Add interface to TweetNaCl library

[noloader]

TweetNaCl is a compact reimplementation of the NaCl library by Daniel J. Bernstein, Bernard van Gastel, Wesley Janssen, Tanja Lange, Peter Schwabe and Sjaak Smetsers. The library is less than 20 KB in size and provides 25 of the NaCl library functions.

The compact library uses curve25519, XSalsa20, Poly1305 and SHA-512 as default primitives, and includes both x25519 key exchange and ed25519 signatures. The complete list of functions can be found in TweetNaCl: A crypto library in 100 tweets (20140917), Table 1, page 5.

Crypto++ retained the function names and signatures but switched to data types provided by <stdint.h> to promote interoperability with Crypto++ and avoid size problems on platforms like Cygwin. For example, NaCl typdef'd u64 as an unsigned long long, but Cygwin, MinGW and MSYS are LP64 systems (not LLP64 systems). In addition, Crypto++ was missing NaCl's signed 64-bit integer i64.

Crypto++ rejects small order elements using libsodium's blacklist. The TweetNaCl library allowed them but the library predated the attack. If you wish to allow small elements then use the "unchecked" versions of crypto_box_unchecked, crypto_box_open_unchecked and crypto_box_beforenm_unchecked. Also see RFC 7748, Elliptic Curves for Security, Section 6.

TweetNaCl is well written but not well optimized. It runs 2x to 3x slower than optimized routines from libsodium. However, the library is still 2x to 4x faster than the algorithms NaCl was designed to replace.

The Crypto++ wrapper for TweetNaCl requires OS features. That is, NO_OS_DEPENDENCE cannot be defined. It is due to TweetNaCl's internal function randombytes. Crypto++ used DefaultAutoSeededRNG within randombytes, so OS integration must be enabled. You can use another generator like RDRAND to avoid the restriction.

[anonimal]

Thank you, @noloader! 🎉 👍

[coneiric]

Epic PR, thank you @noloader 🎉

[noloader]

@anonimal, @coneiric,

We renamed nacl.h to naclite.h to avoid name collisions with other libraries. I got cold feet when I started thinking about the bug reports we would catch because of the confusion. Also see Commit 8ffd165c7a59.

Earlier we added three functions to Bernstein's gear: crypto_box_unchecked, crypto_box_open_unchecked and crypto_box_beforenm_unchecked. The unchecked version do not check for small order elements. They should provide interop needed for downlevel versions of libraries and protocols. Also see Commit 0bb73e7035b1.

Interop problems will likely occur for folks like Ethereum and Monero who are providing the high level protocols. Also see Hopwood's comments at libsodium's Commit afabd7e7386e.