| | | 1 | | using System; |
| | | 2 | | using System.Collections.Generic; |
| | | 3 | | |
| | | 4 | | namespace Renci.SshNet.Security.Chaos.NaCl.Internal.Salsa |
| | | 5 | | { |
| | | 6 | | internal static class SalsaCore |
| | | 7 | | { |
| | | 8 | | internal static void HSalsa(out Array16<UInt32> output, ref Array16<UInt32> input, int rounds) |
| | 0 | 9 | | { |
| | 0 | 10 | | InternalAssert.Assert(rounds % 2 == 0, "Number of salsa rounds must be even"); |
| | | 11 | | |
| | 0 | 12 | | int doubleRounds = rounds / 2; |
| | | 13 | | |
| | 0 | 14 | | UInt32 x0 = input.x0; |
| | 0 | 15 | | UInt32 x1 = input.x1; |
| | 0 | 16 | | UInt32 x2 = input.x2; |
| | 0 | 17 | | UInt32 x3 = input.x3; |
| | 0 | 18 | | UInt32 x4 = input.x4; |
| | 0 | 19 | | UInt32 x5 = input.x5; |
| | 0 | 20 | | UInt32 x6 = input.x6; |
| | 0 | 21 | | UInt32 x7 = input.x7; |
| | 0 | 22 | | UInt32 x8 = input.x8; |
| | 0 | 23 | | UInt32 x9 = input.x9; |
| | 0 | 24 | | UInt32 x10 = input.x10; |
| | 0 | 25 | | UInt32 x11 = input.x11; |
| | 0 | 26 | | UInt32 x12 = input.x12; |
| | 0 | 27 | | UInt32 x13 = input.x13; |
| | 0 | 28 | | UInt32 x14 = input.x14; |
| | 0 | 29 | | UInt32 x15 = input.x15; |
| | | 30 | | |
| | | 31 | | unchecked |
| | 0 | 32 | | { |
| | 0 | 33 | | for (int i = 0; i < doubleRounds; i++) |
| | 0 | 34 | | { |
| | | 35 | | UInt32 y; |
| | | 36 | | |
| | | 37 | | // row 0 |
| | 0 | 38 | | y = x0 + x12; |
| | 0 | 39 | | x4 ^= (y << 7) | (y >> (32 - 7)); |
| | 0 | 40 | | y = x4 + x0; |
| | 0 | 41 | | x8 ^= (y << 9) | (y >> (32 - 9)); |
| | 0 | 42 | | y = x8 + x4; |
| | 0 | 43 | | x12 ^= (y << 13) | (y >> (32 - 13)); |
| | 0 | 44 | | y = x12 + x8; |
| | 0 | 45 | | x0 ^= (y << 18) | (y >> (32 - 18)); |
| | | 46 | | |
| | | 47 | | // row 1 |
| | 0 | 48 | | y = x5 + x1; |
| | 0 | 49 | | x9 ^= (y << 7) | (y >> (32 - 7)); |
| | 0 | 50 | | y = x9 + x5; |
| | 0 | 51 | | x13 ^= (y << 9) | (y >> (32 - 9)); |
| | 0 | 52 | | y = x13 + x9; |
| | 0 | 53 | | x1 ^= (y << 13) | (y >> (32 - 13)); |
| | 0 | 54 | | y = x1 + x13; |
| | 0 | 55 | | x5 ^= (y << 18) | (y >> (32 - 18)); |
| | | 56 | | |
| | | 57 | | // row 2 |
| | 0 | 58 | | y = x10 + x6; |
| | 0 | 59 | | x14 ^= (y << 7) | (y >> (32 - 7)); |
| | 0 | 60 | | y = x14 + x10; |
| | 0 | 61 | | x2 ^= (y << 9) | (y >> (32 - 9)); |
| | 0 | 62 | | y = x2 + x14; |
| | 0 | 63 | | x6 ^= (y << 13) | (y >> (32 - 13)); |
| | 0 | 64 | | y = x6 + x2; |
| | 0 | 65 | | x10 ^= (y << 18) | (y >> (32 - 18)); |
| | | 66 | | |
| | | 67 | | // row 3 |
| | 0 | 68 | | y = x15 + x11; |
| | 0 | 69 | | x3 ^= (y << 7) | (y >> (32 - 7)); |
