@@ -64,7 +64,7 @@ func maskSecretKeys(inp interface{}) {

 	if form, ok := inp.(map[string]interface{}); ok {

 	loop0:

 		for k, v := range form {

-			for _, m := range []string{"password", "secret", "jointoken"} {

+			for _, m := range []string{"password", "secret", "jointoken", "lockkey"} {

 				if strings.EqualFold(m, k) {

 					form[k] = "*****"

 					continue loop0

@@ -12,6 +12,7 @@ type Backend interface {

 	Leave(force bool) error

 	Inspect() (types.Swarm, error)

 	Update(uint64, types.Spec, types.UpdateFlags) error

+	UnlockSwarm(req types.UnlockRequest) error

 	GetServices(basictypes.ServiceListOptions) ([]types.Service, error)

 	GetService(string) (types.Service, error)

 	CreateService(types.ServiceSpec, string) (string, error)

@@ -29,6 +29,7 @@ func (sr *swarmRouter) initRoutes() {

 		router.NewPostRoute("/swarm/leave", sr.leaveCluster),

 		router.NewGetRoute("/swarm", sr.inspectCluster),

 		router.NewPostRoute("/swarm/update", sr.updateCluster),

+		router.NewPostRoute("/swarm/unlock", sr.unlockCluster),

 		router.NewGetRoute("/services", sr.getServices),

 		router.NewGetRoute("/services/{id:.*}", sr.getService),

 		router.NewPostRoute("/services/create", sr.createService),

@@ -94,6 +94,19 @@ func (sr *swarmRouter) updateCluster(ctx context.Context, w http.ResponseWriter,

 	return nil

 }

+func (sr *swarmRouter) unlockCluster(ctx context.Context, w http.ResponseWriter, r *http.Request, vars map[string]string) error {

+	var req types.UnlockRequest

+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {

+		return err

+	}

+

+	if err := sr.backend.UnlockSwarm(req); err != nil {

+		logrus.Errorf("Error unlocking swarm: %+v", err)

+		return err

+	}

+	return nil

+}

+

 func (sr *swarmRouter) getServices(ctx context.Context, w http.ResponseWriter, r *http.Request, vars map[string]string) error {

 	if err := httputils.ParseForm(r); err != nil {

 		return err

@@ -125,6 +125,7 @@ type InitRequest struct {

 	AdvertiseAddr   string

 	ForceNewCluster bool

 	Spec            Spec

+	LockKey         string

 }

 // JoinRequest is the request used to join a swarm.

@@ -135,6 +136,11 @@ type JoinRequest struct {

 	JoinToken     string // accept by secret

 }

+// UnlockRequest is the request used to unlock a swarm.

+type UnlockRequest struct {

+	LockKey string

+}

+

 // LocalNodeState represents the state of the local node.

 type LocalNodeState string

@@ -147,6 +153,8 @@ const (

 	LocalNodeStateActive LocalNodeState = "active"

 	// LocalNodeStateError ERROR

 	LocalNodeStateError LocalNodeState = "error"

+	// LocalNodeStateLocked LOCKED

+	LocalNodeStateLocked LocalNodeState = "locked"

 )

 // Info represents generic information about swarm.

@@ -24,6 +24,7 @@ func NewSwarmCommand(dockerCli *command.DockerCli) *cobra.Command {

 		newJoinTokenCommand(dockerCli),

 		newUpdateCommand(dockerCli),

 		newLeaveCommand(dockerCli),

+		newUnlockCommand(dockerCli),

 	)

 	return cmd

 }

@@ -1,10 +1,15 @@

 package swarm

 import (

+	"bufio"

+	"crypto/rand"

 	"errors"

 	"fmt"

+	"io"

+	"math/big"

 	"strings"

+	"golang.org/x/crypto/ssh/terminal"

 	"golang.org/x/net/context"

 	"github.com/docker/docker/api/types/swarm"

@@ -20,6 +25,7 @@ type initOptions struct {

 	// Not a NodeAddrOption because it has no default port.

 	advertiseAddr   string

 	forceNewCluster bool

+	lockKey         bool

 }

 func newInitCommand(dockerCli *command.DockerCli) *cobra.Command {

@@ -39,6 +45,7 @@ func newInitCommand(dockerCli *command.DockerCli) *cobra.Command {

 	flags := cmd.Flags()

 	flags.Var(&opts.listenAddr, flagListenAddr, "Listen address (format: <ip|interface>[:port])")

 	flags.StringVar(&opts.advertiseAddr, flagAdvertiseAddr, "", "Advertised address (format: <ip|interface>[:port])")

