phelix.c

phelix加密算法源代码,是一个开源的加密算法

    assert(0 == (pc.cs.msgLen % 4));    /* can only make ONE sub-word call! */
    pc.cs.msgLen += msgLen;
    i = pc.cs.i;
    pc.cs.Z[1] ^= pc.cs.aadXor;         /* do the AAD xor, if needed */
    pc.cs.aadXor= 0;                    /* next time, the xor will be a nop */

    for (;msgLen;i++,srcPtr++,dstPtr++)
        {
        if (msgLen >= 4)
            msgLen -= 4;
        else    /* remaining partial word */
            {
            p       = dstPtr;           /* where to put final partial word */
            w[0]    = srcPtr[0] & BSWAP(MASK_TAB[msgLen%4]);
            srcPtr  = w;
            dstPtr  = w;
            msgLen  = 0;
            }

        j = i & 7;

        Phelix_H0(pc.cs.Z,0);
        DebugState(i,"a",pc.cs.Z,"  OldZ       = %08X.     X_i_0 = %08X.",
                   pc.cs.oldZ[i&3],pc.ks.X_0[j]);

        Phelix_H1(pc.cs.Z,pc.ks.X_0[j]);
        keyStream = pc.cs.Z[4] + pc.cs.oldZ[i&3];

        plainText   = BSWAP(*srcPtr) ^ keyStream;
        if (srcPtr == w)                /* extend ciphertext to full 32 bits */
            plainText &= MASK_TAB[pc.cs.msgLen % 4];
        *dstPtr     = BSWAP(plainText);
        
        DebugState(i,"b",pc.cs.Z,"  Keystream  = %08X.  plainText= %08X.",keyStream,plainText);

        Phelix_H0(pc.cs.Z,plainText);
        DebugState(i,"c",pc.cs.Z,"               %08s     X_i_1  = %08X.","",pc.ks.X_1[j]);

        Phelix_H1(pc.cs.Z,pc.ks.X_1[j]+i);
        DebugState(i," ",pc.cs.Z,"               %08s  cipherText= %08X.","",keyStream^plainText);
        DebugStr("\n");

        pc.cs.oldZ[i&3] = pc.cs.Z[OLD_Z_REG]; /* save the "old" value */
        }
    if (p)                              /* output partial word */
        p[0] ^= (p[0] ^ w[0]) & BSWAP(MASK_TAB[pc.cs.msgLen%4]);

    pc.cs.i = i;
    ctx->cs = pc.cs;                    /* copy back the modified state */
    }

void PhelixProcessAAD(PhelixContext *ctx,const U08P aad,u32b aadLen)
    {
    u32b i,j,w,plainText;
    c32p srcPtr = (c32p) aad;
    PhelixContext pc = *ctx;            /* make a local copy (for speed) */

    DebugStrN("ProcessAAD: %d bytes\n",aadLen);

    assert(0 == (pc.cs.aadLen[0] % 4)); /* can only make ONE sub-word call! */
    pc.cs.aadLen[0] += aadLen;          /* do a 64-bit add into pc.cs.addLen[] */
    if (pc.cs.aadLen[0] < aadLen)
        pc.cs.aadLen[1]++;

    i = pc.cs.i;                        /* keep it short for cosmetics */
    for (;aadLen;i++,srcPtr++)
        {
        if (aadLen >= 4)        
            aadLen -= 4;
        else                            /* handle any final "odd" aad bytes */
            {
            w       = srcPtr[0] & BSWAP(MASK_TAB[aadLen % 4]);
            srcPtr  = &w;               /* use local copy of masked word */
            aadLen  = 0;                /* we're definitely done now */
            }
        
        j = i & 7;

        Phelix_H0(pc.cs.Z,0);
        DebugState(i,"a",pc.cs.Z,"  OldZ       = %08X.     X_i_0 = %08X.",
                   pc.cs.oldZ[i&3],pc.ks.X_0[j]);

