1*b077aed3SPierre Pronchery /*
2*b077aed3SPierre Pronchery * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
3*b077aed3SPierre Pronchery *
4*b077aed3SPierre Pronchery * Licensed under the Apache License 2.0 (the "License"). You may not use
5*b077aed3SPierre Pronchery * this file except in compliance with the License. You can obtain a copy
6*b077aed3SPierre Pronchery * in the file LICENSE in the source distribution or at
7*b077aed3SPierre Pronchery * https://www.openssl.org/source/license.html
8*b077aed3SPierre Pronchery */
9*b077aed3SPierre Pronchery
10*b077aed3SPierre Pronchery /* chacha20 cipher implementation */
11*b077aed3SPierre Pronchery
12*b077aed3SPierre Pronchery #include "cipher_chacha20.h"
13*b077aed3SPierre Pronchery
chacha20_initkey(PROV_CIPHER_CTX * bctx,const uint8_t * key,size_t keylen)14*b077aed3SPierre Pronchery static int chacha20_initkey(PROV_CIPHER_CTX *bctx, const uint8_t *key,
15*b077aed3SPierre Pronchery size_t keylen)
16*b077aed3SPierre Pronchery {
17*b077aed3SPierre Pronchery PROV_CHACHA20_CTX *ctx = (PROV_CHACHA20_CTX *)bctx;
18*b077aed3SPierre Pronchery unsigned int i;
19*b077aed3SPierre Pronchery
20*b077aed3SPierre Pronchery if (key != NULL) {
21*b077aed3SPierre Pronchery for (i = 0; i < CHACHA_KEY_SIZE; i += 4)
22*b077aed3SPierre Pronchery ctx->key.d[i / 4] = CHACHA_U8TOU32(key + i);
23*b077aed3SPierre Pronchery }
24*b077aed3SPierre Pronchery ctx->partial_len = 0;
25*b077aed3SPierre Pronchery return 1;
26*b077aed3SPierre Pronchery }
27*b077aed3SPierre Pronchery
chacha20_initiv(PROV_CIPHER_CTX * bctx)28*b077aed3SPierre Pronchery static int chacha20_initiv(PROV_CIPHER_CTX *bctx)
29*b077aed3SPierre Pronchery {
30*b077aed3SPierre Pronchery PROV_CHACHA20_CTX *ctx = (PROV_CHACHA20_CTX *)bctx;
31*b077aed3SPierre Pronchery unsigned int i;
32*b077aed3SPierre Pronchery
33*b077aed3SPierre Pronchery if (bctx->iv_set) {
34*b077aed3SPierre Pronchery for (i = 0; i < CHACHA_CTR_SIZE; i += 4)
35*b077aed3SPierre Pronchery ctx->counter[i / 4] = CHACHA_U8TOU32(bctx->oiv + i);
36*b077aed3SPierre Pronchery }
37*b077aed3SPierre Pronchery ctx->partial_len = 0;
38*b077aed3SPierre Pronchery return 1;
39*b077aed3SPierre Pronchery }
40*b077aed3SPierre Pronchery
chacha20_cipher(PROV_CIPHER_CTX * bctx,unsigned char * out,const unsigned char * in,size_t inl)41*b077aed3SPierre Pronchery static int chacha20_cipher(PROV_CIPHER_CTX *bctx, unsigned char *out,
42*b077aed3SPierre Pronchery const unsigned char *in, size_t inl)
43*b077aed3SPierre Pronchery {
44*b077aed3SPierre Pronchery PROV_CHACHA20_CTX *ctx = (PROV_CHACHA20_CTX *)bctx;
45*b077aed3SPierre Pronchery unsigned int n, rem, ctr32;
46*b077aed3SPierre Pronchery
47*b077aed3SPierre Pronchery n = ctx->partial_len;
48*b077aed3SPierre Pronchery if (n > 0) {
49*b077aed3SPierre Pronchery while (inl > 0 && n < CHACHA_BLK_SIZE) {
50*b077aed3SPierre Pronchery *out++ = *in++ ^ ctx->buf[n++];
51*b077aed3SPierre Pronchery inl--;
52*b077aed3SPierre Pronchery }
53*b077aed3SPierre Pronchery ctx->partial_len = n;
54*b077aed3SPierre Pronchery
55*b077aed3SPierre Pronchery if (inl == 0)
56*b077aed3SPierre Pronchery return 1;
57*b077aed3SPierre Pronchery
58*b077aed3SPierre Pronchery if (n == CHACHA_BLK_SIZE) {
59*b077aed3SPierre Pronchery ctx->partial_len = 0;
60*b077aed3SPierre Pronchery ctx->counter[0]++;
61*b077aed3SPierre Pronchery if (ctx->counter[0] == 0)
62*b077aed3SPierre Pronchery ctx->counter[1]++;
63*b077aed3SPierre Pronchery }
64*b077aed3SPierre Pronchery }
65*b077aed3SPierre Pronchery
66*b077aed3SPierre Pronchery rem = (unsigned int)(inl % CHACHA_BLK_SIZE);
67*b077aed3SPierre Pronchery inl -= rem;
68*b077aed3SPierre Pronchery ctr32 = ctx->counter[0];
69*b077aed3SPierre Pronchery while (inl >= CHACHA_BLK_SIZE) {
70*b077aed3SPierre Pronchery size_t blocks = inl / CHACHA_BLK_SIZE;
71*b077aed3SPierre Pronchery
72*b077aed3SPierre Pronchery /*
73*b077aed3SPierre Pronchery * 1<<28 is just a not-so-small yet not-so-large number...
