Skip to content

Commit ad904f3

Browse files
dhruvdhruv
committed
Adding forward secure FSChaCha20
1 parent 23944f5 commit ad904f3

File tree

4 files changed

+162
-2
lines changed

4 files changed

+162
-2
lines changed

‎src/crypto/chacha20.cpp

+23-1
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,10 @@
55
// Based on the public domain implementation 'merged' by D. J. Bernstein
66
// See https://cr.yp.to/chacha.html.
77

8-
#include <crypto/common.h>
98
#include <crypto/chacha20.h>
9+
#include <crypto/common.h>
10+
#include <crypto/sha256.h>
11+
#include <span.h>
1012

1113
#include <string.h>
1214

@@ -422,3 +424,23 @@ void ChaCha20::Crypt(const unsigned char* m, unsigned char* c, size_t bytes)
422424
prev_block_start_pos = 0;
423425
}
424426
}
427+
428+
void FSChaCha20::Crypt(Span<const std::byte> input, Span<std::byte> output)
429+
{
430+
assert(input.size() == output.size());
431+
c20.Crypt(reinterpret_cast<const unsigned char*>(input.data()),
432+
reinterpret_cast<unsigned char*>(output.data()), input.size());
433+
messages_with_key++;
434+
435+
if (messages_with_key % rekey_interval == 0) {
436+
unsigned char new_key[CSHA256::OUTPUT_SIZE];
437+
auto hasher = CSHA256().Write(UCharCast(rekey_salt.data()), rekey_salt.size());
438+
hasher.Write(UCharCast(key.data()), key.size()).Finalize(new_key);
439+
memory_cleanse(key.data(), key.size());
440+
assert(CSHA256::OUTPUT_SIZE == FSCHACHA20_KEYLEN);
441+
memcpy(key.data(), new_key, FSCHACHA20_KEYLEN);
442+
c20.SetKey(reinterpret_cast<unsigned char*>(key.data()), key.size());
443+
rekey_counter++;
444+
set_nonce();
445+
}
446+
}

‎src/crypto/chacha20.h

+48
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,17 @@
55
#ifndef BITCOIN_CRYPTO_CHACHA20_H
66
#define BITCOIN_CRYPTO_CHACHA20_H
77

8+
#include <crypto/common.h>
9+
#include <span.h>
10+
#include <support/cleanse.h>
11+
812
#include <array>
913
#include <cstddef>
1014
#include <stdint.h>
1115
#include <stdlib.h>
1216

17+
static constexpr size_t FSCHACHA20_KEYLEN = 32;
18+
1319
/** A class for ChaCha20 256-bit stream cipher developed by Daniel J. Bernstein
1420
https://cr.yp.to/chacha/chacha-20080128.pdf */
1521
class ChaCha20
@@ -39,4 +45,46 @@ class ChaCha20
3945
void Crypt(const unsigned char* input, unsigned char* output, size_t bytes);
4046
};
4147

48+
class FSChaCha20
49+
{
50+
private:
51+
ChaCha20 c20;
52+
size_t rekey_interval;
53+
uint32_t messages_with_key;
54+
uint64_t rekey_counter;
55+
std::array<std::byte, FSCHACHA20_KEYLEN> key;
56+
std::array<std::byte, FSCHACHA20_KEYLEN> rekey_salt;
57+
58+
void set_nonce()
59+
{
60+
std::array<std::byte, 12> nonce;
61+
WriteLE32(reinterpret_cast<unsigned char*>(nonce.data()), uint32_t{0});
62+
WriteLE64(reinterpret_cast<unsigned char*>(nonce.data()) + 4, rekey_counter);
63+
c20.SetRFC8439Nonce(nonce);
64+
}
65+
66+
public:
67+
FSChaCha20() = delete;
68+
FSChaCha20(const std::array<std::byte, FSCHACHA20_KEYLEN>& key,
69+
const std::array<std::byte, FSCHACHA20_KEYLEN>& rekey_salt,
70+
size_t rekey_interval)
71+
: c20{reinterpret_cast<const unsigned char*>(key.data()), FSCHACHA20_KEYLEN},
72+
rekey_interval{rekey_interval},
73+
messages_with_key{0},
74+
rekey_counter{0},
75+
key{key},
76+
rekey_salt{rekey_salt}
77+
{
78+
assert(rekey_interval > 0);
79+
set_nonce();
80+
}
81+
82+
~FSChaCha20()
83+
{
84+
memory_cleanse(key.data(), FSCHACHA20_KEYLEN);
85+
memory_cleanse(rekey_salt.data(), FSCHACHA20_KEYLEN);
86+
}
87+
88+
void Crypt(Span<const std::byte> input, Span<std::byte> output);
89+
};
4290
#endif // BITCOIN_CRYPTO_CHACHA20_H

