https://www.poppo.com/js/axlsign.js?ver=1790070820754

1(function(axlsign) {
2'use strict';
3
4// Curve25519 signatures (and also key agreement)
5// like in the early Axolotl.
6//
7// Written by Dmitry Chestnykh.
8// You can use it under MIT or CC0 license.
9
10// Curve25519 signatures idea and math by Trevor Perrin
11// https://moderncrypto.org/mail-archive/curves/2014/000205.html
12
13// Derived from TweetNaCl.js (https://tweetnacl.js.org/)
14// Ported in 2014 by Dmitry Chestnykh and Devi Mandiri.
15// Public domain.
16//
17// Implementation derived from TweetNaCl version 20140427.
18// See for details: http://tweetnacl.cr.yp.to/
19
20var gf = function(init) {
21  var i, r = new Float64Array(16);
22  if (init) for (i = 0; i < init.length; i++) r[i] = init[i];
23  return r;
24};
25
26var _0 = new Uint8Array(16);
27var _9 = new Uint8Array(32); _9[0] = 9;
28
29var gf0 = gf(),
30    gf1 = gf([1]),
31    _121665 = gf([0xdb41, 1]),
32    D = gf([0x78a3, 0x1359, 0x4dca, 0x75eb, 0xd8ab, 0x4141, 0x0a4d, 0x0070, 0xe898, 0x7779, 0x4079, 0x8cc7, 0xfe73, 0x2b6f, 0x6cee, 0x5203]),
33    D2 = gf([0xf159, 0x26b2, 0x9b94, 0xebd6, 0xb156, 0x8283, 0x149a, 0x00e0, 0xd130, 0xeef3, 0x80f2, 0x198e, 0xfce7, 0x56df, 0xd9dc, 0x2406]),
34    X = gf([0xd51a, 0x8f25, 0x2d60, 0xc956, 0xa7b2, 0x9525, 0xc760, 0x692c, 0xdc5c, 0xfdd6, 0xe231, 0xc0a4, 0x53fe, 0xcd6e, 0x36d3, 0x2169]),
35    Y = gf([0x6658, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666, 0x6666]),
36    I = gf([0xa0b0, 0x4a0e, 0x1b27, 0xc4ee, 0xe478, 0xad2f, 0x1806, 0x2f43, 0xd7a7, 0x3dfb, 0x0099, 0x2b4d, 0xdf0b, 0x4fc1, 0x2480, 0x2b83]);
37
38function ts64(x, i, h, l) {
39  x[i]   = (h >> 24) & 0xff;
40  x[i+1] = (h >> 16) & 0xff;
41  x[i+2] = (h >>  8) & 0xff;
42  x[i+3] = h & 0xff;
43  x[i+4] = (l >> 24)  & 0xff;
44  x[i+5] = (l >> 16)  & 0xff;
45  x[i+6] = (l >>  8)  & 0xff;
46  x[i+7] = l & 0xff;
47}
48
49function vn(x, xi, y, yi, n) {
50  var i,d = 0;
51  for (i = 0; i < n; i++) d |= x[xi+i]^y[yi+i];
52  return (1 & ((d - 1) >>> 8)) - 1;
53}
54
55function crypto_verify_32(x, xi, y, yi) {
56  return vn(x,xi,y,yi,32);
57}
58
59function set25519(r, a) {
60  var i;
61  for (i = 0; i < 16; i++) r[i] = a[i]|0;
62}
63
64function car25519(o) {
65  var i, v, c = 1;
66  for (i = 0; i < 16; i++) {
67    v = o[i] + c + 65535;
68    c = Math.floor(v / 65536);
69    o[i] = v - c * 65536;
70  }
71  o[0] += c-1 + 37 * (c-1);
72}
73
74function sel25519(p, q, b) {
75  var t, c = ~(b-1);
76  for (var i = 0; i < 16; i++) {
77    t = c & (p[i] ^ q[i]);
78    p[i] ^= t;
79    q[i] ^= t;
80  }
81}
82
83function pack25519(o, n) {
84  var i, j, b;
85  var m = gf(), t = gf();
86  for (i = 0; i < 16; i++) t[i] = n[i];
87  car25519(t);
88  car25519(t);
89  car25519(t);
90  for (j = 0; j < 2; j++) {
91    m[0] = t[0] - 0xffed;
92    for (i = 1; i < 15; i++) {
93      m[i] = t[i] - 0xffff - ((m[i-1]>>16) & 1);
94      m[i-1] &= 0xffff;
95    }
96    m[15] = t[15] - 0x7fff - ((m[14]>>16) & 1);
97    b = (m[15]>>16) & 1;
98    m[14] &= 0xffff;
99    sel25519(t, m, 1-b);
100  }
101  for (i = 0; i < 16; i++) {
102    o[2*i] = t[i] & 0xff;
103    o[2*i+1] = t[i]>>8;
104  }
105}
106
107function neq25519(a, b) {
108  var c = new Uint8Array(32), d = new Uint8Array(32);
109  pack25519(c, a);
110  pack25519(d, b);
111  return crypto_verify_32(c, 0, d, 0);
112}
113
114function par25519(a) {
115  var d = new Uint8Array(32);
116  pack25519(d, a);
117  return d[0] & 1;
118}
119
120function unpack25519(o, n) {
121  var i;
