crypto: Adiantum support

From: Eric Biggers <[email protected]>

Refactor the unkeyed permutation part of chacha20_block() into its own function, then add hchacha20_block() which is the ChaCha equivalent of HSalsa20 and is an intermediate step towards XChaCha20 (see
https://cr.yp.to/snuffle/xsalsa-20081128.pdf). HChaCha20 skips the final addition of the initial state, and outputs only certain words of the state. It should not be used for streaming directly.

Signed-off-by Eric Biggers <[email protected]>

---
 include/crypto/chacha20.h |  2 ++
 lib/chacha20.c            | 50 ++++++++++++++++++++++++++++++++++-----
 2 files changed, 46 insertions(+), 6 deletions(-)

include/crypto/chacha20.h +2 -0

index f76302d99e2be..fbec4e6a87890 100644
@@ -19,6 +19,8 @@ struct chacha20_ctx {
 };
 
 void chacha20_block(u32 *state, u8 *stream);
+void hchacha20_block(const u32 *in, u32 *out);
+
 void crypto_chacha20_init(u32 *state, struct chacha20_ctx *ctx, u8 *iv);
 int crypto_chacha20_setkey(struct crypto_skcipher *tfm, const u8 *key,
                           unsigned int keysize);

lib/chacha20.c +44 -7

index d907fec6a9ed1..6a484e16171d1 100644
@@ -1,5 +1,5 @@
 /*
- * ChaCha20 256-bit cipher algorithm, RFC7539
+ * The "hash function" used as the core of the ChaCha20 stream cipher (RFC7539)
  *
  * Copyright (C) 2015 Martin Willi
  *

@@ -16,14 +16,10 @@
 #include <asm/unaligned.h>
 #include <crypto/chacha20.h>
 
-void chacha20_block(u32 *state, u8 *stream)
+static void chacha20_permute(u32 *x)
 {
-       u32 x[16];
        int i;
 
-       for (i = 0; i < ARRAY_SIZE(x); i++)
-               x[i] = state[i];
-
        for (i = 0; i < 20; i += 2) {
                x[0]  += x[4];    x[12] = rol32(x[12] ^ x[0],  16);
                x[1]  += x[5];    x[13] = rol32(x[13] ^ x[1],  16);

@@ -65,6 +61,25 @@ void chacha20_block(u32 *state, u8 *stream)
                x[8]  += x[13];   x[7]  = rol32(x[7]  ^ x[8],   7);
                x[9]  += x[14];   x[4]  = rol32(x[4]  ^ x[9],   7);
        }
+}
+
+/**
+ * chacha20_block - generate one keystream block and increment block counter
+ * @state: input state matrix (16 32-bit words)
+ * @stream: output keystream block (64 bytes)
+ *
+ * This is the ChaCha20 core, a function from 64-byte strings to 64-byte
+ * strings.  The caller has already converted the endianness of the input.  This
+ * function also handles incrementing the block counter in the input matrix.
+ */
+void chacha20_block(u32 *state, u8 *stream)
+{
+       u32 x[16];
+       int i;
+
+       memcpy(x, state, 64);
+
+       chacha20_permute(x);
 
        for (i = 0; i < ARRAY_SIZE(x); i++)
                put_unaligned_le32(x[i] + state[i], &stream[i * sizeof(u32)]);

@@ -72,3 +87,26 @@ void chacha20_block(u32 *state, u8 *stream)
        state[12]++;
 }
 EXPORT_SYMBOL(chacha20_block);
+
+/**
+ * hchacha20_block - abbreviated ChaCha20 core, for XChaCha20
+ * @in: input state matrix (16 32-bit words)
+ * @out: output (8 32-bit words)
+ *
+ * HChaCha20 is the ChaCha equivalent of HSalsa20 and is an intermediate step
+ * towards XChaCha20 (see https://cr.yp.to/snuffle/xsalsa-20081128.pdf).
+ * HChaCha20 skips the final addition of the initial state, and outputs only
+ * certain words of the state.  It should not be used for streaming directly.
+ */
+void hchacha20_block(const u32 *in, u32 *out)
+{
+       u32 x[16];
+
+       memcpy(x, in, 64);
+
+       chacha20_permute(x);
+
+       memcpy(&out[0], &x[0], 16);
+       memcpy(&out[4], &x[12], 16);
+}
+EXPORT_SYMBOL(hchacha20_block);
--

2.19.1.331.ge82ca0e54c-goog

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel at lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

From: Eric Biggers <[email protected]>

Add support for the XChaCha20 stream cipher. XChaCha20 is the application of the XSalsa20 construction
(https://cr.yp.to/snuffle/xsalsa-20081128.pdf) to ChaCha20 rather than to Salsa20. XChaCha20 extends ChaCha20's nonce length from 64 bits (or 96 bits, depending on convention) to 192 bits, while provably retaining ChaCha20's security. XChaCha20 uses the ChaCha20 permutation to map the key and first 128 nonce bits to a 256-bit subkey. Then, it does the ChaCha20 stream cipher with the subkey and remaining 64 bits of nonce.

We need XChaCha support in order to add support for the Adiantum encryption mode. Note that to meet our performance requirements, we actually plan to primarily use the variant XChaCha12. But we believe it's wise to first add XChaCha20 as a baseline with a higher security margin, in case there are any situations where it can be used. Supporting both variants is straightforward.

Since XChaCha20's subkey differs for each request, XChaCha20 can't be a template that wraps ChaCha20; that would require re-keying the underlying ChaCha20 for every request, which wouldn't be thread-safe. Instead, we make XChaCha20 its own top-level algorithm which calls the ChaCha20 streaming implementation internally.

Similar to the existing ChaCha20 implementation, we define the IV to be the nonce and stream position concatenated together. This allows users to seek to any position in the stream.

I considered splitting the code into separate chacha20-common, chacha20, and xchacha20 modules, so that chacha20 and xchacha20 could be enabled/disabled independently. However, since nearly all the code is shared anyway, I ultimately decided there would have been little benefit to the added complexity of separate modules.

Signed-off-by Eric Biggers <[email protected]>

---
 crypto/Kconfig            |  14 +-
 crypto/chacha20_generic.c | 120 +++++---
 crypto/testmgr.c          |   6 +
 crypto/testmgr.h          | 577 ++++++++++++++++++++++++++++++++++++++
 include/crypto/chacha20.h |  14 +-
 5 files changed, 689 insertions(+), 42 deletions(-)

crypto/Kconfig +9 -5

index f7a235db56aaa..d9acbce23d4d5 100644
@@ -1387,18 +1387,22 @@ config CRYPTO_SALSA20
          Bernstein <[email protected]>. See <http://cr.yp.to/snuffle.html>
 
 config CRYPTO_CHACHA20
-       tristate "ChaCha20 cipher algorithm"
+       tristate "ChaCha20 stream cipher algorithms"
        select CRYPTO_BLKCIPHER
        help
-         ChaCha20 cipher algorithm, RFC7539.
+         The ChaCha20 and XChaCha20 stream cipher algorithms.
 
          ChaCha20 is a 256-bit high-speed stream cipher designed by Daniel J.
          Bernstein and further specified in RFC7539 for use in IETF protocols.
-         This is the portable C implementation of ChaCha20.
-
-         See also:
+         This is the portable C implementation of ChaCha20.  See also:
          <http://cr.yp.to/chacha/chacha-20080128.pdf>
 
+         XChaCha20 is the application of the XSalsa20 construction to ChaCha20
+         rather than to Salsa20.  XChaCha20 extends ChaCha20's nonce length
+         from 64 bits (or 96 bits using the RFC7539 convention) to 192 bits,
+         while provably retaining ChaCha20's security.  See also:
+         <https://cr.yp.to/snuffle/xsalsa-20081128.pdf>
+
 config CRYPTO_CHACHA20_X86_64
        tristate "ChaCha20 cipher algorithm (x86_64/SSSE3/AVX2)"
        depends on X86 && 64BIT

crypto/chacha20_generic.c +2 -1

index 3ae96587caf9a..07902fe37aeb8 100644
@@ -1,7 +1,8 @@
 /*
- * ChaCha20 256-bit cipher algorithm, RFC7539
+ * ChaCha20 (RFC7539) and XChaCha20 stream cipher algorithms
  *
  * Copyright (C) 2015 Martin Willi
+ * Copyright (C) 2018 Google LLC
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

@@ -36,6 +37,31 @@ static void chacha20_docrypt(u32 *state, u8 *dst, const u8 *src,
        }
 }

crypto/chacha20_generic.c +73 -35

+       crypto_chacha20_init(state, ctx, iv);
+
+       while (walk.nbytes > 0) {
+               unsigned int nbytes = walk.nbytes;
+
+               if (nbytes < walk.total)
+                       nbytes = round_down(nbytes, walk.stride);
+
+               chacha20_docrypt(state, walk.dst.virt.addr, walk.src.virt.addr,
+                                nbytes);
+               err = skcipher_walk_done(&walk, walk.nbytes - nbytes);
+       }
+
+       return err;
+}
+
 void crypto_chacha20_init(u32 *state, struct chacha20_ctx *ctx, u8 *iv)
 {
        state[0]  = 0x61707865; /* "expa" */

@@ -77,54 +103,74 @@ int crypto_chacha20_crypt(struct skcipher_request *req)
 {
        struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
        struct chacha20_ctx *ctx = crypto_skcipher_ctx(tfm);
-       struct skcipher_walk walk;
-       u32 state[16];
-       int err;
-
-       err = skcipher_walk_virt(&walk, req, true);
 
-       crypto_chacha20_init(state, ctx, walk.iv);
+       return chacha20_stream_xor(req, ctx, req->iv);
+}
+EXPORT_SYMBOL_GPL(crypto_chacha20_crypt);
 
-       while (walk.nbytes > 0) {
-               unsigned int nbytes = walk.nbytes;
+int crypto_xchacha20_crypt(struct skcipher_request *req)
+{
+       struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
+       struct chacha20_ctx *ctx = crypto_skcipher_ctx(tfm);
+       struct chacha20_ctx subctx;
+       u32 state[16];
+       u8 real_iv[16];
 
-               if (nbytes < walk.total)
-                       nbytes = round_down(nbytes, walk.stride);
+       /* Compute the subkey given the original key and first 128 nonce bits */
+       crypto_chacha20_init(state, ctx, req->iv);
+       hchacha20_block(state, subctx.key);
 
-               chacha20_docrypt(state, walk.dst.virt.addr, walk.src.virt.addr,
-                                nbytes);
-               err = skcipher_walk_done(&walk, walk.nbytes - nbytes);
-       }
+       /* Build the real IV */
+       memcpy(&real_iv[0], req->iv + 24, 8); /* stream position */
+       memcpy(&real_iv[8], req->iv + 16, 8); /* remaining 64 nonce bits */
 
-       return err;
+       /* Generate the stream and XOR it with the data */
+       return chacha20_stream_xor(req, &subctx, real_iv);
 }
-EXPORT_SYMBOL_GPL(crypto_chacha20_crypt);
-
-static struct skcipher_alg alg = {
-       .base.cra_name          = "chacha20",
-       .base.cra_driver_name   = "chacha20-generic",
-       .base.cra_priority      = 100,
-       .base.cra_blocksize     = 1,
-       .base.cra_ctxsize       = sizeof(struct chacha20_ctx),
-       .base.cra_module        = THIS_MODULE,
-
-       .min_keysize            = CHACHA20_KEY_SIZE,
-       .max_keysize            = CHACHA20_KEY_SIZE,
-       .ivsize                 = CHACHA20_IV_SIZE,
-       .chunksize              = CHACHA20_BLOCK_SIZE,
-       .setkey                 = crypto_chacha20_setkey,
-       .encrypt                = crypto_chacha20_crypt,
-       .decrypt                = crypto_chacha20_crypt,
+EXPORT_SYMBOL_GPL(crypto_xchacha20_crypt);
+
+static struct skcipher_alg algs[] = {
+       {
+               .base.cra_name          = "chacha20",
+               .base.cra_driver_name   = "chacha20-generic",
+               .base.cra_priority      = 100,
+               .base.cra_blocksize     = 1,
+               .base.cra_ctxsize       = sizeof(struct chacha20_ctx),
+               .base.cra_module        = THIS_MODULE,
+
+               .min_keysize            = CHACHA20_KEY_SIZE,
+               .max_keysize            = CHACHA20_KEY_SIZE,
+               .ivsize                 = CHACHA20_IV_SIZE,
+               .chunksize              = CHACHA20_BLOCK_SIZE,
+               .setkey                 = crypto_chacha20_setkey,
+               .encrypt                = crypto_chacha20_crypt,
+               .decrypt                = crypto_chacha20_crypt,
+       }, {
+               .base.cra_name          = "xchacha20",
+               .base.cra_driver_name   = "xchacha20-generic",
+               .base.cra_priority      = 100,
+               .base.cra_blocksize     = 1,
+               .base.cra_ctxsize       = sizeof(struct chacha20_ctx),
+               .base.cra_module        = THIS_MODULE,
+
+               .min_keysize            = CHACHA20_KEY_SIZE,
+               .max_keysize            = CHACHA20_KEY_SIZE,
+               .ivsize                 = XCHACHA20_IV_SIZE,
+               .chunksize              = CHACHA20_BLOCK_SIZE,
+               .setkey                 = crypto_chacha20_setkey,
+               .encrypt                = crypto_xchacha20_crypt,
+               .decrypt                = crypto_xchacha20_crypt,
+       }
 };
 
 static int __init chacha20_generic_mod_init(void)
 {
-       return crypto_register_skcipher(&alg);
+       return crypto_register_skciphers(algs, ARRAY_SIZE(algs));
 }
 
 static void __exit chacha20_generic_mod_fini(void)
 {
-       crypto_unregister_skcipher(&alg);
+       crypto_unregister_skciphers(algs, ARRAY_SIZE(algs));
 }
 
 module_init(chacha20_generic_mod_init);

@@ -132,6 +178,8 @@ module_exit(chacha20_generic_mod_fini);
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Martin Willi <[email protected]>");
-MODULE_DESCRIPTION("chacha20 cipher algorithm");
+MODULE_DESCRIPTION("ChaCha20 and XChaCha20 stream ciphers (generic)");
 MODULE_ALIAS_CRYPTO("chacha20");
 MODULE_ALIAS_CRYPTO("chacha20-generic");
+MODULE_ALIAS_CRYPTO("xchacha20");
+MODULE_ALIAS_CRYPTO("xchacha20-generic");

crypto/testmgr.c +6 -0

index b1f79c6bf4096..a5512e69c8f31 100644
@@ -3544,6 +3544,12 @@ static const struct alg_test_desc alg_test_descs[] = {
                .suite = {
                        .hash = __VECS(aes_xcbc128_tv_template)
                }
+       }, {
+               .alg = "xchacha20",
+               .test = alg_test_skcipher,
+               .suite = {
+                       .cipher = __VECS(xchacha20_tv_template)
+               },
        }, {
                .alg = "xts(aes)",
                .test = alg_test_skcipher,

crypto/testmgr.h +577 -0

index 1fe7b97ba03f9..371641c73cf8c 100644
@@ -30802,6 +30802,583 @@ static const struct cipher_testvec chacha20_tv_template[] = {
        },
 };
 
