/src/openssl/crypto/evp/e_chacha20_poly1305.c

Source (jump to first uncovered line)
/*
 * Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the OpenSSL license (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include <stdio.h>
#include "internal/cryptlib.h"

#ifndef OPENSSL_NO_CHACHA

# include <openssl/evp.h>
# include <openssl/objects.h>
# include "evp_locl.h"
# include "internal/evp_int.h"
# include "internal/chacha.h"

typedef struct {
    union {
        double align;   /* this ensures even sizeof(EVP_CHACHA_KEY)%8==0 */
        unsigned int d[CHACHA_KEY_SIZE / 4];
    } key;
    unsigned int  counter[CHACHA_CTR_SIZE / 4];
    unsigned char buf[CHACHA_BLK_SIZE];
    unsigned int  partial_len;
} EVP_CHACHA_KEY;

#define data(ctx)   ((EVP_CHACHA_KEY *)(ctx)->cipher_data)

static int chacha_init_key(EVP_CIPHER_CTX *ctx,
                           const unsigned char user_key[CHACHA_KEY_SIZE],
                           const unsigned char iv[CHACHA_CTR_SIZE], int enc)
{
    EVP_CHACHA_KEY *key = data(ctx);
    unsigned int i;

    if (user_key)
        for (i = 0; i < CHACHA_KEY_SIZE; i+=4) {
            key->key.d[i/4] = CHACHA_U8TOU32(user_key+i);
        }

    if (iv)
        for (i = 0; i < CHACHA_CTR_SIZE; i+=4) {
            key->counter[i/4] = CHACHA_U8TOU32(iv+i);
        }

    key->partial_len = 0;

    return 1;
}

static int chacha_cipher(EVP_CIPHER_CTX * ctx, unsigned char *out,
                         const unsigned char *inp, size_t len)
{
    EVP_CHACHA_KEY *key = data(ctx);
    unsigned int n, rem, ctr32;

    if ((n = key->partial_len)) {
        while (len && n < CHACHA_BLK_SIZE) {
            *out++ = *inp++ ^ key->buf[n++];
            len--;
        }
        key->partial_len = n;

        if (len == 0)
            return 1;

        if (n == CHACHA_BLK_SIZE) {
            key->partial_len = 0;
            key->counter[0]++;
            if (key->counter[0] == 0)
                key->counter[1]++;
        }
    }

    rem = (unsigned int)(len % CHACHA_BLK_SIZE);
    len -= rem;
    ctr32 = key->counter[0];
    while (len >= CHACHA_BLK_SIZE) {
        size_t blocks = len / CHACHA_BLK_SIZE;
        /*
         * 1<<28 is just a not-so-small yet not-so-large number...
         * Below condition is practically never met, but it has to
         * be checked for code correctness.
         */
        if (sizeof(size_t)>sizeof(unsigned int) && blocks>(1U<<28))
            blocks = (1U<<28);

        /*
         * As ChaCha20_ctr32 operates on 32-bit counter, caller
         * has to handle overflow. 'if' below detects the
         * overflow, which is then handled by limiting the
         * amount of blocks to the exact overflow point...
         */
        ctr32 += (unsigned int)blocks;
        if (ctr32 < blocks) {
            blocks -= ctr32;
            ctr32 = 0;
        }
        blocks *= CHACHA_BLK_SIZE;
        ChaCha20_ctr32(out, inp, blocks, key->key.d, key->counter);
        len -= blocks;
        inp += blocks;
        out += blocks;

        key->counter[0] = ctr32;
        if (ctr32 == 0) key->counter[1]++;
    }

    if (rem) {
        memset(key->buf, 0, sizeof(key->buf));
        ChaCha20_ctr32(key->buf, key->buf, CHACHA_BLK_SIZE,
                       key->key.d, key->counter);
        for (n = 0; n < rem; n++)
            out[n] = inp[n] ^ key->buf[n];
        key->partial_len = rem;
    }

    return 1;
}

static const EVP_CIPHER chacha20 = {
    NID_chacha20,
    1,                      /* block_size */
    CHACHA_KEY_SIZE,        /* key_len */
    CHACHA_CTR_SIZE,        /* iv_len, 128-bit counter in the context */
    EVP_CIPH_CUSTOM_IV | EVP_CIPH_ALWAYS_CALL_INIT,
    chacha_init_key,
    chacha_cipher,
    NULL,
    sizeof(EVP_CHACHA_KEY),
    NULL,
    NULL,
    NULL,
    NULL
};

const EVP_CIPHER *EVP_chacha20(void)
{
    return &chacha20;
}

# ifndef OPENSSL_NO_POLY1305
#  include "internal/poly1305.h"

typedef struct {
    EVP_CHACHA_KEY key;
    unsigned int nonce[12/4];
    unsigned char tag[POLY1305_BLOCK_SIZE];
    unsigned char tls_aad[POLY1305_BLOCK_SIZE];
    struct { uint64_t aad, text; } len;
    int aad, mac_inited, tag_len, nonce_len;
    size_t tls_payload_length;
} EVP_CHACHA_AEAD_CTX;

#  define NO_TLS_PAYLOAD_LENGTH ((size_t)-1)
#  define aead_data(ctx)        ((EVP_CHACHA_AEAD_CTX *)(ctx)->cipher_data)
#  define POLY1305_ctx(actx)    ((POLY1305 *)(actx + 1))

static int chacha20_poly1305_init_key(EVP_CIPHER_CTX *ctx,
                                      const unsigned char *inkey,
                                      const unsigned char *iv, int enc)
{
    EVP_CHACHA_AEAD_CTX *actx = aead_data(ctx);

    if (!inkey && !iv)
        return 1;

    actx->len.aad = 0;
    actx->len.text = 0;
    actx->aad = 0;
    actx->mac_inited = 0;
    actx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;

    if (iv != NULL) {
        unsigned char temp[CHACHA_CTR_SIZE] = { 0 };

