Coverage Report

Created: 2024-11-21 07:03

/src/openssl/crypto/camellia/camellia.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Copyright 2006-2022 The OpenSSL Project Authors. All Rights Reserved.
3
 *
4
 * Licensed under the Apache License 2.0 (the "License").  You may not use
5
 * this file except in compliance with the License.  You can obtain a copy
6
 * in the file LICENSE in the source distribution or at
7
 * https://www.openssl.org/source/license.html
8
 */
9
10
/* ====================================================================
11
 * Copyright 2006 NTT (Nippon Telegraph and Telephone Corporation) .
12
 * ALL RIGHTS RESERVED.
13
 *
14
 * Intellectual Property information for Camellia:
15
 *     http://info.isl.ntt.co.jp/crypt/eng/info/chiteki.html
16
 *
17
 * News Release for Announcement of Camellia open source:
18
 *     http://www.ntt.co.jp/news/news06e/0604/060413a.html
19
 *
20
 * The Camellia Code included herein is developed by
21
 * NTT (Nippon Telegraph and Telephone Corporation), and is contributed
22
 * to the OpenSSL project.
23
 */
24
25
/*
26
 * Algorithm Specification
27
 * http://info.isl.ntt.co.jp/crypt/eng/camellia/specifications.html
28
 */
29
30
/*
31
 * This release balances code size and performance. In particular key
32
 * schedule setup is fully unrolled, because doing so *significantly*
33
 * reduces amount of instructions per setup round and code increase is
34
 * justifiable. In block functions on the other hand only inner loops
35
 * are unrolled, as full unroll gives only nominal performance boost,
36
 * while code size grows 4 or 7 times. Also, unlike previous versions
37
 * this one "encourages" compiler to keep intermediate variables in
38
 * registers, which should give better "all round" results, in other
39
 * words reasonable performance even with not so modern compilers.
40
 */
41
42
/*
43
 * Camellia low level APIs are deprecated for public use, but still ok for
44
 * internal use.
45
 */
46
#include "internal/deprecated.h"
47
48
#include <openssl/camellia.h>
49
#include "cmll_local.h"
50
#include <string.h>
51
#include <stdlib.h>
52
53
141k
#define RightRotate(x, s) ( ((x) >> (s)) + ((x) << (32 - s)) )
54
33.5k
#define LeftRotate(x, s)  ( ((x) << (s)) + ((x) >> (32 - s)) )
55
56
27.8k
#define GETU32(p)   (((u32)(p)[0] << 24) ^ ((u32)(p)[1] << 16) ^ ((u32)(p)[2] <<  8) ^ ((u32)(p)[3]))
57
26.4k
#define PUTU32(p,v) ((p)[0] = (u8)((v) >> 24), (p)[1] = (u8)((v) >> 16), (p)[2] = (u8)((v) >>  8), (p)[3] = (u8)(v))
58
59
/* S-box data */
60
283k
#define SBOX1_1110 Camellia_SBOX[0]
61
283k
#define SBOX4_4404 Camellia_SBOX[1]
62
283k
#define SBOX2_0222 Camellia_SBOX[2]
63
283k
#define SBOX3_3033 Camellia_SBOX[3]
64
static const u32 Camellia_SBOX[][256] = {
65
    {0x70707000, 0x82828200, 0x2c2c2c00, 0xececec00, 0xb3b3b300, 0x27272700,
66
     0xc0c0c000, 0xe5e5e500, 0xe4e4e400, 0x85858500, 0x57575700, 0x35353500,
67
     0xeaeaea00, 0x0c0c0c00, 0xaeaeae00, 0x41414100, 0x23232300, 0xefefef00,
68
     0x6b6b6b00, 0x93939300, 0x45454500, 0x19191900, 0xa5a5a500, 0x21212100,
69
     0xededed00, 0x0e0e0e00, 0x4f4f4f00, 0x4e4e4e00, 0x1d1d1d00, 0x65656500,
70
     0x92929200, 0xbdbdbd00, 0x86868600, 0xb8b8b800, 0xafafaf00, 0x8f8f8f00,
71
     0x7c7c7c00, 0xebebeb00, 0x1f1f1f00, 0xcecece00, 0x3e3e3e00, 0x30303000,
72
     0xdcdcdc00, 0x5f5f5f00, 0x5e5e5e00, 0xc5c5c500, 0x0b0b0b00, 0x1a1a1a00,
73
