X-Git-Url: https://git.distorted.org.uk/~mdw/catacomb/blobdiff_plain/0f23f75ff53acadf80e9d3dfd2dfd14cb526074f..2b3f6527d522b647a6c8b5039228ebe569686c38:/symm/salsa20.c

diff --git a/symm/salsa20.c b/symm/salsa20.c
index eb4e67ad..f424b746 100644
--- a/symm/salsa20.c
+++ b/symm/salsa20.c
@@ -5,6 +5,26 @@
  * (c) 2015 Straylight/Edgeware
  */
 
+/*----- Licensing notice --------------------------------------------------*
+ *
+ * This file is part of Catacomb.
+ *
+ * Catacomb is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Library General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * Catacomb is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public
+ * License along with Catacomb; if not, write to the Free
+ * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
+ * MA 02111-1307, USA.
+ */
+
 /*----- Header files ------------------------------------------------------*/
 
 #include "config.h"
@@ -42,11 +62,9 @@ const octet salsa20_keysz[] = { KSZ_SET, 32, 16, 10, 0 };
  *		the feedforward step.
  */
 
-CPU_DISPATCH(static, (void),
-	     void, core, (unsigned r, const salsa20_matrix src,
-			  salsa20_matrix dest),
-	     (r, src, dest),
-	     pick_core, simple_core);
+CPU_DISPATCH(static, (void), void, core,
+	     (unsigned r, const salsa20_matrix src, salsa20_matrix dest),
+	     (r, src, dest), pick_core, simple_core);
 
 static void simple_core(unsigned r, const salsa20_matrix src,
 			salsa20_matrix dest)
@@ -56,12 +74,28 @@ static void simple_core(unsigned r, const salsa20_matrix src,
 extern core__functype salsa20_core_x86ish_sse2;
 #endif
 
+#if CPUFAM_ARMEL
+extern core__functype salsa20_core_arm_neon;
+#endif
+
+#if CPUFAM_ARM64
+extern core__functype salsa20_core_arm64;
+#endif
+
 static core__functype *pick_core(void)
 {
 #if CPUFAM_X86 || CPUFAM_AMD64
   DISPATCH_PICK_COND(salsa20_core, salsa20_core_x86ish_sse2,
 		     cpu_feature_p(CPUFEAT_X86_SSE2));
 #endif
+#if CPUFAM_ARMEL
+  DISPATCH_PICK_COND(salsa20_core, salsa20_core_arm_neon,
+		     cpu_feature_p(CPUFEAT_ARM_NEON));
+#endif
+#if CPUFAM_ARM64
+  DISPATCH_PICK_COND(salsa20_core, salsa20_core_arm64,
+		     cpu_feature_p(CPUFEAT_ARM_NEON));
+#endif
   DISPATCH_PICK_FALLBACK(salsa20_core, simple_core);
 }
 
@@ -146,10 +180,11 @@ void salsa20_init(salsa20_ctx *ctx, const void *key, size_t ksz,
   salsa20_setnonce(ctx, nonce ? nonce : zerononce);
 }
 
-/* --- @salsa20_setnonce@ --- *
+/* --- @salsa20_setnonce{,_ietf}@ --- *
  *
  * Arguments:	@salsa20_ctx *ctx@ = pointer to context
- *		@const void *nonce@ = the nonce (@SALSA20_NONCESZ@ bytes)
+ *		@const void *nonce@ = the nonce (@SALSA20_NONCESZ@ or
+ *			@SALSA20_IETF_NONCESZ@ bytes)
  *
  * Returns:	---
  *
@@ -167,10 +202,20 @@ void salsa20_setnonce(salsa20_ctx *ctx, const void *nonce)
   salsa20_seek(ctx, 0);
 }
 
