Use upstream's xchacha20poly1305
This commit is contained in:
Jason A. Donenfeld
parent
849fa400e9
commit
5ace0fdfe2
19
cookie.go
19
cookie.go
|
|
@ -8,7 +8,6 @@ package main
|
|||
import (
|
||||
"crypto/hmac"
|
||||
"crypto/rand"
|
||||
"git.zx2c4.com/wireguard-go/xchacha20poly1305"
|
||||
"golang.org/x/crypto/blake2s"
|
||||
"golang.org/x/crypto/chacha20poly1305"
|
||||
"sync"
|
||||
|
|
@ -163,13 +162,8 @@ func (st *CookieChecker) CreateReply(
|
|||
return nil, err
|
||||
}
|
||||
|
||||
xchacha20poly1305.Encrypt(
|
||||
reply.Cookie[:0],
|
||||
&reply.Nonce,
|
||||
cookie[:],
|
||||
msg[smac1:smac2],
|
||||
&st.mac2.encryptionKey,
|
||||
)
|
||||
xchapoly, _ := chacha20poly1305.NewX(st.mac2.encryptionKey[:])
|
||||
xchapoly.Seal(reply.Cookie[:0], reply.Nonce[:], cookie[:], msg[smac1:smac2])
|
||||
|
||||
st.mutex.RUnlock()
|
||||
|
||||
|
|
@ -207,13 +201,8 @@ func (st *CookieGenerator) ConsumeReply(msg *MessageCookieReply) bool {
|
|||
|
||||
var cookie [blake2s.Size128]byte
|
||||
|
||||
_, err := xchacha20poly1305.Decrypt(
|
||||
cookie[:0],
|
||||
&msg.Nonce,
|
||||
msg.Cookie[:],
|
||||
st.mac2.lastMAC1[:],
|
||||
&st.mac2.encryptionKey,
|
||||
)
|
||||
xchapoly, _ := chacha20poly1305.NewX(st.mac2.encryptionKey[:])
|
||||
_, err := xchapoly.Open(cookie[:0], msg.Nonce[:], msg.Cookie[:], st.mac2.lastMAC1[:])
|
||||
|
||||
if err != nil {
|
||||
return false
|
||||
|
|
|
|||
|
|
@ -89,7 +89,7 @@ type MessageTransport struct {
|
|||
type MessageCookieReply struct {
|
||||
Type uint32
|
||||
Receiver uint32
|
||||
Nonce [24]byte
|
||||
Nonce [chacha20poly1305.NonceSizeX]byte
|
||||
Cookie [blake2s.Size128 + poly1305.TagSize]byte
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,171 +0,0 @@
|
|||
/* SPDX-License-Identifier: MIT
|
||||
*
|
||||
* Copyright (C) 2016 Andreas Auernhammer. All Rights Reserved.
|
||||
* Copyright (C) 2017-2018 WireGuard LLC. All Rights Reserved.
|
||||
*/
|
||||
|
||||
package xchacha20poly1305
|
||||
|
||||
import (
|
||||
"encoding/binary"
|
||||
"golang.org/x/crypto/chacha20poly1305"
|
||||
)
|
||||
|
||||
func hChaCha20(out *[32]byte, nonce []byte, key *[32]byte) {
|
||||
|
||||
v00 := uint32(0x61707865)
|
||||
v01 := uint32(0x3320646e)
|
||||
v02 := uint32(0x79622d32)
|
||||
v03 := uint32(0x6b206574)
|
||||
|
||||
v04 := binary.LittleEndian.Uint32(key[0:])
|
||||
v05 := binary.LittleEndian.Uint32(key[4:])
|
||||
v06 := binary.LittleEndian.Uint32(key[8:])
|
||||
v07 := binary.LittleEndian.Uint32(key[12:])
|
||||
v08 := binary.LittleEndian.Uint32(key[16:])
|
||||
v09 := binary.LittleEndian.Uint32(key[20:])
|
||||
v10 := binary.LittleEndian.Uint32(key[24:])
|
||||
v11 := binary.LittleEndian.Uint32(key[28:])
|
||||
v12 := binary.LittleEndian.Uint32(nonce[0:])
|
||||
v13 := binary.LittleEndian.Uint32(nonce[4:])
|
||||
v14 := binary.LittleEndian.Uint32(nonce[8:])
|
||||
v15 := binary.LittleEndian.Uint32(nonce[12:])
|
||||
|
||||
for i := 0; i < 20; i += 2 {
|
||||
v00 += v04
|
||||
v12 ^= v00
|
||||
v12 = (v12 << 16) | (v12 >> 16)
|
||||
v08 += v12
|
||||
v04 ^= v08
|
||||
v04 = (v04 << 12) | (v04 >> 20)
|
||||
v00 += v04
|
||||
v12 ^= v00
|
||||
v12 = (v12 << 8) | (v12 >> 24)
|
||||
v08 += v12
|
||||
