xref: /freebsd/sys/opencrypto/xform_chacha20_poly1305.c (revision d8787d4f7848bad8bd69325969806e1a76d0c3df)
1fc8fc743SJohn Baldwin /*-
2fc8fc743SJohn Baldwin  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3fc8fc743SJohn Baldwin  *
4fc8fc743SJohn Baldwin  * Copyright (c) 2020 Netflix Inc.
5fc8fc743SJohn Baldwin  *
6fc8fc743SJohn Baldwin  * Redistribution and use in source and binary forms, with or without
7fc8fc743SJohn Baldwin  * modification, are permitted provided that the following conditions
8fc8fc743SJohn Baldwin  * are met:
9fc8fc743SJohn Baldwin  * 1. Redistributions of source code must retain the above copyright
10fc8fc743SJohn Baldwin  *    notice, this list of conditions and the following disclaimer.
11fc8fc743SJohn Baldwin  * 2. Redistributions in binary form must reproduce the above copyright
12fc8fc743SJohn Baldwin  *    notice, this list of conditions and the following disclaimer in the
13fc8fc743SJohn Baldwin  *    documentation and/or other materials provided with the distribution.
14fc8fc743SJohn Baldwin  *
15fc8fc743SJohn Baldwin  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
16fc8fc743SJohn Baldwin  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17fc8fc743SJohn Baldwin  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18fc8fc743SJohn Baldwin  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
19fc8fc743SJohn Baldwin  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20fc8fc743SJohn Baldwin  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21fc8fc743SJohn Baldwin  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22fc8fc743SJohn Baldwin  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23fc8fc743SJohn Baldwin  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24fc8fc743SJohn Baldwin  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25fc8fc743SJohn Baldwin  * SUCH DAMAGE.
26fc8fc743SJohn Baldwin  */
27fc8fc743SJohn Baldwin 
28dd2e1352SJohn Baldwin #include <opencrypto/xform_auth.h>
29fc8fc743SJohn Baldwin #include <opencrypto/xform_enc.h>
30fc8fc743SJohn Baldwin 
31dd2e1352SJohn Baldwin #include <sodium/crypto_onetimeauth_poly1305.h>
32dd2e1352SJohn Baldwin #include <sodium/crypto_stream_chacha20.h>
33dd2e1352SJohn Baldwin 
34dd2e1352SJohn Baldwin struct chacha20_poly1305_cipher_ctx {
35dd2e1352SJohn Baldwin 	const void *key;
36dd2e1352SJohn Baldwin 	uint32_t ic;
37dd2e1352SJohn Baldwin 	char nonce[CHACHA20_POLY1305_IV_LEN];
38dd2e1352SJohn Baldwin };
39dd2e1352SJohn Baldwin 
40dd2e1352SJohn Baldwin static int
41dd2e1352SJohn Baldwin chacha20_poly1305_setkey(void *vctx, const uint8_t *key, int len)
42dd2e1352SJohn Baldwin {
43dd2e1352SJohn Baldwin 	struct chacha20_poly1305_cipher_ctx *ctx = vctx;
44dd2e1352SJohn Baldwin 
45dd2e1352SJohn Baldwin 	if (len != CHACHA20_POLY1305_KEY)
46dd2e1352SJohn Baldwin 		return (EINVAL);
47dd2e1352SJohn Baldwin 
48dd2e1352SJohn Baldwin 	ctx->key = key;
49dd2e1352SJohn Baldwin 	return (0);
