1 // SPDX-License-Identifier: BSD-2-Clause 2 /* LibTomCrypt, modular cryptographic library -- Tom St Denis 3 * 4 * LibTomCrypt is a library that provides various cryptographic 5 * algorithms in a highly modular and flexible manner. 6 * 7 * The library is free for all purposes without any express 8 * guarantee it works. 9 */ 10 11 /** 12 @file kasumi.c 13 Implementation of the 3GPP Kasumi block cipher 14 Derived from the 3GPP standard source code 15 */ 16 17 #include "tomcrypt_private.h" 18 19 #ifdef LTC_KASUMI 20 21 typedef unsigned u16; 22 23 #define ROL16(x, y) ((((x)<<(y)) | ((x)>>(16-(y)))) & 0xFFFF) 24 25 const struct ltc_cipher_descriptor kasumi_desc = { 26 "kasumi", 27 21, 28 16, 16, 8, 8, 29 &kasumi_setup, 30 &kasumi_ecb_encrypt, 31 &kasumi_ecb_decrypt, 32 &kasumi_test, 33 &kasumi_done, 34 &kasumi_keysize, 35 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL 36 }; 37 38 static u16 FI( u16 in, u16 subkey ) 39 { 40 u16 nine, seven; 41 static const u16 S7[128] = { 42 54, 50, 62, 56, 22, 34, 94, 96, 38, 6, 63, 93, 2, 18,123, 33, 43 55,113, 39,114, 21, 67, 65, 12, 47, 73, 46, 27, 25,111,124, 81, 44 53, 9,121, 79, 52, 60, 58, 48,101,127, 40,120,104, 70, 71, 43, 45 20,122, 72, 61, 23,109, 13,100, 77, 1, 16, 7, 82, 10,105, 98, 46 117,116, 76, 11, 89,106, 0,125,118, 99, 86, 69, 30, 57,126, 87, 47 112, 51, 17, 5, 95, 14, 90, 84, 91, 8, 35,103, 32, 97, 28, 66, 48 102, 31, 26, 45, 75, 4, 85, 92, 37, 74, 80, 49, 68, 29,115, 44, 49 64,107,108, 24,110, 83, 36, 78, 42, 19, 15, 41, 88,119, 59, 3 }; 50 static const u16 S9[512] = { 51 167,239,161,379,391,334, 9,338, 38,226, 48,358,452,385, 90,397, 52 183,253,147,331,415,340, 51,362,306,500,262, 82,216,159,356,177, 53 175,241,489, 37,206, 17, 0,333, 44,254,378, 58,143,220, 81,400, 54 95, 3,315,245, 54,235,218,405,472,264,172,494,371,290,399, 76, 55 165,197,395,121,257,480,423,212,240, 28,462,176,406,507,288,223, 56 501,407,249,265, 89,186,221,428,164, 74,440,196,458,421,350,163, 57 232,158,134,354, 13,250,491,142,191, 69,193,425,152,227,366,135, 58 344,300,276,242,437,320,113,278, 11,243, 87,317, 36, 93,496, 27, 59 487,446,482, 41, 68,156,457,131,326,403,339, 20, 39,115,442,124, 60 475,384,508, 53,112,170,479,151,126,169, 73,268,279,321,168,364, 61 363,292, 46,499,393,327,324, 24,456,267,157,460,488,426,309,229, 62 439,506,208,271,349,401,434,236, 16,209,359, 52, 56,120,199,277, 63 465,416,252,287,246, 6, 83,305,420,345,153,502, 65, 61,244,282, 64 173,222,418, 67,386,368,261,101,476,291,195,430, 49, 79,166,330, 65 280,383,373,128,382,408,155,495,367,388,274,107,459,417, 62,454, 66 132,225,203,316,234, 14,301, 91,503,286,424,211,347,307,140,374, 67 35,103,125,427, 19,214,453,146,498,314,444,230,256,329,198,285, 68 50,116, 78,410, 10,205,510,171,231, 45,139,467, 29, 86,505, 32, 69 72, 26,342,150,313,490,431,238,411,325,149,473, 40,119,174,355, 70 185,233,389, 71,448,273,372, 55,110,178,322, 12,469,392,369,190, 71 1,109,375,137,181, 88, 75,308,260,484, 98,272,370,275,412,111, 72 336,318, 4,504,492,259,304, 77,337,435, 21,357,303,332,483, 18, 73 47, 85, 25,497,474,289,100,269,296,478,270,106, 31,104,433, 84, 74 414,486,394, 96, 99,154,511,148,413,361,409,255,162,215,302,201, 75 266,351,343,144,441,365,108,298,251, 34,182,509,138,210,335,133, 76 311,352,328,141,396,346,123,319,450,281,429,228,443,481, 92,404, 