diff options
Diffstat (limited to 'src')
30 files changed, 771 insertions, 16 deletions
diff --git a/src/add_threshold/cipher.c b/src/add_threshold/cipher.c new file mode 100644 index 0000000..7efd4ae --- /dev/null +++ b/src/add_threshold/cipher.c @@ -0,0 +1,309 @@ +/* +Implementation of the Lilliput-AE tweakable block cipher. + +Authors, hereby denoted as "the implementer": + Alexandre Adomnicai, + Kévin Le Gouguec, + Léo Reynaud, + 2019. + +For more information, feedback or questions, refer to our website: +https://paclido.fr/lilliput-ae + +To the extent possible under law, the implementer has waived all copyright +and related or neighboring rights to the source code in this file. +http://creativecommons.org/publicdomain/zero/1.0/ + +--- + +This file provides a first-order threshold implementation for Lilliput-TBC, +where the input block is split into three shares. +*/ + +#include <stdint.h> +#include <string.h> + +#include "cipher.h" +#include "constants.h" +#include "random.h" +#include "tweakey.h" + + +enum permutation +{ + PERMUTATION_ENCRYPTION = 0, /* PI(i) */ + PERMUTATION_DECRYPTION = 1, /* PI^-1(i) */ + PERMUTATION_NONE +}; + +typedef enum permutation permutation; + +static const uint8_t PERMUTATIONS[2][BLOCK_BYTES] = { + [PERMUTATION_ENCRYPTION] = { 13, 9, 14, 8, 10, 11, 12, 15, 4, 5, 3, 1, 2, 6, 0, 7 }, + [PERMUTATION_DECRYPTION] = { 14, 11, 12, 10, 8, 9, 13, 15, 3, 1, 4, 5, 6, 0, 2, 7 } +}; + +static const uint8_t F[16][16] = { + {0x0, 0x2, 0x0, 0x2, 0x2, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x2, 0x2, 0x0, 0x2, 0x0}, + {0x0, 0x2, 0x9, 0xb, 0x3, 0x1, 0xa, 0x8, 0xd, 0xf, 0x4, 0x6, 0xe, 0xc, 0x7, 0x5}, + {0x0, 0xb, 0x0, 0xb, 0xb, 0x0, 0xb, 0x0, 0x1, 0xa, 0x1, 0xa, 0xa, 0x1, 0xa, 0x1}, + {0x9, 0x2, 0x0, 0xb, 0x3, 0x8, 0xa, 0x1, 0x5, 0xe, 0xc, 0x7, 0xf, 0x4, 0x6, 0xd}, + {0x1, 0x2, 0x8, 0xb, 0x3, 0x0, 0xa, 0x9, 0x9, 0xa, 0x0, 0x3, 0xb, 0x8, 0x2, 0x1}, + {0x0, 0x3, 0x0, 0x3, 0x3, 0x0, 0x3, 0x0, 0x5, 0x6, 0x5, 0x6, 0x6, 0x5, 0x6, 0x5}, + {0x8, 0x2, 0x1, 0xb, 0x3, 0x9, 0xa, 0x0, 0x1, 0xb, 0x8, 0x2, 0xa, 0x0, 0x3, 0x9}, + {0x0, 0xa, 0x0, 0xa, 0xa, 0x0, 0xa, 0x0, 0x4, 0xe, 0x4, 0xe, 0xe, 0x4, 0xe, 0x4}, + {0x1, 0xe, 0x0, 0xf, 0xb, 0x4, 0xa, 0x5, 0x1, 0xe, 0x0, 0xf, 0xb, 0x4, 0xa, 0x5}, + {0xc, 0x3, 0x4, 0xb, 0x7, 0x8, 0xf, 0x0, 0x1, 0xe, 0x9, 0x6, 0xa, 0x5, 0x2, 0xd}, + {0x0, 0x6, 0x1, 0x7, 0x3, 0x5, 0x2, 0x4, 0x1, 0x7, 0x0, 0x6, 0x2, 0x4, 0x3, 0x5}, + {0x4, 0x2, 0xc, 0xa, 0x6, 0x0, 0xe, 0x8, 0x8, 0xe, 0x0, 0x6, 0xa, 0xc, 0x2, 0x4}, + {0x8, 0x6, 0x0, 0xe, 0x2, 0xc, 0xa, 0x4, 0x0, 0xe, 0x8, 0x6, 0xa, 0x4, 0x2, 0xc}, + {0x4, 0xa, 0x5, 0xb, 0xf, 0x1, 0xe, 0x0, 0x1, 0xf, 0x0, 0xe, 0xa, 0x4, 0xb, 0x5}, + {0x0, 0x7, 0x8, 0xf, 0x3, 0x4, 0xb, 0xc, 0x9, 0xe, 0x1, 0x6, 0xa, 0xd, 0x2, 0x5}, + {0x5, 0x2, 0x4, 0x3, 0x7, 0x0, 0x6, 0x1, 0x1, 0x6, 0x0, 0x7, 0x3, 0x4, 0x2, 0x5} +}; + +static const uint8_t G[4][16] = { + {0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8, 0x9, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf}, + {0x0, 0x1, 0x2, 0x3, 0x5, 0x4, 0x7, 0x6, 0x8, 0x9, 0xa, 0xb, 0xd, 0xc, 0xf, 0xe}, + {0x0, 0x1, 0x3, 0x2, 0x4, 0x5, 0x7, 0x6, 0x8, 0x9, 0xb, 0xa, 0xc, 0xd, 0xf, 0xe}, + {0x1, 0x0, 0x2, 0x3, 0x4, 0x5, 0x7, 0x6, 0x9, 0x8, 0xa, 0xb, 0xc, 0xd, 