-/* --- @salsa20_seek@, @salsa20_seeku64@ --- *
+void salsa20_setnonce_ietf(salsa20_ctx *ctx, const void *nonce)
+{
+  const octet *n = nonce;
+
+  ctx->a[ 5] = LOAD32_L(n + 0);
+  ctx->a[14] = LOAD32_L(n + 4);
+  ctx->a[11] = LOAD32_L(n + 8);
+  salsa20_seek_ietf(ctx, 0);
+}
+
+/* --- @salsa20_seek{,u64,_ietf}@ --- *
  *
  * Arguments:	@salsa20_ctx *ctx@ = pointer to context
- *		@unsigned long i@, @kludge64 i@ = new position to set
+ *		@unsigned long i@, @kludge64 i@, @uint32@ = new position
  *
  * Returns:	---
  *
@@ -189,7 +234,10 @@ void salsa20_seeku64(salsa20_ctx *ctx, kludge64 i)
   ctx->bufi = SALSA20_OUTSZ;
 }
 
-/* --- @salsa20_tell@, @salsa20_tellu64@ --- *
+void salsa20_seek_ietf(salsa20_ctx *ctx, uint32 i)
+  { ctx->a[8] = i; }
+
+/* --- @salsa20_tell{,u64,_ietf}@ --- *
  *
  * Arguments:	@salsa20_ctx *ctx@ = pointer to context
  *
@@ -203,6 +251,9 @@ unsigned long salsa20_tell(salsa20_ctx *ctx)
 kludge64 salsa20_tellu64(salsa20_ctx *ctx)
   { kludge64 i; SET64(i, ctx->a[5], ctx->a[8]); return (i); }
 
+uint32 salsa20_tell_ietf(salsa20_ctx *ctx)
+  { return (ctx->a[5]); }
+
 /* --- @salsa20{,12,8}_encrypt@ --- *
  *
  * Arguments:	@salsa20_ctx *ctx@ = pointer to context
@@ -409,7 +460,7 @@ SALSA20_VARS(DEFXINIT)
   }
 SALSA20_VARS(DEFXNONCE)
 
-/* --- @xsalsa20{,12,8}_seek@, @xsalsa20{,12,8}_seeku64@ --- *
+/* --- @xsalsa20{,12,8}_seek{,u64}@ --- *
  *
  * Arguments:	@xsalsa20R_ctx *ctx@ = pointer to context
  *		@unsigned long i@, @kludge64 i@ = new position to set
@@ -426,7 +477,7 @@ SALSA20_VARS(DEFXNONCE)
  *		different.
  */
 
-/* --- @xsalsa20{,12,8}_tell@, @xsalsa20{,12,8}_tellu64@ --- *
+/* --- @xsalsa20{,12,8}_tell{,u64}@ --- *
  *
  * Arguments:	@salsa20_ctx *ctx@ = pointer to context
  *
@@ -476,20 +527,29 @@ typedef struct gctx { gcipher c; salsa20_ctx ctx; } gctx;
 static void gsetiv(gcipher *c, const void *iv)
   { gctx *g = (gctx *)c; salsa20_setnonce(&g->ctx, iv); }
 
+static void gsetiv_ietf(gcipher *c, const void *iv)
+  { gctx *g = (gctx *)c; salsa20_setnonce_ietf(&g->ctx, iv); }
+
 static void gdestroy(gcipher *c)
   { gctx *g = (gctx *)c; BURN(*g); S_DESTROY(g); }
 
+static gcipher *ginit(const void *k, size_t sz, const gcipher_ops *ops)
+{
+  gctx *g = S_CREATE(gctx);
+  g->c.ops = ops;
+  salsa20_init(&g->ctx, k, sz, 0);
+  return (&g->c);
+}
+
 #define DEFGCIPHER(r)							\
 									\
-  static const gcipher_ops gops_##r;					\
+  static const gcipher_ops gops_##r, gops_##r##_ietf;			\
 									\
   static gcipher *ginit_##r(const void *k, size_t sz)			\
-  {									\
-    gctx *g = S_CREATE(gctx);						\
-    g->c.ops = &gops_##r;						\
-    salsa20_init(&g->ctx, k, sz, 0);					\
-    return (&g->c);							\
-  }									\
+    { return (ginit(k, sz, &gops_##r)); }				\
+									\
+  static gcipher *ginit_##r##_ietf(const void *k, size_t sz)		\
+    { return (ginit(k, sz, &gops_##r##_ietf)); }			\
 									\
   static void gencrypt_##r(gcipher *c, const void *s,			\
 			   void *t, size_t sz)				\
@@ -500,9 +560,19 @@ static void gdestroy(gcipher *c)
     gencrypt_##r, gencrypt_##r, gdestroy, gsetiv, 0			\
   };									\
 									\
+  static const gcipher_ops gops_##r##_ietf = {				\
+    &SALSA20_DECOR(salsa20, r, _ietf),					\
+    gencrypt_##r, gencrypt_##r, gdestroy, gsetiv_ietf, 0		\
+  };									\
+									\
   const gccipher SALSA20_DECOR(salsa20, r, ) = {			\
     SALSA20_NAME_##r, salsa20_keysz,					\
     SALSA20_NONCESZ, ginit_##r						\
+  };									\
+									\
+  const gccipher SALSA20_DECOR(salsa20, r, _ietf) = {			\
+    SALSA20_NAME_##r "-ietf", salsa20_keysz,				\
+    SALSA20_IETF_NONCESZ, ginit_##r##_ietf				\
   };
 
