~mdw / sgt / putty / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Replace the type-checking COMPTR macro with my current idea of best
[sgt/putty] / sshdes.c
CommitLineData
374330e2 1#include <assert.h>
2#include "ssh.h"
3
033b4cef 4
d1e726bc 5/* des.c - implementation of DES
6 */
7
374330e2 8/*
d1e726bc 9 * Description of DES
1608bfe3 10 * ------------------
d1e726bc 11 *
12 * Unlike the description in FIPS 46, I'm going to use _sensible_ indices:
13 * bits in an n-bit word are numbered from 0 at the LSB to n-1 at the MSB.
14 * And S-boxes are indexed by six consecutive bits, not by the outer two
15 * followed by the middle four.
16 *
17 * The DES encryption routine requires a 64-bit input, and a key schedule K
18 * containing 16 48-bit elements.
19 *
20 * First the input is permuted by the initial permutation IP.
21 * Then the input is split into 32-bit words L and R. (L is the MSW.)
22 * Next, 16 rounds. In each round:
23 * (L, R) <- (R, L xor f(R, K[i]))
24 * Then the pre-output words L and R are swapped.
25 * Then L and R are glued back together into a 64-bit word. (L is the MSW,
26 * again, but since we just swapped them, the MSW is the R that came out
27 * of the last round.)
28 * The 64-bit output block is permuted by the inverse of IP and returned.
29 *
30 * Decryption is identical except that the elements of K are used in the
31 * opposite order. (This wouldn't work if that word swap didn't happen.)
32 *
33 * The function f, used in each round, accepts a 32-bit word R and a
34 * 48-bit key block K. It produces a 32-bit output.
35 *
36 * First R is expanded to 48 bits using the bit-selection function E.
37 * The resulting 48-bit block is XORed with the key block K to produce
38 * a 48-bit block X.
39 * This block X is split into eight groups of 6 bits. Each group of 6
40 * bits is then looked up in one of the eight S-boxes to convert
41 * it to 4 bits. These eight groups of 4 bits are glued back
42 * together to produce a 32-bit preoutput block.
43 * The preoutput block is permuted using the permutation P and returned.
44 *
45 * Key setup maps a 64-bit key word into a 16x48-bit key schedule. Although
46 * the approved input format for the key is a 64-bit word, eight of the
47 * bits are discarded, so the actual quantity of key used is 56 bits.
48 *
49 * First the input key is converted to two 28-bit words C and D using
50 * the bit-selection function PC1.
51 * Then 16 rounds of key setup occur. In each round, C and D are each
52 * rotated left by either 1 or 2 bits (depending on which round), and
53 * then converted into a key schedule element using the bit-selection
54 * function PC2.
55 *
56 * That's the actual algorithm. Now for the tedious details: all those
57 * painful permutations and lookup tables.
58 *
59 * IP is a 64-to-64 bit permutation. Its output contains the following
60 * bits of its input (listed in order MSB to LSB of output).
61 *
62 * 6 14 22 30 38 46 54 62 4 12 20 28 36 44 52 60
63 * 2 10 18 26 34 42 50 58 0 8 16 24 32 40 48 56
64 * 7 15 23 31 39 47 55 63 5 13 21 29 37 45 53 61
65 * 3 11 19 27 35 43 51 59 1 9 17 25 33 41 49 57
66 *
67 * E is a 32-to-48 bit selection function. Its output contains the following
68 * bits of its input (listed in order MSB to LSB of output).
69 *
70 * 0 31 30 29 28 27 28 27 26 25 24 23 24 23 22 21 20 19 20 19 18 17 16 15
71 * 16 15 14 13 12 11 12 11 10 9 8 7 8 7 6 5 4 3 4 3 2 1 0 31
72 *
73 * The S-boxes are arbitrary table-lookups each mapping a 6-bit input to a
74 * 4-bit output. In other words, each S-box is an array[64] of 4-bit numbers.
75 * The S-boxes are listed below. The first S-box listed is applied to the
76 * most significant six bits of the block X; the last one is applied to the
77 * least significant.
78 *
79 * 14 0 4 15 13 7 1 4 2 14 15 2 11 13 8 1
80 * 3 10 10 6 6 12 12 11 5 9 9 5 0 3 7 8
81 * 4 15 1 12 14 8 8 2 13 4 6 9 2 1 11 7
82 * 15 5 12 11 9 3 7 14 3 10 10 0 5 6 0 13
83 *
84 * 15 3 1 13 8 4 14 7 6 15 11 2 3 8 4 14
85 * 9 12 7 0 2 1 13 10 12 6 0 9 5 11 10 5
86 * 0 13 14 8 7 10 11 1 10 3 4 15 13 4 1 2
87 * 5 11 8 6 12 7 6 12 9 0 3 5 2 14 15 9
88 *
89 * 10 13 0 7 9 0 14 9 6 3 3 4 15 6 5 10
90 * 1 2 13 8 12 5 7 14 11 12 4 11 2 15 8 1
91 * 13 1 6 10 4 13 9 0 8 6 15 9 3 8 0 7
92 * 11 4 1 15 2 14 12 3 5 11 10 5 14 2 7 12
93 *
94 * 7 13 13 8 14 11 3 5 0 6 6 15 9 0 10 3
95 * 1 4 2 7 8 2 5 12 11 1 12 10 4 14 15 9
96 * 10 3 6 15 9 0 0 6 12 10 11 1 7 13 13 8
97 * 15 9 1 4 3 5 14 11 5 12 2 7 8 2 4 14
98 *
99 * 2 14 12 11 4 2 1 12 7 4 10 7 11 13 6 1
100 * 8 5 5 0 3 15 15 10 13 3 0 9 14 8 9 6
101 * 4 11 2 8 1 12 11 7 10 1 13 14 7 2 8 13
102 * 15 6 9 15 12 0 5 9 6 10 3 4 0 5 14 3
103 *
104 * 12 10 1 15 10 4 15 2 9 7 2 12 6 9 8 5
105 * 0 6 13 1 3 13 4 14 14 0 7 11 5 3 11 8
106 * 9 4 14 3 15 2 5 12 2 9 8 5 12 15 3 10
107 * 7 11 0 14 4 1 10 7 1 6 13 0 11 8 6 13
108 *
109 * 4 13 11 0 2 11 14 7 15 4 0 9 8 1 13 10
110 * 3 14 12 3 9 5 7 12 5 2 10 15 6 8 1 6
111 * 1 6 4 11 11 13 13 8 12 1 3 4 7 10 14 7
112 * 10 9 15 5 6 0 8 15 0 14 5 2 9 3 2 12
113 *
114 * 13 1 2 15 8 13 4 8 6 10 15 3 11 7 1 4
115 * 10 12 9 5 3 6 14 11 5 0 0 14 12 9 7 2
116 * 7 2 11 1 4 14 1 7 9 4 12 10 14 8 2 13
117 * 0 15 6 12 10 9 13 0 15 3 3 5 5 6 8 11
118 *
119 * P is a 32-to-32 bit permutation. Its output contains the following
120 * bits of its input (listed in order MSB to LSB of output).
