crypto/camellia/camellia.c

   1 /*
   2  * Copyright 2006-2022 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 /* ====================================================================
  11  * Copyright 2006 NTT (Nippon Telegraph and Telephone Corporation) .
  12  * ALL RIGHTS RESERVED.
  13  *
  14  * Intellectual Property information for Camellia:
  15  *     http://info.isl.ntt.co.jp/crypt/eng/info/chiteki.html
  16  *
  17  * News Release for Announcement of Camellia open source:
  18  *     http://www.ntt.co.jp/news/news06e/0604/060413a.html
  19  *
  20  * The Camellia Code included herein is developed by
  21  * NTT (Nippon Telegraph and Telephone Corporation), and is contributed
  22  * to the OpenSSL project.
  23  */
  24
  25 /*
  26  * Algorithm Specification
  27  * http://info.isl.ntt.co.jp/crypt/eng/camellia/specifications.html
  28  */
  29
  30 /*
  31  * This release balances code size and performance. In particular key
  32  * schedule setup is fully unrolled, because doing so *significantly*
  33  * reduces amount of instructions per setup round and code increase is
  34  * justifiable. In block functions on the other hand only inner loops
  35  * are unrolled, as full unroll gives only nominal performance boost,
  36  * while code size grows 4 or 7 times. Also, unlike previous versions
  37  * this one "encourages" compiler to keep intermediate variables in
  38  * registers, which should give better "all round" results, in other
  39  * words reasonable performance even with not so modern compilers.
  40  */
  41
  42 /*
  43  * Camellia low level APIs are deprecated for public use, but still ok for
  44  * internal use.
  45  */
  46 #include "internal/deprecated.h"
  47
  48 #include <openssl/camellia.h>
  49 #include "cmll_local.h"
  50 #include <string.h>
  51 #include <stdlib.h>
  52
  53 #define RightRotate(x, s) ( ((x) >> (s)) + ((x) << (32 - s)) )
  54 #define LeftRotate(x, s)  ( ((x) << (s)) + ((x) >> (32 - s)) )
  55
  56 #define GETU32(p)   (((u32)(p)[0] << 24) ^ ((u32)(p)[1] << 16) ^ ((u32)(p)[2] <<  8) ^ ((u32)(p)[3]))
  57 #define PUTU32(p,v) ((p)[0] = (u8)((v) >> 24), (p)[1] = (u8)((v) >> 16), (p)[2] = (u8)((v) >>  8), (p)[3] = (u8)(v))
  58
  59 /* S-box data */
  60 #define SBOX1_1110 Camellia_SBOX[0]
  61 #define SBOX4_4404 Camellia_SBOX[1]
  62 #define SBOX2_0222 Camellia_SBOX[2]
  63 #define SBOX3_3033 Camellia_SBOX[3]
  64 static const u32 Camellia_SBOX[][256] = {
  65     {0x70707000, 0x82828200, 0x2c2c2c00, 0xececec00, 0xb3b3b300, 0x27272700,
  66      0xc0c0c000, 0xe5e5e500, 0xe4e4e400, 0x85858500, 0x57575700, 0x35353500,
  67      0xeaeaea00, 0x0c0c0c00, 0xaeaeae00, 0x41414100, 0x23232300, 0xefefef00,
  68      0x6b6b6b00, 0x93939300, 0x45454500, 0x19191900, 0xa5a5a500, 0x21212100,
  69      0xededed00, 0x0e0e0e00, 0x4f4f4f00, 0x4e4e4e00, 0x1d1d1d00, 0x65656500,
  70      0x92929200, 0xbdbdbd00, 0x86868600, 0xb8b8b800, 0xafafaf00, 0x8f8f8f00,
  71      0x7c7c7c00, 0xebebeb00, 0x1f1f1f00, 0xcecece00, 0x3e3e3e00, 0x30303000,
  72      0xdcdcdc00, 0x5f5f5f00, 0x5e5e5e00, 0xc5c5c500, 0x0b0b0b00, 0x1a1a1a00,
  73      0xa6a6a600, 0xe1e1e100, 0x39393900, 0xcacaca00, 0xd5d5d500, 0x47474700,
  74      0x5d5d5d00, 0x3d3d3d00, 0xd9d9d900, 0x01010100, 0x5a5a5a00, 0xd6d6d600,
  75      0x51515100, 0x56565600, 0x6c6c6c00, 0x4d4d4d00, 0x8b8b8b00, 0x0d0d0d00,
