crypto/camellia_generic.c

   1 /*
   2  * Copyright (C) 2006
   3  * NTT (Nippon Telegraph and Telephone Corporation).
   4  *
   5  * This program is free software; you can redistribute it and/or
   6  * modify it under the terms of the GNU General Public License
   7  * as published by the Free Software Foundation; either version 2
   8  * of the License, or (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License
  16  * along with this program; if not, write to the Free Software
  17  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  18  */
  19
  20 /*
  21  * Algorithm Specification
  22  *  http://info.isl.ntt.co.jp/crypt/eng/camellia/specifications.html
  23  */
  24
  25 /*
  26  *
  27  * NOTE --- NOTE --- NOTE --- NOTE
  28  * This implementation assumes that all memory addresses passed
  29  * as parameters are four-byte aligned.
  30  *
  31  */
  32
  33 #include <linux/crypto.h>
  34 #include <linux/errno.h>
  35 #include <linux/init.h>
  36 #include <linux/kernel.h>
  37 #include <linux/module.h>
  38 #include <linux/bitops.h>
  39 #include <asm/unaligned.h>
  40
  41 static const u32 camellia_sp1110[256] = {
  42         0x70707000, 0x82828200, 0x2c2c2c00, 0xececec00,
  43         0xb3b3b300, 0x27272700, 0xc0c0c000, 0xe5e5e500,
  44         0xe4e4e400, 0x85858500, 0x57575700, 0x35353500,
  45         0xeaeaea00, 0x0c0c0c00, 0xaeaeae00, 0x41414100,
  46         0x23232300, 0xefefef00, 0x6b6b6b00, 0x93939300,
  47         0x45454500, 0x19191900, 0xa5a5a500, 0x21212100,
  48         0xededed00, 0x0e0e0e00, 0x4f4f4f00, 0x4e4e4e00,
  49         0x1d1d1d00, 0x65656500, 0x92929200, 0xbdbdbd00,
  50         0x86868600, 0xb8b8b800, 0xafafaf00, 0x8f8f8f00,
  51         0x7c7c7c00, 0xebebeb00, 0x1f1f1f00, 0xcecece00,
  52         0x3e3e3e00, 0x30303000, 0xdcdcdc00, 0x5f5f5f00,
  53         0x5e5e5e00, 0xc5c5c500, 0x0b0b0b00, 0x1a1a1a00,
  54         0xa6a6a600, 0xe1e1e100, 0x39393900, 0xcacaca00,
  55         0xd5d5d500, 0x47474700, 0x5d5d5d00, 0x3d3d3d00,
  56         0xd9d9d900, 0x01010100, 0x5a5a5a00, 0xd6d6d600,
  57         0x51515100, 0x56565600, 0x6c6c6c00, 0x4d4d4d00,
  58         0x8b8b8b00, 0x0d0d0d00, 0x9a9a9a00, 0x66666600,
  59         0xfbfbfb00, 0xcccccc00, 0xb0b0b000, 0x2d2d2d00,
  60         0x74747400, 0x12121200, 0x2b2b2b00, 0x20202000,
  61         0xf0f0f000, 0xb1b1b100, 0x84848400, 0x99999900,
  62         0xdfdfdf00, 0x4c4c4c00, 0xcbcbcb00, 0xc2c2c200,
  63         0x34343400, 0x7e7e7e00, 0x76767600, 0x05050500,
  64         0x6d6d6d00, 0xb7b7b700, 0xa9a9a900, 0x31313100,
  65         0xd1d1d100, 0x17171700, 0x04040400, 0xd7d7d700,
  66         0x14141400, 0x58585800, 0x3a3a3a00, 0x61616100,
  67         0xdedede00, 0x1b1b1b00, 0x11111100, 0x1c1c1c00,
  68         0x32323200, 0x0f0f0f00, 0x9c9c9c00, 0x16161600,
  69         0x53535300, 0x18181800, 0xf2f2f200, 0x22222200,
  70         0xfefefe00, 0x44444400, 0xcfcfcf00, 0xb2b2b200,
  71         0xc3c3c300, 0xb5b5b500, 0x7a7a7a00, 0x91919100,
  72         0x24242400, 0x08080800, 0xe8e8e800, 0xa8a8a800,
  73         0x60606000, 0xfcfcfc00, 0x69696900, 0x50505000,
  74         0xaaaaaa00, 0xd0d0d000, 0xa0a0a000, 0x7d7d7d00,
  75         0xa1a1a100, 0x89898900, 0x62626200, 0x97979700,
  76         0x54545400, 0x5b5b5b00, 0x1e1e1e00, 0x95959500,
  77         0xe0e0e000, 0xffffff00, 0x64646400, 0xd2d2d200,
  78         0x10101000, 0xc4c4c400, 0x00000000, 0x48484800,
  79         0xa3a3a300, 0xf7f7f700, 0x75757500, 0xdbdbdb00,
  80         0x8a8a8a00, 0x03030300, 0xe6e6e600, 0xdadada00,
  81         0x09090900, 0x3f3f3f00, 0xdddddd00, 0x94949400,
  82         0x87878700, 0x5c5c5c00, 0x83838300, 0x02020200,
  83         0xcdcdcd00, 0x4a4a4a00, 0x90909000, 0x33333300,
  84         0x73737300, 0x67676700, 0xf6f6f600, 0xf3f3f300,
  85         0x9d9d9d00, 0x7f7f7f00, 0xbfbfbf00, 0xe2e2e200,
  86         0x52525200, 0x9b9b9b00, 0xd8d8d800, 0x26262600,
  87         0xc8c8c800, 0x37373700, 0xc6c6c600, 0x3b3b3b00,
  88         0x81818100, 0x96969600, 0x6f6f6f00, 0x4b4b4b00,
  89         0x13131300, 0xbebebe00, 0x63636300, 0x2e2e2e00,
  90         0xe9e9e900, 0x79797900, 0xa7a7a700, 0x8c8c8c00,
  91         0x9f9f9f00, 0x6e6e6e00, 0xbcbcbc00, 0x8e8e8e00,
  92         0x29292900, 0xf5f5f500, 0xf9f9f900, 0xb6b6b600,
  93         0x2f2f2f00, 0xfdfdfd00, 0xb4b4b400, 0x59595900,
  94         0x78787800, 0x98989800, 0x06060600, 0x6a6a6a00,
  95         0xe7e7e700, 0x46464600, 0x71717100, 0xbababa00,
  96         0xd4d4d400, 0x25252500, 0xababab00, 0x42424200,
  97         0x88888800, 0xa2a2a200, 0x8d8d8d00, 0xfafafa00,
  98         0x72727200, 0x07070700, 0xb9b9b900, 0x55555500,
  99         0xf8f8f800, 0xeeeeee00, 0xacacac00, 0x0a0a0a00,
 100         0x36363600, 0x49494900, 0x2a2a2a00, 0x68686800,
 101         0x3c3c3c00, 0x38383800, 0xf1f1f100, 0xa4a4a400,
 102         0x40404000, 0x28282800, 0xd3d3d300, 0x7b7b7b00,
 103         0xbbbbbb00, 0xc9c9c900, 0x43434300, 0xc1c1c100,
 104         0x15151500, 0xe3e3e300, 0xadadad00, 0xf4f4f400,
 105         0x77777700, 0xc7c7c700, 0x80808000, 0x9e9e9e00,
 106 };
 107
 108 static const u32 camellia_sp0222[256] = {
 109         0x00e0e0e0, 0x00050505, 0x00585858, 0x00d9d9d9,
 110         0x00676767, 0x004e4e4e, 0x00818181, 0x00cbcbcb,
 111         0x00c9c9c9, 0x000b0b0b, 0x00aeaeae, 0x006a6a6a,
 112         0x00d5d5d5, 0x00181818, 0x005d5d5d, 0x00828282,
 113         0x00464646, 0x00dfdfdf, 0x00d6d6d6, 0x00272727,
 114         0x008a8a8a, 0x00323232, 0x004b4b4b, 0x00424242,
 115         0x00dbdbdb, 0x001c1c1c, 0x009e9e9e, 0x009c9c9c,
 116         0x003a3a3a, 0x00cacaca, 0x00252525, 0x007b7b7b,
 117         0x000d0d0d, 0x00717171, 0x005f5f5f, 0x001f1f1f,
 118         0x00f8f8f8, 0x00d7d7d7, 0x003e3e3e, 0x009d9d9d,
