The NSA's Skipjack block cipher.

[u/mdw/catacomb] / skipjack.c

/* -*-c-*-
 *
 * $Id: skipjack.c,v 1.1 2000/07/15 15:39:33 mdw Exp $
 *
 * The Skipjack block cipher
 *
 * (c) 2000 Straylight/Edgeware
 */

/*----- Licensing notice --------------------------------------------------* 
 *
 * This file is part of Catacomb.
 *
 * Catacomb is free software; you can redistribute it and/or modify
 * it under the terms of the GNU Library General Public License as
 * published by the Free Software Foundation; either version 2 of the
 * License, or (at your option) any later version.
 * 
 * Catacomb is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Library General Public License for more details.
 * 
 * You should have received a copy of the GNU Library General Public
 * License along with Catacomb; if not, write to the Free
 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
 * MA 02111-1307, USA.
 */

/*----- Revision history --------------------------------------------------* 
 *
 * $Log: skipjack.c,v $
 * Revision 1.1  2000/07/15 15:39:33  mdw
 * The NSA's Skipjack block cipher.
 *
 */

/*----- Header files ------------------------------------------------------*/

#include <mLib/bits.h>

#include "blkc.h"
#include "gcipher.h"
#include "skipjack.h"
#include "skipjack-tab.h"

/*----- Global variables --------------------------------------------------*/

const octet skipjack_keysz[] = { KSZ_SET, 10, 0 };

/*----- The Skipjack S-box ------------------------------------------------*/

static octet f[256] = SKIPJACK_S;

/*----- Main code ---------------------------------------------------------*/

/* --- @skipjack_init@ --- *
 *
 * Arguments:   @skipjack_ctx *k@ = pointer to key block
 *              @const void *buf@ = pointer to key buffer
 *              @size_t sz@ = size of key material
 *
 * Returns:     ---
 *
 * Use:         Initializes a Skipjack key buffer.  The key buffer must be
 *		exactly 10 bytes long.
 */

void skipjack_init(skipjack_ctx *k, const void *buf, size_t sz)
{
  KSZ_ASSERT(skipjack, sz);
  memcpy(k->k, buf, sz);
}

/* --- @skipjack_eblk@, @skipjack_dblk@ --- *
 *
 * Arguments:   @const skipjack_ctx *k@ = pointer to key block
 *              @const uint32 s[2]@ = pointer to source block
 *              @uint32 d[2]@ = pointer to skipjacktination block
 *
 * Returns:     ---
 *
 * Use:         Low-level block encryption and decryption.
 */

#define G(x, i) do {							\
  octet _x = U8(x >> 8), _y = U8(x);					\
  _x ^= f[_y ^ k->k[i++]]; if (i >= 10) i = 0;				\
  _y ^= f[_x ^ k->k[i++]]; if (i >= 10) i = 0;				\
  _x ^= f[_y ^ k->k[i++]]; if (i >= 10) i = 0;				\
  _y ^= f[_x ^ k->k[i++]]; if (i >= 10) i = 0;				\
  x = U16((_x << 8) | _y);						\
} while (0)

#define RULE_A(w, x, y, z, n, i) do {					\
  G(w, i); z ^= w ^ n++;						\
} while (0)

#define RULE_B(w, x, y, z, n, i) do {					\
  x ^= w ^ n++; G(w, i);						\
} while (0)

void skipjack_eblk(const skipjack_ctx *k, const uint32 *s, uint32 *d)
{
  unsigned i = 0;
  unsigned n = 1;
  uint16 w = U16(s[0] >> 16), x = U16(s[0]);
  uint16 y = U16(s[1] >> 16), z = U16(s[1]);

