1 From 3cdf9ec918b37c17e12b33e4c244944d1ee836ca Mon Sep 17 00:00:00 2001
2 From: Vladislav Grishenko <themiron@mail.ru>
3 Date: Mon, 6 Apr 2020 23:28:09 +0500
4 Subject: [PATCH] Add Chacha20-Poly1305 authenticated encryption
6 * Add general AEAD approach.
7 * Add chacha20-poly1305@openssh.com algo using LibTomCrypt chacha and
10 Chacha20-Poly1305 is generally faster than AES256 on CPU w/o dedicated
11 AES instructions, having the same key size.
12 Compiling in will add ~5,5kB to binary size on x86-64.
16 chachapoly.c | 148 ++++++++++++++++++++
17 chachapoly.h | 44 ++++++
19 common-kex.c | 44 ++++--
20 default_options.h | 6 +
21 libtomcrypt/src/headers/tomcrypt_dropbear.h | 4 +
22 packet.c | 145 +++++++++++++------
25 11 files changed, 368 insertions(+), 56 deletions(-)
26 create mode 100644 chachapoly.c
27 create mode 100644 chachapoly.h
29 diff --git a/Makefile.in b/Makefile.in
30 index aaf7b3b..3437cb2 100644
33 @@ -53,7 +53,7 @@ CLIOBJS=cli-main.o cli-auth.o cli-authpasswd.o cli-kex.o \
34 CLISVROBJS=common-session.o packet.o common-algo.o common-kex.o \
35 common-channel.o common-chansession.o termcodes.o loginrec.o \
36 tcp-accept.o listener.o process-packet.o dh_groups.o \
37 - common-runopts.o circbuffer.o list.o netio.o
38 + common-runopts.o circbuffer.o list.o netio.o chachapoly.o
42 diff --git a/algo.h b/algo.h
43 index b12fb94..efd0d73 100644
46 @@ -72,6 +72,14 @@ struct dropbear_cipher_mode {
47 unsigned long len, void *cipher_state);
48 int (*decrypt)(const unsigned char *ct, unsigned char *pt,
49 unsigned long len, void *cipher_state);
50 + int (*aead_crypt)(unsigned int seq,
51 + const unsigned char *in, unsigned char *out,
52 + unsigned long len, unsigned long taglen,
53 + void *cipher_state, int direction);
54 + int (*aead_getlength)(unsigned int seq,
55 + const unsigned char *in, unsigned int *outlen,
56 + unsigned long len, void *cipher_state);
57 + const struct dropbear_hash *aead_mac;
60 struct dropbear_hash {
61 diff --git a/chachapoly.c b/chachapoly.c
63 index 0000000..8fb06c5
70 + * Copyright (c) 2002,2003 Matt Johnston
71 + * Copyright (c) 2020 by Vladislav Grishenko
72 + * All rights reserved.
74 + * Permission is hereby granted, free of charge, to any person obtaining a copy
75 + * of this software and associated documentation files (the "Software"), to deal
76 + * in the Software without restriction, including without limitation the rights
77 + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
78 + * copies of the Software, and to permit persons to whom the Software is
79 + * furnished to do so, subject to the following conditions:
81 + * The above copyright notice and this permission notice shall be included in
82 + * all copies or substantial portions of the Software.