| | 0 | 70 | | y = x3 + x15; |
| | 0 | 71 | | x7 ^= (y << 9) | (y >> (32 - 9)); |
| | 0 | 72 | | y = x7 + x3; |
| | 0 | 73 | | x11 ^= (y << 13) | (y >> (32 - 13)); |
| | 0 | 74 | | y = x11 + x7; |
| | 0 | 75 | | x15 ^= (y << 18) | (y >> (32 - 18)); |
| | | 76 | | |
| | | 77 | | // column 0 |
| | 0 | 78 | | y = x0 + x3; |
| | 0 | 79 | | x1 ^= (y << 7) | (y >> (32 - 7)); |
| | 0 | 80 | | y = x1 + x0; |
| | 0 | 81 | | x2 ^= (y << 9) | (y >> (32 - 9)); |
| | 0 | 82 | | y = x2 + x1; |
| | 0 | 83 | | x3 ^= (y << 13) | (y >> (32 - 13)); |
| | 0 | 84 | | y = x3 + x2; |
| | 0 | 85 | | x0 ^= (y << 18) | (y >> (32 - 18)); |
| | | 86 | | |
| | | 87 | | // column 1 |
| | 0 | 88 | | y = x5 + x4; |
| | 0 | 89 | | x6 ^= (y << 7) | (y >> (32 - 7)); |
| | 0 | 90 | | y = x6 + x5; |
| | 0 | 91 | | x7 ^= (y << 9) | (y >> (32 - 9)); |
| | 0 | 92 | | y = x7 + x6; |
| | 0 | 93 | | x4 ^= (y << 13) | (y >> (32 - 13)); |
| | 0 | 94 | | y = x4 + x7; |
| | 0 | 95 | | x5 ^= (y << 18) | (y >> (32 - 18)); |
| | | 96 | | |
| | | 97 | | // column 2 |
| | 0 | 98 | | y = x10 + x9; |
| | 0 | 99 | | x11 ^= (y << 7) | (y >> (32 - 7)); |
| | 0 | 100 | | y = x11 + x10; |
| | 0 | 101 | | x8 ^= (y << 9) | (y >> (32 - 9)); |
| | 0 | 102 | | y = x8 + x11; |
| | 0 | 103 | | x9 ^= (y << 13) | (y >> (32 - 13)); |
| | 0 | 104 | | y = x9 + x8; |
| | 0 | 105 | | x10 ^= (y << 18) | (y >> (32 - 18)); |
| | | 106 | | |
| | | 107 | | // column 3 |
| | 0 | 108 | | y = x15 + x14; |
| | 0 | 109 | | x12 ^= (y << 7) | (y >> (32 - 7)); |
| | 0 | 110 | | y = x12 + x15; |
| | 0 | 111 | | x13 ^= (y << 9) | (y >> (32 - 9)); |
| | 0 | 112 | | y = x13 + x12; |
| | 0 | 113 | | x14 ^= (y << 13) | (y >> (32 - 13)); |
| | 0 | 114 | | y = x14 + x13; |
| | 0 | 115 | | x15 ^= (y << 18) | (y >> (32 - 18)); |
| | 0 | 116 | | } |
| | 0 | 117 | | } |
| | | 118 | | |
| | 0 | 119 | | output.x0 = x0; |
| | 0 | 120 | | output.x1 = x1; |
| | 0 | 121 | | output.x2 = x2; |
| | 0 | 122 | | output.x3 = x3; |
| | 0 | 123 | | output.x4 = x4; |
| | 0 | 124 | | output.x5 = x5; |
| | 0 | 125 | | output.x6 = x6; |
| | 0 | 126 | | output.x7 = x7; |
| | 0 | 127 | | output.x8 = x8; |
| | 0 | 128 | | output.x9 = x9; |
| | 0 | 129 | | output.x10 = x10; |
| | 0 | 130 | | output.x11 = x11; |
| | 0 | 131 | | output.x12 = x12; |
| | 0 | 132 | | output.x13 = x13; |
| | 0 | 133 | | output.x14 = x14; |
| | 0 | 134 | | output.x15 = x15; |
| | 0 | 135 | | } |
| | | 136 | | |
| | | 137 | | internal static void Salsa(out Array16<UInt32> output, ref Array16<UInt32> input, int rounds) |
