OpenSSL  1.0.1c
 All Classes Files Functions Variables Typedefs Enumerations Enumerator Macros
camellia.c
Go to the documentation of this file.
1 /* crypto/camellia/camellia.c -*- mode:C; c-file-style: "eay" -*- */
2 /* ====================================================================
3  * Copyright 2006 NTT (Nippon Telegraph and Telephone Corporation) .
4  * ALL RIGHTS RESERVED.
5  *
6  * Intellectual Property information for Camellia:
7  * http://info.isl.ntt.co.jp/crypt/eng/info/chiteki.html
8  *
9  * News Release for Announcement of Camellia open source:
10  * http://www.ntt.co.jp/news/news06e/0604/060413a.html
11  *
12  * The Camellia Code included herein is developed by
13  * NTT (Nippon Telegraph and Telephone Corporation), and is contributed
14  * to the OpenSSL project.
15  *
16  * The Camellia Code is licensed pursuant to the OpenSSL open source
17  * license provided below.
18  */
19 /* ====================================================================
20  * Copyright (c) 2006 The OpenSSL Project. All rights reserved.
21  *
22  * Redistribution and use in source and binary forms, with or without
23  * modification, are permitted provided that the following conditions
24  * are met:
25  *
26  * 1. Redistributions of source code must retain the above copyright
27  * notice, this list of conditions and the following disclaimer.
28  *
29  * 2. Redistributions in binary form must reproduce the above copyright
30  * notice, this list of conditions and the following disclaimer in
31  * the documentation and/or other materials provided with the
32  * distribution.
33  *
34  * 3. All advertising materials mentioning features or use of this
35  * software must display the following acknowledgment:
36  * "This product includes software developed by the OpenSSL Project
37  * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
38  *
39  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
40  * endorse or promote products derived from this software without
41  * prior written permission. For written permission, please contact
42  * [email protected].
43  *
44  * 5. Products derived from this software may not be called "OpenSSL"
45  * nor may "OpenSSL" appear in their names without prior written
46  * permission of the OpenSSL Project.
47  *
48  * 6. Redistributions of any form whatsoever must retain the following
49  * acknowledgment:
50  * "This product includes software developed by the OpenSSL Project
51  * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
52  *
53  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
54  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
55  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
56  * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
57  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
58  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
59  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
60  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
61  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
62  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
63  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
64  * OF THE POSSIBILITY OF SUCH DAMAGE.
65  * ====================================================================
66  */
67 
68 /* Algorithm Specification
69  http://info.isl.ntt.co.jp/crypt/eng/camellia/specifications.html
70 */
71 
72 /*
73  * This release balances code size and performance. In particular key
74  * schedule setup is fully unrolled, because doing so *significantly*
