/* cast.c -- implementation of CAST-128 (aka CAST5) as described in RFC2144 Written in 1997 by Wim Lewis based entirely on RFC2144. Minor modifications made in 2002 by Andrew M. Kuchling . =================================================================== The contents of this file are dedicated to the public domain. To the extent that dedication to the public domain is not available, everyone is granted a worldwide, perpetual, royalty-free, non-exclusive license to exercise all rights associated with the contents of this file for any purpose whatsoever. No rights are reserved. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. =================================================================== Consult your local laws for possible restrictions on use, distribution, and import/export. RFC2144 states that this algorithm "is available worldwide on a royalty-free basis for commercial and non-commercial uses". This code is a pretty straightforward transliteration of the RFC into C. It has not been optimized much at all: byte-order-independent arithmetic operations are used where order-dependent pointer ops or unions might be faster; the code could be rearranged to give the optimizer a better chance to speed things up; etc. This code requires a vaguely ANSI-ish compiler. compile -DTEST to include main() which performs the tests specified in RFC2144 Tested with gcc 2.5.8 on i486, i586, i686, hp pa-risc, mc68040, sparc; also with gcc 2.7.2 and (with minor changes) native Sun compiler on sparc */ #include "common.h" #include "endianess.h" #include "block_base.h" FAKE_INIT(raw_cast) #define MODULE_NAME CAST #define BLOCK_SIZE 8 #define KEY_SIZE 0 /* this struct probably belongs in cast.h */ struct block_state { /* masking and rotate keys */ uint32_t Km[16]; uint8_t Kr[16]; /* number of rounds (depends on original unpadded keylength) */ unsigned rounds; }; /* these are the eight 32*256 S-boxes */ #include "cast5.c" /* this is the round function f(D, Km, Kr) */ static uint32_t castfunc(uint32_t D, uint32_t Kmi, uint8_t Kri, unsigned type) { uint32_t I, f; uint8_t Ibe[4]; #define Ia Ibe[0] #define Ib Ibe[1] #define Ic Ibe[2] #define Id Ibe[3] switch(type) { case 0: I = (Kmi + D) ; break; case 1: I = (Kmi ^ D) ; break; default: case 2: I = (Kmi - D) ; break; } if (Kri>0) { I = ( I << Kri ) | ( I >> ( 32-Kri ) ); } STORE_U32_BIG(Ibe, I); switch(type) { case 0: f = ((S1[Ia] ^ S2[Ib]) - S3[Ic]) + S4[Id]; break; case 1: f = ((S1[Ia] - S2[Ib]) + S3[Ic]) ^ S4[Id]; break; default: case 2: f = ((S1[Ia] + S2[Ib]) ^ S3[Ic]) - S4[Id]; break; } return f; } /* encrypts/decrypts one block of data according to the key schedule pointed to by `key'. Encrypts if decrypt=0, otherwise decrypts. */ static void castcrypt(struct block_state *key, uint8_t *block, int decrypt) { uint32_t L, R, tmp, f; uint32_t Kmi; uint8_t Kri; unsigned functype, round; L = LOAD_U32_BIG(block + 0); R = LOAD_U32_BIG(block + 4); for(round = 0; round < key->rounds; round ++) { if (!decrypt) { Kmi = key->Km[round]; Kri = key->Kr[round]; functype = round % 3; } else { Kmi = key->Km[(key->rounds) - round - 1]; Kri = key->Kr[(key->rounds) - round - 1]; functype = (((key->rounds) - round - 1) % 3); } f = castfunc(R, Kmi, Kri, functype); tmp = L; L = R; R = tmp ^ f; } STORE_U32_BIG(block + 0, R); STORE_U32_BIG(block + 4, L); } /* fetch a uint8_t