[Project] Remove NIST mode from everywhere

22 files changed, 648 insertions, 1041 deletions

diff --git a/contrib/librdns/curve.c b/contrib/librdns/curve.c
index 19ec2508c..9fc345fb5 100644
--- a/contrib/librdns/curve.c
+++ b/contrib/librdns/curve.c
@@ -1,4 +1,20 @@
 /*
+ * Copyright 2024 Vsevolod Stakhov
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
  * Copyright (c) 2014, Vsevolod Stakhov
  *
  * All rights reserved.
@@ -39,12 +55,11 @@
 
 #include <tweetnacl.h>
 
-void
-randombytes(uint8_t *data, uint64_t len)
+void randombytes(uint8_t *data, uint64_t len)
 {
-	ottery_rand_bytes (data, len);
+	ottery_rand_bytes(data, len);
 }
-void sodium_memzero (uint8_t *data, uint64_t len)
+void sodium_memzero(uint8_t *data, uint64_t len)
 {
 	volatile uint8_t *p = data;
 
@@ -54,14 +69,13 @@ void sodium_memzero (uint8_t *data, uint64_t len)
 }
 void sodium_init(void)
 {
-
 }
 
-ssize_t rdns_curve_send (struct rdns_request *req, void *plugin_data);
-ssize_t rdns_curve_recv (struct rdns_io_channel *ioc, void *buf, size_t len,
-		void *plugin_data, struct rdns_request **req_out);
-void rdns_curve_finish_request (struct rdns_request *req, void *plugin_data);
-void rdns_curve_dtor (struct rdns_resolver *resolver, void *plugin_data);
+ssize_t rdns_curve_send(struct rdns_request *req, void *plugin_data);
+ssize_t rdns_curve_recv(struct rdns_io_channel *ioc, void *buf, size_t len,
+						void *plugin_data, struct rdns_request **req_out);
+void rdns_curve_finish_request(struct rdns_request *req, void *plugin_data);
+void rdns_curve_dtor(struct rdns_resolver *resolver, void *plugin_data);
 
 struct rdns_curve_entry {
 	char *name;
@@ -103,34 +117,36 @@ struct rdns_curve_ctx {
 };
 
 static struct rdns_curve_client_key *
-rdns_curve_client_key_new (struct rdns_curve_ctx *ctx)
+rdns_curve_client_key_new(struct rdns_curve_ctx *ctx)
 {
 	struct rdns_curve_client_key *new;
 	struct rdns_curve_nm_entry *nm;
 	struct rdns_curve_entry *entry, *tmp;
 
-	new = calloc (1, sizeof (struct rdns_curve_client_key));
-	crypto_box_keypair (new->pk, new->sk);
+	new = calloc(1, sizeof(struct rdns_curve_client_key));
+	crypto_box_keypair(new->pk, new->sk);
 
-	HASH_ITER (hh, ctx->entries, entry, tmp) {
-		nm = calloc (1, sizeof (struct rdns_curve_nm_entry));
+	HASH_ITER(hh, ctx->entries, entry, tmp)
+	{
+		nm = calloc(1, sizeof(struct rdns_curve_nm_entry));
 		nm->entry = entry;
-		crypto_box_beforenm (nm->k, entry->pk, new->sk);
+		crypto_box_beforenm(nm->k, entry->pk, new->sk);
 
-		DL_APPEND (new->nms, nm);
+		DL_APPEND(new->nms, nm);
 	}
 
-	new->counter = ottery_rand_uint64 ();
+	new->counter = ottery_rand_uint64();
 
 	return new;
 }
 
 static struct rdns_curve_nm_entry *
-rdns_curve_find_nm (struct rdns_curve_client_key *key, struct rdns_curve_entry *entry)
+rdns_curve_find_nm(struct rdns_curve_client_key *key, struct rdns_curve_entry *entry)
 {
 	struct rdns_curve_nm_entry *nm;
 
-	DL_FOREACH (key->nms, nm) {
+	DL_FOREACH(key->nms, nm)
+	{
 		if (nm->entry == entry) {
 			return nm;
 		}
@@ -140,67 +156,68 @@ rdns_curve_find_nm (struct rdns_curve_client_key *key, struct rdns_curve_entry *
 }
 
 static void
-rdns_curve_client_key_free (struct rdns_curve_client_key *key)
+rdns_curve_client_key_free(struct rdns_curve_client_key *key)
 {
 	struct rdns_curve_nm_entry *nm, *tmp;
 
-	DL_FOREACH_SAFE (key->nms, nm, tmp) {
-		sodium_memzero (nm->k, sizeof (nm->k));
-		free (nm);
+	DL_FOREACH_SAFE(key->nms, nm, tmp)
+	{
+		sodium_memzero(nm->k, sizeof(nm->k));
+		free(nm);
 	}
-	sodium_memzero (key->sk, sizeof (key->sk));
-	free (key);
+	sodium_memzero(key->sk, sizeof(key->sk));
+	free(key);
 }
 
-struct rdns_curve_ctx*
-rdns_curve_ctx_new (double key_refresh_interval)
+struct rdns_curve_ctx *
+rdns_curve_ctx_new(double key_refresh_interval)
 {
 	struct rdns_curve_ctx *new;
 
-	new = calloc (1, sizeof (struct rdns_curve_ctx));
+	new = calloc(1, sizeof(struct rdns_curve_ctx));
 	new->key_refresh_interval = key_refresh_interval;
 
 	return new;
 }
 
-void
-rdns_curve_ctx_add_key (struct rdns_curve_ctx *ctx,
-		const char *name, const unsigned char *pubkey)
+void rdns_curve_ctx_add_key(struct rdns_curve_ctx *ctx,
+							const char *name, const unsigned char *pubkey)
 {
 	struct rdns_curve_entry *entry;
 	bool success = true;
 
-	entry = malloc (sizeof (struct rdns_curve_entry));
+	entry = malloc(sizeof(struct rdns_curve_entry));
 	if (entry != NULL) {
-		entry->name = strdup (name);
+		entry->name = strdup(name);
 		if (entry->name == NULL) {
 			success = false;
 		}
-		memcpy (entry->pk, pubkey, sizeof (entry->pk));
+		memcpy(entry->pk, pubkey, sizeof(entry->pk));
 		if (success) {
-			HASH_ADD_KEYPTR (hh, ctx->entries, entry->name, strlen (entry->name), entry);
+			HASH_ADD_KEYPTR(hh, ctx->entries, entry->name, strlen(entry->name), entry);
 		}
 	}
 }
 
-#define rdns_curve_write_hex(in, out, offset, base) do {					\
-    *(out) |= ((in)[(offset)] - (base)) << ((1 - offset) * 4);				\
-} while (0)
+#define rdns_curve_write_hex(in, out, offset, base)                \
+	do {                                                           \
+		*(out) |= ((in)[(offset)] - (base)) << ((1 - offset) * 4); \
+	} while (0)
 
 static bool
-rdns_curve_hex_to_byte (const char *in, unsigned char *out)
+rdns_curve_hex_to_byte(const char *in, unsigned char *out)
 {
 	int i;
 
-	for (i = 0; i <= 1; i ++) {
+	for (i = 0; i <= 1; i++) {
 		if (in[i] >= '0' && in[i] <= '9') {
-			rdns_curve_write_hex (in, out, i, '0');
+			rdns_curve_write_hex(in, out, i, '0');
 		}
 		else if (in[i] >= 'a' && in[i] <= 'f') {
-			rdns_curve_write_hex (in, out, i, 'a' - 10);
+			rdns_curve_write_hex(in, out, i, 'a' - 10);
 		}
 		else if (in[i] >= 'A' && in[i] <= 'F') {
-			rdns_curve_write_hex (in, out, i, 'A' - 10);
+			rdns_curve_write_hex(in, out, i, 'A' - 10);
 		}
 		else {
 			return false;
@@ -212,16 +229,16 @@ rdns_curve_hex_to_byte (const char *in, unsigned char *out)
 #undef rdns_curve_write_hex
 
 unsigned char *
-rdns_curve_key_from_hex (const char *hex)
+rdns_curve_key_from_hex(const char *hex)
 {
-	unsigned int len = strlen (hex), i;
+	unsigned int len = strlen(hex), i;
 	unsigned char *res = NULL;
 
 	if (len == crypto_box_PUBLICKEYBYTES * 2) {
-		res = calloc (1, crypto_box_PUBLICKEYBYTES);
-		for (i = 0; i < crypto_box_PUBLICKEYBYTES; i ++) {
-			if (!rdns_curve_hex_to_byte (&hex[i * 2], &res[i])) {
-				free (res);
+		res = calloc(1, crypto_box_PUBLICKEYBYTES);
+		for (i = 0; i < crypto_box_PUBLICKEYBYTES; i++) {
+			if (!rdns_curve_hex_to_byte(&hex[i * 2], &res[i])) {
+				free(res);
 				return NULL;
 			}
 		}
@@ -230,35 +247,34 @@ rdns_curve_key_from_hex (const char *hex)
 	return res;
 }
 
-void
-rdns_curve_ctx_destroy (struct rdns_curve_ctx *ctx)
+void rdns_curve_ctx_destroy(struct rdns_curve_ctx *ctx)
 {
 	struct rdns_curve_entry *entry, *tmp;
 
-	HASH_ITER (hh, ctx->entries, entry, tmp) {
-		free (entry->name);
-		free (entry);
+	HASH_ITER(hh, ctx->entries, entry, tmp)
+	{
+		free(entry->name);
+		free(entry);
 	}
 
-	free (ctx);
+	free(ctx);
 }
 
 static void
-rdns_curve_refresh_key_callback (void *user_data)
+rdns_curve_refresh_key_callback(void *user_data)
 {
 	struct rdns_curve_ctx *ctx = user_data;
 	struct rdns_resolver *resolver;
 
 	resolver = ctx->resolver;
-	rdns_info ("refresh dnscurve keys");
-	REF_RELEASE (ctx->cur_key);
-	ctx->cur_key = rdns_curve_client_key_new (ctx);
-	REF_INIT_RETAIN (ctx->cur_key, rdns_curve_client_key_free);
+	rdns_info("refresh dnscurve keys");
+	REF_RELEASE(ctx->cur_key);
+	ctx->cur_key = rdns_curve_client_key_new(ctx);
+	REF_INIT_RETAIN(ctx->cur_key, rdns_curve_client_key_free);
 }
 
-void
-rdns_curve_register_plugin (struct rdns_resolver *resolver,
-		struct rdns_curve_ctx *ctx)
+void rdns_curve_register_plugin(struct rdns_resolver *resolver,
+								struct rdns_curve_ctx *ctx)
 {
 	struct rdns_plugin *plugin;
 
@@ -266,7 +282,7 @@ rdns_curve_register_plugin (struct rdns_resolver *resolver,
 		return;
 	}
 
-	plugin = calloc (1, sizeof (struct rdns_plugin));
+	plugin = calloc(1, sizeof(struct rdns_plugin));
 	if (plugin != NULL) {
 		plugin->data = ctx;
 		plugin->type = RDNS_PLUGIN_CURVE;
@@ -274,24 +290,24 @@ rdns_curve_register_plugin (struct rdns_resolver *resolver,
 		plugin->cb.curve_plugin.recv_cb = rdns_curve_recv;
 		plugin->cb.curve_plugin.finish_cb = rdns_curve_finish_request;
 		plugin->dtor = rdns_curve_dtor;
-		sodium_init ();
-		ctx->cur_key = rdns_curve_client_key_new (ctx);
-		REF_INIT_RETAIN (ctx->cur_key, rdns_curve_client_key_free);
+		sodium_init();
+		ctx->cur_key = rdns_curve_client_key_new(ctx);
+		REF_INIT_RETAIN(ctx->cur_key, rdns_curve_client_key_free);
 
 		if (ctx->key_refresh_interval > 0) {
-			ctx->key_refresh_event = resolver->async->add_periodic (
-					resolver->async->data, ctx->key_refresh_interval,
-					rdns_curve_refresh_key_callback, ctx);
+			ctx->key_refresh_event = resolver->async->add_periodic(
+				resolver->async->data, ctx->key_refresh_interval,
+				rdns_curve_refresh_key_callback, ctx);
 		}
 		ctx->resolver = resolver;
-		rdns_resolver_register_plugin (resolver, plugin);
+		rdns_resolver_register_plugin(resolver, plugin);
 	}
 }
 
 ssize_t
-rdns_curve_send (struct rdns_request *req, void *plugin_data)
+rdns_curve_send(struct rdns_request *req, void *plugin_data)
 {
-	struct rdns_curve_ctx *ctx = (struct rdns_curve_ctx *)plugin_data;
+	struct rdns_curve_ctx *ctx = (struct rdns_curve_ctx *) plugin_data;
 	struct rdns_curve_entry *entry;
 	struct iovec iov[4];
 	unsigned char *m;
@@ -301,62 +317,62 @@ rdns_curve_send (struct rdns_request *req, void *plugin_data)
 	ssize_t ret, boxed_len;
 
 	/* Check for key */
-	HASH_FIND_STR (ctx->entries, req->io->srv->name, entry);
+	HASH_FIND_STR(ctx->entries, req->io->srv->name, entry);
 	if (entry != NULL) {
-		nm = rdns_curve_find_nm (ctx->cur_key, entry);
-		creq = malloc (sizeof (struct rdns_curve_request));
+		nm = rdns_curve_find_nm(ctx->cur_key, entry);
+		creq = malloc(sizeof(struct rdns_curve_request));
 		if (creq == NULL) {
 			return -1;
 		}
 
 		boxed_len = req->pos + crypto_box_ZEROBYTES;
-		m = malloc (boxed_len);
+		m = malloc(boxed_len);
 		if (m == NULL) {
 			return -1;
 		}
 
 		/* Ottery is faster than sodium native PRG that uses /dev/random only */
-		memcpy (creq->nonce, &ctx->cur_key->counter, sizeof (uint64_t));
-		ottery_rand_bytes (creq->nonce + sizeof (uint64_t), 12 - sizeof (uint64_t));
-		sodium_memzero (creq->nonce + 12, crypto_box_NONCEBYTES - 12);
+		memcpy(creq->nonce, &ctx->cur_key->counter, sizeof(uint64_t));
+		ottery_rand_bytes(creq->nonce + sizeof(uint64_t), 12 - sizeof(uint64_t));
+		sodium_memzero(creq->nonce + 12, crypto_box_NONCEBYTES - 12);
 
-		sodium_memzero (m, crypto_box_ZEROBYTES);
-		memcpy (m + crypto_box_ZEROBYTES, req->packet, req->pos);
+		sodium_memzero(m, crypto_box_ZEROBYTES);
+		memcpy(m + crypto_box_ZEROBYTES, req->packet, req->pos);
 
-		if (crypto_box_afternm (m, m, boxed_len,
-				creq->nonce, nm->k) == -1) {
-			sodium_memzero (m, boxed_len);
-			free (m);
+		if (crypto_box_afternm(m, m, boxed_len,
+							   creq->nonce, nm->k) == -1) {
+			sodium_memzero(m, boxed_len);
+			free(m);
 			return -1;
 		}
 
 		creq->key = ctx->cur_key;
-		REF_RETAIN (ctx->cur_key);
+		REF_RETAIN(ctx->cur_key);
 		creq->entry = entry;
 		creq->req = req;
 		creq->nm = nm;
-		HASH_ADD_KEYPTR (hh, ctx->requests, creq->nonce, 12, creq);
+		HASH_ADD_KEYPTR(hh, ctx->requests, creq->nonce, 12, creq);
 		req->curve_plugin_data = creq;
 
-		ctx->cur_key->counter ++;
-		ctx->cur_key->uses ++;
+		ctx->cur_key->counter++;
+		ctx->cur_key->uses++;
 
 		/* Now form a dnscurve packet */
-		iov[0].iov_base = (void *)qmagic;
-		iov[0].iov_len = sizeof (qmagic) - 1;
+		iov[0].iov_base = (void *) qmagic;
+		iov[0].iov_len = sizeof(qmagic) - 1;
 		iov[1].iov_base = ctx->cur_key->pk;
-		iov[1].iov_len = sizeof (ctx->cur_key->pk);
+		iov[1].iov_len = sizeof(ctx->cur_key->pk);
 		iov[2].iov_base = creq->nonce;
 		iov[2].iov_len = 12;
 		iov[3].iov_base = m + crypto_box_BOXZEROBYTES;
 		iov[3].iov_len = boxed_len - crypto_box_BOXZEROBYTES;
 
-		ret = writev (req->io->sock, iov, sizeof (iov) / sizeof (iov[0]));
-		sodium_memzero (m, boxed_len);
-		free (m);
+		ret = writev(req->io->sock, iov, sizeof(iov) / sizeof(iov[0]));
+		sodium_memzero(m, boxed_len);
+		free(m);
 	}
 	else {
-		ret = write (req->io->sock, req->packet, req->pos);
+		ret = write(req->io->sock, req->packet, req->pos);
 		req->curve_plugin_data = NULL;
 	}
 
@@ -364,10 +380,10 @@ rdns_curve_send (struct rdns_request *req, void *plugin_data)
 }
 
 ssize_t
-rdns_curve_recv (struct rdns_io_channel *ioc, void *buf, size_t len, void *plugin_data,
-		struct rdns_request **req_out)
+rdns_curve_recv(struct rdns_io_channel *ioc, void *buf, size_t len, void *plugin_data,
+				struct rdns_request **req_out)
 {
-	struct rdns_curve_ctx *ctx = (struct rdns_curve_ctx *)plugin_data;
+	struct rdns_curve_ctx *ctx = (struct rdns_curve_ctx *) plugin_data;
 	ssize_t ret, boxlen;
 	static const char rmagic[] = "R6fnvWJ8";
 	unsigned char *p, *box;
@@ -376,71 +392,69 @@ rdns_curve_recv (struct rdns_io_channel *ioc, void *buf, size_t len, void *plugi
 	struct rdns_resolver *resolver;
 
 	resolver = ctx->resolver;
-	ret = read (ioc->sock, buf, len);
+	ret = read(ioc->sock, buf, len);
 
 	if (ret <= 0 || ret < 64) {
 		/* Definitely not a DNSCurve packet */
 		return ret;
 	}
 
-	if (memcmp (buf, rmagic, sizeof (rmagic) - 1) == 0) {
+	if (memcmp(buf, rmagic, sizeof(rmagic) - 1) == 0) {
 		/* Likely DNSCurve packet */
-		p = ((unsigned char *)buf) + 8;
-		HASH_FIND (hh, ctx->requests, p, 12, creq);
+		p = ((unsigned char *) buf) + 8;
+		HASH_FIND(hh, ctx->requests, p, 12, creq);
 		if (creq == NULL) {
-			rdns_info ("unable to find nonce in the internal hash");
+			rdns_info("unable to find nonce in the internal hash");
 			return ret;
 		}
-		memcpy (enonce, p, crypto_box_NONCEBYTES);
+		memcpy(enonce, p, crypto_box_NONCEBYTES);
 		p += crypto_box_NONCEBYTES;
 		boxlen = ret - crypto_box_NONCEBYTES +
-				crypto_box_BOXZEROBYTES -
-				sizeof (rmagic) + 1;
+				 crypto_box_BOXZEROBYTES -
+				 sizeof(rmagic) + 1;
 		if (boxlen < 0) {
 			return ret;
 		}
-		box = malloc (boxlen);
-		sodium_memzero (box, crypto_box_BOXZEROBYTES);
-		memcpy (box + crypto_box_BOXZEROBYTES, p,
-				boxlen - crypto_box_BOXZEROBYTES);
-
-		if (crypto_box_open_afternm (box, box, boxlen, enonce, creq->nm->k) != -1) {
-			memcpy (buf, box + crypto_box_ZEROBYTES,
-					boxlen - crypto_box_ZEROBYTES);
+		box = malloc(boxlen);
+		sodium_memzero(box, crypto_box_BOXZEROBYTES);
+		memcpy(box + crypto_box_BOXZEROBYTES, p,
+			   boxlen - crypto_box_BOXZEROBYTES);
+
+		if (crypto_box_open_afternm(box, box, boxlen, enonce, creq->nm->k) != -1) {
+			memcpy(buf, box + crypto_box_ZEROBYTES,
+				   boxlen - crypto_box_ZEROBYTES);
 			ret = boxlen - crypto_box_ZEROBYTES;
 			*req_out = creq->req;
 		}
 		else {
-			rdns_info ("unable open cryptobox of size %d", (int)boxlen);
+			rdns_info("unable open cryptobox of size %d", (int) boxlen);
 		}
-		free (box);
+		free(box);
 	}
 
 	return ret;
 }
 
-void
-rdns_curve_finish_request (struct rdns_request *req, void *plugin_data)
+void rdns_curve_finish_request(struct rdns_request *req, void *plugin_data)
 {
-	struct rdns_curve_ctx *ctx = (struct rdns_curve_ctx *)plugin_data;
+	struct rdns_curve_ctx *ctx = (struct rdns_curve_ctx *) plugin_data;
 	struct rdns_curve_request *creq = req->curve_plugin_data;
 
 	if (creq != NULL) {
-		REF_RELEASE (creq->key);
-		HASH_DELETE (hh, ctx->requests, creq);
+		REF_RELEASE(creq->key);
+		HASH_DELETE(hh, ctx->requests, creq);
 	}
 }
 
-void
-rdns_curve_dtor (struct rdns_resolver *resolver, void *plugin_data)
+void rdns_curve_dtor(struct rdns_resolver *resolver, void *plugin_data)
 {
-	struct rdns_curve_ctx *ctx = (struct rdns_curve_ctx *)plugin_data;
+	struct rdns_curve_ctx *ctx = (struct rdns_curve_ctx *) plugin_data;
 
 	if (ctx->key_refresh_event != NULL) {
-		resolver->async->del_periodic (resolver->async->data,
-				ctx->key_refresh_event);
+		resolver->async->del_periodic(resolver->async->data,
+									  ctx->key_refresh_event);
 	}
-	REF_RELEASE (ctx->cur_key);
+	REF_RELEASE(ctx->cur_key);
 }
 #elif defined(USE_RSPAMD_CRYPTOBOX)
 
@@ -454,13 +468,13 @@ rdns_curve_dtor (struct rdns_resolver *resolver, void *plugin_data)
 #define crypto_box_BOXZEROBYTES 16
 #endif
 
-ssize_t rdns_curve_send (struct rdns_request *req, void *plugin_data,
-						 struct sockaddr *saddr, socklen_t slen);
-ssize_t rdns_curve_recv (struct rdns_io_channel *ioc, void *buf, size_t len,
-						 void *plugin_data, struct rdns_request **req_out,
-						 struct sockaddr *saddr, socklen_t slen);
-void rdns_curve_finish_request (struct rdns_request *req, void *plugin_data);
-void rdns_curve_dtor (struct rdns_resolver *resolver, void *plugin_data);
+ssize_t rdns_curve_send(struct rdns_request *req, void *plugin_data,
+						struct sockaddr *saddr, socklen_t slen);
+ssize_t rdns_curve_recv(struct rdns_io_channel *ioc, void *buf, size_t len,
+						void *plugin_data, struct rdns_request **req_out,
+						struct sockaddr *saddr, socklen_t slen);
+void rdns_curve_finish_request(struct rdns_request *req, void *plugin_data);
+void rdns_curve_dtor(struct rdns_resolver *resolver, void *plugin_data);
 
 struct rdns_curve_entry {
 	char *name;
@@ -502,35 +516,36 @@ struct rdns_curve_ctx {
 };
 
 static struct rdns_curve_client_key *
-rdns_curve_client_key_new (struct rdns_curve_ctx *ctx)
+rdns_curve_client_key_new(struct rdns_curve_ctx *ctx)
 {
 	struct rdns_curve_client_key *new;
 	struct rdns_curve_nm_entry *nm;
 	struct rdns_curve_entry *entry, *tmp;
 
-	new = calloc (1, sizeof (struct rdns_curve_client_key));
-	rspamd_cryptobox_keypair (new->pk, new->sk, RSPAMD_CRYPTOBOX_MODE_25519);
+	new = calloc(1, sizeof(struct rdns_curve_client_key));
+	rspamd_cryptobox_keypair(new->pk, new->sk);
 
-	HASH_ITER (hh, ctx->entries, entry, tmp) {
-		nm = calloc (1, sizeof (struct rdns_curve_nm_entry));
+	HASH_ITER(hh, ctx->entries, entry, tmp)
+	{
+		nm = calloc(1, sizeof(struct rdns_curve_nm_entry));
 		nm->entry = entry;
-		rspamd_cryptobox_nm (nm->k, entry->pk, new->sk,
-				RSPAMD_CRYPTOBOX_MODE_25519);
+		rspamd_cryptobox_nm(nm->k, entry->pk, new->sk);
 
-		DL_APPEND (new->nms, nm);
+		DL_APPEND(new->nms, nm);
 	}
 
-	new->counter = ottery_rand_uint64 ();
+	new->counter = ottery_rand_uint64();
 
 	return new;
 }
 
 static struct rdns_curve_nm_entry *
-rdns_curve_find_nm (struct rdns_curve_client_key *key, struct rdns_curve_entry *entry)
+rdns_curve_find_nm(struct rdns_curve_client_key *key, struct rdns_curve_entry *entry)
 {
 	struct rdns_curve_nm_entry *nm;
 
-	DL_FOREACH (key->nms, nm) {
+	DL_FOREACH(key->nms, nm)
+	{
 		if (nm->entry == entry) {
 			return nm;
 		}
@@ -540,68 +555,69 @@ rdns_curve_find_nm (struct rdns_curve_client_key *key, struct rdns_curve_entry *
 }
 
 static void
-rdns_curve_client_key_free (struct rdns_curve_client_key *key)
+rdns_curve_client_key_free(struct rdns_curve_client_key *key)
 {
 	struct rdns_curve_nm_entry *nm, *tmp;
 
-	DL_FOREACH_SAFE (key->nms, nm, tmp) {
-		rspamd_explicit_memzero (nm->k, sizeof (nm->k));
-		free (nm);
+	DL_FOREACH_SAFE(key->nms, nm, tmp)
+	{
+		rspamd_explicit_memzero(nm->k, sizeof(nm->k));
+		free(nm);
 	}
 
-	rspamd_explicit_memzero (key->sk, sizeof (key->sk));
-	free (key);
+	rspamd_explicit_memzero(key->sk, sizeof(key->sk));
+	free(key);
 }
 
-struct rdns_curve_ctx*
-rdns_curve_ctx_new (double key_refresh_interval)
+struct rdns_curve_ctx *
+rdns_curve_ctx_new(double key_refresh_interval)
 {
 	struct rdns_curve_ctx *new;
 
-	new = calloc (1, sizeof (struct rdns_curve_ctx));
+	new = calloc(1, sizeof(struct rdns_curve_ctx));
 	new->key_refresh_interval = key_refresh_interval;
 
 	return new;
 }
 
-void
-rdns_curve_ctx_add_key (struct rdns_curve_ctx *ctx,
-		const char *name, const unsigned char *pubkey)
+void rdns_curve_ctx_add_key(struct rdns_curve_ctx *ctx,
+							const char *name, const unsigned char *pubkey)
 {
 	struct rdns_curve_entry *entry;
 	bool success = true;
 
-	entry = malloc (sizeof (struct rdns_curve_entry));
+	entry = malloc(sizeof(struct rdns_curve_entry));
 	if (entry != NULL) {
-		entry->name = strdup (name);
+		entry->name = strdup(name);
 		if (entry->name == NULL) {
 			success = false;
 		}
-		memcpy (entry->pk, pubkey, sizeof (entry->pk));
+		memcpy(entry->pk, pubkey, sizeof(entry->pk));
 		if (success) {
-			HASH_ADD_KEYPTR (hh, ctx->entries, entry->name, strlen (entry->name), entry);
+			HASH_ADD_KEYPTR(hh, ctx->entries, entry->name, strlen(entry->name), entry);
 		}
 	}
 }
 
-#define rdns_curve_write_hex(in, out, offset, base) do {					\
-    *(out) |= ((in)[(offset)] - (base)) << ((1 - offset) * 4);				\
-} while (0)
+#define rdns_curve_write_hex(in, out, offset, base)                \
+	do {                                                           \
+		*(out) |= ((in)[(offset)] - (base)) << ((1 - offset) * 4); \
+	} while (0)
 
 static bool
-rdns_curve_hex_to_byte (const char *in, unsigned char *out)
+rdns_curve_hex_to_byte(const char *in, unsigned char *out)
 {
 	int i;
 
-	for (i = 0; i <= 1; i ++) {
+	for (i = 0; i <= 1; i++) {
 		if (in[i] >= '0' && in[i] <= '9') {
-			rdns_curve_write_hex (in, out, i, '0');
+			rdns_curve_write_hex(in, out, i, '0');
 		}
 		else if (in[i] >= 'a' && in[i] <= 'f') {
-			rdns_curve_write_hex (in, out, i, 'a' - 10);
+			rdns_curve_write_hex(in, out, i, 'a' - 10);
 		}
 		else if (in[i] >= 'A' && in[i] <= 'F') {
-			rdns_curve_write_hex (in, out, i, 'A' - 10);
+			rdns_curve_write_hex(in, out, i, 'A' - 10);
 		}
 		else {
 			return false;
@@ -613,18 +629,18 @@ rdns_curve_hex_to_byte (const char *in, unsigned char *out)
 #undef rdns_curve_write_hex
 
 unsigned char *
-rdns_curve_key_from_hex (const char *hex)
+rdns_curve_key_from_hex(const char *hex)
 {
-	unsigned int len = strlen (hex), i;
+	unsigned int len = strlen(hex), i;
 	unsigned char *res = NULL;
 
-	if (len == rspamd_cryptobox_pk_bytes (RSPAMD_CRYPTOBOX_MODE_25519) * 2) {
-		res = calloc (1, rspamd_cryptobox_pk_bytes (RSPAMD_CRYPTOBOX_MODE_25519));
+	if (len == crypto_box_publickeybytes() * 2) {
+		res = calloc(1, crypto_box_publickeybytes());
 		for (i = 0;
-				i < rspamd_cryptobox_pk_bytes (RSPAMD_CRYPTOBOX_MODE_25519);
-				i ++) {
-			if (!rdns_curve_hex_to_byte (&hex[i * 2], &res[i])) {
-				free (res);
+			 i < crypto_box_publickeybytes();
+			 i++) {
+			if (!rdns_curve_hex_to_byte(&hex[i * 2], &res[i])) {
+				free(res);
 				return NULL;
 			}
 		}
@@ -633,35 +649,34 @@ rdns_curve_key_from_hex (const char *hex)
 	return res;
 }
 
-void
-rdns_curve_ctx_destroy (struct rdns_curve_ctx *ctx)
+void rdns_curve_ctx_destroy(struct rdns_curve_ctx *ctx)
 {
 	struct rdns_curve_entry *entry, *tmp;
 
-	HASH_ITER (hh, ctx->entries, entry, tmp) {
-		free (entry->name);
-		free (entry);
+	HASH_ITER(hh, ctx->entries, entry, tmp)
+	{
+		free(entry->name);
+		free(entry);
 	}
 
-	free (ctx);
+	free(ctx);
 }
 
 static void
-rdns_curve_refresh_key_callback (void *user_data)
+rdns_curve_refresh_key_callback(void *user_data)
 {
 	struct rdns_curve_ctx *ctx = user_data;
 	struct rdns_resolver *resolver;
 
 	resolver = ctx->resolver;
-	rdns_info ("refresh dnscurve keys");
-	REF_RELEASE (ctx->cur_key);
-	ctx->cur_key = rdns_curve_client_key_new (ctx);
-	REF_INIT_RETAIN (ctx->cur_key, rdns_curve_client_key_free);
+	rdns_info("refresh dnscurve keys");
+	REF_RELEASE(ctx->cur_key);
+	ctx->cur_key = rdns_curve_client_key_new(ctx);
+	REF_INIT_RETAIN(ctx->cur_key, rdns_curve_client_key_free);
 }
 
-void
-rdns_curve_register_plugin (struct rdns_resolver *resolver,
-		struct rdns_curve_ctx *ctx)
+void rdns_curve_register_plugin(struct rdns_resolver *resolver,
+								struct rdns_curve_ctx *ctx)
 {
 	struct rdns_plugin *plugin;
 
@@ -669,7 +684,7 @@ rdns_curve_register_plugin (struct rdns_resolver *resolver,
 		return;
 	}
 
-	plugin = calloc (1, sizeof (struct rdns_plugin));
+	plugin = calloc(1, sizeof(struct rdns_plugin));
 	if (plugin != NULL) {
 		plugin->data = ctx;
 		plugin->type = RDNS_PLUGIN_CURVE;
@@ -677,24 +692,24 @@ rdns_curve_register_plugin (struct rdns_resolver *resolver,
 		plugin->cb.curve_plugin.recv_cb = rdns_curve_recv;
 		plugin->cb.curve_plugin.finish_cb = rdns_curve_finish_request;
 		plugin->dtor = rdns_curve_dtor;
-		ctx->cur_key = rdns_curve_client_key_new (ctx);
-		REF_INIT_RETAIN (ctx->cur_key, rdns_curve_client_key_free);
+		ctx->cur_key = rdns_curve_client_key_new(ctx);
+		REF_INIT_RETAIN(ctx->cur_key, rdns_curve_client_key_free);
 
 		if (ctx->key_refresh_interval > 0) {
-			ctx->key_refresh_event = resolver->async->add_periodic (
-					resolver->async->data, ctx->key_refresh_interval,
-					rdns_curve_refresh_key_callback, ctx);
+			ctx->key_refresh_event = resolver->async->add_periodic(
+				resolver->async->data, ctx->key_refresh_interval,
+				rdns_curve_refresh_key_callback, ctx);
 		}
 		ctx->resolver = resolver;
-		rdns_resolver_register_plugin (resolver, plugin);
+		rdns_resolver_register_plugin(resolver, plugin);
 	}
 }
 
 ssize_t
-rdns_curve_send (struct rdns_request *req, void *plugin_data,
-				 struct sockaddr *saddr, socklen_t slen)
+rdns_curve_send(struct rdns_request *req, void *plugin_data,
+				struct sockaddr *saddr, socklen_t slen)
 {
-	struct rdns_curve_ctx *ctx = (struct rdns_curve_ctx *)plugin_data;
+	struct rdns_curve_ctx *ctx = (struct rdns_curve_ctx *) plugin_data;
 	struct rdns_curve_entry *entry;
 	struct iovec iov[4];
 	unsigned char *m;
@@ -704,53 +719,52 @@ rdns_curve_send (struct rdns_request *req, void *plugin_data,
 	ssize_t ret, boxed_len;
 
 	/* Check for key */
-	HASH_FIND_STR (ctx->entries, req->io->srv->name, entry);
+	HASH_FIND_STR(ctx->entries, req->io->srv->name, entry);
 	if (entry != NULL) {
-		nm = rdns_curve_find_nm (ctx->cur_key, entry);
-		creq = malloc (sizeof (struct rdns_curve_request));
+		nm = rdns_curve_find_nm(ctx->cur_key, entry);
+		creq = malloc(sizeof(struct rdns_curve_request));
 		if (creq == NULL) {
 			return -1;
 		}
 
 		boxed_len = req->pos + crypto_box_ZEROBYTES;
-		m = malloc (boxed_len);
+		m = malloc(boxed_len);
 		if (m == NULL) {
 			free(creq);
 			return -1;
 		}
 
 		/* Ottery is faster than sodium native PRG that uses /dev/random only */
-		memcpy (creq->nonce, &ctx->cur_key->counter, sizeof (uint64_t));
-		ottery_rand_bytes (creq->nonce + sizeof (uint64_t), 12 - sizeof (uint64_t));
-		rspamd_explicit_memzero (creq->nonce + 12,
-				rspamd_cryptobox_nonce_bytes (RSPAMD_CRYPTOBOX_MODE_25519) - 12);
+		memcpy(creq->nonce, &ctx->cur_key->counter, sizeof(uint64_t));
+		ottery_rand_bytes(creq->nonce + sizeof(uint64_t), 12 - sizeof(uint64_t));
+		rspamd_explicit_memzero(creq->nonce + 12,
+								crypto_box_noncebytes() - 12);
 
-		rspamd_explicit_memzero (m, crypto_box_ZEROBYTES);
-		memcpy (m + crypto_box_ZEROBYTES, req->packet, req->pos);
+		rspamd_explicit_memzero(m, crypto_box_ZEROBYTES);
+		memcpy(m + crypto_box_ZEROBYTES, req->packet, req->pos);
 
-		rspamd_cryptobox_encrypt_nm_inplace (m + crypto_box_ZEROBYTES,
-				boxed_len,
-				creq->nonce,
-				nm->k,
-				m,
-				RSPAMD_CRYPTOBOX_MODE_25519);
+		rspamd_cryptobox_encrypt_nm_inplace(m + crypto_box_ZEROBYTES,
+											boxed_len,
+											creq->nonce,
+											nm->k,
+											m);
 
 		creq->key = ctx->cur_key;
-		REF_RETAIN (ctx->cur_key);
+		REF_RETAIN(ctx->cur_key);
 		creq->entry = entry;
 		creq->req = req;
 		creq->nm = nm;
-		HASH_ADD_KEYPTR (hh, ctx->requests, creq->nonce, 12, creq);
+		HASH_ADD_KEYPTR(hh, ctx->requests, creq->nonce, 12, creq);
 		req->curve_plugin_data = creq;
 
-		ctx->cur_key->counter ++;
-		ctx->cur_key->uses ++;
+		ctx->cur_key->counter++;
+		ctx->cur_key->uses++;
 
 		/* Now form a dnscurve packet */
-		iov[0].iov_base = (void *)qmagic;
-		iov[0].iov_len = sizeof (qmagic) - 1;
+		iov[0].iov_base = (void *) qmagic;
+		iov[0].iov_len = sizeof(qmagic) - 1;
 		iov[1].iov_base = ctx->cur_key->pk;
-		iov[1].iov_len = sizeof (ctx->cur_key->pk);
+		iov[1].iov_len = sizeof(ctx->cur_key->pk);
 		iov[2].iov_base = creq->nonce;
 		iov[2].iov_len = 12;
 		iov[3].iov_base = m + crypto_box_BOXZEROBYTES;
@@ -758,17 +772,17 @@ rdns_curve_send (struct rdns_request *req, void *plugin_data,
 
 		struct msghdr msg;
 
-		memset (&msg, 0, sizeof (msg));
+		memset(&msg, 0, sizeof(msg));
 		msg.msg_namelen = slen;
 		msg.msg_name = saddr;
 		msg.msg_iov = iov;
-		msg.msg_iovlen = sizeof (iov) / sizeof (iov[0]);
-		ret = sendmsg (req->io->sock, &msg, 0);
-		rspamd_explicit_memzero (m, boxed_len);
-		free (m);
+		msg.msg_iovlen = sizeof(iov) / sizeof(iov[0]);
+		ret = sendmsg(req->io->sock, &msg, 0);
+		rspamd_explicit_memzero(m, boxed_len);
+		free(m);
 	}
 	else {
-		ret = sendto (req->io->sock, req->packet, req->pos, 0, saddr, slen);
+		ret = sendto(req->io->sock, req->packet, req->pos, 0, saddr, slen);
 		req->curve_plugin_data = NULL;
 	}
 
@@ -776,10 +790,10 @@ rdns_curve_send (struct rdns_request *req, void *plugin_data,
 }
 
 ssize_t
-rdns_curve_recv (struct rdns_io_channel *ioc, void *buf, size_t len, void *plugin_data,
-		struct rdns_request **req_out, struct sockaddr *saddr, socklen_t slen)
+rdns_curve_recv(struct rdns_io_channel *ioc, void *buf, size_t len, void *plugin_data,
+				struct rdns_request **req_out, struct sockaddr *saddr, socklen_t slen)
 {
-	struct rdns_curve_ctx *ctx = (struct rdns_curve_ctx *)plugin_data;
+	struct rdns_curve_ctx *ctx = (struct rdns_curve_ctx *) plugin_data;
 	ssize_t ret, boxlen;
 	static const char rmagic[] = "R6fnvWJ8";
 	unsigned char *p, *box;
@@ -788,102 +802,97 @@ rdns_curve_recv (struct rdns_io_channel *ioc, void *buf, size_t len, void *plugi
 	struct rdns_resolver *resolver;
 
 	resolver = ctx->resolver;
-	ret = recv (ioc->sock, buf, len, 0);
+	ret = recv(ioc->sock, buf, len, 0);
 
 	if (ret <= 0 || ret < 64) {
 		/* Definitely not a DNSCurve packet */
 		return ret;
 	}
 