75  * reduces amount of instructions per setup round and code increase is
76  * justifiable. In block functions on the other hand only inner loops
77  * are unrolled, as full unroll gives only nominal performance boost,
78  * while code size grows 4 or 7 times. Also, unlike previous versions
79  * this one "encourages" compiler to keep intermediate variables in
80  * registers, which should give better "all round" results, in other
81  * words reasonable performance even with not so modern compilers.
82  */
83 
84 #include "camellia.h"
85 #include "cmll_locl.h"
86 #include <string.h>
87 #include <stdlib.h>
88 
89 /* 32-bit rotations */
90 #if !defined(PEDANTIC) && !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_NO_INLINE_ASM)
91 # if defined(_MSC_VER) && (defined(_M_IX86) || defined(_M_AMD64) || defined(_M_X64))
92 # define RightRotate(x, s) _lrotr(x, s)
93 # define LeftRotate(x, s) _lrotl(x, s)
94 # if _MSC_VER >= 1400
95 # define SWAP(x) _byteswap_ulong(x)
96 # else
97 # define SWAP(x) (_lrotl(x, 8) & 0x00ff00ff | _lrotr(x, 8) & 0xff00ff00)
98 # endif
99 # define GETU32(p) SWAP(*((u32 *)(p)))
100 # define PUTU32(p,v) (*((u32 *)(p)) = SWAP((v)))
101 # elif defined(__GNUC__) && __GNUC__>=2
102 # if defined(__i386) || defined(__x86_64)
103 # define RightRotate(x,s) ({u32 ret; asm ("rorl %1,%0":"=r"(ret):"I"(s),"0"(x):"cc"); ret; })
104 # define LeftRotate(x,s) ({u32 ret; asm ("roll %1,%0":"=r"(ret):"I"(s),"0"(x):"cc"); ret; })
105 # if defined(B_ENDIAN) /* stratus.com does it */
106 # define GETU32(p) (*(u32 *)(p))
107 # define PUTU32(p,v) (*(u32 *)(p)=(v))
108 # else
109 # define GETU32(p) ({u32 r=*(const u32 *)(p); asm("bswapl %0":"=r"(r):"0"(r)); r; })
110 # define PUTU32(p,v) ({u32 r=(v); asm("bswapl %0":"=r"(r):"0"(r)); *(u32 *)(p)=r; })
111 # endif
112 # elif defined(_ARCH_PPC) || defined(_ARCH_PPC64) || \
113  defined(__powerpc) || defined(__ppc__) || defined(__powerpc64__)
114 # define LeftRotate(x,s) ({u32 ret; asm ("rlwinm %0,%1,%2,0,31":"=r"(ret):"r"(x),"I"(s)); ret; })
115 # define RightRotate(x,s) LeftRotate(x,(32-s))
116 # elif defined(__s390x__)
117 # define LeftRotate(x,s) ({u32 ret; asm ("rll %0,%1,%2":"=r"(ret):"r"(x),"I"(s)); ret; })
118 # define RightRotate(x,s) LeftRotate(x,(32-s))
119 # define GETU32(p) (*(u32 *)(p))
120 # define PUTU32(p,v) (*(u32 *)(p)=(v))
121 # endif
122 # endif
123 #endif
124 
125 #if !defined(RightRotate) && !defined(LeftRotate)
126 # define RightRotate(x, s) ( ((x) >> (s)) + ((x) << (32 - s)) )
127 # define LeftRotate(x, s) ( ((x) << (s)) + ((x) >> (32 - s)) )
128 #endif
129 
130 #if !defined(GETU32) && !defined(PUTU32)
131 # define GETU32(p) (((u32)(p)[0] << 24) ^ ((u32)(p)[1] << 16) ^ ((u32)(p)[2] << 8) ^ ((u32)(p)[3]))
132 # define PUTU32(p,v) ((p)[0] = (u8)((v) >> 24), (p)[1] = (u8)((v) >> 16), (p)[2] = (u8)((v) >> 8), (p)[3] = (u8)(v))
133 #endif
134 
135 /* S-box data */
136 #define SBOX1_1110 Camellia_SBOX[0]
137 #define SBOX4_4404 Camellia_SBOX[1]
138 #define SBOX2_0222 Camellia_SBOX[2]
139 #define SBOX3_3033 Camellia_SBOX[3]
140 static const u32 Camellia_SBOX[][256] = {
141 { 0x70707000, 0x82828200, 0x2c2c2c00, 0xececec00, 0xb3b3b300, 0x27272700,
142  0xc0c0c000, 0xe5e5e500, 0xe4e4e400, 0x85858500, 0x57575700, 0x35353500,
143  0xeaeaea00, 0x0c0c0c00, 0xaeaeae00, 0x41414100, 0x23232300, 0xefefef00,
144  0x6b6b6b00, 0x93939300, 0x45454500, 0x19191900, 0xa5a5a500, 0x21212100,
145  0xededed00, 0x0e0e0e00, 0x4f4f4f00, 0x4e4e4e00, 0x1d1d1d00, 0x65656500,
146  0x92929200, 0xbdbdbd00, 0x86868600, 0xb8b8b800, 0xafafaf00, 0x8f8f8f00,
