chacha20_test.go 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408
  1. // chacha20_test.go - ChaCha stream cipher implementation tests.
  2. //
  3. // To the extent possible under law, Yawning Angel waived all copyright
  4. // and related or neighboring rights to chacha20, using the Creative
  5. // Commons "CC0" public domain dedication. See LICENSE or
  6. // <http://creativecommons.org/publicdomain/zero/1.0/> for full details.
  7. package chacha20
  8. import (
  9. "bytes"
  10. "crypto/rand"
  11. "testing"
  12. )
  13. // Test vectors taken from:
  14. // https://tools.ietf.org/html/draft-strombergson-chacha-test-vectors-01
  15. var draftTestVectors = []struct {
  16. name string
  17. key []byte
  18. iv []byte
  19. stream []byte
  20. seekOffset uint64
  21. }{
  22. {
  23. name: "IETF Draft: TC1: All zero key and IV.",
  24. key: []byte{
  25. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  26. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  27. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  28. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  29. },
  30. iv: []byte{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
  31. stream: []byte{
  32. 0x76, 0xb8, 0xe0, 0xad, 0xa0, 0xf1, 0x3d, 0x90,
  33. 0x40, 0x5d, 0x6a, 0xe5, 0x53, 0x86, 0xbd, 0x28,
  34. 0xbd, 0xd2, 0x19, 0xb8, 0xa0, 0x8d, 0xed, 0x1a,
  35. 0xa8, 0x36, 0xef, 0xcc, 0x8b, 0x77, 0x0d, 0xc7,
  36. 0xda, 0x41, 0x59, 0x7c, 0x51, 0x57, 0x48, 0x8d,
  37. 0x77, 0x24, 0xe0, 0x3f, 0xb8, 0xd8, 0x4a, 0x37,
  38. 0x6a, 0x43, 0xb8, 0xf4, 0x15, 0x18, 0xa1, 0x1c,
  39. 0xc3, 0x87, 0xb6, 0x69, 0xb2, 0xee, 0x65, 0x86,
  40. 0x9f, 0x07, 0xe7, 0xbe, 0x55, 0x51, 0x38, 0x7a,
  41. 0x98, 0xba, 0x97, 0x7c, 0x73, 0x2d, 0x08, 0x0d,
  42. 0xcb, 0x0f, 0x29, 0xa0, 0x48, 0xe3, 0x65, 0x69,
  43. 0x12, 0xc6, 0x53, 0x3e, 0x32, 0xee, 0x7a, 0xed,
  44. 0x29, 0xb7, 0x21, 0x76, 0x9c, 0xe6, 0x4e, 0x43,
  45. 0xd5, 0x71, 0x33, 0xb0, 0x74, 0xd8, 0x39, 0xd5,
  46. 0x31, 0xed, 0x1f, 0x28, 0x51, 0x0a, 0xfb, 0x45,
  47. 0xac, 0xe1, 0x0a, 0x1f, 0x4b, 0x79, 0x4d, 0x6f,
  48. },
  49. },
  50. {
  51. name: "IETF Draft: TC2: Single bit in key set. All zero IV.",
  52. key: []byte{
  53. 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  54. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  55. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  56. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  57. },
