chiark - git - mdw - catacomb/blob - symm/chacha.c

   1 /* -*-c-*-
   2  *
   3  * ChaCha stream cipher
   4  *
   5  * (c) 2015 Straylight/Edgeware
   6  */
   7
   8 /*----- Licensing notice --------------------------------------------------*
   9  *
  10  * This file is part of Catacomb.
  11  *
  12  * Catacomb is free software; you can redistribute it and/or modify
  13  * it under the terms of the GNU Library General Public License as
  14  * published by the Free Software Foundation; either version 2 of the
  15  * License, or (at your option) any later version.
  16  *
  17  * Catacomb is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU Library General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU Library General Public
  23  * License along with Catacomb; if not, write to the Free
  24  * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
  25  * MA 02111-1307, USA.
  26  */
  27
  28 /*----- Header files ------------------------------------------------------*/
  29
  30 #include "config.h"
  31
  32 #include <stdarg.h>
  33
  34 #include <mLib/bits.h>
  35
  36 #include "arena.h"
  37 #include "chacha.h"
  38 #include "chacha-core.h"
  39 #include "dispatch.h"
  40 #include "gcipher.h"
  41 #include "grand.h"
  42 #include "keysz.h"
  43 #include "paranoia.h"
  44 #include "rsvr.h"
  45
  46 /*----- Global variables --------------------------------------------------*/
  47
  48 const octet chacha_keysz[] = { KSZ_SET, 32, 16, 10, 0 };
  49
  50 /*----- The ChaCha core function and utilities ----------------------------*/
  51
  52 /* --- @core@ --- *
  53  *
  54  * Arguments:   @unsigned r@ = number of rounds
  55  *              @const chacha_matrix src@ = input matrix
  56  *              @chacha_matrix dest@ = where to put the output
  57  *
  58  * Returns:     ---
  59  *
  60  *
  61  * Use:         Apply the ChaCha/r core function to @src@, writing the
  62  *              result to @dest@.  This consists of @r@ rounds followed by
  63  *              the feedforward step.
  64  */
  65
  66 CPU_DISPATCH(static, (void), void, core,
  67              (unsigned r, const chacha_matrix src, chacha_matrix dest),
  68              (r, src, dest), pick_core, simple_core);
  69
  70 static void simple_core(unsigned r, const chacha_matrix src,
  71                         chacha_matrix dest)
  72   { CHACHA_nR(dest, src, r); CHACHA_FFWD(dest, src); }
  73
  74 #if CPUFAM_X86 || CPUFAM_AMD64
  75 extern core__functype chacha_core_x86ish_sse2;
  76 extern core__functype chacha_core_x86ish_avx;
  77 #endif
  78
  79 #if CPUFAM_ARMEL
  80 extern core__functype chacha_core_arm_neon;
  81 #endif
  82
  83 #if CPUFAM_ARM64
  84 extern core__functype chacha_core_arm64;
  85 #endif
  86
  87 static core__functype *pick_core(void)
  88 {
  89 #if CPUFAM_X86 || CPUFAM_AMD64
  90   DISPATCH_PICK_COND(chacha_core, chacha_core_x86ish_avx,
  91                      cpu_feature_p(CPUFEAT_X86_AVX));
  92   DISPATCH_PICK_COND(chacha_core, chacha_core_x86ish_sse2,
  93                      cpu_feature_p(CPUFEAT_X86_SSE2));
  94 #endif
  95 #if CPUFAM_ARMEL
  96   DISPATCH_PICK_COND(chacha_core, chacha_core_arm_neon,
  97                      cpu_feature_p(CPUFEAT_ARM_NEON));
  98 #endif
  99 #if CPUFAM_ARM64
 100   DISPATCH_PICK_COND(chacha_core, chacha_core_arm64,
 101                      cpu_feature_p(CPUFEAT_ARM_NEON));
 102 #endif
 103   DISPATCH_PICK_FALLBACK(chacha_core, simple_core);
 104 }
 105
 106 /* --- @populate@ --- *
 107  *
 108  * Arguments:   @chacha_matrix a@ = a matrix to fill in
 109  *              @const void *key@ = pointer to key material
 110  *              @size_t ksz@ = size of key
 111  *
 112  * Returns:     ---
 113  *
 114  * Use:         Fills in a ChaCha matrix from the key, setting the
 115  *              appropriate constants according to the key length.  The nonce
 116  *              and position words are left uninitialized.
 117  */
 118
 119 static void populate(chacha_matrix a, const void *key, size_t ksz)
 120 {
 121   const octet *k = key;
 122
 123   KSZ_ASSERT(chacha, ksz);
 124
 125   a[ 4] = LOAD32_L(k +  0);
 126   a[ 5] = LOAD32_L(k +  4);
 127   if (ksz == 10) {
 128     a[ 6] = LOAD16_L(k +  8);
 129     a[ 7] = 0;
 130   } else {
 131     a[ 6] = LOAD32_L(k +  8);
 132     a[ 7] = LOAD32_L(k + 12);
 133   }
 134   if (ksz <= 16) {
 135     a[ 8] = a[ 4];
 136     a[ 9] = a[ 5];
 137     a[10] = a[ 6];
 138     a[11] = a[ 7];
 139     a[ 0] = CHACHA_A128;
 140     a[ 1] = CHACHA_B128;
 141     a[ 2] = ksz == 10 ? CHACHA_C80 : CHACHA_C128;
 142     a[ 3] = CHACHA_D128;
 143   } else {
 144     a[ 8] = LOAD32_L(k + 16);
 145     a[ 9] = LOAD32_L(k + 20);
 146     a[10] = LOAD32_L(k + 24);
 147     a[11] = LOAD32_L(k + 28);
 148     a[ 0] = CHACHA_A256;
 149     a[ 1] = CHACHA_B256;
 150     a[ 2] = CHACHA_C256;
 151     a[ 3] = CHACHA_D256;
 152   }
 153 }
 154
 155 /*----- ChaCha implementation ---------------------------------------------*/
 156
 157 static const octet zerononce[XCHACHA_NONCESZ];
 158
 159 /* --- @chacha_init@ --- *
 160  *
 161  * Arguments:   @chacha_ctx *ctx@ = context to fill in
 162  *              @const void *key@ = pointer to key material
 163  *              @size_t ksz@ = size of key (either 32 or 16)
 164  *              @const void *nonce@ = initial nonce, or null
 165  *
 166  * Returns:     ---
 167  *
 168  * Use:         Initializes a ChaCha context ready for use.
