[u/mdw/catacomb] / symm / rijndael-mktab.c

/* -*-c-*-
 *
 * Build precomputed tables for the Rijndael block cipher
 *
 * (c) 2000 Straylight/Edgeware
 */

/*----- Licensing notice --------------------------------------------------*
 *
 * This file is part of Catacomb.
 *
 * Catacomb is free software; you can redistribute it and/or modify
 * it under the terms of the GNU Library General Public License as
 * published by the Free Software Foundation; either version 2 of the
 * License, or (at your option) any later version.
 *
 * Catacomb is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Library General Public License for more details.
 *
 * You should have received a copy of the GNU Library General Public
 * License along with Catacomb; if not, write to the Free
 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
 * MA 02111-1307, USA.
 */

/*----- Header files ------------------------------------------------------*/

#include <assert.h>
#include <stdio.h>
#include <stdlib.h>

#include <mLib/bits.h>

/*----- Magic variables ---------------------------------------------------*/

static octet s[256], si[256];
static uint32 t[4][256], ti[4][256];
static uint32 u[4][256];
static octet rc[32];

/*----- Main code ---------------------------------------------------------*/

/* --- @mul@ --- *
 *
 * Arguments:	@unsigned x, y@ = polynomials over %$\gf{2^8}$%
 *		@unsigned m@ = modulus
 *
 * Returns:	The product of two polynomials.
 *
 * Use:		Computes a product of polynomials, quite slowly.
 */

static unsigned mul(unsigned x, unsigned y, unsigned m)
{
  unsigned a = 0;
  unsigned i;

  for (i = 0; i < 8; i++) {
    if (y & 1)
      a ^= x;
    y >>= 1;
    x <<= 1;
    if (x & 0x100)
      x ^= m;
  }

  return (a);
}

/* --- @sbox@ --- *
 *
 * Build the S-box.
 *
 * This is built from inversion in the multiplicative group of
 * %$\gf{2^8}[x]/(p(x))$%, where %$p(x) = x^8 + x^4 + x^3 + x + 1$%, followed
 * by an affine transformation treating inputs as vectors over %$\gf{2}$%.
 * The result is a horrible function.
 *
 * The inversion is done slightly sneakily, by building log and antilog
 * tables.  Let %$a$% be an element of the finite field.  If the inverse of
 * %$a$% is %$a^{-1}$%, then %$\log a a^{-1} = 0$%.  Hence
 * %$\log a = -\log a^{-1}$%.  This saves fiddling about with Euclidean
 * algorithm.
 */

#define S_MOD 0x11b

static void sbox(void)
{
  octet log[256], alog[256];
  unsigned x;
  unsigned i;
  unsigned g;

  /* --- Find a suitable generator, and build log tables --- */

  log[0] = 0;
  for (g = 2; g < 256; g++) {
    x = 1;
    for (i = 0; i < 256; i++) {
      log[x] = i;
      alog[i] = x;
      x = mul(x, g, S_MOD);
      if (x == 1 && i != 254)
	goto again;
    }
    goto done;
  again:;
  }
  fprintf(stderr, "couldn't find generator\n");
  exit(EXIT_FAILURE);
done:;

  /* --- Now grind through and do the affine transform --- *
   *
   * The matrix multiply is an AND and a parity op.  The add is an XOR.
   */

  for (i = 0; i < 256; i++) {
    unsigned j;
    unsigned m = 0xf8;
    unsigned v = i ? alog[255 - log[i]] : 0;

    assert(i == 0 || mul(i, v, S_MOD) == 1);

    x = 0;
    for (j = 0; j < 8; j++) {
      unsigned r;
      r = v & m;
      r = (r >> 4) ^ r;
      r = (r >> 2) ^ r;
      r = (r >> 1) ^ r;
      x = (x << 1) | (r & 1);
      m = ROR8(m, 1);
    }
    x ^= 0x63;
    s[i] = x;
    si[x] = i;
  }
}

/* --- @tbox@ --- *
 *
 * Construct the t tables for doing the round function efficiently.
 */

static void tbox(void)
{
  unsigned i;

  for (i = 0; i < 256; i++) {
    uint32 a, b, c, d;
    uint32 w;

    /* --- Build a forwards t-box entry --- */

    a = s[i];
    b = a << 1; if (b & 0x100) b ^= S_MOD;
    c = a ^ b;
    w = (c << 0) | (a << 8) | (a << 16) | (b << 24);
    t[0][i] = w;
    t[1][i] = ROR32(w, 8);
    t[2][i] = ROR32(w, 16);
    t[3][i] = ROR32(w, 24);

