1/* Copyright (c) 2014, Google Inc.
2 *
3 * Permission to use, copy, modify, and/or distribute this software for any
4 * purpose with or without fee is hereby granted, provided that the above
5 * copyright notice and this permission notice appear in all copies.
6 *
7 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14
15// Adapted from the public domain, estream code by D. Bernstein.
16
17#include <openssl/chacha.h>
18
19#include <assert.h>
20#include <string.h>
21
22#include <openssl/cpu.h>
23
24#include "../internal.h"
25#include "internal.h"
26
27
28#define U8TO32_LITTLE(p) \
29 (((uint32_t)((p)[0])) | ((uint32_t)((p)[1]) << 8) | \
30 ((uint32_t)((p)[2]) << 16) | ((uint32_t)((p)[3]) << 24))
31
32// sigma contains the ChaCha constants, which happen to be an ASCII string.
33static const uint8_t sigma[16] = { 'e', 'x', 'p', 'a', 'n', 'd', ' ', '3',
34 '2', '-', 'b', 'y', 't', 'e', ' ', 'k' };
35
36#define ROTATE(v, n) (((v) << (n)) | ((v) >> (32 - (n))))
37
38// QUARTERROUND updates a, b, c, d with a ChaCha "quarter" round.
39#define QUARTERROUND(a, b, c, d) \
40 x[a] += x[b]; x[d] = ROTATE(x[d] ^ x[a], 16); \
41 x[c] += x[d]; x[b] = ROTATE(x[b] ^ x[c], 12); \
42 x[a] += x[b]; x[d] = ROTATE(x[d] ^ x[a], 8); \
43 x[c] += x[d]; x[b] = ROTATE(x[b] ^ x[c], 7);
44
45void CRYPTO_hchacha20(uint8_t out[32], const uint8_t key[32],
46 const uint8_t nonce[16]) {
47 uint32_t x[16];
48 OPENSSL_memcpy(x, sigma, sizeof(sigma));
49 OPENSSL_memcpy(&x[4], key, 32);
50 OPENSSL_memcpy(&x[12], nonce, 16);
51
52 for (size_t i = 0; i < 20; i += 2) {
53 QUARTERROUND(0, 4, 8, 12)
54 QUARTERROUND(1, 5, 9, 13)
55 QUARTERROUND(2, 6, 10, 14)
56 QUARTERROUND(3, 7, 11, 15)
57 QUARTERROUND(0, 5, 10, 15)
58 QUARTERROUND(1, 6, 11, 12)
59 QUARTERROUND(2, 7, 8, 13)
60 QUARTERROUND(3, 4, 9, 14)
61 }
62
63 OPENSSL_memcpy(out, &x[0], sizeof(uint32_t) * 4);
64 OPENSSL_memcpy(&out[16], &x[12], sizeof(uint32_t) * 4);
65}
66
67#if defined(CHACHA20_ASM)
68
69void CRYPTO_chacha_20(uint8_t *out, const uint8_t *in, size_t in_len,
70 const uint8_t key[32], const uint8_t nonce[12],
71 uint32_t counter) {
72 assert(!buffers_alias(out, in_len, in, in_len) || in == out);
73
74 uint32_t counter_nonce[4]; counter_nonce[0] = counter;
75 counter_nonce[1] = U8TO32_LITTLE(nonce + 0);
76 counter_nonce[2] = U8TO32_LITTLE(nonce + 4);
77 counter_nonce[3] = U8TO32_LITTLE(nonce + 8);
78
79 const uint32_t *key_ptr = (const uint32_t *)key;
80#if !defined(OPENSSL_X86) && !defined(OPENSSL_X86_64)
81 // The assembly expects the key to be four-byte aligned.
