• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1// Copyright (c) 2016, Google Inc.
2//
3// Permission to use, copy, modify, and/or distribute this software for any
4// purpose with or without fee is hereby granted, provided that the above
5// copyright notice and this permission notice appear in all copies.
6//
7// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10// SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12// OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13// CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
14
15package runner
16
17import (
18	"crypto/cipher"
19	"crypto/subtle"
20	"encoding/binary"
21	"errors"
22
23	"./poly1305"
24)
25
26// See RFC 7539.
27
28func leftRotate(a uint32, n uint) uint32 {
29	return (a << n) | (a >> (32 - n))
30}
31
32func chaChaQuarterRound(state *[16]uint32, a, b, c, d int) {
33	state[a] += state[b]
34	state[d] = leftRotate(state[d]^state[a], 16)
35
36	state[c] += state[d]
37	state[b] = leftRotate(state[b]^state[c], 12)
38
39	state[a] += state[b]
40	state[d] = leftRotate(state[d]^state[a], 8)
41
42	state[c] += state[d]
43	state[b] = leftRotate(state[b]^state[c], 7)
44}
45
46func chaCha20Block(state *[16]uint32, out []byte) {
47	var workingState [16]uint32
48	copy(workingState[:], state[:])
49	for i := 0; i < 10; i++ {
50		chaChaQuarterRound(&workingState, 0, 4, 8, 12)
51		chaChaQuarterRound(&workingState, 1, 5, 9, 13)
52		chaChaQuarterRound(&workingState, 2, 6, 10, 14)
53		chaChaQuarterRound(&workingState, 3, 7, 11, 15)
54		chaChaQuarterRound(&workingState, 0, 5, 10, 15)
55		chaChaQuarterRound(&workingState, 1, 6, 11, 12)
56		chaChaQuarterRound(&workingState, 2, 7, 8, 13)
57		chaChaQuarterRound(&workingState, 3, 4, 9, 14)
58	}
59	for i := 0; i < 16; i++ {
60		binary.LittleEndian.PutUint32(out[i*4:i*4+4], workingState[i]+state[i])
61	}
62}
63
64// sliceForAppend takes a slice and a requested number of bytes. It returns a
65// slice with the contents of the given slice followed by that many bytes and a
66// second slice that aliases into it and contains only the extra bytes. If the
67// original slice has sufficient capacity then no allocation is performed.
68func sliceForAppend(in []byte, n int) (head, tail []byte) {
69	if total := len(in) + n; cap(in) >= total {
70		head = in[:total]
71	} else {
72		head = make([]byte, total)
73		copy(head, in)
74	}
75	tail = head[len(in):]
76	return
77}
78
79func chaCha20(out, in, key, nonce []byte, counter uint64) {
80	var state [16]uint32
81	state[0] = 0x61707865
82	state[1] = 0x3320646e
83	state[2] = 0x79622d32
84	state[3] = 0x6b206574
85	for i := 0; i < 8; i++ {
86		state[4+i] = binary.LittleEndian.Uint32(key[i*4 : i*4+4])
87	}
88
89	switch len(nonce) {
90	case 8:
91		state[14] = binary.LittleEndian.Uint32(nonce[0:4])
92		state[15] = binary.LittleEndian.Uint32(nonce[4:8])
93	case 12:
94		state[13] = binary.LittleEndian.Uint32(nonce[0:4])
95		state[14] = binary.LittleEndian.Uint32(nonce[4:8])
96		state[15] = binary.LittleEndian.Uint32(nonce[8:12])
97	default:
98		panic("bad nonce length")
99	}
100
101	for i := 0; i < len(in); i += 64 {
102		state[12] = uint32(counter)
103
104		var tmp [64]byte
105		chaCha20Block(&state, tmp[:])
106		count := 64
107		if len(in)-i < count {
108			count = len(in) - i
109		}
110		for j := 0; j < count; j++ {
111			out[i+j] = in[i+j] ^ tmp[j]
112		}
113
114		counter++
115	}
116}
117
118// chaCha20Poly1305 implements the AEAD from
119// RFC 7539 and draft-agl-tls-chacha20poly1305-04.
120type chaCha20Poly1305 struct {
121	key [32]byte
122}
123
124func newChaCha20Poly1305(key []byte) (cipher.AEAD, error) {
125	if len(key) != 32 {
126		return nil, errors.New("bad key length")
127	}
128	aead := new(chaCha20Poly1305)
129	copy(aead.key[:], key)
130	return aead, nil
131}
132
133func (c *chaCha20Poly1305) NonceSize() int {
134	return 12
135}
136
137func (c *chaCha20Poly1305) Overhead() int { return 16 }
138
139func (c *chaCha20Poly1305) poly1305(tag *[16]byte, nonce, ciphertext, additionalData []byte) {
140	input := make([]byte, 0, len(additionalData)+15+len(ciphertext)+15+8+8)
141	input = append(input, additionalData...)
142	var zeros [15]byte
143	if pad := len(input) % 16; pad != 0 {
144		input = append(input, zeros[:16-pad]...)
145	}
146	input = append(input, ciphertext...)
147	if pad := len(input) % 16; pad != 0 {
148		input = append(input, zeros[:16-pad]...)
149	}
150	input, out := sliceForAppend(input, 8)
151	binary.LittleEndian.PutUint64(out, uint64(len(additionalData)))
152	input, out = sliceForAppend(input, 8)
153	binary.LittleEndian.PutUint64(out, uint64(len(ciphertext)))
154
155	var poly1305Key [32]byte
156	chaCha20(poly1305Key[:], poly1305Key[:], c.key[:], nonce, 0)
157
158	poly1305.Sum(tag, input, &poly1305Key)
159}
160
161func (c *chaCha20Poly1305) Seal(dst, nonce, plaintext, additionalData []byte) []byte {
162	if len(nonce) != c.NonceSize() {
163		panic("Bad nonce length")
164	}
165
166	ret, out := sliceForAppend(dst, len(plaintext)+16)
167	chaCha20(out[:len(plaintext)], plaintext, c.key[:], nonce, 1)
168
169	var tag [16]byte
170	c.poly1305(&tag, nonce, out[:len(plaintext)], additionalData)
171	copy(out[len(plaintext):], tag[:])
172
173	return ret
174}
175
176func (c *chaCha20Poly1305) Open(dst, nonce, ciphertext, additionalData []byte) ([]byte, error) {
177	if len(nonce) != c.NonceSize() {
178		panic("Bad nonce length")
179	}
180	if len(ciphertext) < 16 {
181		return nil, errors.New("chacha20: message authentication failed")
182	}
183	plaintextLen := len(ciphertext) - 16
184
185	var tag [16]byte
186	c.poly1305(&tag, nonce, ciphertext[:plaintextLen], additionalData)
187	if subtle.ConstantTimeCompare(tag[:], ciphertext[plaintextLen:]) != 1 {
188		return nil, errors.New("chacha20: message authentication failed")
189	}
190
191	ret, out := sliceForAppend(dst, plaintextLen)
192	chaCha20(out, ciphertext[:plaintextLen], c.key[:], nonce, 1)
193	return ret, nil
194}
195