  58. iv: []byte{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
  59. stream: []byte{
  60. 0xc5, 0xd3, 0x0a, 0x7c, 0xe1, 0xec, 0x11, 0x93,
  61. 0x78, 0xc8, 0x4f, 0x48, 0x7d, 0x77, 0x5a, 0x85,
  62. 0x42, 0xf1, 0x3e, 0xce, 0x23, 0x8a, 0x94, 0x55,
  63. 0xe8, 0x22, 0x9e, 0x88, 0x8d, 0xe8, 0x5b, 0xbd,
  64. 0x29, 0xeb, 0x63, 0xd0, 0xa1, 0x7a, 0x5b, 0x99,
  65. 0x9b, 0x52, 0xda, 0x22, 0xbe, 0x40, 0x23, 0xeb,
  66. 0x07, 0x62, 0x0a, 0x54, 0xf6, 0xfa, 0x6a, 0xd8,
  67. 0x73, 0x7b, 0x71, 0xeb, 0x04, 0x64, 0xda, 0xc0,
  68. 0x10, 0xf6, 0x56, 0xe6, 0xd1, 0xfd, 0x55, 0x05,
  69. 0x3e, 0x50, 0xc4, 0x87, 0x5c, 0x99, 0x30, 0xa3,
  70. 0x3f, 0x6d, 0x02, 0x63, 0xbd, 0x14, 0xdf, 0xd6,
  71. 0xab, 0x8c, 0x70, 0x52, 0x1c, 0x19, 0x33, 0x8b,
  72. 0x23, 0x08, 0xb9, 0x5c, 0xf8, 0xd0, 0xbb, 0x7d,
  73. 0x20, 0x2d, 0x21, 0x02, 0x78, 0x0e, 0xa3, 0x52,
  74. 0x8f, 0x1c, 0xb4, 0x85, 0x60, 0xf7, 0x6b, 0x20,
  75. 0xf3, 0x82, 0xb9, 0x42, 0x50, 0x0f, 0xce, 0xac,
  76. },
  77. },
  78. {
  79. name: "IETF Draft: TC3: Single bit in IV set. All zero key.",
  80. key: []byte{
  81. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  82. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  83. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  84. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  85. },
  86. iv: []byte{0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
  87. stream: []byte{
  88. 0xef, 0x3f, 0xdf, 0xd6, 0xc6, 0x15, 0x78, 0xfb,
  89. 0xf5, 0xcf, 0x35, 0xbd, 0x3d, 0xd3, 0x3b, 0x80,
  90. 0x09, 0x63, 0x16, 0x34, 0xd2, 0x1e, 0x42, 0xac,
  91. 0x33, 0x96, 0x0b, 0xd1, 0x38, 0xe5, 0x0d, 0x32,
  92. 0x11, 0x1e, 0x4c, 0xaf, 0x23, 0x7e, 0xe5, 0x3c,
  93. 0xa8, 0xad, 0x64, 0x26, 0x19, 0x4a, 0x88, 0x54,
  94. 0x5d, 0xdc, 0x49, 0x7a, 0x0b, 0x46, 0x6e, 0x7d,
  95. 0x6b, 0xbd, 0xb0, 0x04, 0x1b, 0x2f, 0x58, 0x6b,
  96. 0x53, 0x05, 0xe5, 0xe4, 0x4a, 0xff, 0x19, 0xb2,
  97. 0x35, 0x93, 0x61, 0x44, 0x67, 0x5e, 0xfb, 0xe4,
  98. 0x40, 0x9e, 0xb7, 0xe8, 0xe5, 0xf1, 0x43, 0x0f,
  99. 0x5f, 0x58, 0x36, 0xae, 0xb4, 0x9b, 0xb5, 0x32,
  100. 0x8b, 0x01, 0x7c, 0x4b, 0x9d, 0xc1, 0x1f, 0x8a,
  101. 0x03, 0x86, 0x3f, 0xa8, 0x03, 0xdc, 0x71, 0xd5,
  102. 0x72, 0x6b, 0x2b, 0x6b, 0x31, 0xaa, 0x32, 0x70,
  103. 0x8a, 0xfe, 0x5a, 0xf1, 0xd6, 0xb6, 0x90, 0x58,
  104. },
  105. },
  106. {
  107. name: "IETF Draft: TC4: All bits in key and IV are set.",
