You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
 

996 lines
17 KiB

/* camellia-asm.S */
/*
This file is part of the AVR-Crypto-Lib.
Copyright (C) 2006-2015 Daniel Otte (bg@nerilex.org)
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
/*
* File: camellis-asm.S
* Author: Daniel Otte
* Date: 2006-11-10
* License: GPLv3 or later
* Description: Implementation of the camellia block cipher algorithm.
*
*/
.macro SWAP_R A, B
eor \A, \B
eor \B, \A
eor \A, \B
.endm
.macro precall
/* push r18 - r27, r30 - r31*/
push r0
push r1
push r18
push r19
push r20
push r21
push r22
push r23
push r24
push r25
push r26
push r27
push r30
push r31
clr r1
.endm
.macro postcall
pop r31
pop r30
pop r27
pop r26
pop r25
pop r24
pop r23
pop r22
pop r21
pop r20
pop r19
pop r18
pop r1
pop r0
.endm
.macro hexdump length
push r27
push r26
ldi r25, '\r'
mov r24, r25
call uart_putc
ldi r25, '\n'
mov r24, r25
call uart_putc
pop r26
pop r27
movw r24, r26
.if \length > 16
ldi r22, lo8(16)
ldi r23, hi8(16)
push r27
push r26
call uart_hexdump
pop r26
pop r27
adiw r26, 16
hexdump \length-16
.else
ldi r22, lo8(\length)
ldi r23, hi8(\length)
call uart_hexdump
.endif
.endm
/* X points to Block */
.macro dbg_hexdump length
precall
hexdump \length
postcall
.endm
SPL = 0x3D
SPH = 0x3E
SREG = 0x3F
NULLr = 1
camellia_sbox:
.byte 112, 130, 44, 236, 179, 39, 192, 229, 228, 133, 87, 53, 234, 12, 174, 65
.byte 35, 239, 107, 147, 69, 25, 165, 33, 237, 14, 79, 78, 29, 101, 146, 189
.byte 134, 184, 175, 143, 124, 235, 31, 206, 62, 48, 220, 95, 94, 197, 11, 26
.byte 166, 225, 57, 202, 213, 71, 93, 61, 217, 1, 90, 214, 81, 86, 108, 77
.byte 139, 13, 154, 102, 251, 204, 176, 45, 116, 18, 43, 32, 240, 177, 132, 153
.byte 223, 76, 203, 194, 52, 126, 118, 5, 109, 183, 169, 49, 209, 23, 4, 215
.byte 20, 88, 58, 97, 222, 27, 17, 28, 50, 15, 156, 22, 83, 24, 242, 34
.byte 254, 68, 207, 178, 195, 181, 122, 145, 36, 8, 232, 168, 96, 252, 105, 80
.byte 170, 208, 160, 125, 161, 137, 98, 151, 84, 91, 30, 149, 224, 255, 100, 210
.byte 16, 196, 0, 72, 163, 247, 117, 219, 138, 3, 230, 218, 9, 63, 221, 148
.byte 135, 92, 131, 2, 205, 74, 144, 51, 115, 103, 246, 243, 157, 127, 191, 226
.byte 82, 155, 216, 38, 200, 55, 198, 59, 129, 150, 111, 75, 19, 190, 99, 46
.byte 233, 121, 167, 140, 159, 110, 188, 142, 41, 245, 249, 182, 47, 253, 180, 89
.byte 120, 152, 6, 106, 231, 70, 113, 186, 212, 37, 171, 66, 136, 162, 141, 250
.byte 114, 7, 185, 85, 248, 238, 172, 10, 54, 73, 42, 104, 60, 56, 241, 164
.byte 64, 40, 211, 123, 187, 201, 67, 193, 21, 227, 173, 244, 119, 199, 128, 158
//.global camellia_sigma
/*
camellia_sigma:
