3 This file is part of the Crypto-avr-lib/microcrypt-lib.
4 Copyright (C) 2008 Daniel Otte (daniel.otte@rub.de)
6 This program is free software: you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation, either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 * \brief SEED parts in C for AVR
29 #include <avr/pgmspace.h>
31 #include "seed_sbox.h"
36 static uint64_t f_function(uint64_t a, uint32_t k0, uint32_t k1);
37 static uint32_t g_function(uint32_t x);
39 /******************************************************************************/
41 void changeendian32(uint32_t * a){
42 *a = (*a & 0x000000FF) << 24 |
43 (*a & 0x0000FF00) << 8 |
44 (*a & 0x00FF0000) >> 8 |
45 (*a & 0xFF000000) >> 24;
48 /******************************************************************************/
50 void changeendian64(uint64_t * a){
51 *a = (*a & 0x00000000000000FFLL) << 56 |
52 (*a & 0x000000000000FF00LL) << 40 |
53 (*a & 0x0000000000FF0000LL) << 24 |
54 (*a & 0x00000000FF000000LL) << 8 |
55 (*a & 0x000000FF00000000LL) >> 8 |
56 (*a & 0x0000FF0000000000LL) >> 24 |
57 (*a & 0x00FF000000000000LL) >> 40 |
58 (*a & 0xFF00000000000000LL) >> 56 ;
61 /******************************************************************************/
63 uint32_t bigendian_sum32(uint32_t a, uint32_t b);/*{
71 /******************************************************************************/
73 uint32_t bigendian_sub32(uint32_t a, uint32_t b);/*{
81 /******************************************************************************/
83 uint64_t bigendian_rotl8_64(uint64_t a){
86 a = (a<<8) | (a>>(64-8));
89 a = (a>>8) | (a<<(64-8));
93 /******************************************************************************/
95 uint64_t bigendian_rotr8_64(uint64_t a){
98 a = (a>>8) | (a<<(64-8));
101 a = (a<<8) | (a>>(64-8));
105 /******************************************************************************/
107 uint64_t f_function(uint64_t a, uint32_t k0, uint32_t k1){
110 c = a & 0x00000000FFFFFFFFLL;
111 d = (a>>32) & 0x00000000FFFFFFFFLL;
116 c = bigendian_sum32(c,d);
118 d = bigendian_sum32(c,d);
120 c = bigendian_sum32(c,d);
121 a = ((uint64_t)d << 32) | c;
125 /******************************************************************************/
131 #define X3 (((uint8_t*)(&x))[0])
132 #define X2 (((uint8_t*)(&x))[1])
133 #define X1 (((uint8_t*)(&x))[2])
134 #define X0 (((uint8_t*)(&x))[3])
136 #define Z3 (((uint8_t*)(&z))[0])
137 #define Z2 (((uint8_t*)(&z))[1])
138 #define Z1 (((uint8_t*)(&z))[2])
139 #define Z0 (((uint8_t*)(&z))[3])
142 uint32_t g_function(uint32_t x){
144 /* sbox substitution */
145 X3 = pgm_read_byte(&(seed_sbox2[X3]));
146 X2 = pgm_read_byte(&(seed_sbox1[X2]));
147 X1 = pgm_read_byte(&(seed_sbox2[X1]));
148 X0 = pgm_read_byte(&(seed_sbox1[X0]));
149 /* now the permutation */
150 Z0 = (X0 & M0) ^ (X1 & M1) ^ (X2 & M2) ^ (X3 & M3);
151 Z1 = (X0 & M1) ^ (X1 & M2) ^ (X2 & M3) ^ (X3 & M0);
152 Z2 = (X0 & M2) ^ (X1 & M3) ^ (X2 & M0) ^ (X3 & M1);
153 Z3 = (X0 & M3) ^ (X1 & M0) ^ (X2 & M1) ^ (X3 & M2);
156 /******************************************************************************/
161 keypair_t getnextkeys(uint32_t *keystate, uint8_t curround){
167 /* ret.k0 = g_function(keystate[0] + keystate[2] - pgm_read_dword(&(seed_kc[curround])));
168 ret.k1 = g_function(keystate[1] - keystate[3] + pgm_read_dword(&(seed_kc[curround]))); */
169 ret.k0 = bigendian_sum32(keystate[0], keystate[2]);