121 *
122 * 16 25 12 11 3 20 4 15 31 17 9 6 27 14 1 22
123 * 30 24 8 18 0 5 29 23 13 19 2 26 10 21 28 7
124 *
125 * PC1 is a 64-to-56 bit selection function. Its output is in two words,
126 * C and D. The word C contains the following bits of its input (listed
127 * in order MSB to LSB of output).
128 *
129 * 7 15 23 31 39 47 55 63 6 14 22 30 38 46
130 * 54 62 5 13 21 29 37 45 53 61 4 12 20 28
131 *
132 * And the word D contains these bits.
133 *
134 * 1 9 17 25 33 41 49 57 2 10 18 26 34 42
135 * 50 58 3 11 19 27 35 43 51 59 36 44 52 60
136 *
137 * PC2 is a 56-to-48 bit selection function. Its input is in two words,
138 * C and D. These are treated as one 56-bit word (with C more significant,
139 * so that bits 55 to 28 of the word are bits 27 to 0 of C, and bits 27 to
140 * 0 of the word are bits 27 to 0 of D). The output contains the following
141 * bits of this 56-bit input word (listed in order MSB to LSB of output).
142 *
143 * 42 39 45 32 55 51 53 28 41 50 35 46 33 37 44 52 30 48 40 49 29 36 43 54
144 * 15 4 25 19 9 1 26 16 5 11 23 8 12 7 17 0 22 3 10 14 6 20 27 24
145 */
146
1608bfe3 147/*
148 * Implementation details
149 * ----------------------
150 *
151 * If you look at the code in this module, you'll find it looks
152 * nothing _like_ the above algorithm. Here I explain the
153 * differences...
154 *
155 * Key setup has not been heavily optimised here. We are not
156 * concerned with key agility: we aren't codebreakers. We don't
157 * mind a little delay (and it really is a little one; it may be a
158 * factor of five or so slower than it could be but it's still not
159 * an appreciable length of time) while setting up. The only tweaks
160 * in the key setup are ones which change the format of the key
161 * schedule to speed up the actual encryption. I'll describe those
162 * below.
163 *
164 * The first and most obvious optimisation is the S-boxes. Since
165 * each S-box always targets the same four bits in the final 32-bit
166 * word, so the output from (for example) S-box 0 must always be
167 * shifted left 28 bits, we can store the already-shifted outputs
168 * in the lookup tables. This reduces lookup-and-shift to lookup,
169 * so the S-box step is now just a question of ORing together eight
170 * table lookups.
171 *
172 * The permutation P is just a bit order change; it's invariant
173 * with respect to OR, in that P(x)|P(y) = P(x|y). Therefore, we
174 * can apply P to every entry of the S-box tables and then we don't
175 * have to do it in the code of f(). This yields a set of tables
176 * which might be called SP-boxes.
177 *
178 * The bit-selection function E is our next target. Note that E is
179 * immediately followed by the operation of splitting into 6-bit
180 * chunks. Examining the 6-bit chunks coming out of E we notice
181 * they're all contiguous within the word (speaking cyclically -
182 * the end two wrap round); so we can extract those bit strings
183 * individually rather than explicitly running E. This would yield
184 * code such as
185 *
186 * y |= SPboxes[0][ (rotl(R, 5) ^ top6bitsofK) & 0x3F ];
187 * t |= SPboxes[1][ (rotl(R,11) ^ next6bitsofK) & 0x3F ];
188 *
189 * and so on; and the key schedule preparation would have to
190 * provide each 6-bit chunk separately.
191 *
192 * Really we'd like to XOR in the key schedule element before
193 * looking up bit strings in R. This we can't do, naively, because
194 * the 6-bit strings we want overlap. But look at the strings:
195 *
196 * 3322222222221111111111
197 * bit 10987654321098765432109876543210
198 *
199 * box0 XXXXX X
200 * box1 XXXXXX
201 * box2 XXXXXX
202 * box3 XXXXXX
203 * box4 XXXXXX
204 * box5 XXXXXX
205 * box6 XXXXXX
206 * box7 X XXXXX
207 *
208 * The bit strings we need to XOR in for boxes 0, 2, 4 and 6 don't
209 * overlap with each other. Neither do the ones for boxes 1, 3, 5
210 * and 7. So we could provide the key schedule in the form of two
211 * words that we can separately XOR into R, and then every S-box
212 * index is available as a (cyclically) contiguous 6-bit substring
213 * of one or the other of the results.
214 *
215 * The comments in Eric Young's libdes implementation point out
216 * that two of these bit strings require a rotation (rather than a
217 * simple shift) to extract. It's unavoidable that at least _one_
218 * must do; but we can actually run the whole inner algorithm (all
219 * 16 rounds) rotated one bit to the left, so that what the `real'
220 * DES description sees as L=0x80000001 we see as L=0x00000003.
221 * This requires rotating all our SP-box entries one bit to the
222 * left, and rotating each word of the key schedule elements one to
223 * the left, and rotating L and R one bit left just after IP and
224 * one bit right again just before FP. And in each round we convert
225 * a rotate into a shift, so we've saved a few per cent.
226 *
227 * That's about it for the inner loop; the SP-box tables as listed
228 * below are what I've described here (the original S value,
229 * shifted to its final place in the input to P, run through P, and
230 * then rotated one bit left). All that remains is to optimise the
231 * initial permutation IP.
232 *
233 * IP is not an arbitrary permutation. It has the nice property
234 * that if you take any bit number, write it in binary (6 bits),
235 * permute those 6 bits and invert some of them, you get the final
236 * position of that bit. Specifically, the bit whose initial
237 * position is given (in binary) as fedcba ends up in position
238 * AcbFED (where a capital letter denotes the inverse of a bit).
239 *
240 * We have the 64-bit data in two 32-bit words L and R, where bits
241 * in L are those with f=1 and bits in R are those with f=0. We
242 * note that we can do a simple transformation: suppose we exchange
243 * the bits with f=1,c=0 and the bits with f=0,c=1. This will cause
244 * the bit fedcba to be in position cedfba - we've `swapped' bits c
245 * and f in the position of each bit!
246 *
247 * Better still, this transformation is easy. In the example above,
248 * bits in L with c=0 are bits 0x0F0F0F0F, and those in R with c=1
249 * are 0xF0F0F0F0. So we can do
250 *
251 * difference = ((R >> 4) ^ L) & 0x0F0F0F0F
252 * R ^= (difference << 4)
253 * L ^= difference
254 *
255 * to perform the swap. Let's denote this by bitswap(4,0x0F0F0F0F).
