3 * $Id: cast128.c,v 1.1 2000/06/17 10:49:14 mdw Exp $
5 * The CAST-128 block cipher
7 * (c) 2000 Straylight/Edgeware
10 /*----- Licensing notice --------------------------------------------------*
12 * This file is part of Catacomb.
14 * Catacomb is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU Library General Public License as
16 * published by the Free Software Foundation; either version 2 of the
17 * License, or (at your option) any later version.
19 * Catacomb is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU Library General Public License for more details.
24 * You should have received a copy of the GNU Library General Public
25 * License along with Catacomb; if not, write to the Free
26 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
30 /*----- Revision history --------------------------------------------------*
33 * Revision 1.1 2000/06/17 10:49:14 mdw
38 /*----- Header files ------------------------------------------------------*/
45 #include <mLib/bits.h>
48 #include "cast-base.h"
53 /*----- Global variables --------------------------------------------------*/
55 const octet cast128_keysz
[] = { KSZ_RANGE
, CAST128_KEYSZ
, 0, 16, 1 };
57 /*----- Main code ---------------------------------------------------------*/
59 /* --- @cast128_init@ --- *
61 * Arguments: @cast128_ctx *k@ = pointer to key block to fill in
62 * @const void *buf@ = pointer to buffer of key material
63 * @size_t sz@ = size of key material
67 * Use: Initializes a CAST-128 key buffer. CAST-128 accepts
68 * 128-bit keys or shorter.
71 void cast128_init(cast128_ctx
*k
, const void *buf
, size_t sz
)
76 uint32 a
, b
, c
, d
, aa
, bb
, cc
, dd
;
78 /* --- Fiddle with the key size a bit --- */
80 KSZ_ASSERT(cast128
, sz
);
87 /* --- Read the key into the array --- */
95 aa
|= ((uint32
)*p
++ << b
);
111 /* --- Read the key words out --- */
113 a
= kk
[0]; b
= kk
[1]; c
= kk
[2]; d
= kk
[3];
120 #define X_0 U8(X_0123 >> 24)
121 #define X_1 U8(X_0123 >> 16)
122 #define X_2 U8(X_0123 >> 8)
123 #define X_3 U8(X_0123 >> 0)
124 #define X_4 U8(X_4567 >> 24)
125 #define X_5 U8(X_4567 >> 16)
126 #define X_6 U8(X_4567 >> 8)
127 #define X_7 U8(X_4567 >> 0)
128 #define X_8 U8(X_89ab >> 24)
129 #define X_9 U8(X_89ab >> 16)
130 #define X_a U8(X_89ab >> 8)
131 #define X_b U8(X_89ab >> 0)
132 #define X_c U8(X_cdef >> 24)
133 #define X_d U8(X_cdef >> 16)
