| blob | 134d6fc255a44302a6a49dc1eb8a462af82d1de7 |
1 #include <assert.h>\r
2 #include "ssh.h"\r
3 \r
4 \r
5 /* des.c - implementation of DES\r
6 */\r
7 \r
8 /*\r
9 * Description of DES\r
10 * ------------------\r
11 *\r
12 * Unlike the description in FIPS 46, I'm going to use _sensible_ indices:\r
13 * bits in an n-bit word are numbered from 0 at the LSB to n-1 at the MSB.\r
14 * And S-boxes are indexed by six consecutive bits, not by the outer two\r
15 * followed by the middle four.\r
16 *\r
17 * The DES encryption routine requires a 64-bit input, and a key schedule K\r
18 * containing 16 48-bit elements.\r
19 *\r
20 * First the input is permuted by the initial permutation IP.\r
21 * Then the input is split into 32-bit words L and R. (L is the MSW.)\r
22 * Next, 16 rounds. In each round:\r
23 * (L, R) <- (R, L xor f(R, K[i]))\r
24 * Then the pre-output words L and R are swapped.\r
25 * Then L and R are glued back together into a 64-bit word. (L is the MSW,\r
26 * again, but since we just swapped them, the MSW is the R that came out\r
27 * of the last round.)\r
28 * The 64-bit output block is permuted by the inverse of IP and returned.\r
29 *\r
30 * Decryption is identical except that the elements of K are used in the\r
31 * opposite order. (This wouldn't work if that word swap didn't happen.)\r
32 *\r
33 * The function f, used in each round, accepts a 32-bit word R and a\r
34 * 48-bit key block K. It produces a 32-bit output.\r
35 *\r
36 * First R is expanded to 48 bits using the bit-selection function E.\r
37 * The resulting 48-bit block is XORed with the key block K to produce\r
38 * a 48-bit block X.\r
39 * This block X is split into eight groups of 6 bits. Each group of 6\r
40 * bits is then looked up in one of the eight S-boxes to convert\r
41 * it to 4 bits. These eight groups of 4 bits are glued back\r
42 * together to produce a 32-bit preoutput block.\r
43 * The preoutput block is permuted using the permutation P and returned.\r
44 *\r
45 * Key setup maps a 64-bit key word into a 16x48-bit key schedule. Although\r
46 * the approved input format for the key is a 64-bit word, eight of the\r
47 * bits are discarded, so the actual quantity of key used is 56 bits.\r
48 *\r
49 * First the input key is converted to two 28-bit words C and D using\r
50 * the bit-selection function PC1.\r
51 * Then 16 rounds of key setup occur. In each round, C and D are each\r
52 * rotated left by either 1 or 2 bits (depending on which round), and\r
53 * then converted into a key schedule element using the bit-selection\r
54 * function PC2.\r
55 *\r
56 * That's the actual algorithm. Now for the tedious details: all those\r
57 * painful permutations and lookup tables.\r
58 *\r
59 * IP is a 64-to-64 bit permutation. Its output contains the following\r
60 * bits of its input (listed in order MSB to LSB of output).\r
61 *\r
62 * 6 14 22 30 38 46 54 62 4 12 20 28 36 44 52 60\r
63 * 2 10 18 26 34 42 50 58 0 8 16 24 32 40 48 56\r
64 * 7 15 23 31 39 47 55 63 5 13 21 29 37 45 53 61\r
65 * 3 11 19 27 35 43 51 59 1 9 17 25 33 41 49 57\r
66 *\r
67 * E is a 32-to-48 bit selection function. Its output contains the following\r
68 * bits of its input (listed in order MSB to LSB of output).\r
69 *\r
70 * 0 31 30 29 28 27 28 27 26 25 24 23 24 23 22 21 20 19 20 19 18 17 16 15\r
71 * 16 15 14 13 12 11 12 11 10 9 8 7 8 7 6 5 4 3 4 3 2 1 0 31\r
72 *\r
73 * The S-boxes are arbitrary table-lookups each mapping a 6-bit input to a\r
74 * 4-bit output. In other words, each S-box is an array[64] of 4-bit numbers.\r
75 * The S-boxes are listed below. The first S-box listed is applied to the\r
76 * most significant six bits of the block X; the last one is applied to the\r
77 * least significant.\r
78 *\r
79 * 14 0 4 15 13 7 1 4 2 14 15 2 11 13 8 1\r
80 * 3 10 10 6 6 12 12 11 5 9 9 5 0 3 7 8\r
81 * 4 15 1 12 14 8 8 2 13 4 6 9 2 1 11 7\r
82 * 15 5 12 11 9 3 7 14 3 10 10 0 5 6 0 13\r
83 *\r
84 * 15 3 1 13 8 4 14 7 6 15 11 2 3 8 4 14\r
85 * 9 12 7 0 2 1 13 10 12 6 0 9 5 11 10 5\r
86 * 0 13 14 8 7 10 11 1 10 3 4 15 13 4 1 2\r
87 * 5 11 8 6 12 7 6 12 9 0 3 5 2 14 15 9\r
88 *\r
89 * 10 13 0 7 9 0 14 9 6 3 3 4 15 6 5 10\r
90 * 1 2 13 8 12 5 7 14 11 12 4 11 2 15 8 1\r
91 * 13 1 6 10 4 13 9 0 8 6 15 9 3 8 0 7\r
92 * 11 4 1 15 2 14 12 3 5 11 10 5 14 2 7 12\r
93 *\r
94 * 7 13 13 8 14 11 3 5 0 6 6 15 9 0 10 3\r
95 * 1 4 2 7 8 2 5 12 11 1 12 10 4 14 15 9\r
96 * 10 3 6 15 9 0 0 6 12 10 11 1 7 13 13 8\r
97 * 15 9 1 4 3 5 14 11 5 12 2 7 8 2 4 14\r
98 *\r
99 * 2 14 12 11 4 2 1 12 7 4 10 7 11 13 6 1\r
100 * 8 5 5 0 3 15 15 10 13 3 0 9 14 8 9 6\r
101 * 4 11 2 8 1 12 11 7 10 1 13 14 7 2 8 13\r
102 * 15 6 9 15 12 0 5 9 6 10 3 4 0 5 14 3\r
103 *\r
104 * 12 10 1 15 10 4 15 2 9 7 2 12 6 9 8 5\r
105 * 0 6 13 1 3 13 4 14 14 0 7 11 5 3 11 8\r
106 * 9 4 14 3 15 2 5 12 2 9 8 5 12 15 3 10\r
107 * 7 11 0 14 4 1 10 7 1 6 13 0 11 8 6 13\r
108 *\r
109 * 4 13 11 0 2 11 14 7 15 4 0 9 8 1 13 10\r
110 * 3 14 12 3 9 5 7 12 5 2 10 15 6 8 1 6\r
111 * 1 6 4 11 11 13 13 8 12 1 3 4 7 10 14 7\r
112 * 10 9 15 5 6 0 8 15 0 14 5 2 9 3 2 12\r
113 *\r
114 * 13 1 2 15 8 13 4 8 6 10 15 3 11 7 1 4\r