     0xa6a6a600, 0xe1e1e100, 0x39393900, 0xcacaca00, 0xd5d5d500, 0x47474700,
74
     0x5d5d5d00, 0x3d3d3d00, 0xd9d9d900, 0x01010100, 0x5a5a5a00, 0xd6d6d600,
75
     0x51515100, 0x56565600, 0x6c6c6c00, 0x4d4d4d00, 0x8b8b8b00, 0x0d0d0d00,
76
     0x9a9a9a00, 0x66666600, 0xfbfbfb00, 0xcccccc00, 0xb0b0b000, 0x2d2d2d00,
77
     0x74747400, 0x12121200, 0x2b2b2b00, 0x20202000, 0xf0f0f000, 0xb1b1b100,
78
     0x84848400, 0x99999900, 0xdfdfdf00, 0x4c4c4c00, 0xcbcbcb00, 0xc2c2c200,
79
     0x34343400, 0x7e7e7e00, 0x76767600, 0x05050500, 0x6d6d6d00, 0xb7b7b700,
80
     0xa9a9a900, 0x31313100, 0xd1d1d100, 0x17171700, 0x04040400, 0xd7d7d700,
81
     0x14141400, 0x58585800, 0x3a3a3a00, 0x61616100, 0xdedede00, 0x1b1b1b00,
82
     0x11111100, 0x1c1c1c00, 0x32323200, 0x0f0f0f00, 0x9c9c9c00, 0x16161600,
83
     0x53535300, 0x18181800, 0xf2f2f200, 0x22222200, 0xfefefe00, 0x44444400,
84
     0xcfcfcf00, 0xb2b2b200, 0xc3c3c300, 0xb5b5b500, 0x7a7a7a00, 0x91919100,
85
     0x24242400, 0x08080800, 0xe8e8e800, 0xa8a8a800, 0x60606000, 0xfcfcfc00,
86
     0x69696900, 0x50505000, 0xaaaaaa00, 0xd0d0d000, 0xa0a0a000, 0x7d7d7d00,
87
     0xa1a1a100, 0x89898900, 0x62626200, 0x97979700, 0x54545400, 0x5b5b5b00,
88
     0x1e1e1e00, 0x95959500, 0xe0e0e000, 0xffffff00, 0x64646400, 0xd2d2d200,
89
     0x10101000, 0xc4c4c400, 0x00000000, 0x48484800, 0xa3a3a300, 0xf7f7f700,
90
     0x75757500, 0xdbdbdb00, 0x8a8a8a00, 0x03030300, 0xe6e6e600, 0xdadada00,
91
     0x09090900, 0x3f3f3f00, 0xdddddd00, 0x94949400, 0x87878700, 0x5c5c5c00,
92
     0x83838300, 0x02020200, 0xcdcdcd00, 0x4a4a4a00, 0x90909000, 0x33333300,
93
     0x73737300, 0x67676700, 0xf6f6f600, 0xf3f3f300, 0x9d9d9d00, 0x7f7f7f00,
94
     0xbfbfbf00, 0xe2e2e200, 0x52525200, 0x9b9b9b00, 0xd8d8d800, 0x26262600,
95
     0xc8c8c800, 0x37373700, 0xc6c6c600, 0x3b3b3b00, 0x81818100, 0x96969600,
96
     0x6f6f6f00, 0x4b4b4b00, 0x13131300, 0xbebebe00, 0x63636300, 0x2e2e2e00,
97
     0xe9e9e900, 0x79797900, 0xa7a7a700, 0x8c8c8c00, 0x9f9f9f00, 0x6e6e6e00,
98
     0xbcbcbc00, 0x8e8e8e00, 0x29292900, 0xf5f5f500, 0xf9f9f900, 0xb6b6b600,
99
     0x2f2f2f00, 0xfdfdfd00, 0xb4b4b400, 0x59595900, 0x78787800, 0x98989800,
100
     0x06060600, 0x6a6a6a00, 0xe7e7e700, 0x46464600, 0x71717100, 0xbababa00,
101
     0xd4d4d400, 0x25252500, 0xababab00, 0x42424200, 0x88888800, 0xa2a2a200,
102
     0x8d8d8d00, 0xfafafa00, 0x72727200, 0x07070700, 0xb9b9b900, 0x55555500,
103
     0xf8f8f800, 0xeeeeee00, 0xacacac00, 0x0a0a0a00, 0x36363600, 0x49494900,
104
     0x2a2a2a00, 0x68686800, 0x3c3c3c00, 0x38383800, 0xf1f1f100, 0xa4a4a400,
105
     0x40404000, 0x28282800, 0xd3d3d300, 0x7b7b7b00, 0xbbbbbb00, 0xc9c9c900,
106
     0x43434300, 0xc1c1c100, 0x15151500, 0xe3e3e300, 0xadadad00, 0xf4f4f400,
107
     0x77777700, 0xc7c7c700, 0x80808000, 0x9e9e9e00},
108
    {0x70700070, 0x2c2c002c, 0xb3b300b3, 0xc0c000c0, 0xe4e400e4, 0x57570057,
109
     0xeaea00ea, 0xaeae00ae, 0x23230023, 0x6b6b006b, 0x45450045, 0xa5a500a5,
110
     0xeded00ed, 0x4f4f004f, 0x1d1d001d, 0x92920092, 0x86860086, 0xafaf00af,
111
     0x7c7c007c, 0x1f1f001f, 0x3e3e003e, 0xdcdc00dc, 0x5e5e005e, 0x0b0b000b,
112
     0xa6a600a6, 0x39390039, 0xd5d500d5, 0x5d5d005d, 0xd9d900d9, 0x5a5a005a,
113
     0x51510051, 0x6c6c006c, 0x8b8b008b, 0x9a9a009a, 0xfbfb00fb, 0xb0b000b0,
114
     0x74740074, 0x2b2b002b, 0xf0f000f0, 0x84840084, 0xdfdf00df, 0xcbcb00cb,
115
     0x34340034, 0x76760076, 0x6d6d006d, 0xa9a900a9, 0xd1d100d1, 0x04040004,