50dd2e1352SJohn Baldwin }
51dd2e1352SJohn Baldwin 
52dd2e1352SJohn Baldwin static void
53dd2e1352SJohn Baldwin chacha20_poly1305_reinit(void *vctx, const uint8_t *iv)
54dd2e1352SJohn Baldwin {
55dd2e1352SJohn Baldwin 	struct chacha20_poly1305_cipher_ctx *ctx = vctx;
56dd2e1352SJohn Baldwin 
57dd2e1352SJohn Baldwin 	/* Block 0 is used for the poly1305 key. */
58dd2e1352SJohn Baldwin 	memcpy(ctx->nonce, iv, sizeof(ctx->nonce));
59dd2e1352SJohn Baldwin 	ctx->ic = 1;
60dd2e1352SJohn Baldwin }
61dd2e1352SJohn Baldwin 
62dd2e1352SJohn Baldwin static void
63dd2e1352SJohn Baldwin chacha20_poly1305_crypt(void *vctx, const uint8_t *in, uint8_t *out)
64dd2e1352SJohn Baldwin {
65dd2e1352SJohn Baldwin 	struct chacha20_poly1305_cipher_ctx *ctx = vctx;
66dd2e1352SJohn Baldwin 	int error;
67dd2e1352SJohn Baldwin 
68dd2e1352SJohn Baldwin 	error = crypto_stream_chacha20_ietf_xor_ic(out, in,
69dd2e1352SJohn Baldwin 	    CHACHA20_NATIVE_BLOCK_LEN, ctx->nonce, ctx->ic, ctx->key);
70dd2e1352SJohn Baldwin 	KASSERT(error == 0, ("%s failed: %d", __func__, error));
71dd2e1352SJohn Baldwin 	ctx->ic++;
72dd2e1352SJohn Baldwin }
73dd2e1352SJohn Baldwin 
74dd2e1352SJohn Baldwin static void
75dd2e1352SJohn Baldwin chacha20_poly1305_crypt_last(void *vctx, const uint8_t *in, uint8_t *out,
76dd2e1352SJohn Baldwin     size_t len)
77dd2e1352SJohn Baldwin {
78dd2e1352SJohn Baldwin 	struct chacha20_poly1305_cipher_ctx *ctx = vctx;
79dd2e1352SJohn Baldwin 
80dd2e1352SJohn Baldwin 	int error;
81dd2e1352SJohn Baldwin 
82dd2e1352SJohn Baldwin 	error = crypto_stream_chacha20_ietf_xor_ic(out, in, len, ctx->nonce,
83dd2e1352SJohn Baldwin 	    ctx->ic, ctx->key);
84dd2e1352SJohn Baldwin 	KASSERT(error == 0, ("%s failed: %d", __func__, error));
85dd2e1352SJohn Baldwin }
86dd2e1352SJohn Baldwin 
87*d8787d4fSMark Johnston const struct enc_xform enc_xform_chacha20_poly1305 = {
88fc8fc743SJohn Baldwin 	.type = CRYPTO_CHACHA20_POLY1305,
89fc8fc743SJohn Baldwin 	.name = "ChaCha20-Poly1305",
90dd2e1352SJohn Baldwin 	.ctxsize = sizeof(struct chacha20_poly1305_cipher_ctx),
91fc8fc743SJohn Baldwin 	.blocksize = 1,
92dd2e1352SJohn Baldwin 	.native_blocksize = CHACHA20_NATIVE_BLOCK_LEN,
93fc8fc743SJohn Baldwin 	.ivsize = CHACHA20_POLY1305_IV_LEN,
94fc8fc743SJohn Baldwin 	.minkey = CHACHA20_POLY1305_KEY,
95fc8fc743SJohn Baldwin 	.maxkey = CHACHA20_POLY1305_KEY,
96dd2e1352SJohn Baldwin 	.encrypt = chacha20_poly1305_crypt,
97dd2e1352SJohn Baldwin 	.decrypt = chacha20_poly1305_crypt,
98dd2e1352SJohn Baldwin 	.setkey = chacha20_poly1305_setkey,
99dd2e1352SJohn Baldwin 	.reinit = chacha20_poly1305_reinit,
100dd2e1352SJohn Baldwin 	.encrypt_last = chacha20_poly1305_crypt_last,
101dd2e1352SJohn Baldwin 	.decrypt_last = chacha20_poly1305_crypt_last,
102fc8fc743SJohn Baldwin };
103fc8fc743SJohn Baldwin 
104dd2e1352SJohn Baldwin struct chacha20_poly1305_auth_ctx {
105dd2e1352SJohn Baldwin 	struct crypto_onetimeauth_poly1305_state state;
