|
3
|
1 /* LibTomCrypt, modular cryptographic library -- Tom St Denis |
|
|
2 * |
|
|
3 * LibTomCrypt is a library that provides various cryptographic |
|
|
4 * algorithms in a highly modular and flexible manner. |
|
|
5 * |
|
|
6 * The library is free for all purposes without any express |
|
|
7 * guarantee it works. |
|
|
8 * |
|
|
9 * Tom St Denis, [email protected], http://libtomcrypt.org |
|
|
10 */ |
|
|
11 |
|
|
12 /* SAFER+ Implementation by Tom St Denis */ |
|
|
13 #include "mycrypt.h" |
|
|
14 |
|
|
15 #ifdef SAFERP |
|
|
16 |
|
|
17 const struct _cipher_descriptor saferp_desc = |
|
|
18 { |
|
|
19 "safer+", |
|
|
20 4, |
|
|
21 16, 32, 16, 8, |
|
|
22 &saferp_setup, |
|
|
23 &saferp_ecb_encrypt, |
|
|
24 &saferp_ecb_decrypt, |
|
|
25 &saferp_test, |
|
|
26 &saferp_keysize |
|
|
27 }; |
|
|
28 |
|
|
29 /* ROUND(b,i) |
|
|
30 * |
|
|
31 * This is one forward key application. Note the basic form is |
|
|
32 * key addition, substitution, key addition. The safer_ebox and safer_lbox |
|
|
33 * are the exponentiation box and logarithm boxes respectively. |
|
|
34 * The value of 'i' is the current round number which allows this |
|
|
35 * function to be unrolled massively. Most of SAFER+'s speed |
|
|
36 * comes from not having to compute indirect accesses into the |
|
|
37 * array of 16 bytes b[0..15] which is the block of data |
|
|
38 */ |
|
|
39 |
|
|
40 extern const unsigned char safer_ebox[], safer_lbox[]; |
|
|
41 |
|
|
42 #define ROUND(b, i) \ |
|
|
43 b[0] = (safer_ebox[(b[0] ^ skey->saferp.K[i][0]) & 255] + skey->saferp.K[i+1][0]) & 255; \ |
|
|
44 b[1] = safer_lbox[(b[1] + skey->saferp.K[i][1]) & 255] ^ skey->saferp.K[i+1][1]; \ |
|
|
45 b[2] = safer_lbox[(b[2] + skey->saferp.K[i][2]) & 255] ^ skey->saferp.K[i+1][2]; \ |
|
|
46 b[3] = (safer_ebox[(b[3] ^ skey->saferp.K[i][3]) & 255] + skey->saferp.K[i+1][3]) & 255; \ |
|
|
47 b[4] = (safer_ebox[(b[4] ^ skey->saferp.K[i][4]) & 255] + skey->saferp.K[i+1][4]) & 255; \ |
|
|
48 b[5] = safer_lbox[(b[5] + skey->saferp.K[i][5]) & 255] ^ skey->saferp.K[i+1][5]; \ |
|
|
49 b[6] = safer_lbox[(b[6] + skey->saferp.K[i][6]) & 255] ^ skey->saferp.K[i+1][6]; \ |
|
|
50 b[7] = (safer_ebox[(b[7] ^ skey->saferp.K[i][7]) & 255] + skey->saferp.K[i+1][7]) & 255; \ |
|
|
51 b[8] = (safer_ebox[(b[8] ^ skey->saferp.K[i][8]) & 255] + skey->saferp.K[i+1][8]) & 255; \ |
|
|
52 b[9] = safer_lbox[(b[9] + skey->saferp.K[i][9]) & 255] ^ skey->saferp.K[i+1][9]; \ |
|
|
53 b[10] = safer_lbox[(b[10] + skey->saferp.K[i][10]) & 255] ^ skey->saferp.K[i+1][10]; \ |
|
|
54 b[11] = (safer_ebox[(b[11] ^ skey->saferp.K[i][11]) & 255] + skey->saferp.K[i+1][11]) & 255; \ |
|
|
55 b[12] = (safer_ebox[(b[12] ^ skey->saferp.K[i][12]) & 255] + skey->saferp.K[i+1][12]) & 255; \ |
|
|