116
     0x14140014, 0x3a3a003a, 0xdede00de, 0x11110011, 0x32320032, 0x9c9c009c,
117
     0x53530053, 0xf2f200f2, 0xfefe00fe, 0xcfcf00cf, 0xc3c300c3, 0x7a7a007a,
118
     0x24240024, 0xe8e800e8, 0x60600060, 0x69690069, 0xaaaa00aa, 0xa0a000a0,
119
     0xa1a100a1, 0x62620062, 0x54540054, 0x1e1e001e, 0xe0e000e0, 0x64640064,
120
     0x10100010, 0x00000000, 0xa3a300a3, 0x75750075, 0x8a8a008a, 0xe6e600e6,
121
     0x09090009, 0xdddd00dd, 0x87870087, 0x83830083, 0xcdcd00cd, 0x90900090,
122
     0x73730073, 0xf6f600f6, 0x9d9d009d, 0xbfbf00bf, 0x52520052, 0xd8d800d8,
123
     0xc8c800c8, 0xc6c600c6, 0x81810081, 0x6f6f006f, 0x13130013, 0x63630063,
124
     0xe9e900e9, 0xa7a700a7, 0x9f9f009f, 0xbcbc00bc, 0x29290029, 0xf9f900f9,
125
     0x2f2f002f, 0xb4b400b4, 0x78780078, 0x06060006, 0xe7e700e7, 0x71710071,
126
     0xd4d400d4, 0xabab00ab, 0x88880088, 0x8d8d008d, 0x72720072, 0xb9b900b9,
127
     0xf8f800f8, 0xacac00ac, 0x36360036, 0x2a2a002a, 0x3c3c003c, 0xf1f100f1,
128
     0x40400040, 0xd3d300d3, 0xbbbb00bb, 0x43430043, 0x15150015, 0xadad00ad,
129
     0x77770077, 0x80800080, 0x82820082, 0xecec00ec, 0x27270027, 0xe5e500e5,
130
     0x85850085, 0x35350035, 0x0c0c000c, 0x41410041, 0xefef00ef, 0x93930093,
131
     0x19190019, 0x21210021, 0x0e0e000e, 0x4e4e004e, 0x65650065, 0xbdbd00bd,
132
     0xb8b800b8, 0x8f8f008f, 0xebeb00eb, 0xcece00ce, 0x30300030, 0x5f5f005f,
133
     0xc5c500c5, 0x1a1a001a, 0xe1e100e1, 0xcaca00ca, 0x47470047, 0x3d3d003d,
134
     0x01010001, 0xd6d600d6, 0x56560056, 0x4d4d004d, 0x0d0d000d, 0x66660066,
135
     0xcccc00cc, 0x2d2d002d, 0x12120012, 0x20200020, 0xb1b100b1, 0x99990099,
136
     0x4c4c004c, 0xc2c200c2, 0x7e7e007e, 0x05050005, 0xb7b700b7, 0x31310031,
137
     0x17170017, 0xd7d700d7, 0x58580058, 0x61610061, 0x1b1b001b, 0x1c1c001c,
138
     0x0f0f000f, 0x16160016, 0x18180018, 0x22220022, 0x44440044, 0xb2b200b2,
139
     0xb5b500b5, 0x91910091, 0x08080008, 0xa8a800a8, 0xfcfc00fc, 0x50500050,
140
     0xd0d000d0, 0x7d7d007d, 0x89890089, 0x97970097, 0x5b5b005b, 0x95950095,
141
     0xffff00ff, 0xd2d200d2, 0xc4c400c4, 0x48480048, 0xf7f700f7, 0xdbdb00db,
142
     0x03030003, 0xdada00da, 0x3f3f003f, 0x94940094, 0x5c5c005c, 0x02020002,
143
     0x4a4a004a, 0x33330033, 0x67670067, 0xf3f300f3, 0x7f7f007f, 0xe2e200e2,
144
     0x9b9b009b, 0x26260026, 0x37370037, 0x3b3b003b, 0x96960096, 0x4b4b004b,
145
     0xbebe00be, 0x2e2e002e, 0x79790079, 0x8c8c008c, 0x6e6e006e, 0x8e8e008e,
146
     0xf5f500f5, 0xb6b600b6, 0xfdfd00fd, 0x59590059, 0x98980098, 0x6a6a006a,
147
     0x46460046, 0xbaba00ba, 0x25250025, 0x42420042, 0xa2a200a2, 0xfafa00fa,
148
     0x07070007, 0x55550055, 0xeeee00ee, 0x0a0a000a, 0x49490049, 0x68680068,
149
     0x38380038, 0xa4a400a4, 0x28280028, 0x7b7b007b, 0xc9c900c9, 0xc1c100c1,
150
     0xe3e300e3, 0xf4f400f4, 0xc7c700c7, 0x9e9e009e},
151
    {0x00e0e0e0, 0x00050505, 0x00585858, 0x00d9d9d9, 0x00676767, 0x004e4e4e,
152
     0x00818181, 0x00cbcbcb, 0x00c9c9c9, 0x000b0b0b, 0x00aeaeae, 0x006a6a6a,
153
     0x00d5d5d5, 0x00181818, 0x005d5d5d, 0x00828282, 0x00464646, 0x00dfdfdf,
154
     0x00d6d6d6, 0x00272727, 0x008a8a8a, 0x00323232, 0x004b4b4b, 0x00424242,
155
     0x00dbdbdb, 0x001c1c1c, 0x009e9e9e, 0x009c9c9c, 0x003a3a3a, 0x00cacaca,
156
     0x00252525, 0x007b7b7b, 0x000d0d0d, 0x00717171, 0x005f5f5f, 0x001f1f1f,
157
     0x00f8f8f8, 0x00d7d7d7, 0x003e3e3e, 0x009d9d9d, 0x007c7c7c, 0x00606060,
158
