serpent_generic.c 21 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * Cryptographic API.
  4. *
  5. * Serpent Cipher Algorithm.
  6. *
  7. * Copyright (C) 2002 Dag Arne Osvik <osvik@ii.uib.no>
  8. * 2003 Herbert Valerio Riedel <hvr@gnu.org>
  9. *
  10. * Added tnepres support:
  11. * Ruben Jesus Garcia Hernandez <ruben@ugr.es>, 18.10.2004
  12. * Based on code by hvr
  13. */
  14. #include <linux/init.h>
  15. #include <linux/module.h>
  16. #include <linux/errno.h>
  17. #include <asm/byteorder.h>
  18. #include <linux/crypto.h>
  19. #include <linux/types.h>
  20. #include <crypto/serpent.h>
  21. /* Key is padded to the maximum of 256 bits before round key generation.
  22. * Any key length <= 256 bits (32 bytes) is allowed by the algorithm.
  23. */
  24. #define PHI 0x9e3779b9UL
  25. #define keyiter(a, b, c, d, i, j) \
  26. ({ b ^= d; b ^= c; b ^= a; b ^= PHI ^ i; b = rol32(b, 11); k[j] = b; })
  27. #define loadkeys(x0, x1, x2, x3, i) \
  28. ({ x0 = k[i]; x1 = k[i+1]; x2 = k[i+2]; x3 = k[i+3]; })
  29. #define storekeys(x0, x1, x2, x3, i) \
  30. ({ k[i] = x0; k[i+1] = x1; k[i+2] = x2; k[i+3] = x3; })
  31. #define store_and_load_keys(x0, x1, x2, x3, s, l) \
  32. ({ storekeys(x0, x1, x2, x3, s); loadkeys(x0, x1, x2, x3, l); })
  33. #define K(x0, x1, x2, x3, i) ({ \
  34. x3 ^= k[4*(i)+3]; x2 ^= k[4*(i)+2]; \
  35. x1 ^= k[4*(i)+1]; x0 ^= k[4*(i)+0]; \
  36. })
  37. #define LK(x0, x1, x2, x3, x4, i) ({ \
  38. x0 = rol32(x0, 13);\
  39. x2 = rol32(x2, 3); x1 ^= x0; x4 = x0 << 3; \
  40. x3 ^= x2; x1 ^= x2; \
  41. x1 = rol32(x1, 1); x3 ^= x4; \
  42. x3 = rol32(x3, 7); x4 = x1; \
  43. x0 ^= x1; x4 <<= 7; x2 ^= x3; \
  44. x0 ^= x3; x2 ^= x4; x3 ^= k[4*i+3]; \
  45. x1 ^= k[4*i+1]; x0 = rol32(x0, 5); x2 = rol32(x2, 22);\
  46. x0 ^= k[4*i+0]; x2 ^= k[4*i+2]; \
  47. })
  48. #define KL(x0, x1, x2, x3, x4, i) ({ \
  49. x0 ^= k[4*i+0]; x1 ^= k[4*i+1]; x2 ^= k[4*i+2]; \
  50. x3 ^= k[4*i+3]; x0 = ror32(x0, 5); x2 = ror32(x2, 22);\
  51. x4 = x1; x2 ^= x3; x0 ^= x3; \
  52. x4 <<= 7; x0 ^= x1; x1 = ror32(x1, 1); \
  53. x2 ^= x4; x3 = ror32(x3, 7); x4 = x0 << 3; \
  54. x1 ^= x0; x3 ^= x4; x0 = ror32(x0, 13);\
  55. x1 ^= x2; x3 ^= x2; x2 = ror32(x2, 3); \
  56. })
  57. #define S0(x0, x1, x2, x3, x4) ({ \
  58. x4 = x3; \
  59. x3 |= x0; x0 ^= x4; x4 ^= x2; \
  60. x4 = ~x4; x3 ^= x1; x1 &= x0; \
  61. x1 ^= x4; x2 ^= x0; x0 ^= x3; \
  62. x4 |= x0; x0 ^= x2; x2 &= x1; \
  63. x3 ^= x2; x1 = ~x1; x2 ^= x4; \
  64. x1 ^= x2; \
  65. })
  66. #define S1(x0, x1, x2, x3, x4) ({ \
  67. x4 = x1; \
  68. x1 ^= x0; x0 ^= x3; x3 = ~x3; \
  69. x4 &= x1; x0 |= x1; x3 ^= x2; \
  70. x0 ^= x3; x1 ^= x3; x3 ^= x4; \
  71. x1 |= x4; x4 ^= x2; x2 &= x0; \
  72. x2 ^= x1; x1 |= x0; x0 = ~x0; \
  73. x0 ^= x2; x4 ^= x1; \
  74. })
  75. #define S2(x0, x1, x2, x3, x4) ({ \
  76. x3 = ~x3; \
  77. x1 ^= x0; x4 = x0; x0 &= x2; \
  78. x0 ^= x3; x3 |= x4; x2 ^= x1; \
  79. x3 ^= x1; x1 &= x0; x0 ^= x2; \
  80. x2 &= x3; x3 |= x1; x0 = ~x0; \
  81. x3 ^= x0; x4 ^= x0; x0 ^= x2; \
  82. x1 |= x2; \
  83. })
  84. #define S3(x0, x1, x2, x3, x4) ({ \
  85. x4 = x1; \
  86. x1 ^= x3; x3 |= x0; x4 &= x0; \
