| 1 | /* -*-c-*- |
| 2 | * |
| 3 | * The CAST-128 block cipher |
| 4 | * |
| 5 | * (c) 2000 Straylight/Edgeware |
| 6 | */ |
| 7 | |
| 8 | /*----- Licensing notice --------------------------------------------------* |
| 9 | * |
| 10 | * This file is part of Catacomb. |
| 11 | * |
| 12 | * Catacomb is free software; you can redistribute it and/or modify |
| 13 | * it under the terms of the GNU Library General Public License as |
| 14 | * published by the Free Software Foundation; either version 2 of the |
| 15 | * License, or (at your option) any later version. |
| 16 | * |
| 17 | * Catacomb is distributed in the hope that it will be useful, |
| 18 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 19 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 20 | * GNU Library General Public License for more details. |
| 21 | * |
| 22 | * You should have received a copy of the GNU Library General Public |
| 23 | * License along with Catacomb; if not, write to the Free |
| 24 | * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, |
| 25 | * MA 02111-1307, USA. |
| 26 | */ |
| 27 | |
| 28 | /*----- Header files ------------------------------------------------------*/ |
| 29 | |
| 30 | #include <assert.h> |
| 31 | #include <stdio.h> |
| 32 | #include <stdlib.h> |
| 33 | #include <string.h> |
| 34 | |
| 35 | #include <mLib/bits.h> |
| 36 | |
| 37 | #include "blkc.h" |
| 38 | #include "cast-base.h" |
| 39 | #include "cast128.h" |
| 40 | #include "gcipher.h" |
| 41 | #include "paranoia.h" |
| 42 | |
| 43 | /*----- Global variables --------------------------------------------------*/ |
| 44 | |
| 45 | const octet cast128_keysz[] = { KSZ_RANGE, CAST128_KEYSZ, 0, 16, 1 }; |
| 46 | |
| 47 | /*----- Main code ---------------------------------------------------------*/ |
| 48 | |
| 49 | /* --- @cast128_init@ --- * |
| 50 | * |
| 51 | * Arguments: @cast128_ctx *k@ = pointer to key block to fill in |
| 52 | * @const void *buf@ = pointer to buffer of key material |
| 53 | * @size_t sz@ = size of key material |
| 54 | * |
| 55 | * Returns: --- |
| 56 | * |
| 57 | * Use: Initializes a CAST-128 key buffer. CAST-128 accepts |
| 58 | * 128-bit keys or shorter. |
| 59 | */ |
| 60 | |
| 61 | void cast128_init(cast128_ctx *k, const void *buf, size_t sz) |
| 62 | { |
| 63 | const octet *p = buf; |
| 64 | uint32 kk[4]; |
| 65 | unsigned i; |
