From 4582b5447826886a4ce7f5cd095daed2513d352d Mon Sep 17 00:00:00 2001 From: Kévin Le Gouguec Date: Tue, 12 Mar 2019 10:42:10 +0100 Subject: Ajout de l'implémentation à seuil d'ordre 1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Modifications nécessaires dans l'infra : - retrait conditionnel de test-tweakey, vu que l'API n'est pas la même pour l'implémentation à seuil, - retrait conditionnel de l'avertissement "-Wparentheses", plus agaçant qu'autre chose sur les calculs booléens de cipher.c, e.g. y_hi&3 ^ (y_hi&8)>>1 où la priorité est intuitive (shifts avant AND avant XOR). C'est dommage de perdre les avertissements sur if (a&b == c), mais tant pis… On va compter sur La Suite De Test®©™ pour nous couvrir. Co-authored-by: Alexandre Adomnicai Co-authored-by: leo --- nist/make-package.sh | 1 + src/add_threshold/cipher.c | 307 ++++++++++++++++++++++++++++++++++ src/add_threshold/cipher.h | 1 + src/add_threshold/constants.h | 1 + src/add_threshold/lilliput-ae-utils.h | 1 + src/add_threshold/lilliput-ae.h | 1 + src/add_threshold/lilliput-i.c | 1 + src/add_threshold/lilliput-ii.c | 1 + src/add_threshold/tweakey.c | 216 ++++++++++++++++++++++++ src/add_threshold/tweakey.h | 47 ++++++ test/check-implementation.sh | 2 +- test/common.mk | 9 +- 12 files changed, 586 insertions(+), 2 deletions(-) create mode 100644 src/add_threshold/cipher.c create mode 120000 src/add_threshold/cipher.h create mode 120000 src/add_threshold/constants.h create mode 120000 src/add_threshold/lilliput-ae-utils.h create mode 120000 src/add_threshold/lilliput-ae.h create mode 120000 src/add_threshold/lilliput-i.c create mode 120000 src/add_threshold/lilliput-ii.c create mode 100644 src/add_threshold/tweakey.c create mode 100644 src/add_threshold/tweakey.h diff --git a/nist/make-package.sh b/nist/make-package.sh index 77c4057..abd3b50 100755 --- a/nist/make-package.sh +++ b/nist/make-package.sh @@ -53,6 +53,7 @@ add-variant () implementations=( ref + add_threshold add_tweakeyloop ) diff --git a/src/add_threshold/cipher.c b/src/add_threshold/cipher.c new file mode 100644 index 0000000..911449d --- /dev/null +++ b/src/add_threshold/cipher.c @@ -0,0 +1,307 @@ +/* +Implementation of the Lilliput-AE tweakable block cipher. + +Authors: + Kévin Le Gouguec, + Léo Reynaud, + Alexandre Adomnicai, 2019. + +For more information, feedback or questions, refer to our website: +https://paclido.fr/lilliput-ae + +To the extent possible under law, the implementer has waived all copyright +and related or neighboring rights to the source code in this file. +http://creativecommons.org/publicdomain/zero/1.0/ + +--- + +This file provides an implementation of Lilliput-TBC's tweakey schedule, +where multiplications by matrices M and M_R to the power n are performed +by functions expressing the exponentiated matrices with shifts and XORs. +*/ + +#include +#include +#include + +#include "cipher.h" +#include "constants.h" +#include "tweakey.h" + + +enum permutation +{ + PERMUTATION_ENCRYPTION = 0, /* PI(i) */ + PERMUTATION_DECRYPTION = 1, /* PI^-1(i) */ + PERMUTATION_NONE +}; + +typedef enum permutation permutation; + +static const uint8_t PERMUTATIONS[2][BLOCK_BYTES] = { + [PERMUTATION_ENCRYPTION] = { 13, 9, 14, 8, 10, 11, 12, 15, 4, 5, 3, 1, 2, 6, 0, 7 }, + [PERMUTATION_DECRYPTION] = { 14, 11, 12, 10, 8, 9, 13, 15, 3, 1, 4, 5, 6, 0, 2, 7 } +}; + +static const uint8_t F[16][16] = { + {0x0, 0x2, 0x0, 0x2, 0x2, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x2, 0x2, 0x0, 0x2, 0x0}, + {0x0, 0x2, 0x9, 0xb, 0x3, 0x1, 0xa, 0x8, 0xd, 0xf, 0x4, 0x6, 0xe, 0xc, 0x7, 0x5}, + {0x0, 0xb, 0x0, 0xb, 0xb, 0x0, 0xb, 0x0, 0x1, 0xa, 0x1, 0xa, 0xa, 0x1, 0xa, 0x1}, + {0x9, 0x2, 0x0, 0xb, 0x3, 0x8, 0xa, 0x1, 0x5, 0xe, 0xc, 0x7, 0xf, 0x4, 0x6, 0xd}, + {0x1, 0x2, 0x8, 0xb, 0x3, 0x0, 0xa, 0x9, 0x9, 0xa, 0x0, 0x3, 0xb, 0x8, 0x2, 0x1}, + {0x0, 0x3, 0x0, 0x3, 0x3, 0x0, 0x3, 0x0, 0x5, 0x6, 0x5, 0x6, 0x6, 0x5, 0x6, 0x5}, + {0x8, 0x2, 0x1, 0xb, 0x3, 0x9, 0xa, 0x0, 0x1, 0xb, 0x8, 0x2, 0xa, 0x0, 0x3, 0x9}, + {0x0, 0xa, 0x0, 0xa, 0xa, 0x0, 0xa, 0x0, 0x4, 0xe, 0x4, 0xe, 0xe, 0x4, 0xe, 0x4}, + {0x1, 0xe, 0x0, 0xf, 0xb, 0x4, 0xa, 0x5, 0x1, 0xe, 0x0, 0xf, 0xb, 0x4, 0xa, 0x5}, + {0xc, 0x3, 0x4, 0xb, 0x7, 0x8, 0xf, 0x0, 0x1, 0xe, 0x9, 0x6, 0xa, 0x5, 0x2, 0xd}, + {0x0, 0x6, 0x1, 0x7, 0x3, 0x5, 0x2, 0x4, 0x1, 0x7, 0x0, 0x6, 0x2, 0x4, 0x3, 0x5}, + {0x4, 0x2, 0xc, 0xa, 0x6, 0x0, 0xe, 0x8, 0x8, 0xe, 0x0, 0x6, 0xa, 0xc, 0x2, 0x4}, + {0x8, 0x6, 0x0, 0xe, 0x2, 0xc, 0xa, 0x4, 0x0, 0xe, 0x8, 0x6, 0xa, 0x4, 0x2, 0xc}, + {0x4, 0xa, 0x5, 0xb, 0xf, 0x1, 0xe, 0x0, 0x1, 0xf, 0x0, 0xe, 0xa, 0x4, 0xb, 0x5}, + {0x0, 0x7, 0x8, 0xf, 0x3, 0x4, 0xb, 0xc, 0x9, 0xe, 0x1, 0x6, 0xa, 0xd, 0x2, 0x5}, + {0x5, 0x2, 0x4, 0x3, 0x7, 0x0, 0x6, 0x1, 0x1, 0x6, 0x0, 0x7, 0x3, 0x4, 0x2, 0x5} +}; + +static const uint8_t G[4][16] = { + {0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8, 0x9, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf}, + {0x0, 0x1, 0x2, 0x3, 0x5, 0x4, 0x7, 0x6, 0x8, 0x9, 0xa, 0xb, 0xd, 0xc, 0xf, 0xe}, + {0x0, 0x1, 0x3, 0x2, 0x4, 0x5, 0x7, 0x6, 0x8, 0x9, 0xb, 0xa, 0xc, 0xd, 0xf, 0xe}, + {0x1, 0x0, 0x2, 0x3, 0x4, 0x5, 0x7, 0x6, 0x9, 0x8, 0xa, 0xb, 0xc, 0xd, 0xf, 0xe} +}; + +static const uint8_t Q[8][16] = { + {0x0, 0x4, 0x2, 0x6, 0x8, 0xc, 0xa, 0xe, 0x1, 0x5, 0x3, 0x7, 0x9, 0xd, 0xb, 0xf}, + {0x0, 0x4, 0xa, 0xe, 0x8, 0xc, 0x2, 0x6, 0x3, 0x7, 0x9, 0xd, 0xb, 0xf, 0x1, 0x5}, + {0x0, 0xc, 0x2, 0xe, 0x8, 0x4, 0xa, 0x6, 0x1, 0xd, 0x3, 0xf, 0x9, 0x5, 0xb, 0x7}, + {0x8, 0x4, 0x2, 0xe, 0x0, 0xc, 0xa, 0x6, 0xb, 0x7, 0x1, 0xd, 0x3, 0xf, 0x9, 0x5}, + {0x0, 0x6, 0x2, 0x4, 0x8, 0xe, 0xa, 0xc, 0x1, 0x7, 0x3, 0x5, 0x9, 0xf, 0xb, 0xd}, + {0x2, 0x4, 0x8, 0xe, 0xa, 0xc, 0x0, 0x6, 0x1, 0x7, 0xb, 0xd, 0x9, 0xf, 0x3, 0x5}, + {0x0, 0xe, 0x2, 0xc, 0x8, 0x6, 0xa, 0x4, 0x1, 0xf, 0x3, 0xd, 0x9, 0x7, 0xb, 0x5}, + {0xa, 0x4, 0x0, 0xe, 0x2, 0xc, 0x8, 0x6, 0x9, 0x7, 0x3, 0xd, 0x1, 0xf, 0xb, 0x5} +}; + +static const uint8_t P[16] = { + 0x0, 0x2, 0x8, 0xa, 0x4, 0X6, 0xc, 0xe, 0x1, 0x3, 0x9, 0xb, 0x5, 0x7, 0xd, 0xf +}; + +static void _state_init_TI(uint8_t X[BLOCK_BYTES], uint8_t Y[BLOCK_BYTES], uint8_t Z[BLOCK_BYTES], const uint8_t message[BLOCK_BYTES]) +{ + // To be replaced by real random numbers!!! + uint8_t SHARES_0[BLOCK_BYTES] = { + 0x0f, 0x1e, 0x2d, 0x3c, 0x4b, 0x5a, 0x69, 0x78, 0x87, 0x96, 0xa5, 0xb4, 0xc3, 0xd2, 0xe1, 0xf0 + }; + uint8_t SHARES_1[BLOCK_BYTES] = { + 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f + }; + + memcpy(X, SHARES_0, BLOCK_BYTES); + memcpy(Y, SHARES_1, BLOCK_BYTES); + for (uint8_t i=0; i> 4; + x_lo = TMP_X[j] & 0xf; + y_hi = TMP_Y[j] >> 4; + y_lo = TMP_Y[j] & 0xf; + z_hi = Z[j] >> 4; + z_lo = Z[j] & 0xf; + // First 4-bit S-box + tmp0 = G[(y_lo&7)>>1][z_lo]; + tmp1 = G[(z_lo&7)>>1][x_lo]; + tmp2 = G[(x_lo&7)>>1][y_lo]; + x_hi ^= F[tmp1][tmp2]; + y_hi ^= F[tmp2][tmp0]; + z_hi ^= F[tmp0][tmp1]; + // Second 4-bit S-box + tmp0 = P[Q[y_hi&3 ^ (y_hi&8)>>1][z_hi]]; + tmp1 = P[Q[z_hi&3 ^ (z_hi&8)>>1][x_hi]]; + tmp2 = P[Q[x_hi&3 ^ (x_hi&8)>>1][y_hi]]; + x_lo ^= Q[tmp1&3 ^ (tmp1&8)>>1][tmp2]; + y_lo ^= Q[tmp2&3 ^ (tmp2&8)>>1][tmp0]; + z_lo ^= Q[tmp0&3 ^ (tmp0&8)>>1][tmp1]; + // Third 4-bit S-box + tmp0 = G[(y_lo&7)>>1][z_lo] ^ 1; + tmp1 = G[(z_lo&7)>>1][x_lo]; + tmp2 = G[(x_lo&7)>>1][y_lo]; + x_hi ^= F[tmp1][tmp2]; + y_hi ^= F[tmp2][tmp0]; + z_hi ^= F[tmp0][tmp1]; + // Build bytes from nibbles + TMP_X[j] = (x_hi << 4 | x_lo); + TMP_Y[j] = (y_hi << 4 | y_lo); + TMP_Z[j] = (z_hi << 4 | z_lo); + } + + for (size_t j=0; j<8; j++) + { + size_t dest_j = 15-j; + X[dest_j] ^= TMP_X[j]; + Y[dest_j] ^= TMP_Y[j]; + Z[dest_j] ^= TMP_Z[j]; + } +} + +static