crypto/chacha20_generic.c

   1 /*
   2  * ChaCha20 256-bit cipher algorithm, RFC7539
   3  *
   4  * Copyright (C) 2015 Martin Willi
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; either version 2 of the License, or
   9  * (at your option) any later version.
  10  */
  11
  12 #include <crypto/algapi.h>
  13 #include <linux/crypto.h>
  14 #include <linux/kernel.h>
  15 #include <linux/module.h>
  16
  17 #define CHACHA20_NONCE_SIZE 16
  18 #define CHACHA20_KEY_SIZE   32
  19 #define CHACHA20_BLOCK_SIZE 64
  20
  21 struct chacha20_ctx {
  22         u32 key[8];
  23 };
  24
  25 static inline u32 rotl32(u32 v, u8 n)
  26 {
  27         return (v << n) | (v >> (sizeof(v) * 8 - n));
  28 }
  29
  30 static inline u32 le32_to_cpuvp(const void *p)
  31 {
  32         return le32_to_cpup(p);
  33 }
  34
  35 static void chacha20_block(u32 *state, void *stream)
  36 {
  37         u32 x[16], *out = stream;
  38         int i;
  39
  40         for (i = 0; i < ARRAY_SIZE(x); i++)
  41                 x[i] = state[i];
  42
  43         for (i = 0; i < 20; i += 2) {
  44                 x[0]  += x[4];    x[12] = rotl32(x[12] ^ x[0],  16);
  45                 x[1]  += x[5];    x[13] = rotl32(x[13] ^ x[1],  16);
  46                 x[2]  += x[6];    x[14] = rotl32(x[14] ^ x[2],  16);
  47                 x[3]  += x[7];    x[15] = rotl32(x[15] ^ x[3],  16);
  48
  49                 x[8]  += x[12];   x[4]  = rotl32(x[4]  ^ x[8],  12);
  50                 x[9]  += x[13];   x[5]  = rotl32(x[5]  ^ x[9],  12);
  51                 x[10] += x[14];   x[6]  = rotl32(x[6]  ^ x[10], 12);
  52                 x[11] += x[15];   x[7]  = rotl32(x[7]  ^ x[11], 12);
  53
  54                 x[0]  += x[4];    x[12] = rotl32(x[12] ^ x[0],   8);
  55                 x[1]  += x[5];    x[13] = rotl32(x[13] ^ x[1],   8);
  56                 x[2]  += x[6];    x[14] = rotl32(x[14] ^ x[2],   8);
  57                 x[3]  += x[7];    x[15] = rotl32(x[15] ^ x[3],   8);
  58
  59                 x[8]  += x[12];   x[4]  = rotl32(x[4]  ^ x[8],   7);
  60                 x[9]  += x[13];   x[5]  = rotl32(x[5]  ^ x[9],   7);
  61                 x[10] += x[14];   x[6]  = rotl32(x[6]  ^ x[10],  7);
  62                 x[11] += x[15];   x[7]  = rotl32(x[7]  ^ x[11],  7);
  63
  64                 x[0]  += x[5];    x[15] = rotl32(x[15] ^ x[0],  16);
  65                 x[1]  += x[6];    x[12] = rotl32(x[12] ^ x[1],  16);
  66                 x[2]  += x[7];    x[13] = rotl32(x[13] ^ x[2],  16);
  67                 x[3]  += x[4];    x[14] = rotl32(x[14] ^ x[3],  16);
  68
  69                 x[10] += x[15];   x[5]  = rotl32(x[5]  ^ x[10], 12);
  70                 x[11] += x[12];   x[6]  = rotl32(x[6]  ^ x[11], 12);
  71                 x[8]  += x[13];   x[7]  = rotl32(x[7]  ^ x[8],  12);
  72                 x[9]  += x[14];   x[4]  = rotl32(x[4]  ^ x[9],  12);
  73
  74                 x[0]  += x[5];    x[15] = rotl32(x[15] ^ x[0],   8);
  75                 x[1]  += x[6];    x[12] = rotl32(x[12] ^ x[1],   8);
  76                 x[2]  += x[7];    x[13] = rotl32(x[13] ^ x[2],   8);
  77                 x[3]  += x[4];    x[14] = rotl32(x[14] ^ x[3],   8);
  78
  79                 x[10] += x[15];   x[5]  = rotl32(x[5]  ^ x[10],  7);
  80                 x[11] += x[12];   x[6]  = rotl32(x[6]  ^ x[11],  7);
  81                 x[8]  += x[13];   x[7]  = rotl32(x[7]  ^ x[8],   7);
  82                 x[9]  += x[14];   x[4]  = rotl32(x[4]  ^ x[9],   7);
  83         }
  84
  85         for (i = 0; i < ARRAY_SIZE(x); i++)
  86                 out[i] = cpu_to_le32(x[i] + state[i]);
  87
  88         state[12]++;
  89 }
  90
  91 static void chacha20_docrypt(u32 *state, u8 *dst, const u8 *src,
  92                              unsigned int bytes)
  93 {
  94         u8 stream[CHACHA20_BLOCK_SIZE];
  95
  96         if (dst != src)
  97                 memcpy(dst, src, bytes);
  98
  99         while (bytes >= CHACHA20_BLOCK_SIZE) {
 100                 chacha20_block(state, stream);
 101                 crypto_xor(dst, stream, CHACHA20_BLOCK_SIZE);
 102                 bytes -= CHACHA20_BLOCK_SIZE;
 103                 dst += CHACHA20_BLOCK_SIZE;
 104         }
 105         if (bytes) {
 106                 chacha20_block(state, stream);
