camellia-crypt-internal.c

   1 /* camellia-crypt-internal.c
   2  *
   3  * Copyright (C) 2006,2007
   4  * NTT (Nippon Telegraph and Telephone Corporation).
   5  *
   6  * Copyright (C) 2010 Niels Möller
   7  *
   8  * This library is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public
  10  * License as published by the Free Software Foundation; either
  11  * version 2.1 of the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public
  19  * License along with this library; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
  21  */
  22
  23 /*
  24  * Algorithm Specification
  25  *  http://info.isl.ntt.co.jp/crypt/eng/camellia/specifications.html
  26  */
  27
  28 /* Based on camellia.c ver 1.2.0, see
  29    http://info.isl.ntt.co.jp/crypt/eng/camellia/dl/camellia-LGPL-1.2.0.tar.gz.
  30  */
  31 #if HAVE_CONFIG_H
  32 # include "config.h"
  33 #endif
  34
  35 #include <assert.h>
  36 #include <limits.h>
  37
  38 #include "camellia-internal.h"
  39
  40 #include "macros.h"
  41
  42 #define CAMELLIA_FL(x, k) do {                  \
  43   uint32_t __xl, __xr, __kl, __kr, __t;         \
  44   __xl = (x) >> 32;                             \
  45   __xr = (x) & 0xffffffff;                      \
  46   __kl = (k) >> 32;                             \
  47   __kr = (k) & 0xffffffff;                      \
  48   __t = __xl & __kl;                            \
  49   __xr ^= ROTL32(1, __t);                       \
  50   __xl ^= (__xr | __kr);                        \
  51   (x) = ((uint64_t) __xl << 32) | __xr;         \
  52 } while (0)
  53
  54 #define CAMELLIA_FLINV(x, k) do {               \
  55   uint32_t __xl, __xr, __kl, __kr, __t;         \
  56   __xl = (x) >> 32;                             \
  57   __xr = (x) & 0xffffffff;                      \
  58   __kl = (k) >> 32;                             \
  59   __kr = (k) & 0xffffffff;                      \
  60   __xl ^= (__xr | __kr);                        \
  61   __t = __xl & __kl;                            \
  62   __xr ^= ROTL32(1, __t);                       \
  63   (x) = ((uint64_t) __xl << 32) | __xr;         \
  64 } while (0)
  65
  66 #if HAVE_NATIVE_64_BIT
  67 #define CAMELLIA_ROUNDSM(T, x, k, y) do {                       \
  68     uint32_t __il, __ir;                                        \
  69     __ir                                                        \
  70       = T->sp1110[(x) & 0xff]                                   \
  71       ^ T->sp0222[((x) >> 24) & 0xff]                           \
  72       ^ T->sp3033[((x) >> 16) & 0xff]                           \
  73       ^ T->sp4404[((x) >> 8) & 0xff];                           \
  74     /* ir == (t6^t7^t8),(t5^t7^t8),(t5^t6^t8),(t5^t6^t7) */     \
  75     __il                                                        \
  76       = T->sp1110[ (x) >> 56]                                   \
  77       ^ T->sp0222[((x) >> 48) & 0xff]                           \
  78       ^ T->sp3033[((x) >> 40) & 0xff]                           \
  79       ^ T->sp4404[((x) >> 32) & 0xff];                          \
  80     /* il == (t1^t3^t4),(t1^t2^t4),(t1^t2^t3),(t2^t3^t4) */     \
  81     __ir ^= __il;                                               \
  82     /* ir == (t1^t3^t4^t6^t7^t8),(t1^t2^t4^t5^t7^t8),           \
  83        (t1^t2^t3^t5^t6^t8),(t2^t3^t4^t5^t6^t7)                  \
  84        == y1,y2,y3,y4 */                                        \
  85     __il = ROTL32(24, __il);                                    \
  86     /* il == (t2^t3^t4),(t1^t3^t4),(t1^t2^t4),(t1^t2^t3) */     \
  87     __il ^= __ir;                                               \
  88     /* il == (t1^t2^t6^t7^t8),(t2^t3^t5^t7^t8),                 \
  89        (t3^t4^t5^t6^t8),(t1^t4^t5^t6^t7)                        \
