chacha20_ref.go 10 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394
  1. // chacha20_ref.go - Reference ChaCha20.
  2. //
  3. // To the extent possible under law, Yawning Angel has waived all copyright
  4. // and related or neighboring rights to chacha20, using the Creative
  5. // Commons "CC0" public domain dedication. See LICENSE or
  6. // <http://creativecommons.org/publicdomain/zero/1.0/> for full details.
  7. // +build !go1.9
  8. package chacha20
  9. import (
  10. "encoding/binary"
  11. "math"
  12. "unsafe"
  13. )
  14. func blocksRef(x *[stateSize]uint32, in []byte, out []byte, nrBlocks int, isIetf bool) {
  15. if isIetf {
  16. var totalBlocks uint64
  17. totalBlocks = uint64(x[12]) + uint64(nrBlocks)
  18. if totalBlocks > math.MaxUint32 {
  19. panic("chacha20: Exceeded keystream per nonce limit")
  20. }
  21. }
  22. // This routine ignores x[0]...x[4] in favor the const values since it's
  23. // ever so slightly faster.
  24. for n := 0; n < nrBlocks; n++ {
  25. x0, x1, x2, x3 := sigma0, sigma1, sigma2, sigma3
  26. x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15 := x[4], x[5], x[6], x[7], x[8], x[9], x[10], x[11], x[12], x[13], x[14], x[15]
  27. for i := chachaRounds; i > 0; i -= 2 {
  28. // quarterround(x, 0, 4, 8, 12)
  29. x0 += x4
  30. x12 ^= x0
  31. x12 = (x12 << 16) | (x12 >> 16)
  32. x8 += x12
  33. x4 ^= x8
  34. x4 = (x4 << 12) | (x4 >> 20)
  35. x0 += x4
  36. x12 ^= x0
  37. x12 = (x12 << 8) | (x12 >> 24)
  38. x8 += x12
  39. x4 ^= x8
  40. x4 = (x4 << 7) | (x4 >> 25)
  41. // quarterround(x, 1, 5, 9, 13)
  42. x1 += x5
  43. x13 ^= x1
  44. x13 = (x13 << 16) | (x13 >> 16)
  45. x9 += x13
  46. x5 ^= x9
  47. x5 = (x5 << 12) | (x5 >> 20)
  48. x1 += x5
  49. x13 ^= x1
  50. x13 = (x13 << 8) | (x13 >> 24)
  51. x9 += x13
  52. x5 ^= x9
  53. x5 = (x5 << 7) | (x5 >> 25)
  54. // quarterround(x, 2, 6, 10, 14)
  55. x2 += x6
  56. x14 ^= x2
  57. x14 = (x14 << 16) | (x14 >> 16)
  58. x10 += x14
  59. x6 ^= x10
  60. x6 = (x6 << 12) | (x6 >> 20)
  61. x2 += x6
  62. x14 ^= x2
  63. x14 = (x14 << 8) | (x14 >> 24)
  64. x10 += x14
  65. x6 ^= x10
  66. x6 = (x6 << 7) | (x6 >> 25)
  67. // quarterround(x, 3, 7, 11, 15)
  68. x3 += x7
  69. x15 ^= x3
  70. x15 = (x15 << 16) | (x15 >> 16)
  71. x11 += x15
  72. x7 ^= x11
  73. x7 = (x7 << 12) | (x7 >> 20)
  74. x3 += x7
  75. x15 ^= x3
  76. x15 = (x15 << 8) | (x15 >> 24)
  77. x11 += x15
  78. x7 ^= x11
  79. x7 = (x7 << 7) | (x7 >> 25)
  80. // quarterround(x, 0, 5, 10, 15)
  81. x0 += x5
  82. x15 ^= x0
  83. x15 = (x15 << 16) | (x15 >> 16)
  84. x10 += x15
  85. x5 ^= x10
  86. x5 = (x5 << 12) | (x5 >> 20)
  87. x0 += x5
  88. x15 ^= x0
  89. x15 = (x15 << 8) | (x15 >> 24)
  90. x10 += x15
  91. x5 ^= x10
  92. x5 = (x5 << 7) | (x5 >> 25)
  93. // quarterround(x, 1, 6, 11, 12)
  94. x1 += x6
  95. x12 ^= x1
  96. x12 = (x12 << 16) | (x12 >> 16)
  97. x11 += x12
  98. x6 ^= x11
  99. x6 = (x6 << 12) | (x6 >> 20)
  100. x1 += x6
  101. x12 ^= x1
  102. x12 = (x12 << 8) | (x12 >> 24)
  103. x11 += x12
  104. x6 ^= x11
  105. x6 = (x6 << 7) | (x6 >> 25)
  106. // quarterround(x, 2, 7, 8, 13)
  107. x2 += x7
  108. x13 ^= x2
  109. x13 = (x13 << 16) | (x13 >> 16)
  110. x8 += x13
  111. x7 ^= x8
  112. x7 = (x7 << 12) | (x7 >> 20)
  113. x2 += x7
  114. x13 ^= x2
  115. x13 = (x13 << 8) | (x13 >> 24)
  116. x8 += x13
  117. x7 ^= x8
  118. x7 = (x7 << 7) | (x7 >> 25)
  119. // quarterround(x, 3, 4, 9, 14)
  120. x3 += x4
  121. x14 ^= x3
  122. x14 = (x14 << 16) | (x14 >> 16)
  123. x9 += x14
  124. x4 ^= x9
  125. x4 = (x4 << 12) | (x4 >> 20)
  126. x3 += x4
  127. x14 ^= x3
  128. x14 = (x14 << 8) | (x14 >> 24)
  129. x9 += x14
  130. x4 ^= x9
  131. x4 = (x4 << 7) | (x4 >> 25)
  132. }
  133. // On amd64 at least, this is a rather big boost.