+	flags.BoolVar(&opts.lockKey, flagLockKey, false, "Encrypt swarm with optionally provided key from stdin")

 	flags.BoolVar(&opts.forceNewCluster, "force-new-cluster", false, "Force create a new cluster from current state")

 	addSwarmFlags(flags, &opts.swarmOptions)

 	return cmd

@@ -48,11 +55,31 @@ func runInit(dockerCli *command.DockerCli, flags *pflag.FlagSet, opts initOption

 	client := dockerCli.Client()

 	ctx := context.Background()

+	var lockKey string

+	if opts.lockKey {

+		var err error

+		lockKey, err = readKey(dockerCli.In(), "Please enter key for encrypting swarm(leave empty to generate): ")

+		if err != nil {

+			return err

+		}

+		if len(lockKey) == 0 {

+			randBytes := make([]byte, 16)

+			if _, err := rand.Read(randBytes[:]); err != nil {

+				panic(fmt.Errorf("failed to general random lock key: %v", err))

+			}

+

+			var n big.Int

+			n.SetBytes(randBytes[:])

+			lockKey = n.Text(36)

+		}

+	}

+

 	req := swarm.InitRequest{

 		ListenAddr:      opts.listenAddr.String(),

 		AdvertiseAddr:   opts.advertiseAddr,

 		ForceNewCluster: opts.forceNewCluster,

 		Spec:            opts.swarmOptions.ToSpec(flags),

+		LockKey:         lockKey,

 	}

 	nodeID, err := client.SwarmInit(ctx, req)

@@ -65,6 +92,10 @@ func runInit(dockerCli *command.DockerCli, flags *pflag.FlagSet, opts initOption

 	fmt.Fprintf(dockerCli.Out(), "Swarm initialized: current node (%s) is now a manager.\n\n", nodeID)

+	if len(lockKey) > 0 {

+		fmt.Fprintf(dockerCli.Out(), "Swarm is encrypted. When a node is restarted it needs to be unlocked by running command:\n\n    echo '%s' | docker swarm unlock\n\n", lockKey)

+	}

+

 	if err := printJoinCommand(ctx, dockerCli, nodeID, true, false); err != nil {

 		return err

 	}

@@ -72,3 +103,18 @@ func runInit(dockerCli *command.DockerCli, flags *pflag.FlagSet, opts initOption

 	fmt.Fprint(dockerCli.Out(), "To add a manager to this swarm, run 'docker swarm join-token manager' and follow the instructions.\n\n")

 	return nil

 }

+

+func readKey(in *command.InStream, prompt string) (string, error) {

+	if in.IsTerminal() {

+		fmt.Print(prompt)

+		dt, err := terminal.ReadPassword(int(in.FD()))

+		fmt.Println()

+		return string(dt), err

+	} else {

+		key, err := bufio.NewReader(in).ReadString('\n')

+		if err == io.EOF {

+			err = nil

+		}

+		return strings.TrimSpace(key), err

+	}

+}

@@ -26,6 +26,7 @@ const (

 	flagExternalCA          = "external-ca"

 	flagMaxSnapshots        = "max-snapshots"

 	flagSnapshotInterval    = "snapshot-interval"

+	flagLockKey             = "lock-key"

 )

 type swarmOptions struct {

new file mode 100644

@@ -0,0 +1,35 @@

+package swarm

+

+import (

+	"context"

+

+	"github.com/spf13/cobra"

+

+	"github.com/docker/docker/api/types/swarm"

+	"github.com/docker/docker/cli"

+	"github.com/docker/docker/cli/command"

+)

+

+func newUnlockCommand(dockerCli *command.DockerCli) *cobra.Command {

+	cmd := &cobra.Command{

+		Use:   "unlock",

+		Short: "Unlock swarm",

+		Args:  cli.ExactArgs(0),

+		RunE: func(cmd *cobra.Command, args []string) error {

+			client := dockerCli.Client()

+			ctx := context.Background()

+

+			key, err := readKey(dockerCli.In(), "Please enter unlock key: ")

+			if err != nil {

+				return err

+			}

+			req := swarm.UnlockRequest{

+				LockKey: string(key),

+			}

+

+			return client.SwarmUnlock(ctx, req)

+		},

+	}

+

+	return cmd

+}

@@ -96,7 +96,7 @@ func prettyPrintInfo(dockerCli *command.DockerCli, info types.Info) error {