        /* pad on the left */
        if (actx->nonce_len <= CHACHA_CTR_SIZE)
            memcpy(temp + CHACHA_CTR_SIZE - actx->nonce_len, iv,
                   actx->nonce_len);

        chacha_init_key(ctx, inkey, temp, enc);

        actx->nonce[0] = actx->key.counter[1];
        actx->nonce[1] = actx->key.counter[2];
        actx->nonce[2] = actx->key.counter[3];
    } else {
        chacha_init_key(ctx, inkey, NULL, enc);
    }

    return 1;
}

#  if !defined(OPENSSL_SMALL_FOOTPRINT)

#   if defined(POLY1305_ASM) && (defined(__x86_64) || defined(__x86_64__) || \
                                 defined(_M_AMD64) || defined(_M_X64))
#    define XOR128_HELPERS
void *xor128_encrypt_n_pad(void *out, const void *inp, void *otp, size_t len);
void *xor128_decrypt_n_pad(void *out, const void *inp, void *otp, size_t len);
static const unsigned char zero[4 * CHACHA_BLK_SIZE] = { 0 };
#   else
static const unsigned char zero[2 * CHACHA_BLK_SIZE] = { 0 };
#   endif

static int chacha20_poly1305_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
                                        const unsigned char *in, size_t len)
{
    EVP_CHACHA_AEAD_CTX *actx = aead_data(ctx);
    size_t tail, tohash_len, buf_len, plen = actx->tls_payload_length;
    unsigned char *buf, *tohash, *ctr, storage[sizeof(zero) + 32];

    if (len != plen + POLY1305_BLOCK_SIZE)
        return -1;

    buf = storage + ((0 - (size_t)storage) & 15);   /* align */
    ctr = buf + CHACHA_BLK_SIZE;
    tohash = buf + CHACHA_BLK_SIZE - POLY1305_BLOCK_SIZE;

#   ifdef XOR128_HELPERS
    if (plen <= 3 * CHACHA_BLK_SIZE) {
        actx->key.counter[0] = 0;
        buf_len = (plen + 2 * CHACHA_BLK_SIZE - 1) & (0 - CHACHA_BLK_SIZE);
        ChaCha20_ctr32(buf, zero, buf_len, actx->key.key.d,
                       actx->key.counter);
        Poly1305_Init(POLY1305_ctx(actx), buf);
        actx->key.partial_len = 0;
        memcpy(tohash, actx->tls_aad, POLY1305_BLOCK_SIZE);
        tohash_len = POLY1305_BLOCK_SIZE;
        actx->len.aad = EVP_AEAD_TLS1_AAD_LEN;
        actx->len.text = plen;

        if (plen) {
            if (ctx->encrypt)
                ctr = xor128_encrypt_n_pad(out, in, ctr, plen);
            else
                ctr = xor128_decrypt_n_pad(out, in, ctr, plen);

            in += plen;
            out += plen;
            tohash_len = (size_t)(ctr - tohash);
        }
    }
#   else
    if (plen <= CHACHA_BLK_SIZE) {
        size_t i;

        actx->key.counter[0] = 0;
        ChaCha20_ctr32(buf, zero, (buf_len = 2 * CHACHA_BLK_SIZE),
                       actx->key.key.d, actx->key.counter);
        Poly1305_Init(POLY1305_ctx(actx), buf);
        actx->key.partial_len = 0;
        memcpy(tohash, actx->tls_aad, POLY1305_BLOCK_SIZE);
        tohash_len = POLY1305_BLOCK_SIZE;
        actx->len.aad = EVP_AEAD_TLS1_AAD_LEN;
        actx->len.text = plen;

        if (ctx->encrypt) {
            for (i = 0; i < plen; i++) {
                out[i] = ctr[i] ^= in[i];
            }
        } else {
            for (i = 0; i < plen; i++) {
                unsigned char c = in[i];
                out[i] = ctr[i] ^ c;
                ctr[i] = c;
            }
        }

        in += i;
        out += i;

        tail = (0 - i) & (POLY1305_BLOCK_SIZE - 1);
        memset(ctr + i, 0, tail);
        ctr += i + tail;
        tohash_len += i + tail;
    }
#   endif
    else {
        actx->key.counter[0] = 0;
        ChaCha20_ctr32(buf, zero, (buf_len = CHACHA_BLK_SIZE),
                       actx->key.key.d, actx->key.counter);
        Poly1305_Init(POLY1305_ctx(actx), buf);
        actx->key.counter[0] = 1;
        actx->key.partial_len = 0;
        Poly1305_Update(POLY1305_ctx(actx), actx->tls_aad, POLY1305_BLOCK_SIZE);
        tohash = ctr;
        tohash_len = 0;
        actx->len.aad = EVP_AEAD_TLS1_AAD_LEN;
        actx->len.text = plen;

        if (ctx->encrypt) {
            ChaCha20_ctr32(out, in, plen, actx->key.key.d, actx->key.counter);
            Poly1305_Update(POLY1305_ctx(actx), out, plen);
        } else {
            Poly1305_Update(POLY1305_ctx(actx), in, plen);
            ChaCha20_ctr32(out, in, plen, actx->key.key.d, actx->key.counter);
        }

        in += plen;
        out += plen;
        tail = (0 - plen) & (POLY1305_BLOCK_SIZE - 1);
        Poly1305_Update(POLY1305_ctx(actx), zero, tail);
    }

    {
        const union {
            long one;
            char little;
        } is_endian = { 1 };

        if (is_endian.little) {
            memcpy(ctr, (unsigned char *)&actx->len, POLY1305_BLOCK_SIZE);
        } else {
            ctr[0]  = (unsigned char)(actx->len.aad);
            ctr[1]  = (unsigned char)(actx->len.aad>>8);
            ctr[2]  = (unsigned char)(actx->len.aad>>16);
            ctr[3]  = (unsigned char)(actx->len.aad>>24);
            ctr[4]  = (unsigned char)(actx->len.aad>>32);
            ctr[5]  = (unsigned char)(actx->len.aad>>40);
            ctr[6]  = (unsigned char)(actx->len.aad>>48);
            ctr[7]  = (unsigned char)(actx->len.aad>>56);

            ctr[8]  = (unsigned char)(actx->len.text);
            ctr[9]  = (unsigned char)(actx->len.text>>8);
            ctr[10] = (unsigned char)(actx->len.text>>16);
            ctr[11] = (unsigned char)(actx->len.text>>24);
            ctr[12] = (unsigned char)(actx->len.text>>32);
            ctr[13] = (unsigned char)(actx->len.text>>40);
            ctr[14] = (unsigned char)(actx->len.text>>48);
            ctr[15] = (unsigned char)(actx->len.text>>56);
        }
        tohash_len += POLY1305_BLOCK_SIZE;
    }

