General utilities cleanup. Add signature support to catcrypt. Throw in
[u/mdw/catacomb] / cast128.c
1 /* -*-c-*-
2 *
3 * $Id: cast128.c,v 1.2 2004/04/08 01:36:15 mdw Exp $
4 *
5 * The CAST-128 block cipher
6 *
7 * (c) 2000 Straylight/Edgeware
8 */
9
10 /*----- Licensing notice --------------------------------------------------*
11 *
12 * This file is part of Catacomb.
13 *
14 * Catacomb is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU Library General Public License as
16 * published by the Free Software Foundation; either version 2 of the
17 * License, or (at your option) any later version.
18 *
19 * Catacomb is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU Library General Public License for more details.
23 *
24 * You should have received a copy of the GNU Library General Public
25 * License along with Catacomb; if not, write to the Free
26 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
27 * MA 02111-1307, USA.
28 */
29
30 /*----- Header files ------------------------------------------------------*/
31
32 #include <assert.h>
33 #include <stdio.h>
34 #include <stdlib.h>
35 #include <string.h>
36
37 #include <mLib/bits.h>
38
39 #include "blkc.h"
40 #include "cast-base.h"
41 #include "cast128.h"
42 #include "gcipher.h"
43 #include "paranoia.h"
44
45 /*----- Global variables --------------------------------------------------*/
46
47 const octet cast128_keysz[] = { KSZ_RANGE, CAST128_KEYSZ, 0, 16, 1 };
48
49 /*----- Main code ---------------------------------------------------------*/
50
51 /* --- @cast128_init@ --- *
52 *
53 * Arguments: @cast128_ctx *k@ = pointer to key block to fill in
54 * @const void *buf@ = pointer to buffer of key material
55 * @size_t sz@ = size of key material
56 *
57 * Returns: ---
58 *
59 * Use: Initializes a CAST-128 key buffer. CAST-128 accepts
60 * 128-bit keys or shorter.
61 */
62
63 void cast128_init(cast128_ctx *k, const void *buf, size_t sz)
64 {
65 const octet *p = buf;
66 uint32 kk[4];
67 unsigned i;
68 uint32 a, b, c, d, aa, bb, cc, dd;
69
70 /* --- Fiddle with the key size a bit --- */
71
72 KSZ_ASSERT(cast128, sz);
73
74 if (sz > 10)
75 k->r = 16;
76 else
77 k->r = 12;
78
79 /* --- Read the key into the array --- */
80
81 i = 0;
82 b = 32; aa = 0;
83 for (;;) {
84 if (!sz)
85 break;
86 b -= 8;
87 aa |= ((uint32)*p++ << b);
88 sz--;
89 if (b == 0) {
90 kk[i++] = aa;
91 if (i == 4)
92 break;
93 aa = 0;
94 b = 32;
95 }
96 }
97
98 for (; i < 4; i++) {
99 kk[i] = aa;
100 aa = 0;
101 }
102
103 /* --- Read the key words out --- */
104
