Mercurial > dropbear

comparison twofish.c @ 0:d7da3b1e1540 libtomcrypt

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
put back the 0.95 makefile which was inadvertently merged over
author Matt Johnston <matt@ucc.asn.au>
date Mon, 31 May 2004 18:21:40 +0000
parents
children 8fc624ea2521
comparison
equal deleted inserted replaced
-1:000000000000 0:d7da3b1e1540
1 /* LibTomCrypt, modular cryptographic library -- Tom St Denis
2 *
3 * LibTomCrypt is a library that provides various cryptographic
4 * algorithms in a highly modular and flexible manner.
5 *
6 * The library is free for all purposes without any express
7 * guarantee it works.
8 *
9 * Tom St Denis, [email protected], http://libtomcrypt.org
10 */
11
12 /* Implementation of Twofish by Tom St Denis */
13 #include "mycrypt.h"
14
15 #ifdef TWOFISH
16
17 /* first TWOFISH_ALL_TABLES must ensure TWOFISH_TABLES is defined */
18 #ifdef TWOFISH_ALL_TABLES
19 #ifndef TWOFISH_TABLES
20 #define TWOFISH_TABLES
21 #endif
22 #endif
23
24 const struct _cipher_descriptor twofish_desc =
25 {
26 "twofish",
27 7,
28 16, 32, 16, 16,
29 &twofish_setup,
30 &twofish_ecb_encrypt,
31 &twofish_ecb_decrypt,
32 &twofish_test,
33 &twofish_keysize
34 };
35
36 /* the two polynomials */
37 #define MDS_POLY 0x169
38 #define RS_POLY 0x14D
39
40 /* The 4x4 MDS Linear Transform */
41 static const unsigned char MDS[4][4] = {
42 { 0x01, 0xEF, 0x5B, 0x5B },
43 { 0x5B, 0xEF, 0xEF, 0x01 },
44 { 0xEF, 0x5B, 0x01, 0xEF },
45 { 0xEF, 0x01, 0xEF, 0x5B }
46 };
47
48 /* The 4x8 RS Linear Transform */
49 static const unsigned char RS[4][8] = {
50 { 0x01, 0xA4, 0x55, 0x87, 0x5A, 0x58, 0xDB, 0x9E },
51 { 0xA4, 0x56, 0x82, 0xF3, 0X1E, 0XC6, 0X68, 0XE5 },
52 { 0X02, 0XA1, 0XFC, 0XC1, 0X47, 0XAE, 0X3D, 0X19 },
53 { 0XA4, 0X55, 0X87, 0X5A, 0X58, 0XDB, 0X9E, 0X03 }
54 };
55
56 /* sbox usage orderings */
57 static const unsigned char qord[4][5] = {
58 { 1, 1, 0, 0, 1 },
59 { 0, 1, 1, 0, 0 },
60 { 0, 0, 0, 1, 1 },
61 { 1, 0, 1, 1, 0 }
62 };
63
64 #ifdef TWOFISH_TABLES
65
66 #include "twofish_tab.c"
67
68 #define sbox(i, x) ((ulong32)SBOX[i][(x)&255])
69
70 #else
71
72 /* The Q-box tables */
73 static const unsigned char qbox[2][4][16] = {
74 {
75 { 0x8, 0x1, 0x7, 0xD, 0x6, 0xF, 0x3, 0x2, 0x0, 0xB, 0x5, 0x9, 0xE, 0xC, 0xA, 0x4 },
76 { 0xE, 0XC, 0XB, 0X8, 0X1, 0X2, 0X3, 0X5, 0XF, 0X4, 0XA, 0X6, 0X7, 0X0, 0X9, 0XD },
77 { 0XB, 0XA, 0X5, 0XE, 0X6, 0XD, 0X9, 0X0, 0XC, 0X8, 0XF, 0X3, 0X2, 0X4, 0X7, 0X1 },
