Пример #1
0
/* Perform the key setup. */
int twofish_setkey(struct crypto_tfm *tfm, const u8 *key, unsigned int key_len)
{

	struct twofish_ctx *ctx = crypto_tfm_ctx(tfm);
	u32 *flags = &tfm->crt_flags;

	int i, j, k;

	/* Temporaries for CALC_K. */
	u32 x, y;

	/* The S vector used to key the S-boxes, split up into individual bytes.
	 * 128-bit keys use only sa through sh; 256-bit use all of them. */
	u8 sa = 0, sb = 0, sc = 0, sd = 0, se = 0, sf = 0, sg = 0, sh = 0;
	u8 si = 0, sj = 0, sk = 0, sl = 0, sm = 0, sn = 0, so = 0, sp = 0;

	/* Temporary for CALC_S. */
	u8 tmp;

	/* Check key length. */
	if (key_len % 8)
	{
		*flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
		return -EINVAL; /* unsupported key length */
	}

	/* Compute the first two words of the S vector.  The magic numbers are
	 * the entries of the RS matrix, preprocessed through poly_to_exp. The
	 * numbers in the comments are the original (polynomial form) matrix
	 * entries. */
	CALC_S (sa, sb, sc, sd, 0, 0x00, 0x2D, 0x01, 0x2D); /* 01 A4 02 A4 */
	CALC_S (sa, sb, sc, sd, 1, 0x2D, 0xA4, 0x44, 0x8A); /* A4 56 A1 55 */
	CALC_S (sa, sb, sc, sd, 2, 0x8A, 0xD5, 0xBF, 0xD1); /* 55 82 FC 87 */
	CALC_S (sa, sb, sc, sd, 3, 0xD1, 0x7F, 0x3D, 0x99); /* 87 F3 C1 5A */
	CALC_S (sa, sb, sc, sd, 4, 0x99, 0x46, 0x66, 0x96); /* 5A 1E 47 58 */
	CALC_S (sa, sb, sc, sd, 5, 0x96, 0x3C, 0x5B, 0xED); /* 58 C6 AE DB */
	CALC_S (sa, sb, sc, sd, 6, 0xED, 0x37, 0x4F, 0xE0); /* DB 68 3D 9E */
	CALC_S (sa, sb, sc, sd, 7, 0xE0, 0xD0, 0x8C, 0x17); /* 9E E5 19 03 */
	CALC_S (se, sf, sg, sh, 8, 0x00, 0x2D, 0x01, 0x2D); /* 01 A4 02 A4 */
	CALC_S (se, sf, sg, sh, 9, 0x2D, 0xA4, 0x44, 0x8A); /* A4 56 A1 55 */
	CALC_S (se, sf, sg, sh, 10, 0x8A, 0xD5, 0xBF, 0xD1); /* 55 82 FC 87 */
	CALC_S (se, sf, sg, sh, 11, 0xD1, 0x7F, 0x3D, 0x99); /* 87 F3 C1 5A */
	CALC_S (se, sf, sg, sh, 12, 0x99, 0x46, 0x66, 0x96); /* 5A 1E 47 58 */
	CALC_S (se, sf, sg, sh, 13, 0x96, 0x3C, 0x5B, 0xED); /* 58 C6 AE DB */
	CALC_S (se, sf, sg, sh, 14, 0xED, 0x37, 0x4F, 0xE0); /* DB 68 3D 9E */
	CALC_S (se, sf, sg, sh, 15, 0xE0, 0xD0, 0x8C, 0x17); /* 9E E5 19 03 */

	if (key_len == 24 || key_len == 32) { /* 192- or 256-bit key */
		/* Calculate the third word of the S vector */
		CALC_S (si, sj, sk, sl, 16, 0x00, 0x2D, 0x01, 0x2D); /* 01 A4 02 A4 */
		CALC_S (si, sj, sk, sl, 17, 0x2D, 0xA4, 0x44, 0x8A); /* A4 56 A1 55 */
		CALC_S (si, sj, sk, sl, 18, 0x8A, 0xD5, 0xBF, 0xD1); /* 55 82 FC 87 */
		CALC_S (si, sj, sk, sl, 19, 0xD1, 0x7F, 0x3D, 0x99); /* 87 F3 C1 5A */
		CALC_S (si, sj, sk, sl, 20, 0x99, 0x46, 0x66, 0x96); /* 5A 1E 47 58 */
		CALC_S (si, sj, sk, sl, 21, 0x96, 0x3C, 0x5B, 0xED); /* 58 C6 AE DB */
		CALC_S (si, sj, sk, sl, 22, 0xED, 0x37, 0x4F, 0xE0); /* DB 68 3D 9E */
		CALC_S (si, sj, sk, sl, 23, 0xE0, 0xD0, 0x8C, 0x17); /* 9E E5 19 03 */
	}

	if (key_len == 32) { /* 256-bit key */
		/* Calculate the fourth word of the S vector */
		CALC_S (sm, sn, so, sp, 24, 0x00, 0x2D, 0x01, 0x2D); /* 01 A4 02 A4 */
		CALC_S (sm, sn, so, sp, 25, 0x2D, 0xA4, 0x44, 0x8A); /* A4 56 A1 55 */
		CALC_S (sm, sn, so, sp, 26, 0x8A, 0xD5, 0xBF, 0xD1); /* 55 82 FC 87 */
		CALC_S (sm, sn, so, sp, 27, 0xD1, 0x7F, 0x3D, 0x99); /* 87 F3 C1 5A */
		CALC_S (sm, sn, so, sp, 28, 0x99, 0x46, 0x66, 0x96); /* 5A 1E 47 58 */
		CALC_S (sm, sn, so, sp, 29, 0x96, 0x3C, 0x5B, 0xED); /* 58 C6 AE DB */
		CALC_S (sm, sn, so, sp, 30, 0xED, 0x37, 0x4F, 0xE0); /* DB 68 3D 9E */
		CALC_S (sm, sn, so, sp, 31, 0xE0, 0xD0, 0x8C, 0x17); /* 9E E5 19 03 */

