Coverage Report

Created: 2020-05-23 13:54

/src/botan/src/lib/stream/chacha/chacha.cpp
Line
Count
Source (jump to first uncovered line)
1
/*
2
* ChaCha
3
* (C) 2014,2018 Jack Lloyd
4
*
5
* Botan is released under the Simplified BSD License (see license.txt)
6
*/
7
8
#include <botan/chacha.h>
9
#include <botan/exceptn.h>
10
#include <botan/loadstor.h>
11
#include <botan/rotate.h>
12
#include <botan/cpuid.h>
13
14
namespace Botan {
15
16
namespace {
17
18
#define CHACHA_QUARTER_ROUND(a, b, c, d) \
19
0
      do {                               \
20
0
      a += b; d ^= a; d = rotl<16>(d);   \
21
0
      c += d; b ^= c; b = rotl<12>(b);   \
22
0
      a += b; d ^= a; d = rotl<8>(d);    \
23
0
      c += d; b ^= c; b = rotl<7>(b);    \
24
0
      } while(0)
25
26
/*
27
* Generate HChaCha cipher stream (for XChaCha IV setup)
28
*/
29
void hchacha(uint32_t output[8], const uint32_t input[16], size_t rounds)
30
0
   {
31
0
   BOTAN_ASSERT(rounds % 2 == 0, "Valid rounds");
32
0
33
0
   uint32_t x00 = input[ 0], x01 = input[ 1], x02 = input[ 2], x03 = input[ 3],
34
0
            x04 = input[ 4], x05 = input[ 5], x06 = input[ 6], x07 = input[ 7],
35
0
            x08 = input[ 8], x09 = input[ 9], x10 = input[10], x11 = input[11],
36
0
            x12 = input[12], x13 = input[13], x14 = input[14], x15 = input[15];
37
0
38
0
   for(size_t i = 0; i != rounds / 2; ++i)
39
0
      {
40
0
      CHACHA_QUARTER_ROUND(x00, x04, x08, x12);
41
0
      CHACHA_QUARTER_ROUND(x01, x05, x09, x13);
42
0
      CHACHA_QUARTER_ROUND(x02, x06, x10, x14);
43
0
      CHACHA_QUARTER_ROUND(x03, x07, x11, x15);
44
0
45
0
      CHACHA_QUARTER_ROUND(x00, x05, x10, x15);
46
0
      CHACHA_QUARTER_ROUND(x01, x06, x11, x12);
47
0
      CHACHA_QUARTER_ROUND(x02, x07, x08, x13);
48
0
      CHACHA_QUARTER_ROUND(x03, x04, x09, x14);
49
0
      }
50
0
51
0
   output[0] = x00;
52
0
   output[1] = x01;
53
0
   output[2] = x02;
54
0
   output[3] = x03;
55
0
   output[4] = x12;
56
0
   output[5] = x13;
57
0
   output[6] = x14;
58
0
   output[7] = x15;
59
0
   }
60
61
}
62
63
ChaCha::ChaCha(size_t rounds) : m_rounds(rounds)
64
117
   {
65
117
   BOTAN_ARG_CHECK(m_rounds == 8 || m_rounds == 12 || m_rounds == 20,
66
117
                   "ChaCha only supports 8, 12 or 20 rounds");
67
117
   }
68
69
std::string ChaCha::provider() const
70
0
   {
71
0
#if defined(BOTAN_HAS_CHACHA_AVX2)
72
0
   if(CPUID::has_avx2())
73
0
      {
74
0
      return "avx2";
75
0
      }
76
0
#endif
77
0
78
0
#if defined(BOTAN_HAS_CHACHA_SIMD32)
79
0
   if(CPUID::has_simd_32())
80
0
      {
81
0
      return "simd32";
82
0
      }
83
0
#endif
84
0
85
0
   return "base";
86
0
   }
87
88
//static
89
void ChaCha::chacha_x8(uint8_t output[64*8], uint32_t input[16], size_t rounds)
90
44.7k
   {
91
44.7k
   BOTAN_ASSERT(rounds % 2 == 0, "Valid rounds");
92
44.7k
93
44.7k
#if defined(BOTAN_HAS_CHACHA_AVX2)
94
44.7k
   if(CPUID::has_avx2())
95
44.7k
      {
96
44.7k
      return ChaCha::chacha_avx2_x8(output, input, rounds);
97
44.7k
