projects / u / mdw / catacomb / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Renamed from `rsa-decrypt', since the name was no longer appropriate.
[u/mdw/catacomb] / rijndael.c
1 /* -*-c-*-
2 *
3 * $Id: rijndael.c,v 1.1 2000/06/17 11:56:07 mdw Exp $
4 *
5 * The Rijndael block cipher
6 *
7 * (c) 2000 Straylight/Edgeware
8 */
9
10 /*----- Licensing notice --------------------------------------------------*
11 *
12 * This file is part of Catacomb.
13 *
14 * Catacomb is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU Library General Public License as
16 * published by the Free Software Foundation; either version 2 of the
17 * License, or (at your option) any later version.
18 *
19 * Catacomb is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU Library General Public License for more details.
23 *
24 * You should have received a copy of the GNU Library General Public
25 * License along with Catacomb; if not, write to the Free
26 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
27 * MA 02111-1307, USA.
28 */
29
30 /*----- Revision history --------------------------------------------------*
31 *
32 * $Log: rijndael.c,v $
33 * Revision 1.1 2000/06/17 11:56:07 mdw
34 * New cipher.
35 *
36 */
37
38 /*----- Header files ------------------------------------------------------*/
39
40 #include <assert.h>
41 #include <stdio.h>
42
43 #include <mLib/bits.h>
44
45 #include "blkc.h"
46 #include "gcipher.h"
47 #include "rijndael.h"
48 #include "rijndael-tab.h"
49
50 /*----- Global variables --------------------------------------------------*/
51
52 const octet rijndael_keysz[] = { KSZ_RANGE, RIJNDAEL_KEYSZ, 4, 32, 4 };
53
54 /*----- Constant tables ---------------------------------------------------*/
55
56 static const octet S[256] = RIJNDAEL_S, SI[256] = RIJNDAEL_SI;
57 static const uint32 T[4][256] = RIJNDAEL_T, TI[4][256] = RIJNDAEL_TI;
58 static const uint32 U[4][256] = RIJNDAEL_U;
59 static const octet rcon[] = RIJNDAEL_RCON;
60
61 /*----- Main code ---------------------------------------------------------*/
62
63 #define BYTESUB(x, s) \
64 (s[U8((x) >> 24)] << 24 | s[U8((x) >> 16)] << 16 | \
65 s[U8((x) >> 8)] << 8 | s[U8((x) >> 0)] << 0)
66
67 /* --- @rijndael_init@ --- *
68 *
69 * Arguments: @rijndael_ctx *k@ = pointer to context to initialize
70 * @const void *buf@ = pointer to buffer of key material
71 * @size_t sz@ = size of the key material
72 *
73 * Returns: ---
74 *
75 * Use: Initializes a Rijndael context with a particular key. This
76 * implementation of Rijndael doesn't impose any particular
77 * limits on the key size except that it must be multiple of 4
78 * bytes long. 256 bits seems sensible, though.
79 */
80
81 void rijndael_init(rijndael_ctx *k, const void *buf, size_t sz)
82 {
83 unsigned nk, nr, nw;
84 unsigned i, j, jj;
85 const octet *p;
86 uint32 ww;
87
88 /* --- Sort out the key size --- */