     0x00b9b9b9, 0x00bebebe, 0x00bcbcbc, 0x008b8b8b, 0x00161616, 0x00343434,
159
     0x004d4d4d, 0x00c3c3c3, 0x00727272, 0x00959595, 0x00ababab, 0x008e8e8e,
160
     0x00bababa, 0x007a7a7a, 0x00b3b3b3, 0x00020202, 0x00b4b4b4, 0x00adadad,
161
     0x00a2a2a2, 0x00acacac, 0x00d8d8d8, 0x009a9a9a, 0x00171717, 0x001a1a1a,
162
     0x00353535, 0x00cccccc, 0x00f7f7f7, 0x00999999, 0x00616161, 0x005a5a5a,
163
     0x00e8e8e8, 0x00242424, 0x00565656, 0x00404040, 0x00e1e1e1, 0x00636363,
164
     0x00090909, 0x00333333, 0x00bfbfbf, 0x00989898, 0x00979797, 0x00858585,
165
     0x00686868, 0x00fcfcfc, 0x00ececec, 0x000a0a0a, 0x00dadada, 0x006f6f6f,
166
     0x00535353, 0x00626262, 0x00a3a3a3, 0x002e2e2e, 0x00080808, 0x00afafaf,
167
     0x00282828, 0x00b0b0b0, 0x00747474, 0x00c2c2c2, 0x00bdbdbd, 0x00363636,
168
     0x00222222, 0x00383838, 0x00646464, 0x001e1e1e, 0x00393939, 0x002c2c2c,
169
     0x00a6a6a6, 0x00303030, 0x00e5e5e5, 0x00444444, 0x00fdfdfd, 0x00888888,
170
     0x009f9f9f, 0x00656565, 0x00878787, 0x006b6b6b, 0x00f4f4f4, 0x00232323,
171
     0x00484848, 0x00101010, 0x00d1d1d1, 0x00515151, 0x00c0c0c0, 0x00f9f9f9,
172
     0x00d2d2d2, 0x00a0a0a0, 0x00555555, 0x00a1a1a1, 0x00414141, 0x00fafafa,
173
     0x00434343, 0x00131313, 0x00c4c4c4, 0x002f2f2f, 0x00a8a8a8, 0x00b6b6b6,
174
     0x003c3c3c, 0x002b2b2b, 0x00c1c1c1, 0x00ffffff, 0x00c8c8c8, 0x00a5a5a5,
175
     0x00202020, 0x00898989, 0x00000000, 0x00909090, 0x00474747, 0x00efefef,
176
     0x00eaeaea, 0x00b7b7b7, 0x00151515, 0x00060606, 0x00cdcdcd, 0x00b5b5b5,
177
     0x00121212, 0x007e7e7e, 0x00bbbbbb, 0x00292929, 0x000f0f0f, 0x00b8b8b8,
178
     0x00070707, 0x00040404, 0x009b9b9b, 0x00949494, 0x00212121, 0x00666666,
179
     0x00e6e6e6, 0x00cecece, 0x00ededed, 0x00e7e7e7, 0x003b3b3b, 0x00fefefe,
180
     0x007f7f7f, 0x00c5c5c5, 0x00a4a4a4, 0x00373737, 0x00b1b1b1, 0x004c4c4c,
181
     0x00919191, 0x006e6e6e, 0x008d8d8d, 0x00767676, 0x00030303, 0x002d2d2d,
182
     0x00dedede, 0x00969696, 0x00262626, 0x007d7d7d, 0x00c6c6c6, 0x005c5c5c,
183
     0x00d3d3d3, 0x00f2f2f2, 0x004f4f4f, 0x00191919, 0x003f3f3f, 0x00dcdcdc,
184
     0x00797979, 0x001d1d1d, 0x00525252, 0x00ebebeb, 0x00f3f3f3, 0x006d6d6d,
185
     0x005e5e5e, 0x00fbfbfb, 0x00696969, 0x00b2b2b2, 0x00f0f0f0, 0x00313131,
186
     0x000c0c0c, 0x00d4d4d4, 0x00cfcfcf, 0x008c8c8c, 0x00e2e2e2, 0x00757575,
187
     0x00a9a9a9, 0x004a4a4a, 0x00575757, 0x00848484, 0x00111111, 0x00454545,
188
     0x001b1b1b, 0x00f5f5f5, 0x00e4e4e4, 0x000e0e0e, 0x00737373, 0x00aaaaaa,
189
     0x00f1f1f1, 0x00dddddd, 0x00595959, 0x00141414, 0x006c6c6c, 0x00929292,
190
     0x00545454, 0x00d0d0d0, 0x00787878, 0x00707070, 0x00e3e3e3, 0x00494949,
191
     0x00808080, 0x00505050, 0x00a7a7a7, 0x00f6f6f6, 0x00777777, 0x00939393,
192
     0x00868686, 0x00838383, 0x002a2a2a, 0x00c7c7c7, 0x005b5b5b, 0x00e9e9e9,
193
     0x00eeeeee, 0x008f8f8f, 0x00010101, 0x003d3d3d},
194
    {0x38003838, 0x41004141, 0x16001616, 0x76007676, 0xd900d9d9, 0x93009393,
195
     0x60006060, 0xf200f2f2, 0x72007272, 0xc200c2c2, 0xab00abab, 0x9a009a9a,
196
     0x75007575, 0x06000606, 0x57005757, 0xa000a0a0, 0x91009191, 0xf700f7f7,
197
     0xb500b5b5, 0xc900c9c9, 0xa200a2a2, 0x8c008c8c, 0xd200d2d2, 0x90009090,
198
     0xf600f6f6, 0x07000707, 0xa700a7a7, 0x27002727, 0x8e008e8e, 0xb200b2b2,
199
     0x49004949, 0xde00dede, 0x43004343, 0x5c005c5c, 0xd700d7d7, 0xc700c7c7,
200
