1130812Smarcel 2130812Smarcel* Version 1.0.16 3130812Smarcel - Signatures computations and verifications are now way faster on 4130812Smarcel64-bit platforms with compilers supporting 128-bit arithmetic (gcc, 5130812Smarcelclang, icc). This includes the WebAssembly target. 6130812Smarcel - New low-level APIs for computations over edwards25519: 7130812Smarcel`crypto_scalarmult_ed25519()`, `crypto_scalarmult_ed25519_base()`, 8130812Smarcel`crypto_core_ed25519_is_valid_point()`, `crypto_core_ed25519_add()`, 9130812Smarcel`crypto_core_ed25519_sub()` and `crypto_core_ed25519_from_uniform()` 10130812Smarcel(elligator representative to point). 11130812Smarcel - `crypto_sign_open()`, `crypto_sign_verify_detached() and 12130812Smarcel`crypto_sign_edwards25519sha512batch_open` now reject public keys in 13130812Smarcelnon-canonical form in addition to low-order points. 14130812Smarcel - The library can be built with `ED25519_NONDETERMINISTIC` defined in 15130812Smarcelorder to use synthetic nonces for EdDSA. This is disabled by default. 16130812Smarcel - Webassembly: `crypto_pwhash_*()` functions are now included in 17130812Smarcelnon-sumo builds. 18130812Smarcel - `sodium_stackzero()` was added to wipe content off the stack. 19130812Smarcel - Android: support new SDKs where unified headers have become the 20130812Smarceldefault. 21130812Smarcel - The Salsa20-based PRNG example is now thread-safe on platforms with 22130812Smarcelsupport for thread-local storage, optionally mixes bits from RDRAND. 23130812Smarcel - CMAKE: static library detection on Unix systems has been improved 24130812Smarcel(thanks to @BurningEnlightenment, @nibua-r, @mellery451) 25130812Smarcel - Argon2 and scrypt are slightly faster on Linux. 26130812Smarcel 27130812Smarcel* Version 1.0.15 28130812Smarcel - The default password hashing algorithm is now Argon2id. The 29130812Smarcel`pwhash_str_verify()` function can still verify Argon2i hashes 30130812Smarcelwithout any changes, and `pwhash()` can still compute Argon2i hashes 31130812Smarcelas well. 32130812Smarcel - The aes128ctr primitive was removed. It was slow, non-standard, not 33130812Smarcelauthenticated, and didn't seem to be used by any opensource project. 34130812Smarcel - Argon2id required at least 3 passes like Argon2i, despite a minimum 35130812Smarcelof `1` as defined by the `OPSLIMIT_MIN` constant. This has been fixed. 36130812Smarcel - The secretstream construction was slightly changed to be consistent 37130812Smarcelwith forthcoming variants. 38130812Smarcel - The Javascript and Webassembly versions have been merged, and the 39130812Smarcelmodule now returns a `.ready` promise that will resolve after the 40130812SmarcelWebassembly code is loaded and compiled. 41130812Smarcel - Note that due to these incompatible changes, the library version 42130812Smarcelmajor was bumped up. 43130812Smarcel 44130812Smarcel* Version 1.0.14 45130812Smarcel - iOS binaries should now be compatible with WatchOS and TVOS. 46130812Smarcel - WebAssembly is now officially supported. Special thanks to 47130812Smarcel@facekapow and @pepyakin who helped to make it happen. 48130812Smarcel - Internal consistency checks failing and primitives used with 49130812Smarceldangerous/out-of-bounds/invalid parameters used to call abort(3). 50130812SmarcelNow, a custom handler *that doesn't return* can be set with the 51130812Smarcel`set_sodium_misuse()` function. It still aborts by default or if the 52130812Smarcelhandler ever returns. This is not a replacement for non-fatal, 53130812Smarcelexpected runtime errors. This handler will be only called in 54130812Smarcelunexpected situations due to potential bugs in the library or in 55130812Smarcellanguage bindings. 56130812Smarcel - `*_MESSAGEBYTES_MAX` macros (and the corresponding 57130812Smarcel`_messagebytes_max()` symbols) have been added to represent the 58130812Smarcelmaximum message size that can be safely handled by a primitive. 59130812SmarcelLanguage bindings are encouraged to check user inputs against these 60130812Smarcelmaximum lengths. 