| 1 | /*
|
|---|
| 2 | * dlls/rsaen/rc2.c
|
|---|
| 3 | * RC2 functions
|
|---|
| 4 | *
|
|---|
| 5 | * Copyright 2004 Michael Jung
|
|---|
| 6 | * Based on public domain code by Tom St Denis (tomstdenis@iahu.ca)
|
|---|
| 7 | *
|
|---|
| 8 | * This library is free software; you can redistribute it and/or
|
|---|
| 9 | * modify it under the terms of the GNU Lesser General Public
|
|---|
| 10 | * License as published by the Free Software Foundation; either
|
|---|
| 11 | * version 2.1 of the License, or (at your option) any later version.
|
|---|
| 12 | *
|
|---|
| 13 | * This library is distributed in the hope that it will be useful,
|
|---|
| 14 | * but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|---|
| 15 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|---|
| 16 | * Lesser General Public License for more details.
|
|---|
| 17 | *
|
|---|
| 18 | * You should have received a copy of the GNU Lesser General Public
|
|---|
| 19 | * License along with this library; if not, write to the Free Software
|
|---|
| 20 | * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
|
|---|
| 21 | */
|
|---|
| 22 |
|
|---|
| 23 | /*
|
|---|
| 24 | * This file contains code from the LibTomCrypt cryptographic
|
|---|
| 25 | * library written by Tom St Denis (tomstdenis@iahu.ca). LibTomCrypt
|
|---|
| 26 | * is in the public domain. The code in this file is tailored to
|
|---|
| 27 | * special requirements. Take a look at http://libtomcrypt.org for the
|
|---|
| 28 | * original version.
|
|---|
| 29 | */
|
|---|
| 30 |
|
|---|
| 31 | #include "tomcrypt.h"
|
|---|
| 32 |
|
|---|
| 33 | /* 256-entry permutation table, probably derived somehow from pi */
|
|---|
| 34 | static const unsigned char permute[256] = {
|
|---|
| 35 | 217,120,249,196, 25,221,181,237, 40,233,253,121, 74,160,216,157,
|
|---|
| 36 | 198,126, 55,131, 43,118, 83,142, 98, 76,100,136, 68,139,251,162,
|
|---|
| 37 | 23,154, 89,245,135,179, 79, 19, 97, 69,109,141, 9,129,125, 50,
|
|---|
| 38 | 189,143, 64,235,134,183,123, 11,240,149, 33, 34, 92,107, 78,130,
|
|---|
| 39 | 84,214,101,147,206, 96,178, 28,115, 86,192, 20,167,140,241,220,
|
|---|
| 40 | 18,117,202, 31, 59,190,228,209, 66, 61,212, 48,163, 60,182, 38,
|
|---|
| 41 | 111,191, 14,218, 70,105, 7, 87, 39,242, 29,155,188,148, 67, 3,
|
|---|
| 42 | 248, 17,199,246,144,239, 62,231, 6,195,213, 47,200,102, 30,215,
|
|---|
| 43 | 8,232,234,222,128, 82,238,247,132,170,114,172, 53, 77,106, 42,
|
|---|
| 44 | 150, 26,210,113, 90, 21, 73,116, 75,159,208, 94, 4, 24,164,236,
|
|---|
| 45 | 194,224, 65,110, 15, 81,203,204, 36,145,175, 80,161,244,112, 57,
|
|---|
| 46 | 153,124, 58,133, 35,184,180,122,252, 2, 54, 91, 37, 85,151, 49,
|
|---|
| 47 | 45, 93,250,152,227,138,146,174, 5,223, 41, 16,103,108,186,201,
|
|---|
| 48 | 211, 0,230,207,225,158,168, 44, 99, 22, 1, 63, 88,226,137,169,
|
|---|
| 49 | 13, 56, 52, 27,171, 51,255,176,187, 72, 12, 95,185,177,205, 46,
|
|---|
| 50 | 197,243,219, 71,229,165,156,119, 10,166, 32,104,254,127,193,173
|
|---|
| 51 | };
|
|---|
| 52 |
|
|---|
| 53 | int rc2_setup(const unsigned char *key, int keylen, int bits, int rounds, rc2_key *rc2)
|
|---|
| 54 | {
|
|---|
| 55 | unsigned *xkey = rc2->xkey;
|
|---|
| 56 | unsigned char tmp[128];
|
|---|
| 57 | unsigned T8, TM;
|
|---|
| 58 | int i;
|
|---|
| 59 |
|
|---|
| 60 | if (keylen < 5 || keylen > 128) {
|
|---|
| 61 | return CRYPT_INVALID_KEYSIZE;
|
|---|
| 62 | }
|
|---|
| 63 |
|
|---|
| 64 | if (rounds != 0 && rounds != 16) {
|
|---|
| 65 | return CRYPT_INVALID_ROUNDS;
|
|---|
| 66 | }
|
|---|
| 67 |
|
|---|
| 68 | /* Following comment is from Eric Young's rc2 code: */
|
|---|
| 69 | /* It has come to my attention that there are 2 versions of the RC2
|
|---|
| 70 | * key schedule. One which is normal, and anther which has a hook to
|
|---|
| 71 | * use a reduced key length.