89
90 KSZ_ASSERT(rijndael, sz);
91 nk = sz / 4;
92
93 /* --- Select the number of rounds --- */
94
95 if (nk < 5)
96 nr = 10;
97 else if (nk > 7)
98 nr = 14;
99 else
100 nr = 12;
101 k->nr = nr;
102
103 /* --- Fetch the first key words out --- */
104
105 p = buf;
106 for (i = 0; i < nk; i++) {
107 k->w[i] = LOAD32_L(p);
108 p += 4;
109 }
110
111 /* --- Expand this material to fill the rest of the table --- */
112
113 nw = (nr + 1) * (RIJNDAEL_BLKSZ / 4);
114 ww = k->w[i - 1];
115 p = rcon;
116 for (; i < nw; i++) {
117 uint32 w = k->w[i - nk];
118 if (i % nk == 0) {
119 ww = ROR32(ww, 8);
120 w ^= BYTESUB(ww, S) ^ *p++;
121 } else if (nk > 6 && i % nk == 4)
122 w ^= BYTESUB(ww, S);
123 else
124 w ^= ww;
125 k->w[i] = ww = w;
126 }
127
128 /* --- Make the decryption keys --- */
129
130 j = nw;
131
132 j -= RIJNDAEL_BLKSZ / 4; jj = 0;
133 for (i = 0; i < RIJNDAEL_BLKSZ / 4; i++)
134 k->wi[i] = k->w[j + jj++];
135
136 for (; i < nw - RIJNDAEL_BLKSZ / 4; i += RIJNDAEL_BLKSZ / 4) {
137 j -= RIJNDAEL_BLKSZ / 4;
138 for (jj = 0; jj < RIJNDAEL_BLKSZ / 4; jj++) {
139 uint32 w = k->w[j + jj];
140 k->wi[i + jj] = (U[0][U8(w >> 0)] ^ U[1][U8(w >> 8)] ^
141 U[2][U8(w >> 16)] ^ U[3][U8(w >> 24)]);
142 }
143 }
144
145 j -= RIJNDAEL_BLKSZ / 4; jj = 0;
146 for (; i < nw; i++)
147 k->wi[i] = k->w[j + jj++];
148 }
149
150 /* --- @rijndael_eblk@, @rijndael_dblk@ --- *
151 *
152 * Arguments: @const rijndael_ctx *k@ = pointer to Rijndael context
153 * @const uint32 s[4]@ = pointer to source block
154 * @uint32 d[4]@ = pointer to destination block
155 *
156 * Returns: ---
157 *
158 * Use: Low-level block encryption and decryption.
159 */
160
161 #define EROUND(aa, bb, cc, dd, a, b, c, d, w) do { \
162 aa = (T[0][U8(a >> 0)] ^ T[1][U8(b >> 8)] ^ \
163 T[2][U8(c >> 16)] ^ T[3][U8(d >> 24)]) ^ *w++; \
164 bb = (T[0][U8(b >> 0)] ^ T[1][U8(c >> 8)] ^ \
165 T[2][U8(d >> 16)] ^ T[3][U8(a >> 24)]) ^ *w++; \
166 cc = (T[0][U8(c >> 0)] ^ T[1][U8(d >> 8)] ^ \
167 T[2][U8(a >> 16)] ^ T[3][U8(b >> 24)]) ^ *w++; \
168 dd = (T[0][U8(d >> 0)] ^ T[1][U8(a >> 8)] ^ \
169 T[2][U8(b >> 16)] ^ T[3][U8(c >> 24)]) ^ *w++; \
170 } while (0)
171
172 #define DROUND(aa, bb, cc, dd, a, b, c, d, w) do { \
173 aa = (TI[0][U8(a >> 0)] ^ TI[1][U8(d >> 8)] ^ \
174 TI[2][U8(c >> 16)] ^ TI[3][U8(b >> 24)]) ^ *w++; \
175 bb = (TI[0][U8(b >> 0)] ^ TI[1][U8(a >> 8)] ^ \
176 TI[2][U8(d >> 16)] ^ TI[3][U8(c >> 24)]) ^ *w++; \
177 cc = (TI[0][U8(c >> 0)] ^ TI[1][U8(b >> 8)] ^ \
178 TI[2][U8(a >> 16)] ^ TI[3][U8(d >> 24)]) ^ *w++; \
179 dd = (TI[0][U8(d >> 0)] ^ TI[1][U8(c >> 8)] ^ \
180 TI[2][U8(b >> 16)] ^ TI[3][U8(a >> 24)]) ^ *w++; \
181 } while (0)
182
183 void rijndael_eblk(const rijndael_ctx *k, const uint32 *s, uint32 *dst)
184 {
185 uint32 a = s[0], b = s[1], c = s[2], d = s[3];
186 uint32 aa, bb, cc, dd;
187 uint32 *w = k->w;
188
189 a ^= *w++; b ^= *w++; c ^= *w++; d ^= *w++;
