Skip to content

Commit

Permalink
Fix major cockup with short keys in CAST-128.
Browse files Browse the repository at this point in the history
  • Loading branch information
Ben Laurie committed Jan 17, 1999
1 parent fdd3b64 commit 649cdb7
Show file tree
Hide file tree
Showing 7 changed files with 249 additions and 219 deletions.
10 changes: 10 additions & 0 deletions CHANGES
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,16 @@

Changes between 0.9.1c and 0.9.2

*) CAST-128 was incorrectly implemented for short keys. The C version has
been fixed, but is untested. The assembler versions are also fixed, but
new assembler HAS NOT BEEN GENERATED FOR WIN32 - the Makefile needs fixing
to regenerate it if needed.
[Ben Laurie, reported (with fix for C version) by Jun-ichiro itojun
Hagino <itojun@kame.net>]

*) File was opened incorrectly in randfile.c.
[Ulf M�ller <ulf@fitug.de>]

*) Beginning of support for GeneralizedTime. d2i, i2d, check and print
functions. Also ASN1_TIME suite which is a CHOICE of UTCTime or
GeneralizedTime. ASN1_TIME is the proper type used in certificates et
Expand Down
2 changes: 1 addition & 1 deletion crypto/cast/Makefile.ssl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@ asm/cx86-out.o: asm/cx86unix.cpp
asm/cx86bsdi.o: asm/cx86unix.cpp
$(CPP) -DBSDI asm/cx86unix.cpp | sed 's/ :/:/' | as -o asm/cx86bsdi.o

asm/cx86unix.cpp:
asm/cx86unix.cpp: asm/cast-586.pl
(cd asm; perl cast-586.pl cpp >cx86unix.cpp)

files:
Expand Down
262 changes: 135 additions & 127 deletions crypto/cast/asm/cast-586.pl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -32,136 +32,144 @@

&asm_finish();

sub CAST_encrypt
{
local($name,$enc)=@_;
sub CAST_encrypt {
local($name,$enc)=@_;

local($win_ex)=<<"EOF";
local($win_ex)=<<"EOF";
EXTERN _CAST_S_table0:DWORD
EXTERN _CAST_S_table1:DWORD
EXTERN _CAST_S_table2:DWORD
EXTERN _CAST_S_table3:DWORD
EOF
&main'external_label(
"CAST_S_table0",
"CAST_S_table1",
"CAST_S_table2",
"CAST_S_table3",
);
&function_begin_B($name,$win_ex);
&comment("");
&push("ebp");
&push("ebx");
&mov($tmp2,&wparam(0));
&mov($K,&wparam(1));
&push("esi");
&push("edi");
&comment("Load the 2 words");
&mov($L,&DWP(0,$tmp2,"",0));
&mov($R,&DWP(4,$tmp2,"",0));
&xor( $tmp3, $tmp3);
# encrypting part
if ($enc)
{
&E_CAST( 0,$S,$L,$R,$K,@F1,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 1,$S,$R,$L,$K,@F2,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 2,$S,$L,$R,$K,@F3,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 3,$S,$R,$L,$K,@F1,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 4,$S,$L,$R,$K,@F2,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 5,$S,$R,$L,$K,@F3,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 6,$S,$L,$R,$K,@F1,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 7,$S,$R,$L,$K,@F2,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 8,$S,$L,$R,$K,@F3,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 9,$S,$R,$L,$K,@F1,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST(10,$S,$L,$R,$K,@F2,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST(11,$S,$R,$L,$K,@F3,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST(12,$S,$L,$R,$K,@F1,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST(13,$S,$R,$L,$K,@F2,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST(14,$S,$L,$R,$K,@F3,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST(15,$S,$R,$L,$K,@F1,$tmp1,$tmp2,$tmp3,$tmp4,1);
}
else
{
&E_CAST(15,$S,$L,$R,$K,@F1,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST(14,$S,$R,$L,$K,@F3,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST(13,$S,$L,$R,$K,@F2,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST(12,$S,$R,$L,$K,@F1,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST(11,$S,$L,$R,$K,@F3,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST(10,$S,$R,$L,$K,@F2,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 9,$S,$L,$R,$K,@F1,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 8,$S,$R,$L,$K,@F3,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 7,$S,$L,$R,$K,@F2,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 6,$S,$R,$L,$K,@F1,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 5,$S,$L,$R,$K,@F3,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 4,$S,$R,$L,$K,@F2,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 3,$S,$L,$R,$K,@F1,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 2,$S,$R,$L,$K,@F3,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 1,$S,$L,$R,$K,@F2,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 0,$S,$R,$L,$K,@F1,$tmp1,$tmp2,$tmp3,$tmp4,1);
}
&nop();
&mov(&DWP(4,$tmp3,"",0),$L);
&mov(&DWP(0,$tmp3,"",0),$R);
&function_end($name);
}
sub E_CAST
{
local($i,$S,$L,$R,$K,$OP1,$OP2,$OP3,$tmp1,$tmp2,$tmp3,$tmp4,$lst)=@_;
# Ri needs to have 16 pre added.
&comment("round $i");
&mov( $tmp4, &DWP($i*8,$K,"",1));
&mov( $tmp1, &DWP($i*8+4,$K,"",1));# must be word
&$OP1( $tmp4, $R);
&rotl( $tmp4, &LB($tmp1));
if ($ppro)
{
&mov( $tmp2, $tmp4); # B
&xor( $tmp1, $tmp1);
&movb( &LB($tmp1), &HB($tmp4)); # A
&and( $tmp2, 0xff);
&shr( $tmp4, 16); #
&xor( $tmp3, $tmp3);
}
else
{
&mov( $tmp2, $tmp4); # B
&movb( &LB($tmp1), &HB($tmp4)); # A # BAD BAD BAD
&shr( $tmp4, 16); #
&and( $tmp2, 0xff);
}
&movb( &LB($tmp3), &HB($tmp4)); # C # BAD BAD BAD
&and( $tmp4, 0xff); # D
&mov( $tmp1, &DWP($S1,"",$tmp1,4));
&mov( $tmp2, &DWP($S2,"",$tmp2,4));
&$OP2( $tmp1, $tmp2);
&mov( $tmp2, &DWP($S3,"",$tmp3,4));
&$OP3( $tmp1, $tmp2);
&mov( $tmp2, &DWP($S4,"",$tmp4,4));
&$OP1( $tmp1, $tmp2);
&mov($tmp3,&wparam(0)) if $lst;
# XXX
&xor( $L, $tmp1);
# XXX
}
&main::external_label(
"CAST_S_table0",
"CAST_S_table1",
"CAST_S_table2",
"CAST_S_table3",
);

