camellia.c 34 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072
  1. /*
  2. * Camellia implementation
  3. *
  4. * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
  5. * SPDX-License-Identifier: Apache-2.0
  6. *
  7. * Licensed under the Apache License, Version 2.0 (the "License"); you may
  8. * not use this file except in compliance with the License.
  9. * You may obtain a copy of the License at
  10. *
  11. * http://www.apache.org/licenses/LICENSE-2.0
  12. *
  13. * Unless required by applicable law or agreed to in writing, software
  14. * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  15. * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16. * See the License for the specific language governing permissions and
  17. * limitations under the License.
  18. *
  19. * This file is part of mbed TLS (https://tls.mbed.org)
  20. */
  21. /*
  22. * The Camellia block cipher was designed by NTT and Mitsubishi Electric
  23. * Corporation.
  24. *
  25. * http://info.isl.ntt.co.jp/crypt/eng/camellia/dl/01espec.pdf
  26. */
  27. #if !defined(MBEDTLS_CONFIG_FILE)
  28. #include "mbedtls/config.h"
  29. #else
  30. #include MBEDTLS_CONFIG_FILE
  31. #endif
  32. #if defined(MBEDTLS_CAMELLIA_C)
  33. #include "mbedtls/camellia.h"
  34. #include <string.h>
  35. #if defined(MBEDTLS_SELF_TEST)
  36. #if defined(MBEDTLS_PLATFORM_C)
  37. #include "mbedtls/platform.h"
  38. #else
  39. #include <stdio.h>
  40. #define mbedtls_printf printf
  41. #endif /* MBEDTLS_PLATFORM_C */
  42. #endif /* MBEDTLS_SELF_TEST */
  43. #if !defined(MBEDTLS_CAMELLIA_ALT)
  44. /* Implementation that should never be optimized out by the compiler */
  45. static void mbedtls_zeroize( void *v, size_t n ) {
  46. volatile unsigned char *p = (unsigned char*)v; while( n-- ) *p++ = 0;
  47. }
  48. /*
  49. * 32-bit integer manipulation macros (big endian)
  50. */
  51. #ifndef GET_UINT32_BE
  52. #define GET_UINT32_BE(n,b,i) \
  53. { \
  54. (n) = ( (uint32_t) (b)[(i) ] << 24 ) \
  55. | ( (uint32_t) (b)[(i) + 1] << 16 ) \
  56. | ( (uint32_t) (b)[(i) + 2] << 8 ) \
  57. | ( (uint32_t) (b)[(i) + 3] ); \
  58. }
  59. #endif
  60. #ifndef PUT_UINT32_BE
  61. #define PUT_UINT32_BE(n,b,i) \
  62. { \
  63. (b)[(i) ] = (unsigned char) ( (n) >> 24 ); \
  64. (b)[(i) + 1] = (unsigned char) ( (n) >> 16 ); \
  65. (b)[(i) + 2] = (unsigned char) ( (n) >> 8 ); \
  66. (b)[(i) + 3] = (unsigned char) ( (n) ); \
  67. }
  68. #endif
  69. static const unsigned char SIGMA_CHARS[6][8] =
  70. {
  71. { 0xa0, 0x9e, 0x66, 0x7f, 0x3b, 0xcc, 0x90, 0x8b },
  72. { 0xb6, 0x7a, 0xe8, 0x58, 0x4c, 0xaa, 0x73, 0xb2 },
  73. { 0xc6, 0xef, 0x37, 0x2f, 0xe9, 0x4f, 0x82, 0xbe },
  74. { 0x54, 0xff, 0x53, 0xa5, 0xf1, 0xd3, 0x6f, 0x1c },
  75. { 0x10, 0xe5, 0x27, 0xfa, 0xde, 0x68, 0x2d, 0x1d },
  76. { 0xb0, 0x56, 0x88, 0xc2, 0xb3, 0xe6, 0xc1, 0xfd }
  77. };
  78. #if defined(MBEDTLS_CAMELLIA_SMALL_MEMORY)
  79. static const unsigned char FSb[256] =
  80. {
  81. 112,130, 44,236,179, 39,192,229,228,133, 87, 53,234, 12,174, 65,
  82. 35,239,107,147, 69, 25,165, 33,237, 14, 79, 78, 29,101,146,189,
  83. 134,184,175,143,124,235, 31,206, 62, 48,220, 95, 94,197, 11, 26,
  84. 166,225, 57,202,213, 71, 93, 61,217, 1, 90,214, 81, 86,108, 77,
  85. 139, 13,154,102,251,204,176, 45,116, 18, 43, 32,240,177,132,153,
  86. 223, 76,203,194, 52,126,118, 5,109,183,169, 49,209, 23, 4,215,
  87. 20, 88, 58, 97,222, 27, 17, 28, 50, 15,156, 22, 83, 24,242, 34,
  88. 254, 68,207,178,195,181,122,145, 36, 8,232,168, 96,252,105, 80,
  89. 170,208,160,125,161,137, 98,151, 84, 91, 30,149,224,255,100,210,
  90. 16,196, 0, 72,163,247,117,219,138, 3,230,218, 9, 63,221,148,
  91. 135, 92,131, 2,205, 74,144, 51,115,103,246,243,157,127,191,226,
  92. 82,155,216, 38,200, 55,198, 59,129,150,111, 75, 19,190, 99, 46,
  93. 233,121,167,140,159,110,188,142, 41,245,249,182, 47,253,180, 89,
  94. 120,152, 6,106,231, 70,113,186,212, 37,171, 66,136,162,141,250,
  95. 114, 7,185, 85,248,238,172, 10, 54, 73, 42,104, 60, 56,241,164,
  96. 64, 40,211,123,187,201, 67,193, 21,227,173,244,119,199,128,158
  97. };
  98. #define SBOX1(n) FSb[(n)]
  99. #define SBOX2(n) (unsigned char)((FSb[(n)] >> 7 ^ FSb[(n)] << 1) & 0xff)
  100. #define SBOX3(n) (unsigned char)((FSb[(n)] >> 1 ^ FSb[(n)] << 7) & 0xff)
  101. #define SBOX4(n) FSb[((n) << 1 ^ (n) >> 7) &0xff]