134 #define X_e U8(X_cdef >> 8)
135 #define X_f U8(X_cdef >> 0)
142 #define Z_0 U8(Z_0123 >> 24)
143 #define Z_1 U8(Z_0123 >> 16)
144 #define Z_2 U8(Z_0123 >> 8)
145 #define Z_3 U8(Z_0123 >> 0)
146 #define Z_4 U8(Z_4567 >> 24)
147 #define Z_5 U8(Z_4567 >> 16)
148 #define Z_6 U8(Z_4567 >> 8)
149 #define Z_7 U8(Z_4567 >> 0)
150 #define Z_8 U8(Z_89ab >> 24)
151 #define Z_9 U8(Z_89ab >> 16)
152 #define Z_a U8(Z_89ab >> 8)
153 #define Z_b U8(Z_89ab >> 0)
154 #define Z_c U8(Z_cdef >> 24)
155 #define Z_d U8(Z_cdef >> 16)
156 #define Z_e U8(Z_cdef >> 8)
157 #define Z_f U8(Z_cdef >> 0)
159 #define SK(w, x, y, z) \
160 cast_sk[0][w] ^ cast_sk[1][x] ^ cast_sk[2][y] ^ cast_sk[3][z]
163 Z_0123
= X_0123
^ SK(X_d
, X_f
, X_c
, X_e
) ^ cast_sk
[2][X_8
];
164 Z_4567
= X_89ab
^ SK(Z_0
, Z_2
, Z_1
, Z_3
) ^ cast_sk
[3][X_a
];
165 Z_89ab
= X_cdef
^ SK(Z_7
, Z_6
, Z_5
, Z_4
) ^ cast_sk
[0][X_9
];
166 Z_cdef
= X_4567
^ SK(Z_a
, Z_9
, Z_b
, Z_8
) ^ cast_sk
[1][X_b
];
167 k
->km
[i
++] = SK(Z_8
, Z_9
, Z_7
, Z_6
) ^ cast_sk
[0][Z_2
];
168 k
->km
[i
++] = SK(Z_a
, Z_b
, Z_5
, Z_4
) ^ cast_sk
[1][Z_6
];
169 k
->km
[i
++] = SK(Z_c
, Z_d
, Z_3
, Z_2
) ^ cast_sk
[2][Z_9
];
170 k
->km
[i
++] = SK(Z_e
, Z_f
, Z_1
, Z_0
) ^ cast_sk
[3][Z_c
];
171 X_0123
= Z_89ab
^ SK(Z_5
, Z_7
, Z_4
, Z_6
) ^ cast_sk
[2][Z_0
];
172 X_4567
= Z_0123
^ SK(X_0
, X_2
, X_1
, X_3
) ^ cast_sk
[3][Z_2
];
173 X_89ab
= Z_4567
^ SK(X_7
, X_6
, X_5
, X_4
) ^ cast_sk
[0][Z_1
];
174 X_cdef
= Z_cdef
^ SK(X_a
, X_9
, X_b
, X_8
) ^ cast_sk
[1][Z_3
];
175 k
->km
[i
++] = SK(X_3
, X_2
, X_c
, X_d
) ^ cast_sk
[0][X_8
];
176 k
->km
[i
++] = SK(X_1
, X_0
, X_e
, X_f
) ^ cast_sk
[1][X_d
];
177 k
->km
[i
++] = SK(X_7
, X_6
, X_8
, X_9
) ^ cast_sk
[2][X_3
];
178 k
->km
[i
++] = SK(X_5
, X_4
, X_a
, X_b
) ^ cast_sk
[3][X_7
];
179 Z_0123
= X_0123
^ SK(X_d
, X_f
, X_c
, X_e
) ^ cast_sk
[2][X_8
];
180 Z_4567
= X_89ab
^ SK(Z_0
, Z_2
, Z_1
, Z_3
) ^ cast_sk
[3][X_a
];
181 Z_89ab
= X_cdef
^ SK(Z_7
, Z_6
, Z_5
, Z_4
) ^ cast_sk
[0][X_9
];
182 Z_cdef
= X_4567
^ SK(Z_a
, Z_9
, Z_b
, Z_8
) ^ cast_sk
[1][X_b
];
183 k
->km
[i
++] = SK(Z_3
, Z_2
, Z_c
, Z_d
) ^ cast_sk
[0][Z_9
];
184 k
->km
[i
++] = SK(Z_1
, Z_0
, Z_e
, Z_f
) ^ cast_sk
[1][Z_c
];
185 k
->km
[i
++] = SK(Z_7
, Z_6
, Z_8
, Z_9
) ^ cast_sk
[2][Z_2
];
186 k
->km
[i
++] = SK(Z_5
, Z_4
, Z_a
, Z_b
) ^ cast_sk
[3][Z_6
];
187 X_0123
= Z_89ab
^ SK(Z_5
, Z_7
, Z_4
, Z_6
) ^ cast_sk
