Crypto++ 8.6 Free C++ class library of cryptographic schemes

twofish.cpp
1 // twofish.cpp - modified by Wei Dai from Matthew Skala's twofish.c
2 // The original code and all modifications are in the public domain.
3
4 #include "pch.h"
5 #include "twofish.h"
6 #include "secblock.h"
7 #include "misc.h"
8
9 NAMESPACE_BEGIN(CryptoPP)
10
11 // compute (c * x^4) mod (x^4 + (a + 1/a) * x^3 + a * x^2 + (a + 1/a) * x + 1)
12 // over GF(256)
13 static inline unsigned int Mod(unsigned int c)
14 {
15 static const unsigned int modulus = 0x14d;
16 unsigned int c2 = (c<<1) ^ ((c & 0x80) ? modulus : 0);
17 unsigned int c1 = c2 ^ (c>>1) ^ ((c & 1) ? (modulus>>1) : 0);
18 return c | (c1 << 8) | (c2 << 16) | (c1 << 24);
19 }
20
21 // compute RS(12,8) code with the above polynomial as generator
22 // this is equivalent to multiplying by the RS matrix
23 static word32 ReedSolomon(word32 high, word32 low)
24 {
25 for (unsigned int i=0; i<8; i++)
26 {
27 high = Mod(high>>24) ^ (high<<8) ^ (low>>24);
28 low <<= 8;
29 }
30 return high;
31 }
32
33 inline word32 Twofish::Base::h0(word32 x, const word32 *key, unsigned int kLen)
34 {
35 x = x | (x<<8) | (x<<16) | (x<<24);
36 switch(kLen)
37 {
38 #define Q(a, b, c, d, t) q[a][GETBYTE(t,0)] ^ (q[b][GETBYTE(t,1)] << 8) ^ (q[c][GETBYTE(t,2)] << 16) ^ (q[d][GETBYTE(t,3)] << 24)
39 case 4: x = Q(1, 0, 0, 1, x) ^ key[6];
40 // fall through
41 case 3: x = Q(1, 1, 0, 0, x) ^ key[4];
42 // fall through
43 case 2: x = Q(0, 1, 0, 1, x) ^ key[2];
44 x = Q(0, 0, 1, 1, x) ^ key[0];
45 }
46 return x;
47 }
48
49 inline word32 Twofish::Base::h(word32 x, const word32 *key, unsigned int kLen)
50 {
51 x = h0(x, key, kLen);
52 return mds[0][GETBYTE(x,0)] ^ mds[1][GETBYTE(x,1)] ^ mds[2][GETBYTE(x,2)] ^ mds[3][GETBYTE(x,3)];
53 }
54
55 void Twofish::Base::UncheckedSetKey(const byte *userKey, unsigned int keylength, const NameValuePairs &)
56 {
57 AssertValidKeyLength(keylength);
58
59 unsigned int len = (keylength <= 16 ? 2 : (keylength <= 24 ? 3 : 4));
60 SecBlock<word32> key(len*2);
61 GetUserKey(LITTLE_ENDIAN_ORDER, key.begin(), len*2, userKey, keylength);
62
63 unsigned int i;
64 for (i=0; i<40; i+=2)
65 {
66 word32 a = h(i, key, len);
67 word32 b = rotlConstant<8>(h(i + 1, key + 1, len));
68 m_k[i] = a+b;
69 m_k[i + 1] = rotlConstant<9>(a + 2 * b);
70 }
71
72 SecBlock<word32> svec(2*len);
73 for (i=0; i<len; i++)
74 svec[2*(len-i-1)] = ReedSolomon(key[2*i+1], key[2*i]);
75 for (i=0; i<256; i++)
76 {
77 word32 t = h0(i, svec, len);
78 m_s[0*256+i] = mds[0][GETBYTE(t, 0)];
79 m_s[1*256+i] = mds[1][GETBYTE(t, 1)];
80 m_s[2*256+i] = mds[2][GETBYTE(t, 2)];
81 m_s[3*256+i] = mds[3][GETBYTE(t, 3)];
82 }
83 }
84
