11 #include <botan/serpent.h>    12 #include <botan/loadstor.h>    13 #include <botan/rotate.h>    24    u32bit T0 = B0, T1 = B1, T2 = B2, T3 = B3, T4;
    25    T3 ^= T0; T4  = T1; T1 &= T3; T4 ^= T2; T1 ^= T0; T0 |= T3; T0 ^= T4;
    26    T4 ^= T3; T3 ^= T2; T2 |= T1; T2 ^= T4; T4 = ~T4; T4 |= T1; T1 ^= T3;
    27    T1 ^= T4; T3 |= T0; T1 ^= T3; T4 ^= T3;
    28    B0 = T1; B1 = T4; B2 = T2; B3 = T0;
    36    u32bit T0 = B0, T1 = B1, T2 = B2, T3 = B3, T4;
    37    T0 = ~T0; T2 = ~T2; T4  = T0; T0 &= T1; T2 ^= T0; T0 |= T3; T3 ^= T2;
    38    T1 ^= T0; T0 ^= T4; T4 |= T1; T1 ^= T3; T2 |= T0; T2 &= T4; T0 ^= T1;
    39    T1 &= T2; T1 ^= T0; T0 &= T2; T0 ^= T4;
    40    B0 = T2; B1 = T0; B2 = T3; B3 = T1;
    48    u32bit T0 = B0, T1 = B1, T2 = B2, T3 = B3, T4;
    49    T4  = T0; T0 &= T2; T0 ^= T3; T2 ^= T1; T2 ^= T0; T3 |= T4; T3 ^= T1;
    50    T4 ^= T2; T1  = T3; T3 |= T4; T3 ^= T0; T0 &= T1; T4 ^= T0; T1 ^= T3;
    52    B0 = T2; B1 = T3; B2 = T1; B3 = T4;
    60    u32bit T0 = B0, T1 = B1, T2 = B2, T3 = B3, T4;
    61    T4  = T0; T0 |= T3; T3 ^= T1; T1 &= T4; T4 ^= T2; T2 ^= T3; T3 &= T0;
    62    T4 |= T1; T3 ^= T4; T0 ^= T1; T4 &= T0; T1 ^= T3; T4 ^= T2; T1 |= T0;
    63    T1 ^= T2; T0 ^= T3; T2  = T1; T1 |= T3; T1 ^= T0;
    64    B0 = T1; B1 = T2; B2 = T3; B3 = T4;
    72    u32bit T0 = B0, T1 = B1, T2 = B2, T3 = B3, T4;
    73    T1 ^= T3; T3 = ~T3; T2 ^= T3; T3 ^= T0; T4  = T1; T1 &= T3; T1 ^= T2;
    74    T4 ^= T3; T0 ^= T4; T2 &= T4; T2 ^= T0; T0 &= T1; T3 ^= T0; T4 |= T1;
    75    T4 ^= T0; T0 |= T3; T0 ^= T2; T2 &= T3; T0 = ~T0; T4 ^= T2;
    76    B0 = T1; B1 = T4; B2 = T0; B3 = T3;
    84    u32bit T0 = B0, T1 = B1, T2 = B2, T3 = B3, T4;
    85    T0 ^= T1; T1 ^= T3; T3 = ~T3; T4  = T1; T1 &= T0; T2 ^= T3; T1 ^= T2;
    86    T2 |= T4; T4 ^= T3; T3 &= T1; T3 ^= T0; T4 ^= T1; T4 ^= T2; T2 ^= T0;
    87    T0 &= T3; T2 = ~T2; T0 ^= T4; T4 |= T3; T2 ^= T4;
    88    B0 = T1; B1 = T3; B2 = T0; B3 = T2;
    96    u32bit T0 = B0, T1 = B1, T2 = B2, T3 = B3, T4;
    97    T2 = ~T2; T4  = T3; T3 &= T0; T0 ^= T4; T3 ^= T2; T2 |= T4; T1 ^= T3;
    98    T2 ^= T0; T0 |= T1; T2 ^= T1; T4 ^= T0; T0 |= T3; T0 ^= T2; T4 ^= T3;
    99    T4 ^= T0; T3 = ~T3; T2 &= T4; T2 ^= T3;
   100    B0 = T0; B1 = T1; B2 = T4; B3 = T2;
   108    u32bit T0 = B0, T1 = B1, T2 = B2, T3 = B3, T4;
   109    T4  = T1; T1 |= T2; T1 ^= T3; T4 ^= T2; T2 ^= T1; T3 |= T4; T3 &= T0;
   110    T4 ^= T2; T3 ^= T1; T1 |= T4; T1 ^= T0; T0 |= T4; T0 ^= T2; T1 ^= T4;
   111    T2 ^= T1; T1 &= T0; T1 ^= T4; T2 = ~T2; T2 |= T0; T4 ^= T2;
   112    B0 = T4; B1 = T3; B2 = T1; B3 = T0;
   120    u32bit T0 = B0, T1 = B1, T2 = B2, T3 = B3, T4;
   121    T2 = ~T2; T4  = T1; T1 |= T0; T4 = ~T4; T1 ^= T2; T2 |= T4; T1 ^= T3;
   122    T0 ^= T4; T2 ^= T0; T0 &= T3; T4 ^= T0; T0 |= T1; T0 ^= T2; T3 ^= T4;
   123    T2 ^= T1; T3 ^= T0; T3 ^= T1; T2 &= T3; T4 ^= T2;
