2 #include <stdarg.h> /* FIXME */
3 #include <windows.h> /* FIXME */
4 #include "putty.h" /* FIXME */
8 /* des.c - implementation of DES
15 * Unlike the description in FIPS 46, I'm going to use _sensible_ indices:
16 * bits in an n-bit word are numbered from 0 at the LSB to n-1 at the MSB.
17 * And S-boxes are indexed by six consecutive bits, not by the outer two
18 * followed by the middle four.
20 * The DES encryption routine requires a 64-bit input, and a key schedule K
21 * containing 16 48-bit elements.
23 * First the input is permuted by the initial permutation IP.
24 * Then the input is split into 32-bit words L and R. (L is the MSW.)
25 * Next, 16 rounds. In each round:
26 * (L, R) <- (R, L xor f(R, K[i]))
27 * Then the pre-output words L and R are swapped.
28 * Then L and R are glued back together into a 64-bit word. (L is the MSW,
29 * again, but since we just swapped them, the MSW is the R that came out
31 * The 64-bit output block is permuted by the inverse of IP and returned.
33 * Decryption is identical except that the elements of K are used in the
34 * opposite order. (This wouldn't work if that word swap didn't happen.)
36 * The function f, used in each round, accepts a 32-bit word R and a
37 * 48-bit key block K. It produces a 32-bit output.
39 * First R is expanded to 48 bits using the bit-selection function E.
40 * The resulting 48-bit block is XORed with the key block K to produce
42 * This block X is split into eight groups of 6 bits. Each group of 6
43 * bits is then looked up in one of the eight S-boxes to convert
44 * it to 4 bits. These eight groups of 4 bits are glued back
45 * together to produce a 32-bit preoutput block.
46 * The preoutput block is permuted using the permutation P and returned.
48 * Key setup maps a 64-bit key word into a 16x48-bit key schedule. Although
49 * the approved input format for the key is a 64-bit word, eight of the
50 * bits are discarded, so the actual quantity of key used is 56 bits.
52 * First the input key is converted to two 28-bit words C and D using
53 * the bit-selection function PC1.
54 * Then 16 rounds of key setup occur. In each round, C and D are each
55 * rotated left by either 1 or 2 bits (depending on which round), and
56 * then converted into a key schedule element using the bit-selection
59 * That's the actual algorithm. Now for the tedious details: all those
60 * painful permutations and lookup tables.
62 * IP is a 64-to-64 bit permutation. Its output contains the following
63 * bits of its input (listed in order MSB to LSB of output).
65 * 6 14 22 30 38 46 54 62 4 12 20 28 36 44 52 60
66 * 2 10 18 26 34 42 50 58 0 8 16 24 32 40 48 56
67 * 7 15 23 31 39 47 55 63 5 13 21 29 37 45 53 61
68 * 3 11 19 27 35 43 51 59 1 9 17 25 33 41 49 57
70 * E is a 32-to-48 bit selection function. Its output contains the following
71 * bits of its input (listed in order MSB to LSB of output).
73 * 0 31 30 29 28 27 28 27 26 25 24 23 24 23 22 21 20 19 20 19 18 17 16 15
74 * 16 15 14 13 12 11 12 11 10 9 8 7 8 7 6 5 4 3 4 3 2 1 0 31
76 * The S-boxes are arbitrary table-lookups each mapping a 6-bit input to a
77 * 4-bit output. In other words, each S-box is an array[64] of 4-bit numbers.
78 * The S-boxes are listed below. The first S-box listed is applied to the
79 * most significant six bits of the block X; the last one is applied to the
82 * 14 0 4 15 13 7 1 4 2 14 15 2 11 13 8 1
83 * 3 10 10 6 6 12 12 11 5 9 9 5 0 3 7 8
84 * 4 15 1 12 14 8 8 2 13 4 6 9 2 1 11 7
85 * 15 5 12 11 9 3 7 14 3 10 10 0 5 6 0 13
87 * 15 3 1 13 8 4 14 7 6 15 11 2 3 8 4 14
88 * 9 12 7 0 2 1 13 10 12 6 0 9 5 11 10 5
89 * 0 13 14 8 7 10 11 1 10 3 4 15 13 4 1 2
90 * 5 11 8 6 12 7 6 12 9 0 3 5 2 14 15 9
92 * 10 13 0 7 9 0 14 9 6 3 3 4 15 6 5 10
93 * 1 2 13 8 12 5 7 14 11 12 4 11 2 15 8 1
94 * 13 1 6 10 4 13 9 0 8 6 15 9 3 8 0 7
95 * 11 4 1 15 2 14 12 3 5 11 10 5 14 2 7 12
97 * 7 13 13 8 14 11 3 5 0 6 6 15 9 0 10 3
98 * 1 4 2 7 8 2 5 12 11 1 12 10 4 14 15 9
99 * 10 3 6 15 9 0 0 6 12 10 11 1 7 13 13 8