        Phelix_H1(pc.cs.Z,pc.ks.X_0[j]);

        plainText   = BSWAP(*srcPtr);

        DebugState(i,"b",pc.cs.Z,"  %22s  plainText= %08X.","",plainText);

        Phelix_H0(pc.cs.Z,plainText);
        DebugState(i,"c",pc.cs.Z,"               %08s     X_i_1  = %08X.","",pc.ks.X_1[j]);

        Phelix_H1(pc.cs.Z,pc.ks.X_1[j]+i);
        DebugState(i," ",pc.cs.Z,"\n",0,0);

        pc.cs.oldZ[i&3] = pc.cs.Z[OLD_Z_REG]; /* save the "old" value */
        }
    pc.cs.i = i;
    ctx->cs = pc.cs;                    /* copy back the modified state */
    }
            
#define PM32(dst,src,n) ((u32p)(dst))[n] = ((u32p)(src))[n]
#define PutMac(d,s,bits)    /* d = dst, s = src */  \
        switch (bits) {                 \
            case 128: PM32(d,s,3);      \
            case  96: PM32(d,s,2);      \
                      PM32(d,s,1);      \
                      PM32(d,s,0);      \
                      break;            \
            default:  memcpy(d,s,((bits)+7)/8); }   /* optimize "common" cases */

void PhelixFinalize(PhelixContext *ctx,U08P mac)
    {
    u32b i,j,k,plainText,cipherText,keyStream,tmp[MAC_INIT_CNT+MAC_WORD_CNT];
    PhelixContext pc = *ctx;            /* make a local copy (for speed) */

    DebugStr("FinalizeMAC:\n");

    i           = pc.cs.i;
    plainText   = pc.cs.msgLen % 4;
    pc.cs.Z[0] ^= MAC_MAGIC_XOR;
    pc.cs.Z[4] ^= pc.cs.aadLen[0];
    pc.cs.Z[2] ^= pc.cs.aadLen[1];
    pc.cs.Z[1] ^= pc.cs.aadXor;         /* do this in case msgLen == 0 */

    for (k=0;k<MAC_INIT_CNT+MAC_WORD_CNT;k++,i++)
        {
        j = i & 7;

        Phelix_H0(pc.cs.Z,0);
        DebugState(i,"a",pc.cs.Z,"  OldZ       = %08X.     X_i_0 = %08X.",
                   pc.cs.oldZ[i&3],pc.ks.X_0[j]);

        Phelix_H1(pc.cs.Z,pc.ks.X_0[j]);
        keyStream = pc.cs.Z[4] + pc.cs.oldZ[i&3];

        cipherText  = keyStream ^ plainText;
        tmp[k]      = BSWAP(cipherText);

        DebugState(i,"b",pc.cs.Z,"  Keystream  = %08X.  plainText= %08X.",keyStream,plainText);

        Phelix_H0(pc.cs.Z,plainText);
        DebugState(i,"c",pc.cs.Z,"               %08s     X_i_1  = %08X.","",pc.ks.X_1[j]);

        Phelix_H1(pc.cs.Z,pc.ks.X_1[j]+i);
        DebugState(i," ",pc.cs.Z,"               %08s  cipherText= %08X.","",keyStream^plainText);
        DebugStr("\n");

        pc.cs.oldZ[i&3] = pc.cs.Z[OLD_Z_REG]; /* save the "old" value */
        }
    
    PutMac(mac,&tmp[MAC_INIT_CNT],pc.ks.macSize);

    /* no need to copy back any modified context -- we're done with this one! */
    }

u32b PhelixIncremental_CodeSize(void)
    {
#if defined(_MSC_VER) | defined(__STDC__)
    return 0; /* MSVC42 doesn't work here for some reason */
#else
    return ((u08b *) PhelixIncremental_CodeSize) - ((u08b *) PhelixInit);
#endif
    }

/* Phelix encryption/decryption in C (not real fast, but useful for checking vs. ASM) */
void PhelixProcessPacket(int action,PhelixPacketParms)
    {
    enum
        {
        PHASE_AAD      =    0,      /* "phases" of the encryption/decryption operation */
        PHASE_DATA,
        PHASE_ODD_BYTES,
        PHASE_MAC_GEN,
        PHASE_DONE
        };
    int     doEncrypt = (action == 0);
    u32b    i,j,k,phase,wCnt,keyStream,plainText,cipherText,encBlk,aadLeft;
    u32b    tmp[MAC_INIT_CNT + MAC_WORD_CNT + 4];
    c32p    srcPtr,aadPtr;           /* const pointers to u32b[]          */
    u32p    dstPtr;                  /*       pointer  to u32b[]          */
    PhelixContext pc = * ctx;        /* local copy of context (for speed) */

    DebugStrN("\n**********\nPhelix_C_%s:  ",(doEncrypt)?"Encrypt":"Decrypt");
    DebugStrN("msgLen = %d. ",msgLen);
    DebugStrN("aadLen = %d.\n",aadLen);
    PhelixSetupNonce(&pc,nonce);    /* do the initial nonce mixing */
    i = pc.cs.i;                    /* use "local" copy of i here   */
    aadLeft = aadLen;               /* number of bytes of aad remaining */
    aadPtr  = (c32p) aad;
    phase   = (aadLeft) ? PHASE_AAD : PHASE_DATA;
    srcPtr  = NULL;                 /* avoid compiler warnings :( */
    encBlk  = 0;

    for (; phase < PHASE_DONE ; phase++)
        {
        switch (phase)
            {
            case PHASE_AAD:
                if (aadLeft >= 4)           /* handle full words first */
                    {
                    srcPtr  = aadPtr;
                    dstPtr  = tmp;          /* discard the ciphertext */
                    wCnt    = ((aadLeft > sizeof(tmp)) ? sizeof(tmp) : aadLeft) /4;
                    aadLeft-= wCnt*4;       /* adjust count   */
                    aadPtr += wCnt;
                    if (aadLeft)            /* will there be anything left after this? */
                        phase--;            /* if so, we need to come back here for more */
                    DebugStrN("**********PHASE_AAD (%d bytes):\n",wCnt*4);
                    }
                else                        /* handle final odd bytes */
                    {
                    DebugStrN("**********PHASE_AAD (%d bytes + padding):\n",aadLeft);
                    tmp[0]  = aadPtr[0] & BSWAP(MASK_TAB[aadLeft % 4]);
                    srcPtr  = dstPtr = tmp; /* encrypt in place in temp buffer */
                    wCnt    = 1;            /* just one word */
                    aadLeft = 0;            /* done with AAD after this */
                    }
                encBlk  = 1;
                break;
            case PHASE_DATA:
                DebugStr("**********PHASE_DATA:\n");
                pc.cs.Z[1] ^= pc.cs.aadXor;
                srcPtr  = (c32p) src;
                dstPtr  = (u32p) dst;
                wCnt    = msgLen/4;         /* number of full words of source */
                encBlk  = doEncrypt;
                break;
            case PHASE_ODD_BYTES:
                if ((msgLen % 4) == 0)      /* are there any bytes left mod 4? */
                    continue;               /* if not, just start next phase */
                DebugStr("**********PHASE_ODD_BYTES:\n");
                tmp[0]  = srcPtr[0] & BSWAP(MASK_TAB[msgLen % 4]);
                srcPtr  = dstPtr = tmp;     /* encrypt in place in temp buffer */
                wCnt    = 1;
                encBlk  = doEncrypt;
                break;
            case PHASE_MAC_GEN:
                DebugStr("**********PHASE_MAC_GEN:\n");
                k = msgLen % 4;
                if (k)
                    {   /* first, do we need "cleanup" for odd byte results? */
                    dstPtr  = (u32p) dst;
                    tmp[0] &= BSWAP(MASK_TAB[k]);
                    dstPtr[msgLen/4] ^= (tmp[0] ^ dstPtr[msgLen/4]) & BSWAP(MASK_TAB[k]);
                    }
                pc.cs.Z[0] ^= MAC_MAGIC_XOR;/* magic XOR constant for MAC computation */
                pc.cs.Z[4] ^= aadLen;       /* only 32-bit aadLen used here */
                wCnt = MAC_INIT_CNT + MAC_WORD_CNT;
                k    = BSWAP(k);
                for (j=0;j<wCnt;j++)        /* use plaintext = (msgLen mod 4) */
                    tmp[j] = k;
                srcPtr  = dstPtr = tmp;
                encBlk = 1;                 /* use encrypt block function */
                break;
            default:
                assert(0);                  /* should never come here */
                wCnt    = 0;                /* (avoid uninitialized var compiler warnings */
                srcPtr  = NULL;
                dstPtr  = NULL;
            }
        /* here to do some encryption (wCnt words, using srcPtr, dstPtr) */
        for (;wCnt;wCnt--,srcPtr++,dstPtr++,i++)
            {
            j = i & 7;

