1 // SPDX-License-Identifier: BSD-2-Clause
2 /* LibTomCrypt, modular cryptographic library -- Tom St Denis
3  *
4  * LibTomCrypt is a library that provides various cryptographic
5  * algorithms in a highly modular and flexible manner.
6  *
7  * The library is free for all purposes without any express
8  * guarantee it works.
9  */
10 
11 /**
12    @file saferp.c
13    LTC_SAFER+ Implementation by Tom St Denis
14 */
15 #include "tomcrypt_private.h"
16 
17 #ifdef LTC_SAFERP
18 
19 #define __LTC_SAFER_TAB_C__
20 #include "safer_tab.c"
21 
22 const struct ltc_cipher_descriptor saferp_desc =
23 {
24     "safer+",
25     4,
26     16, 32, 16, 8,
27     &saferp_setup,
28     &saferp_ecb_encrypt,
29     &saferp_ecb_decrypt,
30     &saferp_test,
31     &saferp_done,
32     &saferp_keysize,
33     NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL
34 };
35 
36 /* ROUND(b,i)
37  *
38  * This is one forward key application.  Note the basic form is
39  * key addition, substitution, key addition.  The safer_ebox and safer_lbox
40  * are the exponentiation box and logarithm boxes respectively.
41  * The value of 'i' is the current round number which allows this
42  * function to be unrolled massively.  Most of LTC_SAFER+'s speed
43  * comes from not having to compute indirect accesses into the
44  * array of 16 bytes b[0..15] which is the block of data
45 */
46 
47 #define ROUND(b, i) do {                                                                         \
48     b[0]  = (safer_ebox[(b[0] ^ skey->saferp.K[i][0]) & 255] + skey->saferp.K[i+1][0]) & 255;    \
49     b[1]  = safer_lbox[(b[1] + skey->saferp.K[i][1]) & 255] ^ skey->saferp.K[i+1][1];            \
50     b[2]  = safer_lbox[(b[2] + skey->saferp.K[i][2]) & 255] ^ skey->saferp.K[i+1][2];            \
51     b[3]  = (safer_ebox[(b[3] ^ skey->saferp.K[i][3]) & 255] + skey->saferp.K[i+1][3]) & 255;    \
52     b[4]  = (safer_ebox[(b[4] ^ skey->saferp.K[i][4]) & 255] + skey->saferp.K[i+1][4]) & 255;    \
53     b[5]  = safer_lbox[(b[5] + skey->saferp.K[i][5]) & 255] ^ skey->saferp.K[i+1][5];            \
54     b[6]  = safer_lbox[(b[6] + skey->saferp.K[i][6]) & 255] ^ skey->saferp.K[i+1][6];            \
55     b[7]  = (safer_ebox[(b[7] ^ skey->saferp.K[i][7]) & 255] + skey->saferp.K[i+1][7]) & 255;    \
56     b[8]  = (safer_ebox[(b[8] ^ skey->saferp.K[i][8]) & 255] + skey->saferp.K[i+1][8]) & 255;    \
57     b[9]  = safer_lbox[(b[9] + skey->saferp.K[i][9]) & 255] ^ skey->saferp.K[i+1][9];            \
58     b[10] = safer_lbox[(b[10] + skey->saferp.K[i][10]) & 255] ^ skey->saferp.K[i+1][10];         \
59     b[11] = (safer_ebox[(b[11] ^ skey->saferp.K[i][11]) & 255] + skey->saferp.K[i+1][11]) & 255; \
60     b[12] = (safer_ebox[(b[12] ^ skey->saferp.K[i][12]) & 255] + skey->saferp.K[i+1][12]) & 255; \
61     b[13] = safer_lbox[(b[13] + skey->saferp.K[i][13]) & 255] ^ skey->saferp.K[i+1][13];         \
62     b[14] = safer_lbox[(b[14] + skey->saferp.K[i][14]) & 255] ^ skey->saferp.K[i+1][14];         \
