chacha20.h

Go to the documentation of this file.

// Copyright (c) 2017-present The Bitcoin Core developers
// Distributed under the MIT software license, see the accompanying
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
#ifndef BITCOIN_CRYPTO_CHACHA20_H
#define BITCOIN_CRYPTO_CHACHA20_H
 
#include <span.h>
 
#include <array>
#include <cstddef>
#include <cstdint>
#include <cstdlib>
#include <utility>
 
// classes for ChaCha20 256-bit stream cipher developed by Daniel J. Bernstein
// https://cr.yp.to/chacha/chacha-20080128.pdf.
//
// The 128-bit input is here implemented as a 96-bit nonce and a 32-bit block
// counter, as in RFC8439 Section 2.3. When the 32-bit block counter overflows
// the first 32-bit part of the nonce is automatically incremented, making it
// conceptually compatible with variants that use a 64/64 split instead.
 
class ChaCha20Aligned
{
private:
    uint32_t input[12];
 
public:
    static constexpr unsigned KEYLEN{32};
 
    static constexpr unsigned BLOCKLEN{64};
 
    ChaCha20Aligned() noexcept = delete;
 
    ChaCha20Aligned(std::span<const std::byte> key) noexcept;
 
    ~ChaCha20Aligned();
 
    void SetKey(std::span<const std::byte> key) noexcept;
 
    using Nonce96 = std::pair<uint32_t, uint64_t>;
 
    void Seek(Nonce96 nonce, uint32_t block_counter) noexcept;
 
    void Keystream(std::span<std::byte> out) noexcept;
 
    void Crypt(std::span<const std::byte> input, std::span<std::byte> output) noexcept;
};
 
class ChaCha20
{
private:
    ChaCha20Aligned m_aligned;
    std::array<std::byte, ChaCha20Aligned::BLOCKLEN> m_buffer;
    unsigned m_bufleft{0};
 
public:
    static constexpr unsigned KEYLEN = ChaCha20Aligned::KEYLEN;
 
    ChaCha20() noexcept = delete;
 
    ChaCha20(std::span<const std::byte> key) noexcept : m_aligned(key) {}
 
    ~ChaCha20();
 
    void SetKey(std::span<const std::byte> key) noexcept;
 
    using Nonce96 = ChaCha20Aligned::Nonce96;
 
    void Seek(Nonce96 nonce, uint32_t block_counter) noexcept
    {
        m_aligned.Seek(nonce, block_counter);
        m_bufleft = 0;
    }
 
    void Crypt(std::span<const std::byte> in_bytes, std::span<std::byte> out_bytes) noexcept;
 
    void Keystream(std::span<std::byte> out) noexcept;
};
 
class FSChaCha20
{
private:
    ChaCha20 m_chacha20;
 
    const uint32_t m_rekey_interval;
 
    uint32_t m_chunk_counter{0};
 
    uint64_t m_rekey_counter{0};
 
public:
    static constexpr unsigned KEYLEN = 32;
 
    // No copy or move to protect the secret.
    FSChaCha20(const FSChaCha20&) = delete;
    FSChaCha20(FSChaCha20&&) = delete;
    FSChaCha20& operator=(const FSChaCha20&) = delete;
    FSChaCha20& operator=(FSChaCha20&&) = delete;
 
    FSChaCha20(std::span<const std::byte> key, uint32_t rekey_interval) noexcept;
 
    void Crypt(std::span<const std::byte> input, std::span<std::byte> output) noexcept;
};
 
#endif // BITCOIN_CRYPTO_CHACHA20_H