Botan  1.10.9
square.cpp
Go to the documentation of this file.
1 /*
2 * Square
3 * (C) 1999-2007 Jack Lloyd
4 *
5 * Based on the public domain reference implemenation
6 *
7 * Distributed under the terms of the Botan license
8 */
9 
10 #include <botan/square.h>
11 #include <botan/loadstor.h>
12 #include <botan/rotate.h>
13 
14 namespace Botan {
15 
16 /*
17 * Square Encryption
18 */
19 void Square::encrypt_n(const byte in[], byte out[], size_t blocks) const
20  {
21  for(size_t i = 0; i != blocks; ++i)
22  {
23  u32bit B0, B1, B2, B3;
24 
25  B0 = TE0[in[ 0] ^ ME[ 0]] ^ TE1[in[ 4] ^ ME[ 4]] ^
26  TE2[in[ 8] ^ ME[ 8]] ^ TE3[in[12] ^ ME[12]] ^ EK[0];
27  B1 = TE0[in[ 1] ^ ME[ 1]] ^ TE1[in[ 5] ^ ME[ 5]] ^
28  TE2[in[ 9] ^ ME[ 9]] ^ TE3[in[13] ^ ME[13]] ^ EK[1];
29  B2 = TE0[in[ 2] ^ ME[ 2]] ^ TE1[in[ 6] ^ ME[ 6]] ^
30  TE2[in[10] ^ ME[10]] ^ TE3[in[14] ^ ME[14]] ^ EK[2];
31  B3 = TE0[in[ 3] ^ ME[ 3]] ^ TE1[in[ 7] ^ ME[ 7]] ^
32  TE2[in[11] ^ ME[11]] ^ TE3[in[15] ^ ME[15]] ^ EK[3];
33 
34  for(size_t j = 1; j != 7; j += 2)
35  {
36  u32bit T0, T1, T2, T3;
37  T0 = TE0[get_byte(0, B0)] ^ TE1[get_byte(0, B1)] ^
38  TE2[get_byte(0, B2)] ^ TE3[get_byte(0, B3)] ^ EK[4*j+0];
39  T1 = TE0[get_byte(1, B0)] ^ TE1[get_byte(1, B1)] ^
40  TE2[get_byte(1, B2)] ^ TE3[get_byte(1, B3)] ^ EK[4*j+1];
41  T2 = TE0[get_byte(2, B0)] ^ TE1[get_byte(2, B1)] ^
42  TE2[get_byte(2, B2)] ^ TE3[get_byte(2, B3)] ^ EK[4*j+2];
43  T3 = TE0[get_byte(3, B0)] ^ TE1[get_byte(3, B1)] ^
44  TE2[get_byte(3, B2)] ^ TE3[get_byte(3, B3)] ^ EK[4*j+3];
45 
46  B0 = TE0[get_byte(0, T0)] ^ TE1[get_byte(0, T1)] ^
47  TE2[get_byte(0, T2)] ^ TE3[get_byte(0, T3)] ^ EK[4*j+4];
48  B1 = TE0[get_byte(1, T0)] ^ TE1[get_byte(1, T1)] ^
49  TE2[get_byte(1, T2)] ^ TE3[get_byte(1, T3)] ^ EK[4*j+5];
50  B2 = TE0[get_byte(2, T0)] ^ TE1[get_byte(2, T1)] ^
51  TE2[get_byte(2, T2)] ^ TE3[get_byte(2, T3)] ^ EK[4*j+6];
52  B3 = TE0[get_byte(3, T0)] ^ TE1[get_byte(3, T1)] ^
53  TE2[get_byte(3, T2)] ^ TE3[get_byte(3, T3)] ^ EK[4*j+7];
54  }
55 
56  out[ 0] = SE[get_byte(0, B0)] ^ ME[16];
57  out[ 1] = SE[get_byte(0, B1)] ^ ME[17];
58  out[ 2] = SE[get_byte(0, B2)] ^ ME[18];
59  out[ 3] = SE[get_byte(0, B3)] ^ ME[19];
60  out[ 4] = SE[get_byte(1, B0)] ^ ME[20];
61  out[ 5] = SE[get_byte(1, B1)] ^ ME[21];
62  out[ 6] = SE[get_byte(1, B2)] ^ ME[22];
63  out[ 7] = SE[get_byte(1, B3)] ^ ME[23];
64  out[ 8] = SE[get_byte(2, B0)] ^ ME[24];
65  out[ 9] = SE[get_byte(2, B1)] ^ ME[25];
66  out[10] = SE[get_byte(2, B2)] ^ ME[26];
67  out[11] = SE[get_byte(2, B3)] ^ ME[27];
