Commit 1ca1b917 authored by Eric Biggers's avatar Eric Biggers Committed by Herbert Xu
Browse files

crypto: chacha20-generic - refactor to allow varying number of rounds 



In preparation for adding XChaCha12 support, rename/refactor
chacha20-generic to support different numbers of rounds.  The
justification for needing XChaCha12 support is explained in more detail
in the patch "crypto: chacha - add XChaCha12 support".

The only difference between ChaCha{8,12,20} are the number of rounds
itself; all other parts of the algorithm are the same.  Therefore,
remove the "20" from all definitions, structures, functions, files, etc.
that will be shared by all ChaCha versions.

Also make ->setkey() store the round count in the chacha_ctx (previously
chacha20_ctx).  The generic code then passes the round count through to
chacha_block().  There will be a ->setkey() function for each explicitly
allowed round count; the encrypt/decrypt functions will be the same.  I
decided not to do it the opposite way (same ->setkey() function for all
round counts, with different encrypt/decrypt functions) because that
would have required more boilerplate code in architecture-specific
implementations of ChaCha and XChaCha.

Reviewed-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
Acked-by: default avatarMartin Willi <martin@strongswan.org>
Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent de61d7ae

arch/arm/crypto/chacha20-neon-glue.c

+20 −20
Original line number Diff line number Diff line
@@ -19,7 +19,7 @@ 
 */



#include <crypto/algapi.h>

#include <crypto/chacha20.h>

#include <crypto/chacha.h>

#include <crypto/internal/skcipher.h>

#include <linux/kernel.h>

#include <linux/module.h>
@@ -34,20 +34,20 @@ asmlinkage void chacha20_4block_xor_neon(u32 *state, u8 *dst, const u8 *src); 
static void chacha20_doneon(u32 *state, u8 *dst, const u8 *src,

			    unsigned int bytes)

{

	u8 buf[CHACHA20_BLOCK_SIZE];

	u8 buf[CHACHA_BLOCK_SIZE];



	while (bytes >= CHACHA20_BLOCK_SIZE * 4) {

	while (bytes >= CHACHA_BLOCK_SIZE * 4) {

		chacha20_4block_xor_neon(state, dst, src);

		bytes -= CHACHA20_BLOCK_SIZE * 4;

		src += CHACHA20_BLOCK_SIZE * 4;

		dst += CHACHA20_BLOCK_SIZE * 4;

		bytes -= CHACHA_BLOCK_SIZE * 4;

		src += CHACHA_BLOCK_SIZE * 4;

		dst += CHACHA_BLOCK_SIZE * 4;

		state[12] += 4;

	}

	while (bytes >= CHACHA20_BLOCK_SIZE) {

	while (bytes >= CHACHA_BLOCK_SIZE) {

		chacha20_block_xor_neon(state, dst, src);

		bytes -= CHACHA20_BLOCK_SIZE;

		src += CHACHA20_BLOCK_SIZE;

		dst += CHACHA20_BLOCK_SIZE;

		bytes -= CHACHA_BLOCK_SIZE;

		src += CHACHA_BLOCK_SIZE;

		dst += CHACHA_BLOCK_SIZE;

		state[12]++;

	}

	if (bytes) {
@@ -60,17 +60,17 @@ static void chacha20_doneon(u32 *state, u8 *dst, const u8 *src, 
static int chacha20_neon(struct skcipher_request *req)

{

	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);

	struct chacha20_ctx *ctx = crypto_skcipher_ctx(tfm);

	struct chacha_ctx *ctx = crypto_skcipher_ctx(tfm);

	struct skcipher_walk walk;

	u32 state[16];

	int err;



	if (req->cryptlen <= CHACHA20_BLOCK_SIZE || !may_use_simd())

		return crypto_chacha20_crypt(req);

	if (req->cryptlen <= CHACHA_BLOCK_SIZE || !may_use_simd())

		return crypto_chacha_crypt(req);



	err = skcipher_walk_virt(&walk, req, true);



	crypto_chacha20_init(state, ctx, walk.iv);

	crypto_chacha_init(state, ctx, walk.iv);



	kernel_neon_begin();

	while (walk.nbytes > 0) {
@@ -93,14 +93,14 @@ static struct skcipher_alg alg = { 
	.base.cra_driver_name	= "chacha20-neon",