 169  */
 170
 171 void chacha_init(chacha_ctx *ctx, const void *key, size_t ksz,
 172                   const void *nonce)
 173 {
 174   populate(ctx->a, key, ksz);
 175   chacha_setnonce(ctx, nonce ? nonce : zerononce);
 176 }
 177
 178 /* --- @chacha_setnonce{,_ietf}@ --- *
 179  *
 180  * Arguments:   @chacha_ctx *ctx@ = pointer to context
 181  *              @const void *nonce@ = the nonce (@CHACHA_NONCESZ@ or
 182  *                      @CHACHA_IETF_NONCESZ@ bytes)
 183  *
 184  * Returns:     ---
 185  *
 186  * Use:         Set a new nonce in the context @ctx@, e.g., for processing a
 187  *              different message.  The stream position is reset to zero (see
 188  *              @chacha_seek@ etc.).
 189  */
 190
 191 void chacha_setnonce(chacha_ctx *ctx, const void *nonce)
 192 {
 193   const octet *n = nonce;
 194
 195   ctx->a[14] = LOAD32_L(n + 0);
 196   ctx->a[15] = LOAD32_L(n + 4);
 197   chacha_seek(ctx, 0);
 198 }
 199
 200 void chacha_setnonce_ietf(chacha_ctx *ctx, const void *nonce)
 201 {
 202   const octet *n = nonce;
 203
 204   ctx->a[13] = LOAD32_L(n + 0);
 205   ctx->a[14] = LOAD32_L(n + 4);
 206   ctx->a[15] = LOAD32_L(n + 8);
 207   chacha_seek_ietf(ctx, 0);
 208 }
 209
 210 /* --- @chacha_seek{,u64,_ietf}@ --- *
 211  *
 212  * Arguments:   @chacha_ctx *ctx@ = pointer to context
 213  *              @unsigned long i@, @kludge64 i@, @uint32 i@ = new position
 214  *
 215  * Returns:     ---
 216  *
 217  * Use:         Sets a new stream position, in units of Chacha output
 218  *              blocks, which are @CHACHA_OUTSZ@ bytes each.  Byte
 219  *              granularity can be achieved by calling @chachaR_encrypt@
 220  *              appropriately.
 221  */
 222
 223 void chacha_seek(chacha_ctx *ctx, unsigned long i)
 224   { kludge64 ii; ASSIGN64(ii, i); chacha_seeku64(ctx, ii); }
 225
 226 void chacha_seeku64(chacha_ctx *ctx, kludge64 i)
 227 {
 228   ctx->a[12] = LO64(i); ctx->a[13] = HI64(i);
 229   ctx->off = CHACHA_OUTSZ;
 230 }
 231
 232 void chacha_seek_ietf(chacha_ctx *ctx, uint32 i)
 233   { ctx->a[12] = i; }
 234
 235 /* --- @chacha_tell{,u64,_ietf}@ --- *
 236  *
 237  * Arguments:   @chacha_ctx *ctx@ = pointer to context
 238  *
 239  * Returns:     The current position in the output stream, in blocks,
 240  *              rounding upwards.
 241  */
 242
 243 unsigned long chacha_tell(chacha_ctx *ctx)
 244   { kludge64 i = chacha_tellu64(ctx); return (GET64(unsigned long, i)); }
 245
 246 kludge64 chacha_tellu64(chacha_ctx *ctx)
 247   { kludge64 i; SET64(i, ctx->a[13], ctx->a[12]); return (i); }
 248
 249 uint32 chacha_tell_ietf(chacha_ctx *ctx)
 250   { return (ctx->a[12]); }
 251
 252 /* --- @chacha{20,12,8}_encrypt@ --- *
 253  *
 254  * Arguments:   @chacha_ctx *ctx@ = pointer to context
 255  *              @const void *src@ = source buffer (or null)
 256  *              @void *dest@ = destination buffer (or null)
 257  *              @size_t sz@ = size of the buffers
 258  *
 259  * Returns:     ---
 260  *
 261  * Use:         Encrypts or decrypts @sz@ bytes of data from @src@ to @dest@.
 262  *              ChaCha works by XORing plaintext with a keystream, so
 263  *              encryption and decryption are the same operation.  If @dest@
 264  *              is null then ignore @src@ and skip @sz@ bytes of the
 265  *              keystream.  If @src@ is null, then just write the keystream
 266  *              to @dest@.