61130812Smarcel - The test suite has been extended to cover more edge cases. 62130812Smarcel - crypto_sign_ed25519_pk_to_curve25519() now rejects points that are 63130812Smarcelnot on the curve, or not in the main subgroup. 64130812Smarcel - Further changes have been made to ensure that smart compilers will 65130812Smarcelnot optimize out code that we don't want to be optimized. 66130812Smarcel - Visual Studio solutions are now included in distribution tarballs. 67130812Smarcel - The `sodium_runtime_has_*` symbols for CPU features detection are 68130812Smarcelnow defined as weak symbols, i.e. they can be replaced with an 69130812Smarcelapplication-defined implementation. This can be useful to disable 70130812SmarcelAVX* when temperature/power consumption is a concern. 71130812Smarcel - `crypto_kx_*()` now aborts if called with no non-NULL pointers to 72130812Smarcelstore keys to. 73130812Smarcel - SSE2 implementations of `crypto_verify_*()` have been added. 74130812Smarcel - Passwords can be hashed using a specific algorithm with the new 75130812Smarcel`crypto_pwhash_str_alg()` function. 76130812Smarcel - Due to popular demand, base64 encoding (`sodium_bin2base64()`) and 77130812Smarceldecoding (`sodium_base642bin()`) have been implemented. 78130812Smarcel - A new `crypto_secretstream_*()` API was added to safely encrypt files 79130812Smarceland multi-part messages. 80130812Smarcel - The `sodium_pad()` and `sodium_unpad()` helper functions have been 81130812Smarceladded in order to add & remove padding. 82130812Smarcel - An AVX512 optimized implementation of Argon2 has been added (written 83130812Smarcelby Ondrej Mosn����ek, thanks!) 84130812Smarcel - The `crypto_pwhash_str_needs_rehash()` function was added to check if 85130812Smarcela password hash string matches the given parameters, or if it needs an 86130812Smarcelupdate. 87130812Smarcel - The library can now be compiled with recent versions of 88130812Smarcelemscripten/binaryen that don't allow multiple variables declarations 89130812Smarcelusing a single `var` statement. 90130812Smarcel 91130812Smarcel* Version 1.0.13 92130812Smarcel - Javascript: the sumo builds now include all symbols. They were 93130812Smarcelpreviously limited to symbols defined in minimal builds. 94130812Smarcel - The public `crypto_pwhash_argon2i_MEMLIMIT_MAX` constant was 95130812Smarcelincorrectly defined on 32-bit platforms. This has been fixed. 96130812Smarcel - Version 1.0.12 didn't compile on OpenBSD/i386 using the base gcc 97130812Smarcelcompiler. This has been fixed. 98130812Smarcel - The Android compilation scripts have been updated for NDK r14b. 99130812Smarcel - armv7s-optimized code was re-added to iOS builds. 100130812Smarcel - An AVX2 optimized implementation of the Argon2 round function was 101130812Smarceladded. 102130812Smarcel - The Argon2id variant of Argon2 has been implemented. The 103130812Smarcelhigh-level `crypto_pwhash_str_verify()` function automatically detects 104130812Smarcelthe algorithm and can verify both Argon2i and Argon2id hashed passwords. 105130812SmarcelThe default algorithm for newly hashed passwords remains Argon2i in 106130812Smarcelthis version to avoid breaking compatibility with verifiers running 107130812Smarcellibsodium <= 1.0.12. 108130812Smarcel - A `crypto_box_curve25519xchacha20poly1305_seal*()` function set was 109130812Smarcelimplemented. 110130812Smarcel - scrypt was removed from minimal builds. 111130812Smarcel - libsodium is now available on NuGet. 112130812Smarcel 113130812Smarcel* Version 1.0.12 114130812Smarcel - Ed25519ph was implemented, adding a multi-part signature API 115130812Smarcel(`crypto_sign_init()`, `crypto_sign_update()`, `crypto_sign_final_*()`). 116130812Smarcel - New constants and related accessors have been added for Scrypt and 117130812SmarcelArgon2. 118130812Smarcel - XChaCha20 has been implemented. Like XSalsa20, this construction 119130812Smarcelextends the ChaCha20 cipher to accept a 192-bit nonce. This makes it safe 120130812Smarcelto use ChaCha20 with random nonces. 