  108. key: []byte{
  109. 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
  110. 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
  111. 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
  112. 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
  113. },
  114. iv: []byte{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff},
  115. stream: []byte{
  116. 0xd9, 0xbf, 0x3f, 0x6b, 0xce, 0x6e, 0xd0, 0xb5,
  117. 0x42, 0x54, 0x55, 0x77, 0x67, 0xfb, 0x57, 0x44,
  118. 0x3d, 0xd4, 0x77, 0x89, 0x11, 0xb6, 0x06, 0x05,
  119. 0x5c, 0x39, 0xcc, 0x25, 0xe6, 0x74, 0xb8, 0x36,
  120. 0x3f, 0xea, 0xbc, 0x57, 0xfd, 0xe5, 0x4f, 0x79,
  121. 0x0c, 0x52, 0xc8, 0xae, 0x43, 0x24, 0x0b, 0x79,
  122. 0xd4, 0x90, 0x42, 0xb7, 0x77, 0xbf, 0xd6, 0xcb,
  123. 0x80, 0xe9, 0x31, 0x27, 0x0b, 0x7f, 0x50, 0xeb,
  124. 0x5b, 0xac, 0x2a, 0xcd, 0x86, 0xa8, 0x36, 0xc5,
  125. 0xdc, 0x98, 0xc1, 0x16, 0xc1, 0x21, 0x7e, 0xc3,
  126. 0x1d, 0x3a, 0x63, 0xa9, 0x45, 0x13, 0x19, 0xf0,
  127. 0x97, 0xf3, 0xb4, 0xd6, 0xda, 0xb0, 0x77, 0x87,
  128. 0x19, 0x47, 0x7d, 0x24, 0xd2, 0x4b, 0x40, 0x3a,
  129. 0x12, 0x24, 0x1d, 0x7c, 0xca, 0x06, 0x4f, 0x79,
  130. 0x0f, 0x1d, 0x51, 0xcc, 0xaf, 0xf6, 0xb1, 0x66,
  131. 0x7d, 0x4b, 0xbc, 0xa1, 0x95, 0x8c, 0x43, 0x06,
  132. },
  133. },
  134. {
  135. name: "IETF Draft: TC5: Every even bit set in key and IV.",
  136. key: []byte{
  137. 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55,
  138. 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55,
  139. 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55,
  140. 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55,
  141. },
  142. iv: []byte{0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55},
  143. stream: []byte{
  144. 0xbe, 0xa9, 0x41, 0x1a, 0xa4, 0x53, 0xc5, 0x43,
  145. 0x4a, 0x5a, 0xe8, 0xc9, 0x28, 0x62, 0xf5, 0x64,
  146. 0x39, 0x68, 0x55, 0xa9, 0xea, 0x6e, 0x22, 0xd6,
  147. 0xd3, 0xb5, 0x0a, 0xe1, 0xb3, 0x66, 0x33, 0x11,
  148. 0xa4, 0xa3, 0x60, 0x6c, 0x67, 0x1d, 0x60, 0x5c,
  149. 0xe1, 0x6c, 0x3a, 0xec, 0xe8, 0xe6, 0x1e, 0xa1,
  150. 0x45, 0xc5, 0x97, 0x75, 0x01, 0x7b, 0xee, 0x2f,
  151. 0xa6, 0xf8, 0x8a, 0xfc, 0x75, 0x80, 0x69, 0xf7,
  152. 0xe0, 0xb8, 0xf6, 0x76, 0xe6, 0x44, 0x21, 0x6f,
  153. 0x4d, 0x2a, 0x34, 0x22, 0xd7, 0xfa, 0x36, 0xc6,
  154. 0xc4, 0x93, 0x1a, 0xca, 0x95, 0x0e, 0x9d, 0xa4,
  155. 0x27, 0x88, 0xe6, 0xd0, 0xb6, 0xd1, 0xcd, 0x83,