56 b[13] = safer_lbox[(b[13] + skey->saferp.K[i][13]) & 255] ^ skey->saferp.K[i+1][13]; \ |
|
|
57 b[14] = safer_lbox[(b[14] + skey->saferp.K[i][14]) & 255] ^ skey->saferp.K[i+1][14]; \ |
|
|
58 b[15] = (safer_ebox[(b[15] ^ skey->saferp.K[i][15]) & 255] + skey->saferp.K[i+1][15]) & 255; |
|
|
59 |
|
|
60 /* This is one inverse key application */ |
|
|
61 #define iROUND(b, i) \ |
|
|
62 b[0] = safer_lbox[(b[0] - skey->saferp.K[i+1][0]) & 255] ^ skey->saferp.K[i][0]; \ |
|
|
63 b[1] = (safer_ebox[(b[1] ^ skey->saferp.K[i+1][1]) & 255] - skey->saferp.K[i][1]) & 255; \ |
|
|
64 b[2] = (safer_ebox[(b[2] ^ skey->saferp.K[i+1][2]) & 255] - skey->saferp.K[i][2]) & 255; \ |
|
|
65 b[3] = safer_lbox[(b[3] - skey->saferp.K[i+1][3]) & 255] ^ skey->saferp.K[i][3]; \ |
|
|
66 b[4] = safer_lbox[(b[4] - skey->saferp.K[i+1][4]) & 255] ^ skey->saferp.K[i][4]; \ |
|
|
67 b[5] = (safer_ebox[(b[5] ^ skey->saferp.K[i+1][5]) & 255] - skey->saferp.K[i][5]) & 255; \ |
|
|
68 b[6] = (safer_ebox[(b[6] ^ skey->saferp.K[i+1][6]) & 255] - skey->saferp.K[i][6]) & 255; \ |
|
|
69 b[7] = safer_lbox[(b[7] - skey->saferp.K[i+1][7]) & 255] ^ skey->saferp.K[i][7]; \ |
|
|
70 b[8] = safer_lbox[(b[8] - skey->saferp.K[i+1][8]) & 255] ^ skey->saferp.K[i][8]; \ |
|
|
71 b[9] = (safer_ebox[(b[9] ^ skey->saferp.K[i+1][9]) & 255] - skey->saferp.K[i][9]) & 255; \ |
|
|
72 b[10] = (safer_ebox[(b[10] ^ skey->saferp.K[i+1][10]) & 255] - skey->saferp.K[i][10]) & 255; \ |
|
|
73 b[11] = safer_lbox[(b[11] - skey->saferp.K[i+1][11]) & 255] ^ skey->saferp.K[i][11]; \ |
|
|
74 b[12] = safer_lbox[(b[12] - skey->saferp.K[i+1][12]) & 255] ^ skey->saferp.K[i][12]; \ |
|
|
75 b[13] = (safer_ebox[(b[13] ^ skey->saferp.K[i+1][13]) & 255] - skey->saferp.K[i][13]) & 255; \ |
|
|
76 b[14] = (safer_ebox[(b[14] ^ skey->saferp.K[i+1][14]) & 255] - skey->saferp.K[i][14]) & 255; \ |
|
|
77 b[15] = safer_lbox[(b[15] - skey->saferp.K[i+1][15]) & 255] ^ skey->saferp.K[i][15]; |
|
|
78 |
|
|
79 /* This is a forward single layer PHT transform. */ |
|
|
80 #define PHT(b) \ |
|
|
81 b[0] = (b[0] + (b[1] = (b[0] + b[1]) & 255)) & 255; \ |
|
|
82 b[2] = (b[2] + (b[3] = (b[3] + b[2]) & 255)) & 255; \ |
|
|
83 b[4] = (b[4] + (b[5] = (b[5] + b[4]) & 255)) & 255; \ |
|
|
84 b[6] = (b[6] + (b[7] = (b[7] + b[6]) & 255)) & 255; \ |
|
|
85 b[8] = (b[8] + (b[9] = (b[9] + b[8]) & 255)) & 255; \ |
|
|
86 b[10] = (b[10] + (b[11] = (b[11] + b[10]) & 255)) & 255; \ |
|
|
87 b[12] = (b[12] + (b[13] = (b[13] + b[12]) & 255)) & 255; \ |
|
|
88 b[14] = (b[14] + (b[15] = (b[15] + b[14]) & 255)) & 255; |
|
|
89 |
|
|
90 /* This is an inverse single layer PHT transform */ |
|
|
91 #define iPHT(b) \ |
|
|
92 b[15] = (b[15] - (b[14] = (b[14] - b[15]) & 255)) & 255; \ |
|
|
93 b[13] = (b[13] - (b[12] = (b[12] - b[13]) & 255)) & 255; \ |
