1 /* OPENBSD ORIGINAL: lib/libc/crypt/chacha_private.h */ 2 3 /* 4 chacha-merged.c version 20080118 5 D. J. Bernstein 6 Public domain. 7 */ 8 9 /* $OpenBSD: chacha_private.h,v 1.3 2022/02/28 21:56:29 dtucker Exp $ */ 10 11 typedef unsigned char u8; 12 typedef unsigned int u32; 13 14 typedef struct 15 { 16 u32 input[16]; /* could be compressed */ 17 } chacha_ctx; 18 19 #define U8C(v) (v##U) 20 #define U32C(v) (v##U) 21 22 #define U8V(v) ((u8)(v) & U8C(0xFF)) 23 #define U32V(v) ((u32)(v) & U32C(0xFFFFFFFF)) 24 25 #define ROTL32(v, n) \ 26 (U32V((v) << (n)) | ((v) >> (32 - (n)))) 27 28 #define U8TO32_LITTLE(p) \ 29 (((u32)((p)[0]) ) | \ 30 ((u32)((p)[1]) << 8) | \ 31 ((u32)((p)[2]) << 16) | \ 32 ((u32)((p)[3]) << 24)) 33 34 #define U32TO8_LITTLE(p, v) \ 35 do { \ 36 (p)[0] = U8V((v) ); \ 37 (p)[1] = U8V((v) >> 8); \ 38 (p)[2] = U8V((v) >> 16); \ 39 (p)[3] = U8V((v) >> 24); \ 40 } while (0) 41 42 #define ROTATE(v,c) (ROTL32(v,c)) 43 #define XOR(v,w) ((v) ^ (w)) 44 #define PLUS(v,w) (U32V((v) + (w))) 45 #define PLUSONE(v) (PLUS((v),1)) 46 47 #define QUARTERROUND(a,b,c,d) \ 48 a = PLUS(a,b); d = ROTATE(XOR(d,a),16); \ 49 c = PLUS(c,d); b = ROTATE(XOR(b,c),12); \ 50 a = PLUS(a,b); d = ROTATE(XOR(d,a), 8); \ 51 c = PLUS(c,d); b = ROTATE(XOR(b,c), 7); 52 53 static const char sigma[16] = "expand 32-byte k"; 54 static const char tau[16] = "expand 16-byte k"; 55 56 static void 57 chacha_keysetup(chacha_ctx *x,const u8 *k,u32 kbits) 58 { 59 const char *constants; 60 61 x->input[4] = U8TO32_LITTLE(k + 0); 62 x->input[5] = U8TO32_LITTLE(k + 4); 63 x->input[6] = U8TO32_LITTLE(k + 8); 64 x->input[7] = U8TO32_LITTLE(k + 12); 65 if (kbits == 256) { /* recommended */ 66 k += 16; 67 constants = sigma; 68 } else { /* kbits == 128 */ 69 constants = tau; 70 } 71 x->input[8] = U8TO32_LITTLE(k + 0); 72 x->input[9] = U8TO32_LITTLE(k + 4); 73 x->input[10] = U8TO32_LITTLE(k + 8); 74 x->input[11] = U8TO32_LITTLE(k + 12); 75 x->input[0] = U8TO32_LITTLE(constants + 0); 76 x->input[1] = U8TO32_LITTLE(constants + 4); 77 x->input[2] = U8TO32_LITTLE(constants + 8); 78 x->input[3] = U8TO32_LITTLE(constants + 12); 79 } 80 81 static void 82 chacha_ivsetup(chacha_ctx *x,const u8 *iv) 83 { 84 x->input[12] = 0; 85 x->input[13] = 0; 86 x->input[14] = U8TO32_LITTLE(iv + 0); 87 x->input[15] = U8TO32_LITTLE(iv + 4); 88 } 89 90 static void 91 chacha_encrypt_bytes(chacha_ctx *x,const u8 *m,u8 *c,u32 bytes) 92 { 93 u32 x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15; 94 u32 j0, j1, j2, j3, j4, j5, j6, j7, j8, j9, j10, j11, j12, j13, j14, j15; 95 u8 *ctarget = NULL; 96 u8 tmp[64]; 97 u_int i; 98 99 if (!bytes) return; 100 101 j0 = x->input[0]; 102 j1 = x->input[1]; 103 j2 = x->input[2]; 104 j3 = x->input[3]; 105 j4 = x->input[4]; 106 j5 = x->input[5]; 107 j6 = x->input[6]; 108 j7 = x->input[7]; 