Coverage Report

Created: 2020-11-21 08:34

/src/botan/src/lib/block/des/des.cpp
Line
Count
Source (jump to first uncovered line)
1
/*
2
* DES
3
* (C) 1999-2008,2018 Jack Lloyd
4
*
5
* Based on a public domain implemenation by Phil Karn (who in turn
6
* credited Richard Outerbridge and Jim Gillogly)
7
*
8
* Botan is released under the Simplified BSD License (see license.txt)
9
*/
10
11
#include <botan/internal/des.h>
12
#include <botan/internal/loadstor.h>
13
#include <botan/internal/rotate.h>
14
15
namespace Botan {
16
17
namespace {
18
19
/*
20
* DES Key Schedule
21
*/
22
void des_key_schedule(uint32_t round_key[32], const uint8_t key[8])
23
1.70k
   {
24
1.70k
   static const uint8_t ROT[16] = { 1, 1, 2, 2, 2, 2, 2, 2,
25
1.70k
                                 1, 2, 2, 2, 2, 2, 2, 1 };
26
27
1.70k
   uint32_t C = ((key[7] & 0x80) << 20) | ((key[6] & 0x80) << 19) |
28
1.70k
                ((key[5] & 0x80) << 18) | ((key[4] & 0x80) << 17) |
29
1.70k
                ((key[3] & 0x80) << 16) | ((key[2] & 0x80) << 15) |
30
1.70k
                ((key[1] & 0x80) << 14) | ((key[0] & 0x80) << 13) |
31
1.70k
                ((key[7] & 0x40) << 13) | ((key[6] & 0x40) << 12) |
32
1.70k
                ((key[5] & 0x40) << 11) | ((key[4] & 0x40) << 10) |
33
1.70k
                ((key[3] & 0x40) <<  9) | ((key[2] & 0x40) <<  8) |
34
1.70k
                ((key[1] & 0x40) <<  7) | ((key[0] & 0x40) <<  6) |
35
1.70k
                ((key[7] & 0x20) <<  6) | ((key[6] & 0x20) <<  5) |
36
1.70k
                ((key[5] & 0x20) <<  4) | ((key[4] & 0x20) <<  3) |
37
1.70k
                ((key[3] & 0x20) <<  2) | ((key[2] & 0x20) <<  1) |
38
1.70k
                ((key[1] & 0x20)      ) | ((key[0] & 0x20) >>  1) |
39
1.70k
                ((key[7] & 0x10) >>  1) | ((key[6] & 0x10) >>  2) |
40
1.70k
                ((key[5] & 0x10) >>  3) | ((key[4] & 0x10) >>  4);
41
1.70k
   uint32_t D = ((key[7] & 0x02) << 26) | ((key[6] & 0x02) << 25) |
42
1.70k
                ((key[5] & 0x02) << 24) | ((key[4] & 0x02) << 23) |
43
1.70k
                ((key[3] & 0x02) << 22) | ((key[2] & 0x02) << 21) |
44
1.70k
                ((key[1] & 0x02) << 20) | ((key[0] & 0x02) << 19) |
45
1.70k
                ((key[7] & 0x04) << 17) | ((key[6] & 0x04) << 16) |
46
1.70k
                ((key[5] & 0x04) << 15) | ((key[4] & 0x04) << 14) |
47
1.70k
                ((key[3] & 0x04) << 13) | ((key[2] & 0x04) << 12) |
48
1.70k
                ((key[1] & 0x04) << 11) | ((key[0] & 0x04) << 10) |
49
1.70k
                ((key[7] & 0x08) <<  8) | ((key[6] & 0x08) <<  7) |
50
1.70k
                ((key[5] & 0x08) <<  6) | ((key[4] & 0x08) <<  5) |
51
1.70k
                ((key[3] & 0x08) <<  4) | ((key[2] & 0x08) <<  3) |
52
1.70k
                ((key[1] & 0x08) <<  2) | ((key[0] & 0x08) <<  1) |
53
1.70k
                ((key[3] & 0x10) >>  1) | ((key[2] & 0x10) >>  2) |
54
1.70k
                ((key[1] & 0x10) >>  3) | ((key[0] & 0x10) >>  4);
