2 * Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 /* chacha20_poly1305 cipher implementation */
12 #include "internal/endian.h"
13 #include "cipher_chacha20_poly1305.h"
15 static int chacha_poly1305_tls_init(PROV_CIPHER_CTX *bctx,
16 unsigned char *aad, size_t alen)
19 PROV_CHACHA20_POLY1305_CTX *ctx = (PROV_CHACHA20_POLY1305_CTX *)bctx;
21 if (alen != EVP_AEAD_TLS1_AAD_LEN)
24 memcpy(ctx->tls_aad, aad, EVP_AEAD_TLS1_AAD_LEN);
25 len = aad[EVP_AEAD_TLS1_AAD_LEN - 2] << 8 | aad[EVP_AEAD_TLS1_AAD_LEN - 1];
28 if (len < POLY1305_BLOCK_SIZE)
30 len -= POLY1305_BLOCK_SIZE; /* discount attached tag */
31 aad[EVP_AEAD_TLS1_AAD_LEN - 2] = (unsigned char)(len >> 8);
32 aad[EVP_AEAD_TLS1_AAD_LEN - 1] = (unsigned char)len;
34 ctx->tls_payload_length = len;
36 /* merge record sequence number as per RFC7905 */
37 ctx->chacha.counter[1] = ctx->nonce[0];
38 ctx->chacha.counter[2] = ctx->nonce[1] ^ CHACHA_U8TOU32(aad);
39 ctx->chacha.counter[3] = ctx->nonce[2] ^ CHACHA_U8TOU32(aad+4);
42 return POLY1305_BLOCK_SIZE; /* tag length */
45 static int chacha_poly1305_tls_iv_set_fixed(PROV_CIPHER_CTX *bctx,
46 unsigned char *fixed, size_t flen)
48 PROV_CHACHA20_POLY1305_CTX *ctx = (PROV_CHACHA20_POLY1305_CTX *)bctx;
50 if (flen != CHACHA20_POLY1305_IVLEN)
52 ctx->nonce[0] = ctx->chacha.counter[1] = CHACHA_U8TOU32(fixed);
53 ctx->nonce[1] = ctx->chacha.counter[2] = CHACHA_U8TOU32(fixed + 4);
54 ctx->nonce[2] = ctx->chacha.counter[3] = CHACHA_U8TOU32(fixed + 8);
59 static int chacha20_poly1305_initkey(PROV_CIPHER_CTX *bctx,
60 const unsigned char *key, size_t keylen)
62 PROV_CHACHA20_POLY1305_CTX *ctx = (PROV_CHACHA20_POLY1305_CTX *)bctx;
68 ctx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;
71 return chacha20_einit(&ctx->chacha, key, keylen, NULL, 0);
73 return chacha20_dinit(&ctx->chacha, key, keylen, NULL, 0);
76 static int chacha20_poly1305_initiv(PROV_CIPHER_CTX *bctx)
78 PROV_CHACHA20_POLY1305_CTX *ctx = (PROV_CHACHA20_POLY1305_CTX *)bctx;
79 unsigned char tempiv[CHACHA_CTR_SIZE] = { 0 };
83 if (ctx->nonce_len <= CHACHA_CTR_SIZE) {
84 memcpy(tempiv + CHACHA_CTR_SIZE - ctx->nonce_len, bctx->oiv,
88 ret = chacha20_einit(&ctx->chacha, NULL, 0, tempiv, sizeof(tempiv));
90 ret = chacha20_dinit(&ctx->chacha, NULL, 0, tempiv, sizeof(tempiv));
91 ctx->nonce[0] = ctx->chacha.counter[1];
92 ctx->nonce[1] = ctx->chacha.counter[2];
93 ctx->nonce[2] = ctx->chacha.counter[3];
99 #if !defined(OPENSSL_SMALL_FOOTPRINT)
101 # if defined(POLY1305_ASM) && (defined(__x86_64) || defined(__x86_64__) \
102 || defined(_M_AMD64) || defined(_M_X64))
103 # define XOR128_HELPERS
104 void *xor128_encrypt_n_pad(void *out, const void *inp, void *otp, size_t len);