147  0x7c7c7c00, 0xebebeb00, 0x1f1f1f00, 0xcecece00, 0x3e3e3e00, 0x30303000,
148  0xdcdcdc00, 0x5f5f5f00, 0x5e5e5e00, 0xc5c5c500, 0x0b0b0b00, 0x1a1a1a00,
149  0xa6a6a600, 0xe1e1e100, 0x39393900, 0xcacaca00, 0xd5d5d500, 0x47474700,
150  0x5d5d5d00, 0x3d3d3d00, 0xd9d9d900, 0x01010100, 0x5a5a5a00, 0xd6d6d600,
151  0x51515100, 0x56565600, 0x6c6c6c00, 0x4d4d4d00, 0x8b8b8b00, 0x0d0d0d00,
152  0x9a9a9a00, 0x66666600, 0xfbfbfb00, 0xcccccc00, 0xb0b0b000, 0x2d2d2d00,
153  0x74747400, 0x12121200, 0x2b2b2b00, 0x20202000, 0xf0f0f000, 0xb1b1b100,
154  0x84848400, 0x99999900, 0xdfdfdf00, 0x4c4c4c00, 0xcbcbcb00, 0xc2c2c200,
155  0x34343400, 0x7e7e7e00, 0x76767600, 0x05050500, 0x6d6d6d00, 0xb7b7b700,
156  0xa9a9a900, 0x31313100, 0xd1d1d100, 0x17171700, 0x04040400, 0xd7d7d700,
157  0x14141400, 0x58585800, 0x3a3a3a00, 0x61616100, 0xdedede00, 0x1b1b1b00,
158  0x11111100, 0x1c1c1c00, 0x32323200, 0x0f0f0f00, 0x9c9c9c00, 0x16161600,
159  0x53535300, 0x18181800, 0xf2f2f200, 0x22222200, 0xfefefe00, 0x44444400,
160  0xcfcfcf00, 0xb2b2b200, 0xc3c3c300, 0xb5b5b500, 0x7a7a7a00, 0x91919100,
161  0x24242400, 0x08080800, 0xe8e8e800, 0xa8a8a800, 0x60606000, 0xfcfcfc00,
162  0x69696900, 0x50505000, 0xaaaaaa00, 0xd0d0d000, 0xa0a0a000, 0x7d7d7d00,
163  0xa1a1a100, 0x89898900, 0x62626200, 0x97979700, 0x54545400, 0x5b5b5b00,
164  0x1e1e1e00, 0x95959500, 0xe0e0e000, 0xffffff00, 0x64646400, 0xd2d2d200,
165  0x10101000, 0xc4c4c400, 0x00000000, 0x48484800, 0xa3a3a300, 0xf7f7f700,
166  0x75757500, 0xdbdbdb00, 0x8a8a8a00, 0x03030300, 0xe6e6e600, 0xdadada00,
167  0x09090900, 0x3f3f3f00, 0xdddddd00, 0x94949400, 0x87878700, 0x5c5c5c00,
168  0x83838300, 0x02020200, 0xcdcdcd00, 0x4a4a4a00, 0x90909000, 0x33333300,
169  0x73737300, 0x67676700, 0xf6f6f600, 0xf3f3f300, 0x9d9d9d00, 0x7f7f7f00,
170  0xbfbfbf00, 0xe2e2e200, 0x52525200, 0x9b9b9b00, 0xd8d8d800, 0x26262600,
171  0xc8c8c800, 0x37373700, 0xc6c6c600, 0x3b3b3b00, 0x81818100, 0x96969600,
172  0x6f6f6f00, 0x4b4b4b00, 0x13131300, 0xbebebe00, 0x63636300, 0x2e2e2e00,
173  0xe9e9e900, 0x79797900, 0xa7a7a700, 0x8c8c8c00, 0x9f9f9f00, 0x6e6e6e00,
174  0xbcbcbc00, 0x8e8e8e00, 0x29292900, 0xf5f5f500, 0xf9f9f900, 0xb6b6b600,
175  0x2f2f2f00, 0xfdfdfd00, 0xb4b4b400, 0x59595900, 0x78787800, 0x98989800,
176  0x06060600, 0x6a6a6a00, 0xe7e7e700, 0x46464600, 0x71717100, 0xbababa00,
177  0xd4d4d400, 0x25252500, 0xababab00, 0x42424200, 0x88888800, 0xa2a2a200,
178  0x8d8d8d00, 0xfafafa00, 0x72727200, 0x07070700, 0xb9b9b900, 0x55555500,
179  0xf8f8f800, 0xeeeeee00, 0xacacac00, 0x0a0a0a00, 0x36363600, 0x49494900,
180  0x2a2a2a00, 0x68686800, 0x3c3c3c00, 0x38383800, 0xf1f1f100, 0xa4a4a400,
181  0x40404000, 0x28282800, 0xd3d3d300, 0x7b7b7b00, 0xbbbbbb00, 0xc9c9c900,
182  0x43434300, 0xc1c1c100, 0x15151500, 0xe3e3e300, 0xadadad00, 0xf4f4f400,
183  0x77777700, 0xc7c7c700, 0x80808000, 0x9e9e9e00 },
184 { 0x70700070, 0x2c2c002c, 0xb3b300b3, 0xc0c000c0, 0xe4e400e4, 0x57570057,
185  0xeaea00ea, 0xaeae00ae, 0x23230023, 0x6b6b006b, 0x45450045, 0xa5a500a5,
186  0xeded00ed, 0x4f4f004f, 0x1d1d001d, 0x92920092, 0x86860086, 0xafaf00af,
187  0x7c7c007c, 0x1f1f001f, 0x3e3e003e, 0xdcdc00dc, 0x5e5e005e, 0x0b0b000b,
188  0xa6a600a6, 0x39390039, 0xd5d500d5, 0x5d5d005d, 0xd9d900d9, 0x5a5a005a,
189  0x51510051, 0x6c6c006c, 0x8b8b008b, 0x9a9a009a, 0xfbfb00fb, 0xb0b000b0,
190  0x74740074, 0x2b2b002b, 0xf0f000f0, 0x84840084, 0xdfdf00df, 0xcbcb00cb,
191  0x34340034, 0x76760076, 0x6d6d006d, 0xa9a900a9, 0xd1d100d1, 0x04040004,
192  0x14140014, 0x3a3a003a, 0xdede00de, 0x11110011, 0x32320032, 0x9c9c009c,
