Replace local ChaCha20-Poly1305 with external crate

Migrates ChaCha20-Poly1305 encryption from the local crypto
module to rust-bitcoin's `chacha20-poly1305` crate.

Integrated the crate across all modules (Router,
PeerStorage, Onion Utils, etc.).

Add the chacha20_poly1305_fuzz flag to fuzz config to after
implementing the fuzz logic upstream.

Author: Abeeujah

.github/workflows/build.yml

@@ -225,9 +225,9 @@ jobs:
       - name: Sanity check fuzz targets on Rust ${{ env.TOOLCHAIN }}
         run: |
           cd fuzz
-          RUSTFLAGS="--cfg=fuzzing --cfg=secp256k1_fuzz --cfg=hashes_fuzz" cargo test --quiet --color always --lib -j8
-          RUSTFLAGS="--cfg=fuzzing --cfg=secp256k1_fuzz --cfg=hashes_fuzz" cargo test --manifest-path fuzz-fake-hashes/Cargo.toml --quiet --color always --bins -j8
-          RUSTFLAGS="--cfg=fuzzing --cfg=secp256k1_fuzz" cargo test --manifest-path fuzz-real-hashes/Cargo.toml --quiet --color always --bins -j8
+          RUSTFLAGS="--cfg=fuzzing --cfg=secp256k1_fuzz --cfg=hashes_fuzz --cfg=chacha20_poly1305_fuzz" cargo test --quiet --color always --lib -j8
+          RUSTFLAGS="--cfg=fuzzing --cfg=secp256k1_fuzz --cfg=hashes_fuzz --cfg=chacha20_poly1305_fuzz" cargo test --manifest-path fuzz-fake-hashes/Cargo.toml --quiet --color always --bins -j8
+          RUSTFLAGS="--cfg=fuzzing --cfg=secp256k1_fuzz --cfg=chacha20_poly1305_fuzz" cargo test --manifest-path fuzz-real-hashes/Cargo.toml --quiet --color always --bins -j8
 
   fuzz:
     runs-on: self-hosted

Cargo.toml

@@ -58,6 +58,7 @@ check-cfg = [
     "cfg(fuzzing)",
     "cfg(secp256k1_fuzz)",
     "cfg(hashes_fuzz)",
+    "cfg(chacha20_poly1305_fuzz)",
     "cfg(test)",
     "cfg(debug_assertions)",
     "cfg(c_bindings)",

ci/check-compiles.sh

@@ -6,9 +6,9 @@ cargo check
 cargo doc
 cargo doc --document-private-items
 cd fuzz
-RUSTFLAGS="--cfg=fuzzing --cfg=secp256k1_fuzz --cfg=hashes_fuzz" \
+RUSTFLAGS="--cfg=fuzzing --cfg=secp256k1_fuzz --cfg=hashes_fuzz --cfg=chacha20_poly1305_fuzz" \
 	cargo check --manifest-path fuzz-fake-hashes/Cargo.toml --features=stdin_fuzz
-RUSTFLAGS="--cfg=fuzzing --cfg=secp256k1_fuzz" \
+RUSTFLAGS="--cfg=fuzzing --cfg=secp256k1_fuzz --cfg=chacha20_poly1305_fuzz" \
 	cargo check --manifest-path fuzz-real-hashes/Cargo.toml --features=stdin_fuzz
 cd ../lightning && cargo check --no-default-features
 cd .. && RUSTC_BOOTSTRAP=1 RUSTFLAGS="--cfg=c_bindings" cargo check -Z avoid-dev-deps

fuzz/Cargo.toml

@@ -44,4 +44,5 @@ check-cfg = [
     "cfg(secp256k1_fuzz)",
     "cfg(hashes_fuzz)",
     "cfg(splicing)",
+    "cfg(chacha20_poly1305_fuzz)"
 ]

lightning/Cargo.toml

@@ -40,6 +40,7 @@ lightning-macros = { version = "0.2", path = "../lightning-macros" }
 
 bech32 = { version = "0.11.0", default-features = false }
 bitcoin = { version = "0.32.4", default-features = false, features = ["secp-recovery"] }
+chacha20-poly1305 = { version = "0.2.0", default-features = false }
 
 dnssec-prover = { version = "0.6", default-features = false }
 hashbrown = { version = "0.13", default-features = false }