  134. if useUnsafe {
  135. if in != nil {
  136. inArr := (*[16]uint32)(unsafe.Pointer(&in[n*BlockSize]))
  137. outArr := (*[16]uint32)(unsafe.Pointer(&out[n*BlockSize]))
  138. outArr[0] = inArr[0] ^ (x0 + sigma0)
  139. outArr[1] = inArr[1] ^ (x1 + sigma1)
  140. outArr[2] = inArr[2] ^ (x2 + sigma2)
  141. outArr[3] = inArr[3] ^ (x3 + sigma3)
  142. outArr[4] = inArr[4] ^ (x4 + x[4])
  143. outArr[5] = inArr[5] ^ (x5 + x[5])
  144. outArr[6] = inArr[6] ^ (x6 + x[6])
  145. outArr[7] = inArr[7] ^ (x7 + x[7])
  146. outArr[8] = inArr[8] ^ (x8 + x[8])
  147. outArr[9] = inArr[9] ^ (x9 + x[9])
  148. outArr[10] = inArr[10] ^ (x10 + x[10])
  149. outArr[11] = inArr[11] ^ (x11 + x[11])
  150. outArr[12] = inArr[12] ^ (x12 + x[12])
  151. outArr[13] = inArr[13] ^ (x13 + x[13])
  152. outArr[14] = inArr[14] ^ (x14 + x[14])
  153. outArr[15] = inArr[15] ^ (x15 + x[15])
  154. } else {
  155. outArr := (*[16]uint32)(unsafe.Pointer(&out[n*BlockSize]))
  156. outArr[0] = x0 + sigma0
  157. outArr[1] = x1 + sigma1
  158. outArr[2] = x2 + sigma2
  159. outArr[3] = x3 + sigma3
  160. outArr[4] = x4 + x[4]
  161. outArr[5] = x5 + x[5]
  162. outArr[6] = x6 + x[6]
  163. outArr[7] = x7 + x[7]
  164. outArr[8] = x8 + x[8]
  165. outArr[9] = x9 + x[9]
  166. outArr[10] = x10 + x[10]
  167. outArr[11] = x11 + x[11]
  168. outArr[12] = x12 + x[12]
  169. outArr[13] = x13 + x[13]
  170. outArr[14] = x14 + x[14]
  171. outArr[15] = x15 + x[15]
  172. }
  173. } else {
  174. // Slow path, either the architecture cares about alignment, or is not little endian.