193  0x53530053, 0xf2f200f2, 0xfefe00fe, 0xcfcf00cf, 0xc3c300c3, 0x7a7a007a,
194  0x24240024, 0xe8e800e8, 0x60600060, 0x69690069, 0xaaaa00aa, 0xa0a000a0,
195  0xa1a100a1, 0x62620062, 0x54540054, 0x1e1e001e, 0xe0e000e0, 0x64640064,
196  0x10100010, 0x00000000, 0xa3a300a3, 0x75750075, 0x8a8a008a, 0xe6e600e6,
197  0x09090009, 0xdddd00dd, 0x87870087, 0x83830083, 0xcdcd00cd, 0x90900090,
198  0x73730073, 0xf6f600f6, 0x9d9d009d, 0xbfbf00bf, 0x52520052, 0xd8d800d8,
199  0xc8c800c8, 0xc6c600c6, 0x81810081, 0x6f6f006f, 0x13130013, 0x63630063,
200  0xe9e900e9, 0xa7a700a7, 0x9f9f009f, 0xbcbc00bc, 0x29290029, 0xf9f900f9,
201  0x2f2f002f, 0xb4b400b4, 0x78780078, 0x06060006, 0xe7e700e7, 0x71710071,
202  0xd4d400d4, 0xabab00ab, 0x88880088, 0x8d8d008d, 0x72720072, 0xb9b900b9,
203  0xf8f800f8, 0xacac00ac, 0x36360036, 0x2a2a002a, 0x3c3c003c, 0xf1f100f1,
204  0x40400040, 0xd3d300d3, 0xbbbb00bb, 0x43430043, 0x15150015, 0xadad00ad,
205  0x77770077, 0x80800080, 0x82820082, 0xecec00ec, 0x27270027, 0xe5e500e5,
206  0x85850085, 0x35350035, 0x0c0c000c, 0x41410041, 0xefef00ef, 0x93930093,
207  0x19190019, 0x21210021, 0x0e0e000e, 0x4e4e004e, 0x65650065, 0xbdbd00bd,
208  0xb8b800b8, 0x8f8f008f, 0xebeb00eb, 0xcece00ce, 0x30300030, 0x5f5f005f,
209  0xc5c500c5, 0x1a1a001a, 0xe1e100e1, 0xcaca00ca, 0x47470047, 0x3d3d003d,
210  0x01010001, 0xd6d600d6, 0x56560056, 0x4d4d004d, 0x0d0d000d, 0x66660066,
211  0xcccc00cc, 0x2d2d002d, 0x12120012, 0x20200020, 0xb1b100b1, 0x99990099,
212  0x4c4c004c, 0xc2c200c2, 0x7e7e007e, 0x05050005, 0xb7b700b7, 0x31310031,
213  0x17170017, 0xd7d700d7, 0x58580058, 0x61610061, 0x1b1b001b, 0x1c1c001c,
214  0x0f0f000f, 0x16160016, 0x18180018, 0x22220022, 0x44440044, 0xb2b200b2,
215  0xb5b500b5, 0x91910091, 0x08080008, 0xa8a800a8, 0xfcfc00fc, 0x50500050,
216  0xd0d000d0, 0x7d7d007d, 0x89890089, 0x97970097, 0x5b5b005b, 0x95950095,
217  0xffff00ff, 0xd2d200d2, 0xc4c400c4, 0x48480048, 0xf7f700f7, 0xdbdb00db,
218  0x03030003, 0xdada00da, 0x3f3f003f, 0x94940094, 0x5c5c005c, 0x02020002,
219  0x4a4a004a, 0x33330033, 0x67670067, 0xf3f300f3, 0x7f7f007f, 0xe2e200e2,
220  0x9b9b009b, 0x26260026, 0x37370037, 0x3b3b003b, 0x96960096, 0x4b4b004b,
221  0xbebe00be, 0x2e2e002e, 0x79790079, 0x8c8c008c, 0x6e6e006e, 0x8e8e008e,
222  0xf5f500f5, 0xb6b600b6, 0xfdfd00fd, 0x59590059, 0x98980098, 0x6a6a006a,
223  0x46460046, 0xbaba00ba, 0x25250025, 0x42420042, 0xa2a200a2, 0xfafa00fa,
224  0x07070007, 0x55550055, 0xeeee00ee, 0x0a0a000a, 0x49490049, 0x68680068,
225  0x38380038, 0xa4a400a4, 0x28280028, 0x7b7b007b, 0xc9c900c9, 0xc1c100c1,
226  0xe3e300e3, 0xf4f400f4, 0xc7c700c7, 0x9e9e009e },
227 { 0x00e0e0e0, 0x00050505, 0x00585858, 0x00d9d9d9, 0x00676767, 0x004e4e4e,
228  0x00818181, 0x00cbcbcb, 0x00c9c9c9, 0x000b0b0b, 0x00aeaeae, 0x006a6a6a,
229  0x00d5d5d5, 0x00181818, 0x005d5d5d, 0x00828282, 0x00464646, 0x00dfdfdf,
230  0x00d6d6d6, 0x00272727, 0x008a8a8a, 0x00323232, 0x004b4b4b, 0x00424242,
231  0x00dbdbdb, 0x001c1c1c, 0x009e9e9e, 0x009c9c9c, 0x003a3a3a, 0x00cacaca,
232  0x00252525, 0x007b7b7b, 0x000d0d0d, 0x00717171, 0x005f5f5f, 0x001f1f1f,
233  0x00f8f8f8, 0x00d7d7d7, 0x003e3e3e, 0x009d9d9d, 0x007c7c7c, 0x00606060,
234  0x00b9b9b9, 0x00bebebe, 0x00bcbcbc, 0x008b8b8b, 0x00161616, 0x00343434,
235  0x004d4d4d, 0x00c3c3c3, 0x00727272, 0x00959595, 0x00ababab, 0x008e8e8e,
236  0x00bababa, 0x007a7a7a, 0x00b3b3b3, 0x00020202, 0x00b4b4b4, 0x00adadad,
237  0x00a2a2a2, 0x00acacac, 0x00d8d8d8, 0x009a9a9a, 0x00171717, 0x001a1a1a,
238  0x00353535, 0x00cccccc, 0x00f7f7f7, 0x00999999, 0x00616161, 0x005a5a5a,
239  0x00e8e8e8, 0x00242424, 0x00565656, 0x00404040, 0x00e1e1e1, 0x00636363,
