Squashed commit of the following:

commit 942aed8a4e7c173a2c9423829c2b38087cbd49e4
Author: vnugent <public@vaughnnugent.com>
Date:   Tue Aug 6 20:54:03 2024 -0400

    chore: update changelog and mbedtls headers

commit 3b97f84fd0477eafcd6567eb8597b213e4136664
Author: vnugent <public@vaughnnugent.com>
Date:   Tue Aug 6 19:57:10 2024 -0400

    update libsecp256k1 to v0.5.1

commit 7989a2660997b909e0b99fc1dfb3bcfbb0528df3
Author: vnugent <public@vaughnnugent.com>
Date:   Tue Aug 6 19:42:25 2024 -0400

    update openssl to 3.3.1

commit e949ae5aa1fd25d4d11fe31e30b7d82ae7778dc2
Author: vnugent <public@vaughnnugent.com>
Date:   Mon Aug 5 18:01:03 2024 -0400

    fix: Find and fix openssl encryption bug

commit a60a3e1ca1d99d655c0cfc96e3952c371e8a8677
Author: vnugent <public@vaughnnugent.com>
Date:   Sun Aug 4 15:27:06 2024 -0400

    cleanup comments + return codes

commit 2aa7f4b6cdb2e0e8990e7177476f4104fd2e2b17
Author: vnugent <public@vaughnnugent.com>
Date:   Sat Jul 27 22:20:53 2024 -0400

    fix codeberg url

commit 1640f79776c6b291b49a39a6128c05888fc4153e
Author: vnugent <public@vaughnnugent.com>
Date:   Sat Jul 27 00:05:07 2024 -0400

    fix: Potential overflow in nip44 padding calculation

commit 07de078a3b5b7b0043d9f81bb5a9e750a3a0c7c1
Author: vnugent <public@vaughnnugent.com>
Date:   Fri Jul 26 23:37:15 2024 -0400

    refactor: Span invasion, checks and fix some evp api

commit 54f520e4bfc0fe23e2719d44b09739aa8709451c
Author: vnugent <public@vaughnnugent.com>
Date:   Tue Jul 23 19:55:13 2024 -0400

    latest changes

commit 12feb33dba2061415d6f39fa59dec16fafcda2a0
Author: vnugent <public@vaughnnugent.com>
Date:   Sun Jul 21 17:51:04 2024 -0400

    Push latest changes, patches, and internal upgrades

commit ffe42b6858f112a00405be4f0605ab1163063749
Author: vnugent <public@vaughnnugent.com>
Date:   Sat Jul 13 22:13:13 2024 -0400

    test: Add decryption test cases and fixes

commit 5dfafbc5a9214587533ec8b1dae2a962118d3650
Author: vnugent <public@vaughnnugent.com>
Date:   Fri Jul 12 22:14:00 2024 -0400

    feat: add decryption functionality to public api

commit 8df8c5aed4ac626171b451b5422c3b207e88000b
Author: vnugent <public@vaughnnugent.com>
Date:   Thu Jul 11 21:39:39 2024 -0400

    feat: Update sidecar utils library

commit 23fe6e8c8596333c2183f0f4389817087442c551
Author: vnugent <public@vaughnnugent.com>
Date:   Fri Jul 5 00:03:48 2024 -0400

    push latest utils and changes

commit dc71f861df8929deee300368b88ef47d45560695
Author: vnugent <public@vaughnnugent.com>
Date:   Mon Jul 1 15:05:34 2024 -0400

    fix: #7 fix confusing inline functions

commit 90166048046d2511f0bb74f8880180e82466d4c0
Author: vnugent <public@vaughnnugent.com>
Date:   Tue Jun 18 21:22:37 2024 -0400

    push pending changes

commit 461dd71069d0c0250752ac1256160605c33a6243
Author: vnugent <public@vaughnnugent.com>
Date:   Tue Jun 11 15:44:28 2024 -0400

    feat!: #4 Close #4. Add public nip04 support to api

commit a74f96251bcc81fb2c94fe75dd6f8043fd35fe0b
Merge: 1c26ef8 51d0aff
Author: vnugent <public@vaughnnugent.com>
Date:   Wed May 29 13:37:00 2024 -0400

    Merge branch 'master' into develop

commit 1c26ef86a04690120f4f752c7c5018a570ec5880
Author: vnugent <public@vaughnnugent.com>
Date:   Wed May 29 13:34:20 2024 -0400

    missed extra argument

commit 88c9095743a12cf8fc1793c607ba3a1e4fa86483
Author: vnugent <public@vaughnnugent.com>
Date:   Wed May 29 13:25:51 2024 -0400

    refactor!: return NC_SUCCESS when validating secret key

commit 718be80a4810b9352de7eb0707da54020aa6b649
Author: vnugent <public@vaughnnugent.com>
Date:   Mon May 27 14:52:41 2024 -0400

    fix: Properly build mbedtls & cmake fixes

commit a8a6efb2319f739e5faae550561dc27d9dd1e88d
Author: vnugent <public@vaughnnugent.com>
Date:   Sun May 26 17:39:40 2024 -0400

    chore: Update libs, reorder files, internalize private headers

commit 72e1b7be4031e2fd4d258fcf434ad049c0029201
Author: vnugent <public@vaughnnugent.com>
Date:   Sun May 26 13:39:08 2024 -0400

    fix: Add c++ extern prototypes in noscrypt.h

commit aeaac8d328b75911541be64d6f09d58fca294a08
Author: vnugent <public@vaughnnugent.com>
Date:   Sun May 26 11:47:17 2024 -0400