77 485,422,248,297, 23,213,130,466, 22,217,283, 70,294,360,419,127, 78 312,377, 7,468,194, 2,117,295,463,258,224,447,247,187, 80,398, 79 284,353,105,390,299,471,470,184, 57,200,348, 63,204,188, 33,451, 80 97, 30,310,219, 94,160,129,493, 64,179,263,102,189,207,114,402, 81 438,477,387,122,192, 42,381, 5,145,118,180,449,293,323,136,380, 82 43, 66, 60,455,341,445,202,432, 8,237, 15,376,436,464, 59,461}; 83 84 /* The sixteen bit input is split into two unequal halves, * 85 * nine bits and seven bits - as is the subkey */ 86 87 nine = (u16)(in>>7)&0x1FF; 88 seven = (u16)(in&0x7F); 89 90 /* Now run the various operations */ 91 nine = (u16)(S9[nine] ^ seven); 92 seven = (u16)(S7[seven] ^ (nine & 0x7F)); 93 seven ^= (subkey>>9); 94 nine ^= (subkey&0x1FF); 95 nine = (u16)(S9[nine] ^ seven); 96 seven = (u16)(S7[seven] ^ (nine & 0x7F)); 97 return (u16)(seven<<9) + nine; 98 } 99 100 static ulong32 FO( ulong32 in, int round_no, const symmetric_key *key) 101 { 102 u16 left, right; 103 104 /* Split the input into two 16-bit words */ 105 left = (u16)(in>>16); 106 right = (u16) in&0xFFFF; 107 108 /* Now apply the same basic transformation three times */ 109 left ^= key->kasumi.KOi1[round_no]; 110 left = FI( left, key->kasumi.KIi1[round_no] ); 111 left ^= right; 112 113 right ^= key->kasumi.KOi2[round_no]; 114 right = FI( right, key->kasumi.KIi2[round_no] ); 115 right ^= left; 116 117 left ^= key->kasumi.KOi3[round_no]; 118 left = FI( left, key->kasumi.KIi3[round_no] ); 119 left ^= right; 120 121 return (((ulong32)right)<<16)+left; 122 } 123 124 static ulong32 FL( ulong32 in, int round_no, const symmetric_key *key ) 125 { 126 u16 l, r, a, b; 127 /* split out the left and right halves */ 128 l = (u16)(in>>16); 129 r = (u16)(in)&0xFFFF; 130 /* do the FL() operations */ 131 a = (u16) (l & key->kasumi.KLi1[round_no]); 132 r ^= ROL16(a,1); 133 b = (u16)(r | key->kasumi.KLi2[round_no]); 134 l ^= ROL16(b,1); 135 /* put the two halves back together */ 136 137 return (((ulong32)l)<<16) + r; 138 } 139 140 int kasumi_ecb_encrypt(const unsigned char *pt, unsigned char *ct, const symmetric_key *skey) 141 { 142 ulong32 left, right, temp; 143 int n; 144 145 LTC_ARGCHK(pt != NULL); 146 LTC_ARGCHK(ct != NULL); 147 LTC_ARGCHK(skey != NULL); 148 149 LOAD32H(left, pt); 150 LOAD32H(right, pt+4); 151 152 for (n = 0; n <= 7; ) { 153 temp = FL(left, n, skey); 154 temp = FO(temp, n++, skey); 155 right ^= temp; 156 temp = FO(right, n, skey); 157 temp = FL(temp, n++, skey); 158 left ^= temp; 159 } 160 161 STORE32H(left, ct); 162 STORE32H(right, ct+4); 163 164 return CRYPT_OK; 165 } 166 167 int kasumi_ecb_decrypt(const unsigned char *ct, unsigned char *pt, const symmetric_key *skey) 168 { 169 ulong32 left, right, temp; 170 int n; 171 172 LTC_ARGCHK(pt != NULL); 173 LTC_ARGCHK(ct != NULL); 174 LTC_ARGCHK(skey != NULL); 175 176 LOAD32H(left, ct); 177 LOAD32H(right, ct+4); 178 179 for (n = 7; n >= 0; ) { 180 temp = FO(right, n, skey); 181 temp = FL(temp, n--, skey); 182 left ^= temp; 183 temp = FL(left, n, skey); 184 temp = FO(temp, n--, skey); 185 right ^= temp; 186 } 187 188 STORE32H(left, pt); 189 STORE32H(right, pt+4); 190 191 return CRYPT_OK; 192 } 193 194 int kasumi_setup(const unsigned char *key, int keylen, int num_rounds, symmetric_key *skey) 195 { 196 static const u16 C[8] = { 