LibSodium.Bindings

Secret-key Cryptography

Authenticated Encryption

Encrypt a message and compute an authentication tag to make sure the message hasn't been tampered with.

Encryption: XSalsa20 stream cipher; Authentication: Poly1305 MAC

SecretBox

Encrypted Streams

Encrypt a sequence of messages, or a single message split into an arbitrary number of chunks, using a secret key.

Initialisation: XChaCha20; Encryption: ChaCha20Poly1305-IETF

SecretStream

Authentication

Compute an authentication tag for a message and a secret key, and verify that a given tag is valid for a given message and a key.

Authentication: HMAC-SHA512-256

CryptoAuth

Public-key Cryptography

Authenticated Encryption

Encrypt a confidential message with the recipient's public key, who can then decrypt it with their secret key.

Key exchange: X25519; Encryption: XSalsa20; Authentication: Poly1305

CryptoBox

Public-key Signatures

Sign messages with a secret key, and distribute a public key, which anybody can use to verify that the signature appended to a message was issued by the creator of the public key.

Single-part signature: Ed25519; Multi-part signature: Ed25519ph

CryptoSign

Sealed Boxes

Anonymously send messages to a recipient given their public key.

Key Exchange: X25519; Encryption: XSalsa20-Poly1305

SealedBoxes

Hashing

Generic Hashing

Computes a fixed-length fingerprint for an arbitrarily long message. Use this for file integrity checking and create unique identifiers to index arbitrarily long data. Do not use this API to hash passwords!

Hashing: BLAKE2b

GenericHashing

Password Hashing

Hash passwords with high control on the computation parameters.

Hashing: Argon2id v1.3

PasswordHashing

Short-input Hashing

Produce short hashes for your data, suitable to build Hash tables, probabilistic data structures or perform integrity checking in interactive protocols.

Hashing: SipHash-2-4

ShortHashing

Cryptographic Keys

Key Derivation

Derive secret keys from a single high-entropy key.

Key derivation: BLAKE2B

KeyDerivation

Key Exchange

Securely compute a set of shared keys using your peer's public key and your own secret key.

Key generation: BLAKE2B-512

KeyExchange

Other constructs

SHA-2

Provide compatibility with existing applications for SHA-256 and SHA-512. You should prioritise GenericHashing and PasswordHashing for new developmentinstead.

SHA-256 and SHA-512

SHA2

AEAD

Encrypt a message with a key and a nonce to keep it confidential, compute an authentication tag, and store optional, non-confidential data.

Encryption: XChaCha20 stream cipher; Authentication: Poly1305 MAC

AEAD

XChaCha20

Implementation of the XChaCha20 stream cipher

XChaCha20 stream cipher

XChaCha20

Scrypt

Unless you have specific reasons to use scrypt, you should instead consider the PasswordHashing module!

scrypt password hashing function

Scrypt