[u/mdw/catacomb] / cast128.c

/* -*-c-*-
 *
 * $Id: cast128.c,v 1.2 2004/04/08 01:36:15 mdw Exp $
 *
 * The CAST-128 block cipher
 *
 * (c) 2000 Straylight/Edgeware
 */

/*----- Licensing notice --------------------------------------------------*
 *
 * This file is part of Catacomb.
 *
 * Catacomb is free software; you can redistribute it and/or modify
 * it under the terms of the GNU Library General Public License as
 * published by the Free Software Foundation; either version 2 of the
 * License, or (at your option) any later version.
 *
 * Catacomb is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Library General Public License for more details.
 *
 * You should have received a copy of the GNU Library General Public
 * License along with Catacomb; if not, write to the Free
 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
 * MA 02111-1307, USA.
 */

/*----- Header files ------------------------------------------------------*/

#include <assert.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include <mLib/bits.h>

#include "blkc.h"
#include "cast-base.h"
#include "cast128.h"
#include "gcipher.h"
#include "paranoia.h"

/*----- Global variables --------------------------------------------------*/

const octet cast128_keysz[] = { KSZ_RANGE, CAST128_KEYSZ, 0, 16, 1 };

/*----- Main code ---------------------------------------------------------*/

/* --- @cast128_init@ --- *
 *
 * Arguments:	@cast128_ctx *k@ = pointer to key block to fill in
 *		@const void *buf@ = pointer to buffer of key material
 *		@size_t sz@ = size of key material
 *
 * Returns:	---
 *
 * Use:		Initializes a CAST-128 key buffer.  CAST-128 accepts
 *		128-bit keys or shorter.
 */

void cast128_init(cast128_ctx *k, const void *buf, size_t sz)
{
  const octet *p = buf;
  uint32 kk[4];
  unsigned i;
  uint32 a, b, c, d,  aa, bb, cc, dd;

  /* --- Fiddle with the key size a bit --- */

  KSZ_ASSERT(cast128, sz);

  if (sz > 10)
    k->r = 16;
  else
    k->r = 12;

  /* --- Read the key into the array --- */

  i = 0;
  b = 32; aa = 0;
  for (;;) {
    if (!sz)
      break;
    b -= 8;
    aa |= ((uint32)*p++ << b);
    sz--;
    if (b == 0) {
      kk[i++] = aa;
      if (i == 4)
	break;
      aa = 0;
      b = 32;
    }
  }

  for (; i < 4; i++) {
    kk[i] = aa;
    aa = 0;
  }

  /* --- Read the key words out --- */

  a = kk[0]; b = kk[1]; c = kk[2]; d = kk[3];

#define X_0123 a
#define X_4567 b
#define X_89ab c
#define X_cdef d

#define X_0 U8(X_0123 >> 24)
#define X_1 U8(X_0123 >> 16)
#define X_2 U8(X_0123 >>  8)
#define X_3 U8(X_0123 >>  0)
#define X_4 U8(X_4567 >> 24)
#define X_5 U8(X_4567 >> 16)
#define X_6 U8(X_4567 >>  8)
#define X_7 U8(X_4567 >>  0)
#define X_8 U8(X_89ab >> 24)
#define X_9 U8(X_89ab >> 16)
#define X_a U8(X_89ab >>  8)
#define X_b U8(X_89ab >>  0)
#define X_c U8(X_cdef >> 24)
#define X_d U8(X_cdef >> 16)
#define X_e U8(X_cdef >>  8)
#define X_f U8(X_cdef >>  0)

#define Z_0123 aa
#define Z_4567 bb
#define Z_89ab cc
#define Z_cdef dd

#define Z_0 U8(Z_0123 >> 24)
#define Z_1 U8(Z_0123 >> 16)
#define Z_2 U8(Z_0123 >>  8)
#define Z_3 U8(Z_0123 >>  0)
#define Z_4 U8(Z_4567 >> 24)
#define Z_5 U8(Z_4567 >> 16)
#define Z_6 U8(Z_4567 >>  8)
#define Z_7 U8(Z_4567 >>  0)
#define Z_8 U8(Z_89ab >> 24)
#define Z_9 U8(Z_89ab >> 16)
#define Z_a U8(Z_89ab >>  8)
#define Z_b U8(Z_89ab >>  0)
#define Z_c U8(Z_cdef >> 24)
#define Z_d U8(Z_cdef >> 16)
#define Z_e U8(Z_cdef >>  8)
#define Z_f U8(Z_cdef >>  0)

