From: Eric Biggers <ebiggers@kernel.org> To: linux-crypto@vger.kernel.org Cc: linux-fscrypt@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, Herbert Xu <herbert@gondor.apana.org.au>, Paul Crowley <paulcrowley@google.com>, Greg Kaiser <gkaiser@google.com>, Michael Halcrow <mhalcrow@google.com>, "Jason A . Donenfeld" <Jason@zx2c4.com>, Samuel Neves <samuel.c.p.neves@gmail.com>, Tomer Ashur <tomer.ashur@esat.kuleuven.be> Subject: [RFC PATCH v2 01/12] crypto: chacha20-generic - add HChaCha20 library function Date: Mon, 15 Oct 2018 10:54:13 -0700 [thread overview] Message-ID: <20181015175424.97147-2-ebiggers@kernel.org> (raw) In-Reply-To: <20181015175424.97147-1-ebiggers@kernel.org> From: Eric Biggers <ebiggers@google.com> Refactor the unkeyed permutation part of chacha20_block() into its own function, then add hchacha20_block() which is the ChaCha equivalent of HSalsa20 and is an intermediate step towards XChaCha20 (see https://cr.yp.to/snuffle/xsalsa-20081128.pdf). HChaCha20 skips the final addition of the initial state, and outputs only certain words of the state. It should not be used for streaming directly. Signed-off-by: Eric Biggers <ebiggers@google.com> --- include/crypto/chacha20.h | 2 ++ lib/chacha20.c | 50 ++++++++++++++++++++++++++++++++++----- 2 files changed, 46 insertions(+), 6 deletions(-) diff --git a/include/crypto/chacha20.h b/include/crypto/chacha20.h index f76302d99e2be..fbec4e6a87890 100644 --- a/include/crypto/chacha20.h +++ b/include/crypto/chacha20.h @@ -19,6 +19,8 @@ struct chacha20_ctx { }; void chacha20_block(u32 *state, u8 *stream); +void hchacha20_block(const u32 *in, u32 *out); + void crypto_chacha20_init(u32 *state, struct chacha20_ctx *ctx, u8 *iv); int crypto_chacha20_setkey(struct crypto_skcipher *tfm, const u8 *key, unsigned int keysize); diff --git a/lib/chacha20.c b/lib/chacha20.c index d907fec6a9ed1..6a484e16171d1 100644 --- a/lib/chacha20.c +++ b/lib/chacha20.c @@ -1,5 +1,5 @@ /* - * ChaCha20 256-bit cipher algorithm, RFC7539 + * The "hash function" used as the core of the ChaCha20 stream cipher (RFC7539) * * Copyright (C) 2015 Martin Willi * @@ -16,14 +16,10 @@ #include <asm/unaligned.h> #include <crypto/chacha20.h> -void chacha20_block(u32 *state, u8 *stream) +static void chacha20_permute(u32 *x) { - u32 x[16]; int i; - for (i = 0; i < ARRAY_SIZE(x); i++) - x[i] = state[i]; - for (i = 0; i < 20; i += 2) { x[0] += x[4]; x[12] = rol32(x[12] ^ x[0], 16); x[1] += x[5]; x[13] = rol32(x[13] ^ x[1], 16); @@ -65,6 +61,25 @@ void chacha20_block(u32 *state, u8 *stream) x[8] += x[13]; x[7] = rol32(x[7] ^ x[8], 7); x[9] += x[14]; x[4] = rol32(x[4] ^ x[9], 7); } +} + +/** + * chacha20_block - generate one keystream block and increment block counter + * @state: input state matrix (16 32-bit words) + * @stream: output keystream block (64 bytes) + * + * This is the ChaCha20 core, a function from 64-byte strings to 64-byte + * strings. The caller has already converted the endianness of the input. This + * function also handles incrementing the block counter in the input matrix. + */ +void chacha20_block(u32 *state, u8 *stream) +{ + u32 x[16]; + int i; + + memcpy(x, state, 64); + + chacha20_permute(x); for (i = 0; i < ARRAY_SIZE(x); i++) put_unaligned_le32(x[i] + state[i], &stream[i * sizeof(u32)]); @@ -72,3 +87,26 @@ void chacha20_block(u32 *state, u8 *stream) state[12]++; } EXPORT_SYMBOL(chacha20_block); + +/** + * hchacha20_block - abbreviated ChaCha20 core, for XChaCha20 + * @in: input state matrix (16 32-bit words) + * @out: output (8 32-bit words) + * + * HChaCha20 is the ChaCha equivalent of HSalsa20 and is an intermediate step + * towards XChaCha20 (see https://cr.yp.to/snuffle/xsalsa-20081128.pdf). + * HChaCha20 skips the final addition of the initial state, and outputs only + * certain words of the state. It should not be used for streaming directly. + */ +void hchacha20_block(const u32 *in, u32 *out) +{ + u32 x[16]; + + memcpy(x, in, 64); + + chacha20_permute(x); + + memcpy(&out[0], &x[0], 16); + memcpy(&out[4], &x[12], 16); +} +EXPORT_SYMBOL(hchacha20_block); -- 2.19.1.331.ge82ca0e54c-goog
WARNING: multiple messages have this Message-ID (diff)
From: ebiggers@kernel.org (Eric Biggers) To: linux-arm-kernel@lists.infradead.org Subject: [RFC PATCH v2 01/12] crypto: chacha20-generic - add HChaCha20 library function Date: Mon, 15 Oct 2018 10:54:13 -0700 [thread overview] Message-ID: <20181015175424.97147-2-ebiggers@kernel.org> (raw) In-Reply-To: <20181015175424.97147-1-ebiggers@kernel.org> From: Eric Biggers <ebiggers@google.com> Refactor the unkeyed permutation part of chacha20_block() into its own function, then add hchacha20_block() which is the ChaCha equivalent of HSalsa20 and is an intermediate step towards XChaCha20 (see https://cr.yp.to/snuffle/xsalsa-20081128.pdf). HChaCha20 skips the final addition of the initial state, and outputs only certain words of the state. It should not be used for streaming directly. Signed-off-by: Eric Biggers <ebiggers@google.com> --- include/crypto/chacha20.h | 2 ++ lib/chacha20.c | 50 ++++++++++++++++++++++++++++++++++----- 2 files changed, 46 insertions(+), 6 deletions(-) diff --git a/include/crypto/chacha20.h b/include/crypto/chacha20.h index f76302d99e2be..fbec4e6a87890 100644 --- a/include/crypto/chacha20.h +++ b/include/crypto/chacha20.h @@ -19,6 +19,8 @@ struct chacha20_ctx { }; void chacha20_block(u32 *state, u8 *stream); +void hchacha20_block(const u32 *in, u32 *out); + void crypto_chacha20_init(u32 *state, struct chacha20_ctx *ctx, u8 *iv); int crypto_chacha20_setkey(struct crypto_skcipher *tfm, const u8 *key, unsigned int keysize); diff --git a/lib/chacha20.c b/lib/chacha20.c index d907fec6a9ed1..6a484e16171d1 100644 --- a/lib/chacha20.c +++ b/lib/chacha20.c @@ -1,5 +1,5 @@ /* - * ChaCha20 256-bit cipher algorithm, RFC7539 + * The "hash function" used as the core of the ChaCha20 stream cipher (RFC7539) * * Copyright (C) 2015 Martin Willi * @@ -16,14 +16,10 @@ #include <asm/unaligned.h> #include <crypto/chacha20.h> -void chacha20_block(u32 *state, u8 *stream) +static void chacha20_permute(u32 *x) { - u32 x[16]; int i; - for (i = 0; i < ARRAY_SIZE(x); i++) - x[i] = state[i]; - for (i = 0; i < 20; i += 2) { x[0] += x[4]; x[12] = rol32(x[12] ^ x[0], 16); x[1] += x[5]; x[13] = rol32(x[13] ^ x[1], 16); @@ -65,6 +61,25 @@ void chacha20_block(u32 *state, u8 *stream) x[8] += x[13]; x[7] = rol32(x[7] ^ x[8], 7); x[9] += x[14]; x[4] = rol32(x[4] ^ x[9], 7); } +} + +/** + * chacha20_block - generate one keystream block and increment block counter + * @state: input state matrix (16 32-bit words) + * @stream: output keystream block (64 bytes) + * + * This is the ChaCha20 core, a function from 64-byte strings to 64-byte + * strings. The caller has already converted the endianness of the input. This + * function also handles incrementing the block counter in the input matrix. + */ +void chacha20_block(u32 *state, u8 *stream) +{ + u32 x[16]; + int i; + + memcpy(x, state, 64); + + chacha20_permute(x); for (i = 0; i < ARRAY_SIZE(x); i++) put_unaligned_le32(x[i] + state[i], &stream[i * sizeof(u32)]); @@ -72,3 +87,26 @@ void chacha20_block(u32 *state, u8 *stream) state[12]++; } EXPORT_SYMBOL(chacha20_block); + +/** + * hchacha20_block - abbreviated ChaCha20 core, for XChaCha20 + * @in: input state matrix (16 32-bit words) + * @out: output (8 32-bit words) + * + * HChaCha20 is the ChaCha equivalent of HSalsa20 and is an intermediate step + * towards XChaCha20 (see https://cr.yp.to/snuffle/xsalsa-20081128.pdf). + * HChaCha20 skips the final addition of the initial state, and outputs only + * certain words of the state. It should not be used for streaming directly. + */ +void hchacha20_block(const u32 *in, u32 *out) +{ + u32 x[16]; + + memcpy(x, in, 64); + + chacha20_permute(x); + + memcpy(&out[0], &x[0], 16); + memcpy(&out[4], &x[12], 16); +} +EXPORT_SYMBOL(hchacha20_block); -- 2.19.1.331.ge82ca0e54c-goog
next prev parent reply other threads:[~2018-10-16 1:42 UTC|newest] Thread overview: 136+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-10-15 17:54 [RFC PATCH v2 00/12] crypto: Adiantum support Eric Biggers 2018-10-15 17:54 ` Eric Biggers 2018-10-15 17:54 ` Eric Biggers [this message] 2018-10-15 17:54 ` [RFC PATCH v2 01/12] crypto: chacha20-generic - add HChaCha20 library function Eric Biggers 2018-10-19 14:13 ` Ard Biesheuvel 2018-10-19 