des_soft.c revision 1219:f89f56c2d9ac 
1/*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License, Version 1.0 only
6 * (the "License").  You may not use this file except in compliance
7 * with the License.
8 *
9 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10 * or http://www.opensolaris.org/os/licensing.
11 * See the License for the specific language governing permissions
12 * and limitations under the License.
13 *
14 * When distributing Covered Code, include this CDDL HEADER in each
15 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16 * If applicable, add the following below this CDDL HEADER, with the
17 * fields enclosed by brackets "[]" replaced with your own identifying
18 * information: Portions Copyright [yyyy] [name of copyright owner]
19 *
20 * CDDL HEADER END
21 */
22
23/*
24 * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
25 * Use is subject to license terms.
26 */
27
28/*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
29/*	  All Rights Reserved  	*/
30
31/*
32 * Portions of this source code were derived from Berkeley 4.3 BSD
33 * under license from the Regents of the University of California.
34 */
35
36#pragma ident	"%Z%%M%	%I%	%E% SMI"
37/*LINTLIBRARY*/
38
39/*
40 * Warning!  Things are arranged very carefully in this file to
41 * allow read-only data to be moved to the text segment.  The
42 * various DES tables must appear before any function definitions
43 * (this is arranged by including them immediately below) and partab
44 * must also appear before and function definitions
45 * This arrangement allows all data up through the first text to
46 * be moved to text.
47 */
48
49#ifndef _KERNEL
50#define	CRYPT	/* cannot configure out of user-level code */
51#endif
52
53#include "des_synonyms.h"
54#ifdef CRYPT
55#include <sys/types.h>
56#include <des/softdes.h>
57#include <des/desdata.h>
58
59#ifdef sun
60#include <sys/ioctl.h>
61#include <sys/des.h>
62#else
63#include <des/des.h>
64#endif
65
66#include "des_soft.h"
67
68/*
69 * Fast (?) software implementation of DES
70 * Has been seen going at 2000 bytes/sec on a Sun-2
71 * Works on a VAX too.
72 * Won't work without 8 bit chars and 32 bit longs
73 */
74
75#define	btst(k, b)	(k[b >> 3] & (0x80 >> (b & 07)))
76#define	BIT28	(1<<28)
77
78
79#endif /* def CRYPT */
80
81static void des_setkey(u_char [8], struct deskeydata *, unsigned);
82static void des_encrypt(u_char *, struct deskeydata *);
83
84#ifndef	_KERNEL
85/*
86 * Table giving odd parity in the low bit for ASCII characters
87 */
88static char partab[128] = {
89	0x01, 0x01, 0x02, 0x02, 0x04, 0x04, 0x07, 0x07,
90	0x08, 0x08, 0x0b, 0x0b, 0x0d, 0x0d, 0x0e, 0x0e,
91	0x10, 0x10, 0x13, 0x13, 0x15, 0x15, 0x16, 0x16,
92	0x19, 0x19, 0x1a, 0x1a, 0x1c, 0x1c, 0x1f, 0x1f,
93	0x20, 0x20, 0x23, 0x23, 0x25, 0x25, 0x26, 0x26,
94	0x29, 0x29, 0x2a, 0x2a, 0x2c, 0x2c, 0x2f, 0x2f,
95	0x31, 0x31, 0x32, 0x32, 0x34, 0x34, 0x37, 0x37,
96	0x38, 0x38, 0x3b, 0x3b, 0x3d, 0x3d, 0x3e, 0x3e,
97	0x40, 0x40, 0x43, 0x43, 0x45, 0x45, 0x46, 0x46,
98	0x49, 0x49, 0x4a, 0x4a, 0x4c, 0x4c, 0x4f, 0x4f,
99	0x51, 0x51, 0x52, 0x52, 0x54, 0x54, 0x57, 0x57,
100	0x58, 0x58, 0x5b, 0x5b, 0x5d, 0x5d, 0x5e, 0x5e,
101	0x61, 0x61, 0x62, 0x62, 0x64, 0x64, 0x67, 0x67,
102	0x68, 0x68, 0x6b, 0x6b, 0x6d, 0x6d, 0x6e, 0x6e,
103	0x70, 0x70, 0x73, 0x73, 0x75, 0x75, 0x76, 0x76,
104	0x79, 0x79, 0x7a, 0x7a, 0x7c, 0x7c, 0x7f, 0x7f,
105};
106
107
108
109/*
110 * Add odd parity to low bit of 8 byte key
111 */
112void
113des_setparity(char *p)
114{
115	int i;
116
117	for (i = 0; i < 8; i++) {
118		*p = partab[*p & 0x7f];
119		p++;
120	}
121}
122#endif /* def _KERNEL */
123
124#ifdef CRYPT
125/*
126 * Software encrypt or decrypt a block of data (multiple of 8 bytes)
127 * Do the CBC ourselves if needed.