  102. #else /* MBEDTLS_CAMELLIA_SMALL_MEMORY */
  103. static const unsigned char FSb[256] =
  104. {
  105. 112, 130, 44, 236, 179, 39, 192, 229, 228, 133, 87, 53, 234, 12, 174, 65,
  106. 35, 239, 107, 147, 69, 25, 165, 33, 237, 14, 79, 78, 29, 101, 146, 189,
  107. 134, 184, 175, 143, 124, 235, 31, 206, 62, 48, 220, 95, 94, 197, 11, 26,
  108. 166, 225, 57, 202, 213, 71, 93, 61, 217, 1, 90, 214, 81, 86, 108, 77,
  109. 139, 13, 154, 102, 251, 204, 176, 45, 116, 18, 43, 32, 240, 177, 132, 153,
  110. 223, 76, 203, 194, 52, 126, 118, 5, 109, 183, 169, 49, 209, 23, 4, 215,
  111. 20, 88, 58, 97, 222, 27, 17, 28, 50, 15, 156, 22, 83, 24, 242, 34,
  112. 254, 68, 207, 178, 195, 181, 122, 145, 36, 8, 232, 168, 96, 252, 105, 80,
  113. 170, 208, 160, 125, 161, 137, 98, 151, 84, 91, 30, 149, 224, 255, 100, 210,
  114. 16, 196, 0, 72, 163, 247, 117, 219, 138, 3, 230, 218, 9, 63, 221, 148,
  115. 135, 92, 131, 2, 205, 74, 144, 51, 115, 103, 246, 243, 157, 127, 191, 226,
  116. 82, 155, 216, 38, 200, 55, 198, 59, 129, 150, 111, 75, 19, 190, 99, 46,
  117. 233, 121, 167, 140, 159, 110, 188, 142, 41, 245, 249, 182, 47, 253, 180, 89,
  118. 120, 152, 6, 106, 231, 70, 113, 186, 212, 37, 171, 66, 136, 162, 141, 250,
  119. 114, 7, 185, 85, 248, 238, 172, 10, 54, 73, 42, 104, 60, 56, 241, 164,
  120. 64, 40, 211, 123, 187, 201, 67, 193, 21, 227, 173, 244, 119, 199, 128, 158
  121. };
  122. static const unsigned char FSb2[256] =
  123. {
  124. 224, 5, 88, 217, 103, 78, 129, 203, 201, 11, 174, 106, 213, 24, 93, 130,
  125. 70, 223, 214, 39, 138, 50, 75, 66, 219, 28, 158, 156, 58, 202, 37, 123,
  126. 13, 113, 95, 31, 248, 215, 62, 157, 124, 96, 185, 190, 188, 139, 22, 52,
  127. 77, 195, 114, 149, 171, 142, 186, 122, 179, 2, 180, 173, 162, 172, 216, 154,
  128. 23, 26, 53, 204, 247, 153, 97, 90, 232, 36, 86, 64, 225, 99, 9, 51,
  129. 191, 152, 151, 133, 104, 252, 236, 10, 218, 111, 83, 98, 163, 46, 8, 175,
  130. 40, 176, 116, 194, 189, 54, 34, 56, 100, 30, 57, 44, 166, 48, 229, 68,
  131. 253, 136, 159, 101, 135, 107, 244, 35, 72, 16, 209, 81, 192, 249, 210, 160,
  132. 85, 161, 65, 250, 67, 19, 196, 47, 168, 182, 60, 43, 193, 255, 200, 165,
  133. 32, 137, 0, 144, 71, 239, 234, 183, 21, 6, 205, 181, 18, 126, 187, 41,
  134. 15, 184, 7, 4, 155, 148, 33, 102, 230, 206, 237, 231, 59, 254, 127, 197,
  135. 164, 55, 177, 76, 145, 110, 141, 118, 3, 45, 222, 150, 38, 125, 198, 92,
  136. 211, 242, 79, 25, 63, 220, 121, 29, 82, 235, 243, 109, 94, 251, 105, 178,
  137. 240, 49, 12, 212, 207, 140, 226, 117, 169, 74, 87, 132, 17, 69, 27, 245,
  138. 228, 14, 115, 170, 241, 221, 89, 20, 108, 146, 84, 208, 120, 112, 227, 73,
  139. 128, 80, 167, 246, 119, 147, 134, 131, 42, 199, 91, 233, 238, 143, 1, 61
  140. };
  141. static const unsigned char FSb3[256] =
  142. {
  143. 56, 65, 22, 118, 217, 147, 96, 242, 114, 194, 171, 154, 117, 6, 87, 160,
  144. 145, 247, 181, 201, 162, 140, 210, 144, 246, 7, 167, 39, 142, 178, 73, 222,
  145. 67, 92, 215, 199, 62, 245, 143, 103, 31, 24, 110, 175, 47, 226, 133, 13,
  146. 83, 240, 156, 101, 234, 163, 174, 158, 236, 128, 45, 107, 168, 43, 54, 166,
  147. 197, 134, 77, 51, 253, 102, 88, 150, 58, 9, 149, 16, 120, 216, 66, 204,
  148. 239, 38, 229, 97, 26, 63, 59, 130, 182, 219, 212, 152, 232, 139, 2, 235,
  149. 10, 44, 29, 176, 111, 141, 136, 14, 25, 135, 78, 11, 169, 12, 121, 17,
  150. 127, 34, 231, 89, 225, 218, 61, 200, 18, 4, 116, 84, 48, 126, 180, 40,
  151. 85, 104, 80, 190, 208, 196, 49, 203, 42, 173, 15, 202, 112, 255, 50, 105,
  152. 8, 98, 0, 36, 209, 251, 186, 237, 69, 129, 115, 109, 132, 159, 238, 74,
  153. 195, 46, 193, 1, 230, 37, 72, 153, 185, 179, 123, 249, 206, 191, 223, 113,
  154. 41, 205, 108, 19, 100, 155, 99, 157, 192, 75, 183, 165, 137, 95, 177, 23,
  155. 244, 188, 211, 70, 207, 55, 94, 71, 148, 250, 252, 91, 151, 254, 90, 172,
  156. 60, 76, 3, 53, 243, 35, 184, 93, 106, 146, 213, 33, 68, 81, 198, 125,
  157. 57, 131, 220, 170, 124, 119, 86, 5, 27, 164, 21, 52, 30, 28, 248, 82,
  158. 32, 20, 233, 189, 221, 228, 161, 224, 138, 241, 214, 122, 187, 227, 64, 79
  159. };
  160. static const unsigned char FSb4[256] =
  161. {
  162. 112, 44, 179, 192, 228, 87, 234, 174, 35, 107, 69, 165, 237, 79, 29, 146,
  163. 134, 175, 124, 31, 62, 220, 94, 11, 166, 57, 213, 93, 217, 90, 81, 108,
  164. 139, 154, 251, 176, 116, 43, 240, 132, 223, 203, 52, 118, 109, 169, 209, 4,