#define SK(w, x, y, z)							\
  cast_sk[0][w] ^ cast_sk[1][x] ^ cast_sk[2][y] ^ cast_sk[3][z]

  i = 0;
  Z_0123 = X_0123 ^ SK(X_d, X_f, X_c, X_e) ^ cast_sk[2][X_8];
  Z_4567 = X_89ab ^ SK(Z_0, Z_2, Z_1, Z_3) ^ cast_sk[3][X_a];
  Z_89ab = X_cdef ^ SK(Z_7, Z_6, Z_5, Z_4) ^ cast_sk[0][X_9];
  Z_cdef = X_4567 ^ SK(Z_a, Z_9, Z_b, Z_8) ^ cast_sk[1][X_b];
  k->km[i++] = SK(Z_8, Z_9, Z_7, Z_6) ^ cast_sk[0][Z_2];
  k->km[i++] = SK(Z_a, Z_b, Z_5, Z_4) ^ cast_sk[1][Z_6];
  k->km[i++] = SK(Z_c, Z_d, Z_3, Z_2) ^ cast_sk[2][Z_9];
  k->km[i++] = SK(Z_e, Z_f, Z_1, Z_0) ^ cast_sk[3][Z_c];
  X_0123 = Z_89ab ^ SK(Z_5, Z_7, Z_4, Z_6) ^ cast_sk[2][Z_0];
  X_4567 = Z_0123 ^ SK(X_0, X_2, X_1, X_3) ^ cast_sk[3][Z_2];
  X_89ab = Z_4567 ^ SK(X_7, X_6, X_5, X_4) ^ cast_sk[0][Z_1];
  X_cdef = Z_cdef ^ SK(X_a, X_9, X_b, X_8) ^ cast_sk[1][Z_3];
  k->km[i++] = SK(X_3, X_2, X_c, X_d) ^ cast_sk[0][X_8];
  k->km[i++] = SK(X_1, X_0, X_e, X_f) ^ cast_sk[1][X_d];
  k->km[i++] = SK(X_7, X_6, X_8, X_9) ^ cast_sk[2][X_3];
  k->km[i++] = SK(X_5, X_4, X_a, X_b) ^ cast_sk[3][X_7];
  Z_0123 = X_0123 ^ SK(X_d, X_f, X_c, X_e) ^ cast_sk[2][X_8];
  Z_4567 = X_89ab ^ SK(Z_0, Z_2, Z_1, Z_3) ^ cast_sk[3][X_a];
  Z_89ab = X_cdef ^ SK(Z_7, Z_6, Z_5, Z_4) ^ cast_sk[0][X_9];
  Z_cdef = X_4567 ^ SK(Z_a, Z_9, Z_b, Z_8) ^ cast_sk[1][X_b];
  k->km[i++] = SK(Z_3, Z_2, Z_c, Z_d) ^ cast_sk[0][Z_9];
  k->km[i++] = SK(Z_1, Z_0, Z_e, Z_f) ^ cast_sk[1][Z_c];
  k->km[i++] = SK(Z_7, Z_6, Z_8, Z_9) ^ cast_sk[2][Z_2];
  k->km[i++] = SK(Z_5, Z_4, Z_a, Z_b) ^ cast_sk[3][Z_6];
  X_0123 = Z_89ab ^ SK(Z_5, Z_7, Z_4, Z_6) ^ cast_sk[2][Z_0];
  X_4567 = Z_0123 ^ SK(X_0, X_2, X_1, X_3) ^ cast_sk[3][Z_2];
  X_89ab = Z_4567 ^ SK(X_7, X_6, X_5, X_4) ^ cast_sk[0][Z_1];
  X_cdef = Z_cdef ^ SK(X_a, X_9, X_b, X_8) ^ cast_sk[1][Z_3];
  k->km[i++] = SK(X_8, X_9, X_7, X_6) ^ cast_sk[0][X_3];
  k->km[i++] = SK(X_a, X_b, X_5, X_4) ^ cast_sk[1][X_7];
  k->km[i++] = SK(X_c, X_d, X_3, X_2) ^ cast_sk[2][X_8];
  k->km[i++] = SK(X_e, X_f, X_1, X_0) ^ cast_sk[3][X_d];