     0x3e003e3e, 0xf500f5f5, 0x8f008f8f, 0x67006767, 0x1f001f1f, 0x18001818,
201
     0x6e006e6e, 0xaf00afaf, 0x2f002f2f, 0xe200e2e2, 0x85008585, 0x0d000d0d,
202
     0x53005353, 0xf000f0f0, 0x9c009c9c, 0x65006565, 0xea00eaea, 0xa300a3a3,
203
     0xae00aeae, 0x9e009e9e, 0xec00ecec, 0x80008080, 0x2d002d2d, 0x6b006b6b,
204
     0xa800a8a8, 0x2b002b2b, 0x36003636, 0xa600a6a6, 0xc500c5c5, 0x86008686,
205
     0x4d004d4d, 0x33003333, 0xfd00fdfd, 0x66006666, 0x58005858, 0x96009696,
206
     0x3a003a3a, 0x09000909, 0x95009595, 0x10001010, 0x78007878, 0xd800d8d8,
207
     0x42004242, 0xcc00cccc, 0xef00efef, 0x26002626, 0xe500e5e5, 0x61006161,
208
     0x1a001a1a, 0x3f003f3f, 0x3b003b3b, 0x82008282, 0xb600b6b6, 0xdb00dbdb,
209
     0xd400d4d4, 0x98009898, 0xe800e8e8, 0x8b008b8b, 0x02000202, 0xeb00ebeb,
210
     0x0a000a0a, 0x2c002c2c, 0x1d001d1d, 0xb000b0b0, 0x6f006f6f, 0x8d008d8d,
211
     0x88008888, 0x0e000e0e, 0x19001919, 0x87008787, 0x4e004e4e, 0x0b000b0b,
212
     0xa900a9a9, 0x0c000c0c, 0x79007979, 0x11001111, 0x7f007f7f, 0x22002222,
213
     0xe700e7e7, 0x59005959, 0xe100e1e1, 0xda00dada, 0x3d003d3d, 0xc800c8c8,
214
     0x12001212, 0x04000404, 0x74007474, 0x54005454, 0x30003030, 0x7e007e7e,
215
     0xb400b4b4, 0x28002828, 0x55005555, 0x68006868, 0x50005050, 0xbe00bebe,
216
     0xd000d0d0, 0xc400c4c4, 0x31003131, 0xcb00cbcb, 0x2a002a2a, 0xad00adad,
217
     0x0f000f0f, 0xca00caca, 0x70007070, 0xff00ffff, 0x32003232, 0x69006969,
218
     0x08000808, 0x62006262, 0x00000000, 0x24002424, 0xd100d1d1, 0xfb00fbfb,
219
     0xba00baba, 0xed00eded, 0x45004545, 0x81008181, 0x73007373, 0x6d006d6d,
220
     0x84008484, 0x9f009f9f, 0xee00eeee, 0x4a004a4a, 0xc300c3c3, 0x2e002e2e,
221
     0xc100c1c1, 0x01000101, 0xe600e6e6, 0x25002525, 0x48004848, 0x99009999,
222
     0xb900b9b9, 0xb300b3b3, 0x7b007b7b, 0xf900f9f9, 0xce00cece, 0xbf00bfbf,
223
     0xdf00dfdf, 0x71007171, 0x29002929, 0xcd00cdcd, 0x6c006c6c, 0x13001313,
224
     0x64006464, 0x9b009b9b, 0x63006363, 0x9d009d9d, 0xc000c0c0, 0x4b004b4b,
225
     0xb700b7b7, 0xa500a5a5, 0x89008989, 0x5f005f5f, 0xb100b1b1, 0x17001717,
226
     0xf400f4f4, 0xbc00bcbc, 0xd300d3d3, 0x46004646, 0xcf00cfcf, 0x37003737,
227
     0x5e005e5e, 0x47004747, 0x94009494, 0xfa00fafa, 0xfc00fcfc, 0x5b005b5b,
228
     0x97009797, 0xfe00fefe, 0x5a005a5a, 0xac00acac, 0x3c003c3c, 0x4c004c4c,
229
     0x03000303, 0x35003535, 0xf300f3f3, 0x23002323, 0xb800b8b8, 0x5d005d5d,
230
     0x6a006a6a, 0x92009292, 0xd500d5d5, 0x21002121, 0x44004444, 0x51005151,
231
     0xc600c6c6, 0x7d007d7d, 0x39003939, 0x83008383, 0xdc00dcdc, 0xaa00aaaa,
232
     0x7c007c7c, 0x77007777, 0x56005656, 0x05000505, 0x1b001b1b, 0xa400a4a4,
233
     0x15001515, 0x34003434, 0x1e001e1e, 0x1c001c1c, 0xf800f8f8, 0x52005252,
234
     0x20002020, 0x14001414, 0xe900e9e9, 0xbd00bdbd, 0xdd00dddd, 0xe400e4e4,
235
     0xa100a1a1, 0xe000e0e0, 0x8a008a8a, 0xf100f1f1, 0xd600d6d6, 0x7a007a7a,
236
     0xbb00bbbb, 0xe300e3e3, 0x40004040, 0x4f004f4f}
237
};
238
239
/* Key generation constants */
240
static const u32 SIGMA[] = {
241
    0xa09e667f, 0x3bcc908b, 0xb67ae858, 0x4caa73b2, 0xc6ef372f, 0xe94f82be,
242
    0x54ff53a5, 0xf1d36f1c, 0x10e527fa, 0xde682d1d, 0xb05688c2, 0xb3e6c1fd
243
};
244
245
/* The phi algorithm given in C.2.7 of the Camellia spec document. */
246
/*
247
 * This version does not attempt to minimize amount of temporary
248
 * variables, but instead explicitly exposes algorithm's parallelism.