   124    B0 = T0; B1 = T4; B2 = T1; B3 = T3;
   132    u32bit T0 = B0, T1 = B1, T2 = B2, T3 = B3, T4;
   133    T4  = T1; T1 ^= T3; T3 &= T1; T4 ^= T2; T3 ^= T0; T0 |= T1; T2 ^= T3;
   134    T0 ^= T4; T0 |= T2; T1 ^= T3; T0 ^= T1; T1 |= T3; T1 ^= T0; T4 = ~T4;
   135    T4 ^= T1; T1 |= T0; T1 ^= T0; T1 |= T4; T3 ^= T1;
   136    B0 = T4; B1 = T0; B2 = T3; B3 = T2;
   144    u32bit T0 = B0, T1 = B1, T2 = B2, T3 = B3, T4;
   145    T2 ^= T3; T3 ^= T0; T4  = T3; T3 &= T2; T3 ^= T1; T1 |= T2; T1 ^= T4;
   146    T4 &= T3; T2 ^= T3; T4 &= T0; T4 ^= T2; T2 &= T1; T2 |= T0; T3 = ~T3;
   147    T2 ^= T3; T0 ^= T3; T0 &= T1; T3 ^= T4; T3 ^= T0;
   148    B0 = T1; B1 = T4; B2 = T2; B3 = T3;
   156    u32bit T0 = B0, T1 = B1, T2 = B2, T3 = B3, T4;
   157    T4  = T2; T2 ^= T1; T0 ^= T2; T4 &= T2; T4 ^= T0; T0 &= T1; T1 ^= T3;
   158    T3 |= T4; T2 ^= T3; T0 ^= T3; T1 ^= T4; T3 &= T2; T3 ^= T1; T1 ^= T0;
   159    T1 |= T2; T0 ^= T3; T1 ^= T4; T0 ^= T1;
   160    B0 = T2; B1 = T1; B2 = T3; B3 = T0;
   168    u32bit T0 = B0, T1 = B1, T2 = B2, T3 = B3, T4;
   169    T4  = T2; T2 &= T3; T2 ^= T1; T1 |= T3; T1 &= T0; T4 ^= T2; T4 ^= T1;
   170    T1 &= T2; T0 = ~T0; T3 ^= T4; T1 ^= T3; T3 &= T0; T3 ^= T2; T0 ^= T1;
   171    T2 &= T0; T3 ^= T0; T2 ^= T4; T2 |= T3; T3 ^= T0; T2 ^= T1;
   172    B0 = T0; B1 = T3; B2 = T2; B3 = T4;
   180    u32bit T0 = B0, T1 = B1, T2 = B2, T3 = B3, T4;
   181    T1 = ~T1; T4  = T3; T2 ^= T1; T3 |= T0; T3 ^= T2; T2 |= T1; T2 &= T0;
   182    T4 ^= T3; T2 ^= T4; T4 |= T0; T4 ^= T1; T1 &= T2; T1 ^= T3; T4 ^= T2;
   183    T3 &= T4; T4 ^= T1; T3 ^= T4; T4 = ~T4; T3 ^= T0;
   184    B0 = T1; B1 = T4; B2 = T3; B3 = T2;
   192    u32bit T0 = B0, T1 = B1, T2 = B2, T3 = B3, T4;
   193    T0 ^= T2; T4  = T2; T2 &= T0; T4 ^= T3; T2 = ~T2; T3 ^= T1; T2 ^= T3;
   194    T4 |= T0; T0 ^= T2; T3 ^= T4; T4 ^= T1; T1 &= T3; T1 ^= T0; T0 ^= T3;
   195    T0 |= T2; T3 ^= T1; T4 ^= T0;
   196    B0 = T1; B1 = T2; B2 = T4; B3 = T3;
   204    u32bit T0 = B0, T1 = B1, T2 = B2, T3 = B3, T4;
   205    T4  = T2; T2 ^= T0; T0 &= T3; T4 |= T3; T2 = ~T2; T3 ^= T1; T1 |= T0;
   206    T0 ^= T2; T2 &= T4; T3 &= T4; T1 ^= T2; T2 ^= T0; T0 |= T2; T4 ^= T1;
   207    T0 ^= T3; T3 ^= T4; T4 |= T0; T3 ^= T2; T4 ^= T2;
   208    B0 = T3; B1 = T0; B2 = T1; B3 = T4;
   217    B1 ^= B0 ^ B2;               B3 ^= B2 ^ (B0 << 3);
   219    B0 ^= B1 ^ B3;               B2 ^= B3 ^ (B1 << 7);
   229    B2 ^= B3 ^ (B1 << 7);        B0 ^= B1 ^ B3;
   231    B3 ^= B2 ^ (B0 << 3);        B1 ^= B0 ^ B2;
   240 #define key_xor(round, B0, B1, B2, B3) \   241    B0 ^= round_key[4*round  ]; \   242    B1 ^= round_key[4*round+1]; \   243    B2 ^= round_key[4*round+2]; \   244    B3 ^= round_key[4*round+3];   251    for(
size_t i = 0; i != blocks; ++i)
   258       key_xor( 0,B0,B1,B2,B3); 
