2 * FreeSec: libcrypt for NetBSD
4 * Copyright (c) 1994 David Burren
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 4. Neither the name of the author nor the names of other contributors
16 * may be used to endorse or promote products derived from this software
17 * without specific prior written permission.
19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * $FreeBSD: src/secure/lib/libcipher/crypt.c,v 1.6 1999/08/28 01:30:21 peter Exp $
32 * $DragonFly: src/secure/lib/libcipher/crypt.c,v 1.3 2005/05/21 10:31:08 corecode Exp $
34 * This is an original implementation of the DES and the crypt(3) interfaces
35 * by David Burren <davidb@werj.com.au>.
37 * An excellent reference on the underlying algorithm (and related
40 * B. Schneier, Applied Cryptography: protocols, algorithms,
41 * and source code in C, John Wiley & Sons, 1994.
43 * Note that in that book's description of DES the lookups for the initial,
44 * pbox, and final permutations are inverted (this has been brought to the
45 * attention of the author). A list of errata for this book has been
46 * posted to the sci.crypt newsgroup by the author and is available for FTP.
48 * ARCHITECTURE ASSUMPTIONS:
49 * This code assumes that u_longs are 32 bits. It will probably not
50 * operate on 64-bit machines without modifications.
51 * It is assumed that the 8-byte arrays passed by reference can be
52 * addressed as arrays of u_longs (ie. the CPU is not picky about
55 #include <sys/types.h>
56 #include <sys/param.h>
64 static u_char IP
[64] = {
65 58, 50, 42, 34, 26, 18, 10, 2, 60, 52, 44, 36, 28, 20, 12, 4,
66 62, 54, 46, 38, 30, 22, 14, 6, 64, 56, 48, 40, 32, 24, 16, 8,
67 57, 49, 41, 33, 25, 17, 9, 1, 59, 51, 43, 35, 27, 19, 11, 3,
68 61, 53, 45, 37, 29, 21, 13, 5, 63, 55, 47, 39, 31, 23, 15, 7
71 static u_char inv_key_perm
[64];
72 static u_char u_key_perm
[56];
73 static u_char key_perm
[56] = {
74 57, 49, 41, 33, 25, 17, 9, 1, 58, 50, 42, 34, 26, 18,
75 10, 2, 59, 51, 43, 35, 27, 19, 11, 3, 60, 52, 44, 36,
76 63, 55, 47, 39, 31, 23, 15, 7, 62, 54, 46, 38, 30, 22,
77 14, 6, 61, 53, 45, 37, 29, 21, 13, 5, 28, 20, 12, 4
80 static u_char key_shifts
[16] = {
81 1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1
84 static u_char inv_comp_perm
[56];
85 static u_char comp_perm
[48] = {
86 14, 17, 11, 24, 1, 5, 3, 28, 15, 6, 21, 10,
87 23, 19, 12, 4, 26, 8, 16, 7, 27, 20, 13, 2,
88 41, 52, 31, 37, 47, 55, 30, 40, 51, 45, 33, 48,
89 44, 49, 39, 56, 34, 53, 46, 42, 50, 36, 29, 32
93 * No E box is used, as it's replaced by some ANDs, shifts, and ORs.
96 static u_char u_sbox
[8][64];
97 static u_char sbox
[8][64] = {
99 14, 4, 13, 1, 2, 15, 11, 8, 3, 10, 6, 12, 5, 9, 0, 7,
100 0, 15, 7, 4, 14, 2, 13, 1, 10, 6, 12, 11, 9, 5, 3, 8,
101 4, 1, 14, 8, 13, 6, 2, 11, 15, 12, 9, 7, 3, 10, 5, 0,
102 15, 12, 8, 2, 4, 9, 1, 7, 5, 11, 3, 14, 10, 0, 6, 13
105 15, 1, 8, 14, 6, 11, 3, 4, 9, 7, 2, 13, 12, 0, 5, 10,
106 3, 13, 4, 7, 15, 2, 8, 14, 12, 0, 1, 10, 6, 9, 11, 5,
107 0, 14, 7, 11, 10, 4, 13, 1, 5, 8, 12, 6, 9, 3, 2, 15,
108 13, 8, 10, 1, 3, 15, 4, 2, 11, 6, 7, 12, 0, 5, 14, 9
111 10, 0, 9, 14, 6, 3, 15, 5, 1, 13, 12, 7, 11, 4, 2, 8,
112 13, 7, 0, 9, 3, 4, 6, 10, 2, 8, 5, 14, 12, 11, 15, 1,
113 13, 6, 4, 9, 8, 15, 3, 0, 11, 1, 2, 12, 5, 10, 14, 7,
114 1, 10, 13, 0, 6, 9, 8, 7, 4, 15, 14, 3, 11, 5, 2, 12
117 7, 13, 14, 3, 0, 6, 9, 10, 1, 2, 8, 5, 11, 12, 4, 15,
118 13, 8, 11, 5, 6, 15, 0, 3, 4, 7, 2, 12, 1, 10, 14, 9,
119 10, 6, 9, 0, 12, 11, 7, 13, 15, 1, 3, 14, 5, 2, 8, 4,
120 3, 15, 0, 6, 10, 1, 13, 8, 9, 4, 5, 11, 12, 7, 2, 14
123 2, 12, 4, 1, 7, 10, 11, 6, 8, 5, 3, 15, 13, 0, 14, 9,
124 14, 11, 2, 12, 4, 7, 13, 1, 5, 0, 15, 10, 3, 9, 8, 6,
125 4, 2, 1, 11, 10, 13, 7, 8, 15, 9, 12, 5, 6, 3, 0, 14,
126 11, 8, 12, 7, 1, 14, 2, 13, 6, 15, 0, 9, 10, 4, 5, 3
129 12, 1, 10, 15, 9, 2, 6, 8, 0, 13, 3, 4, 14, 7, 5, 11,
130 10, 15, 4, 2, 7, 12, 9, 5, 6, 1, 13, 14, 0, 11, 3, 8,
131 9, 14, 15, 5, 2, 8, 12, 3, 7, 0, 4, 10, 1, 13, 11, 6,
132 4, 3, 2, 12, 9, 5, 15, 10, 11, 14, 1, 7, 6, 0, 8, 13
135 4, 11, 2, 14, 15, 0, 8, 13, 3, 12, 9, 7, 5, 10, 6, 1,
136 13, 0, 11, 7, 4, 9, 1, 10, 14, 3, 5, 12, 2, 15, 8, 6,
137 1, 4, 11, 13, 12, 3, 7, 14, 10, 15, 6, 8, 0, 5, 9, 2,
138 6, 11, 13, 8, 1, 4, 10, 7, 9, 5, 0, 15, 14, 2, 3, 12
141 13, 2, 8, 4, 6, 15, 11, 1, 10, 9, 3, 14, 5, 0, 12, 7,
142 1, 15, 13, 8, 10, 3, 7, 4, 12, 5, 6, 11, 0, 14, 9, 2,
143 7, 11, 4, 1, 9, 12, 14, 2, 0, 6, 10, 13, 15, 3, 5, 8,
144 2, 1, 14, 7, 4, 10, 8, 13, 15, 12, 9, 0, 3, 5, 6, 11
148 static u_char un_pbox
[32];
149 static u_char pbox
[32] = {
150 16, 7, 20, 21, 29, 12, 28, 17, 1, 15, 23, 26, 5, 18, 31, 10,
151 2, 8, 24, 14, 32, 27, 3, 9, 19, 13, 30, 6, 22, 11, 4, 25
154 static u_long bits32
[32] =
156 0x80000000, 0x40000000, 0x20000000, 0x10000000,
157 0x08000000, 0x04000000, 0x02000000, 0x01000000,
158 0x00800000, 0x00400000, 0x00200000, 0x00100000,
159 0x00080000, 0x00040000, 0x00020000, 0x00010000,
160 0x00008000, 0x00004000, 0x00002000, 0x00001000,
161 0x00000800, 0x00000400, 0x00000200, 0x00000100,
162 0x00000080, 0x00000040, 0x00000020, 0x00000010,
163 0x00000008, 0x00000004, 0x00000002, 0x00000001
166 static u_char bits8
[8] = { 0x80, 0x40, 0x20, 0x10, 0x08, 0x04, 0x02, 0x01 };
168 static u_long saltbits
;
169 static long old_salt
;
170 static u_long
*bits28
, *bits24
;
171 static u_char init_perm
[64], final_perm
[64];
172 static u_long en_keysl
[16], en_keysr
[16];
173 static u_long de_keysl
[16], de_keysr
[16];
174 static int des_initialised
= 0;
175 static u_char m_sbox
[4][4096];
176 static u_long psbox
[4][256];
177 static u_long ip_maskl
[8][256], ip_maskr
[8][256];
178 static u_long fp_maskl
[8][256], fp_maskr
[8][256];
179 static u_long key_perm_maskl
[8][128], key_perm_maskr
[8][128];
180 static u_long comp_maskl
[8][128], comp_maskr
[8][128];
181 static u_long old_rawkey0
, old_rawkey1
;
184 ascii_to_bin(char ch
)
189 return(ch
- 'a' + 38);
193 return(ch
- 'A' + 12);
205 int i
, j
, b
, k
, inbit
, obit
;
206 u_long
*p
, *il
, *ir
, *fl
, *fr
;
208 old_rawkey0
= old_rawkey1
= 0L;
211 bits24
= (bits28
= bits32
+ 4) + 4;
214 * Invert the S-boxes, reordering the input bits.
