From 1989002054111cc5301f9aa229957cbd59a9e2f5 Mon Sep 17 00:00:00 2001 From: Kévin Le Gouguec Date: Wed, 20 Feb 2019 17:30:10 +0100 Subject: Changement de l'implémentation de référence MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Et suppression de l'implémentation add_tweakeysequences, qui n'a plus aucun intérêt (plus lente et plus grosse que les deux autres). --- nist/make-package.sh | 3 +- src/add_tweakeyloop/cipher.c | 1 + src/add_tweakeyloop/cipher.h | 1 + src/add_tweakeyloop/constants.h | 1 + src/add_tweakeyloop/lilliput-ae-utils.h | 1 + src/add_tweakeyloop/lilliput-ae.h | 1 + src/add_tweakeyloop/lilliput-i.c | 1 + src/add_tweakeyloop/lilliput-ii.c | 1 + src/add_tweakeyloop/tweakey.c | 146 ++++++++++++++++ src/add_tweakeyloop/tweakey.h | 1 + src/add_tweakeysequences/cipher.c | 1 - src/add_tweakeysequences/cipher.h | 1 - src/add_tweakeysequences/constants.h | 1 - src/add_tweakeysequences/lilliput-ae-utils.h | 1 - src/add_tweakeysequences/lilliput-ae.h | 1 - src/add_tweakeysequences/lilliput-i.c | 1 - src/add_tweakeysequences/lilliput-ii.c | 1 - src/add_tweakeysequences/tweakey.c | 240 --------------------------- src/add_tweakeysequences/tweakey.h | 1 - src/add_tweakeyunrolled/cipher.c | 1 - src/add_tweakeyunrolled/cipher.h | 1 - src/add_tweakeyunrolled/constants.h | 1 - src/add_tweakeyunrolled/lilliput-ae-utils.h | 1 - src/add_tweakeyunrolled/lilliput-ae.h | 1 - src/add_tweakeyunrolled/lilliput-i.c | 1 - src/add_tweakeyunrolled/lilliput-ii.c | 1 - src/add_tweakeyunrolled/tweakey.c | 175 ------------------- src/add_tweakeyunrolled/tweakey.h | 1 - src/ref/tweakey.c | 63 +++++-- traces/traces-tbc.patch | 2 +- 30 files changed, 202 insertions(+), 451 deletions(-) create mode 120000 src/add_tweakeyloop/cipher.c create mode 120000 src/add_tweakeyloop/cipher.h create mode 120000 src/add_tweakeyloop/constants.h create mode 120000 src/add_tweakeyloop/lilliput-ae-utils.h create mode 120000 src/add_tweakeyloop/lilliput-ae.h create mode 120000 src/add_tweakeyloop/lilliput-i.c create mode 120000 src/add_tweakeyloop/lilliput-ii.c create mode 100644 src/add_tweakeyloop/tweakey.c create mode 120000 src/add_tweakeyloop/tweakey.h delete mode 120000 src/add_tweakeysequences/cipher.c delete mode 120000 src/add_tweakeysequences/cipher.h delete mode 120000 src/add_tweakeysequences/constants.h delete mode 120000 src/add_tweakeysequences/lilliput-ae-utils.h delete mode 120000 src/add_tweakeysequences/lilliput-ae.h delete mode 120000 src/add_tweakeysequences/lilliput-i.c delete mode 120000 src/add_tweakeysequences/lilliput-ii.c delete mode 100644 src/add_tweakeysequences/tweakey.c delete mode 120000 src/add_tweakeysequences/tweakey.h delete mode 120000 src/add_tweakeyunrolled/cipher.c delete mode 120000 src/add_tweakeyunrolled/cipher.h delete mode 120000 src/add_tweakeyunrolled/constants.h delete mode 120000 src/add_tweakeyunrolled/lilliput-ae-utils.h delete mode 120000 src/add_tweakeyunrolled/lilliput-ae.h delete mode 120000 src/add_tweakeyunrolled/lilliput-i.c delete mode 120000 src/add_tweakeyunrolled/lilliput-ii.c delete mode 100644 src/add_tweakeyunrolled/tweakey.c delete mode 120000 src/add_tweakeyunrolled/tweakey.h diff --git a/nist/make-package.sh