(32-18);
143
144    u = x10 + x9 | 0;
145    x11 ^= u<<7 | u>>>(32-7);
146    u = x11 + x10 | 0;
147    x8 ^= u<<9 | u>>>(32-9);
148    u = x8 + x11 | 0;
149    x9 ^= u<<13 | u>>>(32-13);
150    u = x9 + x8 | 0;
151    x10 ^= u<<18 | u>>>(32-18);
152
153    u = x15 + x14 | 0;
154    x12 ^= u<<7 | u>>>(32-7);
155    u = x12 + x15 | 0;
156    x13 ^= u<<9 | u>>>(32-9);
157    u = x13 + x12 | 0;
158    x14 ^= u<<13 | u>>>(32-13);
159    u = x14 + x13 | 0;
160    x15 ^= u<<18 | u>>>(32-18);
161  }
162   x0 =  x0 +  j0 | 0;
163   x1 =  x1 +  j1 | 0;
164   x2 =  x2 +  j2 | 0;
165   x3 =  x3 +  j3 | 0;
166   x4 =  x4 +  j4 | 0;
167   x5 =  x5 +  j5 | 0;
168   x6 =  x6 +  j6 | 0;
169   x7 =  x7 +  j7 | 0;
170   x8 =  x8 +  j8 | 0;
171   x9 =  x9 +  j9 | 0;
172  x10 = x10 + j10 | 0;
173  x11 = x11 + j11 | 0;
174  x12 = x12 + j12 | 0;
175  x13 = x13 + j13 | 0;
176  x14 = x14 + j14 | 0;
177  x15 = x15 + j15 | 0;
178
179  o[ 0] = x0 >>>  0 & 0xff;
180  o[ 1] = x0 >>>  8 & 0xff;
181  o[ 2] = x0 >>> 16 & 0xff;
182  o[ 3] = x0 >>> 24 & 0xff;
183
184  o[ 4] = x1 >>>  0 & 0xff;
185  o[ 5] = x1 >>>  8 & 0xff;
186  o[ 6] = x1 >>> 16 & 0xff;
187  o[ 7] = x1 >>> 24 & 0xff;
188
189  o[ 8] = x2 >>>  0 & 0xff;
190  o[ 9] = x2 >>>  8 & 0xff;
191  o[10] = x2 >>> 16 & 0xff;
192  o[11] = x2 >>> 24 & 0xff;
193
194  o[12] = x3 >>>  0 & 0xff;
195  o[13] = x3 >>>  8 & 0xff;
196  o[14] = x3 >>> 16 & 0xff;
197  o[15] = x3 >>> 24 & 0xff;
198
199  o[16] = x4 >>>  0 & 0xff;
200  o[17] = x4 >>>  8 & 0xff;
201  o[18] = x4 >>> 16 & 0xff;
202  o[19] = x4 >>> 24 & 0xff;
203
204  o[20] = x5 >>>  0 & 0xff;
205  o[21] = x5 >>>  8 & 0xff;
206  o[22] = x5 >>> 16 & 0xff;
207  o[23] = x5 >>> 24 & 0xff;
208
209  o[24] = x6 >>>  0 & 0xff;
210  o[25] = x6 >>>  8 & 0xff;
211  o[26] = x6 >>> 16 & 0xff;
212  o[27] = x6 >>> 24 & 0xff;
213
214  o[28] = x7 >>>  0 & 0xff;
215  o[29] = x7 >>>  8 & 0xff;
216  o[30] = x7 >>> 16 & 0xff;
217  o[31] = x7 >>> 24 & 0xff;
218
219  o[32] = x8 >>>  0 & 0xff;
220  o[33] = x8 >>>  8 & 0xff;
221  o[34] = x8 >>> 16 & 0xff;
222  o[35] = x8 >>> 24 & 0xff;
223
224  o[36] = x9 >>>  0 & 0xff;
225  o[37] = x9 >>>  8 & 0xff;
226  o[38] = x9 >>> 16 & 0xff;
227  o[39] = x9 >>> 24 & 0xff;
228
229  o[40] = x10 >>>  0 & 0xff;
230  o[41] = x10 >>>  8 & 0xff;
231  o[42] = x10 >>> 16 & 0xff;
232  o[43] = x10 >>> 24 & 0xff;
233
234  o[44] = x11 >>>  0 & 0xff;
235  o[45] = x11 >>>  8 & 0xff;
236  o[46] = x11 >>> 16 & 0xff;
237  o[47] = x11 >>> 24 & 0xff;
238
239  o[48] = x12 >>>  0 & 0xff;
240  o[49] = x12 >>>  8 & 0xff;
241  o[50] = x12 >>> 16 & 0xff;
242  o[51] = x12 >>> 24 & 0xff;
243
244  o[52] = x13 >>>  0 & 0xff;
245  o[53] = x13 >>>  8 & 0xff;
246  o[54] = x13 >>> 16 & 0xff;
247  o[55] = x13 >>> 24 & 0xff;
248
249  o[56] = x14 >>>  0 & 0xff;
250  o[57] = x14 >>>  8 & 0xff;
251  o[58] = x14 >>> 16 & 0xff;
252  o[59] = x14 >>> 24 & 0xff;
253
254  o[60] = x15 >>>  0 & 0xff;
255  o[61] = x15 >>>  8 & 0xff;
256  o[62] = x15 >>> 16 & 0xff;
257  o[63] = x15 >>> 24 & 0xff;
258}
259
260function core_hsalsa20(o,p,k,c) {
261  var j0  = c[ 0] & 0xff | (c[ 1] & 0xff)<<8 | (c[ 2] & 0xff)<<16 | (c[ 3] & 0xff)<<24,
262      j1  = k[ 0] & 0xff | (k[ 1] & 0xff)<<8 | (k[ 2] & 0xff)<<16 | (k[ 3] & 0xff)<<24,
263      j2  = k[ 4] & 0xff | (k[ 5] & 0xff)<<8 | (k[ 6] & 0xff)<<16 | (k[ 7] & 0xff)<<24,
264      j3  = k[ 8] & 0xff | (k[ 9] & 0xff)<<8 | (k[10] & 0xff)<<16 | (k[11] & 0xff)<<24,
265      j4  = k[12] & 0xff | (k[13] & 0xff)<<8 | (k[14] & 0xff)<<16 | (k[15] & 0xff)<<24,
266      j5  = c[ 4] & 0xff | (c[ 5] & 0xff)<<8 | (c[ 6] & 0xff)<<16 | (c[ 7] & 0xff)<<24,
267      j6  = p[ 0] & 0xff | (p[ 1] & 0xff)<<8 | (p[ 2] & 0xff)<<16 | (p[ 3] & 0xff)<<24,
268      j7  = p[ 4] & 0xff | (p[ 5] & 0xff)<<8 | (p[ 6] & 0xff)<<16 | (p[ 7] & 0xff)<<24,
269      j8  = p[ 8] & 0xff | (p[ 9] & 0xff)<<8 | (p[10] & 0xff)<<16 | (p[11] & 0xff)<<24,
270      j9  = p[12] & 0xff | (p[13] & 0xff)<<8 | (p[14] & 0xff)<<16 | (p[15] & 0xff)<<24,
271      j10 = c[ 8] & 0xff | (c[ 9] & 0xff)<<8 | (c[10] & 0xff)<<16 | (c[11] & 0xff)<<24,
272      j11 = k[16] & 0xff | (k[17] & 0xff)<<8 | (k[18] & 0xff)<<16 | (k[19] & 0xff)<<24,
273      j12 = k[20] & 0xff | (k[21] & 0xff)<<8 | (k[22] & 0xff)<<16 | (k[23] & 0xff)<<24,
274      j13 = k[24] & 0xff | (k[25] & 0xff)<<8 | (k[26] & 0xff)<<16 | (k[27] & 0xff)<<24,
275      j14 = k[28] & 0xff | (k[29] & 0xff)<<8 | (k[30] & 0xff)<<16 | (k[31] & 0xff)<<24,
276      j15 = c[12] & 0xff | (c[13] & 0xff)<<8 | (c[14] & 0xff)<<16 | (c[15] & 0xff)<<24;
277
278  var x0 = j0, x1 = j1, x2 = j2, x3 = j3, x4 = j4, x5 = j5, x6 = j6, x7 = j7,
279      x8 = j8, x9 = j9, x10 = j10, x11 = j11, x12 = j12, x13 = j13, x14 = j14,
280      x15 = j15, u;
281
282  for (var i = 0; i < 20; i += 2) {
283    u = x0 + x12 | 0;
284    x4 ^= u<<7 | u>>>(32-7);
285    u = x4 + x0 | 0;
286    x8 ^= u<<9 | u>>>(32-9);
287    u = x8 + x4 | 0;
288    x12 ^= u<<13 | u>>>(32-13);
289    u = x12 + x8 | 0;
290    x0 ^= u<<18 | u>>>(32-18);
291
292    u = x5 + x1 | 0;
293    x9 ^= u<<7 | u>>>(32-7);
294    u = x9 + x5 | 0;
295    x13 ^= u<<9 | u>>>(32-9);
296    u = x13 + x9 | 0;
297    x1 ^= u<<13 | u>>>(32-13);
298    u = x1 + x13 | 0;
299    x5 ^= u<<18 | u>>>(32-18);
300
301    u = x10 + x6 | 0;
302    x14 ^= u<<7 | u>>>(32-7);
303    u = x14 + x10 | 0;
304    x2 ^= u<<9 | u>>>(32-9);
305    u = x2 + x14 | 0;
306    x6 ^= u<<13 | u>>>(32-13);
307    u = x6 + x2 | 0;
308    x10 ^= u<<18 | u>>>(32-18);
309
310    u = x15 + x11 | 0;
311    x3 ^= u<<7 | u>>>(32-7);
312    u = x3 + x15 | 0;
313    x7 ^= u<<9 | u>>>(32-9);
314    u = x7 + x3 | 0;
315    x11 ^= u<<13 | u>>>(32-13);
316    u = x11 + x7 | 0;
317    x15 ^= u<<18 | u>>>(32-18);
318
319    u = x0 + x3 | 0;
320    x1 ^= u<<7 | u>>>(32-7);
321    u = x1 + x0 | 0;
322    x2 ^= u<<9 | u>>>(32-9);
323    u = x2 + x1 | 0;
324    x3 ^= u<<13 | u>>>(32-13);
325    u = x3 + x2 | 0;
326    x0 ^= u<<18 | u>>>(32-18);
327
328    u = x5 + x4 | 0;
329    x6 ^= u<<7 | u>>>(32-7);
330    u = x6 + x5 | 0;
331    x7 ^= u<<9 | u>>>(32-9);
332    u = x7 + x6 | 0;
333    x4 ^= u<<13 | u>>>(32-13);
334    u = x4 + x7 | 0;
335    x5 ^= u<<18 | u>>>(32-18);
336
337    u = x10 + x9 | 0;
338    x11 ^= u<<7 | u>>>(32-7);
339    u = x11 + x10 | 0;
340    x8 ^= u<<9 | u>>>(32-9);
341    u = x8 + x11 | 0;
342    x9 ^= u<<13 | u>>>(32-13);
343    u = x9 + x8 | 0;
344    x10 ^= u<<18 | u>>>(32-18);
345
346    u = x15 + x14 | 0;
347    x12 ^= u<<7 | u>>>(32-7);
348    u = x12 + x15 | 0;
349    x13 ^= u<<9 | u>>>(32-9);
350    u = x13 + x12 | 0;
351    x14 ^= u<<13 | u>>>(32-13);
352    u = x14 + x13 | 0;
353    x15 ^= u<<18 | u>>>(32-18);
354  }
355
356  o[ 0] = x0 >>>  0 & 0xff;
357  o[ 1] = x0 >>>  8 & 0xff;
358  o[ 2] = x0 >>> 16 & 0xff;
359  o[ 3] = x0 >>> 24 & 0xff;
360
361  o[ 4] = x5 >>>  0 & 0xff;
362  o[ 5] = x5 >>>  8 & 0xff;
363  o[ 6] = x5 >>> 16 & 0xff;
364  o[ 7] = x5 >>> 24 & 0xff;
365
366  o[ 8] = x10 >>>  0 & 0xff;
367  o[ 9] = x10 >>>  8 & 0xff;
368  o[10] = x10 >>> 16 & 0xff;
369  o[11] = x10 >>> 24 & 0xff;
370
371  o[12] = x15 >>>  0 & 0xff;
372  o[13] = x15 >>>  8 & 0xff;
373  o[14] = x15 >>> 16 & 0xff;
374  o[15] = x15 >>> 24 & 0xff;
375
376  o[16] = x6 >>>  0 & 0xff;
377  o[17] = x6 >>>  8 & 0xff;
378  o[18] = x6 >>> 16 & 0xff;
379  o[19] = x6 >>> 24 & 0xff;
380
381  o[20] = x7 >>>  0 & 0xff;
382  o[21] = x7 >>>  8 & 0xff;
383  o[22] = x7 >>> 16 & 0xff;
384  o[23] = x7 >>> 24 & 0xff;
385
386  o[24] = x8 >>>  0 & 0xff;
387  o[25] = x8 >>>  8 & 0xff;
388  o[26] = x8 >>> 16 & 0xff;
389  o[27] = x8 >>> 24 & 0xff;
390
391  o[28] = x9 >>>  0 & 0xff;
392  o[29] = x9 >>>  8 & 0xff;
393  o[30] = x9 >>> 16 & 0xff;
394  o[31] = x9 >>> 24 & 0xff;
395}
396
397function crypto_core_salsa20(out,inp,k,c) {
398  core_salsa20(out,inp,k,c);
399}
400
401function crypto_core_hsalsa20(out,inp,k,c) {
402  core_hsalsa20(out,inp,k,c);
403}
404
405var sigma = new Uint8Array([101, 120, 112, 97, 110, 100, 32, 51, 50, 45, 98, 121, 116, 101, 32, 107]);
406            // "expand 32-byte k"
407
408function crypto_stream_salsa20_xor(c,cpos,m,mpos,b,n,k) {
409  var z = new Uint8Array(16), x = new Uint8Array(64);
410  var u, i;
