Mercurial > dropbear

comparison saferp.c @ 0:d7da3b1e1540 libtomcrypt

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
put back the 0.95 makefile which was inadvertently merged over
author Matt Johnston <matt@ucc.asn.au>
date Mon, 31 May 2004 18:21:40 +0000
parents
children
comparison
equal deleted inserted replaced
-1:000000000000 0:d7da3b1e1540
1 /* LibTomCrypt, modular cryptographic library -- Tom St Denis
2 *
3 * LibTomCrypt is a library that provides various cryptographic
4 * algorithms in a highly modular and flexible manner.
5 *
6 * The library is free for all purposes without any express
7 * guarantee it works.
8 *
9 * Tom St Denis, [email protected], http://libtomcrypt.org
10 */
11
12 /* SAFER+ Implementation by Tom St Denis */
13 #include "mycrypt.h"
14
15 #ifdef SAFERP
16
17 const struct _cipher_descriptor saferp_desc =
18 {
19 "safer+",
20 4,
21 16, 32, 16, 8,
22 &saferp_setup,
23 &saferp_ecb_encrypt,
24 &saferp_ecb_decrypt,
25 &saferp_test,
26 &saferp_keysize
27 };
28
29 /* ROUND(b,i)
30 *
31 * This is one forward key application. Note the basic form is
32 * key addition, substitution, key addition. The safer_ebox and safer_lbox
33 * are the exponentiation box and logarithm boxes respectively.
34 * The value of 'i' is the current round number which allows this
35 * function to be unrolled massively. Most of SAFER+'s speed
36 * comes from not having to compute indirect accesses into the
37 * array of 16 bytes b[0..15] which is the block of data
38 */
39
40 extern const unsigned char safer_ebox[], safer_lbox[];
41
42 #define ROUND(b, i) \
43 b[0] = (safer_ebox[(b[0] ^ skey->saferp.K[i][0]) & 255] + skey->saferp.K[i+1][0]) & 255; \
44 b[1] = safer_lbox[(b[1] + skey->saferp.K[i][1]) & 255] ^ skey->saferp.K[i+1][1]; \
45 b[2] = safer_lbox[(b[2] + skey->saferp.K[i][2]) & 255] ^ skey->saferp.K[i+1][2]; \
46 b[3] = (safer_ebox[(b[3] ^ skey->saferp.K[i][3]) & 255] + skey->saferp.K[i+1][3]) & 255; \
47 b[4] = (safer_ebox[(b[4] ^ skey->saferp.K[i][4]) & 255] + skey->saferp.K[i+1][4]) & 255; \
48 b[5] = safer_lbox[(b[5] + skey->saferp.K[i][5]) & 255] ^ skey->saferp.K[i+1][5]; \
49 b[6] = safer_lbox[(b[6] + skey->saferp.K[i][6]) & 255] ^ skey->saferp.K[i+1][6]; \
50 b[7] = (safer_ebox[(b[7] ^ skey->saferp.K[i][7]) & 255] + skey->saferp.K[i+1][7]) & 255; \
51 b[8] = (safer_ebox[(b[8] ^ skey->saferp.K[i][8]) & 255] + skey->saferp.K[i+1][8]) & 255; \
52 b[9] = safer_lbox[(b[9] + skey->saferp.K[i][9]) & 255] ^ skey->saferp.K[i+1][9]; \
53 b[10] = safer_lbox[(b[10] + skey->saferp.K[i][10]) & 255] ^ skey->saferp.K[i+1][10]; \
54 b[11] = (safer_ebox[(b[11] ^ skey->saferp.K[i][11]) & 255] + skey->saferp.K[i+1][11]) & 255; \
55 b[12] = (safer_ebox[(b[12] ^ skey->saferp.K[i][12]) & 255] + skey->saferp.K[i+1][12]) & 255; \