115 * 10 12 9 5 3 6 14 11 5 0 0 14 12 9 7 2\r
116 * 7 2 11 1 4 14 1 7 9 4 12 10 14 8 2 13\r
117 * 0 15 6 12 10 9 13 0 15 3 3 5 5 6 8 11\r
118 *\r
119 * P is a 32-to-32 bit permutation. Its output contains the following\r
120 * bits of its input (listed in order MSB to LSB of output).\r
121 *\r
122 * 16 25 12 11 3 20 4 15 31 17 9 6 27 14 1 22\r
123 * 30 24 8 18 0 5 29 23 13 19 2 26 10 21 28 7\r
124 *\r
125 * PC1 is a 64-to-56 bit selection function. Its output is in two words,\r
126 * C and D. The word C contains the following bits of its input (listed\r
127 * in order MSB to LSB of output).\r
128 *\r
129 * 7 15 23 31 39 47 55 63 6 14 22 30 38 46\r
130 * 54 62 5 13 21 29 37 45 53 61 4 12 20 28\r
131 *\r
132 * And the word D contains these bits.\r
133 *\r
134 * 1 9 17 25 33 41 49 57 2 10 18 26 34 42\r
135 * 50 58 3 11 19 27 35 43 51 59 36 44 52 60\r
136 *\r
137 * PC2 is a 56-to-48 bit selection function. Its input is in two words,\r
138 * C and D. These are treated as one 56-bit word (with C more significant,\r
139 * so that bits 55 to 28 of the word are bits 27 to 0 of C, and bits 27 to\r
140 * 0 of the word are bits 27 to 0 of D). The output contains the following\r
141 * bits of this 56-bit input word (listed in order MSB to LSB of output).\r
142 *\r
143 * 42 39 45 32 55 51 53 28 41 50 35 46 33 37 44 52 30 48 40 49 29 36 43 54\r
144 * 15 4 25 19 9 1 26 16 5 11 23 8 12 7 17 0 22 3 10 14 6 20 27 24\r
145 */\r
146 \r
147 /*\r
148 * Implementation details\r
149 * ----------------------\r
150 * \r
151 * If you look at the code in this module, you'll find it looks\r
152 * nothing _like_ the above algorithm. Here I explain the\r
153 * differences...\r
154 *\r
155 * Key setup has not been heavily optimised here. We are not\r
156 * concerned with key agility: we aren't codebreakers. We don't\r
157 * mind a little delay (and it really is a little one; it may be a\r
158 * factor of five or so slower than it could be but it's still not\r
159 * an appreciable length of time) while setting up. The only tweaks\r
160 * in the key setup are ones which change the format of the key\r
161 * schedule to speed up the actual encryption. I'll describe those\r
162 * below.\r
163 *\r
164 * The first and most obvious optimisation is the S-boxes. Since\r
165 * each S-box always targets the same four bits in the final 32-bit\r
166 * word, so the output from (for example) S-box 0 must always be\r
167 * shifted left 28 bits, we can store the already-shifted outputs\r
168 * in the lookup tables. This reduces lookup-and-shift to lookup,\r
169 * so the S-box step is now just a question of ORing together eight\r
170 * table lookups.\r
171 *\r
172 * The permutation P is just a bit order change; it's invariant\r
173 * with respect to OR, in that P(x)|P(y) = P(x|y). Therefore, we\r
174 * can apply P to every entry of the S-box tables and then we don't\r
175 * have to do it in the code of f(). This yields a set of tables\r
176 * which might be called SP-boxes.\r
177 *\r
178 * The bit-selection function E is our next target. Note that E is\r
179 * immediately followed by the operation of splitting into 6-bit\r
180 * chunks. Examining the 6-bit chunks coming out of E we notice\r
181 * they're all contiguous within the word (speaking cyclically -\r
182 * the end two wrap round); so we can extract those bit strings\r
183 * individually rather than explicitly running E. This would yield\r
184 * code such as\r
185 *\r
186 * y |= SPboxes[0][ (rotl(R, 5) ^ top6bitsofK) & 0x3F ];\r
187 * t |= SPboxes[1][ (rotl(R,11) ^ next6bitsofK) & 0x3F ];\r
188 *\r
189 * and so on; and the key schedule preparation would have to\r
190 * provide each 6-bit chunk separately.\r
191 *\r
192 * Really we'd like to XOR in the key schedule element before\r
193 * looking up bit strings in R. This we can't do, naively, because\r
194 * the 6-bit strings we want overlap. But look at the strings:\r
195 *\r
196 * 3322222222221111111111\r
197 * bit 10987654321098765432109876543210\r
198 * \r
199 * box0 XXXXX X\r
200 * box1 XXXXXX\r
201 * box2 XXXXXX\r
202 * box3 XXXXXX\r
203 * box4 XXXXXX\r
204 * box5 XXXXXX\r
205 * box6 XXXXXX\r
206 * box7 X XXXXX\r
207 *\r
208 * The bit strings we need to XOR in for boxes 0, 2, 4 and 6 don't\r
209 * overlap with each other. Neither do the ones for boxes 1, 3, 5\r
210 * and 7. So we could provide the key schedule in the form of two\r
211 * words that we can separately XOR into R, and then every S-box\r
212 * index is available as a (cyclically) contiguous 6-bit substring\r
213 * of one or the other of the results.\r
214 *\r
215 * The comments in Eric Young's libdes implementation point out\r
216 * that two of these bit strings require a rotation (rather than a\r
217 * simple shift) to extract. It's unavoidable that at least _one_\r
218 * must do; but we can actually run the whole inner algorithm (all\r
219 * 16 rounds) rotated one bit to the left, so that what the `real'\r
220 * DES description sees as L=0x80000001 we see as L=0x00000003.\r
221 * This requires rotating all our SP-box entries one bit to the\r
222 * left, and rotating each word of the key schedule elements one to\r
