/src/openssl/crypto/des/set_key.c

Source
/*
 * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

/*-
 * set_key.c v 1.4 eay 24/9/91
 * 1.4 Speed up by 400% :-)
 * 1.3 added register declarations.
 * 1.2 unrolled make_key_sched a bit more
 * 1.1 added norm_expand_bits
 * 1.0 First working version
 */

/*
 * DES low level APIs are deprecated for public use, but still ok for internal
 * use.
 */
#include "internal/deprecated.h"

#include <openssl/crypto.h>
#include "internal/constant_time.h"
#include "internal/nelem.h"
#include "des_local.h"

static const unsigned char odd_parity[256] = {
    1, 1, 2, 2, 4, 4, 7, 7, 8, 8, 11, 11, 13, 13, 14, 14,
    16, 16, 19, 19, 21, 21, 22, 22, 25, 25, 26, 26, 28, 28, 31, 31,
    32, 32, 35, 35, 37, 37, 38, 38, 41, 41, 42, 42, 44, 44, 47, 47,
    49, 49, 50, 50, 52, 52, 55, 55, 56, 56, 59, 59, 61, 61, 62, 62,
    64, 64, 67, 67, 69, 69, 70, 70, 73, 73, 74, 74, 76, 76, 79, 79,
    81, 81, 82, 82, 84, 84, 87, 87, 88, 88, 91, 91, 93, 93, 94, 94,
    97, 97, 98, 98, 100, 100, 103, 103, 104, 104, 107, 107, 109, 109, 110,
    110,
    112, 112, 115, 115, 117, 117, 118, 118, 121, 121, 122, 122, 124, 124, 127,
    127,
    128, 128, 131, 131, 133, 133, 134, 134, 137, 137, 138, 138, 140, 140, 143,
    143,
    145, 145, 146, 146, 148, 148, 151, 151, 152, 152, 155, 155, 157, 157, 158,
    158,
    161, 161, 162, 162, 164, 164, 167, 167, 168, 168, 171, 171, 173, 173, 174,
    174,
    176, 176, 179, 179, 181, 181, 182, 182, 185, 185, 186, 186, 188, 188, 191,
    191,
    193, 193, 194, 194, 196, 196, 199, 199, 200, 200, 203, 203, 205, 205, 206,
    206,
    208, 208, 211, 211, 213, 213, 214, 214, 217, 217, 218, 218, 220, 220, 223,
    223,
    224, 224, 227, 227, 229, 229, 230, 230, 233, 233, 234, 234, 236, 236, 239,
    239,
    241, 241, 242, 242, 244, 244, 247, 247, 248, 248, 251, 251, 253, 253, 254,
    254
};

void DES_set_odd_parity(DES_cblock *key)
{
    unsigned int i;

    for (i = 0; i < DES_KEY_SZ; i++)
        (*key)[i] = odd_parity[(*key)[i]];
}

/*
 * Check that a key has the correct parity.
 * Return 1 if parity is okay and 0 if not.
 */
int DES_check_key_parity(const_DES_cblock *key)
{
    unsigned int i;
    unsigned char res = 0377, b;

    for (i = 0; i < DES_KEY_SZ; i++) {
        b = (*key)[i];
        b ^= b >> 4;
        b ^= b >> 2;
        b ^= b >> 1;
        res &= constant_time_eq_8(b & 1, 1);
    }
    return (int)(res & 1);
}

/*-
 * Weak and semi weak keys as taken from
 * %A D.W. Davies
 * %A W.L. Price
 * %T Security for Computer Networks
 * %I John Wiley & Sons
 * %D 1984
 */
static const DES_cblock weak_keys[] = {
    /* weak keys */
    { 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01 },
    { 0xFE, 0xFE, 0xFE, 0xFE, 0xFE, 0xFE, 0xFE, 0xFE },
    { 0x1F, 0x1F, 0x1F, 0x1F, 0x0E, 0x0E, 0x0E, 0x0E },
    { 0xE0, 0xE0, 0xE0, 0xE0, 0xF1, 0xF1, 0xF1, 0xF1 },
    /* semi-weak keys */
    { 0x01, 0xFE, 0x01, 0xFE, 0x01, 0xFE, 0x01, 0xFE },
    { 0xFE, 0x01, 0xFE, 0x01, 0xFE, 0x01, 0xFE, 0x01 },
    { 0x1F, 0xE0, 0x1F, 0xE0, 0x0E, 0xF1, 0x0E, 0xF1 },
    { 0xE0, 0x1F, 0xE0, 0x1F, 0xF1, 0x0E, 0xF1, 0x0E },
    { 0x01, 0xE0, 0x01, 0xE0, 0x01, 0xF1, 0x01, 0xF1 },
    { 0xE0, 0x01, 0xE0, 0x01, 0xF1, 0x01, 0xF1, 0x01 },
    { 0x1F, 0xFE, 0x1F, 0xFE, 0x0E, 0xFE, 0x0E, 0xFE },
    { 0xFE, 0x1F, 0xFE, 0x1F, 0xFE, 0x0E, 0xFE, 0x0E },
    { 0x01, 0x1F, 0x01, 0x1F, 0x01, 0x0E, 0x01, 0x0E },
    { 0x1F, 0x01, 0x1F, 0x01, 0x0E, 0x01, 0x0E, 0x01 },
    { 0xE0, 0xFE, 0xE0, 0xFE, 0xF1, 0xFE, 0xF1, 0xFE },
    { 0xFE, 0xE0, 0xFE, 0xE0, 0xFE, 0xF1, 0xFE, 0xF1 }
};

/*
 * Check for weak keys.
 * Return 1 if the key is weak and 0 otherwise.
 */
int DES_is_weak_key(const_DES_cblock *key)
{
    unsigned int i, res = 0;
    int j;

    for (i = 0; i < OSSL_NELEM(weak_keys); i++) {
        j = CRYPTO_memcmp(weak_keys[i], key, sizeof(DES_cblock));
        res |= constant_time_is_zero((unsigned int)j);
    }
    return (int)(res & 1);
}