 267  */
 268
 269 static const rsvr_policy policy = { 0, CHACHA_OUTSZ, CHACHA_OUTSZ };
 270
 271 #define CHACHA_ENCRYPT(r, ctx, src, dest, sz)                           \
 272   chacha##r##_encrypt(ctx, src, dest, sz)
 273 #define DEFENCRYPT(r)                                                   \
 274   void CHACHA_ENCRYPT(r, chacha_ctx *ctx, const void *src,              \
 275                       void *dest, size_t sz)                            \
 276   {                                                                     \
 277     chacha_matrix b;                                                    \
 278     const octet *s = src;                                               \
 279     octet *d = dest;                                                    \
 280     rsvr_plan plan;                                                     \
 281     kludge64 pos, delta;                                                \
 282                                                                         \
 283     rsvr_mkplan(&plan, &policy, ctx->off, sz);                          \
 284                                                                         \
 285     if (plan.head) {                                                    \
 286       if (!ctx->off) {                                                  \
 287         core(r, ctx->a, b); CHACHA_STEP(ctx->a);                        \
 288         SALSA20_PREPBUF(ctx, b);                                        \
 289       }                                                                 \
 290       SALSA20_OUTBUF(ctx, d, s, plan.head);                             \
 291     }                                                                   \
 292                                                                         \
 293     ctx->off -= plan.from_rsvr;                                         \
 294                                                                         \
 295     if (!d) {                                                           \
 296       if (plan.from_input) {                                            \
 297         pos = chacha_tellu64(ctx);                                      \
 298         ASSIGN64(delta, plan.from_input/SALSA20_OUTSZ);                 \
 299         ADD64(pos, pos, delta);                                         \
 300         chacha_seeku64(ctx, pos);                                       \
 301       }                                                                 \
 302     } else if (!s) while (plan.from_input) {                            \
 303       core(r, ctx->a, b); CHACHA_STEP(ctx->a);                          \
 304       SALSA20_GENFULL(b, d); plan.from_input -= CHACHA_OUTSZ;           \
 305     } else while (plan.from_input) {                                    \
 306       core(r, ctx->a, b); CHACHA_STEP(ctx->a);                          \
 307       SALSA20_MIXFULL(b, d, s); plan.from_input -= CHACHA_OUTSZ;        \
 308     }                                                                   \
 309                                                                         \
 310     if (plan.tail) {                                                    \
 311       core(r, ctx->a, b); CHACHA_STEP(ctx->a);                          \
 312       SALSA20_PREPBUF(ctx, b);                                          \
 313       SALSA20_OUTBUF(ctx, d, s, plan.tail);                             \
 314     }                                                                   \
 315   }
 316 CHACHA_VARS(DEFENCRYPT)
 317
 318 /*----- HChaCha implementation --------------------------------------------*/
 319
 320 #define HCHACHA_RAW(r, ctx, src, dest) hchacha##r##_raw(ctx, src, dest)
 321 #define HCHACHA_PRF(r, ctx, src, dest) hchacha##r##_prf(ctx, src, dest)
 322
 323 /* --- @hchacha{20,12,8}_prf@ --- *
 324  *
 325  * Arguments:   @chacha_ctx *ctx@ = pointer to context
 326  *              @const void *src@ = the input (@HCHACHA_INSZ@ bytes)
 327  *              @void *dest@ = the output (@HCHACHA_OUTSZ@ bytes)
 328  *
 329  * Returns:     ---
 330  *
 331  * Use:         Apply the HChacha/r pseudorandom function to @src@, writing
 332  *              the result to @out@.
 333  */
 334
 335 #define DEFHCHACHA(r)                                                   \
 336   static void HCHACHA_RAW(r, chacha_matrix k,                           \
 337                           const uint32 *src, uint32 *dest)              \
 338   {                                                                     \
 339     chacha_matrix a;                                                    \
 340     int i;                                                              \
 341                                                                         \
 342     /* --- HChaCha, computed from full ChaCha --- *                     \
 343      *                                                                  \
 344      * The security proof makes use of the fact that HChaCha (i.e.,     \
 345      * without the final feedforward step) can be computed from full    \
 346      * ChaCha using only knowledge of the non-secret input.  I don't    \
 347      * want to compromise the performance of the main function by       \
 348      * making the feedforward step separate, but this operation is less \
 349      * speed critical, so we do it the harder way.                      \
 350      */                                                                 \
 351                                                                         \
 352     for (i = 0; i < 4; i++) k[12 + i] = src[i];                         \
 353     core(r, k, a);                                                      \
 354     for (i = 0; i < 8; i++) dest[i] = a[(i + 4)^4] - k[(i + 4)^4];      \
 355   }                                                                     \
 356                                                                         \
 357   void HCHACHA_PRF(r, chacha_ctx *ctx, const void *src, void *dest)     \
 358   {                                                                     \
 359     const octet *s = src;                                               \
 360     octet *d = dest;                                                    \
 361     uint32 in[4], out[8];                                               \
 362     int i;                                                              \
 363                                                                         \
 364     for (i = 0; i < 4; i++) in[i] = LOAD32_L(s + 4*i);                  \
 365     HCHACHA_RAW(r, ctx->a, in, out);                                    \
 366     for (i = 0; i < 8; i++) STORE32_L(d + 4*i, out[i]);                 \
 367   }
 368 CHACHA_VARS(DEFHCHACHA)
 369
 370 /*----- XChaCha implementation -------------------------------------------*/
 371
 372 /* --- Some convenient macros for naming functions --- *
 373  *
 374  * Because the crypto core is involved in XChaCha/r's per-nonce setup, we
 375  * need to take an interest in the number of rounds in most of the various
 376  * functions, and it will probably help if we distinguish the context
 377  * structures for the various versions.
 378  */
 379
 380 #define XCHACHA_CTX(r) xchacha##r##_ctx
 381 #define XCHACHA_INIT(r, ctx, k, ksz, n) xchacha##r##_init(ctx, k, ksz, n)
 382 #define XCHACHA_SETNONCE(r, ctx, n) xchacha##r##_setnonce(ctx, n)
 383 #define XCHACHA_SEEK(r, ctx, i) xchacha##r##_seek(ctx, i)
 384 #define XCHACHA_SEEKU64(r, ctx, i) xchacha##r##_seeku64(ctx, i)
 385 #define XCHACHA_TELL(r, ctx) xchacha##r##_tell(ctx)
 386 #define XCHACHA_TELLU64(r, ctx) xchacha##r##_tellu64(ctx)
 387 #define XCHACHA_ENCRYPT(r, ctx, src, dest, sz)                          \
 388   xchacha##r##_encrypt(ctx, src, dest, sz)
 389
 390 /* --- @xchacha{20,12,8}_init@ --- *
 391  *
 392  * Arguments:   @xchachaR_ctx *ctx@ = the context to fill in
 393  *              @const void *key@ = pointer to key material
 394  *              @size_t ksz@ = size of key (either 32 or 16)
 395  *              @const void *nonce@ = initial nonce, or null
 396  *
 397  * Returns:     ---
 398  *
 399  * Use:         Initializes an XChaCha/r context ready for use.
