| // SPDX-License-Identifier: BSD-2-Clause |
| /* LibTomCrypt, modular cryptographic library -- Tom St Denis |
| * |
| * LibTomCrypt is a library that provides various cryptographic |
| * algorithms in a highly modular and flexible manner. |
| * |
| * The library is free for all purposes without any express |
| * guarantee it works. |
| */ |
| |
| /****************************************************************************** |
| * This Rabbit C source code was morphed fm the EU eSTREAM ECRYPT submission |
| * and should run on any conforming C implementation (C90 or later). |
| * |
| * This implementation supports any key length up to 128 bits (16 bytes) and |
| * works in increments of 8-bit bytes. Keys must be submitted as whole bytes |
| * and shorter keys will be right-null-padded to 16 bytes. Likewise, an iv |
| * may be any length up to 8 bytes and will be padded out to 8 bytes. |
| * |
| * The eSTREAM submission was rather picky about the calling sequence of |
| * ECRYPT_process_blocks() and ECRYPT_process_bytes(). That version allowed |
| * calling ECRYPT_process_blocks() multiple times for a multiple of whole |
| * 16-byte blocks, but once ECRYPT_process_bytes() was called. no more calls |
| * were supported correctly. This implementation handles the keystream |
| * differently and rabbit_crypt() may be called as many times as desired, |
| * crypting any number of bytes each time. |
| * |
| * http://www.ecrypt.eu.org/stream/e2-rabbit.html |
| * |
| * NB: One of the test vectors distributed by the eSTREAM site in the file |
| * "rabbit_p3source.zip" is in error. Referring to "test-vectors.txt" |
| * in that ZIP file, the 3rd line in "out1" should be |
| * "96 D6 73 16 88 D1 68 DA 51 D4 0C 70 C3 A1 16 F4". |
| * |
| * Here is the original legal notice accompanying the Rabbit submission |
| * to the EU eSTREAM competition. |
| *--------------------------------------------------------------------------- |
| * Copyright (C) Cryptico A/S. All rights reserved. |
| * |
| * YOU SHOULD CAREFULLY READ THIS LEGAL NOTICE BEFORE USING THIS SOFTWARE. |
| * |
| * This software is developed by Cryptico A/S and/or its suppliers. |
| * All title and intellectual property rights in and to the software, |
| * including but not limited to patent rights and copyrights, are owned |
| * by Cryptico A/S and/or its suppliers. |
| * |
| * The software may be used solely for non-commercial purposes |
| * without the prior written consent of Cryptico A/S. For further |
| * information on licensing terms and conditions please contact |
| * Cryptico A/S at info@cryptico.com |
| * |
| * Cryptico, CryptiCore, the Cryptico logo and "Re-thinking encryption" |
| * are either trademarks or registered trademarks of Cryptico A/S. |
| * |
| * Cryptico A/S shall not in any way be liable for any use of this |
| * software. The software is provided "as is" without any express or |
| * implied warranty. |
| *--------------------------------------------------------------------------- |