  i = 0;
  Z_0123 = X_0123 ^ SK(X_d, X_f, X_c, X_e) ^ cast_sk[2][X_8];
  Z_4567 = X_89ab ^ SK(Z_0, Z_2, Z_1, Z_3) ^ cast_sk[3][X_a];
  Z_89ab = X_cdef ^ SK(Z_7, Z_6, Z_5, Z_4) ^ cast_sk[0][X_9];
  Z_cdef = X_4567 ^ SK(Z_a, Z_9, Z_b, Z_8) ^ cast_sk[1][X_b];
  k->kr[i++] = (SK(Z_8, Z_9, Z_7, Z_6) ^ cast_sk[0][Z_2]) & 0x1f;
  k->kr[i++] = (SK(Z_a, Z_b, Z_5, Z_4) ^ cast_sk[1][Z_6]) & 0x1f;
  k->kr[i++] = (SK(Z_c, Z_d, Z_3, Z_2) ^ cast_sk[2][Z_9]) & 0x1f;
  k->kr[i++] = (SK(Z_e, Z_f, Z_1, Z_0) ^ cast_sk[3][Z_c]) & 0x1f;
  X_0123 = Z_89ab ^ SK(Z_5, Z_7, Z_4, Z_6) ^ cast_sk[2][Z_0];
  X_4567 = Z_0123 ^ SK(X_0, X_2, X_1, X_3) ^ cast_sk[3][Z_2];
  X_89ab = Z_4567 ^ SK(X_7, X_6, X_5, X_4) ^ cast_sk[0][Z_1];
  X_cdef = Z_cdef ^ SK(X_a, X_9, X_b, X_8) ^ cast_sk[1][Z_3];
  k->kr[i++] = (SK(X_3, X_2, X_c, X_d) ^ cast_sk[0][X_8]) & 0x1f;
  k->kr[i++] = (SK(X_1, X_0, X_e, X_f) ^ cast_sk[1][X_d]) & 0x1f;
  k->kr[i++] = (SK(X_7, X_6, X_8, X_9) ^ cast_sk[2][X_3]) & 0x1f;
  k->kr[i++] = (SK(X_5, X_4, X_a, X_b) ^ cast_sk[3][X_7]) & 0x1f;
  Z_0123 = X_0123 ^ SK(X_d, X_f, X_c, X_e) ^ cast_sk[2][X_8];
  Z_4567 = X_89ab ^ SK(Z_0, Z_2, Z_1, Z_3) ^ cast_sk[3][X_a];
  Z_89ab = X_cdef ^ SK(Z_7, Z_6, Z_5, Z_4) ^ cast_sk[0][X_9];
  Z_cdef = X_4567 ^ SK(Z_a, Z_9, Z_b, Z_8) ^ cast_sk[1][X_b];
  k->kr[i++] = (SK(Z_3, Z_2, Z_c, Z_d) ^ cast_sk[0][Z_9]) & 0x1f;
  k->kr[i++] = (SK(Z_1, Z_0, Z_e, Z_f) ^ cast_sk[1][Z_c]) & 0x1f;
  k->kr[i++] = (SK(Z_7, Z_6, Z_8, Z_9) ^ cast_sk[2][Z_2]) & 0x1f;
  k->kr[i++] = (SK(Z_5, Z_4, Z_a, Z_b) ^ cast_sk[3][Z_6]) & 0x1f;
  X_0123 = Z_89ab ^ SK(Z_5, Z_7, Z_4, Z_6) ^ cast_sk[2][Z_0];
  X_4567 = Z_0123 ^ SK(X_0, X_2, X_1, X_3) ^ cast_sk[3][Z_2];
  X_89ab = Z_4567 ^ SK(X_7, X_6, X_5, X_4) ^ cast_sk[0][Z_1];
  X_cdef = Z_cdef ^ SK(X_a, X_9, X_b, X_8) ^ cast_sk[1][Z_3];
  k->kr[i++] = (SK(X_8, X_9, X_7, X_6) ^ cast_sk[0][X_3]) & 0x1f;
  k->kr[i++] = (SK(X_a, X_b, X_5, X_4) ^ cast_sk[1][X_7]) & 0x1f;
  k->kr[i++] = (SK(X_c, X_d, X_3, X_2) ^ cast_sk[2][X_8]) & 0x1f;
  k->kr[i++] = (SK(X_e, X_f, X_1, X_0) ^ cast_sk[3][X_d]) & 0x1f;

