Mercurial > dropbear

comparison libtomcrypt/src/ciphers/twofish/twofish.c @ 285:1b9e69c058d2

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
propagate from branch 'au.asn.ucc.matt.ltc.dropbear' (head 20dccfc09627970a312d77fb41dc2970b62689c3) to branch 'au.asn.ucc.matt.dropbear' (head fdf4a7a3b97ae5046139915de7e40399cceb2c01)
author Matt Johnston <matt@ucc.asn.au>
date Wed, 08 Mar 2006 13:23:58 +0000
parents
children 0cbe8f6dbf9e
comparison
equal deleted inserted replaced
281:997e6f7dc01e 285:1b9e69c058d2
1 /* LibTomCrypt, modular cryptographic library -- Tom St Denis
2 *
3 * LibTomCrypt is a library that provides various cryptographic
4 * algorithms in a highly modular and flexible manner.
5 *
6 * The library is free for all purposes without any express
7 * guarantee it works.
8 *
9 * Tom St Denis, [email protected], http://libtomcrypt.org
10 */
11
12 /**
13 @file twofish.c
14 Implementation of Twofish by Tom St Denis
15 */
16 #include "tomcrypt.h"
17
18 #ifdef TWOFISH
19
20 /* first TWOFISH_ALL_TABLES must ensure TWOFISH_TABLES is defined */
21 #ifdef TWOFISH_ALL_TABLES
22 #ifndef TWOFISH_TABLES
23 #define TWOFISH_TABLES
24 #endif
25 #endif
26
27 const struct ltc_cipher_descriptor twofish_desc =
28 {
29 "twofish",
30 7,
31 16, 32, 16, 16,
32 &twofish_setup,
33 &twofish_ecb_encrypt,
34 &twofish_ecb_decrypt,
35 &twofish_test,
36 &twofish_done,
37 &twofish_keysize,
38 NULL, NULL, NULL, NULL, NULL, NULL, NULL
39 };
40
41 /* the two polynomials */
42 #define MDS_POLY 0x169
43 #define RS_POLY 0x14D
44
45 /* The 4x4 MDS Linear Transform */
46 #if 0
47 static const unsigned char MDS[4][4] = {
48 { 0x01, 0xEF, 0x5B, 0x5B },
49 { 0x5B, 0xEF, 0xEF, 0x01 },
50 { 0xEF, 0x5B, 0x01, 0xEF },
51 { 0xEF, 0x01, 0xEF, 0x5B }
52 };
53 #endif
54
55 /* The 4x8 RS Linear Transform */
56 static const unsigned char RS[4][8] = {
57 { 0x01, 0xA4, 0x55, 0x87, 0x5A, 0x58, 0xDB, 0x9E },
58 { 0xA4, 0x56, 0x82, 0xF3, 0X1E, 0XC6, 0X68, 0XE5 },
59 { 0X02, 0XA1, 0XFC, 0XC1, 0X47, 0XAE, 0X3D, 0X19 },
60 { 0XA4, 0X55, 0X87, 0X5A, 0X58, 0XDB, 0X9E, 0X03 }
61 };
62
63 /* sbox usage orderings */
64 static const unsigned char qord[4][5] = {
65 { 1, 1, 0, 0, 1 },
66 { 0, 1, 1, 0, 0 },
67 { 0, 0, 0, 1, 1 },
68 { 1, 0, 1, 1, 0 }
69 };
70
71 #ifdef TWOFISH_TABLES
72
73 #include "twofish_tab.c"
74
75 #define sbox(i, x) ((ulong32)SBOX[i][(x)&255])
76
77 #else
78
79 /* The Q-box tables */
80 static const unsigned char qbox[2][4][16] = {
81 {
82 { 0x8, 0x1, 0x7, 0xD, 0x6, 0xF, 0x3, 0x2, 0x0, 0xB, 0x5, 0x9, 0xE, 0xC, 0xA, 0x4 },