| * On October 6, 2008, Rabbit was "released into the public domain and |
| * may be used freely for any purpose." |
| * http://www.ecrypt.eu.org/stream/rabbitpf.html |
| * https://web.archive.org/web/20090630021733/http://www.ecrypt.eu.org/stream/phorum/read.php?1,1244 |
| ******************************************************************************/ |
| |
| |
| #include "tomcrypt_private.h" |
| |
| #ifdef LTC_RABBIT |
| |
| /* local/private prototypes (NB: rabbit_ctx and rabbit_state are different) */ |
| static LTC_INLINE ulong32 _rabbit_g_func(ulong32 x); |
| static LTC_INLINE void _rabbit_next_state(rabbit_ctx *p_instance); |
| static LTC_INLINE void _rabbit_gen_1_block(rabbit_state* st, unsigned char *out); |
| |
| /* -------------------------------------------------------------------------- */ |
| |
| /* Square a 32-bit unsigned integer to obtain the 64-bit result and return */ |
| /* the upper 32 bits XOR the lower 32 bits */ |
| static LTC_INLINE ulong32 _rabbit_g_func(ulong32 x) |
| { |
| ulong32 a, b, h, l; |
| |
| /* Construct high and low argument for squaring */ |
| a = x & 0xFFFF; |
| b = x >> 16; |
| |
| /* Calculate high and low result of squaring */ |
| h = ((((ulong32)(a*a)>>17) + (ulong32)(a*b))>>15) + b*b; |
| l = x * x; |
| |
| /* Return high XOR low */ |
| return (ulong32)(h^l); |
| } |
| |
| /* -------------------------------------------------------------------------- */ |
| |
| /* Calculate the next internal state */ |
| static LTC_INLINE void _rabbit_next_state(rabbit_ctx *p_instance) |
| { |
| ulong32 g[8], c_old[8], i; |
| |
| /* Save old counter values */ |
| for (i=0; i<8; i++) { |
| c_old[i] = p_instance->c[i]; |
| } |
| |
| /* Calculate new counter values */ |
| p_instance->c[0] = (ulong32)(p_instance->c[0] + 0x4D34D34D + p_instance->carry); |
| p_instance->c[1] = (ulong32)(p_instance->c[1] + 0xD34D34D3 + (p_instance->c[0] < c_old[0])); |
| p_instance->c[2] = (ulong32)(p_instance->c[2] + 0x34D34D34 + (p_instance->c[1] < c_old[1])); |
| p_instance->c[3] = (ulong32)(p_instance->c[3] + 0x4D34D34D + (p_instance->c[2] < c_old[2])); |
| p_instance->c[4] = (ulong32)(p_instance->c[4] + 0xD34D34D3 + (p_instance->c[3] < c_old[3])); |
| p_instance->c[5] = (ulong32)(p_instance->c[5] + 0x34D34D34 + (p_instance->c[4] < c_old[4])); |
| p_instance->c[6] = (ulong32)(p_instance->c[6] + 0x4D34D34D + (p_instance->c[5] < c_old[5])); |
| p_instance->c[7] = (ulong32)(p_instance->c[7] + 0xD34D34D3 + (p_instance->c[6] < c_old[6])); |
| p_instance->carry = (p_instance->c[7] < c_old[7]); |
| |
| /* Calculate the g-values */ |
| for (i=0;i<8;i++) { |
| g[i] = _rabbit_g_func((ulong32)(p_instance->x[i] + p_instance->c[i])); |
| } |
| |
| /* Calculate new state values */ |
| p_instance->x[0] = (ulong32)(g[0] + ROLc(g[7],16) + ROLc(g[6], 16)); |
| p_instance->x[1] = (ulong32)(g[1] + ROLc(g[0], 8) + g[7]); |
| p_instance->x[2] = (ulong32)(g[2] + ROLc(g[1],16) + ROLc(g[0], 16)); |
| p_instance->x[3] = (ulong32)(g[3] + ROLc(g[2], 8) + g[1]); |
| p_instance->x[4] = (ulong32)(g[4] + ROLc(g[3],16) + ROLc(g[2], 16)); |
