#mooncry

#Highlights

• Correct — every algorithm is checked against FIPS / NIST / RFC test vectors, and cross-validated against reference implementations (pycryptodome, cryptography, hashlib, libsodium, zlib) plus randomized differential testing. 555 tests, run with moon test --deny-warn.
• Broad — MD5, SHA-1, the SHA-2 and SHA-3 families (incl. SHA-512/224 and SHA-512/256), Keccak-256, SHAKE/cSHAKE XOFs, KMAC128/256, BLAKE2b, BLAKE2s, BLAKE3, RIPEMD-160, HMAC (incl. HMAC-SHA3), Poly1305, CMAC-AES, keyed BLAKE2b/2s, GMAC, AES-CBC/GCM/CTR/CCM/KW/SIV, ChaCha20, Salsa20, ChaCha20-Poly1305 AEAD, XChaCha20 / XChaCha20-Poly1305 (24-byte nonce), HKDF, PBKDF2, scrypt, Argon2, RSA (PKCS1-v1.5/OAEP/PSS, incl. multi-hash _with variants**)**, ECDSA P-256 / secp256k1, Ed25519 (incl. Ed25519ctx / Ed25519ph), Ed448 (incl. contexts), X25519 / X448, ML-KEM-512/768/1024 (FIPS 203 post-quantum KEM), HOTP/TOTP (incl. SHA-256/SHA-512 variants), SipHash-2-4, CRC32/CRC32C/CRC-64/Adler-32, a sealed-box AEAD envelope, Base64, Hex.
• Fast where it matters — hex / Base64 encoding are O(n); AES MixColumns uses precomputed GF(2^8) tables (~5x over bit-sliced math); throughput is measured by moon bench.
• Fail-fast input validation — AES / ChaCha20 / SHAKE / hex functions abort with a clear message on wrong key / IV / nonce / tag lengths instead of producing garbage. Graceful Result-returning variants (hex_to_bytes_or, base64_decode_or) are provided for callers that prefer to branch on error.
• Single source of truth — one-shot hash entry points delegate to the streaming hashers, so the incremental and one-shot paths share one implementation.

The implementations are correct and tested but have not been formally audited. See Security & performance boundaries.

#Repositories

• GitHub (canonical): https://github.com/cc06b/mooncry
• Gitlink (mirror): https://www.gitlink.org.cn/CC01/mooncry_mirror

git remote add gitlink https://www.gitlink.org.cn/CC01/mooncry_mirror.git
git push gitlink master

#Algorithms

#Hash functions

• MD5 (RFC 1321) — 128-bit digest
• SHA-224 / SHA-256 (FIPS 180-4) — 224 / 256-bit digest
• SHA-384 / SHA-512 (FIPS 180-4) — 384 / 512-bit digest
• SHA-512/224 / SHA-512/256 (FIPS 180-4 §5.3.6) — truncated SHA-512 variants
• SHA-3 (FIPS 202) — SHA3-224 / 256 / 384 / 512 (Keccak-f[1600] sponge)
• Keccak-256 (original Keccak submission, domain 0x01) — the Ethereum hash
• BLAKE2b (RFC 7693) — 1..64-byte digest; keyed variant (MAC, 1..64-byte key)
• BLAKE2s (RFC 7693) — 1..32-byte digest (32-bit words, 64-byte blocks); keyed variant (MAC, 1..32-byte key)
• RIPEMD-160 (Dobbertin et al. 1996) — 160-bit digest (Bitcoin legacy)
• BLAKE3 (BLAKE3 spec) — 32-byte default digest, XOF (arbitrary-length via tree-Merkle)

#Extendable-output functions (XOF)

• SHAKE128 / SHAKE256 (FIPS 202) — variable-length output
• cSHAKE128 / cSHAKE256 (NIST SP 800-185) — customizable XOFs (function name N + customization string S; degenerate to SHAKE when both empty)