 119         0x007c7c7c, 0x00606060, 0x00b9b9b9, 0x00bebebe,
 120         0x00bcbcbc, 0x008b8b8b, 0x00161616, 0x00343434,
 121         0x004d4d4d, 0x00c3c3c3, 0x00727272, 0x00959595,
 122         0x00ababab, 0x008e8e8e, 0x00bababa, 0x007a7a7a,
 123         0x00b3b3b3, 0x00020202, 0x00b4b4b4, 0x00adadad,
 124         0x00a2a2a2, 0x00acacac, 0x00d8d8d8, 0x009a9a9a,
 125         0x00171717, 0x001a1a1a, 0x00353535, 0x00cccccc,
 126         0x00f7f7f7, 0x00999999, 0x00616161, 0x005a5a5a,
 127         0x00e8e8e8, 0x00242424, 0x00565656, 0x00404040,
 128         0x00e1e1e1, 0x00636363, 0x00090909, 0x00333333,
 129         0x00bfbfbf, 0x00989898, 0x00979797, 0x00858585,
 130         0x00686868, 0x00fcfcfc, 0x00ececec, 0x000a0a0a,
 131         0x00dadada, 0x006f6f6f, 0x00535353, 0x00626262,
 132         0x00a3a3a3, 0x002e2e2e, 0x00080808, 0x00afafaf,
 133         0x00282828, 0x00b0b0b0, 0x00747474, 0x00c2c2c2,
 134         0x00bdbdbd, 0x00363636, 0x00222222, 0x00383838,
 135         0x00646464, 0x001e1e1e, 0x00393939, 0x002c2c2c,
 136         0x00a6a6a6, 0x00303030, 0x00e5e5e5, 0x00444444,
 137         0x00fdfdfd, 0x00888888, 0x009f9f9f, 0x00656565,
 138         0x00878787, 0x006b6b6b, 0x00f4f4f4, 0x00232323,
 139         0x00484848, 0x00101010, 0x00d1d1d1, 0x00515151,
 140         0x00c0c0c0, 0x00f9f9f9, 0x00d2d2d2, 0x00a0a0a0,
 141         0x00555555, 0x00a1a1a1, 0x00414141, 0x00fafafa,
 142         0x00434343, 0x00131313, 0x00c4c4c4, 0x002f2f2f,
 143         0x00a8a8a8, 0x00b6b6b6, 0x003c3c3c, 0x002b2b2b,
 144         0x00c1c1c1, 0x00ffffff, 0x00c8c8c8, 0x00a5a5a5,
 145         0x00202020, 0x00898989, 0x00000000, 0x00909090,
 146         0x00474747, 0x00efefef, 0x00eaeaea, 0x00b7b7b7,
 147         0x00151515, 0x00060606, 0x00cdcdcd, 0x00b5b5b5,
 148         0x00121212, 0x007e7e7e, 0x00bbbbbb, 0x00292929,
 149         0x000f0f0f, 0x00b8b8b8, 0x00070707, 0x00040404,
 150         0x009b9b9b, 0x00949494, 0x00212121, 0x00666666,
 151         0x00e6e6e6, 0x00cecece, 0x00ededed, 0x00e7e7e7,
 152         0x003b3b3b, 0x00fefefe, 0x007f7f7f, 0x00c5c5c5,
 153         0x00a4a4a4, 0x00373737, 0x00b1b1b1, 0x004c4c4c,
 154         0x00919191, 0x006e6e6e, 0x008d8d8d, 0x00767676,
 155         0x00030303, 0x002d2d2d, 0x00dedede, 0x00969696,
 156         0x00262626, 0x007d7d7d, 0x00c6c6c6, 0x005c5c5c,
 157         0x00d3d3d3, 0x00f2f2f2, 0x004f4f4f, 0x00191919,
 158         0x003f3f3f, 0x00dcdcdc, 0x00797979, 0x001d1d1d,
 159         0x00525252, 0x00ebebeb, 0x00f3f3f3, 0x006d6d6d,
 160         0x005e5e5e, 0x00fbfbfb, 0x00696969, 0x00b2b2b2,
 161         0x00f0f0f0, 0x00313131, 0x000c0c0c, 0x00d4d4d4,
 162         0x00cfcfcf, 0x008c8c8c, 0x00e2e2e2, 0x00757575,
 163         0x00a9a9a9, 0x004a4a4a, 0x00575757, 0x00848484,
 164         0x00111111, 0x00454545, 0x001b1b1b, 0x00f5f5f5,
 165         0x00e4e4e4, 0x000e0e0e, 0x00737373, 0x00aaaaaa,
 166         0x00f1f1f1, 0x00dddddd, 0x00595959, 0x00141414,
 167         0x006c6c6c, 0x00929292, 0x00545454, 0x00d0d0d0,
 168         0x00787878, 0x00707070, 0x00e3e3e3, 0x00494949,
 169         0x00808080, 0x00505050, 0x00a7a7a7, 0x00f6f6f6,
 170         0x00777777, 0x00939393, 0x00868686, 0x00838383,
 171         0x002a2a2a, 0x00c7c7c7, 0x005b5b5b, 0x00e9e9e9,
 172         0x00eeeeee, 0x008f8f8f, 0x00010101, 0x003d3d3d,
 173 };
 174
 175 static const u32 camellia_sp3033[256] = {
 176         0x38003838, 0x41004141, 0x16001616, 0x76007676,
 177         0xd900d9d9, 0x93009393, 0x60006060, 0xf200f2f2,
 178         0x72007272, 0xc200c2c2, 0xab00abab, 0x9a009a9a,
 179         0x75007575, 0x06000606, 0x57005757, 0xa000a0a0,
 180         0x91009191, 0xf700f7f7, 0xb500b5b5, 0xc900c9c9,
 181         0xa200a2a2, 0x8c008c8c, 0xd200d2d2, 0x90009090,
 182         0xf600f6f6, 0x07000707, 0xa700a7a7, 0x27002727,
 183         0x8e008e8e, 0xb200b2b2, 0x49004949, 0xde00dede,
 184         0x43004343, 0x5c005c5c, 0xd700d7d7, 0xc700c7c7,
 185         0x3e003e3e, 0xf500f5f5, 0x8f008f8f, 0x67006767,
 186         0x1f001f1f, 0x18001818, 0x6e006e6e, 0xaf00afaf,
 187         0x2f002f2f, 0xe200e2e2, 0x85008585, 0x0d000d0d,
 188         0x53005353, 0xf000f0f0, 0x9c009c9c, 0x65006565,
 189         0xea00eaea, 0xa300a3a3, 0xae00aeae, 0x9e009e9e,
 190         0xec00ecec, 0x80008080, 0x2d002d2d, 0x6b006b6b,
 191         0xa800a8a8, 0x2b002b2b, 0x36003636, 0xa600a6a6,
 192         0xc500c5c5, 0x86008686, 0x4d004d4d, 0x33003333,
 193         0xfd00fdfd, 0x66006666, 0x58005858, 0x96009696,
 194         0x3a003a3a, 0x09000909, 0x95009595, 0x10001010,
 195         0x78007878, 0xd800d8d8, 0x42004242, 0xcc00cccc,
 196         0xef00efef, 0x26002626, 0xe500e5e5, 0x61006161,
 197         0x1a001a1a, 0x3f003f3f, 0x3b003b3b, 0x82008282,
 198         0xb600b6b6, 0xdb00dbdb, 0xd400d4d4, 0x98009898,
 199         0xe800e8e8, 0x8b008b8b, 0x02000202, 0xeb00ebeb,
 200         0x0a000a0a, 0x2c002c2c, 0x1d001d1d, 0xb000b0b0,
 201         0x6f006f6f, 0x8d008d8d, 0x88008888, 0x0e000e0e,
 202         0x19001919, 0x87008787, 0x4e004e4e, 0x0b000b0b,
 203         0xa900a9a9, 0x0c000c0c, 0x79007979, 0x11001111,
 204         0x7f007f7f, 0x22002222, 0xe700e7e7, 0x59005959,
 205         0xe100e1e1, 0xda00dada, 0x3d003d3d, 0xc800c8c8,
 206         0x12001212, 0x04000404, 0x74007474, 0x54005454,
 207         0x30003030, 0x7e007e7e, 0xb400b4b4, 0x28002828,
 208         0x55005555, 0x68006868, 0x50005050, 0xbe00bebe,
 209         0xd000d0d0, 0xc400c4c4, 0x31003131, 0xcb00cbcb,
 210         0x2a002a2a, 0xad00adad, 0x0f000f0f, 0xca00caca,
 211         0x70007070, 0xff00ffff, 0x32003232, 0x69006969,
 212         0x08000808, 0x62006262, 0x00000000, 0x24002424,
 213         0xd100d1d1, 0xfb00fbfb, 0xba00baba, 0xed00eded,
 214         0x45004545, 0x81008181, 0x73007373, 0x6d006d6d,
 215         0x84008484, 0x9f009f9f, 0xee00eeee, 0x4a004a4a,
