3 * $Id: rijndael.c,v 1.2 2000/12/06 20:32:59 mdw Exp $
5 * The Rijndael block cipher
7 * (c) 2000 Straylight/Edgeware
10 /*----- Licensing notice --------------------------------------------------*
12 * This file is part of Catacomb.
14 * Catacomb is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU Library General Public License as
16 * published by the Free Software Foundation; either version 2 of the
17 * License, or (at your option) any later version.
19 * Catacomb is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU Library General Public License for more details.
24 * You should have received a copy of the GNU Library General Public
25 * License along with Catacomb; if not, write to the Free
26 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
30 /*----- Revision history --------------------------------------------------*
32 * $Log: rijndael.c,v $
33 * Revision 1.2 2000/12/06 20:32:59 mdw
34 * Fix round count for weird key sizes.
36 * Revision 1.1 2000/06/17 11:56:07 mdw
41 /*----- Header files ------------------------------------------------------*/
46 #include <mLib/bits.h>
51 #include "rijndael-tab.h"
53 /*----- Global variables --------------------------------------------------*/
55 const octet rijndael_keysz
[] = { KSZ_RANGE
, RIJNDAEL_KEYSZ
, 4, 32, 4 };
57 /*----- Constant tables ---------------------------------------------------*/
59 static const octet S
[256] = RIJNDAEL_S
, SI
[256] = RIJNDAEL_SI
;
60 static const uint32 T
[4][256] = RIJNDAEL_T
, TI
[4][256] = RIJNDAEL_TI
;
61 static const uint32 U
[4][256] = RIJNDAEL_U
;
62 static const octet rcon
[] = RIJNDAEL_RCON
;
64 /*----- Main code ---------------------------------------------------------*/
66 #define BYTESUB(x, s) \
67 (s[U8((x) >> 24)] << 24 | s[U8((x) >> 16)] << 16 | \
68 s[U8((x) >> 8)] << 8 | s[U8((x) >> 0)] << 0)
70 /* --- @rijndael_init@ --- *
72 * Arguments: @rijndael_ctx *k@ = pointer to context to initialize
73 * @const void *buf@ = pointer to buffer of key material
74 * @size_t sz@ = size of the key material
78 * Use: Initializes a Rijndael context with a particular key. This
79 * implementation of Rijndael doesn't impose any particular
80 * limits on the key size except that it must be multiple of 4
81 * bytes long. 256 bits seems sensible, though.
84 void rijndael_init(rijndael_ctx
*k
, const void *buf
, size_t sz
)
91 /* --- Sort out the key size --- */
93 KSZ_ASSERT(rijndael
, sz
);
96 /* --- Select the number of rounds --- */
103 /* --- Fetch the first key words out --- */
106 for (i
= 0; i
< nk
; i
++) {
107 k
->w
[i
] = LOAD32_L(p
);
111 /* --- Expand this material to fill the rest of the table --- */
113 nw
= (nr
+ 1) * (RIJNDAEL_BLKSZ
/ 4);
116 for (; i
< nw
; i
++) {
117 uint32 w
= k
->w
[i
- nk
];
120 w
^= BYTESUB(ww
, S
) ^ *p
++;
121 } else if (nk
> 6 && i
% nk
== 4)
128 /* --- Make the decryption keys --- */
132 j
-= RIJNDAEL_BLKSZ
/ 4; jj
= 0;
133 for (i
= 0; i
< RIJNDAEL_BLKSZ
/ 4; i
++)
134 k
->wi
[i
] = k
->w
[j
+ jj
++];
136 for (; i
< nw
- RIJNDAEL_BLKSZ
/ 4; i
+= RIJNDAEL_BLKSZ
/ 4) {
137 j
-= RIJNDAEL_BLKSZ
/ 4;
138 for (jj
= 0; jj
< RIJNDAEL_BLKSZ
/ 4; jj
++) {
139 uint32 w
= k
->w
[j
+ jj
];
140 k
->wi
[i
+ jj
] = (U
[0][U8(w
>> 0)] ^ U
[1][U8(w
>> 8)] ^
141 U
[2][U8(w
>> 16)] ^ U
[3][U8(w
>> 24)]);
145 j
-= RIJNDAEL_BLKSZ
/ 4; jj
= 0;
147 k
->wi
[i
] = k
->w
[j
+ jj
++];
150 /* --- @rijndael_eblk@, @rijndael_dblk@ --- *
152 * Arguments: @const rijndael_ctx *k@ = pointer to Rijndael context
153 * @const uint32 s[4]@ = pointer to source block
154 * @uint32 d[4]@ = pointer to destination block
158 * Use: Low-level block encryption and decryption.
