aboutsummaryrefslogtreecommitdiffstats
path: root/src/lib/block
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/block')
-rw-r--r--src/lib/block/aria/aria.cpp612
-rw-r--r--src/lib/block/aria/aria.h18
2 files changed, 251 insertions, 379 deletions
diff --git a/src/lib/block/aria/aria.cpp b/src/lib/block/aria/aria.cpp
index 12d009858..5b449722a 100644
--- a/src/lib/block/aria/aria.cpp
+++ b/src/lib/block/aria/aria.cpp
@@ -1,5 +1,8 @@
/*
* ARIA
+* Adapted for Botan by Jeffrey Walton, public domain
+*
+* Further changes
* (C) 2017 Jack Lloyd
*
* Botan is released under the Simplified BSD License (see license.txt)
@@ -17,21 +20,13 @@
#include <botan/loadstor.h>
#include <botan/cpuid.h>
-#if defined(BOTAN_TARGET_SUPPORTS_NEON)
-# include <arm_neon.h>
-#endif
-
-#if (BOTAN_GCC_VERSION >= 480) || (BOTAN_CLANG_VERSION >= 310) || (_MSC_VER >= 1900)
-# define DATA_ALIGN16 alignas(16)
-#else
-# define DATA_ALIGN16
-#endif
-
namespace Botan {
namespace {
-DATA_ALIGN16
+namespace ARIA_F {
+
+BOTAN_ALIGNAS(16)
const uint32_t S1[256]={
0x00636363,0x007c7c7c,0x00777777,0x007b7b7b,0x00f2f2f2,0x006b6b6b,0x006f6f6f,0x00c5c5c5,
0x00303030,0x00010101,0x00676767,0x002b2b2b,0x00fefefe,0x00d7d7d7,0x00ababab,0x00767676,
@@ -67,7 +62,7 @@ const uint32_t S1[256]={
0x00414141,0x00999999,0x002d2d2d,0x000f0f0f,0x00b0b0b0,0x00545454,0x00bbbbbb,0x00161616
};
-DATA_ALIGN16
+BOTAN_ALIGNAS(16)
const uint32_t S2[256]={
0xe200e2e2,0x4e004e4e,0x54005454,0xfc00fcfc,0x94009494,0xc200c2c2,0x4a004a4a,0xcc00cccc,
0x62006262,0x0d000d0d,0x6a006a6a,0x46004646,0x3c003c3c,0x4d004d4d,0x8b008b8b,0xd100d1d1,
@@ -103,7 +98,7 @@ const uint32_t S2[256]={
0x89008989,0xde00dede,0x71007171,0x1a001a1a,0xaf00afaf,0xba00baba,0xb500b5b5,0x81008181
};
-DATA_ALIGN16
+BOTAN_ALIGNAS(16)
const uint32_t X1[256]={
0x52520052,0x09090009,0x6a6a006a,0xd5d500d5,0x30300030,0x36360036,0xa5a500a5,0x38380038,
0xbfbf00bf,0x40400040,0xa3a300a3,0x9e9e009e,0x81810081,0xf3f300f3,0xd7d700d7,0xfbfb00fb,
@@ -139,7 +134,7 @@ const uint32_t X1[256]={
0xe1e100e1,0x69690069,0x14140014,0x63630063,0x55550055,0x21210021,0x0c0c000c,0x7d7d007d
};
-DATA_ALIGN16
+BOTAN_ALIGNAS(16)
const uint32_t X2[256]={
0x30303000,0x68686800,0x99999900,0x1b1b1b00,0x87878700,0xb9b9b900,0x21212100,0x78787800,
0x50505000,0x39393900,0xdbdbdb00,0xe1e1e100,0x72727200,0x09090900,0x62626200,0x3c3c3c00,
@@ -175,448 +170,331 @@ const uint32_t X2[256]={
0xf7f7f700,0x4c4c4c00,0x11111100,0x33333300,0x03030300,0xa2a2a200,0xacacac00,0x60606000
};
-DATA_ALIGN16
-const uint32_t KRK[3][4] = {
- {0x517cc1b7, 0x27220a94, 0xfe13abe8, 0xfa9a6ee0},
- {0x6db14acc, 0x9e21c820, 0xff28b1d5, 0xef5de2b0},
- {0xdb92371d, 0x2126e970, 0x03249775, 0x04e8c90e}
-};
-
-namespace ARIA_F {
-
-// Retrieve the i-th byte
-inline uint8_t ARIA_BRF(const uint32_t x, const unsigned int i)
- {
- // TODO: use the fastest method provided by the library
- return static_cast<uint8_t>(x >> (i*8));
- }
-
-#define ARIA_KXL { \
- t[0]^=reinterpret_cast<const uint32_t*>(rk)[0]; t[1]^=reinterpret_cast<const uint32_t*>(rk)[1]; \
- t[2]^=reinterpret_cast<const uint32_t*>(rk)[2]; t[3]^=reinterpret_cast<const uint32_t*>(rk)[3]; \