240  0x00090909, 0x00333333, 0x00bfbfbf, 0x00989898, 0x00979797, 0x00858585,
241  0x00686868, 0x00fcfcfc, 0x00ececec, 0x000a0a0a, 0x00dadada, 0x006f6f6f,
242  0x00535353, 0x00626262, 0x00a3a3a3, 0x002e2e2e, 0x00080808, 0x00afafaf,
243  0x00282828, 0x00b0b0b0, 0x00747474, 0x00c2c2c2, 0x00bdbdbd, 0x00363636,
244  0x00222222, 0x00383838, 0x00646464, 0x001e1e1e, 0x00393939, 0x002c2c2c,
245  0x00a6a6a6, 0x00303030, 0x00e5e5e5, 0x00444444, 0x00fdfdfd, 0x00888888,
246  0x009f9f9f, 0x00656565, 0x00878787, 0x006b6b6b, 0x00f4f4f4, 0x00232323,
247  0x00484848, 0x00101010, 0x00d1d1d1, 0x00515151, 0x00c0c0c0, 0x00f9f9f9,
248  0x00d2d2d2, 0x00a0a0a0, 0x00555555, 0x00a1a1a1, 0x00414141, 0x00fafafa,
249  0x00434343, 0x00131313, 0x00c4c4c4, 0x002f2f2f, 0x00a8a8a8, 0x00b6b6b6,
250  0x003c3c3c, 0x002b2b2b, 0x00c1c1c1, 0x00ffffff, 0x00c8c8c8, 0x00a5a5a5,
251  0x00202020, 0x00898989, 0x00000000, 0x00909090, 0x00474747, 0x00efefef,
252  0x00eaeaea, 0x00b7b7b7, 0x00151515, 0x00060606, 0x00cdcdcd, 0x00b5b5b5,
253  0x00121212, 0x007e7e7e, 0x00bbbbbb, 0x00292929, 0x000f0f0f, 0x00b8b8b8,
254  0x00070707, 0x00040404, 0x009b9b9b, 0x00949494, 0x00212121, 0x00666666,
255  0x00e6e6e6, 0x00cecece, 0x00ededed, 0x00e7e7e7, 0x003b3b3b, 0x00fefefe,
256  0x007f7f7f, 0x00c5c5c5, 0x00a4a4a4, 0x00373737, 0x00b1b1b1, 0x004c4c4c,
257  0x00919191, 0x006e6e6e, 0x008d8d8d, 0x00767676, 0x00030303, 0x002d2d2d,
258  0x00dedede, 0x00969696, 0x00262626, 0x007d7d7d, 0x00c6c6c6, 0x005c5c5c,
259  0x00d3d3d3, 0x00f2f2f2, 0x004f4f4f, 0x00191919, 0x003f3f3f, 0x00dcdcdc,
260  0x00797979, 0x001d1d1d, 0x00525252, 0x00ebebeb, 0x00f3f3f3, 0x006d6d6d,
261  0x005e5e5e, 0x00fbfbfb, 0x00696969, 0x00b2b2b2, 0x00f0f0f0, 0x00313131,
262  0x000c0c0c, 0x00d4d4d4, 0x00cfcfcf, 0x008c8c8c, 0x00e2e2e2, 0x00757575,
263  0x00a9a9a9, 0x004a4a4a, 0x00575757, 0x00848484, 0x00111111, 0x00454545,
264  0x001b1b1b, 0x00f5f5f5, 0x00e4e4e4, 0x000e0e0e, 0x00737373, 0x00aaaaaa,
265  0x00f1f1f1, 0x00dddddd, 0x00595959, 0x00141414, 0x006c6c6c, 0x00929292,
266  0x00545454, 0x00d0d0d0, 0x00787878, 0x00707070, 0x00e3e3e3, 0x00494949,
267  0x00808080, 0x00505050, 0x00a7a7a7, 0x00f6f6f6, 0x00777777, 0x00939393,
268  0x00868686, 0x00838383, 0x002a2a2a, 0x00c7c7c7, 0x005b5b5b, 0x00e9e9e9,
269  0x00eeeeee, 0x008f8f8f, 0x00010101, 0x003d3d3d },
270 { 0x38003838, 0x41004141, 0x16001616, 0x76007676, 0xd900d9d9, 0x93009393,
271  0x60006060, 0xf200f2f2, 0x72007272, 0xc200c2c2, 0xab00abab, 0x9a009a9a,
272  0x75007575, 0x06000606, 0x57005757, 0xa000a0a0, 0x91009191, 0xf700f7f7,
273  0xb500b5b5, 0xc900c9c9, 0xa200a2a2, 0x8c008c8c, 0xd200d2d2, 0x90009090,
274  0xf600f6f6, 0x07000707, 0xa700a7a7, 0x27002727, 0x8e008e8e, 0xb200b2b2,
275  0x49004949, 0xde00dede, 0x43004343, 0x5c005c5c, 0xd700d7d7, 0xc700c7c7,
276  0x3e003e3e, 0xf500f5f5, 0x8f008f8f, 0x67006767, 0x1f001f1f, 0x18001818,
277  0x6e006e6e, 0xaf00afaf, 0x2f002f2f, 0xe200e2e2, 0x85008585, 0x0d000d0d,
278  0x53005353, 0xf000f0f0, 0x9c009c9c, 0x65006565, 0xea00eaea, 0xa300a3a3,
279  0xae00aeae, 0x9e009e9e, 0xec00ecec, 0x80008080, 0x2d002d2d, 0x6b006b6b,
280  0xa800a8a8, 0x2b002b2b, 0x36003636, 0xa600a6a6, 0xc500c5c5, 0x86008686,
281  0x4d004d4d, 0x33003333, 0xfd00fdfd, 0x66006666, 0x58005858, 0x96009696,
282  0x3a003a3a, 0x09000909, 0x95009595, 0x10001010, 0x78007878, 0xd800d8d8,
283  0x42004242, 0xcc00cccc, 0xef00efef, 0x26002626, 0xe500e5e5, 0x61006161,
284  0x1a001a1a, 0x3f003f3f, 0x3b003b3b, 0x82008282, 0xb600b6b6, 0xdb00dbdb,
285  0xd400d4d4, 0x98009898, 0xe800e8e8, 0x8b008b8b, 0x02000202, 0xeb00ebeb,