v04 ^= v08
|
||||
v04 = (v04 << 7) | (v04 >> 25)
|
||||
v01 += v05
|
||||
v13 ^= v01
|
||||
v13 = (v13 << 16) | (v13 >> 16)
|
||||
v09 += v13
|
||||
v05 ^= v09
|
||||
v05 = (v05 << 12) | (v05 >> 20)
|
||||
v01 += v05
|
||||
v13 ^= v01
|
||||
v13 = (v13 << 8) | (v13 >> 24)
|
||||
v09 += v13
|
||||
v05 ^= v09
|
||||
v05 = (v05 << 7) | (v05 >> 25)
|
||||
v02 += v06
|
||||
v14 ^= v02
|
||||
v14 = (v14 << 16) | (v14 >> 16)
|
||||
v10 += v14
|
||||
v06 ^= v10
|
||||
v06 = (v06 << 12) | (v06 >> 20)
|
||||
v02 += v06
|
||||
v14 ^= v02
|
||||
v14 = (v14 << 8) | (v14 >> 24)
|
||||
v10 += v14
|
||||
v06 ^= v10
|
||||
v06 = (v06 << 7) | (v06 >> 25)
|
||||
v03 += v07
|
||||
v15 ^= v03
|
||||
v15 = (v15 << 16) | (v15 >> 16)
|
||||
v11 += v15
|
||||
v07 ^= v11
|
||||
v07 = (v07 << 12) | (v07 >> 20)
|
||||
v03 += v07
|
||||
v15 ^= v03
|
||||
v15 = (v15 << 8) | (v15 >> 24)
|
||||
v11 += v15
|
||||
v07 ^= v11
|
||||
v07 = (v07 << 7) | (v07 >> 25)
|
||||
v00 += v05
|
||||
v15 ^= v00
|
||||
v15 = (v15 << 16) | (v15 >> 16)
|
||||
v10 += v15
|
||||
v05 ^= v10
|
||||
v05 = (v05 << 12) | (v05 >> 20)
|
||||
v00 += v05
|
||||
v15 ^= v00
|
||||
v15 = (v15 << 8) | (v15 >> 24)
|
||||
v10 += v15
|
||||
v05 ^= v10
|
||||
v05 = (v05 << 7) | (v05 >> 25)
|
||||
v01 += v06
|
||||
v12 ^= v01
|
||||
v12 = (v12 << 16) | (v12 >> 16)
|
||||
v11 += v12
|
||||
v06 ^= v11
|
||||
v06 = (v06 << 12) | (v06 >> 20)
|
||||
v01 += v06
|
||||
v12 ^= v01
|
||||
v12 = (v12 << 8) | (v12 >> 24)
|
||||
v11 += v12
|
||||
v06 ^= v11
|
||||
v06 = (v06 << 7) | (v06 >> 25)
|
||||
v02 += v07
|
||||
v13 ^= v02
|
||||
v13 = (v13 << 16) | (v13 >> 16)
|
||||
v08 += v13
|
||||
v07 ^= v08
|
||||
v07 = (v07 << 12) | (v07 >> 20)
|
||||
v02 += v07
|
||||
v13 ^= v02
|
||||
v13 = (v13 << 8) | (v13 >> 24)
|
||||
v08 += v13
|
||||
v07 ^= v08
|
||||
v07 = (v07 << 7) | (v07 >> 25)
|
||||
v03 += v04
|
||||
v14 ^= v03
|
||||
v14 = (v14 << 16) | (v14 >> 16)
|
||||
v09 += v14
|
||||
v04 ^= v09
|
||||
v04 = (v04 << 12) | (v04 >> 20)
|
||||
v03 += v04
|
||||
v14 ^= v03
|
||||
v14 = (v14 << 8) | (v14 >> 24)
|
||||
v09 += v14
|
||||
v04 ^= v09
|
||||
v04 = (v04 << 7) | (v04 >> 25)
|
||||
}
|
||||
|
||||
binary.LittleEndian.PutUint32(out[0:], v00)
|
||||
binary.LittleEndian.PutUint32(out[4:], v01)
|
||||
binary.LittleEndian.PutUint32(out[8:], v02)
|
||||
binary.LittleEndian.PutUint32(out[12:], v03)
|
||||
binary.LittleEndian.PutUint32(out[16:], v12)
|
||||
binary.LittleEndian.PutUint32(out[20:], v13)
|
||||
binary.LittleEndian.PutUint32(out[24:], v14)
|
||||
binary.LittleEndian.PutUint32(out[28:], v15)
|
||||
}
|
||||
|
||||
func Encrypt(
|
||||
dst []byte,
|
||||
nonceFull *[24]byte,
|
||||
plaintext []byte,
|
||||
additionalData []byte,
|
||||
key *[chacha20poly1305.KeySize]byte,
|
||||
) []byte {
|
||||
var nonce [chacha20poly1305.NonceSize]byte
|
||||
var derivedKey [chacha20poly1305.KeySize]byte
|
||||
hChaCha20(&derivedKey, nonceFull[:16], key)
|
||||
aead, _ := chacha20poly1305.New(derivedKey[:])
|
||||
copy(nonce[4:], nonceFull[16:])
|
||||
return aead.Seal(dst, nonce[:], plaintext, additionalData)
|
||||
}
|
||||
|
||||
func Decrypt(
|
||||
dst []byte,
|
||||
nonceFull *[24]byte,
|
||||
plaintext []byte,
|
||||