  76      0x9a9a9a00, 0x66666600, 0xfbfbfb00, 0xcccccc00, 0xb0b0b000, 0x2d2d2d00,
  77      0x74747400, 0x12121200, 0x2b2b2b00, 0x20202000, 0xf0f0f000, 0xb1b1b100,
  78      0x84848400, 0x99999900, 0xdfdfdf00, 0x4c4c4c00, 0xcbcbcb00, 0xc2c2c200,
  79      0x34343400, 0x7e7e7e00, 0x76767600, 0x05050500, 0x6d6d6d00, 0xb7b7b700,
  80      0xa9a9a900, 0x31313100, 0xd1d1d100, 0x17171700, 0x04040400, 0xd7d7d700,
  81      0x14141400, 0x58585800, 0x3a3a3a00, 0x61616100, 0xdedede00, 0x1b1b1b00,
  82      0x11111100, 0x1c1c1c00, 0x32323200, 0x0f0f0f00, 0x9c9c9c00, 0x16161600,
  83      0x53535300, 0x18181800, 0xf2f2f200, 0x22222200, 0xfefefe00, 0x44444400,
  84      0xcfcfcf00, 0xb2b2b200, 0xc3c3c300, 0xb5b5b500, 0x7a7a7a00, 0x91919100,
  85      0x24242400, 0x08080800, 0xe8e8e800, 0xa8a8a800, 0x60606000, 0xfcfcfc00,
  86      0x69696900, 0x50505000, 0xaaaaaa00, 0xd0d0d000, 0xa0a0a000, 0x7d7d7d00,
  87      0xa1a1a100, 0x89898900, 0x62626200, 0x97979700, 0x54545400, 0x5b5b5b00,
  88      0x1e1e1e00, 0x95959500, 0xe0e0e000, 0xffffff00, 0x64646400, 0xd2d2d200,
  89      0x10101000, 0xc4c4c400, 0x00000000, 0x48484800, 0xa3a3a300, 0xf7f7f700,
  90      0x75757500, 0xdbdbdb00, 0x8a8a8a00, 0x03030300, 0xe6e6e600, 0xdadada00,
  91      0x09090900, 0x3f3f3f00, 0xdddddd00, 0x94949400, 0x87878700, 0x5c5c5c00,
  92      0x83838300, 0x02020200, 0xcdcdcd00, 0x4a4a4a00, 0x90909000, 0x33333300,
  93      0x73737300, 0x67676700, 0xf6f6f600, 0xf3f3f300, 0x9d9d9d00, 0x7f7f7f00,
  94      0xbfbfbf00, 0xe2e2e200, 0x52525200, 0x9b9b9b00, 0xd8d8d800, 0x26262600,
  95      0xc8c8c800, 0x37373700, 0xc6c6c600, 0x3b3b3b00, 0x81818100, 0x96969600,
  96      0x6f6f6f00, 0x4b4b4b00, 0x13131300, 0xbebebe00, 0x63636300, 0x2e2e2e00,
  97      0xe9e9e900, 0x79797900, 0xa7a7a700, 0x8c8c8c00, 0x9f9f9f00, 0x6e6e6e00,
  98      0xbcbcbc00, 0x8e8e8e00, 0x29292900, 0xf5f5f500, 0xf9f9f900, 0xb6b6b600,
  99      0x2f2f2f00, 0xfdfdfd00, 0xb4b4b400, 0x59595900, 0x78787800, 0x98989800,
 100      0x06060600, 0x6a6a6a00, 0xe7e7e700, 0x46464600, 0x71717100, 0xbababa00,
 101      0xd4d4d400, 0x25252500, 0xababab00, 0x42424200, 0x88888800, 0xa2a2a200,
 102      0x8d8d8d00, 0xfafafa00, 0x72727200, 0x07070700, 0xb9b9b900, 0x55555500,
 103      0xf8f8f800, 0xeeeeee00, 0xacacac00, 0x0a0a0a00, 0x36363600, 0x49494900,
 104      0x2a2a2a00, 0x68686800, 0x3c3c3c00, 0x38383800, 0xf1f1f100, 0xa4a4a400,
 105      0x40404000, 0x28282800, 0xd3d3d300, 0x7b7b7b00, 0xbbbbbb00, 0xc9c9c900,
 106      0x43434300, 0xc1c1c100, 0x15151500, 0xe3e3e300, 0xadadad00, 0xf4f4f400,
 107      0x77777700, 0xc7c7c700, 0x80808000, 0x9e9e9e00},
 108     {0x70700070, 0x2c2c002c, 0xb3b300b3, 0xc0c000c0, 0xe4e400e4, 0x57570057,
 109      0xeaea00ea, 0xaeae00ae, 0x23230023, 0x6b6b006b, 0x45450045, 0xa5a500a5,
 110      0xeded00ed, 0x4f4f004f, 0x1d1d001d, 0x92920092, 0x86860086, 0xafaf00af,
 111      0x7c7c007c, 0x1f1f001f, 0x3e3e003e, 0xdcdc00dc, 0x5e5e005e, 0x0b0b000b,
 112      0xa6a600a6, 0x39390039, 0xd5d500d5, 0x5d5d005d, 0xd9d900d9, 0x5a5a005a,
 113      0x51510051, 0x6c6c006c, 0x8b8b008b, 0x9a9a009a, 0xfbfb00fb, 0xb0b000b0,
 114      0x74740074, 0x2b2b002b, 0xf0f000f0, 0x84840084, 0xdfdf00df, 0xcbcb00cb,
 115      0x34340034, 0x76760076, 0x6d6d006d, 0xa9a900a9, 0xd1d100d1, 0x04040004,
 116      0x14140014, 0x3a3a003a, 0xdede00de, 0x11110011, 0x32320032, 0x9c9c009c,
 117      0x53530053, 0xf2f200f2, 0xfefe00fe, 0xcfcf00cf, 0xc3c300c3, 0x7a7a007a,