 	}

 	fmt.Fprintf(dockerCli.Out(), "Swarm: %v\n", info.Swarm.LocalNodeState)

-	if info.Swarm.LocalNodeState != swarm.LocalNodeStateInactive {

+	if info.Swarm.LocalNodeState != swarm.LocalNodeStateInactive && info.Swarm.LocalNodeState != swarm.LocalNodeStateLocked {

 		fmt.Fprintf(dockerCli.Out(), " NodeID: %s\n", info.Swarm.NodeID)

 		if info.Swarm.Error != "" {

 			fmt.Fprintf(dockerCli.Out(), " Error: %v\n", info.Swarm.Error)

@@ -119,6 +119,7 @@ type ServiceAPIClient interface {

 type SwarmAPIClient interface {

 	SwarmInit(ctx context.Context, req swarm.InitRequest) (string, error)

 	SwarmJoin(ctx context.Context, req swarm.JoinRequest) error

+	SwarmUnlock(ctx context.Context, req swarm.UnlockRequest) error

 	SwarmLeave(ctx context.Context, force bool) error

 	SwarmInspect(ctx context.Context) (swarm.Swarm, error)

 	SwarmUpdate(ctx context.Context, version swarm.Version, swarm swarm.Spec, flags swarm.UpdateFlags) error

new file mode 100644

@@ -0,0 +1,17 @@

+package client

+

+import (

+	"github.com/docker/docker/api/types/swarm"

+	"golang.org/x/net/context"

+)

+

+// SwarmUnlock unlockes locked swarm.

+func (cli *Client) SwarmUnlock(ctx context.Context, req swarm.UnlockRequest) error {

+	serverResp, err := cli.post(ctx, "/swarm/unlock", nil, req, nil)

+	if err != nil {

+		return err

+	}

+

+	ensureReaderClosed(serverResp)

+	return err

+}

@@ -1,6 +1,7 @@

 package cluster

 import (

+	"crypto/x509"

 	"encoding/json"

 	"fmt"

 	"io/ioutil"

@@ -12,10 +13,8 @@ import (

 	"sync"

 	"time"

-	"google.golang.org/grpc"

-

 	"github.com/Sirupsen/logrus"

-	"github.com/docker/docker/api/errors"

+	apierrors "github.com/docker/docker/api/errors"

 	apitypes "github.com/docker/docker/api/types"

 	"github.com/docker/docker/api/types/filters"

 	"github.com/docker/docker/api/types/network"

@@ -29,7 +28,9 @@ import (

 	"github.com/docker/docker/runconfig"

 	swarmapi "github.com/docker/swarmkit/api"

 	swarmnode "github.com/docker/swarmkit/node"

+	"github.com/pkg/errors"

 	"golang.org/x/net/context"

+	"google.golang.org/grpc"

 )

 const swarmDirName = "swarm"

@@ -56,6 +57,9 @@ var ErrPendingSwarmExists = fmt.Errorf("This node is processing an existing join

 // ErrSwarmJoinTimeoutReached is returned when cluster join could not complete before timeout was reached.

 var ErrSwarmJoinTimeoutReached = fmt.Errorf("Timeout was reached before node was joined. The attempt to join the swarm will continue in the background. Use the \"docker info\" command to see the current swarm status of your node.")

+// ErrSwarmLocked is returned if the swarm is encrypted and needs a key to unlock it.

+var ErrSwarmLocked = fmt.Errorf("Swarm is encrypted and needs to be unlocked before it can be used. Please use \"docker swarm unlock\" to unlock it.")

+

 // NetworkSubnetsProvider exposes functions for retrieving the subnets

 // of networks managed by Docker, so they can be filtered.

 type NetworkSubnetsProvider interface {

@@ -92,6 +96,8 @@ type Cluster struct {

 	err             error

 	cancelDelay     func()

 	attachers       map[string]*attacher

+	locked          bool

+	lastNodeConfig  *nodeStartConfig

 }

 // attacher manages the in-memory attachment state of a container

@@ -133,6 +139,7 @@ type nodeStartConfig struct {

 	joinAddr        string

 	forceNewCluster bool

 	joinToken       string

+	lockKey         []byte

 }

 // New creates a new Cluster instance using provided config.

@@ -165,6 +172,12 @@ func New(config Config) (*Cluster, error) {

 	n, err := c.startNewNode(*nodeConfig)

 	if err != nil {

+		if errors.Cause(err) == ErrSwarmLocked {

+			logrus.Warnf("swarm component could not be started: %v", err)

+			c.locked = true

+			c.lastNodeConfig = nodeConfig

+			return c, nil

+		}

 		return nil, err

 	}

@@ -300,8 +313,16 @@ func (c *Cluster) startNewNode(conf nodeStartConfig) (*node, error) {

 		Executor:           container.NewExecutor(c.config.Backend),

 		HeartbeatTick:      1,

 		ElectionTick:       3,

+		UnlockKey:          conf.lockKey,

 	})

+

 	if err != nil {

+		err = detectLockedError(err)

+		if errors.Cause(err) == ErrSwarmLocked {

+			c.locked = true

+			confClone := conf

+			c.lastNodeConfig = &confClone

+		}

 		return nil, err

 	}

 	ctx := context.Background()

@@ -365,7 +386,7 @@ func (c *Cluster) startNewNode(conf nodeStartConfig) (*node, error) {

 // Init initializes new cluster from user provided request.

 func (c *Cluster) Init(req types.InitRequest) (string, error) {

 	c.Lock()

-	if node := c.node; node != nil {

+	if node := c.node; node != nil || c.locked {

 		if !req.ForceNewCluster {

 			c.Unlock()

 			return "", ErrSwarmExists

@@ -422,12 +443,18 @@ func (c *Cluster) Init(req types.InitRequest) (string, error) {

 		localAddr = advertiseIP.String()

 	}

+	var key []byte

+	if len(req.LockKey) > 0 {

+		key = []byte(req.LockKey)

+	}

+

 	// todo: check current state existing

 	n, err := c.startNewNode(nodeStartConfig{

 		forceNewCluster: req.ForceNewCluster,

 		LocalAddr:       localAddr,

 		ListenAddr:      net.JoinHostPort(listenHost, listenPort),

 		AdvertiseAddr:   net.JoinHostPort(advertiseHost, advertisePort),

+		lockKey:         key,

 	})

 	if err != nil {

 		c.Unlock()

@@ -457,7 +484,7 @@ func (c *Cluster) Init(req types.InitRequest) (string, error) {

 // Join makes current Cluster part of an existing swarm cluster.

 func (c *Cluster) Join(req types.JoinRequest) error {

 	c.Lock()

-	if node := c.node; node != nil {

+	if node := c.node; node != nil || c.locked {

 		c.Unlock()

 		return ErrSwarmExists

 	}

@@ -518,6 +545,60 @@ func (c *Cluster) Join(req types.JoinRequest) error {

 	}

 }

+// GetUnlockKey returns the unlock key for the swarm.

+func (c *Cluster) GetUnlockKey() (string, error) {

+	c.RLock()

+	defer c.RUnlock()

+

+	if !c.isActiveManager() {

+		return "", c.errNoManager()

+	}

+

+	ctx, cancel := c.getRequestContext()

+	defer cancel()

+

+	client := swarmapi.NewCAClient(c.conn)

+

+	r, err := client.GetUnlockKey(ctx, &swarmapi.GetUnlockKeyRequest{})

+	if err != nil {

+		return "", err

+	}

+

+	return encryption.HumanReadableKey(r.UnlockKey), nil

+}

+

+// UnlockSwarm provides a key to decrypt data that is encrypted at rest.

+func (c *Cluster) UnlockSwarm(req types.UnlockRequest) error {

+	if len(req.LockKey) == 0 {

+		return errors.New("unlock key can't be empty")

+	}

+

+	c.Lock()

+	if c.node != nil || c.locked != true {

+		c.Unlock()

+		return errors.New("swarm is not locked")

+	}

+

+	config := *c.lastNodeConfig

+	config.lockKey = []byte(req.LockKey)

+	n, err := c.startNewNode(config)

+	if err != nil {

+		c.Unlock()

+		if errors.Cause(err) == ErrSwarmLocked {

+			return errors.New("swarm could not be unlocked: invalid key provided")

+		}

+		return err

+	}

+	c.Unlock()

+	select {

+	case <-n.Ready():

+	case <-n.done:

+		return fmt.Errorf("swarm component could not be started: %v", c.err)

+	}

+	go c.reconnectOnFailure(n)

+	return nil

+}

+

 // stopNode is a helper that stops the active c.node and waits until it has

 // shut down. Call while keeping the cluster lock.

 func (c *Cluster) stopNode() error {

@@ -555,47 +636,53 @@ func (c *Cluster) Leave(force bool) error {

 	c.Lock()

 	node := c.node

 	if node == nil {

-		c.Unlock()

-		return ErrNoSwarm

-	}

-

-	if node.Manager() != nil && !force {

-		msg := "You are attempting to leave the swarm on a node that is participating as a manager. "