      }
98
0
#endif
99
0
100
0
#if defined(BOTAN_HAS_CHACHA_SIMD32)
101
0
   if(CPUID::has_simd_32())
102
0
      {
103
0
      ChaCha::chacha_simd32_x4(output, input, rounds);
104
0
      ChaCha::chacha_simd32_x4(output + 4*64, input, rounds);
105
0
      return;
106
0
      }
107
0
#endif
108
0
109
0
   // TODO interleave rounds
110
0
   for(size_t i = 0; i != 8; ++i)
111
0
      {
112
0
      uint32_t x00 = input[ 0], x01 = input[ 1], x02 = input[ 2], x03 = input[ 3],
113
0
               x04 = input[ 4], x05 = input[ 5], x06 = input[ 6], x07 = input[ 7],
114
0
               x08 = input[ 8], x09 = input[ 9], x10 = input[10], x11 = input[11],
115
0
               x12 = input[12], x13 = input[13], x14 = input[14], x15 = input[15];
116
0
117
0
      for(size_t r = 0; r != rounds / 2; ++r)
118
0
         {
119
0
         CHACHA_QUARTER_ROUND(x00, x04, x08, x12);
120
0
         CHACHA_QUARTER_ROUND(x01, x05, x09, x13);
121
0
         CHACHA_QUARTER_ROUND(x02, x06, x10, x14);
122
0
         CHACHA_QUARTER_ROUND(x03, x07, x11, x15);
123
0
124
0
         CHACHA_QUARTER_ROUND(x00, x05, x10, x15);
125
0
         CHACHA_QUARTER_ROUND(x01, x06, x11, x12);
126
0
         CHACHA_QUARTER_ROUND(x02, x07, x08, x13);
127
0
         CHACHA_QUARTER_ROUND(x03, x04, x09, x14);
128
0
         }
129
0
130
0
      x00 += input[0];
131
0
      x01 += input[1];
132
0
      x02 += input[2];
133
0
      x03 += input[3];
134
0
      x04 += input[4];
135
0
      x05 += input[5];
136
0
      x06 += input[6];
137
0
      x07 += input[7];
138
0
      x08 += input[8];
139
0
      x09 += input[9];
140
0
      x10 += input[10];
141
0
      x11 += input[11];
142
0
      x12 += input[12];
143
0
      x13 += input[13];
144
0
      x14 += input[14];
145
0
      x15 += input[15];
146
0
147
0
      store_le(x00, output + 64 * i + 4 *  0);
148
0
      store_le(x01, output + 64 * i + 4 *  1);
149
0
      store_le(x02, output + 64 * i + 4 *  2);
150
0
      store_le(x03, output + 64 * i + 4 *  3);
151
0
      store_le(x04, output + 64 * i + 4 *  4);
152
0
      store_le(x05, output + 64 * i + 4 *  5);
153
0
      store_le(x06, output + 64 * i + 4 *  6);
154
0
      store_le(x07, output + 64 * i + 4 *  7);
155
0
      store_le(x08, output + 64 * i + 4 *  8);
156
0
      store_le(x09, output + 64 * i + 4 *  9);
157
0
      store_le(x10, output + 64 * i + 4 * 10);
158
0
      store_le(x11, output + 64 * i + 4 * 11);
159
0
      store_le(x12, output + 64 * i + 4 * 12);
160
0
      store_le(x13, output + 64 * i + 4 * 13);
161
0
      store_le(x14, output + 64 * i + 4 * 14);
162
0
      store_le(x15, output + 64 * i + 4 * 15);
163
0
164
0
      input[12]++;
165
0
      input[13] += (input[12] == 0);
166
0
      }
167
0
   }
168
169
#undef CHACHA_QUARTER_ROUND
170
171
/*
172
* Combine cipher stream with message
173
*/
174
void ChaCha::cipher(const uint8_t in[], uint8_t out[], size_t length)
175
151
   {
176
151
   verify_key_set(m_state.empty() == false);
177
151
178
232
   while(length >= m_buffer.size() - m_position)