256 * Also, we can invert the bit at the top just by exchanging L and
257 * R. So in a few swaps and a few of these bit operations we can
258 * do:
259 *
260 * Initially the position of bit fedcba is fedcba
261 * Swap L with R to make it Fedcba
262 * Perform bitswap( 4,0x0F0F0F0F) to make it cedFba
263 * Perform bitswap(16,0x0000FFFF) to make it ecdFba
264 * Swap L with R to make it EcdFba
265 * Perform bitswap( 2,0x33333333) to make it bcdFEa
266 * Perform bitswap( 8,0x00FF00FF) to make it dcbFEa
267 * Swap L with R to make it DcbFEa
268 * Perform bitswap( 1,0x55555555) to make it acbFED
269 * Swap L with R to make it AcbFED
270 *
271 * (In the actual code the four swaps are implicit: R and L are
272 * simply used the other way round in the first, second and last
273 * bitswap operations.)
274 *
275 * The final permutation is just the inverse of IP, so it can be
276 * performed by a similar set of operations.
277 */
278
d1e726bc 279typedef struct {
280 word32 k0246[16], k1357[16];
371e569c 281 word32 iv0, iv1;
d1e726bc 282} DESContext;
374330e2 283
d1e726bc 284#define rotl(x, c) ( (x << c) | (x >> (32-c)) )
285#define rotl28(x, c) ( ( (x << c) | (x >> (28-c)) ) & 0x0FFFFFFF)
374330e2 286
32874aea 287static word32 bitsel(word32 * input, const int *bitnums, int size)
288{
d1e726bc 289 word32 ret = 0;
290 while (size--) {
32874aea 291 int bitpos = *bitnums++;
292 ret <<= 1;
293 if (bitpos >= 0)
294 ret |= 1 & (input[bitpos / 32] >> (bitpos % 32));
d1e726bc 295 }
296 return ret;
297}
374330e2 298
302845cd 299static void des_key_setup(word32 key_msw, word32 key_lsw, DESContext * sched)
32874aea 300{
d1e726bc 301
302 static const int PC1_Cbits[] = {
32874aea 303 7, 15, 23, 31, 39, 47, 55, 63, 6, 14, 22, 30, 38, 46,
304 54, 62, 5, 13, 21, 29, 37, 45, 53, 61, 4, 12, 20, 28
d1e726bc 305 };
306 static const int PC1_Dbits[] = {
32874aea 307 1, 9, 17, 25, 33, 41, 49, 57, 2, 10, 18, 26, 34, 42,
308 50, 58, 3, 11, 19, 27, 35, 43, 51, 59, 36, 44, 52, 60
d1e726bc 309 };
1608bfe3 310 /*
311 * The bit numbers in the two lists below don't correspond to
312 * the ones in the above description of PC2, because in the
313 * above description C and D are concatenated so `bit 28' means
314 * bit 0 of C. In this implementation we're using the standard
315 * `bitsel' function above and C is in the second word, so bit
316 * 0 of C is addressed by writing `32' here.
317 */
d1e726bc 318 static const int PC2_0246[] = {
32874aea 319 49, 36, 59, 55, -1, -1, 37, 41, 48, 56, 34, 52, -1, -1, 15, 4,
320 25, 19, 9, 1, -1, -1, 12, 7, 17, 0, 22, 3, -1, -1, 46, 43
d1e726bc 321 };
322 static const int PC2_1357[] = {
32874aea 323 -1, -1, 57, 32, 45, 54, 39, 50, -1, -1, 44, 53, 33, 40, 47, 58,
324 -1, -1, 26, 16, 5, 11, 23, 8, -1, -1, 10, 14, 6, 20, 27, 24
d1e726bc 325 };
32874aea 326 static const int leftshifts[] =
327 { 1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1 };
d1e726bc 328
329 word32 C, D;
330 word32 buf[2];
331 int i;
332
333 buf[0] = key_lsw;
334 buf[1] = key_msw;
335
336 C = bitsel(buf, PC1_Cbits, 28);
337 D = bitsel(buf, PC1_Dbits, 28);
338
339 for (i = 0; i < 16; i++) {
32874aea 340 C = rotl28(C, leftshifts[i]);
341 D = rotl28(D, leftshifts[i]);
342 buf[0] = D;
343 buf[1] = C;
344 sched->k0246[i] = bitsel(buf, PC2_0246, 32);
345 sched->k1357[i] = bitsel(buf, PC2_1357, 32);
d1e726bc 346 }
374330e2 347
371e569c 348 sched->iv0 = sched->iv1 = 0;
d1e726bc 349}
374330e2 350
d1e726bc 351static const word32 SPboxes[8][64] = {
352 {0x01010400, 0x00000000, 0x00010000, 0x01010404,
32874aea 353 0x01010004, 0x00010404, 0x00000004, 0x00010000,
354 0x00000400, 0x01010400, 0x01010404, 0x00000400,
355 0x01000404, 0x01010004, 0x01000000, 0x00000004,
356 0x00000404, 0x01000400, 0x01000400, 0x00010400,
357 0x00010400, 0x01010000, 0x01010000, 0x01000404,
358 0x00010004, 0x01000004, 0x01000004, 0x00010004,
359 0x00000000, 0x00000404, 0x00010404, 0x01000000,
360 0x00010000, 0x01010404, 0x00000004, 0x01010000,
361 0x01010400, 0x01000000, 0x01000000, 0x00000400,
362 0x01010004, 0x00010000, 0x00010400, 0x01000004,
363 0x00000400, 0x00000004, 0x01000404, 0x00010404,
364 0x01010404, 0x00010004, 0x01010000, 0x01000404,
365 0x01000004, 0x00000404, 0x00010404, 0x01010400,
366 0x00000404, 0x01000400, 0x01000400, 0x00000000,
367 0x00010004, 0x00010400, 0x00000000, 0x01010004L},
d1e726bc 368
369 {0x80108020, 0x80008000, 0x00008000, 0x00108020,
32874aea 370 0x00100000, 0x00000020, 0x80100020, 0x80008020,
371 0x80000020, 0x80108020, 0x80108000, 0x80000000,
372 0x80008000, 0x00100000, 0x00000020, 0x80100020,
373 0x00108000, 0x00100020, 0x80008020, 0x00000000,
374 0x80000000, 0x00008000, 0x00108020, 0x80100000,
375 0x00100020, 0x80000020, 0x00000000, 0x00108000,