| p_instance->x[5] = (ulong32)(g[5] + ROLc(g[4], 8) + g[3]); |
| p_instance->x[6] = (ulong32)(g[6] + ROLc(g[5],16) + ROLc(g[4], 16)); |
| p_instance->x[7] = (ulong32)(g[7] + ROLc(g[6], 8) + g[5]); |
| } |
| |
| /* ------------------------------------------------------------------------- */ |
| |
| static LTC_INLINE void _rabbit_gen_1_block(rabbit_state* st, unsigned char *out) |
| { |
| ulong32 *ptr; |
| |
| /* Iterate the work context once */ |
| _rabbit_next_state(&(st->work_ctx)); |
| |
| /* Generate 16 bytes of pseudo-random data */ |
| ptr = (ulong32*)&(st->work_ctx.x); |
| STORE32L((ptr[0] ^ (ptr[5]>>16) ^ (ulong32)(ptr[3]<<16)), out+ 0); |
| STORE32L((ptr[2] ^ (ptr[7]>>16) ^ (ulong32)(ptr[5]<<16)), out+ 4); |
| STORE32L((ptr[4] ^ (ptr[1]>>16) ^ (ulong32)(ptr[7]<<16)), out+ 8); |
| STORE32L((ptr[6] ^ (ptr[3]>>16) ^ (ulong32)(ptr[1]<<16)), out+12); |
| } |
| |
| /* -------------------------------------------------------------------------- */ |
| |
| /* Key setup */ |
| int rabbit_setup(rabbit_state* st, const unsigned char *key, unsigned long keylen) |
| { |
| ulong32 k0, k1, k2, k3, i; |
| unsigned char tmpkey[16] = {0}; |
| |
| LTC_ARGCHK(st != NULL); |
| LTC_ARGCHK(key != NULL); |
| LTC_ARGCHK(keylen <= 16); |
| |
| /* init state */ |
| XMEMSET(st, 0, sizeof(rabbit_state)); |
| |
| /* pad key in tmpkey */ |
| XMEMCPY(tmpkey, key, keylen); |
| |
| /* Generate four subkeys */ |
| LOAD32L(k0, tmpkey+ 0); |
| LOAD32L(k1, tmpkey+ 4); |
| LOAD32L(k2, tmpkey+ 8); |
| LOAD32L(k3, tmpkey+12); |
| |
| #ifdef LTC_CLEAN_STACK |
| /* done with tmpkey, wipe it */ |
| zeromem(tmpkey, sizeof(tmpkey)); |
| #endif |
| |
| /* Generate initial state variables */ |
| st->master_ctx.x[0] = k0; |
| st->master_ctx.x[2] = k1; |
| st->master_ctx.x[4] = k2; |
| st->master_ctx.x[6] = k3; |
| st->master_ctx.x[1] = (ulong32)(k3<<16) | (k2>>16); |
| st->master_ctx.x[3] = (ulong32)(k0<<16) | (k3>>16); |
| st->master_ctx.x[5] = (ulong32)(k1<<16) | (k0>>16); |
| st->master_ctx.x[7] = (ulong32)(k2<<16) | (k1>>16); |
| |
| /* Generate initial counter values */ |
| st->master_ctx.c[0] = ROLc(k2, 16); |
| st->master_ctx.c[2] = ROLc(k3, 16); |
| st->master_ctx.c[4] = ROLc(k0, 16); |
| st->master_ctx.c[6] = ROLc(k1, 16); |
| st->master_ctx.c[1] = (k0&0xFFFF0000) | (k1&0xFFFF); |
| st->master_ctx.c[3] = (k1&0xFFFF0000) | (k2&0xFFFF); |
| st->master_ctx.c[5] = (k2&0xFFFF0000) | (k3&0xFFFF); |
| st->master_ctx.c[7] = (k3&0xFFFF0000) | (k0&0xFFFF); |
| |
| /* Clear carry bit */ |
| st->master_ctx.carry = 0; |
| |
| /* Iterate the master context four times */ |
| for (i=0; i<4; i++) { |
| _rabbit_next_state(&(st->master_ctx)); |
| } |
| |
| /* Modify the counters */ |
| for (i=0; i<8; i++) { |
| st->master_ctx.c[i] ^= st->master_ctx.x[(i+4)&0x7]; |
| } |
| |
| /* Copy master instance to work instance */ |
| for (i=0; i<8; i++) { |
| st->work_ctx.x[i] = st->master_ctx.x[i]; |
| st->work_ctx.c[i] = st->master_ctx.c[i]; |
| } |
| st->work_ctx.carry = st->master_ctx.carry; |