249
 * It is therefore most appropriate for platforms with not less than
250
 * ~16 registers. For platforms with less registers [well, x86 to be
251
 * specific] assembler version should be/is provided anyway...
252
 */
253
141k
#define Camellia_Feistel(_s0,_s1,_s2,_s3,_key) do {\
254
141k
        register u32 _t0,_t1,_t2,_t3;\
255
141k
\
256
141k
        _t0  = _s0 ^ (_key)[0];\
257
141k
        _t3  = SBOX4_4404[_t0&0xff];\
258
141k
        _t1  = _s1 ^ (_key)[1];\
259
141k
        _t3 ^= SBOX3_3033[(_t0 >> 8)&0xff];\
260
141k
        _t2  = SBOX1_1110[_t1&0xff];\
261
141k
        _t3 ^= SBOX2_0222[(_t0 >> 16)&0xff];\
262
141k
        _t2 ^= SBOX4_4404[(_t1 >> 8)&0xff];\
263
141k
        _t3 ^= SBOX1_1110[(_t0 >> 24)];\
264
141k
        _t2 ^= _t3;\
265
141k
        _t3  = RightRotate(_t3,8);\
266
141k
        _t2 ^= SBOX3_3033[(_t1 >> 16)&0xff];\
267
141k
        _s3 ^= _t3;\
268
141k
        _t2 ^= SBOX2_0222[(_t1 >> 24)];\
269
141k
        _s2 ^= _t2; \
270
141k
        _s3 ^= _t2;\
271
141k
} while(0)
272
273
/*
274
 * Note that n has to be less than 32. Rotations for larger amount
275
 * of bits are achieved by "rotating" order of s-elements and
276
 * adjusting n accordingly, e.g. RotLeft128(s1,s2,s3,s0,n-32).
277
 */
278
3.42k
#define RotLeft128(_s0,_s1,_s2,_s3,_n) do {\
279
3.42k
        u32 _t0=_s0>>(32-_n);\
280
3.42k
        _s0 = (_s0<<_n) | (_s1>>(32-_n));\
281
3.42k
        _s1 = (_s1<<_n) | (_s2>>(32-_n));\
282
3.42k
        _s2 = (_s2<<_n) | (_s3>>(32-_n));\
283
3.42k
        _s3 = (_s3<<_n) | _t0;\
284
3.42k
} while (0)
285
286
int Camellia_Ekeygen(int keyBitLength, const u8 *rawKey, KEY_TABLE_TYPE k)
287
260
{
288
260
    register u32 s0, s1, s2, s3;
289
290
260
    k[0] = s0 = GETU32(rawKey);
291
260
    k[1] = s1 = GETU32(rawKey + 4);
292
260
    k[2] = s2 = GETU32(rawKey + 8);
293
260
    k[3] = s3 = GETU32(rawKey + 12);
294
295
260
    if (keyBitLength != 128) {
296
152
        k[8] = s0 = GETU32(rawKey + 16);
297
152
        k[9] = s1 = GETU32(rawKey + 20);
298
152
        if (keyBitLength == 192) {
299
149
            k[10] = s2 = ~s0;
300
149
            k[11] = s3 = ~s1;
301
149
        } else {
302
3
            k[10] = s2 = GETU32(rawKey + 24);
303
3
            k[11] = s3 = GETU32(rawKey + 28);
304
3
        }
305
152
        s0 ^= k[0], s1 ^= k[1], s2 ^= k[2], s3 ^= k[3];
306
152
    }
307
308
    /* Use the Feistel routine to scramble the key material */
309
260
    Camellia_Feistel(s0, s1, s2, s3, SIGMA + 0);
310
260
    Camellia_Feistel(s2, s3, s0, s1, SIGMA + 2);
311
312
260
    s0 ^= k[0], s1 ^= k[1], s2 ^= k[2], s3 ^= k[3];
313
260
    Camellia_Feistel(s0, s1, s2, s3, SIGMA + 4);
314
260
    Camellia_Feistel(s2, s3, s0, s1, SIGMA + 6);
315
316
    /* Fill the keyTable. Requires many block rotations. */
317
260
    if (keyBitLength == 128) {
318
108
        k[4] = s0, k[5] = s1, k[6] = s2, k[7] = s3;
319
108
        RotLeft128(s0, s1, s2, s3, 15); /* KA <<< 15 */
320
108
        k[12] = s0, k[13] = s1, k[14] = s2, k[15] = s3;
321
108
        RotLeft128(s0, s1, s2, s3, 15); /* KA <<< 30 */
322
108
        k[16] = s0, k[17] = s1, k[18] = s2, k[19] = s3;
323
108
        RotLeft128(s0, s1, s2, s3, 15); /* KA <<< 45 */
324
108
        k[24] = s0, k[25] = s1;
325
108
        RotLeft128(s0, s1, s2, s3, 15); /* KA <<< 60 */
326
108
        k[28] = s0, k[29] = s1, k[30] = s2, k[31] = s3;
327
108
        RotLeft128(s1, s2, s3, s0, 2); /* KA <<< 94 */
328
108
        k[40] = s1, k[41] = s2, k[42] = s3, k[43] = s0;
329
108
        RotLeft128(s1, s2, s3, s0, 17); /* KA <<<111 */
330
108
        k[48] = s1, k[49] = s2, k[50] = s3, k[51] = s0;
331
332
108
        s0 = k[0], s1 = k[1], s2 = k[2], s3 = k[3];