100 * 15 9 1 4 3 5 14 11 5 12 2 7 8 2 4 14
102 * 2 14 12 11 4 2 1 12 7 4 10 7 11 13 6 1
103 * 8 5 5 0 3 15 15 10 13 3 0 9 14 8 9 6
104 * 4 11 2 8 1 12 11 7 10 1 13 14 7 2 8 13
105 * 15 6 9 15 12 0 5 9 6 10 3 4 0 5 14 3
107 * 12 10 1 15 10 4 15 2 9 7 2 12 6 9 8 5
108 * 0 6 13 1 3 13 4 14 14 0 7 11 5 3 11 8
109 * 9 4 14 3 15 2 5 12 2 9 8 5 12 15 3 10
110 * 7 11 0 14 4 1 10 7 1 6 13 0 11 8 6 13
112 * 4 13 11 0 2 11 14 7 15 4 0 9 8 1 13 10
113 * 3 14 12 3 9 5 7 12 5 2 10 15 6 8 1 6
114 * 1 6 4 11 11 13 13 8 12 1 3 4 7 10 14 7
115 * 10 9 15 5 6 0 8 15 0 14 5 2 9 3 2 12
117 * 13 1 2 15 8 13 4 8 6 10 15 3 11 7 1 4
118 * 10 12 9 5 3 6 14 11 5 0 0 14 12 9 7 2
119 * 7 2 11 1 4 14 1 7 9 4 12 10 14 8 2 13
120 * 0 15 6 12 10 9 13 0 15 3 3 5 5 6 8 11
122 * P is a 32-to-32 bit permutation. Its output contains the following
123 * bits of its input (listed in order MSB to LSB of output).
125 * 16 25 12 11 3 20 4 15 31 17 9 6 27 14 1 22
126 * 30 24 8 18 0 5 29 23 13 19 2 26 10 21 28 7
128 * PC1 is a 64-to-56 bit selection function. Its output is in two words,
129 * C and D. The word C contains the following bits of its input (listed
130 * in order MSB to LSB of output).
132 * 7 15 23 31 39 47 55 63 6 14 22 30 38 46
133 * 54 62 5 13 21 29 37 45 53 61 4 12 20 28
135 * And the word D contains these bits.
137 * 1 9 17 25 33 41 49 57 2 10 18 26 34 42
138 * 50 58 3 11 19 27 35 43 51 59 36 44 52 60
140 * PC2 is a 56-to-48 bit selection function. Its input is in two words,
141 * C and D. These are treated as one 56-bit word (with C more significant,
142 * so that bits 55 to 28 of the word are bits 27 to 0 of C, and bits 27 to
143 * 0 of the word are bits 27 to 0 of D). The output contains the following
144 * bits of this 56-bit input word (listed in order MSB to LSB of output).
146 * 42 39 45 32 55 51 53 28 41 50 35 46 33 37 44 52 30 48 40 49 29 36 43 54
147 * 15 4 25 19 9 1 26 16 5 11 23 8 12 7 17 0 22 3 10 14 6 20 27 24
151 * Implementation details
152 * ----------------------
154 * If you look at the code in this module, you'll find it looks
155 * nothing _like_ the above algorithm. Here I explain the
158 * Key setup has not been heavily optimised here. We are not
159 * concerned with key agility: we aren't codebreakers. We don't
160 * mind a little delay (and it really is a little one; it may be a
161 * factor of five or so slower than it could be but it's still not
162 * an appreciable length of time) while setting up. The only tweaks
163 * in the key setup are ones which change the format of the key
164 * schedule to speed up the actual encryption. I'll describe those
167 * The first and most obvious optimisation is the S-boxes. Since
168 * each S-box always targets the same four bits in the final 32-bit
169 * word, so the output from (for example) S-box 0 must always be
170 * shifted left 28 bits, we can store the already-shifted outputs
171 * in the lookup tables. This reduces lookup-and-shift to lookup,
172 * so the S-box step is now just a question of ORing together eight
175 * The permutation P is just a bit order change; it's invariant
176 * with respect to OR, in that P(x)|P(y) = P(x|y). Therefore, we
177 * can apply P to every entry of the S-box tables and then we don't
178 * have to do it in the code of f(). This yields a set of tables
179 * which might be called SP-boxes.
181 * The bit-selection function E is our next target. Note that E is
182 * immediately followed by the operation of splitting into 6-bit
183 * chunks. Examining the 6-bit chunks coming out of E we notice
184 * they're all contiguous within the word (speaking cyclically -
185 * the end two wrap round); so we can extract those bit strings
186 * individually rather than explicitly running E. This would yield
189 * y |= SPboxes[0][ (rotl(R, 5) ^ top6bitsofK) & 0x3F ];
190 * t |= SPboxes[1][ (rotl(R,11) ^ next6bitsofK) & 0x3F ];
192 * and so on; and the key schedule preparation would have to
193 * provide each 6-bit chunk separately.
