Home | History | Annotate | Line # | Download | only in camellia
      1  1.3  gutterid /* $NetBSD: camellia.c,v 1.3 2021/09/04 00:33:09 gutteridge Exp $ */
      2  1.1  drochner 
      3  1.1  drochner /* camellia.h ver 1.1.0
      4  1.1  drochner  *
      5  1.1  drochner  * Copyright (c) 2006
      6  1.1  drochner  * NTT (Nippon Telegraph and Telephone Corporation) . All rights reserved.
      7  1.1  drochner  *
      8  1.1  drochner  * Redistribution and use in source and binary forms, with or without
      9  1.1  drochner  * modification, are permitted provided that the following conditions
     10  1.1  drochner  * are met:
     11  1.1  drochner  * 1. Redistributions of source code must retain the above copyright
     12  1.1  drochner  *   notice, this list of conditions and the following disclaimer as
     13  1.1  drochner  *   the first lines of this file unmodified.
     14  1.1  drochner  * 2. Redistributions in binary form must reproduce the above copyright
     15  1.1  drochner  *   notice, this list of conditions and the following disclaimer in the
     16  1.1  drochner  *   documentation and/or other materials provided with the distribution.
     17  1.1  drochner  *
     18  1.1  drochner  * THIS SOFTWARE IS PROVIDED BY NTT ``AS IS'' AND ANY EXPRESS OR
     19  1.1  drochner  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     20  1.1  drochner  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     21  1.1  drochner  * IN NO EVENT SHALL NTT BE LIABLE FOR ANY DIRECT, INDIRECT,
     22  1.1  drochner  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
     23  1.1  drochner  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
     24  1.1  drochner  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
     25  1.1  drochner  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     26  1.1  drochner  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
     27  1.1  drochner  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     28  1.1  drochner  */
     29  1.1  drochner 
     30  1.1  drochner /*
     31  1.1  drochner  * Algorithm Specification
     32  1.1  drochner  *  http://info.isl.ntt.co.jp/crypt/eng/camellia/specifications.html
     33  1.1  drochner  */
     34  1.1  drochner 
     35  1.1  drochner #include <sys/cdefs.h>
     36  1.3  gutterid __KERNEL_RCSID(0, "$NetBSD: camellia.c,v 1.3 2021/09/04 00:33:09 gutteridge Exp $");
     37  1.3  gutterid 
     38  1.1  drochner #include <sys/types.h>
     39  1.1  drochner #include <sys/systm.h>
     40  1.2  pgoyette #include <sys/errno.h>
     41  1.2  pgoyette #include <sys/module.h>
     42  1.2  pgoyette 
     43  1.1  drochner #include <crypto/camellia/camellia.h>
     44  1.1  drochner 
     45  1.1  drochner 
     46  1.1  drochner /* key constants */
     47  1.1  drochner 
     48  1.1  drochner #define CAMELLIA_SIGMA1L (0xA09E667FL)
     49  1.1  drochner #define CAMELLIA_SIGMA1R (0x3BCC908BL)
     50  1.1  drochner #define CAMELLIA_SIGMA2L (0xB67AE858L)
     51  1.1  drochner #define CAMELLIA_SIGMA2R (0x4CAA73B2L)
     52  1.1  drochner #define CAMELLIA_SIGMA3L (0xC6EF372FL)
     53  1.1  drochner #define CAMELLIA_SIGMA3R (0xE94F82BEL)
     54  1.1  drochner #define CAMELLIA_SIGMA4L (0x54FF53A5L)
     55  1.1  drochner #define CAMELLIA_SIGMA4R (0xF1D36F1CL)
     56  1.1  drochner #define CAMELLIA_SIGMA5L (0x10E527FAL)
     57  1.1  drochner #define CAMELLIA_SIGMA5R (0xDE682D1DL)
     58  1.1  drochner #define CAMELLIA_SIGMA6L (0xB05688C2L)
     59  1.1  drochner #define CAMELLIA_SIGMA6R (0xB3E6C1FDL)
     60  1.1  drochner 
     61  1.1  drochner /*
     62  1.1  drochner  *  macros
     63  1.1  drochner  */
     64  1.1  drochner #define GETU32(pt) (((uint32_t)(pt)[0] << 24)		\
     65  1.1  drochner 		     ^ ((uint32_t)(pt)[1] << 16)	\
     66  1.1  drochner 		     ^ ((uint32_t)(pt)[2] <<  8)	\
     67  1.1  drochner 		     ^ ((uint32_t)(pt)[3]))
     68  1.1  drochner 
     69  1.1  drochner #define PUTU32(ct, st) {(ct)[0] = (uint8_t)((st) >> 24);	\
     70  1.1  drochner 			(ct)[1] = (uint8_t)((st) >> 16);	\
     71  1.1  drochner 			(ct)[2] = (uint8_t)((st) >>  8);	\
     72  1.1  drochner 			(ct)[3] = (uint8_t)(st);}
     73  1.1  drochner 
     74  1.1  drochner #define SUBL(INDEX) (subkey[(INDEX)*2+1])
     75  1.1  drochner #define SUBR(INDEX) (subkey[(INDEX)*2])
     76  1.1  drochner 
     77  1.1  drochner #define CAMELLIA_RR8(x) (((x) >> 8) + ((x) << 24))
     78  1.1  drochner #define CAMELLIA_RL1(x) (((x) << 1) + ((x) >> 31))
     79  1.1  drochner #define CAMELLIA_RL8(x) (((x) << 8) + ((x) >> 24))
     80  1.1  drochner 
     81  1.1  drochner #define CAMELLIA_ROLDQ(ll, lr, rl, rr, w0, w1, bits)	\
     82  1.1  drochner     do {						\
     83  1.1  drochner 	w0 = ll;					\
     84  1.1  drochner 	ll = (ll << bits) + (lr >> (32 - bits));	\
     85  1.1  drochner 	lr = (lr << bits) + (rl >> (32 - bits));	\
     86  1.1  drochner 	rl = (rl << bits) + (rr >> (32 - bits));	\
     87  1.1  drochner 	rr = (rr << bits) + (w0 >> (32 - bits));	\
     88  1.1  drochner     } while(0)
     89  1.1  drochner 
     90  1.1  drochner #define CAMELLIA_ROLDQo32(ll, lr, rl, rr, w0, w1, bits)	\
     91  1.1  drochner     do {						\
     92  1.1  drochner 	w0 = ll;					\
     93  1.1  drochner 	w1 = lr;					\
     94  1.1  drochner 	ll = (lr << (bits - 32)) + (rl >> (64 - bits));	\
     95  1.1  drochner 	lr = (rl << (bits - 32)) + (rr >> (64 - bits));	\
     96  1.1  drochner 	rl = (rr << (bits - 32)) + (w0 >> (64 - bits));	\
     97  1.1  drochner 	rr = (w0 << (bits - 32)) + (w1 >> (64 - bits));	\
     98  1.1  drochner     } while(0)
     99  1.1  drochner 
    100  1.1  drochner #define CAMELLIA_SP1110(INDEX) (camellia_sp1110[(INDEX)])
    101  1.1  drochner #define CAMELLIA_SP0222(INDEX) (camellia_sp0222[(INDEX)])
    102  1.1  drochner #define CAMELLIA_SP3033(INDEX) (camellia_sp3033[(INDEX)])
    103  1.1  drochner #define CAMELLIA_SP4404(INDEX) (camellia_sp4404[(INDEX)])
    104  1.1  drochner 
    105  1.1  drochner #define CAMELLIA_F(xl, xr, kl, kr, yl, yr, il, ir, t0, t1)	\
    106  1.1  drochner     do {							\
    107  1.1  drochner 	il = xl ^ kl;						\
    108  1.1  drochner 	ir = xr ^ kr;						\
    109  1.1  drochner 	t0 = il >> 16;						\
    110  1.1  drochner 	t1 = ir >> 16;						\
    111  1.1  drochner 	yl = CAMELLIA_SP1110(ir & 0xff)				\
    112  1.1  drochner 	    ^ CAMELLIA_SP0222((t1 >> 8) & 0xff)			\
    113  1.1  drochner 	    ^ CAMELLIA_SP3033(t1 & 0xff)			\
    114  1.1  drochner 	    ^ CAMELLIA_SP4404((ir >> 8) & 0xff);		\
    115  1.1  drochner 	yr = CAMELLIA_SP1110((t0 >> 8) & 0xff)			\
    116  1.1  drochner 	    ^ CAMELLIA_SP0222(t0 & 0xff)			\
    117  1.1  drochner 	    ^ CAMELLIA_SP3033((il >> 8) & 0xff)			\
    118  1.1  drochner 	    ^ CAMELLIA_SP4404(il & 0xff);			\
    119  1.1  drochner 	yl ^= yr;						\
    120  1.1  drochner 	yr = CAMELLIA_RR8(yr);					\
    121  1.1  drochner 	yr ^= yl;						\
    122  1.1  drochner     } while(0)
    123  1.1  drochner 
    124  1.1  drochner 
    125  1.1  drochner #define CAMELLIA_FLS(ll, lr, rl, rr, kll, klr, krl, krr, t0, t1, t2, t3) \
    126  1.1  drochner     do {								\
    127  1.1  drochner 	t0 = kll;							\
    128  1.1  drochner 	t2 = krr;							\
    129  1.1  drochner 	t0 &= ll;							\
    130  1.1  drochner 	t2 |= rr;							\
    131  1.1  drochner 	rl ^= t2;							\
    132  1.1  drochner 	lr ^= CAMELLIA_RL1(t0);						\
    133  1.1  drochner 	t3 = krl;							\
    134  1.1  drochner 	t1 = klr;							\
    135  1.1  drochner 	t3 &= rl;							\
    136  1.1  drochner 	t1 |= lr;							\
    137  1.1  drochner 	ll ^= t1;							\
    138  1.1  drochner 	rr ^= CAMELLIA_RL1(t3);						\
    139  1.1  drochner     } while(0)
    140  1.1  drochner 
    141  1.1  drochner #define CAMELLIA_ROUNDSM(xl, xr, kl, kr, yl, yr, il, ir, t0, t1)	\
    142  1.1  drochner     do {								\
    143  1.1  drochner 	ir =  CAMELLIA_SP1110(xr & 0xff);				\
    144  1.1  drochner 	il =  CAMELLIA_SP1110((xl>>24) & 0xff);				\
    145  1.1  drochner 	ir ^= CAMELLIA_SP0222((xr>>24) & 0xff);				\
    146  1.1  drochner 	il ^= CAMELLIA_SP0222((xl>>16) & 0xff);				\
    147  1.1  drochner 	ir ^= CAMELLIA_SP3033((xr>>16) & 0xff);				\
    148  1.1  drochner 	il ^= CAMELLIA_SP3033((xl>>8) & 0xff);				\
    149  1.1  drochner 	ir ^= CAMELLIA_SP4404((xr>>8) & 0xff);				\
    150  1.1  drochner 	il ^= CAMELLIA_SP4404(xl & 0xff);				\
    151  1.1  drochner 	il ^= kl;							\
    152  1.1  drochner 	ir ^= kr;							\
    153  1.1  drochner 	ir ^= il;							\
    154  1.1  drochner 	il = CAMELLIA_RR8(il);						\
    155  1.1  drochner 	il ^= ir;							\
    156  1.1  drochner 	yl ^= ir;							\
    157  1.1  drochner 	yr ^= il;							\
    158  1.1  drochner     } while(0)
    159  1.1  drochner 
    160  1.1  drochner 
    161  1.1  drochner static const uint32_t camellia_sp1110[256] = {
    162  1.1  drochner     0x70707000,0x82828200,0x2c2c2c00,0xececec00,
    163  1.1  drochner     0xb3b3b300,0x27272700,0xc0c0c000,0xe5e5e500,
    164  1.1  drochner     0xe4e4e400,0x85858500,0x57575700,0x35353500,
    165  1.1  drochner     0xeaeaea00,0x0c0c0c00,0xaeaeae00,0x41414100,
    166  1.1  drochner     0x23232300,0xefefef00,0x6b6b6b00,0x93939300,
    167  1.1  drochner     0x45454500,0x19191900,0xa5a5a500,0x21212100,
    168  1.1  drochner     0xededed00,0x0e0e0e00,0x4f4f4f00,0x4e4e4e00,
    169  1.1  drochner     0x1d1d1d00,0x65656500,0x92929200,0xbdbdbd00,
    170  1.1  drochner     0x86868600,0xb8b8b800,0xafafaf00,0x8f8f8f00,
    171  1.1  drochner     0x7c7c7c00,0xebebeb00,0x1f1f1f00,0xcecece00,
    172  1.1  drochner     0x3e3e3e00,0x30303000,0xdcdcdc00,0x5f5f5f00,
    173  1.1  drochner     0x5e5e5e00,0xc5c5c500,0x0b0b0b00,0x1a1a1a00,
    174  1.1  drochner     0xa6a6a600,0xe1e1e100,0x39393900,0xcacaca00,
    175  1.1  drochner     0xd5d5d500,0x47474700,0x5d5d5d00,0x3d3d3d00,
    176  1.1  drochner     0xd9d9d900,0x01010100,0x5a5a5a00,0xd6d6d600,