121130812Smarcel - `crypto_secretbox`, `crypto_box` and `crypto_aead` now offer 122130812Smarcelvariants leveraging XChaCha20. 123130812Smarcel - SHA-2 is about 20% faster, which also gives a speed boost to 124130812Smarcelsignature and signature verification. 125130812Smarcel - AVX2 implementations of Salsa20 and ChaCha20 have been added. They 126130812Smarcelare twice as fast as the SSE2 implementations. The speed gain is 127130812Smarceleven more significant on Windows, that previously didn't use 128130812Smarcelvectorized implementations. 129130812Smarcel - New high-level API: `crypto_kdf`, to easily derive one or more 130130812Smarcelsubkeys from a master key. 131130812Smarcel - Siphash with a 128-bit output has been implemented, and is 132130812Smarcelavailable as `crypto_shorthash_siphashx_*`. 133130812Smarcel - New `*_keygen()` helpers functions have been added to create secret 134130812Smarcelkeys for all constructions. This improves code clarity and can prevent keys 135130812Smarcelfrom being partially initialized. 136130812Smarcel - A new `randombytes_buf_deterministic()` function was added to 137130812Smarceldeterministically fill a memory region with pseudorandom data. This 138130812Smarcelfunction can especially be useful to write reproducible tests. 139130812Smarcel - A preliminary `crypto_kx_*()` API was added to compute shared session 140130812Smarcelkeys. 141130812Smarcel - AVX2 detection is more reliable. 142130812Smarcel - The pthreads library is not required any more when using MingW. 143130812Smarcel - `contrib/Findsodium.cmake` was added as an example to include 144130812Smarcellibsodium in a project using cmake. 145130812Smarcel - Compatibility with gcc 2.x has been restored. 146130812Smarcel - Minimal builds can be checked using `sodium_library_minimal()`. 147130812Smarcel - The `--enable-opt` compilation switch has become compatible with more 148130812Smarcelplatforms. 149130812Smarcel - Android builds are now using clang on platforms where it is 150130812Smarcelavailable. 151130812Smarcel 152130812Smarcel* Version 1.0.11 153130812Smarcel - `sodium_init()` is now thread-safe, and can be safely called multiple 154130812Smarceltimes. 155130812Smarcel - Android binaries now properly support 64-bit Android, targeting 156130812Smarcelplatform 24, but without breaking compatibility with platforms 16 and 157130812Smarcel21. 158130812Smarcel - Better support for old gcc versions. 159130812Smarcel - On FreeBSD, core dumps are disabled on regions allocated with 160130812Smarcelsodium allocation functions. 161130812Smarcel - AVX2 detection was fixed, resulting in faster Blake2b hashing on 162130812Smarcelplatforms where it was not properly detected. 163130812Smarcel - The Sandy2x Curve25519 implementation was not as fast as expected 164130812Smarcelon some platforms. This has been fixed. 165130812Smarcel - The NativeClient target was improved. Most notably, it now supports 166130812Smarceloptimized implementations, and uses pepper_49 by default. 167130812Smarcel - The library can be compiled with recent Emscripten versions. 168130812SmarcelChanges have been made to produce smaller code, and the default heap 169130812Smarcelsize was reduced in the standard version. 170130812Smarcel - The code can now be compiled on SLES11 service pack 4. 171130812Smarcel - Decryption functions can now accept a NULL pointer for the output. 172130812SmarcelThis checks the MAC without writing the decrypted message. 173130812Smarcel - crypto_generichash_final() now returns -1 if called twice. 174130812Smarcel - Support for Visual Studio 2008 was improved. 175130812Smarcel 176130812Smarcel* Version 1.0.10 177130812Smarcel - This release only fixes a compilation issue reported with some older 178130812Smarcelgcc versions. There are no functional changes over the previous release. 179130812Smarcel 180130812Smarcel* Version 1.0.9 181130812Smarcel - The Javascript target now includes a `--sumo` option to include all 182130812Smarcelthe symbols of the original C library. 