/src/botan/src/lib/block/des/des.cpp

Source (jump to first uncovered line)
/*
* DES
* (C) 1999-2008,2018,2020 Jack Lloyd
*
* Based on a public domain implemenation by Phil Karn (who in turn
* credited Richard Outerbridge and Jim Gillogly)
*
* Botan is released under the Simplified BSD License (see license.txt)
*/

#include <botan/internal/des.h>
#include <botan/internal/loadstor.h>
#include <botan/internal/rotate.h>

namespace Botan {

namespace {

alignas(256) const uint8_t SPBOX_CATS[64*8] = {
   0x54, 0x00, 0x10, 0x55, 0x51, 0x15, 0x01, 0x10, 0x04, 0x54, 0x55, 0x04, 0x45, 0x51, 0x40, 0x01,
   0x05, 0x44, 0x44, 0x14, 0x14, 0x50, 0x50, 0x45, 0x11, 0x41, 0x41, 0x11, 0x00, 0x05, 0x15, 0x40,
   0x10, 0x55, 0x01, 0x50, 0x54, 0x40, 0x40, 0x04, 0x51, 0x10, 0x14, 0x41, 0x04, 0x01, 0x45, 0x15,
   0x55, 0x11, 0x50, 0x45, 0x41, 0x05, 0x15, 0x54, 0x05, 0x44, 0x44, 0x00, 0x11, 0x14, 0x00, 0x51,

   0x55, 0x44, 0x04, 0x15, 0x10, 0x01, 0x51, 0x45, 0x41, 0x55, 0x54, 0x40, 0x44, 0x10, 0x01, 0x51,
   0x14, 0x11, 0x45, 0x00, 0x40, 0x04, 0x15, 0x50, 0x11, 0x41, 0x00, 0x14, 0x05, 0x54, 0x50, 0x05,
   0x00, 0x15, 0x51, 0x10, 0x45, 0x50, 0x54, 0x04, 0x50, 0x44, 0x01, 0x55, 0x15, 0x01, 0x04, 0x40,
   0x05, 0x54, 0x10, 0x41, 0x11, 0x45, 0x41, 0x11, 0x14, 0x00, 0x44, 0x05, 0x40, 0x51, 0x55, 0x14,

   0x09, 0xA8, 0x00, 0xA1, 0x88, 0x00, 0x29, 0x88, 0x21, 0x81, 0x81, 0x20, 0xA9, 0x21, 0xA0, 0x09,
   0x80, 0x01, 0xA8, 0x08, 0x28, 0xA0, 0xA1, 0x29, 0x89, 0x28, 0x20, 0x89, 0x01, 0xA9, 0x08, 0x80,
   0xA8, 0x80, 0x21, 0x09, 0x20, 0xA8, 0x88, 0x00, 0x08, 0x21, 0xA9, 0x88, 0x81, 0x08, 0x00, 0xA1,
   0x89, 0x20, 0x80, 0xA9, 0x01, 0x29, 0x28, 0x81, 0xA0, 0x89, 0x09, 0xA0, 0x29, 0x01, 0xA1, 0x28,

   0x51, 0x15, 0x15, 0x04, 0x54, 0x45, 0x41, 0x11, 0x00, 0x50, 0x50, 0x55, 0x05, 0x00, 0x44, 0x41,
   0x01, 0x10, 0x40, 0x51, 0x04, 0x40, 0x11, 0x14, 0x45, 0x01, 0x14, 0x44, 0x10, 0x54, 0x55, 0x05,
   0x44, 0x41, 0x50, 0x55, 0x05, 0x00, 0x00, 0x50, 0x14, 0x44, 0x45, 0x01, 0x51, 0x15, 0x15, 0x04,
   0x55, 0x05, 0x01, 0x10, 0x41, 0x11, 0x54, 0x45, 0x11, 0x14, 0x40, 0x51, 0x04, 0x40, 0x10, 0x54,

   0x01, 0x29, 0x28, 0xA1, 0x08, 0x01, 0x80, 0x28, 0x89, 0x08, 0x21, 0x89, 0xA1, 0xA8, 0x09, 0x80,
   0x20, 0x88, 0x88, 0x00, 0x81, 0xA9, 0xA9, 0x21, 0xA8, 0x81, 0x00, 0xA0, 0x29, 0x20, 0xA0, 0x09,
   0x08, 0xA1, 0x01, 0x20, 0x80, 0x28, 0xA1, 0x89, 0x21, 0x80, 0xA8, 0x29, 0x89, 0x01, 0x20, 0xA8,
   0xA9, 0x09, 0xA0, 0xA9, 0x28, 0x00, 0x88, 0xA0, 0x09, 0x21, 0x81, 0x08, 0x00, 0x88, 0x29, 0x81,

   0x41, 0x50, 0x04, 0x55, 0x50, 0x01, 0x55, 0x10, 0x44, 0x15, 0x10, 0x41, 0x11, 0x44, 0x40, 0x05,
   0x00, 0x11, 0x45, 0x04, 0x14, 0x45, 0x01, 0x51, 0x51, 0x00, 0x15, 0x54, 0x05, 0x14, 0x54, 0x40,
   0x44, 0x01, 0x51, 0x14, 0x55, 0x10, 0x05, 0x41, 0x10, 0x44, 0x40, 0x05, 0x41, 0x55, 0x14, 0x50,
   0x15, 0x54, 0x00, 0x51, 0x01, 0x04, 0x50, 0x15, 0x04, 0x11, 0x45, 0x00, 0x54, 0x40, 0x11, 0x45,

   0x10, 0x51, 0x45, 0x00, 0x04, 0x45, 0x15, 0x54, 0x55, 0x10, 0x00, 0x41, 0x01, 0x40, 0x51, 0x05,
   0x44, 0x15, 0x11, 0x44, 0x41, 0x50, 0x54, 0x11, 0x50, 0x04, 0x05, 0x55, 0x14, 0x01, 0x40, 0x14,
   0x40, 0x14, 0x10, 0x45, 0x45, 0x51, 0x51, 0x01, 0x11, 0x40, 0x44, 0x10, 0x54, 0x05, 0x15, 0x54,
   0x05, 0x41, 0x55, 0x50, 0x14, 0x00, 0x01, 0x55, 0x00, 0x15, 0x50, 0x04, 0x41, 0x44, 0x04, 0x11,