    refactor: Dep update, openssl chacha20 added

commit 86b02540cce6015cfe4a2a56499a9a2f45d4e368
Author: vnugent <public@vaughnnugent.com>
Date:   Sat May 18 12:24:17 2024 -0400

    refactor: Remove NCContext structure definition

commit d09d9330415d463ca19be9394b02ce11b3366f7e
Author: vnugent <public@vaughnnugent.com>
Date:   Mon May 13 22:33:50 2024 -0400

    fix: update mbedtls inline issue includes

commit 7838cb4bb15d4f453f92f56ece75e2b03986fe42
Author: vnugent <public@vaughnnugent.com>
Date:   Mon May 13 22:29:16 2024 -0400

    fix: force fPIC for secp256k1 targets

commit d76f7708bc6ae81a638ca708230ac9153ac754e2
Merge: aa8033d a526139
Author: vnugent <public@vaughnnugent.com>
Date:   Sun May 12 00:37:01 2024 -0400

    Merge branch 'master' into develop

commit aa8033d4dbfebeb72b6fd7a0cd218ebde0eb54dd
Author: vnugent <public@vaughnnugent.com>
Date:   Sun May 12 00:34:20 2024 -0400

    Final overview and test before tag

commit 4e3ead2cf1d3068e77f0959dfdc17e20e9102a0f
Merge: 2cee801 872c49d
Author: vnugent <public@vaughnnugent.com>
Date:   Mon May 6 22:08:09 2024 -0400

    Merge branch 'master' into develop

commit 2cee801979bfbcb3b0e53f592ce8c779b57cb679
Author: vnugent <public@vaughnnugent.com>
Date:   Mon May 6 22:02:39 2024 -0400

    Ensure static and dynamic libs get same args

commit f533694023133552d0d42933d779c95a5854343f
Author: vnugent <public@vaughnnugent.com>
Date:   Mon May 6 21:50:29 2024 -0400

    feat: CMake install & fetch-content test & updates

commit 940ff20348b13d0bc30d9e9f4289dd6de20b16ba
Author: vnugent <public@vaughnnugent.com>
Date:   Sun May 5 14:07:28 2024 -0400

    codeberg readonly push

commit b34ed055c0b7d143561ce8798e0a95313b9224bd
Merge: 0a40e20 e737556
Author: vnugent <public@vaughnnugent.com>
Date:   Sat May 4 14:06:45 2024 -0400

    Merge branch 'master' into develop

commit 0a40e209d03e8ff9b6f81cd5969d3e845c633bfc
Author: vnugent <public@vaughnnugent.com>
Date:   Sat May 4 13:55:19 2024 -0400

    ci: Force disable testing for win ci builds

commit 55fae189fffc86f07a3448370f0a746670819712
Author: vnugent <public@vaughnnugent.com>
Date:   Thu May 2 21:54:35 2024 -0400

    feat: Working and tested openssl impl & defaults

commit 6ff8bb11774c51fd341b7699a3938fd894995fbf
Author: vnugent <public@vaughnnugent.com>
Date:   Thu Apr 25 17:45:42 2024 -0400

    refactor: Finish support and testing for mbedtls

commit 7cb7a93de4f6f5e741bc5129e3d928e44f050930
Author: vnugent <public@vaughnnugent.com>
Date:   Tue Apr 23 18:19:31 2024 -0400

    refactor!: MbedTLS on Windows, switch to uint32

commit 30e8dda6cbea86bdee6d5dfe48514385d3b9f81b
Author: vnugent <public@vaughnnugent.com>
Date:   Tue Apr 23 14:48:05 2024 -0400

    refactor: Crypto dep redesign working on Windows

commit d09c6c1bd5da3e2d79351daeba304ca99976a726
Author: vnugent <public@vaughnnugent.com>
Date:   Thu Apr 18 00:28:51 2024 -0400

    refactor!: Pushing what I have to dev

commit 54e06ada7d624ed0d28c6a6db04a149708841bf8
Author: vnugent <public@vaughnnugent.com>
Date:   Sat Apr 13 01:24:00 2024 -0400

    fix: convert constants to hex, inline macro, ParseErrorCode

commit 4215e3100d9a0d23119080d09638fa5b60d0c6d4
Merge: d3328f4 7485aa5
Author: vnugent <public@vaughnnugent.com>
Date:   Wed Apr 3 18:26:30 2024 -0400

    Merge branch 'master' into develop

commit d3328f4152b22b28f24c43dda62464287f1efff5
Author: vnugent <public@vaughnnugent.com>
Date:   Wed Apr 3 18:22:56 2024 -0400

    build: Included dependency and versions in client builds

commit b11bc0bac955fd5c6db65f0da48456bf5e748805
Author: vnugent <public@vaughnnugent.com>
Date:   Wed Apr 3 18:10:08 2024 -0400

    fix: Fix c89 compatabilty comments and struct assignment

commit 9915bd41799a72413e6b400e150aa9f5fa797e25
Merge: 8e3d6ea 5184d7d
Author: vnugent <public@vaughnnugent.com>
Date:   Sat Mar 30 09:57:30 2024 -0400

    Merge branch 'master' into develop

commit 8e3d6ea5e3c83fe42cb904b6ccc4fe2b73f76aae
Author: vnugent <public@vaughnnugent.com>
Date:   Sat Mar 30 09:52:55 2024 -0400

    refactor!: Some api (struct) changes and updated tests

commit e88e8420520204e20802516f01d4488bb0b1d6ea
Merge: 490dfee 21f6c0a
Author: vnugent <public@vaughnnugent.com>
Date:   Sun Mar 3 15:02:34 2024 -0500

