1 /* camellia-crypt-internal.c
3 * Copyright (C) 2006,2007
4 * NTT (Nippon Telegraph and Telephone Corporation).
6 * Copyright (C) 2010 Niels Möller
8 * This library is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Lesser General Public
10 * License as published by the Free Software Foundation; either
11 * version 2.1 of the License, or (at your option) any later version.
13 * This library is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * Lesser General Public License for more details.
18 * You should have received a copy of the GNU Lesser General Public
19 * License along with this library; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
24 * Algorithm Specification
25 * http://info.isl.ntt.co.jp/crypt/eng/camellia/specifications.html
28 /* Based on camellia.c ver 1.2.0, see
29 http://info.isl.ntt.co.jp/crypt/eng/camellia/dl/camellia-LGPL-1.2.0.tar.gz.
37 #include "camellia-internal.h"
41 #define CAMELLIA_FL(x, k) do { \
42 uint32_t __xl, __xr, __kl, __kr, __t; \
44 __xr = (x) & 0xffffffff; \
46 __kr = (k) & 0xffffffff; \
48 __xr ^= ROL32(1, __t); \
49 __xl ^= (__xr | __kr); \
50 (x) = ((uint64_t) __xl << 32) | __xr; \
53 #define CAMELLIA_FLINV(x, k) do { \
54 uint32_t __xl, __xr, __kl, __kr, __t; \
56 __xr = (x) & 0xffffffff; \
58 __kr = (k) & 0xffffffff; \
59 __xl ^= (__xr | __kr); \
61 __xr ^= ROL32(1, __t); \
62 (x) = ((uint64_t) __xl << 32) | __xr; \
65 #define CAMELLIA_ROUNDSM(T, x, k, y) do { \
66 uint32_t __il, __ir; \
68 = T->sp1110[(x) & 0xff] \
69 ^ T->sp0222[((x) >> 24) & 0xff] \
70 ^ T->sp3033[((x) >> 16) & 0xff] \
71 ^ T->sp4404[((x) >> 8) & 0xff]; \
72 /* ir == (t6^t7^t8),(t5^t7^t8),(t5^t6^t8),(t5^t6^t7) */ \
74 = T->sp1110[ (x) >> 56] \
75 ^ T->sp0222[((x) >> 48) & 0xff] \
76 ^ T->sp3033[((x) >> 40) & 0xff] \
77 ^ T->sp4404[((x) >> 32) & 0xff]; \
78 /* il == (t1^t3^t4),(t1^t2^t4),(t1^t2^t3),(t2^t3^t4) */ \
80 __ir ^= (k) & 0xffffffff; \
82 /* ir == (t1^t3^t4^t6^t7^t8),(t1^t2^t4^t5^t7^t8), \
83 (t1^t2^t3^t5^t6^t8),(t2^t3^t4^t5^t6^t7) \
85 __il = ROL32(24, __il); \
86 /* il == (t2^t3^t4),(t1^t3^t4),(t1^t2^t4),(t1^t2^t3) */ \
88 /* il == (t1^t2^t6^t7^t8),(t2^t3^t5^t7^t8), \
89 (t3^t4^t5^t6^t8),(t1^t4^t5^t6^t7) \
91 y ^= ((uint64_t) __ir << 32) | __il; \
95 _camellia_crypt(const struct camellia_ctx *ctx,
96 const struct camellia_table *T,
97 unsigned length, uint8_t *dst,
100 FOR_BLOCKS(length, dst, src, CAMELLIA_BLOCK_SIZE)
105 i0 = READ_UINT64(src);
106 i1 = READ_UINT64(src + 8);
108 /* pre whitening but absorb kw2*/
113 CAMELLIA_ROUNDSM(T, i0,ctx->keys[1], i1);
114 CAMELLIA_ROUNDSM(T, i1,ctx->keys[2], i0);
115 CAMELLIA_ROUNDSM(T, i0,ctx->keys[3], i1);
116 CAMELLIA_ROUNDSM(T, i1,ctx->keys[4], i0);
117 CAMELLIA_ROUNDSM(T, i0,ctx->keys[5], i1);
118 CAMELLIA_ROUNDSM(T, i1,ctx->keys[6], i0);
120 for (i = 0; i < ctx->nkeys - 8; i+= 8)
122 CAMELLIA_FL(i0, ctx->keys[i+7]);
123 CAMELLIA_FLINV(i1, ctx->keys[i+8]);
125 CAMELLIA_ROUNDSM(T, i0,ctx->keys[i+9], i1);
126 CAMELLIA_ROUNDSM(T, i1,ctx->keys[i+10], i0);
127 CAMELLIA_ROUNDSM(T, i0,ctx->keys[i+11], i1);
128 CAMELLIA_ROUNDSM(T, i1,ctx->keys[i+12], i0);
129 CAMELLIA_ROUNDSM(T, i0,ctx->keys[i+13], i1);
130 CAMELLIA_ROUNDSM(T, i1,ctx->keys[i+14], i0);
133 /* post whitening but kw4 */
134 i1 ^= ctx->keys[i+7];
136 WRITE_UINT64(dst , i1);
137 WRITE_UINT64(dst + 8, i0);