-		if c.isActiveManager() {

-			active, reachable, unreachable, err := c.managerStats()

-			if err == nil {

-				if active && removingManagerCausesLossOfQuorum(reachable, unreachable) {

-					if isLastManager(reachable, unreachable) {

-						msg += "Removing the last manager erases all current state of the swarm. Use `--force` to ignore this message. "

-						c.Unlock()

-						return fmt.Errorf(msg)

+		if c.locked {

+			c.locked = false

+			c.lastNodeConfig = nil

+			c.Unlock()

+		} else {

+			c.Unlock()

+			return ErrNoSwarm

+		}

+	} else {

+		if node.Manager() != nil && !force {

+			msg := "You are attempting to leave the swarm on a node that is participating as a manager. "

+			if c.isActiveManager() {

+				active, reachable, unreachable, err := c.managerStats()

+				if err == nil {

+					if active && removingManagerCausesLossOfQuorum(reachable, unreachable) {

+						if isLastManager(reachable, unreachable) {

+							msg += "Removing the last manager erases all current state of the swarm. Use `--force` to ignore this message. "

+							c.Unlock()

+							return fmt.Errorf(msg)

+						}

+						msg += fmt.Sprintf("Removing this node leaves %v managers out of %v. Without a Raft quorum your swarm will be inaccessible. ", reachable-1, reachable+unreachable)

 					}

-					msg += fmt.Sprintf("Removing this node leaves %v managers out of %v. Without a Raft quorum your swarm will be inaccessible. ", reachable-1, reachable+unreachable)

 				}

+			} else {

+				msg += "Doing so may lose the consensus of your cluster. "

 			}

-		} else {

-			msg += "Doing so may lose the consensus of your cluster. "

-		}

-		msg += "The only way to restore a swarm that has lost consensus is to reinitialize it with `--force-new-cluster`. Use `--force` to suppress this message."

-		c.Unlock()

-		return fmt.Errorf(msg)

-	}

-	if err := c.stopNode(); err != nil {

-		logrus.Errorf("failed to shut down cluster node: %v", err)

-		signal.DumpStacks("")

-		c.Unlock()

-		return err

-	}

-	c.Unlock()

-	if nodeID := node.NodeID(); nodeID != "" {

-		nodeContainers, err := c.listContainerForNode(nodeID)

-		if err != nil {

+			msg += "The only way to restore a swarm that has lost consensus is to reinitialize it with `--force-new-cluster`. Use `--force` to suppress this message."

+			c.Unlock()

+			return fmt.Errorf(msg)

+		}

+		if err := c.stopNode(); err != nil {

+			logrus.Errorf("failed to shut down cluster node: %v", err)

+			signal.DumpStacks("")

+			c.Unlock()

 			return err

 		}

-		for _, id := range nodeContainers {

-			if err := c.config.Backend.ContainerRm(id, &apitypes.ContainerRmConfig{ForceRemove: true}); err != nil {

-				logrus.Errorf("error removing %v: %v", id, err)

+		c.Unlock()

+		if nodeID := node.NodeID(); nodeID != "" {

+			nodeContainers, err := c.listContainerForNode(nodeID)

+			if err != nil {

+				return err

+			}

+			for _, id := range nodeContainers {

+				if err := c.config.Backend.ContainerRm(id, &apitypes.ContainerRmConfig{ForceRemove: true}); err != nil {

+					logrus.Errorf("error removing %v: %v", id, err)

+				}

 			}

 		}

 	}

@@ -786,6 +873,9 @@ func (c *Cluster) Info() types.Info {

 		if c.cancelDelay != nil {

 			info.LocalNodeState = types.LocalNodeStateError

 		}

+		if c.locked {

+			info.LocalNodeState = types.LocalNodeStateLocked

+		}

 	} else {

 		info.LocalNodeState = types.LocalNodeStatePending

 		if c.ready == true {

@@ -838,6 +928,9 @@ func (c *Cluster) isActiveManager() bool {

 // Call with read lock.

 func (c *Cluster) errNoManager() error {

 	if c.node == nil {

+		if c.locked {

+			return ErrSwarmLocked

+		}

 		return fmt.Errorf("This node is not a swarm manager. Use \"docker swarm init\" or \"docker swarm join\" to connect this node to swarm and try again.")

 	}

 	if c.node.Manager() != nil {

@@ -1396,7 +1489,7 @@ func (c *Cluster) CreateNetwork(s apitypes.NetworkCreateRequest) (string, error)

 	if runconfig.IsPreDefinedNetwork(s.Name) {

 		err := fmt.Errorf("%s is a pre-defined network and cannot be created", s.Name)

-		return "", errors.NewRequestForbiddenError(err)

+		return "", apierrors.NewRequestForbiddenError(err)

 	}

 	ctx, cancel := c.getRequestContext()

@@ -1447,7 +1540,7 @@ func (c *Cluster) populateNetworkID(ctx context.Context, client swarmapi.Control

 		if err != nil {

 			if ln, _ := c.config.Backend.FindNetwork(n.Target); ln != nil && !ln.Info().Dynamic() {

 				err = fmt.Errorf("network %s is not eligible for docker services", ln.Name())

-				return errors.NewRequestForbiddenError(err)

+				return apierrors.NewRequestForbiddenError(err)

 			}

 			return err

 		}

@@ -1613,3 +1706,10 @@ func initClusterSpec(node *node, spec types.Spec) error {

 	}

 	return ctx.Err()

 }

+

+func detectLockedError(err error) error {

+	if errors.Cause(err) == x509.IncorrectPasswordError || errors.Cause(err).Error() == "tls: failed to parse private key" { // todo: better to export typed error

+		return errors.WithStack(ErrSwarmLocked)

+	}

+	return err

+}

new file mode 100644

@@ -0,0 +1,149 @@

+// Copyright 2012 The Go Authors. All rights reserved.

+// Use of this source code is governed by a BSD-style

+// license that can be found in the LICENSE file.

+

+/*

+Package secretbox encrypts and authenticates small messages.

+

+Secretbox uses XSalsa20 and Poly1305 to encrypt and authenticate messages with

+secret-key cryptography. The length of messages is not hidden.

+

+It is the caller's responsibility to ensure the uniqueness of nonces—for

+example, by using nonce 1 for the first message, nonce 2 for the second

+message, etc. Nonces are long enough that randomly generated nonces have

+negligible risk of collision.

+

+This package is interoperable with NaCl: http://nacl.cr.yp.to/secretbox.html.

+*/

+package secretbox // import "golang.org/x/crypto/nacl/secretbox"

+

+import (

+	"golang.org/x/crypto/poly1305"

+	"golang.org/x/crypto/salsa20/salsa"

+)

+

+// Overhead is the number of bytes of overhead when boxing a message.

+const Overhead = poly1305.TagSize

+

+// setup produces a sub-key and Salsa20 counter given a nonce and key.

+func setup(subKey *[32]byte, counter *[16]byte, nonce *[24]byte, key *[32]byte) {

+	// We use XSalsa20 for encryption so first we need to generate a

+	// key and nonce with HSalsa20.

+	var hNonce [16]byte

+	copy(hNonce[:], nonce[:])

+	salsa.HSalsa20(subKey, &hNonce, key, &salsa.Sigma)

+

+	// The final 8 bytes of the original nonce form the new nonce.

+	copy(counter[:], nonce[16:])

+}

+

+// sliceForAppend takes a slice and a requested number of bytes. It returns a

+// slice with the contents of the given slice followed by that many bytes and a

+// second slice that aliases into it and contains only the extra bytes. If the

+// original slice has sufficient capacity then no allocation is performed.

+func sliceForAppend(in []byte, n int) (head, tail []byte) {

+	if total := len(in) + n; cap(in) >= total {

+		head = in[:total]

+	} else {

+		head = make([]byte, total)

+		copy(head, in)

+	}

+	tail = head[len(in):]

+	return

+}

+

+// Seal appends an encrypted and authenticated copy of message to out, which

+// must not overlap message. The key and nonce pair must be unique for each

+// distinct message and the output will be Overhead bytes longer than message.

+func Seal(out, message []byte, nonce *[24]byte, key *[32]byte) []byte {

+	var subKey [32]byte

+	var counter [16]byte

+	setup(&subKey, &counter, nonce, key)

+

+	// The Poly1305 key is generated by encrypting 32 bytes of zeros. Since

+	// Salsa20 works with 64-byte blocks, we also generate 32 bytes of

+	// keystream as a side effect.

+	var firstBlock [64]byte

+	salsa.XORKeyStream(firstBlock[:], firstBlock[:], &counter, &subKey)

+

+	var poly1305Key [32]byte

+	copy(poly1305Key[:], firstBlock[:])

+

+	ret, out := sliceForAppend(out, len(message)+poly1305.TagSize)

+

+	// We XOR up to 32 bytes of message with the keystream generated from

+	// the first block.

+	firstMessageBlock := message

+	if len(firstMessageBlock) > 32 {

+		firstMessageBlock = firstMessageBlock[:32]

+	}

+

+	tagOut := out

+	out = out[poly1305.TagSize:]

+	for i, x := range firstMessageBlock {

+		out[i] = firstBlock[32+i] ^ x

+	}

+	message = message[len(firstMessageBlock):]

+	ciphertext := out

+	out = out[len(firstMessageBlock):]

+

+	// Now encrypt the rest.

+	counter[8] = 1

+	salsa.XORKeyStream(out, message, &counter, &subKey)

+

+	var tag [poly1305.TagSize]byte

+	poly1305.Sum(&tag, ciphertext, &poly1305Key)

+	copy(tagOut, tag[:])

+

+	return ret

+}

+

+// Open authenticates and decrypts a box produced by Seal and appends the

+// message to out, which must not overlap box. The output will be Overhead

+// bytes smaller than box.

+func Open(out []byte, box []byte, nonce *[24]byte, key *[32]byte) ([]byte, bool) {

+	if len(box) < Overhead {

+		return nil, false

+	}

+

+	var subKey [32]byte

+	var counter [16]byte

+	setup(&subKey, &counter, nonce, key)

+

+	// The Poly1305 key is generated by encrypting 32 bytes of zeros. Since

+	// Salsa20 works with 64-byte blocks, we also generate 32 bytes of

+	// keystream as a side effect.

+	var firstBlock [64]byte

+	salsa.XORKeyStream(firstBlock[:], firstBlock[:], &counter, &subKey)

+

+	var poly1305Key [32]byte

+	copy(poly1305Key[:], firstBlock[:])

+	var tag [poly1305.TagSize]byte

+	copy(tag[:], box)

+

+	if !poly1305.Verify(&tag, box[poly1305.TagSize:], &poly1305Key) {

+		return nil, false

+	}

+

+	ret, out := sliceForAppend(out, len(box)-Overhead)

+

+	// We XOR up to 32 bytes of box with the keystream generated from

+	// the first block.

+	box = box[Overhead:]

+	firstMessageBlock := box

+	if len(firstMessageBlock) > 32 {

+		firstMessageBlock = firstMessageBlock[:32]

+	}

+	for i, x := range firstMessageBlock {

+		out[i] = firstBlock[32+i] ^ x

+	}

+

+	box = box[len(firstMessageBlock):]

+	out = out[len(firstMessageBlock):]

+

+	// Now decrypt the rest.

+	counter[8] = 1

+	salsa.XORKeyStream(out, box, &counter, &subKey)

+

+	return ret, true

+}

new file mode 100644

@@ -0,0 +1,45 @@

+// Copyright 2012 The Go Authors. All rights reserved.

+// Use of this source code is governed by a BSD-style

+// license that can be found in the LICENSE file.

+

+// This code was translated into a form compatible with 6a from the public

+// domain sources in SUPERCOP: http://bench.cr.yp.to/supercop.html

+

+// +build amd64,!gccgo,!appengine

+

+DATA ·SCALE(SB)/8, $0x37F4000000000000

+GLOBL ·SCALE(SB), 8, $8

+DATA ·TWO32(SB)/8, $0x41F0000000000000

+GLOBL ·TWO32(SB), 8, $8

+DATA ·TWO64(SB)/8, $0x43F0000000000000

+GLOBL ·TWO64(SB), 8, $8

+DATA ·TWO96(SB)/8, $0x45F0000000000000

+GLOBL ·TWO96(SB), 8, $8

+DATA ·ALPHA32(SB)/8, $0x45E8000000000000

+GLOBL ·ALPHA32(SB), 8, $8

+DATA ·ALPHA64(SB)/8, $0x47E8000000000000

+GLOBL ·ALPHA64(SB), 8, $8

+DATA ·ALPHA96(SB)/8, $0x49E8000000000000

+GLOBL ·ALPHA96(SB), 8, $8

+DATA ·ALPHA130(SB)/8, $0x4C08000000000000

+GLOBL ·ALPHA130(SB), 8, $8

+DATA ·DOFFSET0(SB)/8, $0x4330000000000000

+GLOBL ·DOFFSET0(SB), 8, $8

+DATA ·DOFFSET1(SB)/8, $0x4530000000000000

+GLOBL ·DOFFSET1(SB), 8, $8

+DATA ·DOFFSET2(SB)/8, $0x4730000000000000

+GLOBL ·DOFFSET2(SB), 8, $8

+DATA ·DOFFSET3(SB)/8, $0x4930000000000000

+GLOBL ·DOFFSET3(SB), 8, $8

+DATA ·DOFFSET3MINUSTWO128(SB)/8, $0x492FFFFE00000000

+GLOBL ·DOFFSET3MINUSTWO128(SB), 8, $8

+DATA ·HOFFSET0(SB)/8, $0x43300001FFFFFFFB

+GLOBL ·HOFFSET0(SB), 8, $8

+DATA ·HOFFSET1(SB)/8, $0x45300001FFFFFFFE

+GLOBL ·HOFFSET1(SB), 8, $8

+DATA ·HOFFSET2(SB)/8, $0x47300001FFFFFFFE

+GLOBL ·HOFFSET2(SB), 8, $8

+DATA ·HOFFSET3(SB)/8, $0x49300003FFFFFFFE

+GLOBL ·HOFFSET3(SB), 8, $8

+DATA ·ROUNDING(SB)/2, $0x137f

+GLOBL ·ROUNDING(SB), 8, $2

new file mode 100644

@@ -0,0 +1,32 @@

+// Copyright 2012 The Go Authors. All rights reserved.

+// Use of this source code is governed by a BSD-style

+// license that can be found in the LICENSE file.

+

+/*

+Package poly1305 implements Poly1305 one-time message authentication code as specified in http://cr.yp.to/mac/poly1305-20050329.pdf.

+

+Poly1305 is a fast, one-time authentication function. It is infeasible for an

+attacker to generate an authenticator for a message without the key. However, a

+key must only be used for a single message. Authenticating two different

+messages with the same key allows an attacker to forge authenticators for other

+messages with the same key.

+

+Poly1305 was originally coupled with AES in order to make Poly1305-AES. AES was

+used with a fixed key in order to generate one-time keys from an nonce.

+However, in this package AES isn't used and the one-time key is specified

+directly.

+*/

+package poly1305 // import "golang.org/x/crypto/poly1305"

+

+import "crypto/subtle"

+

+// TagSize is the size, in bytes, of a poly1305 authenticator.

+const TagSize = 16

+

+// Verify returns true if mac is a valid authenticator for m with the given

+// key.

+func Verify(mac *[16]byte, m []byte, key *[32]byte) bool {

+	var tmp [16]byte

+	Sum(&tmp, m, key)

+	return subtle.ConstantTimeCompare(tmp[:], mac[:]) == 1

+}

new file mode 100644

@@ -0,0 +1,497 @@

+// Copyright 2012 The Go Authors. All rights reserved.

+// Use of this source code is governed by a BSD-style

+// license that can be found in the LICENSE file.

+

+// This code was translated into a form compatible with 6a from the public

+// domain sources in SUPERCOP: http://bench.cr.yp.to/supercop.html

+

+// +build amd64,!gccgo,!appengine

+

+// func poly1305(out *[16]byte, m *byte, mlen uint64, key *[32]key)

+TEXT ·poly1305(SB),0,$224-32

+	MOVQ out+0(FP),DI

+	MOVQ m+8(FP),SI

+	MOVQ mlen+16(FP),DX

+	MOVQ key+24(FP),CX

+

+	MOVQ SP,R11

+	MOVQ $31,R9

+	NOTQ R9

+	ANDQ R9,SP

+	ADDQ $32,SP

+

+	MOVQ R11,32(SP)

+	MOVQ R12,40(SP)

+	MOVQ R13,48(SP)

+	MOVQ R14,56(SP)

+	MOVQ R15,64(SP)

+	MOVQ BX,72(SP)

+	MOVQ BP,80(SP)

+	FLDCW ·ROUNDING(SB)

+	MOVL 0(CX),R8

+	MOVL 4(CX),R9

+	MOVL 8(CX),AX

+	MOVL 12(CX),R10

+	MOVQ DI,88(SP)

+	MOVQ CX,96(SP)

+	MOVL $0X43300000,108(SP)

+	MOVL $0X45300000,116(SP)

+	MOVL $0X47300000,124(SP)

+	MOVL $0X49300000,132(SP)

+	ANDL $0X0FFFFFFF,R8

+	ANDL $0X0FFFFFFC,R9

+	ANDL $0X0FFFFFFC,AX

+	ANDL $0X0FFFFFFC,R10

+	MOVL R8,104(SP)

+	MOVL R9,112(SP)

+	MOVL AX,120(SP)

+	MOVL R10,128(SP)