diff options
| -rw-r--r-- | .gitmodules | 3 | ||||
| -rw-r--r-- | Makefile | 10 | ||||
| -rw-r--r-- | README | 27 | ||||
| m--------- | chacha-opt | 0 | ||||
| -rw-r--r-- | rdd.1 | 27 | ||||
| -rw-r--r-- | rdd.c | 28 | ||||
| -rw-r--r-- | sosemanuk.c | 1283 | ||||
| -rw-r--r-- | sosemanuk.h | 176 |
8 files changed, 41 insertions, 1513 deletions
diff --git a/.gitmodules b/.gitmodules new file mode 100644 index 0000000..bb70641 --- /dev/null +++ b/.gitmodules @@ -0,0 +1,3 @@ +[submodule "chacha-opt"] + path = chacha-opt + url = https://github.com/floodyberry/chacha-opt diff --git a/Makefile b/Makefile index ea91cfa..f172b30 100644 --- a/Makefile +++ b/Makefile @@ -1,19 +1,23 @@ ALL=rdd CFLAGS=-g -O3 -Wall -Wno-switch -Wextra -Wwrite-strings +CPPFLAGS=-I./chacha-opt/app/include DESTDIR= PREFIX=/usr/local BINDIR=$(PREFIX)/bin MANDIR=$(PREFIX)/share/man -all: $(ALL) +all: $(ALL) chacha-opt/bin/chacha.lib clean: FRC rm -f $(ALL) *.o + make -C chacha-opt clean -rdd: sosemanuk.o rdd.o -rdd.c: sosemanuk.h +rdd: rdd.o chacha-opt/bin/chacha.lib + +chacha-opt/bin/chacha.lib: + cd chacha-opt && ./configure && make install: FRC all mkdir -p $(DESTDIR)$(BINDIR) $(DESTDIR)$(MANDIR)/man1 $(DESTDIR)$(ZSHCOMPDIR) diff --git a/README b/README index d18358f..d91c6c8 100644 --- a/README +++ b/README @@ -8,10 +8,10 @@ SYNOPSIS DESCRIPTION rdd is a high-speed, cryptographically safe random data generator using - the reference implementation of the eSTREAM Profile 1 SOSEMANUK stream - cipher. It is designed to fill crypto devices with random data. + optimized versions of the ChaCha8 stream cipher, depending on your CPU. + It is designed to fill crypto devices with random data. - Random binary data is outputted to standard output. + Random binary data is written to standard output. The options are as follows: @@ -30,11 +30,11 @@ SEE ALSO dd(1), random(4), random(7) NOTES - rdd reads 32 random bytes for the initial key and 16 bytes for every + rdd reads 40 random bytes for the initial key and 32 bytes for every rekeying from the random source. Setting rekeymb to -1 never rekeys. This implementation passed dieharder 3.31.1 "-a" and PractRand/RNG_test - 0.93 (tested up to 32 TB). + 0.95 (tested up to 32 TB). AUTHORS Leah Neukirchen <leah@vuxu.org> @@ -45,19 +45,8 @@ LICENSE To the extent possible under law, the creator of this work has waived all copyright and related or neighboring rights to this work. - http://creativecommons.org/publicdomain/zero/1.0/ + http://creativecommons.org/publicdomain/zero/1.0/ - This program includes code taken from - http://www.ecrypt.eu.org/stream/p3ciphers/sosemanuk/sosemanuk_p3source.zip - as of 2013-04-13. An error message which can never occur in rdd usage - has been #ifdef'ed out. + This program uses the public domain library chacha-opt. - © 2005 X-CRYPT project. This software is provided 'as-is', without any - express or implied warranty. In no event will the authors be held liable - for any damages arising from the use of this software. - - Permission is granted to anyone to use this software for any purpose, - including commercial applications, and to alter it and redistribute it - freely, subject to no restriction. - -Void Linux January 3, 2018 Void Linux +Void Linux April 19, 2020 Void Linux diff --git a/chacha-opt b/chacha-opt new file mode 160000 +Subproject d69e5acbc632ded477fa7056564c8a830c457de diff --git a/rdd.1 b/rdd.1 index a9b7364..d5012ab 100644 --- a/rdd.1 +++ b/rdd.1 @@ -1,4 +1,4 @@ -.Dd January 3, 2018 +.Dd April 19, 2020 .Dt RDD 1 .Os .Sh NAME @@ -12,11 +12,11 @@ .Sh DESCRIPTION .Nm is a high-speed, cryptographically safe random data generator -using the reference implementation of the eSTREAM Profile 1 SOSEMANUK -stream cipher. +using optimized versions of the ChaCha8 stream cipher, +depending on your CPU. It is designed to fill crypto devices with random data. .Pp -Random binary data is outputted to standard output. +Random binary data is written to standard output. .Pp The options are as follows: .Bl -tag -width Ds @@ -41,14 +41,14 @@ to standard error on every rekey. .Xr random 4 , .Xr random 7 .Sh NOTES -rdd reads 32 random bytes for the initial key and 16 bytes for every rekeying +rdd reads 40 random bytes for the initial key and 32 bytes for every rekeying from the random source. Setting .Ar rekeymb to -1 never rekeys. .Pp This implementation passed dieharder 3.31.1 "-a" and -PractRand/RNG_test 0.93 (tested up to 32 TB). +PractRand/RNG_test 0.95 (tested up to 32 TB). .Sh AUTHORS .An Leah Neukirchen Aq Mt leah@vuxu.org .Sh LICENSE @@ -62,17 +62,4 @@ neighboring rights to this work. .Pp .Lk http://creativecommons.org/publicdomain/zero/1.0/ .Pp -This program includes code taken from -.Lk http://www.ecrypt.eu.org/stream/p3ciphers/sosemanuk/sosemanuk_p3source.zip -as of 2013-04-13. -An error message which can never occur in rdd usage -has been #ifdef'ed out. -.Pp -\[co] 2005 X-CRYPT project. -This software is provided 'as-is', without any express or implied warranty. -In no event will the authors be held liable for any damages arising -from the use of this software. -.Pp -Permission is granted to anyone to use this software for any purpose, -including commercial applications, and to alter it and redistribute it -freely, subject to no restriction. +This program uses the public domain library chacha-opt. diff --git a/rdd.c b/rdd.c index c1ed8d6..8f0af11 100644 --- a/rdd.c +++ b/rdd.c @@ -5,16 +5,17 @@ #include <stdlib.h> #include <unistd.h> -#include "sosemanuk.h" +#include "chacha.h" #define fail(i, s) write(2, "rdd: " s, 5+(sizeof s)-1), exit(i); int main(int argc, char *argv[]) { - unsigned char key[32], iv[16], buf[120*512]; - sosemanuk_key_context kc; - sosemanuk_run_context rc; + chacha_state state; + chacha_key key; + chacha_iv iv; + unsigned char buf[16*4096]; int fd, c, v = 0; long i, r = 4; @@ -33,28 +34,31 @@ usage: if (argc > optind) goto usage; + if (chacha_startup() != 0) + fail(255, "self-test failed\n"); + if (isatty(1)) fail(5, "cowardly not dumping random data to tty\n"); if ((fd = open(src, O_RDONLY)) < 0) fail(2, "failed to open random source\n"); - if (read(fd, key, sizeof