+static const struct cipher_testvec xchacha20_tv_template[] = {
+       { /* from libsodium test/default/xchacha20.c */
+               .key    = "\x79\xc9\x97\x98\xac\x67\x30\x0b"
+                         "\xbb\x27\x04\xc9\x5c\x34\x1e\x32"
+                         "\x45\xf3\xdc\xb2\x17\x61\xb9\x8e"
+                         "\x52\xff\x45\xb2\x4f\x30\x4f\xc4",
+               .klen   = 32,
+               .iv     = "\xb3\x3f\xfd\x30\x96\x47\x9b\xcf"
+                         "\xbc\x9a\xee\x49\x41\x76\x88\xa0"
+                         "\xa2\x55\x4f\x8d\x95\x38\x94\x19"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00",
+               .ptext  = "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00",
+               .ctext  = "\xc6\xe9\x75\x81\x60\x08\x3a\xc6"
+                         "\x04\xef\x90\xe7\x12\xce\x6e\x75"
+                         "\xd7\x79\x75\x90\x74\x4e\x0c\xf0"
+                         "\x60\xf0\x13\x73\x9c",
+               .len    = 29,
+       }, { /* from libsodium test/default/xchacha20.c */
+               .key    = "\x9d\x23\xbd\x41\x49\xcb\x97\x9c"
+                         "\xcf\x3c\x5c\x94\xdd\x21\x7e\x98"
+                         "\x08\xcb\x0e\x50\xcd\x0f\x67\x81"
+                         "\x22\x35\xea\xaf\x60\x1d\x62\x32",
+               .klen   = 32,
+               .iv     = "\xc0\x47\x54\x82\x66\xb7\xc3\x70"
+                         "\xd3\x35\x66\xa2\x42\x5c\xbf\x30"
+                         "\xd8\x2d\x1e\xaf\x52\x94\x10\x9e"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00",
+               .ptext  = "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00",
+               .ctext  = "\xa2\x12\x09\x09\x65\x94\xde\x8c"
+                         "\x56\x67\xb1\xd1\x3a\xd9\x3f\x74"
+                         "\x41\x06\xd0\x54\xdf\x21\x0e\x47"
+                         "\x82\xcd\x39\x6f\xec\x69\x2d\x35"
+                         "\x15\xa2\x0b\xf3\x51\xee\xc0\x11"
+                         "\xa9\x2c\x36\x78\x88\xbc\x46\x4c"
+                         "\x32\xf0\x80\x7a\xcd\x6c\x20\x3a"
+                         "\x24\x7e\x0d\xb8\x54\x14\x84\x68"
+                         "\xe9\xf9\x6b\xee\x4c\xf7\x18\xd6"
+                         "\x8d\x5f\x63\x7c\xbd\x5a\x37\x64"
+                         "\x57\x78\x8e\x6f\xae\x90\xfc\x31"
+                         "\x09\x7c\xfc",
+               .len    = 91,
+       }, { /* Taken from the ChaCha20 test vectors, appended 16 random bytes
+               to nonce, and recomputed the ciphertext with libsodium */
+               .key    = "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00",
+               .klen   = 32,
+               .iv     = "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x67\xc6\x69\x73"
+                         "\x51\xff\x4a\xec\x29\xcd\xba\xab"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00",
+               .ptext  = "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00",
+               .ctext  = "\x9c\x49\x2a\xe7\x8a\x2f\x93\xc7"
+                         "\xb3\x33\x6f\x82\x17\xd8\xc4\x1e"
+                         "\xad\x80\x11\x11\x1d\x4c\x16\x18"
+                         "\x07\x73\x9b\x4f\xdb\x7c\xcb\x47"
+                         "\xfd\xef\x59\x74\xfa\x3f\xe5\x4c"
+                         "\x9b\xd0\xea\xbc\xba\x56\xad\x32"
+                         "\x03\xdc\xf8\x2b\xc1\xe1\x75\x67"
+                         "\x23\x7b\xe6\xfc\xd4\x03\x86\x54",
+               .len    = 64,
+       }, { /* Taken from the ChaCha20 test vectors, appended 16 random bytes
+               to nonce, and recomputed the ciphertext with libsodium */
+               .key    = "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x01",
+               .klen   = 32,
+               .iv     = "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x02\xf2\xfb\xe3\x46"
+                         "\x7c\xc2\x54\xf8\x1b\xe8\xe7\x8d"
+                         "\x01\x00\x00\x00\x00\x00\x00\x00",
+               .ptext  = "\x41\x6e\x79\x20\x73\x75\x62\x6d"
+                         "\x69\x73\x73\x69\x6f\x6e\x20\x74"
+                         "\x6f\x20\x74\x68\x65\x20\x49\x45"
+                         "\x54\x46\x20\x69\x6e\x74\x65\x6e"
+                         "\x64\x65\x64\x20\x62\x79\x20\x74"
+                         "\x68\x65\x20\x43\x6f\x6e\x74\x72"
+                         "\x69\x62\x75\x74\x6f\x72\x20\x66"
+                         "\x6f\x72\x20\x70\x75\x62\x6c\x69"
+                         "\x63\x61\x74\x69\x6f\x6e\x20\x61"
+                         "\x73\x20\x61\x6c\x6c\x20\x6f\x72"
+                         "\x20\x70\x61\x72\x74\x20\x6f\x66"
+                         "\x20\x61\x6e\x20\x49\x45\x54\x46"
+                         "\x20\x49\x6e\x74\x65\x72\x6e\x65"
+                         "\x74\x2d\x44\x72\x61\x66\x74\x20"
+                         "\x6f\x72\x20\x52\x46\x43\x20\x61"
+                         "\x6e\x64\x20\x61\x6e\x79\x20\x73"
+                         "\x74\x61\x74\x65\x6d\x65\x6e\x74"
+                         "\x20\x6d\x61\x64\x65\x20\x77\x69"
+                         "\x74\x68\x69\x6e\x20\x74\x68\x65"
+                         "\x20\x63\x6f\x6e\x74\x65\x78\x74"
+                         "\x20\x6f\x66\x20\x61\x6e\x20\x49"
+                         "\x45\x54\x46\x20\x61\x63\x74\x69"
+                         "\x76\x69\x74\x79\x20\x69\x73\x20"
+                         "\x63\x6f\x6e\x73\x69\x64\x65\x72"
+                         "\x65\x64\x20\x61\x6e\x20\x22\x49"
+                         "\x45\x54\x46\x20\x43\x6f\x6e\x74"
+                         "\x72\x69\x62\x75\x74\x69\x6f\x6e"
+                         "\x22\x2e\x20\x53\x75\x63\x68\x20"
+                         "\x73\x74\x61\x74\x65\x6d\x65\x6e"
+                         "\x74\x73\x20\x69\x6e\x63\x6c\x75"
+                         "\x64\x65\x20\x6f\x72\x61\x6c\x20"
+                         "\x73\x74\x61\x74\x65\x6d\x65\x6e"
+                         "\x74\x73\x20\x69\x6e\x20\x49\x45"
+                         "\x54\x46\x20\x73\x65\x73\x73\x69"
+                         "\x6f\x6e\x73\x2c\x20\x61\x73\x20"
+                         "\x77\x65\x6c\x6c\x20\x61\x73\x20"
+                         "\x77\x72\x69\x74\x74\x65\x6e\x20"
+                         "\x61\x6e\x64\x20\x65\x6c\x65\x63"
+                         "\x74\x72\x6f\x6e\x69\x63\x20\x63"
+                         "\x6f\x6d\x6d\x75\x6e\x69\x63\x61"
+                         "\x74\x69\x6f\x6e\x73\x20\x6d\x61"
+                         "\x64\x65\x20\x61\x74\x20\x61\x6e"
+                         "\x79\x20\x74\x69\x6d\x65\x20\x6f"
+                         "\x72\x20\x70\x6c\x61\x63\x65\x2c"
+                         "\x20\x77\x68\x69\x63\x68\x20\x61"
+                         "\x72\x65\x20\x61\x64\x64\x72\x65"
+                         "\x73\x73\x65\x64\x20\x74\x6f",
+               .ctext  = "\xf9\xab\x7a\x4a\x60\xb8\x5f\xa0"
+                         "\x50\xbb\x57\xce\xef\x8c\xc1\xd9"
+                         "\x24\x15\xb3\x67\x5e\x7f\x01\xf6"
+                         "\x1c\x22\xf6\xe5\x71\xb1\x43\x64"
+                         "\x63\x05\xd5\xfc\x5c\x3d\xc0\x0e"
+                         "\x23\xef\xd3\x3b\xd9\xdc\x7f\xa8"
+                         "\x58\x26\xb3\xd0\xc2\xd5\x04\x3f"
+                         "\x0a\x0e\x8f\x17\xe4\xcd\xf7\x2a"
+                         "\xb4\x2c\x09\xe4\x47\xec\x8b\xfb"
+                         "\x59\x37\x7a\xa1\xd0\x04\x7e\xaa"
+                         "\xf1\x98\x5f\x24\x3d\x72\x9a\x43"
+                         "\xa4\x36\x51\x92\x22\x87\xff\x26"
+                         "\xce\x9d\xeb\x59\x78\x84\x5e\x74"
+                         "\x97\x2e\x63\xc0\xef\x29\xf7\x8a"
+                         "\xb9\xee\x35\x08\x77\x6a\x35\x9a"
+                         "\x3e\xe6\x4f\x06\x03\x74\x1b\xc1"
+                         "\x5b\xb3\x0b\x89\x11\x07\xd3\xb7"
+                         "\x53\xd6\x25\x04\xd9\x35\xb4\x5d"
+                         "\x4c\x33\x5a\xc2\x42\x4c\xe6\xa4"
+                         "\x97\x6e\x0e\xd2\xb2\x8b\x2f\x7f"
+                         "\x28\xe5\x9f\xac\x4b\x2e\x02\xab"
+                         "\x85\xfa\xa9\x0d\x7c\x2d\x10\xe6"
+                         "\x91\xab\x55\x63\xf0\xde\x3a\x94"
+                         "\x25\x08\x10\x03\xc2\x68\xd1\xf4"
+                         "\xaf\x7d\x9c\x99\xf7\x86\x96\x30"
+                         "\x60\xfc\x0b\xe6\xa8\x80\x15\xb0"
+                         "\x81\xb1\x0c\xbe\xb9\x12\x18\x25"
+                         "\xe9\x0e\xb1\xe7\x23\xb2\xef\x4a"
+                         "\x22\x8f\xc5\x61\x89\xd4\xe7\x0c"
+                         "\x64\x36\x35\x61\xb6\x34\x60\xf7"
+                         "\x7b\x61\x37\x37\x12\x10\xa2\xf6"
+                         "\x7e\xdb\x7f\x39\x3f\xb6\x8e\x89"
+                         "\x9e\xf3\xfe\x13\x98\xbb\x66\x5a"
+                         "\xec\xea\xab\x3f\x9c\x87\xc4\x8c"
+                         "\x8a\x04\x18\x49\xfc\x77\x11\x50"
+                         "\x16\xe6\x71\x2b\xee\xc0\x9c\xb6"
+                         "\x87\xfd\x80\xff\x0b\x1d\x73\x38"
+                         "\xa4\x1d\x6f\xae\xe4\x12\xd7\x93"
+                         "\x9d\xcd\x38\x26\x09\x40\x52\xcd"
+                         "\x67\x01\x67\x26\xe0\x3e\x98\xa8"
+                         "\xe8\x1a\x13\x41\xbb\x90\x4d\x87"
+                         "\xbb\x42\x82\x39\xce\x3a\xd0\x18"
+                         "\x6d\x7b\x71\x8f\xbb\x2c\x6a\xd1"
+                         "\xbd\xf5\xc7\x8a\x7e\xe1\x1e\x0f"
+                         "\x0d\x0d\x13\x7c\xd9\xd8\x3c\x91"
+                         "\xab\xff\x1f\x12\xc3\xee\xe5\x65"
+                         "\x12\x8d\x7b\x61\xe5\x1f\x98",
+               .len    = 375,
+               .also_non_np = 1,
+               .np     = 3,
+               .tap    = { 375 - 20, 4, 16 },
+
+       }, { /* Taken from the ChaCha20 test vectors, appended 16 random bytes
+               to nonce, and recomputed the ciphertext with libsodium */
+               .key    = "\x1c\x92\x40\xa5\xeb\x55\xd3\x8a"
+                         "\xf3\x33\x88\x86\x04\xf6\xb5\xf0"
+                         "\x47\x39\x17\xc1\x40\x2b\x80\x09"
+                         "\x9d\xca\x5c\xbc\x20\x70\x75\xc0",
+               .klen   = 32,
+               .iv     = "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x02\x76\x5a\x2e\x63"
+                         "\x33\x9f\xc9\x9a\x66\x32\x0d\xb7"
+                         "\x2a\x00\x00\x00\x00\x00\x00\x00",
+               .ptext  = "\x27\x54\x77\x61\x73\x20\x62\x72"
+                         "\x69\x6c\x6c\x69\x67\x2c\x20\x61"
+                         "\x6e\x64\x20\x74\x68\x65\x20\x73"
+                         "\x6c\x69\x74\x68\x79\x20\x74\x6f"
+                         "\x76\x65\x73\x0a\x44\x69\x64\x20"
+                         "\x67\x79\x72\x65\x20\x61\x6e\x64"
+                         "\x20\x67\x69\x6d\x62\x6c\x65\x20"
+                         "\x69\x6e\x20\x74\x68\x65\x20\x77"
+                         "\x61\x62\x65\x3a\x0a\x41\x6c\x6c"
+                         "\x20\x6d\x69\x6d\x73\x79\x20\x77"
+                         "\x65\x72\x65\x20\x74\x68\x65\x20"
+                         "\x62\x6f\x72\x6f\x67\x6f\x76\x65"
+                         "\x73\x2c\x0a\x41\x6e\x64\x20\x74"
+                         "\x68\x65\x20\x6d\x6f\x6d\x65\x20"
+                         "\x72\x61\x74\x68\x73\x20\x6f\x75"
+                         "\x74\x67\x72\x61\x62\x65\x2e",
+               .ctext  = "\x95\xb9\x51\xe7\x8f\xb4\xa4\x03"
+                         "\xca\x37\xcc\xde\x60\x1d\x8c\xe2"
+                         "\xf1\xbb\x8a\x13\x7f\x61\x85\xcc"
+                         "\xad\xf4\xf0\xdc\x86\xa6\x1e\x10"
+                         "\xbc\x8e\xcb\x38\x2b\xa5\xc8\x8f"
+                         "\xaa\x03\x3d\x53\x4a\x42\xb1\x33"
+                         "\xfc\xd3\xef\xf0\x8e\x7e\x10\x9c"
+                         "\x6f\x12\x5e\xd4\x96\xfe\x5b\x08"
+                         "\xb6\x48\xf0\x14\x74\x51\x18\x7c"
+                         "\x07\x92\xfc\xac\x9d\xf1\x94\xc0"
+                         "\xc1\x9d\xc5\x19\x43\x1f\x1d\xbb"
+                         "\x07\xf0\x1b\x14\x25\x45\xbb\xcb"
+                         "\x5c\xe2\x8b\x28\xf3\xcf\x47\x29"
+                         "\x27\x79\x67\x24\xa6\x87\xc2\x11"
+                         "\x65\x03\xfa\x45\xf7\x9e\x53\x7a"
+                         "\x99\xf1\x82\x25\x4f\x8d\x07",
+               .len    = 127,
+       }, { /* Taken from the ChaCha20 test vectors, appended 16 random bytes
+               to nonce, and recomputed the ciphertext with libsodium */
+               .key    = "\x1c\x92\x40\xa5\xeb\x55\xd3\x8a"
+                         "\xf3\x33\x88\x86\x04\xf6\xb5\xf0"
+                         "\x47\x39\x17\xc1\x40\x2b\x80\x09"
+                         "\x9d\xca\x5c\xbc\x20\x70\x75\xc0",
+               .klen   = 32,
+               .iv     = "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x01\x31\x58\xa3\x5a"
+                         "\x25\x5d\x05\x17\x58\xe9\x5e\xd4"
+                         "\x1c\x00\x00\x00\x00\x00\x00\x00",
+               .ptext  = "\x49\xee\xe0\xdc\x24\x90\x40\xcd"
+                         "\xc5\x40\x8f\x47\x05\xbc\xdd\x81"
+                         "\x47\xc6\x8d\xe6\xb1\x8f\xd7\xcb"
+                         "\x09\x0e\x6e\x22\x48\x1f\xbf\xb8"
+                         "\x5c\xf7\x1e\x8a\xc1\x23\xf2\xd4"
+                         "\x19\x4b\x01\x0f\x4e\xa4\x43\xce"
+                         "\x01\xc6\x67\xda\x03\x91\x18\x90"
+                         "\xa5\xa4\x8e\x45\x03\xb3\x2d\xac"
+                         "\x74\x92\xd3\x53\x47\xc8\xdd\x25"
+                         "\x53\x6c\x02\x03\x87\x0d\x11\x0c"
+                         "\x58\xe3\x12\x18\xfd\x2a\x5b\x40"
+                         "\x0c\x30\xf0\xb8\x3f\x43\xce\xae"
+                         "\x65\x3a\x7d\x7c\xf4\x54\xaa\xcc"
+                         "\x33\x97\xc3\x77\xba\xc5\x70\xde"
+                         "\xd7\xd5\x13\xa5\x65\xc4\x5f\x0f"
+                         "\x46\x1a\x0d\x97\xb5\xf3\xbb\x3c"
+                         "\x84\x0f\x2b\xc5\xaa\xea\xf2\x6c"
+                         "\xc9\xb5\x0c\xee\x15\xf3\x7d\xbe"
+                         "\x9f\x7b\x5a\xa6\xae\x4f\x83\xb6"
+                         "\x79\x49\x41\xf4\x58\x18\xcb\x86"
+                         "\x7f\x30\x0e\xf8\x7d\x44\x36\xea"
+                         "\x75\xeb\x88\x84\x40\x3c\xad\x4f"
+                         "\x6f\x31\x6b\xaa\x5d\xe5\xa5\xc5"
+                         "\x21\x66\xe9\xa7\xe3\xb2\x15\x88"
+                         "\x78\xf6\x79\xa1\x59\x47\x12\x4e"
+                         "\x9f\x9f\x64\x1a\xa0\x22\x5b\x08"
+                         "\xbe\x7c\x36\xc2\x2b\x66\x33\x1b"
+                         "\xdd\x60\x71\xf7\x47\x8c\x61\xc3"
+                         "\xda\x8a\x78\x1e\x16\xfa\x1e\x86"
+                         "\x81\xa6\x17\x2a\xa7\xb5\xc2\xe7"
+                         "\xa4\xc7\x42\xf1\xcf\x6a\xca\xb4"
+                         "\x45\xcf\xf3\x93\xf0\xe7\xea\xf6"
+                         "\xf4\xe6\x33\x43\x84\x93\xa5\x67"
+                         "\x9b\x16\x58\x58\x80\x0f\x2b\x5c"
+                         "\x24\x74\x75\x7f\x95\x81\xb7\x30"
+                         "\x7a\x33\xa7\xf7\x94\x87\x32\x27"
+                         "\x10\x5d\x14\x4c\x43\x29\xdd\x26"
+                         "\xbd\x3e\x3c\x0e\xfe\x0e\xa5\x10"
+                         "\xea\x6b\x64\xfd\x73\xc6\xed\xec"
+                         "\xa8\xc9\xbf\xb3\xba\x0b\x4d\x07"
+                         "\x70\xfc\x16\xfd\x79\x1e\xd7\xc5"
+                         "\x49\x4e\x1c\x8b\x8d\x79\x1b\xb1"
+                         "\xec\xca\x60\x09\x4c\x6a\xd5\x09"
+                         "\x49\x46\x00\x88\x22\x8d\xce\xea"
+                         "\xb1\x17\x11\xde\x42\xd2\x23\xc1"
+                         "\x72\x11\xf5\x50\x73\x04\x40\x47"
+                         "\xf9\x5d\xe7\xa7\x26\xb1\x7e\xb0"
+                         "\x3f\x58\xc1\x52\xab\x12\x67\x9d"
+                         "\x3f\x43\x4b\x68\xd4\x9c\x68\x38"
+                         "\x07\x8a\x2d\x3e\xf3\xaf\x6a\x4b"
+                         "\xf9\xe5\x31\x69\x22\xf9\xa6\x69"
+                         "\xc6\x9c\x96\x9a\x12\x35\x95\x1d"
+                         "\x95\xd5\xdd\xbe\xbf\x93\x53\x24"
+                         "\xfd\xeb\xc2\x0a\x64\xb0\x77\x00"
+                         "\x6f\x88\xc4\x37\x18\x69\x7c\xd7"
+                         "\x41\x92\x55\x4c\x03\xa1\x9a\x4b"
+                         "\x15\xe5\xdf\x7f\x37\x33\x72\xc1"
+                         "\x8b\x10\x67\xa3\x01\x57\x94\x25"
+                         "\x7b\x38\x71\x7e\xdd\x1e\xcc\x73"
+                         "\x55\xd2\x8e\xeb\x07\xdd\xf1\xda"
+                         "\x58\xb1\x47\x90\xfe\x42\x21\x72"
+                         "\xa3\x54\x7a\xa0\x40\xec\x9f\xdd"
+                         "\xc6\x84\x6e\xca\xae\xe3\x68\xb4"
+                         "\x9d\xe4\x78\xff\x57\xf2\xf8\x1b"
+                         "\x03\xa1\x31\xd9\xde\x8d\xf5\x22"
+                         "\x9c\xdd\x20\xa4\x1e\x27\xb1\x76"
+                         "\x4f\x44\x55\xe2\x9b\xa1\x9c\xfe"
+                         "\x54\xf7\x27\x1b\xf4\xde\x02\xf5"
+                         "\x1b\x55\x48\x5c\xdc\x21\x4b\x9e"
+                         "\x4b\x6e\xed\x46\x23\xdc\x65\xb2"
+                         "\xcf\x79\x5f\x28\xe0\x9e\x8b\xe7"
+                         "\x4c\x9d\x8a\xff\xc1\xa6\x28\xb8"
+                         "\x65\x69\x8a\x45\x29\xef\x74\x85"
+                         "\xde\x79\xc7\x08\xae\x30\xb0\xf4"
+                         "\xa3\x1d\x51\x41\xab\xce\xcb\xf6"
+                         "\xb5\xd8\x6d\xe0\x85\xe1\x98\xb3"
+                         "\x43\xbb\x86\x83\x0a\xa0\xf5\xb7"
+                         "\x04\x0b\xfa\x71\x1f\xb0\xf6\xd9"
+                         "\x13\x00\x15\xf0\xc7\xeb\x0d\x5a"
+                         "\x9f\xd7\xb9\x6c\x65\x14\x22\x45"
+                         "\x6e\x45\x32\x3e\x7e\x60\x1a\x12"
+                         "\x97\x82\x14\xfb\xaa\x04\x22\xfa"
+                         "\xa0\xe5\x7e\x8c\x78\x02\x48\x5d"
+                         "\x78\x33\x5a\x7c\xad\xdb\x29\xce"
+                         "\xbb\x8b\x61\xa4\xb7\x42\xe2\xac"
+                         "\x8b\x1a\xd9\x2f\x0b\x8b\x62\x21"
+                         "\x83\x35\x7e\xad\x73\xc2\xb5\x6c"
+                         "\x10\x26\x38\x07\xe5\xc7\x36\x80"
+                         "\xe2\x23\x12\x61\xf5\x48\x4b\x2b"
+                         "\xc5\xdf\x15\xd9\x87\x01\xaa\xac"
+                         "\x1e\x7c\xad\x73\x78\x18\x63\xe0"
+                         "\x8b\x9f\x81\xd8\x12\x6a\x28\x10"
+                         "\xbe\x04\x68\x8a\x09\x7c\x1b\x1c"
+                         "\x83\x66\x80\x47\x80\xe8\xfd\x35"
+                         "\x1c\x97\x6f\xae\x49\x10\x66\xcc"
+                         "\xc6\xd8\xcc\x3a\x84\x91\x20\x77"
+                         "\x72\xe4\x24\xd2\x37\x9f\xc5\xc9"
+                         "\x25\x94\x10\x5f\x40\x00\x64\x99"
+                         "\xdc\xae\xd7\x21\x09\x78\x50\x15"
+                         "\xac\x5f\xc6\x2c\xa2\x0b\xa9\x39"
+                         "\x87\x6e\x6d\xab\xde\x08\x51\x16"
+                         "\xc7\x13\xe9\xea\xed\x06\x8e\x2c"
+                         "\xf8\x37\x8c\xf0\xa6\x96\x8d\x43"
+                         "\xb6\x98\x37\xb2\x43\xed\xde\xdf"
+                         "\x89\x1a\xe7\xeb\x9d\xa1\x7b\x0b"
+                         "\x77\xb0\xe2\x75\xc0\xf1\x98\xd9"
+                         "\x80\x55\xc9\x34\x91\xd1\x59\xe8"
+                         "\x4b\x0f\xc1\xa9\x4b\x7a\x84\x06"
+                         "\x20\xa8\x5d\xfa\xd1\xde\x70\x56"
+                         "\x2f\x9e\x91\x9c\x20\xb3\x24\xd8"
+                         "\x84\x3d\xe1\x8c\x7e\x62\x52\xe5"
+                         "\x44\x4b\x9f\xc2\x93\x03\xea\x2b"
+                         "\x59\xc5\xfa\x3f\x91\x2b\xbb\x23"
+                         "\xf5\xb2\x7b\xf5\x38\xaf\xb3\xee"
+                         "\x63\xdc\x7b\xd1\xff\xaa\x8b\xab"
+                         "\x82\x6b\x37\x04\xeb\x74\xbe\x79"
+                         "\xb9\x83\x90\xef\x20\x59\x46\xff"
+                         "\xe9\x97\x3e\x2f\xee\xb6\x64\x18"
+                         "\x38\x4c\x7a\x4a\xf9\x61\xe8\x9a"
+                         "\xa1\xb5\x01\xa6\x47\xd3\x11\xd4"
+                         "\xce\xd3\x91\x49\x88\xc7\xb8\x4d"
+                         "\xb1\xb9\x07\x6d\x16\x72\xae\x46"
+                         "\x5e\x03\xa1\x4b\xb6\x02\x30\xa8"
+                         "\x3d\xa9\x07\x2a\x7c\x19\xe7\x62"
+                         "\x87\xe3\x82\x2f\x6f\xe1\x09\xd9"
+                         "\x94\x97\xea\xdd\x58\x9e\xae\x76"
+                         "\x7e\x35\xe5\xb4\xda\x7e\xf4\xde"
+                         "\xf7\x32\x87\xcd\x93\xbf\x11\x56"
+                         "\x11\xbe\x08\x74\xe1\x69\xad\xe2"
+                         "\xd7\xf8\x86\x75\x8a\x3c\xa4\xbe"
+                         "\x70\xa7\x1b\xfc\x0b\x44\x2a\x76"
+                         "\x35\xea\x5d\x85\x81\xaf\x85\xeb"
+                         "\xa0\x1c\x61\xc2\xf7\x4f\xa5\xdc"
+                         "\x02\x7f\xf6\x95\x40\x6e\x8a\x9a"
+                         "\xf3\x5d\x25\x6e\x14\x3a\x22\xc9"
+                         "\x37\x1c\xeb\x46\x54\x3f\xa5\x91"
+                         "\xc2\xb5\x8c\xfe\x53\x08\x97\x32"
+                         "\x1b\xb2\x30\x27\xfe\x25\x5d\xdc"
+                         "\x08\x87\xd0\xe5\x94\x1a\xd4\xf1"
+                         "\xfe\xd6\xb4\xa3\xe6\x74\x81\x3c"
+                         "\x1b\xb7\x31\xa7\x22\xfd\xd4\xdd"
+                         "\x20\x4e\x7c\x51\xb0\x60\x73\xb8"
+                         "\x9c\xac\x91\x90\x7e\x01\xb0\xe1"
+                         "\x8a\x2f\x75\x1c\x53\x2a\x98\x2a"
+                         "\x06\x52\x95\x52\xb2\xe9\x25\x2e"
+                         "\x4c\xe2\x5a\x00\xb2\x13\x81\x03"
+                         "\x77\x66\x0d\xa5\x99\xda\x4e\x8c"
+                         "\xac\xf3\x13\x53\x27\x45\xaf\x64"
+                         "\x46\xdc\xea\x23\xda\x97\xd1\xab"
+                         "\x7d\x6c\x30\x96\x1f\xbc\x06\x34"
+                         "\x18\x0b\x5e\x21\x35\x11\x8d\x4c"
+                         "\xe0\x2d\xe9\x50\x16\x74\x81\xa8"
+                         "\xb4\x34\xb9\x72\x42\xa6\xcc\xbc"
+                         "\xca\x34\x83\x27\x10\x5b\x68\x45"
+                         "\x8f\x52\x22\x0c\x55\x3d\x29\x7c"
+                         "\xe3\xc0\x66\x05\x42\x91\x5f\x58"
+                         "\xfe\x4a\x62\xd9\x8c\xa9\x04\x19"
+                         "\x04\xa9\x08\x4b\x57\xfc\x67\x53"
+                         "\x08\x7c\xbc\x66\x8a\xb0\xb6\x9f"
+                         "\x92\xd6\x41\x7c\x5b\x2a\x00\x79"
+                         "\x72",
+               .ctext  = "\x3a\x92\xee\x53\x31\xaf\x2b\x60"
+                         "\x5f\x55\x8d\x00\x5d\xfc\x74\x97"
+                         "\x28\x54\xf4\xa5\x75\xf1\x9b\x25"
+                         "\x62\x1c\xc0\xe0\x13\xc8\x87\x53"
+                         "\xd0\xf3\xa7\x97\x1f\x3b\x1e\xea"
+                         "\xe0\xe5\x2a\xd1\xdd\xa4\x3b\x50"
+                         "\x45\xa3\x0d\x7e\x1b\xc9\xa0\xad"
+                         "\xb9\x2c\x54\xa6\xc7\x55\x16\xd0"
+                         "\xc5\x2e\x02\x44\x35\xd0\x7e\x67"
+                         "\xf2\xc4\x9b\xcd\x95\x10\xcc\x29"
+                         "\x4b\xfa\x86\x87\xbe\x40\x36\xbe"
+                         "\xe1\xa3\x52\x89\x55\x20\x9b\xc2"
+                         "\xab\xf2\x31\x34\x16\xad\xc8\x17"
+                         "\x65\x24\xc0\xff\x12\x37\xfe\x5a"
+                         "\x62\x3b\x59\x47\x6c\x5f\x3a\x8e"
+                         "\x3b\xd9\x30\xc8\x7f\x2f\x88\xda"
+                         "\x80\xfd\x02\xda\x7f\x9a\x7a\x73"
+                         "\x59\xc5\x34\x09\x9a\x11\xcb\xa7"
+                         "\xfc\xf6\xa1\xa0\x60\xfb\x43\xbb"
+                         "\xf1\xe9\xd7\xc6\x79\x27\x4e\xff"
+                         "\x22\xb4\x24\xbf\x76\xee\x47\xb9"
+                         "\x6d\x3f\x8b\xb0\x9c\x3c\x43\xdd"
+                         "\xff\x25\x2e\x6d\xa4\x2b\xfb\x5d"
+                         "\x1b\x97\x6c\x55\x0a\x82\x7a\x7b"
+                         "\x94\x34\xc2\xdb\x2f\x1f\xc1\xea"
+                         "\xd4\x4d\x17\x46\x3b\x51\x69\x09"
+                         "\xe4\x99\x32\x25\xfd\x94\xaf\xfb"
+                         "\x10\xf7\x4f\xdd\x0b\x3c\x8b\x41"
+                         "\xb3\x6a\xb7\xd1\x33\xa8\x0c\x2f"
+                         "\x62\x4c\x72\x11\xd7\x74\xe1\x3b"
+                         "\x38\x43\x66\x7b\x6c\x36\x48\xe7"
+                         "\xe3\xe7\x9d\xb9\x42\x73\x7a\x2a"
+                         "\x89\x20\x1a\x41\x80\x03\xf7\x8f"
+                         "\x61\x78\x13\xbf\xfe\x50\xf5\x04"
+                         "\x52\xf9\xac\x47\xf8\x62\x4b\xb2"
+                         "\x24\xa9\xbf\x64\xb0\x18\x69\xd2"
+                         "\xf5\xe4\xce\xc8\xb1\x87\x75\xd6"
+                         "\x2c\x24\x79\x00\x7d\x26\xfb\x44"
+                         "\xe7\x45\x7a\xee\x58\xa5\x83\xc1"
+                         "\xb4\x24\xab\x23\x2f\x4d\xd7\x4f"
+                         "\x1c\xc7\xaa\xa9\x50\xf4\xa3\x07"
+                         "\x12\x13\x89\x74\xdc\x31\x6a\xb2"
+                         "\xf5\x0f\x13\x8b\xb9\xdb\x85\x1f"
+                         "\xf5\xbc\x88\xd9\x95\xea\x31\x6c"
+                         "\x36\x60\xb6\x49\xdc\xc4\xf7\x55"
+                         "\x3f\x21\xc1\xb5\x92\x18\x5e\xbc"
+                         "\x9f\x87\x7f\xe7\x79\x25\x40\x33"
+                         "\xd6\xb9\x33\xd5\x50\xb3\xc7\x89"
+                         "\x1b\x12\xa0\x46\xdd\xa7\xd8\x3e"
+                         "\x71\xeb\x6f\x66\xa1\x26\x0c\x67"
+                         "\xab\xb2\x38\x58\x17\xd8\x44\x3b"
+                         "\x16\xf0\x8e\x62\x8d\x16\x10\x00"
+                         "\x32\x8b\xef\xb9\x28\xd3\xc5\xad"
+                         "\x0a\x19\xa2\xe4\x03\x27\x7d\x94"
+                         "\x06\x18\xcd\xd6\x27\x00\xf9\x1f"
+                         "\xb6\xb3\xfe\x96\x35\x5f\xc4\x1c"
+                         "\x07\x62\x10\x79\x68\x50\xf1\x7e"
+                         "\x29\xe7\xc4\xc4\xe7\xee\x54\xd6"
+                         "\x58\x76\x84\x6d\x8d\xe4\x59\x31"
+                         "\xe9\xf4\xdc\xa1\x1f\xe5\x1a\xd6"
+                         "\xe6\x64\x46\xf5\x77\x9c\x60\x7a"
+                         "\x5e\x62\xe3\x0a\xd4\x9f\x7a\x2d"
+                         "\x7a\xa5\x0a\x7b\x29\x86\x7a\x74"
+                         "\x74\x71\x6b\xca\x7d\x1d\xaa\xba"
+                         "\x39\x84\x43\x76\x35\xfe\x4f\x9b"
+                         "\xbb\xbb\xb5\x6a\x32\xb5\x5d\x41"
+                         "\x51\xf0\x5b\x68\x03\x47\x4b\x8a"
+                         "\xca\x88\xf6\x37\xbd\x73\x51\x70"
+                         "\x66\xfe\x9e\x5f\x21\x9c\xf3\xdd"
+                         "\xc3\xea\x27\xf9\x64\x94\xe1\x19"
+                         "\xa0\xa9\xab\x60\xe0\x0e\xf7\x78"
+                         "\x70\x86\xeb\xe0\xd1\x5c\x05\xd3"
+                         "\xd7\xca\xe0\xc0\x47\x47\x34\xee"
+                         "\x11\xa3\xa3\x54\x98\xb7\x49\x8e"
+                         "\x84\x28\x70\x2c\x9e\xfb\x55\x54"
+                         "\x4d\xf8\x86\xf7\x85\x7c\xbd\xf3"
+                         "\x17\xd8\x47\xcb\xac\xf4\x20\x85"
+                         "\x34\x66\xad\x37\x2d\x5e\x52\xda"
+                         "\x8a\xfe\x98\x55\x30\xe7\x2d\x2b"
+                         "\x19\x10\x8e\x7b\x66\x5e\xdc\xe0"
+                         "\x45\x1f\x7b\xb4\x08\xfb\x8f\xf6"
+                         "\x8c\x89\x21\x34\x55\x27\xb2\x76"
+                         "\xb2\x07\xd9\xd6\x68\x9b\xea\x6b"
+                         "\x2d\xb4\xc4\x35\xdd\xd2\x79\xae"
+                         "\xc7\xd6\x26\x7f\x12\x01\x8c\xa7"
+                         "\xe3\xdb\xa8\xf4\xf7\x2b\xec\x99"
+                         "\x11\x00\xf1\x35\x8c\xcf\xd5\xc9"
+                         "\xbd\x91\x36\x39\x70\xcf\x7d\x70"
+                         "\x47\x1a\xfc\x6b\x56\xe0\x3f\x9c"
+                         "\x60\x49\x01\x72\xa9\xaf\x2c\x9c"
+                         "\xe8\xab\xda\x8c\x14\x19\xf3\x75"
+                         "\x07\x17\x9d\x44\x67\x7a\x2e\xef"
+                         "\xb7\x83\x35\x4a\xd1\x3d\x1c\x84"
+                         "\x32\xdd\xaa\xea\xca\x1d\xdc\x72"
+                         "\x2c\xcc\x43\xcd\x5d\xe3\x21\xa4"
+                         "\xd0\x8a\x4b\x20\x12\xa3\xd5\x86"
+                         "\x76\x96\xff\x5f\x04\x57\x0f\xe6"
+                         "\xba\xe8\x76\x50\x0c\x64\x1d\x83"
+                         "\x9c\x9b\x9a\x9a\x58\x97\x9c\x5c"
+                         "\xb4\xa4\xa6\x3e\x19\xeb\x8f\x5a"
+                         "\x61\xb2\x03\x7b\x35\x19\xbe\xa7"
+                         "\x63\x0c\xfd\xdd\xf9\x90\x6c\x08"
+                         "\x19\x11\xd3\x65\x4a\xf5\x96\x92"
+                         "\x59\xaa\x9c\x61\x0c\x29\xa7\xf8"
+                         "\x14\x39\x37\xbf\x3c\xf2\x16\x72"
+                         "\x02\xfa\xa2\xf3\x18\x67\x5d\xcb"
+                         "\xdc\x4d\xbb\x96\xff\x70\x08\x2d"
+                         "\xc2\xa8\x52\xe1\x34\x5f\x72\xfe"
+                         "\x64\xbf\xca\xa7\x74\x38\xfb\x74"
+                         "\x55\x9c\xfa\x8a\xed\xfb\x98\xeb"
+                         "\x58\x2e\x6c\xe1\x52\x76\x86\xd7"
+                         "\xcf\xa1\xa4\xfc\xb2\x47\x41\x28"
+                         "\xa3\xc1\xe5\xfd\x53\x19\x28\x2b"
+                         "\x37\x04\x65\x96\x99\x7a\x28\x0f"
+                         "\x07\x68\x4b\xc7\x52\x0a\x55\x35"
+                         "\x40\x19\x95\x61\xe8\x59\x40\x1f"
+                         "\x9d\xbf\x78\x7d\x8f\x84\xff\x6f"
+                         "\xd0\xd5\x63\xd2\x22\xbd\xc8\x4e"
+                         "\xfb\xe7\x9f\x06\xe6\xe7\x39\x6d"
+                         "\x6a\x96\x9f\xf0\x74\x7e\xc9\x35"
+                         "\xb7\x26\xb8\x1c\x0a\xa6\x27\x2c"
+                         "\xa2\x2b\xfe\xbe\x0f\x07\x73\xae"
+                         "\x7f\x7f\x54\xf5\x7c\x6a\x0a\x56"
+                         "\x49\xd4\x81\xe5\x85\x53\x99\x1f"
+                         "\x95\x05\x13\x58\x8d\x0e\x1b\x90"
+                         "\xc3\x75\x48\x64\x58\x98\x67\x84"
+                         "\xae\xe2\x21\xa2\x8a\x04\x0a\x0b"
+                         "\x61\xaa\xb0\xd4\x28\x60\x7a\xf8"
+                         "\xbc\x52\xfb\x24\x7f\xed\x0d\x2a"
+                         "\x0a\xb2\xf9\xc6\x95\xb5\x11\xc9"
+                         "\xf4\x0f\x26\x11\xcf\x2a\x57\x87"
+                         "\x7a\xf3\xe7\x94\x65\xc2\xb5\xb3"
+                         "\xab\x98\xe3\xc1\x2b\x59\x19\x7c"
+                         "\xd6\xf3\xf9\xbf\xff\x6d\xc6\x82"
+                         "\x13\x2f\x4a\x2e\xcd\x26\xfe\x2d"
+                         "\x01\x70\xf4\xc2\x7f\x1f\x4c\xcb"
+                         "\x47\x77\x0c\xa0\xa3\x03\xec\xda"
+                         "\xa9\xbf\x0d\x2d\xae\xe4\xb8\x7b"
+                         "\xa9\xbc\x08\xb4\x68\x2e\xc5\x60"
+                         "\x8d\x87\x41\x2b\x0f\x69\xf0\xaf"
+                         "\x5f\xba\x72\x20\x0f\x33\xcd\x6d"
+                         "\x36\x7d\x7b\xd5\x05\xf1\x4b\x05"
+                         "\xc4\xfc\x7f\x80\xb9\x4d\xbd\xf7"
+                         "\x7c\x84\x07\x01\xc2\x40\x66\x5b"
+                         "\x98\xc7\x2c\xe3\x97\xfa\xdf\x87"
+                         "\xa0\x1f\xe9\x21\x42\x0f\x3b\xeb"
+                         "\x89\x1c\x3b\xca\x83\x61\x77\x68"
+                         "\x84\xbb\x60\x87\x38\x2e\x25\xd5"
+                         "\x9e\x04\x41\x70\xac\xda\xc0\x9c"
+                         "\x9c\x69\xea\x8d\x4e\x55\x2a\x29"
+                         "\xed\x05\x4b\x7b\x73\x71\x90\x59"
+                         "\x4d\xc8\xd8\x44\xf0\x4c\xe1\x5e"
+                         "\x84\x47\x55\xcc\x32\x3f\xe7\x97"
+                         "\x42\xc6\x32\xac\x40\xe5\xa5\xc7"
+                         "\x8b\xed\xdb\xf7\x83\xd6\xb1\xc2"
+                         "\x52\x5e\x34\xb7\xeb\x6e\xd9\xfc"
+                         "\xe5\x93\x9a\x97\x3e\xb0\xdc\xd9"
+                         "\xd7\x06\x10\xb6\x1d\x80\x59\xdd"
+                         "\x0d\xfe\x64\x35\xcd\x5d\xec\xf0"
+                         "\xba\xd0\x34\xc9\x2d\x91\xc5\x17"
+                         "\x11",
+               .len    = 1281,
+               .also_non_np = 1,
+               .np     = 3,
+               .tap    = { 1200, 1, 80 },
+       },
+};
+
 /*
  * CTS (Cipher Text Stealing) mode tests
  */