286  0x0a000a0a, 0x2c002c2c, 0x1d001d1d, 0xb000b0b0, 0x6f006f6f, 0x8d008d8d,
287  0x88008888, 0x0e000e0e, 0x19001919, 0x87008787, 0x4e004e4e, 0x0b000b0b,
288  0xa900a9a9, 0x0c000c0c, 0x79007979, 0x11001111, 0x7f007f7f, 0x22002222,
289  0xe700e7e7, 0x59005959, 0xe100e1e1, 0xda00dada, 0x3d003d3d, 0xc800c8c8,
290  0x12001212, 0x04000404, 0x74007474, 0x54005454, 0x30003030, 0x7e007e7e,
291  0xb400b4b4, 0x28002828, 0x55005555, 0x68006868, 0x50005050, 0xbe00bebe,
292  0xd000d0d0, 0xc400c4c4, 0x31003131, 0xcb00cbcb, 0x2a002a2a, 0xad00adad,
293  0x0f000f0f, 0xca00caca, 0x70007070, 0xff00ffff, 0x32003232, 0x69006969,
294  0x08000808, 0x62006262, 0x00000000, 0x24002424, 0xd100d1d1, 0xfb00fbfb,
295  0xba00baba, 0xed00eded, 0x45004545, 0x81008181, 0x73007373, 0x6d006d6d,
296  0x84008484, 0x9f009f9f, 0xee00eeee, 0x4a004a4a, 0xc300c3c3, 0x2e002e2e,
297  0xc100c1c1, 0x01000101, 0xe600e6e6, 0x25002525, 0x48004848, 0x99009999,
298  0xb900b9b9, 0xb300b3b3, 0x7b007b7b, 0xf900f9f9, 0xce00cece, 0xbf00bfbf,
299  0xdf00dfdf, 0x71007171, 0x29002929, 0xcd00cdcd, 0x6c006c6c, 0x13001313,
300  0x64006464, 0x9b009b9b, 0x63006363, 0x9d009d9d, 0xc000c0c0, 0x4b004b4b,
301  0xb700b7b7, 0xa500a5a5, 0x89008989, 0x5f005f5f, 0xb100b1b1, 0x17001717,
302  0xf400f4f4, 0xbc00bcbc, 0xd300d3d3, 0x46004646, 0xcf00cfcf, 0x37003737,
303  0x5e005e5e, 0x47004747, 0x94009494, 0xfa00fafa, 0xfc00fcfc, 0x5b005b5b,
304  0x97009797, 0xfe00fefe, 0x5a005a5a, 0xac00acac, 0x3c003c3c, 0x4c004c4c,
305  0x03000303, 0x35003535, 0xf300f3f3, 0x23002323, 0xb800b8b8, 0x5d005d5d,
306  0x6a006a6a, 0x92009292, 0xd500d5d5, 0x21002121, 0x44004444, 0x51005151,
307  0xc600c6c6, 0x7d007d7d, 0x39003939, 0x83008383, 0xdc00dcdc, 0xaa00aaaa,
308  0x7c007c7c, 0x77007777, 0x56005656, 0x05000505, 0x1b001b1b, 0xa400a4a4,
309  0x15001515, 0x34003434, 0x1e001e1e, 0x1c001c1c, 0xf800f8f8, 0x52005252,
310  0x20002020, 0x14001414, 0xe900e9e9, 0xbd00bdbd, 0xdd00dddd, 0xe400e4e4,
311  0xa100a1a1, 0xe000e0e0, 0x8a008a8a, 0xf100f1f1, 0xd600d6d6, 0x7a007a7a,
312  0xbb00bbbb, 0xe300e3e3, 0x40004040, 0x4f004f4f }
313 };
314 
315 /* Key generation constants */
316 static const u32 SIGMA[] = {
317  0xa09e667f, 0x3bcc908b, 0xb67ae858, 0x4caa73b2, 0xc6ef372f, 0xe94f82be,
318  0x54ff53a5, 0xf1d36f1c, 0x10e527fa, 0xde682d1d, 0xb05688c2, 0xb3e6c1fd
319 };
320 
321 /* The phi algorithm given in C.2.7 of the Camellia spec document. */
322 /*
323  * This version does not attempt to minimize amount of temporary
324  * variables, but instead explicitly exposes algorithm's parallelism.
325  * It is therefore most appropriate for platforms with not less than
326  * ~16 registers. For platforms with less registers [well, x86 to be
327  * specific] assembler version should be/is provided anyway...
328  */
329 #define Camellia_Feistel(_s0,_s1,_s2,_s3,_key) do {\
330  register u32 _t0,_t1,_t2,_t3;\
331 \
332  _t0 = _s0 ^ (_key)[0];\
333  _t3 = SBOX4_4404[_t0&0xff];\
334  _t1 = _s1 ^ (_key)[1];\
335  _t3 ^= SBOX3_3033[(_t0 >> 8)&0xff];\
336  _t2 = SBOX1_1110[_t1&0xff];\
337  _t3 ^= SBOX2_0222[(_t0 >> 16)&0xff];\
338  _t2 ^= SBOX4_4404[(_t1 >> 8)&0xff];\
339  _t3 ^= SBOX1_1110[(_t0 >> 24)];\
340  _t2 ^= _t3;\
341  _t3 = RightRotate(_t3,8);\
342  _t2 ^= SBOX3_3033[(_t1 >> 16)&0xff];\
343  _s3 ^= _t3;\
344  _t2 ^= SBOX2_0222[(_t1 >> 24)];\
345  _s2 ^= _t2; \
346  _s3 ^= _t2;\
347 } while(0)
348 
349 /*
350  * Note that n has to be less than 32. Rotations for larger amount
351  * of bits are achieved by "rotating" order of s-elements and
352  * adjusting n accordingly, e.g. RotLeft128(s1,s2,s3,s0,n-32).