56 b[13] = safer_lbox[(b[13] + skey->saferp.K[i][13]) & 255] ^ skey->saferp.K[i+1][13]; \
57 b[14] = safer_lbox[(b[14] + skey->saferp.K[i][14]) & 255] ^ skey->saferp.K[i+1][14]; \
58 b[15] = (safer_ebox[(b[15] ^ skey->saferp.K[i][15]) & 255] + skey->saferp.K[i+1][15]) & 255;
59
60 /* This is one inverse key application */
61 #define iROUND(b, i) \
62 b[0] = safer_lbox[(b[0] - skey->saferp.K[i+1][0]) & 255] ^ skey->saferp.K[i][0]; \
63 b[1] = (safer_ebox[(b[1] ^ skey->saferp.K[i+1][1]) & 255] - skey->saferp.K[i][1]) & 255; \
64 b[2] = (safer_ebox[(b[2] ^ skey->saferp.K[i+1][2]) & 255] - skey->saferp.K[i][2]) & 255; \
65 b[3] = safer_lbox[(b[3] - skey->saferp.K[i+1][3]) & 255] ^ skey->saferp.K[i][3]; \
66 b[4] = safer_lbox[(b[4] - skey->saferp.K[i+1][4]) & 255] ^ skey->saferp.K[i][4]; \
67 b[5] = (safer_ebox[(b[5] ^ skey->saferp.K[i+1][5]) & 255] - skey->saferp.K[i][5]) & 255; \
68 b[6] = (safer_ebox[(b[6] ^ skey->saferp.K[i+1][6]) & 255] - skey->saferp.K[i][6]) & 255; \
69 b[7] = safer_lbox[(b[7] - skey->saferp.K[i+1][7]) & 255] ^ skey->saferp.K[i][7]; \
70 b[8] = safer_lbox[(b[8] - skey->saferp.K[i+1][8]) & 255] ^ skey->saferp.K[i][8]; \
71 b[9] = (safer_ebox[(b[9] ^ skey->saferp.K[i+1][9]) & 255] - skey->saferp.K[i][9]) & 255; \
72 b[10] = (safer_ebox[(b[10] ^ skey->saferp.K[i+1][10]) & 255] - skey->saferp.K[i][10]) & 255; \
73 b[11] = safer_lbox[(b[11] - skey->saferp.K[i+1][11]) & 255] ^ skey->saferp.K[i][11]; \
74 b[12] = safer_lbox[(b[12] - skey->saferp.K[i+1][12]) & 255] ^ skey->saferp.K[i][12]; \
75 b[13] = (safer_ebox[(b[13] ^ skey->saferp.K[i+1][13]) & 255] - skey->saferp.K[i][13]) & 255; \
76 b[14] = (safer_ebox[(b[14] ^ skey->saferp.K[i+1][14]) & 255] - skey->saferp.K[i][14]) & 255; \
77 b[15] = safer_lbox[(b[15] - skey->saferp.K[i+1][15]) & 255] ^ skey->saferp.K[i][15];
78
79 /* This is a forward single layer PHT transform. */
80 #define PHT(b) \
81 b[0] = (b[0] + (b[1] = (b[0] + b[1]) & 255)) & 255; \
82 b[2] = (b[2] + (b[3] = (b[3] + b[2]) & 255)) & 255; \
83 b[4] = (b[4] + (b[5] = (b[5] + b[4]) & 255)) & 255; \
84 b[6] = (b[6] + (b[7] = (b[7] + b[6]) & 255)) & 255; \
85 b[8] = (b[8] + (b[9] = (b[9] + b[8]) & 255)) & 255; \
86 b[10] = (b[10] + (b[11] = (b[11] + b[10]) & 255)) & 255; \
87 b[12] = (b[12] + (b[13] = (b[13] + b[12]) & 255)) & 255; \
88 b[14] = (b[14] + (b[15] = (b[15] + b[14]) & 255)) & 255;
89
90 /* This is an inverse single layer PHT transform */
91 #define iPHT(b) \
92 b[15] = (b[15] - (b[14] = (b[14] - b[15]) & 255)) & 255; \
93 b[13] = (b[13] - (b[12] = (b[12] - b[13]) & 255)) & 255; \
94 b[11] = (b[11] - (b[10] = (b[10] - b[11]) & 255)) & 255; \
95 b[9] = (b[9] - (b[8] = (b[8] - b[9]) & 255)) & 255; \
96 b[7] = (b[7] - (b[6] = (b[6] - b[7]) & 255)) & 255; \