 400  *
 401  *              There is a different function for each number of rounds,
 402  *              unlike for plain ChaCha.
 403  */
 404
 405 #define DEFXINIT(r)                                                     \
 406   void XCHACHA_INIT(r, XCHACHA_CTX(r) *ctx,                             \
 407                     const void *key, size_t ksz, const void *nonce)     \
 408   {                                                                     \
 409     populate(ctx->k, key, ksz);                                         \
 410     ctx->s.a[ 0] = CHACHA_A256;                                         \
 411     ctx->s.a[ 1] = CHACHA_B256;                                         \
 412     ctx->s.a[ 2] = CHACHA_C256;                                         \
 413     ctx->s.a[ 3] = CHACHA_D256;                                         \
 414     XCHACHA_SETNONCE(r, ctx, nonce ? nonce : zerononce);                \
 415   }
 416 CHACHA_VARS(DEFXINIT)
 417
 418 /* --- @xchacha{20,12,8}_setnonce@ --- *
 419  *
 420  * Arguments:   @xchachaR_ctx *ctx@ = pointer to context
 421  *              @const void *nonce@ = the nonce (@XCHACHA_NONCESZ@ bytes)
 422  *
 423  * Returns:     ---
 424  *
 425  * Use:         Set a new nonce in the context @ctx@, e.g., for processing a
 426  *              different message.  The stream position is reset to zero (see
 427  *              @chacha_seek@ etc.).
 428  *
 429  *              There is a different function for each number of rounds,
 430  *              unlike for plain ChaCha.
 431  */
 432
 433 #define DEFXNONCE(r)                                                    \
 434   void XCHACHA_SETNONCE(r, XCHACHA_CTX(r) *ctx, const void *nonce)      \
 435   {                                                                     \
 436     const octet *n = nonce;                                             \
 437     uint32 in[4];                                                       \
 438     int i;                                                              \
 439                                                                         \
 440     for (i = 0; i < 4; i++) in[i] = LOAD32_L(n + 4*i);                  \
 441     HCHACHA_RAW(r, ctx->k, in, ctx->s.a + 4);                           \
 442     chacha_setnonce(&ctx->s, n + 16);                                   \
 443   }
 444 CHACHA_VARS(DEFXNONCE)
 445
 446 /* --- @xchacha{20,12,8}_seek{,u64}@ --- *
 447  *
 448  * Arguments:   @xchachaR_ctx *ctx@ = pointer to context
 449  *              @unsigned long i@, @kludge64 i@ = new position to set
 450  *
 451  * Returns:     ---
 452  *
 453  * Use:         Sets a new stream position, in units of ChaCha output
 454  *              blocks, which are @XCHACHA_OUTSZ@ bytes each.  Byte
 455  *              granularity can be achieved by calling @xchachaR_encrypt@
 456  *              appropriately.
 457  *
 458  *              There is a different function for each number of rounds,
 459  *              unlike for plain ChaCha, because the context structures are
 460  *              different.
 461  */
 462
 463 /* --- @xchacha{20,12,8}_tell{,u64}@ --- *
 464  *
 465  * Arguments:   @chacha_ctx *ctx@ = pointer to context
 466  *
 467  * Returns:     The current position in the output stream, in blocks,
 468  *              rounding upwards.
 469  *
 470  *              There is a different function for each number of rounds,
 471  *              unlike for plain ChaCha, because the context structures are
 472  *              different.
 473  */
 474
 475 /* --- @xchacha{20,12,8}_encrypt@ --- *
 476  *
 477  * Arguments:   @xchachaR_ctx *ctx@ = pointer to context
 478  *              @const void *src@ = source buffer (or null)
 479  *              @void *dest@ = destination buffer (or null)
 480  *              @size_t sz@ = size of the buffers
 481  *
 482  * Returns:     ---
 483  *
 484  * Use:         Encrypts or decrypts @sz@ bytes of data from @src@ to @dest@.
 485  *              XChaCha works by XORing plaintext with a keystream, so
 486  *              encryption and decryption are the same operation.  If @dest@
 487  *              is null then ignore @src@ and skip @sz@ bytes of the
 488  *              keystream.  If @src@ is null, then just write the keystream
 489  *              to @dest@.