63     b[15] = (safer_ebox[(b[15] ^ skey->saferp.K[i][15]) & 255] + skey->saferp.K[i+1][15]) & 255; \
64 } while (0)
65 
66 /* This is one inverse key application */
67 #define iROUND(b, i) do {                                                                        \
68     b[0]  = safer_lbox[(b[0] - skey->saferp.K[i+1][0]) & 255] ^ skey->saferp.K[i][0];            \
69     b[1]  = (safer_ebox[(b[1] ^ skey->saferp.K[i+1][1]) & 255] - skey->saferp.K[i][1]) & 255;    \
70     b[2]  = (safer_ebox[(b[2] ^ skey->saferp.K[i+1][2]) & 255] - skey->saferp.K[i][2]) & 255;    \
71     b[3]  = safer_lbox[(b[3] - skey->saferp.K[i+1][3]) & 255] ^ skey->saferp.K[i][3];            \
72     b[4]  = safer_lbox[(b[4] - skey->saferp.K[i+1][4]) & 255] ^ skey->saferp.K[i][4];            \
73     b[5]  = (safer_ebox[(b[5] ^ skey->saferp.K[i+1][5]) & 255] - skey->saferp.K[i][5]) & 255;    \
74     b[6]  = (safer_ebox[(b[6] ^ skey->saferp.K[i+1][6]) & 255] - skey->saferp.K[i][6]) & 255;    \
75     b[7]  = safer_lbox[(b[7] - skey->saferp.K[i+1][7]) & 255] ^ skey->saferp.K[i][7];            \
76     b[8]  = safer_lbox[(b[8] - skey->saferp.K[i+1][8]) & 255] ^ skey->saferp.K[i][8];            \
77     b[9]  = (safer_ebox[(b[9] ^ skey->saferp.K[i+1][9]) & 255] - skey->saferp.K[i][9]) & 255;    \
78     b[10] = (safer_ebox[(b[10] ^ skey->saferp.K[i+1][10]) & 255] - skey->saferp.K[i][10]) & 255; \
79     b[11] = safer_lbox[(b[11] - skey->saferp.K[i+1][11]) & 255] ^ skey->saferp.K[i][11];         \
80     b[12] = safer_lbox[(b[12] - skey->saferp.K[i+1][12]) & 255] ^ skey->saferp.K[i][12];         \
81     b[13] = (safer_ebox[(b[13] ^ skey->saferp.K[i+1][13]) & 255] - skey->saferp.K[i][13]) & 255; \
82     b[14] = (safer_ebox[(b[14] ^ skey->saferp.K[i+1][14]) & 255] - skey->saferp.K[i][14]) & 255; \
83     b[15] = safer_lbox[(b[15] - skey->saferp.K[i+1][15]) & 255] ^ skey->saferp.K[i][15];         \
84 } while (0)
85 
86 /* This is a forward single layer PHT transform.  */
87 #define PHT(b) do {                                          \
88     b[0]  = (b[0] + (b[1] = (b[0] + b[1]) & 255)) & 255;     \
89     b[2]  = (b[2] + (b[3] = (b[3] + b[2]) & 255)) & 255;     \
90     b[4]  = (b[4] + (b[5] = (b[5] + b[4]) & 255)) & 255;     \
91     b[6]  = (b[6] + (b[7] = (b[7] + b[6]) & 255)) & 255;     \
92     b[8]  = (b[8] + (b[9] = (b[9] + b[8]) & 255)) & 255;     \
93     b[10] = (b[10] + (b[11] = (b[11] + b[10]) & 255)) & 255; \
94     b[12] = (b[12] + (b[13] = (b[13] + b[12]) & 255)) & 255; \
95     b[14] = (b[14] + (b[15] = (b[15] + b[14]) & 255)) & 255; \
96 } while (0)
97 
98 /* This is an inverse single layer PHT transform */
99 #define iPHT(b) do {                                          \
100     b[15] = (b[15] - (b[14] = (b[14] - b[15]) & 255)) & 255;  \
101     b[13] = (b[13] - (b[12] = (b[12] - b[13]) & 255)) & 255;  \
102     b[11] = (b[11] - (b[10] = (b[10] - b[11]) & 255)) & 255;  \
103     b[9]  = (b[9] - (b[8] = (b[8] - b[9]) & 255)) & 255;      \