78 { 0XD, 0X7, 0XF, 0X4, 0X1, 0X2, 0X6, 0XE, 0X9, 0XB, 0X3, 0X0, 0X8, 0X5, 0XC, 0XA }
79 },
80 {
81 { 0X2, 0X8, 0XB, 0XD, 0XF, 0X7, 0X6, 0XE, 0X3, 0X1, 0X9, 0X4, 0X0, 0XA, 0XC, 0X5 },
82 { 0X1, 0XE, 0X2, 0XB, 0X4, 0XC, 0X3, 0X7, 0X6, 0XD, 0XA, 0X5, 0XF, 0X9, 0X0, 0X8 },
83 { 0X4, 0XC, 0X7, 0X5, 0X1, 0X6, 0X9, 0XA, 0X0, 0XE, 0XD, 0X8, 0X2, 0XB, 0X3, 0XF },
84 { 0xB, 0X9, 0X5, 0X1, 0XC, 0X3, 0XD, 0XE, 0X6, 0X4, 0X7, 0XF, 0X2, 0X0, 0X8, 0XA }
85 }
86 };
87
88 /* computes S_i[x] */
89 #ifdef CLEAN_STACK
90 static ulong32 _sbox(int i, ulong32 x)
91 #else
92 static ulong32 sbox(int i, ulong32 x)
93 #endif
94 {
95 unsigned char a0,b0,a1,b1,a2,b2,a3,b3,a4,b4,y;
96
97 /* a0,b0 = [x/16], x mod 16 */
98 a0 = (unsigned char)((x>>4)&15);
99 b0 = (unsigned char)((x)&15);
100
101 /* a1 = a0 ^ b0 */
102 a1 = a0 ^ b0;
103
104 /* b1 = a0 ^ ROR(b0, 1) ^ 8a0 */
105 b1 = (a0 ^ ((b0<<3)|(b0>>1)) ^ (a0<<3)) & 15;
106
107 /* a2,b2 = t0[a1], t1[b1] */
108 a2 = qbox[i][0][(int)a1];
109 b2 = qbox[i][1][(int)b1];
110
111 /* a3 = a2 ^ b2 */
112 a3 = a2 ^ b2;
113
114 /* b3 = a2 ^ ROR(b2, 1) ^ 8a2 */
115 b3 = (a2 ^ ((b2<<3)|(b2>>1)) ^ (a2<<3)) & 15;
116
117 /* a4,b4 = t2[a3], t3[b3] */
118 a4 = qbox[i][2][(int)a3];
119 b4 = qbox[i][3][(int)b3];
120
121 /* y = 16b4 + a4 */
122 y = (b4 << 4) + a4;
123
124 /* return result */
125 return (ulong32)y;
126 }
127
128 #ifdef CLEAN_STACK
129 static ulong32 sbox(int i, ulong32 x)
130 {
131 ulong32 y;
132 y = _sbox(i, x);
133 burn_stack(sizeof(unsigned char) * 11);
134 return y;
135 }
136 #endif /* CLEAN_STACK */
137
138 #endif /* TWOFISH_TABLES */
139
140 /* computes ab mod p */
141 static ulong32 gf_mult(ulong32 a, ulong32 b, ulong32 p)
142 {
143 ulong32 result, B[2], P[2];
144
145 P[1] = p;
146 B[1] = b;
147 result = P[0] = B[0] = 0;
148
149 /* unrolled branchless GF multiplier */
150 result ^= B[a&1]; a >>= 1; B[1] = P[B[1]>>7] ^ (B[1] << 1);
151 result ^= B[a&1]; a >>= 1; B[1] = P[B[1]>>7] ^ (B[1] << 1);
152 result ^= B[a&1]; a >>= 1; B[1] = P[B[1]>>7] ^ (B[1] << 1);
153 result ^= B[a&1]; a >>= 1; B[1] = P[B[1]>>7] ^ (B[1] << 1);
154 result ^= B[a&1]; a >>= 1; B[1] = P[B[1]>>7] ^ (B[1] << 1);
155 result ^= B[a&1]; a >>= 1; B[1] = P[B[1]>>7] ^ (B[1] << 1);
156 result ^= B[a&1]; a >>= 1; B[1] = P[B[1]>>7] ^ (B[1] << 1);
157 result ^= B[a&1];
158
159 return result;
160 }
161
162 /* computes [y0 y1 y2 y3] = MDS . [x0] */
163 #ifndef TWOFISH_TABLES
164 static ulong32 mds_column_mult(unsigned char in, int col)
165 {
