aboutsummaryrefslogtreecommitdiff
path: root/src/crypto
AgeCommit message (Collapse)Author
2023-09-20Add ability to specify SHA256 implementation for benchmark purposesHennadii Stepanov
2023-08-17crypto: make ChaCha20::SetKey wipe bufferPieter Wuille
2023-08-17crypto: require key on ChaCha20 initializationPieter Wuille
2023-08-17crypto: refactor ChaCha20 classes to use Span<std::byte> interfacePieter Wuille
2023-08-15refactor: add missing headers for BIP324 ciphersuitestratospher
2023-08-14crypto: BIP324 ciphersuite follow-upstratospher
follow-up to #28008. * move `dummy_tag` variable in FSChaCha20Poly1305 crypto_tests outside of the loop to be reused every time * use easy to read `cipher.last()` in `AEADChaCha20Poly1305::Decrypt()` * comment for initiator in `BIP324Cipher::Initialize()` * systematically damage ciphertext with bit positions in bip324_tests * use 4095 max bytes for aad in bip324 fuzz test
2023-07-26crypto: support split plaintext in ChaCha20Poly1305 Encrypt/DecryptPieter Wuille
2023-07-26crypto: add FSChaCha20Poly1305, rekeying wrapper around ChaCha20Poly1305Pieter Wuille
This adds the FSChaCha20Poly1305 AEAD as specified in BIP324, a wrapper around the ChaCha20Poly1305 AEAD (as specified in RFC8439 section 2.8) which automatically rekeys every N messages, and automatically increments the nonce every message.
2023-07-26crypto: add FSChaCha20, a rekeying wrapper around ChaCha20Pieter Wuille
This adds the FSChaCha20 stream cipher as specified in BIP324, a wrapper around the ChaCha20 stream cipher (specified in RFC8439 section 2.4) which automatically rekeys every N messages, and manages the nonces used for encryption. Co-authored-by: dhruv <856960+dhruv@users.noreply.github.com>
2023-07-26crypto: add the ChaCha20Poly1305 AEAD as specified in RFC8439Pieter Wuille
This adds an implementation of the ChaCha20Poly1305 AEAD exactly matching the version specified in RFC8439 section 2.8, including tests and official test vectors.
2023-07-26crypto: remove outdated variant of ChaCha20Poly1305 AEADPieter Wuille
Remove the variant of ChaCha20Poly1305 AEAD that was previously added in anticipation of BIP324 using it. BIP324 was updated to instead use rekeying wrappers around otherwise unmodified versions of the ChaCha20 stream cipher and the ChaCha20Poly1305 AEAD as specified in RFC8439.
2023-07-24refactor: Remove unused C-style castsMarcoFalke
2023-07-19Merge bitcoin/bitcoin#28085: refactor: use Span for SipHash::WriteAndrew Chow
7d92b1430a6fd42c4438810640576830d0ff8d13 refactor: use Span for SipHash::Write (Sebastian Falbesoner) Pull request description: This simple refactoring PR changes the interface for the `SipHash` arbitrary-data `Write` method to take a `Span<unsigned char>` instead of having to pass data and length. (`Span<std::byte>` seems to be more modern, but vectors of `unsigned char` are still used prety much everywhere where SipHash is called, and I didn't find it very appealing having to clutter the code with `Make(Writable)ByteSpan` helpers). ACKs for top commit: sipa: utACK 7d92b1430a6fd42c4438810640576830d0ff8d13 MarcoFalke: lgtm ACK 7d92b1430a6fd42c4438810640576830d0ff8d13 achow101: ACK 7d92b1430a6fd42c4438810640576830d0ff8d13 Tree-SHA512: f17a27013c942aead4b09f5a64e0c3ff8dbc7e83fe63eb9a2e3ace8be9921c9cbba3ec67e3e83fbe3332ca941c42370efd059e702c060f9b508307e9657c66f2
2023-07-17refactor: use Span for SipHash::WriteSebastian Falbesoner
Co-authored-by: MarcoFalke <*~=`'#}+{/-|&$^_@721217.xyz>
2023-07-12Switch all callers from poly1305_auth to Poly1305 classPieter Wuille
This also removes the old poly1305_auth interface, as it no longer serves any function. The new Poly1305 class based interface is more modern and safe.
