aboutsummaryrefslogtreecommitdiffstats
path: root/src/stream
diff options
context:
space:
mode:
Diffstat (limited to 'src/stream')
-rw-r--r--src/stream/salsa20/salsa20.cpp154
-rw-r--r--src/stream/salsa20/salsa20.h11
2 files changed, 94 insertions, 71 deletions
diff --git a/src/stream/salsa20/salsa20.cpp b/src/stream/salsa20/salsa20.cpp
index 1b97f4421..a38e6e305 100644
--- a/src/stream/salsa20/salsa20.cpp
+++ b/src/stream/salsa20/salsa20.cpp
@@ -1,6 +1,6 @@
/*
-* Salsa20
-* (C) 1999-2008 Jack Lloyd
+* Salsa20 / XSalsa20
+* (C) 1999-2010 Jack Lloyd
*
* Distributed under the terms of the Botan license
*/
@@ -14,63 +14,68 @@ namespace Botan {
namespace {
+#define SALSA20_QUARTER_ROUND(x1, x2, x3, x4) \
+ do { \
+ x2 ^= rotate_left(x1 + x4, 7); \
+ x3 ^= rotate_left(x2 + x1, 9); \
+ x4 ^= rotate_left(x3 + x2, 13); \
+ x1 ^= rotate_left(x4 + x3, 18); \
+ } while(0)
+
+/*
+* Generate HSalsa20 cipher stream (for XSalsa20 IV setup)
+*/
+void hsalsa20(u32bit output[8], const u32bit input[16])
+ {
+ u32bit x00 = input[ 0], x01 = input[ 1], x02 = input[ 2], x03 = input[ 3],
+ x04 = input[ 4], x05 = input[ 5], x06 = input[ 6], x07 = input[ 7],
+ x08 = input[ 8], x09 = input[ 9], x10 = input[10], x11 = input[11],
+ x12 = input[12], x13 = input[13], x14 = input[14], x15 = input[15];
+
+ for(u32bit i = 0; i != 10; ++i)
+ {
+ SALSA20_QUARTER_ROUND(x00, x04, x08, x12);
+ SALSA20_QUARTER_ROUND(x05, x09, x13, x01);
+ SALSA20_QUARTER_ROUND(x10, x14, x02, x06);
+ SALSA20_QUARTER_ROUND(x15, x03, x07, x11);
+
+ SALSA20_QUARTER_ROUND(x00, x01, x02, x03);
+ SALSA20_QUARTER_ROUND(x05, x06, x07, x04);
+ SALSA20_QUARTER_ROUND(x10, x11, x08, x09);
+ SALSA20_QUARTER_ROUND(x15, x12, x13, x14);
+ }
+
+ output[0] = x00;
+ output[1] = x05;
+ output[2] = x10;
+ output[3] = x15;
+ output[4] = x06;
+ output[5] = x07;
+ output[6] = x08;
+ output[7] = x09;
+ }
+
/*
* Generate Salsa20 cipher stream
*/
void salsa20(byte output[64], const u32bit input[16])
{
- u32bit x00 = input[0];
- u32bit x01 = input[1];
- u32bit x02 = input[2];
- u32bit x03 = input[3];
- u32bit x04 = input[4];
- u32bit x05 = input[5];
- u32bit x06 = input[6];
- u32bit x07 = input[7];
- u32bit x08 = input[8];
- u32bit x09 = input[9];
- u32bit x10 = input[10];
- u32bit x11 = input[11];
- u32bit x12 = input[12];
- u32bit x13 = input[13];
- u32bit x14 = input[14];
- u32bit x15 = input[15];
+ u32bit x00 = input[ 0], x01 = input[ 1], x02 = input[ 2], x03 = input[ 3],
+ x04 = input[ 4], x05 = input[ 5], x06 = input[ 6], x07 = input[ 7],
+ x08 = input[ 8], x09 = input[ 9], x10 = input[10], x11 = input[11],
+ x12 = input[12], x13 = input[13], x14 = input[14], x15 = input[15];
for(u32bit i = 0; i != 10; ++i)
{
- x04 ^= rotate_left(x00 + x12, 7);
- x08 ^= rotate_left(x04 + x00, 9);
- x12 ^= rotate_left(x08 + x04, 13);
- x00 ^= rotate_left(x12 + x08, 18);
- x09 ^= rotate_left(x05 + x01, 7);
- x13 ^= rotate_left(x09 + x05, 9);
- x01 ^= rotate_left(x13 + x09, 13);
- x05 ^= rotate_left(x01 + x13, 18);
- x14 ^= rotate_left(x10 + x06, 7);
- x02 ^= rotate_left(x14 + x10, 9);
- x06 ^= rotate_left(x02 + x14, 13);
- x10 ^= rotate_left(x06 + x02, 18);
- x03 ^= rotate_left(x15 + x11, 7);
- x07 ^= rotate_left(x03 + x15, 9);
- x11 ^= rotate_left(x07 + x03, 13);
- x15 ^= rotate_left(x11 + x07, 18);
-
- x01 ^= rotate_left(x00 + x03, 7);
- x02 ^= rotate_left(x01 + x00, 9);
- x03 ^= rotate_left(x02 + x01, 13);
- x00 ^= rotate_left(x03 + x02, 18);
- x06 ^= rotate_left(x05 + x04, 7);
- x07 ^= rotate_left(x06 + x05, 9);
- x04 ^= rotate_left(x07 + x06, 13);
- x05 ^= rotate_left(x04 + x07, 18);
- x11 ^= rotate_left(x10 + x09, 7);
- x08 ^= rotate_left(x11 + x10, 9);
