Harald Welte | 867ca29 | 2019-07-12 18:21:39 +0800 | [diff] [blame] | 1 | /*------------------------------------------------------------------------ |
| 2 | * SNOW_3G.c |
| 3 | *------------------------------------------------------------------------*/ |
| 4 | |
| 5 | #include "snow-3g.h" |
| 6 | |
| 7 | /* LFSR */ |
| 8 | |
| 9 | static u32 LFSR_S0 = 0x00; |
| 10 | static u32 LFSR_S1 = 0x00; |
| 11 | static u32 LFSR_S2 = 0x00; |
| 12 | static u32 LFSR_S3 = 0x00; |
| 13 | static u32 LFSR_S4 = 0x00; |
| 14 | static u32 LFSR_S5 = 0x00; |
| 15 | static u32 LFSR_S6 = 0x00; |
| 16 | static u32 LFSR_S7 = 0x00; |
| 17 | static u32 LFSR_S8 = 0x00; |
| 18 | static u32 LFSR_S9 = 0x00; |
| 19 | static u32 LFSR_S10 = 0x00; |
| 20 | static u32 LFSR_S11 = 0x00; |
| 21 | static u32 LFSR_S12 = 0x00; |
| 22 | static u32 LFSR_S13 = 0x00; |
| 23 | static u32 LFSR_S14 = 0x00; |
| 24 | static u32 LFSR_S15 = 0x00; |
| 25 | |
| 26 | /* FSM */ |
| 27 | |
| 28 | static u32 FSM_R1 = 0x00; |
| 29 | static u32 FSM_R2 = 0x00; |
| 30 | static u32 FSM_R3 = 0x00; |
| 31 | |
| 32 | /* Rijndael S-box SR */ |
| 33 | |
Harald Welte | 051fd86 | 2019-07-12 18:22:35 +0800 | [diff] [blame] | 34 | static const u8 SR[256] = { |
Harald Welte | 867ca29 | 2019-07-12 18:21:39 +0800 | [diff] [blame] | 35 | 0x63,0x7C,0x77,0x7B,0xF2,0x6B,0x6F,0xC5,0x30,0x01,0x67,0x2B,0xFE,0xD7,0xAB,0x76, |
| 36 | 0xCA,0x82,0xC9,0x7D,0xFA,0x59,0x47,0xF0,0xAD,0xD4,0xA2,0xAF,0x9C,0xA4,0x72,0xC0, |
| 37 | 0xB7,0xFD,0x93,0x26,0x36,0x3F,0xF7,0xCC,0x34,0xA5,0xE5,0xF1,0x71,0xD8,0x31,0x15, |
| 38 | 0x04,0xC7,0x23,0xC3,0x18,0x96,0x05,0x9A,0x07,0x12,0x80,0xE2,0xEB,0x27,0xB2,0x75, |
| 39 | 0x09,0x83,0x2C,0x1A,0x1B,0x6E,0x5A,0xA0,0x52,0x3B,0xD6,0xB3,0x29,0xE3,0x2F,0x84, |
| 40 | 0x53,0xD1,0x00,0xED,0x20,0xFC,0xB1,0x5B,0x6A,0xCB,0xBE,0x39,0x4A,0x4C,0x58,0xCF, |
| 41 | 0xD0,0xEF,0xAA,0xFB,0x43,0x4D,0x33,0x85,0x45,0xF9,0x02,0x7F,0x50,0x3C,0x9F,0xA8, |
| 42 | 0x51,0xA3,0x40,0x8F,0x92,0x9D,0x38,0xF5,0xBC,0xB6,0xDA,0x21,0x10,0xFF,0xF3,0xD2, |
| 43 | 0xCD,0x0C,0x13,0xEC,0x5F,0x97,0x44,0x17,0xC4,0xA7,0x7E,0x3D,0x64,0x5D,0x19,0x73, |
| 44 | 0x60,0x81,0x4F,0xDC,0x22,0x2A,0x90,0x88,0x46,0xEE,0xB8,0x14,0xDE,0x5E,0x0B,0xDB, |
| 45 | 0xE0,0x32,0x3A,0x0A,0x49,0x06,0x24,0x5C,0xC2,0xD3,0xAC,0x62,0x91,0x95,0xE4,0x79, |
| 46 | 0xE7,0xC8,0x37,0x6D,0x8D,0xD5,0x4E,0xA9,0x6C,0x56,0xF4,0xEA,0x65,0x7A,0xAE,0x08, |
| 47 | 0xBA,0x78,0x25,0x2E,0x1C,0xA6,0xB4,0xC6,0xE8,0xDD,0x74,0x1F,0x4B,0xBD,0x8B,0x8A, |
| 48 | 0x70,0x3E,0xB5,0x66,0x48,0x03,0xF6,0x0E,0x61,0x35,0x57,0xB9,0x86,0xC1,0x1D,0x9E, |
| 49 | 0xE1,0xF8,0x98,0x11,0x69,0xD9,0x8E,0x94,0x9B,0x1E,0x87,0xE9,0xCE,0x55,0x28,0xDF, |
| 50 | 0x8C,0xA1,0x89,0x0D,0xBF,0xE6,0x42,0x68,0x41,0x99,0x2D,0x0F,0xB0,0x54,0xBB,0x16 |
| 51 | }; |
| 52 | |
| 53 | /* S-box SQ */ |
| 54 | |
Harald Welte | 051fd86 | 2019-07-12 18:22:35 +0800 | [diff] [blame] | 55 | static const u8 SQ[256] = { |