.quad 0xA09E667F3BCC908B
.quad 0xB67AE8584CAA73B2
.quad 0xC6EF372FE94F82BE
.quad 0x54FF53A5F1D36F1C
.quad 0x10E527FADE682D1D
.quad 0xB05688C2B3E6C1FD
*/
/* uint8_t camellia_s1(uint8_t b) */
.global camellia_s1
camellia_s1:
ldi r30, lo8(camellia_sbox)
ldi r31, hi8(camellia_sbox)
add r30, r24
adc r31, NULLr
lpm r24, Z
clr r25
ret
.global camellia_s2
camellia_s2:
ldi r30, lo8(camellia_sbox)
ldi r31, hi8(camellia_sbox)
add r30, r24
adc r31, NULLr
lpm r24, Z
lsl r24
adc r24, NULLr
clr r25
ret
.global camellia_s3
camellia_s3:
ldi r30, lo8(camellia_sbox)
ldi r31, hi8(camellia_sbox)
add r30, r24
adc r31, NULLr
lpm r24, Z
bst r24, 0
lsr r24
bld r24, 7
clr r25
ret
.global camellia_s4
camellia_s4:
ldi r30, lo8(camellia_sbox)
ldi r31, hi8(camellia_sbox)
lsl r24
adc r24, NULLr
add r30, r24
adc r31, NULLr
lpm r24, Z
clr r25
ret
.global camellia_s
/* uint64_t camellia_s(uint64_t d){
#define D ((uint8_t*)(&d))
D[7] = camellia_s1(D[7]); // MSB
D[6] = camellia_s2(D[6]);
D[5] = camellia_s3(D[5]);
D[4] = camellia_s4(D[4]);
D[3] = camellia_s2(D[3]);
D[2] = camellia_s3(D[2]);
D[1] = camellia_s4(D[1]);
D[0] = camellia_s1(D[0]); // LSB
#undef D
return d;
}*/
; parameters
; d: r18-r25 (r18 is LSB)
camellia_s:
movw r26, r24 ; backup r24,r25 -> X
clr r25
rcall camellia_s2
mov r26, r24
mov r24, r27
rcall camellia_s1
mov r27, r24
mov r24, r23
rcall camellia_s3
mov r23, r24
mov r24, r22
rcall camellia_s4
mov r22, r24
mov r24, r21
rcall camellia_s2
mov r21, r24
mov r24, r20
rcall camellia_s3
mov r20, r24
mov r24, r19
rcall camellia_s4
mov r19, r24
mov r24, r18
rcall camellia_s1
mov r18, r24
movw r24, r26
ret
;##############################################################################
/* uint64_t camellia_p(uint64_t d) */
; param: r18-r25 (r18 is LSB)
z1 = 25
z2 = 24
z3 = 23
z4 = 22
z5 = 21
z6 = 20
z7 = 19
z8 = 18
.global camellia_p
camellia_p:
eor z1, z6
eor z2, z7
eor z3, z8
eor z4, z5
eor z5, z3
eor z6, z4
eor z7, z1
eor z8, z2
;---------
eor z1, z8
eor z2, z5
eor z3, z6
eor z4, z7
eor z5, z4
eor z6, z1
eor z7, z2
eor z8, z3
;---------
movw r26, z8
movw r30, z6 ; backup z5 bis z8
movw z8, z4
movw z6, z2
movw z4, r26
movw z2, r30
ret
;##############################################################################
/* uint64_t camellia_f(uint64_t x, uint64_t k) */
; param x: r18-r25
; param k: r10-r17
.global camellia_f
camellia_f:
eor r18, r10
eor r19, r11
eor r20, r12
eor r21, r13
eor r22, r14
eor r23, r15
eor r24, r16
eor r25, r17
rcall camellia_s
rcall camellia_p
ret
;##############################################################################
/* uint64_t camellia_fl(uint64_t x, uint64_t k) */