  87. x0 ^= x2; x2 ^= x1; x1 &= x3; \
  88. x2 ^= x3; x0 |= x4; x4 ^= x3; \
  89. x1 ^= x0; x0 &= x3; x3 &= x4; \
  90. x3 ^= x2; x4 |= x1; x2 &= x1; \
  91. x4 ^= x3; x0 ^= x3; x3 ^= x2; \
  92. })
  93. #define S4(x0, x1, x2, x3, x4) ({ \
  94. x4 = x3; \
  95. x3 &= x0; x0 ^= x4; \
  96. x3 ^= x2; x2 |= x4; x0 ^= x1; \
  97. x4 ^= x3; x2 |= x0; \
  98. x2 ^= x1; x1 &= x0; \
  99. x1 ^= x4; x4 &= x2; x2 ^= x3; \
  100. x4 ^= x0; x3 |= x1; x1 = ~x1; \
  101. x3 ^= x0; \
  102. })
  103. #define S5(x0, x1, x2, x3, x4) ({ \
  104. x4 = x1; x1 |= x0; \
  105. x2 ^= x1; x3 = ~x3; x4 ^= x0; \
  106. x0 ^= x2; x1 &= x4; x4 |= x3; \
  107. x4 ^= x0; x0 &= x3; x1 ^= x3; \
  108. x3 ^= x2; x0 ^= x1; x2 &= x4; \
  109. x1 ^= x2; x2 &= x0; \
  110. x3 ^= x2; \
  111. })
  112. #define S6(x0, x1, x2, x3, x4) ({ \
  113. x4 = x1; \
  114. x3 ^= x0; x1 ^= x2; x2 ^= x0; \
  115. x0 &= x3; x1 |= x3; x4 = ~x4; \
  116. x0 ^= x1; x1 ^= x2; \
  117. x3 ^= x4; x4 ^= x0; x2 &= x0; \
  118. x4 ^= x1; x2 ^= x3; x3 &= x1; \
  119. x3 ^= x0; x1 ^= x2; \
  120. })
  121. #define S7(x0, x1, x2, x3, x4) ({ \
  122. x1 = ~x1; \
  123. x4 = x1; x0 = ~x0; x1 &= x2; \
  124. x1 ^= x3; x3 |= x4; x4 ^= x2; \
  125. x2 ^= x3; x3 ^= x0; x0 |= x1; \
  126. x2 &= x0; x0 ^= x4; x4 ^= x3; \
  127. x3 &= x0; x4 ^= x1; \
  128. x2 ^= x4; x3 ^= x1; x4 |= x0; \
  129. x4 ^= x1; \
  130. })
  131. #define SI0(x0, x1, x2, x3, x4) ({ \
  132. x4 = x3; x1 ^= x0; \
  133. x3 |= x1; x4 ^= x1; x0 = ~x0; \
  134. x2 ^= x3; x3 ^= x0; x0 &= x1; \
  135. x0 ^= x2; x2 &= x3; x3 ^= x4; \
  136. x2 ^= x3; x1 ^= x3; x3 &= x0; \
  137. x1 ^= x0; x0 ^= x2; x4 ^= x3; \
  138. })
  139. #define SI1(x0, x1, x2, x3, x4) ({ \
  140. x1 ^= x3; x4 = x0; \
  141. x0 ^= x2; x2 = ~x2; x4 |= x1; \
  142. x4 ^= x3; x3 &= x1; x1 ^= x2; \
  143. x2 &= x4; x4 ^= x1; x1 |= x3; \
  144. x3 ^= x0; x2 ^= x0; x0 |= x4; \
  145. x2 ^= x4; x1 ^= x0; \
  146. x4 ^= x1; \
  147. })
  148. #define SI2(x0, x1, x2, x3, x4) ({ \
  149. x2 ^= x1; x4 = x3; x3 = ~x3; \
  150. x3 |= x2; x2 ^= x4; x4 ^= x0; \
  151. x3 ^= x1; x1 |= x2; x2 ^= x0; \
  152. x1 ^= x4; x4 |= x3; x2 ^= x3; \
  153. x4 ^= x2; x2 &= x1; \
  154. x2 ^= x3; x3 ^= x4; x4 ^= x0; \
  155. })
  156. #define SI3(x0, x1, x2, x3, x4) ({ \
  157. x2 ^= x1; \
  158. x4 = x1; x1 &= x2; \
  159. x1 ^= x0; x0 |= x4; x4 ^= x3; \
  160. x0 ^= x3; x3 |= x1; x1 ^= x2; \
  161. x1 ^= x3; x0 ^= x2; x2 ^= x3; \
  162. x3 &= x1; x1 ^= x0; x0 &= x2; \
  163. x4 ^= x3; x3 ^= x0; x0 ^= x1; \
  164. })
  165. #define SI4(x0, x1, x2, x3, x4) ({ \
  166. x2 ^= x3; x4 = x0; x0 &= x1; \
  167. x0 ^= x2; x2 |= x3; x4 = ~x4; \
  168. x1 ^= x0; x0 ^= x2; x2 &= x4; \
  169. x2 ^= x0; x0 |= x4; \
  170. x0 ^= x3; x3 &= x2; \
  171. x4 ^= x3; x3 ^= x1; x1 &= x0; \
  172. x4 ^= x1; x0 ^= x3; \
  173. })
  174. #define SI5(x0, x1, x2, x3, x4) ({ \
  175. x4 = x1; x1 |= x2; \
  176. x2 ^= x4; x1 ^= x3; x3 &= x4; \
  177. x2 ^= x3; x3 |= x0; x0 = ~x0; \
  178. x3 ^= x2; x2 |= x0; x4 ^= x1; \
  179. x2 ^= x4; x4 &= x0; x0 ^= x1; \
  180. x1 ^= x3; x0 &= x2; x2 ^= x3; \
  181. x0 ^= x2; x2 ^= x4; x4 ^= x3; \
  182. })