223 * the left, and rotating L and R one bit left just after IP and\r
224 * one bit right again just before FP. And in each round we convert\r
225 * a rotate into a shift, so we've saved a few per cent.\r
226 *\r
227 * That's about it for the inner loop; the SP-box tables as listed\r
228 * below are what I've described here (the original S value,\r
229 * shifted to its final place in the input to P, run through P, and\r
230 * then rotated one bit left). All that remains is to optimise the\r
231 * initial permutation IP.\r
232 *\r
233 * IP is not an arbitrary permutation. It has the nice property\r
234 * that if you take any bit number, write it in binary (6 bits),\r
235 * permute those 6 bits and invert some of them, you get the final\r
236 * position of that bit. Specifically, the bit whose initial\r
237 * position is given (in binary) as fedcba ends up in position\r
238 * AcbFED (where a capital letter denotes the inverse of a bit).\r
239 *\r
240 * We have the 64-bit data in two 32-bit words L and R, where bits\r
241 * in L are those with f=1 and bits in R are those with f=0. We\r
242 * note that we can do a simple transformation: suppose we exchange\r
243 * the bits with f=1,c=0 and the bits with f=0,c=1. This will cause\r
244 * the bit fedcba to be in position cedfba - we've `swapped' bits c\r
245 * and f in the position of each bit!\r
246 * \r
247 * Better still, this transformation is easy. In the example above,\r
248 * bits in L with c=0 are bits 0x0F0F0F0F, and those in R with c=1\r
249 * are 0xF0F0F0F0. So we can do\r
250 *\r
251 * difference = ((R >> 4) ^ L) & 0x0F0F0F0F\r
252 * R ^= (difference << 4)\r
253 * L ^= difference\r
254 *\r
255 * to perform the swap. Let's denote this by bitswap(4,0x0F0F0F0F).\r
256 * Also, we can invert the bit at the top just by exchanging L and\r
257 * R. So in a few swaps and a few of these bit operations we can\r
258 * do:\r
259 * \r
260 * Initially the position of bit fedcba is fedcba\r
261 * Swap L with R to make it Fedcba\r
262 * Perform bitswap( 4,0x0F0F0F0F) to make it cedFba\r
263 * Perform bitswap(16,0x0000FFFF) to make it ecdFba\r
264 * Swap L with R to make it EcdFba\r
265 * Perform bitswap( 2,0x33333333) to make it bcdFEa\r
266 * Perform bitswap( 8,0x00FF00FF) to make it dcbFEa\r
267 * Swap L with R to make it DcbFEa\r
268 * Perform bitswap( 1,0x55555555) to make it acbFED\r
269 * Swap L with R to make it AcbFED\r
270 *\r
271 * (In the actual code the four swaps are implicit: R and L are\r
272 * simply used the other way round in the first, second and last\r
273 * bitswap operations.)\r
274 *\r
275 * The final permutation is just the inverse of IP, so it can be\r
276 * performed by a similar set of operations.\r
277 */\r
278 \r
279 typedef struct {\r
280 word32 k0246[16], k1357[16];\r
281 word32 iv0, iv1;\r
282 } DESContext;\r
283 \r
284 #define rotl(x, c) ( (x << c) | (x >> (32-c)) )\r
285 #define rotl28(x, c) ( ( (x << c) | (x >> (28-c)) ) & 0x0FFFFFFF)\r
286 \r
287 static word32 bitsel(word32 * input, const int *bitnums, int size)\r
288 {\r
289 word32 ret = 0;\r
290 while (size--) {\r
291 int bitpos = *bitnums++;\r
292 ret <<= 1;\r
293 if (bitpos >= 0)\r
294 ret |= 1 & (input[bitpos / 32] >> (bitpos % 32));\r
295 }\r
296 return ret;\r
297 }\r
298 \r
299 static void des_key_setup(word32 key_msw, word32 key_lsw, DESContext * sched)\r
300 {\r
301 \r
302 static const int PC1_Cbits[] = {\r
303 7, 15, 23, 31, 39, 47, 55, 63, 6, 14, 22, 30, 38, 46,\r
304 54, 62, 5, 13, 21, 29, 37, 45, 53, 61, 4, 12, 20, 28\r
305 };\r
306 static const int PC1_Dbits[] = {\r
307 1, 9, 17, 25, 33, 41, 49, 57, 2, 10, 18, 26, 34, 42,\r
308 50, 58, 3, 11, 19, 27, 35, 43, 51, 59, 36, 44, 52, 60\r
309 };\r
310 /*\r
311 * The bit numbers in the two lists below don't correspond to\r
312 * the ones in the above description of PC2, because in the\r
313 * above description C and D are concatenated so `bit 28' means\r
314 * bit 0 of C. In this implementation we're using the standard\r
315 * `bitsel' function above and C is in the second word, so bit\r
316 * 0 of C is addressed by writing `32' here.\r
317 */\r
318 static const int PC2_0246[] = {\r
319 49, 36, 59, 55, -1, -1, 37, 41, 48, 56, 34, 52, -1, -1, 15, 4,\r
320 25, 19, 9, 1, -1, -1, 12, 7, 17, 0, 22, 3, -1, -1, 46, 43\r
321 };\r
322 static const int PC2_1357[] = {\r
323 -1, -1, 57, 32, 45, 54, 39, 50, -1, -1, 44, 53, 33, 40, 47, 58,\r
324 -1, -1, 26, 16, 5, 11, 23, 8, -1, -1, 10, 14, 6, 20, 27, 24\r
325 };\r
326 static const int leftshifts[] =\r
327 { 1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1 };\r
328 \r
329 word32 C, D;\r
330 word32 buf[2];\r
331 int i;\r
332 \r
333 buf[0] = key_lsw;\r
334 buf[1] = key_msw;\r
335 \r
336 C = bitsel(buf, PC1_Cbits, 28);\r
337 D = bitsel(buf, PC1_Dbits, 28);\r
338 \r
339 for (i = 0; i < 16; i++) {\r
340 C = rotl28(C, leftshifts[i]);\r
341 D = rotl28(D, leftshifts[i]);\r
342 buf[0] = D;\r
343 buf[1] = C;\r
344 sched->k0246[i] = bitsel(buf, PC2_0246, 32);\r
345 sched->k1357[i] = bitsel(buf, PC2_1357, 32);\r
346 }\r
347 \r
348 sched->iv0 = sched->iv1 = 0;\r
349 }\r
350 \r