411  for (i = 0; i < 16; i++) z[i] = 0;
412  for (i = 0; i < 8; i++) z[i] = n[i];
413  while (b >= 64) {
414    crypto_core_salsa20(x,z,k,sigma);
415    for (i = 0; i < 64; i++) c[cpos+i] = m[mpos+i] ^ x[i];
416    u = 1;
417    for (i = 8; i < 16; i++) {
418      u = u + (z[i] & 0xff) | 0;
419      z[i] = u & 0xff;
420      u >>>= 8;
421    }
422    b -= 64;
423    cpos += 64;
424    mpos += 64;
425  }
426  if (b > 0) {
427    crypto_core_salsa20(x,z,k,sigma);
428    for (i = 0; i < b; i++) c[cpos+i] = m[mpos+i] ^ x[i];
429  }
430  return 0;
431}
432
433function crypto_stream_salsa20(c,cpos,b,n,k) {
434  var z = new Uint8Array(16), x = new Uint8Array(64);
435  var u, i;
436  for (i = 0; i < 16; i++) z[i] = 0;
437  for (i = 0; i < 8; i++) z[i] = n[i];
438  while (b >= 64) {
439    crypto_core_salsa20(x,z,k,sigma);
440    for (i = 0; i < 64; i++) c[cpos+i] = x[i];
441    u = 1;
442    for (i = 8; i < 16; i++) {
443      u = u + (z[i] & 0xff) | 0;
444      z[i] = u & 0xff;
445      u >>>= 8;
446    }
447    b -= 64;
448    cpos += 64;
449  }
450  if (b > 0) {
451    crypto_core_salsa20(x,z,k,sigma);
452    for (i = 0; i < b; i++) c[cpos+i] = x[i];
453  }
454  return 0;
455}
456
457function crypto_stream(c,cpos,d,n,k) {
458  var s = new Uint8Array(32);
459  crypto_core_hsalsa20(s,n,k,sigma);
460  var sn = new Uint8Array(8);
461  for (var i = 0; i < 8; i++) sn[i] = n[i+16];
462  return crypto_stream_salsa20(c,cpos,d,sn,s);
463}
464
465function crypto_stream_xor(c,cpos,m,mpos,d,n,k) {
466  var s = new Uint8Array(32);
467  crypto_core_hsalsa20(s,n,k,sigma);
468  var sn = new Uint8Array(8);
469  for (var i = 0; i < 8; i++) sn[i] = n[i+16];
470  return crypto_stream_salsa20_xor(c,cpos,m,mpos,d,sn,s);
471}
472
473/*
474* Port of Andrew Moon's Poly1305-donna-16. Public domain.
475* https://github.com/floodyberry/poly1305-donna
476*/
477
478var poly1305 = function(key) {
479  this.buffer = new Uint8Array(16);
480  this.r = new Uint16Array(10);
481  this.h = new Uint16Array(10);
482  this.pad = new Uint16Array(8);
483  this.leftover = 0;
484  this.fin = 0;
485
486  var t0, t1, t2, t3, t4, t5, t6, t7;
487
488  t0 = key[ 0] & 0xff | (key[ 1] & 0xff) << 8; this.r[0] = ( t0                     ) & 0x1fff;
489  t1 = key[ 2] & 0xff | (key[ 3] & 0xff) << 8; this.r[1] = ((t0 >>> 13) | (t1 <<  3)) & 0x1fff;
490  t2 = key[ 4] & 0xff | (key[ 5] & 0xff) << 8; this.r[2] = ((t1 >>> 10) | (t2 <<  6)) & 0x1f03;
491  t3 = key[ 6] & 0xff | (key[ 7] & 0xff) << 8; this.r[3] = ((t2 >>>  7) | (t3 <<  9)) & 0x1fff;
492  t4 = key[ 8] & 0xff | (key[ 9] & 0xff) << 8; this.r[4] = ((t3 >>>  4) | (t4 << 12)) & 0x00ff;
493  this.r[5] = ((t4 >>>  1)) & 0x1ffe;
494  t5 = key[10] & 0xff | (key[11] & 0xff) << 8; this.r[6] = ((t4 >>> 14) | (t5 <<  2)) & 0x1fff;
495  t6 = key[12] & 0xff | (key[13] & 0xff) << 8; this.r[7] = ((t5 >>> 11) | (t6 <<  5)) & 0x1f81;
496  t7 = key[14] & 0xff | (key[15] & 0xff) << 8; this.r[8] = ((t6 >>>  8) | (t7 <<  8)) & 0x1fff;
497  this.r[9] = ((t7 >>>  5)) & 0x007f;
498
499  this.pad[0] = key[16] & 0xff | (key[17] & 0xff) << 8;
500  this.pad[1] = key[18] & 0xff | (key[19] & 0xff) << 8;
501  this.pad[2] = key[20] & 0xff | (key[21] & 0xff) << 8;
502  this.pad[3] = key[22] & 0xff | (key[23] & 0xff) << 8;
503  this.pad[4] = key[24] & 0xff | (key[25] & 0xff) << 8;
504  this.pad[5] = key[26] & 0xff | (key[27] & 0xff) << 8;
505  this.pad[6] = key[28] & 0xff | (key[29] & 0xff) << 8;
506  this.pad[7] = key[30] & 0xff | (key[31] & 0xff) << 8;
507};
508
509poly1305.prototype.blocks = function(m, mpos, bytes) {
510  var hibit = this.fin ? 0 : (1 << 11);
511  var t0, t1, t2, t3, t4, t5, t6, t7, c;
512  var d0, d1, d2, d3, d4, d5, d6, d7, d8, d9;
513
514  var h0 = this.h[0],
515      h1 = this.h[1],
516      h2 = this.h[2],
517      h3 = this.h[3],
518      h4 = this.h[4],
519      h5 = this.h[5],
520      h6 = this.h[6],
521      h7 = this.h[7],
522      h8 = this.h[8],
523      h9 = this.h[9];
524
525  var r0 = this.r[0],
526      r1 = this.r[1],
527      r2 = this.r[2],
528      r3 = this.r[3],
529      r4 = this.r[4],
530      r5 = this.r[5],
531      r6 = this.r[6],
532      r7 = this.r[7],
533      r8 = this.r[8],
534      r9 = this.r[9];
535
536  while (bytes >= 16) {
537    t0 = m[mpos+ 0] & 0xff | (m[mpos+ 1] & 0xff) << 8; h0 += ( t0                     ) & 0x1fff;
538    t1 = m[mpos+ 2] & 0xff | (m[mpos+ 3] & 0xff) << 8; h1 += ((t0 >>> 13) | (t1 <<  3)) & 0x1fff;
539    t2 = m[mpos+ 4] & 0xff | (m[mpos+ 5] & 0xff) << 8; h2 += ((t1 >>> 10) | (t2 <<  6)) & 0x1fff;
540    t3 = m[mpos+ 6] & 0xff | (m[mpos+ 7] & 0xff) << 8; h3 += ((t2 >>>  7) | (t3 <<  9)) & 0x1fff;
541    t4 = m[mpos+ 8] & 0xff | (m[mpos+ 9] & 0xff) << 8; h4 += ((t3 >>>  4) | (t4 << 12)) & 0x1fff;
542    h5 += ((t4 >>>  1)) & 0x1fff;
543    t5 = m[mpos+10] & 0xff | (m[mpos+11] & 0xff) << 8; h6 += ((t4 >>> 14) | (t5 <<  2)) & 0x1fff;
544    t6 = m[mpos+12] & 0xff | (m[mpos+13] & 0xff) << 8; h7 += ((t5 >>> 11) | (t6 <<  5)) & 0x1fff;
545    t7 = m[mpos+14] & 0xff | (m[mpos+15] & 0xff) << 8; h8 += ((t6 >>>  8) | (t7 <<  8)) & 0x1fff;
546    h9 += ((t7 >>> 5)) | hibit;
547
548    c = 0;
549
550    d0 = c;
551    d0 += h0 * r0;
552    d0 += h1 * (5 * r9);
553    d0 += h2 * (5 * r8);
554    d0 += h3 * (5 * r7);
555    d0 += h4 * (5 * r6);
556    c = (d0 >>> 13); d0 &= 0x1fff;
557    d0 += h5 * (5 * r5);
558    d0 += h6 * (5 * r4);
559    d0 += h7 * (5 * r3);
560    d0 += h8 * (5 * r2);
561    d0 += h9 * (5 * r1);
562    c += (d0 >>> 13); d0 &= 0x1fff;
563
564    d1 = c;
565    d1 += h0 * r1;
566    d1 += h1 * r0;
567    d1 += h2 * (5 * r9);
568    d1 += h3 * (5 * r8);
569    d1 += h4 * (5 * r7);
570    c = (d1 >>> 13); d1 &= 0x1fff;
571    d1 += h5 * (5 * r6);
572    d1 += h6 * (5 * r5);
573    d1 += h7 * (5 * r4);
574    d1 += h8 * (5 * r3);
575    d1 += h9 * (5 * r2);
576    c += (d1 >>> 13); d1 &= 0x1fff;
577
578    d2 = c;
579    d2 += h0 * r2;
580    d2 += h1 * r1;
581    d2 += h2 * r0;
582    d2 += h3 * (5 * r9);
583    d2 += h4 * (5 * r8);
584    c = (d2 >>> 13); d2 &= 0x1fff;
585    d2 += h5 * (5 * r7);
586    d2 += h6 * (5 * r6);
587    d2 += h7 * (5 * r5);
588    d2 += h8 * (5 * r4);
589    d2 += h9 * (5 * r3);
590    c += (d2 >>> 13); d2 &= 0x1fff;
591
592    d3 = c;
593    d3 += h0 * r3;
594    d3 += h1 * r2;
595    d3 += h2 * r1;
596    d3 += h3 * r0;
597    d3 += h4 * (5 * r9);
598    c = (d3 >>> 13); d3 &= 0x1fff;
599    d3 += h5 * (5 * r8);
600    d3 += h6 * (5 * r7);
601    d3 += h7 * (5 * r6);
602    d3 += h8 * (5 * r5);
603    d3 += h9 * (5 * r4);
604    c += (d3 >>> 13); d3 &= 0x1fff;
605
606    d4 = c;
607    d4 += h0 * r4;
608    d4 += h1 * r3;
609    d4 += h2 * r2;
610    d4 += h3 * r1;
611    d4 += h4 * r0;
612    c = (d4 >>> 13); d4 &= 0x1fff;
613    d4 += h5 * (5 * r9);
614    d4 += h6 * (5 * r8);
615    d4 += h7 * (5 * r7);
616    d4 += h8 * (5 * r6);
617    d4 += h9 * (5 * r5);
618    c += (d4 >>> 13); d4 &= 0x1fff;
619
620    d5 = c;
621    d5 += h0 * r5;
622    d5 += h1 * r4;
623    d5 += h2 * r3;
624    d5 += h3 * r2;
625    d5 += h4 * r1;
626    c = (d5 >>> 13); d5 &= 0x1fff;
627    d5 += h5 * r0;
628    d5 += h6 * (5 * r9);
629    d5 += h7 * (5 * r8);
630    d5 += h8 * (5 * r7);
631    d5 += h9 * (5 * r6);
632    c += (d5 >>> 13); d5 &= 0x1fff;
633
634    d6 = c;
635    d6 += h0 * r6;
636    d6 += h1 * r5;
637    d6 += h2 * r4;
638    d6 += h3 * r3;
639    d6 += h4 * r2;
640    c = (d6 >>> 13); d6 &= 0x1fff;
641    d6 += h5 * r1;
642    d6 += h6 * r0;
643    d6 += h7 * (5 * r9);
644    d6 += h8 * (5 * r8);
645    d6 += h9 * (5 * r7);
646    c += (d6 >>> 13); d6 &= 0x1fff;
647
648    d7 = c;
649    d7 += h0 * r7;
650    d7 += h1 * r6;
651    d7 += h2 * r5;
652    d7 += h3 * r4;
653    d7 += h4 * r3;
654    c = (d7 >>> 13); d7 &= 0x1fff;
655    d7 += h5 * r2;
656    d7 += h6 * r1;
657    d7 += h7 * r0;
658    d7 += h8 * (5 * r9);
659    d7 += h9 * (5 * r8);
660    c += (d7 >>> 13); d7 &= 0x1fff;
661
662    d8 = c;
663    d8 += h0 * r8;
664    d8 += h1 * r7;
665    d8 += h2 * r6;
666    d8 += h3 * r5;
667    d8 += h4 * r4;
668    c = (d8 >>> 13); d8 &= 0x1fff;
669    d8 += h5 * r3;
670    d8 += h6 * r2;