122  for (i = 0; i < 16; i++) o[i] = n[2*i] + (n[2*i+1] << 8);
123  o[15] &= 0x7fff;
124}
125
126function A(o, a, b) {
127  for (var i = 0; i < 16; i++) o[i] = a[i] + b[i];
128}
129
130function Z(o, a, b) {
131  for (var i = 0; i < 16; i++) o[i] = a[i] - b[i];
132}
133
134function M(o, a, b) {
135  var v, c,
136     t0 = 0,  t1 = 0,  t2 = 0,  t3 = 0,  t4 = 0,  t5 = 0,  t6 = 0,  t7 = 0,
137     t8 = 0,  t9 = 0, t10 = 0, t11 = 0, t12 = 0, t13 = 0, t14 = 0, t15 = 0,
138    t16 = 0, t17 = 0, t18 = 0, t19 = 0, t20 = 0, t21 = 0, t22 = 0, t23 = 0,
139    t24 = 0, t25 = 0, t26 = 0, t27 = 0, t28 = 0, t29 = 0, t30 = 0,
140    b0 = b[0],
141    b1 = b[1],
142    b2 = b[2],
143    b3 = b[3],
144    b4 = b[4],
145    b5 = b[5],
146    b6 = b[6],
147    b7 = b[7],
148    b8 = b[8],
149    b9 = b[9],
150    b10 = b[10],
151    b11 = b[11],
152    b12 = b[12],
153    b13 = b[13],
154    b14 = b[14],
155    b15 = b[15];
156
157  v = a[0];
158  t0 += v * b0;
159  t1 += v * b1;
160  t2 += v * b2;
161  t3 += v * b3;
162  t4 += v * b4;
163  t5 += v * b5;
164  t6 += v * b6;
165  t7 += v * b7;
166  t8 += v * b8;
167  t9 += v * b9;
168  t10 += v * b10;
169  t11 += v * b11;
170  t12 += v * b12;
171  t13 += v * b13;
172  t14 += v * b14;
173  t15 += v * b15;
174  v = a[1];
175  t1 += v * b0;
176  t2 += v * b1;
177  t3 += v * b2;
178  t4 += v * b3;
179  t5 += v * b4;
180  t6 += v * b5;
181  t7 += v * b6;
182  t8 += v * b7;
183  t9 += v * b8;
184  t10 += v * b9;
185  t11 += v * b10;
186  t12 += v * b11;
187  t13 += v * b12;
188  t14 += v * b13;
189  t15 += v * b14;
190  t16 += v * b15;
191  v = a[2];
192  t2 += v * b0;
193  t3 += v * b1;
194  t4 += v * b2;
195  t5 += v * b3;
196  t6 += v * b4;
197  t7 += v * b5;
198  t8 += v * b6;
199  t9 += v * b7;
200  t10 += v * b8;
201  t11 += v * b9;
202  t12 += v * b10;
203  t13 += v * b11;
204  t14 += v * b12;
205  t15 += v * b13;
206  t16 += v * b14;
207  t17 += v * b15;
208  v = a[3];
209  t3 += v * b0;
210  t4 += v * b1;
211  t5 += v * b2;
212  t6 += v * b3;
213  t7 += v * b4;
214  t8 += v * b5;
215  t9 += v * b6;
216  t10 += v * b7;
217  t11 += v * b8;
218  t12 += v * b9;
219  t13 += v * b10;
220  t14 += v * b11;
221  t15 += v * b12;
222  t16 += v * b13;
223  t17 += v * b14;
224  t18 += v * b15;
225  v = a[4];
226  t4 += v * b0;
227  t5 += v * b1;
228  t6 += v * b2;
229  t7 += v * b3;
230  t8 += v * b4;
231  t9 += v * b5;
232  t10 += v * b6;
233  t11 += v * b7;
234  t12 += v * b8;
235  t13 += v * b9;
236  t14 += v * b10;
237  t15 += v * b11;
238  t16 += v * b12;
239  t17 += v * b13;
240  t18 += v * b14;
241  t19 += v * b15;
242  v = a[5];
243  t5 += v * b0;
244  t6 += v * b1;
245  t7 += v * b2;
246  t8 += v * b3;
247  t9 += v * b4;
248  t10 += v * b5;
249  t11 += v * b6;
250  t12 += v * b7;
251  t13 += v * b8;
252  t14 += v * b9;
253  t15 += v * b10;
254  t16 += v * b11;
255  t17 += v * b12;
256  t18 += v * b13;
257  t19 += v * b14;
258  t20 += v * b15;
259  v = a[6];
260  t6 += v * b0;
261  t7 += v * b1;
262  t8 += v * b2;
263  t9 += v * b3;
264  t10 += v * b4;
265  t11 += v * b5;
266  t12 += v * b6;
267  t13 += v * b7;
268  t14 += v * b8;
269  t15 += v * b9;
270  t16 += v * b10;
271  t17 += v * b11;
272  t18 += v * b12;
273  t19 += v * b13;
274  t20 += v * b14;
275  t21 += v * b15;
276  v = a[7];
277  t7 += v * b0;
278  t8 += v * b1;
279  t9 += v * b2;
280  t10 += v * b3;
281  t11 += v * b4;
282  t12 += v * b5;
283  t13 += v * b6;
284  t14 += v * b7;
285  t15 += v * b8;
286  t16 += v * b9;
287  t17 += v * b10;
288  t18 += v * b11;