		/* Compute the S-boxes. */
		for ( i = j = 0, k = 1; i < 256; i++, j += 2, k += 2 ) {
			CALC_SB256_2( i, calc_sb_tbl[j], calc_sb_tbl[k] );
		}

		/* CALC_K256/CALC_K192/CALC_K loops were unrolled.
		 * Unrolling produced x2.5 more code (+18k on i386),
		 * and speeded up key setup by 7%:
		 * unrolled: twofish_setkey/sec: 41128
		 *     loop: twofish_setkey/sec: 38148
		 * CALC_K256: ~100 insns each
		 * CALC_K192: ~90 insns
		 *    CALC_K: ~70 insns
		 */
		/* Calculate whitening and round subkeys */
		for ( i = 0; i < 8; i += 2 ) {
			CALC_K256 (w, i, q0[i], q1[i], q0[i+1], q1[i+1]);
		}
		for ( i = 0; i < 32; i += 2 ) {
			CALC_K256 (k, i, q0[i+8], q1[i+8], q0[i+9], q1[i+9]);
		}
	} else if (key_len == 24) { /* 192-bit key */
		/* Compute the S-boxes. */
		for ( i = j = 0, k = 1; i < 256; i++, j += 2, k += 2 ) {
		        CALC_SB192_2( i, calc_sb_tbl[j], calc_sb_tbl[k] );
		}

		/* Calculate whitening and round subkeys */
		for ( i = 0; i < 8; i += 2 ) {
			CALC_K192 (w, i, q0[i], q1[i], q0[i+1], q1[i+1]);
		}
		for ( i = 0; i < 32; i += 2 ) {
			CALC_K192 (k, i, q0[i+8], q1[i+8], q0[i+9], q1[i+9]);
		}
	} else { /* 128-bit key */
		/* Compute the S-boxes. */
		for ( i = j = 0, k = 1; i < 256; i++, j += 2, k += 2 ) {
			CALC_SB_2( i, calc_sb_tbl[j], calc_sb_tbl[k] );
		}

		/* Calculate whitening and round subkeys */
		for ( i = 0; i < 8; i += 2 ) {
			CALC_K (w, i, q0[i], q1[i], q0[i+1], q1[i+1]);
		}
		for ( i = 0; i < 32; i += 2 ) {
			CALC_K (k, i, q0[i+8], q1[i+8], q0[i+9], q1[i+9]);
		}
	}

	return 0;
}
Пример #2
0
/**
 * @brief Perform the key setup.
 *        Note that this works only with 128- and 256-bit keys, despite the
 *        API that looks like it might support other sizes.
 *
 * @param ctx       pointer to the context that the setup will be executed on
 * @param key       pointer to the key
 * @param keylen    length of the key in bytes
 *
 * @return  -1 if invalid key-length, 0 otherwise
 */
static int twofish_set_key(twofish_context_t *ctx, uint8_t *key, uint8_t keylen)
{
    int i, j, k;

    /* Temporaries for CALC_K. */
    /* cppcheck: used in macros in sys/include/crypto/twofish.h that cppcheck
     * doesn't understand
     */
    /* cppcheck-suppress unusedVariable */
    uint32_t x, y;

    /* The S vector used to key the S-boxes, split up into individual bytes.
     * 128-bit keys use only sa through sh; 256-bit use all of them. */
    uint8_t sa = 0, sb = 0, sc = 0, sd = 0, se = 0, sf = 0, sg = 0, sh = 0;
    /* cppcheck: moving this may introduce timing vulnerability */
    /* cppcheck-suppress variableScope */
    uint8_t si = 0, sj = 0, sk = 0, sl = 0, sm = 0, sn = 0, so = 0, sp = 0;

    /* Temporary for CALC_S. */
    /* cppcheck: used in macros in sys/include/crypto/twofish.h that cppcheck
     * doesn't understand
     */
    /* cppcheck-suppress unusedVariable */
    uint8_t tmp;

    /* Check key length. */
    if (((keylen - 16) | 16) != 16) {
        printf("%-40s: [ERROR] invalid key-length!\r\n", __FUNCTION__);
        return -1;//GPG_ERR_INV_KEYLEN;
    }