  RULE_A(w, x, y, z, n, i); RULE_A(z, w, x, y, n, i);
  RULE_A(y, z, w, x, n, i); RULE_A(x, y, z, w, n, i);
  RULE_A(w, x, y, z, n, i); RULE_A(z, w, x, y, n, i);
  RULE_A(y, z, w, x, n, i); RULE_A(x, y, z, w, n, i);
  RULE_B(w, x, y, z, n, i); RULE_B(z, w, x, y, n, i);
  RULE_B(y, z, w, x, n, i); RULE_B(x, y, z, w, n, i);
  RULE_B(w, x, y, z, n, i); RULE_B(z, w, x, y, n, i);
  RULE_B(y, z, w, x, n, i); RULE_B(x, y, z, w, n, i);
  RULE_A(w, x, y, z, n, i); RULE_A(z, w, x, y, n, i);
  RULE_A(y, z, w, x, n, i); RULE_A(x, y, z, w, n, i);
  RULE_A(w, x, y, z, n, i); RULE_A(z, w, x, y, n, i);
  RULE_A(y, z, w, x, n, i); RULE_A(x, y, z, w, n, i);
  RULE_B(w, x, y, z, n, i); RULE_B(z, w, x, y, n, i);
  RULE_B(y, z, w, x, n, i); RULE_B(x, y, z, w, n, i);
  RULE_B(w, x, y, z, n, i); RULE_B(z, w, x, y, n, i);
  RULE_B(y, z, w, x, n, i); RULE_B(x, y, z, w, n, i);

  d[0] = ((uint32)w << 16) | (uint32)x;
  d[1] = ((uint32)y << 16) | (uint32)z;
}

#define G_INV(x, i) do {						\
  octet _x = U8(x >> 8), _y = U8(x);					\
  _y ^= f[_x ^ k->k[--i]]; if (i == 0) i = 10;				\
  _x ^= f[_y ^ k->k[--i]]; if (i == 0) i = 10;				\
  _y ^= f[_x ^ k->k[--i]]; if (i == 0) i = 10;				\
  _x ^= f[_y ^ k->k[--i]]; if (i == 0) i = 10;				\
  x = U16((_x << 8) | _y);						\
} while (0)

#define RULE_A_INV(w, x, y, z, n, i) do {				\
  w ^= x ^ --n; G_INV(x, i);						\
} while (0)

#define RULE_B_INV(w, x, y, z, n, i) do {				\
  G_INV(x, i); y ^= x ^ --n;						\
} while (0)

void skipjack_dblk(const skipjack_ctx *k, const uint32 *s, uint32 *d)
{
  unsigned i = 8;
  unsigned n = 33;
  uint16 w = U16(s[0] >> 16), x = U16(s[0]);
  uint16 y = U16(s[1] >> 16), z = U16(s[1]);

  RULE_B_INV(w, x, y, z, n, i); RULE_B_INV(x, y, z, w, n, i);
  RULE_B_INV(y, z, w, x, n, i); RULE_B_INV(z, w, x, y, n, i);
  RULE_B_INV(w, x, y, z, n, i); RULE_B_INV(x, y, z, w, n, i);
  RULE_B_INV(y, z, w, x, n, i); RULE_B_INV(z, w, x, y, n, i);
  RULE_A_INV(w, x, y, z, n, i); RULE_A_INV(x, y, z, w, n, i);
  RULE_A_INV(y, z, w, x, n, i); RULE_A_INV(z, w, x, y, n, i);
  RULE_A_INV(w, x, y, z, n, i); RULE_A_INV(x, y, z, w, n, i);
  RULE_A_INV(y, z, w, x, n, i); RULE_A_INV(z, w, x, y, n, i);
  RULE_B_INV(w, x, y, z, n, i); RULE_B_INV(x, y, z, w, n, i);
  RULE_B_INV(y, z, w, x, n, i); RULE_B_INV(z, w, x, y, n, i);
  RULE_B_INV(w, x, y, z, n, i); RULE_B_INV(x, y, z, w, n, i);
  RULE_B_INV(y, z, w, x, n, i); RULE_B_INV(z, w, x, y, n, i);
  RULE_A_INV(w, x, y, z, n, i); RULE_A_INV(x, y, z, w, n, i);
  RULE_A_INV(y, z, w, x, n, i); RULE_A_INV(z, w, x, y, n, i);
  RULE_A_INV(w, x, y, z, n, i); RULE_A_INV(x, y, z, w, n, i);
  RULE_A_INV(y, z, w, x, n, i); RULE_A_INV(z, w, x, y, n, i);

  d[0] = ((uint32)w << 16) | (uint32)x;
  d[1] = ((uint32)y << 16) | (uint32)z;
}

BLKC_TEST(SKIPJACK, skipjack)

/*----- That's all, folks -------------------------------------------------*/