- }
-
-// S-Box Layer 1 + M (DFW)
-#define SBL1_M(T0,T1,T2,T3) { \
- T0=S1[ARIA_BRF(T0,3)]^S2[ARIA_BRF(T0,2)]^X1[ARIA_BRF(T0,1)]^X2[ARIA_BRF(T0,0)]; \
- T1=S1[ARIA_BRF(T1,3)]^S2[ARIA_BRF(T1,2)]^X1[ARIA_BRF(T1,1)]^X2[ARIA_BRF(T1,0)]; \
- T2=S1[ARIA_BRF(T2,3)]^S2[ARIA_BRF(T2,2)]^X1[ARIA_BRF(T2,1)]^X2[ARIA_BRF(T2,0)]; \
- T3=S1[ARIA_BRF(T3,3)]^S2[ARIA_BRF(T3,2)]^X1[ARIA_BRF(T3,1)]^X2[ARIA_BRF(T3,0)]; \
- }
-
-// S-Box Layer 2 + M (DFW)
-#define SBL2_M(T0,T1,T2,T3) { \
- T0=X1[ARIA_BRF(T0,3)]^X2[ARIA_BRF(T0,2)]^S1[ARIA_BRF(T0,1)]^S2[ARIA_BRF(T0,0)]; \
- T1=X1[ARIA_BRF(T1,3)]^X2[ARIA_BRF(T1,2)]^S1[ARIA_BRF(T1,1)]^S2[ARIA_BRF(T1,0)]; \
- T2=X1[ARIA_BRF(T2,3)]^X2[ARIA_BRF(T2,2)]^S1[ARIA_BRF(T2,1)]^S2[ARIA_BRF(T2,0)]; \
- T3=X1[ARIA_BRF(T3,3)]^X2[ARIA_BRF(T3,2)]^S1[ARIA_BRF(T3,1)]^S2[ARIA_BRF(T3,0)]; \
- }
-
-// (DFW)
-#define ARIA_MM(T0,T1,T2,T3) { \
- (T1)^=(T2); (T2)^=(T3); (T0)^=(T1); \
- (T3)^=(T1); (T2)^=(T0); (T1)^=(T2); \
- }
-
-// (DFW)
-#define ARIA_P(T0,T1,T2,T3) { \
- (T1) = (((T1)<< 8)&0xff00ff00) ^ (((T1)>> 8)&0x00ff00ff); \
- (T2) = rotate_right((T2),16); \
- (T3) = reverse_bytes((T3)); \
- }
-
-#define ARIA_M1(X,Y) { \
- Y=(X)<<8 ^ (X)>>8 ^ (X)<<16 ^ (X)>>16 ^ (X)<<24 ^ (X)>>24; \
- }
-
-#define ARIA_FO {SBL1_M(t[0],t[1],t[2],t[3]) ARIA_MM(t[0],t[1],t[2],t[3]) ARIA_P(t[0],t[1],t[2],t[3]) ARIA_MM(t[0],t[1],t[2],t[3])}
-#define ARIA_FE {SBL2_M(t[0],t[1],t[2],t[3]) ARIA_MM(t[0],t[1],t[2],t[3]) ARIA_P(t[2],t[3],t[0],t[1]) ARIA_MM(t[0],t[1],t[2],t[3])}
-
-// n-bit right shift of Y XORed to X
-template <unsigned int N>
-inline void ARIA_GSKS(const uint32_t X[4], const uint32_t Y[4], uint8_t KS[16])
+inline void ARIA_FO(uint32_t& T0, uint32_t& T1, uint32_t& T2, uint32_t& T3)
{
- // MSVC is not generating a "rotate immediate". Constify to help it along.
- static const unsigned int Q = 4-(N/32);
- static const unsigned int R = N % 32;
- reinterpret_cast<uint32_t*>(KS)[0] = (X[0]) ^ ((Y[(Q )%4])>>R) ^ ((Y[(Q+3)%4])<<(32-R));
- reinterpret_cast<uint32_t*>(KS)[1] = (X[1]) ^ ((Y[(Q+1)%4])>>R) ^ ((Y[(Q )%4])<<(32-R));
- reinterpret_cast<uint32_t*>(KS)[2] = (X[2]) ^ ((Y[(Q+2)%4])>>R) ^ ((Y[(Q+1)%4])<<(32-R));
- reinterpret_cast<uint32_t*>(KS)[3] = (X[3]) ^ ((Y[(Q+3)%4])>>R) ^ ((Y[(Q+2)%4])<<(32-R));
+ T0 = S1[get_byte(0,T0)] ^ S2[get_byte(1,T0)] ^ X1[get_byte(2,T0)] ^ X2[get_byte(3,T0)];
+ T1 = S1[get_byte(0,T1)] ^ S2[get_byte(1,T1)] ^ X1[get_byte(2,T1)] ^ X2[get_byte(3,T1)];
+ T2 = S1[get_byte(0,T2)] ^ S2[get_byte(1,T2)] ^ X1[get_byte(2,T2)] ^ X2[get_byte(3,T2)];
+ T3 = S1[get_byte(0,T3)] ^ S2[get_byte(1,T3)] ^ X1[get_byte(2,T3)] ^ X2[get_byte(3,T3)];
+
+ T1 ^= T2;
+ T2 ^= T3; T0 ^= T1;
+ T3 ^= T1; T2 ^= T0;
+ T1 ^= T2;
+
+ T1 = ((T1 << 8) & 0xFF00FF00) | ((T1 >> 8) & 0x00FF00FF);
+ T2 = rotate_right(T2, 16);
+ T3 = reverse_bytes(T3);
+
+ T1 ^= T2;
+ T2 ^= T3; T0 ^= T1;
+ T3 ^= T1; T2 ^= T0;
+ T1 ^= T2;
}
-#if defined(BOTAN_TARGET_SUPPORTS_NEON)
-template <unsigned int N>
-inline void ARIA_GSKS_NEON(const uint32x4_t X, const uint32x4_t Y, uint8_t KS[16])
+inline void ARIA_FE(uint32_t& T0, uint32_t& T1, uint32_t& T2, uint32_t& T3)
{
- static const unsigned int Q1 = (4-(N/32)) % 4;
