Java tutorial
package org.bouncycastle.crypto.engines; import org.bouncycastle.crypto.CipherParameters; import org.bouncycastle.crypto.DataLengthException; import org.bouncycastle.crypto.MaxBytesExceededException; import org.bouncycastle.crypto.OutputLengthException; import org.bouncycastle.crypto.SkippingStreamCipher; import org.bouncycastle.crypto.params.KeyParameter; import org.bouncycastle.crypto.params.ParametersWithIV; import org.bouncycastle.util.Pack; import org.bouncycastle.util.Strings; /** * Implementation of Daniel J. Bernstein's Salsa20 stream cipher, Snuffle 2005 */ public class Salsa20Engine implements SkippingStreamCipher { public final static int DEFAULT_ROUNDS = 20; /** Constants */ private final static int STATE_SIZE = 16; // 16, 32 bit ints = 64 bytes private final static int[] TAU_SIGMA = Pack .littleEndianToInt(Strings.toByteArray("expand 16-byte k" + "expand 32-byte k"), 0, 8); protected void packTauOrSigma(int keyLength, int[] state, int stateOffset) { int tsOff = (keyLength - 16) / 4; state[stateOffset] = TAU_SIGMA[tsOff]; state[stateOffset + 1] = TAU_SIGMA[tsOff + 1]; state[stateOffset + 2] = TAU_SIGMA[tsOff + 2]; state[stateOffset + 3] = TAU_SIGMA[tsOff + 3]; } /** @deprecated */ protected final static byte[] sigma = Strings.toByteArray("expand 32-byte k"), tau = Strings.toByteArray("expand 16-byte k"); protected int rounds; /* * variables to hold the state of the engine * during encryption and decryption */ private int index = 0; protected int[] engineState = new int[STATE_SIZE]; // state protected int[] x = new int[STATE_SIZE]; // internal buffer private byte[] keyStream = new byte[STATE_SIZE * 4]; // expanded state, 64 bytes private boolean initialised = false; /* * internal counter */ private int cW0, cW1, cW2; /** * Creates a 20 round Salsa20 engine. */ public Salsa20Engine() { this(DEFAULT_ROUNDS); } /** * Creates a Salsa20 engine with a specific number of rounds. * @param rounds the number of rounds (must be an even number). */ public Salsa20Engine(int rounds) { if (rounds <= 0 || (rounds & 1) != 0) { throw new IllegalArgumentException("'rounds' must be a positive, even number"); } this.rounds = rounds; } /** * initialise a Salsa20 cipher. * * @param forEncryption whether or not we are for encryption. * @param params the parameters required to set up the cipher. * @exception IllegalArgumentException if the params argument is * inappropriate. */ public void init(boolean forEncryption, CipherParameters params) { /* * Salsa20 encryption and decryption is completely * symmetrical, so the 'forEncryption' is * irrelevant. (Like 90% of stream ciphers) */ if (!(params instanceof ParametersWithIV)) { throw new IllegalArgumentException(getAlgorithmName() + " Init parameters must include an IV"); } ParametersWithIV ivParams = (ParametersWithIV) params; byte[] iv = ivParams.getIV(); if (iv == null || iv.length != getNonceSize()) { throw new IllegalArgumentException( getAlgorithmName() + " requires exactly " + getNonceSize() + " bytes of IV"); } CipherParameters keyParam = ivParams.getParameters(); if (keyParam == null) { if (!initialised) { throw new IllegalStateException( getAlgorithmName() + " KeyParameter can not be null for first initialisation"); } setKey(null, iv); } else if (keyParam instanceof KeyParameter) { setKey(((KeyParameter) keyParam).getKey(), iv); } else { throw