3 * The CAST-256 block cipher
5 * (c) 2000 Straylight/Edgeware
8 /*----- Licensing notice --------------------------------------------------*
10 * This file is part of Catacomb.
12 * Catacomb is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU Library General Public License as
14 * published by the Free Software Foundation; either version 2 of the
15 * License, or (at your option) any later version.
17 * Catacomb is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU Library General Public License for more details.
22 * You should have received a copy of the GNU Library General Public
23 * License along with Catacomb; if not, write to the Free
24 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
28 /*----- Header files ------------------------------------------------------*/
35 #include <mLib/bits.h>
38 #include "cast-base.h"
43 /*----- Global variables --------------------------------------------------*/
45 const octet cast256_keysz[] = { KSZ_RANGE, CAST256_KEYSZ, 0, 32, 1 };
47 /*----- Main code ---------------------------------------------------------*/
49 /* --- @cast256_init@ --- *
51 * Arguments: @cast128_ctx *k@ = pointer to key block to fill in
52 * @const void *buf@ = pointer to buffer of key material
53 * @size_t sz@ = size of key material
57 * Use: Initializes a CAST-256 key buffer. CAST-256 accepts
58 * 256-bit keys or shorter.
61 void cast256_init(cast256_ctx *k, const void *buf, size_t sz)
68 uint32 a, b, c, d, e, f, g, h;
72 /* --- Fiddle with the key size --- */
74 KSZ_ASSERT(cast256, sz);
76 /* --- Read the key into the array --- */
84 a |= ((uint32)*p++ << b);
100 /* --- Read the key words out --- */
102 a = kk[0]; b = kk[1]; c = kk[2]; d = kk[3];
103 e = kk[4]; f = kk[5]; g = kk[6]; h = kk[7];
105 #define ROOT2 0x5a827999
106 #define ROOT3 0x6ed9eba1
113 for (i = 0; i < 12; i++) {
114 for (j = 0; j < 2; j++) {
115 CAST_R1(m, r, g, h); m += ROOT3; r = (r + 17) & 0x1f;
116 CAST_R2(m, r, f, g); m += ROOT3; r = (r + 17) & 0x1f;
117 CAST_R3(m, r, e, f); m += ROOT3; r = (r + 17) & 0x1f;
118 CAST_R1(m, r, d, e); m += ROOT3; r = (r + 17) & 0x1f;
119 CAST_R2(m, r, c, d); m += ROOT3; r = (r + 17) & 0x1f;
120 CAST_R3(m, r, b, c); m += ROOT3; r = (r + 17) & 0x1f;
121 CAST_R1(m, r, a, b); m += ROOT3; r = (r + 17) & 0x1f;
122 CAST_R2(m, r, h, a); m += ROOT3; r = (r + 17) & 0x1f;
124 km[0] = h; km[1] = f; km[2] = d; km[3] = b;
125 kr[0] = a & 0x1f; kr[1] = c & 0x1f; kr[2] = e & 0x1f; kr[3] = g & 0x1f;
130 /* --- @cast256_eblk@, @cast256_dblk@ --- *
132 * Arguments: @const cast256_ctx *k@ = pointer to key block
133 * @const uint32 s[2]@ = pointer to source block
134 * @uint32 d[2]@ = pointer to destination block
138 * Use: Low-level block encryption and decryption.
141 #define Q0(k, r, a, b, c, d) do { \
142 CAST_R1(k[0], r[0], c, d); \
143 CAST_R2(k[1], r[1], b, c); \
144 CAST_R3(k[2], r[2], a, b); \
145 CAST_R1(k[3], r[3], d, a); \
148 #define Q1(k, r, a, b, c, d) do { \
149 CAST_R1(k[3], r[3], d, a); \
150 CAST_R3(k[2], r[2], a, b); \
151 CAST_R2(k[1], r[1], b, c); \
152 CAST_R1(k[0], r[0], c, d); \
155 void cast256_eblk(const cast256_ctx *k, const uint32 *s, uint32 *d)
157 uint32 aa = s[0], bb = s[1], cc = s[2], dd = s[3];
158 const uint32 *km = k->km;
159 const octet *kr = k->kr;
161 Q0(km, kr, aa, bb, cc, dd); km += 4; kr += 4;
162 Q0(km, kr, aa, bb, cc, dd); km += 4; kr += 4;
163 Q0(km, kr, aa, bb, cc, dd); km += 4; kr += 4;
164 Q0(km, kr, aa, bb, cc, dd); km += 4; kr += 4;
165 Q0(km, kr, aa, bb, cc, dd); km += 4; kr += 4;
166 Q0(km, kr, aa, bb, cc, dd); km += 4; kr += 4;
168 Q1(km, kr, aa, bb, cc, dd); km += 4; kr += 4;
169 Q1(km, kr, aa, bb, cc, dd); km += 4; kr += 4;
170 Q1(km, kr, aa, bb, cc, dd); km += 4; kr += 4;
171 Q1(km, kr, aa, bb, cc, dd); km += 4; kr += 4;
172 Q1(km, kr, aa, bb, cc, dd); km += 4; kr += 4;
173 Q1(km, kr, aa, bb, cc, dd); km += 4; kr += 4;
175 d[0] = aa; d[1] = bb; d[2] = cc; d[3] = dd;
178 void cast256_dblk(const cast256_ctx *k, const uint32 *s, uint32 *d)
180 uint32 aa = s[0], bb = s[1], cc = s[2], dd = s[3];
181 const uint32 *km = k->km + 48;
182 const octet *kr = k->kr + 48;
184 km -= 4; kr -= 4; Q0(km, kr, aa, bb, cc, dd);
185 km -= 4; kr -= 4; Q0(km, kr, aa, bb, cc, dd);
186 km -= 4; kr -= 4; Q0(km, kr, aa, bb, cc, dd);
187 km -= 4; kr -= 4; Q0(km, kr, aa, bb, cc, dd);
188 km -= 4; kr -= 4; Q0(km, kr, aa, bb, cc, dd);
189 km -= 4; kr -= 4; Q0(km, kr, aa, bb, cc, dd);
191 km -= 4; kr -= 4; Q1(km, kr, aa, bb, cc, dd);
192 km -= 4; kr -= 4; Q1(km, kr, aa, bb, cc, dd);
193 km -= 4; kr -= 4; Q1(km, kr, aa, bb, cc, dd);
194 km -= 4; kr -= 4; Q1(km, kr, aa, bb, cc, dd);
195 km -= 4; kr -= 4; Q1(km, kr, aa, bb, cc, dd);
196 km -= 4; kr -= 4; Q1(km, kr, aa, bb, cc, dd);
198 d[0] = aa; d[1] = bb; d[2] = cc; d[3] = dd;
201 BLKC_TEST(CAST256, cast256)
203 /*----- That's all, folks -------------------------------------------------*/