351 static const word32 SPboxes[8][64] = {\r
352 {0x01010400, 0x00000000, 0x00010000, 0x01010404,\r
353 0x01010004, 0x00010404, 0x00000004, 0x00010000,\r
354 0x00000400, 0x01010400, 0x01010404, 0x00000400,\r
355 0x01000404, 0x01010004, 0x01000000, 0x00000004,\r
356 0x00000404, 0x01000400, 0x01000400, 0x00010400,\r
357 0x00010400, 0x01010000, 0x01010000, 0x01000404,\r
358 0x00010004, 0x01000004, 0x01000004, 0x00010004,\r
359 0x00000000, 0x00000404, 0x00010404, 0x01000000,\r
360 0x00010000, 0x01010404, 0x00000004, 0x01010000,\r
361 0x01010400, 0x01000000, 0x01000000, 0x00000400,\r
362 0x01010004, 0x00010000, 0x00010400, 0x01000004,\r
363 0x00000400, 0x00000004, 0x01000404, 0x00010404,\r
364 0x01010404, 0x00010004, 0x01010000, 0x01000404,\r
365 0x01000004, 0x00000404, 0x00010404, 0x01010400,\r
366 0x00000404, 0x01000400, 0x01000400, 0x00000000,\r
367 0x00010004, 0x00010400, 0x00000000, 0x01010004L},\r
368 \r
369 {0x80108020, 0x80008000, 0x00008000, 0x00108020,\r
370 0x00100000, 0x00000020, 0x80100020, 0x80008020,\r
371 0x80000020, 0x80108020, 0x80108000, 0x80000000,\r
372 0x80008000, 0x00100000, 0x00000020, 0x80100020,\r
373 0x00108000, 0x00100020, 0x80008020, 0x00000000,\r
374 0x80000000, 0x00008000, 0x00108020, 0x80100000,\r
375 0x00100020, 0x80000020, 0x00000000, 0x00108000,\r
376 0x00008020, 0x80108000, 0x80100000, 0x00008020,\r
377 0x00000000, 0x00108020, 0x80100020, 0x00100000,\r
378 0x80008020, 0x80100000, 0x80108000, 0x00008000,\r
379 0x80100000, 0x80008000, 0x00000020, 0x80108020,\r
380 0x00108020, 0x00000020, 0x00008000, 0x80000000,\r
381 0x00008020, 0x80108000, 0x00100000, 0x80000020,\r
382 0x00100020, 0x80008020, 0x80000020, 0x00100020,\r
383 0x00108000, 0x00000000, 0x80008000, 0x00008020,\r
384 0x80000000, 0x80100020, 0x80108020, 0x00108000L},\r
385 \r
386 {0x00000208, 0x08020200, 0x00000000, 0x08020008,\r
387 0x08000200, 0x00000000, 0x00020208, 0x08000200,\r
388 0x00020008, 0x08000008, 0x08000008, 0x00020000,\r
389 0x08020208, 0x00020008, 0x08020000, 0x00000208,\r
390 0x08000000, 0x00000008, 0x08020200, 0x00000200,\r
391 0x00020200, 0x08020000, 0x08020008, 0x00020208,\r
392 0x08000208, 0x00020200, 0x00020000, 0x08000208,\r
393 0x00000008, 0x08020208, 0x00000200, 0x08000000,\r
394 0x08020200, 0x08000000, 0x00020008, 0x00000208,\r
395 0x00020000, 0x08020200, 0x08000200, 0x00000000,\r
396 0x00000200, 0x00020008, 0x08020208, 0x08000200,\r
397 0x08000008, 0x00000200, 0x00000000, 0x08020008,\r
398 0x08000208, 0x00020000, 0x08000000, 0x08020208,\r
399 0x00000008, 0x00020208, 0x00020200, 0x08000008,\r
400 0x08020000, 0x08000208, 0x00000208, 0x08020000,\r
401 0x00020208, 0x00000008, 0x08020008, 0x00020200L},\r
402 \r
403 {0x00802001, 0x00002081, 0x00002081, 0x00000080,\r
404 0x00802080, 0x00800081, 0x00800001, 0x00002001,\r
405 0x00000000, 0x00802000, 0x00802000, 0x00802081,\r
406 0x00000081, 0x00000000, 0x00800080, 0x00800001,\r
407 0x00000001, 0x00002000, 0x00800000, 0x00802001,\r
408 0x00000080, 0x00800000, 0x00002001, 0x00002080,\r
409 0x00800081, 0x00000001, 0x00002080, 0x00800080,\r
410 0x00002000, 0x00802080, 0x00802081, 0x00000081,\r
411 0x00800080, 0x00800001, 0x00802000, 0x00802081,\r
412 0x00000081, 0x00000000, 0x00000000, 0x00802000,\r
413 0x00002080, 0x00800080, 0x00800081, 0x00000001,\r
414 0x00802001, 0x00002081, 0x00002081, 0x00000080,\r
415 0x00802081, 0x00000081, 0x00000001, 0x00002000,\r
416 0x00800001, 0x00002001, 0x00802080, 0x00800081,\r
417 0x00002001, 0x00002080, 0x00800000, 0x00802001,\r
418 0x00000080, 0x00800000, 0x00002000, 0x00802080L},\r
419 \r
420 {0x00000100, 0x02080100, 0x02080000, 0x42000100,\r
421 0x00080000, 0x00000100, 0x40000000, 0x02080000,\r
422 0x40080100, 0x00080000, 0x02000100, 0x40080100,\r
423 0x42000100, 0x42080000, 0x00080100, 0x40000000,\r
424 0x02000000, 0x40080000, 0x40080000, 0x00000000,\r
425 0x40000100, 0x42080100, 0x42080100, 0x02000100,\r
426 0x42080000, 0x40000100, 0x00000000, 0x42000000,\r
427 0x02080100, 0x02000000, 0x42000000, 0x00080100,\r
428 0x00080000, 0x42000100, 0x00000100, 0x02000000,\r
429 0x40000000, 0x02080000, 0x42000100, 0x40080100,\r
430 0x02000100, 0x40000000, 0x42080000, 0x02080100,\r
431 0x40080100, 0x00000100, 0x02000000, 0x42080000,\r
432 0x42080100, 0x00080100, 0x42000000, 0x42080100,\r
433 0x02080000, 0x00000000, 0x40080000, 0x42000000,\r
434 0x00080100, 0x02000100, 0x40000100, 0x00080000,\r
435 0x00000000, 0x40080000, 0x02080100, 0x40000100L},\r
436 \r
437 {0x20000010, 0x20400000, 0x00004000, 0x20404010,\r
438 0x20400000, 0x00000010, 0x20404010, 0x00400000,\r
439 0x20004000, 0x00404010, 0x00400000, 0x20000010,\r
440 0x00400010, 0x20004000, 0x20000000, 0x00004010,\r
441 0x00000000, 0x00400010, 0x20004010, 0x00004000,\r
442 0x00404000, 0x20004010, 0x00000010, 0x20400010,\r
443 0x20400010, 0x00000000, 0x00404010, 0x20404000,\r
444 0x00004010, 0x00404000, 0x20404000, 0x20000000,\r
445 0x20004000, 0x00000010, 0x20400010, 0x00404000,\r
446 0x20404010, 0x00400000, 0x00004010, 0x20000010,\r
447 0x00400000, 0x20004000, 0x20000000, 0x00004010,\r
448 0x20000010, 0x20404010, 0x00404000, 0x20400000,\r
449 0x00404010, 0x20404000, 0x00000000, 0x20400010,\r
