Mercurial > dropbear

comparison serpent.c @ 0:d7da3b1e1540 libtomcrypt

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
put back the 0.95 makefile which was inadvertently merged over
author Matt Johnston <matt@ucc.asn.au>
date Mon, 31 May 2004 18:21:40 +0000
parents
children
comparison
equal deleted inserted replaced
-1:000000000000 0:d7da3b1e1540
1 #include "mycrypt.h"
2
3 #ifdef SERPENT
4
5 const struct _cipher_descriptor serpent_desc =
6 {
7 "serpent",
8 5,
9 16, 32, 16, 32,
10 &serpent_setup,
11 &serpent_ecb_encrypt,
12 &serpent_ecb_decrypt,
13 &serpent_test,
14 &serpent_keysize
15 };
16
17 /* These defines are derived from Brian Gladman's work. Contact him at [email protected]
18 *
19 * Available on the web at http://fp.gladman.plus.com/cryptography_technology/aes/index.htm
20 */
21 #define sb0(a,b,c,d,e,f,g,h) \
22 t1 = a ^ d; \
23 t2 = a & d; \
24 t3 = c ^ t1; \
25 t6 = b & t1; \
26 t4 = b ^ t3; \
27 t10 = ~t3; \
28 h = t2 ^ t4; \
29 t7 = a ^ t6; \
30 t14 = ~t7; \
31 t8 = c | t7; \
32 t11 = t3 ^ t7; \
33 g = t4 ^ t8; \
34 t12 = h & t11; \
35 f = t10 ^ t12; \
36 e = t12 ^ t14
37
38 /* 15 terms */
39
40 #define ib0(a,b,c,d,e,f,g,h) \
41 t1 = ~a; \
42 t2 = a ^ b; \
43 t3 = t1 | t2; \
44 t4 = d ^ t3; \
45 t7 = d & t2; \
46 t5 = c ^ t4; \
47 t8 = t1 ^ t7; \
48 g = t2 ^ t5; \
49 t11 = a & t4; \
50 t9 = g & t8; \
51 t14 = t5 ^ t8; \
52 f = t4 ^ t9; \
53 t12 = t5 | f; \
54 h = t11 ^ t12; \
55 e = h ^ t14
56
57 /* 14 terms! */
58
59 #define sb1(a,b,c,d,e,f,g,h) \
60 t1 = ~a; \
61 t2 = b ^ t1; \
62 t3 = a | t2; \
63 t4 = d | t2; \
64 t5 = c ^ t3; \
65 g = d ^ t5; \
66 t7 = b ^ t4; \
67 t8 = t2 ^ g; \
68 t9 = t5 & t7; \
69 h = t8 ^ t9; \
70 t11 = t5 ^ t7; \
71 f = h ^ t11; \
72 t13 = t8 & t11; \
73 e = t5 ^ t13
74
75 /* 17 terms */
76
77 #define ib1(a,b,c,d,e,f,g,h) \
78 t1 = a ^ d; \
79 t2 = a & b; \
80 t3 = b ^ c; \
81 t4 = a ^ t3; \
82 t5 = b | d; \
83 t7 = c | t1; \
84 h = t4 ^ t5; \
85 t8 = b ^ t7; \
86 t11 = ~t2; \
87 t9 = t4 & t8; \
88 f = t1 ^ t9; \
89 t13 = t9 ^ t11; \
90 t12 = h & f; \
91 g = t12 ^ t13; \
92 t15 = a & d; \
93 t16 = c ^ t13; \
94 e = t15 ^ t16
95
96 /* 16 terms */
97
98 #define sb2(a,b,c,d,e,f,g,h) \
99 t1 = ~a; \
100 t2 = b ^ d; \
101 t3 = c & t1; \
102 t13 = d | t1; \
103 e = t2 ^ t3; \
104 t5 = c ^ t1; \
105 t6 = c ^ e; \
106 t7 = b & t6; \
107 t10 = e | t5; \
108 h = t5 ^ t7; \
109 t9 = d | t7; \
110 t11 = t9 & t10; \
111 t14 = t2 ^ h; \
112 g = a ^ t11; \
113 t15 = g ^ t13; \
114 f = t14 ^ t15