| /* ...and prepare block for crypt() */ |
| XMEMSET(&(st->block), 0, sizeof(st->block)); |
| st->unused = 0; |
| |
| return CRYPT_OK; |
| } |
| |
| /* -------------------------------------------------------------------------- */ |
| |
| /* IV setup */ |
| int rabbit_setiv(rabbit_state* st, const unsigned char *iv, unsigned long ivlen) |
| { |
| ulong32 i0, i1, i2, i3, i; |
| unsigned char tmpiv[8] = {0}; |
| |
| LTC_ARGCHK(st != NULL); |
| LTC_ARGCHK(iv != NULL || ivlen == 0); |
| LTC_ARGCHK(ivlen <= 8); |
| |
| /* pad iv in tmpiv */ |
| if (iv && ivlen > 0) XMEMCPY(tmpiv, iv, ivlen); |
| |
| /* Generate four subvectors */ |
| LOAD32L(i0, tmpiv+0); |
| LOAD32L(i2, tmpiv+4); |
| i1 = (i0>>16) | (i2&0xFFFF0000); |
| i3 = (i2<<16) | (i0&0x0000FFFF); |
| |
| /* Modify counter values */ |
| st->work_ctx.c[0] = st->master_ctx.c[0] ^ i0; |
| st->work_ctx.c[1] = st->master_ctx.c[1] ^ i1; |
| st->work_ctx.c[2] = st->master_ctx.c[2] ^ i2; |
| st->work_ctx.c[3] = st->master_ctx.c[3] ^ i3; |
| st->work_ctx.c[4] = st->master_ctx.c[4] ^ i0; |
| st->work_ctx.c[5] = st->master_ctx.c[5] ^ i1; |
| st->work_ctx.c[6] = st->master_ctx.c[6] ^ i2; |
| st->work_ctx.c[7] = st->master_ctx.c[7] ^ i3; |
| |
| /* Copy state variables */ |
| for (i=0; i<8; i++) { |
| st->work_ctx.x[i] = st->master_ctx.x[i]; |
| } |
| st->work_ctx.carry = st->master_ctx.carry; |
| |
| /* Iterate the work context four times */ |
| for (i=0; i<4; i++) { |
| _rabbit_next_state(&(st->work_ctx)); |
| } |
| |
| /* reset keystream buffer and unused count */ |
| XMEMSET(&(st->block), 0, sizeof(st->block)); |
| st->unused = 0; |
| |
| return CRYPT_OK; |
| } |
| |
| /* ------------------------------------------------------------------------- */ |
| |
| /* Crypt a chunk of any size (encrypt/decrypt) */ |
| int rabbit_crypt(rabbit_state* st, const unsigned char *in, unsigned long inlen, unsigned char *out) |
| { |
| unsigned char buf[16]; |
| unsigned long i, j; |
| |
| if (inlen == 0) return CRYPT_OK; /* nothing to do */ |
| |
| LTC_ARGCHK(st != NULL); |
| LTC_ARGCHK(in != NULL); |
| LTC_ARGCHK(out != NULL); |
| |
| if (st->unused > 0) { |
| j = MIN(st->unused, inlen); |
| for (i = 0; i < j; ++i, st->unused--) out[i] = in[i] ^ st->block[16 - st->unused]; |
| inlen -= j; |
| if (inlen == 0) return CRYPT_OK; |
| out += j; |
| in += j; |
| } |
| for (;;) { |
| /* gen a block for buf */ |
| _rabbit_gen_1_block(st, buf); |
| if (inlen <= 16) { |
| /* XOR and send to out */ |
| for (i = 0; i < inlen; ++i) out[i] = in[i] ^ buf[i]; |
| st->unused = 16 - inlen; |
| /* copy remainder to block */ |
| for (i = inlen; i < 16; ++i) st->block[i] = buf[i]; |
| return CRYPT_OK; |
| } |
| /* XOR entire buf and send to out */ |
| for (i = 0; i < 16; ++i) out[i] = in[i] ^ buf[i]; |
| inlen -= 16; |
| out += 16; |
| in += 16; |
| } |
| } |
| |
| /* ------------------------------------------------------------------------- */ |
| |
| int rabbit_keystream(rabbit_state *st, unsigned char *out, unsigned long outlen) |
| { |
| if (outlen == 0) return CRYPT_OK; /* nothing to do */ |
