2N/A/*
2N/A * CDDL HEADER START
2N/A *
2N/A * The contents of this file are subject to the terms of the
2N/A * Common Development and Distribution License (the "License").
2N/A * You may not use this file except in compliance with the License.
2N/A *
2N/A * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
2N/A * or http://www.opensolaris.org/os/licensing.
2N/A * See the License for the specific language governing permissions
2N/A * and limitations under the License.
2N/A *
2N/A * When distributing Covered Code, include this CDDL HEADER in each
2N/A * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
2N/A * If applicable, add the following below this CDDL HEADER, with the
2N/A * fields enclosed by brackets "[]" replaced with your own identifying
2N/A * information: Portions Copyright [yyyy] [name of copyright owner]
2N/A *
2N/A * CDDL HEADER END
2N/A */
2N/A
2N/A/*
2N/A * Copyright 2008 Sun Microsystems, Inc. All rights reserved.
2N/A * Use is subject to license terms.
2N/A */
2N/A
2N/A/* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
2N/A/* All Rights Reserved */
2N/A
2N/A/*
2N/A * Portions of this source code were derived from Berkeley 4.3 BSD
2N/A * under license from the Regents of the University of California.
2N/A */
2N/A
2N/A#pragma ident "%Z%%M% %I% %E% SMI"
2N/A
2N/A/*
2N/A * Warning! Things are arranged very carefully in this file to
2N/A * allow read-only data to be moved to the text segment. The
2N/A * various DES tables must appear before any function definitions
2N/A * (this is arranged by including them immediately below) and partab
2N/A * must also appear before and function definitions
2N/A * This arrangement allows all data up through the first text to
2N/A * be moved to text.
2N/A */
2N/A
2N/A#ifndef _KERNEL
2N/A#define CRYPT /* cannot configure out of user-level code */
2N/A#endif
2N/A
2N/A#ifdef CRYPT
2N/A#include <sys/types.h>
2N/A#include <des/softdes.h>
2N/A#include <des/desdata.h>
2N/A
2N/A#ifdef sun
2N/A#include <sys/ioctl.h>
2N/A#include <sys/des.h>
2N/A#else
2N/A#include <des/des.h>
2N/A#endif
2N/A
2N/A#include "des_soft.h"
2N/A
2N/A/*
2N/A * Fast (?) software implementation of DES
2N/A * Has been seen going at 2000 bytes/sec on a Sun-2
2N/A * Works on a VAX too.
2N/A * Won't work without 8 bit chars and 32 bit longs
2N/A */
2N/A
2N/A#define btst(k, b) (k[b >> 3] & (0x80 >> (b & 07)))
2N/A#define BIT28 (1<<28)
2N/A
2N/A
2N/A#endif /* def CRYPT */
2N/A
2N/Astatic void des_setkey(uchar_t [8], struct deskeydata *, unsigned);
2N/Astatic void des_encrypt(uchar_t *, struct deskeydata *);
2N/A
2N/A#ifndef _KERNEL
2N/A/*
2N/A * Table giving odd parity in the low bit for ASCII characters
2N/A */
2N/Astatic char partab[128] = {
2N/A 0x01, 0x01, 0x02, 0x02, 0x04, 0x04, 0x07, 0x07,
2N/A 0x08, 0x08, 0x0b, 0x0b, 0x0d, 0x0d, 0x0e, 0x0e,
2N/A 0x10, 0x10, 0x13, 0x13, 0x15, 0x15, 0x16, 0x16,
2N/A 0x19, 0x19, 0x1a, 0x1a, 0x1c, 0x1c, 0x1f, 0x1f,
2N/A 0x20, 0x20, 0x23, 0x23, 0x25, 0x25, 0x26, 0x26,
2N/A 0x29, 0x29, 0x2a, 0x2a, 0x2c, 0x2c, 0x2f, 0x2f,
2N/A 0x31, 0x31, 0x32, 0x32, 0x34, 0x34, 0x37, 0x37,
2N/A 0x38, 0x38, 0x3b, 0x3b, 0x3d, 0x3d, 0x3e, 0x3e,
2N/A 0x40, 0x40, 0x43, 0x43, 0x45, 0x45, 0x46, 0x46,
2N/A 0x49, 0x49, 0x4a, 0x4a, 0x4c, 0x4c, 0x4f, 0x4f,
2N/A 0x51, 0x51, 0x52, 0x52, 0x54, 0x54, 0x57, 0x57,
2N/A 0x58, 0x58, 0x5b, 0x5b, 0x5d, 0x5d, 0x5e, 0x5e,
2N/A 0x61, 0x61, 0x62, 0x62, 0x64, 0x64, 0x67, 0x67,
2N/A 0x68, 0x68, 0x6b, 0x6b, 0x6d, 0x6d, 0x6e, 0x6e,
2N/A 0x70, 0x70, 0x73, 0x73, 0x75, 0x75, 0x76, 0x76,
2N/A 0x79, 0x79, 0x7a, 0x7a, 0x7c, 0x7c, 0x7f, 0x7f,
2N/A};
2N/A
2N/A
2N/A
2N/A/*
2N/A * Add odd parity to low bit of 8 byte key
2N/A */
2N/Avoid
2N/Ades_setparity(char *p)
2N/A{
2N/A int i;
2N/A
2N/A for (i = 0; i < 8; i++) {
2N/A *p = partab[*p & 0x7f];
2N/A p++;
2N/A }
2N/A}
2N/A#endif /* def _KERNEL */
2N/A
2N/A#ifdef CRYPT
2N/A/*
2N/A * Software encrypt or decrypt a block of data (multiple of 8 bytes)
2N/A * Do the CBC ourselves if needed.
