cryptobox.c

/* Copyright (c) 2015, Vsevolod Stakhov
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are met:
 *       * Redistributions of source code must retain the above copyright
 *         notice, this list of conditions and the following disclaimer.
 *       * Redistributions in binary form must reproduce the above copyright
 *         notice, this list of conditions and the following disclaimer in the
 *         documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED ''AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 * DISCLAIMED. IN NO EVENT SHALL AUTHOR BE LIABLE FOR ANY
 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "config.h"
#include "cryptobox.h"
#include "platform_config.h"
#include "chacha20/chacha.h"
#include "poly1305/poly1305.h"
#include "curve25519/curve25519.h"
#include "blake2/blake2.h"

#ifdef HAVE_MEMSET_S
/* Darwin requirement */
#define __STDC_WANT_LIB_EXT1__ 1
#endif

#include <stdlib.h>
#include <string.h>

unsigned long cpu_config = 0;

static const unsigned char n0[16] = {0};
extern void randombytes_sysrandom_init (void);
extern void randombytes_sysrandom_buf (void * const buf, const size_t size);

#ifdef HAVE_WEAK_SYMBOLS
__attribute__((weak)) void
_dummy_symbol_to_prevent_lto(void * const pnt, const size_t len)
{
	(void) pnt;
	(void) len;
}
#endif

void
rspamd_explicit_memzero(void * const pnt, const size_t len)
{
#if defined(HAVE_MEMSET_S)
	if (memset_s (pnt, (rsize_t) len, 0, (rsize_t) len) != 0) {
		abort ();
	}
#elif defined(HAVE_EXPLICIT_BZERO)
	explicit_bzero (pnt, len);
#elif defined(HAVE_WEAK_SYMBOLS)
	memset (pnt, 0, len);
	_dummy_symbol_to_prevent_lto (pnt, len);
#else
	volatile unsigned char *pnt_ = (volatile unsigned char *) pnt;
	size_t i = (size_t) 0U;
	while (i < len) {
		pnt_[i++] = 0U;
	}
#endif
}

static void
rspamd_cryptobox_cpuid (int cpu[4], int info)
{
#if defined(__GNUC__) && (defined(__x86_64__) || defined(__i386__))
	__asm__ __volatile__ (
			"cpuid":
			"=a" (cpu[0]),
			"=b" (cpu[1]),
			"=c" (cpu[2]),
			"=d" (cpu[3]) :
			"a" (info), "c" (0)
	);
#else
	memset (cpu, 0, sizeof (cpu));
#endif
}

void
rspamd_randombytes (void * const buf, const size_t size)
{
	randombytes_sysrandom_buf (buf, size);
}

void
rspamd_cryptobox_init (void)
{
	int cpu[4], nid;

	rspamd_cryptobox_cpuid (cpu, 0);
	nid = cpu[0];
	rspamd_cryptobox_cpuid (cpu, 1);

	if (nid > 1) {
		/* Check OSXSAVE bit first of all */
		if ((cpu[2] & ((int)1 << 9))) {
			if ((cpu[3] & ((int)1 << 26))) {
				cpu_config |= CPUID_SSE2;
			}
			if ((cpu[2] & ((int)1 << 28))) {
				cpu_config |= CPUID_AVX;
			}
			if (nid > 7) {
				rspamd_cryptobox_cpuid (cpu, 7);
				if ((cpu[1] & ((int)1 <<  5))) {
					cpu_config |= CPUID_AVX2;
				}
			}
		}
	}

	chacha_load ();
	poly1305_load ();
	randombytes_sysrandom_init ();
}

void
rspamd_cryptobox_keypair (rspamd_pk_t pk, rspamd_sk_t sk)
{
	randombytes_sysrandom_buf (sk, rspamd_cryptobox_SKBYTES);
	sk[0] &= 248;
	sk[31] &= 127;
	sk[31] |= 64;

	curve25519 (pk, sk, curve25519_basepoint);
}

void
rspamd_cryptobox_nm (rspamd_nm_t nm, const rspamd_pk_t pk, const rspamd_sk_t sk)
{
	unsigned char s[rspamd_cryptobox_PKBYTES];
	unsigned char e[rspamd_cryptobox_SKBYTES];