  165. 20, 58, 222, 17, 50, 156, 83, 242, 254, 207, 195, 122, 36, 232, 96, 105,
  166. 170, 160, 161, 98, 84, 30, 224, 100, 16, 0, 163, 117, 138, 230, 9, 221,
  167. 135, 131, 205, 144, 115, 246, 157, 191, 82, 216, 200, 198, 129, 111, 19, 99,
  168. 233, 167, 159, 188, 41, 249, 47, 180, 120, 6, 231, 113, 212, 171, 136, 141,
  169. 114, 185, 248, 172, 54, 42, 60, 241, 64, 211, 187, 67, 21, 173, 119, 128,
  170. 130, 236, 39, 229, 133, 53, 12, 65, 239, 147, 25, 33, 14, 78, 101, 189,
  171. 184, 143, 235, 206, 48, 95, 197, 26, 225, 202, 71, 61, 1, 214, 86, 77,
  172. 13, 102, 204, 45, 18, 32, 177, 153, 76, 194, 126, 5, 183, 49, 23, 215,
  173. 88, 97, 27, 28, 15, 22, 24, 34, 68, 178, 181, 145, 8, 168, 252, 80,
  174. 208, 125, 137, 151, 91, 149, 255, 210, 196, 72, 247, 219, 3, 218, 63, 148,
  175. 92, 2, 74, 51, 103, 243, 127, 226, 155, 38, 55, 59, 150, 75, 190, 46,
  176. 121, 140, 110, 142, 245, 182, 253, 89, 152, 106, 70, 186, 37, 66, 162, 250,
  177. 7, 85, 238, 10, 73, 104, 56, 164, 40, 123, 201, 193, 227, 244, 199, 158
  178. };
  179. #define SBOX1(n) FSb[(n)]
  180. #define SBOX2(n) FSb2[(n)]
  181. #define SBOX3(n) FSb3[(n)]
  182. #define SBOX4(n) FSb4[(n)]
  183. #endif /* MBEDTLS_CAMELLIA_SMALL_MEMORY */
  184. static const unsigned char shifts[2][4][4] =
  185. {
  186. {
  187. { 1, 1, 1, 1 }, /* KL */
  188. { 0, 0, 0, 0 }, /* KR */
  189. { 1, 1, 1, 1 }, /* KA */
  190. { 0, 0, 0, 0 } /* KB */
  191. },
  192. {
  193. { 1, 0, 1, 1 }, /* KL */
  194. { 1, 1, 0, 1 }, /* KR */
  195. { 1, 1, 1, 0 }, /* KA */
  196. { 1, 1, 0, 1 } /* KB */
  197. }
  198. };
  199. static const signed char indexes[2][4][20] =
  200. {
  201. {
  202. { 0, 1, 2, 3, 8, 9, 10, 11, 38, 39,
  203. 36, 37, 23, 20, 21, 22, 27, -1, -1, 26 }, /* KL -> RK */
  204. { -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
  205. -1, -1, -1, -1, -1, -1, -1, -1, -1, -1 }, /* KR -> RK */
  206. { 4, 5, 6, 7, 12, 13, 14, 15, 16, 17,
  207. 18, 19, -1, 24, 25, -1, 31, 28, 29, 30 }, /* KA -> RK */
  208. { -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
  209. -1, -1, -1, -1, -1, -1, -1, -1, -1, -1 } /* KB -> RK */
  210. },
  211. {
  212. { 0, 1, 2, 3, 61, 62, 63, 60, -1, -1,
  213. -1, -1, 27, 24, 25, 26, 35, 32, 33, 34 }, /* KL -> RK */
  214. { -1, -1, -1, -1, 8, 9, 10, 11, 16, 17,
  215. 18, 19, -1, -1, -1, -1, 39, 36, 37, 38 }, /* KR -> RK */
  216. { -1, -1, -1, -1, 12, 13, 14, 15, 58, 59,
  217. 56, 57, 31, 28, 29, 30, -1, -1, -1, -1 }, /* KA -> RK */
  218. { 4, 5, 6, 7, 65, 66, 67, 64, 20, 21,
  219. 22, 23, -1, -1, -1, -1, 43, 40, 41, 42 } /* KB -> RK */
  220. }
  221. };
  222. static const signed char transposes[2][20] =
  223. {
  224. {
  225. 21, 22, 23, 20,
  226. -1, -1, -1, -1,
  227. 18, 19, 16, 17,
  228. 11, 8, 9, 10,
  229. 15, 12, 13, 14
  230. },
  231. {
  232. 25, 26, 27, 24,
  233. 29, 30, 31, 28,
  234. 18, 19, 16, 17,
  235. -1, -1, -1, -1,
  236. -1, -1, -1, -1
  237. }
  238. };
  239. /* Shift macro for 128 bit strings with rotation smaller than 32 bits (!) */
  240. #define ROTL(DEST, SRC, SHIFT) \
  241. { \
  242. (DEST)[0] = (SRC)[0] << (SHIFT) ^ (SRC)[1] >> (32 - (SHIFT)); \
  243. (DEST)[1] = (SRC)[1] << (SHIFT) ^ (SRC)[2] >> (32 - (SHIFT)); \
  244. (DEST)[2] = (SRC)[2] << (SHIFT) ^ (SRC)[3] >> (32 - (SHIFT)); \
  245. (DEST)[3] = (SRC)[3] << (SHIFT) ^ (SRC)[0] >> (32 - (SHIFT)); \
  246. }
  247. #define FL(XL, XR, KL, KR) \
  248. { \
  249. (XR) = ((((XL) & (KL)) << 1) | (((XL) & (KL)) >> 31)) ^ (XR); \
  250. (XL) = ((XR) | (KR)) ^ (XL); \
  251. }
  252. #define FLInv(YL, YR, KL, KR) \
  253. { \
  254. (YL) = ((YR) | (KR)) ^ (YL); \
  255. (YR) = ((((YL) & (KL)) << 1) | (((YL) & (KL)) >> 31)) ^ (YR); \
  256. }
  257. #define SHIFT_AND_PLACE(INDEX, OFFSET) \
  258. { \
  259. TK[0] = KC[(OFFSET) * 4 + 0]; \
  260. TK[1] = KC[(OFFSET) * 4 + 1]; \
  261. TK[2] = KC[(OFFSET) * 4 + 2]; \
  262. TK[3] = KC[(OFFSET) * 4 + 3]; \
  263. \
  264. for( i = 1; i <= 4; i++ ) \
  265. if( shifts[(INDEX)][(OFFSET)][i -1] ) \
  266. ROTL(TK + i * 4, TK, ( 15 * i ) % 32); \
  267. \
  268. for( i = 0; i < 20; i++ ) \
  269. if( indexes[(INDEX)][(OFFSET)][i] != -1 ) { \
  270. RK[indexes[(INDEX)][(OFFSET)][i]] = TK[ i ]; \
  271. } \
  272. }
  273. static void camellia_feistel( const uint32_t x[2], const uint32_t k[2],
  274. uint32_t z[2])
  275. {
  276. uint32_t I0, I1;
  277. I0 = x[0] ^ k[0];
  278. I1 = x[1] ^ k[1];
  279. I0 = ((uint32_t) SBOX1((I0 >> 24) & 0xFF) << 24) |
  280. ((uint32_t) SBOX2((I0 >> 16) & 0xFF) << 16) |
  281. ((uint32_t) SBOX3((I0 >> 8) & 0xFF) << 8) |
  282. ((uint32_t) SBOX4((I0 ) & 0xFF) );
  283. I1 = ((uint32_t) SBOX2((I1 >> 24) & 0xFF) << 24) |
  284. ((uint32_t) SBOX3((I1 >> 16) & 0xFF) << 16) |
  285. ((uint32_t) SBOX4((I1 >> 8) & 0xFF) << 8) |
  286. ((uint32_t) SBOX1((I1 ) & 0xFF) );
  287. I0 ^= (I1 << 8) | (I1 >> 24);
  288. I1 ^= (I0 << 16) | (I0 >> 16);
  289. I0 ^= (I1 >> 8) | (I1 << 24);
  290. I1 ^= (I0 >> 8) | (I0 << 24);
  291. z[0] ^= I1;
  292. z[1] ^= I0;
  293. }
  294. void mbedtls_camellia_init( mbedtls_camellia_context *ctx )
  295. {
  296. memset( ctx, 0, sizeof( mbedtls_camellia_context ) );
  297. }
  298. void mbedtls_camellia_free( mbedtls_camellia_context *ctx )
  299. {
  300. if( ctx == NULL )
  301. return;
  302. mbedtls_zeroize( ctx, sizeof( mbedtls_camellia_context ) );
  303. }
  304. /*
  305. * Camellia key schedule (encryption)
  306. */
  307. int mbedtls_camellia_setkey_enc( mbedtls_camellia_context *ctx, const unsigned char *key,
  308. unsigned int keybits )
  309. {
  310. int idx;
  311. size_t i;
  312. uint32_t *RK;
  313. unsigned char t[64];
  314. uint32_t SIGMA[6][2];
  315. uint32_t KC[16];
  316. uint32_t TK[20];
  317. RK = ctx->rk;
  318. memset( t, 0, 64 );
  319. memset( RK, 0, sizeof(ctx->rk) );
  320. switch( keybits )
  321. {
  322. case 128: ctx->nr = 3; idx = 0; break;
  323. case 192:
  324. case 256: ctx->nr = 4; idx = 1; break;
  325. default : return( MBEDTLS_ERR_CAMELLIA_INVALID_KEY_LENGTH );
  326. }
  327. for( i = 0; i < keybits / 8; ++i )
  328. t[i] = key[i];
  329. if( keybits == 192 ) {
  330. for( i = 0; i < 8; i++ )
  331. t[24 + i] = ~t[16 + i];
  332. }
  333. /*
  334. * Prepare SIGMA values
  335. */
  336. for( i = 0; i < 6; i++ ) {
  337. GET_UINT32_BE( SIGMA[i][0], SIGMA_CHARS[i], 0 );
  338. GET_UINT32_BE( SIGMA[i][1], SIGMA_CHARS[i], 4 );
  339. }
  340. /*
  341. * Key storage in KC
  342. * Order: KL, KR, KA, KB
  343. */
  344. memset( KC, 0, sizeof(KC) );
  345. /* Store KL, KR */
  346. for( i = 0; i < 8; i++ )
  347. GET_UINT32_BE( KC[i], t, i * 4 );
  348. /* Generate KA */
  349. for( i = 0; i < 4; ++i )
  350. KC[8 + i] = KC[i] ^ KC[4 + i];
  351. camellia_feistel( KC + 8, SIGMA[0], KC + 10 );
  352. camellia_feistel( KC + 10, SIGMA[1], KC + 8 );
  353. for( i = 0; i < 4; ++i )
  354. KC[8 + i] ^= KC[i];
  355. camellia_feistel( KC + 8, SIGMA[2], KC + 10 );
  356. camellia_feistel( KC + 10, SIGMA[3], KC + 8 );
  357. if( keybits > 128 ) {
  358. /* Generate KB */
  359. for( i = 0; i < 4; ++i )
  360. KC[12 + i] = KC[4 + i] ^ KC[8 + i];
  361. camellia_feistel( KC + 12, SIGMA[4], KC + 14 );
  362. camellia_feistel( KC + 14, SIGMA[5], KC + 12 );
  363. }
  364. /*
  365. * Generating subkeys
  366. */
  367. /* Manipulating KL */
  368. SHIFT_AND_PLACE( idx, 0 );
  369. /* Manipulating KR */
  370. if( keybits > 128 ) {
  371. SHIFT_AND_PLACE( idx, 1 );
  372. }
  373. /* Manipulating KA */
  374. SHIFT_AND_PLACE( idx, 2 );
  375. /* Manipulating KB */
  376. if( keybits > 128 ) {
  377. SHIFT_AND_PLACE( idx, 3 );
  378. }
  379. /* Do transpositions */
  380. for( i = 0; i < 20; i++ ) {
  381. if( transposes[idx][i] != -1 ) {
  382. RK[32 + 12 * idx + i] = RK[transposes[idx][i]];
  383. }
  384. }
  385. return( 0 );
  386. }
  387. /*
  388. * Camellia key schedule (decryption)
  389. */
  390. int mbedtls_camellia_setkey_dec( mbedtls_camellia_context *ctx, const unsigned char *key,
  391. unsigned int keybits )
  392. {
  393. int idx, ret;
  394. size_t i;
  395. mbedtls_camellia_context cty;
  396. uint32_t *RK;
  397. uint32_t *SK;
  398. mbedtls_camellia_init( &cty );
  399. /* Also checks keybits */
  400. if( ( ret = mbedtls_camellia_setkey_enc( &cty, key, keybits ) ) != 0 )
  401. goto exit;
  402. ctx->nr = cty.nr;
  403. idx = ( ctx->nr == 4 );
  404. RK = ctx->rk;
  405. SK = cty.rk + 24 * 2 + 8 * idx * 2;
  406. *RK++ = *SK++;
  407. *RK++ = *SK++;
  408. *RK++ = *SK++;
  409. *RK++ = *SK++;
  410. for( i = 22 + 8 * idx, SK -= 6; i > 0; i--, SK -= 4 )
  411. {
  412. *RK++ = *SK++;
  413. *RK++ = *SK++;
  414. }
  415. SK -= 2;
  416. *RK++ = *SK++;
  417. *RK++ = *SK++;
  418. *RK++ = *SK++;
  419. *RK++ = *SK++;
  420. exit:
  421. mbedtls_camellia_free( &cty );