105 void *xor128_decrypt_n_pad(void *out, const void *inp, void *otp, size_t len);
106 static const unsigned char zero[4 * CHACHA_BLK_SIZE] = { 0 };
108 static const unsigned char zero[2 * CHACHA_BLK_SIZE] = { 0 };
111 static int chacha20_poly1305_tls_cipher(PROV_CIPHER_CTX *bctx,
114 const unsigned char *in, size_t len)
116 PROV_CHACHA20_POLY1305_CTX *ctx = (PROV_CHACHA20_POLY1305_CTX *)bctx;
117 POLY1305 *poly = &ctx->poly1305;
118 size_t tail, tohash_len, buf_len, plen = ctx->tls_payload_length;
119 unsigned char *buf, *tohash, *ctr, storage[sizeof(zero) + 32];
123 if (len != plen + POLY1305_BLOCK_SIZE)
126 buf = storage + ((0 - (size_t)storage) & 15); /* align */
127 ctr = buf + CHACHA_BLK_SIZE;
128 tohash = buf + CHACHA_BLK_SIZE - POLY1305_BLOCK_SIZE;
130 # ifdef XOR128_HELPERS
131 if (plen <= 3 * CHACHA_BLK_SIZE) {
132 ctx->chacha.counter[0] = 0;
133 buf_len = (plen + 2 * CHACHA_BLK_SIZE - 1) & (0 - CHACHA_BLK_SIZE);
134 ChaCha20_ctr32(buf, zero, buf_len, ctx->chacha.key.d, ctx->chacha.counter);
135 Poly1305_Init(poly, buf);
136 ctx->chacha.partial_len = 0;
137 memcpy(tohash, ctx->tls_aad, POLY1305_BLOCK_SIZE);
138 tohash_len = POLY1305_BLOCK_SIZE;
139 ctx->len.aad = EVP_AEAD_TLS1_AAD_LEN;
140 ctx->len.text = plen;
144 ctr = xor128_encrypt_n_pad(out, in, ctr, plen);
146 ctr = xor128_decrypt_n_pad(out, in, ctr, plen);
150 tohash_len = (size_t)(ctr - tohash);
154 if (plen <= CHACHA_BLK_SIZE) {
157 ctx->chacha.counter[0] = 0;
158 ChaCha20_ctr32(buf, zero, (buf_len = 2 * CHACHA_BLK_SIZE),
159 ctx->chacha.key.d, ctx->chacha.counter);
160 Poly1305_Init(poly, buf);
161 ctx->chacha.partial_len = 0;
162 memcpy(tohash, ctx->tls_aad, POLY1305_BLOCK_SIZE);
163 tohash_len = POLY1305_BLOCK_SIZE;
164 ctx->len.aad = EVP_AEAD_TLS1_AAD_LEN;
165 ctx->len.text = plen;
168 for (i = 0; i < plen; i++)
169 out[i] = ctr[i] ^= in[i];
171 for (i = 0; i < plen; i++) {
172 unsigned char c = in[i];
182 tail = (0 - i) & (POLY1305_BLOCK_SIZE - 1);
183 memset(ctr + i, 0, tail);
185 tohash_len += i + tail;
189 ctx->chacha.counter[0] = 0;
190 ChaCha20_ctr32(buf, zero, (buf_len = CHACHA_BLK_SIZE),
191 ctx->chacha.key.d, ctx->chacha.counter);
192 Poly1305_Init(poly, buf);
193 ctx->chacha.counter[0] = 1;
194 ctx->chacha.partial_len = 0;
195 Poly1305_Update(poly, ctx->tls_aad, POLY1305_BLOCK_SIZE);
198 ctx->len.aad = EVP_AEAD_TLS1_AAD_LEN;
199 ctx->len.text = plen;
202 ChaCha20_ctr32(out, in, plen, ctx->chacha.key.d, ctx->chacha.counter);
203 Poly1305_Update(poly, out, plen);
205 Poly1305_Update(poly, in, plen);
206 ChaCha20_ctr32(out, in, plen, ctx->chacha.key.d, ctx->chacha.counter);