0xf, 0xe} +}; + +static const uint8_t Q[8][16] = { + {0x0, 0x4, 0x2, 0x6, 0x8, 0xc, 0xa, 0xe, 0x1, 0x5, 0x3, 0x7, 0x9, 0xd, 0xb, 0xf}, + {0x0, 0x4, 0xa, 0xe, 0x8, 0xc, 0x2, 0x6, 0x3, 0x7, 0x9, 0xd, 0xb, 0xf, 0x1, 0x5}, + {0x0, 0xc, 0x2, 0xe, 0x8, 0x4, 0xa, 0x6, 0x1, 0xd, 0x3, 0xf, 0x9, 0x5, 0xb, 0x7}, + {0x8, 0x4, 0x2, 0xe, 0x0, 0xc, 0xa, 0x6, 0xb, 0x7, 0x1, 0xd, 0x3, 0xf, 0x9, 0x5}, + {0x0, 0x6, 0x2, 0x4, 0x8, 0xe, 0xa, 0xc, 0x1, 0x7, 0x3, 0x5, 0x9, 0xf, 0xb, 0xd}, + {0x2, 0x4, 0x8, 0xe, 0xa, 0xc, 0x0, 0x6, 0x1, 0x7, 0xb, 0xd, 0x9, 0xf, 0x3, 0x5}, + {0x0, 0xe, 0x2, 0xc, 0x8, 0x6, 0xa, 0x4, 0x1, 0xf, 0x3, 0xd, 0x9, 0x7, 0xb, 0x5}, + {0xa, 0x4, 0x0, 0xe, 0x2, 0xc, 0x8, 0x6, 0x9, 0x7, 0x3, 0xd, 0x1, 0xf, 0xb, 0x5} +}; + +static const uint8_t P[16] = { + 0x0, 0x2, 0x8, 0xa, 0x4, 0X6, 0xc, 0xe, 0x1, 0x3, 0x9, 0xb, 0x5, 0x7, 0xd, 0xf +}; + +static void _state_init( + uint8_t X[BLOCK_BYTES], + uint8_t Y[BLOCK_BYTES], + uint8_t Z[BLOCK_BYTES], + const uint8_t message[BLOCK_BYTES] +) +{ + uint8_t SHARES_0[BLOCK_BYTES]; + uint8_t SHARES_1[BLOCK_BYTES]; + randombytes(sizeof(SHARES_0), SHARES_0); + randombytes(sizeof(SHARES_1), SHARES_1); + + memcpy(X, SHARES_0, BLOCK_BYTES); + memcpy(Y, SHARES_1, BLOCK_BYTES); + for (uint8_t i=0; i<BLOCK_BYTES; i++) + { + Z[i] = message[i] ^ SHARES_0[i] ^ SHARES_1[i]; + } +} + + +static void _compute_round_tweakeys( + const uint8_t key[KEY_BYTES], + const uint8_t tweak[TWEAK_BYTES], + uint8_t RTK_X[ROUNDS][ROUND_TWEAKEY_BYTES], + uint8_t RTK_Y[ROUNDS][ROUND_TWEAKEY_BYTES] +) +{ + uint8_t TK_X[TWEAKEY_BYTES]; + uint8_t TK_Y[TWEAKEY_BYTES]; + tweakey_state_init(TK_X, TK_Y, key, tweak); + tweakey_state_extract(TK_X, TK_Y, 0, RTK_X[0], RTK_Y[0]); + + for (uint8_t i=1; i<ROUNDS; i++) + { + tweakey_state_update(TK_X, TK_Y); + tweakey_state_extract(TK_X, TK_Y, i, RTK_X[i], RTK_Y[i]); + } +} + + +static void _nonlinear_layer( + uint8_t X[BLOCK_BYTES], + uint8_t Y[BLOCK_BYTES], + uint8_t Z[BLOCK_BYTES], + const uint8_t RTK_X[ROUND_TWEAKEY_BYTES], + const uint8_t RTK_Y[ROUND_TWEAKEY_BYTES] +) +{ + uint8_t x_hi, y_hi, z_hi; // High nibbles for the Feistel network + uint8_t x_lo, y_lo, z_lo; // Low nibbles for the Feistel network + uint8_t tmp0, tmp1, tmp2; + uint8_t TMP_X[ROUND_TWEAKEY_BYTES]; + uint8_t TMP_Y[ROUND_TWEAKEY_BYTES]; + uint8_t TMP_Z[ROUND_TWEAKEY_BYTES]; + + // Apply the RTK to two shares + for (size_t j=0; j<ROUND_TWEAKEY_BYTES; j++) + { + TMP_X[j] = X[j] ^ RTK_X[j]; + TMP_Y[j] = Y[j] ^ RTK_Y[j]; + } + + // Threshold Implementation of the 8-bit S-box + for (size_t j=0; j<ROUND_TWEAKEY_BYTES; j++) + { + // Decomposition into nibbles + x_hi = TMP_X[j] >> 4; + x_lo = TMP_X[j] & 0xf; + y_hi = TMP_Y[j] >> 4; + y_lo = TMP_Y[j] & 0xf; + z_hi = Z[j] >> 4; + z_lo = Z[j] & 0xf; + // First 4-bit S-box + tmp0 = G[(y_lo&7)>>1][z_lo]; + tmp1 = G[(z_lo&7)>>1][x_lo]; + tmp2 = G[(x_lo&7)>>1][y_lo]; + x_hi ^= F[tmp1][tmp2]; + y_hi ^= F[tmp2][tmp0]; + z_hi ^= F[tmp0][tmp1]; + // Second 4-bit S-box + tmp0 = P[Q[y_hi&3 ^ (y_hi&8)>>1][z_hi]]; + tmp1 = P[Q[z_hi&3 ^ (z_hi&8)>>1][x_hi]]; + tmp2 = P[Q[x_hi&3 ^ (x_hi&8)>>1][y_hi]]; + x_lo ^= Q[tmp1&3 ^ (tmp1&8)>>1][tmp2]; + y_lo ^= Q[tmp2&3 ^ (tmp2&8)>>1][tmp0]; + z_lo ^= Q[tmp0&3 ^ (tmp0&8)>>1][tmp1]; + // Third 4-bit S-box + tmp0 = G[(y_lo&7)>>1][z_lo] ^ 1; + tmp1 = G[(z_lo&7)>>1][x_lo]; + tmp2 = G[(x_lo&7)>>1][y_lo]; + x_hi ^= F[tmp1][tmp2]; + y_hi ^= F[tmp2][tmp0]; + z_hi ^= F[tmp0][tmp1]; + // Build bytes from nibbles + TMP_X[j] = (x_hi << 4 | x_lo); + TMP_Y[j] = (y_hi << 4 | y_lo); + TMP_Z[j] = (z_hi << 4 | z_lo); + } + + for (size_t j=0; j<8; j++) + { + size_t dest_j = 15-j; + X[dest_j] ^= TMP_X[j]; + Y[dest_j] ^= TMP_Y[j]; + Z[dest_j] ^= TMP_Z[j]; + } +} + +static void _linear_layer(uint8_t X[BLOCK_BYTES]) +{ + X[15] ^= X[1]; + X[15] ^= X[2]; + X[15] ^= X[3]; + X[15] ^= X[4]; + X[15] ^= X[5]; + X[15] ^= X[6]; + X[15] ^= X[7]; + + X[14] ^= X[7]; + X[13] ^= X[7]; + X[12] ^= X[7]; + X[11] ^= X[7]; + X[10] ^= X[7]; + X[9] ^= X[7]; +} + +static void _permutation_layer(uint8_t X[BLOCK_BYTES], permutation p) +{ + if (p == PERMUTATION_NONE) + { + return; + } + + uint8_t X_old[BLOCK_BYTES]; + memcpy(X_old, X, BLOCK_BYTES); + + const uint8_t *pi = PERMUTATIONS[p]; + + for (size_t j=0; j<BLOCK_BYTES; j++) + { + X[pi[j]] = X_old[j]; + } +} + +static void _one_round_egfn( + uint8_t X[BLOCK_BYTES], + uint8_t Y[BLOCK_BYTES], + uint8_t Z[BLOCK_BYTES], + const uint8_t RTK_X[ROUND_TWEAKEY_BYTES], + const uint8_t RTK_Y[ROUND_TWEAKEY_BYTES], + permutation p +) +{ + _nonlinear_layer(X, Y, Z, RTK_X, RTK_Y); + _linear_layer(X); + _linear_layer(Y); + _linear_layer(Z); + _permutation_layer(X, p); + _permutation_layer(Y, p); + _permutation_layer(Z, p); +} + + +void lilliput_tbc_encrypt( + const uint8_t key[KEY_BYTES], + const uint8_t tweak[TWEAK_BYTES], + const uint8_t message[BLOCK_BYTES], + uint8_t ciphertext[BLOCK_BYTES] +) +{ + uint8_t X[BLOCK_BYTES]; + uint8_t Y[BLOCK_BYTES]; + uint8_t Z[BLOCK_BYTES]; + _state_init(X, Y, Z, message); + + uint8_t RTK_X[ROUNDS][ROUND_TWEAKEY_BYTES]; + uint8_t RTK_Y[ROUNDS][ROUND_TWEAKEY_BYTES]; + _compute_round_tweakeys(key, tweak, RTK_X, RTK_Y); + + + for (uint8_t i=0; i<ROUNDS-1; i++) + { + _one_round_egfn(X, Y, Z, RTK_X[i], RTK_Y[i], PERMUTATION_ENCRYPTION); + } + + _one_round_egfn(X, Y, Z, RTK_X[ROUNDS-1], RTK_Y[ROUNDS-1], PERMUTATION_NONE); + + + for (size_t i=0; i<BLOCK_BYTES; i++) + { + ciphertext[i] = X[i] ^ Y[i] ^ Z[i]; + } +} + +void lilliput_tbc_decrypt( + const uint8_t key[KEY_BYTES], + const uint8_t tweak[TWEAK_BYTES], + const uint8_t ciphertext[BLOCK_BYTES], + uint8_t message[BLOCK_BYTES] +) +{ + uint8_t X[BLOCK_BYTES]; + uint8_t Y[BLOCK_BYTES]; + uint8_t Z[BLOCK_BYTES]; + _state_init(X, Y, Z, ciphertext); + + uint8_t RTK_X[ROUNDS][ROUND_TWEAKEY_BYTES]; + uint8_t RTK_Y[ROUNDS][ROUND_TWEAKEY_BYTES]; + _compute_round_tweakeys(key, tweak, RTK_X, RTK_Y); + + for (uint8_t i=0; i<ROUNDS-1; i++) + { + _one_round_egfn(X, Y, Z, RTK_X[ROUNDS-1-i], RTK_Y[ROUNDS-1-i], PERMUTATION_DECRYPTION); + } + + _one_round_egfn(X, Y, Z, RTK_X[0], RTK_Y[0], PERMUTATION_NONE); + + for (size_t i=0; i<BLOCK_BYTES; i++) + { + message[i] = X[i] ^ Y[i] ^ Z[i]; + } +} diff --git a/src/add_threshold/cipher.h b/src/add_threshold/cipher.h new file mode 120000 index 0000000..eab258b --- /dev/null +++ b/src/add_threshold/cipher.h @@ -0,0 +1 @@ +../ref/cipher.h
\ No newline at end of file diff --git a/src/add_threshold/constants.h b/src/add_threshold/constants.h new file mode 120000 index 0000000..67df0f3 --- /dev/null +++ b/src/add_threshold/constants.h @@ -0,0 +1 @@ +../ref/constants.h
