READ THE CODE

Inside Bitcoin

The code behind the network, with room to understand it.

Stable release v32.1bitcoin/bitcoin · f0de87f04062 ↗3,020 source files · 47.5 MB stored on the server440 file guides

Release published 2026-10-28 · Snapshot fetched 2026-11-01. Latest stable release at fetch time; development branches and Git history are excluded. Only the selected code window and visible folders load here.

10,389 bytes · SHA-256 c412e83b29f088bd… · View upstream ↗

1// Copyright (c) 2017-present The Bitcoin Core developers
2// Distributed under the MIT software license, see the accompanying
3// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4
5// Based on the public domain implementation 'merged' by D. J. Bernstein
6// See https://cr.yp.to/chacha.html.
7
8#include <crypto/common.h>
9#include <crypto/chacha20.h>
10#include <support/cleanse.h>
11
12#include <algorithm>
13#include <bit>
14#include <cassert>
15
16#define QUARTERROUND(a,b,c,d) \
17  a += b; d = std::rotl(d ^ a, 16); \
18  c += d; b = std::rotl(b ^ c, 12); \
19  a += b; d = std::rotl(d ^ a, 8); \
20  c += d; b = std::rotl(b ^ c, 7);
21
22#define REPEAT10(a) do { {a}; {a}; {a}; {a}; {a}; {a}; {a}; {a}; {a}; {a}; } while(0)
23
24void ChaCha20Aligned::SetKey(std::span<const std::byte> key) noexcept
25{
26    assert(key.size() == KEYLEN);
27    input[0] = ReadLE32(key.data() + 0);
28    input[1] = ReadLE32(key.data() + 4);
29    input[2] = ReadLE32(key.data() + 8);
30    input[3] = ReadLE32(key.data() + 12);
31    input[4] = ReadLE32(key.data() + 16);
32    input[5] = ReadLE32(key.data() + 20);
33    input[6] = ReadLE32(key.data() + 24);
34    input[7] = ReadLE32(key.data() + 28);
35    input[8] = 0;
36    input[9] = 0;
37    input[10] = 0;
38    input[11] = 0;
39}
40
41ChaCha20Aligned::~ChaCha20Aligned()
42{
43    memory_cleanse(input, sizeof(input));
44}
45
46ChaCha20Aligned::ChaCha20Aligned(std::span<const std::byte> key) noexcept
47{
48    SetKey(key);
49}
50
51void ChaCha20Aligned::Seek(Nonce96 nonce, uint32_t block_counter) noexcept
52{
53    input[8] = block_counter;
54    input[9] = nonce.first;
55    input[10] = nonce.second;
56    input[11] = nonce.second >> 32;
57}
58
59inline void ChaCha20Aligned::Keystream(std::span<std::byte> output) noexcept
60{
61    std::byte* c = output.data();
62    size_t blocks = output.size() / BLOCKLEN;
63    assert(blocks * BLOCKLEN == output.size());
64
65    uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;
66    uint32_t j4, j5, j6, j7, j8, j9, j10, j11, j12, j13, j14, j15;
67
68    if (!blocks) return;
69
70    j4 = input[0];
71    j5 = input[1];
72    j6 = input[2];
73    j7 = input[3];
74    j8 = input[4];
75    j9 = input[5];
76    j10 = input[6];
77    j11 = input[7];
78    j12 = input[8];
79    j13 = input[9];
80    j14 = input[10];
81    j15 = input[11];
82
83    for (;;) {
84        x0 = 0x61707865;
85        x1 = 0x3320646e;
86        x2 = 0x79622d32;
87        x3 = 0x6b206574;
88        x4 = j4;
89        x5 = j5;
90        x6 = j6;
91        x7 = j7;
92        x8 = j8;
93        x9 = j9;
94        x10 = j10;
95        x11 = j11;
96        x12 = j12;
97        x13 = j13;
98        x14 = j14;
99        x15 = j15;
100
101        // The 20 inner ChaCha20 rounds are unrolled here for performance.
102        REPEAT10(
103            QUARTERROUND( x0, x4, x8,x12);
104            QUARTERROUND( x1, x5, x9,x13);
105            QUARTERROUND( x2, x6,x10,x14);
106            QUARTERROUND( x3, x7,x11,x15);
107            QUARTERROUND( x0, x5,x10,x15);
108            QUARTERROUND( x1, x6,x11,x12);
109            QUARTERROUND( x2, x7, x8,x13);
110            QUARTERROUND( x3, x4, x9,x14);
111        );
112
113        x0 += 0x61707865;
114        x1 += 0x3320646e;
115        x2 += 0x79622d32;
116        x3 += 0x6b206574;
117        x4 += j4;
118        x5 += j5;
119        x6 += j6;
120        x7 += j7;
121        x8 += j8;
122        x9 += j9;
123        x10 += j10;
124        x11 += j11;
125        x12 += j12;
126        x13 += j13;
127        x14 += j14;
128        x15 += j15;
129
130        ++j12;
131        if (!j12) ++j13;
132
133        WriteLE32(c + 0, x0);
134        WriteLE32(c + 4, x1);
135        WriteLE32(c + 8, x2);
136        WriteLE32(c + 12, x3);
137        WriteLE32(c + 16, x4);
138        WriteLE32(c + 20, x5);
139        WriteLE32(c + 24, x6);
140        WriteLE32(c + 28, x7);
141        WriteLE32(c + 32, x8);
142        WriteLE32(c + 36, x9);
143        WriteLE32(c + 40, x10);
144        WriteLE32(c + 44, x11);
145        WriteLE32(c + 48, x12);
146        WriteLE32(c + 52, x13);
147        WriteLE32(c + 56, x14);
148        WriteLE32(c + 60, x15);
149
150        if (blocks == 1) {
151            input[8] = j12;
152            input[9] = j13;
153            return;
154        }
155        blocks -= 1;
156        c += BLOCKLEN;
157    }
158}
159
160inline void ChaCha20Aligned::Crypt(std::span<const std::byte> in_bytes, std::span<std::byte> out_bytes) noexcept
161{
162    assert(in_bytes.size() == out_bytes.size());
163    const std::byte* m = in_bytes.data();
164    std::byte* c = out_bytes.data();
165    size_t blocks = out_bytes.size() / BLOCKLEN;
166    assert(blocks * BLOCKLEN == out_bytes.size());
167
168    uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;
169    uint32_t j4, j5, j6, j7, j8, j9, j10, j11, j12, j13, j14, j15;
170
171    if (!blocks) return;
172
173    j4 = input[0];
174    j5 = input[1];
175    j6 = input[2];
176    j7 = input[3];
177    j8 = input[4];
178    j9 = input[5];
179    j10 = input[6];
180    j11 = input[7];
181    j12 = input[8];
182    j13 = input[9];
183    j14 = input[10];
184    j15 = input[11];
185
186    for (;;) {
187        x0 = 0x61707865;
188        x1 = 0x3320646e;
189        x2 = 0x79622d32;
190        x3 = 0x6b206574;
191        x4 = j4;
192        x5 = j5;
193        x6 = j6;
194        x7 = j7;
195        x8 = j8;
196        x9 = j9;
197        x10 = j10;
198        x11 = j11;
199        x12 = j12;
200        x13 = j13;
201        x14 = j14;
202        x15 = j15;
203
204        // The 20 inner ChaCha20 rounds are unrolled here for performance.
205        REPEAT10(
206            QUARTERROUND( x0, x4, x8,x12);
207            QUARTERROUND( x1, x5, x9,x13);
208            QUARTERROUND( x2, x6,x10,x14);
209            QUARTERROUND( x3, x7,x11,x15);
210            QUARTERROUND( x0, x5,x10,x15);
211            QUARTERROUND( x1, x6,x11,x12);
212            QUARTERROUND( x2, x7, x8,x13);
213            QUARTERROUND( x3, x4, x9,x14);
214        );
215
216        x0 += 0x61707865;
217        x1 += 0x3320646e;
218        x2 += 0x79622d32;
219        x3 += 0x6b206574;
220        x4 += j4;
221        x5 += j5;
222        x6 += j6;
223        x7 += j7;
224        x8 += j8;
225        x9 += j9;
226        x10 += j10;
227        x11 += j11;
228        x12 += j12;
229        x13 += j13;
230        x14 += j14;
231        x15 += j15;
232
233        x0 ^= ReadLE32(m + 0);
234        x1 ^= ReadLE32(m + 4);
235        x2 ^= ReadLE32(m + 8);
236        x3 ^= ReadLE32(m + 12);
237        x4 ^= ReadLE32(m + 16);
238        x5 ^= ReadLE32(m + 20);
239        x6 ^= ReadLE32(m + 24);
240        x7 ^= ReadLE32(m + 28);
241        x8 ^= ReadLE32(m + 32);
242        x9 ^= ReadLE32(m + 36);
243        x10 ^= ReadLE32(m + 40);
244        x11 ^= ReadLE32(m + 44);
245        x12 ^= ReadLE32(m + 48);
246        x13 ^= ReadLE32(m + 52);
247        x14 ^= ReadLE32(m + 56);
248        x15 ^= ReadLE32(m + 60);
249
250        ++j12;

