crypto: Add support for the XChaCha20-Poly1305 AEAD cipher.

[jhb]

Summary

This cipher is a wrapper around the ChaCha20-Poly1305 AEAD cipher
which accepts a larger nonce. Part of the nonce is used along with
the key as an input to HChaCha20 to generate a derived key used for
ChaCha20-Poly1305.

This cipher is used by WireGuard.

Sponsored by: The FreeBSD Foundation

[jhb]

This does not include cryptocheck support as OpenSSL does not include XChaCha20 (and specifically it does not include HChaCha20).

In theory ossl(4) could support XChaCha20-Poly1305 by using the HChaCha20 routine from libsodium to compute the derived key. However, WireGuard (the only expected consumer of this cipher) will most likely not use OCF but use the enc_xform directly (or a wrapper, see D33524), so patching ossl(4) probably isn't worth it.

[pauamma_gundo.com]

Manual page change (such as it is) LGTM.

[gbe]

LGTM for the man page part.

[markj]

sys/opencrypto/xform_chacha20_poly1305.c

44

186

Should we zero the nonce buffer?

[jhb]

• Explicitly note the C inheritance.
• zero the temporary nonce