3 * The Serpent block cipher
5 * (c) 2000 Straylight/Edgeware
8 /*----- Licensing notice --------------------------------------------------*
10 * This file is part of Catacomb.
12 * Catacomb is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU Library General Public License as
14 * published by the Free Software Foundation; either version 2 of the
15 * License, or (at your option) any later version.
17 * Catacomb is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU Library General Public License for more details.
22 * You should have received a copy of the GNU Library General Public
23 * License along with Catacomb; if not, write to the Free
24 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
28 /*----- Header files ------------------------------------------------------*/
33 #include <mLib/bits.h>
38 #include "serpent-sbox.h"
40 /*----- Global variables --------------------------------------------------*/
42 const octet serpent_keysz[] = { KSZ_RANGE, SERPENT_KEYSZ, 0, 32, 1 };
44 /*----- Main code ---------------------------------------------------------*/
46 /* --- @serpent_init@ --- *
48 * Arguments: @serpent_ctx *k@ = pointer to context block to initialize
49 * @const void *buf@ = pointer to input buffer
50 * @size_t sz@ = size of input buffer
54 * Use: Initializes a Serpent context. The key may be any length of
55 * up to 32 bytes (256 bits).
58 void serpent_init(serpent_ctx *k, const void *buf, size_t sz)
66 KSZ_ASSERT(serpent, sz);
68 /* --- Read the key into the buffer --- */
72 i = 0; p = buf; q = p + sz;
75 a |= (uint32)*p++ << b;
83 /* --- Pad short keys --- */
93 /* --- Expand the prekeys to fill the buffer --- */
95 for (i = 8; i < 8 + 132; i++) {
96 uint32 x = (pk[i - 8] ^ pk[i - 5] ^ pk[i - 3] ^ pk[i - 1] ^
97 (i - 8) ^ 0x9e3779b9);
98 k->k[i - 8] = pk[i] = ROL32(x, 11);
101 /* --- Now substitute everything --- */
106 #define KSUB(r) do { \
108 a = k->k[i]; b = k->k[i + 1]; c = k->k[i + 2]; d = k->k[i + 3]; \
110 k->k[i] = a; k->k[i + 1] = b; k->k[i + 2] = c; k->k[i + 3] = d; \
113 KSUB(2); KSUB(1); KSUB(0); KSUB(7);
114 KSUB(6); KSUB(5); KSUB(4);
121 /* --- @serpent_eblk@, @serpent_dblk@ --- *
123 * Arguments: @const serpent_ctx *k@ = pointer to key context
124 * @const uint32 s[4]@ = pointer to source block
125 * @uint32 d[4]@ = pointer to destination block
129 * Use: Low-level block encryption.
132 #define EROUND(a, b, c, d, r, k) do { \
133 a ^= *k++; b ^= *k++; c ^= *k++; d ^= *k++; \
135 a = ROL32(a, 13); c = ROL32(c, 3); b ^= a ^ c; d ^= c ^ (a << 3); \
136 b = ROL32(b, 1); d = ROL32(d, 7); a ^= b ^ d; c ^= d ^ (b << 7); \
137 a = ROL32(a, 5); c = ROL32(c, 22); \
140 #define DROUND(a, b, c, d, r, k) do { \
142 d ^= *--k; c ^= *--k; b ^= *--k; a ^= *--k; \
143 a = ROR32(a, 5); c = ROR32(c, 22); a ^= b ^ d; c ^= d ^ (b << 7); \
144 b = ROR32(b, 1); d = ROR32(d, 7); b ^= a ^ c; d ^= c ^ (a << 3); \