183130812Smarcel - A detached API was added to the ChaCha20-Poly1305 and AES256-GCM 184130812Smarcelimplementations. 185130812Smarcel - The Argon2i password hashing function was added, and is accessible 186130812Smarceldirectly and through a new, high-level `crypto_pwhash` API. The scrypt 187130812Smarcelfunction remains available as well. 188130812Smarcel - A speed-record AVX2 implementation of BLAKE2b was added (thanks to 189130812SmarcelSamuel Neves). 190130812Smarcel - The library can now be compiled using C++Builder (thanks to @jcolli44) 191130812Smarcel - Countermeasures for Ed25519 signatures malleability have been added 192130812Smarcelto match the irtf-cfrg-eddsa draft (note that malleability is irrelevant to 193130812Smarcelthe standard definition of signature security). Signatures with a small-order 194130812Smarcel`R` point are now also rejected. 195130812Smarcel - Some implementations are now slightly faster when using the Clang 196130812Smarcelcompiler. 197130812Smarcel - The HChaCha20 core function was implemented (`crypto_core_hchacha20()`). 198130812Smarcel - No-op stubs were added for all AES256-GCM public functions even when 199130812Smarcelcompiled on non-Intel platforms. 200130812Smarcel - `crypt_generichash_blake2b_statebytes()` was added. 201130812Smarcel - New macros were added for the IETF variant of the ChaCha20-Poly1305 202130812Smarcelconstruction. 203130812Smarcel - The library can now be compiled on Minix. 204130812Smarcel - HEASLR is now enabled on MinGW builds. 205130812Smarcel 206130812Smarcel* Version 1.0.8 207130812Smarcel - Handle the case where the CPU supports AVX, but we are running 208130812Smarcelon an hypervisor with AVX disabled/not supported. 209130812Smarcel - Faster (2x) scalarmult_base() when using the ref10 implementation. 210130812Smarcel 211130812Smarcel* Version 1.0.7 212130812Smarcel - More functions whose return value should be checked have been 213130812Smarceltagged with `__attribute__ ((warn_unused_result))`: `crypto_box_easy()`, 214130812Smarcel`crypto_box_detached()`, `crypto_box_beforenm()`, `crypto_box()`, and 215130812Smarcel`crypto_scalarmult()`. 216130812Smarcel - Sandy2x, the fastest Curve25519 implementation ever, has been 217130812Smarcelmerged in, and is automatically used on CPUs supporting the AVX 218130812Smarcelinstructions set. 219130812Smarcel - An SSE2 optimized implementation of Poly1305 was added, and is 220130812Smarceltwice as fast as the portable one. 221130812Smarcel - An SSSE3 optimized implementation of ChaCha20 was added, and is 222130812Smarceltwice as fast as the portable one. 223130812Smarcel - Faster `sodium_increment()` for common nonce sizes. 224130812Smarcel - New helper functions have been added: `sodium_is_zero()` and 225130812Smarcel `sodium_add()`. 226130812Smarcel - `sodium_runtime_has_aesni()` now properly detects the CPU flag when 227130812Smarcel compiled using Visual Studio. 228130812Smarcel 229130812Smarcel* Version 1.0.6 230130812Smarcel - Optimized implementations of Blake2 have been added for modern 231130812SmarcelIntel platforms. `crypto_generichash()` is now faster than MD5 and SHA1 232130812Smarcelimplementations while being far more secure. 233130812Smarcel - Functions for which the return value should be checked have been 234130812Smarceltagged with `__attribute__ ((warn_unused_result))`. This will 235130812Smarcelintentionally break code compiled with `-Werror` that didn't bother 236130812Smarcelchecking critical return values. 237130812Smarcel - The `crypto_sign_edwards25519sha512batch_*()` functions have been 238130812Smarceltagged as deprecated. 239130812Smarcel - Undocumented symbols that were exported, but were only useful for 240130812Smarcelinternal purposes have been removed or made private: 241130812Smarcel`sodium_runtime_get_cpu_features()`, the implementation-specific 242130812Smarcel`crypto_onetimeauth_poly1305_donna()` symbols, 243130812Smarcel`crypto_onetimeauth_poly1305_set_implementation()`, 244130812Smarcel`crypto_onetimeauth_poly1305_implementation_name()` and 245130812Smarcel`crypto_onetimeauth_pick_best_implementation()`. 246130812Smarcel - `sodium_compare()` now works as documented, and compares numbers 247130812Smarcelin little-endian format instead of behaving like `memcmp()`. 248130812Smarcel - The previous changes should not break actual applications, but to be 249130812Smarcelsafe, the library version major was incremented. 250130812Smarcel - `sodium_runtime_has_ssse3()` and `sodium_runtime_has_sse41()` have 251130812Smarcelbeen added. 252130812Smarcel - The library can now be compiled with the CompCert compiler. 253130812Smarcel 254130812Smarcel* Version 1.0.5 255130812Smarcel - Compilation issues on some platforms were fixed: missing alignment 256130812Smarceldirectives were added (required at least on RHEL-6/i386), a workaround 257130812Smarcelfor a VRP bug on gcc/armv7 was added, and the library can now be compiled 258130812Smarcelwith the SunPro compiler. 259130812Smarcel - Javascript target: io.js is not supported any more. Use nodejs. 260130812Smarcel 261130812Smarcel* Version 1.0.4 262130812Smarcel - Support for AES256-GCM has been added. This requires 263130812Smarcela CPU with the aesni and pclmul extensions, and is accessible via the 264130812Smarcelcrypto_aead_aes256gcm_*() functions. 265130812Smarcel - The Javascript target doesn't use eval() any more, so that the 266130812Smarcellibrary can be used in Chrome packaged applications. 267130812Smarcel - QNX and CloudABI are now supported. 268130812Smarcel - Support for NaCl has finally been added. 269130812Smarcel - ChaCha20 with an extended (96 bit) nonce and a 32-bit counter has 270130812Smarcelbeen implemented as crypto_stream_chacha20_ietf(), 271130812Smarcelcrypto_stream_chacha20_ietf_xor() and crypto_stream_chacha20_ietf_xor_ic(). 272130812SmarcelAn IETF-compatible version of ChaCha20Poly1305 is available as 273130812Smarcelcrypto_aead_chacha20poly1305_ietf_npubbytes(), 274130812Smarcelcrypto_aead_chacha20poly1305_ietf_encrypt() and 275130812Smarcelcrypto_aead_chacha20poly1305_ietf_decrypt(). 276130812Smarcel - The sodium_increment() helper function has been added, to increment 277130812Smarcelan arbitrary large number (such as a nonce). 278130812Smarcel - The sodium_compare() helper function has been added, to compare 279130812Smarcelarbitrary large numbers (such as nonces, in order to prevent replay 280130812Smarcelattacks). 281130812Smarcel 282130812Smarcel* Version 1.0.3 283130812Smarcel - In addition to sodium_bin2hex(), sodium_hex2bin() is now a 284130812Smarcelconstant-time function. 285130812Smarcel - crypto_stream_xsalsa20_ic() has been added. 286130812Smarcel - crypto_generichash_statebytes(), crypto_auth_*_statebytes() and 287130812Smarcelcrypto_hash_*_statebytes() have been added in order to retrieve the 288130812Smarcelsize of structures keeping states from foreign languages. 289130812Smarcel - The JavaScript target doesn't require /dev/urandom or an external 290130812Smarcelrandombytes() implementation any more. Other minor Emscripten-related 291130812Smarcelimprovements have been made in order to support libsodium.js 292130812Smarcel - Custom randombytes implementations do not need to provide their own 293130812Smarcelimplementation of randombytes_uniform() any more. randombytes_stir() 294130812Smarceland randombytes_close() can also be NULL pointers if they are not 295130812Smarcelrequired. 296130812Smarcel - On Linux, getrandom(2) is being used instead of directly accessing 297130812Smarcel/dev/urandom, if the kernel supports this system call. 298130812Smarcel - crypto_box_seal() and crypto_box_seal_open() have been added. 299130812Smarcel - Visual Studio 2015 is now supported. 300130812Smarcel 301130812Smarcel* Version 1.0.2 302130812Smarcel - The _easy and _detached APIs now support precalculated keys; 303130812Smarcelcrypto_box_easy_afternm(), crypto_box_open_easy_afternm(), 304130812Smarcelcrypto_box_detached_afternm() and crypto_box_open_detached_afternm() 305130812Smarcelhave been added as an alternative to the NaCl interface. 