|
|
94 b[11] = (b[11] - (b[10] = (b[10] - b[11]) & 255)) & 255; \ |
|
|
95 b[9] = (b[9] - (b[8] = (b[8] - b[9]) & 255)) & 255; \ |
|
|
96 b[7] = (b[7] - (b[6] = (b[6] - b[7]) & 255)) & 255; \ |
|
|
97 b[5] = (b[5] - (b[4] = (b[4] - b[5]) & 255)) & 255; \ |
|
|
98 b[3] = (b[3] - (b[2] = (b[2] - b[3]) & 255)) & 255; \ |
|
|
99 b[1] = (b[1] - (b[0] = (b[0] - b[1]) & 255)) & 255; \ |
|
|
100 |
|
|
101 /* This is the "Armenian" Shuffle. It takes the input from b and stores it in b2 */ |
|
|
102 #define SHUF(b, b2) \ |
|
|
103 b2[0] = b[8]; b2[1] = b[11]; b2[2] = b[12]; b2[3] = b[15]; \ |
|
|
104 b2[4] = b[2]; b2[5] = b[1]; b2[6] = b[6]; b2[7] = b[5]; \ |
|
|
105 b2[8] = b[10]; b2[9] = b[9]; b2[10] = b[14]; b2[11] = b[13]; \ |
|
|
106 b2[12] = b[0]; b2[13] = b[7]; b2[14] = b[4]; b2[15] = b[3]; |
|
|
107 |
|
|
108 /* This is the inverse shuffle. It takes from b and gives to b2 */ |
|
|
109 #define iSHUF(b, b2) \ |
|
|
110 b2[0] = b[12]; b2[1] = b[5]; b2[2] = b[4]; b2[3] = b[15]; \ |
|
|
111 b2[4] = b[14]; b2[5] = b[7]; b2[6] = b[6]; b2[7] = b[13]; \ |
|
|
112 b2[8] = b[0]; b2[9] = b[9]; b2[10] = b[8]; b2[11] = b[1]; \ |
|
|
113 b2[12] = b[2]; b2[13] = b[11]; b2[14] = b[10]; b2[15] = b[3]; |
|
|
114 |
|
|
115 /* The complete forward Linear Transform layer. |
|
|
116 * Note that alternating usage of b and b2. |
|
|
117 * Each round of LT starts in 'b' and ends in 'b2'. |
|
|
118 */ |
|
|
119 #define LT(b, b2) \ |
|
|
120 PHT(b); SHUF(b, b2); \ |
|
|
121 PHT(b2); SHUF(b2, b); \ |
|
|
122 PHT(b); SHUF(b, b2); \ |
|
|
123 PHT(b2); |
|
|
124 |
|
|
125 /* This is the inverse linear transform layer. */ |
|
|
126 #define iLT(b, b2) \ |
|
|
127 iPHT(b); \ |
|
|
128 iSHUF(b, b2); iPHT(b2); \ |
|
|
129 iSHUF(b2, b); iPHT(b); \ |
|
|
130 iSHUF(b, b2); iPHT(b2); |
|
|
131 |
|
|
132 #ifdef SMALL_CODE |
|
|
133 |
|
|
134 static void _round(unsigned char *b, int i, symmetric_key *skey) |
|
|
135 { |
|
|
136 ROUND(b, i); |
|
|
137 } |
|
|
138 |
|
|
139 static void _iround(unsigned char *b, int i, symmetric_key *skey) |
|
|
140 { |
|
|
141 iROUND(b, i); |
|
|
142 } |
|
|
143 |
|
|
144 static void _lt(unsigned char *b, unsigned char *b2) |
|
|
145 { |
|
|
146 LT(b, b2); |
|
|
147 } |
|
|
148 |
|
|
149 static void _ilt(unsigned char *b, unsigned char *b2) |
|
|
150 { |
|
|
151 iLT(b, b2); |
|
|
152 } |
|
|
153 |
|
|
154 #undef ROUND |
|
|
155 #define ROUND(b, i) _round(b, i, skey) |
|
|
156 |
|
|
157 #undef iROUND |
|
|
158 #define iROUND(b, i) _iround(b, i, skey) |
|
|
159 |
|
|
160 #undef LT |
|
|
161 #define LT(b, b2) _lt(b, b2) |
|
|
162 |
|
|
163 #undef iLT |
|
|
164 #define iLT(b, b2) _ilt(b, b2) |
|
|
165 |
|
|
166 #endif |
|
|
167 |
|
|
168 /* These are the 33, 128-bit bias words for the key schedule */ |