  175. x0 += sigma0
  176. x1 += sigma1
  177. x2 += sigma2
  178. x3 += sigma3
  179. x4 += x[4]
  180. x5 += x[5]
  181. x6 += x[6]
  182. x7 += x[7]
  183. x8 += x[8]
  184. x9 += x[9]
  185. x10 += x[10]
  186. x11 += x[11]
  187. x12 += x[12]
  188. x13 += x[13]
  189. x14 += x[14]
  190. x15 += x[15]
  191. if in != nil {
  192. binary.LittleEndian.PutUint32(out[0:4], binary.LittleEndian.Uint32(in[0:4])^x0)
  193. binary.LittleEndian.PutUint32(out[4:8], binary.LittleEndian.Uint32(in[4:8])^x1)
  194. binary.LittleEndian.PutUint32(out[8:12], binary.LittleEndian.Uint32(in[8:12])^x2)
  195. binary.LittleEndian.PutUint32(out[12:16], binary.LittleEndian.Uint32(in[12:16])^x3)
  196. binary.LittleEndian.PutUint32(out[16:20], binary.LittleEndian.Uint32(in[16:20])^x4)
  197. binary.LittleEndian.PutUint32(out[20:24], binary.LittleEndian.Uint32(in[20:24])^x5)
  198. binary.LittleEndian.PutUint32(out[24:28], binary.LittleEndian.Uint32(in[24:28])^x6)
  199. binary.LittleEndian.PutUint32(out[28:32], binary.LittleEndian.Uint32(in[28:32])^x7)
  200. binary.LittleEndian.PutUint32(out[32:36], binary.LittleEndian.Uint32(in[32:36])^x8)
  201. binary.LittleEndian.PutUint32(out[36:40], binary.LittleEndian.Uint32(in[36:40])^x9)
  202. binary.LittleEndian.PutUint32(out[40:44], binary.LittleEndian.Uint32(in[40:44])^x10)
  203. binary.LittleEndian.PutUint32(out[44:48], binary.LittleEndian.Uint32(in[44:48])^x11)
  204. binary.LittleEndian.PutUint32(out[48:52], binary.LittleEndian.Uint32(in[48:52])^x12)
  205. binary.LittleEndian.PutUint32(out[52:56], binary.LittleEndian.Uint32(in[52:56])^x13)
  206. binary.LittleEndian.PutUint32(out[56:60], binary.LittleEndian.Uint32(in[56:60])^x14)
  207. binary.LittleEndian.PutUint32(out[60:64], binary.LittleEndian.Uint32(in[60:64])^x15)
  208. in = in[BlockSize:]
  209. } else {
  210. binary.LittleEndian.PutUint32(out[0:4], x0)
  211. binary.LittleEndian.PutUint32(out[4:8], x1)
  212. binary.LittleEndian.PutUint32(out[8:12], x2)
  213. binary.LittleEndian.PutUint32(out[12:16], x3)
  214. binary.LittleEndian.PutUint32(out[16:20], x4)
  215. binary.LittleEndian.PutUint32(out[20:24], x5)
  216. binary.LittleEndian.PutUint32(out[24:28], x6)
  217. binary.LittleEndian.PutUint32(out[28:32], x7)
  218. binary.LittleEndian.PutUint32(out[32:36], x8)
  219. binary.LittleEndian.PutUint32(out[36:40], x9)
  220. binary.LittleEndian.PutUint32(out[40:44], x10)
  221. binary.LittleEndian.PutUint32(out[44:48], x11)
  222. binary.LittleEndian.PutUint32(out[48:52], x12)
  223. binary.LittleEndian.PutUint32(out[52:56], x13)
  224. binary.LittleEndian.PutUint32(out[56:60], x14)
  225. binary.LittleEndian.PutUint32(out[60:64], x15)
  226. }
  227. out = out[BlockSize:]
  228. }
  229. // Stoping at 2^70 bytes per nonce is the user's responsibility.
  230. ctr := uint64(x[13])<<32 | uint64(x[12])
  231. ctr++
  232. x[12] = uint32(ctr)
  233. x[13] = uint32(ctr >> 32)
  234. }
  235. }
  236. func hChaChaRef(x *[stateSize]uint32, out *[32]byte) {
  237. x0, x1, x2, x3 := sigma0, sigma1, sigma2, sigma3
  238. x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15 := x[0], x[1], x[2], x[3], x[4], x[5], x[6], x[7], x[8], x[9], x[10], x[11]
  239. for i := chachaRounds; i > 0; i -= 2 {
  240. // quarterround(x, 0, 4, 8, 12)
  241. x0 += x4
  242. x12 ^= x0
  243. x12 = (x12 << 16) | (x12 >> 16)
