#! /usr/bin/python
from sys import argv
-from struct import pack
+from struct import unpack, pack
from itertools import izip
import catacomb as C
if len(tl) == w: v.append(tl); tl = EMPTY
return v, tl
+def dummygen(bc): return []
+
CUSTOM = {}
###--------------------------------------------------------------------------
(3*bc.blksz - 5,)]
###--------------------------------------------------------------------------
+### Counter mode.
+
+def ctr(E, m, c0):
+ blksz = E.__class__.blksz
+ y = C.WriteBuffer()
+ c = C.MP.loadb(c0)
+ while y.size < len(m):
+ y.put(E.encrypt(c.storeb(blksz)))
+ c += 1
+ return C.ByteString(m) ^ C.ByteString(y)[:len(m)]
+
+###--------------------------------------------------------------------------
+### GCM.
+
+def gcm_mangle(x):
+ y = C.WriteBuffer()
+ for b in x:
+ b = ord(b)
+ bb = 0
+ for i in xrange(8):
+ bb <<= 1
+ if b&1: bb |= 1
+ b >>= 1
+ y.putu8(bb)
+ return C.ByteString(y)
+
+def gcm_mul(x, y):
+ w = len(x)
+ p = poly(8*w)
+ u, v = C.GF.loadl(gcm_mangle(x)), C.GF.loadl(gcm_mangle(y))
+ z = (u*v)%p
+ return gcm_mangle(z.storel(w))
+
+def gcm_pow(x, n):
+ w = len(x)
+ p = poly(8*w)
+ u = C.GF.loadl(gcm_mangle(x))
+ z = pow(u, n, p)
+ return gcm_mangle(z.storel(w))
+
+def gcm_ctr(E, m, c0):
+ y = C.WriteBuffer()
+ pre = c0[:-4]
+ c, = unpack('>L', c0[-4:])
+ while y.size < len(m):
+ c += 1
+ y.put(E.encrypt(pre + pack('>L', c)))
+ return C.ByteString(m) ^ C.ByteString(y)[:len(m)]
+
+def g(what, x, m, a0 = None):
+ n = len(x)
+ if a0 is None: a = Z(n)
+ else: a = a0
+ i = 0
+ for b in blocks0(m, n)[0]:
+ a = gcm_mul(a ^ b, x)
+ if VERBOSE: print '%s[%d] = %s -> %s' % (what, i, hex(b), hex(a))
+ i += 1
+ return a
+
+def gcm_pad(w, x):
+ return C.ByteString(x + Z(-len(x)%w))
+
+def gcm_lens(w, a, b):
+ if w < 12: n = w
+ else: n = w/2
+ return C.ByteString(C.MP(a).storeb(n) + C.MP(b).storeb(n))
+
+def ghash(whata, whatb, x, a, b):
+ w = len(x)
+ ha = g(whata, x, gcm_pad(w, a))
+ hb = g(whatb, x, gcm_pad(w, b))
+ if a:
+ hc = gcm_mul(ha, gcm_pow(x, (len(b) + w - 1)/w)) ^ hb
+ if VERBOSE: print '%s || %s -> %s' % (whata, whatb, hex(hc))
+ else:
+ hc = hb
+ return g(whatb, x, gcm_lens(w, 8*len(a), 8*len(b)), hc)
+
+def gcmenc(E, n, h, m, tsz = None):
+ w = E.__class__.blksz
+ x = E.encrypt(Z(w))
+ if VERBOSE: print 'x = %s' % hex(x)
+ if len(n) + 4 == w: c0 = C.ByteString(n + pack('>L', 1))
+ else: c0 = ghash('?', 'n', x, EMPTY, n)
+ if VERBOSE: print 'c0 = %s' % hex(c0)
+ y = gcm_ctr(E, m, c0)
+ t = ghash('h', 'y', x, h, y) ^ E.encrypt(c0)
+ return y, t
+
+def gcmdec(E, n, h, y, t):
+ w = E.__class__.blksz
+ x = E.encrypt(Z(w))
+ if VERBOSE: print 'x = %s' % hex(x)
+ if len(n) + 4 == w: c0 = C.ByteString(n + pack('>L', 1))
+ else: c0 = ghash('?', 'n', x, EMPTY, n)
+ if VERBOSE: print 'c0 = %s' % hex(c0)
+ m = gcm_ctr(E, y, c0)
+ tt = ghash('h', 'y', x, h, y) ^ E.encrypt(c0)
+ if t == tt: return m,
+ else: return None,
+
+def gcmgen(bc):
+ return [(0, 0, 0), (1, 0, 0), (0, 1, 0), (0, 0, 1),
+ (bc.blksz, 3*bc.blksz, 3*bc.blksz),
+ (bc.blksz - 4, bc.blksz + 3, 3*bc.blksz + 9),
+ (bc.blksz - 1, 3*bc.blksz - 5, 3*bc.blksz + 5)]
+
+###--------------------------------------------------------------------------
+### EAX.