2N/A */
2N/Aint
2N/A__des_crypt(char *buf, unsigned int len, struct desparams *desp)
2N/A{
2N/A/* EXPORT DELETE START */
2N/A short i;
2N/A unsigned mode;
2N/A unsigned dir;
2N/A char nextiv[8];
2N/A struct deskeydata softkey;
2N/A
2N/A mode = (unsigned)desp->des_mode;
2N/A dir = (unsigned)desp->des_dir;
2N/A des_setkey(desp->des_key, &softkey, dir);
2N/A while (len != 0) {
2N/A switch (mode) {
2N/A case CBC:
2N/A switch (dir) {
2N/A case ENCRYPT:
2N/A for (i = 0; i < 8; i++)
2N/A buf[i] ^= desp->des_ivec[i];
2N/A des_encrypt((uchar_t *)buf, &softkey);
2N/A for (i = 0; i < 8; i++)
2N/A desp->des_ivec[i] = buf[i];
2N/A break;
2N/A case DECRYPT:
2N/A for (i = 0; i < 8; i++)
2N/A nextiv[i] = buf[i];
2N/A des_encrypt((uchar_t *)buf, &softkey);
2N/A for (i = 0; i < 8; i++) {
2N/A buf[i] ^= desp->des_ivec[i];
2N/A desp->des_ivec[i] = nextiv[i];
2N/A }
2N/A break;
2N/A }
2N/A break;
2N/A case ECB:
2N/A des_encrypt((uchar_t *)buf, &softkey);
2N/A break;
2N/A }
2N/A buf += 8;
2N/A len -= 8;
2N/A }
2N/A/* EXPORT DELETE END */
2N/A return (1);
2N/A}
2N/A
2N/A
2N/A/*
2N/A * Set the key and direction for an encryption operation
2N/A * We build the 16 key entries here
2N/A */
2N/Astatic void
2N/Ades_setkey(uchar_t userkey[8], struct deskeydata *kd, unsigned int dir)
2N/A{
2N/A/* EXPORT DELETE START */
2N/A long C, D;
2N/A short i;
2N/A
2N/A /*
2N/A * First, generate C and D by permuting
2N/A * the key. The low order bit of each
2N/A * 8-bit char is not used, so C and D are only 28
2N/A * bits apiece.
2N/A */
2N/A {
2N/A short bit;
2N/A const short *pcc = PC1_C, *pcd = PC1_D;
2N/A
2N/A C = D = 0;
2N/A for (i = 0; i < 28; i++) {
2N/A C <<= 1;
2N/A D <<= 1;
2N/A bit = *pcc++;
2N/A if (btst(userkey, bit))
2N/A C |= 1;
2N/A bit = *pcd++;
2N/A if (btst(userkey, bit))
2N/A D |= 1;
2N/A }
2N/A }
2N/A /*
2N/A * To generate Ki, rotate C and D according
2N/A * to schedule and pick up a permutation
2N/A * using PC2.