| 66 | uint32 a, b, c, d, aa, bb, cc, dd; |
| 67 | |
| 68 | /* --- Fiddle with the key size a bit --- */ |
| 69 | |
| 70 | KSZ_ASSERT(cast128, sz); |
| 71 | |
| 72 | if (sz > 10) |
| 73 | k->r = 16; |
| 74 | else |
| 75 | k->r = 12; |
| 76 | |
| 77 | /* --- Read the key into the array --- */ |
| 78 | |
| 79 | i = 0; |
| 80 | b = 32; aa = 0; |
| 81 | for (;;) { |
| 82 | if (!sz) |
| 83 | break; |
| 84 | b -= 8; |
| 85 | aa |= ((uint32)*p++ << b); |
| 86 | sz--; |
| 87 | if (b == 0) { |
| 88 | kk[i++] = aa; |
| 89 | if (i == 4) |
| 90 | break; |
| 91 | aa = 0; |
| 92 | b = 32; |
| 93 | } |
| 94 | } |
| 95 | |
| 96 | for (; i < 4; i++) { |
| 97 | kk[i] = aa; |
| 98 | aa = 0; |
| 99 | } |
| 100 | |
| 101 | /* --- Read the key words out --- */ |
| 102 | |
| 103 | a = kk[0]; b = kk[1]; c = kk[2]; d = kk[3]; |
| 104 | |
| 105 | #define X_0123 a |
| 106 | #define X_4567 b |
| 107 | #define X_89ab c |
| 108 | #define X_cdef d |
| 109 | |
| 110 | #define X_0 U8(X_0123 >> 24) |
| 111 | #define X_1 U8(X_0123 >> 16) |
| 112 | #define X_2 U8(X_0123 >> 8) |
| 113 | #define X_3 U8(X_0123 >> 0) |
| 114 | #define X_4 U8(X_4567 >> 24) |
| 115 | #define X_5 U8(X_4567 >> 16) |
| 116 | #define X_6 U8(X_4567 >> 8) |
| 117 | #define X_7 U8(X_4567 >> 0) |
| 118 | #define X_8 U8(X_89ab >> 24) |
| 119 | #define X_9 U8(X_89ab >> 16) |
| 120 | #define X_a U8(X_89ab >> 8) |
| 121 | #define X_b U8(X_89ab >> 0) |
| 122 | #define X_c U8(X_cdef >> 24) |
| 123 | #define X_d U8(X_cdef >> 16) |
| 124 | #define X_e U8(X_cdef >> 8) |
| 125 | #define X_f U8(X_cdef >> 0) |
| 126 | |
| 127 | #define Z_0123 aa |
| 128 | #define Z_4567 bb |
| 129 | #define Z_89ab cc |
| 130 | #define Z_cdef dd |
| 131 | |
| 132 | #define Z_0 U8(Z_0123 >> 24) |
| 133 | #define Z_1 U8(Z_0123 >> 16) |
| 134 | #define Z_2 U8(Z_0123 >> 8) |
| 135 | #define Z_3 U8(Z_0123 >> 0) |
| 136 | #define Z_4 U8(Z_4567 >> 24) |
| 137 | #define Z_5 U8(Z_4567 >> 16) |
| 138 | #define Z_6 U8(Z_4567 >> 8) |
| 139 | #define Z_7 U8(Z_4567 >> 0) |
| 140 | #define Z_8 U8(Z_89ab >> 24) |
| 141 | #define Z_9 U8(Z_89ab >> 16) |
| 142 | #define Z_a U8(Z_89ab >> 8) |
| 143 | #define Z_b U8(Z_89ab >> 0) |
| 144 | #define Z_c U8(Z_cdef >> 24) |
| 145 | #define Z_d U8(Z_cdef >> 16) |
| 146 | #define Z_e U8(Z_cdef >> 8) |
| 147 | #define Z_f U8(Z_cdef >> 0) |
| 148 | |
| 149 | #define SK(w, x, y, z) \ |
| 150 | cast_sk[0][w] ^ cast_sk[1][x] ^ cast_sk[2][y] ^ cast_sk[3][z] |
