Squashed commit of the following:

commit 8e3d6ea5e3c83fe42cb904b6ccc4fe2b73f76aae
Author: vnugent <public@vaughnnugent.com>
Date:   Sat Mar 30 09:52:55 2024 -0400

    refactor!: Some api (struct) changes and updated tests

commit e88e8420520204e20802516f01d4488bb0b1d6ea
Merge: 490dfee 21f6c0a
Author: vnugent <public@vaughnnugent.com>
Date:   Sun Mar 3 15:02:34 2024 -0500

    Merge branch 'master' into develop

commit 490dfee4ef22479009627435c6ad728c3cbbab54
Author: vnugent <public@vaughnnugent.com>
Date:   Sun Mar 3 14:59:25 2024 -0500

    test: #3 tests for encryption/description and Macs

commit efa97490b7ed47f4e2f05bee52e2b33e14e439e6
Merge: 1b84e3c 120022a
Author: vnugent <public@vaughnnugent.com>
Date:   Sun Mar 3 14:55:48 2024 -0500

    merge master

commit 1b84e3c7c2e55b1ff9ffdd09b66873e11c131441
Author: vnugent <public@vaughnnugent.com>
Date:   Sat Mar 2 22:57:36 2024 -0500

    fix: #2 constent usage of sizeof() operator on struct types

commit 9de5a214c66adea0ef2d0bac63c59449de202a88
Author: vnugent <public@vaughnnugent.com>
Date:   Fri Mar 1 14:30:36 2024 -0500

    perf: avoid nc_key struct copy, cast and verify instead

commit b917b761120ed684af28d0707673ffadcf14b8fe
Author: vnugent <public@vaughnnugent.com>
Date:   Mon Feb 12 22:06:50 2024 -0500

    fix: found the constant time memcompare function

commit 9f85fff3b9f25da7410569ea94f994b88feb3910
Author: vnugent <public@vaughnnugent.com>
Date:   Fri Feb 9 22:48:35 2024 -0500

    feat: added/update MAC functions to sign or verify nip44 payload

commit aa5113741bb419b02d6ea416bba571fa3d65db46
Author: vnugent <public@vaughnnugent.com>
Date:   Wed Feb 7 01:37:53 2024 -0500

    add missing hmac-key output buffer

commit 55f47d22cc9ce4d1e22b70814d608c7ef3b1bbc9
Author: vnugent <public@vaughnnugent.com>
Date:   Sun Feb 4 21:08:13 2024 -0500

    simple bug fixes, and public api argument validation tests

commit 73c5a713fb164ae8b4ac8a891a8020e08eae0a3b
Author: vnugent <public@vaughnnugent.com>
Date:   Fri Feb 2 23:05:48 2024 -0500

    update api to return secpvalidate return code instead of internal return codes

commit 06c73004e1a39a7ea4ea3a89c22dee0f66adb236
Author: vnugent <public@vaughnnugent.com>
Date:   Fri Feb 2 19:25:17 2024 -0500

    change to lgpl license

commit 6e79fdb3b6b6739fc7797d47e55a7691306cf736
Author: vnugent <public@vaughnnugent.com>
Date:   Wed Jan 31 21:30:49 2024 -0500

    move validation macros, and optionally disable them

commit ac1e58837f1ba687939f78b5c03cadd346c10ddd
Author: vnugent <public@vaughnnugent.com>
Date:   Tue Jan 30 12:25:05 2024 -0500

    couple more tests, renable range checks, set flags for all projects

4 files changed, 93 insertions, 69 deletions

diff --git a/CMakeLists.txt b/CMakeLists.txt
index ab86081..f9a1642 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -43,8 +43,7 @@ if(MSVC)
 		/GS		#buffer security check
 		
 		$<$<CONFIG:Debug>:/FC>				#show full path in diagnostics
-		$<$<CONFIG:Debug>:/showIncludes>	#show a list of all included header files during build	
-
+		$<$<CONFIG:Debug>:/showIncludes>	#show a list of all included header files during build
 		