195 * Really we'd like to XOR in the key schedule element before
196 * looking up bit strings in R. This we can't do, naively, because
197 * the 6-bit strings we want overlap. But look at the strings:
199 * 3322222222221111111111
200 * bit 10987654321098765432109876543210
211 * The bit strings we need to XOR in for boxes 0, 2, 4 and 6 don't
212 * overlap with each other. Neither do the ones for boxes 1, 3, 5
213 * and 7. So we could provide the key schedule in the form of two
214 * words that we can separately XOR into R, and then every S-box
215 * index is available as a (cyclically) contiguous 6-bit substring
216 * of one or the other of the results.
218 * The comments in Eric Young's libdes implementation point out
219 * that two of these bit strings require a rotation (rather than a
220 * simple shift) to extract. It's unavoidable that at least _one_
221 * must do; but we can actually run the whole inner algorithm (all
222 * 16 rounds) rotated one bit to the left, so that what the `real'
223 * DES description sees as L=0x80000001 we see as L=0x00000003.
224 * This requires rotating all our SP-box entries one bit to the
225 * left, and rotating each word of the key schedule elements one to
226 * the left, and rotating L and R one bit left just after IP and
227 * one bit right again just before FP. And in each round we convert
228 * a rotate into a shift, so we've saved a few per cent.
230 * That's about it for the inner loop; the SP-box tables as listed
231 * below are what I've described here (the original S value,
232 * shifted to its final place in the input to P, run through P, and
233 * then rotated one bit left). All that remains is to optimise the
234 * initial permutation IP.
236 * IP is not an arbitrary permutation. It has the nice property
237 * that if you take any bit number, write it in binary (6 bits),
238 * permute those 6 bits and invert some of them, you get the final
239 * position of that bit. Specifically, the bit whose initial
240 * position is given (in binary) as fedcba ends up in position
241 * AcbFED (where a capital letter denotes the inverse of a bit).
243 * We have the 64-bit data in two 32-bit words L and R, where bits
244 * in L are those with f=1 and bits in R are those with f=0. We
245 * note that we can do a simple transformation: suppose we exchange
246 * the bits with f=1,c=0 and the bits with f=0,c=1. This will cause
247 * the bit fedcba to be in position cedfba - we've `swapped' bits c
248 * and f in the position of each bit!
250 * Better still, this transformation is easy. In the example above,
251 * bits in L with c=0 are bits 0x0F0F0F0F, and those in R with c=1
252 * are 0xF0F0F0F0. So we can do
254 * difference = ((R >> 4) ^ L) & 0x0F0F0F0F
255 * R ^= (difference << 4)
258 * to perform the swap. Let's denote this by bitswap(4,0x0F0F0F0F).
259 * Also, we can invert the bit at the top just by exchanging L and
260 * R. So in a few swaps and a few of these bit operations we can
263 * Initially the position of bit fedcba is fedcba
264 * Swap L with R to make it Fedcba
265 * Perform bitswap( 4,0x0F0F0F0F) to make it cedFba
266 * Perform bitswap(16,0x0000FFFF) to make it ecdFba
267 * Swap L with R to make it EcdFba
268 * Perform bitswap( 2,0x33333333) to make it bcdFEa
269 * Perform bitswap( 8,0x00FF00FF) to make it dcbFEa
270 * Swap L with R to make it DcbFEa
271 * Perform bitswap( 1,0x55555555) to make it acbFED
272 * Swap L with R to make it AcbFED
274 * (In the actual code the four swaps are implicit: R and L are
275 * simply used the other way round in the first, second and last
276 * bitswap operations.)
278 * The final permutation is just the inverse of IP, so it can be
279 * performed by a similar set of operations.
283 word32 k0246
[16], k1357
[16];
288 #define rotl(x, c) ( (x << c) | (x >> (32-c)) )
289 #define rotl28(x, c) ( ( (x << c) | (x >> (28-c)) ) & 0x0FFFFFFF)
291 static word32
bitsel(word32
*input
, const int *bitnums
, int size
) {
294 int bitpos
= *bitnums
++;
297 ret
|= 1 & (input
[bitpos
/ 32] >> (bitpos
% 32));
302 void des_key_setup(word32 key_msw
, word32 key_lsw
, DESContext
*sched
) {
304 static const int PC1_Cbits
[] = {
305 7, 15, 23, 31, 39, 47, 55, 63, 6, 14, 22, 30, 38, 46,
306 54, 62, 5, 13, 21, 29, 37, 45, 53, 61, 4, 12, 20, 28
308 static const int PC1_Dbits
[] = {
309 1, 9, 17, 25, 33, 41, 49, 57, 2, 10, 18, 26, 34, 42,
310 50, 58, 3, 11, 19, 27, 35, 43, 51, 59, 36, 44, 52, 60
313 * The bit numbers in the two lists below don't correspond to
314 * the ones in the above description of PC2, because in the
315 * above description C and D are concatenated so `bit 28' means
316 * bit 0 of C. In this implementation we're using the standard
317 * `bitsel' function above and C is in the second word, so bit
318 * 0 of C is addressed by writing `32' here.