/*-
 * NOW DEFINED IN des_local.h
 * See ecb_encrypt.c for a pseudo description of these macros.
 * #define PERM_OP(a,b,t,n,m) ((t)=((((a)>>(n))^(b))&(m)),\
 *      (b)^=(t),\
 *      (a)=((a)^((t)<<(n))))
 */

#define HPERM_OP(a, t, n, m) ((t) = ((((a) << (16 - (n))) ^ (a)) & (m)), \
    (a) = (a) ^ (t) ^ (t >> (16 - (n))))

static const DES_LONG des_skb[8][64] = {
    {
        /* for C bits (numbered as per FIPS 46) 1 2 3 4 5 6 */
        0x00000000L,
        0x00000010L,
        0x20000000L,
        0x20000010L,
        0x00010000L,
        0x00010010L,
        0x20010000L,
        0x20010010L,
        0x00000800L,
        0x00000810L,
        0x20000800L,
        0x20000810L,
        0x00010800L,
        0x00010810L,
        0x20010800L,
        0x20010810L,
        0x00000020L,
        0x00000030L,
        0x20000020L,
        0x20000030L,
        0x00010020L,
        0x00010030L,
        0x20010020L,
        0x20010030L,
        0x00000820L,
        0x00000830L,
        0x20000820L,
        0x20000830L,
        0x00010820L,
        0x00010830L,
        0x20010820L,
        0x20010830L,
        0x00080000L,
        0x00080010L,
        0x20080000L,
        0x20080010L,
        0x00090000L,
        0x00090010L,
        0x20090000L,
        0x20090010L,
        0x00080800L,
        0x00080810L,
        0x20080800L,
        0x20080810L,
        0x00090800L,
        0x00090810L,
        0x20090800L,
        0x20090810L,
        0x00080020L,
        0x00080030L,
        0x20080020L,
        0x20080030L,
        0x00090020L,
        0x00090030L,
        0x20090020L,
        0x20090030L,
        0x00080820L,
        0x00080830L,
        0x20080820L,
        0x20080830L,
        0x00090820L,
        0x00090830L,
        0x20090820L,
        0x20090830L,
    },
    {
        /* for C bits (numbered as per FIPS 46) 7 8 10 11 12 13 */
        0x00000000L,
        0x02000000L,
        0x00002000L,
        0x02002000L,
        0x00200000L,
        0x02200000L,
        0x00202000L,
        0x02202000L,
        0x00000004L,
        0x02000004L,
        0x00002004L,
        0x02002004L,
        0x00200004L,
        0x02200004L,
        0x00202004L,
        0x02202004L,
        0x00000400L,
        0x02000400L,
        0x00002400L,
        0x02002400L,
        0x00200400L,
        0x02200400L,
        0x00202400L,
        0x02202400L,
        0x00000404L,
        0x02000404L,
        0x00002404L,
        0x02002404L,
        0x00200404L,
        0x02200404L,
        0x00202404L,
        0x02202404L,
        0x10000000L,
        0x12000000L,
        0x10002000L,
        0x12002000L,
        0x10200000L,
        0x12200000L,
        0x10202000L,
        0x12202000L,
        0x10000004L,
        0x12000004L,
        0x10002004L,
        0x12002004L,
        0x10200004L,
        0x12200004L,
        0x10202004L,
        0x12202004L,
        0x10000400L,
        0x12000400L,
        0x10002400L,
        0x12002400L,
        0x10200400L,
        0x12200400L,
        0x10202400L,
        0x12202400L,
        0x10000404L,
        0x12000404L,
        0x10002404L,
        0x12002404L,
        0x10200404L,
        0x12200404L,
        0x10202404L,
        0x12202404L,
    },
    {
        /* for C bits (numbered as per FIPS 46) 14 15 16 17 19 20 */
        0x00000000L,
        0x00000001L,
        0x00040000L,
        0x00040001L,
        0x01000000L,
        0x01000001L,
        0x01040000L,
        0x01040001L,
        0x00000002L,
        0x00000003L,
        0x00040002L,
        0x00040003L,
        0x01000002L,
        0x01000003L,
        0x01040002L,
        0x01040003L,
        0x00000200L,
        0x00000201L,
        0x00040200L,
        0x00040201L,
        0x01000200L,
        0x01000201L,
        0x01040200L,
        0x01040201L,
        0x00000202L,
        0x00000203L,
        0x00040202L,
        0x00040203L,
        0x01000202L,
        0x01000203L,
        0x01040202L,
        0x01040203L,
        0x08000000L,
        0x08000001L,
        0x08040000L,
        0x08040001L,
        0x09000000L,
        0x09000001L,
        0x09040000L,
        0x09040001L,
        0x08000002L,
        0x08000003L,
        0x08040002L,
        0x08040003L,
        0x09000002L,
        0x09000003L,
        0x09040002L,
        0x09040003L,
        0x08000200L,
        0x08000201L,
        0x08040200L,
        0x08040201L,
        0x09000200L,
        0x09000201L,
        0x09040200L,
        0x09040201L,
        0x08000202L,
        0x08000203L,
        0x08040202L,
        0x08040203L,
        0x09000202L,
        0x09000203L,
        0x09040202L,
        0x09040203L,
    },
    {
        /* for C bits (numbered as per FIPS 46) 21 23 24 26 27 28 */
        0x00000000L,
        0x00100000L,
        0x00000100L,
        0x00100100L,
        0x00000008L,
        0x00100008L,
        0x00000108L,
        0x00100108L,
        0x00001000L,
        0x00101000L,
        0x00001100L,
        0x00101100L,
        0x00001008L,
        0x00101008L,
        0x00001108L,
        0x00101108L,
        0x04000000L,
        0x04100000L,
        0x04000100L,
        0x04100100L,
        0x04000008L,
        0x04100008L,
        0x04000108L,
        0x04100108L,
        0x04001000L,
        0x04101000L,
        0x04001100L,
        0x04101100L,
        0x04001008L,
        0x04101008L,
        0x04001108L,
        0x04101108L,
        0x00020000L,
        0x00120000L,
        0x00020100L,
        0x00120100L,
        0x00020008L,
        0x00120008L,
        0x00020108L,
        0x00120108L,
        0x00021000L,
        0x00121000L,
        0x00021100L,
        0x00121100L,
        0x00021008L,
        0x00121008L,
        0x00021108L,
        0x00121108L,
        0x04020000L,
        0x04120000L,
        0x04020100L,
        0x04120100L,
        0x04020008L,
        0x04120008L,
        0x04020108L,
        0x04120108L,
