chiark - git - mdw - catacomb/blob - symm/chacha.c

   1 /* -*-c-*-
   2  *
   3  * ChaCha stream cipher
   4  *
   5  * (c) 2015 Straylight/Edgeware
   6  */
   7
   8 /*----- Licensing notice --------------------------------------------------*
   9  *
  10  * This file is part of Catacomb.
  11  *
  12  * Catacomb is free software; you can redistribute it and/or modify
  13  * it under the terms of the GNU Library General Public License as
  14  * published by the Free Software Foundation; either version 2 of the
  15  * License, or (at your option) any later version.
  16  *
  17  * Catacomb is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU Library General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU Library General Public
  23  * License along with Catacomb; if not, write to the Free
  24  * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
  25  * MA 02111-1307, USA.
  26  */
  27
  28 /*----- Header files ------------------------------------------------------*/
  29
  30 #include "config.h"
  31
  32 #include <stdarg.h>
  33
  34 #include <mLib/bits.h>
  35
  36 #include "arena.h"
  37 #include "chacha.h"
  38 #include "chacha-core.h"
  39 #include "dispatch.h"
  40 #include "gcipher.h"
  41 #include "grand.h"
  42 #include "keysz.h"
  43 #include "paranoia.h"
  44 #include "rsvr.h"
  45
  46 /*----- Global variables --------------------------------------------------*/
  47
  48 const octet chacha_keysz[] = { KSZ_SET, 32, 16, 10, 0 };
  49
  50 /*----- The ChaCha core function and utilities ----------------------------*/
  51
  52 /* --- @core@ --- *
  53  *
  54  * Arguments:   @unsigned r@ = number of rounds
  55  *              @const chacha_matrix src@ = input matrix
  56  *              @chacha_matrix dest@ = where to put the output
  57  *
  58  * Returns:     ---
  59  *
  60  *
  61  * Use:         Apply the ChaCha/r core function to @src@, writing the
  62  *              result to @dest@.  This consists of @r@ rounds followed by
  63  *              the feedforward step.
  64  */
  65
  66 CPU_DISPATCH(static, (void), void, core,
  67              (unsigned r, const chacha_matrix src, chacha_matrix dest),
  68              (r, src, dest), pick_core, simple_core);
  69
  70 static void simple_core(unsigned r, const chacha_matrix src,
  71                         chacha_matrix dest)
  72   { CHACHA_nR(dest, src, r); CHACHA_FFWD(dest, src); }
  73
  74 #if CPUFAM_X86 || CPUFAM_AMD64
  75 extern core__functype chacha_core_x86ish_sse2;
  76 extern core__functype chacha_core_x86ish_avx;
  77 #endif
  78
  79 #if CPUFAM_ARMEL
  80 extern core__functype chacha_core_arm_neon;
  81 #endif
  82
  83 #if CPUFAM_ARM64
  84 extern core__functype chacha_core_arm64;
  85 #endif
  86
  87 static core__functype *pick_core(void)
  88 {
  89 #if CPUFAM_X86 || CPUFAM_AMD64
  90   DISPATCH_PICK_COND(chacha_core, chacha_core_x86ish_avx,
  91                      cpu_feature_p(CPUFEAT_X86_AVX));
  92   DISPATCH_PICK_COND(chacha_core, chacha_core_x86ish_sse2,
  93                      cpu_feature_p(CPUFEAT_X86_SSE2));
  94 #endif
  95 #if CPUFAM_ARMEL
  96   DISPATCH_PICK_COND(chacha_core, chacha_core_arm_neon,
  97                      cpu_feature_p(CPUFEAT_ARM_NEON));
  98 #endif
  99 #if CPUFAM_ARM64
 100   DISPATCH_PICK_COND(chacha_core, chacha_core_arm64, 1);
 101 #endif
 102   DISPATCH_PICK_FALLBACK(chacha_core, simple_core);
 103 }
 104
 105 /* --- @populate@ --- *
 106  *
 107  * Arguments:   @chacha_matrix a@ = a matrix to fill in
 108  *              @const void *key@ = pointer to key material
 109  *              @size_t ksz@ = size of key
 110  *
 111  * Returns:     ---
 112  *
 113  * Use:         Fills in a ChaCha matrix from the key, setting the
 114  *              appropriate constants according to the key length.  The nonce
 115  *              and position words are left uninitialized.
 116  */
 117
 118 static void populate(chacha_matrix a, const void *key, size_t ksz)
 119 {
 120   const octet *k = key;
 121
 122   KSZ_ASSERT(chacha, ksz);
 123
 124   a[ 4] = LOAD32_L(k +  0);
 125   a[ 5] = LOAD32_L(k +  4);
 126   if (ksz == 10) {
 127     a[ 6] = LOAD16_L(k +  8);
 128     a[ 7] = 0;
 129   } else {
 130     a[ 6] = LOAD32_L(k +  8);
 131     a[ 7] = LOAD32_L(k + 12);
 132   }
 133   if (ksz <= 16) {
 134     a[ 8] = a[ 4];
 135     a[ 9] = a[ 5];
 136     a[10] = a[ 6];
 137     a[11] = a[ 7];
 138     a[ 0] = CHACHA_A128;
 139     a[ 1] = CHACHA_B128;
 140     a[ 2] = ksz == 10 ? CHACHA_C80 : CHACHA_C128;
 141     a[ 3] = CHACHA_D128;
 142   } else {
 143     a[ 8] = LOAD32_L(k + 16);
 144     a[ 9] = LOAD32_L(k + 20);
 145     a[10] = LOAD32_L(k + 24);
 146     a[11] = LOAD32_L(k + 28);
 147     a[ 0] = CHACHA_A256;
 148     a[ 1] = CHACHA_B256;
 149     a[ 2] = CHACHA_C256;
 150     a[ 3] = CHACHA_D256;
 151   }
 152 }
 153
 154 /*----- ChaCha implementation ---------------------------------------------*/
 155
 156 static const octet zerononce[XCHACHA_NONCESZ];
 157
 158 /* --- @chacha_init@ --- *
 159  *
 160  * Arguments:   @chacha_ctx *ctx@ = context to fill in
 161  *              @const void *key@ = pointer to key material
 162  *              @size_t ksz@ = size of key (either 32 or 16)
 163  *              @const void *nonce@ = initial nonce, or null
 164  *
 165  * Returns:     ---
 166  *
 167  * Use:         Initializes a ChaCha context ready for use.