; param x: r18-r25 xl: r22-r25, xr: r18-r21
; param k: r10-r17 kl: r14-r17, kr: r10-r13
kl1 = 14
kl2 = 15
kl3 = 16
kl4 = 17
kr1 = 10
kr2 = 11
kr3 = 12
kr4 = 13
xr1 = 18
xr2 = 19
xr3 = 20
xr4 = 21
xl1 = 22
xl2 = 23
xl3 = 24
xl4 = 25
.global camellia_fl
camellia_fl:
and kl1, xl1
and kl2, xl2
and kl3, xl3
and kl4, xl4
mov r26, kl4
rol r26
rol kl1
rol kl2
rol kl3
rol kl4
eor xr1, kl1
eor xr2, kl2
eor xr3, kl3
eor xr4, kl4
// that was part one
or kr1, xr1
or kr2, xr2
or kr3, xr3
or kr4, xr4
eor xl1, kr1
eor xl2, kr2
eor xl3, kr3
eor xl4, kr4
ret
;##############################################################################
/* uint64_t camellia_fl_inv(uint64_t y, uint64_t k) */
; param y: r18-r25 yl: r22-r25, yr: r18-r21
; param k: r10-r17 kl: r14-r17, kr: r10-r13
kl1 = 14
kl2 = 15
kl3 = 16
kl4 = 17
kr1 = 10
kr2 = 11
kr3 = 12
kr4 = 13
yr1 = 18
yr2 = 19
yr3 = 20
yr4 = 21
yl1 = 22
yl2 = 23
yl3 = 24
yl4 = 25
.global camellia_fl_inv
camellia_fl_inv:
or kr1, yr1
or kr2, yr2
or kr3, yr3
or kr4, yr4
eor yl1, kr1
eor yl2, kr2
eor yl3, kr3
eor yl4, kr4
// the first one is done
and kl1, yl1
and kl2, yl2
and kl3, yl3
and kl4, yl4
mov r26, kl4
rol r26
rol kl1
rol kl2
rol kl3
rol kl4
eor yr1, kl1
eor yr2, kl2
eor yr3, kl3
eor yr4, kl4
ret
;##############################################################################
; param s: r24-r25
; param q: r22
B1 = 18
B2 = 19
.global camellia128_keyop_rot15
camellia128_keyop_rot15:
movw r30, r24 ; Z points at LSB of kl ;-- 0
ldi r22, 2
2: adiw r30, 15 ;-- 15
ld r21, Z
ld r20, -Z ;-- 14
movw B1, r20 ; store Backup of the 2 MSB of kl
ror r20
ldi r21, 14
1: ld r20, -Z ;-- 13..0
ror r20
std Z+2, r20 ;-- (15..2)
dec r21
brne 1b
ror B2
ror B1
st Z+, B1 ;-- 1
st Z, B2
adiw r30, 15 ;-- 16
dec r22
brne 2b
ret
;##############################################################################
; param s: r24-r25
; param q: r22
.global camellia128_keyop_rot17
camellia128_keyop_rot17:
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
push r16
push r17
clt
movw r30, r24
clr r27
2: ldi r26, 8
mov r1, r26
lsl r1 ; r1=16
;push r1
; load 128bit value
ldd r0, Z+15
rol r0
1: ld r0, Z+
rol r0
st X+, r0
dec r1
brne 1b
st -Z, 21
st -Z, 20
st -Z, 19
st -Z, 18
st -Z, 17
st -Z, 16
st -Z, 15
st -Z, 14 ;--
st -Z, 13
st -Z, 12
st -Z, 11
st -Z, 10
st -Z, 9
st -Z, 8
st -Z, 23
st -Z, 22
brts 2f
set
adiw r30, 16
rjmp 2b
2:
pop r17
pop r16
pop r15
pop r14
pop r13
pop r12
pop r11
pop r10
pop r9
pop r8
ret
;##############################################################################
; param s: r24-r25
; param q: r22
.global camellia128_keyop