        0x04021000L,
        0x04121000L,
        0x04021100L,
        0x04121100L,
        0x04021008L,
        0x04121008L,
        0x04021108L,
        0x04121108L,
    },
    {
        /* for D bits (numbered as per FIPS 46) 1 2 3 4 5 6 */
        0x00000000L,
        0x10000000L,
        0x00010000L,
        0x10010000L,
        0x00000004L,
        0x10000004L,
        0x00010004L,
        0x10010004L,
        0x20000000L,
        0x30000000L,
        0x20010000L,
        0x30010000L,
        0x20000004L,
        0x30000004L,
        0x20010004L,
        0x30010004L,
        0x00100000L,
        0x10100000L,
        0x00110000L,
        0x10110000L,
        0x00100004L,
        0x10100004L,
        0x00110004L,
        0x10110004L,
        0x20100000L,
        0x30100000L,
        0x20110000L,
        0x30110000L,
        0x20100004L,
        0x30100004L,
        0x20110004L,
        0x30110004L,
        0x00001000L,
        0x10001000L,
        0x00011000L,
        0x10011000L,
        0x00001004L,
        0x10001004L,
        0x00011004L,
        0x10011004L,
        0x20001000L,
        0x30001000L,
        0x20011000L,
        0x30011000L,
        0x20001004L,
        0x30001004L,
        0x20011004L,
        0x30011004L,
        0x00101000L,
        0x10101000L,
        0x00111000L,
        0x10111000L,
        0x00101004L,
        0x10101004L,
        0x00111004L,
        0x10111004L,
        0x20101000L,
        0x30101000L,
        0x20111000L,
        0x30111000L,
        0x20101004L,
        0x30101004L,
        0x20111004L,
        0x30111004L,
    },
    {
        /* for D bits (numbered as per FIPS 46) 8 9 11 12 13 14 */
        0x00000000L,
        0x08000000L,
        0x00000008L,
        0x08000008L,
        0x00000400L,
        0x08000400L,
        0x00000408L,
        0x08000408L,
        0x00020000L,
        0x08020000L,
        0x00020008L,
        0x08020008L,
        0x00020400L,
        0x08020400L,
        0x00020408L,
        0x08020408L,
        0x00000001L,
        0x08000001L,
        0x00000009L,
        0x08000009L,
        0x00000401L,
        0x08000401L,
        0x00000409L,
        0x08000409L,
        0x00020001L,
        0x08020001L,
        0x00020009L,
        0x08020009L,
        0x00020401L,
        0x08020401L,
        0x00020409L,
        0x08020409L,
        0x02000000L,
        0x0A000000L,
        0x02000008L,
        0x0A000008L,
        0x02000400L,
        0x0A000400L,
        0x02000408L,
        0x0A000408L,
        0x02020000L,
        0x0A020000L,
        0x02020008L,
        0x0A020008L,
        0x02020400L,
        0x0A020400L,
        0x02020408L,
        0x0A020408L,
        0x02000001L,
        0x0A000001L,
        0x02000009L,
        0x0A000009L,
        0x02000401L,
        0x0A000401L,
        0x02000409L,
        0x0A000409L,
        0x02020001L,
        0x0A020001L,
        0x02020009L,
        0x0A020009L,
        0x02020401L,
        0x0A020401L,
        0x02020409L,
        0x0A020409L,
    },
    {
        /* for D bits (numbered as per FIPS 46) 16 17 18 19 20 21 */
        0x00000000L,
        0x00000100L,
        0x00080000L,
        0x00080100L,
        0x01000000L,
        0x01000100L,
        0x01080000L,
        0x01080100L,
        0x00000010L,
        0x00000110L,
        0x00080010L,
        0x00080110L,
        0x01000010L,
        0x01000110L,
        0x01080010L,
        0x01080110L,
        0x00200000L,
        0x00200100L,
        0x00280000L,
        0x00280100L,
        0x01200000L,
        0x01200100L,
        0x01280000L,
        0x01280100L,
        0x00200010L,
        0x00200110L,
        0x00280010L,
        0x00280110L,
        0x01200010L,
        0x01200110L,
        0x01280010L,
        0x01280110L,
        0x00000200L,
        0x00000300L,
        0x00080200L,
        0x00080300L,
        0x01000200L,
        0x01000300L,
        0x01080200L,
        0x01080300L,
        0x00000210L,
        0x00000310L,
        0x00080210L,
        0x00080310L,
        0x01000210L,
        0x01000310L,
        0x01080210L,
        0x01080310L,
        0x00200200L,
        0x00200300L,
        0x00280200L,
        0x00280300L,
        0x01200200L,
        0x01200300L,
        0x01280200L,
        0x01280300L,
        0x00200210L,
        0x00200310L,
        0x00280210L,
        0x00280310L,
        0x01200210L,
        0x01200310L,
        0x01280210L,
        0x01280310L,
    },
    {
        /* for D bits (numbered as per FIPS 46) 22 23 24 25 27 28 */
        0x00000000L,
        0x04000000L,
        0x00040000L,
        0x04040000L,
        0x00000002L,
        0x04000002L,
        0x00040002L,
        0x04040002L,
        0x00002000L,
        0x04002000L,
        0x00042000L,
        0x04042000L,
        0x00002002L,
        0x04002002L,
        0x00042002L,
        0x04042002L,
        0x00000020L,
        0x04000020L,
        0x00040020L,
        0x04040020L,
        0x00000022L,
        0x04000022L,
        0x00040022L,
        0x04040022L,
        0x00002020L,
        0x04002020L,
        0x00042020L,
        0x04042020L,
        0x00002022L,
        0x04002022L,
        0x00042022L,
        0x04042022L,
        0x00000800L,
        0x04000800L,
        0x00040800L,
        0x04040800L,
        0x00000802L,
        0x04000802L,
        0x00040802L,
        0x04040802L,
        0x00002800L,
        0x04002800L,
        0x00042800L,
        0x04042800L,
        0x00002802L,
        0x04002802L,
        0x00042802L,
        0x04042802L,
        0x00000820L,
        0x04000820L,
        0x00040820L,
        0x04040820L,
        0x00000822L,
        0x04000822L,
        0x00040822L,
        0x04040822L,
        0x00002820L,
        0x04002820L,
        0x00042820L,
        0x04042820L,
        0x00002822L,
        0x04002822L,
        0x00042822L,
        0x04042822L,
    }
};