320 static const int PC2_0246
[] = {
321 49, 36, 59, 55, -1, -1, 37, 41, 48, 56, 34, 52, -1, -1, 15, 4,
322 25, 19, 9, 1, -1, -1, 12, 7, 17, 0, 22, 3, -1, -1, 46, 43
324 static const int PC2_1357
[] = {
325 -1, -1, 57, 32, 45, 54, 39, 50, -1, -1, 44, 53, 33, 40, 47, 58,
326 -1, -1, 26, 16, 5, 11, 23, 8, -1, -1, 10, 14, 6, 20, 27, 24
328 static const int leftshifts
[] = {1,1,2,2,2,2,2,2,1,2,2,2,2,2,2,1};
337 C
= bitsel(buf
, PC1_Cbits
, 28);
338 D
= bitsel(buf
, PC1_Dbits
, 28);
340 for (i
= 0; i
< 16; i
++) {
341 C
= rotl28(C
, leftshifts
[i
]);
342 D
= rotl28(D
, leftshifts
[i
]);
345 sched
->k0246
[i
] = bitsel(buf
, PC2_0246
, 32);
346 sched
->k1357
[i
] = bitsel(buf
, PC2_1357
, 32);
349 sched
->eiv0
= sched
->eiv1
= 0;
350 sched
->div0
= sched
->div1
= 0; /* for good measure */
353 static const word32 SPboxes
[8][64] = {
354 {0x01010400, 0x00000000, 0x00010000, 0x01010404,
355 0x01010004, 0x00010404, 0x00000004, 0x00010000,
356 0x00000400, 0x01010400, 0x01010404, 0x00000400,
357 0x01000404, 0x01010004, 0x01000000, 0x00000004,
358 0x00000404, 0x01000400, 0x01000400, 0x00010400,
359 0x00010400, 0x01010000, 0x01010000, 0x01000404,
360 0x00010004, 0x01000004, 0x01000004, 0x00010004,
361 0x00000000, 0x00000404, 0x00010404, 0x01000000,
362 0x00010000, 0x01010404, 0x00000004, 0x01010000,
363 0x01010400, 0x01000000, 0x01000000, 0x00000400,
364 0x01010004, 0x00010000, 0x00010400, 0x01000004,
365 0x00000400, 0x00000004, 0x01000404, 0x00010404,
366 0x01010404, 0x00010004, 0x01010000, 0x01000404,
367 0x01000004, 0x00000404, 0x00010404, 0x01010400,
368 0x00000404, 0x01000400, 0x01000400, 0x00000000,
369 0x00010004, 0x00010400, 0x00000000, 0x01010004L
},
371 {0x80108020, 0x80008000, 0x00008000, 0x00108020,
372 0x00100000, 0x00000020, 0x80100020, 0x80008020,
373 0x80000020, 0x80108020, 0x80108000, 0x80000000,
374 0x80008000, 0x00100000, 0x00000020, 0x80100020,
375 0x00108000, 0x00100020, 0x80008020, 0x00000000,
376 0x80000000, 0x00008000, 0x00108020, 0x80100000,
377 0x00100020, 0x80000020, 0x00000000, 0x00108000,
378 0x00008020, 0x80108000, 0x80100000, 0x00008020,
379 0x00000000, 0x00108020, 0x80100020, 0x00100000,
380 0x80008020, 0x80100000, 0x80108000, 0x00008000,
381 0x80100000, 0x80008000, 0x00000020, 0x80108020,
382 0x00108020, 0x00000020, 0x00008000, 0x80000000,
383 0x00008020, 0x80108000, 0x00100000, 0x80000020,
384 0x00100020, 0x80008020, 0x80000020, 0x00100020,
385 0x00108000, 0x00000000, 0x80008000, 0x00008020,
386 0x80000000, 0x80100020, 0x80108020, 0x00108000L
},
388 {0x00000208, 0x08020200, 0x00000000, 0x08020008,
389 0x08000200, 0x00000000, 0x00020208, 0x08000200,
390 0x00020008, 0x08000008, 0x08000008, 0x00020000,
391 0x08020208, 0x00020008, 0x08020000, 0x00000208,
392 0x08000000, 0x00000008, 0x08020200, 0x00000200,
393 0x00020200, 0x08020000, 0x08020008, 0x00020208,
394 0x08000208, 0x00020200, 0x00020000, 0x08000208,
395 0x00000008, 0x08020208, 0x00000200, 0x08000000,
396 0x08020200, 0x08000000, 0x00020008, 0x00000208,
397 0x00020000, 0x08020200, 0x08000200, 0x00000000,
398 0x00000200, 0x00020008, 0x08020208, 0x08000200,
399 0x08000008, 0x00000200, 0x00000000, 0x08020008,
400 0x08000208, 0x00020000, 0x08000000, 0x08020208,