-	if (memcmp (buf, rmagic, sizeof (rmagic) - 1) == 0) {
+	if (memcmp(buf, rmagic, sizeof(rmagic) - 1) == 0) {
 		/* Likely DNSCurve packet */
-		p = ((unsigned char *)buf) + 8;
-		HASH_FIND (hh, ctx->requests, p, 12, creq);
+		p = ((unsigned char *) buf) + 8;
+		HASH_FIND(hh, ctx->requests, p, 12, creq);
 		if (creq == NULL) {
-			rdns_info ("unable to find nonce in the internal hash");
+			rdns_info("unable to find nonce in the internal hash");
 			return ret;
 		}
 
-		memcpy (enonce, p, rspamd_cryptobox_nonce_bytes (RSPAMD_CRYPTOBOX_MODE_25519));
-		p += rspamd_cryptobox_nonce_bytes (RSPAMD_CRYPTOBOX_MODE_25519);
-		boxlen = ret - rspamd_cryptobox_nonce_bytes (RSPAMD_CRYPTOBOX_MODE_25519) +
-				crypto_box_BOXZEROBYTES -
-				sizeof (rmagic) + 1;
+		memcpy(enonce, p, crypto_box_noncebytes());
+		p += crypto_box_noncebytes();
+		boxlen = ret - crypto_box_noncebytes() +
+				 crypto_box_BOXZEROBYTES -
+				 sizeof(rmagic) + 1;
 		if (boxlen < 0) {
 			return ret;
 		}
 
-		box = malloc (boxlen);
-		rspamd_explicit_memzero (box, crypto_box_BOXZEROBYTES);
-		memcpy (box + crypto_box_BOXZEROBYTES, p,
-				boxlen - crypto_box_BOXZEROBYTES);
-
-		if (!rspamd_cryptobox_decrypt_nm_inplace (
-				box + rspamd_cryptobox_mac_bytes (RSPAMD_CRYPTOBOX_MODE_25519),
-				boxlen - rspamd_cryptobox_mac_bytes (RSPAMD_CRYPTOBOX_MODE_25519),
-				enonce, creq->nm->k, box, RSPAMD_CRYPTOBOX_MODE_25519)) {
-			memcpy (buf, box + crypto_box_ZEROBYTES,
-					boxlen - crypto_box_ZEROBYTES);
+		box = malloc(boxlen);
+		rspamd_explicit_memzero(box, crypto_box_BOXZEROBYTES);
+		memcpy(box + crypto_box_BOXZEROBYTES, p,
+			   boxlen - crypto_box_BOXZEROBYTES);
+
+		if (!rspamd_cryptobox_decrypt_nm_inplace(
+				box + crypto_box_macbytes(),
+				boxlen - crypto_box_macbytes(),
+				enonce, creq->nm->k, box)) {
+			memcpy(buf, box + crypto_box_ZEROBYTES,
+				   boxlen - crypto_box_ZEROBYTES);
 			ret = boxlen - crypto_box_ZEROBYTES;
 			*req_out = creq->req;
 		}
 		else {
-			rdns_info ("unable open cryptobox of size %d", (int)boxlen);
+			rdns_info("unable open cryptobox of size %d", (int) boxlen);
 		}
 
-		free (box);
+		free(box);
 	}
 
 	return ret;
 }
 
-void
-rdns_curve_finish_request (struct rdns_request *req, void *plugin_data)
+void rdns_curve_finish_request(struct rdns_request *req, void *plugin_data)
 {
-	struct rdns_curve_ctx *ctx = (struct rdns_curve_ctx *)plugin_data;
+	struct rdns_curve_ctx *ctx = (struct rdns_curve_ctx *) plugin_data;
 	struct rdns_curve_request *creq = req->curve_plugin_data;
 
 	if (creq != NULL) {
-		REF_RELEASE (creq->key);
-		HASH_DELETE (hh, ctx->requests, creq);
+		REF_RELEASE(creq->key);
+		HASH_DELETE(hh, ctx->requests, creq);
 	}
 }
 
-void
-rdns_curve_dtor (struct rdns_resolver *resolver, void *plugin_data)
+void rdns_curve_dtor(struct rdns_resolver *resolver, void *plugin_data)
 {
-	struct rdns_curve_ctx *ctx = (struct rdns_curve_ctx *)plugin_data;
+	struct rdns_curve_ctx *ctx = (struct rdns_curve_ctx *) plugin_data;
 
 	if (ctx->key_refresh_event != NULL) {
-		resolver->async->del_periodic (resolver->async->data,
-				ctx->key_refresh_event);
+		resolver->async->del_periodic(resolver->async->data,
+									  ctx->key_refresh_event);
 	}
-	REF_RELEASE (ctx->cur_key);
+	REF_RELEASE(ctx->cur_key);
 }
 #else
 
 /* Fake functions */
-struct rdns_curve_ctx* rdns_curve_ctx_new (double rekey_interval)
+struct rdns_curve_ctx *rdns_curve_ctx_new(double rekey_interval)
 {
 	return NULL;
 }
-void rdns_curve_ctx_add_key (struct rdns_curve_ctx *ctx,
-		const char *name, const unsigned char *pubkey)
+void rdns_curve_ctx_add_key(struct rdns_curve_ctx *ctx,
+							const char *name, const unsigned char *pubkey)
 {
-
 }
-void rdns_curve_ctx_destroy (struct rdns_curve_ctx *ctx)
+void rdns_curve_ctx_destroy(struct rdns_curve_ctx *ctx)
 {
-
 }
-void rdns_curve_register_plugin (struct rdns_resolver *resolver,
-		struct rdns_curve_ctx *ctx)
+void rdns_curve_register_plugin(struct rdns_resolver *resolver,
+								struct rdns_curve_ctx *ctx)
 {
-
 }
 
 unsigned char *
-rdns_curve_key_from_hex (const char *hex)
+rdns_curve_key_from_hex(const char *hex)
 {
 	return NULL;
 }
diff --git a/src/client/rspamdclient.c b/src/client/rspamdclient.c
index 2b8d0e9bb..bcb3cf67c 100644
--- a/src/client/rspamdclient.c
+++ b/src/client/rspamdclient.c
@@ -302,12 +302,10 @@ rspamd_client_init(struct rspamd_http_context *http_ctx,
 	conn->timeout = timeout;
 
 	if (key) {
-		conn->key = rspamd_pubkey_from_base32(key, 0, RSPAMD_KEYPAIR_KEX,
-											  RSPAMD_CRYPTOBOX_MODE_25519);
+		conn->key = rspamd_pubkey_from_base32(key, 0, RSPAMD_KEYPAIR_KEX);
 
 		if (conn->key) {
-			conn->keypair = rspamd_keypair_new(RSPAMD_KEYPAIR_KEX,
-											   RSPAMD_CRYPTOBOX_MODE_25519);
+			conn->keypair = rspamd_keypair_new(RSPAMD_KEYPAIR_KEX);
 			rspamd_http_connection_set_key(conn->http_conn, conn->keypair);
 		}
 		else {
diff --git a/src/fuzzy_storage.c b/src/fuzzy_storage.c
index 445289511..5fd3303dc 100644
--- a/src/fuzzy_storage.c
+++ b/src/fuzzy_storage.c
@@ -1088,8 +1088,7 @@ rspamd_fuzzy_make_reply(struct rspamd_fuzzy_cmd *cmd,
 												len,
 												session->reply.hdr.nonce,
 												session->nm,
-												session->reply.hdr.mac,
-												RSPAMD_CRYPTOBOX_MODE_25519);
+												session->reply.hdr.mac);
 		}
 		else if (default_disabled) {
 			/* Hash is from a forbidden flag by default, and there is no encryption override */
@@ -1668,8 +1667,7 @@ rspamd_fuzzy_decrypt_command(struct fuzzy_session *s, unsigned char *buf, gsize
 	}
 
 	/* Now process the remote pubkey */
-	rk = rspamd_pubkey_from_bin(hdr.pubkey, sizeof(hdr.pubkey),
-								RSPAMD_KEYPAIR_KEX, RSPAMD_CRYPTOBOX_MODE_25519);
+	rk = rspamd_pubkey_from_bin(hdr.pubkey, sizeof(hdr.pubkey), RSPAMD_KEYPAIR_KEX);
 
 	if (rk == NULL) {
 		msg_err("bad key; ip=%s",
@@ -1683,7 +1681,7 @@ rspamd_fuzzy_decrypt_command(struct fuzzy_session *s, unsigned char *buf, gsize
 	/* Now decrypt request */
 	if (!rspamd_cryptobox_decrypt_nm_inplace(buf, buflen, hdr.nonce,
 											 rspamd_pubkey_get_nm(rk, key->key),
-											 hdr.mac, RSPAMD_CRYPTOBOX_MODE_25519)) {
+											 hdr.mac)) {
 		msg_err("decryption failed; ip=%s",
 				rspamd_inet_address_to_string(s->addr));
 		rspamd_pubkey_unref(rk);
@@ -2771,8 +2769,7 @@ fuzzy_add_keypair_from_ucl(const ucl_object_t *obj, khash_t(rspamd_fuzzy_keys_ha
 		return NULL;
 	}
 
-	if (rspamd_keypair_alg(kp) != RSPAMD_CRYPTOBOX_MODE_25519 ||
-		rspamd_keypair_type(kp) != RSPAMD_KEYPAIR_KEX) {
+	if (rspamd_keypair_type(kp) != RSPAMD_KEYPAIR_KEX) {
 		return FALSE;
 	}
 
@@ -2837,7 +2834,7 @@ fuzzy_add_keypair_from_ucl(const ucl_object_t *obj, khash_t(rspamd_fuzzy_keys_ha
 		}
 	}
 
-	msg_debug("loaded keypair %*bs", rspamd_cryptobox_pk_bytes(RSPAMD_CRYPTOBOX_MODE_25519), pk);
+	msg_debug("loaded keypair %*bs", crypto_box_publickeybytes(), pk);
 
 	return key;
 }
diff --git a/src/libcryptobox/keypair.c b/src/libcryptobox/keypair.c
index 02070bb46..f6f932957 100644
--- a/src/libcryptobox/keypair.c
+++ b/src/libcryptobox/keypair.c
@@ -1,11 +1,11 @@
-/*-
- * Copyright 2016 Vsevolod Stakhov
+/*
+ * Copyright 2024 Vsevolod Stakhov
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
- *   http://www.apache.org/licenses/LICENSE-2.0
+ *    http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
@@ -38,29 +38,14 @@ rspamd_cryptobox_keypair_sk(struct rspamd_cryptobox_keypair *kp,
 {
 	g_assert(kp != NULL);
 
-	if (kp->alg == RSPAMD_CRYPTOBOX_MODE_25519) {
-		if (kp->type == RSPAMD_KEYPAIR_KEX) {
-			*len = 32;
-			return RSPAMD_CRYPTOBOX_KEYPAIR_25519(kp)->sk;
-		}
-		else {
-			*len = 64;
-			return RSPAMD_CRYPTOBOX_KEYPAIR_SIG_25519(kp)->sk;
-		}
+	if (kp->type == RSPAMD_KEYPAIR_KEX) {
+		*len = 32;
+		return RSPAMD_CRYPTOBOX_KEYPAIR_25519(kp)->sk;
 	}
 	else {
-		if (kp->type == RSPAMD_KEYPAIR_KEX) {
-			*len = 32;
-			return RSPAMD_CRYPTOBOX_KEYPAIR_NIST(kp)->sk;
-		}
-		else {
-			*len = 32;
-			return RSPAMD_CRYPTOBOX_KEYPAIR_SIG_NIST(kp)->sk;
-		}
+		*len = 64;
+		return RSPAMD_CRYPTOBOX_KEYPAIR_SIG_25519(kp)->sk;
 	}
-
-	/* Not reached */
-	return NULL;
 }
 
 static void *
@@ -69,29 +54,14 @@ rspamd_cryptobox_keypair_pk(struct rspamd_cryptobox_keypair *kp,
 {
 	g_assert(kp != NULL);
 
-	if (kp->alg == RSPAMD_CRYPTOBOX_MODE_25519) {
-		if (kp->type == RSPAMD_KEYPAIR_KEX) {
-			*len = 32;
-			return RSPAMD_CRYPTOBOX_KEYPAIR_25519(kp)->pk;
-		}
-		else {
-			*len = 32;
-			return RSPAMD_CRYPTOBOX_KEYPAIR_SIG_25519(kp)->pk;
-		}
+	if (kp->type == RSPAMD_KEYPAIR_KEX) {
+		*len = 32;
+		return RSPAMD_CRYPTOBOX_KEYPAIR_25519(kp)->pk;
 	}
 	else {
-		if (kp->type == RSPAMD_KEYPAIR_KEX) {
-			*len = 65;
-			return RSPAMD_CRYPTOBOX_KEYPAIR_NIST(kp)->pk;
-		}
-		else {
-			*len = 65;
-			return RSPAMD_CRYPTOBOX_KEYPAIR_SIG_NIST(kp)->pk;
-		}
+		*len = 32;
+		return RSPAMD_CRYPTOBOX_KEYPAIR_SIG_25519(kp)->pk;
 	}
-
-	/* Not reached */
-	return NULL;
 }
 
 static void *
@@ -100,53 +70,27 @@ rspamd_cryptobox_pubkey_pk(const struct rspamd_cryptobox_pubkey *kp,
 {
 	g_assert(kp != NULL);
 
-	if (kp->alg == RSPAMD_CRYPTOBOX_MODE_25519) {
-		if (kp->type == RSPAMD_KEYPAIR_KEX) {
-			*len = 32;
-			return RSPAMD_CRYPTOBOX_PUBKEY_25519(kp)->pk;
-		}
-		else {
-			*len = 32;
-			return RSPAMD_CRYPTOBOX_PUBKEY_SIG_25519(kp)->pk;
-		}
+	if (kp->type == RSPAMD_KEYPAIR_KEX) {
+		*len = 32;
+		return RSPAMD_CRYPTOBOX_PUBKEY_25519(kp)->pk;
 	}
 	else {
-		if (kp->type == RSPAMD_KEYPAIR_KEX) {
-			*len = 65;
-			return RSPAMD_CRYPTOBOX_PUBKEY_NIST(kp)->pk;
-		}
-		else {
-			*len = 65;
-			return RSPAMD_CRYPTOBOX_PUBKEY_SIG_NIST(kp)->pk;
-		}
+		*len = 32;
+		return RSPAMD_CRYPTOBOX_PUBKEY_SIG_25519(kp)->pk;
 	}
-
-	/* Not reached */
-	return NULL;
 }
 
 static struct rspamd_cryptobox_keypair *
-rspamd_cryptobox_keypair_alloc(enum rspamd_cryptobox_keypair_type type,
-							   enum rspamd_cryptobox_mode alg)
+rspamd_cryptobox_keypair_alloc(enum rspamd_cryptobox_keypair_type type)
 {
 	struct rspamd_cryptobox_keypair *kp;
 	unsigned int size = 0;
 
-	if (alg == RSPAMD_CRYPTOBOX_MODE_25519) {
-		if (type == RSPAMD_KEYPAIR_KEX) {
-			size = sizeof(struct rspamd_cryptobox_keypair_25519);
-		}
-		else {
-			size = sizeof(struct rspamd_cryptobox_keypair_sig_25519);
-		}
+	if (type == RSPAMD_KEYPAIR_KEX) {
+		size = sizeof(struct rspamd_cryptobox_keypair_25519);
 	}
 	else {
-		if (type == RSPAMD_KEYPAIR_KEX) {
-			size = sizeof(struct rspamd_cryptobox_keypair_nist);
-		}
-		else {
-			size = sizeof(struct rspamd_cryptobox_keypair_sig_nist);
-		}
+		size = sizeof(struct rspamd_cryptobox_keypair_sig_25519);
 	}
 
 	g_assert(size >= sizeof(*kp));
@@ -161,27 +105,17 @@ rspamd_cryptobox_keypair_alloc(enum rspamd_cryptobox_keypair_type type,
 }
 
 static struct rspamd_cryptobox_pubkey *
-rspamd_cryptobox_pubkey_alloc(enum rspamd_cryptobox_keypair_type type,
-							  enum rspamd_cryptobox_mode alg)
+rspamd_cryptobox_pubkey_alloc(enum rspamd_cryptobox_keypair_type type)
 {
 	struct rspamd_cryptobox_pubkey *pk;
 	unsigned int size = 0;
 
-	if (alg == RSPAMD_CRYPTOBOX_MODE_25519) {
-		if (type == RSPAMD_KEYPAIR_KEX) {
-			size = sizeof(struct rspamd_cryptobox_pubkey_25519);
-		}
-		else {
-			size = sizeof(struct rspamd_cryptobox_pubkey_sig_25519);
-		}
+
+	if (type == RSPAMD_KEYPAIR_KEX) {
+		size = sizeof(struct rspamd_cryptobox_pubkey_25519);
 	}
 	else {
-		if (type == RSPAMD_KEYPAIR_KEX) {
-			size = sizeof(struct rspamd_cryptobox_pubkey_nist);
-		}
-		else {
-			size = sizeof(struct rspamd_cryptobox_pubkey_sig_nist);
-		}
+		size = sizeof(struct rspamd_cryptobox_pubkey_sig_25519);
 	}
 
 	g_assert(size >= sizeof(*pk));
@@ -230,25 +164,23 @@ void rspamd_cryptobox_pubkey_dtor(struct rspamd_cryptobox_pubkey *p)
 }
 
 struct rspamd_cryptobox_keypair *
-rspamd_keypair_new(enum rspamd_cryptobox_keypair_type type,
-				   enum rspamd_cryptobox_mode alg)
+rspamd_keypair_new(enum rspamd_cryptobox_keypair_type type)
 {
 	struct rspamd_cryptobox_keypair *kp;
 	void *pk, *sk;
 	unsigned int size;
 
-	kp = rspamd_cryptobox_keypair_alloc(type, alg);
-	kp->alg = alg;
+	kp = rspamd_cryptobox_keypair_alloc(type);
 	kp->type = type;
 
 	sk = rspamd_cryptobox_keypair_sk(kp, &size);
 	pk = rspamd_cryptobox_keypair_pk(kp, &size);
 
 	if (type == RSPAMD_KEYPAIR_KEX) {
-		rspamd_cryptobox_keypair(pk, sk, alg);
+		rspamd_cryptobox_keypair(pk, sk);
 	}
 	else {
-		rspamd_cryptobox_keypair_sig(pk, sk, alg);
+		rspamd_cryptobox_keypair_sig(pk, sk);
 	}
 
 	rspamd_cryptobox_hash(kp->id, pk, size, NULL, 0);
@@ -302,27 +234,10 @@ rspamd_pubkey_type(struct rspamd_cryptobox_pubkey *p)
 }
 
 
-enum rspamd_cryptobox_mode
-rspamd_keypair_alg(struct rspamd_cryptobox_keypair *kp)
-{
-	g_assert(kp != NULL);
-
-	return kp->alg;
-}
-
-enum rspamd_cryptobox_mode
-rspamd_pubkey_alg(struct rspamd_cryptobox_pubkey *p)
-{
-	g_assert(p != NULL);
-
-	return p->alg;
-}
-
 struct rspamd_cryptobox_pubkey *
 rspamd_pubkey_from_base32(const char *b32,
 						  gsize len,
-						  enum rspamd_cryptobox_keypair_type type,
-						  enum rspamd_cryptobox_mode alg)
+						  enum rspamd_cryptobox_keypair_type type)
 {
 	unsigned char *decoded;
 	gsize dlen, expected_len;
@@ -342,16 +257,15 @@ rspamd_pubkey_from_base32(const char *b32,
 		return NULL;
 	}
 
-	expected_len = (type == RSPAMD_KEYPAIR_KEX) ? rspamd_cryptobox_pk_bytes(alg) : rspamd_cryptobox_pk_sig_bytes(alg);
+	expected_len = (type == RSPAMD_KEYPAIR_KEX) ? crypto_box_PUBLICKEYBYTES : crypto_sign_PUBLICKEYBYTES;
 
 	if (dlen != expected_len) {
 		g_free(decoded);
 		return NULL;
 	}
 
-	pk = rspamd_cryptobox_pubkey_alloc(type, alg);
+	pk = rspamd_cryptobox_pubkey_alloc(type);
 	REF_INIT_RETAIN(pk, rspamd_cryptobox_pubkey_dtor);
-	pk->alg = alg;
 	pk->type = type;
 	pk_data = rspamd_cryptobox_pubkey_pk(pk, &pklen);
 
