1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright 2008 Sun Microsystems, Inc. All rights reserved.
24 * Use is subject to license terms.
25 */
26
27 /* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
28 /* All Rights Reserved */
29
30 /*
31 * Portions of this source code were derived from Berkeley 4.3 BSD
32 * under license from the Regents of the University of California.
33 */
34
35 /*
36 * Warning! Things are arranged very carefully in this file to
37 * allow read-only data to be moved to the text segment. The
38 * various DES tables must appear before any function definitions
39 * (this is arranged by including them immediately below) and partab
40 * must also appear before and function definitions
41 * This arrangement allows all data up through the first text to
42 * be moved to text.
43 */
44
45 #ifndef _KERNEL
46 #define CRYPT /* cannot configure out of user-level code */
47 #endif
48
49 #ifdef CRYPT
50 #include <sys/types.h>
51 #include <des/softdes.h>
52 #include <des/desdata.h>
53
54 #ifdef sun
55 #include <sys/ioctl.h>
56 #include <sys/des.h>
57 #else
58 #include <des/des.h>
59 #endif
60
61 #include "des_soft.h"
62
63 /*
64 * Fast (?) software implementation of DES
65 * Has been seen going at 2000 bytes/sec on a Sun-2
66 * Works on a VAX too.
67 * Won't work without 8 bit chars and 32 bit longs
68 */
69
70 #define btst(k, b) (k[b >> 3] & (0x80 >> (b & 07)))
71 #define BIT28 (1<<28)
72
73
74 #endif /* def CRYPT */
75
76 static void des_setkey(uchar_t [8], struct deskeydata *, unsigned);
77 static void des_encrypt(uchar_t *, struct deskeydata *);
78
79 #ifndef _KERNEL
80 /*
81 * Table giving odd parity in the low bit for ASCII characters
82 */
83 static char partab[128] = {
84 0x01, 0x01, 0x02, 0x02, 0x04, 0x04, 0x07, 0x07,
85 0x08, 0x08, 0x0b, 0x0b, 0x0d, 0x0d, 0x0e, 0x0e,
86 0x10, 0x10, 0x13, 0x13, 0x15, 0x15, 0x16, 0x16,
87 0x19, 0x19, 0x1a, 0x1a, 0x1c, 0x1c, 0x1f, 0x1f,
88 0x20, 0x20, 0x23, 0x23, 0x25, 0x25, 0x26, 0x26,
89 0x29, 0x29, 0x2a, 0x2a, 0x2c, 0x2c, 0x2f, 0x2f,
90 0x31, 0x31, 0x32, 0x32, 0x34, 0x34, 0x37, 0x37,
91 0x38, 0x38, 0x3b, 0x3b, 0x3d, 0x3d, 0x3e, 0x3e,
92 0x40, 0x40, 0x43, 0x43, 0x45, 0x45, 0x46, 0x46,
93 0x49, 0x49, 0x4a, 0x4a, 0x4c, 0x4c, 0x4f, 0x4f,
94 0x51, 0x51, 0x52, 0x52, 0x54, 0x54, 0x57, 0x57,
95 0x58, 0x58, 0x5b, 0x5b, 0x5d, 0x5d, 0x5e, 0x5e,
96 0x61, 0x61, 0x62, 0x62, 0x64, 0x64, 0x67, 0x67,
97 0x68, 0x68, 0x6b, 0x6b, 0x6d, 0x6d, 0x6e, 0x6e,
98 0x70, 0x70, 0x73, 0x73, 0x75, 0x75, 0x76, 0x76,
99 0x79, 0x79, 0x7a, 0x7a, 0x7c, 0x7c, 0x7f, 0x7f,
100 };
101
102
103
104 /*
105 * Add odd parity to low bit of 8 byte key
106 */
107 void
des_setparity(char * p)108 des_setparity(char *p)
109 {
110 int i;
111
112 for (i = 0; i < 8; i++) {
113 *p = partab[*p & 0x7f];
114 p++;
115 }
116 }
117 #endif /* def _KERNEL */
118
119 #ifdef CRYPT
120 /*
121 * Software encrypt or decrypt a block of data (multiple of 8 bytes)
122 * Do the CBC ourselves if needed.
