📄 camellia_8cpp-source.html
字号:
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="Content-Type" content="text/html;charset=UTF-8"><title>Crypto++: camellia.cpp Source File</title><link href="doxygen.css" rel="stylesheet" type="text/css"><link href="tabs.css" rel="stylesheet" type="text/css"></head><body><!-- Generated by Doxygen 1.5.2 --><div class="tabs"> <ul> <li><a href="index.html"><span>Main Page</span></a></li> <li><a href="namespaces.html"><span>Namespaces</span></a></li> <li><a href="classes.html"><span>Classes</span></a></li> <li class="current"><a href="files.html"><span>Files</span></a></li> </ul></div><div class="tabs"> <ul> <li><a href="files.html"><span>File List</span></a></li> <li><a href="globals.html"><span>File Members</span></a></li> </ul></div><h1>camellia.cpp</h1><div class="fragment"><pre class="fragment"><a name="l00001"></a>00001 <span class="comment">// camellia.cpp - by Kevin Springle, 2003</span><a name="l00002"></a>00002 <span class="comment">// This code is hereby placed in the public domain.</span><a name="l00003"></a>00003 <a name="l00004"></a>00004 <span class="comment">/*</span><a name="l00005"></a>00005 <span class="comment">Optimisations and defense against timing attacks added in Jan 2007 by Wei Dai.</span><a name="l00006"></a>00006 <span class="comment"></span><a name="l00007"></a>00007 <span class="comment">The first 2 rounds and the last round seem especially vulnerable to timing</span><a name="l00008"></a>00008 <span class="comment">attacks. The protection is similar to what was implemented for Rijndael.</span><a name="l00009"></a>00009 <span class="comment">See comments at top of rijndael.cpp for more details.</span><a name="l00010"></a>00010 <span class="comment">*/</span><a name="l00011"></a>00011 <a name="l00012"></a>00012 <span class="preprocessor">#include "pch.h"</span><a name="l00013"></a>00013 <a name="l00014"></a>00014 <span class="preprocessor">#include "<a class="code" href="camellia_8h.html">camellia.h</a>"</span><a name="l00015"></a>00015 <span class="preprocessor">#include "misc.h"</span><a name="l00016"></a>00016 <span class="preprocessor">#include "cpu.h"</span><a name="l00017"></a>00017 <a name="l00018"></a>00018 NAMESPACE_BEGIN(CryptoPP)<a name="l00019"></a>00019 <a name="l00020"></a>00020 <span class="comment">// round implementation that uses a small table for protection against timing attacks</span><a name="l00021"></a>00021 <span class="preprocessor">#define SLOW_ROUND(lh, ll, rh, rl, kh, kl) { \</span><a name="l00022"></a>00022 <span class="preprocessor"> word32 zr = ll ^ kl; \</span><a name="l00023"></a>00023 <span class="preprocessor"> word32 zl = lh ^ kh; \</span><a name="l00024"></a>00024 <span class="preprocessor"> zr= rotlFixed(s1[GETBYTE(zr, 3)], 1) | \</span><a name="l00025"></a>00025 <span class="preprocessor"> (rotrFixed(s1[GETBYTE(zr, 2)], 1) << 24) | \</span><a name="l00026"></a>00026 <span class="preprocessor"> (s1[rotlFixed(CRYPTOPP_GET_BYTE_AS_BYTE(zr, 1),1)] << 16) | \</span><a name="l00027"></a>00027 <span class="preprocessor"> (s1[GETBYTE(zr, 0)] << 8); \</span><a name="l00028"></a>00028 <span class="preprocessor"> zl= (s1[GETBYTE(zl, 3)] << 24) | \</span><a name="l00029"></a>00029 <span class="preprocessor"> (rotlFixed(s1[GETBYTE(zl, 2)], 1) << 16) | \</span><a name="l00030"></a>00030 <span class="preprocessor"> (rotrFixed(s1[GETBYTE(zl, 1)], 1) << 8) | \</span><a name="l00031"></a>00031 <span class="preprocessor"> s1[rotlFixed(CRYPTOPP_GET_BYTE_AS_BYTE(zl, 0), 1)]; \</span><a name="l00032"></a>00032 <span class="preprocessor"> zl ^= zr; \</span><a name="l00033"></a>00033 <span class="preprocessor"> zr = zl ^ rotlFixed(zr, 8); \</span><a name="l00034"></a>00034 <span class="preprocessor"> zl = zr ^ rotrFixed(zl, 8); \</span><a name="l00035"></a>00035 <span class="preprocessor"> rh ^= rotlFixed(zr, 16); \</span><a name="l00036"></a>00036 <span class="preprocessor"> rh ^= zl; \</span><a name="l00037"></a>00037 <span class="preprocessor"> rl ^= rotlFixed(zl, 8); \</span><a name="l00038"></a>00038 <span class="preprocessor"> }</span><a name="l00039"></a>00039 <span class="preprocessor"></span><a name="l00040"></a>00040 <span class="comment">// normal round - same output as above but using larger tables for faster speed</span><a name="l00041"></a>00041 <span class="preprocessor">#define ROUND(lh, ll, rh, rl, kh, kl) { \</span><a name="l00042"></a>00042 <span class="preprocessor"> word32 th = lh ^ kh; \</span><a name="l00043"></a>00043 <span class="preprocessor"> word32 tl = ll ^ kl; \</span><a name="l00044"></a>00044 <span class="preprocessor"> word32 d = SP[0][GETBYTE(tl,0)] ^ SP[1][GETBYTE(tl,3)] ^ SP[2][GETBYTE(tl,2)] ^ SP[3][GETBYTE(tl,1)]; \</span><a name="l00045"></a>00045 <span class="preprocessor"> word32 u = SP[0][GETBYTE(th,3)] ^ SP[1][GETBYTE(th,2)] ^ SP[2][GETBYTE(th,1)] ^ SP[3][GETBYTE(th,0)]; \</span><a name="l00046"></a>00046 <span class="preprocessor"> d ^= u; \</span><a name="l00047"></a>00047 <span class="preprocessor"> rh ^= d; \</span><a name="l00048"></a>00048 <span class="preprocessor"> rl ^= d; \</span><a name="l00049"></a>00049 <span class="preprocessor"> rl ^= rotrFixed(u, 8);}</span><a name="l00050"></a>00050 <span class="preprocessor"></span><a name="l00051"></a>00051 <span class="preprocessor">#define DOUBLE_ROUND(lh, ll, rh, rl, k0, k1, k2, k3) \</span><a name="l00052"></a>00052 <span class="preprocessor"> ROUND(lh, ll, rh, rl, k0, k1) \</span><a name="l00053"></a>00053 <span class="preprocessor"> ROUND(rh, rl, lh, ll, k2, k3)</span><a name="l00054"></a>00054 <span class="preprocessor"></span><a name="l00055"></a>00055 <span class="preprocessor">#ifdef IS_LITTLE_ENDIAN</span><a name="l00056"></a>00056 <span class="preprocessor"></span><span class="preprocessor">#define EFI(i) (1-(i))</span><a name="l00057"></a>00057 <span class="preprocessor"></span><span class="preprocessor">#else</span><a name="l00058"></a>00058 <span class="preprocessor"></span><span class="preprocessor">#define EFI(i) (i)</span><a name="l00059"></a>00059 <span class="preprocessor"></span><span class="preprocessor">#endif</span><a name="l00060"></a>00060 <span class="preprocessor"></span><a name="l00061"></a>00061 <span class="keywordtype">void</span> Camellia::Base::UncheckedSetKey(<span class="keyword">const</span> byte *key, <span class="keywordtype">unsigned</span> <span class="keywordtype">int</span> keylen, <span class="keyword">const</span> <a class="code" href="class_name_value_pairs.html" title="interface for retrieving values given their names">NameValuePairs</a> &)<a name="l00062"></a>00062 {<a name="l00063"></a>00063 m_rounds = (keylen >= 24) ? 