Function xor_cipher_stream_off

common/sphinx.c:253–288

#define CHACHA20_BLOCK_BYTES 64

static void xor_cipher_stream_off(const struct secret *k,
				  size_t off,
				  void *dst, size_t dstlen)
{
	const u8 nonce[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
	u8 block[CHACHA20_BLOCK_BYTES];
	size_t block_off;
	size_t ic = off / CHACHA20_BLOCK_BYTES;

	/* From https://libsodium.gitbook.io/doc/advanced/stream_ciphers/chacha20:
	 *
	 * The crypto_stream_chacha20_xor_ic() function is similar to
	 * crypto_stream_chacha20_xor() but adds the ability to set
	 * the initial value of the block counter to a non-zero value,
	 * ic.
	 *
	 * This permits direct access to any block without having to
	 * compute the previous ones.
	 */
	block_off = (off % CHACHA20_BLOCK_BYTES);
	if (block_off != 0) {
		size_t rem = CHACHA20_BLOCK_BYTES - block_off;
		if (rem > dstlen)
			rem = dstlen;
		memcpy(block + block_off, dst, rem);
		crypto_stream_chacha20_xor_ic(block, block, block_off + rem,
					      nonce,
					      ic,
					      k->data);
		ic++;
		memcpy(dst, block + block_off, rem);
		dst = (char *)dst + rem;
		dstlen -= rem;
	}
	crypto_stream_chacha20_xor_ic(dst, dst, dstlen, nonce, ic, k->data);
}

/* Convenience function: s2/s2len can be NULL/0 if unwanted */
static void compute_hmac(const struct secret *key,