From patchwork Tue Sep 18 16:16:29 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Jason A. Donenfeld" X-Patchwork-Id: 146911 Delivered-To: patch@linaro.org Received: by 2002:a2e:1648:0:0:0:0:0 with SMTP id 8-v6csp64332ljw; Tue, 18 Sep 2018 09:18:21 -0700 (PDT) X-Google-Smtp-Source: ANB0VdbOH+rlZOLfUCzcRxaRZSxtTuHbT5DrAhGOdVUeo3vWwO2x3vr44uDCOgQkz2kszP6GjViH X-Received: by 2002:a17:902:b08f:: with SMTP id p15-v6mr3044044plr.296.1537287496754; Tue, 18 Sep 2018 09:18:16 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1537287496; cv=none; d=google.com; s=arc-20160816; b=quBDJImRCgL3UzLn3TT+sf5ygGfJj0gMf/El37VFbS1svOhwkKw+esX6qV2tsIAoTV h+GqudV1nzPvsIQvZQm6uGKirPCtzzDE84BlebLLMQrQGUHRSEonnoJcNPFYEIPwvwAt WdVQ2KhXyKDmlFETJpqe6QCdYq8S+7mdFi4+js1fF1ERKcEsntqL/QhtvLpg4xf0ynW4 CNySDlcBg8ABJq/naUCGWwNAeIOo13SlfN+YLvzZr+X6dp/U6/Cf+lZfjbpHwrQQ4wEe 4N579g4KPjNSZft6SVDgaa/HVNHDIF1G/1+rwZiC3lyBPVk1yZHKnAmKOgFVeSXcnQUE ZmyQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=zhw4eDmQJWaN2VStBXW18RSTPDmYpB89f6qcBsReWEQ=; b=hoYyLOdeUzov+m2rOdj9euhM2xoczhbt958YUjSdnlMpjLzetuEe+6iVMN56LXWnUM AOFRw1KA3aThyiKbX5Acqp1km0gkplxVncMyHFyPtRTwT0iDstsVHWzAf9jU7E2jYhBP jsVrR1PoOrKqAFQOYYCZbvsWG8EViOEMI8hTYZqRojNq6IHP9e7C4s5UiGEZePvr6aOH L+GrcM2+tA2NnexYVAR69R7ZcscsOYm/7cJZP1pD5gRyFQcipGoRq2nB+6u0/sGjXkCM qljR7Hi0si43jXoOpwSteY3MVvxomLqHOyhnxn02Y8zCacTeRc8SS21n9NVSG1/J77as SGZQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@zx2c4.com header.s=mail header.b=WKu6XbT7; spf=pass (google.com: best guess record for domain of netdev-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=netdev-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=zx2c4.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id v9-v6si19923535pfg.123.2018.09.18.09.18.12; Tue, 18 Sep 2018 09:18:16 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of netdev-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@zx2c4.com header.s=mail header.b=WKu6XbT7; spf=pass (google.com: best guess record for domain of netdev-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=netdev-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=zx2c4.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730250AbeIRVuv (ORCPT + 10 others); Tue, 18 Sep 2018 17:50:51 -0400 Received: from frisell.zx2c4.com ([192.95.5.64]:57805 "EHLO frisell.zx2c4.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729905AbeIRVuu (ORCPT ); Tue, 18 Sep 2018 17:50:50 -0400 Received: by frisell.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 7faad02f; Tue, 18 Sep 2018 15:59:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=zx2c4.com; h=from:to:cc :subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; s=mail; bh=LbTDJo+M3jHypcrtDy3qxh1o0 Qc=; b=WKu6XbT7gvKWgamUSUZwBhfJQajHo3lBpY3f1ZzKrBm/JH/glfU7Ou1cD UFus5kqqwYuOUDbe3fMP+t1j9qsKVNf23FsYGeDv24ZRdep/qrym6LfF0U514ztw jL/Pch5wAt8Qp/3uQB9GqkKAUxPwJ6HZupMnfkzrx+rFJLbE7nixpSyCkQWFk0Rh iROYp9ta6IKQjrpU4UCzvElVAVghdgIO+94gEZ9epMX5Dvz6CvxG7OU3pyEtEtnN 58YkA/8BqzzpuD6EcDKmf/XbQ/5dVXO4xWBvW2Q/G9XUgsM98bSdpu0NTunthGs4 cibVI4ynvDL5B2kRPqkwigJ/UUJ5A== Received: by frisell.zx2c4.com (ZX2C4 Mail Server) with ESMTPSA id 5c024547 (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256:NO); Tue, 18 Sep 2018 15:59:47 +0000 (UTC) From: "Jason A. Donenfeld" To: linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linux-crypto@vger.kernel.org, davem@davemloft.net, gregkh@linuxfoundation.org Cc: "Jason A. Donenfeld" , Samuel Neves , Andy Lutomirski , Jean-Philippe Aumasson Subject: [PATCH net-next v5 03/20] zinc: ChaCha20 generic C implementation and selftest Date: Tue, 18 Sep 2018 18:16:29 +0200 Message-Id: <20180918161646.19105-4-Jason@zx2c4.com> In-Reply-To: <20180918161646.19105-1-Jason@zx2c4.com> References: <20180918161646.19105-1-Jason@zx2c4.com> MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org This implements the ChaCha20 permutation as a single C statement, by way of the comma operator, which the compiler is able to simplify terrifically. Information: https://cr.yp.to/chacha.html Signed-off-by: Jason A. Donenfeld Cc: Samuel Neves Cc: Andy Lutomirski Cc: Greg KH Cc: Jean-Philippe Aumasson --- include/zinc/chacha20.h | 52 ++ lib/zinc/Kconfig | 4 + lib/zinc/Makefile | 3 + lib/zinc/chacha20/chacha20.c | 193 ++++++ lib/zinc/selftest/chacha20.h | 1182 ++++++++++++++++++++++++++++++++++ 5 files changed, 1434 insertions(+) create mode 100644 include/zinc/chacha20.h create mode 100644 lib/zinc/chacha20/chacha20.c create mode 100644 lib/zinc/selftest/chacha20.h -- 2.19.0 diff --git a/include/zinc/chacha20.h b/include/zinc/chacha20.h new file mode 100644 index 000000000000..afad69409f5f --- /dev/null +++ b/include/zinc/chacha20.h @@ -0,0 +1,52 @@ +/* SPDX-License-Identifier: MIT + * + * Copyright (C) 2015-2018 Jason A. Donenfeld . All Rights Reserved. + */ + +#ifndef _ZINC_CHACHA20_H +#define _ZINC_CHACHA20_H + +#include +#include +#include +#include + +enum { + CHACHA20_IV_SIZE = 16, + CHACHA20_KEY_SIZE = 32, + CHACHA20_BLOCK_SIZE = 64, + CHACHA20_BLOCK_WORDS = CHACHA20_BLOCK_SIZE / sizeof(u32), + HCHACHA20_KEY_SIZE = 32, + HCHACHA20_NONCE_SIZE = 16 +}; + +struct chacha20_ctx { + u32 key[8]; + u32 counter[4]; +} __aligned(32); + +static inline void chacha20_init(struct chacha20_ctx *state, + const u8 key[CHACHA20_KEY_SIZE], + const u64 nonce) +{ + state->key[0] = get_unaligned_le32(key + 0); + state->key[1] = get_unaligned_le32(key + 4); + state->key[2] = get_unaligned_le32(key + 8); + state->key[3] = get_unaligned_le32(key + 12); + state->key[4] = get_unaligned_le32(key + 16); + state->key[5] = get_unaligned_le32(key + 20); + state->key[6] = get_unaligned_le32(key + 24); + state->key[7] = get_unaligned_le32(key + 28); + state->counter[0] = state->counter[1] = 0; + state->counter[2] = nonce & U32_MAX; + state->counter[3] = nonce >> 32; +} +void chacha20(struct chacha20_ctx *state, u8 *dst, const u8 *src, u32 len, + simd_context_t *simd_context); + +/* Derived key should be 32-bit aligned */ +void hchacha20(u8 derived_key[CHACHA20_KEY_SIZE], + const u8 nonce[HCHACHA20_NONCE_SIZE], + const u8 key[HCHACHA20_KEY_SIZE], simd_context_t *simd_context); + +#endif /* _ZINC_CHACHA20_H */ diff --git a/lib/zinc/Kconfig b/lib/zinc/Kconfig index 4e2e59126a67..1ca1ae1e9ea9 100644 --- a/lib/zinc/Kconfig +++ b/lib/zinc/Kconfig @@ -1,3 +1,7 @@ +config ZINC_CHACHA20 + tristate + select CRYPTO_ALGAPI + config ZINC_DEBUG bool "Zinc cryptography library debugging and self-tests" help diff --git a/lib/zinc/Makefile b/lib/zinc/Makefile index 