  422. return( ret );
  423. }
  424. /*
  425. * Camellia-ECB block encryption/decryption
  426. */
  427. int mbedtls_camellia_crypt_ecb( mbedtls_camellia_context *ctx,
  428. int mode,
  429. const unsigned char input[16],
  430. unsigned char output[16] )
  431. {
  432. int NR;
  433. uint32_t *RK, X[4];
  434. ( (void) mode );
  435. NR = ctx->nr;
  436. RK = ctx->rk;
  437. GET_UINT32_BE( X[0], input, 0 );
  438. GET_UINT32_BE( X[1], input, 4 );
  439. GET_UINT32_BE( X[2], input, 8 );
  440. GET_UINT32_BE( X[3], input, 12 );
  441. X[0] ^= *RK++;
  442. X[1] ^= *RK++;
  443. X[2] ^= *RK++;
  444. X[3] ^= *RK++;
  445. while( NR ) {
  446. --NR;
  447. camellia_feistel( X, RK, X + 2 );
  448. RK += 2;
  449. camellia_feistel( X + 2, RK, X );
  450. RK += 2;
  451. camellia_feistel( X, RK, X + 2 );
  452. RK += 2;
  453. camellia_feistel( X + 2, RK, X );
  454. RK += 2;
  455. camellia_feistel( X, RK, X + 2 );
  456. RK += 2;
  457. camellia_feistel( X + 2, RK, X );
  458. RK += 2;
  459. if( NR ) {
  460. FL(X[0], X[1], RK[0], RK[1]);
  461. RK += 2;
  462. FLInv(X[2], X[3], RK[0], RK[1]);
  463. RK += 2;
  464. }
  465. }
  466. X[2] ^= *RK++;
  467. X[3] ^= *RK++;
  468. X[0] ^= *RK++;
  469. X[1] ^= *RK++;
  470. PUT_UINT32_BE( X[2], output, 0 );
  471. PUT_UINT32_BE( X[3], output, 4 );
  472. PUT_UINT32_BE( X[0], output, 8 );
  473. PUT_UINT32_BE( X[1], output, 12 );
  474. return( 0 );
  475. }
  476. #if defined(MBEDTLS_CIPHER_MODE_CBC)
  477. /*
  478. * Camellia-CBC buffer encryption/decryption
  479. */
  480. int mbedtls_camellia_crypt_cbc( mbedtls_camellia_context *ctx,
  481. int mode,
  482. size_t length,
  483. unsigned char iv[16],
  484. const unsigned char *input,
  485. unsigned char *output )
  486. {
  487. int i;
  488. unsigned char temp[16];
  489. if( length % 16 )
  490. return( MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH );
  491. if( mode == MBEDTLS_CAMELLIA_DECRYPT )
  492. {
  493. while( length > 0 )
  494. {
  495. memcpy( temp, input, 16 );
  496. mbedtls_camellia_crypt_ecb( ctx, mode, input, output );
  497. for( i = 0; i < 16; i++ )
  498. output[i] = (unsigned char)( output[i] ^ iv[i] );
  499. memcpy( iv, temp, 16 );
  500. input += 16;
  501. output += 16;
  502. length -= 16;
  503. }
  504. }
  505. else
  506. {
  507. while( length > 0 )
  508. {
  509. for( i = 0; i < 16; i++ )
  510. output[i] = (unsigned char)( input[i] ^ iv[i] );
  511. mbedtls_camellia_crypt_ecb( ctx, mode, output, output );
  512. memcpy( iv, output, 16 );
  513. input += 16;
  514. output += 16;
  515. length -= 16;
  516. }
  517. }
  518. return( 0 );
  519. }
  520. #endif /* MBEDTLS_CIPHER_MODE_CBC */
  521. #if defined(MBEDTLS_CIPHER_MODE_CFB)
  522. /*
  523. * Camellia-CFB128 buffer encryption/decryption
  524. */
  525. int mbedtls_camellia_crypt_cfb128( mbedtls_camellia_context *ctx,
  526. int mode,
  527. size_t length,
  528. size_t *iv_off,
  529. unsigned char iv[16],
  530. const unsigned char *input,
  531. unsigned char *output )
  532. {
  533. int c;
  534. size_t n = *iv_off;
  535. if( mode == MBEDTLS_CAMELLIA_DECRYPT )
  536. {
  537. while( length-- )
  538. {
  539. if( n == 0 )
  540. mbedtls_camellia_crypt_ecb( ctx, MBEDTLS_CAMELLIA_ENCRYPT, iv, iv );
  541. c = *input++;
  542. *output++ = (unsigned char)( c ^ iv[n] );
  543. iv[n] = (unsigned char) c;
  544. n = ( n + 1 ) & 0x0F;
  545. }
  546. }
  547. else
  548. {
  549. while( length-- )
  550. {
  551. if( n == 0 )
  552. mbedtls_camellia_crypt_ecb( ctx, MBEDTLS_CAMELLIA_ENCRYPT, iv, iv );
  553. iv[n] = *output++ = (unsigned char)( iv[n] ^ *input++ );
  554. n = ( n + 1 ) & 0x0F;
  555. }
  556. }
  557. *iv_off = n;
  558. return( 0 );
  559. }
  560. #endif /* MBEDTLS_CIPHER_MODE_CFB */
  561. #if defined(MBEDTLS_CIPHER_MODE_CTR)
  562. /*
  563. * Camellia-CTR buffer encryption/decryption
  564. */
  565. int mbedtls_camellia_crypt_ctr( mbedtls_camellia_context *ctx,
  566. size_t length,
  567. size_t *nc_off,
  568. unsigned char nonce_counter[16],
  569. unsigned char stream_block[16],
  570. const unsigned char *input,
  571. unsigned char *output )
  572. {
  573. int c, i;
  574. size_t n = *nc_off;
  575. while( length-- )
  576. {
  577. if( n == 0 ) {
  578. mbedtls_camellia_crypt_ecb( ctx, MBEDTLS_CAMELLIA_ENCRYPT, nonce_counter,
  579. stream_block );