include/crypto/chacha20.h +13 -2

index fbec4e6a87890..6290d997060ec 100644
@@ -1,6 +1,10 @@
 /* SPDX-License-Identifier: GPL-2.0 */
 /*
- * Common values for the ChaCha20 algorithm
+ * Common values and helper functions for the ChaCha20 and XChaCha20 algorithms.
+ *
+ * XChaCha20 extends ChaCha20's nonce to 192 bits, while provably retaining
+ * ChaCha20's security.  Here they share the same key size, tfm context, and
+ * setkey function; only their IV size and encrypt/decrypt function differ.
  */
 
 #ifndef _CRYPTO_CHACHA20_H

@@ -10,10 +14,15 @@
 #include <linux/types.h>
 #include <linux/crypto.h>
 
+/* 32-bit stream position, then 96-bit nonce (RFC7539 convention) */
 #define CHACHA20_IV_SIZE       16
+
 #define CHACHA20_KEY_SIZE      32
 #define CHACHA20_BLOCK_SIZE    64
 
+/* 192-bit nonce, then 64-bit stream position */
+#define XCHACHA20_IV_SIZE      32
+
 struct chacha20_ctx {
        u32 key[8];
 };

@@ -22,8 +31,11 @@ void chacha20_block(u32 *state, u8 *stream);
 void hchacha20_block(const u32 *in, u32 *out);
 
 void crypto_chacha20_init(u32 *state, struct chacha20_ctx *ctx, u8 *iv);
+
 int crypto_chacha20_setkey(struct crypto_skcipher *tfm, const u8 *key,
                           unsigned int keysize);
+
 int crypto_chacha20_crypt(struct skcipher_request *req);
+int crypto_xchacha20_crypt(struct skcipher_request *req);
 
 #endif
--

2.19.1.331.ge82ca0e54c-goog

From: Eric Biggers <[email protected]>

In preparation for adding XChaCha12 support, rename/refactor chacha20-generic to support different numbers of rounds. The justification for needing XChaCha12 support is explained in more detail in the patch "crypto: chacha - add XChaCha12 support".

The only difference between ChaCha{8,12,20} are the number of rounds itself; all other parts of the algorithm are the same. Therefore, remove the "20" from all definitions, structures, functions, files, etc. that will be shared by all ChaCha versions.

Also make ->setkey() store the round count in the chacha_ctx (previously chacha20_ctx). The generic code then passes the round count through to chacha_block(). There will be a ->setkey() function for each explicitly allowed round count; the encrypt/decrypt functions will be the same. I decided not to do it the opposite way (same ->setkey() function for all round counts, with different encrypt/decrypt functions) because that would have required more boilerplate code in architecture-specific implementations of ChaCha and XChaCha.

To be as careful as possible, we whitelist the allowed round counts in the low-level generic code. Currently only 20 is allowed, i.e. no actual use of other variants is introduced by this patch.

Signed-off-by Eric Biggers <[email protected]>

---
 arch/arm/crypto/chacha20-neon-glue.c          |  40 +++----
 arch/arm64/crypto/chacha20-neon-glue.c        |  40 +++----
 arch/x86/crypto/chacha20_glue.c               |  52 ++++-----
 crypto/Makefile                               |   2 +-
 crypto/chacha20poly1305.c                     |  10 +-
 .../{chacha20_generic.c => chacha_generic.c}  | 110 ++++++++++--------
 drivers/char/random.c                         |  51 ++++----
 include/crypto/chacha.h                       |  46 ++++++++
 include/crypto/chacha20.h                     |  41 -------
 lib/Makefile                                  |   2 +-
 lib/{chacha20.c => chacha.c}                  |  43 ++++---
 11 files changed, 227 insertions(+), 210 deletions(-)
 rename crypto/{chacha20_generic.c => chacha_generic.c} (57%)
 create mode 100644 include/crypto/chacha.h
 delete mode 100644 include/crypto/chacha20.h
 rename lib/{chacha20.c => chacha.c} (67%)

arch/arm/crypto/chacha20-neon-glue.c +20 -20

index 59a7be08e80ce..7386eb1c1889d 100644
@@ -19,7 +19,7 @@
  */
 
 #include <crypto/algapi.h>
-#include <crypto/chacha20.h>
+#include <crypto/chacha.h>
 #include <crypto/internal/skcipher.h>
 #include <linux/kernel.h>
 #include <linux/module.h>

@@ -34,20 +34,20 @@ asmlinkage void chacha20_4block_xor_neon(u32 *state, u8 *dst, const u8 *src);
 static void chacha20_doneon(u32 *state, u8 *dst, const u8 *src,
                            unsigned int bytes)
 {
-       u8 buf[CHACHA20_BLOCK_SIZE];
+       u8 buf[CHACHA_BLOCK_SIZE];
 
-       while (bytes >= CHACHA20_BLOCK_SIZE * 4) {
+       while (bytes >= CHACHA_BLOCK_SIZE * 4) {
                chacha20_4block_xor_neon(state, dst, src);
-               bytes -= CHACHA20_BLOCK_SIZE * 4;
-               src += CHACHA20_BLOCK_SIZE * 4;
-               dst += CHACHA20_BLOCK_SIZE * 4;
+               bytes -= CHACHA_BLOCK_SIZE * 4;
+               src += CHACHA_BLOCK_SIZE * 4;
+               dst += CHACHA_BLOCK_SIZE * 4;
                state[12] += 4;
        }
-       while (bytes >= CHACHA20_BLOCK_SIZE) {
+       while (bytes >= CHACHA_BLOCK_SIZE) {
                chacha20_block_xor_neon(state, dst, src);
-               bytes -= CHACHA20_BLOCK_SIZE;
-               src += CHACHA20_BLOCK_SIZE;
-               dst += CHACHA20_BLOCK_SIZE;
+               bytes -= CHACHA_BLOCK_SIZE;
+               src += CHACHA_BLOCK_SIZE;
+               dst += CHACHA_BLOCK_SIZE;
                state[12]++;
        }
        if (bytes) {

@@ -60,17 +60,17 @@ static void chacha20_doneon(u32 *state, u8 *dst, const u8 *src,
 static int chacha20_neon(struct skcipher_request *req)
 {
        struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
-       struct chacha20_ctx *ctx = crypto_skcipher_ctx(tfm);
+       struct chacha_ctx *ctx = crypto_skcipher_ctx(tfm);
        struct skcipher_walk walk;
        u32 state[16];
        int err;
 