83 { 0xE, 0XC, 0XB, 0X8, 0X1, 0X2, 0X3, 0X5, 0XF, 0X4, 0XA, 0X6, 0X7, 0X0, 0X9, 0XD },
84 { 0XB, 0XA, 0X5, 0XE, 0X6, 0XD, 0X9, 0X0, 0XC, 0X8, 0XF, 0X3, 0X2, 0X4, 0X7, 0X1 },
85 { 0XD, 0X7, 0XF, 0X4, 0X1, 0X2, 0X6, 0XE, 0X9, 0XB, 0X3, 0X0, 0X8, 0X5, 0XC, 0XA }
86 },
87 {
88 { 0X2, 0X8, 0XB, 0XD, 0XF, 0X7, 0X6, 0XE, 0X3, 0X1, 0X9, 0X4, 0X0, 0XA, 0XC, 0X5 },
89 { 0X1, 0XE, 0X2, 0XB, 0X4, 0XC, 0X3, 0X7, 0X6, 0XD, 0XA, 0X5, 0XF, 0X9, 0X0, 0X8 },
90 { 0X4, 0XC, 0X7, 0X5, 0X1, 0X6, 0X9, 0XA, 0X0, 0XE, 0XD, 0X8, 0X2, 0XB, 0X3, 0XF },
91 { 0xB, 0X9, 0X5, 0X1, 0XC, 0X3, 0XD, 0XE, 0X6, 0X4, 0X7, 0XF, 0X2, 0X0, 0X8, 0XA }
92 }
93 };
94
95 /* computes S_i[x] */
96 #ifdef LTC_CLEAN_STACK
97 static ulong32 _sbox(int i, ulong32 x)
98 #else
99 static ulong32 sbox(int i, ulong32 x)
100 #endif
101 {
102 unsigned char a0,b0,a1,b1,a2,b2,a3,b3,a4,b4,y;
103
104 /* a0,b0 = [x/16], x mod 16 */
105 a0 = (unsigned char)((x>>4)&15);
106 b0 = (unsigned char)((x)&15);
107
108 /* a1 = a0 ^ b0 */
109 a1 = a0 ^ b0;
110
111 /* b1 = a0 ^ ROR(b0, 1) ^ 8a0 */
112 b1 = (a0 ^ ((b0<<3)|(b0>>1)) ^ (a0<<3)) & 15;
113
114 /* a2,b2 = t0[a1], t1[b1] */
115 a2 = qbox[i][0][(int)a1];
116 b2 = qbox[i][1][(int)b1];
117
118 /* a3 = a2 ^ b2 */
119 a3 = a2 ^ b2;
120
121 /* b3 = a2 ^ ROR(b2, 1) ^ 8a2 */
122 b3 = (a2 ^ ((b2<<3)|(b2>>1)) ^ (a2<<3)) & 15;
123
124 /* a4,b4 = t2[a3], t3[b3] */
125 a4 = qbox[i][2][(int)a3];
126 b4 = qbox[i][3][(int)b3];
127
128 /* y = 16b4 + a4 */
129 y = (b4 << 4) + a4;
130
131 /* return result */
132 return (ulong32)y;
133 }
134
135 #ifdef LTC_CLEAN_STACK
136 static ulong32 sbox(int i, ulong32 x)
137 {
138 ulong32 y;
139 y = _sbox(i, x);
140 burn_stack(sizeof(unsigned char) * 11);
141 return y;
142 }
143 #endif /* LTC_CLEAN_STACK */
144
145 #endif /* TWOFISH_TABLES */
146
147 /* computes ab mod p */
148 static ulong32 gf_mult(ulong32 a, ulong32 b, ulong32 p)
149 {
150 ulong32 result, B[2], P[2];
151
152 P[1] = p;
153 B[1] = b;
154 result = P[0] = B[0] = 0;
155
156 /* unrolled branchless GF multiplier */
157 result ^= B[a&1]; a >>= 1; B[1] = P[B[1]>>7] ^ (B[1] << 1);
158 result ^= B[a&1]; a >>= 1; B[1] = P[B[1]>>7] ^ (B[1] << 1);
159 result ^= B[a&1]; a >>= 1; B[1] = P[B[1]>>7] ^ (B[1] << 1);
160 result ^= B[a&1]; a >>= 1; B[1] = P[B[1]>>7] ^ (B[1] << 1);
161 result ^= B[a&1]; a >>= 1; B[1] = P[B[1]>>7] ^ (B[1] << 1);
162 result ^= B[a&1]; a >>= 1; B[1] = P[B[1]>>7] ^ (B[1] << 1);
163 result ^= B[a&1]; a >>= 1; B[1] = P[B[1]>>7] ^ (B[1] << 1);
164 result ^= B[a&1];
165
166 return result;
167 }
168