    Merge branch 'master' into develop

commit 490dfee4ef22479009627435c6ad728c3cbbab54
Author: vnugent <public@vaughnnugent.com>
Date:   Sun Mar 3 14:59:25 2024 -0500

    test: #3 tests for encryption/description and Macs

commit efa97490b7ed47f4e2f05bee52e2b33e14e439e6
Merge: 1b84e3c 120022a
Author: vnugent <public@vaughnnugent.com>
Date:   Sun Mar 3 14:55:48 2024 -0500

    merge master

commit 1b84e3c7c2e55b1ff9ffdd09b66873e11c131441
Author: vnugent <public@vaughnnugent.com>
Date:   Sat Mar 2 22:57:36 2024 -0500

    fix: #2 constent usage of sizeof() operator on struct types

commit 9de5a214c66adea0ef2d0bac63c59449de202a88
Author: vnugent <public@vaughnnugent.com>
Date:   Fri Mar 1 14:30:36 2024 -0500

    perf: avoid nc_key struct copy, cast and verify instead

commit b917b761120ed684af28d0707673ffadcf14b8fe
Author: vnugent <public@vaughnnugent.com>
Date:   Mon Feb 12 22:06:50 2024 -0500

    fix: found the constant time memcompare function

commit 9f85fff3b9f25da7410569ea94f994b88feb3910
Author: vnugent <public@vaughnnugent.com>
Date:   Fri Feb 9 22:48:35 2024 -0500

    feat: added/update MAC functions to sign or verify nip44 payload

commit aa5113741bb419b02d6ea416bba571fa3d65db46
Author: vnugent <public@vaughnnugent.com>
Date:   Wed Feb 7 01:37:53 2024 -0500

    add missing hmac-key output buffer

commit 55f47d22cc9ce4d1e22b70814d608c7ef3b1bbc9
Author: vnugent <public@vaughnnugent.com>
Date:   Sun Feb 4 21:08:13 2024 -0500

    simple bug fixes, and public api argument validation tests

commit 73c5a713fb164ae8b4ac8a891a8020e08eae0a3b
Author: vnugent <public@vaughnnugent.com>
Date:   Fri Feb 2 23:05:48 2024 -0500

    update api to return secpvalidate return code instead of internal return codes

commit 06c73004e1a39a7ea4ea3a89c22dee0f66adb236
Author: vnugent <public@vaughnnugent.com>
Date:   Fri Feb 2 19:25:17 2024 -0500

    change to lgpl license

commit 6e79fdb3b6b6739fc7797d47e55a7691306cf736
Author: vnugent <public@vaughnnugent.com>
Date:   Wed Jan 31 21:30:49 2024 -0500

    move validation macros, and optionally disable them

commit ac1e58837f1ba687939f78b5c03cadd346c10ddd
Author: vnugent <public@vaughnnugent.com>
Date:   Tue Jan 30 12:25:05 2024 -0500