|
|---|
| 72 | * BSAFE uses the 'retarded' version. What I previously shipped is
|
|---|
| 73 | * the same as specifying 1024 for the 'bits' parameter. BSAFE uses
|
|---|
| 74 | * a version where the bits parameter is the same as len*8 */
|
|---|
| 75 | /* Seems like MS uses the 'retarded' version, too.
|
|---|
| 76 | * Adjust effective keylen bits */
|
|---|
| 77 | if (bits <= 0) bits = keylen << 3;
|
|---|
| 78 | if (bits > 1024) bits = 1024;
|
|---|
| 79 |
|
|---|
| 80 | for (i = 0; i < keylen; i++) {
|
|---|
| 81 | tmp[i] = key[i] & 255;
|
|---|
| 82 | }
|
|---|
| 83 |
|
|---|
| 84 | /* Phase 1: Expand input key to 128 bytes */
|
|---|
| 85 | if (keylen < 128) {
|
|---|
| 86 | for (i = keylen; i < 128; i++) {
|
|---|
| 87 | tmp[i] = permute[(tmp[i - 1] + tmp[i - keylen]) & 255];
|
|---|
| 88 | }
|
|---|
| 89 | }
|
|---|
| 90 |
|
|---|
| 91 | /* Phase 2 - reduce effective key size to "bits" */
|
|---|
| 92 | /*bits = keylen<<3; */
|
|---|
| 93 | T8 = (unsigned)(bits+7)>>3;
|
|---|
| 94 | TM = (255 >> (unsigned)(7 & -bits));
|
|---|
| 95 | tmp[128 - T8] = permute[tmp[128 - T8] & TM];
|
|---|
| 96 | for (i = 127 - T8; i >= 0; i--) {
|
|---|
| 97 | tmp[i] = permute[tmp[i + 1] ^ tmp[i + T8]];
|
|---|
| 98 | }
|
|---|
| 99 |
|
|---|
| 100 | /* Phase 3 - copy to xkey in little-endian order */
|
|---|
| 101 | for (i = 0; i < 64; i++) {
|
|---|
| 102 | xkey[i] = (unsigned)tmp[2*i] + ((unsigned)tmp[2*i+1] << 8);
|
|---|
| 103 | }
|
|---|
| 104 |
|
|---|
| 105 | return CRYPT_OK;
|
|---|
| 106 | }
|
|---|
| 107 |
|
|---|
| 108 | /**********************************************************************\
|
|---|
| 109 | * Encrypt an 8-byte block of plaintext using the given key. *
|
|---|
| 110 | \**********************************************************************/
|
|---|
| 111 | void rc2_ecb_encrypt( const unsigned char *plain,
|
|---|
| 112 | unsigned char *cipher,
|
|---|
| 113 | rc2_key *rc2)
|
|---|
| 114 | {
|
|---|
| 115 | unsigned *xkey;
|
|---|
| 116 | unsigned x76, x54, x32, x10, i;
|
|---|
| 117 |
|
|---|
| 118 | xkey = rc2->xkey;
|
|---|
| 119 |
|
|---|
| 120 | x76 = ((unsigned)plain[7] << 8) + (unsigned)plain[6];
|
|---|
| 121 | x54 = ((unsigned)plain[5] << 8) + (unsigned)plain[4];
|
|---|
| 122 | x32 = ((unsigned)plain[3] << 8) + (unsigned)plain[2];
|
|---|
| 123 | x10 = ((unsigned)plain[1] << 8) + (unsigned)plain[0];
|
|---|
| 124 |
|
|---|
| 125 | for (i = 0; i < 16; i++) {
|
|---|
| 126 | x10 = (x10 + (x32 & ~x76) + (x54 & x76) + xkey[4*i+0]) & 0xFFFF;
|
|---|
| 127 | x10 = ((x10 << 1) | (x10 >> 15));
|
|---|
| 128 |
|
|---|
| 129 | x32 = (x32 + (x54 & ~x10) + (x76 & x10) + xkey[4*i+1]) & 0xFFFF;
|
|---|
| 130 | x32 = ((x32 << 2) | (x32 >> 14));
|
|---|
| 131 |
|
|---|
| 132 | x54 = (x54 + (x76 & ~x32) + (x10 & x32) + xkey[4*i+2]) & 0xFFFF;
|
|---|
| 133 | x54 = ((x54 << 3) | (x54 >> 13));
|
|---|
| 134 |
|
|---|
| 135 | x76 = (x76 + (x10 & ~x54) + (x32 & x54) + xkey[4*i+3]) & 0xFFFF;
|
|---|
| 136 | x76 = ((x76 << 5) | (x76 >> 11));
|
|---|
| 137 |
|