376 0x00008020, 0x80108000, 0x80100000, 0x00008020,
377 0x00000000, 0x00108020, 0x80100020, 0x00100000,
378 0x80008020, 0x80100000, 0x80108000, 0x00008000,
379 0x80100000, 0x80008000, 0x00000020, 0x80108020,
380 0x00108020, 0x00000020, 0x00008000, 0x80000000,
381 0x00008020, 0x80108000, 0x00100000, 0x80000020,
382 0x00100020, 0x80008020, 0x80000020, 0x00100020,
383 0x00108000, 0x00000000, 0x80008000, 0x00008020,
384 0x80000000, 0x80100020, 0x80108020, 0x00108000L},
d1e726bc 385
386 {0x00000208, 0x08020200, 0x00000000, 0x08020008,
32874aea 387 0x08000200, 0x00000000, 0x00020208, 0x08000200,
388 0x00020008, 0x08000008, 0x08000008, 0x00020000,
389 0x08020208, 0x00020008, 0x08020000, 0x00000208,
390 0x08000000, 0x00000008, 0x08020200, 0x00000200,
391 0x00020200, 0x08020000, 0x08020008, 0x00020208,
392 0x08000208, 0x00020200, 0x00020000, 0x08000208,
393 0x00000008, 0x08020208, 0x00000200, 0x08000000,
394 0x08020200, 0x08000000, 0x00020008, 0x00000208,
395 0x00020000, 0x08020200, 0x08000200, 0x00000000,
396 0x00000200, 0x00020008, 0x08020208, 0x08000200,
397 0x08000008, 0x00000200, 0x00000000, 0x08020008,
398 0x08000208, 0x00020000, 0x08000000, 0x08020208,
399 0x00000008, 0x00020208, 0x00020200, 0x08000008,
400 0x08020000, 0x08000208, 0x00000208, 0x08020000,
401 0x00020208, 0x00000008, 0x08020008, 0x00020200L},
d1e726bc 402
403 {0x00802001, 0x00002081, 0x00002081, 0x00000080,
32874aea 404 0x00802080, 0x00800081, 0x00800001, 0x00002001,
405 0x00000000, 0x00802000, 0x00802000, 0x00802081,
406 0x00000081, 0x00000000, 0x00800080, 0x00800001,
407 0x00000001, 0x00002000, 0x00800000, 0x00802001,
408 0x00000080, 0x00800000, 0x00002001, 0x00002080,
409 0x00800081, 0x00000001, 0x00002080, 0x00800080,
410 0x00002000, 0x00802080, 0x00802081, 0x00000081,
411 0x00800080, 0x00800001, 0x00802000, 0x00802081,
412 0x00000081, 0x00000000, 0x00000000, 0x00802000,
413 0x00002080, 0x00800080, 0x00800081, 0x00000001,
414 0x00802001, 0x00002081, 0x00002081, 0x00000080,
415 0x00802081, 0x00000081, 0x00000001, 0x00002000,
416 0x00800001, 0x00002001, 0x00802080, 0x00800081,
417 0x00002001, 0x00002080, 0x00800000, 0x00802001,
418 0x00000080, 0x00800000, 0x00002000, 0x00802080L},
d1e726bc 419
420 {0x00000100, 0x02080100, 0x02080000, 0x42000100,
32874aea 421 0x00080000, 0x00000100, 0x40000000, 0x02080000,
422 0x40080100, 0x00080000, 0x02000100, 0x40080100,
423 0x42000100, 0x42080000, 0x00080100, 0x40000000,
424 0x02000000, 0x40080000, 0x40080000, 0x00000000,
425 0x40000100, 0x42080100, 0x42080100, 0x02000100,
426 0x42080000, 0x40000100, 0x00000000, 0x42000000,
427 0x02080100, 0x02000000, 0x42000000, 0x00080100,
428 0x00080000, 0x42000100, 0x00000100, 0x02000000,
429 0x40000000, 0x02080000, 0x42000100, 0x40080100,
430 0x02000100, 0x40000000, 0x42080000, 0x02080100,
431 0x40080100, 0x00000100, 0x02000000, 0x42080000,
432 0x42080100, 0x00080100, 0x42000000, 0x42080100,
433 0x02080000, 0x00000000, 0x40080000, 0x42000000,
434 0x00080100, 0x02000100, 0x40000100, 0x00080000,
435 0x00000000, 0x40080000, 0x02080100, 0x40000100L},
d1e726bc 436
437 {0x20000010, 0x20400000, 0x00004000, 0x20404010,
32874aea 438 0x20400000, 0x00000010, 0x20404010, 0x00400000,
439 0x20004000, 0x00404010, 0x00400000, 0x20000010,
440 0x00400010, 0x20004000, 0x20000000, 0x00004010,
441 0x00000000, 0x00400010, 0x20004010, 0x00004000,
442 0x00404000, 0x20004010, 0x00000010, 0x20400010,
443 0x20400010, 0x00000000, 0x00404010, 0x20404000,
444 0x00004010, 0x00404000, 0x20404000, 0x20000000,
445 0x20004000, 0x00000010, 0x20400010, 0x00404000,
446 0x20404010, 0x00400000, 0x00004010, 0x20000010,
447 0x00400000, 0x20004000, 0x20000000, 0x00004010,
448 0x20000010, 0x20404010, 0x00404000, 0x20400000,
449 0x00404010, 0x20404000, 0x00000000, 0x20400010,
450 0x00000010, 0x00004000, 0x20400000, 0x00404010,
451 0x00004000, 0x00400010, 0x20004010, 0x00000000,
452 0x20404000, 0x20000000, 0x00400010, 0x20004010L},
d1e726bc 453
454 {0x00200000, 0x04200002, 0x04000802, 0x00000000,
32874aea 455 0x00000800, 0x04000802, 0x00200802, 0x04200800,
456 0x04200802, 0x00200000, 0x00000000, 0x04000002,
457 0x00000002, 0x04000000, 0x04200002, 0x00000802,
458 0x04000800, 0x00200802, 0x00200002, 0x04000800,
459 0x04000002, 0x04200000, 0x04200800, 0x00200002,
460 0x04200000, 0x00000800, 0x00000802, 0x04200802,
461 0x00200800, 0x00000002, 0x04000000, 0x00200800,
462 0x04000000, 0x00200800, 0x00200000, 0x04000802,
463 0x04000802, 0x04200002, 0x04200002, 0x00000002,
464 0x00200002, 0x04000000, 0x04000800, 0x00200000,
465 0x04200800, 0x00000802, 0x00200802, 0x04200800,
466 0x00000802, 0x04000002, 0x04200802, 0x04200000,
467 0x00200800, 0x00000000, 0x00000002, 0x04200802,
