camellia-crypt-internal.c 5.29 KB
Newer Older
1 2 3 4 5
/* camellia-crypt-internal.c
 *
 * Copyright (C) 2006,2007
 * NTT (Nippon Telegraph and Telephone Corporation).
 *
Niels Möller's avatar
Niels Möller committed
6
 * Copyright (C) 2010 Niels Möller
7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
 */

/*
 * Algorithm Specification 
 *  http://info.isl.ntt.co.jp/crypt/eng/camellia/specifications.html
 */

/* Based on camellia.c ver 1.2.0, see
   http://info.isl.ntt.co.jp/crypt/eng/camellia/dl/camellia-LGPL-1.2.0.tar.gz.
 */
#if HAVE_CONFIG_H
# include "config.h"
#endif

#include <assert.h>
36
#include <limits.h>
37 38 39 40 41 42 43 44 45 46 47 48

#include "camellia-internal.h"

#include "macros.h"

#define CAMELLIA_FL(x, k) do {			\
  uint32_t __xl, __xr, __kl, __kr, __t;		\
  __xl = (x) >> 32;				\
  __xr = (x) & 0xffffffff;			\
  __kl = (k) >> 32;				\
  __kr = (k) & 0xffffffff;			\
  __t = __xl & __kl;				\
49
  __xr ^= ROTL32(1, __t);			\
50 51 52 53 54 55 56 57 58 59 60 61
  __xl ^= (__xr | __kr);			\
  (x) = ((uint64_t) __xl << 32) | __xr;		\
} while (0)

#define CAMELLIA_FLINV(x, k) do {		\
  uint32_t __xl, __xr, __kl, __kr, __t;		\
  __xl = (x) >> 32;				\
  __xr = (x) & 0xffffffff;			\
  __kl = (k) >> 32;				\
  __kr = (k) & 0xffffffff;			\
  __xl ^= (__xr | __kr);			\
  __t = __xl & __kl;				\
62
  __xr ^= ROTL32(1, __t);			\
63 64 65
  (x) = ((uint64_t) __xl << 32) | __xr;		\
} while (0)

66
#if HAVE_NATIVE_64_BIT
67 68 69
#define CAMELLIA_ROUNDSM(T, x, k, y) do {			\
    uint32_t __il, __ir;					\
    __ir							\
70 71 72 73
      = T->sp1110[(x) & 0xff]					\
      ^ T->sp0222[((x) >> 24) & 0xff]				\
      ^ T->sp3033[((x) >> 16) & 0xff]				\
      ^ T->sp4404[((x) >> 8) & 0xff];				\
74 75
    /* ir == (t6^t7^t8),(t5^t7^t8),(t5^t6^t8),(t5^t6^t7) */	\
    __il							\
76 77 78 79
      = T->sp1110[ (x) >> 56]					\
      ^ T->sp0222[((x) >> 48) & 0xff]				\
      ^ T->sp3033[((x) >> 40) & 0xff]				\
      ^ T->sp4404[((x) >> 32) & 0xff];				\
80 81 82
    /* il == (t1^t3^t4),(t1^t2^t4),(t1^t2^t3),(t2^t3^t4) */	\
    __ir ^= __il;						\
    /* ir == (t1^t3^t4^t6^t7^t8),(t1^t2^t4^t5^t7^t8),		\
83 84
       (t1^t2^t3^t5^t6^t8),(t2^t3^t4^t5^t6^t7)			\
       == y1,y2,y3,y4 */					\
85
    __il = ROTL32(24, __il);					\
86 87 88
    /* il == (t2^t3^t4),(t1^t3^t4),(t1^t2^t4),(t1^t2^t3) */	\
    __il ^= __ir;						\
    /* il == (t1^t2^t6^t7^t8),(t2^t3^t5^t7^t8),			\
89 90
       (t3^t4^t5^t6^t8),(t1^t4^t5^t6^t7)			\
       == y5,y6,y7,y8 */					\
91
    y ^= (k);							\
92 93
    y ^= ((uint64_t) __ir << 32) | __il;			\
  } while (0)
94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114
#else /* !HAVE_NATIVE_64_BIT */
#define CAMELLIA_ROUNDSM(T, x, k, y) do {			\
    uint32_t __il, __ir;					\
    __ir							\
      = T->sp1110[(x) & 0xff]					\
      ^ T->sp0222[((x) >> 24) & 0xff]				\
      ^ T->sp3033[((x) >> 16) & 0xff]				\
      ^ T->sp4404[((x) >> 8) & 0xff];				\
    /* ir == (t6^t7^t8),(t5^t7^t8),(t5^t6^t8),(t5^t6^t7) */	\
    __il							\
      = T->sp1110[ (x) >> 56]					\
      ^ T->sp0222[((x) >> 48) & 0xff]				\
      ^ T->sp3033[((x) >> 40) & 0xff]				\
      ^ T->sp4404[((x) >> 32) & 0xff];				\
    /* il == (t1^t3^t4),(t1^t2^t4),(t1^t2^t3),(t2^t3^t4) */	\
    __il ^= (k) >> 32;						\
    __ir ^= (k) & 0xffffffff;					\
    __ir ^= __il;						\
    /* ir == (t1^t3^t4^t6^t7^t8),(t1^t2^t4^t5^t7^t8),		\
       (t1^t2^t3^t5^t6^t8),(t2^t3^t4^t5^t6^t7)			\
       == y1,y2,y3,y4 */					\
115
    __il = ROTL32(24, __il);					\
116 117 118 119 120 121 122 123
    /* il == (t2^t3^t4),(t1^t3^t4),(t1^t2^t4),(t1^t2^t3) */	\
    __il ^= __ir;						\
    /* il == (t1^t2^t6^t7^t8),(t2^t3^t5^t7^t8),			\
       (t3^t4^t5^t6^t8),(t1^t4^t5^t6^t7)			\
       == y5,y6,y7,y8 */					\
    y ^= ((uint64_t) __ir << 32) | __il;			\
  } while (0)
#endif
124 125 126 127