[2][Z_0
];
188 X_4567
= Z_0123
^ SK(X_0
, X_2
, X_1
, X_3
) ^ cast_sk
[3][Z_2
];
189 X_89ab
= Z_4567
^ SK(X_7
, X_6
, X_5
, X_4
) ^ cast_sk
[0][Z_1
];
190 X_cdef
= Z_cdef
^ SK(X_a
, X_9
, X_b
, X_8
) ^ cast_sk
[1][Z_3
];
191 k
->km
[i
++] = SK(X_8
, X_9
, X_7
, X_6
) ^ cast_sk
[0][X_3
];
192 k
->km
[i
++] = SK(X_a
, X_b
, X_5
, X_4
) ^ cast_sk
[1][X_7
];
193 k
->km
[i
++] = SK(X_c
, X_d
, X_3
, X_2
) ^ cast_sk
[2][X_8
];
194 k
->km
[i
++] = SK(X_e
, X_f
, X_1
, X_0
) ^ cast_sk
[3][X_d
];
197 Z_0123
= X_0123
^ SK(X_d
, X_f
, X_c
, X_e
) ^ cast_sk
[2][X_8
];
198 Z_4567
= X_89ab
^ SK(Z_0
, Z_2
, Z_1
, Z_3
) ^ cast_sk
[3][X_a
];
199 Z_89ab
= X_cdef
^ SK(Z_7
, Z_6
, Z_5
, Z_4
) ^ cast_sk
[0][X_9
];
200 Z_cdef
= X_4567
^ SK(Z_a
, Z_9
, Z_b
, Z_8
) ^ cast_sk
[1][X_b
];
201 k
->kr
[i
++] = (SK(Z_8
, Z_9
, Z_7
, Z_6
) ^ cast_sk
[0][Z_2
]) & 0x1f;
202 k
->kr
[i
++] = (SK(Z_a
, Z_b
, Z_5
, Z_4
) ^ cast_sk
[1][Z_6
]) & 0x1f;
203 k
->kr
[i
++] = (SK(Z_c
, Z_d
, Z_3
, Z_2
) ^ cast_sk
[2][Z_9
]) & 0x1f;
204 k
->kr
[i
++] = (SK(Z_e
, Z_f
, Z_1
, Z_0
) ^ cast_sk
[3][Z_c
]) & 0x1f;
205 X_0123
= Z_89ab
^ SK(Z_5
, Z_7
, Z_4
, Z_6
) ^ cast_sk
[2][Z_0
];
206 X_4567
= Z_0123
^ SK(X_0
, X_2
, X_1
, X_3
) ^ cast_sk
[3][Z_2
];
207 X_89ab
= Z_4567
^ SK(X_7
, X_6
, X_5
, X_4
) ^ cast_sk
[0][Z_1
];
208 X_cdef
= Z_cdef
^ SK(X_a
, X_9
, X_b
, X_8
) ^ cast_sk
[1][Z_3
];
209 k
->kr
[i
++] = (SK(X_3
, X_2
, X_c
, X_d
) ^ cast_sk
[0][X_8
]) & 0x1f;
210 k
->kr
[i
++] = (SK(X_1
, X_0
, X_e
, X_f
) ^ cast_sk
[1][X_d
]) & 0x1f;
211 k
->kr
[i
++] = (SK(X_7
, X_6
, X_8
, X_9
) ^ cast_sk
[2][X_3
]) & 0x1f;
212 k
->kr
[i
++] = (SK(X_5
, X_4
, X_a
, X_b
) ^ cast_sk
[3][X_7
]) & 0x1f;
213 Z_0123
= X_0123
^ SK(X_d
, X_f
, X_c
, X_e
) ^ cast_sk
[2][X_8
];
214 Z_4567
= X_89ab
^ SK(Z_0
, Z_2
, Z_1
, Z_3
) ^ cast_sk
[3][X_a
];
215 Z_89ab
= X_cdef
^ SK(Z_7
, Z_6
, Z_5
, Z_4
) ^ cast_sk
[0][X_9
];
216 Z_cdef
= X_4567
^ SK(Z_a
, Z_9
, Z_b
, Z_8
) ^ cast_sk
[1][X_b
];
217 k
->kr
[i
++] = (SK(Z_3
, Z_2
, Z_c
, Z_d
) ^ cast_sk
[0][Z_9
]) & 0x1f;
218 k
->kr
[i
++] = (SK(Z_1
, Z_0
, Z_e
, Z_f
) ^ cast_sk
[1][Z_c
]) & 0x1f;
219 k
->kr
[i
++] = (SK(Z_7
, Z_6
, Z_8
, Z_9
) ^ cast_sk
[2][Z_2
]) & 0x1f;
220 k
->kr
[i
++] = (SK(Z_5
, Z_4
, Z_a
, Z_b
) ^ cast_sk
[3][Z_6
]) & 0x1f;
221 X_0123
= Z_89ab
^ SK(Z_5
, Z_7
, Z_4
, Z_6
) ^ cast_sk
[2][Z_0
];
222 X_4567
= Z_0123
^ SK(X_0
, X_2
, X_1
, X_3
) ^ cast_sk
