changelog shortlog tags branches files raw gz bz2 help

Mercurial > hg > plan9front / changeset: libsec: add salsa20 stream cipher

changeset 5064: 846326544dbe
parent 5063: fe7929b7ec01
child 5065: 78182d119cca
author: cinap_lenrek@felloff.net
date: Tue, 19 Jan 2016 12:50:33 +0100
files: sys/include/libsec.h sys/man/2/chacha sys/man/2/salsa sys/src/libsec/port/mkfile sys/src/libsec/port/salsa.c
description: libsec: add salsa20 stream cipher
     1.1--- a/sys/include/libsec.h
     1.2+++ b/sys/include/libsec.h
     1.3@@ -107,6 +107,34 @@ void	ccpoly_encrypt(uchar *dat, ulong nd
     1.4 int	ccpoly_decrypt(uchar *dat, ulong ndat, uchar *aad, ulong naad, uchar tag[16], Chachastate *cs);
     1.5 
     1.6 /*
     1.7+ * Salsa definitions
     1.8+ */
     1.9+enum
    1.10+{
    1.11+	SalsaBsize=	64,
    1.12+	SalsaKeylen=	256/8,
    1.13+	SalsaIVlen=	64/8,
    1.14+	XSalsaIVlen=	192/8,
    1.15+};
    1.16+
    1.17+typedef struct Salsastate Salsastate;
    1.18+struct Salsastate
    1.19+{
    1.20+	u32int	input[16];
    1.21+	u32int	key[8];
    1.22+	int	rounds;
    1.23+	int	ivwords;
    1.24+};
    1.25+
    1.26+void	setupSalsastate(Salsastate*, uchar*, ulong, uchar*, ulong, int);
    1.27+void	salsa_setiv(Salsastate*, uchar*);
    1.28+void	salsa_setblock(Salsastate*, u64int);
    1.29+void	salsa_encrypt(uchar*, ulong, Salsastate*);
    1.30+void	salsa_encrypt2(uchar*, uchar*, ulong, Salsastate*);
    1.31+
    1.32+void	hsalsa(uchar h[32], uchar *key, ulong keylen, uchar nonce[16], int rounds);
    1.33+
    1.34+/*
    1.35  * DES definitions
    1.36  */
    1.37 
     2.1--- a/sys/man/2/chacha
     2.2+++ b/sys/man/2/chacha
     2.3@@ -131,6 +131,7 @@ calculation, but not encrypted.
     2.4 .IR elgamal (2),
     2.5 .IR rc4 (2),
     2.6 .IR rsa (2),
     2.7+.IR salsa (2),
     2.8 .IR sechash (2),
     2.9 .IR prime (2),
    2.10 .IR rand (2)
     3.1new file mode 100644
     3.2--- /dev/null
     3.3+++ b/sys/man/2/salsa
     3.4@@ -0,0 +1,102 @@
     3.5+.TH SALSA 2
     3.6+.SH NAME
     3.7+setupSalsastate, salsa_setblock, salsa_setiv, salsa_encrypt, salsa_encrypt2, hsalsa
     3.8+\- salsa20 encryption
     3.9+.SH SYNOPSIS
    3.10+.B #include <u.h>
    3.11+.br
    3.12+.B #include <libc.h>
    3.13+.br
    3.14+.B #include <libsec.h>
    3.15+.PP
    3.16+.B
    3.17+void setupSalsastate(Salsastate *s, uchar key[], ulong keylen, uchar *iv, ulong ivlen, int rounds)
    3.18+.PP
    3.19+.B
    3.20+void salsa_encrypt(uchar *data, ulong len, Salsastate *s)
    3.21+.PP
    3.22+.B
    3.23+void salsa_encrypt2(uchar *src, uchar *dst, ulong len, Salsastate *s)
    3.24+.PP
    3.25+.B
    3.26+void salsa_setblock(Salsastate *s, u64int blockno)
    3.27+.PP
    3.28+.B
    3.29+void salsa_setiv(Salsastate *s, uchar *iv);
    3.30+.PP
    3.31+.B
    3.32+void hsalsa(uchar h[32], uchar *key, ulong keylen, uchar nonce[16], int rounds);
    3.33+.SH DESCRIPTION
    3.34+.PP
    3.35+Salsa20 is a stream cipher designed by D J Berstein. It has an underlying block size of 64 bytes
    3.36+(named as constant
    3.37+.BR SalsaBsize ).
