BIP324: Cipher suite #25361

 173 | +        c20.SetRFC8439Nonce(nonce);
 174 | +        c20.SeekRFC8439(seek);
 175 | +        std::vector<unsigned char> keystream;
 176 | +        keystream.resize(CHACHA20_ROUND_OUTPUT);
 177 | +        c20.Keystream(keystream.data(), CHACHA20_ROUND_OUTPUT);
 178 | +        BOOST_CHECK_EQUAL(HexStr(keystream).substr(0, hex_expected_keystream.size()), hex_expected_keystream);

---

  44 | @@ -39,4 +45,48 @@ class ChaCha20
  45 |      void Crypt(const unsigned char* input, unsigned char* output, size_t bytes);
  46 |  };
  47 |  
  48 | +class FSChaCha20
  49 | +{
  50 | +private:
  51 | +    ChaCha20 c20;
  52 | +    size_t rekey_interval;
  53 | +    uint32_t messages_with_key;

---

  57 | +bool BIP324CipherSuite::Crypt(const Span<const std::byte> input, Span<std::byte> output,
  58 | +                              BIP324HeaderFlags& flags, bool encrypt)
  59 | +{
  60 | +    // check buffer boundaries
  61 | +    if (
  62 | +        // if we encrypt, make sure the destination has the space for the length field, header, ciphertext and MAC

---

  71 | +        // output will be encrypted length + encrypted (header and payload) + mac tag
  72 | +        uint32_t ciphertext_len = BIP324_HEADER_LEN + input.size();
  73 | +        WriteLE32(reinterpret_cast<unsigned char*>(&ciphertext_len), ciphertext_len);
  74 | +
  75 | +        std::vector<std::byte> input_vec;
  76 | +        input_vec.resize(BIP324_HEADER_LEN + input.size());

---

  43 | +
  44 | +public:
  45 | +    BIP324CipherSuite(const BIP324Key& K_L, const BIP324Key& K_P, const BIP324Key& rekey_salt)
  46 | +        : fsc20{K_L, rekey_salt, REKEY_INTERVAL},
  47 | +          rekey_ctr{0},
  48 | +          msg_ctr{0},

---

  16 | +static constexpr size_t BIP324_HEADER_LEN = 1;       // bytes
  17 | +static constexpr size_t BIP324_LENGTH_FIELD_LEN = 3; // bytes
  18 | +static constexpr size_t REKEY_INTERVAL = 256;        // messages
  19 | +static constexpr size_t NONCE_LENGTH = 12;           // bytes
  20 | +
  21 | +enum BIP324HeaderFlags : uint8_t {

---

  69 | +               const std::array<std::byte, FSCHACHA20_KEYLEN>& rekey_salt,
  70 | +               size_t rekey_interval)
  71 | +        : c20{reinterpret_cast<const unsigned char*>(key.data()), FSCHACHA20_KEYLEN},
  72 | +          rekey_interval{rekey_interval},
  73 | +          messages_with_key{0},
  74 | +          rekey_counter{0},

---

   4 | @@ -5,6 +5,7 @@
   5 |  #include <assert.h>
   6 |  #include <bench/bench.h>
   7 |  #include <crypto/rfc8439.h>
   8 | +#include <span.h>

---

  23 | +    for (; n > 0; n--)
  24 | +        ret |= *p1++ ^ *p2++;
  25 | +    return (ret != 0);
  26 | +}
  27 | +
  28 | +#endif // TIMINGSAFE_BCMP

---

  20 | +    for (; n > 0; n--)
  21 | +        ret |= *p1++ ^ *p2++;
  22 | +    return (ret != 0);
  23 | +}
  24 | +
  25 | +#endif // RFC8439_TIMINGSAFE_BCMP

---

  28 | +{
  29 | +    return (len % 16 == 0) ? len : (len / 16 + 1) * 16;
  30 | +}
  31 | +
  32 | +void ComputeRFC8439Tag(const std::array<std::byte, POLY1305_KEYLEN>& polykey,
  33 | +                       Span<const std::byte> aad, Span<const std::byte> ciphertext,