 118      0x24240024, 0xe8e800e8, 0x60600060, 0x69690069, 0xaaaa00aa, 0xa0a000a0,
 119      0xa1a100a1, 0x62620062, 0x54540054, 0x1e1e001e, 0xe0e000e0, 0x64640064,
 120      0x10100010, 0x00000000, 0xa3a300a3, 0x75750075, 0x8a8a008a, 0xe6e600e6,
 121      0x09090009, 0xdddd00dd, 0x87870087, 0x83830083, 0xcdcd00cd, 0x90900090,
 122      0x73730073, 0xf6f600f6, 0x9d9d009d, 0xbfbf00bf, 0x52520052, 0xd8d800d8,
 123      0xc8c800c8, 0xc6c600c6, 0x81810081, 0x6f6f006f, 0x13130013, 0x63630063,
 124      0xe9e900e9, 0xa7a700a7, 0x9f9f009f, 0xbcbc00bc, 0x29290029, 0xf9f900f9,
 125      0x2f2f002f, 0xb4b400b4, 0x78780078, 0x06060006, 0xe7e700e7, 0x71710071,
 126      0xd4d400d4, 0xabab00ab, 0x88880088, 0x8d8d008d, 0x72720072, 0xb9b900b9,
 127      0xf8f800f8, 0xacac00ac, 0x36360036, 0x2a2a002a, 0x3c3c003c, 0xf1f100f1,
 128      0x40400040, 0xd3d300d3, 0xbbbb00bb, 0x43430043, 0x15150015, 0xadad00ad,
 129      0x77770077, 0x80800080, 0x82820082, 0xecec00ec, 0x27270027, 0xe5e500e5,
 130      0x85850085, 0x35350035, 0x0c0c000c, 0x41410041, 0xefef00ef, 0x93930093,
 131      0x19190019, 0x21210021, 0x0e0e000e, 0x4e4e004e, 0x65650065, 0xbdbd00bd,
 132      0xb8b800b8, 0x8f8f008f, 0xebeb00eb, 0xcece00ce, 0x30300030, 0x5f5f005f,
 133      0xc5c500c5, 0x1a1a001a, 0xe1e100e1, 0xcaca00ca, 0x47470047, 0x3d3d003d,
 134      0x01010001, 0xd6d600d6, 0x56560056, 0x4d4d004d, 0x0d0d000d, 0x66660066,
 135      0xcccc00cc, 0x2d2d002d, 0x12120012, 0x20200020, 0xb1b100b1, 0x99990099,
 136      0x4c4c004c, 0xc2c200c2, 0x7e7e007e, 0x05050005, 0xb7b700b7, 0x31310031,
 137      0x17170017, 0xd7d700d7, 0x58580058, 0x61610061, 0x1b1b001b, 0x1c1c001c,
 138      0x0f0f000f, 0x16160016, 0x18180018, 0x22220022, 0x44440044, 0xb2b200b2,
 139      0xb5b500b5, 0x91910091, 0x08080008, 0xa8a800a8, 0xfcfc00fc, 0x50500050,
 140      0xd0d000d0, 0x7d7d007d, 0x89890089, 0x97970097, 0x5b5b005b, 0x95950095,
 141      0xffff00ff, 0xd2d200d2, 0xc4c400c4, 0x48480048, 0xf7f700f7, 0xdbdb00db,
 142      0x03030003, 0xdada00da, 0x3f3f003f, 0x94940094, 0x5c5c005c, 0x02020002,
 143      0x4a4a004a, 0x33330033, 0x67670067, 0xf3f300f3, 0x7f7f007f, 0xe2e200e2,
 144      0x9b9b009b, 0x26260026, 0x37370037, 0x3b3b003b, 0x96960096, 0x4b4b004b,
 145      0xbebe00be, 0x2e2e002e, 0x79790079, 0x8c8c008c, 0x6e6e006e, 0x8e8e008e,
 146      0xf5f500f5, 0xb6b600b6, 0xfdfd00fd, 0x59590059, 0x98980098, 0x6a6a006a,
 147      0x46460046, 0xbaba00ba, 0x25250025, 0x42420042, 0xa2a200a2, 0xfafa00fa,
 148      0x07070007, 0x55550055, 0xeeee00ee, 0x0a0a000a, 0x49490049, 0x68680068,
 149      0x38380038, 0xa4a400a4, 0x28280028, 0x7b7b007b, 0xc9c900c9, 0xc1c100c1,
 150      0xe3e300e3, 0xf4f400f4, 0xc7c700c7, 0x9e9e009e},
 151     {0x00e0e0e0, 0x00050505, 0x00585858, 0x00d9d9d9, 0x00676767, 0x004e4e4e,
 152      0x00818181, 0x00cbcbcb, 0x00c9c9c9, 0x000b0b0b, 0x00aeaeae, 0x006a6a6a,
 153      0x00d5d5d5, 0x00181818, 0x005d5d5d, 0x00828282, 0x00464646, 0x00dfdfdf,
 154      0x00d6d6d6, 0x00272727, 0x008a8a8a, 0x00323232, 0x004b4b4b, 0x00424242,
 155      0x00dbdbdb, 0x001c1c1c, 0x009e9e9e, 0x009c9c9c, 0x003a3a3a, 0x00cacaca,
 156      0x00252525, 0x007b7b7b, 0x000d0d0d, 0x00717171, 0x005f5f5f, 0x001f1f1f,
 157      0x00f8f8f8, 0x00d7d7d7, 0x003e3e3e, 0x009d9d9d, 0x007c7c7c, 0x00606060,
 158      0x00b9b9b9, 0x00bebebe, 0x00bcbcbc, 0x008b8b8b, 0x00161616, 0x00343434,
 159      0x004d4d4d, 0x00c3c3c3, 0x00727272, 0x00959595, 0x00ababab, 0x008e8e8e,