115
116 /* 16 terms */
117
118 #define ib2(a,b,c,d,e,f,g,h) \
119 t1 = b ^ d; \
120 t2 = ~t1; \
121 t3 = a ^ c; \
122 t4 = c ^ t1; \
123 t7 = a | t2; \
124 t5 = b & t4; \
125 t8 = d ^ t7; \
126 t11 = ~t4; \
127 e = t3 ^ t5; \
128 t9 = t3 | t8; \
129 t14 = d & t11; \
130 h = t1 ^ t9; \
131 t12 = e | h; \
132 f = t11 ^ t12; \
133 t15 = t3 ^ t12; \
134 g = t14 ^ t15
135
136 /* 17 terms */
137
138 #define sb3(a,b,c,d,e,f,g,h) \
139 t1 = a ^ c; \
140 t2 = d ^ t1; \
141 t3 = a & t2; \
142 t4 = d ^ t3; \
143 t5 = b & t4; \
144 g = t2 ^ t5; \
145 t7 = a | g; \
146 t8 = b | d; \
147 t11 = a | d; \
148 t9 = t4 & t7; \
149 f = t8 ^ t9; \
150 t12 = b ^ t11; \
151 t13 = g ^ t9; \
152 t15 = t3 ^ t8; \
153 h = t12 ^ t13; \
154 t16 = c & t15; \
155 e = t12 ^ t16
156
157 /* 16 term solution that performs less well than 17 term one
158 in my environment (PPro/PII)
159
160 #define sb3(a,b,c,d,e,f,g,h) \
161 t1 = a ^ b; \
162 t2 = a & c; \
163 t3 = a | d; \
164 t4 = c ^ d; \
165 t5 = t1 & t3; \
166 t6 = t2 | t5; \
167 g = t4 ^ t6; \
168 t8 = b ^ t3; \
169 t9 = t6 ^ t8; \
170 t10 = t4 & t9; \
171 e = t1 ^ t10; \
172 t12 = g & e; \
173 f = t9 ^ t12; \
174 t14 = b | d; \
175 t15 = t4 ^ t12; \
176 h = t14 ^ t15
177 */
178
179 /* 17 terms */
180
181 #define ib3(a,b,c,d,e,f,g,h) \
182 t1 = b ^ c; \
183 t2 = b | c; \
184 t3 = a ^ c; \
185 t7 = a ^ d; \
186 t4 = t2 ^ t3; \
187 t5 = d | t4; \
188 t9 = t2 ^ t7; \
189 e = t1 ^ t5; \
190 t8 = t1 | t5; \
191 t11 = a & t4; \
192 g = t8 ^ t9; \
193 t12 = e | t9; \
194 f = t11 ^ t12; \
195 t14 = a & g; \
196 t15 = t2 ^ t14; \
197 t16 = e & t15; \
198 h = t4 ^ t16
199
200 /* 15 terms */
201
202 #define sb4(a,b,c,d,e,f,g,h) \
203 t1 = a ^ d; \
204 t2 = d & t1; \
205 t3 = c ^ t2; \
206 t4 = b | t3; \
207 h = t1 ^ t4; \
208 t6 = ~b; \
209 t7 = t1 | t6; \
210 e = t3 ^ t7; \
211 t9 = a & e; \
212 t10 = t1 ^ t6; \
213 t11 = t4 & t10; \
214 g = t9 ^ t11; \
215 t13 = a ^ t3; \
216 t14 = t10 & g; \
217 f = t13 ^ t14
218
219 /* 17 terms */
220
221 #define ib4(a,b,c,d,e,f,g,h) \
222 t1 = c ^ d; \
223 t2 = c | d; \
224 t3 = b ^ t2; \
225 t4 = a & t3; \
226 f = t1 ^ t4; \
227 t6 = a ^ d; \
228 t7 = b | d; \
229 t8 = t6 & t7; \
230 h = t3 ^ t8; \
231 t10 = ~a; \
232 t11 = c ^ h; \
233 t12 = t10 | t11;\
234 e = t3 ^ t12; \
235 t14 = c | t4; \
236 t15 = t7 ^ t14; \
237 t16 = h | t10; \
238 g = t15 ^ t16
239
240 /* 16 terms */
241
242 #define sb5(a,b,c,d,e,f,g,h) \
243 t1 = ~a; \
244 t2 = a ^ b; \
245 t3 = a ^ d; \