   0x89, 0x08, 0x20, 0xA9, 0x80, 0x89, 0x01, 0x80, 0x21, 0xA0, 0xA9, 0x28, 0xA8, 0x29, 0x08, 0x01,
   0xA0, 0x81, 0x88, 0x09, 0x28, 0x21, 0xA1, 0xA8, 0x09, 0x00, 0x00, 0xA1, 0x81, 0x88, 0x29, 0x20,
   0x29, 0x20, 0xa8, 0x08, 0x01, 0xA1, 0x08, 0x29, 0x88, 0x01, 0x81, 0xA0, 0xA1, 0x80, 0x20, 0x89,
   0x00, 0xA9, 0x21, 0x81, 0xA0, 0x88, 0x89, 0x00, 0xA9, 0x28, 0x28, 0x09, 0x09, 0x21, 0x80, 0xA8,
};

const uint32_t SPBOX_CAT_0_MUL = 0x70041106;
const uint32_t SPBOX_CAT_1_MUL = 0x02012020;
const uint32_t SPBOX_CAT_2_MUL = 0x00901048;
const uint32_t SPBOX_CAT_3_MUL = 0x8e060221;
const uint32_t SPBOX_CAT_4_MUL = 0x00912140;
const uint32_t SPBOX_CAT_5_MUL = 0x80841018;
const uint32_t SPBOX_CAT_6_MUL = 0xe0120202;
const uint32_t SPBOX_CAT_7_MUL = 0x00212240;

const uint32_t SPBOX_CAT_0_MASK = 0x01010404;
const uint32_t SPBOX_CAT_1_MASK = 0x80108020;
const uint32_t SPBOX_CAT_2_MASK = 0x08020208;
const uint32_t SPBOX_CAT_3_MASK = 0x00802081;
const uint32_t SPBOX_CAT_4_MASK = 0x42080100;
const uint32_t SPBOX_CAT_5_MASK = 0x20404010;
const uint32_t SPBOX_CAT_6_MASK = 0x04200802;
const uint32_t SPBOX_CAT_7_MASK = 0x10041040;

/*
* DES Key Schedule
*/
void des_key_schedule(uint32_t round_key[32], const uint8_t key[8])
   {
   static const uint8_t ROT[16] = { 1, 1, 2, 2, 2, 2, 2, 2,
                                 1, 2, 2, 2, 2, 2, 2, 1 };

   uint32_t C = ((key[7] & 0x80) << 20) | ((key[6] & 0x80) << 19) |
                ((key[5] & 0x80) << 18) | ((key[4] & 0x80) << 17) |
                ((key[3] & 0x80) << 16) | ((key[2] & 0x80) << 15) |
                ((key[1] & 0x80) << 14) | ((key[0] & 0x80) << 13) |
                ((key[7] & 0x40) << 13) | ((key[6] & 0x40) << 12) |
                ((key[5] & 0x40) << 11) | ((key[4] & 0x40) << 10) |
                ((key[3] & 0x40) <<  9) | ((key[2] & 0x40) <<  8) |
                ((key[1] & 0x40) <<  7) | ((key[0] & 0x40) <<  6) |
                ((key[7] & 0x20) <<  6) | ((key[6] & 0x20) <<  5) |
                ((key[5] & 0x20) <<  4) | ((key[4] & 0x20) <<  3) |
                ((key[3] & 0x20) <<  2) | ((key[2] & 0x20) <<  1) |
                ((key[1] & 0x20)      ) | ((key[0] & 0x20) >>  1) |
                ((key[7] & 0x10) >>  1) | ((key[6] & 0x10) >>  2) |
                ((key[5] & 0x10) >>  3) | ((key[4] & 0x10) >>  4);
   uint32_t D = ((key[7] & 0x02) << 26) | ((key[6] & 0x02) << 25) |
                ((key[5] & 0x02) << 24) | ((key[4] & 0x02) << 23) |
                ((key[3] & 0x02) << 22) | ((key[2] & 0x02) << 21) |
                ((key[1] & 0x02) << 20) | ((key[0] & 0x02) << 19) |
                ((key[7] & 0x04) << 17) | ((key[6] & 0x04) << 16) |
                ((key[5] & 0x04) << 15) | ((key[4] & 0x04) << 14) |
                ((key[3] & 0x04) << 13) | ((key[2] & 0x04) << 12) |
                ((key[1] & 0x04) << 11) | ((key[0] & 0x04) << 10) |
                ((key[7] & 0x08) <<  8) | ((key[6] & 0x08) <<  7) |
                ((key[5] & 0x08) <<  6) | ((key[4] & 0x08) <<  5) |
                ((key[3] & 0x08) <<  4) | ((key[2] & 0x08) <<  3) |
                ((key[1] & 0x08) <<  2) | ((key[0] & 0x08) <<  1) |
                ((key[3] & 0x10) >>  1) | ((key[2] & 0x10) >>  2) |
                ((key[1] & 0x10) >>  3) | ((key[0] & 0x10) >>  4);

   for(size_t i = 0; i != 16; ++i)
      {
      C = ((C << ROT[i]) | (C >> (28-ROT[i]))) & 0x0FFFFFFF;
      D = ((D << ROT[i]) | (D >> (28-ROT[i]))) & 0x0FFFFFFF;
      round_key[2*i  ] = ((C & 0x00000010) << 22) | ((C & 0x00000800) << 17) |
                         ((C & 0x00000020) << 16) | ((C & 0x00004004) << 15) |
                         ((C & 0x00000200) << 11) | ((C & 0x00020000) << 10) |
                         ((C & 0x01000000) >>  6) | ((C & 0x00100000) >>  4) |
                         ((C & 0x00010000) <<  3) | ((C & 0x08000000) >>  2) |
                         ((C & 0x00800000) <<  1) | ((D & 0x00000010) <<  8) |
                         ((D & 0x00000002) <<  7) | ((D & 0x00000001) <<  2) |
                         ((D & 0x00000200)      ) | ((D & 0x00008000) >>  2) |
                         ((D & 0x00000088) >>  3) | ((D & 0x00001000) >>  7) |
                         ((D & 0x00080000) >>  9) | ((D & 0x02020000) >> 14) |
                         ((D & 0x00400000) >> 21);
      round_key[2*i+1] = ((C & 0x00000001) << 28) | ((C & 0x00000082) << 18) |
                         ((C & 0x00002000) << 14) | ((C & 0x00000100) << 10) |
                         ((C & 0x00001000) <<  9) | ((C & 0x00040000) <<  6) |
                         ((C & 0x02400000) <<  4) | ((C & 0x00008000) <<  2) |
                         ((C & 0x00200000) >>  1) | ((C & 0x04000000) >> 10) |
                         ((D & 0x00000020) <<  6) | ((D & 0x00000100)      ) |
                         ((D & 0x00000800) >>  1) | ((D & 0x00000040) >>  3) |
                         ((D & 0x00010000) >>  4) | ((D & 0x00000400) >>  5) |
                         ((D & 0x00004000) >> 10) | ((D & 0x04000000) >> 13) |
                         ((D & 0x00800000) >> 14) | ((D & 0x00100000) >> 18) |
                         ((D & 0x01000000) >> 24) | ((D & 0x08000000) >> 26);
      }
   }

inline uint32_t spbox(uint32_t T0, uint32_t T1)
   {
   return
      ((SPBOX_CATS[0*64 + ((T0 >> 24) & 0x3F)] * SPBOX_CAT_0_MUL) & SPBOX_CAT_0_MASK)  ^
      ((SPBOX_CATS[1*64 + ((T1 >> 24) & 0x3F)] * SPBOX_CAT_1_MUL) & SPBOX_CAT_1_MASK)  ^
      ((SPBOX_CATS[2*64 + ((T0 >> 16) & 0x3F)] * SPBOX_CAT_2_MUL) & SPBOX_CAT_2_MASK)  ^
      ((SPBOX_CATS[3*64 + ((T1 >> 16) & 0x3F)] * SPBOX_CAT_3_MUL) & SPBOX_CAT_3_MASK)  ^
      ((SPBOX_CATS[4*64 + ((T0 >>  8) & 0x3F)] * SPBOX_CAT_4_MUL) & SPBOX_CAT_4_MASK)  ^
      ((SPBOX_CATS[5*64 + ((T1 >>  8) & 0x3F)] * SPBOX_CAT_5_MUL) & SPBOX_CAT_5_MASK)  ^
      ((SPBOX_CATS[6*64 + ((T0 >>  0) & 0x3F)] * SPBOX_CAT_6_MUL) & SPBOX_CAT_6_MASK)  ^
      ((SPBOX_CATS[7*64 + ((T1 >>  0) & 0x3F)] * SPBOX_CAT_7_MUL) & SPBOX_CAT_7_MASK);
   }

