x.crypto.chacha20 xor_key_stream fails after a while

[einar-hjortdal]

Describe the bug

x.crypto.chacha20 xor_key_stream works as expected for a while, then fails to decode after a few consecutive calls.

Reproduction Steps

module main

import x.crypto.chacha20

const key = [u8(225), 2, 1, 178, 238, 127, 187, 188, 27, 237, 18, 62, 181, 65, 67, 152, 13, 247,
	147, 148, 101, 220, 185, 120, 234, 58, 144, 173, 3, 218, 193, 130]
const nonce = [u8(153), 221, 244, 134, 99, 135, 243, 247, 169, 121, 69, 54]
const encoded_data = [
	[u8(231), 121, 9, 28],
	[u8(178), 221, 62, 9, 153, 189, 106, 12, 117, 47, 192, 81, 65, 112, 85, 57],
	[u8(155), 202, 56, 16],
	[u8(227), 47, 226, 137],
	[u8(162), 77, 218, 52],
	[u8(42), 250, 184, 196],
	[u8(2), 129, 13, 136, 6, 12, 235, 183, 38, 178, 151, 243, 27, 88, 97, 40],
	[u8(248), 170, 168, 206],
	[u8(181), 220, 223, 139],
	[u8(95), 108, 201, 227],
	[u8(38), 221, 147, 230],
	[u8(98), 229, 5, 130, 13, 103, 248, 159, 240, 246, 56, 119, 160, 130, 82, 222],
]

// expected data obtained with an equivalent Java program
const expected_data = [
	[u8(0), 0, 0, 9],
	[u8(0), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
	[u8(0), 0, 0, 1],
	[u8(0), 0, 0, 0],
	[u8(0), 0, 0, 0],
	[u8(0), 0, 0, 9],
	[u8(0), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
	[u8(0), 0, 0, 1],
	[u8(0), 0, 0, 0],
	[u8(0), 0, 0, 0],
	[u8(0), 0, 0, 9],
	[u8(0), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
]

fn main() {
	mut cipher := chacha20.new_cipher(key, nonce)!
	for i := 0; i < encoded_data.len; i++ {
		p := encoded_data[i]
		e := expected_data[i]
		mut dst := []u8{len: p.len}
		cipher.xor_key_stream(mut dst, p)
		assert dst == e
	}
}

Expected Behavior

assert passes

Current Behavior

assert fails

Possible Solution

No response

Additional Information/Context

Interestingly, the failed assert returns the second undecoded data array, perhaps some circular caching is happening?

V version

V 0.4.10 dd083e7

Environment details (OS name and version, etc.)

|V full version      |V 0.4.10 537605a.dd083e7
|:-------------------|:-------------------
|OS                  |linux, "openmamba release 2024.6 for x86_64 (rolling)"
|Processor           |8 cpus, 64bit, little endian, Intel(R) Core(TM) i7-4790K CPU @ 4.00GHz
|Memory              |14.86GB/31.16GB
|                    |
|V executable        |/home/einar/.local/lib64/v/v
|V last modified time|2025-03-25 08:13:29
|                    |
|V home dir          |OK, value: /home/einar/.local/lib64/v
|VMODULES            |OK, value: /home/einar/.vmodules
|VTMP                |OK, value: /tmp/v_1000
|Current working dir |OK, value: /home/einar/Documents/projects/vlang/active/firebird
|                    |
|Git version         |git version 2.49.0
|V git status        |weekly.2025.12-46-gdd083e76 (2 commit(s) behind V master)
|.git/config present |true
|                    |
|cc version          |cc (GCC) 14.2.1 20240909
|gcc version         |gcc (GCC) 14.2.1 20240909
|clang version       |N/A
|tcc version         |tcc version 0.9.28rc 2024-07-31 HEAD@1cee0908 (x86_64 Linux)
|tcc git status      |thirdparty-linux-amd64 0134e9b9
|emcc version        |N/A
|glibc version       |ldd (GNU libc) 2.41

Note

You can use the 👍 reaction to increase the issue's priority for developers.

Please note that only the 👍 reaction to the issue itself counts as a vote.
Other reactions and those to comments will not be taken into account.

[huly-for-github]

Connected to Huly®: V_0.6-22434

[einar-hjortdal]

@blackshirt

[blackshirt]

Thank you for testing and reporting the issues founded. I will see into this and trying to find the solution

[blackshirt]

I think the issues comes from partial block handling where in the old code, its missing step to clear out internal buffer with the new one, and use the old c.block directly, its maybe contains some data
Confirmed with the golang

package main

import (
	"bytes"
	"fmt"
	"golang.org/x/crypto/chacha20"
)

func main() {
	key := []byte{225, 2, 1, 178, 238, 127, 187, 188, 27, 237, 18, 62, 181, 65, 67, 152, 13, 247,
		147, 148, 101, 220, 185, 120, 234, 58, 144, 173, 3, 218, 193, 130}
	nonce := []byte{153, 221, 244, 134, 99, 135, 243, 247, 169, 121, 69, 54}

	encoded_data := [][]byte{
		{231, 121, 9, 28},
		{178, 221, 62, 9, 153, 189, 106, 12, 117, 47, 192, 81, 65, 112, 85, 57},
		{155, 202, 56, 16},
		{227, 47, 226, 137},
		{162, 77, 218, 52},
		{42, 250, 184, 196},
		{2, 129, 13, 136, 6, 12, 235, 183, 38, 178, 151, 243, 27, 88, 97, 40},
		{248, 170, 168, 206},
		{181, 220, 223, 139},
		{95, 108, 201, 227},
		{38, 221, 147, 230},
		{98, 229, 5, 130, 13, 103, 248, 159, 240, 246, 56, 119, 160, 130, 82, 222},
		[]byte("hello hello hello"),
		[]byte("me me me"),
	}

	expected_data := [][]byte{
		{0, 0, 0, 9},
		{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
		{0, 0, 0, 1},
		{0, 0, 0, 0},
		{0, 0, 0, 0},
		{0, 0, 0, 9},
		{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
		{0, 0, 0, 1},
		{0, 0, 0, 0},
		{0, 0, 0, 0},
		{0, 0, 0, 9},
		{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
		{119, 69, 96, 134, 100, 241, 107, 39, 71, 72, 65, 158, 50, 76, 187, 68, 100},
		{164, 169, 216, 98, 61, 175, 20, 175},
	}
	c, _ := chacha20.NewUnauthenticatedCipher(key, nonce)

	for i := 0; i < len(encoded_data); i++ {
		p := encoded_data[i]
		e := expected_data[i]
		dst := make([]byte, len(p))
		c.XORKeyStream(dst, p)
		v := bytes.Equal(e, dst)
		fmt.Println(e, dst, v)
	}
}

produces

[0 0 0 9] [0 0 0 9] true
[0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0] [0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0] true
[0 0 0 1] [0 0 0 1] true
[0 0 0 0] [0 0 0 0] true
[0 0 0 0] [0 0 0 0] true
[0 0 0 9] [0 0 0 9] true
[0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0] [0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0] true
[0 0 0 1] [0 0 0 1] true
[0 0 0 0] [0 0 0 0] true
[0 0 0 0] [0 0 0 0] true
[0 0 0 9] [0 0 0 9] true
[0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0] [0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0] true
[119 69 96 134 100 241 107 39 71 72 65 158 50 76 187 68 100] [119 69 96 134 100 241 107 39 71 72 65 158 50 76 187 68 100] true
[164 169 216 98 61 175 20 175] [164 169 216 98 61 175 20 175] true

[blackshirt]

Thank @einar-hjortdal ..he spots the bug and makes it better