Botan 1.10.17
safer_sk.cpp
Go to the documentation of this file.
1/*
2* SAFER-SK
3* (C) 1999-2009 Jack Lloyd
4*
5* Distributed under the terms of the Botan license
6*/
7
8#include <botan/safer_sk.h>
9#include <botan/rotate.h>
10#include <botan/parsing.h>
11#include <botan/rotate.h>
12
13namespace Botan {
14
15namespace {
16
17const byte EXP[256] = {
18 0x01, 0x2D, 0xE2, 0x93, 0xBE, 0x45, 0x15, 0xAE, 0x78, 0x03, 0x87, 0xA4,
19 0xB8, 0x38, 0xCF, 0x3F, 0x08, 0x67, 0x09, 0x94, 0xEB, 0x26, 0xA8, 0x6B,
20 0xBD, 0x18, 0x34, 0x1B, 0xBB, 0xBF, 0x72, 0xF7, 0x40, 0x35, 0x48, 0x9C,
21 0x51, 0x2F, 0x3B, 0x55, 0xE3, 0xC0, 0x9F, 0xD8, 0xD3, 0xF3, 0x8D, 0xB1,
22 0xFF, 0xA7, 0x3E, 0xDC, 0x86, 0x77, 0xD7, 0xA6, 0x11, 0xFB, 0xF4, 0xBA,
23 0x92, 0x91, 0x64, 0x83, 0xF1, 0x33, 0xEF, 0xDA, 0x2C, 0xB5, 0xB2, 0x2B,
24 0x88, 0xD1, 0x99, 0xCB, 0x8C, 0x84, 0x1D, 0x14, 0x81, 0x97, 0x71, 0xCA,
25 0x5F, 0xA3, 0x8B, 0x57, 0x3C, 0x82, 0xC4, 0x52, 0x5C, 0x1C, 0xE8, 0xA0,
26 0x04, 0xB4, 0x85, 0x4A, 0xF6, 0x13, 0x54, 0xB6, 0xDF, 0x0C, 0x1A, 0x8E,
27 0xDE, 0xE0, 0x39, 0xFC, 0x20, 0x9B, 0x24, 0x4E, 0xA9, 0x98, 0x9E, 0xAB,
28 0xF2, 0x60, 0xD0, 0x6C, 0xEA, 0xFA, 0xC7, 0xD9, 0x00, 0xD4, 0x1F, 0x6E,
29 0x43, 0xBC, 0xEC, 0x53, 0x89, 0xFE, 0x7A, 0x5D, 0x49, 0xC9, 0x32, 0xC2,
30 0xF9, 0x9A, 0xF8, 0x6D, 0x16, 0xDB, 0x59, 0x96, 0x44, 0xE9, 0xCD, 0xE6,
31 0x46, 0x42, 0x8F, 0x0A, 0xC1, 0xCC, 0xB9, 0x65, 0xB0, 0xD2, 0xC6, 0xAC,
32 0x1E, 0x41, 0x62, 0x29, 0x2E, 0x0E, 0x74, 0x50, 0x02, 0x5A, 0xC3, 0x25,
33 0x7B, 0x8A, 0x2A, 0x5B, 0xF0, 0x06, 0x0D, 0x47, 0x6F, 0x70, 0x9D, 0x7E,
34 0x10, 0xCE, 0x12, 0x27, 0xD5, 0x4C, 0x4F, 0xD6, 0x79, 0x30, 0x68, 0x36,
35 0x75, 0x7D, 0xE4, 0xED, 0x80, 0x6A, 0x90, 0x37, 0xA2, 0x5E, 0x76, 0xAA,
36 0xC5, 0x7F, 0x3D, 0xAF, 0xA5, 0xE5, 0x19, 0x61, 0xFD, 0x4D, 0x7C, 0xB7,
37 0x0B, 0xEE, 0xAD, 0x4B, 0x22, 0xF5, 0xE7, 0x73, 0x23, 0x21, 0xC8, 0x05,
38 0xE1, 0x66, 0xDD, 0xB3, 0x58, 0x69, 0x63, 0x56, 0x0F, 0xA1, 0x31, 0x95,
39 0x17, 0x07, 0x3A, 0x28 };
40
41const byte LOG[512] = {
42 0x80, 0x00, 0xB0, 0x09, 0x60, 0xEF, 0xB9, 0xFD, 0x10, 0x12, 0x9F, 0xE4,
43 0x69, 0xBA, 0xAD, 0xF8, 0xC0, 0x38, 0xC2, 0x65, 0x4F, 0x06, 0x94, 0xFC,