468 0x00000000, 0x00200802, 0x04200000, 0x00000800,
469 0x04000002, 0x04000800, 0x00000800, 0x00200002L},
d1e726bc 470
471 {0x10001040, 0x00001000, 0x00040000, 0x10041040,
32874aea 472 0x10000000, 0x10001040, 0x00000040, 0x10000000,
473 0x00040040, 0x10040000, 0x10041040, 0x00041000,
474 0x10041000, 0x00041040, 0x00001000, 0x00000040,
475 0x10040000, 0x10000040, 0x10001000, 0x00001040,
476 0x00041000, 0x00040040, 0x10040040, 0x10041000,
477 0x00001040, 0x00000000, 0x00000000, 0x10040040,
478 0x10000040, 0x10001000, 0x00041040, 0x00040000,
479 0x00041040, 0x00040000, 0x10041000, 0x00001000,
480 0x00000040, 0x10040040, 0x00001000, 0x00041040,
481 0x10001000, 0x00000040, 0x10000040, 0x10040000,
482 0x10040040, 0x10000000, 0x00040000, 0x10001040,
483 0x00000000, 0x10041040, 0x00040040, 0x10000040,
484 0x10040000, 0x10001000, 0x10001040, 0x00000000,
485 0x10041040, 0x00041000, 0x00041000, 0x00001040,
486 0x00001040, 0x00040040, 0x10000000, 0x10041000L}
d1e726bc 487};
374330e2 488
d1e726bc 489#define f(R, K0246, K1357) (\
490 s0246 = R ^ K0246, \
491 s1357 = R ^ K1357, \
492 s0246 = rotl(s0246, 28), \
493 SPboxes[0] [(s0246 >> 24) & 0x3F] | \
494 SPboxes[1] [(s1357 >> 24) & 0x3F] | \
495 SPboxes[2] [(s0246 >> 16) & 0x3F] | \
496 SPboxes[3] [(s1357 >> 16) & 0x3F] | \
497 SPboxes[4] [(s0246 >> 8) & 0x3F] | \
498 SPboxes[5] [(s1357 >> 8) & 0x3F] | \
499 SPboxes[6] [(s0246 ) & 0x3F] | \
500 SPboxes[7] [(s1357 ) & 0x3F])
501
502#define bitswap(L, R, n, mask) (\
503 swap = mask & ( (R >> n) ^ L ), \
504 R ^= swap << n, \
505 L ^= swap)
506
507/* Initial permutation */
508#define IP(L, R) (\
509 bitswap(R, L, 4, 0x0F0F0F0F), \
510 bitswap(R, L, 16, 0x0000FFFF), \
511 bitswap(L, R, 2, 0x33333333), \
512 bitswap(L, R, 8, 0x00FF00FF), \
513 bitswap(R, L, 1, 0x55555555))
514
515/* Final permutation */
516#define FP(L, R) (\
517 bitswap(R, L, 1, 0x55555555), \
518 bitswap(L, R, 8, 0x00FF00FF), \
519 bitswap(L, R, 2, 0x33333333), \
520 bitswap(R, L, 16, 0x0000FFFF), \
521 bitswap(R, L, 4, 0x0F0F0F0F))
522
302845cd 523static void des_encipher(word32 * output, word32 L, word32 R,
524 DESContext * sched)
32874aea 525{
d1e726bc 526 word32 swap, s0246, s1357;
527
528 IP(L, R);
529
530 L = rotl(L, 1);
531 R = rotl(R, 1);
532
32874aea 533 L ^= f(R, sched->k0246[0], sched->k1357[0]);
534 R ^= f(L, sched->k0246[1], sched->k1357[1]);
535 L ^= f(R, sched->k0246[2], sched->k1357[2]);
536 R ^= f(L, sched->k0246[3], sched->k1357[3]);
537 L ^= f(R, sched->k0246[4], sched->k1357[4]);
538 R ^= f(L, sched->k0246[5], sched->k1357[5]);
539 L ^= f(R, sched->k0246[6], sched->k1357[6]);
540 R ^= f(L, sched->k0246[7], sched->k1357[7]);
541 L ^= f(R, sched->k0246[8], sched->k1357[8]);
542 R ^= f(L, sched->k0246[9], sched->k1357[9]);
d1e726bc 543 L ^= f(R, sched->k0246[10], sched->k1357[10]);
544 R ^= f(L, sched->k0246[11], sched->k1357[11]);
545 L ^= f(R, sched->k0246[12], sched->k1357[12]);
546 R ^= f(L, sched->k0246[13], sched->k1357[13]);
547 L ^= f(R, sched->k0246[14], sched->k1357[14]);
548 R ^= f(L, sched->k0246[15], sched->k1357[15]);
549
550 L = rotl(L, 31);
551 R = rotl(R, 31);
552
32874aea 553 swap = L;
554 L = R;
555 R = swap;
d1e726bc 556
557 FP(L, R);
558
559 output[0] = L;
560 output[1] = R;
561}
374330e2 562
302845cd 563static void des_decipher(word32 * output, word32 L, word32 R,
564 DESContext * sched)
32874aea 565{
d1e726bc 566 word32 swap, s0246, s1357;
374330e2 567
d1e726bc 568 IP(L, R);
374330e2 569
d1e726bc 570 L = rotl(L, 1);
571 R = rotl(R, 1);
374330e2 572
d1e726bc 573 L ^= f(R, sched->k0246[15], sched->k1357[15]);
574 R ^= f(L, sched->k0246[14], sched->k1357[14]);
575 L ^= f(R, sched->k0246[13], sched->k1357[13]);
576 R ^= f(L, sched->k0246[12], sched->k1357[12]);
577 L ^= f(R, sched->k0246[11], sched->k1357[11]);
578 R ^= f(L, sched->k0246[10], sched->k1357[10]);
32874aea 579 L ^= f(R, sched->k0246[9], sched->k1357[9]);
580 R ^= f(L, sched->k0246[8], sched->k1357[8]);
581 L ^= f(R, sched->k0246[7], sched->k1357[7]);
582 R ^= f(L, sched->k0246[6], sched->k1357[6]);
583 L ^= f(R, sched->k0246[5], sched->k1357[5]);
584 R ^= f(L, sched->k0246[4], sched->k1357[4]);
585 L ^= f(R, sched->k0246[3], sched->k1357[3]);
586 R ^= f(L, sched->k0246[2], sched->k1357[2]);
587 L ^= f(R, sched->k0246[1], sched->k1357[1]);
588 R ^= f(L, sched->k0246[0], sched->k1357[0]);
d1e726bc 589
590 L = rotl(L, 31);
591 R = rotl(R, 31);
592
32874aea 593 swap = L;
594 L = R;
595 R = swap;
d1e726bc 596
597 FP(L, R);
598
599 output[0] = L;
600 output[1] = R;
374330e2 601}
602
5a22e651 603static void des_cbc_encrypt(unsigned char *blk,
32874aea 604 unsigned int len, DESContext * sched)
605{
d1e726bc 606 word32 out[2], iv0, iv1;
607 unsigned int i;
608