97 b[5] = (b[5] - (b[4] = (b[4] - b[5]) & 255)) & 255; \
98 b[3] = (b[3] - (b[2] = (b[2] - b[3]) & 255)) & 255; \
99 b[1] = (b[1] - (b[0] = (b[0] - b[1]) & 255)) & 255; \
100
101 /* This is the "Armenian" Shuffle. It takes the input from b and stores it in b2 */
102 #define SHUF(b, b2) \
103 b2[0] = b[8]; b2[1] = b[11]; b2[2] = b[12]; b2[3] = b[15]; \
104 b2[4] = b[2]; b2[5] = b[1]; b2[6] = b[6]; b2[7] = b[5]; \
105 b2[8] = b[10]; b2[9] = b[9]; b2[10] = b[14]; b2[11] = b[13]; \
106 b2[12] = b[0]; b2[13] = b[7]; b2[14] = b[4]; b2[15] = b[3];
107
108 /* This is the inverse shuffle. It takes from b and gives to b2 */
109 #define iSHUF(b, b2) \
110 b2[0] = b[12]; b2[1] = b[5]; b2[2] = b[4]; b2[3] = b[15]; \
111 b2[4] = b[14]; b2[5] = b[7]; b2[6] = b[6]; b2[7] = b[13]; \
112 b2[8] = b[0]; b2[9] = b[9]; b2[10] = b[8]; b2[11] = b[1]; \
113 b2[12] = b[2]; b2[13] = b[11]; b2[14] = b[10]; b2[15] = b[3];
114
115 /* The complete forward Linear Transform layer.
116 * Note that alternating usage of b and b2.
117 * Each round of LT starts in 'b' and ends in 'b2'.
118 */
119 #define LT(b, b2) \
120 PHT(b); SHUF(b, b2); \
121 PHT(b2); SHUF(b2, b); \
122 PHT(b); SHUF(b, b2); \
123 PHT(b2);
124
125 /* This is the inverse linear transform layer. */
126 #define iLT(b, b2) \
127 iPHT(b); \
128 iSHUF(b, b2); iPHT(b2); \
129 iSHUF(b2, b); iPHT(b); \
130 iSHUF(b, b2); iPHT(b2);
131
132 #ifdef SMALL_CODE
133
134 static void _round(unsigned char *b, int i, symmetric_key *skey)
135 {
136 ROUND(b, i);
137 }
138
139 static void _iround(unsigned char *b, int i, symmetric_key *skey)
140 {
141 iROUND(b, i);
142 }
143
144 static void _lt(unsigned char *b, unsigned char *b2)
145 {
146 LT(b, b2);
147 }
148
149 static void _ilt(unsigned char *b, unsigned char *b2)
150 {
151 iLT(b, b2);
152 }
153
154 #undef ROUND
155 #define ROUND(b, i) _round(b, i, skey)
156
157 #undef iROUND
158 #define iROUND(b, i) _iround(b, i, skey)
159
160 #undef LT
161 #define LT(b, b2) _lt(b, b2)
162
163 #undef iLT
164 #define iLT(b, b2) _ilt(b, b2)
165
166 #endif
167
168 /* These are the 33, 128-bit bias words for the key schedule */
169 static const unsigned char safer_bias[33][16] = {
170 { 70, 151, 177, 186, 163, 183, 16, 10, 197, 55, 179, 201, 90, 40, 172, 100},
171 { 236, 171, 170, 198, 103, 149, 88, 13, 248, 154, 246, 110, 102, 220, 5, 61},
172 { 138, 195, 216, 137, 106, 233, 54, 73, 67, 191, 235, 212, 150, 155, 104, 160},
173 { 93, 87, 146, 31, 213, 113, 92, 187, 34, 193, 190, 123, 188, 153, 99, 148},
174 { 42, 97, 184, 52, 50, 25, 253, 251, 23, 64, 230, 81, 29, 65, 68, 143},
175 { 221, 4, 128, 222, 231, 49, 214, 127, 1, 162, 247, 57, 218, 111, 35, 202},
176 { 58, 208, 28, 209, 48, 62, 18, 161, 205, 15, 224, 168, 175, 130, 89, 44},
177 { 125, 173, 178, 239, 194, 135, 206, 117, 6, 19, 2, 144, 79, 46, 114, 51},