  BURN(kk);
}

/* --- @cast128_eblk@, @cast128_dblk@ --- *
 *
 * Arguments:	@const cast128_ctx *k@ = pointer to key block
 *		@const uint32 s[2]@ = pointer to source block
 *		@uint32 d[2]@ = pointer to destination block
 *
 * Returns:	---
 *
 * Use:		Low-level block encryption and decryption.
 */

void cast128_eblk(const cast128_ctx *k, const uint32 *s, uint32 *d)
{
  uint32 a = s[0], b = s[1];
  const uint32 *km = k->km;
  const octet *kr = k->kr;

  switch (k->r) {
    default:
      CAST_R1(*km++, *kr++, a, b);
      CAST_R2(*km++, *kr++, b, a);
      CAST_R3(*km++, *kr++, a, b);
      CAST_R1(*km++, *kr++, b, a);
      CAST_R2(*km++, *kr++, a, b);
      CAST_R3(*km++, *kr++, b, a);
      CAST_R1(*km++, *kr++, a, b);
      CAST_R2(*km++, *kr++, b, a);
      CAST_R3(*km++, *kr++, a, b);
      CAST_R1(*km++, *kr++, b, a);
      CAST_R2(*km++, *kr++, a, b);
      CAST_R3(*km++, *kr++, b, a);
      if (k->r == 12)
	break;
      CAST_R1(*km++, *kr++, a, b);
      CAST_R2(*km++, *kr++, b, a);
      CAST_R3(*km++, *kr++, a, b);
      CAST_R1(*km++, *kr++, b, a);
      break;
  }

  d[0] = b; d[1] = a;
}

void cast128_dblk(const cast128_ctx *k, const uint32 *s, uint32 *d)
{
  uint32 a = s[0], b = s[1];
  const uint32 *km = k->km + k->r;
  const octet *kr = k->kr + k->r;

  switch (k->r) {
    case 16:
    default:
      CAST_R1(*--km, *--kr, a, b);
      CAST_R3(*--km, *--kr, b, a);
      CAST_R2(*--km, *--kr, a, b);
      CAST_R1(*--km, *--kr, b, a);
    case 12:
      CAST_R3(*--km, *--kr, a, b);
      CAST_R2(*--km, *--kr, b, a);
      CAST_R1(*--km, *--kr, a, b);
      CAST_R3(*--km, *--kr, b, a);
      CAST_R2(*--km, *--kr, a, b);
      CAST_R1(*--km, *--kr, b, a);
      CAST_R3(*--km, *--kr, a, b);
      CAST_R2(*--km, *--kr, b, a);
      CAST_R1(*--km, *--kr, a, b);
      CAST_R3(*--km, *--kr, b, a);
      CAST_R2(*--km, *--kr, a, b);
      CAST_R1(*--km, *--kr, b, a);
      break;
  }

  d[0] = b; d[1] = a;
}

BLKC_TEST(CAST128, cast128)

