{bp-19403} crypto: add CRYPTO_CHACHA20_DJB variant (64-bit counter/nonce)

Documentation/components/crypto.rst

@@ -62,6 +62,7 @@ Authentication and Hashing Algorithms
   - CRYPTO_SHA1_HMAC
 
 - SHA-2 HMAC:
+  - CRYPTO_SHA2_224_HMAC (224-bit)
   - CRYPTO_SHA2_256_HMAC (256-bit)
   - CRYPTO_SHA2_384_HMAC (384-bit)
   - CRYPTO_SHA2_512_HMAC (512-bit)

crypto/chacha_private.h

@@ -141,9 +141,9 @@ static void chacha_ivsetup(FAR chacha_ctx *x,
                            FAR const uint8_t *counter)
 {
   x->input[12] = counter == NULL ? 0 : U8TO32_LITTLE(counter + 0);
-  x->input[13] = counter == NULL ? 0 : U8TO32_LITTLE(counter + 4);
-  x->input[14] = U8TO32_LITTLE(iv + 0);
-  x->input[15] = U8TO32_LITTLE(iv + 4);
+  x->input[13] = U8TO32_LITTLE(iv + 0);
+  x->input[14] = U8TO32_LITTLE(iv + 4);
+  x->input[15] = U8TO32_LITTLE(iv + 8);
 }
 
 static void chacha_encrypt_bytes(FAR chacha_ctx *x,

crypto/chachapoly.c

@@ -48,10 +48,7 @@ int chacha20_setkey(FAR void *sched, FAR uint8_t *key, int len)
       return -1;
     }
 
-  /* initial counter is 1 */
-
-  ctx->nonce[0] = 1;
-  memcpy(ctx->nonce + CHACHA20_CTR, key + CHACHA20_KEYSIZE,
+  memcpy(ctx->nonce, key + CHACHA20_KEYSIZE,
          CHACHA20_SALT);
   chacha_keysetup((FAR chacha_ctx *)&ctx->block, key, CHACHA20_KEYSIZE * 8);
   return 0;
@@ -64,12 +61,53 @@ void chacha20_reinit(caddr_t key, FAR uint8_t *iv)
   chacha_ivsetup((FAR chacha_ctx *)ctx->block, iv, ctx->nonce);
 }
 
-void chacha20_crypt(caddr_t key, FAR uint8_t *data)
+void chacha20_crypt(caddr_t key, FAR uint8_t *data, size_t len)
+{
+  FAR struct chacha20_ctx *ctx = (FAR struct chacha20_ctx *)key;
+
+  /* The underlying chacha state keeps its own block counter (input[12]),
+   * so successive calls continue the keystream seamlessly.  This mirrors
+   * how aes_ctr_crypt relies on swcr_encdec feeding whole blocks (only the
+   * final block may be shorter), keeping every stream cipher on one path.
+   */
+
+  chacha_encrypt_bytes((FAR chacha_ctx *)ctx, data, data, len);
+}
+
+void chachapoly_reinit(caddr_t key, FAR uint8_t *iv)
+{
+  FAR struct chacha20_ctx *ctx = (FAR struct chacha20_ctx *)key;
+
+  /* initial counter is 1 */
+
+  ctx->nonce[0] = 1;
+  chacha_ivsetup((FAR chacha_ctx *)ctx->block, iv, ctx->nonce);
+}
+
+int chacha20_djb_setkey(FAR void *sched, FAR uint8_t *key, int len)
+{
+  FAR struct chacha20_ctx *ctx = (FAR struct chacha20_ctx *)sched;
+
+  if (len != CHACHA20_KEYSIZE)
+    {
+      return -1;
+    }
+
+  chacha_keysetup((FAR chacha_ctx *)ctx->block, key, CHACHA20_KEYSIZE * 8);
+  return 0;
+}
+
+void chacha20_djb_reinit(caddr_t key, FAR uint8_t *iv)
 {
   FAR struct chacha20_ctx *ctx = (FAR struct chacha20_ctx *)key;
 