84 + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
85 + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
86 + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
87 + * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
88 + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
89 + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
92 +#include "includes.h"
95 +#include "chachapoly.h"
97 +#if DROPBEAR_CHACHA20POLY1305
99 +#define CHACHA20_KEY_LEN 32
100 +#define CHACHA20_BLOCKSIZE 8
101 +#define POLY1305_KEY_LEN 32
102 +#define POLY1305_TAG_LEN 16
104 +static const struct ltc_cipher_descriptor dummy = {.name = NULL};
106 +static const struct dropbear_hash dropbear_chachapoly_mac =
107 + {NULL, POLY1305_KEY_LEN, POLY1305_TAG_LEN};
109 +const struct dropbear_cipher dropbear_chachapoly =
110 + {&dummy, CHACHA20_KEY_LEN*2, CHACHA20_BLOCKSIZE};
112 +static int dropbear_chachapoly_start(int UNUSED(cipher), const unsigned char* UNUSED(IV),
113 + const unsigned char *key, int keylen,
114 + int UNUSED(num_rounds), dropbear_chachapoly_state *state) {
117 + TRACE2(("enter dropbear_chachapoly_start"))
119 + if (keylen != CHACHA20_KEY_LEN*2) {
120 + return CRYPT_ERROR;
123 + if ((err = chacha_setup(&state->chacha, key,
124 + CHACHA20_KEY_LEN, 20)) != CRYPT_OK) {
128 + if ((err = chacha_setup(&state->header, key + CHACHA20_KEY_LEN,
129 + CHACHA20_KEY_LEN, 20) != CRYPT_OK)) {
133 + TRACE2(("leave dropbear_chachapoly_start"))
137 +static int dropbear_chachapoly_crypt(unsigned int seq,
138 + const unsigned char *in, unsigned char *out,
139 + unsigned long len, unsigned long taglen,
140 + dropbear_chachapoly_state *state, int direction) {
141 + poly1305_state poly;
142 + unsigned char seqbuf[8], key[POLY1305_KEY_LEN], tag[POLY1305_TAG_LEN];
145 + TRACE2(("enter dropbear_chachapoly_crypt"))
147 + if (len < 4 || taglen != POLY1305_TAG_LEN) {
148 + return CRYPT_ERROR;
151 + STORE64H((uint64_t)seq, seqbuf);
152 + chacha_ivctr64(&state->chacha, seqbuf, sizeof(seqbuf), 0);
153 + if ((err = chacha_keystream(&state->chacha, key, sizeof(key))) != CRYPT_OK) {
157 + poly1305_init(&poly, key, sizeof(key));
158 + if (direction == LTC_DECRYPT) {
159 + poly1305_process(&poly, in, len);
160 + poly1305_done(&poly, tag, &taglen);
161 + if (constant_time_memcmp(in + len, tag, taglen) != 0) {
162 + return CRYPT_ERROR;
166 + chacha_ivctr64(&state->header, seqbuf, sizeof(seqbuf), 0);
167 + if ((err = chacha_crypt(&state->header, in, 4, out)) != CRYPT_OK) {
171 + chacha_ivctr64(&state->chacha, seqbuf, sizeof(seqbuf), 1);
172 + if ((err = chacha_crypt(&state->chacha, in + 4, len - 4, out + 4)) != CRYPT_OK) {
176 + if (direction == LTC_ENCRYPT) {
177 + poly1305_process(&poly, out, len);
178 + poly1305_done(&poly, out + len, &taglen);
181 + TRACE2(("leave dropbear_chachapoly_crypt"))
185 +static int dropbear_chachapoly_getlength(unsigned int seq,
186 + const unsigned char *in, unsigned int *outlen,
187 + unsigned long len, dropbear_chachapoly_state *state) {
188 + unsigned char seqbuf[8], buf[4];
191 + TRACE2(("enter dropbear_chachapoly_getlength"))
193 + if (len < sizeof(buf)) {
194 + return CRYPT_ERROR;
197 + STORE64H((uint64_t)seq, seqbuf);
198 + chacha_ivctr64(&state->header, seqbuf, sizeof(seqbuf), 0);
199 + if ((err = chacha_crypt(&state->header, in, sizeof(buf), buf)) != CRYPT_OK) {
203 + LOAD32H(*outlen, buf);
205 + TRACE2(("leave dropbear_chachapoly_getlength"))
209 +const struct dropbear_cipher_mode dropbear_mode_chachapoly =
210 + {(void *)dropbear_chachapoly_start, NULL, NULL,
211 + (void *)dropbear_chachapoly_crypt,
212 + (void *)dropbear_chachapoly_getlength, &dropbear_chachapoly_mac};
214 +#endif /* DROPBEAR_CHACHA20POLY1305 */
215 diff --git a/chachapoly.h b/chachapoly.h
217 index 0000000..5a7c5b2
224 + * Copyright (c) 2002,2003 Matt Johnston
225 + * Copyright (c) 2020 by Vladislav Grishenko
226 + * All rights reserved.