 168  */
 169
 170 void chacha_init(chacha_ctx *ctx, const void *key, size_t ksz,
 171                   const void *nonce)
 172 {
 173   populate(ctx->a, key, ksz);
 174   chacha_setnonce(ctx, nonce ? nonce : zerononce);
 175 }
 176
 177 /* --- @chacha_setnonce{,_ietf}@ --- *
 178  *
 179  * Arguments:   @chacha_ctx *ctx@ = pointer to context
 180  *              @const void *nonce@ = the nonce (@CHACHA_NONCESZ@ or
 181  *                      @CHACHA_IETF_NONCESZ@ bytes)
 182  *
 183  * Returns:     ---
 184  *
 185  * Use:         Set a new nonce in the context @ctx@, e.g., for processing a
 186  *              different message.  The stream position is reset to zero (see
 187  *              @chacha_seek@ etc.).
 188  */
 189
 190 void chacha_setnonce(chacha_ctx *ctx, const void *nonce)
 191 {
 192   const octet *n = nonce;
 193
 194   ctx->a[14] = LOAD32_L(n + 0);
 195   ctx->a[15] = LOAD32_L(n + 4);
 196   chacha_seek(ctx, 0);
 197 }
 198
 199 void chacha_setnonce_ietf(chacha_ctx *ctx, const void *nonce)
 200 {
 201   const octet *n = nonce;
 202
 203   ctx->a[13] = LOAD32_L(n + 0);
 204   ctx->a[14] = LOAD32_L(n + 4);
 205   ctx->a[15] = LOAD32_L(n + 8);
 206   chacha_seek_ietf(ctx, 0);
 207 }
 208
 209 /* --- @chacha_seek{,u64,_ietf}@ --- *
 210  *
 211  * Arguments:   @chacha_ctx *ctx@ = pointer to context
 212  *              @unsigned long i@, @kludge64 i@, @uint32 i@ = new position
 213  *
 214  * Returns:     ---
 215  *
 216  * Use:         Sets a new stream position, in units of Chacha output
 217  *              blocks, which are @CHACHA_OUTSZ@ bytes each.  Byte
 218  *              granularity can be achieved by calling @chachaR_encrypt@
 219  *              appropriately.
 220  */
 221
 222 void chacha_seek(chacha_ctx *ctx, unsigned long i)
 223   { kludge64 ii; ASSIGN64(ii, i); chacha_seeku64(ctx, ii); }
 224
 225 void chacha_seeku64(chacha_ctx *ctx, kludge64 i)
 226 {
 227   ctx->a[12] = LO64(i); ctx->a[13] = HI64(i);
 228   ctx->off = CHACHA_OUTSZ;
 229 }
 230
 231 void chacha_seek_ietf(chacha_ctx *ctx, uint32 i)
 232   { ctx->a[12] = i; }
 233
 234 /* --- @chacha_tell{,u64,_ietf}@ --- *
 235  *
 236  * Arguments:   @chacha_ctx *ctx@ = pointer to context
 237  *
 238  * Returns:     The current position in the output stream, in blocks,
 239  *              rounding upwards.
 240  */
 241
 242 unsigned long chacha_tell(chacha_ctx *ctx)
 243   { kludge64 i = chacha_tellu64(ctx); return (GET64(unsigned long, i)); }
 244
 245 kludge64 chacha_tellu64(chacha_ctx *ctx)
 246   { kludge64 i; SET64(i, ctx->a[13], ctx->a[12]); return (i); }
 247
 248 uint32 chacha_tell_ietf(chacha_ctx *ctx)
 249   { return (ctx->a[12]); }
 250
 251 /* --- @chacha{20,12,8}_encrypt@ --- *
 252  *
 253  * Arguments:   @chacha_ctx *ctx@ = pointer to context
 254  *              @const void *src@ = source buffer (or null)
 255  *              @void *dest@ = destination buffer (or null)
 256  *              @size_t sz@ = size of the buffers
 257  *
 258  * Returns:     ---
 259  *
 260  * Use:         Encrypts or decrypts @sz@ bytes of data from @src@ to @dest@.
 261  *              ChaCha works by XORing plaintext with a keystream, so
 262  *              encryption and decryption are the same operation.  If @dest@
 263  *              is null then ignore @src@ and skip @sz@ bytes of the
 264  *              keystream.  If @src@ is null, then just write the keystream
 265  *              to @dest@.
