chacha20.c File Reference

#include "precomp.h"

Include dependency graph for chacha20.c:

Go to the source code of this file.

Macros
#define	OFFSET_MASK   (((UINT64)1 << 38) - 1)
#define	CHACHA_QUARTERROUND(a, b, c, d)

Functions
VOID SYMCRYPT_CALL	SymCryptChaCha20CryptBlocks (_Inout_ PSYMCRYPT_CHACHA20_STATE pState, _In_reads_(cbData) PCBYTE pbSrc, _Out_writes_(cbData) PBYTE pbDst, SIZE_T cbData)
SYMCRYPT_ERROR SYMCRYPT_CALL	SymCryptChaCha20Init (_Out_ PSYMCRYPT_CHACHA20_STATE pState, _In_reads_(cbKey) PCBYTE pbKey, _In_ SIZE_T cbKey, _In_reads_(cbNonce) PCBYTE pbNonce, SIZE_T cbNonce, UINT64 offset)
VOID SYMCRYPT_CALL	SymCryptChaCha20SetOffset (_Inout_ PSYMCRYPT_CHACHA20_STATE pState, UINT64 offset)
VOID SYMCRYPT_CALL	SymCryptChaCha20Crypt (_Inout_ PSYMCRYPT_CHACHA20_STATE pState, _In_reads_(cbData) PCBYTE pbSrc, _Out_writes_(cbData) PBYTE pbDst, SIZE_T cbData)
VOID SYMCRYPT_CALL	SymCryptChaCha20Selftest (void)

Variables
static const BYTE	chacha20KatAnswer [3] = { 0xb5, 0xe0, 0x54 }

Macro Definition Documentation

CHACHA_QUARTERROUND

#define CHACHA_QUARTERROUND	(		a,
			b,
			c,
			d
	)

Value:

    { \
    a += b; d ^= a; d = ROL32( d, 16 ); \
    c += d; b ^= c; b = ROL32( b, 12 ); \
    a += b; d ^= a; d = ROL32( d, 8 ); \
    c += d; b ^= c; b = ROL32( b, 7 ); \
}

Definition at line 147 of file chacha20.c.

OFFSET_MASK

#define OFFSET_MASK   (((UINT64)1 << 38) - 1)

Definition at line 22 of file chacha20.c.

Function Documentation

SymCryptChaCha20Crypt()

VOID SYMCRYPT_CALL SymCryptChaCha20Crypt	(	_Inout_ PSYMCRYPT_CHACHA20_STATE	pState,
		_In_reads_(cbData) PCBYTE	pbSrc,
		_Out_writes_(cbData) PBYTE	pbDst,
		SIZE_T	cbData
	)

Definition at line 69 of file chacha20.c.

{
    UINT32  blockOffset;
    SIZE_T  nBytes;
 
    blockOffset = pState->offset & 0x3f;
 
    // If the offset is in the middle of the block, we first crypt until the end
    // of the block
    if( blockOffset != 0 )
    {
        if( !pState->keystreamBufferValid )
        {
            // Generate a block of key stream
            SymCryptWipe( &pState->keystream[0], 64 );
            SymCryptChaCha20CryptBlocks(    pState,
                                            &pState->keystream[0],
                                            &pState->keystream[0],
                                            64 );
            pState->offset -= 64;   // Don't update the offset yet
        }
 
        nBytes = 64 - blockOffset;  // # bytes in buffer starting at offset
        if( cbData < nBytes )
        {
            // We don't use the generated block to the end. The buffer will be valid
            // at the end as the offset won't advance beyond the block.
            nBytes = cbData;
            pState->keystreamBufferValid = TRUE;
        } else {
            // We'll use the rest of the generated block. After that the key stream
            // buffer won't be valid as the offset will advance beyond it.
            pState->keystreamBufferValid = FALSE;
        }
 
        SymCryptXorBytes( pbSrc, &pState->keystream[ blockOffset ], pbDst, nBytes );
        pbSrc += nBytes;
        pbDst += nBytes;
        cbData -= nBytes;
        pState->offset += nBytes;
    }
 
    // Here: pbSrc, pbDst, cbData, and pState->offset all in sync
    // and either cbData == 0 or offset is at a block boundary
 
    if( cbData >= 64 )
    {
        nBytes = cbData & ~0x3f;
        SymCryptChaCha20CryptBlocks( pState, pbSrc, pbDst, nBytes );
        pbSrc += nBytes;
        pbDst += nBytes;
        cbData -= nBytes;
    }
 
    if( cbData > 0 )
    {
        // Generate a block of key stream
        SymCryptWipe( &pState->keystream[0], 64 );
        SymCryptChaCha20CryptBlocks(    pState,
                                        &pState->keystream[0],
                                        &pState->keystream[0],
                                        64 );
        pState->offset -= 64;   // Don't update the offset yet
        pState->keystreamBufferValid = TRUE;
 
        SymCryptXorBytes( pbSrc, &pState->keystream[0], pbDst, cbData );
        pState->offset += cbData;
        // The following updates are correct but not needed
        // pbSrc += cbData;
        // pbDst += cbData;
        // cbData -= cbData;
    }
}

Referenced by SymCryptChaCha20Poly1305Decrypt(), SymCryptChaCha20Poly1305Encrypt(), and SymCryptChaCha20Selftest().