‎src/test/crypto_tests.cpp

+63-1
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@
1616
#include <crypto/sha256.h>
1717
#include <crypto/sha3.h>
1818
#include <crypto/sha512.h>
19-
#include <crypto/muhash.h>
2019
#include <random.h>
2120
#include <span.h>
2221
#include <streams.h>
@@ -167,6 +166,57 @@ static void TestChaCha20(const std::string &hex_message, const std::string &hexk
167166
}
168167
}
169168

169+
static void TestFSChaCha20(const std::string& hex_plaintext, const std::string& hexkey, const std::string& hex_rekey_salt, size_t rekey_interval, const std::string& ciphertext_after_rotation)
170+
{
171+
auto key_vec = ParseHex(hexkey);
172+
BOOST_CHECK_EQUAL(FSCHACHA20_KEYLEN, key_vec.size());
173+
std::array<std::byte, FSCHACHA20_KEYLEN> key;
174+
memcpy(key.data(), key_vec.data(), FSCHACHA20_KEYLEN);
175+
176+
auto salt_vec = ParseHex(hex_rekey_salt);
177+
BOOST_CHECK_EQUAL(FSCHACHA20_KEYLEN, salt_vec.size());
178+
std::array<std::byte, FSCHACHA20_KEYLEN> rekey_salt;
179+
memcpy(rekey_salt.data(), salt_vec.data(), FSCHACHA20_KEYLEN);
180+
181+
auto plaintext = ParseHex(hex_plaintext);
182+
183+
auto fsc20 = FSChaCha20{key, rekey_salt, rekey_interval};
184+
auto c20 = ChaCha20{reinterpret_cast<const unsigned char*>(key.data()), key.size()};
185+
186+
std::vector<std::byte> fsc20_output;
187+
fsc20_output.resize(plaintext.size());
188+
189+
std::vector<unsigned char> c20_output;
190+
c20_output.resize(plaintext.size());
191+
192+
for (size_t i = 0; i < rekey_interval; i++) {
193+
fsc20.Crypt(MakeByteSpan(plaintext), fsc20_output);
194+
c20.Crypt(plaintext.data(), c20_output.data(), plaintext.size());
195+
BOOST_CHECK_EQUAL(0, memcmp(c20_output.data(), fsc20_output.data(), plaintext.size()));
196+
}
197+
198+
// At the rotation interval, the outputs will no longer match
199+
fsc20.Crypt(MakeByteSpan(plaintext), fsc20_output);
200+
c20.Crypt(plaintext.data(), c20_output.data(), plaintext.size());
201+
BOOST_CHECK(memcmp(c20_output.data(), fsc20_output.data(), plaintext.size()) != 0);
202+
203+
unsigned char new_key[FSCHACHA20_KEYLEN];
204+
auto hasher = CSHA256().Write(UCharCast(rekey_salt.data()), rekey_salt.size());
205+
hasher.Write(UCharCast(key.data()), key.size()).Finalize(new_key);
206+
c20.SetKey(reinterpret_cast<unsigned char*>(new_key), 32);
207+
208+
std::array<std::byte, 12> new_nonce;
209+
WriteLE32(reinterpret_cast<unsigned char*>(new_nonce.data()), 0);
210+
WriteLE64(reinterpret_cast<unsigned char*>(new_nonce.data()) + 4, 1);
211+
c20.SetRFC8439Nonce(new_nonce);
212+
213+
// Outputs should match again after simulating key rotation
214+
c20.Crypt(plaintext.data(), c20_output.data(), plaintext.size());
215+
BOOST_CHECK_EQUAL(0, memcmp(c20_output.data(), fsc20_output.data(), plaintext.size()));
216+
217+
BOOST_CHECK_EQUAL(HexStr(fsc20_output), ciphertext_after_rotation);
218+
}
219+
170220
static void TestChaCha20RFC8439(const std::string& hex_key, const std::array<std::byte, 12>& nonce, uint32_t seek, const std::string& hex_expected_keystream, const std::string& hex_input, const std::string& hex_expected_output)
171221
{
172222
auto key = ParseHex(hex_key);
@@ -577,6 +627,18 @@ BOOST_AUTO_TEST_CASE(chacha20_testvector)
577627
rfc8439_nonce2, 0, "ecfa254f845f647473d3cb140da9e87606cb33066c447b87bc2666dde3fbb739", "", "");
578628
TestChaCha20RFC8439("1c9240a5eb55d38af333888604f6b5f0473917c1402b80099dca5cbc207075c0",
579629
rfc8439_nonce2, 0, "965e3bc6f9ec7ed9560808f4d229f94b137ff275ca9b3fcbdd59deaad23310ae", "", "");
630+
631+
// Forward secure ChaCha20
632+
TestFSChaCha20("000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
633+
"0000000000000000000000000000000000000000000000000000000000000000",
634+
"0000000000000000000000000000000000000000000000000000000000000000", 256,
635+
"65bd1a6644c605995d3e0663d1500e761ebfe174475ee6148ae92b243294c042");
636+
TestFSChaCha20("01", "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
637+
"0000000000000000000000000000000000000000000000000000000000000000", 5, "17");
638+
TestFSChaCha20("e93fdb5c762804b9a706816aca31e35b11d2aa3080108ef46a5b1f1508819c0a",
639+
"8ec4c3ccdaea336bdeb245636970be01266509b33f3d2642504eaf412206207a",
640+
"8bb571662db12d38ee4e2630d4434f6f626cb0e6007e3cc41d2f44dbb32e6e9d", 4096,
641+
"03988d3808ca6b0f98e2ae6d9d80a65ceb5a799e5bbaf5d161885b4c4cc18118");
580642
}
581643