    177  1.1  drochner     0x51515100,0x56565600,0x6c6c6c00,0x4d4d4d00,
    178  1.1  drochner     0x8b8b8b00,0x0d0d0d00,0x9a9a9a00,0x66666600,
    179  1.1  drochner     0xfbfbfb00,0xcccccc00,0xb0b0b000,0x2d2d2d00,
    180  1.1  drochner     0x74747400,0x12121200,0x2b2b2b00,0x20202000,
    181  1.1  drochner     0xf0f0f000,0xb1b1b100,0x84848400,0x99999900,
    182  1.1  drochner     0xdfdfdf00,0x4c4c4c00,0xcbcbcb00,0xc2c2c200,
    183  1.1  drochner     0x34343400,0x7e7e7e00,0x76767600,0x05050500,
    184  1.1  drochner     0x6d6d6d00,0xb7b7b700,0xa9a9a900,0x31313100,
    185  1.1  drochner     0xd1d1d100,0x17171700,0x04040400,0xd7d7d700,
    186  1.1  drochner     0x14141400,0x58585800,0x3a3a3a00,0x61616100,
    187  1.1  drochner     0xdedede00,0x1b1b1b00,0x11111100,0x1c1c1c00,
    188  1.1  drochner     0x32323200,0x0f0f0f00,0x9c9c9c00,0x16161600,
    189  1.1  drochner     0x53535300,0x18181800,0xf2f2f200,0x22222200,
    190  1.1  drochner     0xfefefe00,0x44444400,0xcfcfcf00,0xb2b2b200,
    191  1.1  drochner     0xc3c3c300,0xb5b5b500,0x7a7a7a00,0x91919100,
    192  1.1  drochner     0x24242400,0x08080800,0xe8e8e800,0xa8a8a800,
    193  1.1  drochner     0x60606000,0xfcfcfc00,0x69696900,0x50505000,
    194  1.1  drochner     0xaaaaaa00,0xd0d0d000,0xa0a0a000,0x7d7d7d00,
    195  1.1  drochner     0xa1a1a100,0x89898900,0x62626200,0x97979700,
    196  1.1  drochner     0x54545400,0x5b5b5b00,0x1e1e1e00,0x95959500,
    197  1.1  drochner     0xe0e0e000,0xffffff00,0x64646400,0xd2d2d200,
    198  1.1  drochner     0x10101000,0xc4c4c400,0x00000000,0x48484800,
    199  1.1  drochner     0xa3a3a300,0xf7f7f700,0x75757500,0xdbdbdb00,
    200  1.1  drochner     0x8a8a8a00,0x03030300,0xe6e6e600,0xdadada00,
    201  1.1  drochner     0x09090900,0x3f3f3f00,0xdddddd00,0x94949400,
    202  1.1  drochner     0x87878700,0x5c5c5c00,0x83838300,0x02020200,
    203  1.1  drochner     0xcdcdcd00,0x4a4a4a00,0x90909000,0x33333300,
    204  1.1  drochner     0x73737300,0x67676700,0xf6f6f600,0xf3f3f300,
    205  1.1  drochner     0x9d9d9d00,0x7f7f7f00,0xbfbfbf00,0xe2e2e200,
    206  1.1  drochner     0x52525200,0x9b9b9b00,0xd8d8d800,0x26262600,
    207  1.1  drochner     0xc8c8c800,0x37373700,0xc6c6c600,0x3b3b3b00,
    208  1.1  drochner     0x81818100,0x96969600,0x6f6f6f00,0x4b4b4b00,
    209  1.1  drochner     0x13131300,0xbebebe00,0x63636300,0x2e2e2e00,
    210  1.1  drochner     0xe9e9e900,0x79797900,0xa7a7a700,0x8c8c8c00,
    211  1.1  drochner     0x9f9f9f00,0x6e6e6e00,0xbcbcbc00,0x8e8e8e00,
    212  1.1  drochner     0x29292900,0xf5f5f500,0xf9f9f900,0xb6b6b600,
    213  1.1  drochner     0x2f2f2f00,0xfdfdfd00,0xb4b4b400,0x59595900,
    214  1.1  drochner     0x78787800,0x98989800,0x06060600,0x6a6a6a00,
    215  1.1  drochner     0xe7e7e700,0x46464600,0x71717100,0xbababa00,
    216  1.1  drochner     0xd4d4d400,0x25252500,0xababab00,0x42424200,
    217  1.1  drochner     0x88888800,0xa2a2a200,0x8d8d8d00,0xfafafa00,
    218  1.1  drochner     0x72727200,0x07070700,0xb9b9b900,0x55555500,
    219  1.1  drochner     0xf8f8f800,0xeeeeee00,0xacacac00,0x0a0a0a00,
    220  1.1  drochner     0x36363600,0x49494900,0x2a2a2a00,0x68686800,
    221  1.1  drochner     0x3c3c3c00,0x38383800,0xf1f1f100,0xa4a4a400,
    222  1.1  drochner     0x40404000,0x28282800,0xd3d3d300,0x7b7b7b00,
    223  1.1  drochner     0xbbbbbb00,0xc9c9c900,0x43434300,0xc1c1c100,
    224  1.1  drochner     0x15151500,0xe3e3e300,0xadadad00,0xf4f4f400,
    225  1.1  drochner     0x77777700,0xc7c7c700,0x80808000,0x9e9e9e00,
    226  1.1  drochner };
    227  1.1  drochner 
    228  1.1  drochner static const uint32_t camellia_sp0222[256] = {
    229  1.1  drochner     0x00e0e0e0,0x00050505,0x00585858,0x00d9d9d9,
    230  1.1  drochner     0x00676767,0x004e4e4e,0x00818181,0x00cbcbcb,
    231  1.1  drochner     0x00c9c9c9,0x000b0b0b,0x00aeaeae,0x006a6a6a,
    232  1.1  drochner     0x00d5d5d5,0x00181818,0x005d5d5d,0x00828282,
    233  1.1  drochner     0x00464646,0x00dfdfdf,0x00d6d6d6,0x00272727,
    234  1.1  drochner     0x008a8a8a,0x00323232,0x004b4b4b,0x00424242,
    235  1.1  drochner     0x00dbdbdb,0x001c1c1c,0x009e9e9e,0x009c9c9c,
    236  1.1  drochner     0x003a3a3a,0x00cacaca,0x00252525,0x007b7b7b,
    237  1.1  drochner     0x000d0d0d,0x00717171,0x005f5f5f,0x001f1f1f,
    238  1.1  drochner     0x00f8f8f8,0x00d7d7d7,0x003e3e3e,0x009d9d9d,
    239  1.1  drochner     0x007c7c7c,0x00606060,0x00b9b9b9,0x00bebebe,
    240  1.1  drochner     0x00bcbcbc,0x008b8b8b,0x00161616,0x00343434,
    241  1.1  drochner     0x004d4d4d,0x00c3c3c3,0x00727272,0x00959595,
    242  1.1  drochner     0x00ababab,0x008e8e8e,0x00bababa,0x007a7a7a,
    243  1.1  drochner     0x00b3b3b3,0x00020202,0x00b4b4b4,0x00adadad,
    244  1.1  drochner     0x00a2a2a2,0x00acacac,0x00d8d8d8,0x009a9a9a,
    245  1.1  drochner     0x00171717,0x001a1a1a,0x00353535,0x00cccccc,
    246  1.1  drochner     0x00f7f7f7,0x00999999,0x00616161,0x005a5a5a,
    247  1.1  drochner     0x00e8e8e8,0x00242424,0x00565656,0x00404040,
    248  1.1  drochner     0x00e1e1e1,0x00636363,0x00090909,0x00333333,
    249  1.1  drochner     0x00bfbfbf,0x00989898,0x00979797,0x00858585,
    250  1.1  drochner     0x00686868,0x00fcfcfc,0x00ececec,0x000a0a0a,
    251  1.1  drochner     0x00dadada,0x006f6f6f,0x00535353,0x00626262,
    252  1.1  drochner     0x00a3a3a3,0x002e2e2e,0x00080808,0x00afafaf,
    253  1.1  drochner     0x00282828,0x00b0b0b0,0x00747474,0x00c2c2c2,
    254  1.1  drochner     0x00bdbdbd,0x00363636,0x00222222,0x00383838,
    255  1.1  drochner     0x00646464,0x001e1e1e,0x00393939,0x002c2c2c,
    256  1.1  drochner     0x00a6a6a6,0x00303030,0x00e5e5e5,0x00444444,
    257  1.1  drochner     0x00fdfdfd,0x00888888,0x009f9f9f,0x00656565,
    258  1.1  drochner     0x00878787,0x006b6b6b,0x00f4f4f4,0x00232323,
    259  1.1  drochner     0x00484848,0x00101010,0x00d1d1d1,0x00515151,
    260  1.1  drochner     0x00c0c0c0,0x00f9f9f9,0x00d2d2d2,0x00a0a0a0,
    261  1.1  drochner     0x00555555,0x00a1a1a1,0x00414141,0x00fafafa,
    262  1.1  drochner     0x00434343,0x00131313,0x00c4c4c4,0x002f2f2f,
    263  1.1  drochner     0x00a8a8a8,0x00b6b6b6,0x003c3c3c,0x002b2b2b,
    264  1.1  drochner     0x00c1c1c1,0x00ffffff,0x00c8c8c8,0x00a5a5a5,
    265  1.1  drochner     0x00202020,0x00898989,0x00000000,0x00909090,
    266  1.1  drochner     0x00474747,0x00efefef,0x00eaeaea,0x00b7b7b7,
    267  1.1  drochner     0x00151515,0x00060606,0x00cdcdcd,0x00b5b5b5,
    268  1.1  drochner     0x00121212,0x007e7e7e,0x00bbbbbb,0x00292929,
    269  1.1  drochner     0x000f0f0f,0x00b8b8b8,0x00070707,0x00040404,
    270  1.1  drochner     0x009b9b9b,0x00949494,0x00212121,0x00666666,
    271  1.1  drochner     0x00e6e6e6,0x00cecece,0x00ededed,0x00e7e7e7,
    272  1.1  drochner     0x003b3b3b,0x00fefefe,0x007f7f7f,0x00c5c5c5,
    273  1.1  drochner     0x00a4a4a4,0x00373737,0x00b1b1b1,0x004c4c4c,
    274  1.1  drochner     0x00919191,0x006e6e6e,0x008d8d8d,0x00767676,
    275  1.1  drochner     0x00030303,0x002d2d2d,0x00dedede,0x00969696,
    276  1.1  drochner     0x00262626,0x007d7d7d,0x00c6c6c6,0x005c5c5c,
    277  1.1  drochner     0x00d3d3d3,0x00f2f2f2,0x004f4f4f,0x00191919,
    278  1.1  drochner     0x003f3f3f,0x00dcdcdc,0x00797979,0x001d1d1d,
    279  1.1  drochner     0x00525252,0x00ebebeb,0x00f3f3f3,0x006d6d6d,
    280  1.1  drochner     0x005e5e5e,0x00fbfbfb,0x00696969,0x00b2b2b2,
    281  1.1  drochner     0x00f0f0f0,0x00313131,0x000c0c0c,0x00d4d4d4,
    282  1.1  drochner     0x00cfcfcf,0x008c8c8c,0x00e2e2e2,0x00757575,
    283  1.1  drochner     0x00a9a9a9,0x004a4a4a,0x00575757,0x00848484,
    284  1.1  drochner     0x00111111,0x00454545,0x001b1b1b,0x00f5f5f5,
    285  1.1  drochner     0x00e4e4e4,0x000e0e0e,0x00737373,0x00aaaaaa,
    286  1.1  drochner     0x00f1f1f1,0x00dddddd,0x00595959,0x00141414,
    287  1.1  drochner     0x006c6c6c,0x00929292,0x00545454,0x00d0d0d0,
    288  1.1  drochner     0x00787878,0x00707070,0x00e3e3e3,0x00494949,
    289  1.1  drochner     0x00808080,0x00505050,0x00a7a7a7,0x00f6f6f6,
    290  1.1  drochner     0x00777777,0x00939393,0x00868686,0x00838383,
    291  1.1  drochner     0x002a2a2a,0x00c7c7c7,0x005b5b5b,0x00e9e9e9,
    292  1.1  drochner     0x00eeeeee,0x008f8f8f,0x00010101,0x003d3d3d,
    293  1.1  drochner };
    294  1.1  drochner 
    295  1.1  drochner static const uint32_t camellia_sp3033[256] = {
    296  1.1  drochner     0x38003838,0x41004141,0x16001616,0x76007676,
    297  1.1  drochner     0xd900d9d9,0x93009393,0x60006060,0xf200f2f2,
    298  1.1  drochner     0x72007272,0xc200c2c2,0xab00abab,0x9a009a9a,
    299  1.1  drochner     0x75007575,0x06000606,0x57005757,0xa000a0a0,
    300  1.1  drochner     0x91009191,0xf700f7f7,0xb500b5b5,0xc900c9c9,
    301  1.1  drochner     0xa200a2a2,0x8c008c8c,0xd200d2d2,0x90009090,
    302  1.1  drochner     0xf600f6f6,0x07000707,0xa700a7a7,0x27002727,
    303  1.1  drochner     0x8e008e8e,0xb200b2b2,0x49004949,0xde00dede,
    304  1.1  drochner     0x43004343,0x5c005c5c,0xd700d7d7,0xc700c7c7,
    305  1.1  drochner     0x3e003e3e,0xf500f5f5,0x8f008f8f,0x67006767,
    306  1.1  drochner     0x1f001f1f,0x18001818,0x6e006e6e,0xaf00afaf,
    307  1.1  drochner     0x2f002f2f,0xe200e2e2,0x85008585,0x0d000d0d,
    308  1.1  drochner     0x53005353,0xf000f0f0,0x9c009c9c,0x65006565,
    309  1.1  drochner     0xea00eaea,0xa300a3a3,0xae00aeae,0x9e009e9e,
    310  1.1  drochner     0xec00ecec,0x80008080,0x2d002d2d,0x6b006b6b,
    311  1.1  drochner     0xa800a8a8,0x2b002b2b,0x36003636,0xa600a6a6,
    312  1.1  drochner     0xc500c5c5,0x86008686,0x4d004d4d,0x33003333,
    313  1.1  drochner     0xfd00fdfd,0x66006666,0x58005858,0x96009696,
    314  1.1  drochner     0x3a003a3a,0x09000909,0x95009595,0x10001010,
    315  1.1  drochner     0x78007878,0xd800d8d8,0x42004242,0xcc00cccc,
    316  1.1  drochner     0xef00efef,0x26002626,0xe500e5e5,0x61006161,
    317  1.1  drochner     0x1a001a1a,0x3f003f3f,0x3b003b3b,0x82008282,
    318  1.1  drochner     0xb600b6b6,0xdb00dbdb,0xd400d4d4,0x98009898,