    3.38+It supports key sizes of 128 and 256-bit (recommended).
    3.39+.PP
    3.40+.I SetupSalsastate
    3.41+takes a reference to a
    3.42+.B Salsastate
    3.43+structure, a
    3.44+.I key
    3.45+of
    3.46+.I keylen
    3.47+bytes, which should normally be
    3.48+.BR SalsaKeylen (32),
    3.49+a
    3.50+.I iv
    3.51+or nonce of
    3.52+.I ivlen
    3.53+bytes (can be
    3.54+.BR SalsaIVlen (8)
    3.55+or
    3.56+.BR XSalsaIVlen (24)),
    3.57+set to all zeros if the
    3.58+.I iv
    3.59+argument is nil),
    3.60+and the number of
    3.61+.I rounds
    3.62+(set to the default of 20 if the argument is zero).
    3.63+.PP
    3.64+.I Salsa_encrypt
    3.65+encrypts
    3.66+.I len
    3.67+bytes of
    3.68+.I buf
    3.69+in place using the
    3.70+.B Salsastate
    3.71+in
    3.72+.IR s .
    3.73+.I Len
    3.74+can be any byte length.
    3.75+Encryption and decryption are the same operation given the same starting state
    3.76+.IR s .
    3.77+.PP
    3.78+.I Salsa_encrypt2
    3.79+is similar, but encrypts
    3.80+.I len
    3.81+bytes of
    3.82+.I src
    3.83+into
    3.84+.I dst
    3.85+without modifying
    3.86+.IR src .
    3.87+.PP
    3.88+.I Salsa_setblock
    3.89+sets the Salsa block counter for the next encryption to
    3.90+.IR blockno ,
    3.91+allowing seeking in an encrypted stream.
    3.92+.PP
    3.93+.I Salsa_setiv
    3.94+sets the the initialization vector (nonce) to
    3.95+.IR iv .
    3.96+.PP
    3.97+.I Hsalsa
    3.98+is a key expansion function that takes a 128 or
    3.99+256-bit key and a 128-bit nonce and produces a new
   3.100+256-bit key.
   3.101+.SH SOURCE
   3.102+.B /sys/src/libsec/salsa.c
   3.103+.SH SEE ALSO
   3.104+.IR chacha (2)
   3.105+.br
   3.106+.B http://cr.yp.to/snuffle.html#specification
     4.1--- a/sys/src/libsec/port/mkfile
     4.2+++ b/sys/src/libsec/port/mkfile
     4.3@@ -10,6 +10,7 @@ CFILES = des.c desmodes.c desECB.c desCB
     4.4 	poly1305.c\
     4.5 	rc4.c\
     4.6 	chacha.c\
     4.7+	salsa.c\
     4.8 	genrandom.c prng.c fastrand.c nfastrand.c\
     4.9 	probably_prime.c smallprimetest.c genprime.c dsaprimes.c\
    4.10 	gensafeprime.c genstrongprime.c\
     5.1new file mode 100644
     5.2--- /dev/null
     5.3+++ b/sys/src/libsec/port/salsa.c
     5.4@@ -0,0 +1,320 @@
     5.5+#include <u.h>
     5.6+#include <libc.h>
     5.7+#include <libsec.h>
     5.8+
     5.9+enum{
    5.10+	Blockwords=	SalsaBsize/sizeof(u32int)
    5.11+};
    5.12+
    5.13+/* little-endian data order */
    5.14+#define GET4(p)	((((((p)[3]<<8) | (p)[2])<<8) | (p)[1])<<8 | (p)[0])