/*
* DES Encryption
*/
inline void des_encrypt(uint32_t& Lr, uint32_t& Rr,
                        const uint32_t round_key[32])
   {
   uint32_t L = Lr;
   uint32_t R = Rr;
   for(size_t i = 0; i != 16; i += 2)
      {
      L ^= spbox(rotr<4>(R) ^ round_key[2*i  ], R ^ round_key[2*i+1]);
      R ^= spbox(rotr<4>(L) ^ round_key[2*i+2], L ^ round_key[2*i+3]);
      }

   Lr = L;
   Rr = R;
   }

inline void des_encrypt_x2(uint32_t& L0r, uint32_t& R0r,
                           uint32_t& L1r, uint32_t& R1r,
                           const uint32_t round_key[32])
   {
   uint32_t L0 = L0r;
   uint32_t R0 = R0r;
   uint32_t L1 = L1r;
   uint32_t R1 = R1r;

   for(size_t i = 0; i != 16; i += 2)
      {
      L0 ^= spbox(rotr<4>(R0) ^ round_key[2*i  ], R0 ^ round_key[2*i+1]);
      L1 ^= spbox(rotr<4>(R1) ^ round_key[2*i  ], R1 ^ round_key[2*i+1]);

      R0 ^= spbox(rotr<4>(L0) ^ round_key[2*i+2], L0 ^ round_key[2*i+3]);
      R1 ^= spbox(rotr<4>(L1) ^ round_key[2*i+2], L1 ^ round_key[2*i+3]);
      }

   L0r = L0;
   R0r = R0;
   L1r = L1;
   R1r = R1;
   }

/*
* DES Decryption
*/
inline void des_decrypt(uint32_t& Lr, uint32_t& Rr,
                        const uint32_t round_key[32])
   {
   uint32_t L = Lr;
   uint32_t R = Rr;
   for(size_t i = 16; i != 0; i -= 2)
      {
      L ^= spbox(rotr<4>(R) ^ round_key[2*i - 2], R  ^ round_key[2*i - 1]);
      R ^= spbox(rotr<4>(L) ^ round_key[2*i - 4], L  ^ round_key[2*i - 3]);
      }
   Lr = L;
   Rr = R;
   }

inline void des_decrypt_x2(uint32_t& L0r, uint32_t& R0r,
                           uint32_t& L1r, uint32_t& R1r,
                           const uint32_t round_key[32])
   {
   uint32_t L0 = L0r;
   uint32_t R0 = R0r;
   uint32_t L1 = L1r;
   uint32_t R1 = R1r;

   for(size_t i = 16; i != 0; i -= 2)
      {
      L0 ^= spbox(rotr<4>(R0) ^ round_key[2*i - 2], R0  ^ round_key[2*i - 1]);
      L1 ^= spbox(rotr<4>(R1) ^ round_key[2*i - 2], R1  ^ round_key[2*i - 1]);

      R0 ^= spbox(rotr<4>(L0) ^ round_key[2*i - 4], L0  ^ round_key[2*i - 3]);
      R1 ^= spbox(rotr<4>(L1) ^ round_key[2*i - 4], L1  ^ round_key[2*i - 3]);
      }

   L0r = L0;
   R0r = R0;
   L1r = L1;
   R1r = R1;
   }

inline void des_IP(uint32_t& L, uint32_t& R)
   {
   // IP sequence by Wei Dai, taken from public domain Crypto++
   uint32_t T;
   R = rotl<4>(R);
   T = (L ^ R) & 0xF0F0F0F0;
   L ^= T;
   R = rotr<20>(R ^ T);
   T = (L ^ R) & 0xFFFF0000;
   L ^= T;
   R = rotr<18>(R ^ T);
   T = (L ^ R) & 0x33333333;
   L ^= T;
   R = rotr<6>(R ^ T);
   T = (L ^ R) & 0x00FF00FF;
   L ^= T;
   R = rotl<9>(R ^ T);
   T = (L ^ R) & 0xAAAAAAAA;
   L = rotl<1>(L ^ T);
   R ^= T;
   }

inline void des_FP(uint32_t& L, uint32_t& R)
   {
   // FP sequence by Wei Dai, taken from public domain Crypto++
   uint32_t T;

   R = rotr<1>(R);
   T = (L ^ R) & 0xAAAAAAAA;
   R ^= T;
   L = rotr<9>(L ^ T);
   T = (L ^ R) & 0x00FF00FF;
   R ^= T;
   L = rotl<6>(L ^ T);
   T = (L ^ R) & 0x33333333;
   R ^= T;
   L = rotl<18>(L ^ T);
   T = (L ^ R) & 0xFFFF0000;
   R ^= T;
   L = rotl<20>(L ^ T);
   T = (L ^ R) & 0xF0F0F0F0;
   R ^= T;
   L = rotr<4>(L ^ T);
   }

}

/*
* DES Encryption
*/
void DES::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
   {
   verify_key_set(m_round_key.empty() == false);

   while(blocks >= 2)
      {
      uint32_t L0 = load_be<uint32_t>(in, 0);
      uint32_t R0 = load_be<uint32_t>(in, 1);
      uint32_t L1 = load_be<uint32_t>(in, 2);
      uint32_t R1 = load_be<uint32_t>(in, 3);

      des_IP(L0, R0);
      des_IP(L1, R1);

      des_encrypt_x2(L0, R0, L1, R1, m_round_key.data());

      des_FP(L0, R0);
      des_FP(L1, R1);

      store_be(out, R0, L0, R1, L1);

      in += 2*BLOCK_SIZE;
      out += 2*BLOCK_SIZE;
      blocks -= 2;
      }

   while(blocks > 0)
      {
      uint32_t L0 = load_be<uint32_t>(in, 0);
      uint32_t R0 = load_be<uint32_t>(in, 1);
      des_IP(L0, R0);
      des_encrypt(L0, R0, m_round_key.data());
      des_FP(L0, R0);
      store_be(out, R0, L0);

      in += BLOCK_SIZE;
      out += BLOCK_SIZE;
      blocks -= 1;
      }
   }

/*
* DES Decryption
*/
void DES::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
   {
   verify_key_set(m_round_key.empty() == false);