2023-07-12crypto: add Poly1305 class with std::byte Span interfacePieter Wuille
2023-07-12crypto: switch poly1305 to incremental implementationPieter Wuille
This code is taken from poly1305-donna-32.h, poly1305-donna.h, poly1305-donna.c from https://github.com/floodyberry/poly1305-donna, commit e6ad6e091d30d7f4ec2d4f978be1fcfcbce72781, with the following modifications: * Coding style (braces around one-line indented if/for loops). * Rename unsigned long (long) to uint32_t and uint64_t. * Rename poly1305_block_size to POLY1305_BLOCK_SIZE. * Adding noexcept to functions. * Merging poly1305_state_internal_t and poly1305_context types. * Merging code from multiple files. * Place all imported code in the poly1305_donna namespace.
2023-07-07crypto: Implement RFC8439-compatible variant of ChaCha20Pieter Wuille
There are two variants of ChaCha20 in use. The original one uses a 64-bit nonce and a 64-bit block counter, while the one used in RFC8439 uses a 96-bit nonce and 32-bit block counter. This commit changes the interface to use the 96/32 split (but automatically incrementing the first 32-bit part of the nonce when the 32-bit block counter overflows, so to retain compatibility with >256 GiB output). Simultaneously, also merge the SetIV and Seek64 functions, as we almost always call both anyway. Co-authored-by: dhruv <856960+dhruv@users.noreply.github.com>
2023-05-04scripted-diff: Use platform-agnostic `ALWAYS_INLINE` macroHennadii Stepanov
-BEGIN VERIFY SCRIPT- sed -i 's/ inline __attribute__((always_inline)) / ALWAYS_INLINE /g' $(git grep -l "inline __attribute__((always_inline))") sed -i 's/ inline __attribute__((always_inline)) / ALWAYS_INLINE /g' $(git grep -l "inline __attribute__((always_inline))") -END VERIFY SCRIPT-
2023-05-04Introduce platform-agnostic `ALWAYS_INLINE` macroHennadii Stepanov
`<attributes.h>` has been included in anticipation of the following commit.
2023-02-15Merge bitcoin/bitcoin#26153: Reduce wasted pseudorandom bytes in ChaCha20 + ↵fanquake
various improvements 511aa4f1c7508f15cab8d7e58007900ad6fd3d5d Add unit test for ChaCha20's new caching (Pieter Wuille) fb243d25f754da8f01793b41e2d225b917f3e5d7 Improve test vectors for ChaCha20 (Pieter Wuille) 93aee8bbdad808b7009279b67470d496cc26b936 Inline ChaCha20 32-byte specific constants (Pieter Wuille) 62ec713961ade7b58e90c905395558a41e8a59f0 Only support 32-byte keys in ChaCha20{,Aligned} (Pieter Wuille) f21994a02e1cc46d41995581b54222abc655be93 Use ChaCha20Aligned in MuHash3072 code (Pieter Wuille) 5d16f757639e2cc6e81db6e07bc1d5dd74abca6c Use ChaCha20 caching in FastRandomContext (Pieter Wuille) 38eaece67b1bc37b2f502348c5d7537480a34346 Add fuzz test for testing that ChaCha20 works as a stream (Pieter Wuille) 5f05b27841af0bed1b6e7de5f46ffe33e5919e4d Add xoroshiro128++ PRNG (Martin Leitner-Ankerl) 12ff72476ac0dbf8add736ad3fb5fad2eeab156c Make unrestricted ChaCha20 cipher not waste keystream bytes (Pieter Wuille) 6babf402130a8f3ef3058594750aeaa50b8f5044 Rename ChaCha20::Seek -> Seek64 to clarify multiple of 64 (Pieter Wuille) e37bcaa0a6dbb334ab6e817efcb609ccee6edc39 Split