3 * Implementation of the IDEA cipher
5 * (c) 1999 Straylight/Edgeware
8 /*----- Licensing notice --------------------------------------------------*
10 * This file is part of Catacomb.
12 * Catacomb is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU Library General Public License as
14 * published by the Free Software Foundation; either version 2 of the
15 * License, or (at your option) any later version.
17 * Catacomb is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU Library General Public License for more details.
22 * You should have received a copy of the GNU Library General Public
23 * License along with Catacomb; if not, write to the Free
24 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
28 /*----- Header files ------------------------------------------------------*/
35 #include <mLib/bits.h>
41 /*----- Global variables --------------------------------------------------*/
43 const octet idea_keysz[] = { KSZ_SET, IDEA_KEYSZ };
45 /*----- Main code ---------------------------------------------------------*/
49 * Arguments: @uint16 n@ = number to invert
51 * Returns: Multiplicative inverse of @n@ %$\pmod{2^{16} + 1}$%.
53 * Use: Computes multiplicative inverses. This is handy for the
54 * decryption key scheduling.
57 static uint16 inv(uint16 n)
71 t = a; a = b - q * a; b = t;
80 * Arguments @x@ and @y@ are two 32-bit values to multiply. On exit, @x@ is
81 * the product of the two arguments. The result is not normalized back to 16
82 * bits; the arguments are not expected to be normalized.
84 * This code is from `Side Channel Attack Hardening of the IDEA Cipher',
85 * published by Ascom Tech.
88 #define MUL(x, y) do { \
94 _tt = (uint32)x * (uint32)_t + (uint32)x + (uint32)_t + 1; \
96 _t = U16(_tt >> 16); \
97 x = x - _t + (x <= _t); \
100 /* --- @idea_init@ --- *
102 * Arguments: @idea_ctx *k@ = pointer to key block
103 * @const void *buf@ = pointer to key buffer
104 * @size_t sz@ = size of key material
108 * Use: Initializes an IDEA key buffer. The buffer must be exactly
109 * 16 bytes in size, because IDEA is only defined with a key
113 void idea_init(idea_ctx *k, const void *buf, size_t sz)
115 KSZ_ASSERT(idea, sz);
117 /* --- Unpack the encryption key --- */
120 const octet *p = buf;
122 uint32 a = LOAD32(p + 0);
123 uint32 b = LOAD32(p + 4);
124 uint32 c = LOAD32(p + 8);
125 uint32 d = LOAD32(p + 12);
128 /* --- Main unpacking loop --- */
130 for (i = 0; i < 6; i++) {
132 /* --- Spit out the next 8 subkeys --- */
144 /* --- Rotate and permute the subkeys --- */
148 a = U32((a << 25) | (b >> 7));
149 b = U32((b << 25) | (c >> 7));
150 c = U32((c << 25) | (d >> 7));
151 d = U32((d << 25) | (t >> 7));
155 /* --- Write out the tail-enders --- */
163 /* --- Convert this into the decryption key --- */
166 uint16 *p = k->e + 52;
170 /* --- Translate the main round keys --- */
172 for (i = 0; i < 8; i++) {
179 q[1] = 0x10000 - p[4];
180 q[2] = 0x10000 - p[3];
182 q[1] = 0x10000 - p[3];
183 q[2] = 0x10000 - p[4];
188 /* --- Translate the tail-enders --- */
192 q[1] = 0x10000 - p[1];
193 q[2] = 0x10000 - p[2];
198 /* --- @ROUND@ --- */
200 #define MIX(k, a, b, c, d) do { \
207 #define MA(k, a, b, c, d) do { \
208 unsigned _u = a ^ c; \
209 unsigned _v = b ^ d; \
220 #define ROUND(k, a, b, c, d) do { \
221 MIX(k, a, b, c, d); \
226 /* --- Encryption --- */
228 #define EBLK(k, a, b, c, d) do { \
229 unsigned _a = U16(a >> 16); \
230 unsigned _b = U16(a >> 0); \
231 unsigned _c = U16(b >> 16); \
232 unsigned _d = U16(b >> 0); \
233 const uint16 *_k = (k); \
235 ROUND(_k, _a, _b, _c, _d); \
236 ROUND(_k, _a, _c, _b, _d); \
237 ROUND(_k, _a, _b, _c, _d); \
238 ROUND(_k, _a, _c, _b, _d); \
239 ROUND(_k, _a, _b, _c, _d); \
240 ROUND(_k, _a, _c, _b, _d); \
241 ROUND(_k, _a, _b, _c, _d); \
242 ROUND(_k, _a, _c, _b, _d); \
243 MIX (_k, _a, _c, _b, _d); \
244 c = ((uint32)U16(_a) << 16) | (uint32)U16(_c); \
245 d = ((uint32)U16(_b) << 16) | (uint32)U16(_d); \
248 #define DBLK(k, a, b) EBLK((k), (a), (b))
250 /* --- @idea_eblk@, @idea_dblk@ --- *
252 * Arguments: @const idea_ctx *k@ = pointer to a key block
253 * @const uint32 s[2]@ = pointer to source block
254 * @uint32 d[2]@ = pointer to destination block
258 * Use: Low-level block encryption and decryption.
261 void idea_eblk(const idea_ctx *k, const uint32 *s, uint32 *d)
263 EBLK(k->e, s[0], s[1], d[0], d[1]);
266 void idea_dblk(const idea_ctx *k, const uint32 *s, uint32 *d)
268 EBLK(k->d, s[0], s[1], d[0], d[1]);
271 BLKC_TEST(IDEA, idea)
273 /*----- That's all, folks -------------------------------------------------*/