  183. #define SI6(x0, x1, x2, x3, x4) ({ \
  184. x0 ^= x2; \
  185. x4 = x0; x0 &= x3; x2 ^= x3; \
  186. x0 ^= x2; x3 ^= x1; x2 |= x4; \
  187. x2 ^= x3; x3 &= x0; x0 = ~x0; \
  188. x3 ^= x1; x1 &= x2; x4 ^= x0; \
  189. x3 ^= x4; x4 ^= x2; x0 ^= x1; \
  190. x2 ^= x0; \
  191. })
  192. #define SI7(x0, x1, x2, x3, x4) ({ \
  193. x4 = x3; x3 &= x0; x0 ^= x2; \
  194. x2 |= x4; x4 ^= x1; x0 = ~x0; \
  195. x1 |= x3; x4 ^= x0; x0 &= x2; \
  196. x0 ^= x1; x1 &= x2; x3 ^= x2; \
  197. x4 ^= x3; x2 &= x3; x3 |= x0; \
  198. x1 ^= x4; x3 ^= x4; x4 &= x0; \
  199. x4 ^= x2; \
  200. })
  201. /*
  202. * both gcc and clang have misoptimized this function in the past,
  203. * producing horrible object code from spilling temporary variables
  204. * on the stack. Forcing this part out of line avoids that.
  205. */
  206. static noinline void __serpent_setkey_sbox(u32 r0, u32 r1, u32 r2,
  207. u32 r3, u32 r4, u32 *k)
  208. {
  209. k += 100;
  210. S3(r3, r4, r0, r1, r2); store_and_load_keys(r1, r2, r4, r3, 28, 24);
  211. S4(r1, r2, r4, r3, r0); store_and_load_keys(r2, r4, r3, r0, 24, 20);
  212. S5(r2, r4, r3, r0, r1); store_and_load_keys(r1, r2, r4, r0, 20, 16);
  213. S6(r1, r2, r4, r0, r3); store_and_load_keys(r4, r3, r2, r0, 16, 12);
  214. S7(r4, r3, r2, r0, r1); store_and_load_keys(r1, r2, r0, r4, 12, 8);
  215. S0(r1, r2, r0, r4, r3); store_and_load_keys(r0, r2, r4, r1, 8, 4);
  216. S1(r0, r2, r4, r1, r3); store_and_load_keys(r3, r4, r1, r0, 4, 0);
  217. S2(r3, r4, r1, r0, r2); store_and_load_keys(r2, r4, r3, r0, 0, -4);
  218. S3(r2, r4, r3, r0, r1); store_and_load_keys(r0, r1, r4, r2, -4, -8);
  219. S4(r0, r1, r4, r2, r3); store_and_load_keys(r1, r4, r2, r3, -8, -12);
  220. S5(r1, r4, r2, r3, r0); store_and_load_keys(r0, r1, r4, r3, -12, -16);
  221. S6(r0, r1, r4, r3, r2); store_and_load_keys(r4, r2, r1, r3, -16, -20);
  222. S7(r4, r2, r1, r3, r0); store_and_load_keys(r0, r1, r3, r4, -20, -24);
  223. S0(r0, r1, r3, r4, r2); store_and_load_keys(r3, r1, r4, r0, -24, -28);
  224. k -= 50;
  225. S1(r3, r1, r4, r0, r2); store_and_load_keys(r2, r4, r0, r3, 22, 18);
  226. S2(r2, r4, r0, r3, r1); store_and_load_keys(r1, r4, r2, r3, 18, 14);
  227. S3(r1, r4, r2, r3, r0); store_and_load_keys(r3, r0, r4, r1, 14, 10);
  228. S4(r3, r0, r4, r1, r2); store_and_load_keys(r0, r4, r1, r2, 10, 6);
  229. S5(r0, r4, r1, r2, r3); store_and_load_keys(r3, r0, r4, r2, 6, 2);
  230. S6(r3, r0, r4, r2, r1); store_and_load_keys(r4, r1, r0, r2, 2, -2);
  231. S7(r4, r1, r0, r2, r3); store_and_load_keys(r3, r0, r2, r4, -2, -6);
  232. S0(r3, r0, r2, r4, r1); store_and_load_keys(r2, r0, r4, r3, -6, -10);
  233. S1(r2, r0, r4, r3, r1); store_and_load_keys(r1, r4, r3, r2, -10, -14);
  234. S2(r1, r4, r3, r2, r0); store_and_load_keys(r0, r4, r1, r2, -14, -18);
  235. S3(r0, r4, r1, r2, r3); store_and_load_keys(r2, r3, r4, r0, -18, -22);
  236. k -= 50;
  237. S4(r2, r3, r4, r0, r1); store_and_load_keys(r3, r4, r0, r1, 28, 24);
  238. S5(r3, r4, r0, r1, r2); store_and_load_keys(r2, r3, r4, r1, 24, 20);
  239. S6(r2, r3, r4, r1, r0); store_and_load_keys(r4, r0, r3, r1, 20, 16);
  240. S7(r4, r0, r3, r1, r2); store_and_load_keys(r2, r3, r1, r4, 16, 12);
