3 This file is part of the AVR-Crypto-Lib.
4 Copyright (C) 2008 Daniel Otte (daniel.otte@rub.de)
6 This program is free software: you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation, either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 * \email daniel.otte@rub.de
26 * \brief Implementation of the CAST5 (aka CAST-128) cipher algorithm as described in RFC 2144
40 #include "cast5-sbox.h"
44 #define S5(x) pgm_read_dword(&s5[(x)])
45 #define S6(x) pgm_read_dword(&s6[(x)])
46 #define S7(x) pgm_read_dword(&s7[(x)])
47 #define S8(x) pgm_read_dword(&s8[(x)])
50 void cast5_init_A(uint8_t *dest, uint8_t *src, bool bmode){
51 uint8_t mask = bmode?0x8:0;
52 *((uint32_t*)(&dest[0x0])) = *((uint32_t*)(&src[0x0^mask]))
53 ^ S5(src[0xD^mask]) ^ S6(src[0xF^mask])
54 ^ S7(src[0xC^mask]) ^ S8(src[0xE^mask])
56 *((uint32_t*)(&dest[0x4])) = *((uint32_t*)(&src[0x8^mask]))
57 ^ S5(dest[0x0]) ^ S6(dest[0x2])
58 ^ S7(dest[0x1]) ^ S8(dest[0x3])
60 *((uint32_t*)(&dest[0x8])) = *((uint32_t*)(&src[0xC^mask]))
61 ^ S5(dest[0x7]) ^ S6(dest[0x6])
62 ^ S7(dest[0x5]) ^ S8(dest[0x4])
64 *((uint32_t*)(&dest[0xC])) = *((uint32_t*)(&src[0x4^mask]))
73 void cast5_init_M(uint8_t *dest, uint8_t *src, bool nmode, bool xmode){
74 uint8_t nmt[] = {0xB, 0xA, 0x9, 0x8,
77 0x7, 0x6, 0x5, 0x4}; /* nmode table */
78 uint8_t xmt[4][4] = {{0x2, 0x6, 0x9, 0xC},
81 {0x9, 0xC, 0x2, 0x6}};
82 #define NMT(x) (src[nmode?nmt[(x)]:(x)])
83 #define XMT(x) (src[xmt[(xmode<<1) + nmode][(x)]])
84 *((uint32_t*)(&dest[0x0])) = S5(NMT(0x8)) ^ S6(NMT(0x9)) ^ S7(NMT(0x7)) ^ S8(NMT(0x6)) ^ S5(XMT(0));
85 *((uint32_t*)(&dest[0x4])) = S5(NMT(0xA)) ^ S6(NMT(0xB)) ^ S7(NMT(0x5)) ^ S8(NMT(0x4)) ^ S6(XMT(1));
86 *((uint32_t*)(&dest[0x8])) = S5(NMT(0xC)) ^ S6(NMT(0xD)) ^ S7(NMT(0x3)) ^ S8(NMT(0x2)) ^ S7(XMT(2));
87 *((uint32_t*)(&dest[0xC])) = S5(NMT(0xE)) ^ S6(NMT(0xF)) ^ S7(NMT(0x1)) ^ S8(NMT(0x0)) ^ S8(XMT(3));
90 #define S5B(x) pgm_read_byte(3+(uint8_t*)(&s5[(x)]))
91 #define S6B(x) pgm_read_byte(3+(uint8_t*)(&s6[(x)]))
92 #define S7B(x) pgm_read_byte(3+(uint8_t*)(&s7[(x)]))
93 #define S8B(x) pgm_read_byte(3+(uint8_t*)(&s8[(x)]))
96 void cast5_init_rM(uint8_t *klo, uint8_t *khi, uint8_t offset, uint8_t *src, bool nmode, bool xmode){
97 uint8_t nmt[] = {0xB, 0xA, 0x9, 0x8, 0xF, 0xE, 0xD, 0xC, 0x3, 0x2, 0x1, 0x0, 0x7, 0x6, 0x5, 0x4}; /* nmode table */
