3 * $Id: rijndael.c,v 1.3 2001/05/07 15:44:46 mdw Exp $
5 * The Rijndael block cipher
7 * (c) 2000 Straylight/Edgeware
10 /*----- Licensing notice --------------------------------------------------*
12 * This file is part of Catacomb.
14 * Catacomb is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU Library General Public License as
16 * published by the Free Software Foundation; either version 2 of the
17 * License, or (at your option) any later version.
19 * Catacomb is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU Library General Public License for more details.
24 * You should have received a copy of the GNU Library General Public
25 * License along with Catacomb; if not, write to the Free
26 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
30 /*----- Revision history --------------------------------------------------*
32 * $Log: rijndael.c,v $
33 * Revision 1.3 2001/05/07 15:44:46 mdw
34 * Fix unusual numbers of rounds. Simplify implementation.
36 * Revision 1.2 2000/12/06 20:32:59 mdw
37 * Fix round count for weird key sizes.
39 * Revision 1.1 2000/06/17 11:56:07 mdw
44 /*----- Header files ------------------------------------------------------*/
49 #include <mLib/bits.h>
54 #include "rijndael-tab.h"
56 /*----- Global variables --------------------------------------------------*/
58 const octet rijndael_keysz
[] = { KSZ_RANGE
, RIJNDAEL_KEYSZ
, 4, 32, 4 };
60 /*----- Constant tables ---------------------------------------------------*/
62 static const octet S
[256] = RIJNDAEL_S
, SI
[256] = RIJNDAEL_SI
;
63 static const uint32 T
[4][256] = RIJNDAEL_T
, TI
[4][256] = RIJNDAEL_TI
;
64 static const uint32 U
[4][256] = RIJNDAEL_U
;
65 static const octet rcon
[] = RIJNDAEL_RCON
;
67 /*----- Main code ---------------------------------------------------------*/
69 #define SUB(s, a, b, c, d) \
70 (s[U8((a) >> 0)] << 0 | s[U8((b) >> 8)] << 8 | \
71 s[U8((c) >> 16)] << 16 | s[U8((d) >> 24)] << 24)
73 #define MIX(t, a, b, c, d) \
74 (t[0][U8((a) >> 0)] ^ t[1][U8((b) >> 8)] ^ \
75 t[2][U8((c) >> 16)] ^ t[3][U8((d) >> 24)])
77 /* --- @rijndael_init@ --- *
79 * Arguments: @rijndael_ctx *k@ = pointer to context to initialize
80 * @const void *buf@ = pointer to buffer of key material
81 * @size_t sz@ = size of the key material
85 * Use: Initializes a Rijndael context with a particular key. This
86 * implementation of Rijndael doesn't impose any particular
87 * limits on the key size except that it must be multiple of 4
88 * bytes long. 256 bits seems sensible, though.
91 void rijndael_init(rijndael_ctx
*k
, const void *buf
, size_t sz
)
98 /* --- Sort out the key size --- */
100 KSZ_ASSERT(rijndael
, sz
);
103 /* --- Select the number of rounds --- */
110 /* --- Fetch the first key words out --- */
113 for (i
= 0; i
< nk
; i
++) {
114 k
->w
[i
] = LOAD32_L(p
);
118 /* --- Expand this material to fill the rest of the table --- */
120 nw
= (nr
+ 1) * (RIJNDAEL_BLKSZ
/ 4);
123 for (; i
< nw
; i
++) {
124 uint32 w
= k
->w
[i
- nk
];
127 w
^= SUB(S
, ww
, ww
, ww
, ww
) ^ *p
++;
128 } else if (nk
> 6 && i
% nk
== 4)
129 w
^= SUB(S
, ww
, ww
, ww
, ww
);
135 /* --- Make the decryption keys --- */
139 j
-= RIJNDAEL_BLKSZ
/ 4; jj
= 0;
140 for (i
= 0; i
< RIJNDAEL_BLKSZ
/ 4; i
++)
141 k
->wi
[i
] = k
->w
[j
+ jj
++];
143 for (; i
< nw
- RIJNDAEL_BLKSZ
/ 4; i
+= RIJNDAEL_BLKSZ
/ 4) {
144 j
-= RIJNDAEL_BLKSZ
/ 4;
145 for (jj
= 0; jj
< RIJNDAEL_BLKSZ
/ 4; jj
++) {
146 uint32 w
= k
->w
[j
+ jj
];
147 k
->wi
[i
+ jj
] = MIX(U
, w
, w
, w
, w
);
151 j
-= RIJNDAEL_BLKSZ
/ 4; jj
= 0;
153 k
->wi
[i
] = k
->w
[j
+ jj
++];
156 /* --- @rijndael_eblk@, @rijndael_dblk@ --- *
158 * Arguments: @const rijndael_ctx *k@ = pointer to Rijndael context
159 * @const uint32 s[4]@ = pointer to source block
160 * @uint32 d[4]@ = pointer to destination block
164 * Use: Low-level block encryption and decryption.