    319  1.1  drochner     0xe800e8e8,0x8b008b8b,0x02000202,0xeb00ebeb,
    320  1.1  drochner     0x0a000a0a,0x2c002c2c,0x1d001d1d,0xb000b0b0,
    321  1.1  drochner     0x6f006f6f,0x8d008d8d,0x88008888,0x0e000e0e,
    322  1.1  drochner     0x19001919,0x87008787,0x4e004e4e,0x0b000b0b,
    323  1.1  drochner     0xa900a9a9,0x0c000c0c,0x79007979,0x11001111,
    324  1.1  drochner     0x7f007f7f,0x22002222,0xe700e7e7,0x59005959,
    325  1.1  drochner     0xe100e1e1,0xda00dada,0x3d003d3d,0xc800c8c8,
    326  1.1  drochner     0x12001212,0x04000404,0x74007474,0x54005454,
    327  1.1  drochner     0x30003030,0x7e007e7e,0xb400b4b4,0x28002828,
    328  1.1  drochner     0x55005555,0x68006868,0x50005050,0xbe00bebe,
    329  1.1  drochner     0xd000d0d0,0xc400c4c4,0x31003131,0xcb00cbcb,
    330  1.1  drochner     0x2a002a2a,0xad00adad,0x0f000f0f,0xca00caca,
    331  1.1  drochner     0x70007070,0xff00ffff,0x32003232,0x69006969,
    332  1.1  drochner     0x08000808,0x62006262,0x00000000,0x24002424,
    333  1.1  drochner     0xd100d1d1,0xfb00fbfb,0xba00baba,0xed00eded,
    334  1.1  drochner     0x45004545,0x81008181,0x73007373,0x6d006d6d,
    335  1.1  drochner     0x84008484,0x9f009f9f,0xee00eeee,0x4a004a4a,
    336  1.1  drochner     0xc300c3c3,0x2e002e2e,0xc100c1c1,0x01000101,
    337  1.1  drochner     0xe600e6e6,0x25002525,0x48004848,0x99009999,
    338  1.1  drochner     0xb900b9b9,0xb300b3b3,0x7b007b7b,0xf900f9f9,
    339  1.1  drochner     0xce00cece,0xbf00bfbf,0xdf00dfdf,0x71007171,
    340  1.1  drochner     0x29002929,0xcd00cdcd,0x6c006c6c,0x13001313,
    341  1.1  drochner     0x64006464,0x9b009b9b,0x63006363,0x9d009d9d,
    342  1.1  drochner     0xc000c0c0,0x4b004b4b,0xb700b7b7,0xa500a5a5,
    343  1.1  drochner     0x89008989,0x5f005f5f,0xb100b1b1,0x17001717,
    344  1.1  drochner     0xf400f4f4,0xbc00bcbc,0xd300d3d3,0x46004646,
    345  1.1  drochner     0xcf00cfcf,0x37003737,0x5e005e5e,0x47004747,
    346  1.1  drochner     0x94009494,0xfa00fafa,0xfc00fcfc,0x5b005b5b,
    347  1.1  drochner     0x97009797,0xfe00fefe,0x5a005a5a,0xac00acac,
    348  1.1  drochner     0x3c003c3c,0x4c004c4c,0x03000303,0x35003535,
    349  1.1  drochner     0xf300f3f3,0x23002323,0xb800b8b8,0x5d005d5d,
    350  1.1  drochner     0x6a006a6a,0x92009292,0xd500d5d5,0x21002121,
    351  1.1  drochner     0x44004444,0x51005151,0xc600c6c6,0x7d007d7d,
    352  1.1  drochner     0x39003939,0x83008383,0xdc00dcdc,0xaa00aaaa,
    353  1.1  drochner     0x7c007c7c,0x77007777,0x56005656,0x05000505,
    354  1.1  drochner     0x1b001b1b,0xa400a4a4,0x15001515,0x34003434,
    355  1.1  drochner     0x1e001e1e,0x1c001c1c,0xf800f8f8,0x52005252,
    356  1.1  drochner     0x20002020,0x14001414,0xe900e9e9,0xbd00bdbd,
    357  1.1  drochner     0xdd00dddd,0xe400e4e4,0xa100a1a1,0xe000e0e0,
    358  1.1  drochner     0x8a008a8a,0xf100f1f1,0xd600d6d6,0x7a007a7a,
    359  1.1  drochner     0xbb00bbbb,0xe300e3e3,0x40004040,0x4f004f4f,
    360  1.1  drochner };
    361  1.1  drochner 
    362  1.1  drochner static const uint32_t camellia_sp4404[256] = {
    363  1.1  drochner     0x70700070,0x2c2c002c,0xb3b300b3,0xc0c000c0,
    364  1.1  drochner     0xe4e400e4,0x57570057,0xeaea00ea,0xaeae00ae,
    365  1.1  drochner     0x23230023,0x6b6b006b,0x45450045,0xa5a500a5,
    366  1.1  drochner     0xeded00ed,0x4f4f004f,0x1d1d001d,0x92920092,
    367  1.1  drochner     0x86860086,0xafaf00af,0x7c7c007c,0x1f1f001f,
    368  1.1  drochner     0x3e3e003e,0xdcdc00dc,0x5e5e005e,0x0b0b000b,
    369  1.1  drochner     0xa6a600a6,0x39390039,0xd5d500d5,0x5d5d005d,
    370  1.1  drochner     0xd9d900d9,0x5a5a005a,0x51510051,0x6c6c006c,
    371  1.1  drochner     0x8b8b008b,0x9a9a009a,0xfbfb00fb,0xb0b000b0,
    372  1.1  drochner     0x74740074,0x2b2b002b,0xf0f000f0,0x84840084,
    373  1.1  drochner     0xdfdf00df,0xcbcb00cb,0x34340034,0x76760076,
    374  1.1  drochner     0x6d6d006d,0xa9a900a9,0xd1d100d1,0x04040004,
    375  1.1  drochner     0x14140014,0x3a3a003a,0xdede00de,0x11110011,
    376  1.1  drochner     0x32320032,0x9c9c009c,0x53530053,0xf2f200f2,
    377  1.1  drochner     0xfefe00fe,0xcfcf00cf,0xc3c300c3,0x7a7a007a,
    378  1.1  drochner     0x24240024,0xe8e800e8,0x60600060,0x69690069,
    379  1.1  drochner     0xaaaa00aa,0xa0a000a0,0xa1a100a1,0x62620062,
    380  1.1  drochner     0x54540054,0x1e1e001e,0xe0e000e0,0x64640064,
    381  1.1  drochner     0x10100010,0x00000000,0xa3a300a3,0x75750075,
    382  1.1  drochner     0x8a8a008a,0xe6e600e6,0x09090009,0xdddd00dd,
    383  1.1  drochner     0x87870087,0x83830083,0xcdcd00cd,0x90900090,
    384  1.1  drochner     0x73730073,0xf6f600f6,0x9d9d009d,0xbfbf00bf,
    385  1.1  drochner     0x52520052,0xd8d800d8,0xc8c800c8,0xc6c600c6,
    386  1.1  drochner     0x81810081,0x6f6f006f,0x13130013,0x63630063,
    387  1.1  drochner     0xe9e900e9,0xa7a700a7,0x9f9f009f,0xbcbc00bc,
    388  1.1  drochner     0x29290029,0xf9f900f9,0x2f2f002f,0xb4b400b4,
    389  1.1  drochner     0x78780078,0x06060006,0xe7e700e7,0x71710071,
    390  1.1  drochner     0xd4d400d4,0xabab00ab,0x88880088,0x8d8d008d,
    391  1.1  drochner     0x72720072,0xb9b900b9,0xf8f800f8,0xacac00ac,
    392  1.1  drochner     0x36360036,0x2a2a002a,0x3c3c003c,0xf1f100f1,
    393  1.1  drochner     0x40400040,0xd3d300d3,0xbbbb00bb,0x43430043,
    394  1.1  drochner     0x15150015,0xadad00ad,0x77770077,0x80800080,
    395  1.1  drochner     0x82820082,0xecec00ec,0x27270027,0xe5e500e5,
    396  1.1  drochner     0x85850085,0x35350035,0x0c0c000c,0x41410041,
    397  1.1  drochner     0xefef00ef,0x93930093,0x19190019,0x21210021,
    398  1.1  drochner     0x0e0e000e,0x4e4e004e,0x65650065,0xbdbd00bd,
    399  1.1  drochner     0xb8b800b8,0x8f8f008f,0xebeb00eb,0xcece00ce,
    400  1.1  drochner     0x30300030,0x5f5f005f,0xc5c500c5,0x1a1a001a,
    401  1.1  drochner     0xe1e100e1,0xcaca00ca,0x47470047,0x3d3d003d,
    402  1.1  drochner     0x01010001,0xd6d600d6,0x56560056,0x4d4d004d,
    403  1.1  drochner     0x0d0d000d,0x66660066,0xcccc00cc,0x2d2d002d,
    404  1.1  drochner     0x12120012,0x20200020,0xb1b100b1,0x99990099,
    405  1.1  drochner     0x4c4c004c,0xc2c200c2,0x7e7e007e,0x05050005,
    406  1.1  drochner     0xb7b700b7,0x31310031,0x17170017,0xd7d700d7,
    407  1.1  drochner     0x58580058,0x61610061,0x1b1b001b,0x1c1c001c,
    408  1.1  drochner     0x0f0f000f,0x16160016,0x18180018,0x22220022,
    409  1.1  drochner     0x44440044,0xb2b200b2,0xb5b500b5,0x91910091,
    410  1.1  drochner     0x08080008,0xa8a800a8,0xfcfc00fc,0x50500050,
    411  1.1  drochner     0xd0d000d0,0x7d7d007d,0x89890089,0x97970097,
    412  1.1  drochner     0x5b5b005b,0x95950095,0xffff00ff,0xd2d200d2,
    413  1.1  drochner     0xc4c400c4,0x48480048,0xf7f700f7,0xdbdb00db,
    414  1.1  drochner     0x03030003,0xdada00da,0x3f3f003f,0x94940094,
    415  1.1  drochner     0x5c5c005c,0x02020002,0x4a4a004a,0x33330033,
    416  1.1  drochner     0x67670067,0xf3f300f3,0x7f7f007f,0xe2e200e2,
    417  1.1  drochner     0x9b9b009b,0x26260026,0x37370037,0x3b3b003b,
    418  1.1  drochner     0x96960096,0x4b4b004b,0xbebe00be,0x2e2e002e,
    419  1.1  drochner     0x79790079,0x8c8c008c,0x6e6e006e,0x8e8e008e,
    420  1.1  drochner     0xf5f500f5,0xb6b600b6,0xfdfd00fd,0x59590059,
    421  1.1  drochner     0x98980098,0x6a6a006a,0x46460046,0xbaba00ba,
    422  1.1  drochner     0x25250025,0x42420042,0xa2a200a2,0xfafa00fa,
    423  1.1  drochner     0x07070007,0x55550055,0xeeee00ee,0x0a0a000a,
    424  1.1  drochner     0x49490049,0x68680068,0x38380038,0xa4a400a4,
    425  1.1  drochner     0x28280028,0x7b7b007b,0xc9c900c9,0xc1c100c1,
    426  1.1  drochner     0xe3e300e3,0xf4f400f4,0xc7c700c7,0x9e9e009e,
    427  1.1  drochner };
    428  1.1  drochner 
    429  1.1  drochner 
    430  1.1  drochner /*
    431  1.1  drochner  * Stuff related to the Camellia key schedule
    432  1.1  drochner  */
    433  1.1  drochner #define subl(x) subL[(x)]
    434  1.1  drochner #define subr(x) subR[(x)]
    435  1.1  drochner 
    436  1.1  drochner void
    437  1.1  drochner camellia_setup128(const unsigned char *key, uint32_t *subkey)
    438  1.1  drochner {
    439  1.1  drochner     uint32_t kll, klr, krl, krr;
    440  1.1  drochner     uint32_t il, ir, t0, t1, w0, w1;
    441  1.1  drochner     uint32_t kw4l, kw4r, dw, tl, tr;
    442  1.1  drochner     uint32_t subL[26];
    443  1.1  drochner     uint32_t subR[26];
    444  1.1  drochner 
    445  1.1  drochner     /*
    446  1.1  drochner      *  k == kll || klr || krl || krr (|| is concatination)
    447  1.1  drochner      */
    448  1.1  drochner     kll = GETU32(key     );
    449  1.1  drochner     klr = GETU32(key +  4);
    450  1.1  drochner     krl = GETU32(key +  8);
    451  1.1  drochner     krr = GETU32(key + 12);
    452  1.1  drochner     /*
    453  1.1  drochner      * generate KL dependent subkeys
    454  1.1  drochner      */
    455  1.1  drochner     subl(0) = kll; subr(0) = klr;
    456  1.1  drochner     subl(1) = krl; subr(1) = krr;
    457  1.1  drochner     CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
    458  1.1  drochner     subl(4) = kll; subr(4) = klr;
    459  1.1  drochner     subl(5) = krl; subr(5) = krr;
    460  1.1  drochner     CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 30);
    461  1.1  drochner     subl(10) = kll; subr(10) = klr;
    462  1.1  drochner     subl(11) = krl; subr(11) = krr;
    463  1.1  drochner     CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
    464  1.1  drochner     subl(13) = krl; subr(13) = krr;
    465  1.1  drochner     CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 17);
    466  1.1  drochner     subl(16) = kll; subr(16) = klr;
    467  1.1  drochner     subl(17) = krl; subr(17) = krr;
    468  1.1  drochner     CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 17);
    469  1.1  drochner     subl(18) = kll; subr(18) = klr;
    470  1.1  drochner     subl(19) = krl; subr(19) = krr;
    471  1.1  drochner     CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 17);