44 0x19, 0xDE, 0x6A, 0x1B, 0x5D, 0x4E, 0xA8, 0x82, 0x70, 0xED, 0xE8, 0xEC,
45 0x72, 0xB3, 0x15, 0xC3, 0xFF, 0xAB, 0xB6, 0x47, 0x44, 0x01, 0xAC, 0x25,
46 0xC9, 0xFA, 0x8E, 0x41, 0x1A, 0x21, 0xCB, 0xD3, 0x0D, 0x6E, 0xFE, 0x26,
47 0x58, 0xDA, 0x32, 0x0F, 0x20, 0xA9, 0x9D, 0x84, 0x98, 0x05, 0x9C, 0xBB,
48 0x22, 0x8C, 0x63, 0xE7, 0xC5, 0xE1, 0x73, 0xC6, 0xAF, 0x24, 0x5B, 0x87,
49 0x66, 0x27, 0xF7, 0x57, 0xF4, 0x96, 0xB1, 0xB7, 0x5C, 0x8B, 0xD5, 0x54,
50 0x79, 0xDF, 0xAA, 0xF6, 0x3E, 0xA3, 0xF1, 0x11, 0xCA, 0xF5, 0xD1, 0x17,
51 0x7B, 0x93, 0x83, 0xBC, 0xBD, 0x52, 0x1E, 0xEB, 0xAE, 0xCC, 0xD6, 0x35,
52 0x08, 0xC8, 0x8A, 0xB4, 0xE2, 0xCD, 0xBF, 0xD9, 0xD0, 0x50, 0x59, 0x3F,
53 0x4D, 0x62, 0x34, 0x0A, 0x48, 0x88, 0xB5, 0x56, 0x4C, 0x2E, 0x6B, 0x9E,
54 0xD2, 0x3D, 0x3C, 0x03, 0x13, 0xFB, 0x97, 0x51, 0x75, 0x4A, 0x91, 0x71,
55 0x23, 0xBE, 0x76, 0x2A, 0x5F, 0xF9, 0xD4, 0x55, 0x0B, 0xDC, 0x37, 0x31,
56 0x16, 0x74, 0xD7, 0x77, 0xA7, 0xE6, 0x07, 0xDB, 0xA4, 0x2F, 0x46, 0xF3,
57 0x61, 0x45, 0x67, 0xE3, 0x0C, 0xA2, 0x3B, 0x1C, 0x85, 0x18, 0x04, 0x1D,
58 0x29, 0xA0, 0x8F, 0xB2, 0x5A, 0xD8, 0xA6, 0x7E, 0xEE, 0x8D, 0x53, 0x4B,
59 0xA1, 0x9A, 0xC1, 0x0E, 0x7A, 0x49, 0xA5, 0x2C, 0x81, 0xC4, 0xC7, 0x36,
60 0x2B, 0x7F, 0x43, 0x95, 0x33, 0xF2, 0x6C, 0x68, 0x6D, 0xF0, 0x02, 0x28,
61 0xCE, 0xDD, 0x9B, 0xEA, 0x5E, 0x99, 0x7C, 0x14, 0x86, 0xCF, 0xE5, 0x42,
62 0xB8, 0x40, 0x78, 0x2D, 0x3A, 0xE9, 0x64, 0x1F, 0x92, 0x90, 0x7D, 0x39,
63 0x6F, 0xE0, 0x89, 0x30, 0x80, 0x00, 0xB0, 0x09, 0x60, 0xEF, 0xB9, 0xFD,
64 0x10, 0x12, 0x9F, 0xE4, 0x69, 0xBA, 0xAD, 0xF8, 0xC0, 0x38, 0xC2, 0x65,
65 0x4F, 0x06, 0x94, 0xFC, 0x19, 0xDE, 0x6A, 0x1B, 0x5D, 0x4E, 0xA8, 0x82,
66 0x70, 0xED, 0xE8, 0xEC, 0x72, 0xB3, 0x15, 0xC3, 0xFF, 0xAB, 0xB6, 0x47,
67 0x44, 0x01, 0xAC, 0x25, 0xC9, 0xFA, 0x8E, 0x41, 0x1A, 0x21, 0xCB, 0xD3,
68 0x0D, 0x6E, 0xFE, 0x26, 0x58, 0xDA, 0x32, 0x0F, 0x20, 0xA9, 0x9D, 0x84,
69 0x98, 0x05, 0x9C, 0xBB, 0x22, 0x8C, 0x63, 0xE7, 0xC5, 0xE1, 0x73, 0xC6,
70 0xAF, 0x24, 0x5B, 0x87, 0x66, 0x27, 0xF7, 0x57, 0xF4, 0x96, 0xB1, 0xB7,
71 0x5C, 0x8B, 0xD5, 0x54, 0x79, 0xDF, 0xAA, 0xF6, 0x3E, 0xA3, 0xF1, 0x11,
