sys/crypto/camellia/camellia.c

   1 /* camellia.h ver 1.1.0
   2  *
   3  * Copyright (c) 2006
   4  * NTT (Nippon Telegraph and Telephone Corporation) . All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  * 1. Redistributions of source code must retain the above copyright
  10  *   notice, this list of conditions and the following disclaimer as
  11  *   the first lines of this file unmodified.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *   notice, this list of conditions and the following disclaimer in the
  14  *   documentation and/or other materials provided with the distribution.
  15  *
  16  * THIS SOFTWARE IS PROVIDED BY NTT ``AS IS'' AND ANY EXPRESS OR
  17  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  18  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  19  * IN NO EVENT SHALL NTT BE LIABLE FOR ANY DIRECT, INDIRECT,
  20  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  21  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  22  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  23  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  24  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  25  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  26  *
  27  * $FreeBSD: src/sys/crypto/camellia/camellia.c,v 1.1 2007/05/09 19:37:01 gnn Exp $
  28  */
  29
  30 /*
  31  * Algorithm Specification
  32  *  http://info.isl.ntt.co.jp/crypt/eng/camellia/specifications.html
  33  */
  34
  35 #include <sys/cdefs.h>
  36 #include <sys/types.h>
  37 #include <sys/endian.h>
  38 #ifdef _KERNEL
  39 #include <sys/param.h>
  40 #include <sys/systm.h>
  41 #else
  42 #include <string.h>
  43 #include <assert.h>
  44 #define KASSERT(exp, msg) assert(exp)
  45 #endif
  46
  47 #include <crypto/camellia/camellia.h>
  48
  49
  50 /* key constants */
  51
  52 #define CAMELLIA_SIGMA1L (0xA09E667FL)
  53 #define CAMELLIA_SIGMA1R (0x3BCC908BL)
  54 #define CAMELLIA_SIGMA2L (0xB67AE858L)
  55 #define CAMELLIA_SIGMA2R (0x4CAA73B2L)
  56 #define CAMELLIA_SIGMA3L (0xC6EF372FL)
  57 #define CAMELLIA_SIGMA3R (0xE94F82BEL)
  58 #define CAMELLIA_SIGMA4L (0x54FF53A5L)
  59 #define CAMELLIA_SIGMA4R (0xF1D36F1CL)
  60 #define CAMELLIA_SIGMA5L (0x10E527FAL)
  61 #define CAMELLIA_SIGMA5R (0xDE682D1DL)
  62 #define CAMELLIA_SIGMA6L (0xB05688C2L)
  63 #define CAMELLIA_SIGMA6R (0xB3E6C1FDL)
  64
  65 /*
  66  *  macros
  67  */
  68 #define GETU32(pt) (((uint32_t)(pt)[0] << 24)           \
  69                      ^ ((uint32_t)(pt)[1] << 16)        \
  70                      ^ ((uint32_t)(pt)[2] <<  8)        \
  71                      ^ ((uint32_t)(pt)[3]))
  72
  73 #define PUTU32(ct, st) {(ct)[0] = (uint8_t)((st) >> 24);        \
  74                         (ct)[1] = (uint8_t)((st) >> 16);        \
  75                         (ct)[2] = (uint8_t)((st) >>  8);        \
  76                         (ct)[3] = (uint8_t)(st);}
  77
  78 #define SUBL(INDEX) (subkey[(INDEX)*2+1])
  79 #define SUBR(INDEX) (subkey[(INDEX)*2])
  80
  81 #define CAMELLIA_RR8(x) (((x) >> 8) + ((x) << 24))
  82 #define CAMELLIA_RL1(x) (((x) << 1) + ((x) >> 31))
  83 #define CAMELLIA_RL8(x) (((x) << 8) + ((x) >> 24))
  84
  85 #define CAMELLIA_ROLDQ(ll, lr, rl, rr, w0, w1, bits)    \
  86     do {                                                \
  87         w0 = ll;                                        \
  88         ll = (ll << bits) + (lr >> (32 - bits));        \
  89         lr = (lr << bits) + (rl >> (32 - bits));        \
  90         rl = (rl << bits) + (rr >> (32 - bits));        \
  91         rr = (rr << bits) + (w0 >> (32 - bits));        \
  92     } while(0)
  93
  94 #define CAMELLIA_ROLDQo32(ll, lr, rl, rr, w0, w1, bits) \
  95     do {                                                \
  96         w0 = ll;                                        \
  97         w1 = lr;                                        \
  98         ll = (lr << (bits - 32)) + (rl >> (64 - bits)); \
  99         lr = (rl << (bits - 32)) + (rr >> (64 - bits)); \
 100         rl = (rr << (bits - 32)) + (w0 >> (64 - bits)); \
 101         rr = (w0 << (bits - 32)) + (w1 >> (64 - bits)); \
 102     } while(0)
 103
 104 #define CAMELLIA_SP1110(INDEX) (camellia_sp1110[(INDEX)])
 105 #define CAMELLIA_SP0222(INDEX) (camellia_sp0222[(INDEX)])
 106 #define CAMELLIA_SP3033(INDEX) (camellia_sp3033[(INDEX)])
 107 #define CAMELLIA_SP4404(INDEX) (camellia_sp4404[(INDEX)])
 108
 109 #define CAMELLIA_F(xl, xr, kl, kr, yl, yr, il, ir, t0, t1)      \
 110     do {                                                        \
 111         il = xl ^ kl;                                           \
 112         ir = xr ^ kr;                                           \
 113         t0 = il >> 16;                                          \
 114         t1 = ir >> 16;                                          \
 115         yl = CAMELLIA_SP1110(ir & 0xff)                         \
 116             ^ CAMELLIA_SP0222((t1 >> 8) & 0xff)                 \
 117             ^ CAMELLIA_SP3033(t1 & 0xff)                        \
 118             ^ CAMELLIA_SP4404((ir >> 8) & 0xff);                \
 119         yr = CAMELLIA_SP1110((t0 >> 8) & 0xff)                  \
 120             ^ CAMELLIA_SP0222(t0 & 0xff)                        \
 121             ^ CAMELLIA_SP3033((il >> 8) & 0xff)                 \
 122             ^ CAMELLIA_SP4404(il & 0xff);                       \
 123         yl ^= yr;                                               \
 124         yr = CAMELLIA_RR8(yr);                                  \
 125         yr ^= yl;                                               \
 126     } while(0)
 127
 128
 129 #define CAMELLIA_FLS(ll, lr, rl, rr, kll, klr, krl, krr, t0, t1, t2, t3) \
 130     do {                                                                \
 131         t0 = kll;                                                       \
 132         t2 = krr;                                                       \
 133         t0 &= ll;                                                       \
 134         t2 |= rr;                                                       \
 135         rl ^= t2;                                                       \
 136         lr ^= CAMELLIA_RL1(t0);                                         \
 137         t3 = krl;                                                       \
 138         t1 = klr;                                                       \
 139         t3 &= rl;                                                       \
 140         t1 |= lr;                                                       \
 141         ll ^= t1;                                                       \
 142         rr ^= CAMELLIA_RL1(t3);                                         \
 143     } while(0)
 144
 145 #define CAMELLIA_ROUNDSM(xl, xr, kl, kr, yl, yr, il, ir, t0, t1)        \
 146     do {                                                                \
 147         ir =  CAMELLIA_SP1110(xr & 0xff);                               \
 148         il =  CAMELLIA_SP1110((xl>>24) & 0xff);                         \
 149         ir ^= CAMELLIA_SP0222((xr>>24) & 0xff);                         \
 150         il ^= CAMELLIA_SP0222((xl>>16) & 0xff);                         \
 151         ir ^= CAMELLIA_SP3033((xr>>16) & 0xff);                         \
 152         il ^= CAMELLIA_SP3033((xl>>8) & 0xff);                          \
 153         ir ^= CAMELLIA_SP4404((xr>>8) & 0xff);                          \
 154         il ^= CAMELLIA_SP4404(xl & 0xff);                               \