 SALSA20_VARS(DEFGCIPHER)
@@ -674,15 +744,41 @@ typedef struct grctx {
 static void gr_seek(void *r, kludge64 pos)
   { grctx *g = r; salsa20_seeku64(&g->ctx, pos); }
 
+static void gr_seek_ietf(void *r, kludge64 pos)
+  { grctx *g = r; salsa20_seek_ietf(&g->ctx, LO64(pos)); }
+
 static kludge64 gr_tell(void *r)
   { grctx *g = r; return (salsa20_tellu64(&g->ctx)); }
 
+static kludge64 gr_tell_ietf(void *r)
+{
+  grctx *g = r;
+  kludge64 pos;
+
+  SET64(pos, 0, salsa20_tell_ietf(&g->ctx));
+  return (pos);
+}
+
 static void gr_setnonce(void *r, const void *n)
   { grctx *g = r; salsa20_setnonce(&g->ctx, n); }
 
+static void gr_setnonce_ietf(void *r, const void *n)
+  { grctx *g = r; salsa20_setnonce(&g->ctx, n); }
+
 static void grdestroy(grand *r)
   { grctx *g = (grctx *)r; BURN(*g); S_DESTROY(g); }
 
+static grand *grinit(const void *k, size_t ksz, const void *n,
+		     const grand_ops *ops, const grops *myops)
+{
+    grctx *g = S_CREATE(grctx);
+    g->r.r.ops = ops;
+    g->r.ops = myops;
+    salsa20_init(&g->ctx, k, ksz, 0);
+    if (n) myops->setnonce(g, n);
+    return (&g->r.r);
+}
+
 #define DEFGRAND(rr)							\
 									\
   static void gr_generate_##rr(void *r, void *b, size_t sz)		\
@@ -692,21 +788,34 @@ static void grdestroy(grand *r)
     { SALSA20_NONCESZ, gr_seek, gr_tell,				\
       gr_setnonce, gr_generate_##rr };					\
 									\
+  static const grops grops_##rr##_ietf =				\
+    { SALSA20_IETF_NONCESZ, gr_seek_ietf, gr_tell_ietf,			\
+      gr_setnonce_ietf, gr_generate_##rr };				\
+									\
   static const grand_ops grops_rand_##rr = {				\
     SALSA20_NAME_##rr, GRAND_CRYPTO, 0,					\
     grmisc, grdestroy, grword,						\
-    grbyte, grword, grand_range, grfill					\
+    grbyte, grword, grand_defaultrange, grfill				\
+  };									\
+									\
+  static const grand_ops grops_rand_##rr##_ietf = {			\
+    SALSA20_NAME_##rr "-ietf", GRAND_CRYPTO, 0,				\
+    grmisc, grdestroy, grword,						\
+    grbyte, grword, grand_defaultrange, grfill				\
   };									\
 									\
   grand *SALSA20_DECOR(salsa20, rr, _rand)				\
     (const void *k, size_t ksz, const void *n)				\
+    { return (grinit(k, ksz, n, &grops_rand_##rr, &grops_##rr)); }	\
+									\
+  grand *SALSA20_DECOR(salsa20, rr, _ietf_rand)				\
+    (const void *k, size_t ksz, const void *n)				\
   {									\
-    grctx *g = S_CREATE(g);						\
-    g->r.r.ops = &grops_rand_##rr;					\
-    g->r.ops = &grops_##rr;						\
-    salsa20_init(&g->ctx, k, ksz, n);					\
-    return (&g->r.r);							\
+    return (grinit(k, ksz, n,						\
+		   &grops_rand_##rr##_ietf,				\
+		   &grops_##rr##_ietf));				\
   }
+
 SALSA20_VARS(DEFGRAND)
 