    couple more tests, renable range checks, set flags for all projects

1 files changed, 910 insertions, 0 deletions

diff --git a/src/noscryptutil.c b/src/noscryptutil.c
new file mode 100644
index 0000000..4cee2c3
--- /dev/null
+++ b/src/noscryptutil.c
@@ -0,0 +1,910 @@
+/*
+* Copyright (c) 2024 Vaughn Nugent
+*
+* Package: noscrypt
+* File: noscryptutil.h
+*
+* This library is free software; you can redistribute it and/or
+* modify it under the terms of the GNU Lesser General Public License
+* as published by the Free Software Foundation; either version 2.1
+* of the License, or  (at your option) any later version.
+*
+* This library is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+* Lesser General Public License for more details.
+*
+* You should have received a copy of the GNU Lesser General Public License
+* along with noscrypt. If not, see http://www.gnu.org/licenses/.
+*/
+
+
+#include <stdlib.h>
+
+#include "nc-util.h"
+#include "nc-crypto.h"
+
+#include <noscryptutil.h>
+
+/*
+* Validation macros
+*/
+
+#ifdef NC_EXTREME_COMPAT
+	#error "Utilities library must be disabled when using extreme compat mode"
+#endif /* NC_EXTREME_COMPAT */
+
+#define MIN_PADDING_SIZE		0x20u
+#define NIP44_VERSION_SIZE		0x01u
+#define NIP44_PT_LEN_SIZE		sizeof(uint16_t)
+
+/*
+* minimum size for a valid nip44 payload
+* 1 byte version + 32 byte nonce + 32 byte mac + 2 byte ptSize + 32bytes minimum length
+*/
+#define NIP44_MIN_PAYLOAD_SIZE  (NIP44_VERSION_SIZE + 0x20 + 0x02 + 0x20 + 0x02)
+
+/*
+* Max payload size is the maximum size of the encrypted message
+* 1 byte version + 32 byte nonce + 32 byte mac + maximum ciphertext size
+*/
+#define NIP44_MAX_PAYLOAD_SIZE (NIP44_VERSION_SIZE + 0x20 + 0x20 + NIP44_MAX_ENC_MESSAGE_SIZE)
+
+/*
+* The minimum ciphertext size is the minimum padded size + the minimum
+* size of the plaintext length field
+*/
+#define NIP44_MIN_CIPHERTEXT_SIZE (MIN_PADDING_SIZE + NIP44_PT_LEN_SIZE)
+
+
+#define _nc_mem_free(x) if(x != NULL) { free(x); x = NULL; }
+#define _nc_mem_alloc(elements, size) calloc(elements, size);
+#define ZERO_FILL ncCryptoSecureZero
+
+#ifndef NC_INPUT_VALIDATION_OFF
+	#define CHECK_INVALID_ARG(x, argPos) if(x == NULL) return NCResultWithArgPosition(E_INVALID_ARG, argPos);
+	#define CHECK_NULL_ARG(x, argPos) if(x == NULL) return NCResultWithArgPosition(E_NULL_PTR, argPos);
+	#define CHECK_ARG_RANGE(x, min, max, argPos) if(x < min || x > max) return NCResultWithArgPosition(E_ARGUMENT_OUT_OF_RANGE, argPos);
+	#define CHECK_ARG_IS(exp, argPos) if(!(exp)) return NCResultWithArgPosition(E_INVALID_ARG, argPos);
+#else
+	/* empty macros */
+	#define CHECK_INVALID_ARG(x)
+	#define CHECK_NULL_ARG(x, argPos) 
+	#define CHECK_ARG_RANGE(x, min, max, argPos) 
+	#define CHECK_ARG_IS(is, expected, argPos)
+#endif /* !NC_DISABLE_INPUT_VALIDATION */
+
+#ifdef _NC_IS_WINDOWS
+	
+	#include <math.h>
+
+	/* performs a log2 on integer types */
+	#define _math_int_log2(x)	(uint32_t)log2((double)x)
+
+#else
+	/* 
+	* GCC/clang does not expose log2 so we can use the __builtin_clz
+	* to find leading zeros of an integer and subtract that from 31 
+	* (bit positions) for int32 
+	*/
+	static _nc_fn_inline uint32_t _math_int_log2(uint32_t val)
+	{
+		DEBUG_ASSERT(val < UINT32_MAX);
+
+		return 31 - __builtin_clz(val);
+	}
+#endif
+
+/* Currently were on nip44 version 2 */
+static const uint8_t Nip44VersionValue[1] = { 0x02u };
+
+struct cipher_buffer_state {
+	
+	cspan_t input;
+	span_t output;
+
+	cspan_t actualOutput;
+};
+
+struct nc_util_enc_struct {
+
+	uint32_t _flags;
+
+	NCEncryptionArgs encArgs;
+
+	struct cipher_buffer_state buffer;
+};
+
+static _nc_fn_inline span_t _ncUtilAllocSpan(uint32_t count, size_t size)
+{
+	span_t span;
+
+#if SIZE_MAX < UINT32_MAX
+
+	if (count > SIZE_MAX)
+	{
+		return span;
+	}
+
+#endif
+
+	span.data = _nc_mem_alloc((size_t)count, size);
+	span.size = (uint32_t)count;
+
+	return span;
+}
+
+static _nc_fn_inline void _ncUtilZeroSpan(span_t span)
+{
+	ZERO_FILL(span.data, span.size);
+}
+
+static _nc_fn_inline void _ncUtilFreeSpan(span_t span)
+{
+	_nc_mem_free(span.data);
+}
+
+static _nc_fn_inline uint32_t _calcNip44PtPadding(uint32_t plaintextSize)
+{
+	uint32_t chunk, nextPower, factor;
+
+	/*
+	* Taken from https://github.com/nostr-protocol/nips/blob/master/44.md
+	*
+	* I believe the idea is to add consisten padding for some better 
+	* disgusing of the plainText data.
+	*/
+
+	if (plaintextSize <= MIN_PADDING_SIZE)
+	{
+		return MIN_PADDING_SIZE;