    5.15+#define PUT4(p, v)	(((p)[0]=v), (v>>=8), ((p)[1]=v), (v>>=8), ((p)[2]=v), (v>>=8), ((p)[3]=v))
    5.16+
    5.17+#define ROTATE(v,c) (t = v, (u32int)(t << (c)) | (t >> (32 - (c))))
    5.18+
    5.19+#define ENCRYPT(s, x, y, d) {\
    5.20+	u32int v; \
    5.21+	uchar *sp, *dp; \
    5.22+	sp = (s); \
    5.23+	v = GET4(sp); \
    5.24+	v ^= (x)+(y); \
    5.25+	dp = (d); \
    5.26+	PUT4(dp, v); \
    5.27+}
    5.28+
    5.29+static uchar sigma[16] = "expand 32-byte k";
    5.30+static uchar tau[16] = "expand 16-byte k";
    5.31+
    5.32+static void
    5.33+load(u32int *d, uchar *s, int nw)
    5.34+{
    5.35+	int i;
    5.36+
    5.37+	for(i = 0; i < nw; i++, s+=4)
    5.38+		d[i] = GET4(s);
    5.39+}
    5.40+
    5.41+void
    5.42+setupSalsastate(Salsastate *s, uchar *key, ulong keylen, uchar *iv, ulong ivlen, int rounds)
    5.43+{
    5.44+	if(keylen != 256/8 && keylen != 128/8)
    5.45+		sysfatal("invalid salsa key length");
    5.46+	if(ivlen != 64/8 && ivlen != 128/8 && ivlen != 192/8)
    5.47+		sysfatal("invalid salsa iv length");
    5.48+	if(rounds == 0)
    5.49+		rounds = 20;
    5.50+	s->rounds = rounds;
    5.51+	if(keylen == 256/8) { /* recommended */
    5.52+		load(&s->input[0],  sigma+4*0, 1);
    5.53+		load(&s->input[1],  key +16*0, 4);
    5.54+		load(&s->input[5],  sigma+4*1, 1);
    5.55+		load(&s->input[10], sigma+4*2, 1);
    5.56+		load(&s->input[11], key +16*1, 4);
    5.57+		load(&s->input[15], sigma+4*3, 1);
    5.58+	}else{
    5.59+		load(&s->input[0],  tau +4*0, 1);
    5.60+		load(&s->input[1],  key, 4);
    5.61+		load(&s->input[5],  tau +4*1, 1);
    5.62+		load(&s->input[10], tau +4*2, 1);
    5.63+		load(&s->input[11], key, 4);
    5.64+		load(&s->input[15], tau +4*3, 1);
    5.65+	}
    5.66+	s->key[0] = s->input[1];
    5.67+	s->key[1] = s->input[2];
    5.68+	s->key[2] = s->input[3];
    5.69+	s->key[3] = s->input[4];
    5.70+	s->key[4] = s->input[11];
    5.71+	s->key[5] = s->input[12];
    5.72+	s->key[6] = s->input[13];
    5.73+	s->key[7] = s->input[14];
    5.74+
    5.75+	s->ivwords = ivlen/4;
    5.76+	s->input[8] = 0;
    5.77+	s->input[9] = 0;
    5.78+	if(iv == nil){
    5.79+		s->input[6] = 0;
    5.80+		s->input[7] = 0;
    5.81+	}else
    5.82+		salsa_setiv(s, iv);
    5.83+}
    5.84+
    5.85+static void
    5.86+hsalsablock(uchar h[32], Salsastate *s)
    5.87+{
    5.88+	u32int x[Blockwords], t;
    5.89+	int i, rounds;
    5.90+
    5.91+	rounds = s->rounds;
    5.92+	x[0] = s->input[0];
    5.93+	x[1] = s->input[1];
    5.94+	x[2] = s->input[2];
    5.95+	x[3] = s->input[3];
    5.96+	x[4] = s->input[4];
    5.97+	x[5] = s->input[5];
    5.98+	x[6] = s->input[6];