    /* Compute the first two words of the S vector.  The magic numbers are
     * the entries of the RS matrix, preprocessed through poly_to_exp. The
     * numbers in the comments are the original (polynomial form) matrix
     * entries. */
    CALC_S(sa, sb, sc, sd, 0, 0x00, 0x2D, 0x01, 0x2D);  /* 01 A4 02 A4 */
    CALC_S(sa, sb, sc, sd, 1, 0x2D, 0xA4, 0x44, 0x8A);  /* A4 56 A1 55 */
    CALC_S(sa, sb, sc, sd, 2, 0x8A, 0xD5, 0xBF, 0xD1);  /* 55 82 FC 87 */
    CALC_S(sa, sb, sc, sd, 3, 0xD1, 0x7F, 0x3D, 0x99);  /* 87 F3 C1 5A */
    CALC_S(sa, sb, sc, sd, 4, 0x99, 0x46, 0x66, 0x96);  /* 5A 1E 47 58 */
    CALC_S(sa, sb, sc, sd, 5, 0x96, 0x3C, 0x5B, 0xED);  /* 58 C6 AE DB */
    CALC_S(sa, sb, sc, sd, 6, 0xED, 0x37, 0x4F, 0xE0);  /* DB 68 3D 9E */
    CALC_S(sa, sb, sc, sd, 7, 0xE0, 0xD0, 0x8C, 0x17);  /* 9E E5 19 03 */
    CALC_S(se, sf, sg, sh, 8, 0x00, 0x2D, 0x01, 0x2D);  /* 01 A4 02 A4 */
    CALC_S(se, sf, sg, sh, 9, 0x2D, 0xA4, 0x44, 0x8A);  /* A4 56 A1 55 */
    CALC_S(se, sf, sg, sh, 10, 0x8A, 0xD5, 0xBF, 0xD1); /* 55 82 FC 87 */
    CALC_S(se, sf, sg, sh, 11, 0xD1, 0x7F, 0x3D, 0x99); /* 87 F3 C1 5A */
    CALC_S(se, sf, sg, sh, 12, 0x99, 0x46, 0x66, 0x96); /* 5A 1E 47 58 */
    CALC_S(se, sf, sg, sh, 13, 0x96, 0x3C, 0x5B, 0xED); /* 58 C6 AE DB */
    CALC_S(se, sf, sg, sh, 14, 0xED, 0x37, 0x4F, 0xE0); /* DB 68 3D 9E */
    CALC_S(se, sf, sg, sh, 15, 0xE0, 0xD0, 0x8C, 0x17); /* 9E E5 19 03 */

    if (keylen == 32) { /* 256-bit key */
        /* Calculate the remaining two words of the S vector */
        CALC_S(si, sj, sk, sl, 16, 0x00, 0x2D, 0x01, 0x2D);  /* 01 A4 02 A4 */
        CALC_S(si, sj, sk, sl, 17, 0x2D, 0xA4, 0x44, 0x8A);  /* A4 56 A1 55 */
        CALC_S(si, sj, sk, sl, 18, 0x8A, 0xD5, 0xBF, 0xD1);  /* 55 82 FC 87 */
        CALC_S(si, sj, sk, sl, 19, 0xD1, 0x7F, 0x3D, 0x99);  /* 87 F3 C1 5A */
        CALC_S(si, sj, sk, sl, 20, 0x99, 0x46, 0x66, 0x96);  /* 5A 1E 47 58 */
        CALC_S(si, sj, sk, sl, 21, 0x96, 0x3C, 0x5B, 0xED);  /* 58 C6 AE DB */
        CALC_S(si, sj, sk, sl, 22, 0xED, 0x37, 0x4F, 0xE0);  /* DB 68 3D 9E */
        CALC_S(si, sj, sk, sl, 23, 0xE0, 0xD0, 0x8C, 0x17);  /* 9E E5 19 03 */
        CALC_S(sm, sn, so, sp, 24, 0x00, 0x2D, 0x01, 0x2D);  /* 01 A4 02 A4 */
        CALC_S(sm, sn, so, sp, 25, 0x2D, 0xA4, 0x44, 0x8A);  /* A4 56 A1 55 */
        CALC_S(sm, sn, so, sp, 26, 0x8A, 0xD5, 0xBF, 0xD1);  /* 55 82 FC 87 */
        CALC_S(sm, sn, so, sp, 27, 0xD1, 0x7F, 0x3D, 0x99);  /* 87 F3 C1 5A */
        CALC_S(sm, sn, so, sp, 28, 0x99, 0x46, 0x66, 0x96);  /* 5A 1E 47 58 */
        CALC_S(sm, sn, so, sp, 29, 0x96, 0x3C, 0x5B, 0xED);  /* 58 C6 AE DB */
        CALC_S(sm, sn, so, sp, 30, 0xED, 0x37, 0x4F, 0xE0);  /* DB 68 3D 9E */
        CALC_S(sm, sn, so, sp, 31, 0xE0, 0xD0, 0x8C, 0x17);  /* 9E E5 19 03 */

        /* Compute the S-boxes. */
        for (i = j = 0, k = 1; i < 256; i++, j += 2, k += 2) {
            CALC_SB256_2(i, calc_sb_tbl[j], calc_sb_tbl[k]);
        }

