9810d749 |
1 | /* -*-c-*- |
2 | * |
3 | * $Id: cast128.c,v 1.1 2000/06/17 10:49:14 mdw Exp $ |
4 | * |
5 | * The CAST-128 block cipher |
6 | * |
7 | * (c) 2000 Straylight/Edgeware |
8 | */ |
9 | |
10 | /*----- Licensing notice --------------------------------------------------* |
11 | * |
12 | * This file is part of Catacomb. |
13 | * |
14 | * Catacomb is free software; you can redistribute it and/or modify |
15 | * it under the terms of the GNU Library General Public License as |
16 | * published by the Free Software Foundation; either version 2 of the |
17 | * License, or (at your option) any later version. |
18 | * |
19 | * Catacomb is distributed in the hope that it will be useful, |
20 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
21 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
22 | * GNU Library General Public License for more details. |
23 | * |
24 | * You should have received a copy of the GNU Library General Public |
25 | * License along with Catacomb; if not, write to the Free |
26 | * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, |
27 | * MA 02111-1307, USA. |
28 | */ |
29 | |
30 | /*----- Revision history --------------------------------------------------* |
31 | * |
32 | * $Log: cast128.c,v $ |
33 | * Revision 1.1 2000/06/17 10:49:14 mdw |
34 | * New cipher. |
35 | * |
36 | */ |
37 | |
38 | /*----- Header files ------------------------------------------------------*/ |
39 | |
40 | #include <assert.h> |
41 | #include <stdio.h> |
42 | #include <stdlib.h> |
43 | #include <string.h> |
44 | |
45 | #include <mLib/bits.h> |
46 | |
47 | #include "blkc.h" |
48 | #include "cast-base.h" |
49 | #include "cast128.h" |
50 | #include "gcipher.h" |
51 | #include "paranoia.h" |
52 | |
53 | /*----- Global variables --------------------------------------------------*/ |
54 | |
55 | const octet cast128_keysz[] = { KSZ_RANGE, CAST128_KEYSZ, 0, 16, 1 }; |
56 | |
57 | /*----- Main code ---------------------------------------------------------*/ |
58 | |
59 | /* --- @cast128_init@ --- * |
60 | * |
61 | * Arguments: @cast128_ctx *k@ = pointer to key block to fill in |
62 | * @const void *buf@ = pointer to buffer of key material |
63 | * @size_t sz@ = size of key material |
64 | * |
65 | * Returns: --- |
66 | * |
67 | * Use: Initializes a CAST-128 key buffer. CAST-128 accepts |
68 | * 128-bit keys or shorter. |
69 | */ |
70 | |
71 | void cast128_init(cast128_ctx *k, const void *buf, size_t sz) |
72 | { |
73 | const octet *p = buf; |
74 | uint32 kk[4]; |
75 | unsigned i; |
76 | uint32 a, b, c, d, aa, bb, cc, dd; |
77 | |
78 | /* --- Fiddle with the key size a bit --- */ |
79 | |
80 | KSZ_ASSERT(cast128, sz); |
81 | |
82 | if (sz > 10) |
83 | k->r = 16; |
84 | else |
85 | k->r = 12; |
86 | |
87 | /* --- Read the key into the array --- */ |
88 | |
89 | i = 0; |
90 | b = 32; aa = 0; |
91 | for (;;) { |
92 | if (!sz) |
93 | break; |
94 | b -= 8; |