68  out[12] = SE[get_byte(3, B0)] ^ ME[28];
69  out[13] = SE[get_byte(3, B1)] ^ ME[29];
70  out[14] = SE[get_byte(3, B2)] ^ ME[30];
71  out[15] = SE[get_byte(3, B3)] ^ ME[31];
72 
73  in += BLOCK_SIZE;
74  out += BLOCK_SIZE;
75  }
76  }
77 
78 /*
79 * Square Decryption
80 */
81 void Square::decrypt_n(const byte in[], byte out[], size_t blocks) const
82  {
83  for(size_t i = 0; i != blocks; ++i)
84  {
85  u32bit B0, B1, B2, B3;
86 
87  B0 = TD0[in[ 0] ^ MD[ 0]] ^ TD1[in[ 4] ^ MD[ 4]] ^
88  TD2[in[ 8] ^ MD[ 8]] ^ TD3[in[12] ^ MD[12]] ^ DK[0];
89  B1 = TD0[in[ 1] ^ MD[ 1]] ^ TD1[in[ 5] ^ MD[ 5]] ^
90  TD2[in[ 9] ^ MD[ 9]] ^ TD3[in[13] ^ MD[13]] ^ DK[1];
91  B2 = TD0[in[ 2] ^ MD[ 2]] ^ TD1[in[ 6] ^ MD[ 6]] ^
92  TD2[in[10] ^ MD[10]] ^ TD3[in[14] ^ MD[14]] ^ DK[2];
93  B3 = TD0[in[ 3] ^ MD[ 3]] ^ TD1[in[ 7] ^ MD[ 7]] ^
94  TD2[in[11] ^ MD[11]] ^ TD3[in[15] ^ MD[15]] ^ DK[3];
95 
96  for(size_t j = 1; j != 7; j += 2)
97  {
98  u32bit T0, T1, T2, T3;
99  T0 = TD0[get_byte(0, B0)] ^ TD1[get_byte(0, B1)] ^
100  TD2[get_byte(0, B2)] ^ TD3[get_byte(0, B3)] ^ DK[4*j+0];
101  T1 = TD0[get_byte(1, B0)] ^ TD1[get_byte(1, B1)] ^
102  TD2[get_byte(1, B2)] ^ TD3[get_byte(1, B3)] ^ DK[4*j+1];
103  T2 = TD0[get_byte(2, B0)] ^ TD1[get_byte(2, B1)] ^
104  TD2[get_byte(2, B2)] ^ TD3[get_byte(2, B3)] ^ DK[4*j+2];
105  T3 = TD0[get_byte(3, B0)] ^ TD1[get_byte(3, B1)] ^
106  TD2[get_byte(3, B2)] ^ TD3[get_byte(3, B3)] ^ DK[4*j+3];
107 
108  B0 = TD0[get_byte(0, T0)] ^ TD1[get_byte(0, T1)] ^
109  TD2[get_byte(0, T2)] ^ TD3[get_byte(0, T3)] ^ DK[4*j+4];
110  B1 = TD0[get_byte(1, T0)] ^ TD1[get_byte(1, T1)] ^
111  TD2[get_byte(1, T2)] ^ TD3[get_byte(1, T3)] ^ DK[4*j+5];
112  B2 = TD0[get_byte(2, T0)] ^ TD1[get_byte(2, T1)] ^
113  TD2[get_byte(2, T2)] ^ TD3[get_byte(2, T3)] ^ DK[4*j+6];
114  B3 = TD0[get_byte(3, T0)] ^ TD1[get_byte(3, T1)] ^
115  TD2[get_byte(3, T2)] ^ TD3[get_byte(3, T3)] ^ DK[4*j+7];
116  }
117 
118  out[ 0] = SD[get_byte(0, B0)] ^ MD[16];
119  out[ 1] = SD[get_byte(0, B1)] ^ MD[17];
120  out[ 2] = SD[get_byte(0, B2)] ^ MD[18];
121  out[ 3] = SD[get_byte(0, B3)] ^ MD[19];
122  out[ 4] = SD[get_byte(1, B0)] ^ MD[20];
123  out[ 5] = SD[get_byte(1, B1)] ^ MD[21];
124  out[ 6] = SD[get_byte(1, B2)] ^ MD[22];
125  out[ 7] = SD[get_byte(1, B3)] ^ MD[23];
126  out[ 8] = SD[get_byte(2, B0)] ^ MD[24];
127  out[ 9] = SD[get_byte(2, B1)] ^ MD[25];
128  out[10] = SD[get_byte(2, B2)] ^ MD[26];
129  out[11] = SD[get_byte(2, B3)] ^ MD[27];
130  out[12] = SD[get_byte(3, B0)] ^ MD[28];
131  out[13] = SD[get_byte(3, B1)] ^ MD[29];
