]>
git.ipfire.org Git - thirdparty/openssl.git/blob - crypto/chacha/chacha_enc.c
1 /* ====================================================================
2 * Copyright (c) 2011-2013 The OpenSSL Project. All rights reserved.
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in
13 * the documentation and/or other materials provided with the
16 * 3. All advertising materials mentioning features or use of this
17 * software must display the following acknowledgment:
18 * "This product includes software developed by the OpenSSL Project
19 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
21 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
22 * endorse or promote products derived from this software without
23 * prior written permission. For written permission, please contact
24 * licensing@OpenSSL.org.
26 * 5. Products derived from this software may not be called "OpenSSL"
27 * nor may "OpenSSL" appear in their names without prior written
28 * permission of the OpenSSL Project.
30 * 6. Redistributions of any form whatsoever must retain the following
32 * "This product includes software developed by the OpenSSL Project
33 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
35 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
36 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
37 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
38 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
39 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
40 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
41 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
42 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
43 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
44 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
45 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
46 * OF THE POSSIBILITY OF SUCH DAMAGE.
47 * ====================================================================
50 /* Adapted from the public domain code by D. Bernstein from SUPERCOP. */
54 #include "internal/chacha.h"
56 typedef unsigned int u32
;
57 typedef unsigned char u8
;
63 # define ROTATE(v, n) (((v) << (n)) | ((v) >> (32 - (n))))
65 # define U32TO8_LITTLE(p, v) do { \
66 (p)[0] = (u8)(v >> 0); \
67 (p)[1] = (u8)(v >> 8); \
68 (p)[2] = (u8)(v >> 16); \
69 (p)[3] = (u8)(v >> 24); \
72 /* QUARTERROUND updates a, b, c, d with a ChaCha "quarter" round. */
73 # define QUARTERROUND(a,b,c,d) ( \
74 x[a] += x[b], x[d] = ROTATE((x[d] ^ x[a]),16), \
75 x[c] += x[d], x[b] = ROTATE((x[b] ^ x[c]),12), \
76 x[a] += x[b], x[d] = ROTATE((x[d] ^ x[a]), 8), \
77 x[c] += x[d], x[b] = ROTATE((x[b] ^ x[c]), 7) )
79 /* chacha_core performs 20 rounds of ChaCha on the input words in
80 * |input| and writes the 64 output bytes to |output|. */
81 static void chacha20_core(chacha_buf
*output
, const u32 input
[16])
90 memcpy(x
, input
, sizeof(x
));
92 for (i
= 20; i
> 0; i
-= 2) {
93 QUARTERROUND(0, 4, 8, 12);
94 QUARTERROUND(1, 5, 9, 13);
95 QUARTERROUND(2, 6, 10, 14);
96 QUARTERROUND(3, 7, 11, 15);
97 QUARTERROUND(0, 5, 10, 15);
98 QUARTERROUND(1, 6, 11, 12);
99 QUARTERROUND(2, 7, 8, 13);
100 QUARTERROUND(3, 4, 9, 14);
103 if (is_endian
.little
) {
104 for (i
= 0; i
< 16; ++i
)
105 output
->u
[i
] = x
[i
] + input
[i
];
107 for (i
= 0; i
< 16; ++i
)
108 U32TO8_LITTLE(output
->c
+ 4 * i
, (x
[i
] + input
[i
]));
112 void ChaCha20_ctr32(unsigned char *out
, const unsigned char *inp
,
113 size_t len
, const unsigned int key
[8],
114 const unsigned int counter
[4])
120 /* sigma constant "expand 32-byte k" in little-endian encoding */
121 input
[0] = ((u32
)'e') | ((u32
)'x'<<8) | ((u32
)'p'<<16) | ((u32
)'a'<<24);
122 input
[1] = ((u32
)'n') | ((u32
)'d'<<8) | ((u32
)' '<<16) | ((u32
)'3'<<24);
123 input
[2] = ((u32
)'2') | ((u32
)'-'<<8) | ((u32
)'b'<<16) | ((u32
)'y'<<24);
124 input
[3] = ((u32
)'t') | ((u32
)'e'<<8) | ((u32
)' '<<16) | ((u32
)'k'<<24);
135 input
[12] = counter
[0];
136 input
[13] = counter
[1];
137 input
[14] = counter
[2];
138 input
[15] = counter
[3];
145 chacha20_core(&buf
, input
);
147 for (i
= 0; i
< todo
; i
++)
148 out
[i
] = inp
[i
] ^ buf
.c
[i
];
153 /* advance counter */
154 if (++input
[12] == 0)