- static const unsigned int Q2 = (3-(N/32)) % 4;
- static const unsigned int R = N % 32;
-
- vst1q_u32(reinterpret_cast<uint32_t*>(KS),
- veorq_u32(X, veorq_u32(
- vshrq_n_u32(vextq_u32(Y, Y, Q1), R),
- vshlq_n_u32(vextq_u32(Y, Y, Q2), 32-R))));
+ T0 = X1[get_byte(0,T0)] ^ X2[get_byte(1,T0)] ^ S1[get_byte(2,T0)] ^ S2[get_byte(3,T0)];
+ T1 = X1[get_byte(0,T1)] ^ X2[get_byte(1,T1)] ^ S1[get_byte(2,T1)] ^ S2[get_byte(3,T1)];
+ T2 = X1[get_byte(0,T2)] ^ X2[get_byte(1,T2)] ^ S1[get_byte(2,T2)] ^ S2[get_byte(3,T2)];
+ T3 = X1[get_byte(0,T3)] ^ X2[get_byte(1,T3)] ^ S1[get_byte(2,T3)] ^ S2[get_byte(3,T3)];
+
+ T1 ^= T2;
+ T2 ^= T3; T0 ^= T1;
+ T3 ^= T1; T2 ^= T0;
+ T1 ^= T2;
+
+ T3 = ((T3 << 8) & 0xFF00FF00) | ((T3 >> 8) & 0x00FF00FF);
+ T0 = rotate_right(T0, 16);
+ T1 = reverse_bytes(T1);
+
+ T1 ^= T2;
+ T2 ^= T3; T0 ^= T1;
+ T3 ^= T1; T2 ^= T0;
+ T1 ^= T2;
}
-#endif
/*
-* ARIA Encryption and decryption
+* ARIA encryption and decryption
*/
-template <unsigned int ROUNDS>
void transform(const uint8_t in[], uint8_t out[], size_t blocks,
- const secure_vector<uint8_t>& KS, secure_vector<uint32_t>& WS)
+ const secure_vector<uint32_t>& KS)
{
+ if(KS.empty())
+ throw Invalid_State("ARIA key was not set");
- // Hit every cache line of S1
+ // Hit every cache line of S1 and S2
const size_t cache_line_size = CPUID::cache_line_size();
- volatile uint32_t _Z = 0;
- uint32_t Z = _Z;
- for(size_t i = 0; i < 256; i += cache_line_size / sizeof(uint32_t))
- {
- Z |= S1[i];
- }
- WS[0] = Z;
- while(blocks)
+ /*
+ * This initializer ensures Z == 0xFFFFFFFF for any cache line size
+ * in {32,64,128,256,512}
+ */
+ volatile uint32_t Z = 0x11101010;
+ for(size_t i = 0; i < 256; i += cache_line_size / sizeof(uint32_t))
{
- const uint8_t* rk = reinterpret_cast<const byte*>(&KS[0]);
- uint32_t* t = &WS[20];
-
- t[0] = load_be<uint32_t>(in,0); t[1] = load_be<uint32_t>(in,1);
- t[2] = load_be<uint32_t>(in,2); t[3] = load_be<uint32_t>(in,3);
-
- if (ROUNDS > 12) {
- ARIA_KXL; rk+= 16; ARIA_FO;
- ARIA_KXL; rk+= 16; ARIA_FE;
+ Z |= S1[i] | S2[i];
}
- if (ROUNDS > 14) {
- ARIA_KXL; rk+= 16; ARIA_FO;
- ARIA_KXL; rk+= 16; ARIA_FE;
- }
+ const size_t ROUNDS = (KS.size() / 4) - 1;
- ARIA_KXL; rk+= 16; ARIA_FO; ARIA_KXL; rk+= 16; ARIA_FE;
- ARIA_KXL; rk+= 16; ARIA_FO; ARIA_KXL; rk+= 16; ARIA_FE;
- ARIA_KXL; rk+= 16; ARIA_FO; ARIA_KXL; rk+= 16; ARIA_FE;
- ARIA_KXL; rk+= 16; ARIA_FO; ARIA_KXL; rk+= 16; ARIA_FE;
- ARIA_KXL; rk+= 16; ARIA_FO; ARIA_KXL; rk+= 16; ARIA_FE;
- ARIA_KXL; rk+= 16; ARIA_FO; ARIA_KXL; rk+= 16;
-
-#if defined(BOTAN_TARGET_CPU_IS_LITTLE_ENDIAN)
- out[ 0] = (byte)(X1[ARIA_BRF(t[0],3)] ) ^ rk[ 3];
- out[ 1] = (byte)(X2[ARIA_BRF(t[0],2)]>>8) ^ rk[ 2];
- out[ 2] = (byte)(S1[ARIA_BRF(t[0],1)] ) ^ rk[ 1];
- out[ 3] = (byte)(S2[ARIA_BRF(t[0],0)] ) ^ rk[ 0];
- out[ 4] = (byte)(X1[ARIA_BRF(t[1],3)] ) ^ rk[ 7];
- out[ 5] = (byte)(X2[ARIA_BRF(t[1],2)]>>8) ^ rk[ 6];
- out[ 6] = (byte)(S1[ARIA_BRF(t[1],1)] ) ^ rk[ 5];
- out[ 7] = (byte)(S2[ARIA_BRF(t[1],0)] ) ^ rk[ 4];
- out[ 8] = (byte)(X1[ARIA_BRF(t[2],3)] ) ^ rk[11];
- out[ 9] = (byte)(X2[ARIA_BRF(t[2],2)]>>8) ^ rk[10];