14:13 ` Ard Biesheuvel 2018-10-19 14:13 ` Ard Biesheuvel 2018-10-15 17:54 ` [RFC PATCH v2 02/12] crypto: chacha20-generic - add XChaCha20 support Eric Biggers 2018-10-15 17:54 ` Eric Biggers 2018-10-19 14:24 ` Ard Biesheuvel 2018-10-19 14:24 ` Ard Biesheuvel 2018-10-19 14:24 ` Ard Biesheuvel 2018-10-15 17:54 ` [RFC PATCH v2 03/12] crypto: chacha20-generic - refactor to allow varying number of rounds Eric Biggers 2018-10-15 17:54 ` Eric Biggers 2018-10-19 14:25 ` Ard Biesheuvel 2018-10-19 14:25 ` Ard Biesheuvel 2018-10-19 14:25 ` Ard Biesheuvel 2018-10-15 17:54 ` [RFC PATCH v2 04/12] crypto: chacha - add XChaCha12 support Eric Biggers 2018-10-15 17:54 ` Eric Biggers 2018-10-19 14:34 ` Ard Biesheuvel 2018-10-19 14:34 ` Ard Biesheuvel 2018-10-19 14:34 ` Ard Biesheuvel 2018-10-19 18:28 ` Eric Biggers 2018-10-19 18:28 ` Eric Biggers 2018-10-19 18:28 ` Eric Biggers 2018-10-15 17:54 ` [RFC PATCH v2 05/12] crypto: arm/chacha20 - add XChaCha20 support Eric Biggers 2018-10-15 17:54 ` Eric Biggers 2018-10-20 2:29 ` Ard Biesheuvel 2018-10-20 2:29 ` Ard Biesheuvel 2018-10-20 2:29 ` Ard Biesheuvel 2018-10-15 17:54 ` [RFC PATCH v2 06/12] crypto: arm/chacha20 - refactor to allow varying number of rounds Eric Biggers 2018-10-15 17:54 ` Eric Biggers 2018-10-20 3:35 ` Ard Biesheuvel 2018-10-20 3:35 ` Ard Biesheuvel 2018-10-20 3:35 ` Ard Biesheuvel 2018-10-20 5:26 ` Eric Biggers 2018-10-20 5:26 ` Eric Biggers 2018-10-20 5:26 ` Eric Biggers 2018-10-15 17:54 ` [RFC PATCH v2 07/12] crypto: arm/chacha - add XChaCha12 support Eric Biggers 2018-10-15 17:54 ` Eric Biggers 2018-10-20 3:36 ` Ard Biesheuvel 2018-10-20 3:36 ` Ard Biesheuvel 2018-10-20 3:36 ` Ard Biesheuvel 2018-10-15 17:54 ` [RFC PATCH v2 08/12] crypto: poly1305 - add Poly1305 core API Eric Biggers 2018-10-15 17:54 ` Eric Biggers 2018-10-20 3:45 ` Ard Biesheuvel 2018-10-20 3:45 ` Ard Biesheuvel 2018-10-20 3:45 ` Ard Biesheuvel 2018-10-15 17:54 ` [RFC PATCH v2 09/12] crypto: nhpoly1305 - add NHPoly1305 support Eric Biggers 2018-10-15 17:54 ` Eric Biggers 2018-10-20 4:00 ` Ard Biesheuvel 2018-10-20 4:00 ` Ard Biesheuvel 2018-10-20 4:00 ` Ard Biesheuvel 2018-10-20 5:38 ` Eric Biggers 2018-10-20 5:38 ` Eric Biggers 2018-10-20 5:38 ` Eric Biggers 2018-10-20 15:06 ` Ard Biesheuvel 2018-10-20 15:06 ` Ard Biesheuvel 2018-10-20 15:06 ` Ard Biesheuvel 2018-10-22 18:42 ` Eric Biggers 2018-10-22 18:42 ` Eric Biggers 2018-10-22 18:42 ` Eric Biggers 2018-10-22 22:25 ` Ard Biesheuvel 2018-10-22 22:25 ` Ard Biesheuvel 2018-10-22 22:25 ` Ard Biesheuvel 2018-10-22 22:40 ` Eric Biggers 2018-10-22 22:40 ` Eric Biggers 2018-10-22 22:40 ` Eric Biggers 2018-10-22 22:43 ` Ard Biesheuvel 2018-10-22 22:43 ` Ard Biesheuvel 2018-10-22 22:43 ` Ard Biesheuvel 2018-10-15 17:54 ` [RFC PATCH v2 10/12] crypto: arm/nhpoly1305 - add