aboutsummaryrefslogtreecommitdiffstats
path: root/src/stream/salsa20
diff options
context:
space:
mode:
authorlloyd <[email protected]>2010-03-03 00:47:19 +0000
committerlloyd <[email protected]>2010-03-03 00:47:19 +0000
commit265c39bd4efb3155ec68ea09018a3e83499862f9 (patch)
treef94564a2d332febdbd546ded6127d0b1e1246059 /src/stream/salsa20
parente04cd85725b712c747ef5dbed2e94b7a7207ef22 (diff)
Add XSalsa20
Diffstat (limited to 'src/stream/salsa20')
-rw-r--r--src/stream/salsa20/salsa20.cpp112
-rw-r--r--src/stream/salsa20/salsa20.h8
2 files changed, 108 insertions, 12 deletions
diff --git a/src/stream/salsa20/salsa20.cpp b/src/stream/salsa20/salsa20.cpp
index 1b97f4421..0243149f1 100644
--- a/src/stream/salsa20/salsa20.cpp
+++ b/src/stream/salsa20/salsa20.cpp
@@ -1,6 +1,6 @@
/*
-* Salsa20
-* (C) 1999-2008 Jack Lloyd
+* Salsa20 / XSalsa20
+* (C) 1999-2010 Jack Lloyd
*
* Distributed under the terms of the Botan license
*/
@@ -15,6 +15,75 @@ namespace Botan {
namespace {
/*
+* Generate HSalsa20 cipher stream (for XSalsa20 IV setup)
+*/
+void hsalsa20(u32bit output[8], const u32bit input[16])
+ {
+ u32bit x00 = input[0];
+ u32bit x01 = input[1];
+ u32bit x02 = input[2];
+ u32bit x03 = input[3];
+ u32bit x04 = input[4];
+ u32bit x05 = input[5];
+ u32bit x06 = input[6];
+ u32bit x07 = input[7];
+ u32bit x08 = input[8];
+ u32bit x09 = input[9];
+ u32bit x10 = input[10];
+ u32bit x11 = input[11];
+ u32bit x12 = input[12];
+ u32bit x13 = input[13];
+ u32bit x14 = input[14];
+ u32bit x15 = input[15];
+
+ for(u32bit i = 0; i != 10; ++i)
+ {
+ x04 ^= rotate_left(x00 + x12, 7);
+ x08 ^= rotate_left(x04 + x00, 9);
+ x12 ^= rotate_left(x08 + x04, 13);
+ x00 ^= rotate_left(x12 + x08, 18);
+ x09 ^= rotate_left(x05 + x01, 7);
+ x13 ^= rotate_left(x09 + x05, 9);
+ x01 ^= rotate_left(x13 + x09, 13);
+ x05 ^= rotate_left(x01 + x13, 18);
+ x14 ^= rotate_left(x10 + x06, 7);
+ x02 ^= rotate_left(x14 + x10, 9);
+ x06 ^= rotate_left(x02 + x14, 13);
+ x10 ^= rotate_left(x06 + x02, 18);
+ x03 ^= rotate_left(x15 + x11, 7);
+ x07 ^= rotate_left(x03 + x15, 9);
+ x11 ^= rotate_left(x07 + x03, 13);
+ x15 ^= rotate_left(x11 + x07, 18);
+
+ x01 ^= rotate_left(x00 + x03, 7);
+ x02 ^= rotate_left(x01 + x00, 9);
+ x03 ^= rotate_left(x02 + x01, 13);
+ x00 ^= rotate_left(x03 + x02, 18);
+ x06 ^= rotate_left(x05 + x04, 7);
+ x07 ^= rotate_left(x06 + x05, 9);
+ x04 ^= rotate_left(x07 + x06, 13);
+ x05 ^= rotate_left(x04 + x07, 18);
+ x11 ^= rotate_left(x10 + x09, 7);
+ x08 ^= rotate_left(x11 + x10, 9);
+ x09 ^= rotate_left(x08 + x11, 13);
+ x10 ^= rotate_left(x09 + x08, 18);
+ x12 ^= rotate_left(x15 + x14, 7);
+ x13 ^= rotate_left(x12 + x15, 9);
+ x14 ^= rotate_left(x13 + x12, 13);
+ x15 ^= rotate_left(x14 + x13, 18);
+ }
+
