From 847f3a0cf54ac6aaafaeda7f6c6a4422e2f14700 Mon Sep 17 00:00:00 2001 From: cinap_lenrek Date: Thu, 22 Oct 2015 07:48:26 +0200 Subject: [PATCH] libsec: add chacha cipher (from charles forsyth) --- sys/include/libsec.h | 31 ++++++ sys/man/2/chacha | 93 ++++++++++++++++ sys/src/libsec/port/chacha.c | 175 +++++++++++++++++++++++++++++++ sys/src/libsec/port/chachatest.c | 70 +++++++++++++ sys/src/libsec/port/mkfile | 1 + 5 files changed, 370 insertions(+) create mode 100644 sys/man/2/chacha create mode 100644 sys/src/libsec/port/chacha.c create mode 100644 sys/src/libsec/port/chachatest.c diff --git a/sys/include/libsec.h b/sys/include/libsec.h index 127395bef..359a8aa61 100644 --- a/sys/include/libsec.h +++ b/sys/include/libsec.h @@ -70,6 +70,37 @@ void bfCBCdecrypt(uchar*, int, BFstate*); void bfECBencrypt(uchar*, int, BFstate*); void bfECBdecrypt(uchar*, int, BFstate*); +/* + * Chacha definitions + */ + +enum +{ + ChachaBsize= 64, + ChachaKeylen= 256/8, + ChachaIVlen= 96/8, +}; + +typedef struct Chachastate Chachastate; +struct Chachastate +{ + union{ + u32int input[16]; + struct { + u32int constant[4]; + u32int key[8]; + u32int counter; + u32int iv[3]; + }; + }; + int rounds; +}; + +void setupChachastate(Chachastate*, uchar*, ulong, uchar*, int); +void chacha_setblock(Chachastate*, u32int); +void chacha_encrypt(uchar*, ulong, Chachastate*); +void chacha_encrypt2(uchar*, uchar*, ulong, Chachastate*); + /* * DES definitions */ diff --git a/sys/man/2/chacha b/sys/man/2/chacha new file mode 100644 index 000000000..de07d133d --- /dev/null +++ b/sys/man/2/chacha @@ -0,0 +1,93 @@ +.TH CHACHA 2 +.SH NAME +setupChachastate, chacha_setblock, chacha_encrypt, chacha_encrypt2 - chacha encryption +.SH SYNOPSIS +.B #include +.br +.B #include +.br +.B #include +.br +.B #include +.PP +.B +void setupChachastate(Chachastate *s, uchar key[], ulong keylen, uchar *nonce, int rounds) +.PP +.B +void chacha_encrypt(uchar *data, ulong len, Chachastate *s) +.PP +.B +void chacha_encrypt2(uchar *src, uchar *dst, ulong len, Chachastate *s) +.PP +.B +void chacha_setblock(Chachastate *s, u32int blockno) +.SH DESCRIPTION +.PP +Chacha is D J Berstein's symmetric stream cipher, as modified by RFC7539. It supports +keys of 256 bits (128 bits is supported here for special purposes). It has an underlying block size of 64 bytes +(named as constant +.BR ChachaBsize ). +.PP +.I SetupChachastate +takes a reference to a +.B Chachastate +structure, a +.I key +of +.I keylen +bytes, which should normally be +.BR ChachaKeylen , +a +.I nonce +or initialisation vector of +.B ChachaIVlen +bytes (set to all zeros if the argument is nil), +and the number of +.I rounds +(set to the default of 20 if the argument is zero). +With a keylength of 256 bits (32 bytes) and 20 +.IR rounds , +the function implements the Chacha20 encryption function of RFC7539. +.PP +.I Chacha_encrypt +encrypts +.I len +bytes of +.I buf +in place using the +.B Chachastate +in +.IR s . +.I Len +can be any byte length. +Encryption and decryption are the same operation given the same starting state +.IR s . +.PP +.I Chacha_encrypt2 +is similar, but encrypts +.I len +bytes of +.I src +into +.I dst +without modifying +.IR src . +.PP +.I Chacha_setblock +sets the Chacha block counter for the next encryption to +.IR blockno , +allowing seeking in an encrypted stream. +.SH SOURCE +.B /sys/src/libsec +.SH SEE ALSO +.IR mp (2), +.IR aes (2), +.IR blowfish (2), +.IR des (2), +.IR dsa (2), +.IR elgamal (2), +.IR rc4 (2), +.IR rsa (2), +.IR sechash (2), +.IR prime (2), +.IR rand (2) diff --git a/sys/src/libsec/port/chacha.c