|
|
169 static const unsigned char safer_bias[33][16] = { |
|
|
170 { 70, 151, 177, 186, 163, 183, 16, 10, 197, 55, 179, 201, 90, 40, 172, 100}, |
|
|
171 { 236, 171, 170, 198, 103, 149, 88, 13, 248, 154, 246, 110, 102, 220, 5, 61}, |
|
|
172 { 138, 195, 216, 137, 106, 233, 54, 73, 67, 191, 235, 212, 150, 155, 104, 160}, |
|
|
173 { 93, 87, 146, 31, 213, 113, 92, 187, 34, 193, 190, 123, 188, 153, 99, 148}, |
|
|
174 { 42, 97, 184, 52, 50, 25, 253, 251, 23, 64, 230, 81, 29, 65, 68, 143}, |
|
|
175 { 221, 4, 128, 222, 231, 49, 214, 127, 1, 162, 247, 57, 218, 111, 35, 202}, |
|
|
176 { 58, 208, 28, 209, 48, 62, 18, 161, 205, 15, 224, 168, 175, 130, 89, 44}, |
|
|
177 { 125, 173, 178, 239, 194, 135, 206, 117, 6, 19, 2, 144, 79, 46, 114, 51}, |
|
|
178 { 192, 141, 207, 169, 129, 226, 196, 39, 47, 108, 122, 159, 82, 225, 21, 56}, |
|
|
179 { 252, 32, 66, 199, 8, 228, 9, 85, 94, 140, 20, 118, 96, 255, 223, 215}, |
|
|
180 { 250, 11, 33, 0, 26, 249, 166, 185, 232, 158, 98, 76, 217, 145, 80, 210}, |
|
|
181 { 24, 180, 7, 132, 234, 91, 164, 200, 14, 203, 72, 105, 75, 78, 156, 53}, |
|
|
182 { 69, 77, 84, 229, 37, 60, 12, 74, 139, 63, 204, 167, 219, 107, 174, 244}, |
|
|
183 { 45, 243, 124, 109, 157, 181, 38, 116, 242, 147, 83, 176, 240, 17, 237, 131}, |
|
|
184 { 182, 3, 22, 115, 59, 30, 142, 112, 189, 134, 27, 71, 126, 36, 86, 241}, |
|
|
185 { 136, 70, 151, 177, 186, 163, 183, 16, 10, 197, 55, 179, 201, 90, 40, 172}, |
|
|
186 { 220, 134, 119, 215, 166, 17, 251, 244, 186, 146, 145, 100, 131, 241, 51, 239}, |
|
|
187 { 44, 181, 178, 43, 136, 209, 153, 203, 140, 132, 29, 20, 129, 151, 113, 202}, |
|
|
188 { 163, 139, 87, 60, 130, 196, 82, 92, 28, 232, 160, 4, 180, 133, 74, 246}, |
|
|
189 { 84, 182, 223, 12, 26, 142, 222, 224, 57, 252, 32, 155, 36, 78, 169, 152}, |
|
|
190 { 171, 242, 96, 208, 108, 234, 250, 199, 217, 0, 212, 31, 110, 67, 188, 236}, |
|
|
191 { 137, 254, 122, 93, 73, 201, 50, 194, 249, 154, 248, 109, 22, 219, 89, 150}, |
|
|
192 { 233, 205, 230, 70, 66, 143, 10, 193, 204, 185, 101, 176, 210, 198, 172, 30}, |
|
|
193 { 98, 41, 46, 14, 116, 80, 2, 90, 195, 37, 123, 138, 42, 91, 240, 6}, |
|
|
194 { 71, 111, 112, 157, 126, 16, 206, 18, 39, 213, 76, 79, 214, 121, 48, 104}, |
|
|
195 { 117, 125, 228, 237, 128, 106, 144, 55, 162, 94, 118, 170, 197, 127, 61, 175}, |
|
|
196 { 229, 25, 97, 253, 77, 124, 183, 11, 238, 173, 75, 34, 245, 231, 115, 35}, |
|
|
197 { 200, 5, 225, 102, 221, 179, 88, 105, 99, 86, 15, 161, 49, 149, 23, 7}, |
|
|
198 { 40, 1, 45, 226, 147, 190, 69, 21, 174, 120, 3, 135, 164, 184, 56, 207}, |
|
|
199 { 8, 103, 9, 148, 235, 38, 168, 107, 189, 24, 52, 27, 187, 191, 114, 247}, |
|
|
200 { 53, 72, 156, 81, 47, 59, 85, 227, 192, 159, 216, 211, 243, 141, 177, 255}, |
|
|