| |
| LTC_ARGCHK(out != NULL); |
| |
| XMEMSET(out, 0, outlen); |
| return rabbit_crypt(st, out, outlen, out); |
| } |
| |
| /* -------------------------------------------------------------------------- */ |
| |
| int rabbit_done(rabbit_state *st) |
| { |
| LTC_ARGCHK(st != NULL); |
| |
| zeromem(st, sizeof(rabbit_state)); |
| return CRYPT_OK; |
| } |
| |
| /* -------------------------------------------------------------------------- */ |
| |
| int rabbit_test(void) |
| { |
| #ifndef LTC_TEST |
| return CRYPT_NOP; |
| #else |
| rabbit_state st; |
| int err; |
| unsigned char out[1000] = { 0 }; |
| { |
| /* all 3 tests use key and iv fm set 6, vector 3, the last vector in: |
| http://www.ecrypt.eu.org/stream/svn/viewcvs.cgi/ecrypt/trunk/submissions/rabbit/verified.test-vectors?rev=210&view=log |
| */ |
| |
| /* --- Test 1 (generate whole blocks) --------------------------------- */ |
| |
| { |
| unsigned char k[] = { 0x0F, 0x62, 0xB5, 0x08, 0x5B, 0xAE, 0x01, 0x54, |
| 0xA7, 0xFA, 0x4D, 0xA0, 0xF3, 0x46, 0x99, 0xEC }; |
| unsigned char iv[] = { 0x28, 0x8F, 0xF6, 0x5D, 0xC4, 0x2B, 0x92, 0xF9 }; |
| char pt[64] = { 0 }; |
| unsigned char ct[] = { 0x61, 0x3C, 0xB0, 0xBA, 0x96, 0xAF, 0xF6, 0xCA, |
| 0xCF, 0x2A, 0x45, 0x9A, 0x10, 0x2A, 0x7F, 0x78, |
| 0xCA, 0x98, 0x5C, 0xF8, 0xFD, 0xD1, 0x47, 0x40, |
| 0x18, 0x75, 0x8E, 0x36, 0xAE, 0x99, 0x23, 0xF5, |
| 0x19, 0xD1, 0x3D, 0x71, 0x8D, 0xAF, 0x8D, 0x7C, |
| 0x0C, 0x10, 0x9B, 0x79, 0xD5, 0x74, 0x94, 0x39, |
| 0xB7, 0xEF, 0xA4, 0xC4, 0xC9, 0xC8, 0xD2, 0x9D, |
| 0xC5, 0xB3, 0x88, 0x83, 0x14, 0xA6, 0x81, 0x6F }; |
| unsigned long ptlen = sizeof(pt); |
| |
| /* crypt 64 nulls */ |
| if ((err = rabbit_setup(&st, k, sizeof(k))) != CRYPT_OK) return err; |
| if ((err = rabbit_setiv(&st, iv, sizeof(iv))) != CRYPT_OK) return err; |
| if ((err = rabbit_crypt(&st, (unsigned char*)pt, ptlen, out)) != CRYPT_OK) return err; |
| if (compare_testvector(out, ptlen, ct, ptlen, "RABBIT-TV1", 1)) return CRYPT_FAIL_TESTVECTOR; |
| } |
| |
| /* --- Test 2 (generate unusual number of bytes each time) ------------ */ |
| |
| { |
| unsigned char k[] = { 0x0F, 0x62, 0xB5, 0x08, 0x5B, 0xAE, 0x01, 0x54, |
| 0xA7, 0xFA, 0x4D, 0xA0, 0xF3, 0x46, 0x99, 0xEC }; |
| unsigned char iv[] = { 0x28, 0x8F, 0xF6, 0x5D, 0xC4, 0x2B, 0x92, 0xF9 }; |
| char pt[39] = { 0 }; |
| unsigned char ct[] = { 0x61, 0x3C, 0xB0, 0xBA, 0x96, 0xAF, 0xF6, 0xCA, |
| 0xCF, 0x2A, 0x45, 0x9A, 0x10, 0x2A, 0x7F, 0x78, |
| 0xCA, 0x98, 0x5C, 0xF8, 0xFD, 0xD1, 0x47, 0x40, |
| 0x18, 0x75, 0x8E, 0x36, 0xAE, 0x99, 0x23, 0xF5, |
| 0x19, 0xD1, 0x3D, 0x71, 0x8D, 0xAF, 0x8D }; |
| unsigned long ptlen = sizeof(pt); |
| |
| /* crypt piece by piece (hit at least one 16-byte boundary) */ |
| if ((err = rabbit_setup(&st, k, sizeof(k))) != CRYPT_OK) return err; |
| if ((err = rabbit_setiv(&st, iv, sizeof(iv))) != CRYPT_OK) return err; |
| if ((err = rabbit_crypt(&st, (unsigned char*)pt, 5, out)) != CRYPT_OK) return err; |
| if ((err = rabbit_crypt(&st, (unsigned char*)pt + 5, 11, out + 5)) != CRYPT_OK) return err; |