ChaCha20 into aligned/unaligned variants (Pieter Wuille) Pull request description: This is an alternative to #25354 (by my benchmarking, somewhat faster), subsumes #25712, and adds additional test vectors. It separates the multiple-of-64-bytes-only "core" logic (which becomes simpler) from a layer around which performs caching/slicing to support arbitrary byte amounts. Both have their uses (in particular, the MuHash3072 code can benefit from multiple-of-64-bytes assumptions), plus the separation results in more readable code. Also, since FastRandomContext effectively had its own (more naive) caching on top of ChaCha20, that can be dropped in favor of ChaCha20's new built-in caching. I thought about rebasing #25712 on top of this, but the changes before are fairly extensive, so redid it instead. ACKs for top commit: ajtowns: ut reACK 511aa4f1c7508f15cab8d7e58007900ad6fd3d5d dhruv: tACK crACK 511aa4f1c7 Tree-SHA512: 3aa80971322a93e780c75a8d35bd39da3a9ea570fbae4491eaf0c45242f5f670a24a592c50ad870d5fd09b9f88ec06e274e8aa3cefd9561d623c63f7198cf2c7
2023-01-31clang-tidy: Fix `modernize-use-default-member-init` in headersHennadii Stepanov
See https://clang.llvm.org/extra/clang-tidy/checks/modernize/use-default-member-init.html
2023-01-30Inline ChaCha20 32-byte specific constantsPieter Wuille
2023-01-30Only support 32-byte keys in ChaCha20{,Aligned}Pieter Wuille
2023-01-30Use ChaCha20Aligned in MuHash3072 codePieter Wuille
2023-01-30Make unrestricted ChaCha20 cipher not waste keystream bytesPieter Wuille
Co-authored-by: dhruv <856960+dhruv@users.noreply.github.com>
2023-01-30Rename ChaCha20::Seek -> Seek64 to clarify multiple of 64Pieter Wuille
2023-01-30Split ChaCha20 into aligned/unaligned variantsPieter Wuille
2023-01-03refactor: use braced init for integer constants instead of c style castsPasta
2022-12-24scripted-diff: Bump copyright headersHennadii Stepanov
-BEGIN VERIFY SCRIPT- ./contrib/devtools/copyright_header.py update ./ -END VERIFY SCRIPT- Commits of previous years: - 2021: f47dda2c58b5d8d623e0e7ff4e74bc352dfa83d7 - 2020: fa0074e2d82928016a43ca408717154a1c70a4db - 2019: aaaaad6ac95b402fe18d019d67897ced6b316ee0
2022-10-26Fix typo in comment SHA256->SHA512Elichai Turkel
2022-09-23refactor: use <cstdlib> over stdlib.hfanquake
We currently use both. Consolidate on the former.
2022-07-20Use HashWriter where possibleMacroFake
2022-06-10build: test for timingsafe_bcmpfanquake
Code introduced in #15649 added usage of `timingsafe_bcmp()`, if available, otherwise falling back to our own implementation. However the relevant build system check was never added, so currently, we'll always just use our implementation, as HAVE_TIMINGSAFE_BCMP will never be defined. Add the check for timingsafe_bcmp. Note that as far as I'm aware, it's only available on OpenBSD.
2022-05-04Unroll the ChaCha20 inner loop for performancePieter Wuille
2022-04-05refactor: Use [[maybe_unused]] attributeHennadii Stepanov
2022-04-05refactor: Drop unneeded workarounds aimed to silence unused warningHennadii Stepanov
All of the touched symbols are indeed used regardless of any macros.