void _linear_layer(uint8_t X[BLOCK_BYTES]) +{ + X[15] ^= X[1]; + X[15] ^= X[2]; + X[15] ^= X[3]; + X[15] ^= X[4]; + X[15] ^= X[5]; + X[15] ^= X[6]; + X[15] ^= X[7]; + + X[14] ^= X[7]; + X[13] ^= X[7]; + X[12] ^= X[7]; + X[11] ^= X[7]; + X[10] ^= X[7]; + X[9] ^= X[7]; +} + +static void _permutation_layer(uint8_t X[BLOCK_BYTES], permutation p) +{ + if (p == PERMUTATION_NONE) + { + return; + } + + uint8_t X_old[BLOCK_BYTES]; + memcpy(X_old, X, BLOCK_BYTES); + + const uint8_t *pi = PERMUTATIONS[p]; + + for (size_t j=0; j +#include + +#include "constants.h" +#include "tweakey.h" + + +#define LANE_BITS 64 +#define LANE_BYTES (LANE_BITS/8) +#define LANES_NB (TWEAKEY_BYTES/LANE_BYTES) + + +void tweakey_state_init_TI( + uint8_t TK_X[TWEAKEY_BYTES], + uint8_t TK_Y[KEY_BYTES], + const uint8_t key[KEY_BYTES], + const uint8_t tweak[TWEAK_BYTES] +) +{ + // To be replaced by real random numbers!!! + uint8_t SHARES_0[KEY_BYTES] = { + 0x0f, 0x1e, 0x2d, 0x3c, 0x4b, 0x5a, 0x69, 0x78, 0x87, 0x96, 0xa5, 0xb4, 0xc3, 0xd2, 0xe1, 0xf0 + }; + + memcpy(TK_Y, SHARES_0, KEY_BYTES); + memcpy(TK_X, tweak, TWEAK_BYTES); + + for (size_t i=0; i>3 ^ x[3]; + y[3] = x[2]; + y[2] = x[6]<<2 ^ x[1]; + y[1] = x[0]; + y[0] = x[7]; +} + +static void _multiply_M2(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) +{ + uint8_t x_M_5 = x[5]<<3 ^ x[4]; + uint8_t x_M_4 = x[4]>>3 ^ x[3]; + + y[7] = x[5]; + y[6] = x_M_5; + y[5] = x_M_5<<3 ^ x_M_4; + y[4] = x_M_4>>3 ^ x[2]; + y[3] = x[6]<<2 ^ x[1]; + y[2] = x[5]<<2 ^ x[0]; + y[1] = x[7]; + y[0] = x[6]; +} + +static void _multiply_M3(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) +{ + uint8_t x_M_5 = x[5]<<3 ^ x[4]; + uint8_t x_M_4 = x[4]>>3 ^ x[3]; + uint8_t x_M2_5 = x_M_5<<3 ^ x_M_4; + uint8_t x_M2_4 = x_M_4>>3 ^ x[2]; + + y[7] = x_M_5; + y[6] = x_M2_5; + y[5] = x_M2_5<<3 ^ x_M2_4; + y[4] = x_M2_4>>3 ^ x[6]<<2 ^ x[1]; + y[3] = x[5]<<2 ^ x[0]; + y[2] = x_M_5<<2 ^ x[7]; + y[1] = x[6]; + y[0] = x[5]; +} + +static void _multiply_MR(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) +{ + y[0] = x[1]; + y[1] = x[2]; + y[2] = x[3] ^ x[4]>>3; + y[3] = x[4]; + y[4] = x[5] ^ x[6]<<3; + y[5] = x[3]<<2 ^ x[6]; + y[6] = x[7]; + y[7] = x[0]; +} + +static void _multiply_MR2(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) +{ + uint8_t x_MR_4 = x[5] ^ x[6]<<3; + + y[0] = x[2]; + y[1] = x[3] ^ x[4]>>3; + y[2] = x[4] ^ x_MR_4>>3; + y[3] = x_MR_4; + y[4] = x[3]<<2 ^ x[6] ^ x[7]<<3; + y[5] = x[4]<<2 ^ x[7]; + y[6] = x[0]; + y[7] = x[1]; +} + +static void _multiply_MR3(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) +{ + uint8_t x_MR_4 = x[5] ^ x[6]<<3; + uint8_t x_MR2_4 = x[3]<<2 ^ x[6] ^ x[7]<<3; + + y[0] = x[3] ^ x[4]>>3; + y[1] = x[4] ^ x_MR_4>>3; + y[2] = x_MR_4 ^ x_MR2_4>>3; + y[3] = x_MR2_4; + y[4] = x[0]<<3 ^ x[4]<<2 ^ x[7]; + y[5] = x_MR_4<<2 ^ x[0]; + y[6] = x[1]; + y[7] = x[2]; +} + +typedef void (*matrix_multiplication)(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]); + +static const matrix_multiplication ALPHAS[6] = { + _multiply_M, + _multiply_M2, + _multiply_M3, + _multiply_MR, + _multiply_MR2, + _multiply_MR3 +}; + + +void tweakey_state_update_TI(uint8_t TK_X[TWEAKEY_BYTES], uint8_t TK_Y[KEY_BYTES]) +{ + /* Skip lane 0, as it is multiplied by the identity matrix. */ + + for (size_t j=1; j<(TWEAK_BYTES/LANE_BYTES); j++) + { + uint8_t *TKj_X = TK_X + j*LANE_BYTES; + + uint8_t TKj_old_X[LANE_BYTES]; + memcpy(TKj_old_X, TKj_X, LANE_BYTES); + + ALPHAS[j-1](TKj_old_X, TKj_X); + } + + for (size_t j=0; j<(KEY_BYTES/LANE_BYTES); j++) + { + uint8_t *TKj_X = TK_X + (j + (TWEAK_BYTES/LANE_BYTES))*LANE_BYTES; + uint8_t *TKj_Y = TK_Y + j*LANE_BYTES; + + uint8_t TKj_X_old[LANE_BYTES]; + uint8_t TKj_Y_old[LANE_BYTES]; + memcpy(TKj_X_old, TKj_X, LANE_BYTES); + memcpy(TKj_Y_old, TKj_Y, LANE_BYTES); + + ALPHAS[j-1 + (TWEAK_BYTES/LANE_BYTES)](TKj_X_old, TKj_X); + ALPHAS[j-1 + (TWEAK_BYTES/LANE_BYTES)](TKj_Y_old, TKj_Y); + } +} diff --git a/src/add_threshold/tweakey.h b/src/add_threshold/tweakey.h new file mode 100644 index 0000000..c76d655 --- /dev/null +++ b/src/add_threshold/tweakey.h @@ -0,0 +1,47 @@ +/* +Implementation of the Lilliput-AE tweakable block cipher. + +Authors: + Kévin Le Gouguec, + Léo Reynaud, + Alexandre Adomnicai, 2019. + +For more information, feedback or questions, refer to our website: +https://paclido.fr/lilliput-ae + +To the extent possible under law, the implementer has waived all copyright +and related or neighboring rights to the source code in this file. +http://creativecommons.org/publicdomain/zero/1.0/ + +--- + +This file provides the interface for Lilliput-TBC's tweakey schedule. +*/ + +#ifndef TWEAKEY_H +#define TWEAKEY_H + +#include + +#include "constants.h" + + +void tweakey_state_init_TI( + uint8_t TK_X[TWEAKEY_BYTES], + uint8_t TK_Y[TWEAKEY_BYTES], + const uint8_t key[KEY_BYTES], + const uint8_t tweak[TWEAK_BYTES] +); + +void tweakey_state_extract_TI( + const uint8_t TK_X[TWEAKEY_BYTES], + const uint8_t TK_Y[KEY_BYTES], + uint8_t round_constant, + uint8_t round_tweakey_X[ROUND_TWEAKEY_BYTES], + uint8_t round_tweakey_Y[ROUND_TWEAKEY_BYTES] +); + +void tweakey_state_update_TI(uint8_t TK_X[TWEAKEY_BYTES], uint8_t TK_Y[KEY_BYTES]); + + +#endif /* TWEAKEY_H */ diff --git a/test/check-implementation.sh b/test/check-implementation.sh index 4113637..0750d1b 100755 --- a/test/check-implementation.sh +++ b/test/check-implementation.sh @@ -46,7 +46,7 @@ run-genkat () local nist_flags=(-std=c99 -Wall -Wextra -Wshadow -fsanitize=address,undefined -O2) - gcc ${nist_flags[@]} -Werror -I${genkat_dir} ${genkat_dir}/*.c -o ${genkat} + gcc ${nist_flags[@]} -I${genkat_dir} ${genkat_dir}/*.c -o ${genkat} ${genkat} mv LWC_AEAD_KAT*.txt ${vectors_dir}/${mode}-${keylen} diff --git a/test/common.mk b/test/common.mk index 677dcbe..c978c2d 100644 --- a/test/common.mk +++ b/test/common.mk @@ -11,9 +11,16 @@ endif IMPLEMENTATION = ref +ifeq "$(IMPLEMENTATION)" "add_threshold" +# Filter out tests on tweakey schedule, as the thresholded API differs. +tests = $(filter-out test-tweakey,$(basename $(wildcard test-*.c))) +# Don't trigger warnings for "a&b ^ c". +CFLAGS += -Wno-parentheses +else tests = $(basename $(wildcard test-*.c)) -traces = $(basename $(wildcard traces-*.c)) +endif +traces = $(basename $(wildcard traces-*.c)) test_dir = $(dir $(lastword $(MAKEFILE_LIST))) root_dir = $(test_dir).. -- cgit v1.2.3 From 7a2cf03fece905c33bcf3fbbad8d93c682c09bc0 Mon Sep 17 00:00:00 2001 From: Kévin Le Gouguec Date: Tue, 12 Mar 2019 11:17:16 +0100 Subject: Ajustement des entêtes des fichiers sources MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - ordre alphabétique des auteurs, - un auteur par ligne, date sur une ligne séparée : maintenance et diff plus simples, - brève description de chaque fichier. --- src/add_threshold/cipher.c | 12 ++++++------ src/add_threshold/tweakey.c | 12 ++++++------ src/add_threshold/tweakey.h | 10 ++++++---- 3 files changed, 18 insertions(+), 16 deletions(-) diff --git a/src/add_threshold/cipher.c b/src/add_threshold/cipher.c index 911449d..d78270d 100644 --- a/src/add_threshold/cipher.c +++ b/src/add_threshold/cipher.c @@ -2,9 +2,10 @@ Implementation of the Lilliput-AE tweakable block cipher. Authors: - Kévin Le Gouguec, - Léo Reynaud, - Alexandre Adomnicai, 2019. + Alexandre Adomnicai, + Kévin Le Gouguec, + Léo Reynaud, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae @@ -15,9 +16,8 @@ http://creativecommons.org/publicdomain/zero/1.0/ --- -This file provides an implementation of Lilliput-TBC's tweakey schedule, -where