98 uint8_t xmt[4][4] = {{0x2, 0x6, 0x9, 0xC}, {0x8, 0xD, 0x3, 0x7}, {0x3, 0x7, 0x8, 0xD}, {0x9, 0xC, 0x2, 0x6}};
100 t = S5B(NMT(0x8)) ^ S6B(NMT(0x9)) ^ S7B(NMT(0x7)) ^ S8B(NMT(0x6)) ^ S5B(XMT(0));
101 klo[offset*2] |= (t & 0x0f);
102 h |= (t&0x10); h>>=1;
103 t = S5B(NMT(0xA)) ^ S6B(NMT(0xB)) ^ S7B(NMT(0x5)) ^ S8B(NMT(0x4)) ^ S6B(XMT(1));
104 klo[offset*2] |= (t<<4) & 0xf0;
106 t = S5B(NMT(0xC)) ^ S6B(NMT(0xD)) ^ S7B(NMT(0x3)) ^ S8B(NMT(0x2)) ^ S7B(XMT(2));
107 klo[offset*2+1] |= t&0xf;
109 t = S5B(NMT(0xE)) ^ S6B(NMT(0xF)) ^ S7B(NMT(0x1)) ^ S8B(NMT(0x0)) ^ S8B(XMT(3));
110 klo[offset*2+1] |= t<<4;
113 cli_putstr("\r\n\t h="); cli_hexdump(&h,1);
115 khi[offset>>1] |= h<<((offset&0x1)?4:0);
118 #define S_5X(s) pgm_read_dword(&s5[BPX[(s)]])
119 #define S_6X(s) pgm_read_dword(&s6[BPX[(s)]])
120 #define S_7X(s) pgm_read_dword(&s7[BPX[(s)]])
121 #define S_8X(s) pgm_read_dword(&s8[BPX[(s)]])
123 #define S_5Z(s) pgm_read_dword(&s5[BPZ[(s)]])
124 #define S_6Z(s) pgm_read_dword(&s6[BPZ[(s)]])
125 #define S_7Z(s) pgm_read_dword(&s7[BPZ[(s)]])
126 #define S_8Z(s) pgm_read_dword(&s8[BPZ[(s)]])
131 void cast5_init(const void* key, uint16_t keylength_b, cast5_ctx_t* s){
132 /* we migth return if the key is valid and if setup was successful */
134 #define BPX ((uint8_t*)&(x[0]))
135 #define BPZ ((uint8_t*)&(z[0]))
136 s->shortkey = (keylength_b<=80);
137 /* littel endian only! */
138 memset(&(x[0]), 0 ,16); /* set x to zero */
139 if(keylength_b > 128)
141 memcpy(&(x[0]), key, (keylength_b+7)/8);
144 /* todo: merge a and b and compress the whole stuff */
146 cast5_init_A((uint8_t*)(&z[0]), (uint8_t*)(&x[0]), false);
148 cast5_init_M((uint8_t*)(&(s->mask[0])), (uint8_t*)(&z[0]), false, false);
150 cast5_init_A((uint8_t*)(&x[0]), (uint8_t*)(&z[0]), true);
152 cast5_init_M((uint8_t*)(&(s->mask[4])), (uint8_t*)(&x[0]), true, false);
154 cast5_init_A((uint8_t*)(&z[0]), (uint8_t*)(&x[0]), false);
156 cast5_init_M((uint8_t*)(&(s->mask[8])), (uint8_t*)(&z[0]), true, true);
158 cast5_init_A((uint8_t*)(&x[0]), (uint8_t*)(&z[0]), true);
160 cast5_init_M((uint8_t*)(&(s->mask[12])), (uint8_t*)(&x[0]), false, true);
162 /* that were the masking keys, now the rotation keys */
163 /* set the keys to zero */
164 memset(&(s->rotl[0]),0,8);
165 s->roth[0]=s->roth[1]=0;
167 cast5_init_A((uint8_t*)(&z[0]), (uint8_t*)(&x[0]), false);
169 cast5_init_rM(&(s->rotl[0]), &(s->roth[0]), 0, (uint8_t*)(&z[0]), false, false);
