This is an automated email from the ASF dual-hosted git repository.
acassis pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git
The following commit(s) were added to refs/heads/master by this push:
new 5e2ce6190d8 crypto: add CRYPTO_CHACHA20_DJB variant (64-bit
counter/nonce)
5e2ce6190d8 is described below
commit 5e2ce6190d801b79d8bb5c1aaa7a9e1ae51aa3f8
Author: Felipe Moura <[email protected]>
AuthorDate: Fri Jul 10 18:48:43 2026 -0300
crypto: add CRYPTO_CHACHA20_DJB variant (64-bit counter/nonce)
CRYPTO_CHACHA20 implements the RFC 8439/IETF parameterization (32-bit
counter + 96-bit nonce). SSH's [email protected] uses the
original DJB construction instead: a 64-bit block counter in state
words 12..13 and a 64-bit nonce in words 14..15 (libtomcrypt's
chacha_ivctr64). The two layouts produce different keystreams for the
same key, so an SSH server cannot interoperate with OpenSSH clients
through the IETF variant.
Signed-off-by: Felipe Moura <[email protected]>
---
crypto/chachapoly.c | 26 ++++++++++++++++++++++++++
crypto/cryptodev.c | 1 +
crypto/cryptosoft.c | 6 ++++++
crypto/xform.c | 11 +++++++++++
include/crypto/chachapoly.h | 2 ++
include/crypto/cryptodev.h | 3 ++-
include/crypto/xform.h | 1 +
7 files changed, 49 insertions(+), 1 deletion(-)
diff --git a/crypto/chachapoly.c b/crypto/chachapoly.c
index 885b066ff6e..8a0c47a52c8 100644
--- a/crypto/chachapoly.c
+++ b/crypto/chachapoly.c
@@ -84,6 +84,32 @@ void chachapoly_reinit(caddr_t key, FAR uint8_t *iv)
chacha_ivsetup((FAR chacha_ctx *)ctx->block, iv, ctx->nonce);
}
+int chacha20_djb_setkey(FAR void *sched, FAR uint8_t *key, int len)
+{
+ FAR struct chacha20_ctx *ctx = (FAR struct chacha20_ctx *)sched;
+
+ if (len != CHACHA20_KEYSIZE)
+ {
+ return -1;
+ }
+
+ chacha_keysetup((FAR chacha_ctx *)ctx->block, key, CHACHA20_KEYSIZE * 8);
+ return 0;
+}
+
+void chacha20_djb_reinit(caddr_t key, FAR uint8_t *iv)
+{
+ FAR struct chacha20_ctx *ctx = (FAR struct chacha20_ctx *)key;
+
+ /* Original DJB ChaCha20 layout, as used by [email protected]
+ * (libtomcrypt chacha_ivctr64): the 16-byte IV is loaded verbatim into
+ * state words 12..15 as a 64-bit little-endian block counter followed by
+ * a 64-bit nonce.
+ */
+
+ chacha_ivsetup((FAR chacha_ctx *)ctx->block, iv + 4, iv);
+}
+
void chacha20_poly1305_init(FAR void *xctx)
{
FAR CHACHA20_POLY1305_CTX *ctx = xctx;
diff --git a/crypto/cryptodev.c b/crypto/cryptodev.c
index e36716443d1..a6ad2be4092 100644
--- a/crypto/cryptodev.c
+++ b/crypto/cryptodev.c
@@ -237,6 +237,7 @@ static int cryptof_ioctl(FAR struct file *filep,
case CRYPTO_AES_CFB_8:
case CRYPTO_AES_CFB_128:
case CRYPTO_CHACHA20:
+ case CRYPTO_CHACHA20_DJB:
case CRYPTO_CHACHA20_POLY1305:
case CRYPTO_NULL:
txform = true;
diff --git a/crypto/cryptosoft.c b/crypto/cryptosoft.c
index de1d87b4e9d..c1f4539b060 100644
--- a/crypto/cryptosoft.c
+++ b/crypto/cryptosoft.c
@@ -1645,6 +1645,9 @@ int swcr_newsession(FAR uint32_t *sid, FAR struct
cryptoini *cri)
case CRYPTO_CHACHA20:
txf = &enc_xform_chacha20;
goto enccommon;
+ case CRYPTO_CHACHA20_DJB:
+ txf = &enc_xform_chacha20_djb;
