ChaCha.cpp

/*
 * Copyright (C) 2015 Southern Storm Software, Pty Ltd.
 *
 * Permission is hereby granted, free of charge, to any person obtaining a
 * copy of this software and associated documentation files (the "Software"),
 * to deal in the Software without restriction, including without limitation
 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
 * and/or sell copies of the Software, and to permit persons to whom the
 * Software is furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included
 * in all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
 * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 * DEALINGS IN THE SOFTWARE.
 */

#include "ChaCha.h"
#include "Crypto.h"
#include "utility/RotateUtil.h"
#include "utility/EndianUtil.h"
#include "utility/ProgMemUtil.h"
#include <string.h>

ChaCha::ChaCha(uint8_t numRounds)
    : rounds(numRounds)
    , posn(64)
{
}

ChaCha::~ChaCha()
{
    clean(block);
    clean(stream);
}

size_t ChaCha::keySize() const
{
    // Default key size is 256-bit, but any key size is allowed.
    return 32;
}

size_t ChaCha::ivSize() const
{
    // We return 8 but we also support 12-byte nonces in setIV().
    return 8;
}

bool ChaCha::setKey(const uint8_t *key, size_t len)
{
    static const char tag128[] PROGMEM = "expand 16-byte k";
    static const char tag256[] PROGMEM = "expand 32-byte k";
    if (len <= 16) {
        memcpy_P(block, tag128, 16);
        memcpy(block + 16, key, len);
        memcpy(block + 32, key, len);
        if (len < 16) {
            memset(block + 16 + len, 0, 16 - len);
            memset(block + 32 + len, 0, 16 - len);
        }
    } else {
        if (len > 32)
            len = 32;
        memcpy_P(block, tag256, 16);
        memcpy(block + 16, key, len);
        if (len < 32)
            memset(block + 16 + len, 0, 32 - len);
    }
    posn = 64;
    return true;
}

bool ChaCha::setIV(const uint8_t *iv, size_t len)
{
    // From draft-nir-cfrg-chacha20-poly1305-04.txt, we can use either
    // 64-bit or 96-bit nonces.  The 96-bit nonce consists of the high
    // word of the counter prepended to a regular 64-bit nonce for ChaCha.
    if (len == 8) {
        memset(block + 48, 0, 8);
        memcpy(block + 56, iv, len);
        posn = 64;
        return true;
    } else if (len == 12) {
        memset(block + 48, 0, 4);
        memcpy(block + 52, iv, len);
        posn = 64;
        return true;
    } else {
        return false;
    }
}

bool ChaCha::setCounter(const uint8_t *counter, size_t len)
{
    // Normally both the IV and the counter are 8 bytes in length.
    // However, if the IV was 12 bytes, then a 4 byte counter can be used.
    if (len == 4 || len == 8) {
        memcpy(block + 48, counter, len);
        posn = 64;
        return true;
    } else {
        return false;
    }
}

void ChaCha::encrypt(uint8_t *output, const uint8_t *input, size_t len)
{
    while (len > 0) {
        if (posn >= 64) {
            // Generate a new encrypted counter block.
            hashCore((uint32_t *)stream, (const uint32_t *)block, rounds);
            posn = 0;

            // Increment the counter, taking care not to reveal
            // any timing information about the starting value.
            // We iterate through the entire counter region even
            // if we could stop earlier because a byte is non-zero.
            uint16_t temp = 1;
            uint8_t index = 48;
            while (index < 56) {
                temp += block[index];
                block[index] = (uint8_t)temp;
                temp >>= 8;
                ++index;
            }
        }
        uint8_t templen = 64 - posn;
        if (templen > len)
            templen = len;
        len -= templen;
        while (templen > 0) {
            *output++ = *input++ ^ stream[posn++];
            --templen;
        }
    }
}

void ChaCha::decrypt(uint8_t *output, const uint8_t *input, size_t len)
{
    encrypt(output, input, len);
}

void ChaCha::clear()
{
    clean(block);
    clean(stream);
    posn = 64;
}

// Perform a ChaCha quarter round operation.
#define quarterRound(a, b, c, d)    \
    do { \
        uint32_t _b = (b); \
        uint32_t _a = (a) + _b; \
        uint32_t _d = leftRotate((d) ^ _a, 16); \
        uint32_t _c = (c) + _d; \
        _b = leftRotate12(_b ^ _c); \
        _a += _b; \
        (d) = _d = leftRotate(_d ^ _a, 8); \
        _c += _d; \
        (a) = _a; \
        (b) = leftRotate7(_b ^ _c); \
        (c) = _c; \
    } while (0)

void ChaCha::hashCore(uint32_t *output, const uint32_t *input, uint8_t rounds)
{
    uint8_t posn;

    // Copy the input buffer to the output prior to the first round
    // and convert from little-endian to host byte order.
    for (posn = 0; posn < 16; ++posn)
        output[posn] = le32toh(input[posn]);

    // Perform the ChaCha rounds in sets of two.
    for (; rounds >= 2; rounds -= 2) {
        // Column round.
        quarterRound(output[0], output[4], output[8],  output[12]);
        quarterRound(output[1], output[5], output[9],  output[13]);
        quarterRound(output[2], output[6], output[10], output[14]);
        quarterRound(output[3], output[7], output[11], output[15]);

        // Diagonal round.
        quarterRound(output[0], output[5], output[10], output[15]);
        quarterRound(output[1], output[6], output[11], output[12]);
        quarterRound(output[2], output[7], output[8],  output[13]);
        quarterRound(output[3], output[4], output[9],  output[14]);
    }

    // Add the original input to the final output, convert back to
    // little-endian, and return the result.
    for (posn = 0; posn < 16; ++posn)
        output[posn] = htole32(output[posn] + le32toh(input[posn]));
}