95 | aa |= ((uint32)*p++ << b); |
96 | sz--; |
97 | if (b == 0) { |
98 | kk[i++] = aa; |
99 | if (i == 4) |
100 | break; |
101 | aa = 0; |
102 | b = 32; |
103 | } |
104 | } |
105 | |
106 | for (; i < 4; i++) { |
107 | kk[i] = aa; |
108 | aa = 0; |
109 | } |
110 | |
111 | /* --- Read the key words out --- */ |
112 | |
113 | a = kk[0]; b = kk[1]; c = kk[2]; d = kk[3]; |
114 | |
115 | #define X_0123 a |
116 | #define X_4567 b |
117 | #define X_89ab c |
118 | #define X_cdef d |
119 | |
120 | #define X_0 U8(X_0123 >> 24) |
121 | #define X_1 U8(X_0123 >> 16) |
122 | #define X_2 U8(X_0123 >> 8) |
123 | #define X_3 U8(X_0123 >> 0) |
124 | #define X_4 U8(X_4567 >> 24) |
125 | #define X_5 U8(X_4567 >> 16) |
126 | #define X_6 U8(X_4567 >> 8) |
127 | #define X_7 U8(X_4567 >> 0) |
128 | #define X_8 U8(X_89ab >> 24) |
129 | #define X_9 U8(X_89ab >> 16) |
130 | #define X_a U8(X_89ab >> 8) |
131 | #define X_b U8(X_89ab >> 0) |
132 | #define X_c U8(X_cdef >> 24) |
133 | #define X_d U8(X_cdef >> 16) |
134 | #define X_e U8(X_cdef >> 8) |
135 | #define X_f U8(X_cdef >> 0) |
136 | |
137 | #define Z_0123 aa |
138 | #define Z_4567 bb |
139 | #define Z_89ab cc |
140 | #define Z_cdef dd |
141 | |
142 | #define Z_0 U8(Z_0123 >> 24) |
143 | #define Z_1 U8(Z_0123 >> 16) |
144 | #define Z_2 U8(Z_0123 >> 8) |
145 | #define Z_3 U8(Z_0123 >> 0) |
146 | #define Z_4 U8(Z_4567 >> 24) |
147 | #define Z_5 U8(Z_4567 >> 16) |
148 | #define Z_6 U8(Z_4567 >> 8) |
149 | #define Z_7 U8(Z_4567 >> 0) |
150 | #define Z_8 U8(Z_89ab >> 24) |
151 | #define Z_9 U8(Z_89ab >> 16) |
152 | #define Z_a U8(Z_89ab >> 8) |
153 | #define Z_b U8(Z_89ab >> 0) |
154 | #define Z_c U8(Z_cdef >> 24) |
155 | #define Z_d U8(Z_cdef >> 16) |
156 | #define Z_e U8(Z_cdef >> 8) |
157 | #define Z_f U8(Z_cdef >> 0) |
158 | |
159 | #define SK(w, x, y, z) \ |
160 | cast_sk[0][w] ^ cast_sk[1][x] ^ cast_sk[2][y] ^ cast_sk[3][z] |
161 | |
162 | i = 0; |
163 | Z_0123 = X_0123 ^ SK(X_d, X_f, X_c, X_e) ^ cast_sk[2][X_8]; |
164 | Z_4567 = X_89ab ^ SK(Z_0, Z_2, Z_1, Z_3) ^ cast_sk[3][X_a]; |
165 | Z_89ab = X_cdef ^ SK(Z_7, Z_6, Z_5, Z_4) ^ cast_sk[0][X_9]; |
166 | Z_cdef = X_4567 ^ SK(Z_a, Z_9, Z_b, Z_8) ^ cast_sk[1][X_b]; |
167 | k->km[i++] = SK(Z_8, Z_9, Z_7, Z_6) ^ cast_sk[0][Z_2]; |
168 | k->km[i++] = SK(Z_a, Z_b, Z_5, Z_4) ^ cast_sk[1][Z_6]; |
169 | k->km[i++] = SK(Z_c, Z_d, Z_3, Z_2) ^ cast_sk[2][Z_9]; |
170 | k->km[i++] = SK(Z_e, Z_f, Z_1, Z_0) ^ cast_sk[3][Z_c]; |
171 | X_0123 = Z_89ab ^ SK(Z_5, Z_7, Z_4, Z_6) ^ cast_sk[2][Z_0]; |
172 | X_4567 = Z_0123 ^ SK(X_0, X_2, X_1, X_3) ^ cast_sk[3][Z_2]; |
173 | X_89ab = Z_4567 ^ SK(X_7, X_6, X_5, X_4) ^ cast_sk[0][Z_1]; |
174 | X_cdef = Z_cdef ^ SK(X_a, X_9, X_b, X_8) ^ cast_sk[1][Z_3]; |
175 | k->km[i++] = SK(X_3, X_2, X_c, X_d) ^ cast_sk[0][X_8]; |
176 | k->km[i++] = SK(X_1, X_0, X_e, X_f) ^ cast_sk[1][X_d]; |
177 | k->km[i++] = SK(X_7, X_6, X_8, X_9) ^ cast_sk[2][X_3]; |