 490  */
 491
 492 #define DEFXPASSTHRU(r)                                                 \
 493   void XCHACHA_SEEK(r, XCHACHA_CTX(r) *ctx, unsigned long i)            \
 494     { chacha_seek(&ctx->s, i); }                                        \
 495   void XCHACHA_SEEKU64(r, XCHACHA_CTX(r) *ctx, kludge64 i)              \
 496     { chacha_seeku64(&ctx->s, i); }                                     \
 497   unsigned long XCHACHA_TELL(r, XCHACHA_CTX(r) *ctx)                    \
 498     { return chacha_tell(&ctx->s); }                                    \
 499   kludge64 XCHACHA_TELLU64(r, XCHACHA_CTX(r) *ctx)                      \
 500     { return chacha_tellu64(&ctx->s); }                                 \
 501   void XCHACHA_ENCRYPT(r, XCHACHA_CTX(r) *ctx,                          \
 502                         const void *src, void *dest, size_t sz)         \
 503     { CHACHA_ENCRYPT(r, &ctx->s, src, dest, sz); }
 504 CHACHA_VARS(DEFXPASSTHRU)
 505
 506 /*----- Generic cipher interface ------------------------------------------*/
 507
 508 typedef struct gctx { gcipher c; chacha_ctx ctx; } gctx;
 509
 510 static void gsetiv(gcipher *c, const void *iv)
 511   { gctx *g = (gctx *)c; chacha_setnonce(&g->ctx, iv); }
 512
 513 static void gsetiv_ietf(gcipher *c, const void *iv)
 514   { gctx *g = (gctx *)c; chacha_setnonce_ietf(&g->ctx, iv); }
 515
 516 static void gdestroy(gcipher *c)
 517   { gctx *g = (gctx *)c; BURN(*g); S_DESTROY(g); }
 518
 519 static gcipher *ginit(const void *k, size_t sz, const gcipher_ops *ops)
 520 {
 521   gctx *g = S_CREATE(gctx);
 522   g->c.ops = ops;
 523   chacha_init(&g->ctx, k, sz, 0);
 524   return (&g->c);
 525 }
 526
 527 #define DEFGCIPHER(r)                                                   \
 528                                                                         \
 529   static const gcipher_ops gops_##r, gops_##r##_ietf;                   \
 530                                                                         \
 531   static gcipher *ginit_##r(const void *k, size_t sz)                   \
 532     { return (ginit(k, sz, &gops_##r)); }                               \
 533                                                                         \
 534   static gcipher *ginit_##r##_ietf(const void *k, size_t sz)            \
 535     { return (ginit(k, sz, &gops_##r##_ietf)); }                        \
 536                                                                         \
 537   static void gencrypt_##r(gcipher *c, const void *s,                   \
 538                            void *t, size_t sz)                          \
 539     { gctx *g = (gctx *)c; CHACHA_ENCRYPT(r, &g->ctx, s, t, sz); }      \
 540                                                                         \
 541   static const gcipher_ops gops_##r = {                                 \
 542     &chacha##r,                                                         \
 543     gencrypt_##r, gencrypt_##r, gdestroy, gsetiv, 0                     \
 544   };                                                                    \
 545                                                                         \
 546   static const gcipher_ops gops_##r##_ietf = {                          \
 547     &chacha##r##_ietf,                                                  \
 548     gencrypt_##r, gencrypt_##r, gdestroy, gsetiv_ietf, 0                \
 549   };                                                                    \
 550                                                                         \
 551   const gccipher chacha##r = {                                          \
 552     "chacha" #r, chacha_keysz,                                          \
 553     CHACHA_NONCESZ, ginit_##r                                           \
 554   };                                                                    \
 555                                                                         \
 556   const gccipher chacha##r##_ietf = {                                   \
 557     "chacha" #r "-ietf", chacha_keysz,                                  \
 558     CHACHA_IETF_NONCESZ, ginit_##r##_ietf                               \
 559   };
 560
 561 CHACHA_VARS(DEFGCIPHER)
 562
 563 #define DEFGXCIPHER(r)                                                  \
 564                                                                         \
 565   typedef struct { gcipher c; XCHACHA_CTX(r) ctx; } gxctx_##r;          \
 566                                                                         \
 567   static void gxsetiv_##r(gcipher *c, const void *iv)                   \
 568     { gxctx_##r *g = (gxctx_##r *)c; XCHACHA_SETNONCE(r, &g->ctx, iv); } \
 569                                                                         \
 570   static void gxdestroy_##r(gcipher *c)                                 \
 571     { gxctx_##r *g = (gxctx_##r *)c; BURN(*g); S_DESTROY(g); }          \
 572                                                                         \
 573   static const gcipher_ops gxops_##r;                                   \
 574                                                                         \
 575   static gcipher *gxinit_##r(const void *k, size_t sz)                  \
 576   {                                                                     \
 577     gxctx_##r *g = S_CREATE(gxctx_##r);                                 \
 578     g->c.ops = &gxops_##r;                                              \
 579     XCHACHA_INIT(r, &g->ctx, k, sz, 0);                                 \
 580     return (&g->c);                                                     \
 581   }                                                                     \
 582                                                                         \
 583   static void gxencrypt_##r(gcipher *c, const void *s,                  \
 584                             void *t, size_t sz)                         \
 585   {                                                                     \
 586     gxctx_##r *g = (gxctx_##r *)c;                                      \
 587     XCHACHA_ENCRYPT(r, &g->ctx, s, t, sz);                              \
 588   }                                                                     \
 589                                                                         \
 590   static const gcipher_ops gxops_##r = {                                \
 591     &xchacha##r,                                                        \
 592     gxencrypt_##r, gxencrypt_##r, gxdestroy_##r, gxsetiv_##r, 0         \
 593   };                                                                    \
 594                                                                         \
 595   const gccipher xchacha##r = {                                         \
 596     "xchacha" #r, chacha_keysz,                                         \
 597     XCHACHA_NONCESZ, gxinit_##r                                         \
 598   };
 599
 600 CHACHA_VARS(DEFGXCIPHER)
 601
 602 /*----- Generic random number generator interface -------------------------*/
 603
 604 typedef struct grops {
 605   size_t noncesz;
 606   void (*seek)(void *, kludge64);
 607   kludge64 (*tell)(void *);
 608   void (*setnonce)(void *, const void *);
 609   void (*generate)(void *, void *, size_t);
 610 } grops;
 611
 612 typedef struct grbasectx {
 613   grand r;
 614   const grops *ops;
 615 } grbasectx;
 616
 617 static int grmisc(grand *r, unsigned op, ...)
