ocrypto_chacha20_poly1305_inc.h 8.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244
  1. /**
  2. * Copyright (c) 2019 - 2020, Nordic Semiconductor ASA
  3. *
  4. * All rights reserved.
  5. *
  6. * Redistribution and use in source and binary forms, with or without modification,
  7. * are permitted provided that the following conditions are met:
  8. *
  9. * 1. Redistributions of source code must retain the above copyright notice, this
  10. * list of conditions and the following disclaimer.
  11. *
  12. * 2. Redistributions in binary form, except as embedded into a Nordic
  13. * Semiconductor ASA integrated circuit in a product or a software update for
  14. * such product, must reproduce the above copyright notice, this list of
  15. * conditions and the following disclaimer in the documentation and/or other
  16. * materials provided with the distribution.
  17. *
  18. * 3. Neither the name of Nordic Semiconductor ASA nor the names of its
  19. * contributors may be used to endorse or promote products derived from this
  20. * software without specific prior written permission.
  21. *
  22. * 4. This software, with or without modification, must only be used with a
  23. * Nordic Semiconductor ASA integrated circuit.
  24. *
  25. * 5. Any software provided in binary form under this license must not be reverse
  26. * engineered, decompiled, modified and/or disassembled.
  27. *
  28. * THIS SOFTWARE IS PROVIDED BY NORDIC SEMICONDUCTOR ASA "AS IS" AND ANY EXPRESS
  29. * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  30. * OF MERCHANTABILITY, NONINFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE ARE
  31. * DISCLAIMED. IN NO EVENT SHALL NORDIC SEMICONDUCTOR ASA OR CONTRIBUTORS BE
  32. * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  33. * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
  34. * GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  35. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  36. * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
  37. * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  38. *
  39. */
  40. /**@file
  41. * @defgroup nrf_oberon_chacha_poly_inc ChaCha20-Poly1305 incremental APIs
  42. * @ingroup nrf_oberon_chacha_poly
  43. * @{
  44. * @brief Type declaration and APIs for authenticated encryption and additional data using
  45. * the ChaCha20-Poly1305 algorithm in incremental steps.
  46. *
  47. * ChaCha20-Poly1305 is an authenticated encryption algorithm with optional
  48. * additional authenticated data developed by Daniel J.Bernstein.
  49. *
  50. * The ChaCha20 stream cipher is combined with the Poly1305 authenticator.
  51. *
  52. * @see [RFC 7539 - ChaCha20 and Poly1305 for IETF Protocols](http://tools.ietf.org/html/rfc7539)
  53. */
  54. #ifndef OCRYPTO_CHACHA20_POLY1305_INC_H
  55. #define OCRYPTO_CHACHA20_POLY1305_INC_H
  56. #include <stdint.h>
  57. #include <stddef.h>
  58. #include "ocrypto_chacha20_poly1305.h"
  59. #include "ocrypto_poly1305.h"
  60. #ifdef __cplusplus
  61. extern "C" {
  62. #endif
  63. /**@cond */
  64. typedef struct {
  65. ocrypto_poly1305_ctx auth_ctx;
  66. uint8_t subkey[32];
  67. uint8_t buffer[16];
  68. uint32_t buffer_len;
  69. uint8_t cypher[64];
  70. uint32_t cypher_idx;
  71. uint32_t count;
  72. size_t msg_len;
  73. size_t aad_len;
  74. } ocrypto_chacha20_poly1305_ctx;
  75. /**@endcond */
  76. /**@name Incremental ChaCha20-Poly1305 generator.
  77. *
  78. * This group of functions can be used to incrementally encode and decode using the ChaCha20-Poly1305 stream cypher.
  79. *
  80. * Use pattern:
  81. *
  82. * Encoding:
  83. * @code
  84. * ocrypto_chacha20_poly1305_init(ctx, nonce, nonce_len, key);
  85. * ocrypto_chacha20_poly1305_update_aad(ctx, aad, aad_len, nonce, nonce_len, key);
  86. * ...
  87. * ocrypto_chacha20_poly1305_update_aad(ctx, aad, aad_len, nonce, nonce_len, key);
  88. * ocrypto_chacha20_poly1305_update_enc(ctx, ct, pt, pt_len, nonce, nonce_len, key);
  89. * ...
  90. * ocrypto_chacha20_poly1305_update_enc(ctx, ct, pt, pt_len, nonce, nonce_len, key);
  91. * ocrypto_chacha20_poly1305_final_enc(ctx, tag);
  92. * @endcode
  93. * Decoding:
  94. * @code
  95. * ocrypto_chacha20_poly1305_init(ctx, nonce, nonce_len, key);
  96. * ocrypto_chacha20_poly1305_update_aad(ctx, aad, aad_len, nonce, nonce_len, key);
  97. * ...
  98. * ocrypto_chacha20_poly1305_update_aad(ctx, aad, aad_len, nonce, nonce_len, key);
  99. * ocrypto_chacha20_poly1305_update_dec(ctx, pt, ct, ct_len, nonce, nonce_len, key);
  100. * ...
  101. * ocrypto_chacha20_poly1305_update_dec(ctx, pt, ct, ct_len, nonce, nonce_len, key);
  102. * res = ocrypto_chacha20_poly1305_final_dec(ctx, tag);
  103. * @endcode
  104. */
  105. /**@{*/
  106. /**
  107. * ChaCha20-Poly1305 initialization.
  108. *
  109. * The generator state @p ctx is initialized by this function.
  110. *
  111. * @param[out] ctx Generator state.
  112. * @param n Nonce.