228 + * Permission is hereby granted, free of charge, to any person obtaining a copy
229 + * of this software and associated documentation files (the "Software"), to deal
230 + * in the Software without restriction, including without limitation the rights
231 + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
232 + * copies of the Software, and to permit persons to whom the Software is
233 + * furnished to do so, subject to the following conditions:
235 + * The above copyright notice and this permission notice shall be included in
236 + * all copies or substantial portions of the Software.
238 + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
239 + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
240 + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
241 + * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
242 + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
243 + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
246 +#ifndef DROPBEAR_DROPBEAR_CHACHAPOLY_H_
247 +#define DROPBEAR_DROPBEAR_CHACHAPOLY_H_
249 +#include "includes.h"
252 +#if DROPBEAR_CHACHA20POLY1305
255 + chacha_state chacha;
256 + chacha_state header;
257 +} dropbear_chachapoly_state;
259 +extern const struct dropbear_cipher dropbear_chachapoly;
260 +extern const struct dropbear_cipher_mode dropbear_mode_chachapoly;
262 +#endif /* DROPBEAR_CHACHA20POLY1305 */
264 +#endif /* DROPBEAR_DROPBEAR_CHACHAPOLY_H_ */
265 diff --git a/common-algo.c b/common-algo.c
266 index 558aad2..1436456 100644
270 #include "dh_groups.h"
271 #include "ltc_prng.h"
273 +#include "chachapoly.h"
275 /* This file (algo.c) organises the ciphers which can be used, and is used to
276 * decide which ciphers/hashes/compression/signing to use during key exchange*/
277 @@ -86,11 +87,11 @@ const struct dropbear_cipher dropbear_nocipher =
278 * about the symmetric_CBC vs symmetric_CTR cipher_state pointer */
279 #if DROPBEAR_ENABLE_CBC_MODE
280 const struct dropbear_cipher_mode dropbear_mode_cbc =
281 - {(void*)cbc_start, (void*)cbc_encrypt, (void*)cbc_decrypt};
282 + {(void*)cbc_start, (void*)cbc_encrypt, (void*)cbc_decrypt, NULL, NULL, NULL};
283 #endif /* DROPBEAR_ENABLE_CBC_MODE */
285 const struct dropbear_cipher_mode dropbear_mode_none =
286 - {void_start, void_cipher, void_cipher};
287 + {void_start, void_cipher, void_cipher, NULL, NULL, NULL};
289 #if DROPBEAR_ENABLE_CTR_MODE
290 /* a wrapper to make ctr_start and cbc_start look the same */
291 @@ -101,7 +102,7 @@ static int dropbear_big_endian_ctr_start(int cipher,
292 return ctr_start(cipher, IV, key, keylen, num_rounds, CTR_COUNTER_BIG_ENDIAN, ctr);
294 const struct dropbear_cipher_mode dropbear_mode_ctr =
295 - {(void*)dropbear_big_endian_ctr_start, (void*)ctr_encrypt, (void*)ctr_decrypt};
296 + {(void*)dropbear_big_endian_ctr_start, (void*)ctr_encrypt, (void*)ctr_decrypt, NULL, NULL, NULL};
297 #endif /* DROPBEAR_ENABLE_CTR_MODE */
299 /* Mapping of ssh hashes to libtomcrypt hashes, including keysize etc.