        /*
         * Calculate whitening and round subkeys. The constants are
         * indices of subkeys, preprocessed through q0 and q1.
         *
         **/
        CALC_K256(w, 0, 0xA9, 0x75, 0x67, 0xF3);
        CALC_K256(w, 2, 0xB3, 0xC6, 0xE8, 0xF4);
        CALC_K256(w, 4, 0x04, 0xDB, 0xFD, 0x7B);
        CALC_K256(w, 6, 0xA3, 0xFB, 0x76, 0xC8);
        CALC_K256(k, 0, 0x9A, 0x4A, 0x92, 0xD3);
        CALC_K256(k, 2, 0x80, 0xE6, 0x78, 0x6B);
        CALC_K256(k, 4, 0xE4, 0x45, 0xDD, 0x7D);
        CALC_K256(k, 6, 0xD1, 0xE8, 0x38, 0x4B);
        CALC_K256(k, 8, 0x0D, 0xD6, 0xC6, 0x32);
        CALC_K256(k, 10, 0x35, 0xD8, 0x98, 0xFD);
        CALC_K256(k, 12, 0x18, 0x37, 0xF7, 0x71);
        CALC_K256(k, 14, 0xEC, 0xF1, 0x6C, 0xE1);
        CALC_K256(k, 16, 0x43, 0x30, 0x75, 0x0F);
        CALC_K256(k, 18, 0x37, 0xF8, 0x26, 0x1B);
        CALC_K256(k, 20, 0xFA, 0x87, 0x13, 0xFA);
        CALC_K256(k, 22, 0x94, 0x06, 0x48, 0x3F);
        CALC_K256(k, 24, 0xF2, 0x5E, 0xD0, 0xBA);
        CALC_K256(k, 26, 0x8B, 0xAE, 0x30, 0x5B);
        CALC_K256(k, 28, 0x84, 0x8A, 0x54, 0x00);
        CALC_K256(k, 30, 0xDF, 0xBC, 0x23, 0x9D);
    }
    else {
        /* Compute the S-boxes. */
        for (i = j = 0, k = 1; i < 256; i++, j += 2, k += 2) {
            CALC_SB_2(i, calc_sb_tbl[j], calc_sb_tbl[k]);
        }

        /*
         * Calculate whitening and round subkeys. The constants are
         * indices of subkeys, preprocessed through q0 and q1.
         **/
        CALC_K(w, 0, 0xA9, 0x75, 0x67, 0xF3);
        CALC_K(w, 2, 0xB3, 0xC6, 0xE8, 0xF4);
        CALC_K(w, 4, 0x04, 0xDB, 0xFD, 0x7B);
        CALC_K(w, 6, 0xA3, 0xFB, 0x76, 0xC8);
        CALC_K(k, 0, 0x9A, 0x4A, 0x92, 0xD3);
        CALC_K(k, 2, 0x80, 0xE6, 0x78, 0x6B);
        CALC_K(k, 4, 0xE4, 0x45, 0xDD, 0x7D);
        CALC_K(k, 6, 0xD1, 0xE8, 0x38, 0x4B);
        CALC_K(k, 8, 0x0D, 0xD6, 0xC6, 0x32);
        CALC_K(k, 10, 0x35, 0xD8, 0x98, 0xFD);
        CALC_K(k, 12, 0x18, 0x37, 0xF7, 0x71);
        CALC_K(k, 14, 0xEC, 0xF1, 0x6C, 0xE1);
        CALC_K(k, 16, 0x43, 0x30, 0x75, 0x0F);
        CALC_K(k, 18, 0x37, 0xF8, 0x26, 0x1B);
        CALC_K(k, 20, 0xFA, 0x87, 0x13, 0xFA);
        CALC_K(k, 22, 0x94, 0x06, 0x48, 0x3F);
        CALC_K(k, 24, 0xF2, 0x5E, 0xD0, 0xBA);
        CALC_K(k, 26, 0x8B, 0xAE, 0x30, 0x5B);
        CALC_K(k, 28, 0x84, 0x8A, 0x54, 0x00);
        CALC_K(k, 30, 0xDF, 0xBC, 0x23, 0x9D);
    }

    return 0;
}
Пример #3
0
static gcry_err_code_t
do_twofish_setkey (TWOFISH_context *ctx, const byte *key, const unsigned keylen)
{
  int i, j, k;

  /* Temporaries for CALC_K. */
  u32 x, y;

  /* The S vector used to key the S-boxes, split up into individual bytes.
   * 128-bit keys use only sa through sh; 256-bit use all of them. */
  byte sa = 0, sb = 0, sc = 0, sd = 0, se = 0, sf = 0, sg = 0, sh = 0;
  byte si = 0, sj = 0, sk = 0, sl = 0, sm = 0, sn = 0, so = 0, sp = 0;
  
  /* Temporary for CALC_S. */
  byte tmp;
  
  /* Flags for self-test. */
  static int initialized = 0;
  static const char *selftest_failed=0;

  /* Check key length. */
  if( ( ( keylen - 16 ) | 16 ) != 16 )
    return GPG_ERR_INV_KEYLEN;

  /* Do self-test if necessary. */
  if (!initialized)
    {
      initialized = 1;
      selftest_failed = selftest ();
      if( selftest_failed )
        log_error("%s\n", selftest_failed );
    }
  if( selftest_failed )
    return GPG_ERR_SELFTEST_FAILED;

