1// Copyright (c) 2016, Google Inc. 2// 3// Permission to use, copy, modify, and/or distribute this software for any 4// purpose with or without fee is hereby granted, provided that the above 5// copyright notice and this permission notice appear in all copies. 6// 7// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 8// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 9// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY 10// SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 11// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION 12// OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN 13// CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 14 15package runner 16 17import ( 18 "crypto/cipher" 19 "crypto/subtle" 20 "encoding/binary" 21 "errors" 22 23 "./poly1305" 24) 25 26// See RFC 7539. 27 28func leftRotate(a uint32, n uint) uint32 { 29 return (a << n) | (a >> (32 - n)) 30} 31 32func chaChaQuarterRound(state *[16]uint32, a, b, c, d int) { 33 state[a] += state[b] 34 state[d] = leftRotate(state[d]^state[a], 16) 35 36 state[c] += state[d] 37 state[b] = leftRotate(state[b]^state[c], 12) 38 39 state[a] += state[b] 40 state[d] = leftRotate(state[d]^state[a], 8) 41 42 state[c] += state[d] 43 state[b] = leftRotate(state[b]^state[c], 7) 44} 45 46func chaCha20Block(state *[16]uint32, out []byte) { 47 var workingState [16]uint32 48 copy(workingState[:], state[:]) 49 for i := 0; i < 10; i++ { 50 chaChaQuarterRound(&workingState, 0, 4, 8, 12) 51 chaChaQuarterRound(&workingState, 1, 5, 9, 13) 52 chaChaQuarterRound(&workingState, 2, 6, 10, 14) 53 chaChaQuarterRound(&workingState, 3, 7, 11, 15) 54 chaChaQuarterRound(&workingState, 0, 5, 10, 15) 55 chaChaQuarterRound(&workingState, 1, 6, 11, 12) 56 chaChaQuarterRound(&workingState, 2, 7, 8, 13) 57 chaChaQuarterRound(&workingState, 3, 4, 9, 14) 58 } 59 for i := 0; i < 16; i++ { 60 binary.LittleEndian.PutUint32(out[i*4:i*4+4], workingState[i]+state[i]) 61 } 62} 63 64// sliceForAppend takes a slice and a requested number of bytes. It returns a 65// slice with the contents of the given slice followed by that many bytes and a 66// second slice that aliases into it and contains only the extra bytes. If the 67// original slice has sufficient capacity then no allocation is performed. 68func sliceForAppend(in []byte, n int) (head, tail []byte) { 69 if total := len(in) + n; cap(in) >= total { 70 head = in[:total] 71 } else { 72 head = make([]byte, total) 73 copy(head, in) 74 } 75 tail = head[len(in):] 76 return 77} 78 79func chaCha20(out, in, key, nonce []byte, counter uint64) { 80 var state [16]uint32 81 state[0] = 0x61707865 82 state[1] = 0x3320646e 83 state[2] = 0x79622d32 84 state[3] = 0x6b206574 85 for i := 0; i < 8; i++ { 86 state[4+i] = binary.LittleEndian.Uint32(key[i*4 : i*4+4]) 87 } 88 89 switch len(nonce) { 90 case 8: 91 state[14] = binary.LittleEndian.Uint32(nonce[0:4]) 92 state[15] = binary.LittleEndian.Uint32(nonce[4:8]) 93 case 12: 94 state[13] = binary.LittleEndian.Uint32(nonce[0:4]) 95 state[14] = binary.LittleEndian.Uint32(nonce[4:8]) 96 state[15] = binary.LittleEndian.Uint32(nonce[8:12]) 97 default: 98 panic("bad nonce length") 99 } 100 101 for i := 0; i < len(in); i += 64 { 102 state[12] = uint32(counter) 103 104 var tmp [64]byte 105 chaCha20Block(&state, tmp[:]) 106 count := 64 107 if len(in)-i < count { 108 count = len(in) - i 109 } 110 for j := 0; j < count; j++ { 111 out[i+j] = in[i+j] ^ tmp[j] 112 } 113 114 counter++ 115 } 116} 117 118// chaCha20Poly1305 implements the AEAD from 119// RFC 7539 and draft-agl-tls-chacha20poly1305-04. 120type chaCha20Poly1305 struct { 121 key [32]byte 122} 123 124func newChaCha20Poly1305(key []byte) (cipher.AEAD, error) { 125 if len(key) != 32 { 126 return nil, errors.New("bad key length") 127 } 128 aead := new(chaCha20Poly1305) 129 copy(aead.key[:], key) 130 return aead, nil 131} 132 133func (c *chaCha20Poly1305) NonceSize() int { 134 return 12 135} 136 137func (c *chaCha20Poly1305) Overhead() int { return 16 } 138 139func (c *chaCha20Poly1305) poly1305(tag *[16]byte, nonce, ciphertext, additionalData []byte) { 140 input := make([]byte, 0, len(additionalData)+15+len(ciphertext)+15+8+8) 141 input = append(input, additionalData...) 142 var zeros [15]byte 143 if pad := len(input) % 16; pad != 0 { 144 input = append(input, zeros[:16-pad]...) 145 } 146 input = append(input, ciphertext...) 147 if pad := len(input) % 16; pad != 0 { 148 input = append(input, zeros[:16-pad]...) 149 } 150 input, out := sliceForAppend(input, 8) 151 binary.LittleEndian.PutUint64(out, uint64(len(additionalData))) 152 input, out = sliceForAppend(input, 8) 153 binary.LittleEndian.PutUint64(out, uint64(len(ciphertext))) 154 155 var poly1305Key [32]byte 156 chaCha20(poly1305Key[:], poly1305Key[:], c.key[:], nonce, 0) 157 158 poly1305.Sum(tag, input, &poly1305Key) 159} 160 161func (c *chaCha20Poly1305) Seal(dst, nonce, plaintext, additionalData []byte) []byte { 162 if len(nonce) != c.NonceSize() { 163 panic("Bad nonce length") 164 } 165 166 ret, out := sliceForAppend(dst, len(plaintext)+16) 167 chaCha20(out[:len(plaintext)], plaintext, c.key[:], nonce, 1) 168 169 var tag [16]byte 170 c.poly1305(&tag, nonce, out[:len(plaintext)], additionalData) 171 copy(out[len(plaintext):], tag[:]) 172 173 return ret 174} 175 176func (c *chaCha20Poly1305) Open(dst, nonce, ciphertext, additionalData []byte) ([]byte, error) { 177 if len(nonce) != c.NonceSize() { 178 panic("Bad nonce length") 179 } 180 if len(ciphertext) < 16 { 181 return nil, errors.New("chacha20: message authentication failed") 182 } 183 plaintextLen := len(ciphertext) - 16 184 185 var tag [16]byte 186 c.poly1305(&tag, nonce, ciphertext[:plaintextLen], additionalData) 187 if subtle.ConstantTimeCompare(tag[:], ciphertext[plaintextLen:]) != 1 { 188 return nil, errors.New("chacha20: message authentication failed") 189 } 190 191 ret, out := sliceForAppend(dst, plaintextLen) 192 chaCha20(out, ciphertext[:plaintextLen], c.key[:], nonce, 1) 193 return ret, nil 194} 195