 618 {
 619   octet buf[XCHACHA_NONCESZ];
 620   grbasectx *g = (grbasectx *)r;
 621   grand *rr;
 622   const octet *p;
 623   size_t sz;
 624   uint32 i;
 625   unsigned long ul;
 626   kludge64 pos;
 627   va_list ap;
 628   int rc = 0;
 629
 630   va_start(ap, op);
 631
 632   switch (op) {
 633     case GRAND_CHECK:
 634       switch (va_arg(ap, unsigned)) {
 635         case GRAND_CHECK:
 636         case GRAND_SEEDINT:
 637         case GRAND_SEEDUINT32:
 638         case GRAND_SEEDBLOCK:
 639         case GRAND_SEEDRAND:
 640         case CHACHA_SEEK:
 641         case CHACHA_SEEKU64:
 642         case CHACHA_TELL:
 643         case CHACHA_TELLU64:
 644           rc = 1;
 645           break;
 646         default:
 647           rc = 0;
 648           break;
 649       }
 650       break;
 651
 652     case GRAND_SEEDINT:
 653       i = va_arg(ap, unsigned); STORE32_L(buf, i);
 654       memset(buf + 4, 0, g->ops->noncesz - 4);
 655       g->ops->setnonce(g, buf);
 656       break;
 657     case GRAND_SEEDUINT32:
 658       i = va_arg(ap, uint32); STORE32_L(buf, i);
 659       memset(buf + 4, 0, g->ops->noncesz - 4);
 660       g->ops->setnonce(g, buf);
 661       break;
 662     case GRAND_SEEDBLOCK:
 663       p = va_arg(ap, const void *);
 664       sz = va_arg(ap, size_t);
 665       if (sz < g->ops->noncesz) {
 666         memcpy(buf, p, sz);
 667         memset(buf + sz, 0, g->ops->noncesz - sz);
 668         p = buf;
 669       }
 670       g->ops->setnonce(g, p);
 671       break;
 672     case GRAND_SEEDRAND:
 673       rr = va_arg(ap, grand *);
 674       rr->ops->fill(rr, buf, g->ops->noncesz);
 675       g->ops->setnonce(g, buf);
 676       break;
 677     case CHACHA_SEEK:
 678       ul = va_arg(ap, unsigned long); ASSIGN64(pos, ul);
 679       g->ops->seek(g, pos);
 680       break;
 681     case CHACHA_SEEKU64:
 682       pos = va_arg(ap, kludge64);
 683       g->ops->seek(g, pos);
 684       break;
 685     case CHACHA_TELL:
 686       pos = g->ops->tell(g);
 687       *va_arg(ap, unsigned long *) = GET64(unsigned long, pos);
 688       break;
 689     case CHACHA_TELLU64:
 690       *va_arg(ap, kludge64 *) = g->ops->tell(g);
 691       break;
 692     default:
 693       GRAND_BADOP;
 694       break;
 695   }
 696
 697   return (rc);
 698 }
 699
 700 static octet grbyte(grand *r)
 701 {
 702   grbasectx *g = (grbasectx *)r;
 703   octet o;
 704   g->ops->generate(g, &o, 1);
 705   return (o);
 706 }
 707
 708 static uint32 grword(grand *r)
 709 {
 710   grbasectx *g = (grbasectx *)r;
 711   octet b[4];
 712   g->ops->generate(g, b, sizeof(b));
 713   return (LOAD32_L(b));
 714 }
 715
 716 static void grfill(grand *r, void *p, size_t sz)
 717 {
 718   grbasectx *g = (grbasectx *)r;
 719   g->ops->generate(r, p, sz);
 720 }
 721
 722 typedef struct grctx {
 723   grbasectx r;
 724   chacha_ctx ctx;
 725 } grctx;
 726
 727 static void gr_seek(void *r, kludge64 pos)
 728   { grctx *g = r; chacha_seeku64(&g->ctx, pos); }
 729
 730 static void gr_seek_ietf(void *r, kludge64 pos)
 731   { grctx *g = r; chacha_seek_ietf(&g->ctx, LO64(pos)); }
 732
 733 static kludge64 gr_tell(void *r)
 734   { grctx *g = r; return (chacha_tellu64(&g->ctx)); }
 735
 736 static kludge64 gr_tell_ietf(void *r)
 737 {
 738   grctx *g = r;
 739   kludge64 pos;
 740
 741   SET64(pos, 0, chacha_tell_ietf(&g->ctx));
 742   return (pos);
 743 }
 744
 745 static void gr_setnonce(void *r, const void *n)
 746   { grctx *g = r; chacha_setnonce(&g->ctx, n); }
 747
 748 static void gr_setnonce_ietf(void *r, const void *n)
 749   { grctx *g = r; chacha_setnonce_ietf(&g->ctx, n); }
 750
 751 static void grdestroy(grand *r)
 752   { grctx *g = (grctx *)r; BURN(*g); S_DESTROY(g); }
 753
 754 static grand *grinit(const void *k, size_t ksz, const void *n,
 755                      const grand_ops *ops, const grops *myops)
 756 {
 757     grctx *g = S_CREATE(grctx);
 758     g->r.r.ops = ops;
 759     g->r.ops = myops;
 760     chacha_init(&g->ctx, k, ksz, 0);
 761     if (n) myops->setnonce(g, n);
 762     return (&g->r.r);
 763 }
 764
 765 #define DEFGRAND(rr)                                                    \
 766                                                                         \
 767   static void gr_generate_##rr(void *r, void *b, size_t sz)             \
 768     { grctx *g = r; CHACHA_ENCRYPT(rr, &g->ctx, 0, b, sz); }            \
 769                                                                         \
 770   static const grops grops_##rr =                                       \
 771     { CHACHA_NONCESZ, gr_seek, gr_tell,                                 \
 772       gr_setnonce, gr_generate_##rr };                                  \
 773                                                                         \
 774   static const grops grops_##rr##_ietf =                                \
 775     { CHACHA_IETF_NONCESZ, gr_seek_ietf, gr_tell_ietf,                  \
 776       gr_setnonce_ietf, gr_generate_##rr };                             \
 777                                                                         \
 778   static const grand_ops grops_rand_##rr = {                            \
 779     "chacha" #rr, GRAND_CRYPTO, 0,                                      \
 780     grmisc, grdestroy, grword,                                          \
 781     grbyte, grword, grand_defaultrange, grfill                          \
 782   };                                                                    \
 783                                                                         \
 784   static const grand_ops grops_rand_##rr##_ietf = {                     \
 785     "chacha" #rr "-ietf", GRAND_CRYPTO, 0,                              \
 786     grmisc, grdestroy, grword,                                          \
 787     grbyte, grword, grand_defaultrange, grfill                          \
 788   };                                                                    \
 789                                                                         \
 790   grand *chacha##rr##_rand(const void *k, size_t ksz, const void *n)    \
 791     { return (grinit(k, ksz, n, &grops_rand_##rr, &grops_##rr)); }      \
 792                                                                         \
 793   grand *chacha##rr##_ietf_rand(const void *k, size_t ksz,              \
 794                                 const void *n)                          \