104     b[7]  = (b[7] - (b[6] = (b[6] - b[7]) & 255)) & 255;      \
105     b[5]  = (b[5] - (b[4] = (b[4] - b[5]) & 255)) & 255;      \
106     b[3]  = (b[3] - (b[2] = (b[2] - b[3]) & 255)) & 255;      \
107     b[1]  = (b[1] - (b[0] = (b[0] - b[1]) & 255)) & 255;      \
108  } while (0)
109 
110 /* This is the "Armenian" Shuffle.  It takes the input from b and stores it in b2 */
111 #define SHUF(b, b2) do {                                         \
112     b2[0] = b[8]; b2[1] = b[11]; b2[2] = b[12]; b2[3] = b[15];   \
113     b2[4] = b[2]; b2[5] = b[1]; b2[6] = b[6]; b2[7] = b[5];      \
114     b2[8] = b[10]; b2[9] = b[9]; b2[10] = b[14]; b2[11] = b[13]; \
115     b2[12] = b[0]; b2[13] = b[7]; b2[14] = b[4]; b2[15] = b[3];  \
116 } while (0)
117 
118 /* This is the inverse shuffle.  It takes from b and gives to b2 */
119 #define iSHUF(b, b2) do {                                          \
120     b2[0] = b[12]; b2[1] = b[5]; b2[2] = b[4]; b2[3] = b[15];      \
121     b2[4] = b[14]; b2[5] = b[7]; b2[6] = b[6]; b2[7] = b[13];      \
122     b2[8] = b[0]; b2[9] = b[9]; b2[10] = b[8]; b2[11] = b[1];      \
123     b2[12] = b[2]; b2[13] = b[11]; b2[14] = b[10]; b2[15] = b[3];  \
124 } while (0)
125 
126 /* The complete forward Linear Transform layer.
127  * Note that alternating usage of b and b2.
128  * Each round of LT starts in 'b' and ends in 'b2'.
129  */
130 #define LT(b, b2) do {        \
131     PHT(b);  SHUF(b, b2);     \
132     PHT(b2); SHUF(b2, b);     \
133     PHT(b);  SHUF(b, b2);     \
134     PHT(b2);                  \
135 } while (0)
136 
137 /* This is the inverse linear transform layer.  */
138 #define iLT(b, b2) do {       \
139     iPHT(b);                  \
140     iSHUF(b, b2); iPHT(b2);   \
141     iSHUF(b2, b); iPHT(b);    \
142     iSHUF(b, b2); iPHT(b2);   \
143 } while (0)
144 
145 #ifdef LTC_SMALL_CODE
146 
_round(unsigned char * b,int i,const symmetric_key * skey)147 static void _round(unsigned char *b, int i, const symmetric_key *skey)
148 {
149    ROUND(b, i);
150 }
151 
_iround(unsigned char * b,int i,const symmetric_key * skey)152 static void _iround(unsigned char *b, int i, const symmetric_key *skey)
153 {
154    iROUND(b, i);
155 }
156 
_lt(unsigned char * b,unsigned char * b2)157 static void _lt(unsigned char *b, unsigned char *b2)
158 {
159    LT(b, b2);
160 }
161 
_ilt(unsigned char * b,unsigned char * b2)162 static void _ilt(unsigned char *b, unsigned char *b2)
163 {
164    iLT(b, b2);
165 }
166 
167 #undef ROUND
168 #define ROUND(b, i) _round(b, i, skey)
169 
170 #undef iROUND
171 #define iROUND(b, i) _iround(b, i, skey)
172 
173 #undef LT
174 #define LT(b, b2) _lt(b, b2)
175 
176 #undef iLT
177 #define iLT(b, b2) _ilt(b, b2)
178 
179 #endif
180 
181 /* These are the 33, 128-bit bias words for the key schedule */
182 static const unsigned char safer_bias[33][16] = {
183 {  70, 151, 177, 186, 163, 183,  16,  10, 197,  55, 179, 201,  90,  40, 172, 100},