- out[10] = (byte)(S1[ARIA_BRF(t[2],1)] ) ^ rk[ 9];
- out[11] = (byte)(S2[ARIA_BRF(t[2],0)] ) ^ rk[ 8];
- out[12] = (byte)(X1[ARIA_BRF(t[3],3)] ) ^ rk[15];
- out[13] = (byte)(X2[ARIA_BRF(t[3],2)]>>8) ^ rk[14];
- out[14] = (byte)(S1[ARIA_BRF(t[3],1)] ) ^ rk[13];
- out[15] = (byte)(S2[ARIA_BRF(t[3],0)] ) ^ rk[12];
-#else
- out[ 0] = (byte)(X1[ARIA_BRF(t[0],3)] );
- out[ 1] = (byte)(X2[ARIA_BRF(t[0],2)]>>8);
- out[ 2] = (byte)(S1[ARIA_BRF(t[0],1)] );
- out[ 3] = (byte)(S2[ARIA_BRF(t[0],0)] );
- out[ 4] = (byte)(X1[ARIA_BRF(t[1],3)] );
- out[ 5] = (byte)(X2[ARIA_BRF(t[1],2)]>>8);
- out[ 6] = (byte)(S1[ARIA_BRF(t[1],1)] );
- out[ 7] = (byte)(S2[ARIA_BRF(t[1],0)] );
- out[ 8] = (byte)(X1[ARIA_BRF(t[2],3)] );
- out[ 9] = (byte)(X2[ARIA_BRF(t[2],2)]>>8);
- out[10] = (byte)(S1[ARIA_BRF(t[2],1)] );
- out[11] = (byte)(S2[ARIA_BRF(t[2],0)] );
- out[12] = (byte)(X1[ARIA_BRF(t[3],3)] );
- out[13] = (byte)(X2[ARIA_BRF(t[3],2)]>>8);
- out[14] = (byte)(S1[ARIA_BRF(t[3],1)] );
- out[15] = (byte)(S2[ARIA_BRF(t[3],0)] );
-
- store_be((load_be<uint32_t>(rk,0) ^ load_be<uint32_t>(out,0)), reinterpret_cast<uint8_t*>(out+0));
- store_be((load_be<uint32_t>(rk,1) ^ load_be<uint32_t>(out,1)), reinterpret_cast<uint8_t*>(out+4));
- store_be((load_be<uint32_t>(rk,2) ^ load_be<uint32_t>(out,2)), reinterpret_cast<uint8_t*>(out+8));
- store_be((load_be<uint32_t>(rk,3) ^ load_be<uint32_t>(out,3)), reinterpret_cast<uint8_t*>(out+12));
-#endif
-
- in += 16;
- out += 16;
- blocks--;
+ for(size_t i = 0; i != blocks; ++i)
+ {
+ uint32_t t0, t1, t2, t3;
+ load_be(in + 16*i, t0, t1, t2, t3);
+
+ t0 &= Z;
+
+ for(size_t r = 0; r < ROUNDS; r += 2)
+ {
+ t0 ^= KS[4*r];
+ t1 ^= KS[4*r+1];
+ t2 ^= KS[4*r+2];
+ t3 ^= KS[4*r+3];
+ ARIA_FO(t0,t1,t2,t3);
+
+ t0 ^= KS[4*r+4];
+ t1 ^= KS[4*r+5];
+ t2 ^= KS[4*r+6];
+ t3 ^= KS[4*r+7];
+
+ if(r != ROUNDS-2)
+ ARIA_FE(t0,t1,t2,t3);
+ }
+
+ out[16*i+ 0] = static_cast<uint8_t>(X1[get_byte(0,t0)] ) ^ get_byte(0, KS[4*ROUNDS]);
+ out[16*i+ 1] = static_cast<uint8_t>(X2[get_byte(1,t0)]>>8) ^ get_byte(1, KS[4*ROUNDS]);
+ out[16*i+ 2] = static_cast<uint8_t>(S1[get_byte(2,t0)] ) ^ get_byte(2, KS[4*ROUNDS]);
+ out[16*i+ 3] = static_cast<uint8_t>(S2[get_byte(3,t0)] ) ^ get_byte(3, KS[4*ROUNDS]);
+ out[16*i+ 4] = static_cast<uint8_t>(X1[get_byte(0,t1)] ) ^ get_byte(0, KS[4*ROUNDS+1]);
+ out[16*i+ 5] = static_cast<uint8_t>(X2[get_byte(1,t1)]>>8) ^ get_byte(1, KS[4*ROUNDS+1]);
+ out[16*i+ 6] = static_cast<uint8_t>(S1[get_byte(2,t1)] ) ^ get_byte(2, KS[4*ROUNDS+1]);
+ out[16*i+ 7] = static_cast<uint8_t>(S2[get_byte(3,t1)] ) ^ get_byte(3, KS[4*ROUNDS+1]);
+ out[16*i+ 8] = static_cast<uint8_t>(X1[get_byte(0,t2)] ) ^ get_byte(0, KS[4*ROUNDS+2]);
+ out[16*i+ 9] = static_cast<uint8_t>(X2[get_byte(1,t2)]>>8) ^ get_byte(1, KS[4*ROUNDS+2]);
+ out[16*i+10] = static_cast<uint8_t>(S1[get_byte(2,t2)] ) ^ get_byte(2, KS[4*ROUNDS+2]);
+ out[16*i+11] = static_cast<uint8_t>(S2[get_byte(3,t2)] ) ^ get_byte(3, KS[4*ROUNDS+2]);
+ out[16*i+12] = static_cast<uint8_t>(X1[get_byte(0,t3)] ) ^ get_byte(0, KS[4*ROUNDS+3]);
+ out[16*i+13] = static_cast<uint8_t>(X2[get_byte(1,t3)]>>8) ^ get_byte(1, KS[4*ROUNDS+3]);