+ goto enccommon;
case CRYPTO_CHACHA20_POLY1305:
txf = &enc_xform_chacha20_poly1305;
goto enccommon;
@@ -1908,6 +1911,7 @@ int swcr_freesession(uint64_t tid)
case CRYPTO_AES_CFB_8:
case CRYPTO_AES_CFB_128:
case CRYPTO_CHACHA20:
+ case CRYPTO_CHACHA20_DJB:
case CRYPTO_CHACHA20_POLY1305:
case CRYPTO_NULL:
txf = swd->sw_exf;
@@ -2047,6 +2051,7 @@ int swcr_process(struct cryptop *crp)
case CRYPTO_AES_CFB_8:
case CRYPTO_AES_CFB_128:
case CRYPTO_CHACHA20:
+ case CRYPTO_CHACHA20_DJB:
txf = sw->sw_exf;
if (crp->crp_iv)
@@ -2452,6 +2457,7 @@ void swcr_init(void)
algs[CRYPTO_AES_CFB_8] = CRYPTO_ALG_FLAG_SUPPORTED;
algs[CRYPTO_AES_CFB_128] = CRYPTO_ALG_FLAG_SUPPORTED;
algs[CRYPTO_CHACHA20] = CRYPTO_ALG_FLAG_SUPPORTED;
+ algs[CRYPTO_CHACHA20_DJB] = CRYPTO_ALG_FLAG_SUPPORTED;
algs[CRYPTO_CHACHA20_POLY1305] = CRYPTO_ALG_FLAG_SUPPORTED;
algs[CRYPTO_CHACHA20_POLY1305_MAC] = CRYPTO_ALG_FLAG_SUPPORTED;
algs[CRYPTO_MD5] = CRYPTO_ALG_FLAG_SUPPORTED;
diff --git a/crypto/xform.c b/crypto/xform.c
index ff9729c2295..788a718b08e 100644
--- a/crypto/xform.c
+++ b/crypto/xform.c
@@ -318,6 +318,17 @@ const struct enc_xform enc_xform_chacha20 =
chacha20_reinit
};
+const struct enc_xform enc_xform_chacha20_djb =
+{
+ CRYPTO_CHACHA20_DJB, "CHACHA20-DJB",
+ 64, 16, 32, 32,
+ sizeof(struct chacha20_ctx),
+ chacha20_crypt,
+ chacha20_crypt,
+ chacha20_djb_setkey,
+ chacha20_djb_reinit
+};
+
const struct enc_xform enc_xform_chacha20_poly1305 =
{
CRYPTO_CHACHA20_POLY1305, "CHACHA20-POLY1305",
diff --git a/include/crypto/chachapoly.h b/include/crypto/chachapoly.h
index ee5a4607842..1886e88af1b 100644
--- a/include/crypto/chachapoly.h
+++ b/include/crypto/chachapoly.h
@@ -36,6 +36,8 @@ int chacha20_setkey(FAR void *, FAR uint8_t *, int);
void chacha20_reinit(caddr_t, FAR uint8_t *);
void chacha20_crypt(caddr_t, FAR uint8_t *, size_t);
void chachapoly_reinit(caddr_t, FAR uint8_t *);
+int chacha20_djb_setkey(FAR void *, FAR uint8_t *, int);
+void chacha20_djb_reinit(caddr_t, FAR uint8_t *);
#define POLY1305_KEYLEN 64
#define POLY1305_TAGLEN 16
diff --git a/include/crypto/cryptodev.h b/include/crypto/cryptodev.h
index 3ee6c4f16cf..824f8fafb12 100644
--- a/include/crypto/cryptodev.h
+++ b/include/crypto/cryptodev.h
@@ -141,7 +141,8 @@
#define CRYPTO_ESN 40 /* Support for Extended Sequence Numbers */
#define CRYPTO_SHA2_224_HMAC 41
#define CRYPTO_CHACHA20 42
-#define CRYPTO_ALGORITHM_MAX 42 /* Keep updated */
+#define CRYPTO_CHACHA20_DJB 43
+#define CRYPTO_ALGORITHM_MAX 43 /* Keep updated */
/* Algorithm flags */
diff --git a/include/crypto/xform.h b/include/crypto/xform.h
index 2e14495c29f..ad6b7ad4086 100644
--- a/include/crypto/xform.h
+++ b/include/crypto/xform.h
@@ -113,6 +113,7 @@ extern const struct enc_xform enc_xform_aes_ofb;
extern const struct enc_xform enc_xform_aes_cfb_8;
extern const struct enc_xform enc_xform_aes_cfb_128;
extern const struct enc_xform enc_xform_chacha20;
+extern const struct enc_xform enc_xform_chacha20_djb;
extern const struct enc_xform enc_xform_chacha20_poly1305;
extern const struct enc_xform enc_xform_null;
