Skip to content

Commit 28d1353

Browse files
laanwjlaanwj
committed
Merge #15649: Add ChaCha20Poly1305@Bitcoin AEAD
bb326ad Add ChaCha20Poly1305@Bitcoin AEAD benchmark (Jonas Schnelli) 99aea04 Add ChaCha20Poly1305@Bitcoin tests (Jonas Schnelli) af5d1b5 Add ChaCha20Poly1305@Bitcoin AEAD implementation (Jonas Schnelli) Pull request description: This adds a new AEAD (authenticated encryption with additional data) construct optimised for small messages (like used in Bitcoins p2p network). Includes: #15519, #15512 (please review those first). The construct is specified here. https://gist.github.com/jonasschnelli/c530ea8421b8d0e80c51486325587c52#ChaCha20Poly1305Bitcoin_Cipher_Suite This aims for being used in v2 peer-to-peer messages. ACKs for top commit: laanwj: code review ACK bb326ad Tree-SHA512: 15bcb86c510fce7abb7a73536ff2ae89893b24646bf108c6cf18f064d672dbbbea8b1dd0868849fdac0c6854e498f1345d01dab56d1c92031afd728302234686
2 parents 4fcccda + bb326ad commit 28d1353

File tree

6 files changed

+525
-1
lines changed

6 files changed

+525
-1
lines changed

‎src/Makefile.am

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -352,6 +352,8 @@ crypto_libbitcoin_crypto_base_a_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
352352
crypto_libbitcoin_crypto_base_a_SOURCES = \
353353
crypto/aes.cpp \
354354
crypto/aes.h \
355+
crypto/chacha_poly_aead.h \
356+
crypto/chacha_poly_aead.cpp \
355357
crypto/chacha20.h \
356358
crypto/chacha20.cpp \
357359
crypto/common.h \
@@ -614,7 +616,7 @@ bitcoin_wallet_LDADD += $(BOOST_LIBS) $(BDB_LIBS) $(CRYPTO_LIBS) $(EVENT_PTHREAD
614616
# bitcoinconsensus library #
615617
if BUILD_BITCOIN_LIBS
616618
include_HEADERS = script/bitcoinconsensus.h
617-
libbitcoinconsensus_la_SOURCES = $(crypto_libbitcoin_crypto_base_a_SOURCES) $(libbitcoin_consensus_a_SOURCES)
619+
libbitcoinconsensus_la_SOURCES = support/cleanse.cpp $(crypto_libbitcoin_crypto_base_a_SOURCES) $(libbitcoin_consensus_a_SOURCES)
618620

619621
if GLIBC_BACK_COMPAT
620622
libbitcoinconsensus_la_SOURCES += compat/glibc_compat.cpp

‎src/Makefile.bench.include

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ bench_bench_bitcoin_SOURCES = \
2424
bench/examples.cpp \
2525
bench/rollingbloom.cpp \
2626
bench/chacha20.cpp \
27+
bench/chacha_poly_aead.cpp \
2728
bench/crypto_hash.cpp \
2829
bench/ccoins_caching.cpp \
2930
bench/gcs_filter.cpp \

