crypto: add CRYPTO_CHACHA20_DJB variant (64-bit counter/nonce)

CRYPTO_CHACHA20 implements the RFC 8439/IETF parameterization (32-bit
counter + 96-bit nonce). SSH's chacha20-poly1305@openssh.com uses the
original DJB construction instead: a 64-bit block counter in state
words 12..13 and a 64-bit nonce in words 14..15 (libtomcrypt's
chacha_ivctr64). The two layouts produce different keystreams for the
same key, so an SSH server cannot interoperate with OpenSSH clients
through the IETF variant.

Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
This commit is contained in:
Felipe Moura 2026-07-10 18:48:43 -03:00 committed by Alan C. Assis
parent 6d62533e4d
commit 5e2ce6190d
7 changed files with 49 additions and 1 deletions

View file

@ -36,6 +36,8 @@ int chacha20_setkey(FAR void *, FAR uint8_t *, int);
void chacha20_reinit(caddr_t, FAR uint8_t *);
void chacha20_crypt(caddr_t, FAR uint8_t *, size_t);
void chachapoly_reinit(caddr_t, FAR uint8_t *);
int chacha20_djb_setkey(FAR void *, FAR uint8_t *, int);
void chacha20_djb_reinit(caddr_t, FAR uint8_t *);
#define POLY1305_KEYLEN 64
#define POLY1305_TAGLEN 16

View file

@ -141,7 +141,8 @@
#define CRYPTO_ESN 40 /* Support for Extended Sequence Numbers */
#define CRYPTO_SHA2_224_HMAC 41
#define CRYPTO_CHACHA20 42
#define CRYPTO_ALGORITHM_MAX 42 /* Keep updated */
#define CRYPTO_CHACHA20_DJB 43
#define CRYPTO_ALGORITHM_MAX 43 /* Keep updated */
/* Algorithm flags */

View file

@ -113,6 +113,7 @@ extern const struct enc_xform enc_xform_aes_ofb;
extern const struct enc_xform enc_xform_aes_cfb_8;
extern const struct enc_xform enc_xform_aes_cfb_128;
extern const struct enc_xform enc_xform_chacha20;
extern const struct enc_xform enc_xform_chacha20_djb;
extern const struct enc_xform enc_xform_chacha20_poly1305;
extern const struct enc_xform enc_xform_null;