additionalData []byte,
|
||||
key *[chacha20poly1305.KeySize]byte,
|
||||
) ([]byte, error) {
|
||||
var nonce [chacha20poly1305.NonceSize]byte
|
||||
var derivedKey [chacha20poly1305.KeySize]byte
|
||||
hChaCha20(&derivedKey, nonceFull[:16], key)
|
||||
aead, _ := chacha20poly1305.New(derivedKey[:])
|
||||
copy(nonce[4:], nonceFull[16:])
|
||||
return aead.Open(dst, nonce[:], plaintext, additionalData)
|
||||
}
|
||||
|
|
@ -1,101 +0,0 @@
|
|||
/* SPDX-License-Identifier: GPL-2.0
|
||||
*
|
||||
* Copyright (C) 2017-2018 WireGuard LLC. All Rights Reserved.
|
||||
*/
|
||||
|
||||
package xchacha20poly1305
|
||||
|
||||
import (
|
||||
"encoding/hex"
|
||||
"testing"
|
||||
)
|
||||
|
||||
type XChaCha20Test struct {
|
||||
Nonce string
|
||||
Key string
|
||||
PT string
|
||||
CT string
|
||||
}
|
||||
|
||||
func TestXChaCha20(t *testing.T) {
|
||||
|
||||
tests := []XChaCha20Test{
|
||||
{
|
||||
Nonce: "000000000000000000000000000000000000000000000000",
|
||||
Key: "0000000000000000000000000000000000000000000000000000000000000000",
|
||||
PT: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
|
||||
CT: "789e9689e5208d7fd9e1f3c5b5341f48ef18a13e418998addadd97a3693a987f8e82ecd5c1433bfed1af49750c0f1ff29c4174a05b119aa3a9e8333812e0c0feb1299c5949d895ee01dbf50f8395dd84",
|
||||
},
|
||||
{
|
||||
Nonce: "0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f",
|
||||
Key: "0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f",
|
||||
PT: "0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f",
|
||||
CT: "e1a046aa7f71e2af8b80b6408b2fd8d3a350278cde79c94d9efaa475e1339b3dd490127b",
|
||||
},
|
||||
{
|
||||
Nonce: "d9a8213e8a697508805c2c171ad54487ead9e3e02d82d5bc",
|
||||
Key: "979196dbd78526f2f584f7534db3f5824d8ccfa858ca7e09bdd3656ecd36033c",
|
||||
PT: "43cc6d624e451bbed952c3e071dc6c03392ce11eb14316a94b2fdc98b22fedea",
|
||||
CT: "53c1e8bef2dbb8f2505ec010a7afe21d5a8e6dd8f987e4ea1a2ed5dfbc844ea400db34496fd2153526c6e87c36694200",
|
||||
},
|
||||
}
|
||||
|
||||
for _, test := range tests {
|
||||
|
||||
nonce, err := hex.DecodeString(test.Nonce)
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
|
||||
key, err := hex.DecodeString(test.Key)
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
|
||||
pt, err := hex.DecodeString(test.PT)
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
|
||||
func() {
|
||||
var nonceArray [24]byte
|
||||
var keyArray [32]byte
|
||||
copy(nonceArray[:], nonce)
|
||||
copy(keyArray[:], key)
|
||||
|
||||
// test encryption
|
||||
|
||||
ct := Encrypt(
|
||||
nil,
|
||||
&nonceArray,
|
||||
pt,
|
||||
nil,
|
||||
&keyArray,
|
||||
)
|
||||
ctHex := hex.EncodeToString(ct)
|
||||
if ctHex != test.CT {
|
||||
t.Fatal("encryption failed, expected:", test.CT, "got", ctHex)
|
||||
}
|
||||
|
||||
// test decryption
|
||||
|
||||
ptp, err := Decrypt(
|
||||
nil,
|
||||
&nonceArray,
|
||||
ct,
|
||||
nil,
|
||||
&keyArray,
|
||||
)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
ptHex := hex.EncodeToString(ptp)
|
||||
if ptHex != test.PT {
|
||||
t.Fatal("decryption failed, expected:", test.PT, "got", ptHex)
|
||||
}
|
||||
}()
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
Loading…
Reference in New Issue