1 /* LibTomCrypt, modular cryptographic library -- Tom St Denis */
2 /* SPDX-License-Identifier: Unlicense */
3 
4 /**
5   @file xtea.c
6   Implementation of eXtended TEA, Tom St Denis
7 */
8 #include "tomcrypt_private.h"
9 
10 #ifdef LTC_XTEA
11 
12 const struct ltc_cipher_descriptor xtea_desc =
13 {
14     "xtea",
15     1,
16     16, 16, 8, 32,
17     &xtea_setup,
18     &xtea_ecb_encrypt,
19     &xtea_ecb_decrypt,
20     &xtea_test,
21     &xtea_done,
22     &xtea_keysize,
23     NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL
24 };
25 
xtea_setup(const unsigned char * key,int keylen,int num_rounds,symmetric_key * skey)26 int xtea_setup(const unsigned char *key, int keylen, int num_rounds, symmetric_key *skey)
27 {
28    ulong32 x, sum, K[4];
29 
30    LTC_ARGCHK(key != NULL);
31    LTC_ARGCHK(skey != NULL);
32 
33    /* check arguments */
34    if (keylen != 16) {
35       return CRYPT_INVALID_KEYSIZE;
36    }
37 
38    if (num_rounds != 0 && num_rounds != 32) {
39       return CRYPT_INVALID_ROUNDS;
40    }
41 
42    /* load key */
43    LOAD32H(K[0], key+0);
44    LOAD32H(K[1], key+4);
45    LOAD32H(K[2], key+8);
46    LOAD32H(K[3], key+12);
47 
48    for (x = sum = 0; x < 32; x++) {
49        skey->xtea.A[x] = (sum + K[sum&3]) & 0xFFFFFFFFUL;
50        sum = (sum + 0x9E3779B9UL) & 0xFFFFFFFFUL;
51        skey->xtea.B[x] = (sum + K[(sum>>11)&3]) & 0xFFFFFFFFUL;
52    }
53 
54 #ifdef LTC_CLEAN_STACK
55    zeromem(&K, sizeof(K));
56 #endif
57 
58    return CRYPT_OK;
59 }
60 
61 /**
62   Encrypts a block of text with LTC_XTEA
63   @param pt The input plaintext (8 bytes)
64   @param ct The output ciphertext (8 bytes)
65   @param skey The key as scheduled
66   @return CRYPT_OK if successful
67 */
xtea_ecb_encrypt(const unsigned char * pt,unsigned char * ct,const symmetric_key * skey)68 int xtea_ecb_encrypt(const unsigned char *pt, unsigned char *ct, const symmetric_key *skey)
69 {
70    ulong32 y, z;
71    int r;
72 
73    LTC_ARGCHK(pt   != NULL);
74    LTC_ARGCHK(ct   != NULL);
75    LTC_ARGCHK(skey != NULL);
76 
77    LOAD32H(y, &pt[0]);
78    LOAD32H(z, &pt[4]);
79    for (r = 0; r < 32; r += 4) {
80        y = (y + ((((z<<4)^(z>>5)) + z) ^ skey->xtea.A[r])) & 0xFFFFFFFFUL;
81        z = (z + ((((y<<4)^(y>>5)) + y) ^ skey->xtea.B[r])) & 0xFFFFFFFFUL;
82 
83        y = (y + ((((z<<4)^(z>>5)) + z) ^ skey->xtea.A[r+1])) & 0xFFFFFFFFUL;
84        z = (z + ((((y<<4)^(y>>5)) + y) ^ skey->xtea.B[r+1])) & 0xFFFFFFFFUL;
85 
86        y = (y + ((((z<<4)^(z>>5)) + z) ^ skey->xtea.A[r+2])) & 0xFFFFFFFFUL;
87        z = (z + ((((y<<4)^(y>>5)) + y) ^ skey->xtea.B[r+2])) & 0xFFFFFFFFUL;
88 
89        y = (y + ((((z<<4)^(z>>5)) + z) ^ skey->xtea.A[r+3])) & 0xFFFFFFFFUL;
90        z = (z + ((((y<<4)^(y>>5)) + y) ^ skey->xtea.B[r+3])) & 0xFFFFFFFFUL;
91    }
92    STORE32H(y, &ct[0]);
93    STORE32H(z, &ct[4]);
94    return CRYPT_OK;
95 }
96 
97 /**
98   Decrypts a block of text with LTC_XTEA
99   @param ct The input ciphertext (8 bytes)
100   @param pt The output plaintext (8 bytes)
101   @param skey The key as scheduled
102   @return CRYPT_OK if successful
103 */
xtea_ecb_decrypt(const unsigned char * ct,unsigned char * pt,const symmetric_key * skey)104 int xtea_ecb_decrypt(const unsigned char *ct, unsigned char *pt, const symmetric_key *skey)
105 {
106    ulong32 y, z;
107    int r;
108 
109    LTC_ARGCHK(pt   != NULL);
110    LTC_ARGCHK(ct   != NULL);
111    LTC_ARGCHK(skey != NULL);
112 
113    LOAD32H(y, &ct[0]);
114    LOAD32H(z, &ct[4]);
115    for (r = 31; r >= 0; r -= 4) {
116        z = (z - ((((y<<4)^(y>>5)) + y) ^ skey->xtea.B[r])) & 0xFFFFFFFFUL;
117        y = (y - ((((z<<4)^(z>>5)) + z) ^ skey->xtea.A[r])) & 0xFFFFFFFFUL;
118 
119        z = (z - ((((y<<4)^(y>>5)) + y) ^ skey->xtea.B[r-1])) & 0xFFFFFFFFUL;
120        y = (y - ((((z<<4)^(z>>5)) + z) ^ skey->xtea.A[r-1])) & 0xFFFFFFFFUL;
121 
122        z = (z - ((((y<<4)^(y>>5)) + y) ^ skey->xtea.B[r-2])) & 0xFFFFFFFFUL;
123        y = (y - ((((z<<4)^(z>>5)) + z) ^ skey->xtea.A[r-2])) & 0xFFFFFFFFUL;
124 
125        z = (z - ((((y<<4)^(y>>5)) + y) ^ skey->xtea.B[r-3])) & 0xFFFFFFFFUL;
126        y = (y - ((((z<<4)^(z>>5)) + z) ^ skey->xtea.A[r-3])) & 0xFFFFFFFFUL;
127    }
128    STORE32H(y, &pt[0]);
129    STORE32H(z, &pt[4]);
130    return CRYPT_OK;
131 }
132 
133 /**
134   Performs a self-test of the LTC_XTEA block cipher
135   @return CRYPT_OK if functional, CRYPT_NOP if self-test has been disabled
136 */
xtea_test(void)137 int xtea_test(void)
138 {
139  #ifndef LTC_TEST
140     return CRYPT_NOP;
141  #else
142     static const struct {
143         unsigned char key[16], pt[8], ct[8];
144     } tests[] = {
145        {
146          { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