105 a = kk[0]; b = kk[1]; c = kk[2]; d = kk[3];
106
107 #define X_0123 a
108 #define X_4567 b
109 #define X_89ab c
110 #define X_cdef d
111
112 #define X_0 U8(X_0123 >> 24)
113 #define X_1 U8(X_0123 >> 16)
114 #define X_2 U8(X_0123 >> 8)
115 #define X_3 U8(X_0123 >> 0)
116 #define X_4 U8(X_4567 >> 24)
117 #define X_5 U8(X_4567 >> 16)
118 #define X_6 U8(X_4567 >> 8)
119 #define X_7 U8(X_4567 >> 0)
120 #define X_8 U8(X_89ab >> 24)
121 #define X_9 U8(X_89ab >> 16)
122 #define X_a U8(X_89ab >> 8)
123 #define X_b U8(X_89ab >> 0)
124 #define X_c U8(X_cdef >> 24)
125 #define X_d U8(X_cdef >> 16)
126 #define X_e U8(X_cdef >> 8)
127 #define X_f U8(X_cdef >> 0)
128
129 #define Z_0123 aa
130 #define Z_4567 bb
131 #define Z_89ab cc
132 #define Z_cdef dd
133
134 #define Z_0 U8(Z_0123 >> 24)
135 #define Z_1 U8(Z_0123 >> 16)
136 #define Z_2 U8(Z_0123 >> 8)
137 #define Z_3 U8(Z_0123 >> 0)
138 #define Z_4 U8(Z_4567 >> 24)
139 #define Z_5 U8(Z_4567 >> 16)
140 #define Z_6 U8(Z_4567 >> 8)
141 #define Z_7 U8(Z_4567 >> 0)
142 #define Z_8 U8(Z_89ab >> 24)
143 #define Z_9 U8(Z_89ab >> 16)
144 #define Z_a U8(Z_89ab >> 8)
145 #define Z_b U8(Z_89ab >> 0)
146 #define Z_c U8(Z_cdef >> 24)
147 #define Z_d U8(Z_cdef >> 16)
148 #define Z_e U8(Z_cdef >> 8)
149 #define Z_f U8(Z_cdef >> 0)
150
151 #define SK(w, x, y, z) \
152 cast_sk[0][w] ^ cast_sk[1][x] ^ cast_sk[2][y] ^ cast_sk[3][z]
153
154 i = 0;
155 Z_0123 = X_0123 ^ SK(X_d, X_f, X_c, X_e) ^ cast_sk[2][X_8];
156 Z_4567 = X_89ab ^ SK(Z_0, Z_2, Z_1, Z_3) ^ cast_sk[3][X_a];
157 Z_89ab = X_cdef ^ SK(Z_7, Z_6, Z_5, Z_4) ^ cast_sk[0][X_9];
158 Z_cdef = X_4567 ^ SK(Z_a, Z_9, Z_b, Z_8) ^ cast_sk[1][X_b];
159 k->km[i++] = SK(Z_8, Z_9, Z_7, Z_6) ^ cast_sk[0][Z_2];
160 k->km[i++] = SK(Z_a, Z_b, Z_5, Z_4) ^ cast_sk[1][Z_6];
161 k->km[i++] = SK(Z_c, Z_d, Z_3, Z_2) ^ cast_sk[2][Z_9];
162 k->km[i++] = SK(Z_e, Z_f, Z_1, Z_0) ^ cast_sk[3][Z_c];
163 X_0123 = Z_89ab ^ SK(Z_5, Z_7, Z_4, Z_6) ^ cast_sk[2][Z_0];
164 X_4567 = Z_0123 ^ SK(X_0, X_2, X_1, X_3) ^ cast_sk[3][Z_2];
165 X_89ab = Z_4567 ^ SK(X_7, X_6, X_5, X_4) ^ cast_sk[0][Z_1];
166 X_cdef = Z_cdef ^ SK(X_a, X_9, X_b, X_8) ^ cast_sk[1][Z_3];
167 k->km[i++] = SK(X_3, X_2, X_c, X_d) ^ cast_sk[0][X_8];
168 k->km[i++] = SK(X_1, X_0, X_e, X_f) ^ cast_sk[1][X_d];
169 k->km[i++] = SK(X_7, X_6, X_8, X_9) ^ cast_sk[2][X_3];
170 k->km[i++] = SK(X_5, X_4, X_a, X_b) ^ cast_sk[3][X_7];
171 Z_0123 = X_0123 ^ SK(X_d, X_f, X_c, X_e) ^ cast_sk[2][X_8];
172 Z_4567 = X_89ab ^ SK(Z_0, Z_2, Z_1, Z_3) ^ cast_sk[3][X_a];