 216         0xc300c3c3, 0x2e002e2e, 0xc100c1c1, 0x01000101,
 217         0xe600e6e6, 0x25002525, 0x48004848, 0x99009999,
 218         0xb900b9b9, 0xb300b3b3, 0x7b007b7b, 0xf900f9f9,
 219         0xce00cece, 0xbf00bfbf, 0xdf00dfdf, 0x71007171,
 220         0x29002929, 0xcd00cdcd, 0x6c006c6c, 0x13001313,
 221         0x64006464, 0x9b009b9b, 0x63006363, 0x9d009d9d,
 222         0xc000c0c0, 0x4b004b4b, 0xb700b7b7, 0xa500a5a5,
 223         0x89008989, 0x5f005f5f, 0xb100b1b1, 0x17001717,
 224         0xf400f4f4, 0xbc00bcbc, 0xd300d3d3, 0x46004646,
 225         0xcf00cfcf, 0x37003737, 0x5e005e5e, 0x47004747,
 226         0x94009494, 0xfa00fafa, 0xfc00fcfc, 0x5b005b5b,
 227         0x97009797, 0xfe00fefe, 0x5a005a5a, 0xac00acac,
 228         0x3c003c3c, 0x4c004c4c, 0x03000303, 0x35003535,
 229         0xf300f3f3, 0x23002323, 0xb800b8b8, 0x5d005d5d,
 230         0x6a006a6a, 0x92009292, 0xd500d5d5, 0x21002121,
 231         0x44004444, 0x51005151, 0xc600c6c6, 0x7d007d7d,
 232         0x39003939, 0x83008383, 0xdc00dcdc, 0xaa00aaaa,
 233         0x7c007c7c, 0x77007777, 0x56005656, 0x05000505,
 234         0x1b001b1b, 0xa400a4a4, 0x15001515, 0x34003434,
 235         0x1e001e1e, 0x1c001c1c, 0xf800f8f8, 0x52005252,
 236         0x20002020, 0x14001414, 0xe900e9e9, 0xbd00bdbd,
 237         0xdd00dddd, 0xe400e4e4, 0xa100a1a1, 0xe000e0e0,
 238         0x8a008a8a, 0xf100f1f1, 0xd600d6d6, 0x7a007a7a,
 239         0xbb00bbbb, 0xe300e3e3, 0x40004040, 0x4f004f4f,
 240 };
 241
 242 static const u32 camellia_sp4404[256] = {
 243         0x70700070, 0x2c2c002c, 0xb3b300b3, 0xc0c000c0,
 244         0xe4e400e4, 0x57570057, 0xeaea00ea, 0xaeae00ae,
 245         0x23230023, 0x6b6b006b, 0x45450045, 0xa5a500a5,
 246         0xeded00ed, 0x4f4f004f, 0x1d1d001d, 0x92920092,
 247         0x86860086, 0xafaf00af, 0x7c7c007c, 0x1f1f001f,
 248         0x3e3e003e, 0xdcdc00dc, 0x5e5e005e, 0x0b0b000b,
 249         0xa6a600a6, 0x39390039, 0xd5d500d5, 0x5d5d005d,
 250         0xd9d900d9, 0x5a5a005a, 0x51510051, 0x6c6c006c,
 251         0x8b8b008b, 0x9a9a009a, 0xfbfb00fb, 0xb0b000b0,
 252         0x74740074, 0x2b2b002b, 0xf0f000f0, 0x84840084,
 253         0xdfdf00df, 0xcbcb00cb, 0x34340034, 0x76760076,
 254         0x6d6d006d, 0xa9a900a9, 0xd1d100d1, 0x04040004,
 255         0x14140014, 0x3a3a003a, 0xdede00de, 0x11110011,
 256         0x32320032, 0x9c9c009c, 0x53530053, 0xf2f200f2,
 257         0xfefe00fe, 0xcfcf00cf, 0xc3c300c3, 0x7a7a007a,
 258         0x24240024, 0xe8e800e8, 0x60600060, 0x69690069,
 259         0xaaaa00aa, 0xa0a000a0, 0xa1a100a1, 0x62620062,
 260         0x54540054, 0x1e1e001e, 0xe0e000e0, 0x64640064,
 261         0x10100010, 0x00000000, 0xa3a300a3, 0x75750075,
 262         0x8a8a008a, 0xe6e600e6, 0x09090009, 0xdddd00dd,
 263         0x87870087, 0x83830083, 0xcdcd00cd, 0x90900090,
 264         0x73730073, 0xf6f600f6, 0x9d9d009d, 0xbfbf00bf,
 265         0x52520052, 0xd8d800d8, 0xc8c800c8, 0xc6c600c6,
 266         0x81810081, 0x6f6f006f, 0x13130013, 0x63630063,
 267         0xe9e900e9, 0xa7a700a7, 0x9f9f009f, 0xbcbc00bc,
 268         0x29290029, 0xf9f900f9, 0x2f2f002f, 0xb4b400b4,
 269         0x78780078, 0x06060006, 0xe7e700e7, 0x71710071,
 270         0xd4d400d4, 0xabab00ab, 0x88880088, 0x8d8d008d,
 271         0x72720072, 0xb9b900b9, 0xf8f800f8, 0xacac00ac,
 272         0x36360036, 0x2a2a002a, 0x3c3c003c, 0xf1f100f1,
 273         0x40400040, 0xd3d300d3, 0xbbbb00bb, 0x43430043,
 274         0x15150015, 0xadad00ad, 0x77770077, 0x80800080,
 275         0x82820082, 0xecec00ec, 0x27270027, 0xe5e500e5,
 276         0x85850085, 0x35350035, 0x0c0c000c, 0x41410041,
 277         0xefef00ef, 0x93930093, 0x19190019, 0x21210021,
 278         0x0e0e000e, 0x4e4e004e, 0x65650065, 0xbdbd00bd,
 279         0xb8b800b8, 0x8f8f008f, 0xebeb00eb, 0xcece00ce,
 280         0x30300030, 0x5f5f005f, 0xc5c500c5, 0x1a1a001a,
 281         0xe1e100e1, 0xcaca00ca, 0x47470047, 0x3d3d003d,
 282         0x01010001, 0xd6d600d6, 0x56560056, 0x4d4d004d,
 283         0x0d0d000d, 0x66660066, 0xcccc00cc, 0x2d2d002d,
 284         0x12120012, 0x20200020, 0xb1b100b1, 0x99990099,
 285         0x4c4c004c, 0xc2c200c2, 0x7e7e007e, 0x05050005,
 286         0xb7b700b7, 0x31310031, 0x17170017, 0xd7d700d7,
 287         0x58580058, 0x61610061, 0x1b1b001b, 0x1c1c001c,
 288         0x0f0f000f, 0x16160016, 0x18180018, 0x22220022,
 289         0x44440044, 0xb2b200b2, 0xb5b500b5, 0x91910091,
 290         0x08080008, 0xa8a800a8, 0xfcfc00fc, 0x50500050,
 291         0xd0d000d0, 0x7d7d007d, 0x89890089, 0x97970097,
 292         0x5b5b005b, 0x95950095, 0xffff00ff, 0xd2d200d2,
 293         0xc4c400c4, 0x48480048, 0xf7f700f7, 0xdbdb00db,
 294         0x03030003, 0xdada00da, 0x3f3f003f, 0x94940094,
 295         0x5c5c005c, 0x02020002, 0x4a4a004a, 0x33330033,
 296         0x67670067, 0xf3f300f3, 0x7f7f007f, 0xe2e200e2,
 297         0x9b9b009b, 0x26260026, 0x37370037, 0x3b3b003b,
 298         0x96960096, 0x4b4b004b, 0xbebe00be, 0x2e2e002e,
 299         0x79790079, 0x8c8c008c, 0x6e6e006e, 0x8e8e008e,
 300         0xf5f500f5, 0xb6b600b6, 0xfdfd00fd, 0x59590059,
 301         0x98980098, 0x6a6a006a, 0x46460046, 0xbaba00ba,
 302         0x25250025, 0x42420042, 0xa2a200a2, 0xfafa00fa,
 303         0x07070007, 0x55550055, 0xeeee00ee, 0x0a0a000a,
 304         0x49490049, 0x68680068, 0x38380038, 0xa4a400a4,
 305         0x28280028, 0x7b7b007b, 0xc9c900c9, 0xc1c100c1,
 306         0xe3e300e3, 0xf4f400f4, 0xc7c700c7, 0x9e9e009e,
 307 };
 308
 309
 310 #define CAMELLIA_MIN_KEY_SIZE        16
 311 #define CAMELLIA_MAX_KEY_SIZE        32
 312 #define CAMELLIA_BLOCK_SIZE          16
 313 #define CAMELLIA_TABLE_BYTE_LEN     272
 314
 315 /*
 316  * NB: L and R below stand for 'left' and 'right' as in written numbers.