‎src/bench/chacha_poly_aead.cpp

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
// Copyright (c) 2019 The Bitcoin Core developers
2+
// Distributed under the MIT software license, see the accompanying
3+
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4+
5+
#include <iostream>
6+
7+
#include <bench/bench.h>
8+
#include <crypto/chacha_poly_aead.h>
9+
#include <crypto/poly1305.h> // for the POLY1305_TAGLEN constant
10+
#include <hash.h>
11+
12+
#include <limits>
13+
#include <assert.h>
14+
15+
/* Number of bytes to process per iteration */
16+
static constexpr uint64_t BUFFER_SIZE_TINY = 64;
17+
static constexpr uint64_t BUFFER_SIZE_SMALL = 256;
18+
static constexpr uint64_t BUFFER_SIZE_LARGE = 1024 * 1024;
19+
20+
static const unsigned char k1[32] = {0};
21+
static const unsigned char k2[32] = {0};
22+
23+
static ChaCha20Poly1305AEAD aead(k1, 32, k2, 32);
24+
25+
static void CHACHA20_POLY1305_AEAD(benchmark::State& state, size_t buffersize, bool include_decryption)
26+
{
27+
std::vector<unsigned char> in(buffersize + CHACHA20_POLY1305_AEAD_AAD_LEN + POLY1305_TAGLEN, 0);
28+
std::vector<unsigned char> out(buffersize + CHACHA20_POLY1305_AEAD_AAD_LEN + POLY1305_TAGLEN, 0);
29+
uint64_t seqnr_payload = 0;
30+
uint64_t seqnr_aad = 0;
31+
int aad_pos = 0;
32+
uint32_t len = 0;
33+
while (state.KeepRunning()) {
34+
// encrypt or decrypt the buffer with a static key
35+
assert(aead.Crypt(seqnr_payload, seqnr_aad, aad_pos, out.data(), out.size(), in.data(), buffersize, true));
36+
37+
if (include_decryption) {
38+
// if we decrypt, include the GetLength
39+
assert(aead.GetLength(&len, seqnr_aad, aad_pos, in.data()));
40+
assert(aead.Crypt(seqnr_payload, seqnr_aad, aad_pos, out.data(), out.size(), in.data(), buffersize, true));
41+
}
42+
43+
// increase main sequence number
44+
seqnr_payload++;
45+
// increase aad position (position in AAD keystream)
46+
aad_pos += CHACHA20_POLY1305_AEAD_AAD_LEN;
47+
if (aad_pos + CHACHA20_POLY1305_AEAD_AAD_LEN > CHACHA20_ROUND_OUTPUT) {
48+
aad_pos = 0;
49+
seqnr_aad++;
50+
}
51+
if (seqnr_payload + 1 == std::numeric_limits<uint64_t>::max()) {
52+
// reuse of nonce+key is okay while benchmarking.
53+
seqnr_payload = 0;
54+
seqnr_aad = 0;
55+
aad_pos = 0;
56+
}
57+
}
58+
}
59+
60+
static void CHACHA20_POLY1305_AEAD_64BYTES_ONLY_ENCRYPT(benchmark::State& state)
61+
{
62+
CHACHA20_POLY1305_AEAD(state, BUFFER_SIZE_TINY, false);
63+
}
64+
65+
static void CHACHA20_POLY1305_AEAD_256BYTES_ONLY_ENCRYPT(benchmark::State& state)
66+
{
67+
CHACHA20_POLY1305_AEAD(state, BUFFER_SIZE_SMALL, false);
68+
}
69+
70+
static void CHACHA20_POLY1305_AEAD_1MB_ONLY_ENCRYPT(benchmark::State& state)
71+
{
72+
CHACHA20_POLY1305_AEAD(state, BUFFER_SIZE_LARGE, false);
73+
}
74+
75+
static void CHACHA20_POLY1305_AEAD_64BYTES_ENCRYPT_DECRYPT(benchmark::State& state)
76+
{
77+
CHACHA20_POLY1305_AEAD(state, BUFFER_SIZE_TINY, true);
78+
}
79+
80+
static void CHACHA20_POLY1305_AEAD_256BYTES_ENCRYPT_DECRYPT(benchmark::State& state)
81+
{
82+
CHACHA20_POLY1305_AEAD(state, BUFFER_SIZE_SMALL, true);
83+
}
84+
85+
static void CHACHA20_POLY1305_AEAD_1MB_ENCRYPT_DECRYPT(benchmark::State& state)
86+
{
87+
CHACHA20_POLY1305_AEAD(state, BUFFER_SIZE_LARGE, true);
88+
}
89+
90+
// Add Hash() (dbl-sha256) bench for comparison
91+
92+
static void HASH(benchmark::State& state, size_t buffersize)
93+
{
94+
uint8_t hash[CHash256::OUTPUT_SIZE];
95+
std::vector<uint8_t> in(buffersize,0);
96+
while (state.KeepRunning())
97+
CHash256().Write(in.data(), in.size()).Finalize(hash);
98+
}
99+
100+
static void HASH_64BYTES(benchmark::State& state)
101+
{
102+
HASH(state, BUFFER_SIZE_TINY);
103+
}
104+
105+
static void HASH_256BYTES(benchmark::State& state)
106+
{
107+
HASH(state, BUFFER_SIZE_SMALL);
108+
}
109+
110+
static void HASH_1MB(benchmark::State& state)
111+
{
112+
HASH(state, BUFFER_SIZE_LARGE);
113+
}
114+
115+
BENCHMARK(CHACHA20_POLY1305_AEAD_64BYTES_ONLY_ENCRYPT, 500000);
116+
BENCHMARK(CHACHA20_POLY1305_AEAD_256BYTES_ONLY_ENCRYPT, 250000);
117+
BENCHMARK(CHACHA20_POLY1305_AEAD_1MB_ONLY_ENCRYPT, 340);
118+
BENCHMARK(CHACHA20_POLY1305_AEAD_64BYTES_ENCRYPT_DECRYPT, 500000);
119+
BENCHMARK(CHACHA20_POLY1305_AEAD_256BYTES_ENCRYPT_DECRYPT, 250000);
120+
BENCHMARK(CHACHA20_POLY1305_AEAD_1MB_ENCRYPT_DECRYPT, 340);
121+
BENCHMARK(HASH_64BYTES, 500000);
122+
BENCHMARK(HASH_256BYTES, 250000);
123+
BENCHMARK(HASH_1MB, 340);