 		$<$<CONFIG:Debug>:/wd4820>	#disable warnings for struct padding and spectre mitigation wuen WX is enabled
 		$<$<CONFIG:Debug>:/wd5045>	#disable warnings for spectre mitigation insertion
@@ -91,6 +90,7 @@ if(NOT SECP256K1_LIB)
 	message(FATAL_ERROR "secp256k1 library not found on local system")
 endif()
 
+message(STATUS "secp256k1 library found at ${SECP256K1_LIB}")
 target_link_libraries(${CMAKE_PROJECT_NAME} ${SECP256K1_LIB})
 
 
@@ -117,12 +117,12 @@ target_link_libraries(${CMAKE_PROJECT_NAME} ${MBEDCRYPTO_LIB} ${MBEDTLS_LIB})
 #TESTS
 if(BUILD_TESTS)
 
-#add test executable and link to library
-add_executable(nctest tests/test.c)
-target_link_libraries(nctest ${CMAKE_PROJECT_NAME})
-#link mbedtls crypto sahred library
-target_link_libraries(nctest ${MBEDCRYPTO_LIB} ${MBEDTLS_LIB})
-target_include_directories(nctest PRIVATE "src")
+	#add test executable and link to library
+	add_executable(nctest tests/test.c)
+	target_link_libraries(nctest ${CMAKE_PROJECT_NAME})
+	#link mbedtls crypto sahred library
+	target_link_libraries(nctest ${MBEDCRYPTO_LIB} ${MBEDTLS_LIB})
+	target_include_directories(nctest PRIVATE "src")
 
 endif()
 
diff --git a/src/noscrypt.c b/src/noscrypt.c
index a24c804..d63fe53 100644
--- a/src/noscrypt.c
+++ b/src/noscrypt.c
@@ -356,7 +356,7 @@ static inline NCResult _encryptEx(
 	DEBUG_ASSERT2(hmacKey != NULL, "Expected valid hmac key buffer")
 
 	//Failure, bail out
-	if ((result = _getMessageKey(mdINfo, ck, args->nonce, NC_ENCRYPTION_NONCE_SIZE, &messageKey)) != NC_SUCCESS)
+	if ((result = _getMessageKey(mdINfo, ck, args->nonce32, NC_ENCRYPTION_NONCE_SIZE, &messageKey)) != NC_SUCCESS)
 	{
 		goto Cleanup;
 	}
@@ -394,7 +394,7 @@ static inline NCResult _decryptEx(
 	DEBUG_ASSERT2(mdInfo != NULL, "Expected valid md info struct")	
 
 	//Failure to get message keys, bail out
-	if ((result = _getMessageKey(mdInfo, ck, args->nonce, NC_ENCRYPTION_NONCE_SIZE, &messageKey)) != NC_SUCCESS)
+	if ((result = _getMessageKey(mdInfo, ck, args->nonce32, NC_ENCRYPTION_NONCE_SIZE, &messageKey)) != NC_SUCCESS)
 	{
 		goto Cleanup;
 	}
@@ -412,6 +412,26 @@ Cleanup:
 	return result;
 }
 
