|
3
|
1 /* LibTomCrypt, modular cryptographic library -- Tom St Denis |
|
|
2 * |
|
|
3 * LibTomCrypt is a library that provides various cryptographic |
|
|
4 * algorithms in a highly modular and flexible manner. |
|
|
5 * |
|
|
6 * The library is free for all purposes without any express |
|
|
7 * guarantee it works. |
|
|
8 * |
|
|
9 * Tom St Denis, [email protected], http://libtomcrypt.org |
|
|
10 */ |
|
|
11 /**********************************************************************\ |
|
|
12 * To commemorate the 1996 RSA Data Security Conference, the following * |
|
|
13 * code is released into the public domain by its author. Prost! * |
|
|
14 * * |
|
|
15 * This cipher uses 16-bit words and little-endian byte ordering. * |
|
|
16 * I wonder which processor it was optimized for? * |
|
|
17 * * |
|
|
18 * Thanks to CodeView, SoftIce, and D86 for helping bring this code to * |
|
|
19 * the public. * |
|
|
20 \**********************************************************************/ |
|
|
21 |
|
|
22 #include <mycrypt.h> |
|
|
23 |
|
|
24 #ifdef RC2 |
|
|
25 |
|
|
26 const struct _cipher_descriptor rc2_desc = { |
|
|
27 "rc2", |
|
|
28 12, 8, 128, 8, 16, |
|
|
29 &rc2_setup, |
|
|
30 &rc2_ecb_encrypt, |
|
|
31 &rc2_ecb_decrypt, |
|
|
32 &rc2_test, |
|
|
33 &rc2_keysize |
|
|
34 }; |
|
|
35 |
|
143
|
36 /* 256-entry permutation table, probably derived somehow from pi */ |
|
|
37 static const unsigned char permute[256] = { |
|
3
|
38 217,120,249,196, 25,221,181,237, 40,233,253,121, 74,160,216,157, |
|
|
39 198,126, 55,131, 43,118, 83,142, 98, 76,100,136, 68,139,251,162, |
|
|
40 23,154, 89,245,135,179, 79, 19, 97, 69,109,141, 9,129,125, 50, |
|
|
41 189,143, 64,235,134,183,123, 11,240,149, 33, 34, 92,107, 78,130, |
|
|
42 84,214,101,147,206, 96,178, 28,115, 86,192, 20,167,140,241,220, |
|
|
43 18,117,202, 31, 59,190,228,209, 66, 61,212, 48,163, 60,182, 38, |
|
|
44 111,191, 14,218, 70,105, 7, 87, 39,242, 29,155,188,148, 67, 3, |
|
|
45 248, 17,199,246,144,239, 62,231, 6,195,213, 47,200,102, 30,215, |
|
|
46 8,232,234,222,128, 82,238,247,132,170,114,172, 53, 77,106, 42, |
|
|
47 150, 26,210,113, 90, 21, 73,116, 75,159,208, 94, 4, 24,164,236, |
|
|
48 194,224, 65,110, 15, 81,203,204, 36,145,175, 80,161,244,112, 57, |
|
|
49 153,124, 58,133, 35,184,180,122,252, 2, 54, 91, 37, 85,151, 49, |
|
|
50 45, 93,250,152,227,138,146,174, 5,223, 41, 16,103,108,186,201, |
|
|
51 211, 0,230,207,225,158,168, 44, 99, 22, 1, 63, 88,226,137,169, |
|
|
52 13, 56, 52, 27,171, 51,255,176,187, 72, 12, 95,185,177,205, 46, |
|
|
53 197,243,219, 71,229,165,156,119, 10,166, 32,104,254,127,193,173 |
|
143
|
54 }; |
|
3
|
55 |
|
|
56 int rc2_setup(const unsigned char *key, int keylen, int rounds, symmetric_key *skey) |
|
|
57 { |
|
|
58 unsigned *xkey = skey->rc2.xkey; |
|
|
59 unsigned char tmp[128]; |
|
|
60 unsigned T8, TM; |
|
|
61 int i, bits; |
|
|
62 |
|
|
63 _ARGCHK(key != NULL); |
|
|
64 _ARGCHK(skey != NULL); |