new IllegalArgumentException( getAlgorithmName() + " Init parameters must contain a KeyParameter (or null for re-init)"); } reset(); initialised = true; } protected int getNonceSize() { return 8; } public String getAlgorithmName() { String name = "Salsa20"; if (rounds != DEFAULT_ROUNDS) { name += "/" + rounds; } return name; } public byte returnByte(byte in) { if (limitExceeded()) { throw new MaxBytesExceededException("2^70 byte limit per IV; Change IV"); } byte out = (byte) (keyStream[index] ^ in); index = (index + 1) & 63; if (index == 0) { advanceCounter(); generateKeyStream(keyStream); } return out; } protected void advanceCounter(long diff) { int hi = (int) (diff >>> 32); int lo = (int) diff; if (hi > 0) { engineState[9] += hi; } int oldState = engineState[8]; engineState[8] += lo; if (oldState != 0 && engineState[8] < oldState) { engineState[9]++; } } protected void advanceCounter() { if (++engineState[8] == 0) { ++engineState[9]; } } protected void retreatCounter(long diff) { int hi = (int) (diff >>> 32); int lo = (int) diff; if (hi != 0) { if ((engineState[9] & 0xffffffffL) >= (hi & 0xffffffffL)) { engineState[9] -= hi; } else { throw new IllegalStateException("attempt to reduce counter past zero."); } } if ((engineState[8] & 0xffffffffL) >= (lo & 0xffffffffL)) { engineState[8] -= lo; } else { if (engineState[9] != 0) { --engineState[9]; engineState[8] -= lo; } else { throw new IllegalStateException("attempt to reduce counter past zero."); } } } protected void retreatCounter() { if (engineState[8] == 0 && engineState[9] == 0) { throw new IllegalStateException("attempt to reduce counter past zero."); } if (--engineState[8] == -1) { --engineState[9]; } } public int processBytes(byte[] in, int inOff, int len, byte[] out, int outOff) { if (!initialised) { throw new IllegalStateException(getAlgorithmName() + " not initialised"); } if ((inOff + len) > in.length) { throw new DataLengthException("input buffer too short"); } if ((outOff + len) > out.length) { throw new OutputLengthException("output buffer too short"); } if (limitExceeded(len)) { throw new MaxBytesExceededException("2^70 byte limit per IV would be exceeded; Change IV"); } for (int i = 0; i < len; i++) { out[i + outOff] = (byte) (keyStream[index] ^ in[i + inOff]); index = (index + 1) & 63; if (index == 0) { advanceCounter(); generateKeyStream(keyStream); } } return len; } public long skip(long numberOfBytes) { if (numberOfBytes >= 0) { long remaining = numberOfBytes; if (remaining >= 64) { long count = remaining / 64; advanceCounter(count); remaining -= count * 64; } int oldIndex = index; index = (index + (int) remaining) & 63; if (index < oldIndex) { advanceCounter(); } } else { long remaining = -numberOfBytes; if (remaining >= 64) { long count = remaining / 64; retreatCounter(count); remaining -= count * 64; } for (long i = 0; i < remaining; i++) { if (index == 0) { retreatCounter(); } index = (index - 1) & 63; } } generateKeyStream(keyStream); return numberOfBytes; } public long seekTo(long position) { reset(); return skip(position); } public long getPosition() { return getCounter() * 64 + index; } public void reset() { index = 0; resetLimitCounter(); resetCounter(); generateKeyStream(keyStream); } protected long getCounter() { return ((long) engineState[9] << 32) | (engineState[8] & 0xffffffffL); } protected void