| 151 | |
| 152 | i = 0; |
| 153 | Z_0123 = X_0123 ^ SK(X_d, X_f, X_c, X_e) ^ cast_sk[2][X_8]; |
| 154 | Z_4567 = X_89ab ^ SK(Z_0, Z_2, Z_1, Z_3) ^ cast_sk[3][X_a]; |
| 155 | Z_89ab = X_cdef ^ SK(Z_7, Z_6, Z_5, Z_4) ^ cast_sk[0][X_9]; |
| 156 | Z_cdef = X_4567 ^ SK(Z_a, Z_9, Z_b, Z_8) ^ cast_sk[1][X_b]; |
| 157 | k->km[i++] = SK(Z_8, Z_9, Z_7, Z_6) ^ cast_sk[0][Z_2]; |
| 158 | k->km[i++] = SK(Z_a, Z_b, Z_5, Z_4) ^ cast_sk[1][Z_6]; |
| 159 | k->km[i++] = SK(Z_c, Z_d, Z_3, Z_2) ^ cast_sk[2][Z_9]; |
| 160 | k->km[i++] = SK(Z_e, Z_f, Z_1, Z_0) ^ cast_sk[3][Z_c]; |
| 161 | X_0123 = Z_89ab ^ SK(Z_5, Z_7, Z_4, Z_6) ^ cast_sk[2][Z_0]; |
| 162 | X_4567 = Z_0123 ^ SK(X_0, X_2, X_1, X_3) ^ cast_sk[3][Z_2]; |
| 163 | X_89ab = Z_4567 ^ SK(X_7, X_6, X_5, X_4) ^ cast_sk[0][Z_1]; |
| 164 | X_cdef = Z_cdef ^ SK(X_a, X_9, X_b, X_8) ^ cast_sk[1][Z_3]; |
| 165 | k->km[i++] = SK(X_3, X_2, X_c, X_d) ^ cast_sk[0][X_8]; |
| 166 | k->km[i++] = SK(X_1, X_0, X_e, X_f) ^ cast_sk[1][X_d]; |
| 167 | k->km[i++] = SK(X_7, X_6, X_8, X_9) ^ cast_sk[2][X_3]; |
| 168 | k->km[i++] = SK(X_5, X_4, X_a, X_b) ^ cast_sk[3][X_7]; |
| 169 | Z_0123 = X_0123 ^ SK(X_d, X_f, X_c, X_e) ^ cast_sk[2][X_8]; |
| 170 | Z_4567 = X_89ab ^ SK(Z_0, Z_2, Z_1, Z_3) ^ cast_sk[3][X_a]; |
| 171 | Z_89ab = X_cdef ^ SK(Z_7, Z_6, Z_5, Z_4) ^ cast_sk[0][X_9]; |
| 172 | Z_cdef = X_4567 ^ SK(Z_a, Z_9, Z_b, Z_8) ^ cast_sk[1][X_b]; |
| 173 | k->km[i++] = SK(Z_3, Z_2, Z_c, Z_d) ^ cast_sk[0][Z_9]; |
| 174 | k->km[i++] = SK(Z_1, Z_0, Z_e, Z_f) ^ cast_sk[1][Z_c]; |
| 175 | k->km[i++] = SK(Z_7, Z_6, Z_8, Z_9) ^ cast_sk[2][Z_2]; |
| 176 | k->km[i++] = SK(Z_5, Z_4, Z_a, Z_b) ^ cast_sk[3][Z_6]; |
| 177 | X_0123 = Z_89ab ^ SK(Z_5, Z_7, Z_4, Z_6) ^ cast_sk[2][Z_0]; |
| 178 | X_4567 = Z_0123 ^ SK(X_0, X_2, X_1, X_3) ^ cast_sk[3][Z_2]; |
| 179 | X_89ab = Z_4567 ^ SK(X_7, X_6, X_5, X_4) ^ cast_sk[0][Z_1]; |
| 180 | X_cdef = Z_cdef ^ SK(X_a, X_9, X_b, X_8) ^ cast_sk[1][Z_3]; |
| 181 | k->km[i++] = SK(X_8, X_9, X_7, X_6) ^ cast_sk[0][X_3]; |
| 182 | k->km[i++] = SK(X_a, X_b, X_5, X_4) ^ cast_sk[1][X_7]; |
| 183 | k->km[i++] = SK(X_c, X_d, X_3, X_2) ^ cast_sk[2][X_8]; |
| 184 | k->km[i++] = SK(X_e, X_f, X_1, X_0) ^ cast_sk[3][X_d]; |
| 185 | |
| 186 | i = 0; |
| 187 | Z_0123 = X_0123 ^ SK(X_d, X_f, X_c, X_e) ^ cast_sk[2][X_8]; |
| 188 | Z_4567 = X_89ab ^ SK(Z_0, Z_2, Z_1, Z_3) ^ cast_sk[3][X_a]; |