211 tail = (0 - plen) & (POLY1305_BLOCK_SIZE - 1);
212 Poly1305_Update(poly, zero, tail);
215 if (IS_LITTLE_ENDIAN) {
216 memcpy(ctr, (unsigned char *)&ctx->len, POLY1305_BLOCK_SIZE);
218 ctr[0] = (unsigned char)(ctx->len.aad);
219 ctr[1] = (unsigned char)(ctx->len.aad>>8);
220 ctr[2] = (unsigned char)(ctx->len.aad>>16);
221 ctr[3] = (unsigned char)(ctx->len.aad>>24);
222 ctr[4] = (unsigned char)(ctx->len.aad>>32);
223 ctr[5] = (unsigned char)(ctx->len.aad>>40);
224 ctr[6] = (unsigned char)(ctx->len.aad>>48);
225 ctr[7] = (unsigned char)(ctx->len.aad>>56);
227 ctr[8] = (unsigned char)(ctx->len.text);
228 ctr[9] = (unsigned char)(ctx->len.text>>8);
229 ctr[10] = (unsigned char)(ctx->len.text>>16);
230 ctr[11] = (unsigned char)(ctx->len.text>>24);
231 ctr[12] = (unsigned char)(ctx->len.text>>32);
232 ctr[13] = (unsigned char)(ctx->len.text>>40);
233 ctr[14] = (unsigned char)(ctx->len.text>>48);
234 ctr[15] = (unsigned char)(ctx->len.text>>56);
236 tohash_len += POLY1305_BLOCK_SIZE;
238 Poly1305_Update(poly, tohash, tohash_len);
239 OPENSSL_cleanse(buf, buf_len);
240 Poly1305_Final(poly, bctx->enc ? ctx->tag : tohash);
242 ctx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;
245 memcpy(out, ctx->tag, POLY1305_BLOCK_SIZE);
247 if (CRYPTO_memcmp(tohash, in, POLY1305_BLOCK_SIZE)) {
248 if (len > POLY1305_BLOCK_SIZE)
249 memset(out - (len - POLY1305_BLOCK_SIZE), 0,
250 len - POLY1305_BLOCK_SIZE);
254 len -= POLY1305_BLOCK_SIZE;
261 static const unsigned char zero[CHACHA_BLK_SIZE] = { 0 };
262 #endif /* OPENSSL_SMALL_FOOTPRINT */
264 static int chacha20_poly1305_aead_cipher(PROV_CIPHER_CTX *bctx,
265 unsigned char *out, size_t *outl,
266 const unsigned char *in, size_t inl)
268 PROV_CHACHA20_POLY1305_CTX *ctx = (PROV_CHACHA20_POLY1305_CTX *)bctx;
269 POLY1305 *poly = &ctx->poly1305;
270 size_t rem, plen = ctx->tls_payload_length;
276 if (!ctx->mac_inited) {
277 #if !defined(OPENSSL_SMALL_FOOTPRINT)
278 if (plen != NO_TLS_PAYLOAD_LENGTH && out != NULL) {
279 return chacha20_poly1305_tls_cipher(bctx, out, outl, in, inl);
282 ctx->chacha.counter[0] = 0;
283 ChaCha20_ctr32(ctx->chacha.buf, zero, CHACHA_BLK_SIZE,
284 ctx->chacha.key.d, ctx->chacha.counter);
285 Poly1305_Init(poly, ctx->chacha.buf);
286 ctx->chacha.counter[0] = 1;
287 ctx->chacha.partial_len = 0;
288 ctx->len.aad = ctx->len.text = 0;
290 if (plen != NO_TLS_PAYLOAD_LENGTH) {
291 Poly1305_Update(poly, ctx->tls_aad, EVP_AEAD_TLS1_AAD_LEN);
292 ctx->len.aad = EVP_AEAD_TLS1_AAD_LEN;
297 if (in != NULL) { /* aad or text */
298 if (out == NULL) { /* aad */
299 Poly1305_Update(poly, in, inl);
303 } else { /* plain- or ciphertext */
304 if (ctx->aad) { /* wrap up aad */