void
_camellia_crypt(const struct camellia_ctx *ctx,
		const struct camellia_table *T,
128
		size_t length, uint8_t *dst,
129 130 131 132 133 134 135 136 137 138 139 140 141 142 143
		const uint8_t *src)
{
  FOR_BLOCKS(length, dst, src, CAMELLIA_BLOCK_SIZE)
    {
      uint64_t i0,i1;
      unsigned i;

      i0 = READ_UINT64(src);
      i1 = READ_UINT64(src +  8);
      
      /* pre whitening but absorb kw2*/
      i0 ^= ctx->keys[0];

      /* main iteration */

144 145 146 147 148 149
      CAMELLIA_ROUNDSM(T, i0,ctx->keys[1], i1);
      CAMELLIA_ROUNDSM(T, i1,ctx->keys[2], i0);
      CAMELLIA_ROUNDSM(T, i0,ctx->keys[3], i1);
      CAMELLIA_ROUNDSM(T, i1,ctx->keys[4], i0);
      CAMELLIA_ROUNDSM(T, i0,ctx->keys[5], i1);
      CAMELLIA_ROUNDSM(T, i1,ctx->keys[6], i0);
150
      
151
      for (i = 0; i < ctx->nkeys - 8; i+= 8)
152
	{
153 154
	  CAMELLIA_FL(i0, ctx->keys[i+7]);
	  CAMELLIA_FLINV(i1, ctx->keys[i+8]);
155
	  
156 157 158 159 160 161
	  CAMELLIA_ROUNDSM(T, i0,ctx->keys[i+9], i1);
	  CAMELLIA_ROUNDSM(T, i1,ctx->keys[i+10], i0);
	  CAMELLIA_ROUNDSM(T, i0,ctx->keys[i+11], i1);
	  CAMELLIA_ROUNDSM(T, i1,ctx->keys[i+12], i0);
	  CAMELLIA_ROUNDSM(T, i0,ctx->keys[i+13], i1);
	  CAMELLIA_ROUNDSM(T, i1,ctx->keys[i+14], i0);
162 163 164
	}

      /* post whitening but kw4 */
165
      i1 ^= ctx->keys[i+7];
166 167 168 169 170

      WRITE_UINT64(dst     , i1);
      WRITE_UINT64(dst +  8, i0);
    }
}