83dfd63988c0..83b320f1ace2 100644 --- a/lib/zinc/Makefile +++ b/lib/zinc/Makefile @@ -2,3 +2,6 @@ ccflags-y := -O3 ccflags-y += -Wframe-larger-than=$(if (CONFIG_KASAN),16384,8192) ccflags-y += -D'pr_fmt(fmt)="zinc: " fmt' ccflags-$(CONFIG_ZINC_DEBUG) += -DDEBUG + +zinc_chacha20-y := chacha20/chacha20.o +obj-$(CONFIG_ZINC_CHACHA20) += zinc_chacha20.o diff --git a/lib/zinc/chacha20/chacha20.c b/lib/zinc/chacha20/chacha20.c new file mode 100644 index 000000000000..3f00e1edd4c8 --- /dev/null +++ b/lib/zinc/chacha20/chacha20.c @@ -0,0 +1,193 @@ +/* SPDX-License-Identifier: MIT + * + * Copyright (C) 2015-2018 Jason A. Donenfeld . All Rights Reserved. + * + * Implementation of the ChaCha20 stream cipher. + * + * Information: https://cr.yp.to/chacha.html + */ + +#include + +#include +#include +#include +#include + +#ifndef HAVE_CHACHA20_ARCH_IMPLEMENTATION +void __init chacha20_fpu_init(void) +{ +} +static inline bool chacha20_arch(u8 *out, const u8 *in, const size_t len, + const u32 key[8], const u32 counter[4], + simd_context_t *simd_context) +{ + return false; +} +static inline bool hchacha20_arch(u8 *derived_key, const u8 *nonce, + const u8 *key, simd_context_t *simd_context) +{ + return false; +} +#endif + +#define EXPAND_32_BYTE_K 0x61707865U, 0x3320646eU, 0x79622d32U, 0x6b206574U + +#define QUARTER_ROUND(x, a, b, c, d) ( \ + x[a] += x[b], \ + x[d] = rol32((x[d] ^ x[a]), 16), \ + x[c] += x[d], \ + x[b] = rol32((x[b] ^ x[c]), 12), \ + x[a] += x[b], \ + x[d] = rol32((x[d] ^ x[a]), 8), \ + x[c] += x[d], \ + x[b] = rol32((x[b] ^ x[c]), 7) \ +) + +#define C(i, j) (i * 4 + j) + +#define DOUBLE_ROUND(x) ( \ + /* Column Round */ \ + QUARTER_ROUND(x, C(0, 0), C(1, 0), C(2, 0), C(3, 0)), \ + QUARTER_ROUND(x, C(0, 1), C(1, 1), C(2, 1), C(3, 1)), \ + QUARTER_ROUND(x, C(0, 2), C(1, 2), C(2, 2), C(3, 2)), \ + QUARTER_ROUND(x, C(0, 3), C(1, 3), C(2, 3), C(3, 3)), \ + /* Diagonal Round */ \ + QUARTER_ROUND(x, C(0, 0), C(1, 1), C(2, 2), C(3, 3)), \ + QUARTER_ROUND(x, C(0, 1), C(1, 2), C(2, 3), C(3, 0)), \ + QUARTER_ROUND(x, C(0, 2), C(1, 3), C(2, 0), C(3, 1)), \ + QUARTER_ROUND(x, C(0, 3), C(1, 0), C(2, 1), C(3, 2)) \ +) + +#define TWENTY_ROUNDS(x) ( \ + DOUBLE_ROUND(x), \ + DOUBLE_ROUND(x), \ + DOUBLE_ROUND(x), \ + DOUBLE_ROUND(x), \ + DOUBLE_ROUND(x), \ + DOUBLE_ROUND(x), \ + DOUBLE_ROUND(x), \ + DOUBLE_ROUND(x), \ + DOUBLE_ROUND(x), \ + DOUBLE_ROUND(x) \ +) + +static void chacha20_block_generic(__le32 *stream, u32 *state) +{ + u32 x[CHACHA20_BLOCK_WORDS]; + int i; + + for (i = 0; i < ARRAY_SIZE(x); ++i) + x[i] = state[i]; + + TWENTY_ROUNDS(x); + + for (i = 0; i < ARRAY_SIZE(x); ++i) + stream[i] = cpu_to_le32(x[i] + state[i]); + + ++state[12]; +} + +static void chacha20_generic(u8 *out, const u8 *in, u32 len, const u32 key[8], + const u32 counter[4]) +{ + __le32 buf[CHACHA20_BLOCK_WORDS]; + u32 x[] = { + EXPAND_32_BYTE_K, + key[0], key[1], key[2], key[3], + key[4], key[5], key[6], key[7], + counter[0], counter[1], counter[2], counter[3] + }; + + if (out != in) + memmove(out, in, len); + + while (len >= CHACHA20_BLOCK_SIZE) { + chacha20_block_generic(buf, x); + crypto_xor(out, (u8 *)buf, CHACHA20_BLOCK_SIZE); + len -= CHACHA20_BLOCK_SIZE; + out += CHACHA20_BLOCK_SIZE; + } + if (len) { + chacha20_block_generic(buf, x); + crypto_xor(out, (u8 *)buf, len); + } +} + +void chacha20(struct chacha20_ctx *state, u8 *dst, const u8 *src, u32 len, + simd_context_t *simd_context) +{ + if (!chacha20_arch(dst, src, len, state->key, state->counter, + simd_context)) + chacha20_generic(dst, src, len, state->key, state->counter); + state->counter[0] += (len + 63) / 64; +} +EXPORT_SYMBOL(chacha20); + +static void hchacha20_generic(u8 derived_key[CHACHA20_KEY_SIZE], + const u8 nonce[HCHACHA20_NONCE_SIZE], + const u8 key[HCHACHA20_KEY_SIZE]) +{ + __le32 *out = (__force __le32 *)derived_key; + u32 x[] = { EXPAND_32_BYTE_K, + get_unaligned_le32(key + 0), + get_unaligned_le32(key + 4), + get_unaligned_le32(key + 8), + get_unaligned_le32(key + 12), + get_unaligned_le32(key + 16), + get_unaligned_le32(key + 20), + get_unaligned_le32(key + 24), + get_unaligned_le32(key + 28), + get_unaligned_le32(nonce + 0), + get_unaligned_le32(nonce + 4), + get_unaligned_le32(nonce + 8), + get_unaligned_le32(nonce + 12) + }; + + TWENTY_ROUNDS(x); + + out[0] = cpu_to_le32(x[0]); + out[1] = cpu_to_le32(x[1]); + out[2] = cpu_to_le32(x[2]); + out[3] = cpu_to_le32(x[3]); + out[4] = cpu_to_le32(x[12]); + out[5] = cpu_to_le32(x[13]); + out[6] = cpu_to_le32(x[14]); + out[7] = cpu_to_le32(x[15]); +} + +/* Derived key should be 32-bit aligned */ +void hchacha20(u8 derived_key[CHACHA20_KEY_SIZE], + const u8 nonce[HCHACHA20_NONCE_SIZE], + const u8 key[HCHACHA20_KEY_SIZE], simd_context_t *simd_context) +{ + if (!hchacha20_arch(derived_key, nonce, key, simd_context)) + hchacha20_generic(derived_key, nonce, key); +} +EXPORT_SYMBOL(hchacha20); + +#include "../selftest/chacha20.h" + +static bool nosimd __initdata = false; + +static int __init mod_init(void) +{ + if (!nosimd) + chacha20_fpu_init(); +#ifdef DEBUG + if (!chacha20_selftest()) + return -ENOTRECOVERABLE; +#endif + return 0; +} + +static void __exit mod_exit(void) +{ +} + +module_param(nosimd, bool, 0); +module_init(mod_init); +module_exit(mod_exit); +MODULE_LICENSE("GPL v2"); +MODULE_DESCRIPTION("ChaCha20 stream cipher"); +MODULE_AUTHOR("Jason A. Donenfeld "); diff --git a/lib/zinc/selftest/chacha20.h b/lib/zinc/selftest/chacha20.h new file mode 100644 index 000000000000..f591460a854a --- /dev/null +++ b/lib/zinc/selftest/chacha20.h @@ -0,0 +1,1182 @@ +/* SPDX-License-Identifier: MIT + * + * Copyright (C) 2015-2018 Jason A. Donenfeld . All Rights Reserved. + */ + +#ifdef DEBUG + +enum { MAXIMUM_TEST_BUFFER_LEN = 800 }; + +struct chacha20_testvec { + u8 key[CHACHA20_KEY_SIZE]; + u64 nonce; + u8 input[MAXIMUM_TEST_BUFFER_LEN]; + u8 result[MAXIMUM_TEST_BUFFER_LEN]; + size_t ilen; +}; + +/* + * #!/usr/bin/env python3 + * + * import chacha20 + * import os + * import struct + * + * def encode_blob(blob): + * a = "" + * x = 0 + * for i in blob: + * a += ('0x%02x' % i) + "," + * x += 1 + * if x % 8 == 0: + * a += "\n\t\t " + * else: + * a += " " + * if x % 8 == 0: + * return a[:len(a) - 8] + * return a[:len(a) - 2] + * + * enc = [ ] + * dec = [ ] + * + * def make_vector(plen): + * key = os.urandom(32) + * nonce = os.urandom(8) + * p = os.urandom(plen) + * c = chacha20.chacha20_encrypt(p, key, nonce) + * + * out = "{\n" + * out += "\t.key\t= { " + encode_blob(key) + " },\n" + * out += "\t.nonce\t= " + hex(struct.unpack("