SBoxE1(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   259       key_xor( 1,B0,B1,B2,B3); 
SBoxE2(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   260       key_xor( 2,B0,B1,B2,B3); 
SBoxE3(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   261       key_xor( 3,B0,B1,B2,B3); 
SBoxE4(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   262       key_xor( 4,B0,B1,B2,B3); 
SBoxE5(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   263       key_xor( 5,B0,B1,B2,B3); 
SBoxE6(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   264       key_xor( 6,B0,B1,B2,B3); 
SBoxE7(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   265       key_xor( 7,B0,B1,B2,B3); 
SBoxE8(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   266       key_xor( 8,B0,B1,B2,B3); 
SBoxE1(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   267       key_xor( 9,B0,B1,B2,B3); 
SBoxE2(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   268       key_xor(10,B0,B1,B2,B3); 
SBoxE3(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   269       key_xor(11,B0,B1,B2,B3); 
SBoxE4(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   270       key_xor(12,B0,B1,B2,B3); 
SBoxE5(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   271       key_xor(13,B0,B1,B2,B3); 
SBoxE6(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   272       key_xor(14,B0,B1,B2,B3); 
SBoxE7(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   273       key_xor(15,B0,B1,B2,B3); 
SBoxE8(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   274       key_xor(16,B0,B1,B2,B3); 
SBoxE1(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   275       key_xor(17,B0,B1,B2,B3); 
SBoxE2(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   276       key_xor(18,B0,B1,B2,B3); 
SBoxE3(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   277       key_xor(19,B0,B1,B2,B3); 
SBoxE4(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   278       key_xor(20,B0,B1,B2,B3); 
SBoxE5(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   279       key_xor(21,B0,B1,B2,B3); 
SBoxE6(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   280       key_xor(22,B0,B1,B2,B3); 
SBoxE7(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   281       key_xor(23,B0,B1,B2,B3); 
SBoxE8(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   282       key_xor(24,B0,B1,B2,B3); 
SBoxE1(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   283       key_xor(25,B0,B1,B2,B3); 
SBoxE2(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   284       key_xor(26,B0,B1,B2,B3); 
SBoxE3(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   285       key_xor(27,B0,B1,B2,B3); 
SBoxE4(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   286       key_xor(28,B0,B1,B2,B3); 
SBoxE5(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   287       key_xor(29,B0,B1,B2,B3); 