| | 0 | 138 | | { |
| | | 139 | | Array16<UInt32> temp; |
| | 0 | 140 | | HSalsa(out temp, ref input, rounds); |
| | | 141 | | unchecked |
| | 0 | 142 | | { |
| | 0 | 143 | | output.x0 = temp.x0 + input.x0; |
| | 0 | 144 | | output.x1 = temp.x1 + input.x1; |
| | 0 | 145 | | output.x2 = temp.x2 + input.x2; |
| | 0 | 146 | | output.x3 = temp.x3 + input.x3; |
| | 0 | 147 | | output.x4 = temp.x4 + input.x4; |
| | 0 | 148 | | output.x5 = temp.x5 + input.x5; |
| | 0 | 149 | | output.x6 = temp.x6 + input.x6; |
| | 0 | 150 | | output.x7 = temp.x7 + input.x7; |
| | 0 | 151 | | output.x8 = temp.x8 + input.x8; |
| | 0 | 152 | | output.x9 = temp.x9 + input.x9; |
| | 0 | 153 | | output.x10 = temp.x10 + input.x10; |
| | 0 | 154 | | output.x11 = temp.x11 + input.x11; |
| | 0 | 155 | | output.x12 = temp.x12 + input.x12; |
| | 0 | 156 | | output.x13 = temp.x13 + input.x13; |
| | 0 | 157 | | output.x14 = temp.x14 + input.x14; |
| | 0 | 158 | | output.x15 = temp.x15 + input.x15; |
| | 0 | 159 | | } |
| | 0 | 160 | | } |
| | | 161 | | |
| | | 162 | | /*internal static void SalsaCore(int[] output, int outputOffset, int[] input, int inputOffset, int rounds) |
| | | 163 | | { |
| | | 164 | | if (rounds % 2 != 0) |
| | | 165 | | throw new ArgumentException("rounds must be even"); |
| | | 166 | | } |
| | | 167 | | |
| | | 168 | | |
| | | 169 | | static void store_littleendian(unsigned char *x,uint32 u) |
| | | 170 | | { |
| | | 171 | | x[0] = u; u >>= 8; |
| | | 172 | | x[1] = u; u >>= 8; |
| | | 173 | | x[2] = u; u >>= 8; |
| | | 174 | | x[3] = u; |
| | | 175 | | } |
| | | 176 | | |
| | | 177 | | internal static void HSalsaCore(int[] output, int outputOffset, int[] input, int inputOffset, int rounds) |
| | | 178 | | { |
| | | 179 | | if (rounds % 2 != 0) |
| | | 180 | | throw new ArgumentException("rounds must be even"); |
| | | 181 | | static uint32 rotate(uint32 u,int c) |
| | | 182 | | { |
| | | 183 | | return (u << c) | (u >> (32 - c)); |
| | | 184 | | } |
| | | 185 | | |
| | | 186 | | |
| | | 187 | | |
| | | 188 | | int crypto_core( |
| | | 189 | | unsigned char *out, |
| | | 190 | | const unsigned char *in, |
| | | 191 | | const unsigned char *k, |
| | | 192 | | const unsigned char *c |
| | | 193 | | ) |
| | | 194 | | { |
| | | 195 | | uint32 x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15; |
| | | 196 | | int i; |
| | | 197 | | |
| | | 198 | | x0 = load_littleendian(c + 0); |
| | | 199 | | x1 = load_littleendian(k + 0); |
| | | 200 | | x2 = load_littleendian(k + 4); |
| | | 201 | | x3 = load_littleendian(k + 8); |