 266  */
 267
 268 static const rsvr_policy policy = { 0, CHACHA_OUTSZ, CHACHA_OUTSZ };
 269
 270 #define CHACHA_ENCRYPT(r, ctx, src, dest, sz)                           \
 271   chacha##r##_encrypt(ctx, src, dest, sz)
 272 #define DEFENCRYPT(r)                                                   \
 273   void CHACHA_ENCRYPT(r, chacha_ctx *ctx, const void *src,              \
 274                       void *dest, size_t sz)                            \
 275   {                                                                     \
 276     chacha_matrix b;                                                    \
 277     const octet *s = src;                                               \
 278     octet *d = dest;                                                    \
 279     rsvr_plan plan;                                                     \
 280     kludge64 pos, delta;                                                \
 281                                                                         \
 282     rsvr_mkplan(&plan, &policy, ctx->off, sz);                          \
 283                                                                         \
 284     if (plan.head) {                                                    \
 285       if (!ctx->off) {                                                  \
 286         core(r, ctx->a, b); CHACHA_STEP(ctx->a);                        \
 287         SALSA20_PREPBUF(ctx, b);                                        \
 288       }                                                                 \
 289       SALSA20_OUTBUF(ctx, d, s, plan.head);                             \
 290     }                                                                   \
 291                                                                         \
 292     ctx->off -= plan.from_rsvr;                                         \
 293                                                                         \
 294     if (!d) {                                                           \
 295       if (plan.from_input) {                                            \
 296         pos = chacha_tellu64(ctx);                                      \
 297         ASSIGN64(delta, plan.from_input/SALSA20_OUTSZ);                 \
 298         ADD64(pos, pos, delta);                                         \
 299         chacha_seeku64(ctx, pos);                                       \
 300       }                                                                 \
 301     } else if (!s) while (plan.from_input) {                            \
 302       core(r, ctx->a, b); CHACHA_STEP(ctx->a);                          \
 303       SALSA20_GENFULL(b, d); plan.from_input -= CHACHA_OUTSZ;           \
 304     } else while (plan.from_input) {                                    \
 305       core(r, ctx->a, b); CHACHA_STEP(ctx->a);                          \
 306       SALSA20_MIXFULL(b, d, s); plan.from_input -= CHACHA_OUTSZ;        \
 307     }                                                                   \
 308                                                                         \
 309     if (plan.tail) {                                                    \
 310       core(r, ctx->a, b); CHACHA_STEP(ctx->a);                          \
 311       SALSA20_PREPBUF(ctx, b);                                          \
 312       SALSA20_OUTBUF(ctx, d, s, plan.tail);                             \
 313     }                                                                   \
 314   }
 315 CHACHA_VARS(DEFENCRYPT)
 316
 317 /*----- HChaCha implementation --------------------------------------------*/
 318
 319 #define HCHACHA_RAW(r, ctx, src, dest) hchacha##r##_raw(ctx, src, dest)
 320 #define HCHACHA_PRF(r, ctx, src, dest) hchacha##r##_prf(ctx, src, dest)
 321
 322 /* --- @hchacha{20,12,8}_prf@ --- *
 323  *
 324  * Arguments:   @chacha_ctx *ctx@ = pointer to context
 325  *              @const void *src@ = the input (@HCHACHA_INSZ@ bytes)
 326  *              @void *dest@ = the output (@HCHACHA_OUTSZ@ bytes)
 327  *
 328  * Returns:     ---
 329  *
 330  * Use:         Apply the HChacha/r pseudorandom function to @src@, writing
 331  *              the result to @out@.
 332  */
 333
 334 #define DEFHCHACHA(r)                                                   \
 335   static void HCHACHA_RAW(r, chacha_matrix k,                           \
 336                           const uint32 *src, uint32 *dest)              \
 337   {                                                                     \
 338     chacha_matrix a;                                                    \
 339     int i;                                                              \
 340                                                                         \
 341     /* --- HChaCha, computed from full ChaCha --- *                     \
 342      *                                                                  \
 343      * The security proof makes use of the fact that HChaCha (i.e.,     \
 344      * without the final feedforward step) can be computed from full    \
 345      * ChaCha using only knowledge of the non-secret input.  I don't    \
 346      * want to compromise the performance of the main function by       \
 347      * making the feedforward step separate, but this operation is less \
 348      * speed critical, so we do it the harder way.                      \
 349      */                                                                 \
 350                                                                         \
 351     for (i = 0; i < 4; i++) k[12 + i] = src[i];                         \
 352     core(r, k, a);                                                      \
 353     for (i = 0; i < 8; i++) dest[i] = a[(i + 4)^4] - k[(i + 4)^4];      \
 354   }                                                                     \
 355                                                                         \
 356   void HCHACHA_PRF(r, chacha_ctx *ctx, const void *src, void *dest)     \
 357   {                                                                     \
 358     const octet *s = src;                                               \
 359     octet *d = dest;                                                    \
 360     uint32 in[4], out[8];                                               \
 361     int i;                                                              \
 362                                                                         \
 363     for (i = 0; i < 4; i++) in[i] = LOAD32_L(s + 4*i);                  \
 364     HCHACHA_RAW(r, ctx->a, in, out);                                    \
 365     for (i = 0; i < 8; i++) STORE32_L(d + 4*i, out[i]);                 \
 366   }
 367 CHACHA_VARS(DEFHCHACHA)
 368
 369 /*----- XChaCha implementation -------------------------------------------*/
 370
 371 /* --- Some convenient macros for naming functions --- *
 372  *
 373  * Because the crypto core is involved in XChaCha/r's per-nonce setup, we
 374  * need to take an interest in the number of rounds in most of the various
 375  * functions, and it will probably help if we distinguish the context
 376  * structures for the various versions.
 377  */
 378
 379 #define XCHACHA_CTX(r) xchacha##r##_ctx
 380 #define XCHACHA_INIT(r, ctx, k, ksz, n) xchacha##r##_init(ctx, k, ksz, n)
 381 #define XCHACHA_SETNONCE(r, ctx, n) xchacha##r##_setnonce(ctx, n)
 382 #define XCHACHA_SEEK(r, ctx, i) xchacha##r##_seek(ctx, i)
 383 #define XCHACHA_SEEKU64(r, ctx, i) xchacha##r##_seeku64(ctx, i)
 384 #define XCHACHA_TELL(r, ctx) xchacha##r##_tell(ctx)
 385 #define XCHACHA_TELLU64(r, ctx) xchacha##r##_tellu64(ctx)
 386 #define XCHACHA_ENCRYPT(r, ctx, src, dest, sz)                          \
 387   xchacha##r##_encrypt(ctx, src, dest, sz)
 388
 389 /* --- @xchacha{20,12,8}_init@ --- *
 390  *
 391  * Arguments:   @xchachaR_ctx *ctx@ = the context to fill in
 392  *              @const void *key@ = pointer to key material
 393  *              @size_t ksz@ = size of key (either 32 or 16)
 394  *              @const void *nonce@ = initial nonce, or null
 395  *
 396  * Returns:     ---
 397  *
 398  * Use:         Initializes an XChaCha/r context ready for use.