 160      0x00bababa, 0x007a7a7a, 0x00b3b3b3, 0x00020202, 0x00b4b4b4, 0x00adadad,
 161      0x00a2a2a2, 0x00acacac, 0x00d8d8d8, 0x009a9a9a, 0x00171717, 0x001a1a1a,
 162      0x00353535, 0x00cccccc, 0x00f7f7f7, 0x00999999, 0x00616161, 0x005a5a5a,
 163      0x00e8e8e8, 0x00242424, 0x00565656, 0x00404040, 0x00e1e1e1, 0x00636363,
 164      0x00090909, 0x00333333, 0x00bfbfbf, 0x00989898, 0x00979797, 0x00858585,
 165      0x00686868, 0x00fcfcfc, 0x00ececec, 0x000a0a0a, 0x00dadada, 0x006f6f6f,
 166      0x00535353, 0x00626262, 0x00a3a3a3, 0x002e2e2e, 0x00080808, 0x00afafaf,
 167      0x00282828, 0x00b0b0b0, 0x00747474, 0x00c2c2c2, 0x00bdbdbd, 0x00363636,
 168      0x00222222, 0x00383838, 0x00646464, 0x001e1e1e, 0x00393939, 0x002c2c2c,
 169      0x00a6a6a6, 0x00303030, 0x00e5e5e5, 0x00444444, 0x00fdfdfd, 0x00888888,
 170      0x009f9f9f, 0x00656565, 0x00878787, 0x006b6b6b, 0x00f4f4f4, 0x00232323,
 171      0x00484848, 0x00101010, 0x00d1d1d1, 0x00515151, 0x00c0c0c0, 0x00f9f9f9,
 172      0x00d2d2d2, 0x00a0a0a0, 0x00555555, 0x00a1a1a1, 0x00414141, 0x00fafafa,
 173      0x00434343, 0x00131313, 0x00c4c4c4, 0x002f2f2f, 0x00a8a8a8, 0x00b6b6b6,
 174      0x003c3c3c, 0x002b2b2b, 0x00c1c1c1, 0x00ffffff, 0x00c8c8c8, 0x00a5a5a5,
 175      0x00202020, 0x00898989, 0x00000000, 0x00909090, 0x00474747, 0x00efefef,
 176      0x00eaeaea, 0x00b7b7b7, 0x00151515, 0x00060606, 0x00cdcdcd, 0x00b5b5b5,
 177      0x00121212, 0x007e7e7e, 0x00bbbbbb, 0x00292929, 0x000f0f0f, 0x00b8b8b8,
 178      0x00070707, 0x00040404, 0x009b9b9b, 0x00949494, 0x00212121, 0x00666666,
 179      0x00e6e6e6, 0x00cecece, 0x00ededed, 0x00e7e7e7, 0x003b3b3b, 0x00fefefe,
 180      0x007f7f7f, 0x00c5c5c5, 0x00a4a4a4, 0x00373737, 0x00b1b1b1, 0x004c4c4c,
 181      0x00919191, 0x006e6e6e, 0x008d8d8d, 0x00767676, 0x00030303, 0x002d2d2d,
 182      0x00dedede, 0x00969696, 0x00262626, 0x007d7d7d, 0x00c6c6c6, 0x005c5c5c,
 183      0x00d3d3d3, 0x00f2f2f2, 0x004f4f4f, 0x00191919, 0x003f3f3f, 0x00dcdcdc,
 184      0x00797979, 0x001d1d1d, 0x00525252, 0x00ebebeb, 0x00f3f3f3, 0x006d6d6d,
 185      0x005e5e5e, 0x00fbfbfb, 0x00696969, 0x00b2b2b2, 0x00f0f0f0, 0x00313131,
 186      0x000c0c0c, 0x00d4d4d4, 0x00cfcfcf, 0x008c8c8c, 0x00e2e2e2, 0x00757575,
 187      0x00a9a9a9, 0x004a4a4a, 0x00575757, 0x00848484, 0x00111111, 0x00454545,
 188      0x001b1b1b, 0x00f5f5f5, 0x00e4e4e4, 0x000e0e0e, 0x00737373, 0x00aaaaaa,
 189      0x00f1f1f1, 0x00dddddd, 0x00595959, 0x00141414, 0x006c6c6c, 0x00929292,
 190      0x00545454, 0x00d0d0d0, 0x00787878, 0x00707070, 0x00e3e3e3, 0x00494949,
 191      0x00808080, 0x00505050, 0x00a7a7a7, 0x00f6f6f6, 0x00777777, 0x00939393,
 192      0x00868686, 0x00838383, 0x002a2a2a, 0x00c7c7c7, 0x005b5b5b, 0x00e9e9e9,
 193      0x00eeeeee, 0x008f8f8f, 0x00010101, 0x003d3d3d},
 194     {0x38003838, 0x41004141, 0x16001616, 0x76007676, 0xd900d9d9, 0x93009393,
 195      0x60006060, 0xf200f2f2, 0x72007272, 0xc200c2c2, 0xab00abab, 0x9a009a9a,
 196      0x75007575, 0x06000606, 0x57005757, 0xa000a0a0, 0x91009191, 0xf700f7f7,
 197      0xb500b5b5, 0xc900c9c9, 0xa200a2a2, 0x8c008c8c, 0xd200d2d2, 0x90009090,
 198      0xf600f6f6, 0x07000707, 0xa700a7a7, 0x27002727, 0x8e008e8e, 0xb200b2b2,
 199      0x49004949, 0xde00dede, 0x43004343, 0x5c005c5c, 0xd700d7d7, 0xc700c7c7,
 200      0x3e003e3e, 0xf500f5f5, 0x8f008f8f, 0x67006767, 0x1f001f1f, 0x18001818,
