Add SM4 block cipher

This work was sponsored by Ribose Inc

6 files changed, 228 insertions, 3 deletions

diff --git a/src/lib/block/block_cipher.cpp b/src/lib/block/block_cipher.cpp
index fa0ecad52..b56f1c571 100644
--- a/src/lib/block/block_cipher.cpp
+++ b/src/lib/block/block_cipher.cpp
@@ -66,6 +66,10 @@
   #include <botan/serpent.h>
 #endif
 
+#if defined(BOTAN_HAS_SM4)
+  #include <botan/sm4.h>
+#endif
+
 #if defined(BOTAN_HAS_TWOFISH)
   #include <botan/twofish.h>
 #endif
@@ -233,6 +237,13 @@ BlockCipher::create(const std::string& algo,
       }
 #endif
 
+#if defined(BOTAN_HAS_SM4)
+   if(algo == "SM4")
+      {
+      return std::unique_ptr<BlockCipher>(new SM4);
+      }
+#endif
+
 #if defined(BOTAN_HAS_XTEA)
    if(algo == "XTEA")
       {
diff --git a/src/lib/block/sm4/info.txt b/src/lib/block/sm4/info.txt
new file mode 100644
index 000000000..32561f6d6
--- /dev/null
+++ b/src/lib/block/sm4/info.txt
@@ -0,0 +1,3 @@
+<defines>
+SM4 -> 20170716
+</defines>
diff --git a/src/lib/block/sm4/sm4.cpp b/src/lib/block/sm4/sm4.cpp
new file mode 100644
index 000000000..979491566
--- /dev/null
+++ b/src/lib/block/sm4/sm4.cpp
@@ -0,0 +1,159 @@
+/*
+* SM4
+* (C) 2017 Ribose Inc
+*
+* Botan is released under the Simplified BSD License (see license.txt)
+*/
+
+#include <botan/sm4.h>
+#include <botan/loadstor.h>
+
+namespace Botan {
+
+namespace SM4_F {
+
+const uint8_t SBOX[256] = {
+0xD6, 0x90, 0xE9, 0xFE, 0xCC, 0xE1, 0x3D, 0xB7, 0x16, 0xB6, 0x14, 0xC2, 0x28, 0xFB, 0x2C, 0x05,
+0x2B, 0x67, 0x9A, 0x76, 0x2A, 0xBE, 0x04, 0xC3, 0xAA, 0x44, 0x13, 0x26, 0x49, 0x86, 0x06, 0x99,
+0x9C, 0x42, 0x50, 0xF4, 0x91, 0xEF, 0x98, 0x7A, 0x33, 0x54, 0x0B, 0x43, 0xED, 0xCF, 0xAC, 0x62,
+0xE4, 0xB3, 0x1C, 0xA9, 0xC9, 0x08, 0xE8, 0x95, 0x80, 0xDF, 0x94, 0xFA, 0x75, 0x8F, 0x3F, 0xA6,
+0x47, 0x07, 0xA7, 0xFC, 0xF3, 0x73, 0x17, 0xBA, 0x83, 0x59, 0x3C, 0x19, 0xE6, 0x85, 0x4F, 0xA8,
+0x68, 0x6B, 0x81, 0xB2, 0x71, 0x64, 0xDA, 0x8B, 0xF8, 0xEB, 0x0F, 0x4B, 0x70, 0x56, 0x9D, 0x35,
+0x1E, 0x24, 0x0E, 0x5E, 0x63, 0x58, 0xD1, 0xA2, 0x25, 0x22, 0x7C, 0x3B, 0x01, 0x21, 0x78, 0x87,
+0xD4, 0x00, 0x46, 0x57, 0x9F, 0xD3, 0x27, 0x52, 0x4C, 0x36, 0x02, 0xE7, 0xA0, 0xC4, 0xC8, 0x9E,
+0xEA, 0xBF, 0x8A, 0xD2, 0x40, 0xC7, 0x38, 0xB5, 0xA3, 0xF7, 0xF2, 0xCE, 0xF9, 0x61, 0x15, 0xA1,
+0xE0, 0xAE, 0x5D, 0xA4, 0x9B, 0x34, 0x1A, 0x55, 0xAD, 0x93, 0x32, 0x30, 0xF5, 0x8C, 0xB1, 0xE3,
+0x1D, 0xF6, 0xE2, 0x2E, 0x82, 0x66, 0xCA, 0x60, 0xC0, 0x29, 0x23, 0xAB, 0x0D, 0x53, 0x4E, 0x6F,
+0xD5, 0xDB, 0x37, 0x45, 0xDE, 0xFD, 0x8E, 0x2F, 0x03, 0xFF, 0x6A, 0x72, 0x6D, 0x6C, 0x5B, 0x51,
+0x8D, 0x1B, 0xAF, 0x92, 0xBB, 0xDD, 0xBC, 0x7F, 0x11, 0xD9, 0x5C, 0x41, 0x1F, 0x10, 0x5A, 0xD8,
+0x0A, 0xC1, 0x31, 0x88, 0xA5, 0xCD, 0x7B, 0xBD, 0x2D, 0x74, 0xD0, 0x12, 0xB8, 0xE5, 0xB4, 0xB0,
+0x89, 0x69, 0x97, 0x4A, 0x0C, 0x96, 0x77, 0x7E, 0x65, 0xB9, 0xF1, 0x09, 0xC5, 0x6E, 0xC6, 0x84,
+0x18, 0xF0, 0x7D, 0xEC, 0x3A, 0xDC, 0x4D, 0x20, 0x79, 0xEE, 0x5F, 0x3E, 0xD7, 0xCB, 0x39, 0x48
+};
+
+inline uint32_t T(uint32_t b)
+   {
+   /*
+   TODO: could convert this to 4 8->32 bit tables combined with xor.
+   It was about 66% faster (110 MiB->181 MiB) on an i7-6700k, but the
+   large tables will be likely vulnerable to AES style cache attacks.
+   */
+