&function_begin_B($name,$win_ex);

&comment("");

&push("ebp");
&push("ebx");
&mov($tmp2,&wparam(0));
&mov($K,&wparam(1));
&push("esi");
&push("edi");

&comment("Load the 2 words");
&mov($L,&DWP(0,$tmp2,"",0));
&mov($R,&DWP(4,$tmp2,"",0));

&comment('Get short key flag');
&mov($tmp3,&DWP(128,$K,"",0));
if($enc) {
&push($tmp3);
} else {
&or($tmp3,$tmp3);
&jnz(&label('cast_dec_skip'));
}

&xor($tmp3, $tmp3);

# encrypting part

if ($enc) {
&E_CAST( 0,$S,$L,$R,$K,@F1,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 1,$S,$R,$L,$K,@F2,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 2,$S,$L,$R,$K,@F3,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 3,$S,$R,$L,$K,@F1,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 4,$S,$L,$R,$K,@F2,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 5,$S,$R,$L,$K,@F3,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 6,$S,$L,$R,$K,@F1,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 7,$S,$R,$L,$K,@F2,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 8,$S,$L,$R,$K,@F3,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 9,$S,$R,$L,$K,@F1,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST(10,$S,$L,$R,$K,@F2,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST(11,$S,$R,$L,$K,@F3,$tmp1,$tmp2,$tmp3,$tmp4);
&comment('test short key flag');
&pop($tmp4);
&or($tmp4,$tmp4);
&jnz(&label('cast_enc_done'));
&E_CAST(12,$S,$L,$R,$K,@F1,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST(13,$S,$R,$L,$K,@F2,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST(14,$S,$L,$R,$K,@F3,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST(15,$S,$R,$L,$K,@F1,$tmp1,$tmp2,$tmp3,$tmp4);
} else {
&E_CAST(15,$S,$L,$R,$K,@F1,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST(14,$S,$R,$L,$K,@F3,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST(13,$S,$L,$R,$K,@F2,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST(12,$S,$R,$L,$K,@F1,$tmp1,$tmp2,$tmp3,$tmp4);
&set_label('cast_dec_skip');
&E_CAST(11,$S,$L,$R,$K,@F3,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST(10,$S,$R,$L,$K,@F2,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 9,$S,$L,$R,$K,@F1,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 8,$S,$R,$L,$K,@F3,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 7,$S,$L,$R,$K,@F2,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 6,$S,$R,$L,$K,@F1,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 5,$S,$L,$R,$K,@F3,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 4,$S,$R,$L,$K,@F2,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 3,$S,$L,$R,$K,@F1,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 2,$S,$R,$L,$K,@F3,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 1,$S,$L,$R,$K,@F2,$tmp1,$tmp2,$tmp3,$tmp4);
&E_CAST( 0,$S,$R,$L,$K,@F1,$tmp1,$tmp2,$tmp3,$tmp4);
}

&set_label('cast_enc_done') if $enc;
# Why the nop? - Ben 17/1/99
&nop();
&mov($tmp3,&wparam(0));
&mov(&DWP(4,$tmp3,"",0),$L);
&mov(&DWP(0,$tmp3,"",0),$R);
&function_end($name);
}

sub E_CAST {
local($i,$S,$L,$R,$K,$OP1,$OP2,$OP3,$tmp1,$tmp2,$tmp3,$tmp4)=@_;
# Ri needs to have 16 pre added.

&comment("round $i");
&mov( $tmp4, &DWP($i*8,$K,"",1));

&mov( $tmp1, &DWP($i*8+4,$K,"",1));
&$OP1( $tmp4, $R);

&rotl( $tmp4, &LB($tmp1));

if ($ppro) {
&mov( $tmp2, $tmp4); # B
&xor( $tmp1, $tmp1);

&movb( &LB($tmp1), &HB($tmp4)); # A
&and( $tmp2, 0xff);

&shr( $tmp4, 16); #
&xor( $tmp3, $tmp3);
} else {
&mov( $tmp2, $tmp4); # B
&movb( &LB($tmp1), &HB($tmp4)); # A # BAD BAD BAD

&shr( $tmp4, 16); #
&and( $tmp2, 0xff);
}

&movb( &LB($tmp3), &HB($tmp4)); # C # BAD BAD BAD
&and( $tmp4, 0xff); # D

&mov( $tmp1, &DWP($S1,"",$tmp1,4));
&mov( $tmp2, &DWP($S2,"",$tmp2,4));

&$OP2( $tmp1, $tmp2);
&mov( $tmp2, &DWP($S3,"",$tmp3,4));

&$OP3( $tmp1, $tmp2);
&mov( $tmp2, &DWP($S4,"",$tmp4,4));

&$OP1( $tmp1, $tmp2);
# XXX

&xor( $L, $tmp1);
# XXX
}
22 changes: 14 additions & 8 deletions crypto/cast/c_enc.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -81,10 +81,13 @@ CAST_KEY *key;
E_CAST( 9,k,r,l,+,^,-);
E_CAST(10,k,l,r,^,-,+);
E_CAST(11,k,r,l,-,+,^);
E_CAST(12,k,l,r,+,^,-);
E_CAST(13,k,r,l,^,-,+);
E_CAST(14,k,l,r,-,+,^);
E_CAST(15,k,r,l,+,^,-);
if(!k->short_key)
{
E_CAST(12,k,l,r,+,^,-);
E_CAST(13,k,r,l,^,-,+);
E_CAST(14,k,l,r,-,+,^);
E_CAST(15,k,r,l,+,^,-);
}

data[1]=l&0xffffffffL;
data[0]=r&0xffffffffL;
Expand All @@ -100,10 +103,13 @@ CAST_KEY *key;
l=data[0];
r=data[1];

E_CAST(15,k,l,r,+,^,-);
E_CAST(14,k,r,l,-,+,^);
E_CAST(13,k,l,r,^,-,+);
E_CAST(12,k,r,l,+,^,-);
if(!k->short_key)
{
E_CAST(15,k,l,r,+,^,-);
E_CAST(14,k,r,l,-,+,^);
E_CAST(13,k,l,r,^,-,+);
E_CAST(12,k,r,l,+,^,-);
}
E_CAST(11,k,l,r,-,+,^);
E_CAST(10,k,r,l,^,-,+);
E_CAST( 9,k,l,r,+,^,-);
Expand Down
4 changes: 4 additions & 0 deletions crypto/cast/c_skey.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -88,6 +88,10 @@ unsigned char *data;
if (len > 16) len=16;
for (i=0; i<len; i++)
x[i]=data[i];
if(len <= 10)
key->short_key=1;
else
key->short_key=0;

K= &k[0];
X[0]=((x[ 0]<<24)|(x[ 1]<<16)|(x[ 2]<<8)|x[ 3])&0xffffffffL;
Expand Down
1 change: 1 addition & 0 deletions crypto/cast/cast.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,7 @@ extern "C" {
typedef struct cast_key_st
{
CAST_LONG data[32];
int short_key; /* Use reduced rounds for short key */
} CAST_KEY;

#ifndef NOPROTO
Expand Down

0 comments on commit 649cdb7

Please sign in to comment.