	memcpy (e, sk, rspamd_cryptobox_SKBYTES);
	e[0] &= 248;
	e[31] &= 127;
	e[31] |= 64;

	curve25519 (s, e, pk);
	hchacha (s, n0, nm, 20);

	rspamd_explicit_memzero (e, rspamd_cryptobox_SKBYTES);
}

void rspamd_cryptobox_encrypt_nm_inplace (unsigned char *data, size_t len,
		const rspamd_nonce_t nonce,
		const rspamd_nm_t nm, rspamd_sig_t sig)
{
	poly1305_state mac_ctx;
	unsigned char subkey[CHACHA_BLOCKBYTES];
	chacha_state s;
	size_t r;

	xchacha_init (&s, (const chacha_key *)nm, (const chacha_iv24 *)nonce, 20);
	memset (subkey, 0, sizeof (subkey));
	chacha_update (&s, subkey, subkey, sizeof (subkey));

	r = chacha_update (&s, data, data, len);
	chacha_final (&s, data + r);

	poly1305_init (&mac_ctx, (const poly1305_key *)subkey);
	poly1305_update (&mac_ctx, data, len);
	poly1305_finish (&mac_ctx, sig);

	rspamd_explicit_memzero (&mac_ctx, sizeof (mac_ctx));
	rspamd_explicit_memzero (subkey, sizeof (subkey));
}

bool
rspamd_cryptobox_decrypt_nm_inplace (unsigned char *data, size_t len,
		const rspamd_nonce_t nonce, const rspamd_nm_t nm, const rspamd_sig_t sig)
{
	poly1305_state mac_ctx;
	unsigned char subkey[CHACHA_BLOCKBYTES];
	rspamd_sig_t mac;
	chacha_state s;
	size_t r;
	bool ret = true;

	/* Generate MAC key */
	xchacha_init (&s, (const chacha_key *)nm, (const chacha_iv24 *)nonce, 20);
	memset (subkey, 0, sizeof (subkey));
	chacha_update (&s, subkey, subkey, sizeof (subkey));

	poly1305_init (&mac_ctx, (const poly1305_key *)subkey);
	poly1305_update (&mac_ctx, data, len);
	poly1305_finish (&mac_ctx, mac);

	if (!poly1305_verify (mac, sig)) {
		ret = false;
	}
	else {
		r = chacha_update (&s, data, data, len);
		chacha_final (&s, data + r);
	}

	rspamd_explicit_memzero (&mac_ctx, sizeof (mac_ctx));
	rspamd_explicit_memzero (subkey, sizeof (subkey));

	return ret;
}

bool
rspamd_cryptobox_decrypt_inplace (unsigned char *data, size_t len,
		const rspamd_nonce_t nonce,
		const rspamd_pk_t pk, const rspamd_sk_t sk, const rspamd_sig_t sig)
{
	unsigned char nm[rspamd_cryptobox_NMBYTES];
	bool ret;

	rspamd_cryptobox_nm (nm, pk, sk);
	ret = rspamd_cryptobox_decrypt_nm_inplace (data, len, nonce, nm, sig);

	rspamd_explicit_memzero (nm, sizeof (nm));

	return ret;
}

void
rspamd_cryptobox_encrypt_inplace (unsigned char *data, size_t len,
		const rspamd_nonce_t nonce,
		const rspamd_pk_t pk, const rspamd_sk_t sk, rspamd_sig_t sig)
{
	unsigned char nm[rspamd_cryptobox_NMBYTES];

	rspamd_cryptobox_nm (nm, pk, sk);
	rspamd_cryptobox_encrypt_nm_inplace (data, len, nonce, nm, sig);
	rspamd_explicit_memzero (nm, sizeof (nm));
}

void
rspamd_cryptobox_hash (void * const buf, const size_t size,
    rspamd_hash_t out)
{
	blake2b_state st;

	blake2b_init (&st, rspamd_cryptobox_HASHBYTES);
	blake2b_update (&st, buf, size);
	blake2b_final (&st, out, rspamd_cryptobox_HASHBYTES);
}