1 | /* |
---|---|

2 | * Twofish for CryptoAPI |

3 | * |

4 | * Originally Twofish for GPG |

5 | * By Matthew Skala <mskala@ansuz.sooke.bc.ca>, July 26, 1998 |

6 | * 256-bit key length added March 20, 1999 |

7 | * Some modifications to reduce the text size by Werner Koch, April, 1998 |

8 | * Ported to the kerneli patch by Marc Mutz <Marc@Mutz.com> |

9 | * Ported to CryptoAPI by Colin Slater <hoho@tacomeat.net> |

10 | * |

11 | * The original author has disclaimed all copyright interest in this |

12 | * code and thus put it in the public domain. The subsequent authors |

13 | * have put this under the GNU General Public License. |

14 | * |

15 | * This program is free software; you can redistribute it and/or modify |

16 | * it under the terms of the GNU General Public License as published by |

17 | * the Free Software Foundation; either version 2 of the License, or |

18 | * (at your option) any later version. |

19 | * |

20 | * This program is distributed in the hope that it will be useful, |

21 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |

22 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |

23 | * GNU General Public License for more details. |

24 | * |

25 | * You should have received a copy of the GNU General Public License |

26 | * along with this program. If not, see <http://www.gnu.org/licenses/>. |

27 | * |

28 | * |

29 | * This code is a "clean room" implementation, written from the paper |

30 | * _Twofish: A 128-Bit Block Cipher_ by Bruce Schneier, John Kelsey, |

31 | * Doug Whiting, David Wagner, Chris Hall, and Niels Ferguson, available |

32 | * through http://www.counterpane.com/twofish.html |

33 | * |

34 | * For background information on multiplication in finite fields, used for |

35 | * the matrix operations in the key schedule, see the book _Contemporary |

36 | * Abstract Algebra_ by Joseph A. Gallian, especially chapter 22 in the |

37 | * Third Edition. |

38 | */ |

39 | |

40 | #include <asm/byteorder.h> |

41 | #include <crypto/twofish.h> |

42 | #include <linux/module.h> |

43 | #include <linux/init.h> |

44 | #include <linux/types.h> |

45 | #include <linux/errno.h> |

46 | #include <linux/crypto.h> |

47 | #include <linux/bitops.h> |

48 | |

49 | /* Macros to compute the g() function in the encryption and decryption |

50 | * rounds. G1 is the straight g() function; G2 includes the 8-bit |

51 | * rotation for the high 32-bit word. */ |

52 | |

53 | #define G1(a) \ |

54 | (ctx->s[0][(a) & 0xFF]) ^ (ctx->s[1][((a) >> 8) & 0xFF]) \ |

55 | ^ (ctx->s[2][((a) >> 16) & 0xFF]) ^ (ctx->s[3][(a) >> 24]) |

56 | |

57 | #define G2(b) \ |

58 | (ctx->s[1][(b) & 0xFF]) ^ (ctx->s[2][((b) >> 8) & 0xFF]) \ |

59 | ^ (ctx->s[3][((b) >> 16) & 0xFF]) ^ (ctx->s[0][(b) >> 24]) |

60 | |

61 | /* Encryption and decryption Feistel rounds. Each one calls the two g() |

62 | * macros, does the PHT, and performs the XOR and the appropriate bit |

63 | * rotations. The parameters are the round number (used to select subkeys), |

64 | * and the four 32-bit chunks of the text. */ |

65 | |

66 | #define ENCROUND(n, a, b, c, d) \ |

67 | x = G1 (a); y = G2 (b); \ |

68 | x += y; y += x + ctx->k[2 * (n) + 1]; \ |

69 | (c) ^= x + ctx->k[2 * (n)]; \ |

70 | (c) = ror32((c), 1); \ |

71 | (d) = rol32((d), 1) ^ y |

72 | |

73 | #define DECROUND(n, a, b, c, d) \ |

74 | x = G1 (a); y = G2 (b); \ |

75 | x += y; y += x; \ |

76 | (d) ^= y + ctx->k[2 * (n) + 1]; \ |

77 | (d) = ror32((d), 1); \ |

78 | (c) = rol32((c), 1); \ |

79 | (c) ^= (x + ctx->k[2 * (n)]) |

80 | |

81 | /* Encryption and decryption cycles; each one is simply two Feistel rounds |

82 | * with the 32-bit chunks re-ordered to simulate the "swap" */ |

83 | |

84 | #define ENCCYCLE(n) \ |

85 | ENCROUND (2 * (n), a, b, c, d); \ |

86 | ENCROUND (2 * (n) + 1, c, d, a, b) |

87 | |

88 | #define DECCYCLE(n) \ |

89 | DECROUND (2 * (n) + 1, c, d, a, b); \ |

90 | DECROUND (2 * (n), a, b, c, d) |

91 | |

92 | /* Macros to convert the input and output bytes into 32-bit words, |

93 | * and simultaneously perform the whitening step. INPACK packs word |

94 | * number n into the variable named by x, using whitening subkey number m. |

95 | * OUTUNPACK unpacks word number n from the variable named by x, using |

96 | * whitening subkey number m. */ |

97 | |

98 | #define INPACK(n, x, m) \ |

99 | x = le32_to_cpu(src[n]) ^ ctx->w[m] |

100 | |

101 | #define OUTUNPACK(n, x, m) \ |

102 | x ^= ctx->w[m]; \ |

103 | dst[n] = cpu_to_le32(x) |

104 | |

105 | |

106 | |

107 | /* Encrypt one block. in and out may be the same. */ |

108 | static void twofish_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in) |

