X-Git-Url: https://git.distorted.org.uk/u/mdw/catacomb/blobdiff_plain/6134d9683efd0dd88740a4a7f4804bbb2d92e912..3a65506d4df316377c9b838ef5954b5d856215ee:/rijndael.c?ds=sidebyside diff --git a/rijndael.c b/rijndael.c new file mode 100644 index 0000000..66797d5 --- /dev/null +++ b/rijndael.c @@ -0,0 +1,265 @@ +/* -*-c-*- + * + * $Id: rijndael.c,v 1.1 2000/06/17 11:56:07 mdw Exp $ + * + * The Rijndael block cipher + * + * (c) 2000 Straylight/Edgeware + */ + +/*----- Licensing notice --------------------------------------------------* + * + * This file is part of Catacomb. + * + * Catacomb is free software; you can redistribute it and/or modify + * it under the terms of the GNU Library General Public License as + * published by the Free Software Foundation; either version 2 of the + * License, or (at your option) any later version. + * + * Catacomb is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Library General Public License for more details. + * + * You should have received a copy of the GNU Library General Public + * License along with Catacomb; if not, write to the Free + * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, + * MA 02111-1307, USA. + */ + +/*----- Revision history --------------------------------------------------* + * + * $Log: rijndael.c,v $ + * Revision 1.1 2000/06/17 11:56:07 mdw + * New cipher. + * + */ + +/*----- Header files ------------------------------------------------------*/ + +#include +#include + +#include + +#include "blkc.h" +#include "gcipher.h" +#include "rijndael.h" +#include "rijndael-tab.h" + +/*----- Global variables --------------------------------------------------*/ + +const octet rijndael_keysz[] = { KSZ_RANGE, RIJNDAEL_KEYSZ, 4, 32, 4 }; + +/*----- Constant tables ---------------------------------------------------*/ + +static const octet S[256] = RIJNDAEL_S, SI[256] = RIJNDAEL_SI; +static const uint32 T[4][256] = RIJNDAEL_T, TI[4][256] = RIJNDAEL_TI; +static const uint32 U[4][256] = RIJNDAEL_U; +static const octet rcon[] = RIJNDAEL_RCON; + +/*----- Main code ---------------------------------------------------------*/ + +#define BYTESUB(x, s) \ + (s[U8((x) >> 24)] << 24 | s[U8((x) >> 16)] << 16 | \ + s[U8((x) >> 8)] << 8 | s[U8((x) >> 0)] << 0) + +/* --- @rijndael_init@ --- * + * + * Arguments: @rijndael_ctx *k@ = pointer to context to initialize + * @const void *buf@ = pointer to buffer of key material + * @size_t sz@ = size of the key material + * + * Returns: --- + * + * Use: Initializes a Rijndael context with a particular key. This + * implementation of Rijndael doesn't impose any particular + * limits on the key size except that it must be multiple of 4 + * bytes long. 256 bits seems sensible, though. + */ + +void