BLAKE3 WASM — Auditable Build

Minimal wrapper around the official BLAKE3 hash function for browser use. No pre-built WASM is committed — auditors build from source.

Security Audit Guide

1. build.sh (~80 lines) — clones BLAKE3 at tag 1.8.3 (pinned), scaffolds two tiny Rust crates, builds with wasm-pack, cleans up
2. blake3-wasm-single/src/lib.rs — 7 lines: calls blake3::hash() and returns bytes
3. blake3-wasm-rayon/src/lib.rs — 22 lines: uses blake3::Hasher with update_rayon() for parallel hashing above 16 KB
4. Run ./build.sh (or .\build.ps1 on Windows) to build from source
5. All Cargo.toml, config, and source files are generated by the build script — nothing hidden

Build Prerequisites

• Rust (stable + nightly for rayon build)
• wasm-pack
• Git

Build

# Linux/macOS
chmod +x build.sh
./build.sh

# Windows (PowerShell)
.\build.ps1

Browser Demo

After building, serve the directory and open browser-test.html:

python -m http.server 8080
# Open http://localhost:8080/browser-test.html

Drop a file to compare BLAKE3 (WASM) vs SHA-256 (WebCrypto) throughput.

• If SharedArrayBuffer is available: parallel mode (4 threads)
• Otherwise: single-threaded SIMD fallback

What Gets Built

blake3-wasm-single/pkg/   — single-threaded WASM module
blake3-wasm-rayon/pkg/    — parallel (rayon) WASM module

Both are gitignored. Build from source to verify.

Design Decisions

Decision	Rationale
No pre-built WASM	Auditors build from source to verify nothing is tampered
Build script generates all config	Only build.sh + build.ps1 to audit
Pin BLAKE3 at tag 1.8.3	Reproducible builds; matches crates.io
Two builds (single + rayon)	browser-test.html auto-falls back; both wrappers are tiny
Rayon uses nightly-2025-11-15	Required for build-std with atomics/shared-memory