- x09 ^= rotate_left(x08 + x11, 13);
- x10 ^= rotate_left(x09 + x08, 18);
- x12 ^= rotate_left(x15 + x14, 7);
- x13 ^= rotate_left(x12 + x15, 9);
- x14 ^= rotate_left(x13 + x12, 13);
- x15 ^= rotate_left(x14 + x13, 18);
+ SALSA20_QUARTER_ROUND(x00, x04, x08, x12);
+ SALSA20_QUARTER_ROUND(x05, x09, x13, x01);
+ SALSA20_QUARTER_ROUND(x10, x14, x02, x06);
+ SALSA20_QUARTER_ROUND(x15, x03, x07, x11);
+
+ SALSA20_QUARTER_ROUND(x00, x01, x02, x03);
+ SALSA20_QUARTER_ROUND(x05, x06, x07, x04);
+ SALSA20_QUARTER_ROUND(x10, x11, x08, x09);
+ SALSA20_QUARTER_ROUND(x15, x12, x13, x14);
}
store_le(x00 + input[ 0], output + 4 * 0);
@@ -100,11 +105,11 @@ void Salsa20::cipher(const byte in[], byte out[], u32bit length)
{
while(length >= buffer.size() - position)
{
- xor_buf(out, in, buffer.begin() + position, buffer.size() - position);
+ xor_buf(out, in, &buffer[position], buffer.size() - position);
length -= (buffer.size() - position);
in += (buffer.size() - position);
out += (buffer.size() - position);
- salsa20(buffer.begin(), state);
+ salsa20(&buffer[0], state);
++state[8];
if(!state[8]) // if overflow in state[8]
@@ -113,7 +118,7 @@ void Salsa20::cipher(const byte in[], byte out[], u32bit length)
position = 0;
}
- xor_buf(out, in, buffer.begin() + position, length);
+ xor_buf(out, in, &buffer[position], length);
position += length;
}
@@ -174,12 +179,39 @@ void Salsa20::set_iv(const byte iv[], u32bit length)
if(!valid_iv_length(length))
throw Invalid_IV_Length(name(), length);
- state[6] = load_le<u32bit>(iv, 0);
- state[7] = load_le<u32bit>(iv, 1);
+ if(length == 8)
+ {
+ // Salsa20
+ state[6] = load_le<u32bit>(iv, 0);
+ state[7] = load_le<u32bit>(iv, 1);
+ }
+ else
+ {
+ // XSalsa20
+ state[6] = load_le<u32bit>(iv, 0);
+ state[7] = load_le<u32bit>(iv, 1);
+ state[8] = load_le<u32bit>(iv, 2);
+ state[9] = load_le<u32bit>(iv, 3);
+
+ SecureVector<u32bit> hsalsa(8);
+ hsalsa20(hsalsa, state);
+
+ state[ 1] = hsalsa[0];
+ state[ 2] = hsalsa[1];
+ state[ 3] = hsalsa[2];
+ state[ 4] = hsalsa[3];
+ state[ 6] = load_le<u32bit>(iv, 4);
+ state[ 7] = load_le<u32bit>(iv, 5);
+ state[11] = hsalsa[4];
+ state[12] = hsalsa[5];
+ state[13] = hsalsa[6];
+ state[14] = hsalsa[7];
+ }
+
state[8] = 0;
state[9] = 0;
- salsa20(buffer.begin(), state);
+ salsa20(&buffer[0], state);
++state[8];
if(!state[8]) // if overflow in state[8]
++state[9]; // carry to state[9]
@@ -205,12 +237,4 @@ void Salsa20::clear()
position = 0;
}
-/*
-* Salsa20 Constructor
-*/
-Salsa20::Salsa20() : StreamCipher(16, 32, 16)
- {
- clear();
- }
-
}
diff --git a/src/stream/salsa20/salsa20.h b/src/stream/salsa20/salsa20.h
index 3ca781ea2..af7ddd145 100644
--- a/src/stream/salsa20/salsa20.h
+++ b/src/stream/salsa20/salsa20.h
@@ -1,6 +1,6 @@
/*
-* Salsa20
-* (C) 1999-2008 Jack Lloyd
+* Salsa20 / XSalsa20
+* (C) 1999-2010 Jack Lloyd
*
* Distributed under the terms of the Botan license
*/
@@ -13,7 +13,7 @@
namespace Botan {
/*
-* Salsa20
+* Salsa20 (and XSalsa20)
*/
class BOTAN_DLL Salsa20 : public StreamCipher
{
@@ -23,19 +23,18 @@ class BOTAN_DLL Salsa20 : public StreamCipher
void set_iv(const byte iv[], u32bit iv_len);
bool valid_iv_length(u32bit iv_len) const
- { return (iv_len == 8); }
+ { return (iv_len == 8 || iv_len == 24); }
void clear();
std::string name() const;
StreamCipher* clone() const { return new Salsa20; }
- Salsa20();
+ Salsa20() : StreamCipher(16, 32, 16) { position = 0; }
~Salsa20() { clear(); }
private:
void key_schedule(const byte key[], u32bit key_len);
SecureBuffer<u32bit, 16> state;
-
SecureBuffer<byte, 64> buffer;
u32bit position;
};
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-04 17:24:27 +0000