    472  1.1  drochner     subl(22) = kll; subr(22) = klr;
    473  1.1  drochner     subl(23) = krl; subr(23) = krr;
    474  1.1  drochner 
    475  1.1  drochner     /* generate KA */
    476  1.1  drochner     kll = subl(0); klr = subr(0);
    477  1.1  drochner     krl = subl(1); krr = subr(1);
    478  1.1  drochner     CAMELLIA_F(kll, klr, CAMELLIA_SIGMA1L, CAMELLIA_SIGMA1R,
    479  1.1  drochner 	       w0, w1, il, ir, t0, t1);
    480  1.1  drochner     krl ^= w0; krr ^= w1;
    481  1.1  drochner     CAMELLIA_F(krl, krr, CAMELLIA_SIGMA2L, CAMELLIA_SIGMA2R,
    482  1.1  drochner 	       kll, klr, il, ir, t0, t1);
    483  1.1  drochner     CAMELLIA_F(kll, klr, CAMELLIA_SIGMA3L, CAMELLIA_SIGMA3R,
    484  1.1  drochner 	       krl, krr, il, ir, t0, t1);
    485  1.1  drochner     krl ^= w0; krr ^= w1;
    486  1.1  drochner     CAMELLIA_F(krl, krr, CAMELLIA_SIGMA4L, CAMELLIA_SIGMA4R,
    487  1.1  drochner 	       w0, w1, il, ir, t0, t1);
    488  1.1  drochner     kll ^= w0; klr ^= w1;
    489  1.1  drochner 
    490  1.1  drochner     /* generate KA dependent subkeys */
    491  1.1  drochner     subl(2) = kll; subr(2) = klr;
    492  1.1  drochner     subl(3) = krl; subr(3) = krr;
    493  1.1  drochner     CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
    494  1.1  drochner     subl(6) = kll; subr(6) = klr;
    495  1.1  drochner     subl(7) = krl; subr(7) = krr;
    496  1.1  drochner     CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
    497  1.1  drochner     subl(8) = kll; subr(8) = klr;
    498  1.1  drochner     subl(9) = krl; subr(9) = krr;
    499  1.1  drochner     CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
    500  1.1  drochner     subl(12) = kll; subr(12) = klr;
    501  1.1  drochner     CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
    502  1.1  drochner     subl(14) = kll; subr(14) = klr;
    503  1.1  drochner     subl(15) = krl; subr(15) = krr;
    504  1.1  drochner     CAMELLIA_ROLDQo32(kll, klr, krl, krr, w0, w1, 34);
    505  1.1  drochner     subl(20) = kll; subr(20) = klr;
    506  1.1  drochner     subl(21) = krl; subr(21) = krr;
    507  1.1  drochner     CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 17);
    508  1.1  drochner     subl(24) = kll; subr(24) = klr;
    509  1.1  drochner     subl(25) = krl; subr(25) = krr;
    510  1.1  drochner 
    511  1.1  drochner 
    512  1.1  drochner     /* absorb kw2 to other subkeys */
    513  1.1  drochner     subl(3) ^= subl(1); subr(3) ^= subr(1);
    514  1.1  drochner     subl(5) ^= subl(1); subr(5) ^= subr(1);
    515  1.1  drochner     subl(7) ^= subl(1); subr(7) ^= subr(1);
    516  1.1  drochner     subl(1) ^= subr(1) & ~subr(9);
    517  1.1  drochner     dw = subl(1) & subl(9), subr(1) ^= CAMELLIA_RL1(dw);
    518  1.1  drochner     subl(11) ^= subl(1); subr(11) ^= subr(1);
    519  1.1  drochner     subl(13) ^= subl(1); subr(13) ^= subr(1);
    520  1.1  drochner     subl(15) ^= subl(1); subr(15) ^= subr(1);
    521  1.1  drochner     subl(1) ^= subr(1) & ~subr(17);
    522  1.1  drochner     dw = subl(1) & subl(17), subr(1) ^= CAMELLIA_RL1(dw);
    523  1.1  drochner     subl(19) ^= subl(1); subr(19) ^= subr(1);
    524  1.1  drochner     subl(21) ^= subl(1); subr(21) ^= subr(1);
    525  1.1  drochner     subl(23) ^= subl(1); subr(23) ^= subr(1);
    526  1.1  drochner     subl(24) ^= subl(1); subr(24) ^= subr(1);
    527  1.1  drochner 
    528  1.1  drochner     /* absorb kw4 to other subkeys */
    529  1.1  drochner     kw4l = subl(25); kw4r = subr(25);
    530  1.1  drochner     subl(22) ^= kw4l; subr(22) ^= kw4r;
    531  1.1  drochner     subl(20) ^= kw4l; subr(20) ^= kw4r;
    532  1.1  drochner     subl(18) ^= kw4l; subr(18) ^= kw4r;
    533  1.1  drochner     kw4l ^= kw4r & ~subr(16);
    534  1.1  drochner     dw = kw4l & subl(16), kw4r ^= CAMELLIA_RL1(dw);
    535  1.1  drochner     subl(14) ^= kw4l; subr(14) ^= kw4r;
    536  1.1  drochner     subl(12) ^= kw4l; subr(12) ^= kw4r;
    537  1.1  drochner     subl(10) ^= kw4l; subr(10) ^= kw4r;
    538  1.1  drochner     kw4l ^= kw4r & ~subr(8);
    539  1.1  drochner     dw = kw4l & subl(8), kw4r ^= CAMELLIA_RL1(dw);
    540  1.1  drochner     subl(6) ^= kw4l; subr(6) ^= kw4r;
    541  1.1  drochner     subl(4) ^= kw4l; subr(4) ^= kw4r;
    542  1.1  drochner     subl(2) ^= kw4l; subr(2) ^= kw4r;
    543  1.1  drochner     subl(0) ^= kw4l; subr(0) ^= kw4r;
    544  1.1  drochner 
    545  1.1  drochner     /* key XOR is end of F-function */
    546  1.1  drochner     SUBL(0) = subl(0) ^ subl(2);
    547  1.1  drochner     SUBR(0) = subr(0) ^ subr(2);
    548  1.1  drochner     SUBL(2) = subl(3);
    549  1.1  drochner     SUBR(2) = subr(3);
    550  1.1  drochner     SUBL(3) = subl(2) ^ subl(4);
    551  1.1  drochner     SUBR(3) = subr(2) ^ subr(4);
    552  1.1  drochner     SUBL(4) = subl(3) ^ subl(5);
    553  1.1  drochner     SUBR(4) = subr(3) ^ subr(5);
    554  1.1  drochner     SUBL(5) = subl(4) ^ subl(6);
    555  1.1  drochner     SUBR(5) = subr(4) ^ subr(6);
    556  1.1  drochner     SUBL(6) = subl(5) ^ subl(7);
    557  1.1  drochner     SUBR(6) = subr(5) ^ subr(7);
    558  1.1  drochner     tl = subl(10) ^ (subr(10) & ~subr(8));
    559  1.1  drochner     dw = tl & subl(8), tr = subr(10) ^ CAMELLIA_RL1(dw);
    560  1.1  drochner     SUBL(7) = subl(6) ^ tl;
    561  1.1  drochner     SUBR(7) = subr(6) ^ tr;
    562  1.1  drochner     SUBL(8) = subl(8);
    563  1.1  drochner     SUBR(8) = subr(8);
    564  1.1  drochner     SUBL(9) = subl(9);
    565  1.1  drochner     SUBR(9) = subr(9);
    566  1.1  drochner     tl = subl(7) ^ (subr(7) & ~subr(9));
    567  1.1  drochner     dw = tl & subl(9), tr = subr(7) ^ CAMELLIA_RL1(dw);
    568  1.1  drochner     SUBL(10) = tl ^ subl(11);
    569  1.1  drochner     SUBR(10) = tr ^ subr(11);
    570  1.1  drochner     SUBL(11) = subl(10) ^ subl(12);
    571  1.1  drochner     SUBR(11) = subr(10) ^ subr(12);
    572  1.1  drochner     SUBL(12) = subl(11) ^ subl(13);
    573  1.1  drochner     SUBR(12) = subr(11) ^ subr(13);
    574  1.1  drochner     SUBL(13) = subl(12) ^ subl(14);
    575  1.1  drochner     SUBR(13) = subr(12) ^ subr(14);
    576  1.1  drochner     SUBL(14) = subl(13) ^ subl(15);
    577  1.1  drochner     SUBR(14) = subr(13) ^ subr(15);
    578  1.1  drochner     tl = subl(18) ^ (subr(18) & ~subr(16));
    579  1.1  drochner     dw = tl & subl(16), tr = subr(18) ^ CAMELLIA_RL1(dw);
    580  1.1  drochner     SUBL(15) = subl(14) ^ tl;
    581  1.1  drochner     SUBR(15) = subr(14) ^ tr;
    582  1.1  drochner     SUBL(16) = subl(16);
    583  1.1  drochner     SUBR(16) = subr(16);
    584  1.1  drochner     SUBL(17) = subl(17);
    585  1.1  drochner     SUBR(17) = subr(17);
    586  1.1  drochner     tl = subl(15) ^ (subr(15) & ~subr(17));
    587  1.1  drochner     dw = tl & subl(17), tr = subr(15) ^ CAMELLIA_RL1(dw);
    588  1.1  drochner     SUBL(18) = tl ^ subl(19);
    589  1.1  drochner     SUBR(18) = tr ^ subr(19);
    590  1.1  drochner     SUBL(19) = subl(18) ^ subl(20);
    591  1.1  drochner     SUBR(19) = subr(18) ^ subr(20);
    592  1.1  drochner     SUBL(20) = subl(19) ^ subl(21);
    593  1.1  drochner     SUBR(20) = subr(19) ^ subr(21);
    594  1.1  drochner     SUBL(21) = subl(20) ^ subl(22);
    595  1.1  drochner     SUBR(21) = subr(20) ^ subr(22);
    596  1.1  drochner     SUBL(22) = subl(21) ^ subl(23);
    597  1.1  drochner     SUBR(22) = subr(21) ^ subr(23);
    598  1.1  drochner     SUBL(23) = subl(22);
    599  1.1  drochner     SUBR(23) = subr(22);
    600  1.1  drochner     SUBL(24) = subl(24) ^ subl(23);
    601  1.1  drochner     SUBR(24) = subr(24) ^ subr(23);
    602  1.1  drochner 
    603  1.1  drochner     /* apply the inverse of the last half of P-function */
    604  1.1  drochner     dw = SUBL(2) ^ SUBR(2), dw = CAMELLIA_RL8(dw);
    605  1.1  drochner     SUBR(2) = SUBL(2) ^ dw, SUBL(2) = dw;
    606  1.1  drochner     dw = SUBL(3) ^ SUBR(3), dw = CAMELLIA_RL8(dw);
    607  1.1  drochner     SUBR(3) = SUBL(3) ^ dw, SUBL(3) = dw;
    608  1.1  drochner     dw = SUBL(4) ^ SUBR(4), dw = CAMELLIA_RL8(dw);
    609  1.1  drochner     SUBR(4) = SUBL(4) ^ dw, SUBL(4) = dw;
    610  1.1  drochner     dw = SUBL(5) ^ SUBR(5), dw = CAMELLIA_RL8(dw);
    611  1.1  drochner     SUBR(5) = SUBL(5) ^ dw, SUBL(5) = dw;
    612  1.1  drochner     dw = SUBL(6) ^ SUBR(6), dw = CAMELLIA_RL8(dw);
    613  1.1  drochner     SUBR(6) = SUBL(6) ^ dw, SUBL(6) = dw;
    614  1.1  drochner     dw = SUBL(7) ^ SUBR(7), dw = CAMELLIA_RL8(dw);
    615  1.1  drochner     SUBR(7) = SUBL(7) ^ dw, SUBL(7) = dw;
    616  1.1  drochner     dw = SUBL(10) ^ SUBR(10), dw = CAMELLIA_RL8(dw);
    617  1.1  drochner     SUBR(10) = SUBL(10) ^ dw, SUBL(10) = dw;
    618  1.1  drochner     dw = SUBL(11) ^ SUBR(11), dw = CAMELLIA_RL8(dw);
    619  1.1  drochner     SUBR(11) = SUBL(11) ^ dw, SUBL(11) = dw;
    620  1.1  drochner     dw = SUBL(12) ^ SUBR(12), dw = CAMELLIA_RL8(dw);
    621  1.1  drochner     SUBR(12) = SUBL(12) ^ dw, SUBL(12) = dw;
    622  1.1  drochner     dw = SUBL(13) ^ SUBR(13), dw = CAMELLIA_RL8(dw);
    623  1.1  drochner     SUBR(13) = SUBL(13) ^ dw, SUBL(13) = dw;
    624  1.1  drochner     dw = SUBL(14) ^ SUBR(14), dw = CAMELLIA_RL8(dw);
    625  1.1  drochner     SUBR(14) = SUBL(14) ^ dw, SUBL(14) = dw;
    626  1.1  drochner     dw = SUBL(15) ^ SUBR(15), dw = CAMELLIA_RL8(dw);
    627  1.1  drochner     SUBR(15) = SUBL(15) ^ dw, SUBL(15) = dw;
    628  1.1  drochner     dw = SUBL(18) ^ SUBR(18), dw = CAMELLIA_RL8(dw);
    629  1.1  drochner     SUBR(18) = SUBL(18) ^ dw, SUBL(18) = dw;
    630  1.1  drochner     dw = SUBL(19) ^ SUBR(19), dw = CAMELLIA_RL8(dw);
    631  1.1  drochner     SUBR(19) = SUBL(19) ^ dw, SUBL(19) = dw;
    632  1.1  drochner     dw = SUBL(20) ^ SUBR(20), dw = CAMELLIA_RL8(dw);
    633  1.1  drochner     SUBR(20) = SUBL(20) ^ dw, SUBL(20) = dw;
    634  1.1  drochner     dw = SUBL(21) ^ SUBR(21), dw = CAMELLIA_RL8(dw);