-       if (req->cryptlen <= CHACHA20_BLOCK_SIZE || !may_use_simd())
-               return crypto_chacha20_crypt(req);
+       if (req->cryptlen <= CHACHA_BLOCK_SIZE || !may_use_simd())
+               return crypto_chacha_crypt(req);
 
        err = skcipher_walk_virt(&walk, req, true);
 
-       crypto_chacha20_init(state, ctx, walk.iv);
+       crypto_chacha_init(state, ctx, walk.iv);
 
        kernel_neon_begin();
        while (walk.nbytes > 0) {

@@ -93,14 +93,14 @@ static struct skcipher_alg alg = {
        .base.cra_driver_name   = "chacha20-neon",
        .base.cra_priority      = 300,
        .base.cra_blocksize     = 1,
-       .base.cra_ctxsize       = sizeof(struct chacha20_ctx),
+       .base.cra_ctxsize       = sizeof(struct chacha_ctx),
        .base.cra_module        = THIS_MODULE,
 
-       .min_keysize            = CHACHA20_KEY_SIZE,
-       .max_keysize            = CHACHA20_KEY_SIZE,
-       .ivsize                 = CHACHA20_IV_SIZE,
-       .chunksize              = CHACHA20_BLOCK_SIZE,
-       .walksize               = 4 * CHACHA20_BLOCK_SIZE,
+       .min_keysize            = CHACHA_KEY_SIZE,
+       .max_keysize            = CHACHA_KEY_SIZE,
+       .ivsize                 = CHACHA_IV_SIZE,
+       .chunksize              = CHACHA_BLOCK_SIZE,
+       .walksize               = 4 * CHACHA_BLOCK_SIZE,
        .setkey                 = crypto_chacha20_setkey,
        .encrypt                = chacha20_neon,
        .decrypt                = chacha20_neon,

arch/arm64/crypto/chacha20-neon-glue.c +20 -20

index 727579c93dedb..96e0cfb8c3f5b 100644
@@ -19,7 +19,7 @@
  */
 
 #include <crypto/algapi.h>
-#include <crypto/chacha20.h>
+#include <crypto/chacha.h>
 #include <crypto/internal/skcipher.h>
 #include <linux/kernel.h>
 #include <linux/module.h>

@@ -34,15 +34,15 @@ asmlinkage void chacha20_4block_xor_neon(u32 *state, u8 *dst, const u8 *src);
 static void chacha20_doneon(u32 *state, u8 *dst, const u8 *src,
                            unsigned int bytes)
 {
-       u8 buf[CHACHA20_BLOCK_SIZE];
+       u8 buf[CHACHA_BLOCK_SIZE];
 
-       while (bytes >= CHACHA20_BLOCK_SIZE * 4) {
+       while (bytes >= CHACHA_BLOCK_SIZE * 4) {
                kernel_neon_begin();
                chacha20_4block_xor_neon(state, dst, src);
                kernel_neon_end();
-               bytes -= CHACHA20_BLOCK_SIZE * 4;
-               src += CHACHA20_BLOCK_SIZE * 4;
-               dst += CHACHA20_BLOCK_SIZE * 4;
+               bytes -= CHACHA_BLOCK_SIZE * 4;
+               src += CHACHA_BLOCK_SIZE * 4;
+               dst += CHACHA_BLOCK_SIZE * 4;
                state[12] += 4;
        }
 

@@ -50,11 +50,11 @@ static void chacha20_doneon(u32 *state, u8 *dst, const u8 *src,
                return;
 
        kernel_neon_begin();
-       while (bytes >= CHACHA20_BLOCK_SIZE) {
+       while (bytes >= CHACHA_BLOCK_SIZE) {
                chacha20_block_xor_neon(state, dst, src);
-               bytes -= CHACHA20_BLOCK_SIZE;
-               src += CHACHA20_BLOCK_SIZE;
-               dst += CHACHA20_BLOCK_SIZE;
+               bytes -= CHACHA_BLOCK_SIZE;
+               src += CHACHA_BLOCK_SIZE;
+               dst += CHACHA_BLOCK_SIZE;
                state[12]++;
        }
        if (bytes) {

@@ -68,17 +68,17 @@ static void chacha20_doneon(u32 *state, u8 *dst, const u8 *src,
 static int chacha20_neon(struct skcipher_request *req)
 {
        struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
-       struct chacha20_ctx *ctx = crypto_skcipher_ctx(tfm);
+       struct chacha_ctx *ctx = crypto_skcipher_ctx(tfm);
        struct skcipher_walk walk;
        u32 state[16];
        int err;
 
-       if (!may_use_simd() || req->cryptlen <= CHACHA20_BLOCK_SIZE)
-               return crypto_chacha20_crypt(req);
+       if (!may_use_simd() || req->cryptlen <= CHACHA_BLOCK_SIZE)
+               return crypto_chacha_crypt(req);
 
        err = skcipher_walk_virt(&walk, req, false);
 
-       crypto_chacha20_init(state, ctx, walk.iv);
+       crypto_chacha_init(state, ctx, walk.iv);
 
        while (walk.nbytes > 0) {
                unsigned int nbytes = walk.nbytes;

@@ -99,14 +99,14 @@ static struct skcipher_alg alg = {
        .base.cra_driver_name   = "chacha20-neon",
        .base.cra_priority      = 300,
        .base.cra_blocksize     = 1,
-       .base.cra_ctxsize       = sizeof(struct chacha20_ctx),
+       .base.cra_ctxsize       = sizeof(struct chacha_ctx),
        .base.cra_module        = THIS_MODULE,
 
-       .min_keysize            = CHACHA20_KEY_SIZE,
-       .max_keysize            = CHACHA20_KEY_SIZE,
-       .ivsize                 = CHACHA20_IV_SIZE,
-       .chunksize              = CHACHA20_BLOCK_SIZE,
-       .walksize               = 4 * CHACHA20_BLOCK_SIZE,
+       .min_keysize            = CHACHA_KEY_SIZE,
+       .max_keysize            = CHACHA_KEY_SIZE,
+       .ivsize                 = CHACHA_IV_SIZE,
+       .chunksize              = CHACHA_BLOCK_SIZE,
+       .walksize               = 4 * CHACHA_BLOCK_SIZE,
        .setkey                 = crypto_chacha20_setkey,
        .encrypt                = chacha20_neon,
        .decrypt                = chacha20_neon,

arch/x86/crypto/chacha20_glue.c +26 -26

index dce7c5d39c2f2..bd249f0b29dc2 100644
@@ -10,7 +10,7 @@
  */
 
 #include <crypto/algapi.h>
-#include <crypto/chacha20.h>
+#include <crypto/chacha.h>
 #include <crypto/internal/skcipher.h>
 #include <linux/kernel.h>
 #include <linux/module.h>

@@ -29,31 +29,31 @@ static bool chacha20_use_avx2;
 static void chacha20_dosimd(u32 *state, u8 *dst, const u8 *src,
                            unsigned int bytes)
 {
-       u8 buf[CHACHA20_BLOCK_SIZE];
+       u8 buf[CHACHA_BLOCK_SIZE];
 
 #ifdef CONFIG_AS_AVX2
        if (chacha20_use_avx2) {
-               while (bytes >= CHACHA20_BLOCK_SIZE * 8) {
+               while (bytes >= CHACHA_BLOCK_SIZE * 8) {
                        chacha20_8block_xor_avx2(state, dst, src);
-                       bytes -= CHACHA20_BLOCK_SIZE * 8;
-                       src += CHACHA20_BLOCK_SIZE * 8;
-                       dst += CHACHA20_BLOCK_SIZE * 8;
+                       bytes -= CHACHA_BLOCK_SIZE * 8;
+                       src += CHACHA_BLOCK_SIZE * 8;
+                       dst += CHACHA_BLOCK_SIZE * 8;
                        state[12] += 8;
                }
        }
 #endif
-       while (bytes >= CHACHA20_BLOCK_SIZE * 4) {
+       while (bytes >= CHACHA_BLOCK_SIZE * 4) {
                chacha20_4block_xor_ssse3(state, dst, src);
-               bytes -= CHACHA20_BLOCK_SIZE * 4;
-               src += CHACHA20_BLOCK_SIZE * 4;
-               dst += CHACHA20_BLOCK_SIZE * 4;
+               bytes -= CHACHA_BLOCK_SIZE * 4;
+               src += CHACHA_BLOCK_SIZE * 4;
+               dst += CHACHA_BLOCK_SIZE * 4;
                state[12] += 4;
        }
-       while (bytes >= CHACHA20_BLOCK_SIZE) {
+       while (bytes >= CHACHA_BLOCK_SIZE) {
                chacha20_block_xor_ssse3(state, dst, src);
-               bytes -= CHACHA20_BLOCK_SIZE;
-               src += CHACHA20_BLOCK_SIZE;
-               dst += CHACHA20_BLOCK_SIZE;
+               bytes -= CHACHA_BLOCK_SIZE;
+               src += CHACHA_BLOCK_SIZE;
+               dst += CHACHA_BLOCK_SIZE;
                state[12]++;
        }
        if (bytes) {

@@ -66,7 +66,7 @@ static void chacha20_dosimd(u32 *state, u8 *dst, const u8 *src,
 static int chacha20_simd(struct skcipher_request *req)
 {
        struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
-       struct chacha20_ctx *ctx = crypto_skcipher_ctx(tfm);
+       struct chacha_ctx *ctx = crypto_skcipher_ctx(tfm);
        u32 *state, state_buf[16 + 2] __aligned(8);
        struct skcipher_walk walk;
        int err;

@@ -74,20 +74,20 @@ static int chacha20_simd(struct skcipher_request *req)
        BUILD_BUG_ON(CHACHA20_STATE_ALIGN != 16);
        state = PTR_ALIGN(state_buf + 0, CHACHA20_STATE_ALIGN);
 
-       if (req->cryptlen <= CHACHA20_BLOCK_SIZE || !may_use_simd())
-               return crypto_chacha20_crypt(req);
+       if (req->cryptlen <= CHACHA_BLOCK_SIZE || !may_use_simd())
+               return crypto_chacha_crypt(req);
 
        err = skcipher_walk_virt(&walk, req, true);
 
-       crypto_chacha20_init(state, ctx, walk.iv);
+       crypto_chacha_init(state, ctx, walk.iv);
 
        kernel_fpu_begin();
 
-       while (walk.nbytes >= CHACHA20_BLOCK_SIZE) {
+       while (walk.nbytes >= CHACHA_BLOCK_SIZE) {
                chacha20_dosimd(state, walk.dst.virt.addr, walk.src.virt.addr,
-                               rounddown(walk.nbytes, CHACHA20_BLOCK_SIZE));
+                               rounddown(walk.nbytes, CHACHA_BLOCK_SIZE));
                err = skcipher_walk_done(&walk,
-                                        walk.nbytes % CHACHA20_BLOCK_SIZE);
+                                        walk.nbytes % CHACHA_BLOCK_SIZE);
        }
 
        if (walk.nbytes) {

@@ -106,13 +106,13 @@ static struct skcipher_alg alg = {
        .base.cra_driver_name   = "chacha20-simd",
        .base.cra_priority      = 300,
        .base.cra_blocksize     = 1,
-       .base.cra_ctxsize       = sizeof(struct chacha20_ctx),
+       .base.cra_ctxsize       = sizeof(struct chacha_ctx),
        .base.cra_module        = THIS_MODULE,
 
-       .min_keysize            = CHACHA20_KEY_SIZE,
-       .max_keysize            = CHACHA20_KEY_SIZE,
-       .ivsize                 = CHACHA20_IV_SIZE,
-       .chunksize              = CHACHA20_BLOCK_SIZE,
+       .min_keysize            = CHACHA_KEY_SIZE,
+       .max_keysize            = CHACHA_KEY_SIZE,
+       .ivsize                 = CHACHA_IV_SIZE,
+       .chunksize              = CHACHA_BLOCK_SIZE,
        .setkey                 = crypto_chacha20_setkey,
        .encrypt                = chacha20_simd,
        .decrypt                = chacha20_simd,

crypto/Makefile +1 -1

index 5c207c76abf7e..7e673f7c71107 100644
@@ -116,7 +116,7 @@ obj-$(CONFIG_CRYPTO_KHAZAD) += khazad.o
 obj-$(CONFIG_CRYPTO_ANUBIS) += anubis.o
 obj-$(CONFIG_CRYPTO_SEED) += seed.o
 obj-$(CONFIG_CRYPTO_SALSA20) += salsa20_generic.o
-obj-$(CONFIG_CRYPTO_CHACHA20) += chacha20_generic.o
+obj-$(CONFIG_CRYPTO_CHACHA20) += chacha_generic.o
 obj-$(CONFIG_CRYPTO_POLY1305) += poly1305_generic.o
 obj-$(CONFIG_CRYPTO_DEFLATE) += deflate.o
 obj-$(CONFIG_CRYPTO_MICHAEL_MIC) += michael_mic.o

crypto/chacha20poly1305.c +5 -5

index 600afa99941fe..573c07e6f189e 100644
@@ -13,7 +13,7 @@
 #include <crypto/internal/hash.h>
 #include <crypto/internal/skcipher.h>
 #include <crypto/scatterwalk.h>
-#include <crypto/chacha20.h>
+#include <crypto/chacha.h>
 #include <crypto/poly1305.h>
 #include <linux/err.h>
 #include <linux/init.h>

@@ -51,7 +51,7 @@ struct poly_req {
 };
 
 struct chacha_req {
-       u8 iv[CHACHA20_IV_SIZE];
+       u8 iv[CHACHA_IV_SIZE];
        struct scatterlist src[1];
        struct skcipher_request req; /* must be last member */
 };

@@ -91,7 +91,7 @@ static void chacha_iv(u8 *iv, struct aead_request *req, u32 icb)
        memcpy(iv, &leicb, sizeof(leicb));
        memcpy(iv + sizeof(leicb), ctx->salt, ctx->saltlen);
        memcpy(iv + sizeof(leicb) + ctx->saltlen, req->iv,
-              CHACHA20_IV_SIZE - sizeof(leicb) - ctx->saltlen);
+              CHACHA_IV_SIZE - sizeof(leicb) - ctx->saltlen);
 }
 
 static int poly_verify_tag(struct aead_request *req)

@@ -494,7 +494,7 @@ static int chachapoly_setkey(struct crypto_aead *aead, const u8 *key,
        struct chachapoly_ctx *ctx = crypto_aead_ctx(aead);
        int err;
 
-       if (keylen != ctx->saltlen + CHACHA20_KEY_SIZE)
+       if (keylen != ctx->saltlen + CHACHA_KEY_SIZE)
                return -EINVAL;
 
        keylen -= ctx->saltlen;

@@ -639,7 +639,7 @@ static int chachapoly_create(struct crypto_template *tmpl, struct rtattr **tb,
 
        err = -EINVAL;
        /* Need 16-byte IV size, including Initial Block Counter value */
-       if (crypto_skcipher_alg_ivsize(chacha) != CHACHA20_IV_SIZE)
+       if (crypto_skcipher_alg_ivsize(chacha) != CHACHA_IV_SIZE)
                goto out_drop_chacha;
        /* Not a stream cipher? */
        if (chacha->base.cra_blocksize != 1)

crypto/chacha_generic.c renamed from crypto/chacha20_generic.c +59 -51

similarity index 57%
rename from crypto/chacha20_generic.c
rename to crypto/chacha_generic.c
index 07902fe37aeb8..8e25e9930c549 100644
@@ -12,33 +12,33 @@
 
 #include <asm/unaligned.h>
 #include <crypto/algapi.h>
-#include <crypto/chacha20.h>
+#include <crypto/chacha.h>
 #include <crypto/internal/skcipher.h>
 #include <linux/module.h>
 
-static void chacha20_docrypt(u32 *state, u8 *dst, const u8 *src,
-                            unsigned int bytes)
+static void chacha_docrypt(u32 *state, u8 *dst, const u8 *src,
+                          unsigned int bytes, int nrounds)
 {
        /* aligned to potentially speed up crypto_xor() */
-       u8 stream[CHACHA20_BLOCK_SIZE] __aligned(sizeof(long));
+       u8 stream[CHACHA_BLOCK_SIZE] __aligned(sizeof(long));
 
        if (dst != src)
                memcpy(dst, src, bytes);
 
-       while (bytes >= CHACHA20_BLOCK_SIZE) {
-               chacha20_block(state, stream);
-               crypto_xor(dst, stream, CHACHA20_BLOCK_SIZE);
-               bytes -= CHACHA20_BLOCK_SIZE;
-               dst += CHACHA20_BLOCK_SIZE;
+       while (bytes >= CHACHA_BLOCK_SIZE) {
+               chacha_block(state, stream, nrounds);
+               crypto_xor(dst, stream, CHACHA_BLOCK_SIZE);
+               bytes -= CHACHA_BLOCK_SIZE;
+               dst += CHACHA_BLOCK_SIZE;
        }
        if (bytes) {
-               chacha20_block(state, stream);
+               chacha_block(state, stream, nrounds);
                crypto_xor(dst, stream, bytes);
        }
 }
 
-static int chacha20_stream_xor(struct skcipher_request *req,
-                              struct chacha20_ctx *ctx, u8 *iv)
+static int chacha_stream_xor(struct skcipher_request *req,
+                            struct chacha_ctx *ctx, u8 *iv)
 {
        struct skcipher_walk walk;
        u32 state[16];

@@ -46,7 +46,7 @@ static int chacha20_stream_xor(struct skcipher_request *req,
 
        err = skcipher_walk_virt(&walk, req, true);
 
-       crypto_chacha20_init(state, ctx, iv);
+       crypto_chacha_init(state, ctx, iv);
 
        while (walk.nbytes > 0) {
                unsigned int nbytes = walk.nbytes;

@@ -54,15 +54,15 @@ static int chacha20_stream_xor(struct skcipher_request *req,
                if (nbytes < walk.total)
                        nbytes = round_down(nbytes, walk.stride);
 
-               chacha20_docrypt(state, walk.dst.virt.addr, walk.src.virt.addr,
-                                nbytes);
+               chacha_docrypt(state, walk.dst.virt.addr, walk.src.virt.addr,
+                              nbytes, ctx->nrounds);
                err = skcipher_walk_done(&walk, walk.nbytes - nbytes);
        }
 
        return err;
 }
 
-void crypto_chacha20_init(u32 *state, struct chacha20_ctx *ctx, u8 *iv)
+void crypto_chacha_init(u32 *state, struct chacha_ctx *ctx, u8 *iv)
 {
        state[0]  = 0x61707865; /* "expa" */
        state[1]  = 0x3320646e; /* "nd 3" */

@@ -81,53 +81,61 @@ void crypto_chacha20_init(u32 *state, struct chacha20_ctx *ctx, u8 *iv)
        state[14] = get_unaligned_le32(iv +  8);
        state[15] = get_unaligned_le32(iv + 12);
 }
-EXPORT_SYMBOL_GPL(crypto_chacha20_init);
+EXPORT_SYMBOL_GPL(crypto_chacha_init);
 
-int crypto_chacha20_setkey(struct crypto_skcipher *tfm, const u8 *key,
-                          unsigned int keysize)
+static int chacha_setkey(struct crypto_skcipher *tfm, const u8 *key,
+                        unsigned int keysize, int nrounds)
 {
-       struct chacha20_ctx *ctx = crypto_skcipher_ctx(tfm);
+       struct chacha_ctx *ctx = crypto_skcipher_ctx(tfm);
        int i;
 
-       if (keysize != CHACHA20_KEY_SIZE)
+       if (keysize != CHACHA_KEY_SIZE)
                return -EINVAL;
 
        for (i = 0; i < ARRAY_SIZE(ctx->key); i++)
                ctx->key[i] = get_unaligned_le32(key + i * sizeof(u32));
 
+       ctx->nrounds = nrounds;
        return 0;
 }
+
+int crypto_chacha20_setkey(struct crypto_skcipher *tfm, const u8 *key,
+                          unsigned int keysize)
+{
+       return chacha_setkey(tfm, key, keysize, 20);
+}
 EXPORT_SYMBOL_GPL(crypto_chacha20_setkey);
 
-int crypto_chacha20_crypt(struct skcipher_request *req)
+int crypto_chacha_crypt(struct skcipher_request *req)
 {
        struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
-       struct chacha20_ctx *ctx = crypto_skcipher_ctx(tfm);
+       struct chacha_ctx *ctx = crypto_skcipher_ctx(tfm);
 
-       return chacha20_stream_xor(req, ctx, req->iv);
+       return chacha_stream_xor(req, ctx, req->iv);
 }
-EXPORT_SYMBOL_GPL(crypto_chacha20_crypt);
+EXPORT_SYMBOL_GPL(crypto_chacha_crypt);
 
-int crypto_xchacha20_crypt(struct skcipher_request *req)
+int crypto_xchacha_crypt(struct skcipher_request *req)
 {
        struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
-       struct chacha20_ctx *ctx = crypto_skcipher_ctx(tfm);
-       struct chacha20_ctx subctx;
+       struct chacha_ctx *ctx = crypto_skcipher_ctx(tfm);
+       struct chacha_ctx subctx;
        u32 state[16];
        u8 real_iv[16];
 
        /* Compute the subkey given the original key and first 128 nonce bits */
-       crypto_chacha20_init(state, ctx, req->iv);
-       hchacha20_block(state, subctx.key);
+       crypto_chacha_init(state, ctx, req->iv);
+       hchacha_block(state, subctx.key, ctx->nrounds);
+       subctx.nrounds = ctx->nrounds;
 