169 /* computes [y0 y1 y2 y3] = MDS . [x0] */
170 #ifndef TWOFISH_TABLES
171 static ulong32 mds_column_mult(unsigned char in, int col)
172 {
173 ulong32 x01, x5B, xEF;
174
175 x01 = in;
176 x5B = gf_mult(in, 0x5B, MDS_POLY);
177 xEF = gf_mult(in, 0xEF, MDS_POLY);
178
179 switch (col) {
180 case 0:
181 return (x01 << 0 ) |
182 (x5B << 8 ) |
183 (xEF << 16) |
184 (xEF << 24);
185 case 1:
186 return (xEF << 0 ) |
187 (xEF << 8 ) |
188 (x5B << 16) |
189 (x01 << 24);
190 case 2:
191 return (x5B << 0 ) |
192 (xEF << 8 ) |
193 (x01 << 16) |
194 (xEF << 24);
195 case 3:
196 return (x5B << 0 ) |
197 (x01 << 8 ) |
198 (xEF << 16) |
199 (x5B << 24);
200 }
201 /* avoid warnings, we'd never get here normally but just to calm compiler warnings... */
202 return 0;
203 }
204
205 #else /* !TWOFISH_TABLES */
206
207 #define mds_column_mult(x, i) mds_tab[i][x]
208
209 #endif /* TWOFISH_TABLES */
210
211 /* Computes [y0 y1 y2 y3] = MDS . [x0 x1 x2 x3] */
212 static void mds_mult(const unsigned char *in, unsigned char *out)
213 {
214 int x;
215 ulong32 tmp;
216 for (tmp = x = 0; x < 4; x++) {
217 tmp ^= mds_column_mult(in[x], x);
218 }
219 STORE32L(tmp, out);
220 }
221
222 #ifdef TWOFISH_ALL_TABLES
223 /* computes [y0 y1 y2 y3] = RS . [x0 x1 x2 x3 x4 x5 x6 x7] */
224 static void rs_mult(const unsigned char *in, unsigned char *out)
225 {
226 ulong32 tmp;
227 tmp = rs_tab0[in[0]] ^ rs_tab1[in[1]] ^ rs_tab2[in[2]] ^ rs_tab3[in[3]] ^
228 rs_tab4[in[4]] ^ rs_tab5[in[5]] ^ rs_tab6[in[6]] ^ rs_tab7[in[7]];
229 STORE32L(tmp, out);
230 }
231
232 #else /* !TWOFISH_ALL_TABLES */
233
234 /* computes [y0 y1 y2 y3] = RS . [x0 x1 x2 x3 x4 x5 x6 x7] */
235 static void rs_mult(const unsigned char *in, unsigned char *out)
236 {
237 int x, y;
238 for (x = 0; x < 4; x++) {
239 out[x] = 0;
240 for (y = 0; y < 8; y++) {
241 out[x] ^= gf_mult(in[y], RS[x][y], RS_POLY);
242 }
243 }
244 }
245
246 #endif
247
248 /* computes h(x) */
249 static void h_func(const unsigned char *in, unsigned char *out, unsigned char *M, int k, int offset)
250 {
251 int x;
252 unsigned char y[4];
253 for (x = 0; x < 4; x++) {
254 y[x] = in[x];
255 }
256 switch (k) {
257 case 4:
258 y[0] = (unsigned char)(sbox(1, (ulong32)y[0]) ^ M[4 * (6 + offset) + 0]);
259 y[1] = (unsigned char)(sbox(0, (ulong32)y[1]) ^ M[4 * (6 + offset) + 1]);
260 y[2] = (unsigned char)(sbox(0, (ulong32)y[2]) ^ M[4 * (6 + offset) + 2]);
261 y[3] = (unsigned char)(sbox(1, (ulong32)y[3]) ^ M[4 * (6 + offset) + 3]);
262 case 3:
263 y[0] = (unsigned char)(sbox(1, (ulong32)y[0]) ^ M[4 * (4 + offset) + 0]);
