Adding upstream version 3.8.1.upstream/3.8.1upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

27 files changed, 8936 insertions, 0 deletions

diff --git a/src/libcryptobox/AsmOpt.cmake b/src/libcryptobox/AsmOpt.cmake
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/src/libcryptobox/AsmOpt.cmake
diff --git a/src/libcryptobox/CMakeLists.txt b/src/libcryptobox/CMakeLists.txt
new file mode 100644
index 0000000..d1c8e3d
--- /dev/null
+++ b/src/libcryptobox/CMakeLists.txt
@@ -0,0 +1,41 @@
+SET(CHACHASRC ${CMAKE_CURRENT_SOURCE_DIR}/chacha20/chacha.c
+        ${CMAKE_CURRENT_SOURCE_DIR}/chacha20/ref.c)
+
+SET(BASE64SRC ${CMAKE_CURRENT_SOURCE_DIR}/base64/ref.c
+        ${CMAKE_CURRENT_SOURCE_DIR}/base64/base64.c)
+
+IF (HAVE_AVX2)
+    IF ("${ARCH}" STREQUAL "x86_64")
+        SET(CHACHASRC ${CHACHASRC} ${CMAKE_CURRENT_SOURCE_DIR}/chacha20/avx2.S)
+        MESSAGE(STATUS "Cryptobox: AVX2 support is added (chacha20)")
+    ENDIF ()
+    SET(BASE64SRC ${BASE64SRC} ${CMAKE_CURRENT_SOURCE_DIR}/base64/avx2.c)
+    MESSAGE(STATUS "Cryptobox: AVX2 support is added (base64)")
+ENDIF (HAVE_AVX2)
+IF (HAVE_AVX)
+    IF ("${ARCH}" STREQUAL "x86_64")
+        SET(CHACHASRC ${CHACHASRC} ${CMAKE_CURRENT_SOURCE_DIR}/chacha20/avx.S)
+        MESSAGE(STATUS "Cryptobox: AVX support is added (chacha20)")
+    ENDIF ()
+ENDIF (HAVE_AVX)
+IF (HAVE_SSE2)
+    IF ("${ARCH}" STREQUAL "x86_64")
+        SET(CHACHASRC ${CHACHASRC} ${CMAKE_CURRENT_SOURCE_DIR}/chacha20/sse2.S)
+        MESSAGE(STATUS "Cryptobox: SSE2 support is added (chacha20)")
+    ENDIF ()
+ENDIF (HAVE_SSE2)
+IF (HAVE_SSE42)
+    IF ("${ARCH}" STREQUAL "x86_64")
+        SET(BASE64SRC ${BASE64SRC} ${CMAKE_CURRENT_SOURCE_DIR}/base64/sse42.c)
+        MESSAGE(STATUS "Cryptobox: SSE42 support is added (base64)")
+    ENDIF ()
+ENDIF (HAVE_SSE42)
+
+CONFIGURE_FILE(platform_config.h.in platform_config.h)
+INCLUDE_DIRECTORIES("${CMAKE_CURRENT_BINARY_DIR}")
+SET(LIBCRYPTOBOXSRC ${CMAKE_CURRENT_SOURCE_DIR}/cryptobox.c
+        ${CMAKE_CURRENT_SOURCE_DIR}/keypair.c
+        ${CMAKE_CURRENT_SOURCE_DIR}/keypairs_cache.c
+        ${CMAKE_CURRENT_SOURCE_DIR}/catena/catena.c)
+
+SET(RSPAMD_CRYPTOBOX ${LIBCRYPTOBOXSRC} ${CHACHASRC} ${BASE64SRC} PARENT_SCOPE)
diff --git a/src/libcryptobox/base64/avx2.c b/src/libcryptobox/base64/avx2.c
new file mode 100644
index 0000000..38abffc
--- /dev/null
+++ b/src/libcryptobox/base64/avx2.c
@@ -0,0 +1,287 @@
+/*-
+ * Copyright 2018 Vsevolod Stakhov
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*-
+Copyright (c) 2013-2015, Alfred Klomp
+Copyright (c) 2018, Vsevolod Stakhov
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+- Redistributions of source code must retain the above copyright notice,
+  this list of conditions and the following disclaimer.
+
+- Redistributions in binary form must reproduce the above copyright
+  notice, this list of conditions and the following disclaimer in the
+  documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "cryptobox.h"
+
+extern const uint8_t base64_table_dec[256];
+
+#ifdef RSPAMD_HAS_TARGET_ATTR
+#if defined(__GNUC__) && !defined(__clang__)
+#pragma GCC push_options
+#pragma GCC target("avx2")
+#endif
+#ifndef __SSE2__
+#define __SSE2__
+#endif
+#ifndef __SSE__
+#define __SSE__
+#endif
+#ifndef __SSE4_2__
+#define __SSE4_2__
+#endif
+#ifndef __SSE4_1__
+#define __SSE4_1__
+#endif
+#ifndef __SSEE3__
+#define __SSEE3__
+#endif
+#ifndef __AVX__
+#define __AVX__
+#endif
+#ifndef __AVX2__
+#define __AVX2__
+#endif
+
+#include <immintrin.h>
+
+#define CMPGT(s, n) _mm256_cmpgt_epi8((s), _mm256_set1_epi8(n))
+#define CMPEQ(s, n) _mm256_cmpeq_epi8((s), _mm256_set1_epi8(n))
+#define REPLACE(s, n) _mm256_and_si256((s), _mm256_set1_epi8(n))
+#define RANGE(s, a, b) _mm256_andnot_si256(CMPGT((s), (b)), CMPGT((s), (a) -1))
+
+static inline __m256i
+dec_reshuffle(__m256i in) __attribute__((__target__("avx2")));
+
+static inline __m256i
+dec_reshuffle(__m256i in)
+{
+	// in, lower lane, bits, upper case are most significant bits, lower case are least significant bits:
+	// 00llllll 00kkkkLL 00jjKKKK 00JJJJJJ
+	// 00iiiiii 00hhhhII 00ggHHHH 00GGGGGG
+	// 00ffffff 00eeeeFF 00ddEEEE 00DDDDDD
+	// 00cccccc 00bbbbCC 00aaBBBB 00AAAAAA
+
+	const __m256i merge_ab_and_bc = _mm256_maddubs_epi16(in, _mm256_set1_epi32(0x01400140));
+	// 0000kkkk LLllllll 0000JJJJ JJjjKKKK
+	// 0000hhhh IIiiiiii 0000GGGG GGggHHHH
+	// 0000eeee FFffffff 0000DDDD DDddEEEE
+	// 0000bbbb CCcccccc 0000AAAA AAaaBBBB
+
+	__m256i out = _mm256_madd_epi16(merge_ab_and_bc, _mm256_set1_epi32(0x00011000));
+	// 00000000 JJJJJJjj KKKKkkkk LLllllll
+	// 00000000 GGGGGGgg HHHHhhhh IIiiiiii
+	// 00000000 DDDDDDdd EEEEeeee FFffffff
+	// 00000000 AAAAAAaa BBBBbbbb CCcccccc
+
+	// Pack bytes together in each lane:
+	out = _mm256_shuffle_epi8(out, _mm256_setr_epi8(
+									   2, 1, 0, 6, 5, 4, 10, 9, 8, 14, 13, 12, -1, -1, -1, -1,
+									   2, 1, 0, 6, 5, 4, 10, 9, 8, 14, 13, 12, -1, -1, -1, -1));
+	// 00000000 00000000 00000000 00000000
+	// LLllllll KKKKkkkk JJJJJJjj IIiiiiii
+	// HHHHhhhh GGGGGGgg FFffffff EEEEeeee
+	// DDDDDDdd CCcccccc BBBBbbbb AAAAAAaa
+
+	// Pack lanes
+	return _mm256_permutevar8x32_epi32(out, _mm256_setr_epi32(0, 1, 2, 4, 5, 6, -1, -1));
+}
+
+
+#define INNER_LOOP_AVX2                                                                         \
+	while (inlen >= 45) {                                                                       \
+		__m256i str = _mm256_loadu_si256((__m256i *) c);                                        \
+		const __m256i lut_lo = _mm256_setr_epi8(                                                \
+			0x15, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11,                                     \
+			0x11, 0x11, 0x13, 0x1A, 0x1B, 0x1B, 0x1B, 0x1A,                                     \
+			0x15, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11,                                     \
+			0x11, 0x11, 0x13, 0x1A, 0x1B, 0x1B, 0x1B, 0x1A);                                    \
+		const __m256i lut_hi = _mm256_setr_epi8(                                                \
+			0x10, 0x10, 0x01, 0x02, 0x04, 0x08, 0x04, 0x08,                                     \
+			0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10,                                     \
+			0x10, 0x10, 0x01, 0x02, 0x04, 0x08, 0x04, 0x08,                                     \
+			0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10);                                    \
+		const __m256i lut_roll = _mm256_setr_epi8(                                              \
+			0, 16, 19, 4, -65, -65, -71, -71,                                                   \
+			0, 0, 0, 0, 0, 0, 0, 0,                                                             \
+			0, 16, 19, 4, -65, -65, -71, -71,                                                   \
+			0, 0, 0, 0, 0, 0, 0, 0);                                                            \
+		const __m256i mask_2F = _mm256_set1_epi8(0x2f);                                         \
+		const __m256i hi_nibbles = _mm256_and_si256(_mm256_srli_epi32(str, 4), mask_2F);        \
+		const __m256i lo_nibbles = _mm256_and_si256(str, mask_2F);                              \
+		const __m256i hi = _mm256_shuffle_epi8(lut_hi, hi_nibbles);                             \
+		const __m256i lo = _mm256_shuffle_epi8(lut_lo, lo_nibbles);                             \
+		const __m256i eq_2F = _mm256_cmpeq_epi8(str, mask_2F);                                  \
+		const __m256i roll = _mm256_shuffle_epi8(lut_roll, _mm256_add_epi8(eq_2F, hi_nibbles)); \
+		if (!_mm256_testz_si256(lo, hi)) {                                                      \
+			seen_error = true;                                                                  \
+			break;                                                                              \
+		}                                                                                       \
+		str = _mm256_add_epi8(str, roll);                                                       \
+		str = dec_reshuffle(str);                                                               \
+		_mm256_storeu_si256((__m256i *) o, str);                                                \
+		c += 32;                                                                                \
+		o += 24;                                                                                \
+		outl += 24;                                                                             \
+		inlen -= 32;                                                                            \
+	}
+
+int base64_decode_avx2(const char *in, size_t inlen,
+					   unsigned char *out, size_t *outlen) __attribute__((__target__("avx2")));
+int base64_decode_avx2(const char *in, size_t inlen,
+					   unsigned char *out, size_t *outlen)
+{
+	ssize_t ret = 0;
+	const uint8_t *c = (const uint8_t *) in;
+	uint8_t *o = (uint8_t *) out;
+	uint8_t q, carry;
+	size_t outl = 0;
+	size_t leftover = 0;
+	bool seen_error = false;
+
+repeat:
+	switch (leftover) {
+		for (;;) {
+		case 0:
+			if (G_LIKELY(!seen_error)) {
+				INNER_LOOP_AVX2
+			}
+
+			if (inlen-- == 0) {
+				ret = 1;
+				break;
+			}
+			if ((q = base64_table_dec[*c++]) >= 254) {
+				ret = 0;
+				break;
+			}
+			carry = q << 2;
+			leftover++;
+
+		case 1:
+			if (inlen-- == 0) {
+				ret = 1;
+				break;
+			}
+			if ((q = base64_table_dec[*c++]) >= 254) {
+				ret = 0;
+				break;
+			}
+			*o++ = carry | (q >> 4);
+			carry = q << 4;
+			leftover++;
+			outl++;
+
+		case 2:
+			if (inlen-- == 0) {
+				ret = 1;
+				break;
+			}
+			if ((q = base64_table_dec[*c++]) >= 254) {
+				leftover++;
+
+				if (q == 254) {
+					if (inlen-- != 0) {
+						leftover = 0;
+						q = base64_table_dec[*c++];
+						ret = ((q == 254) && (inlen == 0)) ? 1 : 0;
+						break;
+					}
+					else {
+						ret = 1;
+						break;
+					}
+				}
+				else {
+					leftover--;
+				}
+				/* If we get here, there was an error: */
+				break;
+			}
+			*o++ = carry | (q >> 2);
+			carry = q << 6;
+			leftover++;
+			outl++;
+
+		case 3:
+			if (inlen-- == 0) {
+				ret = 1;
+				break;
+			}
+			if ((q = base64_table_dec[*c++]) >= 254) {
+				/*
+				 * When q == 254, the input char is '='. Return 1 and EOF.
+				 * When q == 255, the input char is invalid. Return 0 and EOF.
+				 */
+				if (q == 254 && inlen == 0) {
+					ret = 1;
+					leftover = 0;
+				}
+				else {
+					ret = 0;
+				}
+
+				break;
+			}
+
+			*o++ = carry | q;
+			carry = 0;
+			leftover = 0;
+			outl++;
+		}
+	}
+
+	if (!ret && inlen > 0) {
+		/* Skip to the next valid character in input */
+		while (inlen > 0 && base64_table_dec[*c] >= 254) {
+			c++;
+			inlen--;
+		}
+
+		if (inlen > 0) {
+			seen_error = false;
+			goto repeat;
+		}
+	}
+
+	*outlen = outl;
+
+	return ret;
+}
+
+#if defined(__GNUC__) && !defined(__clang__)
+#pragma GCC pop_options
+#endif
+#endif
diff --git a/src/libcryptobox/base64/base64.c b/src/libcryptobox/base64/base64.c
new file mode 100644
index 0000000..e868924
--- /dev/null
+++ b/src/libcryptobox/base64/base64.c
@@ -0,0 +1,445 @@
+/*
+ * Copyright 2023 Vsevolod Stakhov
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "config.h"
+#include "cryptobox.h"
+#include "base64.h"
+#include "platform_config.h"
+#include "str_util.h"
+#include "util.h"
+#include "contrib/libottery/ottery.h"
+
+extern unsigned cpu_config;
+const uint8_t
+	base64_table_dec[256] =
+		{
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			62,
+			255,
+			255,
+			255,
+			63,
+			52,
+			53,
+			54,
+			55,
+			56,
+			57,
+			58,
+			59,
+			60,
+			61,
+			255,
+			255,
+			255,
+			254,
+			255,
+			255,
+			255,
+			0,
+			1,
+			2,
+			3,
+			4,
+			5,
+			6,
+			7,
+			8,
+			9,
+			10,
+			11,
+			12,
+			13,
+			14,
+			15,
+			16,
+			17,
+			18,
+			19,
+			20,
+			21,
+			22,
+			23,
+			24,
+			25,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			26,
+			27,
+			28,
+			29,
+			30,
+			31,
+			32,
+			33,
+			34,
+			35,
+			36,
+			37,
+			38,
+			39,
+			40,
+			41,
+			42,
+			43,
+			44,
+			45,
+			46,
+			47,
+			48,
+			49,
+			50,
+			51,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+			255,
+};
+
+static const char base64_alphabet[] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz+/";
+
+typedef struct base64_impl {
+	unsigned short enabled;
+	unsigned short min_len;
+	unsigned int cpu_flags;
+	const char *desc;
+	int (*decode)(const char *in, size_t inlen,
+				  unsigned char *out, size_t *outlen);
+} base64_impl_t;
+
+#define BASE64_DECLARE(ext) \
+	int base64_decode_##ext(const char *in, size_t inlen, unsigned char *out, size_t *outlen);
+#define BASE64_IMPL(cpuflags, min_len, desc, ext)           \
+	{                                                       \
+		0, (min_len), (cpuflags), desc, base64_decode_##ext \
+	}
+
+BASE64_DECLARE(ref);
+#define BASE64_REF BASE64_IMPL(0, 0, "ref", ref)
+
+#ifdef RSPAMD_HAS_TARGET_ATTR
+#if defined(HAVE_SSE42) && defined(__x86_64__)
+int base64_decode_sse42(const char *in, size_t inlen,
+						unsigned char *out, size_t *outlen) __attribute__((__target__("sse4.2")));
+
+BASE64_DECLARE(sse42);
+#define BASE64_SSE42 BASE64_IMPL(CPUID_SSE42, 24, "sse42", sse42)
+#endif
+#endif
+
+#ifdef RSPAMD_HAS_TARGET_ATTR
+#if defined(HAVE_AVX2) && defined(__x86_64__)
+int base64_decode_avx2(const char *in, size_t inlen,
+					   unsigned char *out, size_t *outlen) __attribute__((__target__("avx2")));
+
+BASE64_DECLARE(avx2);
+#define BASE64_AVX2 BASE64_IMPL(CPUID_AVX2, 128, "avx2", avx2)
+#endif
+#endif
+
+static base64_impl_t base64_list[] = {
+	BASE64_REF,
+#ifdef BASE64_SSE42
+	BASE64_SSE42,
+#endif
+#ifdef BASE64_AVX2
+	BASE64_AVX2,
+#endif
+};
+
+static const base64_impl_t *base64_ref = &base64_list[0];
+
+const char *
+base64_load(void)
+{
+	guint i;
+	const base64_impl_t *opt_impl = base64_ref;
+
+	/* Enable reference */
+	base64_list[0].enabled = true;
+
+	if (cpu_config != 0) {
+		for (i = 1; i < G_N_ELEMENTS(base64_list); i++) {
+			if (base64_list[i].cpu_flags & cpu_config) {
+				base64_list[i].enabled = true;
+				opt_impl = &base64_list[i];
+			}
+		}
+	}
+
+
+	return opt_impl->desc;
+}
+
+gboolean
+rspamd_cryptobox_base64_decode(const gchar *in, gsize inlen,
+							   guchar *out, gsize *outlen)
+{
+	const base64_impl_t *opt_impl = base64_ref;
+
+	for (gint i = G_N_ELEMENTS(base64_list) - 1; i > 0; i--) {
+		if (base64_list[i].enabled && base64_list[i].min_len <= inlen) {
+			opt_impl = &base64_list[i];
+			break;
+		}
+	}
+
+	return opt_impl->decode(in, inlen, out, outlen);
+}
+
+double
+base64_test(bool generic, size_t niters, size_t len, size_t str_len)
+{
+	size_t cycles;
+	guchar *in, *out, *tmp;
+	gdouble t1, t2, total = 0;
+	gsize outlen;
+
+	g_assert(len > 0);
+	in = g_malloc(len);
+	tmp = g_malloc(len);
+	ottery_rand_bytes(in, len);
+
+	out = rspamd_encode_base64_fold(in, len, str_len, &outlen,
+									RSPAMD_TASK_NEWLINES_CRLF);
+
+	if (generic) {
+		base64_list[0].decode(out, outlen, tmp, &len);
+	}
+	else {
+		rspamd_cryptobox_base64_decode(out, outlen, tmp, &len);
+	}
+
+	g_assert(memcmp(in, tmp, len) == 0);
+
+	for (cycles = 0; cycles < niters; cycles++) {
+		t1 = rspamd_get_ticks(TRUE);
+		if (generic) {
+			base64_list[0].decode(out, outlen, tmp, &len);
+		}
+		else {
+			rspamd_cryptobox_base64_decode(out, outlen, tmp, &len);
+		}
+		t2 = rspamd_get_ticks(TRUE);
+		total += t2 - t1;
+	}
+
+	g_free(in);
+	g_free(tmp);
+	g_free(out);
+
+	return total;
+}
+
+
+gboolean
+rspamd_cryptobox_base64_is_valid(const gchar *in, gsize inlen)
+{
+	const guchar *p, *end;
+
+	if (inlen == 0) {
+		return FALSE;
+	}
+
+	p = in;
+	end = in + inlen;
+
+	while (p < end && *p != '=') {
+		if (!g_ascii_isspace(*p)) {
+			if (base64_table_dec[*p] == 255) {
+				return FALSE;
+			}
+		}
+		p++;
+	}
+
+	return TRUE;
+}
\ No newline at end of file
diff --git a/src/libcryptobox/base64/base64.h b/src/libcryptobox/base64/base64.h
new file mode 100644
index 0000000..f53c80a
--- /dev/null
+++ b/src/libcryptobox/base64/base64.h
@@ -0,0 +1,31 @@
+/*-
+ * Copyright 2016 Vsevolod Stakhov
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#ifndef SRC_LIBCRYPTOBOX_BASE64_BASE64_H_
+#define SRC_LIBCRYPTOBOX_BASE64_BASE64_H_
+
+#include "config.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+const char *base64_load(void);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* SRC_LIBCRYPTOBOX_BASE64_BASE64_H_ */
diff --git a/src/libcryptobox/base64/ref.c b/src/libcryptobox/base64/ref.c
new file mode 100644
index 0000000..61df68e
--- /dev/null
+++ b/src/libcryptobox/base64/ref.c
@@ -0,0 +1,241 @@
+/*-
+Copyright (c) 2013-2015, Alfred Klomp
+Copyright (c) 2016, Vsevolod Stakhov
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+- Redistributions of source code must retain the above copyright notice,
+  this list of conditions and the following disclaimer.
+
+- Redistributions in binary form must reproduce the above copyright
+  notice, this list of conditions and the following disclaimer in the
+  documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "libutil/util.h"
+
+extern const uint8_t base64_table_dec[256];
+
+#define INNER_LOOP_64                                                \
+	do {                                                             \
+		uint64_t str, res, dec;                                      \
+		bool aligned = rspamd_is_aligned_as(c, str);                 \
+		while (inlen >= 13) {                                        \
+			if (aligned) { str = *(uint64_t *) c; }                  \
+			else {                                                   \
+				memcpy(&str, c, sizeof(str));                        \
+			}                                                        \
+			str = GUINT64_TO_BE(str);                                \
+			if ((dec = base64_table_dec[str >> 56]) > 63) {          \
+				break;                                               \
+			}                                                        \
+			res = dec << 58;                                         \
+			if ((dec = base64_table_dec[(str >> 48) & 0xFF]) > 63) { \
+				break;                                               \
+			}                                                        \
+			res |= dec << 52;                                        \
+			if ((dec = base64_table_dec[(str >> 40) & 0xFF]) > 63) { \
+				break;                                               \
+			}                                                        \
+			res |= dec << 46;                                        \
+			if ((dec = base64_table_dec[(str >> 32) & 0xFF]) > 63) { \
+				break;                                               \
+			}                                                        \
+			res |= dec << 40;                                        \
+			if ((dec = base64_table_dec[(str >> 24) & 0xFF]) > 63) { \
+				break;                                               \
+			}                                                        \
+			res |= dec << 34;                                        \
+			if ((dec = base64_table_dec[(str >> 16) & 0xFF]) > 63) { \
+				break;                                               \
+			}                                                        \
+			res |= dec << 28;                                        \
+			if ((dec = base64_table_dec[(str >> 8) & 0xFF]) > 63) {  \
+				break;                                               \
+			}                                                        \
+			res |= dec << 22;                                        \
+			if ((dec = base64_table_dec[str & 0xFF]) > 63) {         \
+				break;                                               \
+			}                                                        \
+			res |= dec << 16;                                        \
+			res = GUINT64_FROM_BE(res);                              \
+			memcpy(o, &res, sizeof(res));                            \
+			c += 8;                                                  \
+			o += 6;                                                  \
+			outl += 6;                                               \
+			inlen -= 8;                                              \
+		}                                                            \
+	} while (0)
+
+#define INNER_LOOP_32                                                \
+	do {                                                             \
+		uint32_t str, res, dec;                                      \
+		bool aligned = rspamd_is_aligned_as(c, str);                 \
+		while (inlen >= 8) {                                         \
+			if (aligned) { str = *(uint32_t *) c; }                  \
+			else {                                                   \
+				memcpy(&str, c, sizeof(str));                        \
+			}                                                        \
+			str = GUINT32_TO_BE(str);                                \
+			if ((dec = base64_table_dec[str >> 24]) > 63) {          \
+				break;                                               \
+			}                                                        \
+			res = dec << 26;                                         \
+			if ((dec = base64_table_dec[(str >> 16) & 0xFF]) > 63) { \
+				break;                                               \
+			}                                                        \
+			res |= dec << 20;                                        \
+			if ((dec = base64_table_dec[(str >> 8) & 0xFF]) > 63) {  \
+				break;                                               \
+			}                                                        \
+			res |= dec << 14;                                        \
+			if ((dec = base64_table_dec[str & 0xFF]) > 63) {         \
+				break;                                               \
+			}                                                        \
+			res |= dec << 8;                                         \
+			res = GUINT32_FROM_BE(res);                              \
+			memcpy(o, &res, sizeof(res));                            \
+			c += 4;                                                  \
+			o += 3;                                                  \
+			outl += 3;                                               \
+			inlen -= 4;                                              \
+		}                                                            \
+	} while (0)
+
+
+int base64_decode_ref(const char *in, size_t inlen,
+					  unsigned char *out, size_t *outlen)
+{
+	ssize_t ret = 0;
+	const uint8_t *c = (const uint8_t *) in;
+	uint8_t *o = (uint8_t *) out;
+	uint8_t q, carry;
+	size_t outl = 0;
+	size_t leftover = 0;
+
+repeat:
+	switch (leftover) {
+		for (;;) {
+		case 0:
+#if defined(__LP64__)
+			INNER_LOOP_64;
+#else
+			INNER_LOOP_32;
+#endif
+
+			if (inlen-- == 0) {
+				ret = 1;
+				break;
+			}
+			if ((q = base64_table_dec[*c++]) >= 254) {
+				ret = 0;
+				break;
+			}
+			carry = (uint8_t) (q << 2);
+			leftover++;
+
+		case 1:
+			if (inlen-- == 0) {
+				ret = 1;
+				break;
+			}
+			if ((q = base64_table_dec[*c++]) >= 254) {
+				ret = 0;
+				break;
+			}
+			*o++ = carry | (q >> 4);
+			carry = (uint8_t) (q << 4);
+			leftover++;
+			outl++;
+
+		case 2:
+			if (inlen-- == 0) {
+				ret = 1;
+				break;
+			}
+			if ((q = base64_table_dec[*c++]) >= 254) {
+				leftover++;
+
+				if (q == 254) {
+					if (inlen-- != 0) {
+						leftover = 0;
+						q = base64_table_dec[*c++];
+						ret = ((q == 254) && (inlen == 0)) ? 1 : 0;
+						break;
+					}
+					else {
+						ret = 1;
+						break;
+					}
+				}
+				else {
+					leftover--;
+				}
+				/* If we get here, there was an error: */
+				break;
+			}
+			*o++ = carry | (q >> 2);
+			carry = (uint8_t) (q << 6);
+			leftover++;
+			outl++;
+
+		case 3:
+			if (inlen-- == 0) {
+				ret = 1;
+				break;
+			}
+			if ((q = base64_table_dec[*c++]) >= 254) {
+				/*
+				 * When q == 254, the input char is '='. Return 1 and EOF.
+				 * When q == 255, the input char is invalid. Return 0 and EOF.
+				 */
+				if (q == 254 && inlen == 0) {
+					ret = 1;
+					leftover = 0;
+				}
+				else {
+					ret = 0;
+				}
+
+				break;
+			}
+
+			*o++ = carry | q;
+			carry = 0;
+			leftover = 0;
+			outl++;
+		}
+	}
+
+	if (!ret && inlen > 0) {
+		/* Skip to the next valid character in input */
+		while (inlen > 0 && base64_table_dec[*c] >= 254) {
+			c++;
+			inlen--;
+		}
+
+		if (inlen > 0) {
+			goto repeat;
+		}
+	}
+
+	*outlen = outl;
+
+	return ret;
+}
diff --git a/src/libcryptobox/base64/sse42.c b/src/libcryptobox/base64/sse42.c
new file mode 100644
index 0000000..36070ab
--- /dev/null
+++ b/src/libcryptobox/base64/sse42.c
@@ -0,0 +1,268 @@
+/*-
+ * Copyright 2017 Vsevolod Stakhov
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*-
+Copyright (c) 2013-2015, Alfred Klomp
+Copyright (c) 2016, Vsevolod Stakhov
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+- Redistributions of source code must retain the above copyright notice,
+  this list of conditions and the following disclaimer.
+
+- Redistributions in binary form must reproduce the above copyright
+  notice, this list of conditions and the following disclaimer in the
+  documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "cryptobox.h"
+
+extern const uint8_t base64_table_dec[256];
+
+#ifdef RSPAMD_HAS_TARGET_ATTR
+#if defined(__GNUC__) && !defined(__clang__)
+#pragma GCC push_options
+#pragma GCC target("sse4.2")
+#endif
+#ifndef __SSE2__
+#define __SSE2__
+#endif
+#ifndef __SSE__
+#define __SSE__
+#endif
+#ifndef __SSE4_2__
+#define __SSE4_2__
+#endif
+#ifndef __SSE4_1__
+#define __SSE4_1__
+#endif
+#ifndef __SSEE3__
+#define __SSEE3__
+#endif
+#include <xmmintrin.h>
+#include <nmmintrin.h>
+
+
+static inline __m128i
+dec_reshuffle(__m128i in) __attribute__((__target__("sse4.2")));
+
+static inline __m128i dec_reshuffle(__m128i in)
+{
+	// Mask in a single byte per shift:
+	const __m128i maskB2 = _mm_set1_epi32(0x003F0000);
+	const __m128i maskB1 = _mm_set1_epi32(0x00003F00);
+
+	// Pack bytes together:
+	__m128i out = _mm_srli_epi32(in, 16);
+
+	out = _mm_or_si128(out, _mm_srli_epi32(_mm_and_si128(in, maskB2), 2));
+
+	out = _mm_or_si128(out, _mm_slli_epi32(_mm_and_si128(in, maskB1), 12));
+
+	out = _mm_or_si128(out, _mm_slli_epi32(in, 26));
+
+	// Reshuffle and repack into 12-byte output format:
+	return _mm_shuffle_epi8(out, _mm_setr_epi8(
+									 3, 2, 1,
+									 7, 6, 5,
+									 11, 10, 9,
+									 15, 14, 13,
+									 -1, -1, -1, -1));
+}
+
+#define CMPGT(s, n) _mm_cmpgt_epi8((s), _mm_set1_epi8(n))
+
+#define INNER_LOOP_SSE42                                                                              \
+	while (inlen >= 24) {                                                                             \
+		__m128i str = _mm_loadu_si128((__m128i *) c);                                                 \
+		const __m128i lut = _mm_setr_epi8(                                                            \
+			19, 16, 4, 4,                                                                             \
+			4, 4, 4, 4,                                                                               \
+			4, 4, 4, 4,                                                                               \
+			0, 0, -71, -65);                                                                          \
+		const __m128i range = _mm_setr_epi8(                                                          \
+			'+', '+',                                                                                 \
+			'+', '+',                                                                                 \
+			'+', '+',                                                                                 \
+			'+', '+',                                                                                 \
+			'/', '/',                                                                                 \
+			'0', '9',                                                                                 \
+			'A', 'Z',                                                                                 \
+			'a', 'z');                                                                                \
+		if (_mm_cmpistrc(range, str, _SIDD_UBYTE_OPS | _SIDD_CMP_RANGES | _SIDD_NEGATIVE_POLARITY)) { \
+			seen_error = true;                                                                        \
+			break;                                                                                    \
+		}                                                                                             \
+		__m128i indices = _mm_subs_epu8(str, _mm_set1_epi8(46));                                      \
+		__m128i mask45 = CMPGT(str, 64);                                                              \
+		__m128i mask5 = CMPGT(str, 96);                                                               \
+		indices = _mm_andnot_si128(mask45, indices);                                                  \
+		mask45 = _mm_add_epi8(_mm_slli_epi16(_mm_abs_epi8(mask45), 4), mask45);                       \
+		indices = _mm_add_epi8(indices, mask45);                                                      \
+		indices = _mm_add_epi8(indices, mask5);                                                       \
+		__m128i delta = _mm_shuffle_epi8(lut, indices);                                               \
+		str = _mm_add_epi8(str, delta);                                                               \
+		str = dec_reshuffle(str);                                                                     \
+		_mm_storeu_si128((__m128i *) o, str);                                                         \
+		c += 16;                                                                                      \
+		o += 12;                                                                                      \
+		outl += 12;                                                                                   \
+		inlen -= 16;                                                                                  \
+	}
+
+int base64_decode_sse42(const char *in, size_t inlen,
+						unsigned char *out, size_t *outlen) __attribute__((__target__("sse4.2")));
+int base64_decode_sse42(const char *in, size_t inlen,
+						unsigned char *out, size_t *outlen)
+{
+	ssize_t ret = 0;
+	const uint8_t *c = (const uint8_t *) in;
+	uint8_t *o = (uint8_t *) out;
+	uint8_t q, carry;
+	size_t outl = 0;
+	size_t leftover = 0;
+	bool seen_error = false;
+
+repeat:
+	switch (leftover) {
+		for (;;) {
+		case 0:
+			if (G_LIKELY(!seen_error)) {
+				INNER_LOOP_SSE42
+			}
+
+			if (inlen-- == 0) {
+				ret = 1;
+				break;
+			}
+			if ((q = base64_table_dec[*c++]) >= 254) {
+				ret = 0;
+				break;
+			}
+			carry = q << 2;
+			leftover++;
+
+		case 1:
+			if (inlen-- == 0) {
+				ret = 1;
+				break;
+			}
+			if ((q = base64_table_dec[*c++]) >= 254) {
+				ret = 0;
+				break;
+			}
+			*o++ = carry | (q >> 4);
+			carry = q << 4;
+			leftover++;
+			outl++;
+
+		case 2:
+			if (inlen-- == 0) {
+				ret = 1;
+				break;
+			}
+			if ((q = base64_table_dec[*c++]) >= 254) {
+				leftover++;
+
+				if (q == 254) {
+					if (inlen-- != 0) {
+						leftover = 0;
+						q = base64_table_dec[*c++];
+						ret = ((q == 254) && (inlen == 0)) ? 1 : 0;
+						break;
+					}
+					else {
+						ret = 1;
+						break;
+					}
+				}
+				else {
+					leftover--;
+				}
+				/* If we get here, there was an error: */
+				break;
+			}
+			*o++ = carry | (q >> 2);
+			carry = q << 6;
+			leftover++;
+			outl++;
+
+		case 3:
+			if (inlen-- == 0) {
+				ret = 1;
+				break;
+			}
+			if ((q = base64_table_dec[*c++]) >= 254) {
+				/*
+				 * When q == 254, the input char is '='. Return 1 and EOF.
+				 * When q == 255, the input char is invalid. Return 0 and EOF.
+				 */
+				if (q == 254 && inlen == 0) {
+					ret = 1;
+					leftover = 0;
+				}
+				else {
+					ret = 0;
+				}
+
+				break;
+			}
+
+			*o++ = carry | q;
+			carry = 0;
+			leftover = 0;
+			outl++;
+		}
+	}
+
+	if (!ret && inlen > 0) {
+		/* Skip to the next valid character in input */
+		while (inlen > 0 && base64_table_dec[*c] >= 254) {
+			c++;
+			inlen--;
+		}
+
+		if (inlen > 0) {
+			seen_error = false;
+			goto repeat;
+		}
+	}
+
+	*outlen = outl;
+
+	return ret;
+}
+
+#if defined(__GNUC__) && !defined(__clang__)
+#pragma GCC pop_options
+#endif
+#endif
diff --git a/src/libcryptobox/catena/LICENSE b/src/libcryptobox/catena/LICENSE
new file mode 100644
index 0000000..ff22dc8
--- /dev/null
+++ b/src/libcryptobox/catena/LICENSE
@@ -0,0 +1,20 @@
+The MIT License (MIT)
+
+Copyright (c) 2014 cforler
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/src/libcryptobox/catena/README.md b/src/libcryptobox/catena/README.md
new file mode 100644
index 0000000..4a0f948
--- /dev/null
+++ b/src/libcryptobox/catena/README.md
@@ -0,0 +1,18 @@
+Catena
+======
+Catena is a memory-consuming password scrambler that excellently
+thwarts massively parallel attacks on cheap memory-constrained
+hardware, such as recent graphical processing units (GPUs).
+Furthermore, Catena provides resistance against cache-timing attacks, since
+its memory-access pattern is password-independent.
+
+Academic paper:
+<a href="http://www.uni-weimar.de/fileadmin/user/fak/medien/professuren/Mediensicherheit/Research/Publications/catena-v3.1.pdf">catena-v3.1.pdf</a>
+
+Rspamd specific
+---------------
+
+Rspamd implements Catena-Butterfly using full blake2b hash implemented in the
+cryptobox.