401 0x00000008, 0x00020208, 0x00020200, 0x08000008,
402 0x08020000, 0x08000208, 0x00000208, 0x08020000,
403 0x00020208, 0x00000008, 0x08020008, 0x00020200L
},
405 {0x00802001, 0x00002081, 0x00002081, 0x00000080,
406 0x00802080, 0x00800081, 0x00800001, 0x00002001,
407 0x00000000, 0x00802000, 0x00802000, 0x00802081,
408 0x00000081, 0x00000000, 0x00800080, 0x00800001,
409 0x00000001, 0x00002000, 0x00800000, 0x00802001,
410 0x00000080, 0x00800000, 0x00002001, 0x00002080,
411 0x00800081, 0x00000001, 0x00002080, 0x00800080,
412 0x00002000, 0x00802080, 0x00802081, 0x00000081,
413 0x00800080, 0x00800001, 0x00802000, 0x00802081,
414 0x00000081, 0x00000000, 0x00000000, 0x00802000,
415 0x00002080, 0x00800080, 0x00800081, 0x00000001,
416 0x00802001, 0x00002081, 0x00002081, 0x00000080,
417 0x00802081, 0x00000081, 0x00000001, 0x00002000,
418 0x00800001, 0x00002001, 0x00802080, 0x00800081,
419 0x00002001, 0x00002080, 0x00800000, 0x00802001,
420 0x00000080, 0x00800000, 0x00002000, 0x00802080L
},
422 {0x00000100, 0x02080100, 0x02080000, 0x42000100,
423 0x00080000, 0x00000100, 0x40000000, 0x02080000,
424 0x40080100, 0x00080000, 0x02000100, 0x40080100,
425 0x42000100, 0x42080000, 0x00080100, 0x40000000,
426 0x02000000, 0x40080000, 0x40080000, 0x00000000,
427 0x40000100, 0x42080100, 0x42080100, 0x02000100,
428 0x42080000, 0x40000100, 0x00000000, 0x42000000,
429 0x02080100, 0x02000000, 0x42000000, 0x00080100,
430 0x00080000, 0x42000100, 0x00000100, 0x02000000,
431 0x40000000, 0x02080000, 0x42000100, 0x40080100,
432 0x02000100, 0x40000000, 0x42080000, 0x02080100,
433 0x40080100, 0x00000100, 0x02000000, 0x42080000,
434 0x42080100, 0x00080100, 0x42000000, 0x42080100,
435 0x02080000, 0x00000000, 0x40080000, 0x42000000,
436 0x00080100, 0x02000100, 0x40000100, 0x00080000,
437 0x00000000, 0x40080000, 0x02080100, 0x40000100L
},
439 {0x20000010, 0x20400000, 0x00004000, 0x20404010,
440 0x20400000, 0x00000010, 0x20404010, 0x00400000,
441 0x20004000, 0x00404010, 0x00400000, 0x20000010,
442 0x00400010, 0x20004000, 0x20000000, 0x00004010,
443 0x00000000, 0x00400010, 0x20004010, 0x00004000,
444 0x00404000, 0x20004010, 0x00000010, 0x20400010,
445 0x20400010, 0x00000000, 0x00404010, 0x20404000,
446 0x00004010, 0x00404000, 0x20404000, 0x20000000,
447 0x20004000, 0x00000010, 0x20400010, 0x00404000,
448 0x20404010, 0x00400000, 0x00004010, 0x20000010,
449 0x00400000, 0x20004000, 0x20000000, 0x00004010,
450 0x20000010, 0x20404010, 0x00404000, 0x20400000,
451 0x00404010, 0x20404000, 0x00000000, 0x20400010,
452 0x00000010, 0x00004000, 0x20400000, 0x00404010,
453 0x00004000, 0x00400010, 0x20004010, 0x00000000,
454 0x20404000, 0x20000000, 0x00400010, 0x20004010L
},
456 {0x00200000, 0x04200002, 0x04000802, 0x00000000,
457 0x00000800, 0x04000802, 0x00200802, 0x04200800,
458 0x04200802, 0x00200000, 0x00000000, 0x04000002,
459 0x00000002, 0x04000000, 0x04200002, 0x00000802,
460 0x04000800, 0x00200802, 0x00200002, 0x04000800,
461 0x04000002, 0x04200000, 0x04200800, 0x00200002,
462 0x04200000, 0x00000800, 0x00000802, 0x04200802,
463 0x00200800, 0x00000002, 0x04000000, 0x00200800,
464 0x04000000, 0x00200800, 0x00200000, 0x04000802,
465 0x04000802, 0x04200002, 0x04200002, 0x00000002,
466 0x00200002, 0x04000000, 0x04000800, 0x00200000,