  113. * @param n_len Length of @p n. 0 <= @p n_len <= @c ocrypto_chacha20_poly1305_NONCE_BYTES_MAX.
  114. * @param k Encryption key.
  115. */
  116. void ocrypto_chacha20_poly1305_init(
  117. ocrypto_chacha20_poly1305_ctx *ctx,
  118. const uint8_t *n, size_t n_len,
  119. const uint8_t k[ocrypto_chacha20_poly1305_KEY_BYTES]);
  120. /**
  121. * SHA-ChaCha20-Poly1305 incremental aad input.
  122. *
  123. * The generator state @p ctx is updated to include a data chunk @p a.
  124. *
  125. * This function can be called repeatedly until the whole data is processed.
  126. *
  127. * @param ctx Generator state.
  128. * @param a Additional authenticated data.
  129. * @param a_len Length of @p a.
  130. *
  131. * @remark Initialization of the generator state @p ctx through
  132. * @c ocrypto_chacha20_poly1305_init is required before this function can be called.
  133. *
  134. * @remark @c ocrypto_chacha20_poly1305_update_aad must be called before any call to
  135. * @c ocrypto_chacha20_poly1305_update_enc or @c ocrypto_chacha20_poly1305_update_dec.
  136. */
  137. void ocrypto_chacha20_poly1305_update_aad(
  138. ocrypto_chacha20_poly1305_ctx *ctx,
  139. const uint8_t *a, size_t a_len);
  140. /**
  141. * SHA-ChaCha20-Poly1305 incremental encoder input.
  142. *
  143. * The generator state @p ctx is updated to include a message chunk @p m.
  144. *
  145. * This function can be called repeatedly until the whole message is processed.
  146. *
  147. * @param ctx Generator state.
  148. * @param[out] c Generated ciphertext. Same length as input message.
  149. * @param m Message chunk.
  150. * @param m_len Length of @p m.
  151. * @param n Nonce.
  152. * @param n_len Length of @p n. 0 <= @p n_len <= @c ocrypto_chacha20_poly1305_NONCE_BYTES_MAX.
  153. * @param k Encryption key.
  154. *
  155. * @remark Initialization of the generator state @p ctx through
  156. * @c ocrypto_chacha20_poly1305_init is required before this function can be called.
  157. *
  158. * @remark @c ocrypto_chacha20_poly1305_update_enc must be called after any call to
  159. * @c ocrypto_chacha20_poly1305_update_aad.
  160. *
  161. * @remark @p c and @p m can point to the same address.
  162. */
  163. void ocrypto_chacha20_poly1305_update_enc(
  164. ocrypto_chacha20_poly1305_ctx *ctx,
  165. uint8_t *c,
  166. const uint8_t *m, size_t m_len,
  167. const uint8_t *n, size_t n_len,
  168. const uint8_t k[ocrypto_chacha20_poly1305_KEY_BYTES]);
  169. /**
  170. * SHA-ChaCha20-Poly1305 incremental decoder input.
  171. *
  172. * The generator state @p ctx is updated to include a cyphertext chunk @p c.
  173. *
  174. * This function can be called repeatedly until the whole cyphertext is processed.
  175. *
  176. * @param ctx Generator state.
  177. * @param[out] m Decoded message. Same length as received ciphertext.
  178. * @param c Cyphertext chunk.
  179. * @param c_len Length of @p c.
  180. * @param n Nonce.
  181. * @param n_len Length of @p n. 0 <= @p n_len <= @c ocrypto_chacha20_poly1305_NONCE_BYTES_MAX.
  182. * @param k Encryption key.
  183. *
  184. * @remark Initialization of the generator state @p ctx through
  185. * @c ocrypto_chacha20_poly1305_init is required before this function can be called.
  186. *
  187. * @remark @c ocrypto_chacha20_poly1305_update_dec must be called after any call to
  188. * @c ocrypto_chacha20_poly1305_update_aad.
  189. *
  190. * @remark @p m and @p c can point to the same address.
  191. */
  192. void ocrypto_chacha20_poly1305_update_dec(
  193. ocrypto_chacha20_poly1305_ctx *ctx,
  194. uint8_t *m,
  195. const uint8_t *c, size_t c_len,
  196. const uint8_t *n, size_t n_len,
  197. const uint8_t k[ocrypto_chacha20_poly1305_KEY_BYTES]);
  198. /**
  199. * SHA-ChaCha20-Poly1305 final encoder step.
  200. *
  201. * The generator state @p ctx is used to finalize the encryption and generate the tag.
  202. *
  203. * @param ctx Generator state.
  204. * @param[out] tag Generated authentication tag.
  205. */
  206. void ocrypto_chacha20_poly1305_final_enc(
  207. ocrypto_chacha20_poly1305_ctx *ctx,
  208. uint8_t tag[ocrypto_chacha20_poly1305_TAG_BYTES]);
  209. /**
  210. * SHA-ChaCha20-Poly1305 final decoder step.
  211. *
  212. * The generator state @p ctx is used to finalize the decryption and check the tag.
  213. *
  214. * @param ctx Generator state.
  215. * @param tag Received authentication tag.
  216. *
  217. * @retval 0 If @p tag is valid.
  218. * @retval -1 Otherwise.
  219. */
  220. int ocrypto_chacha20_poly1305_final_dec(
  221. ocrypto_chacha20_poly1305_ctx *ctx,
  222. const uint8_t tag[ocrypto_chacha20_poly1305_TAG_BYTES]);
  223. /**@}*/
  224. #ifdef __cplusplus
  225. }
  226. #endif
  227. #endif /* #ifndef OCRYPTO_CHACHA20_POLY1305_INC_H */
  228. /** @} */