  156. 0x8e, 0xf6, 0x52, 0xe9, 0x7b, 0x14, 0x5b, 0x14,
  157. 0x87, 0x1e, 0xae, 0x6c, 0x68, 0x04, 0xc7, 0x00,
  158. 0x4d, 0xb5, 0xac, 0x2f, 0xce, 0x4c, 0x68, 0xc7,
  159. 0x26, 0xd0, 0x04, 0xb1, 0x0f, 0xca, 0xba, 0x86,
  160. },
  161. },
  162. {
  163. name: "IETF Draft: TC6: Every odd bit set in key and IV.",
  164. key: []byte{
  165. 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
  166. 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
  167. 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
  168. 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
  169. },
  170. iv: []byte{0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa},
  171. stream: []byte{
  172. 0x9a, 0xa2, 0xa9, 0xf6, 0x56, 0xef, 0xde, 0x5a,
  173. 0xa7, 0x59, 0x1c, 0x5f, 0xed, 0x4b, 0x35, 0xae,
  174. 0xa2, 0x89, 0x5d, 0xec, 0x7c, 0xb4, 0x54, 0x3b,
  175. 0x9e, 0x9f, 0x21, 0xf5, 0xe7, 0xbc, 0xbc, 0xf3,
  176. 0xc4, 0x3c, 0x74, 0x8a, 0x97, 0x08, 0x88, 0xf8,
  177. 0x24, 0x83, 0x93, 0xa0, 0x9d, 0x43, 0xe0, 0xb7,
  178. 0xe1, 0x64, 0xbc, 0x4d, 0x0b, 0x0f, 0xb2, 0x40,
  179. 0xa2, 0xd7, 0x21, 0x15, 0xc4, 0x80, 0x89, 0x06,
  180. 0x72, 0x18, 0x44, 0x89, 0x44, 0x05, 0x45, 0xd0,
  181. 0x21, 0xd9, 0x7e, 0xf6, 0xb6, 0x93, 0xdf, 0xe5,
  182. 0xb2, 0xc1, 0x32, 0xd4, 0x7e, 0x6f, 0x04, 0x1c,
  183. 0x90, 0x63, 0x65, 0x1f, 0x96, 0xb6, 0x23, 0xe6,
  184. 0x2a, 0x11, 0x99, 0x9a, 0x23, 0xb6, 0xf7, 0xc4,
  185. 0x61, 0xb2, 0x15, 0x30, 0x26, 0xad, 0x5e, 0x86,
  186. 0x6a, 0x2e, 0x59, 0x7e, 0xd0, 0x7b, 0x84, 0x01,
  187. 0xde, 0xc6, 0x3a, 0x09, 0x34, 0xc6, 0xb2, 0xa9,
  188. },
  189. },
  190. {
  191. name: "IETF Draft: TC7: Sequence patterns in key and IV.",
  192. key: []byte{
  193. 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77,
  194. 0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff,
  195. 0xff, 0xee, 0xdd, 0xcc, 0xbb, 0xaa, 0x99, 0x88,
  196. 0x77, 0x66, 0x55, 0x44, 0x33, 0x22, 0x11, 0x00,
  197. },
  198. iv: []byte{0x0f, 0x1e, 0x2d, 0x3c, 0x4b, 0x5a, 0x69, 0x78},
  199. stream: []byte{
  200. 0x9f, 0xad, 0xf4, 0x09, 0xc0, 0x08, 0x11, 0xd0,
  201. 0x04, 0x31, 0xd6, 0x7e, 0xfb, 0xd8, 0x8f, 0xba,
  202. 0x59, 0x21, 0x8d, 0x5d, 0x67, 0x08, 0xb1, 0xd6,
  203. 0x85, 0x86, 0x3f, 0xab, 0xbb, 0x0e, 0x96, 0x1e,
  204. 0xea, 0x48, 0x0f, 0xd6, 0xfb, 0x53, 0x2b, 0xfd,
  205. 0x49, 0x4b, 0x21, 0x51, 0x01, 0x50, 0x57, 0x42,
  206. 0x3a, 0xb6, 0x0a, 0x63, 0xfe, 0x4f, 0x55, 0xf7,