306130812Smarcel - Memory allocation functions can now be used on operating systems with 307130812Smarcelno memory protection. 308130812Smarcel - crypto_sign_open() and crypto_sign_edwards25519sha512batch_open() 309130812Smarcelnow accept a NULL pointer instead of a pointer to the message size, if 310130812Smarcelstoring this information is not required. 311130812Smarcel - The close-on-exec flag is now set on the descriptor returned when 312130812Smarcelopening /dev/urandom. 313130812Smarcel - A libsodium-uninstalled.pc file to use pkg-config even when 314130812Smarcellibsodium is not installed, has been added. 315130812Smarcel - The iOS target now includes armv7s and arm64 optimized code, as well 316130812Smarcelas i386 and x86_64 code for the iOS simulator. 317130812Smarcel - sodium_free() can now be called on regions with PROT_NONE protection. 318130812Smarcel - The Javascript tests can run on Ubuntu, where the node binary was 319130812Smarcelrenamed nodejs. io.js can also be used instead of node. 320130812Smarcel 321130812Smarcel* Version 1.0.1 322130812Smarcel - DLL_EXPORT was renamed SODIUM_DLL_EXPORT in order to avoid 323130812Smarcelcollisions with similar macros defined by other libraries. 324130812Smarcel - sodium_bin2hex() is now constant-time. 325130812Smarcel - crypto_secretbox_detached() now supports overlapping input and output 326130812Smarcelregions. 327130812Smarcel - NaCl's donna_c64 implementation of curve25519 was reading an extra byte 328130812Smarcelpast the end of the buffer containing the base point. This has been 329130812Smarcelfixed. 330130812Smarcel 331130812Smarcel* Version 1.0.0 332130812Smarcel - The API and ABI are now stable. New features will be added, but 333130812Smarcelbackward-compatibility is guaranteed through all the 1.x.y releases. 334130812Smarcel - crypto_sign() properly works with overlapping regions again. Thanks 335130812Smarcelto @pysiak for reporting this regression introduced in version 0.6.1. 336130812Smarcel - The test suite has been extended. 337130812Smarcel 338130812Smarcel* Version 0.7.1 (1.0 RC2) 339130812Smarcel - This is the second release candidate of Sodium 1.0. Minor 340130812Smarcelcompilation, readability and portability changes have been made and the 341130812Smarceltest suite was improved, but the API is the same as the previous release 342130812Smarcelcandidate. 343130812Smarcel 344130812Smarcel* Version 0.7.0 (1.0 RC1) 345130812Smarcel - Allocating memory to store sensitive data can now be done using 346130812Smarcelsodium_malloc() and sodium_allocarray(). These functions add guard 347130812Smarcelpages around the protected data to make it less likely to be 348130812Smarcelaccessible in a heartbleed-like scenario. In addition, the protection 349130812Smarcelfor memory regions allocated that way can be changed using 350130812Smarcelsodium_mprotect_noaccess(), sodium_mprotect_readonly() and 351130812Smarcelsodium_mprotect_readwrite(). 352130812Smarcel - ed25519 keys can be converted to curve25519 keys with 353130812Smarcelcrypto_sign_ed25519_pk_to_curve25519() and 354130812Smarcelcrypto_sign_ed25519_sk_to_curve25519(). This allows using the same 355130812Smarcelkeys for signature and encryption. 356130812Smarcel - The seed and the public key can be extracted from an ed25519 key 357130812Smarcelusing crypto_sign_ed25519_sk_to_seed() and crypto_sign_ed25519_sk_to_pk(). 358130812Smarcel - aes256 was removed. A timing-attack resistant implementation might 359130812Smarcelbe added later, but not before version 1.0 is tagged. 360130812Smarcel - The crypto_pwhash_scryptxsalsa208sha256_* compatibility layer was 361130812Smarcelremoved. Use crypto_pwhash_scryptsalsa208sha256_*. 362130812Smarcel - The compatibility layer for implementation-specific functions was 363130812Smarcelremoved. 364130812Smarcel - Compilation issues with Mingw64 on MSYS (not MSYS2) were fixed. 