+
+Original code: https://github.com/medsec/catena
\ No newline at end of file
diff --git a/src/libcryptobox/catena/catena.c b/src/libcryptobox/catena/catena.c
new file mode 100644
index 0000000..7e066dd
--- /dev/null
+++ b/src/libcryptobox/catena/catena.c
@@ -0,0 +1,444 @@
+/*-
+ * Copyright 2016 Vsevolod Stakhov
+ * Copyright (c) 2014 cforler
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to
+ * use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+ * the Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+ * IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#include "config.h"
+#include "catena.h"
+
+#include <sodium.h>
+
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+#define TO_LITTLE_ENDIAN_64(n) (n)
+#define TO_LITTLE_ENDIAN_32(n) (n)
+#else
+#define TO_LITTLE_ENDIAN_64 GUINT64_SWAP_LE_BE
+#define TO_LITTLE_ENDIAN_32 GUINT32_SWAP_LE_BE
+#endif
+
+/* Recommended default values */
+#define H_LEN CATENA_HLEN
+#define KEY_LEN 16
+
+const uint8_t VERSION_ID[] = "Butterfly-Full";
+const uint8_t LAMBDA = 4;
+const uint8_t GARLIC = 16;
+const uint8_t MIN_GARLIC = 16;
+
+/*
+ * Hash part
+ */
+
+static inline void
+__Hash1(const uint8_t *input, const uint32_t inputlen,
+		uint8_t hash[H_LEN])
+{
+	crypto_generichash_blake2b_state ctx;
+	crypto_generichash_blake2b_init(&ctx, NULL, 0, H_LEN);
+	crypto_generichash_blake2b_update(&ctx, input, inputlen);
+	crypto_generichash_blake2b_final(&ctx, hash, H_LEN);
+}
+
+/***************************************************/
+
+static inline void __Hash2(const uint8_t *i1, const uint8_t i1len, const uint8_t *i2,
+						   const uint8_t i2len, uint8_t hash[H_LEN])
+{
+	crypto_generichash_blake2b_state ctx;
+
+	crypto_generichash_blake2b_init(&ctx, NULL, 0, H_LEN);
+	crypto_generichash_blake2b_update(&ctx, i1, i1len);
+	crypto_generichash_blake2b_update(&ctx, i2, i2len);
+	crypto_generichash_blake2b_final(&ctx, hash, H_LEN);
+}
+
+/***************************************************/
+
+static inline void __Hash3(const uint8_t *i1, const uint8_t i1len, const uint8_t *i2,
+						   const uint8_t i2len, const uint8_t *i3, const uint8_t i3len,
+						   uint8_t hash[H_LEN])
+{
+	crypto_generichash_blake2b_state ctx;
+
+	crypto_generichash_blake2b_init(&ctx, NULL, 0, H_LEN);
+	crypto_generichash_blake2b_update(&ctx, i1, i1len);
+	crypto_generichash_blake2b_update(&ctx, i2, i2len);
+	crypto_generichash_blake2b_update(&ctx, i3, i3len);
+	crypto_generichash_blake2b_final(&ctx, hash, H_LEN);
+}
+
+/***************************************************/
+
+static inline void __Hash4(const uint8_t *i1, const uint8_t i1len, const uint8_t *i2,
+						   const uint8_t i2len, const uint8_t *i3, const uint8_t i3len,
+						   const uint8_t *i4, const uint8_t i4len, uint8_t hash[H_LEN])
+{
+	crypto_generichash_blake2b_state ctx;
+
+	crypto_generichash_blake2b_init(&ctx, NULL, 0, H_LEN);
+	crypto_generichash_blake2b_update(&ctx, i1, i1len);
+	crypto_generichash_blake2b_update(&ctx, i2, i2len);
+	crypto_generichash_blake2b_update(&ctx, i3, i3len);
+	crypto_generichash_blake2b_update(&ctx, i4, i4len);
+	crypto_generichash_blake2b_final(&ctx, hash, H_LEN);
+}
+
+/***************************************************/
+
+static inline void __Hash5(const uint8_t *i1, const uint8_t i1len, const uint8_t *i2,
+						   const uint8_t i2len, const uint8_t *i3, const uint8_t i3len,
+						   const uint8_t *i4, const uint8_t i4len, const uint8_t *i5,
+						   const uint8_t i5len, uint8_t hash[H_LEN])
+{
+	crypto_generichash_blake2b_state ctx;
+
+	crypto_generichash_blake2b_init(&ctx, NULL, 0, H_LEN);
+	crypto_generichash_blake2b_update(&ctx, i1, i1len);
+	crypto_generichash_blake2b_update(&ctx, i2, i2len);
+	crypto_generichash_blake2b_update(&ctx, i3, i3len);
+	crypto_generichash_blake2b_update(&ctx, i4, i4len);
+	crypto_generichash_blake2b_update(&ctx, i5, i5len);
+	crypto_generichash_blake2b_final(&ctx, hash, H_LEN);
+}
+
+static inline void
+__HashFast(int vindex, const uint8_t *i1, const uint8_t *i2,
+		   uint8_t hash[H_LEN])
+{
+	__Hash2(i1, H_LEN, i2, H_LEN, hash);
+}
+
+static void __ResetState(void)
+{
+}
+
+/*
+ * Misc utils
+ */
+const uint8_t ZERO8[H_LEN] = {0};
+
+/* see: http://en.wikipedia.org/wiki/Xorshift#Variations */
+static int p;
+static uint64_t s[16];
+
+static void
+initXSState(const uint8_t *a, const uint8_t *b)
+{
+	p = 0;
+
+	for (int i = 0; i < 8; i++) {
+		s[i] = UINT64_C(0);
+		s[i + 8] = UINT64_C(0);
+
+		for (int j = 0; j < 8; j++) {
+			s[i] |= ((uint64_t) a[i * 8 + j]) << j * 8;
+			s[i + 8] |= ((uint64_t) b[i * 8 + j]) << j * 8;
+		}
+	}
+}
+
+static uint64_t
+xorshift1024star(void)
+{
+	uint64_t s0 = s[p];
+	uint64_t s1 = s[p = (p + 1) & 15];
+	s1 ^= s1 << 31;
+	s1 ^= s1 >> 11;
+	s0 ^= s0 >> 30;
+	return (s[p] = s0 ^ s1) * UINT64_C(1181783497276652981);
+}
+
+static void
+H_INIT(const uint8_t *x, const uint16_t xlen, uint8_t *vm1, uint8_t *vm2)
+{
+	const uint8_t l = 2;
+	uint8_t *tmp = (uint8_t *) g_malloc(l * H_LEN);
+
+	for (uint8_t i = 0; i != l; ++i) {
+		__Hash2(&i, 1, x, xlen, tmp + i * H_LEN);
+	}
+
+	memcpy(vm1, tmp, H_LEN);
+	memcpy(vm2, tmp + (l / 2 * H_LEN), H_LEN);
+	g_free(tmp);
+}
+
+static void
+H_First(const uint8_t *i1, const uint8_t *i2, uint8_t *hash)
+{
+	uint8_t i = 0;
+	uint8_t *x = (uint8_t *) g_malloc(H_LEN);
+
+	__ResetState();
+	__Hash2(i1, H_LEN, i2, H_LEN, x);
+	__Hash2(&i, 1, x, H_LEN, hash);
+	g_free(x);
+}
+
+static inline void
+initmem(const uint8_t x[H_LEN], const uint64_t c, uint8_t *r)
+{
+	uint8_t *vm2 = (uint8_t *) g_malloc(H_LEN);
+	uint8_t *vm1 = (uint8_t *) g_malloc(H_LEN);
+
+	H_INIT(x, H_LEN, vm1, vm2);
+	__ResetState();
+	__HashFast(0, vm1, vm2, r);
+	__HashFast(1, r, vm1, r + H_LEN);
+
+	/* Top row */
+	for (uint64_t i = 2; i < c; i++) {
+		__HashFast(i, r + (i - 1) * H_LEN, r + (i - 2) * H_LEN, r + i * H_LEN);
+	}
+
+	g_free(vm2);
+	g_free(vm1);
+}
+
+static inline void
+catena_gamma(const uint8_t garlic, const uint8_t *salt,
+			 const uint8_t saltlen, uint8_t *r)
+{
+	const uint64_t q = UINT64_C(1) << ((3 * garlic + 3) / 4);
+
+	uint64_t i, j, j2;
+	uint8_t *tmp = g_malloc(H_LEN);
+	uint8_t *tmp2 = g_malloc(H_LEN);
+
+	__Hash1(salt, saltlen, tmp);
+	__Hash1(tmp, H_LEN, tmp2);
+	initXSState(tmp, tmp2);
+
+	__ResetState();
+	for (i = 0; i < q; i++) {
+		j = xorshift1024star() >> (64 - garlic);
+		j2 = xorshift1024star() >> (64 - garlic);
+		__HashFast(i, r + j * H_LEN, r + j2 * H_LEN, r + j * H_LEN);
+	}
+
+	g_free(tmp);
+	g_free(tmp2);
+}
+
+static void
+XOR(const uint8_t *input1, const uint8_t *input2, uint8_t *output)
+{
+	uint32_t i;
+
+	for (i = 0; i < H_LEN; i++) {
+		output[i] = input1[i] ^ input2[i];
+	}
+}
+
+/*
+ * Butterfly part
+ */
+/*
+ * Sigma function that defines the diagonal connections of a DBG
+ * diagonal front: flip the (g-i)th bit (Inverse Butterfly Graph)
+ * diagonal back: flip the i-(g-1)th bit (Regular Butterfly Graph)
+ */
+static uint64_t
+sigma(const uint8_t g, const uint64_t i, const uint64_t j)
+{
+	if (i < g) {
+		return (j ^ (UINT64_C(1) << (g - 1 - i))); /* diagonal front */
+	}
+	else {
+		return (j ^ (UINT64_C(1) << (i - (g - 1)))); /* diagonal back */
+	}
+}
+
+/*calculate actual index from level and element index*/
+static uint64_t
+idx(uint64_t i, uint64_t j, uint8_t co, uint64_t c, uint64_t m)
+{
+	i += co;
+	if (i % 3 == 0) {
+		return j;
+	}
+	else if (i % 3 == 1) {
+		if (j < m) {
+			/* still fits in the array */
+			return j + c;
+		}
+		else {
+			/* start overwriting elements at the beginning */
+			return j - m;
+		}
+	}
+	/* i % 3 == 2 */
+	return j + m;
+}
+
+/*
+ * Computes the hash of x using a Double Butterfly Graph,
+ * that forms as (2^g,\lamba)-Superconcentrator
+ */
+static void
+Flap(const uint8_t x[H_LEN], const uint8_t lambda, const uint8_t garlic,
+	 const uint8_t *salt, const uint8_t saltlen, uint8_t h[H_LEN])
+{
+	const uint64_t c = UINT64_C(1) << garlic;
+	const uint64_t m = UINT64_C(1) << (garlic - 1); /* 0.5 * 2^g */
+	const uint32_t l = 2 * garlic;
+
+	uint8_t *r = g_malloc((c + m) * H_LEN);
+	uint8_t *tmp = g_malloc(H_LEN);
+	uint64_t i, j;
+	uint8_t k;
+	uint8_t co = 0; /* carry over from last iteration */
+
+	/* Top row */
+	initmem(x, c, r);
+
+	/*Gamma Function*/
+	catena_gamma(garlic, salt, saltlen, r);
+
+	/* DBH */
+	for (k = 0; k < lambda; k++) {
+		for (i = 1; i < l; i++) {
+			XOR(r + idx(i - 1, c - 1, co, c, m) * H_LEN,
+				r + idx(i - 1, 0, co, c, m) * H_LEN, tmp);
+
+			/*
+			 * r0 := H(tmp || vsigma(g,i-1,0) )
+			 * __Hash2(tmp, H_LEN, r+idx(i-1,sigma(garlic,i-1,0),co,c,m) * H_LEN, H_LEN,
+			 * r+idx(i,0,co,c,m) *H_LEN);
+			 */
+			H_First(tmp,
+					r + idx(i - 1, sigma(garlic, i - 1, 0), co, c, m) * H_LEN,
+					r + idx(i, 0, co, c, m) * H_LEN);
+			__ResetState();
+
+			/* vertices */
+			for (j = 1; j < c; j++) {
+				/* tmp:= rj-1 XOR vj */
+				XOR(r + idx(i, j - 1, co, c, m) * H_LEN,
+					r + idx(i - 1, j, co, c, m) * H_LEN, tmp);
+				/* rj := H(tmp || vsigma(g,i-1,j)) */
+				__HashFast(j, tmp,
+						   r + idx(i - 1, sigma(garlic, i - 1, j), co, c, m) * H_LEN,
+						   r + idx(i, j, co, c, m) * H_LEN);
+			}
+		}
+		co = (co + (i - 1)) % 3;
+	}
+
+	memcpy(h, r + idx(0, c - 1, co, c, m) * H_LEN, H_LEN);
+	g_free(r);
+	g_free(tmp);
+}
+
+static int
+__Catena(const uint8_t *pwd, const uint32_t pwdlen,
+		 const uint8_t *salt, const uint8_t saltlen, const uint8_t *data,
+		 const uint32_t datalen, const uint8_t lambda, const uint8_t min_garlic,
+		 const uint8_t garlic, const uint8_t hashlen, const uint8_t client,
+		 const uint8_t tweak_id, uint8_t *hash)
+{
+	uint8_t x[H_LEN];
+	uint8_t hv[H_LEN];
+	uint8_t t[4];
+	uint8_t c;
+
+	if ((hashlen > H_LEN) || (garlic > 63) || (min_garlic > garlic) || (lambda == 0) || (min_garlic == 0)) {
+		return -1;
+	}
+
+	/*Compute H(V)*/
+	__Hash1(VERSION_ID, strlen((char *) VERSION_ID), hv);
+
+	/* Compute Tweak */
+	t[0] = tweak_id;
+	t[1] = lambda;
+	t[2] = hashlen;
+	t[3] = saltlen;
+
+	/* Compute H(AD) */
+	__Hash1((uint8_t *) data, datalen, x);
+
+	/* Compute the initial value to hash  */
+	__Hash5(hv, H_LEN, t, 4, x, H_LEN, pwd, pwdlen, salt, saltlen, x);
+
+	/*Overwrite Password if enabled*/
+#ifdef OVERWRITE
+	erasepwd(pwd, pwdlen);
+#endif
+
+	Flap(x, lambda, (min_garlic + 1) / 2, salt, saltlen, x);
+
+	for (c = min_garlic; c <= garlic; c++) {
+		Flap(x, lambda, c, salt, saltlen, x);
+		if ((c == garlic) && (client == CLIENT)) {
+			memcpy(hash, x, H_LEN);
+			return 0;
+		}
+		__Hash2(&c, 1, x, H_LEN, x);
+		memset(x + hashlen, 0, H_LEN - hashlen);
+	}
+
+	memcpy(hash, x, hashlen);
+
+	return 0;
+}
+
+/***************************************************/
+
+int catena(const uint8_t *pwd, const uint32_t pwdlen, const uint8_t *salt,
+		   const uint8_t saltlen, const uint8_t *data, const uint32_t datalen,
+		   const uint8_t lambda, const uint8_t min_garlic, const uint8_t garlic,
+		   const uint8_t hashlen, uint8_t *hash)
+{
+	return __Catena(pwd, pwdlen, salt, saltlen, data, datalen, lambda,
+					min_garlic, garlic, hashlen, REGULAR, PASSWORD_HASHING_MODE, hash);
+}
+
+int simple_catena(const uint8_t *pwd, const uint32_t pwdlen,
+				  const uint8_t *salt, const uint8_t saltlen,
+				  const uint8_t *data, const uint32_t datalen,
+				  uint8_t hash[H_LEN])
+{
+	return __Catena(pwd, pwdlen, salt, saltlen, data, datalen,
+					LAMBDA, MIN_GARLIC, GARLIC, H_LEN,
+					REGULAR, PASSWORD_HASHING_MODE, hash);
+}
+
+int catena_test(void)
+{
+	/* From catena-v3.1 spec */
+	guint8 pw[] = {0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64};
+	guint8 salt[] = {0x73, 0x61, 0x6c, 0x74};
+	guint8 ad[] = {0x64, 0x61, 0x74, 0x61};
+	guint8 expected[] = {
+		0x20, 0xc5, 0x91, 0x93, 0x8f, 0xc3, 0xaf, 0xcc, 0x3b, 0xba, 0x91, 0xd2, 0xfb,
+		0x84, 0xbf, 0x7b, 0x44, 0x04, 0xf9, 0x4c, 0x45, 0xed, 0x4d, 0x11, 0xa7, 0xe2,
+		0xb4, 0x12, 0x3e, 0xab, 0x0b, 0x77, 0x4a, 0x12, 0xb4, 0x22, 0xd0, 0xda, 0xb5,
+		0x25, 0x29, 0x02, 0xfc, 0x54, 0x47, 0xea, 0x82, 0x63, 0x8c, 0x1a, 0xfb, 0xa7,
+		0xa9, 0x94, 0x24, 0x13, 0x0e, 0x44, 0x36, 0x3b, 0x9d, 0x9f, 0xc9, 0x60};
+	guint8 real[H_LEN];
+
+	if (catena(pw, sizeof(pw), salt, sizeof(salt), ad, sizeof(ad),
+			   4, 10, 10, H_LEN, real) != 0) {
+		return -1;
+	}
+
+	return memcmp(real, expected, H_LEN);
+}
diff --git a/src/libcryptobox/catena/catena.h b/src/libcryptobox/catena/catena.h
new file mode 100644
index 0000000..1fcea21
--- /dev/null
+++ b/src/libcryptobox/catena/catena.h
@@ -0,0 +1,62 @@
+/*-
+ * Copyright 2016 Vsevolod Stakhov
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#ifndef SRC_LIBCRYPTOBOX_CATENA_CATENA_H_
+#define SRC_LIBCRYPTOBOX_CATENA_CATENA_H_
+
+/* Modes  */
+#define PASSWORD_HASHING_MODE 0
+#define KEY_DERIVATION_MODE 1
+#define REGULAR 0
+#define CLIENT 1
+
+#define CATENA_HLEN 64
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+int catena(const uint8_t *pwd, const uint32_t pwdlen,
+		   const uint8_t *salt, const uint8_t saltlen,
+		   const uint8_t *data, const uint32_t datalen,
+		   const uint8_t lambda, const uint8_t min_garlic,
+		   const uint8_t garlic, const uint8_t hashlen, uint8_t *hash);
+
+/**
+ * Simple interface for catena PBKDF
+ * @param pwd password
+ * @param pwdlen length of password
+ * @param salt salt
+ * @param saltlen length of salt
+ * @param data additional data
+ * @param datalen length of additional data
+ * @param hash output hash
+ * @return 0 if hash is generated, -1 in case of error
+ */
+int simple_catena(const uint8_t *pwd, const uint32_t pwdlen,
+				  const uint8_t *salt, const uint8_t saltlen,
+				  const uint8_t *data, const uint32_t datalen,
+				  uint8_t hash[CATENA_HLEN]);
+
+/**
+ * Run a quick test on catena implementation
+ */
+int catena_test(void);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* SRC_LIBCRYPTOBOX_CATENA_CATENA_H_ */
diff --git a/src/libcryptobox/chacha20/avx.S b/src/libcryptobox/chacha20/avx.S
new file mode 100644
index 0000000..7689b84
--- /dev/null
+++ b/src/libcryptobox/chacha20/avx.S
@@ -0,0 +1,614 @@
+#include "../macro.S"
+#include "constants.S"
+SECTION_TEXT
+
+GLOBAL_HIDDEN_FN chacha_blocks_avx
+chacha_blocks_avx_local:
+pushq %rbx
+pushq %rbp
+movq %rsp, %rbp
+andq $~63, %rsp
+subq $512, %rsp
+LOAD_VAR_PIC chacha_constants, %rax
+vmovdqa 0(%rax), %xmm8
+vmovdqa 16(%rax), %xmm6
+vmovdqa 32(%rax), %xmm7
+vmovdqu 0(%rdi), %xmm9
+vmovdqu 16(%rdi), %xmm10
+vmovdqu 32(%rdi), %xmm11
+movq 48(%rdi), %rax
+movq $1, %r9
+vmovdqa %xmm8, 0(%rsp)
+vmovdqa %xmm9, 16(%rsp)
+vmovdqa %xmm10, 32(%rsp)
+vmovdqa %xmm11, 48(%rsp)
+vmovdqa %xmm6, 80(%rsp)
+vmovdqa %xmm7, 96(%rsp)
+movq %rax, 64(%rsp)
+cmpq $256, %rcx
+jb chacha_blocks_avx_below256
+vpshufd $0x00, %xmm8, %xmm0
+vpshufd $0x55, %xmm8, %xmm1
+vpshufd $0xaa, %xmm8, %xmm2
+vpshufd $0xff, %xmm8, %xmm3
+vmovdqa %xmm0, 128(%rsp)
+vmovdqa %xmm1, 144(%rsp)
+vmovdqa %xmm2, 160(%rsp)
+vmovdqa %xmm3, 176(%rsp)
+vpshufd $0x00, %xmm9, %xmm0
+vpshufd $0x55, %xmm9, %xmm1
+vpshufd $0xaa, %xmm9, %xmm2
+vpshufd $0xff, %xmm9, %xmm3
+vmovdqa %xmm0, 192(%rsp)
+vmovdqa %xmm1, 208(%rsp)
+vmovdqa %xmm2, 224(%rsp)
+vmovdqa %xmm3, 240(%rsp)
+vpshufd $0x00, %xmm10, %xmm0
+vpshufd $0x55, %xmm10, %xmm1
+vpshufd $0xaa, %xmm10, %xmm2
+vpshufd $0xff, %xmm10, %xmm3
+vmovdqa %xmm0, 256(%rsp)
+vmovdqa %xmm1, 272(%rsp)
+vmovdqa %xmm2, 288(%rsp)
+vmovdqa %xmm3, 304(%rsp)
+vpshufd $0xaa, %xmm11, %xmm0
+vpshufd $0xff, %xmm11, %xmm1
+vmovdqa %xmm0, 352(%rsp)
+vmovdqa %xmm1, 368(%rsp)
+jmp chacha_blocks_avx_atleast256
+.p2align 6,,63
+nop
+nop
+nop
+nop
+nop
+chacha_blocks_avx_atleast256:
+movq 48(%rsp), %rax
+leaq 1(%rax), %r8
+leaq 2(%rax), %r9
+leaq 3(%rax), %r10
+leaq 4(%rax), %rbx
+movl %eax, 320(%rsp)
+movl %r8d, 4+320(%rsp)
+movl %r9d, 8+320(%rsp)
+movl %r10d, 12+320(%rsp)
+shrq $32, %rax
+shrq $32, %r8
+shrq $32, %r9
+shrq $32, %r10
+movl %eax, 336(%rsp)
+movl %r8d, 4+336(%rsp)
+movl %r9d, 8+336(%rsp)
+movl %r10d, 12+336(%rsp)
+movq %rbx, 48(%rsp)
+movq 64(%rsp), %rax
+vmovdqa 128(%rsp), %xmm0
+vmovdqa 144(%rsp), %xmm1
+vmovdqa 160(%rsp), %xmm2
+vmovdqa 176(%rsp), %xmm3
+vmovdqa 192(%rsp), %xmm4
+vmovdqa 208(%rsp), %xmm5
+vmovdqa 224(%rsp), %xmm6
+vmovdqa 240(%rsp), %xmm7
+vmovdqa 256(%rsp), %xmm8
+vmovdqa 272(%rsp), %xmm9
+vmovdqa 288(%rsp), %xmm10
+vmovdqa 304(%rsp), %xmm11
+vmovdqa 320(%rsp), %xmm12
+vmovdqa 336(%rsp), %xmm13
+vmovdqa 352(%rsp), %xmm14
+vmovdqa 368(%rsp), %xmm15
+chacha_blocks_avx_mainloop1:
+vpaddd %xmm0, %xmm4, %xmm0
+vpaddd %xmm1, %xmm5, %xmm1
+vpxor %xmm12, %xmm0, %xmm12
+vpxor %xmm13, %xmm1, %xmm13
+vpaddd %xmm2, %xmm6, %xmm2
+vpaddd %xmm3, %xmm7, %xmm3
+vpxor %xmm14, %xmm2, %xmm14
+vpxor %xmm15, %xmm3, %xmm15
+vpshufb 80(%rsp), %xmm12, %xmm12
+vpshufb 80(%rsp), %xmm13, %xmm13
+vpaddd %xmm8, %xmm12, %xmm8
+vpaddd %xmm9, %xmm13, %xmm9
+vpshufb 80(%rsp), %xmm14, %xmm14
+vpshufb 80(%rsp), %xmm15, %xmm15
+vpaddd %xmm10, %xmm14, %xmm10
+vpaddd %xmm11, %xmm15, %xmm11
+vmovdqa %xmm12, 112(%rsp)
+vpxor %xmm4, %xmm8, %xmm4
+vpxor %xmm5, %xmm9, %xmm5
+vpslld $ 12, %xmm4, %xmm12
+vpsrld $20, %xmm4, %xmm4
+vpxor %xmm4, %xmm12, %xmm4
+vpslld $ 12, %xmm5, %xmm12
+vpsrld $20, %xmm5, %xmm5
+vpxor %xmm5, %xmm12, %xmm5
+vpxor %xmm6, %xmm10, %xmm6
+vpxor %xmm7, %xmm11, %xmm7
+vpslld $ 12, %xmm6, %xmm12
+vpsrld $20, %xmm6, %xmm6
+vpxor %xmm6, %xmm12, %xmm6
+vpslld $ 12, %xmm7, %xmm12
+vpsrld $20, %xmm7, %xmm7
+vpxor %xmm7, %xmm12, %xmm7
+vpaddd %xmm0, %xmm4, %xmm0
+vpaddd %xmm1, %xmm5, %xmm1
+vpxor 112(%rsp), %xmm0, %xmm12
+vpxor %xmm13, %xmm1, %xmm13
+vpaddd %xmm2, %xmm6, %xmm2
+vpaddd %xmm3, %xmm7, %xmm3
+vpxor %xmm14, %xmm2, %xmm14
+vpxor %xmm15, %xmm3, %xmm15
+vpshufb 96(%rsp), %xmm12, %xmm12
+vpshufb 96(%rsp), %xmm13, %xmm13
+vpaddd %xmm8, %xmm12, %xmm8
+vpaddd %xmm9, %xmm13, %xmm9
+vpshufb 96(%rsp), %xmm14, %xmm14
+vpshufb 96(%rsp), %xmm15, %xmm15
+vpaddd %xmm10, %xmm14, %xmm10
+vpaddd %xmm11, %xmm15, %xmm11
+vmovdqa %xmm12, 112(%rsp)
+vpxor %xmm4, %xmm8, %xmm4
+vpxor %xmm5, %xmm9, %xmm5
+vpslld $ 7, %xmm4, %xmm12
+vpsrld $25, %xmm4, %xmm4
+vpxor %xmm4, %xmm12, %xmm4
+vpslld $ 7, %xmm5, %xmm12
+vpsrld $25, %xmm5, %xmm5
+vpxor %xmm5, %xmm12, %xmm5
+vpxor %xmm6, %xmm10, %xmm6
+vpxor %xmm7, %xmm11, %xmm7
+vpslld $ 7, %xmm6, %xmm12
+vpsrld $25, %xmm6, %xmm6
+vpxor %xmm6, %xmm12, %xmm6
+vpslld $ 7, %xmm7, %xmm12
+vpsrld $25, %xmm7, %xmm7
+vpxor %xmm7, %xmm12, %xmm7
+vpaddd %xmm0, %xmm5, %xmm0
+vpaddd %xmm1, %xmm6, %xmm1
+vpxor %xmm15, %xmm0, %xmm15
+vpxor 112(%rsp), %xmm1, %xmm12
+vpaddd %xmm2, %xmm7, %xmm2
+vpaddd %xmm3, %xmm4, %xmm3
+vpxor %xmm13, %xmm2, %xmm13
+vpxor %xmm14, %xmm3, %xmm14
+vpshufb 80(%rsp), %xmm15, %xmm15
+vpshufb 80(%rsp), %xmm12, %xmm12
+vpaddd %xmm10, %xmm15, %xmm10
+vpaddd %xmm11, %xmm12, %xmm11
+vpshufb 80(%rsp), %xmm13, %xmm13
+vpshufb 80(%rsp), %xmm14, %xmm14
+vpaddd %xmm8, %xmm13, %xmm8
+vpaddd %xmm9, %xmm14, %xmm9
+vmovdqa %xmm15, 112(%rsp)
+vpxor %xmm5, %xmm10, %xmm5
+vpxor %xmm6, %xmm11, %xmm6
+vpslld $ 12, %xmm5, %xmm15
+vpsrld $20, %xmm5, %xmm5
+vpxor %xmm5, %xmm15, %xmm5
+vpslld $ 12, %xmm6, %xmm15
+vpsrld $20, %xmm6, %xmm6
+vpxor %xmm6, %xmm15, %xmm6
+vpxor %xmm7, %xmm8, %xmm7
+vpxor %xmm4, %xmm9, %xmm4
+vpslld $ 12, %xmm7, %xmm15
+vpsrld $20, %xmm7, %xmm7
+vpxor %xmm7, %xmm15, %xmm7
+vpslld $ 12, %xmm4, %xmm15
+vpsrld $20, %xmm4, %xmm4
+vpxor %xmm4, %xmm15, %xmm4
+vpaddd %xmm0, %xmm5, %xmm0
+vpaddd %xmm1, %xmm6, %xmm1
+vpxor 112(%rsp), %xmm0, %xmm15
+vpxor %xmm12, %xmm1, %xmm12
+vpaddd %xmm2, %xmm7, %xmm2
+vpaddd %xmm3, %xmm4, %xmm3
+vpxor %xmm13, %xmm2, %xmm13
+vpxor %xmm14, %xmm3, %xmm14
+vpshufb 96(%rsp), %xmm15, %xmm15
+vpshufb 96(%rsp), %xmm12, %xmm12
+vpaddd %xmm10, %xmm15, %xmm10
+vpaddd %xmm11, %xmm12, %xmm11
+vpshufb 96(%rsp), %xmm13, %xmm13
+vpshufb 96(%rsp), %xmm14, %xmm14
+vpaddd %xmm8, %xmm13, %xmm8
+vpaddd %xmm9, %xmm14, %xmm9
+vmovdqa %xmm15, 112(%rsp)
+vpxor %xmm5, %xmm10, %xmm5
+vpxor %xmm6, %xmm11, %xmm6
+vpslld $ 7, %xmm5, %xmm15
+vpsrld $25, %xmm5, %xmm5
+vpxor %xmm5, %xmm15, %xmm5
+vpslld $ 7, %xmm6, %xmm15
+vpsrld $25, %xmm6, %xmm6
+vpxor %xmm6, %xmm15, %xmm6
+vpxor %xmm7, %xmm8, %xmm7
+vpxor %xmm4, %xmm9, %xmm4
+vpslld $ 7, %xmm7, %xmm15
+vpsrld $25, %xmm7, %xmm7
+vpxor %xmm7, %xmm15, %xmm7
+vpslld $ 7, %xmm4, %xmm15
+vpsrld $25, %xmm4, %xmm4
+vpxor %xmm4, %xmm15, %xmm4
+vmovdqa 112(%rsp), %xmm15
+subq $2, %rax
+jnz chacha_blocks_avx_mainloop1
+vpaddd 128(%rsp), %xmm0, %xmm0
+vpaddd 144(%rsp), %xmm1, %xmm1
+vpaddd 160(%rsp), %xmm2, %xmm2
+vpaddd 176(%rsp), %xmm3, %xmm3
+vpaddd 192(%rsp), %xmm4, %xmm4
+vpaddd 208(%rsp), %xmm5, %xmm5
+vpaddd 224(%rsp), %xmm6, %xmm6
+vpaddd 240(%rsp), %xmm7, %xmm7
+vpaddd 256(%rsp), %xmm8, %xmm8
+vpaddd 272(%rsp), %xmm9, %xmm9
+vpaddd 288(%rsp), %xmm10, %xmm10
+vpaddd 304(%rsp), %xmm11, %xmm11
+vpaddd 320(%rsp), %xmm12, %xmm12
+vpaddd 336(%rsp), %xmm13, %xmm13
+vpaddd 352(%rsp), %xmm14, %xmm14
+vpaddd 368(%rsp), %xmm15, %xmm15
+vmovdqa %xmm8, 384(%rsp)
+vmovdqa %xmm9, 400(%rsp)
+vmovdqa %xmm10, 416(%rsp)
+vmovdqa %xmm11, 432(%rsp)
+vmovdqa %xmm12, 448(%rsp)
+vmovdqa %xmm13, 464(%rsp)
+vmovdqa %xmm14, 480(%rsp)
+vmovdqa %xmm15, 496(%rsp)
+vpunpckldq %xmm1, %xmm0, %xmm8
+vpunpckldq %xmm3, %xmm2, %xmm9
+vpunpckhdq %xmm1, %xmm0, %xmm12
+vpunpckhdq %xmm3, %xmm2, %xmm13
+vpunpckldq %xmm5, %xmm4, %xmm10
+vpunpckldq %xmm7, %xmm6, %xmm11
+vpunpckhdq %xmm5, %xmm4, %xmm14
+vpunpckhdq %xmm7, %xmm6, %xmm15
+vpunpcklqdq %xmm9, %xmm8, %xmm0
+vpunpcklqdq %xmm11, %xmm10, %xmm1
+vpunpckhqdq %xmm9, %xmm8, %xmm2
+vpunpckhqdq %xmm11, %xmm10, %xmm3
+vpunpcklqdq %xmm13, %xmm12, %xmm4
+vpunpcklqdq %xmm15, %xmm14, %xmm5
+vpunpckhqdq %xmm13, %xmm12, %xmm6
+vpunpckhqdq %xmm15, %xmm14, %xmm7
+andq %rsi, %rsi
+jz chacha_blocks_avx_noinput1
+vpxor 0(%rsi), %xmm0, %xmm0
+vpxor 16(%rsi), %xmm1, %xmm1
+vpxor 64(%rsi), %xmm2, %xmm2
+vpxor 80(%rsi), %xmm3, %xmm3
+vpxor 128(%rsi), %xmm4, %xmm4
+vpxor 144(%rsi), %xmm5, %xmm5
+vpxor 192(%rsi), %xmm6, %xmm6
+vpxor 208(%rsi), %xmm7, %xmm7
+vmovdqu %xmm0, 0(%rdx)
+vmovdqu %xmm1, 16(%rdx)
+vmovdqu %xmm2, 64(%rdx)
+vmovdqu %xmm3, 80(%rdx)
+vmovdqu %xmm4, 128(%rdx)
+vmovdqu %xmm5, 144(%rdx)
+vmovdqu %xmm6, 192(%rdx)
+vmovdqu %xmm7, 208(%rdx)
+vmovdqa 384(%rsp), %xmm0
+vmovdqa 400(%rsp), %xmm1
+vmovdqa 416(%rsp), %xmm2
+vmovdqa 432(%rsp), %xmm3
+vmovdqa 448(%rsp), %xmm4
+vmovdqa 464(%rsp), %xmm5
+vmovdqa 480(%rsp), %xmm6
+vmovdqa 496(%rsp), %xmm7
+vpunpckldq %xmm1, %xmm0, %xmm8
+vpunpckldq %xmm3, %xmm2, %xmm9
+vpunpckhdq %xmm1, %xmm0, %xmm12
+vpunpckhdq %xmm3, %xmm2, %xmm13
+vpunpckldq %xmm5, %xmm4, %xmm10
+vpunpckldq %xmm7, %xmm6, %xmm11
+vpunpckhdq %xmm5, %xmm4, %xmm14
+vpunpckhdq %xmm7, %xmm6, %xmm15
+vpunpcklqdq %xmm9, %xmm8, %xmm0
+vpunpcklqdq %xmm11, %xmm10, %xmm1
+vpunpckhqdq %xmm9, %xmm8, %xmm2
+vpunpckhqdq %xmm11, %xmm10, %xmm3
+vpunpcklqdq %xmm13, %xmm12, %xmm4
+vpunpcklqdq %xmm15, %xmm14, %xmm5
+vpunpckhqdq %xmm13, %xmm12, %xmm6
+vpunpckhqdq %xmm15, %xmm14, %xmm7
+vpxor 32(%rsi), %xmm0, %xmm0
+vpxor 48(%rsi), %xmm1, %xmm1
+vpxor 96(%rsi), %xmm2, %xmm2
+vpxor 112(%rsi), %xmm3, %xmm3
+vpxor 160(%rsi), %xmm4, %xmm4
+vpxor 176(%rsi), %xmm5, %xmm5
+vpxor 224(%rsi), %xmm6, %xmm6
+vpxor 240(%rsi), %xmm7, %xmm7
+vmovdqu %xmm0, 32(%rdx)
+vmovdqu %xmm1, 48(%rdx)
+vmovdqu %xmm2, 96(%rdx)
+vmovdqu %xmm3, 112(%rdx)
+vmovdqu %xmm4, 160(%rdx)
+vmovdqu %xmm5, 176(%rdx)
+vmovdqu %xmm6, 224(%rdx)
+vmovdqu %xmm7, 240(%rdx)
+addq $256, %rsi
+jmp chacha_blocks_avx_mainloop_cont
+chacha_blocks_avx_noinput1:
+vmovdqu %xmm0, 0(%rdx)
+vmovdqu %xmm1, 16(%rdx)
+vmovdqu %xmm2, 64(%rdx)
+vmovdqu %xmm3, 80(%rdx)
+vmovdqu %xmm4, 128(%rdx)
+vmovdqu %xmm5, 144(%rdx)
+vmovdqu %xmm6, 192(%rdx)
+vmovdqu %xmm7, 208(%rdx)
+vmovdqa 384(%rsp), %xmm0
+vmovdqa 400(%rsp), %xmm1
+vmovdqa 416(%rsp), %xmm2
+vmovdqa 432(%rsp), %xmm3
+vmovdqa 448(%rsp), %xmm4
+vmovdqa 464(%rsp), %xmm5
+vmovdqa 480(%rsp), %xmm6
+vmovdqa 496(%rsp), %xmm7
+vpunpckldq %xmm1, %xmm0, %xmm8
+vpunpckldq %xmm3, %xmm2, %xmm9
+vpunpckhdq %xmm1, %xmm0, %xmm12
+vpunpckhdq %xmm3, %xmm2, %xmm13
+vpunpckldq %xmm5, %xmm4, %xmm10
+vpunpckldq %xmm7, %xmm6, %xmm11
+vpunpckhdq %xmm5, %xmm4, %xmm14
+vpunpckhdq %xmm7, %xmm6, %xmm15
+vpunpcklqdq %xmm9, %xmm8, %xmm0
+vpunpcklqdq %xmm11, %xmm10, %xmm1
+vpunpckhqdq %xmm9, %xmm8, %xmm2
+vpunpckhqdq %xmm11, %xmm10, %xmm3
+vpunpcklqdq %xmm13, %xmm12, %xmm4
+vpunpcklqdq %xmm15, %xmm14, %xmm5
+vpunpckhqdq %xmm13, %xmm12, %xmm6
+vpunpckhqdq %xmm15, %xmm14, %xmm7
+vmovdqu %xmm0, 32(%rdx)
+vmovdqu %xmm1, 48(%rdx)
+vmovdqu %xmm2, 96(%rdx)
+vmovdqu %xmm3, 112(%rdx)
+vmovdqu %xmm4, 160(%rdx)
+vmovdqu %xmm5, 176(%rdx)
+vmovdqu %xmm6, 224(%rdx)
+vmovdqu %xmm7, 240(%rdx)
+chacha_blocks_avx_mainloop_cont:
+addq $256, %rdx
+subq $256, %rcx
+cmp $256, %rcx
+jae chacha_blocks_avx_atleast256
+vmovdqa 80(%rsp), %xmm6
+vmovdqa 96(%rsp), %xmm7
+vmovdqa 0(%rsp), %xmm8
+vmovdqa 16(%rsp), %xmm9
+vmovdqa 32(%rsp), %xmm10
+vmovdqa 48(%rsp), %xmm11
+movq $1, %r9
+chacha_blocks_avx_below256:
+vmovq %r9, %xmm5
+andq %rcx, %rcx
+jz chacha_blocks_avx_done
+cmpq $64, %rcx
+jae chacha_blocks_avx_above63
+movq %rdx, %r9
+andq %rsi, %rsi
+jz chacha_blocks_avx_noinput2
+movq %rcx, %r10
+movq %rsp, %rdx
+addq %r10, %rsi
+addq %r10, %rdx
+negq %r10
+chacha_blocks_avx_copyinput:
+movb (%rsi, %r10), %al
+movb %al, (%rdx, %r10)
+incq %r10
+jnz chacha_blocks_avx_copyinput
+movq %rsp, %rsi
+chacha_blocks_avx_noinput2:
+movq %rsp, %rdx
+chacha_blocks_avx_above63:
+vmovdqa %xmm8, %xmm0
+vmovdqa %xmm9, %xmm1
+vmovdqa %xmm10, %xmm2
+vmovdqa %xmm11, %xmm3
+movq 64(%rsp), %rax
+chacha_blocks_avx_mainloop2:
+vpaddd %xmm0, %xmm1, %xmm0
+vpxor %xmm3, %xmm0, %xmm3
+vpshufb %xmm6, %xmm3, %xmm3
+vpaddd %xmm2, %xmm3, %xmm2
+vpxor %xmm1, %xmm2, %xmm1
+vpslld $12, %xmm1, %xmm4
+vpsrld $20, %xmm1, %xmm1
+vpxor %xmm1, %xmm4, %xmm1
+vpaddd %xmm0, %xmm1, %xmm0
+vpxor %xmm3, %xmm0, %xmm3
+vpshufb %xmm7, %xmm3, %xmm3
+vpshufd $0x93, %xmm0, %xmm0
+vpaddd %xmm2, %xmm3, %xmm2
+vpshufd $0x4e, %xmm3, %xmm3
+vpxor %xmm1, %xmm2, %xmm1
+vpshufd $0x39, %xmm2, %xmm2
+vpslld $7, %xmm1, %xmm4
+vpsrld $25, %xmm1, %xmm1
+vpxor %xmm1, %xmm4, %xmm1
+vpaddd %xmm0, %xmm1, %xmm0
+vpxor %xmm3, %xmm0, %xmm3
+vpshufb %xmm6, %xmm3, %xmm3
+vpaddd %xmm2, %xmm3, %xmm2
+vpxor %xmm1, %xmm2, %xmm1
+vpslld $12, %xmm1, %xmm4
+vpsrld $20, %xmm1, %xmm1
+vpxor %xmm1, %xmm4, %xmm1
+vpaddd %xmm0, %xmm1, %xmm0
+vpxor %xmm3, %xmm0, %xmm3
+vpshufb %xmm7, %xmm3, %xmm3
+vpshufd $0x39, %xmm0, %xmm0
+vpaddd %xmm2, %xmm3, %xmm2
+vpshufd $0x4e, %xmm3, %xmm3
+vpxor %xmm1, %xmm2, %xmm1
+vpshufd $0x93, %xmm2, %xmm2
+vpslld $7, %xmm1, %xmm4
+vpsrld $25, %xmm1, %xmm1
+vpxor %xmm1, %xmm4, %xmm1
+subq $2, %rax
+jnz chacha_blocks_avx_mainloop2
+vpaddd %xmm0, %xmm8, %xmm0
+vpaddd %xmm1, %xmm9, %xmm1
+vpaddd %xmm2, %xmm10, %xmm2
+vpaddd %xmm3, %xmm11, %xmm3
+andq %rsi, %rsi
+jz chacha_blocks_avx_noinput3
+vpxor 0(%rsi), %xmm0, %xmm0
+vpxor 16(%rsi), %xmm1, %xmm1
+vpxor 32(%rsi), %xmm2, %xmm2
+vpxor 48(%rsi), %xmm3, %xmm3
+addq $64, %rsi
+chacha_blocks_avx_noinput3:
+vmovdqu %xmm0, 0(%rdx)
+vmovdqu %xmm1, 16(%rdx)
+vmovdqu %xmm2, 32(%rdx)
+vmovdqu %xmm3, 48(%rdx)
+vpaddq %xmm11, %xmm5, %xmm11
+cmpq $64, %rcx
+jbe chacha_blocks_avx_mainloop2_finishup
+addq $64, %rdx
+subq $64, %rcx
+jmp chacha_blocks_avx_below256
+chacha_blocks_avx_mainloop2_finishup:
+cmpq $64, %rcx
+je chacha_blocks_avx_done
+addq %rcx, %r9
+addq %rcx, %rdx
+negq %rcx
+chacha_blocks_avx_copyoutput:
+movb (%rdx, %rcx), %al
+movb %al, (%r9, %rcx)
+incq %rcx
+jnz chacha_blocks_avx_copyoutput
+chacha_blocks_avx_done:
+vmovdqu %xmm11, 32(%rdi)
+movq %rbp, %rsp
+popq %rbp
+popq %rbx
+ret
+FN_END chacha_blocks_avx
+
+GLOBAL_HIDDEN_FN hchacha_avx
+hchacha_avx_local:
+LOAD_VAR_PIC chacha_constants, %rax
+vmovdqa 0(%rax), %xmm0
+vmovdqa 16(%rax), %xmm6
+vmovdqa 32(%rax), %xmm5
+vmovdqu 0(%rdi), %xmm1
+vmovdqu 16(%rdi), %xmm2
+vmovdqu 0(%rsi), %xmm3
+hhacha_mainloop_avx:
+vpaddd %xmm0, %xmm1, %xmm0
+vpxor %xmm3, %xmm0, %xmm3
+vpshufb %xmm6, %xmm3, %xmm3
+vpaddd %xmm2, %xmm3, %xmm2