333
108
        RotLeft128(s0, s1, s2, s3, 15); /* KL <<< 15 */
334
108
        k[8] = s0, k[9] = s1, k[10] = s2, k[11] = s3;
335
108
        RotLeft128(s0, s1, s2, s3, 30); /* KL <<< 45 */
336
108
        k[20] = s0, k[21] = s1, k[22] = s2, k[23] = s3;
337
108
        RotLeft128(s0, s1, s2, s3, 15); /* KL <<< 60 */
338
108
        k[26] = s2, k[27] = s3;
339
108
        RotLeft128(s0, s1, s2, s3, 17); /* KL <<< 77 */
340
108
        k[32] = s0, k[33] = s1, k[34] = s2, k[35] = s3;
341
108
        RotLeft128(s0, s1, s2, s3, 17); /* KL <<< 94 */
342
108
        k[36] = s0, k[37] = s1, k[38] = s2, k[39] = s3;
343
108
        RotLeft128(s0, s1, s2, s3, 17); /* KL <<<111 */
344
108
        k[44] = s0, k[45] = s1, k[46] = s2, k[47] = s3;
345
346
108
        return 3;               /* grand rounds */
347
152
    } else {
348
152
        k[12] = s0, k[13] = s1, k[14] = s2, k[15] = s3;
349
152
        s0 ^= k[8], s1 ^= k[9], s2 ^= k[10], s3 ^= k[11];
350
152
        Camellia_Feistel(s0, s1, s2, s3, (SIGMA + 8));
351
152
        Camellia_Feistel(s2, s3, s0, s1, (SIGMA + 10));
352
353
152
        k[4] = s0, k[5] = s1, k[6] = s2, k[7] = s3;
354
152
        RotLeft128(s0, s1, s2, s3, 30); /* KB <<< 30 */
355
152
        k[20] = s0, k[21] = s1, k[22] = s2, k[23] = s3;
356
152
        RotLeft128(s0, s1, s2, s3, 30); /* KB <<< 60 */
357
152
        k[40] = s0, k[41] = s1, k[42] = s2, k[43] = s3;
358
152
        RotLeft128(s1, s2, s3, s0, 19); /* KB <<<111 */
359
152
        k[64] = s1, k[65] = s2, k[66] = s3, k[67] = s0;
360
361
152
        s0 = k[8], s1 = k[9], s2 = k[10], s3 = k[11];
362
152
        RotLeft128(s0, s1, s2, s3, 15); /* KR <<< 15 */
363
152
        k[8] = s0, k[9] = s1, k[10] = s2, k[11] = s3;
364
152
        RotLeft128(s0, s1, s2, s3, 15); /* KR <<< 30 */
365
152
        k[16] = s0, k[17] = s1, k[18] = s2, k[19] = s3;
366
152
        RotLeft128(s0, s1, s2, s3, 30); /* KR <<< 60 */
367
152
        k[36] = s0, k[37] = s1, k[38] = s2, k[39] = s3;
368
152
        RotLeft128(s1, s2, s3, s0, 2); /* KR <<< 94 */
369
152
        k[52] = s1, k[53] = s2, k[54] = s3, k[55] = s0;
370
371
152
        s0 = k[12], s1 = k[13], s2 = k[14], s3 = k[15];
372
152
        RotLeft128(s0, s1, s2, s3, 15); /* KA <<< 15 */
373
152
        k[12] = s0, k[13] = s1, k[14] = s2, k[15] = s3;
374
152
        RotLeft128(s0, s1, s2, s3, 30); /* KA <<< 45 */
375
152
        k[28] = s0, k[29] = s1, k[30] = s2, k[31] = s3;
376
        /* KA <<< 77 */
377
152
        k[48] = s1, k[49] = s2, k[50] = s3, k[51] = s0;
378
152
        RotLeft128(s1, s2, s3, s0, 17); /* KA <<< 94 */
379
152
        k[56] = s1, k[57] = s2, k[58] = s3, k[59] = s0;
380
381
152
        s0 = k[0], s1 = k[1], s2 = k[2], s3 = k[3];
382
152
        RotLeft128(s1, s2, s3, s0, 13); /* KL <<< 45 */
383
152
        k[24] = s1, k[25] = s2, k[26] = s3, k[27] = s0;
384
152
        RotLeft128(s1, s2, s3, s0, 15); /* KL <<< 60 */
385
152
        k[32] = s1, k[33] = s2, k[34] = s3, k[35] = s0;
386
152
        RotLeft128(s1, s2, s3, s0, 17); /* KL <<< 77 */
387
152
        k[44] = s1, k[45] = s2, k[46] = s3, k[47] = s0;
388
152
        RotLeft128(s2, s3, s0, s1, 2); /* KL <<<111 */
389
152
        k[60] = s2, k[61] = s3, k[62] = s0, k[63] = s1;
390
391
152
        return 4;               /* grand rounds */
392
152
    }
393
    /*
394
     * It is possible to perform certain precalculations, which
395
     * would spare few cycles in block procedure. It's not done,
396
     * because it upsets the performance balance between key
397
     * setup and block procedures, negatively affecting overall
398
     * throughput in applications operating on short messages
399
     * and volatile keys.
