- Parametrise both HMAC cores by initial state and inner hash length, so that SHA-224 rides on the SHA-256 core and SHA-384 on the SHA-512 one, and encode the length of the outer message from that inner length instead of a constant, since a shortened inner result moves where the padding begins - Offer -hmac224 and -hmac384 in nacl::auth and nacl::auth verify, taking the tag length from the variant through Tnacl_AuthBytes, and lift the option enum out of the command so the helpers can name its values - Shorten a key longer than the block size with the hash of its own variant rather than with the hash of equal block size: SHA-224 and SHA-384 start from a different state, so the previous choice by block size produced a tag from length 65 respectively 129 upwards that no other implementation agrees with - Add crypto_hash_sha224_ref and crypto_hash_sha384_ref for that purpose, placed beside the HMAC that needs them, where the initial state already resides - Verify a 28 byte tag through two overlapping crypto_verify_16 and a 48 byte one through a crypto_verify_32 plus a crypto_verify_16, both joined by a bitwise or so that every byte is compared on every call - Cover all seven RFC 4231 vectors for both new algorithms in tests/auth.test as rows auth-9 to auth-11, and add auth-12 for the tag lengths of all five variants, the refusal of a wrong length, and the fact that neither new tag is a prefix of its bigger sibling - Document the five variants in README, doc/help.txt and doc/examples.txt, including which of them JWT calls HS256, HS384 and HS512 check-in: c6bed6ff35 user: alex tags: trunk

- Add generic/crypto_auth_hmacsha512.c with the shared core of both SHA-512 based HMACs, crypto_auth_hmacsha512_ref_kpad_out, which takes the tag length as a parameter, and the hmacsha512 API on top of it with 64 bytes - Reduce generic/crypto_auth_hmacsha512256.c to calls into that core with a length of 32, its outer API untouched - the primitive behaves exactly as before, it merely stops carrying a second copy of the computation - Verify a 64 byte tag through two calls to crypto_verify_32 joined by a bitwise or, so that both halves are compared every time and the running time does not depend on where the first difference sits - Offer -hmac512 in nacl::auth and nacl::auth verify, with the tag length following the variant instead of being crypto_auth_BYTES throughout, and refuse a tag that does not have the length of the variant asked for - Cover all seven RFC 4231 vectors for the untruncated result in tests/auth.test as rows auth-6 and auth-7, and add auth-8 for the tag length, the prefix relation to -hmac512256, a wrong tag length, a wrong key and a flipped bit in the second half - Document the option in README, doc/help.txt and doc/examples.txt together with the criterion for choosing: -hmac512256 is the crypto_auth of NaCl, -hmac512 is what RFC 4231 and JWT HS512 are defined on - Note in all three that option names are matched by prefix, so on a build without -hmac512 that string is an unambiguous prefix of -hmac512256 and yields 32 bytes instead of 64 with no error to catch - Correct a typo in doc/examples.txt where the onetimeauth example called nacl: onetimeauth with a single colon check-in: 4ff29f467e user: alex tags: trunk

- Reach manifest, manifest.uuid and mkversion.tcl through srcdir in the rule for manifest.h, so that a build directory outside the source tree finds them instead of looking beside the Makefile - Let tools/mkversion.tcl change into the source tree on its own, derived from the location of the script, as it reads manifest, manifest.uuid and configure.ac by relative path and would otherwise depend on the directory it was started from - Test for the file in install-doc before installing it, so that a doc directory holding no .n page leaves the unexpanded glob with install and aborts the run no longer check-in: 7df39161a3 user: alex tags: trunk

- Check for sys/random.h in CHECK_FOR_GETRANDOM and include it in randombytes.c, since glibc declares getrandom there while linux/random.h only carries the GRND_ flags - without it the function stays implicitly declared, which a compiler defaulting to C23 treats as an error rather than a warning - Guard the include of linux/random.h with HAVE_LINUX_RANDOM_H, which configure has been defining all along without anyone acting on it - Treat a negative result of getrandom as the failure it is: the previous expression returned success for it, because -1 is true in C, leaving the caller with an uninitialised buffer where key material was expected - Loop around getrandom instead of calling it once, as GRND_RANDOM yields at most 512 bytes per call and any call can be cut short by a signal, and retry on EINTR check-in: 243a909988 user: alex tags: trunk

- Name the built artifact as libtcl9nacl1.3.dylib in both places where the skill refers to it, in the loading note at the top and in the reference list at the end - Read 1.3 in the sample output of nacl::build-info, and put a placeholder in the position of the check-in uuid instead of a literal one, which would go stale with the next commit anyway check-in: 11c701b42e user: alex tags: trunk

- Integrate the branch modern, whose single check-in swaps ClientData for void* in the ten command handlers and in the eleven client data casts of Tcl_CreateObjCommand - Settle the mixed style that had crept in: Tnacl_BuildInfo was already declared with void* while every older handler still used ClientData, so nacl.c spelled the same thing two ways - Note that this is a matter of spelling rather than of compatibility - tcl.h declares ClientData as a plain typedef of void* in 8.6 as well as in 9.0, with no deprecation guard around it, so neither form breaks anywhere - Close the branch through the integrate flag, since it had been sitting unmerged since january while trunk moved on six check-ins, and a longer divergence only makes the merge harder check-in: d8ba755d29 user: alex tags: trunk