467 0x04200800, 0x00000802, 0x00200802, 0x04200800,
468 0x00000802, 0x04000002, 0x04200802, 0x04200000,
469 0x00200800, 0x00000000, 0x00000002, 0x04200802,
470 0x00000000, 0x00200802, 0x04200000, 0x00000800,
471 0x04000002, 0x04000800, 0x00000800, 0x00200002L
},
473 {0x10001040, 0x00001000, 0x00040000, 0x10041040,
474 0x10000000, 0x10001040, 0x00000040, 0x10000000,
475 0x00040040, 0x10040000, 0x10041040, 0x00041000,
476 0x10041000, 0x00041040, 0x00001000, 0x00000040,
477 0x10040000, 0x10000040, 0x10001000, 0x00001040,
478 0x00041000, 0x00040040, 0x10040040, 0x10041000,
479 0x00001040, 0x00000000, 0x00000000, 0x10040040,
480 0x10000040, 0x10001000, 0x00041040, 0x00040000,
481 0x00041040, 0x00040000, 0x10041000, 0x00001000,
482 0x00000040, 0x10040040, 0x00001000, 0x00041040,
483 0x10001000, 0x00000040, 0x10000040, 0x10040000,
484 0x10040040, 0x10000000, 0x00040000, 0x10001040,
485 0x00000000, 0x10041040, 0x00040040, 0x10000040,
486 0x10040000, 0x10001000, 0x10001040, 0x00000000,
487 0x10041040, 0x00041000, 0x00041000, 0x00001040,
488 0x00001040, 0x00040040, 0x10000000, 0x10041000L
}
491 #define f(R, K0246, K1357) (\
494 s0246 = rotl(s0246, 28), \
495 SPboxes[0] [(s0246 >> 24) & 0x3F] | \
496 SPboxes[1] [(s1357 >> 24) & 0x3F] | \
497 SPboxes[2] [(s0246 >> 16) & 0x3F] | \
498 SPboxes[3] [(s1357 >> 16) & 0x3F] | \
499 SPboxes[4] [(s0246 >> 8) & 0x3F] | \
500 SPboxes[5] [(s1357 >> 8) & 0x3F] | \
501 SPboxes[6] [(s0246 ) & 0x3F] | \
502 SPboxes[7] [(s1357 ) & 0x3F])
504 #define bitswap(L, R, n, mask) (\
505 swap = mask & ( (R >> n) ^ L ), \
509 /* Initial permutation */
511 bitswap(R, L, 4, 0x0F0F0F0F), \
512 bitswap(R, L, 16, 0x0000FFFF), \
513 bitswap(L, R, 2, 0x33333333), \
514 bitswap(L, R, 8, 0x00FF00FF), \
515 bitswap(R, L, 1, 0x55555555))
517 /* Final permutation */
519 bitswap(R, L, 1, 0x55555555), \
520 bitswap(L, R, 8, 0x00FF00FF), \
521 bitswap(L, R, 2, 0x33333333), \
522 bitswap(R, L, 16, 0x0000FFFF), \
523 bitswap(R, L, 4, 0x0F0F0F0F))
525 void des_encipher(word32
*output
, word32 L
, word32 R
, DESContext
*sched
) {
526 word32 swap
, s0246
, s1357
;
533 L
^= f(R
, sched
->k0246
[ 0], sched
->k1357
[ 0]);
534 R
^= f(L
, sched
->k0246
[ 1], sched
->k1357
[ 1]);
535 L
^= f(R
, sched
->k0246
[ 2], sched
->k1357
[ 2]);
536 R
^= f(L
, sched
->k0246
[ 3], sched
->k1357
[ 3]);
537 L
^= f(R
, sched
->k0246
[ 4], sched
->k1357
[ 4]);
538 R
^= f(L
, sched
->k0246
[ 5], sched
->k1357
[ 5]);
539 L
^= f(R
, sched
->k0246
[ 6], sched
->k1357
[ 6]);
540 R
^= f(L
, sched
->k0246
[ 7], sched
->k1357
[ 7]);
541 L
^= f(R
, sched
->k0246
[ 8], sched
->k1357
[ 8]);
542 R
^= f(L
, sched
->k0246
[ 9], sched
->k1357
[ 9]);
543 L
^= f(R
, sched
->k0246
[10], sched
->k1357
[10]);
544 R
^= f(L
, sched
->k0246
[11], sched
->k1357
[11]);
545 L
^= f(R
, sched
->k0246
[12], sched
->k1357
[12]);
546 R
^= f(L
, sched
->k0246
[13], sched
->k1357
[13]);
547 L
^= f(R
, sched
->k0246
[14], sched
->k1357
[14]);
548 R
^= f(L
, sched
->k0246
[15], sched
->k1357
[15]);
553 swap
= L
; L
= R
; R
= swap
;
561 void des_decipher(word32
*output
, word32 L
, word32 R
, DESContext
*sched
) {
562 word32 swap
, s0246
, s1357
;
569 L
^= f(R
, sched
->k0246
[15], sched