184 { 236, 171, 170, 198, 103, 149,  88,  13, 248, 154, 246, 110, 102, 220,   5,  61},
185 { 138, 195, 216, 137, 106, 233,  54,  73,  67, 191, 235, 212, 150, 155, 104, 160},
186 {  93,  87, 146,  31, 213, 113,  92, 187,  34, 193, 190, 123, 188, 153,  99, 148},
187 {  42,  97, 184,  52,  50,  25, 253, 251,  23,  64, 230,  81,  29,  65,  68, 143},
188 { 221,   4, 128, 222, 231,  49, 214, 127,   1, 162, 247,  57, 218, 111,  35, 202},
189 {  58, 208,  28, 209,  48,  62,  18, 161, 205,  15, 224, 168, 175, 130,  89,  44},
190 { 125, 173, 178, 239, 194, 135, 206, 117,   6,  19,   2, 144,  79,  46, 114,  51},
191 { 192, 141, 207, 169, 129, 226, 196,  39,  47, 108, 122, 159,  82, 225,  21,  56},
192 { 252,  32,  66, 199,   8, 228,   9,  85,  94, 140,  20, 118,  96, 255, 223, 215},
193 { 250,  11,  33,   0,  26, 249, 166, 185, 232, 158,  98,  76, 217, 145,  80, 210},
194 {  24, 180,   7, 132, 234,  91, 164, 200,  14, 203,  72, 105,  75,  78, 156,  53},
195 {  69,  77,  84, 229,  37,  60,  12,  74, 139,  63, 204, 167, 219, 107, 174, 244},
196 {  45, 243, 124, 109, 157, 181,  38, 116, 242, 147,  83, 176, 240,  17, 237, 131},
197 { 182,   3,  22, 115,  59,  30, 142, 112, 189, 134,  27,  71, 126,  36,  86, 241},
198 { 136,  70, 151, 177, 186, 163, 183,  16,  10, 197,  55, 179, 201,  90,  40, 172},
199 { 220, 134, 119, 215, 166,  17, 251, 244, 186, 146, 145, 100, 131, 241,  51, 239},
200 {  44, 181, 178,  43, 136, 209, 153, 203, 140, 132,  29,  20, 129, 151, 113, 202},
201 { 163, 139,  87,  60, 130, 196,  82,  92,  28, 232, 160,   4, 180, 133,  74, 246},
202 {  84, 182, 223,  12,  26, 142, 222, 224,  57, 252,  32, 155,  36,  78, 169, 152},
203 { 171, 242,  96, 208, 108, 234, 250, 199, 217,   0, 212,  31, 110,  67, 188, 236},
204 { 137, 254, 122,  93,  73, 201,  50, 194, 249, 154, 248, 109,  22, 219,  89, 150},
205 { 233, 205, 230,  70,  66, 143,  10, 193, 204, 185, 101, 176, 210, 198, 172,  30},
206 {  98,  41,  46,  14, 116,  80,   2,  90, 195,  37, 123, 138,  42,  91, 240,   6},
207 {  71, 111, 112, 157, 126,  16, 206,  18,  39, 213,  76,  79, 214, 121,  48, 104},
208 { 117, 125, 228, 237, 128, 106, 144,  55, 162,  94, 118, 170, 197, 127,  61, 175},
209 { 229,  25,  97, 253,  77, 124, 183,  11, 238, 173,  75,  34, 245, 231, 115,  35},
210 { 200,   5, 225, 102, 221, 179,  88, 105,  99,  86,  15, 161,  49, 149,  23,   7},
211 {  40,   1,  45, 226, 147, 190,  69,  21, 174, 120,   3, 135, 164, 184,  56, 207},
212 {   8, 103,   9, 148, 235,  38, 168, 107, 189,  24,  52,  27, 187, 191, 114, 247},
213 {  53,  72, 156,  81,  47,  59,  85, 227, 192, 159, 216, 211, 243, 141, 177, 255},
214 {  62, 220, 134, 119, 215, 166,  17, 251, 244, 186, 146, 145, 100, 131, 241,  51}};
215 
216  /**
217     Initialize the LTC_SAFER+ block cipher
218     @param key The symmetric key you wish to pass
219     @param keylen The key length in bytes
220     @param num_rounds The number of rounds desired (0 for default)
221     @param skey The key in as scheduled by this function.
