raycrypt 0.3.1

Encrypt at the speed of light
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226

#[cfg(target_arch = "x86")]
use core::arch::x86::*;
#[cfg(target_arch = "x86_64")]
use core::arch::x86_64::*;

use crate::utils::from_le_bytes;

const SIGMA: [u32; 4] = [0x61707865, 0x3320646e, 0x79622d32, 0x6b206574];

// taken from rustcrypto/stream-ciphers
#[inline(always)]
unsafe fn rows_to_cols(vs: &mut [__m256i; 4]) {
    vs[2] = _mm256_shuffle_epi32(vs[2], 0b_00_11_10_01);
    vs[3] = _mm256_shuffle_epi32(vs[3], 0b_01_00_11_10);
    vs[0] = _mm256_shuffle_epi32(vs[0], 0b_10_01_00_11);
}

#[inline(always)]
unsafe fn cols_to_rows(vs: &mut [__m256i; 4]) {
    vs[2] = _mm256_shuffle_epi32(vs[2], 0b_10_01_00_11);
    vs[3] = _mm256_shuffle_epi32(vs[3], 0b_01_00_11_10);
    vs[0] = _mm256_shuffle_epi32(vs[0], 0b_00_11_10_01);
}

#[inline(always)]
unsafe fn permute(data: &mut [__m256i; 4]) {
    data[0] = _mm256_add_epi32(data[0], data[1]);
    data[3] = _mm256_xor_si256(data[3], data[0]);
    data[3] = _mm256_xor_si256(
        _mm256_slli_epi32(data[3], 16),
        _mm256_srli_epi32(data[3], 16),
    );

    data[2] = _mm256_add_epi32(data[2], data[3]);
    data[1] = _mm256_xor_si256(data[1], data[2]);
    data[1] = _mm256_xor_si256(
        _mm256_slli_epi32(data[1], 12),
        _mm256_srli_epi32(data[1], 20),
    );

    data[0] = _mm256_add_epi32(data[0], data[1]);
    data[3] = _mm256_xor_si256(data[3], data[0]);
    data[3] = _mm256_xor_si256(
        _mm256_slli_epi32(data[3], 8),
        _mm256_srli_epi32(data[3], 24),
    );

    data[2] = _mm256_add_epi32(data[2], data[3]);
    data[1] = _mm256_xor_si256(data[1], data[2]);
    data[1] = _mm256_xor_si256(
        _mm256_slli_epi32(data[1], 7),
        _mm256_srli_epi32(data[1], 25),
    );
}

#[inline(always)]
unsafe fn double_quarter_round(mut data: [__m256i; 4]) -> [__m256i; 4] {
    permute(&mut data);
    rows_to_cols(&mut data);
    permute(&mut data);
    cols_to_rows(&mut data);

    data
}

#[target_feature(enable = "avx2")]
pub unsafe fn rounds(mut items: [__m256i; 4]) -> [__m256i; 4] {
    items[3] = _mm256_add_epi32(items[3], _mm256_set_epi32(0, 0, 0, 1, 0, 0, 0, 0));
    let initial_state = items.clone();

    for _ in 0..10 {
        items = double_quarter_round(items);
    }

    for i in 0..4 {
        items[i] = _mm256_add_epi32(items[i], initial_state[i]);
    }

    let mut output = [_mm256_setzero_si256(); 4];

    output[0] = _mm256_permute2x128_si256(items[0], items[1], 0x20);
    output[1] = _mm256_permute2x128_si256(items[2], items[3], 0x20);
    output[2] = _mm256_permute2x128_si256(items[0], items[1], 0x31);
    output[3] = _mm256_permute2x128_si256(items[2], items[3], 0x31);

    output
}

#[inline]
#[target_feature(enable = "avx2")]
unsafe fn encrypt_remainder(
    block_ptr: *const __m256i,
    keystream: __m256i,
    ciphertext: &mut Vec<u8>,
) {
    let plaintext_block = _mm256_loadu_si256(block_ptr);

    let ciphertext_block = _mm256_xor_si256(plaintext_block, keystream);

    let mut output_block = [0u8; 32];
    _mm256_storeu_si256(output_block.as_mut_ptr() as *mut __m256i, ciphertext_block);

