CAST.c 8.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284
  1. /*
  2. cast.c -- implementation of CAST-128 (aka CAST5) as described in RFC2144
  3. Written in 1997 by Wim Lewis <wiml@hhhh.org> based entirely on RFC2144.
  4. Minor modifications made in 2002 by Andrew M. Kuchling <amk@amk.ca>.
  5. ===================================================================
  6. The contents of this file are dedicated to the public domain. To
  7. the extent that dedication to the public domain is not available,
  8. everyone is granted a worldwide, perpetual, royalty-free,
  9. non-exclusive license to exercise all rights associated with the
  10. contents of this file for any purpose whatsoever.
  11. No rights are reserved.
  12. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  13. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  14. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  15. NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
  16. BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
  17. ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  18. CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  19. SOFTWARE.
  20. ===================================================================
  21. Consult your local laws for possible restrictions on use, distribution, and
  22. import/export. RFC2144 states that this algorithm "is available worldwide
  23. on a royalty-free basis for commercial and non-commercial uses".
  24. This code is a pretty straightforward transliteration of the RFC into C.
  25. It has not been optimized much at all: byte-order-independent arithmetic
  26. operations are used where order-dependent pointer ops or unions might be
  27. faster; the code could be rearranged to give the optimizer a better
  28. chance to speed things up; etc.
  29. This code requires a vaguely ANSI-ish compiler.
  30. compile -DTEST to include main() which performs the tests
  31. specified in RFC2144
  32. Tested with gcc 2.5.8 on i486, i586, i686, hp pa-risc, mc68040, sparc;
  33. also with gcc 2.7.2 and (with minor changes) native Sun compiler on sparc
  34. */
  35. #include "common.h"
  36. #include "endianess.h"
  37. #include "block_base.h"
  38. FAKE_INIT(raw_cast)
  39. #define MODULE_NAME CAST
  40. #define BLOCK_SIZE 8
  41. #define KEY_SIZE 0
  42. /* this struct probably belongs in cast.h */
  43. struct block_state {
  44. /* masking and rotate keys */
  45. uint32_t Km[16];
  46. uint8_t Kr[16];
  47. /* number of rounds (depends on original unpadded keylength) */
  48. unsigned rounds;
  49. };
  50. /* these are the eight 32*256 S-boxes */
  51. #include "cast5.c"
  52. /* this is the round function f(D, Km, Kr) */
  53. static uint32_t castfunc(uint32_t D, uint32_t Kmi, uint8_t Kri, unsigned type)
  54. {
  55. uint32_t I, f;
  56. uint8_t Ibe[4];
  57. #define Ia Ibe[0]
  58. #define Ib Ibe[1]
  59. #define Ic Ibe[2]
  60. #define Id Ibe[3]
  61. switch(type) {
  62. case 0:
  63. I = (Kmi + D) ;
  64. break;
  65. case 1:
  66. I = (Kmi ^ D) ;
  67. break;
  68. default:
  69. case 2:
  70. I = (Kmi - D) ;
  71. break;
  72. }
  73. if (Kri>0) {
  74. I = ( I << Kri ) | ( I >> ( 32-Kri ) );
  75. }
  76. STORE_U32_BIG(Ibe, I);
  77. switch(type) {
  78. case 0:
  79. f = ((S1[Ia] ^ S2[Ib]) - S3[Ic]) + S4[Id];
  80. break;
  81. case 1:
  82. f = ((S1[Ia] - S2[Ib]) + S3[Ic]) ^ S4[Id];
  83. break;
  84. default:
  85. case 2:
  86. f = ((S1[Ia] + S2[Ib]) ^ S3[Ic]) - S4[Id];
  87. break;
  88. }
  89. return f;
  90. }
  91. /* encrypts/decrypts one block of data according to the key schedule
  92. pointed to by `key'. Encrypts if decrypt=0, otherwise decrypts. */
  93. static void castcrypt(struct block_state *key, uint8_t *block, int decrypt)
  94. {
  95. uint32_t L, R, tmp, f;
  96. uint32_t Kmi;
  97. uint8_t Kri;
  98. unsigned functype, round;
  99. L = LOAD_U32_BIG(block + 0);
  100. R = LOAD_U32_BIG(block + 4);
  101. for(round = 0; round < key->rounds; round ++) {
  102. if (!decrypt) {
  103. Kmi = key->Km[round];
  104. Kri = key->Kr[round];
  105. functype = round % 3;
  106. } else {
  107. Kmi = key->Km[(key->rounds) - round - 1];
  108. Kri = key->Kr[(key->rounds) - round - 1];
  109. functype = (((key->rounds) - round - 1) % 3);
  110. }
  111. f = castfunc(R, Kmi, Kri, functype);