+vpxor %xmm1, %xmm2, %xmm1
+vpslld $12, %xmm1, %xmm4
+vpsrld $20, %xmm1, %xmm1
+vpxor %xmm1, %xmm4, %xmm1
+vpaddd %xmm0, %xmm1, %xmm0
+vpxor %xmm3, %xmm0, %xmm3
+vpshufb %xmm5, %xmm3, %xmm3
+vpaddd %xmm2, %xmm3, %xmm2
+vpxor %xmm1, %xmm2, %xmm1
+vpslld $7, %xmm1, %xmm4
+vpsrld $25, %xmm1, %xmm1
+vpshufd $0x93, %xmm0, %xmm0
+vpxor %xmm1, %xmm4, %xmm1
+vpshufd $0x4e, %xmm3, %xmm3
+vpaddd %xmm0, %xmm1, %xmm0
+vpxor %xmm3, %xmm0, %xmm3
+vpshufb %xmm6, %xmm3, %xmm3
+vpshufd $0x39, %xmm2, %xmm2
+vpaddd %xmm2, %xmm3, %xmm2
+vpxor %xmm1, %xmm2, %xmm1
+vpslld $12, %xmm1, %xmm4
+vpsrld $20, %xmm1, %xmm1
+vpxor %xmm1, %xmm4, %xmm1
+vpaddd %xmm0, %xmm1, %xmm0
+vpxor %xmm3, %xmm0, %xmm3
+vpshufb %xmm5, %xmm3, %xmm3
+vpaddd %xmm2, %xmm3, %xmm2
+vpxor %xmm1, %xmm2, %xmm1
+vpshufd $0x39, %xmm0, %xmm0
+vpslld $7, %xmm1, %xmm4
+vpshufd $0x4e, %xmm3, %xmm3
+vpsrld $25, %xmm1, %xmm1
+vpshufd $0x93, %xmm2, %xmm2
+vpxor %xmm1, %xmm4, %xmm1
+subl $2, %ecx
+jne hhacha_mainloop_avx
+vmovdqu %xmm0, (%rdx)
+vmovdqu %xmm3, 16(%rdx)
+ret
+FN_END hchacha_avx
+
+GLOBAL_HIDDEN_FN_EXT chacha_avx, 6, 16
+pushq %rbp
+movq %rsp, %rbp
+subq $64, %rsp
+andq $~63, %rsp
+vmovdqu 0(%rdi), %xmm0
+vmovdqu 16(%rdi), %xmm1
+vmovdqa %xmm0, 0(%rsp)
+vmovdqa %xmm1, 16(%rsp)
+xorq %rdi, %rdi
+movq %rdi, 32(%rsp)
+movq 0(%rsi), %rsi
+movq %rsi, 40(%rsp)
+movq %r9, 48(%rsp)
+movq %rsp, %rdi
+movq %rdx, %rsi
+movq %rcx, %rdx
+movq %r8, %rcx
+call chacha_blocks_avx_local
+vpxor %xmm0, %xmm0, %xmm0
+vmovdqa %xmm0, 0(%rsp)
+vmovdqa %xmm0, 16(%rsp)
+vmovdqa %xmm0, 32(%rsp)
+movq %rbp, %rsp
+popq %rbp
+ret
+FN_END chacha_avx
+
+GLOBAL_HIDDEN_FN_EXT xchacha_avx, 6, 16
+pushq %rbp
+pushq %rbx
+movq %rsp, %rbp
+subq $64, %rsp
+andq $~63, %rsp
+movq %rsp, %rbx
+xorq %rax, %rax
+movq %rax, 32(%rbx)
+movq 16(%rsi), %rax
+movq %rax, 40(%rbx)
+movq %r9, 48(%rbx)
+pushq %rdx
+pushq %rcx
+pushq %r8
+movq %rbx, %rdx
+movq %r9, %rcx
+call hchacha_avx_local
+movq %rbx, %rdi
+popq %rcx
+popq %rdx
+popq %rsi
+call chacha_blocks_avx_local
+vpxor %xmm0, %xmm0, %xmm0
+vmovdqa %xmm0, 0(%rbx)
+vmovdqa %xmm0, 16(%rbx)
+vmovdqa %xmm0, 32(%rbx)
+movq %rbp, %rsp
+popq %rbx
+popq %rbp
+ret
+FN_END xchacha_avx
diff --git a/src/libcryptobox/chacha20/avx2.S b/src/libcryptobox/chacha20/avx2.S
new file mode 100644
index 0000000..efd0f54
--- /dev/null
+++ b/src/libcryptobox/chacha20/avx2.S
@@ -0,0 +1,1018 @@
+#include "../macro.S"
+#include "constants.S"
+SECTION_TEXT
+
+GLOBAL_HIDDEN_FN chacha_blocks_avx2
+chacha_blocks_avx2_local:
+pushq %rbx
+pushq %rbp
+pushq %r12
+pushq %r13
+pushq %r14
+movq %rsp, %rbp
+andq $~63, %rsp
+subq $512, %rsp
+LOAD_VAR_PIC chacha_constants, %rax
+vmovdqa 0(%rax), %xmm8
+vmovdqa 16(%rax), %xmm6
+vmovdqa 32(%rax), %xmm7
+vmovdqu 0(%rdi), %xmm9
+vmovdqu 16(%rdi), %xmm10
+vmovdqu 32(%rdi), %xmm11
+movq 48(%rdi), %rax
+movq $1, %r9
+vmovdqa %xmm8, 0(%rsp)
+vmovdqa %xmm9, 16(%rsp)
+vmovdqa %xmm10, 32(%rsp)
+vmovdqa %xmm11, 48(%rsp)
+movq %rax, 64(%rsp)
+vmovdqa %xmm6, 448(%rsp)
+vmovdqa %xmm6, 464(%rsp)
+vmovdqa %xmm7, 480(%rsp)
+vmovdqa %xmm7, 496(%rsp)
+cmpq $512, %rcx
+jae chacha_blocks_avx2_atleast512
+cmp $256, %rcx
+jae chacha_blocks_avx2_atleast256
+jmp chacha_blocks_avx2_below256
+.p2align 6,,63
+chacha_blocks_avx2_atleast512:
+movq 48(%rsp), %rax
+leaq 1(%rax), %r8
+leaq 2(%rax), %r9
+leaq 3(%rax), %r10
+leaq 4(%rax), %rbx
+leaq 5(%rax), %r11
+leaq 6(%rax), %r12
+leaq 7(%rax), %r13
+leaq 8(%rax), %r14
+movl %eax, 128(%rsp)
+movl %r8d, 4+128(%rsp)
+movl %r9d, 8+128(%rsp)
+movl %r10d, 12+128(%rsp)
+movl %ebx, 16+128(%rsp)
+movl %r11d, 20+128(%rsp)
+movl %r12d, 24+128(%rsp)
+movl %r13d, 28+128(%rsp)
+shrq $32, %rax
+shrq $32, %r8
+shrq $32, %r9
+shrq $32, %r10
+shrq $32, %rbx
+shrq $32, %r11
+shrq $32, %r12
+shrq $32, %r13
+movl %eax, 160(%rsp)
+movl %r8d, 4+160(%rsp)
+movl %r9d, 8+160(%rsp)
+movl %r10d, 12+160(%rsp)
+movl %ebx, 16+160(%rsp)
+movl %r11d, 20+160(%rsp)
+movl %r12d, 24+160(%rsp)
+movl %r13d, 28+160(%rsp)
+movq %r14, 48(%rsp)
+movq 64(%rsp), %rax
+vpbroadcastd 0(%rsp), %ymm0
+vpbroadcastd 4+0(%rsp), %ymm1
+vpbroadcastd 8+0(%rsp), %ymm2
+vpbroadcastd 12+0(%rsp), %ymm3
+vpbroadcastd 16(%rsp), %ymm4
+vpbroadcastd 4+16(%rsp), %ymm5
+vpbroadcastd 8+16(%rsp), %ymm6
+vpbroadcastd 12+16(%rsp), %ymm7
+vpbroadcastd 32(%rsp), %ymm8
+vpbroadcastd 4+32(%rsp), %ymm9
+vpbroadcastd 8+32(%rsp), %ymm10
+vpbroadcastd 12+32(%rsp), %ymm11
+vpbroadcastd 8+48(%rsp), %ymm14
+vpbroadcastd 12+48(%rsp), %ymm15
+vmovdqa 128(%rsp), %ymm12
+vmovdqa 160(%rsp), %ymm13
+chacha_blocks_avx2_mainloop1:
+vpaddd %ymm0, %ymm4, %ymm0
+vpaddd %ymm1, %ymm5, %ymm1
+vpxor %ymm12, %ymm0, %ymm12
+vpxor %ymm13, %ymm1, %ymm13
+vpaddd %ymm2, %ymm6, %ymm2
+vpaddd %ymm3, %ymm7, %ymm3
+vpxor %ymm14, %ymm2, %ymm14
+vpxor %ymm15, %ymm3, %ymm15
+vpshufb 448(%rsp), %ymm12, %ymm12
+vpshufb 448(%rsp), %ymm13, %ymm13
+vpaddd %ymm8, %ymm12, %ymm8
+vpaddd %ymm9, %ymm13, %ymm9
+vpshufb 448(%rsp), %ymm14, %ymm14
+vpshufb 448(%rsp), %ymm15, %ymm15
+vpaddd %ymm10, %ymm14, %ymm10
+vpaddd %ymm11, %ymm15, %ymm11
+vmovdqa %ymm12, 96(%rsp)
+vpxor %ymm4, %ymm8, %ymm4
+vpxor %ymm5, %ymm9, %ymm5
+vpslld $ 12, %ymm4, %ymm12
+vpsrld $20, %ymm4, %ymm4
+vpxor %ymm4, %ymm12, %ymm4
+vpslld $ 12, %ymm5, %ymm12
+vpsrld $20, %ymm5, %ymm5
+vpxor %ymm5, %ymm12, %ymm5
+vpxor %ymm6, %ymm10, %ymm6
+vpxor %ymm7, %ymm11, %ymm7
+vpslld $ 12, %ymm6, %ymm12
+vpsrld $20, %ymm6, %ymm6
+vpxor %ymm6, %ymm12, %ymm6
+vpslld $ 12, %ymm7, %ymm12
+vpsrld $20, %ymm7, %ymm7
+vpxor %ymm7, %ymm12, %ymm7
+vpaddd %ymm0, %ymm4, %ymm0
+vpaddd %ymm1, %ymm5, %ymm1
+vpxor 96(%rsp), %ymm0, %ymm12
+vpxor %ymm13, %ymm1, %ymm13
+vpaddd %ymm2, %ymm6, %ymm2
+vpaddd %ymm3, %ymm7, %ymm3
+vpxor %ymm14, %ymm2, %ymm14
+vpxor %ymm15, %ymm3, %ymm15
+vpshufb 480(%rsp), %ymm12, %ymm12
+vpshufb 480(%rsp), %ymm13, %ymm13
+vpaddd %ymm8, %ymm12, %ymm8
+vpaddd %ymm9, %ymm13, %ymm9
+vpshufb 480(%rsp), %ymm14, %ymm14
+vpshufb 480(%rsp), %ymm15, %ymm15
+vpaddd %ymm10, %ymm14, %ymm10
+vpaddd %ymm11, %ymm15, %ymm11
+vmovdqa %ymm12, 96(%rsp)
+vpxor %ymm4, %ymm8, %ymm4
+vpxor %ymm5, %ymm9, %ymm5
+vpslld $ 7, %ymm4, %ymm12
+vpsrld $25, %ymm4, %ymm4
+vpxor %ymm4, %ymm12, %ymm4
+vpslld $ 7, %ymm5, %ymm12
+vpsrld $25, %ymm5, %ymm5
+vpxor %ymm5, %ymm12, %ymm5
+vpxor %ymm6, %ymm10, %ymm6
+vpxor %ymm7, %ymm11, %ymm7
+vpslld $ 7, %ymm6, %ymm12
+vpsrld $25, %ymm6, %ymm6
+vpxor %ymm6, %ymm12, %ymm6
+vpslld $ 7, %ymm7, %ymm12
+vpsrld $25, %ymm7, %ymm7
+vpxor %ymm7, %ymm12, %ymm7
+vpaddd %ymm0, %ymm5, %ymm0
+vpaddd %ymm1, %ymm6, %ymm1
+vpxor %ymm15, %ymm0, %ymm15
+vpxor 96(%rsp), %ymm1, %ymm12
+vpaddd %ymm2, %ymm7, %ymm2
+vpaddd %ymm3, %ymm4, %ymm3
+vpxor %ymm13, %ymm2, %ymm13
+vpxor %ymm14, %ymm3, %ymm14
+vpshufb 448(%rsp), %ymm15, %ymm15
+vpshufb 448(%rsp), %ymm12, %ymm12
+vpaddd %ymm10, %ymm15, %ymm10
+vpaddd %ymm11, %ymm12, %ymm11
+vpshufb 448(%rsp), %ymm13, %ymm13
+vpshufb 448(%rsp), %ymm14, %ymm14
+vpaddd %ymm8, %ymm13, %ymm8
+vpaddd %ymm9, %ymm14, %ymm9
+vmovdqa %ymm15, 96(%rsp)
+vpxor %ymm5, %ymm10, %ymm5
+vpxor %ymm6, %ymm11, %ymm6
+vpslld $ 12, %ymm5, %ymm15
+vpsrld $20, %ymm5, %ymm5
+vpxor %ymm5, %ymm15, %ymm5
+vpslld $ 12, %ymm6, %ymm15
+vpsrld $20, %ymm6, %ymm6
+vpxor %ymm6, %ymm15, %ymm6
+vpxor %ymm7, %ymm8, %ymm7
+vpxor %ymm4, %ymm9, %ymm4
+vpslld $ 12, %ymm7, %ymm15
+vpsrld $20, %ymm7, %ymm7
+vpxor %ymm7, %ymm15, %ymm7
+vpslld $ 12, %ymm4, %ymm15
+vpsrld $20, %ymm4, %ymm4
+vpxor %ymm4, %ymm15, %ymm4
+vpaddd %ymm0, %ymm5, %ymm0
+vpaddd %ymm1, %ymm6, %ymm1
+vpxor 96(%rsp), %ymm0, %ymm15
+vpxor %ymm12, %ymm1, %ymm12
+vpaddd %ymm2, %ymm7, %ymm2
+vpaddd %ymm3, %ymm4, %ymm3
+vpxor %ymm13, %ymm2, %ymm13
+vpxor %ymm14, %ymm3, %ymm14
+vpshufb 480(%rsp), %ymm15, %ymm15
+vpshufb 480(%rsp), %ymm12, %ymm12
+vpaddd %ymm10, %ymm15, %ymm10
+vpaddd %ymm11, %ymm12, %ymm11
+vpshufb 480(%rsp), %ymm13, %ymm13
+vpshufb 480(%rsp), %ymm14, %ymm14
+vpaddd %ymm8, %ymm13, %ymm8
+vpaddd %ymm9, %ymm14, %ymm9
+vmovdqa %ymm15, 96(%rsp)
+vpxor %ymm5, %ymm10, %ymm5
+vpxor %ymm6, %ymm11, %ymm6
+vpslld $ 7, %ymm5, %ymm15
+vpsrld $25, %ymm5, %ymm5
+vpxor %ymm5, %ymm15, %ymm5
+vpslld $ 7, %ymm6, %ymm15
+vpsrld $25, %ymm6, %ymm6
+vpxor %ymm6, %ymm15, %ymm6
+vpxor %ymm7, %ymm8, %ymm7
+vpxor %ymm4, %ymm9, %ymm4
+vpslld $ 7, %ymm7, %ymm15
+vpsrld $25, %ymm7, %ymm7
+vpxor %ymm7, %ymm15, %ymm7
+vpslld $ 7, %ymm4, %ymm15
+vpsrld $25, %ymm4, %ymm4
+vpxor %ymm4, %ymm15, %ymm4
+vmovdqa 96(%rsp), %ymm15
+subq $2, %rax
+jnz chacha_blocks_avx2_mainloop1
+vmovdqa %ymm8, 192(%rsp)
+vmovdqa %ymm9, 224(%rsp)
+vmovdqa %ymm10, 256(%rsp)
+vmovdqa %ymm11, 288(%rsp)
+vmovdqa %ymm12, 320(%rsp)
+vmovdqa %ymm13, 352(%rsp)
+vmovdqa %ymm14, 384(%rsp)
+vmovdqa %ymm15, 416(%rsp)
+vpbroadcastd 0(%rsp), %ymm8
+vpbroadcastd 4+0(%rsp), %ymm9
+vpbroadcastd 8+0(%rsp), %ymm10
+vpbroadcastd 12+0(%rsp), %ymm11
+vpbroadcastd 16(%rsp), %ymm12
+vpbroadcastd 4+16(%rsp), %ymm13
+vpbroadcastd 8+16(%rsp), %ymm14
+vpbroadcastd 12+16(%rsp), %ymm15
+vpaddd %ymm8, %ymm0, %ymm0
+vpaddd %ymm9, %ymm1, %ymm1
+vpaddd %ymm10, %ymm2, %ymm2
+vpaddd %ymm11, %ymm3, %ymm3
+vpaddd %ymm12, %ymm4, %ymm4
+vpaddd %ymm13, %ymm5, %ymm5
+vpaddd %ymm14, %ymm6, %ymm6
+vpaddd %ymm15, %ymm7, %ymm7
+vpunpckldq %ymm1, %ymm0, %ymm8
+vpunpckldq %ymm3, %ymm2, %ymm9
+vpunpckhdq %ymm1, %ymm0, %ymm12
+vpunpckhdq %ymm3, %ymm2, %ymm13
+vpunpckldq %ymm5, %ymm4, %ymm10
+vpunpckldq %ymm7, %ymm6, %ymm11
+vpunpckhdq %ymm5, %ymm4, %ymm14
+vpunpckhdq %ymm7, %ymm6, %ymm15
+vpunpcklqdq %ymm9, %ymm8, %ymm0
+vpunpcklqdq %ymm11, %ymm10, %ymm1
+vpunpckhqdq %ymm9, %ymm8, %ymm2
+vpunpckhqdq %ymm11, %ymm10, %ymm3
+vpunpcklqdq %ymm13, %ymm12, %ymm4
+vpunpcklqdq %ymm15, %ymm14, %ymm5
+vpunpckhqdq %ymm13, %ymm12, %ymm6
+vpunpckhqdq %ymm15, %ymm14, %ymm7
+vperm2i128 $0x20, %ymm1, %ymm0, %ymm8
+vperm2i128 $0x20, %ymm3, %ymm2, %ymm9
+vperm2i128 $0x31, %ymm1, %ymm0, %ymm12
+vperm2i128 $0x31, %ymm3, %ymm2, %ymm13
+vperm2i128 $0x20, %ymm5, %ymm4, %ymm10
+vperm2i128 $0x20, %ymm7, %ymm6, %ymm11
+vperm2i128 $0x31, %ymm5, %ymm4, %ymm14
+vperm2i128 $0x31, %ymm7, %ymm6, %ymm15
+andq %rsi, %rsi
+jz chacha_blocks_avx2_noinput1
+vpxor 0(%rsi), %ymm8, %ymm8
+vpxor 64(%rsi), %ymm9, %ymm9
+vpxor 128(%rsi), %ymm10, %ymm10
+vpxor 192(%rsi), %ymm11, %ymm11
+vpxor 256(%rsi), %ymm12, %ymm12
+vpxor 320(%rsi), %ymm13, %ymm13
+vpxor 384(%rsi), %ymm14, %ymm14
+vpxor 448(%rsi), %ymm15, %ymm15
+vmovdqu %ymm8, 0(%rdx)
+vmovdqu %ymm9, 64(%rdx)
+vmovdqu %ymm10, 128(%rdx)
+vmovdqu %ymm11, 192(%rdx)
+vmovdqu %ymm12, 256(%rdx)
+vmovdqu %ymm13, 320(%rdx)
+vmovdqu %ymm14, 384(%rdx)
+vmovdqu %ymm15, 448(%rdx)
+vmovdqa 192(%rsp), %ymm0
+vmovdqa 224(%rsp), %ymm1
+vmovdqa 256(%rsp), %ymm2
+vmovdqa 288(%rsp), %ymm3
+vmovdqa 320(%rsp), %ymm4
+vmovdqa 352(%rsp), %ymm5
+vmovdqa 384(%rsp), %ymm6
+vmovdqa 416(%rsp), %ymm7
+vpbroadcastd 32(%rsp), %ymm8
+vpbroadcastd 4+32(%rsp), %ymm9
+vpbroadcastd 8+32(%rsp), %ymm10
+vpbroadcastd 12+32(%rsp), %ymm11
+vmovdqa 128(%rsp), %ymm12
+vmovdqa 160(%rsp), %ymm13
+vpbroadcastd 8+48(%rsp), %ymm14
+vpbroadcastd 12+48(%rsp), %ymm15
+vpaddd %ymm8, %ymm0, %ymm0
+vpaddd %ymm9, %ymm1, %ymm1
+vpaddd %ymm10, %ymm2, %ymm2
+vpaddd %ymm11, %ymm3, %ymm3
+vpaddd %ymm12, %ymm4, %ymm4
+vpaddd %ymm13, %ymm5, %ymm5
+vpaddd %ymm14, %ymm6, %ymm6
+vpaddd %ymm15, %ymm7, %ymm7
+vpunpckldq %ymm1, %ymm0, %ymm8
+vpunpckldq %ymm3, %ymm2, %ymm9
+vpunpckhdq %ymm1, %ymm0, %ymm12
+vpunpckhdq %ymm3, %ymm2, %ymm13
+vpunpckldq %ymm5, %ymm4, %ymm10
+vpunpckldq %ymm7, %ymm6, %ymm11
+vpunpckhdq %ymm5, %ymm4, %ymm14
+vpunpckhdq %ymm7, %ymm6, %ymm15
+vpunpcklqdq %ymm9, %ymm8, %ymm0
+vpunpcklqdq %ymm11, %ymm10, %ymm1
+vpunpckhqdq %ymm9, %ymm8, %ymm2
+vpunpckhqdq %ymm11, %ymm10, %ymm3
+vpunpcklqdq %ymm13, %ymm12, %ymm4
+vpunpcklqdq %ymm15, %ymm14, %ymm5
+vpunpckhqdq %ymm13, %ymm12, %ymm6
+vpunpckhqdq %ymm15, %ymm14, %ymm7
+vperm2i128 $0x20, %ymm1, %ymm0, %ymm8
+vperm2i128 $0x20, %ymm3, %ymm2, %ymm9
+vperm2i128 $0x31, %ymm1, %ymm0, %ymm12
+vperm2i128 $0x31, %ymm3, %ymm2, %ymm13
+vperm2i128 $0x20, %ymm5, %ymm4, %ymm10
+vperm2i128 $0x20, %ymm7, %ymm6, %ymm11
+vperm2i128 $0x31, %ymm5, %ymm4, %ymm14
+vperm2i128 $0x31, %ymm7, %ymm6, %ymm15
+vpxor 32(%rsi), %ymm8, %ymm8
+vpxor 96(%rsi), %ymm9, %ymm9
+vpxor 160(%rsi), %ymm10, %ymm10
+vpxor 224(%rsi), %ymm11, %ymm11
+vpxor 288(%rsi), %ymm12, %ymm12
+vpxor 352(%rsi), %ymm13, %ymm13
+vpxor 416(%rsi), %ymm14, %ymm14
+vpxor 480(%rsi), %ymm15, %ymm15
+vmovdqu %ymm8, 32(%rdx)
+vmovdqu %ymm9, 96(%rdx)
+vmovdqu %ymm10, 160(%rdx)
+vmovdqu %ymm11, 224(%rdx)
+vmovdqu %ymm12, 288(%rdx)
+vmovdqu %ymm13, 352(%rdx)
+vmovdqu %ymm14, 416(%rdx)
+vmovdqu %ymm15, 480(%rdx)
+addq $512, %rsi
+jmp chacha_blocks_avx2_mainloop1_cont
+chacha_blocks_avx2_noinput1:
+vmovdqu %ymm8, 0(%rdx)
+vmovdqu %ymm9, 64(%rdx)
+vmovdqu %ymm10, 128(%rdx)
+vmovdqu %ymm11, 192(%rdx)
+vmovdqu %ymm12, 256(%rdx)
+vmovdqu %ymm13, 320(%rdx)
+vmovdqu %ymm14, 384(%rdx)
+vmovdqu %ymm15, 448(%rdx)
+vmovdqa 192(%rsp), %ymm0
+vmovdqa 224(%rsp), %ymm1
+vmovdqa 256(%rsp), %ymm2
+vmovdqa 288(%rsp), %ymm3
+vmovdqa 320(%rsp), %ymm4
+vmovdqa 352(%rsp), %ymm5
+vmovdqa 384(%rsp), %ymm6
+vmovdqa 416(%rsp), %ymm7
+vpbroadcastd 32(%rsp), %ymm8
+vpbroadcastd 4+32(%rsp), %ymm9
+vpbroadcastd 8+32(%rsp), %ymm10
+vpbroadcastd 12+32(%rsp), %ymm11
+vmovdqa 128(%rsp), %ymm12
+vmovdqa 160(%rsp), %ymm13
+vpbroadcastd 8+48(%rsp), %ymm14
+vpbroadcastd 12+48(%rsp), %ymm15
+vpaddd %ymm8, %ymm0, %ymm0
+vpaddd %ymm9, %ymm1, %ymm1
+vpaddd %ymm10, %ymm2, %ymm2
+vpaddd %ymm11, %ymm3, %ymm3
+vpaddd %ymm12, %ymm4, %ymm4
+vpaddd %ymm13, %ymm5, %ymm5
+vpaddd %ymm14, %ymm6, %ymm6
+vpaddd %ymm15, %ymm7, %ymm7
+vpunpckldq %ymm1, %ymm0, %ymm8
+vpunpckldq %ymm3, %ymm2, %ymm9
+vpunpckhdq %ymm1, %ymm0, %ymm12
+vpunpckhdq %ymm3, %ymm2, %ymm13
+vpunpckldq %ymm5, %ymm4, %ymm10
+vpunpckldq %ymm7, %ymm6, %ymm11
+vpunpckhdq %ymm5, %ymm4, %ymm14
+vpunpckhdq %ymm7, %ymm6, %ymm15
+vpunpcklqdq %ymm9, %ymm8, %ymm0
+vpunpcklqdq %ymm11, %ymm10, %ymm1
+vpunpckhqdq %ymm9, %ymm8, %ymm2
+vpunpckhqdq %ymm11, %ymm10, %ymm3
+vpunpcklqdq %ymm13, %ymm12, %ymm4
+vpunpcklqdq %ymm15, %ymm14, %ymm5
+vpunpckhqdq %ymm13, %ymm12, %ymm6
+vpunpckhqdq %ymm15, %ymm14, %ymm7
+vperm2i128 $0x20, %ymm1, %ymm0, %ymm8
+vperm2i128 $0x20, %ymm3, %ymm2, %ymm9
+vperm2i128 $0x31, %ymm1, %ymm0, %ymm12
+vperm2i128 $0x31, %ymm3, %ymm2, %ymm13
+vperm2i128 $0x20, %ymm5, %ymm4, %ymm10
+vperm2i128 $0x20, %ymm7, %ymm6, %ymm11
+vperm2i128 $0x31, %ymm5, %ymm4, %ymm14
+vperm2i128 $0x31, %ymm7, %ymm6, %ymm15
+vmovdqu %ymm8, 32(%rdx)
+vmovdqu %ymm9, 96(%rdx)
+vmovdqu %ymm10, 160(%rdx)
+vmovdqu %ymm11, 224(%rdx)
+vmovdqu %ymm12, 288(%rdx)
+vmovdqu %ymm13, 352(%rdx)
+vmovdqu %ymm14, 416(%rdx)
+vmovdqu %ymm15, 480(%rdx)
+chacha_blocks_avx2_mainloop1_cont:
+addq $512, %rdx
+subq $512, %rcx
+cmp $512, %rcx
+jae chacha_blocks_avx2_atleast512
+cmp $256, %rcx
+jb chacha_blocks_avx2_below256_fixup
+chacha_blocks_avx2_atleast256:
+movq 48(%rsp), %rax
+leaq 1(%rax), %r8
+leaq 2(%rax), %r9
+leaq 3(%rax), %r10
+leaq 4(%rax), %rbx
+movl %eax, 128(%rsp)
+movl %r8d, 4+128(%rsp)
+movl %r9d, 8+128(%rsp)
+movl %r10d, 12+128(%rsp)
+shrq $32, %rax
+shrq $32, %r8
+shrq $32, %r9
+shrq $32, %r10
+movl %eax, 160(%rsp)
+movl %r8d, 4+160(%rsp)
+movl %r9d, 8+160(%rsp)
+movl %r10d, 12+160(%rsp)
+movq %rbx, 48(%rsp)
+movq 64(%rsp), %rax
+vpbroadcastd 0(%rsp), %xmm0
+vpbroadcastd 4+0(%rsp), %xmm1
+vpbroadcastd 8+0(%rsp), %xmm2
+vpbroadcastd 12+0(%rsp), %xmm3
+vpbroadcastd 16(%rsp), %xmm4
+vpbroadcastd 4+16(%rsp), %xmm5
+vpbroadcastd 8+16(%rsp), %xmm6
+vpbroadcastd 12+16(%rsp), %xmm7
+vpbroadcastd 32(%rsp), %xmm8
+vpbroadcastd 4+32(%rsp), %xmm9
+vpbroadcastd 8+32(%rsp), %xmm10
+vpbroadcastd 12+32(%rsp), %xmm11
+vmovdqa 128(%rsp), %xmm12
+vmovdqa 160(%rsp), %xmm13
+vpbroadcastd 8+48(%rsp), %xmm14
+vpbroadcastd 12+48(%rsp), %xmm15
+chacha_blocks_avx2_mainloop2:
+vpaddd %xmm0, %xmm4, %xmm0
+vpaddd %xmm1, %xmm5, %xmm1
+vpxor %xmm12, %xmm0, %xmm12
+vpxor %xmm13, %xmm1, %xmm13
+vpaddd %xmm2, %xmm6, %xmm2
+vpaddd %xmm3, %xmm7, %xmm3
+vpxor %xmm14, %xmm2, %xmm14
+vpxor %xmm15, %xmm3, %xmm15
+vpshufb 448(%rsp), %xmm12, %xmm12
+vpshufb 448(%rsp), %xmm13, %xmm13
+vpaddd %xmm8, %xmm12, %xmm8
+vpaddd %xmm9, %xmm13, %xmm9
+vpshufb 448(%rsp), %xmm14, %xmm14
+vpshufb 448(%rsp), %xmm15, %xmm15
+vpaddd %xmm10, %xmm14, %xmm10
+vpaddd %xmm11, %xmm15, %xmm11
+vmovdqa %xmm12, 96(%rsp)
+vpxor %xmm4, %xmm8, %xmm4
+vpxor %xmm5, %xmm9, %xmm5
+vpslld $ 12, %xmm4, %xmm12
+vpsrld $20, %xmm4, %xmm4
+vpxor %xmm4, %xmm12, %xmm4
+vpslld $ 12, %xmm5, %xmm12
+vpsrld $20, %xmm5, %xmm5
+vpxor %xmm5, %xmm12, %xmm5
+vpxor %xmm6, %xmm10, %xmm6
+vpxor %xmm7, %xmm11, %xmm7
+vpslld $ 12, %xmm6, %xmm12
+vpsrld $20, %xmm6, %xmm6
+vpxor %xmm6, %xmm12, %xmm6
+vpslld $ 12, %xmm7, %xmm12
+vpsrld $20, %xmm7, %xmm7
+vpxor %xmm7, %xmm12, %xmm7
+vpaddd %xmm0, %xmm4, %xmm0
+vpaddd %xmm1, %xmm5, %xmm1
+vpxor 96(%rsp), %xmm0, %xmm12
+vpxor %xmm13, %xmm1, %xmm13
+vpaddd %xmm2, %xmm6, %xmm2
+vpaddd %xmm3, %xmm7, %xmm3
+vpxor %xmm14, %xmm2, %xmm14
+vpxor %xmm15, %xmm3, %xmm15
+vpshufb 480(%rsp), %xmm12, %xmm12
+vpshufb 480(%rsp), %xmm13, %xmm13
+vpaddd %xmm8, %xmm12, %xmm8
+vpaddd %xmm9, %xmm13, %xmm9
+vpshufb 480(%rsp), %xmm14, %xmm14
+vpshufb 480(%rsp), %xmm15, %xmm15
+vpaddd %xmm10, %xmm14, %xmm10
+vpaddd %xmm11, %xmm15, %xmm11
+vmovdqa %xmm12, 96(%rsp)
+vpxor %xmm4, %xmm8, %xmm4
+vpxor %xmm5, %xmm9, %xmm5
+vpslld $ 7, %xmm4, %xmm12
+vpsrld $25, %xmm4, %xmm4
+vpxor %xmm4, %xmm12, %xmm4
+vpslld $ 7, %xmm5, %xmm12
+vpsrld $25, %xmm5, %xmm5
+vpxor %xmm5, %xmm12, %xmm5
+vpxor %xmm6, %xmm10, %xmm6
+vpxor %xmm7, %xmm11, %xmm7
+vpslld $ 7, %xmm6, %xmm12
+vpsrld $25, %xmm6, %xmm6
+vpxor %xmm6, %xmm12, %xmm6
+vpslld $ 7, %xmm7, %xmm12
+vpsrld $25, %xmm7, %xmm7
+vpxor %xmm7, %xmm12, %xmm7
+vpaddd %xmm0, %xmm5, %xmm0
+vpaddd %xmm1, %xmm6, %xmm1
+vpxor %xmm15, %xmm0, %xmm15
+vpxor 96(%rsp), %xmm1, %xmm12
+vpaddd %xmm2, %xmm7, %xmm2
+vpaddd %xmm3, %xmm4, %xmm3
+vpxor %xmm13, %xmm2, %xmm13
+vpxor %xmm14, %xmm3, %xmm14
+vpshufb 448(%rsp), %xmm15, %xmm15
+vpshufb 448(%rsp), %xmm12, %xmm12
+vpaddd %xmm10, %xmm15, %xmm10
+vpaddd %xmm11, %xmm12, %xmm11
+vpshufb 448(%rsp), %xmm13, %xmm13
+vpshufb 448(%rsp), %xmm14, %xmm14
+vpaddd %xmm8, %xmm13, %xmm8
+vpaddd %xmm9, %xmm14, %xmm9
+vmovdqa %xmm15, 96(%rsp)
+vpxor %xmm5, %xmm10, %xmm5
+vpxor %xmm6, %xmm11, %xmm6
+vpslld $ 12, %xmm5, %xmm15
+vpsrld $20, %xmm5, %xmm5
+vpxor %xmm5, %xmm15, %xmm5
+vpslld $ 12, %xmm6, %xmm15
+vpsrld $20, %xmm6, %xmm6
+vpxor %xmm6, %xmm15, %xmm6
+vpxor %xmm7, %xmm8, %xmm7
+vpxor %xmm4, %xmm9, %xmm4
+vpslld $ 12, %xmm7, %xmm15
+vpsrld $20, %xmm7, %xmm7
+vpxor %xmm7, %xmm15, %xmm7
+vpslld $ 12, %xmm4, %xmm15
+vpsrld $20, %xmm4, %xmm4
+vpxor %xmm4, %xmm15, %xmm4
+vpaddd %xmm0, %xmm5, %xmm0
+vpaddd %xmm1, %xmm6, %xmm1
+vpxor 96(%rsp), %xmm0, %xmm15
+vpxor %xmm12, %xmm1, %xmm12
+vpaddd %xmm2, %xmm7, %xmm2
+vpaddd %xmm3, %xmm4, %xmm3
+vpxor %xmm13, %xmm2, %xmm13
+vpxor %xmm14, %xmm3, %xmm14
+vpshufb 480(%rsp), %xmm15, %xmm15
+vpshufb 480(%rsp), %xmm12, %xmm12
+vpaddd %xmm10, %xmm15, %xmm10
+vpaddd %xmm11, %xmm12, %xmm11
+vpshufb 480(%rsp), %xmm13, %xmm13
+vpshufb 480(%rsp), %xmm14, %xmm14
+vpaddd %xmm8, %xmm13, %xmm8
+vpaddd %xmm9, %xmm14, %xmm9
+vmovdqa %xmm15, 96(%rsp)
+vpxor %xmm5, %xmm10, %xmm5
+vpxor %xmm6, %xmm11, %xmm6
+vpslld $ 7, %xmm5, %xmm15
+vpsrld $25, %xmm5, %xmm5
+vpxor %xmm5, %xmm15, %xmm5
+vpslld $ 7, %xmm6, %xmm15
+vpsrld $25, %xmm6, %xmm6
+vpxor %xmm6, %xmm15, %xmm6
+vpxor %xmm7, %xmm8, %xmm7
+vpxor %xmm4, %xmm9, %xmm4
+vpslld $ 7, %xmm7, %xmm15
+vpsrld $25, %xmm7, %xmm7
+vpxor %xmm7, %xmm15, %xmm7
+vpslld $ 7, %xmm4, %xmm15
+vpsrld $25, %xmm4, %xmm4
+vpxor %xmm4, %xmm15, %xmm4
+vmovdqa 96(%rsp), %xmm15
+subq $2, %rax
+jnz chacha_blocks_avx2_mainloop2
+vmovdqa %xmm8, 192(%rsp)
+vmovdqa %xmm9, 208(%rsp)
+vmovdqa %xmm10, 224(%rsp)
+vmovdqa %xmm11, 240(%rsp)
+vmovdqa %xmm12, 256(%rsp)
+vmovdqa %xmm13, 272(%rsp)
+vmovdqa %xmm14, 288(%rsp)
+vmovdqa %xmm15, 304(%rsp)
+vpbroadcastd 0(%rsp), %xmm8
+vpbroadcastd 4+0(%rsp), %xmm9
+vpbroadcastd 8+0(%rsp), %xmm10
+vpbroadcastd 12+0(%rsp), %xmm11
+vpbroadcastd 16(%rsp), %xmm12
+vpbroadcastd 4+16(%rsp), %xmm13
+vpbroadcastd 8+16(%rsp), %xmm14
+vpbroadcastd 12+16(%rsp), %xmm15
+vpaddd %xmm8, %xmm0, %xmm0
+vpaddd %xmm9, %xmm1, %xmm1
+vpaddd %xmm10, %xmm2, %xmm2
+vpaddd %xmm11, %xmm3, %xmm3
+vpaddd %xmm12, %xmm4, %xmm4
+vpaddd %xmm13, %xmm5, %xmm5
+vpaddd %xmm14, %xmm6, %xmm6
+vpaddd %xmm15, %xmm7, %xmm7
+vpunpckldq %xmm1, %xmm0, %xmm8
+vpunpckldq %xmm3, %xmm2, %xmm9
+vpunpckhdq %xmm1, %xmm0, %xmm12
+vpunpckhdq %xmm3, %xmm2, %xmm13
+vpunpckldq %xmm5, %xmm4, %xmm10
+vpunpckldq %xmm7, %xmm6, %xmm11
+vpunpckhdq %xmm5, %xmm4, %xmm14
+vpunpckhdq %xmm7, %xmm6, %xmm15
+vpunpcklqdq %xmm9, %xmm8, %xmm0
+vpunpcklqdq %xmm11, %xmm10, %xmm1
+vpunpckhqdq %xmm9, %xmm8, %xmm2
+vpunpckhqdq %xmm11, %xmm10, %xmm3
+vpunpcklqdq %xmm13, %xmm12, %xmm4
+vpunpcklqdq %xmm15, %xmm14, %xmm5
+vpunpckhqdq %xmm13, %xmm12, %xmm6
+vpunpckhqdq %xmm15, %xmm14, %xmm7
+andq %rsi, %rsi
+jz chacha_blocks_avx2_noinput2
+vpxor 0(%rsi), %xmm0, %xmm0
+vpxor 16(%rsi), %xmm1, %xmm1
+vpxor 64(%rsi), %xmm2, %xmm2
+vpxor 80(%rsi), %xmm3, %xmm3
+vpxor 128(%rsi), %xmm4, %xmm4
+vpxor 144(%rsi), %xmm5, %xmm5
+vpxor 192(%rsi), %xmm6, %xmm6
+vpxor 208(%rsi), %xmm7, %xmm7
+vmovdqu %xmm0, 0(%rdx)
+vmovdqu %xmm1, 16(%rdx)
+vmovdqu %xmm2, 64(%rdx)
+vmovdqu %xmm3, 80(%rdx)
+vmovdqu %xmm4, 128(%rdx)
+vmovdqu %xmm5, 144(%rdx)
+vmovdqu %xmm6, 192(%rdx)
+vmovdqu %xmm7, 208(%rdx)
+vmovdqa 192(%rsp), %xmm0
+vmovdqa 208(%rsp), %xmm1
+vmovdqa 224(%rsp), %xmm2
+vmovdqa 240(%rsp), %xmm3
+vmovdqa 256(%rsp), %xmm4
+vmovdqa 272(%rsp), %xmm5
+vmovdqa 288(%rsp), %xmm6
+vmovdqa 304(%rsp), %xmm7
+vpbroadcastd 32(%rsp), %xmm8
+vpbroadcastd 4+32(%rsp), %xmm9
+vpbroadcastd 8+32(%rsp), %xmm10
+vpbroadcastd 12+32(%rsp), %xmm11
+vmovdqa 128(%rsp), %xmm12
+vmovdqa 160(%rsp), %xmm13
+vpbroadcastd 8+48(%rsp), %xmm14
+vpbroadcastd 12+48(%rsp), %xmm15
+vpaddd %xmm8, %xmm0, %xmm0
+vpaddd %xmm9, %xmm1, %xmm1
+vpaddd %xmm10, %xmm2, %xmm2
+vpaddd %xmm11, %xmm3, %xmm3
+vpaddd %xmm12, %xmm4, %xmm4
+vpaddd %xmm13, %xmm5, %xmm5
+vpaddd %xmm14, %xmm6, %xmm6
+vpaddd %xmm15, %xmm7, %xmm7
+vpunpckldq %xmm1, %xmm0, %xmm8
+vpunpckldq %xmm3, %xmm2, %xmm9
+vpunpckhdq %xmm1, %xmm0, %xmm12
+vpunpckhdq %xmm3, %xmm2, %xmm13
+vpunpckldq %xmm5, %xmm4, %xmm10
+vpunpckldq %xmm7, %xmm6, %xmm11
+vpunpckhdq %xmm5, %xmm4, %xmm14
+vpunpckhdq %xmm7, %xmm6, %xmm15
+vpunpcklqdq %xmm9, %xmm8, %xmm0
+vpunpcklqdq %xmm11, %xmm10, %xmm1
+vpunpckhqdq %xmm9, %xmm8, %xmm2
+vpunpckhqdq %xmm11, %xmm10, %xmm3
+vpunpcklqdq %xmm13, %xmm12, %xmm4
+vpunpcklqdq %xmm15, %xmm14, %xmm5
+vpunpckhqdq %xmm13, %xmm12, %xmm6
+vpunpckhqdq %xmm15, %xmm14, %xmm7
+vpxor 32(%rsi), %xmm0, %xmm0
+vpxor 48(%rsi), %xmm1, %xmm1
+vpxor 96(%rsi), %xmm2, %xmm2
+vpxor 112(%rsi), %xmm3, %xmm3
+vpxor 160(%rsi), %xmm4, %xmm4
+vpxor 176(%rsi), %xmm5, %xmm5
+vpxor 224(%rsi), %xmm6, %xmm6
+vpxor 240(%rsi), %xmm7, %xmm7
+vmovdqu %xmm0, 32(%rdx)
+vmovdqu %xmm1, 48(%rdx)
+vmovdqu %xmm2, 96(%rdx)
+vmovdqu %xmm3, 112(%rdx)
+vmovdqu %xmm4, 160(%rdx)
+vmovdqu %xmm5, 176(%rdx)
+vmovdqu %xmm6, 224(%rdx)
+vmovdqu %xmm7, 240(%rdx)
+addq $256, %rsi
+jmp chacha_blocks_avx2_mainloop2_cont
+chacha_blocks_avx2_noinput2:
+vmovdqu %xmm0, 0(%rdx)
+vmovdqu %xmm1, 16(%rdx)
+vmovdqu %xmm2, 64(%rdx)
+vmovdqu %xmm3, 80(%rdx)
+vmovdqu %xmm4, 128(%rdx)
+vmovdqu %xmm5, 144(%rdx)
+vmovdqu %xmm6, 192(%rdx)
+vmovdqu %xmm7, 208(%rdx)
+vmovdqa 192(%rsp), %xmm0
+vmovdqa 208(%rsp), %xmm1
+vmovdqa 224(%rsp), %xmm2
+vmovdqa 240(%rsp), %xmm3
+vmovdqa 256(%rsp), %xmm4
+vmovdqa 272(%rsp), %xmm5
+vmovdqa 288(%rsp), %xmm6
+vmovdqa 304(%rsp), %xmm7
+vpbroadcastd 32(%rsp), %xmm8
+vpbroadcastd 4+32(%rsp), %xmm9
+vpbroadcastd 8+32(%rsp), %xmm10
+vpbroadcastd 12+32(%rsp), %xmm11
+vmovdqa 128(%rsp), %xmm12
+vmovdqa 160(%rsp), %xmm13
+vpbroadcastd 8+48(%rsp), %xmm14
+vpbroadcastd 12+48(%rsp), %xmm15
+vpaddd %xmm8, %xmm0, %xmm0
+vpaddd %xmm9, %xmm1, %xmm1
+vpaddd %xmm10, %xmm2, %xmm2
+vpaddd %xmm11, %xmm3, %xmm3
+vpaddd %xmm12, %xmm4, %xmm4
+vpaddd %xmm13, %xmm5, %xmm5
+vpaddd %xmm14, %xmm6, %xmm6
+vpaddd %xmm15, %xmm7, %xmm7
+vpunpckldq %xmm1, %xmm0, %xmm8
+vpunpckldq %xmm3, %xmm2, %xmm9
+vpunpckhdq %xmm1, %xmm0, %xmm12
+vpunpckhdq %xmm3, %xmm2, %xmm13
+vpunpckldq %xmm5, %xmm4, %xmm10
+vpunpckldq %xmm7, %xmm6, %xmm11
+vpunpckhdq %xmm5, %xmm4, %xmm14
+vpunpckhdq %xmm7, %xmm6, %xmm15
+vpunpcklqdq %xmm9, %xmm8, %xmm0
+vpunpcklqdq %xmm11, %xmm10, %xmm1
+vpunpckhqdq %xmm9, %xmm8, %xmm2
+vpunpckhqdq %xmm11, %xmm10, %xmm3
+vpunpcklqdq %xmm13, %xmm12, %xmm4
+vpunpcklqdq %xmm15, %xmm14, %xmm5
+vpunpckhqdq %xmm13, %xmm12, %xmm6
+vpunpckhqdq %xmm15, %xmm14, %xmm7
+vmovdqu %xmm0, 32(%rdx)
+vmovdqu %xmm1, 48(%rdx)
+vmovdqu %xmm2, 96(%rdx)
+vmovdqu %xmm3, 112(%rdx)
+vmovdqu %xmm4, 160(%rdx)
+vmovdqu %xmm5, 176(%rdx)
+vmovdqu %xmm6, 224(%rdx)
+vmovdqu %xmm7, 240(%rdx)
+chacha_blocks_avx2_mainloop2_cont:
+addq $256, %rdx
+subq $256, %rcx
+cmp $256, %rcx
+jae chacha_blocks_avx2_atleast256
+chacha_blocks_avx2_below256_fixup:
+vmovdqa 448(%rsp), %xmm6
+vmovdqa 480(%rsp), %xmm7
+vmovdqa 0(%rsp), %xmm8
+vmovdqa 16(%rsp), %xmm9
+vmovdqa 32(%rsp), %xmm10
+vmovdqa 48(%rsp), %xmm11
+movq $1, %r9
+chacha_blocks_avx2_below256:
+vmovq %r9, %xmm5
+andq %rcx, %rcx
+jz chacha_blocks_avx2_done
+cmpq $64, %rcx
+jae chacha_blocks_avx2_above63
+movq %rdx, %r9
+andq %rsi, %rsi
+jz chacha_blocks_avx2_noinput3
+movq %rcx, %r10
+movq %rsp, %rdx
+addq %r10, %rsi
+addq %r10, %rdx
+negq %r10
+chacha_blocks_avx2_copyinput:
+movb (%rsi, %r10), %al
+movb %al, (%rdx, %r10)
+incq %r10
+jnz chacha_blocks_avx2_copyinput
+movq %rsp, %rsi
+chacha_blocks_avx2_noinput3:
+movq %rsp, %rdx
+chacha_blocks_avx2_above63:
+vmovdqa %xmm8, %xmm0
+vmovdqa %xmm9, %xmm1
+vmovdqa %xmm10, %xmm2
+vmovdqa %xmm11, %xmm3
+movq 64(%rsp), %rax
+chacha_blocks_avx2_mainloop3:
+vpaddd %xmm0, %xmm1, %xmm0
+vpxor %xmm3, %xmm0, %xmm3
+vpshufb %xmm6, %xmm3, %xmm3
+vpaddd %xmm2, %xmm3, %xmm2
+vpxor %xmm1, %xmm2, %xmm1
+vpslld $12, %xmm1, %xmm4
+vpsrld $20, %xmm1, %xmm1
+vpxor %xmm1, %xmm4, %xmm1
+vpaddd %xmm0, %xmm1, %xmm0
+vpxor %xmm3, %xmm0, %xmm3
+vpshufb %xmm7, %xmm3, %xmm3
+vpshufd $0x93, %xmm0, %xmm0
+vpaddd %xmm2, %xmm3, %xmm2
+vpshufd $0x4e, %xmm3, %xmm3
+vpxor %xmm1, %xmm2, %xmm1
+vpshufd $0x39, %xmm2, %xmm2
+vpslld $7, %xmm1, %xmm4
+vpsrld $25, %xmm1, %xmm1
+vpxor %xmm1, %xmm4, %xmm1
+vpaddd %xmm0, %xmm1, %xmm0
+vpxor %xmm3, %xmm0, %xmm3
+vpshufb %xmm6, %xmm3, %xmm3
+vpaddd %xmm2, %xmm3, %xmm2
+vpxor %xmm1, %xmm2, %xmm1
+vpslld $12, %xmm1, %xmm4
+vpsrld $20, %xmm1, %xmm1
+vpxor %xmm1, %xmm4, %xmm1
+vpaddd %xmm0, %xmm1, %xmm0
+vpxor %xmm3, %xmm0, %xmm3
+vpshufb %xmm7, %xmm3, %xmm3
+vpshufd $0x39, %xmm0, %xmm0
+vpaddd %xmm2, %xmm3, %xmm2
+vpshufd $0x4e, %xmm3, %xmm3
+vpxor %xmm1, %xmm2, %xmm1
+vpshufd $0x93, %xmm2, %xmm2
+vpslld $7, %xmm1, %xmm4
+vpsrld $25, %xmm1, %xmm1
+vpxor %xmm1, %xmm4, %xmm1
+subq $2, %rax
+jnz chacha_blocks_avx2_mainloop3
+vpaddd %xmm0, %xmm8, %xmm0
+vpaddd %xmm1, %xmm9, %xmm1
+vpaddd %xmm2, %xmm10, %xmm2
+vpaddd %xmm3, %xmm11, %xmm3
+andq %rsi, %rsi
+jz chacha_blocks_avx2_noinput4
+vpxor 0(%rsi), %xmm0, %xmm0
+vpxor 16(%rsi), %xmm1, %xmm1
+vpxor 32(%rsi), %xmm2, %xmm2
+vpxor 48(%rsi), %xmm3, %xmm3
+addq $64, %rsi
+chacha_blocks_avx2_noinput4:
+vmovdqu %xmm0, 0(%rdx)
+vmovdqu %xmm1, 16(%rdx)
+vmovdqu %xmm2, 32(%rdx)
+vmovdqu %xmm3, 48(%rdx)
+vpaddq %xmm11, %xmm5, %xmm11
+cmpq $64, %rcx
+jbe chacha_blocks_avx2_mainloop3_finishup
+addq $64, %rdx
+subq $64, %rcx
+jmp chacha_blocks_avx2_below256
+chacha_blocks_avx2_mainloop3_finishup:
+cmpq $64, %rcx
+je chacha_blocks_avx2_done
+addq %rcx, %r9
+addq %rcx, %rdx
+negq %rcx
+chacha_blocks_avx2_copyoutput:
+movb (%rdx, %rcx), %al
+movb %al, (%r9, %rcx)
+incq %rcx
+jnz chacha_blocks_avx2_copyoutput
+chacha_blocks_avx2_done:
+vmovdqu %xmm11, 32(%rdi)
+movq %rbp, %rsp
+popq %r14
+popq %r13
+popq %r12
+popq %rbp
+popq %rbx
+vzeroupper