128 */
129int
130__des_crypt(char *buf, unsigned int len, struct desparams *desp)
131{
132/* EXPORT DELETE START */
133	short i;
134	unsigned mode;
135	unsigned dir;
136	char nextiv[8];
137	struct deskeydata softkey;
138
139	mode = (unsigned) desp->des_mode;
140	dir = (unsigned) desp->des_dir;
141	des_setkey(desp->des_key, &softkey, dir);
142	while (len != 0) {
143		switch (mode) {
144		case CBC:
145			switch (dir) {
146			case ENCRYPT:
147				for (i = 0; i < 8; i++)
148					buf[i] ^= desp->des_ivec[i];
149				des_encrypt((u_char *)buf, &softkey);
150				for (i = 0; i < 8; i++)
151					desp->des_ivec[i] = buf[i];
152				break;
153			case DECRYPT:
154				for (i = 0; i < 8; i++)
155					nextiv[i] = buf[i];
156				des_encrypt((u_char *)buf, &softkey);
157				for (i = 0; i < 8; i++) {
158					buf[i] ^= desp->des_ivec[i];
159					desp->des_ivec[i] = nextiv[i];
160				}
161				break;
162			}
163			break;
164		case ECB:
165			des_encrypt((u_char *)buf, &softkey);
166			break;
167		}
168		buf += 8;
169		len -= 8;
170	}
171/* EXPORT DELETE END */
172	return (1);
173}
174
175
176/*
177 * Set the key and direction for an encryption operation
178 * We build the 16 key entries here
179 */
180static void
181des_setkey(u_char userkey[8], struct deskeydata *kd, unsigned int dir)
182{
183/* EXPORT DELETE START */
184	long C, D;
185	short i;
186
187	/*
188	 * First, generate C and D by permuting
189	 * the key. The low order bit of each
190	 * 8-bit char is not used, so C and D are only 28
191	 * bits apiece.
192	 */
193	{
194		short bit;
195		const short *pcc = PC1_C, *pcd = PC1_D;
196
197		C = D = 0;
198		for (i = 0; i < 28; i++) {
199			C <<= 1;
200			D <<= 1;
201			bit = *pcc++;
202			if (btst(userkey, bit))
203				C |= 1;
204			bit = *pcd++;
205			if (btst(userkey, bit))
206				D |= 1;
207		}
208	}
209	/*
210	 * To generate Ki, rotate C and D according
211	 * to schedule and pick up a permutation
212	 * using PC2.
213	 */
214	for (i = 0; i < 16; i++) {
215		chunk_t *c;
216		short j, k, bit;
217		long bbit;
218
219		/*
220		 * Do the "left shift" (rotate)
221		 * We know we always rotate by either 1 or 2 bits
222		 * the shifts table tells us if its 2
223		 */
224		C <<= 1;
225		if (C & BIT28)
226			C |= 1;
227		D <<= 1;
228		if (D & BIT28)
229			D |= 1;
230		if (shifts[i]) {
231			C <<= 1;
232			if (C & BIT28)
233				C |= 1;
234			D <<= 1;
235			if (D & BIT28)
236				D |= 1;
237		}
238		/*
239		 * get Ki. Note C and D are concatenated.
240		 */
241		bit = 0;
242		switch (dir) {
243		case ENCRYPT:
244			c = &kd->keyval[i]; break;
245		case DECRYPT:
246			c = &kd->keyval[15 - i]; break;
247		}
248		c->long0 = 0;
249		c->long1 = 0;
250		bbit = (1 << 5) << 24;
251		for (j = 0; j < 4; j++) {
252			for (k = 0; k < 6; k++) {
253				if (C & (BIT28 >> PC2_C[bit]))
254					c->long0 |= bbit >> k;
255				if (D & (BIT28 >> PC2_D[bit]))
256					c->long1 |= bbit >> k;
257				bit++;
258			}
259			bbit >>= 8;
260		}
261
262	}
263/* EXPORT DELETE END */
264	return;
265}
266
267
268
269/*
270 * Do an encryption operation
271 * Much pain is taken (with preprocessor) to avoid loops so the compiler
272 * can do address arithmetic instead of doing it at runtime.
273 * Note that the byte-to-chunk conversion is necessary to guarantee
274 * processor byte-order independence.