2N/A */
2N/A for (i = 0; i < 16; i++) {
2N/A chunk_t *c;
2N/A short j, k, bit;
2N/A long bbit;
2N/A
2N/A /*
2N/A * Do the "left shift" (rotate)
2N/A * We know we always rotate by either 1 or 2 bits
2N/A * the shifts table tells us if its 2
2N/A */
2N/A C <<= 1;
2N/A if (C & BIT28)
2N/A C |= 1;
2N/A D <<= 1;
2N/A if (D & BIT28)
2N/A D |= 1;
2N/A if (shifts[i]) {
2N/A C <<= 1;
2N/A if (C & BIT28)
2N/A C |= 1;
2N/A D <<= 1;
2N/A if (D & BIT28)
2N/A D |= 1;
2N/A }
2N/A /*
2N/A * get Ki. Note C and D are concatenated.
2N/A */
2N/A bit = 0;
2N/A switch (dir) {
2N/A case ENCRYPT:
2N/A c = &kd->keyval[i]; break;
2N/A case DECRYPT:
2N/A c = &kd->keyval[15 - i]; break;
2N/A }
2N/A c->long0 = 0;
2N/A c->long1 = 0;
2N/A bbit = (1 << 5) << 24;
2N/A for (j = 0; j < 4; j++) {
2N/A for (k = 0; k < 6; k++) {
2N/A if (C & (BIT28 >> PC2_C[bit]))
2N/A c->long0 |= bbit >> k;
2N/A if (D & (BIT28 >> PC2_D[bit]))
2N/A c->long1 |= bbit >> k;
2N/A bit++;
2N/A }
2N/A bbit >>= 8;
2N/A }
2N/A
2N/A }
2N/A/* EXPORT DELETE END */
2N/A}
2N/A
2N/A
2N/A
2N/A/*
2N/A * Do an encryption operation
2N/A * Much pain is taken (with preprocessor) to avoid loops so the compiler
2N/A * can do address arithmetic instead of doing it at runtime.
2N/A * Note that the byte-to-chunk conversion is necessary to guarantee
2N/A * processor byte-order independence.
2N/A */
2N/Astatic void
2N/Ades_encrypt(uchar_t *data, struct deskeydata *kd)
2N/A{
2N/A/* EXPORT DELETE START */
2N/A chunk_t work1, work2;
2N/A
2N/A /*
2N/A * Initial permutation
2N/A * and byte to chunk conversion
2N/A */
2N/A {
2N/A const uint32_t *lp;
2N/A uint32_t l0, l1, w;
2N/A short i, pbit;
2N/A
2N/A work1.byte0 = data[0];
2N/A work1.byte1 = data[1];
2N/A work1.byte2 = data[2];
2N/A work1.byte3 = data[3];
2N/A work1.byte4 = data[4];
2N/A work1.byte5 = data[5];
2N/A work1.byte6 = data[6];
2N/A work1.byte7 = data[7];
2N/A l0 = l1 = 0;
2N/A w = work1.long0;
2N/A for (lp = &longtab[0], i = 0; i < 32; i++) {
2N/A if (w & *lp++) {
2N/A pbit = IPtab[i];
2N/A if (pbit < 32)
2N/A l0 |= longtab[pbit];
2N/A else
2N/A l1 |= longtab[pbit-32];
2N/A }
2N/A }
2N/A w = work1.long1;
2N/A for (lp = &longtab[0], i = 32; i < 64; i++) {
2N/A if (w & *lp++) {
2N/A pbit = IPtab[i];
2N/A if (pbit < 32)
2N/A l0 |= longtab[pbit];
2N/A else
2N/A l1 |= longtab[pbit-32];
2N/A }
2N/A }
2N/A work2.long0 = l0;
2N/A work2.long1 = l1;
2N/A }
2N/A
2N/A/*
2N/A * Expand 8 bits of 32 bit R to 48 bit R
2N/A */
2N/A#define do_R_to_ER(op, b) { \
2N/A const struct R_to_ER *p = &R_to_ER_tab[b][R.byte##b]; \
2N/A e0 op p->l0; \
2N/A e1 op p->l1; \
2N/A}
2N/A
2N/A/*
2N/A * Inner part of the algorithm:
2N/A * Expand R from 32 to 48 bits; xor key value;