\ No newline at end of file diff --git a/src/add_threshold/implem.mk b/src/add_threshold/implem.mk new file mode 100644 index 0000000..2925287 --- /dev/null +++ b/src/add_threshold/implem.mk @@ -0,0 +1,42 @@ +# This file sets some implementation-specific variables and defines +# build dependencies. + +# Filter out tests on tweakey schedule, as the thresholded API differs. +tests = $(filter-out test-tweakey,$(basename $(wildcard test-*.c))) + +# Filter out traces on tweakable block cipher, as intermediate steps +# differ significantly. +traces = $(filter-out traces-tbc,$(basename $(wildcard traces-*.c))) + +# Don't trigger warnings for "a&b ^ c". +CFLAGS += -Wno-parentheses + + +# Build dependencies: add random module; remove unused tests/traces. + +# Program => additional objects dependencies + +$(results_dir)/test-tbc-decrypt $(results_dir)/test-tbc-encrypt: \ +$(results_dir)/src/cipher.o $(results_dir)/src/tweakey.o $(results_dir)/src/random.o + +$(results_dir)/test-ae-decrypt $(results_dir)/test-ae-encrypt $(results_dir)/test-ae-roundtrip $(results_dir)/traces-ae: \ +$(results_dir)/src/lilliput-$(mode).o $(results_dir)/src/cipher.o \ +$(results_dir)/src/tweakey.o $(results_dir)/src/random.o + +# Object => headers dependencies + +$(results_dir)/$(src_dir)/cipher.o: $(src_dir)/cipher.h \ +$(src_dir)/tweakey.h $(src_dir)/random.h $(variant_dir)/parameters.h + +$(results_dir)/$(src_dir)/lilliput-i.o $(results_dir)/$(src_dir)/lilliput-ii.o: \ +$(src_dir)/lilliput-ae.h $(src_dir)/cipher.h $(src_dir)/constants.h \ +$(variant_dir)/parameters.h + +$(results_dir)/$(src_dir)/tweakey.o: $(src_dir)/tweakey.h \ +$(src_dir)/constants.h $(src_dir)/random.h $(variant_dir)/parameters.h + +$(results_dir)/test/test-tbc-encrypt.o $(results_dir)/test/test-tbc-decrypt.o $(results_dir)/test/traces-tbc.o: \ +$(src_dir)/cipher.h + +$(results_dir)/test/test-ae-encrypt.o $(results_dir)/test/test-ae-decrypt.o $(results_dir)/test/test-ae-roundtrip.o $(results_dir)/test/traces-ae.o: \ +$(src_dir)/lilliput-ae.h diff --git a/src/add_threshold/lilliput-ae-utils.h b/src/add_threshold/lilliput-ae-utils.h new file mode 120000 index 0000000..b46625b --- /dev/null +++ b/src/add_threshold/lilliput-ae-utils.h @@ -0,0 +1 @@ +../ref/lilliput-ae-utils.h
\ No newline at end of file diff --git a/src/add_threshold/lilliput-ae.h b/src/add_threshold/lilliput-ae.h new file mode 120000 index 0000000..66c8314 --- /dev/null +++ b/src/add_threshold/lilliput-ae.h @@ -0,0 +1 @@ +../ref/lilliput-ae.h
\ No newline at end of file diff --git a/src/add_threshold/lilliput-i.c b/src/add_threshold/lilliput-i.c new file mode 120000 index 0000000..46688d4 --- /dev/null +++ b/src/add_threshold/lilliput-i.c @@ -0,0 +1 @@ +../ref/lilliput-i.c
\ No newline at end of file diff --git a/src/add_threshold/lilliput-ii.c b/src/add_threshold/lilliput-ii.c new file mode 120000 index 0000000..09abf10 --- /dev/null +++ b/src/add_threshold/lilliput-ii.c @@ -0,0 +1 @@ +../ref/lilliput-ii.c