72 0xCA, 0xF5, 0xD1, 0x17, 0x7B, 0x93, 0x83, 0xBC, 0xBD, 0x52, 0x1E, 0xEB,
73 0xAE, 0xCC, 0xD6, 0x35, 0x08, 0xC8, 0x8A, 0xB4, 0xE2, 0xCD, 0xBF, 0xD9,
74 0xD0, 0x50, 0x59, 0x3F, 0x4D, 0x62, 0x34, 0x0A, 0x48, 0x88, 0xB5, 0x56,
75 0x4C, 0x2E, 0x6B, 0x9E, 0xD2, 0x3D, 0x3C, 0x03, 0x13, 0xFB, 0x97, 0x51,
76 0x75, 0x4A, 0x91, 0x71, 0x23, 0xBE, 0x76, 0x2A, 0x5F, 0xF9, 0xD4, 0x55,
77 0x0B, 0xDC, 0x37, 0x31, 0x16, 0x74, 0xD7, 0x77, 0xA7, 0xE6, 0x07, 0xDB,
78 0xA4, 0x2F, 0x46, 0xF3, 0x61, 0x45, 0x67, 0xE3, 0x0C, 0xA2, 0x3B, 0x1C,
79 0x85, 0x18, 0x04, 0x1D, 0x29, 0xA0, 0x8F, 0xB2, 0x5A, 0xD8, 0xA6, 0x7E,
80 0xEE, 0x8D, 0x53, 0x4B, 0xA1, 0x9A, 0xC1, 0x0E, 0x7A, 0x49, 0xA5, 0x2C,
81 0x81, 0xC4, 0xC7, 0x36, 0x2B, 0x7F, 0x43, 0x95, 0x33, 0xF2, 0x6C, 0x68,
82 0x6D, 0xF0, 0x02, 0x28, 0xCE, 0xDD, 0x9B, 0xEA, 0x5E, 0x99, 0x7C, 0x14,
83 0x86, 0xCF, 0xE5, 0x42, 0xB8, 0x40, 0x78, 0x2D, 0x3A, 0xE9, 0x64, 0x1F,
84 0x92, 0x90, 0x7D, 0x39, 0x6F, 0xE0, 0x89, 0x30 };
85
86}
87
88/*
89* SAFER-SK Encryption
90*/
91void SAFER_SK::encrypt_n(const byte in[], byte out[], size_t blocks) const
92 {
93 const size_t rounds = get_rounds();
94
95 for(size_t i = 0; i != blocks; ++i)
96 {
97 byte A = in[0], B = in[1], C = in[2], D = in[3],
98 E = in[4], F = in[5], G = in[6], H = in[7], X, Y;
99
100 for(size_t j = 0; j != 16*rounds; j += 16)
101 {
102 A = EXP[A ^ EK[j ]]; B = LOG[B + EK[j+1]];
103 C = LOG[C + EK[j+2]]; D = EXP[D ^ EK[j+3]];
104 E = EXP[E ^ EK[j+4]]; F = LOG[F + EK[j+5]];
105 G = LOG[G + EK[j+6]]; H = EXP[H ^ EK[j+7]];
106
107 A += EK[j+ 8]; B ^= EK[j+ 9]; C ^= EK[j+10]; D += EK[j+11];
108 E += EK[j+12]; F ^= EK[j+13]; G ^= EK[j+14]; H += EK[j+15];
109
110 B += A; D += C; F += E; H += G; A += B; C += D; E += F; G += H;
111 C += A; G += E; D += B; H += F; A += C; E += G; B += D; F += H;
112 H += D; Y = D + H; D = B + F; X = B + D; B = A + E;
113 A += B; F = C + G; E = C + F; C = X; G = Y;
114 }
115
116 out[0] = A ^ EK[16*rounds+0]; out[1] = B + EK[16*rounds+1];
117 out[2] = C + EK[16*rounds+2]; out[3] = D ^ EK[16*rounds+3];