264 y[1] = (unsigned char)(sbox(1, (ulong32)y[1]) ^ M[4 * (4 + offset) + 1]);
265 y[2] = (unsigned char)(sbox(0, (ulong32)y[2]) ^ M[4 * (4 + offset) + 2]);
266 y[3] = (unsigned char)(sbox(0, (ulong32)y[3]) ^ M[4 * (4 + offset) + 3]);
267 case 2:
268 y[0] = (unsigned char)(sbox(1, sbox(0, sbox(0, (ulong32)y[0]) ^ M[4 * (2 + offset) + 0]) ^ M[4 * (0 + offset) + 0]));
269 y[1] = (unsigned char)(sbox(0, sbox(0, sbox(1, (ulong32)y[1]) ^ M[4 * (2 + offset) + 1]) ^ M[4 * (0 + offset) + 1]));
270 y[2] = (unsigned char)(sbox(1, sbox(1, sbox(0, (ulong32)y[2]) ^ M[4 * (2 + offset) + 2]) ^ M[4 * (0 + offset) + 2]));
271 y[3] = (unsigned char)(sbox(0, sbox(1, sbox(1, (ulong32)y[3]) ^ M[4 * (2 + offset) + 3]) ^ M[4 * (0 + offset) + 3]));
272 }
273 mds_mult(y, out);
274 }
275
276 #ifndef TWOFISH_SMALL
277
278 /* for GCC we don't use pointer aliases */
279 #if defined(__GNUC__)
280 #define S1 skey->twofish.S[0]
281 #define S2 skey->twofish.S[1]
282 #define S3 skey->twofish.S[2]
283 #define S4 skey->twofish.S[3]
284 #endif
285
286 /* the G function */
287 #define g_func(x, dum) (S1[byte(x,0)] ^ S2[byte(x,1)] ^ S3[byte(x,2)] ^ S4[byte(x,3)])
288 #define g1_func(x, dum) (S2[byte(x,0)] ^ S3[byte(x,1)] ^ S4[byte(x,2)] ^ S1[byte(x,3)])
289
290 #else
291
292 #ifdef LTC_CLEAN_STACK
293 static ulong32 _g_func(ulong32 x, symmetric_key *key)
294 #else
295 static ulong32 g_func(ulong32 x, symmetric_key *key)
296 #endif
297 {
298 unsigned char g, i, y, z;
299 ulong32 res;
300
301 res = 0;
302 for (y = 0; y < 4; y++) {
303 z = key->twofish.start;
304
305 /* do unkeyed substitution */
306 g = sbox(qord[y][z++], (x >> (8*y)) & 255);
307
308 /* first subkey */
309 i = 0;
310
311 /* do key mixing+sbox until z==5 */
312 while (z != 5) {
313 g = g ^ key->twofish.S[4*i++ + y];
314 g = sbox(qord[y][z++], g);
315 }
316
317 /* multiply g by a column of the MDS */
318 res ^= mds_column_mult(g, y);
319 }
320 return res;
321 }
322
323 #define g1_func(x, key) g_func(ROLc(x, 8), key)
324
325 #ifdef LTC_CLEAN_STACK
326 static ulong32 g_func(ulong32 x, symmetric_key *key)
327 {
328 ulong32 y;
329 y = _g_func(x, key);
330 burn_stack(sizeof(unsigned char) * 4 + sizeof(ulong32));
331 return y;
332 }
333 #endif /* LTC_CLEAN_STACK */
334
335 #endif /* TWOFISH_SMALL */
336
337 /**
338 Initialize the Twofish block cipher
339 @param key The symmetric key you wish to pass
340 @param keylen The key length in bytes
341 @param num_rounds The number of rounds desired (0 for default)
342 @param skey The key in as scheduled by this function.