+ out[16*i+14] = static_cast<uint8_t>(S1[get_byte(2,t3)] ) ^ get_byte(2, KS[4*ROUNDS+3]);
+ out[16*i+15] = static_cast<uint8_t>(S2[get_byte(3,t3)] ) ^ get_byte(3, KS[4*ROUNDS+3]);
}
}
-/*
-* ARIA Key Schedule (forward direction)
-*/
-void key_schedule_fwd(secure_vector<uint8_t>& KS, secure_vector<uint32_t>& WS, const uint8_t key[], size_t length)
+// n-bit right shift of Y XORed to X
+template <unsigned int N>
+inline void ARIA_ROL128(const uint32_t X[4], const uint32_t Y[4], uint32_t KS[4])
{
-
- const uint8_t *mk = key;
- uint8_t *rk = &KS[0];
- int q, r;
-
- switch (length)
- {
- case 16:
- r = 12;
- q = 0;
- break;
- case 32:
- r = 16;
- q = 2;
- break;
- case 24:
- r = 14;
- q = 1;
- break;
- default:
- q = r = 0;
- BOTAN_ASSERT(0, "Invalid key length");
- }
-
- // w0 has room for 32 bytes. w1-w3 each has room for 16 bytes. t and u are 16 byte temp areas.
- uint32_t *w0 = &WS[0], *w1 = &WS[8], *w2 = &WS[12], *w3 = &WS[16], *t = &WS[20];
-
- w0[0] = load_be<uint32_t>(mk,0); w0[1] = load_be<uint32_t>(mk,1);
- w0[2] = load_be<uint32_t>(mk,2); w0[3] = load_be<uint32_t>(mk,3);
-
- t[0]=w0[0]^KRK[q][0]; t[1]=w0[1]^KRK[q][1];
- t[2]=w0[2]^KRK[q][2]; t[3]=w0[3]^KRK[q][3];
-
- ARIA_FO;
-
- if (length == 32)
- {
- w1[0] = load_be<uint32_t>(mk,4);
- w1[1] = load_be<uint32_t>(mk,5);
- w1[2] = load_be<uint32_t>(mk,6);
- w1[3] = load_be<uint32_t>(mk,7);
- }
- else if (length == 24)
- {
- w1[0] = load_be<uint32_t>(mk,4);
- w1[1] = load_be<uint32_t>(mk,5);
- w1[2] = w1[3] = 0;
- }
- else
- {
- w1[0]=w1[1]=w1[2]=w1[3]=0;
- }
-
- w1[0]^=t[0]; w1[1]^=t[1]; w1[2]^=t[2]; w1[3]^=t[3];
- ::memcpy(t, w1, 16);
-
- q = (q==2) ? 0 : (q+1);
- t[0]^=KRK[q][0]; t[1]^=KRK[q][1]; t[2]^=KRK[q][2]; t[3]^=KRK[q][3];
-
- ARIA_FE;
-
- t[0]^=w0[0]; t[1]^=w0[1]; t[2]^=w0[2]; t[3]^=w0[3];
- ::memcpy(w2, t, 16);
-
- q = (q==2) ? 0 : (q+1);
- t[0]^=KRK[q][0]; t[1]^=KRK[q][1]; t[2]^=KRK[q][2]; t[3]^=KRK[q][3];
-
- ARIA_FO;
-
- w3[0]=t[0]^w1[0]; w3[1]=t[1]^w1[1]; w3[2]=t[2]^w1[2]; w3[3]=t[3]^w1[3];
-
-#if defined(BOTAN_TARGET_SUPPORTS_NEON)
- if (CPUID::has_neon())
- {
- const uint32x4_t w0 = vld1q_u32((const uint32_t*)(&WS[0]));
- const uint32x4_t w1 = vld1q_u32((const uint32_t*)(&WS[8]));
- const uint32x4_t w2 = vld1q_u32((const uint32_t*)(&WS[12]));
- const uint32x4_t w3 = vld1q_u32((const uint32_t*)(&WS[16]));
-
- ARIA_GSKS_NEON<19>(w0, w1, rk + 0);
- ARIA_GSKS_NEON<19>(w1, w2, rk + 16);
- ARIA_GSKS_NEON<19>(w2, w3, rk + 32);
- ARIA_GSKS_NEON<19>(w3, w0, rk + 48);
- ARIA_GSKS_NEON<31>(w0, w1, rk + 64);
- ARIA_GSKS_NEON<31>(w1, w2, rk + 80);
- ARIA_GSKS_NEON<31>(w2, w3, rk + 96);
- ARIA_GSKS_NEON<31>(w3, w0, rk + 112);
- ARIA_GSKS_NEON<67>(w0, w1, rk + 128);
- ARIA_GSKS_NEON<67>(w1, w2, rk + 144);
- ARIA_GSKS_NEON<67>(w2, w3, rk + 160);
- ARIA_GSKS_NEON<67>(w3, w0, rk + 176);
- ARIA_GSKS_NEON<97>(w0, w1, rk + 192);
-
- if (length > 16)
- {
- ARIA_GSKS_NEON<97>(w1, w2, rk + 208);
- ARIA_GSKS_NEON<97>(w2, w3, rk + 224);
-
- if (length > 24)
- {
- ARIA_GSKS_NEON< 97>(w3, w0, rk + 240);
- ARIA_GSKS_NEON<109>(w0, w1, rk + 256);
- }
- }
- }
- else
-#endif // BOTAN_TARGET_SUPPORTS_NEON
- {
- ARIA_GSKS<19>(w0, w1, rk + 0);