\ No newline at end of file diff --git a/src/add_threshold/random.c b/src/add_threshold/random.c new file mode 100644 index 0000000..a966a8e --- /dev/null +++ b/src/add_threshold/random.c @@ -0,0 +1,36 @@ +/* +Implementation of the Lilliput-AE tweakable block cipher. + +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. + +For more information, feedback or questions, refer to our website: +https://paclido.fr/lilliput-ae + +To the extent possible under law, the implementer has waived all copyright +and related or neighboring rights to the source code in this file. +http://creativecommons.org/publicdomain/zero/1.0/ + +--- + +This file provides a system-specific function to generate random bytes. +*/ + +/* glibc < 2.25 does not provide getrandom(2): use the system call. */ + +#define _GNU_SOURCE + +#include <stddef.h> +#include <stdint.h> + +#include <unistd.h> +#include <sys/syscall.h> + +#include "random.h" + + +void randombytes(size_t nb, uint8_t out[nb]) +{ + syscall(SYS_getrandom, out, nb, 0); +} diff --git a/src/add_threshold/random.h b/src/add_threshold/random.h new file mode 100644 index 0000000..32ff4df --- /dev/null +++ b/src/add_threshold/random.h @@ -0,0 +1,30 @@ +/* +Implementation of the Lilliput-AE tweakable block cipher. + +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. + +For more information, feedback or questions, refer to our website: +https://paclido.fr/lilliput-ae + +To the extent possible under law, the implementer has waived all copyright +and related or neighboring rights to the source code in this file. +http://creativecommons.org/publicdomain/zero/1.0/ + +--- + +This file provides an interface to generate random bytes. +*/ + +#ifndef RANDOM_H +#define RANDOM_H + +#include <stddef.h> +#include <stdint.h> + + +void randombytes(size_t nb, uint8_t out[nb]); + + +#endif /* RANDOM_H */ diff --git a/src/add_threshold/tweakey.c b/src/add_threshold/tweakey.c new file mode 100644 index 0000000..e228a69 --- /dev/null +++ b/src/add_threshold/tweakey.c @@ -0,0 +1,215 @@ +/* +Implementation of the Lilliput-AE tweakable block cipher. + +Authors, hereby denoted as "the implementer": + Alexandre Adomnicai, + Kévin Le Gouguec, + Léo Reynaud, + 2019. + +For more information, feedback or questions, refer to our website: +https://paclido.fr/lilliput-ae + +To the extent possible under law, the implementer has waived all copyright +and related or neighboring rights to the source code in this file. +http://creativecommons.org/publicdomain/zero/1.0/ + +--- + +This file provides a first-order threshold implementation of Lilliput-TBC's +tweakey schedule, where the tweak and the key are split into two shares. +*/ + +#include <stdint.h> +#include <string.h> + +#include "constants.h" +#include "random.h" +#include "tweakey.h" + + +#define LANE_BITS 64 +#define LANE_BYTES (LANE_BITS/8) +#define LANES_NB (TWEAKEY_BYTES/LANE_BYTES) + + +void tweakey_state_init( + uint8_t TK_X[TWEAKEY_BYTES], + uint8_t TK_Y[KEY_BYTES], + const uint8_t key[KEY_BYTES], + const uint8_t tweak[TWEAK_BYTES] +) +{ + uint8_t SHARES_0[KEY_BYTES]; + randombytes(sizeof(SHARES_0), SHARES_0); + + memcpy(TK_Y, SHARES_0, KEY_BYTES); + memcpy(TK_X, tweak, TWEAK_BYTES); + + for (size_t i=0; i<KEY_BYTES; i++){ + TK_X[i+TWEAK_BYTES] = key[i] ^ SHARES_0[i]; + } +} + + +void tweakey_state_extract( + const uint8_t TK_X[TWEAKEY_BYTES], + const uint8_t TK_Y[KEY_BYTES], + uint8_t