rbnacl-libsodium 1.0.8 → 1.0.9

data/vendor/libsodium/src/libsodium/crypto_shorthash/siphash24/ref/shorthash_siphash24.c

@@ -1,32 +1,12 @@
 #include "crypto_shorthash_siphash24.h"
-#include "crypto_uint64.h"
-#include "crypto_uint32.h"
-#include "crypto_uint8.h"
+#include "../../sodium/common.h"
 
-typedef crypto_uint64 u64;
-typedef crypto_uint32 u32;
-typedef crypto_uint8   u8;
+typedef uint64_t u64;
+typedef uint32_t u32;
+typedef uint8_t   u8;
 
 #define ROTL(x,b) (u64)( ((x) << (b)) | ( (x) >> (64 - (b))) )
 
-#define U32TO8_LE(p, v)         \
-    (p)[0] = (u8)((v)      ); (p)[1] = (u8)((v) >>  8); \
-    (p)[2] = (u8)((v) >> 16); (p)[3] = (u8)((v) >> 24);
-
-#define U64TO8_LE(p, v)         \
-  U32TO8_LE((p),     (u32)((v)      ));   \
-  U32TO8_LE((p) + 4, (u32)((v) >> 32));
-
-#define U8TO64_LE(p) \
-  (((u64)((p)[0])      ) | \
-   ((u64)((p)[1]) <<  8) | \
-   ((u64)((p)[2]) << 16) | \
-   ((u64)((p)[3]) << 24) | \
-   ((u64)((p)[4]) << 32) | \
-   ((u64)((p)[5]) << 40) | \
-   ((u64)((p)[6]) << 48) | \
-   ((u64)((p)[7]) << 56))
-
 #define SIPROUND            \
   do {              \
     v0 += v1; v1=ROTL(v1,13); v1 ^= v0; v0=ROTL(v0,32); \
@@ -44,8 +24,8 @@ int crypto_shorthash_siphash24(unsigned char *out, const unsigned char *in,
   u64 v2 = 0x6c7967656e657261ULL;
   u64 v3 = 0x7465646279746573ULL;
   u64 b;
-  u64 k0 = U8TO64_LE( k );
-  u64 k1 = U8TO64_LE( k + 8 );
+  u64 k0 = LOAD64_LE( k );
+  u64 k1 = LOAD64_LE( k + 8 );
   u64 m;
   const u8 *end = in + inlen - ( inlen % sizeof( u64 ) );
   const int left = inlen & 7;
@@ -57,7 +37,7 @@ int crypto_shorthash_siphash24(unsigned char *out, const unsigned char *in,
 
   for ( ; in != end; in += 8 )
   {
-    m = U8TO64_LE( in );
+    m = LOAD64_LE( in );
     v3 ^= m;
     SIPROUND;
     SIPROUND;
@@ -86,7 +66,7 @@ int crypto_shorthash_siphash24(unsigned char *out, const unsigned char *in,
   SIPROUND;
   SIPROUND;
   b = v0 ^ v1 ^ v2  ^ v3;
-  U64TO8_LE( out, b );
+  STORE64_LE( out, b );
   return 0;
 }
 

data/vendor/libsodium/src/libsodium/crypto_sign/ed25519/ref10/open.c

@@ -9,6 +9,74 @@
 #include "utils.h"
 #include "../../../crypto_core/curve25519/ref10/curve25519_ref10.h"
 