[3][Z_2
];
223 X_89ab
= Z_4567
^ SK(X_7
, X_6
, X_5
, X_4
) ^ cast_sk
[0][Z_1
];
224 X_cdef
= Z_cdef
^ SK(X_a
, X_9
, X_b
, X_8
) ^ cast_sk
[1][Z_3
];
225 k
->kr
[i
++] = (SK(X_8
, X_9
, X_7
, X_6
) ^ cast_sk
[0][X_3
]) & 0x1f;
226 k
->kr
[i
++] = (SK(X_a
, X_b
, X_5
, X_4
) ^ cast_sk
[1][X_7
]) & 0x1f;
227 k
->kr
[i
++] = (SK(X_c
, X_d
, X_3
, X_2
) ^ cast_sk
[2][X_8
]) & 0x1f;
228 k
->kr
[i
++] = (SK(X_e
, X_f
, X_1
, X_0
) ^ cast_sk
[3][X_d
]) & 0x1f;
233 /* --- @cast128_eblk@, @cast128_dblk@ --- *
235 * Arguments: @const cast128_ctx *k@ = pointer to key block
236 * @const uint32 s[2]@ = pointer to source block
237 * @uint32 d[2]@ = pointer to destination block
241 * Use: Low-level block encryption and decryption.
244 void cast128_eblk(const cast128_ctx
*k
, const uint32
*s
, uint32
*d
)
246 uint32 a
= s
[0], b
= s
[1];
247 const uint32
*km
= k
->km
;
248 const octet
*kr
= k
->kr
;
252 CAST_R1(*km
++, *kr
++, a
, b
);
253 CAST_R2(*km
++, *kr
++, b
, a
);
254 CAST_R3(*km
++, *kr
++, a
, b
);
255 CAST_R1(*km
++, *kr
++, b
, a
);
256 CAST_R2(*km
++, *kr
++, a
, b
);
257 CAST_R3(*km
++, *kr
++, b
, a
);
258 CAST_R1(*km
++, *kr
++, a
, b
);
259 CAST_R2(*km
++, *kr
++, b
, a
);
260 CAST_R3(*km
++, *kr
++, a
, b
);
261 CAST_R1(*km
++, *kr
++, b
, a
);
262 CAST_R2(*km
++, *kr
++, a
, b
);
263 CAST_R3(*km
++, *kr
++, b
, a
);
266 CAST_R1(*km
++, *kr
++, a
, b
);
267 CAST_R2(*km
++, *kr
++, b
, a
);
268 CAST_R3(*km
++, *kr
++, a
, b
);
269 CAST_R1(*km
++, *kr
++, b
, a
);
276 void cast128_dblk(const cast128_ctx
*k
, const uint32
*s
, uint32
*d
)
278 uint32 a
= s
[0], b
= s
[1];
279 const uint32
*km
= k
->km
+ k
->r
;
280 const octet
*kr
= k
->kr
+ k
->r
;
285 CAST_R1(*--km
, *--kr
, a
, b
);
286 CAST_R3(*--km
, *--kr
, b
, a
);
287 CAST_R2(*--km
, *--kr
, a
, b
);
288 CAST_R1(*--km
, *--kr
, b
, a
);
290 CAST_R3(*--km
, *--kr
, a
, b
);
291 CAST_R2(*--km
, *--kr
, b
, a
);
292 CAST_R1(*--km
, *--kr
, a
, b
);
293 CAST_R3(*--km
, *--kr
, b
, a
);
294 CAST_R2(*--km
, *--kr
, a
, b
);
295 CAST_R1(*--km
, *--kr
, b
, a
);
296 CAST_R3(*--km
, *--kr
, a
, b
);
297 CAST_R2(*--km
, *--kr
, b
, a
);
298 CAST_R1(*--km
, *--kr
, a
, b
);
299 CAST_R3(*--km
, *--kr
, b
, a
);
300 CAST_R2(*--km
, *--kr
, a
, b
);
301 CAST_R1(*--km
, *--kr
, b
, a
);
308 BLKC_TEST(CAST128
, cast128
)
310 /*----- That's all, folks -------------------------------------------------*/