multiplications by matrices M and M_R to the power n are performed -by functions expressing the exponentiated matrices with shifts and XORs. +This file provides a first-order threshold implementation for Lilliput-TBC, +where the input block is split into three shares. */ #include diff --git a/src/add_threshold/tweakey.c b/src/add_threshold/tweakey.c index 28d0e3d..fc664ed 100644 --- a/src/add_threshold/tweakey.c +++ b/src/add_threshold/tweakey.c @@ -2,9 +2,10 @@ Implementation of the Lilliput-AE tweakable block cipher. Authors: - Kévin Le Gouguec, - Léo Reynaud, - Alexandre Adomnicai, 2019. + Alexandre Adomnicai, + Kévin Le Gouguec, + Léo Reynaud, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae @@ -15,9 +16,8 @@ http://creativecommons.org/publicdomain/zero/1.0/ --- -This file provides an implementation of Lilliput-TBC's tweakey schedule, -where multiplications by matrices M and M_R to the power n are performed -by functions expressing the exponentiated matrices with shifts and XORs. +This file provides a first-order threshold implementation of Lilliput-TBC's +tweakey schedule, where the tweak and the key are split into two shares. */ #include diff --git a/src/add_threshold/tweakey.h b/src/add_threshold/tweakey.h index c76d655..ca7bd49 100644 --- a/src/add_threshold/tweakey.h +++ b/src/add_threshold/tweakey.h @@ -2,9 +2,10 @@ Implementation of the Lilliput-AE tweakable block cipher. Authors: - Kévin Le Gouguec, - Léo Reynaud, - Alexandre Adomnicai, 2019. + Alexandre Adomnicai, + Kévin Le Gouguec, + Léo Reynaud, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae @@ -15,7 +16,8 @@ http://creativecommons.org/publicdomain/zero/1.0/ --- -This file provides the interface for Lilliput-TBC's tweakey schedule. +This file provides the interface for the first-order threshold implementation +of Lilliput-TBC's tweakey schedule. */ #ifndef TWEAKEY_H -- cgit v1.2.3 From a3fcc8a19fd39e13e41f96abb78a9f6c0bb4c5e5 Mon Sep 17 00:00:00 2001 From: Kévin Le Gouguec Date: Tue, 12 Mar 2019 11:22:45 +0100 Subject: Retrait des suffixes _TI Dans le but de rendre diff -ru ref add_threshold plus digeste. --- src/add_threshold/cipher.c | 34 +++++++++++++++++----------------- src/add_threshold/tweakey.c | 6 +++--- src/add_threshold/tweakey.h | 6 +++--- 3 files changed, 23 insertions(+), 23 deletions(-) diff --git a/src/add_threshold/cipher.c b/src/add_threshold/cipher.c index d78270d..1535025 100644 --- a/src/add_threshold/cipher.c +++ b/src/add_threshold/cipher.c @@ -84,7 +84,7 @@ static const uint8_t P[16] = { 0x0, 0x2, 0x8, 0xa, 0x4, 0X6, 0xc, 0xe, 0x1, 0x3, 0x9, 0xb, 0x5, 0x7, 0xd, 0xf }; -static void _state_init_TI(uint8_t X[BLOCK_BYTES], uint8_t Y[BLOCK_BYTES], uint8_t Z[BLOCK_BYTES], const uint8_t message[BLOCK_BYTES]) +static void _state_init(uint8_t X[BLOCK_BYTES], uint8_t Y[BLOCK_BYTES], uint8_t Z[BLOCK_BYTES], const uint8_t message[BLOCK_BYTES]) { // To be replaced by real random numbers!!! uint8_t SHARES_0[BLOCK_BYTES] = { @@ -103,7 +103,7 @@ static void _state_init_TI(uint8_t X[BLOCK_BYTES], uint8_t Y[BLOCK_BYTES], uint8 } -static void _compute_round_tweakeys_TI( +static void _compute_round_tweakeys( const uint8_t key[KEY_BYTES], const uint8_t tweak[TWEAK_BYTES], uint8_t RTK_X[ROUNDS][ROUND_TWEAKEY_BYTES], @@ -112,18 +112,18 @@ static void _compute_round_tweakeys_TI( { uint8_t TK_X[TWEAKEY_BYTES]; uint8_t TK_Y[TWEAKEY_BYTES]; - tweakey_state_init_TI(TK_X, TK_Y, key, tweak); - tweakey_state_extract_TI(TK_X, TK_Y, 0, RTK_X[0], RTK_Y[0]); + tweakey_state_init(TK_X, TK_Y, key, tweak); + tweakey_state_extract(TK_X, TK_Y, 0, RTK_X[0], RTK_Y[0]); for (uint8_t i=1; i Date: Tue, 12 Mar 2019 11:31:44 +0100 Subject: Ajustement des caractères d'espacement MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - fins de ligne UNIX (\n) - espaces plutôt que tabulations --- src/add_threshold/cipher.c | 614 ++++++++++++++++++++++---------------------- src/add_threshold/tweakey.c | 432 +++++++++++++++---------------- src/add_threshold/tweakey.h | 98 +++---- 3 files changed, 572 insertions(+), 572 deletions(-) diff --git a/src/add_threshold/cipher.c b/src/add_threshold/cipher.c index 1535025..ad8b4d3 100644 --- a/src/add_threshold/cipher.c +++ b/src/add_threshold/cipher.c @@ -1,307 +1,307 @@ -/* -Implementation of the Lilliput-AE tweakable block cipher. - -Authors: - Alexandre Adomnicai, - Kévin Le Gouguec, - Léo Reynaud, - 2019. - -For more information, feedback or questions, refer to our website: -https://paclido.fr/lilliput-ae - -To the extent possible under law, the implementer has waived all copyright -and related or neighboring rights to the source code in this file. -http://creativecommons.org/publicdomain/zero/1.0/ - ---- - -This file provides a first-order threshold implementation for Lilliput-TBC, -where the input block is split into three shares. -*/ - -#include -#include -#include - -#include "cipher.h" -#include "constants.h" -#include "tweakey.h" - - -enum permutation -{ - PERMUTATION_ENCRYPTION = 0, /* PI(i) */ - PERMUTATION_DECRYPTION = 1, /* PI^-1(i) */ - PERMUTATION_NONE -}; - -typedef enum permutation permutation; - -static const uint8_t PERMUTATIONS[2][BLOCK_BYTES] = { - [PERMUTATION_ENCRYPTION] = { 13, 9, 14, 8, 10, 11, 12, 15, 4, 5, 3, 1, 2, 6, 0, 7 }, - [PERMUTATION_DECRYPTION] = { 14, 11, 12, 10, 8, 9, 13, 15, 3, 1, 4, 5, 6, 0, 2, 7 } -}; - -static const uint8_t F[16][16] = { - {0x0, 0x2, 0x0, 0x2, 0x2, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x2, 0x2, 0x0, 0x2, 0x0}, - {0x0, 0x2, 0x9, 0xb, 0x3, 0x1, 0xa, 0x8, 0xd, 0xf, 0x4, 0x6, 0xe, 0xc, 0x7, 0x5}, - {0x0, 0xb, 0x0, 0xb, 0xb, 0x0, 0xb, 0x0, 0x1, 0xa, 0x1, 0xa, 0xa, 0x1, 0xa, 0x1}, - {0x9, 0x2, 0x0, 0xb, 0x3, 0x8, 0xa, 0x1, 0x5, 0xe, 0xc, 0x7, 0xf, 0x4, 0x6, 0xd}, - {0x1, 0x2, 0x8, 0xb, 0x3, 0x0, 0xa, 0x9, 0x9, 0xa, 0x0, 0x3, 0xb, 0x8, 0x2, 0x1}, - {0x0, 0x3, 0x0, 0x3, 0x3, 0x0, 0x3, 0x0, 0x5, 0x6, 0x5, 0x6, 0x6, 0x5, 0x6, 0x5}, - {0x8, 0x2, 0x1, 0xb, 0x3, 0x9, 0xa, 0x0, 0x1, 0xb, 0x8, 0x2, 0xa, 0x0, 0x3, 0x9}, - {0x0, 0xa, 0x0, 0xa, 0xa, 0x0, 0xa, 0x0, 0x4, 0xe, 0x4, 0xe, 0xe, 0x4, 0xe, 0x4}, - {0x1, 0xe, 0x0, 0xf, 0xb, 0x4, 0xa, 0x5, 0x1, 0xe, 0x0, 0xf, 0xb, 0x4, 0xa, 0x5}, - {0xc, 0x3, 0x4, 0xb, 0x7, 0x8, 0xf, 0x0, 0x1, 0xe, 0x9, 0x6, 0xa, 0x5, 0x2, 0xd}, - {0x0, 0x6, 0x1, 0x7, 0x3, 0x5, 0x2, 0x4, 0x1, 0x7, 0x0, 0x6, 0x2, 0x4, 0x3, 0x5}, - {0x4, 0x2, 0xc, 0xa, 0x6, 0x0, 0xe, 0x8, 0x8, 0xe, 0x0, 0x6, 0xa, 0xc, 0x2, 0x4}, - {0x8, 0x6, 0x0, 0xe, 0x2, 0xc, 0xa, 0x4, 0x0, 0xe, 0x8, 0x6, 0xa, 0x4, 0x2, 0xc}, - {0x4, 0xa, 0x5, 0xb, 0xf, 0x1, 0xe, 0x0, 0x1, 0xf, 0x0, 0xe, 0xa, 0x4, 0xb, 0x5}, - {0x0, 0x7, 0x8, 0xf, 0x3, 0x4, 0xb, 0xc, 0x9, 0xe, 0x1, 0x6, 0xa, 0xd, 0x2, 0x5}, - {0x5, 0x2, 0x4, 0x3, 0x7, 0x0, 0x6, 0x1, 0x1, 0x6, 0x0, 0x7, 0x3, 0x4, 0x2, 0x5} -}; - -static const uint8_t G[4][16] = { - {0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8, 0x9, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf}, - {0x0, 0x1, 0x2, 0x3, 0x5, 0x4, 0x7, 0x6, 0x8, 0x9, 0xa, 0xb, 0xd, 0xc, 0xf, 0xe}, - {0x0, 0x1, 0x3, 0x2, 0x4, 0x5, 0x7, 0x6, 0x8, 0x9, 0xb, 0xa, 0xc, 0xd, 0xf, 0xe}, - {0x1, 0x0, 0x2, 0x3, 0x4, 0x5, 0x7, 0x6, 0x9, 0x8, 0xa, 0xb, 0xc, 0xd, 0xf, 0xe} -}; - -static const uint8_t Q[8][16] = { - {0x0, 0x4, 0x2, 0x6, 0x8, 0xc, 0xa, 0xe, 0x1, 0x5, 0x3, 0x7, 0x9, 0xd, 0xb, 0xf}, - {0x0, 0x4, 0xa, 0xe, 0x8, 0xc, 0x2, 0x6, 0x3, 0x7, 0x9, 0xd, 0xb, 0xf, 0x1, 0x5}, - {0x0, 0xc, 0x2, 0xe, 0x8, 0x4, 0xa, 0x6, 0x1, 0xd, 0x3, 0xf, 0x9, 0x5, 0xb, 0x7}, - {0x8, 0x4, 0x2, 0xe, 0x0, 0xc, 0xa, 0x6, 0xb, 0x7, 0x1, 0xd, 0x3, 0xf, 0x9, 0x5}, - {0x0, 0x6, 0x2, 0x4, 