Line data    Source code

       1             : // SPDX-License-Identifier: GPL-2.0-or-later
       2             : /*
       3             :  * The "hash function" used as the core of the ChaCha stream cipher (RFC7539)
       4             :  *
       5             :  * Copyright (C) 2015 Martin Willi
       6             :  */
       7             : 
       8             : #include <linux/bug.h>
       9             : #include <linux/kernel.h>
      10             : #include <linux/export.h>
      11             : #include <linux/bitops.h>
      12             : #include <linux/string.h>
      13             : #include <asm/unaligned.h>
      14             : #include <crypto/chacha.h>
      15             : 
      16         200 : static void chacha_permute(u32 *x, int nrounds)
      17             : {
      18             :         int i;
      19             : 
      20             :         /* whitelist the allowed round counts */
      21         200 :         WARN_ON_ONCE(nrounds != 20 && nrounds != 12);
      22             : 
      23        2000 :         for (i = 0; i < nrounds; i += 2) {
      24        4000 :                 x[0]  += x[4];    x[12] = rol32(x[12] ^ x[0],  16);
      25        4000 :                 x[1]  += x[5];    x[13] = rol32(x[13] ^ x[1],  16);
      26        4000 :                 x[2]  += x[6];    x[14] = rol32(x[14] ^ x[2],  16);
      27        4000 :                 x[3]  += x[7];    x[15] = rol32(x[15] ^ x[3],  16);
      28             : 
      29        4000 :                 x[8]  += x[12];   x[4]  = rol32(x[4]  ^ x[8],  12);
      30        4000 :                 x[9]  += x[13];   x[5]  = rol32(x[5]  ^ x[9],  12);
      31        4000 :                 x[10] += x[14];   x[6]  = rol32(x[6]  ^ x[10], 12);
      32        4000 :                 x[11] += x[15];   x[7]  = rol32(x[7]  ^ x[11], 12);
      33             : 
      34        4000 :                 x[0]  += x[4];    x[12] = rol32(x[12] ^ x[0],   8);
      35        4000 :                 x[1]  += x[5];    x[13] = rol32(x[13] ^ x[1],   8);
      36        4000 :                 x[2]  += x[6];    x[14] = rol32(x[14] ^ x[2],   8);
      37        4000 :                 x[3]  += x[7];    x[15] = rol32(x[15] ^ x[3],   8);
      38             : 
      39        4000 :                 x[8]  += x[12];   x[4]  = rol32(x[4]  ^ x[8],   7);
      40        4000 :                 x[9]  += x[13];   x[5]  = rol32(x[5]  ^ x[9],   7);
      41        4000 :                 x[10] += x[14];   x[6]  = rol32(x[6]  ^ x[10],  7);
      42        4000 :                 x[11] += x[15];   x[7]  = rol32(x[7]  ^ x[11],  7);
      43             : 
      44        4000 :                 x[0]  += x[5];    x[15] = rol32(x[15] ^ x[0],  16);
      45        4000 :                 x[1]  += x[6];    x[12] = rol32(x[12] ^ x[1],  16);
      46        4000 :                 x[2]  += x[7];    x[13] = rol32(x[13] ^ x[2],  16);
      47        4000 :                 x[3]  += x[4];    x[14] = rol32(x[14] ^ x[3],  16);
      48             : 
      49        4000 :                 x[10] += x[15];   x[5]  = rol32(x[5]  ^ x[10], 12);
      50        4000 :                 x[11] += x[12];   x[6]  = rol32(x[6]  ^ x[11], 12);
      51        4000 :                 x[8]  += x[13];   x[7]  = rol32(x[7]  ^ x[8],  12);
      52        4000 :                 x[9]  += x[14];   x[4]  = rol32(x[4]  ^ x[9],  12);
      53             : 
      54        4000 :                 x[0]  += x[5];    x[15] = rol32(x[15] ^ x[0],   8);
      55        4000 :                 x[1]  += x[6];    x[12] = rol32(x[12] ^ x[1],   8);
      56        4000 :                 x[2]  += x[7];    x[13] = rol32(x[13] ^ x[2],   8);
      57        4000 :                 x[3]  += x[4];    x[14] = rol32(x[14] ^ x[3],   8);
      58             : 
      59        4000 :                 x[10] += x[15];   x[5]  = rol32(x[5]  ^ x[10],  7);
      60        4000 :                 x[11] += x[12];   x[6]  = rol32(x[6]  ^ x[11],  7);
      61        4000 :                 x[8]  += x[13];   x[7]  = rol32(x[7]  ^ x[8],   7);
      62        4000 :                 x[9]  += x[14];   x[4]  = rol32(x[4]  ^ x[9],   7);
      63             :         }
      64         200 : }
      65             : 
      66             : /**
      67             :  * chacha_block_generic - generate one keystream block and increment block counter
      68             :  * @state: input state matrix (16 32-bit words)
      69             :  * @stream: output keystream block (64 bytes)
      70             :  * @nrounds: number of rounds (20 or 12; 20 is recommended)
      71             :  *
      72             :  * This is the ChaCha core, a function from 64-byte strings to 64-byte strings.
      73             :  * The caller has already converted the endianness of the input.  This function
      74             :  * also handles incrementing the block counter in the input matrix.
      75             :  */
      76         200 : void chacha_block_generic(u32 *state, u8 *stream, int nrounds)
      77             : {
      78             :         u32 x[16];
      79             :         int i;
      80             : 
      81         200 :         memcpy(x, state, 64);
      82             : 
      83         200 :         chacha_permute(x, nrounds);
      84             : 
      85        3400 :         for (i = 0; i < ARRAY_SIZE(x); i++)
      86        6400 :                 put_unaligned_le32(x[i] + state[i], &stream[i * sizeof(u32)]);
      87             : 
      88         200 :         state[12]++;
      89         200 : }
      90             : EXPORT_SYMBOL(chacha_block_generic);
      91             : 
      92             : /**
      93             :  * hchacha_block_generic - abbreviated ChaCha core, for XChaCha
      94             :  * @state: input state matrix (16 32-bit words)
      95             :  * @stream: output (8 32-bit words)
      96             :  * @nrounds: number of rounds (20 or 12; 20 is recommended)
      97             :  *
      98             :  * HChaCha is the ChaCha equivalent of HSalsa and is an intermediate step
      99             :  * towards XChaCha (see https://cr.yp.to/snuffle/xsalsa-20081128.pdf).  HChaCha
     100             :  * skips the final addition of the initial state, and outputs only certain words
     101             :  * of the state.  It should not be used for streaming directly.
     102             :  */
     103           0 : void hchacha_block_generic(const u32 *state, u32 *stream, int nrounds)
     104             : {
     105             :         u32 x[16];
     106             : 
     107           0 :         memcpy(x, state, 64);
     108             : 
     109           0 :         chacha_permute(x, nrounds);
     110             : 
     111           0 :         memcpy(&stream[0], &x[0], 16);
     112           0 :         memcpy(&stream[4], &x[12], 16);
     113           0 : }
     114             : EXPORT_SYMBOL(hchacha_block_generic);