118 out[4] = E ^ EK[16*rounds+4]; out[5] = F + EK[16*rounds+5];
119 out[6] = G + EK[16*rounds+6]; out[7] = H ^ EK[16*rounds+7];
120
121 in += BLOCK_SIZE;
122 out += BLOCK_SIZE;
123 }
124 }
125
126/*
127* SAFER-SK Decryption
128*/
129void SAFER_SK::decrypt_n(const byte in[], byte out[], size_t blocks) const
130 {
131 const size_t rounds = get_rounds();
132
133 for(size_t i = 0; i != blocks; ++i)
134 {
135 byte A = in[0], B = in[1], C = in[2], D = in[3],
136 E = in[4], F = in[5], G = in[6], H = in[7];
137
138 A ^= EK[16*rounds+0]; B -= EK[16*rounds+1]; C -= EK[16*rounds+2];
139 D ^= EK[16*rounds+3]; E ^= EK[16*rounds+4]; F -= EK[16*rounds+5];
140 G -= EK[16*rounds+6]; H ^= EK[16*rounds+7];
141
142 for(s32bit j = 16*(rounds-1); j >= 0; j -= 16)
143 {
144 byte T = E; E = B; B = C; C = T; T = F; F = D; D = G; G = T;
145 A -= E; B -= F; C -= G; D -= H; E -= A; F -= B; G -= C; H -= D;
146 A -= C; E -= G; B -= D; F -= H; C -= A; G -= E; D -= B; H -= F;
147 A -= B; C -= D; E -= F; G -= H; B -= A; D -= C; F -= E; H -= G;
148
149 A = LOG[A - EK[j+8 ] + 256]; B = EXP[B ^ EK[j+9 ]];
150 C = EXP[C ^ EK[j+10]]; D = LOG[D - EK[j+11] + 256];
151 E = LOG[E - EK[j+12] + 256]; F = EXP[F ^ EK[j+13]];
152 G = EXP[G ^ EK[j+14]]; H = LOG[H - EK[j+15] + 256];
153
154 A ^= EK[j+0]; B -= EK[j+1]; C -= EK[j+2]; D ^= EK[j+3];
155 E ^= EK[j+4]; F -= EK[j+5]; G -= EK[j+6]; H ^= EK[j+7];
156 }
157
158 out[0] = A; out[1] = B; out[2] = C; out[3] = D;
159 out[4] = E; out[5] = F; out[6] = G; out[7] = H;
160
161 in += BLOCK_SIZE;
162 out += BLOCK_SIZE;
163 }
164 }
165
166/*
167* SAFER-SK Key Schedule
168*/
169void SAFER_SK::key_schedule(const byte key[], size_t)
170 {
171 const byte BIAS[208] = {
172 0x16, 0x73, 0x3B, 0x1E, 0x8E, 0x70, 0xBD, 0x86, 0x47, 0x7E, 0x24, 0x56,
173 0xF1, 0x77, 0x88, 0x46, 0xB1, 0xBA, 0xA3, 0xB7, 0x10, 0x0A, 0xC5, 0x37,
174 0xC9, 0x5A, 0x28, 0xAC, 0x64, 0xA5, 0xEC, 0xAB, 0xC6, 0x67, 0x95, 0x58,
175 0x0D, 0xF8, 0x9A, 0xF6, 0x66, 0xDC, 0x05, 0x3D, 0xD3, 0x8A, 0xC3, 0xD8,
176 0x6A, 0xE9, 0x36, 0x49, 0x43, 0xBF, 0xEB, 0xD4, 0x9B, 0x68, 0xA0, 0x65,
177 0x5D, 0x57, 0x92, 0x1F, 0x71, 0x5C, 0xBB, 0x22, 0xC1, 0xBE, 0x7B, 0xBC,
