^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0-or-later
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) * The "hash function" used as the core of the ChaCha stream cipher (RFC7539)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) * Copyright (C) 2015 Martin Willi
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) #include <linux/bug.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) #include <linux/kernel.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) #include <linux/export.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) #include <linux/bitops.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) #include <linux/string.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) #include <asm/unaligned.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) #include <crypto/chacha.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) static void chacha_permute(u32 *x, int nrounds)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) int i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) /* whitelist the allowed round counts */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) WARN_ON_ONCE(nrounds != 20 && nrounds != 12);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) for (i = 0; i < nrounds; i += 2) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) x[0] += x[4]; x[12] = rol32(x[12] ^ x[0], 16);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) x[1] += x[5]; x[13] = rol32(x[13] ^ x[1], 16);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) x[2] += x[6]; x[14] = rol32(x[14] ^ x[2], 16);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) x[3] += x[7]; x[15] = rol32(x[15] ^ x[3], 16);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) x[8] += x[12]; x[4] = rol32(x[4] ^ x[8], 12);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) x[9] += x[13]; x[5] = rol32(x[5] ^ x[9], 12);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) x[10] += x[14]; x[6] = rol32(x[6] ^ x[10], 12);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) x[11] += x[15]; x[7] = rol32(x[7] ^ x[11], 12);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) x[0] += x[4]; x[12] = rol32(x[12] ^ x[0], 8);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) x[1] += x[5]; x[13] = rol32(x[13] ^ x[1], 8);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) x[2] += x[6]; x[14] = rol32(x[14] ^ x[2], 8);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) x[3] += x[7]; x[15] = rol32(x[15] ^ x[3], 8);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) x[8] += x[12]; x[4] = rol32(x[4] ^ x[8], 7);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) x[9] += x[13]; x[5] = rol32(x[5] ^ x[9], 7);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) x[10] += x[14]; x[6] = rol32(x[6] ^ x[10], 7);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) x[11] += x[15]; x[7] = rol32(x[7] ^ x[11], 7);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) x[0] += x[5]; x[15] = rol32(x[15] ^ x[0], 16);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) x[1] += x[6]; x[12] = rol32(x[12] ^ x[1], 16);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) x[2] += x[7]; x[13] = rol32(x[13] ^ x[2], 16);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) x[3] += x[4]; x[14] = rol32(x[14] ^ x[3], 16);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) x[10] += x[15]; x[5] = rol32(x[5] ^ x[10], 12);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) x[11] += x[12]; x[6] = rol32(x[6] ^ x[11], 12);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) x[8] += x[13]; x[7] = rol32(x[7] ^ x[8], 12);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) x[9] += x[14]; x[4] = rol32(x[4] ^ x[9], 12);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) x[0] += x[5]; x[15] = rol32(x[15] ^ x[0], 8);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) x[1] += x[6]; x[12] = rol32(x[12] ^ x[1], 8);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) x[2] += x[7]; x[13] = rol32(x[13] ^ x[2], 8);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) x[3] += x[4]; x[14] = rol32(x[14] ^ x[3], 8);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) x[10] += x[15]; x[5] = rol32(x[5] ^ x[10], 7);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) x[11] += x[12]; x[6] = rol32(x[6] ^ x[11], 7);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) x[8] += x[13]; x[7] = rol32(x[7] ^ x[8], 7);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) x[9] += x[14]; x[4] = rol32(x[4] ^ x[9], 7);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) * chacha_block - generate one keystream block and increment block counter
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) * @state: input state matrix (16 32-bit words)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) * @stream: output keystream block (64 bytes)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) * @nrounds: number of rounds (20 or 12; 20 is recommended)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) * This is the ChaCha core, a function from 64-byte strings to 64-byte strings.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) * The caller has already converted the endianness of the input. This function
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) * also handles incrementing the block counter in the input matrix.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) void chacha_block_generic(u32 *state, u8 *stream, int nrounds)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) u32 x[16];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) int i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) memcpy(x, state, 64);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) chacha_permute(x, nrounds);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) for (i = 0; i < ARRAY_SIZE(x); i++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) put_unaligned_le32(x[i] + state[i], &stream[i * sizeof(u32)]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) state[12]++;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) EXPORT_SYMBOL(chacha_block_generic);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) * hchacha_block_generic - abbreviated ChaCha core, for XChaCha
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) * @state: input state matrix (16 32-bit words)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) * @out: output (8 32-bit words)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) * @nrounds: number of rounds (20 or 12; 20 is recommended)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) * HChaCha is the ChaCha equivalent of HSalsa and is an intermediate step
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) * towards XChaCha (see https://cr.yp.to/snuffle/xsalsa-20081128.pdf). HChaCha
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) * skips the final addition of the initial state, and outputs only certain words
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) * of the state. It should not be used for streaming directly.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) void hchacha_block_generic(const u32 *state, u32 *stream, int nrounds)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) u32 x[16];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) memcpy(x, state, 64);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) chacha_permute(x, nrounds);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) memcpy(&stream[0], &x[0], 16);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) memcpy(&stream[4], &x[12], 16);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) EXPORT_SYMBOL(hchacha_block_generic);
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags