From 4582b5447826886a4ce7f5cd095daed2513d352d Mon Sep 17 00:00:00 2001 From: Kévin Le Gouguec Date: Tue, 12 Mar 2019 10:42:10 +0100 Subject: Ajout de l'implémentation à seuil d'ordre 1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Modifications nécessaires dans l'infra : - retrait conditionnel de test-tweakey, vu que l'API n'est pas la même pour l'implémentation à seuil, - retrait conditionnel de l'avertissement "-Wparentheses", plus agaçant qu'autre chose sur les calculs booléens de cipher.c, e.g. y_hi&3 ^ (y_hi&8)>>1 où la priorité est intuitive (shifts avant AND avant XOR). C'est dommage de perdre les avertissements sur if (a&b == c), mais tant pis… On va compter sur La Suite De Test®©™ pour nous couvrir. Co-authored-by: Alexandre Adomnicai Co-authored-by: leo --- src/add_threshold/tweakey.c | 216 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 216 insertions(+) create mode 100644 src/add_threshold/tweakey.c (limited to 'src/add_threshold/tweakey.c') diff --git a/src/add_threshold/tweakey.c b/src/add_threshold/tweakey.c new file mode 100644 index 0000000..28d0e3d --- /dev/null +++ b/src/add_threshold/tweakey.c @@ -0,0 +1,216 @@ +/* +Implementation of the Lilliput-AE tweakable block cipher. + +Authors: + Kévin Le Gouguec, + Léo Reynaud, + Alexandre Adomnicai, 2019. + +For more information, feedback or questions, refer to our website: +https://paclido.fr/lilliput-ae + +To the extent possible under law, the implementer has waived all copyright +and related or neighboring rights to the source code in this file. +http://creativecommons.org/publicdomain/zero/1.0/ + +--- + +This file provides an implementation of Lilliput-TBC's tweakey schedule, +where multiplications by matrices M and M_R to the power n are performed +by functions expressing the exponentiated matrices with shifts and XORs. +*/ + +#include +#include + +#include "constants.h" +#include "tweakey.h" + + +#define LANE_BITS 64 +#define LANE_BYTES (LANE_BITS/8) +#define LANES_NB (TWEAKEY_BYTES/LANE_BYTES) + + +void tweakey_state_init_TI( + uint8_t TK_X[TWEAKEY_BYTES], + uint8_t TK_Y[KEY_BYTES], + const uint8_t key[KEY_BYTES], + const uint8_t tweak[TWEAK_BYTES] +) +{ + // To be replaced by real random numbers!!! + uint8_t SHARES_0[KEY_BYTES] = { + 0x0f, 0x1e, 0x2d, 0x3c, 0x4b, 0x5a, 0x69, 0x78, 0x87, 0x96, 0xa5, 0xb4, 0xc3, 0xd2, 0xe1, 0xf0 + }; + + memcpy(TK_Y, SHARES_0, KEY_BYTES); + memcpy(TK_X, tweak, TWEAK_BYTES); + + for (size_t i=0; i>3 ^ x[3]; + y[3] = x[2]; + y[2] = x[6]<<2 ^ x[1]; + y[1] = x[0]; + y[0] = x[7]; +} + +static void _multiply_M2(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) +{ + uint8_t x_M_5 = x[5]<<3 ^ x[4]; + uint8_t x_M_4 = x[4]>>3 ^ x[3]; + + y[7] = x[5]; + y[6] = x_M_5; + y[5] = x_M_5<<3 ^ x_M_4; + y[4] = x_M_4>>3 ^ x[2]; + y[3] = x[6]<<2 ^ x[1]; + y[2] = x[5]<<2 ^ x[0]; + y[1] = x[7]; + y[0] = x[6]; +} + +static void _multiply_M3(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) +{ + uint8_t x_M_5 = x[5]<<3 ^ x[4]; + uint8_t x_M_4 = x[4]>>3 ^ x[3]; + uint8_t x_M2_5 = x_M_5<<3 ^ x_M_4; + uint8_t x_M2_4 = x_M_4>>3 ^ x[2]; + + y[7] = x_M_5; + y[6] = x_M2_5; + y[5] = x_M2_5<<3 ^ x_M2_4; + y[4] = x_M2_4>>3 ^ x[6]<<2 ^ x[1]; + y[3] = x[5]<<2 ^ x[0]; + y[2] = x_M_5<<2 ^ x[7]; + y[1] = x[6]; + y[0] = x[5]; +} + +static void _multiply_MR(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) +{ + y[0] = x[1]; + y[1] = x[2]; + y[2] = x[3] ^ x[4]>>3; + y[3] = x[4]; + y[4] = x[5] ^ x[6]<<3; + y[5] = x[3]<<2 ^ x[6]; + y[6] = x[7]; + y[7] = x[0]; +} + +static void _multiply_MR2(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) +{ + uint8_t x_MR_4 = x[5] ^ x[6]<<3; + + y[0] = x[2]; + y[1] = x[3] ^ x[4]>>3; + y[2] = x[4] ^ x_MR_4>>3; + y[3] = x_MR_4; + y[4] = x[3]<<2 ^ x[6] ^ x[7]<<3; + y[5] = x[4]<<2 ^ x[7]; + y[6] = x[0]; + y[7] = x[1]; +} + +static void _multiply_MR3(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) +{ + uint8_t x_MR_4 = x[5] ^ x[6]<<3; + uint8_t x_MR2_4 = x[3]<<2 ^ x[6] ^ x[7]<<3; + + y[0] = x[3] ^ x[4]>>3; + y[1] = x[4] ^ x_MR_4>>3; + y[2] = x_MR_4 ^ x_MR2_4>>3; + y[3] = x_MR2_4; + y[4] = x[0]<<3 ^ x[4]<<2 ^ x[7]; + y[5] = x_MR_4<<2 ^ x[0]; + y[6] = x[1]; + y[7] = x[2]; +} + +typedef void (*matrix_multiplication)(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]); + +static const matrix_multiplication ALPHAS[6] = { + _multiply_M, + _multiply_M2, + _multiply_M3, + _multiply_MR, + _multiply_MR2, + _multiply_MR3 +}; + + +void tweakey_state_update_TI(uint8_t TK_X[TWEAKEY_BYTES], uint8_t TK_Y[KEY_BYTES]) +{ + /* Skip lane 0, as it is multiplied by the identity matrix. */ + + for (size_t j=1; j<(TWEAK_BYTES/LANE_BYTES); j++) + { + uint8_t *TKj_X = TK_X + j*LANE_BYTES; + + uint8_t TKj_old_X[LANE_BYTES]; + memcpy(TKj_old_X, TKj_X, LANE_BYTES); + + ALPHAS[j-1](TKj_old_X, TKj_X); + } + + for (size_t j=0; j<(KEY_BYTES/LANE_BYTES); j++) + { + uint8_t *TKj_X = TK_X + (j + (TWEAK_BYTES/LANE_BYTES))*LANE_BYTES; + uint8_t *TKj_Y = TK_Y + j*LANE_BYTES; + + uint8_t TKj_X_old[LANE_BYTES]; + uint8_t TKj_Y_old[LANE_BYTES]; + memcpy(TKj_X_old, TKj_X, LANE_BYTES); + memcpy(TKj_Y_old, TKj_Y, LANE_BYTES); + + ALPHAS[j-1 + (TWEAK_BYTES/LANE_BYTES)](TKj_X_old, TKj_X); + ALPHAS[j-1 + (TWEAK_BYTES/LANE_BYTES)](TKj_Y_old, TKj_Y); + } +} -- cgit v1.2.3