|
|
65 |
|
|
66 if (keylen < 8 || keylen > 128) { |
|
|
67 return CRYPT_INVALID_KEYSIZE; |
|
|
68 } |
|
|
69 |
|
|
70 if (rounds != 0 && rounds != 16) { |
|
|
71 return CRYPT_INVALID_ROUNDS; |
|
|
72 } |
|
|
73 |
|
|
74 for (i = 0; i < keylen; i++) { |
|
|
75 tmp[i] = key[i] & 255; |
|
|
76 } |
|
|
77 |
|
|
78 /* Phase 1: Expand input key to 128 bytes */ |
|
|
79 if (keylen < 128) { |
|
|
80 for (i = keylen; i < 128; i++) { |
|
143
|
81 tmp[i] = permute[(tmp[i - 1] + tmp[i - keylen]) & 255]; |
|
3
|
82 } |
|
|
83 } |
|
|
84 |
|
|
85 /* Phase 2 - reduce effective key size to "bits" */ |
|
143
|
86 bits = keylen<<3; |
|
3
|
87 T8 = (unsigned)(bits+7)>>3; |
|
|
88 TM = (255 >> (unsigned)(7 & -bits)); |
|
143
|
89 tmp[128 - T8] = permute[tmp[128 - T8] & TM]; |
|
3
|
90 for (i = 127 - T8; i >= 0; i--) { |
|
143
|
91 tmp[i] = permute[tmp[i + 1] ^ tmp[i + T8]]; |
|
3
|
92 } |
|
|
93 |
|
|
94 /* Phase 3 - copy to xkey in little-endian order */ |
|
143
|
95 for (i = 0; i < 64; i++) { |
|
3
|
96 xkey[i] = (unsigned)tmp[2*i] + ((unsigned)tmp[2*i+1] << 8); |
|
143
|
97 } |
|
3
|
98 |
|
|
99 #ifdef CLEAN_STACK |
|
|
100 zeromem(tmp, sizeof(tmp)); |
|
|
101 #endif |
|
|
102 |
|
|
103 return CRYPT_OK; |
|
|
104 } |
|
|
105 |
|
|
106 /**********************************************************************\ |
|
|
107 * Encrypt an 8-byte block of plaintext using the given key. * |
|
|
108 \**********************************************************************/ |
|
|
109 #ifdef CLEAN_STACK |
|
|
110 static void _rc2_ecb_encrypt( const unsigned char *plain, |
|
|
111 unsigned char *cipher, |
|
|
112 symmetric_key *skey) |
|
|
113 #else |
|
|
114 void rc2_ecb_encrypt( const unsigned char *plain, |
|
|
115 unsigned char *cipher, |
|
|
116 symmetric_key *skey) |
|
|
117 #endif |
|
|
118 { |
|
|
119 unsigned *xkey; |
|
|
120 unsigned x76, x54, x32, x10, i; |
|
|
121 |
|
143
|
122 _ARGCHK(plain != NULL); |
|
3
|
123 _ARGCHK(cipher != NULL); |
|
143
|
124 _ARGCHK(skey != NULL); |
|
3
|
125 |
|
|
126 xkey = skey->rc2.xkey; |
|
|
127 |
|
|
128 x76 = ((unsigned)plain[7] << 8) + (unsigned)plain[6]; |
|
|
129 x54 = ((unsigned)plain[5] << 8) + (unsigned)plain[4]; |
|
|
130 x32 = ((unsigned)plain[3] << 8) + (unsigned)plain[2]; |
|
|
131 x10 = ((unsigned)plain[1] << 8) + (unsigned)plain[0]; |
|
|
132 |
|
|
133 for (i = 0; i < 16; i++) { |
|
|
134 x10 = (x10 + (x32 & ~x76) + (x54 & x76) + xkey[4*i+0]) & 0xFFFF; |
|
143
|
135 x10 = ((x10 << 1) | (x10 >> 15)); |
|
3
|
136 |
|
|
137 x32 = (x32 + (x54 & ~x10) + (x76 & x10) + xkey[4*i+1]) & 0xFFFF; |
|
143
|
138 x32 = ((x32 << 2) | (x32 >> 14)); |
|
3
|
139 |
|
|
140 x54 = (x54 + (x76 & ~x32) + (x10 & x32) + xkey[4*i+2]) & 0xFFFF; |
|
143
|
141 x54 = ((x54 << 3) | (x54 >> 13)); |
|
3
|
142 |
|
|
143 x76 = (x76 + (x10 & ~x54) + (x32 & x54) + xkey[4*i+3]) & 0xFFFF; |
|
143
|
144 x76 = ((x76 << 5) | (x76 >> 11)); |
|
3
|
145 |
|
|
146 if (i == 4 || i == 10) { |