4 : 3;<a name="l00064"></a>00064 <span class="keywordtype">unsigned</span> <span class="keywordtype">int</span> kslen = (8 * m_rounds + 2);<a name="l00065"></a>00065 m_key.New(kslen*2);<a name="l00066"></a>00066 word32 *ks32 = m_key.data();<a name="l00067"></a>00067 <span class="keywordtype">int</span> m=0, a=0;<a name="l00068"></a>00068 <span class="keywordflow">if</span> (!<a class="code" href="class_public_blum_blum_shub.html#0ad21fce7f3113ab25ea05e47773a786" title="returns whether this is an encryption object">IsForwardTransformation</a>())<a name="l00069"></a>00069 m = -1, a = kslen-1;<a name="l00070"></a>00070 <a name="l00071"></a>00071 word32 kl0, kl1, kl2, kl3;<a name="l00072"></a>00072 <a class="code" href="class_get_block.html">GetBlock<word32, BigEndian, false></a> getBlock(key);<a name="l00073"></a>00073 getBlock(kl0)(kl1)(kl2)(kl3);<a name="l00074"></a>00074 word32 k0=kl0, k1=kl1, k2=kl2, k3=kl3;<a name="l00075"></a>00075 <a name="l00076"></a>00076 <span class="preprocessor">#define CALC_ADDR2(base, i, j) ((byte *)(base)+8*(i)+4*(j)+((-16*(i))&m))</span><a name="l00077"></a>00077 <span class="preprocessor"></span><span class="preprocessor">#define CALC_ADDR(base, i) CALC_ADDR2(base, i, 0)</span><a name="l00078"></a>00078 <span class="preprocessor"></span><a name="l00079"></a>00079 <span class="preprocessor">#if !defined(WORD64_AVAILABLE)</span><a name="l00080"></a>00080 <span class="preprocessor"></span> ks32 += 2*a;<a name="l00081"></a>00081 <span class="preprocessor">#define PREPARE_KS_ROUNDS</span><a name="l00082"></a>00082 <span class="preprocessor"></span><span class="preprocessor">#define KS_ROUND_0(i) \</span><a name="l00083"></a>00083 <span class="preprocessor"> *(word32*)CALC_ADDR2(ks32, i+EFI(0), EFI(0)) = k0; \</span><a name="l00084"></a>00084 <span class="preprocessor"> *(word32*)CALC_ADDR2(ks32, i+EFI(0), EFI(1)) = k1; \</span><a name="l00085"></a>00085 <span class="preprocessor"> *(word32*)CALC_ADDR2(ks32, i+EFI(1), EFI(0)) = k2; \</span><a name="l00086"></a>00086 <span class="preprocessor"> *(word32*)CALC_ADDR2(ks32, i+EFI(1), EFI(1)) = k3</span><a name="l00087"></a>00087 <span class="preprocessor"></span><span class="preprocessor">#define KS_ROUND(i, r, which) \</span><a name="l00088"></a>00088 <span class="preprocessor"> if (which & (1<<((7-r/32)%4/2))) *(word32*)CALC_ADDR2(ks32, i+EFI((7-r/32)%4/2), EFI((7-r/32)%2)) = (k3 << (r%32)) | (k0 >> (32-r%32)); \</span><a name="l00089"></a>00089 <span class="preprocessor"> if (which & (1<<((6-r/32)%4/2))) *(word32*)CALC_ADDR2(ks32, i+EFI((6-r/32)%4/2), EFI((6-r/32)%2)) = (k2 << (r%32)) | (k3 >> (32-r%32)); \</span><a name="l00090"></a>00090 <span class="preprocessor"> if (which & (1<<((5-r/32)%4/2))) *(word32*)CALC_ADDR2(ks32, i+EFI((5-r/32)%4/2), EFI((5-r/32)%2)) = (k1 << (r%32)) | (k2 >> (32-r%32)); \</span><a name="l00091"></a>00091 <span class="preprocessor"> if (which & (1<<((4-r/32)%4/2))) *(word32*)CALC_ADDR2(ks32, i+EFI((4-r/32)%4/2), EFI((4-r/32)%2)) = (k0 << (r%32)) | (k1 >> (32-r%32))</span><a name="l00092"></a>00092 <span class="preprocessor"></span><span class="preprocessor">#elif 1</span><a name="l00093"></a>00093 <span class="preprocessor"></span> word64 kwl, kwr;<a name="l00094"></a>00094 ks32 += 2*a;<a name="l00095"></a>00095 <span class="preprocessor">#define PREPARE_KS_ROUNDS \</span><a name="l00096"></a>00096 <span class="preprocessor"> kwl = (word64(k0) << 32) | k1; \</span><a name="l00097"></a>00097 <span class="preprocessor"> kwr = (word64(k2) << 32) | k3</span><a name="l00098"></a>00098 <span class="preprocessor"></span><span class="preprocessor">#define KS_ROUND_0(i) \</span><a name="l00099"></a>00099 <span class="preprocessor"> *(word64*)CALC_ADDR(ks32, i+EFI(0)) = kwl; \</span><a name="l00100"></a>00100 <span class="preprocessor"> *(word64*)CALC_ADDR(ks32, i+EFI(1)) = kwr</span><a name="l00101"></a>00101 <span class="preprocessor"></span><span class="preprocessor">#define KS_ROUND(i, r, which) \</span><a name="l00102"></a>00102 <span class="preprocessor"> if (which & (1<<int(r<64))) *(word64*)CALC_ADDR(ks32, i+EFI(r<64)) = (kwr << (r%64)) | (kwl >> (64 - (r%64))); \</span><a name="l00103"></a>00103 <span class="preprocessor"> if (which & (1<<int(r>64))) *(word64*)CALC_ADDR(ks32, i+EFI(r>64)) = (kwl << (r%64)) | (kwr >> (64 - (r%64)))</span><a name="l00104"></a>00104 <span class="preprocessor"></span><span class="preprocessor">#else</span><a name="l00105"></a>00105 <span class="preprocessor"></span> <span class="comment">// SSE2 version is 30% faster on Intel Core 2. Doesn't seem worth the hassle of maintenance, but left here</span><a name="l00106"></a>00106 <span class="comment">// #if'd out in case someone needs it.</span><a name="l00107"></a>00107 __m128i kw, kw2;<a name="l00108"></a>00108 __m128i *ks128 = (__m128i *)ks32+a/2;<a name="l00109"></a>00109 ks32 += 2*a;<a name="l00110"></a>00110 <span class="preprocessor">#define PREPARE_KS_ROUNDS \</span><a name="l00111"></a>00111 <span class="preprocessor"> kw = _mm_set_epi32(k0, k1, k2, k3); \</span><a name="l00112"></a>00112 <span class="preprocessor"> if (m) kw2 = kw, kw = _mm_shuffle_epi32(kw, _MM_SHUFFLE(1, 0, 3, 2)); \</span><a name="l00113"></a>00113 <span class="preprocessor"> else kw2 = _mm_shuffle_epi32(kw, _MM_SHUFFLE(1, 0, 3, 2))</span><a name="l00114"></a>00114 <span class="preprocessor"></span><span class="preprocessor">#define KS_ROUND_0(i) \</span><a name="l00115"></a>00115 <span class="preprocessor"> _mm_store_si128((__m128i *)CALC_ADDR(ks128, i), kw)</span><a name="l00116"></a>00116 <span class="preprocessor"></span><span class="preprocessor">#define KS_ROUND(i, r, which) { \</span><a name="l00117"></a>00117 <span class="preprocessor"> __m128i temp; \</span><a name="l00118"></a>00118 <span class="preprocessor"> if (r<64 && (which!=1 || m)) temp = _mm_or_si128(_mm_slli_epi64(kw, r%64), _mm_srli_epi64(kw2, 64-r%64)); \</span><a name="l00119"></a>00119 <span class="preprocessor"> else temp = _mm_or_si128(_mm_slli_epi64(kw2, r%64), _mm_srli_epi64(kw, 64-r%64)); \</span><a name="l00120"></a>00120 <span class="preprocessor"> if (which & 2) _mm_store_si128((__m128i *)CALC_ADDR(ks128, i), temp); \</span>⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -