git.samba.org - gd/nettle/blob - cast128.c

   1 /* cast128.c
   2
   3    The CAST-128 block cipher, described in RFC 2144.
   4
   5    Copyright (C) 2001, 2014 Niels Möller
   6
   7    This file is part of GNU Nettle.
   8
   9    GNU Nettle is free software: you can redistribute it and/or
  10    modify it under the terms of either:
  11
  12      * the GNU Lesser General Public License as published by the Free
  13        Software Foundation; either version 3 of the License, or (at your
  14        option) any later version.
  15
  16    or
  17
  18      * the GNU General Public License as published by the Free
  19        Software Foundation; either version 2 of the License, or (at your
  20        option) any later version.
  21
  22    or both in parallel, as here.
  23
  24    GNU Nettle is distributed in the hope that it will be useful,
  25    but WITHOUT ANY WARRANTY; without even the implied warranty of
  26    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  27    General Public License for more details.
  28
  29    You should have received copies of the GNU General Public License and
  30    the GNU Lesser General Public License along with this program.  If
  31    not, see http://www.gnu.org/licenses/.
  32 */
  33
  34 /* Based on:
  35  *
  36  *      CAST-128 in C
  37  *      Written by Steve Reid <sreid@sea-to-sky.net>
  38  *      100% Public Domain - no warranty
  39  *      Released 1997.10.11
  40  */
  41
  42 #if HAVE_CONFIG_H
  43 # include "config.h"
  44 #endif
  45
  46 #include <assert.h>
  47 #include <stdlib.h>
  48 #include <string.h>
  49
  50 #include "cast128.h"
  51 #include "cast128_sboxes.h"
  52
  53 #include "macros.h"
  54
  55 #define CAST_SMALL_KEY 10
  56
  57 #define S1 cast_sbox1
  58 #define S2 cast_sbox2
  59 #define S3 cast_sbox3
  60 #define S4 cast_sbox4
  61 #define S5 cast_sbox5
  62 #define S6 cast_sbox6
  63 #define S7 cast_sbox7
  64 #define S8 cast_sbox8
  65
  66 /* Macros to access 8-bit bytes out of a 32-bit word */
  67 #define B0(x) ( (uint8_t) (x>>24) )
  68 #define B1(x) ( (uint8_t) ((x>>16)&0xff) )
  69 #define B2(x) ( (uint8_t) ((x>>8)&0xff) )
  70 #define B3(x) ( (uint8_t) ((x)&0xff) )
  71
  72 /* NOTE: Depends on ROTL32 supporting a zero shift count. */
  73
  74 /* CAST-128 uses three different round functions */
  75 #define F1(l, r, i) do {                                        \
  76     t = ctx->Km[i] + r;                                         \
  77     t = ROTL32(ctx->Kr[i], t);                                  \
  78     l ^= ((S1[B0(t)] ^ S2[B1(t)]) - S3[B2(t)]) + S4[B3(t)];     \
  79   } while (0)
  80 #define F2(l, r, i) do {                                        \
  81     t = ctx->Km[i] ^ r;                                         \
  82     t = ROTL32( ctx->Kr[i], t);                                 \
  83     l ^= ((S1[B0(t)] - S2[B1(t)]) + S3[B2(t)]) ^ S4[B3(t)];     \
  84   } while (0)
  85 #define F3(l, r, i) do {                                        \
  86     t = ctx->Km[i] - r;                                         \
  87     t = ROTL32(ctx->Kr[i], t);                                  \
  88     l ^= ((S1[B0(t)] + S2[B1(t)]) ^ S3[B2(t)]) - S4[B3(t)];     \
  89   } while (0)
  90
  91
  92 /***** Encryption Function *****/
  93
  94 void
  95 cast128_encrypt(const struct cast128_ctx *ctx,
  96                 size_t length, uint8_t *dst,
  97                 const uint8_t *src)
  98 {
  99   FOR_BLOCKS(length, dst, src, CAST128_BLOCK_SIZE)
 100     {