  112. tmp = L;
  113. L = R;
  114. R = tmp ^ f;
  115. }
  116. STORE_U32_BIG(block + 0, R);
  117. STORE_U32_BIG(block + 4, L);
  118. }
  119. /* fetch a uint8_t from an array of uint32_ts */
  120. #define b(a,n) (((a)[n/4] >> (24-((n&3)*8))) & 0xFF)
  121. /* key schedule round functions */
  122. #define XZRound(T, F, ki1, ki2, ki3, ki4, \
  123. si11, si12, si13, si14, si15,\
  124. si25,\
  125. si35,\
  126. si45 ) \
  127. T[0] = F[ki1] ^ S5[si11 ] ^ S6[si12 ] ^ S7[si13 ] ^ S8[si14 ] ^ S7[si15];\
  128. T[1] = F[ki2] ^ S5[b(T, 0)] ^ S6[b(T,2)] ^ S7[b(T, 1)] ^ S8[b(T,3)] ^ S8[si25];\
  129. T[2] = F[ki3] ^ S5[b(T, 7)] ^ S6[b(T,6)] ^ S7[b(T, 5)] ^ S8[b(T,4)] ^ S5[si35];\
  130. T[3] = F[ki4] ^ S5[b(T,10)] ^ S6[b(T,9)] ^ S7[b(T,11)] ^ S8[b(T,8)] ^ S6[si45];
  131. #define zxround() XZRound(z, x, 0, 2, 3, 1, \
  132. b(x,13), b(x,15), b(x,12), b(x,14),\
  133. b(x, 8), b(x,10), b(x, 9), b(x,11))
  134. #define xzround() XZRound(x, z, 2, 0, 1, 3, \
  135. b(z,5), b(z,7), b(z,4), b(z,6), \
  136. b(z,0), b(z,2), b(z,1), b(z,3))
  137. #define Kround(T, base, F,\
  138. i11, i12, i13, i14, i15,\
  139. i21, i22, i23, i24, i25,\
  140. i31, i32, i33, i34, i35,\
  141. i41, i42, i43, i44, i45)\
  142. T[base+0] = S5[b(F,i11)] ^ S6[b(F,i12)] ^ S7[b(F,i13)] ^ S8[b(F,i14)] ^ S5[b(F,i15)];\
  143. T[base+1] = S5[b(F,i21)] ^ S6[b(F,i22)] ^ S7[b(F,i23)] ^ S8[b(F,i24)] ^ S6[b(F,i25)];\
  144. T[base+2] = S5[b(F,i31)] ^ S6[b(F,i32)] ^ S7[b(F,i33)] ^ S8[b(F,i34)] ^ S7[b(F,i35)];\
  145. T[base+3] = S5[b(F,i41)] ^ S6[b(F,i42)] ^ S7[b(F,i43)] ^ S8[b(F,i44)] ^ S8[b(F,i45)];
  146. /* generates sixteen 32-bit subkeys based on a 4x32-bit input key;
  147. modifies the input key *in as well. */
  148. static void schedulekeys_half(uint32_t *in, uint32_t *keys)
  149. {
  150. uint32_t x[4], z[4];
  151. x[0] = in[0];
  152. x[1] = in[1];
  153. x[2] = in[2];
  154. x[3] = in[3];
  155. zxround();
  156. Kround(keys, 0, z,
  157. 8, 9, 7, 6, 2,
  158. 10, 11, 5, 4, 6,
  159. 12, 13, 3, 2, 9,
  160. 14, 15, 1, 0, 12);
  161. xzround();
  162. Kround(keys, 4, x,
  163. 3, 2, 12, 13, 8,
  164. 1, 0, 14, 15, 13,
  165. 7, 6, 8, 9, 3,
  166. 5, 4, 10, 11, 7);
  167. zxround();
  168. Kround(keys, 8, z,
  169. 3, 2, 12, 13, 9,
  170. 1, 0, 14, 15, 12,
  171. 7, 6, 8, 9, 2,
  172. 5, 4, 10, 11, 6);
  173. xzround();
  174. Kround(keys, 12, x,
  175. 8, 9, 7, 6, 3,
  176. 10, 11, 5, 4, 7,
  177. 12, 13, 3, 2, 8,
  178. 14, 15, 1, 0, 13);
  179. in[0] = x[0];
  180. in[1] = x[1];
  181. in[2] = x[2];
  182. in[3] = x[3];
  183. }
  184. /* generates a key schedule from an input key */
  185. static void castschedulekeys(struct block_state *schedule, const uint8_t *key, size_t keybytes)
  186. {
  187. uint32_t x[4];
  188. uint8_t paddedkey[16];
  189. uint32_t Kr_wide[16];
  190. unsigned i;
  191. for(i = 0; i < keybytes; i++)
  192. paddedkey[i] = key[i];
  193. for( ; i < 16 ; i++)
  194. paddedkey[i] = 0;
  195. if (keybytes <= 10)
  196. schedule->rounds = 12;
  197. else
  198. schedule->rounds = 16;
  199. x[0] = LOAD_U32_BIG(paddedkey + 0);
  200. x[1] = LOAD_U32_BIG(paddedkey + 4);
  201. x[2] = LOAD_U32_BIG(paddedkey + 8);
  202. x[3] = LOAD_U32_BIG(paddedkey + 12);
  203. schedulekeys_half(x, schedule->Km);
  204. schedulekeys_half(x, Kr_wide);
  205. for(i = 0; i < 16; i ++) {
  206. /* The Kr[] subkeys are used for 32-bit circular shifts,
  207. so we only need to keep them modulo 32 */
  208. schedule->Kr[i] = (uint8_t)(Kr_wide[i] & 0x1F);
  209. }
  210. }
  211. static int
  212. block_init(struct block_state *self, const uint8_t *key, size_t keylength)
  213. {
  214. /* make sure the key length is within bounds */
  215. if (keylength < 5 || keylength > 16) {
  216. return ERR_KEY_SIZE;
  217. }
  218. /* do the actual key schedule setup */
  219. castschedulekeys(self, key, keylength);
  220. return 0;
  221. }
  222. static void block_finalize(struct block_state* self)
  223. {
  224. }
  225. static void
  226. block_encrypt(struct block_state *self, const uint8_t *in, uint8_t *out)
  227. {
  228. memcpy(out, in, 8);
  229. castcrypt(self, out, 0);
  230. }
  231. static void block_decrypt(struct block_state *self, const uint8_t *in, uint8_t *out)
  232. {
  233. memcpy(out, in, 8);
  234. castcrypt(self, out, 1);
  235. }
  236. #include "block_common.c"