round_constant, + uint8_t round_tweakey_X[ROUND_TWEAKEY_BYTES], + uint8_t round_tweakey_Y[ROUND_TWEAKEY_BYTES] +) +{ + memset(round_tweakey_X, 0, ROUND_TWEAKEY_BYTES); + memset(round_tweakey_Y, 0, ROUND_TWEAKEY_BYTES); + + for (size_t j=0; j<LANES_NB; j++) + { + const uint8_t *TKj_X = TK_X + j*LANE_BYTES; + + for (size_t k=0; k<LANE_BYTES; k++) + { + round_tweakey_X[k] ^= TKj_X[k]; + } + } + + + for (size_t j=0; j<(KEY_BYTES / LANE_BYTES); j++) + { + const uint8_t *TKj_Y = TK_Y + j*LANE_BYTES; + + for (size_t k=0; k<LANE_BYTES; k++) + { + round_tweakey_Y[k] ^= TKj_Y[k]; + } + } + + round_tweakey_X[0] ^= round_constant; +} + + +static void _multiply_M(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) +{ + y[7] = x[6]; + y[6] = x[5]; + y[5] = x[5]<<3 ^ x[4]; + y[4] = x[4]>>3 ^ x[3]; + y[3] = x[2]; + y[2] = x[6]<<2 ^ x[1]; + y[1] = x[0]; + y[0] = x[7]; +} + +static void _multiply_M2(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) +{ + uint8_t x_M_5 = x[5]<<3 ^ x[4]; + uint8_t x_M_4 = x[4]>>3 ^ x[3]; + + y[7] = x[5]; + y[6] = x_M_5; + y[5] = x_M_5<<3 ^ x_M_4; + y[4] = x_M_4>>3 ^ x[2]; + y[3] = x[6]<<2 ^ x[1]; + y[2] = x[5]<<2 ^ x[0]; + y[1] = x[7]; + y[0] = x[6]; +} + +static void _multiply_M3(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) +{ + uint8_t x_M_5 = x[5]<<3 ^ x[4]; + uint8_t x_M_4 = x[4]>>3 ^ x[3]; + uint8_t x_M2_5 = x_M_5<<3 ^ x_M_4; + uint8_t x_M2_4 = x_M_4>>3 ^ x[2]; + + y[7] = x_M_5; + y[6] = x_M2_5; + y[5] = x_M2_5<<3 ^ x_M2_4; + y[4] = x_M2_4>>3 ^ x[6]<<2 ^ x[1]; + y[3] = x[5]<<2 ^ x[0]; + y[2] = x_M_5<<2 ^ x[7]; + y[1] = x[6]; + y[0] = x[5]; +} + +static void _multiply_MR(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) +{ + y[0] = x[1]; + y[1] = x[2]; + y[2] = x[3] ^ x[4]>>3; + y[3] = x[4]; + y[4] = x[5] ^ x[6]<<3; + y[5] = x[3]<<2 ^ x[6]; + y[6] = x[7]; + y[7] = x[0]; +} + +static void _multiply_MR2(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) +{ + uint8_t x_MR_4 = x[5] ^ x[6]<<3; + + y[0] = x[2]; + y[1] = x[3] ^ x[4]>>3; + y[2] = x[4] ^ x_MR_4>>3; + y[3] = x_MR_4; + y[4] = x[3]<<2 ^ x[6] ^ x[7]<<3; + y[5] = x[4]<<2 ^ x[7]; + y[6] = x[0]; + y[7] = x[1]; +} + +static void _multiply_MR3(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) +{ + uint8_t x_MR_4 = x[5] ^ x[6]<<3; + uint8_t x_MR2_4 = x[3]<<2 ^ x[6] ^ x[7]<<3; + + y[0] = x[3] ^ x[4]>>3; + y[1] = x[4] ^ x_MR_4>>3; + y[2] = x_MR_4 ^ x_MR2_4>>3; + y[3] = x_MR2_4; + y[4] = x[0]<<3 ^ x[4]<<2 ^ x[7]; + y[5] = x_MR_4<<2 ^ x[0]; + y[6] = x[1]; + y[7] = x[2]; +} + +typedef void (*matrix_multiplication)(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]); + +static const matrix_multiplication ALPHAS[6] = { + _multiply_M, + _multiply_M2, + _multiply_M3, + _multiply_MR, + _multiply_MR2, + _multiply_MR3 +}; + + +void tweakey_state_update(uint8_t TK_X[TWEAKEY_BYTES], uint8_t TK_Y[KEY_BYTES]) +{ + /* Skip lane 0, as it is multiplied by the identity matrix. */ + + for (size_t j=1; j<(TWEAK_BYTES/LANE_BYTES); j++) + { + uint8_t *TKj_X = TK_X + j*LANE_BYTES; + + uint8_t TKj_old_X[LANE_BYTES]; + memcpy(TKj_old_X, TKj_X, LANE_BYTES); + + ALPHAS[j-1](TKj_old_X, TKj_X); + } + + for (size_t j=0; j<(KEY_BYTES/LANE_BYTES); j++) + { + uint8_t *TKj_X = TK_X + (j + (TWEAK_BYTES/LANE_BYTES))*LANE_BYTES; + uint8_t *TKj_Y = TK_Y + j*LANE_BYTES; + + uint8_t TKj_X_old[LANE_BYTES]; + uint8_t TKj_Y_old[LANE_BYTES]; + memcpy(TKj_X_old, TKj_X, LANE_BYTES); + memcpy(TKj_Y_old, TKj_Y, LANE_BYTES); + + ALPHAS[j-1 + (TWEAK_BYTES/LANE_BYTES)](TKj_X_old, TKj_X); + ALPHAS[j-1 + (TWEAK_BYTES/LANE_BYTES)](TKj_Y_old, TKj_Y); + } +} diff --git a/src/add_threshold/tweakey.h b/src/add_threshold/tweakey.h new file mode 100644 index 0000000..f9ca722 --- /dev/null +++ b/src/add_threshold/tweakey.h @@ -0,0 +1,49 @@ +/* +Implementation of the Lilliput-AE tweakable block cipher. + +Authors, hereby denoted as "the implementer": + Alexandre Adomnicai, + Kévin Le Gouguec, + Léo Reynaud, + 2019. + +For more information, feedback or questions, refer to our website: +https://paclido.fr/lilliput-ae + +To the extent possible under law, the implementer has waived all copyright +and related or neighboring rights to the source code in this file. +http://creativecommons.org/publicdomain/zero/1.0/ + +--- + +This file provides the interface for the first-order threshold implementation +of Lilliput-TBC's tweakey schedule. +*/ + +#ifndef TWEAKEY_H +#define TWEAKEY_H + +#include <stdint.h> + +#include "constants.h" + + +void tweakey_state_init( + uint8_t TK_X[TWEAKEY_BYTES], + uint8_t TK_Y[TWEAKEY_BYTES], + const uint8_t key[KEY_BYTES], + const uint8_t tweak[TWEAK_BYTES] +); + +void tweakey_state_extract( + const uint8_t TK_X[TWEAKEY_BYTES], + const uint8_t TK_Y[KEY_BYTES], + uint8_t round_constant, + uint8_t round_tweakey_X[ROUND_TWEAKEY_BYTES], + uint8_t round_tweakey_Y[ROUND_TWEAKEY_BYTES] +); + +void tweakey_state_update(uint8_t TK_X[TWEAKEY_BYTES], uint8_t TK_Y[KEY_BYTES]); + + +#endif /* TWEAKEY_H */ diff --git a/src/add_tweakeyloop/implem.mk b/src/add_tweakeyloop/implem.mk new file mode 120000 index 0000000..eb789fb --- /dev/null +++ b/src/add_tweakeyloop/implem.mk @@ -0,0 +1 @@ +../ref/implem.mk
\ No newline at end of file diff --git a/src/add_tweakeyloop/tweakey.c b/src/add_tweakeyloop/tweakey.c index b1f349e..3360a70 100644 --- a/src/add_tweakeyloop/tweakey.c +++ b/src/add_tweakeyloop/tweakey.c @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/i-128/parameters.h b/src/i-128/parameters.h index b4c2f02..11ef889 100644 --- a/src/i-128/parameters.h +++ b/src/i-128/parameters.h @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/i-192/parameters.h b/src/i-192/parameters.h index aa1ea31..18d9e34 100644 --- a/src/i-192/parameters.h +++ b/src/i-192/parameters.h @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/i-256/parameters.h b/src/i-256/parameters.h index 5a9c029..4d23eae 100644 --- a/src/i-256/parameters.h +++ b/src/i-256/parameters.h @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/ii-128/parameters.h b/src/ii-128/parameters.h index aa73123..8e8dbc0 100644 --- a/src/ii-128/parameters.h +++ b/src/ii-128/parameters.h @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/ii-192/parameters.h b/src/ii-192/parameters.h index 531d56d..d5c6f89 100644 --- a/src/ii-192/parameters.h +++ b/src/ii-192/parameters.h @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/ii-256/parameters.h b/src/ii-256/parameters.h index 77d2f99..b6e1d34 100644 --- a/src/ii-256/parameters.h +++ b/src/ii-256/parameters.h @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/ref/cipher.c b/src/ref/cipher.c index 48144d4..5f26cc9 100644 --- a/src/ref/cipher.c +++ b/src/ref/cipher.c @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/ref/cipher.h b/src/ref/cipher.h index 8e4bd16..b84820d 100644 --- a/src/ref/cipher.h +++ b/src/ref/cipher.h @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/ref/constants.h b/src/ref/constants.h index 6f17b40..6812fd8 100644 --- a/src/ref/constants.h +++ b/src/ref/constants.h @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/ref/implem.mk b/src/ref/implem.mk new file mode 100644 index 0000000..f396696 --- /dev/null +++ b/src/ref/implem.mk @@ -0,0 +1,35 @@ +# This file sets some implementation-specific variables and defines +# build dependencies. + +tests = $(basename $(wildcard test-*.c)) +traces = $(basename $(wildcard traces-*.c)) + + +# Program => additional objects dependencies + +$(results_dir)/test-tbc-decrypt $(results_dir)/test-tbc-encrypt $(results_dir)/traces-tbc: \ +$(results_dir)/src/cipher.o $(results_dir)/src/tweakey.o + +$(results_dir)/test-ae-decrypt $(results_dir)/test-ae-encrypt $(results_dir)/test-ae-roundtrip $(results_dir)/traces-ae: \ +$(results_dir)/src/lilliput-$(mode).o $(results_dir)/src/cipher.o \ +$(results_dir)/src/tweakey.o + +$(results_dir)/test-tweakey: $(results_dir)/src/tweakey.o + +# Object => headers dependencies + +$(results_dir)/$(src_dir)/cipher.o: $(src_dir)/cipher.h \ +$(src_dir)/tweakey.h $(variant_dir)/parameters.h + +$(results_dir)/$(src_dir)/lilliput-i.o $(results_dir)/$(src_dir)/lilliput-ii.o: \ +$(src_dir)/lilliput-ae.h $(src_dir)/cipher.h $(src_dir)/constants.h \ +$(variant_dir)/parameters.h + +$(results_dir)/$(src_dir)/tweakey.o: $(src_dir)/tweakey.h \ +$(src_dir)/constants.h $(variant_dir)/parameters.h + +$(results_dir)/test/test-tbc-encrypt.o $(results_dir)/test/test-tbc-decrypt.o $(results_dir)/test/traces-tbc.o: \ +$(src_dir)/cipher.h + +$(results_dir)/test/test-ae-encrypt.o $(results_dir)/test/test-ae-decrypt.o $(results_dir)/test/test-ae-roundtrip.o $(results_dir)/test/traces-ae.o: \ +$(src_dir)/lilliput-ae.h diff --git a/src/ref/lilliput-ae-utils.h b/src/ref/lilliput-ae-utils.h index d78d9ff..41acaf6 100644 --- a/src/ref/lilliput-ae-utils.h +++ b/src/ref/lilliput-ae-utils.h @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/ref/lilliput-ae.h b/src/ref/lilliput-ae.h index 48721fe..acb24d2 100644 --- a/src/ref/lilliput-ae.h +++ b/src/ref/lilliput-ae.h @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/ref/lilliput-i.c b/src/ref/lilliput-i.c index 5e91e4e..74248a9 100644 --- a/src/ref/lilliput-i.c +++ b/src/ref/lilliput-i.c @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/ref/lilliput-ii.c b/src/ref/lilliput-ii.c index 7c02bce..a371521 100644 --- a/src/ref/lilliput-ii.c +++ b/src/ref/lilliput-ii.c @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/ref/tweakey.c b/src/ref/tweakey.c index dd1a855..78c6060 100644 --- a/src/ref/tweakey.c +++ b/src/ref/tweakey.c @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/ref/tweakey.h b/src/ref/tweakey.h index e461b43..dcda357 100644 --- a/src/ref/tweakey.h +++ b/src/ref/tweakey.h @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae |