1 /* arctwo.c --- The RC2 cipher as described in RFC 2268.
2 * Copyright (C) 2003, 2004, 2005 Free Software Foundation, Inc.
4 * This file is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published
6 * by the Free Software Foundation; either version 2, or (at your
7 * option) any later version.
9 * This file is distributed in the hope that it will be useful, but
10 * WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this file; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
20 /* Code from GnuTLS/Libgcrypt adapted for gnulib by Simon Josefsson. */
22 /* This implementation was written by Nikos Mavroyanopoulos for GNUTLS
23 * as a Libgcrypt module (gnutls/lib/x509/rc2.c) and later adapted for
24 * direct use by Libgcrypt by Werner Koch. This implementation is
25 * only useful for pkcs#12 decryption.
27 * The implementation here is based on Peter Gutmann's RRC.2 paper.
36 static const uint8_t arctwo_sbox[] = {
37 217, 120, 249, 196, 25, 221, 181, 237,
38 40, 233, 253, 121, 74, 160, 216, 157,
39 198, 126, 55, 131, 43, 118, 83, 142,
40 98, 76, 100, 136, 68, 139, 251, 162,
41 23, 154, 89, 245, 135, 179, 79, 19,
42 97, 69, 109, 141, 9, 129, 125, 50,
43 189, 143, 64, 235, 134, 183, 123, 11,
44 240, 149, 33, 34, 92, 107, 78, 130,
45 84, 214, 101, 147, 206, 96, 178, 28,
46 115, 86, 192, 20, 167, 140, 241, 220,
47 18, 117, 202, 31, 59, 190, 228, 209,
48 66, 61, 212, 48, 163, 60, 182, 38,
49 111, 191, 14, 218, 70, 105, 7, 87,
50 39, 242, 29, 155, 188, 148, 67, 3,
51 248, 17, 199, 246, 144, 239, 62, 231,
52 6, 195, 213, 47, 200, 102, 30, 215,
53 8, 232, 234, 222, 128, 82, 238, 247,
54 132, 170, 114, 172, 53, 77, 106, 42,
55 150, 26, 210, 113, 90, 21, 73, 116,
56 75, 159, 208, 94, 4, 24, 164, 236,
57 194, 224, 65, 110, 15, 81, 203, 204,
58 36, 145, 175, 80, 161, 244, 112, 57,
59 153, 124, 58, 133, 35, 184, 180, 122,
60 252, 2, 54, 91, 37, 85, 151, 49,
61 45, 93, 250, 152, 227, 138, 146, 174,
62 5, 223, 41, 16, 103, 108, 186, 201,
63 211, 0, 230, 207, 225, 158, 168, 44,
64 99, 22, 1, 63, 88, 226, 137, 169,
65 13, 56, 52, 27, 171, 51, 255, 176,
66 187, 72, 12, 95, 185, 177, 205, 46,
67 197, 243, 219, 71, 229, 165, 156, 119,
68 10, 166, 32, 104, 254, 127, 193, 173
71 #define rotl16(x,n) (((x) << ((uint16_t)(n))) | ((x) >> (16 - (uint16_t)(n))))
72 #define rotr16(x,n) (((x) >> ((uint16_t)(n))) | ((x) << (16 - (uint16_t)(n))))
74 /* C89 compliant way to cast 'char' to 'unsigned char'. */
75 static inline unsigned char
82 arctwo_encrypt (arctwo_context *context, const char *inbuf,
83 char *outbuf, size_t length)
85 for (; length >= ARCTWO_BLOCK_SIZE; length -= ARCTWO_BLOCK_SIZE,
86 inbuf += ARCTWO_BLOCK_SIZE, outbuf += ARCTWO_BLOCK_SIZE)
89 uint16_t word0 = 0, word1 = 0, word2 = 0, word3 = 0;
91 word0 = (word0 << 8) | to_uchar (inbuf[1]);
92 word0 = (word0 << 8) | to_uchar (inbuf[0]);
93 word1 = (word1 << 8) | to_uchar (inbuf[3]);
94 word1 = (word1 << 8) | to_uchar (inbuf[2]);
95 word2 = (word2 << 8) | to_uchar (inbuf[5]);
96 word2 = (word2 << 8) | to_uchar (inbuf[4]);
97 word3 = (word3 << 8) | to_uchar (inbuf[7]);
98 word3 = (word3 << 8) | to_uchar (inbuf[6]);
100 for (i = 0; i < 16; i++)
103 /* For some reason I cannot combine those steps. */
104 word0 += (word1 & ~word3) + (word2 & word3) + context->S[j];
105 word0 = rotl16 (word0, 1);
107 word1 += (word2 & ~word0) + (word3 & word0) + context->S[j + 1];
108 word1 = rotl16 (word1, 2);
110 word2 += (word3 & ~word1) + (word0 & word1) + context->S[j + 2];
111 word2 = rotl16 (word2, 3);
113 word3 += (word0 & ~word2) + (word1 & word2) + context->S[j + 3];
114 word3 = rotl16 (word3, 5);
116 if (i == 4 || i == 10)
118 word0 += context->S[word3 & 63];
119 word1 += context->S[word0 & 63];
120 word2 += context->S[word1 & 63];
121 word3 += context->S[word2 & 63];
125 outbuf[0] = word0 & 255;
126 outbuf[1] = word0 >> 8;
127 outbuf[2] = word1 & 255;
128 outbuf[3] = word1 >> 8;
129 outbuf[4] = word2 & 255;
130 outbuf[5] = word2 >> 8;
131 outbuf[6] = word3 & 255;
132 outbuf[7] = word3 >> 8;
137 arctwo_decrypt (arctwo_context *context, const char *inbuf,
138 char *outbuf, size_t length)
140 for (; length >= ARCTWO_BLOCK_SIZE; length -= ARCTWO_BLOCK_SIZE,
141 inbuf += ARCTWO_BLOCK_SIZE, outbuf += ARCTWO_BLOCK_SIZE)
144 uint16_t word0 = 0, word1 = 0, word2 = 0, word3 = 0;
146 word0 = (word0 << 8) | to_uchar (inbuf[1]);
147 word0 = (word0 << 8) | to_uchar (inbuf[0]);
148 word1 = (word1 << 8) | to_uchar (inbuf[3]);
149 word1 = (word1 << 8) | to_uchar (inbuf[2]);
150 word2 = (word2 << 8) | to_uchar (inbuf[5]);
151 word2 = (word2 << 8) | to_uchar (inbuf[4]);
152 word3 = (word3 << 8) | to_uchar (inbuf[7]);
153 word3 = (word3 << 8) | to_uchar (inbuf[6]);
155 for (i = 16; i > 0; i--)
159 word3 = rotr16 (word3, 5);
160 word3 -= (word0 & ~word2) + (word1 & word2) + context->S[j + 3];
162 word2 = rotr16 (word2, 3);
163 word2 -= (word3 & ~word1) + (word0 & word1) + context->S[j + 2];
165 word1 = rotr16 (word1, 2);
166 word1 -= (word2 & ~word0) + (word3 & word0) + context->S[j + 1];
168 word0 = rotr16 (word0, 1);
169 word0 -= (word1 & ~word3) + (word2 & word3) + context->S[j];
171 if (i == 6 || i == 12)
173 word3 = word3 - context->S[word2 & 63];
174 word2 = word2 - context->S[word1 & 63];
175 word1 = word1 - context->S[word0 & 63];
176 word0 = word0 - context->S[word3 & 63];
180 outbuf[0] = word0 & 255;
181 outbuf[1] = word0 >> 8;
182 outbuf[2] = word1 & 255;
183 outbuf[3] = word1 >> 8;
184 outbuf[4] = word2 & 255;
185 outbuf[5] = word2 >> 8;
186 outbuf[6] = word3 & 255;
187 outbuf[7] = word3 >> 8;
192 arctwo_setkey_ekb (arctwo_context *context,
193 size_t keylen, const char *key, size_t effective_keylen)
198 if (keylen < 40 / 8 || effective_keylen > 1024)
201 S = (uint8_t *) context->S;
203 for (i = 0; i < keylen; i++)
204 S[i] = (uint8_t) key[i];
206 for (i = keylen; i < 128; i++)
207 S[i] = arctwo_sbox[(S[i - keylen] + S[i - 1]) & 255];
209 S[0] = arctwo_sbox[S[0]];
211 /* Phase 2 - reduce effective key size to "bits". This was not
212 * discussed in Gutmann's paper. I've copied that from the public
213 * domain code posted in sci.crypt. */
214 if (effective_keylen)
216 size_t len = (effective_keylen + 7) >> 3;
218 x = arctwo_sbox[S[i] & (255 >> (7 & -effective_keylen))];
223 x = arctwo_sbox[x ^ S[i + len]];
228 /* Make the expanded key, endian independent. */
229 for (i = 0; i < 64; i++)
230 context->S[i] = ((uint16_t) S[i * 2] | (((uint16_t) S[i * 2 + 1]) << 8));