Harald Welte | 867ca29 | 2019-07-12 18:21:39 +0800 | [diff] [blame] | 56 | 0x25,0x24,0x73,0x67,0xD7,0xAE,0x5C,0x30,0xA4,0xEE,0x6E,0xCB,0x7D,0xB5,0x82,0xDB, |
| 57 | 0xE4,0x8E,0x48,0x49,0x4F,0x5D,0x6A,0x78,0x70,0x88,0xE8,0x5F,0x5E,0x84,0x65,0xE2, |
| 58 | 0xD8,0xE9,0xCC,0xED,0x40,0x2F,0x11,0x28,0x57,0xD2,0xAC,0xE3,0x4A,0x15,0x1B,0xB9, |
| 59 | 0xB2,0x80,0x85,0xA6,0x2E,0x02,0x47,0x29,0x07,0x4B,0x0E,0xC1,0x51,0xAA,0x89,0xD4, |
| 60 | 0xCA,0x01,0x46,0xB3,0xEF,0xDD,0x44,0x7B,0xC2,0x7F,0xBE,0xC3,0x9F,0x20,0x4C,0x64, |
| 61 | 0x83,0xA2,0x68,0x42,0x13,0xB4,0x41,0xCD,0xBA,0xC6,0xBB,0x6D,0x4D,0x71,0x21,0xF4, |
| 62 | 0x8D,0xB0,0xE5,0x93,0xFE,0x8F,0xE6,0xCF,0x43,0x45,0x31,0x22,0x37,0x36,0x96,0xFA, |
| 63 | 0xBC,0x0F,0x08,0x52,0x1D,0x55,0x1A,0xC5,0x4E,0x23,0x69,0x7A,0x92,0xFF,0x5B,0x5A, |
| 64 | 0xEB,0x9A,0x1C,0xA9,0xD1,0x7E,0x0D,0xFC,0x50,0x8A,0xB6,0x62,0xF5,0x0A,0xF8,0xDC, |
| 65 | 0x03,0x3C,0x0C,0x39,0xF1,0xB8,0xF3,0x3D,0xF2,0xD5,0x97,0x66,0x81,0x32,0xA0,0x00, |
| 66 | 0x06,0xCE,0xF6,0xEA,0xB7,0x17,0xF7,0x8C,0x79,0xD6,0xA7,0xBF,0x8B,0x3F,0x1F,0x53, |
| 67 | 0x63,0x75,0x35,0x2C,0x60,0xFD,0x27,0xD3,0x94,0xA5,0x7C,0xA1,0x05,0x58,0x2D,0xBD, |
| 68 | 0xD9,0xC7,0xAF,0x6B,0x54,0x0B,0xE0,0x38,0x04,0xC8,0x9D,0xE7,0x14,0xB1,0x87,0x9C, |
| 69 | 0xDF,0x6F,0xF9,0xDA,0x2A,0xC4,0x59,0x16,0x74,0x91,0xAB,0x26,0x61,0x76,0x34,0x2B, |
| 70 | 0xAD,0x99,0xFB,0x72,0xEC,0x33,0x12,0xDE,0x98,0x3B,0xC0,0x9B,0x3E,0x18,0x10,0x3A, |
| 71 | 0x56,0xE1,0x77,0xC9,0x1E,0x9E,0x95,0xA3,0x90,0x19,0xA8,0x6C,0x09,0xD0,0xF0,0x86 |
| 72 | }; |
| 73 | |
| 74 | /* MULx. |
| 75 | * Input V: an 8-bit input. |
| 76 | * Input c: an 8-bit input. |
| 77 | * Output : an 8-bit output. |
| 78 | * See section 3.1.1 for details. |
| 79 | */ |
| 80 | |
Harald Welte | 135af53 | 2019-07-12 18:26:35 +0800 | [diff] [blame] | 81 | static u8 MULx(u8 V, u8 c) |
Harald Welte | 867ca29 | 2019-07-12 18:21:39 +0800 | [diff] [blame] | 82 | { |
| 83 | if ( V & 0x80 ) |
| 84 | return ( (V << 1) ^ c); |
| 85 | else |
| 86 | return ( V << 1); |
| 87 | } |
| 88 | |
| 89 | /* MULxPOW. |
| 90 | * Input V: an 8-bit input. |
| 91 | * Input i: a positive integer. |
| 92 | * Input c: an 8-bit input. |
| 93 | * Output : an 8-bit output. |
| 94 | * See section 3.1.2 for details. |
| 95 | */ |
| 96 | |
Harald Welte | 135af53 | 2019-07-12 18:26:35 +0800 | [diff] [blame] | 97 | static u8 MULxPOW(u8 V, u8 i, u8 c) |
Harald Welte | 867ca29 | 2019-07-12 18:21:39 +0800 | [diff] [blame] | 98 | { |
| 99 | if ( i == 0) |
| 100 | return V; |
| 101 | else |
| 102 | return MULx( MULxPOW( V, i-1, c ), c); |
| 103 | } |
| 104 | |
| 105 | /* The function MUL alpha. |
| 106 | * Input c: 8-bit input. |
| 107 | * Output : 32-bit output. |
| 108 | * See section 3.4.2 for details. |
| 109 | */ |
| 110 | |
Harald Welte | 135af53 | 2019-07-12 18:26:35 +0800 | [diff] [blame] | 111 | static u32 MULalpha(u8 c) |
Harald Welte | 867ca29 | 2019-07-12 18:21:39 +0800 | [diff] [blame] | 112 | { |
| 113 | return ( ( ((u32)MULxPOW(c, 23, 0xa9)) << 24 ) | |
| 114 | ( ((u32)MULxPOW(c, 245, 0xa9)) << 16 ) | |
| 115 | ( ((u32)MULxPOW(c, 48, 0xa9)) << 8 ) | |
| 116 | ( ((u32)MULxPOW(c, 239, 0xa9)) ) ) ; |
| 117 | } |
| 118 | |
| 119 | /* The function DIV alpha. |
| 120 | * Input c: 8-bit input. |
| 121 | * Output : 32-bit output. |
| 122 | * See section 3.4.3 for details. |
| 123 | */ |
| 124 | |
Harald Welte | 135af53 | 2019-07-12 18:26:35 +0800 | [diff] [blame] | 125 | static u32 DIValpha(u8 c) |
Harald Welte | 867ca29 | 2019-07-12 18:21:39 +0800 | [diff] [blame] | 126 | { |
| 127 | return ( ( ((u32)MULxPOW(c, 16, 0xa9)) << 24 ) | |
| 128 | ( ((u32)MULxPOW(c, 39, 0xa9)) << 16 ) | |
| 129 | ( ((u32)MULxPOW(c, 6, 0xa9)) << 8 ) | |
| 130 | ( ((u32)MULxPOW(c, 64, 0xa9)) ) ) ; |
| 131 | } |
| 132 | |
| 133 | /* The 32x32-bit S-Box S1 |
| 134 | * Input: a 32-bit input. |
| 135 | * Output: a 32-bit output of S1 box. |
| 136 | * See section 3.3.1. |
| 137 | */ |
| 138 | |
Harald Welte | 135af53 | 2019-07-12 18:26:35 +0800 | [diff] [blame] | 139 | static u32 S1(u32 w) |
Harald Welte | 867ca29 | 2019-07-12 18:21:39 +0800 | [diff] [blame] | 140 | { |
| 141 | u8 r0=0, r1=0, r2=0, r3=0; |
| 142 | u8 srw0 = SR[ (u8)((w >> 24) & 0xff) ]; |
| 143 | u8 srw1 = SR[ (u8)((w >> 16) & 0xff) ]; |
| 144 | u8 srw2 = SR[ (u8)((w >> 8) & 0xff) ]; |
| 145 | u8 srw3 = SR[ (u8)((w) & 0xff) ]; |
| 146 | r0 = ( ( MULx( srw0 , 0x1b) ) ^ |
| 147 | ( srw1 ) ^ |
| 148 | ( srw2 ) ^ |
| 149 | ( (MULx( srw3, 0x1b)) ^ srw3 ) |
| 150 | ); |
| 151 | r1 = ( ( ( MULx( srw0 , 0x1b) ) ^ srw0 ) ^ |
| 152 | ( MULx(srw1, 0x1b) ) ^ |
| 153 | ( srw2 ) ^ |
| 154 | ( srw3 ) |
| 155 | ); |
| 156 | r2 = ( ( srw0 ) ^ |
| 157 | ( ( MULx( srw1 , 0x1b) ) ^ srw1 ) ^ |
| 158 | ( MULx(srw2, 0x1b) ) ^ |
| 159 | ( srw3 ) |
| 160 | ); |
| 161 | r3 = ( ( srw0 ) ^ |
| 162 | ( srw1 ) ^ |
| 163 | ( ( MULx( srw2 , 0x1b) ) ^ srw2 ) ^ |
| 164 | ( MULx( srw3, 0x1b) ) |
| 165 | ); |
| 166 | |
| 167 | return ( ( ((u32)r0) << 24 ) | ( ((u32)r1) << 16 ) | ( ((u32)r2) << 8 ) | |
| 168 | ( ((u32)r3) ) ); |
| 169 | } |
| 170 | |
| 171 | /* The 32x32-bit S-Box S2 |
| 172 | * Input: a 32-bit input. |
| 173 | * Output: a 32-bit output of S2 box. |
| 174 | * See section 3.3.2. |
| 175 | */ |
| 176 | |
Harald Welte | 135af53 | 2019-07-12 18:26:35 +0800 | [diff] [blame] | 177 | static u32 S2(u32 w) |
Harald Welte | 867ca29 | 2019-07-12 18:21:39 +0800 | [diff] [blame] | 178 | { |
| 179 | u8 r0=0, r1=0, r2=0, r3=0; |
| 180 | u8 sqw0 = SQ[ (u8)((w >> 24) & 0xff) ]; |
| 181 | u8 sqw1 = SQ[ (u8)((w >> 16) & 0xff) ]; |
| 182 | u8 sqw2 = SQ[ (u8)((w >> 8) & 0xff) ]; |
| 183 | u8 sqw3 = SQ[ (u8)((w) & 0xff) ]; |
| 184 | r0 = ( ( MULx( sqw0 , 0x69) ) ^ |
| 185 | ( sqw1 ) ^ |
| 186 | ( sqw2 ) ^ |
| 187 | ( (MULx( sqw3, 0x69)) ^ sqw3 ) |
| 188 | ); |
| 189 | r1 = ( ( ( MULx( sqw0 , 0x69) ) ^ sqw0 ) ^ |
| 190 | ( MULx(sqw1, 0x69) ) ^ |
| 191 | ( sqw2 ) ^ |
| 192 | ( sqw3 ) |
| 193 | ); |
| 194 | r2 = ( ( sqw0 ) ^ |
| 195 | ( ( MULx( sqw1 , 0x69) ) ^ sqw1 ) ^ |
| 196 | ( MULx(sqw2, 0x69) ) ^ |
| 197 | ( sqw3 ) |
| 198 | ); |
| 199 | r3 = ( ( sqw0 ) ^ |
| 200 | ( sqw1 ) ^ |
| 201 | ( ( MULx( sqw2 , 0x69) ) ^ sqw2 ) ^ |
| 202 | ( MULx( sqw3, 0x69) ) |
| 203 | ); |
| 204 | return ( ( ((u32)r0) << 24 ) | ( ((u32)r1) << 16 ) | ( ((u32)r2) << 8 ) | |
| 205 | ( ((u32)r3) ) ); |
| 206 | } |
| 207 | |
| 208 | /* Clocking LFSR in initialization mode. |
| 209 | * LFSR Registers S0 to S15 are updated as the LFSR receives a single clock. |
| 210 | * Input F: a 32-bit word comes from output of FSM. |
| 211 | * See section 3.4.4. |
| 212 | */ |
| 213 | |
Harald Welte | 135af53 | 2019-07-12 18:26:35 +0800 | [diff] [blame] | 214 | static void ClockLFSRInitializationMode(u32 F) |
Harald Welte | 867ca29 | 2019-07-12 18:21:39 +0800 | [diff] [blame] | 215 | { |
| 216 | u32 v = ( ( (LFSR_S0 << 8) & 0xffffff00 ) ^ |
| 217 | ( MULalpha( (u8)((LFSR_S0>>24) & 0xff) ) ) ^ |
| 218 | ( LFSR_S2 ) ^ |
| 219 | ( (LFSR_S11 >> 8) & 0x00ffffff ) ^ |
| 220 | ( DIValpha( (u8)( ( LFSR_S11) & 0xff ) ) ) ^ |
| 221 | ( F ) |
| 222 | ); |
| 223 | LFSR_S0 = LFSR_S1; |
| 224 | LFSR_S1 = LFSR_S2; |
| 225 | LFSR_S2 = LFSR_S3; |
| 226 | LFSR_S3 = LFSR_S4; |
| 227 | LFSR_S4 = LFSR_S5; |
| 228 | LFSR_S5 = LFSR_S6; |
| 229 | LFSR_S6 = LFSR_S7; |
| 230 | LFSR_S7 = LFSR_S8; |
| 231 | LFSR_S8 = LFSR_S9; |
| 232 | LFSR_S9 = LFSR_S10; |
| 233 | LFSR_S10 = LFSR_S11; |
| 234 | LFSR_S11 = LFSR_S12; |
| 235 | LFSR_S12 = LFSR_S13; |
| 236 | LFSR_S13 = LFSR_S14; |
| 237 | LFSR_S14 = LFSR_S15; |
| 238 | LFSR_S15 = v; |
| 239 | } |
| 240 | |
| 241 | /* Clocking LFSR in keystream mode. |
| 242 | * LFSR Registers S0 to S15 are updated as the LFSR receives a single clock. |
| 243 | * See section 3.4.5. |
| 244 | */ |
| 245 | |
Harald Welte | 135af53 | 2019-07-12 18:26:35 +0800 | [diff] [blame] | 246 | static void ClockLFSRKeyStreamMode() |
Harald Welte | 867ca29 | 2019-07-12 18:21:39 +0800 | [diff] [blame] | 247 | { |
| 248 | u32 v = ( ( (LFSR_S0 << 8) & 0xffffff00 ) ^ |
| 249 | ( MULalpha( (u8)((LFSR_S0>>24) & 0xff) ) ) ^ |
| 250 | ( LFSR_S2 ) ^ |
| 251 | ( (LFSR_S11 >> 8) & 0x00ffffff ) ^ |
| 252 | ( DIValpha( (u8)( ( LFSR_S11) & 0xff ) ) ) |
| 253 | ); |
| 254 | LFSR_S0 = LFSR_S1; |
| 255 | LFSR_S1 = LFSR_S2; |
| 256 | LFSR_S2 = LFSR_S3; |
| 257 | LFSR_S3 = LFSR_S4; |
| 258 | LFSR_S4 = LFSR_S5; |
| 259 | LFSR_S5 = LFSR_S6; |
| 260 | LFSR_S6 = LFSR_S7; |
| 261 | LFSR_S7 = LFSR_S8; |
| 262 | LFSR_S8 = LFSR_S9; |
| 263 | LFSR_S9 = LFSR_S10; |
| 264 | LFSR_S10 = LFSR_S11; |
| 265 | LFSR_S11 = LFSR_S12; |
| 266 | LFSR_S12 = LFSR_S13; |
| 267 | LFSR_S13 = LFSR_S14; |
| 268 | LFSR_S14 = LFSR_S15; |
| 269 | LFSR_S15 = v; |
| 270 | } |
| 271 | |
| 272 | /* Clocking FSM. |
| 273 | * Produces a 32-bit word F. |
| 274 | * Updates FSM registers R1, R2, R3. |
| 275 | * See Section 3.4.6. |
| 276 | */ |
| 277 | |
Harald Welte | 135af53 | 2019-07-12 18:26:35 +0800 | [diff] [blame] | 278 | static u32 ClockFSM() |
Harald Welte | 867ca29 | 2019-07-12 18:21:39 +0800 | [diff] [blame] | 279 | { |
| 280 | u32 F = ( ( LFSR_S15 + FSM_R1 ) & 0xffffffff ) ^ FSM_R2 ; |
| 281 | u32 r = ( FSM_R2 + ( FSM_R3 ^ LFSR_S5 ) ) & 0xffffffff ; |
| 282 | FSM_R3 = S2(FSM_R2); |
| 283 | FSM_R2 = S1(FSM_R1); |
| 284 | FSM_R1 = r; |
| 285 | return F; |
| 286 | } |
| 287 | |
| 288 | /* Initialization. |
| 289 | * Input k[4]: Four 32-bit words making up 128-bit key. |
| 290 | * Input IV[4]: Four 32-bit words making 128-bit initialization variable. |
| 291 | * Output: All the LFSRs and FSM are initialized for key generation. |
| 292 | * See Section 4.1. |
| 293 | */ |
| 294 | |
| 295 | void snow_3g_initialize(u32 k[4], u32 IV[4]) |
| 296 | { |
| 297 | u8 i=0; |
| 298 | u32 F = 0x0; |
| 299 | LFSR_S15 = k[3] ^ IV[0]; |
| 300 | LFSR_S14 = k[2]; |
| 301 | LFSR_S13 = k[1]; |
| 302 | LFSR_S12 = k[0] ^ IV[1]; |
| 303 | LFSR_S11 = k[3] ^ 0xffffffff; |
| 304 | LFSR_S10 = k[2] ^ 0xffffffff ^ IV[2]; |
| 305 | LFSR_S9 = k[1] ^ 0xffffffff ^ IV[3]; |
| 306 | LFSR_S8 = k[0] ^ 0xffffffff; |
| 307 | LFSR_S7 = k[3]; |
| 308 | LFSR_S6 = k[2]; |
| 309 | LFSR_S5 = k[1]; |
| 310 | LFSR_S4 = k[0]; |
| 311 | LFSR_S3 = k[3] ^ 0xffffffff; |
| 312 | LFSR_S2 = k[2] ^ 0xffffffff; |
| 313 | LFSR_S1 = k[1] ^ 0xffffffff; |
| 314 | LFSR_S0 = k[0] ^ 0xffffffff; |
| 315 | FSM_R1 = 0x0; |
| 316 | FSM_R2 = 0x0; |
| 317 | FSM_R3 = 0x0; |
| 318 | for(i=0;i<32;i++) |
| 319 | { |
| 320 | F = ClockFSM(); |
| 321 | ClockLFSRInitializationMode(F); |
| 322 | } |
| 323 | } |
| 324 | |
| 325 | /* Generation of Keystream. |
| 326 | * input n: number of 32-bit words of keystream. |
| 327 | * input z: space for the generated keystream, assumes |
| 328 | * memory is allocated already. |
| 329 | * output: generated keystream which is filled in z |
| 330 | * See section 4.2. |
| 331 | */ |
| 332 | |
| 333 | void snow_3g_generate_key_stream(u32 n, u32 *ks) |
| 334 | { |
| 335 | u32 t = 0; |
| 336 | u32 F = 0x0; |
| 337 | ClockFSM(); /* Clock FSM once. Discard the output. */ |
| 338 | ClockLFSRKeyStreamMode(); /* Clock LFSR in keystream mode once. */ |
| 339 | for ( t=0; t<n; t++) |
| 340 | { |
| 341 | F = ClockFSM(); /* STEP 1 */ |
| 342 | ks[t] = F ^ LFSR_S0; /* STEP 2 */ |
| 343 | /* Note that ks[t] corresponds to z_{t+1} in section 4.2 |
| 344 | */ |
| 345 | ClockLFSRKeyStreamMode(); /* STEP 3 */ |
| 346 | } |
| 347 | } |
| 348 | |
| 349 | /*----------------------------------------------------------------------- |
| 350 | * end of SNOW_3G.c |
| 351 | *-----------------------------------------------------------------------*/ |
| 352 | |
| 353 | /*--------------------------------------------------------- |
| 354 | * f8.c |
| 355 | *---------------------------------------------------------*/ |
| 356 | |
| 357 | /* |
| 358 | #include "f8.h" |
| 359 | #include <stdio.h> |
| 360 | #include <stdlib.h> |
| 361 | #include <string.h> |
| 362 | */ |
| 363 | |
| 364 | /* f8. |
| 365 | * Input key: 128 bit Confidentiality Key. |
| 366 | * Input count:32-bit Count, Frame dependent input. |
| 367 | * Input bearer: 5-bit Bearer identity (in the LSB side). |
| 368 | * Input dir:1 bit, direction of transmission. |
| 369 | * Input data: length number of bits, input bit stream. |
| 370 | * Input length: 32 bit Length, i.e., the number of bits to be encrypted or |
| 371 | * decrypted. |
| 372 | * Output data: Output bit stream. Assumes data is suitably memory |
| 373 | * allocated. |
| 374 | * Encrypts/decrypts blocks of data between 1 and 2^32 bits in length as |
| 375 | * defined in Section 3. |
| 376 | */ |
| 377 | |
| 378 | void snow_3g_f8(u8 *key, u32 count, u32 bearer, u32 dir, u8 *data, u32 length) |
| 379 | { |
| 380 | u32 K[4],IV[4]; |
| 381 | int n = ( length + 31 ) / 32; |
| 382 | int i=0; |
| 383 | int lastbits = (8-(length%8)) % 8; |
Harald Welte | 4a2bfcb | 2019-07-12 18:27:08 +0800 | [diff] [blame] | 384 | u32 KS[n]; |
Harald Welte | 867ca29 | 2019-07-12 18:21:39 +0800 | [diff] [blame] | 385 | |
| 386 | /*Initialisation*/ |
| 387 | /* Load the confidentiality key for SNOW 3G initialization as in section |
| 388 | 3.4. */ |
| 389 | for (i=0; i<4; i++) |
| 390 | K[3-i] = (key[4*i] << 24) ^ (key[4*i+1] << 16) |
| 391 | ^ (key[4*i+2] << 8) ^ (key[4*i+3]); |
| 392 | |
| 393 | /* Prepare the initialization vector (IV) for SNOW 3G initialization as in |
| 394 | section 3.4. */ |
| 395 | IV[3] = count; |
| 396 | IV[2] = (bearer << 27) | ((dir & 0x1) << 26); |
| 397 | IV[1] = IV[3]; |
| 398 | IV[0] = IV[2]; |
| 399 | |
| 400 | /* Run SNOW 3G algorithm to generate sequence of key stream bits KS*/ |
| 401 | snow_3g_initialize(K,IV); |
Harald Welte | 867ca29 | 2019-07-12 18:21:39 +0800 | [diff] [blame] | 402 | snow_3g_generate_key_stream(n,(u32*)KS); |
| 403 | |
| 404 | /* Exclusive-OR the input data with keystream to generate the output bit |
| 405 | stream */ |
| 406 | for (i=0; i<n; i++) |
| 407 | { |
| 408 | data[4*i+0] ^= (u8) (KS[i] >> 24) & 0xff; |
| 409 | data[4*i+1] ^= (u8) (KS[i] >> 16) & 0xff; |
| 410 | data[4*i+2] ^= (u8) (KS[i] >> 8) & 0xff; |
| 411 | data[4*i+3] ^= (u8) (KS[i] ) & 0xff; |
| 412 | } |
| 413 | |
Harald Welte | 867ca29 | 2019-07-12 18:21:39 +0800 | [diff] [blame] | 414 | /* zero last bits of data in case its length is not byte-aligned |
| 415 | this is an addition to the C reference code, which did not handle it */ |
| 416 | if (lastbits) |
| 417 | data[length/8] &= 256 - (1<<lastbits); |
| 418 | } |
| 419 | /* End of f8.c */ |
| 420 | |
| 421 | /*--------------------------------------------------------- |
| 422 | * f9.c |
| 423 | *---------------------------------------------------------*/ |
| 424 | |
| 425 | /* MUL64x. |
| 426 | * Input V: a 64-bit input. |
| 427 | * Input c: a 64-bit input. |
| 428 | * Output : a 64-bit output. |
| 429 | * A 64-bit memory is allocated which is to be freed by the calling |
| 430 | * function. |
| 431 | * See section 4.3.2 for details. |
| 432 | */ |
Harald Welte | 135af53 | 2019-07-12 18:26:35 +0800 | [diff] [blame] | 433 | static u64 MUL64x(u64 V, u64 c) |
Harald Welte | 867ca29 | 2019-07-12 18:21:39 +0800 | [diff] [blame] | 434 | { |
| 435 | if ( V & 0x8000000000000000 ) |
| 436 | return (V << 1) ^ c; |
| 437 | else |
| 438 | return V << 1; |
| 439 | } |
| 440 | |
| 441 | /* MUL64xPOW. |
| 442 | * Input V: a 64-bit input. |
| 443 | * Input i: a positive integer. |
| 444 | * Input c: a 64-bit input. |
| 445 | * Output : a 64-bit output. |
| 446 | * A 64-bit memory is allocated which is to be freed by the calling function. |
| 447 | * See section 4.3.3 for details. |
| 448 | */ |
Harald Welte | 135af53 | 2019-07-12 18:26:35 +0800 | [diff] [blame] | 449 | static u64 MUL64xPOW(u64 V, u8 i, u64 c) |
Harald Welte | 867ca29 | 2019-07-12 18:21:39 +0800 | [diff] [blame] | 450 | { |
| 451 | if ( i == 0) |
| 452 | return V; |
| 453 | else |
| 454 | return MUL64x( MUL64xPOW(V,i-1,c) , c); |
| 455 | } |
| 456 | |
| 457 | /* MUL64. |
| 458 | * Input V: a 64-bit input. |
| 459 | * Input P: a 64-bit input. |
| 460 | * Input c: a 64-bit input. |
| 461 | * Output : a 64-bit output. |
| 462 | * A 64-bit memory is allocated which is to be freed by the calling |
| 463 | * function. |
| 464 | * See section 4.3.4 for details. |
| 465 | */ |
Harald Welte | 135af53 | 2019-07-12 18:26:35 +0800 | [diff] [blame] | 466 | static u64 MUL64(u64 V, u64 P, u64 c) |
Harald Welte | 867ca29 | 2019-07-12 18:21:39 +0800 | [diff] [blame] | 467 | { |
| 468 | u64 result = 0; |
| 469 | int i = 0; |
| 470 | |
| 471 | for ( i=0; i<64; i++) |
| 472 | { |
| 473 | if( ( P>>i ) & 0x1 ) |
| 474 | result ^= MUL64xPOW(V,i,c); |
| 475 | } |
| 476 | return result; |
| 477 | } |
| 478 | |
| 479 | /* mask8bit. |
| 480 | * Input n: an integer in 1-7. |
| 481 | * Output : an 8 bit mask. |
| 482 | * Prepares an 8 bit mask with required number of 1 bits on the MSB side. |
| 483 | */ |
Harald Welte | 135af53 | 2019-07-12 18:26:35 +0800 | [diff] [blame] | 484 | static u8 mask8bit(int n) |
Harald Welte | 867ca29 | 2019-07-12 18:21:39 +0800 | [diff] [blame] | 485 | { |
| 486 | return 0xFF ^ ((1<<(8-n)) - 1); |
| 487 | } |
| 488 | |
| 489 | /* f9. |
| 490 | * Input key: 128 bit Integrity Key. |
| 491 | * Input count:32-bit Count, Frame dependent input. |
| 492 | * Input fresh: 32-bit Random number. |
| 493 | * Input dir:1 bit, direction of transmission (in the LSB). |
| 494 | * Input data: length number of bits, input bit stream. |
| 495 | * Input length: 64 bit Length, i.e., the number of bits to be MAC'd. |