145 a = ROR32(a, 13); c = ROR32(c, 3); \
148 void serpent_eblk(const serpent_ctx *k, const uint32 *s, uint32 *d)
150 uint32 aa = s[0], bb = s[1], cc = s[2], dd = s[3];
151 const uint32 *kk = k->k;
153 EROUND(aa, bb, cc, dd, 0, kk); EROUND(aa, bb, cc, dd, 1, kk);
154 EROUND(aa, bb, cc, dd, 2, kk); EROUND(aa, bb, cc, dd, 3, kk);
155 EROUND(aa, bb, cc, dd, 4, kk); EROUND(aa, bb, cc, dd, 5, kk);
156 EROUND(aa, bb, cc, dd, 6, kk); EROUND(aa, bb, cc, dd, 7, kk);
158 EROUND(aa, bb, cc, dd, 0, kk); EROUND(aa, bb, cc, dd, 1, kk);
159 EROUND(aa, bb, cc, dd, 2, kk); EROUND(aa, bb, cc, dd, 3, kk);
160 EROUND(aa, bb, cc, dd, 4, kk); EROUND(aa, bb, cc, dd, 5, kk);
161 EROUND(aa, bb, cc, dd, 6, kk); EROUND(aa, bb, cc, dd, 7, kk);
163 EROUND(aa, bb, cc, dd, 0, kk); EROUND(aa, bb, cc, dd, 1, kk);
164 EROUND(aa, bb, cc, dd, 2, kk); EROUND(aa, bb, cc, dd, 3, kk);
165 EROUND(aa, bb, cc, dd, 4, kk); EROUND(aa, bb, cc, dd, 5, kk);
166 EROUND(aa, bb, cc, dd, 6, kk); EROUND(aa, bb, cc, dd, 7, kk);
168 EROUND(aa, bb, cc, dd, 0, kk); EROUND(aa, bb, cc, dd, 1, kk);
169 EROUND(aa, bb, cc, dd, 2, kk); EROUND(aa, bb, cc, dd, 3, kk);
170 EROUND(aa, bb, cc, dd, 4, kk); EROUND(aa, bb, cc, dd, 5, kk);
171 EROUND(aa, bb, cc, dd, 6, kk);
173 aa ^= *kk++; bb ^= *kk++; cc ^= *kk++; dd ^= *kk++;
175 aa ^= *kk++; bb ^= *kk++; cc ^= *kk++; dd ^= *kk++;
176 d[0] = aa; d[1] = bb; d[2] = cc; d[3] = dd;
179 void serpent_dblk(const serpent_ctx *k, const uint32 *s, uint32 *d)
181 uint32 aa = s[0], bb = s[1], cc = s[2], dd = s[3];
182 const uint32 *kk = k->k + 132;
184 dd ^= *--kk; cc ^= *--kk; bb ^= *--kk; aa ^= *--kk;
186 DROUND(aa, bb, cc, dd, 7, kk); DROUND(aa, bb, cc, dd, 6, kk);
187 DROUND(aa, bb, cc, dd, 5, kk); DROUND(aa, bb, cc, dd, 4, kk);
188 DROUND(aa, bb, cc, dd, 3, kk); DROUND(aa, bb, cc, dd, 2, kk);
189 DROUND(aa, bb, cc, dd, 1, kk); DROUND(aa, bb, cc, dd, 0, kk);
191 DROUND(aa, bb, cc, dd, 7, kk); DROUND(aa, bb, cc, dd, 6, kk);
192 DROUND(aa, bb, cc, dd, 5, kk); DROUND(aa, bb, cc, dd, 4, kk);
193 DROUND(aa, bb, cc, dd, 3, kk); DROUND(aa, bb, cc, dd, 2, kk);
194 DROUND(aa, bb, cc, dd, 1, kk); DROUND(aa, bb, cc, dd, 0, kk);
196 DROUND(aa, bb, cc, dd, 7, kk); DROUND(aa, bb, cc, dd, 6, kk);
197 DROUND(aa, bb, cc, dd, 5, kk); DROUND(aa, bb, cc, dd, 4, kk);
198 DROUND(aa, bb, cc, dd, 3, kk); DROUND(aa, bb, cc, dd, 2, kk);
199 DROUND(aa, bb, cc, dd, 1, kk); DROUND(aa, bb, cc, dd, 0, kk);
201 DROUND(aa, bb, cc, dd, 7, kk); DROUND(aa, bb, cc, dd, 6, kk);
202 DROUND(aa, bb, cc, dd, 5, kk); DROUND(aa, bb, cc, dd, 4, kk);
203 DROUND(aa, bb, cc, dd, 3, kk); DROUND(aa, bb, cc, dd, 2, kk);
204 DROUND(aa, bb, cc, dd, 1, kk);
207 dd ^= *--kk; cc ^= *--kk; bb ^= *--kk; aa ^= *--kk;
208 d[0] = aa; d[1] = bb; d[2] = cc; d[3] = dd;
211 BLKC_TEST(SERPENT, serpent)
213 /*----- That's all, folks -------------------------------------------------*/