    Poly1305_Update(POLY1305_ctx(actx), tohash, tohash_len);
    OPENSSL_cleanse(buf, buf_len);
    Poly1305_Final(POLY1305_ctx(actx), ctx->encrypt ? actx->tag
                                                    : tohash);

    actx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;

    if (ctx->encrypt) {
        memcpy(out, actx->tag, POLY1305_BLOCK_SIZE);
    } else {
        if (CRYPTO_memcmp(tohash, in, POLY1305_BLOCK_SIZE)) {
            memset(out - (len - POLY1305_BLOCK_SIZE), 0,
                   len - POLY1305_BLOCK_SIZE);
            return -1;
        }
    }

    return len;
}
#  else
static const unsigned char zero[CHACHA_BLK_SIZE] = { 0 };
#  endif

static int chacha20_poly1305_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
                                    const unsigned char *in, size_t len)
{
    EVP_CHACHA_AEAD_CTX *actx = aead_data(ctx);
    size_t rem, plen = actx->tls_payload_length;

    if (!actx->mac_inited) {
#  if !defined(OPENSSL_SMALL_FOOTPRINT)
        if (plen != NO_TLS_PAYLOAD_LENGTH && out != NULL)
            return chacha20_poly1305_tls_cipher(ctx, out, in, len);
#  endif
        actx->key.counter[0] = 0;
        ChaCha20_ctr32(actx->key.buf, zero, CHACHA_BLK_SIZE,
                       actx->key.key.d, actx->key.counter);
        Poly1305_Init(POLY1305_ctx(actx), actx->key.buf);
        actx->key.counter[0] = 1;
        actx->key.partial_len = 0;
        actx->len.aad = actx->len.text = 0;
        actx->mac_inited = 1;
        if (plen != NO_TLS_PAYLOAD_LENGTH) {
            Poly1305_Update(POLY1305_ctx(actx), actx->tls_aad,
                            EVP_AEAD_TLS1_AAD_LEN);
            actx->len.aad = EVP_AEAD_TLS1_AAD_LEN;
            actx->aad = 1;
        }
    }

    if (in) {                                   /* aad or text */
        if (out == NULL) {                      /* aad */
            Poly1305_Update(POLY1305_ctx(actx), in, len);
            actx->len.aad += len;
            actx->aad = 1;
            return len;
        } else {                                /* plain- or ciphertext */
            if (actx->aad) {                    /* wrap up aad */
                if ((rem = (size_t)actx->len.aad % POLY1305_BLOCK_SIZE))
                    Poly1305_Update(POLY1305_ctx(actx), zero,
                                    POLY1305_BLOCK_SIZE - rem);
                actx->aad = 0;
            }

            actx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;
            if (plen == NO_TLS_PAYLOAD_LENGTH)
                plen = len;
            else if (len != plen + POLY1305_BLOCK_SIZE)
                return -1;

            if (ctx->encrypt) {                 /* plaintext */
                chacha_cipher(ctx, out, in, plen);
                Poly1305_Update(POLY1305_ctx(actx), out, plen);
                in += plen;
                out += plen;
                actx->len.text += plen;
            } else {                            /* ciphertext */
                Poly1305_Update(POLY1305_ctx(actx), in, plen);
                chacha_cipher(ctx, out, in, plen);
                in += plen;
                out += plen;
                actx->len.text += plen;
            }
        }
    }
    if (in == NULL                              /* explicit final */
        || plen != len) {                       /* or tls mode */
        const union {
            long one;
            char little;
        } is_endian = { 1 };
        unsigned char temp[POLY1305_BLOCK_SIZE];

        if (actx->aad) {                        /* wrap up aad */
            if ((rem = (size_t)actx->len.aad % POLY1305_BLOCK_SIZE))
                Poly1305_Update(POLY1305_ctx(actx), zero,
                                POLY1305_BLOCK_SIZE - rem);
            actx->aad = 0;
        }

        if ((rem = (size_t)actx->len.text % POLY1305_BLOCK_SIZE))
            Poly1305_Update(POLY1305_ctx(actx), zero,
                            POLY1305_BLOCK_SIZE - rem);

        if (is_endian.little) {
            Poly1305_Update(POLY1305_ctx(actx),
                            (unsigned char *)&actx->len, POLY1305_BLOCK_SIZE);
        } else {
            temp[0]  = (unsigned char)(actx->len.aad);
            temp[1]  = (unsigned char)(actx->len.aad>>8);
            temp[2]  = (unsigned char)(actx->len.aad>>16);
            temp[3]  = (unsigned char)(actx->len.aad>>24);
            temp[4]  = (unsigned char)(actx->len.aad>>32);
            temp[5]  = (unsigned char)(actx->len.aad>>40);
            temp[6]  = (unsigned char)(actx->len.aad>>48);
            temp[7]  = (unsigned char)(actx->len.aad>>56);

            temp[8]  = (unsigned char)(actx->len.text);
            temp[9]  = (unsigned char)(actx->len.text>>8);
            temp[10] = (unsigned char)(actx->len.text>>16);
            temp[11] = (unsigned char)(actx->len.text>>24);
            temp[12] = (unsigned char)(actx->len.text>>32);
            temp[13] = (unsigned char)(actx->len.text>>40);
            temp[14] = (unsigned char)(actx->len.text>>48);
            temp[15] = (unsigned char)(actx->len.text>>56);

            Poly1305_Update(POLY1305_ctx(actx), temp, POLY1305_BLOCK_SIZE);
        }
        Poly1305_Final(POLY1305_ctx(actx), ctx->encrypt ? actx->tag
                                                        : temp);
        actx->mac_inited = 0;

        if (in != NULL && len != plen) {        /* tls mode */
            if (ctx->encrypt) {
                memcpy(out, actx->tag, POLY1305_BLOCK_SIZE);
            } else {
                if (CRYPTO_memcmp(temp, in, POLY1305_BLOCK_SIZE)) {
                    memset(out - plen, 0, plen);
                    return -1;
                }
            }
        }
        else if (!ctx->encrypt) {
            if (CRYPTO_memcmp(temp, actx->tag, actx->tag_len))
                return -1;
        }
    }
    return len;
}

static int chacha20_poly1305_cleanup(EVP_CIPHER_CTX *ctx)
{
    EVP_CHACHA_AEAD_CTX *actx = aead_data(ctx);
    if (actx)
        OPENSSL_cleanse(ctx->cipher_data, sizeof(*actx) + Poly1305_ctx_size());
    return 1;
}

static int chacha20_poly1305_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg,
                                  void *ptr)
{
    EVP_CHACHA_AEAD_CTX *actx = aead_data(ctx);

    switch(type) {
    case EVP_CTRL_INIT:
        if (actx == NULL)
            actx = ctx->cipher_data
                 = OPENSSL_zalloc(sizeof(*actx) + Poly1305_ctx_size());
        if (actx == NULL) {
            EVPerr(EVP_F_CHACHA20_POLY1305_CTRL, EVP_R_INITIALIZATION_ERROR);
            return 0;
        }
        actx->len.aad = 0;
        actx->len.text = 0;
        actx->aad = 0;
        actx->mac_inited = 0;
        actx->tag_len = 0;
        actx->nonce_len = 12;
        actx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;
        memset(actx->tls_aad, 0, POLY1305_BLOCK_SIZE);
        return 1;