  241. S0(r2, r3, r1, r4, r0); store_and_load_keys(r1, r3, r4, r2, 12, 8);
  242. S1(r1, r3, r4, r2, r0); store_and_load_keys(r0, r4, r2, r1, 8, 4);
  243. S2(r0, r4, r2, r1, r3); store_and_load_keys(r3, r4, r0, r1, 4, 0);
  244. S3(r3, r4, r0, r1, r2); storekeys(r1, r2, r4, r3, 0);
  245. }
  246. int __serpent_setkey(struct serpent_ctx *ctx, const u8 *key,
  247. unsigned int keylen)
  248. {
  249. u32 *k = ctx->expkey;
  250. u8 *k8 = (u8 *)k;
  251. u32 r0, r1, r2, r3, r4;
  252. int i;
  253. /* Copy key, add padding */
  254. for (i = 0; i < keylen; ++i)
  255. k8[i] = key[i];
  256. if (i < SERPENT_MAX_KEY_SIZE)
  257. k8[i++] = 1;
  258. while (i < SERPENT_MAX_KEY_SIZE)
  259. k8[i++] = 0;
  260. /* Expand key using polynomial */
  261. r0 = le32_to_cpu(k[3]);
  262. r1 = le32_to_cpu(k[4]);
  263. r2 = le32_to_cpu(k[5]);
  264. r3 = le32_to_cpu(k[6]);
  265. r4 = le32_to_cpu(k[7]);
  266. keyiter(le32_to_cpu(k[0]), r0, r4, r2, 0, 0);
  267. keyiter(le32_to_cpu(k[1]), r1, r0, r3, 1, 1);
  268. keyiter(le32_to_cpu(k[2]), r2, r1, r4, 2, 2);
  269. keyiter(le32_to_cpu(k[3]), r3, r2, r0, 3, 3);
  270. keyiter(le32_to_cpu(k[4]), r4, r3, r1, 4, 4);
  271. keyiter(le32_to_cpu(k[5]), r0, r4, r2, 5, 5);
  272. keyiter(le32_to_cpu(k[6]), r1, r0, r3, 6, 6);
  273. keyiter(le32_to_cpu(k[7]), r2, r1, r4, 7, 7);
  274. keyiter(k[0], r3, r2, r0, 8, 8);
  275. keyiter(k[1], r4, r3, r1, 9, 9);
  276. keyiter(k[2], r0, r4, r2, 10, 10);
  277. keyiter(k[3], r1, r0, r3, 11, 11);
  278. keyiter(k[4], r2, r1, r4, 12, 12);
  279. keyiter(k[5], r3, r2, r0, 13, 13);
  280. keyiter(k[6], r4, r3, r1, 14, 14);
  281. keyiter(k[7], r0, r4, r2, 15, 15);
  282. keyiter(k[8], r1, r0, r3, 16, 16);
  283. keyiter(k[9], r2, r1, r4, 17, 17);
  284. keyiter(k[10], r3, r2, r0, 18, 18);
  285. keyiter(k[11], r4, r3, r1, 19, 19);
  286. keyiter(k[12], r0, r4, r2, 20, 20);
  287. keyiter(k[13], r1, r0, r3, 21, 21);
  288. keyiter(k[14], r2, r1, r4, 22, 22);
  289. keyiter(k[15], r3, r2, r0, 23, 23);
  290. keyiter(k[16], r4, r3, r1, 24, 24);
  291. keyiter(k[17], r0, r4, r2, 25, 25);
  292. keyiter(k[18], r1, r0, r3, 26, 26);
  293. keyiter(k[19], r2, r1, r4, 27, 27);
  294. keyiter(k[20], r3, r2, r0, 28, 28);
  295. keyiter(k[21], r4, r3, r1, 29, 29);
  296. keyiter(k[22], r0, r4, r2, 30, 30);
  297. keyiter(k[23], r1, r0, r3, 31, 31);
  298. k += 50;
  299. keyiter(k[-26], r2, r1, r4, 32, -18);
  300. keyiter(k[-25], r3, r2, r0, 33, -17);
  301. keyiter(k[-24], r4, r3, r1, 34, -16);
  302. keyiter(k[-23], r0, r4, r2, 35, -15);
  303. keyiter(k[-22], r1, r0, r3, 36, -14);
  304. keyiter(k[-21], r2, r1, r4, 37, -13);
  305. keyiter(k[-20], r3, r2, r0, 38, -12);
  306. keyiter(k[-19], r4, r3, r1, 39, -11);
  307. keyiter(k[-18], r0, r4, r2, 40, -10);
  308. keyiter(k[-17], r1, r0, r3, 41, -9);
  309. keyiter(k[-16], r2, r1, r4, 42, -8);
  310. keyiter(k[-15], r3, r2, r0, 43, -7);
  311. keyiter(k[-14], r4, r3, r1, 44, -6);
  312. keyiter(k[-13], r0, r4, r2, 45, -5);
  313. keyiter(k[-12], r1, r0, r3, 46, -4);
  314. keyiter(k[-11], r2, r1, r4, 47, -3);
  315. keyiter(k[-10], r3, r2, r0, 48, -2);