    let start = ciphertext.len() - (ciphertext.len() % 32);
    let end = ciphertext.len();

    ciphertext[start..].copy_from_slice(&output_block[..(end - start)]);
}

#[inline]
#[target_feature(enable = "avx2")]
unsafe fn encrypt_block(
    block: &[u8],
    keystream: [__m256i; 4],
    ciphertext: &mut Vec<u8>,
    mut ct_ptr: *mut __m256i,
) {
    let mut ptr = block.as_ptr() as *const __m256i;

    for i in 0..4 {
        if i * 32 > block.len() {
            return;
        }
        if (i + 1) * 32 > block.len() {
            encrypt_remainder(ptr, keystream[i], ciphertext);
            continue;
        }

        let plaintext_block = _mm256_loadu_si256(ptr);

        let ciphertext_block = _mm256_xor_si256(plaintext_block, keystream[i]);

        _mm256_storeu_si256(ct_ptr, ciphertext_block);

        ptr = ptr.add(1);
        ct_ptr = ct_ptr.add(1);
    }
}

pub struct ChaCha20 {
    state: [__m256i; 3],
}

// lower level functions
impl ChaCha20 {
    #[inline(always)]
    pub fn new(key: &[u8]) -> ChaCha20 {
        unsafe {
            let s0 = _mm256_broadcastsi128_si256(_mm_loadu_si128(SIGMA.as_ptr() as *const __m128i));

            let mut s1 = _mm256_loadu_si256(key.as_ptr() as *const __m256i);
            let s2 = _mm256_permute2x128_si256(s1, s1, 0x11);
            s1 = _mm256_permute2x128_si256(s1, s1, 0x00);

            ChaCha20 {
                state: [s0, s1, s2],
            }
        }
    }

    /// Generates a keystream block. Should not be used.
    #[inline]
    #[target_feature(enable = "avx2")]
    unsafe fn _keystream(&self, nonce: __m256i) -> [__m256i; 4] {
        let state = [self.state[0], self.state[1], self.state[2], nonce];
        rounds(state)
    }

    #[inline]
    #[target_feature(enable = "avx2")]
    pub unsafe fn _encrypt(&self, plaintext: &[u8], nonce: &[u8]) -> Vec<u8> {
        let nonce_block = [
            1,
            from_le_bytes(&nonce[0..4]),
            from_le_bytes(&nonce[4..8]),
            from_le_bytes(&nonce[8..12]),
        ];

        let nonce_vector = _mm_loadu_si128(nonce_block.as_ptr() as *const __m128i);

        let mut nonce = _mm256_broadcastsi128_si256(nonce_vector);

        let mut ciphertext: Vec<u8> = vec![0u8; plaintext.len()];
        let mut ct_ptr = ciphertext.as_mut_ptr() as *mut __m256i;

        for block in plaintext.chunks(128) {
            let keystream = self._keystream(nonce);

            nonce = _mm256_add_epi32(nonce, _mm256_set_epi32(0, 0, 0, 2, 0, 0, 0, 2));

            encrypt_block(block, keystream, &mut ciphertext, ct_ptr);
            ct_ptr = ct_ptr.add(4);
        }

        ciphertext
    }
}

impl ChaCha20 {
    pub fn encrypt(&self, plaintext: &[u8], nonce: &[u8]) -> Vec<u8> {
        unsafe { self._encrypt(plaintext, nonce) }
    }

    pub fn keystream(&self, nonce: &[u8], counter: u32) -> [u8; 64] {
        let mut nonce_block = [
            counter,
            from_le_bytes(&nonce[0..4]),
            from_le_bytes(&nonce[4..8]),
            from_le_bytes(&nonce[8..12]),
        ];

        unsafe {
            let nonce = _mm256_broadcastsi128_si256(_mm_loadu_si128(
                nonce_block.as_mut_ptr() as *mut __m128i
            ));

            let keystream = self._keystream(nonce);

            let mut output = [0u8; 64];

            _mm256_storeu_si256(output.as_mut_ptr() as *mut __m256i, keystream[0]);
            _mm256_storeu_si256((output.as_mut_ptr() as *mut __m256i).add(1), keystream[1]);

            output
        }
    }
}