b/sys/src/libsec/port/chacha.c new file mode 100644 index 000000000..e075c15e5 --- /dev/null +++ b/sys/src/libsec/port/chacha.c @@ -0,0 +1,175 @@ +/* +Adapted from chacha-merged.c version 20080118 +D. J. Bernstein +Public domain. + +modified for use in Plan 9 and Inferno (no algorithmic changes), +and including the changes to block number and nonce defined in RFC7539 +*/ + +#include +#include +#include + +enum{ + Blockwords= ChachaBsize/sizeof(u32int) +}; + +/* little-endian data order */ +#define GET4(p) ((((((p)[3]<<8) | (p)[2])<<8) | (p)[1])<<8 | (p)[0]) +#define PUT4(p, v) (((p)[0]=v), (v>>=8), ((p)[1]=v), (v>>=8), ((p)[2]=v), (v>>=8), ((p)[3]=v)) + +#define ROTATE(v,c) ((u32int)((v) << (c)) | ((v) >> (32 - (c)))) + +#define QUARTERROUND(ia,ib,ic,id) { \ + u32int a, b, c, d, t;\ + a = x[ia]; b = x[ib]; c = x[ic]; d = x[id]; \ + a += b; t = d^a; d = ROTATE(t,16); \ + c += d; t = b^c; b = ROTATE(t,12); \ + a += b; t = d^a; d = ROTATE(t, 8); \ + c += d; t = b^c; b = ROTATE(t, 7); \ + x[ia] = a; x[ib] = b; x[ic] = c; x[id] = d; \ +} + +#define ENCRYPT(s, x, y, d) {\ + u32int v; \ + uchar *sp, *dp; \ + sp = (s); \ + v = GET4(sp); \ + v ^= (x)+(y); \ + dp = (d); \ + PUT4(dp, v); \ +} + +static uchar sigma[16] = "expand 32-byte k"; +static uchar tau[16] = "expand 16-byte k"; + +static void +load(u32int *d, uchar *s, int nw) +{ + int i; + + for(i = 0; i < nw; i++, s+=4) + d[i] = GET4(s); +} + +void +setupChachastate(Chachastate *s, uchar *key, ulong keylen, uchar *iv, int rounds) +{ + if(keylen != 256/8 && keylen != 128/8) + sysfatal("invalid chacha key length"); + if(rounds == 0) + rounds = 20; + s->rounds = rounds; + if(keylen == 256/8) { /* recommended */ + load(&s->input[0], sigma, 4); + load(&s->input[4], key, 8); + }else{ + load(&s->input[0], tau, 4); + load(&s->input[4], key, 4); + load(&s->input[8], key, 4); + } + s->input[12] = 0; + if(iv == nil){ + s->input[13] = 0; + s->input[14] = 0; + s->input[15] = 0; + }else + load(&s->input[13], iv, 3); +} + +void +chacha_setblock(Chachastate *s, u32int blockno) +{ + s->input[12] = blockno; +} + +static void +encryptblock(Chachastate *s, uchar *src, uchar *dst) +{ + u32int x[Blockwords]; + int i, rounds; + + rounds = s->rounds; + x[0] = s->input[0]; + x[1] = s->input[1]; + x[2] = s->input[2]; + x[3] = s->input[3]; + x[4] = s->input[4]; + x[5] = s->input[5]; + x[6] = s->input[6]; + x[7] = s->input[7]; + x[8] = s->input[8]; + x[9] = s->input[9]; + x[10] = s->input[10]; + x[11] = s->input[11]; + x[12] = s->input[12]; + x[13] = s->input[13]; + x[14] = s->input[14]; + x[15] = s->input[15]; + + for(i = rounds; i > 0; i -= 2) { + QUARTERROUND(0, 4, 8,12) + QUARTERROUND(1, 5, 9,13) + QUARTERROUND(2, 6,10,14) + QUARTERROUND(3, 7,11,15) + + QUARTERROUND(0, 5,10,15) + QUARTERROUND(1, 6,11,12) + QUARTERROUND(2, 7, 8,13) + QUARTERROUND(3, 4, 9,14) + } + +#ifdef FULL_UNROLL + ENCRYPT(src+0*4, x[0], s->input[0], dst+0*4); + ENCRYPT(src+1*4, x[1], s->input[1], dst+1*4); + ENCRYPT(src+2*4, x[2], s->input[2], dst+2*4); + ENCRYPT(src+3*4, x[3], s->input[3], dst+3*4); + ENCRYPT(src+4*4, x[4], s->input[4], dst+4*4); + ENCRYPT(src+5*4, x[5], s->input[5], dst+5*4); + ENCRYPT(src+6*4, x[6], s->input[6], dst+6*4); + ENCRYPT(src+7*4, x[7], s->input[7], dst+7*4); + ENCRYPT(src+8*4, x[8], s->input[8], dst+8*4); + ENCRYPT(src+9*4, x[9], s->input[9], dst+9*4); + ENCRYPT(src+10*4, x[10], s->input[10], dst+10*4); + ENCRYPT(src+11*4, x[11], s->input[11], dst+11*4); + ENCRYPT(src+12*4, x[12], s->input[12], dst+12*4); + ENCRYPT(src+13*4, x[13], s->input[13], dst+13*4); + ENCRYPT(src+14*4, x[14], s->input[14], dst+14*4); + ENCRYPT(src+15*4, x[15], s->input[15], dst+15*4); +#else + for(i=0; iinput[i], dst); + ENCRYPT(src+4, x[i+1], s->input[i+1], dst+4); + ENCRYPT(src+8, x[i+2], s->input[i+2], dst+8); + ENCRYPT(src+12, x[i+3], s->input[i+3], dst+12); + src += 16; + dst += 16; + } +#endif + + s->input[12]++; +} + +void +chacha_encrypt2(uchar *src, uchar *dst, ulong bytes, Chachastate *s) +{ + uchar tmp[ChachaBsize]; + + for(; bytes >= ChachaBsize; bytes -= ChachaBsize){ + encryptblock(s, src, dst); + src += ChachaBsize; + dst += ChachaBsize; + } + if(bytes > 0){ + memmove(tmp, src, bytes); + encryptblock(s, tmp, tmp); + memmove(dst, tmp, bytes); + } +} + +void +chacha_encrypt(uchar *buf, ulong bytes, Chachastate *s) +{ + chacha_encrypt2(buf, buf, bytes, s); +} diff --git a/sys/src/libsec/port/chachatest.c b/sys/src/libsec/port/chachatest.c new file mode 100644 index 000000000..7949c6f65 --- /dev/null +++ b/sys/src/libsec/port/chachatest.c @@ -0,0 +1,70 @@ +#include +#include +#include + +static void +printblock(uchar *b, usize n) +{ + int i; + + for(i=0; i+8<=n; i+=8){ + print("%#.2ux %#.2ux %#.2ux %#.2ux %#.2ux %#.2ux %#.2ux %#.2ux\n", + b[0], b[1], b[2], b[3], b[4], b[5], b[6], b[7]); + b += 8; + } + if(i < n){ + print("%#.2ux", *b++); + while(++i < n) + print(" %#.2ux", *b++); + print("\n"); + } +} + +/* test vector from RFC7539 */ +uchar rfckey[] = { + 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, + 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, + 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, + 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f}; +uchar rfcnonce[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x4a, 0x00, 0x00, 0x00, 0x00}; +u32int rfccount = 1; +char rfctext[] = "Ladies and Gentlemen of the class of '99: If I could offer you only one tip for the future, " + "sunscreen would be it."; +uchar rfcout[3*ChachaBsize]; +uchar rfcref[3*ChachaBsize] = { + 0x6e, 0x2e, 0x35, 0x9a, 0x25, 0x68, 0xf9, 0x80, 0x41, 0xba, 0x07, 0x28, 0xdd, 0x0d, 0x69, 0x81, + 0xe9, 0x7e, 0x7a, 0xec, 0x1d, 0x43, 0x60, 0xc2, 0x0a, 0x27, 0xaf, 0xcc, 0xfd, 0x9f, 0xae, 0x0b, + 0xf9, 0x1b, 0x65, 0xc5, 0x52, 0x47, 0x33, 0xab, 0x8f, 0x59, 0x3d, 0xab, 0xcd, 0x62, 0xb3, 0x57, + 0x16, 0x39, 0xd6, 0x24, 0xe6, 0x51, 0x52, 0xab, 0x8f, 0x53, 0x0c, 0x35, 0x9f, 0x08, 0x61, 0xd8, + 0x07, 0xca, 0x0d, 0xbf, 0x50, 0x0d, 0x6a, 0x61, 0x56, 0xa3, 0x8e, 0x08, 0x8a, 0x22, 0xb6, 0x5e, + 0x52, 0xbc, 0x51, 0x4d, 0x16, 0xcc, 0xf8, 0x06, 0x81, 0x8c, 0xe9, 0x1a, 0xb7, 0x79, 0x37, 0x36, + 0x5a, 0xf9, 0x0b, 0xbf, 0x74, 0xa3, 0x5b, 0xe6, 0xb4, 0x0b, 0x8e, 0xed, 0xf2, 0x78, 0x5e, 0x42, + 0x87, 0x4d +}; + +void +main(int argc, char **argv) +{ + Chachastate s; + int n; + + ARGBEGIN{ + }ARGEND + print("rfc7539:\n"); + print("key:\n"); + printblock(rfckey, sizeof(rfckey)); + n = strlen(rfctext); + setupChachastate(&s, rfckey, sizeof(rfckey), rfcnonce, 0); + chacha_setblock(&s, rfccount); + print("rfc in:\n"); + printblock((uchar*)rfctext, n); + chacha_encrypt2((uchar*)rfctext, rfcout, n, &s); + print("rfc out:\n"); + printblock(rfcout, n); + if(memcmp(rfcout, rfcref, sizeof(rfcout)) != 0){ + print("failure of vision\n"); + exits("wrong"); + } + print("passed\n"); + exits(nil); +} diff --git a/sys/src/libsec/port/mkfile b/sys/src/libsec/port/mkfile index 1b6947d1b..f7be1abfc 100644 --- a/sys/src/libsec/port/mkfile +++ b/sys/src/libsec/port/mkfile @@ -9,6 +9,7 @@ CFILES = des.c desmodes.c desECB.c desCBC.c des3ECB.c des3CBC.c\ sha1pickle.c md5pickle.c\ poly1305.c\ rc4.c\ + chacha.c\ genrandom.c prng.c fastrand.c nfastrand.c\ probably_prime.c smallprimetest.c genprime.c dsaprimes.c\ gensafeprime.c genstrongprime.c\