SBoxE6(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   288       key_xor(30,B0,B1,B2,B3); 
SBoxE7(B0,B1,B2,B3); 
transform(B0,B1,B2,B3);
   289       key_xor(31,B0,B1,B2,B3); 
SBoxE8(B0,B1,B2,B3); 
key_xor(32,B0,B1,B2,B3);
   303    for(
size_t i = 0; i != blocks; ++i)
   310       key_xor(32,B0,B1,B2,B3);  
SBoxD8(B0,B1,B2,B3); 
key_xor(31,B0,B1,B2,B3);
   311       i_transform(B0,B1,B2,B3); 
SBoxD7(B0,B1,B2,B3); 
key_xor(30,B0,B1,B2,B3);
   312       i_transform(B0,B1,B2,B3); 
SBoxD6(B0,B1,B2,B3); 
key_xor(29,B0,B1,B2,B3);
   313       i_transform(B0,B1,B2,B3); 
SBoxD5(B0,B1,B2,B3); 
key_xor(28,B0,B1,B2,B3);
   314       i_transform(B0,B1,B2,B3); 
SBoxD4(B0,B1,B2,B3); 
key_xor(27,B0,B1,B2,B3);
   315       i_transform(B0,B1,B2,B3); 
SBoxD3(B0,B1,B2,B3); 
key_xor(26,B0,B1,B2,B3);
   316       i_transform(B0,B1,B2,B3); 
SBoxD2(B0,B1,B2,B3); 
key_xor(25,B0,B1,B2,B3);
   317       i_transform(B0,B1,B2,B3); 
SBoxD1(B0,B1,B2,B3); 
key_xor(24,B0,B1,B2,B3);
   318       i_transform(B0,B1,B2,B3); 
SBoxD8(B0,B1,B2,B3); 
key_xor(23,B0,B1,B2,B3);
   319       i_transform(B0,B1,B2,B3); 
SBoxD7(B0,B1,B2,B3); 
key_xor(22,B0,B1,B2,B3);
   320       i_transform(B0,B1,B2,B3); 
SBoxD6(B0,B1,B2,B3); 
key_xor(21,B0,B1,B2,B3);
   321       i_transform(B0,B1,B2,B3); 
SBoxD5(B0,B1,B2,B3); 
key_xor(20,B0,B1,B2,B3);
   322       i_transform(B0,B1,B2,B3); 
SBoxD4(B0,B1,B2,B3); 
key_xor(19,B0,B1,B2,B3);
   323       i_transform(B0,B1,B2,B3); 
SBoxD3(B0,B1,B2,B3); 
key_xor(18,B0,B1,B2,B3);
   324       i_transform(B0,B1,B2,B3); 
SBoxD2(B0,B1,B2,B3); 
key_xor(17,B0,B1,B2,B3);
   325       i_transform(B0,B1,B2,B3); 
SBoxD1(B0,B1,B2,B3); 
key_xor(16,B0,B1,B2,B3);
   326       i_transform(B0,B1,B2,B3); 
SBoxD8(B0,B1,B2,B3); 
key_xor(15,B0,B1,B2,B3);
   327       i_transform(B0,B1,B2,B3); 
SBoxD7(B0,B1,B2,B3); 
key_xor(14,B0,B1,B2,B3);
   328       i_transform(B0,B1,B2,B3); 
SBoxD6(B0,B1,B2,B3); 
key_xor(13,B0,B1,B2,B3);
   329       i_transform(B0,B1,B2,B3); 
SBoxD5(B0,B1,B2,B3); 
key_xor(12,B0,B1,B2,B3);
   330       i_transform(B0,B1,B2,B3); 
SBoxD4(B0,B1,B2,B3); 
key_xor(11,B0,B1,B2,B3);
   331       i_transform(B0,B1,B2,B3); 
SBoxD3(B0,B1,B2,B3); 
key_xor(10,B0,B1,B2,B3);
   332       i_transform(B0,B1,B2,B3); 
SBoxD2(B0,B1,B2,B3); 
key_xor( 9,B0,B1,B2,B3);
   333       i_transform(B0,B1,B2,B3); 
SBoxD1(B0,B1,B2,B3); 
key_xor( 8,B0,B1,B2,B3);
   334       i_transform(B0,B1,B2,B3); 
SBoxD8(B0,B1,B2,B3); 
key_xor( 7,B0,B1,B2,B3);
   335       i_transform(B0,B1,B2,B3); 
SBoxD7(B0,B1,B2,B3); 
key_xor( 6,B0,B1,B2,B3);
   336       i_transform(B0,B1,B2,B3); 
SBoxD6(B0,B1,B2,B3); 
key_xor( 5,B0,B1,B2,B3);
   337       i_transform(B0,B1,B2,B3); 
SBoxD5(B0,B1,B2,B3); 
key_xor( 4,B0,B1,B2,B3);
   338       i_transform(B0,B1,B2,B3); 
SBoxD4(B0,B1,B2,B3); 
key_xor( 3,B0,B1,B2,B3);
   339       i_transform(B0,B1,B2,B3); 
SBoxD3(B0,B1,B2,B3); 
key_xor( 2,B0,B1,B2,B3);
   340       i_transform(B0,B1,B2,B3); 
