1 /* $FreeBSD: src/sys/opencrypto/cast.c,v 1.1.2.1 2002/11/21 23:34:23 sam Exp $ */
2 /* $DragonFly: src/sys/opencrypto/cast.c,v 1.2 2003/06/17 04:28:54 dillon Exp $ */
3 /* $OpenBSD: cast.c,v 1.2 2000/06/06 06:49:47 deraadt Exp $ */
7 * Written by Steve Reid <sreid@sea-to-sky.net>
8 * 100% Public Domain - no warranty
12 #include <sys/types.h>
13 #include <opencrypto/cast.h>
14 #include <opencrypto/castsb.h>
16 /* Macros to access 8-bit bytes out of a 32-bit word */
17 #define U_INT8_Ta(x) ( (u_int8_t) (x>>24) )
18 #define U_INT8_Tb(x) ( (u_int8_t) ((x>>16)&255) )
19 #define U_INT8_Tc(x) ( (u_int8_t) ((x>>8)&255) )
20 #define U_INT8_Td(x) ( (u_int8_t) ((x)&255) )
22 /* Circular left shift */
23 #define ROL(x, n) ( ((x)<<(n)) | ((x)>>(32-(n))) )
25 /* CAST-128 uses three different round functions */
27 t = ROL(key->xkey[i] + r, key->xkey[i+16]); \
28 l ^= ((cast_sbox1[U_INT8_Ta(t)] ^ cast_sbox2[U_INT8_Tb(t)]) - \
29 cast_sbox3[U_INT8_Tc(t)]) + cast_sbox4[U_INT8_Td(t)];
31 t = ROL(key->xkey[i] ^ r, key->xkey[i+16]); \
32 l ^= ((cast_sbox1[U_INT8_Ta(t)] - cast_sbox2[U_INT8_Tb(t)]) + \
33 cast_sbox3[U_INT8_Tc(t)]) ^ cast_sbox4[U_INT8_Td(t)];
35 t = ROL(key->xkey[i] - r, key->xkey[i+16]); \
36 l ^= ((cast_sbox1[U_INT8_Ta(t)] + cast_sbox2[U_INT8_Tb(t)]) ^ \
37 cast_sbox3[U_INT8_Tc(t)]) - cast_sbox4[U_INT8_Td(t)];
40 /***** Encryption Function *****/
42 void cast_encrypt(cast_key
* key
, u_int8_t
* inblock
, u_int8_t
* outblock
)
46 /* Get inblock into l,r */
47 l
= ((u_int32_t
)inblock
[0] << 24) | ((u_int32_t
)inblock
[1] << 16) |
48 ((u_int32_t
)inblock
[2] << 8) | (u_int32_t
)inblock
[3];
49 r
= ((u_int32_t
)inblock
[4] << 24) | ((u_int32_t
)inblock
[5] << 16) |
50 ((u_int32_t
)inblock
[6] << 8) | (u_int32_t
)inblock
[7];
64 /* Only do full 16 rounds if key length > 80 bits */
65 if (key
->rounds
> 12) {
71 /* Put l,r into outblock */
72 outblock
[0] = U_INT8_Ta(r
);
73 outblock
[1] = U_INT8_Tb(r
);
74 outblock
[2] = U_INT8_Tc(r
);
75 outblock
[3] = U_INT8_Td(r
);
76 outblock
[4] = U_INT8_Ta(l
);
77 outblock
[5] = U_INT8_Tb(l
);
78 outblock
[6] = U_INT8_Tc(l
);
79 outblock
[7] = U_INT8_Td(l
);
85 /***** Decryption Function *****/
87 void cast_decrypt(cast_key
* key
, u_int8_t
* inblock
, u_int8_t
* outblock
)
91 /* Get inblock into l,r */
92 r
= ((u_int32_t
)inblock
[0] << 24) | ((u_int32_t
)inblock
[1] << 16) |
93 ((u_int32_t
)inblock
[2] << 8) | (u_int32_t
)inblock
[3];
94 l
= ((u_int32_t
)inblock
[4] << 24) | ((u_int32_t
)inblock
[5] << 16) |
95 ((u_int32_t
)inblock
[6] << 8) | (u_int32_t