216 for (i
= 0; i
< 8; i
++)
217 for (j
= 0; j
< 64; j
++) {
218 b
= (j
& 0x20) | ((j
& 1) << 4) | ((j
>> 1) & 0xf);
219 u_sbox
[i
][j
] = sbox
[i
][b
];
223 * Convert the inverted S-boxes into 4 arrays of 8 bits.
224 * Each will handle 12 bits of the S-box input.
226 for (b
= 0; b
< 4; b
++)
227 for (i
= 0; i
< 64; i
++)
228 for (j
= 0; j
< 64; j
++)
229 m_sbox
[b
][(i
<< 6) | j
] =
230 (u_sbox
[(b
<< 1)][i
] << 4) |
231 u_sbox
[(b
<< 1) + 1][j
];
234 * Set up the initial & final permutations into a useful form, and
235 * initialise the inverted key permutation.
237 for (i
= 0; i
< 64; i
++) {
238 init_perm
[final_perm
[i
] = IP
[i
] - 1] = i
;
239 inv_key_perm
[i
] = 255;
243 * Invert the key permutation and initialise the inverted key
244 * compression permutation.
246 for (i
= 0; i
< 56; i
++) {
247 u_key_perm
[i
] = key_perm
[i
] - 1;
248 inv_key_perm
[key_perm
[i
] - 1] = i
;
249 inv_comp_perm
[i
] = 255;
253 * Invert the key compression permutation.
255 for (i
= 0; i
< 48; i
++) {
256 inv_comp_perm
[comp_perm
[i
] - 1] = i
;
260 * Set up the OR-mask arrays for the initial and final permutations,
261 * and for the key initial and compression permutations.
263 for (k
= 0; k
< 8; k
++) {
264 for (i
= 0; i
< 256; i
++) {
265 *(il
= &ip_maskl
[k
][i
]) = 0L;
266 *(ir
= &ip_maskr
[k
][i
]) = 0L;
267 *(fl
= &fp_maskl
[k
][i
]) = 0L;
268 *(fr
= &fp_maskr
[k
][i
]) = 0L;
269 for (j
= 0; j
< 8; j
++) {
272 if ((obit
= init_perm
[inbit
]) < 32)
275 *ir
|= bits32
[obit
-32];
276 if ((obit
= final_perm
[inbit
]) < 32)
279 *fr
|= bits32
[obit
- 32];
283 for (i
= 0; i
< 128; i
++) {
284 *(il
= &key_perm_maskl
[k
][i
]) = 0L;
285 *(ir
= &key_perm_maskr
[k
][i
]) = 0L;
286 for (j
= 0; j
< 7; j
++) {
288 if (i
& bits8
[j
+ 1]) {
289 if ((obit
= inv_key_perm
[inbit
]) == 255)
294 *ir
|= bits28
[obit
- 28];
297 *(il
= &comp_maskl
[k
][i
]) = 0L;
298 *(ir
= &comp_maskr
[k
][i
]) = 0L;
299 for (j
= 0; j
< 7; j
++) {
301 if (i
& bits8
[j
+ 1]) {
302 if ((obit
=inv_comp_perm
[inbit
]) == 255)
307 *ir
|= bits24
[obit
- 24];
314 * Invert the P-box permutation, and convert into OR-masks for
315 * handling the output of the S-box arrays setup above.
