andre@0: /* This Source Code Form is subject to the terms of the Mozilla Public
andre@0:  * License, v. 2.0. If a copy of the MPL was not distributed with this
andre@0:  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
andre@0: 
andre@0: /* Adopted from the public domain code in NaCl by djb. */
andre@0: 
andre@0: #include <string.h>
andre@0: #include <stdio.h>
andre@0: 
andre@0: #include "prtypes.h"
andre@0: #include "chacha20.h"
andre@0: 
andre@0: #define ROTL32(v, n) (((v) << (n)) | ((v) >> (32 - (n))))
andre@0: #define ROTATE(v, c) ROTL32((v), (c))
andre@0: #define XOR(v, w) ((v) ^ (w))
andre@0: #define PLUS(x, y) ((x) + (y))
andre@0: 
andre@0: #define U32TO8_LITTLE(p, v) \
andre@0: 	{ (p)[0] = ((v)      ) & 0xff; (p)[1] = ((v) >>  8) & 0xff; \
andre@0: 	  (p)[2] = ((v) >> 16) & 0xff; (p)[3] = ((v) >> 24) & 0xff; }
andre@0: #define U8TO32_LITTLE(p)   \
andre@0: 	(((PRUint32)((p)[0])      ) | ((PRUint32)((p)[1]) <<  8) | \
andre@0: 	 ((PRUint32)((p)[2]) << 16) | ((PRUint32)((p)[3]) << 24)   )
andre@0: 
andre@0: #define QUARTERROUND(a,b,c,d) \
andre@0:   x[a] = PLUS(x[a],x[b]); x[d] = ROTATE(XOR(x[d],x[a]),16); \
andre@0:   x[c] = PLUS(x[c],x[d]); x[b] = ROTATE(XOR(x[b],x[c]),12); \
andre@0:   x[a] = PLUS(x[a],x[b]); x[d] = ROTATE(XOR(x[d],x[a]), 8); \
andre@0:   x[c] = PLUS(x[c],x[d]); x[b] = ROTATE(XOR(x[b],x[c]), 7);
andre@0: 
andre@0: static void ChaChaCore(unsigned char output[64], const PRUint32 input[16],
andre@0: 		       int num_rounds) {
andre@0:     PRUint32 x[16];
andre@0:     int i;
andre@0: 
andre@0:     memcpy(x, input, sizeof(PRUint32) * 16);
andre@0:     for (i = num_rounds; i > 0; i -= 2) {
andre@0: 	QUARTERROUND( 0, 4, 8,12)
andre@0: 	QUARTERROUND( 1, 5, 9,13)
andre@0: 	QUARTERROUND( 2, 6,10,14)
andre@0: 	QUARTERROUND( 3, 7,11,15)
andre@0: 	QUARTERROUND( 0, 5,10,15)
andre@0: 	QUARTERROUND( 1, 6,11,12)
andre@0: 	QUARTERROUND( 2, 7, 8,13)
andre@0: 	QUARTERROUND( 3, 4, 9,14)
andre@0:     }
andre@0: 
andre@0:     for (i = 0; i < 16; ++i) {
andre@0: 	x[i] = PLUS(x[i], input[i]);
andre@0:     }
andre@0:     for (i = 0; i < 16; ++i) {
andre@0: 	U32TO8_LITTLE(output + 4 * i, x[i]);
andre@0:     }
andre@0: }
andre@0: 
andre@0: static const unsigned char sigma[16] = "expand 32-byte k";
andre@0: 
andre@0: void ChaCha20XOR(unsigned char *out, const unsigned char *in, unsigned int inLen,
andre@0: 		 const unsigned char key[32], const unsigned char nonce[8],
andre@0: 		 uint64_t counter) {
andre@0:     unsigned char block[64];
andre@0:     PRUint32 input[16];
andre@0:     unsigned int u;
andre@0:     unsigned int i;
andre@0: 
andre@0:     input[4] = U8TO32_LITTLE(key + 0);
andre@0:     input[5] = U8TO32_LITTLE(key + 4);
andre@0:     input[6] = U8TO32_LITTLE(key + 8);
andre@0:     input[7] = U8TO32_LITTLE(key + 12);
andre@0: 
andre@0:     input[8] = U8TO32_LITTLE(key + 16);
andre@0:     input[9] = U8TO32_LITTLE(key + 20);
andre@0:     input[10] = U8TO32_LITTLE(key + 24);
andre@0:     input[11] = U8TO32_LITTLE(key + 28);
andre@0: 
andre@0:     input[0] = U8TO32_LITTLE(sigma + 0);
andre@0:     input[1] = U8TO32_LITTLE(sigma + 4);
andre@0:     input[2] = U8TO32_LITTLE(sigma + 8);
andre@0:     input[3] = U8TO32_LITTLE(sigma + 12);
andre@0: 
andre@0:     input[12] = counter;
andre@0:     input[13] = counter >> 32;
andre@0:     input[14] = U8TO32_LITTLE(nonce + 0);
andre@0:     input[15] = U8TO32_LITTLE(nonce + 4);
andre@0: 
andre@0:     while (inLen >= 64) {
andre@0: 	ChaChaCore(block, input, 20);
andre@0: 	for (i = 0; i < 64; i++) {
andre@0: 	    out[i] = in[i] ^ block[i];
andre@0: 	}
andre@0: 
andre@0: 	input[12]++;
andre@0: 	if (input[12] == 0) {
andre@0: 	    input[13]++;
andre@0: 	}
andre@0: 
andre@0: 	inLen -= 64;
andre@0: 	in += 64;
andre@0: 	out += 64;
andre@0:     }
andre@0: 
andre@0:     if (inLen > 0) {
andre@0: 	ChaChaCore(block, input, 20);
andre@0: 	for (i = 0; i < inLen; i++) {
andre@0: 	    out[i] = in[i] ^ block[i];
andre@0: 	}
andre@0:     }
andre@0: }