lightning/src/crypto/streams.rs

@@ -1,7 +1,4 @@
-use crate::crypto::chacha20::ChaCha20;
-use crate::crypto::chacha20poly1305rfc::ChaCha20Poly1305RFC;
 use crate::crypto::fixed_time_eq;
-use crate::crypto::poly1305::Poly1305;
 
 use crate::io::{self, Read, Write};
 use crate::ln::msgs::DecodeError;
@@ -10,6 +7,10 @@ use crate::util::ser::{
 };
 
 use alloc::vec::Vec;
+use chacha20_poly1305::{
+	chacha20::{ChaCha20, Key, Nonce},
+	poly1305::Poly1305,
+};
 
 pub(crate) struct ChaChaReader<'a, R: io::Read> {
 	pub chacha: &'a mut ChaCha20,
@@ -19,7 +20,7 @@ impl<'a, R: io::Read> io::Read for ChaChaReader<'a, R> {
 	fn read(&mut self, dest: &mut [u8]) -> Result<usize, io::Error> {
 		let res = self.read.read(dest)?;
 		if res > 0 {
-			self.chacha.process_in_place(&mut dest[0..res]);
+			self.chacha.apply_keystream(&mut dest[..res]);
 		}
 		Ok(res)
 	}
@@ -42,11 +43,20 @@ impl<'a, W: Writeable> ChaChaPolyWriteAdapter<'a, W> {
 impl<'a, T: Writeable> Writeable for ChaChaPolyWriteAdapter<'a, T> {
 	// Simultaneously write and encrypt Self::writeable.
 	fn write<W: Writer>(&self, w: &mut W) -> Result<(), io::Error> {
-		let mut chacha = ChaCha20Poly1305RFC::new(&self.rho, &[0; 12], &[]);
-		let mut chacha_stream = ChaChaPolyWriter { chacha: &mut chacha, write: w };
+		let mut chacha = ChaCha20::new(Key::new(self.rho), Nonce::new([0; 12]), 0);
+		let mut mac_key = [0u8; 64];
+		chacha.apply_keystream(&mut mac_key);
+
+		#[cfg(not(fuzzing))]
+		let mac = Poly1305::new(mac_key[..32].try_into().unwrap());
+		#[cfg(fuzzing)]
+		let mac = Poly1305::new(self.rho);
+
+		let mut chacha_stream =
+			ChaChaPolyWriter { chacha: &mut chacha, poly: mac, write_len: 0, write: w };
 		self.writeable.write(&mut chacha_stream)?;
-		let mut tag = [0 as u8; 16];
-		chacha.finish_and_get_tag(&mut tag);
+
+		let tag = chacha_stream.finish_and_get_tag();
 		tag.write(w)?;
 
 		Ok(())
@@ -62,12 +72,15 @@ impl<'a, T: Writeable> Writeable for ChaChaPolyWriteAdapter<'a, T> {
 pub(crate) fn chachapoly_encrypt_with_swapped_aad(
 	mut plaintext: Vec<u8>, key: [u8; 32], aad: [u8; 32],
 ) -> Vec<u8> {
-	let mut chacha = ChaCha20::new(&key[..], &[0; 12]);
+	let mut chacha = ChaCha20::new(Key::new(key), Nonce::new([0; 12]), 0);
 	let mut mac_key = [0u8; 64];
-	chacha.process_in_place(&mut mac_key);
+	chacha.apply_keystream(&mut mac_key);
 
-	let mut mac = Poly1305::new(&mac_key[..32]);
-	chacha.process_in_place(&mut plaintext[..]);
+	#[cfg(not(fuzzing))]
+	let mut mac = Poly1305::new(mac_key[..32].try_into().unwrap());
+	#[cfg(fuzzing)]
+	let mut mac = Poly1305::new(key);
+	chacha.apply_keystream(&mut plaintext[..]);
 	mac.input(&plaintext[..]);
 
 	if plaintext.len() % 16 != 0 {
@@ -80,7 +93,7 @@ pub(crate) fn chachapoly_encrypt_with_swapped_aad(
 	mac.input(&(plaintext.len() as u64).to_le_bytes());
 	mac.input(&32u64.to_le_bytes());
 
-	plaintext.extend_from_slice(&mac.result());
+	plaintext.extend_from_slice(&mac.tag());
 	plaintext
 }
 