317 for (i
= 0; i
< 32; i
++)
318 un_pbox
[pbox
[i
] - 1] = i
;
320 for (b
= 0; b
< 4; b
++)
321 for (i
= 0; i
< 256; i
++) {
322 *(p
= &psbox
[b
][i
]) = 0L;
323 for (j
= 0; j
< 8; j
++) {
325 *p
|= bits32
[un_pbox
[8 * b
+ j
]];
334 setup_salt(long salt
)
336 u_long obit
, saltbit
;
339 if (salt
== old_salt
)
346 for (i
= 0; i
< 24; i
++) {
356 des_setkey(const char *key
)
358 u_long k0
, k1
, rawkey0
, rawkey1
;
361 if (!des_initialised
)
364 rawkey0
= ntohl(*(u_long
*) key
);
365 rawkey1
= ntohl(*(u_long
*) (key
+ 4));
367 if ((rawkey0
| rawkey1
)
368 && rawkey0
== old_rawkey0
369 && rawkey1
== old_rawkey1
) {
371 * Already setup for this key.
372 * This optimisation fails on a zero key (which is weak and
373 * has bad parity anyway) in order to simplify the starting
378 old_rawkey0
= rawkey0
;
379 old_rawkey1
= rawkey1
;
382 * Do key permutation and split into two 28-bit subkeys.
384 k0
= key_perm_maskl
[0][rawkey0
>> 25]
385 | key_perm_maskl
[1][(rawkey0
>> 17) & 0x7f]
386 | key_perm_maskl
[2][(rawkey0
>> 9) & 0x7f]
387 | key_perm_maskl
[3][(rawkey0
>> 1) & 0x7f]
388 | key_perm_maskl
[4][rawkey1
>> 25]
389 | key_perm_maskl
[5][(rawkey1
>> 17) & 0x7f]
390 | key_perm_maskl
[6][(rawkey1
>> 9) & 0x7f]
391 | key_perm_maskl
[7][(rawkey1
>> 1) & 0x7f];
392 k1
= key_perm_maskr
[0][rawkey0
>> 25]
393 | key_perm_maskr
[1][(rawkey0
>> 17) & 0x7f]
394 | key_perm_maskr
[2][(rawkey0
>> 9) & 0x7f]
395 | key_perm_maskr
[3][(rawkey0
>> 1) & 0x7f]
396 | key_perm_maskr
[4][rawkey1
>> 25]
397 | key_perm_maskr
[5][(rawkey1
>> 17) & 0x7f]
398 | key_perm_maskr
[6][(rawkey1
>> 9) & 0x7f]
399 | key_perm_maskr
[7][(rawkey1
>> 1) & 0x7f];
401 * Rotate subkeys and do compression permutation.
404 for (round
= 0; round
< 16; round
++) {
407 shifts
+= key_shifts
[round
];
409 t0
= (k0
<< shifts
) | (k0
>> (28 - shifts
));
410 t1
= (k1
<< shifts
) | (k1
>> (28 - shifts
));
412 de_keysl
[15 - round
] =
413 en_keysl
[round
] = comp_maskl
[0][(t0
>> 21) & 0x7f]
414 | comp_maskl
[1][(t0
>> 14) & 0x7f]
415 | comp_maskl
[2][(t0
>> 7) & 0x7f]
416 | comp_maskl
[3][t0
& 0x7f]
417 | comp_maskl
[4][(t1
>> 21) & 0x7f]
418 | comp_maskl
[5][(t1
>> 14) & 0x7f]
419 | comp_maskl
[6][(t1
>> 7) & 0x7f]
420 | comp_maskl
[7][t1
& 0x7f];
422 de_keysr
[15 - round
] =
423 en_keysr
[round
] = comp_maskr
[0][(t0
>> 21) & 0x7f]
424 | comp_maskr
[1][(t0
>> 14) & 0x7f]
425 | comp_maskr
[2][(t0
>> 7) & 0x7f]
426 | comp_maskr
[3][t0
& 0x7f]
427 | comp_maskr
[4][(t1
>> 21) & 0x7f]
428 | comp_maskr
[5][(t1
>> 14) & 0x7f]
429 | comp_maskr
[6][(t1
>> 7) & 0x7f]
430 | comp_maskr
[7][t1
& 0x7f];
437 do_des( u_long l_in
, u_long r_in
, u_long
*l_out
, u_long
*r_out
, int count
)
440 * l_in, r_in, l_out, and r_out are in pseudo-"big-endian" format.
442 u_long l
, r
, *kl
, *kr
, *kl1
, *kr1
;
443 u_long f
, r48l
, r48r
;
448 } else if (count
> 0) {
464 * Do initial permutation (IP).