582644
BOOST_AUTO_TEST_CASE(chacha20_midblock)

‎src/test/fuzz/crypto_chacha20.cpp

+28
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@
77
#include <test/fuzz/fuzz.h>
88
#include <test/fuzz/util.h>
99

10+
#include <array>
11+
#include <cstddef>
1012
#include <cstdint>
1113
#include <vector>
1214

@@ -43,3 +45,29 @@ FUZZ_TARGET(crypto_chacha20)
4345
});
4446
}
4547
}
48+
49+
FUZZ_TARGET(crypto_fschacha20)
50+
{
51+
FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
52+
53+
auto key_vec = ConsumeFixedLengthByteVector(fuzzed_data_provider, FSCHACHA20_KEYLEN);
54+
key_vec.resize(FSCHACHA20_KEYLEN);
55+
auto salt_vec = ConsumeFixedLengthByteVector(fuzzed_data_provider, FSCHACHA20_KEYLEN);
56+
salt_vec.resize(FSCHACHA20_KEYLEN);
57+
58+
std::array<std::byte, FSCHACHA20_KEYLEN> key;
59+
memcpy(key.data(), key_vec.data(), FSCHACHA20_KEYLEN);
60+
61+
std::array<std::byte, FSCHACHA20_KEYLEN> salt;
62+
memcpy(salt.data(), salt_vec.data(), FSCHACHA20_KEYLEN);
63+
64+
auto fsc20 = FSChaCha20{key, salt, fuzzed_data_provider.ConsumeIntegralInRange<size_t>(1, 1024)};
65+
66+
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000)
67+
{
68+
auto input = fuzzed_data_provider.ConsumeBytes<std::byte>(fuzzed_data_provider.ConsumeIntegralInRange(0, 4096));
69+
std::vector<std::byte> output;
70+
output.resize(input.size());
71+
fsc20.Crypt(input, output);
72+
}
73+
}

0 commit comments

Comments
 (0)