Mercurial > dropbear

comparison rc2.c @ 3:7faae8f46238 libtomcrypt-orig

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Branch renaming
author Matt Johnston <matt@ucc.asn.au>
date Mon, 31 May 2004 18:25:41 +0000
parents
children 5d99163f7e32
comparison
equal deleted inserted replaced
-1:000000000000 3:7faae8f46238
1 /* LibTomCrypt, modular cryptographic library -- Tom St Denis
2 *
3 * LibTomCrypt is a library that provides various cryptographic
4 * algorithms in a highly modular and flexible manner.
5 *
6 * The library is free for all purposes without any express
7 * guarantee it works.
8 *
9 * Tom St Denis, [email protected], http://libtomcrypt.org
10 */
11 /**********************************************************************\
12 * To commemorate the 1996 RSA Data Security Conference, the following *
13 * code is released into the public domain by its author. Prost! *
14 * *
15 * This cipher uses 16-bit words and little-endian byte ordering. *
16 * I wonder which processor it was optimized for? *
17 * *
18 * Thanks to CodeView, SoftIce, and D86 for helping bring this code to *
19 * the public. *
20 \**********************************************************************/
21
22 #include <mycrypt.h>
23
24 #ifdef RC2
25
26 const struct _cipher_descriptor rc2_desc = {
27 "rc2",
28 12, 8, 128, 8, 16,
29 &rc2_setup,
30 &rc2_ecb_encrypt,
31 &rc2_ecb_decrypt,
32 &rc2_test,
33 &rc2_keysize
34 };
35
36
37 /**********************************************************************\
38 * Expand a variable-length user key (between 1 and 128 bytes) to a *
39 * 64-short working rc2 key, of at most "bits" effective key bits. *
40 * The effective key bits parameter looks like an export control hack. *
41 * For normal use, it should always be set to 1024. For convenience, *
42 * zero is accepted as an alias for 1024. *
43 \**********************************************************************/
44
45 /* 256-entry permutation table, probably derived somehow from pi */
46 static const unsigned char permute[256] = {
47 217,120,249,196, 25,221,181,237, 40,233,253,121, 74,160,216,157,
48 198,126, 55,131, 43,118, 83,142, 98, 76,100,136, 68,139,251,162,
49 23,154, 89,245,135,179, 79, 19, 97, 69,109,141, 9,129,125, 50,
50 189,143, 64,235,134,183,123, 11,240,149, 33, 34, 92,107, 78,130,
51 84,214,101,147,206, 96,178, 28,115, 86,192, 20,167,140,241,220,
52 18,117,202, 31, 59,190,228,209, 66, 61,212, 48,163, 60,182, 38,
53 111,191, 14,218, 70,105, 7, 87, 39,242, 29,155,188,148, 67, 3,
54 248, 17,199,246,144,239, 62,231, 6,195,213, 47,200,102, 30,215,
55 8,232,234,222,128, 82,238,247,132,170,114,172, 53, 77,106, 42,
56 150, 26,210,113, 90, 21, 73,116, 75,159,208, 94, 4, 24,164,236,
57 194,224, 65,110, 15, 81,203,204, 36,145,175, 80,161,244,112, 57,
58 153,124, 58,133, 35,184,180,122,252, 2, 54, 91, 37, 85,151, 49,
59 45, 93,250,152,227,138,146,174, 5,223, 41, 16,103,108,186,201,
60 211, 0,230,207,225,158,168, 44, 99, 22, 1, 63, 88,226,137,169,
61 13, 56, 52, 27,171, 51,255,176,187, 72, 12, 95,185,177,205, 46,
62 197,243,219, 71,229,165,156,119, 10,166, 32,104,254,127,193,173
63 };
64
65 int rc2_setup(const unsigned char *key, int keylen, int rounds, symmetric_key *skey)
66 {
67 unsigned *xkey = skey->rc2.xkey;
68 unsigned char tmp[128];
69 unsigned T8, TM;
70 int i, bits;
71
72 _ARGCHK(key != NULL);
73 _ARGCHK(skey != NULL);
74
75 if (keylen < 8 || keylen > 128) {
76 return CRYPT_INVALID_KEYSIZE;
77 }
78
79 if (rounds != 0 && rounds != 16) {
80 return CRYPT_INVALID_ROUNDS;
81 }
82
83 for (i = 0; i < keylen; i++) {