+#ifndef ED25519_COMPAT
+static int
+crypto_sign_check_S_lt_L(const unsigned char *S)
+{
+    /* 2^252+27742317777372353535851937790883648493 */
+    static const unsigned char L[32] =
+      { 0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58,
+        0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10 };
+    unsigned char c = 0;
+    unsigned char n = 1;
+    unsigned int  i = 32;
+
+    do {
+        i--;
+        c |= ((S[i] - L[i]) >> 8) & n;
+        n &= ((S[i] ^ L[i]) - 1) >> 8;
+    } while (i != 0);
+
+    return -(c == 0);
+}
+
+static int
+small_order(const unsigned char R[32])
+{
+    CRYPTO_ALIGN(16) static const unsigned char blacklist[][32] = {
+        /* 0 (order 4) */
+        { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
+        /* 1 (order 1) */
+        { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
+        /* 2707385501144840649318225287225658788936804267575313519463743609750303402022 (order 8) */
+        { 0x26, 0xe8, 0x95, 0x8f, 0xc2, 0xb2, 0x27, 0xb0, 0x45, 0xc3, 0xf4, 0x89, 0xf2, 0xef, 0x98, 0xf0, 0xd5, 0xdf, 0xac, 0x05, 0xd3, 0xc6, 0x33, 0x39, 0xb1, 0x38, 0x02, 0x88, 0x6d, 0x53, 0xfc, 0x05 },
+        /* 55188659117513257062467267217118295137698188065244968500265048394206261417927 (order 8) */
+        { 0xc7, 0x17, 0x6a, 0x70, 0x3d, 0x4d, 0xd8, 0x4f, 0xba, 0x3c, 0x0b, 0x76, 0x0d, 0x10, 0x67, 0x0f, 0x2a, 0x20, 0x53, 0xfa, 0x2c, 0x39, 0xcc, 0xc6, 0x4e, 0xc7, 0xfd, 0x77, 0x92, 0xac, 0x03, 0x7a },
+        /* p-1 (order 2) */
+        { 0x13, 0xe8, 0x95, 0x8f, 0xc2, 0xb2, 0x27, 0xb0, 0x45, 0xc3, 0xf4, 0x89, 0xf2, 0xef, 0x98, 0xf0, 0xd5, 0xdf, 0xac, 0x05, 0xd3, 0xc6, 0x33, 0x39, 0xb1, 0x38, 0x02, 0x88, 0x6d, 0x53, 0xfc, 0x85 },
+        /* p (order 4) */
+        { 0xb4, 0x17, 0x6a, 0x70, 0x3d, 0x4d, 0xd8, 0x4f, 0xba, 0x3c, 0x0b, 0x76, 0x0d, 0x10, 0x67, 0x0f, 0x2a, 0x20, 0x53, 0xfa, 0x2c, 0x39, 0xcc, 0xc6, 0x4e, 0xc7, 0xfd, 0x77, 0x92, 0xac, 0x03, 0xfa },
+        /* p+1 (order 1) */
+        { 0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
+        /* p+2707385501144840649318225287225658788936804267575313519463743609750303402022 (order 8) */
+        { 0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
+        /* p+55188659117513257062467267217118295137698188065244968500265048394206261417927 (order 8) */
+        { 0xee, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
+        /* 2p-1 (order 2) */
+        { 0xd9, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
+        /* 2p (order 4) */
+        { 0xda, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
+        /* 2p+1 (order 1) */
+        { 0xdb, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }
+    };
+    size_t        i, j;
+    unsigned char c;
+
+    for (i = 0; i < sizeof blacklist / sizeof blacklist[0]; i++) {
+        c = 0;
+        for (j = 0; j < 32; j++) {
+            c |= R[j] ^ blacklist[i][j];
+        }
+        if (c == 0) {
+            return 1;
+        }
+    }
+    return 0;
+}
+#endif
+
 int
 crypto_sign_ed25519_verify_detached(const unsigned char *sig,
                                     const unsigned char *m,
@@ -23,9 +91,16 @@ crypto_sign_ed25519_verify_detached(const unsigned char *sig,
     ge_p3 A;
     ge_p2 R;
 
+#ifndef ED25519_COMPAT
+    if (crypto_sign_check_S_lt_L(sig + 32) != 0 ||
+        small_order(sig) != 0) {
+        return -1;
+    }
+#else
     if (sig[63] & 224) {
         return -1;
     }
+#endif
     if (ge_frombytes_negate_vartime(&A, pk) != 0) {
         return -1;
     }

data/vendor/libsodium/src/libsodium/crypto_stream/aes128ctr/portable/afternm_aes128ctr.c

@@ -88,9 +88,9 @@ int crypto_stream_aes128ctr_afternm(unsigned char *out, unsigned long long len,
     if(len < 128) goto partial;
     if(len == 128) goto full;
 
-    tmp = load32_bigendian(np + 12);
+    tmp = LOAD32_BE(np + 12);
     tmp += 8;
-    store32_bigendian(np + 12, tmp);
+    STORE32_BE(np + 12, tmp);
 
     *(int128 *) (out + 0) = xmm8;
     *(int128 *) (out + 16) = xmm9;
@@ -111,9 +111,9 @@ int crypto_stream_aes128ctr_afternm(unsigned char *out, unsigned long long len,
     lensav = len;
     len >>= 4;
 
-    tmp = load32_bigendian(np + 12);
+    tmp = LOAD32_BE(np + 12);
     tmp += len;
-    store32_bigendian(np + 12, tmp);
+    STORE32_BE(np + 12, tmp);
 
     blp = bl;
     *(int128 *)(blp + 0) = xmm8;
@@ -140,9 +140,9 @@ int crypto_stream_aes128ctr_afternm(unsigned char *out, unsigned long long len,
 
     full:
 
