Support ChaCha20+Poly1305 cipher suites.

nss/lib/freebl/blapi.h

Index: nss/lib/freebl/blapi.h
===================================================================
--- nss/lib/freebl/blapi.h	(revision 228205)
+++ nss/lib/freebl/blapi.h	(working copy)
@@ -818,7 +818,32 @@
 		 unsigned int *outputLen, unsigned int maxOutputLen,
 		 const unsigned char *input, unsigned int inputLen);
 
+/******************************************/
+/*
+** ChaCha20+Poly1305 AEAD
+*/
 
+extern ChaCha20Poly1305Context *
+ChaCha20Poly1305_CreateContext(const unsigned char *key, unsigned int keyLen,
+			       const unsigned char *nonce, unsigned int nonceLen,

[wtc, 2013/10/19 01:09:42]

Do you think this function should assume |key| and |nonce| are the right lengths
and omit the |keyLen| and |nonceLen| parameters?

[agl, 2013/10/21 21:53:39]

I'm ok with that if you are. (There are tweaks to ChaCha20 that let it take a 16
byte key or a 24 byte nonce, but we don't support either. It's possible that we
could in the future however.)

[wtc, 2013/10/22 22:36:42]

I decided to leave the length arguments there.

+			       const unsigned char *ad, unsigned int adLen,
+			       unsigned int tagBits);
+
+extern void
+ChaCha20Poly1305_DestroyContext(ChaCha20Poly1305Context *ctx, PRBool freeit);
+
+extern SECStatus
+ChaCha20Poly1305_Seal(const ChaCha20Poly1305Context *ctx,
+		      unsigned char *output, unsigned int *outputLen,
+		      unsigned int maxOutputLen,
+		      const unsigned char *input, unsigned int inputLen);

[wtc, 2013/10/19 19:51:02]

I will go back to your original design and let the _Seal and _Open functions
take |iv| and |ad| inputs. This will allow us to perform multiple _Seal or _Open
operations using the same ChaCha20Poly1305Context.

I will change the _CreateContext function to calculate the Poly1305 key and
store it in the ChaCha20Poly1305Context.

In lib/softoken, I will resurrect the sftk_ChaCha20Poly1305 wrapper functions
that match the SFTKCipher function signature.

[wtc, 2013/10/20 23:21:28]

I just realized this won't work because Poly1305 keys are one-time keys.

+
+extern SECStatus
+ChaCha20Poly1305_Open(const ChaCha20Poly1305Context *ctx,
+		      unsigned char *output, unsigned int *outputLen,
+		      unsigned int maxOutputLen,
+		      const unsigned char *input, unsigned int inputLen);
+
 /******************************************/
 /*
 ** MD5 secure hash function