@@ -105,7 +118,7 @@ pub(crate) enum TriPolyAADUsed {
 ///
 /// Note that we do *not* use the provided AADs as the standard ChaCha20Poly1305 AAD as that would
 /// require placing it first and prevent us from avoiding redundant Poly1305 rounds. Instead, the
-/// ChaCha20Poly1305 MAC check is tweaked to move the AAD to *after* the the contents being
+/// ChaCha20Poly1305 MAC check is tweaked to move the AAD to *after* the contents being
 /// checked, effectively treating the contents as the AAD for the AAD-containing MAC but behaving
 /// like classic ChaCha20Poly1305 for the non-AAD-containing MAC.
 pub(crate) struct ChaChaTriPolyReadAdapter<R: Readable> {
@@ -127,14 +140,14 @@ impl<T: Readable> LengthReadableArgs<([u8; 32], [u8; 32], [u8; 32])>
 		}
 		let (key, aad_a, aad_b) = params;
 
-		let mut chacha = ChaCha20::new(&key[..], &[0; 12]);
+		let mut chacha = ChaCha20::new(Key::new(key), Nonce::new([0; 12]), 0);
 		let mut mac_key = [0u8; 64];
-		chacha.process_in_place(&mut mac_key);
+		chacha.apply_keystream(&mut mac_key);
 
 		#[cfg(not(fuzzing))]
-		let mut mac = Poly1305::new(&mac_key[..32]);
+		let mut mac = Poly1305::new(mac_key[..32].try_into().unwrap());
 		#[cfg(fuzzing)]
-		let mut mac = Poly1305::new(&key);
+		let mut mac = Poly1305::new(key);
 
 		let decrypted_len = r.remaining_bytes() - 16;
 		let s = FixedLengthReader::new(r, decrypted_len);
@@ -145,7 +158,6 @@ impl<T: Readable> LengthReadableArgs<([u8; 32], [u8; 32], [u8; 32])>
 		while chacha_stream.read.bytes_remain() {
 			let mut buf = [0; 256];
 			if chacha_stream.read(&mut buf)? == 0 {
-				// Reached EOF
 				return Err(DecodeError::ShortRead);
 			}
 		}
@@ -173,13 +185,13 @@ impl<T: Readable> LengthReadableArgs<([u8; 32], [u8; 32], [u8; 32])>
 		mac.input(&0u64.to_le_bytes());
 		mac.input(&(read_len as u64).to_le_bytes());
 
-		let mut tag = [0 as u8; 16];
+		let mut tag = [0u8; 16];
 		r.read_exact(&mut tag)?;
-		if fixed_time_eq(&mac.result(), &tag) {
+		if fixed_time_eq(&mac.tag(), &tag) {
 			Ok(Self { readable, used_aad: TriPolyAADUsed::None })
-		} else if fixed_time_eq(&mac_aad_a.result(), &tag) {
+		} else if fixed_time_eq(&mac_aad_a.tag(), &tag) {
 			Ok(Self { readable, used_aad: TriPolyAADUsed::First })
-		} else if fixed_time_eq(&mac_aad_b.result(), &tag) {
+		} else if fixed_time_eq(&mac_aad_b.tag(), &tag) {
 			Ok(Self { readable, used_aad: TriPolyAADUsed::Second })
 		} else {
 			return Err(DecodeError::InvalidValue);
@@ -197,12 +209,12 @@ struct ChaChaTriPolyReader<'a, R: Read> {
 impl<'a, R: Read> Read for ChaChaTriPolyReader<'a, R> {
 	// Decrypts bytes from Self::read into `dest`.
 	// After all reads complete, the caller must compare the expected tag with
-	// the result of `Poly1305::result()`.
+	// the result of `Poly1305::tag()`
 	fn read(&mut self, dest: &mut [u8]) -> Result<usize, io::Error> {
 		let res = self.read.read(dest)?;
 		if res > 0 {
-			self.poly.input(&dest[0..res]);
-			self.chacha.process_in_place(&mut dest[0..res]);
+			self.poly.input(&dest[..res]);
+			self.chacha.apply_keystream(&mut dest[..res]);
 			self.read_len += res;
 		}
 		Ok(res)
@@ -224,64 +236,109 @@ impl<T: Readable> LengthReadableArgs<[u8; 32]> for ChaChaPolyReadAdapter<T> {
 			return Err(DecodeError::InvalidValue);
 		}
 