201 { 62, 220, 134, 119, 215, 166, 17, 251, 244, 186, 146, 145, 100, 131, 241, 51}}; |
|
|
202 |
|
|
203 int saferp_setup(const unsigned char *key, int keylen, int num_rounds, symmetric_key *skey) |
|
|
204 { |
|
|
205 unsigned x, y, z; |
|
|
206 unsigned char t[33]; |
|
|
207 static const int rounds[3] = { 8, 12, 16 }; |
|
|
208 |
|
|
209 _ARGCHK(key != NULL); |
|
|
210 _ARGCHK(skey != NULL); |
|
|
211 |
|
|
212 /* check arguments */ |
|
|
213 if (keylen != 16 && keylen != 24 && keylen != 32) { |
|
|
214 return CRYPT_INVALID_KEYSIZE; |
|
|
215 } |
|
|
216 |
|
|
217 /* Is the number of rounds valid? Either use zero for default or |
|
|
218 * 8,12,16 rounds for 16,24,32 byte keys |
|
|
219 */ |
|
|
220 if (num_rounds != 0 && num_rounds != rounds[(keylen/8)-2]) { |
|
|
221 return CRYPT_INVALID_ROUNDS; |
|
|
222 } |
|
|
223 |
|
|
224 /* 128 bit key version */ |
|
|
225 if (keylen == 16) { |
|
|
226 /* copy key into t */ |
|
|
227 for (x = y = 0; x < 16; x++) { |
|
|
228 t[x] = key[x]; |
|
|
229 y ^= key[x]; |
|
|
230 } |
|
|
231 t[16] = y; |
|
|
232 |
|
|
233 /* make round keys */ |
|
|
234 for (x = 0; x < 16; x++) { |
|
|
235 skey->saferp.K[0][x] = t[x]; |
|
|
236 } |
|
|
237 |
|
|
238 /* make the 16 other keys as a transformation of the first key */ |
|
|
239 for (x = 1; x < 17; x++) { |
|
|
240 /* rotate 3 bits each */ |
|
|
241 for (y = 0; y < 17; y++) { |
|
|
242 t[y] = ((t[y]<<3)|(t[y]>>5)) & 255; |
|
|
243 } |
|
|
244 |
|
|
245 /* select and add */ |
|
|
246 z = x; |
|
|
247 for (y = 0; y < 16; y++) { |
|
|
248 skey->saferp.K[x][y] = (t[z] + safer_bias[x-1][y]) & 255; |
|
|
249 if (++z == 17) { z = 0; } |
|
|
250 } |
|
|
251 } |
|
|
252 skey->saferp.rounds = 8; |
|
|
253 } else if (keylen == 24) { |
|
|
254 /* copy key into t */ |
|
|
255 for (x = y = 0; x < 24; x++) { |
|
|
256 t[x] = key[x]; |
|
|
257 y ^= key[x]; |
|
|
258 } |
|
|
259 t[24] = y; |
|
|
260 |
|
|
261 /* make round keys */ |
|
|
262 for (x = 0; x < 16; x++) { |
|
|
263 skey->saferp.K[0][x] = t[x]; |
|
|
264 } |
|
|
265 |
|
|
266 for (x = 1; x < 25; x++) { |
|
|
267 /* rotate 3 bits each */ |
|
|
268 for (y = 0; y < 25; y++) { |
|
|
269 t[y] = ((t[y]<<3)|(t[y]>>5)) & 255; |
|
|
270 } |
|
|
271 |
|
|
272 /* select and add */ |
|
|
273 z = x; |
|
|
274 for (y = 0; y < 16; y++) { |
|
|
275 skey->saferp.K[x][y] = (t[z] + safer_bias[x-1][y]) & 255; |
|
|
276 if (++z == 25) { z = 0; } |
|
|
277 } |
|
|
278 } |
|
|
279 skey->saferp.rounds = 12; |
|
|
280 } else { |
|
|
281 /* copy key into t */ |
|
|
282 for (x = y = 0; x < 32; x++) { |
|
|
283 t[x] = key[x]; |
|
|
284 y ^= key[x]; |
|
|
285 } |
|
|
286 t[32] = y; |
|
|
287 |
|
|
288 /* make round keys */ |
|
|
289 for (x = 0; x < 16; x++) { |
|
|
290 skey->saferp.K[0][x] = t[x]; |
|
|
291 } |
|
|
292 |
|