+static inline int _computeHmac(
+	const uint8_t key[NC_HMAC_KEY_SIZE],
+	const NCMacVerifyArgs* args,
+	uint8_t hmacOut[NC_ENCRYPTION_MAC_SIZE]
+) 
+{
+	DEBUG_ASSERT2(key != NULL, "Expected valid hmac key")
+	DEBUG_ASSERT2(args != NULL, "Expected valid mac verification args")
+	DEBUG_ASSERT2(hmacOut != NULL, "Expected valid hmac output buffer")
+
+	return mbedtls_md_hmac(
+		_getSha256MdInfo(),
+		key,
+		NC_HMAC_KEY_SIZE,
+		args->payload,
+		args->payloadSize,
+		hmacOut
+	);
+}
+
 static NCResult _verifyMacEx(
 	const NCContext* ctx,
 	const uint8_t conversationKey[NC_CONV_KEY_SIZE],
@@ -437,7 +457,7 @@ static NCResult _verifyMacEx(
 	result = _getMessageKey(
 		sha256Info,
 		(struct conversation_key*)conversationKey,
-		args->nonce,
+		args->nonce32,
 		NC_ENCRYPTION_NONCE_SIZE,
 		&messageKey
 	);
@@ -453,14 +473,14 @@ static NCResult _verifyMacEx(
 	/*
 	* Compute the hmac of the data using the computed hmac key
 	*/
-	if (mbedtls_md_hmac(sha256Info, keys->hmac_key, NC_HMAC_KEY_SIZE, args->payload, args->payloadSize, hmacOut) != 0)
+	if (_computeHmac(keys->hmac_key, args, hmacOut) != 0)
 	{
 		result = E_OPERATION_FAILED;
 		goto Cleanup;
 	}
 
 	/* constant time compare the macs */
-	result = mbedtls_ct_memcmp(hmacOut, args->mac, NC_ENCRYPTION_MAC_SIZE) == 0 ? NC_SUCCESS : E_OPERATION_FAILED;
+	result = mbedtls_ct_memcmp(hmacOut, args->mac32, NC_ENCRYPTION_MAC_SIZE) == 0 ? NC_SUCCESS : E_OPERATION_FAILED;
 
 Cleanup:
 	/* Clean up sensitive data */
@@ -529,7 +549,7 @@ NC_EXPORT NCResult NC_CC NCGetPublicKey(
 {
 	int result;
 	secp256k1_keypair keyPair;
-	secp256k1_xonly_pubkey xonly;	
+	secp256k1_xonly_pubkey xonly;
 
 	CHECK_NULL_ARG(ctx, 0)
 	CHECK_INVALID_ARG(ctx->secpCtx, 0)
@@ -752,15 +772,12 @@ NC_EXPORT NCResult NC_CC NCGetConversationKey(
 {
 	NCResult result;
 	struct shared_secret sharedSecret;
-	const mbedtls_md_info_t* mdInfo;
 
 	CHECK_NULL_ARG(ctx, 0)
 	CHECK_INVALID_ARG(ctx->secpCtx, 0)
 	CHECK_NULL_ARG(sk, 1)
 	CHECK_NULL_ARG(pk, 2)
-	CHECK_NULL_ARG(conversationKey, 3)	
-	
-	mdInfo = _getSha256MdInfo();
+	CHECK_NULL_ARG(conversationKey, 3)
 
 	//Compute the shared point
 	if ((result = _computeSharedSecret(ctx, sk, pk, &sharedSecret)) != NC_SUCCESS)
@@ -770,7 +787,7 @@ NC_EXPORT NCResult NC_CC NCGetConversationKey(
 
 	result = _computeConversationKey(
 		ctx, 
-		mdInfo, 
+		_getSha256MdInfo(),
 		&sharedSecret, 
 		(struct conversation_key*)conversationKey
 	);
@@ -798,7 +815,7 @@ NC_EXPORT NCResult NC_CC NCEncryptEx(
 	//Validte ciphertext/plaintext
 	CHECK_INVALID_ARG(args->inputData, 3)
 	CHECK_INVALID_ARG(args->outputData, 3)
-	CHECK_INVALID_ARG(args->nonce, 3)
+	CHECK_INVALID_ARG(args->nonce32, 3)
 	CHECK_ARG_RANGE(args->dataSize, NIP44_MIN_ENC_MESSAGE_SIZE, NIP44_MAX_ENC_MESSAGE_SIZE, 3)	
 
 	return _encryptEx(
@@ -833,7 +850,7 @@ NC_EXPORT NCResult NC_CC NCEncrypt(
 	//Validate input/output data
 	CHECK_INVALID_ARG(args->inputData, 4)
 	CHECK_INVALID_ARG(args->outputData, 4)
-	CHECK_INVALID_ARG(args->nonce, 4)
+	CHECK_INVALID_ARG(args->nonce32, 4)
 	CHECK_ARG_RANGE(args->dataSize, NIP44_MIN_ENC_MESSAGE_SIZE, NIP44_MAX_ENC_MESSAGE_SIZE, 4)
 