  /* Compute the first two words of the S vector.  The magic numbers are
   * the entries of the RS matrix, preprocessed through poly_to_exp.	The
   * numbers in the comments are the original (polynomial form) matrix
   * entries. */
  CALC_S (sa, sb, sc, sd, 0, 0x00, 0x2D, 0x01, 0x2D); /* 01 A4 02 A4 */
  CALC_S (sa, sb, sc, sd, 1, 0x2D, 0xA4, 0x44, 0x8A); /* A4 56 A1 55 */
  CALC_S (sa, sb, sc, sd, 2, 0x8A, 0xD5, 0xBF, 0xD1); /* 55 82 FC 87 */
  CALC_S (sa, sb, sc, sd, 3, 0xD1, 0x7F, 0x3D, 0x99); /* 87 F3 C1 5A */
  CALC_S (sa, sb, sc, sd, 4, 0x99, 0x46, 0x66, 0x96); /* 5A 1E 47 58 */
  CALC_S (sa, sb, sc, sd, 5, 0x96, 0x3C, 0x5B, 0xED); /* 58 C6 AE DB */
  CALC_S (sa, sb, sc, sd, 6, 0xED, 0x37, 0x4F, 0xE0); /* DB 68 3D 9E */
  CALC_S (sa, sb, sc, sd, 7, 0xE0, 0xD0, 0x8C, 0x17); /* 9E E5 19 03 */
  CALC_S (se, sf, sg, sh, 8, 0x00, 0x2D, 0x01, 0x2D); /* 01 A4 02 A4 */
  CALC_S (se, sf, sg, sh, 9, 0x2D, 0xA4, 0x44, 0x8A); /* A4 56 A1 55 */
  CALC_S (se, sf, sg, sh, 10, 0x8A, 0xD5, 0xBF, 0xD1); /* 55 82 FC 87 */
  CALC_S (se, sf, sg, sh, 11, 0xD1, 0x7F, 0x3D, 0x99); /* 87 F3 C1 5A */
  CALC_S (se, sf, sg, sh, 12, 0x99, 0x46, 0x66, 0x96); /* 5A 1E 47 58 */
  CALC_S (se, sf, sg, sh, 13, 0x96, 0x3C, 0x5B, 0xED); /* 58 C6 AE DB */
  CALC_S (se, sf, sg, sh, 14, 0xED, 0x37, 0x4F, 0xE0); /* DB 68 3D 9E */
  CALC_S (se, sf, sg, sh, 15, 0xE0, 0xD0, 0x8C, 0x17); /* 9E E5 19 03 */

  if (keylen == 32)  /* 256-bit key */
    {
      /* Calculate the remaining two words of the S vector */
      CALC_S (si, sj, sk, sl, 16, 0x00, 0x2D, 0x01, 0x2D); /* 01 A4 02 A4 */
      CALC_S (si, sj, sk, sl, 17, 0x2D, 0xA4, 0x44, 0x8A); /* A4 56 A1 55 */
      CALC_S (si, sj, sk, sl, 18, 0x8A, 0xD5, 0xBF, 0xD1); /* 55 82 FC 87 */
      CALC_S (si, sj, sk, sl, 19, 0xD1, 0x7F, 0x3D, 0x99); /* 87 F3 C1 5A */
      CALC_S (si, sj, sk, sl, 20, 0x99, 0x46, 0x66, 0x96); /* 5A 1E 47 58 */
      CALC_S (si, sj, sk, sl, 21, 0x96, 0x3C, 0x5B, 0xED); /* 58 C6 AE DB */
      CALC_S (si, sj, sk, sl, 22, 0xED, 0x37, 0x4F, 0xE0); /* DB 68 3D 9E */
      CALC_S (si, sj, sk, sl, 23, 0xE0, 0xD0, 0x8C, 0x17); /* 9E E5 19 03 */
      CALC_S (sm, sn, so, sp, 24, 0x00, 0x2D, 0x01, 0x2D); /* 01 A4 02 A4 */
      CALC_S (sm, sn, so, sp, 25, 0x2D, 0xA4, 0x44, 0x8A); /* A4 56 A1 55 */
      CALC_S (sm, sn, so, sp, 26, 0x8A, 0xD5, 0xBF, 0xD1); /* 55 82 FC 87 */
      CALC_S (sm, sn, so, sp, 27, 0xD1, 0x7F, 0x3D, 0x99); /* 87 F3 C1 5A */
      CALC_S (sm, sn, so, sp, 28, 0x99, 0x46, 0x66, 0x96); /* 5A 1E 47 58 */
      CALC_S (sm, sn, so, sp, 29, 0x96, 0x3C, 0x5B, 0xED); /* 58 C6 AE DB */
      CALC_S (sm, sn, so, sp, 30, 0xED, 0x37, 0x4F, 0xE0); /* DB 68 3D 9E */
      CALC_S (sm, sn, so, sp, 31, 0xE0, 0xD0, 0x8C, 0x17); /* 9E E5 19 03 */

      /* Compute the S-boxes. */
      for(i=j=0,k=1; i < 256; i++, j += 2, k += 2 )
        {
          CALC_SB256_2( i, calc_sb_tbl[j], calc_sb_tbl[k] );
	}