|
|
147 x10 = (x10 + xkey[x76 & 63]) & 0xFFFF; |
|
|
148 x32 = (x32 + xkey[x10 & 63]) & 0xFFFF; |
|
|
149 x54 = (x54 + xkey[x32 & 63]) & 0xFFFF; |
|
|
150 x76 = (x76 + xkey[x54 & 63]) & 0xFFFF; |
|
|
151 } |
|
|
152 } |
|
|
153 |
|
|
154 cipher[0] = (unsigned char)x10; |
|
|
155 cipher[1] = (unsigned char)(x10 >> 8); |
|
|
156 cipher[2] = (unsigned char)x32; |
|
|
157 cipher[3] = (unsigned char)(x32 >> 8); |
|
|
158 cipher[4] = (unsigned char)x54; |
|
|
159 cipher[5] = (unsigned char)(x54 >> 8); |
|
|
160 cipher[6] = (unsigned char)x76; |
|
|
161 cipher[7] = (unsigned char)(x76 >> 8); |
|
|
162 } |
|
|
163 |
|
|
164 #ifdef CLEAN_STACK |
|
|
165 void rc2_ecb_encrypt( const unsigned char *plain, |
|
|
166 unsigned char *cipher, |
|
|
167 symmetric_key *skey) |
|
|
168 { |
|
|
169 _rc2_ecb_encrypt(plain, cipher, skey); |
|
|
170 burn_stack(sizeof(unsigned *) + sizeof(unsigned) * 5); |
|
|
171 } |
|
|
172 #endif |
|
|
173 |
|
|
174 /**********************************************************************\ |
|
|
175 * Decrypt an 8-byte block of ciphertext using the given key. * |
|
|
176 \**********************************************************************/ |
|
|
177 |
|
|
178 #ifdef CLEAN_STACK |
|
|
179 static void _rc2_ecb_decrypt( const unsigned char *cipher, |
|
|
180 unsigned char *plain, |
|
|
181 symmetric_key *skey) |
|
|
182 #else |
|
|
183 void rc2_ecb_decrypt( const unsigned char *cipher, |
|
|
184 unsigned char *plain, |
|
|
185 symmetric_key *skey) |
|
|
186 #endif |
|
|
187 { |
|
|
188 unsigned x76, x54, x32, x10; |
|
|
189 unsigned *xkey; |
|
|
190 int i; |
|
|
191 |
|
143
|
192 _ARGCHK(plain != NULL); |
|
3
|
193 _ARGCHK(cipher != NULL); |
|
143
|
194 _ARGCHK(skey != NULL); |
|
3
|
195 |
|
|
196 xkey = skey->rc2.xkey; |
|
|
197 |
|
|
198 x76 = ((unsigned)cipher[7] << 8) + (unsigned)cipher[6]; |
|
|
199 x54 = ((unsigned)cipher[5] << 8) + (unsigned)cipher[4]; |
|
|
200 x32 = ((unsigned)cipher[3] << 8) + (unsigned)cipher[2]; |
|
|
201 x10 = ((unsigned)cipher[1] << 8) + (unsigned)cipher[0]; |
|
|
202 |
|
|
203 for (i = 15; i >= 0; i--) { |
|
|
204 if (i == 4 || i == 10) { |
|
|
205 x76 = (x76 - xkey[x54 & 63]) & 0xFFFF; |
|
|
206 x54 = (x54 - xkey[x32 & 63]) & 0xFFFF; |
|
|
207 x32 = (x32 - xkey[x10 & 63]) & 0xFFFF; |
|
|
208 x10 = (x10 - xkey[x76 & 63]) & 0xFFFF; |
|
|
209 } |
|
|
210 |
|
143
|
211 x76 = ((x76 << 11) | (x76 >> 5)); |
|
3
|
212 x76 = (x76 - ((x10 & ~x54) + (x32 & x54) + xkey[4*i+3])) & 0xFFFF; |
|
|
213 |
|
143
|
214 x54 = ((x54 << 13) | (x54 >> 3)); |
|
3
|
215 x54 = (x54 - ((x76 & ~x32) + (x10 & x32) + xkey[4*i+2])) & 0xFFFF; |
|
|
216 |
|
143
|
217 x32 = ((x32 << 14) | (x32 >> 2)); |
|
3
|
218 x32 = (x32 - ((x54 & ~x10) + (x76 & x10) + xkey[4*i+1])) & 0xFFFF; |
|
|
219 |
|
143
|
220 x10 = ((x10 << 15) | (x10 >> 1)); |
|
3
|
221 x10 = (x10 - ((x32 & ~x76) + (x54 & x76) + xkey[4*i+0])) & 0xFFFF; |
|
|
222 } |
|
|
223 |
|
|
224 plain[0] = (unsigned char)x10; |