    635  1.1  drochner     SUBR(21) = SUBL(21) ^ dw, SUBL(21) = dw;
    636  1.1  drochner     dw = SUBL(22) ^ SUBR(22), dw = CAMELLIA_RL8(dw);
    637  1.1  drochner     SUBR(22) = SUBL(22) ^ dw, SUBL(22) = dw;
    638  1.1  drochner     dw = SUBL(23) ^ SUBR(23), dw = CAMELLIA_RL8(dw);
    639  1.1  drochner     SUBR(23) = SUBL(23) ^ dw, SUBL(23) = dw;
    640  1.1  drochner }
    641  1.1  drochner 
    642  1.1  drochner void
    643  1.1  drochner camellia_setup256(const unsigned char *key, uint32_t *subkey)
    644  1.1  drochner {
    645  1.1  drochner     uint32_t kll,klr,krl,krr;           /* left half of key */
    646  1.1  drochner     uint32_t krll,krlr,krrl,krrr;       /* right half of key */
    647  1.1  drochner     uint32_t il, ir, t0, t1, w0, w1;    /* temporary variables */
    648  1.1  drochner     uint32_t kw4l, kw4r, dw, tl, tr;
    649  1.1  drochner     uint32_t subL[34];
    650  1.1  drochner     uint32_t subR[34];
    651  1.1  drochner 
    652  1.1  drochner     /*
    653  1.1  drochner      *  key = (kll || klr || krl || krr || krll || krlr || krrl || krrr)
    654  1.1  drochner      *  (|| is concatination)
    655  1.1  drochner      */
    656  1.1  drochner 
    657  1.1  drochner     kll  = GETU32(key     );
    658  1.1  drochner     klr  = GETU32(key +  4);
    659  1.1  drochner     krl  = GETU32(key +  8);
    660  1.1  drochner     krr  = GETU32(key + 12);
    661  1.1  drochner     krll = GETU32(key + 16);
    662  1.1  drochner     krlr = GETU32(key + 20);
    663  1.1  drochner     krrl = GETU32(key + 24);
    664  1.1  drochner     krrr = GETU32(key + 28);
    665  1.1  drochner 
    666  1.1  drochner     /* generate KL dependent subkeys */
    667  1.1  drochner     subl(0) = kll; subr(0) = klr;
    668  1.1  drochner     subl(1) = krl; subr(1) = krr;
    669  1.1  drochner     CAMELLIA_ROLDQo32(kll, klr, krl, krr, w0, w1, 45);
    670  1.1  drochner     subl(12) = kll; subr(12) = klr;
    671  1.1  drochner     subl(13) = krl; subr(13) = krr;
    672  1.1  drochner     CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
    673  1.1  drochner     subl(16) = kll; subr(16) = klr;
    674  1.1  drochner     subl(17) = krl; subr(17) = krr;
    675  1.1  drochner     CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 17);
    676  1.1  drochner     subl(22) = kll; subr(22) = klr;
    677  1.1  drochner     subl(23) = krl; subr(23) = krr;
    678  1.1  drochner     CAMELLIA_ROLDQo32(kll, klr, krl, krr, w0, w1, 34);
    679  1.1  drochner     subl(30) = kll; subr(30) = klr;
    680  1.1  drochner     subl(31) = krl; subr(31) = krr;
    681  1.1  drochner 
    682  1.1  drochner     /* generate KR dependent subkeys */
    683  1.1  drochner     CAMELLIA_ROLDQ(krll, krlr, krrl, krrr, w0, w1, 15);
    684  1.1  drochner     subl(4) = krll; subr(4) = krlr;
    685  1.1  drochner     subl(5) = krrl; subr(5) = krrr;
    686  1.1  drochner     CAMELLIA_ROLDQ(krll, krlr, krrl, krrr, w0, w1, 15);
    687  1.1  drochner     subl(8) = krll; subr(8) = krlr;
    688  1.1  drochner     subl(9) = krrl; subr(9) = krrr;
    689  1.1  drochner     CAMELLIA_ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
    690  1.1  drochner     subl(18) = krll; subr(18) = krlr;
    691  1.1  drochner     subl(19) = krrl; subr(19) = krrr;
    692  1.1  drochner     CAMELLIA_ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 34);
    693  1.1  drochner     subl(26) = krll; subr(26) = krlr;
    694  1.1  drochner     subl(27) = krrl; subr(27) = krrr;
    695  1.1  drochner     CAMELLIA_ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 34);
    696  1.1  drochner 
    697  1.1  drochner     /* generate KA */
    698  1.1  drochner     kll = subl(0) ^ krll; klr = subr(0) ^ krlr;
    699  1.1  drochner     krl = subl(1) ^ krrl; krr = subr(1) ^ krrr;
    700  1.1  drochner     CAMELLIA_F(kll, klr, CAMELLIA_SIGMA1L, CAMELLIA_SIGMA1R,
    701  1.1  drochner 	       w0, w1, il, ir, t0, t1);
    702  1.1  drochner     krl ^= w0; krr ^= w1;
    703  1.1  drochner     CAMELLIA_F(krl, krr, CAMELLIA_SIGMA2L, CAMELLIA_SIGMA2R,
    704  1.1  drochner 	       kll, klr, il, ir, t0, t1);
    705  1.1  drochner     kll ^= krll; klr ^= krlr;
    706  1.1  drochner     CAMELLIA_F(kll, klr, CAMELLIA_SIGMA3L, CAMELLIA_SIGMA3R,
    707  1.1  drochner 	       krl, krr, il, ir, t0, t1);
    708  1.1  drochner     krl ^= w0 ^ krrl; krr ^= w1 ^ krrr;
    709  1.1  drochner     CAMELLIA_F(krl, krr, CAMELLIA_SIGMA4L, CAMELLIA_SIGMA4R,
    710  1.1  drochner 	       w0, w1, il, ir, t0, t1);
    711  1.1  drochner     kll ^= w0; klr ^= w1;
    712  1.1  drochner 
    713  1.1  drochner     /* generate KB */
    714  1.1  drochner     krll ^= kll; krlr ^= klr;
    715  1.1  drochner     krrl ^= krl; krrr ^= krr;
    716  1.1  drochner     CAMELLIA_F(krll, krlr, CAMELLIA_SIGMA5L, CAMELLIA_SIGMA5R,
    717  1.1  drochner 	       w0, w1, il, ir, t0, t1);
    718  1.1  drochner     krrl ^= w0; krrr ^= w1;
    719  1.1  drochner     CAMELLIA_F(krrl, krrr, CAMELLIA_SIGMA6L, CAMELLIA_SIGMA6R,
    720  1.1  drochner 	       w0, w1, il, ir, t0, t1);
    721  1.1  drochner     krll ^= w0; krlr ^= w1;
    722  1.1  drochner 
    723  1.1  drochner     /* generate KA dependent subkeys */
    724  1.1  drochner     CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
    725  1.1  drochner     subl(6) = kll; subr(6) = klr;
    726  1.1  drochner     subl(7) = krl; subr(7) = krr;
    727  1.1  drochner     CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 30);
    728  1.1  drochner     subl(14) = kll; subr(14) = klr;
    729  1.1  drochner     subl(15) = krl; subr(15) = krr;
    730  1.1  drochner     subl(24) = klr; subr(24) = krl;
    731  1.1  drochner     subl(25) = krr; subr(25) = kll;
    732  1.1  drochner     CAMELLIA_ROLDQo32(kll, klr, krl, krr, w0, w1, 49);
    733  1.1  drochner     subl(28) = kll; subr(28) = klr;
    734  1.1  drochner     subl(29) = krl; subr(29) = krr;
    735  1.1  drochner 
    736  1.1  drochner     /* generate KB dependent subkeys */
    737  1.1  drochner     subl(2) = krll; subr(2) = krlr;
    738  1.1  drochner     subl(3) = krrl; subr(3) = krrr;
    739  1.1  drochner     CAMELLIA_ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
    740  1.1  drochner     subl(10) = krll; subr(10) = krlr;
    741  1.1  drochner     subl(11) = krrl; subr(11) = krrr;
    742  1.1  drochner     CAMELLIA_ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
    743  1.1  drochner     subl(20) = krll; subr(20) = krlr;
    744  1.1  drochner     subl(21) = krrl; subr(21) = krrr;
    745  1.1  drochner     CAMELLIA_ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 51);
    746  1.1  drochner     subl(32) = krll; subr(32) = krlr;
    747  1.1  drochner     subl(33) = krrl; subr(33) = krrr;
    748  1.1  drochner 
    749  1.1  drochner     /* absorb kw2 to other subkeys */
    750  1.1  drochner     subl(3) ^= subl(1); subr(3) ^= subr(1);
    751  1.1  drochner     subl(5) ^= subl(1); subr(5) ^= subr(1);
    752  1.1  drochner     subl(7) ^= subl(1); subr(7) ^= subr(1);
    753  1.1  drochner     subl(1) ^= subr(1) & ~subr(9);
    754  1.1  drochner     dw = subl(1) & subl(9), subr(1) ^= CAMELLIA_RL1(dw);
    755  1.1  drochner     subl(11) ^= subl(1); subr(11) ^= subr(1);
    756  1.1  drochner     subl(13) ^= subl(1); subr(13) ^= subr(1);
    757  1.1  drochner     subl(15) ^= subl(1); subr(15) ^= subr(1);
    758  1.1  drochner     subl(1) ^= subr(1) & ~subr(17);
    759  1.1  drochner     dw = subl(1) & subl(17), subr(1) ^= CAMELLIA_RL1(dw);
    760  1.1  drochner     subl(19) ^= subl(1); subr(19) ^= subr(1);
    761  1.1  drochner     subl(21) ^= subl(1); subr(21) ^= subr(1);
    762  1.1  drochner     subl(23) ^= subl(1); subr(23) ^= subr(1);
    763  1.1  drochner     subl(1) ^= subr(1) & ~subr(25);
    764  1.1  drochner     dw = subl(1) & subl(25), subr(1) ^= CAMELLIA_RL1(dw);
    765  1.1  drochner     subl(27) ^= subl(1); subr(27) ^= subr(1);
    766  1.1  drochner     subl(29) ^= subl(1); subr(29) ^= subr(1);
    767  1.1  drochner     subl(31) ^= subl(1); subr(31) ^= subr(1);
    768  1.1  drochner     subl(32) ^= subl(1); subr(32) ^= subr(1);
    769  1.1  drochner 
    770  1.1  drochner 
    771  1.1  drochner     /* absorb kw4 to other subkeys */
    772  1.1  drochner     kw4l = subl(33); kw4r = subr(33);
    773  1.1  drochner     subl(30) ^= kw4l; subr(30) ^= kw4r;
    774  1.1  drochner     subl(28) ^= kw4l; subr(28) ^= kw4r;
    775  1.1  drochner     subl(26) ^= kw4l; subr(26) ^= kw4r;
    776  1.1  drochner     kw4l ^= kw4r & ~subr(24);
    777  1.1  drochner     dw = kw4l & subl(24), kw4r ^= CAMELLIA_RL1(dw);
    778  1.1  drochner     subl(22) ^= kw4l; subr(22) ^= kw4r;
    779  1.1  drochner     subl(20) ^= kw4l; subr(20) ^= kw4r;
    780  1.1  drochner     subl(18) ^= kw4l; subr(18) ^= kw4r;
    781  1.1  drochner     kw4l ^= kw4r & ~subr(16);
    782  1.1  drochner     dw = kw4l & subl(16), kw4r ^= CAMELLIA_RL1(dw);
    783  1.1  drochner     subl(14) ^= kw4l; subr(14) ^= kw4r;
    784  1.1  drochner     subl(12) ^= kw4l; subr(12) ^= kw4r;
    785  1.1  drochner     subl(10) ^= kw4l; subr(10) ^= kw4r;
    786  1.1  drochner     kw4l ^= kw4r & ~subr(8);
    787  1.1  drochner     dw = kw4l & subl(8), kw4r ^= CAMELLIA_RL1(dw);
    788  1.1  drochner     subl(6) ^= kw4l; subr(6) ^= kw4r;
    789  1.1  drochner     subl(4) ^= kw4l; subr(4) ^= kw4r;
    790  1.1  drochner     subl(2) ^= kw4l; subr(2) ^= kw4r;
    791  1.1  drochner     subl(0) ^= kw4l; subr(0) ^= kw4r;
    792  1.1  drochner 
    793  1.1  drochner     /* key XOR is end of F-function */
    794  1.1  drochner     SUBL(0) = subl(0) ^ subl(2);
    795  1.1  drochner     SUBR(0) = subr(0) ^ subr(2);
    796  1.1  drochner     SUBL(2) = subl(3);
    797  1.1  drochner     SUBR(2) = subr(3);
    798  1.1  drochner     SUBL(3) = subl(2) ^ subl(4);
    799  1.1  drochner     SUBR(3) = subr(2) ^ subr(4);
    800  1.1  drochner     SUBL(4) = subl(3) ^ subl(5);