   while(blocks >= 2)
      {
      uint32_t L0 = load_be<uint32_t>(in, 0);
      uint32_t R0 = load_be<uint32_t>(in, 1);
      uint32_t L1 = load_be<uint32_t>(in, 2);
      uint32_t R1 = load_be<uint32_t>(in, 3);

      des_IP(L0, R0);
      des_IP(L1, R1);

      des_decrypt_x2(L0, R0, L1, R1, m_round_key.data());

      des_FP(L0, R0);
      des_FP(L1, R1);

      store_be(out, R0, L0, R1, L1);

      in += 2*BLOCK_SIZE;
      out += 2*BLOCK_SIZE;
      blocks -= 2;
      }

   while(blocks > 0)
      {
      uint32_t L0 = load_be<uint32_t>(in, 0);
      uint32_t R0 = load_be<uint32_t>(in, 1);
      des_IP(L0, R0);
      des_decrypt(L0, R0, m_round_key.data());
      des_FP(L0, R0);
      store_be(out, R0, L0);

      in += BLOCK_SIZE;
      out += BLOCK_SIZE;
      blocks -= 1;
      }
   }

/*
* DES Key Schedule
*/
void DES::key_schedule(const uint8_t key[], size_t /*length*/)
   {
   m_round_key.resize(32);
   des_key_schedule(m_round_key.data(), key);
   }

void DES::clear()
   {
   zap(m_round_key);
   }

/*
* TripleDES Encryption
*/
void TripleDES::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
   {
   verify_key_set(m_round_key.empty() == false);

   while(blocks >= 2)
      {
      uint32_t L0 = load_be<uint32_t>(in, 0);
      uint32_t R0 = load_be<uint32_t>(in, 1);
      uint32_t L1 = load_be<uint32_t>(in, 2);
      uint32_t R1 = load_be<uint32_t>(in, 3);

      des_IP(L0, R0);
      des_IP(L1, R1);

      des_encrypt_x2(L0, R0, L1, R1, &m_round_key[0]);
      des_decrypt_x2(R0, L0, R1, L1, &m_round_key[32]);
      des_encrypt_x2(L0, R0, L1, R1, &m_round_key[64]);

      des_FP(L0, R0);
      des_FP(L1, R1);

      store_be(out, R0, L0, R1, L1);

      in += 2*BLOCK_SIZE;
      out += 2*BLOCK_SIZE;
      blocks -= 2;
      }

   while(blocks > 0)
      {
      uint32_t L0 = load_be<uint32_t>(in, 0);
      uint32_t R0 = load_be<uint32_t>(in, 1);

      des_IP(L0, R0);
      des_encrypt(L0, R0, &m_round_key[0]);
      des_decrypt(R0, L0, &m_round_key[32]);
      des_encrypt(L0, R0, &m_round_key[64]);
      des_FP(L0, R0);

      store_be(out, R0, L0);

      in += BLOCK_SIZE;
      out += BLOCK_SIZE;
      blocks -= 1;
      }
   }

/*
* TripleDES Decryption
*/
void TripleDES::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
   {
   verify_key_set(m_round_key.empty() == false);

   while(blocks >= 2)
      {
      uint32_t L0 = load_be<uint32_t>(in, 0);
      uint32_t R0 = load_be<uint32_t>(in, 1);
      uint32_t L1 = load_be<uint32_t>(in, 2);
      uint32_t R1 = load_be<uint32_t>(in, 3);

      des_IP(L0, R0);
      des_IP(L1, R1);

      des_decrypt_x2(L0, R0, L1, R1, &m_round_key[64]);
      des_encrypt_x2(R0, L0, R1, L1, &m_round_key[32]);
      des_decrypt_x2(L0, R0, L1, R1, &m_round_key[0]);

      des_FP(L0, R0);
      des_FP(L1, R1);

      store_be(out, R0, L0, R1, L1);

      in += 2*BLOCK_SIZE;
      out += 2*BLOCK_SIZE;
      blocks -= 2;
      }

   while(blocks > 0)
      {
      uint32_t L0 = load_be<uint32_t>(in, 0);
      uint32_t R0 = load_be<uint32_t>(in, 1);

      des_IP(L0, R0);
      des_decrypt(L0, R0, &m_round_key[64]);
      des_encrypt(R0, L0, &m_round_key[32]);
      des_decrypt(L0, R0, &m_round_key[0]);
      des_FP(L0, R0);

      store_be(out, R0, L0);

      in += BLOCK_SIZE;
      out += BLOCK_SIZE;
      blocks -= 1;
      }
   }

/*
* TripleDES Key Schedule
*/
void TripleDES::key_schedule(const uint8_t key[], size_t length)
   {
   m_round_key.resize(3*32);
   des_key_schedule(&m_round_key[0], key);
   des_key_schedule(&m_round_key[32], key + 8);

   if(length == 24)
      des_key_schedule(&m_round_key[64], key + 16);
   else
      copy_mem(&m_round_key[64], &m_round_key[0], 32);
   }