b/nist/make-package.sh index 30debe3..77c4057 100755 --- a/nist/make-package.sh +++ b/nist/make-package.sh @@ -53,8 +53,7 @@ add-variant () implementations=( ref - add_tweakeyunrolled - add_tweakeysequences + add_tweakeyloop ) for implem in ${implementations[@]} diff --git a/src/add_tweakeyloop/cipher.c b/src/add_tweakeyloop/cipher.c new file mode 120000 index 0000000..a2ac6a3 --- /dev/null +++ b/src/add_tweakeyloop/cipher.c @@ -0,0 +1 @@ +../ref/cipher.c \ No newline at end of file diff --git a/src/add_tweakeyloop/cipher.h b/src/add_tweakeyloop/cipher.h new file mode 120000 index 0000000..eab258b --- /dev/null +++ b/src/add_tweakeyloop/cipher.h @@ -0,0 +1 @@ +../ref/cipher.h \ No newline at end of file diff --git a/src/add_tweakeyloop/constants.h b/src/add_tweakeyloop/constants.h new file mode 120000 index 0000000..67df0f3 --- /dev/null +++ b/src/add_tweakeyloop/constants.h @@ -0,0 +1 @@ +../ref/constants.h \ No newline at end of file diff --git a/src/add_tweakeyloop/lilliput-ae-utils.h b/src/add_tweakeyloop/lilliput-ae-utils.h new file mode 120000 index 0000000..b46625b --- /dev/null +++ b/src/add_tweakeyloop/lilliput-ae-utils.h @@ -0,0 +1 @@ +../ref/lilliput-ae-utils.h \ No newline at end of file diff --git a/src/add_tweakeyloop/lilliput-ae.h b/src/add_tweakeyloop/lilliput-ae.h new file mode 120000 index 0000000..66c8314 --- /dev/null +++ b/src/add_tweakeyloop/lilliput-ae.h @@ -0,0 +1 @@ +../ref/lilliput-ae.h \ No newline at end of file diff --git a/src/add_tweakeyloop/lilliput-i.c b/src/add_tweakeyloop/lilliput-i.c new file mode 120000 index 0000000..46688d4 --- /dev/null +++ b/src/add_tweakeyloop/lilliput-i.c @@ -0,0 +1 @@ +../ref/lilliput-i.c \ No newline at end of file diff --git a/src/add_tweakeyloop/lilliput-ii.c b/src/add_tweakeyloop/lilliput-ii.c new file mode 120000 index 0000000..09abf10 --- /dev/null +++ b/src/add_tweakeyloop/lilliput-ii.c @@ -0,0 +1 @@ +../ref/lilliput-ii.c \ No newline at end of file diff --git a/src/add_tweakeyloop/tweakey.c b/src/add_tweakeyloop/tweakey.c new file mode 100644 index 0000000..b1f349e --- /dev/null +++ b/src/add_tweakeyloop/tweakey.c @@ -0,0 +1,146 @@ +/* +Implementation of the Lilliput-AE tweakable block cipher. + +Author: Kévin Le Gouguec, 2019. + +For more information, feedback or questions, refer to our website: +https://paclido.fr/lilliput-ae + +To the extent possible under law, the implementer has waived all copyright +and related or neighboring rights to the source code in this file. +http://creativecommons.org/publicdomain/zero/1.0/ + +--- + +This file provides an implementation of Lilliput-TBC's tweakey schedule, +where multiplications by matrices M and M_R to the power n are performed +by applying functions for M and M_R n times. +*/ + +#include +#include + +#include "constants.h" +#include "tweakey.h" + + +#define LANE_BITS 64 +#define LANE_BYTES (LANE_BITS/8) +#define LANES_NB (TWEAKEY_BYTES/LANE_BYTES) + + +void tweakey_state_init( + uint8_t TK[TWEAKEY_BYTES], + const uint8_t key[KEY_BYTES], + const uint8_t tweak[TWEAK_BYTES] +) +{ + memcpy(TK, tweak, TWEAK_BYTES); + memcpy(TK+TWEAK_BYTES, key, KEY_BYTES); +} + + +void tweakey_state_extract( + const uint8_t TK[TWEAKEY_BYTES], + uint8_t