671    d8 += h7 * r1;
672    d8 += h8 * r0;
673    d8 += h9 * (5 * r9);
674    c += (d8 >>> 13); d8 &= 0x1fff;
675
676    d9 = c;
677    d9 += h0 * r9;
678    d9 += h1 * r8;
679    d9 += h2 * r7;
680    d9 += h3 * r6;
681    d9 += h4 * r5;
682    c = (d9 >>> 13); d9 &= 0x1fff;
683    d9 += h5 * r4;
684    d9 += h6 * r3;
685    d9 += h7 * r2;
686    d9 += h8 * r1;
687    d9 += h9 * r0;
688    c += (d9 >>> 13); d9 &= 0x1fff;
689
690    c = (((c << 2) + c)) | 0;
691    c = (c + d0) | 0;
692    d0 = c & 0x1fff;
693    c = (c >>> 13);
694    d1 += c;
695
696    h0 = d0;
697    h1 = d1;
698    h2 = d2;
699    h3 = d3;
700    h4 = d4;
701    h5 = d5;
702    h6 = d6;
703    h7 = d7;
704    h8 = d8;
705    h9 = d9;
706
707    mpos += 16;
708    bytes -= 16;
709  }
710  this.h[0] = h0;
711  this.h[1] = h1;
712  this.h[2] = h2;
713  this.h[3] = h3;
714  this.h[4] = h4;
715  this.h[5] = h5;
716  this.h[6] = h6;
717  this.h[7] = h7;
718  this.h[8] = h8;
719  this.h[9] = h9;
720};
721
722poly1305.prototype.finish = function(mac, macpos) {
723  var g = new Uint16Array(10);
724  var c, mask, f, i;
725
726  if (this.leftover) {
727    i = this.leftover;
728    this.buffer[i++] = 1;
729    for (; i < 16; i++) this.buffer[i] = 0;
730    this.fin = 1;
731    this.blocks(this.buffer, 0, 16);
732  }
733
734  c = this.h[1] >>> 13;
735  this.h[1] &= 0x1fff;
736  for (i = 2; i < 10; i++) {
737    this.h[i] += c;
738    c = this.h[i] >>> 13;
739    this.h[i] &= 0x1fff;
740  }
741  this.h[0] += (c * 5);
742  c = this.h[0] >>> 13;
743  this.h[0] &= 0x1fff;
744  this.h[1] += c;
745  c = this.h[1] >>> 13;
746  this.h[1] &= 0x1fff;
747  this.h[2] += c;
748
749  g[0] = this.h[0] + 5;
750  c = g[0] >>> 13;
751  g[0] &= 0x1fff;
752  for (i = 1; i < 10; i++) {
753    g[i] = this.h[i] + c;
754    c = g[i] >>> 13;
755    g[i] &= 0x1fff;
756  }
757  g[9] -= (1 << 13);
758
759  mask = (c ^ 1) - 1;
760  for (i = 0; i < 10; i++) g[i] &= mask;
761  mask = ~mask;
762  for (i = 0; i < 10; i++) this.h[i] = (this.h[i] & mask) | g[i];
763
764  this.h[0] = ((this.h[0]       ) | (this.h[1] << 13)                    ) & 0xffff;
765  this.h[1] = ((this.h[1] >>>  3) | (this.h[2] << 10)                    ) & 0xffff;
766  this.h[2] = ((this.h[2] >>>  6) | (this.h[3] <<  7)                    ) & 0xffff;
767  this.h[3] = ((this.h[3] >>>  9) | (this.h[4] <<  4)                    ) & 0xffff;
768  this.h[4] = ((this.h[4] >>> 12) | (this.h[5] <<  1) | (this.h[6] << 14)) & 0xffff;
769  this.h[5] = ((this.h[6] >>>  2) | (this.h[7] << 11)                    ) & 0xffff;
770  this.h[6] = ((this.h[7] >>>  5) | (this.h[8] <<  8)                    ) & 0xffff;
771  this.h[7] = ((this.h[8] >>>  8) | (this.h[9] <<  5)                    ) & 0xffff;
772
773  f = this.h[0] + this.pad[0];
774  this.h[0] = f & 0xffff;
775  for (i = 1; i < 8; i++) {
776    f = (((this.h[i] + this.pad[i]) | 0) + (f >>> 16)) | 0;
777    this.h[i] = f & 0xffff;
778  }
779
780  mac[macpos+ 0] = (this.h[0] >>> 0) & 0xff;
781  mac[macpos+ 1] = (this.h[0] >>> 8) & 0xff;
782  mac[macpos+ 2] = (this.h[1] >>> 0) & 0xff;
783  mac[macpos+ 3] = (this.h[1] >>> 8) & 0xff;
784  mac[macpos+ 4] = (this.h[2] >>> 0) & 0xff;
785  mac[macpos+ 5] = (this.h[2] >>> 8) & 0xff;
786  mac[macpos+ 6] = (this.h[3] >>> 0) & 0xff;
787  mac[macpos+ 7] = (this.h[3] >>> 8) & 0xff;
788  mac[macpos+ 8] = (this.h[4] >>> 0) & 0xff;
789  mac[macpos+ 9] = (this.h[4] >>> 8) & 0xff;
790  mac[macpos+10] = (this.h[5] >>> 0) & 0xff;
791  mac[macpos+11] = (this.h[5] >>> 8) & 0xff;
792  mac[macpos+12] = (this.h[6] >>> 0) & 0xff;
793  mac[macpos+13] = (this.h[6] >>> 8) & 0xff;
794  mac[macpos+14] = (this.h[7] >>> 0) & 0xff;
795  mac[macpos+15] = (this.h[7] >>> 8) & 0xff;
796};
797
798poly1305.prototype.update = function(m, mpos, bytes) {
799  var i, want;
800
801  if (this.leftover) {
802    want = (16 - this.leftover);
803    if (want > bytes)
804      want = bytes;
805    for (i = 0; i < want; i++)
806      this.buffer[this.leftover + i] = m[mpos+i];
807    bytes -= want;
808    mpos += want;
809    this.leftover += want;
810    if (this.leftover < 16)
811      return;
812    this.blocks(this.buffer, 0, 16);
813    this.leftover = 0;
814  }
815
816  if (bytes >= 16) {
817    want = bytes - (bytes % 16);
818    this.blocks(m, mpos, want);
819    mpos += want;
820    bytes -= want;
821  }
822
823  if (bytes) {
824    for (i = 0; i < bytes; i++)
825      this.buffer[this.leftover + i] = m[mpos+i];
826    this.leftover += bytes;
827  }
828};
829
830function crypto_onetimeauth(out, outpos, m, mpos, n, k) {
831  var s = new poly1305(k);
832  s.update(m, mpos, n);
833  s.finish(out, outpos);
834  return 0;
835}
836
837function crypto_onetimeauth_verify(h, hpos, m, mpos, n, k) {
838  var x = new Uint8Array(16);
839  crypto_onetimeauth(x,0,m,mpos,n,k);
840  return crypto_verify_16(h,hpos,x,0);
841}
842
843function crypto_secretbox(c,m,d,n,k) {
844  var i;
845  if (d < 32) return -1;
846  crypto_stream_xor(c,0,m,0,d,n,k);
847  crypto_onetimeauth(c, 16, c, 32, d - 32, c);
848  for (i = 0; i < 16; i++) c[i] = 0;
849  return 0;
850}
851
852function crypto_secretbox_open(m,c,d,n,k) {
853  var i;
854  var x = new Uint8Array(32);
855  if (d < 32) return -1;
856  crypto_stream(x,0,32,n,k);
857  if (crypto_onetimeauth_verify(c, 16,c, 32,d - 32,x) !== 0) return -1;
858  crypto_stream_xor(m,0,c,0,d,n,k);
859  for (i = 0; i < 32; i++) m[i] = 0;
860  return 0;
861}
862
863function set25519(r, a) {
864  var i;
865  for (i = 0; i < 16; i++) r[i] = a[i]|0;
866}
867
868function car25519(o) {
869  var i, v, c = 1;
870  for (i = 0; i < 16; i++) {
871    v = o[i] + c + 65535;
872    c = Math.floor(v / 65536);
873    o[i] = v - c * 65536;
874  }
875  o[0] += c-1 + 37 * (c-1);
876}
877
878function sel25519(p, q, b) {
879  var t, c = ~(b-1);
880  for (var i = 0; i < 16; i++) {
881    t = c & (p[i] ^ q[i]);
882    p[i] ^= t;
883    q[i] ^= t;
884  }
885}
886
887function pack25519(o, n) {
888  var i, j, b;
889  var m = gf(), t = gf();
890  for (i = 0; i < 16; i++) t[i] = n[i];
891  car25519(t);
892  car25519(t);
893  car25519(t);
894  for (j = 0; j < 2; j++) {
895    m[0] = t[0] - 0xffed;
896    for (i = 1; i < 15; i++) {
897      m[i] = t[i] - 0xffff - ((m[i-1]>>16) & 1);
898      m[i-1] &= 0xffff;
899    }
900    m[15] = t[15] - 0x7fff - ((m[14]>>16) & 1);
901    b = (m[15]>>16) & 1;
902    m[14] &= 0xffff;
903    sel25519(t, m, 1-b);
904  }
905  for (i = 0; i < 16; i++) {
906    o[2*i] = t[i] & 0xff;
907    o[2*i+1] = t[i]>>8;
908  }
909}
910
911function neq25519(a, b) {
912  var c = new Uint8Array(32), d = new Uint8Array(32);
913  pack25519(c, a);
914  pack25519(d, b);
915  return crypto_verify_32(c, 0, d, 0);
916}
917
918function par25519(a) {
919  var d = new Uint8Array(32);
920  pack25519(d, a);
921  return d[0] & 1;
922}
923
924function unpack25519(o, n) {
925  var i;
926  for (i = 0; i < 16; i++) o[i] = n[2*i] + (n[2*i+1] << 8);
927  o[15] &= 0x7fff;
928}
929
930function A(o, a, b) {
931  for (var i = 0; i < 16; i++) o[i] = a[i] + b[i];
932}
933
934function Z(o, a, b) {
935  for (var i = 0; i < 16; i++) o[i] = a[i] - b[i];
936}
937
938function M(o, a, b) {
939  var v, c,
940     t0 = 0,  t1 = 0,  t2 = 0,  t3 = 0,  t4 = 0,  t5 = 0,  t6 = 0,  t7 = 0,
941     t8 = 0,  t9 = 0, t10 = 0, t11 = 0, t12 = 0, t13 = 0, t14 = 0, t15 = 0,
942    t16 = 0, t17 = 0, t18 = 0, t19 = 0, t20 = 0, t21 = 0, t22 = 0, t23 = 0,
943    t24 = 0, t25 = 0, t26 = 0, t27 = 0, t28 = 0, t29 = 0, t30 = 0,
944    b0 = b[0],
945    b1 = b[1],
946    b2 = b[2],
947    b3 = b[3],
948    b4 = b[4],
949    b5 = b[5],
950    b6 = b[6],
951    b7 = b[7],
952    b8 = b[8],
953    b9 = b[9],
954    b10 = b[10],
955    b11 = b[11],
956    b12 = b[12],
957    b13 = b[13],
958    b14 = b[14],
959    b15 = b[15];
960
961  v = a[0];
962  t0 += v * b0;
963  t1 += v * b1;
964  t2 += v * b2;
965  t3 += v * b3;
966  t4 += v * b4;
967  t5 += v * b5;
968  t6 += v * b6;
969  t7 += v * b7;
970  t8 += v * b8;
971  t9 += v * b9;
972  t10 += v * b10;
973  t11 += v * b11;
974  t12 += v * b12;
975  t13 += v * b13;
976  t14 += v * b14;
977  t15 += v * b15;
978  v = a[1];