2022-02-17doc: Fix typosTaeik Lim
2022-02-14Merge bitcoin/bitcoin#24115: ARMv8 SHA2 Intrinsicslaanwj
aaa1d03d3acebeb44fdd40a302f086aad3d329ce Add optimized sha256d64_arm_shani::Transform_2way (Pieter Wuille) fe0629852aaf3a26f291bfa535e7e455fe7bea06 Implement sha256_arm_shani::Transform (Pavol Rusnak) 48a72fa81f80c8a3c7c6de8339b5feb361dece1c Add sha256_arm_shani to build system (Pavol Rusnak) c2b79342506e24e9b7100fb7a6025dc870375ef6 Rename SHANI to X86_SHANI to allow future implementation of ARM_SHANI (Pavol Rusnak) Pull request description: This PR adds support for ARMv8 SHA2 Intrinsics. Fixes https://github.com/bitcoin/bitcoin/issues/13401 and https://github.com/bitcoin/bitcoin/issues/17414 * Integration part was done by me. * The original SHA2 NI code comes from https://github.com/noloader/SHA-Intrinsics/blob/master/sha256-arm.c * Minor optimizations from https://github.com/rollmeister/bitcoin-armv8/blob/master/src/crypto/sha256.cpp are applied too. * The 2-way transform added by @sipa ACKs for top commit: laanwj: Code review and lightly tested ACK aaa1d03d3acebeb44fdd40a302f086aad3d329ce Tree-SHA512: 9689d6390c004269cb1ee79ed05430d7d35a6efef2554a2b6732f7258a11e7e959b3306c04b4e8637a9623fb4c12d1c1b3592da0ff0dc6d737932db302509669
2022-01-30doc: Fix typos pointed out by lint-spellingbrunoerg
2022-01-28Add optimized sha256d64_arm_shani::Transform_2wayPieter Wuille
2022-01-28Implement sha256_arm_shani::TransformPavol Rusnak
Co-Authored-By: Rauli Kumpulainen <rauliweb@gmail.com> Co-Authored-By: Pieter Wuille <pieter@wuille.net>
2022-01-28Add sha256_arm_shani to build systemPavol Rusnak
Also rename AArch64 intrinsics to ARMv8 intrinsics as these are not necessarily limited to 64-bit
2022-01-28Rename SHANI to X86_SHANI to allow future implementation of ARM_SHANIPavol Rusnak
2021-12-30scripted-diff: Bump copyright headersHennadii Stepanov
-BEGIN VERIFY SCRIPT- ./contrib/devtools/copyright_header.py update ./ -END VERIFY SCRIPT- Commits of previous years: * 2020: fa0074e2d82928016a43ca408717154a1c70a4db * 2019: aaaaad6ac95b402fe18d019d67897ced6b316ee0
2021-12-13build: use __SIZEOF_INT128__ for checking __int128 availabilityfanquake
We already use this in the blockfilter code, so not sure we need to maintain two different ways of testing for the same functionality. Consolidate on testing for __SIZEOF_INT128__, which we already use, is supported by the compilers we care about, and is also used by libsecp256k1.
2021-10-20Fix K1/K2 use in the comments in ChaCha20-Poly1305 AEAD=
This is done for the ChaCha20-Poly1305 AEAD test vector and for the K1/K2 ChaCha20 cipher instances in chacha_poly_aead.h
2021-06-23[crypto] Fix K1/K2 use in ChaCha20-Poly1305 AEADDhruv Mehta
BIP324 mentions K1 is used for the associated data and K2 is used for the payload. The code does the opposite. This is not a security problem but will be a problem across implementations based on the HKDF key derivations.
2021-04-19crypto: Make MuHash Remove method efficientFabian Jahr
Division of MuHash objects are very expensive and multiplication relatively cheap. The whole idea of introducing and tracking numerator and denominators seperately as a representation of the internal state was so that divisions would be rare. So using divison in the Remove method did not make any sense and was just a silly mistake which is corrected here.
2021-01-24refactor: Improve encapsulation between MuHash3072 and Num3072Fabian Jahr
Also fixes a typo.
generated by cgit v1.2.3 (git 2.26.2) at 2024-09-18 09:13:12 +0000