179
81
      {
180
81
      const size_t available = m_buffer.size() - m_position;
181
81
182
81
      xor_buf(out, in, &m_buffer[m_position], available);
183
81
      chacha_x8(m_buffer.data(), m_state.data(), m_rounds);
184
81
185
81
      length -= available;
186
81
      in += available;
187
81
      out += available;
188
81
      m_position = 0;
189
81
      }
190
151
191
151
   xor_buf(out, in, &m_buffer[m_position], length);
192
151
193
151
   m_position += length;
194
151
   }
195
196
void ChaCha::write_keystream(uint8_t out[], size_t length)
197
474k
   {
198
474k
   verify_key_set(m_state.empty() == false);
199
474k
200
519k
   while(length >= m_buffer.size() - m_position)
201
44.3k
      {
202
44.3k
      const size_t available = m_buffer.size() - m_position;
203
44.3k
204
44.3k
      copy_mem(out, &m_buffer[m_position], available);
205
44.3k
      chacha_x8(m_buffer.data(), m_state.data(), m_rounds);
206
44.3k
207
44.3k
      length -= available;
208
44.3k
      out += available;
209
44.3k
      m_position = 0;
210
44.3k
      }
211
474k
212
474k
   copy_mem(out, &m_buffer[m_position], length);
213
474k
214
474k
   m_position += length;
215
474k
   }
216
217
void ChaCha::initialize_state()
218
277
   {
219
277
   static const uint32_t TAU[] =
220
277
      { 0x61707865, 0x3120646e, 0x79622d36, 0x6b206574 };
221
277
222
277
   static const uint32_t SIGMA[] =
223
277
      { 0x61707865, 0x3320646e, 0x79622d32, 0x6b206574 };
224
277
225
277
   m_state[4] = m_key[0];
226
277
   m_state[5] = m_key[1];
227
277
   m_state[6] = m_key[2];
228
277
   m_state[7] = m_key[3];
229
277
230
277
   if(m_key.size() == 4)
231
0
      {
232
0
      m_state[0] = TAU[0];
233
0
      m_state[1] = TAU[1];
234
0
      m_state[2] = TAU[2];
235
0
      m_state[3] = TAU[3];
236
0
237
0
      m_state[8] = m_key[0];
238
0
      m_state[9] = m_key[1];
239
0
      m_state[10] = m_key[2];
240
0
      m_state[11] = m_key[3];
241
0
      }
242
277
   else
243
277
      {
244
277
      m_state[0] = SIGMA[0];
245
277
      m_state[1] = SIGMA[1];
246
277
      m_state[2] = SIGMA[2];
247
277
      m_state[3] = SIGMA[3];
248
277
249
277
      m_state[8] = m_key[4];
250
277
      m_state[9] = m_key[5];
251
277
      m_state[10] = m_key[6];
252
277
      m_state[11] = m_key[7];
253
277
      }
254
277
255
277
   m_state[12] = 0;
256
277
   m_state[13] = 0;
257
277
   m_state[14] = 0;
258
277
   m_state[15] = 0;
259
277
260
277
   m_position = 0;
261
277
   }
262
263
/*
264
* ChaCha Key Schedule
265
*/
266
void ChaCha::key_schedule(const uint8_t key[], size_t length)
267
124
   {
268
124
   m_key.resize(length / 4);
269
124
   load_le<uint32_t>(m_key.data(), key, m_key.size());
270
124
271
124
   m_state.resize(16);
272
124
273
124
   const size_t chacha_parallelism = 8; // chacha_x8
274
124
   const size_t chacha_block = 64;
275
124
   m_buffer.resize(chacha_parallelism * chacha_block);
276
124
277
124
   set_iv(nullptr, 0);
278
124
   }
279
280