/*----- That's all, folks -------------------------------------------------*/
Commit	Line	Data
9810d749	1	/* --c--
9810d749	2	*
b817bfc6	3	* $Id: cast128.c,v 1.2 2004/04/08 01:36:15 mdw Exp $
9810d749	4	*
	5	* The CAST-128 block cipher
	6	*
	7	* (c) 2000 Straylight/Edgeware
	8	*/
	9
45c0fd36	10	/----- Licensing notice --------------------------------------------------
9810d749	11	*
	12	* This file is part of Catacomb.
	13	*
	14	* Catacomb is free software; you can redistribute it and/or modify
	15	* it under the terms of the GNU Library General Public License as
	16	* published by the Free Software Foundation; either version 2 of the
	17	* License, or (at your option) any later version.
45c0fd36	18	*
9810d749	19	* Catacomb is distributed in the hope that it will be useful,
	20	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	21	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	22	* GNU Library General Public License for more details.
45c0fd36	23	*
9810d749	24	* You should have received a copy of the GNU Library General Public
	25	* License along with Catacomb; if not, write to the Free
	26	* Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
	27	* MA 02111-1307, USA.
	28	*/
	29
9810d749	30	/----- Header files ------------------------------------------------------/
	31
	32	#include <assert.h>
	33	#include <stdio.h>
	34	#include <stdlib.h>
	35	#include <string.h>
	36
	37	#include <mLib/bits.h>
	38
	39	#include "blkc.h"
	40	#include "cast-base.h"
	41	#include "cast128.h"
	42	#include "gcipher.h"
	43	#include "paranoia.h"
	44
	45	/----- Global variables --------------------------------------------------/
	46
	47	const octet cast128_keysz[] = { KSZ_RANGE, CAST128_KEYSZ, 0, 16, 1 };
	48
	49	/----- Main code ---------------------------------------------------------/
	50
	51	/* --- @cast128_init@ --- *
	52	*
	53	* Arguments: @cast128_ctx *k@ = pointer to key block to fill in
	54	* @const void *buf@ = pointer to buffer of key material
	55	* @size_t sz@ = size of key material
	56	*
	57	* Returns: ---
	58	*
	59	* Use: Initializes a CAST-128 key buffer. CAST-128 accepts
	60	* 128-bit keys or shorter.
	61	*/
	62
	63	void cast128_init(cast128_ctx k, const void buf, size_t sz)
	64	{
	65	const octet *p = buf;
	66	uint32 kk[4];
	67	unsigned i;
	68	uint32 a, b, c, d, aa, bb, cc, dd;
	69
	70	/* --- Fiddle with the key size a bit --- */
	71
	72	KSZ_ASSERT(cast128, sz);
	73
	74	if (sz > 10)
	75	k->r = 16;
	76	else
	77	k->r = 12;
	78
	79	/* --- Read the key into the array --- */
	80
	81	i = 0;
	82	b = 32; aa = 0;
	83	for (;;) {
	84	if (!sz)
	85	break;
	86	b -= 8;