466 l
= ip_maskl
[0][l_in
>> 24]
467 | ip_maskl
[1][(l_in
>> 16) & 0xff]
468 | ip_maskl
[2][(l_in
>> 8) & 0xff]
469 | ip_maskl
[3][l_in
& 0xff]
470 | ip_maskl
[4][r_in
>> 24]
471 | ip_maskl
[5][(r_in
>> 16) & 0xff]
472 | ip_maskl
[6][(r_in
>> 8) & 0xff]
473 | ip_maskl
[7][r_in
& 0xff];
474 r
= ip_maskr
[0][l_in
>> 24]
475 | ip_maskr
[1][(l_in
>> 16) & 0xff]
476 | ip_maskr
[2][(l_in
>> 8) & 0xff]
477 | ip_maskr
[3][l_in
& 0xff]
478 | ip_maskr
[4][r_in
>> 24]
479 | ip_maskr
[5][(r_in
>> 16) & 0xff]
480 | ip_maskr
[6][(r_in
>> 8) & 0xff]
481 | ip_maskr
[7][r_in
& 0xff];
492 * Expand R to 48 bits (simulate the E-box).
494 r48l
= ((r
& 0x00000001) << 23)
495 | ((r
& 0xf8000000) >> 9)
496 | ((r
& 0x1f800000) >> 11)
497 | ((r
& 0x01f80000) >> 13)
498 | ((r
& 0x001f8000) >> 15);
500 r48r
= ((r
& 0x0001f800) << 7)
501 | ((r
& 0x00001f80) << 5)
502 | ((r
& 0x000001f8) << 3)
503 | ((r
& 0x0000001f) << 1)
504 | ((r
& 0x80000000) >> 31);
506 * Do salting for crypt() and friends, and
507 * XOR with the permuted key.
509 f
= (r48l
^ r48r
) & saltbits
;
513 * Do sbox lookups (which shrink it back to 32 bits)
514 * and do the pbox permutation at the same time.
516 f
= psbox
[0][m_sbox
[0][r48l
>> 12]]
517 | psbox
[1][m_sbox
[1][r48l
& 0xfff]]
518 | psbox
[2][m_sbox
[2][r48r
>> 12]]
519 | psbox
[3][m_sbox
[3][r48r
& 0xfff]];
521 * Now that we've permuted things, complete f().
531 * Do final permutation (inverse of IP).
533 *l_out
= fp_maskl
[0][l
>> 24]
534 | fp_maskl
[1][(l
>> 16) & 0xff]
535 | fp_maskl
[2][(l
>> 8) & 0xff]
536 | fp_maskl
[3][l
& 0xff]
537 | fp_maskl
[4][r
>> 24]
538 | fp_maskl
[5][(r
>> 16) & 0xff]
539 | fp_maskl
[6][(r
>> 8) & 0xff]
540 | fp_maskl
[7][r
& 0xff];
541 *r_out
= fp_maskr
[0][l
>> 24]
542 | fp_maskr
[1][(l
>> 16) & 0xff]
543 | fp_maskr
[2][(l
>> 8) & 0xff]
544 | fp_maskr
[3][l
& 0xff]
545 | fp_maskr
[4][r
>> 24]
546 | fp_maskr
[5][(r
>> 16) & 0xff]
547 | fp_maskr
[6][(r
>> 8) & 0xff]
548 | fp_maskr
[7][r
& 0xff];
554 des_cipher(const char *in
, char *out
, long salt
, int count
)
556 u_long l_out
, r_out
, rawl
, rawr
;
559 if (!des_initialised
)
564 rawl
= ntohl(*((u_long
*) in
));
565 rawr
= ntohl(*(((u_long
*) in
) + 1));
567 retval
= do_des(rawl
, rawr
, &l_out
, &r_out
, count
);
569 *((u_long
*) out
) = htonl(l_out
);
570 *(((u_long
*) out
) + 1) = htonl(r_out
);
579 u_long packed_keys
[2];
582 p
= (u_char
*) packed_keys
;
584 for (i
= 0; i
< 8; i
++) {
586 for (j
= 0; j
< 8; j
++)
590 return(des_setkey(p
));
595 encrypt(char *block
, int flag
)
601 if (!des_initialised
)
606 for (i
= 0; i
< 2; i
++) {
608 for (j
= 0; j
< 32; j
++)
612 retval
= do_des(io
[0], io
[1], io
, io
+ 1, flag
? -1 : 1);
613 for (i
= 0; i
< 2; i
++)
614 for (j
= 0; j
< 32; j
++)
615 block
[(i
<< 5) | j
] = (io
[i
] & bits32
[j
]) ? 1 : 0;