-    tmp = load32_bigendian(np + 12);
+    tmp = LOAD32_BE(np + 12);
     tmp += 8;
-    store32_bigendian(np + 12, tmp);
+    STORE32_BE(np + 12, tmp);
 
     *(int128 *) (out + 0) = xmm8;
     *(int128 *) (out + 16) = xmm9;

data/vendor/libsodium/src/libsodium/crypto_stream/aes128ctr/portable/common.h

@@ -5,24 +5,7 @@
 #define COMMON_H
 
 #include "types.h"
-
-#define load32_bigendian crypto_stream_aes128ctr_portable_load32_bigendian
-uint32 load32_bigendian(const unsigned char *x);
-
-#define store32_bigendian crypto_stream_aes128ctr_portable_store32_bigendian
-void store32_bigendian(unsigned char *x,uint32 u);
-
-#define load32_littleendian crypto_stream_aes128ctr_portable_load32_littleendian
-uint32 load32_littleendian(const unsigned char *x);
-
-#define store32_littleendian crypto_stream_aes128ctr_portable_store32_littleendian
-void store32_littleendian(unsigned char *x,uint32 u);
-
-#define load64_littleendian crypto_stream_aes128ctr_portable_load64_littleendian
-uint64 load64_littleendian(const unsigned char *x);
-
-#define store64_littleendian crypto_stream_aes128ctr_portable_store64_littleendian
-void store64_littleendian(unsigned char *x,uint64 u);
+#include "../../sodium/common.h"
 
 /* Macros required only for key expansion */
 

data/vendor/libsodium/src/libsodium/crypto_stream/aes128ctr/portable/int128_aes128ctr.c

@@ -68,42 +68,42 @@ void rshift32_littleendian(int128 *r, const unsigned int n)
 {
   unsigned char *rp = (unsigned char *)r;
   uint32 t;
-  t = load32_littleendian(rp);
+  t = LOAD32_LE(rp);
   t >>= n;
-  store32_littleendian(rp, t);
-  t = load32_littleendian(rp+4);
+  STORE32_LE(rp, t);
+  t = LOAD32_LE(rp+4);
   t >>= n;
-  store32_littleendian(rp+4, t);
-  t = load32_littleendian(rp+8);
+  STORE32_LE(rp+4, t);
+  t = LOAD32_LE(rp+8);
   t >>= n;
-  store32_littleendian(rp+8, t);
-  t = load32_littleendian(rp+12);
+  STORE32_LE(rp+8, t);
+  t = LOAD32_LE(rp+12);
   t >>= n;
-  store32_littleendian(rp+12, t);
+  STORE32_LE(rp+12, t);
 }
 
 void rshift64_littleendian(int128 *r, const unsigned int n)
 {
   unsigned char *rp = (unsigned char *)r;
   uint64 t;
-  t = load64_littleendian(rp);
+  t = LOAD64_LE(rp);
   t >>= n;
-  store64_littleendian(rp, t);
-  t = load64_littleendian(rp+8);
+  STORE64_LE(rp, t);
+  t = LOAD64_LE(rp+8);
   t >>= n;
-  store64_littleendian(rp+8, t);
+  STORE64_LE(rp+8, t);
 }
 
 void lshift64_littleendian(int128 *r, const unsigned int n)
 {
   unsigned char *rp = (unsigned char *)r;
   uint64 t;
-  t = load64_littleendian(rp);
+  t = LOAD64_LE(rp);
   t <<= n;
-  store64_littleendian(rp, t);
-  t = load64_littleendian(rp+8);
+  STORE64_LE(rp, t);
+  t = LOAD64_LE(rp+8);
   t <<= n;
-  store64_littleendian(rp+8, t);
+  STORE64_LE(rp+8, t);
 }
 
 void toggle(int128 *r)
@@ -116,16 +116,16 @@ void xor_rcon(int128 *r)
 {
   unsigned char *rp = (unsigned char *)r;
   uint32 t;
-  t = load32_littleendian(rp+12);
+  t = LOAD32_LE(rp+12);
   t ^= 0xffffffff;
-  store32_littleendian(rp+12, t);
+  STORE32_LE(rp+12, t);
 }
 
 void add_uint32_big(int128 *r, uint32 x)
 {
   unsigned char *rp = (unsigned char *)r;
   uint32 t;
-  t = load32_littleendian(rp+12);
+  t = LOAD32_LE(rp+12);
   t += x;
-  store32_littleendian(rp+12, t);
+  STORE32_LE(rp+12, t);
 }

data/vendor/libsodium/src/libsodium/crypto_stream/aes128ctr/portable/types.h

@@ -1,10 +1,10 @@
 #ifndef TYPES_H
 #define TYPES_H
 
-#include "crypto_uint32.h"
-typedef crypto_uint32 uint32;
+#include <stdint.h>
+#include <stdlib.h>
 
