acss.c

   1 /*      $Id: acss.c,v 1.4 2006/07/24 04:51:01 djm Exp $ */
   2 /*
   3  * Copyright (c) 2004 The OpenBSD project
   4  *
   5  * Permission to use, copy, modify, and distribute this software for any
   6  * purpose with or without fee is hereby granted, provided that the above
   7  * copyright notice and this permission notice appear in all copies.
   8  *
   9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  16  */
  17
  18 #include "includes.h"
  19
  20 #include <string.h>
  21
  22 #include <openssl/evp.h>
  23
  24 #if !defined(EVP_CTRL_SET_ACSS_MODE) && (OPENSSL_VERSION_NUMBER >= 0x00906000L)
  25
  26 #include "acss.h"
  27
  28 /* decryption sbox */
  29 static unsigned char sboxdec[] = {
  30         0x33, 0x73, 0x3b, 0x26, 0x63, 0x23, 0x6b, 0x76,
  31         0x3e, 0x7e, 0x36, 0x2b, 0x6e, 0x2e, 0x66, 0x7b,
  32         0xd3, 0x93, 0xdb, 0x06, 0x43, 0x03, 0x4b, 0x96,
  33         0xde, 0x9e, 0xd6, 0x0b, 0x4e, 0x0e, 0x46, 0x9b,
  34         0x57, 0x17, 0x5f, 0x82, 0xc7, 0x87, 0xcf, 0x12,
  35         0x5a, 0x1a, 0x52, 0x8f, 0xca, 0x8a, 0xc2, 0x1f,
  36         0xd9, 0x99, 0xd1, 0x00, 0x49, 0x09, 0x41, 0x90,
  37         0xd8, 0x98, 0xd0, 0x01, 0x48, 0x08, 0x40, 0x91,
  38         0x3d, 0x7d, 0x35, 0x24, 0x6d, 0x2d, 0x65, 0x74,
  39         0x3c, 0x7c, 0x34, 0x25, 0x6c, 0x2c, 0x64, 0x75,
  40         0xdd, 0x9d, 0xd5, 0x04, 0x4d, 0x0d, 0x45, 0x94,
  41         0xdc, 0x9c, 0xd4, 0x05, 0x4c, 0x0c, 0x44, 0x95,
  42         0x59, 0x19, 0x51, 0x80, 0xc9, 0x89, 0xc1, 0x10,
  43         0x58, 0x18, 0x50, 0x81, 0xc8, 0x88, 0xc0, 0x11,
  44         0xd7, 0x97, 0xdf, 0x02, 0x47, 0x07, 0x4f, 0x92,
  45         0xda, 0x9a, 0xd2, 0x0f, 0x4a, 0x0a, 0x42, 0x9f,
  46         0x53, 0x13, 0x5b, 0x86, 0xc3, 0x83, 0xcb, 0x16,
  47         0x5e, 0x1e, 0x56, 0x8b, 0xce, 0x8e, 0xc6, 0x1b,
  48         0xb3, 0xf3, 0xbb, 0xa6, 0xe3, 0xa3, 0xeb, 0xf6,
  49         0xbe, 0xfe, 0xb6, 0xab, 0xee, 0xae, 0xe6, 0xfb,
  50         0x37, 0x77, 0x3f, 0x22, 0x67, 0x27, 0x6f, 0x72,
  51         0x3a, 0x7a, 0x32, 0x2f, 0x6a, 0x2a, 0x62, 0x7f,
  52         0xb9, 0xf9, 0xb1, 0xa0, 0xe9, 0xa9, 0xe1, 0xf0,
  53         0xb8, 0xf8, 0xb0, 0xa1, 0xe8, 0xa8, 0xe0, 0xf1,
  54         0x5d, 0x1d, 0x55, 0x84, 0xcd, 0x8d, 0xc5, 0x14,
  55         0x5c, 0x1c, 0x54, 0x85, 0xcc, 0x8c, 0xc4, 0x15,
  56         0xbd, 0xfd, 0xb5, 0xa4, 0xed, 0xad, 0xe5, 0xf4,
  57         0xbc, 0xfc, 0xb4, 0xa5, 0xec, 0xac, 0xe4, 0xf5,
  58         0x39, 0x79, 0x31, 0x20, 0x69, 0x29, 0x61, 0x70,
  59         0x38, 0x78, 0x30, 0x21, 0x68, 0x28, 0x60, 0x71,