979  t1 += v * b0;
980  t2 += v * b1;
981  t3 += v * b2;
982  t4 += v * b3;
983  t5 += v * b4;
984  t6 += v * b5;
985  t7 += v * b6;
986  t8 += v * b7;
987  t9 += v * b8;
988  t10 += v * b9;
989  t11 += v * b10;
990  t12 += v * b11;
991  t13 += v * b12;
992  t14 += v * b13;
993  t15 += v * b14;
994  t16 += v * b15;
995  v = a[2];
996  t2 += v * b0;
997  t3 += v * b1;
998  t4 += v * b2;
999  t5 += v * b3;
1000  t6 += v * b4;
1001  t7 += v * b5;
1002  t8 += v * b6;
1003  t9 += v * b7;
1004  t10 += v * b8;
1005  t11 += v * b9;
1006  t12 += v * b10;
1007  t13 += v * b11;
1008  t14 += v * b12;
1009  t15 += v * b13;
1010  t16 += v * b14;
1011  t17 += v * b15;
1012  v = a[3];
1013  t3 += v * b0;
1014  t4 += v * b1;
1015  t5 += v * b2;
1016  t6 += v * b3;
1017  t7 += v * b4;
1018  t8 += v * b5;
1019  t9 += v * b6;
1020  t10 += v * b7;
1021  t11 += v * b8;
1022  t12 += v * b9;
1023  t13 += v * b10;
1024  t14 += v * b11;
1025  t15 += v * b12;
1026  t16 += v * b13;
1027  t17 += v * b14;
1028  t18 += v * b15;
1029  v = a[4];
1030  t4 += v * b0;
1031  t5 += v * b1;
1032  t6 += v * b2;
1033  t7 += v * b3;
1034  t8 += v * b4;
1035  t9 += v * b5;
1036  t10 += v * b6;
1037  t11 += v * b7;
1038  t12 += v * b8;
1039  t13 += v * b9;
1040  t14 += v * b10;
1041  t15 += v * b11;
1042  t16 += v * b12;
1043  t17 += v * b13;
1044  t18 += v * b14;
1045  t19 += v * b15;
1046  v = a[5];
1047  t5 += v * b0;
1048  t6 += v * b1;
1049  t7 += v * b2;
1050  t8 += v * b3;
1051  t9 += v * b4;
1052  t10 += v * b5;
1053  t11 += v * b6;
1054  t12 += v * b7;
1055  t13 += v * b8;
1056  t14 += v * b9;
1057  t15 += v * b10;
1058  t16 += v * b11;
1059  t17 += v * b12;
1060  t18 += v * b13;
1061  t19 += v * b14;
1062  t20 += v * b15;
1063  v = a[6];
1064  t6 += v * b0;
1065  t7 += v * b1;
1066  t8 += v * b2;
1067  t9 += v * b3;
1068  t10 += v * b4;
1069  t11 += v * b5;
1070  t12 += v * b6;
1071  t13 += v * b7;
1072  t14 += v * b8;
1073  t15 += v * b9;
1074  t16 += v * b10;
1075  t17 += v * b11;
1076  t18 += v * b12;
1077  t19 += v * b13;
1078  t20 += v * b14;
1079  t21 += v * b15;
1080  v = a[7];
1081  t7 += v * b0;
1082  t8 += v * b1;
1083  t9 += v * b2;
1084  t10 += v * b3;
1085  t11 += v * b4;
1086  t12 += v * b5;
1087  t13 += v * b6;
1088  t14 += v * b7;
1089  t15 += v * b8;
1090  t16 += v * b9;
1091  t17 += v * b10;
1092  t18 += v * b11;
1093  t19 += v * b12;
1094  t20 += v * b13;
1095  t21 += v * b14;
1096  t22 += v * b15;
1097  v = a[8];
1098  t8 += v * b0;
1099  t9 += v * b1;
1100  t10 += v * b2;
1101  t11 += v * b3;
1102  t12 += v * b4;
1103  t13 += v * b5;
1104  t14 += v * b6;
1105  t15 += v * b7;
1106  t16 += v * b8;
1107  t17 += v * b9;
1108  t18 += v * b10;
1109  t19 += v * b11;
1110  t20 += v * b12;
1111  t21 += v * b13;
1112  t22 += v * b14;
1113  t23 += v * b15;
1114  v = a[9];
1115  t9 += v * b0;
1116  t10 += v * b1;
1117  t11 += v * b2;
1118  t12 += v * b3;
1119  t13 += v * b4;
1120  t14 += v * b5;
1121  t15 += v * b6;
1122  t16 += v * b7;
1123  t17 += v * b8;
1124  t18 += v * b9;
1125  t19 += v * b10;
1126  t20 += v * b11;
1127  t21 += v * b12;
1128  t22 += v * b13;
1129  t23 += v * b14;
1130  t24 += v * b15;
1131  v = a[10];
1132  t10 += v * b0;
1133  t11 += v * b1;
1134  t12 += v * b2;
1135  t13 += v * b3;
1136  t14 += v * b4;
1137  t15 += v * b5;
1138  t16 += v * b6;
1139  t17 += v * b7;
1140  t18 += v * b8;
1141  t19 += v * b9;
1142  t20 += v * b10;
1143  t21 += v * b11;
1144  t22 += v * b12;
1145  t23 += v * b13;
1146  t24 += v * b14;
1147  t25 += v * b15;
1148  v = a[11];
1149  t11 += v * b0;
1150  t12 += v * b1;
1151  t13 += v * b2;
1152  t14 += v * b3;
1153  t15 += v * b4;
1154  t16 += v * b5;
1155  t17 += v * b6;
1156  t18 += v * b7;
1157  t19 += v * b8;
1158  t20 += v * b9;
1159  t21 += v * b10;
1160  t22 += v * b11;
1161  t23 += v * b12;
1162  t24 += v * b13;
1163  t25 += v * b14;
1164  t26 += v * b15;
1165  v = a[12];
1166  t12 += v * b0;
1167  t13 += v * b1;
1168  t14 += v * b2;
1169  t15 += v * b3;
1170  t16 += v * b4;
1171  t17 += v * b5;
1172  t18 += v * b6;
1173  t19 += v * b7;
1174  t20 += v * b8;
1175  t21 += v * b9;
1176  t22 += v * b10;
1177  t23 += v * b11;
1178  t24 += v * b12;
1179  t25 += v * b13;
1180  t26 += v * b14;
1181  t27 += v * b15;
1182  v = a[13];
1183  t13 += v * b0;
1184  t14 += v * b1;
1185  t15 += v * b2;
1186  t16 += v * b3;
1187  t17 += v * b4;
1188  t18 += v * b5;
1189  t19 += v * b6;
1190  t20 += v * b7;
1191  t21 += v * b8;
1192  t22 += v * b9;
1193  t23 += v * b10;
1194  t24 += v * b11;
1195  t25 += v * b12;
1196  t26 += v * b13;
1197  t27 += v * b14;
1198  t28 += v * b15;
1199  v = a[14];
1200  t14 += v * b0;
1201  t15 += v * b1;
1202  t16 += v * b2;
1203  t17 += v * b3;
1204  t18 += v * b4;
1205  t19 += v * b5;
1206  t20 += v * b6;
1207  t21 += v * b7;
1208  t22 += v * b8;
1209  t23 += v * b9;
1210  t24 += v * b10;
1211  t25 += v * b11;
1212  t26 += v * b12;
1213  t27 += v * b13;
1214  t28 += v * b14;
1215  t29 += v * b15;
1216  v = a[15];
1217  t15 += v * b0;
1218  t16 += v * b1;
1219  t17 += v * b2;
1220  t18 += v * b3;
1221  t19 += v * b4;
1222  t20 += v * b5;
1223  t21 += v * b6;
1224  t22 += v * b7;
1225  t23 += v * b8;
1226  t24 += v * b9;
1227  t25 += v * b10;
1228  t26 += v * b11;
1229  t27 += v * b12;
1230  t28 += v * b13;
1231  t29 += v * b14;
1232  t30 += v * b15;
1233
1234  t0  += 38 * t16;
1235  t1  += 38 * t17;
1236  t2  += 38 * t18;
1237  t3  += 38 * t19;
1238  t4  += 38 * t20;
1239  t5  += 38 * t21;
1240  t6  += 38 * t22;
1241  t7  += 38 * t23;
1242  t8  += 38 * t24;
1243  t9  += 38 * t25;
1244  t10 += 38 * t26;
1245  t11 += 38 * t27;
1246  t12 += 38 * t28;
1247  t13 += 38 * t29;
1248  t14 += 38 * t30;
1249  // t15 left as is
1250
1251  // first car
1252  c = 1;
1253  v =  t0 + c + 65535; c = Math.floor(v / 65536);  t0 = v - c * 65536;
1254  v =  t1 + c + 65535; c = Math.floor(v / 65536);  t1 = v - c * 65536;
1255  v =  t2 + c + 65535; c = Math.floor(v / 65536);  t2 = v - c * 65536;
1256  v =  t3 + c + 65535; c = Math.floor(v / 65536);  t3 = v - c * 65536;
1257  v =  t4 + c + 65535; c = Math.floor(v / 65536);  t4 = v - c * 65536;
1258  v =  t5 + c + 65535; c = Math.floor(v / 65536);  t5 = v - c * 65536;
1259  v =  t6 + c + 65535; c = Math.floor(v / 65536);  t6 = v - c * 65536;
1260  v =  t7 + c + 65535; c = Math.floor(v / 65536);  t7 = v - c * 65536;
1261  v =  t8 + c + 65535; c = Math.floor(v / 65536);  t8 = v - c * 65536;
1262  v =  t9 + c + 65535; c = Math.floor(v / 65536);  t9 = v - c * 65536;
1263  v = t10 + c + 65535; c = Math.floor(v / 65536); t10 = v - c * 65536;
1264  v = t11 + c + 65535; c = Math.floor(v / 65536); t11 = v - c * 65536;
1265  v = t12 + c + 65535; c = Math.floor(v / 65536); t12 = v - c * 65536;
1266  v = t13 + c + 65535; c = Math.floor(v / 65536); t13 = v - c * 65536;
1267  v = t14 + c + 65535; c = Math.floor(v / 65536); t14 = v - c * 65536;
1268  v = t15 + c + 65535; c = Math.floor(v / 65536); t15 = v - c * 65536;
1269  t0 += c-1 + 37 * (c-1);
1270
1271  // second car
1272  c = 1;
1273  v =  t0 + c + 65535; c = Math.floor(v / 65536);  t0 = v - c * 65536;
1274  v =  t1 + c + 65535; c = Math.floor(v / 65536);  t1 = v - c * 65536;
1275  v =  t2 + c + 65535; c = Math.floor(v / 65536);  t2 = v - c * 65536;
1276  v =  t3 + c + 65535; c = Math.floor(v / 65536);  t3 = v - c * 65536;
1277  v =  t4 + c + 65535; c = Math.floor(v / 65536);  t4 = v - c * 65536;
1278  v =  t5 + c + 65535; c = Math.floor(v / 65536);  t5 = v - c * 65536;
1279  v =  t6 + c + 65535; c = Math.floor(v / 65536);  t6 = v - c * 65536;
1280  v =  t7 + c + 65535; c = Math.floor(v / 65536);  t7 = v - c * 65536;
1281  v =  t8 + c + 65535; c = Math.floor(v / 65536);  t8 = v - c * 65536;
1282  v =  t9 + c + 65535; c = Math.floor(v / 65536);  t9 = v - c * 65536;
1283  v = t10 + c + 65535; c = Math.floor(v / 65536); t10 = v - c * 65536;
1284  v = t11 + c + 65535; c = Math.floor(v / 65536); t11 = v - c * 65536;
1285  v = t12 + c + 65535; c = Math.floor(v / 65536); t12 = v - c * 65536;
1286  v = t13 + c + 65535; c = Math.floor(v / 65536); t13 = v - c * 65536;
1287  v = t14 + c + 65535; c = Math.floor(v / 65536); t14 = v - c * 65536;