-#include "crypto_uint64.h"
-typedef crypto_uint64 uint64;
+typedef uint32_t uint32;
+typedef uint64_t uint64;
 
 #endif

data/vendor/libsodium/src/libsodium/crypto_stream/aes128ctr/portable/xor_afternm_aes128ctr.c

@@ -88,9 +88,9 @@ int crypto_stream_aes128ctr_xor_afternm(unsigned char *out, const unsigned char
     if(len < 128) goto partial;
     if(len == 128) goto full;
 
-    tmp = load32_bigendian(np + 12);
+    tmp = LOAD32_BE(np + 12);
     tmp += 8;
-    store32_bigendian(np + 12, tmp);
+    STORE32_BE(np + 12, tmp);
 
     xor2(&xmm8, (const int128 *)(in + 0));
     xor2(&xmm9, (const int128 *)(in + 16));
@@ -121,9 +121,9 @@ int crypto_stream_aes128ctr_xor_afternm(unsigned char *out, const unsigned char
     lensav = len;
     len >>= 4;
 
-    tmp = load32_bigendian(np + 12);
+    tmp = LOAD32_BE(np + 12);
     tmp += len;
-    store32_bigendian(np + 12, tmp);
+    STORE32_BE(np + 12, tmp);
 
     blp = bl;
     *(int128 *)(blp + 0) = xmm8;
@@ -152,9 +152,9 @@ int crypto_stream_aes128ctr_xor_afternm(unsigned char *out, const unsigned char
 
     full:
 
-    tmp = load32_bigendian(np + 12);
+    tmp = LOAD32_BE(np + 12);
     tmp += 8;
-    store32_bigendian(np + 12, tmp);
+    STORE32_BE(np + 12, tmp);
 
     xor2(&xmm8, (const int128 *)(in + 0));
     xor2(&xmm9, (const int128 *)(in + 16));

data/vendor/libsodium/src/libsodium/crypto_stream/chacha20/ref/stream_chacha20_ref.c

@@ -13,6 +13,7 @@
 #include "crypto_stream_chacha20.h"
 #include "stream_chacha20_ref.h"
 #include "../stream_chacha20.h"
+#include "../../sodium/common.h"
 
 struct chacha_ctx {
     uint32_t input[16];
@@ -32,20 +33,6 @@ typedef struct chacha_ctx chacha_ctx;
 #define ROTL32(v, n) \
   (U32V((v) << (n)) | ((v) >> (32 - (n))))
 
-#define U8TO32_LITTLE(p) \
-  (((u32)((p)[0])      ) | \
-   ((u32)((p)[1]) <<  8) | \
-   ((u32)((p)[2]) << 16) | \
-   ((u32)((p)[3]) << 24))
-
-#define U32TO8_LITTLE(p, v) \
-  do { \
-    (p)[0] = U8V((v)      ); \
-    (p)[1] = U8V((v) >>  8); \
-    (p)[2] = U8V((v) >> 16); \
-    (p)[3] = U8V((v) >> 24); \
-  } while (0)
-
 #define ROTATE(v,c) (ROTL32(v,c))
 #define XOR(v,w) ((v) ^ (w))
 #define PLUS(v,w) (U32V((v) + (w)))
@@ -57,47 +44,39 @@ typedef struct chacha_ctx chacha_ctx;
   a = PLUS(a,b); d = ROTATE(XOR(d,a), 8); \
   c = PLUS(c,d); b = ROTATE(XOR(b,c), 7);
 