166 ulong32 x01, x5B, xEF;
167
168 x01 = in;
169 x5B = gf_mult(in, 0x5B, MDS_POLY);
170 xEF = gf_mult(in, 0xEF, MDS_POLY);
171
172 switch (col) {
173 case 0:
174 return (x01 << 0 ) |
175 (x5B << 8 ) |
176 (xEF << 16) |
177 (xEF << 24);
178 case 1:
179 return (xEF << 0 ) |
180 (xEF << 8 ) |
181 (x5B << 16) |
182 (x01 << 24);
183 case 2:
184 return (x5B << 0 ) |
185 (xEF << 8 ) |
186 (x01 << 16) |
187 (xEF << 24);
188 case 3:
189 return (x5B << 0 ) |
190 (x01 << 8 ) |
191 (xEF << 16) |
192 (x5B << 24);
193 }
194 /* avoid warnings, we'd never get here normally but just to calm compiler warnings... */
195 return 0;
196 }
197
198 #else /* !TWOFISH_TABLES */
199
200 #define mds_column_mult(x, i) mds_tab[i][x]
201
202 #endif /* TWOFISH_TABLES */
203
204 /* Computes [y0 y1 y2 y3] = MDS . [x0 x1 x2 x3] */
205 static void mds_mult(const unsigned char *in, unsigned char *out)
206 {
207 int x;
208 ulong32 tmp;
209 for (tmp = x = 0; x < 4; x++) {
210 tmp ^= mds_column_mult(in[x], x);
211 }
212 STORE32L(tmp, out);
213 }
214
215 #ifdef TWOFISH_ALL_TABLES
216 /* computes [y0 y1 y2 y3] = RS . [x0 x1 x2 x3 x4 x5 x6 x7] */
217 static void rs_mult(const unsigned char *in, unsigned char *out)
218 {
219 ulong32 tmp;
220 tmp = rs_tab0[in[0]] ^ rs_tab1[in[1]] ^ rs_tab2[in[2]] ^ rs_tab3[in[3]] ^
221 rs_tab4[in[4]] ^ rs_tab5[in[5]] ^ rs_tab6[in[6]] ^ rs_tab7[in[7]];
222 STORE32L(tmp, out);
223 }
224
225 #else /* !TWOFISH_ALL_TABLES */
226
227 /* computes [y0 y1 y2 y3] = RS . [x0 x1 x2 x3 x4 x5 x6 x7] */
228 static void rs_mult(const unsigned char *in, unsigned char *out)
229 {
230 int x, y;
231 for (x = 0; x < 4; x++) {
232 out[x] = 0;
233 for (y = 0; y < 8; y++) {
234 out[x] ^= gf_mult(in[y], RS[x][y], RS_POLY);
235 }
236 }
237 }
238
239 #endif
240
241 /* computes h(x) */
242 static void h_func(const unsigned char *in, unsigned char *out, unsigned char *M, int k, int offset)
243 {
244 int x;
245 unsigned char y[4];
246 for (x = 0; x < 4; x++) {
247 y[x] = in[x];
248 }
249 switch (k) {
250 case 4:
251 y[0] = (unsigned char)(sbox(1, (ulong32)y[0]) ^ M[4 * (6 + offset) + 0]);
252 y[1] = (unsigned char)(sbox(0, (ulong32)y[1]) ^ M[4 * (6 + offset) + 1]);
253 y[2] = (unsigned char)(sbox(0, (ulong32)y[2]) ^ M[4 * (6 + offset) + 2]);
254 y[3] = (unsigned char)(sbox(1, (ulong32)y[3]) ^ M[4 * (6 + offset) + 3]);
255 case 3:
256 y[0] = (unsigned char)(sbox(1, (ulong32)y[0]) ^ M[4 * (4 + offset) + 0]);
257 y[1] = (unsigned char)(sbox(1, (ulong32)y[1]) ^ M[4 * (4 + offset) + 1]);