 201      0x6e006e6e, 0xaf00afaf, 0x2f002f2f, 0xe200e2e2, 0x85008585, 0x0d000d0d,
 202      0x53005353, 0xf000f0f0, 0x9c009c9c, 0x65006565, 0xea00eaea, 0xa300a3a3,
 203      0xae00aeae, 0x9e009e9e, 0xec00ecec, 0x80008080, 0x2d002d2d, 0x6b006b6b,
 204      0xa800a8a8, 0x2b002b2b, 0x36003636, 0xa600a6a6, 0xc500c5c5, 0x86008686,
 205      0x4d004d4d, 0x33003333, 0xfd00fdfd, 0x66006666, 0x58005858, 0x96009696,
 206      0x3a003a3a, 0x09000909, 0x95009595, 0x10001010, 0x78007878, 0xd800d8d8,
 207      0x42004242, 0xcc00cccc, 0xef00efef, 0x26002626, 0xe500e5e5, 0x61006161,
 208      0x1a001a1a, 0x3f003f3f, 0x3b003b3b, 0x82008282, 0xb600b6b6, 0xdb00dbdb,
 209      0xd400d4d4, 0x98009898, 0xe800e8e8, 0x8b008b8b, 0x02000202, 0xeb00ebeb,
 210      0x0a000a0a, 0x2c002c2c, 0x1d001d1d, 0xb000b0b0, 0x6f006f6f, 0x8d008d8d,
 211      0x88008888, 0x0e000e0e, 0x19001919, 0x87008787, 0x4e004e4e, 0x0b000b0b,
 212      0xa900a9a9, 0x0c000c0c, 0x79007979, 0x11001111, 0x7f007f7f, 0x22002222,
 213      0xe700e7e7, 0x59005959, 0xe100e1e1, 0xda00dada, 0x3d003d3d, 0xc800c8c8,
 214      0x12001212, 0x04000404, 0x74007474, 0x54005454, 0x30003030, 0x7e007e7e,
 215      0xb400b4b4, 0x28002828, 0x55005555, 0x68006868, 0x50005050, 0xbe00bebe,
 216      0xd000d0d0, 0xc400c4c4, 0x31003131, 0xcb00cbcb, 0x2a002a2a, 0xad00adad,
 217      0x0f000f0f, 0xca00caca, 0x70007070, 0xff00ffff, 0x32003232, 0x69006969,
 218      0x08000808, 0x62006262, 0x00000000, 0x24002424, 0xd100d1d1, 0xfb00fbfb,
 219      0xba00baba, 0xed00eded, 0x45004545, 0x81008181, 0x73007373, 0x6d006d6d,
 220      0x84008484, 0x9f009f9f, 0xee00eeee, 0x4a004a4a, 0xc300c3c3, 0x2e002e2e,
 221      0xc100c1c1, 0x01000101, 0xe600e6e6, 0x25002525, 0x48004848, 0x99009999,
 222      0xb900b9b9, 0xb300b3b3, 0x7b007b7b, 0xf900f9f9, 0xce00cece, 0xbf00bfbf,
 223      0xdf00dfdf, 0x71007171, 0x29002929, 0xcd00cdcd, 0x6c006c6c, 0x13001313,
 224      0x64006464, 0x9b009b9b, 0x63006363, 0x9d009d9d, 0xc000c0c0, 0x4b004b4b,
 225      0xb700b7b7, 0xa500a5a5, 0x89008989, 0x5f005f5f, 0xb100b1b1, 0x17001717,
 226      0xf400f4f4, 0xbc00bcbc, 0xd300d3d3, 0x46004646, 0xcf00cfcf, 0x37003737,
 227      0x5e005e5e, 0x47004747, 0x94009494, 0xfa00fafa, 0xfc00fcfc, 0x5b005b5b,
 228      0x97009797, 0xfe00fefe, 0x5a005a5a, 0xac00acac, 0x3c003c3c, 0x4c004c4c,
 229      0x03000303, 0x35003535, 0xf300f3f3, 0x23002323, 0xb800b8b8, 0x5d005d5d,
 230      0x6a006a6a, 0x92009292, 0xd500d5d5, 0x21002121, 0x44004444, 0x51005151,
 231      0xc600c6c6, 0x7d007d7d, 0x39003939, 0x83008383, 0xdc00dcdc, 0xaa00aaaa,
 232      0x7c007c7c, 0x77007777, 0x56005656, 0x05000505, 0x1b001b1b, 0xa400a4a4,
 233      0x15001515, 0x34003434, 0x1e001e1e, 0x1c001c1c, 0xf800f8f8, 0x52005252,
 234      0x20002020, 0x14001414, 0xe900e9e9, 0xbd00bdbd, 0xdd00dddd, 0xe400e4e4,
 235      0xa100a1a1, 0xe000e0e0, 0x8a008a8a, 0xf100f1f1, 0xd600d6d6, 0x7a007a7a,
 236      0xbb00bbbb, 0xe300e3e3, 0x40004040, 0x4f004f4f}
 237 };
 238
 239 /* Key generation constants */
 240 static const u32 SIGMA[] = {
 241     0xa09e667f, 0x3bcc908b, 0xb67ae858, 0x4caa73b2, 0xc6ef372f, 0xe94f82be,
 242     0x54ff53a5, 0xf1d36f1c, 0x10e527fa, 0xde682d1d, 0xb05688c2, 0xb3e6c1fd
 243 };
 244
 245 /* The phi algorithm given in C.2.7 of the Camellia spec document. */
 246 /*
 247  * This version does not attempt to minimize amount of temporary
 248  * variables, but instead explicitly exposes algorithm's parallelism.