178 0x63, 0x94, 0x5F, 0x2A, 0x61, 0xB8, 0x34, 0x32, 0xFD, 0xFB, 0x17, 0x40,
179 0xE6, 0x51, 0x1D, 0x41, 0x8F, 0x29, 0xDD, 0x04, 0x80, 0xDE, 0xE7, 0x31,
180 0x7F, 0x01, 0xA2, 0xF7, 0x39, 0xDA, 0x6F, 0x23, 0xFE, 0x3A, 0xD0, 0x1C,
181 0xD1, 0x30, 0x3E, 0x12, 0xCD, 0x0F, 0xE0, 0xA8, 0xAF, 0x82, 0x59, 0x2C,
182 0x7D, 0xAD, 0xB2, 0xEF, 0xC2, 0x87, 0xCE, 0x75, 0x13, 0x02, 0x90, 0x4F,
183 0x2E, 0x72, 0x33, 0x85, 0x8D, 0xCF, 0xA9, 0x81, 0xE2, 0xC4, 0x27, 0x2F,
184 0x7A, 0x9F, 0x52, 0xE1, 0x15, 0x38, 0x2B, 0xFC, 0x42, 0xC7, 0x08, 0xE4,
185 0x09, 0x55, 0x5E, 0x8C, 0x76, 0x60, 0xFF, 0xDF, 0xD7, 0x98, 0xFA, 0x0B,
186 0x00, 0x1A, 0xF9, 0xA6, 0xB9, 0xE8, 0x9E, 0x62, 0xD9, 0x91, 0x50, 0xD2,
187 0xEE, 0x18, 0xB4, 0x07, 0xEA, 0x5B, 0xA4, 0xC8, 0x0E, 0xCB, 0x48, 0x69,
188 0x4E, 0x9C, 0x35, 0x79, 0x45, 0x4D, 0x54, 0xE5, 0x3C, 0x0C, 0x4A, 0x8B,
189 0x3F, 0xCC, 0xA7, 0xDB };
190
191 const byte KEY_INDEX[208] = {
192 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x0B, 0x0C, 0x0D, 0x0E,
193 0x0F, 0x10, 0x11, 0x09, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x00, 0x01,
194 0x0D, 0x0E, 0x0F, 0x10, 0x11, 0x09, 0x0A, 0x0B, 0x05, 0x06, 0x07, 0x08,
195 0x00, 0x01, 0x02, 0x03, 0x0F, 0x10, 0x11, 0x09, 0x0A, 0x0B, 0x0C, 0x0D,
196 0x07, 0x08, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x11, 0x09, 0x0A, 0x0B,
197 0x0C, 0x0D, 0x0E, 0x0F, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
198 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10, 0x11, 0x02, 0x03, 0x04, 0x05,
199 0x06, 0x07, 0x08, 0x00, 0x0C, 0x0D, 0x0E, 0x0F, 0x10, 0x11, 0x09, 0x0A,
200 0x04, 0x05, 0x06, 0x07, 0x08, 0x00, 0x01, 0x02, 0x0E, 0x0F, 0x10, 0x11,
201 0x09, 0x0A, 0x0B, 0x0C, 0x06, 0x07, 0x08, 0x00, 0x01, 0x02, 0x03, 0x04,
202 0x10, 0x11, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x08, 0x00, 0x01, 0x02,
203 0x03, 0x04, 0x05, 0x06, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10,
204 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x0B, 0x0C, 0x0D, 0x0E,
205 0x0F, 0x10, 0x11, 0x09, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x00, 0x01,