| 496 | * Output : 32 bit block used as MAC |
| 497 | * Generates 32-bit MAC using UIA2 algorithm as defined in Section 4. |
| 498 | */ |
| 499 | void snow_3g_f9(u8* key, u32 count, u32 fresh, u32 dir, u8 *data, u64 length, |
| 500 | u8 *out) |
| 501 | { |
| 502 | u32 K[4],IV[4], z[5]; |
| 503 | u32 i=0, D; |
| 504 | u64 EVAL; |
| 505 | u64 V; |
| 506 | u64 P; |
| 507 | u64 Q; |
| 508 | u64 c; |
| 509 | |
| 510 | u64 M_D_2; |
| 511 | int rem_bits = 0; |
| 512 | |
| 513 | /* Load the Integrity Key for SNOW3G initialization as in section 4.4. */ |
| 514 | for (i=0; i<4; i++) |
| 515 | { |
| 516 | K[3-i] = (key[4*i] << 24) ^ (key[4*i+1] << 16) ^ |
| 517 | (key[4*i+2] << 8) ^ (key[4*i+3]); |
| 518 | } |
| 519 | |
| 520 | /* Prepare the Initialization Vector (IV) for SNOW3G initialization as |
| 521 | in section 4.4. */ |
| 522 | IV[3] = count; |
| 523 | IV[2] = fresh; |
| 524 | IV[1] = count ^ ( dir << 31 ) ; |
| 525 | IV[0] = fresh ^ (dir << 15); |
| 526 | |
| 527 | z[0] = z[1] = z[2] = z[3] = z[4] = 0; |
| 528 | |
| 529 | /* Run SNOW 3G to produce 5 keystream words z_1, z_2, z_3, z_4 and z_5. */ |
| 530 | snow_3g_initialize(K, IV); |
| 531 | snow_3g_generate_key_stream(5, z); |
| 532 | |
| 533 | P = (u64)z[0] << 32 | (u64)z[1]; |
| 534 | Q = (u64)z[2] << 32 | (u64)z[3]; |
| 535 | |
| 536 | /* Calculation */ |
| 537 | if ((length % 64) == 0) |
| 538 | D = (length>>6) + 1; |
| 539 | else |
| 540 | D = (length>>6) + 2; |
| 541 | EVAL = 0; |
| 542 | c = 0x1b; |
| 543 | |
| 544 | /* for 0 <= i <= D-3 */ |
| 545 | for (i=0; i<D-2; i++) |
| 546 | { |
| 547 | V = EVAL ^ ( (u64)data[8*i ]<<56 | (u64)data[8*i+1]<<48 | |
| 548 | (u64)data[8*i+2]<<40 | (u64)data[8*i+3]<<32 | |
| 549 | (u64)data[8*i+4]<<24 | (u64)data[8*i+5]<<16 | |
| 550 | (u64)data[8*i+6]<< 8 | (u64)data[8*i+7] ) ; |
| 551 | EVAL = MUL64(V,P,c); |
| 552 | } |
| 553 | |
| 554 | /* for D-2 */ |
| 555 | rem_bits = length % 64; |
| 556 | if (rem_bits == 0) |
| 557 | rem_bits = 64; |
| 558 | |
| 559 | M_D_2 = 0; |
| 560 | i = 0; |
| 561 | while (rem_bits > 7) |
| 562 | { |
| 563 | M_D_2 |= (u64)data[8*(D-2)+i] << (8*(7-i)); |
| 564 | rem_bits -= 8; |
| 565 | i++; |
| 566 | } |
| 567 | if (rem_bits > 0) |
| 568 | M_D_2 |= (u64)(data[8*(D-2)+i] & mask8bit(rem_bits)) << (8*(7-i)); |
| 569 | |
| 570 | V = EVAL ^ M_D_2; |
| 571 | EVAL = MUL64(V,P,c); |
| 572 | |
| 573 | /* for D-1 */ |
| 574 | EVAL ^= length; |
| 575 | |
| 576 | /* Multiply by Q */ |
| 577 | EVAL = MUL64(EVAL,Q,c); |
| 578 | |
| 579 | /* XOR with z_5: this is a modification to the reference C code, |
| 580 | which forgot to XOR z[5] */ |
| 581 | for (i=0; i<4; i++) |
| 582 | /* |
| 583 | MAC_I[i] = (mac32 >> (8*(3-i))) & 0xff; |
| 584 | */ |
| 585 | out[i] = ((EVAL >> (56-(i*8))) ^ (z[4] >> (24-(i*8)))) & 0xff; |
| 586 | } |
| 587 | |
| 588 | /* End of f9.c */ |
| 589 | /*------------------------------------------------------------------------*/ |