| 1 | /* SPDX-License-Identifier: GPL-2.0 */ |
| 2 | /* |
| 3 | * Common values and helper functions for the ChaCha and XChaCha stream ciphers. |
| 4 | * |
| 5 | * XChaCha extends ChaCha's nonce to 192 bits, while provably retaining ChaCha's |
| 6 | * security. Here they share the same key size, tfm context, and setkey |
| 7 | * function; only their IV size and encrypt/decrypt function differ. |
| 8 | * |
| 9 | * The ChaCha paper specifies 20, 12, and 8-round variants. In general, it is |
| 10 | * recommended to use the 20-round variant ChaCha20. However, the other |
| 11 | * variants can be needed in some performance-sensitive scenarios. The generic |
| 12 | * ChaCha code currently allows only the 20 and 12-round variants. |
| 13 | */ |
| 14 | |
| 15 | #ifndef _CRYPTO_CHACHA_H |
| 16 | #define _CRYPTO_CHACHA_H |
| 17 | |
| 18 | #include <linux/unaligned.h> |
| 19 | #include <linux/string.h> |
| 20 | #include <linux/types.h> |
| 21 | |
| 22 | /* 32-bit stream position, then 96-bit nonce (RFC7539 convention) */ |
| 23 | #define CHACHA_IV_SIZE 16 |
| 24 | |
| 25 | #define CHACHA_KEY_SIZE 32 |
| 26 | #define CHACHA_BLOCK_SIZE 64 |
| 27 | #define CHACHAPOLY_IV_SIZE 12 |
| 28 | |
| 29 | #define CHACHA_KEY_WORDS 8 |
| 30 | #define CHACHA_STATE_WORDS 16 |
| 31 | #define HCHACHA_OUT_WORDS 8 |
| 32 | |
| 33 | /* 192-bit nonce, then 64-bit stream position */ |
| 34 | #define XCHACHA_IV_SIZE 32 |
| 35 | |
| 36 | struct chacha_state { |
| 37 | u32 x[CHACHA_STATE_WORDS]; |
| 38 | }; |
| 39 | |
| 40 | void chacha_block_generic(struct chacha_state *state, |
| 41 | u8 out[CHACHA_BLOCK_SIZE], int nrounds); |
| 42 | static inline void chacha20_block(struct chacha_state *state, |
| 43 | u8 out[CHACHA_BLOCK_SIZE]) |
| 44 | { |
| 45 | chacha_block_generic(state, out, nrounds: 20); |
| 46 | } |
| 47 | |
| 48 | void hchacha_block_arch(const struct chacha_state *state, |
| 49 | u32 out[HCHACHA_OUT_WORDS], int nrounds); |
| 50 | void hchacha_block_generic(const struct chacha_state *state, |
| 51 | u32 out[HCHACHA_OUT_WORDS], int nrounds); |
| 52 | |
| 53 | static inline void hchacha_block(const struct chacha_state *state, |
| 54 | u32 out[HCHACHA_OUT_WORDS], int nrounds) |
| 55 | { |
| 56 | if (IS_ENABLED(CONFIG_CRYPTO_ARCH_HAVE_LIB_CHACHA)) |
| 57 | hchacha_block_arch(state, out, nrounds); |
| 58 | else |
| 59 | hchacha_block_generic(state, out, nrounds); |
| 60 | } |
| 61 | |
| 62 | enum chacha_constants { /* expand 32-byte k */ |
| 63 | CHACHA_CONSTANT_EXPA = 0x61707865U, |
| 64 | CHACHA_CONSTANT_ND_3 = 0x3320646eU, |
| 65 | CHACHA_CONSTANT_2_BY = 0x79622d32U, |
| 66 | CHACHA_CONSTANT_TE_K = 0x6b206574U |
| 67 | }; |
| 68 | |
| 69 | static inline void chacha_init_consts(struct chacha_state *state) |
| 70 | { |
| 71 | state->x[0] = CHACHA_CONSTANT_EXPA; |
| 72 | state->x[1] = CHACHA_CONSTANT_ND_3; |
| 73 | state->x[2] = CHACHA_CONSTANT_2_BY; |
| 74 | state->x[3] = CHACHA_CONSTANT_TE_K; |
| 75 | } |
| 76 | |
| 77 | static inline void chacha_init(struct chacha_state *state, |
| 78 | const u32 key[CHACHA_KEY_WORDS], |
| 79 | const u8 iv[CHACHA_IV_SIZE]) |
| 80 | { |
| 81 | chacha_init_consts(state); |
| 82 | state->x[4] = key[0]; |
| 83 | state->x[5] = key[1]; |
| 84 | state->x[6] = key[2]; |
| 85 | state->x[7] = key[3]; |
| 86 | state->x[8] = key[4]; |
| 87 | state->x[9] = key[5]; |
| 88 | state->x[10] = key[6]; |
| 89 | state->x[11] = key[7]; |
| 90 | state->x[12] = get_unaligned_le32(p: iv + 0); |
| 91 | state->x[13] = get_unaligned_le32(p: iv + 4); |
| 92 | state->x[14] = get_unaligned_le32(p: iv + 8); |
| 93 | state->x[15] = get_unaligned_le32(p: iv + 12); |
| 94 | } |
| 95 | |
| 96 | void chacha_crypt_arch(struct chacha_state *state, u8 *dst, const u8 *src, |
| 97 | unsigned int bytes, int nrounds); |
| 98 | void chacha_crypt_generic(struct chacha_state *state, u8 *dst, const u8 *src, |
| 99 | unsigned int bytes, int nrounds); |
| 100 | |
| 101 | static inline void chacha_crypt(struct chacha_state *state, |
| 102 | u8 *dst, const u8 *src, |
| 103 | unsigned int bytes, int nrounds) |
| 104 | { |
| 105 | if (IS_ENABLED(CONFIG_CRYPTO_ARCH_HAVE_LIB_CHACHA)) |
| 106 | chacha_crypt_arch(state, dst, src, bytes, nrounds); |
| 107 | else |
| 108 | chacha_crypt_generic(state, dst, src, bytes, nrounds); |
| 109 | } |
| 110 | |
| 111 | static inline void chacha20_crypt(struct chacha_state *state, |
| 112 | u8 *dst, const u8 *src, unsigned int bytes) |
| 113 | { |
| 114 | chacha_crypt(state, dst, src, bytes, nrounds: 20); |
| 115 | } |
| 116 | |
| 117 | static inline void chacha_zeroize_state(struct chacha_state *state) |
| 118 | { |
| 119 | memzero_explicit(s: state, count: sizeof(*state)); |
| 120 | } |
| 121 | |
| 122 | #if IS_ENABLED(CONFIG_CRYPTO_ARCH_HAVE_LIB_CHACHA) |
| 123 | bool chacha_is_arch_optimized(void); |
| 124 | #else |
| 125 | static inline bool chacha_is_arch_optimized(void) |
| 126 | { |
| 127 | return false; |
| 128 | } |
| 129 | #endif |
| 130 | |
| 131 | #endif /* _CRYPTO_CHACHA_H */ |
| 132 | |