1*92aecd1eSJohn Baldwin /* 2*92aecd1eSJohn Baldwin * Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved. 3*92aecd1eSJohn Baldwin * 4*92aecd1eSJohn Baldwin * Licensed under the OpenSSL license (the "License"). You may not use 5*92aecd1eSJohn Baldwin * this file except in compliance with the License. You can obtain a copy 6*92aecd1eSJohn Baldwin * in the file LICENSE in the source distribution or at 7*92aecd1eSJohn Baldwin * https://www.openssl.org/source/license.html 8*92aecd1eSJohn Baldwin */ 9*92aecd1eSJohn Baldwin 10*92aecd1eSJohn Baldwin /* From include/crypto/chacha.h */ 11*92aecd1eSJohn Baldwin 12*92aecd1eSJohn Baldwin #ifndef OSSL_CRYPTO_CHACHA_H 13*92aecd1eSJohn Baldwin #define OSSL_CRYPTO_CHACHA_H 14*92aecd1eSJohn Baldwin 15*92aecd1eSJohn Baldwin /* 16*92aecd1eSJohn Baldwin * ChaCha20_ctr32 encrypts |len| bytes from |inp| with the given key and 17*92aecd1eSJohn Baldwin * nonce and writes the result to |out|, which may be equal to |inp|. 18*92aecd1eSJohn Baldwin * The |key| is not 32 bytes of verbatim key material though, but the 19*92aecd1eSJohn Baldwin * said material collected into 8 32-bit elements array in host byte 20*92aecd1eSJohn Baldwin * order. Same approach applies to nonce: the |counter| argument is 21*92aecd1eSJohn Baldwin * pointer to concatenated nonce and counter values collected into 4 22*92aecd1eSJohn Baldwin * 32-bit elements. This, passing crypto material collected into 32-bit 23*92aecd1eSJohn Baldwin * elements as opposite to passing verbatim byte vectors, is chosen for 24*92aecd1eSJohn Baldwin * efficiency in multi-call scenarios. 25*92aecd1eSJohn Baldwin */ 26*92aecd1eSJohn Baldwin void ChaCha20_ctr32(unsigned char *out, const unsigned char *inp, 27*92aecd1eSJohn Baldwin size_t len, const unsigned int key[8], 28*92aecd1eSJohn Baldwin const unsigned int counter[4]); 29*92aecd1eSJohn Baldwin /* 30*92aecd1eSJohn Baldwin * You can notice that there is no key setup procedure. Because it's 31*92aecd1eSJohn Baldwin * as trivial as collecting bytes into 32-bit elements, it's reckoned 32*92aecd1eSJohn Baldwin * that below macro is sufficient. 33*92aecd1eSJohn Baldwin */ 34*92aecd1eSJohn Baldwin #define CHACHA_U8TOU32(p) ( \ 35*92aecd1eSJohn Baldwin ((unsigned int)(p)[0]) | ((unsigned int)(p)[1]<<8) | \ 36*92aecd1eSJohn Baldwin ((unsigned int)(p)[2]<<16) | ((unsigned int)(p)[3]<<24) ) 37*92aecd1eSJohn Baldwin 38*92aecd1eSJohn Baldwin #define CHACHA_KEY_SIZE 32 39*92aecd1eSJohn Baldwin #define CHACHA_CTR_SIZE 16 40*92aecd1eSJohn Baldwin #define CHACHA_BLK_SIZE 64 41*92aecd1eSJohn Baldwin 42*92aecd1eSJohn Baldwin #endif 43