1288  v = t15 + c + 65535; c = Math.floor(v / 65536); t15 = v - c * 65536;
1289  t0 += c-1 + 37 * (c-1);
1290
1291  o[ 0] = t0;
1292  o[ 1] = t1;
1293  o[ 2] = t2;
1294  o[ 3] = t3;
1295  o[ 4] = t4;
1296  o[ 5] = t5;
1297  o[ 6] = t6;
1298  o[ 7] = t7;
1299  o[ 8] = t8;
1300  o[ 9] = t9;
1301  o[10] = t10;
1302  o[11] = t11;
1303  o[12] = t12;
1304  o[13] = t13;
1305  o[14] = t14;
1306  o[15] = t15;
1307}
1308
1309function S(o, a) {
1310  M(o, a, a);
1311}
1312
1313function inv25519(o, i) {
1314  var c = gf();
1315  var a;
1316  for (a = 0; a < 16; a++) c[a] = i[a];
1317  for (a = 253; a >= 0; a--) {
1318    S(c, c);
1319    if(a !== 2 && a !== 4) M(c, c, i);
1320  }
1321  for (a = 0; a < 16; a++) o[a] = c[a];
1322}
1323
1324function pow2523(o, i) {
1325  var c = gf();
1326  var a;
1327  for (a = 0; a < 16; a++) c[a] = i[a];
1328  for (a = 250; a >= 0; a--) {
1329      S(c, c);
1330      if(a !== 1) M(c, c, i);
1331  }
1332  for (a = 0; a < 16; a++) o[a] = c[a];
1333}
1334
1335function crypto_scalarmult(q, n, p) {
1336  var z = new Uint8Array(32);
1337  var x = new Float64Array(80), r, i;
1338  var a = gf(), b = gf(), c = gf(),
1339      d = gf(), e = gf(), f = gf();
1340  for (i = 0; i < 31; i++) z[i] = n[i];
1341  z[31]=(n[31]&127)|64;
1342  z[0]&=248;
1343  unpack25519(x,p);
1344  for (i = 0; i < 16; i++) {
1345    b[i]=x[i];
1346    d[i]=a[i]=c[i]=0;
1347  }
1348  a[0]=d[0]=1;
1349  for (i=254; i>=0; --i) {
1350    r=(z[i>>>3]>>>(i&7))&1;
1351    sel25519(a,b,r);
1352    sel25519(c,d,r);
1353    A(e,a,c);
1354    Z(a,a,c);
1355    A(c,b,d);
1356    Z(b,b,d);
1357    S(d,e);
1358    S(f,a);
1359    M(a,c,a);
1360    M(c,b,e);
1361    A(e,a,c);
1362    Z(a,a,c);
1363    S(b,a);
1364    Z(c,d,f);
1365    M(a,c,_121665);
1366    A(a,a,d);
1367    M(c,c,a);
1368    M(a,d,f);
1369    M(d,b,x);
1370    S(b,e);
1371    sel25519(a,b,r);
1372    sel25519(c,d,r);
1373  }
1374  for (i = 0; i < 16; i++) {
1375    x[i+16]=a[i];
1376    x[i+32]=c[i];
1377    x[i+48]=b[i];
1378    x[i+64]=d[i];
1379  }
1380  var x32 = x.subarray(32);
1381  var x16 = x.subarray(16);
1382  inv25519(x32,x32);
1383  M(x16,x16,x32);
1384  pack25519(q,x16);
1385  return 0;
1386}
1387
1388function crypto_scalarmult_base(q, n) {
1389  return crypto_scalarmult(q, n, _9);
1390}
1391
1392function crypto_box_keypair(y, x) {
1393  randombytes(x, 32);
1394  return crypto_scalarmult_base(y, x);
1395}
1396
1397function crypto_box_beforenm(k, y, x) {
1398  var s = new Uint8Array(32);
1399  crypto_scalarmult(s, x, y);
1400  return crypto_core_hsalsa20(k, _0, s, sigma);
1401}
1402
1403var crypto_box_afternm = crypto_secretbox;
1404var crypto_box_open_afternm = crypto_secretbox_open;
1405
1406function crypto_box(c, m, d, n, y, x) {
1407  var k = new Uint8Array(32);
1408  crypto_box_beforenm(k, y, x);
1409  return crypto_box_afternm(c, m, d, n, k);
1410}
1411
1412function crypto_box_open(m, c, d, n, y, x) {
1413  var k = new Uint8Array(32);
1414  crypto_box_beforenm(k, y, x);
1415  return crypto_box_open_afternm(m, c, d, n, k);
1416}
1417
1418var K = [
1419  0x428a2f98, 0xd728ae22, 0x71374491, 0x23ef65cd,
1420  0xb5c0fbcf, 0xec4d3b2f, 0xe9b5dba5, 0x8189dbbc,

1421  0x3956c25b, 0xf348b538, 0x59f111f1, 0xb605d019,
1422  0x923f82a4, 0xaf194f9b, 0xab1c5ed5, 0xda6d8118,
1423  0xd807aa98, 0xa3030242, 0x12835b01, 0x45706fbe,
1424  0x243185be, 0x4ee4b28c, 0x550c7dc3, 0xd5ffb4e2,
1425  0x72be5d74, 0xf27b896f, 0x80deb1fe, 0x3b1696b1,
1426  0x9bdc06a7, 0x25c71235, 0xc19bf174, 0xcf692694,
1427  0xe49b69c1, 0x9ef14ad2, 0xefbe4786, 0x384f25e3,
1428  0x0fc19dc6, 0x8b8cd5b5, 0x240ca1cc, 0x77ac9c65,
1429  0x2de92c6f, 0x592b0275, 0x4a7484aa, 0x6ea6e483,
1430  0x5cb0a9dc, 0xbd41fbd4, 0x76f988da, 0x831153b5,
1431  0x983e5152, 0xee66dfab, 0xa831c66d, 0x2db43210,
1432  0xb00327c8, 0x98fb213f, 0xbf597fc7, 0xbeef0ee4,
1433  0xc6e00bf3, 0x3da88fc2, 0xd5a79147, 0x930aa725,
1434  0x06ca6351, 0xe003826f, 0x14292967, 0x0a0e6e70,
1435  0x27b70a85, 0x46d22ffc, 0x2e1b2138, 0x5c26c926,
1436  0x4d2c6dfc, 0x5ac42aed, 0x53380d13, 0x9d95b3df,
1437  0x650a7354, 0x8baf63de, 0x766a0abb, 0x3c77b2a8,
1438  0x81c2c92e, 0x47edaee6, 0x92722c85, 0x1482353b,
1439  0xa2bfe8a1, 0x4cf10364, 0xa81a664b, 0xbc423001,
1440  0xc24b8b70, 0xd0f89791, 0xc76c51a3, 0x0654be30,
1441  0xd192e819, 0xd6ef5218, 0xd6990624, 0x5565a910,
1442  0xf40e3585, 0x5771202a, 0x106aa070, 0x32bbd1b8,
1443  0x19a4c116, 0xb8d2d0c8, 0x1e376c08, 0x5141ab53,
1444  0x2748774c, 0xdf8eeb99, 0x34b0bcb5, 0xe19b48a8,
1445  0x391c0cb3, 0xc5c95a63, 0x4ed8aa4a, 0xe3418acb,
1446  0x5b9cca4f, 0x7763e373, 0x682e6ff3, 0xd6b2b8a3,
1447  0x748f82ee, 0x5defb2fc, 0x78a5636f, 0x43172f60,
1448  0x84c87814, 0xa1f0ab72, 0x8cc70208, 0x1a6439ec,
1449  0x90befffa, 0x23631e28, 0xa4506ceb, 0xde82bde9,
1450  0xbef9a3f7, 0xb2c67915, 0xc67178f2, 0xe372532b,
1451  0xca273ece, 0xea26619c, 0xd186b8c7, 0x21c0c207,
1452  0xeada7dd6, 0xcde0eb1e, 0xf57d4f7f, 0xee6ed178,
1453  0x06f067aa, 0x72176fba, 0x0a637dc5, 0xa2c898a6,
1454  0x113f9804, 0xbef90dae, 0x1b710b35, 0x131c471b,
1455  0x28db77f5, 0x23047d84, 0x32caab7b, 0x40c72493,
1456  0x3c9ebe0a, 0x15c9bebc, 0x431d67c4, 0x9c100d4c,
1457  0x4cc5d4be, 0xcb3e42b6, 0x597f299c, 0xfc657e2a,
1458  0x5fcb6fab, 0x3ad6faec, 0x6c44198c, 0x4a475817
1459];
1460
1461function crypto_hashblocks_hl(hh, hl, m, n) {
1462  var wh = new Int32Array(16), wl = new Int32Array(16),
1463      bh0, bh1, bh2, bh3, bh4, bh5, bh6, bh7,
1464      bl0, bl1, bl2, bl3, bl4, bl5, bl6, bl7,
1465      th, tl, i, j, h, l, a, b, c, d;
1466
1467  var ah0 = hh[0],
1468      ah1 = hh[1],
1469      ah2 = hh[2],
1470      ah3 = hh[3],
1471      ah4 = hh[4],
1472      ah5 = hh[5],
1473      ah6 = hh[6],
1474      ah7 = hh[7],
1475
1476      al0 = hl[0],
1477      al1 = hl[1],
1478      al2 = hl[2],
1479      al3 = hl[3],
1480      al4 = hl[4],
1481      al5 = hl[5],
1482      al6 = hl[6],
1483      al7 = hl[7];
1484
1485  var pos = 0;
1486  while (n >= 128) {
1487    for (i = 0; i < 16; i++) {
1488      j = 8 * i + pos;
1489      wh[i] = (m[j+0] << 24) | (m[j+1] << 16) | (m[j+2] << 8) | m[j+3];
1490      wl[i] = (m[j+4] << 24) | (m[j+5] << 16) | (m[j+6] << 8) | m[j+7];
1491    }
1492    for (i = 0; i < 80; i++) {
1493      bh0 = ah0;
1494      bh1 = ah1;
1495      bh2 = ah2;
1496      bh3 = ah3;
1497      bh4 = ah4;
1498      bh5 = ah5;
1499      bh6 = ah6;
1500      bh7 = ah7;
1501
1502      bl0 = al0;
1503      bl1 = al1;
1504      bl2 = al2;
1505      bl3 = al3;
1506      bl4 = al4;
1507      bl5 = al5;
1508      bl6 = al6;
1509      bl7 = al7;
1510
1511      // add
1512      h = ah7;
1513      l = al7;
1514
1515      a = l & 0xffff; b = l >>> 16;
1516      c = h & 0xffff; d = h >>> 16;
1517
1518      // Sigma1
1519      h = ((ah4 >>> 14) | (al4 << (32-14))) ^ ((ah4 >>> 18) | (al4 << (32-18))) ^ ((al4 >>> (41-32)) | (ah4 << (32-(41-32))));
1520      l = ((al4 >>> 14) | (ah4 << (32-14))) ^ ((al4 >>> 18) | (ah4 << (32-18))) ^ ((ah4 >>> (41-32)) | (al4 << (32-(41-32))));
1521
1522      a += l & 0xffff; b += l >>> 16;
1523      c += h & 0xffff; d += h >>> 16;
1524
1525      // Ch
1526      h = (ah4 & ah5) ^ (~ah4 & ah6);
1527      l = (al4 & al5) ^ (~al4 & al6);
1528
1529      a += l & 0xffff; b += l >>> 16;
1530      c += h & 0xffff; d += h >>> 16;
1531
1532      // K
1533      h = K[i*2];
1534      l = K[i*2+1];
1535
1536      a += l & 0xffff; b += l >>> 16;
1537      c += h & 0xffff; d += h >>> 16;
1538
1539      // w
1540      h = wh[i%16];
1541      l = wl[i%16];
1542
1543      a += l & 0xffff; b += l >>> 16;
1544      c += h & 0xffff; d += h >>> 16;
1545
1546      b += a >>> 16;
1547      c += b >>> 16;
1548      d += c >>> 16;
1549
1550      th = c & 0xffff | d << 16;
1551      tl = a & 0xffff | b << 16;
1552
1553      // add
1554      h = th;
1555      l = tl;
1556
1557      a = l & 0xffff; b = l >>> 16;
1558      c = h & 0xffff; d = h >>> 16;
1559
1560      // Sigma0
1561      h = ((ah0 >>> 28) | (al0 << (32-28))) ^ ((al0 >>> (34-32)) | (ah0 << (32-(34-32)))) ^ ((al0 >>> (39-32)) | (ah0 << (32-(39-32))));
1562      l = ((al0 >>> 28) | (ah0 << (32-28))) ^ ((ah0 >>> (34-32)) | (al0 << (32-(34-32)))) ^ ((ah0 >>> (39-32)) | (al0 << (32-(39-32))));