109 j8 = x->input[8]; 110 j9 = x->input[9]; 111 j10 = x->input[10]; 112 j11 = x->input[11]; 113 j12 = x->input[12]; 114 j13 = x->input[13]; 115 j14 = x->input[14]; 116 j15 = x->input[15]; 117 118 for (;;) { 119 if (bytes < 64) { 120 for (i = 0;i < bytes;++i) tmp[i] = m[i]; 121 m = tmp; 122 ctarget = c; 123 c = tmp; 124 } 125 x0 = j0; 126 x1 = j1; 127 x2 = j2; 128 x3 = j3; 129 x4 = j4; 130 x5 = j5; 131 x6 = j6; 132 x7 = j7; 133 x8 = j8; 134 x9 = j9; 135 x10 = j10; 136 x11 = j11; 137 x12 = j12; 138 x13 = j13; 139 x14 = j14; 140 x15 = j15; 141 for (i = 20;i > 0;i -= 2) { 142 QUARTERROUND( x0, x4, x8,x12) 143 QUARTERROUND( x1, x5, x9,x13) 144 QUARTERROUND( x2, x6,x10,x14) 145 QUARTERROUND( x3, x7,x11,x15) 146 QUARTERROUND( x0, x5,x10,x15) 147 QUARTERROUND( x1, x6,x11,x12) 148 QUARTERROUND( x2, x7, x8,x13) 149 QUARTERROUND( x3, x4, x9,x14) 150 } 151 x0 = PLUS(x0,j0); 152 x1 = PLUS(x1,j1); 153 x2 = PLUS(x2,j2); 154 x3 = PLUS(x3,j3); 155 x4 = PLUS(x4,j4); 156 x5 = PLUS(x5,j5); 157 x6 = PLUS(x6,j6); 158 x7 = PLUS(x7,j7); 159 x8 = PLUS(x8,j8); 160 x9 = PLUS(x9,j9); 161 x10 = PLUS(x10,j10); 162 x11 = PLUS(x11,j11); 163 x12 = PLUS(x12,j12); 164 x13 = PLUS(x13,j13); 165 x14 = PLUS(x14,j14); 166 x15 = PLUS(x15,j15); 167 168 #ifndef KEYSTREAM_ONLY 169 x0 = XOR(x0,U8TO32_LITTLE(m + 0)); 170 x1 = XOR(x1,U8TO32_LITTLE(m + 4)); 171 x2 = XOR(x2,U8TO32_LITTLE(m + 8)); 172 x3 = XOR(x3,U8TO32_LITTLE(m + 12)); 173 x4 = XOR(x4,U8TO32_LITTLE(m + 16)); 174 x5 = XOR(x5,U8TO32_LITTLE(m + 20)); 175 x6 = XOR(x6,U8TO32_LITTLE(m + 24)); 176 x7 = XOR(x7,U8TO32_LITTLE(m + 28)); 177 x8 = XOR(x8,U8TO32_LITTLE(m + 32)); 178 x9 = XOR(x9,U8TO32_LITTLE(m + 36)); 179 x10 = XOR(x10,U8TO32_LITTLE(m + 40)); 180 x11 = XOR(x11,U8TO32_LITTLE(m + 44)); 181 x12 = XOR(x12,U8TO32_LITTLE(m + 48)); 182 x13 = XOR(x13,U8TO32_LITTLE(m + 52)); 183 x14 = XOR(x14,U8TO32_LITTLE(m + 56)); 184 x15 = XOR(x15,U8TO32_LITTLE(m + 60)); 185 #endif 186 187 j12 = PLUSONE(j12); 188 if (!j12) { 189 j13 = PLUSONE(j13); 190 /* stopping at 2^70 bytes per nonce is user's responsibility */ 191 } 192 193 U32TO8_LITTLE(c + 0,x0); 194 U32TO8_LITTLE(c + 4,x1); 195 U32TO8_LITTLE(c + 8,x2); 196 U32TO8_LITTLE(c + 12,x3); 197 U32TO8_LITTLE(c + 16,x4); 198 U32TO8_LITTLE(c + 20,x5); 199 U32TO8_LITTLE(c + 24,x6); 200 U32TO8_LITTLE(c + 28,x7); 201 U32TO8_LITTLE(c + 32,x8); 202 U32TO8_LITTLE(c + 36,x9); 203 U32TO8_LITTLE(c + 40,x10); 204 U32TO8_LITTLE(c + 44,x11); 205 U32TO8_LITTLE(c + 48,x12); 206 U32TO8_LITTLE(c + 52,x13); 207 U32TO8_LITTLE(c + 56,x14); 208 U32TO8_LITTLE(c + 60,x15); 209 210 if (bytes <= 64) { 211 if (bytes < 64) { 212 for (i = 0;i < bytes;++i) ctarget[i] = c[i]; 213 } 214 x->input[12] = j12; 215 x->input[13] = j13; 216 return; 217 } 218 bytes -= 64; 219 c += 64; 220 #ifndef KEYSTREAM_ONLY 221 m += 64; 222 #endif 223 } 224 } 225