1fc8fc743SJohn Baldwin /*- 2fc8fc743SJohn Baldwin * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 3fc8fc743SJohn Baldwin * 4fc8fc743SJohn Baldwin * Copyright (c) 2020 Netflix Inc. 5fc8fc743SJohn Baldwin * 6fc8fc743SJohn Baldwin * Redistribution and use in source and binary forms, with or without 7fc8fc743SJohn Baldwin * modification, are permitted provided that the following conditions 8fc8fc743SJohn Baldwin * are met: 9fc8fc743SJohn Baldwin * 1. Redistributions of source code must retain the above copyright 10fc8fc743SJohn Baldwin * notice, this list of conditions and the following disclaimer. 11fc8fc743SJohn Baldwin * 2. Redistributions in binary form must reproduce the above copyright 12fc8fc743SJohn Baldwin * notice, this list of conditions and the following disclaimer in the 13fc8fc743SJohn Baldwin * documentation and/or other materials provided with the distribution. 14fc8fc743SJohn Baldwin * 15fc8fc743SJohn Baldwin * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 16fc8fc743SJohn Baldwin * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17fc8fc743SJohn Baldwin * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18fc8fc743SJohn Baldwin * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 19fc8fc743SJohn Baldwin * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20fc8fc743SJohn Baldwin * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21fc8fc743SJohn Baldwin * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22fc8fc743SJohn Baldwin * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23fc8fc743SJohn Baldwin * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24fc8fc743SJohn Baldwin * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25fc8fc743SJohn Baldwin * SUCH DAMAGE. 26fc8fc743SJohn Baldwin */ 27fc8fc743SJohn Baldwin 28dd2e1352SJohn Baldwin #include <opencrypto/xform_auth.h> 29fc8fc743SJohn Baldwin #include <opencrypto/xform_enc.h> 30fc8fc743SJohn Baldwin 31dd2e1352SJohn Baldwin #include <sodium/crypto_onetimeauth_poly1305.h> 32dd2e1352SJohn Baldwin #include <sodium/crypto_stream_chacha20.h> 33dd2e1352SJohn Baldwin 34dd2e1352SJohn Baldwin struct chacha20_poly1305_cipher_ctx { 35dd2e1352SJohn Baldwin const void *key; 36dd2e1352SJohn Baldwin uint32_t ic; 37dd2e1352SJohn Baldwin char nonce[CHACHA20_POLY1305_IV_LEN]; 38dd2e1352SJohn Baldwin }; 39dd2e1352SJohn Baldwin 40dd2e1352SJohn Baldwin static int 41dd2e1352SJohn Baldwin chacha20_poly1305_setkey(void *vctx, const uint8_t *key, int len) 42dd2e1352SJohn Baldwin { 43dd2e1352SJohn Baldwin struct chacha20_poly1305_cipher_ctx *ctx = vctx; 44dd2e1352SJohn Baldwin 45dd2e1352SJohn Baldwin if (len != CHACHA20_POLY1305_KEY) 46dd2e1352SJohn Baldwin return (EINVAL); 47dd2e1352SJohn Baldwin 48dd2e1352SJohn Baldwin ctx->key = key; 49dd2e1352SJohn Baldwin return (0); 50dd2e1352SJohn Baldwin } 51dd2e1352SJohn Baldwin 52dd2e1352SJohn