/* * loki91.c - library routines for a 64 bit LOKI91 implementation * * Designed by Matthew Kwan and * Lawrence Brown * Modifications: * v2.0 - original set of code by mkwan 9/91 * v3.0 - support both LOKI89 & LOKI91 versions 10/92 lpb * * Copyright 1991 by Lawrence Brown and UNSW. All rights reserved. * This program may not be sold or used as inducement to buy a * product without the written permission of the author. * * nb: if this program is compiled on a little-endian machine (eg Vax) * #define LITTLE_ENDIAN * in order to enable the byte swapping routines * * if a detailed trace of LOKI91 function f is required for debugging * #define TRACE=n n=1 print blocks, n=2 print fn f also * n=3 print individual S-box calcs also * * these routines assume that the 8-byte char arrays used to pass * the 64-bit blocks fall on a word boundary, so that the blocks * may be read as longwords for efficiency reasons. If this is * not true, the load & save of the parameters will need changing. */ #include #include "loki.h" /* include Interface Specification header file */ #include "loki.i" /* include Interface Specification header file */ /* * string specifying version and copyright message */ char *loki_lib_ver = "LOKI91 library v3.0, Copyright (C) 1991 Lawrence Brown & UNSW"; Long loki_subkeys[ROUNDS]; /* subkeys at the 16 rounds */ static Long f(); /* declare LOKI function f */ static short s(); /* declare LOKI S-box fn s */ /* * ROL12(b) - macro to rotate 32-bit block b left by 12 bits * ROL13(b) - macro to rotate 32-bit block b left by 13 bits */ #define ROL12(b) b = ((b << 12) | (b >> 20)); #define ROL13(b) b = ((b << 13) | (b >> 19)); /* * bswap(b) - exchanged bytes in each longword of a 64-bit data block * on little-endian machines where byte order is reversed */ #ifdef LITTLE_ENDIAN #define bswap(cb) { \ register char c; \ c = cb[0]; cb[0] = cb[3]; cb[3] = c; \ c = cb[1]; cb[1] = cb[2]; cb[2] = c; \ c = cb[4]; cb[4] = cb[7]; cb[7] = c; \ c = cb[5]; cb[5] = cb[6]; cb[6] = c; \ } #endif /* * setlokikey(key) - save 64-bit key for use in encryptions & decryptions * and compute sub-keys using the key schedule */ void setlokikey(key) char key[LOKIBLK]; /* Key to use, stored as an array of Longs */ { register i; register Long KL, KR; #ifdef LITTLE_ENDIAN bswap(key); /* swap bytes round if little-endian */ #endif #if TRACE >= 1 fprintf(stderr," keyinit(%08lx, %08lx)\n", ((Long *)key)[0], ((Long *)key)[1]); #endif KL = ((Long *)key)[0]; KR = ((Long *)key)[1]; for (i=0; i= 1 fprintf(stderr," enloki(%08lx, %08lx)\n", ((Long *)b)[0], ((Long *)b)[1]); #endif L = ((Long *)b)[0]; R = ((Long *)b)[1]; for (i=0; i= 1 fprintf(stderr," enloki returns %08lx, %08lx\n", ((Long *)b)[0], ((Long *)b)[1]); #endif #ifdef LITTLE_ENDIAN bswap(b); /* swap bytes round if little-endian */ #endif } /* * deloki(b) - main LOKI91 decryption routine, this routine decrypts one * 64-bit block b using the LOKI91 algorithm with loki_subkeys * * Decryption uses the same algorithm as encryption, except that * the subkeys are used in reverse order. */ void deloki(b) char b[LOKIBLK]; { register i; register Long L, R; /* left & right data halves */ #ifdef LITTLE_ENDIAN bswap(b); /* swap bytes round if little-endian */ #endif #if TRACE >= 1 fprintf(stderr," deloki(%08lx, %08lx)\n", ((Long *)b)[0], ((Long *)b)[1]); #endif L = ((Long *)b)[0]; /* LR = X XOR K */ R = ((Long *)b)[1]; for (i=ROUNDS; i>0; i-=2) { /* subkeys in reverse order */ L ^= f(R, loki_subkeys[i-1]); R ^= f(L, loki_subkeys[i-2]); } ((Long *)b)[0] = R; /* Y = LR XOR K */ ((Long *)b)[1] = L; #if TRACE >= 1 fprintf(stderr," deloki returns %08lx, %08lx\n", ((Long *)b)[0], ((Long *)b)[1]); #endif #ifdef LITTLE_ENDIAN bswap(b); /* swap bytes round if little-endian */ #endif } /* * f(r, k) - is the complex non-linear LOKI function, whose output * is a complex function of both input data and sub-key. * * The data is XORed with the subkey, then expanded into 4 x 12-bit * values, which are fed into the S-boxes. The 4 x 8-bit outputs * from the S-boxes are permuted together to form the 32-bit value * which is returned. * * In this implementation the outputs from the S-boxes have been * pre-permuted and stored in lookup tables. */ #define MASK12 0x0fff /* 12 bit mask for expansion E */ static Long f(r, k) register Long r; /* Data value R(i-1) */ Long k; /* Key K(i) */ { Long a, b, c; /* 32 bit S-box output, & P output */ a = r ^ k; /* A = R(i-1) XOR K(i) */ /* want to use slow speed/small size version */ b = ((Long)s((a & MASK12)) ) | /* B = S(E(R(i-1))^K(i)) */ ((Long)s(((a >> 8) & MASK12)) << 8) | ((Long)s(((a >> 16) & MASK12)) << 16) | ((Long)s((((a >> 24) | (a << 8)) & MASK12)) << 24); perm32(&c, &b, P); /* C = P(S( E(R(i-1)) XOR K(i))) */ #if TRACE >= 2 /* If Tracing, dump A, K(i), and f(R(i-1),K(i)) */ fprintf(stderr," f(%08lx, %08lx) = P.S(%08lx) = P(%08lx) = %08lx\n", r, k, a, b, c); #endif return(c); /* f returns the result C */ } /* * s(i) - return S-box value for input i */ static short s(i) register Long i; /* return S-box value for input i */ { register short r, c, v, t; short exp8(); /* exponentiation routine for GF(2^8) */ r = ((i>>8) & 0xc) | (i & 0x3); /* row value-top 2 & bottom 2 */ c = (i>>2) & 0xff; /* column value-middle 8 bits */ t = (c + ((r * 17) ^ 0xff)) & 0xff; /* base value for Sfn */ v = exp8(t, sfn[r].exp, sfn[r].gen); /* Sfn[r] = t ^ exp mod gen */ #if TRACE >= 3 fprintf(stderr, " s(%lx=[%d,%d]) = %x sup %d mod %d = %x\n", i, r, c, t, sfn[r].exp, sfn[r].gen, v); #endif return(v); } /* * perm32(out, in, perm) is the general permutation of a 32-bit input * block to a 32-bit output block, under the control of a * permutation array perm. Each element of perm specifies which * input bit is to be permuted to the output bit with the same * index as the array element. * * nb: to set bits in the output word, as mask with a single 1 in it is * used. On each step, the 1 is shifted into the next location */ #define MSB 0x80000000L /* MSB of 32-bit word */ perm32(out, in , perm) Long *out; /* Output 32-bit block to be permuted */ Long *in; /* Input 32-bit block after permutation */ char perm[32]; /* Permutation array */ { Long mask = MSB; /* mask used to set bit in output */ register int i, o, b; /* input bit no, output bit no, value */ register char *p = perm; /* ptr to permutation array */ *out = 0; /* clear output block */ for (o=0; o<32; o++) { /* For each output bit position o */ i =(int)*p++; /* get input bit permuted to output o */ b = (*in >> i) & 01; /* value of input bit i */ if (b) /* If the input bit i is set */ *out |= mask; /* OR in mask to output i */ mask >>= 1; /* Shift mask to next bit */ } } /* * mult8(a, b, gen) - returns the product of two binary * strings a and b using the generator gen as the modulus * mult = a * b mod gen * gen generates a suitable Galois field in GF(2^8) */ #define SIZE 256 /* 256 elements in GF(2^8) */ short mult8(a, b, gen) short a, b; /* operands for multiply */ short gen; /* irreducible polynomial generating Galois Field */ { short product = 0; /* result of multiplication */ while(b != 0) { /* while multiplier is non-zero */ if (b & 01) product ^= a; /* add multiplicand if LSB of b set */ a <<= 1; /* shift multiplicand one place */ if (a >= SIZE) a ^= gen; /* and modulo reduce if needed */ b >>= 1; /* shift multiplier one place */ } return(product); } /* * exp8(base, exponent, gen) - returns the result of * exponentiation given the base, exponent, generator of GF, * exp = base ^ exp mod gen */ short exp8(base, exponent, gen) short base; /* base of exponentiation */ short exponent; /* exponent */ short gen; /* irreducible polynomial generating Galois Field */ { short accum = base; /* superincreasing sequence of base */ short result = 1; /* result of exponentiation */ if (base == 0) /* if zero base specified then */ return(0); /* the result is "0" if base = 0 */ while (exponent != 0) { /* repeat while exponent non-zero */ if (( exponent & 0x0001) == 0x0001) /* multiply if exp 1 */ result = mult8(result, accum, gen); exponent >>= 1; /* shift exponent to next digit */ accum = mult8(accum, accum, gen); /* & square */ } return(result); }