 795   {                                                                     \
 796     return (grinit(k, ksz, n,                                           \
 797                    &grops_rand_##rr##_ietf,                             \
 798                    &grops_##rr##_ietf));                                \
 799   }
 800
 801 CHACHA_VARS(DEFGRAND)
 802
 803 #define DEFXGRAND(rr)                                                   \
 804                                                                         \
 805   typedef struct grxctx_##rr {                                          \
 806     grbasectx r;                                                        \
 807     XCHACHA_CTX(rr) ctx;                                                \
 808   } grxctx_##rr;                                                        \
 809                                                                         \
 810   static void grx_seek_##rr(void *r, kludge64 pos)                      \
 811     { grxctx_##rr *g = r; XCHACHA_SEEKU64(rr, &g->ctx, pos); }          \
 812                                                                         \
 813   static kludge64 grx_tell_##rr(void *r)                                \
 814     { grxctx_##rr *g = r; return (XCHACHA_TELLU64(rr, &g->ctx)); }      \
 815                                                                         \
 816   static void grx_setnonce_##rr(void *r, const void *n)                 \
 817     { grxctx_##rr *g = r; XCHACHA_SETNONCE(rr, &g->ctx, n); }           \
 818                                                                         \
 819   static void grxdestroy_##rr(grand *r)                                 \
 820     { grxctx_##rr *g = (grxctx_##rr *)r; BURN(*g); S_DESTROY(g); }      \
 821                                                                         \
 822   static void grx_generate_##rr(void *r, void *b, size_t sz)            \
 823     { grxctx_##rr *g = r; XCHACHA_ENCRYPT(rr, &g->ctx, 0, b, sz); }     \
 824                                                                         \
 825   static const grops grxops_##rr =                                      \
 826     { XCHACHA_NONCESZ, grx_seek_##rr, grx_tell_##rr,                    \
 827       grx_setnonce_##rr, grx_generate_##rr };                           \
 828                                                                         \
 829   static const grand_ops grxops_rand_##rr = {                           \
 830     "xchacha" #rr, GRAND_CRYPTO, 0,                                     \
 831     grmisc, grxdestroy_##rr, grword,                                    \
 832     grbyte, grword, grand_defaultrange, grfill                          \
 833   };                                                                    \
 834                                                                         \
 835   grand *xchacha##rr##_rand(const void *k, size_t ksz, const void *n)   \
 836   {                                                                     \
 837     grxctx_##rr *g = S_CREATE(grxctx_##rr);                             \
 838     g->r.r.ops = &grxops_rand_##rr;                                     \
 839     g->r.ops = &grxops_##rr;                                            \
 840     XCHACHA_INIT(rr, &g->ctx, k, ksz, n);                               \
 841     return (&g->r.r);                                                   \
 842   }
 843 CHACHA_VARS(DEFXGRAND)
 844
 845 /*----- Test rig ----------------------------------------------------------*/
 846
 847 #ifdef TEST_RIG
 848
 849 #include <stdio.h>
 850 #include <string.h>
 851
 852 #include <mLib/quis.h>
 853 #include <mLib/testrig.h>
 854
 855 #define DEFVCORE(r)                                                     \
 856   static int v_core_##r(dstr *v)                                        \
 857   {                                                                     \
 858     chacha_matrix a, b;                                                 \
 859     dstr d = DSTR_INIT;                                                 \
 860     int i, n;                                                           \
 861     int ok = 1;                                                         \
 862                                                                         \
 863     DENSURE(&d, CHACHA_OUTSZ); d.len = CHACHA_OUTSZ;                    \
 864     n = *(int *)v[0].buf;                                               \
 865     for (i = 0; i < CHACHA_OUTSZ/4; i++)                                \
 866       a[i] = LOAD32_L(v[1].buf + 4*i);                                  \
 867     for (i = 0; i < n; i++) {                                           \
 868       core(r, a, b);                                                    \
 869       memcpy(a, b, sizeof(a));                                          \
 870     }                                                                   \
 871     for (i = 0; i < CHACHA_OUTSZ/4; i++) STORE32_L(d.buf + 4*i, a[i]);  \
 872                                                                         \
 873     if (d.len != v[2].len || memcmp(d.buf, v[2].buf, v[2].len) != 0) {  \
 874       ok = 0;                                                           \
 875       printf("\nfail core:"                                             \
 876              "\n\titerations = %d"                                      \
 877              "\n\tin       = ", n);                                     \
 878       type_hex.dump(&v[1], stdout);                                     \
 879       printf("\n\texpected   = ");                                      \
 880       type_hex.dump(&v[2], stdout);                                     \
 881       printf("\n\tcalculated = ");                                      \
 882       type_hex.dump(&d, stdout);                                        \
 883       putchar('\n');                                                    \
 884     }                                                                   \
 885                                                                         \
 886     dstr_destroy(&d);                                                   \
 887     return (ok);                                                        \
 888   }
 889 CHACHA_VARS(DEFVCORE)
 890
 891 #define CHACHA_CTX(r) chacha_ctx
 892
 893 #define CHACHA_TESTSETUP(r, ctx, k, ksz, n, nsz, p, psz) do {           \