‎src/crypto/chacha_poly_aead.cpp

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
// Copyright (c) 2019 The Bitcoin Core developers
2+
// Distributed under the MIT software license, see the accompanying
3+
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4+
5+
#include <crypto/chacha_poly_aead.h>
6+
7+
#include <crypto/common.h>
8+
#include <crypto/poly1305.h>
9+
#include <support/cleanse.h>
10+
11+
#include <assert.h>
12+
#include <string.h>
13+
14+
#include <cstdio>
15+
#include <limits>
16+
17+
#ifndef HAVE_TIMINGSAFE_BCMP
18+
19+
int timingsafe_bcmp(const unsigned char* b1, const unsigned char* b2, size_t n)
20+
{
21+
const unsigned char *p1 = b1, *p2 = b2;
22+
int ret = 0;
23+
24+
for (; n > 0; n--)
25+
ret |= *p1++ ^ *p2++;
26+
return (ret != 0);
27+
}
28+
29+
#endif // TIMINGSAFE_BCMP
30+
31+
ChaCha20Poly1305AEAD::ChaCha20Poly1305AEAD(const unsigned char* K_1, size_t K_1_len, const unsigned char* K_2, size_t K_2_len)
32+
{
33+
assert(K_1_len == CHACHA20_POLY1305_AEAD_KEY_LEN);
34+
assert(K_2_len == CHACHA20_POLY1305_AEAD_KEY_LEN);
35+
m_chacha_main.SetKey(K_1, CHACHA20_POLY1305_AEAD_KEY_LEN);
36+
m_chacha_header.SetKey(K_2, CHACHA20_POLY1305_AEAD_KEY_LEN);
37+
38+
// set the cached sequence number to uint64 max which hints for an unset cache.
39+
// we can't hit uint64 max since the rekey rule (which resets the sequence number) is 1GB
40+
m_cached_aad_seqnr = std::numeric_limits<uint64_t>::max();
41+
}
42+
43+
bool ChaCha20Poly1305AEAD::Crypt(uint64_t seqnr_payload, uint64_t seqnr_aad, int aad_pos, unsigned char* dest, size_t dest_len /* length of the output buffer for sanity checks */, const unsigned char* src, size_t src_len, bool is_encrypt)
44+
{
45+
// check buffer boundaries
46+
if (
47+
// if we encrypt, make sure the source contains at least the expected AAD and the destination has at least space for the source + MAC
48+
(is_encrypt && (src_len < CHACHA20_POLY1305_AEAD_AAD_LEN || dest_len < src_len + POLY1305_TAGLEN)) ||
49+
// if we decrypt, make sure the source contains at least the expected AAD+MAC and the destination has at least space for the source - MAC
50+
(!is_encrypt && (src_len < CHACHA20_POLY1305_AEAD_AAD_LEN + POLY1305_TAGLEN || dest_len < src_len - POLY1305_TAGLEN))) {
51+
return false;
52+
}
53+
54+
unsigned char expected_tag[POLY1305_TAGLEN], poly_key[POLY1305_KEYLEN];
55+
memset(poly_key, 0, sizeof(poly_key));
56+
m_chacha_main.SetIV(seqnr_payload);
57+
58+
// block counter 0 for the poly1305 key
59+
// use lower 32bytes for the poly1305 key
60+
// (throws away 32 unused bytes (upper 32) from this ChaCha20 round)
61+
m_chacha_main.Seek(0);
62+
m_chacha_main.Crypt(poly_key, poly_key, sizeof(poly_key));
63+
64+
// if decrypting, verify the tag prior to decryption
65+
if (!is_encrypt) {
66+
const unsigned char* tag = src + src_len - POLY1305_TAGLEN;
67+