)inblock
[7];
97 /* Only do full 16 rounds if key length > 80 bits */
98 if (key
->rounds
> 12) {
116 /* Put l,r into outblock */
117 outblock
[0] = U_INT8_Ta(l
);
118 outblock
[1] = U_INT8_Tb(l
);
119 outblock
[2] = U_INT8_Tc(l
);
120 outblock
[3] = U_INT8_Td(l
);
121 outblock
[4] = U_INT8_Ta(r
);
122 outblock
[5] = U_INT8_Tb(r
);
123 outblock
[6] = U_INT8_Tc(r
);
124 outblock
[7] = U_INT8_Td(r
);
130 /***** Key Schedual *****/
132 void cast_setkey(cast_key
* key
, u_int8_t
* rawkey
, int keybytes
)
134 u_int32_t t
[4], z
[4], x
[4];
137 /* Remove compiler warnings */
138 for (i
= 0; i
< 4; i
++) {
142 /* Set number of rounds to 12 or 16, depending on key length */
143 key
->rounds
= (keybytes
<= 10 ? 12 : 16);
145 /* Copy key to workspace x */
146 for (i
= 0; i
< 4; i
++) {
148 if ((i
*4+0) < keybytes
) x
[i
] = (u_int32_t
)rawkey
[i
*4+0] << 24;
149 if ((i
*4+1) < keybytes
) x
[i
] |= (u_int32_t
)rawkey
[i
*4+1] << 16;
150 if ((i
*4+2) < keybytes
) x
[i
] |= (u_int32_t
)rawkey
[i
*4+2] << 8;
151 if ((i
*4+3) < keybytes
) x
[i
] |= (u_int32_t
)rawkey
[i
*4+3];
153 /* Generate 32 subkeys, four at a time */
154 for (i
= 0; i
< 32; i
+=4) {
157 t
[0] = z
[0] = x
[0] ^ cast_sbox5
[U_INT8_Tb(x
[3])] ^
158 cast_sbox6
[U_INT8_Td(x
[3])] ^ cast_sbox7
[U_INT8_Ta(x
[3])] ^
159 cast_sbox8
[U_INT8_Tc(x
[3])] ^ cast_sbox7
[U_INT8_Ta(x
[2])];
160 t
[1] = z
[1] = x
[2] ^ cast_sbox5
[U_INT8_Ta(z
[0])] ^
161 cast_sbox6
[U_INT8_Tc(z
[0])] ^ cast_sbox7
[U_INT8_Tb(z
[0])] ^
162 cast_sbox8
[U_INT8_Td(z
[0])] ^ cast_sbox8
[U_INT8_Tc(x
[2])];
163 t
[2] = z
[2] = x
[3] ^ cast_sbox5
[U_INT8_Td(z
[1])] ^
164 cast_sbox6
[U_INT8_Tc(z
[1])] ^ cast_sbox7
[U_INT8_Tb(z
[1])] ^
165 cast_sbox8
[U_INT8_Ta(z
[1])] ^ cast_sbox5
[U_INT8_Tb(x
[2])];
166 t
[3] = z
[3] = x
[1] ^ cast_sbox5
[U_INT8_Tc(z
[2])] ^
167 cast_sbox6
[U_INT8_Tb(z
[2])] ^ cast_sbox7
[U_INT8_Td(z
[2])] ^
168 cast_sbox8
[U_INT8_Ta(z
[2])] ^ cast_sbox6
[U_INT8_Td(x
[2])];
171 t
[0] = x
[0] = z
[2] ^ cast_sbox5
[U_INT8_Tb(z
[1])] ^
172 cast_sbox6
[U_INT8_Td(z
[1])] ^ cast_sbox7
[U_INT8_Ta(z
[1])] ^
173 cast_sbox8
[U_INT8_Tc(z
[1])] ^ cast_sbox7
[U_INT8_Ta(z
[0])];
174 t
[1] = x
[1] = z
[0] ^ cast_sbox5
[U_INT8_Ta(x
[0])] ^
175 cast_sbox6
[U_INT8_Tc(x
[0])] ^ cast_sbox7
[U_INT8_Tb(x
[0])] ^
176 cast_sbox8
[U_INT8_Td(x
[0])] ^ cast_sbox8
[U_INT8_Tc(z
[0])];
177 t
[2] = x
[2] = z
[1] ^ cast_sbox5
[U_INT8_Td(x
[1])] ^
178 cast_sbox6
[U_INT8_Tc(x
[1])] ^ cast_sbox7
[U_INT8_Tb(x
[1])] ^
179 cast_sbox8
[U_INT8_Ta(x
[1])] ^ cast_sbox5
[U_INT8_Tb(z