+	}
+
+	/* Safe to subtract because pt > 0 */
+	nextPower = _math_int_log2(plaintextSize - 1);
+
+	nextPower += 1u;
+
+	nextPower = 1 << nextPower;
+
+	if (nextPower <= 256u)
+	{
+		chunk = 32u;
+	}
+	else 
+	{
+		chunk = nextPower / 8u;
+	}
+	
+	factor = plaintextSize - 1;
+
+	factor /= chunk;
+
+	factor += 1;
+
+	return chunk * factor;
+}
+
+static _nc_fn_inline uint32_t _calcNip44TotalOutSize(uint32_t inputSize)
+{
+	uint32_t bufferSize;
+
+	/*
+	* Buffer size for nip44 is calculated as follows:
+	*   1 byte for the version
+	*   32 bytes for the nonce
+	*   2 bytes for the length of the plainText
+	*   ... padding size
+	*   32 bytes for the MAC
+	*/
+
+	bufferSize = NIP44_VERSION_SIZE;
+
+	bufferSize += NC_ENCRYPTION_NONCE_SIZE;
+
+	bufferSize += NIP44_PT_LEN_SIZE;
+
+	bufferSize += _calcNip44PtPadding(inputSize);
+
+	bufferSize += NC_ENCRYPTION_MAC_SIZE;
+
+	return bufferSize;
+}
+
+static _nc_fn_inline span_t _nip44GetMacData(span_t payload)
+{
+	DEBUG_ASSERT(payload.size > NIP44_VERSION_SIZE + NC_ENCRYPTION_MAC_SIZE);
+
+	/*
+	* The nip44 mac is computed over the nonce+encrypted ciphertext
+	* 
+	* the ciphertext is the entire message buffer, so it includes 
+	* version, nonce, data, padding, and mac space available.
+	* 
+	* This function will return a span that points to the nonce+data 
+	* segment of the buffer for mac computation.
+	* 
+	* The nonce sits directly after the version byte, ct is after,
+	* and the remaining 32 bytes are for the mac. So that means 
+	* macData = ct.size - version.size + mac.size
+	*/
+
+	return ncSpanSlice(
+		payload,
+		NIP44_VERSION_SIZE,
+		payload.size - (NIP44_VERSION_SIZE + NC_ENCRYPTION_MAC_SIZE)
+	);
+}
+
+static _nc_fn_inline span_t _nip44GetMacOutput(span_t payload)
+{
+	DEBUG_ASSERT(payload.size > NC_ENCRYPTION_MAC_SIZE);
+
+	/*
+	* Mac is the final 32 bytes of the ciphertext buffer
+	*/
+	return ncSpanSlice(
+		payload,
+		payload.size - NC_ENCRYPTION_MAC_SIZE,
+		NC_ENCRYPTION_MAC_SIZE
+	);
+}
+
+static _nc_fn_inline int _nip44ParseSegments(
+	cspan_t payload, 
+	cspan_t* nonce,
+	cspan_t* mac,
+	cspan_t* macData,
+	cspan_t* cipherText
+)
+{
+	if (payload.size < NIP44_MIN_PAYLOAD_SIZE)
+	{
+		return 0;
+	}
+
+	/* slice after the version and before the mac segments */
+	*nonce = ncSpanSliceC(
+		payload,
+		NIP44_VERSION_SIZE,
+		NC_ENCRYPTION_NONCE_SIZE
+	);
+
+	/*
+	* Mac is the final 32 bytes of the ciphertext buffer
+	*/
+	*mac = ncSpanSliceC(
+		payload,
+		payload.size - NC_ENCRYPTION_MAC_SIZE,
+		NC_ENCRYPTION_MAC_SIZE
+	);
+
+	/*
+	* The mac data is the nonce+ct segment of the buffer for mac computation.
+	*/
+	*macData = ncSpanSliceC(
+		payload,
+		NIP44_VERSION_SIZE,
+		payload.size - (NIP44_VERSION_SIZE + NC_ENCRYPTION_MAC_SIZE)
+	);
+
+	/*
+	* Ciphertext is after the nonce segment and before the mac segment
+	*/
+	*cipherText = ncSpanSliceC(
+		payload,
+		NIP44_VERSION_SIZE + NC_ENCRYPTION_NONCE_SIZE,
+		payload.size - (NIP44_VERSION_SIZE + NC_ENCRYPTION_NONCE_SIZE + NC_ENCRYPTION_MAC_SIZE)
+	);
+
+	return 1;
+}
+
+
+static _nc_fn_inline void _cipherPublishOutput(NCUtilCipherContext* buffer, uint32_t offset, uint32_t size)
+{
+	span_t slice;
+
+	DEBUG_ASSERT(ncSpanIsValid(buffer->buffer.output));
+
+	if (size == 0)
+	{
+		ncSpanInitC(&buffer->buffer.actualOutput, NULL, 0);
+	}
+	else
+	{
+		/* use slice for debug guards */
+		slice = ncSpanSlice(buffer->buffer.output, offset, size);
+
+		/* init readonly span from mutable */
+		ncSpanInitC(
+			&buffer->buffer.actualOutput, 
+			ncSpanGetOffset(slice, 0), 
+			ncSpanGetSize(slice)
+		);
+	}	
+}
+
+/*
+* I want the encryption/decyption functions to be indempodent
+* meaning all mutations that happen can be repeated without
+* side effects. IE no perminent state changes that can't be
+* undone.
+*/
+
+static NCResult _nip44EncryptCompleteCore(
+	const NCContext* libContext,
+	const NCSecretKey* sk,
+	const NCPublicKey* pk,
+	NCUtilCipherContext* state
+)
+{
+
+	NCResult result;
+	cspan_t plainText;
+	span_t macData, macOutput, message;
+	uint32_t outPos;
+	uint8_t ptSize[NIP44_PT_LEN_SIZE];
+	uint8_t hmacKeyOut[NC_ENCRYPTION_MAC_SIZE];
+	NCEncryptionArgs encArgs;
+
+	outPos = 0;
+	encArgs = state->encArgs;
+	message = state->buffer.output;
+	plainText = state->buffer.input;
+
+	DEBUG_ASSERT(encArgs.version == NC_ENC_VERSION_NIP44);
+
+	ZERO_FILL(hmacKeyOut, sizeof(hmacKeyOut));
+
+	/* Start by appending the version number */
+	ncSpanAppend(message, &outPos, Nip44VersionValue, sizeof(Nip44VersionValue));