178 { 192, 141, 207, 169, 129, 226, 196, 39, 47, 108, 122, 159, 82, 225, 21, 56},
179 { 252, 32, 66, 199, 8, 228, 9, 85, 94, 140, 20, 118, 96, 255, 223, 215},
180 { 250, 11, 33, 0, 26, 249, 166, 185, 232, 158, 98, 76, 217, 145, 80, 210},
181 { 24, 180, 7, 132, 234, 91, 164, 200, 14, 203, 72, 105, 75, 78, 156, 53},
182 { 69, 77, 84, 229, 37, 60, 12, 74, 139, 63, 204, 167, 219, 107, 174, 244},
183 { 45, 243, 124, 109, 157, 181, 38, 116, 242, 147, 83, 176, 240, 17, 237, 131},
184 { 182, 3, 22, 115, 59, 30, 142, 112, 189, 134, 27, 71, 126, 36, 86, 241},
185 { 136, 70, 151, 177, 186, 163, 183, 16, 10, 197, 55, 179, 201, 90, 40, 172},
186 { 220, 134, 119, 215, 166, 17, 251, 244, 186, 146, 145, 100, 131, 241, 51, 239},
187 { 44, 181, 178, 43, 136, 209, 153, 203, 140, 132, 29, 20, 129, 151, 113, 202},
188 { 163, 139, 87, 60, 130, 196, 82, 92, 28, 232, 160, 4, 180, 133, 74, 246},
189 { 84, 182, 223, 12, 26, 142, 222, 224, 57, 252, 32, 155, 36, 78, 169, 152},
190 { 171, 242, 96, 208, 108, 234, 250, 199, 217, 0, 212, 31, 110, 67, 188, 236},
191 { 137, 254, 122, 93, 73, 201, 50, 194, 249, 154, 248, 109, 22, 219, 89, 150},
192 { 233, 205, 230, 70, 66, 143, 10, 193, 204, 185, 101, 176, 210, 198, 172, 30},
193 { 98, 41, 46, 14, 116, 80, 2, 90, 195, 37, 123, 138, 42, 91, 240, 6},
194 { 71, 111, 112, 157, 126, 16, 206, 18, 39, 213, 76, 79, 214, 121, 48, 104},
195 { 117, 125, 228, 237, 128, 106, 144, 55, 162, 94, 118, 170, 197, 127, 61, 175},
196 { 229, 25, 97, 253, 77, 124, 183, 11, 238, 173, 75, 34, 245, 231, 115, 35},
197 { 200, 5, 225, 102, 221, 179, 88, 105, 99, 86, 15, 161, 49, 149, 23, 7},
198 { 40, 1, 45, 226, 147, 190, 69, 21, 174, 120, 3, 135, 164, 184, 56, 207},
199 { 8, 103, 9, 148, 235, 38, 168, 107, 189, 24, 52, 27, 187, 191, 114, 247},
200 { 53, 72, 156, 81, 47, 59, 85, 227, 192, 159, 216, 211, 243, 141, 177, 255},
201 { 62, 220, 134, 119, 215, 166, 17, 251, 244, 186, 146, 145, 100, 131, 241, 51}};
202
203 int saferp_setup(const unsigned char *key, int keylen, int num_rounds, symmetric_key *skey)
204 {
205 unsigned x, y, z;
206 unsigned char t[33];
207 static const int rounds[3] = { 8, 12, 16 };
208
209 _ARGCHK(key != NULL);
210 _ARGCHK(skey != NULL);
211
212 /* check arguments */
213 if (keylen != 16 && keylen != 24 && keylen != 32) {
214 return CRYPT_INVALID_KEYSIZE;
215 }
216
217 /* Is the number of rounds valid? Either use zero for default or
218 * 8,12,16 rounds for 16,24,32 byte keys
219 */
220 if (num_rounds != 0 && num_rounds != rounds[(keylen/8)-2]) {
221 return CRYPT_INVALID_ROUNDS;
222 }
223
224 /* 128 bit key version */
225 if (keylen == 16) {
226 /* copy key into t */
227 for (x = y = 0; x < 16; x++) {
228 t[x] = key[x];
229 y ^= key[x];
230 }
231 t[16] = y;
232
233 /* make round keys */