    5.99+	x[7] = s->input[7];
   5.100+	x[8] = s->input[8];
   5.101+	x[9] = s->input[9];
   5.102+	x[10] = s->input[10];
   5.103+	x[11] = s->input[11];
   5.104+	x[12] = s->input[12];
   5.105+	x[13] = s->input[13];
   5.106+	x[14] = s->input[14];
   5.107+	x[15] = s->input[15];
   5.108+
   5.109+	for(i = rounds; i > 0; i -= 2) {
   5.110+	     x[4] ^= ROTATE( x[0]+x[12], 7);
   5.111+	     x[8] ^= ROTATE( x[4]+ x[0], 9);
   5.112+	    x[12] ^= ROTATE( x[8]+ x[4],13);
   5.113+	     x[0] ^= ROTATE(x[12]+ x[8],18);
   5.114+	     x[9] ^= ROTATE( x[5]+ x[1], 7);
   5.115+	    x[13] ^= ROTATE( x[9]+ x[5], 9);
   5.116+	     x[1] ^= ROTATE(x[13]+ x[9],13);
   5.117+	     x[5] ^= ROTATE( x[1]+x[13],18);
   5.118+	    x[14] ^= ROTATE(x[10]+ x[6], 7);
   5.119+	     x[2] ^= ROTATE(x[14]+x[10], 9);
   5.120+	     x[6] ^= ROTATE( x[2]+x[14],13);
   5.121+	    x[10] ^= ROTATE( x[6]+ x[2],18);
   5.122+	     x[3] ^= ROTATE(x[15]+x[11], 7);
   5.123+	     x[7] ^= ROTATE( x[3]+x[15], 9);
   5.124+	    x[11] ^= ROTATE( x[7]+ x[3],13);
   5.125+	    x[15] ^= ROTATE(x[11]+ x[7],18);
   5.126+	     x[1] ^= ROTATE( x[0]+ x[3], 7);
   5.127+	     x[2] ^= ROTATE( x[1]+ x[0], 9);
   5.128+	     x[3] ^= ROTATE( x[2]+ x[1],13);
   5.129+	     x[0] ^= ROTATE( x[3]+ x[2],18);
   5.130+	     x[6] ^= ROTATE( x[5]+ x[4], 7);
   5.131+	     x[7] ^= ROTATE( x[6]+ x[5], 9);
   5.132+	     x[4] ^= ROTATE( x[7]+ x[6],13);
   5.133+	     x[5] ^= ROTATE( x[4]+ x[7],18);
   5.134+	    x[11] ^= ROTATE(x[10]+ x[9], 7);
   5.135+	     x[8] ^= ROTATE(x[11]+x[10], 9);
   5.136+	     x[9] ^= ROTATE( x[8]+x[11],13);
   5.137+	    x[10] ^= ROTATE( x[9]+ x[8],18);
   5.138+	    x[12] ^= ROTATE(x[15]+x[14], 7);
   5.139+	    x[13] ^= ROTATE(x[12]+x[15], 9);
   5.140+	    x[14] ^= ROTATE(x[13]+x[12],13);
   5.141+	    x[15] ^= ROTATE(x[14]+x[13],18);
   5.142+	}
   5.143+
   5.144+	PUT4(h+0*4, x[0]);
   5.145+	PUT4(h+1*4, x[5]);
   5.146+	PUT4(h+2*4, x[10]);
   5.147+	PUT4(h+3*4, x[15]);
   5.148+	PUT4(h+4*4, x[6]);
   5.149+	PUT4(h+5*4, x[7]);
   5.150+	PUT4(h+6*4, x[8]);
   5.151+	PUT4(h+7*4, x[9]);
   5.152+}
   5.153+
   5.154+void
   5.155+salsa_setiv(Salsastate *s, uchar *iv)
   5.156+{
   5.157+	if(s->ivwords == 128/32){
   5.158+		/* hsalsa 128-bit iv */
   5.159+		load(&s->input[6], iv, 4);
   5.160+		return;
   5.161+	}
   5.162+	if(s->ivwords == 192/32){
   5.163+		/* xsalsa with 192-bit iv */
   5.164+		u32int counter[2];
   5.165+		uchar h[32];
   5.166+
   5.167+		counter[0] = s->input[8];
   5.168+		counter[1] = s->input[9];
   5.169+
   5.170+		s->input[1] = s->key[0];
   5.171+		s->input[2] = s->key[1];
   5.172+		s->input[3] = s->key[2];