+
+def eaxenc(E, n, h, m, tsz = None):
+ if VERBOSE:
+ print 'k = %s' % hex(k)
+ print 'n = %s' % hex(n)
+ print 'h = %s' % hex(h)
+ print 'm = %s' % hex(m)
+ dump_omac(E)
+ if tsz is None: tsz = E.__class__.blksz
+ c0 = omac(E, 0, n)
+ y = ctr(E, m, c0)
+ ht = omac(E, 1, h)
+ yt = omac(E, 2, y)
+ if VERBOSE:
+ print 'c0 = %s' % hex(c0)
+ print 'ht = %s' % hex(ht)
+ print 'yt = %s' % hex(yt)
+ return y, C.ByteString((c0 ^ ht ^ yt)[:tsz])
+
+def eaxdec(E, n, h, y, t):
+ if VERBOSE:
+ print 'k = %s' % hex(k)
+ print 'n = %s' % hex(n)
+ print 'h = %s' % hex(h)
+ print 'y = %s' % hex(y)
+ print 't = %s' % hex(t)
+ dump_omac(E)
+ c0 = omac(E, 0, n)
+ m = ctr(E, y, c0)
+ ht = omac(E, 1, h)
+ yt = omac(E, 2, y)
+ if VERBOSE:
+ print 'c0 = %s' % hex(c0)
+ print 'ht = %s' % hex(ht)
+ print 'yt = %s' % hex(yt)
+ if t == (c0 ^ ht ^ yt)[:len(t)]: return m,
+ else: return None,
+
+def eaxgen(bc):
+ return [(0, 0, 0), (1, 0, 0), (0, 1, 0), (0, 0, 1),
+ (bc.blksz, 3*bc.blksz, 3*bc.blksz),
+ (bc.blksz - 1, 3*bc.blksz - 5, 3*bc.blksz + 5)]
+
+###--------------------------------------------------------------------------
### Main program.
class struct (object):
binarg = struct(mk = R.block, parse = C.bytes, show = safehex)
intarg = struct(mk = lambda x: x, parse = int, show = None)
-MODEMAP = { 'cmac': (cmacgen, [binarg], cmac) }
+MODEMAP = { 'eax-enc': (eaxgen, 3*[binarg] + [intarg], eaxenc),
+ 'eax-dec': (dummygen, 4*[binarg], eaxdec),
+ 'cmac': (cmacgen, [binarg], cmac),
+ 'gcm-enc': (gcmgen, 3*[binarg] + [intarg], gcmenc),
+ 'gcm-dec': (dummygen, 4*[binarg], gcmdec) }
mode = argv[1]
bc = None
if len(argv) == 3:
VERBOSE = False
gen, argty, func = MODEMAP[mode]
+ if mode.endswith('-enc'): mode = mode[:-4]
print '%s-%s {' % (bc.name, mode)
for ksz in keylens(bc.keysz):
for argvals in gen(bc):
gen, argty, func = MODEMAP[mode]
args = [t.parse(a) for t, a in izip(argty, argv[4:])]
rets = func(bc(k), *args)
- for r in rets: print hex(r)
+ for r in rets:
+ if r is None: print "X"
+ else: print hex(r)
###----- That's all, folks --------------------------------------------------
~mdw / catacomb / blobdiff