New cipher.

[u/mdw/catacomb] / rc2.c

/* -*-c-*-
 *
 * $Id: rc2.c,v 1.1 2000/06/17 11:54:34 mdw Exp $
 *
 * The RC2 block cipher
 *
 * (c) 2000 Straylight/Edgeware
 */

/*----- Licensing notice --------------------------------------------------* 
 *
 * This file is part of Catacomb.
 *
 * Catacomb is free software; you can redistribute it and/or modify
 * it under the terms of the GNU Library General Public License as
 * published by the Free Software Foundation; either version 2 of the
 * License, or (at your option) any later version.
 * 
 * Catacomb is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Library General Public License for more details.
 * 
 * You should have received a copy of the GNU Library General Public
 * License along with Catacomb; if not, write to the Free
 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
 * MA 02111-1307, USA.
 */

/*----- Revision history --------------------------------------------------* 
 *
 * $Log: rc2.c,v $
 * Revision 1.1  2000/06/17 11:54:34  mdw
 * New cipher.
 *
 */

/*----- Header files ------------------------------------------------------*/

#include <assert.h>
#include <stdio.h>

#include <mLib/bits.h>

#include "blkc.h"
#include "gcipher.h"
#include "paranoia.h"
#include "rc2.h"

/*----- Global variables --------------------------------------------------*/

const octet rc2_keysz[] = { KSZ_RANGE, RC2_KEYSZ, 1, 128, 1 };

/*----- Important tables --------------------------------------------------*/

static const octet pi[] = {
  0xd9,	0x78, 0xf9, 0xc4, 0x19,	0xdd, 0xb5, 0xed,
  0x28,	0xe9, 0xfd, 0x79, 0x4a,	0xa0, 0xd8, 0x9d,
  0xc6,	0x7e, 0x37, 0x83, 0x2b,	0x76, 0x53, 0x8e,
  0x62,	0x4c, 0x64, 0x88, 0x44,	0x8b, 0xfb, 0xa2,
  0x17,	0x9a, 0x59, 0xf5, 0x87,	0xb3, 0x4f, 0x13,
  0x61,	0x45, 0x6d, 0x8d, 0x09,	0x81, 0x7d, 0x32,
  0xbd,	0x8f, 0x40, 0xeb, 0x86,	0xb7, 0x7b, 0x0b,
  0xf0,	0x95, 0x21, 0x22, 0x5c,	0x6b, 0x4e, 0x82,
  0x54,	0xd6, 0x65, 0x93, 0xce,	0x60, 0xb2, 0x1c,
  0x73,	0x56, 0xc0, 0x14, 0xa7,	0x8c, 0xf1, 0xdc,
  0x12,	0x75, 0xca, 0x1f, 0x3b,	0xbe, 0xe4, 0xd1,
  0x42,	0x3d, 0xd4, 0x30, 0xa3,	0x3c, 0xb6, 0x26,
  0x6f,	0xbf, 0x0e, 0xda, 0x46,	0x69, 0x07, 0x57,
  0x27,	0xf2, 0x1d, 0x9b, 0xbc,	0x94, 0x43, 0x03,
  0xf8,	0x11, 0xc7, 0xf6, 0x90,	0xef, 0x3e, 0xe7,
  0x06,	0xc3, 0xd5, 0x2f, 0xc8,	0x66, 0x1e, 0xd7,
  0x08,	0xe8, 0xea, 0xde, 0x80,	0x52, 0xee, 0xf7,
  0x84,	0xaa, 0x72, 0xac, 0x35,	0x4d, 0x6a, 0x2a,
  0x96,	0x1a, 0xd2, 0x71, 0x5a,	0x15, 0x49, 0x74,
  0x4b,	0x9f, 0xd0, 0x5e, 0x04,	0x18, 0xa4, 0xec,
  0xc2,	0xe0, 0x41, 0x6e, 0x0f,	0x51, 0xcb, 0xcc,
  0x24,	0x91, 0xaf, 0x50, 0xa1,	0xf4, 0x70, 0x39,
  0x99,	0x7c, 0x3a, 0x85, 0x23,	0xb8, 0xb4, 0x7a,
  0xfc,	0x02, 0x36, 0x5b, 0x25,	0x55, 0x97, 0x31,
  0x2d,	0x5d, 0xfa, 0x98, 0xe3,	0x8a, 0x92, 0xae,
  0x05,	0xdf, 0x29, 0x10, 0x67,	0x6c, 0xba, 0xc9,
  0xd3,	0x00, 0xe6, 0xcf, 0xe1,	0x9e, 0xa8, 0x2c,
  0x63,	0x16, 0x01, 0x3f, 0x58,	0xe2, 0x89, 0xa9,
  0x0d,	0x38, 0x34, 0x1b, 0xab,	0x33, 0xff, 0xb0,
  0xbb,	0x48, 0x0c, 0x5f, 0xb9,	0xb1, 0xcd, 0x2e,
  0xc5,	0xf3, 0xdb, 0x47, 0xe5,	0xa5, 0x9c, 0x77,
  0x0a,	0xa6, 0x20, 0x68, 0xfe,	0x7f, 0xc1, 0xad
};