src/wallet/receive.cpp

src/wallet/coinselection.cpp

src/consensus/validation.h

src/primitives/transaction.cpp

src/script/descriptor.cpp

src/bitcoin-cli.cpp

src/rpc/blockchain.cpp

src/rpc/rawtransaction.cpp

src/init.cpp

src/crypto/sha256.cpp

src/consensus/merkle.h

src/consensus/tx_check.h

src/consensus/tx_verify.h

src/policy/feerate.h

src/policy/feerate.cpp

src/primitives/transaction_identifier.h

src/chainparamsbase.h

src/chainparamsbase.cpp

src/util/moneystr.cpp

src/crypto/ripemd160.h

src/crypto/sha1.h

src/crypto/sha512.h

src/crypto/hmac_sha256.h

src/crypto/hmac_sha512.h

src/crypto/hmac_sha256.cpp

src/crypto/hmac_sha512.cpp

src/crypto/hkdf_sha256_32.h

src/crypto/hkdf_sha256_32.cpp

src/support/cleanse.h

src/support/cleanse.cpp

src/crypto/siphash.cpp

src/crypto/muhash.h

src/crypto/chacha20.h

src/crypto/poly1305.h

src/crypto/chacha20poly1305.h

src/crypto/chacha20poly1305.cpp

src/util/chaintype.cpp

src/util/obfuscation.h

src/util/byte_units.h

src/util/overflow.h

src/blockencodings.cpp

src/net_permissions.cpp

src/policy/packages.cpp

src/policy/rbf.cpp

src/policy/truc_policy.cpp

src/policy/ephemeral_policy.cpp

src/policy/settings.cpp

src/policy/policy.cpp

src/node/transaction.cpp

src/node/coin.cpp

src/rpc/client.cpp

src/rpc/external_signer.cpp

src/rpc/request.cpp

src/rpc/server_util.cpp

src/rpc/fees.cpp

src/rpc/output_script.cpp

src/rpc/rawtransaction_util.cpp

src/rpc/rawtransaction_util.h

src/rpc/register.h

src/rpc/request.h

src/rpc/server_util.h

src/rpc/protocol.h

src/rpc/server.h

src/rpc/signmessage.cpp

src/rpc/txoutproof.cpp

src/rpc/util.cpp

src/rpc/util.h

src/wallet/rpc/addresses.cpp

src/wallet/rpc/backup.cpp

src/wallet/rpc/coins.cpp

src/wallet/rpc/encrypt.cpp

src/wallet/rpc/signmessage.cpp

src/wallet/rpc/util.cpp

src/wallet/rpc/util.h

src/wallet/coincontrol.cpp

src/wallet/coincontrol.h

src/wallet/context.cpp

src/wallet/context.h

src/wallet/crypter.cpp

src/wallet/crypter.h

src/wallet/db.cpp

src/wallet/export.cpp

src/wallet/external_signer_scriptpubkeyman.cpp

src/wallet/rpc/spend.cpp

src/wallet/rpc/transactions.cpp

src/wallet/rpc/wallet.cpp

src/wallet/feebumper.cpp

src/wallet/feebumper.h

src/index/base.h

src/index/base.cpp

src/index/txindex.h

src/index/txindex.cpp

src/index/txindex_key.h

src/index/txospenderindex.h

src/index/txospenderindex.cpp

src/index/blockfilterindex.h

src/index/blockfilterindex.cpp

src/index/coinstatsindex.h

src/index/coinstatsindex.cpp

src/index/db_key.h

src/index/disktxpos.h

src/kernel/chain.cpp

src/kernel/chain.h

src/kernel/checks.cpp

src/kernel/checks.h

src/kernel/context.cpp

src/kernel/context.h

src/kernel/cs_main.cpp

src/kernel/cs_main.h

src/kernel/disconnected_transactions.cpp

src/kernel/disconnected_transactions.h

src/kernel/mempool_removal_reason.cpp

src/kernel/mempool_removal_reason.h

src/kernel/coinstats.cpp

src/kernel/coinstats.h

src/kernel/chainparams.cpp

src/kernel/chainparams.h

src/wallet/sqlite.cpp

src/wallet/sqlite.h

src/wallet/transaction.cpp

src/wallet/transaction.h

src/wallet/dump.cpp

src/wallet/dump.h

src/wallet/init.cpp

src/wallet/walletutil.cpp

src/wallet/walletutil.h

src/wallet/wallettool.cpp

src/wallet/wallettool.h

src/wallet/export.h

src/wallet/migrate.cpp

src/wallet/migrate.h

src/wallet/db.h

src/wallet/walletdb.cpp

src/wallet/interfaces.cpp

src/wallet/scriptpubkeyman.cpp

src/wallet/scriptpubkeyman.h

src/kernel/bitcoinkernel.cpp

src/kernel/bitcoinkernel.h

src/kernel/bitcoinkernel_wrapper.h

src/node/chainstate.cpp

src/node/chainstate.h

src/node/blockstorage.cpp

src/node/blockstorage.h

src/node/mempool_persist.cpp

src/node/mempool_persist.h

src/node/utxo_snapshot.cpp

src/node/utxo_snapshot.h

src/node/kernel_notifications.cpp

src/node/kernel_notifications.h

src/node/blockmanager_args.cpp

src/kernel/blockmanager_opts.h

src/util/expected.cpp

src/policy/settings.h

src/util/types.h

src/kernel/messagestartchars.h

src/kernel/warning.h

src/util/exception.h

src/common/license_info.h

src/node/coins_view_args.h

src/node/database_args.h

src/util/batchpriority.h

src/util/ui_change_type.h

src/node/coins_view_args.cpp

src/node/peerman_args.h

src/util/serfloat.h

src/node/blockmanager_args.h

src/node/database_args.cpp

src/util/overloaded.h

src/interfaces/types.h

src/node/chainstatemanager_args.h

src/node/minisketchwrapper.h

src/util/macros.h

src/util/syserror.h

src/common/run_command.h

src/util/bytevectorhash.cpp

src/node/mempool_persist_args.cpp

src/util/exec.h

src/util/rbf.h

src/crypto/hex_base.h

src/node/mempool_persist_args.h

src/interfaces/echo.h

src/util/any.h

src/util/batchpriority.cpp

src/util/threadnames.h

src/node/coin.h

src/node/mempool_args.h

src/util/asmap.h

src/util/bytevectorhash.h

src/node/context.cpp

src/util/insert.h

src/util/readwritefile.h

src/node/peerman_args.cpp

src/node/interface_ui.cpp

src/interfaces/handler.h

src/node/mining_args.h

src/util/hasher.cpp

src/common/init.h

src/kernel/mempool_limits.h

src/common/system.h

src/crypto/sha3.h

src/util/threadinterrupt.cpp

src/node/protocol_version.h

src/util/exception.cpp

src/common/messages.h

src/node/connection_types.cpp

src/util/bip32.h

src/common/license_info.cpp

src/util/stdmutex.h

src/common/run_command.cpp

src/util/check.cpp

src/util/golombrice.h

src/node/types.h

src/node/timeoffsets.h

src/util/readwritefile.cpp

src/util/fastrange.h