| if ((err = rabbit_crypt(&st, (unsigned char*)pt + 16, 14, out + 16)) != CRYPT_OK) return err; |
| if ((err = rabbit_crypt(&st, (unsigned char*)pt + 30, 2, out + 30)) != CRYPT_OK) return err; |
| if ((err = rabbit_crypt(&st, (unsigned char*)pt + 32, 7, out + 32)) != CRYPT_OK) return err; |
| if (compare_testvector(out, ptlen, ct, ptlen, "RABBIT-TV2", 1)) return CRYPT_FAIL_TESTVECTOR; |
| } |
| |
| /* --- Test 3 (use non-null data) ------------------------------------- */ |
| |
| { |
| unsigned char k[] = { 0x0F, 0x62, 0xB5, 0x08, 0x5B, 0xAE, 0x01, 0x54, |
| 0xA7, 0xFA, 0x4D, 0xA0, 0xF3, 0x46, 0x99, 0xEC }; |
| unsigned char iv[] = { 0x28, 0x8F, 0xF6, 0x5D, 0xC4, 0x2B, 0x92, 0xF9 }; |
| char pt[] = "Kilroy was here, there, and everywhere!"; |
| unsigned char ct[] = { 0x2a, 0x55, 0xdc, 0xc8, 0xf9, 0xd6, 0xd6, 0xbd, |
| 0xae, 0x59, 0x65, 0xf2, 0x75, 0x58, 0x1a, 0x54, |
| 0xea, 0xec, 0x34, 0x9d, 0x8f, 0xb4, 0x6b, 0x60, |
| 0x79, 0x1b, 0xea, 0x16, 0xcb, 0xef, 0x46, 0x87, |
| 0x60, 0xa6, 0x55, 0x14, 0xff, 0xca, 0xac }; |
| unsigned long ptlen = strlen(pt); |
| unsigned char out2[1000] = { 0 }; |
| unsigned char nulls[1000] = { 0 }; |
| |
| /* crypt piece by piece */ |
| if ((err = rabbit_setup(&st, k, sizeof(k))) != CRYPT_OK) return err; |
| if ((err = rabbit_setiv(&st, iv, sizeof(iv))) != CRYPT_OK) return err; |
| if ((err = rabbit_crypt(&st, (unsigned char*)pt, 5, out)) != CRYPT_OK) return err; |
| if ((err = rabbit_crypt(&st, (unsigned char*)pt + 5, 29, out + 5)) != CRYPT_OK) return err; |
| if ((err = rabbit_crypt(&st, (unsigned char*)pt + 34, 5, out + 34)) != CRYPT_OK) return err; |
| if (compare_testvector(out, ptlen, ct, ptlen, "RABBIT-TV3", 1)) return CRYPT_FAIL_TESTVECTOR; |
| |
| /* --- Test 4 (crypt in a single call) ------------------------------------ */ |
| |
| if ((err = rabbit_memory(k, sizeof(k), iv, sizeof(iv), |
| (unsigned char*)pt, sizeof(pt), out)) != CRYPT_OK) return err; |
| if (compare_testvector(out, ptlen, ct, ptlen, "RABBIT-TV4", 1)) return CRYPT_FAIL_TESTVECTOR; |
| /* use 'out' (ciphertext) in the next decryption test */ |
| |
| /* --- Test 5 (decrypt ciphertext) ------------------------------------ */ |
| |
| /* decrypt ct (out) and compare with pt (start with only setiv() to reset) */ |
| if ((err = rabbit_setiv(&st, iv, sizeof(iv))) != CRYPT_OK) return err; |
| if ((err = rabbit_crypt(&st, out, ptlen, out2)) != CRYPT_OK) return err; |
| if (compare_testvector(out2, ptlen, pt, ptlen, "RABBIT-TV5", 1)) return CRYPT_FAIL_TESTVECTOR; |
| |
| /* --- Test 6 (wipe state, incl key) ---------------------------------- */ |
| |
| if ((err = rabbit_done(&st)) != CRYPT_OK) return err; |
| if (compare_testvector(&st, sizeof(st), nulls, sizeof(st), "RABBIT-TV6", 1)) return CRYPT_FAIL_TESTVECTOR; |
| |
| } |
| |
| return CRYPT_OK; |
| } |
| #endif |
| } |
| |
| /* -------------------------------------------------------------------------- */ |
| |
| #endif |
| |
| /* ref: $Format:%D$ */ |
| /* git commit: $Format:%H$ */ |
| /* commit time: $Format:%ai$ */ |