74*b077aed3SPierre Pronchery * Below condition is practically never met, but it has to
75*b077aed3SPierre Pronchery * be checked for code correctness.
76*b077aed3SPierre Pronchery */
77*b077aed3SPierre Pronchery if (sizeof(size_t) > sizeof(unsigned int) && blocks > (1U << 28))
78*b077aed3SPierre Pronchery blocks = (1U << 28);
79*b077aed3SPierre Pronchery
80*b077aed3SPierre Pronchery /*
81*b077aed3SPierre Pronchery * As ChaCha20_ctr32 operates on 32-bit counter, caller
82*b077aed3SPierre Pronchery * has to handle overflow. 'if' below detects the
83*b077aed3SPierre Pronchery * overflow, which is then handled by limiting the
84*b077aed3SPierre Pronchery * amount of blocks to the exact overflow point...
85*b077aed3SPierre Pronchery */
86*b077aed3SPierre Pronchery ctr32 += (unsigned int)blocks;
87*b077aed3SPierre Pronchery if (ctr32 < blocks) {
88*b077aed3SPierre Pronchery blocks -= ctr32;
89*b077aed3SPierre Pronchery ctr32 = 0;
90*b077aed3SPierre Pronchery }
91*b077aed3SPierre Pronchery blocks *= CHACHA_BLK_SIZE;
92*b077aed3SPierre Pronchery ChaCha20_ctr32(out, in, blocks, ctx->key.d, ctx->counter);
93*b077aed3SPierre Pronchery inl -= blocks;
94*b077aed3SPierre Pronchery in += blocks;
95*b077aed3SPierre Pronchery out += blocks;
96*b077aed3SPierre Pronchery
97*b077aed3SPierre Pronchery ctx->counter[0] = ctr32;
98*b077aed3SPierre Pronchery if (ctr32 == 0) ctx->counter[1]++;
99*b077aed3SPierre Pronchery }
100*b077aed3SPierre Pronchery
101*b077aed3SPierre Pronchery if (rem > 0) {
102*b077aed3SPierre Pronchery memset(ctx->buf, 0, sizeof(ctx->buf));
103*b077aed3SPierre Pronchery ChaCha20_ctr32(ctx->buf, ctx->buf, CHACHA_BLK_SIZE,
104*b077aed3SPierre Pronchery ctx->key.d, ctx->counter);
105*b077aed3SPierre Pronchery for (n = 0; n < rem; n++)
106*b077aed3SPierre Pronchery out[n] = in[n] ^ ctx->buf[n];
107*b077aed3SPierre Pronchery ctx->partial_len = rem;
108*b077aed3SPierre Pronchery }
109*b077aed3SPierre Pronchery
110*b077aed3SPierre Pronchery return 1;
111*b077aed3SPierre Pronchery }
112*b077aed3SPierre Pronchery
113*b077aed3SPierre Pronchery static const PROV_CIPHER_HW_CHACHA20 chacha20_hw = {
114*b077aed3SPierre Pronchery { chacha20_initkey, chacha20_cipher },
115*b077aed3SPierre Pronchery chacha20_initiv
116*b077aed3SPierre Pronchery };
117*b077aed3SPierre Pronchery
ossl_prov_cipher_hw_chacha20(size_t keybits)118*b077aed3SPierre Pronchery const PROV_CIPHER_HW *ossl_prov_cipher_hw_chacha20(size_t keybits)
119*b077aed3SPierre Pronchery {
120*b077aed3SPierre Pronchery return (PROV_CIPHER_HW *)&chacha20_hw;
121*b077aed3SPierre Pronchery }
122*b077aed3SPierre Pronchery
123