	87	aa \|= ((uint32)*p++ << b);
	88	sz--;
	89	if (b == 0) {
	90	kk[i++] = aa;
	91	if (i == 4)
	92	break;
	93	aa = 0;
94	b = 32;
95	}
96	}
97
98	for (; i < 4; i++) {
99	kk[i] = aa;
100	aa = 0;
101	}
102
103	/* --- Read the key words out --- */
104
105	a = kk[0]; b = kk[1]; c = kk[2]; d = kk[3];
106
107	#define X_0123 a
108	#define X_4567 b
109	#define X_89ab c
110	#define X_cdef d
111
112	#define X_0 U8(X_0123 >> 24)
113	#define X_1 U8(X_0123 >> 16)
114	#define X_2 U8(X_0123 >> 8)
115	#define X_3 U8(X_0123 >> 0)
116	#define X_4 U8(X_4567 >> 24)
117	#define X_5 U8(X_4567 >> 16)
118	#define X_6 U8(X_4567 >> 8)
119	#define X_7 U8(X_4567 >> 0)
120	#define X_8 U8(X_89ab >> 24)
121	#define X_9 U8(X_89ab >> 16)
122	#define X_a U8(X_89ab >> 8)
123	#define X_b U8(X_89ab >> 0)
124	#define X_c U8(X_cdef >> 24)
125	#define X_d U8(X_cdef >> 16)
126	#define X_e U8(X_cdef >> 8)
127	#define X_f U8(X_cdef >> 0)
128
129	#define Z_0123 aa
130	#define Z_4567 bb
131	#define Z_89ab cc
132	#define Z_cdef dd
133
134	#define Z_0 U8(Z_0123 >> 24)
135	#define Z_1 U8(Z_0123 >> 16)
136	#define Z_2 U8(Z_0123 >> 8)
137	#define Z_3 U8(Z_0123 >> 0)
138	#define Z_4 U8(Z_4567 >> 24)
139	#define Z_5 U8(Z_4567 >> 16)
140	#define Z_6 U8(Z_4567 >> 8)
141	#define Z_7 U8(Z_4567 >> 0)
142	#define Z_8 U8(Z_89ab >> 24)
143	#define Z_9 U8(Z_89ab >> 16)
144	#define Z_a U8(Z_89ab >> 8)
145	#define Z_b U8(Z_89ab >> 0)
146	#define Z_c U8(Z_cdef >> 24)
147	#define Z_d U8(Z_cdef >> 16)
148	#define Z_e U8(Z_cdef >> 8)
149	#define Z_f U8(Z_cdef >> 0)
150
45c0fd36	151	#define SK(w, x, y, z) \
9810d749	152	cast_sk[0][w] ^ cast_sk[1][x] ^ cast_sk[2][y] ^ cast_sk[3][z]
	153
	154	i = 0;
	155	Z_0123 = X_0123 ^ SK(X_d, X_f, X_c, X_e) ^ cast_sk[2][X_8];
	156	Z_4567 = X_89ab ^ SK(Z_0, Z_2, Z_1, Z_3) ^ cast_sk[3][X_a];
	157	Z_89ab = X_cdef ^ SK(Z_7, Z_6, Z_5, Z_4) ^ cast_sk[0][X_9];
	158	Z_cdef = X_4567 ^ SK(Z_a, Z_9, Z_b, Z_8) ^ cast_sk[1][X_b];
	159	k->km[i++] = SK(Z_8, Z_9, Z_7, Z_6) ^ cast_sk[0][Z_2];
	160	k->km[i++] = SK(Z_a, Z_b, Z_5, Z_4) ^ cast_sk[1][Z_6];
	161	k->km[i++] = SK(Z_c, Z_d, Z_3, Z_2) ^ cast_sk[2][Z_9];
	162	k->km[i++] = SK(Z_e, Z_f, Z_1, Z_0) ^ cast_sk[3][Z_c];
	163	X_0123 = Z_89ab ^ SK(Z_5, Z_7, Z_4, Z_6) ^ cast_sk[2][Z_0];
	164	X_4567 = Z_0123 ^ SK(X_0, X_2, X_1, X_3) ^ cast_sk[3][Z_2];
	165	X_89ab = Z_4567 ^ SK(X_7, X_6, X_5, X_4) ^ cast_sk[0][Z_1];
	166	X_cdef = Z_cdef ^ SK(X_a, X_9, X_b, X_8) ^ cast_sk[1][Z_3];
	167	k->km[i++] = SK(X_3, X_2, X_c, X_d) ^ cast_sk[0][X_8];
	168	k->km[i++] = SK(X_1, X_0, X_e, X_f) ^ cast_sk[1][X_d];
	169	k->km[i++] = SK(X_7, X_6, X_8, X_9) ^ cast_sk[2][X_3];