  60         0xb7, 0xf7, 0xbf, 0xa2, 0xe7, 0xa7, 0xef, 0xf2,
  61         0xba, 0xfa, 0xb2, 0xaf, 0xea, 0xaa, 0xe2, 0xff
  62 };
  63
  64 /* encryption sbox */
  65 static unsigned char sboxenc[] = {
  66         0x33, 0x3b, 0x73, 0x15, 0x53, 0x5b, 0x13, 0x75,
  67         0x3d, 0x35, 0x7d, 0x1b, 0x5d, 0x55, 0x1d, 0x7b,
  68         0x67, 0x6f, 0x27, 0x81, 0xc7, 0xcf, 0x87, 0x21,
  69         0x69, 0x61, 0x29, 0x8f, 0xc9, 0xc1, 0x89, 0x2f,
  70         0xe3, 0xeb, 0xa3, 0x05, 0x43, 0x4b, 0x03, 0xa5,
  71         0xed, 0xe5, 0xad, 0x0b, 0x4d, 0x45, 0x0d, 0xab,
  72         0xea, 0xe2, 0xaa, 0x00, 0x4a, 0x42, 0x0a, 0xa0,
  73         0xe8, 0xe0, 0xa8, 0x02, 0x48, 0x40, 0x08, 0xa2,
  74         0x3e, 0x36, 0x7e, 0x14, 0x5e, 0x56, 0x1e, 0x74,
  75         0x3c, 0x34, 0x7c, 0x16, 0x5c, 0x54, 0x1c, 0x76,
  76         0x6a, 0x62, 0x2a, 0x80, 0xca, 0xc2, 0x8a, 0x20,
  77         0x68, 0x60, 0x28, 0x82, 0xc8, 0xc0, 0x88, 0x22,
  78         0xee, 0xe6, 0xae, 0x04, 0x4e, 0x46, 0x0e, 0xa4,
  79         0xec, 0xe4, 0xac, 0x06, 0x4c, 0x44, 0x0c, 0xa6,
  80         0xe7, 0xef, 0xa7, 0x01, 0x47, 0x4f, 0x07, 0xa1,
  81         0xe9, 0xe1, 0xa9, 0x0f, 0x49, 0x41, 0x09, 0xaf,
  82         0x63, 0x6b, 0x23, 0x85, 0xc3, 0xcb, 0x83, 0x25,
  83         0x6d, 0x65, 0x2d, 0x8b, 0xcd, 0xc5, 0x8d, 0x2b,
  84         0x37, 0x3f, 0x77, 0x11, 0x57, 0x5f, 0x17, 0x71,
  85         0x39, 0x31, 0x79, 0x1f, 0x59, 0x51, 0x19, 0x7f,
  86         0xb3, 0xbb, 0xf3, 0x95, 0xd3, 0xdb, 0x93, 0xf5,
  87         0xbd, 0xb5, 0xfd, 0x9b, 0xdd, 0xd5, 0x9d, 0xfb,
  88         0xba, 0xb2, 0xfa, 0x90, 0xda, 0xd2, 0x9a, 0xf0,
  89         0xb8, 0xb0, 0xf8, 0x92, 0xd8, 0xd0, 0x98, 0xf2,
  90         0x6e, 0x66, 0x2e, 0x84, 0xce, 0xc6, 0x8e, 0x24,
  91         0x6c, 0x64, 0x2c, 0x86, 0xcc, 0xc4, 0x8c, 0x26,
  92         0x3a, 0x32, 0x7a, 0x10, 0x5a, 0x52, 0x1a, 0x70,
  93         0x38, 0x30, 0x78, 0x12, 0x58, 0x50, 0x18, 0x72,
  94         0xbe, 0xb6, 0xfe, 0x94, 0xde, 0xd6, 0x9e, 0xf4,
  95         0xbc, 0xb4, 0xfc, 0x96, 0xdc, 0xd4, 0x9c, 0xf6,
  96         0xb7, 0xbf, 0xf7, 0x91, 0xd7, 0xdf, 0x97, 0xf1,
  97         0xb9, 0xb1, 0xf9, 0x9f, 0xd9, 0xd1, 0x99, 0xff
  98 };
  99
 100 static unsigned char reverse[] = {
 101         0x00, 0x80, 0x40, 0xc0, 0x20, 0xa0, 0x60, 0xe0,
 102         0x10, 0x90, 0x50, 0xd0, 0x30, 0xb0, 0x70, 0xf0,
 103         0x08, 0x88, 0x48, 0xc8, 0x28, 0xa8, 0x68, 0xe8,
 104         0x18, 0x98, 0x58, 0xd8, 0x38, 0xb8, 0x78, 0xf8,
 105         0x04, 0x84, 0x44, 0xc4, 0x24, 0xa4, 0x64, 0xe4,