SymCryptChaCha20CryptBlocks()

VOID SYMCRYPT_CALL SymCryptChaCha20CryptBlocks	(	_Inout_ PSYMCRYPT_CHACHA20_STATE	pState,
		_In_reads_(cbData) PCBYTE	pbSrc,
		_Out_writes_(cbData) PBYTE	pbDst,
		SIZE_T	cbData
	)

Definition at line 156 of file chacha20.c.

{
    UINT32 counter;
    UINT32 s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, s10, s11, s12, s13, s14, s15;
    int i;
 
    counter = (UINT32)(pState->offset >> 6);
 
    while( cbData >= 64 )
    {
        // Initialize the state
        s0  = 0x61707865;
        s1  = 0x3320646e;
        s2  = 0x79622d32;
        s3  = 0x6b206574;
        s4  = pState->key[0];
        s5  = pState->key[1];
        s6  = pState->key[2];
        s7  = pState->key[3];
        s8  = pState->key[4];
        s9  = pState->key[5];
        s10 = pState->key[6];
        s11 = pState->key[7];
        s12 = counter;
        s13 = pState->nonce[0];
        s14 = pState->nonce[1];
        s15 = pState->nonce[2];
 
        for( i=0; i<10; i++ )
        {
            CHACHA_QUARTERROUND( s0 , s4 , s8 , s12 );
            CHACHA_QUARTERROUND( s1 , s5 , s9 , s13 );
            CHACHA_QUARTERROUND( s2 , s6 , s10, s14 );
            CHACHA_QUARTERROUND( s3 , s7 , s11, s15 );
 
            CHACHA_QUARTERROUND( s0 , s5 , s10, s15 );
            CHACHA_QUARTERROUND( s1 , s6 , s11, s12 );
            CHACHA_QUARTERROUND( s2 , s7 , s8 , s13 );
            CHACHA_QUARTERROUND( s3 , s4 , s9 , s14 );
        }
 
        s0  += 0x61707865;
        s1  += 0x3320646e;
        s2  += 0x79622d32;
        s3  += 0x6b206574;
        s4  += pState->key[0];
        s5  += pState->key[1];
        s6  += pState->key[2];
        s7  += pState->key[3];
        s8  += pState->key[4];
        s9  += pState->key[5];
        s10 += pState->key[6];
        s11 += pState->key[7];
        s12 += counter;
        s13 += pState->nonce[0];
        s14 += pState->nonce[1];
        s15 += pState->nonce[2];
 
        SYMCRYPT_STORE_LSBFIRST32( pbDst +  0, s0  ^ SYMCRYPT_LOAD_LSBFIRST32( pbSrc +  0 ) );
        SYMCRYPT_STORE_LSBFIRST32( pbDst +  4, s1  ^ SYMCRYPT_LOAD_LSBFIRST32( pbSrc +  4 ) );
        SYMCRYPT_STORE_LSBFIRST32( pbDst +  8, s2  ^ SYMCRYPT_LOAD_LSBFIRST32( pbSrc +  8 ) );
        SYMCRYPT_STORE_LSBFIRST32( pbDst + 12, s3  ^ SYMCRYPT_LOAD_LSBFIRST32( pbSrc + 12 ) );
        SYMCRYPT_STORE_LSBFIRST32( pbDst + 16, s4  ^ SYMCRYPT_LOAD_LSBFIRST32( pbSrc + 16 ) );
        SYMCRYPT_STORE_LSBFIRST32( pbDst + 20, s5  ^ SYMCRYPT_LOAD_LSBFIRST32( pbSrc + 20 ) );
        SYMCRYPT_STORE_LSBFIRST32( pbDst + 24, s6  ^ SYMCRYPT_LOAD_LSBFIRST32( pbSrc + 24 ) );
        SYMCRYPT_STORE_LSBFIRST32( pbDst + 28, s7  ^ SYMCRYPT_LOAD_LSBFIRST32( pbSrc + 28 ) );
        SYMCRYPT_STORE_LSBFIRST32( pbDst + 32, s8  ^ SYMCRYPT_LOAD_LSBFIRST32( pbSrc + 32 ) );
        SYMCRYPT_STORE_LSBFIRST32( pbDst + 36, s9  ^ SYMCRYPT_LOAD_LSBFIRST32( pbSrc + 36 ) );
        SYMCRYPT_STORE_LSBFIRST32( pbDst + 40, s10 ^ SYMCRYPT_LOAD_LSBFIRST32( pbSrc + 40 ) );
        SYMCRYPT_STORE_LSBFIRST32( pbDst + 44, s11 ^ SYMCRYPT_LOAD_LSBFIRST32( pbSrc + 44 ) );
        SYMCRYPT_STORE_LSBFIRST32( pbDst + 48, s12 ^ SYMCRYPT_LOAD_LSBFIRST32( pbSrc + 48 ) );
        SYMCRYPT_STORE_LSBFIRST32( pbDst + 52, s13 ^ SYMCRYPT_LOAD_LSBFIRST32( pbSrc + 52 ) );
        SYMCRYPT_STORE_LSBFIRST32( pbDst + 56, s14 ^ SYMCRYPT_LOAD_LSBFIRST32( pbSrc + 56 ) );
        SYMCRYPT_STORE_LSBFIRST32( pbDst + 60, s15 ^ SYMCRYPT_LOAD_LSBFIRST32( pbSrc + 60 ) );
 