round_constant, + uint8_t round_tweakey[ROUND_TWEAKEY_BYTES] +) +{ + memset(round_tweakey, 0, ROUND_TWEAKEY_BYTES); + + for (size_t j=0; j>3 ^ x[3]; + y[3] = x[2]; + y[2] = x[6]<<2 ^ x[1]; + y[1] = x[0]; + y[0] = x[7]; +} + +static void _multiply_M2(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) +{ + uint8_t M_x[LANE_BYTES]; + _multiply_M(x, M_x); + _multiply_M(M_x, y); +} + +static void _multiply_M3(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) +{ + uint8_t M_x[LANE_BYTES]; + uint8_t M2_x[LANE_BYTES]; + _multiply_M(x, M_x); + _multiply_M(M_x, M2_x); + _multiply_M(M2_x, y); +} + +static void _multiply_MR(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) +{ + y[0] = x[1]; + y[1] = x[2]; + y[2] = x[3] ^ x[4]>>3; + y[3] = x[4]; + y[4] = x[5] ^ x[6]<<3; + y[5] = x[3]<<2 ^ x[6]; + y[6] = x[7]; + y[7] = x[0]; +} + +static void _multiply_MR2(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) +{ + uint8_t MR_x[LANE_BYTES]; + _multiply_MR(x, MR_x); + _multiply_MR(MR_x, y); +} + +static void _multiply_MR3(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) +{ + uint8_t MR_x[LANE_BYTES]; + uint8_t MR2_x[LANE_BYTES]; + _multiply_MR(x, MR_x); + _multiply_MR(MR_x, MR2_x); + _multiply_MR(MR2_x, y); +} + +typedef void (*matrix_multiplication)(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]); + +static const matrix_multiplication ALPHAS[6] = { + _multiply_M, + _multiply_M2, + _multiply_M3, + _multiply_MR, + _multiply_MR2, + _multiply_MR3 +}; + + +void tweakey_state_update(uint8_t TK[TWEAKEY_BYTES]) +{ + /* Skip lane 0, as it is multiplied by the identity matrix. */ + + for (size_t j=1; j -#include - -#include "constants.h" -#include "tweakey.h" - - -#define LANE_BITS 64 -#define LANE_BYTES (LANE_BITS/8) -#define LANES_NB (TWEAKEY_BYTES/LANE_BYTES) - - -void tweakey_state_init( - uint8_t TK[TWEAKEY_BYTES], - const uint8_t key[KEY_BYTES], - const uint8_t tweak[TWEAK_BYTES] -) -{ - memcpy(TK, tweak, TWEAK_BYTES); - memcpy(TK+TWEAK_BYTES, key, KEY_BYTES); -} - - -void tweakey_state_extract( - const uint8_t TK[TWEAKEY_BYTES], - uint8_t round_constant, - uint8_t round_tweakey[ROUND_TWEAKEY_BYTES] -) -{ - memset(round_tweakey, 0, ROUND_TWEAKEY_BYTES); - - for (size_t j=0; j>3 ^ x[3]; - y[3] = x[2]; - y[2] = x[6]<<2 ^ x[1]; - y[1] = x[0]; - y[0] = x[7]; -} - -static void _multiply_M2(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) -{ - y[7] = x[5]; - y[6] = x[5]<<3 ^ x[4]; - y[5] = x[5]<<6 ^ M_1[x[4]] ^ x[3]; - y[4] = x[4]>>6 ^ x[3]>>3 ^ x[2]; - y[3] = x[6]<<2 ^ x[1]; - y[2] = x[5]<<2 ^ x[0]; - y[1] = x[7]; - y[0] = x[6]; -} - -static void _multiply_M3(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) -{ - y[7] = x[5]<<3 ^ x[4]; - y[6] = x[5]<<6 ^ M_1[x[4]] ^ x[3]; - y[5] = M_2[x[4]] ^ M_1[x[3]] ^ x[2]; - y[4] = x[6]<<2 ^ x[3]>>6 ^ x[2]>>3 ^ x[1]; - y[3] = x[5]<<2 ^ x[0]; - y[2] = x[7] ^ x[5]<<5 ^ x[4]<<2; - y[1] = x[6]; - y[0] = x[5]; -} - -static void _multiply_MR(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) -{ - y[0] = x[1]; - y[1] = x[2]; - y[2] = x[3] ^ x[4]>>3; - y[3] = x[4]; - y[4] = x[5] ^ x[6]<<3; - y[5] = x[3]<<2 ^ x[6]; - y[6] = x[7]; - y[7] = x[0]; -} - -static void _multiply_MR2(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) -{ - y[0] = x[2]; - y[1] = x[3] ^ x[4]>>3; - y[2] = x[4] ^ x[5]>>3 ^ M_3[x[6]]; - y[3] = x[5] ^ x[6]<<3; - y[4] = x[3]<<2 ^ x[6] ^ x[7]<<3; - y[5] = x[4]<<2 ^ x[7]; - y[6] = x[0]; - y[7] = x[1]; -} - -static void _multiply_MR3(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) -{ - y[0] = x[3] ^ x[4]>>3; - y[1] = x[4] ^ x[5]>>3 ^ M_3[x[6]]; - y[2] = M_4[x[3]] ^ x[5] ^ M_1[x[6]] ^ M_3[x[7]]; - y[3] = x[3]<<2 ^ x[6] ^ x[7]<<3; - y[4] = x[0]<<3 ^ x[4]<<2 ^ x[7]; - y[5] = x[0] ^ x[5]<<2 ^ x[6]<<5; - y[6] = x[1]; - y[7] = x[2]; -} - -typedef void (*matrix_multiplication)(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]); - -static const matrix_multiplication ALPHAS[6] = { - _multiply_M, - _multiply_M2, - _multiply_M3, - _multiply_MR, - _multiply_MR2, - _multiply_MR3 -}; - - -void tweakey_state_update(uint8_t TK[TWEAKEY_BYTES]) -{ - /* Skip lane 0, as it is multiplied by the identity matrix. */ - - for (size_t j=1; j -#include - -#include "constants.h" -#include "tweakey.h" - - -#define LANE_BITS 64 -#define LANE_BYTES (LANE_BITS/8) -#define LANES_NB (TWEAKEY_BYTES/LANE_BYTES) - - -void tweakey_state_init( - uint8_t TK[TWEAKEY_BYTES], - const uint8_t key[KEY_BYTES], - const uint8_t tweak[TWEAK_BYTES] -) -{ - memcpy(TK, tweak, TWEAK_BYTES); - memcpy(TK+TWEAK_BYTES, key, KEY_BYTES); -} - - -void tweakey_state_extract( - const uint8_t TK[TWEAKEY_BYTES], - uint8_t round_constant, - uint8_t round_tweakey[ROUND_TWEAKEY_BYTES] -) -{ - memset(round_tweakey, 0, ROUND_TWEAKEY_BYTES); - - for (size_t j=0; j>3 ^ x[3]; - y[3] = x[2]; - y[2] = x[6]<<2 ^ x[1]; - y[1] = x[0]; - y[0] = x[7]; -} - -static void _multiply_M2(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) -{ - uint8_t x_M_5 = x[5]<<3 ^ x[4]; - uint8_t x_M_4 = x[4]>>3 ^ x[3]; - - y[7] = x[5]; - y[6] = x_M_5; - y[5] = x_M_5<<3 ^ x_M_4; - y[4] = x_M_4>>3 ^ x[2]; - y[3] = x[6]<<2 ^ x[1]; - y[2] = x[5]<<2 ^ x[0]; - y[1] = x[7]; - y[0] = x[6]; -} - -static void _multiply_M3(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) -{ - uint8_t x_M_5 = x[5]<<3 ^ x[4]; - uint8_t x_M_4 = x[4]>>3 ^ x[3]; - uint8_t x_M2_5 = x_M_5<<3 ^ x_M_4; - uint8_t x_M2_4 = x_M_4>>3 ^ x[2]; - - y[7] = x_M_5; - y[6] = x_M2_5; - y[5] = x_M2_5<<3 ^ x_M2_4; - y[4] = x_M2_4>>3 ^ x[6]<<2 ^ x[1]; - y[3] = x[5]<<2 ^ x[0]; - y[2] = x_M_5<<2 ^ x[7]; - y[1] = x[6]; - y[0] = x[5]; -} - -static void _multiply_MR(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) -{ - y[0] = x[1]; - y[1] = x[2]; - y[2] = x[3] ^ x[4]>>3; - y[3] = x[4]; - y[4] = x[5] ^ x[6]<<3; - y[5] = x[3]<<2 ^ x[6]; - y[6] = x[7]; - y[7] = x[0]; -} - -static void _multiply_MR2(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) -{ - uint8_t x_MR_4 = x[5] ^ x[6]<<3; - - y[0] = x[2]; - y[1] = x[3] ^ x[4]>>3; - y[2] = x[4] ^ x_MR_4>>3; - y[3] = x_MR_4; - y[4] = x[3]<<2 ^ x[6] ^ x[7]<<3; - y[5] = x[4]<<2 ^ x[7]; - y[6] = x[0]; - y[7] = x[1]; -} - -static void _multiply_MR3(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) -{ - uint8_t x_MR_4 = x[5] ^ x[6]<<3; - uint8_t x_MR2_4 = x[3]<<2 ^ x[6] ^ x[7]<<3; - - y[0] = x[3] ^ x[4]>>3; - y[1] = x[4] ^ x_MR_4>>3; - y[2] = x_MR_4 ^ x_MR2_4>>3; - y[3] = x_MR2_4; - y[4] = x[0]<<3 ^ x[4]<<2 ^ x[7]; - y[5] = x_MR_4<<2 ^ x[0]; - y[6] = x[1]; - y[7] = x[2]; -} - -typedef void (*matrix_multiplication)(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]); - -static const matrix_multiplication ALPHAS[6] = { - _multiply_M, - _multiply_M2, - _multiply_M3, - _multiply_MR, - _multiply_MR2, - _multiply_MR3 -}; - - -void tweakey_state_update(uint8_t TK[TWEAKEY_BYTES]) -{ - /* Skip lane 0, as it is multiplied by the identity matrix. */ - - for (size_t j=1; j @@ -76,18 +76,34 @@ static void _multiply_M(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) static void _multiply_M2(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) { - uint8_t M_x[LANE_BYTES]; - _multiply_M(x, M_x); - _multiply_M(M_x, y); + uint8_t x_M_5 = x[5]<<3 ^ x[4]; + uint8_t x_M_4 = x[4]>>3 ^ x[3]; + + y[7] = x[5]; + y[6] = x_M_5; + y[5] = x_M_5<<3 ^ x_M_4; + y[4] = x_M_4>>3 ^ x[2]; + y[3] = x[6]<<2 ^ x[1]; + y[2] = x[5]<<2 ^ x[0]; + y[1] = x[7]; + y[0] = x[6]; } static void _multiply_M3(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) { - uint8_t M_x[LANE_BYTES]; - uint8_t M2_x[LANE_BYTES]; - _multiply_M(x, M_x); - _multiply_M(M_x, M2_x); - _multiply_M(M2_x, y); + uint8_t x_M_5 = x[5]<<3 ^ x[4]; + uint8_t x_M_4 = x[4]>>3 ^ x[3]; + uint8_t x_M2_5 = x_M_5<<3 ^ x_M_4; + uint8_t x_M2_4 = x_M_4>>3 ^ x[2]; + + y[7] = x_M_5; + y[6] = x_M2_5; + y[5] = x_M2_5<<3 ^ x_M2_4; + y[4] = x_M2_4>>3 ^ x[6]<<2 ^ x[1]; + y[3] = x[5]<<2 ^ x[0]; + y[2] = x_M_5<<2 ^ x[7]; + y[1] = x[6]; + y[0] = x[5]; } static void _multiply_MR(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) @@ -104,18 +120,31 @@ static void _multiply_MR(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) static void _multiply_MR2(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) { - uint8_t MR_x[LANE_BYTES]; - _multiply_MR(x, MR_x); - _multiply_MR(MR_x, y); + uint8_t x_MR_4 = x[5] ^ x[6]<<3; + + y[0] = x[2]; + y[1] = x[3] ^ x[4]>>3; + y[2] = x[4] ^ x_MR_4>>3; + y[3] = x_MR_4; + y[4] = x[3]<<2 ^ x[6] ^ x[7]<<3; + y[5] = x[4]<<2 ^ x[7]; + y[6] = x[0]; + y[7] = x[1]; } static void _multiply_MR3(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) { - uint8_t MR_x[LANE_BYTES]; - uint8_t MR2_x[LANE_BYTES]; - _multiply_MR(x, MR_x); - _multiply_MR(MR_x, MR2_x); - _multiply_MR(MR2_x, y); + uint8_t x_MR_4 = x[5] ^ x[6]<<3; + uint8_t x_MR2_4 = x[3]<<2 ^ x[6] ^ x[7]<<3; + + y[0] = x[3] ^ x[4]>>3; + y[1] = x[4] ^ x_MR_4>>3; + y[2] = x_MR_4 ^ x_MR2_4>>3; + y[3] = x_MR2_4; + y[4] = x[0]<<3 ^ x[4]<<2 ^ x[7]; + y[5] = x_MR_4<<2 ^ x[0]; + y[6] = x[1]; + y[7] = x[2]; } typedef void (*matrix_multiplication)(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]); diff --git a/traces/traces-tbc.patch b/traces/traces-tbc.patch index fca6da1..5dc749e 100644 --- a/traces/traces-tbc.patch +++ b/traces/traces-tbc.patch @@ -121,7 +121,7 @@ index 39e5980..4cdcf2a 100644 --- a/SOUMISSION_NIST/REFERENCE_IMPLEMENTATION/src/ref/tweakey.c +++ b/SOUMISSION_NIST/REFERENCE_IMPLEMENTATION/src/ref/tweakey.c @@ -17,6 +17,8 @@ where multiplications by matrices M and M_R to the power n is performed by - by applying functions for M and M_R n times. + by functions expressing the exponentiated matrices with shifts and XORs. */ +#include "debug.h" -- cgit v1.2.3