 317  * That is, in (xxxL,xxxR) pair xxxL holds most significant digits,
 318  * _not_ least significant ones!
 319  */
 320
 321
 322 /* key constants */
 323
 324 #define CAMELLIA_SIGMA1L (0xA09E667FL)
 325 #define CAMELLIA_SIGMA1R (0x3BCC908BL)
 326 #define CAMELLIA_SIGMA2L (0xB67AE858L)
 327 #define CAMELLIA_SIGMA2R (0x4CAA73B2L)
 328 #define CAMELLIA_SIGMA3L (0xC6EF372FL)
 329 #define CAMELLIA_SIGMA3R (0xE94F82BEL)
 330 #define CAMELLIA_SIGMA4L (0x54FF53A5L)
 331 #define CAMELLIA_SIGMA4R (0xF1D36F1CL)
 332 #define CAMELLIA_SIGMA5L (0x10E527FAL)
 333 #define CAMELLIA_SIGMA5R (0xDE682D1DL)
 334 #define CAMELLIA_SIGMA6L (0xB05688C2L)
 335 #define CAMELLIA_SIGMA6R (0xB3E6C1FDL)
 336
 337 /*
 338  *  macros
 339  */
 340 #define ROLDQ(ll, lr, rl, rr, w0, w1, bits) ({          \
 341         w0 = ll;                                        \
 342         ll = (ll << bits) + (lr >> (32 - bits));        \
 343         lr = (lr << bits) + (rl >> (32 - bits));        \
 344         rl = (rl << bits) + (rr >> (32 - bits));        \
 345         rr = (rr << bits) + (w0 >> (32 - bits));        \
 346 })
 347
 348 #define ROLDQo32(ll, lr, rl, rr, w0, w1, bits) ({       \
 349         w0 = ll;                                        \
 350         w1 = lr;                                        \
 351         ll = (lr << (bits - 32)) + (rl >> (64 - bits)); \
 352         lr = (rl << (bits - 32)) + (rr >> (64 - bits)); \
 353         rl = (rr << (bits - 32)) + (w0 >> (64 - bits)); \
 354         rr = (w0 << (bits - 32)) + (w1 >> (64 - bits)); \
 355 })
 356
 357 #define CAMELLIA_F(xl, xr, kl, kr, yl, yr, il, ir, t0, t1) ({   \
 358         il = xl ^ kl;                                           \
 359         ir = xr ^ kr;                                           \
 360         t0 = il >> 16;                                          \
 361         t1 = ir >> 16;                                          \
 362         yl = camellia_sp1110[(u8)(ir)]                          \
 363            ^ camellia_sp0222[(u8)(t1 >> 8)]                     \
 364            ^ camellia_sp3033[(u8)(t1)]                          \
 365            ^ camellia_sp4404[(u8)(ir >> 8)];                    \
 366         yr = camellia_sp1110[(u8)(t0 >> 8)]                     \
 367            ^ camellia_sp0222[(u8)(t0)]                          \
 368            ^ camellia_sp3033[(u8)(il >> 8)]                     \
 369            ^ camellia_sp4404[(u8)(il)];                         \
 370         yl ^= yr;                                               \
 371         yr = ror32(yr, 8);                                      \
 372         yr ^= yl;                                               \
 373 })
 374
 375 #define SUBKEY_L(INDEX) (subkey[(INDEX)*2])
 376 #define SUBKEY_R(INDEX) (subkey[(INDEX)*2 + 1])
 377
 378 static void camellia_setup_tail(u32 *subkey, u32 *subL, u32 *subR, int max)
 379 {
 380         u32 dw, tl, tr;
 381         u32 kw4l, kw4r;
 382
 383         /* absorb kw2 to other subkeys */
 384         /* round 2 */
 385         subL[3] ^= subL[1]; subR[3] ^= subR[1];
 386         /* round 4 */
 387         subL[5] ^= subL[1]; subR[5] ^= subR[1];
 388         /* round 6 */
 389         subL[7] ^= subL[1]; subR[7] ^= subR[1];
 390         subL[1] ^= subR[1] & ~subR[9];
 391         dw = subL[1] & subL[9],
 392                 subR[1] ^= rol32(dw, 1); /* modified for FLinv(kl2) */
 393         /* round 8 */
 394         subL[11] ^= subL[1]; subR[11] ^= subR[1];
 395         /* round 10 */
 396         subL[13] ^= subL[1]; subR[13] ^= subR[1];
 397         /* round 12 */
 398         subL[15] ^= subL[1]; subR[15] ^= subR[1];
 399         subL[1] ^= subR[1] & ~subR[17];
 400         dw = subL[1] & subL[17],
 401                 subR[1] ^= rol32(dw, 1); /* modified for FLinv(kl4) */
 402         /* round 14 */
 403         subL[19] ^= subL[1]; subR[19] ^= subR[1];
 404         /* round 16 */
 405         subL[21] ^= subL[1]; subR[21] ^= subR[1];
 406         /* round 18 */
 407         subL[23] ^= subL[1]; subR[23] ^= subR[1];
 408         if (max == 24) {
 409                 /* kw3 */
 410                 subL[24] ^= subL[1]; subR[24] ^= subR[1];
 411
 412         /* absorb kw4 to other subkeys */
 413                 kw4l = subL[25]; kw4r = subR[25];
 414         } else {
 415                 subL[1] ^= subR[1] & ~subR[25];
 416                 dw = subL[1] & subL[25],
 417                         subR[1] ^= rol32(dw, 1); /* modified for FLinv(kl6) */
 418                 /* round 20 */
 419                 subL[27] ^= subL[1]; subR[27] ^= subR[1];
 420                 /* round 22 */
 421                 subL[29] ^= subL[1]; subR[29] ^= subR[1];
 422                 /* round 24 */
 423                 subL[31] ^= subL[1]; subR[31] ^= subR[1];
 424                 /* kw3 */
 425                 subL[32] ^= subL[1]; subR[32] ^= subR[1];
 426
 427         /* absorb kw4 to other subkeys */
 428                 kw4l = subL[33]; kw4r = subR[33];
 429                 /* round 23 */
 430                 subL[30] ^= kw4l; subR[30] ^= kw4r;
 431                 /* round 21 */
 432                 subL[28] ^= kw4l; subR[28] ^= kw4r;
 433                 /* round 19 */
 434                 subL[26] ^= kw4l; subR[26] ^= kw4r;
 435                 kw4l ^= kw4r & ~subR[24];
 436                 dw = kw4l & subL[24],
 437                         kw4r ^= rol32(dw, 1); /* modified for FL(kl5) */
 438         }
 439         /* round 17 */
 440         subL[22] ^= kw4l; subR[22] ^= kw4r;
 441         /* round 15 */
 442         subL[20] ^= kw4l; subR[20] ^= kw4r;
 443         /* round 13 */
 444         subL[18] ^= kw4l; subR[18] ^= kw4r;
 445         kw4l ^= kw4r & ~subR[16];
 446         dw = kw4l & subL[16],
 447                 kw4r ^= rol32(dw, 1); /* modified for FL(kl3) */
 448         /* round 11 */
 449         subL[14] ^= kw4l; subR[14] ^= kw4r;
 450         /* round 9 */
 451         subL[12] ^= kw4l; subR[12] ^= kw4r;
 452         /* round 7 */
 453         subL[10] ^= kw4l; subR[10] ^= kw4r;
 454         kw4l ^= kw4r & ~subR[8];
 455         dw = kw4l & subL[8],
 456                 kw4r ^= rol32(dw, 1); /* modified for FL(kl1) */
 457         /* round 5 */
 458         subL[6] ^= kw4l; subR[6] ^= kw4r;
 459         /* round 3 */
 460         subL[4] ^= kw4l; subR[4] ^= kw4r;
 461         /* round 1 */
 462         subL[2] ^= kw4l; subR[2] ^= kw4r;
 463         /* kw1 */
 464         subL[0] ^= kw4l; subR[0] ^= kw4r;
 465
 466         /* key XOR is end of F-function */
 467         SUBKEY_L(0) = subL[0] ^ subL[2];/* kw1 */
 468         SUBKEY_R(0) = subR[0] ^ subR[2];
 469         SUBKEY_L(2) = subL[3];       /* round 1 */
 470         SUBKEY_R(2) = subR[3];
 471         SUBKEY_L(3) = subL[2] ^ subL[4]; /* round 2 */
 472         SUBKEY_R(3) = subR[2] ^ subR[4];
 473         SUBKEY_L(4) = subL[3] ^ subL[5]; /* round 3 */
 474         SUBKEY_R(4) = subR[3] ^ subR[5];
 475         SUBKEY_L(5) = subL[4] ^ subL[6]; /* round 4 */
 476         SUBKEY_R(5) = subR[4] ^ subR[6];
 477         SUBKEY_L(6) = subL[5] ^ subL[7]; /* round 5 */
 478         SUBKEY_R(6) = subR[5] ^ subR[7];
 479         tl = subL[10] ^ (subR[10] & ~subR[8]);
 480         dw = tl & subL[8],  /* FL(kl1) */
 481                 tr = subR[10] ^ rol32(dw, 1);
 482         SUBKEY_L(7) = subL[6] ^ tl; /* round 6 */
 483         SUBKEY_R(7) = subR[6] ^ tr;
 484         SUBKEY_L(8) = subL[8];       /* FL(kl1) */
 485         SUBKEY_R(8) = subR[8];
 486         SUBKEY_L(9) = subL[9];       /* FLinv(kl2) */
 487         SUBKEY_R(9) = subR[9];
 488         tl = subL[7] ^ (subR[7] & ~subR[9]);
 489         dw = tl & subL[9],  /* FLinv(kl2) */
 490                 tr = subR[7] ^ rol32(dw, 1);
 491         SUBKEY_L(10) = tl ^ subL[11]; /* round 7 */
 492         SUBKEY_R(10) = tr ^ subR[11];
 493         SUBKEY_L(11) = subL[10] ^ subL[12]; /* round 8 */
 494         SUBKEY_R(11) = subR[10] ^ subR[12];
 495         SUBKEY_L(12) = subL[11] ^ subL[13]; /* round 9 */
 496         SUBKEY_R(12) = subR[11] ^ subR[13];
 497         SUBKEY_L(13) = subL[12] ^ subL[14]; /* round 10 */
 498         SUBKEY_R(13) = subR[12] ^ subR[14];
 499         SUBKEY_L(14) = subL[13] ^ subL[15]; /* round 11 */
 500         SUBKEY_R(14) = subR[13] ^ subR[15];
 501         tl = subL[18] ^ (subR[18] & ~subR[16]);
 502         dw = tl & subL[16], /* FL(kl3) */
 503                 tr = subR[18] ^ rol32(dw, 1);
 504         SUBKEY_L(15) = subL[14] ^ tl; /* round 12 */
 505         SUBKEY_R(15) = subR[14] ^ tr;
 506         SUBKEY_L(16) = subL[16];     /* FL(kl3) */
 507         SUBKEY_R(16) = subR[16];
 508         SUBKEY_L(17) = subL[17];     /* FLinv(kl4) */
 509         SUBKEY_R(17) = subR[17];
 510         tl = subL[15] ^ (subR[15] & ~subR[17]);
 511         dw = tl & subL[17], /* FLinv(kl4) */
 512                 tr = subR[15] ^ rol32(dw, 1);
 513         SUBKEY_L(18) = tl ^ subL[19]; /* round 13 */
 514         SUBKEY_R(18) = tr ^ subR[19];
 515         SUBKEY_L(19) = subL[18] ^ subL[20]; /* round 14 */
 516         SUBKEY_R(19) = subR[18] ^ subR[20];
 517         SUBKEY_L(20) = subL[19] ^ subL[21]; /* round 15 */
 518         SUBKEY_R(20) = subR[19] ^ subR[21];
 519         SUBKEY_L(21) = subL[20] ^ subL[22]; /* round 16 */
 520         SUBKEY_R(21) = subR[20] ^ subR[22];
 521         SUBKEY_L(22) = subL[21] ^ subL[23]; /* round 17 */
 522         SUBKEY_R(22) = subR[21] ^ subR[23];
 523         if (max == 24) {
 524                 SUBKEY_L(23) = subL[22];     /* round 18 */
 525                 SUBKEY_R(23) = subR[22];
 526                 SUBKEY_L(24) = subL[24] ^ subL[23]; /* kw3 */
 527                 SUBKEY_R(24) = subR[24] ^ subR[23];
 528         } else {
 529                 tl = subL[26] ^ (subR[26] & ~subR[24]);
 530                 dw = tl & subL[24], /* FL(kl5) */
 531                         tr = subR[26] ^ rol32(dw, 1);
 532                 SUBKEY_L(23) = subL[22] ^ tl; /* round 18 */
 533                 SUBKEY_R(23) = subR[22] ^ tr;
 534                 SUBKEY_L(24) = subL[24];     /* FL(kl5) */
 535                 SUBKEY_R(24) = subR[24];
 536                 SUBKEY_L(25) = subL[25];     /* FLinv(kl6) */
 537                 SUBKEY_R(25) = subR[25];
 538                 tl = subL[23] ^ (subR[23] & ~subR[25]);
 539                 dw = tl & subL[25], /* FLinv(kl6) */
 540                         tr = subR[23] ^ rol32(dw, 1);
 541                 SUBKEY_L(26) = tl ^ subL[27]; /* round 19 */
 542                 SUBKEY_R(26) = tr ^ subR[27];
 543                 SUBKEY_L(27) = subL[26] ^ subL[28]; /* round 20 */
 544                 SUBKEY_R(27) = subR[26] ^ subR[28];
 545                 SUBKEY_L(28) = subL[27] ^ subL[29]; /* round 21 */
 546                 SUBKEY_R(28) = subR[27] ^ subR[29];
 547                 SUBKEY_L(29) = subL[28] ^ subL[30]; /* round 22 */
 548                 SUBKEY_R(29) = subR[28] ^ subR[30];
 549                 SUBKEY_L(30) = subL[29] ^ subL[31]; /* round 23 */
 550                 SUBKEY_R(30) = subR[29] ^ subR[31];
 551                 SUBKEY_L(31) = subL[30];     /* round 24 */
 552                 SUBKEY_R(31) = subR[30];
 553                 SUBKEY_L(32) = subL[32] ^ subL[31]; /* kw3 */
 554                 SUBKEY_R(32) = subR[32] ^ subR[31];
 555         }
 556 }
 557
 558 static void camellia_setup128(const unsigned char *key, u32 *subkey)
 559 {
 560         u32 kll, klr, krl, krr;
 561         u32 il, ir, t0, t1, w0, w1;
 562         u32 subL[26];
 563         u32 subR[26];
 564
 565         /**
 566          *  k == kll || klr || krl || krr (|| is concatenation)
 567          */
 568         kll = get_unaligned_be32(key);
 569         klr = get_unaligned_be32(key + 4);
 570         krl = get_unaligned_be32(key + 8);
 571         krr = get_unaligned_be32(key + 12);
 572
 573         /* generate KL dependent subkeys */
 574         /* kw1 */
 575         subL[0] = kll; subR[0] = klr;
 576         /* kw2 */
 577         subL[1] = krl; subR[1] = krr;
 578         /* rotation left shift 15bit */
 579         ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 580         /* k3 */
 581         subL[4] = kll; subR[4] = klr;
 582         /* k4 */
 583         subL[5] = krl; subR[5] = krr;
 584         /* rotation left shift 15+30bit */
 585         ROLDQ(kll, klr, krl, krr, w0, w1, 30);
 586         /* k7 */
 587         subL[10] = kll; subR[10] = klr;
 588         /* k8 */
 589         subL[11] = krl; subR[11] = krr;
 590         /* rotation left shift 15+30+15bit */
 591         ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 592         /* k10 */
 593         subL[13] = krl; subR[13] = krr;
 594         /* rotation left shift 15+30+15+17 bit */
 595         ROLDQ(kll, klr, krl, krr, w0, w1, 17);
 596         /* kl3 */
 597         subL[16] = kll; subR[16] = klr;
 598         /* kl4 */
 599         subL[17] = krl; subR[17] = krr;
 600         /* rotation left shift 15+30+15+17+17 bit */
 601         ROLDQ(kll, klr, krl, krr, w0, w1, 17);
 602         /* k13 */
 603         subL[18] = kll; subR[18] = klr;
 604         /* k14 */
 605         subL[19] = krl; subR[19] = krr;