 	mdInfo = _getSha256MdInfo();
@@ -874,7 +891,7 @@ NC_EXPORT NCResult NC_CC NCDecryptEx(
 	//Validte ciphertext/plaintext
 	CHECK_INVALID_ARG(args->inputData, 2)
 	CHECK_INVALID_ARG(args->outputData, 2)
-	CHECK_INVALID_ARG(args->nonce, 2)
+	CHECK_INVALID_ARG(args->nonce32, 2)
 	CHECK_ARG_RANGE(args->dataSize, NIP44_MIN_ENC_MESSAGE_SIZE, NIP44_MAX_ENC_MESSAGE_SIZE, 2)
 
 	return _decryptEx(
@@ -906,7 +923,7 @@ NC_EXPORT NCResult NC_CC NCDecrypt(
 	//Validte ciphertext/plaintext
 	CHECK_INVALID_ARG(args->inputData, 3)
 	CHECK_INVALID_ARG(args->outputData, 3)
-	CHECK_INVALID_ARG(args->nonce, 3)
+	CHECK_INVALID_ARG(args->nonce32, 3)
 	CHECK_ARG_RANGE(args->dataSize, NIP44_MIN_ENC_MESSAGE_SIZE, NIP44_MAX_ENC_MESSAGE_SIZE, 3)
 
 	mdInfo = _getSha256MdInfo();
@@ -949,14 +966,13 @@ NC_EXPORT NCResult NCComputeMac(
 	/*
 	* Compute the hmac of the data using the supplied hmac key
 	*/
-	return mbedtls_md_hmac(
-		_getSha256MdInfo(), 
-		hmacKey, 
-		NC_HMAC_KEY_SIZE, 
-		payload, 
-		payloadSize, 
-		hmacOut
-	) == 0 ? NC_SUCCESS : E_OPERATION_FAILED;
+
+	NCMacVerifyArgs args = {
+		.payload = payload,
+		.payloadSize = payloadSize
+	};
+
+	return _computeHmac(hmacKey, &args, hmacOut) == 0 ? NC_SUCCESS : E_OPERATION_FAILED;
 }
 
 
@@ -971,9 +987,9 @@ NC_EXPORT NCResult NC_CC NCVerifyMacEx(
 	CHECK_NULL_ARG(conversationKey, 1)
 	CHECK_NULL_ARG(args, 2)
 
-	CHECK_INVALID_ARG(args->mac, 2)
+	CHECK_INVALID_ARG(args->mac32, 2)
 	CHECK_INVALID_ARG(args->payload, 2)
-	CHECK_INVALID_ARG(args->nonce, 2)
+	CHECK_INVALID_ARG(args->nonce32, 2)
 	CHECK_ARG_RANGE(args->payloadSize, NIP44_MIN_ENC_MESSAGE_SIZE, NIP44_MAX_ENC_MESSAGE_SIZE, 2)	
 
 	return _verifyMacEx(ctx, conversationKey, args);
@@ -992,9 +1008,9 @@ NC_EXPORT NCResult NC_CC NCVerifyMac(
 	CHECK_NULL_ARG(pk, 2)
 	CHECK_NULL_ARG(args, 3)
 
-	CHECK_INVALID_ARG(args->mac, 3)
+	CHECK_INVALID_ARG(args->mac32, 3)
 	CHECK_INVALID_ARG(args->payload, 3)
-	CHECK_INVALID_ARG(args->nonce, 3)
+	CHECK_INVALID_ARG(args->nonce32, 3)
 	CHECK_ARG_RANGE(args->payloadSize, NIP44_MIN_ENC_MESSAGE_SIZE, NIP44_MAX_ENC_MESSAGE_SIZE, 3)
 