171 cast5_init_A((uint8_t*)(&x[0]), (uint8_t*)(&z[0]), true);
173 cast5_init_rM(&(s->rotl[0]), &(s->roth[0]), 1, (uint8_t*)(&x[0]), true, false);
175 cast5_init_A((uint8_t*)(&z[0]), (uint8_t*)(&x[0]), false);
177 cast5_init_rM(&(s->rotl[0]), &(s->roth[0]), 2, (uint8_t*)(&z[0]), true, true);
179 cast5_init_A((uint8_t*)(&x[0]), (uint8_t*)(&z[0]), true);
181 cast5_init_rM(&(s->rotl[0]), &(s->roth[0]), 3, (uint8_t*)(&x[0]), false, true);
187 /********************************************************************************************************/
189 #define ROTL32(a,n) ((a)<<(n) | (a)>>(32-(n)))
190 #define CHANGE_ENDIAN32(x) ((x)<<24 | (x)>>24 | ((x)&0xff00)<<8 | ((x)&0xff0000)>>8 )
192 typedef uint32_t cast5_f_t(uint32_t,uint32_t,uint8_t);
200 uint32_t cast5_f1(uint32_t d, uint32_t m, uint8_t r){
202 t = ROTL32((d + m),r);
204 uint32_t ia,ib,ic,id;
205 cli_putstr("\r\n f1("); cli_hexdump(&d, 4); cli_putc(',');
206 cli_hexdump(&m , 4); cli_putc(','); cli_hexdump(&r, 1);cli_putstr("): I=");
208 ia = pgm_read_dword(&s1[((uint8_t*)&t)[IA]] );
209 ib = pgm_read_dword(&s2[((uint8_t*)&t)[IB]] );
210 ic = pgm_read_dword(&s3[((uint8_t*)&t)[IC]] );
211 id = pgm_read_dword(&s4[((uint8_t*)&t)[ID]] );
212 cli_putstr("\r\n\tIA="); cli_hexdump(&ia, 4);
213 cli_putstr("\r\n\tIB="); cli_hexdump(&ib, 4);
214 cli_putstr("\r\n\tIC="); cli_hexdump(&ic, 4);
215 cli_putstr("\r\n\tID="); cli_hexdump(&id, 4);
217 return (((ia ^ ib) - ic) + id);
221 return ((( pgm_read_dword(&s1[((uint8_t*)&t)[IA]])
222 ^ pgm_read_dword(&s2[((uint8_t*)&t)[IB]]) )
223 - pgm_read_dword(&s3[((uint8_t*)&t)[IC]]) )
224 + pgm_read_dword(&s4[((uint8_t*)&t)[ID]]) );
230 uint32_t cast5_f2(uint32_t d, uint32_t m, uint8_t r){
232 t = ROTL32((d ^ m),r);
234 uint32_t ia,ib,ic,id;
235 cli_putstr("\r\n f2("); cli_hexdump(&d, 4); cli_putc(',');
236 cli_hexdump(&m , 4); cli_putc(','); cli_hexdump(&r, 1);cli_putstr("): I=");
239 ia = pgm_read_dword(&s1[((uint8_t*)&t)[IA]] );
240 ib = pgm_read_dword(&s2[((uint8_t*)&t)[IB]] );
241 ic = pgm_read_dword(&s3[((uint8_t*)&t)[IC]] );
242 id = pgm_read_dword(&s4[((uint8_t*)&t)[ID]] );
244 cli_putstr("\r\n\tIA="); cli_hexdump(&ia, 4);
245 cli_putstr("\r\n\tIB="); cli_hexdump(&ib, 4);
246 cli_putstr("\r\n\tIC="); cli_hexdump(&ic, 4);
247 cli_putstr("\r\n\tID="); cli_hexdump(&id, 4);
249 return (((ia - ib) + ic) ^ id);
252 return ((( pgm_read_dword(&s1[((uint8_t*)&t)[IA]])