poly1305_auth(expected_tag, src, src_len - POLY1305_TAGLEN, poly_key);
68+
69+
// constant time compare the calculated MAC with the provided MAC
70+
if (timingsafe_bcmp(expected_tag, tag, POLY1305_TAGLEN) != 0) {
71+
memory_cleanse(expected_tag, sizeof(expected_tag));
72+
memory_cleanse(poly_key, sizeof(poly_key));
73+
return false;
74+
}
75+
memory_cleanse(expected_tag, sizeof(expected_tag));
76+
// MAC has been successfully verified, make sure we don't covert it in decryption
77+
src_len -= POLY1305_TAGLEN;
78+
}
79+
80+
// calculate and cache the next 64byte keystream block if requested sequence number is not yet the cache
81+
if (m_cached_aad_seqnr != seqnr_aad) {
82+
m_cached_aad_seqnr = seqnr_aad;
83+
m_chacha_header.SetIV(seqnr_aad);
84+
m_chacha_header.Seek(0);
85+
m_chacha_header.Keystream(m_aad_keystream_buffer, CHACHA20_ROUND_OUTPUT);
86+
}
87+
// crypt the AAD (3 bytes message length) with given position in AAD cipher instance keystream
88+
dest[0] = src[0] ^ m_aad_keystream_buffer[aad_pos];
89+
dest[1] = src[1] ^ m_aad_keystream_buffer[aad_pos + 1];
90+
dest[2] = src[2] ^ m_aad_keystream_buffer[aad_pos + 2];
91+
92+
// Set the playload ChaCha instance block counter to 1 and crypt the payload
93+
m_chacha_main.Seek(1);
94+
m_chacha_main.Crypt(src + CHACHA20_POLY1305_AEAD_AAD_LEN, dest + CHACHA20_POLY1305_AEAD_AAD_LEN, src_len - CHACHA20_POLY1305_AEAD_AAD_LEN);
95+
96+
// If encrypting, calculate and append tag
97+
if (is_encrypt) {
98+
// the poly1305 tag expands over the AAD (3 bytes length) & encrypted payload
99+
poly1305_auth(dest + src_len, dest, src_len, poly_key);
100+
}
101+
102+
// cleanse no longer required MAC and polykey
103+
memory_cleanse(poly_key, sizeof(poly_key));
104+
return true;
105+
}
106+
107+
bool ChaCha20Poly1305AEAD::GetLength(uint32_t* len24_out, uint64_t seqnr_aad, int aad_pos, const uint8_t* ciphertext)
108+
{
109+
// enforce valid aad position to avoid accessing outside of the 64byte keystream cache
110+
// (there is space for 21 times 3 bytes)
111+
assert(aad_pos >= 0 && aad_pos < CHACHA20_ROUND_OUTPUT - CHACHA20_POLY1305_AEAD_AAD_LEN);
112+
if (m_cached_aad_seqnr != seqnr_aad) {
113+
// we need to calculate the 64 keystream bytes since we reached a new aad sequence number
114+
m_cached_aad_seqnr = seqnr_aad;
115+
m_chacha_header.SetIV(seqnr_aad); // use LE for the nonce
116+
m_chacha_header.Seek(0); // block counter 0
117+
m_chacha_header.Keystream(m_aad_keystream_buffer, CHACHA20_ROUND_OUTPUT); // write keystream to the cache
118+
}
119+
120+
// decrypt the ciphertext length by XORing the right position of the 64byte keystream cache with the ciphertext
121+
*len24_out = (ciphertext[0] ^ m_aad_keystream_buffer[aad_pos + 0]) |
122+
(ciphertext[1] ^ m_aad_keystream_buffer[aad_pos + 1]) << 8 |
123+
(ciphertext[2] ^ m_aad_keystream_buffer[aad_pos + 2]) << 16;
124+
125+
return true;
126+
}

0 commit comments

Comments
 (0)