    /* --- Build a backwards t-box entry --- */

    a = mul(si[i], 0x0e, S_MOD);
    b = mul(si[i], 0x09, S_MOD);
    c = mul(si[i], 0x0d, S_MOD);
    d = mul(si[i], 0x0b, S_MOD);
    w = (d << 0) | (c << 8) | (b << 16) | (a << 24);
    ti[0][i] = w;
    ti[1][i] = ROR32(w, 8);
    ti[2][i] = ROR32(w, 16);
    ti[3][i] = ROR32(w, 24);
  }
}

/* --- @ubox@ --- *
 *
 * Construct the tables for performing the decryption key schedule.
 */

static void ubox(void)
{
  unsigned i;

  for (i = 0; i < 256; i++) {
    uint32 a, b, c, d;
    uint32 w;
    a = mul(i, 0x0e, S_MOD);
    b = mul(i, 0x09, S_MOD);
    c = mul(i, 0x0d, S_MOD);
    d = mul(i, 0x0b, S_MOD);
    w = (d << 0) | (c << 8) | (b << 16) | (a << 24);
    u[0][i] = w;
    u[1][i] = ROR32(w, 8);
    u[2][i] = ROR32(w, 16);
    u[3][i] = ROR32(w, 24);
  }
}

/* --- Round constants --- */

static void rcon(void)
{
  unsigned r = 1;
  int i;

  for (i = 0; i < sizeof(rc); i++) {
    rc[i] = r;
    r <<= 1;
    if (r & 0x100)
      r ^= S_MOD;
  }
}

/* --- @main@ --- */

int main(void)
{
  int i, j;

  puts("\
/* -*-c-*-\n\
 *\n\
 * Rijndael tables [generated]\n\
 */\n\
\n\
#ifndef CATACOMB_RIJNDAEL_TAB_H\n\
#define CATACOMB_RIJNDAEL_TAB_H\n\
");

  /* --- Write out the S-box --- */

  sbox();
  fputs("\
/* --- The byte substitution and its inverse --- */\n\
\n\
#define RIJNDAEL_S {							\\\n\
  ", stdout);
  for (i = 0; i < 256; i++) {
    printf("0x%02x", s[i]);
    if (i == 255)
      fputs("			\\\n}\n\n", stdout);
    else if (i % 8 == 7)
      fputs(",			\\\n  ", stdout);
    else
      fputs(", ", stdout);
  }

  fputs("\
#define RIJNDAEL_SI {							\\\n\
  ", stdout);
  for (i = 0; i < 256; i++) {
    printf("0x%02x", si[i]);
    if (i == 255)
      fputs("			\\\n}\n\n", stdout);
    else if (i % 8 == 7)
      fputs(",			\\\n  ", stdout);
    else
      fputs(", ", stdout);
  }

  /* --- Write out the big t tables --- */

  tbox();
  fputs("\
/* --- The big round tables --- */\n\
\n\
#define RIJNDAEL_T {							\\\n\
  { ", stdout);
  for (j = 0; j < 4; j++) {
    for (i = 0; i < 256; i++) {
      printf("0x%08lx", (unsigned long)t[j][i]);
      if (i == 255) {
	if (j == 3)
	  fputs(" }			\\\n}\n\n", stdout);
	else
	  fputs(" },			\\\n\
									\\\n\
  { ", stdout);
      } else if (i % 4 == 3)
	fputs(",			\\\n	", stdout);
      else
	fputs(", ", stdout);
    }
  }

  fputs("\
#define RIJNDAEL_TI {							\\\n\
  { ", stdout);
  for (j = 0; j < 4; j++) {
    for (i = 0; i < 256; i++) {
      printf("0x%08lx", (unsigned long)ti[j][i]);
      if (i == 255) {
	if (j == 3)
	  fputs(" }			\\\n}\n\n", stdout);
	else
	  fputs(" },			\\\n\
									\\\n\
  { ", stdout);
      } else if (i % 4 == 3)
	fputs(",			\\\n	", stdout);
      else
	fputs(", ", stdout);
    }
  }

  /* --- Write out the big u tables --- */

  ubox();
  fputs("\
/* --- The decryption key schedule tables --- */\n\
\n\
#define RIJNDAEL_U {							\\\n\
  { ", stdout);
  for (j = 0; j < 4; j++) {
    for (i = 0; i < 256; i++) {
      printf("0x%08lx", (unsigned long)u[j][i]);
      if (i == 255) {
	if (j == 3)
	  fputs(" }			\\\n}\n\n", stdout);
	else
	  fputs(" },			\\\n\
									\\\n\
  { ", stdout);
      } else if (i % 4 == 3)
	fputs(",			\\\n	", stdout);
      else
	fputs(", ", stdout);
    }
  }