    case EVP_CTRL_COPY:
        if (actx) {
            EVP_CIPHER_CTX *dst = (EVP_CIPHER_CTX *)ptr;

            dst->cipher_data =
                   OPENSSL_memdup(actx, sizeof(*actx) + Poly1305_ctx_size());
            if (dst->cipher_data == NULL) {
                EVPerr(EVP_F_CHACHA20_POLY1305_CTRL, EVP_R_COPY_ERROR);
                return 0;
            }
        }
        return 1;

    case EVP_CTRL_AEAD_SET_IVLEN:
        if (arg <= 0 || arg > CHACHA_CTR_SIZE)
            return 0;
        actx->nonce_len = arg;
        return 1;

    case EVP_CTRL_AEAD_SET_IV_FIXED:
        if (arg != 12)
            return 0;
        actx->nonce[0] = actx->key.counter[1]
                       = CHACHA_U8TOU32((unsigned char *)ptr);
        actx->nonce[1] = actx->key.counter[2]
                       = CHACHA_U8TOU32((unsigned char *)ptr+4);
        actx->nonce[2] = actx->key.counter[3]
                       = CHACHA_U8TOU32((unsigned char *)ptr+8);
        return 1;

    case EVP_CTRL_AEAD_SET_TAG:
        if (arg <= 0 || arg > POLY1305_BLOCK_SIZE)
            return 0;
        if (ptr != NULL) {
            memcpy(actx->tag, ptr, arg);
            actx->tag_len = arg;
        }
        return 1;

    case EVP_CTRL_AEAD_GET_TAG:
        if (arg <= 0 || arg > POLY1305_BLOCK_SIZE || !ctx->encrypt)
            return 0;
        memcpy(ptr, actx->tag, arg);
        return 1;

    case EVP_CTRL_AEAD_TLS1_AAD:
        if (arg != EVP_AEAD_TLS1_AAD_LEN)
            return 0;
        {
            unsigned int len;
            unsigned char *aad = ptr;

            memcpy(actx->tls_aad, ptr, EVP_AEAD_TLS1_AAD_LEN);
            len = aad[EVP_AEAD_TLS1_AAD_LEN - 2] << 8 |
                  aad[EVP_AEAD_TLS1_AAD_LEN - 1];
            aad = actx->tls_aad;
            if (!ctx->encrypt) {
                if (len < POLY1305_BLOCK_SIZE)
                    return 0;
                len -= POLY1305_BLOCK_SIZE;     /* discount attached tag */
                aad[EVP_AEAD_TLS1_AAD_LEN - 2] = (unsigned char)(len >> 8);
                aad[EVP_AEAD_TLS1_AAD_LEN - 1] = (unsigned char)len;
            }
            actx->tls_payload_length = len;

            /*
             * merge record sequence number as per RFC7905
             */
            actx->key.counter[1] = actx->nonce[0];
            actx->key.counter[2] = actx->nonce[1] ^ CHACHA_U8TOU32(aad);
            actx->key.counter[3] = actx->nonce[2] ^ CHACHA_U8TOU32(aad+4);
            actx->mac_inited = 0;

            return POLY1305_BLOCK_SIZE;         /* tag length */
        }

    case EVP_CTRL_AEAD_SET_MAC_KEY:
        /* no-op */
        return 1;

    default:
        return -1;
    }
}

static EVP_CIPHER chacha20_poly1305 = {
    NID_chacha20_poly1305,
    1,                  /* block_size */
    CHACHA_KEY_SIZE,    /* key_len */
    12,                 /* iv_len, 96-bit nonce in the context */
    EVP_CIPH_FLAG_AEAD_CIPHER | EVP_CIPH_CUSTOM_IV |
    EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT |
    EVP_CIPH_CUSTOM_COPY | EVP_CIPH_FLAG_CUSTOM_CIPHER,
    chacha20_poly1305_init_key,
    chacha20_poly1305_cipher,
    chacha20_poly1305_cleanup,
    0,          /* 0 moves context-specific structure allocation to ctrl */
    NULL,       /* set_asn1_parameters */
    NULL,       /* get_asn1_parameters */
    chacha20_poly1305_ctrl,
    NULL        /* app_data */
};

const EVP_CIPHER *EVP_chacha20_poly1305(void)
{
    return(&chacha20_poly1305);
}
# endif
#endif