Baldwin static void 53dd2e1352SJohn Baldwin chacha20_poly1305_reinit(void *vctx, const uint8_t *iv) 54dd2e1352SJohn Baldwin { 55dd2e1352SJohn Baldwin struct chacha20_poly1305_cipher_ctx *ctx = vctx; 56dd2e1352SJohn Baldwin 57dd2e1352SJohn Baldwin /* Block 0 is used for the poly1305 key. */ 58dd2e1352SJohn Baldwin memcpy(ctx->nonce, iv, sizeof(ctx->nonce)); 59dd2e1352SJohn Baldwin ctx->ic = 1; 60dd2e1352SJohn Baldwin } 61dd2e1352SJohn Baldwin 62dd2e1352SJohn Baldwin static void 63dd2e1352SJohn Baldwin chacha20_poly1305_crypt(void *vctx, const uint8_t *in, uint8_t *out) 64dd2e1352SJohn Baldwin { 65dd2e1352SJohn Baldwin struct chacha20_poly1305_cipher_ctx *ctx = vctx; 66dd2e1352SJohn Baldwin int error; 67dd2e1352SJohn Baldwin 68dd2e1352SJohn Baldwin error = crypto_stream_chacha20_ietf_xor_ic(out, in, 69dd2e1352SJohn Baldwin CHACHA20_NATIVE_BLOCK_LEN, ctx->nonce, ctx->ic, ctx->key); 70dd2e1352SJohn Baldwin KASSERT(error == 0, ("%s failed: %d", __func__, error)); 71dd2e1352SJohn Baldwin ctx->ic++; 72dd2e1352SJohn Baldwin } 73dd2e1352SJohn Baldwin 74dd2e1352SJohn Baldwin static void 75dd2e1352SJohn Baldwin chacha20_poly1305_crypt_last(void *vctx, const uint8_t *in, uint8_t *out, 76dd2e1352SJohn Baldwin size_t len) 77dd2e1352SJohn Baldwin { 78dd2e1352SJohn Baldwin struct chacha20_poly1305_cipher_ctx *ctx = vctx; 79dd2e1352SJohn Baldwin 80dd2e1352SJohn Baldwin int error; 81dd2e1352SJohn Baldwin 82dd2e1352SJohn Baldwin error = crypto_stream_chacha20_ietf_xor_ic(out, in, len, ctx->nonce, 83dd2e1352SJohn Baldwin ctx->ic, ctx->key); 84dd2e1352SJohn Baldwin KASSERT(error == 0, ("%s failed: %d", __func__, error)); 85dd2e1352SJohn Baldwin } 86dd2e1352SJohn Baldwin 87*d8787d4fSMark Johnston const struct enc_xform enc_xform_chacha20_poly1305 = { 88fc8fc743SJohn Baldwin .type = CRYPTO_CHACHA20_POLY1305, 89fc8fc743SJohn Baldwin .name = "ChaCha20-Poly1305", 90dd2e1352SJohn Baldwin .ctxsize = sizeof(struct chacha20_poly1305_cipher_ctx), 91fc8fc743SJohn Baldwin .blocksize = 1, 92dd2e1352SJohn Baldwin .native_blocksize = CHACHA20_NATIVE_BLOCK_LEN, 93fc8fc743SJohn Baldwin .ivsize = CHACHA20_POLY1305_IV_LEN, 94fc8fc743SJohn Baldwin .minkey = CHACHA20_POLY1305_KEY, 95fc8fc743SJohn Baldwin .maxkey = CHACHA20_POLY1305_KEY, 96dd2e1352SJohn Baldwin .encrypt = chacha20_poly1305_crypt, 97dd2e1352SJohn Baldwin .decrypt = chacha20_poly1305_crypt, 98dd2e1352SJohn Baldwin .setkey = chacha20_poly1305_setkey, 99dd2e1352SJohn Baldwin .reinit = chacha20_poly1305_reinit, 100dd2e1352SJohn Baldwin .encrypt_last = chacha20_poly1305_crypt_last, 101dd2e1352SJohn Baldwin .decrypt_last = chacha20_poly1305_crypt_last, 102fc8fc743SJohn Baldwin }; 103fc8fc743SJohn Baldwin 104dd2e1352SJohn Baldwin struct chacha20_poly1305_auth_ctx { 105dd2e1352SJohn Baldwin struct crypto_onetimeauth_poly1305_state state; 106dd2e1352SJohn Baldwin const void *key; 107dd2e1352SJohn