 399  *
 400  *              There is a different function for each number of rounds,
 401  *              unlike for plain ChaCha.
 402  */
 403
 404 #define DEFXINIT(r)                                                     \
 405   void XCHACHA_INIT(r, XCHACHA_CTX(r) *ctx,                             \
 406                     const void *key, size_t ksz, const void *nonce)     \
 407   {                                                                     \
 408     populate(ctx->k, key, ksz);                                         \
 409     ctx->s.a[ 0] = CHACHA_A256;                                         \
 410     ctx->s.a[ 1] = CHACHA_B256;                                         \
 411     ctx->s.a[ 2] = CHACHA_C256;                                         \
 412     ctx->s.a[ 3] = CHACHA_D256;                                         \
 413     XCHACHA_SETNONCE(r, ctx, nonce ? nonce : zerononce);                \
 414   }
 415 CHACHA_VARS(DEFXINIT)
 416
 417 /* --- @xchacha{20,12,8}_setnonce@ --- *
 418  *
 419  * Arguments:   @xchachaR_ctx *ctx@ = pointer to context
 420  *              @const void *nonce@ = the nonce (@XCHACHA_NONCESZ@ bytes)
 421  *
 422  * Returns:     ---
 423  *
 424  * Use:         Set a new nonce in the context @ctx@, e.g., for processing a
 425  *              different message.  The stream position is reset to zero (see
 426  *              @chacha_seek@ etc.).
 427  *
 428  *              There is a different function for each number of rounds,
 429  *              unlike for plain ChaCha.
 430  */
 431
 432 #define DEFXNONCE(r)                                                    \
 433   void XCHACHA_SETNONCE(r, XCHACHA_CTX(r) *ctx, const void *nonce)      \
 434   {                                                                     \
 435     const octet *n = nonce;                                             \
 436     uint32 in[4];                                                       \
 437     int i;                                                              \
 438                                                                         \
 439     for (i = 0; i < 4; i++) in[i] = LOAD32_L(n + 4*i);                  \
 440     HCHACHA_RAW(r, ctx->k, in, ctx->s.a + 4);                           \
 441     chacha_setnonce(&ctx->s, n + 16);                                   \
 442   }
 443 CHACHA_VARS(DEFXNONCE)
 444
 445 /* --- @xchacha{20,12,8}_seek{,u64}@ --- *
 446  *
 447  * Arguments:   @xchachaR_ctx *ctx@ = pointer to context
 448  *              @unsigned long i@, @kludge64 i@ = new position to set
 449  *
 450  * Returns:     ---
 451  *
 452  * Use:         Sets a new stream position, in units of ChaCha output
 453  *              blocks, which are @XCHACHA_OUTSZ@ bytes each.  Byte
 454  *              granularity can be achieved by calling @xchachaR_encrypt@
 455  *              appropriately.
 456  *
 457  *              There is a different function for each number of rounds,
 458  *              unlike for plain ChaCha, because the context structures are
 459  *              different.
 460  */
 461
 462 /* --- @xchacha{20,12,8}_tell{,u64}@ --- *
 463  *
 464  * Arguments:   @chacha_ctx *ctx@ = pointer to context
 465  *
 466  * Returns:     The current position in the output stream, in blocks,
 467  *              rounding upwards.
 468  *
 469  *              There is a different function for each number of rounds,
 470  *              unlike for plain ChaCha, because the context structures are
 471  *              different.
 472  */
 473
 474 /* --- @xchacha{20,12,8}_encrypt@ --- *
 475  *
 476  * Arguments:   @xchachaR_ctx *ctx@ = pointer to context
 477  *              @const void *src@ = source buffer (or null)
 478  *              @void *dest@ = destination buffer (or null)
 479  *              @size_t sz@ = size of the buffers
 480  *
 481  * Returns:     ---
 482  *
 483  * Use:         Encrypts or decrypts @sz@ bytes of data from @src@ to @dest@.
 484  *              XChaCha works by XORing plaintext with a keystream, so
 485  *              encryption and decryption are the same operation.  If @dest@
 486  *              is null then ignore @src@ and skip @sz@ bytes of the
 487  *              keystream.  If @src@ is null, then just write the keystream
 488  *              to @dest@.