+ret
+FN_END chacha_blocks_avx2
+
+
+GLOBAL_HIDDEN_FN hchacha_avx2
+hchacha_avx2_local:
+LOAD_VAR_PIC chacha_constants, %rax
+vmovdqa 0(%rax), %xmm0
+vmovdqa 16(%rax), %xmm6
+vmovdqa 32(%rax), %xmm5
+vmovdqu 0(%rdi), %xmm1
+vmovdqu 16(%rdi), %xmm2
+vmovdqu 0(%rsi), %xmm3
+hhacha_mainloop_avx2:
+vpaddd %xmm0, %xmm1, %xmm0
+vpxor %xmm3, %xmm0, %xmm3
+vpshufb %xmm6, %xmm3, %xmm3
+vpaddd %xmm2, %xmm3, %xmm2
+vpxor %xmm1, %xmm2, %xmm1
+vpslld $12, %xmm1, %xmm4
+vpsrld $20, %xmm1, %xmm1
+vpxor %xmm1, %xmm4, %xmm1
+vpaddd %xmm0, %xmm1, %xmm0
+vpxor %xmm3, %xmm0, %xmm3
+vpshufb %xmm5, %xmm3, %xmm3
+vpaddd %xmm2, %xmm3, %xmm2
+vpxor %xmm1, %xmm2, %xmm1
+vpslld $7, %xmm1, %xmm4
+vpsrld $25, %xmm1, %xmm1
+vpshufd $0x93, %xmm0, %xmm0
+vpxor %xmm1, %xmm4, %xmm1
+vpshufd $0x4e, %xmm3, %xmm3
+vpaddd %xmm0, %xmm1, %xmm0
+vpxor %xmm3, %xmm0, %xmm3
+vpshufb %xmm6, %xmm3, %xmm3
+vpshufd $0x39, %xmm2, %xmm2
+vpaddd %xmm2, %xmm3, %xmm2
+vpxor %xmm1, %xmm2, %xmm1
+vpslld $12, %xmm1, %xmm4
+vpsrld $20, %xmm1, %xmm1
+vpxor %xmm1, %xmm4, %xmm1
+vpaddd %xmm0, %xmm1, %xmm0
+vpxor %xmm3, %xmm0, %xmm3
+vpshufb %xmm5, %xmm3, %xmm3
+vpaddd %xmm2, %xmm3, %xmm2
+vpxor %xmm1, %xmm2, %xmm1
+vpshufd $0x39, %xmm0, %xmm0
+vpslld $7, %xmm1, %xmm4
+vpshufd $0x4e, %xmm3, %xmm3
+vpsrld $25, %xmm1, %xmm1
+vpshufd $0x93, %xmm2, %xmm2
+vpxor %xmm1, %xmm4, %xmm1
+subl $2, %ecx
+jne hhacha_mainloop_avx2
+vmovdqu %xmm0, (%rdx)
+vmovdqu %xmm3, 16(%rdx)
+ret
+FN_END hchacha_avx2
+
+GLOBAL_HIDDEN_FN_EXT chacha_avx2, 6, 16
+pushq %rbp
+movq %rsp, %rbp
+subq $64, %rsp
+andq $~63, %rsp
+vmovdqu 0(%rdi), %xmm0
+vmovdqu 16(%rdi), %xmm1
+vmovdqa %xmm0, 0(%rsp)
+vmovdqa %xmm1, 16(%rsp)
+xorq %rdi, %rdi
+movq %rdi, 32(%rsp)
+movq 0(%rsi), %rsi
+movq %rsi, 40(%rsp)
+movq %r9, 48(%rsp)
+movq %rsp, %rdi
+movq %rdx, %rsi
+movq %rcx, %rdx
+movq %r8, %rcx
+call chacha_blocks_avx2_local
+vpxor %xmm0, %xmm0, %xmm0
+vmovdqa %xmm0, 0(%rsp)
+vmovdqa %xmm0, 16(%rsp)
+vmovdqa %xmm0, 32(%rsp)
+movq %rbp, %rsp
+popq %rbp
+ret
+FN_END chacha_avx2
+
+GLOBAL_HIDDEN_FN_EXT xchacha_avx2, 6, 16
+pushq %rbp
+pushq %rbx
+movq %rsp, %rbp
+subq $64, %rsp
+andq $~63, %rsp
+movq %rsp, %rbx
+xorq %rax, %rax
+movq %rax, 32(%rbx)
+movq 16(%rsi), %rax
+movq %rax, 40(%rbx)
+movq %r9, 48(%rbx)
+pushq %rdx
+pushq %rcx
+pushq %r8
+movq %rbx, %rdx
+movq %r9, %rcx
+call hchacha_avx2_local
+movq %rbx, %rdi
+popq %rcx
+popq %rdx
+popq %rsi
+call chacha_blocks_avx2_local
+vpxor %xmm0, %xmm0, %xmm0
+vmovdqa %xmm0, 0(%rbx)
+vmovdqa %xmm0, 16(%rbx)
+vmovdqa %xmm0, 32(%rbx)
+movq %rbp, %rsp
+popq %rbx
+popq %rbp
+ret
+FN_END xchacha_avx2
diff --git a/src/libcryptobox/chacha20/chacha.c b/src/libcryptobox/chacha20/chacha.c
new file mode 100644
index 0000000..0b471c8
--- /dev/null
+++ b/src/libcryptobox/chacha20/chacha.c
@@ -0,0 +1,262 @@
+/* Copyright (c) 2015, Vsevolod Stakhov
+ * Copyright (c) 2015, Andrew Moon
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *       * Redistributions of source code must retain the above copyright
+ *         notice, this list of conditions and the following disclaimer.
+ *       * Redistributions in binary form must reproduce the above copyright
+ *         notice, this list of conditions and the following disclaimer in the
+ *         documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ''AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL AUTHOR BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "cryptobox.h"
+#include "chacha.h"
+#include "platform_config.h"
+
+extern unsigned cpu_config;
+
+typedef struct chacha_impl_t {
+	unsigned long cpu_flags;
+	const char *desc;
+	void (*chacha)(const chacha_key *key, const chacha_iv *iv,
+				   const unsigned char *in, unsigned char *out, size_t inlen,
+				   size_t rounds);
+	void (*xchacha)(const chacha_key *key, const chacha_iv24 *iv,
+					const unsigned char *in, unsigned char *out, size_t inlen,
+					size_t rounds);
+	void (*chacha_blocks)(chacha_state_internal *state,
+						  const unsigned char *in, unsigned char *out, size_t bytes);
+	void (*hchacha)(const unsigned char key[32], const unsigned char iv[16],
+					unsigned char out[32], size_t rounds);
+} chacha_impl_t;
+
+#define CHACHA_DECLARE(ext)                                                                                                                     \
+	void chacha_##ext(const chacha_key *key, const chacha_iv *iv, const unsigned char *in, unsigned char *out, size_t inlen, size_t rounds);    \
+	void xchacha_##ext(const chacha_key *key, const chacha_iv24 *iv, const unsigned char *in, unsigned char *out, size_t inlen, size_t rounds); \
+	void chacha_blocks_##ext(chacha_state_internal *state, const unsigned char *in, unsigned char *out, size_t bytes);                          \
+	void hchacha_##ext(const unsigned char key[32], const unsigned char iv[16], unsigned char out[32], size_t rounds);
+#define CHACHA_IMPL(cpuflags, desc, ext)                                                  \
+	{                                                                                     \
+		(cpuflags), desc, chacha_##ext, xchacha_##ext, chacha_blocks_##ext, hchacha_##ext \
+	}
+
+#if defined(HAVE_AVX2) && defined(__x86_64__)
+CHACHA_DECLARE(avx2)
+#define CHACHA_AVX2 CHACHA_IMPL(CPUID_AVX2, "avx2", avx2)
+#endif
+#if defined(HAVE_AVX) && defined(__x86_64__)
+CHACHA_DECLARE(avx)
+#define CHACHA_AVX CHACHA_IMPL(CPUID_AVX, "avx", avx)
+#endif
+#if defined(HAVE_SSE2) && defined(__x86_64__)
+CHACHA_DECLARE(sse2)
+#define CHACHA_SSE2 CHACHA_IMPL(CPUID_SSE2, "sse2", sse2)
+#endif
+
+CHACHA_DECLARE(ref)
+#define CHACHA_GENERIC CHACHA_IMPL(0, "generic", ref)
+
+static const chacha_impl_t chacha_list[] = {
+	CHACHA_GENERIC,
+#if defined(CHACHA_AVX2) && defined(__x86_64__)
+	CHACHA_AVX2,
+#endif
+#if defined(CHACHA_AVX) && defined(__x86_64__)
+	CHACHA_AVX,
+#endif
+#if defined(CHACHA_SSE2) && defined(__x86_64__)
+	CHACHA_SSE2
+#endif
+};
+
+static const chacha_impl_t *chacha_impl = &chacha_list[0];
+
+static int
+chacha_is_aligned(const void *p)
+{
+	return ((size_t) p & (sizeof(size_t) - 1)) == 0;
+}
+
+const char *
+chacha_load(void)
+{
+	guint i;
+
+	if (cpu_config != 0) {
+		for (i = 0; i < G_N_ELEMENTS(chacha_list); i++) {
+			if (chacha_list[i].cpu_flags & cpu_config) {
+				chacha_impl = &chacha_list[i];
+				break;
+			}
+		}
+	}
+
+	return chacha_impl->desc;
+}
+
+void chacha_init(chacha_state *S, const chacha_key *key,
+				 const chacha_iv *iv, size_t rounds)
+{
+	chacha_state_internal *state = (chacha_state_internal *) S;
+	memcpy(state->s + 0, key, 32);
+	memset(state->s + 32, 0, 8);
+	memcpy(state->s + 40, iv, 8);
+	state->rounds = rounds;
+	state->leftover = 0;
+}
+
+/* processes inlen bytes (can do partial blocks), handling input/output alignment */
+static void
+chacha_consume(chacha_state_internal *state,
+			   const unsigned char *in, unsigned char *out, size_t inlen)
+{
+	unsigned char buffer[16 * CHACHA_BLOCKBYTES];
+	int in_aligned, out_aligned;
+
+	/* it's ok to call with 0 bytes */
+	if (!inlen)
+		return;
+
+	/* if everything is aligned, handle directly */
+	in_aligned = chacha_is_aligned(in);
+	out_aligned = chacha_is_aligned(out);
+	if (in_aligned && out_aligned) {
+		chacha_impl->chacha_blocks(state, in, out, inlen);
+		return;
+	}
+
+	/* copy the unaligned data to an aligned buffer and process in chunks */
+	while (inlen) {
+		const size_t bytes = (inlen > sizeof(buffer)) ? sizeof(buffer) : inlen;
+		const unsigned char *src = in;
+		unsigned char *dst = (out_aligned) ? out : buffer;
+		if (!in_aligned) {
+			memcpy(buffer, in, bytes);
+			src = buffer;
+		}
+		chacha_impl->chacha_blocks(state, src, dst, bytes);
+		if (!out_aligned)
+			memcpy(out, buffer, bytes);
+		if (in)
+			in += bytes;
+		out += bytes;
+		inlen -= bytes;
+	}
+}
+
+/* hchacha */
+void hchacha(const unsigned char key[32],
+			 const unsigned char iv[16], unsigned char out[32], size_t rounds)
+{
+	chacha_impl->hchacha(key, iv, out, rounds);
+}
+
+/* update, returns number of bytes written to out */
+size_t
+chacha_update(chacha_state *S, const unsigned char *in, unsigned char *out,
+			  size_t inlen)
+{
+	chacha_state_internal *state = (chacha_state_internal *) S;
+	unsigned char *out_start = out;
+	size_t bytes;
+
+	/* enough for at least one block? */
+	while ((state->leftover + inlen) >= CHACHA_BLOCKBYTES) {
+		/* handle the previous data */
+		if (state->leftover) {
+			bytes = (CHACHA_BLOCKBYTES - state->leftover);
+			if (in) {
+				memcpy(state->buffer + state->leftover, in, bytes);
+				in += bytes;
+			}
+			chacha_consume(state, (in) ? state->buffer : NULL, out,
+						   CHACHA_BLOCKBYTES);
+			inlen -= bytes;
+			out += CHACHA_BLOCKBYTES;
+			state->leftover = 0;
+		}
+
+		/* handle the direct data */
+		bytes = (inlen & ~(CHACHA_BLOCKBYTES - 1));
+		if (bytes) {
+			chacha_consume(state, in, out, bytes);
+			inlen -= bytes;
+			if (in)
+				in += bytes;
+			out += bytes;
+		}
+	}
+
+	/* handle leftover data */
+	if (inlen) {
+		if (in)
+			memcpy(state->buffer + state->leftover, in, inlen);
+		else
+			memset(state->buffer + state->leftover, 0, inlen);
+		state->leftover += inlen;
+	}
+
+	return out - out_start;
+}
+
+/* finalize, write out any leftover data */
+size_t
+chacha_final(chacha_state *S, unsigned char *out)
+{
+	chacha_state_internal *state = (chacha_state_internal *) S;
+	size_t leftover = state->leftover;
+	if (leftover) {
+		if (chacha_is_aligned(out)) {
+			chacha_impl->chacha_blocks(state, state->buffer, out, leftover);
+		}
+		else {
+			chacha_impl->chacha_blocks(state, state->buffer, state->buffer,
+									   leftover);
+			memcpy(out, state->buffer, leftover);
+		}
+	}
+	rspamd_explicit_memzero(S, sizeof(chacha_state));
+	return leftover;
+}
+
+/* one-shot, input/output assumed to be word aligned */
+void chacha(const chacha_key *key, const chacha_iv *iv,
+			const unsigned char *in, unsigned char *out, size_t inlen,
+			size_t rounds)
+{
+	chacha_impl->chacha(key, iv, in, out, inlen, rounds);
+}
+
+/*
+ xchacha, chacha with a 192 bit nonce
+ */
+
+void xchacha_init(chacha_state *S, const chacha_key *key,
+				  const chacha_iv24 *iv, size_t rounds)
+{
+	chacha_key subkey;
+	hchacha(key->b, iv->b, subkey.b, rounds);
+	chacha_init(S, &subkey, (chacha_iv *) (iv->b + 16), rounds);
+}
+
+/* one-shot, input/output assumed to be word aligned */
+void xchacha(const chacha_key *key, const chacha_iv24 *iv,
+			 const unsigned char *in, unsigned char *out, size_t inlen,
+			 size_t rounds)
+{
+	chacha_impl->xchacha(key, iv, in, out, inlen, rounds);
+}
diff --git a/src/libcryptobox/chacha20/chacha.h b/src/libcryptobox/chacha20/chacha.h
new file mode 100644
index 0000000..d05088a
--- /dev/null
+++ b/src/libcryptobox/chacha20/chacha.h
@@ -0,0 +1,87 @@
+/*
+ * The MIT License (MIT)
+ *
+ * Copyright (c) 2015 Andrew Moon, Vsevolod Stakhov
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+
+#ifndef CHACHA_H_
+#define CHACHA_H_
+
+
+#define CHACHA_BLOCKBYTES 64
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct chacha_state_internal_t {
+	unsigned char s[48];
+	size_t rounds;
+	size_t leftover;
+	unsigned char buffer[CHACHA_BLOCKBYTES];
+} chacha_state_internal;
+
+typedef struct chacha_state_t {
+	unsigned char opaque[128];
+} chacha_state;
+
+typedef struct chacha_key_t {
+	unsigned char b[32];
+} chacha_key;
+
+typedef struct chacha_iv_t {
+	unsigned char b[8];
+} chacha_iv;
+
+typedef struct chacha_iv24_t {
+	unsigned char b[24];
+} chacha_iv24;
+
+void hchacha(const unsigned char key[32], const unsigned char iv[16],
+			 unsigned char out[32], size_t rounds);
+
+void chacha_init(chacha_state *S, const chacha_key *key, const chacha_iv *iv,
+				 size_t rounds);
+
+void xchacha_init(chacha_state *S, const chacha_key *key,
+				  const chacha_iv24 *iv, size_t rounds);
+
+size_t chacha_update(chacha_state *S, const unsigned char *in,
+					 unsigned char *out, size_t inlen);
+
+size_t chacha_final(chacha_state *S, unsigned char *out);
+
+void chacha(const chacha_key *key, const chacha_iv *iv,
+			const unsigned char *in, unsigned char *out, size_t inlen,
+			size_t rounds);
+
+void xchacha(const chacha_key *key, const chacha_iv24 *iv,
+			 const unsigned char *in, unsigned char *out, size_t inlen,
+			 size_t rounds);
+
+const char *chacha_load(void);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* CHACHA_H_ */
diff --git a/src/libcryptobox/chacha20/constants.S b/src/libcryptobox/chacha20/constants.S
new file mode 100644
index 0000000..ff109a3
--- /dev/null
+++ b/src/libcryptobox/chacha20/constants.S
@@ -0,0 +1,6 @@
+SECTION_RODATA
+.p2align 4,,15
+chacha_constants:
+.long 0x61707865,0x3320646e,0x79622d32,0x6b206574 /* "expand 32-byte k" */
+.byte 2,3,0,1,6,7,4,5,10,11,8,9,14,15,12,13 /* pshufb rotate by 16 */
+.byte 3,0,1,2,7,4,5,6,11,8,9,10,15,12,13,14 /* pshufb rotate by 8 */
diff --git a/src/libcryptobox/chacha20/ref.c b/src/libcryptobox/chacha20/ref.c
new file mode 100644
index 0000000..ee646db
--- /dev/null
+++ b/src/libcryptobox/chacha20/ref.c
@@ -0,0 +1,272 @@
+#include "config.h"
+#include "chacha.h"
+#include "cryptobox.h"
+
+#if defined(HAVE_INT32)
+typedef uint32_t chacha_int32;
+#else
+typedef guint32 chacha_int32;
+#endif
+
+/* interpret four 8 bit unsigned integers as a 32 bit unsigned integer in little endian */
+static chacha_int32
+U8TO32(const unsigned char *p)
+{
+	return (((chacha_int32) (p[0])) |
+			((chacha_int32) (p[1]) << 8) |
+			((chacha_int32) (p[2]) << 16) |
+			((chacha_int32) (p[3]) << 24));
+}
+
+/* store a 32 bit unsigned integer as four 8 bit unsigned integers in little endian */
+static void
+U32TO8(unsigned char *p, chacha_int32 v)
+{
+	p[0] = (v) &0xff;
+	p[1] = (v >> 8) & 0xff;
+	p[2] = (v >> 16) & 0xff;
+	p[3] = (v >> 24) & 0xff;
+}
+
+/* 32 bit left rotate */
+static chacha_int32
+ROTL32(chacha_int32 x, int k)
+{
+	return ((x << k) | (x >> (32 - k))) & 0xffffffff;
+}
+
+/* "expand 32-byte k", as 4 little endian 32-bit unsigned integers */
+static const chacha_int32 chacha_constants[4] = {
+	0x61707865, 0x3320646e, 0x79622d32, 0x6b206574};
+
+void chacha_blocks_ref(chacha_state_internal *state, const unsigned char *in, unsigned char *out, size_t bytes)
+{
+	chacha_int32 x[16], j[12];
+	chacha_int32 t;
+	unsigned char *ctarget = out, tmp[64];
+	size_t i, r;
+
+	if (!bytes) return;
+
+	j[0] = U8TO32(state->s + 0);
+	j[1] = U8TO32(state->s + 4);
+	j[2] = U8TO32(state->s + 8);
+	j[3] = U8TO32(state->s + 12);
+	j[4] = U8TO32(state->s + 16);
+	j[5] = U8TO32(state->s + 20);
+	j[6] = U8TO32(state->s + 24);
+	j[7] = U8TO32(state->s + 28);
+	j[8] = U8TO32(state->s + 32);
+	j[9] = U8TO32(state->s + 36);
+	j[10] = U8TO32(state->s + 40);
+	j[11] = U8TO32(state->s + 44);
+
+	r = state->rounds;
+
+	for (;;) {
+		if (bytes < 64) {
+			if (in) {
+				for (i = 0; i < bytes; i++) tmp[i] = in[i];
+				in = tmp;
+			}
+			ctarget = out;
+			out = tmp;
+		}
+
+		x[0] = chacha_constants[0];
+		x[1] = chacha_constants[1];
+		x[2] = chacha_constants[2];
+		x[3] = chacha_constants[3];
+		x[4] = j[0];
+		x[5] = j[1];
+		x[6] = j[2];
+		x[7] = j[3];
+		x[8] = j[4];
+		x[9] = j[5];
+		x[10] = j[6];
+		x[11] = j[7];
+		x[12] = j[8];
+		x[13] = j[9];
+		x[14] = j[10];
+		x[15] = j[11];
+
+#define quarter(a, b, c, d) \
+	a += b;                 \
+	t = d ^ a;              \
+	d = ROTL32(t, 16);      \
+	c += d;                 \
+	t = b ^ c;              \
+	b = ROTL32(t, 12);      \
+	a += b;                 \
+	t = d ^ a;              \
+	d = ROTL32(t, 8);       \
+	c += d;                 \
+	t = b ^ c;              \
+	b = ROTL32(t, 7);
+
+#define doubleround()                                        \
+	quarter(x[0], x[4], x[8], x[12])                         \
+		quarter(x[1], x[5], x[9], x[13])                     \
+			quarter(x[2], x[6], x[10], x[14])                \
+				quarter(x[3], x[7], x[11], x[15])            \
+					quarter(x[0], x[5], x[10], x[15])        \
+						quarter(x[1], x[6], x[11], x[12])    \
+							quarter(x[2], x[7], x[8], x[13]) \
+								quarter(x[3], x[4], x[9], x[14])
+
+		i = r;
+		do {
+			doubleround()
+				i -= 2;
+		} while (i);
+
+		x[0] += chacha_constants[0];
+		x[1] += chacha_constants[1];
+		x[2] += chacha_constants[2];
+		x[3] += chacha_constants[3];
+		x[4] += j[0];
+		x[5] += j[1];
+		x[6] += j[2];
+		x[7] += j[3];
+		x[8] += j[4];
+		x[9] += j[5];
+		x[10] += j[6];
+		x[11] += j[7];
+		x[12] += j[8];
+		x[13] += j[9];
+		x[14] += j[10];
+		x[15] += j[11];
+
+		if (in) {
+			U32TO8(out + 0, x[0] ^ U8TO32(in + 0));
+			U32TO8(out + 4, x[1] ^ U8TO32(in + 4));
+			U32TO8(out + 8, x[2] ^ U8TO32(in + 8));
+			U32TO8(out + 12, x[3] ^ U8TO32(in + 12));
+			U32TO8(out + 16, x[4] ^ U8TO32(in + 16));
+			U32TO8(out + 20, x[5] ^ U8TO32(in + 20));
+			U32TO8(out + 24, x[6] ^ U8TO32(in + 24));
+			U32TO8(out + 28, x[7] ^ U8TO32(in + 28));
+			U32TO8(out + 32, x[8] ^ U8TO32(in + 32));
+			U32TO8(out + 36, x[9] ^ U8TO32(in + 36));
+			U32TO8(out + 40, x[10] ^ U8TO32(in + 40));
+			U32TO8(out + 44, x[11] ^ U8TO32(in + 44));
+			U32TO8(out + 48, x[12] ^ U8TO32(in + 48));
+			U32TO8(out + 52, x[13] ^ U8TO32(in + 52));
+			U32TO8(out + 56, x[14] ^ U8TO32(in + 56));
+			U32TO8(out + 60, x[15] ^ U8TO32(in + 60));
+			in += 64;
+		}
+		else {
+			U32TO8(out + 0, x[0]);
+			U32TO8(out + 4, x[1]);
+			U32TO8(out + 8, x[2]);
+			U32TO8(out + 12, x[3]);
+			U32TO8(out + 16, x[4]);
+			U32TO8(out + 20, x[5]);
+			U32TO8(out + 24, x[6]);
+			U32TO8(out + 28, x[7]);
+			U32TO8(out + 32, x[8]);
+			U32TO8(out + 36, x[9]);
+			U32TO8(out + 40, x[10]);
+			U32TO8(out + 44, x[11]);
+			U32TO8(out + 48, x[12]);
+			U32TO8(out + 52, x[13]);
+			U32TO8(out + 56, x[14]);
+			U32TO8(out + 60, x[15]);
+		}
+
+		/* increment the 64 bit counter, split in to two 32 bit halves */
+		j[8]++;
+		if (!j[8])
+			j[9]++;
+
+		if (bytes <= 64) {
+			if (bytes < 64)
+				for (i = 0; i < bytes; i++) ctarget[i] = out[i];
+
+			/* store the counter back to the state */
+			U32TO8(state->s + 32, j[8]);
+			U32TO8(state->s + 36, j[9]);
+			goto cleanup;
+		}
+		bytes -= 64;
+		out += 64;
+	}
+
+cleanup:
+	rspamd_explicit_memzero(j, sizeof(j));
+}
+
+void hchacha_ref(const unsigned char key[32], const unsigned char iv[16], unsigned char out[32], size_t rounds)
+{
+	chacha_int32 x[16];
+	chacha_int32 t;
+
+	x[0] = chacha_constants[0];
+	x[1] = chacha_constants[1];
+	x[2] = chacha_constants[2];
+	x[3] = chacha_constants[3];
+	x[4] = U8TO32(key + 0);
+	x[5] = U8TO32(key + 4);
+	x[6] = U8TO32(key + 8);
+	x[7] = U8TO32(key + 12);
+	x[8] = U8TO32(key + 16);
+	x[9] = U8TO32(key + 20);
+	x[10] = U8TO32(key + 24);
+	x[11] = U8TO32(key + 28);
+	x[12] = U8TO32(iv + 0);
+	x[13] = U8TO32(iv + 4);
+	x[14] = U8TO32(iv + 8);
+	x[15] = U8TO32(iv + 12);
+
+	do {
+		doubleround()
+			rounds -= 2;
+	} while (rounds);
+
+	/* indices for the chacha constant */
+	U32TO8(out + 0, x[0]);
+	U32TO8(out + 4, x[1]);
+	U32TO8(out + 8, x[2]);
+	U32TO8(out + 12, x[3]);
+
+	/* indices for the iv */
+	U32TO8(out + 16, x[12]);
+	U32TO8(out + 20, x[13]);
+	U32TO8(out + 24, x[14]);
+	U32TO8(out + 28, x[15]);
+}
+
+void chacha_clear_state_ref(chacha_state_internal *state)
+{
+	rspamd_explicit_memzero(state, 48);
+}
+
+void chacha_ref(const chacha_key *key, const chacha_iv *iv, const unsigned char *in, unsigned char *out, size_t inlen, size_t rounds)
+{
+	chacha_state_internal state;
+	size_t i;
+	for (i = 0; i < 32; i++)
+		state.s[i + 0] = key->b[i];
+	for (i = 0; i < 8; i++)
+		state.s[i + 32] = 0;
+	for (i = 0; i < 8; i++)
+		state.s[i + 40] = iv->b[i];
+	state.rounds = rounds;
+	chacha_blocks_ref(&state, in, out, inlen);
+	chacha_clear_state_ref(&state);
+}
+
+void xchacha_ref(const chacha_key *key, const chacha_iv24 *iv, const unsigned char *in, unsigned char *out, size_t inlen, size_t rounds)
+{
+	chacha_state_internal state;
+	size_t i;
+	hchacha_ref(key->b, iv->b, &state.s[0], rounds);
+	for (i = 0; i < 8; i++)
+		state.s[i + 32] = 0;
+	for (i = 0; i < 8; i++)
+		state.s[i + 40] = iv->b[i + 16];
+	state.rounds = rounds;
+	chacha_blocks_ref(&state, in, out, inlen);
+	chacha_clear_state_ref(&state);
+}
diff --git a/src/libcryptobox/chacha20/sse2.S b/src/libcryptobox/chacha20/sse2.S
new file mode 100644
index 0000000..a91d095
--- /dev/null
+++ b/src/libcryptobox/chacha20/sse2.S
@@ -0,0 +1,734 @@
+#include "../macro.S"
+#include "constants.S"
+SECTION_TEXT
+
+GLOBAL_HIDDEN_FN chacha_blocks_sse2
+chacha_blocks_sse2_local:
+pushq %rbx
+pushq %rbp
+movq %rsp, %rbp
+andq $~63, %rsp
+subq $512, %rsp
+movq $0x3320646e61707865, %rax
+movq $0x6b20657479622d32, %r8
+movd %rax, %xmm8
+movd %r8, %xmm14
+punpcklqdq %xmm14, %xmm8
+movdqu 0(%rdi), %xmm9
+movdqu 16(%rdi), %xmm10
+movdqu 32(%rdi), %xmm11
+movq 48(%rdi), %rax
+movq $1, %r9
+movdqa %xmm8, 0(%rsp)
+movdqa %xmm9, 16(%rsp)
+movdqa %xmm10, 32(%rsp)
+movdqa %xmm11, 48(%rsp)
+movq %rax, 64(%rsp)
+cmpq $256, %rcx
+jb chacha_blocks_sse2_below256
+pshufd $0x00, %xmm8, %xmm0
+pshufd $0x55, %xmm8, %xmm1
+pshufd $0xaa, %xmm8, %xmm2
+pshufd $0xff, %xmm8, %xmm3
+movdqa %xmm0, 128(%rsp)
+movdqa %xmm1, 144(%rsp)
+movdqa %xmm2, 160(%rsp)
+movdqa %xmm3, 176(%rsp)
+pshufd $0x00, %xmm9, %xmm0
+pshufd $0x55, %xmm9, %xmm1
+pshufd $0xaa, %xmm9, %xmm2
+pshufd $0xff, %xmm9, %xmm3
+movdqa %xmm0, 192(%rsp)
+movdqa %xmm1, 208(%rsp)
+movdqa %xmm2, 224(%rsp)
+movdqa %xmm3, 240(%rsp)
+pshufd $0x00, %xmm10, %xmm0
+pshufd $0x55, %xmm10, %xmm1
+pshufd $0xaa, %xmm10, %xmm2
+pshufd $0xff, %xmm10, %xmm3
+movdqa %xmm0, 256(%rsp)
+movdqa %xmm1, 272(%rsp)
+movdqa %xmm2, 288(%rsp)
+movdqa %xmm3, 304(%rsp)
+pshufd $0xaa, %xmm11, %xmm0
+pshufd $0xff, %xmm11, %xmm1
+movdqa %xmm0, 352(%rsp)
+movdqa %xmm1, 368(%rsp)
+jmp chacha_blocks_sse2_atleast256
+.p2align 6,,63
+chacha_blocks_sse2_atleast256:
+movq 48(%rsp), %rax
+leaq 1(%rax), %r8
+leaq 2(%rax), %r9
+leaq 3(%rax), %r10
+leaq 4(%rax), %rbx
+movl %eax, 320(%rsp)
+movl %r8d, 4+320(%rsp)
+movl %r9d, 8+320(%rsp)
+movl %r10d, 12+320(%rsp)
+shrq $32, %rax
+shrq $32, %r8
+shrq $32, %r9
+shrq $32, %r10
+movl %eax, 336(%rsp)
+movl %r8d, 4+336(%rsp)
+movl %r9d, 8+336(%rsp)
+movl %r10d, 12+336(%rsp)
+movq %rbx, 48(%rsp)
+movq 64(%rsp), %rax
+movdqa 128(%rsp), %xmm0
+movdqa 144(%rsp), %xmm1
+movdqa 160(%rsp), %xmm2
+movdqa 176(%rsp), %xmm3
+movdqa 192(%rsp), %xmm4
+movdqa 208(%rsp), %xmm5
+movdqa 224(%rsp), %xmm6
+movdqa 240(%rsp), %xmm7
+movdqa 256(%rsp), %xmm8
+movdqa 272(%rsp), %xmm9
+movdqa 288(%rsp), %xmm10
+movdqa 304(%rsp), %xmm11
+movdqa 320(%rsp), %xmm12
+movdqa 336(%rsp), %xmm13
+movdqa 352(%rsp), %xmm14
+movdqa 368(%rsp), %xmm15
+chacha_blocks_sse2_mainloop1:
+paddd %xmm4, %xmm0
+paddd %xmm5, %xmm1
+pxor %xmm0, %xmm12
+pxor %xmm1, %xmm13
+paddd %xmm6, %xmm2
+paddd %xmm7, %xmm3
+movdqa %xmm6, 96(%rsp)
+pxor %xmm2, %xmm14
+pxor %xmm3, %xmm15
+pshuflw $0xb1,%xmm12,%xmm12
+pshufhw $0xb1,%xmm12,%xmm12
+pshuflw $0xb1,%xmm13,%xmm13
+pshufhw $0xb1,%xmm13,%xmm13
+pshuflw $0xb1,%xmm14,%xmm14
+pshufhw $0xb1,%xmm14,%xmm14
+pshuflw $0xb1,%xmm15,%xmm15
+pshufhw $0xb1,%xmm15,%xmm15
+paddd %xmm12, %xmm8
+paddd %xmm13, %xmm9
+paddd %xmm14, %xmm10
+paddd %xmm15, %xmm11
+movdqa %xmm12, 112(%rsp)
+pxor %xmm8, %xmm4
+pxor %xmm9, %xmm5
+movdqa 96(%rsp), %xmm6
+movdqa %xmm4, %xmm12
+pslld $ 12, %xmm4
+psrld $20, %xmm12
+pxor %xmm12, %xmm4
+movdqa %xmm5, %xmm12
+pslld $ 12, %xmm5
+psrld $20, %xmm12
+pxor %xmm12, %xmm5
+pxor %xmm10, %xmm6
+pxor %xmm11, %xmm7
+movdqa %xmm6, %xmm12
+pslld $ 12, %xmm6
+psrld $20, %xmm12
+pxor %xmm12, %xmm6
+movdqa %xmm7, %xmm12
+pslld $ 12, %xmm7
+psrld $20, %xmm12
+pxor %xmm12, %xmm7
+movdqa 112(%rsp), %xmm12
+paddd %xmm4, %xmm0
+paddd %xmm5, %xmm1
+pxor %xmm0, %xmm12
+pxor %xmm1, %xmm13
+paddd %xmm6, %xmm2
+paddd %xmm7, %xmm3
+movdqa %xmm6, 96(%rsp)
+pxor %xmm2, %xmm14
+pxor %xmm3, %xmm15
+movdqa %xmm12, %xmm6
+pslld $ 8, %xmm12
+psrld $24, %xmm6
+pxor %xmm6, %xmm12
+movdqa %xmm13, %xmm6
+pslld $ 8, %xmm13
+psrld $24, %xmm6
+pxor %xmm6, %xmm13
+paddd %xmm12, %xmm8
+paddd %xmm13, %xmm9
+movdqa %xmm14, %xmm6
+pslld $ 8, %xmm14
+psrld $24, %xmm6
+pxor %xmm6, %xmm14
+movdqa %xmm15, %xmm6
+pslld $ 8, %xmm15
+psrld $24, %xmm6
+pxor %xmm6, %xmm15
+paddd %xmm14, %xmm10
+paddd %xmm15, %xmm11
+movdqa %xmm12, 112(%rsp)
+pxor %xmm8, %xmm4
+pxor %xmm9, %xmm5
+movdqa 96(%rsp), %xmm6
+movdqa %xmm4, %xmm12
+pslld $ 7, %xmm4
+psrld $25, %xmm12
+pxor %xmm12, %xmm4
+movdqa %xmm5, %xmm12
+pslld $ 7, %xmm5
+psrld $25, %xmm12
+pxor %xmm12, %xmm5
+pxor %xmm10, %xmm6
+pxor %xmm11, %xmm7
+movdqa %xmm6, %xmm12
+pslld $ 7, %xmm6
+psrld $25, %xmm12
+pxor %xmm12, %xmm6
+movdqa %xmm7, %xmm12
+pslld $ 7, %xmm7
+psrld $25, %xmm12
+pxor %xmm12, %xmm7
+movdqa 112(%rsp), %xmm12
+paddd %xmm5, %xmm0
+paddd %xmm6, %xmm1
+pxor %xmm0, %xmm15
+pxor %xmm1, %xmm12
+paddd %xmm7, %xmm2
+paddd %xmm4, %xmm3
+movdqa %xmm7, 96(%rsp)
+pxor %xmm2, %xmm13
+pxor %xmm3, %xmm14
+pshuflw $0xb1,%xmm15,%xmm15
+pshufhw $0xb1,%xmm15,%xmm15
+pshuflw $0xb1,%xmm12,%xmm12
+pshufhw $0xb1,%xmm12,%xmm12
+pshuflw $0xb1,%xmm13,%xmm13
+pshufhw $0xb1,%xmm13,%xmm13
+pshuflw $0xb1,%xmm14,%xmm14
+pshufhw $0xb1,%xmm14,%xmm14
+paddd %xmm15, %xmm10
+paddd %xmm12, %xmm11
+paddd %xmm13, %xmm8
+paddd %xmm14, %xmm9
+movdqa %xmm15, 112(%rsp)
+pxor %xmm10, %xmm5
+pxor %xmm11, %xmm6
+movdqa 96(%rsp), %xmm7
+movdqa %xmm5, %xmm15
+pslld $ 12, %xmm5
+psrld $20, %xmm15
+pxor %xmm15, %xmm5
+movdqa %xmm6, %xmm15
+pslld $ 12, %xmm6
+psrld $20, %xmm15
+pxor %xmm15, %xmm6
+pxor %xmm8, %xmm7
+pxor %xmm9, %xmm4
+movdqa %xmm7, %xmm15
+pslld $ 12, %xmm7
+psrld $20, %xmm15
+pxor %xmm15, %xmm7
+movdqa %xmm4, %xmm15
+pslld $ 12, %xmm4
+psrld $20, %xmm15
+pxor %xmm15, %xmm4
+movdqa 112(%rsp), %xmm15
+paddd %xmm5, %xmm0
+paddd %xmm6, %xmm1
+pxor %xmm0, %xmm15
+pxor %xmm1, %xmm12
+paddd %xmm7, %xmm2
+paddd %xmm4, %xmm3
+movdqa %xmm7, 96(%rsp)
+pxor %xmm2, %xmm13
+pxor %xmm3, %xmm14
+movdqa %xmm15, %xmm7
+pslld $ 8, %xmm15
+psrld $24, %xmm7
+pxor %xmm7, %xmm15
+movdqa %xmm12, %xmm7
+pslld $ 8, %xmm12
+psrld $24, %xmm7
+pxor %xmm7, %xmm12
+paddd %xmm15, %xmm10
+paddd %xmm12, %xmm11
+movdqa %xmm13, %xmm7
+pslld $ 8, %xmm13
+psrld $24, %xmm7
+pxor %xmm7, %xmm13
+movdqa %xmm14, %xmm7
+pslld $ 8, %xmm14
+psrld $24, %xmm7
+pxor %xmm7, %xmm14
+paddd %xmm13, %xmm8
+paddd %xmm14, %xmm9
+movdqa %xmm15, 112(%rsp)
+pxor %xmm10, %xmm5
+pxor %xmm11, %xmm6
+movdqa 96(%rsp), %xmm7
+movdqa %xmm5, %xmm15
+pslld $ 7, %xmm5
+psrld $25, %xmm15
+pxor %xmm15, %xmm5
+movdqa %xmm6, %xmm15
+pslld $ 7, %xmm6
+psrld $25, %xmm15
+pxor %xmm15, %xmm6
+pxor %xmm8, %xmm7
+pxor %xmm9, %xmm4
+movdqa %xmm7, %xmm15
+pslld $ 7, %xmm7
+psrld $25, %xmm15
+pxor %xmm15, %xmm7
+movdqa %xmm4, %xmm15
+pslld $ 7, %xmm4
+psrld $25, %xmm15
+pxor %xmm15, %xmm4
+movdqa 112(%rsp), %xmm15
+subq $2, %rax
+jnz chacha_blocks_sse2_mainloop1
+paddd 128(%rsp), %xmm0
+paddd 144(%rsp), %xmm1
+paddd 160(%rsp), %xmm2
+paddd 176(%rsp), %xmm3
+paddd 192(%rsp), %xmm4
+paddd 208(%rsp), %xmm5
+paddd 224(%rsp), %xmm6
+paddd 240(%rsp), %xmm7
+paddd 256(%rsp), %xmm8
+paddd 272(%rsp), %xmm9
+paddd 288(%rsp), %xmm10
+paddd 304(%rsp), %xmm11
+paddd 320(%rsp), %xmm12
+paddd 336(%rsp), %xmm13
+paddd 352(%rsp), %xmm14
+paddd 368(%rsp), %xmm15
+movdqa %xmm8, 384(%rsp)
+movdqa %xmm9, 400(%rsp)
+movdqa %xmm10, 416(%rsp)
+movdqa %xmm11, 432(%rsp)
+movdqa %xmm12, 448(%rsp)
+movdqa %xmm13, 464(%rsp)
+movdqa %xmm14, 480(%rsp)
+movdqa %xmm15, 496(%rsp)
+movdqa %xmm0, %xmm8
+movdqa %xmm2, %xmm9
+movdqa %xmm4, %xmm10
+movdqa %xmm6, %xmm11
+punpckhdq %xmm1, %xmm0
+punpckhdq %xmm3, %xmm2
+punpckhdq %xmm5, %xmm4
+punpckhdq %xmm7, %xmm6
+punpckldq %xmm1, %xmm8
+punpckldq %xmm3, %xmm9
+punpckldq %xmm5, %xmm10
+punpckldq %xmm7, %xmm11
+movdqa %xmm0, %xmm1
+movdqa %xmm4, %xmm3
+movdqa %xmm8, %xmm5
+movdqa %xmm10, %xmm7
+punpckhqdq %xmm2, %xmm0
+punpckhqdq %xmm6, %xmm4
+punpckhqdq %xmm9, %xmm8
+punpckhqdq %xmm11, %xmm10
+punpcklqdq %xmm2, %xmm1
