chacha.c 3.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * The "hash function" used as the core of the ChaCha stream cipher (RFC7539)
  4. *
  5. * Copyright (C) 2015 Martin Willi
  6. */
  7. #include <linux/bug.h>
  8. #include <linux/kernel.h>
  9. #include <linux/export.h>
  10. #include <linux/bitops.h>
  11. #include <linux/string.h>
  12. #include <asm/unaligned.h>
  13. #include <crypto/chacha.h>
  14. static void chacha_permute(u32 *x, int nrounds)
  15. {
  16. int i;
  17. /* whitelist the allowed round counts */
  18. WARN_ON_ONCE(nrounds != 20 && nrounds != 12);
  19. for (i = 0; i < nrounds; i += 2) {
  20. x[0] += x[4]; x[12] = rol32(x[12] ^ x[0], 16);
  21. x[1] += x[5]; x[13] = rol32(x[13] ^ x[1], 16);
  22. x[2] += x[6]; x[14] = rol32(x[14] ^ x[2], 16);
  23. x[3] += x[7]; x[15] = rol32(x[15] ^ x[3], 16);
  24. x[8] += x[12]; x[4] = rol32(x[4] ^ x[8], 12);
  25. x[9] += x[13]; x[5] = rol32(x[5] ^ x[9], 12);
  26. x[10] += x[14]; x[6] = rol32(x[6] ^ x[10], 12);
  27. x[11] += x[15]; x[7] = rol32(x[7] ^ x[11], 12);
  28. x[0] += x[4]; x[12] = rol32(x[12] ^ x[0], 8);
  29. x[1] += x[5]; x[13] = rol32(x[13] ^ x[1], 8);
  30. x[2] += x[6]; x[14] = rol32(x[14] ^ x[2], 8);
  31. x[3] += x[7]; x[15] = rol32(x[15] ^ x[3], 8);
  32. x[8] += x[12]; x[4] = rol32(x[4] ^ x[8], 7);
  33. x[9] += x[13]; x[5] = rol32(x[5] ^ x[9], 7);
  34. x[10] += x[14]; x[6] = rol32(x[6] ^ x[10], 7);
  35. x[11] += x[15]; x[7] = rol32(x[7] ^ x[11], 7);
  36. x[0] += x[5]; x[15] = rol32(x[15] ^ x[0], 16);
  37. x[1] += x[6]; x[12] = rol32(x[12] ^ x[1], 16);
  38. x[2] += x[7]; x[13] = rol32(x[13] ^ x[2], 16);
  39. x[3] += x[4]; x[14] = rol32(x[14] ^ x[3], 16);
  40. x[10] += x[15]; x[5] = rol32(x[5] ^ x[10], 12);
  41. x[11] += x[12]; x[6] = rol32(x[6] ^ x[11], 12);
  42. x[8] += x[13]; x[7] = rol32(x[7] ^ x[8], 12);
  43. x[9] += x[14]; x[4] = rol32(x[4] ^ x[9], 12);
  44. x[0] += x[5]; x[15] = rol32(x[15] ^ x[0], 8);
  45. x[1] += x[6]; x[12] = rol32(x[12] ^ x[1], 8);
  46. x[2] += x[7]; x[13] = rol32(x[13] ^ x[2], 8);
  47. x[3] += x[4]; x[14] = rol32(x[14] ^ x[3], 8);
  48. x[10] += x[15]; x[5] = rol32(x[5] ^ x[10], 7);
  49. x[11] += x[12]; x[6] = rol32(x[6] ^ x[11], 7);
  50. x[8] += x[13]; x[7] = rol32(x[7] ^ x[8], 7);
  51. x[9] += x[14]; x[4] = rol32(x[4] ^ x[9], 7);
  52. }
  53. }
  54. /**
  55. * chacha_block - generate one keystream block and increment block counter
  56. * @state: input state matrix (16 32-bit words)
  57. * @stream: output keystream block (64 bytes)
  58. * @nrounds: number of rounds (20 or 12; 20 is recommended)
  59. *
  60. * This is the ChaCha core, a function from 64-byte strings to 64-byte strings.
  61. * The caller has already converted the endianness of the input. This function
  62. * also handles incrementing the block counter in the input matrix.
  63. */
  64. void chacha_block_generic(u32 *state, u8 *stream, int nrounds)
  65. {
  66. u32 x[16];
  67. int i;
  68. memcpy(x, state, 64);
  69. chacha_permute(x, nrounds);
  70. for (i = 0; i < ARRAY_SIZE(x); i++)
  71. put_unaligned_le32(x[i] + state[i], &stream[i * sizeof(u32)]);
  72. state[12]++;
  73. }
  74. EXPORT_SYMBOL(chacha_block_generic);
  75. /**
  76. * hchacha_block_generic - abbreviated ChaCha core, for XChaCha
  77. * @state: input state matrix (16 32-bit words)
  78. * @out: output (8 32-bit words)
  79. * @nrounds: number of rounds (20 or 12; 20 is recommended)
  80. *
  81. * HChaCha is the ChaCha equivalent of HSalsa and is an intermediate step
  82. * towards XChaCha (see https://cr.yp.to/snuffle/xsalsa-20081128.pdf). HChaCha
  83. * skips the final addition of the initial state, and outputs only certain words
  84. * of the state. It should not be used for streaming directly.
  85. */
  86. void hchacha_block_generic(const u32 *state, u32 *stream, int nrounds)
  87. {
  88. u32 x[16];
  89. memcpy(x, state, 64);
  90. chacha_permute(x, nrounds);
  91. memcpy(&stream[0], &x[0], 16);
  92. memcpy(&stream[4], &x[12], 16);
  93. }
  94. EXPORT_SYMBOL(hchacha_block_generic);