161 #define EROUND(aa, bb, cc, dd, a, b, c, d, w) do { \
162 aa = (T[0][U8(a >> 0)] ^ T[1][U8(b >> 8)] ^ \
163 T[2][U8(c >> 16)] ^ T[3][U8(d >> 24)]) ^ *w++; \
164 bb = (T[0][U8(b >> 0)] ^ T[1][U8(c >> 8)] ^ \
165 T[2][U8(d >> 16)] ^ T[3][U8(a >> 24)]) ^ *w++; \
166 cc = (T[0][U8(c >> 0)] ^ T[1][U8(d >> 8)] ^ \
167 T[2][U8(a >> 16)] ^ T[3][U8(b >> 24)]) ^ *w++; \
168 dd = (T[0][U8(d >> 0)] ^ T[1][U8(a >> 8)] ^ \
169 T[2][U8(b >> 16)] ^ T[3][U8(c >> 24)]) ^ *w++; \
172 #define DROUND(aa, bb, cc, dd, a, b, c, d, w) do { \
173 aa = (TI[0][U8(a >> 0)] ^ TI[1][U8(d >> 8)] ^ \
174 TI[2][U8(c >> 16)] ^ TI[3][U8(b >> 24)]) ^ *w++; \
175 bb = (TI[0][U8(b >> 0)] ^ TI[1][U8(a >> 8)] ^ \
176 TI[2][U8(d >> 16)] ^ TI[3][U8(c >> 24)]) ^ *w++; \
177 cc = (TI[0][U8(c >> 0)] ^ TI[1][U8(b >> 8)] ^ \
178 TI[2][U8(a >> 16)] ^ TI[3][U8(d >> 24)]) ^ *w++; \
179 dd = (TI[0][U8(d >> 0)] ^ TI[1][U8(c >> 8)] ^ \
180 TI[2][U8(b >> 16)] ^ TI[3][U8(a >> 24)]) ^ *w++; \
183 void rijndael_eblk(const rijndael_ctx
*k
, const uint32
*s
, uint32
*dst
)
185 uint32 a
= s
[0], b
= s
[1], c
= s
[2], d
= s
[3];
186 uint32 aa
, bb
, cc
, dd
;
189 a
^= *w
++; b
^= *w
++; c
^= *w
++; d
^= *w
++;
193 EROUND(aa
, bb
, cc
, dd
, a
, b
, c
, d
, w
);
194 EROUND(a
, b
, c
, d
, aa
, bb
, cc
, dd
, w
);
196 EROUND(aa
, bb
, cc
, dd
, a
, b
, c
, d
, w
);
197 EROUND(a
, b
, c
, d
, aa
, bb
, cc
, dd
, w
);
200 EROUND(aa
, bb
, cc
, dd
, a
, b
, c
, d
, w
);
201 EROUND(a
, b
, c
, d
, aa
, bb
, cc
, dd
, w
);
202 EROUND(aa
, bb
, cc
, dd
, a
, b
, c
, d
, w
);
203 EROUND(a
, b
, c
, d
, aa
, bb
, cc
, dd
, w
);
204 EROUND(aa
, bb
, cc
, dd
, a
, b
, c
, d
, w
);
205 EROUND(a
, b
, c
, d
, aa
, bb
, cc
, dd
, w
);
206 EROUND(aa
, bb
, cc
, dd
, a
, b
, c
, d
, w
);
207 EROUND(a
, b
, c
, d
, aa
, bb
, cc
, dd
, w
);
208 EROUND(aa
, bb
, cc
, dd
, a
, b
, c
, d
, w
);
211 a
= ((S
[U8(aa
>> 0)] << 0) ^ (S
[U8(bb
>> 8)] << 8) ^
212 (S
[U8(cc
>> 16)] << 16) ^ (S
[U8(dd
>> 24)] << 24)) ^ *w
++;
213 b
= ((S
[U8(bb