- Add claude/nacl-tcl/SKILL.md, a guide to using the package from Tcl - the calling convention, which primitive to pick for a given task, a recipe per command, the mistakes worth catching, and the info, manifest and build-info commands for looking sizes and versions up at runtime - Add references/secretbox-store.tcl with secretbox-store-test.tcl, a ready made module keeping secrets at rest as a self describing enc:base64url blob with a fresh nonce per call - Add references/config-secrets.md as the rationale behind that storage pattern, covering the dual read migration and the question of where the key itself lives - Add references/jwt-hs256.tcl with jwt-hs256-test.tcl, a worked example of a MAC whose key is chosen by the peer - it checks the token header against the expected algorithm instead of trusting it, validates the signature length before nacl::auth verify sees it, enforces exp and nbf, and hands the secret over at its original length - Ask for Tcl 8.6- instead of 8.6 in both modules, as the strict form refuses to load under Tcl 9 - Evaluate the script of the throws helper in both test suites through uplevel #0, without which it runs in the wrong scope and the test passes on a missing variable rather than on the error it means to provoke check-in: bf1938890a user: alex tags: trunk

- Drop nonce 24 from the sign info line - Ed25519 signatures have no nonce, and nacl::sign info has never reported one - Spell the command of the crypto_onetimeauth section as nacl::onetimeauth info, where it read nacl::info and thereby named a different command - Write the length prefix as cipher+ and sign+ the way the commands actually print it, rather than as cipher +16 and sign +64 - Name nacl::randombytes auth -key as the generator of the 32 byte key, since the nacl::random -auth mentioned before does not exist check-in: 55edae8b8e user: alex tags: trunk

- Report key instead of nonce in nacl::auth info - there is no nonce in HMAC authentication, and the value printed next to the label has always been crypto_auth_KEYBYTES - Report key instead of public-key in nacl::stream info - crypto_stream takes a secret key, not a public one, and the value is crypto_stream_KEYBYTES - Adjust the expectations in tests/auth.test and tests/stream.test accordingly, which carried the wrong labels along - Leave doc/help.txt untouched, as it has documented key for both commands all along and now agrees with what the commands report check-in: 145905b372 user: alex tags: trunk

- Set the README in markdown while keeping its file name, so that the glob README* in Makefile.in still picks it up for the distribution and nothing has to be renamed - Add a section on HMAC authentication stating that nacl::auth takes a key of any length and prepares it as RFC 2104 section 2 requires, the block size being 64 bytes for -hmac256 and 128 bytes for -hmac512256 - Point out that -hmac256 is the algorithm behind JWT HS256 and most webhook signatures, that nacl::auth verify compares in constant time, and that a key of exactly 32 bytes still yields the result of earlier releases - Mention nacl::build-info and nacl::manifest as the way to query version and check-in of a build at runtime check-in: 2c958785e1 user: alex tags: trunk

- Accept a key of any length in nacl::auth and nacl::auth verify - the former check rejected everything but exactly crypto_auth_KEYBYTES, which made the command unusable for JWT HS256 and comparable protocols, where the secret is chosen by the peer and changes its length whenever it is rotated - Add Tnacl_AuthKeyPad performing the preparation of RFC 2104 section 2 - a key longer than the block size of the hash is replaced by its hash, a shorter one is padded with zero bytes, the block size being 64 bytes for -hmac256 and 128 bytes for -hmac512256 - Add the _kpad variants of both reference primitives, taking the key already expanded to a full block instead of the 32 bytes the NaCl interface prescribes - this is the part that cannot be done by the caller, since a key between 33 and 64 bytes has to be padded rather than hashed and does not fit through the old interface - Keep crypto_auth_hmacsha256_ref and crypto_auth_hmacsha512256_ref as wrappers zero padding their 32 byte key, so that the NaCl interface and all other callers remain untouched - Leave the result for a key of exactly 32 bytes unchanged bit for bit, while every other length used to raise an error, so no existing call can yield a different value than before - Cover RFC 4231 section 4 test cases 1 to 7 for both algorithms in tests/auth.test, together with a key of exactly block size, an empty key, and a verify that has to reject a wrong key - Record in doc/help.txt that the key length of 32 bytes reported by nacl::auth info is what nacl::random -auth generates and not an upper bound check-in: dfb88cc229 user: alex tags: trunk

- Register ::nacl::build-info unconditionally - it used to be created only when Tcl_GetCommandInfo found ::tcl::build-info, so on an interpreter lacking that command, Tcl 8.6 among them, nacl::build-info did not exist at all - Add the static Tnacl_BuildInfo as that fallback - it parses the build info string handed over as client data and is installed whenever ::tcl::build-info is absent, while Tcl's own objProc is still reused when it is present - Support the subcommands version, patchlevel, commit and compiler - version returns major.minor while patchlevel returns the full package version, commit returns the uuid between the plus sign and the following dot, and compiler reports the .clang- .gcc- .msvc- or .icc- marker up to the next dot - Return the whole build info string when called without a subcommand, report an unknown option as an error naming the valid ones, and reject a surplus argument through Tcl_WrongNumArgs - Concatenate MANIFEST_UUID directly instead of passing it through STRINGIFY - the macro already expands to a quoted string, so stringifying it a second time embedded literal quotes into the commit field - Clamp each field copied into the local 128 byte buffer to its size so that memcpy stays in bounds check-in: c1873c9db9 user: alex tags: trunk