Filippo Valsorda
f792edd33d
The XChaCha20 construction does not have an authoritative spec, but this implementation is based on the following documents: https://cr.yp.to/snuffle/xsalsa-20081128.pdf https://download.libsodium.org/doc/secret-key_cryptography/aead.html http://loup-vaillant.fr/tutorials/chacha20-design https://tools.ietf.org/html/draft-paragon-paseto-rfc-00#section-7 Tested against the following implementations: https://github.com/jedisct1/libsodium/blob/7cdf3f0e841/test/default/aead_xchacha20poly1305.c https://git.kernel.org/pub/scm/linux/kernel/git/zx2c4/linux.git/diff/lib/zinc/selftest/chacha20poly1305.h?h=zinc https://git.zx2c4.com/wireguard-go/tree/xchacha20poly1305/xchacha20.go name time/op speed Chacha20Poly1305/Open-64-8 225ns ± 1% 283MB/s ± 1% Chacha20Poly1305/Open-64-X-8 390ns ± 0% 164MB/s ± 0% Chacha20Poly1305/Seal-64-8 222ns ± 0% 287MB/s ± 0% Chacha20Poly1305/Seal-64-X-8 386ns ± 0% 165MB/s ± 1% Chacha20Poly1305/Open-1350-8 1.12µs ± 1% 1.21GB/s ± 1% Chacha20Poly1305/Open-1350-X-8 1.28µs ± 0% 1.05GB/s ± 0% Chacha20Poly1305/Seal-1350-8 1.15µs ± 0% 1.17GB/s ± 0% Chacha20Poly1305/Seal-1350-X-8 1.32µs ± 1% 1.02GB/s ± 0% Chacha20Poly1305/Open-8192-8 5.53µs ± 0% 1.48GB/s ± 0% Chacha20Poly1305/Open-8192-X-8 5.71µs ± 1% 1.44GB/s ± 1% Chacha20Poly1305/Seal-8192-8 5.54µs ± 1% 1.48GB/s ± 1% Chacha20Poly1305/Seal-8192-X-8 5.74µs ± 1% 1.43GB/s ± 1% Updates golang/go#24485 Change-Id: Iea6f3b4c2be67f16f56720a200dcc895c0f9d520 Reviewed-on: https://go-review.googlesource.com/127819 Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Adam Langley <agl@golang.org>