    801  1.1  drochner     SUBR(4) = subr(3) ^ subr(5);
    802  1.1  drochner     SUBL(5) = subl(4) ^ subl(6);
    803  1.1  drochner     SUBR(5) = subr(4) ^ subr(6);
    804  1.1  drochner     SUBL(6) = subl(5) ^ subl(7);
    805  1.1  drochner     SUBR(6) = subr(5) ^ subr(7);
    806  1.1  drochner     tl = subl(10) ^ (subr(10) & ~subr(8));
    807  1.1  drochner     dw = tl & subl(8), tr = subr(10) ^ CAMELLIA_RL1(dw);
    808  1.1  drochner     SUBL(7) = subl(6) ^ tl;
    809  1.1  drochner     SUBR(7) = subr(6) ^ tr;
    810  1.1  drochner     SUBL(8) = subl(8);
    811  1.1  drochner     SUBR(8) = subr(8);
    812  1.1  drochner     SUBL(9) = subl(9);
    813  1.1  drochner     SUBR(9) = subr(9);
    814  1.1  drochner     tl = subl(7) ^ (subr(7) & ~subr(9));
    815  1.1  drochner     dw = tl & subl(9), tr = subr(7) ^ CAMELLIA_RL1(dw);
    816  1.1  drochner     SUBL(10) = tl ^ subl(11);
    817  1.1  drochner     SUBR(10) = tr ^ subr(11);
    818  1.1  drochner     SUBL(11) = subl(10) ^ subl(12);
    819  1.1  drochner     SUBR(11) = subr(10) ^ subr(12);
    820  1.1  drochner     SUBL(12) = subl(11) ^ subl(13);
    821  1.1  drochner     SUBR(12) = subr(11) ^ subr(13);
    822  1.1  drochner     SUBL(13) = subl(12) ^ subl(14);
    823  1.1  drochner     SUBR(13) = subr(12) ^ subr(14);
    824  1.1  drochner     SUBL(14) = subl(13) ^ subl(15);
    825  1.1  drochner     SUBR(14) = subr(13) ^ subr(15);
    826  1.1  drochner     tl = subl(18) ^ (subr(18) & ~subr(16));
    827  1.1  drochner     dw = tl & subl(16), tr = subr(18) ^ CAMELLIA_RL1(dw);
    828  1.1  drochner     SUBL(15) = subl(14) ^ tl;
    829  1.1  drochner     SUBR(15) = subr(14) ^ tr;
    830  1.1  drochner     SUBL(16) = subl(16);
    831  1.1  drochner     SUBR(16) = subr(16);
    832  1.1  drochner     SUBL(17) = subl(17);
    833  1.1  drochner     SUBR(17) = subr(17);
    834  1.1  drochner     tl = subl(15) ^ (subr(15) & ~subr(17));
    835  1.1  drochner     dw = tl & subl(17), tr = subr(15) ^ CAMELLIA_RL1(dw);
    836  1.1  drochner     SUBL(18) = tl ^ subl(19);
    837  1.1  drochner     SUBR(18) = tr ^ subr(19);
    838  1.1  drochner     SUBL(19) = subl(18) ^ subl(20);
    839  1.1  drochner     SUBR(19) = subr(18) ^ subr(20);
    840  1.1  drochner     SUBL(20) = subl(19) ^ subl(21);
    841  1.1  drochner     SUBR(20) = subr(19) ^ subr(21);
    842  1.1  drochner     SUBL(21) = subl(20) ^ subl(22);
    843  1.1  drochner     SUBR(21) = subr(20) ^ subr(22);
    844  1.1  drochner     SUBL(22) = subl(21) ^ subl(23);
    845  1.1  drochner     SUBR(22) = subr(21) ^ subr(23);
    846  1.1  drochner     tl = subl(26) ^ (subr(26) & ~subr(24));
    847  1.1  drochner     dw = tl & subl(24), tr = subr(26) ^ CAMELLIA_RL1(dw);
    848  1.1  drochner     SUBL(23) = subl(22) ^ tl;
    849  1.1  drochner     SUBR(23) = subr(22) ^ tr;
    850  1.1  drochner     SUBL(24) = subl(24);
    851  1.1  drochner     SUBR(24) = subr(24);
    852  1.1  drochner     SUBL(25) = subl(25);
    853  1.1  drochner     SUBR(25) = subr(25);
    854  1.1  drochner     tl = subl(23) ^ (subr(23) & ~subr(25));
    855  1.1  drochner     dw = tl & subl(25), tr = subr(23) ^ CAMELLIA_RL1(dw);
    856  1.1  drochner     SUBL(26) = tl ^ subl(27);
    857  1.1  drochner     SUBR(26) = tr ^ subr(27);
    858  1.1  drochner     SUBL(27) = subl(26) ^ subl(28);
    859  1.1  drochner     SUBR(27) = subr(26) ^ subr(28);
    860  1.1  drochner     SUBL(28) = subl(27) ^ subl(29);
    861  1.1  drochner     SUBR(28) = subr(27) ^ subr(29);
    862  1.1  drochner     SUBL(29) = subl(28) ^ subl(30);
    863  1.1  drochner     SUBR(29) = subr(28) ^ subr(30);
    864  1.1  drochner     SUBL(30) = subl(29) ^ subl(31);
    865  1.1  drochner     SUBR(30) = subr(29) ^ subr(31);
    866  1.1  drochner     SUBL(31) = subl(30);
    867  1.1  drochner     SUBR(31) = subr(30);
    868  1.1  drochner     SUBL(32) = subl(32) ^ subl(31);
    869  1.1  drochner     SUBR(32) = subr(32) ^ subr(31);
    870  1.1  drochner 
    871  1.1  drochner     /* apply the inverse of the last half of P-function */
    872  1.1  drochner     dw = SUBL(2) ^ SUBR(2), dw = CAMELLIA_RL8(dw);
    873  1.1  drochner     SUBR(2) = SUBL(2) ^ dw, SUBL(2) = dw;
    874  1.1  drochner     dw = SUBL(3) ^ SUBR(3), dw = CAMELLIA_RL8(dw);
    875  1.1  drochner     SUBR(3) = SUBL(3) ^ dw, SUBL(3) = dw;
    876  1.1  drochner     dw = SUBL(4) ^ SUBR(4), dw = CAMELLIA_RL8(dw);
    877  1.1  drochner     SUBR(4) = SUBL(4) ^ dw, SUBL(4) = dw;
    878  1.1  drochner     dw = SUBL(5) ^ SUBR(5), dw = CAMELLIA_RL8(dw);
    879  1.1  drochner     SUBR(5) = SUBL(5) ^ dw, SUBL(5) = dw;
    880  1.1  drochner     dw = SUBL(6) ^ SUBR(6), dw = CAMELLIA_RL8(dw);
    881  1.1  drochner     SUBR(6) = SUBL(6) ^ dw, SUBL(6) = dw;
    882  1.1  drochner     dw = SUBL(7) ^ SUBR(7), dw = CAMELLIA_RL8(dw);
    883  1.1  drochner     SUBR(7) = SUBL(7) ^ dw, SUBL(7) = dw;
    884  1.1  drochner     dw = SUBL(10) ^ SUBR(10), dw = CAMELLIA_RL8(dw);
    885  1.1  drochner     SUBR(10) = SUBL(10) ^ dw, SUBL(10) = dw;
    886  1.1  drochner     dw = SUBL(11) ^ SUBR(11), dw = CAMELLIA_RL8(dw);
    887  1.1  drochner     SUBR(11) = SUBL(11) ^ dw, SUBL(11) = dw;
    888  1.1  drochner     dw = SUBL(12) ^ SUBR(12), dw = CAMELLIA_RL8(dw);
    889  1.1  drochner     SUBR(12) = SUBL(12) ^ dw, SUBL(12) = dw;
    890  1.1  drochner     dw = SUBL(13) ^ SUBR(13), dw = CAMELLIA_RL8(dw);
    891  1.1  drochner     SUBR(13) = SUBL(13) ^ dw, SUBL(13) = dw;
    892  1.1  drochner     dw = SUBL(14) ^ SUBR(14), dw = CAMELLIA_RL8(dw);
    893  1.1  drochner     SUBR(14) = SUBL(14) ^ dw, SUBL(14) = dw;
    894  1.1  drochner     dw = SUBL(15) ^ SUBR(15), dw = CAMELLIA_RL8(dw);
    895  1.1  drochner     SUBR(15) = SUBL(15) ^ dw, SUBL(15) = dw;
    896  1.1  drochner     dw = SUBL(18) ^ SUBR(18), dw = CAMELLIA_RL8(dw);
    897  1.1  drochner     SUBR(18) = SUBL(18) ^ dw, SUBL(18) = dw;
    898  1.1  drochner     dw = SUBL(19) ^ SUBR(19), dw = CAMELLIA_RL8(dw);
    899  1.1  drochner     SUBR(19) = SUBL(19) ^ dw, SUBL(19) = dw;
    900  1.1  drochner     dw = SUBL(20) ^ SUBR(20), dw = CAMELLIA_RL8(dw);
    901  1.1  drochner     SUBR(20) = SUBL(20) ^ dw, SUBL(20) = dw;
    902  1.1  drochner     dw = SUBL(21) ^ SUBR(21), dw = CAMELLIA_RL8(dw);
    903  1.1  drochner     SUBR(21) = SUBL(21) ^ dw, SUBL(21) = dw;
    904  1.1  drochner     dw = SUBL(22) ^ SUBR(22), dw = CAMELLIA_RL8(dw);
    905  1.1  drochner     SUBR(22) = SUBL(22) ^ dw, SUBL(22) = dw;
    906  1.1  drochner     dw = SUBL(23) ^ SUBR(23), dw = CAMELLIA_RL8(dw);
    907  1.1  drochner     SUBR(23) = SUBL(23) ^ dw, SUBL(23) = dw;
    908  1.1  drochner     dw = SUBL(26) ^ SUBR(26), dw = CAMELLIA_RL8(dw);
    909  1.1  drochner     SUBR(26) = SUBL(26) ^ dw, SUBL(26) = dw;
    910  1.1  drochner     dw = SUBL(27) ^ SUBR(27), dw = CAMELLIA_RL8(dw);
    911  1.1  drochner     SUBR(27) = SUBL(27) ^ dw, SUBL(27) = dw;
    912  1.1  drochner     dw = SUBL(28) ^ SUBR(28), dw = CAMELLIA_RL8(dw);
    913  1.1  drochner     SUBR(28) = SUBL(28) ^ dw, SUBL(28) = dw;
    914  1.1  drochner     dw = SUBL(29) ^ SUBR(29), dw = CAMELLIA_RL8(dw);
    915  1.1  drochner     SUBR(29) = SUBL(29) ^ dw, SUBL(29) = dw;
    916  1.1  drochner     dw = SUBL(30) ^ SUBR(30), dw = CAMELLIA_RL8(dw);
    917  1.1  drochner     SUBR(30) = SUBL(30) ^ dw, SUBL(30) = dw;
    918  1.1  drochner     dw = SUBL(31) ^ SUBR(31), dw = CAMELLIA_RL8(dw);
    919  1.1  drochner     SUBR(31) = SUBL(31) ^ dw, SUBL(31) = dw;
    920  1.1  drochner }
    921  1.1  drochner 
    922  1.1  drochner void
    923  1.1  drochner camellia_setup192(const unsigned char *key, uint32_t *subkey)
    924  1.1  drochner {
    925  1.1  drochner     unsigned char kk[32];
    926  1.1  drochner     uint32_t krll, krlr, krrl,krrr;
    927  1.1  drochner 
    928  1.1  drochner     memcpy(kk, key, 24);
    929  1.1  drochner     memcpy((unsigned char *)&krll, key+16,4);
    930  1.1  drochner     memcpy((unsigned char *)&krlr, key+20,4);
    931  1.1  drochner     krrl = ~krll;
    932  1.1  drochner     krrr = ~krlr;
    933  1.1  drochner     memcpy(kk+24, (unsigned char *)&krrl, 4);
    934  1.1  drochner     memcpy(kk+28, (unsigned char *)&krrr, 4);
    935  1.1  drochner     camellia_setup256(kk, subkey);
    936  1.1  drochner }
    937  1.1  drochner 
    938  1.1  drochner 
    939  1.1  drochner /**
    940  1.1  drochner  * Stuff related to camellia encryption/decryption
    941  1.1  drochner  */
    942  1.1  drochner void
    943  1.1  drochner camellia_encrypt128(const uint32_t *subkey, uint32_t *io)
    944  1.1  drochner {
    945  1.1  drochner     uint32_t il, ir, t0, t1;
    946  1.1  drochner 
    947  1.1  drochner     /* pre whitening but absorb kw2*/
    948  1.1  drochner     io[0] ^= SUBL(0);
    949  1.1  drochner     io[1] ^= SUBR(0);
    950  1.1  drochner     /* main iteration */
    951  1.1  drochner 
    952  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(2),SUBR(2),
    953  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
    954  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(3),SUBR(3),
    955  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
    956  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(4),SUBR(4),
    957  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
    958  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(5),SUBR(5),
    959  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
    960  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(6),SUBR(6),
    961  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
    962  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(7),SUBR(7),
    963  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
    964  1.1  drochner 
    965  1.1  drochner     CAMELLIA_FLS(io[0],io[1],io[2],io[3], SUBL(8),SUBR(8), SUBL(9),SUBR(9),
    966  1.1  drochner 		 t0,t1,il,ir);
    967  1.1  drochner 
    968  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(10),SUBR(10),
