common/mbedtls/chacha20.h

   1 /**
   2  * \file chacha20.h
   3  *
   4  * \brief   This file contains ChaCha20 definitions and functions.
   5  *
   6  *          ChaCha20 is a stream cipher that can encrypt and decrypt
   7  *          information. ChaCha was created by Daniel Bernstein as a variant of
   8  *          its Salsa cipher https://cr.yp.to/chacha/chacha-20080128.pdf
   9  *          ChaCha20 is the variant with 20 rounds, that was also standardized
  10  *          in RFC 7539.
  11  *
  12  * \author Daniel King <damaki.gh@gmail.com>
  13  */
  14
  15 /*
  16  *  Copyright The Mbed TLS Contributors
  17  *  SPDX-License-Identifier: Apache-2.0
  18  *
  19  *  Licensed under the Apache License, Version 2.0 (the "License"); you may
  20  *  not use this file except in compliance with the License.
  21  *  You may obtain a copy of the License at
  22  *
  23  *  http://www.apache.org/licenses/LICENSE-2.0
  24  *
  25  *  Unless required by applicable law or agreed to in writing, software
  26  *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  27  *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  28  *  See the License for the specific language governing permissions and
  29  *  limitations under the License.
  30  */
  31
  32 #ifndef MBEDTLS_CHACHA20_H
  33 #define MBEDTLS_CHACHA20_H
  34
  35 #if !defined(MBEDTLS_CONFIG_FILE)
  36 #include "mbedtls/config.h"
  37 #else
  38 #include MBEDTLS_CONFIG_FILE
  39 #endif
  40
  41 #include <stdint.h>
  42 #include <stddef.h>
  43
  44 #define MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA         -0x0051 /**< Invalid input parameter(s). */
  45
  46 /* MBEDTLS_ERR_CHACHA20_FEATURE_UNAVAILABLE is deprecated and should not be
  47  * used. */
  48 #define MBEDTLS_ERR_CHACHA20_FEATURE_UNAVAILABLE    -0x0053 /**< Feature not available. For example, s part of the API is not implemented. */
  49
  50 /* MBEDTLS_ERR_CHACHA20_HW_ACCEL_FAILED is deprecated and should not be used.
  51  */
  52 #define MBEDTLS_ERR_CHACHA20_HW_ACCEL_FAILED        -0x0055  /**< Chacha20 hardware accelerator failed. */
  53
  54 #ifdef __cplusplus
  55 extern "C" {
  56 #endif
  57
  58 #if !defined(MBEDTLS_CHACHA20_ALT)
  59
  60 typedef struct mbedtls_chacha20_context {
  61     uint32_t state[16];          /*! The state (before round operations). */
  62     uint8_t  keystream8[64];     /*! Leftover keystream bytes. */
  63     size_t keystream_bytes_used; /*! Number of keystream bytes already used. */
  64 }
  65 mbedtls_chacha20_context;
  66
  67 #else  /* MBEDTLS_CHACHA20_ALT */
  68 #include "chacha20_alt.h"
  69 #endif /* MBEDTLS_CHACHA20_ALT */
  70
  71 /**
  72  * \brief           This function initializes the specified ChaCha20 context.
  73  *
  74  *                  It must be the first API called before using
  75  *                  the context.
  76  *
  77  *                  It is usually followed by calls to
  78  *                  \c mbedtls_chacha20_setkey() and
  79  *                  \c mbedtls_chacha20_starts(), then one or more calls to
  80  *                  to \c mbedtls_chacha20_update(), and finally to
  81  *                  \c mbedtls_chacha20_free().
  82  *
  83  * \param ctx       The ChaCha20 context to initialize.
  84  *                  This must not be \c NULL.
  85  */
  86 void mbedtls_chacha20_init(mbedtls_chacha20_context *ctx);
  87
  88 /**
  89  * \brief           This function releases and clears the specified
  90  *                  ChaCha20 context.
  91  *
  92  * \param ctx       The ChaCha20 context to clear. This may be \c NULL,
  93  *                  in which case this function is a no-op. If it is not
  94  *                  \c NULL, it must point to an initialized context.
  95  *
  96  */
  97 void mbedtls_chacha20_free(mbedtls_chacha20_context *ctx);
  98
  99 /**
 100  * \brief           This function sets the encryption/decryption key.
 101  *
 102  * \note            After using this function, you must also call
 103  *                  \c mbedtls_chacha20_starts() to set a nonce before you
 104  *                  start encrypting/decrypting data with
 105  *                  \c mbedtls_chacha_update().
 106  *
 107  * \param ctx       The ChaCha20 context to which the key should be bound.
 108  *                  It must be initialized.
 109  * \param key       The encryption/decryption key. This must be \c 32 Bytes
 110  *                  in length.