/* Return values as DES_set_key_checked() but always set the key */
int DES_set_key(const_DES_cblock *key, DES_key_schedule *schedule)
{
    int ret = 0;

    if (!DES_check_key_parity(key))
        ret = -1;
    if (DES_is_weak_key(key))
        ret = -2;
    DES_set_key_unchecked(key, schedule);
    return ret;
}

/*-
 * return 0 if key parity is odd (correct),
 * return -1 if key parity error,
 * return -2 if illegal weak key.
 */
int DES_set_key_checked(const_DES_cblock *key, DES_key_schedule *schedule)
{
    if (!DES_check_key_parity(key))
        return -1;
    if (DES_is_weak_key(key))
        return -2;
    DES_set_key_unchecked(key, schedule);
    return 0;
}

void DES_set_key_unchecked(const_DES_cblock *key, DES_key_schedule *schedule)
{
    static const int shifts2[16] = {
        0, 0, 1, 1, 1, 1, 1, 1, 0, 1, 1, 1, 1, 1, 1, 0
    };
    register DES_LONG c, d, t, s, t2;
    register const unsigned char *in;
    register DES_LONG *k;
    register int i;

#ifdef OPENBSD_DEV_CRYPTO
    memcpy(schedule->key, key, sizeof(schedule->key));
    schedule->session = NULL;
#endif
    k = &schedule->ks->deslong[0];
    in = &(*key)[0];

    c2l(in, c);
    c2l(in, d);

    /*
     * do PC1 in 47 simple operations. Thanks to John Fletcher
     * for the inspiration.
     */
    PERM_OP(d, c, t, 4, 0x0f0f0f0fL);
    HPERM_OP(c, t, -2, 0xcccc0000L);
    HPERM_OP(d, t, -2, 0xcccc0000L);
    PERM_OP(d, c, t, 1, 0x55555555L);
    PERM_OP(c, d, t, 8, 0x00ff00ffL);
    PERM_OP(d, c, t, 1, 0x55555555L);
    d = (((d & 0x000000ffL) << 16L) | (d & 0x0000ff00L) | ((d & 0x00ff0000L) >> 16L) | ((c & 0xf0000000L) >> 4L));
    c &= 0x0fffffffL;

    for (i = 0; i < ITERATIONS; i++) {
        if (shifts2[i]) {
            c = ((c >> 2L) | (c << 26L));
            d = ((d >> 2L) | (d << 26L));
        } else {
            c = ((c >> 1L) | (c << 27L));
            d = ((d >> 1L) | (d << 27L));
        }
        c &= 0x0fffffffL;
        d &= 0x0fffffffL;
        /*
         * could be a few less shifts but I am to lazy at this point in time
         * to investigate
         */
        s = des_skb[0][(c) & 0x3f] | des_skb[1][((c >> 6L) & 0x03) | ((c >> 7L) & 0x3c)] | des_skb[2][((c >> 13L) & 0x0f) | ((c >> 14L) & 0x30)] | des_skb[3][((c >> 20L) & 0x01) | ((c >> 21L) & 0x06) | ((c >> 22L) & 0x38)];
        t = des_skb[4][(d) & 0x3f] | des_skb[5][((d >> 7L) & 0x03) | ((d >> 8L) & 0x3c)] | des_skb[6][(d >> 15L) & 0x3f] | des_skb[7][((d >> 21L) & 0x0f) | ((d >> 22L) & 0x30)];

        /* table contained 0213 4657 */
        t2 = ((t << 16L) | (s & 0x0000ffffL)) & 0xffffffffL;
        *(k++) = ROTATE(t2, 30) & 0xffffffffL;

        t2 = ((s >> 16L) | (t & 0xffff0000L));
        *(k++) = ROTATE(t2, 26) & 0xffffffffL;
    }
}

int DES_key_sched(const_DES_cblock *key, DES_key_schedule *schedule)
{
    return DES_set_key(key, schedule);
}