|
293 for (x = 1; x < 33; x++) { |
|
|
294 /* rotate 3 bits each */ |
|
|
295 for (y = 0; y < 33; y++) { |
|
|
296 t[y] = ((t[y]<<3)|(t[y]>>5)) & 255; |
|
|
297 } |
|
|
298 |
|
|
299 /* select and add */ |
|
|
300 z = x; |
|
|
301 for (y = 0; y < 16; y++) { |
|
|
302 skey->saferp.K[x][y] = (t[z] + safer_bias[x-1][y]) & 255; |
|
|
303 if (++z == 33) { z = 0; } |
|
|
304 } |
|
|
305 } |
|
|
306 skey->saferp.rounds = 16; |
|
|
307 } |
|
|
308 #ifdef CLEAN_STACK |
|
|
309 zeromem(t, sizeof(t)); |
|
|
310 #endif |
|
|
311 return CRYPT_OK; |
|
|
312 } |
|
|
313 |
|
|
314 void saferp_ecb_encrypt(const unsigned char *pt, unsigned char *ct, symmetric_key *skey) |
|
|
315 { |
|
|
316 unsigned char b[16]; |
|
|
317 int x; |
|
|
318 |
|
|
319 _ARGCHK(pt != NULL); |
|
|
320 _ARGCHK(ct != NULL); |
|
|
321 _ARGCHK(skey != NULL); |
|
|
322 |
|
|
323 /* do eight rounds */ |
|
|
324 for (x = 0; x < 16; x++) { |
|
|
325 b[x] = pt[x]; |
|
|
326 } |
|
|
327 ROUND(b, 0); LT(b, ct); |
|
|
328 ROUND(ct, 2); LT(ct, b); |
|
|
329 ROUND(b, 4); LT(b, ct); |
|
|
330 ROUND(ct, 6); LT(ct, b); |
|
|
331 ROUND(b, 8); LT(b, ct); |
|
|
332 ROUND(ct, 10); LT(ct, b); |
|
|
333 ROUND(b, 12); LT(b, ct); |
|
|
334 ROUND(ct, 14); LT(ct, b); |
|
|
335 /* 192-bit key? */ |
|
|
336 if (skey->saferp.rounds > 8) { |
|
|
337 ROUND(b, 16); LT(b, ct); |
|
|
338 ROUND(ct, 18); LT(ct, b); |
|
|
339 ROUND(b, 20); LT(b, ct); |
|
|
340 ROUND(ct, 22); LT(ct, b); |
|
|
341 } |
|
|
342 /* 256-bit key? */ |
|
|
343 if (skey->saferp.rounds > 12) { |
|
|
344 ROUND(b, 24); LT(b, ct); |
|
|
345 ROUND(ct, 26); LT(ct, b); |
|
|
346 ROUND(b, 28); LT(b, ct); |
|
|
347 ROUND(ct, 30); LT(ct, b); |
|
|
348 } |
|
|
349 ct[0] = b[0] ^ skey->saferp.K[skey->saferp.rounds*2][0]; |
|
|
350 ct[1] = (b[1] + skey->saferp.K[skey->saferp.rounds*2][1]) & 255; |
|
|
351 ct[2] = (b[2] + skey->saferp.K[skey->saferp.rounds*2][2]) & 255; |
|
|
352 ct[3] = b[3] ^ skey->saferp.K[skey->saferp.rounds*2][3]; |
|
|
353 ct[4] = b[4] ^ skey->saferp.K[skey->saferp.rounds*2][4]; |
|
|
354 ct[5] = (b[5] + skey->saferp.K[skey->saferp.rounds*2][5]) & 255; |
|
|
355 ct[6] = (b[6] + skey->saferp.K[skey->saferp.rounds*2][6]) & 255; |
|
|
356 ct[7] = b[7] ^ skey->saferp.K[skey->saferp.rounds*2][7]; |
|
|
357 ct[8] = b[8] ^ skey->saferp.K[skey->saferp.rounds*2][8]; |
|
|
358 ct[9] = (b[9] + skey->saferp.K[skey->saferp.rounds*2][9]) & 255; |
|
|
359 ct[10] = (b[10] + skey->saferp.K[skey->saferp.rounds*2][10]) & 255; |
|
|
360 ct[11] = b[11] ^ skey->saferp.K[skey->saferp.rounds*2][11]; |
|
|
361 ct[12] = b[12] ^ skey->saferp.K[skey->saferp.rounds*2][12]; |
|
|
362 ct[13] = (b[13] + skey->saferp.K[skey->saferp.rounds*2][13]) & 255; |
|
|
363 ct[14] = (b[14] + skey->saferp.K[skey->saferp.rounds*2][14]) & 255; |