#Message authentication

• HMAC-SHA256 / HMAC-SHA512 (RFC 2104)
• HMAC-SHA3-256 / HMAC-SHA3-512 (RFC 2104 over FIPS 202)
• HMAC-SHA3-224 / HMAC-SHA3-384 (RFC 2104 over FIPS 202)
• Poly1305 (RFC 8439) — one-time MAC
• AES-CMAC (NIST SP 800-38B) — 128-bit tag, 128/192/256-bit keys
• KMAC128 / KMAC256 (NIST SP 800-185) — Keccak-based MAC with customization string; KMACXOF128 / KMACXOF256 variable-length variants
• GMAC (NIST SP 800-38D) — AES-GCM authentication-only mode (16-byte tag); one-shot and incremental (gmac_new / gmac_update / gmac_finalize)

#Symmetric ciphers / AEAD

• AES-CBC (NIST SP 800-38A) — PKCS#7 padding, 128/192/256-bit keys, IV prepended
• AES-GCM (NIST SP 800-38D) — authenticated encryption with AAD, 96-bit nonce
• AES-CCM (NIST SP 800-38C / RFC 3610) — CBC-MAC + CTR AEAD, 7..13-byte nonce, 4..16-byte tag
• Adler-32 (RFC 1950) — zlib rolling checksum
• AES-CTR (NIST SP 800-38A) — 128-bit big-endian counter, stream cipher
• ChaCha20 (RFC 8439) — 256-bit key, 96-bit nonce, stream cipher
• Salsa20 (eSTREAM, 20-round) — 16/32-byte key, 8-byte nonce, stream cipher
• ChaCha20-Poly1305 (RFC 8439) — AEAD (ciphertext || 16-byte tag)
• XChaCha20 (draft-irtf-cfrg-xchacha) — ChaCha20 with a 24-byte nonce via HChaCha20 subkey derivation
• XChaCha20-Poly1305 (draft-irtf-cfrg-xchacha / libsodium IETF) — AEAD with a 24-byte nonce (ciphertext || 16-byte tag)

#Key derivation

• HKDF-SHA256 (RFC 5869) — extract + expand
• HKDF-SHA512 (RFC 5869) — extract + expand over SHA-512
• HKDF-SHA3-256 (RFC 5869 over FIPS 202)
• PBKDF2-HMAC-SHA256 (RFC 8018) — password-based key derivation
• PBKDF2-HMAC-SHA1 (RFC 8018 / RFC 6070 vectors) — legacy KDF (WPA2)
• PBKDF2-HMAC-SHA512 (RFC 8018) — password-based key derivation
• PBKDF2-HMAC-SHA3-256 (RFC 8018 over FIPS 202)
• scrypt (RFC 7914) — memory-hard password-based KDF (Salsa20/8 + BlockMix + ROMix)

#Checksums / PRFs

• CRC32 (IEEE 802.3, poly 0xEDB88320 reflected)
• CRC32C (Castagnoli, poly 0x82F63B78 reflected) — iSCSI / ext4
• CRC-64/XZ (poly 0x42F0E1EBA9EA3693 reflected) — xz / lzma
• CRC-64/GO-ISO (poly 0x000000000000001B reflected) — Go hash/crc64 ISO
• SipHash-2-4 (Aumasson & Bernstein 2012) — 64-bit short-input PRF

#Composite envelope

• Sealed box — versioned AEAD envelope: HKDF-SHA256 (key derivation) + AES-256-GCM (AEAD). Wire format: version(1) ‖ nonce(12) ‖ ciphertext ‖ tag(16).

#Asymmetric (RSA)

• RSAES-PKCS1-v1.5 (RFC 8017 §7.2) — public-key encryption (decrypt is deterministic; encrypt takes caller-supplied padding randomness — no RNG)
• RSAES-OAEP (RFC 8017 §7.1) — SHA-256 + MGF1-SHA256 (decrypt deterministic; encrypt takes a caller-supplied 32-byte seed)
• RSASSA-PKCS1-v1.5 (RFC 8017 §8.2) — sign/verify over SHA-256 (deterministic)
• RSASSA-PSS (RFC 8017 §8.1) — SHA-256 + MGF1-SHA256, caller-supplied salt

#Asymmetric signatures (Ed25519)

• Ed25519 (RFC 8032, ed25519-sha-512) — deterministic sign/verify.
• Ed25519ctx / Ed25519ph (RFC 8032 §7.2/§7.3) — context-bound and pre-hashed variants (dom2 domain separation) Field arithmetic over GF(2^255-19) uses @bigint; the twisted-Edwards base point is recovered from y = 4/5. Signing is deterministic (no RNG).