0x8, 0xe, 0xa, 0xc, 0x1, 0x7, 0x3, 0x5, 0x9, 0xf, 0xb, 0xd}, - {0x2, 0x4, 0x8, 0xe, 0xa, 0xc, 0x0, 0x6, 0x1, 0x7, 0xb, 0xd, 0x9, 0xf, 0x3, 0x5}, - {0x0, 0xe, 0x2, 0xc, 0x8, 0x6, 0xa, 0x4, 0x1, 0xf, 0x3, 0xd, 0x9, 0x7, 0xb, 0x5}, - {0xa, 0x4, 0x0, 0xe, 0x2, 0xc, 0x8, 0x6, 0x9, 0x7, 0x3, 0xd, 0x1, 0xf, 0xb, 0x5} -}; - -static const uint8_t P[16] = { - 0x0, 0x2, 0x8, 0xa, 0x4, 0X6, 0xc, 0xe, 0x1, 0x3, 0x9, 0xb, 0x5, 0x7, 0xd, 0xf -}; - -static void _state_init(uint8_t X[BLOCK_BYTES], uint8_t Y[BLOCK_BYTES], uint8_t Z[BLOCK_BYTES], const uint8_t message[BLOCK_BYTES]) -{ - // To be replaced by real random numbers!!! - uint8_t SHARES_0[BLOCK_BYTES] = { - 0x0f, 0x1e, 0x2d, 0x3c, 0x4b, 0x5a, 0x69, 0x78, 0x87, 0x96, 0xa5, 0xb4, 0xc3, 0xd2, 0xe1, 0xf0 - }; - uint8_t SHARES_1[BLOCK_BYTES] = { - 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f - }; - - memcpy(X, SHARES_0, BLOCK_BYTES); - memcpy(Y, SHARES_1, BLOCK_BYTES); - for (uint8_t i=0; i> 4; - x_lo = TMP_X[j] & 0xf; - y_hi = TMP_Y[j] >> 4; - y_lo = TMP_Y[j] & 0xf; - z_hi = Z[j] >> 4; - z_lo = Z[j] & 0xf; - // First 4-bit S-box - tmp0 = G[(y_lo&7)>>1][z_lo]; - tmp1 = G[(z_lo&7)>>1][x_lo]; - tmp2 = G[(x_lo&7)>>1][y_lo]; - x_hi ^= F[tmp1][tmp2]; - y_hi ^= F[tmp2][tmp0]; - z_hi ^= F[tmp0][tmp1]; - // Second 4-bit S-box - tmp0 = P[Q[y_hi&3 ^ (y_hi&8)>>1][z_hi]]; - tmp1 = P[Q[z_hi&3 ^ (z_hi&8)>>1][x_hi]]; - tmp2 = P[Q[x_hi&3 ^ (x_hi&8)>>1][y_hi]]; - x_lo ^= Q[tmp1&3 ^ (tmp1&8)>>1][tmp2]; - y_lo ^= Q[tmp2&3 ^ (tmp2&8)>>1][tmp0]; - z_lo ^= Q[tmp0&3 ^ (tmp0&8)>>1][tmp1]; - // Third 4-bit S-box - tmp0 = G[(y_lo&7)>>1][z_lo] ^ 1; - tmp1 = G[(z_lo&7)>>1][x_lo]; - tmp2 = G[(x_lo&7)>>1][y_lo]; - x_hi ^= F[tmp1][tmp2]; - y_hi ^= F[tmp2][tmp0]; - z_hi ^= F[tmp0][tmp1]; - // Build bytes from nibbles - TMP_X[j] = (x_hi << 4 | x_lo); - TMP_Y[j] = (y_hi << 4 | y_lo); - TMP_Z[j] = (z_hi << 4 | z_lo); - } - - for (size_t j=0; j<8; j++) - { - size_t dest_j = 15-j; - X[dest_j] ^= TMP_X[j]; - Y[dest_j] ^= TMP_Y[j]; - Z[dest_j] ^= TMP_Z[j]; - } -} - -static void _linear_layer(uint8_t X[BLOCK_BYTES]) -{ - X[15] ^= X[1]; - X[15] ^= X[2]; - X[15] ^= X[3]; - X[15] ^= X[4]; - X[15] ^= X[5]; - X[15] ^= X[6]; - X[15] ^= X[7]; - - X[14] ^= X[7]; - X[13] ^= X[7]; - X[12] ^= X[7]; - X[11] ^= X[7]; - X[10] ^= X[7]; - X[9] ^= X[7]; -} - -static void _permutation_layer(uint8_t X[BLOCK_BYTES], permutation p) -{ - if (p == PERMUTATION_NONE) - { - return; - } - - uint8_t X_old[BLOCK_BYTES]; - memcpy(X_old, X, BLOCK_BYTES); - - const uint8_t *pi = PERMUTATIONS[p]; - - for (size_t j=0; j +#include +#include + +#include "cipher.h" +#include "constants.h" +#include "tweakey.h" + + +enum permutation +{ + PERMUTATION_ENCRYPTION = 0, /* PI(i) */ + PERMUTATION_DECRYPTION = 1, /* PI^-1(i) */ + PERMUTATION_NONE +}; + +typedef enum permutation permutation; + +static const uint8_t PERMUTATIONS[2][BLOCK_BYTES] = { + [PERMUTATION_ENCRYPTION] = { 13, 9, 14, 8, 10, 11, 12, 15, 4, 5, 3, 1, 2, 6, 0, 7 }, + [PERMUTATION_DECRYPTION] = { 14, 11, 12, 10, 8, 9, 13, 15, 3, 1, 4, 5, 6, 0, 2, 7 } +}; + +static const uint8_t F[16][16] = { + {0x0, 0x2, 0x0, 0x2, 0x2, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x2, 0x2, 0x0, 0x2, 0x0}, + {0x0, 0x2, 0x9, 0xb, 0x3, 0x1, 0xa, 0x8, 0xd, 0xf, 0x4, 0x6, 0xe, 0xc, 0x7, 0x5}, + {0x0, 0xb, 0x0, 0xb, 0xb, 0x0, 0xb, 0x0, 0x1, 0xa, 0x1, 0xa, 0xa, 0x1, 0xa, 0x1}, + {0x9, 0x2, 0x0, 0xb, 0x3, 0x8, 0xa, 0x1, 0x5, 0xe, 0xc, 0x7, 0xf, 0x4, 0x6, 0xd}, + {0x1, 0x2, 0x8, 0xb, 0x3, 0x0, 0xa, 0x9, 0x9, 0xa, 0x0, 0x3, 0xb, 0x8, 0x2, 0x1}, + {0x0, 0x3, 0x0, 0x3, 0x3, 0x0, 0x3, 0x0, 0x5, 0x6, 0x5, 0x6, 0x6, 0x5, 0x6, 0x5}, + {0x8, 0x2, 0x1, 0xb, 0x3, 0x9, 0xa, 0x0, 0x1, 0xb, 0x8, 0x2, 0xa, 0x0, 0x3, 0x9}, + {0x0, 0xa, 0x0, 0xa, 0xa, 0x0, 0xa, 0x0, 0x4, 0xe, 0x4, 0xe, 0xe, 0x4, 0xe, 0x4}, + {0x1, 0xe, 0x0, 0xf, 0xb, 0x4, 0xa, 0x5, 0x1, 0xe, 0x0, 0xf, 0xb, 0x4, 0xa, 0x5}, + {0xc, 0x3, 0x4, 0xb, 0x7, 0x8, 0xf, 0x0, 0x1, 0xe, 0x9, 0x6, 0xa, 0x5, 0x2, 0xd}, + {0x0, 0x6, 0x1, 0x7, 0x3, 0x5, 0x2, 0x4, 0x1, 0x7, 0x0, 0x6, 0x2, 0x4, 0x3, 0x5}, + {0x4, 0x2, 0xc, 0xa, 0x6, 0x0, 0xe, 0x8, 0x8, 0xe, 0x0, 0x6, 0xa, 0xc, 0x2, 0x4}, + {0x8, 0x6, 0x0, 0xe, 0x2, 0xc, 0xa, 0x4, 0x0, 0xe, 0x8, 0x6, 0xa, 0x4, 0x2, 0xc}, + {0x4, 0xa, 0x5, 0xb, 0xf, 0x1, 0xe, 0x0, 0x1, 0xf, 0x0, 0xe, 0xa, 0x4, 0xb, 0x5}, + {0x0, 0x7, 0x8, 0xf, 0x3, 0x4, 0xb, 0xc, 0x9, 0xe, 0x1, 0x6, 0xa, 0xd, 0x2, 0x5}, + {0x5, 0x2, 0x4, 0x3, 0x7, 0x0, 0x6, 0x1, 0x1, 0x6, 0x0, 0x7, 0x3, 0x4, 0x2, 0x5} +}; + +static const uint8_t G[4][16] = { + {0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8, 0x9, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf}, + {0x0, 0x1, 0x2, 0x3, 0x5, 0x4, 0x7, 0x6, 0x8, 0x9, 0xa, 0xb, 0xd, 0xc, 0xf, 0xe}, + {0x0, 0x1, 0x3, 0x2, 0x4, 0x5, 0x7, 0x6, 0x8, 0x9, 0xb, 0xa, 0xc, 0xd, 0xf, 0xe}, + {0x1, 0x0, 0x2, 0x3, 0x4, 0x5, 0x7, 0x6, 0x9, 0x8, 0xa, 0xb, 0xc, 0xd, 0xf, 0xe} +}; + +static const uint8_t Q[8][16] = { + {0x0, 0x4, 0x2, 0x6, 0x8, 0xc, 0xa, 0xe, 0x1, 0x5, 0x3, 0x7, 0x9, 0xd, 0xb, 0xf}, + {0x0, 0x4, 0xa, 0xe, 0x8, 0xc, 0x2, 0x6, 0x3, 0x7, 0x9, 0xd, 0xb, 0xf, 0x1, 0x5}, + {0x0, 0xc, 0x2, 0xe, 0x8, 0x4, 0xa, 0x6, 0x1, 0xd, 0x3, 0xf, 0x9, 0x5, 0xb, 0x7}, + {0x8, 0x4, 0x2, 0xe, 0x0, 0xc, 0xa, 0x6, 0xb, 0x7, 0x1, 0xd, 0x3, 0xf, 0x9, 0x5}, + {0x0, 0x6, 0x2, 0x4, 0x8, 0xe, 0xa, 0xc, 0x1, 0x7, 0x3, 0x5, 0x9, 0xf, 0xb, 0xd}, + {0x2, 0x4, 0x8, 0xe, 0xa, 0xc, 0x0, 0x6, 0x1, 0x7, 0xb, 0xd, 0x9, 0xf, 0x3, 0x5}, + {0x0, 0xe, 0x2, 0xc, 0x8, 0x6, 0xa, 0x4, 0x1, 0xf, 0x3, 0xd, 0x9, 0x7, 0xb, 0x5}, + {0xa, 0x4, 0x0, 0xe, 0x2, 0xc, 0x8, 0x6, 0x9, 0x7, 0x3, 0xd, 0x1, 0xf, 0xb, 0x5} +}; + +static const uint8_t P[16] = { + 0x0, 0x2, 0x8, 0xa, 0x4, 0X6, 0xc, 0xe, 0x1, 0x3, 0x9, 0xb, 0x5, 0x7, 0xd, 0xf +}; + +static void _state_init(uint8_t X[BLOCK_BYTES], uint8_t Y[BLOCK_BYTES], uint8_t Z[BLOCK_BYTES], const uint8_t message[BLOCK_BYTES]) +{ + // To be replaced by real random numbers!!! + uint8_t SHARES_0[BLOCK_BYTES] = { + 0x0f, 0x1e, 0x2d, 0x3c, 0x4b, 0x5a, 0x69, 0x78, 0x87, 0x96, 0xa5, 0xb4, 0xc3, 0xd2, 0xe1, 0xf0 + }; + uint8_t SHARES_1[BLOCK_BYTES] = { + 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f + }; + + memcpy(X, SHARES_0, BLOCK_BYTES); + memcpy(Y, SHARES_1, BLOCK_BYTES); + for (uint8_t i=0; i> 4; + x_lo = TMP_X[j] & 0xf; + y_hi = TMP_Y[j] >> 4; + y_lo = TMP_Y[j] & 0xf; + z_hi = Z[j] >> 4; + z_lo = Z[j] & 0xf; + // First 4-bit S-box + tmp0 = G[(y_lo&7)>>1][z_lo]; + tmp1 = G[(z_lo&7)>>1][x_lo]; + tmp2 = G[(x_lo&7)>>1][y_lo]; + x_hi ^= F[tmp1][tmp2]; + y_hi ^= F[tmp2][tmp0]; + z_hi ^= F[tmp0][tmp1]; + // Second 4-bit S-box + tmp0 = P[Q[y_hi&3 ^ (y_hi&8)>>1][z_hi]]; + tmp1 = P[Q[z_hi&3 ^ (z_hi&8)>>1][x_hi]]; + tmp2 = P[Q[x_hi&3 ^ (x_hi&8)>>1][y_hi]]; + x_lo ^= Q[tmp1&3 ^ (tmp1&8)>>1][tmp2]; + y_lo ^= Q[tmp2&3 ^ (tmp2&8)>>1][tmp0]; + z_lo ^= Q[tmp0&3 ^ (tmp0&8)>>1][tmp1]; + // Third 4-bit S-box + tmp0 = G[(y_lo&7)>>1][z_lo] ^ 1; + tmp1 = G[(z_lo&7)>>1][x_lo]; + tmp2 = G[(x_lo&7)>>1][y_lo]; + x_hi ^= F[tmp1][tmp2]; + y_hi ^= F[tmp2][tmp0]; + z_hi ^= F[tmp0][tmp1]; + // Build bytes from nibbles + TMP_X[j] = (x_hi << 4 | x_lo); + TMP_Y[j] = (y_hi << 4 | y_lo); + TMP_Z[j] = (z_hi << 4 | z_lo); + } + + for (size_t j=0; j<8; j++) + { + size_t dest_j = 15-j; + X[dest_j] ^= TMP_X[j]; + Y[dest_j] ^= TMP_Y[j]; + Z[dest_j] ^= TMP_Z[j]; + } +} + +static void _linear_layer(uint8_t X[BLOCK_BYTES]) +{ + X[15] ^= X[1]; + X[15] ^= X[2]; + X[15] ^= X[3]; + X[15] ^= X[4]; + X[15] ^= X[5]; + X[15] ^= X[6]; + X[15] ^= X[7]; + + X[14] ^= X[7]; + X[13] ^= X[7]; + X[12] ^= X[7]; + X[11] ^= X[7]; + X[10] ^= X[7]; + X[9] ^= X[7]; +} + +static void _permutation_layer(uint8_t X[BLOCK_BYTES], permutation p) +{ + if (p == PERMUTATION_NONE) + { + return; + } + + uint8_t X_old[BLOCK_BYTES]; + memcpy(X_old, X, BLOCK_BYTES); + + const uint8_t *pi = PERMUTATIONS[p]; + + for (size_t j=0; j -#include - -#include "constants.h" -#include "tweakey.h" - - -#define LANE_BITS 64 -#define LANE_BYTES (LANE_BITS/8) -#define LANES_NB (TWEAKEY_BYTES/LANE_BYTES) - - -void tweakey_state_init( - uint8_t TK_X[TWEAKEY_BYTES], - uint8_t TK_Y[KEY_BYTES], - const uint8_t key[KEY_BYTES], - const uint8_t tweak[TWEAK_BYTES] -) -{ - // To be replaced by real random numbers!!! - uint8_t SHARES_0[KEY_BYTES] = { - 0x0f, 0x1e, 0x2d, 0x3c, 0x4b, 0x5a, 0x69, 0x78, 0x87, 0x96, 0xa5, 0xb4, 0xc3, 0xd2, 0xe1, 0xf0 - }; - - memcpy(TK_Y, SHARES_0, KEY_BYTES); - memcpy(TK_X, tweak, TWEAK_BYTES); - - for (size_t i=0; i>3 ^ x[3]; - y[3] = x[2]; - y[2] = x[6]<<2 ^ x[1]; - y[1] = x[0]; - y[0] = x[7]; -} - -static void _multiply_M2(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) -{ - uint8_t x_M_5 = x[5]<<3 ^ x[4]; - uint8_t x_M_4 = x[4]>>3 ^ x[3]; - - y[7] = x[5]; - y[6] = x_M_5; - y[5] = x_M_5<<3 ^ x_M_4; - y[4] = x_M_4>>3 ^ x[2]; - y[3] = x[6]<<2 ^ x[1]; - y[2] = x[5]<<2 ^ x[0]; - y[1] = x[7]; - y[0] = x[6]; -} - -static void _multiply_M3(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) -{ - uint8_t x_M_5 = x[5]<<3 ^ x[4]; - uint8_t x_M_4 = x[4]>>3 ^ x[3]; - uint8_t x_M2_5 = x_M_5<<3 ^ x_M_4; - uint8_t x_M2_4 = x_M_4>>3 ^ x[2]; - - y[7] = x_M_5; - y[6] = x_M2_5; - y[5] = x_M2_5<<3 ^ x_M2_4; - y[4] = x_M2_4>>3 ^ x[6]<<2 ^ x[1]; - y[3] = x[5]<<2 ^ x[0]; - y[2] = x_M_5<<2 ^ x[7]; - y[1] = x[6]; - y[0] = x[5]; -} - -static void _multiply_MR(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) -{ - y[0] = x[1]; - y[1] = x[2]; - y[2] = x[3] ^ x[4]>>3; - y[3] = x[4]; - y[4] = x[5] ^ x[6]<<3; - y[5] = x[3]<<2 ^ x[6]; - y[6] = x[7]; - y[7] = x[0]; -} - -static void _multiply_MR2(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) -{ - uint8_t x_MR_4 = x[5] ^ x[6]<<3; - - y[0] = x[2]; - y[1] = x[3] ^ x[4]>>3; - y[2] = x[4] ^ x_MR_4>>3; - y[3] = x_MR_4; - y[4] = x[3]<<2 ^ x[6] ^ x[7]<<3; - y[5] = x[4]<<2 ^ x[7]; - y[6] = x[0]; - y[7] = x[1]; -} - -static void _multiply_MR3(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) -{ - uint8_t x_MR_4 = x[5] ^ x[6]<<3; - uint8_t x_MR2_4 = x[3]<<2 ^ x[6] ^ x[7]<<3; - - y[0] = x[3] ^ x[4]>>3; - y[1] = x[4] ^ x_MR_4>>3; - y[2] = x_MR_4 ^ x_MR2_4>>3; - y[3] = x_MR2_4; - y[4] = x[0]<<3 ^ x[4]<<2 ^ x[7]; - y[5] = x_MR_4<<2 ^ x[0]; - y[6] = x[1]; - y[7] = x[2]; -} - -typedef void (*matrix_multiplication)(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]); - -static const matrix_multiplication ALPHAS[6] = { - _multiply_M, - _multiply_M2, - _multiply_M3, - _multiply_MR, - _multiply_MR2, - _multiply_MR3 -}; - - -void tweakey_state_update(uint8_t TK_X[TWEAKEY_BYTES], uint8_t TK_Y[KEY_BYTES]) -{ - /* Skip lane 0, as it is multiplied by the identity matrix. */ - - for (size_t j=1; j<(TWEAK_BYTES/LANE_BYTES); j++) - { - uint8_t *TKj_X = TK_X + j*LANE_BYTES; - - uint8_t TKj_old_X[LANE_BYTES]; - memcpy(TKj_old_X, TKj_X, LANE_BYTES); - - ALPHAS[j-1](TKj_old_X, TKj_X); - } - - for (size_t j=0; j<(KEY_BYTES/LANE_BYTES); j++) - { - uint8_t *TKj_X = TK_X + (j + (TWEAK_BYTES/LANE_BYTES))*LANE_BYTES; - uint8_t *TKj_Y = TK_Y + j*LANE_BYTES; - - uint8_t TKj_X_old[LANE_BYTES]; - uint8_t TKj_Y_old[LANE_BYTES]; - memcpy(TKj_X_old, TKj_X, LANE_BYTES); - memcpy(TKj_Y_old, TKj_Y, LANE_BYTES); - - ALPHAS[j-1 + (TWEAK_BYTES/LANE_BYTES)](TKj_X_old, TKj_X); - ALPHAS[j-1 + (TWEAK_BYTES/LANE_BYTES)](TKj_Y_old, TKj_Y); - } -} +/* +Implementation of the Lilliput-AE tweakable block cipher. + +Authors: + Alexandre Adomnicai, + Kévin Le Gouguec, + Léo Reynaud, + 2019. + +For more information, feedback or questions, refer to our website: +https://paclido.fr/lilliput-ae + +To the extent possible under law, the implementer has waived all copyright +and related or neighboring rights to the source code in this file. +http://creativecommons.org/publicdomain/zero/1.0/ + +--- + +This file provides a first-order threshold implementation of Lilliput-TBC's +tweakey schedule, where the tweak and the key are split into two shares. +*/ + +#include +#include + +#include "constants.h" +#include "tweakey.h" + + +#define LANE_BITS 64 +#define LANE_BYTES (LANE_BITS/8) +#define LANES_NB (TWEAKEY_BYTES/LANE_BYTES) + + +void tweakey_state_init( + uint8_t TK_X[TWEAKEY_BYTES], + uint8_t TK_Y[KEY_BYTES], + const uint8_t key[KEY_BYTES], + const uint8_t tweak[TWEAK_BYTES] +) +{ + // To be replaced by real random numbers!!! + uint8_t SHARES_0[KEY_BYTES] = { + 0x0f, 0x1e, 0x2d, 0x3c, 0x4b, 0x5a, 0x69, 0x78, 0x87, 0x96, 0xa5, 0xb4, 0xc3, 0xd2, 0xe1, 0xf0 + }; + + memcpy(TK_Y, SHARES_0, KEY_BYTES); + memcpy(TK_X, tweak, TWEAK_BYTES); + + for (size_t i=0; i>3 ^ x[3]; + y[3] = x[2]; + y[2] = x[6]<<2 ^ x[1]; + y[1] = x[0]; + y[0] = x[7]; +} + +static void _multiply_M2(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) +{ + uint8_t x_M_5 = x[5]<<3 ^ x[4]; + uint8_t x_M_4 = x[4]>>3 ^ x[3]; + + y[7] = x[5]; + y[6] = x_M_5; + y[5] = x_M_5<<3 ^ x_M_4; + y[4] = x_M_4>>3 ^ x[2]; + y[3] = x[6]<<2 ^ x[1]; + y[2] = x[5]<<2 ^ x[0]; + y[1] = x[7]; + y[0] = x[6]; +} + +static void _multiply_M3(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) +{ + uint8_t x_M_5 = x[5]<<3 ^ x[4]; + uint8_t x_M_4 = x[4]>>3 ^ x[3]; + uint8_t x_M2_5 = x_M_5<<3 ^ x_M_4; + uint8_t x_M2_4 = x_M_4>>3 ^ x[2]; + + y[7] = x_M_5; + y[6] = x_M2_5; + y[5] = x_M2_5<<3 ^ x_M2_4; + y[4] = x_M2_4>>3 ^ x[6]<<2 ^ x[1]; + y[3] = x[5]<<2 ^ x[0]; + y[2] = x_M_5<<2 ^ x[7]; + y[1] = x[6]; + y[0] = x[5]; +} + +static void _multiply_MR(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) +{ + y[0] = x[1]; + y[1] = x[2]; + y[2] = x[3] ^ x[4]>>3; + y[3] = x[4]; + y[4] = x[5] ^ x[6]<<3; + y[5] = x[3]<<2 ^ x[6]; + y[6] = x[7]; + y[7] = x[0]; +} + +static void _multiply_MR2(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) +{ + uint8_t x_MR_4 = x[5] ^ x[6]<<3; + + y[0] = x[2]; + y[1] = x[3] ^ x[4]>>3; + y[2] = x[4] ^ x_MR_4>>3; + y[3] = x_MR_4; + y[4] = x[3]<<2 ^ x[6] ^ x[7]<<3; + y[5] = x[4]<<2 ^ x[7]; + y[6] = x[0]; + y[7] = x[1]; +} + +static void _multiply_MR3(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]) +{ + uint8_t x_MR_4 = x[5] ^ x[6]<<3; + uint8_t x_MR2_4 = x[3]<<2 ^ x[6] ^ x[7]<<3; + + y[0] = x[3] ^ x[4]>>3; + y[1] = x[4] ^ x_MR_4>>3; + y[2] = x_MR_4 ^ x_MR2_4>>3; + y[3] = x_MR2_4; + y[4] = x[0]<<3 ^ x[4]<<2 ^ x[7]; + y[5] = x_MR_4<<2 ^ x[0]; + y[6] = x[1]; + y[7] = x[2]; +} + +typedef void (*matrix_multiplication)(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]); + +static const matrix_multiplication ALPHAS[6] = { + _multiply_M, + _multiply_M2, + _multiply_M3, + _multiply_MR, + _multiply_MR2, + _multiply_MR3 +}; + + +void tweakey_state_update(uint8_t TK_X[TWEAKEY_BYTES], uint8_t TK_Y[KEY_BYTES]) +{ + /* Skip lane 0, as it is multiplied by the identity matrix. */ + + for (size_t j=1; j<(TWEAK_BYTES/LANE_BYTES); j++) + { + uint8_t *TKj_X = TK_X + j*LANE_BYTES; + + uint8_t TKj_old_X[LANE_BYTES]; + memcpy(TKj_old_X, TKj_X, LANE_BYTES); + + ALPHAS[j-1](TKj_old_X, TKj_X); + } + + for (size_t j=0; j<(KEY_BYTES/LANE_BYTES); j++) + { + uint8_t *TKj_X = TK_X + (j + (TWEAK_BYTES/LANE_BYTES))*LANE_BYTES; + uint8_t *TKj_Y = TK_Y + j*LANE_BYTES; + + uint8_t TKj_X_old[LANE_BYTES]; + uint8_t TKj_Y_old[LANE_BYTES]; + memcpy(TKj_X_old, TKj_X, LANE_BYTES); + memcpy(TKj_Y_old, TKj_Y, LANE_BYTES); + + ALPHAS[j-1 + (TWEAK_BYTES/LANE_BYTES)](TKj_X_old, TKj_X); + ALPHAS[j-1 + (TWEAK_BYTES/LANE_BYTES)](TKj_Y_old, TKj_Y); + } +} diff --git a/src/add_threshold/tweakey.h b/src/add_threshold/tweakey.h index 6b5f52a..ad2262b 100644 --- a/src/add_threshold/tweakey.h +++ b/src/add_threshold/tweakey.h @@ -1,49 +1,49 @@ -/* -Implementation of the Lilliput-AE tweakable block cipher. - -Authors: - Alexandre Adomnicai, - Kévin Le Gouguec, - Léo Reynaud, - 2019. - -For more information, feedback or questions, refer to our website: -https://paclido.fr/lilliput-ae - -To the extent possible under law, the implementer has waived all copyright -and related or neighboring rights to the source code in this file. -http://creativecommons.org/publicdomain/zero/1.0/ - ---- - -This file provides the interface for the first-order threshold implementation -of Lilliput-TBC's tweakey schedule. -*/ - -#ifndef TWEAKEY_H -#define TWEAKEY_H - -#include - -#include "constants.h" - - -void tweakey_state_init( - uint8_t TK_X[TWEAKEY_BYTES], - uint8_t TK_Y[TWEAKEY_BYTES], - const uint8_t key[KEY_BYTES], - const uint8_t tweak[TWEAK_BYTES] -); - -void tweakey_state_extract( - const uint8_t TK_X[TWEAKEY_BYTES], - const uint8_t TK_Y[KEY_BYTES], - uint8_t round_constant, - uint8_t round_tweakey_X[ROUND_TWEAKEY_BYTES], - uint8_t round_tweakey_Y[ROUND_TWEAKEY_BYTES] -); - -void tweakey_state_update(uint8_t TK_X[TWEAKEY_BYTES], uint8_t TK_Y[KEY_BYTES]); - - -#endif /* TWEAKEY_H */ +/* +Implementation of the Lilliput-AE tweakable block cipher. + +Authors: + Alexandre Adomnicai, + Kévin Le Gouguec, + Léo Reynaud, + 2019. + +For more information, feedback or questions, refer to our website: +https://paclido.fr/lilliput-ae + +To the extent possible under law, the implementer has waived all copyright +and related or neighboring rights to the source code in this file. +http://creativecommons.org/publicdomain/zero/1.0/ + +--- + +This file provides the interface for the first-order threshold implementation +of Lilliput-TBC's tweakey schedule. +*/ + +#ifndef TWEAKEY_H +#define TWEAKEY_H + +#include + +#include "constants.h" + + +void tweakey_state_init( + uint8_t TK_X[TWEAKEY_BYTES], + uint8_t TK_Y[TWEAKEY_BYTES], + const uint8_t key[KEY_BYTES], + const uint8_t tweak[TWEAK_BYTES] +); + +void tweakey_state_extract( + const uint8_t TK_X[TWEAKEY_BYTES], + const uint8_t TK_Y[KEY_BYTES], + uint8_t round_constant, + uint8_t round_tweakey_X[ROUND_TWEAKEY_BYTES], + uint8_t round_tweakey_Y[ROUND_TWEAKEY_BYTES] +); + +void tweakey_state_update(uint8_t TK_X[TWEAKEY_BYTES], uint8_t TK_Y[KEY_BYTES]); + + +#endif /* TWEAKEY_H */ -- cgit v1.2.3 From f1bf4826bb5307a2677d44af6f8079b6cf0b3224 Mon Sep 17 00:00:00 2001 From: Kévin Le Gouguec Date: Tue, 12 Mar 2019 14:34:03 +0100 Subject: Ajustements mineurs sur l'implémentation à seuil MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - retrait de stdio.h (inutile) - "aération" du prototype de _state_init --- src/add_threshold/cipher.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/add_threshold/cipher.c b/src/add_threshold/cipher.c index ad8b4d3..87267fc 100644 --- a/src/add_threshold/cipher.c +++ b/src/add_threshold/cipher.c @@ -22,7 +22,6 @@ where the input block is split into three shares. #include #include -#include #include "cipher.h" #include "constants.h" @@ -84,7 +83,12 @@ static const uint8_t P[16] = { 0x0, 0x2, 0x8, 0xa, 0x4, 0X6, 0xc, 0xe, 0x1, 0x3, 0x9, 0xb, 0x5, 0x7, 0xd, 0xf }; -static void _state_init(uint8_t X[BLOCK_BYTES], uint8_t Y[BLOCK_BYTES], uint8_t Z[BLOCK_BYTES], const uint8_t message[BLOCK_BYTES]) +static void _state_init( + uint8_t X[BLOCK_BYTES], + uint8_t Y[BLOCK_BYTES], + uint8_t Z[BLOCK_BYTES], + const uint8_t message[BLOCK_BYTES] +) { // To be replaced by real random numbers!!! uint8_t SHARES_0[BLOCK_BYTES] = { -- cgit v1.2.3 From f24a5cdcf0eec552f2d2edc73a7df156784ed7c0 Mon Sep 17 00:00:00 2001 From: Kévin Le Gouguec Date: Tue, 12 Mar 2019 15:33:15 +0100 Subject: Utilisation d'un générateur d'aléa pour l'implémentation à seuil MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Un peu de machinerie à mettre en place pour permettre l'ajout de fichiers arbitraires dans une implémentation. --- nist/make-package.sh | 38 +++++++++++++++++++++------------- src/add_threshold/cipher.c | 12 +++++------ src/add_threshold/implem.mk | 42 ++++++++++++++++++++++++++++++++++++++ src/add_threshold/random.c | 34 +++++++++++++++++++++++++++++++ src/add_threshold/random.h | 28 ++++++++++++++++++++++++++ src/add_threshold/tweakey.c | 13 ++++++------ src/add_tweakeyloop/implem.mk | 1 + src/ref/implem.mk | 35 ++++++++++++++++++++++++++++++++ test/check-implementation.sh | 28 +++++++++++++++++++------- test/common.mk | 47 ++++--------------------------------------- 10 files changed, 200 insertions(+), 78 deletions(-) create mode 100644 src/add_threshold/implem.mk create mode 100644 src/add_threshold/random.c create mode 100644 src/add_threshold/random.h create mode 120000 src/add_tweakeyloop/implem.mk create mode 100644 src/ref/implem.mk diff --git a/nist/make-package.sh b/nist/make-package.sh index abd3b50..124da4b 100755 --- a/nist/make-package.sh +++ b/nist/make-package.sh @@ -1,6 +1,7 @@ #!/bin/bash set -Eeu +shopt -s extglob # Generate NIST's expected tree: # @@ -34,6 +35,25 @@ cleanup () trap cleanup ERR +list-implementation-files () +{ + local mode=$1 + local key_length=$2 + local implem=$3 + + # src/${implem} can contain arbitrary files; we need to copy + # everything save for the unused AE mode. + + local f + for f in ${ROOT}/src/${implem}/!(lilliput-i|lilliput-ii).[ch] + do + echo ${f} + done + + echo ${ROOT}/src/${implem}/lilliput-${mode}.c + echo ${ROOT}/src/${mode}-${key_length}/parameters.h +} + add-variant () { mode=$1 @@ -43,14 +63,6 @@ add-variant () mkdir -p ${dest} - source_files=( - cipher.{c,h} - constants.h - lilliput-ae{.h,-utils.h} - lilliput-${mode}.c - tweakey.{c,h} - ) - implementations=( ref add_threshold @@ -60,13 +72,11 @@ add-variant () for implem in ${implementations[@]} do mkdir ${dest}/${implem} - cp ${ROOT}/src/${mode}-${key_length}/parameters.h ${dest}/${implem} - cp ${NIST_DIR}/{api.h,encrypt.c} ${dest}/${implem} - for f in ${source_files[@]} - do - cp ${ROOT}/src/${implem}/${f} ${dest}/${implem} - done + list-implementation-files ${mode} ${key_length} ${implem} | + xargs cp -t ${dest}/${implem} + + cp ${NIST_DIR}/{api.h,encrypt.c} ${dest}/${implem} done } diff --git a/src/add_threshold/cipher.c b/src/add_threshold/cipher.c index 87267fc..230582d 100644 --- a/src/add_threshold/cipher.c +++ b/src/add_threshold/cipher.c @@ -25,6 +25,7 @@ where the input block is split into three shares. #include "cipher.h" #include "constants.h" +#include "random.h" #include "tweakey.h" @@ -90,13 +91,10 @@ static void _state_init( const uint8_t message[BLOCK_BYTES] ) { - // To be replaced by real random numbers!!! - uint8_t SHARES_0[BLOCK_BYTES] = { - 0x0f, 0x1e, 0x2d, 0x3c, 0x4b, 0x5a, 0x69, 0x78, 0x87, 0x96, 0xa5, 0xb4, 0xc3, 0xd2, 0xe1, 0xf0 - }; - uint8_t SHARES_1[BLOCK_BYTES] = { - 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f - }; + uint8_t SHARES_0[BLOCK_BYTES]; + uint8_t SHARES_1[BLOCK_BYTES]; + randombytes(sizeof(SHARES_0), SHARES_0); + randombytes(sizeof(SHARES_1), SHARES_1); memcpy(X, SHARES_0, BLOCK_BYTES); memcpy(Y, SHARES_1, BLOCK_BYTES); diff --git a/src/add_threshold/implem.mk b/src/add_threshold/implem.mk new file mode 100644 index 0000000..2925287 --- /dev/null +++ b/src/add_threshold/implem.mk @@ -0,0 +1,42 @@ +# This file sets some implementation-specific variables and defines +# build dependencies. + +# Filter out