  207. 0xa2, 0x12, 0xe2, 0x16, 0x7c, 0xca, 0xb9, 0x31,
  208. 0xfb, 0xfd, 0x29, 0xcf, 0x7b, 0xc1, 0xd2, 0x79,
  209. 0xed, 0xdf, 0x25, 0xdd, 0x31, 0x6b, 0xb8, 0x84,
  210. 0x3d, 0x6e, 0xde, 0xe0, 0xbd, 0x1e, 0xf1, 0x21,
  211. 0xd1, 0x2f, 0xa1, 0x7c, 0xbc, 0x2c, 0x57, 0x4c,
  212. 0xcc, 0xab, 0x5e, 0x27, 0x51, 0x67, 0xb0, 0x8b,
  213. 0xd6, 0x86, 0xf8, 0xa0, 0x9d, 0xf8, 0x7e, 0xc3,
  214. 0xff, 0xb3, 0x53, 0x61, 0xb9, 0x4e, 0xbf, 0xa1,
  215. 0x3f, 0xec, 0x0e, 0x48, 0x89, 0xd1, 0x8d, 0xa5,
  216. },
  217. },
  218. {
  219. name: "IETF Draft: TC8: key: 'All your base are belong to us!, IV: 'IETF2013'",
  220. key: []byte{
  221. 0xc4, 0x6e, 0xc1, 0xb1, 0x8c, 0xe8, 0xa8, 0x78,
  222. 0x72, 0x5a, 0x37, 0xe7, 0x80, 0xdf, 0xb7, 0x35,
  223. 0x1f, 0x68, 0xed, 0x2e, 0x19, 0x4c, 0x79, 0xfb,
  224. 0xc6, 0xae, 0xbe, 0xe1, 0xa6, 0x67, 0x97, 0x5d,
  225. },
  226. iv: []byte{0x1a, 0xda, 0x31, 0xd5, 0xcf, 0x68, 0x82, 0x21},
  227. stream: []byte{
  228. 0xf6, 0x3a, 0x89, 0xb7, 0x5c, 0x22, 0x71, 0xf9,
  229. 0x36, 0x88, 0x16, 0x54, 0x2b, 0xa5, 0x2f, 0x06,
  230. 0xed, 0x49, 0x24, 0x17, 0x92, 0x30, 0x2b, 0x00,
  231. 0xb5, 0xe8, 0xf8, 0x0a, 0xe9, 0xa4, 0x73, 0xaf,
  232. 0xc2, 0x5b, 0x21, 0x8f, 0x51, 0x9a, 0xf0, 0xfd,
  233. 0xd4, 0x06, 0x36, 0x2e, 0x8d, 0x69, 0xde, 0x7f,
  234. 0x54, 0xc6, 0x04, 0xa6, 0xe0, 0x0f, 0x35, 0x3f,
  235. 0x11, 0x0f, 0x77, 0x1b, 0xdc, 0xa8, 0xab, 0x92,
  236. 0xe5, 0xfb, 0xc3, 0x4e, 0x60, 0xa1, 0xd9, 0xa9,
  237. 0xdb, 0x17, 0x34, 0x5b, 0x0a, 0x40, 0x27, 0x36,
  238. 0x85, 0x3b, 0xf9, 0x10, 0xb0, 0x60, 0xbd, 0xf1,
  239. 0xf8, 0x97, 0xb6, 0x29, 0x0f, 0x01, 0xd1, 0x38,
  240. 0xae, 0x2c, 0x4c, 0x90, 0x22, 0x5b, 0xa9, 0xea,
  241. 0x14, 0xd5, 0x18, 0xf5, 0x59, 0x29, 0xde, 0xa0,
  242. 0x98, 0xca, 0x7a, 0x6c, 0xcf, 0xe6, 0x12, 0x27,
  243. 0x05, 0x3c, 0x84, 0xe4, 0x9a, 0x4a, 0x33, 0x32,
  244. },
  245. },
  246. {
  247. name: "XChaCha20 Test",
  248. key: []byte{
  249. 0x1b, 0x27, 0x55, 0x64, 0x73, 0xe9, 0x85, 0xd4,
  250. 0x62, 0xcd, 0x51, 0x19, 0x7a, 0x9a, 0x46, 0xc7,
  251. 0x60, 0x09, 0x54, 0x9e, 0xac, 0x64, 0x74, 0xf2,
  252. 0x06, 0xc4, 0xee, 0x08, 0x44, 0xf6, 0x83, 0x89,
  253. },
  254. iv: []byte{
  255. 0x69, 0x69, 0x6e, 0xe9, 0x55, 0xb6, 0x2b, 0x73,
  256. 0xcd, 0x62, 0xbd, 0xa8, 0x75, 0xfc, 0x73, 0xd6,
  257. 0x82, 0x19, 0xe0, 0x03, 0x6b, 0x7a, 0x0b, 0x37,
  258. },
  259. stream: []byte{