258 y[2] = (unsigned char)(sbox(0, (ulong32)y[2]) ^ M[4 * (4 + offset) + 2]);
259 y[3] = (unsigned char)(sbox(0, (ulong32)y[3]) ^ M[4 * (4 + offset) + 3]);
260 case 2:
261 y[0] = (unsigned char)(sbox(1, sbox(0, sbox(0, (ulong32)y[0]) ^ M[4 * (2 + offset) + 0]) ^ M[4 * (0 + offset) + 0]));
262 y[1] = (unsigned char)(sbox(0, sbox(0, sbox(1, (ulong32)y[1]) ^ M[4 * (2 + offset) + 1]) ^ M[4 * (0 + offset) + 1]));
263 y[2] = (unsigned char)(sbox(1, sbox(1, sbox(0, (ulong32)y[2]) ^ M[4 * (2 + offset) + 2]) ^ M[4 * (0 + offset) + 2]));
264 y[3] = (unsigned char)(sbox(0, sbox(1, sbox(1, (ulong32)y[3]) ^ M[4 * (2 + offset) + 3]) ^ M[4 * (0 + offset) + 3]));
265 }
266 mds_mult(y, out);
267 }
268
269 #ifndef TWOFISH_SMALL
270
271 /* for GCC we don't use pointer aliases */
272 #if defined(__GNUC__)
273 #define S1 key->twofish.S[0]
274 #define S2 key->twofish.S[1]
275 #define S3 key->twofish.S[2]
276 #define S4 key->twofish.S[3]
277 #endif
278
279 /* the G function */
280 #define g_func(x, dum) (S1[byte(x,0)] ^ S2[byte(x,1)] ^ S3[byte(x,2)] ^ S4[byte(x,3)])
281 #define g1_func(x, dum) (S2[byte(x,0)] ^ S3[byte(x,1)] ^ S4[byte(x,2)] ^ S1[byte(x,3)])
282
283 #else
284
285 #ifdef CLEAN_STACK
286 static ulong32 _g_func(ulong32 x, symmetric_key *key)
287 #else
288 static ulong32 g_func(ulong32 x, symmetric_key *key)
289 #endif
290 {
291 unsigned char g, i, y, z;
292 ulong32 res;
293
294 res = 0;
295 for (y = 0; y < 4; y++) {
296 z = key->twofish.start;
297
298 /* do unkeyed substitution */
299 g = sbox(qord[y][z++], (x >> (8*y)) & 255);
300
301 /* first subkey */
302 i = 0;
303
304 /* do key mixing+sbox until z==5 */
305 while (z != 5) {
306 g = g ^ key->twofish.S[4*i++ + y];
307 g = sbox(qord[y][z++], g);
308 }
309
310 /* multiply g by a column of the MDS */
311 res ^= mds_column_mult(g, y);
312 }
313 return res;
314 }
315
316 #define g1_func(x, key) g_func(ROL(x, 8), key)
317
318 #ifdef CLEAN_STACK
319 static ulong32 g_func(ulong32 x, symmetric_key *key)
320 {
321 ulong32 y;
322 y = _g_func(x, key);
323 burn_stack(sizeof(unsigned char) * 4 + sizeof(ulong32));
324 return y;
325 }
326 #endif /* CLEAN_STACK */
327
328 #endif /* TWOFISH_SMALL */
329
330 #ifdef CLEAN_STACK
331 static int _twofish_setup(const unsigned char *key, int keylen, int num_rounds, symmetric_key *skey)
332 #else
333 int twofish_setup(const unsigned char *key, int keylen, int num_rounds, symmetric_key *skey)
334 #endif
335 {
