/* * Copyright (C) 2024 Michael Brown . * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License as * published by the Free Software Foundation; either version 2 of the * License, or any later version. * * This program is distributed in the hope that it will be useful, but * WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. * * You can also choose to distribute this program under the terms of * the Unmodified Binary Distribution Licence (as given in the file * COPYING.UBDL), provided that you have satisfied its requirements. */ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); /** @file * * DES algorithm * * DES was not designed to be implemented in software, and therefore * contains a large number of bit permutation operations that are * essentially free in hardware (requiring only wires, no gates) but * expensive in software. * * Since DES is no longer used as a practical block cipher for large * volumes of data, we optimise for code size, and do not attempt to * obtain fast throughput. * * The algorithm is specified in NIST SP 800-67, downloadable from * https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-67r2.pdf */ #include #include #include #include #include #include #include #include #include #include /** * DES shift schedule * * The DES shift schedule (ordered from round 16 down to round 1) is * {1,2,2,2,2,2,2,1,2,2,2,2,2,2,1,1}. In binary, this may be * represented as {1,10,10,10,10,10,10,1,10,10,10,10,10,10,1,1} and * concatenated (without padding) to produce a single binary integer * 1101010101010110101010101011 (equal to 0x0d556aab in hexadecimal). * * This integer may then be consumed LSB-first, where a 1 bit * indicates a shift and the generation of a round key, and a 0 bit * indicates a shift without the generation of a round key. */ #define DES_SCHEDULE 0x0d556aab /** * Define an element pair in a DES S-box * * @v x Upper element of element pair * @v y Lower element of element pair * * DES S-box elements are 4-bit values. We encode two values per * byte, ordering the elements so that the six-bit input value may be * used directly as a lookup index. * * Specifically, if the input value is {r1,c3,c2,c1,c0,r0}, where * {r1,r0} is the table row index and {c3,c2,c1,c0} is the table * column index (as used in the DES specification), then: * * - {r1,c3,c2,c1,c0} is the byte index into the table * * - (4*r0) is the required bit shift to extract the 4-bit value */ #define SBYTE( x, y ) ( ( (y) << 4 ) | (x) ) /** * Define a row pair in a DES S-box * * @v x0..xf Upper row of row pair * @v y0..yf Lower row of row pair */ #define SBOX( x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, xa, xb, xc, xd, xe, xf, \ y0, y1, y2, y3, y4, y5, y6, y7, y8, y9, ya, yb, yc, yd, ye, yf ) \ SBYTE ( x0, y0 ), SBYTE ( x1, y1 ), SBYTE ( x2, y2 ), SBYTE ( x3, y3 ),\ SBYTE ( x4, y4 ), SBYTE ( x5, y5 ), SBYTE ( x6, y6 ), SBYTE ( x7, y7 ),\ SBYTE ( x8, y8 ), SBYTE ( x9, y9 ), SBYTE ( xa, ya ), SBYTE ( xb, yb ),\ SBYTE ( xc, yc ), SBYTE ( xd, yd ), SBYTE ( xe, ye ), SBYTE ( xf, yf ) /** DES S-boxes S1..S8 */ static const uint8_t des_s[8][32] = { { /* S1 */ SBOX ( 14, 4, 13, 1, 2, 15, 11, 8, 3, 10, 6, 12, 5, 9, 0, 7, 0, 15, 7, 4, 14, 2, 13, 1, 10, 6, 12, 11, 9, 5, 3, 8 ), SBOX ( 4, 1, 14, 8, 13, 6, 2, 11, 15, 12, 9, 7, 3, 10, 