 249  * It is therefore most appropriate for platforms with not less than
 250  * ~16 registers. For platforms with less registers [well, x86 to be
 251  * specific] assembler version should be/is provided anyway...
 252  */
 253 #define Camellia_Feistel(_s0,_s1,_s2,_s3,_key) do {\
 254         register u32 _t0,_t1,_t2,_t3;\
 255 \
 256         _t0  = _s0 ^ (_key)[0];\
 257         _t3  = SBOX4_4404[_t0&0xff];\
 258         _t1  = _s1 ^ (_key)[1];\
 259         _t3 ^= SBOX3_3033[(_t0 >> 8)&0xff];\
 260         _t2  = SBOX1_1110[_t1&0xff];\
 261         _t3 ^= SBOX2_0222[(_t0 >> 16)&0xff];\
 262         _t2 ^= SBOX4_4404[(_t1 >> 8)&0xff];\
 263         _t3 ^= SBOX1_1110[(_t0 >> 24)];\
 264         _t2 ^= _t3;\
 265         _t3  = RightRotate(_t3,8);\
 266         _t2 ^= SBOX3_3033[(_t1 >> 16)&0xff];\
 267         _s3 ^= _t3;\
 268         _t2 ^= SBOX2_0222[(_t1 >> 24)];\
 269         _s2 ^= _t2; \
 270         _s3 ^= _t2;\
 271 } while(0)
 272
 273 /*
 274  * Note that n has to be less than 32. Rotations for larger amount
 275  * of bits are achieved by "rotating" order of s-elements and
 276  * adjusting n accordingly, e.g. RotLeft128(s1,s2,s3,s0,n-32).
 277  */
 278 #define RotLeft128(_s0,_s1,_s2,_s3,_n) do {\
 279         u32 _t0=_s0>>(32-_n);\
 280         _s0 = (_s0<<_n) | (_s1>>(32-_n));\
 281         _s1 = (_s1<<_n) | (_s2>>(32-_n));\
 282         _s2 = (_s2<<_n) | (_s3>>(32-_n));\
 283         _s3 = (_s3<<_n) | _t0;\
 284 } while (0)
 285
 286 int Camellia_Ekeygen(int keyBitLength, const u8 *rawKey, KEY_TABLE_TYPE k)
 287 {
 288     register u32 s0, s1, s2, s3;
 289
 290     k[0] = s0 = GETU32(rawKey);
 291     k[1] = s1 = GETU32(rawKey + 4);
 292     k[2] = s2 = GETU32(rawKey + 8);
 293     k[3] = s3 = GETU32(rawKey + 12);
 294
 295     if (keyBitLength != 128) {
 296         k[8] = s0 = GETU32(rawKey + 16);
 297         k[9] = s1 = GETU32(rawKey + 20);
 298         if (keyBitLength == 192) {
 299             k[10] = s2 = ~s0;
 300             k[11] = s3 = ~s1;
 301         } else {
 302             k[10] = s2 = GETU32(rawKey + 24);
 303             k[11] = s3 = GETU32(rawKey + 28);
 304         }
 305         s0 ^= k[0], s1 ^= k[1], s2 ^= k[2], s3 ^= k[3];
 306     }
 307
 308     /* Use the Feistel routine to scramble the key material */
 309     Camellia_Feistel(s0, s1, s2, s3, SIGMA + 0);
 310     Camellia_Feistel(s2, s3, s0, s1, SIGMA + 2);
 311
 312     s0 ^= k[0], s1 ^= k[1], s2 ^= k[2], s3 ^= k[3];
 313     Camellia_Feistel(s0, s1, s2, s3, SIGMA + 4);
 314     Camellia_Feistel(s2, s3, s0, s1, SIGMA + 6);
 315
 316     /* Fill the keyTable. Requires many block rotations. */
 317     if (keyBitLength == 128) {
 318         k[4] = s0, k[5] = s1, k[6] = s2, k[7] = s3;
 319         RotLeft128(s0, s1, s2, s3, 15); /* KA <<< 15 */
 320         k[12] = s0, k[13] = s1, k[14] = s2, k[15] = s3;
 321         RotLeft128(s0, s1, s2, s3, 15); /* KA <<< 30 */
 322         k[16] = s0, k[17] = s1, k[18] = s2, k[19] = s3;
 323         RotLeft128(s0, s1, s2, s3, 15); /* KA <<< 45 */
 324         k[24] = s0, k[25] = s1;
 325         RotLeft128(s0, s1, s2, s3, 15); /* KA <<< 60 */
 326         k[28] = s0, k[29] = s1, k[30] = s2, k[31] = s3;
 327         RotLeft128(s1, s2, s3, s0, 2); /* KA <<< 94 */
 328         k[40] = s1, k[41] = s2, k[42] = s3, k[43] = s0;
 329         RotLeft128(s1, s2, s3, s0, 17); /* KA <<<111 */
 330         k[48] = s1, k[49] = s2, k[50] = s3, k[51] = s0;
 331
 332         s0 = k[0], s1 = k[1], s2 = k[2], s3 = k[3];
