1 /* 2 * Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the OpenSSL license (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 /* Adapted from the public domain code by D. Bernstein from SUPERCOP. */ 11 12 #include <string.h> 13 14 #include "crypto/chacha.h" 15 #include "crypto/ctype.h" 16 17 typedef unsigned int u32; 18 typedef unsigned char u8; 19 typedef union { 20 u32 u[16]; 21 u8 c[64]; 22 } chacha_buf; 23 24 # define ROTATE(v, n) (((v) << (n)) | ((v) >> (32 - (n)))) 25 26 # define U32TO8_LITTLE(p, v) do { \ 27 (p)[0] = (u8)(v >> 0); \ 28 (p)[1] = (u8)(v >> 8); \ 29 (p)[2] = (u8)(v >> 16); \ 30 (p)[3] = (u8)(v >> 24); \ 31 } while(0) 32 33 /* QUARTERROUND updates a, b, c, d with a ChaCha "quarter" round. */ 34 # define QUARTERROUND(a,b,c,d) ( \ 35 x[a] += x[b], x[d] = ROTATE((x[d] ^ x[a]),16), \ 36 x[c] += x[d], x[b] = ROTATE((x[b] ^ x[c]),12), \ 37 x[a] += x[b], x[d] = ROTATE((x[d] ^ x[a]), 8), \ 38 x[c] += x[d], x[b] = ROTATE((x[b] ^ x[c]), 7) ) 39 40 /* chacha_core performs 20 rounds of ChaCha on the input words in 41 * |input| and writes the 64 output bytes to |output|. */ 42 static void chacha20_core(chacha_buf *output, const u32 input[16]) 43 { 44 u32 x[16]; 45 int i; 46 const union { 47 long one; 48 char little; 49 } is_endian = { 1 }; 50 51 memcpy(x, input, sizeof(x)); 52 53 for (i = 20; i > 0; i -= 2) { 54 QUARTERROUND(0, 4, 8, 12); 55 QUARTERROUND(1, 5, 9, 13); 56 QUARTERROUND(2, 6, 10, 14); 57 QUARTERROUND(3, 7, 11, 15); 58 QUARTERROUND(0, 5, 10, 15); 59 QUARTERROUND(1, 6, 11, 12); 60 QUARTERROUND(2, 7, 8, 13); 61 QUARTERROUND(3, 4, 9, 14); 62 } 63 64 if (is_endian.little) { 65 for (i = 0; i < 16; ++i) 66 output->u[i] = x[i] + input[i]; 67 } else { 68 for (i = 0; i < 16; ++i) 69 U32TO8_LITTLE(output->c + 4 * i, (x[i] + input[i])); 70 } 71 } 72 73 void ChaCha20_ctr32(unsigned char *out, const unsigned char *inp, 74 size_t len, const unsigned int key[8], 75 const unsigned int counter[4]) 76 { 77 u32 input[16]; 78 chacha_buf buf; 79 size_t todo, i; 80 81 /* sigma constant "expand 32-byte k" in little-endian encoding */ 82 input[0] = ((u32)ossl_toascii('e')) | ((u32)ossl_toascii('x') << 8) 83 | ((u32)ossl_toascii('p') << 16) 84 | ((u32)ossl_toascii('a') << 24); 85 input[1] = ((u32)ossl_toascii('n')) | ((u32)ossl_toascii('d') << 8) 86 | ((u32)ossl_toascii(' ') << 16) 87 | ((u32)ossl_toascii('3') << 24); 88 input[2] = ((u32)ossl_toascii('2')) | ((u32)ossl_toascii('-') << 8) 89 | ((u32)ossl_toascii('b') << 16) 90 | ((u32)ossl_toascii('y') << 24); 91 input[3] = ((u32)ossl_toascii('t')) | ((u32)ossl_toascii('e') << 8) 92 | ((u32)ossl_toascii(' ') << 16) 93 | ((u32)ossl_toascii('k') << 24); 94 95 input[4] = key[0]; 96 input[5] = key[1]; 97 input[6] = key[2]; 98 input[7] = key[3]; 99 input[8] = key[4]; 100 input[9] = key[5]; 101 input[10] = key[6]; 102 input[11] = key[7]; 103 104 input[12] = counter[0]; 105 input[13] = counter[1]; 106 input[14] = counter[2]; 107 input[15] = counter[3]; 108 109 while (len > 0) { 110 todo = sizeof(buf); 111 if (len < todo) 112 todo = len; 113 114 chacha20_core(&buf, input); 115 116 for (i = 0; i < todo; i++) 117 out[i] = inp[i] ^ buf.c[i]; 118 out += todo; 119 inp += todo; 120 len -= todo; 121 122 /* 123 * Advance 32-bit counter. Note that as subroutine is so to 124 * say nonce-agnostic, this limited counter width doesn't 125 * prevent caller from implementing wider counter. It would 126 * simply take two calls split on counter overflow... 127 */ 128 input[12]++; 129 } 130 } 131