+punpcklqdq %xmm6, %xmm3
+punpcklqdq %xmm9, %xmm5
+punpcklqdq %xmm11, %xmm7
+andq %rsi, %rsi
+jz chacha_blocks_sse2_noinput1
+movdqu 0(%rsi), %xmm2
+movdqu 16(%rsi), %xmm6
+movdqu 64(%rsi), %xmm9
+movdqu 80(%rsi), %xmm11
+movdqu 128(%rsi), %xmm12
+movdqu 144(%rsi), %xmm13
+movdqu 192(%rsi), %xmm14
+movdqu 208(%rsi), %xmm15
+pxor %xmm2, %xmm5
+pxor %xmm6, %xmm7
+pxor %xmm9, %xmm8
+pxor %xmm11, %xmm10
+pxor %xmm12, %xmm1
+pxor %xmm13, %xmm3
+pxor %xmm14, %xmm0
+pxor %xmm15, %xmm4
+movdqu %xmm5, 0(%rdx)
+movdqu %xmm7, 16(%rdx)
+movdqu %xmm8, 64(%rdx)
+movdqu %xmm10, 80(%rdx)
+movdqu %xmm1, 128(%rdx)
+movdqu %xmm3, 144(%rdx)
+movdqu %xmm0, 192(%rdx)
+movdqu %xmm4, 208(%rdx)
+movdqa 384(%rsp), %xmm0
+movdqa 400(%rsp), %xmm1
+movdqa 416(%rsp), %xmm2
+movdqa 432(%rsp), %xmm3
+movdqa 448(%rsp), %xmm4
+movdqa 464(%rsp), %xmm5
+movdqa 480(%rsp), %xmm6
+movdqa 496(%rsp), %xmm7
+movdqa %xmm0, %xmm8
+movdqa %xmm2, %xmm9
+movdqa %xmm4, %xmm10
+movdqa %xmm6, %xmm11
+punpckldq %xmm1, %xmm8
+punpckldq %xmm3, %xmm9
+punpckhdq %xmm1, %xmm0
+punpckhdq %xmm3, %xmm2
+punpckldq %xmm5, %xmm10
+punpckldq %xmm7, %xmm11
+punpckhdq %xmm5, %xmm4
+punpckhdq %xmm7, %xmm6
+movdqa %xmm8, %xmm1
+movdqa %xmm0, %xmm3
+movdqa %xmm10, %xmm5
+movdqa %xmm4, %xmm7
+punpcklqdq %xmm9, %xmm1
+punpcklqdq %xmm11, %xmm5
+punpckhqdq %xmm9, %xmm8
+punpckhqdq %xmm11, %xmm10
+punpcklqdq %xmm2, %xmm3
+punpcklqdq %xmm6, %xmm7
+punpckhqdq %xmm2, %xmm0
+punpckhqdq %xmm6, %xmm4
+movdqu 32(%rsi), %xmm2
+movdqu 48(%rsi), %xmm6
+movdqu 96(%rsi), %xmm9
+movdqu 112(%rsi), %xmm11
+movdqu 160(%rsi), %xmm12
+movdqu 176(%rsi), %xmm13
+movdqu 224(%rsi), %xmm14
+movdqu 240(%rsi), %xmm15
+pxor %xmm2, %xmm1
+pxor %xmm6, %xmm5
+pxor %xmm9, %xmm8
+pxor %xmm11, %xmm10
+pxor %xmm12, %xmm3
+pxor %xmm13, %xmm7
+pxor %xmm14, %xmm0
+pxor %xmm15, %xmm4
+movdqu %xmm1, 32(%rdx)
+movdqu %xmm5, 48(%rdx)
+movdqu %xmm8, 96(%rdx)
+movdqu %xmm10, 112(%rdx)
+movdqu %xmm3, 160(%rdx)
+movdqu %xmm7, 176(%rdx)
+movdqu %xmm0, 224(%rdx)
+movdqu %xmm4, 240(%rdx)
+addq $256, %rsi
+jmp chacha_blocks_sse2_mainloop_cont
+chacha_blocks_sse2_noinput1:
+movdqu %xmm5, 0(%rdx)
+movdqu %xmm7, 16(%rdx)
+movdqu %xmm8, 64(%rdx)
+movdqu %xmm10, 80(%rdx)
+movdqu %xmm1, 128(%rdx)
+movdqu %xmm3, 144(%rdx)
+movdqu %xmm0, 192(%rdx)
+movdqu %xmm4, 208(%rdx)
+movdqa 384(%rsp), %xmm0
+movdqa 400(%rsp), %xmm1
+movdqa 416(%rsp), %xmm2
+movdqa 432(%rsp), %xmm3
+movdqa 448(%rsp), %xmm4
+movdqa 464(%rsp), %xmm5
+movdqa 480(%rsp), %xmm6
+movdqa 496(%rsp), %xmm7
+movdqa %xmm0, %xmm8
+movdqa %xmm2, %xmm9
+movdqa %xmm4, %xmm10
+movdqa %xmm6, %xmm11
+punpckldq %xmm1, %xmm8
+punpckldq %xmm3, %xmm9
+punpckhdq %xmm1, %xmm0
+punpckhdq %xmm3, %xmm2
+punpckldq %xmm5, %xmm10
+punpckldq %xmm7, %xmm11
+punpckhdq %xmm5, %xmm4
+punpckhdq %xmm7, %xmm6
+movdqa %xmm8, %xmm1
+movdqa %xmm0, %xmm3
+movdqa %xmm10, %xmm5
+movdqa %xmm4, %xmm7
+punpcklqdq %xmm9, %xmm1
+punpcklqdq %xmm11, %xmm5
+punpckhqdq %xmm9, %xmm8
+punpckhqdq %xmm11, %xmm10
+punpcklqdq %xmm2, %xmm3
+punpcklqdq %xmm6, %xmm7
+punpckhqdq %xmm2, %xmm0
+punpckhqdq %xmm6, %xmm4
+movdqu %xmm1, 32(%rdx)
+movdqu %xmm5, 48(%rdx)
+movdqu %xmm8, 96(%rdx)
+movdqu %xmm10, 112(%rdx)
+movdqu %xmm3, 160(%rdx)
+movdqu %xmm7, 176(%rdx)
+movdqu %xmm0, 224(%rdx)
+movdqu %xmm4, 240(%rdx)
+chacha_blocks_sse2_mainloop_cont:
+addq $256, %rdx
+subq $256, %rcx
+cmp $256, %rcx
+jae chacha_blocks_sse2_atleast256
+movdqa 0(%rsp), %xmm8
+movdqa 16(%rsp), %xmm9
+movdqa 32(%rsp), %xmm10
+movdqa 48(%rsp), %xmm11
+movq $1, %r9
+chacha_blocks_sse2_below256:
+movq %r9, %xmm5
+andq %rcx, %rcx
+jz chacha_blocks_sse2_done
+cmpq $64, %rcx
+jae chacha_blocks_sse2_above63
+movq %rdx, %r9
+andq %rsi, %rsi
+jz chacha_blocks_sse2_noinput2
+movq %rcx, %r10
+movq %rsp, %rdx
+addq %r10, %rsi
+addq %r10, %rdx
+negq %r10
+chacha_blocks_sse2_copyinput:
+movb (%rsi, %r10), %al
+movb %al, (%rdx, %r10)
+incq %r10
+jnz chacha_blocks_sse2_copyinput
+movq %rsp, %rsi
+chacha_blocks_sse2_noinput2:
+movq %rsp, %rdx
+chacha_blocks_sse2_above63:
+movdqa %xmm8, %xmm0
+movdqa %xmm9, %xmm1
+movdqa %xmm10, %xmm2
+movdqa %xmm11, %xmm3
+movq 64(%rsp), %rax
+chacha_blocks_sse2_mainloop2:
+paddd %xmm1, %xmm0
+pxor %xmm0, %xmm3
+pshuflw $0xb1,%xmm3,%xmm3
+pshufhw $0xb1,%xmm3,%xmm3
+paddd %xmm3, %xmm2
+pxor %xmm2, %xmm1
+movdqa %xmm1,%xmm4
+pslld $12, %xmm1
+psrld $20, %xmm4
+pxor %xmm4, %xmm1
+paddd %xmm1, %xmm0
+pxor %xmm0, %xmm3
+movdqa %xmm3,%xmm4
+pslld $8, %xmm3
+psrld $24, %xmm4
+pshufd $0x93,%xmm0,%xmm0
+pxor %xmm4, %xmm3
+paddd %xmm3, %xmm2
+pshufd $0x4e,%xmm3,%xmm3
+pxor %xmm2, %xmm1
+pshufd $0x39,%xmm2,%xmm2
+movdqa %xmm1,%xmm4
+pslld $7, %xmm1
+psrld $25, %xmm4
+pxor %xmm4, %xmm1
+subq $2, %rax
+paddd %xmm1, %xmm0
+pxor %xmm0, %xmm3
+pshuflw $0xb1,%xmm3,%xmm3
+pshufhw $0xb1,%xmm3,%xmm3
+paddd %xmm3, %xmm2
+pxor %xmm2, %xmm1
+movdqa %xmm1,%xmm4
+pslld $12, %xmm1
+psrld $20, %xmm4
+pxor %xmm4, %xmm1
+paddd %xmm1, %xmm0
+pxor %xmm0, %xmm3
+movdqa %xmm3,%xmm4
+pslld $8, %xmm3
+psrld $24, %xmm4
+pshufd $0x39,%xmm0,%xmm0
+pxor %xmm4, %xmm3
+paddd %xmm3, %xmm2
+pshufd $0x4e,%xmm3,%xmm3
+pxor %xmm2, %xmm1
+pshufd $0x93,%xmm2,%xmm2
+movdqa %xmm1,%xmm4
+pslld $7, %xmm1
+psrld $25, %xmm4
+pxor %xmm4, %xmm1
+jnz chacha_blocks_sse2_mainloop2
+paddd %xmm8, %xmm0
+paddd %xmm9, %xmm1
+paddd %xmm10, %xmm2
+paddd %xmm11, %xmm3
+andq %rsi, %rsi
+jz chacha_blocks_sse2_noinput3
+movdqu 0(%rsi), %xmm12
+movdqu 16(%rsi), %xmm13
+movdqu 32(%rsi), %xmm14
+movdqu 48(%rsi), %xmm15
+pxor %xmm12, %xmm0
+pxor %xmm13, %xmm1
+pxor %xmm14, %xmm2
+pxor %xmm15, %xmm3
+addq $64, %rsi
+chacha_blocks_sse2_noinput3:
+movdqu %xmm0, 0(%rdx)
+movdqu %xmm1, 16(%rdx)
+movdqu %xmm2, 32(%rdx)
+movdqu %xmm3, 48(%rdx)
+paddq %xmm5, %xmm11
+cmpq $64, %rcx
+jbe chacha_blocks_sse2_mainloop2_finishup
+addq $64, %rdx
+subq $64, %rcx
+jmp chacha_blocks_sse2_below256
+chacha_blocks_sse2_mainloop2_finishup:
+cmpq $64, %rcx
+je chacha_blocks_sse2_done
+addq %rcx, %r9
+addq %rcx, %rdx
+negq %rcx
+chacha_blocks_sse2_copyoutput:
+movb (%rdx, %rcx), %al
+movb %al, (%r9, %rcx)
+incq %rcx
+jnz chacha_blocks_sse2_copyoutput
+chacha_blocks_sse2_done:
+movdqu %xmm11, 32(%rdi)
+movq %rbp, %rsp
+popq %rbp
+popq %rbx
+ret
+FN_END chacha_blocks_sse2
+
+GLOBAL_HIDDEN_FN hchacha_sse2
+hchacha_sse2_local:
+movq $0x3320646e61707865, %rax
+movq $0x6b20657479622d32, %r8
+movd %rax, %xmm0
+movd %r8, %xmm4
+punpcklqdq %xmm4, %xmm0
+movdqu 0(%rdi), %xmm1
+movdqu 16(%rdi), %xmm2
+movdqu 0(%rsi), %xmm3
+hchacha_sse2_mainloop:
+paddd %xmm1, %xmm0
+pxor %xmm0, %xmm3
+pshuflw $0xb1,%xmm3,%xmm3
+pshufhw $0xb1,%xmm3,%xmm3
+paddd %xmm3, %xmm2
+pxor %xmm2, %xmm1
+movdqa %xmm1,%xmm4
+pslld $12, %xmm1
+psrld $20, %xmm4
+pxor %xmm4, %xmm1
+paddd %xmm1, %xmm0
+pxor %xmm0, %xmm3
+movdqa %xmm3,%xmm4
+pslld $8, %xmm3
+psrld $24, %xmm4
+pshufd $0x93,%xmm0,%xmm0
+pxor %xmm4, %xmm3
+paddd %xmm3, %xmm2
+pshufd $0x4e,%xmm3,%xmm3
+pxor %xmm2, %xmm1
+pshufd $0x39,%xmm2,%xmm2
+movdqa %xmm1,%xmm4
+pslld $7, %xmm1
+psrld $25, %xmm4
+pxor %xmm4, %xmm1
+subq $2, %rcx
+paddd %xmm1, %xmm0
+pxor %xmm0, %xmm3
+pshuflw $0xb1,%xmm3,%xmm3
+pshufhw $0xb1,%xmm3,%xmm3
+paddd %xmm3, %xmm2
+pxor %xmm2, %xmm1
+movdqa %xmm1,%xmm4
+pslld $12, %xmm1
+psrld $20, %xmm4
+pxor %xmm4, %xmm1
+paddd %xmm1, %xmm0
+pxor %xmm0, %xmm3
+movdqa %xmm3,%xmm4
+pslld $8, %xmm3
+psrld $24, %xmm4
+pshufd $0x39,%xmm0,%xmm0
+pxor %xmm4, %xmm3
+paddd %xmm3, %xmm2
+pshufd $0x4e,%xmm3,%xmm3
+pxor %xmm2, %xmm1
+pshufd $0x93,%xmm2,%xmm2
+movdqa %xmm1,%xmm4
+pslld $7, %xmm1
+psrld $25, %xmm4
+pxor %xmm4, %xmm1
+ja hchacha_sse2_mainloop
+movdqu %xmm0, 0(%rdx)
+movdqu %xmm3, 16(%rdx)
+ret
+FN_END hchacha_sse2
+
+GLOBAL_HIDDEN_FN_EXT chacha_sse2, 6, 16
+pushq %rbp
+movq %rsp, %rbp
+subq $64, %rsp
+andq $~63, %rsp
+movdqu 0(%rdi), %xmm0
+movdqu 16(%rdi), %xmm1
+movdqa %xmm0, 0(%rsp)
+movdqa %xmm1, 16(%rsp)
+xorq %rdi, %rdi
+movq %rdi, 32(%rsp)
+movq 0(%rsi), %rsi
+movq %rsi, 40(%rsp)
+movq %r9, 48(%rsp)
+movq %rsp, %rdi
+movq %rdx, %rsi
+movq %rcx, %rdx
+movq %r8, %rcx
+call chacha_blocks_sse2_local
+pxor %xmm0, %xmm0
+movdqa %xmm0, 0(%rsp)
+movdqa %xmm0, 16(%rsp)
+movdqa %xmm0, 32(%rsp)
+movq %rbp, %rsp
+popq %rbp
+ret
+FN_END chacha_sse2
+
+GLOBAL_HIDDEN_FN_EXT xchacha_sse2, 6, 16
+pushq %rbp
+pushq %rbx
+movq %rsp, %rbp
+subq $64, %rsp
+andq $~63, %rsp
+movq %rsp, %rbx
+xorq %rax, %rax
+movq %rax, 32(%rbx)
+movq 16(%rsi), %rax
+movq %rax, 40(%rbx)
+movq %r9, 48(%rbx)
+pushq %rdx
+pushq %rcx
+pushq %r8
+movq %rbx, %rdx
+movq %r9, %rcx
+call hchacha_sse2_local
+movq %rbx, %rdi
+popq %rcx
+popq %rdx
+popq %rsi
+call chacha_blocks_sse2_local
+pxor %xmm0, %xmm0
+movdqa %xmm0, 0(%rbx)
+movdqa %xmm0, 16(%rbx)
+movdqa %xmm0, 32(%rbx)
+movq %rbp, %rsp
+popq %rbx
+popq %rbp
+ret
+FN_END xchacha_sse2
diff --git a/src/libcryptobox/cryptobox.c b/src/libcryptobox/cryptobox.c
new file mode 100644
index 0000000..e118c4a
--- /dev/null
+++ b/src/libcryptobox/cryptobox.c
@@ -0,0 +1,1778 @@
+/*-
+ * Copyright 2016 Vsevolod Stakhov
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/* Workaround for memset_s */
+#ifdef __APPLE__
+#define __STDC_WANT_LIB_EXT1__ 1
+#include <string.h>
+#endif
+
+#include "config.h"
+#include "cryptobox.h"
+#include "platform_config.h"
+#include "chacha20/chacha.h"
+#include "catena/catena.h"
+#include "base64/base64.h"
+#include "ottery.h"
+#include "printf.h"
+#define XXH_INLINE_ALL
+#define XXH_PRIVATE_API
+#include "xxhash.h"
+#define MUM_TARGET_INDEPENDENT_HASH 1 /* For 32/64 bit equal hashes */
+#include "../../contrib/mumhash/mum.h"
+#include "../../contrib/t1ha/t1ha.h"
+#ifdef HAVE_CPUID_H
+#include <cpuid.h>
+#endif
+#ifdef HAVE_OPENSSL
+#include <openssl/opensslv.h>
+/* Openssl >= 1.0.1d is required for GCM verification */
+#if OPENSSL_VERSION_NUMBER >= 0x1000104fL
+#define HAVE_USABLE_OPENSSL 1
+#endif
+#endif
+
+#ifdef HAVE_USABLE_OPENSSL
+#include <openssl/evp.h>
+#include <openssl/ec.h>
+#include <openssl/ecdh.h>
+#include <openssl/ecdsa.h>
+#include <openssl/rand.h>
+#define CRYPTOBOX_CURVE_NID NID_X9_62_prime256v1
+#endif
+
+#include <signal.h>
+#include <setjmp.h>
+#include <stdalign.h>
+
+#include <sodium.h>
+
+unsigned cpu_config = 0;
+
+static gboolean cryptobox_loaded = FALSE;
+
+static const guchar n0[16] = {0};
+
+#define CRYPTOBOX_ALIGNMENT 16
+#define cryptobox_align_ptr(p, a) \
+	(void *) (((uintptr_t) (p) + ((uintptr_t) a - 1)) & ~((uintptr_t) a - 1))
+
+static void
+rspamd_cryptobox_cpuid(gint cpu[4], gint info)
+{
+	guint32 __attribute__((unused)) eax, __attribute__((unused)) ecx = 0, __attribute__((unused)) ebx = 0, __attribute__((unused)) edx = 0;
+
+	eax = info;
+#if defined(__GNUC__) && (defined(__x86_64__) || defined(__i386__))
+#if defined(__i386__) && defined(__PIC__)
+
+	/* in case of PIC under 32-bit EBX cannot be clobbered */
+
+	__asm__ volatile("movl %%ebx, %%edi \n\t cpuid \n\t xchgl %%ebx, %%edi"
+					 : "=D"(ebx),
+					   "+a"(eax), "+c"(ecx), "=d"(edx));
+#else
+	__asm__ volatile("cpuid"
+					 : "+b"(ebx), "+a"(eax), "+c"(ecx), "=d"(edx));
+#endif
+
+	cpu[0] = eax;
+	cpu[1] = ebx;
+	cpu[2] = ecx;
+	cpu[3] = edx;
+#else
+	memset(cpu, 0, sizeof(gint) * 4);
+#endif
+}
+
+static sig_atomic_t ok = 0;
+static jmp_buf j;
+
+__attribute__((noreturn)) static void
+rspamd_cryptobox_ill_handler(int signo)
+{
+	ok = 0;
+	longjmp(j, -1);
+}
+
+static gboolean
+rspamd_cryptobox_test_instr(gint instr)
+{
+	void (*old_handler)(int);
+	guint32 rd;
+
+#if defined(__GNUC__)
+	ok = 1;
+	old_handler = signal(SIGILL, rspamd_cryptobox_ill_handler);
+
+	if (setjmp(j) != 0) {
+		signal(SIGILL, old_handler);
+
+		return FALSE;
+	}
+
+	switch (instr) {
+#if defined HAVE_SSE2 && defined(__x86_64__)
+	case CPUID_SSE2:
+		__asm__ volatile("psubb %xmm0, %xmm0");
+		break;
+	case CPUID_RDRAND:
+		/* Use byte code here for compatibility */
+		__asm__ volatile(".byte 0x0f,0xc7,0xf0; setc %1"
+						 : "=a"(rd), "=qm"(ok)
+						 :
+						 : "edx");
+		break;
+#endif
+#ifdef HAVE_SSE3
+	case CPUID_SSE3:
+		__asm__ volatile("movshdup %xmm0, %xmm0");
+		break;
+#endif
+#ifdef HAVE_SSSE3
+	case CPUID_SSSE3:
+		__asm__ volatile("pshufb %xmm0, %xmm0");
+		break;
+#endif
+#ifdef HAVE_SSE41
+	case CPUID_SSE41:
+		__asm__ volatile("pcmpeqq %xmm0, %xmm0");
+		break;
+#endif
+#if defined HAVE_SSE42 && defined(__x86_64__)
+	case CPUID_SSE42:
+		__asm__ volatile("pushq %rax\n"
+						 "xorq %rax, %rax\n"
+						 "crc32 %rax, %rax\n"
+						 "popq %rax");
+		break;
+#endif
+#ifdef HAVE_AVX
+	case CPUID_AVX:
+		__asm__ volatile("vpaddq %xmm0, %xmm0, %xmm0");
+		break;
+#endif
+#ifdef HAVE_AVX2
+	case CPUID_AVX2:
+		__asm__ volatile("vpaddq %ymm0, %ymm0, %ymm0");
+		break;
+#endif
+	default:
+		return FALSE;
+		break;
+	}
+
+	signal(SIGILL, old_handler);
+#endif
+
+	(void) rd; /* Silence warning */
+
+	/* We actually never return here if SIGILL has been caught */
+	return ok == 1;
+}
+
+struct rspamd_cryptobox_library_ctx *
+rspamd_cryptobox_init(void)
+{
+	gint cpu[4], nid;
+	const guint32 osxsave_mask = (1 << 27);
+	const guint32 fma_movbe_osxsave_mask = ((1 << 12) | (1 << 22) | (1 << 27));
+	const guint32 avx2_bmi12_mask = (1 << 5) | (1 << 3) | (1 << 8);
+	gulong bit;
+	static struct rspamd_cryptobox_library_ctx *ctx;
+	GString *buf;
+
+	if (cryptobox_loaded) {
+		/* Ignore reload attempts */
+		return ctx;
+	}
+
+	cryptobox_loaded = TRUE;
+	ctx = g_malloc0(sizeof(*ctx));
+
+	rspamd_cryptobox_cpuid(cpu, 0);
+	nid = cpu[0];
+	rspamd_cryptobox_cpuid(cpu, 1);
+
+	if (nid > 1) {
+		if ((cpu[3] & ((guint32) 1 << 26))) {
+			if (rspamd_cryptobox_test_instr(CPUID_SSE2)) {
+				cpu_config |= CPUID_SSE2;
+			}
+		}
+		if ((cpu[2] & ((guint32) 1 << 0))) {
+			if (rspamd_cryptobox_test_instr(CPUID_SSE3)) {
+				cpu_config |= CPUID_SSE3;
+			}
+		}
+		if ((cpu[2] & ((guint32) 1 << 9))) {
+			if (rspamd_cryptobox_test_instr(CPUID_SSSE3)) {
+				cpu_config |= CPUID_SSSE3;
+			}
+		}
+		if ((cpu[2] & ((guint32) 1 << 19))) {
+			if (rspamd_cryptobox_test_instr(CPUID_SSE41)) {
+				cpu_config |= CPUID_SSE41;
+			}
+		}
+		if ((cpu[2] & ((guint32) 1 << 20))) {
+			if (rspamd_cryptobox_test_instr(CPUID_SSE42)) {
+				cpu_config |= CPUID_SSE42;
+			}
+		}
+		if ((cpu[2] & ((guint32) 1 << 30))) {
+			if (rspamd_cryptobox_test_instr(CPUID_RDRAND)) {
+				cpu_config |= CPUID_RDRAND;
+			}
+		}
+
+		/* OSXSAVE */
+		if ((cpu[2] & osxsave_mask) == osxsave_mask) {
+			if ((cpu[2] & ((guint32) 1 << 28))) {
+				if (rspamd_cryptobox_test_instr(CPUID_AVX)) {
+					cpu_config |= CPUID_AVX;
+				}
+			}
+
+			if (nid >= 7 &&
+				(cpu[2] & fma_movbe_osxsave_mask) == fma_movbe_osxsave_mask) {
+				rspamd_cryptobox_cpuid(cpu, 7);
+
+				if ((cpu[1] & avx2_bmi12_mask) == avx2_bmi12_mask) {
+					if (rspamd_cryptobox_test_instr(CPUID_AVX2)) {
+						cpu_config |= CPUID_AVX2;
+					}
+				}
+			}
+		}
+	}
+
+	buf = g_string_new("");
+
+	for (bit = 0x1; bit != 0; bit <<= 1) {
+		if (cpu_config & bit) {
+			switch (bit) {
+			case CPUID_SSE2:
+				rspamd_printf_gstring(buf, "sse2, ");
+				break;
+			case CPUID_SSE3:
+				rspamd_printf_gstring(buf, "sse3, ");
+				break;
+			case CPUID_SSSE3:
+				rspamd_printf_gstring(buf, "ssse3, ");
+				break;
+			case CPUID_SSE41:
+				rspamd_printf_gstring(buf, "sse4.1, ");
+				break;
+			case CPUID_SSE42:
+				rspamd_printf_gstring(buf, "sse4.2, ");
+				break;
+			case CPUID_AVX:
+				rspamd_printf_gstring(buf, "avx, ");
+				break;
+			case CPUID_AVX2:
+				rspamd_printf_gstring(buf, "avx2, ");
+				break;
+			case CPUID_RDRAND:
+				rspamd_printf_gstring(buf, "rdrand, ");
+				break;
+			default:
+				break; /* Silence warning */
+			}
+		}
+	}
+
+	if (buf->len > 2) {
+		/* Trim last chars */
+		g_string_erase(buf, buf->len - 2, 2);
+	}
+
+	ctx->cpu_extensions = buf->str;
+	g_string_free(buf, FALSE);
+	ctx->cpu_config = cpu_config;
+	g_assert(sodium_init() != -1);
+
+	ctx->chacha20_impl = chacha_load();
+	ctx->base64_impl = base64_load();
+#if defined(HAVE_USABLE_OPENSSL) && (OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER))
+	/* Needed for old openssl api, not sure about LibreSSL */
+	ERR_load_EC_strings();
+	ERR_load_RAND_strings();
+	ERR_load_EVP_strings();
+#endif
+
+	return ctx;
+}
+
+void rspamd_cryptobox_deinit(struct rspamd_cryptobox_library_ctx *ctx)
+{
+	if (ctx) {
+		g_free(ctx->cpu_extensions);
+		g_free(ctx);
+	}
+}
+
+void rspamd_cryptobox_keypair(rspamd_pk_t pk, rspamd_sk_t sk,
+							  enum rspamd_cryptobox_mode mode)
+{
+	if (G_LIKELY(mode == RSPAMD_CRYPTOBOX_MODE_25519)) {
+		ottery_rand_bytes(sk, rspamd_cryptobox_MAX_SKBYTES);
+		sk[0] &= 248;
+		sk[31] &= 127;
+		sk[31] |= 64;
+
+		crypto_scalarmult_base(pk, sk);
+	}
+	else {
+#ifndef HAVE_USABLE_OPENSSL
+		g_assert(0);
+#else
+		EC_KEY *ec_sec;
+		const BIGNUM *bn_sec;
+
+		const EC_POINT *ec_pub;
+		gsize len;
+
+		ec_sec = EC_KEY_new_by_curve_name(CRYPTOBOX_CURVE_NID);
+		g_assert(ec_sec != NULL);
+		g_assert(EC_KEY_generate_key(ec_sec) != 0);
+
+		bn_sec = EC_KEY_get0_private_key(ec_sec);
+		g_assert(bn_sec != NULL);
+		ec_pub = EC_KEY_get0_public_key(ec_sec);
+		g_assert(ec_pub != NULL);
+#if OPENSSL_VERSION_MAJOR >= 3
+		unsigned char *buf = NULL; /* Thanks openssl for this API (no) */
+		len = EC_POINT_point2buf(EC_KEY_get0_group(ec_sec), ec_pub,
+								 POINT_CONVERSION_UNCOMPRESSED, &buf, NULL);
+		g_assert(len <= (gint) rspamd_cryptobox_pk_bytes(mode));
+		memcpy(pk, buf, len);
+		OPENSSL_free(buf);
+#else
+		BIGNUM *bn_pub;
+		bn_pub = EC_POINT_point2bn(EC_KEY_get0_group(ec_sec),
+								   ec_pub, POINT_CONVERSION_UNCOMPRESSED, NULL, NULL);
+		len = BN_num_bytes(bn_pub);
+		g_assert(len <= (gint) rspamd_cryptobox_pk_bytes(mode));
+		BN_bn2bin(bn_pub, pk);
+		BN_free(bn_pub);
+#endif
+
+		len = BN_num_bytes(bn_sec);
+		g_assert(len <= (gint) sizeof(rspamd_sk_t));
+		BN_bn2bin(bn_sec, sk);
+
+		EC_KEY_free(ec_sec);
+#endif
+	}
+}
+
+void rspamd_cryptobox_keypair_sig(rspamd_sig_pk_t pk, rspamd_sig_sk_t sk,
+								  enum rspamd_cryptobox_mode mode)
+{
+	if (G_LIKELY(mode == RSPAMD_CRYPTOBOX_MODE_25519)) {
+		crypto_sign_keypair(pk, sk);
+	}
+	else {
+#ifndef HAVE_USABLE_OPENSSL
+		g_assert(0);
+#else
+		EC_KEY *ec_sec;
+		const BIGNUM *bn_sec;
+		const EC_POINT *ec_pub;
+		gsize len;
+
+		ec_sec = EC_KEY_new_by_curve_name(CRYPTOBOX_CURVE_NID);
+		g_assert(ec_sec != NULL);
+		g_assert(EC_KEY_generate_key(ec_sec) != 0);
+
+		bn_sec = EC_KEY_get0_private_key(ec_sec);
+		g_assert(bn_sec != NULL);
+		ec_pub = EC_KEY_get0_public_key(ec_sec);
+		g_assert(ec_pub != NULL);
+
+#if OPENSSL_VERSION_MAJOR >= 3
+		unsigned char *buf = NULL; /* Thanks openssl for this API (no) */
+		len = EC_POINT_point2buf(EC_KEY_get0_group(ec_sec), ec_pub,
+								 POINT_CONVERSION_UNCOMPRESSED, &buf, NULL);
+		g_assert(len <= (gint) rspamd_cryptobox_pk_bytes(mode));
+		memcpy(pk, buf, len);
+		OPENSSL_free(buf);
+#else
+		BIGNUM *bn_pub;
+		bn_pub = EC_POINT_point2bn(EC_KEY_get0_group(ec_sec),
+								   ec_pub, POINT_CONVERSION_UNCOMPRESSED, NULL, NULL);
+		len = BN_num_bytes(bn_pub);
+		g_assert(len <= (gint) rspamd_cryptobox_pk_bytes(mode));
+		BN_bn2bin(bn_pub, pk);
+		BN_free(bn_pub);
+#endif
+
+		len = BN_num_bytes(bn_sec);
+		g_assert(len <= (gint) sizeof(rspamd_sk_t));
+		BN_bn2bin(bn_sec, sk);
+		EC_KEY_free(ec_sec);
+#endif
+	}
+}
+
+#if OPENSSL_VERSION_MAJOR >= 3
+/* Compatibility function for OpenSSL 3.0 - thanks for breaking all API one more time */
+EC_POINT *ec_point_bn2point_compat(const EC_GROUP *group,
+								   const BIGNUM *bn, EC_POINT *point, BN_CTX *ctx)
+{
+	size_t buf_len = 0;
+	unsigned char *buf;
+	EC_POINT *ret;
+
+	if ((buf_len = BN_num_bytes(bn)) == 0)
+		buf_len = 1;
+	if ((buf = OPENSSL_malloc(buf_len)) == NULL) {
+		return NULL;
+	}
+
+	if (!BN_bn2binpad(bn, buf, buf_len)) {
+		OPENSSL_free(buf);
+		return NULL;
+	}
+
+	if (point == NULL) {
+		if ((ret = EC_POINT_new(group)) == NULL) {
+			OPENSSL_free(buf);
+			return NULL;
+		}
+	}
+	else
+		ret = point;
+
+	if (!EC_POINT_oct2point(group, ret, buf, buf_len, ctx)) {
+		if (ret != point)
+			EC_POINT_clear_free(ret);
+		OPENSSL_free(buf);
+		return NULL;
+	}
+
+	OPENSSL_free(buf);
+	return ret;
+}
+#else
+#define ec_point_bn2point_compat EC_POINT_bn2point
+#endif
+
+void rspamd_cryptobox_nm(rspamd_nm_t nm,
+						 const rspamd_pk_t pk, const rspamd_sk_t sk,
+						 enum rspamd_cryptobox_mode mode)
+{
+	if (G_LIKELY(mode == RSPAMD_CRYPTOBOX_MODE_25519)) {
+		guchar s[32];
+		guchar e[32];
+
+		memcpy(e, sk, 32);
+		e[0] &= 248;
+		e[31] &= 127;
+		e[31] |= 64;
+
+		if (crypto_scalarmult(s, e, pk) != -1) {
+			hchacha(s, n0, nm, 20);
+		}
+
+		rspamd_explicit_memzero(e, 32);
+	}
+	else {
+#ifndef HAVE_USABLE_OPENSSL
+		g_assert(0);
+#else
+		EC_KEY *lk;
+		EC_POINT *ec_pub;
+		BIGNUM *bn_pub, *bn_sec;
+		gint len;
+		guchar s[32];
+
+		lk = EC_KEY_new_by_curve_name(CRYPTOBOX_CURVE_NID);
+		g_assert(lk != NULL);
+
+		bn_pub = BN_bin2bn(pk, rspamd_cryptobox_pk_bytes(mode), NULL);
+		g_assert(bn_pub != NULL);
+		bn_sec = BN_bin2bn(sk, sizeof(rspamd_sk_t), NULL);
+		g_assert(bn_sec != NULL);
+
+		g_assert(EC_KEY_set_private_key(lk, bn_sec) == 1);
+		ec_pub = ec_point_bn2point_compat(EC_KEY_get0_group(lk), bn_pub, NULL, NULL);
+		g_assert(ec_pub != NULL);
+		len = ECDH_compute_key(s, sizeof(s), ec_pub, lk, NULL);
+		g_assert(len == sizeof(s));
+
+		/* Still do hchacha iteration since we are not using SHA1 KDF */
+		hchacha(s, n0, nm, 20);
+
+		EC_KEY_free(lk);
+		EC_POINT_free(ec_pub);
+		BN_free(bn_sec);
+		BN_free(bn_pub);
+#endif
+	}
+}
+
+void rspamd_cryptobox_sign(guchar *sig, unsigned long long *siglen_p,
+						   const guchar *m, gsize mlen,
+						   const rspamd_sk_t sk,
+						   enum rspamd_cryptobox_mode mode)
+{
+	if (G_LIKELY(mode == RSPAMD_CRYPTOBOX_MODE_25519)) {
+		crypto_sign_detached(sig, siglen_p, m, mlen, sk);
+	}
+	else {
+#ifndef HAVE_USABLE_OPENSSL
+		g_assert(0);
+#else
+		EC_KEY *lk;
+		BIGNUM *bn_sec;
+		EVP_MD_CTX *sha_ctx;
+		unsigned char h[64];
+		guint diglen = rspamd_cryptobox_signature_bytes(mode);
+
+		/* Prehash */
+		sha_ctx = EVP_MD_CTX_create();
+		g_assert(EVP_DigestInit(sha_ctx, EVP_sha512()) == 1);
+		EVP_DigestUpdate(sha_ctx, m, mlen);
+		EVP_DigestFinal(sha_ctx, h, NULL);
+
+		/* Key setup */
+		lk = EC_KEY_new_by_curve_name(CRYPTOBOX_CURVE_NID);
+		g_assert(lk != NULL);
+		bn_sec = BN_bin2bn(sk, sizeof(rspamd_sk_t), NULL);
+		g_assert(bn_sec != NULL);
+		g_assert(EC_KEY_set_private_key(lk, bn_sec) == 1);
+
+		/* ECDSA */
+		g_assert(ECDSA_sign(0, h, sizeof(h), sig, &diglen, lk) == 1);
+		g_assert(diglen <= sizeof(rspamd_signature_t));
+
+		if (siglen_p) {
+			*siglen_p = diglen;
+		}
+
+		EC_KEY_free(lk);
+		EVP_MD_CTX_destroy(sha_ctx);
+		BN_free(bn_sec);
+#endif
+	}
+}
+
+bool rspamd_cryptobox_verify(const guchar *sig,
+							 gsize siglen,
+							 const guchar *m,
+							 gsize mlen,
+							 const rspamd_pk_t pk,
+							 enum rspamd_cryptobox_mode mode)
+{
+	bool ret = false;
+
+	if (G_LIKELY(mode == RSPAMD_CRYPTOBOX_MODE_25519)) {
+		if (siglen == rspamd_cryptobox_signature_bytes(RSPAMD_CRYPTOBOX_MODE_25519)) {
+			ret = (crypto_sign_verify_detached(sig, m, mlen, pk) == 0);
+		}
+	}
+	else {
+#ifndef HAVE_USABLE_OPENSSL
+		g_assert(0);
+#else
+		EC_KEY *lk;
+		EC_POINT *ec_pub;
+		BIGNUM *bn_pub;
+		EVP_MD_CTX *sha_ctx;
+		unsigned char h[64];
+
+		/* Prehash */
+		sha_ctx = EVP_MD_CTX_create();
+		g_assert(EVP_DigestInit(sha_ctx, EVP_sha512()) == 1);
+		EVP_DigestUpdate(sha_ctx, m, mlen);
+		EVP_DigestFinal(sha_ctx, h, NULL);
+
+		/* Key setup */
+		lk = EC_KEY_new_by_curve_name(CRYPTOBOX_CURVE_NID);
+		g_assert(lk != NULL);
+		bn_pub = BN_bin2bn(pk, rspamd_cryptobox_pk_bytes(mode), NULL);
+		g_assert(bn_pub != NULL);
+		ec_pub = ec_point_bn2point_compat(EC_KEY_get0_group(lk), bn_pub, NULL, NULL);
+		g_assert(ec_pub != NULL);
+		g_assert(EC_KEY_set_public_key(lk, ec_pub) == 1);
+
+		/* ECDSA */
+		ret = ECDSA_verify(0, h, sizeof(h), sig, siglen, lk) == 1;
+
+		EC_KEY_free(lk);
+		EVP_MD_CTX_destroy(sha_ctx);
+		BN_free(bn_pub);
+		EC_POINT_free(ec_pub);
+#endif
+	}
+
+	return ret;
+}
+
+static gsize
+rspamd_cryptobox_encrypt_ctx_len(enum rspamd_cryptobox_mode mode)
+{
+	if (G_LIKELY(mode == RSPAMD_CRYPTOBOX_MODE_25519)) {
+		return sizeof(chacha_state) + CRYPTOBOX_ALIGNMENT;
+	}
+	else {
+#ifndef HAVE_USABLE_OPENSSL
+		g_assert(0);
+#else
+		return sizeof(EVP_CIPHER_CTX *) + CRYPTOBOX_ALIGNMENT;
+#endif
+	}
+
+	return 0;
+}
+
+static gsize
+rspamd_cryptobox_auth_ctx_len(enum rspamd_cryptobox_mode mode)
+{
+	if (G_LIKELY(mode == RSPAMD_CRYPTOBOX_MODE_25519)) {
+		return sizeof(crypto_onetimeauth_state) + RSPAMD_ALIGNOF(crypto_onetimeauth_state);
+	}
+	else {
+#ifndef HAVE_USABLE_OPENSSL
+		g_assert(0);
+#else
+		return sizeof(void *);
+#endif
+	}
+
+	return 0;
+}
+
+static void *
+rspamd_cryptobox_encrypt_init(void *enc_ctx, const rspamd_nonce_t nonce,
+							  const rspamd_nm_t nm,
+							  enum rspamd_cryptobox_mode mode)
+{
+	if (G_LIKELY(mode == RSPAMD_CRYPTOBOX_MODE_25519)) {
+		chacha_state *s;
+
+		s = cryptobox_align_ptr(enc_ctx, CRYPTOBOX_ALIGNMENT);
+		xchacha_init(s,
+					 (const chacha_key *) nm,
+					 (const chacha_iv24 *) nonce,
+					 20);
+
+		return s;
+	}
+	else {
+#ifndef HAVE_USABLE_OPENSSL
+		g_assert(0);
+#else
+		EVP_CIPHER_CTX **s;
+
+		s = cryptobox_align_ptr(enc_ctx, CRYPTOBOX_ALIGNMENT);
+		memset(s, 0, sizeof(*s));
+		*s = EVP_CIPHER_CTX_new();
+		g_assert(EVP_EncryptInit_ex(*s, EVP_aes_256_gcm(), NULL, NULL, NULL) == 1);
+		g_assert(EVP_CIPHER_CTX_ctrl(*s, EVP_CTRL_GCM_SET_IVLEN,
+									 rspamd_cryptobox_nonce_bytes(mode), NULL) == 1);
+		g_assert(EVP_EncryptInit_ex(*s, NULL, NULL, nm, nonce) == 1);
+
+		return s;
+#endif
+	}
+
+	return NULL;
+}
+
+static void *
+rspamd_cryptobox_auth_init(void *auth_ctx, void *enc_ctx,
+						   enum rspamd_cryptobox_mode mode)
+{
+	if (G_LIKELY(mode == RSPAMD_CRYPTOBOX_MODE_25519)) {
+		crypto_onetimeauth_state *mac_ctx;
+		guchar RSPAMD_ALIGNED(32) subkey[CHACHA_BLOCKBYTES];
+
+		mac_ctx = cryptobox_align_ptr(auth_ctx, CRYPTOBOX_ALIGNMENT);
+		memset(subkey, 0, sizeof(subkey));
+		chacha_update(enc_ctx, subkey, subkey, sizeof(subkey));
+		crypto_onetimeauth_init(mac_ctx, subkey);
+		rspamd_explicit_memzero(subkey, sizeof(subkey));
+
+		return mac_ctx;
+	}
+	else {
+#ifndef HAVE_USABLE_OPENSSL
+		g_assert(0);
+#else
+		auth_ctx = enc_ctx;
+
+		return auth_ctx;
+#endif
+	}
+
+	return NULL;
+}
+
+static gboolean
+rspamd_cryptobox_encrypt_update(void *enc_ctx, const guchar *in, gsize inlen,
+								guchar *out, gsize *outlen,
+								enum rspamd_cryptobox_mode mode)
+{
+	if (G_LIKELY(mode == RSPAMD_CRYPTOBOX_MODE_25519)) {
+		gsize r;
+		chacha_state *s;
+
+		s = cryptobox_align_ptr(enc_ctx, CRYPTOBOX_ALIGNMENT);
+
+		r = chacha_update(s, in, out, inlen);
+
+		if (outlen != NULL) {
+			*outlen = r;
+		}
+
+		return TRUE;
+	}
+	else {
+#ifndef HAVE_USABLE_OPENSSL
+		g_assert(0);
+#else
+		EVP_CIPHER_CTX **s = enc_ctx;
+		gint r;
+
+		r = inlen;
+		g_assert(EVP_EncryptUpdate(*s, out, &r, in, inlen) == 1);
+
+		if (outlen) {
+			*outlen = r;
+		}
+
+		return TRUE;
+#endif
+	}
+
+	return FALSE;
+}
+
+static gboolean
+rspamd_cryptobox_auth_update(void *auth_ctx, const guchar *in, gsize inlen,
+							 enum rspamd_cryptobox_mode mode)
+{
+	if (G_LIKELY(mode == RSPAMD_CRYPTOBOX_MODE_25519)) {
+		crypto_onetimeauth_state *mac_ctx;
+
+		mac_ctx = cryptobox_align_ptr(auth_ctx, CRYPTOBOX_ALIGNMENT);
+		crypto_onetimeauth_update(mac_ctx, in, inlen);
+
+		return TRUE;
+	}
+	else {
+#ifndef HAVE_USABLE_OPENSSL
+		g_assert(0);
+#else
+		return TRUE;
+#endif
+	}
+
+	return FALSE;
+}
+
+static gsize
+rspamd_cryptobox_encrypt_final(void *enc_ctx, guchar *out, gsize remain,
+							   enum rspamd_cryptobox_mode mode)
+{
+	if (G_LIKELY(mode == RSPAMD_CRYPTOBOX_MODE_25519)) {
+		chacha_state *s;
+
+		s = cryptobox_align_ptr(enc_ctx, CRYPTOBOX_ALIGNMENT);
+		return chacha_final(s, out);
+	}
+	else {