|
|
364 ct[15] = b[15] ^ skey->saferp.K[skey->saferp.rounds*2][15]; |
|
|
365 #ifdef CLEAN_STACK |
|
|
366 zeromem(b, sizeof(b)); |
|
|
367 #endif |
|
|
368 } |
|
|
369 |
|
|
370 void saferp_ecb_decrypt(const unsigned char *ct, unsigned char *pt, symmetric_key *skey) |
|
|
371 { |
|
|
372 unsigned char b[16]; |
|
|
373 int x; |
|
|
374 |
|
|
375 _ARGCHK(pt != NULL); |
|
|
376 _ARGCHK(ct != NULL); |
|
|
377 _ARGCHK(skey != NULL); |
|
|
378 |
|
|
379 /* do eight rounds */ |
|
|
380 b[0] = ct[0] ^ skey->saferp.K[skey->saferp.rounds*2][0]; |
|
|
381 b[1] = (ct[1] - skey->saferp.K[skey->saferp.rounds*2][1]) & 255; |
|
|
382 b[2] = (ct[2] - skey->saferp.K[skey->saferp.rounds*2][2]) & 255; |
|
|
383 b[3] = ct[3] ^ skey->saferp.K[skey->saferp.rounds*2][3]; |
|
|
384 b[4] = ct[4] ^ skey->saferp.K[skey->saferp.rounds*2][4]; |
|
|
385 b[5] = (ct[5] - skey->saferp.K[skey->saferp.rounds*2][5]) & 255; |
|
|
386 b[6] = (ct[6] - skey->saferp.K[skey->saferp.rounds*2][6]) & 255; |
|
|
387 b[7] = ct[7] ^ skey->saferp.K[skey->saferp.rounds*2][7]; |
|
|
388 b[8] = ct[8] ^ skey->saferp.K[skey->saferp.rounds*2][8]; |
|
|
389 b[9] = (ct[9] - skey->saferp.K[skey->saferp.rounds*2][9]) & 255; |
|
|
390 b[10] = (ct[10] - skey->saferp.K[skey->saferp.rounds*2][10]) & 255; |
|
|
391 b[11] = ct[11] ^ skey->saferp.K[skey->saferp.rounds*2][11]; |
|
|
392 b[12] = ct[12] ^ skey->saferp.K[skey->saferp.rounds*2][12]; |
|
|
393 b[13] = (ct[13] - skey->saferp.K[skey->saferp.rounds*2][13]) & 255; |
|
|
394 b[14] = (ct[14] - skey->saferp.K[skey->saferp.rounds*2][14]) & 255; |
|
|
395 b[15] = ct[15] ^ skey->saferp.K[skey->saferp.rounds*2][15]; |
|
|
396 /* 256-bit key? */ |
|
|
397 if (skey->saferp.rounds > 12) { |
|
|
398 iLT(b, pt); iROUND(pt, 30); |
|
|
399 iLT(pt, b); iROUND(b, 28); |
|
|
400 iLT(b, pt); iROUND(pt, 26); |
|
|
401 iLT(pt, b); iROUND(b, 24); |
|
|
402 } |
|
|
403 /* 192-bit key? */ |
|
|
404 if (skey->saferp.rounds > 8) { |
|
|
405 iLT(b, pt); iROUND(pt, 22); |
|
|
406 iLT(pt, b); iROUND(b, 20); |
|
|
407 iLT(b, pt); iROUND(pt, 18); |
|
|
408 iLT(pt, b); iROUND(b, 16); |
|
|
409 } |
|
|
410 iLT(b, pt); iROUND(pt, 14); |
|
|
411 iLT(pt, b); iROUND(b, 12); |
|
|
412 iLT(b, pt); iROUND(pt,10); |
|
|
413 iLT(pt, b); iROUND(b, 8); |
|
|
414 iLT(b, pt); iROUND(pt,6); |
|
|
415 iLT(pt, b); iROUND(b, 4); |
|
|
416 iLT(b, pt); iROUND(pt,2); |
|
|
417 iLT(pt, b); iROUND(b, 0); |
|
|
418 for (x = 0; x < 16; x++) { |
|
|
419 pt[x] = b[x]; |
|
|
420 } |
|
|
421 #ifdef CLEAN_STACK |
|
|
422 zeromem(b, sizeof(b)); |
|
|
423 #endif |
|
|
424 } |
|
|
425 |
|
|
426 int saferp_test(void) |
|
|
427 { |
|
|
428 #ifndef LTC_TEST |
|
|
429 return CRYPT_NOP; |
|
|
430 #else |
|
|
431 static const struct { |
|
|
432 int keylen; |
|
|