      /* Calculate whitening and round subkeys.  The constants are
       * indices of subkeys, preprocessed through q0 and q1. */
      CALC_K256 (w, 0, 0xA9, 0x75, 0x67, 0xF3);
      CALC_K256 (w, 2, 0xB3, 0xC6, 0xE8, 0xF4);
      CALC_K256 (w, 4, 0x04, 0xDB, 0xFD, 0x7B);
      CALC_K256 (w, 6, 0xA3, 0xFB, 0x76, 0xC8);
      CALC_K256 (k, 0, 0x9A, 0x4A, 0x92, 0xD3);
      CALC_K256 (k, 2, 0x80, 0xE6, 0x78, 0x6B);
      CALC_K256 (k, 4, 0xE4, 0x45, 0xDD, 0x7D);
      CALC_K256 (k, 6, 0xD1, 0xE8, 0x38, 0x4B);
      CALC_K256 (k, 8, 0x0D, 0xD6, 0xC6, 0x32);
      CALC_K256 (k, 10, 0x35, 0xD8, 0x98, 0xFD);
      CALC_K256 (k, 12, 0x18, 0x37, 0xF7, 0x71);
      CALC_K256 (k, 14, 0xEC, 0xF1, 0x6C, 0xE1);
      CALC_K256 (k, 16, 0x43, 0x30, 0x75, 0x0F);
      CALC_K256 (k, 18, 0x37, 0xF8, 0x26, 0x1B);
      CALC_K256 (k, 20, 0xFA, 0x87, 0x13, 0xFA);
      CALC_K256 (k, 22, 0x94, 0x06, 0x48, 0x3F);
      CALC_K256 (k, 24, 0xF2, 0x5E, 0xD0, 0xBA);
      CALC_K256 (k, 26, 0x8B, 0xAE, 0x30, 0x5B);
      CALC_K256 (k, 28, 0x84, 0x8A, 0x54, 0x00);
      CALC_K256 (k, 30, 0xDF, 0xBC, 0x23, 0x9D);
    }
  else 
    {
      /* Compute the S-boxes. */
      for(i=j=0,k=1; i < 256; i++, j += 2, k += 2 )
        {
          CALC_SB_2( i, calc_sb_tbl[j], calc_sb_tbl[k] );
        }

      /* Calculate whitening and round subkeys.  The constants are
       * indices of subkeys, preprocessed through q0 and q1. */
      CALC_K (w, 0, 0xA9, 0x75, 0x67, 0xF3);
      CALC_K (w, 2, 0xB3, 0xC6, 0xE8, 0xF4);
      CALC_K (w, 4, 0x04, 0xDB, 0xFD, 0x7B);
      CALC_K (w, 6, 0xA3, 0xFB, 0x76, 0xC8);
      CALC_K (k, 0, 0x9A, 0x4A, 0x92, 0xD3);
      CALC_K (k, 2, 0x80, 0xE6, 0x78, 0x6B);
      CALC_K (k, 4, 0xE4, 0x45, 0xDD, 0x7D);
      CALC_K (k, 6, 0xD1, 0xE8, 0x38, 0x4B);
      CALC_K (k, 8, 0x0D, 0xD6, 0xC6, 0x32);
      CALC_K (k, 10, 0x35, 0xD8, 0x98, 0xFD);
      CALC_K (k, 12, 0x18, 0x37, 0xF7, 0x71);
      CALC_K (k, 14, 0xEC, 0xF1, 0x6C, 0xE1);
      CALC_K (k, 16, 0x43, 0x30, 0x75, 0x0F);
      CALC_K (k, 18, 0x37, 0xF8, 0x26, 0x1B);
      CALC_K (k, 20, 0xFA, 0x87, 0x13, 0xFA);
      CALC_K (k, 22, 0x94, 0x06, 0x48, 0x3F);
      CALC_K (k, 24, 0xF2, 0x5E, 0xD0, 0xBA);
      CALC_K (k, 26, 0x8B, 0xAE, 0x30, 0x5B);
      CALC_K (k, 28, 0x84, 0x8A, 0x54, 0x00);
      CALC_K (k, 30, 0xDF, 0xBC, 0x23, 0x9D);
    }

  return 0;
}
Пример #4
0
/* Perform the key setup. */
static int twofish_setkey(void *cx, const u8 *key,
                          unsigned int key_len, u32 *flags)
{
	
	struct twofish_ctx *ctx = cx;

	int i, j, k;

	/* Temporaries for CALC_K. */
	u32 x, y;

	/* The S vector used to key the S-boxes, split up into individual bytes.
	 * 128-bit keys use only sa through sh; 256-bit use all of them. */
	u8 sa = 0, sb = 0, sc = 0, sd = 0, se = 0, sf = 0, sg = 0, sh = 0;
	u8 si = 0, sj = 0, sk = 0, sl = 0, sm = 0, sn = 0, so = 0, sp = 0;

	/* Temporary for CALC_S. */
	u8 tmp;

	/* Check key length. */
	if (key_len != 16 && key_len != 24 && key_len != 32)
		return -EINVAL; /* unsupported key length */