key) != sizeof key) - fail(3, "failed to read key from random source\n"); - sosemanuk_schedule(&kc, key, sizeof key); + if (read(fd, iv.b, sizeof iv.b) != sizeof iv.b) + fail(3, "failed to read iv from random source\n"); while (1) { - if (read(fd, iv, sizeof iv) != sizeof iv) - fail(3, "failed to read iv from random source\n"); - sosemanuk_init(&rc, &kc, iv, sizeof iv); + if (read(fd, key.b, sizeof key.b) != sizeof key.b) + fail(3, "failed to read key from random source\n"); + chacha_init(&state, &key, &iv, 8); + if (v) write(2, ".", 1); for (i = 0; r < 0 || i < r*1024*1024; i += sizeof buf) { - sosemanuk_prng(&rc, buf, sizeof buf); + chacha_update(&state, 0, buf, sizeof buf); while (write(1, buf, sizeof buf) != sizeof buf) if (errno) { - if (errno == ENOSPC) + if (errno == ENOSPC || errno == EPIPE) exit(0); if (errno != EINTR) fail(4, "write error\n"); diff --git a/sosemanuk.c b/sosemanuk.c deleted file mode 100644 index 033ea53..0000000 --- a/sosemanuk.c +++ /dev/null @@ -1,1283 +0,0 @@ -/* - * SOSEMANUK reference implementation. - * - * This code is supposed to run on any conforming C implementation (C90 - * or later). When compiled with the SOSEMANUK_VECTOR macro defined, this - * is a stand-alone program which outputs detailed test vectors. When - * compiled with the SOSEMANUK_SPEED macro defined, this is a stand-alone - * program which performs an implementation speed measure. - * - * (c) 2005 X-CRYPT project. This software is provided 'as-is', without - * any express or implied warranty. In no event will the authors be held - * liable for any damages arising from the use of this software. - * - * Permission is granted to anyone to use this software for any purpose, - * including commercial applications, and to alter it and redistribute it - * freely, subject to no restriction. - * - * Technical remarks and questions can be addressed to - * <thomas.pornin@cryptolog.com> - */ - -#include <stdio.h> -#include <stdlib.h> -#include <string.h> -#ifdef SOSEMANUK_SPEED -#include <time.h> -#endif - -#include "sosemanuk.h" - -/* ======================================================================== */ - -#ifdef SOSEMANUK_ECRYPT - -/* - * No local speed testing when using the ECRYPT mode. - */ -#undef SOSEMANUK_SPEED - -/* - * If we are using the ECRYPT API, then we rely on the ECRYPT portability - * macros and types. - */ - -#define unum32 u32 -#define T32(x) U32V(x) - -#define decode32le(data) U8TO32_LITTLE(data) -#define encode32le(dst, val) do { \ - u8 *encode_dst = (dst); \ - u32 encode_val = (val); \ - U32TO8_LITTLE(encode_dst, encode_val); \ - } while (0) - -#define ROTL(x, n) ROTL32(x, n) -#define INLINE - -#else - -/* - * 32-bit data decoding, little endian. - */ -static INLINE unum32 -decode32le(unsigned char *data) -{ -#ifdef __i386 - /* - * On i386, we prefer accessing data directly. Unaligned accesses - * imply only a one-cycle penalty; even with that penalty, this - * method is quite faster than the generic one. Note that i486 - * and later may be set in a mode where unaligned access trigger - * exceptions; but such a mode is not compatible with usual ABI - * (which require only 4-byte alignment for "double" and "long - * double", hence operating systems do not set that "alignment - * check" flag. - * - * If this optimized access proves to be a problem, replace the - * test above by "#if 0". - */ - return *(unum32 *)data; -#else - return (unum32)data[0] - | ((unum32)data[1] << 8) - | ((unum32)data[2] << 16) - | ((unum32)data[3] << 24); -#endif -} - -/* - * 32-bit data encoding, little-endian. - */ -static INLINE void -encode32le(unsigned char *dst, unum32 val) -{ -#ifdef __i386__ - /* - * Optimized version for i386. See comments in decode32le(). - */ - *(unum32 *)dst = val; -#else - dst[0] = val & 0xFF; - dst[1] = (val >> 8) & 0xFF; - dst[2] = (val >> 16) & 0xFF; - dst[3] = (val >> 24) & 0xFF; -#endif -} - -/* - * Left-rotation by n bits (0 < n < 32). - */ -#define ROTL(x, n) (T32(((x) << (n)) | T32((x) >> (32 - (n))))) - -#endif - -/* ======================================================================== */ - -/* - * Serpent S-boxes, implemented in bitslice mode. These circuits have - * been published by Dag Arne Osvik ("Speeding up Serpent", published in - * the 3rd AES Candidate Conference) and work on five 32-bit registers: - * the four inputs, and a fifth scratch register. There are meant to be - * quite fast on Pentium-class processors. These are not the fastest - * published, but they are "fast enough" and they are unencumbered as - * far as intellectual property is concerned (note: these are rewritten - * from the article itself, and hence are not covered by the GPL on - * Dag's code, which was not used here). - * - * The output bits are permuted. Here is the correspondance: - * S0: 1420 - * S1: 2031 - * S2: 2314 - * S3: 1234 - * S4: 1403 - * S5: 1302 - * S6: 0142 - * S7: 4310 - * (for instance, the output of S0 is in "r1, r4, r2, r0"). - */ - -#define S0(r0, r1, r2, r3, r4) do { \ - r3 ^= r0; r4 = r1; \ - r1 &= r3; r4 ^= r2; \ - r1 ^= r0; r0 |= r3; \ - r0 ^= r4; r4 ^= r3; \ - r3 ^= r2; r2 |= r1; \ - r2 ^= r4; r4 = ~r4; \ - r4 |= r1; r1 ^= r3; \ - r1 ^= r4; r3 |= r0; \ - r1 ^= r3; r4 ^= r3; \ - } while (0) - -#define S1(r0, r1, r2, r3, r4) do { \ - r0 = ~r0; r2 = ~r2; \ - r4 = r0; r0 &= r1; \ - r2 ^= r0; r0 |= r3; \ - r3 ^= r2; r1 ^= r0; \ - r0 ^= r4; r4 |= r1; \ - r1 ^= r3; r2 |= r0; \ - r2 &= r4; r0 ^= r1; \ - r1 &= r2; \ - r1 ^= r0; r0 &= r2; \ - r0 ^= r4; \ - } while (0) - -#define S2(r0, r1, r2, r3, r4) do { \ - r4 = r0; r0 &= r2; \ - r0 ^= r3; r2 ^= r1; \ - r2 ^= r0; r3 |= r4; \ - r3 ^= r1; r4 ^= r2; \ - r1 = r3; r3 |= r4; \ - r3 ^= r0; r0 &= r1; \ - r4 ^= r0; r1 ^= r3; \ - r1 ^= r4; r4 = ~r4; \ - } while (0) - -#define S3(r0, r1, r2, r3, r4) do { \ - r4 = r0; r0 |= r3; \ - r3 ^= r1; r1 &= r4; \ - r4 ^= r2; r2 ^= r3; \ - r3 &= r0; r4 |= r1; \ - r3 ^= r4; r0 ^= r1; \ - r4 &= r0; r1 ^= r3; \ - r4 ^= r2; r1 |= r0; \ - r1 ^= r2; r0 ^= r3; \ - r2 = r1; r1 |= r3; \ - r1 ^= r0; \ - } while (0) - -#define S4(r0, r1, r2, r3, r4) do { \ - r1 ^= r3; r3 = ~r3; \ - r2 ^= r3; r3 ^= r0; \ - r4 = r1; r1 &= r3; \ - r1 ^= r2; r4 ^= r3; \ - r0 ^= r4; r2 &= r4; \ - r2 ^= r0; r0 &= r1; \ - r3 ^= r0; r4 |= r1; \ - r4 ^= r0; r0 |= r3; \ - r0 ^= r2; r2 &= r3; \ - r0 = ~r0; r4 ^= r2; \ - } while (0) - -#define S5(r0, r1, r2, r3, r4) do { \ - r0 ^= r1; r1 ^= r3; \ - r3 = ~r3; r4 = r1; \ - r1 &= r0; r2 ^= r3; \ - r1 ^= r2; r2 |= r4; \ - r4 ^= r3; r3 &= r1; \ - r3 ^= r0; r4 ^= r1; \ - r4 ^= r2; r2 ^= r0; \ - r0 &= r3; r2 = ~r2; \ - r0 ^= r4; r4 |= r3; \ - r2 ^= r4; \ - } while (0) - -#define S6(r0, r1, r2, r3, r4) do { \ - r2 = ~r2; r4 = r3; \ - r3 &= r0; r0 ^= r4; \ - r3 ^= r2; r2 |= r4; \ - r1 ^= r3; r2 ^= r0; \ - r0 |= r1; r2 ^= r1; \ - r4 ^= r0; r0 |= r3; \ - r0 ^= r2; r4 ^= r3; \ - r4 ^= r0; r3 = ~r3; \ - r2 &= r4; \ - r2 ^= r3; \ - } while (0) - -#define S7(r0, r1, r2, r3, r4) do { \ - r4 = r1; r1 |= r2; \ - r1 ^= r3; r4 ^= r2; \ - r2 ^= r1; r3 |= r4; \ - r3 &= r0; r4 ^= r2; \ - r3 ^= r1; r1 |= r4; \ - r1 ^= r0; r0 |= r4; \ - r0 ^= r2; r1 ^= r4; \ - r2 ^= r1; r1 &= r0; \ - r1 ^= r4; r2 = ~r2; \ - r2 |= r0; \ - r4 ^= r2; \ - } while (0) - -/* - * The Serpent linear transform. - */ -#define SERPENT_LT(x0, x1, x2, x3) do { \ - x0 = ROTL(x0, 13); \ - x2 = ROTL(x2, 3); \ - x1 = x1 ^ x0 ^ x2; \ - x3 = x3 ^ x2 ^ T32(x0 << 3); \ - x1 = ROTL(x1, 1); \ - x3 = ROTL(x3, 7); \ - x0 = x0 ^ x1 ^ x3; \ - x2 = x2 ^ x3 ^ T32(x1 << 7); \ - x0 = ROTL(x0, 5); \ - x2 = ROTL(x2, 22); \ - } while (0) - -/* ======================================================================== */ - -#ifdef SOSEMANUK_ECRYPT -void -ECRYPT_init(void) -{ - return; -} -#endif - -#ifdef SOSEMANUK_ECRYPT -void -ECRYPT_keysetup(ECRYPT_ctx *kc, const u8 *key, u32 keysize, u32 ivsize) -#else -/* see sosemanuk.h */ -void -sosemanuk_schedule(sosemanuk_key_context *kc, - unsigned char *key, size_t key_len) -#endif -{ - /* - * This key schedule is actually a truncated Serpent key schedule. - * The key-derived words (w_i) are computed within the eight - * local variables w0 to w7, which are reused again and again. - */ - -#define SKS(S, o0, o1, o2, o3, d0, d1, d2, d3) do { \ - unum32 r0, r1, r2, r3, r4; \ - r0 = w ## o0; \ - r1 = w ## o1; \ - r2 = w ## o2; \ - r3 = w ## o3; \ - S(r0, r1, r2, r3, r4); \ - kc->sk[i ++] = r ## d0; \ - kc->sk[i ++] = r ## d1; \ - kc->sk[i ++] = r ## d2; \ - kc->sk[i ++] = r ## d3; \ - } while (0) - -#define SKS0 SKS(S0, 4, 5, 6, 7, 1, 4, 2, 0) -#define SKS1 SKS(S1, 0, 1, 2, 3, 2, 0, 3, 1) -#define SKS2 SKS(S2, 4, 5, 6, 7, 2, 3, 1, 4) -#define SKS3 SKS(S3, 0, 1, 2, 3, 1, 2, 3, 4) -#define SKS4 SKS(S4, 4, 5, 6, 7, 1, 4, 0, 3) -#define SKS5 SKS(S5, 0, 1, 2, 3, 1, 3, 0, 2) -#define SKS6 SKS(S6, 4, 5, 6, 7, 0, 1, 4, 2) -#define SKS7 SKS(S7, 0, 1, 2, 3, 4, 3, 1, 0) - -#define WUP(wi, wi5, wi3, wi1, cc) do { \ - unum32 tt = (wi) ^ (wi5) ^ (wi3) \ - ^ (wi1) ^ (0x9E3779B9 ^ (unum32)(cc)); \ - (wi) = ROTL(tt, 11); \ - } while (0) - -#define WUP0(cc) do { \ - WUP(w0, w3, w5, w7, cc); \ - WUP(w1, w4, w6, w0, cc + 1); \ - WUP(w2, w5, w7, w1, cc + 2); \ - WUP(w3, w6, w0, w2, cc + 3); \ - } while (0) - -#define WUP1(cc) do { \ - WUP(w4, w7, w1, w3, cc); \ - WUP(w5, w0, w2, w4, cc + 1); \ - WUP(w6, w1, w3, w5, cc + 2); \ - WUP(w7, w2, w4, w6, cc + 3); \ - } while (0) - - unsigned char wbuf[32]; - register unum32 w0, w1, w2, w3, w4, w5, w6, w7; - int i = 0; -#ifdef SOSEMANUK_ECRYPT - size_t key_len = keysize / 8; - - kc->ivlen = ivsize / 8; -#endif - - /* - * The key is copied into the wbuf[] buffer and padded to 256 bits - * as described in the Serpent specification. - */ -#ifdef WASTE_SPACE_ON_STDIO - if (key_len == 0 || key_len > 32) { - fprintf(stderr, "invalid key size: %lu\n", - (unsigned long)key_len); - exit(EXIT_FAILURE); - } -#endif - memcpy(wbuf, key, key_len); - if (key_len < 32) { - wbuf[key_len] = 0x01; - if (key_len < 31) - memset(wbuf + key_len + 1, 0, 31 - key_len); - } - -#ifdef SOSEMANUK_VECTOR - { - size_t u; - - printf("key = "); - for (u = 0; u < key_len; u ++) - printf("%02X", key[u]); - printf("\n"); - } -#endif - - w0 = decode32le(wbuf); - w1 = decode32le(wbuf + 4); - w2 = decode32le(wbuf + 8); - w3 = decode32le(wbuf + 12); - w4 = decode32le(wbuf + 16); - w5 = decode32le(wbuf + 20); - w6 = decode32le(wbuf + 24); - w7 = decode32le(wbuf + 28); - -#ifdef SOSEMANUK_VECTOR - printf(" -> %08lX %08lX %08lX %08lX %08lX %08lX %08lX %08lX\n", - (unsigned long)w7, (unsigned long)w6, - (unsigned long)w5, (unsigned long)w4, - (unsigned long)w3, (unsigned long)w2, - (unsigned long)w1, (unsigned long)w0); -#endif - - WUP0(0); SKS3; - WUP1(4); SKS2; - WUP0(8); SKS1; - WUP1(12); SKS0; - WUP0(16); SKS7; - WUP1(20); SKS6; - WUP0(24); SKS5; - WUP1(28); SKS4; - WUP0(32); SKS3; - WUP1(36); SKS2; - WUP0(40); SKS1; - WUP1(44); SKS0; - WUP0(48); SKS7; - WUP1(52); SKS6; - WUP0(56); SKS5; - WUP1(60); SKS4; - WUP0(64); SKS3; - WUP1(68); SKS2; - WUP0(72); SKS1; - WUP1(76); SKS0; - WUP0(80); SKS7; - WUP1(84); SKS6; - WUP0(88); SKS5; - WUP1(92); SKS4; - WUP0(96); SKS3; - -#ifdef SOSEMANUK_VECTOR - { - unsigned u; - - for (u = 0; u < 100; u += 4) { - printf("Serpent24 subkey %2u:" - " %08lX %08lX %08lX %08lX\n", u / 4, - (unsigned long)kc->sk[u + 3], - (unsigned long)kc->sk[u + 2], - (unsigned long)kc->sk[u + 1], - (unsigned long)kc->sk[u + 0]); - } - } -#endif - -#undef SKS -#undef SKS0 -#undef SKS1 -#undef SKS2 -#undef SKS3 -#undef SKS4 -#undef SKS5 -#undef SKS6 -#undef SKS7 -#undef WUP -#undef WUP0 -#undef WUP1 -} - -#ifdef SOSEMANUK_ECRYPT -void -ECRYPT_ivsetup(ECRYPT_ctx *ctx, const u8 *iv) -#else -/* see sosemanuk.h */ -void -sosemanuk_init(sosemanuk_run_context *rc, sosemanuk_key_context *kc, - unsigned char *iv, size_t iv_len) -#endif -{ - -#ifdef SOSEMANUK_ECRYPT -#define rc ctx -#define kc ctx -#define iv_len (ctx->ivlen) -#endif - - /* - * The Serpent key addition step. - */ -#define KA(zc, x0, x1, x2, x3) do { \ - x0 ^= kc->sk[(zc)]; \ - x1 ^= kc->sk[(zc) + 1]; \ - x2 ^= kc->sk[(zc) + 2]; \ - x3 ^= kc->sk[(zc) + 3]; \ - } while (0) - - /* - * One Serpent round. - * zc = current subkey counter - * S = S-box macro for this round - * i0 to i4 = input register numbers (the fifth is a scratch register) - * o0 to o3 = output register numbers - */ -#define