luajitos

XChaCha20-Poly1305.c (15424B)

---

 /*
  * XChaCha20-Poly1305 AEAD Implementation
  * Extended-nonce ChaCha20-Poly1305
  * Based on draft-irtf-cfrg-xchacha
  */
 
 #include "XChaCha20-Poly1305.h"
 #include <stdio.h>
 #include <string.h>
 
 // Utility: Read 32-bit little-endian
 static inline uint32_t read_le32(const uint8_t *p) {
     return ((uint32_t)p[0]) |
            ((uint32_t)p[1] << 8) |
            ((uint32_t)p[2] << 16) |
            ((uint32_t)p[3] << 24);
 }
 
 // Utility: Write 32-bit little-endian
 static inline void write_le32(uint8_t *p, uint32_t v) {
     p[0] = v & 0xff;
     p[1] = (v >> 8) & 0xff;
     p[2] = (v >> 16) & 0xff;
     p[3] = (v >> 24) & 0xff;
 }
 
 // Utility: Write 64-bit little-endian
 static inline void write_le64(uint8_t *p, uint64_t v) {
     p[0] = v & 0xff;
     p[1] = (v >> 8) & 0xff;
     p[2] = (v >> 16) & 0xff;
     p[3] = (v >> 24) & 0xff;
     p[4] = (v >> 32) & 0xff;
     p[5] = (v >> 40) & 0xff;
     p[6] = (v >> 48) & 0xff;
     p[7] = (v >> 56) & 0xff;
 }
 
 // ChaCha20 quarter round
 #define ROTL32(x, n) (((x) << (n)) | ((x) >> (32 - (n))))
 
 #define QUARTERROUND(a, b, c, d) \
     a += b; d ^= a; d = ROTL32(d, 16); \
     c += d; b ^= c; b = ROTL32(b, 12); \
     a += b; d ^= a; d = ROTL32(d, 8); \
     c += d; b ^= c; b = ROTL32(b, 7)
 
 // ChaCha20 block function
 static void chacha20_block(uint32_t out[16], const uint32_t in[16]) {
     int i;
     uint32_t x[16];
 
     // Copy input to working state
     for (i = 0; i < 16; i++) {
         x[i] = in[i];
     }
 
     // 20 rounds (10 double rounds)
     for (i = 0; i < 10; i++) {
         // Column rounds
         QUARTERROUND(x[0], x[4], x[8], x[12]);
         QUARTERROUND(x[1], x[5], x[9], x[13]);
         QUARTERROUND(x[2], x[6], x[10], x[14]);
         QUARTERROUND(x[3], x[7], x[11], x[15]);
 
         // Diagonal rounds
         QUARTERROUND(x[0], x[5], x[10], x[15]);
         QUARTERROUND(x[1], x[6], x[11], x[12]);
         QUARTERROUND(x[2], x[7], x[8], x[13]);
         QUARTERROUND(x[3], x[4], x[9], x[14]);
     }
 
     // Add original state
     for (i = 0; i < 16; i++) {
         out[i] = x[i] + in[i];
     }
 }
 
 /**
  * HChaCha20 - Key derivation for XChaCha20
  *
  * Takes a 256-bit key and 128-bit nonce, produces a 256-bit subkey.
  * This is ChaCha20 without the final addition, outputting only
  * the first and last 4 words.
  */
 void hchacha20(const uint8_t key[32], const uint8_t nonce[16], uint8_t subkey[32]) {
     uint32_t state[16];
     int i;
 
     // Constants "expand 32-byte k"
     state[0] = 0x61707865;
     state[1] = 0x3320646e;
     state[2] = 0x79622d32;
     state[3] = 0x6b206574;
 
     // Key (256 bits = 8 words)
     state[4] = read_le32(key + 0);
     state[5] = read_le32(key + 4);
     state[6] = read_le32(key + 8);
     state[7] = read_le32(key + 12);
     state[8] = read_le32(key + 16);
     state[9] = read_le32(key + 20);
     state[10] = read_le32(key + 24);
     state[11] = read_le32(key + 28);
 