|
|
225 plain[1] = (unsigned char)(x10 >> 8); |
|
|
226 plain[2] = (unsigned char)x32; |
|
|
227 plain[3] = (unsigned char)(x32 >> 8); |
|
|
228 plain[4] = (unsigned char)x54; |
|
|
229 plain[5] = (unsigned char)(x54 >> 8); |
|
|
230 plain[6] = (unsigned char)x76; |
|
|
231 plain[7] = (unsigned char)(x76 >> 8); |
|
|
232 } |
|
|
233 |
|
|
234 #ifdef CLEAN_STACK |
|
|
235 void rc2_ecb_decrypt( const unsigned char *cipher, |
|
|
236 unsigned char *plain, |
|
|
237 symmetric_key *skey) |
|
|
238 { |
|
|
239 _rc2_ecb_decrypt(cipher, plain, skey); |
|
|
240 burn_stack(sizeof(unsigned *) + sizeof(unsigned) * 4 + sizeof(int)); |
|
|
241 } |
|
|
242 #endif |
|
|
243 |
|
|
244 int rc2_test(void) |
|
|
245 { |
|
|
246 #ifndef LTC_TEST |
|
|
247 return CRYPT_NOP; |
|
|
248 #else |
|
|
249 static const struct { |
|
|
250 int keylen; |
|
|
251 unsigned char key[16], pt[8], ct[8]; |
|
|
252 } tests[] = { |
|
|
253 |
|
|
254 { 8, |
|
|
255 { 0x30, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, |
|
|
256 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, |
|
|
257 { 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 }, |
|
|
258 { 0x30, 0x64, 0x9e, 0xdf, 0x9b, 0xe7, 0xd2, 0xc2 } |
|
|
259 |
|
|
260 }, |
|
|
261 { 16, |
|
|
262 { 0x88, 0xbc, 0xa9, 0x0e, 0x90, 0x87, 0x5a, 0x7f, |
|
|
263 0x0f, 0x79, 0xc3, 0x84, 0x62, 0x7b, 0xaf, 0xb2 }, |
|
|
264 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, |
|
|
265 { 0x22, 0x69, 0x55, 0x2a, 0xb0, 0xf8, 0x5c, 0xa6 } |
|
|
266 } |
|
|
267 }; |
|
|
268 int x, y, err; |
|
|
269 symmetric_key skey; |
|
|
270 unsigned char tmp[2][8]; |
|
|
271 |
|
|
272 for (x = 0; x < (int)(sizeof(tests) / sizeof(tests[0])); x++) { |
|
|
273 zeromem(tmp, sizeof(tmp)); |
|
|
274 if ((err = rc2_setup(tests[x].key, tests[x].keylen, 0, &skey)) != CRYPT_OK) { |
|
|
275 return err; |
|
|
276 } |
|
|
277 |
|
|
278 rc2_ecb_encrypt(tests[x].pt, tmp[0], &skey); |
|
|
279 rc2_ecb_decrypt(tmp[0], tmp[1], &skey); |
|
|
280 |
|
|
281 if (memcmp(tmp[0], tests[x].ct, 8) != 0 || memcmp(tmp[1], tests[x].pt, 8) != 0) { |
|
|
282 return CRYPT_FAIL_TESTVECTOR; |
|
|
283 } |
|
|
284 |
|
|
285 /* now see if we can encrypt all zero bytes 1000 times, decrypt and come back where we started */ |
|
|
286 for (y = 0; y < 8; y++) tmp[0][y] = 0; |
|
|
287 for (y = 0; y < 1000; y++) rc2_ecb_encrypt(tmp[0], tmp[0], &skey); |
|
|
288 for (y = 0; y < 1000; y++) rc2_ecb_decrypt(tmp[0], tmp[0], &skey); |
|
|
289 for (y = 0; y < 8; y++) if (tmp[0][y] != 0) return CRYPT_FAIL_TESTVECTOR; |
|
|
290 } |
|
|
291 return CRYPT_OK; |
|
|
292 #endif |
|
|
293 } |
|
|
294 |
|
|
295 int rc2_keysize(int *keysize) |
|
|
296 { |
|
|
297 _ARGCHK(keysize != NULL); |
|
|
298 if (*keysize < 8) { |
|
|
299 return CRYPT_INVALID_KEYSIZE; |
|
|
300 } else if (*keysize > 128) { |
|
|
301 *keysize = 128; |
|
|
302 } |
|
|
303 return CRYPT_OK; |
|
|
304 } |
|
|
305 |
|
|
306 #endif |
|
|
307 |
|
|
308 |
|
|
309 |