234 for (x = 0; x < 16; x++) {
235 skey->saferp.K[0][x] = t[x];
236 }
237
238 /* make the 16 other keys as a transformation of the first key */
239 for (x = 1; x < 17; x++) {
240 /* rotate 3 bits each */
241 for (y = 0; y < 17; y++) {
242 t[y] = ((t[y]<<3)|(t[y]>>5)) & 255;
243 }
244
245 /* select and add */
246 z = x;
247 for (y = 0; y < 16; y++) {
248 skey->saferp.K[x][y] = (t[z] + safer_bias[x-1][y]) & 255;
249 if (++z == 17) { z = 0; }
250 }
251 }
252 skey->saferp.rounds = 8;
253 } else if (keylen == 24) {
254 /* copy key into t */
255 for (x = y = 0; x < 24; x++) {
256 t[x] = key[x];
257 y ^= key[x];
258 }
259 t[24] = y;
260
261 /* make round keys */
262 for (x = 0; x < 16; x++) {
263 skey->saferp.K[0][x] = t[x];
264 }
265
266 for (x = 1; x < 25; x++) {
267 /* rotate 3 bits each */
268 for (y = 0; y < 25; y++) {
269 t[y] = ((t[y]<<3)|(t[y]>>5)) & 255;
270 }
271
272 /* select and add */
273 z = x;
274 for (y = 0; y < 16; y++) {
275 skey->saferp.K[x][y] = (t[z] + safer_bias[x-1][y]) & 255;
276 if (++z == 25) { z = 0; }
277 }
278 }
279 skey->saferp.rounds = 12;
280 } else {
281 /* copy key into t */
282 for (x = y = 0; x < 32; x++) {
283 t[x] = key[x];
284 y ^= key[x];
285 }
286 t[32] = y;
287
288 /* make round keys */
289 for (x = 0; x < 16; x++) {
290 skey->saferp.K[0][x] = t[x];
291 }
292
293 for (x = 1; x < 33; x++) {
294 /* rotate 3 bits each */
295 for (y = 0; y < 33; y++) {
296 t[y] = ((t[y]<<3)|(t[y]>>5)) & 255;
297 }
298
299 /* select and add */
300 z = x;
301 for (y = 0; y < 16; y++) {
302 skey->saferp.K[x][y] = (t[z] + safer_bias[x-1][y]) & 255;
303 if (++z == 33) { z = 0; }
304 }
305 }
306 skey->saferp.rounds = 16;
307 }
308 #ifdef CLEAN_STACK
309 zeromem(t, sizeof(t));
310 #endif
311 return CRYPT_OK;
312 }
313
314 void saferp_ecb_encrypt(const unsigned char *pt, unsigned char *ct, symmetric_key *skey)
315 {
316 unsigned char b[16];
317 int x;
318
319 _ARGCHK(pt != NULL);
320 _ARGCHK(ct != NULL);
321 _ARGCHK(skey != NULL);
322
323 /* do eight rounds */
324 for (x = 0; x < 16; x++) {
325 b[x] = pt[x];
326 }
327 ROUND(b, 0); LT(b, ct);
328 ROUND(ct, 2); LT(ct, b);
329 ROUND(b, 4); LT(b, ct);
330 ROUND(ct, 6); LT(ct, b);
331 ROUND(b, 8); LT(b, ct);
332 ROUND(ct, 10); LT(ct, b);
333 ROUND(b, 12); LT(b, ct);
334 ROUND(ct, 14); LT(ct, b);
335 /* 192-bit key? */
336 if (skey->saferp.rounds > 8) {
337 ROUND(b, 16); LT(b, ct);
338 ROUND(ct, 18); LT(ct, b);
339 ROUND(b, 20); LT(b, ct);
340 ROUND(ct, 22); LT(ct, b);
341 }
342 /* 256-bit key? */
343 if (skey->saferp.rounds > 12) {
344 ROUND(b, 24); LT(b, ct);
345 ROUND(ct, 26); LT(ct, b);
346 ROUND(b, 28); LT(b, ct);
347 ROUND(ct, 30); LT(ct, b);
348 }
349 ct[0] = b[0] ^ skey->saferp.K[skey->saferp.rounds*2][0];
350 ct[1] = (b[1] + skey->saferp.K[skey->saferp.rounds*2][1]) & 255;