55
56
28.9k
   for(size_t i = 0; i != 16; ++i)
57
27.2k
      {
58
27.2k
      C = ((C << ROT[i]) | (C >> (28-ROT[i]))) & 0x0FFFFFFF;
59
27.2k
      D = ((D << ROT[i]) | (D >> (28-ROT[i]))) & 0x0FFFFFFF;
60
27.2k
      round_key[2*i  ] = ((C & 0x00000010) << 22) | ((C & 0x00000800) << 17) |
61
27.2k
                         ((C & 0x00000020) << 16) | ((C & 0x00004004) << 15) |
62
27.2k
                         ((C & 0x00000200) << 11) | ((C & 0x00020000) << 10) |
63
27.2k
                         ((C & 0x01000000) >>  6) | ((C & 0x00100000) >>  4) |
64
27.2k
                         ((C & 0x00010000) <<  3) | ((C & 0x08000000) >>  2) |
65
27.2k
                         ((C & 0x00800000) <<  1) | ((D & 0x00000010) <<  8) |
66
27.2k
                         ((D & 0x00000002) <<  7) | ((D & 0x00000001) <<  2) |
67
27.2k
                         ((D & 0x00000200)      ) | ((D & 0x00008000) >>  2) |
68
27.2k
                         ((D & 0x00000088) >>  3) | ((D & 0x00001000) >>  7) |
69
27.2k
                         ((D & 0x00080000) >>  9) | ((D & 0x02020000) >> 14) |
70
27.2k
                         ((D & 0x00400000) >> 21);
71
27.2k
      round_key[2*i+1] = ((C & 0x00000001) << 28) | ((C & 0x00000082) << 18) |
72
27.2k
                         ((C & 0x00002000) << 14) | ((C & 0x00000100) << 10) |
73
27.2k
                         ((C & 0x00001000) <<  9) | ((C & 0x00040000) <<  6) |
74
27.2k
                         ((C & 0x02400000) <<  4) | ((C & 0x00008000) <<  2) |
75
27.2k
                         ((C & 0x00200000) >>  1) | ((C & 0x04000000) >> 10) |
76
27.2k
                         ((D & 0x00000020) <<  6) | ((D & 0x00000100)      ) |
77
27.2k
                         ((D & 0x00000800) >>  1) | ((D & 0x00000040) >>  3) |
78
27.2k
                         ((D & 0x00010000) >>  4) | ((D & 0x00000400) >>  5) |
79
27.2k
                         ((D & 0x00004000) >> 10) | ((D & 0x04000000) >> 13) |
80
27.2k
                         ((D & 0x00800000) >> 14) | ((D & 0x00100000) >> 18) |
81
27.2k
                         ((D & 0x01000000) >> 24) | ((D & 0x08000000) >> 26);
82
27.2k
      }
83
1.70k
   }
84
85
inline uint32_t spbox(uint32_t T0, uint32_t T1)
86
693k
   {
87
693k
   return DES_SPBOX1[get_byte(0, T0)] ^ DES_SPBOX2[get_byte(0, T1)] ^
88
693k
          DES_SPBOX3[get_byte(1, T0)] ^ DES_SPBOX4[get_byte(1, T1)] ^
89
693k
          DES_SPBOX5[get_byte(2, T0)] ^ DES_SPBOX6[get_byte(2, T1)] ^
90
693k
          DES_SPBOX7[get_byte(3, T0)] ^ DES_SPBOX8[get_byte(3, T1)];
91
693k
   }
92
93
/*
94
* DES Encryption
95
*/
96
inline void des_encrypt(uint32_t& Lr, uint32_t& Rr,
97
                        const uint32_t round_key[32])
98
4.42k
   {
99
4.42k
   uint32_t L = Lr;
100
4.42k
   uint32_t R = Rr;
101
39.8k
   for(size_t i = 0; i != 16; i += 2)
102
35.4k
      {
103
35.4k
      L ^= spbox(rotr<4>(R) ^ round_key[2*i  ], R ^ round_key[2*i+1]);
104
35.4k
      R ^= spbox(rotr<4>(L) ^ round_key[2*i+2], L ^ round_key[2*i+3]);