        /* Build the real IV */
        memcpy(&real_iv[0], req->iv + 24, 8); /* stream position */
        memcpy(&real_iv[8], req->iv + 16, 8); /* remaining 64 nonce bits */
 
        /* Generate the stream and XOR it with the data */
-       return chacha20_stream_xor(req, &subctx, real_iv);
+       return chacha_stream_xor(req, &subctx, real_iv);
 }
-EXPORT_SYMBOL_GPL(crypto_xchacha20_crypt);
+EXPORT_SYMBOL_GPL(crypto_xchacha_crypt);
 
 static struct skcipher_alg algs[] = {
        {

@@ -135,50 +143,50 @@ static struct skcipher_alg algs[] = {
                .base.cra_driver_name   = "chacha20-generic",
                .base.cra_priority      = 100,
                .base.cra_blocksize     = 1,
-               .base.cra_ctxsize       = sizeof(struct chacha20_ctx),
+               .base.cra_ctxsize       = sizeof(struct chacha_ctx),
                .base.cra_module        = THIS_MODULE,
 
-               .min_keysize            = CHACHA20_KEY_SIZE,
-               .max_keysize            = CHACHA20_KEY_SIZE,
-               .ivsize                 = CHACHA20_IV_SIZE,
-               .chunksize              = CHACHA20_BLOCK_SIZE,
+               .min_keysize            = CHACHA_KEY_SIZE,
+               .max_keysize            = CHACHA_KEY_SIZE,
+               .ivsize                 = CHACHA_IV_SIZE,
+               .chunksize              = CHACHA_BLOCK_SIZE,
                .setkey                 = crypto_chacha20_setkey,
-               .encrypt                = crypto_chacha20_crypt,
-               .decrypt                = crypto_chacha20_crypt,
+               .encrypt                = crypto_chacha_crypt,
+               .decrypt                = crypto_chacha_crypt,
        }, {
                .base.cra_name          = "xchacha20",
                .base.cra_driver_name   = "xchacha20-generic",
                .base.cra_priority      = 100,
                .base.cra_blocksize     = 1,
-               .base.cra_ctxsize       = sizeof(struct chacha20_ctx),
+               .base.cra_ctxsize       = sizeof(struct chacha_ctx),
                .base.cra_module        = THIS_MODULE,
 
-               .min_keysize            = CHACHA20_KEY_SIZE,
-               .max_keysize            = CHACHA20_KEY_SIZE,
-               .ivsize                 = XCHACHA20_IV_SIZE,
-               .chunksize              = CHACHA20_BLOCK_SIZE,
+               .min_keysize            = CHACHA_KEY_SIZE,
+               .max_keysize            = CHACHA_KEY_SIZE,
+               .ivsize                 = XCHACHA_IV_SIZE,
+               .chunksize              = CHACHA_BLOCK_SIZE,
                .setkey                 = crypto_chacha20_setkey,
-               .encrypt                = crypto_xchacha20_crypt,
-               .decrypt                = crypto_xchacha20_crypt,
+               .encrypt                = crypto_xchacha_crypt,
+               .decrypt                = crypto_xchacha_crypt,
        }
 };
 
-static int __init chacha20_generic_mod_init(void)
+static int __init chacha_generic_mod_init(void)
 {
        return crypto_register_skciphers(algs, ARRAY_SIZE(algs));
 }
 
-static void __exit chacha20_generic_mod_fini(void)
+static void __exit chacha_generic_mod_fini(void)
 {
        crypto_unregister_skciphers(algs, ARRAY_SIZE(algs));
 }
 
-module_init(chacha20_generic_mod_init);
-module_exit(chacha20_generic_mod_fini);
+module_init(chacha_generic_mod_init);
+module_exit(chacha_generic_mod_fini);
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Martin Willi <[email protected]>");
-MODULE_DESCRIPTION("ChaCha20 and XChaCha20 stream ciphers (generic)");
+MODULE_DESCRIPTION("ChaCha and XChaCha stream ciphers (generic)");
 MODULE_ALIAS_CRYPTO("chacha20");
 MODULE_ALIAS_CRYPTO("chacha20-generic");
 MODULE_ALIAS_CRYPTO("xchacha20");

drivers/char/random.c +25 -26

index d22d967c50f0a..5f47c4c8b9b15 100644
@@ -265,7 +265,7 @@
 #include <linux/syscalls.h>
 #include <linux/completion.h>
 #include <linux/uuid.h>
-#include <crypto/chacha20.h>
+#include <crypto/chacha.h>
 
 #include <asm/processor.h>
 #include <linux/uaccess.h>

@@ -431,11 +431,10 @@ static int crng_init = 0;
 #define crng_ready() (likely(crng_init > 1))
 static int crng_init_cnt = 0;
 static unsigned long crng_global_init_time = 0;
-#define CRNG_INIT_CNT_THRESH (2*CHACHA20_KEY_SIZE)
-static void _extract_crng(struct crng_state *crng,
-                         __u8 out[CHACHA20_BLOCK_SIZE]);
+#define CRNG_INIT_CNT_THRESH (2*CHACHA_KEY_SIZE)
+static void _extract_crng(struct crng_state *crng, __u8 out[CHACHA_BLOCK_SIZE]);
 static void _crng_backtrack_protect(struct crng_state *crng,
-                                   __u8 tmp[CHACHA20_BLOCK_SIZE], int used);
+                                   __u8 tmp[CHACHA_BLOCK_SIZE], int used);
 static void process_random_ready_list(void);
 static void _get_random_bytes(void *buf, int nbytes);
 

@@ -858,7 +857,7 @@ static int crng_fast_load(const char *cp, size_t len)
        }
        p = (unsigned char *) &primary_crng.state[4];
        while (len > 0 && crng_init_cnt < CRNG_INIT_CNT_THRESH) {
-               p[crng_init_cnt % CHACHA20_KEY_SIZE] ^= *cp;
+               p[crng_init_cnt % CHACHA_KEY_SIZE] ^= *cp;
                cp++; crng_init_cnt++; len--;
        }
        spin_unlock_irqrestore(&primary_crng.lock, flags);

@@ -890,7 +889,7 @@ static int crng_slow_load(const char *cp, size_t len)
        unsigned long           flags;
        static unsigned char    lfsr = 1;
        unsigned char           tmp;
-       unsigned                i, max = CHACHA20_KEY_SIZE;
+       unsigned                i, max = CHACHA_KEY_SIZE;
        const char *            src_buf = cp;
        char *                  dest_buf = (char *) &primary_crng.state[4];
 

@@ -908,8 +907,8 @@ static int crng_slow_load(const char *cp, size_t len)
                lfsr >>= 1;
                if (tmp & 1)
                        lfsr ^= 0xE1;
-               tmp = dest_buf[i % CHACHA20_KEY_SIZE];
-               dest_buf[i % CHACHA20_KEY_SIZE] ^= src_buf[i % len] ^ lfsr;
+               tmp = dest_buf[i % CHACHA_KEY_SIZE];
+               dest_buf[i % CHACHA_KEY_SIZE] ^= src_buf[i % len] ^ lfsr;
                lfsr += (tmp << 3) | (tmp >> 5);
        }
        spin_unlock_irqrestore(&primary_crng.lock, flags);

@@ -921,7 +920,7 @@ static void crng_reseed(struct crng_state *crng, struct entropy_store *r)
        unsigned long   flags;
        int             i, num;
        union {
-               __u8    block[CHACHA20_BLOCK_SIZE];
+               __u8    block[CHACHA_BLOCK_SIZE];
                __u32   key[8];
        } buf;
 

@@ -932,7 +931,7 @@ static void crng_reseed(struct crng_state *crng, struct entropy_store *r)
        } else {
                _extract_crng(&primary_crng, buf.block);
                _crng_backtrack_protect(&primary_crng, buf.block,
-                                       CHACHA20_KEY_SIZE);
+                                       CHACHA_KEY_SIZE);
        }
        spin_lock_irqsave(&crng->lock, flags);
        for (i = 0; i < 8; i++) {

@@ -968,7 +967,7 @@ static void crng_reseed(struct crng_state *crng, struct entropy_store *r)
 }
 
 static void _extract_crng(struct crng_state *crng,
-                         __u8 out[CHACHA20_BLOCK_SIZE])
+                         __u8 out[CHACHA_BLOCK_SIZE])
 {
        unsigned long v, flags;
 

@@ -985,7 +984,7 @@ static void _extract_crng(struct crng_state *crng,
        spin_unlock_irqrestore(&crng->lock, flags);
 }
 
-static void extract_crng(__u8 out[CHACHA20_BLOCK_SIZE])
+static void extract_crng(__u8 out[CHACHA_BLOCK_SIZE])
 {
        struct crng_state *crng = NULL;
 

@@ -1003,14 +1002,14 @@ static void extract_crng(__u8 out[CHACHA20_BLOCK_SIZE])
  * enough) to mutate the CRNG key to provide backtracking protection.
  */
 static void _crng_backtrack_protect(struct crng_state *crng,
-                                   __u8 tmp[CHACHA20_BLOCK_SIZE], int used)
+                                   __u8 tmp[CHACHA_BLOCK_SIZE], int used)
 {
        unsigned long   flags;
        __u32           *s, *d;
        int             i;
 
        used = round_up(used, sizeof(__u32));
-       if (used + CHACHA20_KEY_SIZE > CHACHA20_BLOCK_SIZE) {
+       if (used + CHACHA_KEY_SIZE > CHACHA_BLOCK_SIZE) {
                extract_crng(tmp);
                used = 0;
        }

@@ -1022,7 +1021,7 @@ static void _crng_backtrack_protect(struct crng_state *crng,
        spin_unlock_irqrestore(&crng->lock, flags);
 }
 
-static void crng_backtrack_protect(__u8 tmp[CHACHA20_BLOCK_SIZE], int used)
+static void crng_backtrack_protect(__u8 tmp[CHACHA_BLOCK_SIZE], int used)
 {
        struct crng_state *crng = NULL;
 

@@ -1037,8 +1036,8 @@ static void crng_backtrack_protect(__u8 tmp[CHACHA20_BLOCK_SIZE], int used)
 
 static ssize_t extract_crng_user(void __user *buf, size_t nbytes)
 {
-       ssize_t ret = 0, i = CHACHA20_BLOCK_SIZE;
-       __u8 tmp[CHACHA20_BLOCK_SIZE] __aligned(4);
+       ssize_t ret = 0, i = CHACHA_BLOCK_SIZE;
+       __u8 tmp[CHACHA_BLOCK_SIZE] __aligned(4);
        int large_request = (nbytes > 256);
 
        while (nbytes) {

@@ -1052,7 +1051,7 @@ static ssize_t extract_crng_user(void __user *buf, size_t nbytes)
                }
 
                extract_crng(tmp);
-               i = min_t(int, nbytes, CHACHA20_BLOCK_SIZE);
+               i = min_t(int, nbytes, CHACHA_BLOCK_SIZE);
                if (copy_to_user(buf, tmp, i)) {
                        ret = -EFAULT;
                        break;

@@ -1617,14 +1616,14 @@ static void _warn_unseeded_randomness(const char *func_name, void *caller,
  */
 static void _get_random_bytes(void *buf, int nbytes)
 {
-       __u8 tmp[CHACHA20_BLOCK_SIZE] __aligned(4);
+       __u8 tmp[CHACHA_BLOCK_SIZE] __aligned(4);
 
        trace_get_random_bytes(nbytes, _RET_IP_);
 
-       while (nbytes >= CHACHA20_BLOCK_SIZE) {
+       while (nbytes >= CHACHA_BLOCK_SIZE) {
                extract_crng(buf);
-               buf += CHACHA20_BLOCK_SIZE;
-               nbytes -= CHACHA20_BLOCK_SIZE;
+               buf += CHACHA_BLOCK_SIZE;
+               nbytes -= CHACHA_BLOCK_SIZE;
        }
 
        if (nbytes > 0) {

@@ -1632,7 +1631,7 @@ static void _get_random_bytes(void *buf, int nbytes)
                memcpy(buf, tmp, nbytes);
                crng_backtrack_protect(tmp, nbytes);
        } else
-               crng_backtrack_protect(tmp, CHACHA20_BLOCK_SIZE);
+               crng_backtrack_protect(tmp, CHACHA_BLOCK_SIZE);
        memzero_explicit(tmp, sizeof(tmp));
 }
 

@@ -2203,8 +2202,8 @@ struct ctl_table random_table[] = {
 
 struct batched_entropy {
        union {
-               u64 entropy_u64[CHACHA20_BLOCK_SIZE / sizeof(u64)];
-               u32 entropy_u32[CHACHA20_BLOCK_SIZE / sizeof(u32)];
+               u64 entropy_u64[CHACHA_BLOCK_SIZE / sizeof(u64)];
+               u32 entropy_u32[CHACHA_BLOCK_SIZE / sizeof(u32)];
        };
        unsigned int position;
 };

include/crypto/chacha.h new file +46 -0

new file mode 100644
index 0000000000000..ae79e9983c72f
@@ -0,0 +1,46 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Common values and helper functions for the ChaCha and XChaCha stream ciphers.
+ *
+ * XChaCha extends ChaCha's nonce to 192 bits, while provably retaining ChaCha's
+ * security.  Here they share the same key size, tfm context, and setkey
+ * function; only their IV size and encrypt/decrypt function differ.
+ */
+
+#ifndef _CRYPTO_CHACHA_H
+#define _CRYPTO_CHACHA_H
+
+#include <crypto/skcipher.h>
+#include <linux/types.h>
+#include <linux/crypto.h>
+
+/* 32-bit stream position, then 96-bit nonce (RFC7539 convention) */
+#define CHACHA_IV_SIZE         16
+
+#define CHACHA_KEY_SIZE                32
+#define CHACHA_BLOCK_SIZE      64
+
+/* 192-bit nonce, then 64-bit stream position */
+#define XCHACHA_IV_SIZE                32
+
+struct chacha_ctx {
+       u32 key[8];
+       int nrounds;
+};
+
+void chacha_block(u32 *state, u8 *stream, int nrounds);
+static inline void chacha20_block(u32 *state, u8 *stream)
+{
+       chacha_block(state, stream, 20);
+}
+void hchacha_block(const u32 *in, u32 *out, int nrounds);
+
+void crypto_chacha_init(u32 *state, struct chacha_ctx *ctx, u8 *iv);
+
+int crypto_chacha20_setkey(struct crypto_skcipher *tfm, const u8 *key,
+                          unsigned int keysize);
+
+int crypto_chacha_crypt(struct skcipher_request *req);
+int crypto_xchacha_crypt(struct skcipher_request *req);
+
+#endif /* _CRYPTO_CHACHA_H */

include/crypto/chacha20.h deleted +0 -41

deleted file mode 100644
index 6290d997060ec..0000000000000
@@ -1,41 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/*
- * Common values and helper functions for the ChaCha20 and XChaCha20 algorithms.
- *
- * XChaCha20 extends ChaCha20's nonce to 192 bits, while provably retaining
- * ChaCha20's security.  Here they share the same key size, tfm context, and
- * setkey function; only their IV size and encrypt/decrypt function differ.
- */
-
-#ifndef _CRYPTO_CHACHA20_H
-#define _CRYPTO_CHACHA20_H
-
-#include <crypto/skcipher.h>
-#include <linux/types.h>
-#include <linux/crypto.h>
-
-/* 32-bit stream position, then 96-bit nonce (RFC7539 convention) */
-#define CHACHA20_IV_SIZE       16
-
-#define CHACHA20_KEY_SIZE      32
-#define CHACHA20_BLOCK_SIZE    64
-
-/* 192-bit nonce, then 64-bit stream position */
-#define XCHACHA20_IV_SIZE      32
-
-struct chacha20_ctx {
-       u32 key[8];
-};
-
-void chacha20_block(u32 *state, u8 *stream);
-void hchacha20_block(const u32 *in, u32 *out);
-
-void crypto_chacha20_init(u32 *state, struct chacha20_ctx *ctx, u8 *iv);
-
-int crypto_chacha20_setkey(struct crypto_skcipher *tfm, const u8 *key,
-                          unsigned int keysize);
-
-int crypto_chacha20_crypt(struct skcipher_request *req);
-int crypto_xchacha20_crypt(struct skcipher_request *req);
-
-#endif

lib/Makefile +1 -1

index ca3f7ebb900d8..9a5f0b7a48891 100644
@@ -20,7 +20,7 @@ KCOV_INSTRUMENT_dynamic_debug.o := n
 lib-y := ctype.o string.o vsprintf.o cmdline.o \
         rbtree.o radix-tree.o timerqueue.o\
         idr.o int_sqrt.o extable.o \
-        sha1.o chacha20.o irq_regs.o argv_split.o \
+        sha1.o chacha.o irq_regs.o argv_split.o \
         flex_proportions.o ratelimit.o show_mem.o \
         is_single_threaded.o plist.o decompress.o kobject_uevent.o \
         earlycpio.o seq_buf.o siphash.o dec_and_lock.o \

lib/chacha.c renamed from lib/chacha20.c +24 -20

similarity index 67%
rename from lib/chacha20.c
rename to lib/chacha.c
index 6a484e16171d1..0a2c2e5b7b84d 100644
@@ -1,5 +1,5 @@
 /*
- * The "hash function" used as the core of the ChaCha20 stream cipher (RFC7539)
+ * The "hash function" used as the core of the ChaCha stream cipher (RFC7539)
  *
  * Copyright (C) 2015 Martin Willi
  *

@@ -14,13 +14,16 @@
 #include <linux/bitops.h>
 #include <linux/cryptohash.h>
 #include <asm/unaligned.h>
-#include <crypto/chacha20.h>
+#include <crypto/chacha.h>
 
-static void chacha20_permute(u32 *x)
+static void chacha_permute(u32 *x, int nrounds)
 {
        int i;
 
-       for (i = 0; i < 20; i += 2) {
+       /* whitelist the allowed round counts */
+       BUG_ON(nrounds != 20);
+
+       for (i = 0; i < nrounds; i += 2) {
                x[0]  += x[4];    x[12] = rol32(x[12] ^ x[0],  16);
                x[1]  += x[5];    x[13] = rol32(x[13] ^ x[1],  16);
                x[2]  += x[6];    x[14] = rol32(x[14] ^ x[2],  16);

@@ -64,49 +67,51 @@ static void chacha20_permute(u32 *x)
 }
 
 /**
- * chacha20_block - generate one keystream block and increment block counter
+ * chacha_block - generate one keystream block and increment block counter
  * @state: input state matrix (16 32-bit words)
  * @stream: output keystream block (64 bytes)
+ * @nrounds: number of rounds (currently must be 20)
  *
- * This is the ChaCha20 core, a function from 64-byte strings to 64-byte
- * strings.  The caller has already converted the endianness of the input.  This
- * function also handles incrementing the block counter in the input matrix.
+ * This is the ChaCha core, a function from 64-byte strings to 64-byte strings.
+ * The caller has already converted the endianness of the input.  This function
+ * also handles incrementing the block counter in the input matrix.
  */
-void chacha20_block(u32 *state, u8 *stream)
+void chacha_block(u32 *state, u8 *stream, int nrounds)
 {
        u32 x[16];
        int i;
 
        memcpy(x, state, 64);
 
-       chacha20_permute(x);
+       chacha_permute(x, nrounds);
 
        for (i = 0; i < ARRAY_SIZE(x); i++)
                put_unaligned_le32(x[i] + state[i], &stream[i * sizeof(u32)]);
 
        state[12]++;
 }
-EXPORT_SYMBOL(chacha20_block);
+EXPORT_SYMBOL(chacha_block);
 
 /**
- * hchacha20_block - abbreviated ChaCha20 core, for XChaCha20
+ * hchacha_block - abbreviated ChaCha core, for XChaCha
  * @in: input state matrix (16 32-bit words)
  * @out: output (8 32-bit words)
+ * @nrounds: number of rounds (currently must be 20)
  *
- * HChaCha20 is the ChaCha equivalent of HSalsa20 and is an intermediate step
- * towards XChaCha20 (see https://cr.yp.to/snuffle/xsalsa-20081128.pdf).
- * HChaCha20 skips the final addition of the initial state, and outputs only
- * certain words of the state.  It should not be used for streaming directly.
+ * HChaCha is the ChaCha equivalent of HSalsa and is an intermediate step
+ * towards XChaCha (see https://cr.yp.to/snuffle/xsalsa-20081128.pdf).  HChaCha
+ * skips the final addition of the initial state, and outputs only certain words
+ * of the state.  It should not be used for streaming directly.
  */
-void hchacha20_block(const u32 *in, u32 *out)
+void hchacha_block(const u32 *in, u32 *out, int nrounds)
 {
        u32 x[16];
 
        memcpy(x, in, 64);
 
-       chacha20_permute(x);
+       chacha_permute(x, nrounds);
 
        memcpy(&out[0], &x[0], 16);
        memcpy(&out[4], &x[12], 16);
 }
-EXPORT_SYMBOL(hchacha20_block);
+EXPORT_SYMBOL(hchacha_block);
--

2.19.1.331.ge82ca0e54c-goog

From: Eric Biggers <[email protected]>

Now that the generic implementation of ChaCha20 has been refactored to allow varying the number of rounds, add support for XChaCha12, which is the XSalsa construction applied to ChaCha12. ChaCha12 is one of the three ciphers specified by the original ChaCha paper
(https://cr.yp.to/chacha/chacha-20080128.pdf: "ChaCha, a variant of Salsa20"), alongside ChaCha8 and ChaCha20. ChaCha12 is faster than ChaCha20 but has a lower, but still large, security margin.

We need XChaCha12 support so that it can be used in the Adiantum encryption mode, which enables disk/file encryption on low-end mobile devices where AES-XTS is too slow as the CPUs lack AES instructions.

We'd prefer XChaCha20 (the more popular variant), but it's too slow on some of our target devices, so at least in some cases we do need the XChaCha12-based version. In more detail, the problem is that Adiantum is still much slower than we're happy with, and encryption still has a quite noticeable effect on the feel of low-end devices. Users and vendors push back hard against encryption that degrades the user experience, which always risks encryption being disabled entirely. So we need to choose the fastest option that gives us a solid margin of security, and here that's XChaCha12. The best known attack on ChaCha breaks only 7 rounds and has 2^235 time complexity, so ChaCha12's security margin is still better than AES-256's. Much has been learned about cryptanalysis of ARX ciphers since Salsa20 was originally designed in 2005, and it now seems we can be comfortable with a smaller number of rounds. The eSTREAM project also suggests the 12-round version of Salsa20 as providing the best balance among the different variants:
combining very good performance with a "comfortable margin of security".

Note that it would be trivial to add vanilla ChaCha12 in addition to XChaCha12. However, it's unneeded for now and therefore is omitted.

As discussed in the patch that introduced XChaCha20 support, I considered splitting the code into separate chacha-common, chacha20, xchacha20, and xchacha12 modules, so that these algorithms could be enabled/disabled independently. However, since nearly all the code is shared anyway, I ultimately decided there would have been little benefit to the added complexity.

Signed-off-by Eric Biggers <[email protected]>

---
 crypto/Kconfig          |   8 +-
 crypto/chacha_generic.c |  26 +-
 crypto/testmgr.c        |   6 +
 crypto/testmgr.h        | 578 ++++++++++++++++++++++++++++++++++++++++
 include/crypto/chacha.h |   7 +
 lib/chacha.c            |   6 +-
 6 files changed, 625 insertions(+), 6 deletions(-)

crypto/Kconfig +6 -2

index d9acbce23d4d5..4fa0a4a0e8615 100644
@@ -1387,10 +1387,10 @@ config CRYPTO_SALSA20
          Bernstein <[email protected]>. See <http://cr.yp.to/snuffle.html>
 
 config CRYPTO_CHACHA20
-       tristate "ChaCha20 stream cipher algorithms"
+       tristate "ChaCha stream cipher algorithms"
        select CRYPTO_BLKCIPHER
        help
-         The ChaCha20 and XChaCha20 stream cipher algorithms.
+         The ChaCha20, XChaCha20, and XChaCha12 stream cipher algorithms.
 
          ChaCha20 is a 256-bit high-speed stream cipher designed by Daniel J.
          Bernstein and further specified in RFC7539 for use in IETF protocols.

@@ -1403,6 +1403,10 @@ config CRYPTO_CHACHA20
          while provably retaining ChaCha20's security.  See also:
          <https://cr.yp.to/snuffle/xsalsa-20081128.pdf>
 
+         XChaCha12 is XChaCha20 reduced to 12 rounds, with correspondingly
+         reduced security margin but increased performance.  It can be needed
+         in some performance-sensitive scenarios.
+
 config CRYPTO_CHACHA20_X86_64
        tristate "ChaCha20 cipher algorithm (x86_64/SSSE3/AVX2)"
        depends on X86 && 64BIT

crypto/chacha_generic.c +25 -1

index 8e25e9930c549..8f8f84e51f334 100644
@@ -1,5 +1,5 @@
 /*
- * ChaCha20 (RFC7539) and XChaCha20 stream cipher algorithms
+ * ChaCha and XChaCha stream ciphers, including ChaCha20 (RFC7539)
  *
  * Copyright (C) 2015 Martin Willi
  * Copyright (C) 2018 Google LLC

@@ -106,6 +106,13 @@ int crypto_chacha20_setkey(struct crypto_skcipher *tfm, const u8 *key,
 }
 EXPORT_SYMBOL_GPL(crypto_chacha20_setkey);
 
+int crypto_chacha12_setkey(struct crypto_skcipher *tfm, const u8 *key,
+                          unsigned int keysize)
+{
+       return chacha_setkey(tfm, key, keysize, 12);
+}
+EXPORT_SYMBOL_GPL(crypto_chacha12_setkey);
+
 int crypto_chacha_crypt(struct skcipher_request *req)
 {
        struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);

@@ -168,6 +175,21 @@ static struct skcipher_alg algs[] = {
                .setkey                 = crypto_chacha20_setkey,
                .encrypt                = crypto_xchacha_crypt,
                .decrypt                = crypto_xchacha_crypt,
+       }, {
+               .base.cra_name          = "xchacha12",
+               .base.cra_driver_name   = "xchacha12-generic",
+               .base.cra_priority      = 100,
+               .base.cra_blocksize     = 1,
+               .base.cra_ctxsize       = sizeof(struct chacha_ctx),
+               .base.cra_module        = THIS_MODULE,
+
+               .min_keysize            = CHACHA_KEY_SIZE,
+               .max_keysize            = CHACHA_KEY_SIZE,
+               .ivsize                 = XCHACHA_IV_SIZE,
+               .chunksize              = CHACHA_BLOCK_SIZE,
+               .setkey                 = crypto_chacha12_setkey,
+               .encrypt                = crypto_xchacha_crypt,
+               .decrypt                = crypto_xchacha_crypt,
        }
 };
 

@@ -191,3 +213,5 @@ MODULE_ALIAS_CRYPTO("chacha20");
 MODULE_ALIAS_CRYPTO("chacha20-generic");
 MODULE_ALIAS_CRYPTO("xchacha20");
 MODULE_ALIAS_CRYPTO("xchacha20-generic");
+MODULE_ALIAS_CRYPTO("xchacha12");
+MODULE_ALIAS_CRYPTO("xchacha12-generic");

crypto/testmgr.c +6 -0

index a5512e69c8f31..3ff70ebc745cb 100644
@@ -3544,6 +3544,12 @@ static const struct alg_test_desc alg_test_descs[] = {
                .suite = {
                        .hash = __VECS(aes_xcbc128_tv_template)
                }
+       }, {
+               .alg = "xchacha12",
+               .test = alg_test_skcipher,
+               .suite = {
+                       .cipher = __VECS(xchacha12_tv_template)
+               },
        }, {
                .alg = "xchacha20",
                .test = alg_test_skcipher,

crypto/testmgr.h +578 -0

index 371641c73cf8c..3b57b2701fcb2 100644
@@ -31379,6 +31379,584 @@ static const struct cipher_testvec xchacha20_tv_template[] = {
        },
 };
 