+   const uint8_t b0 = get_byte(0, b);
+   const uint8_t b1 = get_byte(1, b);
+   const uint8_t b2 = get_byte(2, b);
+   const uint8_t b3 = get_byte(3, b);
+   const uint32_t t = make_uint32(SBOX[b0], SBOX[b1], SBOX[b2], SBOX[b3]);
+
+   // L linear transform
+   return t ^ rotate_left(t, 2) ^ rotate_left(t, 10) ^ rotate_left(t, 18) ^ rotate_left(t, 24);
+   }
+
+// Variant of T for key schedule
+inline uint32_t Tp(uint32_t b)
+   {
+   const uint8_t b0 = get_byte(0, b);
+   const uint8_t b1 = get_byte(1, b);
+   const uint8_t b2 = get_byte(2, b);
+   const uint8_t b3 = get_byte(3, b);
+   const uint32_t t = make_uint32(SBOX[b0], SBOX[b1], SBOX[b2], SBOX[b3]);
+
+   // L' linear transform
+   return t ^ rotate_left(t, 13) ^ rotate_left(t, 23);
+   }
+
+}
+
+/*
+* SM4 Encryption
+*/
+void SM4::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
+   {
+   for(size_t i = 0; i != blocks; ++i)
+      {
+      uint32_t B0 = load_be<uint32_t>(in, 0);
+      uint32_t B1 = load_be<uint32_t>(in, 1);
+      uint32_t B2 = load_be<uint32_t>(in, 2);
+      uint32_t B3 = load_be<uint32_t>(in, 3);
+
+      for(size_t r = 0; r != 32; r += 4)
+         {
+         B0 ^= SM4_F::T(B1 ^ B2 ^ B3 ^ m_RK[r + 0]);
+         B1 ^= SM4_F::T(B0 ^ B2 ^ B3 ^ m_RK[r + 1]);
+         B2 ^= SM4_F::T(B0 ^ B1 ^ B3 ^ m_RK[r + 2]);
+         B3 ^= SM4_F::T(B0 ^ B1 ^ B2 ^ m_RK[r + 3]);
+         }
+
+      store_be(out, B3, B2, B1, B0);
+
+      in += BLOCK_SIZE;
+      out += BLOCK_SIZE;
+      }
+   }
+
+/*
+* SM4 Decryption
+*/
+void SM4::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
+   {
+   for(size_t i = 0; i != blocks; ++i)
+      {
+      uint32_t B0 = load_be<uint32_t>(in, 0);
+      uint32_t B1 = load_be<uint32_t>(in, 1);
+      uint32_t B2 = load_be<uint32_t>(in, 2);
+      uint32_t B3 = load_be<uint32_t>(in, 3);
+
+      for(size_t r = 0; r != 32; r += 4)
+         {
+         B0 ^= SM4_F::T(B1 ^ B2 ^ B3 ^ m_RK[31 - (r + 0)]);
+         B1 ^= SM4_F::T(B0 ^ B2 ^ B3 ^ m_RK[31 - (r + 1)]);
+         B2 ^= SM4_F::T(B0 ^ B1 ^ B3 ^ m_RK[31 - (r + 2)]);
+         B3 ^= SM4_F::T(B0 ^ B1 ^ B2 ^ m_RK[31 - (r + 3)]);
+         }
+
+      store_be(out, B3, B2, B1, B0);
+
+      in += BLOCK_SIZE;
+      out += BLOCK_SIZE;
+      }
+   }
+
+/*
+* SM4 Key Schedule
+*/
+void SM4::key_schedule(const uint8_t key[], size_t)
+   {
+   // System parameter or family key
+   const uint32_t FK[4] = { 0xa3b1bac6, 0x56aa3350, 0x677d9197, 0xb27022dc };
+
+   const uint32_t CK[32] = {
+      0x00070E15, 0x1C232A31, 0x383F464D, 0x545B6269,
+      0x70777E85, 0x8C939AA1, 0xA8AFB6BD, 0xC4CBD2D9,
+      0xE0E7EEF5, 0xFC030A11, 0x181F262D, 0x343B4249,
+      0x50575E65, 0x6C737A81, 0x888F969D, 0xA4ABB2B9,
+      0xC0C7CED5, 0xDCE3EAF1, 0xF8FF060D, 0x141B2229,
+      0x30373E45, 0x4C535A61, 0x686F767D, 0x848B9299,
+      0xA0A7AEB5, 0xBCC3CAD1, 0xD8DFE6ED, 0xF4FB0209,
+      0x10171E25, 0x2C333A41, 0x484F565D, 0x646B7279
+   };
+
+   secure_vector<uint32_t> K(4);
+   K[0] = load_be<uint32_t>(key, 0) ^ FK[0];
+   K[1] = load_be<uint32_t>(key, 1) ^ FK[1];
+   K[2] = load_be<uint32_t>(key, 2) ^ FK[2];
+   K[3] = load_be<uint32_t>(key, 3) ^ FK[3];
+
+   m_RK.resize(32);
+   for(size_t i = 0; i != 32; ++i)
+      {