222     @return CRYPT_OK if successful
223  */
saferp_setup(const unsigned char * key,int keylen,int num_rounds,symmetric_key * skey)224 int saferp_setup(const unsigned char *key, int keylen, int num_rounds, symmetric_key *skey)
225 {
226    unsigned x, y, z;
227    unsigned char t[33];
228    static const int rounds[3] = { 8, 12, 16 };
229 
230    LTC_ARGCHK(key  != NULL);
231    LTC_ARGCHK(skey != NULL);
232 
233    /* check arguments */
234    if (keylen != 16 && keylen != 24 && keylen != 32) {
235       return CRYPT_INVALID_KEYSIZE;
236    }
237 
238    /* Is the number of rounds valid?  Either use zero for default or
239     * 8,12,16 rounds for 16,24,32 byte keys
240     */
241    if (num_rounds != 0 && num_rounds != rounds[(keylen/8)-2]) {
242       return CRYPT_INVALID_ROUNDS;
243    }
244 
245    /* 128 bit key version */
246    if (keylen == 16) {
247        /* copy key into t */
248        for (x = y = 0; x < 16; x++) {
249            t[x] = key[x];
250            y ^= key[x];
251        }
252        t[16] = y;
253 
254        /* make round keys */
255        for (x = 0; x < 16; x++) {
256            skey->saferp.K[0][x] = t[x];
257        }
258 
259        /* make the 16 other keys as a transformation of the first key */
260        for (x = 1; x < 17; x++) {
261            /* rotate 3 bits each */
262            for (y = 0; y < 17; y++) {
263                t[y] = ((t[y]<<3)|(t[y]>>5)) & 255;
264            }
265 
266            /* select and add */
267            z = x;
268            for (y = 0; y < 16; y++) {
269                skey->saferp.K[x][y] = (t[z] + safer_bias[x-1][y]) & 255;
270                if (++z == 17) { z = 0; }
271            }
272        }
273        skey->saferp.rounds = 8;
274    } else if (keylen == 24) {
275        /* copy key into t */
276        for (x = y = 0; x < 24; x++) {
277            t[x] = key[x];
278            y ^= key[x];
279        }
280        t[24] = y;
281 
282        /* make round keys */
283        for (x = 0; x < 16; x++) {
284            skey->saferp.K[0][x] = t[x];
285        }
286 
287        for (x = 1; x < 25; x++) {
288            /* rotate 3 bits each */
289            for (y = 0; y < 25; y++) {
290                t[y] = ((t[y]<<3)|(t[y]>>5)) & 255;
291            }
292 
293            /* select and add */
294            z = x;
295            for (y = 0; y < 16; y++) {
296                skey->saferp.K[x][y] = (t[z] + safer_bias[x-1][y]) & 255;
297                if (++z == 25) { z = 0; }
298            }
299        }
300        skey->saferp.rounds = 12;
301    } else {
302        /* copy key into t */
303        for (x = y = 0; x < 32; x++) {
304            t[x] = key[x];
305            y ^= key[x];
306        }
307        t[32] = y;
308 
309        /* make round keys */
310        for (x = 0; x < 16; x++) {
311            skey->saferp.K[0][x] = t[x];
312        }
313 
314        for (x = 1; x < 33; x++) {
315            /* rotate 3 bits each */
316            for (y = 0; y < 33; y++) {
317                t[y] = ((t[y]<<3)|(t[y]>>5)) & 255;
318            }
319 
320            /* select and add */