	/* Compute the first two words of the S vector.  The magic numbers are
	 * the entries of the RS matrix, preprocessed through poly_to_exp. The
	 * numbers in the comments are the original (polynomial form) matrix
	 * entries. */
	CALC_S (sa, sb, sc, sd, 0, 0x00, 0x2D, 0x01, 0x2D); /* 01 A4 02 A4 */
	CALC_S (sa, sb, sc, sd, 1, 0x2D, 0xA4, 0x44, 0x8A); /* A4 56 A1 55 */
	CALC_S (sa, sb, sc, sd, 2, 0x8A, 0xD5, 0xBF, 0xD1); /* 55 82 FC 87 */
	CALC_S (sa, sb, sc, sd, 3, 0xD1, 0x7F, 0x3D, 0x99); /* 87 F3 C1 5A */
	CALC_S (sa, sb, sc, sd, 4, 0x99, 0x46, 0x66, 0x96); /* 5A 1E 47 58 */
	CALC_S (sa, sb, sc, sd, 5, 0x96, 0x3C, 0x5B, 0xED); /* 58 C6 AE DB */
	CALC_S (sa, sb, sc, sd, 6, 0xED, 0x37, 0x4F, 0xE0); /* DB 68 3D 9E */
	CALC_S (sa, sb, sc, sd, 7, 0xE0, 0xD0, 0x8C, 0x17); /* 9E E5 19 03 */
	CALC_S (se, sf, sg, sh, 8, 0x00, 0x2D, 0x01, 0x2D); /* 01 A4 02 A4 */
	CALC_S (se, sf, sg, sh, 9, 0x2D, 0xA4, 0x44, 0x8A); /* A4 56 A1 55 */
	CALC_S (se, sf, sg, sh, 10, 0x8A, 0xD5, 0xBF, 0xD1); /* 55 82 FC 87 */
	CALC_S (se, sf, sg, sh, 11, 0xD1, 0x7F, 0x3D, 0x99); /* 87 F3 C1 5A */
	CALC_S (se, sf, sg, sh, 12, 0x99, 0x46, 0x66, 0x96); /* 5A 1E 47 58 */
	CALC_S (se, sf, sg, sh, 13, 0x96, 0x3C, 0x5B, 0xED); /* 58 C6 AE DB */
	CALC_S (se, sf, sg, sh, 14, 0xED, 0x37, 0x4F, 0xE0); /* DB 68 3D 9E */
	CALC_S (se, sf, sg, sh, 15, 0xE0, 0xD0, 0x8C, 0x17); /* 9E E5 19 03 */

	if (key_len == 24 || key_len == 32) { /* 192- or 256-bit key */
		/* Calculate the third word of the S vector */
		CALC_S (si, sj, sk, sl, 16, 0x00, 0x2D, 0x01, 0x2D); /* 01 A4 02 A4 */
		CALC_S (si, sj, sk, sl, 17, 0x2D, 0xA4, 0x44, 0x8A); /* A4 56 A1 55 */
		CALC_S (si, sj, sk, sl, 18, 0x8A, 0xD5, 0xBF, 0xD1); /* 55 82 FC 87 */
		CALC_S (si, sj, sk, sl, 19, 0xD1, 0x7F, 0x3D, 0x99); /* 87 F3 C1 5A */
		CALC_S (si, sj, sk, sl, 20, 0x99, 0x46, 0x66, 0x96); /* 5A 1E 47 58 */
		CALC_S (si, sj, sk, sl, 21, 0x96, 0x3C, 0x5B, 0xED); /* 58 C6 AE DB */
		CALC_S (si, sj, sk, sl, 22, 0xED, 0x37, 0x4F, 0xE0); /* DB 68 3D 9E */
		CALC_S (si, sj, sk, sl, 23, 0xE0, 0xD0, 0x8C, 0x17); /* 9E E5 19 03 */
	}

	if (key_len == 32) { /* 256-bit key */
		/* Calculate the fourth word of the S vector */
		CALC_S (sm, sn, so, sp, 24, 0x00, 0x2D, 0x01, 0x2D); /* 01 A4 02 A4 */
		CALC_S (sm, sn, so, sp, 25, 0x2D, 0xA4, 0x44, 0x8A); /* A4 56 A1 55 */
		CALC_S (sm, sn, so, sp, 26, 0x8A, 0xD5, 0xBF, 0xD1); /* 55 82 FC 87 */
		CALC_S (sm, sn, so, sp, 27, 0xD1, 0x7F, 0x3D, 0x99); /* 87 F3 C1 5A */
		CALC_S (sm, sn, so, sp, 28, 0x99, 0x46, 0x66, 0x96); /* 5A 1E 47 58 */
		CALC_S (sm, sn, so, sp, 29, 0x96, 0x3C, 0x5B, 0xED); /* 58 C6 AE DB */
		CALC_S (sm, sn, so, sp, 30, 0xED, 0x37, 0x4F, 0xE0); /* DB 68 3D 9E */
		CALC_S (sm, sn, so, sp, 31, 0xE0, 0xD0, 0x8C, 0x17); /* 9E E5 19 03 */

		/* Compute the S-boxes. */
		for ( i = j = 0, k = 1; i < 256; i++, j += 2, k += 2 ) {
			CALC_SB256_2( i, calc_sb_tbl[j], calc_sb_tbl[k] );
		}