105
35.4k
      }
106
107
4.42k
   Lr = L;
108
4.42k
   Rr = R;
109
4.42k
   }
110
111
inline void des_encrypt_x2(uint32_t& L0r, uint32_t& R0r,
112
                           uint32_t& L1r, uint32_t& R1r,
113
                           const uint32_t round_key[32])
114
6.09k
   {
115
6.09k
   uint32_t L0 = L0r;
116
6.09k
   uint32_t R0 = R0r;
117
6.09k
   uint32_t L1 = L1r;
118
6.09k
   uint32_t R1 = R1r;
119
120
54.8k
   for(size_t i = 0; i != 16; i += 2)
121
48.7k
      {
122
48.7k
      L0 ^= spbox(rotr<4>(R0) ^ round_key[2*i  ], R0 ^ round_key[2*i+1]);
123
48.7k
      L1 ^= spbox(rotr<4>(R1) ^ round_key[2*i  ], R1 ^ round_key[2*i+1]);
124
125
48.7k
      R0 ^= spbox(rotr<4>(L0) ^ round_key[2*i+2], L0 ^ round_key[2*i+3]);
126
48.7k
      R1 ^= spbox(rotr<4>(L1) ^ round_key[2*i+2], L1 ^ round_key[2*i+3]);
127
48.7k
      }
128
129
6.09k
   L0r = L0;
130
6.09k
   R0r = R0;
131
6.09k
   L1r = L1;
132
6.09k
   R1r = R1;
133
6.09k
   }
134
135
/*
136
* DES Decryption
137
*/
138
inline void des_decrypt(uint32_t& Lr, uint32_t& Rr,
139
                        const uint32_t round_key[32])
140
2.32k
   {
141
2.32k
   uint32_t L = Lr;
142
2.32k
   uint32_t R = Rr;
143
20.8k
   for(size_t i = 16; i != 0; i -= 2)
144
18.5k
      {
145
18.5k
      L ^= spbox(rotr<4>(R) ^ round_key[2*i - 2], R  ^ round_key[2*i - 1]);
146
18.5k
      R ^= spbox(rotr<4>(L) ^ round_key[2*i - 4], L  ^ round_key[2*i - 3]);
147
18.5k
      }
148
2.32k
   Lr = L;
149
2.32k
   Rr = R;
150
2.32k
   }
151
152
inline void des_decrypt_x2(uint32_t& L0r, uint32_t& R0r,
153
                           uint32_t& L1r, uint32_t& R1r,
154
                           const uint32_t round_key[32])
155
12.1k
   {
156
12.1k
   uint32_t L0 = L0r;
157
12.1k
   uint32_t R0 = R0r;
158
12.1k
   uint32_t L1 = L1r;
159
12.1k
   uint32_t R1 = R1r;
160
161
109k
   for(size_t i = 16; i != 0; i -= 2)
162
97.5k
      {
163
97.5k
      L0 ^= spbox(rotr<4>(R0) ^ round_key[2*i - 2], R0  ^ round_key[2*i - 1]);
164
97.5k
      L1 ^= spbox(rotr<4>(R1) ^ round_key[2*i - 2], R1  ^ round_key[2*i - 1]);
165
166
97.5k
      R0 ^= spbox(rotr<4>(L0) ^ round_key[2*i - 4], L0  ^ round_key[2*i - 3]);
167
97.5k
      R1 ^= spbox(rotr<4>(L1) ^ round_key[2*i - 4], L1  ^ round_key[2*i - 3]);
168
97.5k
      }
169
170
12.1k
   L0r = L0;
171
12.1k
   R0r = R0;
172
12.1k
   L1r = L1;
173
12.1k
   R1r = R1;
174
12.1k
   }
175
176
inline void des_IP(uint32_t& L, uint32_t& R, const uint8_t block[])
177
14.4k
   {
178
   // IP sequence by Wei Dai, taken from public domain Crypto++
179
14.4k
   L = load_be<uint32_t>(block, 0);
180
14.4k
   R = load_be<uint32_t>(block, 1);
181
182
14.4k
   uint32_t T;
183
14.4k
   R = rotl<4>(R);
184
14.4k
   T = (L ^ R) & 0xF0F0F0F0;
185
14.4k
   L ^= T;
186
14.4k
   R = rotr<20>(R ^ T);
187
14.4k
   T = (L ^ R) & 0xFFFF0000;
188
14.4k
   L ^= T;
189
14.4k
   R = rotr<18>(R ^ T);
190
14.4k
   T = (L ^ R) & 0x33333333;
191
14.4k