@@ -365,8 +279,7 @@ rspamd_pubkey_from_base32(const char *b32,
 struct rspamd_cryptobox_pubkey *
 rspamd_pubkey_from_hex(const char *hex,
 					   gsize len,
-					   enum rspamd_cryptobox_keypair_type type,
-					   enum rspamd_cryptobox_mode alg)
+					   enum rspamd_cryptobox_keypair_type type)
 {
 	unsigned char *decoded;
 	gsize dlen, expected_len;
@@ -388,16 +301,15 @@ rspamd_pubkey_from_hex(const char *hex,
 		return NULL;
 	}
 
-	expected_len = (type == RSPAMD_KEYPAIR_KEX) ? rspamd_cryptobox_pk_bytes(alg) : rspamd_cryptobox_pk_sig_bytes(alg);
+	expected_len = (type == RSPAMD_KEYPAIR_KEX) ? crypto_box_PUBLICKEYBYTES : crypto_sign_PUBLICKEYBYTES;
 
 	if (dlen != expected_len) {
 		g_free(decoded);
 		return NULL;
 	}
 
-	pk = rspamd_cryptobox_pubkey_alloc(type, alg);
+	pk = rspamd_cryptobox_pubkey_alloc(type);
 	REF_INIT_RETAIN(pk, rspamd_cryptobox_pubkey_dtor);
-	pk->alg = alg;
 	pk->type = type;
 	pk_data = rspamd_cryptobox_pubkey_pk(pk, &pklen);
 
@@ -411,8 +323,7 @@ rspamd_pubkey_from_hex(const char *hex,
 struct rspamd_cryptobox_pubkey *
 rspamd_pubkey_from_bin(const unsigned char *raw,
 					   gsize len,
-					   enum rspamd_cryptobox_keypair_type type,
-					   enum rspamd_cryptobox_mode alg)
+					   enum rspamd_cryptobox_keypair_type type)
 {
 	gsize expected_len;
 	unsigned int pklen;
@@ -421,15 +332,14 @@ rspamd_pubkey_from_bin(const unsigned char *raw,
 
 	g_assert(raw != NULL && len > 0);
 
-	expected_len = (type == RSPAMD_KEYPAIR_KEX) ? rspamd_cryptobox_pk_bytes(alg) : rspamd_cryptobox_pk_sig_bytes(alg);
+	(type == RSPAMD_KEYPAIR_KEX) ? crypto_box_PUBLICKEYBYTES : crypto_sign_PUBLICKEYBYTES;
 
 	if (len != expected_len) {
 		return NULL;
 	}
 
-	pk = rspamd_cryptobox_pubkey_alloc(type, alg);
+	pk = rspamd_cryptobox_pubkey_alloc(type);
 	REF_INIT_RETAIN(pk, rspamd_cryptobox_pubkey_dtor);
-	pk->alg = alg;
 	pk->type = type;
 	pk_data = rspamd_cryptobox_pubkey_pk(pk, &pklen);
 
@@ -463,7 +373,6 @@ const unsigned char *
 rspamd_pubkey_calculate_nm(struct rspamd_cryptobox_pubkey *p,
 						   struct rspamd_cryptobox_keypair *kp)
 {
-	g_assert(kp->alg == p->alg);
 	g_assert(kp->type == p->type);
 	g_assert(p->type == RSPAMD_KEYPAIR_KEX);
 
@@ -476,22 +385,12 @@ rspamd_pubkey_calculate_nm(struct rspamd_cryptobox_pubkey *p,
 		REF_INIT_RETAIN(p->nm, rspamd_cryptobox_nm_dtor);
 	}
 
-	if (kp->alg == RSPAMD_CRYPTOBOX_MODE_25519) {
-		struct rspamd_cryptobox_pubkey_25519 *rk_25519 =
-			RSPAMD_CRYPTOBOX_PUBKEY_25519(p);
-		struct rspamd_cryptobox_keypair_25519 *sk_25519 =
-			RSPAMD_CRYPTOBOX_KEYPAIR_25519(kp);
+	struct rspamd_cryptobox_pubkey_25519 *rk_25519 =
+		RSPAMD_CRYPTOBOX_PUBKEY_25519(p);
+	struct rspamd_cryptobox_keypair_25519 *sk_25519 =
+		RSPAMD_CRYPTOBOX_KEYPAIR_25519(kp);
 
-		rspamd_cryptobox_nm(p->nm->nm, rk_25519->pk, sk_25519->sk, p->alg);
-	}
-	else {
-		struct rspamd_cryptobox_pubkey_nist *rk_nist =
-			RSPAMD_CRYPTOBOX_PUBKEY_NIST(p);
-		struct rspamd_cryptobox_keypair_nist *sk_nist =
-			RSPAMD_CRYPTOBOX_KEYPAIR_NIST(kp);
-
-		rspamd_cryptobox_nm(p->nm->nm, rk_nist->pk, sk_nist->sk, p->alg);
-	}
+	rspamd_cryptobox_nm(p->nm->nm, rk_25519->pk, sk_25519->sk);
 
 	return p->nm->nm;
 }
@@ -662,7 +561,6 @@ rspamd_keypair_from_ucl(const ucl_object_t *obj)
 	const ucl_object_t *privkey, *pubkey, *elt;
 	const char *str;
 	enum rspamd_cryptobox_keypair_type type = RSPAMD_KEYPAIR_KEX;
-	enum rspamd_cryptobox_mode mode = RSPAMD_CRYPTOBOX_MODE_25519;
 	gboolean is_hex = FALSE;
 	struct rspamd_cryptobox_keypair *kp;
 	unsigned int len;
@@ -705,19 +603,6 @@ rspamd_keypair_from_ucl(const ucl_object_t *obj)
 		/* TODO: handle errors */
 	}
 
-	elt = ucl_object_lookup(obj, "algorithm");
-	if (elt && ucl_object_type(elt) == UCL_STRING) {
-		str = ucl_object_tostring(elt);
-
-		if (g_ascii_strcasecmp(str, "curve25519") == 0) {
-			mode = RSPAMD_CRYPTOBOX_MODE_25519;
-		}
-		else if (g_ascii_strcasecmp(str, "nistp256") == 0) {
-			mode = RSPAMD_CRYPTOBOX_MODE_NIST;
-		}
-		/* TODO: handle errors */
-	}
-
 	elt = ucl_object_lookup(obj, "encoding");
 	if (elt && ucl_object_type(elt) == UCL_STRING) {
 		str = ucl_object_tostring(elt);
@@ -728,9 +613,8 @@ rspamd_keypair_from_ucl(const ucl_object_t *obj)
 		/* TODO: handle errors */
 	}
 
-	kp = rspamd_cryptobox_keypair_alloc(type, mode);
+	kp = rspamd_cryptobox_keypair_alloc(type);
 	kp->type = type;
-	kp->alg = mode;
 	REF_INIT_RETAIN(kp, rspamd_cryptobox_keypair_dtor);
 	g_assert(kp != NULL);
 
@@ -838,8 +722,7 @@ rspamd_keypair_to_ucl(struct rspamd_cryptobox_keypair *kp,
 						  "encoding", 0, false);
 
 	ucl_object_insert_key(elt,
-						  ucl_object_fromstring(
-							  kp->alg == RSPAMD_CRYPTOBOX_MODE_NIST ? "nistp256" : "curve25519"),
+						  ucl_object_fromstring("curve25519"),
 						  "algorithm", 0, false);
 
 	ucl_object_insert_key(elt,
@@ -873,9 +756,9 @@ rspamd_keypair_decrypt(struct rspamd_cryptobox_keypair *kp,
 		return FALSE;
 	}
 
-	if (inlen < sizeof(encrypted_magic) + rspamd_cryptobox_pk_bytes(kp->alg) +
-					rspamd_cryptobox_mac_bytes(kp->alg) +
-					rspamd_cryptobox_nonce_bytes(kp->alg)) {
+	if (inlen < sizeof(encrypted_magic) + crypto_box_publickeybytes() +
+					crypto_box_macbytes() +
+					crypto_box_noncebytes()) {
 		g_set_error(err, rspamd_keypair_quark(), E2BIG, "invalid size: too small");
 
 		return FALSE;
@@ -890,9 +773,9 @@ rspamd_keypair_decrypt(struct rspamd_cryptobox_keypair *kp,
 
 	/* Set pointers */
 	pubkey = in + sizeof(encrypted_magic);
-	mac = pubkey + rspamd_cryptobox_pk_bytes(kp->alg);
-	nonce = mac + rspamd_cryptobox_mac_bytes(kp->alg);
-	data = nonce + rspamd_cryptobox_nonce_bytes(kp->alg);
+	mac = pubkey + crypto_box_publickeybytes();
+	nonce = mac + crypto_box_macbytes();
+	data = nonce + crypto_box_noncebytes();
 
 	if (data - in >= inlen) {
 		g_set_error(err, rspamd_keypair_quark(), E2BIG, "invalid size: too small");
@@ -908,7 +791,7 @@ rspamd_keypair_decrypt(struct rspamd_cryptobox_keypair *kp,
 
 	if (!rspamd_cryptobox_decrypt_inplace(*out, inlen, nonce, pubkey,
 										  rspamd_keypair_component(kp, RSPAMD_KEYPAIR_COMPONENT_SK, NULL),
-										  mac, kp->alg)) {
+										  mac)) {
 		g_set_error(err, rspamd_keypair_quark(), EPERM, "verification failed");
 		g_free(*out);
 
@@ -942,26 +825,26 @@ rspamd_keypair_encrypt(struct rspamd_cryptobox_keypair *kp,
 		return FALSE;
 	}
 
-	local = rspamd_keypair_new(kp->type, kp->alg);
+	local = rspamd_keypair_new(kp->type);
 
 	olen = inlen + sizeof(encrypted_magic) +
-		   rspamd_cryptobox_pk_bytes(kp->alg) +
-		   rspamd_cryptobox_mac_bytes(kp->alg) +
-		   rspamd_cryptobox_nonce_bytes(kp->alg);
+		   crypto_box_publickeybytes() +
+		   crypto_box_macbytes() +
+		   crypto_box_noncebytes();
 	*out = g_malloc(olen);
 	memcpy(*out, encrypted_magic, sizeof(encrypted_magic));
 	pubkey = *out + sizeof(encrypted_magic);
-	mac = pubkey + rspamd_cryptobox_pk_bytes(kp->alg);
-	nonce = mac + rspamd_cryptobox_mac_bytes(kp->alg);
-	data = nonce + rspamd_cryptobox_nonce_bytes(kp->alg);
+	mac = pubkey + crypto_box_publickeybytes();
+	nonce = mac + crypto_box_macbytes();
+	data = nonce + crypto_box_noncebytes();
 
-	ottery_rand_bytes(nonce, rspamd_cryptobox_nonce_bytes(kp->alg));
+	ottery_rand_bytes(nonce, crypto_box_noncebytes());
 	memcpy(data, in, inlen);
 	memcpy(pubkey, rspamd_keypair_component(kp, RSPAMD_KEYPAIR_COMPONENT_PK, NULL),
-		   rspamd_cryptobox_pk_bytes(kp->alg));
+		   crypto_box_publickeybytes());
 	rspamd_cryptobox_encrypt_inplace(data, inlen, nonce, pubkey,
 									 rspamd_keypair_component(local, RSPAMD_KEYPAIR_COMPONENT_SK, NULL),
-									 mac, kp->alg);
+									 mac);
 	rspamd_keypair_unref(local);
 
 	if (outlen) {
@@ -991,26 +874,26 @@ rspamd_pubkey_encrypt(struct rspamd_cryptobox_pubkey *pk,
 		return FALSE;
 	}
 
-	local = rspamd_keypair_new(pk->type, pk->alg);
+	local = rspamd_keypair_new(pk->type);
 
 	olen = inlen + sizeof(encrypted_magic) +
-		   rspamd_cryptobox_pk_bytes(pk->alg) +
-		   rspamd_cryptobox_mac_bytes(pk->alg) +
-		   rspamd_cryptobox_nonce_bytes(pk->alg);
+		   crypto_box_publickeybytes() +
+		   crypto_box_macbytes() +
+		   crypto_box_noncebytes();
 	*out = g_malloc(olen);
 	memcpy(*out, encrypted_magic, sizeof(encrypted_magic));
 	pubkey = *out + sizeof(encrypted_magic);
-	mac = pubkey + rspamd_cryptobox_pk_bytes(pk->alg);
-	nonce = mac + rspamd_cryptobox_mac_bytes(pk->alg);
-	data = nonce + rspamd_cryptobox_nonce_bytes(pk->alg);
+	mac = pubkey + crypto_box_publickeybytes();
+	nonce = mac + crypto_box_macbytes();
+	data = nonce + crypto_box_noncebytes();
 
-	ottery_rand_bytes(nonce, rspamd_cryptobox_nonce_bytes(pk->alg));
+	ottery_rand_bytes(nonce, crypto_box_noncebytes());
 	memcpy(data, in, inlen);
 	memcpy(pubkey, rspamd_pubkey_get_pk(pk, NULL),
-		   rspamd_cryptobox_pk_bytes(pk->alg));
+		   crypto_box_publickeybytes());
 	rspamd_cryptobox_encrypt_inplace(data, inlen, nonce, pubkey,
 									 rspamd_keypair_component(local, RSPAMD_KEYPAIR_COMPONENT_SK, NULL),
-									 mac, pk->alg);
+									 mac);
 	rspamd_keypair_unref(local);
 
 	if (outlen) {
diff --git a/src/libcryptobox/keypair.h b/src/libcryptobox/keypair.h
index 849246255..97b46cbf5 100644
--- a/src/libcryptobox/keypair.h
+++ b/src/libcryptobox/keypair.h
@@ -1,11 +1,11 @@
-/*-
- * Copyright 2016 Vsevolod Stakhov
+/*
+ * Copyright 2024 Vsevolod Stakhov
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
- *   http://www.apache.org/licenses/LICENSE-2.0
+ *    http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
@@ -50,8 +50,7 @@ struct rspamd_cryptobox_pubkey;
  * @return fresh keypair generated
  */
 struct rspamd_cryptobox_keypair *rspamd_keypair_new(
-	enum rspamd_cryptobox_keypair_type type,
-	enum rspamd_cryptobox_mode alg);
+	enum rspamd_cryptobox_keypair_type type);
 
 /**
  * Increase refcount for the specific keypair
@@ -84,8 +83,7 @@ struct rspamd_cryptobox_pubkey *rspamd_pubkey_ref(
  */
 struct rspamd_cryptobox_pubkey *rspamd_pubkey_from_base32(const char *b32,
 														  gsize len,
-														  enum rspamd_cryptobox_keypair_type type,
-														  enum rspamd_cryptobox_mode alg);
+														  enum rspamd_cryptobox_keypair_type type);
 
 /**
  * Load pubkey from hex string
@@ -96,8 +94,7 @@ struct rspamd_cryptobox_pubkey *rspamd_pubkey_from_base32(const char *b32,
  */
 struct rspamd_cryptobox_pubkey *rspamd_pubkey_from_hex(const char *hex,
 													   gsize len,
-													   enum rspamd_cryptobox_keypair_type type,
-													   enum rspamd_cryptobox_mode alg);
+													   enum rspamd_cryptobox_keypair_type type);
 
 /**
  * Load pubkey from raw chunk string
@@ -108,8 +105,7 @@ struct rspamd_cryptobox_pubkey *rspamd_pubkey_from_hex(const char *hex,
  */
 struct rspamd_cryptobox_pubkey *rspamd_pubkey_from_bin(const unsigned char *raw,
 													   gsize len,
-													   enum rspamd_cryptobox_keypair_type type,
-													   enum rspamd_cryptobox_mode alg);
+													   enum rspamd_cryptobox_keypair_type type);
 
 
 /**
@@ -127,18 +123,7 @@ enum rspamd_cryptobox_keypair_type rspamd_keypair_type(
 /**
  * Get type of pubkey
  */
-enum rspamd_cryptobox_keypair_type rspamd_pubkey_type(
-	struct rspamd_cryptobox_pubkey *p);
-
-/**
- * Get algorithm of keypair
- */
-enum rspamd_cryptobox_mode rspamd_keypair_alg(struct rspamd_cryptobox_keypair *kp);
-
-/**
- * Get algorithm of pubkey
- */
-enum rspamd_cryptobox_mode rspamd_pubkey_alg(struct rspamd_cryptobox_pubkey *p);
+enum rspamd_cryptobox_keypair_type rspamd_pubkey_type(struct rspamd_cryptobox_pubkey *p);
 
 /**
  * Get cached NM for this specific pubkey
diff --git a/src/libcryptobox/keypair_private.h b/src/libcryptobox/keypair_private.h
index 793231701..2e372777c 100644
--- a/src/libcryptobox/keypair_private.h
+++ b/src/libcryptobox/keypair_private.h
@@ -1,11 +1,11 @@
-/*-
- * Copyright 2016 Vsevolod Stakhov
+/*
+ * Copyright 2024 Vsevolod Stakhov
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
- *   http://www.apache.org/licenses/LICENSE-2.0
+ *    http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
@@ -38,22 +38,11 @@ struct rspamd_cryptobox_nm {
 struct rspamd_cryptobox_keypair {
 	unsigned char id[rspamd_cryptobox_HASHBYTES];
 	enum rspamd_cryptobox_keypair_type type;
-	enum rspamd_cryptobox_mode alg;
 	ucl_object_t *extensions;
 	ref_entry_t ref;
 };
 
 /*
- * NIST p256 ecdh keypair
- */
-#define RSPAMD_CRYPTOBOX_KEYPAIR_NIST(x) ((struct rspamd_cryptobox_keypair_nist *) (x))
-struct rspamd_cryptobox_keypair_nist {
-	struct rspamd_cryptobox_keypair parent;
-	unsigned char sk[32];
-	unsigned char pk[65];
-};
-
-/*
  * Curve25519 ecdh keypair
  */
 #define RSPAMD_CRYPTOBOX_KEYPAIR_25519(x) ((struct rspamd_cryptobox_keypair_25519 *) (x))
@@ -64,16 +53,6 @@ struct rspamd_cryptobox_keypair_25519 {
 };
 
 /*
- * NIST p256 ecdsa keypair
- */
-#define RSPAMD_CRYPTOBOX_KEYPAIR_SIG_NIST(x) ((struct rspamd_cryptobox_keypair_sig_nist *) (x))
-struct rspamd_cryptobox_keypair_sig_nist {
-	struct rspamd_cryptobox_keypair parent;
-	unsigned char sk[32];
-	unsigned char pk[65];
-};
-
-/*
  * Ed25519 keypair
  */
 #define RSPAMD_CRYPTOBOX_KEYPAIR_SIG_25519(x) ((struct rspamd_cryptobox_keypair_sig_25519 *) (x))
@@ -90,20 +69,10 @@ struct rspamd_cryptobox_pubkey {
 	unsigned char id[rspamd_cryptobox_HASHBYTES];
 	struct rspamd_cryptobox_nm *nm;
 	enum rspamd_cryptobox_keypair_type type;
-	enum rspamd_cryptobox_mode alg;
 	ref_entry_t ref;
 };
 
 /*
- * Public p256 ecdh
- */
-#define RSPAMD_CRYPTOBOX_PUBKEY_NIST(x) ((struct rspamd_cryptobox_pubkey_nist *) (x))
-struct rspamd_cryptobox_pubkey_nist {
-	struct rspamd_cryptobox_pubkey parent;
-	unsigned char pk[65];
-};
-
-/*
  * Public curve25519 ecdh
  */
 #define RSPAMD_CRYPTOBOX_PUBKEY_25519(x) ((struct rspamd_cryptobox_pubkey_25519 *) (x))
@@ -113,15 +82,6 @@ struct rspamd_cryptobox_pubkey_25519 {
 };
 