-		let mut chacha = ChaCha20Poly1305RFC::new(&secret, &[0; 12], &[]);
+		let mut chacha = ChaCha20::new(Key::new(secret), Nonce::new([0; 12]), 0);
+		let mut mac_key = [0u8; 64];
+		chacha.apply_keystream(&mut mac_key);
+
+		#[cfg(not(fuzzing))]
+		let mut mac = Poly1305::new(mac_key[..32].try_into().unwrap());
+		#[cfg(fuzzing)]
+		let mut mac = Poly1305::new(secret);
+
 		let decrypted_len = r.remaining_bytes() - 16;
 		let s = FixedLengthReader::new(r, decrypted_len);
-		let mut chacha_stream = ChaChaPolyReader { chacha: &mut chacha, read: s };
+		let mut chacha_stream = ChaChaPolyReader::new(&mut chacha, &mut mac, s);
 		let readable: T = Readable::read(&mut chacha_stream)?;
 		while chacha_stream.read.bytes_remain() {
 			let mut buf = [0; 256];
-			chacha_stream.read(&mut buf)?;
+			if chacha_stream.read(&mut buf)? == 0 {
+				return Err(DecodeError::ShortRead);
+			}
 		}
 
-		let mut tag = [0 as u8; 16];
+		let read_len = chacha_stream.read_len();
+		drop(chacha_stream);
+
+		if read_len % 16 != 0 {
+			mac.input(&[0; 16][0..16 - (read_len % 16)]);
+		}
+		mac.input(&0u64.to_le_bytes());
+		mac.input(&(read_len as u64).to_le_bytes());
+
+		let mut tag = [0u8; 16];
 		r.read_exact(&mut tag)?;
-		if !chacha.finish_and_check_tag(&tag) {
+		if !fixed_time_eq(&mac.tag(), &tag) {
 			return Err(DecodeError::InvalidValue);
 		}
 
 		Ok(Self { readable })
 	}
 }
 
-/// Enables simultaneously reading and decrypting a ChaCha20Poly1305RFC stream from a std::io::Read.
+/// Enables simultaneously reading and decrypting a ChaCha20Poly1305 stream from a std::io::Read.
 struct ChaChaPolyReader<'a, R: Read> {
-	pub chacha: &'a mut ChaCha20Poly1305RFC,
+	chacha: &'a mut ChaCha20,
+	poly: &'a mut Poly1305,
+	read_len: usize,
 	pub read: R,
 }
 
+impl<'a, R: Read> ChaChaPolyReader<'a, R> {
+	fn new(chacha: &'a mut ChaCha20, poly: &'a mut Poly1305, read: R) -> Self {
+		Self { chacha, poly, read_len: 0, read }
+	}
+
+	fn read_len(&self) -> usize {
+		self.read_len
+	}
+}
+
 impl<'a, R: Read> Read for ChaChaPolyReader<'a, R> {
 	// Decrypt bytes from Self::read into `dest`.
-	// `ChaCha20Poly1305RFC::finish_and_check_tag` must be called to check the tag after all reads
-	// complete.
 	fn read(&mut self, dest: &mut [u8]) -> Result<usize, io::Error> {
 		let res = self.read.read(dest)?;
 		if res > 0 {
-			self.chacha.decrypt_in_place(&mut dest[0..res]);
+			self.poly.input(&dest[..res]);
+			self.chacha.apply_keystream(&mut dest[..res]);
+			self.read_len += res;
 		}
 		Ok(res)
 	}
 }
 
 /// Enables simultaneously writing and encrypting a byte stream into a Writer.
 struct ChaChaPolyWriter<'a, W: Writer> {
-	pub chacha: &'a mut ChaCha20Poly1305RFC,
+	chacha: &'a mut ChaCha20,
+	poly: Poly1305,
+	write_len: usize,
 	pub write: &'a mut W,
 }
 
+impl<'a, W: Writer> ChaChaPolyWriter<'a, W> {
+	/// Finish encrypting and return the 16-byte authentication tag.
+	fn finish_and_get_tag(mut self) -> [u8; 16] {
+		if self.write_len % 16 != 0 {
+			self.poly.input(&[0; 16][0..16 - (self.write_len % 16)]);
+		}
+		self.poly.input(&0u64.to_le_bytes());
+		self.poly.input(&(self.write_len as u64).to_le_bytes());
+		self.poly.tag()
+	}
+}
+
 impl<'a, W: Writer> Writer for ChaChaPolyWriter<'a, W> {
 	// Encrypt then write bytes from `src` into Self::write.
-	// `ChaCha20Poly1305RFC::finish_and_get_tag` can be called to retrieve the tag after all writes
-	// complete.
 	fn write_all(&mut self, src: &[u8]) -> Result<(), io::Error> {
 		let mut src_idx = 0;
 		while src_idx < src.len() {
 			let mut write_buffer = [0; 8192];
 			let bytes_written = (&mut write_buffer[..])
 				.write(&src[src_idx..])
 				.expect("In-memory writes can't fail");
-			self.chacha.encrypt_in_place(&mut write_buffer[..bytes_written]);
+			self.chacha.apply_keystream(&mut write_buffer[..bytes_written]);
+			self.poly.input(&write_buffer[..bytes_written]);
 			self.write.write_all(&write_buffer[..bytes_written])?;
+			self.write_len += bytes_written;
 			src_idx += bytes_written;
 		}
 		Ok(())