336 #ifndef TWOFISH_SMALL
337 unsigned char S[4*4], tmpx0, tmpx1;
338 #endif
339 int k, x, y;
340 unsigned char tmp[4], tmp2[4], M[8*4];
341 ulong32 A, B;
342
343 _ARGCHK(key != NULL);
344 _ARGCHK(skey != NULL);
345
346 /* invalid arguments? */
347 if (num_rounds != 16 && num_rounds != 0) {
348 return CRYPT_INVALID_ROUNDS;
349 }
350
351 if (keylen != 16 && keylen != 24 && keylen != 32) {
352 return CRYPT_INVALID_KEYSIZE;
353 }
354
355 /* k = keysize/64 [but since our keysize is in bytes...] */
356 k = keylen / 8;
357
358 /* copy the key into M */
359 for (x = 0; x < keylen; x++) {
360 M[x] = key[x] & 255;
361 }
362
363 /* create the S[..] words */
364 #ifndef TWOFISH_SMALL
365 for (x = 0; x < k; x++) {
366 rs_mult(M+(x*8), S+(x*4));
367 }
368 #else
369 for (x = 0; x < k; x++) {
370 rs_mult(M+(x*8), skey->twofish.S+(x*4));
371 }
372 #endif
373
374 /* make subkeys */
375 for (x = 0; x < 20; x++) {
376 /* A = h(p * 2x, Me) */
377 for (y = 0; y < 4; y++) {
378 tmp[y] = x+x;
379 }
380 h_func(tmp, tmp2, M, k, 0);
381 LOAD32L(A, tmp2);
382
383 /* B = ROL(h(p * (2x + 1), Mo), 8) */
384 for (y = 0; y < 4; y++) {
385 tmp[y] = (unsigned char)(x+x+1);
386 }
387 h_func(tmp, tmp2, M, k, 1);
388 LOAD32L(B, tmp2);
389 B = ROL(B, 8);
390
391 /* K[2i] = A + B */
392 skey->twofish.K[x+x] = (A + B) & 0xFFFFFFFFUL;
393
394 /* K[2i+1] = (A + 2B) <<< 9 */
395 skey->twofish.K[x+x+1] = ROL(B + B + A, 9);
396 }
397
398 #ifndef TWOFISH_SMALL
399 /* make the sboxes (large ram variant) */
400 if (k == 2) {
401 for (x = 0; x < 256; x++) {
402 tmpx0 = sbox(0, x);
403 tmpx1 = sbox(1, x);
404 skey->twofish.S[0][x] = mds_column_mult(sbox(1, (sbox(0, tmpx0 ^ S[0]) ^ S[4])),0);
405 skey->twofish.S[1][x] = mds_column_mult(sbox(0, (sbox(0, tmpx1 ^ S[1]) ^ S[5])),1);
406 skey->twofish.S[2][x] = mds_column_mult(sbox(1, (sbox(1, tmpx0 ^ S[2]) ^ S[6])),2);
407 skey->twofish.S[3][x] = mds_column_mult(sbox(0, (sbox(1, tmpx1 ^ S[3]) ^ S[7])),3);
408 }
409 } else if (k == 3) {
410 for (x = 0; x < 256; x++) {
411 tmpx0 = sbox(0, x);
412 tmpx1 = sbox(1, x);
413 skey->twofish.S[0][x] = mds_column_mult(sbox(1, (sbox(0, sbox(0, tmpx1 ^ S[0]) ^ S[4]) ^ S[8])),0);
414 skey->twofish.S[1][x] = mds_column_mult(sbox(0, (sbox(0, sbox(1, tmpx1 ^ S[1]) ^ S[5]) ^ S[9])),1);
415 skey->twofish.S[2][x] = mds_column_mult(sbox(1, (sbox(1, sbox(0, tmpx0 ^ S[2]) ^ S[6]) ^ S[10])),2);
416 skey->twofish.S[3][x] = mds_column_mult(sbox(0, (sbox(1, sbox(1, tmpx0 ^ S[3]) ^ S[7]) ^ S[11])),3);
417 }