/*----- Main code ---------------------------------------------------------*/

/* --- @rc2_braindamage@ --- *
 *
 * Arguments:	@rc2_ctx *k@ = pointer to context to initialize
 *		@const void *buf@ = pointer to key material
 *		@size_t sz@ = size of key material in bytes
 *		@unsigned eb@ = desired effective key size, in bits
 *
 * Returns:	---
 *
 * Use:		Initializes an RC2 expanded key, and braindamages it to the
 *		requested effective key size.  This is here for compatibility
 *		reasons.  You should be using @rc2_init@ in normal code,
 *		which doesn't actually apply braindamage.
 */

void rc2_braindamage(rc2_ctx *k, const void *buf, size_t sz, unsigned eb)
{
  unsigned t8;
  uint16 tm;
  unsigned i;
  uint16 *kk;
  octet l[128];

  KSZ_ASSERT(rc2, sz);

  /* --- Compute the braindamage parameters --- */

  t8 = (eb + 7) / 8;
  tm = 0xff & ((1 << (8 + eb - 8 * t8)) - 1);

  /* --- Copy and expand the initial key --- */

  if (sz > sizeof(l))
    sz = sizeof(l);
  memcpy(l, buf, sz);

  for (i = sz; i < sizeof(l); i++)
    l[i] = pi[U8(l[i - 1] + l[i - sz])];

  /* --- Braindamage the key --- */

  i = sizeof(l) - t8;
  l[i] = pi[l[i] & tm];
  while (i) {
    i--;
    l[i] = pi[U8(l[i + 1] ^ l[i + t8])];
  }

  /* --- Write it to the key block --- */

  kk = k->k;
  for (i = 0; i < sizeof(l); i += 2)
    *kk++ = LOAD16_L(l + i);
  BURN(l);
}

/* --- @rc2_init@ --- *
 *
 * Arguments:	@rc2_ctx *k@ = pointer to context to initialize
 *		@const void *buf@ = pointer to key material
 *		@size_t sz@ = size of key material in bytes
 *
 * Returns:	---
 *
 * Use:		Initializes an RC2 expanded key.  The effective key size is
 *		set to be equal to the real key size, in bits.
 */

void rc2_init(rc2_ctx *k, const void *buf, size_t sz)
{
  rc2_braindamage(k, buf, sz, sz * 8);
}

/*----- Encryption and decryption -----------------------------------------*/

#define MIX(a, b, c, d, r, kk) do {					\
  a += *kk++ + (d & c) + (~d & b);					\
  a = ROL16(a, r);							\
} while (0)

#define MASH(a, d, k) do {						\
  a += k[d & 63];							\
} while (0)

#define UNMIX(a, b, c, d, r, kk) do {					\
  a = ROR16(a, r);							\
  a -= *--kk + (d & c) + (~d & b);					\
} while (0)

#define UNMASH(a, d, k) do {						\
  a -= k[d & 63];							\
} while (0)

/* --- @rc2_eblk@, @rc2_dblk@ --- *
 *
 * Arguments:	@const rc2_ctx *k@ = pointer to RC2 context
 *		@const uint32 s[2]@ = pointer to source block
 *		@const uint32 d[2]@ = pointer to destination block
 *
 * Returns:	---
 *
 * Use:		Low-level block encryption and decryption.
 */

void rc2_eblk(const rc2_ctx *k, const uint32 *s, uint32 *dst)
{
  uint16 a = U16(s[0] >>  0), b = U16(s[0] >> 16);
  uint16 c = U16(s[1] >>  0), d = U16(s[1] >> 16);
  const uint16 *kk = k->k;