size_t ChaCha::default_iv_length() const
281
0
   {
282
0
   return 24;
283
0
   }
284
285
Key_Length_Specification ChaCha::key_spec() const
286
124
   {
287
124
   return Key_Length_Specification(16, 32, 16);
288
124
   }
289
290
StreamCipher* ChaCha::clone() const
291
0
   {
292
0
   return new ChaCha(m_rounds);
293
0
   }
294
295
bool ChaCha::valid_iv_length(size_t iv_len) const
296
277
   {
297
277
   return (iv_len == 0 || iv_len == 8 || iv_len == 12 || iv_len == 24);
298
277
   }
299
300
void ChaCha::set_iv(const uint8_t iv[], size_t length)
301
277
   {
302
277
   verify_key_set(m_state.empty() == false);
303
277
304
277
   if(!valid_iv_length(length))
305
0
      throw Invalid_IV_Length(name(), length);
306
277
307
277
   initialize_state();
308
277
309
277
   if(length == 0)
310
124
      {
311
124
      // Treat zero length IV same as an all-zero IV
312
124
      m_state[14] = 0;
313
124
      m_state[15] = 0;
314
124
      }
315
153
   else if(length == 8)
316
0
      {
317
0
      m_state[14] = load_le<uint32_t>(iv, 0);
318
0
      m_state[15] = load_le<uint32_t>(iv, 1);
319
0
      }
320
153
   else if(length == 12)
321
153
      {
322
153
      m_state[13] = load_le<uint32_t>(iv, 0);
323
153
      m_state[14] = load_le<uint32_t>(iv, 1);
324
153
      m_state[15] = load_le<uint32_t>(iv, 2);
325
153
      }
326
0
   else if(length == 24)
327
0
      {
328
0
      m_state[12] = load_le<uint32_t>(iv, 0);
329
0
      m_state[13] = load_le<uint32_t>(iv, 1);
330
0
      m_state[14] = load_le<uint32_t>(iv, 2);
331
0
      m_state[15] = load_le<uint32_t>(iv, 3);
332
0
333
0
      secure_vector<uint32_t> hc(8);
334
0
      hchacha(hc.data(), m_state.data(), m_rounds);
335
0
336
0
      m_state[ 4] = hc[0];
337
0
      m_state[ 5] = hc[1];
338
0
      m_state[ 6] = hc[2];
339
0
      m_state[ 7] = hc[3];
340
0
      m_state[ 8] = hc[4];
341
0
      m_state[ 9] = hc[5];
342
0
      m_state[10] = hc[6];
343
0
      m_state[11] = hc[7];
344
0
      m_state[12] = 0;
345
0
      m_state[13] = 0;
346
0
      m_state[14] = load_le<uint32_t>(iv, 4);
347
0
      m_state[15] = load_le<uint32_t>(iv, 5);
348
0
      }
349
277
350
277
   chacha_x8(m_buffer.data(), m_state.data(), m_rounds);
351
277
   m_position = 0;
352
277
   }
353
354
void ChaCha::clear()
355
0
   {
356
0
   zap(m_key);
357
0
   zap(m_state);
358
0
   zap(m_buffer);
359
0
   m_position = 0;
360
0
   }
361
362
std::string ChaCha::name() const
363
0
   {
364
0
   return "ChaCha(" + std::to_string(m_rounds) + ")";
365
0
   }
366
367
void ChaCha::seek(uint64_t offset)
368
0
   {
369
0
   verify_key_set(m_state.empty() == false);
370
0
371
0
   // Find the block offset
372
0
   const uint64_t counter = offset / 64;
373
0
374
0
   uint8_t out[8];
375
0
376
0
   store_le(counter, out);
377
0
378
0
   m_state[12] = load_le<uint32_t>(out, 0);
379
0
   m_state[13] += load_le<uint32_t>(out, 1);
380
0
381
0
   chacha_x8(m_buffer.data(), m_state.data(), m_rounds);
382
0
   m_position = offset % 64;
383
0
   }
384
}