170 ret.k0 = bigendian_sub32(ret.k0, pgm_read_dword(&(seed_kc[curround])));
171 ret.k0 = g_function(ret.k0);
172 ret.k1 = bigendian_sub32(keystate[1], keystate[3]);
173 ret.k1 = bigendian_sum32(ret.k1, pgm_read_dword(&(seed_kc[curround])));
174 ret.k1 = g_function(ret.k1);
177 /* odd round (1,3,5, ...) */
178 ((uint64_t*)keystate)[1] = bigendian_rotl8_64( ((uint64_t*)keystate)[1] );
180 /* even round (0,2,4, ...) */
181 ((uint64_t*)keystate)[0] = bigendian_rotr8_64(((uint64_t*)keystate)[0]);
188 /******************************************************************************/
190 keypair_t getprevkeys(uint32_t *keystate, uint8_t curround){
197 /* odd round (1,3,5, ..., 15) */
198 ((uint64_t*)keystate)[1] = bigendian_rotr8_64( ((uint64_t*)keystate)[1] );
200 /* even round (0,2,4, ..., 14) */
201 ((uint64_t*)keystate)[0] = bigendian_rotl8_64(((uint64_t*)keystate)[0]);
203 /* ret.k0 = g_function(keystate[0] + keystate[2] - pgm_read_dword(&(seed_kc[curround])));
204 ret.k1 = g_function(keystate[1] - keystate[3] + pgm_read_dword(&(seed_kc[curround]))); */
205 ret.k0 = bigendian_sum32(keystate[0], keystate[2]);
206 ret.k0 = bigendian_sub32(ret.k0, pgm_read_dword(&(seed_kc[curround])));
207 ret.k0 = g_function(ret.k0);
208 ret.k1 = bigendian_sub32(keystate[1], keystate[3]);
209 ret.k1 = bigendian_sum32(ret.k1, pgm_read_dword(&(seed_kc[curround])));
210 ret.k1 = g_function(ret.k1);
215 /******************************************************************************/
221 /******************************************************************************/
223 void seed_init(seed_ctx_t * ctx, uint8_t * key){
224 memcpy(ctx->k, key, 128/8);
227 /******************************************************************************/
229 #define L (((uint64_t*)buffer)[0])
230 #define R (((uint64_t*)buffer)[1])
232 void seed_encrypt(seed_ctx_t * ctx, void * buffer){
236 k = getnextkeys(ctx->k, 2*r);
238 DEBUG_S("\r\n\tDBG ka,0: "); uart_hexdump(&k.k0, 4);
239 DEBUG_S("\r\n\tDBG ka,1: "); uart_hexdump(&k.k1, 4);
240 DEBUG_S("\r\n\t DBG L: "); uart_hexdump((uint8_t*)buffer+0, 8);
241 DEBUG_S("\r\n\t DBG R: "); uart_hexdump((uint8_t*)buffer+8, 8);
243 L ^= f_function(R,k.k0,k.k1);
245 k = getnextkeys(ctx->k, 2*r+1);
247 DEBUG_S("\r\n\tDBG kb,0: "); uart_hexdump(&k.k0, 4);
248 DEBUG_S("\r\n\tDBG kb,1: "); uart_hexdump(&k.k1, 4);
249 DEBUG_S("\r\n\t DBG L: "); uart_hexdump((uint8_t*)buffer+8, 8);
250 DEBUG_S("\r\n\t DBG R: "); uart_hexdump((uint8_t*)buffer+0, 8);
252 R ^= f_function(L,k.k0,k.k1);
254 /* just an exchange without temp. variable */
260 /******************************************************************************/
262 #define L (((uint64_t*)buffer)[0])
263 #define R (((uint64_t*)buffer)[1])
265 void seed_decrypt(seed_ctx_t * ctx, void * buffer){
269 k = getprevkeys(ctx->k, 2*r+1);
271 DEBUG_S("\r\n\tDBG ka,0: "); uart_hexdump(&k.k0, 4);
272 DEBUG_S("\r\n\tDBG ka,1: "); uart_hexdump(&k.k1, 4);
273 DEBUG_S("\r\n\t DBG L: "); uart_hexdump((uint8_t*)buffer+0, 8);
274 DEBUG_S("\r\n\t DBG R: "); uart_hexdump((uint8_t*)buffer+8, 8);
276 L ^= f_function(R,k.k0,k.k1);
278 k = getprevkeys(ctx->k, 2*r+0);
280 DEBUG_S("\r\n\tDBG kb,0: "); uart_hexdump(&k.k0, 4);
281 DEBUG_S("\r\n\tDBG kb,1: "); uart_hexdump(&k.k1, 4);
282 DEBUG_S("\r\n\t DBG L: "); uart_hexdump((uint8_t*)buffer+8, 8);
283 DEBUG_S("\r\n\t DBG R: "); uart_hexdump((uint8_t*)buffer+0, 8);
285 R ^= f_function(L,k.k0,k.k1);
287 /* just an exchange without temp. variable */