 489  */
 490
 491 #define DEFXPASSTHRU(r)                                                 \
 492   void XCHACHA_SEEK(r, XCHACHA_CTX(r) *ctx, unsigned long i)            \
 493     { chacha_seek(&ctx->s, i); }                                        \
 494   void XCHACHA_SEEKU64(r, XCHACHA_CTX(r) *ctx, kludge64 i)              \
 495     { chacha_seeku64(&ctx->s, i); }                                     \
 496   unsigned long XCHACHA_TELL(r, XCHACHA_CTX(r) *ctx)                    \
 497     { return chacha_tell(&ctx->s); }                                    \
 498   kludge64 XCHACHA_TELLU64(r, XCHACHA_CTX(r) *ctx)                      \
 499     { return chacha_tellu64(&ctx->s); }                                 \
 500   void XCHACHA_ENCRYPT(r, XCHACHA_CTX(r) *ctx,                          \
 501                         const void *src, void *dest, size_t sz)         \
 502     { CHACHA_ENCRYPT(r, &ctx->s, src, dest, sz); }
 503 CHACHA_VARS(DEFXPASSTHRU)
 504
 505 /*----- Generic cipher interface ------------------------------------------*/
 506
 507 typedef struct gctx { gcipher c; chacha_ctx ctx; } gctx;
 508
 509 static void gsetiv(gcipher *c, const void *iv)
 510   { gctx *g = (gctx *)c; chacha_setnonce(&g->ctx, iv); }
 511
 512 static void gsetiv_ietf(gcipher *c, const void *iv)
 513   { gctx *g = (gctx *)c; chacha_setnonce_ietf(&g->ctx, iv); }
 514
 515 static void gdestroy(gcipher *c)
 516   { gctx *g = (gctx *)c; BURN(*g); S_DESTROY(g); }
 517
 518 static gcipher *ginit(const void *k, size_t sz, const gcipher_ops *ops)
 519 {
 520   gctx *g = S_CREATE(gctx);
 521   g->c.ops = ops;
 522   chacha_init(&g->ctx, k, sz, 0);
 523   return (&g->c);
 524 }
 525
 526 #define DEFGCIPHER(r)                                                   \
 527                                                                         \
 528   static const gcipher_ops gops_##r, gops_##r##_ietf;                   \
 529                                                                         \
 530   static gcipher *ginit_##r(const void *k, size_t sz)                   \
 531     { return (ginit(k, sz, &gops_##r)); }                               \
 532                                                                         \
 533   static gcipher *ginit_##r##_ietf(const void *k, size_t sz)            \
 534     { return (ginit(k, sz, &gops_##r##_ietf)); }                        \
 535                                                                         \
 536   static void gencrypt_##r(gcipher *c, const void *s,                   \
 537                            void *t, size_t sz)                          \
 538     { gctx *g = (gctx *)c; CHACHA_ENCRYPT(r, &g->ctx, s, t, sz); }      \
 539                                                                         \
 540   static const gcipher_ops gops_##r = {                                 \
 541     &chacha##r,                                                         \
 542     gencrypt_##r, gencrypt_##r, gdestroy, gsetiv, 0                     \
 543   };                                                                    \
 544                                                                         \
 545   static const gcipher_ops gops_##r##_ietf = {                          \
 546     &chacha##r##_ietf,                                                  \
 547     gencrypt_##r, gencrypt_##r, gdestroy, gsetiv_ietf, 0                \
 548   };                                                                    \
 549                                                                         \
 550   const gccipher chacha##r = {                                          \
 551     "chacha" #r, chacha_keysz,                                          \
 552     CHACHA_NONCESZ, ginit_##r                                           \
 553   };                                                                    \
 554                                                                         \
 555   const gccipher chacha##r##_ietf = {                                   \
 556     "chacha" #r "-ietf", chacha_keysz,                                  \
 557     CHACHA_IETF_NONCESZ, ginit_##r##_ietf                               \
 558   };
 559
 560 CHACHA_VARS(DEFGCIPHER)
 561
 562 #define DEFGXCIPHER(r)                                                  \
 563                                                                         \
 564   typedef struct { gcipher c; XCHACHA_CTX(r) ctx; } gxctx_##r;          \
 565                                                                         \
 566   static void gxsetiv_##r(gcipher *c, const void *iv)                   \
 567     { gxctx_##r *g = (gxctx_##r *)c; XCHACHA_SETNONCE(r, &g->ctx, iv); } \
 568                                                                         \
 569   static void gxdestroy_##r(gcipher *c)                                 \
 570     { gxctx_##r *g = (gxctx_##r *)c; BURN(*g); S_DESTROY(g); }          \
 571                                                                         \
 572   static const gcipher_ops gxops_##r;                                   \
 573                                                                         \
 574   static gcipher *gxinit_##r(const void *k, size_t sz)                  \
 575   {                                                                     \
 576     gxctx_##r *g = S_CREATE(gxctx_##r);                                 \
 577     g->c.ops = &gxops_##r;                                              \
 578     XCHACHA_INIT(r, &g->ctx, k, sz, 0);                                 \
 579     return (&g->c);                                                     \
 580   }                                                                     \
 581                                                                         \
 582   static void gxencrypt_##r(gcipher *c, const void *s,                  \
 583                             void *t, size_t sz)                         \
 584   {                                                                     \
 585     gxctx_##r *g = (gxctx_##r *)c;                                      \
 586     XCHACHA_ENCRYPT(r, &g->ctx, s, t, sz);                              \
 587   }                                                                     \
 588                                                                         \
 589   static const gcipher_ops gxops_##r = {                                \
 590     &xchacha##r,                                                        \
 591     gxencrypt_##r, gxencrypt_##r, gxdestroy_##r, gxsetiv_##r, 0         \
 592   };                                                                    \
 593                                                                         \
 594   const gccipher xchacha##r = {                                         \
 595     "xchacha" #r, chacha_keysz,                                         \
 596     XCHACHA_NONCESZ, gxinit_##r                                         \
 597   };
 598
 599 CHACHA_VARS(DEFGXCIPHER)
 600
 601 /*----- Generic random number generator interface -------------------------*/
 602
 603 typedef struct grops {
 604   size_t noncesz;
 605   void (*seek)(void *, kludge64);
 606   kludge64 (*tell)(void *);
 607   void (*setnonce)(void *, const void *);
 608   void (*generate)(void *, void *, size_t);
 609 } grops;
 610
 611 typedef struct grbasectx {
 612   grand r;
 613   const grops *ops;
 614 } grbasectx;
 615
 616 static int grmisc(grand *r, unsigned op, ...)