resetCounter() { engineState[8] = engineState[9] = 0; } protected void setKey(byte[] keyBytes, byte[] ivBytes) { if (keyBytes != null) { if ((keyBytes.length != 16) && (keyBytes.length != 32)) { throw new IllegalArgumentException(getAlgorithmName() + " requires 128 bit or 256 bit key"); } int tsOff = (keyBytes.length - 16) / 4; engineState[0] = TAU_SIGMA[tsOff]; engineState[5] = TAU_SIGMA[tsOff + 1]; engineState[10] = TAU_SIGMA[tsOff + 2]; engineState[15] = TAU_SIGMA[tsOff + 3]; // Key Pack.littleEndianToInt(keyBytes, 0, engineState, 1, 4); Pack.littleEndianToInt(keyBytes, keyBytes.length - 16, engineState, 11, 4); } // IV Pack.littleEndianToInt(ivBytes, 0, engineState, 6, 2); } protected void generateKeyStream(byte[] output) { salsaCore(rounds, engineState, x); Pack.intToLittleEndian(x, output, 0); } /** * Salsa20 function * * @param input input data */ public static void salsaCore(int rounds, int[] input, int[] x) { if (input.length != 16) { throw new IllegalArgumentException(); } if (x.length != 16) { throw new IllegalArgumentException(); } if (rounds % 2 != 0) { throw new IllegalArgumentException("Number of rounds must be even"); } int x00 = input[0]; int x01 = input[1]; int x02 = input[2]; int x03 = input[3]; int x04 = input[4]; int x05 = input[5]; int x06 = input[6]; int x07 = input[7]; int x08 = input[8]; int x09 = input[9]; int x10 = input[10]; int x11 = input[11]; int x12 = input[12]; int x13 = input[13]; int x14 = input[14]; int x15 = input[15]; for (int i = rounds; i > 0; i -= 2) { x04 ^= rotl(x00 + x12, 7); x08 ^= rotl(x04 + x00, 9); x12 ^= rotl(x08 + x04, 13); x00 ^= rotl(x12 + x08, 18); x09 ^= rotl(x05 + x01, 7); x13 ^= rotl(x09 + x05, 9); x01 ^= rotl(x13 + x09, 13); x05 ^= rotl(x01 + x13, 18); x14 ^= rotl(x10 + x06, 7); x02 ^= rotl(x14 + x10, 9); x06 ^= rotl(x02 + x14, 13); x10 ^= rotl(x06 + x02, 18); x03 ^= rotl(x15 + x11, 7); x07 ^= rotl(x03 + x15, 9); x11 ^= rotl(x07 + x03, 13); x15 ^= rotl(x11 + x07, 18); x01 ^= rotl(x00 + x03, 7); x02 ^= rotl(x01 + x00, 9); x03 ^= rotl(x02 + x01, 13); x00 ^= rotl(x03 + x02, 18); x06 ^= rotl(x05 + x04, 7); x07 ^= rotl(x06 + x05, 9); x04 ^= rotl(x07 + x06, 13); x05 ^= rotl(x04 + x07, 18); x11 ^= rotl(x10 + x09, 7); x08 ^= rotl(x11 + x10, 9); x09 ^= rotl(x08 + x11, 13); x10 ^= rotl(x09 + x08, 18); x12 ^= rotl(x15 + x14, 7); x13 ^= rotl(x12 + x15, 9); x14 ^= rotl(x13 + x12, 13); x15 ^= rotl(x14 + x13, 18); } x[0] = x00 + input[0]; x[1] = x01 + input[1]; x[2] = x02 + input[2]; x[3] = x03 + input[3]; x[4] = x04 + input[4]; x[5] = x05 + input[5]; x[6] = x06 + input[6]; x[7] = x07 + input[7]; x[8] = x08 + input[8]; x[9] = x09 + input[9]; x[10] = x10 + input[10]; x[11] = x11 + input[11]; x[12] = x12 + input[12]; x[13] = x13 + input[13]; x[14] = x14 + input[14]; x[15] = x15 + input[15]; } /** * Rotate left * * @param x value to rotate * @param y amount to rotate x * * @return rotated x */ protected static int rotl(int x, int y) { return (x << y) | (x >>> -y); } private void resetLimitCounter() { cW0 = 0; cW1 = 0; cW2 = 0; } private boolean limitExceeded() { if (++cW0 == 0) { if (++cW1 == 0) { return (++cW2 & 0x20) != 0; // 2^(32 + 32 + 6) } } return false; } /* * this relies on the fact len will always be positive. */ private boolean limitExceeded(int len) { cW0 += len; if (cW0 < len && cW0 >= 0) { if (++cW1 == 0) { return (++cW2 & 0x20) != 0; // 2^(32 + 32 + 6) } } return false; } }