->k1357
[15]);
570 R
^= f(L
, sched
->k0246
[14], sched
->k1357
[14]);
571 L
^= f(R
, sched
->k0246
[13], sched
->k1357
[13]);
572 R
^= f(L
, sched
->k0246
[12], sched
->k1357
[12]);
573 L
^= f(R
, sched
->k0246
[11], sched
->k1357
[11]);
574 R
^= f(L
, sched
->k0246
[10], sched
->k1357
[10]);
575 L
^= f(R
, sched
->k0246
[ 9], sched
->k1357
[ 9]);
576 R
^= f(L
, sched
->k0246
[ 8], sched
->k1357
[ 8]);
577 L
^= f(R
, sched
->k0246
[ 7], sched
->k1357
[ 7]);
578 R
^= f(L
, sched
->k0246
[ 6], sched
->k1357
[ 6]);
579 L
^= f(R
, sched
->k0246
[ 5], sched
->k1357
[ 5]);
580 R
^= f(L
, sched
->k0246
[ 4], sched
->k1357
[ 4]);
581 L
^= f(R
, sched
->k0246
[ 3], sched
->k1357
[ 3]);
582 R
^= f(L
, sched
->k0246
[ 2], sched
->k1357
[ 2]);
583 L
^= f(R
, sched
->k0246
[ 1], sched
->k1357
[ 1]);
584 R
^= f(L
, sched
->k0246
[ 0], sched
->k1357
[ 0]);
589 swap
= L
; L
= R
; R
= swap
;
597 #define GET_32BIT_MSB_FIRST(cp) \
598 (((unsigned long)(unsigned char)(cp)[3]) | \
599 ((unsigned long)(unsigned char)(cp)[2] << 8) | \
600 ((unsigned long)(unsigned char)(cp)[1] << 16) | \
601 ((unsigned long)(unsigned char)(cp)[0] << 24))
603 #define PUT_32BIT_MSB_FIRST(cp, value) do { \
605 (cp)[2] = (value) >> 8; \
606 (cp)[1] = (value) >> 16; \
607 (cp)[0] = (value) >> 24; } while (0)
609 static void des_cbc_encrypt(unsigned char *dest
, const unsigned char *src
,
610 unsigned int len
, DESContext
*sched
) {
611 word32 out
[2], iv0
, iv1
;
614 assert((len
& 7) == 0);
618 for (i
= 0; i
< len
; i
+= 8) {
619 iv0
^= GET_32BIT_MSB_FIRST(src
); src
+= 4;
620 iv1
^= GET_32BIT_MSB_FIRST(src
); src
+= 4;
621 des_encipher(out
, iv0
, iv1
, sched
);
624 PUT_32BIT_MSB_FIRST(dest
, iv0
); dest
+= 4;
625 PUT_32BIT_MSB_FIRST(dest
, iv1
); dest
+= 4;
631 static void des_cbc_decrypt(unsigned char *dest
, const unsigned char *src
,
632 unsigned int len
, DESContext
*sched
) {
633 word32 out
[2], iv0
, iv1
, xL
, xR
;
636 assert((len
& 7) == 0);
640 for (i
= 0; i
< len
; i
+= 8) {
641 xL
= GET_32BIT_MSB_FIRST(src
); src
+= 4;
642 xR
= GET_32BIT_MSB_FIRST(src
); src
+= 4;
643 des_decipher(out
, xL
, xR
, sched
);
646 PUT_32BIT_MSB_FIRST(dest
, iv0
); dest
+= 4;
647 PUT_32BIT_MSB_FIRST(dest
, iv1
); dest
+= 4;
655 static void des_3cbc_encrypt(unsigned char *dest
, const unsigned char *src
,
656 unsigned int len
, DESContext
*scheds
) {
657 des_cbc_encrypt(dest
, src
, len
, &scheds
[0]);
658 des_cbc_decrypt(dest
, src
, len
, &scheds
[1]);
659 des_cbc_encrypt(dest
, src
, len
, &scheds
[2]);
662 static void des_cbc3_encrypt(unsigned char *dest
, const unsigned char *src
,
663 unsigned int len
, DESContext
*scheds
) {
664 word32 out
[2], iv0
, iv1
;
667 assert((len
& 7) == 0);
671 for (i
= 0; i
< len
; i
+= 8) {
672 iv0
^= GET_32BIT_MSB_FIRST(src
); src
+= 4;
673 iv1
^= GET_32BIT_MSB_FIRST(src
); src
+= 4;
674 des_encipher(out
, iv0
, iv1
, &scheds
[0]);
675 des_decipher(out
, out
[0], out
[1], &scheds
[1]);
676 des_encipher(out
, out
[0], out
[1], &scheds
[2]);
679 PUT_32BIT_MSB_FIRST(dest
, iv0
); dest
+= 4;
680 PUT_32BIT_MSB_FIRST(dest
, iv1
); dest
+= 4;
686 static void des_3cbc_decrypt(unsigned char *dest
, const unsigned char *src
,
687 unsigned int len
, DESContext
*scheds
) {