246 t4 = c ^ t1; \
247 t5 = t2 | t3; \
248 e = t4 ^ t5; \
249 t7 = d & e; \
250 t8 = t2 ^ e; \
251 t10 = t1 | e; \
252 f = t7 ^ t8; \
253 t11 = t2 | t7; \
254 t12 = t3 ^ t10; \
255 t14 = b ^ t7; \
256 g = t11 ^ t12; \
257 t15 = f & t12; \
258 h = t14 ^ t15
259
260 /* 16 terms */
261
262 #define ib5(a,b,c,d,e,f,g,h) \
263 t1 = ~c; \
264 t2 = b & t1; \
265 t3 = d ^ t2; \
266 t4 = a & t3; \
267 t5 = b ^ t1; \
268 h = t4 ^ t5; \
269 t7 = b | h; \
270 t8 = a & t7; \
271 f = t3 ^ t8; \
272 t10 = a | d; \
273 t11 = t1 ^ t7; \
274 e = t10 ^ t11; \
275 t13 = a ^ c; \
276 t14 = b & t10; \
277 t15 = t4 | t13; \
278 g = t14 ^ t15
279
280 /* 15 terms */
281
282 #define sb6(a,b,c,d,e,f,g,h) \
283 t1 = ~a; \
284 t2 = a ^ d; \
285 t3 = b ^ t2; \
286 t4 = t1 | t2; \
287 t5 = c ^ t4; \
288 f = b ^ t5; \
289 t13 = ~t5; \
290 t7 = t2 | f; \
291 t8 = d ^ t7; \
292 t9 = t5 & t8; \
293 g = t3 ^ t9; \
294 t11 = t5 ^ t8; \
295 e = g ^ t11; \
296 t14 = t3 & t11; \
297 h = t13 ^ t14
298
299 /* 15 terms */
300
301 #define ib6(a,b,c,d,e,f,g,h) \
302 t1 = ~a; \
303 t2 = a ^ b; \
304 t3 = c ^ t2; \
305 t4 = c | t1; \
306 t5 = d ^ t4; \
307 t13 = d & t1; \
308 f = t3 ^ t5; \
309 t7 = t3 & t5; \
310 t8 = t2 ^ t7; \
311 t9 = b | t8; \
312 h = t5 ^ t9; \
313 t11 = b | h; \
314 e = t8 ^ t11; \
315 t14 = t3 ^ t11; \
316 g = t13 ^ t14
317
318 /* 17 terms */
319
320 #define sb7(a,b,c,d,e,f,g,h) \
321 t1 = ~c; \
322 t2 = b ^ c; \
323 t3 = b | t1; \
324 t4 = d ^ t3; \
325 t5 = a & t4; \
326 t7 = a ^ d; \
327 h = t2 ^ t5; \
328 t8 = b ^ t5; \
329 t9 = t2 | t8; \
330 t11 = d & t3; \
331 f = t7 ^ t9; \
332 t12 = t5 ^ f; \
333 t15 = t1 | t4; \
334 t13 = h & t12; \
335 g = t11 ^ t13; \
336 t16 = t12 ^ g; \
337 e = t15 ^ t16
338
339 /* 17 terms */
340
341 #define ib7(a,b,c,d,e,f,g,h) \
342 t1 = a & b; \
343 t2 = a | b; \
344 t3 = c | t1; \
345 t4 = d & t2; \
346 h = t3 ^ t4; \
347 t6 = ~d; \
348 t7 = b ^ t4; \
349 t8 = h ^ t6; \
350 t11 = c ^ t7; \
351 t9 = t7 | t8; \
352 f = a ^ t9; \
353 t12 = d | f; \
354 e = t11 ^ t12; \
355 t14 = a & h; \
356 t15 = t3 ^ f; \
357 t16 = e ^ t14; \
358 g = t15 ^ t16
359
360 #define k_xor(r,a,b,c,d) \
361 a ^= skey->serpent.K[4 * (r) + 0]; \
362 b ^= skey->serpent.K[4 * (r) + 1]; \
363 c ^= skey->serpent.K[4 * (r) + 2]; \
364 d ^= skey->serpent.K[4 * (r) + 3]
365
366 #define k_set(r,a,b,c,d) \
367 a = lkey[4 * (r) + 8]; \
368 b = lkey[4 * (r) + 9]; \
369 c = lkey[4 * (r) + 10]; \
370 d = lkey[4 * (r) + 11]
371
372 #define k_get(r,a,b,c,d) \