     // Nonce (128 bits = 4 words)
     state[12] = read_le32(nonce + 0);
     state[13] = read_le32(nonce + 4);
     state[14] = read_le32(nonce + 8);
     state[15] = read_le32(nonce + 12);
 
     // 20 rounds (10 double rounds) - same as ChaCha20
     for (i = 0; i < 10; i++) {
         // Column rounds
         QUARTERROUND(state[0], state[4], state[8], state[12]);
         QUARTERROUND(state[1], state[5], state[9], state[13]);
         QUARTERROUND(state[2], state[6], state[10], state[14]);
         QUARTERROUND(state[3], state[7], state[11], state[15]);
 
         // Diagonal rounds
         QUARTERROUND(state[0], state[5], state[10], state[15]);
         QUARTERROUND(state[1], state[6], state[11], state[12]);
         QUARTERROUND(state[2], state[7], state[8], state[13]);
         QUARTERROUND(state[3], state[4], state[9], state[14]);
     }
 
     // Output subkey: first 4 words + last 4 words (total 256 bits)
     write_le32(subkey + 0, state[0]);
     write_le32(subkey + 4, state[1]);
     write_le32(subkey + 8, state[2]);
     write_le32(subkey + 12, state[3]);
     write_le32(subkey + 16, state[12]);
     write_le32(subkey + 20, state[13]);
     write_le32(subkey + 24, state[14]);
     write_le32(subkey + 28, state[15]);
 
     // Clear state
     memset(state, 0, sizeof(state));
 }
 
 // Initialize XChaCha20 state
 static void xchacha20_init_state(xchacha20_context *ctx,
                                   const uint8_t *key,
                                   const uint8_t *nonce) {
     // Derive subkey using HChaCha20 with first 16 bytes of nonce
     uint8_t subkey[32];
     hchacha20(key, nonce, subkey);
 
     // Constants "expand 32-byte k"
     ctx->state[0] = 0x61707865;
     ctx->state[1] = 0x3320646e;
     ctx->state[2] = 0x79622d32;
     ctx->state[3] = 0x6b206574;
 
     // Subkey (256 bits = 8 words)
     ctx->state[4] = read_le32(subkey + 0);
     ctx->state[5] = read_le32(subkey + 4);
     ctx->state[6] = read_le32(subkey + 8);
     ctx->state[7] = read_le32(subkey + 12);
     ctx->state[8] = read_le32(subkey + 16);
     ctx->state[9] = read_le32(subkey + 20);
     ctx->state[10] = read_le32(subkey + 24);
     ctx->state[11] = read_le32(subkey + 28);
 
     // Counter (32 bits) - starts at 0
     ctx->state[12] = 0;
 
     // Last 8 bytes of XChaCha nonce become ChaCha nonce (64 bits + 32 bits padding)
     ctx->state[13] = read_le32(nonce + 16);
     ctx->state[14] = read_le32(nonce + 20);
     ctx->state[15] = 0; // Padding
 
     ctx->keystream_pos = 64; // Force generation on first use
     ctx->counter = 0;
 
     // Clear subkey
     memset(subkey, 0, sizeof(subkey));
 }
 
 // Generate next XChaCha20 keystream block
 static void xchacha20_generate_block(xchacha20_context *ctx) {
     uint32_t block[16];
 
     chacha20_block(block, ctx->state);
 
     // Convert to bytes
     for (int i = 0; i < 16; i++) {
         write_le32(ctx->keystream + i * 4, block[i]);
     }
 
     // Increment counter
     ctx->state[12]++;
     ctx->keystream_pos = 0;
 }
 
 // Poly1305 clamp function
 static void poly1305_clamp(uint32_t r[5], const uint8_t key[16]) {
     r[0] = (read_le32(key + 0)) & 0x0fffffff;
     r[1] = (read_le32(key + 4)) & 0x0ffffffc;
     r[2] = (read_le32(key + 8)) & 0x0ffffffc;
     r[3] = (read_le32(key + 12)) & 0x0ffffffc;
     r[4] = 0;
 }
 
 // Poly1305 initialization
 static void poly1305_init(xchacha20_poly1305_context_mac *ctx, const uint8_t key[32]) {
     // Clamp r
     poly1305_clamp(ctx->r, key);
 