#Key agreement (X25519)

• X25519 (RFC 7748) — Diffie-Hellman over Curve25519 via the x-coordinate-only Montgomery ladder. Reuses the GF(2^255-19) field ops.

#Encoding

• Base64 (RFC 4648) — standard alphabet with padding
• Hex — bytes ↔ lowercase hex

#Streaming API

#Installation

moon add cc06b/mooncry

#Quick start

moon new myapp
cd myapp
moon add cc06b/mooncry

import {
  "cc06b/mooncry/lib",
}

pkgtype(kind: "executable")

fn main {
  // SHA-256 one-shot
  let digest = @lib.sha256(b"Hello, world!")
  println("SHA-256: " + @lib.bytes_to_hex(digest))

  // AES-GCM round-trip (256-bit key, 96-bit nonce, with AAD)
  let key = Bytes::make(32, b'\x00')
  let iv = Bytes::make(12, b'\x00')
  let (ciphertext, tag) = @lib.aes_gcm_encrypt(b"secret data", key, iv, b"aad")
  let (plaintext, ok) = @lib.aes_gcm_decrypt(ciphertext, key, iv, b"aad", tag)
  let status = if ok { "OK" } else { "FAIL" }
  println("AES-GCM round-trip: " + status)
  println("Recovered: " + @lib.bytes_to_hex(plaintext))

  // Sealed-box envelope: HKDF-SHA256 derives the AES-256-GCM key from a
  // master key + context, then encrypts into a versioned envelope.
  let master = Bytes::make(32, b'\x07')
  let nonce = Bytes::make(12, b'\x01')
  let envelope = @lib.sealed_box_seal(master, nonce, b"plaintext", b"aad", b"tenant-1")
  match @lib.sealed_box_open(master, envelope, b"aad", b"tenant-1") {
    Ok(pt) => println("Sealed box: " + @lib.bytes_to_hex(pt))
    Err(msg) => println("Sealed box failed: " + msg)
  }
}

moon run cmd/main

SHA-256: 315f5bdb76d078c43b8ac0064e4a0164612b1fce77c869345bfc94c75894edd3
AES-GCM round-trip: OK
Recovered: 7365637265742064617461

#Public API

#Security & performance boundaries

• Not audited. The code is correct against known vectors but has had no formal security review. Do not use it to protect high-value assets without an independent audit.
• AES is not constant-time. MixColumns uses precomputed GF(2^8) lookup tables (mul2/3/9/11/13/14) for ~5x throughput. This leaks key-dependent table indices through the CPU cache — acceptable for many use cases but not side-channel-safe against a local attacker. Since v0.19.0 GHASH also uses precomputed 4-bit tables (keyed by the GCM hash subkey), so it is no longer bit-sliced and is likewise not side-channel-safe; the GCM tag comparison and CBC PKCS#7 verification remain constant-time (no early exit on mismatch).
• Nonce reuse is catastrophic for AES-GCM and ChaCha20(-Poly1305). Never reuse a (key, nonce) pair. The library does not track nonces — generate a fresh one per message (e.g. a counter or CSPRNG).
• PBKDF2 is a KDF, not a password hasher. For interactive password storage prefer Argon2 / bcrypt / scrypt elsewhere; PBKDF2 is included for compatibility with existing protocols.
• MD5 is collision-broken. It is included for legacy compatibility only — do not sign or authenticate with it.
• BLAKE3 supports arbitrary-length input via the tree-Merkle mode (verified vs the reference blake3 Python package up to 5000 bytes).
• Inputs are validated, not silently padded. Wrong key / IV / nonce / tag lengths abort immediately rather than producing wrong output.
• No RNG. The library provides deterministic primitives; obtain keys, IVs, and nonces from a secure source.

#Performance

moon bench

#Testing

moon test

#Development

moon check --deny-warn
moon fmt --check
moon info
moon test --deny-warn
moon bench          # run the benchmark suite

#Publishing (maintainers)

moon login            # one time, with the account that owns cc06b
moon publish          # publishes the current version

#License