321            z = x;
322            for (y = 0; y < 16; y++) {
323                skey->saferp.K[x][y] = (t[z] + safer_bias[x-1][y]) & 255;
324                if (++z == 33) { z = 0; }
325            }
326        }
327        skey->saferp.rounds = 16;
328    }
329 #ifdef LTC_CLEAN_STACK
330    zeromem(t, sizeof(t));
331 #endif
332    return CRYPT_OK;
333 }
334 
335 /**
336   Encrypts a block of text with LTC_SAFER+
337   @param pt The input plaintext (16 bytes)
338   @param ct The output ciphertext (16 bytes)
339   @param skey The key as scheduled
340   @return CRYPT_OK if successful
341 */
saferp_ecb_encrypt(const unsigned char * pt,unsigned char * ct,const symmetric_key * skey)342 int saferp_ecb_encrypt(const unsigned char *pt, unsigned char *ct, const symmetric_key *skey)
343 {
344    unsigned char b[16];
345    int x;
346 
347    LTC_ARGCHK(pt   != NULL);
348    LTC_ARGCHK(ct   != NULL);
349    LTC_ARGCHK(skey != NULL);
350 
351    /* do eight rounds */
352    for (x = 0; x < 16; x++) {
353        b[x] = pt[x];
354    }
355    ROUND(b,  0);  LT(b, ct);
356    ROUND(ct, 2);  LT(ct, b);
357    ROUND(b,  4);  LT(b, ct);
358    ROUND(ct, 6);  LT(ct, b);
359    ROUND(b,  8);  LT(b, ct);
360    ROUND(ct, 10); LT(ct, b);
361    ROUND(b,  12); LT(b, ct);
362    ROUND(ct, 14); LT(ct, b);
363    /* 192-bit key? */
364    if (skey->saferp.rounds > 8) {
365       ROUND(b, 16);  LT(b, ct);
366       ROUND(ct, 18); LT(ct, b);
367       ROUND(b, 20);  LT(b, ct);
368       ROUND(ct, 22); LT(ct, b);
369    }
370    /* 256-bit key? */
371    if (skey->saferp.rounds > 12) {
372       ROUND(b, 24);  LT(b, ct);
373       ROUND(ct, 26); LT(ct, b);
374       ROUND(b, 28);  LT(b, ct);
375       ROUND(ct, 30); LT(ct, b);
376    }
377    ct[0] = b[0] ^ skey->saferp.K[skey->saferp.rounds*2][0];
378    ct[1] = (b[1] + skey->saferp.K[skey->saferp.rounds*2][1]) & 255;
379    ct[2] = (b[2] + skey->saferp.K[skey->saferp.rounds*2][2]) & 255;
380    ct[3] = b[3] ^ skey->saferp.K[skey->saferp.rounds*2][3];
381    ct[4] = b[4] ^ skey->saferp.K[skey->saferp.rounds*2][4];
382    ct[5] = (b[5] + skey->saferp.K[skey->saferp.rounds*2][5]) & 255;
383    ct[6] = (b[6] + skey->saferp.K[skey->saferp.rounds*2][6]) & 255;
384    ct[7] = b[7] ^ skey->saferp.K[skey->saferp.rounds*2][7];
385    ct[8] = b[8] ^ skey->saferp.K[skey->saferp.rounds*2][8];
386    ct[9] = (b[9] + skey->saferp.K[skey->saferp.rounds*2][9]) & 255;
387    ct[10] = (b[10] + skey->saferp.K[skey->saferp.rounds*2][10]) & 255;
388    ct[11] = b[11] ^ skey->saferp.K[skey->saferp.rounds*2][11];
389    ct[12] = b[12] ^ skey->saferp.K[skey->saferp.rounds*2][12];
390    ct[13] = (b[13] + skey->saferp.K[skey->saferp.rounds*2][13]) & 255;
391    ct[14] = (b[14] + skey->saferp.K[skey->saferp.rounds*2][14]) & 255;
392    ct[15] = b[15] ^ skey->saferp.K[skey->saferp.rounds*2][15];
393 #ifdef LTC_CLEAN_STACK
394    zeromem(b, sizeof(b));
395 #endif
396    return CRYPT_OK;
397 }
398 
399 /**
400   Decrypts a block of text with LTC_SAFER+
401   @param ct The input ciphertext (16 bytes)
402   @param pt The output plaintext (16 bytes)