Baldwin }; 108dd2e1352SJohn Baldwin CTASSERT(sizeof(union authctx) >= sizeof(struct chacha20_poly1305_auth_ctx)); 109dd2e1352SJohn Baldwin 110dd2e1352SJohn Baldwin static void 111dd2e1352SJohn Baldwin chacha20_poly1305_Init(void *vctx) 112dd2e1352SJohn Baldwin { 113dd2e1352SJohn Baldwin } 114dd2e1352SJohn Baldwin 115dd2e1352SJohn Baldwin static void 116dd2e1352SJohn Baldwin chacha20_poly1305_Setkey(void *vctx, const uint8_t *key, u_int klen) 117dd2e1352SJohn Baldwin { 118dd2e1352SJohn Baldwin struct chacha20_poly1305_auth_ctx *ctx = vctx; 119dd2e1352SJohn Baldwin 120dd2e1352SJohn Baldwin ctx->key = key; 121dd2e1352SJohn Baldwin } 122dd2e1352SJohn Baldwin 123dd2e1352SJohn Baldwin static void 124dd2e1352SJohn Baldwin chacha20_poly1305_Reinit(void *vctx, const uint8_t *nonce, u_int noncelen) 125dd2e1352SJohn Baldwin { 126dd2e1352SJohn Baldwin struct chacha20_poly1305_auth_ctx *ctx = vctx; 127dd2e1352SJohn Baldwin char block[CHACHA20_NATIVE_BLOCK_LEN]; 128dd2e1352SJohn Baldwin 129dd2e1352SJohn Baldwin crypto_stream_chacha20_ietf(block, sizeof(block), nonce, ctx->key); 130dd2e1352SJohn Baldwin crypto_onetimeauth_poly1305_init(&ctx->state, block); 131dd2e1352SJohn Baldwin explicit_bzero(block, sizeof(block)); 132dd2e1352SJohn Baldwin } 133dd2e1352SJohn Baldwin 134dd2e1352SJohn Baldwin static int 135dd2e1352SJohn Baldwin chacha20_poly1305_Update(void *vctx, const void *data, u_int len) 136dd2e1352SJohn Baldwin { 137dd2e1352SJohn Baldwin struct chacha20_poly1305_auth_ctx *ctx = vctx; 138dd2e1352SJohn Baldwin 139dd2e1352SJohn Baldwin crypto_onetimeauth_poly1305_update(&ctx->state, data, len); 140dd2e1352SJohn Baldwin return (0); 141dd2e1352SJohn Baldwin } 142dd2e1352SJohn Baldwin 143dd2e1352SJohn Baldwin static void 144dd2e1352SJohn Baldwin chacha20_poly1305_Final(uint8_t *digest, void *vctx) 145dd2e1352SJohn Baldwin { 146dd2e1352SJohn Baldwin struct chacha20_poly1305_auth_ctx *ctx = vctx; 147dd2e1352SJohn Baldwin 148dd2e1352SJohn Baldwin crypto_onetimeauth_poly1305_final(&ctx->state, digest); 149dd2e1352SJohn Baldwin } 150dd2e1352SJohn Baldwin 151*d8787d4fSMark Johnston const struct auth_hash auth_hash_chacha20_poly1305 = { 152dd2e1352SJohn Baldwin .type = CRYPTO_POLY1305, 153dd2e1352SJohn Baldwin .name = "ChaCha20-Poly1305", 154dd2e1352SJohn Baldwin .keysize = POLY1305_KEY_LEN, 155dd2e1352SJohn Baldwin .hashsize = POLY1305_HASH_LEN, 156dd2e1352SJohn Baldwin .ctxsize = sizeof(struct chacha20_poly1305_auth_ctx), 157dd2e1352SJohn Baldwin .blocksize = crypto_onetimeauth_poly1305_BYTES, 158dd2e1352SJohn Baldwin .Init = chacha20_poly1305_Init, 159dd2e1352SJohn Baldwin .Setkey = chacha20_poly1305_Setkey, 160dd2e1352SJohn Baldwin .Reinit = chacha20_poly1305_Reinit, 161dd2e1352SJohn Baldwin .Update = chacha20_poly1305_Update, 162dd2e1352SJohn Baldwin .Final = chacha20_poly1305_Final, 163dd2e1352SJohn Baldwin }; 164