365130812Smarcel - crypto_pwhash_scryptsalsa208sha256_STRPREFIX was added: it contains 366130812Smarcelthe prefix produced by crypto_pwhash_scryptsalsa208sha256_str() 367130812Smarcel 368130812Smarcel* Version 0.6.1 369130812Smarcel - Important bug fix: when crypto_sign_open() was given a signed 370130812Smarcelmessage too short to even contain a signature, it was putting an 371130812Smarcelunlimited amount of zeros into the target buffer instead of 372130812Smarcelimmediately returning -1. The bug was introduced in version 0.5.0. 373130812Smarcel - New API: crypto_sign_detached() and crypto_sign_verify_detached() 374130812Smarcelto produce and verify ed25519 signatures without having to duplicate 375130812Smarcelthe message. 376130812Smarcel - New ./configure switch: --enable-minimal, to create a smaller 377130812Smarcellibrary, with only the functions required for the high-level API. 378130812SmarcelMainly useful for the JavaScript target and embedded systems. 379130812Smarcel - All the symbols are now exported by the Emscripten build script. 380130812Smarcel - The pkg-config .pc file is now always installed even if the 381130812Smarcelpkg-config tool is not available during the installation. 382130812Smarcel 383130812Smarcel* Version 0.6.0 384130812Smarcel - The ChaCha20 stream cipher has been added, as crypto_stream_chacha20_* 385130812Smarcel - The ChaCha20Poly1305 AEAD construction has been implemented, as 386130812Smarcelcrypto_aead_chacha20poly1305_* 387130812Smarcel - The _easy API does not require any heap allocations any more and 388130812Smarceldoes not have any overhead over the NaCl API. With the password 389130812Smarcelhashing function being an obvious exception, the library doesn't 390130812Smarcelallocate and will not allocate heap memory ever. 391130812Smarcel - crypto_box and crypto_secretbox have a new _detached API to store 392130812Smarcelthe authentication tag and the encrypted message separately. 393130812Smarcel - crypto_pwhash_scryptxsalsa208sha256*() functions have been renamed 394130812Smarcelcrypto_pwhash_scryptsalsa208sha256*(). 395130812Smarcel - The low-level crypto_pwhash_scryptsalsa208sha256_ll() function 396130812Smarcelallows setting individual parameters of the scrypt function. 397130812Smarcel - New macros and functions for recommended crypto_pwhash_* parameters 398130812Smarcelhave been added. 399130812Smarcel - Similarly to crypto_sign_seed_keypair(), crypto_box_seed_keypair() 400130812Smarcelhas been introduced to deterministically generate a key pair from a seed. 401130812Smarcel - crypto_onetimeauth() now provides a streaming interface. 402130812Smarcel - crypto_stream_chacha20_xor_ic() and crypto_stream_salsa20_xor_ic() 403130812Smarcelhave been added to use a non-zero initial block counter. 404130812Smarcel - On Windows, CryptGenRandom() was replaced by RtlGenRandom(), which 405130812Smarceldoesn't require the Crypt API. 406130812Smarcel - The high bit in curve25519 is masked instead of processing the key as 407130812Smarcela 256-bit value. 408130812Smarcel - The curve25519 ref implementation was replaced by the latest ref10 409130812Smarcelimplementation from Supercop. 410130812Smarcel - sodium_mlock() now prevents memory from being included in coredumps 411130812Smarcelon Linux 3.4+ 412130812Smarcel 413130812Smarcel* Version 0.5.0 414130812Smarcel - sodium_mlock()/sodium_munlock() have been introduced to lock pages 415130812Smarcelin memory before storing sensitive data, and to zero them before 416130812Smarcelunlocking them. 417130812Smarcel - High-level wrappers for crypto_box and crypto_secretbox 418130812Smarcel(crypto_box_easy and crypto_secretbox_easy) can be used to avoid 419130812Smarceldealing with the specific memory layout regular functions depend on. 420130812Smarcel - crypto_pwhash_scryptsalsa208sha256* functions have been added 421130812Smarcelto derive a key from a password, and for password storage. 422130812Smarcel - Salsa20 and ed25519 implementations now support overlapping 423130812Smarcelinputs/keys/outputs (changes imported from supercop-20140505). 