  MIX(a, b, c, d, 1, kk); MIX(b, c, d, a, 2, kk);
  MIX(c, d, a, b, 3, kk); MIX(d, a, b, c, 5, kk);
  MIX(a, b, c, d, 1, kk); MIX(b, c, d, a, 2, kk);
  MIX(c, d, a, b, 3, kk); MIX(d, a, b, c, 5, kk);
  MIX(a, b, c, d, 1, kk); MIX(b, c, d, a, 2, kk);
  MIX(c, d, a, b, 3, kk); MIX(d, a, b, c, 5, kk);
  MIX(a, b, c, d, 1, kk); MIX(b, c, d, a, 2, kk);
  MIX(c, d, a, b, 3, kk); MIX(d, a, b, c, 5, kk);
  MIX(a, b, c, d, 1, kk); MIX(b, c, d, a, 2, kk);
  MIX(c, d, a, b, 3, kk); MIX(d, a, b, c, 5, kk);
  MASH(a, d, k->k); MASH(b, a, k->k);
  MASH(c, b, k->k); MASH(d, c, k->k);
  MIX(a, b, c, d, 1, kk); MIX(b, c, d, a, 2, kk);
  MIX(c, d, a, b, 3, kk); MIX(d, a, b, c, 5, kk);
  MIX(a, b, c, d, 1, kk); MIX(b, c, d, a, 2, kk);
  MIX(c, d, a, b, 3, kk); MIX(d, a, b, c, 5, kk);
  MIX(a, b, c, d, 1, kk); MIX(b, c, d, a, 2, kk);
  MIX(c, d, a, b, 3, kk); MIX(d, a, b, c, 5, kk);
  MIX(a, b, c, d, 1, kk); MIX(b, c, d, a, 2, kk);
  MIX(c, d, a, b, 3, kk); MIX(d, a, b, c, 5, kk);
  MIX(a, b, c, d, 1, kk); MIX(b, c, d, a, 2, kk);
  MIX(c, d, a, b, 3, kk); MIX(d, a, b, c, 5, kk);
  MIX(a, b, c, d, 1, kk); MIX(b, c, d, a, 2, kk);
  MIX(c, d, a, b, 3, kk); MIX(d, a, b, c, 5, kk);
  MASH(a, d, k->k); MASH(b, a, k->k);
  MASH(c, b, k->k); MASH(d, c, k->k);
  MIX(a, b, c, d, 1, kk); MIX(b, c, d, a, 2, kk);
  MIX(c, d, a, b, 3, kk); MIX(d, a, b, c, 5, kk);
  MIX(a, b, c, d, 1, kk); MIX(b, c, d, a, 2, kk);
  MIX(c, d, a, b, 3, kk); MIX(d, a, b, c, 5, kk);
  MIX(a, b, c, d, 1, kk); MIX(b, c, d, a, 2, kk);
  MIX(c, d, a, b, 3, kk); MIX(d, a, b, c, 5, kk);
  MIX(a, b, c, d, 1, kk); MIX(b, c, d, a, 2, kk);
  MIX(c, d, a, b, 3, kk); MIX(d, a, b, c, 5, kk);
  MIX(a, b, c, d, 1, kk); MIX(b, c, d, a, 2, kk);
  MIX(c, d, a, b, 3, kk); MIX(d, a, b, c, 5, kk);

  dst[0] = a | (b << 16); dst[1] = c | (d << 16);
}

void rc2_dblk(const rc2_ctx *k, const uint32 *s, uint32 *dst)
{
  uint16 a = U16(s[0] >>  0), b = U16(s[0] >> 16);
  uint16 c = U16(s[1] >>  0), d = U16(s[1] >> 16);
  const uint16 *kk = k->k + 64;