433 unsigned char key[32], pt[16], ct[16]; |
|
|
434 } tests[] = { |
|
|
435 { |
|
|
436 16, |
|
|
437 { 41, 35, 190, 132, 225, 108, 214, 174, |
|
|
438 82, 144, 73, 241, 241, 187, 233, 235 }, |
|
|
439 { 179, 166, 219, 60, 135, 12, 62, 153, |
|
|
440 36, 94, 13, 28, 6, 183, 71, 222 }, |
|
|
441 { 224, 31, 182, 10, 12, 255, 84, 70, |
|
|
442 127, 13, 89, 249, 9, 57, 165, 220 } |
|
|
443 }, { |
|
|
444 24, |
|
|
445 { 72, 211, 143, 117, 230, 217, 29, 42, |
|
|
446 229, 192, 247, 43, 120, 129, 135, 68, |
|
|
447 14, 95, 80, 0, 212, 97, 141, 190 }, |
|
|
448 { 123, 5, 21, 7, 59, 51, 130, 31, |
|
|
449 24, 112, 146, 218, 100, 84, 206, 177 }, |
|
|
450 { 92, 136, 4, 63, 57, 95, 100, 0, |
|
|
451 150, 130, 130, 16, 193, 111, 219, 133 } |
|
|
452 }, { |
|
|
453 32, |
|
|
454 { 243, 168, 141, 254, 190, 242, 235, 113, |
|
|
455 255, 160, 208, 59, 117, 6, 140, 126, |
|
|
456 135, 120, 115, 77, 208, 190, 130, 190, |
|
|
457 219, 194, 70, 65, 43, 140, 250, 48 }, |
|
|
458 { 127, 112, 240, 167, 84, 134, 50, 149, |
|
|
459 170, 91, 104, 19, 11, 230, 252, 245 }, |
|
|
460 { 88, 11, 25, 36, 172, 229, 202, 213, |
|
|
461 170, 65, 105, 153, 220, 104, 153, 138 } |
|
|
462 } |
|
|
463 }; |
|
|
464 |
|
|
465 unsigned char tmp[2][16]; |
|
|
466 symmetric_key skey; |
|
|
467 int err, i, y; |
|
|
468 |
|
|
469 for (i = 0; i < (int)(sizeof(tests) / sizeof(tests[0])); i++) { |
|
|
470 if ((err = saferp_setup(tests[i].key, tests[i].keylen, 0, &skey)) != CRYPT_OK) { |
|
|
471 return err; |
|
|
472 } |
|
|
473 saferp_ecb_encrypt(tests[i].pt, tmp[0], &skey); |
|
|
474 saferp_ecb_decrypt(tmp[0], tmp[1], &skey); |
|
|
475 |
|
|
476 /* compare */ |
|
|
477 if (memcmp(tmp[0], tests[i].ct, 16) || memcmp(tmp[1], tests[i].pt, 16)) { |
|
|
478 return CRYPT_FAIL_TESTVECTOR; |
|
|
479 } |
|
|
480 |
|
|
481 /* now see if we can encrypt all zero bytes 1000 times, decrypt and come back where we started */ |
|
|
482 for (y = 0; y < 16; y++) tmp[0][y] = 0; |
|
|
483 for (y = 0; y < 1000; y++) saferp_ecb_encrypt(tmp[0], tmp[0], &skey); |
|
|
484 for (y = 0; y < 1000; y++) saferp_ecb_decrypt(tmp[0], tmp[0], &skey); |
|
|
485 for (y = 0; y < 16; y++) if (tmp[0][y] != 0) return CRYPT_FAIL_TESTVECTOR; |
|
|
486 } |
|
|
487 |
|
|
488 return CRYPT_OK; |
|
|
489 #endif |
|
|
490 } |
|
|
491 |
|
|
492 int saferp_keysize(int *desired_keysize) |
|
|
493 { |
|
|
494 _ARGCHK(desired_keysize != NULL); |
|
|
495 |
|
|
496 if (*desired_keysize < 16) |
|
|
497 return CRYPT_INVALID_KEYSIZE; |
|
|
498 if (*desired_keysize < 24) { |
|
|
499 *desired_keysize = 16; |
|
|
500 } else if (*desired_keysize < 32) { |
|
|
501 *desired_keysize = 24; |
|
|
502 } else { |
|
|
503 *desired_keysize = 32; |
|
|
504 } |
|
|
505 return CRYPT_OK; |
|
|
506 } |
|
|
507 |
|
|
508 #endif |
|
|
509 |
|
|
510 |