 155         il ^= kl;                                                       \
 156         ir ^= kr;                                                       \
 157         ir ^= il;                                                       \
 158         il = CAMELLIA_RR8(il);                                          \
 159         il ^= ir;                                                       \
 160         yl ^= ir;                                                       \
 161         yr ^= il;                                                       \
 162     } while(0)
 163
 164
 165 static const uint32_t camellia_sp1110[256] = {
 166     0x70707000,0x82828200,0x2c2c2c00,0xececec00,
 167     0xb3b3b300,0x27272700,0xc0c0c000,0xe5e5e500,
 168     0xe4e4e400,0x85858500,0x57575700,0x35353500,
 169     0xeaeaea00,0x0c0c0c00,0xaeaeae00,0x41414100,
 170     0x23232300,0xefefef00,0x6b6b6b00,0x93939300,
 171     0x45454500,0x19191900,0xa5a5a500,0x21212100,
 172     0xededed00,0x0e0e0e00,0x4f4f4f00,0x4e4e4e00,
 173     0x1d1d1d00,0x65656500,0x92929200,0xbdbdbd00,
 174     0x86868600,0xb8b8b800,0xafafaf00,0x8f8f8f00,
 175     0x7c7c7c00,0xebebeb00,0x1f1f1f00,0xcecece00,
 176     0x3e3e3e00,0x30303000,0xdcdcdc00,0x5f5f5f00,
 177     0x5e5e5e00,0xc5c5c500,0x0b0b0b00,0x1a1a1a00,
 178     0xa6a6a600,0xe1e1e100,0x39393900,0xcacaca00,
 179     0xd5d5d500,0x47474700,0x5d5d5d00,0x3d3d3d00,
 180     0xd9d9d900,0x01010100,0x5a5a5a00,0xd6d6d600,
 181     0x51515100,0x56565600,0x6c6c6c00,0x4d4d4d00,
 182     0x8b8b8b00,0x0d0d0d00,0x9a9a9a00,0x66666600,
 183     0xfbfbfb00,0xcccccc00,0xb0b0b000,0x2d2d2d00,
 184     0x74747400,0x12121200,0x2b2b2b00,0x20202000,
 185     0xf0f0f000,0xb1b1b100,0x84848400,0x99999900,
 186     0xdfdfdf00,0x4c4c4c00,0xcbcbcb00,0xc2c2c200,
 187     0x34343400,0x7e7e7e00,0x76767600,0x05050500,
 188     0x6d6d6d00,0xb7b7b700,0xa9a9a900,0x31313100,
 189     0xd1d1d100,0x17171700,0x04040400,0xd7d7d700,
 190     0x14141400,0x58585800,0x3a3a3a00,0x61616100,
 191     0xdedede00,0x1b1b1b00,0x11111100,0x1c1c1c00,
 192     0x32323200,0x0f0f0f00,0x9c9c9c00,0x16161600,
 193     0x53535300,0x18181800,0xf2f2f200,0x22222200,
 194     0xfefefe00,0x44444400,0xcfcfcf00,0xb2b2b200,
 195     0xc3c3c300,0xb5b5b500,0x7a7a7a00,0x91919100,
 196     0x24242400,0x08080800,0xe8e8e800,0xa8a8a800,
 197     0x60606000,0xfcfcfc00,0x69696900,0x50505000,
 198     0xaaaaaa00,0xd0d0d000,0xa0a0a000,0x7d7d7d00,
 199     0xa1a1a100,0x89898900,0x62626200,0x97979700,
 200     0x54545400,0x5b5b5b00,0x1e1e1e00,0x95959500,
 201     0xe0e0e000,0xffffff00,0x64646400,0xd2d2d200,
 202     0x10101000,0xc4c4c400,0x00000000,0x48484800,
 203     0xa3a3a300,0xf7f7f700,0x75757500,0xdbdbdb00,
 204     0x8a8a8a00,0x03030300,0xe6e6e600,0xdadada00,
 205     0x09090900,0x3f3f3f00,0xdddddd00,0x94949400,
 206     0x87878700,0x5c5c5c00,0x83838300,0x02020200,
 207     0xcdcdcd00,0x4a4a4a00,0x90909000,0x33333300,
 208     0x73737300,0x67676700,0xf6f6f600,0xf3f3f300,
 209     0x9d9d9d00,0x7f7f7f00,0xbfbfbf00,0xe2e2e200,
 210     0x52525200,0x9b9b9b00,0xd8d8d800,0x26262600,
 211     0xc8c8c800,0x37373700,0xc6c6c600,0x3b3b3b00,
 212     0x81818100,0x96969600,0x6f6f6f00,0x4b4b4b00,
 213     0x13131300,0xbebebe00,0x63636300,0x2e2e2e00,
 214     0xe9e9e900,0x79797900,0xa7a7a700,0x8c8c8c00,
 215     0x9f9f9f00,0x6e6e6e00,0xbcbcbc00,0x8e8e8e00,
 216     0x29292900,0xf5f5f500,0xf9f9f900,0xb6b6b600,
 217     0x2f2f2f00,0xfdfdfd00,0xb4b4b400,0x59595900,
 218     0x78787800,0x98989800,0x06060600,0x6a6a6a00,
 219     0xe7e7e700,0x46464600,0x71717100,0xbababa00,
 220     0xd4d4d400,0x25252500,0xababab00,0x42424200,
 221     0x88888800,0xa2a2a200,0x8d8d8d00,0xfafafa00,
 222     0x72727200,0x07070700,0xb9b9b900,0x55555500,
 223     0xf8f8f800,0xeeeeee00,0xacacac00,0x0a0a0a00,
 224     0x36363600,0x49494900,0x2a2a2a00,0x68686800,
 225     0x3c3c3c00,0x38383800,0xf1f1f100,0xa4a4a400,
 226     0x40404000,0x28282800,0xd3d3d300,0x7b7b7b00,
 227     0xbbbbbb00,0xc9c9c900,0x43434300,0xc1c1c100,
 228     0x15151500,0xe3e3e300,0xadadad00,0xf4f4f400,
 229     0x77777700,0xc7c7c700,0x80808000,0x9e9e9e00,
 230 };
 231
 232 static const uint32_t camellia_sp0222[256] = {
 233     0x00e0e0e0,0x00050505,0x00585858,0x00d9d9d9,
 234     0x00676767,0x004e4e4e,0x00818181,0x00cbcbcb,
 235     0x00c9c9c9,0x000b0b0b,0x00aeaeae,0x006a6a6a,
 236     0x00d5d5d5,0x00181818,0x005d5d5d,0x00828282,
 237     0x00464646,0x00dfdfdf,0x00d6d6d6,0x00272727,
 238     0x008a8a8a,0x00323232,0x004b4b4b,0x00424242,
 239     0x00dbdbdb,0x001c1c1c,0x009e9e9e,0x009c9c9c,
 240     0x003a3a3a,0x00cacaca,0x00252525,0x007b7b7b,
 241     0x000d0d0d,0x00717171,0x005f5f5f,0x001f1f1f,
 242     0x00f8f8f8,0x00d7d7d7,0x003e3e3e,0x009d9d9d,
 243     0x007c7c7c,0x00606060,0x00b9b9b9,0x00bebebe,
 244     0x00bcbcbc,0x008b8b8b,0x00161616,0x00343434,
 245     0x004d4d4d,0x00c3c3c3,0x00727272,0x00959595,
 246     0x00ababab,0x008e8e8e,0x00bababa,0x007a7a7a,
 247     0x00b3b3b3,0x00020202,0x00b4b4b4,0x00adadad,
 248     0x00a2a2a2,0x00acacac,0x00d8d8d8,0x009a9a9a,
 249     0x00171717,0x001a1a1a,0x00353535,0x00cccccc,
 250     0x00f7f7f7,0x00999999,0x00616161,0x005a5a5a,
 251     0x00e8e8e8,0x00242424,0x00565656,0x00404040,
 252     0x00e1e1e1,0x00636363,0x00090909,0x00333333,
 253     0x00bfbfbf,0x00989898,0x00979797,0x00858585,
 254     0x00686868,0x00fcfcfc,0x00ececec,0x000a0a0a,
 255     0x00dadada,0x006f6f6f,0x00535353,0x00626262,
 256     0x00a3a3a3,0x002e2e2e,0x00080808,0x00afafaf,
 257     0x00282828,0x00b0b0b0,0x00747474,0x00c2c2c2,
 258     0x00bdbdbd,0x00363636,0x00222222,0x00383838,
 259     0x00646464,0x001e1e1e,0x00393939,0x002c2c2c,
 260     0x00a6a6a6,0x00303030,0x00e5e5e5,0x00444444,
 261     0x00fdfdfd,0x00888888,0x009f9f9f,0x00656565,
 262     0x00878787,0x006b6b6b,0x00f4f4f4,0x00232323,
 263     0x00484848,0x00101010,0x00d1d1d1,0x00515151,
 264     0x00c0c0c0,0x00f9f9f9,0x00d2d2d2,0x00a0a0a0,
 265     0x00555555,0x00a1a1a1,0x00414141,0x00fafafa,
 266     0x00434343,0x00131313,0x00c4c4c4,0x002f2f2f,
 267     0x00a8a8a8,0x00b6b6b6,0x003c3c3c,0x002b2b2b,
 268     0x00c1c1c1,0x00ffffff,0x00c8c8c8,0x00a5a5a5,
 269     0x00202020,0x00898989,0x00000000,0x00909090,
 270     0x00474747,0x00efefef,0x00eaeaea,0x00b7b7b7,
 271     0x00151515,0x00060606,0x00cdcdcd,0x00b5b5b5,
 272     0x00121212,0x007e7e7e,0x00bbbbbb,0x00292929,
 273     0x000f0f0f,0x00b8b8b8,0x00070707,0x00040404,
 274     0x009b9b9b,0x00949494,0x00212121,0x00666666,
 275     0x00e6e6e6,0x00cecece,0x00ededed,0x00e7e7e7,
 276     0x003b3b3b,0x00fefefe,0x007f7f7f,0x00c5c5c5,
 277     0x00a4a4a4,0x00373737,0x00b1b1b1,0x004c4c4c,
 278     0x00919191,0x006e6e6e,0x008d8d8d,0x00767676,
 279     0x00030303,0x002d2d2d,0x00dedede,0x00969696,
 280     0x00262626,0x007d7d7d,0x00c6c6c6,0x005c5c5c,
 281     0x00d3d3d3,0x00f2f2f2,0x004f4f4f,0x00191919,
 282     0x003f3f3f,0x00dcdcdc,0x00797979,0x001d1d1d,
 283     0x00525252,0x00ebebeb,0x00f3f3f3,0x006d6d6d,
 284     0x005e5e5e,0x00fbfbfb,0x00696969,0x00b2b2b2,
 285     0x00f0f0f0,0x00313131,0x000c0c0c,0x00d4d4d4,
 286     0x00cfcfcf,0x008c8c8c,0x00e2e2e2,0x00757575,
 287     0x00a9a9a9,0x004a4a4a,0x00575757,0x00848484,
 288     0x00111111,0x00454545,0x001b1b1b,0x00f5f5f5,
 289     0x00e4e4e4,0x000e0e0e,0x00737373,0x00aaaaaa,
 290     0x00f1f1f1,0x00dddddd,0x00595959,0x00141414,
 291     0x006c6c6c,0x00929292,0x00545454,0x00d0d0d0,
 292     0x00787878,0x00707070,0x00e3e3e3,0x00494949,
 293     0x00808080,0x00505050,0x00a7a7a7,0x00f6f6f6,
 294     0x00777777,0x00939393,0x00868686,0x00838383,
 295     0x002a2a2a,0x00c7c7c7,0x005b5b5b,0x00e9e9e9,