206 0x0D, 0x0E, 0x0F, 0x10, 0x11, 0x09, 0x0A, 0x0B, 0x05, 0x06, 0x07, 0x08,
207 0x00, 0x01, 0x02, 0x03, 0x0F, 0x10, 0x11, 0x09, 0x0A, 0x0B, 0x0C, 0x0D,
208 0x07, 0x08, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x11, 0x09, 0x0A, 0x0B,
209 0x0C, 0x0D, 0x0E, 0x0F };
210
211 SecureVector<byte> KB(18);
212
213 for(size_t i = 0; i != 8; ++i)
214 {
215 KB[ 8] ^= KB[i] = rotate_left(key[i], 5);
216 KB[17] ^= KB[i+9] = EK[i] = key[i+8];
217 }
218
219 for(size_t i = 0; i != get_rounds(); ++i)
220 {
221 for(size_t j = 0; j != 18; ++j)
222 KB[j] = rotate_left(KB[j], 6);
223 for(size_t j = 0; j != 16; ++j)
224 EK[16*i+j+8] = KB[KEY_INDEX[16*i+j]] + BIAS[16*i+j];
225 }
226 }
227
228/*
229* Return the name of this type
230*/
231std::string SAFER_SK::name() const
232 {
233 return "SAFER-SK(" + to_string(get_rounds()) + ")";
234 }
235
236/*
237* Return a clone of this object
238*/
239BlockCipher* SAFER_SK::clone() const
240 {
241 return new SAFER_SK(get_rounds());
242 }
243
244/*
245* SAFER-SK Constructor
246*/
247SAFER_SK::SAFER_SK(size_t rounds)
248 {
249 if(rounds > 13 || rounds == 0)
250 throw Invalid_Argument(name() + ": Invalid number of rounds");
251
252 EK.resize(16 * rounds + 8);
253 }
254
255}
Botan::Block_Cipher_Fixed_Params< 8, 16 >::BLOCK_SIZE
@ BLOCK_SIZE
Definition block_cipher.h:107
Botan::SAFER_SK::name
std::string name() const
Definition safer_sk.cpp:231
Botan::SAFER_SK::clone
BlockCipher * clone() const
Definition safer_sk.cpp:239
Botan::SAFER_SK::encrypt_n
void encrypt_n(const byte in[], byte out[], size_t blocks) const
Definition safer_sk.cpp:91
Botan::SAFER_SK::SAFER_SK
SAFER_SK(size_t rounds)
Definition safer_sk.cpp:247
Botan::SAFER_SK::decrypt_n
void decrypt_n(const byte in[], byte out[], size_t blocks) const
Definition safer_sk.cpp:129
Botan::s32bit
signed int s32bit
Definition types.h:37
Botan::rotate_left
T rotate_left(T input, size_t rot)
Definition rotate.h:21
Botan::to_string
std::string to_string(u64bit n, size_t min_len)
Definition parsing.cpp:42
Botan::Invalid_Argument
std::invalid_argument Invalid_Argument
Definition exceptn.h:20
Generated by doxygen 1.18.0