123 */
124 int
__des_crypt(char * buf,unsigned int len,struct desparams * desp)125 __des_crypt(char *buf, unsigned int len, struct desparams *desp)
126 {
127 short i;
128 unsigned mode;
129 unsigned dir;
130 char nextiv[8];
131 struct deskeydata softkey;
132
133 mode = (unsigned)desp->des_mode;
134 dir = (unsigned)desp->des_dir;
135 des_setkey(desp->des_key, &softkey, dir);
136 while (len != 0) {
137 switch (mode) {
138 case CBC:
139 switch (dir) {
140 case ENCRYPT:
141 for (i = 0; i < 8; i++)
142 buf[i] ^= desp->des_ivec[i];
143 des_encrypt((uchar_t *)buf, &softkey);
144 for (i = 0; i < 8; i++)
145 desp->des_ivec[i] = buf[i];
146 break;
147 case DECRYPT:
148 for (i = 0; i < 8; i++)
149 nextiv[i] = buf[i];
150 des_encrypt((uchar_t *)buf, &softkey);
151 for (i = 0; i < 8; i++) {
152 buf[i] ^= desp->des_ivec[i];
153 desp->des_ivec[i] = nextiv[i];
154 }
155 break;
156 }
157 break;
158 case ECB:
159 des_encrypt((uchar_t *)buf, &softkey);
160 break;
161 }
162 buf += 8;
163 len -= 8;
164 }
165 return (1);
166 }
167
168
169 /*
170 * Set the key and direction for an encryption operation
171 * We build the 16 key entries here
172 */
173 static void
des_setkey(uchar_t userkey[8],struct deskeydata * kd,unsigned int dir)174 des_setkey(uchar_t userkey[8], struct deskeydata *kd, unsigned int dir)
175 {
176 long C, D;
177 short i;
178
179 /*
180 * First, generate C and D by permuting
181 * the key. The low order bit of each
182 * 8-bit char is not used, so C and D are only 28
183 * bits apiece.
184 */
185 {
186 short bit;
187 const short *pcc = PC1_C, *pcd = PC1_D;
188
189 C = D = 0;
190 for (i = 0; i < 28; i++) {
191 C <<= 1;
192 D <<= 1;
193 bit = *pcc++;
194 if (btst(userkey, bit))
195 C |= 1;
196 bit = *pcd++;
197 if (btst(userkey, bit))
198 D |= 1;
199 }
200 }
201 /*
202 * To generate Ki, rotate C and D according
203 * to schedule and pick up a permutation
204 * using PC2.
205 */
206 for (i = 0; i < 16; i++) {
207 chunk_t *c;
208 short j, k, bit;
209 long bbit;
210
211 /*
212 * Do the "left shift" (rotate)
213 * We know we always rotate by either 1 or 2 bits
214 * the shifts table tells us if its 2
215 */
216 C <<= 1;
217 if (C & BIT28)
218 C |= 1;
219 D <<= 1;
220 if (D & BIT28)
221 D |= 1;
222 if (shifts[i]) {
223 C <<= 1;
224 if (C & BIT28)
225 C |= 1;
226 D <<= 1;
227 if (D & BIT28)
228 D |= 1;
229 }
230 /*
231 * get Ki. Note C and D are concatenated.
232 */
233 bit = 0;
234 switch (dir) {
235 case ENCRYPT:
236 c = &kd->keyval[i]; break;
237 case DECRYPT:
238 c = &kd->keyval[15 - i]; break;
239 }
240 c->long0 = 0;
241 c->long1 = 0;
242 bbit = (1 << 5) << 24;
243 for (j = 0; j < 4; j++) {
244 for (k = 0; k < 6; k++) {
245 if (C & (BIT28 >> PC2_C[bit]))
246 c->long0 |= bbit >> k;
247 if (D & (BIT28 >> PC2_D[bit]))
248 c->long1 |= bbit >> k;
249 bit++;
250 }
251 bbit >>= 8;
252 }
253
254 }
255 }
256
257
258
259 /*
260 * Do an encryption operation
261 * Much pain is taken (with preprocessor) to avoid loops so the compiler
262 * can do address arithmetic instead of doing it at runtime.
263 * Note that the byte-to-chunk conversion is necessary to guarantee
264 * processor byte-order independence.