 606         /* rotation left shift 15+30+15+17+17+17 bit */
 607         ROLDQ(kll, klr, krl, krr, w0, w1, 17);
 608         /* k17 */
 609         subL[22] = kll; subR[22] = klr;
 610         /* k18 */
 611         subL[23] = krl; subR[23] = krr;
 612
 613         /* generate KA */
 614         kll = subL[0]; klr = subR[0];
 615         krl = subL[1]; krr = subR[1];
 616         CAMELLIA_F(kll, klr,
 617                    CAMELLIA_SIGMA1L, CAMELLIA_SIGMA1R,
 618                    w0, w1, il, ir, t0, t1);
 619         krl ^= w0; krr ^= w1;
 620         CAMELLIA_F(krl, krr,
 621                    CAMELLIA_SIGMA2L, CAMELLIA_SIGMA2R,
 622                    kll, klr, il, ir, t0, t1);
 623         /* current status == (kll, klr, w0, w1) */
 624         CAMELLIA_F(kll, klr,
 625                    CAMELLIA_SIGMA3L, CAMELLIA_SIGMA3R,
 626                    krl, krr, il, ir, t0, t1);
 627         krl ^= w0; krr ^= w1;
 628         CAMELLIA_F(krl, krr,
 629                    CAMELLIA_SIGMA4L, CAMELLIA_SIGMA4R,
 630                    w0, w1, il, ir, t0, t1);
 631         kll ^= w0; klr ^= w1;
 632
 633         /* generate KA dependent subkeys */
 634         /* k1, k2 */
 635         subL[2] = kll; subR[2] = klr;
 636         subL[3] = krl; subR[3] = krr;
 637         ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 638         /* k5,k6 */
 639         subL[6] = kll; subR[6] = klr;
 640         subL[7] = krl; subR[7] = krr;
 641         ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 642         /* kl1, kl2 */
 643         subL[8] = kll; subR[8] = klr;
 644         subL[9] = krl; subR[9] = krr;
 645         ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 646         /* k9 */
 647         subL[12] = kll; subR[12] = klr;
 648         ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 649         /* k11, k12 */
 650         subL[14] = kll; subR[14] = klr;
 651         subL[15] = krl; subR[15] = krr;
 652         ROLDQo32(kll, klr, krl, krr, w0, w1, 34);
 653         /* k15, k16 */
 654         subL[20] = kll; subR[20] = klr;
 655         subL[21] = krl; subR[21] = krr;
 656         ROLDQ(kll, klr, krl, krr, w0, w1, 17);
 657         /* kw3, kw4 */
 658         subL[24] = kll; subR[24] = klr;
 659         subL[25] = krl; subR[25] = krr;
 660
 661         camellia_setup_tail(subkey, subL, subR, 24);
 662 }
 663
 664 static void camellia_setup256(const unsigned char *key, u32 *subkey)
 665 {
 666         u32 kll, klr, krl, krr;        /* left half of key */
 667         u32 krll, krlr, krrl, krrr;    /* right half of key */
 668         u32 il, ir, t0, t1, w0, w1;    /* temporary variables */
 669         u32 subL[34];
 670         u32 subR[34];
 671
 672         /**
 673          *  key = (kll || klr || krl || krr || krll || krlr || krrl || krrr)
 674          *  (|| is concatenation)
 675          */
 676         kll = get_unaligned_be32(key);
 677         klr = get_unaligned_be32(key + 4);
 678         krl = get_unaligned_be32(key + 8);
 679         krr = get_unaligned_be32(key + 12);
 680         krll = get_unaligned_be32(key + 16);
 681         krlr = get_unaligned_be32(key + 20);
 682         krrl = get_unaligned_be32(key + 24);
 683         krrr = get_unaligned_be32(key + 28);
 684
 685         /* generate KL dependent subkeys */
 686         /* kw1 */
 687         subL[0] = kll; subR[0] = klr;
 688         /* kw2 */
 689         subL[1] = krl; subR[1] = krr;
 690         ROLDQo32(kll, klr, krl, krr, w0, w1, 45);
 691         /* k9 */
 692         subL[12] = kll; subR[12] = klr;
 693         /* k10 */
 694         subL[13] = krl; subR[13] = krr;
 695         ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 696         /* kl3 */
 697         subL[16] = kll; subR[16] = klr;
 698         /* kl4 */
 699         subL[17] = krl; subR[17] = krr;
 700         ROLDQ(kll, klr, krl, krr, w0, w1, 17);
 701         /* k17 */
 702         subL[22] = kll; subR[22] = klr;
 703         /* k18 */
 704         subL[23] = krl; subR[23] = krr;
 705         ROLDQo32(kll, klr, krl, krr, w0, w1, 34);
 706         /* k23 */
 707         subL[30] = kll; subR[30] = klr;
 708         /* k24 */
 709         subL[31] = krl; subR[31] = krr;
 710
 711         /* generate KR dependent subkeys */
 712         ROLDQ(krll, krlr, krrl, krrr, w0, w1, 15);
 713         /* k3 */
 714         subL[4] = krll; subR[4] = krlr;
 715         /* k4 */
 716         subL[5] = krrl; subR[5] = krrr;
 717         ROLDQ(krll, krlr, krrl, krrr, w0, w1, 15);
 718         /* kl1 */
 719         subL[8] = krll; subR[8] = krlr;
 720         /* kl2 */
 721         subL[9] = krrl; subR[9] = krrr;
 722         ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
 723         /* k13 */
 724         subL[18] = krll; subR[18] = krlr;
 725         /* k14 */
 726         subL[19] = krrl; subR[19] = krrr;
 727         ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 34);
 728         /* k19 */
 729         subL[26] = krll; subR[26] = krlr;
 730         /* k20 */
 731         subL[27] = krrl; subR[27] = krrr;
 732         ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 34);
 733
 734         /* generate KA */
 735         kll = subL[0] ^ krll; klr = subR[0] ^ krlr;
 736         krl = subL[1] ^ krrl; krr = subR[1] ^ krrr;
 737         CAMELLIA_F(kll, klr,
 738                    CAMELLIA_SIGMA1L, CAMELLIA_SIGMA1R,
 739                    w0, w1, il, ir, t0, t1);
 740         krl ^= w0; krr ^= w1;
 741         CAMELLIA_F(krl, krr,
 742                    CAMELLIA_SIGMA2L, CAMELLIA_SIGMA2R,
 743                    kll, klr, il, ir, t0, t1);
 744         kll ^= krll; klr ^= krlr;
 745         CAMELLIA_F(kll, klr,
 746                    CAMELLIA_SIGMA3L, CAMELLIA_SIGMA3R,
 747                    krl, krr, il, ir, t0, t1);
 748         krl ^= w0 ^ krrl; krr ^= w1 ^ krrr;
 749         CAMELLIA_F(krl, krr,
 750                    CAMELLIA_SIGMA4L, CAMELLIA_SIGMA4R,
 751                    w0, w1, il, ir, t0, t1);
 752         kll ^= w0; klr ^= w1;
 753
 754         /* generate KB */
 755         krll ^= kll; krlr ^= klr;
 756         krrl ^= krl; krrr ^= krr;
 757         CAMELLIA_F(krll, krlr,
 758                    CAMELLIA_SIGMA5L, CAMELLIA_SIGMA5R,
 759                    w0, w1, il, ir, t0, t1);
 760         krrl ^= w0; krrr ^= w1;
 761         CAMELLIA_F(krrl, krrr,
 762                    CAMELLIA_SIGMA6L, CAMELLIA_SIGMA6R,
 763                    w0, w1, il, ir, t0, t1);
 764         krll ^= w0; krlr ^= w1;
 765
 766         /* generate KA dependent subkeys */