     // Set pad
     ctx->pad[0] = read_le32(key + 16);
     ctx->pad[1] = read_le32(key + 20);
     ctx->pad[2] = read_le32(key + 24);
     ctx->pad[3] = read_le32(key + 28);
 
     // Initialize accumulator
     ctx->h[0] = ctx->h[1] = ctx->h[2] = ctx->h[3] = ctx->h[4] = 0;
     ctx->buffer_len = 0;
     ctx->total_len = 0;
 }
 
 // Poly1305 block processing
 static void poly1305_block(xchacha20_poly1305_context_mac *ctx, const uint8_t block[16], int final) {
     uint64_t h0 = ctx->h[0];
     uint64_t h1 = ctx->h[1];
     uint64_t h2 = ctx->h[2];
     uint64_t h3 = ctx->h[3];
     uint64_t h4 = ctx->h[4];
 
     // Add block (with high bit for non-final blocks)
     h0 += (read_le32(block + 0)) & 0xffffffff;
     h1 += (read_le32(block + 4)) & 0xffffffff;
     h2 += (read_le32(block + 8)) & 0xffffffff;
     h3 += (read_le32(block + 12)) & 0xffffffff;
     h4 += final ? 0 : (1ULL << 24);
 
     // Multiply by r
     uint64_t r0 = ctx->r[0];
     uint64_t r1 = ctx->r[1];
     uint64_t r2 = ctx->r[2];
     uint64_t r3 = ctx->r[3];
 
     uint64_t s1 = r1 * 5;
     uint64_t s2 = r2 * 5;
     uint64_t s3 = r3 * 5;
 
     uint64_t d0 = h0 * r0 + h1 * s3 + h2 * s2 + h3 * s1;
     uint64_t d1 = h0 * r1 + h1 * r0 + h2 * s3 + h3 * s2 + h4 * s1;
     uint64_t d2 = h0 * r2 + h1 * r1 + h2 * r0 + h3 * s3 + h4 * s2;
     uint64_t d3 = h0 * r3 + h1 * r2 + h2 * r1 + h3 * r0 + h4 * s3;
     uint64_t d4 = h4 * r0;
 
     // Carry propagation
     uint64_t c;
     c = d0 >> 26; h0 = d0 & 0x3ffffff;
     d1 += c; c = d1 >> 26; h1 = d1 & 0x3ffffff;
     d2 += c; c = d2 >> 26; h2 = d2 & 0x3ffffff;
     d3 += c; c = d3 >> 26; h3 = d3 & 0x3ffffff;
     d4 += c; c = d4 >> 26; h4 = d4 & 0x3ffffff;
     h0 += c * 5; c = h0 >> 26; h0 &= 0x3ffffff;
     h1 += c;
 
     ctx->h[0] = (uint32_t)h0;
     ctx->h[1] = (uint32_t)h1;
     ctx->h[2] = (uint32_t)h2;
     ctx->h[3] = (uint32_t)h3;
     ctx->h[4] = (uint32_t)h4;
 }
 
 // Poly1305 update
 static void poly1305_update(xchacha20_poly1305_context_mac *ctx, const uint8_t *data, size_t len) {
     ctx->total_len += len;
 
     // Process buffered data
     if (ctx->buffer_len > 0) {
         size_t to_copy = 16 - ctx->buffer_len;
         if (to_copy > len) to_copy = len;
         memcpy(ctx->buffer + ctx->buffer_len, data, to_copy);
         ctx->buffer_len += to_copy;
         data += to_copy;
         len -= to_copy;
 
         if (ctx->buffer_len == 16) {
             poly1305_block(ctx, ctx->buffer, 0);
             ctx->buffer_len = 0;
         }
     }
 
     // Process full blocks
     while (len >= 16) {
         poly1305_block(ctx, data, 0);
         data += 16;
         len -= 16;
     }
 
     // Buffer remaining data
     if (len > 0) {
         memcpy(ctx->buffer, data, len);
         ctx->buffer_len = len;
     }
 }
 