2N/A * apply S boxes; permute 32 bits of output
2N/A */
2N/A#define do_F(iter, inR, outR) { \
2N/A chunk_t R, ER; \
2N/A uint32_t e0, e1; \
2N/A R.long0 = inR; \
2N/A /* CSTYLED */ \
2N/A do_R_to_ER(=, 0); \
2N/A /* CSTYLED */ \
2N/A do_R_to_ER(|=, 1); \
2N/A /* CSTYLED */ \
2N/A do_R_to_ER(|=, 2); \
2N/A /* CSTYLED */ \
2N/A do_R_to_ER(|=, 3); \
2N/A ER.long0 = e0 ^ kd->keyval[iter].long0; \
2N/A ER.long1 = e1 ^ kd->keyval[iter].long1; \
2N/A R.long0 = \
2N/A S_tab[0][ER.byte0] + \
2N/A S_tab[1][ER.byte1] + \
2N/A S_tab[2][ER.byte2] + \
2N/A S_tab[3][ER.byte3] + \
2N/A S_tab[4][ER.byte4] + \
2N/A S_tab[5][ER.byte5] + \
2N/A S_tab[6][ER.byte6] + \
2N/A S_tab[7][ER.byte7]; \
2N/A outR = \
2N/A P_tab[0][R.byte0] + \
2N/A P_tab[1][R.byte1] + \
2N/A P_tab[2][R.byte2] + \
2N/A P_tab[3][R.byte3]; \
2N/A}
2N/A
2N/A/*
2N/A * Do a cipher step
2N/A * Apply inner part; do xor and exchange of 32 bit parts
2N/A */
2N/A#define cipher(iter, inR, inL, outR, outL) { \
2N/A do_F(iter, inR, outR); \
2N/A outR ^= inL; \
2N/A outL = inR; \
2N/A}
2N/A
2N/A /*
2N/A * Apply the 16 ciphering steps
2N/A */
2N/A {
2N/A uint32_t r0, l0, r1, l1;
2N/A
2N/A l0 = work2.long0;
2N/A r0 = work2.long1;
2N/A cipher(0, r0, l0, r1, l1);
2N/A cipher(1, r1, l1, r0, l0);
2N/A cipher(2, r0, l0, r1, l1);
2N/A cipher(3, r1, l1, r0, l0);
2N/A cipher(4, r0, l0, r1, l1);
2N/A cipher(5, r1, l1, r0, l0);
2N/A cipher(6, r0, l0, r1, l1);
2N/A cipher(7, r1, l1, r0, l0);
2N/A cipher(8, r0, l0, r1, l1);
2N/A cipher(9, r1, l1, r0, l0);
2N/A cipher(10, r0, l0, r1, l1);
2N/A cipher(11, r1, l1, r0, l0);
2N/A cipher(12, r0, l0, r1, l1);
2N/A cipher(13, r1, l1, r0, l0);
2N/A cipher(14, r0, l0, r1, l1);
2N/A cipher(15, r1, l1, r0, l0);
2N/A work1.long0 = r0;
2N/A work1.long1 = l0;
2N/A }
2N/A
2N/A /*
2N/A * Final permutation
2N/A * and chunk to byte conversion
2N/A */
2N/A {
2N/A const uint32_t *lp;
2N/A uint32_t l0, l1, w;
2N/A short i, pbit;
2N/A
2N/A l0 = l1 = 0;
2N/A w = work1.long0;
2N/A for (lp = &longtab[0], i = 0; i < 32; i++) {
2N/A if (w & *lp++) {
2N/A pbit = FPtab[i];
2N/A if (pbit < 32)
2N/A l0 |= longtab[pbit];
2N/A else
2N/A l1 |= longtab[pbit-32];
2N/A }
2N/A }
2N/A w = work1.long1;
2N/A for (lp = &longtab[0], i = 32; i < 64; i++) {
2N/A if (w & *lp++) {
2N/A pbit = FPtab[i];
2N/A if (pbit < 32)
2N/A l0 |= longtab[pbit];
2N/A else
2N/A l1 |= longtab[pbit-32];
2N/A }
2N/A }
2N/A work2.long0 = l0;
2N/A work2.long1 = l1;
2N/A }
2N/A data[0] = work2.byte0;
2N/A data[1] = work2.byte1;
2N/A data[2] = work2.byte2;
2N/A data[3] = work2.byte3;
2N/A data[4] = work2.byte4;
2N/A data[5] = work2.byte5;
2N/A data[6] = work2.byte6;
2N/A data[7] = work2.byte7;
2N/A
2N/A/* EXPORT DELETE END */
2N/A}
2N/A#endif /* def CRYPT */