253 - pgm_read_dword(&s2[((uint8_t*)&t)[IB]]) )
254 + pgm_read_dword(&s3[((uint8_t*)&t)[IC]]) )
255 ^ pgm_read_dword(&s4[((uint8_t*)&t)[ID]]) );
261 uint32_t cast5_f3(uint32_t d, uint32_t m, uint8_t r){
263 t = ROTL32((m - d),r);
266 uint32_t ia,ib,ic,id;
268 cli_putstr("\r\n f3("); cli_hexdump(&d, 4); cli_putc(',');
269 cli_hexdump(&m , 4); cli_putc(','); cli_hexdump(&r, 1);cli_putstr("): I=");
272 ia = pgm_read_dword(&s1[((uint8_t*)&t)[IA]] );
273 ib = pgm_read_dword(&s2[((uint8_t*)&t)[IB]] );
274 ic = pgm_read_dword(&s3[((uint8_t*)&t)[IC]] );
275 id = pgm_read_dword(&s4[((uint8_t*)&t)[ID]] );
277 cli_putstr("\r\n\tIA="); cli_hexdump(&ia, 4);
278 cli_putstr("\r\n\tIB="); cli_hexdump(&ib, 4);
279 cli_putstr("\r\n\tIC="); cli_hexdump(&ic, 4);
280 cli_putstr("\r\n\tID="); cli_hexdump(&id, 4);
281 return (((ia + ib) ^ ic) - id);
283 return (( pgm_read_dword(&s1[((uint8_t*)&t)[IA]] )
284 + pgm_read_dword(&s2[((uint8_t*)&t)[IB]] ))
285 ^ pgm_read_dword(&s3[((uint8_t*)&t)[IC]] ))
286 - pgm_read_dword(&s4[((uint8_t*)&t)[ID]] );
291 /******************************************************************************/
293 void cast5_enc(void* block, const cast5_ctx_t *s){
296 cast5_f_t* f[]={cast5_f1,cast5_f2,cast5_f3};
297 l=((uint32_t*)block)[0];
298 r=((uint32_t*)block)[1];
299 // cli_putstr("\r\n round[-1] = ");
300 // cli_hexdump(&r, 4);
301 for (i=0;i<(s->shortkey?12:16);++i){
303 y = (f[i%3])(CHANGE_ENDIAN32(r), CHANGE_ENDIAN32(s->mask[i]),
304 (((s->roth[i>>3]) & (1<<(i&0x7)))?0x10:0x00)
305 + ( ((s->rotl[i>>1])>>((i&1)?4:0)) & 0x0f) );
306 r = l ^ CHANGE_ENDIAN32(y);
307 // cli_putstr("\r\n round["); DEBUG_B(i); cli_putstr("] = ");
308 // cli_hexdump(&r, 4);
311 ((uint32_t*)block)[0]=r;
312 ((uint32_t*)block)[1]=l;
315 /******************************************************************************/
317 void cast5_dec(void* block, const cast5_ctx_t *s){
320 cast5_f_t* f[]={cast5_f1,cast5_f2,cast5_f3};
321 l=((uint32_t*)block)[0];
322 r=((uint32_t*)block)[1];
323 rounds = (s->shortkey?12:16);
324 for (i=rounds-1; i>=0 ;--i){
326 y = (f[i%3])(CHANGE_ENDIAN32(r), CHANGE_ENDIAN32(s->mask[i]),
327 (((s->roth[i>>3]) & (1<<(i&0x7)))?0x10:0x00)
328 + ( ((s->rotl[i>>1])>>((i&1)?4:0)) & 0x0f) );
329 r = l ^ CHANGE_ENDIAN32(y);
332 ((uint32_t*)block)[0]=r;
333 ((uint32_t*)block)[1]=l;
337 /******************************************************************************/