>> 0)] << 0) ^ (S
[U8(cc
>> 8)] << 8) ^
214 (S
[U8(dd
>> 16)] << 16) ^ (S
[U8(aa
>> 24)] << 24)) ^ *w
++;
215 c
= ((S
[U8(cc
>> 0)] << 0) ^ (S
[U8(dd
>> 8)] << 8) ^
216 (S
[U8(aa
>> 16)] << 16) ^ (S
[U8(bb
>> 24)] << 24)) ^ *w
++;
217 d
= ((S
[U8(dd
>> 0)] << 0) ^ (S
[U8(aa
>> 8)] << 8) ^
218 (S
[U8(bb
>> 16)] << 16) ^ (S
[U8(cc
>> 24)] << 24)) ^ *w
++;
220 dst
[0] = a
; dst
[1] = b
; dst
[2] = c
; dst
[3] = d
;
223 void rijndael_dblk(const rijndael_ctx
*k
, const uint32
*s
, uint32
*dst
)
225 uint32 a
= s
[0], b
= s
[1], c
= s
[2], d
= s
[3];
226 uint32 aa
, bb
, cc
, dd
;
229 a
^= *w
++; b
^= *w
++; c
^= *w
++; d
^= *w
++;
233 DROUND(aa
, bb
, cc
, dd
, a
, b
, c
, d
, w
);
234 DROUND(a
, b
, c
, d
, aa
, bb
, cc
, dd
, w
);
236 DROUND(aa
, bb
, cc
, dd
, a
, b
, c
, d
, w
);
237 DROUND(a
, b
, c
, d
, aa
, bb
, cc
, dd
, w
);
240 DROUND(aa
, bb
, cc
, dd
, a
, b
, c
, d
, w
);
241 DROUND(a
, b
, c
, d
, aa
, bb
, cc
, dd
, w
);
242 DROUND(aa
, bb
, cc
, dd
, a
, b
, c
, d
, w
);
243 DROUND(a
, b
, c
, d
, aa
, bb
, cc
, dd
, w
);
244 DROUND(aa
, bb
, cc
, dd
, a
, b
, c
, d
, w
);
245 DROUND(a
, b
, c
, d
, aa
, bb
, cc
, dd
, w
);
246 DROUND(aa
, bb
, cc
, dd
, a
, b
, c
, d
, w
);
247 DROUND(a
, b
, c
, d
, aa
, bb
, cc
, dd
, w
);
248 DROUND(aa
, bb
, cc
, dd
, a
, b
, c
, d
, w
);
251 a
= ((SI
[U8(aa
>> 0)] << 0) ^ (SI
[U8(dd
>> 8)] << 8) ^
252 (SI
[U8(cc
>> 16)] << 16) ^ (SI
[U8(bb
>> 24)] << 24)) ^ *w
++;
253 b
= ((SI
[U8(bb
>> 0)] << 0) ^ (SI
[U8(aa
>> 8)] << 8) ^
254 (SI
[U8(dd
>> 16)] << 16) ^ (SI
[U8(cc
>> 24)] << 24)) ^ *w
++;
255 c
= ((SI
[U8(cc
>> 0)] << 0) ^ (SI
[U8(bb
>> 8)] << 8) ^
256 (SI
[U8(aa
>> 16)] << 16) ^ (SI
[U8(dd
>> 24)] << 24)) ^ *w
++;
257 d
= ((SI
[U8(dd
>> 0)] << 0) ^ (SI
[U8(cc
>> 8)] << 8) ^
258 (SI
[U8(bb
>> 16)] << 16) ^ (SI
[U8(aa
>> 24)] << 24)) ^ *w
++;
260 dst
[0] = a
; dst
[1] = b
; dst
[2] = c
; dst
[3] = d
;
263 BLKC_TEST(RIJNDAEL
, rijndael
)
265 /*----- That's all, folks -------------------------------------------------*/