crypto: add support for ChaCha20/Policy1305 AEAD cipher

1 files changed, 156 insertions, 2 deletions

diff --git a/lib/crypto/c_src/crypto.c b/lib/crypto/c_src/crypto.c
index d08f0ae26b..27b4e7abbd 100644
--- a/lib/crypto/c_src/crypto.c
+++ b/lib/crypto/c_src/crypto.c
@@ -93,13 +93,28 @@
 # define HAVE_GCM
 #endif
 
+#if defined(NID_chacha20) && !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305)
+# define HAVE_CHACHA20_POLY1305
+#endif
+
 #if defined(HAVE_EC)
 #include <openssl/ec.h>
 #include <openssl/ecdh.h>
 #include <openssl/ecdsa.h>
 #endif
 
+#if defined(HAVE_CHACHA20_POLY1305)
+#include <openssl/chacha.h>
+#include <openssl/poly1305.h>
+
+#if !defined(CHACHA20_NONCE_LEN)
+# define CHACHA20_NONCE_LEN 8
+#endif
+#if !defined(POLY1305_TAG_LEN)
+# define POLY1305_TAG_LEN 16
+#endif
 
+#endif
 
 #ifdef VALGRIND
     #  include <valgrind/memcheck.h>
@@ -268,6 +283,9 @@ static ERL_NIF_TERM rand_seed_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM a
 static ERL_NIF_TERM aes_gcm_encrypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
 static ERL_NIF_TERM aes_gcm_decrypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
 
+static ERL_NIF_TERM chacha20_poly1305_encrypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
+static ERL_NIF_TERM chacha20_poly1305_decrypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]);
+
 /* helpers */
 static void init_algorithms_types(ErlNifEnv*);
 static void init_digest_types(ErlNifEnv* env);
@@ -400,7 +418,11 @@ static ErlNifFunc nif_funcs[] = {
     {"rand_seed_nif", 1, rand_seed_nif},
 
     {"aes_gcm_encrypt", 4, aes_gcm_encrypt},
-    {"aes_gcm_decrypt", 5, aes_gcm_decrypt}
+    {"aes_gcm_decrypt", 5, aes_gcm_decrypt},
+
+    {"chacha20_poly1305_encrypt", 4, chacha20_poly1305_encrypt},
+    {"chacha20_poly1305_decrypt", 5, chacha20_poly1305_decrypt}
+
 
 };
 
@@ -717,7 +739,7 @@ static ERL_NIF_TERM algo_hash[8];   /* increase when extending the list */
 static int algo_pubkey_cnt;
 static ERL_NIF_TERM algo_pubkey[3]; /* increase when extending the list */
 static int algo_cipher_cnt;
-static ERL_NIF_TERM algo_cipher[3]; /* increase when extending the list */
+static ERL_NIF_TERM algo_cipher[4]; /* increase when extending the list */
 
 static void init_algorithms_types(ErlNifEnv* env)
 {
@@ -758,6 +780,9 @@ static void init_algorithms_types(ErlNifEnv* env)
 #if defined(HAVE_GCM)
     algo_cipher[algo_cipher_cnt++] = enif_make_atom(env,"aes_gcm");
 #endif
+#if defined(HAVE_CHACHA20_POLY1305)
+    algo_cipher[algo_cipher_cnt++] = enif_make_atom(env,"chacha20_poly1305");
+#endif
 
     ASSERT(algo_hash_cnt <= sizeof(algo_hash)/sizeof(ERL_NIF_TERM));
     ASSERT(algo_pubkey_cnt <= sizeof(algo_pubkey)/sizeof(ERL_NIF_TERM));
@@ -1856,6 +1881,135 @@ out_err:
 #endif
 }
 
+#if defined(HAVE_CHACHA20_POLY1305)
+static void
+poly1305_update_with_length(poly1305_state *poly1305,
+			    const unsigned char *data, size_t data_len)
+{
+        size_t j = data_len;
+        unsigned char length_bytes[8];
+        unsigned i;
+
+        for (i = 0; i < sizeof(length_bytes); i++) {
+                length_bytes[i] = j;
+                j >>= 8;
+        }
+
+        CRYPTO_poly1305_update(poly1305, data, data_len);
+        CRYPTO_poly1305_update(poly1305, length_bytes, sizeof(length_bytes));
+}
+#endif
+
+static ERL_NIF_TERM chacha20_poly1305_encrypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
+{/* (Key,Iv,AAD,In) */
+#if defined(HAVE_CHACHA20_POLY1305)
+    ErlNifBinary key, iv, aad, in;
+    unsigned char *outp;
+    ERL_NIF_TERM out, out_tag;
+    ErlNifUInt64 in_len_64;
+    unsigned char poly1305_key[32];
+    poly1305_state poly1305;
+
+    CHECK_OSE_CRYPTO();
+
+    if (!enif_inspect_iolist_as_binary(env, argv[0], &key) || key.size != 32
+	|| !enif_inspect_binary(env, argv[1], &iv) || iv.size != CHACHA20_NONCE_LEN
+	|| !enif_inspect_iolist_as_binary(env, argv[2], &aad)
+	|| !enif_inspect_iolist_as_binary(env, argv[3], &in)) {
+	return enif_make_badarg(env);
+    }
+
+    /* Take from OpenSSL patch set/LibreSSL:
+     *
+     * The underlying ChaCha implementation may not overflow the block
+     * counter into the second counter word. Therefore we disallow
+     * individual operations that work on more than 2TB at a time.
+     * in_len_64 is needed because, on 32-bit platforms, size_t is only
+     * 32-bits and this produces a warning because it's always false.
+     * Casting to uint64_t inside the conditional is not sufficient to stop
+     * the warning. */
+    in_len_64 = in.size;
+    if (in_len_64 >= (1ULL << 32) * 64 - 64)
+	return enif_make_badarg(env);
+
+    memset(poly1305_key, 0, sizeof(poly1305_key));
+    CRYPTO_chacha_20(poly1305_key, poly1305_key, sizeof(poly1305_key), key.data, iv.data, 0);
+
+    outp = enif_make_new_binary(env, in.size, &out);
+
+    CRYPTO_poly1305_init(&poly1305, poly1305_key);
+    poly1305_update_with_length(&poly1305, aad.data, aad.size);
+    CRYPTO_chacha_20(outp, in.data, in.size, key.data, iv.data, 1);
+    poly1305_update_with_length(&poly1305, outp, in.size);
+
+    CRYPTO_poly1305_finish(&poly1305, enif_make_new_binary(env, POLY1305_TAG_LEN, &out_tag));
+
+    CONSUME_REDS(env, in);
+
+    return enif_make_tuple2(env, out, out_tag);
+
+#else
+    return atom_notsup;
+#endif
+}
+
+static ERL_NIF_TERM chacha20_poly1305_decrypt(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
+{/* (Key,Iv,AAD,In,Tag) */
+#if defined(HAVE_CHACHA20_POLY1305)
+    ErlNifBinary key, iv, aad, in, tag;
+    unsigned char *outp;
+    ERL_NIF_TERM out;
+    ErlNifUInt64 in_len_64;
+    unsigned char poly1305_key[32];
+    unsigned char mac[POLY1305_TAG_LEN];
+    poly1305_state poly1305;
+
+    CHECK_OSE_CRYPTO();
+
+    if (!enif_inspect_iolist_as_binary(env, argv[0], &key) || key.size != 32
+	|| !enif_inspect_binary(env, argv[1], &iv) || iv.size != CHACHA20_NONCE_LEN
+	|| !enif_inspect_iolist_as_binary(env, argv[2], &aad)
+	|| !enif_inspect_iolist_as_binary(env, argv[3], &in)
+	|| !enif_inspect_iolist_as_binary(env, argv[4], &tag) || tag.size != POLY1305_TAG_LEN) {
+	return enif_make_badarg(env);
+    }
+
+    /* Take from OpenSSL patch set/LibreSSL:
+     *
+     * The underlying ChaCha implementation may not overflow the block
+     * counter into the second counter word. Therefore we disallow
+     * individual operations that work on more than 2TB at a time.
+     * in_len_64 is needed because, on 32-bit platforms, size_t is only
+     * 32-bits and this produces a warning because it's always false.
+     * Casting to uint64_t inside the conditional is not sufficient to stop
+     * the warning. */
+    in_len_64 = in.size;
+    if (in_len_64 >= (1ULL << 32) * 64 - 64)
+	return enif_make_badarg(env);
+
+    memset(poly1305_key, 0, sizeof(poly1305_key));
+    CRYPTO_chacha_20(poly1305_key, poly1305_key, sizeof(poly1305_key), key.data, iv.data, 0);
+
+    CRYPTO_poly1305_init(&poly1305, poly1305_key);
+    poly1305_update_with_length(&poly1305, aad.data, aad.size);
+    poly1305_update_with_length(&poly1305, in.data, in.size);
+    CRYPTO_poly1305_finish(&poly1305, mac);
+
+    if (memcmp(mac, tag.data, POLY1305_TAG_LEN) != 0)
+	return atom_error;
+
+    outp = enif_make_new_binary(env, in.size, &out);
+
+    CRYPTO_chacha_20(outp, in.data, in.size, key.data, iv.data, 1);
+
+    CONSUME_REDS(env, in);
+
+    return out;
+#else
+    return atom_notsup;
+#endif
+}
+
 static ERL_NIF_TERM rand_bytes_1(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
 {/* (Bytes) */     
     unsigned bytes;