450 0x00000010, 0x00004000, 0x20400000, 0x00404010,\r
451 0x00004000, 0x00400010, 0x20004010, 0x00000000,\r
452 0x20404000, 0x20000000, 0x00400010, 0x20004010L},\r
453 \r
454 {0x00200000, 0x04200002, 0x04000802, 0x00000000,\r
455 0x00000800, 0x04000802, 0x00200802, 0x04200800,\r
456 0x04200802, 0x00200000, 0x00000000, 0x04000002,\r
457 0x00000002, 0x04000000, 0x04200002, 0x00000802,\r
458 0x04000800, 0x00200802, 0x00200002, 0x04000800,\r
459 0x04000002, 0x04200000, 0x04200800, 0x00200002,\r
460 0x04200000, 0x00000800, 0x00000802, 0x04200802,\r
461 0x00200800, 0x00000002, 0x04000000, 0x00200800,\r
462 0x04000000, 0x00200800, 0x00200000, 0x04000802,\r
463 0x04000802, 0x04200002, 0x04200002, 0x00000002,\r
464 0x00200002, 0x04000000, 0x04000800, 0x00200000,\r
465 0x04200800, 0x00000802, 0x00200802, 0x04200800,\r
466 0x00000802, 0x04000002, 0x04200802, 0x04200000,\r
467 0x00200800, 0x00000000, 0x00000002, 0x04200802,\r
468 0x00000000, 0x00200802, 0x04200000, 0x00000800,\r
469 0x04000002, 0x04000800, 0x00000800, 0x00200002L},\r
470 \r
471 {0x10001040, 0x00001000, 0x00040000, 0x10041040,\r
472 0x10000000, 0x10001040, 0x00000040, 0x10000000,\r
473 0x00040040, 0x10040000, 0x10041040, 0x00041000,\r
474 0x10041000, 0x00041040, 0x00001000, 0x00000040,\r
475 0x10040000, 0x10000040, 0x10001000, 0x00001040,\r
476 0x00041000, 0x00040040, 0x10040040, 0x10041000,\r
477 0x00001040, 0x00000000, 0x00000000, 0x10040040,\r
478 0x10000040, 0x10001000, 0x00041040, 0x00040000,\r
479 0x00041040, 0x00040000, 0x10041000, 0x00001000,\r
480 0x00000040, 0x10040040, 0x00001000, 0x00041040,\r
481 0x10001000, 0x00000040, 0x10000040, 0x10040000,\r
482 0x10040040, 0x10000000, 0x00040000, 0x10001040,\r
483 0x00000000, 0x10041040, 0x00040040, 0x10000040,\r
484 0x10040000, 0x10001000, 0x10001040, 0x00000000,\r
485 0x10041040, 0x00041000, 0x00041000, 0x00001040,\r
486 0x00001040, 0x00040040, 0x10000000, 0x10041000L}\r
487 };\r
488 \r
489 #define f(R, K0246, K1357) (\\r
490 s0246 = R ^ K0246, \\r
491 s1357 = R ^ K1357, \\r
492 s0246 = rotl(s0246, 28), \\r
493 SPboxes[0] [(s0246 >> 24) & 0x3F] | \\r
494 SPboxes[1] [(s1357 >> 24) & 0x3F] | \\r
495 SPboxes[2] [(s0246 >> 16) & 0x3F] | \\r
496 SPboxes[3] [(s1357 >> 16) & 0x3F] | \\r
497 SPboxes[4] [(s0246 >> 8) & 0x3F] | \\r
498 SPboxes[5] [(s1357 >> 8) & 0x3F] | \\r
499 SPboxes[6] [(s0246 ) & 0x3F] | \\r
500 SPboxes[7] [(s1357 ) & 0x3F])\r
501 \r
502 #define bitswap(L, R, n, mask) (\\r
503 swap = mask & ( (R >> n) ^ L ), \\r
504 R ^= swap << n, \\r
505 L ^= swap)\r
506 \r
507 /* Initial permutation */\r
508 #define IP(L, R) (\\r
509 bitswap(R, L, 4, 0x0F0F0F0F), \\r
510 bitswap(R, L, 16, 0x0000FFFF), \\r
511 bitswap(L, R, 2, 0x33333333), \\r
512 bitswap(L, R, 8, 0x00FF00FF), \\r
513 bitswap(R, L, 1, 0x55555555))\r
514 \r
515 /* Final permutation */\r
516 #define FP(L, R) (\\r
517 bitswap(R, L, 1, 0x55555555), \\r
518 bitswap(L, R, 8, 0x00FF00FF), \\r
519 bitswap(L, R, 2, 0x33333333), \\r
520 bitswap(R, L, 16, 0x0000FFFF), \\r
521 bitswap(R, L, 4, 0x0F0F0F0F))\r
522 \r
523 static void des_encipher(word32 * output, word32 L, word32 R,\r
524 DESContext * sched)\r
525 {\r
526 word32 swap, s0246, s1357;\r
527 \r
528 IP(L, R);\r
529 \r
530 L = rotl(L, 1);\r
531 R = rotl(R, 1);\r
532 \r
533 L ^= f(R, sched->k0246[0], sched->k1357[0]);\r
534 R ^= f(L, sched->k0246[1], sched->k1357[1]);\r
535 L ^= f(R, sched->k0246[2], sched->k1357[2]);\r
536 R ^= f(L, sched->k0246[3], sched->k1357[3]);\r
537 L ^= f(R, sched->k0246[4], sched->k1357[4]);\r
538 R ^= f(L, sched->k0246[5], sched->k1357[5]);\r
539 L ^= f(R, sched->k0246[6], sched->k1357[6]);\r
540 R ^= f(L, sched->k0246[7], sched->k1357[7]);\r
541 L ^= f(R, sched->k0246[8], sched->k1357[8]);\r
542 R ^= f(L, sched->k0246[9], sched->k1357[9]);\r
543 L ^= f(R, sched->k0246[10], sched->k1357[10]);\r
544 R ^= f(L, sched->k0246[11], sched->k1357[11]);\r
545 L ^= f(R, sched->k0246[12], sched->k1357[12]);\r
546 R ^= f(L, sched->k0246[13], sched->k1357[13]);\r
547 L ^= f(R, sched->k0246[14], sched->k1357[14]);\r
548 R ^= f(L, sched->k0246[15], sched->k1357[15]);\r
549 \r
550 L = rotl(L, 31);\r
551 R = rotl(R, 31);\r
552 \r
553 swap = L;\r
554 L = R;\r
555 R = swap;\r
556 \r
557 FP(L, R);\r
558 \r
559 output[0] = L;\r
560 output[1] = R;\r
561 }\r
562 \r
563 static void des_decipher(word32 * output, word32 L, word32 R,\r
564 DESContext * sched)\r
565 {\r
566 word32 swap, s0246, s1357;\r
567 \r
568 IP(L, R);\r
569 \r
570 L = rotl(L, 1);\r
571 R = rotl(R, 1);\r
572 \r
573 L ^= f(R, sched->k0246[15], sched->k1357[15]);\r
574 R ^= f(L, sched->k0246[14], sched->k1357[14]);\r
575 L ^= f(R, sched->k0246[13], sched->k1357[13]);\r
576 R ^= f(L, sched->k0246[12], sched->k1357[12]);\r
577 L ^= f(R, sched->k0246[11], sched->k1357[11]);\r
578 R ^= f(L, sched->k0246[10], sched->k1357[10]);\r
579 L ^= f(R, sched->k0246[9], sched->k1357[9]);\r
580 R ^= f(L, sched->k0246[8], sched->k1357[8]);\r
581 L ^= f(R, sched->k0246[7], sched->k1357[7]);\r
582 R ^= f(L, sched->k0246[6], sched->k1357[6]);\r
583 L ^= f(R, sched->k0246[5], sched->k1357[5]);\r
584 R ^= f(L, sched->k0246[4], sched->k1357[4]);\r