 296     0x00eeeeee,0x008f8f8f,0x00010101,0x003d3d3d,
 297 };
 298
 299 static const uint32_t camellia_sp3033[256] = {
 300     0x38003838,0x41004141,0x16001616,0x76007676,
 301     0xd900d9d9,0x93009393,0x60006060,0xf200f2f2,
 302     0x72007272,0xc200c2c2,0xab00abab,0x9a009a9a,
 303     0x75007575,0x06000606,0x57005757,0xa000a0a0,
 304     0x91009191,0xf700f7f7,0xb500b5b5,0xc900c9c9,
 305     0xa200a2a2,0x8c008c8c,0xd200d2d2,0x90009090,
 306     0xf600f6f6,0x07000707,0xa700a7a7,0x27002727,
 307     0x8e008e8e,0xb200b2b2,0x49004949,0xde00dede,
 308     0x43004343,0x5c005c5c,0xd700d7d7,0xc700c7c7,
 309     0x3e003e3e,0xf500f5f5,0x8f008f8f,0x67006767,
 310     0x1f001f1f,0x18001818,0x6e006e6e,0xaf00afaf,
 311     0x2f002f2f,0xe200e2e2,0x85008585,0x0d000d0d,
 312     0x53005353,0xf000f0f0,0x9c009c9c,0x65006565,
 313     0xea00eaea,0xa300a3a3,0xae00aeae,0x9e009e9e,
 314     0xec00ecec,0x80008080,0x2d002d2d,0x6b006b6b,
 315     0xa800a8a8,0x2b002b2b,0x36003636,0xa600a6a6,
 316     0xc500c5c5,0x86008686,0x4d004d4d,0x33003333,
 317     0xfd00fdfd,0x66006666,0x58005858,0x96009696,
 318     0x3a003a3a,0x09000909,0x95009595,0x10001010,
 319     0x78007878,0xd800d8d8,0x42004242,0xcc00cccc,
 320     0xef00efef,0x26002626,0xe500e5e5,0x61006161,
 321     0x1a001a1a,0x3f003f3f,0x3b003b3b,0x82008282,
 322     0xb600b6b6,0xdb00dbdb,0xd400d4d4,0x98009898,
 323     0xe800e8e8,0x8b008b8b,0x02000202,0xeb00ebeb,
 324     0x0a000a0a,0x2c002c2c,0x1d001d1d,0xb000b0b0,
 325     0x6f006f6f,0x8d008d8d,0x88008888,0x0e000e0e,
 326     0x19001919,0x87008787,0x4e004e4e,0x0b000b0b,
 327     0xa900a9a9,0x0c000c0c,0x79007979,0x11001111,
 328     0x7f007f7f,0x22002222,0xe700e7e7,0x59005959,
 329     0xe100e1e1,0xda00dada,0x3d003d3d,0xc800c8c8,
 330     0x12001212,0x04000404,0x74007474,0x54005454,
 331     0x30003030,0x7e007e7e,0xb400b4b4,0x28002828,
 332     0x55005555,0x68006868,0x50005050,0xbe00bebe,
 333     0xd000d0d0,0xc400c4c4,0x31003131,0xcb00cbcb,
 334     0x2a002a2a,0xad00adad,0x0f000f0f,0xca00caca,
 335     0x70007070,0xff00ffff,0x32003232,0x69006969,
 336     0x08000808,0x62006262,0x00000000,0x24002424,
 337     0xd100d1d1,0xfb00fbfb,0xba00baba,0xed00eded,
 338     0x45004545,0x81008181,0x73007373,0x6d006d6d,
 339     0x84008484,0x9f009f9f,0xee00eeee,0x4a004a4a,
 340     0xc300c3c3,0x2e002e2e,0xc100c1c1,0x01000101,
 341     0xe600e6e6,0x25002525,0x48004848,0x99009999,
 342     0xb900b9b9,0xb300b3b3,0x7b007b7b,0xf900f9f9,
 343     0xce00cece,0xbf00bfbf,0xdf00dfdf,0x71007171,
 344     0x29002929,0xcd00cdcd,0x6c006c6c,0x13001313,
 345     0x64006464,0x9b009b9b,0x63006363,0x9d009d9d,
 346     0xc000c0c0,0x4b004b4b,0xb700b7b7,0xa500a5a5,
 347     0x89008989,0x5f005f5f,0xb100b1b1,0x17001717,
 348     0xf400f4f4,0xbc00bcbc,0xd300d3d3,0x46004646,
 349     0xcf00cfcf,0x37003737,0x5e005e5e,0x47004747,
 350     0x94009494,0xfa00fafa,0xfc00fcfc,0x5b005b5b,
 351     0x97009797,0xfe00fefe,0x5a005a5a,0xac00acac,
 352     0x3c003c3c,0x4c004c4c,0x03000303,0x35003535,
 353     0xf300f3f3,0x23002323,0xb800b8b8,0x5d005d5d,
 354     0x6a006a6a,0x92009292,0xd500d5d5,0x21002121,
 355     0x44004444,0x51005151,0xc600c6c6,0x7d007d7d,
 356     0x39003939,0x83008383,0xdc00dcdc,0xaa00aaaa,
 357     0x7c007c7c,0x77007777,0x56005656,0x05000505,
 358     0x1b001b1b,0xa400a4a4,0x15001515,0x34003434,
 359     0x1e001e1e,0x1c001c1c,0xf800f8f8,0x52005252,
 360     0x20002020,0x14001414,0xe900e9e9,0xbd00bdbd,
 361     0xdd00dddd,0xe400e4e4,0xa100a1a1,0xe000e0e0,
 362     0x8a008a8a,0xf100f1f1,0xd600d6d6,0x7a007a7a,
 363     0xbb00bbbb,0xe300e3e3,0x40004040,0x4f004f4f,
 364 };
 365
 366 static const uint32_t camellia_sp4404[256] = {
 367     0x70700070,0x2c2c002c,0xb3b300b3,0xc0c000c0,
 368     0xe4e400e4,0x57570057,0xeaea00ea,0xaeae00ae,
 369     0x23230023,0x6b6b006b,0x45450045,0xa5a500a5,
 370     0xeded00ed,0x4f4f004f,0x1d1d001d,0x92920092,
 371     0x86860086,0xafaf00af,0x7c7c007c,0x1f1f001f,
 372     0x3e3e003e,0xdcdc00dc,0x5e5e005e,0x0b0b000b,
 373     0xa6a600a6,0x39390039,0xd5d500d5,0x5d5d005d,
 374     0xd9d900d9,0x5a5a005a,0x51510051,0x6c6c006c,
 375     0x8b8b008b,0x9a9a009a,0xfbfb00fb,0xb0b000b0,
 376     0x74740074,0x2b2b002b,0xf0f000f0,0x84840084,
 377     0xdfdf00df,0xcbcb00cb,0x34340034,0x76760076,
 378     0x6d6d006d,0xa9a900a9,0xd1d100d1,0x04040004,
 379     0x14140014,0x3a3a003a,0xdede00de,0x11110011,
 380     0x32320032,0x9c9c009c,0x53530053,0xf2f200f2,
 381     0xfefe00fe,0xcfcf00cf,0xc3c300c3,0x7a7a007a,
 382     0x24240024,0xe8e800e8,0x60600060,0x69690069,
 383     0xaaaa00aa,0xa0a000a0,0xa1a100a1,0x62620062,
 384     0x54540054,0x1e1e001e,0xe0e000e0,0x64640064,
 385     0x10100010,0x00000000,0xa3a300a3,0x75750075,
 386     0x8a8a008a,0xe6e600e6,0x09090009,0xdddd00dd,
 387     0x87870087,0x83830083,0xcdcd00cd,0x90900090,
 388     0x73730073,0xf6f600f6,0x9d9d009d,0xbfbf00bf,
 389     0x52520052,0xd8d800d8,0xc8c800c8,0xc6c600c6,
 390     0x81810081,0x6f6f006f,0x13130013,0x63630063,
 391     0xe9e900e9,0xa7a700a7,0x9f9f009f,0xbcbc00bc,
 392     0x29290029,0xf9f900f9,0x2f2f002f,0xb4b400b4,
 393     0x78780078,0x06060006,0xe7e700e7,0x71710071,
 394     0xd4d400d4,0xabab00ab,0x88880088,0x8d8d008d,
 395     0x72720072,0xb9b900b9,0xf8f800f8,0xacac00ac,
 396     0x36360036,0x2a2a002a,0x3c3c003c,0xf1f100f1,
 397     0x40400040,0xd3d300d3,0xbbbb00bb,0x43430043,
 398     0x15150015,0xadad00ad,0x77770077,0x80800080,
 399     0x82820082,0xecec00ec,0x27270027,0xe5e500e5,
 400     0x85850085,0x35350035,0x0c0c000c,0x41410041,
 401     0xefef00ef,0x93930093,0x19190019,0x21210021,
 402     0x0e0e000e,0x4e4e004e,0x65650065,0xbdbd00bd,
 403     0xb8b800b8,0x8f8f008f,0xebeb00eb,0xcece00ce,
 404     0x30300030,0x5f5f005f,0xc5c500c5,0x1a1a001a,
 405     0xe1e100e1,0xcaca00ca,0x47470047,0x3d3d003d,
 406     0x01010001,0xd6d600d6,0x56560056,0x4d4d004d,
 407     0x0d0d000d,0x66660066,0xcccc00cc,0x2d2d002d,
 408     0x12120012,0x20200020,0xb1b100b1,0x99990099,
 409     0x4c4c004c,0xc2c200c2,0x7e7e007e,0x05050005,
 410     0xb7b700b7,0x31310031,0x17170017,0xd7d700d7,
 411     0x58580058,0x61610061,0x1b1b001b,0x1c1c001c,
 412     0x0f0f000f,0x16160016,0x18180018,0x22220022,
 413     0x44440044,0xb2b200b2,0xb5b500b5,0x91910091,
 414     0x08080008,0xa8a800a8,0xfcfc00fc,0x50500050,
 415     0xd0d000d0,0x7d7d007d,0x89890089,0x97970097,
 416     0x5b5b005b,0x95950095,0xffff00ff,0xd2d200d2,
 417     0xc4c400c4,0x48480048,0xf7f700f7,0xdbdb00db,
 418     0x03030003,0xdada00da,0x3f3f003f,0x94940094,
 419     0x5c5c005c,0x02020002,0x4a4a004a,0x33330033,
 420     0x67670067,0xf3f300f3,0x7f7f007f,0xe2e200e2,
 421     0x9b9b009b,0x26260026,0x37370037,0x3b3b003b,
 422     0x96960096,0x4b4b004b,0xbebe00be,0x2e2e002e,
 423     0x79790079,0x8c8c008c,0x6e6e006e,0x8e8e008e,
 424     0xf5f500f5,0xb6b600b6,0xfdfd00fd,0x59590059,
 425     0x98980098,0x6a6a006a,0x46460046,0xbaba00ba,
 426     0x25250025,0x42420042,0xa2a200a2,0xfafa00fa,
 427     0x07070007,0x55550055,0xeeee00ee,0x0a0a000a,
 428     0x49490049,0x68680068,0x38380038,0xa4a400a4,
 429     0x28280028,0x7b7b007b,0xc9c900c9,0xc1c100c1,
 430     0xe3e300e3,0xf4f400f4,0xc7c700c7,0x9e9e009e,
 431 };
 432
 433
 434 /*
 435  * Stuff related to the Camellia key schedule
 436  */
 437 #define subl(x) subL[(x)]
 438 #define subr(x) subR[(x)]
 439
 440 void
 441 camellia_setup128(const unsigned char *key, uint32_t *subkey)
 442 {
 443     uint32_t kll, klr, krl, krr;
 444     uint32_t il, ir, t0, t1, w0, w1;
 445     uint32_t kw4l, kw4r, dw, tl, tr;
 446     uint32_t subL[26];
 447     uint32_t subR[26];
 448
 449     /*
 450      *  k == kll || klr || krl || krr (|| is concatination)