300 @@ -137,6 +138,10 @@ const struct dropbear_hash dropbear_nohash =
301 * that is also supported by the server will get used. */
303 algo_type sshciphers[] = {
304 +#if DROPBEAR_CHACHA20POLY1305
305 + {"chacha20-poly1305@openssh.com", 0, &dropbear_chachapoly, 1, &dropbear_mode_chachapoly},
308 #if DROPBEAR_ENABLE_CTR_MODE
310 {"aes128-ctr", 0, &dropbear_aes128, 1, &dropbear_mode_ctr},
311 diff --git a/common-kex.c b/common-kex.c
312 index 16b7e27..5e2923f 100644
315 @@ -329,9 +329,12 @@ static void gen_new_keys() {
316 hashkeys(S2C_key, sizeof(S2C_key), &hs, 'D');
318 if (ses.newkeys->recv.algo_crypt->cipherdesc != NULL) {
319 - int recv_cipher = find_cipher(ses.newkeys->recv.algo_crypt->cipherdesc->name);
320 - if (recv_cipher < 0)
321 - dropbear_exit("Crypto error");
322 + int recv_cipher = -1;
323 + if (ses.newkeys->recv.algo_crypt->cipherdesc->name != NULL) {
324 + recv_cipher = find_cipher(ses.newkeys->recv.algo_crypt->cipherdesc->name);
325 + if (recv_cipher < 0)
326 + dropbear_exit("Crypto error");
328 if (ses.newkeys->recv.crypt_mode->start(recv_cipher,
330 ses.newkeys->recv.algo_crypt->keysize, 0,
331 @@ -341,9 +344,12 @@ static void gen_new_keys() {
334 if (ses.newkeys->trans.algo_crypt->cipherdesc != NULL) {
335 - int trans_cipher = find_cipher(ses.newkeys->trans.algo_crypt->cipherdesc->name);
336 - if (trans_cipher < 0)
337 - dropbear_exit("Crypto error");
338 + int trans_cipher = -1;
339 + if (ses.newkeys->trans.algo_crypt->cipherdesc->name != NULL) {
340 + trans_cipher = find_cipher(ses.newkeys->trans.algo_crypt->cipherdesc->name);
341 + if (trans_cipher < 0)
342 + dropbear_exit("Crypto error");
344 if (ses.newkeys->trans.crypt_mode->start(trans_cipher,
346 ses.newkeys->trans.algo_crypt->keysize, 0,
347 @@ -868,19 +874,29 @@ static void read_kex_algos() {
349 /* mac_algorithms_client_to_server */
350 c2s_hash_algo = buf_match_algo(ses.payload, sshhashes, NULL, NULL);
351 +#if DROPBEAR_AEAD_MODE
352 + if (((struct dropbear_cipher_mode*)c2s_cipher_algo->mode)->aead_crypt != NULL) {
353 + c2s_hash_algo = NULL;
356 if (c2s_hash_algo == NULL) {
357 erralgo = "mac c->s";
360 - TRACE(("hash c2s is %s", c2s_hash_algo->name))
361 + TRACE(("hash c2s is %s", c2s_hash_algo ? c2s_hash_algo->name : "<implicit>"))
363 /* mac_algorithms_server_to_client */
364 s2c_hash_algo = buf_match_algo(ses.payload, sshhashes, NULL, NULL);
365 +#if DROPBEAR_AEAD_MODE
366 + if (((struct dropbear_cipher_mode*)s2c_cipher_algo->mode)->aead_crypt != NULL) {
367 + s2c_hash_algo = NULL;
370 if (s2c_hash_algo == NULL) {
371 erralgo = "mac s->c";
374 - TRACE(("hash s2c is %s", s2c_hash_algo->name))
375 + TRACE(("hash s2c is %s", s2c_hash_algo ? s2c_hash_algo->name : "<implicit>"))
377 /* compression_algorithms_client_to_server */
378 c2s_comp_algo = buf_match_algo(ses.payload, ses.compress_algos, NULL, NULL);
379 @@ -925,8 +941,14 @@ static void read_kex_algos() {
380 ses.newkeys->trans.crypt_mode =
381 (struct dropbear_cipher_mode*)c2s_cipher_algo->mode;
382 ses.newkeys->recv.algo_mac =
383 +#if DROPBEAR_AEAD_MODE
384 + s2c_hash_algo == NULL ? ses.newkeys->recv.crypt_mode->aead_mac :
386 (struct dropbear_hash*)s2c_hash_algo->data;
