chach.nosp@m.a20-.nosp@m.poly1.nosp@m.305@.nosp@m.opens.nosp@m.sh.c.nosp@m.om AEAD cipher (OpenSSH PROTOCOL.chacha20poly1305). More...

#include <stddef.h>
#include <stdint.h>

Macros
#define	SSH_CHACHAPOLY_KEY_LEN 64
	two 256-bit ChaCha20 keys

#define	SSH_CHACHAPOLY_TAG_LEN 16
	Poly1305 tag.

#define	SSH_CHACHAPOLY_AAD_LEN 4
	the encrypted packet-length field

Functions
uint32_t	ssh_chachapoly_get_length (const uint8_t key[SSH_CHACHAPOLY_KEY_LEN], uint32_t seqnr, const uint8_t enc_len[SSH_CHACHAPOLY_AAD_LEN])
	Decrypt just the 4-byte length field to learn the packet length before reading the body.

void	ssh_chachapoly_encrypt (const uint8_t key[SSH_CHACHAPOLY_KEY_LEN], uint32_t seqnr, uint8_t dest, const uint8_t src, uint32_t payload_len)
	Encrypt+authenticate one packet.

bool	ssh_chachapoly_decrypt (const uint8_t key[SSH_CHACHAPOLY_KEY_LEN], uint32_t seqnr, uint8_t dest, const uint8_t src, uint32_t payload_len)
	Verify+decrypt one packet.

Detailed Description

chach.nosp@m.a20-.nosp@m.poly1.nosp@m.305@.nosp@m.opens.nosp@m.sh.c.nosp@m.om AEAD cipher (OpenSSH PROTOCOL.chacha20poly1305).

OpenSSH's authenticated cipher for the SSH binary packet. The 512-bit key is split into two 256-bit ChaCha20 keys: K_main = key[0..32] encrypts the packet payload, K_header = key[32..64] encrypts the 4-byte packet-length field separately (so a receiver can size the packet before it has the whole thing). The nonce for both is the packet sequence number as a big-endian uint64.

Poly1305 key = first 32 bytes of ChaCha20(K_main, seqnr, counter 0)
encrypted length = ChaCha20(K_header, seqnr, counter 0) XOR length
encrypted payload = ChaCha20(K_main, seqnr, counter 1) XOR payload
tag = Poly1305(encrypted_length || encrypted_payload) (16 bytes, appended)

On decrypt the tag is verified (constant-time) before any plaintext is produced. Pure, no heap.

Author: Douglas Quigg (dstroy0)

Date: 2026

Definition in file ssh_chachapoly.h.

Macro Definition Documentation

◆ SSH_CHACHAPOLY_KEY_LEN

#define SSH_CHACHAPOLY_KEY_LEN 64

two 256-bit ChaCha20 keys

Definition at line 30 of file ssh_chachapoly.h.

◆ SSH_CHACHAPOLY_TAG_LEN

#define SSH_CHACHAPOLY_TAG_LEN 16

Poly1305 tag.

Definition at line 31 of file ssh_chachapoly.h.

◆ SSH_CHACHAPOLY_AAD_LEN

#define SSH_CHACHAPOLY_AAD_LEN 4

the encrypted packet-length field

Definition at line 32 of file ssh_chachapoly.h.

Function Documentation

◆ ssh_chachapoly_get_length()

uint32_t ssh_chachapoly_get_length	(	const uint8_t	key[SSH_CHACHAPOLY_KEY_LEN],
		uint32_t	seqnr,
		const uint8_t	enc_len[SSH_CHACHAPOLY_AAD_LEN]
	)

Decrypt just the 4-byte length field to learn the packet length before reading the body.

Returns: the SSH packet_length (bytes of the packet after the length field, excluding the tag).

Definition at line 40 of file ssh_chachapoly.cpp.

References ssh_chacha20_xor().

Referenced by ssh_pkt_recv().

◆ ssh_chachapoly_encrypt()

void ssh_chachapoly_encrypt	(	const uint8_t	key[SSH_CHACHAPOLY_KEY_LEN],
		uint32_t	seqnr,
		uint8_t *	dest,
		const uint8_t *	src,
		uint32_t	payload_len
	)

Encrypt+authenticate one packet.

Parameters

src	plaintext: 4-byte packet length (big-endian) \|\| `payload_len` payload bytes.
dest	output: encrypted length (4) \|\| encrypted payload (`payload_len`) \|\| tag (16). May alias `src`. dest must hold 4 + payload_len + 16 bytes.

Definition at line 50 of file ssh_chachapoly.cpp.

References ssh_chacha20_xor(), and ssh_poly1305().

Referenced by ssh_pkt_send().

◆ ssh_chachapoly_decrypt()

bool ssh_chachapoly_decrypt	(	const uint8_t	key[SSH_CHACHAPOLY_KEY_LEN],
		uint32_t	seqnr,
		uint8_t *	dest,
		const uint8_t *	src,
		uint32_t	payload_len
	)

Verify+decrypt one packet.