+
+	/* next is nonce data */
+	ncSpanAppend(message, &outPos, encArgs.nonceData, NC_ENCRYPTION_NONCE_SIZE);
+	DEBUG_ASSERT(outPos == 1 + NC_ENCRYPTION_NONCE_SIZE);
+
+	/*
+	* Assign the hmac key from the stack buffer. Since the args structure
+	* is copied, it won't leak the address to the stack buffer.
+	*
+	* Should always return success for nip44 because all properties are valid
+	* addresses.
+	*/
+
+	result = NCSetEncryptionPropertyEx(
+		&encArgs,
+		NC_ENC_SET_NIP44_MAC_KEY,
+		hmacKeyOut,
+		sizeof(hmacKeyOut)
+	);
+
+	DEBUG_ASSERT(result == NC_SUCCESS);
+
+	/*
+	* So this is the tricky part. The encryption operation appens directly
+	* on the ciphertext segment
+	*
+	* All current implementations allow overlapping input and output buffers
+	* so we can assign the pt segment on the encryption args
+	*/
+
+	/*
+	* Since the message size and padding bytes will get encrypted,
+	* the buffer should currently point to the start of the encryption segment
+	*
+	* The size of the data to encrypt is the padded size plus the size of the
+	* plainText size field.
+	*/
+
+	result = NCSetEncryptionData(
+		&encArgs,
+		ncSpanGetOffset(message, outPos),	/* in place encryption */
+		ncSpanGetOffset(message, outPos),
+		NIP44_PT_LEN_SIZE + _calcNip44PtPadding(plainText.size) 	/* Plaintext + pt size must be encrypted */
+	);
+
+	DEBUG_ASSERT(result == NC_SUCCESS);
+
+	/* big endian plaintext size */
+	ptSize[0] = (uint8_t)(ncSpanGetSizeC(plainText) >> 8);
+	ptSize[1] = (uint8_t)(ncSpanGetSizeC(plainText) & 0xFF);
+
+	/*
+	* Written position must point to the end of the padded ciphertext
+	* area which the plaintext is written to.
+	*
+	* The plaintext data will be encrypted in place. The encrypted
+	* data is the entired padded region containing the leading byte count
+	* the plaintext data, followed by zero padding.
+	*/
+
+	ncSpanWrite(message, outPos, ptSize, sizeof(ptSize));
+
+	ncSpanWrite(
+		message,
+		outPos + NIP44_PT_LEN_SIZE,		/* write pt directly after length */
+		ncSpanGetOffsetC(plainText, 0),
+		ncSpanGetSizeC(plainText)
+	);
+
+	/* Move position pointer directly after final padding bytes */
+	outPos += encArgs.dataSize;
+
+	result = NCEncrypt(libContext, sk, pk, &encArgs);
+
+	if (result != NC_SUCCESS)
+	{
+		return result;
+	}
+
+	/*
+		MAC is computed over the nonce+encrypted data
+		this helper captures that data segment into a span
+	*/
+
+	macData = _nip44GetMacData(message);
+	macOutput = _nip44GetMacOutput(message);
+
+	result = NCComputeMac(
+		libContext,
+		hmacKeyOut,
+		ncSpanGetOffset(macData, 0),
+		ncSpanGetSize(macData),
+		ncSpanGetOffset(macOutput, 0)
+	);
+
+	if (result != NC_SUCCESS)
+	{
+		return result;
+	}
+
+	outPos += NC_ENCRYPTION_MAC_SIZE;
+
+	DEBUG_ASSERT2(outPos == message.size, "Buffer under/overflow detected");
+
+	/* publish all message bytes to output */
+	_cipherPublishOutput(state, 0, outPos);
+
+	/* zero hmac key before returning */
+	ZERO_FILL(hmacKeyOut, sizeof(hmacKeyOut));
+
+	return NC_SUCCESS;
+}
+
+static NCResult _nip44DecryptCompleteCore(
+	const NCContext* libContext,
+	const NCSecretKey* recvKey,
+	const NCPublicKey* sendKey,
+	NCUtilCipherContext* state
+)
+{
+	NCResult result;
+	NCMacVerifyArgs macArgs;
+	NCEncryptionArgs encArgs;
+	cspan_t macData, macValue, nonce, payload, cipherText;
+	span_t output;
+	uint16_t ptSize;
+
+	DEBUG_ASSERT(libContext && recvKey && sendKey && state);
+	DEBUG_ASSERT(state->encArgs.version == NC_ENC_VERSION_NIP44);
+	DEBUG_ASSERT(ncSpanGetSizeC(state->buffer.input) >= NIP44_MIN_PAYLOAD_SIZE);
+
+	/* ensure decryption mode */
+	DEBUG_ASSERT(state->_flags & NC_UTIL_CIPHER_MODE_DECRYPT);
+
+	/* store local stack copy for safe mutation */
+	encArgs = state->encArgs;
+	payload = state->buffer.input;
+	output = state->buffer.output;
+
+	/*
+	* Copy the input buffer to the output buffer because the 
+	* decryption happens in-place and needs a writable buffer
+	* 
+	* After the operation is complete, we will assign the actual plaintext 
+	* data to the actual output buffer
+	*/
+
+	DEBUG_ASSERT2(ncSpanIsValid(output), "Output buffer was not allocated");
+
+	if (!_nip44ParseSegments(payload, &nonce, &macValue, &macData, &cipherText))
+	{
+		return E_CIPHER_INVALID_FORMAT;
+	}
+
+	/* Verify mac if the user allowed it */
+	if ((state->_flags & NC_UTIL_CIPHER_MAC_NO_VERIFY) == 0)
+	{
+		DEBUG_ASSERT(ncSpanGetSizeC(macValue) == NC_ENCRYPTION_MAC_SIZE);
+		DEBUG_ASSERT(ncSpanGetSizeC(macData) > NC_ENCRYPTION_NONCE_SIZE + MIN_PADDING_SIZE);