418 } else {
419 for (x = 0; x < 256; x++) {
420 tmpx0 = sbox(0, x);
421 tmpx1 = sbox(1, x);
422 skey->twofish.S[0][x] = mds_column_mult(sbox(1, (sbox(0, sbox(0, sbox(1, tmpx1 ^ S[0]) ^ S[4]) ^ S[8]) ^ S[12])),0);
423 skey->twofish.S[1][x] = mds_column_mult(sbox(0, (sbox(0, sbox(1, sbox(1, tmpx0 ^ S[1]) ^ S[5]) ^ S[9]) ^ S[13])),1);
424 skey->twofish.S[2][x] = mds_column_mult(sbox(1, (sbox(1, sbox(0, sbox(0, tmpx0 ^ S[2]) ^ S[6]) ^ S[10]) ^ S[14])),2);
425 skey->twofish.S[3][x] = mds_column_mult(sbox(0, (sbox(1, sbox(1, sbox(0, tmpx1 ^ S[3]) ^ S[7]) ^ S[11]) ^ S[15])),3);
426 }
427 }
428 #else
429 /* where to start in the sbox layers */
430 /* small ram variant */
431 switch (k) {
432 case 4 : skey->twofish.start = 0; break;
433 case 3 : skey->twofish.start = 1; break;
434 default: skey->twofish.start = 2; break;
435 }
436 #endif
437 return CRYPT_OK;
438 }
439
440 #ifdef CLEAN_STACK
441 int twofish_setup(const unsigned char *key, int keylen, int num_rounds, symmetric_key *skey)
442 {
443 int x;
444 x = _twofish_setup(key, keylen, num_rounds, skey);
445 burn_stack(sizeof(int) * 7 + sizeof(unsigned char) * 56 + sizeof(ulong32) * 2);
446 return x;
447 }
448 #endif
449
450 #ifdef CLEAN_STACK
451 static void _twofish_ecb_encrypt(const unsigned char *pt, unsigned char *ct, symmetric_key *key)
452 #else
453 void twofish_ecb_encrypt(const unsigned char *pt, unsigned char *ct, symmetric_key *key)
454 #endif
455 {
456 ulong32 a,b,c,d,ta,tb,tc,td,t1,t2, *k;
457 int r;
458 #if !defined(TWOFISH_SMALL) && !defined(__GNUC__)
459 ulong32 *S1, *S2, *S3, *S4;
460 #endif
461
462 _ARGCHK(pt != NULL);
463 _ARGCHK(ct != NULL);
464 _ARGCHK(key != NULL);
465
466 #if !defined(TWOFISH_SMALL) && !defined(__GNUC__)
467 S1 = key->twofish.S[0];
468 S2 = key->twofish.S[1];
469 S3 = key->twofish.S[2];
470 S4 = key->twofish.S[3];
471 #endif
472
473 LOAD32L(a,&pt[0]); LOAD32L(b,&pt[4]);
474 LOAD32L(c,&pt[8]); LOAD32L(d,&pt[12]);
475 a ^= key->twofish.K[0];
476 b ^= key->twofish.K[1];
477 c ^= key->twofish.K[2];
478 d ^= key->twofish.K[3];
479
480 k = key->twofish.K + 8;
481 for (r = 8; r != 0; --r) {
482 t2 = g1_func(b, key);
483 t1 = g_func(a, key) + t2;
484 c = ROR(c ^ (t1 + k[0]), 1);
485 d = ROL(d, 1) ^ (t2 + t1 + k[1]);
486
487 t2 = g1_func(d, key);
488 t1 = g_func(c, key) + t2;
489 a = ROR(a ^ (t1 + k[2]), 1);
490 b = ROL(b, 1) ^ (t2 + t1 + k[3]);
491 k += 4;
492 }
493
494 /* output with "undo last swap" */
495 ta = c ^ key->twofish.K[4];