373 skey->serpent.K[4 * (r) + 0] = a; \
374 skey->serpent.K[4 * (r) + 1] = b; \
375 skey->serpent.K[4 * (r) + 2] = c; \
376 skey->serpent.K[4 * (r) + 3] = d
377
378 /* the linear transformation and its inverse */
379
380 #define rot(a,b,c,d) \
381 a = ROL(a, 13); \
382 c = ROL(c, 3); \
383 d ^= c ^ (a << 3); \
384 b ^= a ^ c; \
385 d = ROL(d, 7); \
386 b = ROL(b, 1); \
387 a ^= b ^ d; \
388 c ^= d ^ (b << 7); \
389 a = ROL(a, 5); \
390 c = ROL(c, 22)
391
392 #define irot(a,b,c,d) \
393 c = ROR(c, 22); \
394 a = ROR(a, 5); \
395 c ^= d ^ (b << 7); \
396 a ^= b ^ d; \
397 d = ROR(d, 7); \
398 b = ROR(b, 1); \
399 d ^= c ^ (a << 3); \
400 b ^= a ^ c; \
401 c = ROR(c, 3); \
402 a = ROR(a, 13)
403
404 #ifdef CLEAN_STACK
405 static int _serpent_setup(const unsigned char *key, int keylen, int num_rounds, symmetric_key *skey)
406 #else
407 int serpent_setup(const unsigned char *key, int keylen, int num_rounds, symmetric_key *skey)
408 #endif
409 {
410 unsigned long lkey[140], t, a, b, c, d, e, f, g, h, x;
411 unsigned long t1,t2,t3,t4,t5,t6,t7,t8,t9,t10,t11,t12,t13,t14,t15,t16;
412 unsigned char buf[32];
413
414 _ARGCHK(key != NULL);
415 _ARGCHK(skey != NULL);
416
417 /* check rounds */
418 if (num_rounds != 0 && num_rounds != 32) {
419 return CRYPT_INVALID_ROUNDS;
420 }
421
422 /* check keylen */
423 if (keylen < 16 || keylen > 32) {
424 return CRYPT_INVALID_KEYSIZE;
425 }
426
427 /* copy key and expand to 32bytes as required */
428 for (x = 0; x < (unsigned long)keylen; x++) {
429 buf[x] = key[x];
430 }
431
432 if (x < 32) {
433 buf[x++] = (unsigned char)0x01;
434 while (x < 32) {
435 buf[x++] = (unsigned char)0;
436 }
437 }
438
439 /* copy key into 32-bit words */
440 for (x = 0; x < 8; x++) {
441 LOAD32L(lkey[x], &buf[x*4]);
442 }
443
444 /* expand using the LFSR to 140 words */
445 for (x = 0; x < 132; x++) {
446 t = lkey[x] ^ lkey[x+3] ^ lkey[x+5] ^ lkey[x+7] ^ x ^ 0x9E3779B9UL;
447 lkey[x + 8] = ROL(t, 11);
448 }
449
450 /* perform the substituions */
451 for (x = 0; x < 32; ) {
452 k_set( x,a,b,c,d);sb3(a,b,c,d,e,f,g,h);k_get( x,e,f,g,h); ++x;
453 k_set( x,a,b,c,d);sb2(a,b,c,d,e,f,g,h);k_get( x,e,f,g,h); ++x;
454 k_set( x,a,b,c,d);sb1(a,b,c,d,e,f,g,h);k_get( x,e,f,g,h); ++x;
455 k_set( x,a,b,c,d);sb0(a,b,c,d,e,f,g,h);k_get( x,e,f,g,h); ++x;
456 k_set( x,a,b,c,d);sb7(a,b,c,d,e,f,g,h);k_get( x,e,f,g,h); ++x;
457 k_set( x,a,b,c,d);sb6(a,b,c,d,e,f,g,h);k_get( x,e,f,g,h); ++x;
458 k_set( x,a,b,c,d);sb5(a,b,c,d,e,f,g,h);k_get( x,e,f,g,h); ++x;