 451      */
 452     kll = GETU32(key     );
 453     klr = GETU32(key +  4);
 454     krl = GETU32(key +  8);
 455     krr = GETU32(key + 12);
 456     /*
 457      * generate KL dependent subkeys
 458      */
 459     subl(0) = kll; subr(0) = klr;
 460     subl(1) = krl; subr(1) = krr;
 461     CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 462     subl(4) = kll; subr(4) = klr;
 463     subl(5) = krl; subr(5) = krr;
 464     CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 30);
 465     subl(10) = kll; subr(10) = klr;
 466     subl(11) = krl; subr(11) = krr;
 467     CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 468     subl(13) = krl; subr(13) = krr;
 469     CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 17);
 470     subl(16) = kll; subr(16) = klr;
 471     subl(17) = krl; subr(17) = krr;
 472     CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 17);
 473     subl(18) = kll; subr(18) = klr;
 474     subl(19) = krl; subr(19) = krr;
 475     CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 17);
 476     subl(22) = kll; subr(22) = klr;
 477     subl(23) = krl; subr(23) = krr;
 478
 479     /* generate KA */
 480     kll = subl(0); klr = subr(0);
 481     krl = subl(1); krr = subr(1);
 482     CAMELLIA_F(kll, klr, CAMELLIA_SIGMA1L, CAMELLIA_SIGMA1R,
 483                w0, w1, il, ir, t0, t1);
 484     krl ^= w0; krr ^= w1;
 485     CAMELLIA_F(krl, krr, CAMELLIA_SIGMA2L, CAMELLIA_SIGMA2R,
 486                kll, klr, il, ir, t0, t1);
 487     CAMELLIA_F(kll, klr, CAMELLIA_SIGMA3L, CAMELLIA_SIGMA3R,
 488                krl, krr, il, ir, t0, t1);
 489     krl ^= w0; krr ^= w1;
 490     CAMELLIA_F(krl, krr, CAMELLIA_SIGMA4L, CAMELLIA_SIGMA4R,
 491                w0, w1, il, ir, t0, t1);
 492     kll ^= w0; klr ^= w1;
 493
 494     /* generate KA dependent subkeys */
 495     subl(2) = kll; subr(2) = klr;
 496     subl(3) = krl; subr(3) = krr;
 497     CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 498     subl(6) = kll; subr(6) = klr;
 499     subl(7) = krl; subr(7) = krr;
 500     CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 501     subl(8) = kll; subr(8) = klr;
 502     subl(9) = krl; subr(9) = krr;
 503     CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 504     subl(12) = kll; subr(12) = klr;
 505     CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 506     subl(14) = kll; subr(14) = klr;
 507     subl(15) = krl; subr(15) = krr;
 508     CAMELLIA_ROLDQo32(kll, klr, krl, krr, w0, w1, 34);
 509     subl(20) = kll; subr(20) = klr;
 510     subl(21) = krl; subr(21) = krr;
 511     CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 17);
 512     subl(24) = kll; subr(24) = klr;
 513     subl(25) = krl; subr(25) = krr;
 514
 515
 516     /* absorb kw2 to other subkeys */
 517     subl(3) ^= subl(1); subr(3) ^= subr(1);
 518     subl(5) ^= subl(1); subr(5) ^= subr(1);
 519     subl(7) ^= subl(1); subr(7) ^= subr(1);
 520     subl(1) ^= subr(1) & ~subr(9);
 521     dw = subl(1) & subl(9), subr(1) ^= CAMELLIA_RL1(dw);
 522     subl(11) ^= subl(1); subr(11) ^= subr(1);
 523     subl(13) ^= subl(1); subr(13) ^= subr(1);
 524     subl(15) ^= subl(1); subr(15) ^= subr(1);
 525     subl(1) ^= subr(1) & ~subr(17);
 526     dw = subl(1) & subl(17), subr(1) ^= CAMELLIA_RL1(dw);
 527     subl(19) ^= subl(1); subr(19) ^= subr(1);
 528     subl(21) ^= subl(1); subr(21) ^= subr(1);
 529     subl(23) ^= subl(1); subr(23) ^= subr(1);
 530     subl(24) ^= subl(1); subr(24) ^= subr(1);
 531
 532     /* absorb kw4 to other subkeys */
 533     kw4l = subl(25); kw4r = subr(25);
 534     subl(22) ^= kw4l; subr(22) ^= kw4r;
 535     subl(20) ^= kw4l; subr(20) ^= kw4r;
 536     subl(18) ^= kw4l; subr(18) ^= kw4r;
 537     kw4l ^= kw4r & ~subr(16);
 538     dw = kw4l & subl(16), kw4r ^= CAMELLIA_RL1(dw);
 539     subl(14) ^= kw4l; subr(14) ^= kw4r;
 540     subl(12) ^= kw4l; subr(12) ^= kw4r;
 541     subl(10) ^= kw4l; subr(10) ^= kw4r;
 542     kw4l ^= kw4r & ~subr(8);
 543     dw = kw4l & subl(8), kw4r ^= CAMELLIA_RL1(dw);
 544     subl(6) ^= kw4l; subr(6) ^= kw4r;
 545     subl(4) ^= kw4l; subr(4) ^= kw4r;
 546     subl(2) ^= kw4l; subr(2) ^= kw4r;
 547     subl(0) ^= kw4l; subr(0) ^= kw4r;
 548
 549     /* key XOR is end of F-function */
 550     SUBL(0) = subl(0) ^ subl(2);
 551     SUBR(0) = subr(0) ^ subr(2);
 552     SUBL(2) = subl(3);
 553     SUBR(2) = subr(3);
 554     SUBL(3) = subl(2) ^ subl(4);
 555     SUBR(3) = subr(2) ^ subr(4);
 556     SUBL(4) = subl(3) ^ subl(5);
 557     SUBR(4) = subr(3) ^ subr(5);
 558     SUBL(5) = subl(4) ^ subl(6);
 559     SUBR(5) = subr(4) ^ subr(6);
 560     SUBL(6) = subl(5) ^ subl(7);
 561     SUBR(6) = subr(5) ^ subr(7);
 562     tl = subl(10) ^ (subr(10) & ~subr(8));
 563     dw = tl & subl(8), tr = subr(10) ^ CAMELLIA_RL1(dw);
 564     SUBL(7) = subl(6) ^ tl;
 565     SUBR(7) = subr(6) ^ tr;
 566     SUBL(8) = subl(8);
 567     SUBR(8) = subr(8);
 568     SUBL(9) = subl(9);
 569     SUBR(9) = subr(9);
 570     tl = subl(7) ^ (subr(7) & ~subr(9));
 571     dw = tl & subl(9), tr = subr(7) ^ CAMELLIA_RL1(dw);
 572     SUBL(10) = tl ^ subl(11);
 573     SUBR(10) = tr ^ subr(11);
 574     SUBL(11) = subl(10) ^ subl(12);
 575     SUBR(11) = subr(10) ^ subr(12);
 576     SUBL(12) = subl(11) ^ subl(13);
 577     SUBR(12) = subr(11) ^ subr(13);
 578     SUBL(13) = subl(12) ^ subl(14);
 579     SUBR(13) = subr(12) ^ subr(14);
 580     SUBL(14) = subl(13) ^ subl(15);
 581     SUBR(14) = subr(13) ^ subr(15);
 582     tl = subl(18) ^ (subr(18) & ~subr(16));
 583     dw = tl & subl(16), tr = subr(18) ^ CAMELLIA_RL1(dw);
 584     SUBL(15) = subl(14) ^ tl;
 585     SUBR(15) = subr(14) ^ tr;
 586     SUBL(16) = subl(16);
 587     SUBR(16) = subr(16);
 588     SUBL(17) = subl(17);
 589     SUBR(17) = subr(17);
 590     tl = subl(15) ^ (subr(15) & ~subr(17));
 591     dw = tl & subl(17), tr = subr(15) ^ CAMELLIA_RL1(dw);
 592     SUBL(18) = tl ^ subl(19);
 593     SUBR(18) = tr ^ subr(19);
 594     SUBL(19) = subl(18) ^ subl(20);
 595     SUBR(19) = subr(18) ^ subr(20);
 596     SUBL(20) = subl(19) ^ subl(21);
 597     SUBR(20) = subr(19) ^ subr(21);
 598     SUBL(21) = subl(20) ^ subl(22);
 599     SUBR(21) = subr(20) ^ subr(22);
 600     SUBL(22) = subl(21) ^ subl(23);
 601     SUBR(22) = subr(21) ^ subr(23);
 602     SUBL(23) = subl(22);
 603     SUBR(23) = subr(22);
 604     SUBL(24) = subl(24) ^ subl(23);
 605     SUBR(24) = subr(24) ^ subr(23);
 606
 607     /* apply the inverse of the last half of P-function */
 608     dw = SUBL(2) ^ SUBR(2), dw = CAMELLIA_RL8(dw);
 609     SUBR(2) = SUBL(2) ^ dw, SUBL(2) = dw;
 610     dw = SUBL(3) ^ SUBR(3), dw = CAMELLIA_RL8(dw);
 611     SUBR(3) = SUBL(3) ^ dw, SUBL(3) = dw;
 612     dw = SUBL(4) ^ SUBR(4), dw = CAMELLIA_RL8(dw);
 613     SUBR(4) = SUBL(4) ^ dw, SUBL(4) = dw;
 614     dw = SUBL(5) ^ SUBR(5), dw = CAMELLIA_RL8(dw);
 615     SUBR(5) = SUBL(5) ^ dw, SUBL(5) = dw;
 616     dw = SUBL(6) ^ SUBR(6), dw = CAMELLIA_RL8(dw);
 617     SUBR(6) = SUBL(6) ^ dw, SUBL(6) = dw;
 618     dw = SUBL(7) ^ SUBR(7), dw = CAMELLIA_RL8(dw);
 619     SUBR(7) = SUBL(7) ^ dw, SUBL(7) = dw;
 620     dw = SUBL(10) ^ SUBR(10), dw = CAMELLIA_RL8(dw);
 621     SUBR(10) = SUBL(10) ^ dw, SUBL(10) = dw;
 622     dw = SUBL(11) ^ SUBR(11), dw = CAMELLIA_RL8(dw);
 623     SUBR(11) = SUBL(11) ^ dw, SUBL(11) = dw;
 624     dw = SUBL(12) ^ SUBR(12), dw = CAMELLIA_RL8(dw);
 625     SUBR(12) = SUBL(12) ^ dw, SUBL(12) = dw;
 626     dw = SUBL(13) ^ SUBR(13), dw = CAMELLIA_RL8(dw);
 627     SUBR(13) = SUBL(13) ^ dw, SUBL(13) = dw;