 /*
- * Public p256 ecdsa
- */
-#define RSPAMD_CRYPTOBOX_PUBKEY_SIG_NIST(x) ((struct rspamd_cryptobox_pubkey_sig_nist *) (x))
-struct rspamd_cryptobox_pubkey_sig_nist {
-	struct rspamd_cryptobox_pubkey parent;
-	unsigned char pk[65];
-};
-
-/*
  * Public ed25519
  */
 #define RSPAMD_CRYPTOBOX_PUBKEY_SIG_25519(x) ((struct rspamd_cryptobox_pubkey_sig_25519 *) (x))
diff --git a/src/libcryptobox/keypairs_cache.c b/src/libcryptobox/keypairs_cache.c
index 6003d9923..0b069a64b 100644
--- a/src/libcryptobox/keypairs_cache.c
+++ b/src/libcryptobox/keypairs_cache.c
@@ -1,11 +1,11 @@
-/*-
- * Copyright 2016 Vsevolod Stakhov
+/*
+ * Copyright 2024 Vsevolod Stakhov
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
- *   http://www.apache.org/licenses/LICENSE-2.0
+ *    http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
@@ -77,7 +77,6 @@ void rspamd_keypair_cache_process(struct rspamd_keypair_cache *c,
 
 	g_assert(lk != NULL);
 	g_assert(rk != NULL);
-	g_assert(rk->alg == lk->alg);
 	g_assert(rk->type == lk->type);
 	g_assert(rk->type == RSPAMD_KEYPAIR_KEX);
 
@@ -106,22 +105,12 @@ void rspamd_keypair_cache_process(struct rspamd_keypair_cache *c,
 			   rspamd_cryptobox_HASHBYTES);
 		memcpy(&new->nm->sk_id, lk->id, sizeof(uint64_t));
 
-		if (rk->alg == RSPAMD_CRYPTOBOX_MODE_25519) {
-			struct rspamd_cryptobox_pubkey_25519 *rk_25519 =
-				RSPAMD_CRYPTOBOX_PUBKEY_25519(rk);
-			struct rspamd_cryptobox_keypair_25519 *sk_25519 =
-				RSPAMD_CRYPTOBOX_KEYPAIR_25519(lk);
+		struct rspamd_cryptobox_pubkey_25519 *rk_25519 =
+			RSPAMD_CRYPTOBOX_PUBKEY_25519(rk);
+		struct rspamd_cryptobox_keypair_25519 *sk_25519 =
+			RSPAMD_CRYPTOBOX_KEYPAIR_25519(lk);
 
-			rspamd_cryptobox_nm(new->nm->nm, rk_25519->pk, sk_25519->sk, rk->alg);
-		}
-		else {
-			struct rspamd_cryptobox_pubkey_nist *rk_nist =
-				RSPAMD_CRYPTOBOX_PUBKEY_NIST(rk);
-			struct rspamd_cryptobox_keypair_nist *sk_nist =
-				RSPAMD_CRYPTOBOX_KEYPAIR_NIST(lk);
-
-			rspamd_cryptobox_nm(new->nm->nm, rk_nist->pk, sk_nist->sk, rk->alg);
-		}
+		rspamd_cryptobox_nm(new->nm->nm, rk_25519->pk, sk_25519->sk);
 
 		rspamd_lru_hash_insert(c->hash, new, new, time(NULL), -1);
 	}
diff --git a/src/libserver/cfg_rcl.cxx b/src/libserver/cfg_rcl.cxx
index 9b6e759bb..7856af814 100644
--- a/src/libserver/cfg_rcl.cxx
+++ b/src/libserver/cfg_rcl.cxx
@@ -3051,21 +3051,16 @@ rspamd_rcl_parse_struct_pubkey(rspamd_mempool_t *pool,
 	gsize len;
 	const char *str;
 	rspamd_cryptobox_keypair_type keypair_type = RSPAMD_KEYPAIR_KEX;
-	rspamd_cryptobox_mode keypair_mode = RSPAMD_CRYPTOBOX_MODE_25519;
 
 	if (pd->flags & RSPAMD_CL_FLAG_SIGNKEY) {
 		keypair_type = RSPAMD_KEYPAIR_SIGN;
 	}
-	if (pd->flags & RSPAMD_CL_FLAG_NISTKEY) {
-		keypair_mode = RSPAMD_CRYPTOBOX_MODE_NIST;
-	}
 
 	target = (struct rspamd_cryptobox_pubkey **) (((char *) pd->user_struct) +
 												  pd->offset);
 	if (obj->type == UCL_STRING) {
 		str = ucl_object_tolstring(obj, &len);
-		pk = rspamd_pubkey_from_base32(str, len, keypair_type,
-									   keypair_mode);
+		pk = rspamd_pubkey_from_base32(str, len, keypair_type);
 
 		if (pk != nullptr) {
 			*target = pk;
diff --git a/src/libserver/cfg_rcl.h b/src/libserver/cfg_rcl.h
index e33656b72..35b9b931f 100644
--- a/src/libserver/cfg_rcl.h
+++ b/src/libserver/cfg_rcl.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2023 Vsevolod Stakhov
+ * Copyright 2024 Vsevolod Stakhov
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -53,7 +53,6 @@ enum rspamd_rcl_flag {
 	RSPAMD_CL_FLAG_STRING_LIST_HASH = 0x1 << 12,
 	RSPAMD_CL_FLAG_MULTIPLE = 0x1 << 13,
 	RSPAMD_CL_FLAG_SIGNKEY = 0x1 << 14,
-	RSPAMD_CL_FLAG_NISTKEY = 0x1 << 15,
 };
 
 struct rspamd_rcl_struct_parser {
diff --git a/src/libserver/dkim.c b/src/libserver/dkim.c
index 0f2afc950..a76ed31ab 100644
--- a/src/libserver/dkim.c
+++ b/src/libserver/dkim.c
@@ -1393,14 +1393,13 @@ rspamd_dkim_make_key(const char *keydata,
 	if (key->type == RSPAMD_DKIM_KEY_EDDSA) {
 		key->specific.key_eddsa = key->keydata;
 
-		if (key->decoded_len != rspamd_cryptobox_pk_sig_bytes(
-									RSPAMD_CRYPTOBOX_MODE_25519)) {
+		if (key->decoded_len != crypto_sign_publickeybytes()) {
 			g_set_error(err,
 						DKIM_ERROR,
 						DKIM_SIGERROR_KEYFAIL,
-						"DKIM key is has invalid length %d for eddsa; expected %d",
+						"DKIM key is has invalid length %d for eddsa; expected %zd",
 						(int) key->decoded_len,
-						rspamd_cryptobox_pk_sig_bytes(RSPAMD_CRYPTOBOX_MODE_25519));
+						crypto_sign_publickeybytes());
 			REF_RELEASE(key);
 
 			return NULL;
@@ -2912,7 +2911,7 @@ rspamd_dkim_check(rspamd_dkim_context_t *ctx,
 
 	case RSPAMD_DKIM_KEY_EDDSA:
 		if (!rspamd_cryptobox_verify(ctx->b, ctx->blen, raw_digest, dlen,
-									 key->specific.key_eddsa, RSPAMD_CRYPTOBOX_MODE_25519)) {
+									 key->specific.key_eddsa)) {
 			msg_info_dkim(
 				"%s: headers EDDSA verification failure; "
 				"body length %d->%d; headers length %d; d=%s; s=%s; key_md5=%*xs; orig header: %s",
@@ -3113,19 +3112,18 @@ rspamd_dkim_sign_key_load(const char *key, gsize len,
 	}
 
 	if (type == RSPAMD_DKIM_KEY_RAW && (len == 32 ||
-										len == rspamd_cryptobox_sk_sig_bytes(RSPAMD_CRYPTOBOX_MODE_25519))) {
+										len == crypto_sign_secretkeybytes())) {
 		if (len == 32) {
 			/* Seeded key, need scalarmult */
 			unsigned char pk[32];
 			nkey->type = RSPAMD_DKIM_KEY_EDDSA;
-			nkey->specific.key_eddsa = g_malloc(
-				rspamd_cryptobox_sk_sig_bytes(RSPAMD_CRYPTOBOX_MODE_25519));
+			nkey->specific.key_eddsa = g_malloc(crypto_sign_secretkeybytes());
 			crypto_sign_ed25519_seed_keypair(pk, nkey->specific.key_eddsa, key);
-			nkey->keylen = rspamd_cryptobox_sk_sig_bytes(RSPAMD_CRYPTOBOX_MODE_25519);
+			nkey->keylen = crypto_sign_secretkeybytes();
 		}
 		else {
 			/* Full ed25519 key */
-			unsigned klen = rspamd_cryptobox_sk_sig_bytes(RSPAMD_CRYPTOBOX_MODE_25519);
+			unsigned klen = crypto_sign_secretkeybytes();
 			nkey->type = RSPAMD_DKIM_KEY_EDDSA;
 			nkey->specific.key_eddsa = g_malloc(klen);
 			memcpy(nkey->specific.key_eddsa, key, klen);
@@ -3518,11 +3516,10 @@ rspamd_dkim_sign(struct rspamd_task *task, const char *selector,
 		}
 	}
 	else if (ctx->key->type == RSPAMD_DKIM_KEY_EDDSA) {
-		sig_len = rspamd_cryptobox_signature_bytes(RSPAMD_CRYPTOBOX_MODE_25519);
+		sig_len = crypto_sign_bytes();
 		sig_buf = g_alloca(sig_len);
 
-		rspamd_cryptobox_sign(sig_buf, NULL, raw_digest, dlen,
-							  ctx->key->specific.key_eddsa, RSPAMD_CRYPTOBOX_MODE_25519);
+		rspamd_cryptobox_sign(sig_buf, NULL, raw_digest, dlen, ctx->key->specific.key_eddsa);
 	}
 	else {
 		g_string_free(hdr, TRUE);
diff --git a/src/libserver/http/http_connection.c b/src/libserver/http/http_connection.c
index ef39e11e7..1ae9bb034 100644
--- a/src/libserver/http/http_connection.c
+++ b/src/libserver/http/http_connection.c
@@ -1,11 +1,11 @@
-/*-
- * Copyright 2016 Vsevolod Stakhov
+/*
+ * Copyright 2024 Vsevolod Stakhov
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
- *   http://www.apache.org/licenses/LICENSE-2.0
+ *    http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
@@ -159,8 +159,7 @@ rspamd_http_parse_key(rspamd_ftok_t *data, struct rspamd_http_connection *conn,
 			if (decoded_id != NULL && id_len >= RSPAMD_KEYPAIR_SHORT_ID_LEN) {
 				pk = rspamd_pubkey_from_base32(eq_pos + 1,
 											   data->begin + data->len - eq_pos - 1,
-											   RSPAMD_KEYPAIR_KEX,
-											   RSPAMD_CRYPTOBOX_MODE_25519);
+											   RSPAMD_KEYPAIR_KEX);
 				if (pk != NULL) {
 					if (memcmp(rspamd_keypair_get_id(priv->local_key),
 							   decoded_id,
@@ -572,21 +571,18 @@ rspamd_http_decrypt_message(struct rspamd_http_connection *conn,
 	struct rspamd_http_header *hdr, *hcur, *hcurtmp;
 	struct http_parser decrypted_parser;
 	struct http_parser_settings decrypted_cb;
-	enum rspamd_cryptobox_mode mode;
 
-	mode = rspamd_keypair_alg(priv->local_key);
 	nonce = msg->body_buf.str;
-	m = msg->body_buf.str + rspamd_cryptobox_nonce_bytes(mode) +
-		rspamd_cryptobox_mac_bytes(mode);
-	dec_len = msg->body_buf.len - rspamd_cryptobox_nonce_bytes(mode) -
-			  rspamd_cryptobox_mac_bytes(mode);
+	m = msg->body_buf.str + crypto_box_noncebytes() +
+		crypto_box_macbytes();
+	dec_len = msg->body_buf.len - crypto_box_noncebytes() - crypto_box_macbytes();
 
 	if ((nm = rspamd_pubkey_get_nm(peer_key, priv->local_key)) == NULL) {
 		nm = rspamd_pubkey_calculate_nm(peer_key, priv->local_key);
 	}
 
 	if (!rspamd_cryptobox_decrypt_nm_inplace(m, dec_len, nonce,
-											 nm, m - rspamd_cryptobox_mac_bytes(mode), mode)) {
+											 nm, m - crypto_box_macbytes())) {
 		msg_err("cannot verify encrypted message, first bytes of the input: %*xs",
 				(int) MIN(msg->body_buf.len, 64), msg->body_buf.begin);
 		return -1;
@@ -640,7 +636,6 @@ rspamd_http_on_message_complete(http_parser *parser)
 		(struct rspamd_http_connection *) parser->data;
 	struct rspamd_http_connection_private *priv;
 	int ret = 0;
-	enum rspamd_cryptobox_mode mode;
 
 	if (conn->finished) {
 		return 0;
@@ -655,11 +650,10 @@ rspamd_http_on_message_complete(http_parser *parser)
 	}
 
 	if ((conn->opts & RSPAMD_HTTP_BODY_PARTIAL) == 0 && IS_CONN_ENCRYPTED(priv)) {
-		mode = rspamd_keypair_alg(priv->local_key);
 
 		if (priv->local_key == NULL || priv->msg->peer_key == NULL ||
-			priv->msg->body_buf.len < rspamd_cryptobox_nonce_bytes(mode) +
-										  rspamd_cryptobox_mac_bytes(mode)) {
+			priv->msg->body_buf.len < crypto_box_noncebytes() +
+										  crypto_box_macbytes()) {
 			msg_err("cannot decrypt message");
 			return -1;
 		}
@@ -1576,10 +1570,8 @@ rspamd_http_connection_encrypt_message(
 	int i, cnt;
 	unsigned int outlen;
 	struct rspamd_http_header *hdr, *hcur;
-	enum rspamd_cryptobox_mode mode;
 
-	mode = rspamd_keypair_alg(priv->local_key);
-	crlfp = mp + rspamd_cryptobox_mac_bytes(mode);
+	crlfp = mp + crypto_box_macbytes();
 
 	outlen = priv->out[0].iov_len + priv->out[1].iov_len;
 	/*
@@ -1632,7 +1624,7 @@ if ((nm = rspamd_pubkey_get_nm(peer_key, priv->local_key)) == NULL) {
 	nm = rspamd_pubkey_calculate_nm(peer_key, priv->local_key);
 }
 
-rspamd_cryptobox_encryptv_nm_inplace(segments, cnt, np, nm, mp, mode);
+rspamd_cryptobox_encryptv_nm_inplace(segments, cnt, np, nm, mp);
 
 /*
 	 * iov[0] = base HTTP request
@@ -1642,12 +1634,12 @@ rspamd_cryptobox_encryptv_nm_inplace(segments, cnt, np, nm, mp, mode);
 	 * iov[4..i] = encrypted HTTP request/reply
 	 */
 priv->out[2].iov_base = np;
-priv->out[2].iov_len = rspamd_cryptobox_nonce_bytes(mode);
+priv->out[2].iov_len = crypto_box_noncebytes();
 priv->out[3].iov_base = mp;
-priv->out[3].iov_len = rspamd_cryptobox_mac_bytes(mode);
+priv->out[3].iov_len = crypto_box_macbytes();
 
-outlen += rspamd_cryptobox_nonce_bytes(mode) +
-		  rspamd_cryptobox_mac_bytes(mode);
+outlen += crypto_box_noncebytes() +
+		  crypto_box_macbytes();
 
 for (i = 0; i < cnt; i++) {
 	priv->out[i + 4].iov_base = segments[i].data;
@@ -2027,7 +2019,6 @@ rspamd_http_connection_write_message_common(struct rspamd_http_connection *conn,
 	unsigned char nonce[rspamd_cryptobox_MAX_NONCEBYTES], mac[rspamd_cryptobox_MAX_MACBYTES];
 	unsigned char *np = NULL, *mp = NULL, *meth_pos = NULL;
 	struct rspamd_cryptobox_pubkey *peer_key = NULL;
-	enum rspamd_cryptobox_mode mode;
 	GError *err;
 
 	conn->ud = ud;
@@ -2059,8 +2050,7 @@ rspamd_http_connection_write_message_common(struct rspamd_http_connection *conn,
 	if (msg->peer_key != NULL) {
 		if (priv->local_key == NULL) {
 			/* Automatically generate a temporary keypair */
-			priv->local_key = rspamd_keypair_new(RSPAMD_KEYPAIR_KEX,
-												 RSPAMD_CRYPTOBOX_MODE_25519);
+			priv->local_key = rspamd_keypair_new(RSPAMD_KEYPAIR_KEX);
 		}
 
 		encrypted = TRUE;
@@ -2128,8 +2118,6 @@ rspamd_http_connection_write_message_common(struct rspamd_http_connection *conn,
 	}
 
 	if (encrypted) {
-		mode = rspamd_keypair_alg(priv->local_key);
-
 		if (msg->body_buf.len == 0) {
 			pbody = NULL;
 			bodylen = 0;
@@ -2154,8 +2142,8 @@ rspamd_http_connection_write_message_common(struct rspamd_http_connection *conn,
 			 * [iov[n + 2] = encrypted body]
 			 */
 			priv->outlen = 7;
-			enclen = rspamd_cryptobox_nonce_bytes(mode) +
-					 rspamd_cryptobox_mac_bytes(mode) +
+			enclen = crypto_box_noncebytes() +
+					 crypto_box_macbytes() +
 					 4 + /* 2 * CRLF */
 					 bodylen;
 		}
@@ -2197,8 +2185,8 @@ rspamd_http_connection_write_message_common(struct rspamd_http_connection *conn,
 											 ENCRYPTED_VERSION);
 			}
 
-			enclen = rspamd_cryptobox_nonce_bytes(mode) +
-					 rspamd_cryptobox_mac_bytes(mode) +
+			enclen = crypto_box_noncebytes() +
+					 crypto_box_macbytes() +
 					 preludelen + /* version [content-length] + 2 * CRLF */
 					 bodylen;
 		}
@@ -2275,10 +2263,9 @@ priv->out[0].iov_len = buf->len;
 /* Buf will be used eventually for encryption */
 if (encrypted) {
 	int meth_offset, nonce_offset, mac_offset;
-	mode = rspamd_keypair_alg(priv->local_key);
 
-	ottery_rand_bytes(nonce, rspamd_cryptobox_nonce_bytes(mode));
-	memset(mac, 0, rspamd_cryptobox_mac_bytes(mode));
+	ottery_rand_bytes(nonce, crypto_box_noncebytes());
+	memset(mac, 0, crypto_box_macbytes());
 	meth_offset = buf->len;
 
 	if (conn->type == RSPAMD_HTTP_SERVER) {
@@ -2292,11 +2279,9 @@ if (encrypted) {
 	}
 
 	nonce_offset = buf->len;
-	buf = rspamd_fstring_append(buf, nonce,
-								rspamd_cryptobox_nonce_bytes(mode));
+	buf = rspamd_fstring_append(buf, nonce, crypto_box_noncebytes());
 	mac_offset = buf->len;
-	buf = rspamd_fstring_append(buf, mac,
-								rspamd_cryptobox_mac_bytes(mode));
+	buf = rspamd_fstring_append(buf, mac, crypto_box_macbytes());
 