|---|
| 138 | if (i == 4 || i == 10) {
|
|---|
| 139 | x10 = (x10 + xkey[x76 & 63]) & 0xFFFF;
|
|---|
| 140 | x32 = (x32 + xkey[x10 & 63]) & 0xFFFF;
|
|---|
| 141 | x54 = (x54 + xkey[x32 & 63]) & 0xFFFF;
|
|---|
| 142 | x76 = (x76 + xkey[x54 & 63]) & 0xFFFF;
|
|---|
| 143 | }
|
|---|
| 144 | }
|
|---|
| 145 |
|
|---|
| 146 | cipher[0] = (unsigned char)x10;
|
|---|
| 147 | cipher[1] = (unsigned char)(x10 >> 8);
|
|---|
| 148 | cipher[2] = (unsigned char)x32;
|
|---|
| 149 | cipher[3] = (unsigned char)(x32 >> 8);
|
|---|
| 150 | cipher[4] = (unsigned char)x54;
|
|---|
| 151 | cipher[5] = (unsigned char)(x54 >> 8);
|
|---|
| 152 | cipher[6] = (unsigned char)x76;
|
|---|
| 153 | cipher[7] = (unsigned char)(x76 >> 8);
|
|---|
| 154 | }
|
|---|
| 155 |
|
|---|
| 156 | /**********************************************************************\
|
|---|
| 157 | * Decrypt an 8-byte block of ciphertext using the given key. *
|
|---|
| 158 | \**********************************************************************/
|
|---|
| 159 | void rc2_ecb_decrypt( const unsigned char *cipher,
|
|---|
| 160 | unsigned char *plain,
|
|---|
| 161 | rc2_key *rc2)
|
|---|
| 162 | {
|
|---|
| 163 | unsigned x76, x54, x32, x10;
|
|---|
| 164 | unsigned *xkey;
|
|---|
| 165 | int i;
|
|---|
| 166 |
|
|---|
| 167 | xkey = rc2->xkey;
|
|---|
| 168 |
|
|---|
| 169 | x76 = ((unsigned)cipher[7] << 8) + (unsigned)cipher[6];
|
|---|
| 170 | x54 = ((unsigned)cipher[5] << 8) + (unsigned)cipher[4];
|
|---|
| 171 | x32 = ((unsigned)cipher[3] << 8) + (unsigned)cipher[2];
|
|---|
| 172 | x10 = ((unsigned)cipher[1] << 8) + (unsigned)cipher[0];
|
|---|
| 173 |
|
|---|
| 174 | for (i = 15; i >= 0; i--) {
|
|---|
| 175 | if (i == 4 || i == 10) {
|
|---|
| 176 | x76 = (x76 - xkey[x54 & 63]) & 0xFFFF;
|
|---|
| 177 | x54 = (x54 - xkey[x32 & 63]) & 0xFFFF;
|
|---|
| 178 | x32 = (x32 - xkey[x10 & 63]) & 0xFFFF;
|
|---|
| 179 | x10 = (x10 - xkey[x76 & 63]) & 0xFFFF;
|
|---|
| 180 | }
|
|---|
| 181 |
|
|---|
| 182 | x76 = ((x76 << 11) | (x76 >> 5));
|
|---|
| 183 | x76 = (x76 - ((x10 & ~x54) + (x32 & x54) + xkey[4*i+3])) & 0xFFFF;
|
|---|
| 184 |
|
|---|
| 185 | x54 = ((x54 << 13) | (x54 >> 3));
|
|---|
| 186 | x54 = (x54 - ((x76 & ~x32) + (x10 & x32) + xkey[4*i+2])) & 0xFFFF;
|
|---|
| 187 |
|
|---|
| 188 | x32 = ((x32 << 14) | (x32 >> 2));
|
|---|
| 189 | x32 = (x32 - ((x54 & ~x10) + (x76 & x10) + xkey[4*i+1])) & 0xFFFF;
|
|---|
| 190 |
|
|---|
| 191 | x10 = ((x10 << 15) | (x10 >> 1));
|
|---|
| 192 | x10 = (x10 - ((x32 & ~x76) + (x54 & x76) + xkey[4*i+0])) & 0xFFFF;
|
|---|
| 193 | }
|
|---|
| 194 |
|
|---|
| 195 | plain[0] = (unsigned char)x10;
|
|---|
| 196 | plain[1] = (unsigned char)(x10 >> 8);
|
|---|
| 197 | plain[2] = (unsigned char)x32;
|
|---|
| 198 | plain[3] = (unsigned char)(x32 >> 8);
|
|---|
| 199 | plain[4] = (unsigned char)x54;
|
|---|
| 200 | plain[5] = (unsigned char)(x54 >> 8);
|
|---|
| 201 | plain[6] = (unsigned char)x76;
|
|---|
| 202 | plain[7] = (unsigned char)(x76 >> 8);
|
|---|
| 203 | }
|
|---|