+#ifndef HAVE_USABLE_OPENSSL
+		g_assert(0);
+#else
+		EVP_CIPHER_CTX **s = enc_ctx;
+		gint r = remain;
+
+		g_assert(EVP_EncryptFinal_ex(*s, out, &r) == 1);
+
+		return r;
+#endif
+	}
+
+	return 0;
+}
+
+static gboolean
+rspamd_cryptobox_auth_final(void *auth_ctx, rspamd_mac_t sig,
+							enum rspamd_cryptobox_mode mode)
+{
+	if (G_LIKELY(mode == RSPAMD_CRYPTOBOX_MODE_25519)) {
+		crypto_onetimeauth_state *mac_ctx;
+
+		mac_ctx = cryptobox_align_ptr(auth_ctx, CRYPTOBOX_ALIGNMENT);
+		crypto_onetimeauth_final(mac_ctx, sig);
+
+		return TRUE;
+	}
+	else {
+#ifndef HAVE_USABLE_OPENSSL
+		g_assert(0);
+#else
+		EVP_CIPHER_CTX **s = auth_ctx;
+
+		g_assert(EVP_CIPHER_CTX_ctrl(*s, EVP_CTRL_GCM_GET_TAG,
+									 sizeof(rspamd_mac_t), sig) == 1);
+
+		return TRUE;
+#endif
+	}
+
+	return FALSE;
+}
+
+static void *
+rspamd_cryptobox_decrypt_init(void *enc_ctx, const rspamd_nonce_t nonce,
+							  const rspamd_nm_t nm,
+							  enum rspamd_cryptobox_mode mode)
+{
+	if (G_LIKELY(mode == RSPAMD_CRYPTOBOX_MODE_25519)) {
+
+		chacha_state *s;
+
+		s = cryptobox_align_ptr(enc_ctx, CRYPTOBOX_ALIGNMENT);
+		xchacha_init(s,
+					 (const chacha_key *) nm,
+					 (const chacha_iv24 *) nonce,
+					 20);
+
+		return s;
+	}
+	else {
+#ifndef HAVE_USABLE_OPENSSL
+		g_assert(0);
+#else
+		EVP_CIPHER_CTX **s;
+
+		s = cryptobox_align_ptr(enc_ctx, CRYPTOBOX_ALIGNMENT);
+		memset(s, 0, sizeof(*s));
+		*s = EVP_CIPHER_CTX_new();
+		g_assert(EVP_DecryptInit_ex(*s, EVP_aes_256_gcm(), NULL, NULL, NULL) == 1);
+		g_assert(EVP_CIPHER_CTX_ctrl(*s, EVP_CTRL_GCM_SET_IVLEN,
+									 rspamd_cryptobox_nonce_bytes(mode), NULL) == 1);
+		g_assert(EVP_DecryptInit_ex(*s, NULL, NULL, nm, nonce) == 1);
+
+		return s;
+#endif
+	}
+
+	return NULL;
+}
+
+static void *
+rspamd_cryptobox_auth_verify_init(void *auth_ctx, void *enc_ctx,
+								  enum rspamd_cryptobox_mode mode)
+{
+	if (G_LIKELY(mode == RSPAMD_CRYPTOBOX_MODE_25519)) {
+		crypto_onetimeauth_state *mac_ctx;
+		guchar RSPAMD_ALIGNED(32) subkey[CHACHA_BLOCKBYTES];
+
+		mac_ctx = cryptobox_align_ptr(auth_ctx, CRYPTOBOX_ALIGNMENT);
+		memset(subkey, 0, sizeof(subkey));
+		chacha_update(enc_ctx, subkey, subkey, sizeof(subkey));
+		crypto_onetimeauth_init(mac_ctx, subkey);
+		rspamd_explicit_memzero(subkey, sizeof(subkey));
+
+		return mac_ctx;
+	}
+	else {
+#ifndef HAVE_USABLE_OPENSSL
+		g_assert(0);
+#else
+		auth_ctx = enc_ctx;
+
+		return auth_ctx;
+#endif
+	}
+
+	return NULL;
+}
+
+static gboolean
+rspamd_cryptobox_decrypt_update(void *enc_ctx, const guchar *in, gsize inlen,
+								guchar *out, gsize *outlen,
+								enum rspamd_cryptobox_mode mode)
+{
+	if (G_LIKELY(mode == RSPAMD_CRYPTOBOX_MODE_25519)) {
+		gsize r;
+		chacha_state *s;
+
+		s = cryptobox_align_ptr(enc_ctx, CRYPTOBOX_ALIGNMENT);
+		r = chacha_update(s, in, out, inlen);
+
+		if (outlen != NULL) {
+			*outlen = r;
+		}
+
+		return TRUE;
+	}
+	else {
+#ifndef HAVE_USABLE_OPENSSL
+		g_assert(0);
+#else
+		EVP_CIPHER_CTX **s = enc_ctx;
+		gint r;
+
+		r = outlen ? *outlen : inlen;
+		g_assert(EVP_DecryptUpdate(*s, out, &r, in, inlen) == 1);
+
+		if (outlen) {
+			*outlen = r;
+		}
+
+		return TRUE;
+#endif
+	}
+}
+
+static gboolean
+rspamd_cryptobox_auth_verify_update(void *auth_ctx,
+									const guchar *in, gsize inlen,
+									enum rspamd_cryptobox_mode mode)
+{
+	if (G_LIKELY(mode == RSPAMD_CRYPTOBOX_MODE_25519)) {
+		crypto_onetimeauth_state *mac_ctx;
+
+		mac_ctx = cryptobox_align_ptr(auth_ctx, CRYPTOBOX_ALIGNMENT);
+		crypto_onetimeauth_update(mac_ctx, in, inlen);
+
+		return TRUE;
+	}
+	else {
+#ifndef HAVE_USABLE_OPENSSL
+		/* We do not need to authenticate as a separate process */
+		return TRUE;
+#else
+#endif
+	}
+
+	return FALSE;
+}
+
+static gboolean
+rspamd_cryptobox_decrypt_final(void *enc_ctx, guchar *out, gsize remain,
+							   enum rspamd_cryptobox_mode mode)
+{
+	if (G_LIKELY(mode == RSPAMD_CRYPTOBOX_MODE_25519)) {
+		chacha_state *s;
+
+		s = cryptobox_align_ptr(enc_ctx, CRYPTOBOX_ALIGNMENT);
+		chacha_final(s, out);
+
+		return TRUE;
+	}
+	else {
+#ifndef HAVE_USABLE_OPENSSL
+		g_assert(0);
+#else
+		EVP_CIPHER_CTX **s = enc_ctx;
+		gint r = remain;
+
+		if (EVP_DecryptFinal_ex(*s, out, &r) < 0) {
+			return FALSE;
+		}
+
+		return TRUE;
+#endif
+	}
+
+	return FALSE;
+}
+
+static gboolean
+rspamd_cryptobox_auth_verify_final(void *auth_ctx, const rspamd_mac_t sig,
+								   enum rspamd_cryptobox_mode mode)
+{
+	if (G_LIKELY(mode == RSPAMD_CRYPTOBOX_MODE_25519)) {
+		rspamd_mac_t mac;
+		crypto_onetimeauth_state *mac_ctx;
+
+		mac_ctx = cryptobox_align_ptr(auth_ctx, CRYPTOBOX_ALIGNMENT);
+		crypto_onetimeauth_final(mac_ctx, mac);
+
+		if (crypto_verify_16(mac, sig) != 0) {
+			return FALSE;
+		}
+
+		return TRUE;
+	}
+	else {
+#ifndef HAVE_USABLE_OPENSSL
+		g_assert(0);
+#else
+		EVP_CIPHER_CTX **s = auth_ctx;
+
+		if (EVP_CIPHER_CTX_ctrl(*s, EVP_CTRL_GCM_SET_TAG, 16, (guchar *) sig) != 1) {
+			return FALSE;
+		}
+
+		return TRUE;
+#endif
+	}
+
+	return FALSE;
+}
+
+
+static void
+rspamd_cryptobox_cleanup(void *enc_ctx, void *auth_ctx,
+						 enum rspamd_cryptobox_mode mode)
+{
+	if (G_LIKELY(mode == RSPAMD_CRYPTOBOX_MODE_25519)) {
+		crypto_onetimeauth_state *mac_ctx;
+
+		mac_ctx = cryptobox_align_ptr(auth_ctx, CRYPTOBOX_ALIGNMENT);
+		rspamd_explicit_memzero(mac_ctx, sizeof(*mac_ctx));
+	}
+	else {
+#ifndef HAVE_USABLE_OPENSSL
+		g_assert(0);
+#else
+		EVP_CIPHER_CTX **s = enc_ctx;
+
+		EVP_CIPHER_CTX_cleanup(*s);
+		EVP_CIPHER_CTX_free(*s);
+#endif
+	}
+}
+
+void rspamd_cryptobox_encrypt_nm_inplace(guchar *data, gsize len,
+										 const rspamd_nonce_t nonce,
+										 const rspamd_nm_t nm,
+										 rspamd_mac_t sig,
+										 enum rspamd_cryptobox_mode mode)
+{
+	gsize r;
+	void *enc_ctx, *auth_ctx;
+
+	enc_ctx = g_alloca(rspamd_cryptobox_encrypt_ctx_len(mode));
+	auth_ctx = g_alloca(rspamd_cryptobox_auth_ctx_len(mode));
+
+	enc_ctx = rspamd_cryptobox_encrypt_init(enc_ctx, nonce, nm, mode);
+	auth_ctx = rspamd_cryptobox_auth_init(auth_ctx, enc_ctx, mode);
+
+	rspamd_cryptobox_encrypt_update(enc_ctx, data, len, data, &r, mode);
+	rspamd_cryptobox_encrypt_final(enc_ctx, data + r, len - r, mode);
+
+	rspamd_cryptobox_auth_update(auth_ctx, data, len, mode);
+	rspamd_cryptobox_auth_final(auth_ctx, sig, mode);
+
+	rspamd_cryptobox_cleanup(enc_ctx, auth_ctx, mode);
+}
+
+static void
+rspamd_cryptobox_flush_outbuf(struct rspamd_cryptobox_segment *st,
+							  const guchar *buf, gsize len, gsize offset)
+{
+	gsize cpy_len;
+
+	while (len > 0) {
+		cpy_len = MIN(len, st->len - offset);
+		memcpy(st->data + offset, buf, cpy_len);
+		st++;
+		buf += cpy_len;
+		len -= cpy_len;
+		offset = 0;
+	}
+}
+
+void rspamd_cryptobox_encryptv_nm_inplace(struct rspamd_cryptobox_segment *segments,
+										  gsize cnt,
+										  const rspamd_nonce_t nonce,
+										  const rspamd_nm_t nm, rspamd_mac_t sig,
+										  enum rspamd_cryptobox_mode mode)
+{
+	struct rspamd_cryptobox_segment *cur = segments, *start_seg = segments;
+	guchar outbuf[CHACHA_BLOCKBYTES * 16];
+	void *enc_ctx, *auth_ctx;
+	guchar *out, *in;
+	gsize r, remain, inremain, seg_offset;
+
+	enc_ctx = g_alloca(rspamd_cryptobox_encrypt_ctx_len(mode));
+	auth_ctx = g_alloca(rspamd_cryptobox_auth_ctx_len(mode));
+
+	enc_ctx = rspamd_cryptobox_encrypt_init(enc_ctx, nonce, nm, mode);
+	auth_ctx = rspamd_cryptobox_auth_init(auth_ctx, enc_ctx, mode);
+
+	remain = sizeof(outbuf);
+	out = outbuf;
+	inremain = cur->len;
+	seg_offset = 0;
+
+	for (;;) {
+		if (cur - segments == (gint) cnt) {
+			break;
+		}
+
+		if (cur->len <= remain) {
+			memcpy(out, cur->data, cur->len);
+			remain -= cur->len;
+			out += cur->len;
+			cur++;
+
+			if (remain == 0) {
+				rspamd_cryptobox_encrypt_update(enc_ctx, outbuf, sizeof(outbuf),
+												outbuf, NULL, mode);
+				rspamd_cryptobox_auth_update(auth_ctx, outbuf, sizeof(outbuf),
+											 mode);
+				rspamd_cryptobox_flush_outbuf(start_seg, outbuf,
+											  sizeof(outbuf), seg_offset);
+				start_seg = cur;
+				seg_offset = 0;
+				remain = sizeof(outbuf);
+				out = outbuf;
+			}
+		}
+		else {
+			memcpy(out, cur->data, remain);
+			rspamd_cryptobox_encrypt_update(enc_ctx, outbuf, sizeof(outbuf),
+											outbuf, NULL, mode);
+			rspamd_cryptobox_auth_update(auth_ctx, outbuf, sizeof(outbuf),
+										 mode);
+			rspamd_cryptobox_flush_outbuf(start_seg, outbuf, sizeof(outbuf),
+										  seg_offset);
+			seg_offset = 0;
+
+			inremain = cur->len - remain;
+			in = cur->data + remain;
+			out = outbuf;
+			remain = 0;
+			start_seg = cur;
+
+			while (inremain > 0) {
+				if (sizeof(outbuf) <= inremain) {
+					memcpy(outbuf, in, sizeof(outbuf));
+					rspamd_cryptobox_encrypt_update(enc_ctx,
+													outbuf,
+													sizeof(outbuf),
+													outbuf,
+													NULL,
+													mode);
+					rspamd_cryptobox_auth_update(auth_ctx,
+												 outbuf,
+												 sizeof(outbuf),
+												 mode);
+					memcpy(in, outbuf, sizeof(outbuf));
+					in += sizeof(outbuf);
+					inremain -= sizeof(outbuf);
+					remain = sizeof(outbuf);
+				}
+				else {
+					memcpy(outbuf, in, inremain);
+					remain = sizeof(outbuf) - inremain;
+					out = outbuf + inremain;
+					inremain = 0;
+				}
+			}
+
+			seg_offset = cur->len - (sizeof(outbuf) - remain);
+			cur++;
+		}
+	}
+
+	rspamd_cryptobox_encrypt_update(enc_ctx, outbuf, sizeof(outbuf) - remain,
+									outbuf, &r, mode);
+	out = outbuf + r;
+	rspamd_cryptobox_encrypt_final(enc_ctx, out, sizeof(outbuf) - remain - r,
+								   mode);
+
+	rspamd_cryptobox_auth_update(auth_ctx, outbuf, sizeof(outbuf) - remain,
+								 mode);
+	rspamd_cryptobox_auth_final(auth_ctx, sig, mode);
+
+	rspamd_cryptobox_flush_outbuf(start_seg, outbuf, sizeof(outbuf) - remain,
+								  seg_offset);
+	rspamd_cryptobox_cleanup(enc_ctx, auth_ctx, mode);
+}
+
+gboolean
+rspamd_cryptobox_decrypt_nm_inplace(guchar *data, gsize len,
+									const rspamd_nonce_t nonce, const rspamd_nm_t nm,
+									const rspamd_mac_t sig, enum rspamd_cryptobox_mode mode)
+{
+	gsize r = 0;
+	gboolean ret = TRUE;
+	void *enc_ctx, *auth_ctx;
+
+	enc_ctx = g_alloca(rspamd_cryptobox_encrypt_ctx_len(mode));
+	auth_ctx = g_alloca(rspamd_cryptobox_auth_ctx_len(mode));
+
+	enc_ctx = rspamd_cryptobox_decrypt_init(enc_ctx, nonce, nm, mode);
+	auth_ctx = rspamd_cryptobox_auth_verify_init(auth_ctx, enc_ctx, mode);
+
+	rspamd_cryptobox_auth_verify_update(auth_ctx, data, len, mode);
+
+	if (!rspamd_cryptobox_auth_verify_final(auth_ctx, sig, mode)) {
+		ret = FALSE;
+	}
+	else {
+		rspamd_cryptobox_decrypt_update(enc_ctx, data, len, data, &r, mode);
+		ret = rspamd_cryptobox_decrypt_final(enc_ctx, data + r, len - r, mode);
+	}
+
+	rspamd_cryptobox_cleanup(enc_ctx, auth_ctx, mode);
+
+	return ret;
+}
+
+gboolean
+rspamd_cryptobox_decrypt_inplace(guchar *data, gsize len,
+								 const rspamd_nonce_t nonce,
+								 const rspamd_pk_t pk, const rspamd_sk_t sk,
+								 const rspamd_mac_t sig,
+								 enum rspamd_cryptobox_mode mode)
+{
+	guchar nm[rspamd_cryptobox_MAX_NMBYTES];
+	gboolean ret;
+
+	rspamd_cryptobox_nm(nm, pk, sk, mode);
+	ret = rspamd_cryptobox_decrypt_nm_inplace(data, len, nonce, nm, sig, mode);
+
+	rspamd_explicit_memzero(nm, sizeof(nm));
+
+	return ret;
+}
+
+void rspamd_cryptobox_encrypt_inplace(guchar *data, gsize len,
+									  const rspamd_nonce_t nonce,
+									  const rspamd_pk_t pk, const rspamd_sk_t sk,
+									  rspamd_mac_t sig,
+									  enum rspamd_cryptobox_mode mode)
+{
+	guchar nm[rspamd_cryptobox_MAX_NMBYTES];
+
+	rspamd_cryptobox_nm(nm, pk, sk, mode);
+	rspamd_cryptobox_encrypt_nm_inplace(data, len, nonce, nm, sig, mode);
+	rspamd_explicit_memzero(nm, sizeof(nm));
+}
+
+void rspamd_cryptobox_encryptv_inplace(struct rspamd_cryptobox_segment *segments,
+									   gsize cnt,
+									   const rspamd_nonce_t nonce,
+									   const rspamd_pk_t pk, const rspamd_sk_t sk,
+									   rspamd_mac_t sig,
+									   enum rspamd_cryptobox_mode mode)
+{
+	guchar nm[rspamd_cryptobox_MAX_NMBYTES];
+
+	rspamd_cryptobox_nm(nm, pk, sk, mode);
+	rspamd_cryptobox_encryptv_nm_inplace(segments, cnt, nonce, nm, sig, mode);
+	rspamd_explicit_memzero(nm, sizeof(nm));
+}
+
+
+void rspamd_cryptobox_siphash(unsigned char *out, const unsigned char *in,
+							  unsigned long long inlen,
+							  const rspamd_sipkey_t k)
+{
+	crypto_shorthash_siphash24(out, in, inlen, k);
+}
+
+/*
+ * Password-Based Key Derivation Function 2 (PKCS #5 v2.0).
+ * Code based on IEEE Std 802.11-2007, Annex H.4.2.
+ */
+static gboolean
+rspamd_cryptobox_pbkdf2(const char *pass, gsize pass_len,
+						const guint8 *salt, gsize salt_len, guint8 *key, gsize key_len,
+						unsigned int rounds)
+{
+	guint8 *asalt, obuf[crypto_generichash_blake2b_BYTES_MAX];
+	guint8 d1[crypto_generichash_blake2b_BYTES_MAX],
+		d2[crypto_generichash_blake2b_BYTES_MAX];
+	unsigned int i, j;
+	unsigned int count;
+	gsize r;
+
+	if (rounds < 1 || key_len == 0) {
+		return FALSE;
+	}
+	if (salt_len == 0 || salt_len > G_MAXSIZE - 4) {
+		return FALSE;
+	}
+
+	asalt = g_malloc(salt_len + 4);
+	memcpy(asalt, salt, salt_len);
+
+	for (count = 1; key_len > 0; count++) {
+		asalt[salt_len + 0] = (count >> 24) & 0xff;
+		asalt[salt_len + 1] = (count >> 16) & 0xff;
+		asalt[salt_len + 2] = (count >> 8) & 0xff;
+		asalt[salt_len + 3] = count & 0xff;
+
+		if (pass_len <= crypto_generichash_blake2b_KEYBYTES_MAX) {
+			crypto_generichash_blake2b(d1, sizeof(d1), asalt, salt_len + 4,
+									   pass, pass_len);
+		}
+		else {
+			guint8 k[crypto_generichash_blake2b_BYTES_MAX];
+
+			/*
+			 * We use additional blake2 iteration to store large key
+			 * XXX: it is not compatible with the original implementation but safe
+			 */
+			crypto_generichash_blake2b(k, sizeof(k), pass, pass_len,
+									   NULL, 0);
+			crypto_generichash_blake2b(d1, sizeof(d1), asalt, salt_len + 4,
+									   k, sizeof(k));
+		}
+
+		memcpy(obuf, d1, sizeof(obuf));
+
+		for (i = 1; i < rounds; i++) {
+			if (pass_len <= crypto_generichash_blake2b_KEYBYTES_MAX) {
+				crypto_generichash_blake2b(d2, sizeof(d2), d1, sizeof(d1),
+										   pass, pass_len);
+			}
+			else {
+				guint8 k[crypto_generichash_blake2b_BYTES_MAX];
+
+				/*
+				 * We use additional blake2 iteration to store large key
+				 * XXX: it is not compatible with the original implementation but safe
+				 */
+				crypto_generichash_blake2b(k, sizeof(k), pass, pass_len,
+										   NULL, 0);
+				crypto_generichash_blake2b(d2, sizeof(d2), d1, sizeof(d1),
+										   k, sizeof(k));
+			}
+
+			memcpy(d1, d2, sizeof(d1));
+
+			for (j = 0; j < sizeof(obuf); j++) {
+				obuf[j] ^= d1[j];
+			}
+		}
+
+		r = MIN(key_len, crypto_generichash_blake2b_BYTES_MAX);
+		memcpy(key, obuf, r);
+		key += r;
+		key_len -= r;
+	}
+
+	rspamd_explicit_memzero(asalt, salt_len + 4);
+	g_free(asalt);
+	rspamd_explicit_memzero(d1, sizeof(d1));
+	rspamd_explicit_memzero(d2, sizeof(d2));
+	rspamd_explicit_memzero(obuf, sizeof(obuf));
+
+	return TRUE;
+}
+
+gboolean
+rspamd_cryptobox_pbkdf(const char *pass, gsize pass_len,
+					   const guint8 *salt, gsize salt_len, guint8 *key, gsize key_len,
+					   unsigned int complexity, enum rspamd_cryptobox_pbkdf_type type)
+{
+	gboolean ret = FALSE;
+
+	switch (type) {
+	case RSPAMD_CRYPTOBOX_CATENA:
+		if (catena(pass, pass_len, salt, salt_len, "rspamd", 6,
+				   4, complexity, complexity, key_len, key) == 0) {
+			ret = TRUE;
+		}
+		break;
+	case RSPAMD_CRYPTOBOX_PBKDF2:
+	default:
+		ret = rspamd_cryptobox_pbkdf2(pass, pass_len, salt, salt_len, key,
+									  key_len, complexity);
+		break;
+	}
+
+	return ret;
+}
+
+guint rspamd_cryptobox_pk_bytes(enum rspamd_cryptobox_mode mode)
+{
+	if (G_UNLIKELY(mode == RSPAMD_CRYPTOBOX_MODE_25519)) {
+		return 32;
+	}
+	else {
+		return 65;
+	}
+}
+
+guint rspamd_cryptobox_pk_sig_bytes(enum rspamd_cryptobox_mode mode)
+{
+	if (G_UNLIKELY(mode == RSPAMD_CRYPTOBOX_MODE_25519)) {
+		return 32;
+	}
+	else {
+		return 65;
+	}
+}
+
+guint rspamd_cryptobox_nonce_bytes(enum rspamd_cryptobox_mode mode)
+{
+	if (G_UNLIKELY(mode == RSPAMD_CRYPTOBOX_MODE_25519)) {
+		return 24;
+	}
+	else {
+		return 16;
+	}
+}
+
+
+guint rspamd_cryptobox_sk_bytes(enum rspamd_cryptobox_mode mode)
+{
+	return 32;
+}
+
+guint rspamd_cryptobox_sk_sig_bytes(enum rspamd_cryptobox_mode mode)
+{
+	if (G_UNLIKELY(mode == RSPAMD_CRYPTOBOX_MODE_25519)) {
+		return 64;
+	}
+	else {
+		return 32;
+	}
+}
+
+guint rspamd_cryptobox_signature_bytes(enum rspamd_cryptobox_mode mode)
+{
+	static guint ssl_keylen;
+
+	if (G_UNLIKELY(mode == RSPAMD_CRYPTOBOX_MODE_25519)) {
+		return 64;
+	}
+	else {
+#ifndef HAVE_USABLE_OPENSSL
+		g_assert(0);
+#else
+		if (ssl_keylen == 0) {
+			EC_KEY *lk;
+			lk = EC_KEY_new_by_curve_name(CRYPTOBOX_CURVE_NID);
+			ssl_keylen = ECDSA_size(lk);
+			EC_KEY_free(lk);
+		}
+#endif
+		return ssl_keylen;
+	}
+}
+
+guint rspamd_cryptobox_nm_bytes(enum rspamd_cryptobox_mode mode)
+{
+	return 32;
+}
+
+guint rspamd_cryptobox_mac_bytes(enum rspamd_cryptobox_mode mode)
+{
+	return 16;
+}
+
+void rspamd_cryptobox_hash_init(rspamd_cryptobox_hash_state_t *p, const guchar *key, gsize keylen)
+{
+	crypto_generichash_blake2b_state *st = cryptobox_align_ptr(p,
+															   RSPAMD_ALIGNOF(crypto_generichash_blake2b_state));
+	crypto_generichash_blake2b_init(st, key, keylen,
+									crypto_generichash_blake2b_BYTES_MAX);
+}
+
+/**
+ * Update hash with data portion
+ */
+void rspamd_cryptobox_hash_update(rspamd_cryptobox_hash_state_t *p, const guchar *data, gsize len)
+{
+	crypto_generichash_blake2b_state *st = cryptobox_align_ptr(p,
+															   RSPAMD_ALIGNOF(crypto_generichash_blake2b_state));
+	crypto_generichash_blake2b_update(st, data, len);
+}
+
+/**
+ * Output hash to the buffer of rspamd_cryptobox_HASHBYTES length
+ */
+void rspamd_cryptobox_hash_final(rspamd_cryptobox_hash_state_t *p, guchar *out)
+{
+	crypto_generichash_blake2b_state *st = cryptobox_align_ptr(p,
+															   RSPAMD_ALIGNOF(crypto_generichash_blake2b_state));
+	crypto_generichash_blake2b_final(st, out, crypto_generichash_blake2b_BYTES_MAX);
+}
+
+/**
+ * One in all function
+ */
+void rspamd_cryptobox_hash(guchar *out,
+						   const guchar *data,
+						   gsize len,
+						   const guchar *key,
+						   gsize keylen)
+{
+	crypto_generichash_blake2b(out, crypto_generichash_blake2b_BYTES_MAX,
+							   data, len, key, keylen);
+}
+
+G_STATIC_ASSERT(sizeof(t1ha_context_t) <=
+				sizeof(((rspamd_cryptobox_fast_hash_state_t *) NULL)->opaque));
+G_STATIC_ASSERT(sizeof(struct XXH3_state_s) <=
+				sizeof(((rspamd_cryptobox_fast_hash_state_t *) NULL)->opaque));
+
+
+struct RSPAMD_ALIGNED(16) _mum_iuf {
+	union {
+		gint64 ll;
+		unsigned char b[sizeof(guint64)];
+	} buf;
+	gint64 h;
+	unsigned rem;
+};
+
+rspamd_cryptobox_fast_hash_state_t *
+rspamd_cryptobox_fast_hash_new(void)
+{
+	rspamd_cryptobox_fast_hash_state_t *nst;
+	int ret = posix_memalign((void **) &nst, RSPAMD_ALIGNOF(rspamd_cryptobox_fast_hash_state_t),
+							 sizeof(rspamd_cryptobox_fast_hash_state_t));
+
+	if (ret != 0) {
+		abort();
+	}
+
+	return nst;
+}
+
+void rspamd_cryptobox_fast_hash_free(rspamd_cryptobox_fast_hash_state_t *st)
+{
+	free(st);
+}
+
+void rspamd_cryptobox_fast_hash_init(rspamd_cryptobox_fast_hash_state_t *st,
+									 guint64 seed)
+{
+	XXH3_state_t *xst = (XXH3_state_t *) st->opaque;
+	st->type = RSPAMD_CRYPTOBOX_XXHASH3;
+	XXH3_INITSTATE(xst);
+	XXH3_64bits_reset_withSeed(xst, seed);
+}
+
+void rspamd_cryptobox_fast_hash_init_specific(rspamd_cryptobox_fast_hash_state_t *st,
+											  enum rspamd_cryptobox_fast_hash_type type,
+											  guint64 seed)
+{
+	switch (type) {
+	case RSPAMD_CRYPTOBOX_T1HA:
+	case RSPAMD_CRYPTOBOX_HASHFAST:
+	case RSPAMD_CRYPTOBOX_HASHFAST_INDEPENDENT: {
+		t1ha_context_t *rst = (t1ha_context_t *) st->opaque;
+		st->type = RSPAMD_CRYPTOBOX_T1HA;
+		t1ha2_init(rst, seed, 0);
+		break;
+	}
+	case RSPAMD_CRYPTOBOX_XXHASH64: {
+		XXH64_state_t *xst = (XXH64_state_t *) st->opaque;
+		memset(xst, 0, sizeof(*xst));
+		st->type = RSPAMD_CRYPTOBOX_XXHASH64;
+		XXH64_reset(xst, seed);
+		break;
+	}
+	case RSPAMD_CRYPTOBOX_XXHASH32: {
+		XXH32_state_t *xst = (XXH32_state_t *) st->opaque;
+		memset(xst, 0, sizeof(*xst));
+		st->type = RSPAMD_CRYPTOBOX_XXHASH32;
+		XXH32_reset(xst, seed);
+		break;
+	}
+	case RSPAMD_CRYPTOBOX_XXHASH3: {
+		XXH3_state_t *xst = (XXH3_state_t *) st->opaque;
+		XXH3_INITSTATE(xst);
+		st->type = RSPAMD_CRYPTOBOX_XXHASH3;
+		XXH3_64bits_reset_withSeed(xst, seed);
+		break;
+	}
+	case RSPAMD_CRYPTOBOX_MUMHASH: {
+		struct _mum_iuf *iuf = (struct _mum_iuf *) st->opaque;
+		st->type = RSPAMD_CRYPTOBOX_MUMHASH;
+		iuf->h = seed;
+		iuf->buf.ll = 0;
+		iuf->rem = 0;
+		break;
+	}
+	}
+}
+
+void rspamd_cryptobox_fast_hash_update(rspamd_cryptobox_fast_hash_state_t *st,
+									   const void *data, gsize len)
+{
+	if (st->type == RSPAMD_CRYPTOBOX_T1HA) {
+		t1ha_context_t *rst = (t1ha_context_t *) st->opaque;
+		t1ha2_update(rst, data, len);
+	}
+	else {
+		switch (st->type) {
+		case RSPAMD_CRYPTOBOX_XXHASH64: {
+			XXH64_state_t *xst = (XXH64_state_t *) st->opaque;
+			XXH64_update(xst, data, len);
+			break;
+		}
+		case RSPAMD_CRYPTOBOX_XXHASH32: {
+			XXH32_state_t *xst = (XXH32_state_t *) st->opaque;
+			XXH32_update(xst, data, len);
+			break;
+		}
+		case RSPAMD_CRYPTOBOX_XXHASH3: {
+			XXH3_state_t *xst = (XXH3_state_t *) st->opaque;
+			XXH3_64bits_update(xst, data, len);
+			break;
+		}
+		case RSPAMD_CRYPTOBOX_MUMHASH: {
+			struct _mum_iuf *iuf = (struct _mum_iuf *) st->opaque;
+			gsize drem = len;
+			const guchar *p = data;
+
+			if (iuf->rem > 0) {
+				/* Process remainder */
+				if (drem >= iuf->rem) {
+					memcpy(iuf->buf.b + sizeof(iuf->buf.ll) - iuf->rem,
+						   p, iuf->rem);
+					drem -= iuf->rem;
+					p += iuf->rem;
+					iuf->h = mum_hash_step(iuf->h, iuf->buf.ll);
+					iuf->rem = 0;
+				}
+				else {
+					memcpy(iuf->buf.b + sizeof(iuf->buf.ll) - iuf->rem, p, drem);
+					iuf->rem -= drem;
+					drem = 0;
+				}
+			}
+
+			while (drem >= sizeof(iuf->buf.ll)) {
+				memcpy(iuf->buf.b, p, sizeof(iuf->buf.ll));
+				iuf->h = mum_hash_step(iuf->h, iuf->buf.ll);
+				drem -= sizeof(iuf->buf.ll);
+				p += sizeof(iuf->buf.ll);
+			}
+
+			/* Leftover */
+			if (drem > 0) {
+				iuf->rem = sizeof(guint64) - drem;
+				iuf->buf.ll = 0;
+				memcpy(iuf->buf.b, p, drem);
+			}
+			break;
+		}
+		case RSPAMD_CRYPTOBOX_T1HA:
+		case RSPAMD_CRYPTOBOX_HASHFAST:
+		case RSPAMD_CRYPTOBOX_HASHFAST_INDEPENDENT: {
+			t1ha_context_t *rst = (t1ha_context_t *) st->opaque;
+			t1ha2_update(rst, data, len);
+			break;
+		}
+		}
+	}
+}
+
+guint64
+rspamd_cryptobox_fast_hash_final(rspamd_cryptobox_fast_hash_state_t *st)
+{
+	guint64 ret;
+
+	if (st->type == RSPAMD_CRYPTOBOX_T1HA) {
+		t1ha_context_t *rst = (t1ha_context_t *) st->opaque;
+
+		return t1ha2_final(rst, NULL);
+	}
+	else {
+		switch (st->type) {
+		case RSPAMD_CRYPTOBOX_XXHASH64: {
+			XXH64_state_t *xst = (XXH64_state_t *) st->opaque;
+			ret = XXH64_digest(xst);
+			break;
+		}
+		case RSPAMD_CRYPTOBOX_XXHASH32: {
+			XXH32_state_t *xst = (XXH32_state_t *) st->opaque;
+			ret = XXH32_digest(xst);
+			break;
+		}
+		case RSPAMD_CRYPTOBOX_XXHASH3: {
+			XXH3_state_t *xst = (XXH3_state_t *) st->opaque;
+			ret = XXH3_64bits_digest(xst);
+			break;
+		}
+		case RSPAMD_CRYPTOBOX_MUMHASH: {
+			struct _mum_iuf *iuf = (struct _mum_iuf *) st->opaque;
+			iuf->h = mum_hash_step(iuf->h, iuf->buf.ll);
+			ret = mum_hash_finish(iuf->h);
+			break;
+		}
+		case RSPAMD_CRYPTOBOX_T1HA:
+		case RSPAMD_CRYPTOBOX_HASHFAST:
+		case RSPAMD_CRYPTOBOX_HASHFAST_INDEPENDENT: {
+			t1ha_context_t *rst = (t1ha_context_t *) st->opaque;
+
+			ret = t1ha2_final(rst, NULL);
+			break;
+		}
+		}
+	}
+
+	return ret;
+}
+
+/**
+ * One in all function
+ */
+static inline guint64
+rspamd_cryptobox_fast_hash_machdep(const void *data,
+								   gsize len, guint64 seed)
+{
+	return XXH3_64bits_withSeed(data, len, seed);
+}
+
+static inline guint64
+rspamd_cryptobox_fast_hash_indep(const void *data,
+								 gsize len, guint64 seed)
+{
+	return XXH3_64bits_withSeed(data, len, seed);
+}
+
+guint64
+rspamd_cryptobox_fast_hash(const void *data,
+						   gsize len, guint64 seed)
+{
+	return rspamd_cryptobox_fast_hash_machdep(data, len, seed);
+}
+
+guint64
+rspamd_cryptobox_fast_hash_specific(
+	enum rspamd_cryptobox_fast_hash_type type,
+	const void *data,
+	gsize len, guint64 seed)
+{
+	switch (type) {
+	case RSPAMD_CRYPTOBOX_XXHASH32:
+		return XXH32(data, len, seed);
+	case RSPAMD_CRYPTOBOX_XXHASH3:
+		return XXH3_64bits_withSeed(data, len, seed);
+	case RSPAMD_CRYPTOBOX_XXHASH64:
+		return XXH64(data, len, seed);
+	case RSPAMD_CRYPTOBOX_MUMHASH:
+		return mum_hash(data, len, seed);
+	case RSPAMD_CRYPTOBOX_T1HA:
+		return t1ha2_atonce(data, len, seed);
+	case RSPAMD_CRYPTOBOX_HASHFAST_INDEPENDENT:
+		return rspamd_cryptobox_fast_hash_indep(data, len, seed);
+	case RSPAMD_CRYPTOBOX_HASHFAST:
+	default:
+		return rspamd_cryptobox_fast_hash_machdep(data, len, seed);
+	}
+}
diff --git a/src/libcryptobox/cryptobox.h b/src/libcryptobox/cryptobox.h
new file mode 100644
index 0000000..8cd79bb
--- /dev/null
+++ b/src/libcryptobox/cryptobox.h
@@ -0,0 +1,437 @@
+/*-
+ * Copyright 2016 Vsevolod Stakhov
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#ifndef CRYPTOBOX_H_
+#define CRYPTOBOX_H_
+
+#include "config.h"
+
+#include <sodium.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+struct rspamd_cryptobox_segment {
+	guchar *data;
+	gsize len;
+};
+
+#if defined(__GNUC__) &&                                                                                 \
+	((defined(__clang__) && (__clang_major__ >= 4 || (__clang_major__ >= 3 && __clang_minor__ >= 8))) || \
+	 ((__GNUC__ == 4) && (__GNUC_MINOR__ >= 8) || (__GNUC__ > 4)))
+#define RSPAMD_HAS_TARGET_ATTR 1
+#endif
+
+#define rspamd_cryptobox_MAX_NONCEBYTES 24
+#define rspamd_cryptobox_MAX_PKBYTES 65
+#define rspamd_cryptobox_MAX_SKBYTES 32
+#define rspamd_cryptobox_MAX_MACBYTES 16
+#define rspamd_cryptobox_MAX_NMBYTES 32
+#define rspamd_cryptobox_SIPKEYBYTES 16
+#define rspamd_cryptobox_HASHBYTES 64
+#define rspamd_cryptobox_HASHKEYBYTES 64
+#define rspamd_cryptobox_HASHSTATEBYTES sizeof(crypto_generichash_blake2b_state) + 64
+#define rspamd_cryptobox_MAX_SIGSKBYTES 64
+#define rspamd_cryptobox_MAX_SIGPKBYTES 32
+#define rspamd_cryptobox_MAX_SIGBYTES 72
+
+#define CPUID_AVX2 0x1
+#define CPUID_AVX 0x2
+#define CPUID_SSE2 0x4
+#define CPUID_SSE3 0x8
+#define CPUID_SSSE3 0x10
+#define CPUID_SSE41 0x20
+#define CPUID_SSE42 0x40
+#define CPUID_RDRAND 0x80
+
+typedef guchar rspamd_pk_t[rspamd_cryptobox_MAX_PKBYTES];
+typedef guchar rspamd_sk_t[rspamd_cryptobox_MAX_SKBYTES];
+typedef guchar rspamd_mac_t[rspamd_cryptobox_MAX_MACBYTES];
+typedef guchar rspamd_nm_t[rspamd_cryptobox_MAX_NMBYTES];
+typedef guchar rspamd_nonce_t[rspamd_cryptobox_MAX_NONCEBYTES];
+typedef guchar rspamd_sipkey_t[rspamd_cryptobox_SIPKEYBYTES];
+typedef guchar rspamd_signature_t[rspamd_cryptobox_MAX_SIGBYTES];
+typedef guchar rspamd_sig_pk_t[rspamd_cryptobox_MAX_SIGPKBYTES];
+typedef guchar rspamd_sig_sk_t[rspamd_cryptobox_MAX_SIGSKBYTES];
+
+enum rspamd_cryptobox_mode {
+	RSPAMD_CRYPTOBOX_MODE_25519 = 0,
+	RSPAMD_CRYPTOBOX_MODE_NIST
+};
+
+struct rspamd_cryptobox_library_ctx {
+	gchar *cpu_extensions;
+	const gchar *chacha20_impl;
+	const gchar *base64_impl;
+	unsigned long cpu_config;
+};
+
+/**
+ * Init cryptobox library
+ */
+struct rspamd_cryptobox_library_ctx *rspamd_cryptobox_init(void);
+
+void rspamd_cryptobox_deinit(struct rspamd_cryptobox_library_ctx *);
+/**
+ * Generate new keypair
+ * @param pk public key buffer
+ * @param sk secret key buffer
+ */
