setupSalsastate, salsa_setblock, salsa_setiv, salsa_encrypt, salsa_encrypt2, hsalsa – salsa20 encryption


#include <u.h>
#include <libc.h>
#include <libsec.h>

void setupSalsastate(Salsastate *s, uchar key[], ulong keylen, uchar *iv, ulong ivlen, int rounds)

void salsa_encrypt(uchar *data, ulong len, Salsastate *s)

void salsa_encrypt2(uchar *src, uchar *dst, ulong len, Salsastate *s)

void salsa_setblock(Salsastate *s, u64int blockno)

void salsa_setiv(Salsastate *s, uchar *iv);

void hsalsa(uchar h[32], uchar *key, ulong keylen, uchar nonce[16], int rounds);


Salsa20 is a stream cipher designed by D J Berstein. It has an underlying block size of 64 bytes (named as constant SalsaBsize). It supports key sizes of 128 and 256-bit (recommended).

SetupSalsastate takes a reference to a Salsastate structure, a key of keylen bytes, which should normally be SalsaKeylen=32, a iv or nonce of ivlen bytes (can be SalsaIVlen=8 or XSalsaIVlen=24, set to all zeros if the iv argument is nil), and the number of rounds (set to the default of 20 if the argument is zero).

Salsa_encrypt encrypts len bytes of buf in place using the Salsastate in s. Len can be any byte length. Encryption and decryption are the same operation given the same starting state s.

Salsa_encrypt2 is similar, but encrypts len bytes of src into dst without modifying src.

Salsa_setblock sets the Salsa block counter for the next encryption to blockno, allowing seeking in an encrypted stream.

Salsa_setiv sets the the initialization vector (nonce) to iv.

Hsalsa is a key expansion function that takes a 128 or 256-bit key and a 128-bit nonce and produces a new 256-bit key.