173 Z_89ab = X_cdef ^ SK(Z_7, Z_6, Z_5, Z_4) ^ cast_sk[0][X_9];
174 Z_cdef = X_4567 ^ SK(Z_a, Z_9, Z_b, Z_8) ^ cast_sk[1][X_b];
175 k->km[i++] = SK(Z_3, Z_2, Z_c, Z_d) ^ cast_sk[0][Z_9];
176 k->km[i++] = SK(Z_1, Z_0, Z_e, Z_f) ^ cast_sk[1][Z_c];
177 k->km[i++] = SK(Z_7, Z_6, Z_8, Z_9) ^ cast_sk[2][Z_2];
178 k->km[i++] = SK(Z_5, Z_4, Z_a, Z_b) ^ cast_sk[3][Z_6];
179 X_0123 = Z_89ab ^ SK(Z_5, Z_7, Z_4, Z_6) ^ cast_sk[2][Z_0];
180 X_4567 = Z_0123 ^ SK(X_0, X_2, X_1, X_3) ^ cast_sk[3][Z_2];
181 X_89ab = Z_4567 ^ SK(X_7, X_6, X_5, X_4) ^ cast_sk[0][Z_1];
182 X_cdef = Z_cdef ^ SK(X_a, X_9, X_b, X_8) ^ cast_sk[1][Z_3];
183 k->km[i++] = SK(X_8, X_9, X_7, X_6) ^ cast_sk[0][X_3];
184 k->km[i++] = SK(X_a, X_b, X_5, X_4) ^ cast_sk[1][X_7];
185 k->km[i++] = SK(X_c, X_d, X_3, X_2) ^ cast_sk[2][X_8];
186 k->km[i++] = SK(X_e, X_f, X_1, X_0) ^ cast_sk[3][X_d];
187
188 i = 0;
189 Z_0123 = X_0123 ^ SK(X_d, X_f, X_c, X_e) ^ cast_sk[2][X_8];
190 Z_4567 = X_89ab ^ SK(Z_0, Z_2, Z_1, Z_3) ^ cast_sk[3][X_a];
191 Z_89ab = X_cdef ^ SK(Z_7, Z_6, Z_5, Z_4) ^ cast_sk[0][X_9];
192 Z_cdef = X_4567 ^ SK(Z_a, Z_9, Z_b, Z_8) ^ cast_sk[1][X_b];
193 k->kr[i++] = (SK(Z_8, Z_9, Z_7, Z_6) ^ cast_sk[0][Z_2]) & 0x1f;
194 k->kr[i++] = (SK(Z_a, Z_b, Z_5, Z_4) ^ cast_sk[1][Z_6]) & 0x1f;
195 k->kr[i++] = (SK(Z_c, Z_d, Z_3, Z_2) ^ cast_sk[2][Z_9]) & 0x1f;
196 k->kr[i++] = (SK(Z_e, Z_f, Z_1, Z_0) ^ cast_sk[3][Z_c]) & 0x1f;
197 X_0123 = Z_89ab ^ SK(Z_5, Z_7, Z_4, Z_6) ^ cast_sk[2][Z_0];
198 X_4567 = Z_0123 ^ SK(X_0, X_2, X_1, X_3) ^ cast_sk[3][Z_2];
199 X_89ab = Z_4567 ^ SK(X_7, X_6, X_5, X_4) ^ cast_sk[0][Z_1];
200 X_cdef = Z_cdef ^ SK(X_a, X_9, X_b, X_8) ^ cast_sk[1][Z_3];
201 k->kr[i++] = (SK(X_3, X_2, X_c, X_d) ^ cast_sk[0][X_8]) & 0x1f;
202 k->kr[i++] = (SK(X_1, X_0, X_e, X_f) ^ cast_sk[1][X_d]) & 0x1f;
203 k->kr[i++] = (SK(X_7, X_6, X_8, X_9) ^ cast_sk[2][X_3]) & 0x1f;
204 k->kr[i++] = (SK(X_5, X_4, X_a, X_b) ^ cast_sk[3][X_7]) & 0x1f;
205 Z_0123 = X_0123 ^ SK(X_d, X_f, X_c, X_e) ^ cast_sk[2][X_8];
206 Z_4567 = X_89ab ^ SK(Z_0, Z_2, Z_1, Z_3) ^ cast_sk[3][X_a];
207 Z_89ab = X_cdef ^ SK(Z_7, Z_6, Z_5, Z_4) ^ cast_sk[0][X_9];
208 Z_cdef = X_4567 ^ SK(Z_a, Z_9, Z_b, Z_8) ^ cast_sk[1][X_b];
209 k->kr[i++] = (SK(Z_3, Z_2, Z_c, Z_d) ^ cast_sk[0][Z_9]) & 0x1f;
210 k->kr[i++] = (SK(Z_1, Z_0, Z_e, Z_f) ^ cast_sk[1][Z_c]) & 0x1f;
211 k->kr[i++] = (SK(Z_7, Z_6, Z_8, Z_9) ^ cast_sk[2][Z_2]) & 0x1f;
212 k->kr[i++] = (SK(Z_5, Z_4, Z_a, Z_b) ^ cast_sk[3][Z_6]) & 0x1f;
213 X_0123 = Z_89ab ^ SK(Z_5, Z_7, Z_4, Z_6) ^ cast_sk[2][Z_0];
214 X_4567 = Z_0123 ^ SK(X_0, X_2, X_1, X_3) ^ cast_sk[3][Z_2];