camellia128_keyop:
cpi r22, 1
breq camellia128_keyop_rot17
rjmp camellia128_keyop_rot15
;##############################################################################
; param s: r24-r25
; param q: r22
B1 = 18
B2 = 19
.global camellia128_keyop_inv_rot15
camellia128_keyop_inv_rot15:
movw r30, r24 ; Z points at LSB of kl ;-- 0
movw r26, r24 ; X also
ldi r22, 2
2: ;-- 0
ld r20, Z+ ;-- 0/1
ld r21, Z+ ;-- 1/2
movw B1, r20 ; store Backup of the 2 LSB of kl
rol r21
ldi r20, 14
1: ld r21, Z+ ;-- 2/14..3/16
rol r21
st X+, r21 ;-- (0..13)/(1..14)
dec r20
brne 1b
rol B1
rol B2
st X+, B1 ;-- 14/15
st X+, B2 ;-- 15/16
dec r22
brne 2b
ret
;##############################################################################
; param s: r24-r25
; param q: r22
.global camellia128_keyop_inv_rot17
camellia128_keyop_inv_rot17:
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
push r16
push r17
clt
movw r30, r24
clr r27
2: ldi r26, 8
mov r1, r26
lsl r1 ; r1=16
; load 128bit value
ld r0, Z
adiw r30, 16
ror r0
1: ld r0, -Z
ror r0
st X+, r0
dec r1
brne 1b
st Z+, 21
st Z+, 20
st Z+, 19
st Z+, 18
st Z+, 17
st Z+, 16
st Z+, 15
st Z+, 14 ;--
st Z+, 13
st Z+, 12
st Z+, 11
st Z+, 10
st Z+, 9
st Z+, 8
st Z+, 23
st Z+, 22
brts 2f
set
; adiw r30, 16
rjmp 2b
2:
pop r17
pop r16
pop r15
pop r14
pop r13
pop r12
pop r11
pop r10
pop r9
pop r8
ret
;##############################################################################
; param s: r24-r25
; param q: r22
.global camellia128_keyop_inv
camellia128_keyop_inv:
cpi r22, 1
breq camellia128_keyop_inv_rot17
rjmp camellia128_keyop_inv_rot15
;##############################################################################
; param p: r24-r25 pointer to data
; param l: r22 length of word
.global change_endian
change_endian:
movw r26, r24
movw r30, r24
add r30, r22
adc r31, r1
lsr r22
1:
ld r20, X
ld r21, -Z
st X+, r21
st Z, r20
dec r22
brne 1b
ret
;##############################################################################
#define SEL_KA 1
#define SEL_KL 0
#define KEY_POSTC1 0x00
#define KEY_POSTC2 0x01
#define KEY_INC2 0x02
#define KEY_DIR 0x04
#define KEY_DIR_NORM 0x00
#define KEY_DIR_INV 0x04
#define KEY_AMMOUNT 0x08
#define KEY_ROL17 0x08
#define KEY_ROL15 0x00
/*
void camellia_6rounds(camellia128_ctx_t *s, uint64_t *bl, uint64_t *br, uint8_t roundop, uint8_t keychoice){
uint8_t i;
uint64_t *k[4];
k[0] = &(s->kll);
k[1] = &(s->klr);
k[2] = &(s->kal);
k[3] = &(s->kar);
for(i=0; i<3; ++i){ / * each cycle * /
br[0] ^= camellia_f(bl[0],*(k[(keychoice&1)*2+((roundop&KEY_DIR)?1:0)]));
keychoice >>= 1;
if((i == 1) && (roundop&KEY_INC2)){