+void rspamd_cryptobox_keypair(rspamd_pk_t pk, rspamd_sk_t sk,
+							  enum rspamd_cryptobox_mode mode);
+
+/**
+ * Generate new keypair for signing
+ * @param pk public key buffer
+ * @param sk secret key buffer
+ */
+void rspamd_cryptobox_keypair_sig(rspamd_sig_pk_t pk, rspamd_sig_sk_t sk,
+								  enum rspamd_cryptobox_mode mode);
+
+/**
+ * Encrypt data inplace adding signature to sig afterwards
+ * @param data input buffer
+ * @param pk remote pubkey
+ * @param sk local secret key
+ * @param sig output signature
+ */
+void rspamd_cryptobox_encrypt_inplace(guchar *data, gsize len,
+									  const rspamd_nonce_t nonce,
+									  const rspamd_pk_t pk, const rspamd_sk_t sk, rspamd_mac_t sig,
+									  enum rspamd_cryptobox_mode mode);
+
+/**
+ * Encrypt segments of data inplace adding signature to sig afterwards
+ * @param segments segments of data
+ * @param cnt count of segments
+ * @param pk remote pubkey
+ * @param sk local secret key
+ * @param sig output signature
+ */
+void rspamd_cryptobox_encryptv_inplace(struct rspamd_cryptobox_segment *segments,
+									   gsize cnt,
+									   const rspamd_nonce_t nonce,
+									   const rspamd_pk_t pk, const rspamd_sk_t sk, rspamd_mac_t sig,
+									   enum rspamd_cryptobox_mode mode);
+
+
+/**
+ * Decrypt and verify data chunk inplace
+ * @param data data to decrypt
+ * @param len length of data
+ * @param pk remote pubkey
+ * @param sk local privkey
+ * @param sig signature input
+ * @return TRUE if input has been verified successfully
+ */
+gboolean rspamd_cryptobox_decrypt_inplace(guchar *data, gsize len,
+										  const rspamd_nonce_t nonce,
+										  const rspamd_pk_t pk, const rspamd_sk_t sk, const rspamd_mac_t sig,
+										  enum rspamd_cryptobox_mode mode);
+
+/**
+ * Encrypt segments of data inplace adding signature to sig afterwards
+ * @param segments segments of data
+ * @param cnt count of segments
+ * @param pk remote pubkey
+ * @param sk local secret key
+ * @param sig output signature
+ */
+void rspamd_cryptobox_encrypt_nm_inplace(guchar *data, gsize len,
+										 const rspamd_nonce_t nonce,
+										 const rspamd_nm_t nm, rspamd_mac_t sig,
+										 enum rspamd_cryptobox_mode mode);
+
+/**
+ * Encrypt segments of data inplace adding signature to sig afterwards
+ * @param segments segments of data
+ * @param cnt count of segments
+ * @param pk remote pubkey
+ * @param sk local secret key
+ * @param sig output signature
+ */
+void rspamd_cryptobox_encryptv_nm_inplace(struct rspamd_cryptobox_segment *segments,
+										  gsize cnt,
+										  const rspamd_nonce_t nonce,
+										  const rspamd_nm_t nm, rspamd_mac_t sig,
+										  enum rspamd_cryptobox_mode mode);
+
+
+/**
+ * Decrypt and verify data chunk inplace
+ * @param data data to decrypt
+ * @param len length of data
+ * @param pk remote pubkey
+ * @param sk local privkey
+ * @param sig signature input
+ * @return TRUE if input has been verified successfully
+ */
+gboolean rspamd_cryptobox_decrypt_nm_inplace(guchar *data, gsize len,
+											 const rspamd_nonce_t nonce,
+											 const rspamd_nm_t nm, const rspamd_mac_t sig,
+											 enum rspamd_cryptobox_mode mode);
+
+/**
+ * Generate shared secret from local sk and remote pk
+ * @param nm shared secret
+ * @param pk remote pubkey
+ * @param sk local privkey
+ */
+void rspamd_cryptobox_nm(rspamd_nm_t nm, const rspamd_pk_t pk,
+						 const rspamd_sk_t sk, enum rspamd_cryptobox_mode mode);
+
+/**
+ * Create digital signature for the specified message and place result in `sig`
+ * @param sig signature target
+ * @param siglen_p pointer to signature length (might be NULL)
+ * @param m input message
+ * @param mlen input length
+ * @param sk secret key
+ */
+void rspamd_cryptobox_sign(guchar *sig, unsigned long long *siglen_p,
+						   const guchar *m, gsize mlen,
+						   const rspamd_sk_t sk,
+						   enum rspamd_cryptobox_mode mode);
+
+/**
+ * Verifies digital signature for the specified message using the specified
+ * pubkey
+ * @param sig signature source
+ * @param m input message
+ * @param mlen message length
+ * @param pk public key for verification
+ * @return true if signature is valid, false otherwise
+ */
+bool rspamd_cryptobox_verify(const guchar *sig,
+							 gsize siglen,
+							 const guchar *m,
+							 gsize mlen,
+							 const rspamd_pk_t pk,
+							 enum rspamd_cryptobox_mode mode);
+
+/**
+ * Securely clear the buffer specified
+ * @param buf buffer to zero
+ * @param buflen length of buffer
+ */
+
+#define rspamd_explicit_memzero sodium_memzero
+
+/**
+ * Constant time memcmp
+ * @param b1_
+ * @param b2_
+ * @param len
+ * @return
+ */
+#define rspamd_cryptobox_memcmp sodium_memcmp
+
+/**
+ * Calculates siphash-2-4 for a message
+ * @param out (8 bytes output)
+ * @param in
+ * @param inlen
+ * @param k key (must be 16 bytes)
+ */
+void rspamd_cryptobox_siphash(unsigned char *out, const unsigned char *in,
+							  unsigned long long inlen,
+							  const rspamd_sipkey_t k);
+
+enum rspamd_cryptobox_pbkdf_type {
+	RSPAMD_CRYPTOBOX_PBKDF2 = 0,
+	RSPAMD_CRYPTOBOX_CATENA
+};
+
+
+/**
+ * Derive key from password using the specified algorithm
+ * @param pass input password
+ * @param pass_len length of the password
+ * @param salt input salt
+ * @param salt_len length of salt
+ * @param key output key
+ * @param key_len size of the key
+ * @param complexity empiric number of complexity (rounds for pbkdf2 and garlic for catena)
+ * @return TRUE in case of success and FALSE if failed
+ */
+gboolean rspamd_cryptobox_pbkdf(const char *pass, gsize pass_len,
+								const guint8 *salt, gsize salt_len,
+								guint8 *key, gsize key_len,
+								unsigned int complexity,
+								enum rspamd_cryptobox_pbkdf_type type);
+
+
+/**
+ * Real size of rspamd cryptobox public key
+ */
+guint rspamd_cryptobox_pk_bytes(enum rspamd_cryptobox_mode mode);
+
+/**
+ * Real size of rspamd cryptobox signing public key
+ */
+guint rspamd_cryptobox_pk_sig_bytes(enum rspamd_cryptobox_mode mode);
+
+/**
+ * Real size of crypto nonce
+ */
+guint rspamd_cryptobox_nonce_bytes(enum rspamd_cryptobox_mode mode);
+
+/**
+ * Real size of rspamd cryptobox secret key
+ */
+guint rspamd_cryptobox_sk_bytes(enum rspamd_cryptobox_mode mode);
+
+/**
+ * Real size of rspamd cryptobox signing secret key
+ */
+guint rspamd_cryptobox_sk_sig_bytes(enum rspamd_cryptobox_mode mode);
+
+/**
+ * Real size of rspamd cryptobox shared key
+ */
+guint rspamd_cryptobox_nm_bytes(enum rspamd_cryptobox_mode mode);
+
+/**
+ * Real size of rspamd cryptobox MAC signature
+ */
+guint rspamd_cryptobox_mac_bytes(enum rspamd_cryptobox_mode mode);
+
+/**
+ * Real size of rspamd cryptobox digital signature
+ */
+guint rspamd_cryptobox_signature_bytes(enum rspamd_cryptobox_mode mode);
+
+/* Hash IUF interface */
+typedef crypto_generichash_blake2b_state rspamd_cryptobox_hash_state_t;
+
+/**
+ * Init cryptobox hash state using key if needed, `st` must point to the buffer
+ * with at least rspamd_cryptobox_HASHSTATEBYTES bytes length. If keylen == 0, then
+ * non-keyed hash is generated
+ */
+void rspamd_cryptobox_hash_init(rspamd_cryptobox_hash_state_t *st,
+								const guchar *key, gsize keylen);
+
+/**
+ * Update hash with data portion
+ */
+void rspamd_cryptobox_hash_update(rspamd_cryptobox_hash_state_t *st,
+								  const guchar *data, gsize len);
+
+/**
+ * Output hash to the buffer of rspamd_cryptobox_HASHBYTES length
+ */
+void rspamd_cryptobox_hash_final(rspamd_cryptobox_hash_state_t *st, guchar *out);
+
+/**
+ * One in all function
+ */
+void rspamd_cryptobox_hash(guchar *out,
+						   const guchar *data,
+						   gsize len,
+						   const guchar *key,
+						   gsize keylen);
+
+enum rspamd_cryptobox_fast_hash_type {
+	RSPAMD_CRYPTOBOX_XXHASH64 = 0,
+	RSPAMD_CRYPTOBOX_XXHASH32,
+	RSPAMD_CRYPTOBOX_XXHASH3,
+	RSPAMD_CRYPTOBOX_MUMHASH,
+	RSPAMD_CRYPTOBOX_T1HA,
+	RSPAMD_CRYPTOBOX_HASHFAST,
+	RSPAMD_CRYPTOBOX_HASHFAST_INDEPENDENT
+};
+
+/* Non crypto hash IUF interface */
+typedef struct CRYPTO_ALIGN(64) rspamd_cryptobox_fast_hash_state_s {
+	guchar opaque[576]; /* Required for xxhash3 */
+	enum rspamd_cryptobox_fast_hash_type type;
+} rspamd_cryptobox_fast_hash_state_t;
+
+
+/**
+ * Creates a new cryptobox state properly aligned
+ * @return
+ */
+rspamd_cryptobox_fast_hash_state_t *rspamd_cryptobox_fast_hash_new(void);
+void rspamd_cryptobox_fast_hash_free(rspamd_cryptobox_fast_hash_state_t *st);
+
+/**
+ * Init cryptobox hash state using key if needed, `st` must point to the buffer
+ * with at least rspamd_cryptobox_HASHSTATEBYTES bytes length. If keylen == 0, then
+ * non-keyed hash is generated
+ */
+void rspamd_cryptobox_fast_hash_init(rspamd_cryptobox_fast_hash_state_t *st,
+									 guint64 seed);
+
+/**
+ * Init cryptobox hash state using key if needed, `st` must point to the buffer
+ * with at least rspamd_cryptobox_HASHSTATEBYTES bytes length. If keylen == 0, then
+ * non-keyed hash is generated
+ */
+void rspamd_cryptobox_fast_hash_init_specific(rspamd_cryptobox_fast_hash_state_t *st,
+											  enum rspamd_cryptobox_fast_hash_type type,
+											  guint64 seed);
+
+/**
+ * Update hash with data portion
+ */
+void rspamd_cryptobox_fast_hash_update(rspamd_cryptobox_fast_hash_state_t *st,
+									   const void *data, gsize len);
+
+/**
+ * Output hash to the buffer of rspamd_cryptobox_HASHBYTES length
+ */
+guint64 rspamd_cryptobox_fast_hash_final(rspamd_cryptobox_fast_hash_state_t *st);
+
+/**
+ * One in all function
+ */
+guint64 rspamd_cryptobox_fast_hash(const void *data,
+								   gsize len, guint64 seed);
+
+/**
+ * Platform independent version
+ */
+guint64 rspamd_cryptobox_fast_hash_specific(
+	enum rspamd_cryptobox_fast_hash_type type,
+	const void *data,
+	gsize len, guint64 seed);
+
+/**
+ * Decode base64 using platform optimized code
+ * @param in
+ * @param inlen
+ * @param out
+ * @param outlen
+ * @return
+ */
+gboolean rspamd_cryptobox_base64_decode(const gchar *in, gsize inlen,
+										guchar *out, gsize *outlen);
+
+/**
+ * Returns TRUE if data looks like a valid base64 string
+ * @param in
+ * @param inlen
+ * @return
+ */
+gboolean rspamd_cryptobox_base64_is_valid(const gchar *in, gsize inlen);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* CRYPTOBOX_H_ */
diff --git a/src/libcryptobox/keypair.c b/src/libcryptobox/keypair.c
new file mode 100644
index 0000000..ec7490a
--- /dev/null
+++ b/src/libcryptobox/keypair.c
@@ -0,0 +1,1021 @@
+/*-
+ * Copyright 2016 Vsevolod Stakhov
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "config.h"
+#include "libcryptobox/keypair.h"
+#include "libcryptobox/keypair_private.h"
+#include "libutil/str_util.h"
+#include "libutil/printf.h"
+#include "contrib/libottery/ottery.h"
+
+const guchar encrypted_magic[7] = {'r', 'u', 'c', 'l', 'e', 'v', '1'};
+
+static GQuark
+rspamd_keypair_quark(void)
+{
+	return g_quark_from_static_string("rspamd-cryptobox-keypair");
+}
+
+/**
+ * Returns specific private key for different keypair types
+ */
+static void *
+rspamd_cryptobox_keypair_sk(struct rspamd_cryptobox_keypair *kp,
+							guint *len)
+{
+	g_assert(kp != NULL);
+
+	if (kp->alg == RSPAMD_CRYPTOBOX_MODE_25519) {
+		if (kp->type == RSPAMD_KEYPAIR_KEX) {
+			*len = 32;
+			return RSPAMD_CRYPTOBOX_KEYPAIR_25519(kp)->sk;
+		}
+		else {
+			*len = 64;
+			return RSPAMD_CRYPTOBOX_KEYPAIR_SIG_25519(kp)->sk;
+		}
+	}
+	else {
+		if (kp->type == RSPAMD_KEYPAIR_KEX) {
+			*len = 32;
+			return RSPAMD_CRYPTOBOX_KEYPAIR_NIST(kp)->sk;
+		}
+		else {
+			*len = 32;
+			return RSPAMD_CRYPTOBOX_KEYPAIR_SIG_NIST(kp)->sk;
+		}
+	}
+
+	/* Not reached */
+	return NULL;
+}
+
+static void *
+rspamd_cryptobox_keypair_pk(struct rspamd_cryptobox_keypair *kp,
+							guint *len)
+{
+	g_assert(kp != NULL);
+
+	if (kp->alg == RSPAMD_CRYPTOBOX_MODE_25519) {
+		if (kp->type == RSPAMD_KEYPAIR_KEX) {
+			*len = 32;
+			return RSPAMD_CRYPTOBOX_KEYPAIR_25519(kp)->pk;
+		}
+		else {
+			*len = 32;
+			return RSPAMD_CRYPTOBOX_KEYPAIR_SIG_25519(kp)->pk;
+		}
+	}
+	else {
+		if (kp->type == RSPAMD_KEYPAIR_KEX) {
+			*len = 65;
+			return RSPAMD_CRYPTOBOX_KEYPAIR_NIST(kp)->pk;
+		}
+		else {
+			*len = 65;
+			return RSPAMD_CRYPTOBOX_KEYPAIR_SIG_NIST(kp)->pk;
+		}
+	}
+
+	/* Not reached */
+	return NULL;
+}
+
+static void *
+rspamd_cryptobox_pubkey_pk(const struct rspamd_cryptobox_pubkey *kp,
+						   guint *len)
+{
+	g_assert(kp != NULL);
+
+	if (kp->alg == RSPAMD_CRYPTOBOX_MODE_25519) {
+		if (kp->type == RSPAMD_KEYPAIR_KEX) {
+			*len = 32;
+			return RSPAMD_CRYPTOBOX_PUBKEY_25519(kp)->pk;
+		}
+		else {
+			*len = 32;
+			return RSPAMD_CRYPTOBOX_PUBKEY_SIG_25519(kp)->pk;
+		}
+	}
+	else {
+		if (kp->type == RSPAMD_KEYPAIR_KEX) {
+			*len = 65;
+			return RSPAMD_CRYPTOBOX_PUBKEY_NIST(kp)->pk;
+		}
+		else {
+			*len = 65;
+			return RSPAMD_CRYPTOBOX_PUBKEY_SIG_NIST(kp)->pk;
+		}
+	}
+
+	/* Not reached */
+	return NULL;
+}
+
+static struct rspamd_cryptobox_keypair *
+rspamd_cryptobox_keypair_alloc(enum rspamd_cryptobox_keypair_type type,
+							   enum rspamd_cryptobox_mode alg)
+{
+	struct rspamd_cryptobox_keypair *kp;
+	guint size = 0;
+
+	if (alg == RSPAMD_CRYPTOBOX_MODE_25519) {
+		if (type == RSPAMD_KEYPAIR_KEX) {
+			size = sizeof(struct rspamd_cryptobox_keypair_25519);
+		}
+		else {
+			size = sizeof(struct rspamd_cryptobox_keypair_sig_25519);
+		}
+	}
+	else {
+		if (type == RSPAMD_KEYPAIR_KEX) {
+			size = sizeof(struct rspamd_cryptobox_keypair_nist);
+		}
+		else {
+			size = sizeof(struct rspamd_cryptobox_keypair_sig_nist);
+		}
+	}
+
+	g_assert(size >= sizeof(*kp));
+
+	if (posix_memalign((void **) &kp, 32, size) != 0) {
+		abort();
+	}
+
+	memset(kp, 0, size);
+
+	return kp;
+}
+
+static struct rspamd_cryptobox_pubkey *
+rspamd_cryptobox_pubkey_alloc(enum rspamd_cryptobox_keypair_type type,
+							  enum rspamd_cryptobox_mode alg)
+{
+	struct rspamd_cryptobox_pubkey *pk;
+	guint size = 0;
+
+	if (alg == RSPAMD_CRYPTOBOX_MODE_25519) {
+		if (type == RSPAMD_KEYPAIR_KEX) {
+			size = sizeof(struct rspamd_cryptobox_pubkey_25519);
+		}
+		else {
+			size = sizeof(struct rspamd_cryptobox_pubkey_sig_25519);
+		}
+	}
+	else {
+		if (type == RSPAMD_KEYPAIR_KEX) {
+			size = sizeof(struct rspamd_cryptobox_pubkey_nist);
+		}
+		else {
+			size = sizeof(struct rspamd_cryptobox_pubkey_sig_nist);
+		}
+	}
+
+	g_assert(size >= sizeof(*pk));
+
+	if (posix_memalign((void **) &pk, 32, size) != 0) {
+		abort();
+	}
+
+	memset(pk, 0, size);
+
+	return pk;
+}
+
+
+void rspamd_cryptobox_nm_dtor(struct rspamd_cryptobox_nm *nm)
+{
+	rspamd_explicit_memzero(nm->nm, sizeof(nm->nm));
+	free(nm);
+}
+
+void rspamd_cryptobox_keypair_dtor(struct rspamd_cryptobox_keypair *kp)
+{
+	void *sk;
+	guint len = 0;
+
+	sk = rspamd_cryptobox_keypair_sk(kp, &len);
+	g_assert(sk != NULL && len > 0);
+	rspamd_explicit_memzero(sk, len);
+
+	if (kp->extensions) {
+		ucl_object_unref(kp->extensions);
+	}
+
+	/* Not g_free as kp is aligned using posix_memalign */
+	free(kp);
+}
+
+void rspamd_cryptobox_pubkey_dtor(struct rspamd_cryptobox_pubkey *p)
+{
+	if (p->nm) {
+		REF_RELEASE(p->nm);
+	}
+
+	/* Not g_free as p is aligned using posix_memalign */
+	free(p);
+}
+
+struct rspamd_cryptobox_keypair *
+rspamd_keypair_new(enum rspamd_cryptobox_keypair_type type,
+				   enum rspamd_cryptobox_mode alg)
+{
+	struct rspamd_cryptobox_keypair *kp;
+	void *pk, *sk;
+	guint size;
+
+	kp = rspamd_cryptobox_keypair_alloc(type, alg);
+	kp->alg = alg;
+	kp->type = type;
+
+	sk = rspamd_cryptobox_keypair_sk(kp, &size);
+	pk = rspamd_cryptobox_keypair_pk(kp, &size);
+
+	if (type == RSPAMD_KEYPAIR_KEX) {
+		rspamd_cryptobox_keypair(pk, sk, alg);
+	}
+	else {
+		rspamd_cryptobox_keypair_sig(pk, sk, alg);
+	}
+
+	rspamd_cryptobox_hash(kp->id, pk, size, NULL, 0);
+
+	REF_INIT_RETAIN(kp, rspamd_cryptobox_keypair_dtor);
+
+	return kp;
+}
+
+
+struct rspamd_cryptobox_keypair *
+rspamd_keypair_ref(struct rspamd_cryptobox_keypair *kp)
+{
+	REF_RETAIN(kp);
+	return kp;
+}
+
+
+void rspamd_keypair_unref(struct rspamd_cryptobox_keypair *kp)
+{
+	REF_RELEASE(kp);
+}
+
+
+struct rspamd_cryptobox_pubkey *
+rspamd_pubkey_ref(struct rspamd_cryptobox_pubkey *kp)
+{
+	REF_RETAIN(kp);
+	return kp;
+}
+
+void rspamd_pubkey_unref(struct rspamd_cryptobox_pubkey *kp)
+{
+	REF_RELEASE(kp);
+}
+
+enum rspamd_cryptobox_keypair_type
+rspamd_keypair_type(struct rspamd_cryptobox_keypair *kp)
+{
+	g_assert(kp != NULL);
+
+	return kp->type;
+}
+
+enum rspamd_cryptobox_keypair_type
+rspamd_pubkey_type(struct rspamd_cryptobox_pubkey *p)
+{
+	g_assert(p != NULL);
+
+	return p->type;
+}
+
+
+enum rspamd_cryptobox_mode
+rspamd_keypair_alg(struct rspamd_cryptobox_keypair *kp)
+{
+	g_assert(kp != NULL);
+
+	return kp->alg;
+}
+
+enum rspamd_cryptobox_mode
+rspamd_pubkey_alg(struct rspamd_cryptobox_pubkey *p)
+{
+	g_assert(p != NULL);
+
+	return p->alg;
+}
+
+struct rspamd_cryptobox_pubkey *
+rspamd_pubkey_from_base32(const gchar *b32,
+						  gsize len,
+						  enum rspamd_cryptobox_keypair_type type,
+						  enum rspamd_cryptobox_mode alg)
+{
+	guchar *decoded;
+	gsize dlen, expected_len;
+	guint pklen;
+	struct rspamd_cryptobox_pubkey *pk;
+	guchar *pk_data;
+
+	g_assert(b32 != NULL);
+
+	if (len == 0) {
+		len = strlen(b32);
+	}
+
+	decoded = rspamd_decode_base32(b32, len, &dlen, RSPAMD_BASE32_DEFAULT);
+
+	if (decoded == NULL) {
+		return NULL;
+	}
+
+	expected_len = (type == RSPAMD_KEYPAIR_KEX) ? rspamd_cryptobox_pk_bytes(alg) : rspamd_cryptobox_pk_sig_bytes(alg);
+
+	if (dlen != expected_len) {
+		g_free(decoded);
+		return NULL;
+	}
+
+	pk = rspamd_cryptobox_pubkey_alloc(type, alg);
+	REF_INIT_RETAIN(pk, rspamd_cryptobox_pubkey_dtor);
+	pk->alg = alg;
+	pk->type = type;
+	pk_data = rspamd_cryptobox_pubkey_pk(pk, &pklen);
+
+	memcpy(pk_data, decoded, pklen);
+	g_free(decoded);
+	rspamd_cryptobox_hash(pk->id, pk_data, pklen, NULL, 0);
+
+	return pk;
+}
+
+struct rspamd_cryptobox_pubkey *
+rspamd_pubkey_from_hex(const gchar *hex,
+					   gsize len,
+					   enum rspamd_cryptobox_keypair_type type,
+					   enum rspamd_cryptobox_mode alg)
+{
+	guchar *decoded;
+	gsize dlen, expected_len;
+	guint pklen;
+	struct rspamd_cryptobox_pubkey *pk;
+	guchar *pk_data;
+
+	g_assert(hex != NULL);
+
+	if (len == 0) {
+		len = strlen(hex);
+	}
+
+	dlen = len / 2;
+
+	decoded = rspamd_decode_hex(hex, len);
+
+	if (decoded == NULL) {
+		return NULL;
+	}
+
+	expected_len = (type == RSPAMD_KEYPAIR_KEX) ? rspamd_cryptobox_pk_bytes(alg) : rspamd_cryptobox_pk_sig_bytes(alg);
+
+	if (dlen != expected_len) {
+		g_free(decoded);
+		return NULL;
+	}
+
+	pk = rspamd_cryptobox_pubkey_alloc(type, alg);
+	REF_INIT_RETAIN(pk, rspamd_cryptobox_pubkey_dtor);
+	pk->alg = alg;
+	pk->type = type;
+	pk_data = rspamd_cryptobox_pubkey_pk(pk, &pklen);
+
+	memcpy(pk_data, decoded, pklen);
+	g_free(decoded);
+	rspamd_cryptobox_hash(pk->id, pk_data, pklen, NULL, 0);
+
+	return pk;
+}
+
+struct rspamd_cryptobox_pubkey *
+rspamd_pubkey_from_bin(const guchar *raw,
+					   gsize len,
+					   enum rspamd_cryptobox_keypair_type type,
+					   enum rspamd_cryptobox_mode alg)
+{
+	gsize expected_len;
+	guint pklen;
+	struct rspamd_cryptobox_pubkey *pk;
+	guchar *pk_data;
+
+	g_assert(raw != NULL && len > 0);
+
+	expected_len = (type == RSPAMD_KEYPAIR_KEX) ? rspamd_cryptobox_pk_bytes(alg) : rspamd_cryptobox_pk_sig_bytes(alg);
+
+	if (len != expected_len) {
+		return NULL;
+	}
+
+	pk = rspamd_cryptobox_pubkey_alloc(type, alg);
+	REF_INIT_RETAIN(pk, rspamd_cryptobox_pubkey_dtor);
+	pk->alg = alg;
+	pk->type = type;
+	pk_data = rspamd_cryptobox_pubkey_pk(pk, &pklen);
+
+	memcpy(pk_data, raw, pklen);
+	rspamd_cryptobox_hash(pk->id, pk_data, pklen, NULL, 0);
+
+	return pk;
+}
+
+
+const guchar *
+rspamd_pubkey_get_nm(struct rspamd_cryptobox_pubkey *p,
+					 struct rspamd_cryptobox_keypair *kp)
+{
+	g_assert(p != NULL);
+
+	if (p->nm) {
+		if (memcmp(kp->id, (const guchar *) &p->nm->sk_id, sizeof(guint64)) == 0) {
+			return p->nm->nm;
+		}
+
+		/* Wrong ID, need to recalculate */
+		REF_RELEASE(p->nm);
+		p->nm = NULL;
+	}
+
+	return NULL;
+}
+
+const guchar *
+rspamd_pubkey_calculate_nm(struct rspamd_cryptobox_pubkey *p,
+						   struct rspamd_cryptobox_keypair *kp)
+{
+	g_assert(kp->alg == p->alg);
+	g_assert(kp->type == p->type);
+	g_assert(p->type == RSPAMD_KEYPAIR_KEX);
+
+	if (p->nm == NULL) {
+		if (posix_memalign((void **) &p->nm, 32, sizeof(*p->nm)) != 0) {
+			abort();
+		}
+
+		memcpy(&p->nm->sk_id, kp->id, sizeof(guint64));
+		REF_INIT_RETAIN(p->nm, rspamd_cryptobox_nm_dtor);
+	}
+
+	if (kp->alg == RSPAMD_CRYPTOBOX_MODE_25519) {
+		struct rspamd_cryptobox_pubkey_25519 *rk_25519 =
+			RSPAMD_CRYPTOBOX_PUBKEY_25519(p);
+		struct rspamd_cryptobox_keypair_25519 *sk_25519 =
+			RSPAMD_CRYPTOBOX_KEYPAIR_25519(kp);
+
+		rspamd_cryptobox_nm(p->nm->nm, rk_25519->pk, sk_25519->sk, p->alg);
+	}
+	else {
+		struct rspamd_cryptobox_pubkey_nist *rk_nist =
+			RSPAMD_CRYPTOBOX_PUBKEY_NIST(p);
+		struct rspamd_cryptobox_keypair_nist *sk_nist =
+			RSPAMD_CRYPTOBOX_KEYPAIR_NIST(kp);
+
+		rspamd_cryptobox_nm(p->nm->nm, rk_nist->pk, sk_nist->sk, p->alg);
+	}
+
+	return p->nm->nm;
+}
+
+const guchar *
+rspamd_keypair_get_id(struct rspamd_cryptobox_keypair *kp)
+{
+	g_assert(kp != NULL);
+
+	return kp->id;
+}
+
+const ucl_object_t *
+rspamd_keypair_get_extensions(struct rspamd_cryptobox_keypair *kp)
+{
+	g_assert(kp != NULL);
+
+	return kp->extensions;
+}
+
+const guchar *
+rspamd_pubkey_get_id(struct rspamd_cryptobox_pubkey *pk)
+{
+	g_assert(pk != NULL);
+
+	return pk->id;
+}
+
+const guchar *
+rspamd_pubkey_get_pk(struct rspamd_cryptobox_pubkey *pk,
+					 guint *len)
+{
+	guchar *ret = NULL;
+	guint rlen;
+
+	ret = rspamd_cryptobox_pubkey_pk(pk, &rlen);
+
+	if (len) {
+		*len = rlen;
+	}
+
+	return ret;
+}
+
+static void
+rspamd_keypair_print_component(guchar *data, gsize datalen,
+							   GString *res, guint how, const gchar *description)
+{
+	gint olen, b32_len;
+
+	if (how & RSPAMD_KEYPAIR_HUMAN) {
+		rspamd_printf_gstring(res, "%s: ", description);
+	}
+
+	if (how & RSPAMD_KEYPAIR_BASE32) {
+		b32_len = (datalen * 8 / 5) + 2;
+		g_string_set_size(res, res->len + b32_len);
+		res->len -= b32_len;
+		olen = rspamd_encode_base32_buf(data, datalen, res->str + res->len,
+										res->len + b32_len - 1, RSPAMD_BASE32_DEFAULT);
+
+		if (olen > 0) {
+			res->len += olen;
+			res->str[res->len] = '\0';
+		}
+	}
+	else if (how & RSPAMD_KEYPAIR_HEX) {
+		rspamd_printf_gstring(res, "%*xs", (gint) datalen, data);
+	}
+	else {
+		g_string_append_len(res, data, datalen);
+	}
+
+	if (how & RSPAMD_KEYPAIR_HUMAN) {
+		g_string_append_c(res, '\n');
+	}
+}
+
+GString *
+rspamd_keypair_print(struct rspamd_cryptobox_keypair *kp, guint how)
+{
+	GString *res;
+	guint len;
+	gpointer p;
+
+	g_assert(kp != NULL);
+
+	res = g_string_sized_new(63);
+
+	if ((how & RSPAMD_KEYPAIR_PUBKEY)) {
+		p = rspamd_cryptobox_keypair_pk(kp, &len);
+		rspamd_keypair_print_component(p, len, res, how, "Public key");
+	}
+	if ((how & RSPAMD_KEYPAIR_PRIVKEY)) {
+		p = rspamd_cryptobox_keypair_sk(kp, &len);
+		rspamd_keypair_print_component(p, len, res, how, "Private key");
+	}
+	if ((how & RSPAMD_KEYPAIR_ID_SHORT)) {
+		rspamd_keypair_print_component(kp->id, RSPAMD_KEYPAIR_SHORT_ID_LEN,
+									   res, how, "Short key ID");
+	}
+	if ((how & RSPAMD_KEYPAIR_ID)) {
+		rspamd_keypair_print_component(kp->id, sizeof(kp->id), res, how, "Key ID");
+	}
+
+	return res;
+}
+
+GString *
+rspamd_pubkey_print(struct rspamd_cryptobox_pubkey *pk, guint how)
+{
+	GString *res;
+	guint len;
+	gpointer p;
+
+	g_assert(pk != NULL);
+
+	res = g_string_sized_new(63);
+
+	if ((how & RSPAMD_KEYPAIR_PUBKEY)) {
+		p = rspamd_cryptobox_pubkey_pk(pk, &len);
+		rspamd_keypair_print_component(p, len, res, how, "Public key");
+	}
+	if ((how & RSPAMD_KEYPAIR_ID_SHORT)) {
+		rspamd_keypair_print_component(pk->id, RSPAMD_KEYPAIR_SHORT_ID_LEN,
+									   res, how, "Short key ID");
+	}
+	if ((how & RSPAMD_KEYPAIR_ID)) {
+		rspamd_keypair_print_component(pk->id, sizeof(pk->id), res, how,
+									   "Key ID");
+	}
+
+	return res;
+}
+
+const guchar *
+rspamd_keypair_component(struct rspamd_cryptobox_keypair *kp,
+						 guint ncomp, guint *len)
+{
+	guint rlen = 0;
+	const guchar *ret = NULL;
+
+	g_assert(kp != NULL);
+
+	switch (ncomp) {
+	case RSPAMD_KEYPAIR_COMPONENT_ID:
+		rlen = sizeof(kp->id);
+		ret = kp->id;
+		break;
+	case RSPAMD_KEYPAIR_COMPONENT_PK:
+		ret = rspamd_cryptobox_keypair_pk(kp, &rlen);
+		break;
+	case RSPAMD_KEYPAIR_COMPONENT_SK:
+		ret = rspamd_cryptobox_keypair_sk(kp, &rlen);
+		break;
+	}
+
+	if (len) {
+		*len = rlen;
+	}
+
+	return ret;
+}
+
+struct rspamd_cryptobox_keypair *
+rspamd_keypair_from_ucl(const ucl_object_t *obj)
+{
+	const ucl_object_t *privkey, *pubkey, *elt;
+	const gchar *str;
+	enum rspamd_cryptobox_keypair_type type = RSPAMD_KEYPAIR_KEX;
+	enum rspamd_cryptobox_mode mode = RSPAMD_CRYPTOBOX_MODE_25519;
+	gboolean is_hex = FALSE;
+	struct rspamd_cryptobox_keypair *kp;
+	guint len;
+	gsize ucl_len;
+	gint dec_len;
+	gpointer target;
+
+	if (ucl_object_type(obj) != UCL_OBJECT) {
+		return NULL;
+	}
+
+	elt = ucl_object_lookup(obj, "keypair");
+	if (elt != NULL) {
+		obj = elt;
+	}
+
+	pubkey = ucl_object_lookup_any(obj, "pubkey", "public", "public_key",
+								   NULL);
+	if (pubkey == NULL || ucl_object_type(pubkey) != UCL_STRING) {
+		return NULL;
+	}
+
+	privkey = ucl_object_lookup_any(obj, "privkey", "private", "private_key",
+									"secret", "secret_key", NULL);
+	if (privkey == NULL || ucl_object_type(privkey) != UCL_STRING) {
+		return NULL;
+	}
+
+	/* Optional fields */
+	elt = ucl_object_lookup(obj, "type");
+	if (elt && ucl_object_type(elt) == UCL_STRING) {
+		str = ucl_object_tostring(elt);
+
+		if (g_ascii_strcasecmp(str, "kex") == 0) {
+			type = RSPAMD_KEYPAIR_KEX;
+		}
+		else if (g_ascii_strcasecmp(str, "sign") == 0) {
+			type = RSPAMD_KEYPAIR_SIGN;
+		}
+		/* TODO: handle errors */
+	}
+
+	elt = ucl_object_lookup(obj, "algorithm");
+	if (elt && ucl_object_type(elt) == UCL_STRING) {
+		str = ucl_object_tostring(elt);
+
+		if (g_ascii_strcasecmp(str, "curve25519") == 0) {
+			mode = RSPAMD_CRYPTOBOX_MODE_25519;
+		}
+		else if (g_ascii_strcasecmp(str, "nistp256") == 0) {
+			mode = RSPAMD_CRYPTOBOX_MODE_NIST;
+		}
+		/* TODO: handle errors */
+	}
+
+	elt = ucl_object_lookup(obj, "encoding");
+	if (elt && ucl_object_type(elt) == UCL_STRING) {
+		str = ucl_object_tostring(elt);
+
+		if (g_ascii_strcasecmp(str, "hex") == 0) {
+			is_hex = TRUE;
+		}
+		/* TODO: handle errors */
+	}
+
+	kp = rspamd_cryptobox_keypair_alloc(type, mode);
+	kp->type = type;
+	kp->alg = mode;
+	REF_INIT_RETAIN(kp, rspamd_cryptobox_keypair_dtor);
+	g_assert(kp != NULL);
+
+	target = rspamd_cryptobox_keypair_sk(kp, &len);
+	str = ucl_object_tolstring(privkey, &ucl_len);
+
+	if (is_hex) {
+		dec_len = rspamd_decode_hex_buf(str, ucl_len, target, len);
+	}
+	else {
+		dec_len = rspamd_decode_base32_buf(str, ucl_len, target, len, RSPAMD_BASE32_DEFAULT);
+	}
+
+	if (dec_len != (gint) len) {
+		rspamd_keypair_unref(kp);
+
+		return NULL;
+	}
+
+	target = rspamd_cryptobox_keypair_pk(kp, &len);
+	str = ucl_object_tolstring(pubkey, &ucl_len);
+
+	if (is_hex) {
+		dec_len = rspamd_decode_hex_buf(str, ucl_len, target, len);
+	}
+	else {
+		dec_len = rspamd_decode_base32_buf(str, ucl_len, target, len, RSPAMD_BASE32_DEFAULT);
+	}
+
+	if (dec_len != (gint) len) {
+		rspamd_keypair_unref(kp);
+
+		return NULL;
+	}
+
+	rspamd_cryptobox_hash(kp->id, target, len, NULL, 0);
+
+	elt = ucl_object_lookup(obj, "extensions");
+	if (elt && ucl_object_type(elt) == UCL_OBJECT) {
+		/* Use copy to avoid issues with the refcounts */
+		kp->extensions = ucl_object_copy(elt);
+	}
+
+	return kp;
+}
+
+ucl_object_t *
+rspamd_keypair_to_ucl(struct rspamd_cryptobox_keypair *kp,