 101       uint32_t t, l, r;
 102
 103       /* Get inblock into l,r */
 104       l = READ_UINT32(src);
 105       r = READ_UINT32(src+4);
 106
 107       /* Do the work */
 108       F1(l, r,  0);
 109       F2(r, l,  1);
 110       F3(l, r,  2);
 111       F1(r, l,  3);
 112       F2(l, r,  4);
 113       F3(r, l,  5);
 114       F1(l, r,  6);
 115       F2(r, l,  7);
 116       F3(l, r,  8);
 117       F1(r, l,  9);
 118       F2(l, r, 10);
 119       F3(r, l, 11);
 120       /* Only do full 16 rounds if key length > 80 bits */
 121       if (ctx->rounds & 16) {
 122         F1(l, r, 12);
 123         F2(r, l, 13);
 124         F3(l, r, 14);
 125         F1(r, l, 15);
 126       }
 127       /* Put l,r into outblock */
 128       WRITE_UINT32(dst, r);
 129       WRITE_UINT32(dst + 4, l);
 130     }
 131 }
 132
 133
 134 /***** Decryption Function *****/
 135
 136 void
 137 cast128_decrypt(const struct cast128_ctx *ctx,
 138                 size_t length, uint8_t *dst,
 139                 const uint8_t *src)
 140 {
 141   FOR_BLOCKS(length, dst, src, CAST128_BLOCK_SIZE)
 142     {
 143       uint32_t t, l, r;
 144
 145       /* Get inblock into l,r */
 146       r = READ_UINT32(src);
 147       l = READ_UINT32(src+4);
 148
 149       /* Do the work */
 150       /* Only do full 16 rounds if key length > 80 bits */
 151       if (ctx->rounds & 16) {
 152         F1(r, l, 15);
 153         F3(l, r, 14);
 154         F2(r, l, 13);
 155         F1(l, r, 12);
 156       }
 157       F3(r, l, 11);
 158       F2(l, r, 10);
 159       F1(r, l,  9);
 160       F3(l, r,  8);
 161       F2(r, l,  7);
 162       F1(l, r,  6);
 163       F3(r, l,  5);
 164       F2(l, r,  4);
 165       F1(r, l,  3);
 166       F3(l, r,  2);
 167       F2(r, l,  1);
 168       F1(l, r,  0);
 169
 170       /* Put l,r into outblock */
 171       WRITE_UINT32(dst, l);
 172       WRITE_UINT32(dst + 4, r);
 173     }
 174 }
 175
 176 /***** Key Schedule *****/
 177
 178 #define SET_KM(i, k) ctx->Km[i] = (k)
 179 #define SET_KR(i, k) ctx->Kr[i] = (k) & 31
 180
 181 #define EXPAND(set, full) do {                                          \
 182     z0 = x0 ^ S5[B1(x3)] ^ S6[B3(x3)] ^ S7[B0(x3)] ^ S8[B2(x3)] ^ S7[B0(x2)]; \
 183     z1 = x2 ^ S5[B0(z0)] ^ S6[B2(z0)] ^ S7[B1(z0)] ^ S8[B3(z0)] ^ S8[B2(x2)]; \
 184     z2 = x3 ^ S5[B3(z1)] ^ S6[B2(z1)] ^ S7[B1(z1)] ^ S8[B0(z1)] ^ S5[B1(x2)]; \
 185     z3 = x1 ^ S5[B2(z2)] ^ S6[B1(z2)] ^ S7[B3(z2)] ^ S8[B0(z2)] ^ S6[B3(x2)]; \
 186                                                                         \
 187     set(0, S5[B0(z2)] ^ S6[B1(z2)] ^ S7[B3(z1)] ^ S8[B2(z1)] ^ S5[B2(z0)]); \
 188     set(1, S5[B2(z2)] ^ S6[B3(z2)] ^ S7[B1(z1)] ^ S8[B0(z1)] ^ S6[B2(z1)]); \
 189     set(2, S5[B0(z3)] ^ S6[B1(z3)] ^ S7[B3(z0)] ^ S8[B2(z0)] ^ S7[B1(z2)]); \
 190     set(3, S5[B2(z3)] ^ S6[B3(z3)] ^ S7[B1(z0)] ^ S8[B0(z0)] ^ S8[B0(z3)]); \
 191                                                                         \
 192     x0 = z2 ^ S5[B1(z1)] ^ S6[B3(z1)] ^ S7[B0(z1)] ^ S8[B2(z1)] ^ S7[B0(z0)]; \
 193     x1 = z0 ^ S5[B0(x0)] ^ S6[B2(x0)] ^ S7[B1(x0)] ^ S8[B3(x0)] ^ S8[B2(z0)]; \
 194     x2 = z1 ^ S5[B3(x1)] ^ S6[B2(x1)] ^ S7[B1(x1)] ^ S8[B0(x1)] ^ S5[B1(z0)]; \
 195     x3 = z3 ^ S5[B2(x2)] ^ S6[B1(x2)] ^ S7[B3(x2)] ^ S8[B0(x2)] ^ S6[B3(z0)]; \
 196                                                                         \
 197     set(4, S5[B3(x0)] ^ S6[B2(x0)] ^ S7[B0(x3)] ^ S8[B1(x3)] ^ S5[B0(x2)]); \
 198     set(5, S5[B1(x0)] ^ S6[B0(x0)] ^ S7[B2(x3)] ^ S8[B3(x3)] ^ S6[B1(x3)]); \