  /* --- Round constants --- */

  rcon();
  fputs("\
/* --- The round constants --- */\n\
\n\
#define RIJNDAEL_RCON {							\\\n\
  ", stdout);
  for (i = 0; i < sizeof(rc); i++) {
    printf("0x%02x", rc[i]);
    if (i == sizeof(rc) - 1)
      fputs("			\\\n}\n\n", stdout);
    else if (i % 8 == 7)
      fputs(",			\\\n  ", stdout);
    else
      fputs(", ", stdout);
  }

  /* --- Done --- */

  puts("#endif");

  if (fclose(stdout)) {
    fprintf(stderr, "error writing data\n");
    exit(EXIT_FAILURE);
  }

  return (0);
}

/*----- That's all, folks -------------------------------------------------*/
Commit	Line	Data
3a65506d	1	/* --c--
3a65506d	2	*
3a65506d	3	* Build precomputed tables for the Rijndael block cipher
	4	*
	5	* (c) 2000 Straylight/Edgeware
	6	*/
	7
45c0fd36	8	/----- Licensing notice --------------------------------------------------
3a65506d	9	*
	10	* This file is part of Catacomb.
	11	*
	12	* Catacomb is free software; you can redistribute it and/or modify
	13	* it under the terms of the GNU Library General Public License as
	14	* published by the Free Software Foundation; either version 2 of the
	15	* License, or (at your option) any later version.
45c0fd36	16	*
3a65506d	17	* Catacomb is distributed in the hope that it will be useful,
	18	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	19	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	20	* GNU Library General Public License for more details.
45c0fd36	21	*
3a65506d	22	* You should have received a copy of the GNU Library General Public
	23	* License along with Catacomb; if not, write to the Free
	24	* Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
	25	* MA 02111-1307, USA.
	26	*/
	27
3a65506d	28	/----- Header files ------------------------------------------------------/
	29
	30	#include <assert.h>
	31	#include <stdio.h>
	32	#include <stdlib.h>
	33
	34	#include <mLib/bits.h>
	35
	36	/----- Magic variables ---------------------------------------------------/
	37
	38	static octet s[256], si[256];
	39	static uint32 t[4][256], ti[4][256];
	40	static uint32 u[4][256];
	41	static octet rc[32];
	42
	43	/----- Main code ---------------------------------------------------------/
	44
	45	/* --- @mul@ --- *
	46	*
4d47e157	47	* Arguments: @unsigned x, y@ = polynomials over %$\gf{2^8}$%
3a65506d	48	* @unsigned m@ = modulus
	49	*
	50	* Returns: The product of two polynomials.
	51	*
	52	* Use: Computes a product of polynomials, quite slowly.
	53	*/
	54
	55	static unsigned mul(unsigned x, unsigned y, unsigned m)
	56	{
	57	unsigned a = 0;
	58	unsigned i;
	59
	60	for (i = 0; i < 8; i++) {
	61	if (y & 1)
	62	a ^= x;
	63	y >>= 1;
	64	x <<= 1;
	65	if (x & 0x100)
	66	x ^= m;
	67	}
	68
	69	return (a);
	70	}
	71
	72	/* --- @sbox@ --- *
	73	*
	74	* Build the S-box.
	75	*
4d47e157	76	* This is built from inversion in the multiplicative group of
	77	* %$\gf{2^8}[x]/(p(x))$%, where %$p(x) = x^8 + x^4 + x^3 + x + 1$%, followed
	78	* by an affine transformation treating inputs as vectors over %$\gf{2}$%.
	79	* The result is a horrible function.
3a65506d	80	*
	81	* The inversion is done slightly sneakily, by building log and antilog
	82	* tables. Let %$a$% be an element of the finite field. If the inverse of