 106         0x14, 0x94, 0x54, 0xd4, 0x34, 0xb4, 0x74, 0xf4,
 107         0x0c, 0x8c, 0x4c, 0xcc, 0x2c, 0xac, 0x6c, 0xec,
 108         0x1c, 0x9c, 0x5c, 0xdc, 0x3c, 0xbc, 0x7c, 0xfc,
 109         0x02, 0x82, 0x42, 0xc2, 0x22, 0xa2, 0x62, 0xe2,
 110         0x12, 0x92, 0x52, 0xd2, 0x32, 0xb2, 0x72, 0xf2,
 111         0x0a, 0x8a, 0x4a, 0xca, 0x2a, 0xaa, 0x6a, 0xea,
 112         0x1a, 0x9a, 0x5a, 0xda, 0x3a, 0xba, 0x7a, 0xfa,
 113         0x06, 0x86, 0x46, 0xc6, 0x26, 0xa6, 0x66, 0xe6,
 114         0x16, 0x96, 0x56, 0xd6, 0x36, 0xb6, 0x76, 0xf6,
 115         0x0e, 0x8e, 0x4e, 0xce, 0x2e, 0xae, 0x6e, 0xee,
 116         0x1e, 0x9e, 0x5e, 0xde, 0x3e, 0xbe, 0x7e, 0xfe,
 117         0x01, 0x81, 0x41, 0xc1, 0x21, 0xa1, 0x61, 0xe1,
 118         0x11, 0x91, 0x51, 0xd1, 0x31, 0xb1, 0x71, 0xf1,
 119         0x09, 0x89, 0x49, 0xc9, 0x29, 0xa9, 0x69, 0xe9,
 120         0x19, 0x99, 0x59, 0xd9, 0x39, 0xb9, 0x79, 0xf9,
 121         0x05, 0x85, 0x45, 0xc5, 0x25, 0xa5, 0x65, 0xe5,
 122         0x15, 0x95, 0x55, 0xd5, 0x35, 0xb5, 0x75, 0xf5,
 123         0x0d, 0x8d, 0x4d, 0xcd, 0x2d, 0xad, 0x6d, 0xed,
 124         0x1d, 0x9d, 0x5d, 0xdd, 0x3d, 0xbd, 0x7d, 0xfd,
 125         0x03, 0x83, 0x43, 0xc3, 0x23, 0xa3, 0x63, 0xe3,
 126         0x13, 0x93, 0x53, 0xd3, 0x33, 0xb3, 0x73, 0xf3,
 127         0x0b, 0x8b, 0x4b, 0xcb, 0x2b, 0xab, 0x6b, 0xeb,
 128         0x1b, 0x9b, 0x5b, 0xdb, 0x3b, 0xbb, 0x7b, 0xfb,
 129         0x07, 0x87, 0x47, 0xc7, 0x27, 0xa7, 0x67, 0xe7,
 130         0x17, 0x97, 0x57, 0xd7, 0x37, 0xb7, 0x77, 0xf7,
 131         0x0f, 0x8f, 0x4f, 0xcf, 0x2f, 0xaf, 0x6f, 0xef,
 132         0x1f, 0x9f, 0x5f, 0xdf, 0x3f, 0xbf, 0x7f, 0xff
 133 };
 134
 135 /*
 136  * Two linear feedback shift registers are used:
 137  *
 138  * lfsr17:  polynomial of degree 17, primitive modulo 2 (listed in Schneier)
 139  *          x^15 + x + 1
 140  * lfsr25:  polynomial of degree 25, not know if primitive modulo 2
 141  *          x^13 + x^5 + x^4 + x^1 + 1
 142  *
 143  * Output bits are discarded, instead the feedback bits are added to produce
 144  * the cipher stream.  Depending on the mode, feedback bytes may be inverted
 145  * bit-wise before addition.
 146  *
 147  * The lfsrs are seeded with bytes from the raw key:
 148  *
 149  * lfsr17:  byte 0[0:7] at bit 9
 150  *          byte 1[0:7] at bit 0
 151  *
 152  * lfsr25:  byte 2[0:4] at bit 16
 153  *          byte 2[5:7] at bit 22
 154  *          byte 3[0:7] at bit 8
 155  *          byte 4[0:7] at bit 0
 156  *
 157  * To prevent 0 cycles, 1's are inject at bit 8 in lfrs17 and bit 21 in
 158  * lfsr25.