   L ^= T;
192
14.4k
   R = rotr<6>(R ^ T);
193
14.4k
   T = (L ^ R) & 0x00FF00FF;
194
14.4k
   L ^= T;
195
14.4k
   R = rotl<9>(R ^ T);
196
14.4k
   T = (L ^ R) & 0xAAAAAAAA;
197
14.4k
   L = rotl<1>(L ^ T);
198
14.4k
   R ^= T;
199
14.4k
   }
200
201
inline void des_FP(uint32_t L, uint32_t R, uint8_t out[])
202
14.4k
   {
203
   // FP sequence by Wei Dai, taken from public domain Crypto++
204
14.4k
   uint32_t T;
205
206
14.4k
   R = rotr<1>(R);
207
14.4k
   T = (L ^ R) & 0xAAAAAAAA;
208
14.4k
   R ^= T;
209
14.4k
   L = rotr<9>(L ^ T);
210
14.4k
   T = (L ^ R) & 0x00FF00FF;
211
14.4k
   R ^= T;
212
14.4k
   L = rotl<6>(L ^ T);
213
14.4k
   T = (L ^ R) & 0x33333333;
214
14.4k
   R ^= T;
215
14.4k
   L = rotl<18>(L ^ T);
216
14.4k
   T = (L ^ R) & 0xFFFF0000;
217
14.4k
   R ^= T;
218
14.4k
   L = rotl<20>(L ^ T);
219
14.4k
   T = (L ^ R) & 0xF0F0F0F0;
220
14.4k
   R ^= T;
221
14.4k
   L = rotr<4>(L ^ T);
222
223
14.4k
   store_be(out, R, L);
224
14.4k
   }
225
226
}
227
228
/*
229
* DES Encryption
230
*/
231
void DES::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
232
0
   {
233
0
   verify_key_set(m_round_key.empty() == false);
234
235
0
   while(blocks >= 2)
236
0
      {
237
0
      uint32_t L0, R0;
238
0
      uint32_t L1, R1;
239
240
0
      des_IP(L0, R0, in);
241
0
      des_IP(L1, R1, in + BLOCK_SIZE);
242
243
0
      des_encrypt_x2(L0, R0, L1, R1, m_round_key.data());
244
245
0
      des_FP(L0, R0, out);
246
0
      des_FP(L1, R1, out + BLOCK_SIZE);
247
248
0
      in += 2*BLOCK_SIZE;
249
0
      out += 2*BLOCK_SIZE;
250
0
      blocks -= 2;
251
0
      }
252
253
0
   for(size_t i = 0; i < blocks; ++i)
254
0
      {
255
0
      uint32_t L, R;
256
0
      des_IP(L, R, in + BLOCK_SIZE*i);
257
0
      des_encrypt(L, R, m_round_key.data());
258
0
      des_FP(L, R, out + BLOCK_SIZE*i);
259
0
      }
260
0
   }
261
262
/*
263
* DES Decryption
264
*/
265
void DES::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
266
0
   {
267
0
   verify_key_set(m_round_key.empty() == false);
268
269
0
   while(blocks >= 2)
270
0
      {
271
0
      uint32_t L0, R0;
272
0
      uint32_t L1, R1;
273
274
0
      des_IP(L0, R0, in);
275
0
      des_IP(L1, R1, in + BLOCK_SIZE);
276
277
0
      des_decrypt_x2(L0, R0, L1, R1, m_round_key.data());
278
279
0
      des_FP(L0, R0, out);
280
0
      des_FP(L1, R1, out + BLOCK_SIZE);
281
282
0
      in += 2*BLOCK_SIZE;
283
0
      out += 2*BLOCK_SIZE;
284
0
      blocks -= 2;
285
0
      }
286
287
0
   for(size_t i = 0; i < blocks; ++i)
288
0
      {
289
0
      uint32_t L, R;
290
0
      des_IP(L, R, in + BLOCK_SIZE*i);
291
0
      des_decrypt(L, R, m_round_key.data());
292
0
      des_FP(L, R, out + BLOCK_SIZE*i);
293
0
      }
294
0
   }
295
296
/*
297
* DES Key Schedule
298
*/
299
void DES::key_schedule(const uint8_t key[], size_t)
300
0
   {
301
0
   m_round_key.resize(32);
302
0
   des_key_schedule(m_round_key.data(), key);
303
0
   }
304
305
void DES::clear()