387 ses.newkeys->trans.algo_mac =
388 +#if DROPBEAR_AEAD_MODE
389 + c2s_hash_algo == NULL ? ses.newkeys->trans.crypt_mode->aead_mac :
391 (struct dropbear_hash*)c2s_hash_algo->data;
392 ses.newkeys->recv.algo_comp = s2c_comp_algo->val;
393 ses.newkeys->trans.algo_comp = c2s_comp_algo->val;
394 @@ -941,8 +963,14 @@ static void read_kex_algos() {
395 ses.newkeys->trans.crypt_mode =
396 (struct dropbear_cipher_mode*)s2c_cipher_algo->mode;
397 ses.newkeys->recv.algo_mac =
398 +#if DROPBEAR_AEAD_MODE
399 + c2s_hash_algo == NULL ? ses.newkeys->recv.crypt_mode->aead_mac :
401 (struct dropbear_hash*)c2s_hash_algo->data;
402 ses.newkeys->trans.algo_mac =
403 +#if DROPBEAR_AEAD_MODE
404 + s2c_hash_algo == NULL ? ses.newkeys->trans.crypt_mode->aead_mac :
406 (struct dropbear_hash*)s2c_hash_algo->data;
407 ses.newkeys->recv.algo_comp = c2s_comp_algo->val;
408 ses.newkeys->trans.algo_comp = s2c_comp_algo->val;
409 diff --git a/default_options.h b/default_options.h
410 index bafbb07..1a2ab10 100644
411 --- a/default_options.h
412 +++ b/default_options.h
413 @@ -99,6 +99,12 @@ IMPORTANT: Some options will require "make clean" after changes */
414 * and forwards compatibility */
415 #define DROPBEAR_ENABLE_CTR_MODE 1
417 +/* Enable Chacha20-Poly1305 authenticated encryption mode. This is
418 + * generally faster than AES256 on CPU w/o dedicated AES instructions,
419 + * having the same key size.
420 + * Compiling in will add ~5,5kB to binary size on x86-64 */
421 +#define DROPBEAR_CHACHA20POLY1305 1
423 /* Message integrity. sha2-256 is recommended as a default,
424 sha1 for compatibility */
425 #define DROPBEAR_SHA1_HMAC 1
426 diff --git a/libtomcrypt/src/headers/tomcrypt_dropbear.h b/libtomcrypt/src/headers/tomcrypt_dropbear.h
427 index b0ce45b..59960e5 100644
428 --- a/libtomcrypt/src/headers/tomcrypt_dropbear.h
429 +++ b/libtomcrypt/src/headers/tomcrypt_dropbear.h
434 +#if DROPBEAR_CHACHA20POLY1305
436 +#define LTC_POLY1305
441 diff --git a/packet.c b/packet.c
442 index 9fda0d6..0454726 100644
445 @@ -215,7 +215,7 @@ static int read_packet_init() {
450 + unsigned int len, plen;
451 unsigned int blocksize;
452 unsigned int macsize;
454 @@ -254,21 +254,35 @@ static int read_packet_init() {
455 /* now we have the first block, need to get packet length, so we decrypt
456 * the first block (only need first 4 bytes) */
457 buf_setpos(ses.readbuf, 0);
458 - if (ses.keys->recv.crypt_mode->decrypt(buf_getptr(ses.readbuf, blocksize),
459 - buf_getwriteptr(ses.readbuf, blocksize),
461 - &ses.keys->recv.cipher_state) != CRYPT_OK) {
462 - dropbear_exit("Error decrypting");
463 +#if DROPBEAR_AEAD_MODE
464 + if (ses.keys->recv.crypt_mode->aead_crypt) {
465 + if (ses.keys->recv.crypt_mode->aead_getlength(ses.recvseq,
466 + buf_getptr(ses.readbuf, blocksize), &plen,
468 + &ses.keys->recv.cipher_state) != CRYPT_OK) {
469 + dropbear_exit("Error decrypting");
471 + len = plen + 4 + macsize;
475 + if (ses.keys->recv.crypt_mode->decrypt(buf_getptr(ses.readbuf, blocksize),
476 + buf_getwriteptr(ses.readbuf, blocksize),
478 + &ses.keys->recv.cipher_state) != CRYPT_OK) {
479 + dropbear_exit("Error decrypting");
481 + plen = buf_getint(ses.readbuf) + 4;