 767         ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 768         /* k5 */
 769         subL[6] = kll; subR[6] = klr;
 770         /* k6 */
 771         subL[7] = krl; subR[7] = krr;
 772         ROLDQ(kll, klr, krl, krr, w0, w1, 30);
 773         /* k11 */
 774         subL[14] = kll; subR[14] = klr;
 775         /* k12 */
 776         subL[15] = krl; subR[15] = krr;
 777         /* rotation left shift 32bit */
 778         /* kl5 */
 779         subL[24] = klr; subR[24] = krl;
 780         /* kl6 */
 781         subL[25] = krr; subR[25] = kll;
 782         /* rotation left shift 49 from k11,k12 -> k21,k22 */
 783         ROLDQo32(kll, klr, krl, krr, w0, w1, 49);
 784         /* k21 */
 785         subL[28] = kll; subR[28] = klr;
 786         /* k22 */
 787         subL[29] = krl; subR[29] = krr;
 788
 789         /* generate KB dependent subkeys */
 790         /* k1 */
 791         subL[2] = krll; subR[2] = krlr;
 792         /* k2 */
 793         subL[3] = krrl; subR[3] = krrr;
 794         ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
 795         /* k7 */
 796         subL[10] = krll; subR[10] = krlr;
 797         /* k8 */
 798         subL[11] = krrl; subR[11] = krrr;
 799         ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
 800         /* k15 */
 801         subL[20] = krll; subR[20] = krlr;
 802         /* k16 */
 803         subL[21] = krrl; subR[21] = krrr;
 804         ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 51);
 805         /* kw3 */
 806         subL[32] = krll; subR[32] = krlr;
 807         /* kw4 */
 808         subL[33] = krrl; subR[33] = krrr;
 809
 810         camellia_setup_tail(subkey, subL, subR, 32);
 811 }
 812
 813 static void camellia_setup192(const unsigned char *key, u32 *subkey)
 814 {
 815         unsigned char kk[32];
 816         u32 krll, krlr, krrl, krrr;
 817
 818         memcpy(kk, key, 24);
 819         memcpy((unsigned char *)&krll, key+16, 4);
 820         memcpy((unsigned char *)&krlr, key+20, 4);
 821         krrl = ~krll;
 822         krrr = ~krlr;
 823         memcpy(kk+24, (unsigned char *)&krrl, 4);
 824         memcpy(kk+28, (unsigned char *)&krrr, 4);
 825         camellia_setup256(kk, subkey);
 826 }
 827
 828
 829 /*
 830  * Encrypt/decrypt
 831  */
 832 #define CAMELLIA_FLS(ll, lr, rl, rr, kll, klr, krl, krr, t0, t1, t2, t3) ({ \
 833         t0 = kll;                                                       \
 834         t2 = krr;                                                       \
 835         t0 &= ll;                                                       \
 836         t2 |= rr;                                                       \
 837         rl ^= t2;                                                       \
 838         lr ^= rol32(t0, 1);                                             \
 839         t3 = krl;                                                       \
 840         t1 = klr;                                                       \
 841         t3 &= rl;                                                       \
 842         t1 |= lr;                                                       \
 843         ll ^= t1;                                                       \
 844         rr ^= rol32(t3, 1);                                             \
 845 })
 846
 847 #define CAMELLIA_ROUNDSM(xl, xr, kl, kr, yl, yr, il, ir) ({             \
 848         yl ^= kl;                                                       \
 849         yr ^= kr;                                                       \
 850         ir =  camellia_sp1110[(u8)xr];                                  \
 851         il =  camellia_sp1110[(u8)(xl >> 24)];                          \
 852         ir ^= camellia_sp0222[(u8)(xr >> 24)];                          \
 853         il ^= camellia_sp0222[(u8)(xl >> 16)];                          \
 854         ir ^= camellia_sp3033[(u8)(xr >> 16)];                          \
 855         il ^= camellia_sp3033[(u8)(xl >> 8)];                           \
 856         ir ^= camellia_sp4404[(u8)(xr >> 8)];                           \
 857         il ^= camellia_sp4404[(u8)xl];                                  \
 858         ir ^= il;                                                       \
 859         yl ^= ir;                                                       \
 860         yr ^= ror32(il, 8) ^ ir;                                        \
 861 })
 862
 863 /* max = 24: 128bit encrypt, max = 32: 256bit encrypt */
 864 static void camellia_do_encrypt(const u32 *subkey, u32 *io, unsigned max)
 865 {
 866         u32 il, ir, t0, t1;            /* temporary variables */
 867
 868         /* pre whitening but absorb kw2 */
 869         io[0] ^= SUBKEY_L(0);
 870         io[1] ^= SUBKEY_R(0);
 871
 872         /* main iteration */
 873 #define ROUNDS(i) ({ \
 874         CAMELLIA_ROUNDSM(io[0], io[1], \
 875                          SUBKEY_L(i + 2), SUBKEY_R(i + 2), \
 876                          io[2], io[3], il, ir); \
 877         CAMELLIA_ROUNDSM(io[2], io[3], \
 878                          SUBKEY_L(i + 3), SUBKEY_R(i + 3), \
 879                          io[0], io[1], il, ir); \
 880         CAMELLIA_ROUNDSM(io[0], io[1], \
 881                          SUBKEY_L(i + 4), SUBKEY_R(i + 4), \
 882                          io[2], io[3], il, ir); \
 883         CAMELLIA_ROUNDSM(io[2], io[3], \
 884                          SUBKEY_L(i + 5), SUBKEY_R(i + 5), \
 885                          io[0], io[1], il, ir); \
 886         CAMELLIA_ROUNDSM(io[0], io[1], \
 887                          SUBKEY_L(i + 6), SUBKEY_R(i + 6), \
 888                          io[2], io[3], il, ir); \
 889         CAMELLIA_ROUNDSM(io[2], io[3], \
 890                          SUBKEY_L(i + 7), SUBKEY_R(i + 7), \
 891                          io[0], io[1], il, ir); \
 892 })
 893 #define FLS(i) ({ \
 894         CAMELLIA_FLS(io[0], io[1], io[2], io[3], \
 895                      SUBKEY_L(i + 0), SUBKEY_R(i + 0), \
 896                      SUBKEY_L(i + 1), SUBKEY_R(i + 1), \
 897                      t0, t1, il, ir); \
 898 })
 899
 900         ROUNDS(0);
 901         FLS(8);
 902         ROUNDS(8);
 903         FLS(16);
 904         ROUNDS(16);
 905         if (max == 32) {
 906                 FLS(24);
 907                 ROUNDS(24);
 908         }
 909
 910 #undef ROUNDS
 911 #undef FLS
 912
 913         /* post whitening but kw4 */
 914         io[2] ^= SUBKEY_L(max);
 915         io[3] ^= SUBKEY_R(max);
 916         /* NB: io[0],[1] should be swapped with [2],[3] by caller! */
 917 }
 918