688 des_cbc_decrypt(dest
, src
, len
, &scheds
[2]);
689 des_cbc_encrypt(dest
, src
, len
, &scheds
[1]);
690 des_cbc_decrypt(dest
, src
, len
, &scheds
[0]);
693 static void des_cbc3_decrypt(unsigned char *dest
, const unsigned char *src
,
694 unsigned int len
, DESContext
*scheds
) {
695 word32 out
[2], iv0
, iv1
, xL
, xR
;
698 assert((len
& 7) == 0);
702 for (i
= 0; i
< len
; i
+= 8) {
703 xL
= GET_32BIT_MSB_FIRST(src
); src
+= 4;
704 xR
= GET_32BIT_MSB_FIRST(src
); src
+= 4;
705 des_decipher(out
, xL
, xR
, &scheds
[2]);
706 des_encipher(out
, out
[0], out
[1], &scheds
[1]);
707 des_decipher(out
, out
[0], out
[1], &scheds
[0]);
710 PUT_32BIT_MSB_FIRST(dest
, iv0
); dest
+= 4;
711 PUT_32BIT_MSB_FIRST(dest
, iv1
); dest
+= 4;
719 static DESContext cskeys
[3], sckeys
[3];
721 static void des3_cskey(unsigned char *key
) {
722 des_key_setup(GET_32BIT_MSB_FIRST(key
),
723 GET_32BIT_MSB_FIRST(key
+4), &cskeys
[0]);
724 des_key_setup(GET_32BIT_MSB_FIRST(key
+8),
725 GET_32BIT_MSB_FIRST(key
+12), &cskeys
[1]);
726 des_key_setup(GET_32BIT_MSB_FIRST(key
+16),
727 GET_32BIT_MSB_FIRST(key
+20), &cskeys
[2]);
728 logevent("Initialised triple-DES client->server encryption");
731 static void des3_csiv(unsigned char *key
) {
732 cskeys
[0].eiv0
= GET_32BIT_MSB_FIRST(key
);
733 cskeys
[0].eiv1
= GET_32BIT_MSB_FIRST(key
+4);
736 static void des3_sciv(unsigned char *key
) {
737 sckeys
[0].div0
= GET_32BIT_MSB_FIRST(key
);
738 sckeys
[0].div1
= GET_32BIT_MSB_FIRST(key
+4);
741 static void des3_sckey(unsigned char *key
) {
742 des_key_setup(GET_32BIT_MSB_FIRST(key
),
743 GET_32BIT_MSB_FIRST(key
+4), &sckeys
[0]);
744 des_key_setup(GET_32BIT_MSB_FIRST(key
+8),
745 GET_32BIT_MSB_FIRST(key
+12), &sckeys
[1]);
746 des_key_setup(GET_32BIT_MSB_FIRST(key
+16),
747 GET_32BIT_MSB_FIRST(key
+20), &sckeys
[2]);
748 logevent("Initialised triple-DES server->client encryption");
751 static void des3_sesskey(unsigned char *key
) {
756 static void des3_encrypt_blk(unsigned char *blk
, int len
) {
757 des_3cbc_encrypt(blk
, blk
, len
, cskeys
);
760 static void des3_decrypt_blk(unsigned char *blk
, int len
) {
761 des_3cbc_decrypt(blk
, blk
, len
, sckeys
);
764 static void des3_ssh2_encrypt_blk(unsigned char *blk
, int len
) {
765 des_cbc3_encrypt(blk
, blk
, len
, cskeys
);
768 static void des3_ssh2_decrypt_blk(unsigned char *blk
, int len
) {
769 des_cbc3_decrypt(blk
, blk
, len
, sckeys
);
772 struct ssh_cipher ssh_3des_ssh2
= {
774 des3_csiv
, des3_cskey
,
775 des3_sciv
, des3_sckey
,
776 des3_ssh2_encrypt_blk
,
777 des3_ssh2_decrypt_blk
,
782 struct ssh_cipher ssh_3des
= {
784 NULL
, NULL
, NULL
, NULL
,
791 static void des_sesskey(unsigned char *key
) {
792 des_key_setup(GET_32BIT_MSB_FIRST(key
),
793 GET_32BIT_MSB_FIRST(key
+4), &cskeys
[0]);
794 logevent("Initialised single-DES encryption");
797 static void des_encrypt_blk(unsigned char *blk
, int len
) {
798 des_cbc_encrypt(blk
, blk
, len
, cskeys
);
801 static void des_decrypt_blk(unsigned char *blk
, int len
) {
802 des_cbc_decrypt(blk
, blk
, len
, cskeys
);
805 struct ssh_cipher ssh_des
= {
807 NULL
, NULL
, NULL
, NULL
, /* SSH 2 bits - unused */
810 "des-cbc", /* should never be used - not a valid cipher in ssh2 */