585 L ^= f(R, sched->k0246[3], sched->k1357[3]);\r
586 R ^= f(L, sched->k0246[2], sched->k1357[2]);\r
587 L ^= f(R, sched->k0246[1], sched->k1357[1]);\r
588 R ^= f(L, sched->k0246[0], sched->k1357[0]);\r
589 \r
590 L = rotl(L, 31);\r
591 R = rotl(R, 31);\r
592 \r
593 swap = L;\r
594 L = R;\r
595 R = swap;\r
596 \r
597 FP(L, R);\r
598 \r
599 output[0] = L;\r
600 output[1] = R;\r
601 }\r
602 \r
603 static void des_cbc_encrypt(unsigned char *blk,\r
604 unsigned int len, DESContext * sched)\r
605 {\r
606 word32 out[2], iv0, iv1;\r
607 unsigned int i;\r
608 \r
609 assert((len & 7) == 0);\r
610 \r
611 iv0 = sched->iv0;\r
612 iv1 = sched->iv1;\r
613 for (i = 0; i < len; i += 8) {\r
614 iv0 ^= GET_32BIT_MSB_FIRST(blk);\r
615 iv1 ^= GET_32BIT_MSB_FIRST(blk + 4);\r
616 des_encipher(out, iv0, iv1, sched);\r
617 iv0 = out[0];\r
618 iv1 = out[1];\r
619 PUT_32BIT_MSB_FIRST(blk, iv0);\r
620 PUT_32BIT_MSB_FIRST(blk + 4, iv1);\r
621 blk += 8;\r
622 }\r
623 sched->iv0 = iv0;\r
624 sched->iv1 = iv1;\r
625 }\r
626 \r
627 static void des_cbc_decrypt(unsigned char *blk,\r
628 unsigned int len, DESContext * sched)\r
629 {\r
630 word32 out[2], iv0, iv1, xL, xR;\r
631 unsigned int i;\r
632 \r
633 assert((len & 7) == 0);\r
634 \r
635 iv0 = sched->iv0;\r
636 iv1 = sched->iv1;\r
637 for (i = 0; i < len; i += 8) {\r
638 xL = GET_32BIT_MSB_FIRST(blk);\r
639 xR = GET_32BIT_MSB_FIRST(blk + 4);\r
640 des_decipher(out, xL, xR, sched);\r
641 iv0 ^= out[0];\r
642 iv1 ^= out[1];\r
643 PUT_32BIT_MSB_FIRST(blk, iv0);\r
644 PUT_32BIT_MSB_FIRST(blk + 4, iv1);\r
645 blk += 8;\r
646 iv0 = xL;\r
647 iv1 = xR;\r
648 }\r
649 sched->iv0 = iv0;\r
650 sched->iv1 = iv1;\r
651 }\r
652 \r
653 static void des_3cbc_encrypt(unsigned char *blk,\r
654 unsigned int len, DESContext * scheds)\r
655 {\r
656 des_cbc_encrypt(blk, len, &scheds[0]);\r
657 des_cbc_decrypt(blk, len, &scheds[1]);\r
658 des_cbc_encrypt(blk, len, &scheds[2]);\r
659 }\r
660 \r
661 static void des_cbc3_encrypt(unsigned char *blk,\r
662 unsigned int len, DESContext * scheds)\r
663 {\r
664 word32 out[2], iv0, iv1;\r
665 unsigned int i;\r
666 \r
667 assert((len & 7) == 0);\r
668 \r
669 iv0 = scheds->iv0;\r
670 iv1 = scheds->iv1;\r
671 for (i = 0; i < len; i += 8) {\r
672 iv0 ^= GET_32BIT_MSB_FIRST(blk);\r
673 iv1 ^= GET_32BIT_MSB_FIRST(blk + 4);\r
674 des_encipher(out, iv0, iv1, &scheds[0]);\r
675 des_decipher(out, out[0], out[1], &scheds[1]);\r
676 des_encipher(out, out[0], out[1], &scheds[2]);\r
677 iv0 = out[0];\r
678 iv1 = out[1];\r
679 PUT_32BIT_MSB_FIRST(blk, iv0);\r
680 PUT_32BIT_MSB_FIRST(blk + 4, iv1);\r
681 blk += 8;\r
682 }\r
683 scheds->iv0 = iv0;\r
684 scheds->iv1 = iv1;\r
685 }\r
686 \r
687 static void des_3cbc_decrypt(unsigned char *blk,\r
688 unsigned int len, DESContext * scheds)\r
689 {\r
690 des_cbc_decrypt(blk, len, &scheds[2]);\r
691 des_cbc_encrypt(blk, len, &scheds[1]);\r
692 des_cbc_decrypt(blk, len, &scheds[0]);\r
693 }\r
694 \r
695 static void des_cbc3_decrypt(unsigned char *blk,\r
696 unsigned int len, DESContext * scheds)\r
697 {\r
698 word32 out[2], iv0, iv1, xL, xR;\r
699 unsigned int i;\r
700 \r
701 assert((len & 7) == 0);\r
702 \r
703 iv0 = scheds->iv0;\r
704 iv1 = scheds->iv1;\r
705 for (i = 0; i < len; i += 8) {\r
706 xL = GET_32BIT_MSB_FIRST(blk);\r
707 xR = GET_32BIT_MSB_FIRST(blk + 4);\r
708 des_decipher(out, xL, xR, &scheds[2]);\r
709 des_encipher(out, out[0], out[1], &scheds[1]);\r
710 des_decipher(out, out[0], out[1], &scheds[0]);\r
711 iv0 ^= out[0];\r
712 iv1 ^= out[1];\r
713 PUT_32BIT_MSB_FIRST(blk, iv0);\r
714 PUT_32BIT_MSB_FIRST(blk + 4, iv1);\r
715 blk += 8;\r
716 iv0 = xL;\r
717 iv1 = xR;\r
718 }\r
719 scheds->iv0 = iv0;\r
720 scheds->iv1 = iv1;\r
721 }\r
722 \r
723 static void des_sdctr3(unsigned char *blk,\r
724 unsigned int len, DESContext * scheds)\r
725 {\r
726 word32 b[2], iv0, iv1, tmp;\r
727 unsigned int i;\r
728 \r
729 assert((len & 7) == 0);\r
730 \r
731 iv0 = scheds->iv0;\r
732 iv1 = scheds->iv1;\r
733 for (i = 0; i < len; i += 8) {\r
734 des_encipher(b, iv0, iv1, &scheds[0]);\r
735 des_decipher(b, b[0], b[1], &scheds[1]);\r
736 des_encipher(b, b[0], b[1], &scheds[2]);\r
737 tmp = GET_32BIT_MSB_FIRST(blk);\r
738 PUT_32BIT_MSB_FIRST(blk, tmp ^ b[0]);\r
739 blk += 4;\r
740 tmp = GET_32BIT_MSB_FIRST(blk);\r
741 PUT_32BIT_MSB_FIRST(blk, tmp ^ b[1]);\r
742 blk += 4;\r
743 if ((iv1 = (iv1 + 1) & 0xffffffff) == 0)\r
744 iv0 = (iv0 + 1) & 0xffffffff;\r
745 }\r
746 scheds->iv0 = iv0;\r
747 scheds->iv1 = iv1;\r
748 }\r
749 \r
750 static void *des3_make_context(void)\r
751 {\r
752 return snewn(3, DESContext);\r
753 }\r
754 \r
755 static void *des3_ssh1_make_context(void)\r
756 {\r
757 /* Need 3 keys for each direction, in SSH-1 */\r
758 return snewn(6, DESContext);\r
759 }\r
760 \r
761 static void *des_make_context(void)\r
762 {\r
763 return snew(DESContext);\r
764 }\r
765 \r
766 static void *des_ssh1_make_context(void)\r
767 {\r
768 /* Need one key for each direction, in SSH-1 */\r
769 return snewn(2, DESContext);\r
770 }\r
771 \r
772 static void des3_free_context(void *handle) /* used for both 3DES and DES */\r
773 {\r
774 sfree(handle);\r
775 }\r
776 \r