 111  *
 112  * \return          \c 0 on success.
 113  * \return          #MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA if ctx or key is NULL.
 114  */
 115 int mbedtls_chacha20_setkey(mbedtls_chacha20_context *ctx,
 116                             const unsigned char key[32]);
 117
 118 /**
 119  * \brief           This function sets the nonce and initial counter value.
 120  *
 121  * \note            A ChaCha20 context can be re-used with the same key by
 122  *                  calling this function to change the nonce.
 123  *
 124  * \warning         You must never use the same nonce twice with the same key.
 125  *                  This would void any confidentiality guarantees for the
 126  *                  messages encrypted with the same nonce and key.
 127  *
 128  * \param ctx       The ChaCha20 context to which the nonce should be bound.
 129  *                  It must be initialized and bound to a key.
 130  * \param nonce     The nonce. This must be \c 12 Bytes in size.
 131  * \param counter   The initial counter value. This is usually \c 0.
 132  *
 133  * \return          \c 0 on success.
 134  * \return          #MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA if ctx or nonce is
 135  *                  NULL.
 136  */
 137 int mbedtls_chacha20_starts(mbedtls_chacha20_context *ctx,
 138                             const unsigned char nonce[12],
 139                             uint32_t counter);
 140
 141 /**
 142  * \brief           This function encrypts or decrypts data.
 143  *
 144  *                  Since ChaCha20 is a stream cipher, the same operation is
 145  *                  used for encrypting and decrypting data.
 146  *
 147  * \note            The \p input and \p output pointers must either be equal or
 148  *                  point to non-overlapping buffers.
 149  *
 150  * \note            \c mbedtls_chacha20_setkey() and
 151  *                  \c mbedtls_chacha20_starts() must be called at least once
 152  *                  to setup the context before this function can be called.
 153  *
 154  * \note            This function can be called multiple times in a row in
 155  *                  order to encrypt of decrypt data piecewise with the same
 156  *                  key and nonce.
 157  *
 158  * \param ctx       The ChaCha20 context to use for encryption or decryption.
 159  *                  It must be initialized and bound to a key and nonce.
 160  * \param size      The length of the input data in Bytes.
 161  * \param input     The buffer holding the input data.
 162  *                  This pointer can be \c NULL if `size == 0`.
 163  * \param output    The buffer holding the output data.
 164  *                  This must be able to hold \p size Bytes.
 165  *                  This pointer can be \c NULL if `size == 0`.
 166  *
 167  * \return          \c 0 on success.
 168  * \return          A negative error code on failure.
 169  */
 170 int mbedtls_chacha20_update(mbedtls_chacha20_context *ctx,
 171                             size_t size,
 172                             const unsigned char *input,
 173                             unsigned char *output);
 174
 175 /**
 176  * \brief           This function encrypts or decrypts data with ChaCha20 and
 177  *                  the given key and nonce.
 178  *
 179  *                  Since ChaCha20 is a stream cipher, the same operation is
 180  *                  used for encrypting and decrypting data.
 181  *
 182  * \warning         You must never use the same (key, nonce) pair more than
 183  *                  once. This would void any confidentiality guarantees for
 184  *                  the messages encrypted with the same nonce and key.
 185  *
 186  * \note            The \p input and \p output pointers must either be equal or
 187  *                  point to non-overlapping buffers.
 188  *
 189  * \param key       The encryption/decryption key.
 190  *                  This must be \c 32 Bytes in length.
 191  * \param nonce     The nonce. This must be \c 12 Bytes in size.
 192  * \param counter   The initial counter value. This is usually \c 0.
 193  * \param size      The length of the input data in Bytes.
 194  * \param input     The buffer holding the input data.
 195  *                  This pointer can be \c NULL if `size == 0`.
 196  * \param output    The buffer holding the output data.
 197  *                  This must be able to hold \p size Bytes.
 198  *                  This pointer can be \c NULL if `size == 0`.
 199  *
 200  * \return          \c 0 on success.
 201  * \return          A negative error code on failure.
 202  */
 203 int mbedtls_chacha20_crypt(const unsigned char key[32],
 204                            const unsigned char nonce[12],
 205                            uint32_t counter,
 206                            size_t size,
 207                            const unsigned char *input,
 208                            unsigned char *output);
 209
 210 #if defined(MBEDTLS_SELF_TEST)
 211 /**
 212  * \brief           The ChaCha20 checkup routine.
 213  *
 214  * \return          \c 0 on success.
 215  * \return          \c 1 on failure.
 216  */
 217 int mbedtls_chacha20_self_test(int verbose);
 218 #endif /* MBEDTLS_SELF_TEST */
 219
 220 #ifdef __cplusplus
 221 }
 222 #endif
 223
 224 #endif /* MBEDTLS_CHACHA20_H */