  90        == y5,y6,y7,y8 */                                        \
  91     y ^= (k);                                                   \
  92     y ^= ((uint64_t) __ir << 32) | __il;                        \
  93   } while (0)
  94 #else /* !HAVE_NATIVE_64_BIT */
  95 #define CAMELLIA_ROUNDSM(T, x, k, y) do {                       \
  96     uint32_t __il, __ir;                                        \
  97     __ir                                                        \
  98       = T->sp1110[(x) & 0xff]                                   \
  99       ^ T->sp0222[((x) >> 24) & 0xff]                           \
 100       ^ T->sp3033[((x) >> 16) & 0xff]                           \
 101       ^ T->sp4404[((x) >> 8) & 0xff];                           \
 102     /* ir == (t6^t7^t8),(t5^t7^t8),(t5^t6^t8),(t5^t6^t7) */     \
 103     __il                                                        \
 104       = T->sp1110[ (x) >> 56]                                   \
 105       ^ T->sp0222[((x) >> 48) & 0xff]                           \
 106       ^ T->sp3033[((x) >> 40) & 0xff]                           \
 107       ^ T->sp4404[((x) >> 32) & 0xff];                          \
 108     /* il == (t1^t3^t4),(t1^t2^t4),(t1^t2^t3),(t2^t3^t4) */     \
 109     __il ^= (k) >> 32;                                          \
 110     __ir ^= (k) & 0xffffffff;                                   \
 111     __ir ^= __il;                                               \
 112     /* ir == (t1^t3^t4^t6^t7^t8),(t1^t2^t4^t5^t7^t8),           \
 113        (t1^t2^t3^t5^t6^t8),(t2^t3^t4^t5^t6^t7)                  \
 114        == y1,y2,y3,y4 */                                        \
 115     __il = ROTL32(24, __il);                                    \
 116     /* il == (t2^t3^t4),(t1^t3^t4),(t1^t2^t4),(t1^t2^t3) */     \
 117     __il ^= __ir;                                               \
 118     /* il == (t1^t2^t6^t7^t8),(t2^t3^t5^t7^t8),                 \
 119        (t3^t4^t5^t6^t8),(t1^t4^t5^t6^t7)                        \
 120        == y5,y6,y7,y8 */                                        \
 121     y ^= ((uint64_t) __ir << 32) | __il;                        \
 122   } while (0)
 123 #endif
 124
 125 void
 126 _camellia_crypt(const struct camellia_ctx *ctx,
 127                 const struct camellia_table *T,
 128                 unsigned length, uint8_t *dst,
 129                 const uint8_t *src)
 130 {
 131   FOR_BLOCKS(length, dst, src, CAMELLIA_BLOCK_SIZE)
 132     {
 133       uint64_t i0,i1;
 134       unsigned i;
 135
 136       i0 = READ_UINT64(src);
 137       i1 = READ_UINT64(src +  8);
 138
 139       /* pre whitening but absorb kw2*/
 140       i0 ^= ctx->keys[0];
 141
 142       /* main iteration */
 143
 144       CAMELLIA_ROUNDSM(T, i0,ctx->keys[1], i1);
 145       CAMELLIA_ROUNDSM(T, i1,ctx->keys[2], i0);
 146       CAMELLIA_ROUNDSM(T, i0,ctx->keys[3], i1);
 147       CAMELLIA_ROUNDSM(T, i1,ctx->keys[4], i0);
 148       CAMELLIA_ROUNDSM(T, i0,ctx->keys[5], i1);
 149       CAMELLIA_ROUNDSM(T, i1,ctx->keys[6], i0);
 150
 151       for (i = 0; i < ctx->nkeys - 8; i+= 8)
 152         {
 153           CAMELLIA_FL(i0, ctx->keys[i+7]);
 154           CAMELLIA_FLINV(i1, ctx->keys[i+8]);
 155
 156           CAMELLIA_ROUNDSM(T, i0,ctx->keys[i+9], i1);
 157           CAMELLIA_ROUNDSM(T, i1,ctx->keys[i+10], i0);
 158           CAMELLIA_ROUNDSM(T, i0,ctx->keys[i+11], i1);
 159           CAMELLIA_ROUNDSM(T, i1,ctx->keys[i+12], i0);
 160           CAMELLIA_ROUNDSM(T, i0,ctx->keys[i+13], i1);
 161           CAMELLIA_ROUNDSM(T, i1,ctx->keys[i+14], i0);
 162         }
 163
 164       /* post whitening but kw4 */
 165       i1 ^= ctx->keys[i+7];
 166
 167       WRITE_UINT64(dst     , i1);
 168       WRITE_UINT64(dst +  8, i0);
 169     }
 170 }