3 This file is part of the ARM-Crypto-Lib.
4 Copyright (C) 2006-2010 Daniel Otte (daniel.otte@rub.de)
6 This program is free software: you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation, either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 * \brief SEED parts in C for ARM
31 #include "seed_sbox.h"
35 uint32_t g_function(uint32_t x);
36 /******************************************************************************/
39 void changeendian32(uint32_t * a){
40 *a = (*a & 0x000000FF) << 24 |
41 (*a & 0x0000FF00) << 8 |
42 (*a & 0x00FF0000) >> 8 |
43 (*a & 0xFF000000) >> 24;
46 /******************************************************************************/
48 uint32_t bigendian_sum32(uint32_t a, uint32_t b){
56 /******************************************************************************/
58 uint32_t bigendian_sub32(uint32_t a, uint32_t b){
66 /******************************************************************************/
68 uint64_t bigendian_rotl8_64(uint64_t a){
71 a = (a<<8) | (a>>(64-8));
74 a = (a>>8) | (a<<(64-8));
78 /******************************************************************************/
80 uint64_t bigendian_rotr8_64(uint64_t a){
83 a = (a>>8) | (a<<(64-8));
86 a = (a<<8) | (a>>(64-8));
90 /******************************************************************************/
92 uint64_t f_function(const uint64_t* a, uint32_t k0, uint32_t k1){
95 c = *a & 0x00000000FFFFFFFFLL;
96 d = (*a>>32) & 0x00000000FFFFFFFFLL;
101 c = bigendian_sum32(c,d);
103 d = bigendian_sum32(c,d);
105 c = bigendian_sum32(c,d);
106 return ((uint64_t)d << 32) | c;
109 /******************************************************************************/
115 #define X3 (((uint8_t*)(&x))[0])
116 #define X2 (((uint8_t*)(&x))[1])
117 #define X1 (((uint8_t*)(&x))[2])
118 #define X0 (((uint8_t*)(&x))[3])
120 #define Z3 (((uint8_t*)(&z))[0])
121 #define Z2 (((uint8_t*)(&z))[1])
122 #define Z1 (((uint8_t*)(&z))[2])
123 #define Z0 (((uint8_t*)(&z))[3])
126 uint32_t g_function(uint32_t x){
128 /* sbox substitution */
133 /* now the permutation */
134 Z0 = (X0 & M0) ^ (X1 & M1) ^ (X2 & M2) ^ (X3 & M3);
135 Z1 = (X0 & M1) ^ (X1 & M2) ^ (X2 & M3) ^ (X3 & M0);
136 Z2 = (X0 & M2) ^ (X1 & M3) ^ (X2 & M0) ^ (X3 & M1);
137 Z3 = (X0 & M3) ^ (X1 & M0) ^ (X2 & M1) ^ (X3 & M2);
140 /******************************************************************************/
145 keypair_t getnextkeys(uint32_t *keystate, uint8_t curround){
151 /* ret.k0 = g_function(keystate[0] + keystate[2] - pgm_read_dword(&(seed_kc[curround])));
152 ret.k1 = g_function(keystate[1] - keystate[3] + pgm_read_dword(&(seed_kc[curround]))); */
153 ret.k0 = bigendian_sum32(keystate[0], keystate[2]);
154 ret.k0 = bigendian_sub32(ret.k0, seed_kc[curround]);
155 ret.k0 = g_function(ret.k0);
156 ret.k1 = bigendian_sub32(keystate[1], keystate[3]);
157 ret.k1 = bigendian_sum32(ret.k1, seed_kc[curround]);
158 ret.k1 = g_function(ret.k1);
161 /* odd round (1,3,5, ...) */
162 ((uint64_t*)keystate)[1] = bigendian_rotl8_64( ((uint64_t*)keystate)[1] );