 #define DEFXGRAND(rr)							\
@@ -738,13 +847,13 @@ SALSA20_VARS(DEFGRAND)
   static const grand_ops grxops_rand_##rr = {				\
     "x" SALSA20_NAME_##rr, GRAND_CRYPTO, 0,				\
     grmisc, grxdestroy_##rr, grword,					\
-    grbyte, grword, grand_range, grfill					\
+    grbyte, grword, grand_defaultrange, grfill				\
   };									\
 									\
   grand *SALSA20_DECOR(xsalsa20, rr, _rand)				\
     (const void *k, size_t ksz, const void *n)				\
   {									\
-    grxctx_##rr *g = S_CREATE(g);					\
+    grxctx_##rr *g = S_CREATE(grxctx_##rr);				\
     g->r.r.ops = &grxops_rand_##rr;					\
     g->r.ops = &grxops_##rr;						\
     XSALSA20_INIT(rr, &g->ctx, k, ksz, n);				\
@@ -807,15 +916,28 @@ static const int perm[] = {
 SALSA20_VARS(DEFVCORE)
 
 #define SALSA20_CTX(r) salsa20_ctx
-#define SALSA20_INIT(r, ctx, k, ksz, n) salsa20_init(ctx, k, ksz, n)
-#define SALSA20_SEEKU64(r, ctx, i) salsa20_seeku64(ctx, i)
+
+#define SALSA20_TESTSETUP(r, ctx, k, ksz, n, nsz, p, psz) do {		\
+  kludge64 pos64;							\
+  salsa20_init(ctx, k, ksz, 0);						\
+  if (nsz == 8) salsa20_setnonce(ctx, n);				\
+  else if (nsz == 12) salsa20_setnonce_ietf(ctx, n);			\
+  if (psz == 8) { LOAD64_(pos64, p); salsa20_seeku64(ctx, pos64); }	\
+  else if (psz == 4) salsa20_seek_ietf(ctx, LOAD32(p));			\
+} while (0)
+
+#define XSALSA20_TESTSETUP(r, ctx, k, ksz, n, nsz, p, psz) do {		\
+  kludge64 pos64;							\
+  XSALSA20_INIT(r, ctx, k, ksz, 0);					\
+  if (nsz == 24) XSALSA20_SETNONCE(r, ctx, n);				\
+  if (psz == 8) { LOAD64_(pos64, p); XSALSA20_SEEKU64(r, ctx, pos64); }	\
+} while (0)
 
 #define DEFxVENC(base, BASE, r)						\
   static int v_encrypt_##base##_##r(dstr *v)				\
   {									\
     BASE##_CTX(r) ctx;							\
     dstr d = DSTR_INIT;							\
-    kludge64 pos;							\
     const octet *p, *p0;						\
     octet *q;								\
     size_t sz, sz0, step;						\
@@ -831,11 +953,8 @@ SALSA20_VARS(DEFVCORE)
     while (step < sz0 + skip) {						\
       step = step ? 3*step + 4 : 1;					\
       if (step > sz0 + skip) step = sz0 + skip;				\
-      BASE##_INIT(r, &ctx, v[0].buf, v[0].len, v[1].buf);		\
-      if (v[2].len) {							\
-	LOAD64_(pos, v[2].buf);						\
-	BASE##_SEEKU64(r, &ctx, pos);					\
-      }									\
+      BASE##_TESTSETUP(r, &ctx, v[0].buf, v[0].len,			\
+		       v[1].buf, v[1].len, v[2].buf, v[2].len);		\
 									\
       for (sz = skip; sz >= step; sz -= step)				\
 	BASE##_ENCRYPT(r, &ctx, 0, 0, step);				\