1563
1564      a += l & 0xffff; b += l >>> 16;
1565      c += h & 0xffff; d += h >>> 16;
1566
1567      // Maj
1568      h = (ah0 & ah1) ^ (ah0 & ah2) ^ (ah1 & ah2);
1569      l = (al0 & al1) ^ (al0 & al2) ^ (al1 & al2);
1570
1571      a += l & 0xffff; b += l >>> 16;
1572      c += h & 0xffff; d += h >>> 16;
1573
1574      b += a >>> 16;
1575      c += b >>> 16;
1576      d += c >>> 16;
1577
1578      bh7 = (c & 0xffff) | (d << 16);
1579      bl7 = (a & 0xffff) | (b << 16);
1580
1581      // add
1582      h = bh3;
1583      l = bl3;
1584
1585      a = l & 0xffff; b = l >>> 16;
1586      c = h & 0xffff; d = h >>> 16;
1587
1588      h = th;
1589      l = tl;
1590
1591      a += l & 0xffff; b += l >>> 16;
1592      c += h & 0xffff; d += h >>> 16;
1593
1594      b += a >>> 16;
1595      c += b >>> 16;
1596      d += c >>> 16;
1597
1598      bh3 = (c & 0xffff) | (d << 16);
1599      bl3 = (a & 0xffff) | (b << 16);
1600
1601      ah1 = bh0;
1602      ah2 = bh1;
1603      ah3 = bh2;
1604      ah4 = bh3;
1605      ah5 = bh4;
1606      ah6 = bh5;
1607      ah7 = bh6;
1608      ah0 = bh7;
1609
1610      al1 = bl0;
1611      al2 = bl1;
1612      al3 = bl2;
1613      al4 = bl3;
1614      al5 = bl4;
1615      al6 = bl5;
1616      al7 = bl6;
1617      al0 = bl7;
1618
1619      if (i%16 === 15) {
1620        for (j = 0; j < 16; j++) {
1621          // add
1622          h = wh[j];
1623          l = wl[j];
1624
1625          a = l & 0xffff; b = l >>> 16;
1626          c = h & 0xffff; d = h >>> 16;
1627
1628          h = wh[(j+9)%16];
1629          l = wl[(j+9)%16];
1630
1631          a += l & 0xffff; b += l >>> 16;
1632          c += h & 0xffff; d += h >>> 16;
1633
1634          // sigma0
1635          th = wh[(j+1)%16];
1636          tl = wl[(j+1)%16];
1637          h = ((th >>> 1) | (tl << (32-1))) ^ ((th >>> 8) | (tl << (32-8))) ^ (th >>> 7);
1638          l = ((tl >>> 1) | (th << (32-1))) ^ ((tl >>> 8) | (th << (32-8))) ^ ((tl >>> 7) | (th << (32-7)));
1639
1640          a += l & 0xffff; b += l >>> 16;
1641          c += h & 0xffff; d += h >>> 16;
1642
1643          // sigma1
1644          th = wh[(j+14)%16];
1645          tl = wl[(j+14)%16];
1646          h = ((th >>> 19) | (tl << (32-19))) ^ ((tl >>> (61-32)) | (th << (32-(61-32)))) ^ (th >>> 6);
1647          l = ((tl >>> 19) | (th << (32-19))) ^ ((th >>> (61-32)) | (tl << (32-(61-32)))) ^ ((tl >>> 6) | (th << (32-6)));
1648
1649          a += l & 0xffff; b += l >>> 16;
1650          c += h & 0xffff; d += h >>> 16;
1651
1652          b += a >>> 16;
1653          c += b >>> 16;
1654          d += c >>> 16;
1655
1656          wh[j] = (c & 0xffff) | (d << 16);
1657          wl[j] = (a & 0xffff) | (b << 16);
1658        }
1659      }
1660    }
1661
1662    // add
1663    h = ah0;
1664    l = al0;
1665
1666    a = l & 0xffff; b = l >>> 16;
1667    c = h & 0xffff; d = h >>> 16;
1668
1669    h = hh[0];
1670    l = hl[0];
1671
1672    a += l & 0xffff; b += l >>> 16;
1673    c += h & 0xffff; d += h >>> 16;
1674
1675    b += a >>> 16;
1676    c += b >>> 16;
1677    d += c >>> 16;
1678
1679    hh[0] = ah0 = (c & 0xffff) | (d << 16);
1680    hl[0] = al0 = (a & 0xffff) | (b << 16);
1681
1682    h = ah1;
1683    l = al1;
1684
1685    a = l & 0xffff; b = l >>> 16;
1686    c = h & 0xffff; d = h >>> 16;
1687
1688    h = hh[1];
1689    l = hl[1];
1690
1691    a += l & 0xffff; b += l >>> 16;
1692    c += h & 0xffff; d += h >>> 16;
1693
1694    b += a >>> 16;
1695    c += b >>> 16;
1696    d += c >>> 16;
1697
1698    hh[1] = ah1 = (c & 0xffff) | (d << 16);
1699    hl[1] = al1 = (a & 0xffff) | (b << 16);
1700
1701    h = ah2;
1702    l = al2;
1703
1704    a = l & 0xffff; b = l >>> 16;
1705    c = h & 0xffff; d = h >>> 16;
1706
1707    h = hh[2];
1708    l = hl[2];
1709
1710    a += l & 0xffff; b += l >>> 16;
1711    c += h & 0xffff; d += h >>> 16;
1712
1713    b += a >>> 16;
1714    c += b >>> 16;
1715    d += c >>> 16;
1716
1717    hh[2] = ah2 = (c & 0xffff) | (d << 16);
1718    hl[2] = al2 = (a & 0xffff) | (b << 16);
1719
1720    h = ah3;
1721    l = al3;
1722
1723    a = l & 0xffff; b = l >>> 16;
1724    c = h & 0xffff; d = h >>> 16;
1725
1726    h = hh[3];
1727    l = hl[3];
1728
1729    a += l & 0xffff; b += l >>> 16;
1730    c += h & 0xffff; d += h >>> 16;
1731
1732    b += a >>> 16;
1733    c += b >>> 16;
1734    d += c >>> 16;
1735
1736    hh[3] = ah3 = (c & 0xffff) | (d << 16);
1737    hl[3] = al3 = (a & 0xffff) | (b << 16);
1738
1739    h = ah4;
1740    l = al4;
1741
1742    a = l & 0xffff; b = l >>> 16;
1743    c = h & 0xffff; d = h >>> 16;
1744
1745    h = hh[4];
1746    l = hl[4];
1747
1748    a += l & 0xffff; b += l >>> 16;
1749    c += h & 0xffff; d += h >>> 16;
1750
1751    b += a >>> 16;
1752    c += b >>> 16;
1753    d += c >>> 16;
1754
1755    hh[4] = ah4 = (c & 0xffff) | (d << 16);
1756    hl[4] = al4 = (a & 0xffff) | (b << 16);
1757
1758    h = ah5;
1759    l = al5;
1760
1761    a = l & 0xffff; b = l >>> 16;
1762    c = h & 0xffff; d = h >>> 16;
1763
1764    h = hh[5];
1765    l = hl[5];
1766
1767    a += l & 0xffff; b += l >>> 16;
1768    c += h & 0xffff; d += h >>> 16;
1769
1770    b += a >>> 16;
1771    c += b >>> 16;
1772    d += c >>> 16;
1773
1774    hh[5] = ah5 = (c & 0xffff) | (d << 16);
1775    hl[5] = al5 = (a & 0xffff) | (b << 16);
1776
1777    h = ah6;
1778    l = al6;
1779
1780    a = l & 0xffff; b = l >>> 16;
1781    c = h & 0xffff; d = h >>> 16;
1782
1783    h = hh[6];
1784    l = hl[6];
1785
1786    a += l & 0xffff; b += l >>> 16;
1787    c += h & 0xffff; d += h >>> 16;
1788
1789    b += a >>> 16;
1790    c += b >>> 16;
1791    d += c >>> 16;
1792
1793    hh[6] = ah6 = (c & 0xffff) | (d << 16);
1794    hl[6] = al6 = (a & 0xffff) | (b << 16);
1795
1796    h = ah7;
1797    l = al7;
1798
1799    a = l & 0xffff; b = l >>> 16;
1800    c = h & 0xffff; d = h >>> 16;
1801
1802    h = hh[7];
1803    l = hl[7];
1804
1805    a += l & 0xffff; b += l >>> 16;
1806    c += h & 0xffff; d += h >>> 16;
1807
1808    b += a >>> 16;
1809    c += b >>> 16;
1810    d += c >>> 16;
1811
1812    hh[7] = ah7 = (c & 0xffff) | (d << 16);
1813    hl[7] = al7 = (a & 0xffff) | (b << 16);
1814
1815    pos += 128;
1816    n -= 128;
1817  }
1818
1819  return n;
1820}
1821
1822function crypto_hash(out, m, n) {
1823  var hh = new Int32Array(8),
1824      hl = new Int32Array(8),
1825      x = new Uint8Array(256),
1826      i, b = n;
1827
1828  hh[0] = 0x6a09e667;
1829  hh[1] = 0xbb67ae85;
1830  hh[2] = 0x3c6ef372;
1831  hh[3] = 0xa54ff53a;
1832  hh[4] = 0x510e527f;
1833  hh[5] = 0x9b05688c;
1834  hh[6] = 0x1f83d9ab;
1835  hh[7] = 0x5be0cd19;
1836
1837  hl[0] = 0xf3bcc908;
1838  hl[1] = 0x84caa73b;
1839  hl[2] = 0xfe94f82b;
1840  hl[3] = 0x5f1d36f1;
1841  hl[4] = 0xade682d1;
1842  hl[5] = 0x2b3e6c1f;
1843  hl[6] = 0xfb41bd6b;
1844  hl[7] = 0x137e2179;
1845
1846  crypto_hashblocks_hl(hh, hl, m, n);
1847  n %= 128;
1848
1849  for (i = 0; i < n; i++) x[i] = m[b-n+i];
1850  x[n] = 128;
1851
1852  n = 256-128*(n<112?1:0);
1853  x[n-9] = 0;
1854  ts64(x, n-8,  (b / 0x20000000) | 0, b << 3);
1855  crypto_hashblocks_hl(hh, hl, x, n);
1856
1857  for (i = 0; i < 8; i++) ts64(out, 8*i, hh[i], hl[i]);
1858
1859  return 0;
1860}
1861
1862function add(p, q) {
1863  var a = gf(), b = gf(), c = gf(),
1864      d = gf(), e = gf(), f = gf(),
1865      g = gf(), h = gf(), t = gf();
1866
1867  Z(a, p[1], p[0]);
1868  Z(t, q[1], q[0]);
1869  M(a, a, t);
1870  A(b, p[0], p[1]);
1871  A(t, q[0], q[1]);
1872  M(b, b, t);
1873  M(c, p[3], q[3]);
1874  M(c, c, D2);
1875  M(d, p[2], q[2]);
1876  A(d, d, d);
1877  Z(e, b, a);
1878  Z(f, d, c);
1879  A(g, d, c);
1880  A(h, b, a);
1881
1882  M(p[0], e, f);
1883  M(p[1], h, g);
1884  M(p[2], g, f);
1885  M(p[3], e, h);
1886}
1887
1888function cswap(p, q, b) {
1889  var i;
1890  for (i = 0; i < 4; i++) {
1891    sel25519(p[i], q[i], b);
1892  }
1893}
1894
1895function pack(r, p) {
1896  var tx = gf(), ty = gf(), zi = gf();
1897  inv25519(zi, p[2]);
1898  M(tx, p[0], zi);
1899  M(ty, p[1], zi);
1900  pack25519(r, ty);
1901  r[31] ^= par25519(tx) << 7;
1902}
1903
1904function scalarmult(p, q, s) {
1905  var b, i;