343 @return CRYPT_OK if successful
344 */
345 #ifdef LTC_CLEAN_STACK
346 static int _twofish_setup(const unsigned char *key, int keylen, int num_rounds, symmetric_key *skey)
347 #else
348 int twofish_setup(const unsigned char *key, int keylen, int num_rounds, symmetric_key *skey)
349 #endif
350 {
351 #ifndef TWOFISH_SMALL
352 unsigned char S[4*4], tmpx0, tmpx1;
353 #endif
354 int k, x, y;
355 unsigned char tmp[4], tmp2[4], M[8*4];
356 ulong32 A, B;
357
358 LTC_ARGCHK(key != NULL);
359 LTC_ARGCHK(skey != NULL);
360
361 /* invalid arguments? */
362 if (num_rounds != 16 && num_rounds != 0) {
363 return CRYPT_INVALID_ROUNDS;
364 }
365
366 if (keylen != 16 && keylen != 24 && keylen != 32) {
367 return CRYPT_INVALID_KEYSIZE;
368 }
369
370 /* k = keysize/64 [but since our keysize is in bytes...] */
371 k = keylen / 8;
372
373 /* copy the key into M */
374 for (x = 0; x < keylen; x++) {
375 M[x] = key[x] & 255;
376 }
377
378 /* create the S[..] words */
379 #ifndef TWOFISH_SMALL
380 for (x = 0; x < k; x++) {
381 rs_mult(M+(x*8), S+(x*4));
382 }
383 #else
384 for (x = 0; x < k; x++) {
385 rs_mult(M+(x*8), skey->twofish.S+(x*4));
386 }
387 #endif
388
389 /* make subkeys */
390 for (x = 0; x < 20; x++) {
391 /* A = h(p * 2x, Me) */
392 for (y = 0; y < 4; y++) {
393 tmp[y] = x+x;
394 }
395 h_func(tmp, tmp2, M, k, 0);
396 LOAD32L(A, tmp2);
397
398 /* B = ROL(h(p * (2x + 1), Mo), 8) */
399 for (y = 0; y < 4; y++) {
400 tmp[y] = (unsigned char)(x+x+1);
401 }
402 h_func(tmp, tmp2, M, k, 1);
403 LOAD32L(B, tmp2);
404 B = ROLc(B, 8);
405
406 /* K[2i] = A + B */
407 skey->twofish.K[x+x] = (A + B) & 0xFFFFFFFFUL;
408
409 /* K[2i+1] = (A + 2B) <<< 9 */
410 skey->twofish.K[x+x+1] = ROLc(B + B + A, 9);
411 }
412
413 #ifndef TWOFISH_SMALL
414 /* make the sboxes (large ram variant) */
415 if (k == 2) {
416 for (x = 0; x < 256; x++) {
417 tmpx0 = sbox(0, x);
418 tmpx1 = sbox(1, x);
419 skey->twofish.S[0][x] = mds_column_mult(sbox(1, (sbox(0, tmpx0 ^ S[0]) ^ S[4])),0);
420 skey->twofish.S[1][x] = mds_column_mult(sbox(0, (sbox(0, tmpx1 ^ S[1]) ^ S[5])),1);
421 skey->twofish.S[2][x] = mds_column_mult(sbox(1, (sbox(1, tmpx0 ^ S[2]) ^ S[6])),2);
422 skey->twofish.S[3][x] = mds_column_mult(sbox(0, (sbox(1, tmpx1 ^ S[3]) ^ S[7])),3);
423 }
424 } else if (k == 3) {
425 for (x = 0; x < 256; x++) {
426 tmpx0 = sbox(0, x);
427 tmpx1 = sbox(1, x);
428 skey->twofish.S[0][x] = mds_column_mult(sbox(1, (sbox(0, sbox(0, tmpx1 ^ S[0]) ^ S[4]) ^ S[8])),0);
429 skey->twofish.S[1][x] = mds_column_mult(sbox(0, (sbox(0, sbox(1, tmpx1 ^ S[1]) ^ S[5]) ^ S[9])),1);
430 skey->twofish.S[2][x] = mds_column_mult(sbox(1, (sbox(1, sbox(0, tmpx0 ^ S[2]) ^ S[6]) ^ S[10])),2);
431 skey->twofish.S[3][x] = mds_column_mult(sbox(0, (sbox(1, sbox(1, tmpx0 ^ S[3]) ^ S[7]) ^ S[11])),3);
432 }
433 } else {
