1 | /* |
2 | * Twofish for CryptoAPI |
3 | * |
4 | * Originally Twofish for GPG |
5 | * By Matthew Skala <mskala@ansuz.sooke.bc.ca>, July 26, 1998 |
6 | * 256-bit key length added March 20, 1999 |
7 | * Some modifications to reduce the text size by Werner Koch, April, 1998 |
8 | * Ported to the kerneli patch by Marc Mutz <Marc@Mutz.com> |
9 | * Ported to CryptoAPI by Colin Slater <hoho@tacomeat.net> |
10 | * |
11 | * The original author has disclaimed all copyright interest in this |
12 | * code and thus put it in the public domain. The subsequent authors |
13 | * have put this under the GNU General Public License. |
14 | * |
15 | * This program is free software; you can redistribute it and/or modify |
16 | * it under the terms of the GNU General Public License as published by |
17 | * the Free Software Foundation; either version 2 of the License, or |
18 | * (at your option) any later version. |
19 | * |
20 | * This program is distributed in the hope that it will be useful, |
21 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
22 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
23 | * GNU General Public License for more details. |
24 | * |
25 | * You should have received a copy of the GNU General Public License |
26 | * along with this program. If not, see <http://www.gnu.org/licenses/>. |
27 | * |
28 | * |
29 | * This code is a "clean room" implementation, written from the paper |
30 | * _Twofish: A 128-Bit Block Cipher_ by Bruce Schneier, John Kelsey, |
31 | * Doug Whiting, David Wagner, Chris Hall, and Niels Ferguson, available |
32 | * through http://www.counterpane.com/twofish.html |
33 | * |
34 | * For background information on multiplication in finite fields, used for |
35 | * the matrix operations in the key schedule, see the book _Contemporary |
36 | * Abstract Algebra_ by Joseph A. Gallian, especially chapter 22 in the |
37 | * Third Edition. |
38 | */ |
39 | |
40 | #include <asm/byteorder.h> |
41 | #include <crypto/twofish.h> |
42 | #include <linux/module.h> |
43 | #include <linux/init.h> |
44 | #include <linux/types.h> |
45 | #include <linux/errno.h> |
46 | #include <linux/crypto.h> |
47 | #include <linux/bitops.h> |
48 | |
49 | /* Macros to compute the g() function in the encryption and decryption |
50 | * rounds. G1 is the straight g() function; G2 includes the 8-bit |
51 | * rotation for the high 32-bit word. */ |
52 | |
53 | #define G1(a) \ |
54 | (ctx->s[0][(a) & 0xFF]) ^ (ctx->s[1][((a) >> 8) & 0xFF]) \ |
55 | ^ (ctx->s[2][((a) >> 16) & 0xFF]) ^ (ctx->s[3][(a) >> 24]) |
56 | |
57 | #define G2(b) \ |
58 | (ctx->s[1][(b) & 0xFF]) ^ (ctx->s[2][((b) >> 8) & 0xFF]) \ |
59 | ^ (ctx->s[3][((b) >> 16) & 0xFF]) ^ (ctx->s[0][(b) >> 24]) |
60 | |
61 | /* Encryption and decryption Feistel rounds. Each one calls the two g() |
62 | * macros, does the PHT, and performs the XOR and the appropriate bit |
63 | * rotations. The parameters are the round number (used to select subkeys), |
64 | * and the four 32-bit chunks of the text. */ |
65 | |
66 | #define ENCROUND(n, a, b, c, d) \ |
67 | x = G1 (a); y = G2 (b); \ |
68 | x += y; y += x + ctx->k[2 * (n) + 1]; \ |
69 | (c) ^= x + ctx->k[2 * (n)]; \ |
70 | (c) = ror32((c), 1); \ |
71 | (d) = rol32((d), 1) ^ y |
72 | |
73 | #define DECROUND(n, a, b, c, d) \ |
74 | x = G1 (a); y = G2 (b); \ |
75 | x += y; y += x; \ |
76 | (d) ^= y + ctx->k[2 * (n) + 1]; \ |
77 | (d) = ror32((d), 1); \ |
78 | (c) = rol32((c), 1); \ |
79 | (c) ^= (x + ctx->k[2 * (n)]) |
80 | |
81 | /* Encryption and decryption cycles; each one is simply two Feistel rounds |
82 | * with the 32-bit chunks re-ordered to simulate the "swap" */ |
83 | |
84 | #define ENCCYCLE(n) \ |
85 | ENCROUND (2 * (n), a, b, c, d); \ |
86 | ENCROUND (2 * (n) + 1, c, d, a, b) |
87 | |
88 | #define DECCYCLE(n) \ |