0x0123,0x4567,0x89AB,0xCDEF, 0xFEDC,0xBA98,0x7654,0x3210 }; 197 u16 ukey[8], Kprime[8]; 198 int n; 199 200 LTC_ARGCHK(key != NULL); 201 LTC_ARGCHK(skey != NULL); 202 203 if (keylen != 16) { 204 return CRYPT_INVALID_KEYSIZE; 205 } 206 207 if (num_rounds != 0 && num_rounds != 8) { 208 return CRYPT_INVALID_ROUNDS; 209 } 210 211 /* Start by ensuring the subkeys are endian correct on a 16-bit basis */ 212 for (n = 0; n < 8; n++ ) { 213 ukey[n] = (((u16)key[2*n]) << 8) | key[2*n+1]; 214 } 215 216 /* Now build the K'[] keys */ 217 for (n = 0; n < 8; n++) { 218 Kprime[n] = ukey[n] ^ C[n]; 219 } 220 221 /* Finally construct the various sub keys */ 222 for(n = 0; n < 8; n++) { 223 skey->kasumi.KLi1[n] = ROL16(ukey[n],1); 224 skey->kasumi.KLi2[n] = Kprime[(n+2)&0x7]; 225 skey->kasumi.KOi1[n] = ROL16(ukey[(n+1)&0x7],5); 226 skey->kasumi.KOi2[n] = ROL16(ukey[(n+5)&0x7],8); 227 skey->kasumi.KOi3[n] = ROL16(ukey[(n+6)&0x7],13); 228 skey->kasumi.KIi1[n] = Kprime[(n+4)&0x7]; 229 skey->kasumi.KIi2[n] = Kprime[(n+3)&0x7]; 230 skey->kasumi.KIi3[n] = Kprime[(n+7)&0x7]; 231 } 232 233 return CRYPT_OK; 234 } 235 236 void kasumi_done(symmetric_key *skey) 237 { 238 LTC_UNUSED_PARAM(skey); 239 } 240 241 int kasumi_keysize(int *keysize) 242 { 243 LTC_ARGCHK(keysize != NULL); 244 if (*keysize >= 16) { 245 *keysize = 16; 246 return CRYPT_OK; 247 } 248 return CRYPT_INVALID_KEYSIZE; 249 } 250 251 int kasumi_test(void) 252 { 253 #ifndef LTC_TEST 254 return CRYPT_NOP; 255 #else 256 static const struct { 257 unsigned char key[16], pt[8], ct[8]; 258 } tests[] = { 259 260 { 261 { 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, 262 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, 263 { 0x4B, 0x58, 0xA7, 0x71, 0xAF, 0xC7, 0xE5, 0xE8 } 264 }, 265 266 { 267 { 0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, 268 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, 269 { 0x7E, 0xEF, 0x11, 0x3C, 0x95, 0xBB, 0x5A, 0x77 } 270 }, 271 272 { 273 { 0x00, 0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, 274 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, 275 { 0x5F, 0x14, 0x06, 0x86, 0xD7, 0xAD, 0x5A, 0x39 }, 276 }, 277 278 { 279 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 }, 280 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, 281 { 0x2E, 0x14, 0x91, 0xCF, 0x70, 0xAA, 0x46, 0x5D } 282 }, 283 284 { 285 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00 }, 286 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, 287 { 0xB5, 0x45, 0x86, 0xF4, 0xAB, 0x9A, 0xE5, 0x46 } 288 }, 289 290 }; 291 unsigned char buf[2][8]; 292 symmetric_key key; 293 int err, x; 294 295 for (x = 0; x < (int)(sizeof(tests)/sizeof(tests[0])); x++) { 296 if ((err = kasumi_setup(tests[x].key, 16, 0, &key)) != CRYPT_OK) { 297 return err; 298 } 299 if ((err = kasumi_ecb_encrypt(tests[x].pt, buf[0], &key)) != CRYPT_OK) { 300 return err; 301 } 302 if ((err = kasumi_ecb_decrypt(tests[x].ct, buf[1], &key)) != CRYPT_OK) { 303 return err; 304 } 305 if (compare_testvector(buf[1], 8, tests[x].pt, 8, "Kasumi Decrypt", x) || 306 compare_testvector(buf[0], 8, tests[x].ct, 8, "Kasumi Encrypt", x)) { 307 return CRYPT_FAIL_TESTVECTOR; 308 } 309 } 310 return CRYPT_OK; 311 #endif 312 } 313 314 #endif 315 316 /* ref: $Format:%D$ */ 317 /* git commit: $Format:%H$ */ 318 /* commit time: $Format:%ai$ */ 319