459 k_set( x,a,b,c,d);sb4(a,b,c,d,e,f,g,h);k_get( x,e,f,g,h); ++x;
460 }
461 k_set(32,a,b,c,d);sb3(a,b,c,d,e,f,g,h);k_get(32,e,f,g,h);
462 return CRYPT_OK;
463 }
464
465 #ifdef CLEAN_STACK
466 int serpent_setup(const unsigned char *key, int keylen, int num_rounds, symmetric_key *skey)
467 {
468 int x;
469 x = _serpent_setup(key, keylen, num_rounds, skey);
470 burn_stack(sizeof(unsigned long)*166 + sizeof(unsigned char)*32);
471 return x;
472 }
473 #endif
474
475 #ifdef CLEAN_STACK
476 static void _serpent_ecb_encrypt(const unsigned char *pt, unsigned char *ct, symmetric_key *skey)
477 #else
478 void serpent_ecb_encrypt(const unsigned char *pt, unsigned char *ct, symmetric_key *skey)
479 #endif
480 {
481 unsigned long a,b,c,d,e,f,g,h;
482 unsigned long t1,t2,t3,t4,t5,t6,t7,t8,t9,t10,t11,t12,t13,t14,t15,t16;
483
484 _ARGCHK(pt != NULL);
485 _ARGCHK(ct != NULL);
486 _ARGCHK(skey != NULL);
487
488 LOAD32L(a, &pt[0]);LOAD32L(b, &pt[4]);LOAD32L(c, &pt[8]);LOAD32L(d, &pt[12]);
489 k_xor( 0,a,b,c,d); sb0(a,b,c,d,e,f,g,h); rot(e,f,g,h);
490 k_xor( 1,e,f,g,h); sb1(e,f,g,h,a,b,c,d); rot(a,b,c,d);
491 k_xor( 2,a,b,c,d); sb2(a,b,c,d,e,f,g,h); rot(e,f,g,h);
492 k_xor( 3,e,f,g,h); sb3(e,f,g,h,a,b,c,d); rot(a,b,c,d);
493 k_xor( 4,a,b,c,d); sb4(a,b,c,d,e,f,g,h); rot(e,f,g,h);
494 k_xor( 5,e,f,g,h); sb5(e,f,g,h,a,b,c,d); rot(a,b,c,d);
495 k_xor( 6,a,b,c,d); sb6(a,b,c,d,e,f,g,h); rot(e,f,g,h);
496 k_xor( 7,e,f,g,h); sb7(e,f,g,h,a,b,c,d); rot(a,b,c,d);
497 k_xor( 8,a,b,c,d); sb0(a,b,c,d,e,f,g,h); rot(e,f,g,h);
498 k_xor( 9,e,f,g,h); sb1(e,f,g,h,a,b,c,d); rot(a,b,c,d);
499 k_xor(10,a,b,c,d); sb2(a,b,c,d,e,f,g,h); rot(e,f,g,h);
500 k_xor(11,e,f,g,h); sb3(e,f,g,h,a,b,c,d); rot(a,b,c,d);
501 k_xor(12,a,b,c,d); sb4(a,b,c,d,e,f,g,h); rot(e,f,g,h);
502 k_xor(13,e,f,g,h); sb5(e,f,g,h,a,b,c,d); rot(a,b,c,d);
503 k_xor(14,a,b,c,d); sb6(a,b,c,d,e,f,g,h); rot(e,f,g,h);
504 k_xor(15,e,f,g,h); sb7(e,f,g,h,a,b,c,d); rot(a,b,c,d);
505 k_xor(16,a,b,c,d); sb0(a,b,c,d,e,f,g,h); rot(e,f,g,h);
506 k_xor(17,e,f,g,h); sb1(e,f,g,h,a,b,c,d); rot(a,b,c,d);
507 k_xor(18,a,b,c,d); sb2(a,b,c,d,e,f,g,h); rot(e,f,g,h);
508 k_xor(19,e,f,g,h); sb3(e,f,g,h,a,b,c,d); rot(a,b,c,d);
509 k_xor(20,a,b,c,d); sb4(a,b,c,d,e,f,g,h); rot(e,f,g,h);
510 k_xor(21,e,f,g,h); sb5(e,f,g,h,a,b,c,d); rot(a,b,c,d);
511 k_xor(22,a,b,c,d); sb6(a,b,c,d,e,f,g,h); rot(e,f,g,h);
512 k_xor(23,e,f,g,h); sb7(e,f,g,h,a,b,c,d); rot(a,b,c,d);
513 k_xor(24,a,b,c,d); sb0(a,b,c,d,e,f,g,h); rot(e,f,g,h);