777 static void des3_key(void *handle, unsigned char *key)\r
778 {\r
779 DESContext *keys = (DESContext *) handle;\r
780 des_key_setup(GET_32BIT_MSB_FIRST(key),\r
781 GET_32BIT_MSB_FIRST(key + 4), &keys[0]);\r
782 des_key_setup(GET_32BIT_MSB_FIRST(key + 8),\r
783 GET_32BIT_MSB_FIRST(key + 12), &keys[1]);\r
784 des_key_setup(GET_32BIT_MSB_FIRST(key + 16),\r
785 GET_32BIT_MSB_FIRST(key + 20), &keys[2]);\r
786 }\r
787 \r
788 static void des3_iv(void *handle, unsigned char *key)\r
789 {\r
790 DESContext *keys = (DESContext *) handle;\r
791 keys[0].iv0 = GET_32BIT_MSB_FIRST(key);\r
792 keys[0].iv1 = GET_32BIT_MSB_FIRST(key + 4);\r
793 }\r
794 \r
795 static void des_key(void *handle, unsigned char *key)\r
796 {\r
797 DESContext *keys = (DESContext *) handle;\r
798 des_key_setup(GET_32BIT_MSB_FIRST(key),\r
799 GET_32BIT_MSB_FIRST(key + 4), &keys[0]);\r
800 }\r
801 \r
802 static void des3_sesskey(void *handle, unsigned char *key)\r
803 {\r
804 DESContext *keys = (DESContext *) handle;\r
805 des3_key(keys, key);\r
806 des3_key(keys+3, key);\r
807 }\r
808 \r
809 static void des3_encrypt_blk(void *handle, unsigned char *blk, int len)\r
810 {\r
811 DESContext *keys = (DESContext *) handle;\r
812 des_3cbc_encrypt(blk, len, keys);\r
813 }\r
814 \r
815 static void des3_decrypt_blk(void *handle, unsigned char *blk, int len)\r
816 {\r
817 DESContext *keys = (DESContext *) handle;\r
818 des_3cbc_decrypt(blk, len, keys+3);\r
819 }\r
820 \r
821 static void des3_ssh2_encrypt_blk(void *handle, unsigned char *blk, int len)\r
822 {\r
823 DESContext *keys = (DESContext *) handle;\r
824 des_cbc3_encrypt(blk, len, keys);\r
825 }\r
826 \r
827 static void des3_ssh2_decrypt_blk(void *handle, unsigned char *blk, int len)\r
828 {\r
829 DESContext *keys = (DESContext *) handle;\r
830 des_cbc3_decrypt(blk, len, keys);\r
831 }\r
832 \r
833 static void des3_ssh2_sdctr(void *handle, unsigned char *blk, int len)\r
834 {\r
835 DESContext *keys = (DESContext *) handle;\r
836 des_sdctr3(blk, len, keys);\r
837 }\r
838 \r
839 static void des_ssh2_encrypt_blk(void *handle, unsigned char *blk, int len)\r
840 {\r
841 DESContext *keys = (DESContext *) handle;\r
842 des_cbc_encrypt(blk, len, keys);\r
843 }\r
844 \r
845 static void des_ssh2_decrypt_blk(void *handle, unsigned char *blk, int len)\r
846 {\r
847 DESContext *keys = (DESContext *) handle;\r
848 des_cbc_decrypt(blk, len, keys);\r
849 }\r
850 \r
851 void des3_decrypt_pubkey(unsigned char *key, unsigned char *blk, int len)\r
852 {\r
853 DESContext ourkeys[3];\r
854 des_key_setup(GET_32BIT_MSB_FIRST(key),\r
855 GET_32BIT_MSB_FIRST(key + 4), &ourkeys[0]);\r
856 des_key_setup(GET_32BIT_MSB_FIRST(key + 8),\r
857 GET_32BIT_MSB_FIRST(key + 12), &ourkeys[1]);\r
858 des_key_setup(GET_32BIT_MSB_FIRST(key),\r
859 GET_32BIT_MSB_FIRST(key + 4), &ourkeys[2]);\r
860 des_3cbc_decrypt(blk, len, ourkeys);\r
861 smemclr(ourkeys, sizeof(ourkeys));\r
862 }\r
863 \r
864 void des3_encrypt_pubkey(unsigned char *key, unsigned char *blk, int len)\r
865 {\r
866 DESContext ourkeys[3];\r
867 des_key_setup(GET_32BIT_MSB_FIRST(key),\r
868 GET_32BIT_MSB_FIRST(key + 4), &ourkeys[0]);\r
869 des_key_setup(GET_32BIT_MSB_FIRST(key + 8),\r
870 GET_32BIT_MSB_FIRST(key + 12), &ourkeys[1]);\r
871 des_key_setup(GET_32BIT_MSB_FIRST(key),\r
872 GET_32BIT_MSB_FIRST(key + 4), &ourkeys[2]);\r
873 des_3cbc_encrypt(blk, len, ourkeys);\r
874 smemclr(ourkeys, sizeof(ourkeys));\r
875 }\r
876 \r
877 void des3_decrypt_pubkey_ossh(unsigned char *key, unsigned char *iv,\r
878 unsigned char *blk, int len)\r
879 {\r
880 DESContext ourkeys[3];\r
881 des_key_setup(GET_32BIT_MSB_FIRST(key),\r
882 GET_32BIT_MSB_FIRST(key + 4), &ourkeys[0]);\r
883 des_key_setup(GET_32BIT_MSB_FIRST(key + 8),\r
884 GET_32BIT_MSB_FIRST(key + 12), &ourkeys[1]);\r
885 des_key_setup(GET_32BIT_MSB_FIRST(key + 16),\r
886 GET_32BIT_MSB_FIRST(key + 20), &ourkeys[2]);\r
887 ourkeys[0].iv0 = GET_32BIT_MSB_FIRST(iv);\r
888 ourkeys[0].iv1 = GET_32BIT_MSB_FIRST(iv+4);\r
889 des_cbc3_decrypt(blk, len, ourkeys);\r
890 smemclr(ourkeys, sizeof(ourkeys));\r
891 }\r
892 \r
893 void des3_encrypt_pubkey_ossh(unsigned char *key, unsigned char *iv,\r
894 unsigned char *blk, int len)\r
895 {\r
896 DESContext ourkeys[3];\r
897 des_key_setup(GET_32BIT_MSB_FIRST(key),\r
898 GET_32BIT_MSB_FIRST(key + 4), &ourkeys[0]);\r
899 des_key_setup(GET_32BIT_MSB_FIRST(key + 8),\r
900 GET_32BIT_MSB_FIRST(key + 12), &ourkeys[1]);\r
901 des_key_setup(GET_32BIT_MSB_FIRST(key + 16),\r
902 GET_32BIT_MSB_FIRST(key + 20), &ourkeys[2]);\r
903 ourkeys[0].iv0 = GET_32BIT_MSB_FIRST(iv);\r
904 ourkeys[0].iv1 = GET_32BIT_MSB_FIRST(iv+4);\r
905 des_cbc3_encrypt(blk, len, ourkeys);\r
906 smemclr(ourkeys, sizeof(ourkeys));\r
907 }\r
908 \r
909 static void des_keysetup_xdmauth(const unsigned char *keydata, DESContext *dc)\r
910 {\r
911 unsigned char key[8];\r
912 int i, nbits, j;\r
913 unsigned int bits;\r
914 \r
915 bits = 0;\r
916 nbits = 0;\r
917 j = 0;\r
918 for (i = 0; i < 8; i++) {\r
919 if (nbits < 7) {\r
920 bits = (bits << 8) | keydata[j];\r
921 nbits += 8;\r
922 j++;\r
923 }\r
924 key[i] = (bits >> (nbits - 7)) << 1;\r