351 ct[2] = (b[2] + skey->saferp.K[skey->saferp.rounds*2][2]) & 255;
352 ct[3] = b[3] ^ skey->saferp.K[skey->saferp.rounds*2][3];
353 ct[4] = b[4] ^ skey->saferp.K[skey->saferp.rounds*2][4];
354 ct[5] = (b[5] + skey->saferp.K[skey->saferp.rounds*2][5]) & 255;
355 ct[6] = (b[6] + skey->saferp.K[skey->saferp.rounds*2][6]) & 255;
356 ct[7] = b[7] ^ skey->saferp.K[skey->saferp.rounds*2][7];
357 ct[8] = b[8] ^ skey->saferp.K[skey->saferp.rounds*2][8];
358 ct[9] = (b[9] + skey->saferp.K[skey->saferp.rounds*2][9]) & 255;
359 ct[10] = (b[10] + skey->saferp.K[skey->saferp.rounds*2][10]) & 255;
360 ct[11] = b[11] ^ skey->saferp.K[skey->saferp.rounds*2][11];
361 ct[12] = b[12] ^ skey->saferp.K[skey->saferp.rounds*2][12];
362 ct[13] = (b[13] + skey->saferp.K[skey->saferp.rounds*2][13]) & 255;
363 ct[14] = (b[14] + skey->saferp.K[skey->saferp.rounds*2][14]) & 255;
364 ct[15] = b[15] ^ skey->saferp.K[skey->saferp.rounds*2][15];
365 #ifdef CLEAN_STACK
366 zeromem(b, sizeof(b));
367 #endif
368 }
369
370 void saferp_ecb_decrypt(const unsigned char *ct, unsigned char *pt, symmetric_key *skey)
371 {
372 unsigned char b[16];
373 int x;
374
375 _ARGCHK(pt != NULL);
376 _ARGCHK(ct != NULL);
377 _ARGCHK(skey != NULL);
378
379 /* do eight rounds */
380 b[0] = ct[0] ^ skey->saferp.K[skey->saferp.rounds*2][0];
381 b[1] = (ct[1] - skey->saferp.K[skey->saferp.rounds*2][1]) & 255;
382 b[2] = (ct[2] - skey->saferp.K[skey->saferp.rounds*2][2]) & 255;
383 b[3] = ct[3] ^ skey->saferp.K[skey->saferp.rounds*2][3];
384 b[4] = ct[4] ^ skey->saferp.K[skey->saferp.rounds*2][4];
385 b[5] = (ct[5] - skey->saferp.K[skey->saferp.rounds*2][5]) & 255;
386 b[6] = (ct[6] - skey->saferp.K[skey->saferp.rounds*2][6]) & 255;
387 b[7] = ct[7] ^ skey->saferp.K[skey->saferp.rounds*2][7];
388 b[8] = ct[8] ^ skey->saferp.K[skey->saferp.rounds*2][8];
389 b[9] = (ct[9] - skey->saferp.K[skey->saferp.rounds*2][9]) & 255;
390 b[10] = (ct[10] - skey->saferp.K[skey->saferp.rounds*2][10]) & 255;
391 b[11] = ct[11] ^ skey->saferp.K[skey->saferp.rounds*2][11];
392 b[12] = ct[12] ^ skey->saferp.K[skey->saferp.rounds*2][12];
393 b[13] = (ct[13] - skey->saferp.K[skey->saferp.rounds*2][13]) & 255;
394 b[14] = (ct[14] - skey->saferp.K[skey->saferp.rounds*2][14]) & 255;
395 b[15] = ct[15] ^ skey->saferp.K[skey->saferp.rounds*2][15];
396 /* 256-bit key? */
397 if (skey->saferp.rounds > 12) {
398 iLT(b, pt); iROUND(pt, 30);
399 iLT(pt, b); iROUND(b, 28);
400 iLT(b, pt); iROUND(pt, 26);
401 iLT(pt, b); iROUND(b, 24);
402 }
403 /* 192-bit key? */
404 if (skey->saferp.rounds > 8) {
405 iLT(b, pt); iROUND(pt, 22);
406 iLT(pt, b); iROUND(b, 20);
407 iLT(b, pt); iROUND(pt, 18);
408 iLT(pt, b); iROUND(b, 16);
409 }
410 iLT(b, pt); iROUND(pt, 14);