	.base.cra_priority	= 300,

	.base.cra_blocksize	= 1,

	.base.cra_ctxsize	= sizeof(struct chacha20_ctx),

	.base.cra_ctxsize	= sizeof(struct chacha_ctx),

	.base.cra_module	= THIS_MODULE,



	.min_keysize		= CHACHA20_KEY_SIZE,

	.max_keysize		= CHACHA20_KEY_SIZE,

	.ivsize			= CHACHA20_IV_SIZE,

	.chunksize		= CHACHA20_BLOCK_SIZE,

	.walksize		= 4 * CHACHA20_BLOCK_SIZE,

	.min_keysize		= CHACHA_KEY_SIZE,

	.max_keysize		= CHACHA_KEY_SIZE,

	.ivsize			= CHACHA_IV_SIZE,

	.chunksize		= CHACHA_BLOCK_SIZE,

	.walksize		= 4 * CHACHA_BLOCK_SIZE,

	.setkey			= crypto_chacha20_setkey,

	.encrypt		= chacha20_neon,

	.decrypt		= chacha20_neon,

arch/arm64/crypto/chacha20-neon-glue.c

+20 −20
Original line number Diff line number Diff line
@@ -19,7 +19,7 @@ 
 */



#include <crypto/algapi.h>

#include <crypto/chacha20.h>

#include <crypto/chacha.h>

#include <crypto/internal/skcipher.h>

#include <linux/kernel.h>

#include <linux/module.h>
@@ -34,15 +34,15 @@ asmlinkage void chacha20_4block_xor_neon(u32 *state, u8 *dst, const u8 *src); 
static void chacha20_doneon(u32 *state, u8 *dst, const u8 *src,

			    unsigned int bytes)

{

	u8 buf[CHACHA20_BLOCK_SIZE];

	u8 buf[CHACHA_BLOCK_SIZE];



	while (bytes >= CHACHA20_BLOCK_SIZE * 4) {

	while (bytes >= CHACHA_BLOCK_SIZE * 4) {

		kernel_neon_begin();

		chacha20_4block_xor_neon(state, dst, src);

		kernel_neon_end();

		bytes -= CHACHA20_BLOCK_SIZE * 4;

		src += CHACHA20_BLOCK_SIZE * 4;

		dst += CHACHA20_BLOCK_SIZE * 4;

		bytes -= CHACHA_BLOCK_SIZE * 4;

		src += CHACHA_BLOCK_SIZE * 4;

		dst += CHACHA_BLOCK_SIZE * 4;

		state[12] += 4;

	}
@@ -50,11 +50,11 @@ static void chacha20_doneon(u32 *state, u8 *dst, const u8 *src, 
		return;



	kernel_neon_begin();

	while (bytes >= CHACHA20_BLOCK_SIZE) {

	while (bytes >= CHACHA_BLOCK_SIZE) {

		chacha20_block_xor_neon(state, dst, src);

		bytes -= CHACHA20_BLOCK_SIZE;

		src += CHACHA20_BLOCK_SIZE;

		dst += CHACHA20_BLOCK_SIZE;

		bytes -= CHACHA_BLOCK_SIZE;

		src += CHACHA_BLOCK_SIZE;

		dst += CHACHA_BLOCK_SIZE;

		state[12]++;

	}

	if (bytes) {
@@ -68,17 +68,17 @@ static void chacha20_doneon(u32 *state, u8 *dst, const u8 *src, 
static int chacha20_neon(struct skcipher_request *req)

{

	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);

	struct chacha20_ctx *ctx = crypto_skcipher_ctx(tfm);

	struct chacha_ctx *ctx = crypto_skcipher_ctx(tfm);

	struct skcipher_walk walk;

	u32 state[16];

	int err;



	if (!may_use_simd() || req->cryptlen <= CHACHA20_BLOCK_SIZE)

		return crypto_chacha20_crypt(req);

	if (!may_use_simd() || req->cryptlen <= CHACHA_BLOCK_SIZE)

		return crypto_chacha_crypt(req);



	err = skcipher_walk_virt(&walk, req, false);



	crypto_chacha20_init(state, ctx, walk.iv);

	crypto_chacha_init(state, ctx, walk.iv);



	while (walk.nbytes > 0) {

		unsigned int nbytes = walk.nbytes;
@@ -99,14 +99,14 @@ static struct skcipher_alg alg = { 
	.base.cra_driver_name	= "chacha20-neon",