  316. keyiter(k[-9], r4, r3, r1, 49, -1);
  317. keyiter(k[-8], r0, r4, r2, 50, 0);
  318. keyiter(k[-7], r1, r0, r3, 51, 1);
  319. keyiter(k[-6], r2, r1, r4, 52, 2);
  320. keyiter(k[-5], r3, r2, r0, 53, 3);
  321. keyiter(k[-4], r4, r3, r1, 54, 4);
  322. keyiter(k[-3], r0, r4, r2, 55, 5);
  323. keyiter(k[-2], r1, r0, r3, 56, 6);
  324. keyiter(k[-1], r2, r1, r4, 57, 7);
  325. keyiter(k[0], r3, r2, r0, 58, 8);
  326. keyiter(k[1], r4, r3, r1, 59, 9);
  327. keyiter(k[2], r0, r4, r2, 60, 10);
  328. keyiter(k[3], r1, r0, r3, 61, 11);
  329. keyiter(k[4], r2, r1, r4, 62, 12);
  330. keyiter(k[5], r3, r2, r0, 63, 13);
  331. keyiter(k[6], r4, r3, r1, 64, 14);
  332. keyiter(k[7], r0, r4, r2, 65, 15);
  333. keyiter(k[8], r1, r0, r3, 66, 16);
  334. keyiter(k[9], r2, r1, r4, 67, 17);
  335. keyiter(k[10], r3, r2, r0, 68, 18);
  336. keyiter(k[11], r4, r3, r1, 69, 19);
  337. keyiter(k[12], r0, r4, r2, 70, 20);
  338. keyiter(k[13], r1, r0, r3, 71, 21);
  339. keyiter(k[14], r2, r1, r4, 72, 22);
  340. keyiter(k[15], r3, r2, r0, 73, 23);
  341. keyiter(k[16], r4, r3, r1, 74, 24);
  342. keyiter(k[17], r0, r4, r2, 75, 25);
  343. keyiter(k[18], r1, r0, r3, 76, 26);
  344. keyiter(k[19], r2, r1, r4, 77, 27);
  345. keyiter(k[20], r3, r2, r0, 78, 28);
  346. keyiter(k[21], r4, r3, r1, 79, 29);
  347. keyiter(k[22], r0, r4, r2, 80, 30);
  348. keyiter(k[23], r1, r0, r3, 81, 31);
  349. k += 50;
  350. keyiter(k[-26], r2, r1, r4, 82, -18);
  351. keyiter(k[-25], r3, r2, r0, 83, -17);
  352. keyiter(k[-24], r4, r3, r1, 84, -16);
  353. keyiter(k[-23], r0, r4, r2, 85, -15);
  354. keyiter(k[-22], r1, r0, r3, 86, -14);
  355. keyiter(k[-21], r2, r1, r4, 87, -13);
  356. keyiter(k[-20], r3, r2, r0, 88, -12);
  357. keyiter(k[-19], r4, r3, r1, 89, -11);
  358. keyiter(k[-18], r0, r4, r2, 90, -10);
  359. keyiter(k[-17], r1, r0, r3, 91, -9);
  360. keyiter(k[-16], r2, r1, r4, 92, -8);
  361. keyiter(k[-15], r3, r2, r0, 93, -7);
  362. keyiter(k[-14], r4, r3, r1, 94, -6);
  363. keyiter(k[-13], r0, r4, r2, 95, -5);
  364. keyiter(k[-12], r1, r0, r3, 96, -4);
  365. keyiter(k[-11], r2, r1, r4, 97, -3);
  366. keyiter(k[-10], r3, r2, r0, 98, -2);
  367. keyiter(k[-9], r4, r3, r1, 99, -1);
  368. keyiter(k[-8], r0, r4, r2, 100, 0);
  369. keyiter(k[-7], r1, r0, r3, 101, 1);
  370. keyiter(k[-6], r2, r1, r4, 102, 2);
  371. keyiter(k[-5], r3, r2, r0, 103, 3);
  372. keyiter(k[-4], r4, r3, r1, 104, 4);
  373. keyiter(k[-3], r0, r4, r2, 105, 5);
  374. keyiter(k[-2], r1, r0, r3, 106, 6);
  375. keyiter(k[-1], r2, r1, r4, 107, 7);
  376. keyiter(k[0], r3, r2, r0, 108, 8);
  377. keyiter(k[1], r4, r3, r1, 109, 9);
  378. keyiter(k[2], r0, r4, r2, 110, 10);
  379. keyiter(k[3], r1, r0, r3, 111, 11);
  380. keyiter(k[4], r2, r1, r4, 112, 12);
  381. keyiter(k[5], r3, r2, r0, 113, 13);
  382. keyiter(k[6], r4, r3, r1, 114, 14);
  383. keyiter(k[7], r0, r4, r2, 115, 15);
  384. keyiter(k[8], r1, r0, r3, 116, 16);
  385. keyiter(k[9], r2, r1, r4, 117, 17);
  386. keyiter(k[10], r3, r2, r0, 118, 18);
  387. keyiter(k[11], r4, r3, r1, 119, 19);
  388. keyiter(k[12], r0, r4, r2, 120, 20);
  389. keyiter(k[13], r1, r0, r3, 121, 21);