 628     dw = SUBL(14) ^ SUBR(14), dw = CAMELLIA_RL8(dw);
 629     SUBR(14) = SUBL(14) ^ dw, SUBL(14) = dw;
 630     dw = SUBL(15) ^ SUBR(15), dw = CAMELLIA_RL8(dw);
 631     SUBR(15) = SUBL(15) ^ dw, SUBL(15) = dw;
 632     dw = SUBL(18) ^ SUBR(18), dw = CAMELLIA_RL8(dw);
 633     SUBR(18) = SUBL(18) ^ dw, SUBL(18) = dw;
 634     dw = SUBL(19) ^ SUBR(19), dw = CAMELLIA_RL8(dw);
 635     SUBR(19) = SUBL(19) ^ dw, SUBL(19) = dw;
 636     dw = SUBL(20) ^ SUBR(20), dw = CAMELLIA_RL8(dw);
 637     SUBR(20) = SUBL(20) ^ dw, SUBL(20) = dw;
 638     dw = SUBL(21) ^ SUBR(21), dw = CAMELLIA_RL8(dw);
 639     SUBR(21) = SUBL(21) ^ dw, SUBL(21) = dw;
 640     dw = SUBL(22) ^ SUBR(22), dw = CAMELLIA_RL8(dw);
 641     SUBR(22) = SUBL(22) ^ dw, SUBL(22) = dw;
 642     dw = SUBL(23) ^ SUBR(23), dw = CAMELLIA_RL8(dw);
 643     SUBR(23) = SUBL(23) ^ dw, SUBL(23) = dw;
 644 }
 645
 646 void
 647 camellia_setup256(const unsigned char *key, uint32_t *subkey)
 648 {
 649     uint32_t kll,klr,krl,krr;           /* left half of key */
 650     uint32_t krll,krlr,krrl,krrr;       /* right half of key */
 651     uint32_t il, ir, t0, t1, w0, w1;    /* temporary variables */
 652     uint32_t kw4l, kw4r, dw, tl, tr;
 653     uint32_t subL[34];
 654     uint32_t subR[34];
 655
 656     /*
 657      *  key = (kll || klr || krl || krr || krll || krlr || krrl || krrr)
 658      *  (|| is concatination)
 659      */
 660
 661     kll  = GETU32(key     );
 662     klr  = GETU32(key +  4);
 663     krl  = GETU32(key +  8);
 664     krr  = GETU32(key + 12);
 665     krll = GETU32(key + 16);
 666     krlr = GETU32(key + 20);
 667     krrl = GETU32(key + 24);
 668     krrr = GETU32(key + 28);
 669
 670     /* generate KL dependent subkeys */
 671     subl(0) = kll; subr(0) = klr;
 672     subl(1) = krl; subr(1) = krr;
 673     CAMELLIA_ROLDQo32(kll, klr, krl, krr, w0, w1, 45);
 674     subl(12) = kll; subr(12) = klr;
 675     subl(13) = krl; subr(13) = krr;
 676     CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 677     subl(16) = kll; subr(16) = klr;
 678     subl(17) = krl; subr(17) = krr;
 679     CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 17);
 680     subl(22) = kll; subr(22) = klr;
 681     subl(23) = krl; subr(23) = krr;
 682     CAMELLIA_ROLDQo32(kll, klr, krl, krr, w0, w1, 34);
 683     subl(30) = kll; subr(30) = klr;
 684     subl(31) = krl; subr(31) = krr;
 685
 686     /* generate KR dependent subkeys */
 687     CAMELLIA_ROLDQ(krll, krlr, krrl, krrr, w0, w1, 15);
 688     subl(4) = krll; subr(4) = krlr;
 689     subl(5) = krrl; subr(5) = krrr;
 690     CAMELLIA_ROLDQ(krll, krlr, krrl, krrr, w0, w1, 15);
 691     subl(8) = krll; subr(8) = krlr;
 692     subl(9) = krrl; subr(9) = krrr;
 693     CAMELLIA_ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
 694     subl(18) = krll; subr(18) = krlr;
 695     subl(19) = krrl; subr(19) = krrr;
 696     CAMELLIA_ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 34);
 697     subl(26) = krll; subr(26) = krlr;
 698     subl(27) = krrl; subr(27) = krrr;
 699     CAMELLIA_ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 34);
 700
 701     /* generate KA */
 702     kll = subl(0) ^ krll; klr = subr(0) ^ krlr;
 703     krl = subl(1) ^ krrl; krr = subr(1) ^ krrr;
 704     CAMELLIA_F(kll, klr, CAMELLIA_SIGMA1L, CAMELLIA_SIGMA1R,
 705                w0, w1, il, ir, t0, t1);
 706     krl ^= w0; krr ^= w1;
 707     CAMELLIA_F(krl, krr, CAMELLIA_SIGMA2L, CAMELLIA_SIGMA2R,
 708                kll, klr, il, ir, t0, t1);
 709     kll ^= krll; klr ^= krlr;
 710     CAMELLIA_F(kll, klr, CAMELLIA_SIGMA3L, CAMELLIA_SIGMA3R,
 711                krl, krr, il, ir, t0, t1);
 712     krl ^= w0 ^ krrl; krr ^= w1 ^ krrr;
 713     CAMELLIA_F(krl, krr, CAMELLIA_SIGMA4L, CAMELLIA_SIGMA4R,
 714                w0, w1, il, ir, t0, t1);
 715     kll ^= w0; klr ^= w1;
 716
 717     /* generate KB */
 718     krll ^= kll; krlr ^= klr;
 719     krrl ^= krl; krrr ^= krr;
 720     CAMELLIA_F(krll, krlr, CAMELLIA_SIGMA5L, CAMELLIA_SIGMA5R,
 721                w0, w1, il, ir, t0, t1);
 722     krrl ^= w0; krrr ^= w1;
 723     CAMELLIA_F(krrl, krrr, CAMELLIA_SIGMA6L, CAMELLIA_SIGMA6R,
 724                w0, w1, il, ir, t0, t1);
 725     krll ^= w0; krlr ^= w1;
 726
 727     /* generate KA dependent subkeys */
 728     CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 729     subl(6) = kll; subr(6) = klr;
 730     subl(7) = krl; subr(7) = krr;
 731     CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 30);
 732     subl(14) = kll; subr(14) = klr;
 733     subl(15) = krl; subr(15) = krr;
 734     subl(24) = klr; subr(24) = krl;
 735     subl(25) = krr; subr(25) = kll;
 736     CAMELLIA_ROLDQo32(kll, klr, krl, krr, w0, w1, 49);
 737     subl(28) = kll; subr(28) = klr;
 738     subl(29) = krl; subr(29) = krr;
 739
 740     /* generate KB dependent subkeys */
 741     subl(2) = krll; subr(2) = krlr;
 742     subl(3) = krrl; subr(3) = krrr;
 743     CAMELLIA_ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
 744     subl(10) = krll; subr(10) = krlr;
 745     subl(11) = krrl; subr(11) = krrr;
 746     CAMELLIA_ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
 747     subl(20) = krll; subr(20) = krlr;
 748     subl(21) = krrl; subr(21) = krrr;
 749     CAMELLIA_ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 51);
 750     subl(32) = krll; subr(32) = krlr;
 751     subl(33) = krrl; subr(33) = krrr;
 752
 753     /* absorb kw2 to other subkeys */
 754     subl(3) ^= subl(1); subr(3) ^= subr(1);
 755     subl(5) ^= subl(1); subr(5) ^= subr(1);
 756     subl(7) ^= subl(1); subr(7) ^= subr(1);
 757     subl(1) ^= subr(1) & ~subr(9);
 758     dw = subl(1) & subl(9), subr(1) ^= CAMELLIA_RL1(dw);
 759     subl(11) ^= subl(1); subr(11) ^= subr(1);
 760     subl(13) ^= subl(1); subr(13) ^= subr(1);
 761     subl(15) ^= subl(1); subr(15) ^= subr(1);
 762     subl(1) ^= subr(1) & ~subr(17);
 763     dw = subl(1) & subl(17), subr(1) ^= CAMELLIA_RL1(dw);
 764     subl(19) ^= subl(1); subr(19) ^= subr(1);
 765     subl(21) ^= subl(1); subr(21) ^= subr(1);
 766     subl(23) ^= subl(1); subr(23) ^= subr(1);
 767     subl(1) ^= subr(1) & ~subr(25);
 768     dw = subl(1) & subl(25), subr(1) ^= CAMELLIA_RL1(dw);
 769     subl(27) ^= subl(1); subr(27) ^= subr(1);
 770     subl(29) ^= subl(1); subr(29) ^= subr(1);
 771     subl(31) ^= subl(1); subr(31) ^= subr(1);
 772     subl(32) ^= subl(1); subr(32) ^= subr(1);
 773
 774
 775     /* absorb kw4 to other subkeys */
 776     kw4l = subl(33); kw4r = subr(33);
 777     subl(30) ^= kw4l; subr(30) ^= kw4r;
 778     subl(28) ^= kw4l; subr(28) ^= kw4r;
 779     subl(26) ^= kw4l; subr(26) ^= kw4r;
 780     kw4l ^= kw4r & ~subr(24);
 781     dw = kw4l & subl(24), kw4r ^= CAMELLIA_RL1(dw);
 782     subl(22) ^= kw4l; subr(22) ^= kw4r;
 783     subl(20) ^= kw4l; subr(20) ^= kw4r;
 784     subl(18) ^= kw4l; subr(18) ^= kw4r;
 785     kw4l ^= kw4r & ~subr(16);
 786     dw = kw4l & subl(16), kw4r ^= CAMELLIA_RL1(dw);
 787     subl(14) ^= kw4l; subr(14) ^= kw4r;
 788     subl(12) ^= kw4l; subr(12) ^= kw4r;
 789     subl(10) ^= kw4l; subr(10) ^= kw4r;
 790     kw4l ^= kw4r & ~subr(8);
 791     dw = kw4l & subl(8), kw4r ^= CAMELLIA_RL1(dw);
 792     subl(6) ^= kw4l; subr(6) ^= kw4r;
 793     subl(4) ^= kw4l; subr(4) ^= kw4r;
 794     subl(2) ^= kw4l; subr(2) ^= kw4r;
 795     subl(0) ^= kw4l; subr(0) ^= kw4r;
 796
 797     /* key XOR is end of F-function */
 798     SUBL(0) = subl(0) ^ subl(2);
 799     SUBR(0) = subr(0) ^ subr(2);
 800     SUBL(2) = subl(3);
 801     SUBR(2) = subr(3);
 802     SUBL(3) = subl(2) ^ subl(4);