FSS(zc, S, i0, i1, i2, i3, i4, o0, o1, o2, o3) do { \ - KA(zc, r ## i0, r ## i1, r ## i2, r ## i3); \ - S(r ## i0, r ## i1, r ## i2, r ## i3, r ## i4); \ - SERPENT_LT(r ## o0, r ## o1, r ## o2, r ## o3); \ - } while (0) - - /* - * Last Serpent round. Contrary to the "true" Serpent, we keep - * the linear transformation for that last round. - */ -#define FSF(zc, S, i0, i1, i2, i3, i4, o0, o1, o2, o3) do { \ - KA(zc, r ## i0, r ## i1, r ## i2, r ## i3); \ - S(r ## i0, r ## i1, r ## i2, r ## i3, r ## i4); \ - SERPENT_LT(r ## o0, r ## o1, r ## o2, r ## o3); \ - KA(zc + 4, r ## o0, r ## o1, r ## o2, r ## o3); \ - } while (0) - - register unum32 r0, r1, r2, r3, r4; - unsigned char ivtmp[16]; - - if (iv_len >= sizeof ivtmp) { - memcpy(ivtmp, iv, sizeof ivtmp); - } else { - if (iv_len > 0) - memcpy(ivtmp, iv, iv_len); - memset(ivtmp + iv_len, 0, (sizeof ivtmp) - iv_len); - } - -#ifdef SOSEMANUK_VECTOR - { - size_t u; - - printf("IV = "); - for (u = 0; u < 16; u ++) - printf("%02X", ivtmp[u]); - printf("\n"); - } -#endif - - /* - * Decode IV into four 32-bit words (little-endian). - */ - r0 = decode32le(ivtmp); - r1 = decode32le(ivtmp + 4); - r2 = decode32le(ivtmp + 8); - r3 = decode32le(ivtmp + 12); - -#ifdef SOSEMANUK_VECTOR - printf(" -> %08lX %08lX %08lX %08lX\n", - (unsigned long)r3, (unsigned long)r2, - (unsigned long)r1, (unsigned long)r0); -#endif - - /* - * Encrypt IV with Serpent24. Some values are extracted from the - * output of the twelfth, eighteenth and twenty-fourth rounds. - */ - FSS(0, S0, 0, 1, 2, 3, 4, 1, 4, 2, 0); - FSS(4, S1, 1, 4, 2, 0, 3, 2, 1, 0, 4); - FSS(8, S2, 2, 1, 0, 4, 3, 0, 4, 1, 3); - FSS(12, S3, 0, 4, 1, 3, 2, 4, 1, 3, 2); - FSS(16, S4, 4, 1, 3, 2, 0, 1, 0, 4, 2); - FSS(20, S5, 1, 0, 4, 2, 3, 0, 2, 1, 4); - FSS(24, S6, 0, 2, 1, 4, 3, 0, 2, 3, 1); - FSS(28, S7, 0, 2, 3, 1, 4, 4, 1, 2, 0); - FSS(32, S0, 4, 1, 2, 0, 3, 1, 3, 2, 4); - FSS(36, S1, 1, 3, 2, 4, 0, 2, 1, 4, 3); - FSS(40, S2, 2, 1, 4, 3, 0, 4, 3, 1, 0); - FSS(44, S3, 4, 3, 1, 0, 2, 3, 1, 0, 2); - rc->s09 = r3; - rc->s08 = r1; - rc->s07 = r0; - rc->s06 = r2; - - FSS(48, S4, 3, 1, 0, 2, 4, 1, 4, 3, 2); - FSS(52, S5, 1, 4, 3, 2, 0, 4, 2, 1, 3); - FSS(56, S6, 4, 2, 1, 3, 0, 4, 2, 0, 1); - FSS(60, S7, 4, 2, 0, 1, 3, 3, 1, 2, 4); - FSS(64, S0, 3, 1, 2, 4, 0, 1, 0, 2, 3); - FSS(68, S1, 1, 0, 2, 3, 4, 2, 1, 3, 0); - rc->r1 = r2; - rc->s04 = r1; - rc->r2 = r3; - rc->s05 = r0; - - FSS(72, S2, 2, 1, 3, 0, 4, 3, 0, 1, 4); - FSS(76, S3, 3, 0, 1, 4, 2, 0, 1, 4, 2); - FSS(80, S4, 0, 1, 4, 2, 3, 1, 3, 0, 2); - FSS(84, S5, 1, 3, 0, 2, 4, 3, 2, 1, 0); - FSS(88, S6, 3, 2, 1, 0, 4, 3, 2, 4, 1); - FSF(92, S7, 3, 2, 4, 1, 0, 0, 1, 2, 3); - rc->s03 = r0; - rc->s02 = r1; - rc->s01 = r2; - rc->s00 = r3; - -#ifdef SOSEMANUK_VECTOR - printf("Initial LFSR state:\n"); - printf(" s1 = %08lX\n", (unsigned long)rc->s00); - printf(" s2 = %08lX\n", (unsigned long)rc->s01); - printf(" s3 = %08lX\n", (unsigned long)rc->s02); - printf(" s4 = %08lX\n", (unsigned long)rc->s03); - printf(" s5 = %08lX\n", (unsigned long)rc->s04); - printf(" s6 = %08lX\n", (unsigned long)rc->s05); - printf(" s7 = %08lX\n", (unsigned long)rc->s06); - printf(" s8 = %08lX\n", (unsigned long)rc->s07); - printf(" s9 = %08lX\n", (unsigned long)rc->s08); - printf(" s10 = %08lX\n", (unsigned long)rc->s09); - printf("Initial FSM state: r1 = %08lX r2 = %08lX\n", - (unsigned long)rc->r1, (unsigned long)rc->r2); -#endif - -#ifndef SOSEMANUK_ECRYPT - rc->ptr = sizeof rc->buf; -#endif - -#undef KA -#undef FSS -#undef FSF - -#ifdef SOSEMANUK_ECRYPT -#undef rc -#undef kc -#undef iv_len -#endif -} - -/* - * Multiplication by alpha: alpha * x = T32(x << 8) ^ mul_a[x >> 24] - */ -static unum32 mul_a[] = { - 0x00000000, 0xE19FCF13, 0x6B973726, 0x8A08F835, - 0xD6876E4C, 0x3718A15F, 0xBD10596A, 0x5C8F9679, - 0x05A7DC98, 0xE438138B, 0x6E30EBBE, 0x8FAF24AD, - 0xD320B2D4, 0x32BF7DC7, 0xB8B785F2, 0x59284AE1, - 0x0AE71199, 0xEB78DE8A, 0x617026BF, 0x80EFE9AC, - 0xDC607FD5, 0x3DFFB0C6, 0xB7F748F3, 0x566887E0, - 0x0F40CD01, 0xEEDF0212, 0x64D7FA27, 0x85483534, - 0xD9C7A34D, 0x38586C5E, 0xB250946B, 0x53CF5B78, - 0x1467229B, 0xF5F8ED88, 0x7FF015BD, 0x9E6FDAAE, - 0xC2E04CD7, 0x237F83C4, 0xA9777BF1, 0x48E8B4E2, - 0x11C0FE03, 0xF05F3110, 0x7A57C925, 0x9BC80636, - 0xC747904F, 0x26D85F5C, 0xACD0A769, 0x4D4F687A, - 0x1E803302, 0xFF1FFC11, 0x75170424, 0x9488CB37, - 0xC8075D4E, 0x2998925D, 0xA3906A68, 0x420FA57B, - 0x1B27EF9A, 0xFAB82089, 0x70B0D8BC, 0x912F17AF, - 0xCDA081D6, 0x2C3F4EC5, 0xA637B6F0, 0x47A879E3, - 0x28CE449F, 0xC9518B8C, 0x435973B9, 0xA2C6BCAA, - 0xFE492AD3, 0x1FD6E5C0, 0x95DE1DF5, 0x7441D2E6, - 0x2D699807, 0xCCF65714, 0x46FEAF21, 0xA7616032, - 0xFBEEF64B, 0x1A713958, 0x9079C16D, 0x71E60E7E, - 0x22295506, 0xC3B69A15, 0x49BE6220, 0xA821AD33, - 0xF4AE3B4A, 0x1531F459, 0x9F390C6C, 0x7EA6C37F, - 0x278E899E, 0xC611468D, 0x4C19BEB8, 0xAD8671AB, - 0xF109E7D2, 0x109628C1, 0x9A9ED0F4, 0x7B011FE7, - 0x3CA96604, 0xDD36A917, 0x573E5122, 0xB6A19E31, - 0xEA2E0848, 0x0BB1C75B, 0x81B93F6E, 0x6026F07D, - 0x390EBA9C, 0xD891758F, 0x52998DBA, 0xB30642A9, - 0xEF89D4D0, 0x0E161BC3, 0x841EE3F6, 0x65812CE5, - 0x364E779D, 0xD7D1B88E, 0x5DD940BB, 0xBC468FA8, - 0xE0C919D1, 0x0156D6C2, 0x8B5E2EF7, 0x6AC1E1E4, - 0x33E9AB05, 0xD2766416, 0x587E9C23, 0xB9E15330, - 0xE56EC549, 0x04F10A5A, 0x8EF9F26F, 0x6F663D7C, - 0x50358897, 0xB1AA4784, 0x3BA2BFB1, 0xDA3D70A2, - 0x86B2E6DB, 0x672D29C8, 0xED25D1FD, 0x0CBA1EEE, - 0x5592540F, 0xB40D9B1C, 0x3E056329, 0xDF9AAC3A, - 0x83153A43, 0x628AF550, 0xE8820D65, 0x091DC276, - 0x5AD2990E, 0xBB4D561D, 0x3145AE28, 0xD0DA613B, - 0x8C55F742, 0x6DCA3851, 0xE7C2C064, 0x065D0F77, - 0x5F754596, 0xBEEA8A85, 0x34E272B0, 0xD57DBDA3, - 0x89F22BDA, 0x686DE4C9, 0xE2651CFC, 0x03FAD3EF, - 0x4452AA0C, 0xA5CD651F, 0x2FC59D2A, 0xCE5A5239, - 0x92D5C440, 0x734A0B53, 0xF942F366, 0x18DD3C75, - 0x41F57694, 0xA06AB987, 0x2A6241B2, 0xCBFD8EA1, - 0x977218D8, 0x76EDD7CB, 0xFCE52FFE, 0x1D7AE0ED, - 0x4EB5BB95, 0xAF2A7486, 0x25228CB3, 0xC4BD43A0, - 0x9832D5D9, 0x79AD1ACA, 0xF3A5E2FF, 0x123A2DEC, - 0x4B12670D, 0xAA8DA81E, 0x2085502B, 0xC11A9F38, - 0x9D950941, 0x7C0AC652, 0xF6023E67, 0x179DF174, - 0x78FBCC08, 0x9964031B, 0x136CFB2E, 0xF2F3343D, - 0xAE7CA244, 0x4FE36D57, 0xC5EB9562, 