85 #define G1(x) (m_s[0*256+GETBYTE(x,0)] ^ m_s[1*256+GETBYTE(x,1)] ^ m_s[2*256+GETBYTE(x,2)] ^ m_s[3*256+GETBYTE(x,3)])
86 #define G2(x) (m_s[0*256+GETBYTE(x,3)] ^ m_s[1*256+GETBYTE(x,0)] ^ m_s[2*256+GETBYTE(x,1)] ^ m_s[3*256+GETBYTE(x,2)])
87
88 #define ENCROUND(n, a, b, c, d) \
89 x = G1 (a); y = G2 (b); \
90 x += y; y += x + k[2 * (n) + 1]; \
91 (c) ^= x + k[2 * (n)]; \
92 (c) = rotrConstant<1>(c); \
93 (d) = rotlConstant<1>(d) ^ y
94
95 #define ENCCYCLE(n) \
96 ENCROUND (2 * (n), a, b, c, d); \
97 ENCROUND (2 * (n) + 1, c, d, a, b)
98
99 #define DECROUND(n, a, b, c, d) \
100 x = G1 (a); y = G2 (b); \
101 x += y; y += x; \
102 (d) ^= y + k[2 * (n) + 1]; \
103 (d) = rotrConstant<1>(d); \
104 (c) = rotlConstant<1>(c); \
105 (c) ^= (x + k[2 * (n)])
106
107 #define DECCYCLE(n) \
108 DECROUND (2 * (n) + 1, c, d, a, b); \
109 DECROUND (2 * (n), a, b, c, d)
110
111 typedef BlockGetAndPut<word32, LittleEndian> Block;
112
113 void Twofish::Enc::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
114 {
115 word32 x, y, a, b, c, d;
116
117 Block::Get(inBlock)(a)(b)(c)(d);
118
119 a ^= m_k[0];
120 b ^= m_k[1];
121 c ^= m_k[2];
122 d ^= m_k[3];
123
124 const word32 *k = m_k+8;
125 ENCCYCLE (0);
126 ENCCYCLE (1);
127 ENCCYCLE (2);
128 ENCCYCLE (3);
129 ENCCYCLE (4);
130 ENCCYCLE (5);
131 ENCCYCLE (6);
132 ENCCYCLE (7);
133
134 c ^= m_k[4];
135 d ^= m_k[5];
136 a ^= m_k[6];
137 b ^= m_k[7];
138
139 Block::Put(xorBlock, outBlock)(c)(d)(a)(b);
140 }
141
142 void Twofish::Dec::ProcessAndXorBlock(const byte *inBlock, const byte *xorBlock, byte *outBlock) const
143 {
144 word32 x, y, a, b, c, d;
145
146 Block::Get(inBlock)(c)(d)(a)(b);
147
148 c ^= m_k[4];
149 d ^= m_k[5];
150 a ^= m_k[6];
151 b ^= m_k[7];
152
153 const word32 *k = m_k+8;
154 DECCYCLE (7);
155 DECCYCLE (6);
156 DECCYCLE (5);
157 DECCYCLE (4);
158 DECCYCLE (3);
159 DECCYCLE (2);
160 DECCYCLE (1);
161 DECCYCLE (0);
162
163 a ^= m_k[0];
164 b ^= m_k[1];
165 c ^= m_k[2];
166 d ^= m_k[3];
167
168 Block::Put(xorBlock, outBlock)(a)(b)(c)(d);
169 }
170
171 NAMESPACE_END
secblock.h
Classes and functions for secure memory allocations.
LITTLE_ENDIAN_ORDER
@ LITTLE_ENDIAN_ORDER
byte order is little-endian
Definition: cryptlib.h:145
pch.h
Precompiled header file.
word32
unsigned int word32
32-bit unsigned datatype
Definition: config_int.h:62
misc.h
Utility functions for the Crypto++ library.
PutBlock
Access a block of memory.
Definition: misc.h:2569
BlockGetAndPut
Access a block of memory.
Definition: misc.h:2606
twofish.h
Classes for the Twofish block cipher.
CryptoPP
Crypto++ library namespace.
SecBlock< word32 >
NameValuePairs
Interface for retrieving values given their names.
Definition: cryptlib.h:321