411 iLT(pt, b); iROUND(b, 12);
412 iLT(b, pt); iROUND(pt,10);
413 iLT(pt, b); iROUND(b, 8);
414 iLT(b, pt); iROUND(pt,6);
415 iLT(pt, b); iROUND(b, 4);
416 iLT(b, pt); iROUND(pt,2);
417 iLT(pt, b); iROUND(b, 0);
418 for (x = 0; x < 16; x++) {
419 pt[x] = b[x];
420 }
421 #ifdef CLEAN_STACK
422 zeromem(b, sizeof(b));
423 #endif
424 }
425
426 int saferp_test(void)
427 {
428 #ifndef LTC_TEST
429 return CRYPT_NOP;
430 #else
431 static const struct {
432 int keylen;
433 unsigned char key[32], pt[16], ct[16];
434 } tests[] = {
435 {
436 16,
437 { 41, 35, 190, 132, 225, 108, 214, 174,
438 82, 144, 73, 241, 241, 187, 233, 235 },
439 { 179, 166, 219, 60, 135, 12, 62, 153,
440 36, 94, 13, 28, 6, 183, 71, 222 },
441 { 224, 31, 182, 10, 12, 255, 84, 70,
442 127, 13, 89, 249, 9, 57, 165, 220 }
443 }, {
444 24,
445 { 72, 211, 143, 117, 230, 217, 29, 42,
446 229, 192, 247, 43, 120, 129, 135, 68,
447 14, 95, 80, 0, 212, 97, 141, 190 },
448 { 123, 5, 21, 7, 59, 51, 130, 31,
449 24, 112, 146, 218, 100, 84, 206, 177 },
450 { 92, 136, 4, 63, 57, 95, 100, 0,
451 150, 130, 130, 16, 193, 111, 219, 133 }
452 }, {
453 32,
454 { 243, 168, 141, 254, 190, 242, 235, 113,
455 255, 160, 208, 59, 117, 6, 140, 126,
456 135, 120, 115, 77, 208, 190, 130, 190,
457 219, 194, 70, 65, 43, 140, 250, 48 },
458 { 127, 112, 240, 167, 84, 134, 50, 149,
459 170, 91, 104, 19, 11, 230, 252, 245 },
460 { 88, 11, 25, 36, 172, 229, 202, 213,
461 170, 65, 105, 153, 220, 104, 153, 138 }
462 }
463 };
464
465 unsigned char tmp[2][16];
466 symmetric_key skey;
467 int err, i, y;
468
469 for (i = 0; i < (int)(sizeof(tests) / sizeof(tests[0])); i++) {
470 if ((err = saferp_setup(tests[i].key, tests[i].keylen, 0, &skey)) != CRYPT_OK) {
471 return err;
472 }
473 saferp_ecb_encrypt(tests[i].pt, tmp[0], &skey);
474 saferp_ecb_decrypt(tmp[0], tmp[1], &skey);
475
476 /* compare */
477 if (memcmp(tmp[0], tests[i].ct, 16) || memcmp(tmp[1], tests[i].pt, 16)) {
478 return CRYPT_FAIL_TESTVECTOR;
479 }
480
481 /* now see if we can encrypt all zero bytes 1000 times, decrypt and come back where we started */
482 for (y = 0; y < 16; y++) tmp[0][y] = 0;
483 for (y = 0; y < 1000; y++) saferp_ecb_encrypt(tmp[0], tmp[0], &skey);
484 for (y = 0; y < 1000; y++) saferp_ecb_decrypt(tmp[0], tmp[0], &skey);
485 for (y = 0; y < 16; y++) if (tmp[0][y] != 0) return CRYPT_FAIL_TESTVECTOR;
486 }
487
488 return CRYPT_OK;
489 #endif
490 }
491
492 int saferp_keysize(int *desired_keysize)
493 {
494 _ARGCHK(desired_keysize != NULL);
495
496 if (*desired_keysize < 16)
497 return CRYPT_INVALID_KEYSIZE;
498 if (*desired_keysize < 24) {
499 *desired_keysize = 16;
500 } else if (*desired_keysize < 32) {
501 *desired_keysize = 24;
502 } else {
503 *desired_keysize = 32;
504 }
505 return CRYPT_OK;
506 }
507
508 #endif
509
510