106dd2e1352SJohn Baldwin 	const void *key;
107dd2e1352SJohn Baldwin };
108dd2e1352SJohn Baldwin CTASSERT(sizeof(union authctx) >= sizeof(struct chacha20_poly1305_auth_ctx));
109dd2e1352SJohn Baldwin 
110dd2e1352SJohn Baldwin static void
111dd2e1352SJohn Baldwin chacha20_poly1305_Init(void *vctx)
112dd2e1352SJohn Baldwin {
113dd2e1352SJohn Baldwin }
114dd2e1352SJohn Baldwin 
115dd2e1352SJohn Baldwin static void
116dd2e1352SJohn Baldwin chacha20_poly1305_Setkey(void *vctx, const uint8_t *key, u_int klen)
117dd2e1352SJohn Baldwin {
118dd2e1352SJohn Baldwin 	struct chacha20_poly1305_auth_ctx *ctx = vctx;
119dd2e1352SJohn Baldwin 
120dd2e1352SJohn Baldwin 	ctx->key = key;
121dd2e1352SJohn Baldwin }
122dd2e1352SJohn Baldwin 
123dd2e1352SJohn Baldwin static void
124dd2e1352SJohn Baldwin chacha20_poly1305_Reinit(void *vctx, const uint8_t *nonce, u_int noncelen)
125dd2e1352SJohn Baldwin {
126dd2e1352SJohn Baldwin 	struct chacha20_poly1305_auth_ctx *ctx = vctx;
127dd2e1352SJohn Baldwin 	char block[CHACHA20_NATIVE_BLOCK_LEN];
128dd2e1352SJohn Baldwin 
129dd2e1352SJohn Baldwin 	crypto_stream_chacha20_ietf(block, sizeof(block), nonce, ctx->key);
130dd2e1352SJohn Baldwin 	crypto_onetimeauth_poly1305_init(&ctx->state, block);
131dd2e1352SJohn Baldwin 	explicit_bzero(block, sizeof(block));
132dd2e1352SJohn Baldwin }
133dd2e1352SJohn Baldwin 
134dd2e1352SJohn Baldwin static int
135dd2e1352SJohn Baldwin chacha20_poly1305_Update(void *vctx, const void *data, u_int len)
136dd2e1352SJohn Baldwin {
137dd2e1352SJohn Baldwin 	struct chacha20_poly1305_auth_ctx *ctx = vctx;
138dd2e1352SJohn Baldwin 
139dd2e1352SJohn Baldwin 	crypto_onetimeauth_poly1305_update(&ctx->state, data, len);
140dd2e1352SJohn Baldwin 	return (0);
141dd2e1352SJohn Baldwin }
142dd2e1352SJohn Baldwin 
143dd2e1352SJohn Baldwin static void
144dd2e1352SJohn Baldwin chacha20_poly1305_Final(uint8_t *digest, void *vctx)
145dd2e1352SJohn Baldwin {
146dd2e1352SJohn Baldwin 	struct chacha20_poly1305_auth_ctx *ctx = vctx;
147dd2e1352SJohn Baldwin 
148dd2e1352SJohn Baldwin 	crypto_onetimeauth_poly1305_final(&ctx->state, digest);
149dd2e1352SJohn Baldwin }
150dd2e1352SJohn Baldwin 
151*d8787d4fSMark Johnston const struct auth_hash auth_hash_chacha20_poly1305 = {
152dd2e1352SJohn Baldwin 	.type = CRYPTO_POLY1305,
153dd2e1352SJohn Baldwin 	.name = "ChaCha20-Poly1305",
154dd2e1352SJohn Baldwin 	.keysize = POLY1305_KEY_LEN,
155dd2e1352SJohn Baldwin 	.hashsize = POLY1305_HASH_LEN,
156dd2e1352SJohn Baldwin 	.ctxsize = sizeof(struct chacha20_poly1305_auth_ctx),
157dd2e1352SJohn Baldwin 	.blocksize = crypto_onetimeauth_poly1305_BYTES,
158dd2e1352SJohn Baldwin 	.Init = chacha20_poly1305_Init,
159dd2e1352SJohn Baldwin 	.Setkey = chacha20_poly1305_Setkey,
160dd2e1352SJohn Baldwin 	.Reinit = chacha20_poly1305_Reinit,
161dd2e1352SJohn Baldwin 	.Update = chacha20_poly1305_Update,
162dd2e1352SJohn Baldwin 	.Final = chacha20_poly1305_Final,
163dd2e1352SJohn Baldwin };
164