crypto/tls: support CHACHA20

[fourstring]

Please answer these questions before submitting your issue. Thanks!

1. What version of Go are you using (go version)?
   1.6
2. What operating system and processor architecture are you using (go env)?
   GOARCH="386"
   GOBIN=""
   GOEXE=""
   GOHOSTARCH="386"
   GOHOSTOS="linux"
   GOOS="linux"
   GOPATH="/data/go"
   GORACE=""
   GOROOT="/usr/local/go"
   GOTOOLDIR="/usr/local/go/pkg/tool/linux_386"
   GO15VENDOREXPERIMENT="1"
   CC="gcc"
   GOGCCFLAGS="-fPIC -m32 -pthread -fmessage-length=0"
   CXX="g++"
   CGO_ENABLED="1"
3. What did you expect to see?
   Cipher Suite ECDHE-ECDSA/RSA-CHACHA20-POLY1305 will be supported.

Thank you!

[alex]

The RFC for this is now finalized.

[mjgarton]

I suppose this depends upon both poly1305 and chacha20 implementations in the standard library?

Is it worth creating separate issues for those?

[Thomasdezeeuw]

Related #9489 and #6914.

[enceve]

If the "right" way to support ChaCha20 and ChaCha20Poly1305 is to use the x/crypto repo as "staging area" for the main repo, maybe this implementation is stable and fast enough. It is similar to the salsa20 package, uses SIMD SSE2 for ChaCha20 on amd64 and avoids mem-allocs for the Poly1305 part of the AEAD.
There is still room for performance improvements, but maybe it can be used as a template...

[mjgarton]

That code appears to be licensed as LGPL, so unfortunately not suitable without re-licensing.

EDIT: Mine is not an official position. I am not a Go team member - I'm just stating my understanding of the licence situation.

[enceve]

The licensing won't be a problem - If the implementation fulfills the requirements / has a chance to be adopted, I'll push it for code-review

[gopherbot]

CL https://golang.org/cl/30957 mentions this issue.

[agl]

(Note that https://go-review.googlesource.com/#/c/30958/ to enable this by default is still pending.)