Coverage Report

Created: 2025-12-10 06:24

Line	Count	Source
1		/*
2		* Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
3		*
4		* Licensed under the Apache License 2.0 (the "License"). You may not use
5		* this file except in compliance with the License. You can obtain a copy
6		* in the file LICENSE in the source distribution or at
7		* https://www.openssl.org/source/license.html
8		*/
9
10		/*-
11		* set_key.c v 1.4 eay 24/9/91
12		* 1.4 Speed up by 400% :-)
13		* 1.3 added register declarations.
14		* 1.2 unrolled make_key_sched a bit more
15		* 1.1 added norm_expand_bits
16		* 1.0 First working version
17		*/
18
19		/*
20		* DES low level APIs are deprecated for public use, but still ok for internal
21		* use.
22		*/
23		#include "internal/deprecated.h"
24
25		#include <openssl/crypto.h>
26		#include "internal/constant_time.h"
27		#include "internal/nelem.h"
28		#include "des_local.h"
29
30		static const unsigned char odd_parity[256] = {
31		1, 1, 2, 2, 4, 4, 7, 7, 8, 8, 11, 11, 13, 13, 14, 14,
32		16, 16, 19, 19, 21, 21, 22, 22, 25, 25, 26, 26, 28, 28, 31, 31,
33		32, 32, 35, 35, 37, 37, 38, 38, 41, 41, 42, 42, 44, 44, 47, 47,
34		49, 49, 50, 50, 52, 52, 55, 55, 56, 56, 59, 59, 61, 61, 62, 62,
35		64, 64, 67, 67, 69, 69, 70, 70, 73, 73, 74, 74, 76, 76, 79, 79,
36		81, 81, 82, 82, 84, 84, 87, 87, 88, 88, 91, 91, 93, 93, 94, 94,
37		97, 97, 98, 98, 100, 100, 103, 103, 104, 104, 107, 107, 109, 109, 110,
38		110,
39		112, 112, 115, 115, 117, 117, 118, 118, 121, 121, 122, 122, 124, 124, 127,
40		127,
41		128, 128, 131, 131, 133, 133, 134, 134, 137, 137, 138, 138, 140, 140, 143,
42		143,
43		145, 145, 146, 146, 148, 148, 151, 151, 152, 152, 155, 155, 157, 157, 158,
44		158,
45		161, 161, 162, 162, 164, 164, 167, 167, 168, 168, 171, 171, 173, 173, 174,
46		174,
47		176, 176, 179, 179, 181, 181, 182, 182, 185, 185, 186, 186, 188, 188, 191,
48		191,
49		193, 193, 194, 194, 196, 196, 199, 199, 200, 200, 203, 203, 205, 205, 206,
50		206,
51		208, 208, 211, 211, 213, 213, 214, 214, 217, 217, 218, 218, 220, 220, 223,
52		223,
53		224, 224, 227, 227, 229, 229, 230, 230, 233, 233, 234, 234, 236, 236, 239,
54		239,
55		241, 241, 242, 242, 244, 244, 247, 247, 248, 248, 251, 251, 253, 253, 254,
56		254
57		};
58
59		void DES_set_odd_parity(DES_cblock *key)
60	18.9M	{
61	18.9M	unsigned int i;
62
63	170M	for (i = 0; i < DES_KEY_SZ; i++)
64	151M	(key)[i] = odd_parity[(key)[i]];
65	18.9M	}
66
67		/*
68		* Check that a key has the correct parity.
69		* Return 1 if parity is okay and 0 if not.
70		*/
71		int DES_check_key_parity(const_DES_cblock *key)
72	0	{
73	0	unsigned int i;
74	0	unsigned char res = 0377, b;
75
76	0	for (i = 0; i < DES_KEY_SZ; i++) {
77	0	b = (*key)[i];
78	0	b ^= b >> 4;
79	0	b ^= b >> 2;
80	0	b ^= b >> 1;
81	0	res &= constant_time_eq_8(b & 1, 1);
82	0	}
83	0	return (int)(res & 1);
84	0	}
85
86		/*-
87		* Weak and semi weak keys as taken from
88		* %A D.W. Davies
89		* %A W.L. Price
90		* %T Security for Computer Networks
91		* %I John Wiley & Sons
92		* %D 1984
93		*/
94		static const DES_cblock weak_keys[] = {
95		/* weak keys */
96		{ 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01 },
97		{ 0xFE, 0xFE, 0xFE, 0xFE, 0xFE, 0xFE, 0xFE, 0xFE },
98		{ 0x1F, 0x1F, 0x1F, 0x1F, 0x0E, 0x0E, 0x0E, 0x0E },
99		{ 0xE0, 0xE0, 0xE0, 0xE0, 0xF1, 0xF1, 0xF1, 0xF1 },
100		/* semi-weak keys */
101		{ 0x01, 0xFE, 0x01, 0xFE, 0x01, 0xFE, 0x01, 0xFE },
102		{ 0xFE, 0x01, 0xFE, 0x01, 0xFE, 0x01, 0xFE, 0x01 },
103		{ 0x1F, 0xE0, 0x1F, 0xE0, 0x0E, 0xF1, 0x0E, 0xF1 },
104		{ 0xE0, 0x1F, 0xE0, 0x1F, 0xF1, 0x0E, 0xF1, 0x0E },
105		{ 0x01, 0xE0, 0x01, 0xE0, 0x01, 0xF1, 0x01, 0xF1 },
106		{ 0xE0, 0x01, 0xE0, 0x01, 0xF1, 0x01, 0xF1, 0x01 },
107		{ 0x1F, 0xFE, 0x1F, 0xFE, 0x0E, 0xFE, 0x0E, 0xFE },
108		{ 0xFE, 0x1F, 0xFE, 0x1F, 0xFE, 0x0E, 0xFE, 0x0E },
109		{ 0x01, 0x1F, 0x01, 0x1F, 0x01, 0x0E, 0x01, 0x0E },
110		{ 0x1F, 0x01, 0x1F, 0x01, 0x0E, 0x01, 0x0E, 0x01 },
111		{ 0xE0, 0xFE, 0xE0, 0xFE, 0xF1, 0xFE, 0xF1, 0xFE },
112		{ 0xFE, 0xE0, 0xFE, 0xE0, 0xFE, 0xF1, 0xFE, 0xF1 }
113		};
114
115		/*
116		* Check for weak keys.
117		* Return 1 if the key is weak and 0 otherwise.
118		*/
119		int DES_is_weak_key(const_DES_cblock *key)
120	0	{
121	0	unsigned int i, res = 0;
122	0	int j;
123
124	0	for (i = 0; i < OSSL_NELEM(weak_keys); i++) {
125	0	j = CRYPTO_memcmp(weak_keys[i], key, sizeof(DES_cblock));
126	0	res \|= constant_time_is_zero((unsigned int)j);
127	0	}
128	0	return (int)(res & 1);
129	0	}
130