0x24745A71, - 0x7D5C1090, 0x9CC3DF83, 0x16CB27B6, 0xF754E8A5, - 0xABDB7EDC, 0x4A44B1CF, 0xC04C49FA, 0x21D386E9, - 0x721CDD91, 0x93831282, 0x198BEAB7, 0xF81425A4, - 0xA49BB3DD, 0x45047CCE, 0xCF0C84FB, 0x2E934BE8, - 0x77BB0109, 0x9624CE1A, 0x1C2C362F, 0xFDB3F93C, - 0xA13C6F45, 0x40A3A056, 0xCAAB5863, 0x2B349770, - 0x6C9CEE93, 0x8D032180, 0x070BD9B5, 0xE69416A6, - 0xBA1B80DF, 0x5B844FCC, 0xD18CB7F9, 0x301378EA, - 0x693B320B, 0x88A4FD18, 0x02AC052D, 0xE333CA3E, - 0xBFBC5C47, 0x5E239354, 0xD42B6B61, 0x35B4A472, - 0x667BFF0A, 0x87E43019, 0x0DECC82C, 0xEC73073F, - 0xB0FC9146, 0x51635E55, 0xDB6BA660, 0x3AF46973, - 0x63DC2392, 0x8243EC81, 0x084B14B4, 0xE9D4DBA7, - 0xB55B4DDE, 0x54C482CD, 0xDECC7AF8, 0x3F53B5EB -}; - -/* - * Multiplication by 1/alpha: 1/alpha * x = (x >> 8) ^ mul_ia[x & 0xFF] - */ -static unum32 mul_ia[] = { - 0x00000000, 0x180F40CD, 0x301E8033, 0x2811C0FE, - 0x603CA966, 0x7833E9AB, 0x50222955, 0x482D6998, - 0xC078FBCC, 0xD877BB01, 0xF0667BFF, 0xE8693B32, - 0xA04452AA, 0xB84B1267, 0x905AD299, 0x88559254, - 0x29F05F31, 0x31FF1FFC, 0x19EEDF02, 0x01E19FCF, - 0x49CCF657, 0x51C3B69A, 0x79D27664, 0x61DD36A9, - 0xE988A4FD, 0xF187E430, 0xD99624CE, 0xC1996403, - 0x89B40D9B, 0x91BB4D56, 0xB9AA8DA8, 0xA1A5CD65, - 0x5249BE62, 0x4A46FEAF, 0x62573E51, 0x7A587E9C, - 0x32751704, 0x2A7A57C9, 0x026B9737, 0x1A64D7FA, - 0x923145AE, 0x8A3E0563, 0xA22FC59D, 0xBA208550, - 0xF20DECC8, 0xEA02AC05, 0xC2136CFB, 0xDA1C2C36, - 0x7BB9E153, 0x63B6A19E, 0x4BA76160, 0x53A821AD, - 0x1B854835, 0x038A08F8, 0x2B9BC806, 0x339488CB, - 0xBBC11A9F, 0xA3CE5A52, 0x8BDF9AAC, 0x93D0DA61, - 0xDBFDB3F9, 0xC3F2F334, 0xEBE333CA, 0xF3EC7307, - 0xA492D5C4, 0xBC9D9509, 0x948C55F7, 0x8C83153A, - 0xC4AE7CA2, 0xDCA13C6F, 0xF4B0FC91, 0xECBFBC5C, - 0x64EA2E08, 0x7CE56EC5, 0x54F4AE3B, 0x4CFBEEF6, - 0x04D6876E, 0x1CD9C7A3, 0x34C8075D, 0x2CC74790, - 0x8D628AF5, 0x956DCA38, 0xBD7C0AC6, 0xA5734A0B, - 0xED5E2393, 0xF551635E, 0xDD40A3A0, 0xC54FE36D, - 0x4D1A7139, 0x551531F4, 0x7D04F10A, 0x650BB1C7, - 0x2D26D85F, 0x35299892, 0x1D38586C, 0x053718A1, - 0xF6DB6BA6, 0xEED42B6B, 0xC6C5EB95, 0xDECAAB58, - 0x96E7C2C0, 0x8EE8820D, 0xA6F942F3, 0xBEF6023E, - 0x36A3906A, 0x2EACD0A7, 0x06BD1059, 0x1EB25094, - 0x569F390C, 0x4E9079C1, 0x6681B93F, 0x7E8EF9F2, - 0xDF2B3497, 0xC724745A, 0xEF35B4A4, 0xF73AF469, - 0xBF179DF1, 0xA718DD3C, 0x8F091DC2, 0x97065D0F, - 0x1F53CF5B, 0x075C8F96, 0x2F4D4F68, 0x37420FA5, - 0x7F6F663D, 0x676026F0, 0x4F71E60E, 0x577EA6C3, - 0xE18D0321, 0xF98243EC, 0xD1938312, 0xC99CC3DF, - 0x81B1AA47, 0x99BEEA8A, 0xB1AF2A74, 0xA9A06AB9, - 0x21F5F8ED, 0x39FAB820, 0x11EB78DE, 0x09E43813, - 0x41C9518B, 0x59C61146, 0x71D7D1B8, 0x69D89175, - 0xC87D5C10, 0xD0721CDD, 0xF863DC23, 0xE06C9CEE, - 0xA841F576, 0xB04EB5BB, 0x985F7545, 0x80503588, - 0x0805A7DC, 0x100AE711, 0x381B27EF, 0x20146722, - 0x68390EBA, 0x70364E77, 0x58278E89, 0x4028CE44, - 0xB3C4BD43, 0xABCBFD8E, 0x83DA3D70, 0x9BD57DBD, - 0xD3F81425, 0xCBF754E8, 0xE3E69416, 0xFBE9D4DB, - 0x73BC468F, 0x6BB30642, 0x43A2C6BC, 0x5BAD8671, - 0x1380EFE9, 0x0B8FAF24, 0x239E6FDA, 0x3B912F17, - 0x9A34E272, 0x823BA2BF, 0xAA2A6241, 0xB225228C, - 0xFA084B14, 0xE2070BD9, 0xCA16CB27, 0xD2198BEA, - 0x5A4C19BE, 0x42435973, 0x6A52998D, 0x725DD940, - 0x3A70B0D8, 0x227FF015, 0x0A6E30EB, 0x12617026, - 0x451FD6E5, 0x5D109628, 0x750156D6, 0x6D0E161B, - 0x25237F83, 0x3D2C3F4E, 0x153DFFB0, 0x0D32BF7D, - 0x85672D29, 0x9D686DE4, 0xB579AD1A, 0xAD76EDD7, - 0xE55B844F, 0xFD54C482, 0xD545047C, 0xCD4A44B1, - 0x6CEF89D4, 0x74E0C919, 0x5CF109E7, 0x44FE492A, - 0x0CD320B2, 0x14DC607F, 0x3CCDA081, 0x24C2E04C, - 0xAC977218, 0xB49832D5, 0x9C89F22B, 0x8486B2E6, - 0xCCABDB7E, 0xD4A49BB3, 0xFCB55B4D, 0xE4BA1B80, - 0x17566887, 0x0F59284A, 0x2748E8B4, 0x3F47A879, - 0x776AC1E1, 0x6F65812C, 0x477441D2, 0x5F7B011F, - 0xD72E934B, 0xCF21D386, 0xE7301378, 0xFF3F53B5, - 0xB7123A2D, 0xAF1D7AE0, 0x870CBA1E, 0x9F03FAD3, - 0x3EA637B6, 0x26A9777B, 0x0EB8B785, 0x16B7F748, - 0x5E9A9ED0, 0x4695DE1D, 0x6E841EE3, 0x768B5E2E, - 0xFEDECC7A, 0xE6D18CB7, 0xCEC04C49, 0xD6CF0C84, - 0x9EE2651C, 0x86ED25D1, 0xAEFCE52F, 0xB6F3A5E2 -}; - -/* - * Compute the next block of bits of output stream. This is equivalent - * to one full rotation of the shift register. - * - * If SOSEMANUK_SPEED is defined, this function takes an extra parameter - * "counter". The function then returns the sum of all produced - * 32-bit words, in an "unum32". That sum prevents the compiler from - * optimizing out part of the computation. - */ -#if defined SOSEMANUK_ECRYPT -static void -sosemanuk_internal(ECRYPT_ctx *rc, u8 *dst) -#elif defined SOSEMANUK_SPEED -static unum32 -sosemanuk_internal(sosemanuk_run_context *rc, unsigned long counter) -#else -static void -sosemanuk_internal(sosemanuk_run_context *rc) -#endif -{ - /* - * MUL_A(x) computes alpha * x (in F_{2^32}). - * MUL_G(x) computes 1/alpha * x (in F_{2^32}). - */ -#define MUL_A(x) (T32((x) << 8) ^ mul_a[(x) >> 24]) -#define MUL_G(x) (((x) >> 8) ^ mul_ia[(x) & 0xFF]) - - /* - * This macro computes the special multiplexer, which chooses - * between "x" and "x xor y", depending on the least significant - * bit of the control word. We use the C "?:" selection operator - * (which most compilers know how to optimise) except for Alpha, - * where the manual sign extension seems to perform equally well - * with DEC/Compaq/HP compiler, and much better with gcc. - */ -#ifdef __alpha -#define XMUX(c, x, y) ((((signed int)((c) << 31) >> 31) & (y)) ^ (x)) -#else -#define XMUX(c, x, y) (((c) & 0x1) ? ((x) ^ (y)) : (x)) -#endif - - /* - * FSM() updates the finite state machine. - */ -#define FSM(x0, x1, x2, x3, x4, x5, x6, x7, x8, x9) do { \ - unum32 tt, or1; \ - tt = XMUX(r1, s ## x1, s ## x8); \ - or1 = r1; \ - r1 = T32(r2 + tt); \ - tt = T32(or1 * 0x54655307); \ - r2 = ROTL(tt, 7); \ - PFSM; \ - } while (0) - - /* - * LRU updates the shift register; the dropped value is stored - * in variable "dd". - */ -#define LRU(x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, dd) do { \ - dd = s ## x0; \ - s ## x0 = MUL_A(s ## x0) ^ MUL_G(s ## x3) ^ s ## x9; \ - PLFSR(dd, s ## x1, s ## x2, s ## x3, s ## x4, s ## x5, \ - s ## x6, s ## x7, s ## x8, s ## x9, s ## x0); \ - } while (0) - - /* - * CC1 stores into variable "ee" the next intermediate word - * (combination of the new states of the LFSR and the FSM). - */ -#define CC1(x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, ee) do { \ - ee = T32(s ## x9 + r1) ^ r2; \ - PCCVAL(ee); \ - } while (0) - - /* - * STEP computes one internal round. "dd" receives the "s_t" - * value (dropped from the LFSR) and "ee" gets the value computed - * from the LFSR and FSM. - */ -#define STEP(x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, dd, ee) do { \ - FSM(x0, x1, x2, x3, x4, x5, x6, x7, x8, x9); \ - LRU(x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, dd); \ - CC1(x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, ee); \ - } while (0) - - /* - * Apply one Serpent round (with the provided S-box macro), XOR - * the result with the "v" values, and encode the result into - * the destination buffer, at the provided offset. The "x*" - * arguments encode the output permutation of the "S" macro. - */ -#ifdef SOSEMANUK_SPEED - -#define SRD(S, x0, x1, x2, x3, ooff) do { \ - S(u0, u1, u2, u3, u4); \ - speed_acc += u ## x0 ^ v0; \ - speed_acc += u ## x1 ^ v1; \ - speed_acc += u ## x2 ^ v2; \ - speed_acc += u ## x3 ^ v3; \ - } while (0) - -#else - -#ifdef SOSEMANUK_ECRYPT -#define OUTWORD_BASE dst -#else -#define OUTWORD_BASE (rc->buf) -#endif - -#define SRD(S, x0, x1, x2, x3, ooff) do { \ - PSPIN(u0, u1, u2, u3); \ - S(u0, u1, u2, u3, u4); \ - PSPOUT(u ## x0, u ## x1, u ## x2, u ## x3); \ - encode32le(OUTWORD_BASE + ooff, u ## x0 ^ v0); \ - encode32le(OUTWORD_BASE + ooff + 4, u ## x1 ^ v1); \ - encode32le(OUTWORD_BASE + ooff + 8, u ## x2 ^ v2); \ - encode32le(OUTWORD_BASE + ooff + 12, u ## x3 ^ v3); \ - POUT(OUTWORD_BASE + ooff); \ - } while (0) - -#endif - - /* - * Audit code; used for detailed test vectors. - */ -#ifdef SOSEMANUK_VECTOR - -#define PFSM do { \ - printf("New FSM state: r1 = %08lX r2 = %08lX\n", \ - (unsigned long)r1, (unsigned long)r2); \ - } while (0) - -#define PLFSR(dd, x1, x2, x3, x4, x5, x6, x7, x8, x9, x0) do { \ - printf("New LFSR state:\n"); \ - printf(" dropped (s_t): %08lX\n", (unsigned long)dd); \ - printf(" s_t+1 = %08lX\n", (unsigned long)x1); \ - printf(" s_t+2 = %08lX\n", (unsigned long)x2); \ - printf(" s_t+3 = %08lX\n", (unsigned long)x3); \ - printf(" s_t+4 = %08lX\n", (unsigned long)x4); \ - printf(" s_t+5 = %08lX\n", (unsigned long)x5); \ - printf(" s_t+6 = %08lX\n", (unsigned long)x6); \ - printf(" s_t+7 = %08lX\n", (unsigned long)x7); \ - printf(" s_t+8 = %08lX\n", (unsigned long)x8); \ - printf(" s_t+9 = %08lX\n", (unsigned long)x9); \ - printf(" s_t+10 = %08lX\n", (unsigned long)x0); \ - } while (0) - -#define PCCVAL(ee) do { \ - printf("Intermediate output: %08lX\n", (unsigned long)ee); \ - } while (0) - -#define PSPIN(x0, x1, x2, x3) do { \ - printf("Serpent1 input: %08lX %08lX %08lX %08lX\n", \ - (unsigned long)x3, (unsigned long)x2, \ - (unsigned long)x1, (unsigned long)x0); \ - } while (0) - -#define PSPOUT(x0, x1, x2, x3) do { \ - printf("Serpent1 output: %08lX %08lX %08lX %08lX\n", \ - (unsigned long)x3, (unsigned long)x2, \ - (unsigned long)x1, (unsigned long)x0); \ - } while (0) - -#define POUT(buf) do { \ - size_t j; \ - printf("Stream output: "); \ - for (j = 0; j < 16; j ++) \ - printf("%02X", (buf)[j]); \ - printf("\n"); \ - } while (0) - -#else - -#define PFSM (void)0 -#define PLFSR(dd, x1, x2, x3, x4, x5, x6, x7, x8, x9, x0) (void)0 -#define PCCVAL(ee) (void)0 -#define PSPIN(x0, x1, x2, x3) (void)0 -#define PSPOUT(x0, x1, x2, x3) (void)0 -#define POUT(buf) (void)0 - -#endif - - unum32 s00 = rc->s00; - unum32 s01 = rc->s01; - unum32 s02 = rc->s02; - unum32 s03 = rc->s03; - unum32 s04 = rc->s04; - unum32 s05 = rc->s05; - unum32 s06 = rc->s06; - unum32 s07 = rc->s07; - unum32 s08 = rc->s08; - unum32 s09 = rc->s09; - unum32 r1 = rc->r1; - unum32 r2 = rc->r2; - unum32 u0, u1, u2, u3, u4; - unum32 v0, v1, v2, v3; -#ifdef SOSEMANUK_SPEED - unum32 speed_acc = 0; -#endif - -#ifdef SOSEMANUK_SPEED - while (counter -- > 0) { -#endif - - STEP(00, 01, 02, 03, 04, 05, 06, 07, 08, 09, v0, u0); - STEP(01, 02, 03, 04, 05, 06, 07, 08, 09, 00, v1, u1); - STEP(02, 03, 04, 05, 06, 07, 08, 09, 00, 01, v2, u2); - STEP(03, 04, 05, 06, 07, 08, 09, 00, 01, 02, v3, u3); - SRD(S2, 2, 3, 1, 4, 0); - STEP(04, 05, 06, 07, 08, 09, 00, 01, 02, 03, v0, u0); - STEP(05, 06, 07, 08, 09, 00, 01, 02, 03, 04, v1, u1); - STEP(06, 07, 08, 09, 00, 01, 02, 03, 04, 05, v2, u2); - STEP(07, 08, 09, 00, 01, 02, 03, 04, 05, 06, v3, u3); - SRD(S2, 2, 3, 1, 4, 16); - STEP(08, 09, 00, 01, 02, 03, 04, 05, 06, 07, v0, u0); - STEP(09, 00, 01, 02, 03, 04, 05, 06, 07, 08, v1, u1); - STEP(00, 01, 02, 03, 04, 05, 06, 07, 08, 09, v2, u2); - STEP(01, 02, 03, 04, 05, 06, 07, 08, 09, 00, v3, u3); - SRD(S2, 2, 3, 1, 4, 32); - STEP(02, 03, 04, 05, 06, 07, 08, 09, 00, 01, v0, u0); - STEP(03, 04, 05, 06, 07, 08, 09, 00, 01, 02, v1, u1); - STEP(04, 05, 06, 07, 08, 09, 00, 01, 02, 03, v2, u2); - STEP(05, 06, 07, 08, 09, 00, 01, 02, 03, 04, v3, u3); - SRD(S2, 2, 3, 1, 4, 48); - STEP(06, 07, 08, 09, 00, 01, 02, 03, 04, 05, v0, u0); - STEP(07, 08, 09, 00, 01, 02, 03, 04, 05, 06, v1, u1); - STEP(08, 09, 00, 01, 02, 03, 04, 05, 06, 07, v2, u2); - STEP(09, 00, 01, 02, 03, 04, 05, 06, 07, 08, v3, u3); - SRD(S2, 2, 3, 1, 4, 64); - -#ifdef SOSEMANUK_SPEED - } -#endif - - rc->s00 = s00; - rc->s01 = s01; - rc->s02 = s02; - rc->s03 = s03; - rc->s04 = s04; - rc->s05 = s05; - rc->s06 = s06; - rc->s07 = s07; - rc->s08 = s08; - rc->s09 = s09; - rc->r1 = r1; - rc->r2 = r2; - -#ifdef SOSEMANUK_SPEED - return T32(speed_acc); -#endif -} - -/* - * Combine buffers in1[] and in2[] by XOR, result in out[]. The length - * is "data_len" (in bytes). Partial overlap of out[] with either in1[] - * or in2[] is not allowed. Total overlap (out == in1 and/or out == in2) - * is allowed. - */ -static INLINE void -xorbuf(const unsigned char *in1, const unsigned char *in2, - unsigned char *out, size_t data_len) -{ - while (data_len -- > 0) - *out ++ = *in1 ++ ^ *in2 ++; -} - -/* ======================================================================== */ -/* - * External API. - */ - -#if defined