 333         RotLeft128(s0, s1, s2, s3, 15); /* KL <<< 15 */
 334         k[8] = s0, k[9] = s1, k[10] = s2, k[11] = s3;
 335         RotLeft128(s0, s1, s2, s3, 30); /* KL <<< 45 */
 336         k[20] = s0, k[21] = s1, k[22] = s2, k[23] = s3;
 337         RotLeft128(s0, s1, s2, s3, 15); /* KL <<< 60 */
 338         k[26] = s2, k[27] = s3;
 339         RotLeft128(s0, s1, s2, s3, 17); /* KL <<< 77 */
 340         k[32] = s0, k[33] = s1, k[34] = s2, k[35] = s3;
 341         RotLeft128(s0, s1, s2, s3, 17); /* KL <<< 94 */
 342         k[36] = s0, k[37] = s1, k[38] = s2, k[39] = s3;
 343         RotLeft128(s0, s1, s2, s3, 17); /* KL <<<111 */
 344         k[44] = s0, k[45] = s1, k[46] = s2, k[47] = s3;
 345
 346         return 3;               /* grand rounds */
 347     } else {
 348         k[12] = s0, k[13] = s1, k[14] = s2, k[15] = s3;
 349         s0 ^= k[8], s1 ^= k[9], s2 ^= k[10], s3 ^= k[11];
 350         Camellia_Feistel(s0, s1, s2, s3, (SIGMA + 8));
 351         Camellia_Feistel(s2, s3, s0, s1, (SIGMA + 10));
 352
 353         k[4] = s0, k[5] = s1, k[6] = s2, k[7] = s3;
 354         RotLeft128(s0, s1, s2, s3, 30); /* KB <<< 30 */
 355         k[20] = s0, k[21] = s1, k[22] = s2, k[23] = s3;
 356         RotLeft128(s0, s1, s2, s3, 30); /* KB <<< 60 */
 357         k[40] = s0, k[41] = s1, k[42] = s2, k[43] = s3;
 358         RotLeft128(s1, s2, s3, s0, 19); /* KB <<<111 */
 359         k[64] = s1, k[65] = s2, k[66] = s3, k[67] = s0;
 360
 361         s0 = k[8], s1 = k[9], s2 = k[10], s3 = k[11];
 362         RotLeft128(s0, s1, s2, s3, 15); /* KR <<< 15 */
 363         k[8] = s0, k[9] = s1, k[10] = s2, k[11] = s3;
 364         RotLeft128(s0, s1, s2, s3, 15); /* KR <<< 30 */
 365         k[16] = s0, k[17] = s1, k[18] = s2, k[19] = s3;
 366         RotLeft128(s0, s1, s2, s3, 30); /* KR <<< 60 */
 367         k[36] = s0, k[37] = s1, k[38] = s2, k[39] = s3;
 368         RotLeft128(s1, s2, s3, s0, 2); /* KR <<< 94 */
 369         k[52] = s1, k[53] = s2, k[54] = s3, k[55] = s0;
 370
 371         s0 = k[12], s1 = k[13], s2 = k[14], s3 = k[15];
 372         RotLeft128(s0, s1, s2, s3, 15); /* KA <<< 15 */
 373         k[12] = s0, k[13] = s1, k[14] = s2, k[15] = s3;
 374         RotLeft128(s0, s1, s2, s3, 30); /* KA <<< 45 */
 375         k[28] = s0, k[29] = s1, k[30] = s2, k[31] = s3;
 376         /* KA <<< 77 */
 377         k[48] = s1, k[49] = s2, k[50] = s3, k[51] = s0;
 378         RotLeft128(s1, s2, s3, s0, 17); /* KA <<< 94 */
 379         k[56] = s1, k[57] = s2, k[58] = s3, k[59] = s0;
 380
 381         s0 = k[0], s1 = k[1], s2 = k[2], s3 = k[3];
 382         RotLeft128(s1, s2, s3, s0, 13); /* KL <<< 45 */
 383         k[24] = s1, k[25] = s2, k[26] = s3, k[27] = s0;
 384         RotLeft128(s1, s2, s3, s0, 15); /* KL <<< 60 */
 385         k[32] = s1, k[33] = s2, k[34] = s3, k[35] = s0;
 386         RotLeft128(s1, s2, s3, s0, 17); /* KL <<< 77 */
 387         k[44] = s1, k[45] = s2, k[46] = s3, k[47] = s0;
 388         RotLeft128(s2, s3, s0, s1, 2); /* KL <<<111 */
 389         k[60] = s2, k[61] = s3, k[62] = s0, k[63] = s1;
 390
 391         return 4;               /* grand rounds */
 392     }
 393     /*
 394      * It is possible to perform certain precalculations, which
 395      * would spare few cycles in block procedure. It's not done,
 396      * because it upsets the performance balance between key
 397      * setup and block procedures, negatively affecting overall
 398      * throughput in applications operating on short messages
 399      * and volatile keys.