 159  *
 160  */
 161
 162 int
 163 acss(ACSS_KEY *key, unsigned long len, const unsigned char *in,
 164     unsigned char *out)
 165 {
 166         unsigned long i;
 167         unsigned long lfsr17tmp, lfsr25tmp, lfsrsumtmp;
 168
 169         lfsrsumtmp = lfsr17tmp = lfsr25tmp = 0;
 170
 171         /* keystream is sum of lfsrs */
 172         for (i = 0; i < len; i++) {
 173                 lfsr17tmp = key->lfsr17 ^ (key->lfsr17 >> 14);
 174                 key->lfsr17 = (key->lfsr17 >> 8)
 175                         ^ (lfsr17tmp << 9)
 176                         ^ (lfsr17tmp << 12)
 177                         ^ (lfsr17tmp << 15);
 178                 key->lfsr17 &= 0x1ffff; /* 17 bit LFSR */
 179
 180                 lfsr25tmp = key->lfsr25
 181                         ^ (key->lfsr25 >> 3)
 182                         ^ (key->lfsr25 >> 4)
 183                         ^ (key->lfsr25 >> 12);
 184                 key->lfsr25 = (key->lfsr25 >> 8) ^ (lfsr25tmp << 17);
 185                 key->lfsr25 &= 0x1ffffff;       /* 25 bit LFSR */
 186
 187                 lfsrsumtmp = key->lfsrsum;
 188
 189                 /* addition */
 190                 switch (key->mode) {
 191                 case ACSS_AUTHENTICATE:
 192                 case ACSS_DATA:
 193                         key->lfsrsum = 0xff & ~(key->lfsr17 >> 9);
 194                         key->lfsrsum += key->lfsr25 >> 17;
 195                         break;
 196                 case ACSS_SESSIONKEY:
 197                         key->lfsrsum = key->lfsr17 >> 9;
 198                         key->lfsrsum += key->lfsr25 >> 17;
 199                         break;
 200                 case ACSS_TITLEKEY:
 201                         key->lfsrsum = key->lfsr17 >> 9;
 202                         key->lfsrsum += 0xff & ~(key->lfsr25 >> 17);
 203                         break;
 204                 default:
 205                         return 1;
 206                 }
 207                 key->lfsrsum += (lfsrsumtmp >> 8);
 208
 209                 if (key->encrypt) {
 210                         out[i] = sboxenc[(in[i] ^ key->lfsrsum) & 0xff];
 211                 } else {
 212                         out[i] = (sboxdec[in[i]] ^ key->lfsrsum) & 0xff;
 213                 }
 214         }
 215
 216         return 0;
 217 }
 218
 219 static void
 220 acss_seed(ACSS_KEY *key)
 221 {
 222         int i;
 223
 224         /* if available, mangle with subkey */
 225         if (key->subkey_avilable) {
 226                 for (i = 0; i < ACSS_KEYSIZE; i++)
 227                         key->seed[i] = reverse[key->data[i] ^ key->subkey[i]];
 228         } else {
 229                 for (i = 0; i < ACSS_KEYSIZE; i++)
 230                         key->seed[i] = reverse[key->data[i]];
 231         }
 232
 233         /* seed lfsrs */
 234         key->lfsr17 = key->seed[1]
 235                 | (key->seed[0] << 9)
 236                 | (1 << 8);     /* inject 1 at bit 9 */
 237         key->lfsr25 = key->seed[4]
 238                 | (key->seed[3] << 8)
 239                 | ((key->seed[2] & 0x1f) << 16)
 240                 | ((key->seed[2] & 0xe0) << 17)
 241                         | (1 << 21);    /* inject 1 at bit 22 */
 242
 243         key->lfsrsum = 0;
 244 }
 245
 246 void
 247 acss_setkey(ACSS_KEY *key, const unsigned char *data, int enc, int mode)
 248 {
 249         memcpy(key->data, data, sizeof(key->data));
 250         memset(key->subkey, 0, sizeof(key->subkey));
 251
 252         if (enc != -1)
 253                 key->encrypt = enc;
 254         key->mode = mode;
 255         key->subkey_avilable = 0;
 256
 257         acss_seed(key);
 258 }
 259
 260 void
 261 acss_setsubkey(ACSS_KEY *key, const unsigned char *subkey)
 262 {
 263         memcpy(key->subkey, subkey, sizeof(key->subkey));
 264         key->subkey_avilable = 1;
 265         acss_seed(key);
 266 }
 267 #endif