353  */
354 #define RotLeft128(_s0,_s1,_s2,_s3,_n) do {\
355  u32 _t0=_s0>>(32-_n);\
356  _s0 = (_s0<<_n) | (_s1>>(32-_n));\
357  _s1 = (_s1<<_n) | (_s2>>(32-_n));\
358  _s2 = (_s2<<_n) | (_s3>>(32-_n));\
359  _s3 = (_s3<<_n) | _t0;\
360 } while (0)
361 
362 int Camellia_Ekeygen(int keyBitLength, const u8 *rawKey, KEY_TABLE_TYPE k)
363  {
364  register u32 s0,s1,s2,s3;
365 
366  k[0] = s0 = GETU32(rawKey);
367  k[1] = s1 = GETU32(rawKey+4);
368  k[2] = s2 = GETU32(rawKey+8);
369  k[3] = s3 = GETU32(rawKey+12);
370 
371  if (keyBitLength != 128)
372  {
373  k[8] = s0 = GETU32(rawKey+16);
374  k[9] = s1 = GETU32(rawKey+20);
375  if (keyBitLength == 192)
376  {
377  k[10] = s2 = ~s0;
378  k[11] = s3 = ~s1;
379  }
380  else
381  {
382  k[10] = s2 = GETU32(rawKey+24);
383  k[11] = s3 = GETU32(rawKey+28);
384  }
385  s0 ^= k[0], s1 ^= k[1], s2 ^= k[2], s3 ^= k[3];
386  }
387 
388  /* Use the Feistel routine to scramble the key material */
389  Camellia_Feistel(s0,s1,s2,s3,SIGMA+0);
390  Camellia_Feistel(s2,s3,s0,s1,SIGMA+2);
391 
392  s0 ^= k[0], s1 ^= k[1], s2 ^= k[2], s3 ^= k[3];
393  Camellia_Feistel(s0,s1,s2,s3,SIGMA+4);
394  Camellia_Feistel(s2,s3,s0,s1,SIGMA+6);
395 
396  /* Fill the keyTable. Requires many block rotations. */
397  if (keyBitLength == 128)
398  {
399  k[ 4] = s0, k[ 5] = s1, k[ 6] = s2, k[ 7] = s3;
400  RotLeft128(s0,s1,s2,s3,15); /* KA <<< 15 */
401  k[12] = s0, k[13] = s1, k[14] = s2, k[15] = s3;
402  RotLeft128(s0,s1,s2,s3,15); /* KA <<< 30 */
403  k[16] = s0, k[17] = s1, k[18] = s2, k[19] = s3;
404  RotLeft128(s0,s1,s2,s3,15); /* KA <<< 45 */
405  k[24] = s0, k[25] = s1;
406  RotLeft128(s0,s1,s2,s3,15); /* KA <<< 60 */
407  k[28] = s0, k[29] = s1, k[30] = s2, k[31] = s3;
408  RotLeft128(s1,s2,s3,s0,2); /* KA <<< 94 */
409  k[40] = s1, k[41] = s2, k[42] = s3, k[43] = s0;
410  RotLeft128(s1,s2,s3,s0,17); /* KA <<<111 */
411  k[48] = s1, k[49] = s2, k[50] = s3, k[51] = s0;
412 
413  s0 = k[ 0], s1 = k[ 1], s2 = k[ 2], s3 = k[ 3];
414  RotLeft128(s0,s1,s2,s3,15); /* KL <<< 15 */
415  k[ 8] = s0, k[ 9] = s1, k[10] = s2, k[11] = s3;
416  RotLeft128(s0,s1,s2,s3,30); /* KL <<< 45 */
417  k[20] = s0, k[21] = s1, k[22] = s2, k[23] = s3;
418  RotLeft128(s0,s1,s2,s3,15); /* KL <<< 60 */
419  k[26] = s2, k[27] = s3;
420  RotLeft128(s0,s1,s2,s3,17); /* KL <<< 77 */
421  k[32] = s0, k[33] = s1, k[34] = s2, k[35] = s3;
422  RotLeft128(s0,s1,s2,s3,17); /* KL <<< 94 */
423  k[36] = s0, k[37] = s1, k[38] = s2, k[39] = s3;
424  RotLeft128(s0,s1,s2,s3,17); /* KL <<<111 */
425  k[44] = s0, k[45] = s1, k[46] = s2, k[47] = s3;
426 
427  return 3; /* grand rounds */
428  }
429  else
430  {
431  k[12] = s0, k[13] = s1, k[14] = s2, k[15] = s3;
432  s0 ^= k[8], s1 ^= k[9], s2 ^=k[10], s3 ^=k[11];
433  Camellia_Feistel(s0,s1,s2,s3,(SIGMA+8));
434  Camellia_Feistel(s2,s3,s0,s1,(SIGMA+10));
435 
436  k[ 4] = s0, k[ 5] = s1, k[ 6] = s2, k[ 7] = s3;
437  RotLeft128(s0,s1,s2,s3,30); /* KB <<< 30 */
438  k[20] = s0, k[21] = s1, k[22] = s2, k[23] = s3;
439  RotLeft128(s0,s1,s2,s3,30); /* KB <<< 60 */
440  k[40] = s0, k[41] = s1, k[42] = s2, k[43] = s3;
441  RotLeft128(s1,s2,s3,s0,19); /* KB <<<111 */
442  k[64] = s1, k[65] = s2, k[66] = s3, k[67] = s0;
443 
444  s0 = k[ 8], s1 = k[ 9], s2 = k[10], s3 = k[11];
445  RotLeft128(s0,s1,s2,s3,15); /* KR <<< 15 */
446  k[ 8] = s0, k[ 9] = s1, k[10] = s2, k[11] = s3;
447  RotLeft128(s0,s1,s2,s3,15); /* KR <<< 30 */
448  k[16] = s0, k[17] = s1, k[18] = s2, k[19] = s3;
449  RotLeft128(s0,s1,s2,s3,30); /* KR <<< 60 */
450  k[36] = s0, k[37] = s1, k[38] = s2, k[39] = s3;
451  RotLeft128(s1,s2,s3,s0,2); /* KR <<< 94 */
452  k[52] = s1, k[53] = s2, k[54] = s3, k[55] = s0;
453 
454  s0 = k[12], s1 = k[13], s2 = k[14], s3 = k[15];
455  RotLeft128(s0,s1,s2,s3,15); /* KA <<< 15 */
456  k[12] = s0, k[13] = s1, k[14] = s2, k[15] = s3;
457  RotLeft128(s0,s1,s2,s3,30); /* KA <<< 45 */
458  k[28] = s0, k[29] = s1, k[30] = s2, k[31] = s3;
459  /* KA <<< 77 */
460  k[48] = s1, k[49] = s2, k[50] = s3, k[51] = s0;
461  RotLeft128(s1,s2,s3,s0,17); /* KA <<< 94 */
462  k[56] = s1, k[57] = s2, k[58] = s3, k[59] = s0;
463 
464  s0 = k[ 0], s1 = k[ 1], s2 = k[ 2], s3 = k[ 3];
465  RotLeft128(s1,s2,s3,s0,13); /* KL <<< 45 */
466  k[24] = s1, k[25] = s2, k[26] = s3, k[27] = s0;
467  RotLeft128(s1,s2,s3,s0,15); /* KL <<< 60 */
468  k[32] = s1, k[33] = s2, k[34] = s3, k[35] = s0;
469  RotLeft128(s1,s2,s3,s0,17); /* KL <<< 77 */
470  k[44] = s1, k[45] = s2, k[46] = s3, k[47] = s0;
471  RotLeft128(s2,s3,s0,s1,2); /* KL <<<111 */
472  k[60] = s2, k[61] = s3, k[62] = s0, k[63] = s1;
473 
474  return 4; /* grand rounds */
475  }
476  /*
477  * It is possible to perform certain precalculations, which
478  * would spare few cycles in block procedure. It's not done,
479  * because it upsets the performance balance between key
480  * setup and block procedures, negatively affecting overall
481  * throughput in applications operating on short messages
482  * and volatile keys.