            Phelix_H0(pc.cs.Z,0);
            DebugState(i,"a",pc.cs.Z,"  OldZ       = %08X.     X_i_0 = %08X.",
                       pc.cs.oldZ[i&3],pc.ks.X_0[j]);

            Phelix_H1(pc.cs.Z,pc.ks.X_0[j]);
            keyStream = pc.cs.Z[4] + pc.cs.oldZ[i&3];
            if (encBlk)
                {   /* encryption block (used in some phases of decryption operation) */
                plainText   = BSWAP(*srcPtr);
                cipherText  = keyStream ^ plainText;
                *dstPtr     = BSWAP(cipherText);
                }
            else
                {   /* decryption block (only used during decryption operations) */
                plainText   = BSWAP(*srcPtr) ^ keyStream;
                if (phase == PHASE_ODD_BYTES)   /* extend ciphertext to full 32 bits */
                    plainText &= MASK_TAB[msgLen % 4];
                *dstPtr     = BSWAP(plainText);
                }
            DebugState(i,"b",pc.cs.Z,"  Keystream  = %08X.  plainText= %08X.",keyStream,plainText);

            Phelix_H0(pc.cs.Z,plainText);
            DebugState(i,"c",pc.cs.Z,"               %08s     X_i_1  = %08X.","",pc.ks.X_1[j]);

            Phelix_H1(pc.cs.Z,pc.ks.X_1[j]+i);
            DebugState(i," ",pc.cs.Z,"               %08s  cipherText= %08X.","",keyStream^plainText);
            DebugStr("\n");

            pc.cs.oldZ[i&3] = pc.cs.Z[OLD_Z_REG]; /* save the "old" value */
            }
        }
    /* done with encrypting/decrypting. Ouput/check MAC at tmp[MAC_INIT_CNT] */
    PutMac(mac,&(tmp[MAC_INIT_CNT]),pc.ks.macSize);
    }

void PhelixEncryptPacket(PhelixPacketParms)
	{
	PhelixProcessPacket(0,ctx,nonce,aad,aadLen,src,dst,msgLen,mac);
	}

void PhelixDecryptPacket(PhelixPacketParms)
	{
	PhelixProcessPacket(1,ctx,nonce,aad,aadLen,src,dst,msgLen,mac);
	}

u32b PhelixProcessPacket_CodeSize(void)
    {
#if defined(_MSC_VER) | defined(__STDC__)
    return 0; /* MSVC42 doesn't work here for some reason */
#else
    return ((u08b *) PhelixProcessPacket_CodeSize) - ((u08b *) PhelixProcessPacket);
#endif
    }