src/util/signalinterrupt.h

src/util/task_runner.h

src/util/syserror.cpp

src/common/interfaces.cpp

src/common/types.h

src/util/threadinterrupt.h

src/kernel/chainstatemanager_opts.h

src/node/psbt.h

src/policy/ephemeral_policy.h

src/util/trace.h

src/common/url.cpp

src/kernel/mempool_options.h

src/util/serfloat.cpp

src/kernel/notifications_interface.h

src/node/timeoffsets.cpp

src/node/warnings.cpp

src/util/hash_type.h

src/crypto/hex_base.cpp

src/node/eviction.h

src/util/tokenbucket.h

src/crypto/aes.h

src/common/pcp.h

src/util/feefrac.cpp

src/node/transaction.h

src/util/threadnames.cpp

src/common/signmessage.h

src/util/exec.cpp

src/util/signalinterrupt.cpp

src/clientversion.cpp

src/common/signmessage.cpp

src/compat/assumptions.h

src/compat/byteswap.h

src/deploymentinfo.cpp

src/deploymentinfo.h

src/deploymentstatus.cpp

src/deploymentstatus.h

src/dummywallet.cpp

src/external_signer.h

src/init/bitcoin-gui.cpp

src/init/bitcoin-node.cpp

src/init/bitcoin-qt.cpp

src/init/bitcoin-wallet.cpp

src/init/bitcoind.cpp

src/init/common.h

src/interfaces/init.h

src/interfaces/ipc.h

src/key_io.h

src/logging/categories.h

src/logging/timer.h

src/mapport.h

src/musig.h

src/net_permissions.h

src/netgroup.h

src/netmessagemaker.h

src/node/chainstatemanager_args.cpp

src/node/connection_types.h

src/node/context.h

src/node/interface_ui.h

src/node/mempool_args.cpp

src/node/mining_args.cpp

src/node/minisketchwrapper.cpp

src/node/txreconciliation.h

src/policy/fees/estimator_args.cpp

src/policy/fees/estimator_args.h

src/policy/fees/estimator_man.cpp

src/policy/fees/estimator_man.h

src/policy/packages.h

src/policy/rbf.h

src/policy/truc_policy.h

src/pow.h

src/primitives/block.cpp

src/randomenv.h

src/rest.h

src/script/keyorigin.h

src/script/parsing.cpp

src/script/parsing.h

src/script/script_error.h

src/script/sigcache.cpp

src/script/sigcache.h

src/script/solver.h

src/script/verify_flags.h

src/semaphore_grant.h

src/signet.h

src/span.h

src/support/allocators/secure.h

src/support/allocators/zeroafterfree.h

src/util/tokenpipe.cpp

src/util/translation.h

src/util/vector.h

src/versionbits.h

src/versionbits_impl.h

src/wallet/external_signer_scriptpubkeyman.h

src/wallet/fees.h

src/wallet/load.h

src/wallet/receive.h

src/wallet/rpc/wallet.h

src/wallet/types.h

src/walletinitinterface.h

src/zmq/zmqabstractnotifier.cpp

Independent explanations by MyBitcoinExplorer. Not affiliated with or endorsed by Bitcoin Core. Guides are educational and do not replace the source or its tests.

Bitcoin Core source © its contributors, distributed under the MIT license. Original notices and bundled third-party licenses are retained in the source tree.