 617 {
 618   octet buf[XCHACHA_NONCESZ];
 619   grbasectx *g = (grbasectx *)r;
 620   grand *rr;
 621   const octet *p;
 622   size_t sz;
 623   uint32 i;
 624   unsigned long ul;
 625   kludge64 pos;
 626   va_list ap;
 627   int rc = 0;
 628
 629   va_start(ap, op);
 630
 631   switch (op) {
 632     case GRAND_CHECK:
 633       switch (va_arg(ap, unsigned)) {
 634         case GRAND_CHECK:
 635         case GRAND_SEEDINT:
 636         case GRAND_SEEDUINT32:
 637         case GRAND_SEEDBLOCK:
 638         case GRAND_SEEDRAND:
 639         case CHACHA_SEEK:
 640         case CHACHA_SEEKU64:
 641         case CHACHA_TELL:
 642         case CHACHA_TELLU64:
 643           rc = 1;
 644           break;
 645         default:
 646           rc = 0;
 647           break;
 648       }
 649       break;
 650
 651     case GRAND_SEEDINT:
 652       i = va_arg(ap, unsigned); STORE32_L(buf, i);
 653       memset(buf + 4, 0, g->ops->noncesz - 4);
 654       g->ops->setnonce(g, buf);
 655       break;
 656     case GRAND_SEEDUINT32:
 657       i = va_arg(ap, uint32); STORE32_L(buf, i);
 658       memset(buf + 4, 0, g->ops->noncesz - 4);
 659       g->ops->setnonce(g, buf);
 660       break;
 661     case GRAND_SEEDBLOCK:
 662       p = va_arg(ap, const void *);
 663       sz = va_arg(ap, size_t);
 664       if (sz < g->ops->noncesz) {
 665         memcpy(buf, p, sz);
 666         memset(buf + sz, 0, g->ops->noncesz - sz);
 667         p = buf;
 668       }
 669       g->ops->setnonce(g, p);
 670       break;
 671     case GRAND_SEEDRAND:
 672       rr = va_arg(ap, grand *);
 673       rr->ops->fill(rr, buf, g->ops->noncesz);
 674       g->ops->setnonce(g, buf);
 675       break;
 676     case CHACHA_SEEK:
 677       ul = va_arg(ap, unsigned long); ASSIGN64(pos, ul);
 678       g->ops->seek(g, pos);
 679       break;
 680     case CHACHA_SEEKU64:
 681       pos = va_arg(ap, kludge64);
 682       g->ops->seek(g, pos);
 683       break;
 684     case CHACHA_TELL:
 685       pos = g->ops->tell(g);
 686       *va_arg(ap, unsigned long *) = GET64(unsigned long, pos);
 687       break;
 688     case CHACHA_TELLU64:
 689       *va_arg(ap, kludge64 *) = g->ops->tell(g);
 690       break;
 691     default:
 692       GRAND_BADOP;
 693       break;
 694   }
 695
 696   return (rc);
 697 }
 698
 699 static octet grbyte(grand *r)
 700 {
 701   grbasectx *g = (grbasectx *)r;
 702   octet o;
 703   g->ops->generate(g, &o, 1);
 704   return (o);
 705 }
 706
 707 static uint32 grword(grand *r)
 708 {
 709   grbasectx *g = (grbasectx *)r;
 710   octet b[4];
 711   g->ops->generate(g, b, sizeof(b));
 712   return (LOAD32_L(b));
 713 }
 714
 715 static void grfill(grand *r, void *p, size_t sz)
 716 {
 717   grbasectx *g = (grbasectx *)r;
 718   g->ops->generate(r, p, sz);
 719 }
 720
 721 typedef struct grctx {
 722   grbasectx r;
 723   chacha_ctx ctx;
 724 } grctx;
 725
 726 static void gr_seek(void *r, kludge64 pos)
 727   { grctx *g = r; chacha_seeku64(&g->ctx, pos); }
 728
 729 static void gr_seek_ietf(void *r, kludge64 pos)
 730   { grctx *g = r; chacha_seek_ietf(&g->ctx, LO64(pos)); }
 731
 732 static kludge64 gr_tell(void *r)
 733   { grctx *g = r; return (chacha_tellu64(&g->ctx)); }
 734
 735 static kludge64 gr_tell_ietf(void *r)
 736 {
 737   grctx *g = r;
 738   kludge64 pos;
 739
 740   SET64(pos, 0, chacha_tell_ietf(&g->ctx));
 741   return (pos);
 742 }
 743
 744 static void gr_setnonce(void *r, const void *n)
 745   { grctx *g = r; chacha_setnonce(&g->ctx, n); }
 746
 747 static void gr_setnonce_ietf(void *r, const void *n)
 748   { grctx *g = r; chacha_setnonce_ietf(&g->ctx, n); }
 749
 750 static void grdestroy(grand *r)
 751   { grctx *g = (grctx *)r; BURN(*g); S_DESTROY(g); }
 752
 753 static grand *grinit(const void *k, size_t ksz, const void *n,
 754                      const grand_ops *ops, const grops *myops)
 755 {
 756     grctx *g = S_CREATE(grctx);
 757     g->r.r.ops = ops;
 758     g->r.ops = myops;
 759     chacha_init(&g->ctx, k, ksz, 0);
 760     if (n) myops->setnonce(g, n);
 761     return (&g->r.r);
 762 }
 763
 764 #define DEFGRAND(rr)                                                    \
 765                                                                         \
 766   static void gr_generate_##rr(void *r, void *b, size_t sz)             \
 767     { grctx *g = r; CHACHA_ENCRYPT(rr, &g->ctx, 0, b, sz); }            \
 768                                                                         \
 769   static const grops grops_##rr =                                       \
 770     { CHACHA_NONCESZ, gr_seek, gr_tell,                                 \
 771       gr_setnonce, gr_generate_##rr };                                  \
 772                                                                         \
 773   static const grops grops_##rr##_ietf =                                \
 774     { CHACHA_IETF_NONCESZ, gr_seek_ietf, gr_tell_ietf,                  \
 775       gr_setnonce_ietf, gr_generate_##rr };                             \
 776                                                                         \
 777   static const grand_ops grops_rand_##rr = {                            \
 778     "chacha" #rr, GRAND_CRYPTO, 0,                                      \
 779     grmisc, grdestroy, grword,                                          \
 780     grbyte, grword, grand_defaultrange, grfill                          \
 781   };                                                                    \
 782                                                                         \
 783   static const grand_ops grops_rand_##rr##_ietf = {                     \
 784     "chacha" #rr "-ietf", GRAND_CRYPTO, 0,                              \
 785     grmisc, grdestroy, grword,                                          \
 786     grbyte, grword, grand_defaultrange, grfill                          \
 787   };                                                                    \
 788                                                                         \
 789   grand *chacha##rr##_rand(const void *k, size_t ksz, const void *n)    \
 790     { return (grinit(k, ksz, n, &grops_rand_##rr, &grops_##rr)); }      \
 791                                                                         \
 792   grand *chacha##rr##_ietf_rand(const void *k, size_t ksz,              \
 793                                 const void *n)                          \