514 k_xor(25,e,f,g,h); sb1(e,f,g,h,a,b,c,d); rot(a,b,c,d);
515 k_xor(26,a,b,c,d); sb2(a,b,c,d,e,f,g,h); rot(e,f,g,h);
516 k_xor(27,e,f,g,h); sb3(e,f,g,h,a,b,c,d); rot(a,b,c,d);
517 k_xor(28,a,b,c,d); sb4(a,b,c,d,e,f,g,h); rot(e,f,g,h);
518 k_xor(29,e,f,g,h); sb5(e,f,g,h,a,b,c,d); rot(a,b,c,d);
519 k_xor(30,a,b,c,d); sb6(a,b,c,d,e,f,g,h); rot(e,f,g,h);
520 k_xor(31,e,f,g,h); sb7(e,f,g,h,a,b,c,d); k_xor(32,a,b,c,d);
521 STORE32L(a, &ct[0]);STORE32L(b, &ct[4]);STORE32L(c, &ct[8]);STORE32L(d, &ct[12]);
522 }
523
524 #ifdef CLEAN_STACK
525 void serpent_ecb_encrypt(const unsigned char *pt, unsigned char *ct, symmetric_key *skey)
526 {
527 _serpent_ecb_encrypt(pt, ct, skey);
528 burn_stack(sizeof(unsigned long)*24);
529 }
530 #endif
531
532 #ifdef CLEAN_STACK
533 static void _serpent_ecb_decrypt(const unsigned char *ct, unsigned char *pt, symmetric_key *skey)
534 #else
535 void serpent_ecb_decrypt(const unsigned char *ct, unsigned char *pt, symmetric_key *skey)
536 #endif
537 {
538 unsigned long a,b,c,d,e,f,g,h;
539 unsigned long t1,t2,t3,t4,t5,t6,t7,t8,t9,t10,t11,t12,t13,t14,t15,t16;
540
541 _ARGCHK(pt != NULL);
542 _ARGCHK(ct != NULL);
543 _ARGCHK(skey != NULL);
544
545 LOAD32L(a, &ct[0]);LOAD32L(b, &ct[4]);LOAD32L(c, &ct[8]);LOAD32L(d, &ct[12]);
546 k_xor(32,a,b,c,d); ib7(a,b,c,d,e,f,g,h); k_xor(31,e,f,g,h);
547 irot(e,f,g,h); ib6(e,f,g,h,a,b,c,d); k_xor(30,a,b,c,d);
548 irot(a,b,c,d); ib5(a,b,c,d,e,f,g,h); k_xor(29,e,f,g,h);
549 irot(e,f,g,h); ib4(e,f,g,h,a,b,c,d); k_xor(28,a,b,c,d);
550 irot(a,b,c,d); ib3(a,b,c,d,e,f,g,h); k_xor(27,e,f,g,h);
551 irot(e,f,g,h); ib2(e,f,g,h,a,b,c,d); k_xor(26,a,b,c,d);
552 irot(a,b,c,d); ib1(a,b,c,d,e,f,g,h); k_xor(25,e,f,g,h);
553 irot(e,f,g,h); ib0(e,f,g,h,a,b,c,d); k_xor(24,a,b,c,d);
554 irot(a,b,c,d); ib7(a,b,c,d,e,f,g,h); k_xor(23,e,f,g,h);
555 irot(e,f,g,h); ib6(e,f,g,h,a,b,c,d); k_xor(22,a,b,c,d);
556 irot(a,b,c,d); ib5(a,b,c,d,e,f,g,h); k_xor(21,e,f,g,h);
557 irot(e,f,g,h); ib4(e,f,g,h,a,b,c,d); k_xor(20,a,b,c,d);
558 irot(a,b,c,d); ib3(a,b,c,d,e,f,g,h); k_xor(19,e,f,g,h);
559 irot(e,f,g,h); ib2(e,f,g,h,a,b,c,d); k_xor(18,a,b,c,d);
560 irot(a,b,c,d); ib1(a,b,c,d,e,f,g,h); k_xor(17,e,f,g,h);
561 irot(e,f,g,h); ib0(e,f,g,h,a,b,c,d); k_xor(16,a,b,c,d);
562 irot(a,b,c,d); ib7(a,b,c,d,e,f,g,h); k_xor(15,e,f,g,h);
563 irot(e,f,g,h); ib6(e,f,g,h,a,b,c,d); k_xor(14,a,b,c,d);
564 irot(a,b,c,d); ib5(a,b,c,d,e,f,g,h); k_xor(13,e,f,g,h);
565 irot(e,f,g,h); ib4(e,f,g,h,a,b,c,d); k_xor(12,a,b,c,d);
566 irot(a,b,c,d); ib3(a,b,c,d,e,f,g,h); k_xor(11,e,f,g,h);
567 irot(e,f,g,h); ib2(e,f,g,h,a,b,c,d); k_xor(10,a,b,c,d);
568 irot(a,b,c,d); ib1(a,b,c,d,e,f,g,h); k_xor( 9,e,f,g,h);
569 irot(e,f,g,h); ib0(e,f,g,h,a,b,c,d); k_xor( 8,a,b,c,d);
570 irot(a,b,c,d); ib7(a,b,c,d,e,f,g,h); k_xor( 7,e,f,g,h);
571 irot(e,f,g,h); ib6(e,f,g,h,a,b,c,d); k_xor( 6,a,b,c,d);
572 irot(a,b,c,d); ib5(a,b,c,d,e,f,g,h); k_xor( 5,e,f,g,h);
573 irot(e,f,g,h); ib4(e,f,g,h,a,b,c,d); k_xor( 4,a,b,c,d);
574 irot(a,b,c,d); ib3(a,b,c,d,e,f,g,h); k_xor( 3,e,f,g,h);
575 irot(e,f,g,h); ib2(e,f,g,h,a,b,c,d); k_xor( 2,a,b,c,d);
576 irot(a,b,c,d); ib1(a,b,c,d,e,f,g,h); k_xor( 1,e,f,g,h);
577 irot(e,f,g,h); ib0(e,f,g,h,a,b,c,d); k_xor( 0,a,b,c,d);
578 STORE32L(a, &pt[0]);STORE32L(b, &pt[4]);STORE32L(c, &pt[8]);STORE32L(d, &pt[12]);
579 }
580
581 #ifdef CLEAN_STACK
582 void serpent_ecb_decrypt(const unsigned char *ct, unsigned char *pt, symmetric_key *skey)
583 {
584 _serpent_ecb_decrypt(ct, pt, skey);
585 burn_stack(sizeof(unsigned long)*24);
586 }
587 #endif
588
589 int serpent_test(void)
590 {
591 static const struct {
592 int keylen;
593 unsigned char key[32], pt[16], ct[16];
594 } tests[] = {
595 {
596 16,
597 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
598 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80,
599 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
600 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
601 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
602 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
603 { 0xdd, 0xd2, 0x6b, 0x98, 0xa5, 0xff, 0xd8, 0x2c,
604 0x05, 0x34, 0x5a, 0x9d, 0xad, 0xbf, 0xaf, 0x49 }
605 },
606 {
607 16,
608 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
609 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
610 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
611 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
612 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
613 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80 },
614 { 0x4a, 0xe9, 0xa2, 0x0b, 0x2b, 0x14, 0xa1, 0x02,
615 0x90, 0xcb, 0xb8, 0x20, 0xb7, 0xff, 0xb5, 0x10 }
616 },
617 {
618 24,
619 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
620 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
621 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
622 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
623 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