483  */
484  }
485 
486 void Camellia_EncryptBlock_Rounds(int grandRounds, const u8 plaintext[],
487  const KEY_TABLE_TYPE keyTable, u8 ciphertext[])
488  {
489  register u32 s0,s1,s2,s3;
490  const u32 *k = keyTable,*kend = keyTable+grandRounds*16;
491 
492  s0 = GETU32(plaintext) ^ k[0];
493  s1 = GETU32(plaintext+4) ^ k[1];
494  s2 = GETU32(plaintext+8) ^ k[2];
495  s3 = GETU32(plaintext+12) ^ k[3];
496  k += 4;
497 
498  while (1)
499  {
500  /* Camellia makes 6 Feistel rounds */
501  Camellia_Feistel(s0,s1,s2,s3,k+0);
502  Camellia_Feistel(s2,s3,s0,s1,k+2);
503  Camellia_Feistel(s0,s1,s2,s3,k+4);
504  Camellia_Feistel(s2,s3,s0,s1,k+6);
505  Camellia_Feistel(s0,s1,s2,s3,k+8);
506  Camellia_Feistel(s2,s3,s0,s1,k+10);
507  k += 12;
508 
509  if (k == kend) break;
510 
511  /* This is the same function as the diffusion function D
512  * of the accompanying documentation. See section 3.2
513  * for properties of the FLlayer function. */
514  s1 ^= LeftRotate(s0 & k[0], 1);
515  s2 ^= s3 | k[3];
516  s0 ^= s1 | k[1];
517  s3 ^= LeftRotate(s2 & k[2], 1);
518  k += 4;
519  }
520 
521  s2 ^= k[0], s3 ^= k[1], s0 ^= k[2], s1 ^= k[3];
522 
523  PUTU32(ciphertext, s2);
524  PUTU32(ciphertext+4, s3);
525  PUTU32(ciphertext+8, s0);
526  PUTU32(ciphertext+12,s1);
527  }
528 void Camellia_EncryptBlock(int keyBitLength, const u8 plaintext[],
529  const KEY_TABLE_TYPE keyTable, u8 ciphertext[])
530  {
531  Camellia_EncryptBlock_Rounds(keyBitLength==128?3:4,
532  plaintext,keyTable,ciphertext);
533  }
534 
535 void Camellia_DecryptBlock_Rounds(int grandRounds, const u8 ciphertext[],
536  const KEY_TABLE_TYPE keyTable, u8 plaintext[])
537  {
538  u32 s0,s1,s2,s3;
539  const u32 *k = keyTable+grandRounds*16,*kend = keyTable+4;
540 
541  s0 = GETU32(ciphertext) ^ k[0];
542  s1 = GETU32(ciphertext+4) ^ k[1];
543  s2 = GETU32(ciphertext+8) ^ k[2];
544  s3 = GETU32(ciphertext+12) ^ k[3];
545 
546  while (1)
547  {
548  /* Camellia makes 6 Feistel rounds */
549  k -= 12;
550  Camellia_Feistel(s0,s1,s2,s3,k+10);
551  Camellia_Feistel(s2,s3,s0,s1,k+8);
552  Camellia_Feistel(s0,s1,s2,s3,k+6);
553  Camellia_Feistel(s2,s3,s0,s1,k+4);
554  Camellia_Feistel(s0,s1,s2,s3,k+2);
555  Camellia_Feistel(s2,s3,s0,s1,k+0);
556 
557  if (k == kend) break;
558 
559  /* This is the same function as the diffusion function D
560  * of the accompanying documentation. See section 3.2
561  * for properties of the FLlayer function. */
562  k -= 4;
563  s1 ^= LeftRotate(s0 & k[2], 1);
564  s2 ^= s3 | k[1];
565  s0 ^= s1 | k[3];
566  s3 ^= LeftRotate(s2 & k[0], 1);
567  }
568 
569  k -= 4;
570  s2 ^= k[0], s3 ^= k[1], s0 ^= k[2], s1 ^= k[3];
571 
572  PUTU32(plaintext, s2);
573  PUTU32(plaintext+4, s3);
574  PUTU32(plaintext+8, s0);
575  PUTU32(plaintext+12,s1);
576  }
577 void Camellia_DecryptBlock(int keyBitLength, const u8 plaintext[],
578  const KEY_TABLE_TYPE keyTable, u8 ciphertext[])
579  {
580  Camellia_DecryptBlock_Rounds(keyBitLength==128?3:4,
581  plaintext,keyTable,ciphertext);
582  }
Generated on Thu Jan 10 2013 09:53:34 for OpenSSL by   doxygen 1.8.2