SOSEMANUK_ECRYPT - -/* see ecrypt-sync.h */ -void -ECRYPT_process_bytes(int action, ECRYPT_ctx *ctx, - const u8 *input, u8 *output, u32 msglen) -{ - (void)action; - - while (msglen > 0) { - unsigned char tbuf[ECRYPT_BLOCKLENGTH]; - size_t len; - - sosemanuk_internal(ctx, tbuf); - len = sizeof tbuf; - if (len > msglen) - len = msglen; - xorbuf(input, tbuf, output, len); - input += len; - output += len; - msglen -= len; - } -} - -/* see ecrypt-sync.h */ -void -ECRYPT_keystream_bytes(ECRYPT_ctx *ctx, u8 *keystream, u32 length) -{ - while (length > 0) { - if (length >= ECRYPT_BLOCKLENGTH) { - sosemanuk_internal(ctx, keystream); - keystream += ECRYPT_BLOCKLENGTH; - length -= ECRYPT_BLOCKLENGTH; - } else { - unsigned char tbuf[ECRYPT_BLOCKLENGTH]; - - sosemanuk_internal(ctx, tbuf); - memcpy(keystream, tbuf, length); - return; - } - } -} - -/* see ecrypt-sync.h */ -void -ECRYPT_process_blocks(int action, ECRYPT_ctx *ctx, - const u8 *input, u8 *output, u32 blocks) -{ - (void)action; - - while (blocks -- > 0) { - unsigned char tbuf[ECRYPT_BLOCKLENGTH]; - - sosemanuk_internal(ctx, tbuf); - xorbuf(input, tbuf, output, ECRYPT_BLOCKLENGTH); - input += ECRYPT_BLOCKLENGTH; - output += ECRYPT_BLOCKLENGTH; - } -} - -/* see ecrypt-sync.h */ -void -ECRYPT_keystream_blocks(ECRYPT_ctx *ctx, u8 *keystream, u32 blocks) -{ - while (blocks -- > 0) { - sosemanuk_internal(ctx, keystream); - keystream += ECRYPT_BLOCKLENGTH; - } -} - -#elif !defined SOSEMANUK_SPEED - -/* see sosemanuk.h */ -void -sosemanuk_prng(sosemanuk_run_context *rc, unsigned char *out, size_t out_len) -{ - if (rc->ptr < (sizeof rc->buf)) { - size_t rlen = (sizeof rc->buf) - rc->ptr; - - if (rlen > out_len) - rlen = out_len; - memcpy(out, rc->buf + rc->ptr, rlen); - out += rlen; - out_len -= rlen; - rc->ptr += rlen; - } - while (out_len > 0) { - sosemanuk_internal(rc); - if (out_len >= sizeof rc->buf) { - memcpy(out, rc->buf, sizeof rc->buf); - out += sizeof rc->buf; - out_len -= sizeof rc->buf; - } else { - memcpy(out, rc->buf, out_len); - rc->ptr = out_len; - out_len = 0; - } - } -} - -/* see sosemanuk.h */ -void -sosemanuk_encrypt(sosemanuk_run_context *rc, - unsigned char *in, unsigned char *out, size_t data_len) -{ - if (rc->ptr < (sizeof rc->buf)) { - size_t rlen = (sizeof rc->buf) - rc->ptr; - - if (rlen > data_len) - rlen = data_len; - xorbuf(rc->buf + rc->ptr, in, out, rlen); - in += rlen; - out += rlen; - data_len -= rlen; - rc->ptr += rlen; - } - while (data_len > 0) { - sosemanuk_internal(rc); - if (data_len >= sizeof rc->buf) { - xorbuf(rc->buf, in, out, sizeof rc->buf); - in += sizeof rc->buf; - out += sizeof rc->buf; - data_len -= sizeof rc->buf; - } else { - xorbuf(rc->buf, in, out, data_len); - rc->ptr = data_len; - data_len = 0; - } - } -} - -#endif - -#if defined SOSEMANUK_VECTOR - -/* ======================================================================== */ -/* - * Test code. This code is used to generate test vectors, with the - * SOSEMANUK_VECTOR macro defined. - */ - -/* - * Generate 160 bytes of stream with the provided key and IV. - */ -static void -maketest(int tvn, unsigned char *key, size_t key_len, - unsigned char *iv, size_t iv_len) -{ -#ifdef SOSEMANUK_ECRYPT - ECRYPT_ctx ctx; -#else - sosemanuk_key_context kc; - sosemanuk_run_context rc; -#endif - unsigned char tmp[160]; - unsigned u; - - printf("=====================================================\n"); - printf("Detailed test vector %d:\n", tvn); - -#ifdef SOSEMANUK_ECRYPT - ECRYPT_init(); - ECRYPT_keysetup(&ctx, key, key_len * 8, iv_len * 8); - ECRYPT_ivsetup(&ctx, iv); -#if defined SOSEMANUK_TEST_ENCRYPT_BYTES - memset(tmp, 0, sizeof tmp); - ECRYPT_encrypt_bytes(&ctx, tmp, tmp, sizeof tmp); -#elif defined SOSEMANUK_TEST_DECRYPT_BYTES - memset(tmp, 0, sizeof tmp); - ECRYPT_decrypt_bytes(&ctx, tmp, tmp, sizeof tmp); -#elif defined SOSEMANUK_TEST_ENCRYPT_BLOCKS - memset(tmp, 0, sizeof tmp); - ECRYPT_encrypt_blocks(&ctx, tmp, tmp, 2); -#elif defined SOSEMANUK_TEST_DECRYPT_BLOCKS - memset(tmp, 0, sizeof tmp); - ECRYPT_decrypt_blocks(&ctx, tmp, tmp, 2); -#elif defined SOSEMANUK_TEST_KEYSTREAM_BLOCKS - ECRYPT_keystream_blocks(&ctx, tmp, 2); -#else - ECRYPT_keystream_bytes(&ctx, tmp, sizeof tmp); -#endif -#else - sosemanuk_schedule(&kc, key, key_len); - sosemanuk_init(&rc, &kc, iv, iv_len); - sosemanuk_prng(&rc, tmp, sizeof tmp); -#endif - - printf("\n"); - printf("Total output:"); - for (u = 0; u < sizeof tmp; u ++) { - if ((u & 0x0F) == 0) - printf("\n"); - printf(" %02X", (unsigned)tmp[u]); - } - printf("\n\n"); -} - -int -main(void) -{ - static unsigned char key1[] = { 0xA7, 0xC0, 0x83, 0xFE, 0xB7 }; - static unsigned char iv1[] = { - 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, - 0x88, 0x99, 0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF - }; - - static unsigned char key2[] = { - 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, - 0x88, 0x99, 0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF - }; - static unsigned char iv2[] = { - 0x88, 0x99, 0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF, - 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77 - }; - - maketest(1, key1, sizeof key1, iv1, sizeof iv1); - maketest(2, key2, sizeof key2, iv2, sizeof iv2); - return 0; -} - -#elif defined SOSEMANUK_SPEED - -/* ======================================================================== */ -/* - * Test code. This code is used to measure implementation speed. The - * provided argument is the size of benched output stream, in megabytes. - */ - -static void -usage(void) -{ - fprintf(stderr, "missing argument: output length (in megabytes)\n"); - exit(EXIT_FAILURE); -} - -int -main(int argc, char *argv[]) -{ - static unsigned char key[] = { 0xA7, 0xC0, 0x83, 0xFE, 0xB7 }; - static unsigned char iv[] = { - 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, - 0x88, 0x99, 0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF - }; - sosemanuk_key_context kc; - sosemanuk_run_context rc; - unsigned long speed_counter; - clock_t orig, end; - double nw, ts; - unum32 sum; - - if (argc < 2) - usage(); - speed_counter = strtoul(argv[1], 0, 0); - speed_counter = (speed_counter * 