Coverage Report

Created: 2018-08-29 13:53

Line	Count	Source (jump to first uncovered line)
1		/*
2		* Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
3		*
4		* Licensed under the OpenSSL license (the "License"). You may not use
5		* this file except in compliance with the License. You can obtain a copy
6		* in the file LICENSE in the source distribution or at
7		* https://www.openssl.org/source/license.html
8		*/
9
10		#include <stdio.h>
11		#include "internal/cryptlib.h"
12
13		#ifndef OPENSSL_NO_CHACHA
14
15		# include <openssl/evp.h>
16		# include <openssl/objects.h>
17		# include "evp_locl.h"
18		# include "internal/evp_int.h"
19		# include "internal/chacha.h"
20
21		typedef struct {
22		union {
23		double align; /* this ensures even sizeof(EVP_CHACHA_KEY)%8==0 */
24		unsigned int d[CHACHA_KEY_SIZE / 4];
25		} key;
26		unsigned int counter[CHACHA_CTR_SIZE / 4];
27		unsigned char buf[CHACHA_BLK_SIZE];
28		unsigned int partial_len;
29		} EVP_CHACHA_KEY;
30
31	0	#define data(ctx) ((EVP_CHACHA_KEY *)(ctx)->cipher_data)
32
33		static int chacha_init_key(EVP_CIPHER_CTX *ctx,
34		const unsigned char user_key[CHACHA_KEY_SIZE],
35		const unsigned char iv[CHACHA_CTR_SIZE], int enc)
36	0	{
37	0	EVP_CHACHA_KEY *key = data(ctx);
38	0	unsigned int i;
39	0
40	0	if (user_key)
41	0	for (i = 0; i < CHACHA_KEY_SIZE; i+=4) {
42	0	key->key.d[i/4] = CHACHA_U8TOU32(user_key+i);
43	0	}
44	0
45	0	if (iv)
46	0	for (i = 0; i < CHACHA_CTR_SIZE; i+=4) {
47	0	key->counter[i/4] = CHACHA_U8TOU32(iv+i);
48	0	}
49	0
50	0	key->partial_len = 0;
51	0
52	0	return 1;
53	0	}
54
55		static int chacha_cipher(EVP_CIPHER_CTX * ctx, unsigned char *out,
56		const unsigned char *inp, size_t len)
57	0	{
58	0	EVP_CHACHA_KEY *key = data(ctx);
59	0	unsigned int n, rem, ctr32;
60	0
61	0	if ((n = key->partial_len)) {
62	0	while (len && n < CHACHA_BLK_SIZE) {
63	0	out++ = inp++ ^ key->buf[n++];
64	0	len--;
65	0	}
66	0	key->partial_len = n;
67	0
68	0	if (len == 0)
69	0	return 1;
70	0
71	0	if (n == CHACHA_BLK_SIZE) {
72	0	key->partial_len = 0;
73	0	key->counter[0]++;
74	0	if (key->counter[0] == 0)
75	0	key->counter[1]++;
76	0	}
77	0	}
78	0
79	0	rem = (unsigned int)(len % CHACHA_BLK_SIZE);
80	0	len -= rem;
81	0	ctr32 = key->counter[0];
82	0	while (len >= CHACHA_BLK_SIZE) {
83	0	size_t blocks = len / CHACHA_BLK_SIZE;
84	0	/*
85	0	* 1<<28 is just a not-so-small yet not-so-large number...
86	0	* Below condition is practically never met, but it has to
87	0	* be checked for code correctness.
88	0	*/
89	0	if (sizeof(size_t)>sizeof(unsigned int) && blocks>(1U<<28))
90	0	blocks = (1U<<28);
91	0
92	0	/*
93	0	* As ChaCha20_ctr32 operates on 32-bit counter, caller
94	0	* has to handle overflow. 'if' below detects the
95	0	* overflow, which is then handled by limiting the
96	0	* amount of blocks to the exact overflow point...
97	0	*/
98	0	ctr32 += (unsigned int)blocks;
99	0	if (ctr32 < blocks) {
100	0	blocks -= ctr32;
101	0	ctr32 = 0;
102	0	}
103	0	blocks *= CHACHA_BLK_SIZE;
104	0	ChaCha20_ctr32(out, inp, blocks, key->key.d, key->counter);
105	0	len -= blocks;
106	0	inp += blocks;
107	0	out += blocks;
108	0
109	0	key->counter[0] = ctr32;
110	0	if (ctr32 == 0) key->counter[1]++;
111	0	}
112	0
113	0	if (rem) {
114	0	memset(key->buf, 0, sizeof(key->buf));
115	0	ChaCha20_ctr32(key->buf, key->buf, CHACHA_BLK_SIZE,
116	0	key->key.d, key->counter);
117	0	for (n = 0; n < rem; n++)
118	0	out[n] = inp[n] ^ key->buf[n];
119	0	key->partial_len = rem;
120	0	}
121	0
122	0	return 1;
123	0	}
124
125		static const EVP_CIPHER chacha20 = {
126		NID_chacha20,
127		1, /* block_size */
128		CHACHA_KEY_SIZE, /* key_len */
129		CHACHA_CTR_SIZE, /* iv_len, 128-bit counter in the context */
130		EVP_CIPH_CUSTOM_IV \| EVP_CIPH_ALWAYS_CALL_INIT,
131		chacha_init_key,
132		chacha_cipher,
133		NULL,
134		sizeof(EVP_CHACHA_KEY),
135		NULL,
136		NULL,
137		NULL,
138		NULL
139		};
140
141		const EVP_CIPHER *EVP_chacha20(void)
142	8	{
143	8	return &chacha20;
144	8	}
145
146		# ifndef OPENSSL_NO_POLY1305
147		# include "internal/poly1305.h"
148
149		typedef struct {
150		EVP_CHACHA_KEY key;
151		unsigned int nonce[12/4];
152		unsigned char tag[POLY1305_BLOCK_SIZE];
153		unsigned char tls_aad[POLY1305_BLOCK_SIZE];
154		struct { uint64_t aad, text; } len;
155		int aad, mac_inited, tag_len, nonce_len;
156		size_t tls_payload_length;
157		} EVP_CHACHA_AEAD_CTX;
158
159	0	# define NO_TLS_PAYLOAD_LENGTH ((size_t)-1)
160	0	# define aead_data(ctx) ((EVP_CHACHA_AEAD_CTX *)(ctx)->cipher_data)
161	0	# define POLY1305_ctx(actx) ((POLY1305 *)(actx + 1))
162
163		static int chacha20_poly1305_init_key(EVP_CIPHER_CTX *ctx,
164		const unsigned char *inkey,
165		const unsigned char *iv, int enc)
166	0	{
167	0	EVP_CHACHA_AEAD_CTX *actx = aead_data(ctx);
168	0
169	0	if (!inkey && !iv)
170	0	return 1;
171	0
172	0	actx->len.aad = 0;
173	0	actx->len.text = 0;