131		/*-
132		* NOW DEFINED IN des_local.h
133		* See ecb_encrypt.c for a pseudo description of these macros.
134		* #define PERM_OP(a,b,t,n,m) ((t)=((((a)>>(n))^(b))&(m)),\
135		* (b)^=(t),\
136		* (a)=((a)^((t)<<(n))))
137		*/
138
139	37.9M	#define HPERM_OP(a, t, n, m) ((t) = ((((a) << (16 - (n))) ^ (a)) & (m)), \
140	37.9M	(a) = (a) ^ (t) ^ (t >> (16 - (n))))
141
142		static const DES_LONG des_skb[8][64] = {
143		{
144		/* for C bits (numbered as per FIPS 46) 1 2 3 4 5 6 */
145		0x00000000L,
146		0x00000010L,
147		0x20000000L,
148		0x20000010L,
149		0x00010000L,
150		0x00010010L,
151		0x20010000L,
152		0x20010010L,
153		0x00000800L,
154		0x00000810L,
155		0x20000800L,
156		0x20000810L,
157		0x00010800L,
158		0x00010810L,
159		0x20010800L,
160		0x20010810L,
161		0x00000020L,
162		0x00000030L,
163		0x20000020L,
164		0x20000030L,
165		0x00010020L,
166		0x00010030L,
167		0x20010020L,
168		0x20010030L,
169		0x00000820L,
170		0x00000830L,
171		0x20000820L,
172		0x20000830L,
173		0x00010820L,
174		0x00010830L,
175		0x20010820L,
176		0x20010830L,
177		0x00080000L,
178		0x00080010L,
179		0x20080000L,
180		0x20080010L,
181		0x00090000L,
182		0x00090010L,
183		0x20090000L,
184		0x20090010L,
185		0x00080800L,
186		0x00080810L,
187		0x20080800L,
188		0x20080810L,
189		0x00090800L,
190		0x00090810L,
191		0x20090800L,
192		0x20090810L,
193		0x00080020L,
194		0x00080030L,
195		0x20080020L,
196		0x20080030L,
197		0x00090020L,
198		0x00090030L,
199		0x20090020L,
200		0x20090030L,
201		0x00080820L,
202		0x00080830L,
203		0x20080820L,
204		0x20080830L,
205		0x00090820L,
206		0x00090830L,
207		0x20090820L,
208		0x20090830L,
209		},
210		{
211		/* for C bits (numbered as per FIPS 46) 7 8 10 11 12 13 */
212		0x00000000L,
213		0x02000000L,
214		0x00002000L,
215		0x02002000L,
216		0x00200000L,
217		0x02200000L,
218		0x00202000L,
219		0x02202000L,
220		0x00000004L,
221		0x02000004L,
222		0x00002004L,
223		0x02002004L,
224		0x00200004L,
225		0x02200004L,
226		0x00202004L,
227		0x02202004L,
228		0x00000400L,
229		0x02000400L,
230		0x00002400L,
231		0x02002400L,
232		0x00200400L,
233		0x02200400L,
234		0x00202400L,
235		0x02202400L,
236		0x00000404L,
237		0x02000404L,
238		0x00002404L,
239		0x02002404L,
240		0x00200404L,
241		0x02200404L,
242		0x00202404L,
243		0x02202404L,
244		0x10000000L,
245		0x12000000L,
246		0x10002000L,
247		0x12002000L,
248		0x10200000L,
249		0x12200000L,
250		0x10202000L,
251		0x12202000L,
252		0x10000004L,
253		0x12000004L,
254		0x10002004L,
255		0x12002004L,
256		0x10200004L,
257		0x12200004L,
258		0x10202004L,
259		0x12202004L,
260		0x10000400L,
261		0x12000400L,
262		0x10002400L,
263		0x12002400L,
264		0x10200400L,
265		0x12200400L,
266		0x10202400L,
267		0x12202400L,
268		0x10000404L,
269		0x12000404L,
270		0x10002404L,
271		0x12002404L,
272		0x10200404L,
273		0x12200404L,
274		0x10202404L,
275		0x12202404L,
276		},
277		{
278		/* for C bits (numbered as per FIPS 46) 14 15 16 17 19 20 */
279		0x00000000L,
280		0x00000001L,
281		0x00040000L,
282		0x00040001L,
283		0x01000000L,
284		0x01000001L,
285		0x01040000L,
286		0x01040001L,
287		0x00000002L,
288		0x00000003L,
289		0x00040002L,
290		0x00040003L,
291		0x01000002L,
292		0x01000003L,
293		0x01040002L,
294		0x01040003L,
295		0x00000200L,
296		0x00000201L,
297		0x00040200L,
298		0x00040201L,
299		0x01000200L,
300		0x01000201L,
301		0x01040200L,
302		0x01040201L,
303		0x00000202L,
304		0x00000203L,
305		0x00040202L,
306		0x00040203L,
307		0x01000202L,
308		0x01000203L,
309		0x01040202L,
310		0x01040203L,
311		0x08000000L,
312		0x08000001L,
313		0x08040000L,
314		0x08040001L,
315		0x09000000L,
316		0x09000001L,
317		0x09040000L,
318		0x09040001L,
319		0x08000002L,
320		0x08000003L,
321		0x08040002L,
322		0x08040003L,
323		0x09000002L,
324		0x09000003L,
325		0x09040002L,
326		0x09040003L,
327		0x08000200L,
328		0x08000201L,
329		0x08040200L,
330		0x08040201L,
331		0x09000200L,
332		0x09000201L,
333		0x09040200L,
334		0x09040201L,
335		0x08000202L,
336		0x08000203L,
337		0x08040202L,
338		0x08040203L,
339		0x09000202L,
340		0x09000203L,
341		0x09040202L,
342		0x09040203L,
343		},
344		{
345		/* for C bits (numbered as per FIPS 46) 21 23 24 26 27 28 */
346		0x00000000L,
347		0x00100000L,
348		0x00000100L,
349		0x00100100L,
350		0x00000008L,
351		0x00100008L,
352		0x00000108L,
353		0x00100108L,
354		0x00001000L,
355		0x00101000L,
356		0x00001100L,
357		0x00101100L,
358		0x00001008L,
359		0x00101008L,
360		0x00001108L,
361		0x00101108L,