 794   {                                                                     \
 795     return (grinit(k, ksz, n,                                           \
 796                    &grops_rand_##rr##_ietf,                             \
 797                    &grops_##rr##_ietf));                                \
 798   }
 799
 800 CHACHA_VARS(DEFGRAND)
 801
 802 #define DEFXGRAND(rr)                                                   \
 803                                                                         \
 804   typedef struct grxctx_##rr {                                          \
 805     grbasectx r;                                                        \
 806     XCHACHA_CTX(rr) ctx;                                                \
 807   } grxctx_##rr;                                                        \
 808                                                                         \
 809   static void grx_seek_##rr(void *r, kludge64 pos)                      \
 810     { grxctx_##rr *g = r; XCHACHA_SEEKU64(rr, &g->ctx, pos); }          \
 811                                                                         \
 812   static kludge64 grx_tell_##rr(void *r)                                \
 813     { grxctx_##rr *g = r; return (XCHACHA_TELLU64(rr, &g->ctx)); }      \
 814                                                                         \
 815   static void grx_setnonce_##rr(void *r, const void *n)                 \
 816     { grxctx_##rr *g = r; XCHACHA_SETNONCE(rr, &g->ctx, n); }           \
 817                                                                         \
 818   static void grxdestroy_##rr(grand *r)                                 \
 819     { grxctx_##rr *g = (grxctx_##rr *)r; BURN(*g); S_DESTROY(g); }      \
 820                                                                         \
 821   static void grx_generate_##rr(void *r, void *b, size_t sz)            \
 822     { grxctx_##rr *g = r; XCHACHA_ENCRYPT(rr, &g->ctx, 0, b, sz); }     \
 823                                                                         \
 824   static const grops grxops_##rr =                                      \
 825     { XCHACHA_NONCESZ, grx_seek_##rr, grx_tell_##rr,                    \
 826       grx_setnonce_##rr, grx_generate_##rr };                           \
 827                                                                         \
 828   static const grand_ops grxops_rand_##rr = {                           \
 829     "xchacha" #rr, GRAND_CRYPTO, 0,                                     \
 830     grmisc, grxdestroy_##rr, grword,                                    \
 831     grbyte, grword, grand_defaultrange, grfill                          \
 832   };                                                                    \
 833                                                                         \
 834   grand *xchacha##rr##_rand(const void *k, size_t ksz, const void *n)   \
 835   {                                                                     \
 836     grxctx_##rr *g = S_CREATE(grxctx_##rr);                             \
 837     g->r.r.ops = &grxops_rand_##rr;                                     \
 838     g->r.ops = &grxops_##rr;                                            \
 839     XCHACHA_INIT(rr, &g->ctx, k, ksz, n);                               \
 840     return (&g->r.r);                                                   \
 841   }
 842 CHACHA_VARS(DEFXGRAND)
 843
 844 /*----- Test rig ----------------------------------------------------------*/
 845
 846 #ifdef TEST_RIG
 847
 848 #include <stdio.h>
 849 #include <string.h>
 850
 851 #include <mLib/quis.h>
 852 #include <mLib/testrig.h>
 853
 854 #define DEFVCORE(r)                                                     \
 855   static int v_core_##r(dstr *v)                                        \
 856   {                                                                     \
 857     chacha_matrix a, b;                                                 \
 858     dstr d = DSTR_INIT;                                                 \
 859     int i, n;                                                           \
 860     int ok = 1;                                                         \
 861                                                                         \
 862     DENSURE(&d, CHACHA_OUTSZ); d.len = CHACHA_OUTSZ;                    \
 863     n = *(int *)v[0].buf;                                               \
 864     for (i = 0; i < CHACHA_OUTSZ/4; i++)                                \
 865       a[i] = LOAD32_L(v[1].buf + 4*i);                                  \
 866     for (i = 0; i < n; i++) {                                           \
 867       core(r, a, b);                                                    \
 868       memcpy(a, b, sizeof(a));                                          \
 869     }                                                                   \
 870     for (i = 0; i < CHACHA_OUTSZ/4; i++) STORE32_L(d.buf + 4*i, a[i]);  \
 871                                                                         \
 872     if (d.len != v[2].len || memcmp(d.buf, v[2].buf, v[2].len) != 0) {  \
 873       ok = 0;                                                           \
 874       printf("\nfail core:"                                             \
 875              "\n\titerations = %d"                                      \
 876              "\n\tin       = ", n);                                     \
 877       type_hex.dump(&v[1], stdout);                                     \
 878       printf("\n\texpected   = ");                                      \
 879       type_hex.dump(&v[2], stdout);                                     \
 880       printf("\n\tcalculated = ");                                      \
 881       type_hex.dump(&d, stdout);                                        \
 882       putchar('\n');                                                    \
 883     }                                                                   \
 884                                                                         \
 885     dstr_destroy(&d);                                                   \
 886     return (ok);                                                        \
 887   }
 888 CHACHA_VARS(DEFVCORE)
 889
 890 #define CHACHA_CTX(r) chacha_ctx
 891
 892 #define CHACHA_TESTSETUP(r, ctx, k, ksz, n, nsz, p, psz) do {           \