424130812Smarcel - New build scripts for Visual Studio, Emscripten, different Android 425130812Smarcelarchitectures and msys2 are available. 426130812Smarcel - The poly1305-53 implementation has been replaced with Floodyberry's 427130812Smarcelpoly1305-donna32 and poly1305-donna64 implementations. 428130812Smarcel - sodium_hex2bin() has been added to complement sodium_bin2hex(). 429130812Smarcel - On OpenBSD and Bitrig, arc4random() is used instead of reading 430130812Smarcel/dev/urandom. 431130812Smarcel - crypto_auth_hmac_sha512() has been implemented. 432130812Smarcel - sha256 and sha512 now have a streaming interface. 433130812Smarcel - hmacsha256, hmacsha512 and hmacsha512256 now support keys of 434130812Smarcelarbitrary length, and have a streaming interface. 435130812Smarcel - crypto_verify_64() has been implemented. 436130812Smarcel - first-class Visual Studio build system, thanks to @evoskuil 437 - CPU features are now detected at runtime. 438 439* Version 0.4.5 440 - Restore compatibility with OSX <= 10.6 441 442* Version 0.4.4 443 - Visual Studio is officially supported (VC 2010 & VC 2013) 444 - mingw64 is now supported 445 - big-endian architectures are now supported as well 446 - The donna_c64 implementation of curve25519_donna_c64 now handles 447non-canonical points like the ref implementation 448 - Missing scalarmult_curve25519 and stream_salsa20 constants are now exported 449 - A crypto_onetimeauth_poly1305_ref() wrapper has been added 450 451* Version 0.4.3 452 - crypto_sign_seedbytes() and crypto_sign_SEEDBYTES were added. 453 - crypto_onetimeauth_poly1305_implementation_name() was added. 454 - poly1305-ref has been replaced by a faster implementation, 455Floodyberry's poly1305-donna-unrolled. 456 - Stackmarkings have been added to assembly code, for Hardened Gentoo. 457 - pkg-config can now be used in order to retrieve compilations flags for 458using libsodium. 459 - crypto_stream_aes256estream_*() can now deal with unaligned input 460on platforms that require word alignment. 461 - portability improvements. 462 463* Version 0.4.2 464 - All NaCl constants are now also exposed as functions. 465 - The Android and iOS cross-compilation script have been improved. 466 - libsodium can now be cross-compiled to Windows from Linux. 467 - libsodium can now be compiled with emscripten. 468 - New convenience function (prototyped in utils.h): sodium_bin2hex(). 469 470* Version 0.4.1 471 - sodium_version_*() functions were not exported in version 0.4. They 472are now visible as intended. 473 - sodium_init() now calls randombytes_stir(). 474 - optimized assembly version of salsa20 is now used on amd64. 475 - further cleanups and enhanced compatibility with non-C99 compilers. 476 477* Version 0.4 478 - Most constants and operations are now available as actual functions 479instead of macros, making it easier to use from other languages. 480 - New operation: crypto_generichash, featuring a variable key size, a 481variable output size, and a streaming API. Currently implemented using 482Blake2b. 483 - The package can be compiled in a separate directory. 484 - aes128ctr functions are exported. 485 - Optimized versions of curve25519 (curve25519_donna_c64), poly1305 486(poly1305_53) and ed25519 (ed25519_ref10) are available. Optionally calling 487sodium_init() once before using the library makes it pick the fastest 488implementation. 489 - New convenience function: sodium_memzero() in order to securely 490wipe a memory area. 491 - A whole bunch of cleanups and portability enhancements. 492 - On Windows, a .REF file is generated along with the shared library, 493for use with Visual Studio. The installation path for these has become 494$prefix/bin as expected by MingW. 495 496* Version 0.3 497 - The crypto_shorthash operation has been added, implemented using 498SipHash-2-4. 499 500* Version 0.2 501 - crypto_sign_seed_keypair() has been added 502 503* Version 0.1 504 - Initial release. 505 506