  580. for( i = 16; i > 0; i-- )
  581. if( ++nonce_counter[i - 1] != 0 )
  582. break;
  583. }
  584. c = *input++;
  585. *output++ = (unsigned char)( c ^ stream_block[n] );
  586. n = ( n + 1 ) & 0x0F;
  587. }
  588. *nc_off = n;
  589. return( 0 );
  590. }
  591. #endif /* MBEDTLS_CIPHER_MODE_CTR */
  592. #endif /* !MBEDTLS_CAMELLIA_ALT */
  593. #if defined(MBEDTLS_SELF_TEST)
  594. /*
  595. * Camellia test vectors from:
  596. *
  597. * http://info.isl.ntt.co.jp/crypt/eng/camellia/technology.html:
  598. * http://info.isl.ntt.co.jp/crypt/eng/camellia/dl/cryptrec/intermediate.txt
  599. * http://info.isl.ntt.co.jp/crypt/eng/camellia/dl/cryptrec/t_camellia.txt
  600. * (For each bitlength: Key 0, Nr 39)
  601. */
  602. #define CAMELLIA_TESTS_ECB 2
  603. static const unsigned char camellia_test_ecb_key[3][CAMELLIA_TESTS_ECB][32] =
  604. {
  605. {
  606. { 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef,
  607. 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10 },
  608. { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  609. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }
  610. },
  611. {
  612. { 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef,
  613. 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10,
  614. 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77 },
  615. { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  616. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  617. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }
  618. },
  619. {
  620. { 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef,
  621. 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10,
  622. 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77,
  623. 0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff },
  624. { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  625. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  626. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  627. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }
  628. },
  629. };
  630. static const unsigned char camellia_test_ecb_plain[CAMELLIA_TESTS_ECB][16] =
  631. {
  632. { 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef,
  633. 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10 },
  634. { 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
  635. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }
  636. };
  637. static const unsigned char camellia_test_ecb_cipher[3][CAMELLIA_TESTS_ECB][16] =
  638. {
  639. {
  640. { 0x67, 0x67, 0x31, 0x38, 0x54, 0x96, 0x69, 0x73,
  641. 0x08, 0x57, 0x06, 0x56, 0x48, 0xea, 0xbe, 0x43 },
  642. { 0x38, 0x3C, 0x6C, 0x2A, 0xAB, 0xEF, 0x7F, 0xDE,
  643. 0x25, 0xCD, 0x47, 0x0B, 0xF7, 0x74, 0xA3, 0x31 }
  644. },
  645. {
  646. { 0xb4, 0x99, 0x34, 0x01, 0xb3, 0xe9, 0x96, 0xf8,
  647. 0x4e, 0xe5, 0xce, 0xe7, 0xd7, 0x9b, 0x09, 0xb9 },
  648. { 0xD1, 0x76, 0x3F, 0xC0, 0x19, 0xD7, 0x7C, 0xC9,
  649. 0x30, 0xBF, 0xF2, 0xA5, 0x6F, 0x7C, 0x93, 0x64 }
  650. },
  651. {
  652. { 0x9a, 0xcc, 0x23, 0x7d, 0xff, 0x16, 0xd7, 0x6c,
  653. 0x20, 0xef, 0x7c, 0x91, 0x9e, 0x3a, 0x75, 0x09 },
  654. { 0x05, 0x03, 0xFB, 0x10, 0xAB, 0x24, 0x1E, 0x7C,
  655. 0xF4, 0x5D, 0x8C, 0xDE, 0xEE, 0x47, 0x43, 0x35 }
  656. }
  657. };
  658. #if defined(MBEDTLS_CIPHER_MODE_CBC)
  659. #define CAMELLIA_TESTS_CBC 3
  660. static const unsigned char camellia_test_cbc_key[3][32] =
  661. {
  662. { 0x2B, 0x7E, 0x15, 0x16, 0x28, 0xAE, 0xD2, 0xA6,
  663. 0xAB, 0xF7, 0x15, 0x88, 0x09, 0xCF, 0x4F, 0x3C }
  664. ,
  665. { 0x8E, 0x73, 0xB0, 0xF7, 0xDA, 0x0E, 0x64, 0x52,
  666. 0xC8, 0x10, 0xF3, 0x2B, 0x80, 0x90, 0x79, 0xE5,
  667. 0x62, 0xF8, 0xEA, 0xD2, 0x52, 0x2C, 0x6B, 0x7B }
  668. ,
  669. { 0x60, 0x3D, 0xEB, 0x10, 0x15, 0xCA, 0x71, 0xBE,
  670. 0x2B, 0x73, 0xAE, 0xF0, 0x85, 0x7D, 0x77, 0x81,
  671. 0x1F, 0x35, 0x2C, 0x07, 0x3B, 0x61, 0x08, 0xD7,
  672. 0x2D, 0x98, 0x10, 0xA3, 0x09, 0x14, 0xDF, 0xF4 }
  673. };
  674. static const unsigned char camellia_test_cbc_iv[16] =
  675. { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
  676. 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F }
  677. ;
  678. static const unsigned char camellia_test_cbc_plain[CAMELLIA_TESTS_CBC][16] =
  679. {
  680. { 0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96,
  681. 0xE9, 0x3D, 0x7E, 0x11, 0x73, 0x93, 0x17, 0x2A },