	.base.cra_priority	= 300,

	.base.cra_blocksize	= 1,

	.base.cra_ctxsize	= sizeof(struct chacha20_ctx),

	.base.cra_ctxsize	= sizeof(struct chacha_ctx),

	.base.cra_module	= THIS_MODULE,



	.min_keysize		= CHACHA20_KEY_SIZE,

	.max_keysize		= CHACHA20_KEY_SIZE,

	.ivsize			= CHACHA20_IV_SIZE,

	.chunksize		= CHACHA20_BLOCK_SIZE,

	.walksize		= 4 * CHACHA20_BLOCK_SIZE,

	.min_keysize		= CHACHA_KEY_SIZE,

	.max_keysize		= CHACHA_KEY_SIZE,

	.ivsize			= CHACHA_IV_SIZE,

	.chunksize		= CHACHA_BLOCK_SIZE,

	.walksize		= 4 * CHACHA_BLOCK_SIZE,

	.setkey			= crypto_chacha20_setkey,

	.encrypt		= chacha20_neon,

	.decrypt		= chacha20_neon,

arch/x86/crypto/chacha20_glue.c

+24 −24
Original line number Diff line number Diff line
@@ -10,7 +10,7 @@ 
 */



#include <crypto/algapi.h>

#include <crypto/chacha20.h>

#include <crypto/chacha.h>

#include <crypto/internal/skcipher.h>

#include <linux/kernel.h>

#include <linux/module.h>
@@ -35,8 +35,8 @@ static bool chacha20_use_avx2; 


static unsigned int chacha20_advance(unsigned int len, unsigned int maxblocks)

{

	len = min(len, maxblocks * CHACHA20_BLOCK_SIZE);

	return round_up(len, CHACHA20_BLOCK_SIZE) / CHACHA20_BLOCK_SIZE;

	len = min(len, maxblocks * CHACHA_BLOCK_SIZE);

	return round_up(len, CHACHA_BLOCK_SIZE) / CHACHA_BLOCK_SIZE;

}



static void chacha20_dosimd(u32 *state, u8 *dst, const u8 *src,
@@ -44,38 +44,38 @@ static void chacha20_dosimd(u32 *state, u8 *dst, const u8 *src, 
{

#ifdef CONFIG_AS_AVX2

	if (chacha20_use_avx2) {

		while (bytes >= CHACHA20_BLOCK_SIZE * 8) {

		while (bytes >= CHACHA_BLOCK_SIZE * 8) {

			chacha20_8block_xor_avx2(state, dst, src, bytes);

			bytes -= CHACHA20_BLOCK_SIZE * 8;

			src += CHACHA20_BLOCK_SIZE * 8;

			dst += CHACHA20_BLOCK_SIZE * 8;

			bytes -= CHACHA_BLOCK_SIZE * 8;

			src += CHACHA_BLOCK_SIZE * 8;

			dst += CHACHA_BLOCK_SIZE * 8;

			state[12] += 8;

		}

		if (bytes > CHACHA20_BLOCK_SIZE * 4) {

		if (bytes > CHACHA_BLOCK_SIZE * 4) {

			chacha20_8block_xor_avx2(state, dst, src, bytes);

			state[12] += chacha20_advance(bytes, 8);

			return;

		}

		if (bytes > CHACHA20_BLOCK_SIZE * 2) {

		if (bytes > CHACHA_BLOCK_SIZE * 2) {

			chacha20_4block_xor_avx2(state, dst, src, bytes);

			state[12] += chacha20_advance(bytes, 4);

			return;

		}

		if (bytes > CHACHA20_BLOCK_SIZE) {

		if (bytes > CHACHA_BLOCK_SIZE) {

			chacha20_2block_xor_avx2(state, dst, src, bytes);

			state[12] += chacha20_advance(bytes, 2);

			return;

		}

	}

#endif

	while (bytes >= CHACHA20_BLOCK_SIZE * 4) {

	while (bytes >= CHACHA_BLOCK_SIZE * 4) {

		chacha20_4block_xor_ssse3(state, dst, src, bytes);

		bytes -= CHACHA20_BLOCK_SIZE * 4;

		src += CHACHA20_BLOCK_SIZE * 4;

		dst += CHACHA20_BLOCK_SIZE * 4;

		bytes -= CHACHA_BLOCK_SIZE * 4;

		src += CHACHA_BLOCK_SIZE * 4;

		dst += CHACHA_BLOCK_SIZE * 4;

		state[12] += 4;

	}

	if (bytes > CHACHA20_BLOCK_SIZE) {

	if (bytes > CHACHA_BLOCK_SIZE) {

		chacha20_4block_xor_ssse3(state, dst, src, bytes);

		state[12] += chacha20_advance(bytes, 4);

		return;
@@ -89,7 +89,7 @@ static void chacha20_dosimd(u32 *state, u8 *dst, const u8 *src, 
static int chacha20_simd(struct skcipher_request *req)

{

	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);

	struct chacha20_ctx *ctx = crypto_skcipher_ctx(tfm);

	struct chacha_ctx *ctx = crypto_skcipher_ctx(tfm);

	u32 *state, state_buf[16 + 2] __aligned(8);

	struct skcipher_walk walk;

	int err;
@@ -97,12 +97,12 @@ static int chacha20_simd(struct skcipher_request *req) 
	BUILD_BUG_ON(CHACHA20_STATE_ALIGN != 16);

	state = PTR_ALIGN(state_buf + 0, CHACHA20_STATE_ALIGN);



	if (req->cryptlen <= CHACHA20_BLOCK_SIZE || !may_use_simd())

		return crypto_chacha20_crypt(req);

	if (req->cryptlen <= CHACHA_BLOCK_SIZE || !may_use_simd())

		return crypto_chacha_crypt(req);



	err = skcipher_walk_virt(&walk, req, true);



	crypto_chacha20_init(state, ctx, walk.iv);

	crypto_chacha_init(state, ctx, walk.iv);



	kernel_fpu_begin();
@@ -128,13 +128,13 @@ static struct skcipher_alg alg = { 
	.base.cra_driver_name	= "chacha20-simd",

