From 76bdb328a68119db409e5ce5d8c85f398a333fee Mon Sep 17 00:00:00 2001 From: Jeffrey Walton Date: Fri, 25 Jan 2019 21:51:43 -0500 Subject: Switch to RFC 8439 for ChaChaTLS Unfortunately the block counter wrap problem is still present. --- chacha.cpp | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) (limited to 'chacha.cpp') diff --git a/chacha.cpp b/chacha.cpp index 0311a56d..9d0f357e 100644 --- a/chacha.cpp +++ b/chacha.cpp @@ -388,8 +388,8 @@ void ChaChaTLS_Policy::CipherSetKey(const NameValuePairs ¶ms, const byte *ke if (rounds != 20) throw InvalidRounds(ChaChaTLS::StaticAlgorithmName(), rounds); - // RFC 7539 test vectors use an initial block counter. However, the counter - // can be an arbitrary value per RFC 7539 Section 2.4. We stash the counter + // RFC 8439 test vectors use an initial block counter. However, the counter + // can be an arbitrary value per RFC 8439 Section 2.4. We stash the counter // away in state[16] and use it for a Resynchronize() operation. I think // the initial counter is used more like a Tweak when non-0, and it should // be provided in Resynchronize() (light-weight re-keying). However, @@ -401,13 +401,13 @@ void ChaChaTLS_Policy::CipherSetKey(const NameValuePairs ¶ms, const byte *ke else m_state[16] = 0; - // State words are defined in RFC 7539, Section 2.3. + // State words are defined in RFC 8439, Section 2.3. m_state[0] = 0x61707865; m_state[1] = 0x3320646e; m_state[2] = 0x79622d32; m_state[3] = 0x6b206574; - // State words are defined in RFC 7539, Section 2.3. Key is 32-bytes. + // State words are defined in RFC 8439, Section 2.3. Key is 32-bytes. GetBlock get(key); get(m_state[4])(m_state[5])(m_state[6])(m_state[7])(m_state[8])(m_state[9])(m_state[10])(m_state[11]); } @@ -417,12 +417,18 @@ void ChaChaTLS_Policy::CipherResynchronize(byte *keystreamBuffer, const byte *IV CRYPTOPP_UNUSED(keystreamBuffer), CRYPTOPP_UNUSED(length); CRYPTOPP_ASSERT(length==12); - // State words are defined in RFC 7539, Section 2.3 + // State words are defined in RFC 8439, Section 2.3 GetBlock get(IV); m_state[12] = m_state[16]; get(m_state[13])(m_state[14])(m_state[15]); } +void ChaChaTLS_Policy::CipherResynchronize(byte *keystreamBuffer, word32 initialBlock, const byte *IV, size_t length) +{ + m_state[16] = initialBlock; + this->CipherResynchronize(keystreamBuffer, IV, length); +} + void ChaChaTLS_Policy::SeekToIteration(lword iterationCount) { // Should we throw here??? If the initial block counter is -- cgit v1.2.1