  682. { 0xAE, 0x2D, 0x8A, 0x57, 0x1E, 0x03, 0xAC, 0x9C,
  683. 0x9E, 0xB7, 0x6F, 0xAC, 0x45, 0xAF, 0x8E, 0x51 },
  684. { 0x30, 0xC8, 0x1C, 0x46, 0xA3, 0x5C, 0xE4, 0x11,
  685. 0xE5, 0xFB, 0xC1, 0x19, 0x1A, 0x0A, 0x52, 0xEF }
  686. };
  687. static const unsigned char camellia_test_cbc_cipher[3][CAMELLIA_TESTS_CBC][16] =
  688. {
  689. {
  690. { 0x16, 0x07, 0xCF, 0x49, 0x4B, 0x36, 0xBB, 0xF0,
  691. 0x0D, 0xAE, 0xB0, 0xB5, 0x03, 0xC8, 0x31, 0xAB },
  692. { 0xA2, 0xF2, 0xCF, 0x67, 0x16, 0x29, 0xEF, 0x78,
  693. 0x40, 0xC5, 0xA5, 0xDF, 0xB5, 0x07, 0x48, 0x87 },
  694. { 0x0F, 0x06, 0x16, 0x50, 0x08, 0xCF, 0x8B, 0x8B,
  695. 0x5A, 0x63, 0x58, 0x63, 0x62, 0x54, 0x3E, 0x54 }
  696. },
  697. {
  698. { 0x2A, 0x48, 0x30, 0xAB, 0x5A, 0xC4, 0xA1, 0xA2,
  699. 0x40, 0x59, 0x55, 0xFD, 0x21, 0x95, 0xCF, 0x93 },
  700. { 0x5D, 0x5A, 0x86, 0x9B, 0xD1, 0x4C, 0xE5, 0x42,
  701. 0x64, 0xF8, 0x92, 0xA6, 0xDD, 0x2E, 0xC3, 0xD5 },
  702. { 0x37, 0xD3, 0x59, 0xC3, 0x34, 0x98, 0x36, 0xD8,
  703. 0x84, 0xE3, 0x10, 0xAD, 0xDF, 0x68, 0xC4, 0x49 }
  704. },
  705. {
  706. { 0xE6, 0xCF, 0xA3, 0x5F, 0xC0, 0x2B, 0x13, 0x4A,
  707. 0x4D, 0x2C, 0x0B, 0x67, 0x37, 0xAC, 0x3E, 0xDA },
  708. { 0x36, 0xCB, 0xEB, 0x73, 0xBD, 0x50, 0x4B, 0x40,
  709. 0x70, 0xB1, 0xB7, 0xDE, 0x2B, 0x21, 0xEB, 0x50 },
  710. { 0xE3, 0x1A, 0x60, 0x55, 0x29, 0x7D, 0x96, 0xCA,
  711. 0x33, 0x30, 0xCD, 0xF1, 0xB1, 0x86, 0x0A, 0x83 }
  712. }
  713. };
  714. #endif /* MBEDTLS_CIPHER_MODE_CBC */
  715. #if defined(MBEDTLS_CIPHER_MODE_CTR)
  716. /*
  717. * Camellia-CTR test vectors from:
  718. *
  719. * http://www.faqs.org/rfcs/rfc5528.html
  720. */
  721. static const unsigned char camellia_test_ctr_key[3][16] =
  722. {
  723. { 0xAE, 0x68, 0x52, 0xF8, 0x12, 0x10, 0x67, 0xCC,
  724. 0x4B, 0xF7, 0xA5, 0x76, 0x55, 0x77, 0xF3, 0x9E },
  725. { 0x7E, 0x24, 0x06, 0x78, 0x17, 0xFA, 0xE0, 0xD7,
  726. 0x43, 0xD6, 0xCE, 0x1F, 0x32, 0x53, 0x91, 0x63 },
  727. { 0x76, 0x91, 0xBE, 0x03, 0x5E, 0x50, 0x20, 0xA8,
  728. 0xAC, 0x6E, 0x61, 0x85, 0x29, 0xF9, 0xA0, 0xDC }
  729. };
  730. static const unsigned char camellia_test_ctr_nonce_counter[3][16] =
  731. {
  732. { 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x00,
  733. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 },
  734. { 0x00, 0x6C, 0xB6, 0xDB, 0xC0, 0x54, 0x3B, 0x59,
  735. 0xDA, 0x48, 0xD9, 0x0B, 0x00, 0x00, 0x00, 0x01 },
  736. { 0x00, 0xE0, 0x01, 0x7B, 0x27, 0x77, 0x7F, 0x3F,
  737. 0x4A, 0x17, 0x86, 0xF0, 0x00, 0x00, 0x00, 0x01 }
  738. };
  739. static const unsigned char camellia_test_ctr_pt[3][48] =
  740. {
  741. { 0x53, 0x69, 0x6E, 0x67, 0x6C, 0x65, 0x20, 0x62,
  742. 0x6C, 0x6F, 0x63, 0x6B, 0x20, 0x6D, 0x73, 0x67 },
  743. { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
  744. 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
  745. 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
  746. 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F },
  747. { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
  748. 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
  749. 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
  750. 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F,
  751. 0x20, 0x21, 0x22, 0x23 }
  752. };
  753. static const unsigned char camellia_test_ctr_ct[3][48] =
  754. {
  755. { 0xD0, 0x9D, 0xC2, 0x9A, 0x82, 0x14, 0x61, 0x9A,
  756. 0x20, 0x87, 0x7C, 0x76, 0xDB, 0x1F, 0x0B, 0x3F },
  757. { 0xDB, 0xF3, 0xC7, 0x8D, 0xC0, 0x83, 0x96, 0xD4,
  758. 0xDA, 0x7C, 0x90, 0x77, 0x65, 0xBB, 0xCB, 0x44,
  759. 0x2B, 0x8E, 0x8E, 0x0F, 0x31, 0xF0, 0xDC, 0xA7,
  760. 0x2C, 0x74, 0x17, 0xE3, 0x53, 0x60, 0xE0, 0x48 },
  761. { 0xB1, 0x9D, 0x1F, 0xCD, 0xCB, 0x75, 0xEB, 0x88,
  762. 0x2F, 0x84, 0x9C, 0xE2, 0x4D, 0x85, 0xCF, 0x73,
  763. 0x9C, 0xE6, 0x4B, 0x2B, 0x5C, 0x9D, 0x73, 0xF1,
  764. 0x4F, 0x2D, 0x5D, 0x9D, 0xCE, 0x98, 0x89, 0xCD,
  765. 0xDF, 0x50, 0x86, 0x96 }
  766. };
  767. static const int camellia_test_ctr_len[3] =
  768. { 16, 32, 36 };
  769. #endif /* MBEDTLS_CIPHER_MODE_CTR */
  770. /*
  771. * Checkup routine
  772. */
  773. int mbedtls_camellia_self_test( int verbose )
  774. {
  775. int i, j, u, v;
  776. unsigned char key[32];
  777. unsigned char buf[64];
  778. unsigned char src[16];
  779. unsigned char dst[16];
  780. #if defined(MBEDTLS_CIPHER_MODE_CBC)
  781. unsigned char iv[16];
  782. #endif
  783. #if defined(MBEDTLS_CIPHER_MODE_CTR)
