Add Chacha stream cipher constants for 128-bit and 256-bit key

Crypto/crypto_signatures.yar

@@ -1431,3 +1431,25 @@ rule DCP_DES_EncryptECB {
 	condition:
 		any of them
 }
+
+rule Chacha_128_constant {
+    meta:
+		author = "spelissier"
+		description = "Look for 128-bit key Chacha stream cipher constant"
+		date = "2019-12"
+	strings:
+		$c0 = "expand 16-byte k"
+	condition:
+		$c0
+}
+
+rule Chacha_256_constant {
+    meta:
+		author = "spelissier"
+		description = "Look for 256-bit key Chacha stream cipher constant"
+		date = "2019-12"
+	strings:
+		$c0 = "expand 32-byte k"
+	condition:
+		$c0
+}