178 | k->km[i++] = SK(X_5, X_4, X_a, X_b) ^ cast_sk[3][X_7]; |
179 | Z_0123 = X_0123 ^ SK(X_d, X_f, X_c, X_e) ^ cast_sk[2][X_8]; |
180 | Z_4567 = X_89ab ^ SK(Z_0, Z_2, Z_1, Z_3) ^ cast_sk[3][X_a]; |
181 | Z_89ab = X_cdef ^ SK(Z_7, Z_6, Z_5, Z_4) ^ cast_sk[0][X_9]; |
182 | Z_cdef = X_4567 ^ SK(Z_a, Z_9, Z_b, Z_8) ^ cast_sk[1][X_b]; |
183 | k->km[i++] = SK(Z_3, Z_2, Z_c, Z_d) ^ cast_sk[0][Z_9]; |
184 | k->km[i++] = SK(Z_1, Z_0, Z_e, Z_f) ^ cast_sk[1][Z_c]; |
185 | k->km[i++] = SK(Z_7, Z_6, Z_8, Z_9) ^ cast_sk[2][Z_2]; |
186 | k->km[i++] = SK(Z_5, Z_4, Z_a, Z_b) ^ cast_sk[3][Z_6]; |
187 | X_0123 = Z_89ab ^ SK(Z_5, Z_7, Z_4, Z_6) ^ cast_sk[2][Z_0]; |
188 | X_4567 = Z_0123 ^ SK(X_0, X_2, X_1, X_3) ^ cast_sk[3][Z_2]; |
189 | X_89ab = Z_4567 ^ SK(X_7, X_6, X_5, X_4) ^ cast_sk[0][Z_1]; |
190 | X_cdef = Z_cdef ^ SK(X_a, X_9, X_b, X_8) ^ cast_sk[1][Z_3]; |
191 | k->km[i++] = SK(X_8, X_9, X_7, X_6) ^ cast_sk[0][X_3]; |
192 | k->km[i++] = SK(X_a, X_b, X_5, X_4) ^ cast_sk[1][X_7]; |
193 | k->km[i++] = SK(X_c, X_d, X_3, X_2) ^ cast_sk[2][X_8]; |
194 | k->km[i++] = SK(X_e, X_f, X_1, X_0) ^ cast_sk[3][X_d]; |
195 | |
196 | i = 0; |
197 | Z_0123 = X_0123 ^ SK(X_d, X_f, X_c, X_e) ^ cast_sk[2][X_8]; |
198 | Z_4567 = X_89ab ^ SK(Z_0, Z_2, Z_1, Z_3) ^ cast_sk[3][X_a]; |
199 | Z_89ab = X_cdef ^ SK(Z_7, Z_6, Z_5, Z_4) ^ cast_sk[0][X_9]; |
200 | Z_cdef = X_4567 ^ SK(Z_a, Z_9, Z_b, Z_8) ^ cast_sk[1][X_b]; |
201 | k->kr[i++] = (SK(Z_8, Z_9, Z_7, Z_6) ^ cast_sk[0][Z_2]) & 0x1f; |
202 | k->kr[i++] = (SK(Z_a, Z_b, Z_5, Z_4) ^ cast_sk[1][Z_6]) & 0x1f; |
203 | k->kr[i++] = (SK(Z_c, Z_d, Z_3, Z_2) ^ cast_sk[2][Z_9]) & 0x1f; |
204 | k->kr[i++] = (SK(Z_e, Z_f, Z_1, Z_0) ^ cast_sk[3][Z_c]) & 0x1f; |
205 | X_0123 = Z_89ab ^ SK(Z_5, Z_7, Z_4, Z_6) ^ cast_sk[2][Z_0]; |
206 | X_4567 = Z_0123 ^ SK(X_0, X_2, X_1, X_3) ^ cast_sk[3][Z_2]; |
207 | X_89ab = Z_4567 ^ SK(X_7, X_6, X_5, X_4) ^ cast_sk[0][Z_1]; |
208 | X_cdef = Z_cdef ^ SK(X_a, X_9, X_b, X_8) ^ cast_sk[1][Z_3]; |
209 | k->kr[i++] = (SK(X_3, X_2, X_c, X_d) ^ cast_sk[0][X_8]) & 0x1f; |
210 | k->kr[i++] = (SK(X_1, X_0, X_e, X_f) ^ cast_sk[1][X_d]) & 0x1f; |
211 | k->kr[i++] = (SK(X_7, X_6, X_8, X_9) ^ cast_sk[2][X_3]) & 0x1f; |
212 | k->kr[i++] = (SK(X_5, X_4, X_a, X_b) ^ cast_sk[3][X_7]) & 0x1f; |
213 | Z_0123 = X_0123 ^ SK(X_d, X_f, X_c, X_e) ^ cast_sk[2][X_8]; |
214 | Z_4567 = X_89ab ^ SK(Z_0, Z_2, Z_1, Z_3) ^ cast_sk[3][X_a]; |
215 | Z_89ab = X_cdef ^ SK(Z_7, Z_6, Z_5, Z_4) ^ cast_sk[0][X_9]; |
216 | Z_cdef = X_4567 ^ SK(Z_a, Z_9, Z_b, Z_8) ^ cast_sk[1][X_b]; |
217 | k->kr[i++] = (SK(Z_3, Z_2, Z_c, Z_d) ^ cast_sk[0][Z_9]) & 0x1f; |
218 | k->kr[i++] = (SK(Z_1, Z_0, Z_e, Z_f) ^ cast_sk[1][Z_c]) & 0x1f; |
219 | k->kr[i++] = (SK(Z_7, Z_6, Z_8, Z_9) ^ cast_sk[2][Z_2]) & 0x1f; |
220 | k->kr[i++] = (SK(Z_5, Z_4, Z_a, Z_b) ^ cast_sk[3][Z_6]) & 0x1f; |
221 | X_0123 = Z_89ab ^ SK(Z_5, Z_7, Z_4, Z_6) ^ cast_sk[2][Z_0]; |