434 for (x = 0; x < 256; x++) {
435 tmpx0 = sbox(0, x);
436 tmpx1 = sbox(1, x);
437 skey->twofish.S[0][x] = mds_column_mult(sbox(1, (sbox(0, sbox(0, sbox(1, tmpx1 ^ S[0]) ^ S[4]) ^ S[8]) ^ S[12])),0);
438 skey->twofish.S[1][x] = mds_column_mult(sbox(0, (sbox(0, sbox(1, sbox(1, tmpx0 ^ S[1]) ^ S[5]) ^ S[9]) ^ S[13])),1);
439 skey->twofish.S[2][x] = mds_column_mult(sbox(1, (sbox(1, sbox(0, sbox(0, tmpx0 ^ S[2]) ^ S[6]) ^ S[10]) ^ S[14])),2);
440 skey->twofish.S[3][x] = mds_column_mult(sbox(0, (sbox(1, sbox(1, sbox(0, tmpx1 ^ S[3]) ^ S[7]) ^ S[11]) ^ S[15])),3);
441 }
442 }
443 #else
444 /* where to start in the sbox layers */
445 /* small ram variant */
446 switch (k) {
447 case 4 : skey->twofish.start = 0; break;
448 case 3 : skey->twofish.start = 1; break;
449 default: skey->twofish.start = 2; break;
450 }
451 #endif
452 return CRYPT_OK;
453 }
454
455 #ifdef LTC_CLEAN_STACK
456 int twofish_setup(const unsigned char *key, int keylen, int num_rounds, symmetric_key *skey)
457 {
458 int x;
459 x = _twofish_setup(key, keylen, num_rounds, skey);
460 burn_stack(sizeof(int) * 7 + sizeof(unsigned char) * 56 + sizeof(ulong32) * 2);
461 return x;
462 }
463 #endif
464
465 /**
466 Encrypts a block of text with Twofish
467 @param pt The input plaintext (16 bytes)
468 @param ct The output ciphertext (16 bytes)
469 @param skey The key as scheduled
470 */
471 #ifdef LTC_CLEAN_STACK
472 static void _twofish_ecb_encrypt(const unsigned char *pt, unsigned char *ct, symmetric_key *skey)
473 #else
474 void twofish_ecb_encrypt(const unsigned char *pt, unsigned char *ct, symmetric_key *skey)
475 #endif
476 {
477 ulong32 a,b,c,d,ta,tb,tc,td,t1,t2, *k;
478 int r;
479 #if !defined(TWOFISH_SMALL) && !defined(__GNUC__)
480 ulong32 *S1, *S2, *S3, *S4;
481 #endif
482
483 LTC_ARGCHK(pt != NULL);
484 LTC_ARGCHK(ct != NULL);
485 LTC_ARGCHK(skey != NULL);
486
487 #if !defined(TWOFISH_SMALL) && !defined(__GNUC__)
488 S1 = skey->twofish.S[0];
489 S2 = skey->twofish.S[1];
490 S3 = skey->twofish.S[2];
491 S4 = skey->twofish.S[3];
492 #endif
493
494 LOAD32L(a,&pt[0]); LOAD32L(b,&pt[4]);
495 LOAD32L(c,&pt[8]); LOAD32L(d,&pt[12]);
496 a ^= skey->twofish.K[0];
497 b ^= skey->twofish.K[1];
498 c ^= skey->twofish.K[2];
499 d ^= skey->twofish.K[3];
500
501 k = skey->twofish.K + 8;
502 for (r = 8; r != 0; --r) {
503 t2 = g1_func(b, skey);
504 t1 = g_func(a, skey) + t2;
505 c = RORc(c ^ (t1 + k[0]), 1);
506 d = ROLc(d, 1) ^ (t2 + t1 + k[1]);
507
508 t2 = g1_func(d, skey);
509 t1 = g_func(c, skey) + t2;
510 a = RORc(a ^ (t1 + k[2]), 1);
511 b = ROLc(b, 1) ^ (t2 + t1 + k[3]);
512 k += 4;
513 }
514
515 /* output with "undo last swap" */
516 ta = c ^ skey->twofish.K[4];
517 tb = d ^ skey->twofish.K[5];
518 tc = a ^ skey->twofish.K[6];
519 td = b ^ skey->twofish.K[7];
520
521 /* store output */
522 STORE32L(ta,&ct[0]); STORE32L(tb,&ct[4]);
