95 lines
4.2 KiB
C
95 lines
4.2 KiB
C
// Bit-sliced Crypto-1 implementation (C) 2015 by Aram Verstegen
|
|
// The cipher states are stored with the least significant bit first, hence all bit indexes are reversed here
|
|
|
|
#include "crypto1_bs.h"
|
|
|
|
// The following functions use this global or thread-local state
|
|
// It is sized to fit exactly KEYSTREAM_SIZE more states next to the initial state
|
|
__thread bitslice_t states[KEYSTREAM_SIZE+STATE_SIZE];
|
|
__thread bitslice_t * restrict state_p;
|
|
|
|
void crypto1_bs_init(){
|
|
// initialize constant one and zero bit vectors
|
|
memset(bs_ones.bytes, 0xff, VECTOR_SIZE);
|
|
memset(bs_zeroes.bytes, 0x00, VECTOR_SIZE);
|
|
}
|
|
|
|
// The following functions have side effects on 48 bitslices at the state_p pointer
|
|
// use the crypto1_bs_rewind_* macros to (re-)initialize them as needed
|
|
|
|
inline const bitslice_value_t crypto1_bs_bit(const bitslice_value_t input, const bool is_encrypted){
|
|
bitslice_value_t feedback = (state_p[47- 0].value ^ state_p[47- 5].value ^ state_p[47- 9].value ^
|
|
state_p[47-10].value ^ state_p[47-12].value ^ state_p[47-14].value ^
|
|
state_p[47-15].value ^ state_p[47-17].value ^ state_p[47-19].value ^
|
|
state_p[47-24].value ^ state_p[47-25].value ^ state_p[47-27].value ^
|
|
state_p[47-29].value ^ state_p[47-35].value ^ state_p[47-39].value ^
|
|
state_p[47-41].value ^ state_p[47-42].value ^ state_p[47-43].value);
|
|
const bitslice_value_t ks_bits = crypto1_bs_f20(state_p);
|
|
if(is_encrypted){
|
|
feedback ^= ks_bits;
|
|
}
|
|
state_p--;
|
|
state_p[0].value = feedback ^ input;
|
|
return ks_bits;
|
|
}
|
|
|
|
inline const bitslice_value_t crypto1_bs_lfsr_rollback(const bitslice_value_t input, const bool is_encrypted){
|
|
bitslice_value_t feedout = state_p[0].value;
|
|
state_p++;
|
|
const bitslice_value_t ks_bits = crypto1_bs_f20(state_p);
|
|
if(is_encrypted){
|
|
feedout ^= ks_bits;
|
|
}
|
|
const bitslice_value_t feedback = (feedout ^ state_p[47- 5].value ^ state_p[47- 9].value ^
|
|
state_p[47-10].value ^ state_p[47-12].value ^ state_p[47-14].value ^
|
|
state_p[47-15].value ^ state_p[47-17].value ^ state_p[47-19].value ^
|
|
state_p[47-24].value ^ state_p[47-25].value ^ state_p[47-27].value ^
|
|
state_p[47-29].value ^ state_p[47-35].value ^ state_p[47-39].value ^
|
|
state_p[47-41].value ^ state_p[47-42].value ^ state_p[47-43].value);
|
|
state_p[47].value = feedback ^ input;
|
|
return ks_bits;
|
|
}
|
|
|
|
// side-effect free from here on
|
|
// note that bytes are sliced and unsliced with reversed endianness
|
|
inline void crypto1_bs_convert_states(bitslice_t bitsliced_states[], state_t regular_states[]){
|
|
size_t bit_idx = 0, slice_idx = 0;
|
|
state_t values[MAX_BITSLICES];
|
|
for(slice_idx = 0; slice_idx < MAX_BITSLICES; slice_idx++){
|
|
for(bit_idx = 0; bit_idx < STATE_SIZE; bit_idx++){
|
|
bool bit = get_vector_bit(slice_idx, bitsliced_states[bit_idx]);
|
|
values[slice_idx].value <<= 1;
|
|
values[slice_idx].value |= bit;
|
|
}
|
|
// swap endianness
|
|
values[slice_idx].value = rev_state_t(values[slice_idx].value);
|
|
// roll off unused bits
|
|
values[slice_idx].value >>= ((sizeof(state_t)*8)-STATE_SIZE);
|
|
}
|
|
memcpy(regular_states, values, sizeof(values));
|
|
}
|
|
|
|
// bitslice a value
|
|
void crypto1_bs_bitslice_value32(uint32_t value, bitslice_t bitsliced_value[], size_t bit_len){
|
|
// load nonce bytes with unswapped endianness
|
|
size_t bit_idx;
|
|
for(bit_idx = 0; bit_idx < bit_len; bit_idx++){
|
|
bool bit = get_bit(bit_len-1-bit_idx, rev32(value));
|
|
if(bit){
|
|
bitsliced_value[bit_idx].value = bs_ones.value;
|
|
} else {
|
|
bitsliced_value[bit_idx].value = bs_zeroes.value;
|
|
}
|
|
}
|
|
}
|
|
|
|
void crypto1_bs_print_states(bitslice_t bitsliced_states[]){
|
|
size_t slice_idx = 0;
|
|
state_t values[MAX_BITSLICES];
|
|
crypto1_bs_convert_states(bitsliced_states, values);
|
|
for(slice_idx = 0; slice_idx < MAX_BITSLICES; slice_idx++){
|
|
printf("State %03lu: %012lx\n", slice_idx, values[slice_idx].value);
|
|
}
|
|
}
|
|
|