+
+		/* Assign the mac data to the mac verify args */
+		macArgs.mac32 = ncSpanGetOffsetC(macValue, 0);
+		macArgs.nonce32 = ncSpanGetOffsetC(nonce, 0);
+		
+		/* message for verifying a mac in nip44 is the nonce+ciphertext */
+		macArgs.payload = ncSpanGetOffsetC(macData, 0);
+		macArgs.payloadSize = ncSpanGetSizeC(macData);
+
+		/* Verify the mac */
+		result = NCVerifyMac(libContext, recvKey, sendKey, &macArgs);
+
+		/* When the mac is invlaid */
+		if (result == E_OPERATION_FAILED)
+		{
+			return E_CIPHER_MAC_INVALID;
+		}
+		/* argument errors */
+		else if (result != NC_SUCCESS)
+		{
+			return result;
+		}
+	}
+
+	/* 
+	* manually assign nonce because it's a constant pointer which
+	* is not allowed when calling setproperty 
+	*/
+	encArgs.nonceData = ncSpanGetOffsetC(nonce, 0);
+
+	DEBUG_ASSERT2(cipherText.size >= MIN_PADDING_SIZE, "Cipertext segment was parsed incorrectly. Too small");
+	
+	result = NCSetEncryptionData(
+		&encArgs,
+		ncSpanGetOffsetC(cipherText, 0),
+		ncSpanGetOffset(output, 0),			/*decrypt ciphertext and write directly to the output buffer */
+		ncSpanGetSizeC(cipherText)
+	);
+
+	DEBUG_ASSERT(result == NC_SUCCESS);
+
+	/*
+	* If decryption was successful, the data should be written 
+	* directly to the output buffer
+	*/
+	result = NCDecrypt(libContext, recvKey, sendKey, &encArgs);
+
+	if (result != NC_SUCCESS)
+	{
+		return result;
+	}
+
+	/*
+	* Parse CT length and assign the output buffer.
+	* 
+	* PT size is stored at the beginning of the ciphertext
+	* segment and is 2 bytes in size, big endian.
+	*/
+
+	ptSize = (uint16_t)(output.data[0] << 8 | output.data[1]);
+
+	/*
+	* If the PT is corrupted or set maliciously, it can overrun
+	* the current buffer. The PT size must be less than the
+	* ciphertext size.
+	*/
+	if (!ncSpanIsValidRange(output, NIP44_PT_LEN_SIZE, ptSize))
+	{
+		return E_OPERATION_FAILED;
+	}
+
+	/*
+	* actual output span should now point to the decrypted plaintext
+	* data segment
+	*/
+	_cipherPublishOutput(state, NIP44_PT_LEN_SIZE, ptSize);
+
+	DEBUG_ASSERT(ncSpanGetSizeC(state->buffer.actualOutput) < cipherText.size);
+
+	return NC_SUCCESS;
+}
+
+NC_EXPORT NCResult NC_CC NCUtilGetEncryptionPaddedSize(uint32_t encVersion, uint32_t plaintextSize)
+{
+	switch (encVersion)
+	{
+	default:
+		return E_VERSION_NOT_SUPPORTED;
+
+	case NC_ENC_VERSION_NIP04:
+		return plaintextSize;
+
+	case NC_ENC_VERSION_NIP44:
+
+		/*
+		* Ensure the plaintext size if a nip44 message does not exceed the maximum size
+		*/
+		CHECK_ARG_IS(plaintextSize - 1 <= NIP44_MAX_ENC_MESSAGE_SIZE, 1);
+
+		return (NCResult)(_calcNip44PtPadding(plaintextSize));
+	}
+}
+
+NC_EXPORT NCResult NC_CC NCUtilGetEncryptionBufferSize(uint32_t encVersion, uint32_t plaintextSize)
+{
+
+	switch (encVersion)
+	{
+	default:
+		return E_VERSION_NOT_SUPPORTED;
+
+		/*
+		* NIP-04 simply uses AES to 1:1 encrypt the plainText
+		* to ciphertext.
+		*/
+	case NC_ENC_VERSION_NIP04:
+		return plaintextSize;
+
+	case NC_ENC_VERSION_NIP44:
+		return (NCResult)(_calcNip44TotalOutSize(plaintextSize));
+	}
+}
+
+
+NC_EXPORT NCUtilCipherContext* NC_CC NCUtilCipherAlloc(uint32_t encVersion, uint32_t flags)
+{
+	NCUtilCipherContext* encCtx;
+
+	/*
+	* Alloc context on heap
+	*/
+	encCtx = (NCUtilCipherContext*)_nc_mem_alloc(1, sizeof(NCUtilCipherContext));
+
+	if (encCtx != NULL)
+	{
+		encCtx->encArgs.version = encVersion;
+		encCtx->_flags = flags;
+	}
+
+	return encCtx;
+}
+
+NC_EXPORT void NC_CC NCUtilCipherFree(NCUtilCipherContext* encCtx)
+{
+	if (!encCtx) 
+	{
+		return;
+	}
+
+	/*
+	* If zero on free flag is set, we can zero all output memory 
+	* before returning the buffer back to the heap
+	*/
+	if ((encCtx->_flags & NC_UTIL_CIPHER_ZERO_ON_FREE) > 0 && ncSpanIsValid(encCtx->buffer.output)) 
+	{
+		_ncUtilZeroSpan(encCtx->buffer.output);
+	}
+
+	/* Free output buffers (null buffers are allowed) */
+	_ncUtilFreeSpan(encCtx->buffer.output);
+
+	/* context can be released */
+	_nc_mem_free(encCtx);
+}
+
+NC_EXPORT NCResult NC_CC NCUtilCipherInit(
+	NCUtilCipherContext* encCtx,
+	const uint8_t* inputData,
+	uint32_t inputSize
+)
+{
+	NCResult outputSize;
+
+	CHECK_NULL_ARG(encCtx, 0);
+	CHECK_NULL_ARG(inputData, 1);
+
+	if ((encCtx->_flags & NC_UTIL_CIPHER_MODE_DECRYPT) > 0)
+	{
+		/*
+		* Validate the input data for proper format for 
+		* the current state version
+		*/
+		switch (encCtx->encArgs.version)
+		{
+		case NC_ENC_VERSION_NIP44:
+		{
