Blame view

RIOT/sys/crypto/chacha.c 3.79 KB
a752c7ab   elopes   add first test an...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
  /*
   * Copyright (C) 2008  D. J. Bernstein  (dedicated to the public domain)
   * Copyright (C) 2015  René Kijewski  <rene.kijewski@fu-berlin.de>
   *
   * Permission is hereby granted, free of charge, to any person obtaining a copy
   * of this software and associated documentation files (the "Software"), to deal
   * in the Software without restriction, including without limitation the rights
   * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
   * copies of the Software, and to permit persons to whom the Software is
   * furnished to do so, subject to the following conditions:
   *
   * The above copyright notice and this permission notice shall be included in
   * all copies or substantial portions of the Software.
   *
   * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
   * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
   * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
   * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
   * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
   * THE SOFTWARE.
   */
  
  /*
   * Please notice:
   *  - This implementation of the ChaCha stream cipher is very stripped down.
   *  - It assumes a little-endian system.
   *  - It is implemented for little code and data size, but will likely be
   *    slower than the refenrence implementation. Optimized implementation will
   *    out-perform the code even more.
   */
  
  #include "crypto/chacha.h"
  #include "byteorder.h"
  
  #if __BYTE_ORDER__ != __ORDER_LITTLE_ENDIAN__
  #   error "This code is implementented in a way that it will only work for little-endian systems!"
  #endif
  
  #include <string.h>
  
  static void _r(uint32_t *d, uint32_t *a, const uint32_t *b, unsigned c)
  {
      *a += *b;
      uint32_t tmp = *a ^ *d;
      *d = (tmp << c) | (tmp >> (32 - c));
  }
  
  static void _doubleround(void *output_, const uint32_t input[16], uint8_t rounds)
  {
      uint32_t *output = (uint32_t *) output_;
      memcpy(output, input, 64);
  
      rounds *= 4;
      for (unsigned i = 0; i < rounds; ++i) {
          /* cppcheck-suppress duplicateExpressionTernary
           * (reason: Externally imported code beautification) */
          uint32_t *a = &output[((i + ((i & 4) ? 0 : 0)) & 3) + (4 * 0)];
          uint32_t *b = &output[((i + ((i & 4) ? 1 : 0)) & 3) + (4 * 1)];
          uint32_t *c = &output[((i + ((i & 4) ? 2 : 0)) & 3) + (4 * 2)];
          uint32_t *d = &output[((i + ((i & 4) ? 3 : 0)) & 3) + (4 * 3)];
  
          _r(d, a, b, 16);
          _r(b, c, d, 12);
          _r(d, a, b,  8);
          _r(b, c, d,  7);
      }
  
      for (unsigned i = 0; i < 16; ++i) {
          output[i] += input[i];
      }
  }
  
  int chacha_init(chacha_ctx *ctx,
                  unsigned rounds,
                  const uint8_t *key, uint32_t keylen,
                  const uint8_t nonce[8])
  {
      if (keylen == 32) {
          memcpy(ctx->state + 0, "expand 32-byte k", 16);
          memcpy(ctx->state + 4, key, 32);
      }
      else if (keylen == 16) {
          memcpy(ctx->state + 0, "expand 16-byte k", 16);
          memcpy(ctx->state + 4, key, 16);
          memcpy(ctx->state + 8, key, 16);
      }
      else {
          return -1;
      }
  
      if ((rounds == 20) || (rounds == 12) || (rounds == 8)) {
          ctx->rounds = rounds;
      }
      else {
          return -1;
      }
  
      memset(ctx->state + 12, 0, 8);
      memcpy(ctx->state + 14, nonce, 8);
  
      return 0;
  }
  
  void chacha_keystream_bytes(chacha_ctx *ctx, void *x)
  {
      _doubleround(x, ctx->state, ctx->rounds);
  
      ++ctx->state[12];
      if (ctx->state[12] == 0) {
          ++ctx->state[13];
      }
  }
  
  void chacha_encrypt_bytes(chacha_ctx *ctx, const uint8_t *m, uint8_t *c)
  {
      uint8_t x[64];
      chacha_keystream_bytes(ctx, x);
      for (unsigned i = 0 ; i < 64; ++i) {
          c[i] = m[i] ^ x[i];
      }
  }