 107                 crypto_xor(dst, stream, bytes);
 108         }
 109 }
 110
 111 static void chacha20_init(u32 *state, struct chacha20_ctx *ctx, u8 *iv)
 112 {
 113         static const char constant[16] = "expand 32-byte k";
 114
 115         state[0]  = le32_to_cpuvp(constant +  0);
 116         state[1]  = le32_to_cpuvp(constant +  4);
 117         state[2]  = le32_to_cpuvp(constant +  8);
 118         state[3]  = le32_to_cpuvp(constant + 12);
 119         state[4]  = ctx->key[0];
 120         state[5]  = ctx->key[1];
 121         state[6]  = ctx->key[2];
 122         state[7]  = ctx->key[3];
 123         state[8]  = ctx->key[4];
 124         state[9]  = ctx->key[5];
 125         state[10] = ctx->key[6];
 126         state[11] = ctx->key[7];
 127         state[12] = le32_to_cpuvp(iv +  0);
 128         state[13] = le32_to_cpuvp(iv +  4);
 129         state[14] = le32_to_cpuvp(iv +  8);
 130         state[15] = le32_to_cpuvp(iv + 12);
 131 }
 132
 133 static int chacha20_setkey(struct crypto_tfm *tfm, const u8 *key,
 134                            unsigned int keysize)
 135 {
 136         struct chacha20_ctx *ctx = crypto_tfm_ctx(tfm);
 137         int i;
 138
 139         if (keysize != CHACHA20_KEY_SIZE)
 140                 return -EINVAL;
 141
 142         for (i = 0; i < ARRAY_SIZE(ctx->key); i++)
 143                 ctx->key[i] = le32_to_cpuvp(key + i * sizeof(u32));
 144
 145         return 0;
 146 }
 147
 148 static int chacha20_crypt(struct blkcipher_desc *desc, struct scatterlist *dst,
 149                           struct scatterlist *src, unsigned int nbytes)
 150 {
 151         struct blkcipher_walk walk;
 152         u32 state[16];
 153         int err;
 154
 155         blkcipher_walk_init(&walk, dst, src, nbytes);
 156         err = blkcipher_walk_virt_block(desc, &walk, CHACHA20_BLOCK_SIZE);
 157
 158         chacha20_init(state, crypto_blkcipher_ctx(desc->tfm), walk.iv);
 159
 160         while (walk.nbytes >= CHACHA20_BLOCK_SIZE) {
 161                 chacha20_docrypt(state, walk.dst.virt.addr, walk.src.virt.addr,
 162                                  rounddown(walk.nbytes, CHACHA20_BLOCK_SIZE));
 163                 err = blkcipher_walk_done(desc, &walk,
 164                                           walk.nbytes % CHACHA20_BLOCK_SIZE);
 165         }
 166
 167         if (walk.nbytes) {
 168                 chacha20_docrypt(state, walk.dst.virt.addr, walk.src.virt.addr,
 169                                  walk.nbytes);
 170                 err = blkcipher_walk_done(desc, &walk, 0);
 171         }
 172
 173         return err;
 174 }
 175
 176 static struct crypto_alg alg = {
 177         .cra_name               = "chacha20",
 178         .cra_driver_name        = "chacha20-generic",
 179         .cra_priority           = 100,
 180         .cra_flags              = CRYPTO_ALG_TYPE_BLKCIPHER,
 181         .cra_blocksize          = 1,
 182         .cra_type               = &crypto_blkcipher_type,
 183         .cra_ctxsize            = sizeof(struct chacha20_ctx),
 184         .cra_alignmask          = sizeof(u32) - 1,
 185         .cra_module             = THIS_MODULE,
 186         .cra_u                  = {
 187                 .blkcipher = {
 188                         .min_keysize    = CHACHA20_KEY_SIZE,
 189                         .max_keysize    = CHACHA20_KEY_SIZE,
 190                         .ivsize         = CHACHA20_NONCE_SIZE,
 191                         .geniv          = "seqiv",
 192                         .setkey         = chacha20_setkey,
 193                         .encrypt        = chacha20_crypt,
 194                         .decrypt        = chacha20_crypt,
 195                 },
 196         },
 197 };
 198
 199 static int __init chacha20_generic_mod_init(void)
 200 {
 201         return crypto_register_alg(&alg);
 202 }
 203
 204 static void __exit chacha20_generic_mod_fini(void)
 205 {
 206         crypto_unregister_alg(&alg);
 207 }
 208
 209 module_init(chacha20_generic_mod_init);
 210 module_exit(chacha20_generic_mod_fini);
 211
 212 MODULE_LICENSE("GPL");
 213 MODULE_AUTHOR("Martin Willi <martin@strongswan.org>");
 214 MODULE_DESCRIPTION("chacha20 cipher algorithm");
 215 MODULE_ALIAS_CRYPTO("chacha20");
 216 MODULE_ALIAS_CRYPTO("chacha20-generic");