((roundop&KEY_DIR)?camellia128_keyop_inv:camellia128_keyop)(s,(roundop&KEY_AMMOUNT)?1:-1);
}
bl[0] ^= camellia_f(br[0],*(k[(keychoice&1)*2+((roundop&KEY_DIR)?0:1)]));
keychoice >>= 1;
/ * check if we should do some keyop * /
if((i == (roundop&1)) && (!(roundop&KEY_INC2)) ){
((roundop&KEY_DIR)?camellia128_keyop_inv:camellia128_keyop)(s,(roundop&KEY_AMMOUNT)?1:-1);
/ * isn't it fuckin nice what we can do in C?! * /
}
}
}
*/
; param s: r24-r25
; param bl: r22-r23
; param br: r20-r21
; param roundop: r18
; param keychoice: r16
s1 = 24
s2 = 25
bl1 = 22
bl2 = 23
br1 = 20
br2 = 22
xro = 18
kc = 16
xro_sec = 17
br1_sec = 10
br2_sec = 11
bl1_sec = 12
bl2_sec = 13
s1_sec = 14
t = 9
loop_cnt = 8
keyop_time = 7
.global camellia_6rounds
camellia_6rounds:
push r17
push r16
push r15
push r14
push r13
push r12
push r11
push r10
push r9
push r8
push r7
ldi r17, 6
mov loop_cnt, r17
mov xro_sec, xro
movw br1_sec, br1
movw bl1_sec, bl1
movw s1_sec, s1
clr keyop_time
inc keyop_time
sec
rol keyop_time // keyop_time == 3
SBRC xro, 1 // KEY_INC2
rjmp 1f
SBRS xro, 0 // KEY_POSTC1
inc keyop_time
SBRS xro, 0 // KEY_POSTC1
inc keyop_time
rjmp 2f
1: inc keyop_time
2:
main_loop:
/* now we load the key to r18-r25 */
movw r26, s1_sec
SBRC kc, 0 /* select between KA and KL */
adiw r26, 16
SBRC xro_sec, 2 // KEY_DIR
rjmp 2f
SBRS loop_cnt, 0 /* enc */
adiw r26, 8
rjmp 3f
2: SBRC loop_cnt, 0 /* dec */
adiw r26, 8
rjmp 3f
3:
lsr kc
ld r18, X+
ld r19, X+
ld r20, X+
ld r21, X+
ld r22, X+
ld r23, X+
ld r24, X+
ld r25, X+
/* now we xor bl in */
movw r26, bl1_sec
ld r0, X+
eor r18, r0
ld r0, X+
eor r19, r0
ld r0, X+
eor r20, r0
ld r0, X+
eor r21, r0
ld r0, X+
eor r22, r0
ld r0, X+
eor r23, r0
ld r0, X+
eor r24, r0
ld r0, X+
eor r25, r0
/* f(x,k) = p(s(x xor k)) ; xor is done */
call camellia_s;
call camellia_p;
// in r26, SPL
// in r27, SPH
// sbiw r26, 9
// dbg_hexdump 10
/* now we have to xor the result into br */
clr r31
ldi r30, 18
movw r26, br1_sec
; ldi r1, 8 ;-- this won't work
clr r1
sec
ror r1
swap r1
1: ld r0, X
ld t, Z+
eor r0, t
st X+, r0
dec r1
brne 1b
/* check for keyop */
cp loop_cnt, keyop_time
brne 3f
movw s1, s1_sec
ldi r22, 1
SBRS xro_sec, 3 // KEY_ROL17
neg r22
SBRS xro_sec, 2 // KEY_DIR
rjmp 2f
rcall camellia128_keyop_inv
rjmp 3f
2: rcall camellia128_keyop
3: /* loop back */
SWAP_R br1_sec, bl1_sec
SWAP_R br2_sec, bl2_sec
dec loop_cnt
breq 2f
rjmp main_loop
2:
pop r7
pop r8
pop r9
pop r10
pop r11
pop r12
pop r13
pop r14
pop r15
pop r16
pop r17
ret
;##############################################################################
/*
void camellia128_init(camellia128_ctx_t *s, uint8_t *key){
uint8_t i;