+ output[0] = x00;
+ output[1] = x05;
+ output[2] = x10;
+ output[3] = x15;
+ output[4] = x06;
+ output[5] = x07;
+ output[6] = x08;
+ output[7] = x09;
+ }
+
+/*
* Generate Salsa20 cipher stream
*/
void salsa20(byte output[64], const u32bit input[16])
@@ -100,11 +169,11 @@ void Salsa20::cipher(const byte in[], byte out[], u32bit length)
{
while(length >= buffer.size() - position)
{
- xor_buf(out, in, buffer.begin() + position, buffer.size() - position);
+ xor_buf(out, in, &buffer[position], buffer.size() - position);
length -= (buffer.size() - position);
in += (buffer.size() - position);
out += (buffer.size() - position);
- salsa20(buffer.begin(), state);
+ salsa20(&buffer[0], state);
++state[8];
if(!state[8]) // if overflow in state[8]
@@ -113,7 +182,7 @@ void Salsa20::cipher(const byte in[], byte out[], u32bit length)
position = 0;
}
- xor_buf(out, in, buffer.begin() + position, length);
+ xor_buf(out, in, &buffer[position], length);
position += length;
}
@@ -174,12 +243,39 @@ void Salsa20::set_iv(const byte iv[], u32bit length)
if(!valid_iv_length(length))
throw Invalid_IV_Length(name(), length);
- state[6] = load_le<u32bit>(iv, 0);
- state[7] = load_le<u32bit>(iv, 1);
+ if(length == 8)
+ {
+ // Salsa20
+ state[6] = load_le<u32bit>(iv, 0);
+ state[7] = load_le<u32bit>(iv, 1);
+ }
+ else
+ {
+ // XSalsa20
+ state[6] = load_le<u32bit>(iv, 0);
+ state[7] = load_le<u32bit>(iv, 1);
+ state[8] = load_le<u32bit>(iv, 2);
+ state[9] = load_le<u32bit>(iv, 3);
+
+ SecureVector<u32bit> hsalsa(8);
+ hsalsa20(hsalsa, state);
+
+ state[ 1] = hsalsa[0];
+ state[ 2] = hsalsa[1];
+ state[ 3] = hsalsa[2];
+ state[ 4] = hsalsa[3];
+ state[ 6] = load_le<u32bit>(iv, 4);
+ state[ 7] = load_le<u32bit>(iv, 5);
+ state[11] = hsalsa[4];
+ state[12] = hsalsa[5];
+ state[13] = hsalsa[6];
+ state[14] = hsalsa[7];
+ }
+
state[8] = 0;
state[9] = 0;
- salsa20(buffer.begin(), state);
+ salsa20(&buffer[0], state);
++state[8];
if(!state[8]) // if overflow in state[8]
++state[9]; // carry to state[9]
diff --git a/src/stream/salsa20/salsa20.h b/src/stream/salsa20/salsa20.h
index 3ca781ea2..016745355 100644
--- a/src/stream/salsa20/salsa20.h
+++ b/src/stream/salsa20/salsa20.h
@@ -1,6 +1,6 @@
/*
-* Salsa20
-* (C) 1999-2008 Jack Lloyd
+* Salsa20 / XSalsa20
+* (C) 1999-2010 Jack Lloyd
*
* Distributed under the terms of the Botan license
*/
@@ -13,7 +13,7 @@
namespace Botan {
/*
-* Salsa20
+* Salsa20 (and XSalsa20)
*/
class BOTAN_DLL Salsa20 : public StreamCipher
{
@@ -23,7 +23,7 @@ class BOTAN_DLL Salsa20 : public StreamCipher
void set_iv(const byte iv[], u32bit iv_len);
bool valid_iv_length(u32bit iv_len) const
- { return (iv_len == 8); }
+ { return (iv_len == 8 || iv_len == 24); }
void clear();
std::string name() const;