 803     SUBR(3) = subr(2) ^ subr(4);
 804     SUBL(4) = subl(3) ^ subl(5);
 805     SUBR(4) = subr(3) ^ subr(5);
 806     SUBL(5) = subl(4) ^ subl(6);
 807     SUBR(5) = subr(4) ^ subr(6);
 808     SUBL(6) = subl(5) ^ subl(7);
 809     SUBR(6) = subr(5) ^ subr(7);
 810     tl = subl(10) ^ (subr(10) & ~subr(8));
 811     dw = tl & subl(8), tr = subr(10) ^ CAMELLIA_RL1(dw);
 812     SUBL(7) = subl(6) ^ tl;
 813     SUBR(7) = subr(6) ^ tr;
 814     SUBL(8) = subl(8);
 815     SUBR(8) = subr(8);
 816     SUBL(9) = subl(9);
 817     SUBR(9) = subr(9);
 818     tl = subl(7) ^ (subr(7) & ~subr(9));
 819     dw = tl & subl(9), tr = subr(7) ^ CAMELLIA_RL1(dw);
 820     SUBL(10) = tl ^ subl(11);
 821     SUBR(10) = tr ^ subr(11);
 822     SUBL(11) = subl(10) ^ subl(12);
 823     SUBR(11) = subr(10) ^ subr(12);
 824     SUBL(12) = subl(11) ^ subl(13);
 825     SUBR(12) = subr(11) ^ subr(13);
 826     SUBL(13) = subl(12) ^ subl(14);
 827     SUBR(13) = subr(12) ^ subr(14);
 828     SUBL(14) = subl(13) ^ subl(15);
 829     SUBR(14) = subr(13) ^ subr(15);
 830     tl = subl(18) ^ (subr(18) & ~subr(16));
 831     dw = tl & subl(16), tr = subr(18) ^ CAMELLIA_RL1(dw);
 832     SUBL(15) = subl(14) ^ tl;
 833     SUBR(15) = subr(14) ^ tr;
 834     SUBL(16) = subl(16);
 835     SUBR(16) = subr(16);
 836     SUBL(17) = subl(17);
 837     SUBR(17) = subr(17);
 838     tl = subl(15) ^ (subr(15) & ~subr(17));
 839     dw = tl & subl(17), tr = subr(15) ^ CAMELLIA_RL1(dw);
 840     SUBL(18) = tl ^ subl(19);
 841     SUBR(18) = tr ^ subr(19);
 842     SUBL(19) = subl(18) ^ subl(20);
 843     SUBR(19) = subr(18) ^ subr(20);
 844     SUBL(20) = subl(19) ^ subl(21);
 845     SUBR(20) = subr(19) ^ subr(21);
 846     SUBL(21) = subl(20) ^ subl(22);
 847     SUBR(21) = subr(20) ^ subr(22);
 848     SUBL(22) = subl(21) ^ subl(23);
 849     SUBR(22) = subr(21) ^ subr(23);
 850     tl = subl(26) ^ (subr(26) & ~subr(24));
 851     dw = tl & subl(24), tr = subr(26) ^ CAMELLIA_RL1(dw);
 852     SUBL(23) = subl(22) ^ tl;
 853     SUBR(23) = subr(22) ^ tr;
 854     SUBL(24) = subl(24);
 855     SUBR(24) = subr(24);
 856     SUBL(25) = subl(25);
 857     SUBR(25) = subr(25);
 858     tl = subl(23) ^ (subr(23) & ~subr(25));
 859     dw = tl & subl(25), tr = subr(23) ^ CAMELLIA_RL1(dw);
 860     SUBL(26) = tl ^ subl(27);
 861     SUBR(26) = tr ^ subr(27);
 862     SUBL(27) = subl(26) ^ subl(28);
 863     SUBR(27) = subr(26) ^ subr(28);
 864     SUBL(28) = subl(27) ^ subl(29);
 865     SUBR(28) = subr(27) ^ subr(29);
 866     SUBL(29) = subl(28) ^ subl(30);
 867     SUBR(29) = subr(28) ^ subr(30);
 868     SUBL(30) = subl(29) ^ subl(31);
 869     SUBR(30) = subr(29) ^ subr(31);
 870     SUBL(31) = subl(30);
 871     SUBR(31) = subr(30);
 872     SUBL(32) = subl(32) ^ subl(31);
 873     SUBR(32) = subr(32) ^ subr(31);
 874
 875     /* apply the inverse of the last half of P-function */
 876     dw = SUBL(2) ^ SUBR(2), dw = CAMELLIA_RL8(dw);
 877     SUBR(2) = SUBL(2) ^ dw, SUBL(2) = dw;
 878     dw = SUBL(3) ^ SUBR(3), dw = CAMELLIA_RL8(dw);
 879     SUBR(3) = SUBL(3) ^ dw, SUBL(3) = dw;
 880     dw = SUBL(4) ^ SUBR(4), dw = CAMELLIA_RL8(dw);
 881     SUBR(4) = SUBL(4) ^ dw, SUBL(4) = dw;
 882     dw = SUBL(5) ^ SUBR(5), dw = CAMELLIA_RL8(dw);
 883     SUBR(5) = SUBL(5) ^ dw, SUBL(5) = dw;
 884     dw = SUBL(6) ^ SUBR(6), dw = CAMELLIA_RL8(dw);
 885     SUBR(6) = SUBL(6) ^ dw, SUBL(6) = dw;
 886     dw = SUBL(7) ^ SUBR(7), dw = CAMELLIA_RL8(dw);
 887     SUBR(7) = SUBL(7) ^ dw, SUBL(7) = dw;
 888     dw = SUBL(10) ^ SUBR(10), dw = CAMELLIA_RL8(dw);
 889     SUBR(10) = SUBL(10) ^ dw, SUBL(10) = dw;
 890     dw = SUBL(11) ^ SUBR(11), dw = CAMELLIA_RL8(dw);
 891     SUBR(11) = SUBL(11) ^ dw, SUBL(11) = dw;
 892     dw = SUBL(12) ^ SUBR(12), dw = CAMELLIA_RL8(dw);
 893     SUBR(12) = SUBL(12) ^ dw, SUBL(12) = dw;
 894     dw = SUBL(13) ^ SUBR(13), dw = CAMELLIA_RL8(dw);
 895     SUBR(13) = SUBL(13) ^ dw, SUBL(13) = dw;
 896     dw = SUBL(14) ^ SUBR(14), dw = CAMELLIA_RL8(dw);
 897     SUBR(14) = SUBL(14) ^ dw, SUBL(14) = dw;
 898     dw = SUBL(15) ^ SUBR(15), dw = CAMELLIA_RL8(dw);
 899     SUBR(15) = SUBL(15) ^ dw, SUBL(15) = dw;
 900     dw = SUBL(18) ^ SUBR(18), dw = CAMELLIA_RL8(dw);
 901     SUBR(18) = SUBL(18) ^ dw, SUBL(18) = dw;
 902     dw = SUBL(19) ^ SUBR(19), dw = CAMELLIA_RL8(dw);
 903     SUBR(19) = SUBL(19) ^ dw, SUBL(19) = dw;
 904     dw = SUBL(20) ^ SUBR(20), dw = CAMELLIA_RL8(dw);
 905     SUBR(20) = SUBL(20) ^ dw, SUBL(20) = dw;
 906     dw = SUBL(21) ^ SUBR(21), dw = CAMELLIA_RL8(dw);
 907     SUBR(21) = SUBL(21) ^ dw, SUBL(21) = dw;
 908     dw = SUBL(22) ^ SUBR(22), dw = CAMELLIA_RL8(dw);
 909     SUBR(22) = SUBL(22) ^ dw, SUBL(22) = dw;
 910     dw = SUBL(23) ^ SUBR(23), dw = CAMELLIA_RL8(dw);
 911     SUBR(23) = SUBL(23) ^ dw, SUBL(23) = dw;
 912     dw = SUBL(26) ^ SUBR(26), dw = CAMELLIA_RL8(dw);
 913     SUBR(26) = SUBL(26) ^ dw, SUBL(26) = dw;
 914     dw = SUBL(27) ^ SUBR(27), dw = CAMELLIA_RL8(dw);
 915     SUBR(27) = SUBL(27) ^ dw, SUBL(27) = dw;
 916     dw = SUBL(28) ^ SUBR(28), dw = CAMELLIA_RL8(dw);
 917     SUBR(28) = SUBL(28) ^ dw, SUBL(28) = dw;
 918     dw = SUBL(29) ^ SUBR(29), dw = CAMELLIA_RL8(dw);
 919     SUBR(29) = SUBL(29) ^ dw, SUBL(29) = dw;
 920     dw = SUBL(30) ^ SUBR(30), dw = CAMELLIA_RL8(dw);
 921     SUBR(30) = SUBL(30) ^ dw, SUBL(30) = dw;
 922     dw = SUBL(31) ^ SUBR(31), dw = CAMELLIA_RL8(dw);
 923     SUBR(31) = SUBL(31) ^ dw, SUBL(31) = dw;
 924 }
 925
 926 void
 927 camellia_setup192(const unsigned char *key, uint32_t *subkey)
 928 {
 929     unsigned char kk[32];
 930     uint32_t krll, krlr, krrl,krrr;
 931
 932     memcpy(kk, key, 24);
 933     memcpy((unsigned char *)&krll, key+16,4);
 934     memcpy((unsigned char *)&krlr, key+20,4);
 935     krrl = ~krll;
 936     krrr = ~krlr;
 937     memcpy(kk+24, (unsigned char *)&krrl, 4);
 938     memcpy(kk+28, (unsigned char *)&krrr, 4);
 939     camellia_setup256(kk, subkey);
 940 }
 941
 942
 943 /**
 944  * Stuff related to camellia encryption/decryption
 945  */
 946 void
 947 camellia_encrypt128(const uint32_t *subkey, uint32_t *io)
 948 {
 949     uint32_t il, ir, t0, t1;
 950
 951     /* pre whitening but absorb kw2*/
 952     io[0] ^= SUBL(0);
 953     io[1] ^= SUBR(0);
 954     /* main iteration */
 955
 956     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(2),SUBR(2),
 957                      io[2],io[3],il,ir,t0,t1);
 958     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(3),SUBR(3),
 959                      io[0],io[1],il,ir,t0,t1);
 960     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(4),SUBR(4),
 961                      io[2],io[3],il,ir,t0,t1);
 962     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(5),SUBR(5),
 963                      io[0],io[1],il,ir,t0,t1);
 964     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(6),SUBR(6),
 965                      io[2],io[3],il,ir,t0,t1);
 966     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(7),SUBR(7),
 967                      io[0],io[1],il,ir,t0,t1);
 968
 969     CAMELLIA_FLS(io[0],io[1],io[2],io[3], SUBL(8),SUBR(8), SUBL(9),SUBR(9),
 970                  t0,t1,il,ir);
 971
 972     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(10),SUBR(10),
 973                      io[2],io[3],il,ir,t0,t1);
 974     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(11),SUBR(11),
 975                      io[0],io[1],il,ir,t0,t1);
 976     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(12),SUBR(12),
 977                      io[2],io[3],il,ir,t0,t1);