482 + len = plen + macsize;
484 - len = buf_getint(ses.readbuf) + 4 + macsize;
486 TRACE2(("packet size is %u, block %u mac %u", len, blocksize, macsize))
489 /* check packet length */
490 if ((len > RECV_MAX_PACKET_LEN) ||
491 - (len < MIN_PACKET_LEN + macsize) ||
492 - ((len - macsize) % blocksize != 0)) {
493 + (plen < blocksize) ||
494 + (plen % blocksize != 0)) {
495 dropbear_exit("Integrity error (bad packet size %u)", len);
498 @@ -294,23 +308,42 @@ void decrypt_packet() {
500 ses.kexstate.datarecv += ses.readbuf->len;
502 - /* we've already decrypted the first blocksize in read_packet_init */
503 - buf_setpos(ses.readbuf, blocksize);
505 - /* decrypt it in-place */
506 - len = ses.readbuf->len - macsize - ses.readbuf->pos;
507 - if (ses.keys->recv.crypt_mode->decrypt(
508 - buf_getptr(ses.readbuf, len),
509 - buf_getwriteptr(ses.readbuf, len),
511 - &ses.keys->recv.cipher_state) != CRYPT_OK) {
512 - dropbear_exit("Error decrypting");
514 - buf_incrpos(ses.readbuf, len);
515 +#if DROPBEAR_AEAD_MODE
516 + if (ses.keys->recv.crypt_mode->aead_crypt) {
517 + /* first blocksize is not decrypted yet */
518 + buf_setpos(ses.readbuf, 0);
520 + /* decrypt it in-place */
521 + len = ses.readbuf->len - macsize - ses.readbuf->pos;
522 + if (ses.keys->recv.crypt_mode->aead_crypt(ses.recvseq,
523 + buf_getptr(ses.readbuf, len + macsize),
524 + buf_getwriteptr(ses.readbuf, len),
526 + &ses.keys->recv.cipher_state, LTC_DECRYPT) != CRYPT_OK) {
527 + dropbear_exit("Error decrypting");
529 + buf_incrpos(ses.readbuf, len);
533 + /* we've already decrypted the first blocksize in read_packet_init */
534 + buf_setpos(ses.readbuf, blocksize);
536 + /* decrypt it in-place */
537 + len = ses.readbuf->len - macsize - ses.readbuf->pos;
538 + if (ses.keys->recv.crypt_mode->decrypt(
539 + buf_getptr(ses.readbuf, len),
540 + buf_getwriteptr(ses.readbuf, len),
542 + &ses.keys->recv.cipher_state) != CRYPT_OK) {
543 + dropbear_exit("Error decrypting");
545 + buf_incrpos(ses.readbuf, len);
547 - /* check the hmac */
548 - if (checkmac() != DROPBEAR_SUCCESS) {
549 - dropbear_exit("Integrity error");
550 + /* check the hmac */
551 + if (checkmac() != DROPBEAR_SUCCESS) {
552 + dropbear_exit("Integrity error");
556 /* get padding length */
557 @@ -557,9 +590,16 @@ void encrypt_packet() {
558 buf_setpos(ses.writepayload, 0);
559 buf_setlen(ses.writepayload, 0);
561 - /* length of padding - packet length must be a multiple of blocksize,
562 - * with a minimum of 4 bytes of padding */
563 - padlen = blocksize - (writebuf->len) % blocksize;
564 + /* length of padding - packet length excluding the packetlength uint32
565 + * field in aead mode must be a multiple of blocksize, with a minimum of
566 + * 4 bytes of padding */
567 + len = writebuf->len;
568 +#if DROPBEAR_AEAD_MODE
569 + if (ses.keys->trans.crypt_mode->aead_crypt) {
573 + padlen = blocksize - len % blocksize;
577 @@ -579,23 +619,42 @@ void encrypt_packet() {
578 buf_incrlen(writebuf, padlen);
579 genrandom(buf_getptr(writebuf, padlen), padlen);
581 - make_mac(ses.transseq, &ses.keys->trans, writebuf, writebuf->len, mac_bytes);
582 +#if DROPBEAR_AEAD_MODE
583 + if (ses.keys->trans.crypt_mode->aead_crypt) {