265 */
266 static void
des_encrypt(uchar_t * data,struct deskeydata * kd)267 des_encrypt(uchar_t *data, struct deskeydata *kd)
268 {
269 chunk_t work1, work2;
270
271 /*
272 * Initial permutation
273 * and byte to chunk conversion
274 */
275 {
276 const uint32_t *lp;
277 uint32_t l0, l1, w;
278 short i, pbit;
279
280 work1.byte0 = data[0];
281 work1.byte1 = data[1];
282 work1.byte2 = data[2];
283 work1.byte3 = data[3];
284 work1.byte4 = data[4];
285 work1.byte5 = data[5];
286 work1.byte6 = data[6];
287 work1.byte7 = data[7];
288 l0 = l1 = 0;
289 w = work1.long0;
290 for (lp = &longtab[0], i = 0; i < 32; i++) {
291 if (w & *lp++) {
292 pbit = IPtab[i];
293 if (pbit < 32)
294 l0 |= longtab[pbit];
295 else
296 l1 |= longtab[pbit-32];
297 }
298 }
299 w = work1.long1;
300 for (lp = &longtab[0], i = 32; i < 64; i++) {
301 if (w & *lp++) {
302 pbit = IPtab[i];
303 if (pbit < 32)
304 l0 |= longtab[pbit];
305 else
306 l1 |= longtab[pbit-32];
307 }
308 }
309 work2.long0 = l0;
310 work2.long1 = l1;
311 }
312
313 /*
314 * Expand 8 bits of 32 bit R to 48 bit R
315 */
316 #define do_R_to_ER(op, b) { \
317 const struct R_to_ER *p = &R_to_ER_tab[b][R.byte##b]; \
318 e0 op p->l0; \
319 e1 op p->l1; \
320 }
321
322 /*
323 * Inner part of the algorithm:
324 * Expand R from 32 to 48 bits; xor key value;
325 * apply S boxes; permute 32 bits of output
326 */
327 #define do_F(iter, inR, outR) { \
328 chunk_t R, ER; \
329 uint32_t e0, e1; \
330 R.long0 = inR; \
331 /* CSTYLED */ \
332 do_R_to_ER(=, 0); \
333 /* CSTYLED */ \
334 do_R_to_ER(|=, 1); \
335 /* CSTYLED */ \
336 do_R_to_ER(|=, 2); \
337 /* CSTYLED */ \
338 do_R_to_ER(|=, 3); \
339 ER.long0 = e0 ^ kd->keyval[iter].long0; \
340 ER.long1 = e1 ^ kd->keyval[iter].long1; \
341 R.long0 = \
342 S_tab[0][ER.byte0] + \
343 S_tab[1][ER.byte1] + \
344 S_tab[2][ER.byte2] + \
345 S_tab[3][ER.byte3] + \
346 S_tab[4][ER.byte4] + \
347 S_tab[5][ER.byte5] + \
348 S_tab[6][ER.byte6] + \
349 S_tab[7][ER.byte7]; \
350 outR = \
351 P_tab[0][R.byte0] + \
352 P_tab[1][R.byte1] + \
353 P_tab[2][R.byte2] + \
354 P_tab[3][R.byte3]; \
355 }
356
357 /*
358 * Do a cipher step
359 * Apply inner part; do xor and exchange of 32 bit parts
360 */
361 #define cipher(iter, inR, inL, outR, outL) { \
362 do_F(iter, inR, outR); \
363 outR ^= inL; \
364 outL = inR; \
365 }
366
367 /*
368 * Apply the 16 ciphering steps
369 */
370 {
371 uint32_t r0, l0, r1, l1;
372
373 l0 = work2.long0;
374 r0 = work2.long1;
375 cipher(0, r0, l0, r1, l1);
376 cipher(1, r1, l1, r0, l0);
377 cipher(2, r0, l0, r1, l1);
378 cipher(3, r1, l1, r0, l0);
379 cipher(4, r0, l0, r1, l1);
380 cipher(5, r1, l1, r0, l0);
381 cipher(6, r0, l0, r1, l1);
382 cipher(7, r1, l1, r0, l0);
383 cipher(8, r0, l0, r1, l1);
384 cipher(9, r1, l1, r0, l0);
385 cipher(10, r0, l0, r1, l1);
386 cipher(11, r1, l1, r0, l0);
387 cipher(12, r0, l0, r1, l1);
388 cipher(13, r1, l1, r0, l0);
389 cipher(14, r0, l0, r1, l1);
390 cipher(15, r1, l1, r0, l0);
391 work1.long0 = r0;
392 work1.long1 = l0;
393 }
394
395 /*
396 * Final permutation
397 * and chunk to byte conversion
398 */
399 {
400 const uint32_t *lp;
401 uint32_t l0, l1, w;
402 short i, pbit;
403
404 l0 = l1 = 0;
405 w = work1.long0;
406 for (lp = &longtab[0], i = 0; i < 32; i++) {
407 if (w & *lp++) {
408 pbit = FPtab[i];
409 if (pbit < 32)
410 l0 |= longtab[pbit];
411 else
412 l1 |= longtab[pbit-32];
413 }
414 }
415 w = work1.long1;
416 for (lp = &longtab[0], i = 32; i < 64; i++) {
417 if (w & *lp++) {
418 pbit = FPtab[i];
419 if (pbit < 32)
420 l0 |= longtab[pbit];
421 else
422 l1 |= longtab[pbit-32];
423 }
424 }
425 work2.long0 = l0;
426 work2.long1 = l1;
427 }
428 data[0] = work2.byte0;
429 data[1] = work2.byte1;
430 data[2] = work2.byte2;
431 data[3] = work2.byte3;
432 data[4] = work2.byte4;
433 data[5] = work2.byte5;
434 data[6] = work2.byte6;
435 data[7] = work2.byte7;
436 }
437 #endif /* def CRYPT */
438