  244. x8 += x12
  245. x4 ^= x8
  246. x4 = (x4 << 12) | (x4 >> 20)
  247. x0 += x4
  248. x12 ^= x0
  249. x12 = (x12 << 8) | (x12 >> 24)
  250. x8 += x12
  251. x4 ^= x8
  252. x4 = (x4 << 7) | (x4 >> 25)
  253. // quarterround(x, 1, 5, 9, 13)
  254. x1 += x5
  255. x13 ^= x1
  256. x13 = (x13 << 16) | (x13 >> 16)
  257. x9 += x13
  258. x5 ^= x9
  259. x5 = (x5 << 12) | (x5 >> 20)
  260. x1 += x5
  261. x13 ^= x1
  262. x13 = (x13 << 8) | (x13 >> 24)
  263. x9 += x13
  264. x5 ^= x9
  265. x5 = (x5 << 7) | (x5 >> 25)
  266. // quarterround(x, 2, 6, 10, 14)
  267. x2 += x6
  268. x14 ^= x2
  269. x14 = (x14 << 16) | (x14 >> 16)
  270. x10 += x14
  271. x6 ^= x10
  272. x6 = (x6 << 12) | (x6 >> 20)
  273. x2 += x6
  274. x14 ^= x2
  275. x14 = (x14 << 8) | (x14 >> 24)
  276. x10 += x14
  277. x6 ^= x10
  278. x6 = (x6 << 7) | (x6 >> 25)
  279. // quarterround(x, 3, 7, 11, 15)
  280. x3 += x7
  281. x15 ^= x3
  282. x15 = (x15 << 16) | (x15 >> 16)
  283. x11 += x15
  284. x7 ^= x11
  285. x7 = (x7 << 12) | (x7 >> 20)
  286. x3 += x7
  287. x15 ^= x3
  288. x15 = (x15 << 8) | (x15 >> 24)
  289. x11 += x15
  290. x7 ^= x11
  291. x7 = (x7 << 7) | (x7 >> 25)
  292. // quarterround(x, 0, 5, 10, 15)
  293. x0 += x5
  294. x15 ^= x0
  295. x15 = (x15 << 16) | (x15 >> 16)
  296. x10 += x15
  297. x5 ^= x10
  298. x5 = (x5 << 12) | (x5 >> 20)
  299. x0 += x5
  300. x15 ^= x0
  301. x15 = (x15 << 8) | (x15 >> 24)
  302. x10 += x15
  303. x5 ^= x10
  304. x5 = (x5 << 7) | (x5 >> 25)
  305. // quarterround(x, 1, 6, 11, 12)
  306. x1 += x6
  307. x12 ^= x1
  308. x12 = (x12 << 16) | (x12 >> 16)
  309. x11 += x12
  310. x6 ^= x11
  311. x6 = (x6 << 12) | (x6 >> 20)
  312. x1 += x6
  313. x12 ^= x1
  314. x12 = (x12 << 8) | (x12 >> 24)
  315. x11 += x12
  316. x6 ^= x11
  317. x6 = (x6 << 7) | (x6 >> 25)
  318. // quarterround(x, 2, 7, 8, 13)
  319. x2 += x7
  320. x13 ^= x2
  321. x13 = (x13 << 16) | (x13 >> 16)
  322. x8 += x13
  323. x7 ^= x8
  324. x7 = (x7 << 12) | (x7 >> 20)
  325. x2 += x7
  326. x13 ^= x2
  327. x13 = (x13 << 8) | (x13 >> 24)
  328. x8 += x13
  329. x7 ^= x8
  330. x7 = (x7 << 7) | (x7 >> 25)
  331. // quarterround(x, 3, 4, 9, 14)
  332. x3 += x4
  333. x14 ^= x3
  334. x14 = (x14 << 16) | (x14 >> 16)
  335. x9 += x14
  336. x4 ^= x9
  337. x4 = (x4 << 12) | (x4 >> 20)
  338. x3 += x4
  339. x14 ^= x3
  340. x14 = (x14 << 8) | (x14 >> 24)
  341. x9 += x14
  342. x4 ^= x9
  343. x4 = (x4 << 7) | (x4 >> 25)
  344. }
  345. // HChaCha returns x0...x3 | x12...x15, which corresponds to the
  346. // indexes of the ChaCha constant and the indexes of the IV.
  347. if useUnsafe {
  348. outArr := (*[16]uint32)(unsafe.Pointer(&out[0]))
  349. outArr[0] = x0
  350. outArr[1] = x1
  351. outArr[2] = x2
  352. outArr[3] = x3
  353. outArr[4] = x12
  354. outArr[5] = x13
  355. outArr[6] = x14
  356. outArr[7] = x15
  357. } else {
  358. binary.LittleEndian.PutUint32(out[0:4], x0)
  359. binary.LittleEndian.PutUint32(out[4:8], x1)
  360. binary.LittleEndian.PutUint32(out[8:12], x2)
  361. binary.LittleEndian.PutUint32(out[12:16], x3)
  362. binary.LittleEndian.PutUint32(out[16:20], x12)
  363. binary.LittleEndian.PutUint32(out[20:24], x13)
  364. binary.LittleEndian.PutUint32(out[24:28], x14)
  365. binary.LittleEndian.PutUint32(out[28:32], x15)
  366. }
  367. return
  368. }