 	NCResult result;
diff --git a/src/noscrypt.h b/src/noscrypt.h
index f7265ad..0f9344a 100644
--- a/src/noscrypt.h
+++ b/src/noscrypt.h
@@ -150,10 +150,8 @@ data buffers and required nonce used for the stream cipher.
 */
 typedef struct nc_encryption_struct {
 
-	/*
-	* The nonce used for the stream cipher.
-	*/
-	uint8_t nonce[NC_ENCRYPTION_NONCE_SIZE];
+	/* The nonce used for the stream cipher. */
+	const uint8_t* nonce32;
 
 	/* The input data buffer to encrypt/decrypt */
 	const void* inputData;
@@ -175,10 +173,10 @@ typedef struct nc_encryption_struct {
 typedef struct nc_mac_verify {
 
 	/* The message authentication code certifying the Nip44 payload */
-	uint8_t mac[NC_ENCRYPTION_MAC_SIZE];
+	const uint8_t* mac32;
 
 	/* The nonce used for the original message encryption */
-	uint8_t nonce[NC_ENCRYPTION_NONCE_SIZE];
+	const uint8_t* nonce32;
 
 	/* The message payload data */
 	const uint8_t* payload;
diff --git a/tests/test.c b/tests/test.c
index 09e195b..e3188dc 100644
--- a/tests/test.c
+++ b/tests/test.c
@@ -272,12 +272,20 @@ static int TestPublicApiArgumentValidation(void)
     uint8_t sig64[64];
     NCSecretKey secKey;
     NCPublicKey pubKey;
-    NCCryptoData cryptoData;
     uint8_t hmacKeyOut[NC_HMAC_KEY_SIZE];
+    uint8_t nonce[NC_ENCRYPTION_NONCE_SIZE];
+
+    NCCryptoData cryptoData = {
+        .dataSize = sizeof(zero32),
+        .inputData = zero32,
+        .outputData = sig64,    //just an arbitrary writeable buffer 
+        .nonce32 = nonce
+    };
 
     PRINTL("TEST: Public API argument validation tests")
 
     FillRandomData(ctxRandom, 32);
+    FillRandomData(nonce, sizeof(nonce));
 
     //Test null context
     TEST(NCInitContext(NULL, ctxRandom), ARG_ERROR_POS_0)
@@ -326,13 +334,7 @@ static int TestPublicApiArgumentValidation(void)
 	TEST(NCSignDigest(&ctx, &secKey, zero32, NULL, sig64), ARG_ERROR_POS_3)
     TEST(NCSignDigest(&ctx, &secKey, zero32, zero32, NULL), ARG_ERROR_POS_4)
 
-
-    //Encrypt
-    cryptoData.dataSize = 32;
-    cryptoData.inputData = zero32;
-    cryptoData.outputData = sig64;
-    FillRandomData(&cryptoData.nonce, 32);
-
+    //Test null encrypt args
     TEST(NCEncrypt(NULL, &secKey, &pubKey, hmacKeyOut, &cryptoData), ARG_ERROR_POS_0)
     TEST(NCEncrypt(&ctx, NULL, &pubKey, hmacKeyOut, &cryptoData), ARG_ERROR_POS_1)
 	TEST(NCEncrypt(&ctx, &secKey, NULL, hmacKeyOut, &cryptoData), ARG_ERROR_POS_2)
@@ -387,9 +389,12 @@ static int TestPublicApiArgumentValidation(void)
     }
 
     {
-        NCMacVerifyArgs macArgs;
-        macArgs.payload = zero32;
-        macArgs.payloadSize = 32;
+        NCMacVerifyArgs macArgs = {
+            .payload = zero32,
+            .payloadSize = 32,
+            .mac32 = zero32,
+            .nonce32 = zero32
+        };
 
         TEST(NCVerifyMac(NULL, &secKey, &pubKey, &macArgs), ARG_ERROR_POS_0)
         TEST(NCVerifyMac(&ctx, NULL, &pubKey, &macArgs), ARG_ERROR_POS_1)
@@ -450,21 +455,38 @@ static int TestCorrectEncryption(NCContext* context)
     