+			if (inputSize < NIP44_MIN_PAYLOAD_SIZE)
+			{
+				return E_CIPHER_BAD_INPUT_SIZE;
+			}
+
+			if (inputSize > NIP44_MAX_PAYLOAD_SIZE)
+			{
+				return E_CIPHER_BAD_INPUT_SIZE;
+			}
+
+			/* Ensure the first byte is a valid version */
+			if (inputData[0] != Nip44VersionValue[0])
+			{
+				return E_VERSION_NOT_SUPPORTED;
+			}
+
+			break;
+		}
+		default:
+			return E_VERSION_NOT_SUPPORTED;
+		}
+
+		/*
+		* Alloc a the output buffer to be the same size as the input
+		* data for decryption because the output will always be equal
+		* or smaller than the input data. This is an over-alloc but 
+		* that should be fine
+		*/
+
+		outputSize = inputSize;
+	}
+	else
+	{
+		/*
+		* Calculate the correct output size to store the encryption
+		* data for the given state version
+		*/
+		outputSize = NCUtilGetEncryptionBufferSize(encCtx->encArgs.version, inputSize);
+
+		if (outputSize < 0)
+		{
+			return E_CIPHER_BAD_INPUT_SIZE;
+		}
+	}
+
+	DEBUG_ASSERT(outputSize > 0);
+
+	/*
+	* If the buffer was previously allocated, the reuseable flag
+	* must be set to allow the buffer to be re-used for another
+	* operation.
+	*/
+
+	if (ncSpanIsValid(encCtx->buffer.output))
+	{
+		CHECK_ARG_IS((encCtx->_flags & NC_UTIL_CIPHER_REUSEABLE) > 0, 0);
+
+		/*
+		* if the existing buffer is large enough to hold the new 
+		* data reuse it, otherwise free it and allocate a new buffer
+		*/
+
+		if (outputSize <= encCtx->buffer.output.size)
+		{
+			_ncUtilZeroSpan(encCtx->buffer.output);
+
+			goto AssignInputAndExit;
+		}
+		else
+		{
+			_ncUtilFreeSpan(encCtx->buffer.output);
+		}
+	}
+
+	/* Alloc output buffer within the struct */
+	encCtx->buffer.output = _ncUtilAllocSpan((uint32_t)outputSize, sizeof(uint8_t));
+
+	if (!ncSpanIsValid(encCtx->buffer.output))
+	{
+		return E_OUT_OF_MEMORY;
+	}
+
+AssignInputAndExit:
+
+	/* Confirm output was allocated */
+	DEBUG_ASSERT(ncSpanIsValid(encCtx->buffer.output));
+
+	/* Assign the input data span to point to the assigned input data */
+	ncSpanInitC(&encCtx->buffer.input, inputData, inputSize);
+
+	return NC_SUCCESS;
+}
+
+NC_EXPORT NCResult NC_CC NCUtilCipherGetFlags(const NCUtilCipherContext* ctx)
+{
+	CHECK_NULL_ARG(ctx, 0);
+
+	return (NCResult)(ctx->_flags);
+}
+
+NC_EXPORT NCResult NC_CC NCUtilCipherGetOutputSize(const NCUtilCipherContext* encCtx)
+{
+	CHECK_NULL_ARG(encCtx, 0);
+
+	if (!ncSpanIsValidC(encCtx->buffer.actualOutput))
+	{
+		return E_CIPHER_NO_OUTPUT;
+	}
+
+	return (NCResult)(encCtx->buffer.actualOutput.size);
+}
+
+NC_EXPORT NCResult NC_CC NCUtilCipherReadOutput(
+	const NCUtilCipherContext* encCtx,
+	uint8_t* output,
+	uint32_t outputSize
+)
+{
+	CHECK_NULL_ARG(encCtx, 0);
+	CHECK_NULL_ARG(output, 1);
+
+	if (!ncSpanIsValidC(encCtx->buffer.actualOutput))
+	{
+		return E_CIPHER_NO_OUTPUT;
+	}
+
+	/* Buffer must be as large as the output data  */
+	CHECK_ARG_RANGE(outputSize, encCtx->buffer.actualOutput.size, UINT32_MAX, 2);
+
+	ncSpanReadC(
+		encCtx->buffer.actualOutput,
+		output,
+		outputSize
+	);
+
+	return (NCResult)encCtx->buffer.actualOutput.size;
+}
+
+NC_EXPORT NCResult NCUtilCipherSetProperty(
+	NCUtilCipherContext* ctx,
+	uint32_t property,
+	uint8_t* value,
+	uint32_t valueLen
+)
+{	
+	CHECK_NULL_ARG(ctx, 0)
+
+	/* All other arguments are verified */
+	return NCSetEncryptionPropertyEx(
+		&ctx->encArgs, 
+		property, 
+		value, 
+		valueLen
+	);
+}
+
+NC_EXPORT NCResult NC_CC NCUtilCipherUpdate(
+	NCUtilCipherContext* encCtx,
+	const NCContext* libContext,
+	const NCSecretKey* sk,
+	const NCPublicKey* pk
+)
+{
+	CHECK_NULL_ARG(encCtx, 0);
+	CHECK_NULL_ARG(libContext, 1);
+	CHECK_NULL_ARG(sk, 2);
+	CHECK_NULL_ARG(pk, 3);
+
+	/* Make sure input & output buffers have been assigned/allocated */
+	if (!ncSpanIsValid(encCtx->buffer.output))
+	{
+		return E_INVALID_CONTEXT;
+	}
+	if (!ncSpanIsValidC(encCtx->buffer.input))
+	{
+		return E_INVALID_CONTEXT;
+	}
+
+	/* Reset output data pointer incase it has been moved */
+	_cipherPublishOutput(encCtx, 0, 0);
+
+	switch (encCtx->encArgs.version)
+	{
+	case NC_ENC_VERSION_NIP44:
+
+		if ((encCtx->_flags & NC_UTIL_CIPHER_MODE_DECRYPT) > 0)
+		{
+			return _nip44DecryptCompleteCore(libContext, sk, pk, encCtx);
+		}
+		else
+		{
+			/* Ensure the user manually specified a nonce buffer for encryption mode */
+			if (!encCtx->encArgs.nonceData)
+			{
+				return E_CIPHER_BAD_NONCE;
+			}
+
+			return _nip44EncryptCompleteCore(libContext, sk, pk, encCtx);
+		}
+
+	default:
+		return E_VERSION_NOT_SUPPORTED;
+	}
+}