609 assert((len & 7) == 0);
610
371e569c 611 iv0 = sched->iv0;
612 iv1 = sched->iv1;
d1e726bc 613 for (i = 0; i < len; i += 8) {
5a22e651 614 iv0 ^= GET_32BIT_MSB_FIRST(blk);
615 iv1 ^= GET_32BIT_MSB_FIRST(blk + 4);
32874aea 616 des_encipher(out, iv0, iv1, sched);
617 iv0 = out[0];
618 iv1 = out[1];
5a22e651 619 PUT_32BIT_MSB_FIRST(blk, iv0);
620 PUT_32BIT_MSB_FIRST(blk + 4, iv1);
621 blk += 8;
374330e2 622 }
371e569c 623 sched->iv0 = iv0;
624 sched->iv1 = iv1;
374330e2 625}
626
5a22e651 627static void des_cbc_decrypt(unsigned char *blk,
32874aea 628 unsigned int len, DESContext * sched)
629{
d1e726bc 630 word32 out[2], iv0, iv1, xL, xR;
631 unsigned int i;
632
633 assert((len & 7) == 0);
634
371e569c 635 iv0 = sched->iv0;
636 iv1 = sched->iv1;
d1e726bc 637 for (i = 0; i < len; i += 8) {
5a22e651 638 xL = GET_32BIT_MSB_FIRST(blk);
639 xR = GET_32BIT_MSB_FIRST(blk + 4);
32874aea 640 des_decipher(out, xL, xR, sched);
641 iv0 ^= out[0];
642 iv1 ^= out[1];
5a22e651 643 PUT_32BIT_MSB_FIRST(blk, iv0);
644 PUT_32BIT_MSB_FIRST(blk + 4, iv1);
645 blk += 8;
32874aea 646 iv0 = xL;
647 iv1 = xR;
374330e2 648 }
371e569c 649 sched->iv0 = iv0;
650 sched->iv1 = iv1;
374330e2 651}
652
5a22e651 653static void des_3cbc_encrypt(unsigned char *blk,
32874aea 654 unsigned int len, DESContext * scheds)
655{
5a22e651 656 des_cbc_encrypt(blk, len, &scheds[0]);
657 des_cbc_decrypt(blk, len, &scheds[1]);
658 des_cbc_encrypt(blk, len, &scheds[2]);
374330e2 659}
660
5a22e651 661static void des_cbc3_encrypt(unsigned char *blk,
32874aea 662 unsigned int len, DESContext * scheds)
663{
033b4cef 664 word32 out[2], iv0, iv1;
665 unsigned int i;
666
667 assert((len & 7) == 0);
668
371e569c 669 iv0 = scheds->iv0;
670 iv1 = scheds->iv1;
033b4cef 671 for (i = 0; i < len; i += 8) {
5a22e651 672 iv0 ^= GET_32BIT_MSB_FIRST(blk);
673 iv1 ^= GET_32BIT_MSB_FIRST(blk + 4);
32874aea 674 des_encipher(out, iv0, iv1, &scheds[0]);
675 des_decipher(out, out[0], out[1], &scheds[1]);
676 des_encipher(out, out[0], out[1], &scheds[2]);
677 iv0 = out[0];
678 iv1 = out[1];
5a22e651 679 PUT_32BIT_MSB_FIRST(blk, iv0);
680 PUT_32BIT_MSB_FIRST(blk + 4, iv1);
681 blk += 8;
033b4cef 682 }
371e569c 683 scheds->iv0 = iv0;
684 scheds->iv1 = iv1;
033b4cef 685}
686
5a22e651 687static void des_3cbc_decrypt(unsigned char *blk,
32874aea 688 unsigned int len, DESContext * scheds)
689{
5a22e651 690 des_cbc_decrypt(blk, len, &scheds[2]);
691 des_cbc_encrypt(blk, len, &scheds[1]);
692 des_cbc_decrypt(blk, len, &scheds[0]);
374330e2 693}
694
5a22e651 695static void des_cbc3_decrypt(unsigned char *blk,
32874aea 696 unsigned int len, DESContext * scheds)
697{
033b4cef 698 word32 out[2], iv0, iv1, xL, xR;
699 unsigned int i;
700
701 assert((len & 7) == 0);
702
371e569c 703 iv0 = scheds->iv0;
704 iv1 = scheds->iv1;
033b4cef 705 for (i = 0; i < len; i += 8) {
5a22e651 706 xL = GET_32BIT_MSB_FIRST(blk);
707 xR = GET_32BIT_MSB_FIRST(blk + 4);
32874aea 708 des_decipher(out, xL, xR, &scheds[2]);
709 des_encipher(out, out[0], out[1], &scheds[1]);
710 des_decipher(out, out[0], out[1], &scheds[0]);
711 iv0 ^= out[0];
712 iv1 ^= out[1];
5a22e651 713 PUT_32BIT_MSB_FIRST(blk, iv0);
714 PUT_32BIT_MSB_FIRST(blk + 4, iv1);
715 blk += 8;
32874aea 716 iv0 = xL;
717 iv1 = xR;
033b4cef 718 }
371e569c 719 scheds->iv0 = iv0;
720 scheds->iv1 = iv1;
033b4cef 721}
722
5a22e651 723static void des_sdctr3(unsigned char *blk,
c2e3a6c9 724 unsigned int len, DESContext * scheds)
725{
726 word32 b[2], iv0, iv1, tmp;
727 unsigned int i;
728
729 assert((len & 7) == 0);
730
731 iv0 = scheds->iv0;
732 iv1 = scheds->iv1;
733 for (i = 0; i < len; i += 8) {
6a38e311 734 des_encipher(b, iv0, iv1, &scheds[0]);
c2e3a6c9 735 des_decipher(b, b[0], b[1], &scheds[1]);
6a38e311 736 des_encipher(b, b[0], b[1], &scheds[2]);
5a22e651 737 tmp = GET_32BIT_MSB_FIRST(blk);
738 PUT_32BIT_MSB_FIRST(blk, tmp ^ b[0]);
739 blk += 4;
740 tmp = GET_32BIT_MSB_FIRST(blk);
741 PUT_32BIT_MSB_FIRST(blk, tmp ^ b[1]);
742 blk += 4;
6236e66e 743 if ((iv1 = (iv1 + 1) & 0xffffffff) == 0)
744 iv0 = (iv0 + 1) & 0xffffffff;
c2e3a6c9 745 }
746 scheds->iv0 = iv0;
747 scheds->iv1 = iv1;
748}
749
371e569c 750static void *des3_make_context(void)
751{
3d88e64d 752 return snewn(3, DESContext);
371e569c 753}
374330e2 754
371e569c 755static void *des3_ssh1_make_context(void)
32874aea 756{
2e85c969 757 /* Need 3 keys for each direction, in SSH-1 */
3d88e64d 758 return snewn(6, DESContext);
d39f364a 759}
760
371e569c 761static void *des_make_context(void)
0d7c43a6 762{
3d88e64d 763 return snew(DESContext);
0d7c43a6 764}
765
371e569c 766static void *des_ssh1_make_context(void)
32874aea 767{
2e85c969 768 /* Need one key for each direction, in SSH-1 */