SBoxD2(B0,B1,B2,B3); 
key_xor( 1,B0,B1,B2,B3);
   341       i_transform(B0,B1,B2,B3); 
SBoxD1(B0,B1,B2,B3); 
key_xor( 0,B0,B1,B2,B3);
   357 void Serpent::key_schedule(
const byte key[], 
size_t length)
   359    const u32bit PHI = 0x9E3779B9;
   362    for(
size_t i = 0; i != length / 4; ++i)
   365    W[length / 4] |= 
u32bit(1) << ((length%4)*8);
   367    for(
size_t i = 8; i != 140; ++i)
   369       u32bit wi = W[i-8] ^ W[i-5] ^ W[i-3] ^ W[i-1] ^ PHI ^ 
u32bit(i-8);
   373    SBoxE4(W[  8],W[  9],W[ 10],W[ 11]); 
SBoxE3(W[ 12],W[ 13],W[ 14],W[ 15]);
   374    SBoxE2(W[ 16],W[ 17],W[ 18],W[ 19]); 
SBoxE1(W[ 20],W[ 21],W[ 22],W[ 23]);
   375    SBoxE8(W[ 24],W[ 25],W[ 26],W[ 27]); 
SBoxE7(W[ 28],W[ 29],W[ 30],W[ 31]);
   376    SBoxE6(W[ 32],W[ 33],W[ 34],W[ 35]); 
SBoxE5(W[ 36],W[ 37],W[ 38],W[ 39]);
   377    SBoxE4(W[ 40],W[ 41],W[ 42],W[ 43]); 
SBoxE3(W[ 44],W[ 45],W[ 46],W[ 47]);
   378    SBoxE2(W[ 48],W[ 49],W[ 50],W[ 51]); 
SBoxE1(W[ 52],W[ 53],W[ 54],W[ 55]);
   379    SBoxE8(W[ 56],W[ 57],W[ 58],W[ 59]); 
SBoxE7(W[ 60],W[ 61],W[ 62],W[ 63]);
   380    SBoxE6(W[ 64],W[ 65],W[ 66],W[ 67]); 
SBoxE5(W[ 68],W[ 69],W[ 70],W[ 71]);
   381    SBoxE4(W[ 72],W[ 73],W[ 74],W[ 75]); 
SBoxE3(W[ 76],W[ 77],W[ 78],W[ 79]);
   382    SBoxE2(W[ 80],W[ 81],W[ 82],W[ 83]); 
SBoxE1(W[ 84],W[ 85],W[ 86],W[ 87]);
   383    SBoxE8(W[ 88],W[ 89],W[ 90],W[ 91]); 
SBoxE7(W[ 92],W[ 93],W[ 94],W[ 95]);
   384    SBoxE6(W[ 96],W[ 97],W[ 98],W[ 99]); 
SBoxE5(W[100],W[101],W[102],W[103]);
   385    SBoxE4(W[104],W[105],W[106],W[107]); 
SBoxE3(W[108],W[109],W[110],W[111]);
   386    SBoxE2(W[112],W[113],W[114],W[115]); 
SBoxE1(W[116],W[117],W[118],W[119]);
   387    SBoxE8(W[120],W[121],W[122],W[123]); 
SBoxE7(W[124],W[125],W[126],W[127]);
   388    SBoxE6(W[128],W[129],W[130],W[131]); 
SBoxE5(W[132],W[133],W[134],W[135]);
   389    SBoxE4(W[136],W[137],W[138],W[139]);
   390    round_key.
copy(&W[8], 132);
 #define SBoxE5(B0, B1, B2, B3)
#define transform(B0, B1, B2, B3)
#define SBoxE6(B0, B1, B2, B3)
#define SBoxD5(B0, B1, B2, B3)
#define SBoxE4(B0, B1, B2, B3)
#define SBoxE7(B0, B1, B2, B3)
#define SBoxD4(B0, B1, B2, B3)
#define SBoxE3(B0, B1, B2, B3)
void store_le(u16bit in, byte out[2])
#define SBoxE8(B0, B1, B2, B3)
#define SBoxD7(B0, B1, B2, B3)
T rotate_left(T input, size_t rot)
#define SBoxE2(B0, B1, B2, B3)
void copy(const T in[], size_t n)
#define SBoxE1(B0, B1, B2, B3)
#define SBoxD1(B0, B1, B2, B3)
T rotate_right(T input, size_t rot)
u32bit load_le< u32bit >(const byte in[], size_t off)
#define SBoxD8(B0, B1, B2, B3)
#define SBoxD2(B0, B1, B2, B3)
void decrypt_n(const byte in[], byte out[], size_t blocks) const
void encrypt_n(const byte in[], byte out[], size_t blocks) const
#define key_xor(round, B0, B1, B2, B3)
#define SBoxD3(B0, B1, B2, B3)
#define i_transform(B0, B1, B2, B3)
#define SBoxD6(B0, B1, B2, B3)