584 + /* do the actual encryption, in-place */
585 + buf_setpos(writebuf, 0);
586 + /* encrypt it in-place*/
587 + len = writebuf->len;
588 + buf_incrlen(writebuf, mac_size);
589 + if (ses.keys->trans.crypt_mode->aead_crypt(ses.transseq,
590 + buf_getptr(writebuf, len),
591 + buf_getwriteptr(writebuf, len + mac_size),
593 + &ses.keys->trans.cipher_state, LTC_ENCRYPT) != CRYPT_OK) {
594 + dropbear_exit("Error encrypting");
596 + buf_incrpos(writebuf, len + mac_size);
600 + make_mac(ses.transseq, &ses.keys->trans, writebuf, writebuf->len, mac_bytes);
602 + /* do the actual encryption, in-place */
603 + buf_setpos(writebuf, 0);
604 + /* encrypt it in-place*/
605 + len = writebuf->len;
606 + if (ses.keys->trans.crypt_mode->encrypt(
607 + buf_getptr(writebuf, len),
608 + buf_getwriteptr(writebuf, len),
610 + &ses.keys->trans.cipher_state) != CRYPT_OK) {
611 + dropbear_exit("Error encrypting");
613 + buf_incrpos(writebuf, len);
615 - /* do the actual encryption, in-place */
616 - buf_setpos(writebuf, 0);
617 - /* encrypt it in-place*/
618 - len = writebuf->len;
619 - if (ses.keys->trans.crypt_mode->encrypt(
620 - buf_getptr(writebuf, len),
621 - buf_getwriteptr(writebuf, len),
623 - &ses.keys->trans.cipher_state) != CRYPT_OK) {
624 - dropbear_exit("Error encrypting");
625 + /* stick the MAC on it */
626 + buf_putbytes(writebuf, mac_bytes, mac_size);
628 - buf_incrpos(writebuf, len);
630 - /* stick the MAC on it */
631 - buf_putbytes(writebuf, mac_bytes, mac_size);
634 ses.kexstate.datatrans += writebuf->len;
635 diff --git a/session.h b/session.h
636 index e436882..a8f8914 100644
640 #include "chansession.h"
643 +#include "chachapoly.h"
645 void common_session_init(int sock_in, int sock_out);
646 void session_loop(void(*loophandler)(void)) ATTRIB_NORETURN;
647 @@ -80,6 +81,9 @@ struct key_context_directional {
649 #if DROPBEAR_ENABLE_CTR_MODE
652 +#if DROPBEAR_CHACHA20POLY1305
653 + dropbear_chachapoly_state chachapoly;
656 unsigned char mackey[MAX_MAC_LEN];
657 diff --git a/sysoptions.h b/sysoptions.h
658 index 2c27caf..2432779 100644
662 #define MD5_HASH_SIZE 16
663 #define MAX_HASH_SIZE 64 /* sha512 */
665 +#if DROPBEAR_CHACHA20POLY1305
666 +#define MAX_KEY_LEN 64 /* 2 x 256 bits for chacha20 */
668 #define MAX_KEY_LEN 32 /* 256 bits for aes256 etc */
670 #define MAX_IV_LEN 20 /* must be same as max blocksize, */
672 #if DROPBEAR_SHA2_512_HMAC
673 @@ -207,6 +211,8 @@ If you test it please contact the Dropbear author */
675 #define DROPBEAR_TWOFISH ((DROPBEAR_TWOFISH256) || (DROPBEAR_TWOFISH128))
677 +#define DROPBEAR_AEAD_MODE ((DROPBEAR_CHACHA20POLY1305))
679 #define DROPBEAR_CLI_ANYTCPFWD ((DROPBEAR_CLI_REMOTETCPFWD) || (DROPBEAR_CLI_LOCALTCPFWD))
681 #define DROPBEAR_TCP_ACCEPT ((DROPBEAR_CLI_LOCALTCPFWD) || (DROPBEAR_SVR_REMOTETCPFWD))
682 @@ -249,7 +255,7 @@ If you test it please contact the Dropbear author */
685 #if !(DROPBEAR_AES128 || DROPBEAR_3DES || DROPBEAR_AES256 || DROPBEAR_BLOWFISH \
686 - || DROPBEAR_TWOFISH256 || DROPBEAR_TWOFISH128)
687 + || DROPBEAR_TWOFISH256 || DROPBEAR_TWOFISH128 || DROPBEAR_CHACHA20POLY1305)
688 #error "At least one encryption algorithm must be enabled. AES128 is recommended."