3d88e64d 769 return snewn(2, DESContext);
d39f364a 770}
771
371e569c 772static void des3_free_context(void *handle) /* used for both 3DES and DES */
32874aea 773{
371e569c 774 sfree(handle);
d39f364a 775}
776
371e569c 777static void des3_key(void *handle, unsigned char *key)
32874aea 778{
371e569c 779 DESContext *keys = (DESContext *) handle;
d39f364a 780 des_key_setup(GET_32BIT_MSB_FIRST(key),
371e569c 781 GET_32BIT_MSB_FIRST(key + 4), &keys[0]);
32874aea 782 des_key_setup(GET_32BIT_MSB_FIRST(key + 8),
371e569c 783 GET_32BIT_MSB_FIRST(key + 12), &keys[1]);
32874aea 784 des_key_setup(GET_32BIT_MSB_FIRST(key + 16),
371e569c 785 GET_32BIT_MSB_FIRST(key + 20), &keys[2]);
786}
787
788static void des3_iv(void *handle, unsigned char *key)
789{
790 DESContext *keys = (DESContext *) handle;
791 keys[0].iv0 = GET_32BIT_MSB_FIRST(key);
792 keys[0].iv1 = GET_32BIT_MSB_FIRST(key + 4);
d39f364a 793}
794
371e569c 795static void des_key(void *handle, unsigned char *key)
0d7c43a6 796{
371e569c 797 DESContext *keys = (DESContext *) handle;
0d7c43a6 798 des_key_setup(GET_32BIT_MSB_FIRST(key),
371e569c 799 GET_32BIT_MSB_FIRST(key + 4), &keys[0]);
0d7c43a6 800}
801
371e569c 802static void des3_sesskey(void *handle, unsigned char *key)
32874aea 803{
371e569c 804 DESContext *keys = (DESContext *) handle;
805 des3_key(keys, key);
806 des3_key(keys+3, key);
374330e2 807}
808
371e569c 809static void des3_encrypt_blk(void *handle, unsigned char *blk, int len)
32874aea 810{
371e569c 811 DESContext *keys = (DESContext *) handle;
5a22e651 812 des_3cbc_encrypt(blk, len, keys);
374330e2 813}
814
371e569c 815static void des3_decrypt_blk(void *handle, unsigned char *blk, int len)
32874aea 816{
371e569c 817 DESContext *keys = (DESContext *) handle;
5a22e651 818 des_3cbc_decrypt(blk, len, keys+3);
374330e2 819}
820
371e569c 821static void des3_ssh2_encrypt_blk(void *handle, unsigned char *blk, int len)
32874aea 822{
371e569c 823 DESContext *keys = (DESContext *) handle;
5a22e651 824 des_cbc3_encrypt(blk, len, keys);
033b4cef 825}
826
371e569c 827static void des3_ssh2_decrypt_blk(void *handle, unsigned char *blk, int len)
32874aea 828{
371e569c 829 DESContext *keys = (DESContext *) handle;
5a22e651 830 des_cbc3_decrypt(blk, len, keys);
033b4cef 831}
832
c2e3a6c9 833static void des3_ssh2_sdctr(void *handle, unsigned char *blk, int len)
834{
835 DESContext *keys = (DESContext *) handle;
5a22e651 836 des_sdctr3(blk, len, keys);
c2e3a6c9 837}
838
371e569c 839static void des_ssh2_encrypt_blk(void *handle, unsigned char *blk, int len)
0d7c43a6 840{
371e569c 841 DESContext *keys = (DESContext *) handle;
5a22e651 842 des_cbc_encrypt(blk, len, keys);
0d7c43a6 843}
844
371e569c 845static void des_ssh2_decrypt_blk(void *handle, unsigned char *blk, int len)
0d7c43a6 846{
371e569c 847 DESContext *keys = (DESContext *) handle;
5a22e651 848 des_cbc_decrypt(blk, len, keys);
0d7c43a6 849}
850
32874aea 851void des3_decrypt_pubkey(unsigned char *key, unsigned char *blk, int len)
852{
7cca0d81 853 DESContext ourkeys[3];
854 des_key_setup(GET_32BIT_MSB_FIRST(key),
32874aea 855 GET_32BIT_MSB_FIRST(key + 4), &ourkeys[0]);
856 des_key_setup(GET_32BIT_MSB_FIRST(key + 8),
857 GET_32BIT_MSB_FIRST(key + 12), &ourkeys[1]);
7cca0d81 858 des_key_setup(GET_32BIT_MSB_FIRST(key),
32874aea 859 GET_32BIT_MSB_FIRST(key + 4), &ourkeys[2]);
5a22e651 860 des_3cbc_decrypt(blk, len, ourkeys);
dfb88efd 861 smemclr(ourkeys, sizeof(ourkeys));
7cca0d81 862}
863
32874aea 864void des3_encrypt_pubkey(unsigned char *key, unsigned char *blk, int len)
865{
6e522441 866 DESContext ourkeys[3];
867 des_key_setup(GET_32BIT_MSB_FIRST(key),
32874aea 868 GET_32BIT_MSB_FIRST(key + 4), &ourkeys[0]);
869 des_key_setup(GET_32BIT_MSB_FIRST(key + 8),
870 GET_32BIT_MSB_FIRST(key + 12), &ourkeys[1]);
6e522441 871 des_key_setup(GET_32BIT_MSB_FIRST(key),
32874aea 872 GET_32BIT_MSB_FIRST(key + 4), &ourkeys[2]);
5a22e651 873 des_3cbc_encrypt(blk, len, ourkeys);
dfb88efd 874 smemclr(ourkeys, sizeof(ourkeys));
6e522441 875}
876
9dda6459 877void des3_decrypt_pubkey_ossh(unsigned char *key, unsigned char *iv,
878 unsigned char *blk, int len)
879{
880 DESContext ourkeys[3];
881 des_key_setup(GET_32BIT_MSB_FIRST(key),
882 GET_32BIT_MSB_FIRST(key + 4), &ourkeys[0]);
883 des_key_setup(GET_32BIT_MSB_FIRST(key + 8),
884 GET_32BIT_MSB_FIRST(key + 12), &ourkeys[1]);
885 des_key_setup(GET_32BIT_MSB_FIRST(key + 16),
886 GET_32BIT_MSB_FIRST(key + 20), &ourkeys[2]);
371e569c 887 ourkeys[0].iv0 = GET_32BIT_MSB_FIRST(iv);
888 ourkeys[0].iv1 = GET_32BIT_MSB_FIRST(iv+4);
5a22e651 889 des_cbc3_decrypt(blk, len, ourkeys);
dfb88efd 890 smemclr(ourkeys, sizeof(ourkeys));
9dda6459 891}
892
893void des3_encrypt_pubkey_ossh(unsigned char *key, unsigned char *iv,
