Botan 1.10.17
cast256.cpp
Go to the documentation of this file.
1/*
2* CAST-256
3* (C) 1999-2007 Jack Lloyd
4*
5* Distributed under the terms of the Botan license
6*/
7
8#include <botan/cast256.h>
9#include <botan/loadstor.h>
10#include <botan/rotate.h>
11
12namespace Botan {
13
14namespace {
15
16/*
17* CAST-256 Round Type 1
18*/
19void round1(u32bit& out, u32bit in, u32bit mask, u32bit rot)
20 {
21 u32bit temp = rotate_left(mask + in, rot);
22 out ^= (CAST_SBOX1[get_byte(0, temp)] ^ CAST_SBOX2[get_byte(1, temp)]) -
23 CAST_SBOX3[get_byte(2, temp)] + CAST_SBOX4[get_byte(3, temp)];
24 }
25
26/*
27* CAST-256 Round Type 2
28*/
29void round2(u32bit& out, u32bit in, u32bit mask, u32bit rot)
30 {
31 u32bit temp = rotate_left(mask ^ in, rot);
32 out ^= (CAST_SBOX1[get_byte(0, temp)] - CAST_SBOX2[get_byte(1, temp)] +
33 CAST_SBOX3[get_byte(2, temp)]) ^ CAST_SBOX4[get_byte(3, temp)];
34 }
35
36/*
37* CAST-256 Round Type 3
38*/
39void round3(u32bit& out, u32bit in, u32bit mask, u32bit rot)
40 {
41 u32bit temp = rotate_left(mask - in, rot);
42 out ^= ((CAST_SBOX1[get_byte(0, temp)] + CAST_SBOX2[get_byte(1, temp)]) ^
43 CAST_SBOX3[get_byte(2, temp)]) - CAST_SBOX4[get_byte(3, temp)];
44 }
45
46}
47
48/*
49* CAST-256 Encryption
50*/
51void CAST_256::encrypt_n(const byte in[], byte out[], size_t blocks) const
52 {
53 for(size_t i = 0; i != blocks; ++i)
54 {
55 u32bit A = load_be<u32bit>(in, 0);
56 u32bit B = load_be<u32bit>(in, 1);
57 u32bit C = load_be<u32bit>(in, 2);
58 u32bit D = load_be<u32bit>(in, 3);
59
60 round1(C, D, MK[ 0], RK[ 0]); round2(B, C, MK[ 1], RK[ 1]);
61 round3(A, B, MK[ 2], RK[ 2]); round1(D, A, MK[ 3], RK[ 3]);
62 round1(C, D, MK[ 4], RK[ 4]); round2(B, C, MK[ 5], RK[ 5]);
63 round3(A, B, MK[ 6], RK[ 6]); round1(D, A, MK[ 7], RK[ 7]);
64 round1(C, D, MK[ 8], RK[ 8]); round2(B, C, MK[ 9], RK[ 9]);
65 round3(A, B, MK[10], RK[10]); round1(D, A, MK[11], RK[11]);
66 round1(C, D, MK[12], RK[12]); round2(B, C, MK[13], RK[13]);
67 round3(A, B, MK[14], RK[14]); round1(D, A, MK[15], RK[15]);
68 round1(C, D, MK[16], RK[16]); round2(B, C, MK[17], RK[17]);
69 round3(A, B, MK[18], RK[18]); round1(D, A, MK[19], RK[19]);
70 round1(C, D, MK[20], RK[20]); round2(B, C, MK[21], RK[21]);
71 round3(A, B, MK[22], RK[22]); round1(D, A, MK[23], RK[23]);
72 round1(D, A, MK[27], RK[27]); round3(A, B, MK[26], RK[26]);
73 round2(B, C, MK[25], RK[25]); round1(C, D, MK[24], RK[24]);
74 round1(D, A, MK[31], RK[31]); round3(A, B, MK[30], RK[30]);
75 round2(B, C, MK[29], RK[29]); round1(C, D, MK[28], RK[28]);