925 bits &= ~(0x7F << (nbits - 7));\r
926 nbits -= 7;\r
927 }\r
928 \r
929 des_key_setup(GET_32BIT_MSB_FIRST(key), GET_32BIT_MSB_FIRST(key + 4), dc);\r
930 }\r
931 \r
932 void des_encrypt_xdmauth(const unsigned char *keydata,\r
933 unsigned char *blk, int len)\r
934 {\r
935 DESContext dc;\r
936 des_keysetup_xdmauth(keydata, &dc);\r
937 des_cbc_encrypt(blk, len, &dc);\r
938 }\r
939 \r
940 void des_decrypt_xdmauth(const unsigned char *keydata,\r
941 unsigned char *blk, int len)\r
942 {\r
943 DESContext dc;\r
944 des_keysetup_xdmauth(keydata, &dc);\r
945 des_cbc_decrypt(blk, len, &dc);\r
946 }\r
947 \r
948 static const struct ssh2_cipher ssh_3des_ssh2 = {\r
949 des3_make_context, des3_free_context, des3_iv, des3_key,\r
950 des3_ssh2_encrypt_blk, des3_ssh2_decrypt_blk,\r
951 "3des-cbc",\r
952 8, 168, SSH_CIPHER_IS_CBC, "triple-DES CBC"\r
953 };\r
954 \r
955 static const struct ssh2_cipher ssh_3des_ssh2_ctr = {\r
956 des3_make_context, des3_free_context, des3_iv, des3_key,\r
957 des3_ssh2_sdctr, des3_ssh2_sdctr,\r
958 "3des-ctr",\r
959 8, 168, 0, "triple-DES SDCTR"\r
960 };\r
961 \r
962 /*\r
963 * Single DES in SSH-2. "des-cbc" is marked as HISTORIC in\r
964 * RFC 4250, referring to\r
965 * FIPS-46-3. ("Single DES (i.e., DES) will be permitted \r
966 * for legacy systems only.") , but ssh.com support it and \r
967 * apparently aren't the only people to do so, so we sigh \r
968 * and implement it anyway.\r
969 */\r
970 static const struct ssh2_cipher ssh_des_ssh2 = {\r
971 des_make_context, des3_free_context, des3_iv, des_key,\r
972 des_ssh2_encrypt_blk, des_ssh2_decrypt_blk,\r
973 "des-cbc",\r
974 8, 56, SSH_CIPHER_IS_CBC, "single-DES CBC"\r
975 };\r
976 \r
977 static const struct ssh2_cipher ssh_des_sshcom_ssh2 = {\r
978 des_make_context, des3_free_context, des3_iv, des_key,\r
979 des_ssh2_encrypt_blk, des_ssh2_decrypt_blk,\r
980 "des-cbc@ssh.com",\r
981 8, 56, SSH_CIPHER_IS_CBC, "single-DES CBC"\r
982 };\r
983 \r
984 static const struct ssh2_cipher *const des3_list[] = {\r
985 &ssh_3des_ssh2_ctr,\r
986 &ssh_3des_ssh2\r
987 };\r
988 \r
989 const struct ssh2_ciphers ssh2_3des = {\r
990 sizeof(des3_list) / sizeof(*des3_list),\r
991 des3_list\r
992 };\r
993 \r
994 static const struct ssh2_cipher *const des_list[] = {\r
995 &ssh_des_ssh2,\r
996 &ssh_des_sshcom_ssh2\r
997 };\r
998 \r
999 const struct ssh2_ciphers ssh2_des = {\r
1000 sizeof(des_list) / sizeof(*des_list),\r
1001 des_list\r
1002 };\r
1003 \r
1004 const struct ssh_cipher ssh_3des = {\r
1005 des3_ssh1_make_context, des3_free_context, des3_sesskey,\r
1006 des3_encrypt_blk, des3_decrypt_blk,\r
1007 8, "triple-DES inner-CBC"\r
1008 };\r
1009 \r
1010 static void des_sesskey(void *handle, unsigned char *key)\r
1011 {\r
1012 DESContext *keys = (DESContext *) handle;\r
1013 des_key(keys, key);\r
1014 des_key(keys+1, key);\r
1015 }\r
1016 \r
1017 static void des_encrypt_blk(void *handle, unsigned char *blk, int len)\r
1018 {\r
1019 DESContext *keys = (DESContext *) handle;\r
1020 des_cbc_encrypt(blk, len, keys);\r
1021 }\r
1022 \r
1023 static void des_decrypt_blk(void *handle, unsigned char *blk, int len)\r
1024 {\r
1025 DESContext *keys = (DESContext *) handle;\r
1026 des_cbc_decrypt(blk, len, keys+1);\r
1027 }\r
1028 \r
1029 const struct ssh_cipher ssh_des = {\r
1030 des_ssh1_make_context, des3_free_context, des_sesskey,\r
1031 des_encrypt_blk, des_decrypt_blk,\r
1032 8, "single-DES CBC"\r
1033 };\r
1034 \r
1035 #ifdef TEST_XDM_AUTH\r
1036 \r
1037 /*\r
1038 * Small standalone utility which allows encryption and decryption of\r
1039 * single cipher blocks in the XDM-AUTHORIZATION-1 style. Written\r
1040 * during the rework of X authorisation for connection sharing, to\r
1041 * check the corner case when xa1_firstblock matches but the rest of\r
1042 * the authorisation is bogus.\r
1043 *\r
1044 * Just compile this file on its own with the above ifdef symbol\r
1045 * predefined:\r
1046 \r
1047 gcc -DTEST_XDM_AUTH -o sshdes sshdes.c\r
1048 \r
1049 */\r
1050 \r
1051 #include <stdlib.h>\r
1052 void *safemalloc(size_t n, size_t size) { return calloc(n, size); }\r
1053 void safefree(void *p) { return free(p); }\r
1054 void smemclr(void *p, size_t size) { memset(p, 0, size); }\r
1055 int main(int argc, char **argv)\r
1056 {\r
1057 unsigned char words[2][8];\r
1058 unsigned char out[8];\r
1059 int i, j;\r
1060 \r
1061 memset(words, 0, sizeof(words));\r
1062 \r
1063 for (i = 0; i < 2; i++) {\r
1064 for (j = 0; j < 8 && argv[i+1][2*j]; j++) {\r
1065 char x[3];\r
1066 unsigned u;\r
1067 x[0] = argv[i+1][2*j];\r
1068 x[1] = argv[i+1][2*j+1];\r
1069 x[2] = 0;\r
1070 sscanf(x, "%02x", &u);\r
1071 words[i][j] = u;\r
1072 }\r
1073 }\r
1074 \r
1075 memcpy(out, words[0], 8);\r
1076 des_decrypt_xdmauth(words[1], out, 8);\r
1077 printf("decrypt(%s,%s) = ", argv[1], argv[2]);\r
1078 for (i = 0; i < 8; i++) printf("%02x", out[i]);\r
1079 printf("\n");\r
1080 \r
1081 memcpy(out, words[0], 8);\r
1082 des_encrypt_xdmauth(words[1], out, 8);\r
1083 printf("encrypt(%s,%s) = ", argv[1], argv[2]);\r
1084 for (i = 0; i < 8; i++) printf("%02x", out[i]);\r
1085 printf("\n");\r
1086 }\r
1087 \r
1088 #endif\r