147            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
148          { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
149          { 0xde, 0xe9, 0xd4, 0xd8, 0xf7, 0x13, 0x1e, 0xd9 }
150        }, {
151          { 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x02,
152            0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x04 },
153          { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
154          { 0xa5, 0x97, 0xab, 0x41, 0x76, 0x01, 0x4d, 0x72 }
155        }, {
156          { 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x04,
157            0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x06 },
158          { 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x02 },
159          { 0xb1, 0xfd, 0x5d, 0xa9, 0xcc, 0x6d, 0xc9, 0xdc }
160        }, {
161          { 0x78, 0x69, 0x5a, 0x4b, 0x3c, 0x2d, 0x1e, 0x0f,
162            0xf0, 0xe1, 0xd2, 0xc3, 0xb4, 0xa5, 0x96, 0x87 },
163          { 0xf0, 0xe1, 0xd2, 0xc3, 0xb4, 0xa5, 0x96, 0x87 },
164          { 0x70, 0x4b, 0x31, 0x34, 0x47, 0x44, 0xdf, 0xab }
165        }, {
166          { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
167            0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f },
168          { 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48 },
169          { 0x49, 0x7d, 0xf3, 0xd0, 0x72, 0x61, 0x2c, 0xb5 }
170        }, {
171          { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
172            0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f },
173          { 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41 },
174          { 0xe7, 0x8f, 0x2d, 0x13, 0x74, 0x43, 0x41, 0xd8 }
175        }, {
176          { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
177            0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f },
178          { 0x5a, 0x5b, 0x6e, 0x27, 0x89, 0x48, 0xd7, 0x7f },
179          { 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41 }
180        }, {
181          { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
182            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
183          { 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48 },
184          { 0xa0, 0x39, 0x05, 0x89, 0xf8, 0xb8, 0xef, 0xa5 }
185        }, {
186          { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
187            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
188          { 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41 },
189          { 0xed, 0x23, 0x37, 0x5a, 0x82, 0x1a, 0x8c, 0x2d }
190        }, {
191          { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
192            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
193          { 0x70, 0xe1, 0x22, 0x5d, 0x6e, 0x4e, 0x76, 0x55 },
194          { 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41 }
195        }
196     };
197    unsigned char tmp[2][8];
198    symmetric_key skey;
199    int i, err, y;
200    for (i = 0; i < (int)(sizeof(tests)/sizeof(tests[0])); i++) {
201        zeromem(&skey, sizeof(skey));
202        if ((err = xtea_setup(tests[i].key, 16, 0, &skey)) != CRYPT_OK)  {
203           return err;
204        }
205        xtea_ecb_encrypt(tests[i].pt, tmp[0], &skey);
206        xtea_ecb_decrypt(tmp[0], tmp[1], &skey);
207 
208        if (compare_testvector(tmp[0], 8, tests[i].ct, 8, "XTEA Encrypt", i) != 0 ||
209              compare_testvector(tmp[1], 8, tests[i].pt, 8, "XTEA Decrypt", i) != 0) {
210           return CRYPT_FAIL_TESTVECTOR;
211        }
212 
213       /* now see if we can encrypt all zero bytes 1000 times, decrypt and come back where we started */
214       for (y = 0; y < 8; y++) tmp[0][y] = 0;
215       for (y = 0; y < 1000; y++) xtea_ecb_encrypt(tmp[0], tmp[0], &skey);
216       for (y = 0; y < 1000; y++) xtea_ecb_decrypt(tmp[0], tmp[0], &skey);
217       for (y = 0; y < 8; y++) if (tmp[0][y] != 0) return CRYPT_FAIL_TESTVECTOR;
218    } /* for */
219 
220    return CRYPT_OK;
221  #endif
222 }
223 
224 /** Terminate the context
225    @param skey    The scheduled key
226 */
xtea_done(symmetric_key * skey)227 void xtea_done(symmetric_key *skey)
228 {
229   LTC_UNUSED_PARAM(skey);
230 }
231 
232 /**
233   Gets suitable key size
234   @param keysize [in/out] The length of the recommended key (in bytes).  This function will store the suitable size back in this variable.
235   @return CRYPT_OK if the input key size is acceptable.
236 */
xtea_keysize(int * keysize)237 int xtea_keysize(int *keysize)
238 {
239    LTC_ARGCHK(keysize != NULL);
240    if (*keysize < 16) {
241       return CRYPT_INVALID_KEYSIZE;
242    }
243    *keysize = 16;
244    return CRYPT_OK;
245 }
246 
247 
248 #endif
249 
250 
251 
252