84 tmp[i] = key[i] & 255;
85 }
86
87 /* Phase 1: Expand input key to 128 bytes */
88 if (keylen < 128) {
89 for (i = keylen; i < 128; i++) {
90 tmp[i] = permute[(int)((tmp[i - 1] + tmp[i - keylen]) & 255)];
91 }
92 }
93
94 /* Phase 2 - reduce effective key size to "bits" */
95 bits = keylen*8;
96 T8 = (unsigned)(bits+7)>>3;
97 TM = (255 >> (unsigned)(7 & -bits));
98 tmp[128 - T8] = permute[(int)(tmp[128 - T8] & TM)];
99 for (i = 127 - T8; i >= 0; i--) {
100 tmp[i] = permute[(int)(tmp[i + 1] ^ tmp[i + T8])];
101 }
102
103 /* Phase 3 - copy to xkey in little-endian order */
104 i = 63;
105 do {
106 xkey[i] = (unsigned)tmp[2*i] + ((unsigned)tmp[2*i+1] << 8);
107 } while (i-- > 0);
108
109 #ifdef CLEAN_STACK
110 zeromem(tmp, sizeof(tmp));
111 #endif
112
113 return CRYPT_OK;
114 }
115
116 /**********************************************************************\
117 * Encrypt an 8-byte block of plaintext using the given key. *
118 \**********************************************************************/
119 #ifdef CLEAN_STACK
120 static void _rc2_ecb_encrypt( const unsigned char *plain,
121 unsigned char *cipher,
122 symmetric_key *skey)
123 #else
124 void rc2_ecb_encrypt( const unsigned char *plain,
125 unsigned char *cipher,
126 symmetric_key *skey)
127 #endif
128 {
129 unsigned *xkey;
130 unsigned x76, x54, x32, x10, i;
131
132 _ARGCHK(plain != NULL);
133 _ARGCHK(cipher != NULL);
134 _ARGCHK(skey != NULL);
135
136 xkey = skey->rc2.xkey;
137
138 x76 = ((unsigned)plain[7] << 8) + (unsigned)plain[6];
139 x54 = ((unsigned)plain[5] << 8) + (unsigned)plain[4];
140 x32 = ((unsigned)plain[3] << 8) + (unsigned)plain[2];
141 x10 = ((unsigned)plain[1] << 8) + (unsigned)plain[0];
142
143 for (i = 0; i < 16; i++) {
144 x10 = (x10 + (x32 & ~x76) + (x54 & x76) + xkey[4*i+0]) & 0xFFFF;
145 x10 = ((x10 << 1) | (x10 >> 15)) & 0xFFFF;
146
147 x32 = (x32 + (x54 & ~x10) + (x76 & x10) + xkey[4*i+1]) & 0xFFFF;
148 x32 = ((x32 << 2) | (x32 >> 14)) & 0xFFFF;
149
150 x54 = (x54 + (x76 & ~x32) + (x10 & x32) + xkey[4*i+2]) & 0xFFFF;
151 x54 = ((x54 << 3) | (x54 >> 13)) & 0xFFFF;
152
153 x76 = (x76 + (x10 & ~x54) + (x32 & x54) + xkey[4*i+3]) & 0xFFFF;
154 x76 = ((x76 << 5) | (x76 >> 11)) & 0xFFFF;
155
156 if (i == 4 || i == 10) {
157 x10 = (x10 + xkey[x76 & 63]) & 0xFFFF;
158 x32 = (x32 + xkey[x10 & 63]) & 0xFFFF;
159 x54 = (x54 + xkey[x32 & 63]) & 0xFFFF;
160 x76 = (x76 + xkey[x54 & 63]) & 0xFFFF;
161 }
162 }
163
164 cipher[0] = (unsigned char)x10;
165 cipher[1] = (unsigned char)(x10 >> 8);
166 cipher[2] = (unsigned char)x32;
167 cipher[3] = (unsigned char)(x32 >> 8);
168 cipher[4] = (unsigned char)x54;
169 cipher[5] = (unsigned char)(x54 >> 8);
170 cipher[6] = (unsigned char)x76;
171 cipher[7] = (unsigned char)(x76 >> 8);
172 }
173
174 #ifdef CLEAN_STACK
175 void rc2_ecb_encrypt( const unsigned char *plain,
176 unsigned char *cipher,
177 symmetric_key *skey)
178 {
179 _rc2_ecb_encrypt(plain, cipher, skey);
180 burn_stack(sizeof(unsigned *) + sizeof(unsigned) * 5);
181 }
182 #endif
183
184 /**********************************************************************\
185 * Decrypt an 8-byte block of ciphertext using the given key. *
186 \**********************************************************************/
187
188 #ifdef CLEAN_STACK
189 static void _rc2_ecb_decrypt( const unsigned char *cipher,
190 unsigned char *plain,
191 symmetric_key *skey)
192 #else
193 void rc2_ecb_decrypt( const unsigned char *cipher,
194 unsigned char *plain,
195 symmetric_key *skey)
196 #endif
197 {
198 unsigned x76, x54, x32, x10;
199 unsigned *xkey;
200 int i;
201
202 _ARGCHK(plain != NULL);
203 _ARGCHK(cipher != NULL);
204 _ARGCHK(skey != NULL);
205
206 xkey = skey->rc2.xkey;
207
208 x76 = ((unsigned)cipher[7] << 8) + (unsigned)cipher[6];
209 x54 = ((unsigned)cipher[5] << 8) + (unsigned)cipher[4];
210 x32 = ((unsigned)cipher[3] << 8) + (unsigned)cipher[2];
211 x10 = ((unsigned)cipher[1] << 8) + (unsigned)cipher[0];
212
213 for (i = 15; i >= 0; i--) {
214 if (i == 4 || i == 10) {
215 x76 = (x76 - xkey[x54 & 63]) & 0xFFFF;
216 x54 = (x54 - xkey[x32 & 63]) & 0xFFFF;
217 x32 = (x32 - xkey[x10 & 63]) & 0xFFFF;
218 x10 = (x10 - xkey[x76 & 63]) & 0xFFFF;
219 }
220
221 x76 = ((x76 << 11) | (x76 >> 5)) & 0xFFFF;
222 x76 = (x76 - ((x10 & ~x54) + (x32 & x54) + xkey[4*i+3])) & 0xFFFF;
223
224 x54 = ((x54 << 13) | (x54 >> 3)) & 0xFFFF;
225 x54 = (x54 - ((x76 & ~x32) + (x10 & x32) + xkey[4*i+2])) & 0xFFFF;
226
227 x32 = ((x32 << 14) | (x32 >> 2)) & 0xFFFF;
228 x32 = (x32 - ((x54 & ~x10) + (x76 & x10) + xkey[4*i+1])) & 0xFFFF;
229
230 x10 = ((x10 << 15) | (x10 >> 1)) & 0xFFFF;
231 x10 = (x10 - ((x32 & ~x76) + (x54 & x76) + xkey[4*i+0])) & 0xFFFF;
232 }
233
234 plain[0] = (unsigned char)x10;
235 plain[1] = (unsigned char)(x10 >> 8);
236 plain[2] = (unsigned char)x32;
237 plain[3] = (unsigned char)(x32 >> 8);
238 plain[4] = (unsigned char)x54;
239 plain[5] = (unsigned char)(x54 >> 8);
240 plain[6] = (unsigned char)x76;
241 plain[7] = (unsigned char)(x76 >> 8);
242 }
243
244 #ifdef CLEAN_STACK
245 void rc2_ecb_decrypt( const unsigned char *cipher,
246 unsigned char *plain,
247 symmetric_key *skey)
248 {
249 _rc2_ecb_decrypt(cipher, plain, skey);
250 burn_stack(sizeof(unsigned *) + sizeof(unsigned) * 4 + sizeof(int));
251 }
252 #endif
253
254 int rc2_test(void)
255 {
256 #ifndef LTC_TEST
257 return CRYPT_NOP;
258 #else
259 static const struct {
260 int keylen;
261 unsigned char key[16], pt[8], ct[8];
262 } tests[] = {
263
264 { 8,
265 { 0x30, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
266 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
267 { 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 },
268 { 0x30, 0x64, 0x9e, 0xdf, 0x9b, 0xe7, 0xd2, 0xc2 }
269
270 },
271 { 16,
272 { 0x88, 0xbc, 0xa9, 0x0e, 0x90, 0x87, 0x5a, 0x7f,
273 0x0f, 0x79, 0xc3, 0x84, 0x62, 0x7b, 0xaf, 0xb2 },
274 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
275 { 0x22, 0x69, 0x55, 0x2a, 0xb0, 0xf8, 0x5c, 0xa6 }
276 }
277 };
278 int x, y, err;
279 symmetric_key skey;
280 unsigned char tmp[2][8];
281
282 for (x = 0; x < (int)(sizeof(tests) / sizeof(tests[0])); x++) {
283 zeromem(tmp, sizeof(tmp));
284 if ((err = rc2_setup(tests[x].key, tests[x].keylen, 0, &skey)) != CRYPT_OK) {
285 return err;
286 }
287
288 rc2_ecb_encrypt(tests[x].pt, tmp[0], &skey);
289 rc2_ecb_decrypt(tmp[0], tmp[1], &skey);
290
291 if (memcmp(tmp[0], tests[x].ct, 8) != 0 || memcmp(tmp[1], tests[x].pt, 8) != 0) {
292 return CRYPT_FAIL_TESTVECTOR;
293 }
294
295 /* now see if we can encrypt all zero bytes 1000 times, decrypt and come back where we started */
296 for (y = 0; y < 8; y++) tmp[0][y] = 0;
297 for (y = 0; y < 1000; y++) rc2_ecb_encrypt(tmp[0], tmp[0], &skey);
298 for (y = 0; y < 1000; y++) rc2_ecb_decrypt(tmp[0], tmp[0], &skey);
299 for (y = 0; y < 8; y++) if (tmp[0][y] != 0) return CRYPT_FAIL_TESTVECTOR;
300 }
301 return CRYPT_OK;
302 #endif
303 }
304
305 int rc2_keysize(int *keysize)
306 {
307 _ARGCHK(keysize != NULL);
308 if (*keysize < 8) {
309 return CRYPT_INVALID_KEYSIZE;
310 } else if (*keysize > 128) {
311 *keysize = 128;
312 }
313 return CRYPT_OK;
314 }
315
316 #endif
317
318
319