624 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08 },
625 { 0xe1, 0x1b, 0x01, 0x52, 0x4e, 0xa1, 0xf4, 0x65,
626 0xa2, 0xa2, 0x00, 0x43, 0xeb, 0x9f, 0x7e, 0x8a }
627 },
628 {
629 32,
630 { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
631 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
632 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
633 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
634 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
635 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
636 { 0xe0, 0x88, 0x5d, 0x44, 0x60, 0x37, 0x34, 0x69,
637 0xd1, 0xfa, 0x6c, 0x36, 0xa6, 0xe1, 0xc5, 0x2f }
638 },
639 {
640 32,
641 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00,
642 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
643 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
644 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
645 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
646 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
647 { 0x17, 0xc6, 0x25, 0x8e, 0x60, 0x09, 0xe2, 0x82,
648 0x66, 0x18, 0x69, 0xd5, 0x25, 0xf7, 0xd2, 0x04 }
649 },
650 {
651 32,
652 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
653 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
654 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
655 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
656 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00,
657 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
658 { 0x9f, 0xe1, 0x43, 0x25, 0x0d, 0x00, 0xe2, 0x56,
659 0x96, 0xb0, 0x1e, 0x0a, 0x2e, 0xd0, 0x5d, 0xb3 }
660 }
661 };
662
663 unsigned char buf[2][16];
664 int x, err;
665 symmetric_key key;
666
667 for (x = 0; x < (int)(sizeof(tests) / sizeof(tests[0])); x++) {
668 /* setup key */
669 if ((err = serpent_setup(tests[x].key, tests[x].keylen, 0, &key))!= CRYPT_OK) {
670 return err;
671 }
672
673 /* encrypt and decrypt */
674 serpent_ecb_encrypt(tests[x].pt, buf[0], &key);
675 serpent_ecb_decrypt(buf[0], buf[1], &key);
676
677 /* compare */
678 if (memcmp(buf[0], tests[x].ct, 16) != 0 || memcmp(buf[1], tests[x].pt, 16) != 0) {
679 return CRYPT_FAIL_TESTVECTOR;
680 }
681 }
682 return CRYPT_OK;
683 }
684
685 int serpent_keysize(int *desired_keysize)
686 {
687 _ARGCHK(desired_keysize != NULL);
688
689 if (*desired_keysize < 16)
690 return CRYPT_INVALID_KEYSIZE;
691 if (*desired_keysize > 32)
692 *desired_keysize = 32;
693 return CRYPT_OK;
694 }
695
696 #endif
697
698