    969  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
    970  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(11),SUBR(11),
    971  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
    972  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(12),SUBR(12),
    973  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
    974  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(13),SUBR(13),
    975  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
    976  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(14),SUBR(14),
    977  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
    978  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(15),SUBR(15),
    979  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
    980  1.1  drochner 
    981  1.1  drochner     CAMELLIA_FLS(io[0],io[1],io[2],io[3], SUBL(16), SUBR(16), SUBL(17),SUBR(17),
    982  1.1  drochner 		 t0,t1,il,ir);
    983  1.1  drochner 
    984  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(18),SUBR(18),
    985  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
    986  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(19),SUBR(19),
    987  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
    988  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(20),SUBR(20),
    989  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
    990  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(21),SUBR(21),
    991  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
    992  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(22),SUBR(22),
    993  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
    994  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(23),SUBR(23),
    995  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
    996  1.1  drochner 
    997  1.1  drochner     /* post whitening but kw4 */
    998  1.1  drochner     io[2] ^= SUBL(24);
    999  1.1  drochner     io[3] ^= SUBR(24);
   1000  1.1  drochner 
   1001  1.1  drochner     t0 = io[0];
   1002  1.1  drochner     t1 = io[1];
   1003  1.1  drochner     io[0] = io[2];
   1004  1.1  drochner     io[1] = io[3];
   1005  1.1  drochner     io[2] = t0;
   1006  1.1  drochner     io[3] = t1;
   1007  1.1  drochner }
   1008  1.1  drochner 
   1009  1.1  drochner void
   1010  1.1  drochner camellia_decrypt128(const uint32_t *subkey, uint32_t *io)
   1011  1.1  drochner {
   1012  1.3  gutterid     uint32_t il,ir,t0,t1;               /* temporary variables */
   1013  1.1  drochner 
   1014  1.1  drochner     /* pre whitening but absorb kw2*/
   1015  1.1  drochner     io[0] ^= SUBL(24);
   1016  1.1  drochner     io[1] ^= SUBR(24);
   1017  1.1  drochner 
   1018  1.1  drochner     /* main iteration */
   1019  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(23),SUBR(23),
   1020  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1021  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(22),SUBR(22),
   1022  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1023  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(21),SUBR(21),
   1024  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1025  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(20),SUBR(20),
   1026  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1027  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(19),SUBR(19),
   1028  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1029  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(18),SUBR(18),
   1030  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1031  1.1  drochner 
   1032  1.1  drochner     CAMELLIA_FLS(io[0],io[1],io[2],io[3],SUBL(17),SUBR(17),SUBL(16),SUBR(16),
   1033  1.1  drochner 		 t0,t1,il,ir);
   1034  1.1  drochner 
   1035  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(15),SUBR(15),
   1036  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1037  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(14),SUBR(14),
   1038  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1039  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(13),SUBR(13),
   1040  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1041  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(12),SUBR(12),
   1042  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1043  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(11),SUBR(11),
   1044  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1045  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(10),SUBR(10),
   1046  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1047  1.1  drochner 
   1048  1.1  drochner     CAMELLIA_FLS(io[0],io[1],io[2],io[3], SUBL(9),SUBR(9), SUBL(8),SUBR(8),
   1049  1.1  drochner 		 t0,t1,il,ir);
   1050  1.1  drochner 
   1051  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(7),SUBR(7),
   1052  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1053  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(6),SUBR(6),
   1054  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1055  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(5),SUBR(5),
   1056  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1057  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(4),SUBR(4),
   1058  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1059  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(3),SUBR(3),
   1060  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1061  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(2),SUBR(2),
   1062  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1063  1.1  drochner 
   1064  1.1  drochner     /* post whitening but kw4 */
   1065  1.1  drochner     io[2] ^= SUBL(0);
   1066  1.1  drochner     io[3] ^= SUBR(0);
   1067  1.1  drochner 
   1068  1.1  drochner     t0 = io[0];
   1069  1.1  drochner     t1 = io[1];
   1070  1.1  drochner     io[0] = io[2];
   1071  1.1  drochner     io[1] = io[3];
   1072  1.1  drochner     io[2] = t0;
   1073  1.1  drochner     io[3] = t1;
   1074  1.1  drochner }
   1075  1.1  drochner 
   1076  1.1  drochner /**
   1077  1.1  drochner  * stuff for 192 and 256bit encryption/decryption
   1078  1.1  drochner  */
   1079  1.1  drochner void
   1080  1.1  drochner camellia_encrypt256(const uint32_t *subkey, uint32_t *io)
   1081  1.1  drochner {
   1082  1.3  gutterid     uint32_t il,ir,t0,t1;           /* temporary variables */
   1083  1.1  drochner 
   1084  1.1  drochner     /* pre whitening but absorb kw2*/
   1085  1.1  drochner     io[0] ^= SUBL(0);
   1086  1.1  drochner     io[1] ^= SUBR(0);
   1087  1.1  drochner 
   1088  1.1  drochner     /* main iteration */
   1089  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(2),SUBR(2),
   1090  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1091  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(3),SUBR(3),
   1092  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1093  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(4),SUBR(4),
   1094  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1095  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(5),SUBR(5),
   1096  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1097  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(6),SUBR(6),
   1098  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1099  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(7),SUBR(7),
   1100  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1101  1.1  drochner 
   1102  1.1  drochner     CAMELLIA_FLS(io[0],io[1],io[2],io[3], SUBL(8),SUBR(8), SUBL(9),SUBR(9),
   1103  1.1  drochner 		 t0,t1,il,ir);
   1104  1.1  drochner 
   1105  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(10),SUBR(10),
   1106  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1107  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(11),SUBR(11),
   1108  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1109  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(12),SUBR(12),
   1110  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1111  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(13),SUBR(13),
   1112  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1113  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(14),SUBR(14),
   1114  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1115  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(15),SUBR(15),
   1116  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1117  1.1  drochner 
   1118  1.1  drochner     CAMELLIA_FLS(io[0],io[1],io[2],io[3], SUBL(16),SUBR(16), SUBL(17),SUBR(17),
   1119  1.1  drochner 		 t0,t1,il,ir);
   1120  1.1  drochner 
   1121  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(18),SUBR(18),
   1122  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1123  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(19),SUBR(19),
   1124  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1125  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(20),SUBR(20),
   1126  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1127  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(21),SUBR(21),
   1128  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1129  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(22),SUBR(22),
   1130  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1131  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(23),SUBR(23),
   1132  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1133  1.1  drochner 
   1134  1.1  drochner     CAMELLIA_FLS(io[0],io[1],io[2],io[3], SUBL(24),SUBR(24), SUBL(25),SUBR(25),
   1135  1.1  drochner 		 t0,t1,il,ir);
   1136  1.1  drochner 
   1137  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(26),SUBR(26),
   1138  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1139  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(27),SUBR(27),
   1140  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1141  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(28),SUBR(28),