     NCSecretKey secKey2;
     NCPublicKey pubKey2;
-    
-    NCCryptoData cryptoData;
-    NCMacVerifyArgs macVerifyArgs;
+  
     uint8_t hmacKeyOut[NC_HMAC_KEY_SIZE];
+    uint8_t nonce[NC_ENCRYPTION_NONCE_SIZE];
+    uint8_t mac[NC_ENCRYPTION_MAC_SIZE];
 
     uint8_t plainText[TEST_ENC_DATA_SIZE];
     uint8_t cipherText[TEST_ENC_DATA_SIZE];
     uint8_t decryptedText[TEST_ENC_DATA_SIZE];
 
+    /* setup the crypto data structure */
+    NCCryptoData cryptoData = {
+        .dataSize = TEST_ENC_DATA_SIZE,
+        .inputData = plainText,
+        .outputData = cipherText,
+        .nonce32 = nonce
+    };
+
+    NCMacVerifyArgs macVerifyArgs = {
+        .nonce32 = nonce,
+        .mac32 = mac,
+        .payload = cipherText,
+        .payloadSize = TEST_ENC_DATA_SIZE
+    };
+
     PRINTL("TEST: Correct encryption")
 
     /* init a sending and receiving key */
     FillRandomData(&secKey1, sizeof(NCSecretKey));
     FillRandomData(&secKey2, sizeof(NCSecretKey));
     FillRandomData(plainText, sizeof(plainText));
+    /* nonce is shared */
+    FillRandomData(nonce, sizeof(nonce));
 
     ENSURE(NCValidateSecretKey(context, &secKey1) == 1);
     ENSURE(NCValidateSecretKey(context, &secKey2) == 1);
@@ -472,17 +494,10 @@ static int TestCorrectEncryption(NCContext* context)
     ENSURE(NCGetPublicKey(context, &secKey1, &pubKey1) == NC_SUCCESS);
     ENSURE(NCGetPublicKey(context, &secKey2, &pubKey2) == NC_SUCCESS);
 
-    /* setup the crypto data structure */
-    cryptoData.dataSize = TEST_ENC_DATA_SIZE;
-    cryptoData.inputData = plainText;
-    cryptoData.outputData = cipherText;
-    /* add a random nonce, we will keep it stored in the nonce field of the struct */
-    FillRandomData(cryptoData.nonce, NC_ENCRYPTION_NONCE_SIZE);
-
     /* Try to encrypt the data from sec1 to pub2 */
     TEST(NCEncrypt(context, &secKey1, &pubKey2, hmacKeyOut, &cryptoData), NC_SUCCESS);
 
-    //swap texts
+    //swap cipher and plain text for decryption
     cryptoData.inputData = cipherText;
     cryptoData.outputData = decryptedText;
 
@@ -492,13 +507,8 @@ static int TestCorrectEncryption(NCContext* context)
     /* Ensure the decrypted text matches the original */
     TEST(memcmp(plainText, decryptedText, sizeof(plainText)), 0);
 
-    /* Also try to validate the payload mac */
-    memmove(macVerifyArgs.nonce, cryptoData.nonce, NC_ENCRYPTION_NONCE_SIZE);
-    macVerifyArgs.payload = cipherText;
-    macVerifyArgs.payloadSize = TEST_ENC_DATA_SIZE;
-
     /* Compute message mac on ciphertext */
-    TEST(NCComputeMac(context, hmacKeyOut, cipherText, sizeof(cipherText), macVerifyArgs.mac), NC_SUCCESS);
+    TEST(NCComputeMac(context, hmacKeyOut, cipherText, sizeof(cipherText), mac), NC_SUCCESS);
 
     /* Verify the mac */
     TEST(NCVerifyMac(context, &secKey1, &pubKey2, &macVerifyArgs), NC_SUCCESS);