-  chacha_encrypt_bytes((FAR chacha_ctx *)ctx->block, data, data,
-                       CHACHA20_BLOCK_LEN);
+  /* Original DJB ChaCha20 layout, as used by chacha20-poly1305@openssh.com
+   * (libtomcrypt chacha_ivctr64): the 16-byte IV is loaded verbatim into
+   * state words 12..15 as a 64-bit little-endian block counter followed by
+   * a 64-bit nonce.
+   */
+
+  chacha_ivsetup((FAR chacha_ctx *)ctx->block, iv + 4, iv);
 }
 
 void chacha20_poly1305_init(FAR void *xctx)
@@ -156,9 +194,12 @@ void chacha20poly1305_encrypt(
   };
 
   uint64_t le_nonce = htole64(nonce);
+  uint8_t le_nonce_array[12];
+  explicit_bzero(le_nonce_array, sizeof(le_nonce_array));
+  memcpy(le_nonce_array, &le_nonce, sizeof(uint64_t));
 
   chacha_keysetup(&ctx, key, CHACHA20POLY1305_KEY_SIZE * 8);
-  chacha_ivsetup(&ctx, (FAR uint8_t *) &le_nonce, NULL);
+  chacha_ivsetup(&ctx, le_nonce_array, NULL);
   chacha_encrypt_bytes(&ctx, b.b0, b.b0, sizeof(b.b0));
   poly1305_begin(&poly1305_ctx, b.b0);
 
@@ -205,14 +246,17 @@ int chacha20poly1305_decrypt(
   };
 
   uint64_t le_nonce = htole64(nonce);
+  uint8_t le_nonce_array[12];
+  explicit_bzero(le_nonce_array, sizeof(le_nonce_array));
+  memcpy(le_nonce_array, &le_nonce, sizeof(uint64_t));
 
   if (src_len < CHACHA20POLY1305_AUTHTAG_SIZE)
     {
       return 0;
     }
 
   chacha_keysetup(&ctx, key, CHACHA20POLY1305_KEY_SIZE * 8);
-  chacha_ivsetup(&ctx, (FAR uint8_t *) &le_nonce, NULL);
+  chacha_ivsetup(&ctx, le_nonce_array, NULL);
   chacha_encrypt_bytes(&ctx, b.b0, b.b0, sizeof(b.b0));
   poly1305_begin(&poly1305_ctx, b.b0);
 

crypto/cryptodev.c

@@ -236,6 +236,9 @@ static int cryptof_ioctl(FAR struct file *filep,
             case CRYPTO_AES_OFB:
             case CRYPTO_AES_CFB_8:
             case CRYPTO_AES_CFB_128:
+            case CRYPTO_CHACHA20:
+            case CRYPTO_CHACHA20_DJB:
+            case CRYPTO_CHACHA20_POLY1305:
             case CRYPTO_NULL:
               txform = true;
               break;
@@ -250,11 +253,13 @@ static int cryptof_ioctl(FAR struct file *filep,
             case CRYPTO_MD5_HMAC:
             case CRYPTO_SHA1_HMAC:
             case CRYPTO_RIPEMD160_HMAC:
+            case CRYPTO_SHA2_224_HMAC:
             case CRYPTO_SHA2_256_HMAC:
             case CRYPTO_SHA2_384_HMAC:
             case CRYPTO_SHA2_512_HMAC:
             case CRYPTO_AES_128_GMAC:
             case CRYPTO_AES_128_CMAC:
+            case CRYPTO_CHACHA20_POLY1305_MAC:
             case CRYPTO_MD5:
             case CRYPTO_POLY1305:
             case CRYPTO_RIPEMD160:
@@ -462,6 +467,12 @@ static int cryptodev_op(FAR struct csession *cse,
       crp.crp_ivlen = cop->ivlen;
     }
 
+  if (cop->aad)
+    {
+      crp.crp_aad = cop->aad;
+      crp.crp_aadlen = cop->aadlen;
+    }
+
   if (cop->dst)
     {
       crp.crp_dst = cop->dst;