-static const unsigned char sigma[16] = {
-    'e', 'x', 'p', 'a', 'n', 'd', ' ', '3', '2', '-', 'b', 'y', 't', 'e', ' ', 'k'
-};
-
 static void
 chacha_keysetup(chacha_ctx *ctx, const u8 *k)
 {
-    const unsigned char *constants;
-
-    ctx->input[4] = U8TO32_LITTLE(k + 0);
-    ctx->input[5] = U8TO32_LITTLE(k + 4);
-    ctx->input[6] = U8TO32_LITTLE(k + 8);
-    ctx->input[7] = U8TO32_LITTLE(k + 12);
-    k += 16;
-    constants = sigma;
-    ctx->input[8] = U8TO32_LITTLE(k + 0);
-    ctx->input[9] = U8TO32_LITTLE(k + 4);
-    ctx->input[10] = U8TO32_LITTLE(k + 8);
-    ctx->input[11] = U8TO32_LITTLE(k + 12);
-    ctx->input[0] = U8TO32_LITTLE(constants + 0);
-    ctx->input[1] = U8TO32_LITTLE(constants + 4);
-    ctx->input[2] = U8TO32_LITTLE(constants + 8);
-    ctx->input[3] = U8TO32_LITTLE(constants + 12);
+    ctx->input[0]  = U32C(0x61707865);
+    ctx->input[1]  = U32C(0x3320646e);
+    ctx->input[2]  = U32C(0x79622d32);
+    ctx->input[3]  = U32C(0x6b206574);
+    ctx->input[4]  = LOAD32_LE(k +  0);
+    ctx->input[5]  = LOAD32_LE(k +  4);
+    ctx->input[6]  = LOAD32_LE(k +  8);
+    ctx->input[7]  = LOAD32_LE(k + 12);
+    ctx->input[8]  = LOAD32_LE(k + 16);
+    ctx->input[9]  = LOAD32_LE(k + 20);
+    ctx->input[10] = LOAD32_LE(k + 24);
+    ctx->input[11] = LOAD32_LE(k + 28);
 }
 
 static void
 chacha_ivsetup(chacha_ctx *ctx, const u8 *iv, const u8 *counter)
 {
-    ctx->input[12] = counter == NULL ? 0 : U8TO32_LITTLE(counter + 0);
-    ctx->input[13] = counter == NULL ? 0 : U8TO32_LITTLE(counter + 4);
-    ctx->input[14] = U8TO32_LITTLE(iv + 0);
-    ctx->input[15] = U8TO32_LITTLE(iv + 4);
+    ctx->input[12] = counter == NULL ? 0 : LOAD32_LE(counter + 0);
+    ctx->input[13] = counter == NULL ? 0 : LOAD32_LE(counter + 4);
+    ctx->input[14] = LOAD32_LE(iv + 0);
+    ctx->input[15] = LOAD32_LE(iv + 4);
 }
 
 static void
 chacha_ietf_ivsetup(chacha_ctx *ctx, const u8 *iv, const u8 *counter)
 {
-    ctx->input[12] = counter == NULL ? 0 : U8TO32_LITTLE(counter);
-    ctx->input[13] = U8TO32_LITTLE(iv + 0);
-    ctx->input[14] = U8TO32_LITTLE(iv + 4);
-    ctx->input[15] = U8TO32_LITTLE(iv + 8);
+    ctx->input[12] = counter == NULL ? 0 : LOAD32_LE(counter);
+    ctx->input[13] = LOAD32_LE(iv + 0);
+    ctx->input[14] = LOAD32_LE(iv + 4);
+    ctx->input[15] = LOAD32_LE(iv + 8);
 }
 
 static void
@@ -185,22 +164,22 @@ chacha_encrypt_bytes(chacha_ctx *ctx, const u8 *m, u8 *c, unsigned long long byt
         x14 = PLUS(x14, j14);
         x15 = PLUS(x15, j15);
 
-        x0 = XOR(x0, U8TO32_LITTLE(m + 0));
-        x1 = XOR(x1, U8TO32_LITTLE(m + 4));
-        x2 = XOR(x2, U8TO32_LITTLE(m + 8));
-        x3 = XOR(x3, U8TO32_LITTLE(m + 12));
-        x4 = XOR(x4, U8TO32_LITTLE(m + 16));
-        x5 = XOR(x5, U8TO32_LITTLE(m + 20));
-        x6 = XOR(x6, U8TO32_LITTLE(m + 24));
-        x7 = XOR(x7, U8TO32_LITTLE(m + 28));
-        x8 = XOR(x8, U8TO32_LITTLE(m + 32));
-        x9 = XOR(x9, U8TO32_LITTLE(m + 36));
-        x10 = XOR(x10, U8TO32_LITTLE(m + 40));
-        x11 = XOR(x11, U8TO32_LITTLE(m + 44));
-        x12 = XOR(x12, U8TO32_LITTLE(m + 48));
-        x13 = XOR(x13, U8TO32_LITTLE(m + 52));
-        x14 = XOR(x14, U8TO32_LITTLE(m + 56));
-        x15 = XOR(x15, U8TO32_LITTLE(m + 60));
+        x0 = XOR(x0, LOAD32_LE(m + 0));
+        x1 = XOR(x1, LOAD32_LE(m + 4));
+        x2 = XOR(x2, LOAD32_LE(m + 8));
+        x3 = XOR(x3, LOAD32_LE(m + 12));
+        x4 = XOR(x4, LOAD32_LE(m + 16));
+        x5 = XOR(x5, LOAD32_LE(m + 20));
+        x6 = XOR(x6, LOAD32_LE(m + 24));
+        x7 = XOR(x7, LOAD32_LE(m + 28));
+        x8 = XOR(x8, LOAD32_LE(m + 32));
+        x9 = XOR(x9, LOAD32_LE(m + 36));
+        x10 = XOR(x10, LOAD32_LE(m + 40));
+        x11 = XOR(x11, LOAD32_LE(m + 44));
+        x12 = XOR(x12, LOAD32_LE(m + 48));
+        x13 = XOR(x13, LOAD32_LE(m + 52));
+        x14 = XOR(x14, LOAD32_LE(m + 56));
+        x15 = XOR(x15, LOAD32_LE(m + 60));
 
         j12 = PLUSONE(j12);
         /* LCOV_EXCL_START */
@@ -209,22 +188,22 @@ chacha_encrypt_bytes(chacha_ctx *ctx, const u8 *m, u8 *c, unsigned long long byt
         }
         /* LCOV_EXCL_STOP */
 
-        U32TO8_LITTLE(c + 0, x0);
-        U32TO8_LITTLE(c + 4, x1);
-        U32TO8_LITTLE(c + 8, x2);
-        U32TO8_LITTLE(c + 12, x3);
-        U32TO8_LITTLE(c + 16, x4);
-        U32TO8_LITTLE(c + 20, x5);
-        U32TO8_LITTLE(c + 24, x6);
-        U32TO8_LITTLE(c + 28, x7);
-        U32TO8_LITTLE(c + 32, x8);
-        U32TO8_LITTLE(c + 36, x9);
-        U32TO8_LITTLE(c + 40, x10);
-        U32TO8_LITTLE(c + 44, x11);
-        U32TO8_LITTLE(c + 48, x12);
-        U32TO8_LITTLE(c + 52, x13);
-        U32TO8_LITTLE(c + 56, x14);
-        U32TO8_LITTLE(c + 60, x15);
+        STORE32_LE(c + 0, x0);
+        STORE32_LE(c + 4, x1);
+        STORE32_LE(c + 8, x2);
+        STORE32_LE(c + 12, x3);
+        STORE32_LE(c + 16, x4);
+        STORE32_LE(c + 20, x5);
+        STORE32_LE(c + 24, x6);
+        STORE32_LE(c + 28, x7);
+        STORE32_LE(c + 32, x8);
+        STORE32_LE(c + 36, x9);
+        STORE32_LE(c + 40, x10);
+        STORE32_LE(c + 44, x11);
+        STORE32_LE(c + 48, x12);
+        STORE32_LE(c + 52, x13);
+        STORE32_LE(c + 56, x14);
+        STORE32_LE(c + 60, x15);
 
         if (bytes <= 64) {
             if (bytes < 64) {
@@ -296,8 +275,8 @@ stream_ref_xor_ic(unsigned char *c, const unsigned char *m,
     }
     ic_high = U32V(ic >> 32);
     ic_low = U32V(ic);
-    U32TO8_LITTLE(&ic_bytes[0], ic_low);
-    U32TO8_LITTLE(&ic_bytes[4], ic_high);
+    STORE32_LE(&ic_bytes[0], ic_low);
+    STORE32_LE(&ic_bytes[4], ic_high);
     chacha_keysetup(&ctx, k);
     chacha_ivsetup(&ctx, n, ic_bytes);
     chacha_encrypt_bytes(&ctx, m, c, mlen);
@@ -318,7 +297,7 @@ stream_ietf_ref_xor_ic(unsigned char *c, const unsigned char *m,
     if (!mlen) {
         return 0;
     }
-    U32TO8_LITTLE(ic_bytes, ic);
+    STORE32_LE(ic_bytes, ic);
     chacha_keysetup(&ctx, k);
     chacha_ietf_ivsetup(&ctx, n, ic_bytes);
     chacha_encrypt_bytes(&ctx, m, c, mlen);