 978     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(13),SUBR(13),
 979                      io[0],io[1],il,ir,t0,t1);
 980     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(14),SUBR(14),
 981                      io[2],io[3],il,ir,t0,t1);
 982     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(15),SUBR(15),
 983                      io[0],io[1],il,ir,t0,t1);
 984
 985     CAMELLIA_FLS(io[0],io[1],io[2],io[3], SUBL(16), SUBR(16), SUBL(17),SUBR(17),
 986                  t0,t1,il,ir);
 987
 988     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(18),SUBR(18),
 989                      io[2],io[3],il,ir,t0,t1);
 990     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(19),SUBR(19),
 991                      io[0],io[1],il,ir,t0,t1);
 992     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(20),SUBR(20),
 993                      io[2],io[3],il,ir,t0,t1);
 994     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(21),SUBR(21),
 995                      io[0],io[1],il,ir,t0,t1);
 996     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(22),SUBR(22),
 997                      io[2],io[3],il,ir,t0,t1);
 998     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(23),SUBR(23),
 999                      io[0],io[1],il,ir,t0,t1);
1000
1001     /* post whitening but kw4 */
1002     io[2] ^= SUBL(24);
1003     io[3] ^= SUBR(24);
1004
1005     t0 = io[0];
1006     t1 = io[1];
1007     io[0] = io[2];
1008     io[1] = io[3];
1009     io[2] = t0;
1010     io[3] = t1;
1011 }
1012
1013 void
1014 camellia_decrypt128(const uint32_t *subkey, uint32_t *io)
1015 {
1016     uint32_t il,ir,t0,t1;               /* temporary valiables */
1017
1018     /* pre whitening but absorb kw2*/
1019     io[0] ^= SUBL(24);
1020     io[1] ^= SUBR(24);
1021
1022     /* main iteration */
1023     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(23),SUBR(23),
1024                      io[2],io[3],il,ir,t0,t1);
1025     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(22),SUBR(22),
1026                      io[0],io[1],il,ir,t0,t1);
1027     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(21),SUBR(21),
1028                      io[2],io[3],il,ir,t0,t1);
1029     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(20),SUBR(20),
1030                      io[0],io[1],il,ir,t0,t1);
1031     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(19),SUBR(19),
1032                      io[2],io[3],il,ir,t0,t1);
1033     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(18),SUBR(18),
1034                      io[0],io[1],il,ir,t0,t1);
1035
1036     CAMELLIA_FLS(io[0],io[1],io[2],io[3],SUBL(17),SUBR(17),SUBL(16),SUBR(16),
1037                  t0,t1,il,ir);
1038
1039     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(15),SUBR(15),
1040                      io[2],io[3],il,ir,t0,t1);
1041     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(14),SUBR(14),
1042                      io[0],io[1],il,ir,t0,t1);
1043     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(13),SUBR(13),
1044                      io[2],io[3],il,ir,t0,t1);
1045     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(12),SUBR(12),
1046                      io[0],io[1],il,ir,t0,t1);
1047     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(11),SUBR(11),
1048                      io[2],io[3],il,ir,t0,t1);
1049     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(10),SUBR(10),
1050                      io[0],io[1],il,ir,t0,t1);
1051
1052     CAMELLIA_FLS(io[0],io[1],io[2],io[3], SUBL(9),SUBR(9), SUBL(8),SUBR(8),
1053                  t0,t1,il,ir);
1054
1055     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(7),SUBR(7),
1056                      io[2],io[3],il,ir,t0,t1);
1057     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(6),SUBR(6),
1058                      io[0],io[1],il,ir,t0,t1);
1059     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(5),SUBR(5),
1060                      io[2],io[3],il,ir,t0,t1);
1061     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(4),SUBR(4),
1062                      io[0],io[1],il,ir,t0,t1);
1063     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(3),SUBR(3),
1064                      io[2],io[3],il,ir,t0,t1);
1065     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(2),SUBR(2),
1066                      io[0],io[1],il,ir,t0,t1);
1067
1068     /* post whitening but kw4 */
1069     io[2] ^= SUBL(0);
1070     io[3] ^= SUBR(0);
1071
1072     t0 = io[0];
1073     t1 = io[1];
1074     io[0] = io[2];
1075     io[1] = io[3];
1076     io[2] = t0;
1077     io[3] = t1;
1078 }
1079
1080 /**
1081  * stuff for 192 and 256bit encryption/decryption
1082  */
1083 void
1084 camellia_encrypt256(const uint32_t *subkey, uint32_t *io)
1085 {
1086     uint32_t il,ir,t0,t1;           /* temporary valiables */
1087
1088     /* pre whitening but absorb kw2*/
1089     io[0] ^= SUBL(0);
1090     io[1] ^= SUBR(0);
1091
1092     /* main iteration */
1093     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(2),SUBR(2),
1094                      io[2],io[3],il,ir,t0,t1);
1095     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(3),SUBR(3),
1096                      io[0],io[1],il,ir,t0,t1);
1097     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(4),SUBR(4),
1098                      io[2],io[3],il,ir,t0,t1);
1099     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(5),SUBR(5),
1100                      io[0],io[1],il,ir,t0,t1);
1101     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(6),SUBR(6),
1102                      io[2],io[3],il,ir,t0,t1);
1103     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(7),SUBR(7),
1104                      io[0],io[1],il,ir,t0,t1);
1105
1106     CAMELLIA_FLS(io[0],io[1],io[2],io[3], SUBL(8),SUBR(8), SUBL(9),SUBR(9),
1107                  t0,t1,il,ir);
1108
1109     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(10),SUBR(10),
1110                      io[2],io[3],il,ir,t0,t1);
1111     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(11),SUBR(11),
1112                      io[0],io[1],il,ir,t0,t1);
1113     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(12),SUBR(12),
1114                      io[2],io[3],il,ir,t0,t1);
1115     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(13),SUBR(13),
1116                      io[0],io[1],il,ir,t0,t1);
1117     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(14),SUBR(14),
1118                      io[2],io[3],il,ir,t0,t1);
1119     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(15),SUBR(15),
1120                      io[0],io[1],il,ir,t0,t1);
1121
1122     CAMELLIA_FLS(io[0],io[1],io[2],io[3], SUBL(16),SUBR(16), SUBL(17),SUBR(17),
1123                  t0,t1,il,ir);
1124
1125     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(18),SUBR(18),
1126                      io[2],io[3],il,ir,t0,t1);
1127     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(19),SUBR(19),
1128                      io[0],io[1],il,ir,t0,t1);
1129     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(20),SUBR(20),
1130                      io[2],io[3],il,ir,t0,t1);
1131     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(21),SUBR(21),
1132                      io[0],io[1],il,ir,t0,t1);
1133     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(22),SUBR(22),
1134                      io[2],io[3],il,ir,t0,t1);
1135     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(23),SUBR(23),
1136                      io[0],io[1],il,ir,t0,t1);
1137