from an array of uint32_ts */ #define b(a,n) (((a)[n/4] >> (24-((n&3)*8))) & 0xFF) /* key schedule round functions */ #define XZRound(T, F, ki1, ki2, ki3, ki4, \ si11, si12, si13, si14, si15,\ si25,\ si35,\ si45 ) \ T[0] = F[ki1] ^ S5[si11 ] ^ S6[si12 ] ^ S7[si13 ] ^ S8[si14 ] ^ S7[si15];\ T[1] = F[ki2] ^ S5[b(T, 0)] ^ S6[b(T,2)] ^ S7[b(T, 1)] ^ S8[b(T,3)] ^ S8[si25];\ T[2] = F[ki3] ^ S5[b(T, 7)] ^ S6[b(T,6)] ^ S7[b(T, 5)] ^ S8[b(T,4)] ^ S5[si35];\ T[3] = F[ki4] ^ S5[b(T,10)] ^ S6[b(T,9)] ^ S7[b(T,11)] ^ S8[b(T,8)] ^ S6[si45]; #define zxround() XZRound(z, x, 0, 2, 3, 1, \ b(x,13), b(x,15), b(x,12), b(x,14),\ b(x, 8), b(x,10), b(x, 9), b(x,11)) #define xzround() XZRound(x, z, 2, 0, 1, 3, \ b(z,5), b(z,7), b(z,4), b(z,6), \ b(z,0), b(z,2), b(z,1), b(z,3)) #define Kround(T, base, F,\ i11, i12, i13, i14, i15,\ i21, i22, i23, i24, i25,\ i31, i32, i33, i34, i35,\ i41, i42, i43, i44, i45)\ T[base+0] = S5[b(F,i11)] ^ S6[b(F,i12)] ^ S7[b(F,i13)] ^ S8[b(F,i14)] ^ S5[b(F,i15)];\ T[base+1] = S5[b(F,i21)] ^ S6[b(F,i22)] ^ S7[b(F,i23)] ^ S8[b(F,i24)] ^ S6[b(F,i25)];\ T[base+2] = S5[b(F,i31)] ^ S6[b(F,i32)] ^ S7[b(F,i33)] ^ S8[b(F,i34)] ^ S7[b(F,i35)];\ T[base+3] = S5[b(F,i41)] ^ S6[b(F,i42)] ^ S7[b(F,i43)] ^ S8[b(F,i44)] ^ S8[b(F,i45)]; /* generates sixteen 32-bit subkeys based on a 4x32-bit input key; modifies the input key *in as well. */ static void schedulekeys_half(uint32_t *in, uint32_t *keys) { uint32_t x[4], z[4]; x[0] = in[0]; x[1] = in[1]; x[2] = in[2]; x[3] = in[3]; zxround(); Kround(keys, 0, z, 8, 9, 7, 6, 2, 10, 11, 5, 4, 6, 12, 13, 3, 2, 9, 14, 15, 1, 0, 12); xzround(); Kround(keys, 4, x, 3, 2, 12, 13, 8, 1, 0, 14, 15, 13, 7, 6, 8, 9, 3, 5, 4, 10, 11, 7); zxround(); Kround(keys, 8, z, 3, 2, 12, 13, 9, 1, 0, 14, 15, 12, 7, 6, 8, 9, 2, 5, 4, 10, 11, 6); xzround(); Kround(keys, 12, x, 8, 9, 7, 6, 3, 10, 11, 5, 4, 7, 12, 13, 3, 2, 8, 14, 15, 1, 0, 13); in[0] = x[0]; in[1] = x[1]; in[2] = x[2]; in[3] = x[3]; } /* generates a key schedule from an input key */ static void castschedulekeys(struct block_state *schedule, const uint8_t *key, size_t keybytes) { uint32_t x[4]; uint8_t paddedkey[16]; uint32_t Kr_wide[16]; unsigned i; for(i = 0; i < keybytes; i++) paddedkey[i] = key[i]; for( ; i < 16 ; i++) paddedkey[i] = 0; if (keybytes <= 10) schedule->rounds = 12; else schedule->rounds = 16; x[0] = LOAD_U32_BIG(paddedkey + 0); x[1] = LOAD_U32_BIG(paddedkey + 4); x[2] = LOAD_U32_BIG(paddedkey + 8); x[3] = LOAD_U32_BIG(paddedkey + 12); schedulekeys_half(x, schedule->Km); schedulekeys_half(x, Kr_wide); for(i = 0; i < 16; i ++) { /* The Kr[] subkeys are used for 32-bit circular shifts, so we only need to keep them modulo 32 */ schedule->Kr[i] = (uint8_t)(Kr_wide[i] & 0x1F); } } static int block_init(struct block_state *self, const uint8_t *key, size_t keylength) { /* make sure the key length is within bounds */ if (keylength < 5 || keylength > 16) { return ERR_KEY_SIZE; } /* do the actual key schedule setup */ castschedulekeys(self, key, keylength); return 0; } static void block_finalize(struct block_state* self) { } static void block_encrypt(struct block_state *self, const uint8_t *in, uint8_t *out) { memcpy(out, in, 8); castcrypt(self, out, 0); } static void block_decrypt(struct block_state *self, const uint8_t *in, uint8_t *out) { memcpy(out, in, 8); castcrypt(self, out, 1); } #include "block_common.c"