        counter ++;
        // If counter overflows then the caller has encrypted more than 256GB of data with a single stream, which is
        // called out as being insecure. It is the caller's responsibility to avoid this!
        pbSrc += 64;
        pbDst += 64;
        cbData -= 64;
        pState->offset += 64;
    }
}

Referenced by SymCryptChaCha20Crypt().

SymCryptChaCha20Init()

SYMCRYPT_ERROR SYMCRYPT_CALL SymCryptChaCha20Init	(	_Out_ PSYMCRYPT_CHACHA20_STATE	pState,
		_In_reads_(cbKey) PCBYTE	pbKey,
		_In_ SIZE_T	cbKey,
		_In_reads_(cbNonce) PCBYTE	pbNonce,
		SIZE_T	cbNonce,
		UINT64	offset
	)

Definition at line 26 of file chacha20.c.

{
    SYMCRYPT_ERROR scError = SYMCRYPT_NO_ERROR;
 
    if (cbKey != 32)
    {
        scError = SYMCRYPT_WRONG_KEY_SIZE;
        goto cleanup;
    }
 
    if (cbNonce != 12)
    {
        scError = SYMCRYPT_WRONG_NONCE_SIZE;
        goto cleanup;
    }
 
    SymCryptLsbFirstToUint32( pbKey, &pState->key[0], 8 );
    SymCryptLsbFirstToUint32( pbNonce, &pState->nonce[0], 3 );
 
    SymCryptChaCha20SetOffset( pState, offset );
 
cleanup:
    return scError;
}

Referenced by SymCryptChaCha20Poly1305Decrypt(), SymCryptChaCha20Poly1305Encrypt(), and SymCryptChaCha20Selftest().

SymCryptChaCha20Selftest()

VOID SYMCRYPT_CALL SymCryptChaCha20Selftest

(

void

)

Definition at line 249 of file chacha20.c.

{
    BYTE buf[3];
    SYMCRYPT_CHACHA20_STATE  state;
 
    SymCryptChaCha20Init(   &state,
                            SymCryptTestKey32, sizeof( SymCryptTestKey32 ),
                            SymCryptTestMsg16, 12,
                            0 );
 
    SymCryptChaCha20Crypt( &state, SymCryptTestMsg3, buf, sizeof( buf ) );
 
    SymCryptInjectError( buf, sizeof( buf ) );
 
    if( memcmp( buf, chacha20KatAnswer, sizeof( buf )) != 0 )
    {
        SymCryptFatal( 'Cha2' );
    }
}

SymCryptChaCha20SetOffset()

VOID SYMCRYPT_CALL SymCryptChaCha20SetOffset	(	_Inout_ PSYMCRYPT_CHACHA20_STATE	pState,
		UINT64	offset
	)

Definition at line 59 of file chacha20.c.

{
    pState->offset = offset;
    pState->keystreamBufferValid = FALSE;
}

Referenced by SymCryptChaCha20Init(), SymCryptChaCha20Poly1305Decrypt(), and SymCryptChaCha20Poly1305Encrypt().

Variable Documentation

chacha20KatAnswer

const BYTE chacha20KatAnswer[3] = { 0xb5, 0xe0, 0x54 }

static

Definition at line 245 of file chacha20.c.

Referenced by SymCryptChaCha20Selftest().