| 189 | Z_89ab = X_cdef ^ SK(Z_7, Z_6, Z_5, Z_4) ^ cast_sk[0][X_9]; |
| 190 | Z_cdef = X_4567 ^ SK(Z_a, Z_9, Z_b, Z_8) ^ cast_sk[1][X_b]; |
| 191 | k->kr[i++] = (SK(Z_8, Z_9, Z_7, Z_6) ^ cast_sk[0][Z_2]) & 0x1f; |
| 192 | k->kr[i++] = (SK(Z_a, Z_b, Z_5, Z_4) ^ cast_sk[1][Z_6]) & 0x1f; |
| 193 | k->kr[i++] = (SK(Z_c, Z_d, Z_3, Z_2) ^ cast_sk[2][Z_9]) & 0x1f; |
| 194 | k->kr[i++] = (SK(Z_e, Z_f, Z_1, Z_0) ^ cast_sk[3][Z_c]) & 0x1f; |
| 195 | X_0123 = Z_89ab ^ SK(Z_5, Z_7, Z_4, Z_6) ^ cast_sk[2][Z_0]; |
| 196 | X_4567 = Z_0123 ^ SK(X_0, X_2, X_1, X_3) ^ cast_sk[3][Z_2]; |
| 197 | X_89ab = Z_4567 ^ SK(X_7, X_6, X_5, X_4) ^ cast_sk[0][Z_1]; |
| 198 | X_cdef = Z_cdef ^ SK(X_a, X_9, X_b, X_8) ^ cast_sk[1][Z_3]; |
| 199 | k->kr[i++] = (SK(X_3, X_2, X_c, X_d) ^ cast_sk[0][X_8]) & 0x1f; |
| 200 | k->kr[i++] = (SK(X_1, X_0, X_e, X_f) ^ cast_sk[1][X_d]) & 0x1f; |
| 201 | k->kr[i++] = (SK(X_7, X_6, X_8, X_9) ^ cast_sk[2][X_3]) & 0x1f; |
| 202 | k->kr[i++] = (SK(X_5, X_4, X_a, X_b) ^ cast_sk[3][X_7]) & 0x1f; |
| 203 | Z_0123 = X_0123 ^ SK(X_d, X_f, X_c, X_e) ^ cast_sk[2][X_8]; |
| 204 | Z_4567 = X_89ab ^ SK(Z_0, Z_2, Z_1, Z_3) ^ cast_sk[3][X_a]; |
| 205 | Z_89ab = X_cdef ^ SK(Z_7, Z_6, Z_5, Z_4) ^ cast_sk[0][X_9]; |
| 206 | Z_cdef = X_4567 ^ SK(Z_a, Z_9, Z_b, Z_8) ^ cast_sk[1][X_b]; |
| 207 | k->kr[i++] = (SK(Z_3, Z_2, Z_c, Z_d) ^ cast_sk[0][Z_9]) & 0x1f; |
| 208 | k->kr[i++] = (SK(Z_1, Z_0, Z_e, Z_f) ^ cast_sk[1][Z_c]) & 0x1f; |
| 209 | k->kr[i++] = (SK(Z_7, Z_6, Z_8, Z_9) ^ cast_sk[2][Z_2]) & 0x1f; |
| 210 | k->kr[i++] = (SK(Z_5, Z_4, Z_a, Z_b) ^ cast_sk[3][Z_6]) & 0x1f; |
| 211 | X_0123 = Z_89ab ^ SK(Z_5, Z_7, Z_4, Z_6) ^ cast_sk[2][Z_0]; |
| 212 | X_4567 = Z_0123 ^ SK(X_0, X_2, X_1, X_3) ^ cast_sk[3][Z_2]; |
| 213 | X_89ab = Z_4567 ^ SK(X_7, X_6, X_5, X_4) ^ cast_sk[0][Z_1]; |
| 214 | X_cdef = Z_cdef ^ SK(X_a, X_9, X_b, X_8) ^ cast_sk[1][Z_3]; |
| 215 | k->kr[i++] = (SK(X_8, X_9, X_7, X_6) ^ cast_sk[0][X_3]) & 0x1f; |
| 216 | k->kr[i++] = (SK(X_a, X_b, X_5, X_4) ^ cast_sk[1][X_7]) & 0x1f; |
| 217 | k->kr[i++] = (SK(X_c, X_d, X_3, X_2) ^ cast_sk[2][X_8]) & 0x1f; |
| 218 | k->kr[i++] = (SK(X_e, X_f, X_1, X_0) ^ cast_sk[3][X_d]) & 0x1f; |
| 219 | |
| 220 | BURN(kk); |
| 221 | } |
| 222 | |
| 223 | /* --- @cast128_eblk@, @cast128_dblk@ --- * |
| 224 | * |
| 225 | * Arguments: @const cast128_ctx *k@ = pointer to key block |
| 226 | * @const uint32 s[2]@ = pointer to source block |