 	/* Need to be encrypted */
 	if (conn->type == RSPAMD_HTTP_SERVER) {
@@ -2365,44 +2350,44 @@ if (conn->opts & RSPAMD_HTTP_CLIENT_SSL) {
 	gpointer ssl_ctx = (msg->flags & RSPAMD_HTTP_FLAG_SSL_NOVERIFY) ? priv->ctx->ssl_ctx_noverify : priv->ctx->ssl_ctx;
 
 	if (!ssl_ctx) {
-			err = g_error_new(HTTP_ERROR, 400, "ssl message requested "
-											   "with no ssl ctx");
-			rspamd_http_connection_ref(conn);
-			conn->error_handler(conn, err);
-			rspamd_http_connection_unref(conn);
-			g_error_free(err);
-			return FALSE;
+		err = g_error_new(HTTP_ERROR, 400, "ssl message requested "
+										   "with no ssl ctx");
+		rspamd_http_connection_ref(conn);
+		conn->error_handler(conn, err);
+		rspamd_http_connection_unref(conn);
+		g_error_free(err);
+		return FALSE;
 	}
 	else {
-			if (!priv->ssl) {
-				priv->ssl = rspamd_ssl_connection_new(ssl_ctx, priv->ctx->event_loop,
-													  !(msg->flags & RSPAMD_HTTP_FLAG_SSL_NOVERIFY),
-													  conn->log_tag);
-				g_assert(priv->ssl != NULL);
-
-				if (!rspamd_ssl_connect_fd(priv->ssl, conn->fd, host, &priv->ev,
-										   priv->timeout, rspamd_http_event_handler,
-										   rspamd_http_ssl_err_handler, conn)) {
-
-					err = g_error_new(HTTP_ERROR, 400,
-									  "ssl connection error: ssl error=%s, errno=%s",
-									  ERR_error_string(ERR_get_error(), NULL),
-									  strerror(errno));
-					rspamd_http_connection_ref(conn);
-					conn->error_handler(conn, err);
-					rspamd_http_connection_unref(conn);
-					g_error_free(err);
-					return FALSE;
-				}
-			}
-			else {
-				/* Just restore SSL handlers */
-				rspamd_ssl_connection_restore_handlers(priv->ssl,
-													   rspamd_http_event_handler,
-													   rspamd_http_ssl_err_handler,
-													   conn,
-													   EV_WRITE);
+		if (!priv->ssl) {
+			priv->ssl = rspamd_ssl_connection_new(ssl_ctx, priv->ctx->event_loop,
+												  !(msg->flags & RSPAMD_HTTP_FLAG_SSL_NOVERIFY),
+												  conn->log_tag);
+			g_assert(priv->ssl != NULL);
+
+			if (!rspamd_ssl_connect_fd(priv->ssl, conn->fd, host, &priv->ev,
+									   priv->timeout, rspamd_http_event_handler,
+									   rspamd_http_ssl_err_handler, conn)) {
+
+				err = g_error_new(HTTP_ERROR, 400,
+								  "ssl connection error: ssl error=%s, errno=%s",
+								  ERR_error_string(ERR_get_error(), NULL),
+								  strerror(errno));
+				rspamd_http_connection_ref(conn);
+				conn->error_handler(conn, err);
+				rspamd_http_connection_unref(conn);
+				g_error_free(err);
+				return FALSE;
 			}
+		}
+		else {
+			/* Just restore SSL handlers */
+			rspamd_ssl_connection_restore_handlers(priv->ssl,
+												   rspamd_http_event_handler,
+												   rspamd_http_ssl_err_handler,
+												   conn,
+												   EV_WRITE);
+		}
 	}
 }
 else {
@@ -2467,10 +2452,10 @@ rspamd_http_connection_get_peer_key(struct rspamd_http_connection *conn)
 	struct rspamd_http_connection_private *priv = conn->priv;
 
 	if (priv->peer_key) {
-			return priv->peer_key;
+		return priv->peer_key;
 	}
 	else if (priv->msg) {
-			return priv->msg->peer_key;
+		return priv->msg->peer_key;
 	}
 
 	return NULL;
@@ -2482,10 +2467,10 @@ rspamd_http_connection_is_encrypted(struct rspamd_http_connection *conn)
 	struct rspamd_http_connection_private *priv = conn->priv;
 
 	if (priv->peer_key != NULL) {
-			return TRUE;
+		return TRUE;
 	}
 	else if (priv->msg) {
-			return priv->msg->peer_key != NULL;
+		return priv->msg->peer_key != NULL;
 	}
 
 	return FALSE;
@@ -2512,103 +2497,103 @@ rspamd_http_message_parse_query(struct rspamd_http_message *msg)
 								rspamd_fstring_mapped_ftok_free);
 
 	if (msg->url && msg->url->len > 0) {
-			http_parser_parse_url(msg->url->str, msg->url->len, TRUE, &u);
-
-			if (u.field_set & (1 << UF_QUERY)) {
-				p = msg->url->str + u.field_data[UF_QUERY].off;
-				c = p;
-				end = p + u.field_data[UF_QUERY].len;
-
-				while (p <= end) {
-					switch (state) {
-					case parse_key:
-						if ((p == end || *p == '&') && p > c) {
-							/* We have a single parameter without a value */
-							key = rspamd_fstring_new_init(c, p - c);
-							key_tok = rspamd_ftok_map(key);
-							key_tok->len = rspamd_url_decode(key->str, key->str,
-															 key->len);
-
-							value = rspamd_fstring_new_init("", 0);
-							value_tok = rspamd_ftok_map(value);
+		http_parser_parse_url(msg->url->str, msg->url->len, TRUE, &u);
+
+		if (u.field_set & (1 << UF_QUERY)) {
+			p = msg->url->str + u.field_data[UF_QUERY].off;
+			c = p;
+			end = p + u.field_data[UF_QUERY].len;
+
+			while (p <= end) {
+				switch (state) {
+				case parse_key:
+					if ((p == end || *p == '&') && p > c) {
+						/* We have a single parameter without a value */
+						key = rspamd_fstring_new_init(c, p - c);
+						key_tok = rspamd_ftok_map(key);
+						key_tok->len = rspamd_url_decode(key->str, key->str,
+														 key->len);
+
+						value = rspamd_fstring_new_init("", 0);
+						value_tok = rspamd_ftok_map(value);
+
+						g_hash_table_replace(res, key_tok, value_tok);
+						state = parse_ampersand;
+					}
+					else if (*p == '=' && p > c) {
+						/* We have something like key=value */
+						key = rspamd_fstring_new_init(c, p - c);
+						key_tok = rspamd_ftok_map(key);
+						key_tok->len = rspamd_url_decode(key->str, key->str,
+														 key->len);
+
+						state = parse_eqsign;
+					}
+					else {
+						p++;
+					}
+					break;
 
-							g_hash_table_replace(res, key_tok, value_tok);
-							state = parse_ampersand;
-						}
-						else if (*p == '=' && p > c) {
-							/* We have something like key=value */
-							key = rspamd_fstring_new_init(c, p - c);
-							key_tok = rspamd_ftok_map(key);
-							key_tok->len = rspamd_url_decode(key->str, key->str,
-															 key->len);
-
-							state = parse_eqsign;
-						}
-						else {
-							p++;
-						}
-						break;
+				case parse_eqsign:
+					if (*p != '=') {
+						c = p;
+						state = parse_value;
+					}
+					else {
+						p++;
+					}
+					break;
 
-					case parse_eqsign:
-						if (*p != '=') {
-							c = p;
-							state = parse_value;
-						}
-						else {
-							p++;
-						}
-						break;
-
-					case parse_value:
-						if ((p == end || *p == '&') && p >= c) {
-							g_assert(key != NULL);
-							if (p > c) {
-								value = rspamd_fstring_new_init(c, p - c);
-								value_tok = rspamd_ftok_map(value);
-								value_tok->len = rspamd_url_decode(value->str,
-																   value->str,
-																   value->len);
-								/* Detect quotes for value */
-								if (value_tok->begin[0] == '"') {
-									memmove(value->str, value->str + 1,
-											value_tok->len - 1);
-									value_tok->len--;
-								}
-								if (value_tok->begin[value_tok->len - 1] == '"') {
-									value_tok->len--;
-								}
+				case parse_value:
+					if ((p == end || *p == '&') && p >= c) {
+						g_assert(key != NULL);
+						if (p > c) {
+							value = rspamd_fstring_new_init(c, p - c);
+							value_tok = rspamd_ftok_map(value);
+							value_tok->len = rspamd_url_decode(value->str,
+															   value->str,
+															   value->len);
+							/* Detect quotes for value */
+							if (value_tok->begin[0] == '"') {
+								memmove(value->str, value->str + 1,
+										value_tok->len - 1);
+								value_tok->len--;
 							}
-							else {
-								value = rspamd_fstring_new_init("", 0);
-								value_tok = rspamd_ftok_map(value);
+							if (value_tok->begin[value_tok->len - 1] == '"') {
+								value_tok->len--;
 							}
-
-							g_hash_table_replace(res, key_tok, value_tok);
-							key = value = NULL;
-							key_tok = value_tok = NULL;
-							state = parse_ampersand;
 						}
 						else {
-							p++;
+							value = rspamd_fstring_new_init("", 0);
+							value_tok = rspamd_ftok_map(value);
 						}
-						break;
 
-					case parse_ampersand:
-						if (p != end && *p != '&') {
-							c = p;
-							state = parse_key;
-						}
-						else {
-							p++;
-						}
-						break;
+						g_hash_table_replace(res, key_tok, value_tok);
+						key = value = NULL;
+						key_tok = value_tok = NULL;
+						state = parse_ampersand;
+					}
+					else {
+						p++;
+					}
+					break;
+
+				case parse_ampersand:
+					if (p != end && *p != '&') {
+						c = p;
+						state = parse_key;
+					}
+					else {
+						p++;
 					}
+					break;
 				}
 			}
+		}
 
-			if (state != parse_ampersand && key != NULL) {
-				rspamd_fstring_free(key);
-			}
+		if (state != parse_ampersand && key != NULL) {
+			rspamd_fstring_free(key);
+		}
 	}
 
 	return res;
@@ -2635,15 +2620,15 @@ void rspamd_http_connection_disable_encryption(struct rspamd_http_connection *co
 	priv = conn->priv;
 
 	if (priv) {
-			if (priv->local_key) {
-				rspamd_keypair_unref(priv->local_key);
-			}
-			if (priv->peer_key) {
-				rspamd_pubkey_unref(priv->peer_key);
-			}
+		if (priv->local_key) {
+			rspamd_keypair_unref(priv->local_key);
+		}
+		if (priv->peer_key) {
+			rspamd_pubkey_unref(priv->peer_key);
+		}
 
-			priv->local_key = NULL;
-			priv->peer_key = NULL;
-			priv->flags &= ~RSPAMD_HTTP_CONN_FLAG_ENCRYPTED;
+		priv->local_key = NULL;
+		priv->peer_key = NULL;
+		priv->flags &= ~RSPAMD_HTTP_CONN_FLAG_ENCRYPTED;
 	}
 }
\ No newline at end of file
diff --git a/src/libserver/http/http_context.c b/src/libserver/http/http_context.c
index fe9412fe2..df32a2258 100644
--- a/src/libserver/http/http_context.c
+++ b/src/libserver/http/http_context.c
@@ -77,8 +77,7 @@ rspamd_http_context_client_rotate_ev(struct ev_loop *loop, ev_timer *w, int reve
 	ev_timer_again(loop, w);
 
 	kp = ctx->client_kp;
-	ctx->client_kp = rspamd_keypair_new(RSPAMD_KEYPAIR_KEX,
-										RSPAMD_CRYPTOBOX_MODE_25519);
+	ctx->client_kp = rspamd_keypair_new(RSPAMD_KEYPAIR_KEX);
 	rspamd_keypair_unref(kp);
 }
 
diff --git a/src/libserver/logger/logger.c b/src/libserver/logger/logger.c
index 13bac5cbe..25818e7a5 100644
--- a/src/libserver/logger/logger.c
+++ b/src/libserver/logger/logger.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2023 Vsevolod Stakhov
+ * Copyright 2024 Vsevolod Stakhov
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -277,8 +277,7 @@ rspamd_log_open_specific(rspamd_mempool_t *pool,
 
 		if (cfg->log_encryption_key) {
 			logger->pk = rspamd_pubkey_ref(cfg->log_encryption_key);
-			logger->keypair = rspamd_keypair_new(RSPAMD_KEYPAIR_KEX,
-												 RSPAMD_CRYPTOBOX_MODE_25519);
+			logger->keypair = rspamd_keypair_new(RSPAMD_KEYPAIR_KEX);
 			rspamd_pubkey_calculate_nm(logger->pk, logger->keypair);
 		}
 	}
@@ -342,9 +341,9 @@ rspamd_log_encrypt_message(const char *begin, const char *end, gsize *enc_len,
 
 	g_assert(end > begin);
 	/* base64 (pubkey | nonce | message) */
-	inlen = rspamd_cryptobox_nonce_bytes(RSPAMD_CRYPTOBOX_MODE_25519) +
-			rspamd_cryptobox_pk_bytes(RSPAMD_CRYPTOBOX_MODE_25519) +
-			rspamd_cryptobox_mac_bytes(RSPAMD_CRYPTOBOX_MODE_25519) +
+	inlen = crypto_box_noncebytes() +
+			crypto_box_publickeybytes() +
+			crypto_box_macbytes() +
 			(end - begin);
 	out = g_malloc(inlen);
 
@@ -352,16 +351,15 @@ rspamd_log_encrypt_message(const char *begin, const char *end, gsize *enc_len,
 	comp = rspamd_pubkey_get_pk(rspamd_log->pk, &len);
 	memcpy(p, comp, len);
 	p += len;
-	ottery_rand_bytes(p, rspamd_cryptobox_nonce_bytes(RSPAMD_CRYPTOBOX_MODE_25519));
+	ottery_rand_bytes(p, crypto_box_noncebytes());
 	nonce = p;
-	p += rspamd_cryptobox_nonce_bytes(RSPAMD_CRYPTOBOX_MODE_25519);
+	p += crypto_box_noncebytes();
 	mac = p;
-	p += rspamd_cryptobox_mac_bytes(RSPAMD_CRYPTOBOX_MODE_25519);
+	p += crypto_box_macbytes();
 	memcpy(p, begin, end - begin);
 	comp = rspamd_pubkey_get_nm(rspamd_log->pk, rspamd_log->keypair);
 	g_assert(comp != NULL);
-	rspamd_cryptobox_encrypt_nm_inplace(p, end - begin, nonce, comp, mac,
-										RSPAMD_CRYPTOBOX_MODE_25519);
+	rspamd_cryptobox_encrypt_nm_inplace(p, end - begin, nonce, comp, mac);
 	b64 = rspamd_encode_base64(out, inlen, 0, enc_len);
 	g_free(out);
 
diff --git a/src/libserver/maps/map.c b/src/libserver/maps/map.c
index 15fce7e9d..631455755 100644
--- a/src/libserver/maps/map.c
+++ b/src/libserver/maps/map.c
@@ -670,14 +670,14 @@ rspamd_map_check_sig_pk_mem(const unsigned char *sig,
 	GString *b32_key;
 	gboolean ret = TRUE;
 
-	if (siglen != rspamd_cryptobox_signature_bytes(RSPAMD_CRYPTOBOX_MODE_25519)) {
+	if (siglen != crypto_sign_bytes()) {
 		msg_err_map("can't open signature for %s: invalid size: %z", map->name, siglen);
 
 		ret = FALSE;
 	}
 
 	if (ret && !rspamd_cryptobox_verify(sig, siglen, input, inlen,
-										rspamd_pubkey_get_pk(pk, NULL), RSPAMD_CRYPTOBOX_MODE_25519)) {
+										rspamd_pubkey_get_pk(pk, NULL))) {
 		msg_err_map("can't verify signature for %s: incorrect signature", map->name);
 
 		ret = FALSE;
@@ -718,8 +718,7 @@ rspamd_map_check_file_sig(const char *fname,
 			return FALSE;
 		}
 
-		pk = rspamd_pubkey_from_base32(data, len, RSPAMD_KEYPAIR_SIGN,
-									   RSPAMD_CRYPTOBOX_MODE_25519);
+		pk = rspamd_pubkey_from_base32(data, len, RSPAMD_KEYPAIR_SIGN);
 		munmap(data, len);
 
 		if (pk == NULL) {
@@ -2414,8 +2413,7 @@ rspamd_map_check_proto(struct rspamd_config *cfg,
 			end_key = memchr(pos, '+', end - pos);
 
 			if (end_key != NULL) {
-				bk->trusted_pubkey = rspamd_pubkey_from_base32(pos, end_key - pos,
-															   RSPAMD_KEYPAIR_SIGN, RSPAMD_CRYPTOBOX_MODE_25519);
+				bk->trusted_pubkey = rspamd_pubkey_from_base32(pos, end_key - pos, RSPAMD_KEYPAIR_SIGN);
 
 				if (bk->trusted_pubkey == NULL) {
 					msg_err_config("cannot read pubkey from map: %s",
@@ -2426,8 +2424,7 @@ rspamd_map_check_proto(struct rspamd_config *cfg,
 			}
 			else if (end - pos > 64) {
 				/* Try hex encoding */
-				bk->trusted_pubkey = rspamd_pubkey_from_hex(pos, 64,
-															RSPAMD_KEYPAIR_SIGN, RSPAMD_CRYPTOBOX_MODE_25519);
+				bk->trusted_pubkey = rspamd_pubkey_from_hex(pos, 64, RSPAMD_KEYPAIR_SIGN);
 
 				if (bk->trusted_pubkey == NULL) {
 					msg_err_config("cannot read pubkey from map: %s",
diff --git a/src/lua/lua_cryptobox.c b/src/lua/lua_cryptobox.c
index bad7d7024..1b9074f58 100644
--- a/src/lua/lua_cryptobox.c
+++ b/src/lua/lua_cryptobox.c
@@ -1,11 +1,11 @@
-/*-
- * Copyright 2016 Vsevolod Stakhov
+/*
+ * Copyright 2024 Vsevolod Stakhov
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
- *   http://www.apache.org/licenses/LICENSE-2.0
+ *    http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
@@ -257,7 +257,6 @@ lua_check_cryptobox_secretbox(lua_State *L, int pos)
  * Loads public key from base32 encoded file
  * @param {string} file filename to load
  * @param {string} type optional 'sign' or 'kex' for signing and encryption
- * @param {string} alg optional 'default' or 'nist' for curve25519/nistp256 keys
  * @return {cryptobox_pubkey} new public key
  */
 static int
@@ -267,7 +266,6 @@ lua_cryptobox_pubkey_load(lua_State *L)
 	struct rspamd_cryptobox_pubkey *pkey = NULL, **ppkey;
 	const char *filename, *arg;
 	int type = RSPAMD_KEYPAIR_SIGN;
-	int alg = RSPAMD_CRYPTOBOX_MODE_25519;
 	unsigned char *map;
 	gsize len;
 
@@ -293,19 +291,8 @@ lua_cryptobox_pubkey_load(lua_State *L)
 					type = RSPAMD_KEYPAIR_KEX;
 				}
 			}
-			if (lua_type(L, 3) == LUA_TSTRING) {
-				/* algorithm */
-				arg = lua_tostring(L, 3);
-
-				if (strcmp(arg, "default") == 0 || strcmp(arg, "curve25519") == 0) {
-					type = RSPAMD_CRYPTOBOX_MODE_25519;
-				}
-				else if (strcmp(arg, "nist") == 0) {
-					type = RSPAMD_CRYPTOBOX_MODE_NIST;
-				}
-			}
 
-			pkey = rspamd_pubkey_from_base32(map, len, type, alg);
+			pkey = rspamd_pubkey_from_base32(map, len, type);
 
 			if (pkey == NULL) {
 				msg_err("cannot open pubkey from file: %s", filename);
@@ -333,7 +320,6 @@ lua_cryptobox_pubkey_load(lua_State *L)
  * Loads public key from base32 encoded string
  * @param {base32 string} base32 string with the key
  * @param {string} type optional 'sign' or 'kex' for signing and encryption
- * @param {string} alg optional 'default' or 'nist' for curve25519/nistp256 keys
  * @return {cryptobox_pubkey} new public key
  */
 static int
@@ -344,7 +330,6 @@ lua_cryptobox_pubkey_create(lua_State *L)
 	const char *buf, *arg;
 	gsize len;
 	int type = RSPAMD_KEYPAIR_SIGN;
-	int alg = RSPAMD_CRYPTOBOX_MODE_25519;
 
 	buf = luaL_checklstring(L, 1, &len);
 	if (buf != NULL) {
@@ -359,19 +344,8 @@ lua_cryptobox_pubkey_create(lua_State *L)
 				type = RSPAMD_KEYPAIR_KEX;
 			}
 		}
-		if (lua_type(L, 3) == LUA_TSTRING) {
-			/* algorithm */
-			arg = lua_tostring(L, 3);
-
-			if (strcmp(arg, "default") == 0 || strcmp(arg, "curve25519") == 0) {
-				type = RSPAMD_CRYPTOBOX_MODE_25519;
-			}
-			else if (strcmp(arg, "nist") == 0) {
-				type = RSPAMD_CRYPTOBOX_MODE_NIST;
-			}
-		}
 