76 round1(D, A, MK[35], RK[35]); round3(A, B, MK[34], RK[34]);
77 round2(B, C, MK[33], RK[33]); round1(C, D, MK[32], RK[32]);
78 round1(D, A, MK[39], RK[39]); round3(A, B, MK[38], RK[38]);
79 round2(B, C, MK[37], RK[37]); round1(C, D, MK[36], RK[36]);
80 round1(D, A, MK[43], RK[43]); round3(A, B, MK[42], RK[42]);
81 round2(B, C, MK[41], RK[41]); round1(C, D, MK[40], RK[40]);
82 round1(D, A, MK[47], RK[47]); round3(A, B, MK[46], RK[46]);
83 round2(B, C, MK[45], RK[45]); round1(C, D, MK[44], RK[44]);
84
85 store_be(out, A, B, C, D);
86
87 in += BLOCK_SIZE;
88 out += BLOCK_SIZE;
89 }
90 }
91
92/*
93* CAST-256 Decryption
94*/
95void CAST_256::decrypt_n(const byte in[], byte out[], size_t blocks) const
96 {
97 for(size_t i = 0; i != blocks; ++i)
98 {
99 u32bit A = load_be<u32bit>(in, 0);
100 u32bit B = load_be<u32bit>(in, 1);
101 u32bit C = load_be<u32bit>(in, 2);
102 u32bit D = load_be<u32bit>(in, 3);
103
104 round1(C, D, MK[44], RK[44]); round2(B, C, MK[45], RK[45]);
105 round3(A, B, MK[46], RK[46]); round1(D, A, MK[47], RK[47]);
106 round1(C, D, MK[40], RK[40]); round2(B, C, MK[41], RK[41]);
107 round3(A, B, MK[42], RK[42]); round1(D, A, MK[43], RK[43]);
108 round1(C, D, MK[36], RK[36]); round2(B, C, MK[37], RK[37]);
109 round3(A, B, MK[38], RK[38]); round1(D, A, MK[39], RK[39]);
110 round1(C, D, MK[32], RK[32]); round2(B, C, MK[33], RK[33]);
111 round3(A, B, MK[34], RK[34]); round1(D, A, MK[35], RK[35]);
112 round1(C, D, MK[28], RK[28]); round2(B, C, MK[29], RK[29]);
113 round3(A, B, MK[30], RK[30]); round1(D, A, MK[31], RK[31]);
114 round1(C, D, MK[24], RK[24]); round2(B, C, MK[25], RK[25]);
115 round3(A, B, MK[26], RK[26]); round1(D, A, MK[27], RK[27]);
116 round1(D, A, MK[23], RK[23]); round3(A, B, MK[22], RK[22]);
117 round2(B, C, MK[21], RK[21]); round1(C, D, MK[20], RK[20]);
118 round1(D, A, MK[19], RK[19]); round3(A, B, MK[18], RK[18]);
119 round2(B, C, MK[17], RK[17]); round1(C, D, MK[16], RK[16]);
120 round1(D, A, MK[15], RK[15]); round3(A, B, MK[14], RK[14]);
121 round2(B, C, MK[13], RK[13]); round1(C, D, MK[12], RK[12]);
122 round1(D, A, MK[11], RK[11]); round3(A, B, MK[10], RK[10]);
123 round2(B, C, MK[ 9], RK[ 9]); round1(C, D, MK[ 8], RK[ 8]);
124 round1(D, A, MK[ 7], RK[ 7]); round3(A, B, MK[ 6], RK[ 6]);
125 round2(B, C, MK[ 5], RK[ 5]); round1(C, D, MK[ 4], RK[ 4]);
126 round1(D, A, MK[ 3], RK[ 3]); round3(A, B, MK[ 2], RK[ 2]);
127 round2(B, C, MK[ 1], RK[ 1]); round1(C, D, MK[ 0], RK[ 0]);
128
129 store_be(out, A, B, C, D);
130
131 in += BLOCK_SIZE;
132 out += BLOCK_SIZE;
133 }
134 }
135
136/*
137* CAST-256 Key Schedule
138*/
139void CAST_256::key_schedule(const byte key[], size_t length)
140 {
141 SecureVector<u32bit> K(8);
142 for(size_t j = 0; j != length; ++j)
143 K[j/4] = (K[j/4] << 8) + key[j];
144
145 u32bit A = K[0], B = K[1], C = K[2], D = K[3],
146 E = K[4], F = K[5], G = K[6], H = K[7];
147
148 for(size_t j = 0; j != 48; j += 4)
149 {
150 round1(G, H, KEY_MASK[4*j+ 0], KEY_ROT[(4*j+ 0) % 32]);
151 round2(F, G, KEY_MASK[4*j+ 1], KEY_ROT[(4*j+ 1) % 32]);
152 round3(E, F, KEY_MASK[4*j+ 2], KEY_ROT[(4*j+ 2) % 32]);
153 round1(D, E, KEY_MASK[4*j+ 3], KEY_ROT[(4*j+ 3) % 32]);
154 round2(C, D, KEY_MASK[4*j+ 4], KEY_ROT[(4*j+ 4) % 32]);
155 round3(B, C, KEY_MASK[4*j+ 5], KEY_ROT[(4*j+ 5) % 32]);
156 round1(A, B, KEY_MASK[4*j+ 6], KEY_ROT[(4*j+ 6) % 32]);
157 round2(H, A, KEY_MASK[4*j+ 7], KEY_ROT[(4*j+ 7) % 32]);
158 round1(G, H, KEY_MASK[4*j+ 8], KEY_ROT[(4*j+ 8) % 32]);
159 round2(F, G, KEY_MASK[4*j+ 9], KEY_ROT[(4*j+ 9) % 32]);
160 round3(E, F, KEY_MASK[4*j+10], KEY_ROT[(4*j+10) % 32]);
161 round1(D, E, KEY_MASK[4*j+11], KEY_ROT[(4*j+11) % 32]);
162 round2(C, D, KEY_MASK[4*j+12], KEY_ROT[(4*j+12) % 32]);
163 round3(B, C, KEY_MASK[4*j+13], KEY_ROT[(4*j+13) % 32]);
164 round1(A, B, KEY_MASK[4*j+14], KEY_ROT[(4*j+14) % 32]);
165 round2(H, A, KEY_MASK[4*j+15], KEY_ROT[(4*j+15) % 32]);
166
167 RK[j ] = (A % 32);
168 RK[j+1] = (C % 32);
169 RK[j+2] = (E % 32);
170 RK[j+3] = (G % 32);
171 MK[j ] = H;
172 MK[j+1] = F;
173 MK[j+2] = D;
174 MK[j+3] = B;
175 }
176 }
177
178}
Botan::Block_Cipher_Fixed_Params< 16, 4, 32, 4 >::BLOCK_SIZE
@ BLOCK_SIZE
Definition block_cipher.h:107
Botan::CAST_256::decrypt_n
void decrypt_n(const byte in[], byte out[], size_t blocks) const
Definition cast256.cpp:95
Botan::CAST_256::encrypt_n
void encrypt_n(const byte in[], byte out[], size_t blocks) const
Definition cast256.cpp:51
Botan::CAST_SBOX1
const u32bit CAST_SBOX1[256]
Definition cast256.h:39
Botan::get_byte
byte get_byte(size_t byte_num, T input)
Definition get_byte.h:21
Botan::load_be
T load_be(const byte in[], size_t off)
Definition loadstor.h:100
Botan::rotate_left
T rotate_left(T input, size_t rot)
Definition rotate.h:21
Botan::CAST_SBOX2
const u32bit CAST_SBOX2[256]
Definition cast256.h:40
Botan::u32bit
unsigned int u32bit
Definition types.h:32
Botan::CAST_SBOX3
const u32bit CAST_SBOX3[256]
Definition cast256.h:41
Botan::store_be
void store_be(u16bit in, byte out[2])
Definition loadstor.h:412
Botan::CAST_SBOX4
const u32bit CAST_SBOX4[256]
Definition cast256.h:42
Generated by doxygen 1.18.0