1906  set25519(p[0], gf0);
1907  set25519(p[1], gf1);
1908  set25519(p[2], gf1);
1909  set25519(p[3], gf0);
1910  for (i = 255; i >= 0; --i) {
1911    b = (s[(i/8)|0] >> (i&7)) & 1;
1912    cswap(p, q, b);
1913    add(q, p);
1914    add(p, p);
1915    cswap(p, q, b);
1916  }
1917}
1918
1919function scalarbase(p, s) {
1920  var q = [gf(), gf(), gf(), gf()];
1921  set25519(q[0], X);
1922  set25519(q[1], Y);
1923  set25519(q[2], gf1);
1924  M(q[3], X, Y);
1925  scalarmult(p, q, s);
1926}
1927
1928function crypto_sign_keypair(pk, sk, seeded) {
1929  var d = new Uint8Array(64);
1930  var p = [gf(), gf(), gf(), gf()];
1931  var i;
1932
1933  if (!seeded) randombytes(sk, 32);
1934  crypto_hash(d, sk, 32);
1935  d[0] &= 248;
1936  d[31] &= 127;
1937  d[31] |= 64;
1938
1939  scalarbase(p, d);
1940  pack(pk, p);
1941
1942  for (i = 0; i < 32; i++) sk[i+32] = pk[i];
1943  return 0;
1944}
1945
1946var L = new Float64Array([0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, 0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x10]);
1947
1948function modL(r, x) {
1949  var carry, i, j, k;
1950  for (i = 63; i >= 32; --i) {
1951    carry = 0;
1952    for (j = i - 32, k = i - 12; j < k; ++j) {
1953      x[j] += carry - 16 * x[i] * L[j - (i - 32)];
1954      carry = Math.floor((x[j] + 128) / 256);
1955      x[j] -= carry * 256;
1956    }
1957    x[j] += carry;
1958    x[i] = 0;
1959  }
1960  carry = 0;
1961  for (j = 0; j < 32; j++) {
1962    x[j] += carry - (x[31] >> 4) * L[j];
1963    carry = x[j] >> 8;
1964    x[j] &= 255;
1965  }
1966  for (j = 0; j < 32; j++) x[j] -= carry * L[j];
1967  for (i = 0; i < 32; i++) {
1968    x[i+1] += x[i] >> 8;
1969    r[i] = x[i] & 255;
1970  }
1971}
1972
1973function reduce(r) {
1974  var x = new Float64Array(64), i;
1975  for (i = 0; i < 64; i++) x[i] = r[i];
1976  for (i = 0; i < 64; i++) r[i] = 0;
1977  modL(r, x);
1978}
1979

1980// Note: difference from C - smlen returned, not passed as argument.
1981function crypto_sign(sm, m, n, sk) {
1982  var d = new Uint8Array(64), h = new Uint8Array(64), r = new Uint8Array(64);
1983  var i, j, x = new Float64Array(64);
1984  var p = [gf(), gf(), gf(), gf()];
1985
1986  crypto_hash(d, sk, 32);
1987  d[0] &= 248;
1988  d[31] &= 127;
1989  d[31] |= 64;
1990
1991  var smlen = n + 64;
1992  for (i = 0; i < n; i++) sm[64 + i] = m[i];
1993  for (i = 0; i < 32; i++) sm[32 + i] = d[32 + i];
1994
1995  crypto_hash(r, sm.subarray(32), n+32);
1996  reduce(r);
1997  scalarbase(p, r);
1998  pack(sm, p);
1999
2000  for (i = 32; i < 64; i++) sm[i] = sk[i];
2001  crypto_hash(h, sm, n + 64);
2002  reduce(h);
2003
2004  for (i = 0; i < 64; i++) x[i] = 0;
2005  for (i = 0; i < 32; i++) x[i] = r[i];
2006  for (i = 0; i < 32; i++) {
2007    for (j = 0; j < 32; j++) {
2008      x[i+j] += h[i] * d[j];
2009    }
2010  }
2011
2012  modL(sm.subarray(32), x);
2013  return smlen;
2014}
2015
2016function unpackneg(r, p) {
2017  var t = gf(), chk = gf(), num = gf(),
2018      den = gf(), den2 = gf(), den4 = gf(),
2019      den6 = gf();
2020
2021  set25519(r[2], gf1);
2022  unpack25519(r[1], p);
2023  S(num, r[1]);
2024  M(den, num, D);
2025  Z(num, num, r[2]);
2026  A(den, r[2], den);
2027
2028  S(den2, den);
2029  S(den4, den2);
2030  M(den6, den4, den2);
2031  M(t, den6, num);
2032  M(t, t, den);
2033
2034  pow2523(t, t);
2035  M(t, t, num);
2036  M(t, t, den);
2037  M(t, t, den);
2038  M(r[0], t, den);
2039
2040  S(chk, r[0]);
2041  M(chk, chk, den);
2042  if (neq25519(chk, num)) M(r[0], r[0], I);
2043
2044  S(chk, r[0]);
2045  M(chk, chk, den);
2046  if (neq25519(chk, num)) return -1;
2047
2048  if (par25519(r[0]) === (p[31]>>7)) Z(r[0], gf0, r[0]);
2049
2050  M(r[3], r[0], r[1]);
2051  return 0;
2052}
2053
2054function crypto_sign_open(m, sm, n, pk) {
2055  var i;
2056  var t = new Uint8Array(32), h = new Uint8Array(64);
2057  var p = [gf(), gf(), gf(), gf()],
2058      q = [gf(), gf(), gf(), gf()];
2059
2060  if (n < 64) return -1;
2061
2062  if (unpackneg(q, pk)) return -1;
2063
2064  for (i = 0; i < n; i++) m[i] = sm[i];
2065  for (i = 0; i < 32; i++) m[i+32] = pk[i];
2066  crypto_hash(h, m, n);
2067  reduce(h);
2068  scalarmult(p, q, h);
2069
2070  scalarbase(q, sm.subarray(32));
2071  add(p, q);
2072  pack(t, p);
2073
2074  n -= 64;
2075  if (crypto_verify_32(sm, 0, t, 0)) {
2076    for (i = 0; i < n; i++) m[i] = 0;
2077    return -1;
2078  }
2079
2080  for (i = 0; i < n; i++) m[i] = sm[i + 64];
2081  return n;
2082}
2083
2084var crypto_secretbox_KEYBYTES = 32,
2085    crypto_secretbox_NONCEBYTES = 24,
2086    crypto_secretbox_ZEROBYTES = 32,
2087    crypto_secretbox_BOXZEROBYTES = 16,
2088    crypto_scalarmult_BYTES = 32,
2089    crypto_scalarmult_SCALARBYTES = 32,
2090    crypto_box_PUBLICKEYBYTES = 32,
2091    crypto_box_SECRETKEYBYTES = 32,
2092    crypto_box_BEFORENMBYTES = 32,
2093    crypto_box_NONCEBYTES = crypto_secretbox_NONCEBYTES,
2094    crypto_box_ZEROBYTES = crypto_secretbox_ZEROBYTES,
2095    crypto_box_BOXZEROBYTES = crypto_secretbox_BOXZEROBYTES,
2096    crypto_sign_BYTES = 64,
2097    crypto_sign_PUBLICKEYBYTES = 32,
2098    crypto_sign_SECRETKEYBYTES = 64,
2099    crypto_sign_SEEDBYTES = 32,
2100    crypto_hash_BYTES = 64;
2101
2102nacl.lowlevel = {
2103  crypto_core_hsalsa20: crypto_core_hsalsa20,
2104  crypto_stream_xor: crypto_stream_xor,
2105  crypto_stream: crypto_stream,
2106  crypto_stream_salsa20_xor: crypto_stream_salsa20_xor,
2107  crypto_stream_salsa20: crypto_stream_salsa20,
2108  crypto_onetimeauth: crypto_onetimeauth,
2109  crypto_onetimeauth_verify: crypto_onetimeauth_verify,
2110  crypto_verify_16: crypto_verify_16,
2111  crypto_verify_32: crypto_verify_32,
2112  crypto_secretbox: crypto_secretbox,
2113  crypto_secretbox_open: crypto_secretbox_open,
2114  crypto_scalarmult: crypto_scalarmult,
2115  crypto_scalarmult_base: crypto_scalarmult_base,
2116  crypto_box_beforenm: crypto_box_beforenm,
2117  crypto_box_afternm: crypto_box_afternm,
2118  crypto_box: crypto_box,
2119  crypto_box_open: crypto_box_open,
2120  crypto_box_keypair: crypto_box_keypair,
2121  crypto_hash: crypto_hash,
2122  crypto_sign: crypto_sign,
2123  crypto_sign_keypair: crypto_sign_keypair,
2124  crypto_sign_open: crypto_sign_open,
2125
2126  crypto_secretbox_KEYBYTES: crypto_secretbox_KEYBYTES,
2127  crypto_secretbox_NONCEBYTES: crypto_secretbox_NONCEBYTES,
2128  crypto_secretbox_ZEROBYTES: crypto_secretbox_ZEROBYTES,
2129  crypto_secretbox_BOXZEROBYTES: crypto_secretbox_BOXZEROBYTES,
2130  crypto_scalarmult_BYTES: crypto_scalarmult_BYTES,
2131  crypto_scalarmult_SCALARBYTES: crypto_scalarmult_SCALARBYTES,
2132  crypto_box_PUBLICKEYBYTES: crypto_box_PUBLICKEYBYTES,
2133  crypto_box_SECRETKEYBYTES: crypto_box_SECRETKEYBYTES,
2134  crypto_box_BEFORENMBYTES: crypto_box_BEFORENMBYTES,
2135  crypto_box_NONCEBYTES: crypto_box_NONCEBYTES,
2136  crypto_box_ZEROBYTES: crypto_box_ZEROBYTES,
2137  crypto_box_BOXZEROBYTES: crypto_box_BOXZEROBYTES,
2138  crypto_sign_BYTES: crypto_sign_BYTES,
2139  crypto_sign_PUBLICKEYBYTES: crypto_sign_PUBLICKEYBYTES,
2140  crypto_sign_SECRETKEYBYTES: crypto_sign_SECRETKEYBYTES,
2141  crypto_sign_SEEDBYTES: crypto_sign_SEEDBYTES,
2142  crypto_hash_BYTES: crypto_hash_BYTES,
2143
2144  gf: gf,
2145  D: D,
2146  L: L,
2147  pack25519: pack25519,
2148  unpack25519: unpack25519,
2149  M: M,
2150  A: A,
2151  S: S,
2152  Z: Z,
2153  pow2523: pow2523,
2154  add: add,
2155  set25519: set25519,
2156  modL: modL,
2157  scalarmult: scalarmult,
2158  scalarbase: scalarbase,
2159};
2160
2161/* High-level API */
2162
2163function checkLengths(k, n) {
2164  if (k.length !== crypto_secretbox_KEYBYTES) throw new Error('bad key size');
2165  if (n.length !== crypto_secretbox_NONCEBYTES) throw new Error('bad nonce size');
2166}
2167
2168function checkBoxLengths(pk, sk) {
2169  if (pk.length !== crypto_box_PUBLICKEYBYTES) throw new Error('bad public key size');
2170  if (sk.length !== crypto_box_SECRETKEYBYTES) throw new Error('bad secret key size');
2171}
2172
2173function checkArrayTypes() {
2174  for (var i = 0; i < arguments.length; i++) {
2175    if (!(arguments[i] instanceof Uint8Array))