-		pkey = rspamd_pubkey_from_base32(buf, len, type, alg);
+		pkey = rspamd_pubkey_from_base32(buf, len, type);
 
 		if (pkey == NULL) {
 			msg_err("cannot load pubkey from string");
@@ -477,7 +451,6 @@ lua_cryptobox_keypair_load(lua_State *L)
  * @function rspamd_cryptobox_keypair.create([type='encryption'[, alg='curve25519']])
  * Generates new keypair
  * @param {string} type type of keypair: 'encryption' (default) or 'sign'
- * @param {string} alg algorithm of keypair: 'curve25519' (default) or 'nist'
  * @return {cryptobox_keypair} new keypair
  */
 static int
@@ -486,7 +459,6 @@ lua_cryptobox_keypair_create(lua_State *L)
 	LUA_TRACE_POINT;
 	struct rspamd_cryptobox_keypair *kp, **pkp;
 	enum rspamd_cryptobox_keypair_type type = RSPAMD_KEYPAIR_KEX;
-	enum rspamd_cryptobox_mode alg = RSPAMD_CRYPTOBOX_MODE_25519;
 
 	if (lua_isstring(L, 1)) {
 		const char *str = lua_tostring(L, 1);
@@ -502,21 +474,7 @@ lua_cryptobox_keypair_create(lua_State *L)
 		}
 	}
 
-	if (lua_isstring(L, 2)) {
-		const char *str = lua_tostring(L, 2);
-
-		if (strcmp(str, "nist") == 0 || strcmp(str, "openssl") == 0) {
-			alg = RSPAMD_CRYPTOBOX_MODE_NIST;
-		}
-		else if (strcmp(str, "curve25519") == 0 || strcmp(str, "default") == 0) {
-			alg = RSPAMD_CRYPTOBOX_MODE_25519;
-		}
-		else {
-			return luaL_error(L, "invalid keypair algorithm: %s", str);
-		}
-	}
-
-	kp = rspamd_keypair_new(type, alg);
+	kp = rspamd_keypair_new(type);
 
 	pkp = lua_newuserdata(L, sizeof(gpointer));
 	*pkp = kp;
@@ -606,12 +564,7 @@ lua_cryptobox_keypair_get_alg(lua_State *L)
 	struct rspamd_cryptobox_keypair *kp = lua_check_cryptobox_keypair(L, 1);
 
 	if (kp) {
-		if (kp->alg == RSPAMD_CRYPTOBOX_MODE_25519) {
-			lua_pushstring(L, "curve25519");
-		}
-		else {
-			lua_pushstring(L, "nist");
-		}
+		lua_pushstring(L, "curve25519");
 	}
 	else {
 		return luaL_error(L, "invalid arguments");
@@ -636,7 +589,7 @@ lua_cryptobox_keypair_get_pk(lua_State *L)
 
 	if (kp) {
 		data = rspamd_keypair_component(kp, RSPAMD_KEYPAIR_COMPONENT_PK, &dlen);
-		pk = rspamd_pubkey_from_bin(data, dlen, kp->type, kp->alg);
+		pk = rspamd_pubkey_from_bin(data, dlen, kp->type);
 
 		if (pk == NULL) {
 			return luaL_error(L, "invalid keypair");
@@ -654,7 +607,7 @@ lua_cryptobox_keypair_get_pk(lua_State *L)
 }
 
 /***
- * @function rspamd_cryptobox_signature.load(file, [alg = 'curve25519'])
+ * @function rspamd_cryptobox_signature.load(file)
  * Loads signature from raw file
  * @param {string} file filename to load
  * @return {cryptobox_signature} new signature
@@ -668,7 +621,6 @@ lua_cryptobox_signature_load(lua_State *L)
 	gpointer data;
 	int fd;
 	struct stat st;
-	enum rspamd_cryptobox_mode alg = RSPAMD_CRYPTOBOX_MODE_25519;
 
 	filename = luaL_checkstring(L, 1);
 	if (filename != NULL) {
@@ -686,22 +638,6 @@ lua_cryptobox_signature_load(lua_State *L)
 				lua_pushnil(L);
 			}
 			else {
-				if (lua_isstring(L, 2)) {
-					const char *str = lua_tostring(L, 2);
-
-					if (strcmp(str, "nist") == 0 || strcmp(str, "openssl") == 0) {
-						alg = RSPAMD_CRYPTOBOX_MODE_NIST;
-					}
-					else if (strcmp(str, "curve25519") == 0 || strcmp(str, "default") == 0) {
-						alg = RSPAMD_CRYPTOBOX_MODE_25519;
-					}
-					else {
-						munmap(data, st.st_size);
-						close(fd);
-
-						return luaL_error(L, "invalid keypair algorithm: %s", str);
-					}
-				}
 				if (st.st_size > 0) {
 					sig = rspamd_fstring_new_init(data, st.st_size);
 					psig = lua_newuserdata(L, sizeof(rspamd_fstring_t *));
@@ -711,7 +647,7 @@ lua_cryptobox_signature_load(lua_State *L)
 				else {
 					msg_err("size of %s mismatches: %d while %d is expected",
 							filename, (int) st.st_size,
-							rspamd_cryptobox_signature_bytes(alg));
+							crypto_sign_bytes());
 					lua_pushnil(L);
 				}
 
@@ -821,7 +757,7 @@ lua_cryptobox_signature_create(lua_State *L)
 	}
 
 	if (data != NULL) {
-		if (dlen == rspamd_cryptobox_signature_bytes(RSPAMD_CRYPTOBOX_MODE_25519)) {
+		if (dlen == crypto_sign_bytes()) {
 			sig = rspamd_fstring_new_init(data, dlen);
 			psig = lua_newuserdata(L, sizeof(rspamd_fstring_t *));
 			rspamd_lua_setclass(L, rspamd_cryptobox_signature_classname, -1);
@@ -1723,7 +1659,7 @@ lua_cryptobox_hash_gc(lua_State *L)
 }
 
 /***
- * @function rspamd_cryptobox.verify_memory(pk, sig, data, [alg = 'curve25519'])
+ * @function rspamd_cryptobox.verify_memory(pk, sig, data)
  * Check memory using specified cryptobox key and signature
  * @param {pubkey} pk public key to verify
  * @param {sig} signature to check
@@ -1738,7 +1674,6 @@ lua_cryptobox_verify_memory(lua_State *L)
 	rspamd_fstring_t *signature;
 	struct rspamd_lua_text *t;
 	const char *data;
-	enum rspamd_cryptobox_mode alg = RSPAMD_CRYPTOBOX_MODE_25519;
 	gsize len;
 	int ret;
 
@@ -1759,23 +1694,9 @@ lua_cryptobox_verify_memory(lua_State *L)
 		data = luaL_checklstring(L, 3, &len);
 	}
 
-	if (lua_isstring(L, 4)) {
-		const char *str = lua_tostring(L, 4);
-
-		if (strcmp(str, "nist") == 0 || strcmp(str, "openssl") == 0) {
-			alg = RSPAMD_CRYPTOBOX_MODE_NIST;
-		}
-		else if (strcmp(str, "curve25519") == 0 || strcmp(str, "default") == 0) {
-			alg = RSPAMD_CRYPTOBOX_MODE_25519;
-		}
-		else {
-			return luaL_error(L, "invalid algorithm: %s", str);
-		}
-	}
-
 	if (pk != NULL && signature != NULL && data != NULL) {
 		ret = rspamd_cryptobox_verify(signature->str, signature->len, data, len,
-									  rspamd_pubkey_get_pk(pk, NULL), alg);
+									  rspamd_pubkey_get_pk(pk, NULL));
 
 		if (ret) {
 			lua_pushboolean(L, 1);
@@ -1792,7 +1713,7 @@ lua_cryptobox_verify_memory(lua_State *L)
 }
 
 /***
- * @function rspamd_cryptobox.verify_file(pk, sig, file, [alg = 'curve25519'])
+ * @function rspamd_cryptobox.verify_file(pk, sig, file)
  * Check file using specified cryptobox key and signature
  * @param {pubkey} pk public key to verify
  * @param {sig} signature to check
@@ -1807,7 +1728,6 @@ lua_cryptobox_verify_file(lua_State *L)
 	struct rspamd_cryptobox_pubkey *pk;
 	rspamd_fstring_t *signature;
 	unsigned char *map = NULL;
-	enum rspamd_cryptobox_mode alg = RSPAMD_CRYPTOBOX_MODE_25519;
 	gsize len;
 	int ret;
 
@@ -1815,26 +1735,12 @@ lua_cryptobox_verify_file(lua_State *L)
 	signature = lua_check_cryptobox_sign(L, 2);
 	fname = luaL_checkstring(L, 3);
 
-	if (lua_isstring(L, 4)) {
-		const char *str = lua_tostring(L, 4);
-
-		if (strcmp(str, "nist") == 0 || strcmp(str, "openssl") == 0) {
-			alg = RSPAMD_CRYPTOBOX_MODE_NIST;
-		}
-		else if (strcmp(str, "curve25519") == 0 || strcmp(str, "default") == 0) {
-			alg = RSPAMD_CRYPTOBOX_MODE_25519;
-		}
-		else {
-			return luaL_error(L, "invalid algorithm: %s", str);
-		}
-	}
-
 	map = rspamd_file_xmap(fname, PROT_READ, &len, TRUE);
 
 	if (map != NULL && pk != NULL && signature != NULL) {
 		ret = rspamd_cryptobox_verify(signature->str, signature->len,
 									  map, len,
-									  rspamd_pubkey_get_pk(pk, NULL), alg);
+									  rspamd_pubkey_get_pk(pk, NULL));
 
 		if (ret) {
 			lua_pushboolean(L, 1);
@@ -1896,12 +1802,11 @@ lua_cryptobox_sign_memory(lua_State *L)
 		return luaL_error(L, "invalid arguments");
 	}
 
-	sig = rspamd_fstring_sized_new(rspamd_cryptobox_signature_bytes(
-		rspamd_keypair_alg(kp)));
+	sig = rspamd_fstring_sized_new(crypto_sign_bytes());
 
 	unsigned long long siglen = sig->len;
 	rspamd_cryptobox_sign(sig->str, &siglen, data,
-						  len, rspamd_keypair_component(kp, RSPAMD_KEYPAIR_COMPONENT_SK, NULL), rspamd_keypair_alg(kp));
+						  len, rspamd_keypair_component(kp, RSPAMD_KEYPAIR_COMPONENT_SK, NULL));
 
 	sig->len = siglen;
 	psig = lua_newuserdata(L, sizeof(void *));
@@ -1942,13 +1847,12 @@ lua_cryptobox_sign_file(lua_State *L)
 		lua_pushnil(L);
 	}
 	else {
-		sig = rspamd_fstring_sized_new(rspamd_cryptobox_signature_bytes(
-			rspamd_keypair_alg(kp)));
+		sig = rspamd_fstring_sized_new(crypto_sign_bytes());
 
 		unsigned long long siglen = sig->len;
 
 		rspamd_cryptobox_sign(sig->str, &siglen, data,
-							  len, rspamd_keypair_component(kp, RSPAMD_KEYPAIR_COMPONENT_SK, NULL), rspamd_keypair_alg(kp));
+							  len, rspamd_keypair_component(kp, RSPAMD_KEYPAIR_COMPONENT_SK, NULL));
 
 		sig->len = siglen;
 		psig = lua_newuserdata(L, sizeof(void *));
@@ -1961,7 +1865,7 @@ lua_cryptobox_sign_file(lua_State *L)
 }
 
 /***
- * @function rspamd_cryptobox.encrypt_memory(kp, data[, nist=false])
+ * @function rspamd_cryptobox.encrypt_memory(kp, data)
  * Encrypt data using specified keypair/pubkey
  * @param {keypair|string} kp keypair or pubkey in base32 to use
  * @param {string|text} data
@@ -1993,8 +1897,7 @@ lua_cryptobox_encrypt_memory(lua_State *L)
 		gsize blen;
 
 		b32 = lua_tolstring(L, 1, &blen);
-		pk = rspamd_pubkey_from_base32(b32, blen, RSPAMD_KEYPAIR_KEX,
-									   lua_toboolean(L, 3) ? RSPAMD_CRYPTOBOX_MODE_NIST : RSPAMD_CRYPTOBOX_MODE_25519);
+		pk = rspamd_pubkey_from_base32(b32, blen, RSPAMD_KEYPAIR_KEX);
 		owned_pk = true;
 	}
 
@@ -2063,7 +1966,7 @@ err:
 }
 
 /***
- * @function rspamd_cryptobox.encrypt_file(kp|pk_string, filename[, nist=false])
+ * @function rspamd_cryptobox.encrypt_file(kp|pk_string, filename)
  * Encrypt data using specified keypair/pubkey
  * @param {keypair|string} kp keypair or pubkey in base32 to use
  * @param {string} filename
@@ -2096,8 +1999,7 @@ lua_cryptobox_encrypt_file(lua_State *L)
 		gsize blen;
 
 		b32 = lua_tolstring(L, 1, &blen);
-		pk = rspamd_pubkey_from_base32(b32, blen, RSPAMD_KEYPAIR_KEX,
-									   lua_toboolean(L, 3) ? RSPAMD_CRYPTOBOX_MODE_NIST : RSPAMD_CRYPTOBOX_MODE_25519);
+		pk = rspamd_pubkey_from_base32(b32, blen, RSPAMD_KEYPAIR_KEX);
 		own_pk = true;
 	}
 
@@ -2658,11 +2560,11 @@ lua_cryptobox_gen_dkim_keypair(lua_State *L)
 		char *b64_data;
 		gsize b64_len;
 
-		rspamd_cryptobox_keypair_sig(pk, sk, RSPAMD_CRYPTOBOX_MODE_25519);
+		rspamd_cryptobox_keypair_sig(pk, sk);
 
 		/* Process private key */
 		b64_data = rspamd_encode_base64(sk,
-										rspamd_cryptobox_sk_sig_bytes(RSPAMD_CRYPTOBOX_MODE_25519),
+										crypto_sign_secretkeybytes(),
 										-1, &b64_len);
 
 		priv_out = lua_newuserdata(L, sizeof(*priv_out));
@@ -2673,7 +2575,7 @@ lua_cryptobox_gen_dkim_keypair(lua_State *L)
 
 		/* Process public key */
 		b64_data = rspamd_encode_base64(pk,
-										rspamd_cryptobox_pk_sig_bytes(RSPAMD_CRYPTOBOX_MODE_25519),
+										crypto_sign_publickeybytes(),
 										-1, &b64_len);
 
 		pub_out = lua_newuserdata(L, sizeof(*pub_out));
@@ -2691,7 +2593,7 @@ lua_cryptobox_gen_dkim_keypair(lua_State *L)
 		char *b64_data;
 		gsize b64_len;
 
-		rspamd_cryptobox_keypair_sig(pk, sk, RSPAMD_CRYPTOBOX_MODE_25519);
+		rspamd_cryptobox_keypair_sig(pk, sk);
 
 		/* Process private key */
 		b64_data = rspamd_encode_base64(sk,
@@ -2706,7 +2608,7 @@ lua_cryptobox_gen_dkim_keypair(lua_State *L)
 
 		/* Process public key */
 		b64_data = rspamd_encode_base64(pk,
-										rspamd_cryptobox_pk_sig_bytes(RSPAMD_CRYPTOBOX_MODE_25519),
+										crypto_sign_publickeybytes(),
 										-1, &b64_len);
 
 		pub_out = lua_newuserdata(L, sizeof(*pub_out));
diff --git a/src/lua/lua_http.c b/src/lua/lua_http.c
index 2032f7dc1..8ba612c1b 100644
--- a/src/lua/lua_http.c
+++ b/src/lua/lua_http.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2023 Vsevolod Stakhov
+ * Copyright 2024 Vsevolod Stakhov
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -907,8 +907,7 @@ lua_http_request(lua_State *L)
 			gsize inlen;
 
 			in = lua_tolstring(L, -1, &inlen);
-			peer_key = rspamd_pubkey_from_base32(in, inlen,
-												 RSPAMD_KEYPAIR_KEX, RSPAMD_CRYPTOBOX_MODE_25519);
+			peer_key = rspamd_pubkey_from_base32(in, inlen, RSPAMD_KEYPAIR_KEX);
 		}
 
 		lua_pop(L, 1);
diff --git a/src/lua/lua_map.c b/src/lua/lua_map.c
index cce78ff2c..1cc2ce1bd 100644
--- a/src/lua/lua_map.c
+++ b/src/lua/lua_map.c
@@ -1293,8 +1293,7 @@ lua_map_set_sign_key(lua_State *L)
 	pk_str = lua_tolstring(L, 2, &len);
 
 	if (map && pk_str) {
-		pk = rspamd_pubkey_from_base32(pk_str, len, RSPAMD_KEYPAIR_SIGN,
-									   RSPAMD_CRYPTOBOX_MODE_25519);
+		pk = rspamd_pubkey_from_base32(pk_str, len, RSPAMD_KEYPAIR_SIGN);
 
 		if (!pk) {
 			return luaL_error(L, "invalid pubkey string");
diff --git a/src/plugins/fuzzy_check.c b/src/plugins/fuzzy_check.c
index b92177f1b..91b77c702 100644
--- a/src/plugins/fuzzy_check.c
+++ b/src/plugins/fuzzy_check.c
@@ -543,15 +543,13 @@ fuzzy_parse_rule(struct rspamd_config *cfg, const ucl_object_t *obj,
 		k = ucl_object_tostring(value);
 
 		if (k == NULL || (rule->peer_key =
-							  rspamd_pubkey_from_base32(k, 0, RSPAMD_KEYPAIR_KEX,
-														RSPAMD_CRYPTOBOX_MODE_25519)) == NULL) {
+							  rspamd_pubkey_from_base32(k, 0, RSPAMD_KEYPAIR_KEX)) == NULL) {
 			msg_err_config("bad encryption key value: %s",
 						   k);
 			return -1;
 		}
 
-		rule->local_key = rspamd_keypair_new(RSPAMD_KEYPAIR_KEX,
-											 RSPAMD_CRYPTOBOX_MODE_25519);
+		rule->local_key = rspamd_keypair_new(RSPAMD_KEYPAIR_KEX);
 	}
 
 	if ((value = ucl_object_lookup(obj, "learn_condition")) != NULL) {
@@ -1334,8 +1332,7 @@ fuzzy_encrypt_cmd(struct fuzzy_rule *rule,
 								 rule->local_key, rule->peer_key);
 	rspamd_cryptobox_encrypt_nm_inplace(data, datalen,
 										hdr->nonce, rspamd_pubkey_get_nm(rule->peer_key, rule->local_key),
-										hdr->mac,
-										rspamd_pubkey_alg(rule->peer_key));
+										hdr->mac);
 }
 
 static struct fuzzy_cmd_io *
@@ -2209,8 +2206,7 @@ fuzzy_process_reply(unsigned char **pos, int *r, GPtrArray *req,
 												 sizeof(encrep.rep),
 												 encrep.hdr.nonce,
 												 rspamd_pubkey_get_nm(rule->peer_key, rule->local_key),
-												 encrep.hdr.mac,
-												 rspamd_pubkey_alg(rule->peer_key))) {
+												 encrep.hdr.mac)) {
 			msg_info("cannot decrypt reply");
 			return NULL;
 		}
diff --git a/src/rspamadm/signtool.c b/src/rspamadm/signtool.c
index 612a67c83..ddc3d45df 100644
--- a/src/rspamadm/signtool.c
+++ b/src/rspamadm/signtool.c
@@ -1,11 +1,11 @@
-/*-
- * Copyright 2016 Vsevolod Stakhov
+/*
+ * Copyright 2024 Vsevolod Stakhov
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
- *   http://www.apache.org/licenses/LICENSE-2.0
+ *    http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
@@ -27,7 +27,6 @@
 #include <sys/wait.h>
 #endif
 
-static gboolean openssl = FALSE;
 static gboolean verify = FALSE;
 static gboolean quiet = FALSE;
 static char *suffix = NULL;
@@ -37,7 +36,6 @@ static char *pubout = NULL;
 static char *keypair_file = NULL;
 static char *editor = NULL;
 static gboolean edit = FALSE;
-enum rspamd_cryptobox_mode mode = RSPAMD_CRYPTOBOX_MODE_25519;
 
 static void rspamadm_signtool(int argc, char **argv,
 							  const struct rspamadm_command *cmd);
@@ -53,8 +51,6 @@ struct rspamadm_command signtool_command = {
 };
 
 static GOptionEntry entries[] = {
-	{"openssl", 'o', 0, G_OPTION_ARG_NONE, &openssl,
-	 "Generate openssl nistp256 keypair not curve25519 one", NULL},
 	{"verify", 'v', 0, G_OPTION_ARG_NONE, &verify,
 	 "Verify signatures and not sign", NULL},
 	{"suffix", 'S', 0, G_OPTION_ARG_STRING, &suffix,
@@ -327,11 +323,8 @@ rspamadm_sign_file(const char *fname, struct rspamd_cryptobox_keypair *kp)
 		exit(EXIT_FAILURE);
 	}
 