362		0x04000000L,
363		0x04100000L,
364		0x04000100L,
365		0x04100100L,
366		0x04000008L,
367		0x04100008L,
368		0x04000108L,
369		0x04100108L,
370		0x04001000L,
371		0x04101000L,
372		0x04001100L,
373		0x04101100L,
374		0x04001008L,
375		0x04101008L,
376		0x04001108L,
377		0x04101108L,
378		0x00020000L,
379		0x00120000L,
380		0x00020100L,
381		0x00120100L,
382		0x00020008L,
383		0x00120008L,
384		0x00020108L,
385		0x00120108L,
386		0x00021000L,
387		0x00121000L,
388		0x00021100L,
389		0x00121100L,
390		0x00021008L,
391		0x00121008L,
392		0x00021108L,
393		0x00121108L,
394		0x04020000L,
395		0x04120000L,
396		0x04020100L,
397		0x04120100L,
398		0x04020008L,
399		0x04120008L,
400		0x04020108L,
401		0x04120108L,
402		0x04021000L,
403		0x04121000L,
404		0x04021100L,
405		0x04121100L,
406		0x04021008L,
407		0x04121008L,
408		0x04021108L,
409		0x04121108L,
410		},
411		{
412		/* for D bits (numbered as per FIPS 46) 1 2 3 4 5 6 */
413		0x00000000L,
414		0x10000000L,
415		0x00010000L,
416		0x10010000L,
417		0x00000004L,
418		0x10000004L,
419		0x00010004L,
420		0x10010004L,
421		0x20000000L,
422		0x30000000L,
423		0x20010000L,
424		0x30010000L,
425		0x20000004L,
426		0x30000004L,
427		0x20010004L,
428		0x30010004L,
429		0x00100000L,
430		0x10100000L,
431		0x00110000L,
432		0x10110000L,
433		0x00100004L,
434		0x10100004L,
435		0x00110004L,
436		0x10110004L,
437		0x20100000L,
438		0x30100000L,
439		0x20110000L,
440		0x30110000L,
441		0x20100004L,
442		0x30100004L,
443		0x20110004L,
444		0x30110004L,
445		0x00001000L,
446		0x10001000L,
447		0x00011000L,
448		0x10011000L,
449		0x00001004L,
450		0x10001004L,
451		0x00011004L,
452		0x10011004L,
453		0x20001000L,
454		0x30001000L,
455		0x20011000L,
456		0x30011000L,
457		0x20001004L,
458		0x30001004L,
459		0x20011004L,
460		0x30011004L,
461		0x00101000L,
462		0x10101000L,
463		0x00111000L,
464		0x10111000L,
465		0x00101004L,
466		0x10101004L,
467		0x00111004L,
468		0x10111004L,
469		0x20101000L,
470		0x30101000L,
471		0x20111000L,
472		0x30111000L,
473		0x20101004L,
474		0x30101004L,
475		0x20111004L,
476		0x30111004L,
477		},
478		{
479		/* for D bits (numbered as per FIPS 46) 8 9 11 12 13 14 */
480		0x00000000L,
481		0x08000000L,
482		0x00000008L,
483		0x08000008L,
484		0x00000400L,
485		0x08000400L,
486		0x00000408L,
487		0x08000408L,
488		0x00020000L,
489		0x08020000L,
490		0x00020008L,
491		0x08020008L,
492		0x00020400L,
493		0x08020400L,
494		0x00020408L,
495		0x08020408L,
496		0x00000001L,
497		0x08000001L,
498		0x00000009L,
499		0x08000009L,
500		0x00000401L,
501		0x08000401L,
502		0x00000409L,
503		0x08000409L,
504		0x00020001L,
505		0x08020001L,
506		0x00020009L,
507		0x08020009L,
508		0x00020401L,
509		0x08020401L,
510		0x00020409L,
511		0x08020409L,
512		0x02000000L,
513		0x0A000000L,
514		0x02000008L,
515		0x0A000008L,
516		0x02000400L,
517		0x0A000400L,
518		0x02000408L,
519		0x0A000408L,
520		0x02020000L,
521		0x0A020000L,
522		0x02020008L,
523		0x0A020008L,
524		0x02020400L,
525		0x0A020400L,
526		0x02020408L,
527		0x0A020408L,
528		0x02000001L,
529		0x0A000001L,
530		0x02000009L,
531		0x0A000009L,
532		0x02000401L,
533		0x0A000401L,
534		0x02000409L,
535		0x0A000409L,
536		0x02020001L,
537		0x0A020001L,
538		0x02020009L,
539		0x0A020009L,
540		0x02020401L,
541		0x0A020401L,
542		0x02020409L,
543		0x0A020409L,
544		},
545		{
546		/* for D bits (numbered as per FIPS 46) 16 17 18 19 20 21 */
547		0x00000000L,
548		0x00000100L,
549		0x00080000L,
550		0x00080100L,
551		0x01000000L,
552		0x01000100L,
553		0x01080000L,
554		0x01080100L,
555		0x00000010L,
556		0x00000110L,
557		0x00080010L,
558		0x00080110L,
559		0x01000010L,
560		0x01000110L,
561		0x01080010L,
562		0x01080110L,
563		0x00200000L,
564		0x00200100L,
565		0x00280000L,
566		0x00280100L,
567		0x01200000L,
568		0x01200100L,
569		0x01280000L,
570		0x01280100L,
571		0x00200010L,
572		0x00200110L,
573		0x00280010L,
574		0x00280110L,
575		0x01200010L,
576		0x01200110L,
577		0x01280010L,
578		0x01280110L,
579		0x00000200L,
580		0x00000300L,
581		0x00080200L,
582		0x00080300L,
583		0x01000200L,
584		0x01000300L,
585		0x01080200L,
586		0x01080300L,
587		0x00000210L,
588		0x00000310L,
589		0x00080210L,
590		0x00080310L,
591		0x01000210L,
592		0x01000310L,
593		0x01080210L,
594		0x01080310L,
595		0x00200200L,
596		0x00200300L,
597		0x00280200L,
598		0x00280300L,
599		0x01200200L,
600		0x01200300L,
601		0x01280200L,
602		0x01280300L,
603		0x00200210L,
604		0x00200310L,
605		0x00280210L,