174	0	actx->aad = 0;
175	0	actx->mac_inited = 0;
176	0	actx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;
177	0
178	0	if (iv != NULL) {
179	0	unsigned char temp[CHACHA_CTR_SIZE] = { 0 };
180	0
181	0	/* pad on the left */
182	0	if (actx->nonce_len <= CHACHA_CTR_SIZE)
183	0	memcpy(temp + CHACHA_CTR_SIZE - actx->nonce_len, iv,
184	0	actx->nonce_len);
185	0
186	0	chacha_init_key(ctx, inkey, temp, enc);
187	0
188	0	actx->nonce[0] = actx->key.counter[1];
189	0	actx->nonce[1] = actx->key.counter[2];
190	0	actx->nonce[2] = actx->key.counter[3];
191	0	} else {
192	0	chacha_init_key(ctx, inkey, NULL, enc);
193	0	}
194	0
195	0	return 1;
196	0	}
197
198		# if !defined(OPENSSL_SMALL_FOOTPRINT)
199
200		# if defined(POLY1305_ASM) && (defined(__x86_64) \|\| defined(__x86_64__) \|\| \
201		defined(_M_AMD64) \|\| defined(_M_X64))
202		# define XOR128_HELPERS
203		void xor128_encrypt_n_pad(void out, const void inp, void otp, size_t len);
204		void xor128_decrypt_n_pad(void out, const void inp, void otp, size_t len);
205		static const unsigned char zero[4 * CHACHA_BLK_SIZE] = { 0 };
206		# else
207		static const unsigned char zero[2 * CHACHA_BLK_SIZE] = { 0 };
208		# endif
209
210		static int chacha20_poly1305_tls_cipher(EVP_CIPHER_CTX ctx, unsigned char out,
211		const unsigned char *in, size_t len)
212	0	{
213	0	EVP_CHACHA_AEAD_CTX *actx = aead_data(ctx);
214	0	size_t tail, tohash_len, buf_len, plen = actx->tls_payload_length;
215	0	unsigned char buf, tohash, *ctr, storage[sizeof(zero) + 32];
216	0
217	0	if (len != plen + POLY1305_BLOCK_SIZE)
218	0	return -1;
219	0
220	0	buf = storage + ((0 - (size_t)storage) & 15); /* align */
221	0	ctr = buf + CHACHA_BLK_SIZE;
222	0	tohash = buf + CHACHA_BLK_SIZE - POLY1305_BLOCK_SIZE;
223	0
224	0	# ifdef XOR128_HELPERS
225	0	if (plen <= 3 * CHACHA_BLK_SIZE) {
226	0	actx->key.counter[0] = 0;
227	0	buf_len = (plen + 2 * CHACHA_BLK_SIZE - 1) & (0 - CHACHA_BLK_SIZE);
228	0	ChaCha20_ctr32(buf, zero, buf_len, actx->key.key.d,
229	0	actx->key.counter);
230	0	Poly1305_Init(POLY1305_ctx(actx), buf);
231	0	actx->key.partial_len = 0;
232	0	memcpy(tohash, actx->tls_aad, POLY1305_BLOCK_SIZE);
233	0	tohash_len = POLY1305_BLOCK_SIZE;
234	0	actx->len.aad = EVP_AEAD_TLS1_AAD_LEN;
235	0	actx->len.text = plen;
236	0
237	0	if (plen) {
238	0	if (ctx->encrypt)
239	0	ctr = xor128_encrypt_n_pad(out, in, ctr, plen);
240	0	else
241	0	ctr = xor128_decrypt_n_pad(out, in, ctr, plen);
242	0
243	0	in += plen;
244	0	out += plen;
245	0	tohash_len = (size_t)(ctr - tohash);
246	0	}
247	0	}
248		# else
249		if (plen <= CHACHA_BLK_SIZE) {
250		size_t i;
251
252		actx->key.counter[0] = 0;
253		ChaCha20_ctr32(buf, zero, (buf_len = 2 * CHACHA_BLK_SIZE),
254		actx->key.key.d, actx->key.counter);
255		Poly1305_Init(POLY1305_ctx(actx), buf);
256		actx->key.partial_len = 0;
257		memcpy(tohash, actx->tls_aad, POLY1305_BLOCK_SIZE);
258		tohash_len = POLY1305_BLOCK_SIZE;
259		actx->len.aad = EVP_AEAD_TLS1_AAD_LEN;
260		actx->len.text = plen;
261
262		if (ctx->encrypt) {
263		for (i = 0; i < plen; i++) {
264		out[i] = ctr[i] ^= in[i];
265		}
266		} else {
267		for (i = 0; i < plen; i++) {
268		unsigned char c = in[i];
269		out[i] = ctr[i] ^ c;
270		ctr[i] = c;
271		}
272		}
273
274		in += i;
275		out += i;
276
277		tail = (0 - i) & (POLY1305_BLOCK_SIZE - 1);
278		memset(ctr + i, 0, tail);
279		ctr += i + tail;
280		tohash_len += i + tail;
281		}
282		# endif
283	0	else {
284	0	actx->key.counter[0] = 0;
285	0	ChaCha20_ctr32(buf, zero, (buf_len = CHACHA_BLK_SIZE),
286	0	actx->key.key.d, actx->key.counter);
287	0	Poly1305_Init(POLY1305_ctx(actx), buf);
288	0	actx->key.counter[0] = 1;
289	0	actx->key.partial_len = 0;
290	0	Poly1305_Update(POLY1305_ctx(actx), actx->tls_aad, POLY1305_BLOCK_SIZE);
291	0	tohash = ctr;
292	0	tohash_len = 0;
293	0	actx->len.aad = EVP_AEAD_TLS1_AAD_LEN;
294	0	actx->len.text = plen;
295	0
296	0	if (ctx->encrypt) {
297	0	ChaCha20_ctr32(out, in, plen, actx->key.key.d, actx->key.counter);
298	0	Poly1305_Update(POLY1305_ctx(actx), out, plen);
299	0	} else {
300	0	Poly1305_Update(POLY1305_ctx(actx), in, plen);
301	0	ChaCha20_ctr32(out, in, plen, actx->key.key.d, actx->key.counter);
302	0	}
303	0
304	0	in += plen;
305	0	out += plen;
306	0	tail = (0 - plen) & (POLY1305_BLOCK_SIZE - 1);
307	0	Poly1305_Update(POLY1305_ctx(actx), zero, tail);
308	0	}
309	0
310	0	{
311	0	const union {
312	0	long one;
313	0	char little;
314	0	} is_endian = { 1 };
315	0
316	0	if (is_endian.little) {
317	0	memcpy(ctr, (unsigned char *)&actx->len, POLY1305_BLOCK_SIZE);
318	0	} else {
319	0	ctr[0] = (unsigned char)(actx->len.aad);
320	0	ctr[1] = (unsigned char)(actx->len.aad>>8);
321	0	ctr[2] = (unsigned char)(actx->len.aad>>16);
322	0	ctr[3] = (unsigned char)(actx->len.aad>>24);
323	0	ctr[4] = (unsigned char)(actx->len.aad>>32);
324	0	ctr[5] = (unsigned char)(actx->len.aad>>40);