 199     set(6, S5[B3(x1)] ^ S6[B2(x1)] ^ S7[B0(x2)] ^ S8[B1(x2)] ^ S7[B3(x0)]); \
 200     set(7, S5[B1(x1)] ^ S6[B0(x1)] ^ S7[B2(x2)] ^ S8[B3(x2)] ^ S8[B3(x1)]); \
 201                                                                         \
 202     z0 = x0 ^ S5[B1(x3)] ^ S6[B3(x3)] ^ S7[B0(x3)] ^ S8[B2(x3)] ^ S7[B0(x2)]; \
 203     z1 = x2 ^ S5[B0(z0)] ^ S6[B2(z0)] ^ S7[B1(z0)] ^ S8[B3(z0)] ^ S8[B2(x2)]; \
 204     z2 = x3 ^ S5[B3(z1)] ^ S6[B2(z1)] ^ S7[B1(z1)] ^ S8[B0(z1)] ^ S5[B1(x2)]; \
 205     z3 = x1 ^ S5[B2(z2)] ^ S6[B1(z2)] ^ S7[B3(z2)] ^ S8[B0(z2)] ^ S6[B3(x2)]; \
 206                                                                         \
 207     set(8,  S5[B3(z0)] ^ S6[B2(z0)] ^ S7[B0(z3)] ^ S8[B1(z3)] ^ S5[B1(z2)]); \
 208     set(9,  S5[B1(z0)] ^ S6[B0(z0)] ^ S7[B2(z3)] ^ S8[B3(z3)] ^ S6[B0(z3)]); \
 209     set(10, S5[B3(z1)] ^ S6[B2(z1)] ^ S7[B0(z2)] ^ S8[B1(z2)] ^ S7[B2(z0)]); \
 210     set(11, S5[B1(z1)] ^ S6[B0(z1)] ^ S7[B2(z2)] ^ S8[B3(z2)] ^ S8[B2(z1)]); \
 211                                                                         \
 212     x0 = z2 ^ S5[B1(z1)] ^ S6[B3(z1)] ^ S7[B0(z1)] ^ S8[B2(z1)] ^ S7[B0(z0)]; \
 213     x1 = z0 ^ S5[B0(x0)] ^ S6[B2(x0)] ^ S7[B1(x0)] ^ S8[B3(x0)] ^ S8[B2(z0)]; \
 214     x2 = z1 ^ S5[B3(x1)] ^ S6[B2(x1)] ^ S7[B1(x1)] ^ S8[B0(x1)] ^ S5[B1(z0)]; \
 215     x3 = z3 ^ S5[B2(x2)] ^ S6[B1(x2)] ^ S7[B3(x2)] ^ S8[B0(x2)] ^ S6[B3(z0)]; \
 216     if (full)                                                           \
 217       {                                                                 \
 218         set(12, S5[B0(x2)] ^ S6[B1(x2)] ^ S7[B3(x1)] ^ S8[B2(x1)] ^ S5[B3(x0)]); \
 219         set(13, S5[B2(x2)] ^ S6[B3(x2)] ^ S7[B1(x1)] ^ S8[B0(x1)] ^ S6[B3(x1)]); \
 220         set(14, S5[B0(x3)] ^ S6[B1(x3)] ^ S7[B3(x0)] ^ S8[B2(x0)] ^ S7[B0(x2)]); \
 221         set(15, S5[B2(x3)] ^ S6[B3(x3)] ^ S7[B1(x0)] ^ S8[B0(x0)] ^ S8[B1(x3)]); \
 222       }                                                                 \
 223 } while (0)
 224
 225 void
 226 cast5_set_key(struct cast128_ctx *ctx,
 227               size_t length, const uint8_t *key)
 228 {
 229   uint32_t x0, x1, x2, x3, z0, z1, z2, z3;
 230   uint32_t w;
 231   int full;
 232
 233   assert (length >= CAST5_MIN_KEY_SIZE);
 234   assert (length <= CAST5_MAX_KEY_SIZE);
 235
 236   full = (length > CAST_SMALL_KEY);
 237
 238   x0 = READ_UINT32 (key);
 239
 240   /* Read final word, possibly zero-padded. */
 241   switch (length & 3)
 242     {
 243     case 0:
 244       w = READ_UINT32 (key + length - 4);
 245       break;
 246     case 3:
 247       w = READ_UINT24 (key + length - 3) << 8;
 248       break;
 249     case 2:
 250       w = READ_UINT16 (key + length - 2) << 16;
 251       break;
 252     case 1:
 253       w = (uint32_t) key[length - 1] << 24;
 254       break;
 255     }
 256
 257   if (length <= 8)
 258     {
 259       x1 = w;
 260       x2 = x3 = 0;
 261     }
 262   else
 263     {
 264       x1 = READ_UINT32 (key + 4);
 265       if (length <= 12)
 266         {
 267           x2 = w;
 268           x3 = 0;
 269         }
 270       else
 271         {
 272           x2 = READ_UINT32 (key + 8);
 273           x3 = w;
 274         }
 275     }
 276
 277   EXPAND(SET_KM, full);
 278   EXPAND(SET_KR, full);
 279
 280   ctx->rounds = full ? 16 : 12;
 281 }
 282
 283 void
 284 cast128_set_key(struct cast128_ctx *ctx, const uint8_t *key)
 285 {
 286   cast5_set_key (ctx, CAST128_KEY_SIZE, key);
 287 }