	.base.cra_priority	= 300,

	.base.cra_blocksize	= 1,

	.base.cra_ctxsize	= sizeof(struct chacha20_ctx),

	.base.cra_ctxsize	= sizeof(struct chacha_ctx),

	.base.cra_module	= THIS_MODULE,



	.min_keysize		= CHACHA20_KEY_SIZE,

	.max_keysize		= CHACHA20_KEY_SIZE,

	.ivsize			= CHACHA20_IV_SIZE,

	.chunksize		= CHACHA20_BLOCK_SIZE,

	.min_keysize		= CHACHA_KEY_SIZE,

	.max_keysize		= CHACHA_KEY_SIZE,

	.ivsize			= CHACHA_IV_SIZE,

	.chunksize		= CHACHA_BLOCK_SIZE,

	.setkey			= crypto_chacha20_setkey,

	.encrypt		= chacha20_simd,

	.decrypt		= chacha20_simd,

crypto/Makefile

+1 −1
Original line number Diff line number Diff line
@@ -117,7 +117,7 @@ obj-$(CONFIG_CRYPTO_KHAZAD) += khazad.o 
obj-$(CONFIG_CRYPTO_ANUBIS) += anubis.o

obj-$(CONFIG_CRYPTO_SEED) += seed.o

obj-$(CONFIG_CRYPTO_SALSA20) += salsa20_generic.o

obj-$(CONFIG_CRYPTO_CHACHA20) += chacha20_generic.o

obj-$(CONFIG_CRYPTO_CHACHA20) += chacha_generic.o

obj-$(CONFIG_CRYPTO_POLY1305) += poly1305_generic.o

obj-$(CONFIG_CRYPTO_DEFLATE) += deflate.o

obj-$(CONFIG_CRYPTO_MICHAEL_MIC) += michael_mic.o

crypto/chacha20poly1305.c

+5 −5
Original line number Diff line number Diff line
@@ -13,7 +13,7 @@ 
#include <crypto/internal/hash.h>

#include <crypto/internal/skcipher.h>

#include <crypto/scatterwalk.h>

#include <crypto/chacha20.h>

#include <crypto/chacha.h>

#include <crypto/poly1305.h>

#include <linux/err.h>

#include <linux/init.h>
@@ -49,7 +49,7 @@ struct poly_req { 
};



struct chacha_req {

	u8 iv[CHACHA20_IV_SIZE];

	u8 iv[CHACHA_IV_SIZE];

	struct scatterlist src[1];

	struct skcipher_request req; /* must be last member */

};
@@ -89,7 +89,7 @@ static void chacha_iv(u8 *iv, struct aead_request *req, u32 icb) 
	memcpy(iv, &leicb, sizeof(leicb));

	memcpy(iv + sizeof(leicb), ctx->salt, ctx->saltlen);

	memcpy(iv + sizeof(leicb) + ctx->saltlen, req->iv,

	       CHACHA20_IV_SIZE - sizeof(leicb) - ctx->saltlen);

	       CHACHA_IV_SIZE - sizeof(leicb) - ctx->saltlen);

}



static int poly_verify_tag(struct aead_request *req)
@@ -492,7 +492,7 @@ static int chachapoly_setkey(struct crypto_aead *aead, const u8 *key, 
	struct chachapoly_ctx *ctx = crypto_aead_ctx(aead);

	int err;



	if (keylen != ctx->saltlen + CHACHA20_KEY_SIZE)

	if (keylen != ctx->saltlen + CHACHA_KEY_SIZE)

		return -EINVAL;



	keylen -= ctx->saltlen;
@@ -637,7 +637,7 @@ static int chachapoly_create(struct crypto_template *tmpl, struct rtattr **tb, 


	err = -EINVAL;

	/* Need 16-byte IV size, including Initial Block Counter value */

	if (crypto_skcipher_alg_ivsize(chacha) != CHACHA20_IV_SIZE)

	if (crypto_skcipher_alg_ivsize(chacha) != CHACHA_IV_SIZE)

		goto out_drop_chacha;

	/* Not a stream cipher? */

	if (chacha->base.cra_blocksize != 1)

CRA Git | Maintained and supported by SUSTech CRA and CCSE