	83	* %$a$% is %$a^{-1}$%, then %$\log a a^{-1} = 0$%. Hence
	84	* %$\log a = -\log a^{-1}$%. This saves fiddling about with Euclidean
45c0fd36	85	* algorithm.
3a65506d	86	*/
	87
	88	#define S_MOD 0x11b
	89
	90	static void sbox(void)
	91	{
	92	octet log[256], alog[256];
	93	unsigned x;
	94	unsigned i;
	95	unsigned g;
	96
	97	/* --- Find a suitable generator, and build log tables --- */
	98
	99	log[0] = 0;
	100	for (g = 2; g < 256; g++) {
	101	x = 1;
	102	for (i = 0; i < 256; i++) {
	103	log[x] = i;
	104	alog[i] = x;
	105	x = mul(x, g, S_MOD);
	106	if (x == 1 && i != 254)
	107	goto again;
	108	}
	109	goto done;
	110	again:;
	111	}
	112	fprintf(stderr, "couldn't find generator\n");
	113	exit(EXIT_FAILURE);
	114	done:;
	115
	116	/* --- Now grind through and do the affine transform --- *
	117	*
	118	* The matrix multiply is an AND and a parity op. The add is an XOR.
	119	*/
	120
	121	for (i = 0; i < 256; i++) {
	122	unsigned j;
	123	unsigned m = 0xf8;
	124	unsigned v = i ? alog[255 - log[i]] : 0;
	125
	126	assert(i == 0 \|\| mul(i, v, S_MOD) == 1);
	127
	128	x = 0;
	129	for (j = 0; j < 8; j++) {
	130	unsigned r;
	131	r = v & m;
	132	r = (r >> 4) ^ r;
	133	r = (r >> 2) ^ r;
	134	r = (r >> 1) ^ r;
	135	x = (x << 1) \| (r & 1);
	136	m = ROR8(m, 1);
	137	}
	138	x ^= 0x63;
	139	s[i] = x;
	140	si[x] = i;
	141	}
	142	}
	143
	144	/* --- @tbox@ --- *
	145	*
	146	* Construct the t tables for doing the round function efficiently.
	147	*/
	148
	149	static void tbox(void)
150	{
151	unsigned i;
152
153	for (i = 0; i < 256; i++) {
154	uint32 a, b, c, d;
155	uint32 w;
156
157	/* --- Build a forwards t-box entry --- */
158
159	a = s[i];
160	b = a << 1; if (b & 0x100) b ^= S_MOD;
161	c = a ^ b;
38333dc2	162	w = (c << 0) \| (a << 8) \| (a << 16) \| (b << 24);
3a65506d	163	t[0][i] = w;
38333dc2 MW	164	t[1][i] = ROR32(w, 8);
	165	t[2][i] = ROR32(w, 16);
	166	t[3][i] = ROR32(w, 24);
3a65506d	167
	168	/* --- Build a backwards t-box entry --- */
	169
	170	a = mul(si[i], 0x0e, S_MOD);
	171	b = mul(si[i], 0x09, S_MOD);
	172	c = mul(si[i], 0x0d, S_MOD);
	173	d = mul(si[i], 0x0b, S_MOD);
38333dc2	174	w = (d << 0) \| (c << 8) \| (b << 16) \| (a << 24);
3a65506d	175	ti[0][i] = w;
38333dc2 MW	176	ti[1][i] = ROR32(w, 8);
	177	ti[2][i] = ROR32(w, 16);
	178	ti[3][i] = ROR32(w, 24);
3a65506d	179	}
	180	}
	181
	182	/* --- @ubox@ --- *
	183	*
	184	* Construct the tables for performing the decryption key schedule.
	185	*/
	186
	187	static void ubox(void)
	188	{
	189	unsigned i;
	190
	191	for (i = 0; i < 256; i++) {
	192	uint32 a, b, c, d;
	193	uint32 w;
	194	a = mul(i, 0x0e, S_MOD);
	195	b = mul(i, 0x09, S_MOD);
	196	c = mul(i, 0x0d, S_MOD);
	197	d = mul(i, 0x0b, S_MOD);
38333dc2	198	w = (d << 0) \| (c << 8) \| (b << 16) \| (a << 24);
3a65506d	199	u[0][i] = w;
38333dc2 MW	200	u[1][i] = ROR32(w, 8);
	201	u[2][i] = ROR32(w, 16);
	202	u[3][i] = ROR32(w, 24);
3a65506d	203	}
	204	}
	205
	206	/* --- Round constants --- */
	207
7a28dc19	208	static void rcon(void)
3a65506d	209	{
	210	unsigned r = 1;
	211	int i;
	212
	213	for (i = 0; i < sizeof(rc); i++) {
	214	rc[i] = r;
	215	r <<= 1;
	216	if (r & 0x100)
	217	r ^= S_MOD;
	218	}
	219	}
	220
	221	/* --- @main@ --- */
	222
	223	int main(void)
	224	{
	225	int i, j;
	226
	227	puts("\