  390. keyiter(k[14], r2, r1, r4, 122, 22);
  391. keyiter(k[15], r3, r2, r0, 123, 23);
  392. keyiter(k[16], r4, r3, r1, 124, 24);
  393. keyiter(k[17], r0, r4, r2, 125, 25);
  394. keyiter(k[18], r1, r0, r3, 126, 26);
  395. keyiter(k[19], r2, r1, r4, 127, 27);
  396. keyiter(k[20], r3, r2, r0, 128, 28);
  397. keyiter(k[21], r4, r3, r1, 129, 29);
  398. keyiter(k[22], r0, r4, r2, 130, 30);
  399. keyiter(k[23], r1, r0, r3, 131, 31);
  400. /* Apply S-boxes */
  401. __serpent_setkey_sbox(r0, r1, r2, r3, r4, ctx->expkey);
  402. return 0;
  403. }
  404. EXPORT_SYMBOL_GPL(__serpent_setkey);
  405. int serpent_setkey(struct crypto_tfm *tfm, const u8 *key, unsigned int keylen)
  406. {
  407. return __serpent_setkey(crypto_tfm_ctx(tfm), key, keylen);
  408. }
  409. EXPORT_SYMBOL_GPL(serpent_setkey);
  410. void __serpent_encrypt(const void *c, u8 *dst, const u8 *src)
  411. {
  412. const struct serpent_ctx *ctx = c;
  413. const u32 *k = ctx->expkey;
  414. const __le32 *s = (const __le32 *)src;
  415. __le32 *d = (__le32 *)dst;
  416. u32 r0, r1, r2, r3, r4;
  417. /*
  418. * Note: The conversions between u8* and u32* might cause trouble
  419. * on architectures with stricter alignment rules than x86
  420. */
  421. r0 = le32_to_cpu(s[0]);
  422. r1 = le32_to_cpu(s[1]);
  423. r2 = le32_to_cpu(s[2]);
  424. r3 = le32_to_cpu(s[3]);
  425. K(r0, r1, r2, r3, 0);
  426. S0(r0, r1, r2, r3, r4); LK(r2, r1, r3, r0, r4, 1);
  427. S1(r2, r1, r3, r0, r4); LK(r4, r3, r0, r2, r1, 2);
  428. S2(r4, r3, r0, r2, r1); LK(r1, r3, r4, r2, r0, 3);
  429. S3(r1, r3, r4, r2, r0); LK(r2, r0, r3, r1, r4, 4);
  430. S4(r2, r0, r3, r1, r4); LK(r0, r3, r1, r4, r2, 5);
  431. S5(r0, r3, r1, r4, r2); LK(r2, r0, r3, r4, r1, 6);
  432. S6(r2, r0, r3, r4, r1); LK(r3, r1, r0, r4, r2, 7);
  433. S7(r3, r1, r0, r4, r2); LK(r2, r0, r4, r3, r1, 8);
  434. S0(r2, r0, r4, r3, r1); LK(r4, r0, r3, r2, r1, 9);
  435. S1(r4, r0, r3, r2, r1); LK(r1, r3, r2, r4, r0, 10);
  436. S2(r1, r3, r2, r4, r0); LK(r0, r3, r1, r4, r2, 11);
  437. S3(r0, r3, r1, r4, r2); LK(r4, r2, r3, r0, r1, 12);
  438. S4(r4, r2, r3, r0, r1); LK(r2, r3, r0, r1, r4, 13);
  439. S5(r2, r3, r0, r1, r4); LK(r4, r2, r3, r1, r0, 14);
  440. S6(r4, r2, r3, r1, r0); LK(r3, r0, r2, r1, r4, 15);
  441. S7(r3, r0, r2, r1, r4); LK(r4, r2, r1, r3, r0, 16);
  442. S0(r4, r2, r1, r3, r0); LK(r1, r2, r3, r4, r0, 17);
  443. S1(r1, r2, r3, r4, r0); LK(r0, r3, r4, r1, r2, 18);
  444. S2(r0, r3, r4, r1, r2); LK(r2, r3, r0, r1, r4, 19);
  445. S3(r2, r3, r0, r1, r4); LK(r1, r4, r3, r2, r0, 20);
  446. S4(r1, r4, r3, r2, r0); LK(r4, r3, r2, r0, r1, 21);
  447. S5(r4, r3, r2, r0, r1); LK(r1, r4, r3, r0, r2, 22);
  448. S6(r1, r4, r3, r0, r2); LK(r3, r2, r4, r0, r1, 23);
  449. S7(r3, r2, r4, r0, r1); LK(r1, r4, r0, r3, r2, 24);
  450. S0(r1, r4, r0, r3, r2); LK(r0, r4, r3, r1, r2, 25);
  451. S1(r0, r4, r3, r1, r2); LK(r2, r3, r1, r0, r4, 26);
  452. S2(r2, r3, r1, r0, r4); LK(r4, r3, r2, r0, r1, 27);
  453. S3(r4, r3, r2, r0, r1); LK(r0, r1, r3, r4, r2, 28);
  454. S4(r0, r1, r3, r4, r2); LK(r1, r3, r4, r2, r0, 29);
  455. S5(r1, r3, r4, r2, r0); LK(r0, r1, r3, r2, r4, 30);