tests on tweakey schedule, as the thresholded API differs. +tests = $(filter-out test-tweakey,$(basename $(wildcard test-*.c))) + +# Filter out traces on tweakable block cipher, as intermediate steps +# differ significantly. +traces = $(filter-out traces-tbc,$(basename $(wildcard traces-*.c))) + +# Don't trigger warnings for "a&b ^ c". +CFLAGS += -Wno-parentheses + + +# Build dependencies: add random module; remove unused tests/traces. + +# Program => additional objects dependencies + +$(results_dir)/test-tbc-decrypt $(results_dir)/test-tbc-encrypt: \ +$(results_dir)/src/cipher.o $(results_dir)/src/tweakey.o $(results_dir)/src/random.o + +$(results_dir)/test-ae-decrypt $(results_dir)/test-ae-encrypt $(results_dir)/test-ae-roundtrip $(results_dir)/traces-ae: \ +$(results_dir)/src/lilliput-$(mode).o $(results_dir)/src/cipher.o \ +$(results_dir)/src/tweakey.o $(results_dir)/src/random.o + +# Object => headers dependencies + +$(results_dir)/$(src_dir)/cipher.o: $(src_dir)/cipher.h \ +$(src_dir)/tweakey.h $(src_dir)/random.h $(variant_dir)/parameters.h + +$(results_dir)/$(src_dir)/lilliput-i.o $(results_dir)/$(src_dir)/lilliput-ii.o: \ +$(src_dir)/lilliput-ae.h $(src_dir)/cipher.h $(src_dir)/constants.h \ +$(variant_dir)/parameters.h + +$(results_dir)/$(src_dir)/tweakey.o: $(src_dir)/tweakey.h \ +$(src_dir)/constants.h $(src_dir)/random.h $(variant_dir)/parameters.h + +$(results_dir)/test/test-tbc-encrypt.o $(results_dir)/test/test-tbc-decrypt.o $(results_dir)/test/traces-tbc.o: \ +$(src_dir)/cipher.h + +$(results_dir)/test/test-ae-encrypt.o $(results_dir)/test/test-ae-decrypt.o $(results_dir)/test/test-ae-roundtrip.o $(results_dir)/test/traces-ae.o: \ +$(src_dir)/lilliput-ae.h diff --git a/src/add_threshold/random.c b/src/add_threshold/random.c new file mode 100644 index 0000000..1bd9427 --- /dev/null +++ b/src/add_threshold/random.c @@ -0,0 +1,34 @@ +/* +Implementation of the Lilliput-AE tweakable block cipher. + +Author: Kévin Le Gouguec, 2019. + +For more information, feedback or questions, refer to our website: +https://paclido.fr/lilliput-ae + +To the extent possible under law, the implementer has waived all copyright +and related or neighboring rights to the source code in this file. +http://creativecommons.org/publicdomain/zero/1.0/ + +--- + +This file provides a system-specific function to generate random bytes. +*/ + +/* glibc < 2.25 does not provide getrandom(2): use the system call. */ + +#define _GNU_SOURCE + +#include +#include + +#include +#include + +#include "random.h" + + +void randombytes(size_t nb, uint8_t out[nb]) +{ + syscall(SYS_getrandom, out, nb, 0); +} diff --git a/src/add_threshold/random.h b/src/add_threshold/random.h new file mode 100644 index 0000000..12cae15 --- /dev/null +++ b/src/add_threshold/random.h @@ -0,0 +1,28 @@ +/* +Implementation of the Lilliput-AE tweakable block cipher. + +Author: Kévin Le Gouguec, 2019. + +For more information, feedback or questions, refer to our website: +https://paclido.fr/lilliput-ae + +To the extent possible under law, the implementer has waived all copyright +and related or neighboring rights to the source code in this file. +http://creativecommons.org/publicdomain/zero/1.0/ + +--- + +This file provides an interface to generate random bytes. +*/ + +#ifndef RANDOM_H +#define RANDOM_H + +#include +#include + + +void randombytes(size_t nb, uint8_t out[nb]); + + +#endif /* RANDOM_H */ diff --git a/src/add_threshold/tweakey.c b/src/add_threshold/tweakey.c index f80ea86..097a79a 100644 --- a/src/add_threshold/tweakey.c +++ b/src/add_threshold/tweakey.c @@ -24,6 +24,7 @@ tweakey schedule, where the tweak and the key are split into two shares. #include #include "constants.h" +#include "random.h" #include "tweakey.h" @@ -39,16 +40,14 @@ void tweakey_state_init( const uint8_t tweak[TWEAK_BYTES] ) { - // To be replaced by real random numbers!!! - uint8_t SHARES_0[KEY_BYTES] = { - 0x0f, 0x1e, 0x2d, 0x3c, 0x4b, 0x5a, 0x69, 0x78, 0x87, 0x96, 0xa5, 0xb4, 0xc3, 0xd2, 0xe1, 0xf0 - }; + uint8_t SHARES_0[KEY_BYTES]; + randombytes(sizeof(SHARES_0), SHARES_0); - memcpy(TK_Y, SHARES_0, KEY_BYTES); - memcpy(TK_X, tweak, TWEAK_BYTES); + memcpy(TK_Y, SHARES_0, KEY_BYTES); + memcpy(TK_X, tweak, TWEAK_BYTES); for (size_t i=0; i additional objects dependencies + +$(results_dir)/test-tbc-decrypt $(results_dir)/test-tbc-encrypt $(results_dir)/traces-tbc: \ +$(results_dir)/src/cipher.o $(results_dir)/src/tweakey.o + +$(results_dir)/test-ae-decrypt $(results_dir)/test-ae-encrypt $(results_dir)/test-ae-roundtrip $(results_dir)/traces-ae: \ +$(results_dir)/src/lilliput-$(mode).o $(results_dir)/src/cipher.o \ +$(results_dir)/src/tweakey.o + +$(results_dir)/test-tweakey: $(results_dir)/src/tweakey.o + +# Object => headers dependencies + +$(results_dir)/$(src_dir)/cipher.o: $(src_dir)/cipher.h \ +$(src_dir)/tweakey.h $(variant_dir)/parameters.h + +$(results_dir)/$(src_dir)/lilliput-i.o $(results_dir)/$(src_dir)/lilliput-ii.o: \ +$(src_dir)/lilliput-ae.h $(src_dir)/cipher.h $(src_dir)/constants.h \ +$(variant_dir)/parameters.h + +$(results_dir)/$(src_dir)/tweakey.o: $(src_dir)/tweakey.h \ +$(src_dir)/constants.h $(variant_dir)/parameters.h + +$(results_dir)/test/test-tbc-encrypt.o $(results_dir)/test/test-tbc-decrypt.o $(results_dir)/test/traces-tbc.o: \ +$(src_dir)/cipher.h + +$(results_dir)/test/test-ae-encrypt.o $(results_dir)/test/test-ae-decrypt.o $(results_dir)/test/test-ae-roundtrip.o $(results_dir)/test/traces-ae.o: \ +$(src_dir)/lilliput-ae.h diff --git a/test/check-implementation.sh b/test/check-implementation.sh index 0750d1b..5f46606 100755 --- a/test/check-implementation.sh +++ b/test/check-implementation.sh @@ -1,6 +1,7 @@ #!/bin/bash set -eu +shopt -s extglob # Run NIST's genkat_aead.c against the reference implementation as # well as another one, and compare vectors. @@ -11,6 +12,24 @@ ROOT_DIR=${TEST_DIR}/.. implem=$1 +list-implementation-files () +{ + local mode=$1 + local key_length=$2 + local src_dir=${ROOT_DIR}/src + + # src/${implem} can contain arbitrary files; we need to copy + # everything save for the unused AE mode. + + for f in ${src_dir}/${implem}/!(lilliput-i|lilliput-ii).[ch] + do + echo ${f} + done + + echo ${src_dir}/${implem}/lilliput-${mode}.c + echo ${src_dir}/${mode}-${key_length}/parameters.h +} + run-genkat () { local tmp_dir=$1 @@ -32,15 +51,10 @@ run-genkat () tweakey.{c,h} ) - mkdir -p ${genkat_dir} # "-p" to allow comparing ref against ref. + mkdir -p ${genkat_dir} # "-p" allows comparing ref against ref. - local f - for f in ${source_files[@]} - do - cp ${src_dir}/${implem}/${f} ${genkat_dir} - done + list-implementation-files ${mode} ${keylen} | xargs cp -t ${genkat_dir} - cp ${src_dir}/${mode}-${keylen}/parameters.h ${genkat_dir} cp ${ROOT_DIR}/nist/{api.h,encrypt.c} ${genkat_dir} cp ${ROOT_DIR}/nist/TestVectorGen/* ${genkat_dir} diff --git a/test/common.mk b/test/common.mk index c978c2d..31e84b0 100644 --- a/test/common.mk +++ b/test/common.mk @@ -10,19 +10,7 @@ endif # Use "make IMPLEMENTATION=..." to compile against other versions. IMPLEMENTATION = ref - -ifeq "$(IMPLEMENTATION)" "add_threshold" -# Filter out tests on tweakey schedule, as the thresholded API differs. -tests = $(filter-out test-tweakey,$(basename $(wildcard test-*.c))) -# Don't trigger warnings for "a&b ^ c". -CFLAGS += -Wno-parentheses -else -tests = $(basename $(wildcard test-*.c)) -endif - -traces = $(basename $(wildcard traces-*.c)) - -test_dir = $(dir $(lastword $(MAKEFILE_LIST))) +test_dir := $(dir $(lastword $(MAKEFILE_LIST))) root_dir = $(test_dir).. results_dir = $(root_dir)/results/$(mode)-$(keylen) src_dir = $(root_dir)/src/$(IMPLEMENTATION) @@ -34,6 +22,9 @@ CFLAGS += -I$(src_dir) -I$(variant_dir) -I$(test_dir) $(nist_flags) -Werror LDFLAGS += $(nist_flags) +include $(src_dir)/implem.mk + + .PHONY: clean test $(tests) traces $(traces) @@ -71,35 +62,5 @@ $(results_dir)/src/%.o: $(src_dir)/%.c | $(results_dir)/src $(Q) gcc -c $< $(CFLAGS) -o $@ -# Program => additional objects dependencies - -$(results_dir)/test-tbc-decrypt $(results_dir)/test-tbc-encrypt $(results_dir)/traces-tbc: \ -$(results_dir)/src/cipher.o $(results_dir)/src/tweakey.o - -$(results_dir)/test-ae-decrypt $(results_dir)/test-ae-encrypt $(results_dir)/test-ae-roundtrip $(results_dir)/traces-ae: \ -$(results_dir)/src/lilliput-$(mode).o $(results_dir)/src/cipher.o \ -$(results_dir)/src/tweakey.o - -$(results_dir)/test-tweakey: $(results_dir)/src/tweakey.o - -# Object => headers dependencies - -$(results_dir)/$(src_dir)/cipher.o: $(src_dir)/cipher.h \ -$(src_dir)/tweakey.h $(variant_dir)/parameters.h - -$(results_dir)/$(src_dir)/lilliput-i.o $(results_dir)/$(src_dir)/lilliput-ii.o: \ -$(src_dir)/lilliput-ae.h $(src_dir)/cipher.h $(src_dir)/constants.h \ -$(variant_dir)/parameters.h - -$(results_dir)/$(src_dir)/tweakey.o: $(src_dir)/tweakey.h \ -$(src_dir)/constants.h $(variant_dir)/parameters.h - -$(results_dir)/test/test-tbc-encrypt.o $(results_dir)/test/test-tbc-decrypt.o $(results_dir)/test/traces-tbc.o: \ -$(src_dir)/cipher.h - -$(results_dir)/test/test-ae-encrypt.o $(results_dir)/test/test-ae-decrypt.o $(results_dir)/test/test-ae-roundtrip.o $(results_dir)/test/traces-ae.o: \ -$(src_dir)/lilliput-ae.h - - # TODO: add valgrind, although it does not seem to play well with ASAN # TODO: use gcc -M... to generate .o -> .h dependencies -- cgit v1.2.3 From 590327c8d81e42079c1fb215512ff5f306d33ab0 Mon Sep 17 00:00:00 2001 From: Kévin Le Gouguec Date: Tue, 12 Mar 2019 15:46:48 +0100 Subject: Homogénéisation de la déclaration des auteurs des implémentations MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ça m'embêtait qu'on liste plusieurs personnes, puis qu'on dise "the implementer has…" ; repompé le "hereby denoted…" de Keccak. --- src/add_threshold/cipher.c | 2 +- src/add_threshold/random.c | 4 +++- src/add_threshold/random.h | 4 +++- src/add_threshold/tweakey.c | 2 +- src/add_threshold/tweakey.h | 2 +- src/add_tweakeyloop/tweakey.c | 4 +++- src/i-128/parameters.h | 4 +++- src/i-192/parameters.h | 4 +++- src/i-256/parameters.h | 4 +++- src/ii-128/parameters.h | 4 +++- src/ii-192/parameters.h | 4 +++- src/ii-256/parameters.h | 4 +++- src/ref/cipher.c | 4 +++- src/ref/cipher.h | 4 +++- src/ref/constants.h | 4 +++- src/ref/lilliput-ae-utils.h | 4 +++- src/ref/lilliput-ae.h | 4 +++- src/ref/lilliput-i.c | 4 +++- src/ref/lilliput-ii.c | 4 +++- src/ref/tweakey.c | 4 +++- src/ref/tweakey.h | 4 +++- 21 files changed, 57 insertions(+), 21 deletions(-) diff --git a/src/add_threshold/cipher.c b/src/add_threshold/cipher.c index 230582d..7efd4ae 100644 --- a/src/add_threshold/cipher.c +++ b/src/add_threshold/cipher.c @@ -1,7 +1,7 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Authors: +Authors, hereby denoted as "the implementer": Alexandre Adomnicai, Kévin Le Gouguec, Léo Reynaud, diff --git a/src/add_threshold/random.c b/src/add_threshold/random.c index 1bd9427..a966a8e 100644 --- a/src/add_threshold/random.c +++ b/src/add_threshold/random.c @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/add_threshold/random.h b/src/add_threshold/random.h index 12cae15..32ff4df 100644 --- a/src/add_threshold/random.h +++ b/src/add_threshold/random.h @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/add_threshold/tweakey.c b/src/add_threshold/tweakey.c index 097a79a..e228a69 100644 --- a/src/add_threshold/tweakey.c +++ b/src/add_threshold/tweakey.c @@ -1,7 +1,7 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Authors: +Authors, hereby denoted as "the implementer": Alexandre Adomnicai, Kévin Le Gouguec, Léo Reynaud, diff --git a/src/add_threshold/tweakey.h b/src/add_threshold/tweakey.h index ad2262b..f9ca722 100644 --- a/src/add_threshold/tweakey.h +++ b/src/add_threshold/tweakey.h @@ -1,7 +1,7 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Authors: +Authors, hereby denoted as "the implementer": Alexandre Adomnicai, Kévin Le Gouguec, Léo Reynaud, diff --git a/src/add_tweakeyloop/tweakey.c b/src/add_tweakeyloop/tweakey.c index b1f349e..3360a70 100644 --- a/src/add_tweakeyloop/tweakey.c +++ b/src/add_tweakeyloop/tweakey.c @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/i-128/parameters.h b/src/i-128/parameters.h index b4c2f02..11ef889 100644 --- a/src/i-128/parameters.h +++ b/src/i-128/parameters.h @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/i-192/parameters.h b/src/i-192/parameters.h index aa1ea31..18d9e34 100644 --- a/src/i-192/parameters.h +++ b/src/i-192/parameters.h @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/i-256/parameters.h b/src/i-256/parameters.h index 5a9c029..4d23eae 100644 --- a/src/i-256/parameters.h +++ b/src/i-256/parameters.h @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/ii-128/parameters.h b/src/ii-128/parameters.h index aa73123..8e8dbc0 100644 --- a/src/ii-128/parameters.h +++ b/src/ii-128/parameters.h @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/ii-192/parameters.h b/src/ii-192/parameters.h index 531d56d..d5c6f89 100644 --- a/src/ii-192/parameters.h +++ b/src/ii-192/parameters.h @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/ii-256/parameters.h b/src/ii-256/parameters.h index 77d2f99..b6e1d34 100644 --- a/src/ii-256/parameters.h +++ b/src/ii-256/parameters.h @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/ref/cipher.c b/src/ref/cipher.c index 48144d4..5f26cc9 100644 --- a/src/ref/cipher.c +++ b/src/ref/cipher.c @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/ref/cipher.h b/src/ref/cipher.h index 8e4bd16..b84820d 100644 --- a/src/ref/cipher.h +++ b/src/ref/cipher.h @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/ref/constants.h b/src/ref/constants.h index 6f17b40..6812fd8 100644 --- a/src/ref/constants.h +++ b/src/ref/constants.h @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/ref/lilliput-ae-utils.h b/src/ref/lilliput-ae-utils.h index d78d9ff..41acaf6 100644 --- a/src/ref/lilliput-ae-utils.h +++ b/src/ref/lilliput-ae-utils.h @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/ref/lilliput-ae.h b/src/ref/lilliput-ae.h index 48721fe..acb24d2 100644 --- a/src/ref/lilliput-ae.h +++ b/src/ref/lilliput-ae.h @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/ref/lilliput-i.c b/src/ref/lilliput-i.c index 5e91e4e..74248a9 100644 --- a/src/ref/lilliput-i.c +++ b/src/ref/lilliput-i.c @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/ref/lilliput-ii.c b/src/ref/lilliput-ii.c index 7c02bce..a371521 100644 --- a/src/ref/lilliput-ii.c +++ b/src/ref/lilliput-ii.c @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/ref/tweakey.c b/src/ref/tweakey.c index dd1a855..78c6060 100644 --- a/src/ref/tweakey.c +++ b/src/ref/tweakey.c @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae diff --git a/src/ref/tweakey.h b/src/ref/tweakey.h index e461b43..dcda357 100644 --- a/src/ref/tweakey.h +++ b/src/ref/tweakey.h @@ -1,7 +1,9 @@ /* Implementation of the Lilliput-AE tweakable block cipher. -Author: Kévin Le Gouguec, 2019. +Authors, hereby denoted as "the implementer": + Kévin Le Gouguec, + 2019. For more information, feedback or questions, refer to our website: https://paclido.fr/lilliput-ae -- cgit v1.2.3