1 // SPDX-License-Identifier: BSD-2-Clause
2 /* LibTomCrypt, modular cryptographic library -- Tom St Denis
3 *
4 * LibTomCrypt is a library that provides various cryptographic
5 * algorithms in a highly modular and flexible manner.
6 *
7 * The library is free for all purposes without any express
8 * guarantee it works.
9 */
10
11 /* The implementation is based on:
12 * "Extending the Salsa20 nonce", https://cr.yp.to/snuffle/xsalsa-20081128.pdf
13 * "Salsa20 specification", http://cr.yp.to/snuffle/spec.pdf
14 * and salsa20-ref.c version 20051118
15 * Public domain from D. J. Bernstein
16 */
17
18 #include "tomcrypt.h"
19
20 #ifdef LTC_XSALSA20
21
22 #if defined(LTC_SHA256) && defined(LTC_TEST)
_sha256(unsigned char * hash,const unsigned char * data,const int datalen)23 static int _sha256(unsigned char *hash, const unsigned char *data, const int datalen) {
24 hash_state md;
25 sha256_init(&md);
26 sha256_process(&md, data, datalen);
27 sha256_done(&md, hash);
28 return CRYPT_OK;
29 }
30 #endif
31
xsalsa20_test(void)32 int xsalsa20_test(void)
33 {
34 #ifndef LTC_TEST
35 return CRYPT_NOP;
36 #else
37
38 /***************************************************************************
39 * verify a round trip:
40 */
41 {
42 const unsigned char key[] = {0x1b,0x27,0x55,0x64,0x73,0xe9,0x85,0xd4,0x62,0xcd,0x51,0x19,0x7a,0x9a,0x46,0xc7,0x60,0x09,0x54,0x9e,0xac,0x64,0x74,0xf2,0x06,0xc4,0xee,0x08,0x44,0xf6,0x83,0x89};
43 const unsigned char nonce[] = {0x69,0x69,0x6e,0xe9,0x55,0xb6,0x2b,0x73,0xcd,0x62,0xbd,0xa8,0x75,0xfc,0x73,0xd6,0x82,0x19,0xe0,0x03,0x6b,0x7a,0x0b,0x37};
44 const void *msg = "Kilroy was here!";
45 unsigned char msglen = 17; /* includes trailing NULL */
46 int rounds = 20;
47 unsigned char ciphertext[17];
48 unsigned char msg2[17];
49 salsa20_state st;
50 int err;
51
52 if ((err = xsalsa20_setup(&st, key, 32, nonce, 24, rounds)) != CRYPT_OK) return err;
53 if ((err = salsa20_crypt(&st, msg, msglen, ciphertext)) != CRYPT_OK) return err;
54 if ((err = salsa20_done(&st)) != CRYPT_OK) return err;
55
56 if ((err = xsalsa20_setup(&st, key, 32, nonce, 24, rounds)) != CRYPT_OK) return err;
57 if ((err = salsa20_crypt(&st, ciphertext, msglen, msg2)) != CRYPT_OK) return err;
58 if ((err = salsa20_done(&st)) != CRYPT_OK) return err;
59
60 if (compare_testvector(msg, msglen, msg2, msglen, "XSALSA20-TV1", 1)) return CRYPT_FAIL_TESTVECTOR;
61
62
63 /* round trip with two single function calls */
64 if ((err = xsalsa20_memory(key, sizeof(key), 20, nonce, sizeof(nonce), msg, msglen, ciphertext)) != CRYPT_OK) return err;
65 if ((err = xsalsa20_memory(key, sizeof(key), 20, nonce, sizeof(nonce), ciphertext, msglen, msg2)) != CRYPT_OK) return err;
66 if (compare_testvector(msg, msglen, msg2, msglen, "XSALSA20-TV2", 1)) return CRYPT_FAIL_TESTVECTOR;
67 }
68
69 #ifdef LTC_SHA256
70 /***************************************************************************
71 * verify correct generation of a keystream
72 */
73 {
74 const unsigned char key[] = {0x1b,0x27,0x55,0x64,0x73,0xe9,0x85,0xd4,0x62,0xcd,0x51,0x19,0x7a,0x9a,0x46,0xc7,0x60,0x09,0x54,0x9e,0xac,0x64,0x74,0xf2,0x06,0xc4,0xee,0x08,0x44,0xf6,0x83,0x89};
75 const unsigned char nonce[] = {0x69,0x69,0x6e,0xe9,0x55,0xb6,0x2b,0x73,0xcd,0x62,0xbd,0xa8,0x75,0xfc,0x73,0xd6,0x82,0x19,0xe0,0x03,0x6b,0x7a,0x0b,0x37};
76 const unsigned char expecthash[] = {0x6a,0x60,0x57,0x65,0x27,0xe0,0x00,0x51,0x6d,0xb0,0xda,0x60,0x46,0x20,0xf6,0xd0,0x95,0x65,0x45,0x39,0xf4,0x86,0x83,0x43,0x64,0xdf,0xd9,0x5a,0x6f,0x3f,0xbe,0xb7};
77 int rounds = 20;
78 unsigned char keystream[91101];
79 unsigned long keystreamlen = 91101;
80 unsigned char hash[32];
81 salsa20_state st;
82 int err;
83
84 if ((err = xsalsa20_setup(&st, key, 32, nonce, 24, rounds)) != CRYPT_OK) return err;
85 if ((err = salsa20_keystream(&st, keystream, keystreamlen)) != CRYPT_OK) return err;
86 if ((err = salsa20_done(&st)) != CRYPT_OK) return err;
87 if ((err = _sha256(hash, keystream, keystreamlen)) != CRYPT_OK) return err;
88 if (compare_testvector(hash, sizeof(hash), expecthash, sizeof(expecthash), "XSALSA20-TV3", 1)) return CRYPT_FAIL_TESTVECTOR;
89 }
90 #endif
91
92 return CRYPT_OK;
93
94 #endif
95 }
96
97 #endif
98
99 /* ref: $Format:%D$ */
100 /* git commit: $Format:%H$ */
101 /* commit time: $Format:%ai$ */
102