  260. 0x4f, 0xeb, 0xf2, 0xfe, 0x4b, 0x35, 0x9c, 0x50,
  261. 0x8d, 0xc5, 0xe8, 0xb5, 0x98, 0x0c, 0x88, 0xe3,
  262. 0x89, 0x46, 0xd8, 0xf1, 0x8f, 0x31, 0x34, 0x65,
  263. 0xc8, 0x62, 0xa0, 0x87, 0x82, 0x64, 0x82, 0x48,
  264. 0x01, 0x8d, 0xac, 0xdc, 0xb9, 0x04, 0x17, 0x88,
  265. 0x53, 0xa4, 0x6d, 0xca, 0x3a, 0x0e, 0xaa, 0xee,
  266. 0x74, 0x7c, 0xba, 0x97, 0x43, 0x4e, 0xaf, 0xfa,
  267. 0xd5, 0x8f, 0xea, 0x82, 0x22, 0x04, 0x7e, 0x0d,
  268. 0xe6, 0xc3, 0xa6, 0x77, 0x51, 0x06, 0xe0, 0x33,
  269. 0x1a, 0xd7, 0x14, 0xd2, 0xf2, 0x7a, 0x55, 0x64,
  270. 0x13, 0x40, 0xa1, 0xf1, 0xdd, 0x9f, 0x94, 0x53,
  271. 0x2e, 0x68, 0xcb, 0x24, 0x1c, 0xbd, 0xd1, 0x50,
  272. 0x97, 0x0d, 0x14, 0xe0, 0x5c, 0x5b, 0x17, 0x31,
  273. 0x93, 0xfb, 0x14, 0xf5, 0x1c, 0x41, 0xf3, 0x93,
  274. 0x83, 0x5b, 0xf7, 0xf4, 0x16, 0xa7, 0xe0, 0xbb,
  275. 0xa8, 0x1f, 0xfb, 0x8b, 0x13, 0xaf, 0x0e, 0x21,
  276. 0x69, 0x1d, 0x7e, 0xce, 0xc9, 0x3b, 0x75, 0xe6,
  277. 0xe4, 0x18, 0x3a,
  278. },
  279. },
  280. {
  281. name: "RFC 7539 Test Vector (96 bit nonce)",
  282. key: []byte{
  283. 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
  284. 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
  285. 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
  286. 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
  287. },
  288. iv: []byte{
  289. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x4a,
  290. 0x00, 0x00, 0x00, 0x00,
  291. },
  292. stream: []byte{
  293. 0x22, 0x4f, 0x51, 0xf3, 0x40, 0x1b, 0xd9, 0xe1,
  294. 0x2f, 0xde, 0x27, 0x6f, 0xb8, 0x63, 0x1d, 0xed,
  295. 0x8c, 0x13, 0x1f, 0x82, 0x3d, 0x2c, 0x06, 0xe2,
  296. 0x7e, 0x4f, 0xca, 0xec, 0x9e, 0xf3, 0xcf, 0x78,
  297. 0x8a, 0x3b, 0x0a, 0xa3, 0x72, 0x60, 0x0a, 0x92,
  298. 0xb5, 0x79, 0x74, 0xcd, 0xed, 0x2b, 0x93, 0x34,
  299. 0x79, 0x4c, 0xba, 0x40, 0xc6, 0x3e, 0x34, 0xcd,
  300. 0xea, 0x21, 0x2c, 0x4c, 0xf0, 0x7d, 0x41, 0xb7,
  301. 0x69, 0xa6, 0x74, 0x9f, 0x3f, 0x63, 0x0f, 0x41,
  302. 0x22, 0xca, 0xfe, 0x28, 0xec, 0x4d, 0xc4, 0x7e,
  303. 0x26, 0xd4, 0x34, 0x6d, 0x70, 0xb9, 0x8c, 0x73,
  304. 0xf3, 0xe9, 0xc5, 0x3a, 0xc4, 0x0c, 0x59, 0x45,
  305. 0x39, 0x8b, 0x6e, 0xda, 0x1a, 0x83, 0x2c, 0x89,
  306. 0xc1, 0x67, 0xea, 0xcd, 0x90, 0x1d, 0x7e, 0x2b,
  307. 0xf3, 0x63,
  308. },
  309. seekOffset: 1,
  310. },
  311. }
  312. func TestChaCha20(t *testing.T) {
  313. for _, v := range draftTestVectors {