289  t19 += v * b12;
290  t20 += v * b13;
291  t21 += v * b14;
292  t22 += v * b15;
293  v = a[8];
294  t8 += v * b0;
295  t9 += v * b1;
296  t10 += v * b2;
297  t11 += v * b3;
298  t12 += v * b4;
299  t13 += v * b5;
300  t14 += v * b6;
301  t15 += v * b7;
302  t16 += v * b8;
303  t17 += v * b9;
304  t18 += v * b10;
305  t19 += v * b11;
306  t20 += v * b12;
307  t21 += v * b13;
308  t22 += v * b14;
309  t23 += v * b15;
310  v = a[9];
311  t9 += v * b0;
312  t10 += v * b1;
313  t11 += v * b2;
314  t12 += v * b3;
315  t13 += v * b4;
316  t14 += v * b5;
317  t15 += v * b6;
318  t16 += v * b7;
319  t17 += v * b8;
320  t18 += v * b9;
321  t19 += v * b10;
322  t20 += v * b11;
323  t21 += v * b12;
324  t22 += v * b13;
325  t23 += v * b14;
326  t24 += v * b15;
327  v = a[10];
328  t10 += v * b0;
329  t11 += v * b1;
330  t12 += v * b2;
331  t13 += v * b3;
332  t14 += v * b4;
333  t15 += v * b5;
334  t16 += v * b6;
335  t17 += v * b7;
336  t18 += v * b8;
337  t19 += v * b9;
338  t20 += v * b10;
339  t21 += v * b11;
340  t22 += v * b12;
341  t23 += v * b13;
342  t24 += v * b14;
343  t25 += v * b15;
344  v = a[11];
345  t11 += v * b0;
346  t12 += v * b1;
347  t13 += v * b2;
348  t14 += v * b3;
349  t15 += v * b4;
350  t16 += v * b5;
351  t17 += v * b6;
352  t18 += v * b7;
353  t19 += v * b8;
354  t20 += v * b9;
355  t21 += v * b10;
356  t22 += v * b11;
357  t23 += v * b12;
358  t24 += v * b13;
359  t25 += v * b14;
360  t26 += v * b15;
361  v = a[12];
362  t12 += v * b0;
363  t13 += v * b1;
364  t14 += v * b2;
365  t15 += v * b3;
366  t16 += v * b4;
367  t17 += v * b5;
368  t18 += v * b6;
369  t19 += v * b7;
370  t20 += v * b8;
371  t21 += v * b9;
372  t22 += v * b10;
373  t23 += v * b11;
374  t24 += v * b12;
375  t25 += v * b13;
376  t26 += v * b14;
377  t27 += v * b15;
378  v = a[13];
379  t13 += v * b0;
380  t14 += v * b1;
381  t15 += v * b2;
382  t16 += v * b3;
383  t17 += v * b4;
384  t18 += v * b5;
385  t19 += v * b6;
386  t20 += v * b7;
387  t21 += v * b8;
388  t22 += v * b9;
389  t23 += v * b10;
390  t24 += v * b11;
391  t25 += v * b12;
392  t26 += v * b13;
393  t27 += v * b14;
394  t28 += v * b15;
395  v = a[14];
396  t14 += v * b0;
397  t15 += v * b1;
398  t16 += v * b2;
399  t17 += v * b3;
400  t18 += v * b4;
401  t19 += v * b5;
402  t20 += v * b6;
403  t21 += v * b7;
404  t22 += v * b8;
405  t23 += v * b9;
406  t24 += v * b10;
407  t25 += v * b11;
408  t26 += v * b12;
409  t27 += v * b13;
410  t28 += v * b14;
411  t29 += v * b15;
412  v = a[15];
413  t15 += v * b0;
414  t16 += v * b1;
415  t17 += v * b2;
416  t18 += v * b3;
417  t19 += v * b4;
418  t20 += v * b5;
419  t21 += v * b6;
420  t22 += v * b7;
421  t23 += v * b8;
422  t24 += v * b9;
423  t25 += v * b10;
424  t26 += v * b11;
425  t27 += v * b12;
426  t28 += v * b13;
427  t29 += v * b14;
428  t30 += v * b15;
429
430  t0  += 38 * t16;
431  t1  += 38 * t17;
432  t2  += 38 * t18;
433  t3  += 38 * t19;
434  t4  += 38 * t20;
435  t5  += 38 * t21;
436  t6  += 38 * t22;
437  t7  += 38 * t23;
438  t8  += 38 * t24;
439  t9  += 38 * t25;
440  t10 += 38 * t26;
441  t11 += 38 * t27;
442  t12 += 38 * t28;
443  t13 += 38 * t29;
444  t14 += 38 * t30;
445  // t15 left as is
446
447  // first car
448  c = 1;
449  v =  t0 + c + 65535; c = Math.floor(v / 65536);  t0 = v - c * 65536;
450  v =  t1 + c + 65535; c = Math.floor(v / 65536);  t1 = v - c * 65536;
451  v =  t2 + c + 65535; c = Math.floor(v / 65536);  t2 = v - c * 65536;
452  v =  t3 + c + 65535; c = Math.floor(v / 65536);  t3 = v - c * 65536;
453  v =  t4 + c + 65535; c = Math.floor(v / 65536);  t4 = v - c * 65536;
454  v =  t5 + c + 65535; c = Math.floor(v / 65536);  t5 = v - c * 65536;
455  v =  t6 + c + 65535; c = Math.floor(v / 65536);  t6 = v - c * 65536;
456  v =  t7 + c + 65535; c = Math.floor(v / 65536);  t7 = v - c * 65536;
457  v =  t8 + c + 65535; c = Math.floor(v / 65536);  t8 = v - c * 65536;
458  v =  t9 + c + 65535; c = Math.floor(v / 65536);  t9 = v - c * 65536;
459  v = t10 + c + 65535; c = Math.floor(v / 65536); t10 = v - c * 65536;
460  v = t11 + c + 65535; c = Math.floor(v / 65536); t11 = v - c * 65536;
461  v = t12 + c + 65535; c = Math.floor(v / 65536); t12 = v - c * 65536;
462  v = t13 + c + 65535; c = Math.floor(v / 65536); t13 = v - c * 65536;
463  v = t14 + c + 65535; c = Math.floor(v / 65536); t14 = v - c * 65536;
464  v = t15 + c + 65535; c = Math.floor(v / 65536); t15 = v - c * 65536;
465  t0 += c-1 + 37 * (c-1);
466
467  // second car
468  c = 1;
469  v =  t0 + c + 65535; c = Math.floor(v / 65536);  t0 = v - c * 65536;
470  v =  t1 + c + 65535; c = Math.floor(v / 65536);  t1 = v - c * 65536;
471  v =  t2 + c + 65535; c = Math.floor(v / 65536);  t2 = v - c * 65536;
472  v =  t3 + c + 65535; c = Math.floor(v / 65536);  t3 = v - c * 65536;
473  v =  t4 + c + 65535; c = Math.floor(v / 65536);  t4 = v - c * 65536;
474  v =  t5 + c + 65535; c = Math.floor(v / 65536);  t5 = v - c * 65536;
475  v =  t6 + c + 65535; c = Math.floor(v / 65536);  t6 = v - c * 65536;
476  v =  t7 + c + 65535; c = Math.floor(v / 65536);  t7 = v - c * 65536;
477  v =  t8 + c + 65535; c = Math.floor(v / 65536);  t8 = v - c * 65536;
478  v =  t9 + c + 65535; c = Math.floor(v / 65536);  t9 = v - c * 65536;
479  v = t10 + c + 65535; c = Math.floor(v / 65536); t10 = v - c * 65536;
480  v = t11 + c + 65535; c = Math.floor(v / 65536); t11 = v - c * 65536;
481  v = t12 + c + 65535; c = Math.floor(v / 65536); t12 = v - c * 65536;
482  v = t13 + c + 65535; c = Math.floor(v / 65536); t13 = v - c * 65536;
483  v = t14 + c + 65535; c = Math.floor(v / 65536); t14 = v - c * 65536;
484  v = t15 + c + 65535; c = Math.floor(v / 65536); t15 = v - c * 65536;
485  t0 += c-1 + 37 * (c-1);
486
487  o[ 0] = t0;
488  o[ 1] = t1;
489  o[ 2] = t2;
490  o[ 3] = t3;
491  o[ 4] = t4;
492  o[ 5] = t5;
493  o[ 6] = t6;
494  o[ 7] = t7;
495  o[ 8] = t8;
496  o[ 9] = t9;
497  o[10] = t10;
498  o[11] = t11;
499  o[12] = t12;
500  o[13] = t13;
501  o[14] = t14;
502  o[15] = t15;
503}
504
505function S(o, a) {
506  M(o, a, a);
507}
508
509function inv25519(o, i) {
510  var c = gf();
511  var a;
512  for (a = 0; a < 16; a++) c[a] = i[a];
513  for (a = 253; a >= 0; a--) {
514    S(c, c);
515    if(a !== 2 && a !== 4) M(c, c, i);
516  }
517  for (a = 0; a < 16; a++) o[a] = c[a];
518}
519
520function pow2523(o, i) {
521  var c = gf();
522  var a;
523  for (a = 0; a < 16; a++) c[a] = i[a];
524  for (a = 250; a >= 0; a--) {
525      S(c, c);
526      if(a !== 1) M(c, c, i);
527  }
528  for (a = 0; a < 16; a++) o[a] = c[a];
529}
530
531function crypto_scalarmult(q, n, p) {
532  var z = new Uint8Array(32);
533  var x = new Float64Array(80), r, i;
534  var a = gf(), b = gf(), c = gf(),
535      d = gf(), e = gf(), f = gf();
536  for (i = 0; i < 31; i++) z[i] = n[i];
537  z[31]=(n[31]&127)|64;
538  z[0]&=248;
539  unpack25519(x,p);
540  for (i = 0; i < 16; i++) {
541    b[i]=x[i];
542    d[i]=a[i]=c[i]=0;
543  }
544  a[0]=d[0]=1;
545  for (i=254; i>=0; --i) {
546    r=(z[i>>>3]>>>(i&7))&1;
547    sel25519(a,b,r);
548    sel25519(c,d,r);