  456. S6(r0, r1, r3, r2, r4); LK(r3, r4, r1, r2, r0, 31);
  457. S7(r3, r4, r1, r2, r0); K(r0, r1, r2, r3, 32);
  458. d[0] = cpu_to_le32(r0);
  459. d[1] = cpu_to_le32(r1);
  460. d[2] = cpu_to_le32(r2);
  461. d[3] = cpu_to_le32(r3);
  462. }
  463. EXPORT_SYMBOL_GPL(__serpent_encrypt);
  464. static void serpent_encrypt(struct crypto_tfm *tfm, u8 *dst, const u8 *src)
  465. {
  466. struct serpent_ctx *ctx = crypto_tfm_ctx(tfm);
  467. __serpent_encrypt(ctx, dst, src);
  468. }
  469. void __serpent_decrypt(const void *c, u8 *dst, const u8 *src)
  470. {
  471. const struct serpent_ctx *ctx = c;
  472. const u32 *k = ctx->expkey;
  473. const __le32 *s = (const __le32 *)src;
  474. __le32 *d = (__le32 *)dst;
  475. u32 r0, r1, r2, r3, r4;
  476. r0 = le32_to_cpu(s[0]);
  477. r1 = le32_to_cpu(s[1]);
  478. r2 = le32_to_cpu(s[2]);
  479. r3 = le32_to_cpu(s[3]);
  480. K(r0, r1, r2, r3, 32);
  481. SI7(r0, r1, r2, r3, r4); KL(r1, r3, r0, r4, r2, 31);
  482. SI6(r1, r3, r0, r4, r2); KL(r0, r2, r4, r1, r3, 30);
  483. SI5(r0, r2, r4, r1, r3); KL(r2, r3, r0, r4, r1, 29);
  484. SI4(r2, r3, r0, r4, r1); KL(r2, r0, r1, r4, r3, 28);
  485. SI3(r2, r0, r1, r4, r3); KL(r1, r2, r3, r4, r0, 27);
  486. SI2(r1, r2, r3, r4, r0); KL(r2, r0, r4, r3, r1, 26);
  487. SI1(r2, r0, r4, r3, r1); KL(r1, r0, r4, r3, r2, 25);
  488. SI0(r1, r0, r4, r3, r2); KL(r4, r2, r0, r1, r3, 24);
  489. SI7(r4, r2, r0, r1, r3); KL(r2, r1, r4, r3, r0, 23);
  490. SI6(r2, r1, r4, r3, r0); KL(r4, r0, r3, r2, r1, 22);
  491. SI5(r4, r0, r3, r2, r1); KL(r0, r1, r4, r3, r2, 21);
  492. SI4(r0, r1, r4, r3, r2); KL(r0, r4, r2, r3, r1, 20);
  493. SI3(r0, r4, r2, r3, r1); KL(r2, r0, r1, r3, r4, 19);
  494. SI2(r2, r0, r1, r3, r4); KL(r0, r4, r3, r1, r2, 18);
  495. SI1(r0, r4, r3, r1, r2); KL(r2, r4, r3, r1, r0, 17);
  496. SI0(r2, r4, r3, r1, r0); KL(r3, r0, r4, r2, r1, 16);
  497. SI7(r3, r0, r4, r2, r1); KL(r0, r2, r3, r1, r4, 15);
  498. SI6(r0, r2, r3, r1, r4); KL(r3, r4, r1, r0, r2, 14);
  499. SI5(r3, r4, r1, r0, r2); KL(r4, r2, r3, r1, r0, 13);
  500. SI4(r4, r2, r3, r1, r0); KL(r4, r3, r0, r1, r2, 12);
  501. SI3(r4, r3, r0, r1, r2); KL(r0, r4, r2, r1, r3, 11);
  502. SI2(r0, r4, r2, r1, r3); KL(r4, r3, r1, r2, r0, 10);
  503. SI1(r4, r3, r1, r2, r0); KL(r0, r3, r1, r2, r4, 9);
  504. SI0(r0, r3, r1, r2, r4); KL(r1, r4, r3, r0, r2, 8);
  505. SI7(r1, r4, r3, r0, r2); KL(r4, r0, r1, r2, r3, 7);
  506. SI6(r4, r0, r1, r2, r3); KL(r1, r3, r2, r4, r0, 6);
  507. SI5(r1, r3, r2, r4, r0); KL(r3, r0, r1, r2, r4, 5);
  508. SI4(r3, r0, r1, r2, r4); KL(r3, r1, r4, r2, r0, 4);
  509. SI3(r3, r1, r4, r2, r0); KL(r4, r3, r0, r2, r1, 3);
  510. SI2(r4, r3, r0, r2, r1); KL(r3, r1, r2, r0, r4, 2);
  511. SI1(r3, r1, r2, r0, r4); KL(r4, r1, r2, r0, r3, 1);
  512. SI0(r4, r1, r2, r0, r3); K(r2, r3, r1, r4, 0);
  513. d[0] = cpu_to_le32(r2);
  514. d[1] = cpu_to_le32(r3);
  515. d[2] = cpu_to_le32(r1);
  516. d[3] = cpu_to_le32(r4);
  517. }
  518. EXPORT_SYMBOL_GPL(__serpent_decrypt);
  519. static void serpent_decrypt(struct crypto_tfm *tfm, u8 *dst, const u8 *src)
  520. {
  521. struct serpent_ctx *ctx = crypto_tfm_ctx(tfm);