s->kll = 0; //((uint64_t*)key)[0];
/ * load the key, endian-adjusted, to kll,klr * /
for(i=0; i<8; ++i){
s->kll <<= 8;
s->kll |= *key++;
}
for(i=0; i<8; ++i){
s->klr <<= 8;
s->klr |= *key++;
}
s->kal = s->kll;
s->kar = s->klr;
s->kar ^= camellia_f(s->kal, camellia_sigma[0]);
s->kal ^= camellia_f(s->kar, camellia_sigma[1]);
s->kal ^= s->kll;
s->kar ^= s->klr;
s->kar ^= camellia_f(s->kal, camellia_sigma[2]);
s->kal ^= camellia_f(s->kar, camellia_sigma[3]);
/ * * /
// uart_putstr("\n\r----------------init finished--------------------");
}
*/
/*
X64_xor_in:
ld r0, X+
eor r18, r0
ld r0, X+
eor r19, r0
ld r0, X+
eor r20, r0
ld r0, X+
eor r21, r0
ld r0, X+
eor r22, r0
ld r0, X+
eor r23, r0
ld r0, X+
eor r24, r0
ld r0, X+
eor r25, r0
ret
X64_load:
ld r18, X+
ld r19, X+
ld r20, X+
ld r21, X+
ld r22, X+
ld r23, X+
ld r24, X+
ld r25, X+
ret
Y64_load_xor_store:
ld r0, Y
eor r18, r0
st Y+, r18
ld r0, Y
eor r19, r0
st Y+, r19
ld r0, Y
eor r20, r0
st Y+, r20
ld r0, Y
eor r21, r0
st Y+, r21
ld r0, Y
eor r22, r0
st Y+, r22
ld r0, Y
eor r23, r0
st Y+, r23
ld r0, Y
eor r24, r0
st Y+, r24
ld r0, Y
eor r25, r0
st Y+, r25
ret
; param s: r24-r25
; param *k: r22-r23
//.global camellia128_init
camellia128_init:
push r29
push r28
movw r30, r24 ; Z is statepointer
movw r26, r22 ; X is keypointer
clr r29
ldi r28, 18
// / * load key into kl, ka and kal to r18:r25 * /
adiw r26, 128/8 ;-- 16
ldi r16, (128/8)-1
1: ld r17, -X
std Z+(128/8), r17
st Z+, r17
sbrs r16, 3
st Y+, r17 ; this should only be done the last 8 rounds 0<=r16<=7
dec r16
brpl 1b
// / * step 1 * /
ldi r26, lo8(camellia_sigma)
ldi r27, hi8(camellia_sigma)
rcall X64_xor_in
rcall camellia_s
rcall camellia_p // / * f(x,k) is done * /
sbiw r30, 128/8
movw r28, r30 ; Z&Y point on kar now
call Y64_load_xor_store
// / * step 2 now * /
rcall X64_xor_in
rcall camellia_s
rcall camellia_p // / * f(x,k) is done * /
rcall Y64_load_xor_store
// / * now the xor part (kl and kr) * /
sbiw r30, 128/8 ; Z points to klr
ldi r16, 128/8
1: ld r0, Z+
ldd r1, Z+(128/8)-1
eor r0, r1
std Z+(128/8)-1, r0
dec r16
brne 1b
// / * now s->kar ^= camellia_f(s->kal, camellia_sigma[2]); * /
rcall X64_load ; load sigma[2]
movw r26, r28 ; X&Y point at kal
rcall X64_xor_in
rcall camellia_s
rcall camellia_p
sbiw r28, 128/8/2 ; Y points at kar
rcall Y64_load_xor_store
// / * now s->kal ^= camellia_f(s->kar, camellia_sigma[3]); * /
sbiw r26, 128/8 ;
rcall X64_load ; load kar
ldi r26, lo8(camellia_sigma+3*8)
ldi r27, hi8(camellia_sigma+3*8)
rcall X64_xor_in ; xor sigma[3] in
rcall camellia_s
rcall camellia_p
rcall Y64_load_xor_store
pop r28
pop r29
ret
//*/