- ARIA_GSKS<19>(w1, w2, rk + 16);
- ARIA_GSKS<19>(w2, w3, rk + 32);
- ARIA_GSKS<19>(w3, w0, rk + 48);
- ARIA_GSKS<31>(w0, w1, rk + 64);
- ARIA_GSKS<31>(w1, w2, rk + 80);
- ARIA_GSKS<31>(w2, w3, rk + 96);
- ARIA_GSKS<31>(w3, w0, rk + 112);
- ARIA_GSKS<67>(w0, w1, rk + 128);
- ARIA_GSKS<67>(w1, w2, rk + 144);
- ARIA_GSKS<67>(w2, w3, rk + 160);
- ARIA_GSKS<67>(w3, w0, rk + 176);
- ARIA_GSKS<97>(w0, w1, rk + 192);
-
- if (length > 16)
- {
- ARIA_GSKS<97>(w1, w2, rk + 208);
- ARIA_GSKS<97>(w2, w3, rk + 224);
-
- if (length > 24)
- {
- ARIA_GSKS< 97>(w3, w0, rk + 240);
- ARIA_GSKS<109>(w0, w1, rk + 256);
- }
- }
- }
+ // MSVC is not generating a "rotate immediate". Constify to help it along.
+ static const unsigned int Q = 4 - (N / 32);
+ static const unsigned int R = N % 32;
+ KS[0] = (X[0]) ^ ((Y[(Q )%4])>>R) ^ ((Y[(Q+3)%4])<<(32-R));
+ KS[1] = (X[1]) ^ ((Y[(Q+1)%4])>>R) ^ ((Y[(Q )%4])<<(32-R));
+ KS[2] = (X[2]) ^ ((Y[(Q+2)%4])>>R) ^ ((Y[(Q+1)%4])<<(32-R));
+ KS[3] = (X[3]) ^ ((Y[(Q+3)%4])>>R) ^ ((Y[(Q+2)%4])<<(32-R));
}
/*
-* ARIA Key Schedule (reverse direction)
+* ARIA Key Schedule
*/
-void key_schedule_rev(secure_vector<uint8_t>& KS, secure_vector<uint32_t>& WS, const uint8_t key[], size_t length)
+void key_schedule(secure_vector<uint32_t>& ERK,
+ secure_vector<uint32_t>& DRK,
+ const uint8_t key[], size_t length)
{
+ const uint32_t KRK[3][4] = {
+ {0x517cc1b7, 0x27220a94, 0xfe13abe8, 0xfa9a6ee0},
+ {0x6db14acc, 0x9e21c820, 0xff28b1d5, 0xef5de2b0},
+ {0xdb92371d, 0x2126e970, 0x03249775, 0x04e8c90e}
+ };
+
+ const size_t CK0 = (length / 8) - 2;
+ const size_t CK1 = (CK0 + 1) % 3;
+ const size_t CK2 = (CK1 + 1) % 3;
+
+ uint32_t w0[4];
+ uint32_t w1[4];
+ uint32_t w2[4];
+ uint32_t w3[4];
+
+ w0[0] = load_be<uint32_t>(key,0);
+ w0[1] = load_be<uint32_t>(key,1);
+ w0[2] = load_be<uint32_t>(key,2);
+ w0[3] = load_be<uint32_t>(key,3);
+
+ w1[0] = w0[0] ^ KRK[CK0][0];
+ w1[1] = w0[1] ^ KRK[CK0][1];
+ w1[2] = w0[2] ^ KRK[CK0][2];
+ w1[3] = w0[3] ^ KRK[CK0][3];
+
+ ARIA_FO(w1[0], w1[1], w1[2], w1[3]);
+
+ if(length == 24 || length == 32)
+ {
+ w1[0] ^= load_be<uint32_t>(key,4);
+ w1[1] ^= load_be<uint32_t>(key,5);
+ }
+ if(length == 32)
+ {
+ w1[2] ^= load_be<uint32_t>(key,6);
+ w1[3] ^= load_be<uint32_t>(key,7);
+ }
- BOTAN_UNUSED(key);
- uint8_t *rk = &KS[0];
- int q, r;
-
- switch (length)
- {
- case 16:
- r = 12;
- q = 0;
- break;
- case 32:
- r = 16;
- q = 2;
- break;
- case 24:
- r = 14;
- q = 1;
- break;
- default:
- q = r = 0;
- BOTAN_ASSERT(0, "Invalid key length");
- }
+ w2[0] = w1[0] ^ KRK[CK1][0];
+ w2[1] = w1[1] ^ KRK[CK1][1];
+ w2[2] = w1[2] ^ KRK[CK1][2];
+ w2[3] = w1[3] ^ KRK[CK1][3];
+
+ ARIA_FE(w2[0], w2[1], w2[2], w2[3]);
+
+ w2[0] ^= w0[0];
+ w2[1] ^= w0[1];
+ w2[2] ^= w0[2];
+ w2[3] ^= w0[3];
+
+ w3[0] = w2[0] ^ KRK[CK2][0];
+ w3[1] = w2[1] ^ KRK[CK2][1];
+ w3[2] = w2[2] ^ KRK[CK2][2];
+ w3[3] = w2[3] ^ KRK[CK2][3];
+
+ ARIA_FO(w3[0], w3[1], w3[2], w3[3]);
+
+ w3[0] ^= w1[0];
+ w3[1] ^= w1[1];
+ w3[2] ^= w1[2];
+ w3[3] ^= w1[3];
+
+ if(length == 16)
+ ERK.resize(4*13);
+ else if(length == 24)
+ ERK.resize(4*15);
+ else if(length == 32)
+ ERK.resize(4*17);
+