82 uint32_t key_u32[8];
83 if ((((uintptr_t)key) & 3) != 0) {
84 key_u32[0] = U8TO32_LITTLE(key + 0);
85 key_u32[1] = U8TO32_LITTLE(key + 4);
86 key_u32[2] = U8TO32_LITTLE(key + 8);
87 key_u32[3] = U8TO32_LITTLE(key + 12);
88 key_u32[4] = U8TO32_LITTLE(key + 16);
89 key_u32[5] = U8TO32_LITTLE(key + 20);
90 key_u32[6] = U8TO32_LITTLE(key + 24);
91 key_u32[7] = U8TO32_LITTLE(key + 28);
92
93 key_ptr = key_u32;
94 }
95#endif
96
97 ChaCha20_ctr32(out, in, in_len, key_ptr, counter_nonce);
98}
99
100#else
101
102#define U32TO8_LITTLE(p, v) \
103 { \
104 (p)[0] = (v >> 0) & 0xff; \
105 (p)[1] = (v >> 8) & 0xff; \
106 (p)[2] = (v >> 16) & 0xff; \
107 (p)[3] = (v >> 24) & 0xff; \
108 }
109
110// chacha_core performs 20 rounds of ChaCha on the input words in
111// |input| and writes the 64 output bytes to |output|.
112static void chacha_core(uint8_t output[64], const uint32_t input[16]) {
113 uint32_t x[16];
114 int i;
115
116 OPENSSL_memcpy(x, input, sizeof(uint32_t) * 16);
117 for (i = 20; i > 0; i -= 2) {
118 QUARTERROUND(0, 4, 8, 12)
119 QUARTERROUND(1, 5, 9, 13)
120 QUARTERROUND(2, 6, 10, 14)
121 QUARTERROUND(3, 7, 11, 15)
122 QUARTERROUND(0, 5, 10, 15)
123 QUARTERROUND(1, 6, 11, 12)
124 QUARTERROUND(2, 7, 8, 13)
125 QUARTERROUND(3, 4, 9, 14)
126 }
127
128 for (i = 0; i < 16; ++i) {
129 x[i] += input[i];
130 }
131 for (i = 0; i < 16; ++i) {
132 U32TO8_LITTLE(output + 4 * i, x[i]);
133 }
134}
135
136void CRYPTO_chacha_20(uint8_t *out, const uint8_t *in, size_t in_len,
137 const uint8_t key[32], const uint8_t nonce[12],
138 uint32_t counter) {
139 assert(!buffers_alias(out, in_len, in, in_len) || in == out);
140
141 uint32_t input[16];
142 uint8_t buf[64];
143 size_t todo, i;
144
145 input[0] = U8TO32_LITTLE(sigma + 0);
146 input[1] = U8TO32_LITTLE(sigma + 4);
147 input[2] = U8TO32_LITTLE(sigma + 8);
148 input[3] = U8TO32_LITTLE(sigma + 12);
149
150 input[4] = U8TO32_LITTLE(key + 0);
151 input[5] = U8TO32_LITTLE(key + 4);
152 input[6] = U8TO32_LITTLE(key + 8);
153 input[7] = U8TO32_LITTLE(key + 12);
154
155 input[8] = U8TO32_LITTLE(key + 16);
156 input[9] = U8TO32_LITTLE(key + 20);
157 input[10] = U8TO32_LITTLE(key + 24);
158 input[11] = U8TO32_LITTLE(key + 28);
159
160 input[12] = counter;
161 input[13] = U8TO32_LITTLE(nonce + 0);
162 input[14] = U8TO32_LITTLE(nonce + 4);
163 input[15] = U8TO32_LITTLE(nonce + 8);
164
165 while (in_len > 0) {
166 todo = sizeof(buf);
167 if (in_len < todo) {
168 todo = in_len;
169 }
170
171 chacha_core(buf, input);
172 for (i = 0; i < todo; i++) {
173 out[i] = in[i] ^ buf[i];
174 }
175
176 out += todo;
177 in += todo;
178 in_len -= todo;
179
180 input[12]++;
181 }
182}
183
184#endif
185