void TripleDES::clear()
   {
   zap(m_round_key);
   }

}

Coverage Report

Created: 2022-11-24 06:56

Line	Count	Source (jump to first uncovered line)
1		/*
2		* DES
3		* (C) 1999-2008,2018,2020 Jack Lloyd
4		*
5		* Based on a public domain implemenation by Phil Karn (who in turn
6		* credited Richard Outerbridge and Jim Gillogly)
7		*
8		* Botan is released under the Simplified BSD License (see license.txt)
9		*/
10
11		#include <botan/internal/des.h>
12		#include <botan/internal/loadstor.h>
13		#include <botan/internal/rotate.h>
14
15		namespace Botan {
16
17		namespace {
18
19		alignas(256) const uint8_t SPBOX_CATS[64*8] = {
20		0x54, 0x00, 0x10, 0x55, 0x51, 0x15, 0x01, 0x10, 0x04, 0x54, 0x55, 0x04, 0x45, 0x51, 0x40, 0x01,
21		0x05, 0x44, 0x44, 0x14, 0x14, 0x50, 0x50, 0x45, 0x11, 0x41, 0x41, 0x11, 0x00, 0x05, 0x15, 0x40,
22		0x10, 0x55, 0x01, 0x50, 0x54, 0x40, 0x40, 0x04, 0x51, 0x10, 0x14, 0x41, 0x04, 0x01, 0x45, 0x15,
23		0x55, 0x11, 0x50, 0x45, 0x41, 0x05, 0x15, 0x54, 0x05, 0x44, 0x44, 0x00, 0x11, 0x14, 0x00, 0x51,
24
25		0x55, 0x44, 0x04, 0x15, 0x10, 0x01, 0x51, 0x45, 0x41, 0x55, 0x54, 0x40, 0x44, 0x10, 0x01, 0x51,
26		0x14, 0x11, 0x45, 0x00, 0x40, 0x04, 0x15, 0x50, 0x11, 0x41, 0x00, 0x14, 0x05, 0x54, 0x50, 0x05,
27		0x00, 0x15, 0x51, 0x10, 0x45, 0x50, 0x54, 0x04, 0x50, 0x44, 0x01, 0x55, 0x15, 0x01, 0x04, 0x40,
28		0x05, 0x54, 0x10, 0x41, 0x11, 0x45, 0x41, 0x11, 0x14, 0x00, 0x44, 0x05, 0x40, 0x51, 0x55, 0x14,
29
30		0x09, 0xA8, 0x00, 0xA1, 0x88, 0x00, 0x29, 0x88, 0x21, 0x81, 0x81, 0x20, 0xA9, 0x21, 0xA0, 0x09,
31		0x80, 0x01, 0xA8, 0x08, 0x28, 0xA0, 0xA1, 0x29, 0x89, 0x28, 0x20, 0x89, 0x01, 0xA9, 0x08, 0x80,
32		0xA8, 0x80, 0x21, 0x09, 0x20, 0xA8, 0x88, 0x00, 0x08, 0x21, 0xA9, 0x88, 0x81, 0x08, 0x00, 0xA1,
33		0x89, 0x20, 0x80, 0xA9, 0x01, 0x29, 0x28, 0x81, 0xA0, 0x89, 0x09, 0xA0, 0x29, 0x01, 0xA1, 0x28,
34
35		0x51, 0x15, 0x15, 0x04, 0x54, 0x45, 0x41, 0x11, 0x00, 0x50, 0x50, 0x55, 0x05, 0x00, 0x44, 0x41,
36		0x01, 0x10, 0x40, 0x51, 0x04, 0x40, 0x11, 0x14, 0x45, 0x01, 0x14, 0x44, 0x10, 0x54, 0x55, 0x05,
37		0x44, 0x41, 0x50, 0x55, 0x05, 0x00, 0x00, 0x50, 0x14, 0x44, 0x45, 0x01, 0x51, 0x15, 0x15, 0x04,
38		0x55, 0x05, 0x01, 0x10, 0x41, 0x11, 0x54, 0x45, 0x11, 0x14, 0x40, 0x51, 0x04, 0x40, 0x10, 0x54,
39
40		0x01, 0x29, 0x28, 0xA1, 0x08, 0x01, 0x80, 0x28, 0x89, 0x08, 0x21, 0x89, 0xA1, 0xA8, 0x09, 0x80,
41		0x20, 0x88, 0x88, 0x00, 0x81, 0xA9, 0xA9, 0x21, 0xA8, 0x81, 0x00, 0xA0, 0x29, 0x20, 0xA0, 0x09,
42		0x08, 0xA1, 0x01, 0x20, 0x80, 0x28, 0xA1, 0x89, 0x21, 0x80, 0xA8, 0x29, 0x89, 0x01, 0x20, 0xA8,
43		0xA9, 0x09, 0xA0, 0xA9, 0x28, 0x00, 0x88, 0xA0, 0x09, 0x21, 0x81, 0x08, 0x00, 0x88, 0x29, 0x81,
44
45		0x41, 0x50, 0x04, 0x55, 0x50, 0x01, 0x55, 0x10, 0x44, 0x15, 0x10, 0x41, 0x11, 0x44, 0x40, 0x05,
46		0x00, 0x11, 0x45, 0x04, 0x14, 0x45, 0x01, 0x51, 0x51, 0x00, 0x15, 0x54, 0x05, 0x14, 0x54, 0x40,
47		0x44, 0x01, 0x51, 0x14, 0x55, 0x10, 0x05, 0x41, 0x10, 0x44, 0x40, 0x05, 0x41, 0x55, 0x14, 0x50,
48		0x15, 0x54, 0x00, 0x51, 0x01, 0x04, 0x50, 0x15, 0x04, 0x11, 0x45, 0x00, 0x54, 0x40, 0x11, 0x45,
49
50		0x10, 0x51, 0x45, 0x00, 0x04, 0x45, 0x15, 0x54, 0x55, 0x10, 0x00, 0x41, 0x01, 0x40, 0x51, 0x05,
51		0x44, 0x15, 0x11, 0x44, 0x41, 0x50, 0x54, 0x11, 0x50, 0x04, 0x05, 0x55, 0x14, 0x01, 0x40, 0x14,
52		0x40, 0x14, 0x10, 0x45, 0x45, 0x51, 0x51, 0x01, 0x11, 0x40, 0x44, 0x10, 0x54, 0x05, 0x15, 0x54,
53		0x05, 0x41, 0x55, 0x50, 0x14, 0x00, 0x01, 0x55, 0x00, 0x15, 0x50, 0x04, 0x41, 0x44, 0x04, 0x11,
54
55		0x89, 0x08, 0x20, 0xA9, 0x80, 0x89, 0x01, 0x80, 0x21, 0xA0, 0xA9, 0x28, 0xA8, 0x29, 0x08, 0x01,
56		0xA0, 0x81, 0x88, 0x09, 0x28, 0x21, 0xA1, 0xA8, 0x09, 0x00, 0x00, 0xA1, 0x81, 0x88, 0x29, 0x20,
57		0x29, 0x20, 0xa8, 0x08, 0x01, 0xA1, 0x08, 0x29, 0x88, 0x01, 0x81, 0xA0, 0xA1, 0x80, 0x20, 0x89,
58		0x00, 0xA9, 0x21, 0x81, 0xA0, 0x88, 0x89, 0x00, 0xA9, 0x28, 0x28, 0x09, 0x09, 0x21, 0x80, 0xA8,
59		};
60
61		const uint32_t SPBOX_CAT_0_MUL = 0x70041106;
62		const uint32_t SPBOX_CAT_1_MUL = 0x02012020;
63		const uint32_t SPBOX_CAT_2_MUL = 0x00901048;
64		const uint32_t SPBOX_CAT_3_MUL = 0x8e060221;
65		const uint32_t SPBOX_CAT_4_MUL = 0x00912140;
66		const uint32_t SPBOX_CAT_5_MUL = 0x80841018;
67		const uint32_t SPBOX_CAT_6_MUL = 0xe0120202;
68		const uint32_t SPBOX_CAT_7_MUL = 0x00212240;
69
70		const uint32_t SPBOX_CAT_0_MASK = 0x01010404;
71		const uint32_t SPBOX_CAT_1_MASK = 0x80108020;
72		const uint32_t SPBOX_CAT_2_MASK = 0x08020208;
73		const uint32_t SPBOX_CAT_3_MASK = 0x00802081;
74		const uint32_t SPBOX_CAT_4_MASK = 0x42080100;