215 X_89ab = Z_4567 ^ SK(X_7, X_6, X_5, X_4) ^ cast_sk[0][Z_1];
216 X_cdef = Z_cdef ^ SK(X_a, X_9, X_b, X_8) ^ cast_sk[1][Z_3];
217 k->kr[i++] = (SK(X_8, X_9, X_7, X_6) ^ cast_sk[0][X_3]) & 0x1f;
218 k->kr[i++] = (SK(X_a, X_b, X_5, X_4) ^ cast_sk[1][X_7]) & 0x1f;
219 k->kr[i++] = (SK(X_c, X_d, X_3, X_2) ^ cast_sk[2][X_8]) & 0x1f;
220 k->kr[i++] = (SK(X_e, X_f, X_1, X_0) ^ cast_sk[3][X_d]) & 0x1f;
221
222 BURN(kk);
223 }
224
225 /* --- @cast128_eblk@, @cast128_dblk@ --- *
226 *
227 * Arguments: @const cast128_ctx *k@ = pointer to key block
228 * @const uint32 s[2]@ = pointer to source block
229 * @uint32 d[2]@ = pointer to destination block
230 *
231 * Returns: ---
232 *
233 * Use: Low-level block encryption and decryption.
234 */
235
236 void cast128_eblk(const cast128_ctx *k, const uint32 *s, uint32 *d)
237 {
238 uint32 a = s[0], b = s[1];
239 const uint32 *km = k->km;
240 const octet *kr = k->kr;
241
242 switch (k->r) {
243 default:
244 CAST_R1(*km++, *kr++, a, b);
245 CAST_R2(*km++, *kr++, b, a);
246 CAST_R3(*km++, *kr++, a, b);
247 CAST_R1(*km++, *kr++, b, a);
248 CAST_R2(*km++, *kr++, a, b);
249 CAST_R3(*km++, *kr++, b, a);
250 CAST_R1(*km++, *kr++, a, b);
251 CAST_R2(*km++, *kr++, b, a);
252 CAST_R3(*km++, *kr++, a, b);
253 CAST_R1(*km++, *kr++, b, a);
254 CAST_R2(*km++, *kr++, a, b);
255 CAST_R3(*km++, *kr++, b, a);
256 if (k->r == 12)
257 break;
258 CAST_R1(*km++, *kr++, a, b);
259 CAST_R2(*km++, *kr++, b, a);
260 CAST_R3(*km++, *kr++, a, b);
261 CAST_R1(*km++, *kr++, b, a);
262 break;
263 }
264
265 d[0] = b; d[1] = a;
266 }
267
268 void cast128_dblk(const cast128_ctx *k, const uint32 *s, uint32 *d)
269 {
270 uint32 a = s[0], b = s[1];
271 const uint32 *km = k->km + k->r;
272 const octet *kr = k->kr + k->r;
273
274 switch (k->r) {
275 case 16:
276 default:
277 CAST_R1(*--km, *--kr, a, b);
278 CAST_R3(*--km, *--kr, b, a);
279 CAST_R2(*--km, *--kr, a, b);
280 CAST_R1(*--km, *--kr, b, a);
281 case 12:
282 CAST_R3(*--km, *--kr, a, b);
283 CAST_R2(*--km, *--kr, b, a);
284 CAST_R1(*--km, *--kr, a, b);
285 CAST_R3(*--km, *--kr, b, a);
286 CAST_R2(*--km, *--kr, a, b);
287 CAST_R1(*--km, *--kr, b, a);
288 CAST_R3(*--km, *--kr, a, b);
289 CAST_R2(*--km, *--kr, b, a);
290 CAST_R1(*--km, *--kr, a, b);
291 CAST_R3(*--km, *--kr, b, a);
292 CAST_R2(*--km, *--kr, a, b);
293 CAST_R1(*--km, *--kr, b, a);
294 break;
295 }
296
297 d[0] = b; d[1] = a;
298 }
299
300 BLKC_TEST(CAST128, cast128)
301
302 /*----- That's all, folks -------------------------------------------------*/