+      K[i % 4] ^= SM4_F::Tp(K[(i+1)%4] ^ K[(i+2)%4] ^ K[(i+3)%4] ^ CK[i]);
+      m_RK[i] = K[i % 4];
+      }
+   }
+
+void SM4::clear()
+   {
+   zap(m_RK);
+   }
+
+}
diff --git a/src/lib/block/sm4/sm4.h b/src/lib/block/sm4/sm4.h
new file mode 100644
index 000000000..873a44c60
--- /dev/null
+++ b/src/lib/block/sm4/sm4.h
@@ -0,0 +1,35 @@
+/*
+* SM4
+* (C) 2017 Ribose Inc
+*
+* Botan is released under the Simplified BSD License (see license.txt)
+*/
+
+#ifndef BOTAN_SM4_H__
+#define BOTAN_SM4_H__
+
+#include <botan/block_cipher.h>
+
+namespace Botan {
+
+/**
+* SM4
+*/
+class BOTAN_DLL SM4 final : public Block_Cipher_Fixed_Params<16, 16>
+   {
+   public:
+      void encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const override;
+      void decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const override;
+
+      void clear() override;
+      std::string name() const override { return "SM4"; }
+      BlockCipher* clone() const override { return new SM4; }
+   private:
+      void key_schedule(const uint8_t[], size_t) override;
+
+      secure_vector<uint32_t> m_RK;
+   };
+
+}
+
+#endif
diff --git a/src/tests/data/block/sm4.vec b/src/tests/data/block/sm4.vec
new file mode 100644
index 000000000..fbdba610f
--- /dev/null
+++ b/src/tests/data/block/sm4.vec
@@ -0,0 +1,9 @@
+[SM4]
+Key = 0123456789abcdeffedcba9876543210
+In  = 0123456789abcdeffedcba9876543210
+Out = 681edf34d206965e86b3e94f536e4246
+
+Iterations = 1000000
+Key = 0123456789abcdeffedcba9876543210
+In  = 0123456789abcdeffedcba9876543210
+Out = 595298c7c6fd271f0402f804c33d3f66
diff --git a/src/tests/test_block.cpp b/src/tests/test_block.cpp
index 7f4856374..16f83a1cb 100644
--- a/src/tests/test_block.cpp
+++ b/src/tests/test_block.cpp
@@ -12,7 +12,7 @@ namespace Botan_Tests {
 class Block_Cipher_Tests : public Text_Based_Test
    {
    public:
-      Block_Cipher_Tests() : Text_Based_Test("block", "Key,In,Out") {}
+      Block_Cipher_Tests() : Text_Based_Test("block", "Key,In,Out", "Iterations") {}
 
       std::vector<std::string> possible_providers(const std::string& algo) override
          {
@@ -24,6 +24,7 @@ class Block_Cipher_Tests : public Text_Based_Test
          const std::vector<uint8_t> key      = get_req_bin(vars, "Key");
          const std::vector<uint8_t> input    = get_req_bin(vars, "In");
          const std::vector<uint8_t> expected = get_req_bin(vars, "Out");
+         const size_t iterations             = get_opt_sz(vars, "Iterations", 1);
 
          Test::Result result(algo);
 
@@ -69,13 +70,20 @@ class Block_Cipher_Tests : public Text_Based_Test
             // have called set_key on clone: process input values
             std::vector<uint8_t> buf = input;
 
-            cipher->encrypt(buf);
+            for(size_t i = 0; i != iterations; ++i)
+               {
+               cipher->encrypt(buf);
+               }
 
             result.test_eq(provider, "encrypt", buf, expected);
 
             // always decrypt expected ciphertext vs what we produced above
             buf = expected;
-            cipher->decrypt(buf);
+
+            for(size_t i = 0; i != iterations; ++i)
+               {
+               cipher->decrypt(buf);
+               }
 
             cipher->clear();