496 tb = d ^ key->twofish.K[5];
497 tc = a ^ key->twofish.K[6];
498 td = b ^ key->twofish.K[7];
499
500 /* store output */
501 STORE32L(ta,&ct[0]); STORE32L(tb,&ct[4]);
502 STORE32L(tc,&ct[8]); STORE32L(td,&ct[12]);
503 }
504
505 #ifdef CLEAN_STACK
506 void twofish_ecb_encrypt(const unsigned char *pt, unsigned char *ct, symmetric_key *key)
507 {
508 _twofish_ecb_encrypt(pt, ct, key);
509 burn_stack(sizeof(ulong32) * 10 + sizeof(int));
510 }
511 #endif
512
513 #ifdef CLEAN_STACK
514 static void _twofish_ecb_decrypt(const unsigned char *ct, unsigned char *pt, symmetric_key *key)
515 #else
516 void twofish_ecb_decrypt(const unsigned char *ct, unsigned char *pt, symmetric_key *key)
517 #endif
518 {
519 ulong32 a,b,c,d,ta,tb,tc,td,t1,t2, *k;
520 int r;
521 #if !defined(TWOFISH_SMALL) && !defined(__GNUC__)
522 ulong32 *S1, *S2, *S3, *S4;
523 #endif
524
525 _ARGCHK(pt != NULL);
526 _ARGCHK(ct != NULL);
527 _ARGCHK(key != NULL);
528
529 #if !defined(TWOFISH_SMALL) && !defined(__GNUC__)
530 S1 = key->twofish.S[0];
531 S2 = key->twofish.S[1];
532 S3 = key->twofish.S[2];
533 S4 = key->twofish.S[3];
534 #endif
535
536 /* load input */
537 LOAD32L(ta,&ct[0]); LOAD32L(tb,&ct[4]);
538 LOAD32L(tc,&ct[8]); LOAD32L(td,&ct[12]);
539
540 /* undo undo final swap */
541 a = tc ^ key->twofish.K[6];
542 b = td ^ key->twofish.K[7];
543 c = ta ^ key->twofish.K[4];
544 d = tb ^ key->twofish.K[5];
545
546 k = key->twofish.K + 36;
547 for (r = 8; r != 0; --r) {
548 t2 = g1_func(d, key);
549 t1 = g_func(c, key) + t2;
550 a = ROL(a, 1) ^ (t1 + k[2]);
551 b = ROR(b ^ (t2 + t1 + k[3]), 1);
552
553 t2 = g1_func(b, key);
554 t1 = g_func(a, key) + t2;
555 c = ROL(c, 1) ^ (t1 + k[0]);
556 d = ROR(d ^ (t2 + t1 + k[1]), 1);
557 k -= 4;
558 }
559
560 /* pre-white */
561 a ^= key->twofish.K[0];
562 b ^= key->twofish.K[1];
563 c ^= key->twofish.K[2];
564 d ^= key->twofish.K[3];
565
566 /* store */
567 STORE32L(a, &pt[0]); STORE32L(b, &pt[4]);
568 STORE32L(c, &pt[8]); STORE32L(d, &pt[12]);
569 }
570
571 #ifdef CLEAN_STACK
572 void twofish_ecb_decrypt(const unsigned char *ct, unsigned char *pt, symmetric_key *key)
573 {
574 _twofish_ecb_decrypt(ct, pt, key);
575 burn_stack(sizeof(ulong32) * 10 + sizeof(int));
576 }
577 #endif
578
579 int twofish_test(void)
580 {
581 #ifndef LTC_TEST
582 return CRYPT_NOP;
583 #else
584 static const struct {
585 int keylen;
586 unsigned char key[32], pt[16], ct[16];
587 } tests[] = {
588 { 16,
589 { 0x9F, 0x58, 0x9F, 0x5C, 0xF6, 0x12, 0x2C, 0x32,