5, 0, 15, 12, 8, 2, 4, 9, 1, 7, 5, 11, 3, 14, 10, 0, 6, 13 ) }, { /* S2 */ SBOX ( 15, 1, 8, 14, 6, 11, 3, 4, 9, 7, 2, 13, 12, 0, 5, 10, 3, 13, 4, 7, 15, 2, 8, 14, 12, 0, 1, 10, 6, 9, 11, 5 ), SBOX ( 0, 14, 7, 11, 10, 4, 13, 1, 5, 8, 12, 6, 9, 3, 2, 15, 13, 8, 10, 1, 3, 15, 4, 2, 11, 6, 7, 12, 0, 5, 14, 9 ) }, { /* S3 */ SBOX ( 10, 0, 9, 14, 6, 3, 15, 5, 1, 13, 12, 7, 11, 4, 2, 8, 13, 7, 0, 9, 3, 4, 6, 10, 2, 8, 5, 14, 12, 11, 15, 1 ), SBOX ( 13, 6, 4, 9, 8, 15, 3, 0, 11, 1, 2, 12, 5, 10, 14, 7, 1, 10, 13, 0, 6, 9, 8, 7, 4, 15, 14, 3, 11, 5, 2, 12 ) }, { /* S4 */ SBOX ( 7, 13, 14, 3, 0, 6, 9, 10, 1, 2, 8, 5, 11, 12, 4, 15, 13, 8, 11, 5, 6, 15, 0, 3, 4, 7, 2, 12, 1, 10, 14, 9 ), SBOX ( 10, 6, 9, 0, 12, 11, 7, 13, 15, 1, 3, 14, 5, 2, 8, 4, 3, 15, 0, 6, 10, 1, 13, 8, 9, 4, 5, 11, 12, 7, 2, 14 ) }, { /* S5 */ SBOX ( 2, 12, 4, 1, 7, 10, 11, 6, 8, 5, 3, 15, 13, 0, 14, 9, 14, 11, 2, 12, 4, 7, 13, 1, 5, 0, 15, 10, 3, 9, 8, 6 ), SBOX ( 4, 2, 1, 11, 10, 13, 7, 8, 15, 9, 12, 5, 6, 3, 0, 14, 11, 8, 12, 7, 1, 14, 2, 13, 6, 15, 0, 9, 10, 4, 5, 3 ) }, { /* S6 */ SBOX ( 12, 1, 10, 15, 9, 2, 6, 8, 0, 13, 3, 4, 14, 7, 5, 11, 10, 15, 4, 2, 7, 12, 9, 5, 6, 1, 13, 14, 0, 11, 3, 8 ), SBOX ( 9, 14, 15, 5, 2, 8, 12, 3, 7, 0, 4, 10, 1, 13, 11, 6, 4, 3, 2, 12, 9, 5, 15, 10, 11, 14, 1, 7, 6, 0, 8, 13 ) }, { /* S7 */ SBOX ( 4, 11, 2, 14, 15, 0, 8, 13, 3, 12, 9, 7, 5, 10, 6, 1, 13, 0, 11, 7, 4, 9, 1, 10, 14, 3, 5, 12, 2, 15, 8, 6 ), SBOX ( 1, 4, 11, 13, 12, 3, 7, 14, 10, 15, 6, 8, 0, 5, 9, 2, 6, 11, 13, 8, 1, 4, 10, 7, 9, 5, 0, 15, 14, 2, 3, 12 ) }, { /* S8 */ SBOX ( 13, 2, 8, 4, 6, 15, 11, 1, 10, 9, 3, 14, 5, 0, 12, 7, 1, 15, 13, 8, 10, 3, 7, 4, 12, 5, 6, 11, 0, 14, 9, 2 ), SBOX ( 7, 11, 4, 1, 9, 12, 14, 2, 0, 6, 10, 13, 15, 3, 5, 8, 2, 1, 14, 7, 4, 10, 8, 13, 15, 12, 9, 0, 3, 5, 6, 11 ) } }; /** * Define a bit index within permuted choice 2 (PC2) * * @v bit Bit index * * Permuted choice 2 (PC2) is used to select bits from a concatenated * pair of 28-bit registers ("C" and "D") as part of the key schedule. * We store these as 32-bit registers and so must add 4 to indexes * above 28. */ #define DES_PC2( x ) ( (x) + ( ( (x) > 28 ) ? 4 : 0 ) ) /** * Define six bits of permuted choice 2 (PC2) * * @v r1:r0 Bits corresponding to S-box row index * @v c3:c0 Bits corresponding to S-box column index * * There are 8 steps within a DES round (one step per S-box). Each * step requires six bits of the round key, corresponding to the S-box * input value {r1,c3,c2,c1,c0,r0}, where {r1,r0} is the table row * index and {c3,c2,c1,c0} is the table column index. * * As an optimisation, we store the least significant of the 6 bits in * the sign bit of a signed 8-bit value, and the remaining 5 bits in * the least significant 5 bits of the 8-bit value. See the comments * in des_sbox() for further details. */ #define DES_PC2R( r1, c3, c2, c1, c0, r0 ) \ DES_PC2 ( r0 ), /* LSB stored in sign bit */ \ DES_PC2 ( r0 ), /* Unused bit */ \ DES_PC2 ( r0 ), /* Unused bit */ \ DES_PC2 ( r1 ), /* Remaining 5 bits */ \ DES_PC2 ( c3 ), /* ... */ \ DES_PC2 ( c2 ), /* ... */ \ DES_PC2 ( c1 ), /* ... */ \ DES_PC2 ( c0 ) /* ... */ /** * A DES systematic permutation generator * * Many of the permutations used in DES comprise systematic bit * patterns. We generate these permutations at runtime to save on * code size. */ struct des_generator { /** Permutation */ uint8_t *permutation; /** Seed value */ uint32_t seed; }; /** * Define a DES permutation generator * * @v PERMUTATION Permutation * @v OFFSET Fixed input bit offset (0 or 1) * @v INV Input bit index bit should be inverted * @v BIT Source bit for input bit index bit * @ret generator Permutation generator */ #define DES_GENERATOR( PERMUTATION, OFFSET, INV5, BIT5, INV4, BIT4, \ INV3, BIT3, INV2, BIT2, INV1, BIT1, INV0, BIT0 ) \ { \ .permutation = (PERMUTATION), \ .seed = ( ( (INV0) << 31 ) | ( (BIT0) << 28 ) | \ ( (INV1) << 27 ) | ( (BIT1) << 24 ) | \ ( (INV2) << 23 ) | ( (BIT2) << 20 ) | \ ( (INV3) << 19 ) | ( (BIT3) << 16 ) | \ ( (INV4) << 15 ) | ( (BIT4) << 12 ) | \ ( (INV5) << 11 ) | ( (BIT5) << 8 ) | \ ( ( uint32_t ) sizeof (PERMUTATION) - 1 ) | \ (OFFSET) ), \ } /** DES permuted choice 1 (PC1) "C" register */ static uint8_t des_pc1c[29]; /** DES permuted choice 1 (PC1) "D" register */ static uint8_t des_pc1d[33]; /** DES permuted choice 2 (PC2) */ static const uint8_t des_pc2[65] = { DES_PC2R ( 14, 17, 11, 24, 1, 5 ), DES_PC2R ( 3, 28, 15, 6, 21, 10 ), DES_PC2R ( 23, 19, 12, 4, 26, 8 ), DES_PC2R ( 16, 7, 27, 20, 13, 2 ), DES_PC2R ( 41, 52, 31, 37, 47, 55 ), DES_PC2R ( 30, 40, 51, 45, 33, 48 ), DES_PC2R ( 44, 49, 39, 56, 34, 53 ), DES_PC2R ( 46, 42, 50, 36, 29, 32 ), 0 /* terminator */ }; /** DES initial permutation (IP) */ static uint8_t des_ip[65]; /** DES data permutation (P) */ static const uint8_t des_p[33] = { 16, 7, 20, 21, 29, 12, 28, 17, 1, 15, 23, 26, 5, 18, 31, 10, 2, 8, 24, 14, 32, 27, 3, 9, 19, 13, 30, 6, 22, 11, 4, 25, 0 /* terminator */ }; /** DES final / inverse initial permutation (FP / IP^-1) */ static uint8_t des_fp[65]; /** DES permutation generators */ static struct des_generator des_generators[] = { /* The DES initial permutation transforms the bit index * {x5,x4,x3,x2,x1,x0}+1 into {~x2,~x1,~x0,x4,x3,~x5}+1 */ DES_GENERATOR ( des_ip, 1, 1, 2, 1, 1, 1, 0, 0, 4, 0, 3, 1, 5 ), /* The DES final permutation transforms the bit index * {x5,x4,x3,x2,x1,x0}+1 into {~x0,x2,x1,~x5,~x4,~x3}+1 * * There is an asymmetry in the DES block diagram for the last * of the 16 rounds, which is functionally equivalent to * performing 16 identical rounds and then swapping the left * and right halves before applying the final permutation. We * may therefore account for this asymmetry by inverting the * MSB in each bit index, to point to the corresponding bit in * the other half. * * This is equivalent to using a permutation that transforms * {x5,x4,x3,x2,x1,x0}+1 into {x0,x2,x1,~x5,~x4,~x3}+1 */ DES_GENERATOR ( des_fp, 1, 0, 0, 0, 2, 0, 1, 1, 5, 1, 4, 1, 3 ), /* The "C" half of DES permuted choice 1 (PC1) transforms the * bit index {x5,x4,x3,x2,x1,x0}+1 into {~x2,~x1,~x0,x5,x4,x3}+1 */ DES_GENERATOR ( des_pc1c, 1, 1, 2, 1, 1, 1, 0, 0, 5, 0, 4, 0, 3 ), /* The "D" half of DES permuted choice 1 (PC1) transforms the * bit index {x5,x4,x3,x2,x1,x0}+1 into {~x2,~x1,~x0,~x5,~x4,~x3}+0 * * Due to the idosyncratic design choice of using 28-bit * registers in the DES key expansion schedule, the final four * permutation values appear at indices [28:31] instead of * [24:27]. This is adjusted for in @c des_setkey(). */ DES_GENERATOR ( des_pc1d, 0, 1, 2, 1, 1, 1, 0, 1, 5, 1, 4, 1, 3 ), }; /** * Generate DES permutation * * @v generator Generator */ static __attribute__ (( noinline )) void des_generate ( struct des_generator *generator ) { uint8_t *permutation = generator->permutation; uint32_t seed = generator->seed; unsigned int index = 0; uint8_t accum; uint8_t bit; /* Generate permutations * * This loop is optimised for code size on a * register-constrained architecture such as i386. */ do { /* Rotate seed to access MSB's bit descriptor */ seed = ror32 ( seed, 8 ); /* Initialise accumulator with six flag bits */ accum = 0xfc; /* Accumulate bits until all six flag bits are cleared */ do { /* Extract specified bit from index. Use a * rotation instead of a shift, since this * will allow the mask to be elided. */ bit = ror8 ( index, ( seed & 0x07 ) ); seed = ror32 ( seed, 3 ); /* Toggle bit if applicable */ bit ^= seed; seed = ror32 ( seed, 1 ); /* Add bit to accumulator and clear one flag bit */ accum <<= 1; accum |= ( bit & 0x01 ); } while ( accum & 0x80 ); /* Add constant offset if applicable */ accum += ( seed & 0x01 ); /* Store permutation */ permutation[index] = accum; /* Loop until reaching length (which is always even) */ } while ( ++index < ( seed & 0xfe ) ); DBGC2 ( permutation, "DES generated permutation %p:\n", permutation ); DBGC2_HDA ( permutation, 0, permutation, ( ( seed & 0xfe ) + 1 /* zero terminator */ ) ); } /** * Initialise permutations */ static void des_init ( void ) { unsigned int i; /* Generate all generated permutations */ for ( i = 0 ; i < ( sizeof ( des_generators ) / sizeof ( des_generators[0] ) ) ; i++ ) { des_generate ( &des_generators[i] ); } } /** Initialisation function */ struct init_fn des_init_fn __init_fn ( INIT_NORMAL ) = { .initialise = des_init, }; /** * Perform bit permutation * * @v permutation Bit permutation (zero-terminated) * @v in Input value * @v out Output value */ static void des_permute ( const uint8_t *permutation, const uint8_t *in, uint8_t *out ) { uint8_t mask = 0x80; uint8_t accum = 0; unsigned int bit; /* Extract individual input bits to construct output value */ while ( ( bit = *(permutation++) ) ) { bit--; if ( in[ bit / 8 ] & ( 0x80 >> ( bit % 8 ) ) ) accum |= mask; *out = accum; mask = ror8 ( mask, 1 ); if ( mask == 0x80 ) { out++; accum = 0; } } } /** * Perform DES S-box substitution * * @v in 32-bit input value (native endian) * @v rkey 48-bit round key * @ret out 32-bit output value (native endian) */ static uint32_t des_sbox ( uint32_t in, const union des_round_key *rkey ) { uint32_t out = 0; uint32_t lookup; int32_t key; uint8_t sub; unsigned int i; /* Perform input expansion, key addition, and S-box substitution */ for ( i = 0 ; i < 8 ; i++ ) { /* Rotate input and output */ out = rol32 ( out, 4 ); in = rol32 ( in, 4 ); /* Extract step key from relevant 6 bits of round key * * The least significant of the 6 bits (corresponding * to bit r0 in the S-box lookup index) is stored in * the sign bit of the step key byte. It will * therefore be propagated via sign extension to the * MSB of the 32-bit step key. * * The remaining 5 of the 6 bits (corresponding to * bits {r1,c3,c2,c1,c0} in the S-box lookup index) * are stored in the least significant 5 bits of the * step key byte and will end up in the least * significant 5 bits of the 32-bit step key. */ key = rkey->step[i]; /* Add step key to input to produce S-box lookup index * * We do not ever perform an explicit expansion of the * input value from 32 to 48 bits. Instead, we rotate * the 32-bit input value by 4 bits on each step, and * extract the relevant 6 bits. * * The least significant of the 6 bits (corresponding * to bit r0 in the S-box lookup index) is currently * in the MSB of the 32-bit (rotated) input value. * * The remaining 5 of the 6 bits (corresponding to * bits {r1,c3,c2,c1,c0} in the S-box lookup index) * are currently in the least significant 5 bits of * the 32-bit (rotated) input value. * * This aligns with the placement of the bits in the * step key (see above), and we can therefore perform * a single XOR to add the 6-bit step key to the * relevant 6 bits of the input value. */ lookup = ( in ^ key ); /* Look up S[i][in ^ key] from S-box * * We have bits {r1,c3,c2,c1,c0} in the least * significant 5 bits of the lookup index, and so can * use the masked lookup index directly as a byte * index into the relevant S-box to extract the byte * containing both {r1,c3,c2,c1,c0,'0'} and * {r1,c3,c2,c1,c0,'1'}. * * We then use the MSB of the 32-bit lookup index to * extract the relevant nibble for the full lookup * index {r1,c3,c2,c1,c0,r0}. */ sub = des_s[i][ lookup & 0x1f ]; sub >>= ( ( lookup >> 29 ) & 4 ); sub &= 0x0f; /* Substitute S[i][input ^ key] into output */ out |= sub; } return out; } /** * Perform a single DES round * * @v block DES block * @v rkey 48-bit round key */ static void des_round ( union des_block *block, const union des_round_key *rkey ) { union des_dword sbox; uint32_t left; uint32_t right; /* Extract left and right halves L[n-1] and R[n-1] */ left = block->left.dword; right = block->right.dword; DBGC2 ( block, "DES L=%08x R=%08x K=%08x%08x", be32_to_cpu ( left ), be32_to_cpu ( right ), be32_to_cpu ( rkey->dword[0] ), be32_to_cpu ( rkey->dword[1] ) ); /* L[n] = R[n-1] */ block->left.dword = right; /* Calculate Feistel function f(R[n-1], K[n]) */ sbox.dword = cpu_to_be32 ( des_sbox ( be32_to_cpu ( right ), rkey ) ); des_permute ( des_p, sbox.byte, block->right.byte ); /* R[n] = L[n-1] + f(R[n-1], K[n]) */ block->right.dword ^= left; DBGC2 ( block, " => L=%08x R=%08x\n", be32_to_cpu ( block->left.dword ), be32_to_cpu ( block->right.dword ) ); } /** * Perform all DES rounds * * @v in Input DES block * @v out Output DES block * @v rkey Starting 48-bit round key * @v offset Byte offset between round keys */ static void des_rounds ( const union des_block *in, union des_block *out, const union des_round_key *rkey, ssize_t offset ) { union des_block tmp; unsigned int i; /* Apply initial permutation */ des_permute ( des_ip, in->byte, tmp.byte ); /* Perform all DES rounds, consuming keys in the specified order */ for ( i = 0 ; i < DES_ROUNDS ; i++ ) { des_round ( &tmp, rkey ); rkey = ( ( ( void * ) rkey ) + offset ); } /* Apply final permutation */ DBGC ( &tmp, "DES %scrypted %08x%08x => ", ( ( offset > 0 ) ? "en" : "de" ), be32_to_cpu ( in->dword[0] ), be32_to_cpu ( in->dword[1] ) ); des_permute ( des_fp, tmp.byte, out->byte ); DBGC ( &tmp, "%08x%08x\n", be32_to_cpu ( out->dword[0] ), be32_to_cpu ( out->dword[1] ) ); } /** * Rotate 28-bit word * * @v dword 28-bit dword value * @ret dword Rotated 28-bit dword value */ static uint32_t des_rol28 ( uint32_t dword ) { int32_t sdword; /* Convert to native-endian */ sdword = be32_to_cpu ( dword ); /* Signed shift right by 4 places to copy bit 31 to bits 27:31 */ sdword >>= 4; /* Rotate left */ sdword = rol32 ( sdword, 1 ); /* Shift left by 4 places to restore bit positions */ sdword <<= 4; /* Convert back to big-endian */ dword = cpu_to_be32 ( sdword ); return dword; } /** * Set key * * @v ctx Context * @v key Key * @v keylen Key length * @ret rc Return status code */ static int des_setkey ( void *ctx, const void *key, size_t keylen ) { struct des_context *des = ctx; union des_round_key *rkey = des->rkey; union des_block reg; uint32_t schedule; /* Validate key length */ if ( keylen != DES_BLOCKSIZE ) return -EINVAL; DBGC ( des, "DES %p new key:\n", des ); DBGC_HDA ( des, 0, key, keylen ); /* Apply permuted choice 1 */ des_permute ( des_pc1c, key, reg.c.byte ); des_permute ( des_pc1d, key, reg.d.byte ); reg.d.byte[3] <<= 4; /* see comment for @c des_pc1d */ DBGC2 ( des, "DES %p C[ 0]=%07x D[ 0]=%07x\n", des, ( be32_to_cpu ( reg.c.dword ) >> 4 ), ( be32_to_cpu ( reg.d.dword ) >> 4 ) ); /* Generate round keys */ for ( schedule = DES_SCHEDULE ; schedule ; schedule >>= 1 ) { /* Shift 28-bit words */ reg.c.dword = des_rol28 ( reg.c.dword ); reg.d.dword = des_rol28 ( reg.d.dword ); /* Skip rounds according to shift schedule */ if ( ! ( schedule & 1 ) ) continue; /* Apply permuted choice 2 */ des_permute ( des_pc2, reg.byte, rkey->byte ); DBGC2 ( des, "DES %p C[%2zd]=%07x D[%2zd]=%07x K[%2zd]=" "%08x%08x\n", des, ( ( rkey - des->rkey ) + 1 ), ( be32_to_cpu ( reg.c.dword ) >> 4 ), ( ( rkey - des->rkey ) + 1 ), ( be32_to_cpu ( reg.d.dword ) >> 4 ), ( ( rkey - des->rkey ) + 1 ), be32_to_cpu ( rkey->dword[0] ), be32_to_cpu ( rkey->dword[1] ) ); /* Move to next key */ rkey++; } /* Sanity check */ assert ( rkey == &des->rkey[DES_ROUNDS] ); return 0; } /** * Encrypt data * * @v ctx Context * @v src Data to encrypt * @v dst Buffer for encrypted data * @v len Length of data */ static void des_encrypt ( void *ctx, const void *src, void *dst, size_t len ) { struct des_context *des = ctx; /* Sanity check */ assert ( len == DES_BLOCKSIZE ); /* Cipher using keys in forward direction */ des_rounds ( src, dst, &des->rkey[0], sizeof ( des->rkey[0] ) ); } /** * Decrypt data * * @v ctx Context * @v src Data to decrypt * @v dst Buffer for decrypted data * @v len Length of data */ static void des_decrypt ( void *ctx, const void *src, void *dst, size_t len ) { struct des_context *des = ctx; /* Sanity check */ assert ( len == DES_BLOCKSIZE ); /* Cipher using keys in reverse direction */ des_rounds ( src, dst, &des->rkey[ DES_ROUNDS - 1 ], -sizeof ( des->rkey[0] ) ); } /** Basic DES algorithm */ struct cipher_algorithm des_algorithm = { .name = "des", .ctxsize = sizeof ( struct des_context ), .blocksize = DES_BLOCKSIZE, .alignsize = 0, .authsize = 0, .setkey = des_setkey, .setiv = cipher_null_setiv, .encrypt = des_encrypt, .decrypt = des_decrypt, .auth = cipher_null_auth, }; /* DES in Electronic Codebook mode */ ECB_CIPHER ( des_ecb, des_ecb_algorithm, des_algorithm, struct des_context, DES_BLOCKSIZE ); /* DES in Cipher Block Chaining mode */ CBC_CIPHER ( des_cbc, des_cbc_algorithm, des_algorithm, struct des_context, DES_BLOCKSIZE );