 894   kludge64 pos64;                                                       \
 895   chacha_init(ctx, k, ksz, 0);                                          \
 896   if (nsz == 8) chacha_setnonce(ctx, n);                                \
 897   else if (nsz == 12) chacha_setnonce_ietf(ctx, n);                     \
 898   if (psz == 8) { LOAD64_(pos64, p); chacha_seeku64(ctx, pos64); }      \
 899   else if (psz == 4) chacha_seek_ietf(ctx, LOAD32(p));                  \
 900 } while (0)
 901
 902 #define XCHACHA_TESTSETUP(r, ctx, k, ksz, n, nsz, p, psz) do {          \
 903   kludge64 pos64;                                                       \
 904   XCHACHA_INIT(r, ctx, k, ksz, 0);                                      \
 905   if (nsz == 24) XCHACHA_SETNONCE(r, ctx, n);                           \
 906   if (psz == 8) { LOAD64_(pos64, p); xchacha##r##_seeku64(ctx, pos64); } \
 907 } while (0)
 908
 909 #define DEFxVENC(base, BASE, r)                                         \
 910   static int v_encrypt_##base##_##r(dstr *v)                            \
 911   {                                                                     \
 912     BASE##_CTX(r) ctx;                                                  \
 913     dstr d = DSTR_INIT;                                                 \
 914     const octet *p, *p0;                                                \
 915     octet *q;                                                           \
 916     size_t sz, sz0, step;                                               \
 917     unsigned long skip;                                                 \
 918     int ok = 1;                                                         \
 919                                                                         \
 920     if (v[4].len) { p0 = (const octet *)v[4].buf; sz0 = v[4].len; }     \
 921     else { p0 = 0; sz0 = v[5].len; }                                    \
 922     DENSURE(&d, sz0); d.len = sz0;                                      \
 923     skip = *(unsigned long *)v[3].buf;                                  \
 924                                                                         \
 925     step = 0;                                                           \
 926     while (step < sz0 + skip) {                                         \
 927       step = step ? 3*step + 4 : 1;                                     \
 928       if (step > sz0 + skip) step = sz0 + skip;                         \
 929       BASE##_TESTSETUP(r, &ctx, v[0].buf, v[0].len,                     \
 930                        v[1].buf, v[1].len, v[2].buf, v[2].len);         \
 931                                                                         \
 932       for (sz = skip; sz >= step; sz -= step)                           \
 933         BASE##_ENCRYPT(r, &ctx, 0, 0, step);                            \
 934       if (sz) BASE##_ENCRYPT(r, &ctx, 0, 0, sz);                        \
 935       for (p = p0, q = (octet *)d.buf, sz = sz0;                        \
 936            sz >= step;                                                  \
 937            sz -= step, q += step) {                                     \
 938         BASE##_ENCRYPT(r, &ctx, p, q, step);                            \
 939         if (p) p += step;                                               \
 940       }                                                                 \
 941       if (sz) BASE##_ENCRYPT(r, &ctx, p, q, sz);                        \
 942                                                                         \
 943       if (d.len != v[5].len || memcmp(d.buf, v[5].buf, v[5].len) != 0) { \
 944         ok = 0;                                                         \
 945         printf("\nfail encrypt:"                                        \
 946                "\n\tstep           = %lu"                               \
 947                "\n\tkey    = ", (unsigned long)step);                   \
 948         type_hex.dump(&v[0], stdout);                                   \
 949         printf("\n\tnonce          = ");                                \
 950         type_hex.dump(&v[1], stdout);                                   \
 951         printf("\n\tposition   = ");                                    \
 952         type_hex.dump(&v[2], stdout);                                   \
 953         printf("\n\tskip           = %lu", skip);                       \
 954         printf("\n\tmessage    = ");                                    \
 955         type_hex.dump(&v[4], stdout);                                   \
 956         printf("\n\texpected   = ");                                    \
 957         type_hex.dump(&v[5], stdout);                                   \
 958         printf("\n\tcalculated = ");                                    \
 959         type_hex.dump(&d, stdout);                                      \
 960         putchar('\n');                                                  \
 961       }                                                                 \
 962     }                                                                   \
 963                                                                         \
 964     dstr_destroy(&d);                                                   \
 965     return (ok);                                                        \
 966   }
 967 #define DEFVENC(r) DEFxVENC(chacha, CHACHA, r)
 968 #define DEFXVENC(r) DEFxVENC(xchacha, XCHACHA, r)
 969 CHACHA_VARS(DEFVENC)
 970 CHACHA_VARS(DEFXVENC)
 971
 972 static test_chunk defs[] = {
 973 #define DEFxTAB(base, r)                                                \
 974   { #base #r, v_encrypt_##base##_##r,                                   \
 975     { &type_hex, &type_hex, &type_hex, &type_ulong,                     \
 976       &type_hex, &type_hex, 0 } },
 977 #define DEFTAB(r)                                                       \
 978   { "chacha" #r "-core", v_core_##r,                                    \
 979     { &type_int, &type_hex, &type_hex, 0 } },                           \
 980   DEFxTAB(chacha, r)
 981 #define DEFXTAB(r) DEFxTAB(xchacha, r)
 982 CHACHA_VARS(DEFTAB)
 983 CHACHA_VARS(DEFXTAB)
 984   { 0, 0, { 0 } }
 985 };
 986
 987 int main(int argc, char *argv[])
 988 {
 989   test_run(argc, argv, defs, SRCDIR"/t/chacha");
 990   return (0);
 991 }
 992
 993 #endif
 994
 995 /*----- That's all, folks -------------------------------------------------*/