| 227 | * @uint32 d[2]@ = pointer to destination block |
| 228 | * |
| 229 | * Returns: --- |
| 230 | * |
| 231 | * Use: Low-level block encryption and decryption. |
| 232 | */ |
| 233 | |
| 234 | void cast128_eblk(const cast128_ctx *k, const uint32 *s, uint32 *d) |
| 235 | { |
| 236 | uint32 a = s[0], b = s[1]; |
| 237 | const uint32 *km = k->km; |
| 238 | const octet *kr = k->kr; |
| 239 | |
| 240 | switch (k->r) { |
| 241 | default: |
| 242 | CAST_R1(*km++, *kr++, a, b); |
| 243 | CAST_R2(*km++, *kr++, b, a); |
| 244 | CAST_R3(*km++, *kr++, a, b); |
| 245 | CAST_R1(*km++, *kr++, b, a); |
| 246 | CAST_R2(*km++, *kr++, a, b); |
| 247 | CAST_R3(*km++, *kr++, b, a); |
| 248 | CAST_R1(*km++, *kr++, a, b); |
| 249 | CAST_R2(*km++, *kr++, b, a); |
| 250 | CAST_R3(*km++, *kr++, a, b); |
| 251 | CAST_R1(*km++, *kr++, b, a); |
| 252 | CAST_R2(*km++, *kr++, a, b); |
| 253 | CAST_R3(*km++, *kr++, b, a); |
| 254 | if (k->r == 12) |
| 255 | break; |
| 256 | CAST_R1(*km++, *kr++, a, b); |
| 257 | CAST_R2(*km++, *kr++, b, a); |
| 258 | CAST_R3(*km++, *kr++, a, b); |
| 259 | CAST_R1(*km++, *kr++, b, a); |
| 260 | break; |
| 261 | } |
| 262 | |
| 263 | d[0] = b; d[1] = a; |
| 264 | } |
| 265 | |
| 266 | void cast128_dblk(const cast128_ctx *k, const uint32 *s, uint32 *d) |
| 267 | { |
| 268 | uint32 a = s[0], b = s[1]; |
| 269 | const uint32 *km = k->km + k->r; |
| 270 | const octet *kr = k->kr + k->r; |
| 271 | |
| 272 | switch (k->r) { |
| 273 | case 16: |
| 274 | default: |
| 275 | CAST_R1(*--km, *--kr, a, b); |
| 276 | CAST_R3(*--km, *--kr, b, a); |
| 277 | CAST_R2(*--km, *--kr, a, b); |
| 278 | CAST_R1(*--km, *--kr, b, a); |
| 279 | case 12: |
| 280 | CAST_R3(*--km, *--kr, a, b); |
| 281 | CAST_R2(*--km, *--kr, b, a); |
| 282 | CAST_R1(*--km, *--kr, a, b); |
| 283 | CAST_R3(*--km, *--kr, b, a); |
| 284 | CAST_R2(*--km, *--kr, a, b); |
| 285 | CAST_R1(*--km, *--kr, b, a); |
| 286 | CAST_R3(*--km, *--kr, a, b); |
| 287 | CAST_R2(*--km, *--kr, b, a); |
| 288 | CAST_R1(*--km, *--kr, a, b); |
| 289 | CAST_R3(*--km, *--kr, b, a); |
| 290 | CAST_R2(*--km, *--kr, a, b); |
| 291 | CAST_R1(*--km, *--kr, b, a); |
| 292 | break; |
| 293 | } |
| 294 | |
| 295 | d[0] = b; d[1] = a; |
| 296 | } |
| 297 | |
| 298 | BLKC_TEST(CAST128, cast128) |
| 299 | |
| 300 | /*----- That's all, folks -------------------------------------------------*/ |