	170	k->km[i++] = SK(X_5, X_4, X_a, X_b) ^ cast_sk[3][X_7];
	171	Z_0123 = X_0123 ^ SK(X_d, X_f, X_c, X_e) ^ cast_sk[2][X_8];
	172	Z_4567 = X_89ab ^ SK(Z_0, Z_2, Z_1, Z_3) ^ cast_sk[3][X_a];
	173	Z_89ab = X_cdef ^ SK(Z_7, Z_6, Z_5, Z_4) ^ cast_sk[0][X_9];
	174	Z_cdef = X_4567 ^ SK(Z_a, Z_9, Z_b, Z_8) ^ cast_sk[1][X_b];
	175	k->km[i++] = SK(Z_3, Z_2, Z_c, Z_d) ^ cast_sk[0][Z_9];
	176	k->km[i++] = SK(Z_1, Z_0, Z_e, Z_f) ^ cast_sk[1][Z_c];
	177	k->km[i++] = SK(Z_7, Z_6, Z_8, Z_9) ^ cast_sk[2][Z_2];
	178	k->km[i++] = SK(Z_5, Z_4, Z_a, Z_b) ^ cast_sk[3][Z_6];
	179	X_0123 = Z_89ab ^ SK(Z_5, Z_7, Z_4, Z_6) ^ cast_sk[2][Z_0];
	180	X_4567 = Z_0123 ^ SK(X_0, X_2, X_1, X_3) ^ cast_sk[3][Z_2];
	181	X_89ab = Z_4567 ^ SK(X_7, X_6, X_5, X_4) ^ cast_sk[0][Z_1];
	182	X_cdef = Z_cdef ^ SK(X_a, X_9, X_b, X_8) ^ cast_sk[1][Z_3];
	183	k->km[i++] = SK(X_8, X_9, X_7, X_6) ^ cast_sk[0][X_3];
	184	k->km[i++] = SK(X_a, X_b, X_5, X_4) ^ cast_sk[1][X_7];
	185	k->km[i++] = SK(X_c, X_d, X_3, X_2) ^ cast_sk[2][X_8];
	186	k->km[i++] = SK(X_e, X_f, X_1, X_0) ^ cast_sk[3][X_d];
	187
	188	i = 0;
	189	Z_0123 = X_0123 ^ SK(X_d, X_f, X_c, X_e) ^ cast_sk[2][X_8];
	190	Z_4567 = X_89ab ^ SK(Z_0, Z_2, Z_1, Z_3) ^ cast_sk[3][X_a];
	191	Z_89ab = X_cdef ^ SK(Z_7, Z_6, Z_5, Z_4) ^ cast_sk[0][X_9];
	192	Z_cdef = X_4567 ^ SK(Z_a, Z_9, Z_b, Z_8) ^ cast_sk[1][X_b];
	193	k->kr[i++] = (SK(Z_8, Z_9, Z_7, Z_6) ^ cast_sk[0][Z_2]) & 0x1f;
	194	k->kr[i++] = (SK(Z_a, Z_b, Z_5, Z_4) ^ cast_sk[1][Z_6]) & 0x1f;
	195	k->kr[i++] = (SK(Z_c, Z_d, Z_3, Z_2) ^ cast_sk[2][Z_9]) & 0x1f;
	196	k->kr[i++] = (SK(Z_e, Z_f, Z_1, Z_0) ^ cast_sk[3][Z_c]) & 0x1f;
	197	X_0123 = Z_89ab ^ SK(Z_5, Z_7, Z_4, Z_6) ^ cast_sk[2][Z_0];
	198	X_4567 = Z_0123 ^ SK(X_0, X_2, X_1, X_3) ^ cast_sk[3][Z_2];
	199	X_89ab = Z_4567 ^ SK(X_7, X_6, X_5, X_4) ^ cast_sk[0][Z_1];
	200	X_cdef = Z_cdef ^ SK(X_a, X_9, X_b, X_8) ^ cast_sk[1][Z_3];
	201	k->kr[i++] = (SK(X_3, X_2, X_c, X_d) ^ cast_sk[0][X_8]) & 0x1f;
	202	k->kr[i++] = (SK(X_1, X_0, X_e, X_f) ^ cast_sk[1][X_d]) & 0x1f;
	203	k->kr[i++] = (SK(X_7, X_6, X_8, X_9) ^ cast_sk[2][X_3]) & 0x1f;
	204	k->kr[i++] = (SK(X_5, X_4, X_a, X_b) ^ cast_sk[3][X_7]) & 0x1f;
	205	Z_0123 = X_0123 ^ SK(X_d, X_f, X_c, X_e) ^ cast_sk[2][X_8];
	206	Z_4567 = X_89ab ^ SK(Z_0, Z_2, Z_1, Z_3) ^ cast_sk[3][X_a];
	207	Z_89ab = X_cdef ^ SK(Z_7, Z_6, Z_5, Z_4) ^ cast_sk[0][X_9];
	208	Z_cdef = X_4567 ^ SK(Z_a, Z_9, Z_b, Z_8) ^ cast_sk[1][X_b];
	209	k->kr[i++] = (SK(Z_3, Z_2, Z_c, Z_d) ^ cast_sk[0][Z_9]) & 0x1f;
	210	k->kr[i++] = (SK(Z_1, Z_0, Z_e, Z_f) ^ cast_sk[1][Z_c]) & 0x1f;
	211	k->kr[i++] = (SK(Z_7, Z_6, Z_8, Z_9) ^ cast_sk[2][Z_2]) & 0x1f;