[0])];
180 t
[3] = x
[3] = z
[3] ^ cast_sbox5
[U_INT8_Tc(x
[2])] ^
181 cast_sbox6
[U_INT8_Tb(x
[2])] ^ cast_sbox7
[U_INT8_Td(x
[2])] ^
182 cast_sbox8
[U_INT8_Ta(x
[2])] ^ cast_sbox6
[U_INT8_Td(z
[0])];
188 key
->xkey
[i
+0] = cast_sbox5
[U_INT8_Ta(t
[2])] ^ cast_sbox6
[U_INT8_Tb(t
[2])] ^
189 cast_sbox7
[U_INT8_Td(t
[1])] ^ cast_sbox8
[U_INT8_Tc(t
[1])];
190 key
->xkey
[i
+1] = cast_sbox5
[U_INT8_Tc(t
[2])] ^ cast_sbox6
[U_INT8_Td(t
[2])] ^
191 cast_sbox7
[U_INT8_Tb(t
[1])] ^ cast_sbox8
[U_INT8_Ta(t
[1])];
192 key
->xkey
[i
+2] = cast_sbox5
[U_INT8_Ta(t
[3])] ^ cast_sbox6
[U_INT8_Tb(t
[3])] ^
193 cast_sbox7
[U_INT8_Td(t
[0])] ^ cast_sbox8
[U_INT8_Tc(t
[0])];
194 key
->xkey
[i
+3] = cast_sbox5
[U_INT8_Tc(t
[3])] ^ cast_sbox6
[U_INT8_Td(t
[3])] ^
195 cast_sbox7
[U_INT8_Tb(t
[0])] ^ cast_sbox8
[U_INT8_Ta(t
[0])];
199 key
->xkey
[i
+0] = cast_sbox5
[U_INT8_Td(t
[0])] ^ cast_sbox6
[U_INT8_Tc(t
[0])] ^
200 cast_sbox7
[U_INT8_Ta(t
[3])] ^ cast_sbox8
[U_INT8_Tb(t
[3])];
201 key
->xkey
[i
+1] = cast_sbox5
[U_INT8_Tb(t
[0])] ^ cast_sbox6
[U_INT8_Ta(t
[0])] ^
202 cast_sbox7
[U_INT8_Tc(t
[3])] ^ cast_sbox8
[U_INT8_Td(t
[3])];
203 key
->xkey
[i
+2] = cast_sbox5
[U_INT8_Td(t
[1])] ^ cast_sbox6
[U_INT8_Tc(t
[1])] ^
204 cast_sbox7
[U_INT8_Ta(t
[2])] ^ cast_sbox8
[U_INT8_Tb(t
[2])];
205 key
->xkey
[i
+3] = cast_sbox5
[U_INT8_Tb(t
[1])] ^ cast_sbox6
[U_INT8_Ta(t
[1])] ^
206 cast_sbox7
[U_INT8_Tc(t
[2])] ^ cast_sbox8
[U_INT8_Td(t
[2])];
211 key
->xkey
[i
+0] ^= cast_sbox5
[U_INT8_Tc(z
[0])];
212 key
->xkey
[i
+1] ^= cast_sbox6
[U_INT8_Tc(z
[1])];
213 key
->xkey
[i
+2] ^= cast_sbox7
[U_INT8_Tb(z
[2])];
214 key
->xkey
[i
+3] ^= cast_sbox8
[U_INT8_Ta(z
[3])];
217 key
->xkey
[i
+0] ^= cast_sbox5
[U_INT8_Ta(x
[2])];
218 key
->xkey
[i
+1] ^= cast_sbox6
[U_INT8_Tb(x
[3])];
219 key
->xkey
[i
+2] ^= cast_sbox7
[U_INT8_Td(x
[0])];
220 key
->xkey
[i
+3] ^= cast_sbox8
[U_INT8_Td(x
[1])];
223 key
->xkey
[i
+0] ^= cast_sbox5
[U_INT8_Tb(z
[2])];
224 key
->xkey
[i
+1] ^= cast_sbox6
[U_INT8_Ta(z
[3])];
225 key
->xkey
[i
+2] ^= cast_sbox7
[U_INT8_Tc(z
[0])];
226 key
->xkey
[i
+3] ^= cast_sbox8
[U_INT8_Tc(z
[1])];
229 key
->xkey
[i
+0] ^= cast_sbox5
[U_INT8_Td(x
[0])];
230 key
->xkey
[i
+1] ^= cast_sbox6
[U_INT8_Td(x
[1])];
231 key
->xkey
[i
+2] ^= cast_sbox7
[U_INT8_Ta(x
[2])];
232 key
->xkey
[i
+3] ^= cast_sbox8
[U_INT8_Tb(x
[3])];
236 key
->xkey
[i
+0] &= 31;
237 key
->xkey
[i
+1] &= 31;
238 key
->xkey
[i
+2] &= 31;
239 key
->xkey
[i
+3] &= 31;
243 for (i
= 0; i
< 4; i
++) {
244 t
[i
] = x
[i
] = z
[i
] = 0;