cast128.c revision 1.6
1 /* $NetBSD: cast128.c,v 1.6 2003/08/26 16:37:36 thorpej Exp $ */ 2 /* $OpenBSD: cast.c,v 1.2 2000/06/06 06:49:47 deraadt Exp $ */ 3 4 /* 5 * CAST-128 in C 6 * Written by Steve Reid <sreid (at) sea-to-sky.net> 7 * 100% Public Domain - no warranty 8 * Released 1997.10.11 9 */ 10 11 #include <sys/cdefs.h> 12 __KERNEL_RCSID(0, "$NetBSD: cast128.c,v 1.6 2003/08/26 16:37:36 thorpej Exp $"); 13 14 #include <sys/types.h> 15 #include <crypto/cast128/cast128.h> 16 #include <crypto/cast128/cast128sb.h> 17 18 /* Macros to access 8-bit bytes out of a 32-bit word */ 19 #define U_INT8_Ta(x) ( (u_int8_t) (x>>24) ) 20 #define U_INT8_Tb(x) ( (u_int8_t) ((x>>16)&255) ) 21 #define U_INT8_Tc(x) ( (u_int8_t) ((x>>8)&255) ) 22 #define U_INT8_Td(x) ( (u_int8_t) ((x)&255) ) 23 24 /* Circular left shift */ 25 #define ROL(x, n) ( ((x)<<(n)) | ((x)>>(32-(n))) ) 26 27 /* CAST-128 uses three different round functions */ 28 #define F1(l, r, i) \ 29 t = ROL(key->xkey[i] + r, key->xkey[i+16]); \ 30 l ^= ((cast_sbox1[U_INT8_Ta(t)] ^ cast_sbox2[U_INT8_Tb(t)]) - \ 31 cast_sbox3[U_INT8_Tc(t)]) + cast_sbox4[U_INT8_Td(t)]; 32 #define F2(l, r, i) \ 33 t = ROL(key->xkey[i] ^ r, key->xkey[i+16]); \ 34 l ^= ((cast_sbox1[U_INT8_Ta(t)] - cast_sbox2[U_INT8_Tb(t)]) + \ 35 cast_sbox3[U_INT8_Tc(t)]) ^ cast_sbox4[U_INT8_Td(t)]; 36 #define F3(l, r, i) \ 37 t = ROL(key->xkey[i] - r, key->xkey[i+16]); \ 38 l ^= ((cast_sbox1[U_INT8_Ta(t)] + cast_sbox2[U_INT8_Tb(t)]) ^ \ 39 cast_sbox3[U_INT8_Tc(t)]) - cast_sbox4[U_INT8_Td(t)]; 40 41 42 /***** Encryption Function *****/ 43 44 void cast128_encrypt(cast128_key* key, u_int8_t* inblock, u_int8_t* outblock) 45 { 46 u_int32_t t, l, r; 47 48 /* Get inblock into l,r */ 49 l = ((u_int32_t)inblock[0] << 24) | ((u_int32_t)inblock[1] << 16) | 50 ((u_int32_t)inblock[2] << 8) | (u_int32_t)inblock[3]; 51 r = ((u_int32_t)inblock[4] << 24) | ((u_int32_t)inblock[5] << 16) | 52 ((u_int32_t)inblock[6] << 8) | (u_int32_t)inblock[7]; 53 /* Do the work */ 54 F1(l, r, 0); 55 F2(r, l, 1); 56 F3(l, r, 2); 57 F1(r, l, 3); 58 F2(l, r, 4); 59 F3(r, l, 5); 60 F1(l, r, 6); 61 F2(r, l, 7); 62 F3(l, r, 8); 63 F1(r, l, 9); 64 F2(l, r, 10); 65 F3(r, l, 11); 66 /* Only do full 16 rounds if key length > 80 bits */ 67 if (key->rounds > 12) { 68 F1(l, r, 12); 69 F2(r, l, 13); 70 F3(l, r, 14); 71 F1(r, l, 15); 72 } 73 /* Put l,r into outblock */ 74 outblock[0] = U_INT8_Ta(r); 75 outblock[1] = U_INT8_Tb(r); 76 outblock[2] = U_INT8_Tc(r); 77 outblock[3] = U_INT8_Td(r); 78 outblock[4] = U_INT8_Ta(l); 79 outblock[5] = U_INT8_Tb(l); 80 outblock[6] = U_INT8_Tc(l); 81 outblock[7] = U_INT8_Td(l); 82 /* Wipe clean */ 83 t = l = r = 0; 84 } 85 86 87 /***** Decryption Function *****/ 88 89 void cast128_decrypt(cast128_key* key, u_int8_t* inblock, u_int8_t* outblock) 90 { 91 u_int32_t t, l, r; 92 93 /* Get inblock into l,r */ 94 r = ((u_int32_t)inblock[0] << 24) | ((u_int32_t)inblock[1] << 16) | 95 ((u_int32_t)inblock[2] << 8) | (u_int32_t)inblock[3]; 96 l = ((u_int32_t)inblock[4] << 24) | ((u_int32_t)inblock[5] << 16) | 97 ((u_int32_t)inblock[6] << 8) | (u_int32_t)inblock[7]; 98 /* Do the work */ 99 /* Only do full 16 rounds if key length > 80 bits */ 100 if (key->rounds > 12) { 101 F1(r, l, 15); 102 F3(l, r, 14); 103 F2(r, l, 13); 104 F1(l, r, 12); 105 } 106 F3(r, l, 11); 107 F2(l, r, 10); 108 F1(r, l, 9); 109 F3(l, r, 8); 110 F2(r, l, 7); 111 F1(l, r, 6); 112 F3(r, l, 5); 113 F2(l, r, 4); 114 F1(r, l, 3); 115 F3(l, r, 2); 116 F2(r, l, 1); 117 F1(l, r, 0); 118 /* Put l,r into outblock */ 119 outblock[0] = U_INT8_Ta(l); 120 outblock[1] = U_INT8_Tb(l); 121 outblock[2] = U_INT8_Tc(l); 122 outblock[3] = U_INT8_Td(l); 123 outblock[4] = U_INT8_Ta(r); 124 outblock[5] = U_INT8_Tb(r); 125 outblock[6] = U_INT8_Tc(r); 126 outblock[7] = U_INT8_Td(r); 127 /* Wipe clean */ 128 t = l = r = 0; 129 } 130 131 132 /***** Key Schedual *****/ 133 134 void cast128_setkey(cast128_key* key, u_int8_t* rawkey, int keybytes) 135 { 136 u_int32_t t[4], z[4], x[4]; 137 int i; 138 139 /* Set number of rounds to 12 or 16, depending on key length */ 140 key->rounds = (keybytes <= 10 ? 12 : 16); 141 142 /* Copy key to workspace x */ 143 for (i = 0; i < 4; i++) { 144 x[i] = 0; 145 if ((i*4+0) < keybytes) x[i] = (u_int32_t)rawkey[i*4+0] << 24; 146 if ((i*4+1) < keybytes) x[i] |= (u_int32_t)rawkey[i*4+1] << 16; 147 if ((i*4+2) < keybytes) x[i] |= (u_int32_t)rawkey[i*4+2] << 8; 148 if ((i*4+3) < keybytes) x[i] |= (u_int32_t)rawkey[i*4+3]; 149 } 150 /* Generate 32 subkeys, four at a time */ 151 for (i = 0; i < 32; i+=4) { 152 switch (i & 4) { 153 case 0: 154 t[0] = z[0] = x[0] ^ cast_sbox5[U_INT8_Tb(x[3])] ^ 155 cast_sbox6[U_INT8_Td(x[3])] ^ cast_sbox7[U_INT8_Ta(x[3])] ^ 156 cast_sbox8[U_INT8_Tc(x[3])] ^ cast_sbox7[U_INT8_Ta(x[2])]; 157 t[1] = z[1] = x[2] ^ cast_sbox5[U_INT8_Ta(z[0])] ^ 158 cast_sbox6[U_INT8_Tc(z[0])] ^ cast_sbox7[U_INT8_Tb(z[0])] ^ 159 cast_sbox8[U_INT8_Td(z[0])] ^ cast_sbox8[U_INT8_Tc(x[2])]; 160 t[2] = z[2] = x[3] ^ cast_sbox5[U_INT8_Td(z[1])] ^ 161 cast_sbox6[U_INT8_Tc(z[1])] ^ cast_sbox7[U_INT8_Tb(z[1])] ^ 162 cast_sbox8[U_INT8_Ta(z[1])] ^ cast_sbox5[U_INT8_Tb(x[2])]; 163 t[3] = z[3] = x[1] ^ cast_sbox5[U_INT8_Tc(z[2])] ^ 164 cast_sbox6[U_INT8_Tb(z[2])] ^ cast_sbox7[U_INT8_Td(z[2])] ^ 165 cast_sbox8[U_INT8_Ta(z[2])] ^ cast_sbox6[U_INT8_Td(x[2])]; 166 break; 167 case 4: 168 t[0] = x[0] = z[2] ^ cast_sbox5[U_INT8_Tb(z[1])] ^ 169 cast_sbox6[U_INT8_Td(z[1])] ^ cast_sbox7[U_INT8_Ta(z[1])] ^ 170 cast_sbox8[U_INT8_Tc(z[1])] ^ cast_sbox7[U_INT8_Ta(z[0])]; 171 t[1] = x[1] = z[0] ^ cast_sbox5[U_INT8_Ta(x[0])] ^ 172 cast_sbox6[U_INT8_Tc(x[0])] ^ cast_sbox7[U_INT8_Tb(x[0])] ^ 173 cast_sbox8[U_INT8_Td(x[0])] ^ cast_sbox8[U_INT8_Tc(z[0])]; 174 t[2] = x[2] = z[1] ^ cast_sbox5[U_INT8_Td(x[1])] ^ 175 cast_sbox6[U_INT8_Tc(x[1])] ^ cast_sbox7[U_INT8_Tb(x[1])] ^ 176 cast_sbox8[U_INT8_Ta(x[1])] ^ cast_sbox5[U_INT8_Tb(z[0])]; 177 t[3] = x[3] = z[3] ^ cast_sbox5[U_INT8_Tc(x[2])] ^ 178 cast_sbox6[U_INT8_Tb(x[2])] ^ cast_sbox7[U_INT8_Td(x[2])] ^ 179 cast_sbox8[U_INT8_Ta(x[2])] ^ cast_sbox6[U_INT8_Td(z[0])]; 180 break; 181 } 182 switch (i & 12) { 183 case 0: 184 case 12: 185 key->xkey[i+0] = cast_sbox5[U_INT8_Ta(t[2])] ^ cast_sbox6[U_INT8_Tb(t[2])] ^ 186 cast_sbox7[U_INT8_Td(t[1])] ^ cast_sbox8[U_INT8_Tc(t[1])]; 187 key->xkey[i+1] = cast_sbox5[U_INT8_Tc(t[2])] ^ cast_sbox6[U_INT8_Td(t[2])] ^ 188 cast_sbox7[U_INT8_Tb(t[1])] ^ cast_sbox8[U_INT8_Ta(t[1])]; 189 key->xkey[i+2] = cast_sbox5[U_INT8_Ta(t[3])] ^ cast_sbox6[U_INT8_Tb(t[3])] ^ 190 cast_sbox7[U_INT8_Td(t[0])] ^ cast_sbox8[U_INT8_Tc(t[0])]; 191 key->xkey[i+3] = cast_sbox5[U_INT8_Tc(t[3])] ^ cast_sbox6[U_INT8_Td(t[3])] ^ 192 cast_sbox7[U_INT8_Tb(t[0])] ^ cast_sbox8[U_INT8_Ta(t[0])]; 193 break; 194 case 4: 195 case 8: 196 key->xkey[i+0] = cast_sbox5[U_INT8_Td(t[0])] ^ cast_sbox6[U_INT8_Tc(t[0])] ^ 197 cast_sbox7[U_INT8_Ta(t[3])] ^ cast_sbox8[U_INT8_Tb(t[3])]; 198 key->xkey[i+1] = cast_sbox5[U_INT8_Tb(t[0])] ^ cast_sbox6[U_INT8_Ta(t[0])] ^ 199 cast_sbox7[U_INT8_Tc(t[3])] ^ cast_sbox8[U_INT8_Td(t[3])]; 200 key->xkey[i+2] = cast_sbox5[U_INT8_Td(t[1])] ^ cast_sbox6[U_INT8_Tc(t[1])] ^ 201 cast_sbox7[U_INT8_Ta(t[2])] ^ cast_sbox8[U_INT8_Tb(t[2])]; 202 key->xkey[i+3] = cast_sbox5[U_INT8_Tb(t[1])] ^ cast_sbox6[U_INT8_Ta(t[1])] ^ 203 cast_sbox7[U_INT8_Tc(t[2])] ^ cast_sbox8[U_INT8_Td(t[2])]; 204 break; 205 } 206 switch (i & 12) { 207 case 0: 208 key->xkey[i+0] ^= cast_sbox5[U_INT8_Tc(z[0])]; 209 key->xkey[i+1] ^= cast_sbox6[U_INT8_Tc(z[1])]; 210 key->xkey[i+2] ^= cast_sbox7[U_INT8_Tb(z[2])]; 211 key->xkey[i+3] ^= cast_sbox8[U_INT8_Ta(z[3])]; 212 break; 213 case 4: 214 key->xkey[i+0] ^= cast_sbox5[U_INT8_Ta(x[2])]; 215 key->xkey[i+1] ^= cast_sbox6[U_INT8_Tb(x[3])]; 216 key->xkey[i+2] ^= cast_sbox7[U_INT8_Td(x[0])]; 217 key->xkey[i+3] ^= cast_sbox8[U_INT8_Td(x[1])]; 218 break; 219 case 8: 220 key->xkey[i+0] ^= cast_sbox5[U_INT8_Tb(z[2])]; 221 key->xkey[i+1] ^= cast_sbox6[U_INT8_Ta(z[3])]; 222 key->xkey[i+2] ^= cast_sbox7[U_INT8_Tc(z[0])]; 223 key->xkey[i+3] ^= cast_sbox8[U_INT8_Tc(z[1])]; 224 break; 225 case 12: 226 key->xkey[i+0] ^= cast_sbox5[U_INT8_Td(x[0])]; 227 key->xkey[i+1] ^= cast_sbox6[U_INT8_Td(x[1])]; 228 key->xkey[i+2] ^= cast_sbox7[U_INT8_Ta(x[2])]; 229 key->xkey[i+3] ^= cast_sbox8[U_INT8_Tb(x[3])]; 230 break; 231 } 232 if (i >= 16) { 233 key->xkey[i+0] &= 31; 234 key->xkey[i+1] &= 31; 235 key->xkey[i+2] &= 31; 236 key->xkey[i+3] &= 31; 237 } 238 } 239 /* Wipe clean */ 240 for (i = 0; i < 4; i++) { 241 t[i] = x[i] = z[i] = 0; 242 } 243 } 244 245 /* Made in Canada */ 246
Indexes created Thu Oct 02 14:10:14 GMT 2025