65536UL) / 5; - if (speed_counter == 0) - usage(); - nw = (double)speed_counter * 20.0; - printf("number of 32-bit words: %.0f\n", nw); - sosemanuk_schedule(&kc, key, sizeof key); - sosemanuk_init(&rc, &kc, iv, sizeof iv); - sosemanuk_internal(&rc, 16); - orig = clock(); - sum = sosemanuk_internal(&rc, speed_counter); - end = clock(); - ts = (double)end / CLOCKS_PER_SEC - (double)orig / CLOCKS_PER_SEC; - if (ts <= 1.0) { - printf("too fast: no meaningful result\n"); - } else { - printf("elapsed time: %.4f seconds\n", ts); - printf("32-bit words per second: %.0f\n", nw / ts); - } - printf("sum = %08lX\n", (unsigned long)sum); - return 0; -} - -#endif diff --git a/sosemanuk.h b/sosemanuk.h deleted file mode 100644 index 3cee5a8..0000000 --- a/sosemanuk.h +++ /dev/null @@ -1,176 +0,0 @@ -/* - * SOSEMANUK reference API. - * - * This file documents the reference implementation API. If the - * macro SOSEMANUK_ECRYPT is defined, the API follows the ECRYPT - * conventions (types, function names...) and uses the ECRYPT files; - * otherwise, a simpler API is used. - * - * (c) 2005 X-CRYPT project. This software is provided 'as-is', without - * any express or implied warranty. In no event will the authors be held - * liable for any damages arising from the use of this software. - * - * Permission is granted to anyone to use this software for any purpose, - * including commercial applications, and to alter it and redistribute it - * freely, subject to no restriction. - * - * Technical remarks and questions can be addressed to - * <thomas.pornin@cryptolog.com> - */ - -#ifndef SOSEMANUK_H__ -#define SOSEMANUK_H__ - -/* - * This macro enables the ECRYPT API, and disables the local API. - * It is defined by default, for ECRYPT processing. - */ -//#define SOSEMANUK_ECRYPT - -#ifdef SOSEMANUK_ECRYPT - -#include "ecrypt-sync.h" - -#else - -#include <limits.h> - -/* - * Input/Output is defined in terms of octets, but C provides only - * the C notion of "byte". We require that C bytes are actually octets. - */ -#if CHAR_BIT != 8 -#error We need 8-bit bytes -#endif - -/* - * We want an unsigned integer type with at least (and possibly exactly) - * 32 bits. Such a type implements arithmetics modulo 2^n for a value - * n greater than or equal to 32. The type is named "unum32". - * - * Note: we try to use C99 features such as <stdint.h>. This may prove - * problematic on architectures which claim C99 conformance, but fail - * to actually conform. If necessary, define the macro BROKEN_C99 to - * fall back to C90, whatever the environment claims: -#define BROKEN_C99 1 - */ - -#if !defined BROKEN_C99 && defined __STDC__ && __STDC_VERSION__ >= 199901L - -/* - * C99 implementation. We use "uint_least32_t" which has the required - * semantics. - */ -#include <stdint.h> -typedef uint_least32_t unum32; - -#else - -/* - * Pre-C99 implementation. "unsigned long" is guaranteed to be wide - * enough, but we want to use "unsigned int" if possible (especially - * for 64-bit architectures). - */ -#if UINT_MAX >= 0xFFFFFFFF -typedef unsigned int unum32; -#else -typedef unsigned long unum32; -#endif - -#endif - -/* - * We want (and sometimes need) to perform explicit truncations to 32 bits. - */ -#define ONE32 ((unum32)0xFFFFFFFF) -#define T32(x) ((x) & ONE32) - -/* - * Some of our functions will be tagged as "inline" to help the compiler - * optimize things. We use "inline" only if the compiler is advanced - * enough to understand it; C99 compilers, and pre-C99 versions of gcc, - * understand enough "inline" for our purposes. - */ -#if (!defined BROKEN_C99 && defined __STDC__ && __STDC_VERSION__ >= 199901L) \ - || defined __GNUC__ -#define INLINE inline -#else -#define INLINE -#endif - -/* - * API description: - * - * The SOSEMANUK algorithm works with a secret key and an initial value (IV). - * Two context structures are used: - * - * -- "sosemanuk_key_context" holds the processed secret key. The contents - * of this structure depends only on the key, not the IV. - * - * -- "sosemanuk_run_context" holds the current cipher internal state. This - * structure is initialized using the "sosemanuk_key_context" structure, and - * the IV; it is updated each time some output is produced. - * - * Both structures may be allocated as local variables. There is no - * other external allocation (using malloc() or any similar function). - * There is no global state; hence, this code is thread-safe and - * reentrant. - */ - -typedef struct { - /* - * Sub-keys for Serpent24. - */ - unum32 sk[100]; -} sosemanuk_key_context; - -typedef struct { - /* - * Internal cipher state. - */ - unum32 s00, s01, s02, s03, s04, s05, s06, s07, s08, s09; - unum32 r1, r2; - - /* - * Buffering: the stream cipher produces output data by - * blocks of 640 bits. buf[] contains such a block, and - * "ptr" is the index of the next output byte. - */ - unsigned char buf[80]; - unsigned ptr; -} sosemanuk_run_context; - -/* - * Key schedule: initialize the key context structure with the provided - * secret key. The secret key is an array of 1 to 32 bytes. - */ -void sosemanuk_schedule(sosemanuk_key_context *kc, - unsigned char *key, size_t key_len); - -/* - * Cipher initialization: the cipher internal state is initialized, using - * the provided key context and IV. The IV length is up to 16 bytes. If - * "iv_len" is 0 (no IV), then the "iv" parameter can be NULL. - */ -void sosemanuk_init(sosemanuk_run_context *rc, - sosemanuk_key_context *kc, unsigned char *iv, size_t iv_len); - -/* - * Cipher operation, as a PRNG: the provided output buffer is filled with - * pseudo-random bytes as output from the stream cipher. - */ -void sosemanuk_prng(sosemanuk_run_context *rc, - unsigned char *out, size_t out_len); - -/* - * Cipher operation, as a stream cipher: data is read from the "in" - * buffer, combined by XOR with the stream, and the result is written - * in the "out" buffer. "in" and "out" must be either equal, or - * reference distinct buffers (no partial overlap is allowed). - */ -void sosemanuk_encrypt(sosemanuk_run_context *rc, - unsigned char *in, unsigned char *out, size_t data_len); - -#endif - -#endif |