   5.173+		s->input[4] = s->key[3];
   5.174+		s->input[11] = s->key[4];
   5.175+		s->input[12] = s->key[5];
   5.176+		s->input[13] = s->key[6];
   5.177+		s->input[14] = s->key[7];
   5.178+
   5.179+		load(&s->input[6], iv, 4);
   5.180+
   5.181+		hsalsablock(h, s);
   5.182+		load(&s->input[1],  h+16*0, 4);
   5.183+		load(&s->input[11], h+16*1, 4);
   5.184+		memset(h, 0, 32);
   5.185+
   5.186+		s->input[8] = counter[0];
   5.187+		s->input[9] = counter[1];
   5.188+
   5.189+		iv += 16;
   5.190+	}
   5.191+	/* 64-bit iv */
   5.192+	load(&s->input[6], iv, 2);
   5.193+}
   5.194+
   5.195+void
   5.196+salsa_setblock(Salsastate *s, u64int blockno)
   5.197+{
   5.198+	s->input[8] = blockno;
   5.199+	s->input[9] = blockno>>32;
   5.200+}
   5.201+
   5.202+static void
   5.203+encryptblock(Salsastate *s, uchar *src, uchar *dst)
   5.204+{
   5.205+	u32int x[Blockwords], t;
   5.206+	int i, rounds;
   5.207+
   5.208+	rounds = s->rounds;
   5.209+	x[0] = s->input[0];
   5.210+	x[1] = s->input[1];
   5.211+	x[2] = s->input[2];
   5.212+	x[3] = s->input[3];
   5.213+	x[4] = s->input[4];
   5.214+	x[5] = s->input[5];
   5.215+	x[6] = s->input[6];
   5.216+	x[7] = s->input[7];
   5.217+	x[8] = s->input[8];
   5.218+	x[9] = s->input[9];
   5.219+	x[10] = s->input[10];
   5.220+	x[11] = s->input[11];
   5.221+	x[12] = s->input[12];
   5.222+	x[13] = s->input[13];
   5.223+	x[14] = s->input[14];
   5.224+	x[15] = s->input[15];
   5.225+
   5.226+	for(i = rounds; i > 0; i -= 2) {
   5.227+	     x[4] ^= ROTATE( x[0]+x[12], 7);
   5.228+	     x[8] ^= ROTATE( x[4]+ x[0], 9);
   5.229+	    x[12] ^= ROTATE( x[8]+ x[4],13);
   5.230+	     x[0] ^= ROTATE(x[12]+ x[8],18);
   5.231+	     x[9] ^= ROTATE( x[5]+ x[1], 7);
   5.232+	    x[13] ^= ROTATE( x[9]+ x[5], 9);
   5.233+	     x[1] ^= ROTATE(x[13]+ x[9],13);
   5.234+	     x[5] ^= ROTATE( x[1]+x[13],18);
   5.235+	    x[14] ^= ROTATE(x[10]+ x[6], 7);
   5.236+	     x[2] ^= ROTATE(x[14]+x[10], 9);
   5.237+	     x[6] ^= ROTATE( x[2]+x[14],13);
   5.238+	    x[10] ^= ROTATE( x[6]+ x[2],18);
   5.239+	     x[3] ^= ROTATE(x[15]+x[11], 7);
   5.240+	     x[7] ^= ROTATE( x[3]+x[15], 9);
   5.241+	    x[11] ^= ROTATE( x[7]+ x[3],13);
   5.242+	    x[15] ^= ROTATE(x[11]+ x[7],18);
   5.243+	     x[1] ^= ROTATE( x[0]+ x[3], 7);
   5.244+	     x[2] ^= ROTATE( x[1]+ x[0], 9);
   5.245+	     x[3] ^= ROTATE( x[2]+ x[1],13);
   5.246+	     x[0] ^= ROTATE( x[3]+ x[2],18);
   5.247+	     x[6] ^= ROTATE( x[5]+ x[4], 7);
   5.248+	     x[7] ^= ROTATE( x[6]+ x[5], 9);
   5.249+	     x[4] ^= ROTATE( x[7]+ x[6],13);
   5.250+	     x[5] ^= ROTATE( x[4]+ x[7],18);
   5.251+	    x[11] ^= ROTATE(x[10]+ x[9], 7);
