Adam Langley
594708b89f
This change adds a package, chacha20poly1305, which implements the
ChaCha20-Poly1305 AEAD from RFC 7539. This AEAD has several attractive
features:
1. It's naturally constant time. AES-GCM needs either dedicated
hardware or extreme effort to be fast and constant-time, while
this design is easy to make constant-time.
2. It's fast on modern processors: it runs at 1GB/s on my IvyBrige
system.
3. It's seeing significant use in TLS. (A change for crypto/tls is
forthcoming.)
This change merges two CLs:
https://go-review.googlesource.com/#/c/24717
https://go-review.googlesource.com/#/c/26691
I took the amd64-optimised AEAD implementation from the former because
it was significantly faster. But the structure of the change is taken
from the latter.
This version will be checked into x/crypto. This package will then be
vendored into the stdlib so that it can be used from crypto/tls.
Change-Id: I5a60587958b7afeec81ca1091e603a7e8517000b
Reviewed-on: https://go-review.googlesource.com/30728
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
30 lines
749 B
Go
30 lines
749 B
Go
package chacha20
|
|
|
|
import (
|
|
"encoding/hex"
|
|
"testing"
|
|
)
|
|
|
|
func TestCore(t *testing.T) {
|
|
// This is just a smoke test that checks the example from
|
|
// https://tools.ietf.org/html/rfc7539#section-2.3.2. The
|
|
// chacha20poly1305 package contains much more extensive tests of this
|
|
// code.
|
|
var key [32]byte
|
|
for i := range key {
|
|
key[i] = byte(i)
|
|
}
|
|
|
|
var input [16]byte
|
|
input[0] = 1
|
|
input[7] = 9
|
|
input[11] = 0x4a
|
|
|
|
var out [64]byte
|
|
XORKeyStream(out[:], out[:], &input, &key)
|
|
const expected = "10f1e7e4d13b5915500fdd1fa32071c4c7d1f4c733c068030422aa9ac3d46c4ed2826446079faa0914c2d705d98b02a2b5129cd1de164eb9cbd083e8a2503c4e"
|
|
if result := hex.EncodeToString(out[:]); result != expected {
|
|
t.Errorf("wanted %x but got %x", expected, result)
|
|
}
|
|
}
|