222 | X_4567 = Z_0123 ^ SK(X_0, X_2, X_1, X_3) ^ cast_sk[3][Z_2]; |
223 | X_89ab = Z_4567 ^ SK(X_7, X_6, X_5, X_4) ^ cast_sk[0][Z_1]; |
224 | X_cdef = Z_cdef ^ SK(X_a, X_9, X_b, X_8) ^ cast_sk[1][Z_3]; |
225 | k->kr[i++] = (SK(X_8, X_9, X_7, X_6) ^ cast_sk[0][X_3]) & 0x1f; |
226 | k->kr[i++] = (SK(X_a, X_b, X_5, X_4) ^ cast_sk[1][X_7]) & 0x1f; |
227 | k->kr[i++] = (SK(X_c, X_d, X_3, X_2) ^ cast_sk[2][X_8]) & 0x1f; |
228 | k->kr[i++] = (SK(X_e, X_f, X_1, X_0) ^ cast_sk[3][X_d]) & 0x1f; |
229 | |
230 | BURN(kk); |
231 | } |
232 | |
233 | /* --- @cast128_eblk@, @cast128_dblk@ --- * |
234 | * |
235 | * Arguments: @const cast128_ctx *k@ = pointer to key block |
236 | * @const uint32 s[2]@ = pointer to source block |
237 | * @uint32 d[2]@ = pointer to destination block |
238 | * |
239 | * Returns: --- |
240 | * |
241 | * Use: Low-level block encryption and decryption. |
242 | */ |
243 | |
244 | void cast128_eblk(const cast128_ctx *k, const uint32 *s, uint32 *d) |
245 | { |
246 | uint32 a = s[0], b = s[1]; |
247 | const uint32 *km = k->km; |
248 | const octet *kr = k->kr; |
249 | |
250 | switch (k->r) { |
251 | default: |
252 | CAST_R1(*km++, *kr++, a, b); |
253 | CAST_R2(*km++, *kr++, b, a); |
254 | CAST_R3(*km++, *kr++, a, b); |
255 | CAST_R1(*km++, *kr++, b, a); |
256 | CAST_R2(*km++, *kr++, a, b); |
257 | CAST_R3(*km++, *kr++, b, a); |
258 | CAST_R1(*km++, *kr++, a, b); |
259 | CAST_R2(*km++, *kr++, b, a); |
260 | CAST_R3(*km++, *kr++, a, b); |
261 | CAST_R1(*km++, *kr++, b, a); |
262 | CAST_R2(*km++, *kr++, a, b); |
263 | CAST_R3(*km++, *kr++, b, a); |
264 | if (k->r == 12) |
265 | break; |
266 | CAST_R1(*km++, *kr++, a, b); |
267 | CAST_R2(*km++, *kr++, b, a); |
268 | CAST_R3(*km++, *kr++, a, b); |
269 | CAST_R1(*km++, *kr++, b, a); |
270 | break; |
271 | } |
272 | |
273 | d[0] = b; d[1] = a; |
274 | } |
275 | |
276 | void cast128_dblk(const cast128_ctx *k, const uint32 *s, uint32 *d) |
277 | { |
278 | uint32 a = s[0], b = s[1]; |
279 | const uint32 *km = k->km + k->r; |
280 | const octet *kr = k->kr + k->r; |
281 | |
282 | switch (k->r) { |
283 | case 16: |
284 | default: |
285 | CAST_R1(*--km, *--kr, a, b); |
286 | CAST_R3(*--km, *--kr, b, a); |
287 | CAST_R2(*--km, *--kr, a, b); |
288 | CAST_R1(*--km, *--kr, b, a); |
289 | case 12: |
290 | CAST_R3(*--km, *--kr, a, b); |
291 | CAST_R2(*--km, *--kr, b, a); |
292 | CAST_R1(*--km, *--kr, a, b); |
293 | CAST_R3(*--km, *--kr, b, a); |
294 | CAST_R2(*--km, *--kr, a, b); |
295 | CAST_R1(*--km, *--kr, b, a); |
296 | CAST_R3(*--km, *--kr, a, b); |
297 | CAST_R2(*--km, *--kr, b, a); |
298 | CAST_R1(*--km, *--kr, a, b); |
299 | CAST_R3(*--km, *--kr, b, a); |
300 | CAST_R2(*--km, *--kr, a, b); |
301 | CAST_R1(*--km, *--kr, b, a); |
302 | break; |
303 | } |
304 | |
305 | d[0] = b; d[1] = a; |
306 | } |
307 | |
308 | BLKC_TEST(CAST128, cast128) |
309 | |
310 | /*----- That's all, folks -------------------------------------------------*/ |