rijndael_init(rijndael_ctx *k, const void *buf, size_t sz) +{ + unsigned nk, nr, nw; + unsigned i, j, jj; + const octet *p; + uint32 ww; + + /* --- Sort out the key size --- */ + + KSZ_ASSERT(rijndael, sz); + nk = sz / 4; + + /* --- Select the number of rounds --- */ + + if (nk < 5) + nr = 10; + else if (nk > 7) + nr = 14; + else + nr = 12; + k->nr = nr; + + /* --- Fetch the first key words out --- */ + + p = buf; + for (i = 0; i < nk; i++) { + k->w[i] = LOAD32_L(p); + p += 4; + } + + /* --- Expand this material to fill the rest of the table --- */ + + nw = (nr + 1) * (RIJNDAEL_BLKSZ / 4); + ww = k->w[i - 1]; + p = rcon; + for (; i < nw; i++) { + uint32 w = k->w[i - nk]; + if (i % nk == 0) { + ww = ROR32(ww, 8); + w ^= BYTESUB(ww, S) ^ *p++; + } else if (nk > 6 && i % nk == 4) + w ^= BYTESUB(ww, S); + else + w ^= ww; + k->w[i] = ww = w; + } + + /* --- Make the decryption keys --- */ + + j = nw; + + j -= RIJNDAEL_BLKSZ / 4; jj = 0; + for (i = 0; i < RIJNDAEL_BLKSZ / 4; i++) + k->wi[i] = k->w[j + jj++]; + + for (; i < nw - RIJNDAEL_BLKSZ / 4; i += RIJNDAEL_BLKSZ / 4) { + j -= RIJNDAEL_BLKSZ / 4; + for (jj = 0; jj < RIJNDAEL_BLKSZ / 4; jj++) { + uint32 w = k->w[j + jj]; + k->wi[i + jj] = (U[0][U8(w >> 0)] ^ U[1][U8(w >> 8)] ^ + U[2][U8(w >> 16)] ^ U[3][U8(w >> 24)]); + } + } + + j -= RIJNDAEL_BLKSZ / 4; jj = 0; + for (; i < nw; i++) + k->wi[i] = k->w[j + jj++]; +} + +/* --- @rijndael_eblk@, @rijndael_dblk@ --- * + * + * Arguments: @const rijndael_ctx *k@ = pointer to Rijndael context + * @const uint32 s[4]@ = pointer to source block + * @uint32 d[4]@ = pointer to destination block + * + * Returns: --- + * + * Use: Low-level block encryption and decryption. + */ + +#define EROUND(aa, bb, cc, dd, a, b, c, d, w) do { \ + aa = (T[0][U8(a >> 0)] ^ T[1][U8(b >> 8)] ^ \ + T[2][U8(c >> 16)] ^ T[3][U8(d >> 24)]) ^ *w++; \ + bb = (T[0][U8(b >> 0)] ^ T[1][U8(c >> 8)] ^ \ + T[2][U8(d >> 16)] ^ T[3][U8(a >> 24)]) ^ *w++; \ + cc = (T[0][U8(c >> 0)] ^ T[1][U8(d >> 8)] ^ \ + T[2][U8(a >> 16)] ^ T[3][U8(b >> 24)]) ^ *w++; \ + dd = (T[0][U8(d >> 0)] ^ T[1][U8(a >> 8)] ^ \ + T[2][U8(b >> 16)] ^ T[3][U8(c >> 24)]) ^ *w++; \ +} while (0) + +#define DROUND(aa, bb, cc, dd, a, b, c, d, w) do { \ + aa = (TI[0][U8(a >> 0)] ^ TI[1][U8(d >> 8)] ^ \ + TI[2][U8(c >> 16)] ^ TI[3][U8(b >> 24)]) ^ *w++; \ + bb = (TI[0][U8(b >> 0)] ^ TI[1][U8(a >> 8)] ^ \ + TI[2][U8(d >> 16)] ^ TI[3][U8(c >> 24)]) ^ *w++; \ + cc = (TI[0][U8(c >> 0)] ^ TI[1][U8(b >> 8)] ^ \ + TI[2][U8(a >> 16)] ^ TI[3][U8(d >> 24)]) ^ *w++; \ + dd = (TI[0][U8(d >> 0)] ^ TI[1][U8(c >> 8)] ^ \ + TI[2][U8(b >> 16)] ^ TI[3][U8(a >> 24)]) ^ *w++; \ +} while (0) + +void rijndael_eblk(const rijndael_ctx *k, const uint32 *s, uint32 *dst) +{ + uint32 a = s[0], b = s[1], c = s[2], d = s[3]; + uint32 aa, bb, cc, dd; + uint32 *w = k->w; + + a ^= *w++; b ^= *w++; c ^= *w++; d ^= *w++; + + switch (k->nr) { + case 14: + EROUND(aa, bb, cc, dd, a, b, c, d, w); + EROUND(a, b, c, d, aa, bb, cc, dd, w); + case 12: + EROUND(aa, bb, cc, dd, a, b, c, d, w); + EROUND(a, b, c, d, aa, bb, cc, dd, w); + case 10: + default: + EROUND(aa, bb, cc, dd, a, b, c, d, w); + EROUND(a, b, c, d, aa, bb, cc, dd, w); + EROUND(aa, bb, cc, dd, a, b, c, d, w); + EROUND(a, b, c, d, aa, bb, cc, dd, w); + EROUND(aa, bb, cc, dd, a, b, c, d, w); + EROUND(a, b, c, d, aa, bb, cc, dd, w); + EROUND(aa, bb, cc, dd, a, b, c, d, w); + EROUND(a, b, c, d, aa, bb, cc, dd, w); + EROUND(aa, bb, cc, dd, a, b, c, d, w); + } + + a = ((S[U8(aa >> 0)] << 0) ^ (S[U8(bb >> 8)] << 8) ^ + (S[U8(cc >> 16)] << 16) ^ (S[U8(dd >> 24)] << 24)) ^ *w++; + b = ((S[U8(bb >> 0)] << 0) ^ (S[U8(cc >> 8)] << 8) ^ + (S[U8(dd >> 16)] << 16) ^ (S[U8(aa >> 24)] << 24)) ^ *w++; + c = ((S[U8(cc >> 0)] << 0) ^ (S[U8(dd >> 8)] << 8) ^ + (S[U8(aa >> 16)] << 16) ^ (S[U8(bb >> 24)] << 24)) ^ *w++; + d = ((S[U8(dd >> 0)] << 0) ^ (S[U8(aa >> 8)] << 8) ^ + (S[U8(bb >> 16)] << 16) ^ (S[U8(cc >> 24)] << 24)) ^ *w++; + + dst[0] = a; dst[1] = b; dst[2] = c; dst[3] = d; +} + +void rijndael_dblk(const rijndael_ctx *k, const uint32 *s, uint32 *dst) +{ + uint32 a = s[0], b = s[1], c = s[2], d = s[3]; + uint32 aa, bb, cc, dd; + uint32 *w = k->wi; + + a ^= *w++; b ^= *w++; c ^= *w++; d ^= *w++; + + switch (k->nr) { + case 14: + DROUND(aa, bb, cc, dd, a, b, c, d, w); + DROUND(a, b, c, d, aa, bb, cc, dd, w); + case 12: + DROUND(aa, bb, cc, dd, a, b, c, d, w); + DROUND(a, b, c, d, aa, bb, cc, dd, w); + case 10: + default: + DROUND(aa, bb, cc, dd, a, b, c, d, w); + DROUND(a, b, c, d, aa, bb, cc, dd, w); + DROUND(aa, bb, cc, dd, a, b, c, d, w); + DROUND(a, b, c, d, aa, bb, cc, dd, w); + DROUND(aa, bb, cc, dd, a, b, c, d, w); + DROUND(a, b, c, d, aa, bb, cc, dd, w); + DROUND(aa, bb, cc, dd, a, b, c, d, w); + DROUND(a, b, c, d, aa, bb, cc, dd, w); + DROUND(aa, bb, cc, dd, a, b, c, d, w); + } + + a = ((SI[U8(aa >> 0)] << 0) ^ (SI[U8(dd >> 8)] << 8) ^ + (SI[U8(cc >> 16)] << 16) ^ (SI[U8(bb >> 24)] << 24)) ^ *w++; + b = ((SI[U8(bb >> 0)] << 0) ^ (SI[U8(aa >> 8)] << 8) ^ + (SI[U8(dd >> 16)] << 16) ^ (SI[U8(cc >> 24)] << 24)) ^ *w++; + c = ((SI[U8(cc >> 0)] << 0) ^ (SI[U8(bb >> 8)] << 8) ^ + (SI[U8(aa >> 16)] << 16) ^ (SI[U8(dd >> 24)] << 24)) ^ *w++; + d = ((SI[U8(dd >> 0)] << 0) ^ (SI[U8(cc >> 8)] << 8) ^ + (SI[U8(bb >> 16)] << 16) ^ (SI[U8(aa >> 24)] << 24)) ^ *w++; + + dst[0] = a; dst[1] = b; dst[2] = c; dst[3] = d; +} + +BLKC_TEST(RIJNDAEL, rijndael) + +/*----- That's all, folks -------------------------------------------------*/