ChaCha RNG block/word position

[dhardy]

Currently this consists of:

// return 36 bit counter
pub fn get_word_pos(&self) -> u64;

// supports `u64` or `[u8; 5]`
// NOTE: [u8; 5] input uses a weird mixed-endian format
pub fn set_word_pos<W: Into<WordPosInput>>(&mut self, word_offset: W);

// supports `u32` or `[u8; 4]`
pub fn set_block_pos<B: Into<BlockPos>>(&mut self, block_pos: B);

pub fn get_block_pos(&self) -> u32;

First, we need 64-bit counters; thats #334 and #399.

Second, there are some weird Endian-conversions going on here. I would go into them except a more radical reform might be better.

Third, I don't think there's a good reason we need to support byte-arrays. Let users call to_le_bytes if they need that. (We don't technically need get_word_pos below either, but it's very little code and serves as an example.)

Proposal:

/// Get block position and sub-block index
///
/// Returns `(block_position, index)` where `index` is a value in the range `0..=16`.
pub fn get_block_pos(&self) -> (u64, u8) {
    self.core.core.0.state[12] as u64 | (self.core.core.0.state[13] as u64) << 32
}

/// Get the word position
///
/// This is a 68-bit index.
#[inline]
pub fn get_word_pos(&self) -> u128 {
    let (block, index) = self.get_block_pos();
    (block as u128) << 4 | ((index & 0b1111) as u128)
}

/// Set the block position
///
/// The sub-block index is reset to 0.
pub fn set_block_pos(&mut self, block: u64) {
    self.core.core.0.state[12] = block as u32;
    self.core.core.0.state[13] = (block >> 32) as u32;
    self.core.reset();
}

/// Set the word position
///
/// The low 68 bits are used; higher bits are ignored.
pub fn set_word_pos(&mut self, word: u128) {
    self.set_block_pos((word >> 4) as u64);
    let index = (word >> 4) as usize;
    self.core.generate_and_set(index);
}

I won't make a PR because I don't want to interfere with #399 or whatever @nstilt1 is up to.

[nstilt1]

The byte arrays are for anyone who wants to use the output of an RNG or a KDF to set these parameters. I don't personally use byte arrays to set anything in my personal code, but I'm sure that someone who is doing that would appreciate these. RNGs can use next_u32() but KDFs only output byte arrays. But the word arrays are more useful since you can specifically set state[12], state[13], state[14] and state[15]

[tarcieri]

I think [u8; 4] is fine if it matches (legacy) ChaCha20 test vectors

[dhardy]

That's an argument for set_block_pos supporting byte-arrays but not set_word_pos.

[nstilt1]

Good point. While a byte array could be convenient for that, it is still pretty arbitrary the way it works now

[dhardy]

I still see a few issues in the latest set_word_pos: (https://github.com/RustCrypto/stream-ciphers/blob/master/chacha20/src/rng.rs#L395)

• Docs mentions a "36-bit number" (should be 68)
• The index is 6-bit due to BUFFER_SIZE
• The block counter should be incremented (get_word_pos decrements it, which I'm guessing is correct)