  UNMIX(d, a, b, c, 5, kk); UNMIX(c, d, a, b, 3, kk);
  UNMIX(b, c, d, a, 2, kk); UNMIX(a, b, c, d, 1, kk);
  UNMIX(d, a, b, c, 5, kk); UNMIX(c, d, a, b, 3, kk);
  UNMIX(b, c, d, a, 2, kk); UNMIX(a, b, c, d, 1, kk);
  UNMIX(d, a, b, c, 5, kk); UNMIX(c, d, a, b, 3, kk);
  UNMIX(b, c, d, a, 2, kk); UNMIX(a, b, c, d, 1, kk);
  UNMIX(d, a, b, c, 5, kk); UNMIX(c, d, a, b, 3, kk);
  UNMIX(b, c, d, a, 2, kk); UNMIX(a, b, c, d, 1, kk);
  UNMIX(d, a, b, c, 5, kk); UNMIX(c, d, a, b, 3, kk);
  UNMIX(b, c, d, a, 2, kk); UNMIX(a, b, c, d, 1, kk);
  UNMASH(d, c, k->k); UNMASH(c, b, k->k);
  UNMASH(b, a, k->k); UNMASH(a, d, k->k);
  UNMIX(d, a, b, c, 5, kk); UNMIX(c, d, a, b, 3, kk);
  UNMIX(b, c, d, a, 2, kk); UNMIX(a, b, c, d, 1, kk);
  UNMIX(d, a, b, c, 5, kk); UNMIX(c, d, a, b, 3, kk);
  UNMIX(b, c, d, a, 2, kk); UNMIX(a, b, c, d, 1, kk);
  UNMIX(d, a, b, c, 5, kk); UNMIX(c, d, a, b, 3, kk);
  UNMIX(b, c, d, a, 2, kk); UNMIX(a, b, c, d, 1, kk);
  UNMIX(d, a, b, c, 5, kk); UNMIX(c, d, a, b, 3, kk);
  UNMIX(b, c, d, a, 2, kk); UNMIX(a, b, c, d, 1, kk);
  UNMIX(d, a, b, c, 5, kk); UNMIX(c, d, a, b, 3, kk);
  UNMIX(b, c, d, a, 2, kk); UNMIX(a, b, c, d, 1, kk);
  UNMIX(d, a, b, c, 5, kk); UNMIX(c, d, a, b, 3, kk);
  UNMIX(b, c, d, a, 2, kk); UNMIX(a, b, c, d, 1, kk);
  UNMASH(d, c, k->k); UNMASH(c, b, k->k);
  UNMASH(b, a, k->k); UNMASH(a, d, k->k);
  UNMIX(d, a, b, c, 5, kk); UNMIX(c, d, a, b, 3, kk);
  UNMIX(b, c, d, a, 2, kk); UNMIX(a, b, c, d, 1, kk);
  UNMIX(d, a, b, c, 5, kk); UNMIX(c, d, a, b, 3, kk);
  UNMIX(b, c, d, a, 2, kk); UNMIX(a, b, c, d, 1, kk);
  UNMIX(d, a, b, c, 5, kk); UNMIX(c, d, a, b, 3, kk);
  UNMIX(b, c, d, a, 2, kk); UNMIX(a, b, c, d, 1, kk);
  UNMIX(d, a, b, c, 5, kk); UNMIX(c, d, a, b, 3, kk);
  UNMIX(b, c, d, a, 2, kk); UNMIX(a, b, c, d, 1, kk);
  UNMIX(d, a, b, c, 5, kk); UNMIX(c, d, a, b, 3, kk);
  UNMIX(b, c, d, a, 2, kk); UNMIX(a, b, c, d, 1, kk);

  dst[0] = a | (b << 16); dst[1] = c | (d << 16);
}

/*----- Custom test rig ---------------------------------------------------*
 *
 * I need to test the braindamage feature.
 */

#ifdef TEST_RIG

#include <mLib/quis.h>
#include <mLib/testrig.h>

static int verify(dstr *v)
{
  rc2_ctx k;
  uint32 p[RC2_BLKSZ / 4];
  uint32 c[RC2_BLKSZ / 4];
  uint32 d[RC2_BLKSZ / 4];
  dstr b = DSTR_INIT;
  unsigned bd = *(unsigned *)v[1].buf;
  int ok = 1;

  /* --- Initialize the key buffer --- */

  dstr_ensure(&b, RC2_BLKSZ);
  b.len = RC2_BLKSZ;
  rc2_braindamage(&k, v[0].buf, v[0].len, bd);
  BLKC_LOAD(RC2, p, v[2].buf);
  BLKC_LOAD(RC2, c, v[3].buf);

  /* --- Test encryption --- */

  BLKC_MOVE(RC2, d, p);
  rc2_eblk(&k, d, d);
  BLKC_STORE(RC2, b.buf, d);
  if (memcmp(b.buf, v[3].buf, RC2_BLKSZ)) {
    ok = 0;
    printf("\nfail encryption:"
           "\n\tkey        = ");
    type_hex.dump(&v[0], stdout);
    printf("\n\tbraindamage= %u", bd);
    printf("\n\tplaintext  = "); type_hex.dump(&v[2], stdout);
    printf("\n\texpected   = "); type_hex.dump(&v[3], stdout);
    printf("\n\tcalculated = "); type_hex.dump(&b, stdout);
    putchar('\n');
  }

  /* --- Test decryption --- */

  BLKC_MOVE(RC2, d, c);
  rc2_dblk(&k, d, d);
  BLKC_STORE(RC2, b.buf, d);
  if (memcmp(b.buf, v[2].buf, RC2_BLKSZ)) {
    ok = 0;
    printf("\nfail decryption:"
           "\n\tkey        = ");
    type_hex.dump(&v[0], stdout);
    printf("\n\tbraindamage= %u", bd);
    printf("\n\tciphertext = "); type_hex.dump(&v[3], stdout);
    printf("\n\texpected   = "); type_hex.dump(&v[2], stdout);
    printf("\n\tcalculated = "); type_hex.dump(&b, stdout);
    putchar('\n');
  }

  /* --- Return --- */

  return (ok);
}

static test_chunk defs[] = {
  { "rc2", verify, { &type_hex, &type_int, &type_hex, &type_hex, 0 } },
  { 0, 0, { 0 } }
};

int main(int argc, char *argv[])
{
  test_run(argc, argv, defs, SRCDIR"/tests/rc2");
  return (0);
}

#endif

/*----- That's all, folks -------------------------------------------------*/