132  out[14] = SD[get_byte(3, B2)] ^ MD[30];
133  out[15] = SD[get_byte(3, B3)] ^ MD[31];
134 
135  in += BLOCK_SIZE;
136  out += BLOCK_SIZE;
137  }
138  }
139 
140 /*
141 * Square Key Schedule
142 */
143 void Square::key_schedule(const byte key[], size_t)
144  {
145  SecureVector<u32bit> XEK(36), XDK(36);
146 
147  for(size_t i = 0; i != 4; ++i)
148  XEK[i] = load_be<u32bit>(key, i);
149 
150  for(size_t i = 0; i != 8; ++i)
151  {
152  XEK[4*i+4] = XEK[4*i ] ^ rotate_left(XEK[4*i+3], 8) ^ (0x01000000 << i);
153  XEK[4*i+5] = XEK[4*i+1] ^ XEK[4*i+4];
154  XEK[4*i+6] = XEK[4*i+2] ^ XEK[4*i+5];
155  XEK[4*i+7] = XEK[4*i+3] ^ XEK[4*i+6];
156 
157  for(size_t j = 0; j != 4; ++j)
158  XDK[28 - 4*i + j] = XEK[4*(i+1)+j];
159 
160  transform(&XEK[4*i]);
161  }
162 
163  for(size_t i = 0; i != 4; ++i)
164  for(size_t j = 0; j != 4; ++j)
165  {
166  ME[4*i+j ] = get_byte(j, XEK[i ]);
167  ME[4*i+j+16] = get_byte(j, XEK[i+32]);
168  MD[4*i+j ] = get_byte(j, XDK[i ]);
169  MD[4*i+j+16] = get_byte(j, XEK[i ]);
170  }
171 
172  EK.copy(&XEK[4], 28);
173  DK.copy(&XDK[4], 28);
174  }
175 
176 /*
177 * Square's Inverse Linear Transformation
178 */
179 void Square::transform(u32bit round_key[4])
180  {
181  static const byte G[4][4] = {
182  { 2, 1, 1, 3 },
183  { 3, 2, 1, 1 },
184  { 1, 3, 2, 1 },
185  { 1, 1, 3, 2 } };
186 
187  for(size_t i = 0; i != 4; ++i)
188  {
189  byte A[4] = { 0 }, B[4] = { 0 };
190 
191  store_be(round_key[i], A);
192 
193  for(size_t j = 0; j != 4; ++j)
194  for(size_t k = 0; k != 4; ++k)
195  {
196  const byte a = A[k];
197  const byte b = G[k][j];
198 
199  if(a && b)
200  B[j] ^= ALog[(Log[a] + Log[b]) % 255];
201  }
202 
203  round_key[i] = load_be<u32bit>(B, 0);
204  }
205  }
206 
207 /*
208 * Clear memory of sensitive data
209 */
211  {
212  zeroise(EK);
213  zeroise(DK);
214  zeroise(ME);
215  zeroise(MD);
216  }
217 
218 }
void encrypt_n(const byte in[], byte out[], size_t blocks) const
Definition: square.cpp:19
T rotate_left(T input, size_t rot)
Definition: rotate.h:21
byte get_byte(size_t byte_num, T input)
Definition: get_byte.h:21
void copy(const T in[], size_t n)
Definition: secmem.h:120
unsigned char byte
Definition: types.h:22
u32bit load_be< u32bit >(const byte in[], size_t off)
Definition: loadstor.h:166
void decrypt_n(const byte in[], byte out[], size_t blocks) const
Definition: square.cpp:81
void store_be(u16bit in, byte out[2])
Definition: loadstor.h:412
void clear()
Definition: square.cpp:210
void zeroise(MemoryRegion< T > &vec)
Definition: secmem.h:415
unsigned int u32bit
Definition: types.h:32