Subversion Repositories planix.SVN

/*

Adapted from chacha-merged.c version 20080118

D. J. Bernstein

Public domain.

modified for use in Plan 9 and Inferno (no algorithmic changes),

and including the changes to block number and nonce defined in RFC7539

*/

#include "os.h"

#include <libsec.h>

/* from chachablock.$O */

extern void _chachablock(u32int x[16], int rounds);

/* little-endian data order */

#define	GET4(p)		((p)[0]|((p)[1]<<8)|((p)[2]<<16)|((p)[3]<<24))

#define	PUT4(p,v)	(p)[0]=(v);(p)[1]=(v)>>8;(p)[2]=(v)>>16;(p)[3]=(v)>>24

#define ENCRYPT(s, x, y, d) {\

	u32int v; \

	v = GET4(s); \

	v ^= (x)+(y); \

	PUT4(d, v); \

}

static uchar sigma[16] = "expand 32-byte k";

static uchar tau[16] = "expand 16-byte k";

static void

load(u32int *d, uchar *s, int nw)

{

	int i;

	for(i = 0; i < nw; i++, s+=4)

		d[i] = GET4(s);

}

void

setupChachastate(Chachastate *s, uchar *key, ulong keylen, uchar *iv, ulong ivlen, int rounds)

{

	if(keylen != 256/8 && keylen != 128/8)

		sysfatal("invalid chacha key length");

	if(ivlen != 64/8 && ivlen != 96/8

	&& ivlen != 128/8 && ivlen != 192/8)	/* hchacha, xchacha */

		sysfatal("invalid chacha iv length");

	if(rounds == 0)

		rounds = 20;

	s->rounds = rounds;

	if(keylen == 256/8) { /* recommended */

		load(&s->input[0], sigma, 4);

		load(&s->input[4], key, 8);

	}else{

		load(&s->input[0], tau, 4);

		load(&s->input[4], key, 4);

		load(&s->input[8], key, 4);

	}

	s->xkey[0] = s->input[4];

	s->xkey[1] = s->input[5];

	s->xkey[2] = s->input[6];

	s->xkey[3] = s->input[7];

	s->xkey[4] = s->input[8];

	s->xkey[5] = s->input[9];

	s->xkey[6] = s->input[10];

	s->xkey[7] = s->input[11];

	s->ivwords = ivlen/4;

	s->input[12] = 0;

	s->input[13] = 0;

	if(iv == nil){

		s->input[14] = 0;

		s->input[15] = 0;

	}else

		chacha_setiv(s, iv);

}

static void

hchachablock(uchar h[32], Chachastate *s)

{

	u32int x[16];

	x[0] = s->input[0];

	x[1] = s->input[1];

	x[2] = s->input[2];

	x[3] = s->input[3];

	x[4] = s->input[4];

	x[5] = s->input[5];

	x[6] = s->input[6];

	x[7] = s->input[7];

	x[8] = s->input[8];

	x[9] = s->input[9];

	x[10] = s->input[10];

	x[11] = s->input[11];

	x[12] = s->input[12];

	x[13] = s->input[13];

	x[14] = s->input[14];

	x[15] = s->input[15];

	_chachablock(x, s->rounds);

	PUT4(h+0*4, x[0]);

	PUT4(h+1*4, x[1]);

	PUT4(h+2*4, x[2]);

	PUT4(h+3*4, x[3]);

	PUT4(h+4*4, x[12]);

	PUT4(h+5*4, x[13]);

	PUT4(h+6*4, x[14]);

	PUT4(h+7*4, x[15]);

}

void

chacha_setiv(Chachastate *s, uchar *iv)

{

	if(s->ivwords == 192/32){

		/* xchacha with 192-bit iv */

		u32int counter[2];

		uchar h[32];

		s->input[4] = s->xkey[0];

		s->input[5] = s->xkey[1];

		s->input[6] = s->xkey[2];

		s->input[7] = s->xkey[3];

		s->input[8] = s->xkey[4];

		s->input[9] = s->xkey[5];

		s->input[10] = s->xkey[6];

		s->input[11] = s->xkey[7];

		counter[0] = s->input[12];

		counter[1] = s->input[13];

		load(&s->input[12], iv, 4);

		hchachablock(h, s);

		load(&s->input[4], h, 8);

		memset(h, 0, 32);

		s->input[12] = counter[0];

		s->input[13] = counter[1];

		load(&s->input[14], iv+16, 2);

		return;

	}

	load(&s->input[16 - s->ivwords], iv, s->ivwords);

}

void

chacha_setblock(Chachastate *s, u64int blockno)

{

	s->input[12] = blockno;

	if(s->ivwords != 3)

		s->input[13] = blockno>>32;

}

static void

encryptblock(Chachastate *s, uchar *src, uchar *dst)

{

	u32int x[16];

	int i;

	x[0] = s->input[0];

	x[1] = s->input[1];

	x[2] = s->input[2];

	x[3] = s->input[3];

	x[4] = s->input[4];

	x[5] = s->input[5];

	x[6] = s->input[6];

	x[7] = s->input[7];

	x[8] = s->input[8];

	x[9] = s->input[9];

	x[10] = s->input[10];

	x[11] = s->input[11];

	x[12] = s->input[12];

	x[13] = s->input[13];

	x[14] = s->input[14];

	x[15] = s->input[15];

	_chachablock(x, s->rounds);

	for(i=0; i<nelem(x); i+=4){

		ENCRYPT(src, x[i], s->input[i], dst);

		ENCRYPT(src+4, x[i+1], s->input[i+1], dst+4);

		ENCRYPT(src+8, x[i+2], s->input[i+2], dst+8);

		ENCRYPT(src+12, x[i+3], s->input[i+3], dst+12);

		src += 16;

		dst += 16;

	}

	if(++s->input[12] == 0 && s->ivwords != 3)

		s->input[13]++;

}

void

chacha_encrypt2(uchar *src, uchar *dst, ulong bytes, Chachastate *s)

{

	uchar tmp[ChachaBsize];

	for(; bytes >= ChachaBsize; bytes -= ChachaBsize){

		encryptblock(s, src, dst);

		src += ChachaBsize;

		dst += ChachaBsize;

	}

	if(bytes > 0){

		memmove(tmp, src, bytes);

		encryptblock(s, tmp, tmp);

		memmove(dst, tmp, bytes);

	}

}

void

chacha_encrypt(uchar *buf, ulong bytes, Chachastate *s)

{

	chacha_encrypt2(buf, buf, bytes, s);

}

void

hchacha(uchar h[32], uchar *key, ulong keylen, uchar nonce[16], int rounds)

{

	Chachastate s[1];

	setupChachastate(s, key, keylen, nonce, 16, rounds);

	hchachablock(h, s);

	memset(s, 0, sizeof(s));

}