-	g_assert(rspamd_cryptobox_MAX_SIGBYTES >=
-			 rspamd_cryptobox_signature_bytes(mode));
-
 	sk = rspamd_keypair_component(kp, RSPAMD_KEYPAIR_COMPONENT_SK, NULL);
-	rspamd_cryptobox_sign(sig, NULL, map, st.st_size, sk, mode);
+	rspamd_cryptobox_sign(sig, NULL, map, st.st_size, sk);
 
 	if (edit) {
 		/* We also need to rename .new file */
@@ -348,7 +341,7 @@ rspamadm_sign_file(const char *fname, struct rspamd_cryptobox_keypair *kp)
 
 	rspamd_snprintf(sigpath, sizeof(sigpath), "%s%s", fname, suffix);
 
-	if (write(fd_sig, sig, rspamd_cryptobox_signature_bytes(mode)) == -1) {
+	if (write(fd_sig, sig, crypto_sign_bytes()) == -1) {
 		rspamd_fprintf(stderr, "cannot write signature to %s: %s\n", sigpath,
 					   strerror(errno));
 		exit(EXIT_FAILURE);
@@ -400,9 +393,6 @@ rspamadm_verify_file(const char *fname, const unsigned char *pk)
 	struct stat st, st_sig;
 	bool ret;
 
-	g_assert(rspamd_cryptobox_MAX_SIGBYTES >=
-			 rspamd_cryptobox_signature_bytes(mode));
-
 	if (suffix == NULL) {
 		suffix = ".sig";
 	}
@@ -439,7 +429,7 @@ rspamadm_verify_file(const char *fname, const unsigned char *pk)
 
 	g_assert(fstat(fd_sig, &st_sig) != -1);
 
-	if (st_sig.st_size != rspamd_cryptobox_signature_bytes(mode)) {
+	if (st_sig.st_size != crypto_sign_bytes()) {
 		close(fd_sig);
 		rspamd_fprintf(stderr, "invalid signature size %s: %ud\n", fname,
 					   (unsigned int) st_sig.st_size);
@@ -458,7 +448,7 @@ rspamadm_verify_file(const char *fname, const unsigned char *pk)
 	}
 
 	ret = rspamd_cryptobox_verify(map_sig, st_sig.st_size,
-								  map, st.st_size, pk, mode);
+								  map, st.st_size, pk);
 	munmap(map, st.st_size);
 	munmap(map_sig, st_sig.st_size);
 
@@ -503,10 +493,6 @@ rspamadm_signtool(int argc, char **argv, const struct rspamadm_command *cmd)
 
 	g_option_context_free(context);
 
-	if (openssl) {
-		mode = RSPAMD_CRYPTOBOX_MODE_NIST;
-	}
-
 	if (verify && (!pubkey && !pubkey_file)) {
 		rspamd_fprintf(stderr, "no pubkey for verification\n");
 		exit(EXIT_FAILURE);
@@ -549,14 +535,13 @@ rspamadm_signtool(int argc, char **argv, const struct rspamadm_command *cmd)
 				flen--;
 			}
 
-			pk = rspamd_pubkey_from_base32(map, flen,
-										   RSPAMD_KEYPAIR_SIGN, mode);
+			pk = rspamd_pubkey_from_base32(map, flen, RSPAMD_KEYPAIR_SIGN);
 
 			if (pk == NULL) {
 				rspamd_fprintf(stderr, "bad size %s: %ud, %ud expected\n",
 							   pubkey_file,
 							   (unsigned int) flen,
-							   rspamd_cryptobox_pk_sig_bytes(mode));
+							   crypto_sign_publickeybytes());
 				exit(EXIT_FAILURE);
 			}
 
@@ -564,13 +549,13 @@ rspamadm_signtool(int argc, char **argv, const struct rspamadm_command *cmd)
 		}
 		else {
 			pk = rspamd_pubkey_from_base32(pubkey, strlen(pubkey),
-										   RSPAMD_KEYPAIR_SIGN, mode);
+										   RSPAMD_KEYPAIR_SIGN);
 
 			if (pk == NULL) {
 				rspamd_fprintf(stderr, "bad size %s: %ud, %ud expected\n",
 							   pubkey_file,
 							   (unsigned int) strlen(pubkey),
-							   rspamd_cryptobox_pk_sig_bytes(mode));
+							   crypto_sign_publickeybytes());
 				exit(EXIT_FAILURE);
 			}
 		}
diff --git a/src/rspamd_proxy.c b/src/rspamd_proxy.c
index 6c8869e22..dbdd2e5a7 100644
--- a/src/rspamd_proxy.c
+++ b/src/rspamd_proxy.c
@@ -395,7 +395,7 @@ rspamd_proxy_parse_upstream(rspamd_mempool_t *pool,
 	elt = ucl_object_lookup(obj, "key");
 	if (elt != NULL) {
 		up->key = rspamd_pubkey_from_base32(ucl_object_tostring(elt), 0,
-											RSPAMD_KEYPAIR_KEX, RSPAMD_CRYPTOBOX_MODE_25519);
+											RSPAMD_KEYPAIR_KEX);
 
 		if (up->key == NULL) {
 			g_set_error(err, rspamd_proxy_quark(), 100,
@@ -571,7 +571,7 @@ rspamd_proxy_parse_mirror(rspamd_mempool_t *pool,
 	elt = ucl_object_lookup(obj, "key");
 	if (elt != NULL) {
 		up->key = rspamd_pubkey_from_base32(ucl_object_tostring(elt), 0,
-											RSPAMD_KEYPAIR_KEX, RSPAMD_CRYPTOBOX_MODE_25519);
+											RSPAMD_KEYPAIR_KEX);
 
 		if (up->key == NULL) {
 			g_set_error(err, rspamd_proxy_quark(), 100,
diff --git a/test/rspamd_cryptobox_test.c b/test/rspamd_cryptobox_test.c
index b32b2822b..03b833404 100644
--- a/test/rspamd_cryptobox_test.c
+++ b/test/rspamd_cryptobox_test.c
@@ -1,11 +1,11 @@
-/*-
- * Copyright 2016 Vsevolod Stakhov
+/*
+ * Copyright 2024 Vsevolod Stakhov
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
- *   http://www.apache.org/licenses/LICENSE-2.0
+ *    http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
@@ -24,7 +24,6 @@
 static const int mapping_size = 64 * 8192 + 1;
 static const int max_seg = 32;
 static const int random_fuzz_cnt = 10000;
-enum rspamd_cryptobox_mode mode = RSPAMD_CRYPTOBOX_MODE_25519;
 
 static void *
 create_mapping(int mapping_len, unsigned char **beg, unsigned char **end)
@@ -52,7 +51,7 @@ check_result(const rspamd_nm_t key, const rspamd_nonce_t nonce,
 	uint64_t *t = (uint64_t *) begin;
 
 	g_assert(rspamd_cryptobox_decrypt_nm_inplace(begin, end - begin, nonce, key,
-												 mac, mode));
+												 mac));
 
 	while (t < (uint64_t *) end) {
 		g_assert(*t == 0);
@@ -174,33 +173,17 @@ void rspamd_cryptobox_test_func(void)
 
 	/* Test baseline */
 	t1 = rspamd_get_ticks(TRUE);
-	rspamd_cryptobox_encrypt_nm_inplace(begin, end - begin, nonce, key, mac,
-										mode);
+	rspamd_cryptobox_encrypt_nm_inplace(begin, end - begin, nonce, key, mac);
 	t2 = rspamd_get_ticks(TRUE);
 	check_result(key, nonce, mac, begin, end);
 
 	msg_info("baseline encryption: %.0f", t2 - t1);
 
-	mode = RSPAMD_CRYPTOBOX_MODE_NIST;
-	t1 = rspamd_get_ticks(TRUE);
-	rspamd_cryptobox_encrypt_nm_inplace(begin,
-										end - begin,
-										nonce,
-										key,
-										mac,
-										mode);
-	t2 = rspamd_get_ticks(TRUE);
-	check_result(key, nonce, mac, begin, end);
-
-	msg_info("openssl baseline encryption: %.0f", t2 - t1);
-	mode = RSPAMD_CRYPTOBOX_MODE_25519;
-
-start:
 	/* A single chunk as vector */
 	seg[0].data = begin;
 	seg[0].len = end - begin;
 	t1 = rspamd_get_ticks(TRUE);
-	rspamd_cryptobox_encryptv_nm_inplace(seg, 1, nonce, key, mac, mode);
+	rspamd_cryptobox_encryptv_nm_inplace(seg, 1, nonce, key, mac);
 	t2 = rspamd_get_ticks(TRUE);
 
 	check_result(key, nonce, mac, begin, end);
@@ -213,7 +196,7 @@ start:
 	seg[1].data = begin + seg[0].len;
 	seg[1].len = (end - begin) - seg[0].len;
 	t1 = rspamd_get_ticks(TRUE);
-	rspamd_cryptobox_encryptv_nm_inplace(seg, 2, nonce, key, mac, mode);
+	rspamd_cryptobox_encryptv_nm_inplace(seg, 2, nonce, key, mac);
 	t2 = rspamd_get_ticks(TRUE);
 
 	check_result(key, nonce, mac, begin, end);
@@ -225,7 +208,7 @@ start:
 	seg[1].data = begin + seg[0].len;
 	seg[1].len = (end - begin) - seg[0].len;
 	t1 = rspamd_get_ticks(TRUE);
-	rspamd_cryptobox_encryptv_nm_inplace(seg, 2, nonce, key, mac, mode);
+	rspamd_cryptobox_encryptv_nm_inplace(seg, 2, nonce, key, mac);
 	t2 = rspamd_get_ticks(TRUE);
 
 	check_result(key, nonce, mac, begin, end);
@@ -237,7 +220,7 @@ start:
 	seg[1].data = begin + seg[0].len;
 	seg[1].len = (end - begin) - seg[0].len;
 	t1 = rspamd_get_ticks(TRUE);
-	rspamd_cryptobox_encryptv_nm_inplace(seg, 2, nonce, key, mac, mode);
+	rspamd_cryptobox_encryptv_nm_inplace(seg, 2, nonce, key, mac);
 	t2 = rspamd_get_ticks(TRUE);
 
 	check_result(key, nonce, mac, begin, end);
@@ -250,7 +233,7 @@ start:
 	seg[1].data = begin + seg[0].len;
 	seg[1].len = (end - begin) - seg[0].len;
 	t1 = rspamd_get_ticks(TRUE);
-	rspamd_cryptobox_encryptv_nm_inplace(seg, 2, nonce, key, mac, mode);
+	rspamd_cryptobox_encryptv_nm_inplace(seg, 2, nonce, key, mac);
 	t2 = rspamd_get_ticks(TRUE);
 
 	check_result(key, nonce, mac, begin, end);
@@ -265,7 +248,7 @@ start:
 	seg[2].data = begin + seg[0].len + seg[1].len;
 	seg[2].len = (end - begin) - seg[0].len - seg[1].len;
 	t1 = rspamd_get_ticks(TRUE);
-	rspamd_cryptobox_encryptv_nm_inplace(seg, 3, nonce, key, mac, mode);
+	rspamd_cryptobox_encryptv_nm_inplace(seg, 3, nonce, key, mac);
 	t2 = rspamd_get_ticks(TRUE);
 
 	check_result(key, nonce, mac, begin, end);
@@ -274,7 +257,7 @@ start:
 
 	cnt = create_random_split(seg, max_seg, begin, end);
 	t1 = rspamd_get_ticks(TRUE);
-	rspamd_cryptobox_encryptv_nm_inplace(seg, cnt, nonce, key, mac, mode);
+	rspamd_cryptobox_encryptv_nm_inplace(seg, cnt, nonce, key, mac);
 	t2 = rspamd_get_ticks(TRUE);
 
 	check_result(key, nonce, mac, begin, end);
@@ -283,7 +266,7 @@ start:
 
 	cnt = create_realistic_split(seg, max_seg, begin, end);
 	t1 = rspamd_get_ticks(TRUE);
-	rspamd_cryptobox_encryptv_nm_inplace(seg, cnt, nonce, key, mac, mode);
+	rspamd_cryptobox_encryptv_nm_inplace(seg, cnt, nonce, key, mac);
 	t2 = rspamd_get_ticks(TRUE);
 
 	check_result(key, nonce, mac, begin, end);
@@ -292,7 +275,7 @@ start:
 
 	cnt = create_constrained_split(seg, max_seg + 1, 32, begin, end);
 	t1 = rspamd_get_ticks(TRUE);
-	rspamd_cryptobox_encryptv_nm_inplace(seg, cnt, nonce, key, mac, mode);
+	rspamd_cryptobox_encryptv_nm_inplace(seg, cnt, nonce, key, mac);
 	t2 = rspamd_get_ticks(TRUE);
 
 	check_result(key, nonce, mac, begin, end);
@@ -303,7 +286,7 @@ start:
 		ms = ottery_rand_range(i % max_seg * 2) + 1;
 		cnt = create_random_split(seg, ms, begin, end);
 		t1 = rspamd_get_ticks(TRUE);
-		rspamd_cryptobox_encryptv_nm_inplace(seg, cnt, nonce, key, mac, mode);
+		rspamd_cryptobox_encryptv_nm_inplace(seg, cnt, nonce, key, mac);
 		t2 = rspamd_get_ticks(TRUE);
 
 		check_result(key, nonce, mac, begin, end);
@@ -316,7 +299,7 @@ start:
 		ms = ottery_rand_range(i % max_seg * 2) + 1;
 		cnt = create_realistic_split(seg, ms, begin, end);
 		t1 = rspamd_get_ticks(TRUE);
-		rspamd_cryptobox_encryptv_nm_inplace(seg, cnt, nonce, key, mac, mode);
+		rspamd_cryptobox_encryptv_nm_inplace(seg, cnt, nonce, key, mac);
 		t2 = rspamd_get_ticks(TRUE);
 
 		check_result(key, nonce, mac, begin, end);
@@ -329,7 +312,7 @@ start:
 		ms = ottery_rand_range(i % max_seg * 10) + 1;
 		cnt = create_constrained_split(seg, ms, i, begin, end);
 		t1 = rspamd_get_ticks(TRUE);
-		rspamd_cryptobox_encryptv_nm_inplace(seg, cnt, nonce, key, mac, mode);
+		rspamd_cryptobox_encryptv_nm_inplace(seg, cnt, nonce, key, mac);
 		t2 = rspamd_get_ticks(TRUE);
 
 		check_result(key, nonce, mac, begin, end);
@@ -338,10 +321,4 @@ start:
 			msg_info("constrained fuzz iterations: %d", i);
 		}
 	}
-
-	if (!checked_openssl) {
-		checked_openssl = TRUE;
-		mode = RSPAMD_CRYPTOBOX_MODE_NIST;
-		goto start;
-	}
 }
diff --git a/test/rspamd_cxx_unit_cryptobox.hxx b/test/rspamd_cxx_unit_cryptobox.hxx
index cfa95dc61..3f3cab697 100644
--- a/test/rspamd_cxx_unit_cryptobox.hxx
+++ b/test/rspamd_cxx_unit_cryptobox.hxx
@@ -26,20 +26,18 @@ TEST_SUITE("rspamd_cryptobox")
 
 	TEST_CASE("rspamd_cryptobox_keypair")
 	{
-		enum rspamd_cryptobox_mode mode = RSPAMD_CRYPTOBOX_MODE_NIST;
 		rspamd_sk_t sk;
 		rspamd_pk_t pk;
 
-		rspamd_cryptobox_keypair(pk, sk, mode);
+		rspamd_cryptobox_keypair(pk, sk);
 	}
 
 	TEST_CASE("rspamd_cryptobox_keypair_sig")
 	{
-		enum rspamd_cryptobox_mode mode = RSPAMD_CRYPTOBOX_MODE_NIST;
 		rspamd_sig_sk_t sk;
 		rspamd_sig_pk_t pk;
 
-		rspamd_cryptobox_keypair_sig(pk, sk, mode);
+		rspamd_cryptobox_keypair_sig(pk, sk);
 	}
 
 	TEST_CASE("rspamd_cryptobox_hash")
@@ -124,73 +122,33 @@ TEST_SUITE("rspamd_cryptobox")
 		rspamd_pk_t pk;
 		rspamd_sk_t sk;
 		rspamd_mac_t sig;
-		enum rspamd_cryptobox_mode mode = RSPAMD_CRYPTOBOX_MODE_25519;
 
 		ottery_rand_bytes(nonce, sizeof(nonce));
 
-		rspamd_cryptobox_keypair(pk, sk, mode);
+		rspamd_cryptobox_keypair(pk, sk);
 
 		memset(sig, 0, sizeof(sig));
 
-		rspamd_cryptobox_encrypt_inplace(data, len, nonce, pk, sk, sig, mode);
+		rspamd_cryptobox_encrypt_inplace(data, len, nonce, pk, sk, sig);
 
-		CHECK(rspamd_cryptobox_decrypt_inplace(data, len, nonce, pk, sk, sig, mode));
-	}
-
-	TEST_CASE("rspamd_cryptobox_encrypt_inplace_p256")
-	{
-		unsigned char data[256];
-		gsize len = sizeof(data);
-		rspamd_nonce_t nonce;
-		rspamd_pk_t pk;
-		rspamd_sk_t sk;
-		rspamd_mac_t sig;
-		enum rspamd_cryptobox_mode mode = RSPAMD_CRYPTOBOX_MODE_NIST;
-
-		ottery_rand_bytes(nonce, sizeof(nonce));
-
-		rspamd_cryptobox_keypair(pk, sk, mode);
-
-		memset(sig, 0, sizeof(sig));
-
-		rspamd_cryptobox_encrypt_inplace(data, len, nonce, pk, sk, sig, mode);
-
-		CHECK(rspamd_cryptobox_decrypt_inplace(data, len, nonce, pk, sk, sig, mode));
+		CHECK(rspamd_cryptobox_decrypt_inplace(data, len, nonce, pk, sk, sig));
 	}
 
 	TEST_CASE("rspamd_cryptobox_sign_25519")
 	{
-		enum rspamd_cryptobox_mode mode = RSPAMD_CRYPTOBOX_MODE_25519;
-		rspamd_sig_sk_t sk;
-		rspamd_sig_pk_t pk;
-		unsigned char sig[256];
-		unsigned long long siglen;
-		std::string m{"data to be signed"};
-
-		rspamd_cryptobox_keypair_sig(pk, sk, mode);
-
-		rspamd_cryptobox_sign(sig, &siglen,
-							  reinterpret_cast<const unsigned char *>(m.data()), m.size(), sk, mode);
-		bool check_result = rspamd_cryptobox_verify(sig, siglen,
-													reinterpret_cast<const unsigned char *>(m.data()), m.size(), pk, mode);
-		CHECK(check_result == true);
-	}
-
-	TEST_CASE("rspamd_cryptobox_sign_nist")
-	{
-		enum rspamd_cryptobox_mode mode = RSPAMD_CRYPTOBOX_MODE_NIST;
 		rspamd_sig_sk_t sk;
 		rspamd_sig_pk_t pk;
 		unsigned char sig[256];
 		unsigned long long siglen;
 		std::string m{"data to be signed"};
 
-		rspamd_cryptobox_keypair_sig(pk, sk, mode);
+		rspamd_cryptobox_keypair_sig(pk, sk);
 
 		rspamd_cryptobox_sign(sig, &siglen,
-							  reinterpret_cast<const unsigned char *>(m.data()), m.size(), sk, mode);
+							  reinterpret_cast<const unsigned char *>(m.data()), m.size(), sk);
 		bool check_result = rspamd_cryptobox_verify(sig, siglen,
-													reinterpret_cast<const unsigned char *>(m.data()), m.size(), pk, mode);
+													reinterpret_cast<const unsigned char *>(m.data()), m.size(),
+													pk);
 		CHECK(check_result == true);
 	}
 }