 // Poly1305 finalization
 static void poly1305_finish(xchacha20_poly1305_context_mac *ctx, uint8_t tag[16]) {
     // Process final block
     if (ctx->buffer_len > 0) {
         uint8_t final_block[16] = {0};
         memcpy(final_block, ctx->buffer, ctx->buffer_len);
         final_block[ctx->buffer_len] = 1;
         poly1305_block(ctx, final_block, 1);
     }
 
     // Final reduction
     uint64_t h0 = ctx->h[0];
     uint64_t h1 = ctx->h[1];
     uint64_t h2 = ctx->h[2];
     uint64_t h3 = ctx->h[3];
     uint64_t h4 = ctx->h[4];
 
     uint64_t c;
     c = h1 >> 26; h1 &= 0x3ffffff;
     h2 += c; c = h2 >> 26; h2 &= 0x3ffffff;
     h3 += c; c = h3 >> 26; h3 &= 0x3ffffff;
     h4 += c; c = h4 >> 26; h4 &= 0x3ffffff;
     h0 += c * 5; c = h0 >> 26; h0 &= 0x3ffffff;
     h1 += c;
 
     uint64_t g0 = h0 + 5; c = g0 >> 26; g0 &= 0x3ffffff;
     uint64_t g1 = h1 + c; c = g1 >> 26; g1 &= 0x3ffffff;
     uint64_t g2 = h2 + c; c = g2 >> 26; g2 &= 0x3ffffff;
     uint64_t g3 = h3 + c; c = g3 >> 26; g3 &= 0x3ffffff;
     uint64_t g4 = h4 + c - (1ULL << 26);
 
     uint64_t mask = (g4 >> 63) - 1;
     g0 &= mask; g1 &= mask; g2 &= mask; g3 &= mask; g4 &= mask;
     mask = ~mask;
     h0 = (h0 & mask) | g0;
     h1 = (h1 & mask) | g1;
     h2 = (h2 & mask) | g2;
     h3 = (h3 & mask) | g3;
     h4 = (h4 & mask) | g4;
 
     // Add pad
     uint64_t f0 = ((h0) | (h1 << 26)) + ctx->pad[0];
     uint64_t f1 = ((h1 >> 6) | (h2 << 20)) + ctx->pad[1] + (f0 >> 32);
     uint64_t f2 = ((h2 >> 12) | (h3 << 14)) + ctx->pad[2] + (f1 >> 32);
     uint64_t f3 = ((h3 >> 18) | (h4 << 8)) + ctx->pad[3] + (f2 >> 32);
 
     write_le32(tag + 0, (uint32_t)f0);
     write_le32(tag + 4, (uint32_t)f1);
     write_le32(tag + 8, (uint32_t)f2);
     write_le32(tag + 12, (uint32_t)f3);
 }
 
 // Initialize XChaCha20-Poly1305
 int xchacha20_poly1305_init(xchacha20_poly1305_context *ctx,
                              const uint8_t *key,
                              const uint8_t *nonce) {
     if (!ctx || !key || !nonce) return -1;
 
     // Initialize XChaCha20 with extended nonce
     xchacha20_init_state(&ctx->cipher, key, nonce);
 
     // Generate Poly1305 key (first 32 bytes of keystream with counter=0)
     uint8_t poly_key[32];
     for (int i = 0; i < 32; i++) {
         if (ctx->cipher.keystream_pos >= 64) {
             xchacha20_generate_block(&ctx->cipher);
         }
         poly_key[i] = ctx->cipher.keystream[ctx->cipher.keystream_pos++];
     }
 
     // Initialize Poly1305
     poly1305_init(&ctx->mac, poly_key);
     memset(poly_key, 0, sizeof(poly_key));
 
     ctx->aad_len = 0;
     ctx->data_len = 0;
 
     return 0;
 }
 
 // XChaCha20-Poly1305 encryption
 int xchacha20_poly1305_encrypt(xchacha20_poly1305_context *ctx,
                                 const uint8_t *aad, size_t aad_len,
                                 const uint8_t *plaintext, size_t pt_len,
                                 uint8_t *ciphertext,
                                 uint8_t *tag) {
     if (!ctx || !tag) return -1;
     if (pt_len > 0 && (!plaintext || !ciphertext)) return -1;
     if (aad_len > 0 && !aad) return -1;
 