+					  enum rspamd_keypair_dump_flags flags)
+{
+	ucl_object_t *ucl_out, *elt;
+	gint how = 0;
+	GString *keypair_out;
+	const gchar *encoding;
+
+	g_assert(kp != NULL);
+
+	if (flags & RSPAMD_KEYPAIR_DUMP_HEX) {
+		how |= RSPAMD_KEYPAIR_HEX;
+		encoding = "hex";
+	}
+	else {
+		how |= RSPAMD_KEYPAIR_BASE32;
+		encoding = "base32";
+	}
+
+	if (flags & RSPAMD_KEYPAIR_DUMP_FLATTENED) {
+		ucl_out = ucl_object_typed_new(UCL_OBJECT);
+		elt = ucl_out;
+	}
+	else {
+		ucl_out = ucl_object_typed_new(UCL_OBJECT);
+		elt = ucl_object_typed_new(UCL_OBJECT);
+		ucl_object_insert_key(ucl_out, elt, "keypair", 0, false);
+	}
+
+
+	/* pubkey part */
+	keypair_out = rspamd_keypair_print(kp,
+									   RSPAMD_KEYPAIR_PUBKEY | how);
+	ucl_object_insert_key(elt,
+						  ucl_object_fromlstring(keypair_out->str, keypair_out->len),
+						  "pubkey", 0, false);
+	g_string_free(keypair_out, TRUE);
+
+	if (!(flags & RSPAMD_KEYPAIR_DUMP_NO_SECRET)) {
+		/* privkey part */
+		keypair_out = rspamd_keypair_print(kp,
+										   RSPAMD_KEYPAIR_PRIVKEY | how);
+		ucl_object_insert_key(elt,
+							  ucl_object_fromlstring(keypair_out->str, keypair_out->len),
+							  "privkey", 0, false);
+		g_string_free(keypair_out, TRUE);
+	}
+
+	keypair_out = rspamd_keypair_print(kp,
+									   RSPAMD_KEYPAIR_ID | how);
+	ucl_object_insert_key(elt,
+						  ucl_object_fromlstring(keypair_out->str, keypair_out->len),
+						  "id", 0, false);
+	g_string_free(keypair_out, TRUE);
+
+	ucl_object_insert_key(elt,
+						  ucl_object_fromstring(encoding),
+						  "encoding", 0, false);
+
+	ucl_object_insert_key(elt,
+						  ucl_object_fromstring(
+							  kp->alg == RSPAMD_CRYPTOBOX_MODE_NIST ? "nistp256" : "curve25519"),
+						  "algorithm", 0, false);
+
+	ucl_object_insert_key(elt,
+						  ucl_object_fromstring(
+							  kp->type == RSPAMD_KEYPAIR_KEX ? "kex" : "sign"),
+						  "type", 0, false);
+
+	if (kp->extensions) {
+		ucl_object_insert_key(elt, ucl_object_copy(kp->extensions),
+							  "extensions", 0, false);
+	}
+
+	return ucl_out;
+}
+
+gboolean
+rspamd_keypair_decrypt(struct rspamd_cryptobox_keypair *kp,
+					   const guchar *in, gsize inlen,
+					   guchar **out, gsize *outlen,
+					   GError **err)
+{
+	const guchar *nonce, *mac, *data, *pubkey;
+
+	g_assert(kp != NULL);
+	g_assert(in != NULL);
+
+	if (kp->type != RSPAMD_KEYPAIR_KEX) {
+		g_set_error(err, rspamd_keypair_quark(), EINVAL,
+					"invalid keypair type");
+
+		return FALSE;
+	}
+
+	if (inlen < sizeof(encrypted_magic) + rspamd_cryptobox_pk_bytes(kp->alg) +
+					rspamd_cryptobox_mac_bytes(kp->alg) +
+					rspamd_cryptobox_nonce_bytes(kp->alg)) {
+		g_set_error(err, rspamd_keypair_quark(), E2BIG, "invalid size: too small");
+
+		return FALSE;
+	}
+
+	if (memcmp(in, encrypted_magic, sizeof(encrypted_magic)) != 0) {
+		g_set_error(err, rspamd_keypair_quark(), EINVAL,
+					"invalid magic");
+
+		return FALSE;
+	}
+
+	/* Set pointers */
+	pubkey = in + sizeof(encrypted_magic);
+	mac = pubkey + rspamd_cryptobox_pk_bytes(kp->alg);
+	nonce = mac + rspamd_cryptobox_mac_bytes(kp->alg);
+	data = nonce + rspamd_cryptobox_nonce_bytes(kp->alg);
+
+	if (data - in >= inlen) {
+		g_set_error(err, rspamd_keypair_quark(), E2BIG, "invalid size: too small");
+
+		return FALSE;
+	}
+
+	inlen -= data - in;
+
+	/* Allocate memory for output */
+	*out = g_malloc(inlen);
+	memcpy(*out, data, inlen);
+
+	if (!rspamd_cryptobox_decrypt_inplace(*out, inlen, nonce, pubkey,
+										  rspamd_keypair_component(kp, RSPAMD_KEYPAIR_COMPONENT_SK, NULL),
+										  mac, kp->alg)) {
+		g_set_error(err, rspamd_keypair_quark(), EPERM, "verification failed");
+		g_free(*out);
+
+		return FALSE;
+	}
+
+	if (outlen) {
+		*outlen = inlen;
+	}
+
+	return TRUE;
+}
+
+gboolean
+rspamd_keypair_encrypt(struct rspamd_cryptobox_keypair *kp,
+					   const guchar *in, gsize inlen,
+					   guchar **out, gsize *outlen,
+					   GError **err)
+{
+	guchar *nonce, *mac, *data, *pubkey;
+	struct rspamd_cryptobox_keypair *local;
+	gsize olen;
+
+	g_assert(kp != NULL);
+	g_assert(in != NULL);
+
+	if (kp->type != RSPAMD_KEYPAIR_KEX) {
+		g_set_error(err, rspamd_keypair_quark(), EINVAL,
+					"invalid keypair type");
+
+		return FALSE;
+	}
+
+	local = rspamd_keypair_new(kp->type, kp->alg);
+
+	olen = inlen + sizeof(encrypted_magic) +
+		   rspamd_cryptobox_pk_bytes(kp->alg) +
+		   rspamd_cryptobox_mac_bytes(kp->alg) +
+		   rspamd_cryptobox_nonce_bytes(kp->alg);
+	*out = g_malloc(olen);
+	memcpy(*out, encrypted_magic, sizeof(encrypted_magic));
+	pubkey = *out + sizeof(encrypted_magic);
+	mac = pubkey + rspamd_cryptobox_pk_bytes(kp->alg);
+	nonce = mac + rspamd_cryptobox_mac_bytes(kp->alg);
+	data = nonce + rspamd_cryptobox_nonce_bytes(kp->alg);
+
+	ottery_rand_bytes(nonce, rspamd_cryptobox_nonce_bytes(kp->alg));
+	memcpy(data, in, inlen);
+	memcpy(pubkey, rspamd_keypair_component(kp, RSPAMD_KEYPAIR_COMPONENT_PK, NULL),
+		   rspamd_cryptobox_pk_bytes(kp->alg));
+	rspamd_cryptobox_encrypt_inplace(data, inlen, nonce, pubkey,
+									 rspamd_keypair_component(local, RSPAMD_KEYPAIR_COMPONENT_SK, NULL),
+									 mac, kp->alg);
+	rspamd_keypair_unref(local);
+
+	if (outlen) {
+		*outlen = olen;
+	}
+
+	return TRUE;
+}
+
+gboolean
+rspamd_pubkey_encrypt(struct rspamd_cryptobox_pubkey *pk,
+					  const guchar *in, gsize inlen,
+					  guchar **out, gsize *outlen,
+					  GError **err)
+{
+	guchar *nonce, *mac, *data, *pubkey;
+	struct rspamd_cryptobox_keypair *local;
+	gsize olen;
+
+	g_assert(pk != NULL);
+	g_assert(in != NULL);
+
+	if (pk->type != RSPAMD_KEYPAIR_KEX) {
+		g_set_error(err, rspamd_keypair_quark(), EINVAL,
+					"invalid pubkey type");
+
+		return FALSE;
+	}
+
+	local = rspamd_keypair_new(pk->type, pk->alg);
+
+	olen = inlen + sizeof(encrypted_magic) +
+		   rspamd_cryptobox_pk_bytes(pk->alg) +
+		   rspamd_cryptobox_mac_bytes(pk->alg) +
+		   rspamd_cryptobox_nonce_bytes(pk->alg);
+	*out = g_malloc(olen);
+	memcpy(*out, encrypted_magic, sizeof(encrypted_magic));
+	pubkey = *out + sizeof(encrypted_magic);
+	mac = pubkey + rspamd_cryptobox_pk_bytes(pk->alg);
+	nonce = mac + rspamd_cryptobox_mac_bytes(pk->alg);
+	data = nonce + rspamd_cryptobox_nonce_bytes(pk->alg);
+
+	ottery_rand_bytes(nonce, rspamd_cryptobox_nonce_bytes(pk->alg));
+	memcpy(data, in, inlen);
+	memcpy(pubkey, rspamd_pubkey_get_pk(pk, NULL),
+		   rspamd_cryptobox_pk_bytes(pk->alg));
+	rspamd_cryptobox_encrypt_inplace(data, inlen, nonce, pubkey,
+									 rspamd_keypair_component(local, RSPAMD_KEYPAIR_COMPONENT_SK, NULL),
+									 mac, pk->alg);
+	rspamd_keypair_unref(local);
+
+	if (outlen) {
+		*outlen = olen;
+	}
+
+	return TRUE;
+}
\ No newline at end of file
diff --git a/src/libcryptobox/keypair.h b/src/libcryptobox/keypair.h
new file mode 100644
index 0000000..64461b7
--- /dev/null
+++ b/src/libcryptobox/keypair.h
@@ -0,0 +1,317 @@
+/*-
+ * Copyright 2016 Vsevolod Stakhov
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#ifndef SRC_LIBCRYPTOBOX_KEYPAIR_H_
+#define SRC_LIBCRYPTOBOX_KEYPAIR_H_
+
+#include "config.h"
+#include "cryptobox.h"
+#include "ucl.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * Keypair type
+ */
+enum rspamd_cryptobox_keypair_type {
+	RSPAMD_KEYPAIR_KEX = 0,
+	RSPAMD_KEYPAIR_SIGN
+};
+
+extern const guchar encrypted_magic[7];
+
+/**
+ * Opaque structure for the full (public + private) keypair
+ */
+struct rspamd_cryptobox_keypair;
+/**
+ * Opaque structure for public only keypair
+ */
+struct rspamd_cryptobox_pubkey;
+
+/**
+ * Creates new full keypair
+ * @param type type of the keypair
+ * @param alg algorithm for the keypair
+ * @return fresh keypair generated
+ */
+struct rspamd_cryptobox_keypair *rspamd_keypair_new(
+	enum rspamd_cryptobox_keypair_type type,
+	enum rspamd_cryptobox_mode alg);
+
+/**
+ * Increase refcount for the specific keypair
+ * @param kp
+ * @return
+ */
+struct rspamd_cryptobox_keypair *rspamd_keypair_ref(
+	struct rspamd_cryptobox_keypair *kp);
+
+/**
+ * Decrease refcount for the specific keypair (or destroy when refcount == 0)
+ * @param kp
+ */
+void rspamd_keypair_unref(struct rspamd_cryptobox_keypair *kp);
+
+/**
+ * Increase refcount for the specific pubkey
+ * @param kp
+ * @return
+ */
+struct rspamd_cryptobox_pubkey *rspamd_pubkey_ref(
+	struct rspamd_cryptobox_pubkey *kp);
+
+/**
+ * Load pubkey from base32 string
+ * @param b32 input string
+ * @param type type of key (signing or kex)
+ * @param alg algorithm of the key (nist or curve25519)
+ * @return new pubkey or NULL in case of error
+ */
+struct rspamd_cryptobox_pubkey *rspamd_pubkey_from_base32(const gchar *b32,
+														  gsize len,
+														  enum rspamd_cryptobox_keypair_type type,
+														  enum rspamd_cryptobox_mode alg);
+
+/**
+ * Load pubkey from hex string
+ * @param hex input string
+ * @param type type of key (signing or kex)
+ * @param alg algorithm of the key (nist or curve25519)
+ * @return new pubkey or NULL in case of error
+ */
+struct rspamd_cryptobox_pubkey *rspamd_pubkey_from_hex(const gchar *hex,
+													   gsize len,
+													   enum rspamd_cryptobox_keypair_type type,
+													   enum rspamd_cryptobox_mode alg);
+
+/**
+ * Load pubkey from raw chunk string
+ * @param hex input data
+ * @param type type of key (signing or kex)
+ * @param alg algorithm of the key (nist or curve25519)
+ * @return new pubkey or NULL in case of error
+ */
+struct rspamd_cryptobox_pubkey *rspamd_pubkey_from_bin(const guchar *raw,
+													   gsize len,
+													   enum rspamd_cryptobox_keypair_type type,
+													   enum rspamd_cryptobox_mode alg);
+
+
+/**
+ * Decrease refcount for the specific pubkey (or destroy when refcount == 0)
+ * @param kp
+ */
+void rspamd_pubkey_unref(struct rspamd_cryptobox_pubkey *kp);
+
+/**
+ * Get type of keypair
+ */
+enum rspamd_cryptobox_keypair_type rspamd_keypair_type(
+	struct rspamd_cryptobox_keypair *kp);
+
+/**
+ * Get type of pubkey
+ */
+enum rspamd_cryptobox_keypair_type rspamd_pubkey_type(
+	struct rspamd_cryptobox_pubkey *p);
+
+/**
+ * Get algorithm of keypair
+ */
+enum rspamd_cryptobox_mode rspamd_keypair_alg(struct rspamd_cryptobox_keypair *kp);
+
+/**
+ * Get algorithm of pubkey
+ */
+enum rspamd_cryptobox_mode rspamd_pubkey_alg(struct rspamd_cryptobox_pubkey *p);
+
+/**
+ * Get cached NM for this specific pubkey
+ * @param p
+ * @return
+ */
+const guchar *rspamd_pubkey_get_nm(struct rspamd_cryptobox_pubkey *p,
+								   struct rspamd_cryptobox_keypair *kp);
+
+/**
+ * Calculate and store nm value for the specified local key (performs ECDH)
+ * @param p
+ * @return
+ */
+const guchar *rspamd_pubkey_calculate_nm(struct rspamd_cryptobox_pubkey *p,
+										 struct rspamd_cryptobox_keypair *kp);
+
+/**
+ * Get raw public key id for a specified keypair (rspamd_cryptobox_HASHBYTES)
+ * @param kp
+ * @return
+ */
+const guchar *rspamd_keypair_get_id(struct rspamd_cryptobox_keypair *kp);
+
+/**
+ * Returns keypair extensions if any
+ * @param kp
+ * @return
+ */
+const ucl_object_t *rspamd_keypair_get_extensions(struct rspamd_cryptobox_keypair *kp);
+
+/**
+ * Get raw public key id for a specified key (rspamd_cryptobox_HASHBYTES)
+ * @param kp
+ * @return
+ */
+const guchar *rspamd_pubkey_get_id(struct rspamd_cryptobox_pubkey *pk);
+
+/**
+ * Get raw public key from pubkey opaque structure
+ * @param pk
+ * @param len
+ * @return
+ */
+const guchar *rspamd_pubkey_get_pk(struct rspamd_cryptobox_pubkey *pk,
+								   guint *len);
+
+/** Short ID characters count */
+#define RSPAMD_KEYPAIR_SHORT_ID_LEN 5
+/** Print pubkey */
+#define RSPAMD_KEYPAIR_PUBKEY 0x1
+/** Print secret key */
+#define RSPAMD_KEYPAIR_PRIVKEY 0x2
+/** Print key id */
+#define RSPAMD_KEYPAIR_ID 0x4
+/** Print short key id */
+#define RSPAMD_KEYPAIR_ID_SHORT 0x8
+/** Encode output with base 32 */
+#define RSPAMD_KEYPAIR_BASE32 0x10
+/** Human readable output */
+#define RSPAMD_KEYPAIR_HUMAN 0x20
+#define RSPAMD_KEYPAIR_HEX 0x40
+
+/**
+ * Print keypair encoding it if needed
+ * @param key key to print
+ * @param how flags that specifies printing behaviour
+ * @return newly allocated string with keypair
+ */
+GString *rspamd_keypair_print(struct rspamd_cryptobox_keypair *kp,
+							  guint how);
+
+/**
+ * Print pubkey encoding it if needed
+ * @param key key to print
+ * @param how flags that specifies printing behaviour
+ * @return newly allocated string with keypair
+ */
+GString *rspamd_pubkey_print(struct rspamd_cryptobox_pubkey *pk,
+							 guint how);
+
+/** Get keypair pubkey ID */
+#define RSPAMD_KEYPAIR_COMPONENT_ID 0
+/** Get keypair public key */
+#define RSPAMD_KEYPAIR_COMPONENT_PK 1
+/** Get keypair private key */
+#define RSPAMD_KEYPAIR_COMPONENT_SK 2
+
+/**
+ * Get specific component of a keypair
+ * @param kp keypair
+ * @param ncomp component number
+ * @param len length of input
+ * @return raw content of the component
+ */
+const guchar *rspamd_keypair_component(struct rspamd_cryptobox_keypair *kp,
+									   guint ncomp, guint *len);
+
+/**
+ * Create a new keypair from ucl object
+ * @param obj object to load
+ * @return new structure or NULL if an object is invalid
+ */
+struct rspamd_cryptobox_keypair *rspamd_keypair_from_ucl(const ucl_object_t *obj);
+
+
+enum rspamd_keypair_dump_flags {
+	RSPAMD_KEYPAIR_DUMP_DEFAULT = 0,
+	RSPAMD_KEYPAIR_DUMP_HEX = 1u << 0u,
+	RSPAMD_KEYPAIR_DUMP_NO_SECRET = 1u << 1u,
+	RSPAMD_KEYPAIR_DUMP_FLATTENED = 1u << 2u,
+};
+
+/**
+ * Converts keypair to ucl object
+ * @param kp
+ * @return
+ */
+ucl_object_t *rspamd_keypair_to_ucl(struct rspamd_cryptobox_keypair *kp,
+									enum rspamd_keypair_dump_flags flags);
+
+
+/**
+ * Decrypts data using keypair and a pubkey stored in in, in must start from
+ * `encrypted_magic` constant
+ * @param kp keypair
+ * @param in raw input
+ * @param inlen input length
+ * @param out output (allocated internally using g_malloc)
+ * @param outlen output size
+ * @return TRUE if decryption is completed, out must be freed in this case
+ */
+gboolean rspamd_keypair_decrypt(struct rspamd_cryptobox_keypair *kp,
+								const guchar *in, gsize inlen,
+								guchar **out, gsize *outlen,
+								GError **err);
+
+/**
+ * Encrypts data usign specific keypair.
+ * This method actually generates ephemeral local keypair, use public key from
+ * the remote keypair and encrypts data
+ * @param kp keypair
+ * @param in raw input
+ * @param inlen input length
+ * @param out output (allocated internally using g_malloc)
+ * @param outlen output size
+ * @param err pointer to error
+ * @return TRUE if encryption has been completed, out must be freed in this case
+ */
+gboolean rspamd_keypair_encrypt(struct rspamd_cryptobox_keypair *kp,
+								const guchar *in, gsize inlen,
+								guchar **out, gsize *outlen,
+								GError **err);
+
+/**
+ * Encrypts data usign specific pubkey (must have KEX type).
+ * This method actually generates ephemeral local keypair, use public key from
+ * the remote keypair and encrypts data
+ * @param kp keypair
+ * @param in raw input
+ * @param inlen input length
+ * @param out output (allocated internally using g_malloc)
+ * @param outlen output size
+ * @param err pointer to error
+ * @return TRUE if encryption has been completed, out must be freed in this case
+ */
+gboolean rspamd_pubkey_encrypt(struct rspamd_cryptobox_pubkey *pk,
+							   const guchar *in, gsize inlen,
+							   guchar **out, gsize *outlen,
+							   GError **err);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* SRC_LIBCRYPTOBOX_KEYPAIR_H_ */
diff --git a/src/libcryptobox/keypair_private.h b/src/libcryptobox/keypair_private.h
new file mode 100644
index 0000000..16e17e0
--- /dev/null
+++ b/src/libcryptobox/keypair_private.h
@@ -0,0 +1,143 @@
+/*-
+ * Copyright 2016 Vsevolod Stakhov
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#ifndef KEYPAIR_PRIVATE_H_
+#define KEYPAIR_PRIVATE_H_
+
+#include "config.h"
+#include "ref.h"
+#include "cryptobox.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+/*
+ * KEX cached data
+ */
+struct rspamd_cryptobox_nm {
+	guchar nm[rspamd_cryptobox_MAX_NMBYTES];
+	guint64 sk_id; /* Used to store secret key id */
+	ref_entry_t ref;
+};
+
+/*
+ * Generic keypair
+ */
+struct rspamd_cryptobox_keypair {
+	guchar id[rspamd_cryptobox_HASHBYTES];
+	enum rspamd_cryptobox_keypair_type type;
+	enum rspamd_cryptobox_mode alg;
+	ucl_object_t *extensions;
+	ref_entry_t ref;
+};
+
+/*
+ * NIST p256 ecdh keypair
+ */
+#define RSPAMD_CRYPTOBOX_KEYPAIR_NIST(x) ((struct rspamd_cryptobox_keypair_nist *) (x))
+struct rspamd_cryptobox_keypair_nist {
+	struct rspamd_cryptobox_keypair parent;
+	guchar sk[32];
+	guchar pk[65];
+};
+
+/*
+ * Curve25519 ecdh keypair
+ */
+#define RSPAMD_CRYPTOBOX_KEYPAIR_25519(x) ((struct rspamd_cryptobox_keypair_25519 *) (x))
+struct rspamd_cryptobox_keypair_25519 {
+	struct rspamd_cryptobox_keypair parent;
+	guchar sk[32];
+	guchar pk[32];
+};
+
+/*
+ * NIST p256 ecdsa keypair
+ */
+#define RSPAMD_CRYPTOBOX_KEYPAIR_SIG_NIST(x) ((struct rspamd_cryptobox_keypair_sig_nist *) (x))
+struct rspamd_cryptobox_keypair_sig_nist {
+	struct rspamd_cryptobox_keypair parent;
+	guchar sk[32];
+	guchar pk[65];
+};
+
+/*
+ * Ed25519 keypair
+ */
+#define RSPAMD_CRYPTOBOX_KEYPAIR_SIG_25519(x) ((struct rspamd_cryptobox_keypair_sig_25519 *) (x))
+struct rspamd_cryptobox_keypair_sig_25519 {
+	struct rspamd_cryptobox_keypair parent;
+	guchar sk[64];
+	guchar pk[32];
+};
+
+/*
+ * Public component of the keypair
+ */
+struct rspamd_cryptobox_pubkey {
+	guchar id[rspamd_cryptobox_HASHBYTES];
+	struct rspamd_cryptobox_nm *nm;
+	enum rspamd_cryptobox_keypair_type type;
+	enum rspamd_cryptobox_mode alg;
+	ref_entry_t ref;
+};
+
+/*
+ * Public p256 ecdh
+ */
+#define RSPAMD_CRYPTOBOX_PUBKEY_NIST(x) ((struct rspamd_cryptobox_pubkey_nist *) (x))
+struct rspamd_cryptobox_pubkey_nist {
+	struct rspamd_cryptobox_pubkey parent;
+	guchar pk[65];
+};
+
+/*
+ * Public curve25519 ecdh
+ */
+#define RSPAMD_CRYPTOBOX_PUBKEY_25519(x) ((struct rspamd_cryptobox_pubkey_25519 *) (x))
+struct rspamd_cryptobox_pubkey_25519 {
+	struct rspamd_cryptobox_pubkey parent;
+	guchar pk[32];
+};
+
+/*
+ * Public p256 ecdsa
+ */
+#define RSPAMD_CRYPTOBOX_PUBKEY_SIG_NIST(x) ((struct rspamd_cryptobox_pubkey_sig_nist *) (x))
+struct rspamd_cryptobox_pubkey_sig_nist {
+	struct rspamd_cryptobox_pubkey parent;
+	guchar pk[65];
+};
+
+/*
+ * Public ed25519
+ */
+#define RSPAMD_CRYPTOBOX_PUBKEY_SIG_25519(x) ((struct rspamd_cryptobox_pubkey_sig_25519 *) (x))
+struct rspamd_cryptobox_pubkey_sig_25519 {
+	struct rspamd_cryptobox_pubkey parent;
+	guchar pk[32];
+};
+
+void rspamd_cryptobox_nm_dtor(struct rspamd_cryptobox_nm *nm);
+
+void rspamd_cryptobox_keypair_dtor(struct rspamd_cryptobox_keypair *kp);
+
+void rspamd_cryptobox_pubkey_dtor(struct rspamd_cryptobox_pubkey *p);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* KEYPAIR_PRIVATE_H_ */
diff --git a/src/libcryptobox/keypairs_cache.c b/src/libcryptobox/keypairs_cache.c
new file mode 100644
index 0000000..0616bb9
--- /dev/null
+++ b/src/libcryptobox/keypairs_cache.c
@@ -0,0 +1,141 @@
+/*-
+ * Copyright 2016 Vsevolod Stakhov
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "config.h"
+#include "keypairs_cache.h"
+#include "keypair_private.h"
+#include "libutil/util.h"
+#include "hash.h"
+
+struct rspamd_keypair_elt {
+	struct rspamd_cryptobox_nm *nm;
+	guchar pair[rspamd_cryptobox_HASHBYTES * 2];
+};
+
+struct rspamd_keypair_cache {
+	rspamd_lru_hash_t *hash;
+};
+
+static void
+rspamd_keypair_destroy(gpointer ptr)
+{
+	struct rspamd_keypair_elt *elt = (struct rspamd_keypair_elt *) ptr;
+
+	REF_RELEASE(elt->nm);
+	g_free(elt);
+}
+
+static guint
+rspamd_keypair_hash(gconstpointer ptr)
+{
+	struct rspamd_keypair_elt *elt = (struct rspamd_keypair_elt *) ptr;
+
+	return rspamd_cryptobox_fast_hash(elt->pair, sizeof(elt->pair),
+									  rspamd_hash_seed());
+}
+
+static gboolean
+rspamd_keypair_equal(gconstpointer p1, gconstpointer p2)
+{
+	struct rspamd_keypair_elt *e1 = (struct rspamd_keypair_elt *) p1,
+							  *e2 = (struct rspamd_keypair_elt *) p2;
+
+	return memcmp(e1->pair, e2->pair, sizeof(e1->pair)) == 0;
+}
+
+struct rspamd_keypair_cache *
+rspamd_keypair_cache_new(guint max_items)
+{
+	struct rspamd_keypair_cache *c;
+
+	g_assert(max_items > 0);
+
+	c = g_malloc0(sizeof(*c));
+	c->hash = rspamd_lru_hash_new_full(max_items, NULL,
+									   rspamd_keypair_destroy, rspamd_keypair_hash, rspamd_keypair_equal);
+
+	return c;
+}
+
+void rspamd_keypair_cache_process(struct rspamd_keypair_cache *c,
+								  struct rspamd_cryptobox_keypair *lk,
+								  struct rspamd_cryptobox_pubkey *rk)
+{
+	struct rspamd_keypair_elt search, *new;
+
+	g_assert(lk != NULL);
+	g_assert(rk != NULL);
+	g_assert(rk->alg == lk->alg);
+	g_assert(rk->type == lk->type);
+	g_assert(rk->type == RSPAMD_KEYPAIR_KEX);
+
+	memset(&search, 0, sizeof(search));
+	memcpy(search.pair, rk->id, rspamd_cryptobox_HASHBYTES);
+	memcpy(&search.pair[rspamd_cryptobox_HASHBYTES], lk->id,
+		   rspamd_cryptobox_HASHBYTES);
+	new = rspamd_lru_hash_lookup(c->hash, &search, time(NULL));
+
+	if (rk->nm) {
+		REF_RELEASE(rk->nm);
+		rk->nm = NULL;
+	}
+
+	if (new == NULL) {
+		new = g_malloc0(sizeof(*new));
+
+		if (posix_memalign((void **) &new->nm, 32, sizeof(*new->nm)) != 0) {
+			abort();
+		}
+
+		REF_INIT_RETAIN(new->nm, rspamd_cryptobox_nm_dtor);
+
+		memcpy(new->pair, rk->id, rspamd_cryptobox_HASHBYTES);
+		memcpy(&new->pair[rspamd_cryptobox_HASHBYTES], lk->id,
+			   rspamd_cryptobox_HASHBYTES);
+		memcpy(&new->nm->sk_id, lk->id, sizeof(guint64));
+
+		if (rk->alg == RSPAMD_CRYPTOBOX_MODE_25519) {
+			struct rspamd_cryptobox_pubkey_25519 *rk_25519 =
+				RSPAMD_CRYPTOBOX_PUBKEY_25519(rk);
+			struct rspamd_cryptobox_keypair_25519 *sk_25519 =
+				RSPAMD_CRYPTOBOX_KEYPAIR_25519(lk);
+
+			rspamd_cryptobox_nm(new->nm->nm, rk_25519->pk, sk_25519->sk, rk->alg);
+		}
+		else {
+			struct rspamd_cryptobox_pubkey_nist *rk_nist =
+				RSPAMD_CRYPTOBOX_PUBKEY_NIST(rk);
+			struct rspamd_cryptobox_keypair_nist *sk_nist =
+				RSPAMD_CRYPTOBOX_KEYPAIR_NIST(lk);
+
+			rspamd_cryptobox_nm(new->nm->nm, rk_nist->pk, sk_nist->sk, rk->alg);
+		}
+
+		rspamd_lru_hash_insert(c->hash, new, new, time(NULL), -1);
+	}
+
+	g_assert(new != NULL);
+
+	rk->nm = new->nm;
+	REF_RETAIN(rk->nm);
+}
+
+void rspamd_keypair_cache_destroy(struct rspamd_keypair_cache *c)
+{
+	if (c != NULL) {
+		rspamd_lru_hash_destroy(c->hash);
+		g_free(c);
+	}
+}
diff --git a/src/libcryptobox/keypairs_cache.h b/src/libcryptobox/keypairs_cache.h
new file mode 100644
index 0000000..96e356a
--- /dev/null
+++ b/src/libcryptobox/keypairs_cache.h
@@ -0,0 +1,57 @@
+/*-
+ * Copyright 2016 Vsevolod Stakhov
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#ifndef KEYPAIRS_CACHE_H_
+#define KEYPAIRS_CACHE_H_
+
+#include "config.h"
+#include "keypair.h"
+
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+struct rspamd_keypair_cache;
+
+/**
+ * Create new keypair cache of the specified size
+ * @param max_items defines maximum count of elements in the cache
+ * @return new cache
+ */
+struct rspamd_keypair_cache *rspamd_keypair_cache_new(guint max_items);
+
+
+/**
+ * Process local and remote keypair setting beforenm value as appropriate
+ * @param c cache of keypairs
+ * @param lk local key
+ * @param rk remote key
+ */
+void rspamd_keypair_cache_process(struct rspamd_keypair_cache *c,
+								  struct rspamd_cryptobox_keypair *lk,
+								  struct rspamd_cryptobox_pubkey *rk);
+
+/**
+ * Destroy old keypair cache
+ * @param c cache object
+ */
+void rspamd_keypair_cache_destroy(struct rspamd_keypair_cache *c);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* KEYPAIRS_CACHE_H_ */
diff --git a/src/libcryptobox/macro.S b/src/libcryptobox/macro.S
new file mode 100644
index 0000000..f213f15
--- /dev/null
+++ b/src/libcryptobox/macro.S
@@ -0,0 +1,176 @@
+#include "platform_config.h"
+
+#if !defined(HAVE_SLASHMACRO) && !defined(HAVE_DOLLARMACRO)
+	#error Unknown gnu as macro parameter convention! Run ./configure
+#endif
+
+#if defined(__MACH__)
+	.macro FN name
+	#if defined(HAVE_SLASHMACRO)
+		\name:
+		_\name:
+	#elif defined(HAVE_DOLLARMACRO)
+		$0:
+		_$0:
+	#endif
+	.endm
+
+	.macro FN_EXT name, args, xmmused
+	#if defined(HAVE_SLASHMACRO)
+		FN \name
+	#elif defined(HAVE_DOLLARMACRO)
+		FN $0
+	#endif
+	.endm
+
+	.macro FN_END name
+	.endm
+
+	.macro HIDDEN name
+	#if defined(HAVE_AS_PRIVATE_EXTERN)
+	#if defined(HAVE_SLASHMACRO)
+		.private_extern \name
+		.private_extern _\name
+	#elif defined(HAVE_DOLLARMACRO)
+		.private_extern $0
+		.private_extern _$0
+	#endif
+	#endif
+	.endm
+#else
+	.macro FN name
+		\name:
+		_\name:
+	.endm
+
+	.macro FN_EXT name, args, xmmused
+		FN \name
+	.endm
+
+	.macro FN_END name
+		.size \name, .-\name
+		.size _\name, .-_\name
+		.type \name, @function
+	 	.type _\name, @function
+	.endm
+
+	.macro HIDDEN name
+	#if defined(HAVE_AS_HIDDEN)
+		.hidden \name
+		.hidden _\name
+	#endif
+	.endm
+
+	/* set NX for stack */
+	.section .note.GNU-stack,"",@progbits
+#endif
+#if defined(__MACH__)
+	.macro SECTION_TEXT
+		.section __TEXT,__text,regular
+	.endm
+
+	.macro SECTION_RODATA
+		.section __TEXT,__text,regular
+	.endm
+#else
+	/* put everything in the code segment to simplify things */
+	.macro SECTION_TEXT
+		.text
+	.endm
+
+	.macro SECTION_RODATA
+		.text
+	.endm
+#endif
+
+/* declare a global function */
+.macro GLOBAL name
+#if defined(HAVE_SLASHMACRO)
+	.globl \name
+	.globl _\name
+#elif defined(HAVE_DOLLARMACRO)
+	.globl $0
+	.globl _$0
+#endif
+.endm
+
+.macro FN_LOCAL_PREFIX name
+#if defined(HAVE_SLASHMACRO)
+	FN LOCAL_PREFIX(\name)
+#elif defined(HAVE_DOLLARMACRO)
+	FN LOCAL_PREFIX($0)
+#endif
+.endm
+
+.macro FN_EXT_LOCAL_PREFIX name, args, xmmused
+#if defined(HAVE_SLASHMACRO)
+	FN_EXT LOCAL_PREFIX(\name), \args, \xmmused
+#elif defined(HAVE_DOLLARMACRO)
+	FN_EXT LOCAL_PREFIX($0), $1, $2
+#endif
+.endm
+
+.macro FN_END_LOCAL_PREFIX name
+#if defined(HAVE_SLASHMACRO)
+	FN_END LOCAL_PREFIX(\name)
+#elif defined(HAVE_DOLLARMACRO)
+	FN_END LOCAL_PREFIX($0)
+#endif
+.endm
+
+.macro GLOBAL_LOCAL_PREFIX name
+#if defined(HAVE_SLASHMACRO)
+	GLOBAL LOCAL_PREFIX(\name)
+	HIDDEN LOCAL_PREFIX(\name)
+#elif defined(HAVE_DOLLARMACRO)
+	GLOBAL LOCAL_PREFIX($0)
+	HIDDEN LOCAL_PREFIX($0)
+#endif
+.endm
+
+.macro GLOBAL_HIDDEN_FN name
+#if defined(HAVE_SLASHMACRO)
+	GLOBAL \name
+	HIDDEN \name
+	FN \name
+#elif defined(HAVE_DOLLARMACRO)
+	GLOBAL $0
+	HIDDEN $0
+	FN $0
+#endif
+.endm
+
+.macro GLOBAL_HIDDEN_FN_EXT name, args, xmmused
+#if defined(HAVE_SLASHMACRO)
+	GLOBAL \name
+	HIDDEN \name
+	FN_EXT \name, \args, \xmmused
+#elif defined(HAVE_DOLLARMACRO)
+	GLOBAL $0
+	HIDDEN $0
+	FN_EXT $0, $1, $2
+#endif
+.endm
+
+/* pic support */
+.macro LOAD_VAR_PIC var, reg
+#if !defined(__LP64__)
+	#if defined(HAVE_SLASHMACRO)
+		call 1f
+		1:
+		popl \reg
+		leal \var - 1b(\reg), \reg
+	#elif defined(HAVE_DOLLARMACRO)
+		call 1f
+		1:
+		popl $1
+		leal $0 - 1b($1), $1
+	#endif
+#else
+	#if defined(HAVE_SLASHMACRO)
+		leaq \var(%rip), \reg
+	#elif defined(HAVE_DOLLARMACRO)
+		leaq $0(%rip), $1
+	#endif
+#endif
+.endm
diff --git a/src/libcryptobox/platform_config.h.in b/src/libcryptobox/platform_config.h.in
new file mode 100644
index 0000000..7b7d17d
--- /dev/null
+++ b/src/libcryptobox/platform_config.h.in
@@ -0,0 +1,16 @@
+#ifndef PLATFORM_H_CONFIG
+#define PLATFORM_H_CONFIG
+
+#define ARCH "${ARCH}"
+#define CMAKE_ARCH_${ARCH} 1
+#cmakedefine HAVE_AVX2	1
+#cmakedefine HAVE_AVX	1
+#cmakedefine HAVE_SSE2	1
+#cmakedefine HAVE_SSE41	1
+#cmakedefine HAVE_SSE42	1
+#cmakedefine HAVE_SSE3	1
+#cmakedefine HAVE_SSSE3	1
+#cmakedefine HAVE_SLASHMACRO 1
+#cmakedefine HAVE_DOLLARMACRO 1
+
+#endif
\ No newline at end of file