606		0x00280310L,
607		0x01200210L,
608		0x01200310L,
609		0x01280210L,
610		0x01280310L,
611		},
612		{
613		/* for D bits (numbered as per FIPS 46) 22 23 24 25 27 28 */
614		0x00000000L,
615		0x04000000L,
616		0x00040000L,
617		0x04040000L,
618		0x00000002L,
619		0x04000002L,
620		0x00040002L,
621		0x04040002L,
622		0x00002000L,
623		0x04002000L,
624		0x00042000L,
625		0x04042000L,
626		0x00002002L,
627		0x04002002L,
628		0x00042002L,
629		0x04042002L,
630		0x00000020L,
631		0x04000020L,
632		0x00040020L,
633		0x04040020L,
634		0x00000022L,
635		0x04000022L,
636		0x00040022L,
637		0x04040022L,
638		0x00002020L,
639		0x04002020L,
640		0x00042020L,
641		0x04042020L,
642		0x00002022L,
643		0x04002022L,
644		0x00042022L,
645		0x04042022L,
646		0x00000800L,
647		0x04000800L,
648		0x00040800L,
649		0x04040800L,
650		0x00000802L,
651		0x04000802L,
652		0x00040802L,
653		0x04040802L,
654		0x00002800L,
655		0x04002800L,
656		0x00042800L,
657		0x04042800L,
658		0x00002802L,
659		0x04002802L,
660		0x00042802L,
661		0x04042802L,
662		0x00000820L,
663		0x04000820L,
664		0x00040820L,
665		0x04040820L,
666		0x00000822L,
667		0x04000822L,
668		0x00040822L,
669		0x04040822L,
670		0x00002820L,
671		0x04002820L,
672		0x00042820L,
673		0x04042820L,
674		0x00002822L,
675		0x04002822L,
676		0x00042822L,
677		0x04042822L,
678		}
679		};
680
681		/* Return values as DES_set_key_checked() but always set the key */
682		int DES_set_key(const_DES_cblock key, DES_key_schedule schedule)
683	0	{
684	0	int ret = 0;
685
686	0	if (!DES_check_key_parity(key))
687	0	ret = -1;
688	0	if (DES_is_weak_key(key))
689	0	ret = -2;
690	0	DES_set_key_unchecked(key, schedule);
691	0	return ret;
692	0	}
693
694		/*-
695		* return 0 if key parity is odd (correct),
696		* return -1 if key parity error,
697		* return -2 if illegal weak key.
698		*/
699		int DES_set_key_checked(const_DES_cblock key, DES_key_schedule schedule)
700	0	{
701	0	if (!DES_check_key_parity(key))
702	0	return -1;
703	0	if (DES_is_weak_key(key))
704	0	return -2;
705	0	DES_set_key_unchecked(key, schedule);
706	0	return 0;
707	0	}
708
709		void DES_set_key_unchecked(const_DES_cblock key, DES_key_schedule schedule)
710	18.9M	{
711	18.9M	static const int shifts2[16] = {
712	18.9M	0, 0, 1, 1, 1, 1, 1, 1, 0, 1, 1, 1, 1, 1, 1, 0
713	18.9M	};
714	18.9M	register DES_LONG c, d, t, s, t2;
715	18.9M	register const unsigned char *in;
716	18.9M	register DES_LONG *k;
717	18.9M	register int i;
718
719		#ifdef OPENBSD_DEV_CRYPTO
720		memcpy(schedule->key, key, sizeof(schedule->key));
721		schedule->session = NULL;
722		#endif
723	18.9M	k = &schedule->ks->deslong[0];
724	18.9M	in = &(*key)[0];
725
726	18.9M	c2l(in, c);
727	18.9M	c2l(in, d);
728
729		/*
730		* do PC1 in 47 simple operations. Thanks to John Fletcher
731		* for the inspiration.
732		*/
733	18.9M	PERM_OP(d, c, t, 4, 0x0f0f0f0fL);
734	18.9M	HPERM_OP(c, t, -2, 0xcccc0000L);
735	18.9M	HPERM_OP(d, t, -2, 0xcccc0000L);
736	18.9M	PERM_OP(d, c, t, 1, 0x55555555L);
737	18.9M	PERM_OP(c, d, t, 8, 0x00ff00ffL);
738	18.9M	PERM_OP(d, c, t, 1, 0x55555555L);
739	18.9M	d = (((d & 0x000000ffL) << 16L) \| (d & 0x0000ff00L) \| ((d & 0x00ff0000L) >> 16L) \| ((c & 0xf0000000L) >> 4L));
740	18.9M	c &= 0x0fffffffL;
741
742	322M	for (i = 0; i < ITERATIONS; i++) {
743	303M	if (shifts2[i]) {
744	227M	c = ((c >> 2L) \| (c << 26L));
745	227M	d = ((d >> 2L) \| (d << 26L));
746	227M	} else {
747	75.8M	c = ((c >> 1L) \| (c << 27L));
748	75.8M	d = ((d >> 1L) \| (d << 27L));
749	75.8M	}
750	303M	c &= 0x0fffffffL;
751	303M	d &= 0x0fffffffL;
752		/*
753		* could be a few less shifts but I am to lazy at this point in time
754		* to investigate
755		*/
756	303M	s = des_skb[0][(c) & 0x3f] \| des_skb[1][((c >> 6L) & 0x03) \| ((c >> 7L) & 0x3c)] \| des_skb[2][((c >> 13L) & 0x0f) \| ((c >> 14L) & 0x30)] \| des_skb[3][((c >> 20L) & 0x01) \| ((c >> 21L) & 0x06) \| ((c >> 22L) & 0x38)];
757	303M	t = des_skb[4][(d) & 0x3f] \| des_skb[5][((d >> 7L) & 0x03) \| ((d >> 8L) & 0x3c)] \| des_skb[6][(d >> 15L) & 0x3f] \| des_skb[7][((d >> 21L) & 0x0f) \| ((d >> 22L) & 0x30)];
758
759		/* table contained 0213 4657 */
760	303M	t2 = ((t << 16L) \| (s & 0x0000ffffL)) & 0xffffffffL;
761	303M	*(k++) = ROTATE(t2, 30) & 0xffffffffL;
762
763	303M	t2 = ((s >> 16L) \| (t & 0xffff0000L));
764	303M	*(k++) = ROTATE(t2, 26) & 0xffffffffL;
765	303M	}
766	18.9M	}
767
768		int DES_key_sched(const_DES_cblock key, DES_key_schedule schedule)
769	0	{
770	0	return DES_set_key(key, schedule);
771	0	}