lightning/src/ln/inbound_payment.rs

@@ -13,12 +13,12 @@ use bitcoin::hashes::cmp::fixed_time_eq;
 use bitcoin::hashes::hmac::{Hmac, HmacEngine};
 use bitcoin::hashes::sha256::Hash as Sha256;
 use bitcoin::hashes::{Hash, HashEngine};
+use chacha20_poly1305::chacha20::{ChaCha20, Key, Nonce};
 
-use crate::crypto::chacha20::ChaCha20;
 use crate::crypto::utils::hkdf_extract_expand_7x;
 use crate::ln::msgs;
 use crate::ln::msgs::MAX_VALUE_MSAT;
-use crate::offers::nonce::Nonce;
+use crate::offers::nonce::Nonce as LocalNonce;
 use crate::sign::EntropySource;
 use crate::types::payment::{PaymentHash, PaymentPreimage, PaymentSecret};
 use crate::util::errors::APIError;
@@ -96,8 +96,13 @@ impl ExpandedKey {
 
 	/// Encrypts or decrypts the given `bytes`. Used for data included in an offer message's
 	/// metadata (e.g., payment id).
-	pub(crate) fn crypt_for_offer(&self, mut bytes: [u8; 32], nonce: Nonce) -> [u8; 32] {
-		ChaCha20::encrypt_single_block_in_place(&self.offers_encryption_key, &nonce.0, &mut bytes);
+	pub(crate) fn crypt_for_offer(&self, mut bytes: [u8; 32], nonce: LocalNonce) -> [u8; 32] {
+		ChaCha20::new_from_block(
+			Key::new(self.offers_encryption_key),
+			Nonce::new(nonce.0[4..].try_into().unwrap()),
+			u32::from_le_bytes(nonce.0[..4].try_into().unwrap()),
+		)
+		.apply_keystream(&mut bytes);
 		bytes
 	}
 }
@@ -301,12 +306,14 @@ fn construct_payment_secret(
 	let (iv_slice, encrypted_metadata_slice) = payment_secret_bytes.split_at_mut(IV_LEN);
 	iv_slice.copy_from_slice(iv_bytes);
 
-	ChaCha20::encrypt_single_block(
-		metadata_key,
-		iv_bytes,
-		encrypted_metadata_slice,
-		metadata_bytes,
-	);
+	encrypted_metadata_slice.copy_from_slice(metadata_bytes);
+	ChaCha20::new_from_block(
+		Key::new(*metadata_key),
+		Nonce::new(iv_bytes[4..].try_into().unwrap()),
+		u32::from_le_bytes(iv_bytes[..4].try_into().unwrap()),
+	)
+	.apply_keystream(encrypted_metadata_slice);
+
 	PaymentSecret(payment_secret_bytes)
 }
 
@@ -485,12 +492,13 @@ fn decrypt_metadata(
 	iv_bytes.copy_from_slice(iv_slice);
 
 	let mut metadata_bytes: [u8; METADATA_LEN] = [0; METADATA_LEN];
-	ChaCha20::encrypt_single_block(
-		&keys.metadata_key,
-		&iv_bytes,
-		&mut metadata_bytes,
-		encrypted_metadata_bytes,
-	);
+	metadata_bytes.copy_from_slice(encrypted_metadata_bytes);
+	ChaCha20::new_from_block(
+		Key::new(keys.metadata_key),
+		Nonce::new(iv_bytes[4..].try_into().unwrap()),
+		u32::from_le_bytes(iv_bytes[..4].try_into().unwrap()),
+	)
+	.apply_keystream(&mut metadata_bytes);
 
 	(iv_bytes, metadata_bytes)
 }