1138     CAMELLIA_FLS(io[0],io[1],io[2],io[3], SUBL(24),SUBR(24), SUBL(25),SUBR(25),
1139                  t0,t1,il,ir);
1140
1141     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(26),SUBR(26),
1142                      io[2],io[3],il,ir,t0,t1);
1143     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(27),SUBR(27),
1144                      io[0],io[1],il,ir,t0,t1);
1145     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(28),SUBR(28),
1146                      io[2],io[3],il,ir,t0,t1);
1147     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(29),SUBR(29),
1148                      io[0],io[1],il,ir,t0,t1);
1149     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(30),SUBR(30),
1150                      io[2],io[3],il,ir,t0,t1);
1151     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(31),SUBR(31),
1152                      io[0],io[1],il,ir,t0,t1);
1153
1154     /* post whitening but kw4 */
1155     io[2] ^= SUBL(32);
1156     io[3] ^= SUBR(32);
1157
1158     t0 = io[0];
1159     t1 = io[1];
1160     io[0] = io[2];
1161     io[1] = io[3];
1162     io[2] = t0;
1163     io[3] = t1;
1164 }
1165
1166 void
1167 camellia_decrypt256(const uint32_t *subkey, uint32_t *io)
1168 {
1169     uint32_t il,ir,t0,t1;           /* temporary valiables */
1170
1171     /* pre whitening but absorb kw2*/
1172     io[0] ^= SUBL(32);
1173     io[1] ^= SUBR(32);
1174
1175     /* main iteration */
1176     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(31),SUBR(31),
1177                      io[2],io[3],il,ir,t0,t1);
1178     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(30),SUBR(30),
1179                      io[0],io[1],il,ir,t0,t1);
1180     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(29),SUBR(29),
1181                      io[2],io[3],il,ir,t0,t1);
1182     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(28),SUBR(28),
1183                      io[0],io[1],il,ir,t0,t1);
1184     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(27),SUBR(27),
1185                      io[2],io[3],il,ir,t0,t1);
1186     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(26),SUBR(26),
1187                      io[0],io[1],il,ir,t0,t1);
1188
1189     CAMELLIA_FLS(io[0],io[1],io[2],io[3], SUBL(25),SUBR(25), SUBL(24),SUBR(24),
1190                  t0,t1,il,ir);
1191
1192     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(23),SUBR(23),
1193                      io[2],io[3],il,ir,t0,t1);
1194     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(22),SUBR(22),
1195                      io[0],io[1],il,ir,t0,t1);
1196     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(21),SUBR(21),
1197                      io[2],io[3],il,ir,t0,t1);
1198     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(20),SUBR(20),
1199                      io[0],io[1],il,ir,t0,t1);
1200     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(19),SUBR(19),
1201                      io[2],io[3],il,ir,t0,t1);
1202     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(18),SUBR(18),
1203                      io[0],io[1],il,ir,t0,t1);
1204
1205     CAMELLIA_FLS(io[0],io[1],io[2],io[3], SUBL(17),SUBR(17), SUBL(16),SUBR(16),
1206                  t0,t1,il,ir);
1207
1208     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(15),SUBR(15),
1209                      io[2],io[3],il,ir,t0,t1);
1210     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(14),SUBR(14),
1211                      io[0],io[1],il,ir,t0,t1);
1212     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(13),SUBR(13),
1213                      io[2],io[3],il,ir,t0,t1);
1214     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(12),SUBR(12),
1215                      io[0],io[1],il,ir,t0,t1);
1216     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(11),SUBR(11),
1217                      io[2],io[3],il,ir,t0,t1);
1218     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(10),SUBR(10),
1219                      io[0],io[1],il,ir,t0,t1);
1220
1221     CAMELLIA_FLS(io[0],io[1],io[2],io[3], SUBL(9),SUBR(9), SUBL(8),SUBR(8),
1222                  t0,t1,il,ir);
1223
1224     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(7),SUBR(7),
1225                      io[2],io[3],il,ir,t0,t1);
1226     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(6),SUBR(6),
1227                      io[0],io[1],il,ir,t0,t1);
1228     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(5),SUBR(5),
1229                      io[2],io[3],il,ir,t0,t1);
1230     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(4),SUBR(4),
1231                      io[0],io[1],il,ir,t0,t1);
1232     CAMELLIA_ROUNDSM(io[0],io[1], SUBL(3),SUBR(3),
1233                      io[2],io[3],il,ir,t0,t1);
1234     CAMELLIA_ROUNDSM(io[2],io[3], SUBL(2),SUBR(2),
1235                      io[0],io[1],il,ir,t0,t1);
1236
1237     /* post whitening but kw4 */
1238     io[2] ^= SUBL(0);
1239     io[3] ^= SUBR(0);
1240
1241     t0 = io[0];
1242     t1 = io[1];
1243     io[0] = io[2];
1244     io[1] = io[3];
1245     io[2] = t0;
1246     io[3] = t1;
1247 }
1248
1249 void
1250 Camellia_Ekeygen(const int keyBitLength,
1251                  const unsigned char *rawKey,
1252                  uint32_t *subkey)
1253 {
1254     KASSERT(keyBitLength == 128 || keyBitLength == 192 || keyBitLength == 256,
1255             ("Invalid key size (%d).", keyBitLength));
1256
1257     switch(keyBitLength) {
1258     case 128:
1259         camellia_setup128(rawKey, subkey);
1260         break;
1261     case 192:
1262         camellia_setup192(rawKey, subkey);
1263         break;
1264     case 256:
1265         camellia_setup256(rawKey, subkey);
1266         break;
1267     default:
1268         break;
1269     }
1270 }
1271 void
1272 Camellia_EncryptBlock(const int keyBitLength,
1273                       const unsigned char *plaintext,
1274                       const uint32_t *subkey,
1275                       unsigned char *ciphertext)
1276 {
1277     uint32_t tmp[4];
1278
1279     tmp[0] = GETU32(plaintext);
1280     tmp[1] = GETU32(plaintext + 4);
1281     tmp[2] = GETU32(plaintext + 8);
1282     tmp[3] = GETU32(plaintext + 12);
1283
1284     switch (keyBitLength) {
1285     case 128:
1286         camellia_encrypt128(subkey, tmp);
1287         break;
1288     case 192:
1289         /* fall through */
1290     case 256:
1291         camellia_encrypt256(subkey, tmp);
1292         break;
1293     default:
1294         break;
1295     }
1296
1297     PUTU32(ciphertext,    tmp[0]);
1298     PUTU32(ciphertext+4,  tmp[1]);
1299     PUTU32(ciphertext+8,  tmp[2]);
1300     PUTU32(ciphertext+12, tmp[3]);
1301 }
1302
1303 void
1304 Camellia_DecryptBlock(const int keyBitLength,
1305                       const unsigned char *ciphertext,
1306                       const uint32_t *subkey,
1307                       unsigned char *plaintext)
1308 {
1309     uint32_t tmp[4];
1310
1311     tmp[0] = GETU32(ciphertext);
1312     tmp[1] = GETU32(ciphertext + 4);
1313     tmp[2] = GETU32(ciphertext + 8);
1314     tmp[3] = GETU32(ciphertext + 12);
1315
1316     switch (keyBitLength) {
1317     case 128:
1318         camellia_decrypt128(subkey, tmp);
1319         break;
1320     case 192:
1321         /* fall through */
1322     case 256:
1323         camellia_decrypt256(subkey, tmp);
1324         break;
1325     default:
1326         break;
1327     }
1328
1329     PUTU32(plaintext,    tmp[0]);
1330     PUTU32(plaintext+4,  tmp[1]);
1331     PUTU32(plaintext+8,  tmp[2]);
1332     PUTU32(plaintext+12, tmp[3]);
1333 }