523 STORE32L(tc,&ct[8]); STORE32L(td,&ct[12]);
524 }
525
526 #ifdef LTC_CLEAN_STACK
527 void twofish_ecb_encrypt(const unsigned char *pt, unsigned char *ct, symmetric_key *skey)
528 {
529 _twofish_ecb_encrypt(pt, ct, skey);
530 burn_stack(sizeof(ulong32) * 10 + sizeof(int));
531 }
532 #endif
533
534 /**
535 Decrypts a block of text with Twofish
536 @param ct The input ciphertext (16 bytes)
537 @param pt The output plaintext (16 bytes)
538 @param skey The key as scheduled
539 */
540 #ifdef LTC_CLEAN_STACK
541 static void _twofish_ecb_decrypt(const unsigned char *ct, unsigned char *pt, symmetric_key *skey)
542 #else
543 void twofish_ecb_decrypt(const unsigned char *ct, unsigned char *pt, symmetric_key *skey)
544 #endif
545 {
546 ulong32 a,b,c,d,ta,tb,tc,td,t1,t2, *k;
547 int r;
548 #if !defined(TWOFISH_SMALL) && !defined(__GNUC__)
549 ulong32 *S1, *S2, *S3, *S4;
550 #endif
551
552 LTC_ARGCHK(pt != NULL);
553 LTC_ARGCHK(ct != NULL);
554 LTC_ARGCHK(skey != NULL);
555
556 #if !defined(TWOFISH_SMALL) && !defined(__GNUC__)
557 S1 = skey->twofish.S[0];
558 S2 = skey->twofish.S[1];
559 S3 = skey->twofish.S[2];
560 S4 = skey->twofish.S[3];
561 #endif
562
563 /* load input */
564 LOAD32L(ta,&ct[0]); LOAD32L(tb,&ct[4]);
565 LOAD32L(tc,&ct[8]); LOAD32L(td,&ct[12]);
566
567 /* undo undo final swap */
568 a = tc ^ skey->twofish.K[6];
569 b = td ^ skey->twofish.K[7];
570 c = ta ^ skey->twofish.K[4];
571 d = tb ^ skey->twofish.K[5];
572
573 k = skey->twofish.K + 36;
574 for (r = 8; r != 0; --r) {
575 t2 = g1_func(d, skey);
576 t1 = g_func(c, skey) + t2;
577 a = ROLc(a, 1) ^ (t1 + k[2]);
578 b = RORc(b ^ (t2 + t1 + k[3]), 1);
579
580 t2 = g1_func(b, skey);
581 t1 = g_func(a, skey) + t2;
582 c = ROLc(c, 1) ^ (t1 + k[0]);
583 d = RORc(d ^ (t2 + t1 + k[1]), 1);
584 k -= 4;
585 }
586
587 /* pre-white */
588 a ^= skey->twofish.K[0];
589 b ^= skey->twofish.K[1];
590 c ^= skey->twofish.K[2];
591 d ^= skey->twofish.K[3];
592
593 /* store */
594 STORE32L(a, &pt[0]); STORE32L(b, &pt[4]);
595 STORE32L(c, &pt[8]); STORE32L(d, &pt[12]);
596 }
597
598 #ifdef LTC_CLEAN_STACK
599 void twofish_ecb_decrypt(const unsigned char *ct, unsigned char *pt, symmetric_key *skey)
600 {
601 _twofish_ecb_decrypt(ct, pt, skey);
602 burn_stack(sizeof(ulong32) * 10 + sizeof(int));
603 }
604 #endif
605
606 /**
607 Performs a self-test of the Twofish block cipher
608 @return CRYPT_OK if functional, CRYPT_NOP if self-test has been disabled
609 */
610 int twofish_test(void)
611 {
612 #ifndef LTC_TEST
613 return CRYPT_NOP;
614 #else
615 static const struct {
616 int keylen;
617 unsigned char key[32], pt[16], ct[16];
618 } tests[] = {
619 { 16,
620 { 0x9F, 0x58, 0x9F, 0x5C, 0xF6, 0x12, 0x2C, 0x32,
621 0xB6, 0xBF, 0xEC, 0x2F, 0x2A, 0xE8, 0xC3, 0x5A },
622 { 0xD4, 0x91, 0xDB, 0x16, 0xE7, 0xB1, 0xC3, 0x9E,