75		const uint32_t SPBOX_CAT_5_MASK = 0x20404010;
76		const uint32_t SPBOX_CAT_6_MASK = 0x04200802;
77		const uint32_t SPBOX_CAT_7_MASK = 0x10041040;
78
79		/*
80		* DES Key Schedule
81		*/
82		void des_key_schedule(uint32_t round_key[32], const uint8_t key[8])
83	291	{
84	291	static const uint8_t ROT[16] = { 1, 1, 2, 2, 2, 2, 2, 2,
85	291	1, 2, 2, 2, 2, 2, 2, 1 };
86
87	291	uint32_t C = ((key[7] & 0x80) << 20) \| ((key[6] & 0x80) << 19) \|
88	291	((key[5] & 0x80) << 18) \| ((key[4] & 0x80) << 17) \|
89	291	((key[3] & 0x80) << 16) \| ((key[2] & 0x80) << 15) \|
90	291	((key[1] & 0x80) << 14) \| ((key[0] & 0x80) << 13) \|
91	291	((key[7] & 0x40) << 13) \| ((key[6] & 0x40) << 12) \|
92	291	((key[5] & 0x40) << 11) \| ((key[4] & 0x40) << 10) \|
93	291	((key[3] & 0x40) << 9) \| ((key[2] & 0x40) << 8) \|
94	291	((key[1] & 0x40) << 7) \| ((key[0] & 0x40) << 6) \|
95	291	((key[7] & 0x20) << 6) \| ((key[6] & 0x20) << 5) \|
96	291	((key[5] & 0x20) << 4) \| ((key[4] & 0x20) << 3) \|
97	291	((key[3] & 0x20) << 2) \| ((key[2] & 0x20) << 1) \|
98	291	((key[1] & 0x20) ) \| ((key[0] & 0x20) >> 1) \|
99	291	((key[7] & 0x10) >> 1) \| ((key[6] & 0x10) >> 2) \|
100	291	((key[5] & 0x10) >> 3) \| ((key[4] & 0x10) >> 4);
101	291	uint32_t D = ((key[7] & 0x02) << 26) \| ((key[6] & 0x02) << 25) \|
102	291	((key[5] & 0x02) << 24) \| ((key[4] & 0x02) << 23) \|
103	291	((key[3] & 0x02) << 22) \| ((key[2] & 0x02) << 21) \|
104	291	((key[1] & 0x02) << 20) \| ((key[0] & 0x02) << 19) \|
105	291	((key[7] & 0x04) << 17) \| ((key[6] & 0x04) << 16) \|
106	291	((key[5] & 0x04) << 15) \| ((key[4] & 0x04) << 14) \|
107	291	((key[3] & 0x04) << 13) \| ((key[2] & 0x04) << 12) \|
108	291	((key[1] & 0x04) << 11) \| ((key[0] & 0x04) << 10) \|
109	291	((key[7] & 0x08) << 8) \| ((key[6] & 0x08) << 7) \|
110	291	((key[5] & 0x08) << 6) \| ((key[4] & 0x08) << 5) \|
111	291	((key[3] & 0x08) << 4) \| ((key[2] & 0x08) << 3) \|
112	291	((key[1] & 0x08) << 2) \| ((key[0] & 0x08) << 1) \|
113	291	((key[3] & 0x10) >> 1) \| ((key[2] & 0x10) >> 2) \|
114	291	((key[1] & 0x10) >> 3) \| ((key[0] & 0x10) >> 4);
115
116	4.94k	for(size_t i = 0; i != 16; ++i)
117	4.65k	{
118	4.65k	C = ((C << ROT[i]) \| (C >> (28-ROT[i]))) & 0x0FFFFFFF;
119	4.65k	D = ((D << ROT[i]) \| (D >> (28-ROT[i]))) & 0x0FFFFFFF;
120	4.65k	round_key[2*i ] = ((C & 0x00000010) << 22) \| ((C & 0x00000800) << 17) \|
121	4.65k	((C & 0x00000020) << 16) \| ((C & 0x00004004) << 15) \|
122	4.65k	((C & 0x00000200) << 11) \| ((C & 0x00020000) << 10) \|
123	4.65k	((C & 0x01000000) >> 6) \| ((C & 0x00100000) >> 4) \|
124	4.65k	((C & 0x00010000) << 3) \| ((C & 0x08000000) >> 2) \|
125	4.65k	((C & 0x00800000) << 1) \| ((D & 0x00000010) << 8) \|
126	4.65k	((D & 0x00000002) << 7) \| ((D & 0x00000001) << 2) \|
127	4.65k	((D & 0x00000200) ) \| ((D & 0x00008000) >> 2) \|
128	4.65k	((D & 0x00000088) >> 3) \| ((D & 0x00001000) >> 7) \|
129	4.65k	((D & 0x00080000) >> 9) \| ((D & 0x02020000) >> 14) \|
130	4.65k	((D & 0x00400000) >> 21);
131	4.65k	round_key[2*i+1] = ((C & 0x00000001) << 28) \| ((C & 0x00000082) << 18) \|
132	4.65k	((C & 0x00002000) << 14) \| ((C & 0x00000100) << 10) \|
133	4.65k	((C & 0x00001000) << 9) \| ((C & 0x00040000) << 6) \|
134	4.65k	((C & 0x02400000) << 4) \| ((C & 0x00008000) << 2) \|
135	4.65k	((C & 0x00200000) >> 1) \| ((C & 0x04000000) >> 10) \|
136	4.65k	((D & 0x00000020) << 6) \| ((D & 0x00000100) ) \|
137	4.65k	((D & 0x00000800) >> 1) \| ((D & 0x00000040) >> 3) \|
138	4.65k	((D & 0x00010000) >> 4) \| ((D & 0x00000400) >> 5) \|
139	4.65k	((D & 0x00004000) >> 10) \| ((D & 0x04000000) >> 13) \|
140	4.65k	((D & 0x00800000) >> 14) \| ((D & 0x00100000) >> 18) \|
141	4.65k	((D & 0x01000000) >> 24) \| ((D & 0x08000000) >> 26);
142	4.65k	}
143	291	}
144
145		inline uint32_t spbox(uint32_t T0, uint32_t T1)
146	268k	{
147	268k	return
148	268k	((SPBOX_CATS[064 + ((T0 >> 24) & 0x3F)] SPBOX_CAT_0_MUL) & SPBOX_CAT_0_MASK) ^
149	268k	((SPBOX_CATS[164 + ((T1 >> 24) & 0x3F)] SPBOX_CAT_1_MUL) & SPBOX_CAT_1_MASK) ^
150	268k	((SPBOX_CATS[264 + ((T0 >> 16) & 0x3F)] SPBOX_CAT_2_MUL) & SPBOX_CAT_2_MASK) ^
151	268k	((SPBOX_CATS[364 + ((T1 >> 16) & 0x3F)] SPBOX_CAT_3_MUL) & SPBOX_CAT_3_MASK) ^
152	268k	((SPBOX_CATS[464 + ((T0 >> 8) & 0x3F)] SPBOX_CAT_4_MUL) & SPBOX_CAT_4_MASK) ^
153	268k	((SPBOX_CATS[564 + ((T1 >> 8) & 0x3F)] SPBOX_CAT_5_MUL) & SPBOX_CAT_5_MASK) ^
154	268k	((SPBOX_CATS[664 + ((T0 >> 0) & 0x3F)] SPBOX_CAT_6_MUL) & SPBOX_CAT_6_MASK) ^
155	268k	((SPBOX_CATS[764 + ((T1 >> 0) & 0x3F)] SPBOX_CAT_7_MUL) & SPBOX_CAT_7_MASK);
156	268k	}
157