  522. __serpent_decrypt(ctx, dst, src);
  523. }
  524. static int tnepres_setkey(struct crypto_tfm *tfm, const u8 *key,
  525. unsigned int keylen)
  526. {
  527. u8 rev_key[SERPENT_MAX_KEY_SIZE];
  528. int i;
  529. for (i = 0; i < keylen; ++i)
  530. rev_key[keylen - i - 1] = key[i];
  531. return serpent_setkey(tfm, rev_key, keylen);
  532. }
  533. static void tnepres_encrypt(struct crypto_tfm *tfm, u8 *dst, const u8 *src)
  534. {
  535. const u32 * const s = (const u32 * const)src;
  536. u32 * const d = (u32 * const)dst;
  537. u32 rs[4], rd[4];
  538. rs[0] = swab32(s[3]);
  539. rs[1] = swab32(s[2]);
  540. rs[2] = swab32(s[1]);
  541. rs[3] = swab32(s[0]);
  542. serpent_encrypt(tfm, (u8 *)rd, (u8 *)rs);
  543. d[0] = swab32(rd[3]);
  544. d[1] = swab32(rd[2]);
  545. d[2] = swab32(rd[1]);
  546. d[3] = swab32(rd[0]);
  547. }
  548. static void tnepres_decrypt(struct crypto_tfm *tfm, u8 *dst, const u8 *src)
  549. {
  550. const u32 * const s = (const u32 * const)src;
  551. u32 * const d = (u32 * const)dst;
  552. u32 rs[4], rd[4];
  553. rs[0] = swab32(s[3]);
  554. rs[1] = swab32(s[2]);
  555. rs[2] = swab32(s[1]);
  556. rs[3] = swab32(s[0]);
  557. serpent_decrypt(tfm, (u8 *)rd, (u8 *)rs);
  558. d[0] = swab32(rd[3]);
  559. d[1] = swab32(rd[2]);
  560. d[2] = swab32(rd[1]);
  561. d[3] = swab32(rd[0]);
  562. }
  563. static struct crypto_alg srp_algs[2] = { {
  564. .cra_name = "serpent",
  565. .cra_driver_name = "serpent-generic",
  566. .cra_priority = 100,
  567. .cra_flags = CRYPTO_ALG_TYPE_CIPHER,
  568. .cra_blocksize = SERPENT_BLOCK_SIZE,
  569. .cra_ctxsize = sizeof(struct serpent_ctx),
  570. .cra_alignmask = 3,
  571. .cra_module = THIS_MODULE,
  572. .cra_u = { .cipher = {
  573. .cia_min_keysize = SERPENT_MIN_KEY_SIZE,
  574. .cia_max_keysize = SERPENT_MAX_KEY_SIZE,
  575. .cia_setkey = serpent_setkey,
  576. .cia_encrypt = serpent_encrypt,
  577. .cia_decrypt = serpent_decrypt } }
  578. }, {
  579. .cra_name = "tnepres",
  580. .cra_driver_name = "tnepres-generic",
  581. .cra_flags = CRYPTO_ALG_TYPE_CIPHER,
  582. .cra_blocksize = SERPENT_BLOCK_SIZE,
  583. .cra_ctxsize = sizeof(struct serpent_ctx),
  584. .cra_alignmask = 3,
  585. .cra_module = THIS_MODULE,
  586. .cra_u = { .cipher = {
  587. .cia_min_keysize = SERPENT_MIN_KEY_SIZE,
  588. .cia_max_keysize = SERPENT_MAX_KEY_SIZE,
  589. .cia_setkey = tnepres_setkey,
  590. .cia_encrypt = tnepres_encrypt,
  591. .cia_decrypt = tnepres_decrypt } }
  592. } };
  593. static int __init serpent_mod_init(void)
  594. {
  595. return crypto_register_algs(srp_algs, ARRAY_SIZE(srp_algs));
  596. }
  597. static void __exit serpent_mod_fini(void)
  598. {
  599. crypto_unregister_algs(srp_algs, ARRAY_SIZE(srp_algs));
  600. }
  601. subsys_initcall(serpent_mod_init);
  602. module_exit(serpent_mod_fini);
  603. MODULE_LICENSE("GPL");
  604. MODULE_DESCRIPTION("Serpent and tnepres (kerneli compatible serpent reversed) Cipher Algorithm");
  605. MODULE_AUTHOR("Dag Arne Osvik <osvik@ii.uib.no>");
  606. MODULE_ALIAS_CRYPTO("tnepres");
  607. MODULE_ALIAS_CRYPTO("serpent");
  608. MODULE_ALIAS_CRYPTO("serpent-generic");