+ ARIA_ROL128<19>(w0, w1, &ERK[ 0]);
+ ARIA_ROL128<19>(w1, w2, &ERK[ 4]);
+ ARIA_ROL128<19>(w2, w3, &ERK[ 8]);
+ ARIA_ROL128<19>(w3, w0, &ERK[12]);
+ ARIA_ROL128<31>(w0, w1, &ERK[16]);
+ ARIA_ROL128<31>(w1, w2, &ERK[20]);
+ ARIA_ROL128<31>(w2, w3, &ERK[24]);
+ ARIA_ROL128<31>(w3, w0, &ERK[28]);
+ ARIA_ROL128<67>(w0, w1, &ERK[32]);
+ ARIA_ROL128<67>(w1, w2, &ERK[36]);
+ ARIA_ROL128<67>(w2, w3, &ERK[40]);
+ ARIA_ROL128<67>(w3, w0, &ERK[44]);
+ ARIA_ROL128<97>(w0, w1, &ERK[48]);
+
+ if(length == 24 || length == 32)
+ {
+ ARIA_ROL128<97>(w1, w2, &ERK[52]);
+ ARIA_ROL128<97>(w2, w3, &ERK[56]);
+
+ if(length == 32)
+ {
+ ARIA_ROL128< 97>(w3, w0, &ERK[60]);
+ ARIA_ROL128<109>(w0, w1, &ERK[64]);
+ }
+ }
- uint32_t *a, *z, *s = &WS[24], *t = &WS[20];
- a=reinterpret_cast<uint32_t*>(rk); z=a+r*4;
- ::memcpy(t, a, 16); ::memcpy(a, z, 16); ::memcpy(z, t, 16);
+ // Now create the decryption key schedule
+ DRK.resize(ERK.size());
- a+=4; z-=4;
- for (; a<z; a+=4, z-=4)
+ for(size_t i = 0; i != DRK.size(); i += 4)
{
- ARIA_M1(a[0],t[0]); ARIA_M1(a[1],t[1]); ARIA_M1(a[2],t[2]); ARIA_M1(a[3],t[3]);
- ARIA_MM(t[0],t[1],t[2],t[3]); ARIA_P(t[0],t[1],t[2],t[3]); ARIA_MM(t[0],t[1],t[2],t[3]);
- ::memcpy(s, t, 16);
-
- ARIA_M1(z[0],t[0]); ARIA_M1(z[1],t[1]); ARIA_M1(z[2],t[2]); ARIA_M1(z[3],t[3]);
- ARIA_MM(t[0],t[1],t[2],t[3]); ARIA_P(t[0],t[1],t[2],t[3]); ARIA_MM(t[0],t[1],t[2],t[3]);
- ::memcpy(a, t, 16); ::memcpy(z, s, 16);
+ DRK[i ] = ERK[ERK.size()-4-i];
+ DRK[i+1] = ERK[ERK.size()-3-i];
+ DRK[i+2] = ERK[ERK.size()-2-i];
+ DRK[i+3] = ERK[ERK.size()-1-i];
}
- ARIA_M1(a[0],t[0]); ARIA_M1(a[1],t[1]); ARIA_M1(a[2],t[2]); ARIA_M1(a[3],t[3]);
- ARIA_MM(t[0],t[1],t[2],t[3]); ARIA_P(t[0],t[1],t[2],t[3]); ARIA_MM(t[0],t[1],t[2],t[3]);
- ::memcpy(z, t, 16);
+ for(size_t i = 4; i != DRK.size() - 4; i += 4)
+ {
+ for(size_t j = 0; j != 4; ++j)
+ {
+ DRK[i+j] = rotate_right(DRK[i+j], 8) ^
+ rotate_right(DRK[i+j], 16) ^
+ rotate_right(DRK[i+j], 24);
+ }
+
+ DRK[i+1] ^= DRK[i+2]; DRK[i+2] ^= DRK[i+3];
+ DRK[i+0] ^= DRK[i+1]; DRK[i+3] ^= DRK[i+1];
+ DRK[i+2] ^= DRK[i+0]; DRK[i+1] ^= DRK[i+2];
+
+ DRK[i+1] = ((DRK[i+1] << 8) & 0xFF00FF00) | ((DRK[i+1] >> 8) & 0x00FF00FF);
+ DRK[i+2] = rotate_right(DRK[i+2], 16);
+ DRK[i+3] = reverse_bytes(DRK[i+3]);
+
+ DRK[i+1] ^= DRK[i+2]; DRK[i+2] ^= DRK[i+3];
+ DRK[i+0] ^= DRK[i+1]; DRK[i+3] ^= DRK[i+1];
+ DRK[i+2] ^= DRK[i+0]; DRK[i+1] ^= DRK[i+2];
+ }
}
}
+
}
void ARIA_128::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
{
- ARIA_F::transform<12>(in, out, blocks, m_ERK, m_WS);
+ ARIA_F::transform(in, out, blocks, m_ERK);
}
void ARIA_192::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
{
- ARIA_F::transform<14>(in, out, blocks, m_ERK, m_WS);
+ ARIA_F::transform(in, out, blocks, m_ERK);
}
void ARIA_256::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
{
- ARIA_F::transform<16>(in, out, blocks, m_ERK, m_WS);
+ ARIA_F::transform(in, out, blocks, m_ERK);
}
void ARIA_128::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
{
- ARIA_F::transform<12>(in, out, blocks, m_DRK, m_WS);
+ ARIA_F::transform(in, out, blocks, m_DRK);
}