NEON-accelerated NHPoly1305 Eric Biggers 2018-10-15 17:54 ` Eric Biggers 2018-10-20 4:12 ` Ard Biesheuvel 2018-10-20 4:12 ` Ard Biesheuvel 2018-10-20 4:12 ` Ard Biesheuvel 2018-10-20 5:51 ` Eric Biggers 2018-10-20 5:51 ` Eric Biggers 2018-10-20 5:51 ` Eric Biggers 2018-10-20 15:00 ` Ard Biesheuvel 2018-10-20 15:00 ` Ard Biesheuvel 2018-10-20 15:00 ` Ard Biesheuvel 2018-10-15 17:54 ` [RFC PATCH v2 11/12] crypto: adiantum - add Adiantum support Eric Biggers 2018-10-15 17:54 ` Eric Biggers 2018-10-20 4:17 ` Ard Biesheuvel 2018-10-20 4:17 ` Ard Biesheuvel 2018-10-20 4:17 ` Ard Biesheuvel 2018-10-20 7:12 ` Eric Biggers 2018-10-20 7:12 ` Eric Biggers 2018-10-20 7:12 ` Eric Biggers 2018-10-23 10:40 ` Ard Biesheuvel 2018-10-23 10:40 ` Ard Biesheuvel 2018-10-23 10:40 ` Ard Biesheuvel 2018-10-24 22:06 ` Eric Biggers 2018-10-24 22:06 ` Eric Biggers 2018-10-24 22:06 ` Eric Biggers 2018-10-30 8:17 ` Herbert Xu 2018-10-30 8:17 ` Herbert Xu 2018-10-30 8:17 ` Herbert Xu 2018-10-15 17:54 ` [RFC PATCH v2 12/12] fscrypt: " Eric Biggers 2018-10-15 17:54 ` Eric Biggers 2018-10-19 15:58 ` [RFC PATCH v2 00/12] crypto: " Jason A. Donenfeld 2018-10-19 15:58 ` Jason A. Donenfeld 2018-10-19 18:19 ` Paul Crowley 2018-10-19 18:19 ` Paul Crowley 2018-10-20 3:24 ` Ard Biesheuvel 2018-10-20 3:24 ` Ard Biesheuvel 2018-10-20 3:24 ` Ard Biesheuvel 2018-10-20 5:22 ` Eric Biggers 2018-10-20 5:22 ` Eric Biggers 2018-10-20 5:22 ` Eric Biggers 2018-10-22 10:19 ` Tomer Ashur 2018-10-22 11:20 ` Tomer Ashur 2018-10-22 11:20 ` Tomer Ashur 2018-10-19 19:04 ` Eric Biggers 2018-10-19 19:04 ` Eric Biggers 2018-10-20 10:26 ` Milan Broz 2018-10-20 10:26 ` Milan Broz 2018-10-20 13:47 ` Jason A. Donenfeld 2018-10-20 13:47 ` Jason A. Donenfeld 2018-11-16 21:52 ` Eric Biggers 2018-11-16 21:52 ` Eric Biggers 2018-11-17 10:29 ` Milan Broz 2018-11-17 10:29 ` Milan Broz 2018-11-19 19:28 ` Eric Biggers 2018-11-19 19:28 ` Eric Biggers 2018-11-19 20:05 ` Milan Broz 2018-11-19 20:05 ` Milan Broz 2018-11-19 20:30 ` Jason A. Donenfeld 2018-11-19 20:30 ` Jason A. Donenfeld 2018-10-21 22:23 ` Eric Biggers 2018-10-21 22:23 ` Eric Biggers 2018-10-21 22:51 ` Jason A. Donenfeld 2018-10-21 22:51 ` Jason A. Donenfeld 2018-10-22 17:17 ` Paul Crowley 2018-10-22 17:17 ` Paul Crowley
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20181015175424.97147-2-ebiggers@kernel.org \ --to=ebiggers@kernel.org \ --cc=Jason@zx2c4.com \ --cc=gkaiser@google.com \ --cc=herbert@gondor.apana.org.au \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-crypto@vger.kernel.org \ --cc=linux-fscrypt@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=mhalcrow@google.com \ --cc=paulcrowley@google.com \ --cc=samuel.c.p.neves@gmail.com \ --cc=tomer.ashur@esat.kuleuven.be \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.