   1142  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1143  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(29),SUBR(29),
   1144  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1145  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(30),SUBR(30),
   1146  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1147  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(31),SUBR(31),
   1148  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1149  1.1  drochner 
   1150  1.1  drochner     /* post whitening but kw4 */
   1151  1.1  drochner     io[2] ^= SUBL(32);
   1152  1.1  drochner     io[3] ^= SUBR(32);
   1153  1.1  drochner 
   1154  1.1  drochner     t0 = io[0];
   1155  1.1  drochner     t1 = io[1];
   1156  1.1  drochner     io[0] = io[2];
   1157  1.1  drochner     io[1] = io[3];
   1158  1.1  drochner     io[2] = t0;
   1159  1.1  drochner     io[3] = t1;
   1160  1.1  drochner }
   1161  1.1  drochner 
   1162  1.1  drochner void
   1163  1.1  drochner camellia_decrypt256(const uint32_t *subkey, uint32_t *io)
   1164  1.1  drochner {
   1165  1.3  gutterid     uint32_t il,ir,t0,t1;           /* temporary variables */
   1166  1.1  drochner 
   1167  1.1  drochner     /* pre whitening but absorb kw2*/
   1168  1.1  drochner     io[0] ^= SUBL(32);
   1169  1.1  drochner     io[1] ^= SUBR(32);
   1170  1.1  drochner 
   1171  1.1  drochner     /* main iteration */
   1172  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(31),SUBR(31),
   1173  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1174  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(30),SUBR(30),
   1175  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1176  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(29),SUBR(29),
   1177  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1178  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(28),SUBR(28),
   1179  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1180  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(27),SUBR(27),
   1181  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1182  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(26),SUBR(26),
   1183  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1184  1.1  drochner 
   1185  1.1  drochner     CAMELLIA_FLS(io[0],io[1],io[2],io[3], SUBL(25),SUBR(25), SUBL(24),SUBR(24),
   1186  1.1  drochner 		 t0,t1,il,ir);
   1187  1.1  drochner 
   1188  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(23),SUBR(23),
   1189  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1190  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(22),SUBR(22),
   1191  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1192  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(21),SUBR(21),
   1193  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1194  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(20),SUBR(20),
   1195  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1196  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(19),SUBR(19),
   1197  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1198  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(18),SUBR(18),
   1199  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1200  1.1  drochner 
   1201  1.1  drochner     CAMELLIA_FLS(io[0],io[1],io[2],io[3], SUBL(17),SUBR(17), SUBL(16),SUBR(16),
   1202  1.1  drochner 		 t0,t1,il,ir);
   1203  1.1  drochner 
   1204  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(15),SUBR(15),
   1205  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1206  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(14),SUBR(14),
   1207  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1208  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(13),SUBR(13),
   1209  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1210  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(12),SUBR(12),
   1211  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1212  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(11),SUBR(11),
   1213  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1214  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(10),SUBR(10),
   1215  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1216  1.1  drochner 
   1217  1.1  drochner     CAMELLIA_FLS(io[0],io[1],io[2],io[3], SUBL(9),SUBR(9), SUBL(8),SUBR(8),
   1218  1.1  drochner 		 t0,t1,il,ir);
   1219  1.1  drochner 
   1220  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(7),SUBR(7),
   1221  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1222  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(6),SUBR(6),
   1223  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1224  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(5),SUBR(5),
   1225  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1226  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(4),SUBR(4),
   1227  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1228  1.1  drochner     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(3),SUBR(3),
   1229  1.1  drochner 		     io[2],io[3],il,ir,t0,t1);
   1230  1.1  drochner     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(2),SUBR(2),
   1231  1.1  drochner 		     io[0],io[1],il,ir,t0,t1);
   1232  1.1  drochner 
   1233  1.1  drochner     /* post whitening but kw4 */
   1234  1.1  drochner     io[2] ^= SUBL(0);
   1235  1.1  drochner     io[3] ^= SUBR(0);
   1236  1.1  drochner 
   1237  1.1  drochner     t0 = io[0];
   1238  1.1  drochner     t1 = io[1];
   1239  1.1  drochner     io[0] = io[2];
   1240  1.1  drochner     io[1] = io[3];
   1241  1.1  drochner     io[2] = t0;
   1242  1.1  drochner     io[3] = t1;
   1243  1.1  drochner }
   1244  1.1  drochner 
   1245  1.1  drochner void
   1246  1.1  drochner Camellia_Ekeygen(const int keyBitLength,
   1247  1.1  drochner 		 const unsigned char *rawKey,
   1248  1.1  drochner 		 uint32_t *subkey)
   1249  1.1  drochner {
   1250  1.1  drochner     KASSERT(keyBitLength == 128 || keyBitLength == 192 || keyBitLength == 256);
   1251  1.1  drochner 
   1252  1.1  drochner     switch(keyBitLength) {
   1253  1.1  drochner     case 128:
   1254  1.1  drochner 	camellia_setup128(rawKey, subkey);
   1255  1.1  drochner 	break;
   1256  1.1  drochner     case 192:
   1257  1.1  drochner 	camellia_setup192(rawKey, subkey);
   1258  1.1  drochner 	break;
   1259  1.1  drochner     case 256:
   1260  1.1  drochner 	camellia_setup256(rawKey, subkey);
   1261  1.1  drochner 	break;
   1262  1.1  drochner     default:
   1263  1.1  drochner 	break;
   1264  1.1  drochner     }
   1265  1.1  drochner }
   1266  1.1  drochner void
   1267  1.1  drochner Camellia_EncryptBlock(const int keyBitLength,
   1268  1.1  drochner 		      const unsigned char *plaintext,
   1269  1.1  drochner 		      const uint32_t *subkey,
   1270  1.1  drochner 		      unsigned char *ciphertext)
   1271  1.1  drochner {
   1272  1.1  drochner     uint32_t tmp[4];
   1273  1.1  drochner 
   1274  1.1  drochner     tmp[0] = GETU32(plaintext);
   1275  1.1  drochner     tmp[1] = GETU32(plaintext + 4);
   1276  1.1  drochner     tmp[2] = GETU32(plaintext + 8);
   1277  1.1  drochner     tmp[3] = GETU32(plaintext + 12);
   1278  1.1  drochner 
   1279  1.1  drochner     switch (keyBitLength) {
   1280  1.1  drochner     case 128:
   1281  1.1  drochner 	camellia_encrypt128(subkey, tmp);
   1282  1.1  drochner 	break;
   1283  1.1  drochner     case 192:
   1284  1.1  drochner 	/* fall through */
   1285  1.1  drochner     case 256:
   1286  1.1  drochner 	camellia_encrypt256(subkey, tmp);
   1287  1.1  drochner 	break;
   1288  1.1  drochner     default:
   1289  1.1  drochner 	break;
   1290  1.1  drochner     }
   1291  1.1  drochner 
   1292  1.1  drochner     PUTU32(ciphertext,    tmp[0]);
   1293  1.1  drochner     PUTU32(ciphertext+4,  tmp[1]);
   1294  1.1  drochner     PUTU32(ciphertext+8,  tmp[2]);
   1295  1.1  drochner     PUTU32(ciphertext+12, tmp[3]);
   1296  1.1  drochner }
   1297  1.1  drochner 
   1298  1.1  drochner void
   1299  1.1  drochner Camellia_DecryptBlock(const int keyBitLength,
   1300  1.1  drochner 		      const unsigned char *ciphertext,
   1301  1.1  drochner 		      const uint32_t *subkey,
   1302  1.1  drochner 		      unsigned char *plaintext)
   1303  1.1  drochner {
   1304  1.1  drochner     uint32_t tmp[4];
   1305  1.1  drochner 
   1306  1.1  drochner     tmp[0] = GETU32(ciphertext);
   1307  1.1  drochner     tmp[1] = GETU32(ciphertext + 4);
   1308  1.1  drochner     tmp[2] = GETU32(ciphertext + 8);
   1309  1.1  drochner     tmp[3] = GETU32(ciphertext + 12);
   1310  1.1  drochner 
   1311  1.1  drochner     switch (keyBitLength) {
   1312  1.1  drochner     case 128:
   1313  1.1  drochner 	camellia_decrypt128(subkey, tmp);
   1314  1.1  drochner 	break;
   1315  1.1  drochner     case 192:
   1316  1.1  drochner 	/* fall through */
   1317  1.1  drochner     case 256:
   1318  1.1  drochner 	camellia_decrypt256(subkey, tmp);
   1319  1.1  drochner 	break;
   1320  1.1  drochner     default:
   1321  1.1  drochner 	break;
   1322  1.1  drochner     }
   1323  1.1  drochner 
   1324  1.1  drochner     PUTU32(plaintext,    tmp[0]);
   1325  1.1  drochner     PUTU32(plaintext+4,  tmp[1]);
   1326  1.1  drochner     PUTU32(plaintext+8,  tmp[2]);
   1327  1.1  drochner     PUTU32(plaintext+12, tmp[3]);
   1328  1.1  drochner }
   1329  1.2  pgoyette 
   1330  1.2  pgoyette MODULE(MODULE_CLASS_MISC, camellia, NULL);
   1331  1.2  pgoyette 
   1332  1.2  pgoyette static int
   1333  1.2  pgoyette camellia_modcmd(modcmd_t cmd, void *opaque)
   1334  1.2  pgoyette {
   1335  1.2  pgoyette 
   1336  1.2  pgoyette 	switch (cmd) {
   1337  1.2  pgoyette 	case MODULE_CMD_INIT:
   1338  1.2  pgoyette 		return 0;
   1339  1.2  pgoyette 	case MODULE_CMD_FINI:
   1340  1.2  pgoyette 		return 0;
   1341  1.2  pgoyette 	default:
   1342  1.2  pgoyette 		return ENOTTY;
   1343  1.2  pgoyette 	}
   1344  1.2  pgoyette }
   1345