109 | { |

110 | struct twofish_ctx *ctx = crypto_tfm_ctx(tfm); |

111 | const __le32 *src = (const __le32 *)in; |

112 | __le32 *dst = (__le32 *)out; |

113 | |

114 | /* The four 32-bit chunks of the text. */ |

115 | u32 a, b, c, d; |

116 | |

117 | /* Temporaries used by the round function. */ |

118 | u32 x, y; |

119 | |

120 | /* Input whitening and packing. */ |

121 | INPACK (0, a, 0); |

122 | INPACK (1, b, 1); |

123 | INPACK (2, c, 2); |

124 | INPACK (3, d, 3); |

125 | |

126 | /* Encryption Feistel cycles. */ |

127 | ENCCYCLE (0); |

128 | ENCCYCLE (1); |

129 | ENCCYCLE (2); |

130 | ENCCYCLE (3); |

131 | ENCCYCLE (4); |

132 | ENCCYCLE (5); |

133 | ENCCYCLE (6); |

134 | ENCCYCLE (7); |

135 | |

136 | /* Output whitening and unpacking. */ |

137 | OUTUNPACK (0, c, 4); |

138 | OUTUNPACK (1, d, 5); |

139 | OUTUNPACK (2, a, 6); |

140 | OUTUNPACK (3, b, 7); |

141 | |

142 | } |

143 | |

144 | /* Decrypt one block. in and out may be the same. */ |

145 | static void twofish_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in) |

146 | { |

147 | struct twofish_ctx *ctx = crypto_tfm_ctx(tfm); |

148 | const __le32 *src = (const __le32 *)in; |

149 | __le32 *dst = (__le32 *)out; |

150 | |

151 | /* The four 32-bit chunks of the text. */ |

152 | u32 a, b, c, d; |

153 | |

154 | /* Temporaries used by the round function. */ |

155 | u32 x, y; |

156 | |

157 | /* Input whitening and packing. */ |

158 | INPACK (0, c, 4); |

159 | INPACK (1, d, 5); |

160 | INPACK (2, a, 6); |

161 | INPACK (3, b, 7); |

162 | |

163 | /* Encryption Feistel cycles. */ |

164 | DECCYCLE (7); |

165 | DECCYCLE (6); |

166 | DECCYCLE (5); |

167 | DECCYCLE (4); |

168 | DECCYCLE (3); |

169 | DECCYCLE (2); |

170 | DECCYCLE (1); |

171 | DECCYCLE (0); |

172 | |

173 | /* Output whitening and unpacking. */ |

174 | OUTUNPACK (0, a, 0); |

175 | OUTUNPACK (1, b, 1); |

176 | OUTUNPACK (2, c, 2); |

177 | OUTUNPACK (3, d, 3); |

178 | |

179 | } |

180 | |

181 | static struct crypto_alg alg = { |

182 | .cra_name = "twofish", |

183 | .cra_driver_name = "twofish-generic", |

184 | .cra_priority = 100, |

185 | .cra_flags = CRYPTO_ALG_TYPE_CIPHER, |

186 | .cra_blocksize = TF_BLOCK_SIZE, |

187 | .cra_ctxsize = sizeof(struct twofish_ctx), |

188 | .cra_alignmask = 3, |

189 | .cra_module = THIS_MODULE, |

190 | .cra_u = { .cipher = { |

191 | .cia_min_keysize = TF_MIN_KEY_SIZE, |

192 | .cia_max_keysize = TF_MAX_KEY_SIZE, |

193 | .cia_setkey = twofish_setkey, |

194 | .cia_encrypt = twofish_encrypt, |

195 | .cia_decrypt = twofish_decrypt } } |

196 | }; |

197 | |

198 | static int __init twofish_mod_init(void) |

199 | { |

200 | return crypto_register_alg(&alg); |

201 | } |

202 | |

203 | static void __exit twofish_mod_fini(void) |

204 | { |

205 | crypto_unregister_alg(&alg); |

206 | } |

207 | |

208 | module_init(twofish_mod_init); |

209 | module_exit(twofish_mod_fini); |

210 | |

211 | MODULE_LICENSE("GPL"); |

212 | MODULE_DESCRIPTION ("Twofish Cipher Algorithm"); |

213 | MODULE_ALIAS_CRYPTO("twofish"); |

214 | MODULE_ALIAS_CRYPTO("twofish-generic"); |

215 |