Support ChaCha20+Poly1305 cipher suites.

nss/lib/freebl/blapi.h

 /*
  * crypto.h - public data structures and prototypes for the crypto library
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef _BLAPI_H_
 #define _BLAPI_H_
 
@@ skipping 800 matching lines @@
 **      "maxOutputLen" the maximum amount of data that can ever be
 **         stored in "output"
 **      "input" the input data
 **      "inputLen" the amount of input data
 */
 extern SECStatus 
 Camellia_Decrypt(CamelliaContext *cx, unsigned char *output,
                  unsigned int *outputLen, unsigned int maxOutputLen,
                  const unsigned char *input, unsigned int inputLen);
 
+/******************************************/
+/*
+** ChaCha20+Poly1305 AEAD
+*/
+
+extern ChaCha20Poly1305Context *
+ChaCha20Poly1305_CreateContext(const unsigned char *key, unsigned int keyLen,
+                               const unsigned char *nonce, unsigned int nonceLen,

[wtc, 2013/10/19 01:09:42]

Do you think this function should assume |key| and |nonce| are the right lengths
and omit the |keyLen| and |nonceLen| parameters?

[agl, 2013/10/21 21:53:39]

I'm ok with that if you are. (There are tweaks to ChaCha20 that let it take a 16
byte key or a 24 byte nonce, but we don't support either. It's possible that we
could in the future however.)

[wtc, 2013/10/22 22:36:42]

I decided to leave the length arguments there.

+                               const unsigned char *ad, unsigned int adLen,
+                               unsigned int tagBits);
+
+extern void
+ChaCha20Poly1305_DestroyContext(ChaCha20Poly1305Context *ctx, PRBool freeit);
+
+extern SECStatus
+ChaCha20Poly1305_Seal(const ChaCha20Poly1305Context *ctx,
+                      unsigned char *output, unsigned int *outputLen,
+                      unsigned int maxOutputLen,
+                      const unsigned char *input, unsigned int inputLen);

[wtc, 2013/10/19 19:51:02]

I will go back to your original design and let the _Seal and _Open functions
take |iv| and |ad| inputs. This will allow us to perform multiple _Seal or _Open
operations using the same ChaCha20Poly1305Context.

I will change the _CreateContext function to calculate the Poly1305 key and
store it in the ChaCha20Poly1305Context.

In lib/softoken, I will resurrect the sftk_ChaCha20Poly1305 wrapper functions
that match the SFTKCipher function signature.

[wtc, 2013/10/20 23:21:28]

I just realized this won't work because Poly1305 keys are one-time keys.

+
+extern SECStatus
+ChaCha20Poly1305_Open(const ChaCha20Poly1305Context *ctx,
+                      unsigned char *output, unsigned int *outputLen,
+                      unsigned int maxOutputLen,
+                      const unsigned char *input, unsigned int inputLen);
 
 /******************************************/
 /*
 ** MD5 secure hash function
 */
 
 /*
 ** Hash a null terminated string "src" into "dest" using MD5
 */
 extern SECStatus MD5_Hash(unsigned char *dest, const char *src);
@@ skipping 573 matching lines @@
 PRBool BLAPI_VerifySelf(const char *name);
 
 /*********************************************************************/
 extern const SECHashObject * HASH_GetRawHashObject(HASH_HashType hashType);
 
 extern void BL_SetForkState(PRBool forked);
 
 SEC_END_PROTOS
 
 #endif /* _BLAPI_H_ */