+/*
+ * Same as XChaCha20 test vectors above, but recomputed the ciphertext with
+ * XChaCha12, using a modified libsodium.
+ */
+static const struct cipher_testvec xchacha12_tv_template[] = {
+       {
+               .key    = "\x79\xc9\x97\x98\xac\x67\x30\x0b"
+                         "\xbb\x27\x04\xc9\x5c\x34\x1e\x32"
+                         "\x45\xf3\xdc\xb2\x17\x61\xb9\x8e"
+                         "\x52\xff\x45\xb2\x4f\x30\x4f\xc4",
+               .klen   = 32,
+               .iv     = "\xb3\x3f\xfd\x30\x96\x47\x9b\xcf"
+                         "\xbc\x9a\xee\x49\x41\x76\x88\xa0"
+                         "\xa2\x55\x4f\x8d\x95\x38\x94\x19"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00",
+               .ptext  = "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00",
+               .ctext  = "\x1b\x78\x7f\xd7\xa1\x41\x68\xab"
+                         "\x3d\x3f\xd1\x7b\x69\x56\xb2\xd5"
+                         "\x43\xce\xeb\xaf\x36\xf0\x29\x9d"
+                         "\x3a\xfb\x18\xae\x1b",
+               .len    = 29,
+       }, {
+               .key    = "\x9d\x23\xbd\x41\x49\xcb\x97\x9c"
+                         "\xcf\x3c\x5c\x94\xdd\x21\x7e\x98"
+                         "\x08\xcb\x0e\x50\xcd\x0f\x67\x81"
+                         "\x22\x35\xea\xaf\x60\x1d\x62\x32",
+               .klen   = 32,
+               .iv     = "\xc0\x47\x54\x82\x66\xb7\xc3\x70"
+                         "\xd3\x35\x66\xa2\x42\x5c\xbf\x30"
+                         "\xd8\x2d\x1e\xaf\x52\x94\x10\x9e"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00",
+               .ptext  = "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00",
+               .ctext  = "\xfb\x32\x09\x1d\x83\x05\xae\x4c"
+                         "\x13\x1f\x12\x71\xf2\xca\xb2\xeb"
+                         "\x5b\x83\x14\x7d\x83\xf6\x57\x77"
+                         "\x2e\x40\x1f\x92\x2c\xf9\xec\x35"
+                         "\x34\x1f\x93\xdf\xfb\x30\xd7\x35"
+                         "\x03\x05\x78\xc1\x20\x3b\x7a\xe3"
+                         "\x62\xa3\x89\xdc\x11\x11\x45\xa8"
+                         "\x82\x89\xa0\xf1\x4e\xc7\x0f\x11"
+                         "\x69\xdd\x0c\x84\x2b\x89\x5c\xdc"
+                         "\xf0\xde\x01\xef\xc5\x65\x79\x23"
+                         "\x87\x67\xd6\x50\xd9\x8d\xd9\x92"
+                         "\x54\x5b\x0e",
+               .len    = 91,
+       }, {
+               .key    = "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00",
+               .klen   = 32,
+               .iv     = "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x67\xc6\x69\x73"
+                         "\x51\xff\x4a\xec\x29\xcd\xba\xab"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00",
+               .ptext  = "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00",
+               .ctext  = "\xdf\x2d\xc6\x21\x2a\x9d\xa1\xbb"
+                         "\xc2\x77\x66\x0c\x5c\x46\xef\xa7"
+                         "\x79\x1b\xb9\xdf\x55\xe2\xf9\x61"
+                         "\x4c\x7b\xa4\x52\x24\xaf\xa2\xda"
+                         "\xd1\x8f\x8f\xa2\x9e\x53\x4d\xc4"
+                         "\xb8\x55\x98\x08\x7c\x08\xd4\x18"
+                         "\x67\x8f\xef\x50\xb1\x5f\xa5\x77"
+                         "\x4c\x25\xe7\x86\x26\x42\xca\x44",
+               .len    = 64,
+       }, {
+               .key    = "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x00\x00\x00\x00\x01",
+               .klen   = 32,
+               .iv     = "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x02\xf2\xfb\xe3\x46"
+                         "\x7c\xc2\x54\xf8\x1b\xe8\xe7\x8d"
+                         "\x01\x00\x00\x00\x00\x00\x00\x00",
+               .ptext  = "\x41\x6e\x79\x20\x73\x75\x62\x6d"
+                         "\x69\x73\x73\x69\x6f\x6e\x20\x74"
+                         "\x6f\x20\x74\x68\x65\x20\x49\x45"
+                         "\x54\x46\x20\x69\x6e\x74\x65\x6e"
+                         "\x64\x65\x64\x20\x62\x79\x20\x74"
+                         "\x68\x65\x20\x43\x6f\x6e\x74\x72"
+                         "\x69\x62\x75\x74\x6f\x72\x20\x66"
+                         "\x6f\x72\x20\x70\x75\x62\x6c\x69"
+                         "\x63\x61\x74\x69\x6f\x6e\x20\x61"
+                         "\x73\x20\x61\x6c\x6c\x20\x6f\x72"
+                         "\x20\x70\x61\x72\x74\x20\x6f\x66"
+                         "\x20\x61\x6e\x20\x49\x45\x54\x46"
+                         "\x20\x49\x6e\x74\x65\x72\x6e\x65"
+                         "\x74\x2d\x44\x72\x61\x66\x74\x20"
+                         "\x6f\x72\x20\x52\x46\x43\x20\x61"
+                         "\x6e\x64\x20\x61\x6e\x79\x20\x73"
+                         "\x74\x61\x74\x65\x6d\x65\x6e\x74"
+                         "\x20\x6d\x61\x64\x65\x20\x77\x69"
+                         "\x74\x68\x69\x6e\x20\x74\x68\x65"
+                         "\x20\x63\x6f\x6e\x74\x65\x78\x74"
+                         "\x20\x6f\x66\x20\x61\x6e\x20\x49"
+                         "\x45\x54\x46\x20\x61\x63\x74\x69"
+                         "\x76\x69\x74\x79\x20\x69\x73\x20"
+                         "\x63\x6f\x6e\x73\x69\x64\x65\x72"
+                         "\x65\x64\x20\x61\x6e\x20\x22\x49"
+                         "\x45\x54\x46\x20\x43\x6f\x6e\x74"
+                         "\x72\x69\x62\x75\x74\x69\x6f\x6e"
+                         "\x22\x2e\x20\x53\x75\x63\x68\x20"
+                         "\x73\x74\x61\x74\x65\x6d\x65\x6e"
+                         "\x74\x73\x20\x69\x6e\x63\x6c\x75"
+                         "\x64\x65\x20\x6f\x72\x61\x6c\x20"
+                         "\x73\x74\x61\x74\x65\x6d\x65\x6e"
+                         "\x74\x73\x20\x69\x6e\x20\x49\x45"
+                         "\x54\x46\x20\x73\x65\x73\x73\x69"
+                         "\x6f\x6e\x73\x2c\x20\x61\x73\x20"
+                         "\x77\x65\x6c\x6c\x20\x61\x73\x20"
+                         "\x77\x72\x69\x74\x74\x65\x6e\x20"
+                         "\x61\x6e\x64\x20\x65\x6c\x65\x63"
+                         "\x74\x72\x6f\x6e\x69\x63\x20\x63"
+                         "\x6f\x6d\x6d\x75\x6e\x69\x63\x61"
+                         "\x74\x69\x6f\x6e\x73\x20\x6d\x61"
+                         "\x64\x65\x20\x61\x74\x20\x61\x6e"
+                         "\x79\x20\x74\x69\x6d\x65\x20\x6f"
+                         "\x72\x20\x70\x6c\x61\x63\x65\x2c"
+                         "\x20\x77\x68\x69\x63\x68\x20\x61"
+                         "\x72\x65\x20\x61\x64\x64\x72\x65"
+                         "\x73\x73\x65\x64\x20\x74\x6f",
+               .ctext  = "\xe4\xa6\xc8\x30\xc4\x23\x13\xd6"
+                         "\x08\x4d\xc9\xb7\xa5\x64\x7c\xb9"
+                         "\x71\xe2\xab\x3e\xa8\x30\x8a\x1c"
+                         "\x4a\x94\x6d\x9b\xe0\xb3\x6f\xf1"
+                         "\xdc\xe3\x1b\xb3\xa9\x6d\x0d\xd6"
+                         "\xd0\xca\x12\xef\xe7\x5f\xd8\x61"
+                         "\x3c\x82\xd3\x99\x86\x3c\x6f\x66"
+                         "\x02\x06\xdc\x55\xf9\xed\xdf\x38"
+                         "\xb4\xa6\x17\x00\x7f\xef\xbf\x4f"
+                         "\xf8\x36\xf1\x60\x7e\x47\xaf\xdb"
+                         "\x55\x9b\x12\xcb\x56\x44\xa7\x1f"
+                         "\xd3\x1a\x07\x3b\x00\xec\xe6\x4c"
+                         "\xa2\x43\x27\xdf\x86\x19\x4f\x16"
+                         "\xed\xf9\x4a\xf3\x63\x6f\xfa\x7f"
+                         "\x78\x11\xf6\x7d\x97\x6f\xec\x6f"
+                         "\x85\x0f\x5c\x36\x13\x8d\x87\xe0"
+                         "\x80\xb1\x69\x0b\x98\x89\x9c\x4e"
+                         "\xf8\xdd\xee\x5c\x0a\x85\xce\xd4"
+                         "\xea\x1b\x48\xbe\x08\xf8\xe2\xa8"
+                         "\xa5\xb0\x3c\x79\xb1\x15\xb4\xb9"
+                         "\x75\x10\x95\x35\x81\x7e\x26\xe6"
+                         "\x78\xa4\x88\xcf\xdb\x91\x34\x18"
+                         "\xad\xd7\x8e\x07\x7d\xab\x39\xf9"
+                         "\xa3\x9e\xa5\x1d\xbb\xed\x61\xfd"
+                         "\xdc\xb7\x5a\x27\xfc\xb5\xc9\x10"
+                         "\xa8\xcc\x52\x7f\x14\x76\x90\xe7"
+                         "\x1b\x29\x60\x74\xc0\x98\x77\xbb"
+                         "\xe0\x54\xbb\x27\x49\x59\x1e\x62"
+                         "\x3d\xaf\x74\x06\xa4\x42\x6f\xc6"
+                         "\x52\x97\xc4\x1d\xc4\x9f\xe2\xe5"
+                         "\x38\x57\x91\xd1\xa2\x28\xcc\x40"
+                         "\xcc\x70\x59\x37\xfc\x9f\x4b\xda"
+                         "\xa0\xeb\x97\x9a\x7d\xed\x14\x5c"
+                         "\x9c\xb7\x93\x26\x41\xa8\x66\xdd"
+                         "\x87\x6a\xc0\xd3\xc2\xa9\x3e\xae"
+                         "\xe9\x72\xfe\xd1\xb3\xac\x38\xea"
+                         "\x4d\x15\xa9\xd5\x36\x61\xe9\x96"
+                         "\x6c\x23\xf8\x43\xe4\x92\x29\xd9"
+                         "\x8b\x78\xf7\x0a\x52\xe0\x19\x5b"
+                         "\x59\x69\x5b\x5d\xa1\x53\xc4\x68"
+                         "\xe1\xbb\xac\x89\x14\xe2\xe2\x85"
+                         "\x41\x18\xf5\xb3\xd1\xfa\x68\x19"
+                         "\x44\x78\xdc\xcf\xe7\x88\x2d\x52"
+                         "\x5f\x40\xb5\x7e\xf8\x88\xa2\xae"
+                         "\x4a\xb2\x07\x35\x9d\x9b\x07\x88"
+                         "\xb7\x00\xd0\x0c\xb6\xa0\x47\x59"
+                         "\xda\x4e\xc9\xab\x9b\x8a\x7b",
+
+               .len    = 375,
+               .also_non_np = 1,
+               .np     = 3,
+               .tap    = { 375 - 20, 4, 16 },
+
+       }, {
+               .key    = "\x1c\x92\x40\xa5\xeb\x55\xd3\x8a"
+                         "\xf3\x33\x88\x86\x04\xf6\xb5\xf0"
+                         "\x47\x39\x17\xc1\x40\x2b\x80\x09"
+                         "\x9d\xca\x5c\xbc\x20\x70\x75\xc0",
+               .klen   = 32,
+               .iv     = "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x02\x76\x5a\x2e\x63"
+                         "\x33\x9f\xc9\x9a\x66\x32\x0d\xb7"
+                         "\x2a\x00\x00\x00\x00\x00\x00\x00",
+               .ptext  = "\x27\x54\x77\x61\x73\x20\x62\x72"
+                         "\x69\x6c\x6c\x69\x67\x2c\x20\x61"
+                         "\x6e\x64\x20\x74\x68\x65\x20\x73"
+                         "\x6c\x69\x74\x68\x79\x20\x74\x6f"
+                         "\x76\x65\x73\x0a\x44\x69\x64\x20"
+                         "\x67\x79\x72\x65\x20\x61\x6e\x64"
+                         "\x20\x67\x69\x6d\x62\x6c\x65\x20"
+                         "\x69\x6e\x20\x74\x68\x65\x20\x77"
+                         "\x61\x62\x65\x3a\x0a\x41\x6c\x6c"
+                         "\x20\x6d\x69\x6d\x73\x79\x20\x77"
+                         "\x65\x72\x65\x20\x74\x68\x65\x20"
+                         "\x62\x6f\x72\x6f\x67\x6f\x76\x65"
+                         "\x73\x2c\x0a\x41\x6e\x64\x20\x74"
+                         "\x68\x65\x20\x6d\x6f\x6d\x65\x20"
+                         "\x72\x61\x74\x68\x73\x20\x6f\x75"
+                         "\x74\x67\x72\x61\x62\x65\x2e",
+               .ctext  = "\xb9\x68\xbc\x6a\x24\xbc\xcc\xd8"
+                         "\x9b\x2a\x8d\x5b\x96\xaf\x56\xe3"
+                         "\x11\x61\xe7\xa7\x9b\xce\x4e\x7d"
+                         "\x60\x02\x48\xac\xeb\xd5\x3a\x26"
+                         "\x9d\x77\x3b\xb5\x32\x13\x86\x8e"
+                         "\x20\x82\x26\x72\xae\x64\x1b\x7e"
+                         "\x2e\x01\x68\xb4\x87\x45\xa1\x24"
+                         "\xe4\x48\x40\xf0\xaa\xac\xee\xa9"
+                         "\xfc\x31\xad\x9d\x89\xa3\xbb\xd2"
+                         "\xe4\x25\x13\xad\x0f\x5e\xdf\x3c"
+                         "\x27\xab\xb8\x62\x46\x22\x30\x48"
+                         "\x55\x2c\x4e\x84\x78\x1d\x0d\x34"
+                         "\x8d\x3c\x91\x0a\x7f\x5b\x19\x9f"
+                         "\x97\x05\x4c\xa7\x62\x47\x8b\xc5"
+                         "\x44\x2e\x20\x33\xdd\xa0\x82\xa9"
+                         "\x25\x76\x37\xe6\x3c\x67\x5b",
+               .len    = 127,
+       }, {
+               .key    = "\x1c\x92\x40\xa5\xeb\x55\xd3\x8a"
+                         "\xf3\x33\x88\x86\x04\xf6\xb5\xf0"
+                         "\x47\x39\x17\xc1\x40\x2b\x80\x09"
+                         "\x9d\xca\x5c\xbc\x20\x70\x75\xc0",
+               .klen   = 32,
+               .iv     = "\x00\x00\x00\x00\x00\x00\x00\x00"
+                         "\x00\x00\x00\x01\x31\x58\xa3\x5a"
+                         "\x25\x5d\x05\x17\x58\xe9\x5e\xd4"
+                         "\x1c\x00\x00\x00\x00\x00\x00\x00",
+               .ptext  = "\x49\xee\xe0\xdc\x24\x90\x40\xcd"
+                         "\xc5\x40\x8f\x47\x05\xbc\xdd\x81"
+                         "\x47\xc6\x8d\xe6\xb1\x8f\xd7\xcb"
+                         "\x09\x0e\x6e\x22\x48\x1f\xbf\xb8"
+                         "\x5c\xf7\x1e\x8a\xc1\x23\xf2\xd4"
+                         "\x19\x4b\x01\x0f\x4e\xa4\x43\xce"
+                         "\x01\xc6\x67\xda\x03\x91\x18\x90"
+                         "\xa5\xa4\x8e\x45\x03\xb3\x2d\xac"
+                         "\x74\x92\xd3\x53\x47\xc8\xdd\x25"
+                         "\x53\x6c\x02\x03\x87\x0d\x11\x0c"
+                         "\x58\xe3\x12\x18\xfd\x2a\x5b\x40"
+                         "\x0c\x30\xf0\xb8\x3f\x43\xce\xae"
+                         "\x65\x3a\x7d\x7c\xf4\x54\xaa\xcc"
+                         "\x33\x97\xc3\x77\xba\xc5\x70\xde"
+                         "\xd7\xd5\x13\xa5\x65\xc4\x5f\x0f"
+                         "\x46\x1a\x0d\x97\xb5\xf3\xbb\x3c"
+                         "\x84\x0f\x2b\xc5\xaa\xea\xf2\x6c"
+                         "\xc9\xb5\x0c\xee\x15\xf3\x7d\xbe"
+                         "\x9f\x7b\x5a\xa6\xae\x4f\x83\xb6"
+                         "\x79\x49\x41\xf4\x58\x18\xcb\x86"
+                         "\x7f\x30\x0e\xf8\x7d\x44\x36\xea"
+                         "\x75\xeb\x88\x84\x40\x3c\xad\x4f"
+                         "\x6f\x31\x6b\xaa\x5d\xe5\xa5\xc5"
+                         "\x21\x66\xe9\xa7\xe3\xb2\x15\x88"
+                         "\x78\xf6\x79\xa1\x59\x47\x12\x4e"
+                         "\x9f\x9f\x64\x1a\xa0\x22\x5b\x08"
+                         "\xbe\x7c\x36\xc2\x2b\x66\x33\x1b"
+                         "\xdd\x60\x71\xf7\x47\x8c\x61\xc3"
+                         "\xda\x8a\x78\x1e\x16\xfa\x1e\x86"
+                         "\x81\xa6\x17\x2a\xa7\xb5\xc2\xe7"
+                         "\xa4\xc7\x42\xf1\xcf\x6a\xca\xb4"
+                         "\x45\xcf\xf3\x93\xf0\xe7\xea\xf6"
+                         "\xf4\xe6\x33\x43\x84\x93\xa5\x67"
+                         "\x9b\x16\x58\x58\x80\x0f\x2b\x5c"
+                         "\x24\x74\x75\x7f\x95\x81\xb7\x30"
+                         "\x7a\x33\xa7\xf7\x94\x87\x32\x27"
+                         "\x10\x5d\x14\x4c\x43\x29\xdd\x26"
+                         "\xbd\x3e\x3c\x0e\xfe\x0e\xa5\x10"
+                         "\xea\x6b\x64\xfd\x73\xc6\xed\xec"
+                         "\xa8\xc9\xbf\xb3\xba\x0b\x4d\x07"
+                         "\x70\xfc\x16\xfd\x79\x1e\xd7\xc5"
+                         "\x49\x4e\x1c\x8b\x8d\x79\x1b\xb1"
+                         "\xec\xca\x60\x09\x4c\x6a\xd5\x09"
+                         "\x49\x46\x00\x88\x22\x8d\xce\xea"
+                         "\xb1\x17\x11\xde\x42\xd2\x23\xc1"
+                         "\x72\x11\xf5\x50\x73\x04\x40\x47"
+                         "\xf9\x5d\xe7\xa7\x26\xb1\x7e\xb0"
+                         "\x3f\x58\xc1\x52\xab\x12\x67\x9d"
+                         "\x3f\x43\x4b\x68\xd4\x9c\x68\x38"
+                         "\x07\x8a\x2d\x3e\xf3\xaf\x6a\x4b"
+                         "\xf9\xe5\x31\x69\x22\xf9\xa6\x69"
+                         "\xc6\x9c\x96\x9a\x12\x35\x95\x1d"
+                         "\x95\xd5\xdd\xbe\xbf\x93\x53\x24"
+                         "\xfd\xeb\xc2\x0a\x64\xb0\x77\x00"
+                         "\x6f\x88\xc4\x37\x18\x69\x7c\xd7"
+                         "\x41\x92\x55\x4c\x03\xa1\x9a\x4b"
+                         "\x15\xe5\xdf\x7f\x37\x33\x72\xc1"
+                         "\x8b\x10\x67\xa3\x01\x57\x94\x25"
+                         "\x7b\x38\x71\x7e\xdd\x1e\xcc\x73"
+                         "\x55\xd2\x8e\xeb\x07\xdd\xf1\xda"
+                         "\x58\xb1\x47\x90\xfe\x42\x21\x72"
+                         "\xa3\x54\x7a\xa0\x40\xec\x9f\xdd"
+                         "\xc6\x84\x6e\xca\xae\xe3\x68\xb4"
+                         "\x9d\xe4\x78\xff\x57\xf2\xf8\x1b"
+                         "\x03\xa1\x31\xd9\xde\x8d\xf5\x22"
+                         "\x9c\xdd\x20\xa4\x1e\x27\xb1\x76"
+                         "\x4f\x44\x55\xe2\x9b\xa1\x9c\xfe"
+                         "\x54\xf7\x27\x1b\xf4\xde\x02\xf5"
+                         "\x1b\x55\x48\x5c\xdc\x21\x4b\x9e"
+                         "\x4b\x6e\xed\x46\x23\xdc\x65\xb2"
+                         "\xcf\x79\x5f\x28\xe0\x9e\x8b\xe7"
+                         "\x4c\x9d\x8a\xff\xc1\xa6\x28\xb8"
+                         "\x65\x69\x8a\x45\x29\xef\x74\x85"
+                         "\xde\x79\xc7\x08\xae\x30\xb0\xf4"
+                         "\xa3\x1d\x51\x41\xab\xce\xcb\xf6"
+                         "\xb5\xd8\x6d\xe0\x85\xe1\x98\xb3"
+                         "\x43\xbb\x86\x83\x0a\xa0\xf5\xb7"
+                         "\x04\x0b\xfa\x71\x1f\xb0\xf6\xd9"
+                         "\x13\x00\x15\xf0\xc7\xeb\x0d\x5a"
+                         "\x9f\xd7\xb9\x6c\x65\x14\x22\x45"
+                         "\x6e\x45\x32\x3e\x7e\x60\x1a\x12"
+                         "\x97\x82\x14\xfb\xaa\x04\x22\xfa"
+                         "\xa0\xe5\x7e\x8c\x78\x02\x48\x5d"
+                         "\x78\x33\x5a\x7c\xad\xdb\x29\xce"
+                         "\xbb\x8b\x61\xa4\xb7\x42\xe2\xac"
+                         "\x8b\x1a\xd9\x2f\x0b\x8b\x62\x21"
+                         "\x83\x35\x7e\xad\x73\xc2\xb5\x6c"
+                         "\x10\x26\x38\x07\xe5\xc7\x36\x80"
+                         "\xe2\x23\x12\x61\xf5\x48\x4b\x2b"
+                         "\xc5\xdf\x15\xd9\x87\x01\xaa\xac"
+                         "\x1e\x7c\xad\x73\x78\x18\x63\xe0"
+                         "\x8b\x9f\x81\xd8\x12\x6a\x28\x10"
+                         "\xbe\x04\x68\x8a\x09\x7c\x1b\x1c"
+                         "\x83\x66\x80\x47\x80\xe8\xfd\x35"
+                         "\x1c\x97\x6f\xae\x49\x10\x66\xcc"
+                         "\xc6\xd8\xcc\x3a\x84\x91\x20\x77"
+                         "\x72\xe4\x24\xd2\x37\x9f\xc5\xc9"
+                         "\x25\x94\x10\x5f\x40\x00\x64\x99"
+                         "\xdc\xae\xd7\x21\x09\x78\x50\x15"
+                         "\xac\x5f\xc6\x2c\xa2\x0b\xa9\x39"
+                         "\x87\x6e\x6d\xab\xde\x08\x51\x16"
+                         "\xc7\x13\xe9\xea\xed\x06\x8e\x2c"
+                         "\xf8\x37\x8c\xf0\xa6\x96\x8d\x43"
+                         "\xb6\x98\x37\xb2\x43\xed\xde\xdf"
+                         "\x89\x1a\xe7\xeb\x9d\xa1\x7b\x0b"
+                         "\x77\xb0\xe2\x75\xc0\xf1\x98\xd9"
+                         "\x80\x55\xc9\x34\x91\xd1\x59\xe8"
+                         "\x4b\x0f\xc1\xa9\x4b\x7a\x84\x06"
+                         "\x20\xa8\x5d\xfa\xd1\xde\x70\x56"
+                         "\x2f\x9e\x91\x9c\x20\xb3\x24\xd8"
+                         "\x84\x3d\xe1\x8c\x7e\x62\x52\xe5"
+                         "\x44\x4b\x9f\xc2\x93\x03\xea\x2b"
+                         "\x59\xc5\xfa\x3f\x91\x2b\xbb\x23"
+                         "\xf5\xb2\x7b\xf5\x38\xaf\xb3\xee"
+                         "\x63\xdc\x7b\xd1\xff\xaa\x8b\xab"
+                         "\x82\x6b\x37\x04\xeb\x74\xbe\x79"
+                         "\xb9\x83\x90\xef\x20\x59\x46\xff"
+                         "\xe9\x97\x3e\x2f\xee\xb6\x64\x18"
+                         "\x38\x4c\x7a\x4a\xf9\x61\xe8\x9a"
+                         "\xa1\xb5\x01\xa6\x47\xd3\x11\xd4"
+                         "\xce\xd3\x91\x49\x88\xc7\xb8\x4d"
+                         "\xb1\xb9\x07\x6d\x16\x72\xae\x46"
+                         "\x5e\x03\xa1\x4b\xb6\x02\x30\xa8"
+                         "\x3d\xa9\x07\x2a\x7c\x19\xe7\x62"
+                         "\x87\xe3\x82\x2f\x6f\xe1\x09\xd9"
+                         "\x94\x97\xea\xdd\x58\x9e\xae\x76"
+                         "\x7e\x35\xe5\xb4\xda\x7e\xf4\xde"
+                         "\xf7\x32\x87\xcd\x93\xbf\x11\x56"
+                         "\x11\xbe\x08\x74\xe1\x69\xad\xe2"
+                         "\xd7\xf8\x86\x75\x8a\x3c\xa4\xbe"
+                         "\x70\xa7\x1b\xfc\x0b\x44\x2a\x76"
+                         "\x35\xea\x5d\x85\x81\xaf\x85\xeb"
+                         "\xa0\x1c\x61\xc2\xf7\x4f\xa5\xdc"
+                         "\x02\x7f\xf6\x95\x40\x6e\x8a\x9a"
+                         "\xf3\x5d\x25\x6e\x14\x3a\x22\xc9"
+                         "\x37\x1c\xeb\x46\x54\x3f\xa5\x91"
+                         "\xc2\xb5\x8c\xfe\x53\x08\x97\x32"
+                         "\x1b\xb2\x30\x27\xfe\x25\x5d\xdc"
+                         "\x08\x87\xd0\xe5\x94\x1a\xd4\xf1"
+                         "\xfe\xd6\xb4\xa3\xe6\x74\x81\x3c"
+                         "\x1b\xb7\x31\xa7\x22\xfd\xd4\xdd"
+                         "\x20\x4e\x7c\x51\xb0\x60\x73\xb8"
+                         "\x9c\xac\x91\x90\x7e\x01\xb0\xe1"
+                         "\x8a\x2f\x75\x1c\x53\x2a\x98\x2a"
+                         "\x06\x52\x95\x52\xb2\xe9\x25\x2e"
+                         "\x4c\xe2\x5a\x00\xb2\x13\x81\x03"
+                         "\x77\x66\x0d\xa5\x99\xda\x4e\x8c"
+                         "\xac\xf3\x13\x53\x27\x45\xaf\x64"
+                         "\x46\xdc\xea\x23\xda\x97\xd1\xab"
+                         "\x7d\x6c\x30\x96\x1f\xbc\x06\x34"
+                         "\x18\x0b\x5e\x21\x35\x11\x8d\x4c"
+                         "\xe0\x2d\xe9\x50\x16\x74\x81\xa8"
+                         "\xb4\x34\xb9\x72\x42\xa6\xcc\xbc"
+                         "\xca\x34\x83\x27\x10\x5b\x68\x45"
+                         "\x8f\x52\x22\x0c\x55\x3d\x29\x7c"
+                         "\xe3\xc0\x66\x05\x42\x91\x5f\x58"
+                         "\xfe\x4a\x62\xd9\x8c\xa9\x04\x19"
+                         "\x04\xa9\x08\x4b\x57\xfc\x67\x53"
+                         "\x08\x7c\xbc\x66\x8a\xb0\xb6\x9f"
+                         "\x92\xd6\x41\x7c\x5b\x2a\x00\x79"
+                         "\x72",
+               .ctext  = "\xe1\xb6\x8b\x5c\x80\xb8\xcc\x08"
+                         "\x1b\x84\xb2\xd1\xad\xa4\x70\xac"
+                         "\x67\xa9\x39\x27\xac\xb4\x5b\xb7"
+                         "\x4c\x26\x77\x23\x1d\xce\x0a\xbe"
+                         "\x18\x9e\x42\x8b\xbd\x7f\xd6\xf1"
+                         "\xf1\x6b\xe2\x6d\x7f\x92\x0e\xcb"
+                         "\xb8\x79\xba\xb4\xac\x7e\x2d\xc0"
+                         "\x9e\x83\x81\x91\xd5\xea\xc3\x12"
+                         "\x8d\xa4\x26\x70\xa4\xf9\x71\x0b"
+                         "\xbd\x2e\xe1\xb3\x80\x42\x25\xb3"
+                         "\x0b\x31\x99\xe1\x0d\xde\xa6\x90"
+                         "\xf2\xa3\x10\xf7\xe5\xf3\x83\x1e"
+                         "\x2c\xfb\x4d\xf0\x45\x3d\x28\x3c"
+                         "\xb8\xf1\xcb\xbf\x67\xd8\x43\x5a"
+                         "\x9d\x7b\x73\x29\x88\x0f\x13\x06"
+                         "\x37\x50\x0d\x7c\xe6\x9b\x07\xdd"
+                         "\x7e\x01\x1f\x81\x90\x10\x69\xdb"
+                         "\xa4\xad\x8a\x5e\xac\x30\x72\xf2"
+                         "\x36\xcd\xe3\x23\x49\x02\x93\xfa"
+                         "\x3d\xbb\xe2\x98\x83\xeb\xe9\x8d"
+                         "\xb3\x8f\x11\xaa\x53\xdb\xaf\x2e"
+                         "\x95\x13\x99\x3d\x71\xbd\x32\x92"
+                         "\xdd\xfc\x9d\x5e\x6f\x63\x2c\xee"
+                         "\x91\x1f\x4c\x64\x3d\x87\x55\x0f"
+                         "\xcc\x3d\x89\x61\x53\x02\x57\x8f"
+                         "\xe4\x77\x29\x32\xaf\xa6\x2f\x0a"
+                         "\xae\x3c\x3f\x3f\xf4\xfb\x65\x52"
+                         "\xc5\xc1\x78\x78\x53\x28\xad\xed"
+                         "\xd1\x67\x37\xc7\x59\x70\xcd\x0a"
+                         "\xb8\x0f\x80\x51\x9f\xc0\x12\x5e"
+                         "\x06\x0a\x7e\xec\x24\x5f\x73\x00"
+                         "\xb1\x0b\x31\x47\x4f\x73\x8d\xb4"
+                         "\xce\xf3\x55\x45\x6c\x84\x27\xba"
+                         "\xb9\x6f\x03\x4a\xeb\x98\x88\x6e"
+                         "\x53\xed\x25\x19\x0d\x8f\xfe\xca"
+                         "\x60\xe5\x00\x93\x6e\x3c\xff\x19"
+                         "\xae\x08\x3b\x8a\xa6\x84\x05\xfe"
+                         "\x9b\x59\xa0\x8c\xc8\x05\x45\xf5"
+                         "\x05\x37\xdc\x45\x6f\x8b\x95\x8c"
+                         "\x4e\x11\x45\x7a\xce\x21\xa5\xf7"
+                         "\x71\x67\xb9\xce\xd7\xf9\xe9\x5e"
+                         "\x60\xf5\x53\x7a\xa8\x85\x14\x03"
+                         "\xa0\x92\xec\xf3\x51\x80\x84\xc4"
+                         "\xdc\x11\x9e\x57\xce\x4b\x45\xcf"
+                         "\x90\x95\x85\x0b\x96\xe9\xee\x35"
+                         "\x10\xb8\x9b\xf2\x59\x4a\xc6\x7e"
+                         "\x85\xe5\x6f\x38\x51\x93\x40\x0c"
+                         "\x99\xd7\x7f\x32\xa8\x06\x27\xd1"
+                         "\x2b\xd5\xb5\x3a\x1a\xe1\x5e\xda"
+                         "\xcd\x5a\x50\x30\x3c\xc7\xe7\x65"
+                         "\xa6\x07\x0b\x98\x91\xc6\x20\x27"
+                         "\x2a\x03\x63\x1b\x1e\x3d\xaf\xc8"
+                         "\x71\x48\x46\x6a\x64\x28\xf9\x3d"
+                         "\xd1\x1d\xab\xc8\x40\x76\xc2\x39"
+                         "\x4e\x00\x75\xd2\x0e\x82\x58\x8c"
+                         "\xd3\x73\x5a\xea\x46\x89\xbe\xfd"
+                         "\x4e\x2c\x0d\x94\xaa\x9b\x68\xac"
+                         "\x86\x87\x30\x7e\xa9\x16\xcd\x59"
+                         "\xd2\xa6\xbe\x0a\xd8\xf5\xfd\x2d"
+                         "\x49\x69\xd2\x1a\x90\xd2\x1b\xed"
+                         "\xff\x71\x04\x87\x87\x21\xc4\xb8"
+                         "\x1f\x5b\x51\x33\xd0\xd6\x59\x9a"
+                         "\x03\x0e\xd3\x8b\xfb\x57\x73\xfd"
+                         "\x5a\x52\x63\x82\xc8\x85\x2f\xcb"
+                         "\x74\x6d\x4e\xd9\x68\x37\x85\x6a"
+                         "\xd4\xfb\x94\xed\x8d\xd1\x1a\xaf"
+                         "\x76\xa7\xb7\x88\xd0\x2b\x4e\xda"
+                         "\xec\x99\x94\x27\x6f\x87\x8c\xdf"
+                         "\x4b\x5e\xa6\x66\xdd\xcb\x33\x7b"
+                         "\x64\x94\x31\xa8\x37\xa6\x1d\xdb"
+                         "\x0d\x5c\x93\xa4\x40\xf9\x30\x53"
+                         "\x4b\x74\x8d\xdd\xf6\xde\x3c\xac"
+                         "\x5c\x80\x01\x3a\xef\xb1\x9a\x02"
+                         "\x0c\x22\x8e\xe7\x44\x09\x74\x4c"
+                         "\xf2\x9a\x27\x69\x7f\x12\x32\x36"
+                         "\xde\x92\xdf\xde\x8f\x5b\x31\xab"
+                         "\x4a\x01\x26\xe0\xb1\xda\xe8\x37"
+                         "\x21\x64\xe8\xff\x69\xfc\x9e\x41"
+                         "\xd2\x96\x2d\x18\x64\x98\x33\x78"
+                         "\x24\x61\x73\x9b\x47\x29\xf1\xa7"
+                         "\xcb\x27\x0f\xf0\x85\x6d\x8c\x9d"
+                         "\x2c\x95\x9e\xe5\xb2\x8e\x30\x29"
+                         "\x78\x8a\x9d\x65\xb4\x8e\xde\x7b"
+                         "\xd9\x00\x50\xf5\x7f\x81\xc3\x1b"
+                         "\x25\x85\xeb\xc2\x8c\x33\x22\x1e"
+                         "\x68\x38\x22\x30\xd8\x2e\x00\x98"
+                         "\x85\x16\x06\x56\xb4\x81\x74\x20"
+                         "\x95\xdb\x1c\x05\x19\xe8\x23\x4d"
+                         "\x65\x5d\xcc\xd8\x7f\xc4\x2d\x0f"
+                         "\x57\x26\x71\x07\xad\xaa\x71\x9f"
+                         "\x19\x76\x2f\x25\x51\x88\xe4\xc0"
+                         "\x82\x6e\x08\x05\x37\x04\xee\x25"
+                         "\x23\x90\xe9\x4e\xce\x9b\x16\xc1"
+                         "\x31\xe7\x6e\x2c\x1b\xe1\x85\x9a"
+                         "\x0c\x8c\xbb\x12\x1e\x68\x7b\x93"
+                         "\xa9\x3c\x39\x56\x23\x3e\x6e\xc7"
+                         "\x77\x84\xd3\xe0\x86\x59\xaa\xb9"
+                         "\xd5\x53\x58\xc9\x0a\x83\x5f\x85"
+                         "\xd8\x47\x14\x67\x8a\x3c\x17\xe0"
+                         "\xab\x02\x51\xea\xf1\xf0\x4f\x30"
+                         "\x7d\xe0\x92\xc2\x5f\xfb\x19\x5a"
+                         "\x3f\xbd\xf4\x39\xa4\x31\x0c\x39"
+                         "\xd1\xae\x4e\xf7\x65\x7f\x1f\xce"
+                         "\xc2\x39\xd1\x84\xd4\xe5\x02\xe0"
+                         "\x58\xaa\xf1\x5e\x81\xaf\x7f\x72"
+                         "\x0f\x08\x99\x43\xb9\xd8\xac\x41"
+                         "\x35\x55\xf2\xb2\xd4\x98\xb8\x3b"
+                         "\x2b\x3c\x3e\x16\x06\x31\xfc\x79"
+                         "\x47\x38\x63\x51\xc5\xd0\x26\xd7"
+                         "\x43\xb4\x2b\xd9\xc5\x05\xf2\x9d"
+                         "\x18\xc9\x26\x82\x56\xd2\x11\x05"
+                         "\xb6\x89\xb4\x43\x9c\xb5\x9d\x11"
+                         "\x6c\x83\x37\x71\x27\x1c\xae\xbf"
+                         "\xcd\x57\xd2\xee\x0d\x5a\x15\x26"
+                         "\x67\x88\x80\x80\x1b\xdc\xc1\x62"
+                         "\xdd\x4c\xff\x92\x5c\x6c\xe1\xa0"
+                         "\xe3\x79\xa9\x65\x8c\x8c\x14\x42"
+                         "\xe5\x11\xd2\x1a\xad\xa9\x56\x6f"
+                         "\x98\xfc\x8a\x7b\x56\x1f\xc6\xc1"
+                         "\x52\x12\x92\x9b\x41\x0f\x4b\xae"
+                         "\x1b\x4a\xbc\xfe\x23\xb6\x94\x70"
+                         "\x04\x30\x9e\x69\x47\xbe\xb8\x8f"
+                         "\xca\x45\xd7\x8a\xf4\x78\x3e\xaa"
+                         "\x71\x17\xd8\x1e\xb8\x11\x8f\xbc"
+                         "\xc8\x1a\x65\x7b\x41\x89\x72\xc7"
+                         "\x5f\xbe\xc5\x2a\xdb\x5c\x54\xf9"
+                         "\x25\xa3\x7a\x80\x56\x9c\x8c\xab"
+                         "\x26\x19\x10\x36\xa6\xf3\x14\x79"
+                         "\x40\x98\x70\x68\xb7\x35\xd9\xb9"
+                         "\x27\xd4\xe7\x74\x5b\x3d\x97\xb4"
+                         "\xd9\xaa\xd9\xf2\xb5\x14\x84\x1f"
+                         "\xa9\xde\x12\x44\x5b\x00\xc0\xbc"
+                         "\xc8\x11\x25\x1b\x67\x7a\x15\x72"
+                         "\xa6\x31\x6f\xf4\x68\x7a\x86\x9d"
+                         "\x43\x1c\x5f\x16\xd3\xad\x2e\x52"
+                         "\xf3\xb4\xc3\xfa\x27\x2e\x68\x6c"
+                         "\x06\xe7\x4c\x4f\xa2\xe0\xe4\x21"
+                         "\x5d\x9e\x33\x58\x8d\xbf\xd5\x70"
+                         "\xf8\x80\xa5\xdd\xe7\x18\x79\xfa"
+                         "\x7b\xfd\x09\x69\x2c\x37\x32\xa8"
+                         "\x65\xfa\x8d\x8b\x5c\xcc\xe8\xf3"
+                         "\x37\xf6\xa6\xc6\x5c\xa2\x66\x79"
+                         "\xfa\x8a\xa7\xd1\x0b\x2e\x1b\x5e"
+                         "\x95\x35\x00\x76\xae\x42\xf7\x50"
+                         "\x51\x78\xfb\xb4\x28\x24\xde\x1a"
+                         "\x70\x8b\xed\xca\x3c\x5e\xe4\xbd"
+                         "\x28\xb5\xf3\x76\x4f\x67\x5d\x81"
+                         "\xb2\x60\x87\xd9\x7b\x19\x1a\xa7"
+                         "\x79\xa2\xfa\x3f\x9e\xa9\xd7\x25"
+                         "\x61\xe1\x74\x31\xa2\x77\xa0\x1b"
+                         "\xf6\xf7\xcb\xc5\xaa\x9e\xce\xf9"
+                         "\x9b\x96\xef\x51\xc3\x1a\x44\x96"
+                         "\xae\x17\x50\xab\x29\x08\xda\xcc"
+                         "\x1a\xb3\x12\xd0\x24\xe4\xe2\xe0"
+                         "\xc6\xe3\xcc\x82\xd0\xba\x47\x4c"
+                         "\x3f\x49\xd7\xe8\xb6\x61\xaa\x65"
+                         "\x25\x18\x40\x2d\x62\x25\x02\x71"
+                         "\x61\xa2\xc1\xb2\x13\xd2\x71\x3f"
+                         "\x43\x1a\xc9\x09\x92\xff\xd5\x57"
+                         "\xf0\xfc\x5e\x1c\xf1\xf5\xf9\xf3"
+                         "\x5b",
+               .len    = 1281,
+               .also_non_np = 1,
+               .np     = 3,
+               .tap    = { 1200, 1, 80 },
+       },
+};
+
 /*
  * CTS (Cipher Text Stealing) mode tests
  */