306
0
   {
307
0
   zap(m_round_key);
308
0
   }
309
310
/*
311
* TripleDES Encryption
312
*/
313
void TripleDES::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
314
2.17k
   {
315
2.17k
   verify_key_set(m_round_key.empty() == false);
316
317
2.17k
   while(blocks >= 2)
318
0
      {
319
0
      uint32_t L0, R0;
320
0
      uint32_t L1, R1;
321
322
0
      des_IP(L0, R0, in);
323
0
      des_IP(L1, R1, in + BLOCK_SIZE);
324
325
0
      des_encrypt_x2(L0, R0, L1, R1, &m_round_key[0]);
326
0
      des_decrypt_x2(R0, L0, R1, L1, &m_round_key[32]);
327
0
      des_encrypt_x2(L0, R0, L1, R1, &m_round_key[64]);
328
329
0
      des_FP(L0, R0, out);
330
0
      des_FP(L1, R1, out + BLOCK_SIZE);
331
332
0
      in += 2*BLOCK_SIZE;
333
0
      out += 2*BLOCK_SIZE;
334
0
      blocks -= 2;
335
0
      }
336
337
4.35k
   for(size_t i = 0; i != blocks; ++i)
338
2.17k
      {
339
2.17k
      uint32_t L, R;
340
2.17k
      des_IP(L, R, in + BLOCK_SIZE*i);
341
342
2.17k
      des_encrypt(L, R, &m_round_key[0]);
343
2.17k
      des_decrypt(R, L, &m_round_key[32]);
344
2.17k
      des_encrypt(L, R, &m_round_key[64]);
345
346
2.17k
      des_FP(L, R, out + BLOCK_SIZE*i);
347
2.17k
      }
348
2.17k
   }
349
350
/*
351
* TripleDES Decryption
352
*/
353
void TripleDES::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
354
3.11k
   {
355
3.11k
   verify_key_set(m_round_key.empty() == false);
356
357
9.21k
   while(blocks >= 2)
358
6.09k
      {
359
6.09k
      uint32_t L0, R0;
360
6.09k
      uint32_t L1, R1;
361
362
6.09k
      des_IP(L0, R0, in);
363
6.09k
      des_IP(L1, R1, in + BLOCK_SIZE);
364
365
6.09k
      des_decrypt_x2(L0, R0, L1, R1, &m_round_key[64]);
366
6.09k
      des_encrypt_x2(R0, L0, R1, L1, &m_round_key[32]);
367
6.09k
      des_decrypt_x2(L0, R0, L1, R1, &m_round_key[0]);
368
369
6.09k
      des_FP(L0, R0, out);
370
6.09k
      des_FP(L1, R1, out + BLOCK_SIZE);
371
372
6.09k
      in += 2*BLOCK_SIZE;
373
6.09k
      out += 2*BLOCK_SIZE;
374
6.09k
      blocks -= 2;
375
6.09k
      }
376
377
3.18k
   for(size_t i = 0; i != blocks; ++i)
378
72
      {
379
72
      uint32_t L, R;
380
72
      des_IP(L, R, in + BLOCK_SIZE*i);
381
382
72
      des_decrypt(L, R, &m_round_key[64]);
383
72
      des_encrypt(R, L, &m_round_key[32]);
384
72
      des_decrypt(L, R, &m_round_key[0]);
385
386
72
      des_FP(L, R, out + BLOCK_SIZE*i);
387
72
      }
388
3.11k
   }
389
390
/*
391
* TripleDES Key Schedule
392
*/
393
void TripleDES::key_schedule(const uint8_t key[], size_t length)
394
568
   {
395
568
   m_round_key.resize(3*32);
396
568
   des_key_schedule(&m_round_key[0], key);
397
568
   des_key_schedule(&m_round_key[32], key + 8);
398
399
568
   if(length == 24)
400
568
      des_key_schedule(&m_round_key[64], key + 16);
401
0
   else
402
0
      copy_mem(&m_round_key[64], &m_round_key[0], 32);
403
568
   }
404
405
void TripleDES::clear()
406
0
   {
407
0
   zap(m_round_key);
408
0
   }
409
410
}