305 if ((rem = (size_t)ctx->len.aad % POLY1305_BLOCK_SIZE))
306 Poly1305_Update(poly, zero, POLY1305_BLOCK_SIZE - rem);
310 ctx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;
311 if (plen == NO_TLS_PAYLOAD_LENGTH)
313 else if (inl != plen + POLY1305_BLOCK_SIZE)
316 if (bctx->enc) { /* plaintext */
317 ctx->chacha.base.hw->cipher(&ctx->chacha.base, out, in, plen);
318 Poly1305_Update(poly, out, plen);
321 ctx->len.text += plen;
322 } else { /* ciphertext */
323 Poly1305_Update(poly, in, plen);
324 ctx->chacha.base.hw->cipher(&ctx->chacha.base, out, in, plen);
327 ctx->len.text += plen;
331 /* explicit final, or tls mode */
332 if (in == NULL || inl != plen) {
334 unsigned char temp[POLY1305_BLOCK_SIZE];
336 if (ctx->aad) { /* wrap up aad */
337 if ((rem = (size_t)ctx->len.aad % POLY1305_BLOCK_SIZE))
338 Poly1305_Update(poly, zero, POLY1305_BLOCK_SIZE - rem);
342 if ((rem = (size_t)ctx->len.text % POLY1305_BLOCK_SIZE))
343 Poly1305_Update(poly, zero, POLY1305_BLOCK_SIZE - rem);
345 if (IS_LITTLE_ENDIAN) {
346 Poly1305_Update(poly, (unsigned char *)&ctx->len,
347 POLY1305_BLOCK_SIZE);
349 temp[0] = (unsigned char)(ctx->len.aad);
350 temp[1] = (unsigned char)(ctx->len.aad>>8);
351 temp[2] = (unsigned char)(ctx->len.aad>>16);
352 temp[3] = (unsigned char)(ctx->len.aad>>24);
353 temp[4] = (unsigned char)(ctx->len.aad>>32);
354 temp[5] = (unsigned char)(ctx->len.aad>>40);
355 temp[6] = (unsigned char)(ctx->len.aad>>48);
356 temp[7] = (unsigned char)(ctx->len.aad>>56);
357 temp[8] = (unsigned char)(ctx->len.text);
358 temp[9] = (unsigned char)(ctx->len.text>>8);
359 temp[10] = (unsigned char)(ctx->len.text>>16);
360 temp[11] = (unsigned char)(ctx->len.text>>24);
361 temp[12] = (unsigned char)(ctx->len.text>>32);
362 temp[13] = (unsigned char)(ctx->len.text>>40);
363 temp[14] = (unsigned char)(ctx->len.text>>48);
364 temp[15] = (unsigned char)(ctx->len.text>>56);
365 Poly1305_Update(poly, temp, POLY1305_BLOCK_SIZE);
367 Poly1305_Final(poly, bctx->enc ? ctx->tag : temp);
370 if (in != NULL && inl != plen) {
372 memcpy(out, ctx->tag, POLY1305_BLOCK_SIZE);
374 if (CRYPTO_memcmp(temp, in, POLY1305_BLOCK_SIZE)) {
375 memset(out - plen, 0, plen);
380 else if (!bctx->enc) {
381 if (CRYPTO_memcmp(temp, ctx->tag, ctx->tag_len))
393 static const PROV_CIPHER_HW_CHACHA20_POLY1305 chacha20poly1305_hw =
395 { chacha20_poly1305_initkey, NULL },
396 chacha20_poly1305_aead_cipher,
397 chacha20_poly1305_initiv,
398 chacha_poly1305_tls_init,
399 chacha_poly1305_tls_iv_set_fixed
402 const PROV_CIPHER_HW *PROV_CIPHER_HW_chacha20_poly1305(size_t keybits)
404 return (PROV_CIPHER_HW *)&chacha20poly1305_hw;