 400      */
 401 }
 402
 403 void Camellia_EncryptBlock_Rounds(int grandRounds, const u8 plaintext[],
 404                                   const KEY_TABLE_TYPE keyTable,
 405                                   u8 ciphertext[])
 406 {
 407     register u32 s0, s1, s2, s3;
 408     const u32 *k = keyTable, *kend = keyTable + grandRounds * 16;
 409
 410     s0 = GETU32(plaintext) ^ k[0];
 411     s1 = GETU32(plaintext + 4) ^ k[1];
 412     s2 = GETU32(plaintext + 8) ^ k[2];
 413     s3 = GETU32(plaintext + 12) ^ k[3];
 414     k += 4;
 415
 416     while (1) {
 417         /* Camellia makes 6 Feistel rounds */
 418         Camellia_Feistel(s0, s1, s2, s3, k + 0);
 419         Camellia_Feistel(s2, s3, s0, s1, k + 2);
 420         Camellia_Feistel(s0, s1, s2, s3, k + 4);
 421         Camellia_Feistel(s2, s3, s0, s1, k + 6);
 422         Camellia_Feistel(s0, s1, s2, s3, k + 8);
 423         Camellia_Feistel(s2, s3, s0, s1, k + 10);
 424         k += 12;
 425
 426         if (k == kend)
 427             break;
 428
 429         /*
 430          * This is the same function as the diffusion function D of the
 431          * accompanying documentation. See section 3.2 for properties of the
 432          * FLlayer function.
 433          */
 434         s1 ^= LeftRotate(s0 & k[0], 1);
 435         s2 ^= s3 | k[3];
 436         s0 ^= s1 | k[1];
 437         s3 ^= LeftRotate(s2 & k[2], 1);
 438         k += 4;
 439     }
 440
 441     s2 ^= k[0], s3 ^= k[1], s0 ^= k[2], s1 ^= k[3];
 442
 443     PUTU32(ciphertext, s2);
 444     PUTU32(ciphertext + 4, s3);
 445     PUTU32(ciphertext + 8, s0);
 446     PUTU32(ciphertext + 12, s1);
 447 }
 448
 449 void Camellia_EncryptBlock(int keyBitLength, const u8 plaintext[],
 450                            const KEY_TABLE_TYPE keyTable, u8 ciphertext[])
 451 {
 452     Camellia_EncryptBlock_Rounds(keyBitLength == 128 ? 3 : 4,
 453                                  plaintext, keyTable, ciphertext);
 454 }
 455
 456 void Camellia_DecryptBlock_Rounds(int grandRounds, const u8 ciphertext[],
 457                                   const KEY_TABLE_TYPE keyTable,
 458                                   u8 plaintext[])
 459 {
 460     u32 s0, s1, s2, s3;
 461     const u32 *k = keyTable + grandRounds * 16, *kend = keyTable + 4;
 462
 463     s0 = GETU32(ciphertext) ^ k[0];
 464     s1 = GETU32(ciphertext + 4) ^ k[1];
 465     s2 = GETU32(ciphertext + 8) ^ k[2];
 466     s3 = GETU32(ciphertext + 12) ^ k[3];
 467
 468     while (1) {
 469         /* Camellia makes 6 Feistel rounds */
 470         k -= 12;
 471         Camellia_Feistel(s0, s1, s2, s3, k + 10);
 472         Camellia_Feistel(s2, s3, s0, s1, k + 8);
 473         Camellia_Feistel(s0, s1, s2, s3, k + 6);
 474         Camellia_Feistel(s2, s3, s0, s1, k + 4);
 475         Camellia_Feistel(s0, s1, s2, s3, k + 2);
 476         Camellia_Feistel(s2, s3, s0, s1, k + 0);
 477
 478         if (k == kend)
 479             break;
 480
 481         /*
 482          * This is the same function as the diffusion function D of the
 483          * accompanying documentation. See section 3.2 for properties of the
 484          * FLlayer function.
 485          */
 486         k -= 4;
 487         s1 ^= LeftRotate(s0 & k[2], 1);
 488         s2 ^= s3 | k[1];
 489         s0 ^= s1 | k[3];
 490         s3 ^= LeftRotate(s2 & k[0], 1);
 491     }
 492
 493     k -= 4;
 494     s2 ^= k[0], s3 ^= k[1], s0 ^= k[2], s1 ^= k[3];
 495
 496     PUTU32(plaintext, s2);
 497     PUTU32(plaintext + 4, s3);
 498     PUTU32(plaintext + 8, s0);
 499     PUTU32(plaintext + 12, s1);
 500 }
 501
 502 void Camellia_DecryptBlock(int keyBitLength, const u8 ciphertext[],
 503                            const KEY_TABLE_TYPE keyTable, u8 plaintext[])
 504 {
 505     Camellia_DecryptBlock_Rounds(keyBitLength == 128 ? 3 : 4,
 506                                  ciphertext, keyTable, plaintext);
 507 }