623 0x86, 0xCB, 0x08, 0x6B, 0x78, 0x9F, 0x54, 0x19 },
624 { 0x01, 0x9F, 0x98, 0x09, 0xDE, 0x17, 0x11, 0x85,
625 0x8F, 0xAA, 0xC3, 0xA3, 0xBA, 0x20, 0xFB, 0xC3 }
626 }, {
627 24,
628 { 0x88, 0xB2, 0xB2, 0x70, 0x6B, 0x10, 0x5E, 0x36,
629 0xB4, 0x46, 0xBB, 0x6D, 0x73, 0x1A, 0x1E, 0x88,
630 0xEF, 0xA7, 0x1F, 0x78, 0x89, 0x65, 0xBD, 0x44 },
631 { 0x39, 0xDA, 0x69, 0xD6, 0xBA, 0x49, 0x97, 0xD5,
632 0x85, 0xB6, 0xDC, 0x07, 0x3C, 0xA3, 0x41, 0xB2 },
633 { 0x18, 0x2B, 0x02, 0xD8, 0x14, 0x97, 0xEA, 0x45,
634 0xF9, 0xDA, 0xAC, 0xDC, 0x29, 0x19, 0x3A, 0x65 }
635 }, {
636 32,
637 { 0xD4, 0x3B, 0xB7, 0x55, 0x6E, 0xA3, 0x2E, 0x46,
638 0xF2, 0xA2, 0x82, 0xB7, 0xD4, 0x5B, 0x4E, 0x0D,
639 0x57, 0xFF, 0x73, 0x9D, 0x4D, 0xC9, 0x2C, 0x1B,
640 0xD7, 0xFC, 0x01, 0x70, 0x0C, 0xC8, 0x21, 0x6F },
641 { 0x90, 0xAF, 0xE9, 0x1B, 0xB2, 0x88, 0x54, 0x4F,
642 0x2C, 0x32, 0xDC, 0x23, 0x9B, 0x26, 0x35, 0xE6 },
643 { 0x6C, 0xB4, 0x56, 0x1C, 0x40, 0xBF, 0x0A, 0x97,
644 0x05, 0x93, 0x1C, 0xB6, 0xD4, 0x08, 0xE7, 0xFA }
645 }
646 };
647
648
649 symmetric_key key;
650 unsigned char tmp[2][16];
651 int err, i, y;
652
653 for (i = 0; i < (int)(sizeof(tests)/sizeof(tests[0])); i++) {
654 if ((err = twofish_setup(tests[i].key, tests[i].keylen, 0, &key)) != CRYPT_OK) {
655 return err;
656 }
657 twofish_ecb_encrypt(tests[i].pt, tmp[0], &key);
658 twofish_ecb_decrypt(tmp[0], tmp[1], &key);
659 if (memcmp(tmp[0], tests[i].ct, 16) != 0 || memcmp(tmp[1], tests[i].pt, 16) != 0) {
660 return CRYPT_FAIL_TESTVECTOR;
661 }
662 /* now see if we can encrypt all zero bytes 1000 times, decrypt and come back where we started */
663 for (y = 0; y < 16; y++) tmp[0][y] = 0;
664 for (y = 0; y < 1000; y++) twofish_ecb_encrypt(tmp[0], tmp[0], &key);
665 for (y = 0; y < 1000; y++) twofish_ecb_decrypt(tmp[0], tmp[0], &key);
666 for (y = 0; y < 16; y++) if (tmp[0][y] != 0) return CRYPT_FAIL_TESTVECTOR;
667 }
668 return CRYPT_OK;
669 #endif
670 }
671
672 /** Terminate the context
673 @param skey The scheduled key
674 */
675 void twofish_done(symmetric_key *skey)
676 {
677 }
678
679 /**
680 Gets suitable key size
681 @param keysize [in/out] The length of the recommended key (in bytes). This function will store the suitable size back in this variable.
682 @return CRYPT_OK if the input key size is acceptable.
683 */
684 int twofish_keysize(int *keysize)
685 {
686 LTC_ARGCHK(keysize);
687 if (*keysize < 16)
688 return CRYPT_INVALID_KEYSIZE;
689 if (*keysize < 24) {
690 *keysize = 16;
691 return CRYPT_OK;
692 } else if (*keysize < 32) {
693 *keysize = 24;
694 return CRYPT_OK;
695 } else {
696 *keysize = 32;
697 return CRYPT_OK;
698 }
699 }
700
701 #endif
702
703
704
705
706 /* $Source: /cvs/libtom/libtomcrypt/src/ciphers/twofish/twofish.c,v $ */
707 /* $Revision: 1.8 $ */
708 /* $Date: 2005/05/05 14:35:58 $ */