158		/*
159		* DES Encryption
160		*/
161		inline void des_encrypt(uint32_t& Lr, uint32_t& Rr,
162		const uint32_t round_key[32])
163	303	{
164	303	uint32_t L = Lr;
165	303	uint32_t R = Rr;
166	2.72k	for(size_t i = 0; i != 16; i += 2)
167	2.42k	{
168	2.42k	L ^= spbox(rotr<4>(R) ^ round_key[2i ], R ^ round_key[2i+1]);
169	2.42k	R ^= spbox(rotr<4>(L) ^ round_key[2i+2], L ^ round_key[2i+3]);
170	2.42k	}
171
172	303	Lr = L;
173	303	Rr = R;
174	303	}
175
176		inline void des_encrypt_x2(uint32_t& L0r, uint32_t& R0r,
177		uint32_t& L1r, uint32_t& R1r,
178		const uint32_t round_key[32])
179	2.71k	{
180	2.71k	uint32_t L0 = L0r;
181	2.71k	uint32_t R0 = R0r;
182	2.71k	uint32_t L1 = L1r;
183	2.71k	uint32_t R1 = R1r;
184
185	24.4k	for(size_t i = 0; i != 16; i += 2)
186	21.7k	{
187	21.7k	L0 ^= spbox(rotr<4>(R0) ^ round_key[2i ], R0 ^ round_key[2i+1]);
188	21.7k	L1 ^= spbox(rotr<4>(R1) ^ round_key[2i ], R1 ^ round_key[2i+1]);
189
190	21.7k	R0 ^= spbox(rotr<4>(L0) ^ round_key[2i+2], L0 ^ round_key[2i+3]);
191	21.7k	R1 ^= spbox(rotr<4>(L1) ^ round_key[2i+2], L1 ^ round_key[2i+3]);
192	21.7k	}
193
194	2.71k	L0r = L0;
195	2.71k	R0r = R0;
196	2.71k	L1r = L1;
197	2.71k	R1r = R1;
198	2.71k	}
199
200		/*
201		* DES Decryption
202		*/
203		inline void des_decrypt(uint32_t& Lr, uint32_t& Rr,
204		const uint32_t round_key[32])
205	192	{
206	192	uint32_t L = Lr;
207	192	uint32_t R = Rr;
208	1.72k	for(size_t i = 16; i != 0; i -= 2)
209	1.53k	{
210	1.53k	L ^= spbox(rotr<4>(R) ^ round_key[2i - 2], R ^ round_key[2i - 1]);
211	1.53k	R ^= spbox(rotr<4>(L) ^ round_key[2i - 4], L ^ round_key[2i - 3]);
212	1.53k	}
213	192	Lr = L;
214	192	Rr = R;
215	192	}
216
217		inline void des_decrypt_x2(uint32_t& L0r, uint32_t& R0r,
218		uint32_t& L1r, uint32_t& R1r,
219		const uint32_t round_key[32])
220	5.43k	{
221	5.43k	uint32_t L0 = L0r;
222	5.43k	uint32_t R0 = R0r;
223	5.43k	uint32_t L1 = L1r;
224	5.43k	uint32_t R1 = R1r;
225
226	48.8k	for(size_t i = 16; i != 0; i -= 2)
227	43.4k	{
228	43.4k	L0 ^= spbox(rotr<4>(R0) ^ round_key[2i - 2], R0 ^ round_key[2i - 1]);
229	43.4k	L1 ^= spbox(rotr<4>(R1) ^ round_key[2i - 2], R1 ^ round_key[2i - 1]);
230
231	43.4k	R0 ^= spbox(rotr<4>(L0) ^ round_key[2i - 4], L0 ^ round_key[2i - 3]);
232	43.4k	R1 ^= spbox(rotr<4>(L1) ^ round_key[2i - 4], L1 ^ round_key[2i - 3]);
233	43.4k	}
234
235	5.43k	L0r = L0;
236	5.43k	R0r = R0;
237	5.43k	L1r = L1;
238	5.43k	R1r = R1;
239	5.43k	}
240
241		inline void des_IP(uint32_t& L, uint32_t& R)
242	5.59k	{
243		// IP sequence by Wei Dai, taken from public domain Crypto++
244	5.59k	uint32_t T;
245	5.59k	R = rotl<4>(R);
246	5.59k	T = (L ^ R) & 0xF0F0F0F0;
247	5.59k	L ^= T;
248	5.59k	R = rotr<20>(R ^ T);
249	5.59k	T = (L ^ R) & 0xFFFF0000;
250	5.59k	L ^= T;
251	5.59k	R = rotr<18>(R ^ T);
252	5.59k	T = (L ^ R) & 0x33333333;
253	5.59k	L ^= T;
254	5.59k	R = rotr<6>(R ^ T);
255	5.59k	T = (L ^ R) & 0x00FF00FF;
256	5.59k	L ^= T;
257	5.59k	R = rotl<9>(R ^ T);
258	5.59k	T = (L ^ R) & 0xAAAAAAAA;
259	5.59k	L = rotl<1>(L ^ T);
260	5.59k	R ^= T;
261	5.59k	}
262
263		inline void des_FP(uint32_t& L, uint32_t& R)
264	5.59k	{
265		// FP sequence by Wei Dai, taken from public domain Crypto++
266	5.59k	uint32_t T;
267
268	5.59k	R = rotr<1>(R);
269	5.59k	T = (L ^ R) & 0xAAAAAAAA;
270	5.59k	R ^= T;
271	5.59k	L = rotr<9>(L ^ T);
272	5.59k	T = (L ^ R) & 0x00FF00FF;
273	5.59k	R ^= T;
274	5.59k	L = rotl<6>(L ^ T);
275	5.59k	T = (L ^ R) & 0x33333333;
276	5.59k	R ^= T;
277	5.59k	L = rotl<18>(L ^ T);
278	5.59k	T = (L ^ R) & 0xFFFF0000;
279	5.59k	R ^= T;
280	5.59k	L = rotl<20>(L ^ T);
281	5.59k	T = (L ^ R) & 0xF0F0F0F0;
282	5.59k	R ^= T;
283	5.59k	L = rotr<4>(L ^ T);
284	5.59k	}
285
286		}
287
288		/*
289		* DES Encryption
290		*/
291		void DES::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
292	0	{
293	0	verify_key_set(m_round_key.empty() == false);
294
295	0	while(blocks >= 2)
296	0	{
297	0	uint32_t L0 = load_be<uint32_t>(in, 0);
298	0	uint32_t R0 = load_be<uint32_t>(in, 1);
299	0	uint32_t L1 = load_be<uint32_t>(in, 2);
300	0	uint32_t R1 = load_be<uint32_t>(in, 3);
301
302	0	des_IP(L0, R0);
303	0	des_IP(L1, R1);
304
305	0	des_encrypt_x2(L0, R0, L1, R1, m_round_key.data());
306
307	0	des_FP(L0, R0);
308	0	des_FP(L1, R1);
309
310	0	store_be(out, R0, L0, R1, L1);
311
312	0	in += 2*BLOCK_SIZE;
313	0	out += 2*BLOCK_SIZE;
314	0	blocks -= 2;
315	0	}
316
317	0	while(blocks > 0)
318	0	{
319	0	uint32_t L0 = load_be<uint32_t>(in, 0);
320	0	uint32_t R0 = load_be<uint32_t>(in, 1);
321	0	des_IP(L0, R0);
322	0	des_encrypt(L0, R0, m_round_key.data());
323	0	des_FP(L0, R0);
324	0	store_be(out, R0, L0);
325
326	0	in += BLOCK_SIZE;
327	0	out += BLOCK_SIZE;
328	0	blocks -= 1;
329	0	}
330	0	}
331
332		/*
333		* DES Decryption
334		*/
335		void DES::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
336	0	{
337	0	verify_key_set(m_round_key.empty() == false);
338
339	0	while(blocks >= 2)
340	0	{
341	0	uint32_t L0 = load_be<uint32_t>(in, 0);
342	0	uint32_t R0 = load_be<uint32_t>(in, 1);
343	0	uint32_t L1 = load_be<uint32_t>(in, 2);
344	0	uint32_t R1 = load_be<uint32_t>(in, 3);
345
346	0	des_IP(L0, R0);
347	0	des_IP(L1, R1);
348
349	0	des_decrypt_x2(L0, R0, L1, R1, m_round_key.data());
350
351	0	des_FP(L0, R0);
352	0	des_FP(L1, R1);
353
354	0	store_be(out, R0, L0, R1, L1);
355
356	0	in += 2*BLOCK_SIZE;
357	0	out += 2*BLOCK_SIZE;
358	0	blocks -= 2;
359	0	}
360
361	0	while(blocks > 0)
362	0	{
363	0	uint32_t L0 = load_be<uint32_t>(in, 0);
364	0	uint32_t R0 = load_be<uint32_t>(in, 1);
365	0	des_IP(L0, R0);
366	0	des_decrypt(L0, R0, m_round_key.data());
367	0	des_FP(L0, R0);
368	0	store_be(out, R0, L0);
369
370	0	in += BLOCK_SIZE;
371	0	out += BLOCK_SIZE;
372	0	blocks -= 1;
373	0	}
374	0	}
375
376		/*
377		* DES Key Schedule
378		*/
379		void DES::key_schedule(const uint8_t key[], size_t /length/)
380	0	{
381	0	m_round_key.resize(32);
382	0	des_key_schedule(m_round_key.data(), key);
383	0	}
384
385		void DES::clear()
386	0	{
387	0	zap(m_round_key);
388	0	}
389
390		/*
391		* TripleDES Encryption
392		*/
393		void TripleDES::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
394	138	{
395	138	verify_key_set(m_round_key.empty() == false);
396
397	138	while(blocks >= 2)
398	0	{
399	0	uint32_t L0 = load_be<uint32_t>(in, 0);
400	0	uint32_t R0 = load_be<uint32_t>(in, 1);
401	0	uint32_t L1 = load_be<uint32_t>(in, 2);
402	0	uint32_t R1 = load_be<uint32_t>(in, 3);
403
404	0	des_IP(L0, R0);
405	0	des_IP(L1, R1);
406
407	0	des_encrypt_x2(L0, R0, L1, R1, &m_round_key[0]);
408	0	des_decrypt_x2(R0, L0, R1, L1, &m_round_key[32]);
409	0	des_encrypt_x2(L0, R0, L1, R1, &m_round_key[64]);
410
411	0	des_FP(L0, R0);
412	0	des_FP(L1, R1);
413
414	0	store_be(out, R0, L0, R1, L1);
415
416	0	in += 2*BLOCK_SIZE;
417	0	out += 2*BLOCK_SIZE;
418	0	blocks -= 2;
419	0	}
420
421	276	while(blocks > 0)
422	138	{
423	138	uint32_t L0 = load_be<uint32_t>(in, 0);
424	138	uint32_t R0 = load_be<uint32_t>(in, 1);
425
426	138	des_IP(L0, R0);
427	138	des_encrypt(L0, R0, &m_round_key[0]);
428	138	des_decrypt(R0, L0, &m_round_key[32]);
429	138	des_encrypt(L0, R0, &m_round_key[64]);
430	138	des_FP(L0, R0);
431
432	138	store_be(out, R0, L0);
433
434	138	in += BLOCK_SIZE;
435	138	out += BLOCK_SIZE;
436	138	blocks -= 1;
437	138	}
438	138	}
439
440		/*
441		* TripleDES Decryption
442		*/
443		void TripleDES::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
444	1.38k	{
445	1.38k	verify_key_set(m_round_key.empty() == false);
446
447	4.09k	while(blocks >= 2)
448	2.71k	{
449	2.71k	uint32_t L0 = load_be<uint32_t>(in, 0);
450	2.71k	uint32_t R0 = load_be<uint32_t>(in, 1);
451	2.71k	uint32_t L1 = load_be<uint32_t>(in, 2);
452	2.71k	uint32_t R1 = load_be<uint32_t>(in, 3);
453
454	2.71k	des_IP(L0, R0);
455	2.71k	des_IP(L1, R1);
456
457	2.71k	des_decrypt_x2(L0, R0, L1, R1, &m_round_key[64]);
458	2.71k	des_encrypt_x2(R0, L0, R1, L1, &m_round_key[32]);
459	2.71k	des_decrypt_x2(L0, R0, L1, R1, &m_round_key[0]);
460
461	2.71k	des_FP(L0, R0);
462	2.71k	des_FP(L1, R1);
463
464	2.71k	store_be(out, R0, L0, R1, L1);
465
466	2.71k	in += 2*BLOCK_SIZE;
467	2.71k	out += 2*BLOCK_SIZE;
468	2.71k	blocks -= 2;
469	2.71k	}
470
471	1.40k	while(blocks > 0)
472	27	{
473	27	uint32_t L0 = load_be<uint32_t>(in, 0);
474	27	uint32_t R0 = load_be<uint32_t>(in, 1);
475
476	27	des_IP(L0, R0);
477	27	des_decrypt(L0, R0, &m_round_key[64]);
478	27	des_encrypt(R0, L0, &m_round_key[32]);
479	27	des_decrypt(L0, R0, &m_round_key[0]);
480	27	des_FP(L0, R0);
481
482	27	store_be(out, R0, L0);
483
484	27	in += BLOCK_SIZE;
485	27	out += BLOCK_SIZE;
486	27	blocks -= 1;
487	27	}
488	1.38k	}
489
490		/*
491		* TripleDES Key Schedule
492		*/
493		void TripleDES::key_schedule(const uint8_t key[], size_t length)
494	97	{
495	97	m_round_key.resize(3*32);
496	97	des_key_schedule(&m_round_key[0], key);
497	97	des_key_schedule(&m_round_key[32], key + 8);
498
499	97	if(length == 24)
500	97	des_key_schedule(&m_round_key[64], key + 16);
501	0	else
502	0	copy_mem(&m_round_key[64], &m_round_key[0], 32);
503	97	}
504
505		void TripleDES::clear()
506	0	{
507	0	zap(m_round_key);
508	0	}
509
510		}