1#include <stdint.h>
2#include <string.h>
3
4#define ROTL32(v, n) ((v << n) | (v >> (32 - n)))
5
6// quarter round
7#define QR(a, b, c, d) \
8 a += b; \
9 d ^= a; \
10 d = ROTL32(d, 16); \
11 c += d; \
12 b ^= c; \
13 b = ROTL32(b, 12); \
14 a += b; \
15 d ^= a; \
16 d = ROTL32(d, 8); \
17 c += d; \
18 b ^= c; \
19 b = ROTL32(b, 7)
20
21static const char *sigma = "expand 32-byte k";
22
23static uint32_t load32_le(const uint8_t *src) {
24 return ((uint32_t) src[0]) | ((uint32_t) src[1] << 8) |
25 ((uint32_t) src[2] << 16) | ((uint32_t) src[3] << 24);
26}
27
28static void store32_le(uint8_t *dst, uint32_t val) {
29 dst[0] = val & 0xff;
30 dst[1] = (val >> 8) & 0xff;
31 dst[2] = (val >> 16) & 0xff;
32 dst[3] = (val >> 24) & 0xff;
33}
34
35static void chacha20_init_state(uint32_t state[16], const uint8_t key[32],
36 const uint8_t nonce[12], uint32_t counter) {
37 const uint8_t *constants = (const uint8_t *) sigma;
38
39 state[0] = load32_le(src: constants + 0);
40 state[1] = load32_le(src: constants + 4);
41 state[2] = load32_le(src: constants + 8);
42 state[3] = load32_le(src: constants + 12);
43
44 for (int i = 0; i < 8; i++) {
45 state[4 + i] = load32_le(src: key + i * 4);
46 }
47
48 state[12] = counter;
49 state[13] = load32_le(src: nonce + 0);
50 state[14] = load32_le(src: nonce + 4);
51 state[15] = load32_le(src: nonce + 8);
52}
53
54static void chacha20_block(uint8_t output[64], const uint32_t input[16]) {
55 uint32_t x[16];
56 memcpy(x, input, sizeof(x));
57
58 for (int i = 0; i < 10; i++) {
59 // Column rounds
60 QR(x[0], x[4], x[8], x[12]);
61 QR(x[1], x[5], x[9], x[13]);
62 QR(x[2], x[6], x[10], x[14]);
63 QR(x[3], x[7], x[11], x[15]);
64 // Diagonal rounds
65 QR(x[0], x[5], x[10], x[15]);
66 QR(x[1], x[6], x[11], x[12]);
67 QR(x[2], x[7], x[8], x[13]);
68 QR(x[3], x[4], x[9], x[14]);
69 }
70
71 for (int i = 0; i < 16; i++) {
72 x[i] += input[i];
73 store32_le(dst: output + 4 * i, val: x[i]);
74 }
75}
76
77// Encrypt or decrypt (it's symmetric)
78void chacha20_encrypt(const uint8_t key[32], const uint8_t nonce[12],
79 uint32_t counter, const uint8_t *in, uint8_t *out,
80 uint64_t len) {
81 uint32_t state[16];
82 uint8_t keystream[64];
83 uint64_t offset = 0;
84
85 while (len > 0) {
86 chacha20_init_state(state, key, nonce, counter);
87 chacha20_block(output: keystream, input: state);
88 counter++;
89
90 uint64_t block_len = len > 64 ? 64 : len;
91 for (uint64_t i = 0; i < block_len; i++) {
92 out[offset + i] = in[offset + i] ^ keystream[i];
93 }
94
95 offset += block_len;
96 len -= block_len;
97 }
98}
99