325	0	ctr[6] = (unsigned char)(actx->len.aad>>48);
326	0	ctr[7] = (unsigned char)(actx->len.aad>>56);
327	0
328	0	ctr[8] = (unsigned char)(actx->len.text);
329	0	ctr[9] = (unsigned char)(actx->len.text>>8);
330	0	ctr[10] = (unsigned char)(actx->len.text>>16);
331	0	ctr[11] = (unsigned char)(actx->len.text>>24);
332	0	ctr[12] = (unsigned char)(actx->len.text>>32);
333	0	ctr[13] = (unsigned char)(actx->len.text>>40);
334	0	ctr[14] = (unsigned char)(actx->len.text>>48);
335	0	ctr[15] = (unsigned char)(actx->len.text>>56);
336	0	}
337	0	tohash_len += POLY1305_BLOCK_SIZE;
338	0	}
339	0
340	0	Poly1305_Update(POLY1305_ctx(actx), tohash, tohash_len);
341	0	OPENSSL_cleanse(buf, buf_len);
342	0	Poly1305_Final(POLY1305_ctx(actx), ctx->encrypt ? actx->tag
343	0	: tohash);
344	0
345	0	actx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;
346	0
347	0	if (ctx->encrypt) {
348	0	memcpy(out, actx->tag, POLY1305_BLOCK_SIZE);
349	0	} else {
350	0	if (CRYPTO_memcmp(tohash, in, POLY1305_BLOCK_SIZE)) {
351	0	memset(out - (len - POLY1305_BLOCK_SIZE), 0,
352	0	len - POLY1305_BLOCK_SIZE);
353	0	return -1;
354	0	}
355	0	}
356	0
357	0	return len;
358	0	}
359		# else
360		static const unsigned char zero[CHACHA_BLK_SIZE] = { 0 };
361		# endif
362
363		static int chacha20_poly1305_cipher(EVP_CIPHER_CTX ctx, unsigned char out,
364		const unsigned char *in, size_t len)
365	0	{
366	0	EVP_CHACHA_AEAD_CTX *actx = aead_data(ctx);
367	0	size_t rem, plen = actx->tls_payload_length;
368	0
369	0	if (!actx->mac_inited) {
370	0	# if !defined(OPENSSL_SMALL_FOOTPRINT)
371	0	if (plen != NO_TLS_PAYLOAD_LENGTH && out != NULL)
372	0	return chacha20_poly1305_tls_cipher(ctx, out, in, len);
373	0	# endif
374	0	actx->key.counter[0] = 0;
375	0	ChaCha20_ctr32(actx->key.buf, zero, CHACHA_BLK_SIZE,
376	0	actx->key.key.d, actx->key.counter);
377	0	Poly1305_Init(POLY1305_ctx(actx), actx->key.buf);
378	0	actx->key.counter[0] = 1;
379	0	actx->key.partial_len = 0;
380	0	actx->len.aad = actx->len.text = 0;
381	0	actx->mac_inited = 1;
382	0	if (plen != NO_TLS_PAYLOAD_LENGTH) {
383	0	Poly1305_Update(POLY1305_ctx(actx), actx->tls_aad,
384	0	EVP_AEAD_TLS1_AAD_LEN);
385	0	actx->len.aad = EVP_AEAD_TLS1_AAD_LEN;
386	0	actx->aad = 1;
387	0	}
388	0	}
389	0
390	0	if (in) { /* aad or text */
391	0	if (out == NULL) { /* aad */
392	0	Poly1305_Update(POLY1305_ctx(actx), in, len);
393	0	actx->len.aad += len;
394	0	actx->aad = 1;
395	0	return len;
396	0	} else { /* plain- or ciphertext */
397	0	if (actx->aad) { /* wrap up aad */
398	0	if ((rem = (size_t)actx->len.aad % POLY1305_BLOCK_SIZE))
399	0	Poly1305_Update(POLY1305_ctx(actx), zero,
400	0	POLY1305_BLOCK_SIZE - rem);
401	0	actx->aad = 0;
402	0	}
403	0
404	0	actx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;
405	0	if (plen == NO_TLS_PAYLOAD_LENGTH)
406	0	plen = len;
407	0	else if (len != plen + POLY1305_BLOCK_SIZE)
408	0	return -1;
409	0
410	0	if (ctx->encrypt) { /* plaintext */
411	0	chacha_cipher(ctx, out, in, plen);
412	0	Poly1305_Update(POLY1305_ctx(actx), out, plen);
413	0	in += plen;
414	0	out += plen;
415	0	actx->len.text += plen;
416	0	} else { /* ciphertext */
417	0	Poly1305_Update(POLY1305_ctx(actx), in, plen);
418	0	chacha_cipher(ctx, out, in, plen);
419	0	in += plen;
420	0	out += plen;
421	0	actx->len.text += plen;
422	0	}
423	0	}
424	0	}
425	0	if (in == NULL /* explicit final */
426	0	\|\| plen != len) { /* or tls mode */
427	0	const union {
428	0	long one;
429	0	char little;
430	0	} is_endian = { 1 };
431	0	unsigned char temp[POLY1305_BLOCK_SIZE];
432	0
433	0	if (actx->aad) { /* wrap up aad */
434	0	if ((rem = (size_t)actx->len.aad % POLY1305_BLOCK_SIZE))
435	0	Poly1305_Update(POLY1305_ctx(actx), zero,
436	0	POLY1305_BLOCK_SIZE - rem);
437	0	actx->aad = 0;
438	0	}
439	0
440	0	if ((rem = (size_t)actx->len.text % POLY1305_BLOCK_SIZE))
441	0	Poly1305_Update(POLY1305_ctx(actx), zero,
442	0	POLY1305_BLOCK_SIZE - rem);
443	0
444	0	if (is_endian.little) {
445	0	Poly1305_Update(POLY1305_ctx(actx),
446	0	(unsigned char *)&actx->len, POLY1305_BLOCK_SIZE);
447	0	} else {
448	0	temp[0] = (unsigned char)(actx->len.aad);
449	0	temp[1] = (unsigned char)(actx->len.aad>>8);
450	0	temp[2] = (unsigned char)(actx->len.aad>>16);
451	0	temp[3] = (unsigned char)(actx->len.aad>>24);
452	0	temp[4] = (unsigned char)(actx->len.aad>>32);
453	0	temp[5] = (unsigned char)(actx->len.aad>>40);
454	0	temp[6] = (unsigned char)(actx->len.aad>>48);
455	0	temp[7] = (unsigned char)(actx->len.aad>>56);
456	0
457	0	temp[8] = (unsigned char)(actx->len.text);
458	0	temp[9] = (unsigned char)(actx->len.text>>8);
459	0	temp[10] = (unsigned char)(actx->len.text>>16);
460	0	temp[11] = (unsigned char)(actx->len.text>>24);
461	0	temp[12] = (unsigned char)(actx->len.text>>32);
462	0	temp[13] = (unsigned char)(actx->len.text>>40);
463	0	temp[14] = (unsigned char)(actx->len.text>>48);
