Support zero-length IV in ChaCha

Equivalent to an 8 byte all-zero IV, same handling as Salsa.

2 files changed, 17 insertions, 3 deletions

diff --git a/src/lib/stream/chacha/chacha.cpp b/src/lib/stream/chacha/chacha.cpp
index 4befe1981..d56f9e60a 100644
--- a/src/lib/stream/chacha/chacha.cpp
+++ b/src/lib/stream/chacha/chacha.cpp
@@ -171,6 +171,11 @@ void ChaCha::key_schedule(const uint8_t key[], size_t length)
    set_iv(ZERO, sizeof(ZERO));
    }
 
+bool ChaCha::valid_iv_length(size_t iv_len) const
+   {
+   return (iv_len == 0 || iv_len == 8 || iv_len == 12);
+   }
+
 void ChaCha::set_iv(const uint8_t iv[], size_t length)
    {
    if(!valid_iv_length(length))
@@ -179,7 +184,13 @@ void ChaCha::set_iv(const uint8_t iv[], size_t length)
    m_state[12] = 0;
    m_state[13] = 0;
 
-   if(length == 8)
+   if(length == 0)
+      {
+      // Treat zero length IV same as an all-zero IV
+      m_state[14] = 0;
+      m_state[15] = 0;
+      }
+   else if(length == 8)
       {
       m_state[14] = load_le<uint32_t>(iv, 0);
       m_state[15] = load_le<uint32_t>(iv, 1);
diff --git a/src/lib/stream/chacha/chacha.h b/src/lib/stream/chacha/chacha.h
index 876b9ca33..64a387ec5 100644
--- a/src/lib/stream/chacha/chacha.h
+++ b/src/lib/stream/chacha/chacha.h
@@ -33,8 +33,11 @@ class BOTAN_DLL ChaCha final : public StreamCipher
 
       void set_iv(const uint8_t iv[], size_t iv_len) override;
 
-      bool valid_iv_length(size_t iv_len) const override
-         { return (iv_len == 8 || iv_len == 12); }
+      /*
+      * ChaCha accepts 0, 8, or 12 byte IVs. The default IV is a 8 zero bytes.
+      * An IV of length 0 is treated the same as the default zero IV.
+      */
+      bool valid_iv_length(size_t iv_len) const override;
 
       Key_Length_Specification key_spec() const override
          {