sodiumoxide

sodiumoxide is a Rust wrapper around libsodium, the portable implementation of Daniel J. Bernstein’s NaCl cryptography library. It exposes NaCl’s core operations — authenticated encryption, public-key and secret-key cryptography, digital signatures, hashing, and key exchange — through a safe, idiomatic Rust API that hides the raw FFI and enforces correct use of keys and nonces via distinct types.

The crate covers the well-known NaCl constructions (e.g. crypto_box, crypto_secretbox, crypto_sign, crypto_hash) organized into modules that map to libsodium’s primitives. Note that the project is formally deprecated and receives security fixes only; it remains widely used but new projects may prefer more actively maintained pure-Rust crypto crates.

What You Get

• Safe Rust wrappers over libsodium’s NaCl primitives (box, secretbox, sign, hash, auth, and more)
• Distinct types for keys, nonces, and tags that make incorrect usage a compile error
• Authenticated public-key and secret-key encryption out of the box
• Ed25519 digital signatures and generic/keyed hashing functions
• Automatic memory zeroing and constant-time comparisons inherited from libsodium

Common Use Cases

• Encrypting and authenticating messages between two parties using crypto_box
• Symmetric authenticated encryption of data at rest with crypto_secretbox
• Signing and verifying data with Ed25519 signatures
• Hashing or computing MACs over data using NaCl’s hashing primitives

Under The Hood

Architecture - The crate is a safe layer over the libsodium-sys FFI bindings: each libsodium primitive is wrapped in a Rust module (e.g. crypto::box_, crypto::secretbox, crypto::sign, crypto::hash) exposing newtype-wrapped keys/nonces and functions that marshal Rust slices into the C API and back. A one-time init() seeds libsodium’s runtime before use. Tech Stack - Rust bound to the C libsodium library via libsodium-sys, with serde support behind a feature flag for serializing key material; the build links against a system or vendored libsodium. Code Quality - The library is mature (600+ stars, millions of downloads) with extensive documentation on docs.rs and per-primitive tests mirroring libsodium’s test vectors, though it is now in maintenance-only mode with no new feature development. API Design - The API leans on Rust’s type system for safety: functions return owned key/nonce types you cannot accidentally swap, and the module layout mirrors NaCl’s naming so users familiar with libsodium find their bearings quickly. Boilerplate is minimal — call init(), generate a keypair, then seal/open.