400
     */
401
260
}
402
403
void Camellia_EncryptBlock_Rounds(int grandRounds, const u8 plaintext[],
404
                                  const KEY_TABLE_TYPE keyTable,
405
                                  u8 ciphertext[])
406
6.61k
{
407
6.61k
    register u32 s0, s1, s2, s3;
408
6.61k
    const u32 *k = keyTable, *kend = keyTable + grandRounds * 16;
409
410
6.61k
    s0 = GETU32(plaintext) ^ k[0];
411
6.61k
    s1 = GETU32(plaintext + 4) ^ k[1];
412
6.61k
    s2 = GETU32(plaintext + 8) ^ k[2];
413
6.61k
    s3 = GETU32(plaintext + 12) ^ k[3];
414
6.61k
    k += 4;
415
416
23.3k
    while (1) {
417
        /* Camellia makes 6 Feistel rounds */
418
23.3k
        Camellia_Feistel(s0, s1, s2, s3, k + 0);
419
23.3k
        Camellia_Feistel(s2, s3, s0, s1, k + 2);
420
23.3k
        Camellia_Feistel(s0, s1, s2, s3, k + 4);
421
23.3k
        Camellia_Feistel(s2, s3, s0, s1, k + 6);
422
23.3k
        Camellia_Feistel(s0, s1, s2, s3, k + 8);
423
23.3k
        Camellia_Feistel(s2, s3, s0, s1, k + 10);
424
23.3k
        k += 12;
425
426
23.3k
        if (k == kend)
427
6.61k
            break;
428
429
        /*
430
         * This is the same function as the diffusion function D of the
431
         * accompanying documentation. See section 3.2 for properties of the
432
         * FLlayer function.
433
         */
434
16.7k
        s1 ^= LeftRotate(s0 & k[0], 1);
435
16.7k
        s2 ^= s3 | k[3];
436
16.7k
        s0 ^= s1 | k[1];
437
16.7k
        s3 ^= LeftRotate(s2 & k[2], 1);
438
16.7k
        k += 4;
439
16.7k
    }
440
441
6.61k
    s2 ^= k[0], s3 ^= k[1], s0 ^= k[2], s1 ^= k[3];
442
443
6.61k
    PUTU32(ciphertext, s2);
444
6.61k
    PUTU32(ciphertext + 4, s3);
445
6.61k
    PUTU32(ciphertext + 8, s0);
446
6.61k
    PUTU32(ciphertext + 12, s1);
447
6.61k
}
448
449
void Camellia_EncryptBlock(int keyBitLength, const u8 plaintext[],
450
                           const KEY_TABLE_TYPE keyTable, u8 ciphertext[])
451
0
{
452
0
    Camellia_EncryptBlock_Rounds(keyBitLength == 128 ? 3 : 4,
453
0
                                 plaintext, keyTable, ciphertext);
454
0
}
455
456
void Camellia_DecryptBlock_Rounds(int grandRounds, const u8 ciphertext[],
457
                                  const KEY_TABLE_TYPE keyTable,
458
                                  u8 plaintext[])
459
0
{
460
0
    u32 s0, s1, s2, s3;
461
0
    const u32 *k = keyTable + grandRounds * 16, *kend = keyTable + 4;
462
463
0
    s0 = GETU32(ciphertext) ^ k[0];
464
0
    s1 = GETU32(ciphertext + 4) ^ k[1];
465
0
    s2 = GETU32(ciphertext + 8) ^ k[2];
466
0
    s3 = GETU32(ciphertext + 12) ^ k[3];
467
468
0
    while (1) {
469
        /* Camellia makes 6 Feistel rounds */
470
0
        k -= 12;
471
0
        Camellia_Feistel(s0, s1, s2, s3, k + 10);
472
0
        Camellia_Feistel(s2, s3, s0, s1, k + 8);
473
0
        Camellia_Feistel(s0, s1, s2, s3, k + 6);
474
0
        Camellia_Feistel(s2, s3, s0, s1, k + 4);
475
0
        Camellia_Feistel(s0, s1, s2, s3, k + 2);
476
0
        Camellia_Feistel(s2, s3, s0, s1, k + 0);
477
478
0
        if (k == kend)
479
0
            break;
480
481
        /*
482
         * This is the same function as the diffusion function D of the
483
         * accompanying documentation. See section 3.2 for properties of the
484
         * FLlayer function.
485
         */
486
0
        k -= 4;
487
0
        s1 ^= LeftRotate(s0 & k[2], 1);
488
0
        s2 ^= s3 | k[1];
489
0
        s0 ^= s1 | k[3];
490
0
        s3 ^= LeftRotate(s2 & k[0], 1);
491
0
    }
492
493
0
    k -= 4;
494
0
    s2 ^= k[0], s3 ^= k[1], s0 ^= k[2], s1 ^= k[3];
495
496
0
    PUTU32(plaintext, s2);
497
0
    PUTU32(plaintext + 4, s3);
498
0
    PUTU32(plaintext + 8, s0);
499
0
    PUTU32(plaintext + 12, s1);
500
0
}
501
502
void Camellia_DecryptBlock(int keyBitLength, const u8 ciphertext[],
503
                           const KEY_TABLE_TYPE keyTable, u8 plaintext[])
504
0
{
505
0
    Camellia_DecryptBlock_Rounds(keyBitLength == 128 ? 3 : 4,
506
0
                                 ciphertext, keyTable, plaintext);
507
0
}