2176      throw new TypeError('unexpected type, use Uint8Array');
2177  }
2178}
2179
2180function cleanup(arr) {
2181  for (var i = 0; i < arr.length; i++) arr[i] = 0;
2182}
2183
2184nacl.randomBytes = function(n) {
2185  var b = new Uint8Array(n);
2186  randombytes(b, n);
2187  return b;
2188};
2189
2190nacl.secretbox = function(msg, nonce, key) {
2191  checkArrayTypes(msg, nonce, key);
2192  checkLengths(key, nonce);
2193  var m = new Uint8Array(crypto_secretbox_ZEROBYTES + msg.length);
2194  var c = new Uint8Array(m.length);
2195  for (var i = 0; i < msg.length; i++) m[i+crypto_secretbox_ZEROBYTES] = msg[i];
2196  crypto_secretbox(c, m, m.length, nonce, key);
2197  return c.subarray(crypto_secretbox_BOXZEROBYTES);
2198};
2199
2200nacl.secretbox.open = function(box, nonce, key) {
2201  checkArrayTypes(box, nonce, key);
2202  checkLengths(key, nonce);
2203  var c = new Uint8Array(crypto_secretbox_BOXZEROBYTES + box.length);
2204  var m = new Uint8Array(c.length);
2205  for (var i = 0; i < box.length; i++) c[i+crypto_secretbox_BOXZEROBYTES] = box[i];
2206  if (c.length < 32) return null;
2207  if (crypto_secretbox_open(m, c, c.length, nonce, key) !== 0) return null;
2208  return m.subarray(crypto_secretbox_ZEROBYTES);
2209};
2210
2211nacl.secretbox.keyLength = crypto_secretbox_KEYBYTES;
2212nacl.secretbox.nonceLength = crypto_secretbox_NONCEBYTES;
2213nacl.secretbox.overheadLength = crypto_secretbox_BOXZEROBYTES;
2214
2215nacl.scalarMult = function(n, p) {
2216  checkArrayTypes(n, p);
2217  if (n.length !== crypto_scalarmult_SCALARBYTES) throw new Error('bad n size');
2218  if (p.length !== crypto_scalarmult_BYTES) throw new Error('bad p size');
2219  var q = new Uint8Array(crypto_scalarmult_BYTES);
2220  crypto_scalarmult(q, n, p);
2221  return q;
2222};
2223
2224nacl.scalarMult.base = function(n) {
2225  checkArrayTypes(n);
2226  if (n.length !== crypto_scalarmult_SCALARBYTES) throw new Error('bad n size');
2227  var q = new Uint8Array(crypto_scalarmult_BYTES);
2228  crypto_scalarmult_base(q, n);
2229  return q;
2230};
2231
2232nacl.scalarMult.scalarLength = crypto_scalarmult_SCALARBYTES;
2233nacl.scalarMult.groupElementLength = crypto_scalarmult_BYTES;
2234
2235nacl.box = function(msg, nonce, publicKey, secretKey) {
2236  var k = nacl.box.before(publicKey, secretKey);
2237  return nacl.secretbox(msg, nonce, k);
2238};
2239
2240nacl.box.before = function(publicKey, secretKey) {
2241  checkArrayTypes(publicKey, secretKey);
2242  checkBoxLengths(publicKey, secretKey);
2243  var k = new Uint8Array(crypto_box_BEFORENMBYTES);
2244  crypto_box_beforenm(k, publicKey, secretKey);
2245  return k;
2246};
2247
2248nacl.box.after = nacl.secretbox;
2249
2250nacl.box.open = function(msg, nonce, publicKey, secretKey) {
2251  var k = nacl.box.before(publicKey, secretKey);
2252  return nacl.secretbox.open(msg, nonce, k);
2253};
2254
2255nacl.box.open.after = nacl.secretbox.open;
2256
2257nacl.box.keyPair = function() {
2258  var pk = new Uint8Array(crypto_box_PUBLICKEYBYTES);
2259  var sk = new Uint8Array(crypto_box_SECRETKEYBYTES);
2260  crypto_box_keypair(pk, sk);
2261  return {publicKey: pk, secretKey: sk};
2262};
2263
2264nacl.box.keyPair.fromSecretKey = function(secretKey) {
2265  checkArrayTypes(secretKey);
2266  if (secretKey.length !== crypto_box_SECRETKEYBYTES)
2267    throw new Error('bad secret key size');
2268  var pk = new Uint8Array(crypto_box_PUBLICKEYBYTES);
2269  crypto_scalarmult_base(pk, secretKey);
2270  return {publicKey: pk, secretKey: new Uint8Array(secretKey)};
2271};
2272
2273nacl.box.publicKeyLength = crypto_box_PUBLICKEYBYTES;
2274nacl.box.secretKeyLength = crypto_box_SECRETKEYBYTES;
2275nacl.box.sharedKeyLength = crypto_box_BEFORENMBYTES;
2276nacl.box.nonceLength = crypto_box_NONCEBYTES;
2277nacl.box.overheadLength = nacl.secretbox.overheadLength;
2278
2279nacl.sign = function(msg, secretKey) {
2280  checkArrayTypes(msg, secretKey);
2281  if (secretKey.length !== crypto_sign_SECRETKEYBYTES)
2282    throw new Error('bad secret key size');
2283  var signedMsg = new Uint8Array(crypto_sign_BYTES+msg.length);
2284  crypto_sign(signedMsg, msg, msg.length, secretKey);
2285  return signedMsg;
2286};
2287
2288nacl.sign.open = function(signedMsg, publicKey) {
2289  checkArrayTypes(signedMsg, publicKey);
2290  if (publicKey.length !== crypto_sign_PUBLICKEYBYTES)
2291    throw new Error('bad public key size');
2292  var tmp = new Uint8Array(signedMsg.length);
2293  var mlen = crypto_sign_open(tmp, signedMsg, signedMsg.length, publicKey);
2294  if (mlen < 0) return null;
2295  var m = new Uint8Array(mlen);
2296  for (var i = 0; i < m.length; i++) m[i] = tmp[i];
2297  return m;
2298};
2299
2300nacl.sign.detached = function(msg, secretKey) {
2301  var signedMsg = nacl.sign(msg, secretKey);
2302  var sig = new Uint8Array(crypto_sign_BYTES);
2303  for (var i = 0; i < sig.length; i++) sig[i] = signedMsg[i];
2304  return sig;
2305};
2306
2307nacl.sign.detached.verify = function(msg, sig, publicKey) {
2308  checkArrayTypes(msg, sig, publicKey);
2309  if (sig.length !== crypto_sign_BYTES)
2310    throw new Error('bad signature size');
2311  if (publicKey.length !== crypto_sign_PUBLICKEYBYTES)
2312    throw new Error('bad public key size');
2313  var sm = new Uint8Array(crypto_sign_BYTES + msg.length);
2314  var m = new Uint8Array(crypto_sign_BYTES + msg.length);
2315  var i;
2316  for (i = 0; i < crypto_sign_BYTES; i++) sm[i] = sig[i];
2317  for (i = 0; i < msg.length; i++) sm[i+crypto_sign_BYTES] = msg[i];
2318  return (crypto_sign_open(m, sm, sm.length, publicKey) >= 0);
2319};
2320
2321nacl.sign.keyPair = function() {
2322  var pk = new Uint8Array(crypto_sign_PUBLICKEYBYTES);
2323  var sk = new Uint8Array(crypto_sign_SECRETKEYBYTES);
2324  crypto_sign_keypair(pk, sk);
2325  return {publicKey: pk, secretKey: sk};
2326};
2327
2328nacl.sign.keyPair.fromSecretKey = function(secretKey) {
2329  checkArrayTypes(secretKey);
2330  if (secretKey.length !== crypto_sign_SECRETKEYBYTES)
2331    throw new Error('bad secret key size');
2332  var pk = new Uint8Array(crypto_sign_PUBLICKEYBYTES);
2333  for (var i = 0; i < pk.length; i++) pk[i] = secretKey[32+i];
2334  return {publicKey: pk, secretKey: new Uint8Array(secretKey)};
2335};
2336
2337nacl.sign.keyPair.fromSeed = function(seed) {
2338  checkArrayTypes(seed);
2339  if (seed.length !== crypto_sign_SEEDBYTES)
2340    throw new Error('bad seed size');
2341  var pk = new Uint8Array(crypto_sign_PUBLICKEYBYTES);
2342  var sk = new Uint8Array(crypto_sign_SECRETKEYBYTES);
2343  for (var i = 0; i < 32; i++) sk[i] = seed[i];
2344  crypto_sign_keypair(pk, sk, true);
2345  return {publicKey: pk, secretKey: sk};
2346};
2347
2348nacl.sign.publicKeyLength = crypto_sign_PUBLICKEYBYTES;
2349nacl.sign.secretKeyLength = crypto_sign_SECRETKEYBYTES;
2350nacl.sign.seedLength = crypto_sign_SEEDBYTES;
2351nacl.sign.signatureLength = crypto_sign_BYTES;
2352
2353nacl.hash = function(msg) {
2354  checkArrayTypes(msg);
2355  var h = new Uint8Array(crypto_hash_BYTES);
2356  crypto_hash(h, msg, msg.length);
2357  return h;
2358};
2359
2360nacl.hash.hashLength = crypto_hash_BYTES;
2361
2362nacl.verify = function(x, y) {
2363  checkArrayTypes(x, y);
2364  // Zero length arguments are considered not equal.
2365  if (x.length === 0 || y.length === 0) return false;
2366  if (x.length !== y.length) return false;
2367  return (vn(x, 0, y, 0, x.length) === 0) ? true : false;
2368};
2369
2370nacl.setPRNG = function(fn) {
2371  randombytes = fn;
2372};
2373
2374(function() {
2375  // Initialize PRNG if environment provides CSPRNG.
2376  // If not, methods calling randombytes will throw.
2377  var crypto = typeof self !== 'undefined' ? (self.crypto || self.msCrypto) : null;
2378  if (crypto && crypto.getRandomValues) {
2379    // Browsers.
2380    var QUOTA = 65536;
2381    nacl.setPRNG(function(x, n) {
2382      var i, v = new Uint8Array(n);
2383      for (i = 0; i < n; i += QUOTA) {
2384        crypto.getRandomValues(v.subarray(i, i + Math.min(n - i, QUOTA)));
2385      }
2386      for (i = 0; i < n; i++) x[i] = v[i];
2387      cleanup(v);
2388    });
2389  } else if (t