549    A(e,a,c);
550    Z(a,a,c);
551    A(c,b,d);
552    Z(b,b,d);
553    S(d,e);
554    S(f,a);
555    M(a,c,a);
556    M(c,b,e);
557    A(e,a,c);
558    Z(a,a,c);
559    S(b,a);
560    Z(c,d,f);
561    M(a,c,_121665);
562    A(a,a,d);
563    M(c,c,a);
564    M(a,d,f);
565    M(d,b,x);
566    S(b,e);
567    sel25519(a,b,r);
568    sel25519(c,d,r);
569  }
570  for (i = 0; i < 16; i++) {
571    x[i+16]=a[i];
572    x[i+32]=c[i];
573    x[i+48]=b[i];
574    x[i+64]=d[i];
575  }
576  var x32 = x.subarray(32);
577  var x16 = x.subarray(16);
578  inv25519(x32,x32);
579  M(x16,x16,x32);
580  pack25519(q,x16);
581  return 0;
582}
583
584function crypto_scalarmult_base(q, n) {
585  return crypto_scalarmult(q, n, _9

585);
586}
587
588var K = [
589  0x428a2f98, 0xd728ae22, 0x71374491, 0x23ef65cd,
590  0xb5c0fbcf, 0xec4d3b2f, 0xe9b5dba5, 0x8189dbbc,
591  0x3956c25b, 0xf348b538, 0x59f111f1, 0xb605d019,
592  0x923f82a4, 0xaf194f9b, 0xab1c5ed5, 0xda6d8118,
593  0xd807aa98, 0xa3030242, 0x12835b01, 0x45706fbe,
594  0x243185be, 0x4ee4b28c, 0x550c7dc3, 0xd5ffb4e2,
595  0x72be5d74, 0xf27b896f, 0x80deb1fe, 0x3b1696b1,
596  0x9bdc06a7, 0x25c71235, 0xc19bf174, 0xcf692694,
597  0xe49b69c1, 0x9ef14ad2, 0xefbe4786, 0x384f25e3,
598  0x0fc19dc6, 0x8b8cd5b5, 0x240ca1cc, 0x77ac9c65,
599  0x2de92c6f, 0x592b0275, 0x4a7484aa, 0x6ea6e483,
600  0x5cb0a9dc, 0xbd41fbd4, 0x76f988da, 0x831153b5,
601  0x983e5152, 0xee66dfab, 0xa831c66d, 0x2db43210,
602  0xb00327c8, 0x98fb213f, 0xbf597fc7, 0xbeef0ee4,
603  0xc6e00bf3, 0x3da88fc2, 0xd5a79147, 0x930aa725,
604  0x06ca6351, 0xe003826f, 0x14292967, 0x0a0e6e70,
605  0x27b70a85, 0x46d22ffc, 0x2e1b2138, 0x5c26c926,
606  0x4d2c6dfc, 0x5ac42aed, 0x53380d13, 0x9d95b3df,
607  0x650a7354, 0x8baf63de, 0x766a0abb, 0x3c77b2a8,
608  0x81c2c92e, 0x47edaee6, 0x92722c85, 0x1482353b,
609  0xa2bfe8a1, 0x4cf10364, 0xa81a664b, 0xbc423001,
610  0xc24b8b70, 0xd0f89791, 0xc76c51a3, 0x0654be30,
611  0xd192e819, 0xd6ef5218, 0xd6990624, 0x5565a910,
612  0xf40e3585, 0x5771202a, 0x106aa070, 0x32bbd1b8,
613  0x19a4c116, 0xb8d2d0c8, 0x1e376c08, 0x5141ab53,
614  0x2748774c, 0xdf8eeb99, 0x34b0bcb5, 0xe19b48a8,
615  0x391c0cb3, 0xc5c95a63, 0x4ed8aa4a, 0xe3418acb,
616  0x5b9cca4f, 0x7763e373, 0x682e6ff3, 0xd6b2b8a3,
617  0x748f82ee, 0x5defb2fc, 0x78a5636f, 0x43172f60,
618  0x84c87814, 0xa1f0ab72, 0x8cc70208, 0x1a6439ec,
619  0x90befffa, 0x23631e28, 0xa4506ceb, 0xde82bde9,
620  0xbef9a3f7, 0xb2c67915, 0xc67178f2, 0xe372532b,
621  0xca273ece, 0xea26619c, 0xd186b8c7, 0x21c0c207,
622  0xeada7dd6, 0xcde0eb1e, 0xf57d4f7f, 0xee6ed178,
623  0x06f067aa, 0x72176fba, 0x0a637dc5, 0xa2c898a6,
624  0x113f9804, 0xbef90dae, 0x1b710b35, 0x131c471b,
625  0x28db77f5, 0x23047d84, 0x32caab7b, 0x40c72493,
626  0x3c9ebe0a, 0x15c9bebc, 0x431d67c4, 0x9c100d4c,
627  0x4cc5d4be, 0xcb3e42b6, 0x597f299c, 0xfc657e2a,
628  0x5fcb6fab, 0x3ad6faec, 0x6c44198c, 0x4a475817
629];
630
631function crypto_hashblocks_hl(hh, hl, m, n) {
632  var wh = new Int32Array(16), wl = new Int32Array(16),
633      bh0, bh1, bh2, bh3, bh4, bh5, bh6, bh7,
634      bl0, bl1, bl2, bl3, bl4, bl5, bl6, bl7,
635      th, tl, i, j, h, l, a, b, c, d;
636
637  var ah0 = hh[0],
638      ah1 = hh[1],
639      ah2 = hh[2],
640      ah3 = hh[3],
641      ah4 = hh[4],
642      ah5 = hh[5],
643      ah6 = hh[6],
644      ah7 = hh[7],
645
646      al0 = hl[0],
647      al1 = hl[1],
648      al2 = hl[2],
649      al3 = hl[3],
650      al4 = hl[4],
651      al5 = hl[5],
652      al6 = hl[6],
653      al7 = hl[7];
654
655  var pos = 0;