 919 static void camellia_do_decrypt(const u32 *subkey, u32 *io, unsigned i)
 920 {
 921         u32 il, ir, t0, t1;            /* temporary variables */
 922
 923         /* pre whitening but absorb kw2 */
 924         io[0] ^= SUBKEY_L(i);
 925         io[1] ^= SUBKEY_R(i);
 926
 927         /* main iteration */
 928 #define ROUNDS(i) ({ \
 929         CAMELLIA_ROUNDSM(io[0], io[1], \
 930                          SUBKEY_L(i + 7), SUBKEY_R(i + 7), \
 931                          io[2], io[3], il, ir); \
 932         CAMELLIA_ROUNDSM(io[2], io[3], \
 933                          SUBKEY_L(i + 6), SUBKEY_R(i + 6), \
 934                          io[0], io[1], il, ir); \
 935         CAMELLIA_ROUNDSM(io[0], io[1], \
 936                          SUBKEY_L(i + 5), SUBKEY_R(i + 5), \
 937                          io[2], io[3], il, ir); \
 938         CAMELLIA_ROUNDSM(io[2], io[3], \
 939                          SUBKEY_L(i + 4), SUBKEY_R(i + 4), \
 940                          io[0], io[1], il, ir); \
 941         CAMELLIA_ROUNDSM(io[0], io[1], \
 942                          SUBKEY_L(i + 3), SUBKEY_R(i + 3), \
 943                          io[2], io[3], il, ir); \
 944         CAMELLIA_ROUNDSM(io[2], io[3], \
 945                          SUBKEY_L(i + 2), SUBKEY_R(i + 2), \
 946                          io[0], io[1], il, ir); \
 947 })
 948 #define FLS(i) ({ \
 949         CAMELLIA_FLS(io[0], io[1], io[2], io[3], \
 950                      SUBKEY_L(i + 1), SUBKEY_R(i + 1), \
 951                      SUBKEY_L(i + 0), SUBKEY_R(i + 0), \
 952                      t0, t1, il, ir); \
 953 })
 954
 955         if (i == 32) {
 956                 ROUNDS(24);
 957                 FLS(24);
 958         }
 959         ROUNDS(16);
 960         FLS(16);
 961         ROUNDS(8);
 962         FLS(8);
 963         ROUNDS(0);
 964
 965 #undef ROUNDS
 966 #undef FLS
 967
 968         /* post whitening but kw4 */
 969         io[2] ^= SUBKEY_L(0);
 970         io[3] ^= SUBKEY_R(0);
 971         /* NB: 0,1 should be swapped with 2,3 by caller! */
 972 }
 973
 974
 975 struct camellia_ctx {
 976         int key_length;
 977         u32 key_table[CAMELLIA_TABLE_BYTE_LEN / sizeof(u32)];
 978 };
 979
 980 static int
 981 camellia_set_key(struct crypto_tfm *tfm, const u8 *in_key,
 982                  unsigned int key_len)
 983 {
 984         struct camellia_ctx *cctx = crypto_tfm_ctx(tfm);
 985         const unsigned char *key = (const unsigned char *)in_key;
 986         u32 *flags = &tfm->crt_flags;
 987
 988         if (key_len != 16 && key_len != 24 && key_len != 32) {
 989                 *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
 990                 return -EINVAL;
 991         }
 992
 993         cctx->key_length = key_len;
 994
 995         switch (key_len) {
 996         case 16:
 997                 camellia_setup128(key, cctx->key_table);
 998                 break;
 999         case 24:
1000                 camellia_setup192(key, cctx->key_table);
1001                 break;
1002         case 32:
1003                 camellia_setup256(key, cctx->key_table);
1004                 break;
1005         }
1006
1007         return 0;
1008 }
1009
1010 static void camellia_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
1011 {
1012         const struct camellia_ctx *cctx = crypto_tfm_ctx(tfm);
1013         const __be32 *src = (const __be32 *)in;
1014         __be32 *dst = (__be32 *)out;
1015         unsigned int max;
1016
1017         u32 tmp[4];
1018
1019         tmp[0] = be32_to_cpu(src[0]);
1020         tmp[1] = be32_to_cpu(src[1]);
1021         tmp[2] = be32_to_cpu(src[2]);
1022         tmp[3] = be32_to_cpu(src[3]);
1023
1024         if (cctx->key_length == 16)
1025                 max = 24;
1026         else
1027                 max = 32; /* for key lengths of 24 and 32 */
1028
1029         camellia_do_encrypt(cctx->key_table, tmp, max);
1030
1031         /* do_encrypt returns 0,1 swapped with 2,3 */
1032         dst[0] = cpu_to_be32(tmp[2]);
1033         dst[1] = cpu_to_be32(tmp[3]);
1034         dst[2] = cpu_to_be32(tmp[0]);
1035         dst[3] = cpu_to_be32(tmp[1]);
1036 }
1037
1038 static void camellia_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
1039 {
1040         const struct camellia_ctx *cctx = crypto_tfm_ctx(tfm);
1041         const __be32 *src = (const __be32 *)in;
1042         __be32 *dst = (__be32 *)out;
1043         unsigned int max;
1044
1045         u32 tmp[4];
1046
1047         tmp[0] = be32_to_cpu(src[0]);
1048         tmp[1] = be32_to_cpu(src[1]);
1049         tmp[2] = be32_to_cpu(src[2]);
1050         tmp[3] = be32_to_cpu(src[3]);
1051
1052         if (cctx->key_length == 16)
1053                 max = 24;
1054         else
1055                 max = 32; /* for key lengths of 24 and 32 */
1056
1057         camellia_do_decrypt(cctx->key_table, tmp, max);
1058
1059         /* do_decrypt returns 0,1 swapped with 2,3 */
1060         dst[0] = cpu_to_be32(tmp[2]);
1061         dst[1] = cpu_to_be32(tmp[3]);
1062         dst[2] = cpu_to_be32(tmp[0]);
1063         dst[3] = cpu_to_be32(tmp[1]);
1064 }
1065
1066 static struct crypto_alg camellia_alg = {
1067         .cra_name               =       "camellia",
1068         .cra_driver_name        =       "camellia-generic",
1069         .cra_priority           =       100,
1070         .cra_flags              =       CRYPTO_ALG_TYPE_CIPHER,
1071         .cra_blocksize          =       CAMELLIA_BLOCK_SIZE,
1072         .cra_ctxsize            =       sizeof(struct camellia_ctx),
1073         .cra_alignmask          =       3,
1074         .cra_module             =       THIS_MODULE,
1075         .cra_u                  =       {
1076                 .cipher = {
1077                         .cia_min_keysize        =       CAMELLIA_MIN_KEY_SIZE,
1078                         .cia_max_keysize        =       CAMELLIA_MAX_KEY_SIZE,
1079                         .cia_setkey             =       camellia_set_key,
1080                         .cia_encrypt            =       camellia_encrypt,
1081                         .cia_decrypt            =       camellia_decrypt
1082                 }
1083         }
1084 };
1085
1086 static int __init camellia_init(void)
1087 {
1088         return crypto_register_alg(&camellia_alg);
1089 }
1090
1091 static void __exit camellia_fini(void)
1092 {
1093         crypto_unregister_alg(&camellia_alg);
1094 }
1095
1096 module_init(camellia_init);
1097 module_exit(camellia_fini);
1098
1099 MODULE_DESCRIPTION("Camellia Cipher Algorithm");
1100 MODULE_LICENSE("GPL");
1101 MODULE_ALIAS("camellia");