	228	/* --c--\n\
	229	*\n\
	230	* Rijndael tables [generated]\n\
	231	*/\n\
	232	\n\
	233	#ifndef CATACOMB_RIJNDAEL_TAB_H\n\
	234	#define CATACOMB_RIJNDAEL_TAB_H\n\
	235	");
	236
	237	/* --- Write out the S-box --- */
	238
	239	sbox();
	240	fputs("\
	241	/* --- The byte substitution and its inverse --- */\n\
	242	\n\
	243	#define RIJNDAEL_S { \\\n\
	244	", stdout);
	245	for (i = 0; i < 256; i++) {
	246	printf("0x%02x", s[i]);
	247	if (i == 255)
	248	fputs(" \\\n}\n\n", stdout);
	249	else if (i % 8 == 7)
	250	fputs(", \\\n ", stdout);
	251	else
	252	fputs(", ", stdout);
	253	}
	254
	255	fputs("\
	256	#define RIJNDAEL_SI { \\\n\
	257	", stdout);
	258	for (i = 0; i < 256; i++) {
	259	printf("0x%02x", si[i]);
	260	if (i == 255)
	261	fputs(" \\\n}\n\n", stdout);
	262	else if (i % 8 == 7)
	263	fputs(", \\\n ", stdout);
	264	else
	265	fputs(", ", stdout);
	266	}
	267
	268	/* --- Write out the big t tables --- */
	269
	270	tbox();
	271	fputs("\
	272	/* --- The big round tables --- */\n\
273	\n\
274	#define RIJNDAEL_T { \\\n\
275	{ ", stdout);
276	for (j = 0; j < 4; j++) {
277	for (i = 0; i < 256; i++) {
7a28dc19	278	printf("0x%08lx", (unsigned long)t[j][i]);
3a65506d	279	if (i == 255) {
	280	if (j == 3)
	281	fputs(" } \\\n}\n\n", stdout);
	282	else
	283	fputs(" }, \\\n\
	284	\\\n\
	285	{ ", stdout);
	286	} else if (i % 4 == 3)
45c0fd36	287	fputs(", \\\n ", stdout);
3a65506d	288	else
	289	fputs(", ", stdout);
	290	}
45c0fd36	291	}
3a65506d	292
	293	fputs("\
	294	#define RIJNDAEL_TI { \\\n\
	295	{ ", stdout);
	296	for (j = 0; j < 4; j++) {
	297	for (i = 0; i < 256; i++) {
7a28dc19	298	printf("0x%08lx", (unsigned long)ti[j][i]);
3a65506d	299	if (i == 255) {
	300	if (j == 3)
	301	fputs(" } \\\n}\n\n", stdout);
	302	else
	303	fputs(" }, \\\n\
	304	\\\n\
	305	{ ", stdout);
	306	} else if (i % 4 == 3)
45c0fd36	307	fputs(", \\\n ", stdout);
3a65506d	308	else
	309	fputs(", ", stdout);
	310	}
	311	}
	312
	313	/* --- Write out the big u tables --- */
	314
	315	ubox();
	316	fputs("\
	317	/* --- The decryption key schedule tables --- */\n\
	318	\n\
	319	#define RIJNDAEL_U { \\\n\
	320	{ ", stdout);
	321	for (j = 0; j < 4; j++) {
	322	for (i = 0; i < 256; i++) {
7a28dc19	323	printf("0x%08lx", (unsigned long)u[j][i]);
3a65506d	324	if (i == 255) {
	325	if (j == 3)
	326	fputs(" } \\\n}\n\n", stdout);
	327	else
	328	fputs(" }, \\\n\
	329	\\\n\
	330	{ ", stdout);
	331	} else if (i % 4 == 3)
45c0fd36	332	fputs(", \\\n ", stdout);
3a65506d	333	else
	334	fputs(", ", stdout);
	335	}
45c0fd36	336	}
3a65506d	337
	338	/* --- Round constants --- */
	339
	340	rcon();
	341	fputs("\
	342	/* --- The round constants --- */\n\
	343	\n\
	344	#define RIJNDAEL_RCON { \\\n\
	345	", stdout);
	346	for (i = 0; i < sizeof(rc); i++) {
	347	printf("0x%02x", rc[i]);
	348	if (i == sizeof(rc) - 1)
	349	fputs(" \\\n}\n\n", stdout);
	350	else if (i % 8 == 7)
	351	fputs(", \\\n ", stdout);
	352	else
	353	fputs(", ", stdout);
45c0fd36	354	}
3a65506d	355
	356	/* --- Done --- */
	357
	358	puts("#endif");
	359
	360	if (fclose(stdout)) {
	361	fprintf(stderr, "error writing data\n");
	362	exit(EXIT_FAILURE);
	363	}
	364
	365	return (0);
	366	}
	367
	368	/----- That's all, folks -------------------------------------------------/