NaCl (software)

Not to be confused with Google Native Client.

NaCl (pronounced "salt") is an abbreviation for "Networking and Cryptography library", a public domain "...high-speed software library for network communication, encryption, decryption, signatures, etc".^[1]

NaCl was created by the mathematician and programmer Daniel J. Bernstein who is best known for the creation of qmail and Curve25519. The core team also includes Tanja Lange^[2] and Peter Schwabe.^[3] The main goal while creating NaCl, according to the paper, was to "avoid various types of cryptographic disaster suffered by previous cryptographic libraries".

Basic functions

Public-key cryptography

• Authenticated encryption using Curve25519, Salsa20, and Poly1305.
• Signatures using Ed25519.
• Scalar multiplication.

Secret-key cryptography

• Authenticated encryption using Salsa20 and Poly1305.
• Encryption using Salsa20 or AES.
• Authentication using HMAC-SHA-512-256.
• One-time authentication using Poly1305.

Low-level functions

• Hashing using SHA-2.
• String comparison.^[4]

Key features

• No data flow from secrets to load addresses.
• No data flow from secrets to branch conditions.
• No padding oracles.
• Centralizing randomness.
• Avoiding unnecessary randomness.
• Extremely high speed.

Implementations

Reference implementation is written in C, often with several inline assembler. C++ and Python are handled as wrappers.^[5]

NaCl has a variety of programming language bindings including Ruby,^[6] PHP,^[7] and Python, and forms the basis for Sodium, a cross-platform cryptography library created in 2013 which is API compatible with NaCl.^[8][9]

Alternative implementation

• TweetNaCl^[10]—a tiny C library, which fits in just 100 tweets (140 symbols each), but supports all NaCl functions.

References

See also

• Official website