164 /* even round (0,2,4, ...) */
165 ((uint64_t*)keystate)[0] = bigendian_rotr8_64(((uint64_t*)keystate)[0]);
172 /******************************************************************************/
174 keypair_t getprevkeys(uint32_t *keystate, uint8_t curround){
181 /* odd round (1,3,5, ..., 15) */
182 ((uint64_t*)keystate)[1] = bigendian_rotr8_64( ((uint64_t*)keystate)[1] );
184 /* even round (0,2,4, ..., 14) */
185 ((uint64_t*)keystate)[0] = bigendian_rotl8_64(((uint64_t*)keystate)[0]);
187 /* ret.k0 = g_function(keystate[0] + keystate[2] - pgm_read_dword(&(seed_kc[curround])));
188 ret.k1 = g_function(keystate[1] - keystate[3] + pgm_read_dword(&(seed_kc[curround]))); */
189 ret.k0 = bigendian_sum32(keystate[0], keystate[2]);
190 ret.k0 = bigendian_sub32(ret.k0, seed_kc[curround]);
191 ret.k0 = g_function(ret.k0);
192 ret.k1 = bigendian_sub32(keystate[1], keystate[3]);
193 ret.k1 = bigendian_sum32(ret.k1, seed_kc[curround]);
194 ret.k1 = g_function(ret.k1);
199 /******************************************************************************/
201 void seed_init(const void * key, seed_ctx_t * ctx){
202 memcpy(ctx->k, key, 128/8);
205 /******************************************************************************/
207 #define L (((uint64_t*)buffer)[0])
208 #define R (((uint64_t*)buffer)[1])
210 void seed_enc(void * buffer, const seed_ctx_t * ctx){
214 k = getnextkeys(((seed_ctx_t*)ctx)->k, 2*r);
216 DEBUG_S("\r\n\tDBG ka,0: "); cli_hexdump(&k.k0, 4);
217 DEBUG_S("\r\n\tDBG ka,1: "); cli_hexdump(&k.k1, 4);
218 DEBUG_S("\r\n\t DBG L: "); cli_hexdump((uint8_t*)buffer+0, 8);
219 DEBUG_S("\r\n\t DBG R: "); cli_hexdump((uint8_t*)buffer+8, 8);
221 L ^= f_function(&R,k.k0,k.k1);
223 k = getnextkeys(((seed_ctx_t*)ctx)->k, 2*r+1);
225 DEBUG_S("\r\n\tDBG kb,0: "); cli_hexdump(&k.k0, 4);
226 DEBUG_S("\r\n\tDBG kb,1: "); cli_hexdump(&k.k1, 4);
227 DEBUG_S("\r\n\t DBG L: "); cli_hexdump((uint8_t*)buffer+8, 8);
228 DEBUG_S("\r\n\t DBG R: "); cli_hexdump((uint8_t*)buffer+0, 8);
230 R ^= f_function(&L,k.k0,k.k1);
232 /* just an exchange without temp. variable */
238 /******************************************************************************/
240 #define L (((uint64_t*)buffer)[0])
241 #define R (((uint64_t*)buffer)[1])
243 void seed_dec(void * buffer, const seed_ctx_t * ctx){
247 k = getprevkeys(((seed_ctx_t*)ctx)->k, 2*r+1);
249 DEBUG_S("\r\n\tDBG ka,0: "); cli_hexdump(&k.k0, 4);
250 DEBUG_S("\r\n\tDBG ka,1: "); cli_hexdump(&k.k1, 4);
251 DEBUG_S("\r\n\t DBG L: "); cli_hexdump((uint8_t*)buffer+0, 8);
252 DEBUG_S("\r\n\t DBG R: "); cli_hexdump((uint8_t*)buffer+8, 8);
254 L ^= f_function(&R,k.k0,k.k1);
256 k = getprevkeys(((seed_ctx_t*)ctx)->k, 2*r+0);
258 DEBUG_S("\r\n\tDBG kb,0: "); cli_hexdump(&k.k0, 4);
259 DEBUG_S("\r\n\tDBG kb,1: "); cli_hexdump(&k.k1, 4);
260 DEBUG_S("\r\n\t DBG L: "); cli_hexdump((uint8_t*)buffer+8, 8);
261 DEBUG_S("\r\n\t DBG R: "); cli_hexdump((uint8_t*)buffer+0, 8);
263 R ^= f_function(&L,k.k0,k.k1);
265 /* just an exchange without temp. variable */