void ARIA_192::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
{
- ARIA_F::transform<14>(in, out, blocks, m_DRK, m_WS);
+ ARIA_F::transform(in, out, blocks, m_DRK);
}
void ARIA_256::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
{
- ARIA_F::transform<16>(in, out, blocks, m_DRK, m_WS);
+ ARIA_F::transform(in, out, blocks, m_DRK);
}
void ARIA_128::key_schedule(const uint8_t key[], size_t length)
{
- m_ERK.resize(16*17); m_DRK.resize(16*17); m_WS.resize(4*7);
- ARIA_F::key_schedule_fwd(m_ERK, m_WS, key, length);
- ::memcpy(&m_DRK[0], &m_ERK[0], 16*17);
- ARIA_F::key_schedule_rev(m_DRK, m_WS, key, length);
+ ARIA_F::key_schedule(m_ERK, m_DRK, key, length);
}
void ARIA_192::key_schedule(const uint8_t key[], size_t length)
{
- m_ERK.resize(16*17); m_DRK.resize(16*17); m_WS.resize(4*7);
- ARIA_F::key_schedule_fwd(m_ERK, m_WS, key, length);
- ::memcpy(&m_DRK[0], &m_ERK[0], 16*17);
- ARIA_F::key_schedule_rev(m_DRK, m_WS, key, length);
+ ARIA_F::key_schedule(m_ERK, m_DRK, key, length);
}
void ARIA_256::key_schedule(const uint8_t key[], size_t length)
{
- m_ERK.resize(16*17); m_DRK.resize(16*17); m_WS.resize(4*7);
- ARIA_F::key_schedule_fwd(m_ERK, m_WS, key, length);
- ::memcpy(&m_DRK[0], &m_ERK[0], 16*17);
- ARIA_F::key_schedule_rev(m_DRK, m_WS, key, length);
+ ARIA_F::key_schedule(m_ERK, m_DRK, key, length);
}
void ARIA_128::clear()
{
zap(m_ERK);
zap(m_DRK);
- zap(m_WS);
}
void ARIA_192::clear()
{
zap(m_ERK);
zap(m_DRK);
- zap(m_WS);
}
void ARIA_256::clear()
{
zap(m_ERK);
zap(m_DRK);
- zap(m_WS);
}
}
diff --git a/src/lib/block/aria/aria.h b/src/lib/block/aria/aria.h
index cc1716c15..3058b2a5e 100644
--- a/src/lib/block/aria/aria.h
+++ b/src/lib/block/aria/aria.h
@@ -35,10 +35,8 @@ class BOTAN_DLL ARIA_128 final : public Block_Cipher_Fixed_Params<16, 16>
private:
void key_schedule(const uint8_t key[], size_t length) override;
- // Encryption and Decryption round keys. The ref impl allocates 17 subkeys.
- secure_vector<uint8_t> m_ERK, m_DRK;
- // Workspace. Key Schedule and Transform use it.
- mutable secure_vector<uint32_t> m_WS;
+ // Encryption and Decryption round keys.
+ secure_vector<uint32_t> m_ERK, m_DRK;
};
/**
@@ -56,10 +54,8 @@ class BOTAN_DLL ARIA_192 final : public Block_Cipher_Fixed_Params<16, 24>
private:
void key_schedule(const uint8_t key[], size_t length) override;
- // Encryption and Decryption round keys. The ref impl allocates 17 subkeys.
- secure_vector<uint8_t> m_ERK, m_DRK;
- // Workspace. Key Schedule and Transform use it.
- mutable secure_vector<uint32_t> m_WS;
+ // Encryption and Decryption round keys.
+ secure_vector<uint32_t> m_ERK, m_DRK;
};
/**
@@ -77,10 +73,8 @@ class BOTAN_DLL ARIA_256 final : public Block_Cipher_Fixed_Params<16, 32>
private:
void key_schedule(const uint8_t key[], size_t length) override;
- // Encryption and Decryption round keys. The ref impl allocates 17 subkeys.
- secure_vector<uint8_t> m_ERK, m_DRK;
- // Workspace. Key Schedule and Transform use it.
- mutable secure_vector<uint32_t> m_WS;
+ // Encryption and Decryption round keys.
+ secure_vector<uint32_t> m_ERK, m_DRK;
};
}
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-25 03:55:05 +0000