403   @param skey The key as scheduled
404   @return CRYPT_OK if successful
405 */
saferp_ecb_decrypt(const unsigned char * ct,unsigned char * pt,const symmetric_key * skey)406 int saferp_ecb_decrypt(const unsigned char *ct, unsigned char *pt, const symmetric_key *skey)
407 {
408    unsigned char b[16];
409    int x;
410 
411    LTC_ARGCHK(pt   != NULL);
412    LTC_ARGCHK(ct   != NULL);
413    LTC_ARGCHK(skey != NULL);
414 
415    /* do eight rounds */
416    b[0] = ct[0] ^ skey->saferp.K[skey->saferp.rounds*2][0];
417    b[1] = (ct[1] - skey->saferp.K[skey->saferp.rounds*2][1]) & 255;
418    b[2] = (ct[2] - skey->saferp.K[skey->saferp.rounds*2][2]) & 255;
419    b[3] = ct[3] ^ skey->saferp.K[skey->saferp.rounds*2][3];
420    b[4] = ct[4] ^ skey->saferp.K[skey->saferp.rounds*2][4];
421    b[5] = (ct[5] - skey->saferp.K[skey->saferp.rounds*2][5]) & 255;
422    b[6] = (ct[6] - skey->saferp.K[skey->saferp.rounds*2][6]) & 255;
423    b[7] = ct[7] ^ skey->saferp.K[skey->saferp.rounds*2][7];
424    b[8] = ct[8] ^ skey->saferp.K[skey->saferp.rounds*2][8];
425    b[9] = (ct[9] - skey->saferp.K[skey->saferp.rounds*2][9]) & 255;
426    b[10] = (ct[10] - skey->saferp.K[skey->saferp.rounds*2][10]) & 255;
427    b[11] = ct[11] ^ skey->saferp.K[skey->saferp.rounds*2][11];
428    b[12] = ct[12] ^ skey->saferp.K[skey->saferp.rounds*2][12];
429    b[13] = (ct[13] - skey->saferp.K[skey->saferp.rounds*2][13]) & 255;
430    b[14] = (ct[14] - skey->saferp.K[skey->saferp.rounds*2][14]) & 255;
431    b[15] = ct[15] ^ skey->saferp.K[skey->saferp.rounds*2][15];
432    /* 256-bit key? */
433    if (skey->saferp.rounds > 12) {
434       iLT(b, pt); iROUND(pt, 30);
435       iLT(pt, b); iROUND(b, 28);
436       iLT(b, pt); iROUND(pt, 26);
437       iLT(pt, b); iROUND(b, 24);
438    }
439    /* 192-bit key? */
440    if (skey->saferp.rounds > 8) {
441       iLT(b, pt); iROUND(pt, 22);
442       iLT(pt, b); iROUND(b, 20);
443       iLT(b, pt); iROUND(pt, 18);
444       iLT(pt, b); iROUND(b, 16);
445    }
446    iLT(b, pt); iROUND(pt, 14);
447    iLT(pt, b); iROUND(b, 12);
448    iLT(b, pt); iROUND(pt,10);
449    iLT(pt, b); iROUND(b, 8);
450    iLT(b, pt); iROUND(pt,6);
451    iLT(pt, b); iROUND(b, 4);
452    iLT(b, pt); iROUND(pt,2);
453    iLT(pt, b); iROUND(b, 0);
454    for (x = 0; x < 16; x++) {
455        pt[x] = b[x];
456    }
457 #ifdef LTC_CLEAN_STACK
458    zeromem(b, sizeof(b));
459 #endif
460    return CRYPT_OK;
461 }
462 
463 /**
464   Performs a self-test of the LTC_SAFER+ block cipher
465   @return CRYPT_OK if functional, CRYPT_NOP if self-test has been disabled
466 */
saferp_test(void)467 int saferp_test(void)
468 {
469  #ifndef LTC_TEST
470     return CRYPT_NOP;
471  #else
472    static const struct {
473        int keylen;
474        unsigned char key[32], pt[16], ct[16];
475    } tests[] = {
476        {
477            16,
478            { 41, 35, 190, 132, 225, 108, 214, 174,
479              82, 144, 73, 241, 241, 187, 233, 235 },
480            { 179, 166, 219, 60, 135, 12, 62, 153,
481              36, 94, 13, 28, 6, 183, 71, 222 },