656  while (n >= 128) {
657    for (i = 0; i < 16; i++) {
658      j = 8 * i + pos;
659      wh[i] = (m[j+0] << 24) | (m[j+1] << 16) | (m[j+2] << 8) | m[j+3];
660      wl[i] = (m[j+4] << 24) | (m[j+5] << 16) | (m[j+6] << 8) | m[j+7];
661    }
662    for (i = 0; i < 80; i++) {
663      bh0 = ah0;
664      bh1 = ah1;
665      bh2 = ah2;
666      bh3 = ah3;
667      bh4 = ah4;
668      bh5 = ah5;
669      bh6 = ah6;
670      bh7 = ah7;
671
672      bl0 = al0;
673      bl1 = al1;
674      bl2 = al2;
675      bl3 = al3;
676      bl4 = al4;
677      bl5 = al5;
678      bl6 = al6;
679      bl7 = al7;
680
681      // add
682      h = ah7;
683      l = al7;
684
685      a = l & 0xffff; b = l >>> 16;
686      c = h & 0xffff; d = h >>> 16;
687
688      // Sigma1
689      h = ((ah4 >>> 14) | (al4 << (32-14))) ^ ((ah4 >>> 18) | (al4 << (32-18))) ^ ((al4 >>> (41-32)) | (ah4 << (32-(41-32))));
690      l = ((al4 >>> 14) | (ah4 << (32-14))) ^ ((al4 >>> 18) | (ah4 << (32-18))) ^ ((ah4 >>> (41-32)) | (al4 << (32-(41-32))));
691
692      a += l & 0xffff; b += l >>> 16;
693      c += h & 0xffff; d += h >>> 16;
694
695      // Ch
696      h = (ah4 & ah5) ^ (~ah4 & ah6);
697      l = (al4 & al5) ^ (~al4 & al6);
698
699      a += l & 0xffff; b += l >>> 16;
700      c += h & 0xffff; d += h >>> 16;
701
702      // K
703      h = K[i*2];
704      l = K[i*2+1];
705
706      a += l & 0xffff; b += l >>> 16;
707      c += h & 0xffff; d += h >>> 16;
708
709      // w
710      h = wh[i%16];
711      l = wl[i%16];
712
713      a += l & 0xffff; b += l >>> 16;
714      c += h & 0xffff; d += h >>> 16;
715
716      b += a >>> 16;
717      c += b >>> 16;
718      d += c >>> 16;
719
720      th = c & 0xffff | d << 16;
721      tl = a & 0xffff | b << 16;
722
723      // add
724      h = th;
725      l = tl;
726
727      a = l & 0xffff; b = l >>> 16;
728      c = h & 0xffff; d = h >>> 16;
729
730      // Sigma0
731      h = ((ah0 >>> 28) | (al0 << (32-28))) ^ ((al0 >>> (34-32)) | (ah0 << (32-(34-32)))) ^ ((al0 >>> (39-32)) | (ah0 << (32-(39-32))));
732      l = ((al0 >>> 28) | (ah0 << (32-28))) ^ ((ah0 >>> (34-32)) | (al0 << (32-(34-32)))) ^ ((ah0 >>> (39-32)) | (al0 << (32-(39-32))));
733
734      a += l & 0xffff; b += l >>> 16;
735      c += h & 0xffff; d += h >>> 16;
736
737      // Maj
738      h = (ah0 & ah1) ^ (ah0 & ah2) ^ (ah1 & ah2);
739      l = (al0 & al1) ^ (al0 & al2) ^ (al1 & al2);
740
741      a += l & 0xffff; b += l >>> 16;
742      c += h & 0xffff; d += h >>> 16;
743
744      b += a >>> 16;
745      c += b >>> 16;
746      d += c >>> 16;
747
748      bh7 = (c & 0xffff) | (d << 16);
749      bl7 = (a & 0xffff) | (b << 16);
750
751      // add
752      h = bh3;
753      l = bl3;
754
755      a = l & 0xffff; b = l >>> 16;
756      c = h & 0xffff; d = h >>> 16;
757
758      h = th;
759      l = tl;
760
761      a += l & 0xffff; b += l >>> 16;
762      c += h & 0xffff; d += h >>> 16;
763
764      b += a >>> 16;
765      c += b >>> 16;
766      d += c >>> 16;
767
768      bh3 = (c & 0xffff) | (d << 16);
769      bl3 = (a & 0xffff) | (b << 16);
770
771      ah1 = bh0;
772      ah2 = bh1;
773      ah3 = bh2;
774      ah4 = bh3;
775      ah5 = bh4;
776      ah6 = bh5;
777      ah7 = bh6;
778      ah0 = bh7;
779
780      al1 = bl0;
781      al2 = bl1;
782      al3 = bl2;
783      al4 = bl3;
784      al5 = bl4;
785      al6 = bl5;
786      al7 = bl6;
787      al0 = bl7;
788
789      if (i%16 === 15) {
790        for (j = 0; j < 16; j++) {
791          // add
792          h = wh[j];
