1 /*
2 Adapted from chacha-merged.c version 20080118
3 D. J. Bernstein
4 Public domain.
5
6 modified for use in Plan 9 and Inferno (no algorithmic changes),
7 and including the changes to block number and nonce defined in RFC7539
8 */
9
10 #include <u.h>
11 #include <libc.h>
12 #include <libsec.h>
13
14 enum{
15 Blockwords= ChachaBsize/sizeof(u32int)
16 };
17
18 /* little-endian data order */
19 #define GET4(p) ((((((p)[3]<<8) | (p)[2])<<8) | (p)[1])<<8 | (p)[0])
20 #define PUT4(p, v) (((p)[0]=v), (v>>=8), ((p)[1]=v), (v>>=8), ((p)[2]=v), (v>>=8), ((p)[3]=v))
21
22 #define ROTATE(v,c) ((u32int)((v) << (c)) | ((v) >> (32 - (c))))
23
24 #define QUARTERROUND(ia,ib,ic,id) { \
25 u32int a, b, c, d, t;\
26 a = x[ia]; b = x[ib]; c = x[ic]; d = x[id]; \
27 a += b; t = d^a; d = ROTATE(t,16); \
28 c += d; t = b^c; b = ROTATE(t,12); \
29 a += b; t = d^a; d = ROTATE(t, 8); \
30 c += d; t = b^c; b = ROTATE(t, 7); \
31 x[ia] = a; x[ib] = b; x[ic] = c; x[id] = d; \
32 }
33
34 #define ENCRYPT(s, x, y, d) {\
35 u32int v; \
36 uchar *sp, *dp; \
37 sp = (s); \
38 v = GET4(sp); \
39 v ^= (x)+(y); \
40 dp = (d); \
41 PUT4(dp, v); \
42 }
43
44 static uchar sigma[16] = "expand 32-byte k";
45 static uchar tau[16] = "expand 16-byte k";
46
47 static void
load(u32int * d,uchar * s,int nw)48 load(u32int *d, uchar *s, int nw)
49 {
50 int i;
51
52 for(i = 0; i < nw; i++, s+=4)
53 d[i] = GET4(s);
54 }
55
56 void
setupChachastate(Chachastate * s,uchar * key,usize keylen,uchar * iv,int rounds)57 setupChachastate(Chachastate *s, uchar *key, usize keylen, uchar *iv, int rounds)
58 {
59 if(keylen != 256/8 && keylen != 128/8)
60 sysfatal("invalid chacha key length");
61 if(rounds == 0)
62 rounds = 20;
63 s->rounds = rounds;
64 if(keylen == 256/8) { /* recommended */
65 load(&s->input[0], sigma, 4);
66 load(&s->input[4], key, 8);
67 }else{
68 load(&s->input[0], tau, 4);
69 load(&s->input[4], key, 4);
70 load(&s->input[8], key, 4);
71 }
72 s->input[12] = 0;
73 if(iv == nil){
74 s->input[13] = 0;
75 s->input[14] = 0;
76 s->input[15] = 0;
77 }else
78 load(&s->input[13], iv, 3);
79 }
80
81 void
chacha_setblock(Chachastate * s,u32int blockno)82 chacha_setblock(Chachastate *s, u32int blockno)
83 {
84 s->input[12] = blockno;
85 }
86
87 static void
encryptblock(Chachastate * s,uchar * src,uchar * dst)88 encryptblock(Chachastate *s, uchar *src, uchar *dst)
89 {
90 u32int x[Blockwords];
91 int i, rounds;
92
93 rounds = s->rounds;
94 x[0] = s->input[0];
95 x[1] = s->input[1];
96 x[2] = s->input[2];
97 x[3] = s->input[3];
98 x[4] = s->input[4];
99 x[5] = s->input[5];
100 x[6] = s->input[6];
101 x[7] = s->input[7];
102 x[8] = s->input[8];
103 x[9] = s->input[9];
104 x[10] = s->input[10];
105 x[11] = s->input[11];
106 x[12] = s->input[12];
107 x[13] = s->input[13];
108 x[14] = s->input[14];
109 x[15] = s->input[15];
110
111 for(i = rounds; i > 0; i -= 2) {
112 QUARTERROUND(0, 4, 8,12)
113 QUARTERROUND(1, 5, 9,13)
114 QUARTERROUND(2, 6,10,14)
115 QUARTERROUND(3, 7,11,15)
116
117 QUARTERROUND(0, 5,10,15)
118 QUARTERROUND(1, 6,11,12)
119 QUARTERROUND(2, 7, 8,13)
120 QUARTERROUND(3, 4, 9,14)
121 }
122
123 #ifdef FULL_UNROLL
124 ENCRYPT(src+0*4, x[0], s->input[0], dst+0*4);
125 ENCRYPT(src+1*4, x[1], s->input[1], dst+1*4);
126 ENCRYPT(src+2*4, x[2], s->input[2], dst+2*4);
127 ENCRYPT(src+3*4, x[3], s->input[3], dst+3*4);
128 ENCRYPT(src+4*4, x[4], s->input[4], dst+4*4);
129 ENCRYPT(src+5*4, x[5], s->input[5], dst+5*4);
130 ENCRYPT(src+6*4, x[6], s->input[6], dst+6*4);
131 ENCRYPT(src+7*4, x[7], s->input[7], dst+7*4);
132 ENCRYPT(src+8*4, x[8], s->input[8], dst+8*4);
133 ENCRYPT(src+9*4, x[9], s->input[9], dst+9*4);
134 ENCRYPT(src+10*4, x[10], s->input[10], dst+10*4);
135 ENCRYPT(src+11*4, x[11], s->input[11], dst+11*4);
136 ENCRYPT(src+12*4, x[12], s->input[12], dst+12*4);
137 ENCRYPT(src+13*4, x[13], s->input[13], dst+13*4);
138 ENCRYPT(src+14*4, x[14], s->input[14], dst+14*4);
139 ENCRYPT(src+15*4, x[15], s->input[15], dst+15*4);
140 #else
141 for(i=0; i<nelem(x); i+=4){
142 ENCRYPT(src, x[i], s->input[i], dst);
143 ENCRYPT(src+4, x[i+1], s->input[i+1], dst+4);
144 ENCRYPT(src+8, x[i+2], s->input[i+2], dst+8);
145 ENCRYPT(src+12, x[i+3], s->input[i+3], dst+12);
146 src += 16;
147 dst += 16;
148 }
149 #endif
150
151 s->input[12]++;
152 }
153
154 void
chacha_encrypt2(uchar * src,uchar * dst,usize bytes,Chachastate * s)155 chacha_encrypt2(uchar *src, uchar *dst, usize bytes, Chachastate *s)
156 {
157 uchar tmp[ChachaBsize];
158
159 for(; bytes >= ChachaBsize; bytes -= ChachaBsize){
160 encryptblock(s, src, dst);
161 src += ChachaBsize;
162 dst += ChachaBsize;
163 }
164 if(bytes > 0){
165 memmove(tmp, src, bytes);
166 encryptblock(s, tmp, tmp);
167 memmove(dst, tmp, bytes);
168 }
169 }
170
171 void
chacha_encrypt(uchar * buf,usize bytes,Chachastate * s)172 chacha_encrypt(uchar *buf, usize bytes, Chachastate *s)
173 {
174 chacha_encrypt2(buf, buf, bytes, s);
175 }
176