482            { 224, 31, 182, 10, 12, 255, 84, 70,
483              127, 13, 89, 249, 9, 57, 165, 220 }
484        }, {
485            24,
486            { 72, 211, 143, 117, 230, 217, 29, 42,
487              229, 192, 247, 43, 120, 129, 135, 68,
488              14, 95, 80, 0, 212, 97, 141, 190 },
489            { 123, 5, 21, 7, 59, 51, 130, 31,
490              24, 112, 146, 218, 100, 84, 206, 177 },
491            { 92, 136, 4, 63, 57, 95, 100, 0,
492              150, 130, 130, 16, 193, 111, 219, 133 }
493        }, {
494            32,
495            { 243, 168, 141, 254, 190, 242, 235, 113,
496              255, 160, 208, 59, 117, 6, 140, 126,
497              135, 120, 115, 77, 208, 190, 130, 190,
498              219, 194, 70, 65, 43, 140, 250, 48 },
499            { 127, 112, 240, 167, 84, 134, 50, 149,
500              170, 91, 104, 19, 11, 230, 252, 245 },
501            { 88, 11, 25, 36, 172, 229, 202, 213,
502              170, 65, 105, 153, 220, 104, 153, 138 }
503        }
504     };
505 
506    unsigned char tmp[2][16];
507    symmetric_key skey;
508    int err, i, y;
509 
510    for (i = 0; i < (int)(sizeof(tests) / sizeof(tests[0])); i++) {
511       if ((err = saferp_setup(tests[i].key, tests[i].keylen, 0, &skey)) != CRYPT_OK)  {
512          return err;
513       }
514       saferp_ecb_encrypt(tests[i].pt, tmp[0], &skey);
515       saferp_ecb_decrypt(tmp[0], tmp[1], &skey);
516 
517       /* compare */
518       if (compare_testvector(tmp[0], 16, tests[i].ct, 16, "Safer+ Encrypt", i) ||
519             compare_testvector(tmp[1], 16, tests[i].pt, 16, "Safer+ Decrypt", i)) {
520          return CRYPT_FAIL_TESTVECTOR;
521       }
522 
523       /* now see if we can encrypt all zero bytes 1000 times, decrypt and come back where we started */
524       for (y = 0; y < 16; y++) tmp[0][y] = 0;
525       for (y = 0; y < 1000; y++) saferp_ecb_encrypt(tmp[0], tmp[0], &skey);
526       for (y = 0; y < 1000; y++) saferp_ecb_decrypt(tmp[0], tmp[0], &skey);
527       for (y = 0; y < 16; y++) if (tmp[0][y] != 0) return CRYPT_FAIL_TESTVECTOR;
528    }
529 
530    return CRYPT_OK;
531  #endif
532 }
533 
534 /** Terminate the context
535    @param skey    The scheduled key
536 */
saferp_done(symmetric_key * skey)537 void saferp_done(symmetric_key *skey)
538 {
539   LTC_UNUSED_PARAM(skey);
540 }
541 
542 /**
543   Gets suitable key size
544   @param keysize [in/out] The length of the recommended key (in bytes).  This function will store the suitable size back in this variable.
545   @return CRYPT_OK if the input key size is acceptable.
546 */
saferp_keysize(int * keysize)547 int saferp_keysize(int *keysize)
548 {
549    LTC_ARGCHK(keysize != NULL);
550 
551    if (*keysize < 16) {
552       return CRYPT_INVALID_KEYSIZE;
553    }
554    if (*keysize < 24) {
555       *keysize = 16;
556    } else if (*keysize < 32) {
557       *keysize = 24;
558    } else {
559       *keysize = 32;
560    }
561    return CRYPT_OK;
562 }
563 
564 #endif
565 
566 
567 
568 /* ref:         $Format:%D$ */
569 /* git commit:  $Format:%H$ */
570 /* commit time: $Format:%ai$ */
571