---

  55 | +    std::array<std::byte, POLY1305_KEYLEN> polykey;
  56 | +    c20.Keystream(reinterpret_cast<unsigned char*>(polykey.data()), POLY1305_KEYLEN);
  57 | +    return polykey;
  58 | +}
  59 | +
  60 | +void RFC8439Crypt(ChaCha20& c20, const Span<const std::byte> in_bytes, Span<std::byte> out_bytes)

---

  10 | +#include <cstring>
  11 | +
  12 | +#ifndef RFC8439_TIMINGSAFE_BCMP
  13 | +#define RFC8439_TIMINGSAFE_BCMP
  14 | +
  15 | +int rfc8439_timingsafe_bcmp(const unsigned char* b1, const unsigned char* b2, size_t n)

---

  14 | +
  15 | +constexpr static size_t RFC8439_KEYLEN = 32;
  16 | +
  17 | +void RFC8439Encrypt(const Span<const std::byte> aad, const Span<const std::byte> key, const std::array<std::byte, 12>& nonce, const Span<const std::byte> plaintext, Span<std::byte> output);
  18 | +
  19 | +// returns false if authentication fails

---

  10 | +
  11 | +#include <array>
  12 | +#include <cstddef>
  13 | +#include <vector>
  14 | +
  15 | +constexpr static size_t RFC8439_KEYLEN = 32;

---

   0 | @@ -0,0 +1,76 @@
   1 | +// Copyright (c) 2022 The Bitcoin Core developers
   2 | +// Distributed under the MIT software license, see the accompanying
   3 | +// file COPYING or http://www.opensource.org/licenses/mit-license.php.
   4 | +
   5 | +#include <assert.h>

---

   0 | @@ -0,0 +1,117 @@
   1 | +// Copyright (c) 2019-2020 The Bitcoin Core developers
   2 | +// Distributed under the MIT software license, see the accompanying
   3 | +// file COPYING or http://www.opensource.org/licenses/mit-license.php.
   4 | +

---

   0 | @@ -0,0 +1,117 @@
   1 | +// Copyright (c) 2019-2020 The Bitcoin Core developers
   2 | +// Distributed under the MIT software license, see the accompanying
   3 | +// file COPYING or http://www.opensource.org/licenses/mit-license.php.
   4 | +
   5 | +
   6 | +#include <assert.h>
   7 | +#include <bench/bench.h>
   8 | +#include <crypto/bip324_suite.h>
   9 | +#include <crypto/rfc8439.h> // for the RFC8439_EXPANSION constant

---

  49 | +        uint32_t contents_len = input.size();
  50 | +        WriteLE32(reinterpret_cast<unsigned char*>(&contents_len), contents_len);
  51 | +
  52 | +        std::vector<std::byte> header_and_contents(BIP324_HEADER_LEN + input.size());
  53 | +
  54 | +        memcpy(header_and_contents.data(), &flags, BIP324_HEADER_LEN);

---

 141 | @@ -127,7 +142,7 @@ inline void ChaCha20Aligned::Keystream64(unsigned char* c, size_t blocks)
 142 |          x15 += j15;
 143 |  
 144 |          ++j12;
 145 | -        if (!j12) ++j13;
 146 | +        if (!j12 && !is_rfc8439) ++j13;

---

  13 | +static constexpr uint64_t AAD_SIZE = 32;
  14 | +static constexpr uint64_t PLAINTEXT_SIZE_TINY = 64;
  15 | +static constexpr uint64_t PLAINTEXT_SIZE_SMALL = 256;
  16 | +static constexpr uint64_t PLAINTEXT_SIZE_LARGE = 1024 * 1024;
  17 | +
  18 | +static std::vector<std::byte> zero_key(32, std::byte{0x00});

---

  15 | +static constexpr uint64_t PLAINTEXT_SIZE_SMALL = 256;
  16 | +static constexpr uint64_t PLAINTEXT_SIZE_LARGE = 1024 * 1024;
  17 | +
  18 | +static std::vector<std::byte> zero_key(32, std::byte{0x00});
  19 | +static std::vector<std::byte> aad(AAD_SIZE, std::byte{0x00});
  20 | +std::array<std::byte, 12> nonce = {std::byte{0x00}, std::byte{0x01}, std::byte{0x02}, std::byte{0x03},

---