590 0xB6, 0xBF, 0xEC, 0x2F, 0x2A, 0xE8, 0xC3, 0x5A },
591 { 0xD4, 0x91, 0xDB, 0x16, 0xE7, 0xB1, 0xC3, 0x9E,
592 0x86, 0xCB, 0x08, 0x6B, 0x78, 0x9F, 0x54, 0x19 },
593 { 0x01, 0x9F, 0x98, 0x09, 0xDE, 0x17, 0x11, 0x85,
594 0x8F, 0xAA, 0xC3, 0xA3, 0xBA, 0x20, 0xFB, 0xC3 }
595 }, {
596 24,
597 { 0x88, 0xB2, 0xB2, 0x70, 0x6B, 0x10, 0x5E, 0x36,
598 0xB4, 0x46, 0xBB, 0x6D, 0x73, 0x1A, 0x1E, 0x88,
599 0xEF, 0xA7, 0x1F, 0x78, 0x89, 0x65, 0xBD, 0x44 },
600 { 0x39, 0xDA, 0x69, 0xD6, 0xBA, 0x49, 0x97, 0xD5,
601 0x85, 0xB6, 0xDC, 0x07, 0x3C, 0xA3, 0x41, 0xB2 },
602 { 0x18, 0x2B, 0x02, 0xD8, 0x14, 0x97, 0xEA, 0x45,
603 0xF9, 0xDA, 0xAC, 0xDC, 0x29, 0x19, 0x3A, 0x65 }
604 }, {
605 32,
606 { 0xD4, 0x3B, 0xB7, 0x55, 0x6E, 0xA3, 0x2E, 0x46,
607 0xF2, 0xA2, 0x82, 0xB7, 0xD4, 0x5B, 0x4E, 0x0D,
608 0x57, 0xFF, 0x73, 0x9D, 0x4D, 0xC9, 0x2C, 0x1B,
609 0xD7, 0xFC, 0x01, 0x70, 0x0C, 0xC8, 0x21, 0x6F },
610 { 0x90, 0xAF, 0xE9, 0x1B, 0xB2, 0x88, 0x54, 0x4F,
611 0x2C, 0x32, 0xDC, 0x23, 0x9B, 0x26, 0x35, 0xE6 },
612 { 0x6C, 0xB4, 0x56, 0x1C, 0x40, 0xBF, 0x0A, 0x97,
613 0x05, 0x93, 0x1C, 0xB6, 0xD4, 0x08, 0xE7, 0xFA }
614 }
615 };
616
617
618 symmetric_key key;
619 unsigned char tmp[2][16];
620 int err, i, y;
621
622 for (i = 0; i < (int)(sizeof(tests)/sizeof(tests[0])); i++) {
623 if ((err = twofish_setup(tests[i].key, tests[i].keylen, 0, &key)) != CRYPT_OK) {
624 return err;
625 }
626 twofish_ecb_encrypt(tests[i].pt, tmp[0], &key);
627 twofish_ecb_decrypt(tmp[0], tmp[1], &key);
628 if (memcmp(tmp[0], tests[i].ct, 16) != 0 || memcmp(tmp[1], tests[i].pt, 16) != 0) {
629 return CRYPT_FAIL_TESTVECTOR;
630 }
631 /* now see if we can encrypt all zero bytes 1000 times, decrypt and come back where we started */
632 for (y = 0; y < 16; y++) tmp[0][y] = 0;
633 for (y = 0; y < 1000; y++) twofish_ecb_encrypt(tmp[0], tmp[0], &key);
634 for (y = 0; y < 1000; y++) twofish_ecb_decrypt(tmp[0], tmp[0], &key);
635 for (y = 0; y < 16; y++) if (tmp[0][y] != 0) return CRYPT_FAIL_TESTVECTOR;
636 }
637 return CRYPT_OK;
638 #endif
639 }
640
641 int twofish_keysize(int *desired_keysize)
642 {
643 _ARGCHK(desired_keysize);
644 if (*desired_keysize < 16)
645 return CRYPT_INVALID_KEYSIZE;
646 if (*desired_keysize < 24) {
647 *desired_keysize = 16;
648 return CRYPT_OK;
649 } else if (*desired_keysize < 32) {
650 *desired_keysize = 24;
651 return CRYPT_OK;
652 } else {
653 *desired_keysize = 32;
654 return CRYPT_OK;
655 }
656 }
657
658 #endif
659
660
661