167 #define DO(what, t, aa, bb, cc, dd, a, b, c, d, w) do { \
168 aa = what(t, a, b, c, d) ^ *w++; \
169 bb = what(t, b, c, d, a) ^ *w++; \
170 cc = what(t, c, d, a, b) ^ *w++; \
171 dd = what(t, d, a, b, c) ^ *w++; \
174 #define UNDO(what, t, aa, bb, cc, dd, a, b, c, d, w) do { \
175 aa = what(t, a, d, c, b) ^ *w++; \
176 bb = what(t, b, a, d, c) ^ *w++; \
177 cc = what(t, c, b, a, d) ^ *w++; \
178 dd = what(t, d, c, b, a) ^ *w++; \
181 void rijndael_eblk(const rijndael_ctx
*k
, const uint32
*s
, uint32
*dst
)
183 uint32 a
= s
[0], b
= s
[1], c
= s
[2], d
= s
[3];
184 uint32 aa
, bb
, cc
, dd
;
187 a
^= *w
++; b
^= *w
++; c
^= *w
++; d
^= *w
++;
188 aa
= a
; bb
= b
; cc
= c
; dd
= d
;
192 DO(MIX
, T
, aa
, bb
, cc
, dd
, a
, b
, c
, d
, w
);
194 DO(MIX
, T
, a
, b
, c
, d
, aa
, bb
, cc
, dd
, w
);
196 DO(MIX
, T
, aa
, bb
, cc
, dd
, a
, b
, c
, d
, w
);
198 DO(MIX
, T
, a
, b
, c
, d
, aa
, bb
, cc
, dd
, w
);
201 DO(MIX
, T
, aa
, bb
, cc
, dd
, a
, b
, c
, d
, w
);
202 DO(MIX
, T
, a
, b
, c
, d
, aa
, bb
, cc
, dd
, w
);
203 DO(MIX
, T
, aa
, bb
, cc
, dd
, a
, b
, c
, d
, w
);
204 DO(MIX
, T
, a
, b
, c
, d
, aa
, bb
, cc
, dd
, w
);
205 DO(MIX
, T
, aa
, bb
, cc
, dd
, a
, b
, c
, d
, w
);
206 DO(MIX
, T
, a
, b
, c
, d
, aa
, bb
, cc
, dd
, w
);
207 DO(MIX
, T
, aa
, bb
, cc
, dd
, a
, b
, c
, d
, w
);
208 DO(MIX
, T
, a
, b
, c
, d
, aa
, bb
, cc
, dd
, w
);
209 DO(MIX
, T
, aa
, bb
, cc
, dd
, a
, b
, c
, d
, w
);
211 DO(SUB
, S
, a
, b
, c
, d
, aa
, bb
, cc
, dd
, w
);
213 dst
[0] = a
; dst
[1] = b
; dst
[2] = c
; dst
[3] = d
;
216 void rijndael_dblk(const rijndael_ctx
*k
, const uint32
*s
, uint32
*dst
)
218 uint32 a
= s
[0], b
= s
[1], c
= s
[2], d
= s
[3];
219 uint32 aa
, bb
, cc
, dd
;
222 a
^= *w
++; b
^= *w
++; c
^= *w
++; d
^= *w
++;
223 aa
= a
; bb
= b
; cc
= c
; dd
= d
;
227 UNDO(MIX
, TI
, aa
, bb
, cc
, dd
, a
, b
, c
, d
, w
);
229 UNDO(MIX
, TI
, a
, b
, c
, d
, aa
, bb
, cc
, dd
, w
);
231 UNDO(MIX
, TI
, aa
, bb
, cc
, dd
, a
, b
, c
, d
, w
);
233 UNDO(MIX
, TI
, a
, b
, c
, d
, aa
, bb
, cc
, dd
, w
);
236 UNDO(MIX
, TI
, aa
, bb
, cc
, dd
, a
, b
, c
, d
, w
);
237 UNDO(MIX
, TI
, a
, b
, c
, d
, aa
, bb
, cc
, dd
, w
);
238 UNDO(MIX
, TI
, aa
, bb
, cc
, dd
, a
, b
, c
, d
, w
);
239 UNDO(MIX
, TI
, a
, b
, c
, d
, aa
, bb
, cc
, dd
, w
);
240 UNDO(MIX
, TI
, aa
, bb
, cc
, dd
, a
, b
, c
, d
, w
);
241 UNDO(MIX
, TI
, a
, b
, c
, d
, aa
, bb
, cc
, dd
, w
);
242 UNDO(MIX
, TI
, aa
, bb
, cc
, dd
, a
, b
, c
, d
, w
);
243 UNDO(MIX
, TI
, a
, b
, c
, d
, aa
, bb
, cc
, dd
, w
);
244 UNDO(MIX
, TI
, aa
, bb
, cc
, dd
, a
, b
, c
, d
, w
);
246 UNDO(SUB
, SI
, a
, b
, c
, d
, aa
, bb
, cc
, dd
, w
);
248 dst
[0] = a
; dst
[1] = b
; dst
[2] = c
; dst
[3] = d
;
251 BLKC_TEST(RIJNDAEL
, rijndael
)
253 /*----- That's all, folks -------------------------------------------------*/