190
191 switch (k->nr) {
192 case 14:
193 EROUND(aa, bb, cc, dd, a, b, c, d, w);
194 EROUND(a, b, c, d, aa, bb, cc, dd, w);
195 case 12:
196 EROUND(aa, bb, cc, dd, a, b, c, d, w);
197 EROUND(a, b, c, d, aa, bb, cc, dd, w);
198 case 10:
199 default:
200 EROUND(aa, bb, cc, dd, a, b, c, d, w);
201 EROUND(a, b, c, d, aa, bb, cc, dd, w);
202 EROUND(aa, bb, cc, dd, a, b, c, d, w);
203 EROUND(a, b, c, d, aa, bb, cc, dd, w);
204 EROUND(aa, bb, cc, dd, a, b, c, d, w);
205 EROUND(a, b, c, d, aa, bb, cc, dd, w);
206 EROUND(aa, bb, cc, dd, a, b, c, d, w);
207 EROUND(a, b, c, d, aa, bb, cc, dd, w);
208 EROUND(aa, bb, cc, dd, a, b, c, d, w);
209 }
210
211 a = ((S[U8(aa >> 0)] << 0) ^ (S[U8(bb >> 8)] << 8) ^
212 (S[U8(cc >> 16)] << 16) ^ (S[U8(dd >> 24)] << 24)) ^ *w++;
213 b = ((S[U8(bb >> 0)] << 0) ^ (S[U8(cc >> 8)] << 8) ^
214 (S[U8(dd >> 16)] << 16) ^ (S[U8(aa >> 24)] << 24)) ^ *w++;
215 c = ((S[U8(cc >> 0)] << 0) ^ (S[U8(dd >> 8)] << 8) ^
216 (S[U8(aa >> 16)] << 16) ^ (S[U8(bb >> 24)] << 24)) ^ *w++;
217 d = ((S[U8(dd >> 0)] << 0) ^ (S[U8(aa >> 8)] << 8) ^
218 (S[U8(bb >> 16)] << 16) ^ (S[U8(cc >> 24)] << 24)) ^ *w++;
219
220 dst[0] = a; dst[1] = b; dst[2] = c; dst[3] = d;
221 }
222
223 void rijndael_dblk(const rijndael_ctx *k, const uint32 *s, uint32 *dst)
224 {
225 uint32 a = s[0], b = s[1], c = s[2], d = s[3];
226 uint32 aa, bb, cc, dd;
227 uint32 *w = k->wi;
228
229 a ^= *w++; b ^= *w++; c ^= *w++; d ^= *w++;
230
231 switch (k->nr) {
232 case 14:
233 DROUND(aa, bb, cc, dd, a, b, c, d, w);
234 DROUND(a, b, c, d, aa, bb, cc, dd, w);
235 case 12:
236 DROUND(aa, bb, cc, dd, a, b, c, d, w);
237 DROUND(a, b, c, d, aa, bb, cc, dd, w);
238 case 10:
239 default:
240 DROUND(aa, bb, cc, dd, a, b, c, d, w);
241 DROUND(a, b, c, d, aa, bb, cc, dd, w);
242 DROUND(aa, bb, cc, dd, a, b, c, d, w);
243 DROUND(a, b, c, d, aa, bb, cc, dd, w);
244 DROUND(aa, bb, cc, dd, a, b, c, d, w);
245 DROUND(a, b, c, d, aa, bb, cc, dd, w);
246 DROUND(aa, bb, cc, dd, a, b, c, d, w);
247 DROUND(a, b, c, d, aa, bb, cc, dd, w);
248 DROUND(aa, bb, cc, dd, a, b, c, d, w);
249 }
250
251 a = ((SI[U8(aa >> 0)] << 0) ^ (SI[U8(dd >> 8)] << 8) ^
252 (SI[U8(cc >> 16)] << 16) ^ (SI[U8(bb >> 24)] << 24)) ^ *w++;
253 b = ((SI[U8(bb >> 0)] << 0) ^ (SI[U8(aa >> 8)] << 8) ^
254 (SI[U8(dd >> 16)] << 16) ^ (SI[U8(cc >> 24)] << 24)) ^ *w++;
255 c = ((SI[U8(cc >> 0)] << 0) ^ (SI[U8(bb >> 8)] << 8) ^
256 (SI[U8(aa >> 16)] << 16) ^ (SI[U8(dd >> 24)] << 24)) ^ *w++;
257 d = ((SI[U8(dd >> 0)] << 0) ^ (SI[U8(cc >> 8)] << 8) ^
258 (SI[U8(bb >> 16)] << 16) ^ (SI[U8(aa >> 24)] << 24)) ^ *w++;
259
260 dst[0] = a; dst[1] = b; dst[2] = c; dst[3] = d;
261 }
262
263 BLKC_TEST(RIJNDAEL, rijndael)
264
265 /*----- That's all, folks -------------------------------------------------*/
Catacomb cryptographic library (downstream of http://git.distorted.org.uk/~mdw/catacomb/)