1 /* LibTomCrypt, modular cryptographic library -- Tom St Denis */
2 /* SPDX-License-Identifier: Unlicense */
3
4 /* The implementation is based on:
5 * chacha-ref.c version 20080118
6 * Public domain from D. J. Bernstein
7 */
8
9 #include "tomcrypt_private.h"
10
11 #ifdef LTC_CHACHA
12
13 #define QUARTERROUND(a,b,c,d) \
14 x[a] += x[b]; x[d] = ROL(x[d] ^ x[a], 16); \
15 x[c] += x[d]; x[b] = ROL(x[b] ^ x[c], 12); \
16 x[a] += x[b]; x[d] = ROL(x[d] ^ x[a], 8); \
17 x[c] += x[d]; x[b] = ROL(x[b] ^ x[c], 7);
18
s_chacha_block(unsigned char * output,const ulong32 * input,int rounds)19 static void s_chacha_block(unsigned char *output, const ulong32 *input, int rounds)
20 {
21 ulong32 x[16];
22 int i;
23 XMEMCPY(x, input, sizeof(x));
24 for (i = rounds; i > 0; i -= 2) {
25 QUARTERROUND(0, 4, 8,12)
26 QUARTERROUND(1, 5, 9,13)
27 QUARTERROUND(2, 6,10,14)
28 QUARTERROUND(3, 7,11,15)
29 QUARTERROUND(0, 5,10,15)
30 QUARTERROUND(1, 6,11,12)
31 QUARTERROUND(2, 7, 8,13)
32 QUARTERROUND(3, 4, 9,14)
33 }
34 for (i = 0; i < 16; ++i) {
35 x[i] += input[i];
36 STORE32L(x[i], output + 4 * i);
37 }
38 }
39
40 /**
41 Encrypt (or decrypt) bytes of ciphertext (or plaintext) with ChaCha
42 @param st The ChaCha state
43 @param in The plaintext (or ciphertext)
44 @param inlen The length of the input (octets)
45 @param out [out] The ciphertext (or plaintext), length inlen
46 @return CRYPT_OK if successful
47 */
chacha_crypt(chacha_state * st,const unsigned char * in,unsigned long inlen,unsigned char * out)48 int chacha_crypt(chacha_state *st, const unsigned char *in, unsigned long inlen, unsigned char *out)
49 {
50 unsigned char buf[64];
51 unsigned long i, j;
52
53 if (inlen == 0) return CRYPT_OK; /* nothing to do */
54
55 LTC_ARGCHK(st != NULL);
56 LTC_ARGCHK(in != NULL);
57 LTC_ARGCHK(out != NULL);
58 LTC_ARGCHK(st->ivlen != 0);
59
60 if (st->ksleft > 0) {
61 j = MIN(st->ksleft, inlen);
62 for (i = 0; i < j; ++i, st->ksleft--) out[i] = in[i] ^ st->kstream[64 - st->ksleft];
63 inlen -= j;
64 if (inlen == 0) return CRYPT_OK;
65 out += j;
66 in += j;
67 }
68 for (;;) {
69 s_chacha_block(buf, st->input, st->rounds);
70 if (st->ivlen == 8) {
71 /* IV-64bit, increment 64bit counter */
72 if (0 == ++st->input[12] && 0 == ++st->input[13]) return CRYPT_OVERFLOW;
73 }
74 else {
75 /* IV-96bit, increment 32bit counter */
76 if (0 == ++st->input[12]) return CRYPT_OVERFLOW;
77 }
78 if (inlen <= 64) {
79 for (i = 0; i < inlen; ++i) out[i] = in[i] ^ buf[i];
80 st->ksleft = 64 - inlen;
81 for (i = inlen; i < 64; ++i) st->kstream[i] = buf[i];
82 return CRYPT_OK;
83 }
84 for (i = 0; i < 64; ++i) out[i] = in[i] ^ buf[i];
85 inlen -= 64;
86 out += 64;
87 in += 64;
88 }
89 }
90
91 #endif
92