ssh_chacha20.h File Reference

ChaCha20 stream cipher (D. J. Bernstein; RFC 8439). More...

#include <stddef.h>
#include <stdint.h>

Go to the source code of this file.

Macros
#define	SSH_CHACHA20_KEY_LEN   32
#define	SSH_CHACHA20_BLOCK_LEN   64

Functions
void	ssh_chacha20_xor (const uint8_t key[SSH_CHACHA20_KEY_LEN], const uint8_t iv[8], uint64_t counter, const uint8_t *in, uint8_t *out, size_t len)
	XOR len bytes of in with the ChaCha20 keystream into out (OpenSSH layout).
void	ssh_chacha20_block_ietf (const uint8_t key[SSH_CHACHA20_KEY_LEN], uint32_t counter, const uint8_t nonce[12], uint8_t out[SSH_CHACHA20_BLOCK_LEN])
	One 64-byte ChaCha20 keystream block in the RFC 8439 layout (for the KAT).

Detailed Description

ChaCha20 stream cipher (D. J. Bernstein; RFC 8439).

The 20-round ARX permutation used by the chach.nosp@m.a20-.nosp@m.poly1.nosp@m.305@.nosp@m.opens.nosp@m.sh.c.nosp@m.om cipher. Two views of the same core are exposed:

• ssh_chacha20_xor(): the original ChaCha layout OpenSSH uses - a 64-bit little-endian block counter (state words 12-13) and a 64-bit nonce/IV (words 14-15). This is what the SSH AEAD drives; the counter increments per 64-byte block.
• ssh_chacha20_block_ietf(): the RFC 8439 layout (32-bit counter in word 12, 96-bit nonce in words 13-15), exposed so the core can be checked against the published RFC 8439 Section 2.3.2 block test vector.

Pure ARX (add-rotate-xor): naturally constant-time, no tables, ~64-byte state. No heap.

Author

Douglas Quigg (dstroy0)

Date

2026

Definition in file ssh_chacha20.h.

Macro Definition Documentation

SSH_CHACHA20_KEY_LEN

#define SSH_CHACHA20_KEY_LEN   32

Definition at line 30 of file ssh_chacha20.h.

SSH_CHACHA20_BLOCK_LEN

#define SSH_CHACHA20_BLOCK_LEN   64

Definition at line 31 of file ssh_chacha20.h.

Function Documentation

ssh_chacha20_xor()

void ssh_chacha20_xor	(	const uint8_t	key[SSH_CHACHA20_KEY_LEN],
		const uint8_t	iv[8],
		uint64_t	counter,
		const uint8_t *	in,
		uint8_t *	out,
		size_t	len
	)

XOR len bytes of in with the ChaCha20 keystream into out (OpenSSH layout).

Parameters

key	32-byte key.
iv	8-byte nonce (OpenSSH uses the packet sequence number, big-endian).
counter	initial 64-bit block counter (0 for the Poly1305-key / length blocks, 1 for the packet payload); it increments per 64-byte block.
in	plaintext (or ciphertext when decrypting); may be nullptr to emit raw keystream.
out	output buffer (len bytes); may alias in.

Definition at line 79 of file ssh_chacha20.cpp.

Referenced by ssh_chachapoly_decrypt(), ssh_chachapoly_encrypt(), and ssh_chachapoly_get_length().

ssh_chacha20_block_ietf()

void ssh_chacha20_block_ietf	(	const uint8_t	key[SSH_CHACHA20_KEY_LEN],
		uint32_t	counter,
		const uint8_t	nonce[12],
		uint8_t	out[SSH_CHACHA20_BLOCK_LEN]
	)

One 64-byte ChaCha20 keystream block in the RFC 8439 layout (for the KAT).

Parameters

key	32-byte key.
counter	32-bit block counter (word 12).
nonce	12-byte nonce (words 13-15).
out	64-byte keystream block.

Definition at line 106 of file ssh_chacha20.cpp.