	212	k->kr[i++] = (SK(Z_5, Z_4, Z_a, Z_b) ^ cast_sk[3][Z_6]) & 0x1f;
	213	X_0123 = Z_89ab ^ SK(Z_5, Z_7, Z_4, Z_6) ^ cast_sk[2][Z_0];
	214	X_4567 = Z_0123 ^ SK(X_0, X_2, X_1, X_3) ^ cast_sk[3][Z_2];
	215	X_89ab = Z_4567 ^ SK(X_7, X_6, X_5, X_4) ^ cast_sk[0][Z_1];
216	X_cdef = Z_cdef ^ SK(X_a, X_9, X_b, X_8) ^ cast_sk[1][Z_3];
217	k->kr[i++] = (SK(X_8, X_9, X_7, X_6) ^ cast_sk[0][X_3]) & 0x1f;
218	k->kr[i++] = (SK(X_a, X_b, X_5, X_4) ^ cast_sk[1][X_7]) & 0x1f;
219	k->kr[i++] = (SK(X_c, X_d, X_3, X_2) ^ cast_sk[2][X_8]) & 0x1f;
220	k->kr[i++] = (SK(X_e, X_f, X_1, X_0) ^ cast_sk[3][X_d]) & 0x1f;
221
222	BURN(kk);
223	}
224
225	/* --- @cast128_eblk@, @cast128_dblk@ --- *
226	*
227	* Arguments: @const cast128_ctx *k@ = pointer to key block
228	* @const uint32 s[2]@ = pointer to source block
229	* @uint32 d[2]@ = pointer to destination block
230	*
231	* Returns: ---
232	*
233	* Use: Low-level block encryption and decryption.
234	*/
235
236	void cast128_eblk(const cast128_ctx k, const uint32 s, uint32 *d)
237	{
238	uint32 a = s[0], b = s[1];
239	const uint32 *km = k->km;
240	const octet *kr = k->kr;
241
242	switch (k->r) {
243	default:
244	CAST_R1(km++, kr++, a, b);
245	CAST_R2(km++, kr++, b, a);
246	CAST_R3(km++, kr++, a, b);
247	CAST_R1(km++, kr++, b, a);
248	CAST_R2(km++, kr++, a, b);
249	CAST_R3(km++, kr++, b, a);
250	CAST_R1(km++, kr++, a, b);
251	CAST_R2(km++, kr++, b, a);
252	CAST_R3(km++, kr++, a, b);
253	CAST_R1(km++, kr++, b, a);
254	CAST_R2(km++, kr++, a, b);
255	CAST_R3(km++, kr++, b, a);
256	if (k->r == 12)
257	break;
258	CAST_R1(km++, kr++, a, b);
259	CAST_R2(km++, kr++, b, a);
260	CAST_R3(km++, kr++, a, b);
261	CAST_R1(km++, kr++, b, a);
262	break;
263	}
264
265	d[0] = b; d[1] = a;
266	}
267
268	void cast128_dblk(const cast128_ctx k, const uint32 s, uint32 *d)
269	{
270	uint32 a = s[0], b = s[1];
271	const uint32 *km = k->km + k->r;
272	const octet *kr = k->kr + k->r;
273
274	switch (k->r) {
275	case 16:
276	default:
277	CAST_R1(--km, --kr, a, b);
278	CAST_R3(--km, --kr, b, a);
279	CAST_R2(--km, --kr, a, b);
280	CAST_R1(--km, --kr, b, a);
281	case 12:
282	CAST_R3(--km, --kr, a, b);
283	CAST_R2(--km, --kr, b, a);
284	CAST_R1(--km, --kr, a, b);
285	CAST_R3(--km, --kr, b, a);
286	CAST_R2(--km, --kr, a, b);
287	CAST_R1(--km, --kr, b, a);
288	CAST_R3(--km, --kr, a, b);
289	CAST_R2(--km, --kr, b, a);
290	CAST_R1(--km, --kr, a, b);
291	CAST_R3(--km, --kr, b, a);
292	CAST_R2(--km, --kr, a, b);
293	CAST_R1(--km, --kr, b, a);
294	break;
295	}
296
297	d[0] = b; d[1] = a;
298	}
299
300	BLKC_TEST(CAST128, cast128)
301
302	/----- That's all, folks -------------------------------------------------/