793          l = wl[j];
794
795          a = l & 0xffff; b = l >>> 16;
796          c = h & 0xffff; d = h >>> 16;
797
798          h = wh[(j+9)%16];
799          l = wl[(j+9)%16];
800
801          a += l & 0xffff; b += l >>> 16;
802          c += h & 0xffff; d += h >>> 16;
803
804          // sigma0
805          th = wh[(j+1)%16];
806          tl = wl[(j+1)%16];
807          h = ((th >>> 1) | (tl << (32-1))) ^ ((th >>> 8) | (tl << (32-8))) ^ (th >>> 7);
808          l = ((tl >>> 1) | (th << (32-1))) ^ ((tl >>> 8) | (th << (32-8))) ^ ((tl >>> 7) | (th << (32-7)));
809
810          a += l & 0xffff; b += l >>> 16;
811          c += h & 0xffff; d += h >>> 16;
812
813          // sigma1
814          th = wh[(j+14)%16];
815          tl = wl[(j+14)%16];
816          h = ((th >>> 19) | (tl << (32-19))) ^ ((tl >>> (61-32)) | (th << (32-(61-32)))) ^ (th >>> 6);
817          l = ((tl >>> 19) | (th << (32-19))) ^ ((th >>> (61-32)) | (tl << (32-(61-32)))) ^ ((tl >>> 6) | (th << (32-6)));
818
819          a += l & 0xffff; b += l >>> 16;
820          c += h & 0xffff; d += h >>> 16;
821
822          b += a >>> 16;
823          c += b >>> 16;
824          d += c >>> 16;
825
826          wh[j] = (c & 0xffff) | (d << 16);
827          wl[j] = (a & 0xffff) | (b << 16);
828        }
829      }
830    }
831
832    // add
833    h = ah0;
834    l = al0;
835
836    a = l & 0xffff; b = l >>> 16;
837    c = h & 0xffff; d = h >>> 16;
838
839    h = hh[0];
840    l = hl[0];
841
842    a += l & 0xffff; b += l >>> 16;
843    c += h & 0xffff; d += h >>> 16;
844
845    b += a >>> 16;
846    c += b >>> 16;
847    d += c >>> 16;
848
849    hh[0] = ah0 = (c & 0xffff) | (d << 16);
850    hl[0] = al0 = (a & 0xffff) | (b << 16);
851
852    h = ah1;
853    l = al1;
854
855    a = l & 0xffff; b = l >>> 16;
856    c = h & 0xffff; d = h >>> 16;
857
858    h = hh[1];
859    l = hl[1];
860
861    a += l & 0xffff; b += l >>> 16;
862    c += h & 0xffff; d += h >>> 16;
863
864    b += a >>> 16;
865    c += b >>> 16;
866    d += c >>> 16;
867
868    hh[1] = ah1 = (c & 0xffff) | (d << 16);
869    hl[1] = al1 = (a & 0xffff) | (b << 16);
870
871    h = ah2;
872    l = al2;
873
874    a = l & 0xffff; b = l >>> 16;
875    c = h & 0xffff; d = h >>> 16;
876
877    h = hh[2];
878    l = hl[2];
879
880    a += l & 0xffff; b += l >>> 16;
881    c += h & 0xffff; d += h >>> 16;
882
883    b += a >>> 16;
884    c += b >>> 16;
885    d += c >>> 16;
886
887    hh[2] = ah2 = (c & 0xffff) | (d << 16);
888    hl[2] = al2 = (a & 0xffff) | (b << 16);
889
890    h = ah3;
891    l = al3;
892
893    a = l & 0xffff; b = l >>> 16;
894    c = h & 0xffff; d = h >>> 16;
895
896    h = hh[3];
897    l = hl[3];
898
899    a += l & 0xffff; b += l >>> 16;
900    c += h & 0xffff; d += h >>> 16;
901
902    b += a >>> 16;
903    c += b >>> 16;
904    d += c >>> 16;
905
906    hh[3] = ah3 = (c & 0xffff) | (d << 16);
907    hl[3] = al3 = (a & 0xffff) | (b << 16);
908
909    h = ah4;
910    l = al4;
911
912    a = l & 0xffff; b = l >>> 16;
913    c = h & 0xffff; d = h >>> 16;
914
915    h = hh[4];
916    l = hl[4];
917
918    a += l & 0xffff; b += l >>> 16;
919    c += h & 0xffff; d += h >>> 16;
920
921    b += a >>> 16;
922    c += b >>> 16;
923    d += c >>> 16;
924
925    hh[4] = ah4 = (c & 0xffff) | (d << 16);
926    hl[4] = al4 = (a & 0xffff) | (b << 16);
927
928    h = ah5;
929    l = al5;
930
931    a = l & 0xffff; b = l >>> 16;
932    c = h & 0xffff; d = h >>> 16;
933
934    h = hh[5];
935    l = hl[5];
936