275 */
276static void
277des_encrypt(u_char *data, struct deskeydata *kd)
278{
279/* EXPORT DELETE START */
280	chunk_t work1, work2;
281
282	/*
283	 * Initial permutation
284	 * and byte to chunk conversion
285	 */
286	{
287		const uint32_t *lp;
288		uint32_t l0, l1, w;
289		short i, pbit;
290
291		work1.byte0 = data[0];
292		work1.byte1 = data[1];
293		work1.byte2 = data[2];
294		work1.byte3 = data[3];
295		work1.byte4 = data[4];
296		work1.byte5 = data[5];
297		work1.byte6 = data[6];
298		work1.byte7 = data[7];
299		l0 = l1 = 0;
300		w = work1.long0;
301		for (lp = &longtab[0], i = 0; i < 32; i++) {
302			if (w & *lp++) {
303				pbit = IPtab[i];
304				if (pbit < 32)
305					l0 |= longtab[pbit];
306				else
307					l1 |= longtab[pbit-32];
308			}
309		}
310		w = work1.long1;
311		for (lp = &longtab[0], i = 32; i < 64; i++) {
312			if (w & *lp++) {
313				pbit = IPtab[i];
314				if (pbit < 32)
315					l0 |= longtab[pbit];
316				else
317					l1 |= longtab[pbit-32];
318			}
319		}
320		work2.long0 = l0;
321		work2.long1 = l1;
322	}
323
324/*
325 * Expand 8 bits of 32 bit R to 48 bit R
326 */
327#define	do_R_to_ER(op, b)	{			\
328	const struct R_to_ER *p = &R_to_ER_tab[b][R.byte##b];	\
329	e0 op p->l0;				\
330	e1 op p->l1;				\
331}
332
333/*
334 * Inner part of the algorithm:
335 * Expand R from 32 to 48 bits; xor key value;
336 * apply S boxes; permute 32 bits of output
337 */
338#define	do_F(iter, inR, outR) 	{			\
339	chunk_t R, ER;					\
340	uint32_t e0, e1;				\
341	R.long0 = inR;					\
342	do_R_to_ER(=, 0);				\
343	do_R_to_ER(|=, 1);				\
344	do_R_to_ER(|=, 2);				\
345	do_R_to_ER(|=, 3);				\
346	ER.long0 = e0 ^ kd->keyval[iter].long0;		\
347	ER.long1 = e1 ^ kd->keyval[iter].long1;		\
348	R.long0 = 					\
349		S_tab[0][ER.byte0] +			\
350		S_tab[1][ER.byte1] +			\
351		S_tab[2][ER.byte2] +			\
352		S_tab[3][ER.byte3] +			\
353		S_tab[4][ER.byte4] +			\
354		S_tab[5][ER.byte5] +			\
355		S_tab[6][ER.byte6] +			\
356		S_tab[7][ER.byte7]; 			\
357	outR = 						\
358		P_tab[0][R.byte0] +			\
359		P_tab[1][R.byte1] +			\
360		P_tab[2][R.byte2] +			\
361		P_tab[3][R.byte3]; 			\
362}
363
364/*
365 * Do a cipher step
366 * Apply inner part; do xor and exchange of 32 bit parts
367 */
368#define	cipher(iter, inR, inL, outR, outL)	{	\
369	do_F(iter, inR, outR);				\
370	outR ^= inL;					\
371	outL = inR;					\
372}
373
374	/*
375	 * Apply the 16 ciphering steps
376	 */
377	{
378		uint32_t r0, l0, r1, l1;
379
380		l0 = work2.long0;
381		r0 = work2.long1;
382		cipher(0, r0, l0, r1, l1);
383		cipher(1, r1, l1, r0, l0);
384		cipher(2, r0, l0, r1, l1);
385		cipher(3, r1, l1, r0, l0);
386		cipher(4, r0, l0, r1, l1);
387		cipher(5, r1, l1, r0, l0);
388		cipher(6, r0, l0, r1, l1);
389		cipher(7, r1, l1, r0, l0);
390		cipher(8, r0, l0, r1, l1);
391		cipher(9, r1, l1, r0, l0);
392		cipher(10, r0, l0, r1, l1);
393		cipher(11, r1, l1, r0, l0);
394		cipher(12, r0, l0, r1, l1);
395		cipher(13, r1, l1, r0, l0);
396		cipher(14, r0, l0, r1, l1);
397		cipher(15, r1, l1, r0, l0);
398		work1.long0 = r0;
399		work1.long1 = l0;
400	}
401
402	/*
403	 * Final permutation
404	 * and chunk to byte conversion
405	 */
406	{
407		const uint32_t *lp;
408		uint32_t l0, l1, w;
409		short i, pbit;
410
411		l0 = l1 = 0;
412		w = work1.long0;
413		for (lp = &longtab[0], i = 0; i < 32; i++) {
414			if (w & *lp++) {
415				pbit = FPtab[i];
416				if (pbit < 32)
417					l0 |= longtab[pbit];
418				else
419					l1 |= longtab[pbit-32];
420			}
421		}
422		w = work1.long1;
423		for (lp = &longtab[0], i = 32; i < 64; i++) {
424			if (w & *lp++) {
425				pbit = FPtab[i];
426				if (pbit < 32)
427					l0 |= longtab[pbit];
428				else
429					l1 |= longtab[pbit-32];
430			}
431		}
432		work2.long0 = l0;
433		work2.long1 = l1;
434	}
435	data[0] = work2.byte0;
436	data[1] = work2.byte1;
437	data[2] = work2.byte2;
438	data[3] = work2.byte3;
439	data[4] = work2.byte4;
440	data[5] = work2.byte5;
441	data[6] = work2.byte6;
442	data[7] = work2.byte7;
443
444/* EXPORT DELETE END */
445	return;
446}
447#endif /* def CRYPT */
448