  314. c, err := NewCipher(v.key, v.iv)
  315. if err != nil {
  316. t.Errorf("[%s]: New(k, iv) returned: %s", v.name, err)
  317. continue
  318. }
  319. if v.seekOffset != 0 {
  320. if err = c.Seek(v.seekOffset); err != nil {
  321. t.Errorf("[%s]: Seek(seekOffset) returned: %s", v.name, err)
  322. continue
  323. }
  324. }
  325. out := make([]byte, len(v.stream))
  326. c.XORKeyStream(out, out)
  327. if !bytes.Equal(out, v.stream) {
  328. t.Errorf("[%s]: out != stream (%x != %x)", v.name, out, v.stream)
  329. }
  330. }
  331. }
  332. func TestChaCha20Vectorized(t *testing.T) {
  333. if !usingVectors {
  334. t.Skip("vectorized ChaCha20 support not compiled in")
  335. }
  336. // Save the batch blocks processing routine so we can mess with it, and
  337. // restore it when we're done.
  338. oldBlocksFn := blocksFn
  339. defer func() {
  340. blocksFn = oldBlocksFn
  341. }()
  342. // Generate a random key, nonce and input.
  343. var key [KeySize]byte
  344. var nonce [NonceSize]byte
  345. var input [1024 * 1024]byte
  346. rand.Read(key[:])
  347. rand.Read(nonce[:])
  348. rand.Read(input[:])
  349. // Encrypt with the vectorized implementation.
  350. c, err := NewCipher(key[:], nonce[:])
  351. if err != nil {
  352. t.Fatal(err)
  353. }
  354. var vecOut [1024 * 1024]byte
  355. c.XORKeyStream(vecOut[:], input[:])
  356. c, err = NewCipher(key[:], nonce[:])
  357. if err != nil {
  358. t.Fatal(err)
  359. }
  360. var refOut [1024 * 1024]byte
  361. blocksFn = blocksRef
  362. c.XORKeyStream(refOut[:], input[:])
  363. if !bytes.Equal(refOut[:], vecOut[:]) {
  364. for i, v := range refOut {
  365. if vecOut[i] != v {
  366. t.Errorf("mismatch at offset: %d", i)
  367. break
  368. }
  369. }
  370. t.Errorf("refOut != vecOut")
  371. }
  372. }
  373. func doBenchN(b *testing.B, n int) {
  374. var key [KeySize]byte
  375. var nonce [NonceSize]byte
  376. s := make([]byte, n)
  377. c, err := NewCipher(key[:], nonce[:])
  378. if err != nil {
  379. b.Fatal(err)
  380. }
  381. b.SetBytes(int64(n))
  382. b.ResetTimer()
  383. for i := 0; i < b.N; i++ {
  384. c.XORKeyStream(s, s)
  385. }
  386. }
  387. func BenchmarkChaCha20_16(b *testing.B) {
  388. doBenchN(b, 16)
  389. }
  390. func BenchmarkChaCha20_1k(b *testing.B) {
  391. doBenchN(b, 1024)
  392. }
  393. func BenchmarkChaCha20_64k(b *testing.B) {
  394. doBenchN(b, 65536)
  395. }