  784. size_t offset, len;
  785. unsigned char nonce_counter[16];
  786. unsigned char stream_block[16];
  787. #endif
  788. mbedtls_camellia_context ctx;
  789. memset( key, 0, 32 );
  790. for( j = 0; j < 6; j++ ) {
  791. u = j >> 1;
  792. v = j & 1;
  793. if( verbose != 0 )
  794. mbedtls_printf( " CAMELLIA-ECB-%3d (%s): ", 128 + u * 64,
  795. (v == MBEDTLS_CAMELLIA_DECRYPT) ? "dec" : "enc");
  796. for( i = 0; i < CAMELLIA_TESTS_ECB; i++ ) {
  797. memcpy( key, camellia_test_ecb_key[u][i], 16 + 8 * u );
  798. if( v == MBEDTLS_CAMELLIA_DECRYPT ) {
  799. mbedtls_camellia_setkey_dec( &ctx, key, 128 + u * 64 );
  800. memcpy( src, camellia_test_ecb_cipher[u][i], 16 );
  801. memcpy( dst, camellia_test_ecb_plain[i], 16 );
  802. } else { /* MBEDTLS_CAMELLIA_ENCRYPT */
  803. mbedtls_camellia_setkey_enc( &ctx, key, 128 + u * 64 );
  804. memcpy( src, camellia_test_ecb_plain[i], 16 );
  805. memcpy( dst, camellia_test_ecb_cipher[u][i], 16 );
  806. }
  807. mbedtls_camellia_crypt_ecb( &ctx, v, src, buf );
  808. if( memcmp( buf, dst, 16 ) != 0 )
  809. {
  810. if( verbose != 0 )
  811. mbedtls_printf( "failed\n" );
  812. return( 1 );
  813. }
  814. }
  815. if( verbose != 0 )
  816. mbedtls_printf( "passed\n" );
  817. }
  818. if( verbose != 0 )
  819. mbedtls_printf( "\n" );
  820. #if defined(MBEDTLS_CIPHER_MODE_CBC)
  821. /*
  822. * CBC mode
  823. */
  824. for( j = 0; j < 6; j++ )
  825. {
  826. u = j >> 1;
  827. v = j & 1;
  828. if( verbose != 0 )
  829. mbedtls_printf( " CAMELLIA-CBC-%3d (%s): ", 128 + u * 64,
  830. ( v == MBEDTLS_CAMELLIA_DECRYPT ) ? "dec" : "enc" );
  831. memcpy( src, camellia_test_cbc_iv, 16 );
  832. memcpy( dst, camellia_test_cbc_iv, 16 );
  833. memcpy( key, camellia_test_cbc_key[u], 16 + 8 * u );
  834. if( v == MBEDTLS_CAMELLIA_DECRYPT ) {
  835. mbedtls_camellia_setkey_dec( &ctx, key, 128 + u * 64 );
  836. } else {
  837. mbedtls_camellia_setkey_enc( &ctx, key, 128 + u * 64 );
  838. }
  839. for( i = 0; i < CAMELLIA_TESTS_CBC; i++ ) {
  840. if( v == MBEDTLS_CAMELLIA_DECRYPT ) {
  841. memcpy( iv , src, 16 );
  842. memcpy( src, camellia_test_cbc_cipher[u][i], 16 );
  843. memcpy( dst, camellia_test_cbc_plain[i], 16 );
  844. } else { /* MBEDTLS_CAMELLIA_ENCRYPT */
  845. memcpy( iv , dst, 16 );
  846. memcpy( src, camellia_test_cbc_plain[i], 16 );
  847. memcpy( dst, camellia_test_cbc_cipher[u][i], 16 );
  848. }
  849. mbedtls_camellia_crypt_cbc( &ctx, v, 16, iv, src, buf );
  850. if( memcmp( buf, dst, 16 ) != 0 )
  851. {
  852. if( verbose != 0 )
  853. mbedtls_printf( "failed\n" );
  854. return( 1 );
  855. }
  856. }
  857. if( verbose != 0 )
  858. mbedtls_printf( "passed\n" );
  859. }
  860. #endif /* MBEDTLS_CIPHER_MODE_CBC */
  861. if( verbose != 0 )
  862. mbedtls_printf( "\n" );
  863. #if defined(MBEDTLS_CIPHER_MODE_CTR)
  864. /*
  865. * CTR mode
  866. */
  867. for( i = 0; i < 6; i++ )
  868. {
  869. u = i >> 1;
  870. v = i & 1;
  871. if( verbose != 0 )
  872. mbedtls_printf( " CAMELLIA-CTR-128 (%s): ",
  873. ( v == MBEDTLS_CAMELLIA_DECRYPT ) ? "dec" : "enc" );
  874. memcpy( nonce_counter, camellia_test_ctr_nonce_counter[u], 16 );
  875. memcpy( key, camellia_test_ctr_key[u], 16 );
  876. offset = 0;
  877. mbedtls_camellia_setkey_enc( &ctx, key, 128 );
  878. if( v == MBEDTLS_CAMELLIA_DECRYPT )
  879. {
  880. len = camellia_test_ctr_len[u];
  881. memcpy( buf, camellia_test_ctr_ct[u], len );
  882. mbedtls_camellia_crypt_ctr( &ctx, len, &offset, nonce_counter, stream_block,
  883. buf, buf );
  884. if( memcmp( buf, camellia_test_ctr_pt[u], len ) != 0 )
  885. {
  886. if( verbose != 0 )
  887. mbedtls_printf( "failed\n" );
  888. return( 1 );
  889. }
  890. }
  891. else
  892. {
  893. len = camellia_test_ctr_len[u];
  894. memcpy( buf, camellia_test_ctr_pt[u], len );
  895. mbedtls_camellia_crypt_ctr( &ctx, len, &offset, nonce_counter, stream_block,
  896. buf, buf );
  897. if( memcmp( buf, camellia_test_ctr_ct[u], len ) != 0 )
  898. {
  899. if( verbose != 0 )
  900. mbedtls_printf( "failed\n" );
  901. return( 1 );
  902. }
  903. }
  904. if( verbose != 0 )
  905. mbedtls_printf( "passed\n" );
  906. }
  907. if( verbose != 0 )
  908. mbedtls_printf( "\n" );
  909. #endif /* MBEDTLS_CIPHER_MODE_CTR */
  910. return( 0 );
  911. }
  912. #endif /* MBEDTLS_SELF_TEST */
  913. #endif /* MBEDTLS_CAMELLIA_C */