 893   kludge64 pos64;                                                       \
 894   chacha_init(ctx, k, ksz, 0);                                          \
 895   if (nsz == 8) chacha_setnonce(ctx, n);                                \
 896   else if (nsz == 12) chacha_setnonce_ietf(ctx, n);                     \
 897   if (psz == 8) { LOAD64_(pos64, p); chacha_seeku64(ctx, pos64); }      \
 898   else if (psz == 4) chacha_seek_ietf(ctx, LOAD32(p));                  \
 899 } while (0)
 900
 901 #define XCHACHA_TESTSETUP(r, ctx, k, ksz, n, nsz, p, psz) do {          \
 902   kludge64 pos64;                                                       \
 903   XCHACHA_INIT(r, ctx, k, ksz, 0);                                      \
 904   if (nsz == 24) XCHACHA_SETNONCE(r, ctx, n);                           \
 905   if (psz == 8) { LOAD64_(pos64, p); xchacha##r##_seeku64(ctx, pos64); } \
 906 } while (0)
 907
 908 #define DEFxVENC(base, BASE, r)                                         \
 909   static int v_encrypt_##base##_##r(dstr *v)                            \
 910   {                                                                     \
 911     BASE##_CTX(r) ctx;                                                  \
 912     dstr d = DSTR_INIT;                                                 \
 913     const octet *p, *p0;                                                \
 914     octet *q;                                                           \
 915     size_t sz, sz0, step;                                               \
 916     unsigned long skip;                                                 \
 917     int ok = 1;                                                         \
 918                                                                         \
 919     if (v[4].len) { p0 = (const octet *)v[4].buf; sz0 = v[4].len; }     \
 920     else { p0 = 0; sz0 = v[5].len; }                                    \
 921     DENSURE(&d, sz0); d.len = sz0;                                      \
 922     skip = *(unsigned long *)v[3].buf;                                  \
 923                                                                         \
 924     step = 0;                                                           \
 925     while (step < sz0 + skip) {                                         \
 926       step = step ? 3*step + 4 : 1;                                     \
 927       if (step > sz0 + skip) step = sz0 + skip;                         \
 928       BASE##_TESTSETUP(r, &ctx, v[0].buf, v[0].len,                     \
 929                        v[1].buf, v[1].len, v[2].buf, v[2].len);         \
 930                                                                         \
 931       for (sz = skip; sz >= step; sz -= step)                           \
 932         BASE##_ENCRYPT(r, &ctx, 0, 0, step);                            \
 933       if (sz) BASE##_ENCRYPT(r, &ctx, 0, 0, sz);                        \
 934       for (p = p0, q = (octet *)d.buf, sz = sz0;                        \
 935            sz >= step;                                                  \
 936            sz -= step, q += step) {                                     \
 937         BASE##_ENCRYPT(r, &ctx, p, q, step);                            \
 938         if (p) p += step;                                               \
 939       }                                                                 \
 940       if (sz) BASE##_ENCRYPT(r, &ctx, p, q, sz);                        \
 941                                                                         \
 942       if (d.len != v[5].len || memcmp(d.buf, v[5].buf, v[5].len) != 0) { \
 943         ok = 0;                                                         \
 944         printf("\nfail encrypt:"                                        \
 945                "\n\tstep           = %lu"                               \
 946                "\n\tkey    = ", (unsigned long)step);                   \
 947         type_hex.dump(&v[0], stdout);                                   \
 948         printf("\n\tnonce          = ");                                \
 949         type_hex.dump(&v[1], stdout);                                   \
 950         printf("\n\tposition   = ");                                    \
 951         type_hex.dump(&v[2], stdout);                                   \
 952         printf("\n\tskip           = %lu", skip);                       \
 953         printf("\n\tmessage    = ");                                    \
 954         type_hex.dump(&v[4], stdout);                                   \
 955         printf("\n\texpected   = ");                                    \
 956         type_hex.dump(&v[5], stdout);                                   \
 957         printf("\n\tcalculated = ");                                    \
 958         type_hex.dump(&d, stdout);                                      \
 959         putchar('\n');                                                  \
 960       }                                                                 \
 961     }                                                                   \
 962                                                                         \
 963     dstr_destroy(&d);                                                   \
 964     return (ok);                                                        \
 965   }
 966 #define DEFVENC(r) DEFxVENC(chacha, CHACHA, r)
 967 #define DEFXVENC(r) DEFxVENC(xchacha, XCHACHA, r)
 968 CHACHA_VARS(DEFVENC)
 969 CHACHA_VARS(DEFXVENC)
 970
 971 static test_chunk defs[] = {
 972 #define DEFxTAB(base, r)                                                \
 973   { #base #r, v_encrypt_##base##_##r,                                   \
 974     { &type_hex, &type_hex, &type_hex, &type_ulong,                     \
 975       &type_hex, &type_hex, 0 } },
 976 #define DEFTAB(r)                                                       \
 977   { "chacha" #r "-core", v_core_##r,                                    \
 978     { &type_int, &type_hex, &type_hex, 0 } },                           \
 979   DEFxTAB(chacha, r)
 980 #define DEFXTAB(r) DEFxTAB(xchacha, r)
 981 CHACHA_VARS(DEFTAB)
 982 CHACHA_VARS(DEFXTAB)
 983   { 0, 0, { 0 } }
 984 };
 985
 986 int main(int argc, char *argv[])
 987 {
 988   test_run(argc, argv, defs, SRCDIR"/t/chacha");
 989   return (0);
 990 }
 991
 992 #endif
 993
 994 /*----- That's all, folks -------------------------------------------------*/