937    a += l & 0xffff; b += l >>> 16;
938    c += h & 0xffff; d += h >>> 16;
939
940    b += a >>> 16;
941    c += b >>> 16;
942    d += c >>> 16;
943
944    hh[5] = ah5 = (c & 0xffff) | (d << 16);
945    hl[5] = al5 = (a & 0xffff) | (b << 16);
946
947    h = ah6;
948    l = al6;
949
950    a = l & 0xffff; b = l >>> 16;
951    c = h & 0xffff; d = h >>> 16;
952
953    h = hh[6];
954    l = hl[6];
955
956    a += l & 0xffff; b += l >>> 16;
957    c += h & 0xffff; d += h >>> 16;
958
959    b += a >>> 16;
960    c += b >>> 16;
961    d += c >>> 16;
962
963    hh[6] = ah6 = (c & 0xffff) | (d << 16);
964    hl[6] = al6 = (a & 0xffff) | (b << 16);
965
966    h = ah7;
967    l = al7;
968
969    a = l & 0xffff; b = l >>> 16;
970    c = h & 0xffff; d = h >>> 16;
971
972    h = hh[7];
973    l = hl[7];
974
975    a += l & 0xffff; b += l >>> 16;
976    c += h & 0xffff; d += h >>> 16;
977
978    b += a >>> 16;
979    c += b >>> 16;
980    d += c >>> 16;
981
982    hh[7] = ah7 = (c & 0xffff) | (d << 16);
983    hl[7] = al7 = (a & 0xffff) | (b << 16);
984
985    pos += 128;
986    n -= 128;
987  }
988
989  return n;
990}
991
992function crypto_hash(out, m, n) {
993  var hh = new Int32Array(8),
994      hl = new Int32Array(8),
995      x = new Uint8Array(256),
996      i, b = n;
997
998  hh[0] = 0x6a09e667;
999  hh[1] = 0xbb67ae85;
1000  hh[2] = 0x3c6ef372;
1001  hh[3] = 0xa54ff53a;
1002  hh[4] = 0x510e527f;
1003  hh[5] = 0x9b05688c;
1004  hh[6] = 0x1f83d9ab;
1005  hh[7] = 0x5be0cd19;
1006
1007  hl[0] = 0xf3bcc908;
1008  hl[1] = 0x84caa73b;
1009  hl[2] = 0xfe94f82b;
1010  hl[3] = 0x5f1d36f1;
1011  hl[4] = 0xade682d1;
1012  hl[5] = 0x2b3e6c1f;
1013  hl[6] = 0xfb41bd6b;
1014  hl[7] = 0x137e2179;
1015
1016  crypto_hashblocks_hl(hh, hl, m, n);
1017  n %= 128;
1018
1019  for (i = 0; i < n; i++) x[i] = m[b-n+i];
1020  x[n] = 128;
1021
1022  n = 256-128*(n<112?1:0);
1023  x[n-9] = 0;
1024  ts64(x, n-8,  (b / 0x20000000) | 0, b << 3);
1025  crypto_hashblocks_hl(hh, hl, x, n);
1026
1027  for (i = 0; i < 8; i++) ts64(out, 8*i, hh[i], hl[i]);
1028
1029  return 0;
1030}
1031
1032function add(p, q) {
1033  var a = gf(), b = gf(), c = gf(),
1034      d = gf(), e = gf(), f = gf(),
1035      g = gf(), h = gf(), t = gf();
1036
1037  Z(a, p[1], p[0]);
1038  Z(t, q[1], q[0]);
1039  M(a, a, t);
1040  A(b, p[0], p[1]);
1041  A(t, q[0], q[1]);
1042  M(b, b, t);
1043  M(c, p[3], q[3]);
1044  M(c, c, D2);
1045  M(d, p[2], q[2]);
1046  A(d, d, d);
1047  Z(e, b, a);
1048  Z(f, d, c);
1049  A(g, d, c);
1050  A(h, b, a);
1051
1052  M(p[0], e, f);
1053  M(p[1], h, g);
1054  M(p[2], g, f);
1055  M(p[3], e, h);
1056}
1057
1058function cswap(p, q, b) {
1059  var i;
1060  for (i = 0; i < 4; i++) {
1061    sel25519(p[i], q[i], b);
1062  }
1063}
1064
1065function pack(r, p) {
1066  var tx = gf(), ty = gf(), zi = gf();
1067  inv25519(zi, p[2]);
1068  M(tx, p[0], zi);
1069  M(ty, p[1], zi);
1070  pack25519(r, ty);
1071  r[31] ^= par25519(tx) << 7;
1072}
1073
1074function scalarmult(p, q, s) {
1075  var b, i;
1076  set25519(p[0], gf0);
1077  set25519(p[1], gf1);
1078  set25519(p[2], gf1);
1079  set25519(p[3], gf0);
1080  for (i = 255; i >= 0; --i) {
1081    b = (s[(i/8)|0] >> (i&7)) & 1;
1082    cswap(p, q, b);
1083    add(q, p);
1084    add(p, p);
1085    cswap(p, q, b);
1086  }
1087}
1088
1089function scalarbase(p, s) {
1090  var q = [gf(), gf(), gf(), gf()];
1091  set25519(q[0], X);
1092  set25519(q[1], Y);
1093  set25519(q[2], gf1);
1094  M(q[3], X, Y);
1095  scalarmult(p, q, s);
1096}
1097