| | | 202 | | x4 = load_littleendian(k + 12); |
| | | 203 | | x5 = load_littleendian(c + 4); |
| | | 204 | | x6 = load_littleendian(in + 0); |
| | | 205 | | x7 = load_littleendian(in + 4); |
| | | 206 | | x8 = load_littleendian(in + 8); |
| | | 207 | | x9 = load_littleendian(in + 12); |
| | | 208 | | x10 = load_littleendian(c + 8); |
| | | 209 | | x11 = load_littleendian(k + 16); |
| | | 210 | | x12 = load_littleendian(k + 20); |
| | | 211 | | x13 = load_littleendian(k + 24); |
| | | 212 | | x14 = load_littleendian(k + 28); |
| | | 213 | | x15 = load_littleendian(c + 12); |
| | | 214 | | |
| | | 215 | | for (i = ROUNDS;i > 0;i -= 2) { |
| | | 216 | | x4 ^= rotate( x0+x12, 7); |
| | | 217 | | x8 ^= rotate( x4+ x0, 9); |
| | | 218 | | x12 ^= rotate( x8+ x4,13); |
| | | 219 | | x0 ^= rotate(x12+ x8,18); |
| | | 220 | | x9 ^= rotate( x5+ x1, 7); |
| | | 221 | | x13 ^= rotate( x9+ x5, 9); |
| | | 222 | | x1 ^= rotate(x13+ x9,13); |
| | | 223 | | x5 ^= rotate( x1+x13,18); |
| | | 224 | | x14 ^= rotate(x10+ x6, 7); |
| | | 225 | | x2 ^= rotate(x14+x10, 9); |
| | | 226 | | x6 ^= rotate( x2+x14,13); |
| | | 227 | | x10 ^= rotate( x6+ x2,18); |
| | | 228 | | x3 ^= rotate(x15+x11, 7); |
| | | 229 | | x7 ^= rotate( x3+x15, 9); |
| | | 230 | | x11 ^= rotate( x7+ x3,13); |
| | | 231 | | x15 ^= rotate(x11+ x7,18); |
| | | 232 | | x1 ^= rotate( x0+ x3, 7); |
| | | 233 | | x2 ^= rotate( x1+ x0, 9); |
| | | 234 | | x3 ^= rotate( x2+ x1,13); |
| | | 235 | | x0 ^= rotate( x3+ x2,18); |
| | | 236 | | x6 ^= rotate( x5+ x4, 7); |
| | | 237 | | x7 ^= rotate( x6+ x5, 9); |
| | | 238 | | x4 ^= rotate( x7+ x6,13); |
| | | 239 | | x5 ^= rotate( x4+ x7,18); |
| | | 240 | | x11 ^= rotate(x10+ x9, 7); |
| | | 241 | | x8 ^= rotate(x11+x10, 9); |
| | | 242 | | x9 ^= rotate( x8+x11,13); |
| | | 243 | | x10 ^= rotate( x9+ x8,18); |
| | | 244 | | x12 ^= rotate(x15+x14, 7); |
| | | 245 | | x13 ^= rotate(x12+x15, 9); |
| | | 246 | | x14 ^= rotate(x13+x12,13); |
| | | 247 | | x15 ^= rotate(x14+x13,18); |
| | | 248 | | } |
| | | 249 | | |
| | | 250 | | store_littleendian(out + 0,x0); |
| | | 251 | | store_littleendian(out + 4,x5); |
| | | 252 | | store_littleendian(out + 8,x10); |
| | | 253 | | store_littleendian(out + 12,x15); |
| | | 254 | | store_littleendian(out + 16,x6); |
| | | 255 | | store_littleendian(out + 20,x7); |
| | | 256 | | store_littleendian(out + 24,x8); |
| | | 257 | | store_littleendian(out + 28,x9); |
| | | 258 | | |
| | | 259 | | return 0; |
| | | 260 | | }*/ |
| | | 261 | | |
| | | 262 | | } |
| | | 263 | | } |