   5.252+	     x[8] ^= ROTATE(x[11]+x[10], 9);
   5.253+	     x[9] ^= ROTATE( x[8]+x[11],13);
   5.254+	    x[10] ^= ROTATE( x[9]+ x[8],18);
   5.255+	    x[12] ^= ROTATE(x[15]+x[14], 7);
   5.256+	    x[13] ^= ROTATE(x[12]+x[15], 9);
   5.257+	    x[14] ^= ROTATE(x[13]+x[12],13);
   5.258+	    x[15] ^= ROTATE(x[14]+x[13],18);
   5.259+	}
   5.260+
   5.261+#ifdef FULL_UNROLL
   5.262+	ENCRYPT(src+0*4, x[0], s->input[0], dst+0*4);
   5.263+	ENCRYPT(src+1*4, x[1], s->input[1], dst+1*4);
   5.264+	ENCRYPT(src+2*4, x[2], s->input[2], dst+2*4);
   5.265+	ENCRYPT(src+3*4, x[3], s->input[3], dst+3*4);
   5.266+	ENCRYPT(src+4*4, x[4], s->input[4], dst+4*4);
   5.267+	ENCRYPT(src+5*4, x[5], s->input[5], dst+5*4);
   5.268+	ENCRYPT(src+6*4, x[6], s->input[6], dst+6*4);
   5.269+	ENCRYPT(src+7*4, x[7], s->input[7], dst+7*4);
   5.270+	ENCRYPT(src+8*4, x[8], s->input[8], dst+8*4);
   5.271+	ENCRYPT(src+9*4, x[9], s->input[9], dst+9*4);
   5.272+	ENCRYPT(src+10*4, x[10], s->input[10], dst+10*4);
   5.273+	ENCRYPT(src+11*4, x[11], s->input[11], dst+11*4);
   5.274+	ENCRYPT(src+12*4, x[12], s->input[12], dst+12*4);
   5.275+	ENCRYPT(src+13*4, x[13], s->input[13], dst+13*4);
   5.276+	ENCRYPT(src+14*4, x[14], s->input[14], dst+14*4);
   5.277+	ENCRYPT(src+15*4, x[15], s->input[15], dst+15*4);
   5.278+#else
   5.279+	for(i=0; i<nelem(x); i+=4){
   5.280+		ENCRYPT(src, x[i], s->input[i], dst);
   5.281+		ENCRYPT(src+4, x[i+1], s->input[i+1], dst+4);
   5.282+		ENCRYPT(src+8, x[i+2], s->input[i+2], dst+8);
   5.283+		ENCRYPT(src+12, x[i+3], s->input[i+3], dst+12);
   5.284+		src += 16;
   5.285+		dst += 16;
   5.286+	}
   5.287+#endif
   5.288+
   5.289+	if(++s->input[8] == 0)
   5.290+		s->input[9]++;
   5.291+}
   5.292+
   5.293+void
   5.294+salsa_encrypt2(uchar *src, uchar *dst, ulong bytes, Salsastate *s)
   5.295+{
   5.296+	uchar tmp[SalsaBsize];
   5.297+
   5.298+	for(; bytes >= SalsaBsize; bytes -= SalsaBsize){
   5.299+		encryptblock(s, src, dst);
   5.300+		src += SalsaBsize;
   5.301+		dst += SalsaBsize;
   5.302+	}
   5.303+	if(bytes > 0){
   5.304+		memmove(tmp, src, bytes);
   5.305+		encryptblock(s, tmp, tmp);
   5.306+		memmove(dst, tmp, bytes);
   5.307+	}
   5.308+}
   5.309+
   5.310+void
   5.311+salsa_encrypt(uchar *buf, ulong bytes, Salsastate *s)
   5.312+{
   5.313+	salsa_encrypt2(buf, buf, bytes, s);
   5.314+}
   5.315+
   5.316+void
   5.317+hsalsa(uchar h[32], uchar *key, ulong keylen, uchar nonce[16], int rounds)
   5.318+{
   5.319+	Salsastate s[1];
   5.320+
   5.321+	setupSalsastate(s, key, keylen, nonce, 16, rounds);
   5.322+	hsalsablock(h, s);
   5.323+	memset(s, 0, sizeof(s));
   5.324+}