     // Authenticate AAD
     if (aad_len > 0) {
         poly1305_update(&ctx->mac, aad, aad_len);
         ctx->aad_len = aad_len;
     }
 
     // Pad AAD to 16 bytes
     if (aad_len % 16 != 0) {
         uint8_t padding[16] = {0};
         poly1305_update(&ctx->mac, padding, 16 - (aad_len % 16));
     }
 
     // Encrypt and authenticate ciphertext
     for (size_t i = 0; i < pt_len; i++) {
         if (ctx->cipher.keystream_pos >= 64) {
             xchacha20_generate_block(&ctx->cipher);
         }
         ciphertext[i] = plaintext[i] ^ ctx->cipher.keystream[ctx->cipher.keystream_pos++];
     }
 
     if (pt_len > 0) {
         poly1305_update(&ctx->mac, ciphertext, pt_len);
         ctx->data_len = pt_len;
     }
 
     // Pad ciphertext to 16 bytes
     if (pt_len % 16 != 0) {
         uint8_t padding[16] = {0};
         poly1305_update(&ctx->mac, padding, 16 - (pt_len % 16));
     }
 
     // Authenticate lengths
     uint8_t len_block[16];
     write_le64(len_block + 0, aad_len);
     write_le64(len_block + 8, pt_len);
     poly1305_update(&ctx->mac, len_block, 16);
 
     // Compute tag
     poly1305_finish(&ctx->mac, tag);
 
     return 0;
 }
 
 // XChaCha20-Poly1305 decryption
 int xchacha20_poly1305_decrypt(xchacha20_poly1305_context *ctx,
                                 const uint8_t *aad, size_t aad_len,
                                 const uint8_t *ciphertext, size_t ct_len,
                                 const uint8_t *tag,
                                 uint8_t *plaintext) {
     if (!ctx || !tag) return -1;
     if (ct_len > 0 && (!ciphertext || !plaintext)) return -1;
     if (aad_len > 0 && !aad) return -1;
 
     // Authenticate AAD
     if (aad_len > 0) {
         poly1305_update(&ctx->mac, aad, aad_len);
         ctx->aad_len = aad_len;
     }
 
     // Pad AAD to 16 bytes
     if (aad_len % 16 != 0) {
         uint8_t padding[16] = {0};
         poly1305_update(&ctx->mac, padding, 16 - (aad_len % 16));
     }
 
     // Authenticate ciphertext
     if (ct_len > 0) {
         poly1305_update(&ctx->mac, ciphertext, ct_len);
         ctx->data_len = ct_len;
     }
 
     // Pad ciphertext to 16 bytes
     if (ct_len % 16 != 0) {
         uint8_t padding[16] = {0};
         poly1305_update(&ctx->mac, padding, 16 - (ct_len % 16));
     }
 
     // Authenticate lengths
     uint8_t len_block[16];
     write_le64(len_block + 0, aad_len);
     write_le64(len_block + 8, ct_len);
     poly1305_update(&ctx->mac, len_block, 16);
 
     // Compute and verify tag
     uint8_t computed_tag[16];
     poly1305_finish(&ctx->mac, computed_tag);
 
     // Constant-time comparison
     int mismatch = 0;
     for (int i = 0; i < 16; i++) {
         mismatch |= (tag[i] ^ computed_tag[i]);
     }
 
     if (mismatch != 0) {
         memset(computed_tag, 0, sizeof(computed_tag));
         return -1; // Authentication failed
     }
 
     memset(computed_tag, 0, sizeof(computed_tag));
 
     // Decrypt ciphertext
     for (size_t i = 0; i < ct_len; i++) {
         if (ctx->cipher.keystream_pos >= 64) {
             xchacha20_generate_block(&ctx->cipher);
         }
         plaintext[i] = ciphertext[i] ^ ctx->cipher.keystream[ctx->cipher.keystream_pos++];
     }
 
     return 0;
 }
 
 // Cleanup
 void xchacha20_poly1305_cleanup(xchacha20_poly1305_context *ctx) {
     if (!ctx) return;
     volatile uint8_t *p = (volatile uint8_t *)ctx;
     size_t n = sizeof(xchacha20_poly1305_context);
     while (n--) {
         *p++ = 0;
     }
 }