89 | DECROUND (2 * (n) + 1, c, d, a, b); \ |
90 | DECROUND (2 * (n), a, b, c, d) |
91 | |
92 | /* Macros to convert the input and output bytes into 32-bit words, |
93 | * and simultaneously perform the whitening step. INPACK packs word |
94 | * number n into the variable named by x, using whitening subkey number m. |
95 | * OUTUNPACK unpacks word number n from the variable named by x, using |
96 | * whitening subkey number m. */ |
97 | |
98 | #define INPACK(n, x, m) \ |
99 | x = le32_to_cpu(src[n]) ^ ctx->w[m] |
100 | |
101 | #define OUTUNPACK(n, x, m) \ |
102 | x ^= ctx->w[m]; \ |
103 | dst[n] = cpu_to_le32(x) |
104 | |
105 | |
106 | |
107 | /* Encrypt one block. in and out may be the same. */ |
108 | static void twofish_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in) |
109 | { |
110 | struct twofish_ctx *ctx = crypto_tfm_ctx(tfm); |
111 | const __le32 *src = (const __le32 *)in; |
112 | __le32 *dst = (__le32 *)out; |
113 | |
114 | /* The four 32-bit chunks of the text. */ |
115 | u32 a, b, c, d; |
116 | |
117 | /* Temporaries used by the round function. */ |
118 | u32 x, y; |
119 | |
120 | /* Input whitening and packing. */ |
121 | INPACK (0, a, 0); |
122 | INPACK (1, b, 1); |
123 | INPACK (2, c, 2); |
124 | INPACK (3, d, 3); |
125 | |
126 | /* Encryption Feistel cycles. */ |
127 | ENCCYCLE (0); |
128 | ENCCYCLE (1); |
129 | ENCCYCLE (2); |
130 | ENCCYCLE (3); |
131 | ENCCYCLE (4); |
132 | ENCCYCLE (5); |
133 | ENCCYCLE (6); |
134 | ENCCYCLE (7); |
135 | |
136 | /* Output whitening and unpacking. */ |
137 | OUTUNPACK (0, c, 4); |
138 | OUTUNPACK (1, d, 5); |
139 | OUTUNPACK (2, a, 6); |
140 | OUTUNPACK (3, b, 7); |
141 | |
142 | } |
143 | |
144 | /* Decrypt one block. in and out may be the same. */ |
145 | static void twofish_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in) |
146 | { |
147 | struct twofish_ctx *ctx = crypto_tfm_ctx(tfm); |
148 | const __le32 *src = (const __le32 *)in; |
149 | __le32 *dst = (__le32 *)out; |
150 | |
151 | /* The four 32-bit chunks of the text. */ |
152 | u32 a, b, c, d; |
153 | |
154 | /* Temporaries used by the round function. */ |
155 | u32 x, y; |
156 | |
157 | /* Input whitening and packing. */ |
158 | INPACK (0, c, 4); |
159 | INPACK (1, d, 5); |
160 | INPACK (2, a, 6); |
161 | INPACK (3, b, 7); |
162 | |
163 | /* Encryption Feistel cycles. */ |
164 | DECCYCLE (7); |
165 | DECCYCLE (6); |
166 | DECCYCLE (5); |
167 | DECCYCLE (4); |
168 | DECCYCLE (3); |
169 | DECCYCLE (2); |
170 | DECCYCLE (1); |
171 | DECCYCLE (0); |
172 | |
173 | /* Output whitening and unpacking. */ |
174 | OUTUNPACK (0, a, 0); |
175 | OUTUNPACK (1, b, 1); |
176 | OUTUNPACK (2, c, 2); |
177 | OUTUNPACK (3, d, 3); |
178 | |
179 | } |
180 | |
181 | static struct crypto_alg alg = { |
182 | .cra_name = "twofish" , |
183 | .cra_driver_name = "twofish-generic" , |
184 | .cra_priority = 100, |
185 | .cra_flags = CRYPTO_ALG_TYPE_CIPHER, |
186 | .cra_blocksize = TF_BLOCK_SIZE, |
187 | .cra_ctxsize = sizeof(struct twofish_ctx), |
188 | .cra_alignmask = 3, |
189 | .cra_module = THIS_MODULE, |
190 | .cra_u = { .cipher = { |
191 | .cia_min_keysize = TF_MIN_KEY_SIZE, |
192 | .cia_max_keysize = TF_MAX_KEY_SIZE, |
193 | .cia_setkey = twofish_setkey, |
194 | .cia_encrypt = twofish_encrypt, |
195 | .cia_decrypt = twofish_decrypt } } |
196 | }; |
197 | |
198 | static int __init twofish_mod_init(void) |
199 | { |
200 | return crypto_register_alg(&alg); |
201 | } |
202 | |
203 | static void __exit twofish_mod_fini(void) |
204 | { |
205 | crypto_unregister_alg(&alg); |
206 | } |
207 | |
208 | module_init(twofish_mod_init); |
209 | module_exit(twofish_mod_fini); |
210 | |
211 | MODULE_LICENSE("GPL" ); |
212 | MODULE_DESCRIPTION ("Twofish Cipher Algorithm" ); |
213 | MODULE_ALIAS_CRYPTO("twofish" ); |
214 | MODULE_ALIAS_CRYPTO("twofish-generic" ); |
215 | |