		/* Calculate whitening and round subkeys.  The constants are
		 * indices of subkeys, preprocessed through q0 and q1. */
		CALC_K256 (w, 0, 0xA9, 0x75, 0x67, 0xF3);
		CALC_K256 (w, 2, 0xB3, 0xC6, 0xE8, 0xF4);
		CALC_K256 (w, 4, 0x04, 0xDB, 0xFD, 0x7B);
		CALC_K256 (w, 6, 0xA3, 0xFB, 0x76, 0xC8);
		CALC_K256 (k, 0, 0x9A, 0x4A, 0x92, 0xD3);
		CALC_K256 (k, 2, 0x80, 0xE6, 0x78, 0x6B);
		CALC_K256 (k, 4, 0xE4, 0x45, 0xDD, 0x7D);
		CALC_K256 (k, 6, 0xD1, 0xE8, 0x38, 0x4B);
		CALC_K256 (k, 8, 0x0D, 0xD6, 0xC6, 0x32);
		CALC_K256 (k, 10, 0x35, 0xD8, 0x98, 0xFD);
		CALC_K256 (k, 12, 0x18, 0x37, 0xF7, 0x71);
		CALC_K256 (k, 14, 0xEC, 0xF1, 0x6C, 0xE1);
		CALC_K256 (k, 16, 0x43, 0x30, 0x75, 0x0F);
		CALC_K256 (k, 18, 0x37, 0xF8, 0x26, 0x1B);
		CALC_K256 (k, 20, 0xFA, 0x87, 0x13, 0xFA);
		CALC_K256 (k, 22, 0x94, 0x06, 0x48, 0x3F);
		CALC_K256 (k, 24, 0xF2, 0x5E, 0xD0, 0xBA);
		CALC_K256 (k, 26, 0x8B, 0xAE, 0x30, 0x5B);
		CALC_K256 (k, 28, 0x84, 0x8A, 0x54, 0x00);
		CALC_K256 (k, 30, 0xDF, 0xBC, 0x23, 0x9D);
	} else if (key_len == 24) { /* 192-bit key */
		/* Compute the S-boxes. */
		for ( i = j = 0, k = 1; i < 256; i++, j += 2, k += 2 ) {
		        CALC_SB192_2( i, calc_sb_tbl[j], calc_sb_tbl[k] );
		}

		/* Calculate whitening and round subkeys.  The constants are
		 * indices of subkeys, preprocessed through q0 and q1. */
		CALC_K192 (w, 0, 0xA9, 0x75, 0x67, 0xF3);
		CALC_K192 (w, 2, 0xB3, 0xC6, 0xE8, 0xF4);
		CALC_K192 (w, 4, 0x04, 0xDB, 0xFD, 0x7B);
		CALC_K192 (w, 6, 0xA3, 0xFB, 0x76, 0xC8);
		CALC_K192 (k, 0, 0x9A, 0x4A, 0x92, 0xD3);
		CALC_K192 (k, 2, 0x80, 0xE6, 0x78, 0x6B);
		CALC_K192 (k, 4, 0xE4, 0x45, 0xDD, 0x7D);
		CALC_K192 (k, 6, 0xD1, 0xE8, 0x38, 0x4B);
		CALC_K192 (k, 8, 0x0D, 0xD6, 0xC6, 0x32);
		CALC_K192 (k, 10, 0x35, 0xD8, 0x98, 0xFD);
		CALC_K192 (k, 12, 0x18, 0x37, 0xF7, 0x71);
		CALC_K192 (k, 14, 0xEC, 0xF1, 0x6C, 0xE1);
		CALC_K192 (k, 16, 0x43, 0x30, 0x75, 0x0F);
		CALC_K192 (k, 18, 0x37, 0xF8, 0x26, 0x1B);
		CALC_K192 (k, 20, 0xFA, 0x87, 0x13, 0xFA);
		CALC_K192 (k, 22, 0x94, 0x06, 0x48, 0x3F);
		CALC_K192 (k, 24, 0xF2, 0x5E, 0xD0, 0xBA);
		CALC_K192 (k, 26, 0x8B, 0xAE, 0x30, 0x5B);
		CALC_K192 (k, 28, 0x84, 0x8A, 0x54, 0x00);
		CALC_K192 (k, 30, 0xDF, 0xBC, 0x23, 0x9D);
	} else { /* 128-bit key */
		/* Compute the S-boxes. */
		for ( i = j = 0, k = 1; i < 256; i++, j += 2, k += 2 ) {
			CALC_SB_2( i, calc_sb_tbl[j], calc_sb_tbl[k] );
		}

		/* Calculate whitening and round subkeys.  The constants are
		 * indices of subkeys, preprocessed through q0 and q1. */
		CALC_K (w, 0, 0xA9, 0x75, 0x67, 0xF3);
		CALC_K (w, 2, 0xB3, 0xC6, 0xE8, 0xF4);
		CALC_K (w, 4, 0x04, 0xDB, 0xFD, 0x7B);
		CALC_K (w, 6, 0xA3, 0xFB, 0x76, 0xC8);
		CALC_K (k, 0, 0x9A, 0x4A, 0x92, 0xD3);
		CALC_K (k, 2, 0x80, 0xE6, 0x78, 0x6B);
		CALC_K (k, 4, 0xE4, 0x45, 0xDD, 0x7D);
		CALC_K (k, 6, 0xD1, 0xE8, 0x38, 0x4B);
		CALC_K (k, 8, 0x0D, 0xD6, 0xC6, 0x32);
		CALC_K (k, 10, 0x35, 0xD8, 0x98, 0xFD);
		CALC_K (k, 12, 0x18, 0x37, 0xF7, 0x71);
		CALC_K (k, 14, 0xEC, 0xF1, 0x6C, 0xE1);
		CALC_K (k, 16, 0x43, 0x30, 0x75, 0x0F);
		CALC_K (k, 18, 0x37, 0xF8, 0x26, 0x1B);
		CALC_K (k, 20, 0xFA, 0x87, 0x13, 0xFA);
		CALC_K (k, 22, 0x94, 0x06, 0x48, 0x3F);
		CALC_K (k, 24, 0xF2, 0x5E, 0xD0, 0xBA);
		CALC_K (k, 26, 0x8B, 0xAE, 0x30, 0x5B);
		CALC_K (k, 28, 0x84, 0x8A, 0x54, 0x00);
		CALC_K (k, 30, 0xDF, 0xBC, 0x23, 0x9D);
	}

	return 0;
}