464	0	temp[15] = (unsigned char)(actx->len.text>>56);
465	0
466	0	Poly1305_Update(POLY1305_ctx(actx), temp, POLY1305_BLOCK_SIZE);
467	0	}
468	0	Poly1305_Final(POLY1305_ctx(actx), ctx->encrypt ? actx->tag
469	0	: temp);
470	0	actx->mac_inited = 0;
471	0
472	0	if (in != NULL && len != plen) { /* tls mode */
473	0	if (ctx->encrypt) {
474	0	memcpy(out, actx->tag, POLY1305_BLOCK_SIZE);
475	0	} else {
476	0	if (CRYPTO_memcmp(temp, in, POLY1305_BLOCK_SIZE)) {
477	0	memset(out - plen, 0, plen);
478	0	return -1;
479	0	}
480	0	}
481	0	}
482	0	else if (!ctx->encrypt) {
483	0	if (CRYPTO_memcmp(temp, actx->tag, actx->tag_len))
484	0	return -1;
485	0	}
486	0	}
487	0	return len;
488	0	}
489
490		static int chacha20_poly1305_cleanup(EVP_CIPHER_CTX *ctx)
491	0	{
492	0	EVP_CHACHA_AEAD_CTX *actx = aead_data(ctx);
493	0	if (actx)
494	0	OPENSSL_cleanse(ctx->cipher_data, sizeof(*actx) + Poly1305_ctx_size());
495	0	return 1;
496	0	}
497
498		static int chacha20_poly1305_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg,
499		void *ptr)
500	0	{
501	0	EVP_CHACHA_AEAD_CTX *actx = aead_data(ctx);
502	0
503	0	switch(type) {
504	0	case EVP_CTRL_INIT:
505	0	if (actx == NULL)
506	0	actx = ctx->cipher_data
507	0	= OPENSSL_zalloc(sizeof(*actx) + Poly1305_ctx_size());
508	0	if (actx == NULL) {
509	0	EVPerr(EVP_F_CHACHA20_POLY1305_CTRL, EVP_R_INITIALIZATION_ERROR);
510	0	return 0;
511	0	}
512	0	actx->len.aad = 0;
513	0	actx->len.text = 0;
514	0	actx->aad = 0;
515	0	actx->mac_inited = 0;
516	0	actx->tag_len = 0;
517	0	actx->nonce_len = 12;
518	0	actx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;
519	0	memset(actx->tls_aad, 0, POLY1305_BLOCK_SIZE);
520	0	return 1;
521	0
522	0	case EVP_CTRL_COPY:
523	0	if (actx) {
524	0	EVP_CIPHER_CTX dst = (EVP_CIPHER_CTX )ptr;
525	0
526	0	dst->cipher_data =
527	0	OPENSSL_memdup(actx, sizeof(*actx) + Poly1305_ctx_size());
528	0	if (dst->cipher_data == NULL) {
529	0	EVPerr(EVP_F_CHACHA20_POLY1305_CTRL, EVP_R_COPY_ERROR);
530	0	return 0;
531	0	}
532	0	}
533	0	return 1;
534	0
535	0	case EVP_CTRL_AEAD_SET_IVLEN:
536	0	if (arg <= 0 \|\| arg > CHACHA_CTR_SIZE)
537	0	return 0;
538	0	actx->nonce_len = arg;
539	0	return 1;
540	0
541	0	case EVP_CTRL_AEAD_SET_IV_FIXED:
542	0	if (arg != 12)
543	0	return 0;
544	0	actx->nonce[0] = actx->key.counter[1]
545	0	= CHACHA_U8TOU32((unsigned char *)ptr);
546	0	actx->nonce[1] = actx->key.counter[2]
547	0	= CHACHA_U8TOU32((unsigned char *)ptr+4);
548	0	actx->nonce[2] = actx->key.counter[3]
549	0	= CHACHA_U8TOU32((unsigned char *)ptr+8);
550	0	return 1;
551	0
552	0	case EVP_CTRL_AEAD_SET_TAG:
553	0	if (arg <= 0 \|\| arg > POLY1305_BLOCK_SIZE)
554	0	return 0;
555	0	if (ptr != NULL) {
556	0	memcpy(actx->tag, ptr, arg);
557	0	actx->tag_len = arg;
558	0	}
559	0	return 1;
560	0
561	0	case EVP_CTRL_AEAD_GET_TAG:
562	0	if (arg <= 0 \|\| arg > POLY1305_BLOCK_SIZE \|\| !ctx->encrypt)
563	0	return 0;
564	0	memcpy(ptr, actx->tag, arg);
565	0	return 1;
566	0
567	0	case EVP_CTRL_AEAD_TLS1_AAD:
568	0	if (arg != EVP_AEAD_TLS1_AAD_LEN)
569	0	return 0;
570	0	{
571	0	unsigned int len;
572	0	unsigned char *aad = ptr;
573	0
574	0	memcpy(actx->tls_aad, ptr, EVP_AEAD_TLS1_AAD_LEN);
575	0	len = aad[EVP_AEAD_TLS1_AAD_LEN - 2] << 8 \|
576	0	aad[EVP_AEAD_TLS1_AAD_LEN - 1];
577	0	aad = actx->tls_aad;
578	0	if (!ctx->encrypt) {
579	0	if (len < POLY1305_BLOCK_SIZE)
580	0	return 0;
581	0	len -= POLY1305_BLOCK_SIZE; /* discount attached tag */
582	0	aad[EVP_AEAD_TLS1_AAD_LEN - 2] = (unsigned char)(len >> 8);
583	0	aad[EVP_AEAD_TLS1_AAD_LEN - 1] = (unsigned char)len;
584	0	}
585	0	actx->tls_payload_length = len;
586	0
587	0	/*
588	0	* merge record sequence number as per RFC7905
589	0	*/
590	0	actx->key.counter[1] = actx->nonce[0];
591	0	actx->key.counter[2] = actx->nonce[1] ^ CHACHA_U8TOU32(aad);
592	0	actx->key.counter[3] = actx->nonce[2] ^ CHACHA_U8TOU32(aad+4);
593	0	actx->mac_inited = 0;
594	0
595	0	return POLY1305_BLOCK_SIZE; /* tag length */
596	0	}
597	0
598	0	case EVP_CTRL_AEAD_SET_MAC_KEY:
599	0	/* no-op */
600	0	return 1;
601	0
602	0	default:
603	0	return -1;
604	0	}
605	0	}
606
607		static EVP_CIPHER chacha20_poly1305 = {
608		NID_chacha20_poly1305,
609		1, /* block_size */
610		CHACHA_KEY_SIZE, /* key_len */
611		12, /* iv_len, 96-bit nonce in the context */
612		EVP_CIPH_FLAG_AEAD_CIPHER \| EVP_CIPH_CUSTOM_IV \|
613		EVP_CIPH_ALWAYS_CALL_INIT \| EVP_CIPH_CTRL_INIT \|
614		EVP_CIPH_CUSTOM_COPY \| EVP_CIPH_FLAG_CUSTOM_CIPHER,
615		chacha20_poly1305_init_key,
616		chacha20_poly1305_cipher,
617		chacha20_poly1305_cleanup,
618		0, /* 0 moves context-specific structure allocation to ctrl */
619		NULL, /* set_asn1_parameters */
620		NULL, /* get_asn1_parameters */
621		chacha20_poly1305_ctrl,
622		NULL /* app_data */
623		};
624
625		const EVP_CIPHER *EVP_chacha20_poly1305(void)
626	8	{
627	8	return(&chacha20_poly1305);
628	8	}
629		# endif
630		#endif