894 unsigned char *blk, int len)
895{
896 DESContext ourkeys[3];
897 des_key_setup(GET_32BIT_MSB_FIRST(key),
898 GET_32BIT_MSB_FIRST(key + 4), &ourkeys[0]);
899 des_key_setup(GET_32BIT_MSB_FIRST(key + 8),
900 GET_32BIT_MSB_FIRST(key + 12), &ourkeys[1]);
901 des_key_setup(GET_32BIT_MSB_FIRST(key + 16),
902 GET_32BIT_MSB_FIRST(key + 20), &ourkeys[2]);
371e569c 903 ourkeys[0].iv0 = GET_32BIT_MSB_FIRST(iv);
904 ourkeys[0].iv1 = GET_32BIT_MSB_FIRST(iv+4);
5a22e651 905 des_cbc3_encrypt(blk, len, ourkeys);
dfb88efd 906 smemclr(ourkeys, sizeof(ourkeys));
9dda6459 907}
908
b3ebaa28 909static void des_keysetup_xdmauth(unsigned char *keydata, DESContext *dc)
2f92b717 910{
911 unsigned char key[8];
2f92b717 912 int i, nbits, j;
913 unsigned int bits;
914
915 bits = 0;
916 nbits = 0;
917 j = 0;
918 for (i = 0; i < 8; i++) {
919 if (nbits < 7) {
920 bits = (bits << 8) | keydata[j];
921 nbits += 8;
922 j++;
923 }
924 key[i] = (bits >> (nbits - 7)) << 1;
925 bits &= ~(0x7F << (nbits - 7));
926 nbits -= 7;
927 }
928
b3ebaa28 929 des_key_setup(GET_32BIT_MSB_FIRST(key), GET_32BIT_MSB_FIRST(key + 4), dc);
930}
931
932void des_encrypt_xdmauth(unsigned char *keydata, unsigned char *blk, int len)
933{
934 DESContext dc;
935 des_keysetup_xdmauth(keydata, &dc);
5a22e651 936 des_cbc_encrypt(blk, 24, &dc);
2f92b717 937}
938
b3ebaa28 939void des_decrypt_xdmauth(unsigned char *keydata, unsigned char *blk, int len)
940{
941 DESContext dc;
942 des_keysetup_xdmauth(keydata, &dc);
5a22e651 943 des_cbc_decrypt(blk, 24, &dc);
b3ebaa28 944}
945
65a22376 946static const struct ssh2_cipher ssh_3des_ssh2 = {
371e569c 947 des3_make_context, des3_free_context, des3_iv, des3_key,
948 des3_ssh2_encrypt_blk, des3_ssh2_decrypt_blk,
033b4cef 949 "3des-cbc",
97ab28d7 950 8, 168, SSH_CIPHER_IS_CBC, "triple-DES CBC"
c2e3a6c9 951};
952
953static const struct ssh2_cipher ssh_3des_ssh2_ctr = {
954 des3_make_context, des3_free_context, des3_iv, des3_key,
955 des3_ssh2_sdctr, des3_ssh2_sdctr,
956 "3des-ctr",
97ab28d7 957 8, 168, 0, "triple-DES SDCTR"
033b4cef 958};
959
0d7c43a6 960/*
2e85c969 961 * Single DES in SSH-2. "des-cbc" is marked as HISTORIC in
bccbeb71 962 * RFC 4250, referring to
8f161275 963 * FIPS-46-3. ("Single DES (i.e., DES) will be permitted
964 * for legacy systems only.") , but ssh.com support it and
965 * apparently aren't the only people to do so, so we sigh
966 * and implement it anyway.
0d7c43a6 967 */
968static const struct ssh2_cipher ssh_des_ssh2 = {
68a49acb 969 des_make_context, des3_free_context, des3_iv, des_key,
371e569c 970 des_ssh2_encrypt_blk, des_ssh2_decrypt_blk,
0d7c43a6 971 "des-cbc",
97ab28d7 972 8, 56, SSH_CIPHER_IS_CBC, "single-DES CBC"
0d7c43a6 973};
974
b88667cd 975static const struct ssh2_cipher ssh_des_sshcom_ssh2 = {
976 des_make_context, des3_free_context, des3_iv, des_key,
977 des_ssh2_encrypt_blk, des_ssh2_decrypt_blk,
978 "des-cbc@ssh.com",
97ab28d7 979 8, 56, SSH_CIPHER_IS_CBC, "single-DES CBC"
b88667cd 980};
981
65a22376 982static const struct ssh2_cipher *const des3_list[] = {
8d49ffb3 983 &ssh_3des_ssh2_ctr,
0a3f1d48 984 &ssh_3des_ssh2
985};
986
65a22376 987const struct ssh2_ciphers ssh2_3des = {
0a3f1d48 988 sizeof(des3_list) / sizeof(*des3_list),
989 des3_list
990};
991
0d7c43a6 992static const struct ssh2_cipher *const des_list[] = {
b88667cd 993 &ssh_des_ssh2,
994 &ssh_des_sshcom_ssh2
0d7c43a6 995};
996
997const struct ssh2_ciphers ssh2_des = {
b88667cd 998 sizeof(des_list) / sizeof(*des_list),
0d7c43a6 999 des_list
1000};
1001
65a22376 1002const struct ssh_cipher ssh_3des = {
371e569c 1003 des3_ssh1_make_context, des3_free_context, des3_sesskey,
1004 des3_encrypt_blk, des3_decrypt_blk,
c2e3a6c9 1005 8, "triple-DES inner-CBC"
374330e2 1006};
1007
371e569c 1008static void des_sesskey(void *handle, unsigned char *key)
32874aea 1009{
371e569c 1010 DESContext *keys = (DESContext *) handle;
1011 des_key(keys, key);
1012 des_key(keys+1, key);
9697bfd2 1013}
1014
371e569c 1015static void des_encrypt_blk(void *handle, unsigned char *blk, int len)
32874aea 1016{
371e569c 1017 DESContext *keys = (DESContext *) handle;
5a22e651 1018 des_cbc_encrypt(blk, len, keys);
9697bfd2 1019}
1020
371e569c 1021static void des_decrypt_blk(void *handle, unsigned char *blk, int len)
32874aea 1022{
371e569c 1023 DESContext *keys = (DESContext *) handle;
5a22e651 1024 des_cbc_decrypt(blk, len, keys+1);
9697bfd2 1025}
1026
65a22376 1027const struct ssh_cipher ssh_des = {
371e569c 1028 des_ssh1_make_context, des3_free_context, des_sesskey,
1029 des_encrypt_blk, des_decrypt_blk,
c2e3a6c9 1030 8, "single-DES CBC"
9697bfd2 1031};
Simon Tatham's PuTTY GUI SSH client; import of svn://svn.tartarus.org/sgt/putty