include/crypto/chacha.h +7 -0

index ae79e9983c72f..3d261f5cd156d 100644
@@ -5,6 +5,11 @@
  * XChaCha extends ChaCha's nonce to 192 bits, while provably retaining ChaCha's
  * security.  Here they share the same key size, tfm context, and setkey
  * function; only their IV size and encrypt/decrypt function differ.
+ *
+ * The ChaCha paper specifies 20, 12, and 8-round variants.  In general, it is
+ * recommended to use the 20-round variant ChaCha20.  However, the other
+ * variants can be needed in some performance-sensitive scenarios.  The generic
+ * ChaCha code currently allows only the 20 and 12-round variants.
  */
 
 #ifndef _CRYPTO_CHACHA_H

@@ -39,6 +44,8 @@ void crypto_chacha_init(u32 *state, struct chacha_ctx *ctx, u8 *iv);
 
 int crypto_chacha20_setkey(struct crypto_skcipher *tfm, const u8 *key,
                           unsigned int keysize);
+int crypto_chacha12_setkey(struct crypto_skcipher *tfm, const u8 *key,
+                          unsigned int keysize);
 
 int crypto_chacha_crypt(struct skcipher_request *req);
 int crypto_xchacha_crypt(struct skcipher_request *req);

lib/chacha.c +0 -0

index 0a2c2e5b7b84d..c4d69a83fcd2d 100644

lib/chacha.c +2 -3

        for (i = 0; i < nrounds; i += 2) {
                x[0]  += x[4];    x[12] = rol32(x[12] ^ x[0],  16);

@@ -70,7 +70,7 @@ static void chacha_permute(u32 *x, int nrounds)
  * chacha_block - generate one keystream block and increment block counter
  * @state: input state matrix (16 32-bit words)
  * @stream: output keystream block (64 bytes)
- * @nrounds: number of rounds (currently must be 20)
+ * @nrounds: number of rounds (20 or 12; 20 is recommended)
  *
  * This is the ChaCha core, a function from 64-byte strings to 64-byte strings.
  * The caller has already converted the endianness of the input.  This function

@@ -96,7 +96,7 @@ EXPORT_SYMBOL(chacha_block);
  * hchacha_block - abbreviated ChaCha core, for XChaCha
  * @in: input state matrix (16 32-bit words)
  * @out: output (8 32-bit words)
- * @nrounds: number of rounds (currently must be 20)
+ * @nrounds: number of rounds (20 or 12; 20 is recommended)
  *
  * HChaCha is the ChaCha equivalent of HSalsa and is an intermediate step
  * towards XChaCha (see https://cr.yp.to/snuffle/xsalsa-20081128.pdf).  HChaCha
--

2.19.1.331.ge82ca0e54c-goog

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel at lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Quoted 30 lines

include/crypto/chacha.h +7 -0

index ae79e9983c72f..3d261f5cd156d 100644
@@ -5,6 +5,11 @@
  * XChaCha extends ChaCha's nonce to 192 bits, while provably retaining ChaCha's
  * security.  Here they share the same key size, tfm context, and setkey
  * function; only their IV size and encrypt/decrypt function differ.
+ *
+ * The ChaCha paper specifies 20, 12, and 8-round variants.  In general, it is
+ * recommended to use the 20-round variant ChaCha20.  However, the other
+ * variants can be needed in some performance-sensitive scenarios.  The generic
+ * ChaCha code currently allows only the 20 and 12-round variants.
  */
 
 #ifndef _CRYPTO_CHACHA_H

@@ -39,6 +44,8 @@ void crypto_chacha_init(u32 *state, struct chacha_ctx *ctx, u8 *iv);
 
 int crypto_chacha20_setkey(struct crypto_skcipher *tfm, const u8 *key,
                           unsigned int keysize);
+int crypto_chacha12_setkey(struct crypto_skcipher *tfm, const u8 *key,
+                          unsigned int keysize);
 
 int crypto_chacha_crypt(struct skcipher_request *req);
 int crypto_xchacha_crypt(struct skcipher_request *req);

lib/chacha.c +0 -0

index 0a2c2e5b7b84d..c4d69a83fcd2d 100644

lib/chacha.c static void chacha_permute(u32 *x, int nrounds) · line 25

Quoted 6 lines

lib/chacha.c +1 -1

@@ -21,7 +21,7 @@ static void chacha_permute(u32 *x, int nrounds)
        int i;
 
        /* whitelist the allowed round counts */
-       BUG_ON(nrounds != 20);
+       BUG_ON(nrounds != 20 && nrounds != 12);
 

I didn't spot this until this patch, but BUG_ON() may bring down the kernel, and so it should really only be used as a last resort. (i.e., if this is called from non-process context things may explode rather painfully)

I didn't look at the entire file [which is a bit cumbersome while reviewing incremental changes like this] and so I don't really have another suggestion right now, but please try to come up with something better if you can.

From: Eric Biggers <[email protected]>

Add an XChaCha20 implementation that is hooked up to the ARM NEON implementation of ChaCha20. This is needed for use in the Adiantum encryption mode; see the generic code patch,
"crypto: chacha20-generic - add XChaCha20 support", for more details.

We also update the NEON code to support HChaCha20 on one block, so we can use that in XChaCha20 rather than calling the generic HChaCha20. This required factoring the permutation out into its own macro.

Signed-off-by Eric Biggers <[email protected]>

---
 arch/arm/crypto/Kconfig              |   2 +-
 arch/arm/crypto/chacha20-neon-core.S |  68 ++++++++++------
 arch/arm/crypto/chacha20-neon-glue.c | 111 ++++++++++++++++++++-------
 3 files changed, 130 insertions(+), 51 deletions(-)

arch/arm/crypto/Kconfig +1 -1

index ef0c7feea6e29..0aa1471f27d2e 100644
@@ -117,7 +117,7 @@ config CRYPTO_CRC32_ARM_CE
        select CRYPTO_HASH
 
 config CRYPTO_CHACHA20_NEON
-       tristate "NEON accelerated ChaCha20 symmetric cipher"
+       tristate "NEON accelerated ChaCha20 stream cipher algorithms"
        depends on KERNEL_MODE_NEON
        select CRYPTO_BLKCIPHER
        select CRYPTO_CHACHA20

arch/arm/crypto/chacha20-neon-core.S +0 -16

index 50e7b98968189..db59f1fbc728b 100644
@@ -52,33 +52,22 @@
        .fpu            neon
        .align          5
 
-ENTRY(chacha20_block_xor_neon)
-       // r0: Input state matrix, s
-       // r1: 1 data block output, o
-       // r2: 1 data block input, i
-
-       //
-       // This function encrypts one ChaCha20 block by loading the state matrix
-       // in four NEON registers. It performs matrix operation on four words in
-       // parallel, but requireds shuffling to rearrange the words after each
-       // round.
-       //
-
-       // x0..3 = s0..3
-       add             ip, r0, #0x20
-       vld1.32         {q0-q1}, [r0]
-       vld1.32         {q2-q3}, [ip]

arch/arm/crypto/chacha20-neon-core.S +1 -1

        adr             ip, .Lrol8_table
        mov             r3, #10
        vld1.8          {d10}, [ip, :64]
 
-.Ldoubleround:
+.Ldoubleround_\@:
        // x0 += x1, x3 = rotl32(x3 ^ x0, 16)
        vadd.i32        q0, q0, q1
        veor            q3, q3, q0

arch/arm/crypto/chacha20-neon-core.S +31 -0

+ENTRY(chacha20_block_xor_neon)
+       // r0: Input state matrix, s
+       // r1: 1 data block output, o
+       // r2: 1 data block input, i
+
+       // x0..3 = s0..3
+       add             ip, r0, #0x20
+       vld1.32         {q0-q1}, [r0]
+       vld1.32         {q2-q3}, [ip]
+
+       vmov            q8, q0
+       vmov            q9, q1
+       vmov            q10, q2
+       vmov            q11, q3
+
+       _chacha20_permute
 
        add             ip, r2, #0x20
        vld1.8          {q4-q5}, [r2]

@@ -169,6 +176,21 @@ ENTRY(chacha20_block_xor_neon)
        bx              lr
 ENDPROC(chacha20_block_xor_neon)
 
+ENTRY(hchacha20_block_neon)
+       // r0: Input state matrix, s
+       // r1: output (8 32-bit words)
+
+       vld1.32         {q0-q1}, [r0]!
+       vld1.32         {q2-q3}, [r0]
+
+       _chacha20_permute
+
+       vst1.32         {q0}, [r1]!
+       vst1.32         {q3}, [r1]
+
+       bx              lr
+ENDPROC(hchacha20_block_neon)
+
        .align          4
 .Lctrinc:      .word   0, 1, 2, 3
 .Lrol8_table:  .byte   3, 0, 1, 2, 7, 4, 5, 6

arch/arm/crypto/chacha20-neon-glue.c +4 -3

index 7386eb1c1889d..becc7990b1d39 100644
@@ -1,5 +1,5 @@
 /*
- * ChaCha20 256-bit cipher algorithm, RFC7539, ARM NEON functions
+ * ChaCha20 (RFC7539) and XChaCha20 stream ciphers, NEON accelerated
  *
  * Copyright (C) 2016 Linaro, Ltd. <[email protected]>
  *

@@ -30,6 +30,7 @@
 
 asmlinkage void chacha20_block_xor_neon(u32 *state, u8 *dst, const u8 *src);
 asmlinkage void chacha20_4block_xor_neon(u32 *state, u8 *dst, const u8 *src);
+asmlinkage void hchacha20_block_neon(const u32 *state, u32 *out);
 
 static void chacha20_doneon(u32 *state, u8 *dst, const u8 *src,
                            unsigned int bytes)

@@ -57,22 +58,17 @@ static void chacha20_doneon(u32 *state, u8 *dst, const u8 *src,
        }
 }
 
-static int chacha20_neon(struct skcipher_request *req)
+static int chacha20_neon_stream_xor(struct skcipher_request *req,
+                                   struct chacha_ctx *ctx, u8 *iv)
 {
-       struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);

arch/arm/crypto/chacha20-neon-glue.c +80 -21

-       crypto_chacha_init(state, ctx, walk.iv);
+       crypto_chacha_init(state, ctx, iv);
 
-       kernel_neon_begin();
        while (walk.nbytes > 0) {
                unsigned int nbytes = walk.nbytes;
 

@@ -83,27 +79,85 @@ static int chacha20_neon(struct skcipher_request *req)
                                nbytes);
                err = skcipher_walk_done(&walk, walk.nbytes - nbytes);
        }
+
+       return err;
+}
+
+static int chacha20_neon(struct skcipher_request *req)
+{
+       struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
+       struct chacha_ctx *ctx = crypto_skcipher_ctx(tfm);
+       int err;
+
+       if (req->cryptlen <= CHACHA_BLOCK_SIZE || !may_use_simd())
+               return crypto_chacha_crypt(req);
+
+       kernel_neon_begin();
+       err = chacha20_neon_stream_xor(req, ctx, req->iv);
+       kernel_neon_end();
+       return err;
+}
+
+static int xchacha20_neon(struct skcipher_request *req)
+{
+       struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
+       struct chacha_ctx *ctx = crypto_skcipher_ctx(tfm);
+       struct chacha_ctx subctx;
+       u32 state[16];
+       u8 real_iv[16];
+       int err;
+
+       if (req->cryptlen <= CHACHA_BLOCK_SIZE || !may_use_simd())
+               return crypto_xchacha_crypt(req);
+
+       crypto_chacha_init(state, ctx, req->iv);
+
+       kernel_neon_begin();
+
+       hchacha20_block_neon(state, subctx.key);
+       memcpy(&real_iv[0], req->iv + 24, 8);
+       memcpy(&real_iv[8], req->iv + 16, 8);
+       err = chacha20_neon_stream_xor(req, &subctx, real_iv);
+
        kernel_neon_end();
 
        return err;
 }
 
-static struct skcipher_alg alg = {
-       .base.cra_name          = "chacha20",
-       .base.cra_driver_name   = "chacha20-neon",
-       .base.cra_priority      = 300,
-       .base.cra_blocksize     = 1,
-       .base.cra_ctxsize       = sizeof(struct chacha_ctx),
-       .base.cra_module        = THIS_MODULE,
-
-       .min_keysize            = CHACHA_KEY_SIZE,
-       .max_keysize            = CHACHA_KEY_SIZE,
-       .ivsize                 = CHACHA_IV_SIZE,
-       .chunksize              = CHACHA_BLOCK_SIZE,
-       .walksize               = 4 * CHACHA_BLOCK_SIZE,
-       .setkey                 = crypto_chacha20_setkey,
-       .encrypt                = chacha20_neon,
-       .decrypt                = chacha20_neon,
+static struct skcipher_alg algs[] = {
+       {
+               .base.cra_name          = "chacha20",
+               .base.cra_driver_name   = "chacha20-neon",
+               .base.cra_priority      = 300,
+               .base.cra_blocksize     = 1,
+               .base.cra_ctxsize       = sizeof(struct chacha_ctx),
+               .base.cra_module        = THIS_MODULE,
+
+               .min_keysize            = CHACHA_KEY_SIZE,
+               .max_keysize            = CHACHA_KEY_SIZE,
+               .ivsize                 = CHACHA_IV_SIZE,
+               .chunksize              = CHACHA_BLOCK_SIZE,
+               .walksize               = 4 * CHACHA_BLOCK_SIZE,
+               .setkey                 = crypto_chacha20_setkey,
+               .encrypt                = chacha20_neon,
+               .decrypt                = chacha20_neon,
+       }, {
+               .base.cra_name          = "xchacha20",
+               .base.cra_driver_name   = "xchacha20-neon",
+               .base.cra_priority      = 300,
+               .base.cra_blocksize     = 1,
+               .base.cra_ctxsize       = sizeof(struct chacha_ctx),
+               .base.cra_module        = THIS_MODULE,
+
+               .min_keysize            = CHACHA_KEY_SIZE,
+               .max_keysize            = CHACHA_KEY_SIZE,
+               .ivsize                 = XCHACHA_IV_SIZE,
+               .chunksize              = CHACHA_BLOCK_SIZE,
+               .walksize               = 4 * CHACHA_BLOCK_SIZE,
+               .setkey                 = crypto_chacha20_setkey,
+               .encrypt                = xchacha20_neon,
+               .decrypt                = xchacha20_neon,
+       }
 };
 
 static int __init chacha20_simd_mod_init(void)

@@ -111,12 +165,12 @@ static int __init chacha20_simd_mod_init(void)
        if (!(elf_hwcap & HWCAP_NEON))
                return -ENODEV;
 
-       return crypto_register_skcipher(&alg);
+       return crypto_register_skciphers(algs, ARRAY_SIZE(algs));
 }
 
 static void __exit chacha20_simd_mod_fini(void)
 {
-       crypto_unregister_skcipher(&alg);
+       crypto_unregister_skciphers(algs, ARRAY_SIZE(algs));
 }
 
 module_init(chacha20_simd_mod_init);

@@ -125,3 +179,6 @@ module_exit(chacha20_simd_mod_fini);
 MODULE_AUTHOR("Ard Biesheuvel <[email protected]>");
 MODULE_LICENSE("GPL v2");
 MODULE_ALIAS_CRYPTO("chacha20");
+MODULE_ALIAS_CRYPTO("chacha20-neon");
+MODULE_ALIAS_CRYPTO("xchacha20");
+MODULE_ALIAS_CRYPTO("xchacha20-neon");
--

2.19.1.331.ge82ca0e54c-goog

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel at lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel