cr.yp.to update
[email protected] 7 Dec 2006 07:45:20 -0000
| Newsgroups | gmane.comp.djb.announce |
|---|---|
| Message-ID | <[email protected]> |
streamciphers.html | 7
streamciphers/timings/estreambench/submissions/polarbear-2/polar-bear.c | 1610 ++++++++--
2 files changed, 1313 insertions(+), 304 deletions(-)
New: conferences/2006.12.03-asiacrypt/www.iacr.org
New: streamciphers/timings/estreambench/submissions/nls/Makefile
New: streamciphers/timings/estreambench/submissions/nls/ecrypt-sync-ae.h
New: streamciphers/timings/estreambench/submissions/nls/ecrypt-sync.h
New: streamciphers/timings/estreambench/submissions/nls/nls.c
New: streamciphers/timings/estreambench/submissions/nls/nls.h
New: streamciphers/timings/estreambench/submissions/nls/nlsfast.c
New: streamciphers/timings/estreambench/submissions/nls/nlsmultab.h
New: streamciphers/timings/estreambench/submissions/nls/nlsref.c
New: streamciphers/timings/estreambench/submissions/nls/nlssbox.h
New: streamciphers/timings/estreambench/submissions/nls/unverified.test-vectors
New: streamciphers/timings/estreambench/submissions/nls-ae
diff -ru .old-crypto/streamciphers/timings/estreambench/submissions/polarbear-2/polar-bear.c cr.yp.to/streamciphers/timings/estreambench/submissions/polarbear-2/polar-bear.c
--- .old-crypto/streamciphers/timings/estreambench/submissions/polarbear-2/polar-bear.c 2006-11-19 21:50:58.000000000 -0500
+++ cr.yp.to/streamciphers/timings/estreambench/submissions/polarbear-2/polar-bear.c 2006-11-26 18:14:33.000000000 -0500
@@ -17,13 +17,6 @@
#include "aescrypt.c"
#include "whirltab.c"
-/* Define this flag to get debug printouts */
-#undef CIPHER_DEBUG
-
-#ifdef ECRYPT_API
-#undef CIPHER_DEBUG
-#endif
-
/* ------------------------------------------------------------------------- */
/* Tables for multiplication in GF(2^16) */
@@ -182,13 +175,6 @@
ctx->ivsize = ivsize;
}
-#ifdef CIPHER_DEBUG
- fprintf(stderr,"Key k (%d bits):\n",keysize);
- for (j = 0; j < keysize/8; j++)
- fprintf(stderr,"%02x ",key[j]);
- fprintf(stderr,"\n\n");
-#endif
-
/* The expanded key K^0 */
for(i = 0; i < 16; i++)
{
@@ -199,17 +185,6 @@
K0[i] = T8[ K0[i - 16] ];
}
-#ifdef CIPHER_DEBUG
- fprintf(stderr,"Expanded key K^0 (512 bits):\n");
- for (i = 0; i < 4; i++)
- {
- for (j = 0; j < 16; j++)
- fprintf(stderr,"%02x ",K0[16 * i + j]);
- fprintf(stderr,"\n");
- }
- fprintf(stderr,"\n");
-#endif
-
/* The expanded key K^0 */
K[0] = U8TO64_LITTLE(K0);
K[1] = U8TO64_LITTLE(K0 + 8);
@@ -312,20 +287,6 @@
for(i = 0; i < 40; i++)
k_sch[i] = W[i];
-
-#ifdef CIPHER_DEBUG
- fprintf(stderr,"Round keys W^0...W^4 (256 bits each):\n");
- for (i = 0; i <= 4; i++)
- {
- for (j = 0; j < 16; j++)
- fprintf(stderr,"%02x ", expKey8[608 + 32 * i + j]);
- fprintf(stderr,"\n");
- for (j = 0; j < 16; j++)
- fprintf(stderr,"%02x ", expKey8[624 + 32 * i + j]);
- fprintf(stderr,"\n\n");
- }
-#endif
-
/* Initiaze D8init to T8 */
memcpy(D8init, T8, 256);
@@ -336,18 +297,6 @@
D8init[i % 256] = D8init[expKey8[i]];
D8init[expKey8[i]] = temp;
}
-
-#ifdef CIPHER_DEBUG
- fprintf(stderr,"Permuted byte array S_R^k (256 bytes):\n");
- for (i = 0; i < 16; i++)
- {
- for (j = 0; j < 16; j++)
- fprintf(stderr,"%02x ", D8init[16 * i + j]);
- fprintf(stderr,"\n");
- }
- fprintf(stderr,"\n");
-#endif
-
}
@@ -365,13 +314,6 @@
memcpy(ctx->D8, ctx->D8init, 256);
-#ifdef CIPHER_DEBUG
- fprintf(stderr,"Initiation vector IV (128 bits):\n");
- for (j = 0; j < n_iv; j++)
- fprintf(stderr,"%02x ", iv[j]);
- fprintf(stderr,"\n\n");
-#endif
-
/* Pad IV with 0x80 and zeroes */
for (j = 0; j < n_iv; j++)
{
@@ -390,17 +332,6 @@
ct[j] = 0;
}
-#ifdef CIPHER_DEBUG
- fprintf(stderr,"Expanded IV:\n");
- for (j = 0; j < 16; j++)
- fprintf(stderr,"%02x ",pt[j]);
- fprintf(stderr,"\n");
- for (j = 16; j < 32; j++)
- fprintf(stderr,"%02x ",pt[j]);
- fprintf(stderr,"\n\n");
-
-#endif
-
/* Four rounds Rijndael */
aes_enc_blk(pt, ct, &ctx->ks);
@@ -415,17 +346,6 @@
R1[j] = U8TO16_LITTLE(ct16);
ct16++;
}
-
-#ifdef CIPHER_DEBUG
- fprintf(stderr,"Initial value of R_0^6...R_0^0:\n");
- for (j = 6; j >= 0; j--)
- fprintf(stderr,"%04x ", ctx->R0[j]);
- fprintf(stderr,"\n\n");
- fprintf(stderr,"Initial value of R_1^8...R_1^0:\n");
- for (j = 8; j >= 0; j--)
- fprintf(stderr,"%04x ", ctx->R1[j]);
- fprintf(stderr,"\n");
-#endif
}
@@ -436,39 +356,39 @@
u32 msglen) /* Message length in bytes. */
{
u32 alpha0, alpha1, alpha2, alpha3, beta0, beta1, beta2, beta3;
- u32 temp0, temp1, b;
+ u32 temp0, temp1, b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14;
u32 *R0 = ctx->R0, *R1 = ctx->R1;
u8 *D8 = ctx->D8;
u32 *in = (u32*)input;
u32 *out = (u32*)output;
- while (msglen >= 20)
+ while (msglen >= 60)
{
- R0[8] = GF216MUL(TL00, TH00, R0[1]) ^ GF216MUL(TL01, TH01, R0[2]);\
+
R0[7] = GF216MUL(TL00, TH00, R0[0]) ^ GF216MUL(TL01, TH01, R0[1]);\
+ R0[8] = GF216MUL(TL00, TH00, R0[1]) ^ GF216MUL(TL01, TH01, R0[2]);\
/* Calculate alphas and betas */
- alpha3 = R0[7] & 0xff;
- alpha2 = R0[7] >> 8;
- alpha1 = R0[8] & 0xff;
alpha0 = R0[8] >> 8;
+ alpha1 = R0[8] & 0xff;
+ alpha2 = R0[7] >> 8;
+ alpha3 = R0[7] & 0xff;
/* Swap(D8[alpha0], D8[alpha2]) */
beta0 = D8[alpha0];
beta2 = D8[alpha2];
D8[alpha2] = beta0;
D8[alpha0] = beta2;
- b = beta2;
- b ^= (beta0 << 24);
+ b0 = beta2;
+ b0 ^= (beta0 << 24);
/* Swap(D8[alpha1], D8[alpha3]) */
beta1 = D8[alpha1];
beta3 = D8[alpha3];
-
D8[alpha3] = beta1;
D8[alpha1] = beta3;
- b ^= (beta3 << 8);
- b ^= (beta1 << 16);
+ b0 ^= (beta3 << 8);
+ b0 ^= (beta1 << 16);
R1[9] = GF216MUL(TL10, TH10, R1[0]) ^ GF216MUL(TL11, TH11, R1[5]);\
R1[0] = GF216MUL(TL10, TH10, R1[1]) ^ GF216MUL(TL11, TH11, R1[6]);\
@@ -495,12 +415,9 @@
temp0 = beta2 | (beta1 << 8);
R0[5] += temp0;
R0[5] &= 0xffff;
- b ^= (temp0 << 16);
+ b0 ^= (temp0 << 16);
temp1 = beta3 | (beta0 << 8);
- b ^= temp1;;
-
- /* Output 32 bits */
- *(out++) = *(in++) ^ U32TO32_LITTLE(b);
+ b0 ^= temp1;;
R0[9] = GF216MUL(TL00, TH00, R0[2]) ^ GF216MUL(TL01, TH01, R0[3]);\
R0[0] = GF216MUL(TL00, TH00, R0[3]) ^ GF216MUL(TL01, TH01, R0[4]);\
@@ -516,8 +433,8 @@
beta2 = D8[alpha2];
D8[alpha2] = beta0;
D8[alpha0] = beta2;
- b = beta2;
- b ^= (beta0 << 24);
+ b1 = beta2;
+ b1 ^= (beta0 << 24);
/* Swap(D8[alpha1], D8[alpha3]) */
beta1 = D8[alpha1];
@@ -525,8 +442,8 @@
D8[alpha3] = beta1;
D8[alpha1] = beta3;
- b ^= (beta3 << 8);
- b ^= (beta1 << 16);
+ b1 ^= (beta3 << 8);
+ b1 ^= (beta1 << 16);
R1[1] = GF216MUL(TL10, TH10, R1[2]) ^ GF216MUL(TL11, TH11, R1[7]);\
R1[2] = GF216MUL(TL10, TH10, R1[3]) ^ GF216MUL(TL11, TH11, R1[8]);\
@@ -553,13 +470,10 @@
temp0 = beta2 | (beta1 << 8);
R0[7] += temp0;
R0[7] &= 0xffff;
- b ^= (temp0 << 16);
+ b1 ^= (temp0 << 16);
temp1 = beta3 | (beta0 << 8);
- b ^= temp1;;
+ b1 ^= temp1;;
- /* Output 32 bits */
- *(out++) = *(in++) ^ U32TO32_LITTLE(b);
-
R0[1] = GF216MUL(TL00, TH00, R0[4]) ^ GF216MUL(TL01, TH01, R0[5]);\
R0[2] = GF216MUL(TL00, TH00, R0[5]) ^ GF216MUL(TL01, TH01, R0[6]);\
@@ -574,8 +488,8 @@
beta2 = D8[alpha2];
D8[alpha2] = beta0;
D8[alpha0] = beta2;
- b = beta2;
- b ^= (beta0 << 24);
+ b2 = beta2;
+ b2 ^= (beta0 << 24);
/* Swap(D8[alpha1], D8[alpha3]) */
beta1 = D8[alpha1];
@@ -583,8 +497,8 @@
D8[alpha3] = beta1;
D8[alpha1] = beta3;
- b ^= (beta3 << 8);
- b ^= (beta1 << 16);
+ b2 ^= (beta3 << 8);
+ b2 ^= (beta1 << 16);
R1[3] = GF216MUL(TL10, TH10, R1[4]) ^ GF216MUL(TL11, TH11, R1[9]);\
R1[4] = GF216MUL(TL10, TH10, R1[5]) ^ GF216MUL(TL11, TH11, R1[0]);\
@@ -611,12 +525,9 @@
temp0 = beta2 | (beta1 << 8);
R0[9] += temp0;
R0[9] &= 0xffff;
- b ^= (temp0 << 16);
+ b2 ^= (temp0 << 16);
temp1 = beta3 | (beta0 << 8);
- b ^= temp1;;
-
- /* Output 32 bits */
- *(out++) = *(in++) ^ U32TO32_LITTLE(b);
+ b2 ^= temp1;;
R0[3] = GF216MUL(TL00, TH00, R0[6]) ^ GF216MUL(TL01, TH01, R0[7]);\
R0[4] = GF216MUL(TL00, TH00, R0[7]) ^ GF216MUL(TL01, TH01, R0[8]);\
@@ -632,8 +543,8 @@
beta2 = D8[alpha2];
D8[alpha2] = beta0;
D8[alpha0] = beta2;
- b = beta2;
- b ^= (beta0 << 24);
+ b3 = beta2;
+ b3 ^= (beta0 << 24);
/* Swap(D8[alpha1], D8[alpha3]) */
beta1 = D8[alpha1];
@@ -641,8 +552,8 @@
D8[alpha3] = beta1;
D8[alpha1] = beta3;
- b ^= (beta3 << 8);
- b ^= (beta1 << 16);
+ b3 ^= (beta3 << 8);
+ b3 ^= (beta1 << 16);
R1[5] = GF216MUL(TL10, TH10, R1[6]) ^ GF216MUL(TL11, TH11, R1[1]);\
R1[6] = GF216MUL(TL10, TH10, R1[7]) ^ GF216MUL(TL11, TH11, R1[2]);\
@@ -669,14 +580,10 @@
temp0 = beta2 | (beta1 << 8);
R0[1] += temp0;
R0[1] &= 0xffff;
- b ^= (temp0 << 16);
+ b3 ^= (temp0 << 16);
temp1 = beta3 | (beta0 << 8);
- b ^= temp1;;
-
- /* Output 32 bits */
- *(out++) = *(in++) ^ U32TO32_LITTLE(b);
-
- R0[5] = GF216MUL(TL00, TH00, R0[8]) ^ GF216MUL(TL01, TH01, R0[9]);\
+ b3 ^= temp1;;
+
R0[5] = GF216MUL(TL00, TH00, R0[8]) ^ GF216MUL(TL01, TH01, R0[9]);\
R0[6] = GF216MUL(TL00, TH00, R0[9]) ^ GF216MUL(TL01, TH01, R0[0]);\
/* Calculate alphas and betas */
@@ -690,8 +597,8 @@
beta2 = D8[alpha2];
D8[alpha2] = beta0;
D8[alpha0] = beta2;
- b = beta2;
- b ^= (beta0 << 24);
+ b4 = beta2;
+ b4 ^= (beta0 << 24);
/* Swap(D8[alpha1], D8[alpha3]) */
beta1 = D8[alpha1];
@@ -699,8 +606,8 @@
D8[alpha3] = beta1;
D8[alpha1] = beta3;
- b ^= (beta3 << 8);
- b ^= (beta1 << 16);
+ b4 ^= (beta3 << 8);
+ b4 ^= (beta1 << 16);
R1[7] = GF216MUL(TL10, TH10, R1[8]) ^ GF216MUL(TL11, TH11, R1[3]);\
R1[8] = GF216MUL(TL10, TH10, R1[9]) ^ GF216MUL(TL11, TH11, R1[4]);\
@@ -727,122 +634,43 @@
temp0 = beta2 | (beta1 << 8);
R0[3] += temp0;
R0[3] &= 0xffff;
- b ^= (temp0 << 16);
- temp1 = beta3 | (beta0 << 8);
- b ^= temp1;;
-
- /* Output 32 bits */
- *(out++) = *(in++) ^ U32TO32_LITTLE(b);
-
- /* Fix values */
- msglen -= 20;
- }
-
- while (msglen)
- {
- STEP_R0_TWO_STEPS;
-
- /* Calculate alphas and betas */
- alpha0 = R0[6] >> 8;
- alpha1 = R0[6] & 0xff;
- alpha2 = R0[5] >> 8;
- alpha3 = R0[5] & 0xff;
-
- /* Swap(D8[alpha0], D8[alpha2]) */
- beta0 = D8[alpha0];
- beta2 = D8[alpha2];
- D8[alpha2] = beta0;
- D8[alpha0] = beta2;
- b = beta2;
- b ^= (beta0 << 24);
-
- /* Swap(D8[alpha1], D8[alpha3]) */
- beta1 = D8[alpha1];
- beta3 = D8[alpha3];
-
- D8[alpha3] = beta1;
- D8[alpha1] = beta3;
- b ^= (beta3 << 8);
- b ^= (beta1 << 16);
-
- STEP_R1_TWO_STEPS;
-
- /* Calculate alphas and betas */
- alpha2 = R1[7] >> 8;
- alpha3 = R1[7] & 0xff;
- alpha0 = R1[8] >> 8;
- alpha1 = R1[8] & 0xff;
-
- /* Swap(D8[alpha0], D8[alpha2]) */
- beta0 = D8[alpha0];
- beta2 = D8[alpha2];
- D8[alpha0] = beta2;
- D8[alpha2] = beta0;
-
- /* Swap(D8[alpha1], D8[alpha3]) */
- beta1 = D8[alpha1];
- beta3 = D8[alpha3];
- D8[alpha1] = beta3;
- D8[alpha3] = beta1;
-
- /* Update R0[3] */
- temp0 = beta2 | (beta1 << 8);
- R0[3] += temp0;
- R0[3] &= 0xffff;
- b ^= (temp0 << 16);
+ b4 ^= (temp0 << 16);
temp1 = beta3 | (beta0 << 8);
- b ^= temp1;;
-
- /* Output 32 bits */
- *(out++) = *(in++) ^ U32TO32_LITTLE(b);
- msglen -= 4;
- }
-}
-
-void ECRYPT_keystream_bytes(ECRYPT_ctx* ctx, u8* keystream, u32 length)
-{
- u32 alpha0, alpha1, alpha2, alpha3, beta0, beta1, beta2, beta3;
- u32 temp0, temp1, b;
- u32 *R0 = ctx->R0, *R1 = ctx->R1;
- u8 *D8 = ctx->D8;
- u32 *ks = (u32*)keystream;
+ b4 ^= temp1;;
- while (length >= 20)
- {
- R0[7] = GF216MUL(TL00, TH00, R0[0]) ^ GF216MUL(TL01, TH01, R0[1]);\
R0[8] = GF216MUL(TL00, TH00, R0[1]) ^ GF216MUL(TL01, TH01, R0[2]);\
+ R0[7] = GF216MUL(TL00, TH00, R0[0]) ^ GF216MUL(TL01, TH01, R0[1]);\
/* Calculate alphas and betas */
- alpha0 = R0[8] >> 8;
- alpha1 = R0[8] & 0xff;
- alpha2 = R0[7] >> 8;
alpha3 = R0[7] & 0xff;
+ alpha2 = R0[7] >> 8;
+ alpha1 = R0[8] & 0xff;
+ alpha0 = R0[8] >> 8;
/* Swap(D8[alpha0], D8[alpha2]) */
beta0 = D8[alpha0];
beta2 = D8[alpha2];
D8[alpha2] = beta0;
D8[alpha0] = beta2;
- b = beta2;
- b ^= (beta0 << 24);
+ b5 = beta2;
+ b5 ^= (beta0 << 24);
/* Swap(D8[alpha1], D8[alpha3]) */
beta1 = D8[alpha1];
beta3 = D8[alpha3];
-
D8[alpha3] = beta1;
D8[alpha1] = beta3;
- b ^= (beta3 << 8);
- b ^= (beta1 << 16);
+ b5 ^= (beta3 << 8);
+ b5 ^= (beta1 << 16);
R1[9] = GF216MUL(TL10, TH10, R1[0]) ^ GF216MUL(TL11, TH11, R1[5]);\
R1[0] = GF216MUL(TL10, TH10, R1[1]) ^ GF216MUL(TL11, TH11, R1[6]);\
/* Calculate alphas and betas */
- alpha2 = R1[9] >> 8;
- alpha3 = R1[9] & 0xff;
alpha0 = R1[0] >> 8;
alpha1 = R1[0] & 0xff;
+ alpha2 = R1[9] >> 8;
+ alpha3 = R1[9] & 0xff;
/* Swap(D8[alpha0], D8[alpha2]) */
beta0 = D8[alpha0];
@@ -860,12 +688,9 @@
temp0 = beta2 | (beta1 << 8);
R0[5] += temp0;
R0[5] &= 0xffff;
- b ^= (temp0 << 16);
+ b5 ^= (temp0 << 16);
temp1 = beta3 | (beta0 << 8);
- b ^= temp1;;
-
- /* Output 32 bits */
- *(ks++) = U32TO32_LITTLE(b);
+ b5 ^= temp1;;
R0[9] = GF216MUL(TL00, TH00, R0[2]) ^ GF216MUL(TL01, TH01, R0[3]);\
R0[0] = GF216MUL(TL00, TH00, R0[3]) ^ GF216MUL(TL01, TH01, R0[4]);\
@@ -881,8 +706,8 @@
beta2 = D8[alpha2];
D8[alpha2] = beta0;
D8[alpha0] = beta2;
- b = beta2;
- b ^= (beta0 << 24);
+ b6 = beta2;
+ b6 ^= (beta0 << 24);
/* Swap(D8[alpha1], D8[alpha3]) */
beta1 = D8[alpha1];
@@ -890,8 +715,8 @@
D8[alpha3] = beta1;
D8[alpha1] = beta3;
- b ^= (beta3 << 8);
- b ^= (beta1 << 16);
+ b6 ^= (beta3 << 8);
+ b6 ^= (beta1 << 16);
R1[1] = GF216MUL(TL10, TH10, R1[2]) ^ GF216MUL(TL11, TH11, R1[7]);\
R1[2] = GF216MUL(TL10, TH10, R1[3]) ^ GF216MUL(TL11, TH11, R1[8]);\
@@ -918,13 +743,10 @@
temp0 = beta2 | (beta1 << 8);
R0[7] += temp0;
R0[7] &= 0xffff;
- b ^= (temp0 << 16);
+ b6 ^= (temp0 << 16);
temp1 = beta3 | (beta0 << 8);
- b ^= temp1;;
+ b6 ^= temp1;;
- /* Output 32 bits */
- *(ks++) = U32TO32_LITTLE(b);
-
R0[1] = GF216MUL(TL00, TH00, R0[4]) ^ GF216MUL(TL01, TH01, R0[5]);\
R0[2] = GF216MUL(TL00, TH00, R0[5]) ^ GF216MUL(TL01, TH01, R0[6]);\
@@ -939,8 +761,8 @@
beta2 = D8[alpha2];
D8[alpha2] = beta0;
D8[alpha0] = beta2;
- b = beta2;
- b ^= (beta0 << 24);
+ b7 = beta2;
+ b7 ^= (beta0 << 24);
/* Swap(D8[alpha1], D8[alpha3]) */
beta1 = D8[alpha1];
@@ -948,8 +770,8 @@
D8[alpha3] = beta1;
D8[alpha1] = beta3;
- b ^= (beta3 << 8);
- b ^= (beta1 << 16);
+ b7 ^= (beta3 << 8);
+ b7 ^= (beta1 << 16);
R1[3] = GF216MUL(TL10, TH10, R1[4]) ^ GF216MUL(TL11, TH11, R1[9]);\
R1[4] = GF216MUL(TL10, TH10, R1[5]) ^ GF216MUL(TL11, TH11, R1[0]);\
@@ -976,12 +798,9 @@
temp0 = beta2 | (beta1 << 8);
R0[9] += temp0;
R0[9] &= 0xffff;
- b ^= (temp0 << 16);
+ b7 ^= (temp0 << 16);
temp1 = beta3 | (beta0 << 8);
- b ^= temp1;;
-
- /* Output 32 bits */
- *(ks++) = U32TO32_LITTLE(b);
+ b7 ^= temp1;;
R0[3] = GF216MUL(TL00, TH00, R0[6]) ^ GF216MUL(TL01, TH01, R0[7]);\
R0[4] = GF216MUL(TL00, TH00, R0[7]) ^ GF216MUL(TL01, TH01, R0[8]);\
@@ -997,8 +816,8 @@
beta2 = D8[alpha2];
D8[alpha2] = beta0;
D8[alpha0] = beta2;
- b = beta2;
- b ^= (beta0 << 24);
+ b8 = beta2;
+ b8 ^= (beta0 << 24);
/* Swap(D8[alpha1], D8[alpha3]) */
beta1 = D8[alpha1];
@@ -1006,8 +825,8 @@
D8[alpha3] = beta1;
D8[alpha1] = beta3;
- b ^= (beta3 << 8);
- b ^= (beta1 << 16);
+ b8 ^= (beta3 << 8);
+ b8 ^= (beta1 << 16);
R1[5] = GF216MUL(TL10, TH10, R1[6]) ^ GF216MUL(TL11, TH11, R1[1]);\
R1[6] = GF216MUL(TL10, TH10, R1[7]) ^ GF216MUL(TL11, TH11, R1[2]);\
@@ -1034,15 +853,10 @@
temp0 = beta2 | (beta1 << 8);
R0[1] += temp0;
R0[1] &= 0xffff;
- b ^= (temp0 << 16);
+ b8 ^= (temp0 << 16);
temp1 = beta3 | (beta0 << 8);
- b ^= temp1;;
-
- /* Output 32 bits */
- *(ks++) = U32TO32_LITTLE(b);
-
-
- R0[5] = GF216MUL(TL00, TH00, R0[8]) ^ GF216MUL(TL01, TH01, R0[9]);\
+ b8 ^= temp1;;
+
R0[5] = GF216MUL(TL00, TH00, R0[8]) ^ GF216MUL(TL01, TH01, R0[9]);\
R0[6] = GF216MUL(TL00, TH00, R0[9]) ^ GF216MUL(TL01, TH01, R0[0]);\
/* Calculate alphas and betas */
@@ -1056,8 +870,8 @@
beta2 = D8[alpha2];
D8[alpha2] = beta0;
D8[alpha0] = beta2;
- b = beta2;
- b ^= (beta0 << 24);
+ b9 = beta2;
+ b9 ^= (beta0 << 24);
/* Swap(D8[alpha1], D8[alpha3]) */
beta1 = D8[alpha1];
@@ -1065,8 +879,8 @@
D8[alpha3] = beta1;
D8[alpha1] = beta3;
- b ^= (beta3 << 8);
- b ^= (beta1 << 16);
+ b9 ^= (beta3 << 8);
+ b9 ^= (beta1 << 16);
R1[7] = GF216MUL(TL10, TH10, R1[8]) ^ GF216MUL(TL11, TH11, R1[3]);\
R1[8] = GF216MUL(TL10, TH10, R1[9]) ^ GF216MUL(TL11, TH11, R1[4]);\
@@ -1093,51 +907,43 @@
temp0 = beta2 | (beta1 << 8);
R0[3] += temp0;
R0[3] &= 0xffff;
- b ^= (temp0 << 16);
+ b9 ^= (temp0 << 16);
temp1 = beta3 | (beta0 << 8);
- b ^= temp1;;
-
- /* Output 32 bits */
- *(ks++) = U32TO32_LITTLE(b);
+ b9 ^= temp1;
- /* Fix values */
- length -= 20;
- }
-
- while (length)
- {
- STEP_R0_TWO_STEPS;
+ R0[8] = GF216MUL(TL00, TH00, R0[1]) ^ GF216MUL(TL01, TH01, R0[2]);\
+ R0[7] = GF216MUL(TL00, TH00, R0[0]) ^ GF216MUL(TL01, TH01, R0[1]);\
/* Calculate alphas and betas */
- alpha0 = R0[6] >> 8;
- alpha1 = R0[6] & 0xff;
- alpha2 = R0[5] >> 8;
- alpha3 = R0[5] & 0xff;
+ alpha3 = R0[7] & 0xff;
+ alpha2 = R0[7] >> 8;
+ alpha1 = R0[8] & 0xff;
+ alpha0 = R0[8] >> 8;
/* Swap(D8[alpha0], D8[alpha2]) */
beta0 = D8[alpha0];
beta2 = D8[alpha2];
D8[alpha2] = beta0;
D8[alpha0] = beta2;
- b = beta2;
- b ^= (beta0 << 24);
+ b10 = beta2;
+ b10 ^= (beta0 << 24);
/* Swap(D8[alpha1], D8[alpha3]) */
beta1 = D8[alpha1];
beta3 = D8[alpha3];
-
D8[alpha3] = beta1;
D8[alpha1] = beta3;
- b ^= (beta3 << 8);
- b ^= (beta1 << 16);
-
- STEP_R1_TWO_STEPS;
+ b10 ^= (beta3 << 8);
+ b10 ^= (beta1 << 16);
+
+ R1[9] = GF216MUL(TL10, TH10, R1[0]) ^ GF216MUL(TL11, TH11, R1[5]);\
+ R1[0] = GF216MUL(TL10, TH10, R1[1]) ^ GF216MUL(TL11, TH11, R1[6]);\
/* Calculate alphas and betas */
- alpha2 = R1[7] >> 8;
- alpha3 = R1[7] & 0xff;
- alpha0 = R1[8] >> 8;
- alpha1 = R1[8] & 0xff;
+ alpha0 = R1[0] >> 8;
+ alpha1 = R1[0] & 0xff;
+ alpha2 = R1[9] >> 8;
+ alpha3 = R1[9] & 0xff;
/* Swap(D8[alpha0], D8[alpha2]) */
beta0 = D8[alpha0];
@@ -1153,25 +959,1227 @@
/* Update R0[3] */
temp0 = beta2 | (beta1 << 8);
- R0[3] += temp0;
- R0[3] &= 0xffff;
- b ^= (temp0 << 16);
+ R0[5] += temp0;
+ R0[5] &= 0xffff;
+ b10 ^= (temp0 << 16);
temp1 = beta3 | (beta0 << 8);
- b ^= temp1;;
+ b10 ^= temp1;;
+
+ R0[9] = GF216MUL(TL00, TH00, R0[2]) ^ GF216MUL(TL01, TH01, R0[3]);\
+ R0[0] = GF216MUL(TL00, TH00, R0[3]) ^ GF216MUL(TL01, TH01, R0[4]);\
- /* Output 32 bits */
- *(ks++) = U32TO32_LITTLE(b);
- length -= 4;
+ /* Calculate alphas and betas */
+ alpha0 = R0[0] >> 8;
+ alpha1 = R0[0] & 0xff;
+ alpha2 = R0[9] >> 8;
+ alpha3 = R0[9] & 0xff;
-#ifdef CIPHER_DEBUG
- fprintf(stderr,"\n\n");
- fprintf(stderr,"%02x ", b & 0xff);
- fprintf(stderr,"%02x ", (b >> 8) & 0xff);
- fprintf(stderr,"%02x ", (b >> 16) & 0xff);
- fprintf(stderr,"%02x ", (b >> 24) & 0xff);
- fprintf(stderr,"\n\n");
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha2] = beta0;
+ D8[alpha0] = beta2;
+ b11 = beta2;
+ b11 ^= (beta0 << 24);
-#endif
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+
+ D8[alpha3] = beta1;
+ D8[alpha1] = beta3;
+ b11 ^= (beta3 << 8);
+ b11 ^= (beta1 << 16);
+
+ R1[1] = GF216MUL(TL10, TH10, R1[2]) ^ GF216MUL(TL11, TH11, R1[7]);\
+ R1[2] = GF216MUL(TL10, TH10, R1[3]) ^ GF216MUL(TL11, TH11, R1[8]);\
+
+ /* Calculate alphas and betas */
+ alpha2 = R1[1] >> 8;
+ alpha3 = R1[1] & 0xff;
+ alpha0 = R1[2] >> 8;
+ alpha1 = R1[2] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha0] = beta2;
+ D8[alpha2] = beta0;
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+ D8[alpha1] = beta3;
+ D8[alpha3] = beta1;
+
+ /* Update R0[3] */
+ temp0 = beta2 | (beta1 << 8);
+ R0[7] += temp0;
+ R0[7] &= 0xffff;
+ b11 ^= (temp0 << 16);
+ temp1 = beta3 | (beta0 << 8);
+ b11 ^= temp1;;
+
+ R0[1] = GF216MUL(TL00, TH00, R0[4]) ^ GF216MUL(TL01, TH01, R0[5]);\
+ R0[2] = GF216MUL(TL00, TH00, R0[5]) ^ GF216MUL(TL01, TH01, R0[6]);\
+
+ /* Calculate alphas and betas */
+ alpha0 = R0[2] >> 8;
+ alpha1 = R0[2] & 0xff;
+ alpha2 = R0[1] >> 8;
+ alpha3 = R0[1] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha2] = beta0;
+ D8[alpha0] = beta2;
+ b12 = beta2;
+ b12 ^= (beta0 << 24);
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+
+ D8[alpha3] = beta1;
+ D8[alpha1] = beta3;
+ b12 ^= (beta3 << 8);
+ b12 ^= (beta1 << 16);
+
+ R1[3] = GF216MUL(TL10, TH10, R1[4]) ^ GF216MUL(TL11, TH11, R1[9]);\
+ R1[4] = GF216MUL(TL10, TH10, R1[5]) ^ GF216MUL(TL11, TH11, R1[0]);\
+
+ /* Calculate alphas and betas */
+ alpha2 = R1[3] >> 8;
+ alpha3 = R1[3] & 0xff;
+ alpha0 = R1[4] >> 8;
+ alpha1 = R1[4] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha0] = beta2;
+ D8[alpha2] = beta0;
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+ D8[alpha1] = beta3;
+ D8[alpha3] = beta1;
+
+ /* Update R0[3] */
+ temp0 = beta2 | (beta1 << 8);
+ R0[9] += temp0;
+ R0[9] &= 0xffff;
+ b12 ^= (temp0 << 16);
+ temp1 = beta3 | (beta0 << 8);
+ b12 ^= temp1;;
+
+ R0[3] = GF216MUL(TL00, TH00, R0[6]) ^ GF216MUL(TL01, TH01, R0[7]);\
+ R0[4] = GF216MUL(TL00, TH00, R0[7]) ^ GF216MUL(TL01, TH01, R0[8]);\
+
+ /* Calculate alphas and betas */
+ alpha0 = R0[4] >> 8;
+ alpha1 = R0[4] & 0xff;
+ alpha2 = R0[3] >> 8;
+ alpha3 = R0[3] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha2] = beta0;
+ D8[alpha0] = beta2;
+ b13 = beta2;
+ b13 ^= (beta0 << 24);
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+
+ D8[alpha3] = beta1;
+ D8[alpha1] = beta3;
+ b13 ^= (beta3 << 8);
+ b13 ^= (beta1 << 16);
+
+ R1[5] = GF216MUL(TL10, TH10, R1[6]) ^ GF216MUL(TL11, TH11, R1[1]);\
+ R1[6] = GF216MUL(TL10, TH10, R1[7]) ^ GF216MUL(TL11, TH11, R1[2]);\
+
+ /* Calculate alphas and betas */
+ alpha2 = R1[5] >> 8;
+ alpha3 = R1[5] & 0xff;
+ alpha0 = R1[6] >> 8;
+ alpha1 = R1[6] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha0] = beta2;
+ D8[alpha2] = beta0;
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+ D8[alpha1] = beta3;
+ D8[alpha3] = beta1;
+
+ /* Update R0[3] */
+ temp0 = beta2 | (beta1 << 8);
+ R0[1] += temp0;
+ R0[1] &= 0xffff;
+ b13 ^= (temp0 << 16);
+ temp1 = beta3 | (beta0 << 8);
+ b13 ^= temp1;;
+
R0[5] = GF216MUL(TL00, TH00, R0[8]) ^ GF216MUL(TL01, TH01, R0[9]);\
+ R0[6] = GF216MUL(TL00, TH00, R0[9]) ^ GF216MUL(TL01, TH01, R0[0]);\
+
+ /* Calculate alphas and betas */
+ alpha0 = R0[6] >> 8;
+ alpha1 = R0[6] & 0xff;
+ alpha2 = R0[5] >> 8;
+ alpha3 = R0[5] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha2] = beta0;
+ D8[alpha0] = beta2;
+ b14 = beta2;
+ b14 ^= (beta0 << 24);
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+
+ D8[alpha3] = beta1;
+ D8[alpha1] = beta3;
+ b14 ^= (beta3 << 8);
+ b14 ^= (beta1 << 16);
+
+ R1[7] = GF216MUL(TL10, TH10, R1[8]) ^ GF216MUL(TL11, TH11, R1[3]);\
+ R1[8] = GF216MUL(TL10, TH10, R1[9]) ^ GF216MUL(TL11, TH11, R1[4]);\
+
+ /* Calculate alphas and betas */
+ alpha2 = R1[7] >> 8;
+ alpha3 = R1[7] & 0xff;
+ alpha0 = R1[8] >> 8;
+ alpha1 = R1[8] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha0] = beta2;
+ D8[alpha2] = beta0;
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+ D8[alpha1] = beta3;
+ D8[alpha3] = beta1;
+
+ /* Update R0[3] */
+ temp0 = beta2 | (beta1 << 8);
+ R0[3] += temp0;
+ R0[3] &= 0xffff;
+ b14 ^= (temp0 << 16);
+ temp1 = beta3 | (beta0 << 8);
+ b14 ^= temp1;
+
+
+ /* Output 160 bits */
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b0);
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b1);
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b2);
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b3);
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b4);
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b5);
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b6);
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b7);
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b8);
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b9);
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b10);
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b11);
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b12);
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b13);
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b14);
+
+ msglen -= 60;
+ }
+
+ if (msglen >= 40)
+ {
+ R0[7] = GF216MUL(TL00, TH00, R0[0]) ^ GF216MUL(TL01, TH01, R0[1]);\
+ R0[8] = GF216MUL(TL00, TH00, R0[1]) ^ GF216MUL(TL01, TH01, R0[2]);\
+
+ /* Calculate alphas and betas */
+ alpha0 = R0[8] >> 8;
+ alpha1 = R0[8] & 0xff;
+ alpha2 = R0[7] >> 8;
+ alpha3 = R0[7] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha2] = beta0;
+ D8[alpha0] = beta2;
+ b0 = beta2;
+ b0 ^= (beta0 << 24);
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+ D8[alpha3] = beta1;
+ D8[alpha1] = beta3;
+ b0 ^= (beta3 << 8);
+ b0 ^= (beta1 << 16);
+
+ R1[9] = GF216MUL(TL10, TH10, R1[0]) ^ GF216MUL(TL11, TH11, R1[5]);\
+ R1[0] = GF216MUL(TL10, TH10, R1[1]) ^ GF216MUL(TL11, TH11, R1[6]);\
+
+ /* Calculate alphas and betas */
+ alpha0 = R1[0] >> 8;
+ alpha1 = R1[0] & 0xff;
+ alpha2 = R1[9] >> 8;
+ alpha3 = R1[9] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha0] = beta2;
+ D8[alpha2] = beta0;
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+ D8[alpha1] = beta3;
+ D8[alpha3] = beta1;
+
+ /* Update R0[3] */
+ temp0 = beta2 | (beta1 << 8);
+ R0[5] += temp0;
+ R0[5] &= 0xffff;
+ b0 ^= (temp0 << 16);
+ temp1 = beta3 | (beta0 << 8);
+ b0 ^= temp1;;
+
+ R0[9] = GF216MUL(TL00, TH00, R0[2]) ^ GF216MUL(TL01, TH01, R0[3]);\
+ R0[0] = GF216MUL(TL00, TH00, R0[3]) ^ GF216MUL(TL01, TH01, R0[4]);\
+
+ /* Calculate alphas and betas */
+ alpha0 = R0[0] >> 8;
+ alpha1 = R0[0] & 0xff;
+ alpha2 = R0[9] >> 8;
+ alpha3 = R0[9] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha2] = beta0;
+ D8[alpha0] = beta2;
+ b1 = beta2;
+ b1 ^= (beta0 << 24);
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+
+ D8[alpha3] = beta1;
+ D8[alpha1] = beta3;
+ b1 ^= (beta3 << 8);
+ b1 ^= (beta1 << 16);
+
+ R1[1] = GF216MUL(TL10, TH10, R1[2]) ^ GF216MUL(TL11, TH11, R1[7]);\
+ R1[2] = GF216MUL(TL10, TH10, R1[3]) ^ GF216MUL(TL11, TH11, R1[8]);\
+
+ /* Calculate alphas and betas */
+ alpha2 = R1[1] >> 8;
+ alpha3 = R1[1] & 0xff;
+ alpha0 = R1[2] >> 8;
+ alpha1 = R1[2] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha0] = beta2;
+ D8[alpha2] = beta0;
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+ D8[alpha1] = beta3;
+ D8[alpha3] = beta1;
+
+ /* Update R0[3] */
+ temp0 = beta2 | (beta1 << 8);
+ R0[7] += temp0;
+ R0[7] &= 0xffff;
+ b1 ^= (temp0 << 16);
+ temp1 = beta3 | (beta0 << 8);
+ b1 ^= temp1;;
+
+ R0[1] = GF216MUL(TL00, TH00, R0[4]) ^ GF216MUL(TL01, TH01, R0[5]);\
+ R0[2] = GF216MUL(TL00, TH00, R0[5]) ^ GF216MUL(TL01, TH01, R0[6]);\
+
+ /* Calculate alphas and betas */
+ alpha0 = R0[2] >> 8;
+ alpha1 = R0[2] & 0xff;
+ alpha2 = R0[1] >> 8;
+ alpha3 = R0[1] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha2] = beta0;
+ D8[alpha0] = beta2;
+ b2 = beta2;
+ b2 ^= (beta0 << 24);
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+
+ D8[alpha3] = beta1;
+ D8[alpha1] = beta3;
+ b2 ^= (beta3 << 8);
+ b2 ^= (beta1 << 16);
+
+ R1[3] = GF216MUL(TL10, TH10, R1[4]) ^ GF216MUL(TL11, TH11, R1[9]);\
+ R1[4] = GF216MUL(TL10, TH10, R1[5]) ^ GF216MUL(TL11, TH11, R1[0]);\
+
+ /* Calculate alphas and betas */
+ alpha2 = R1[3] >> 8;
+ alpha3 = R1[3] & 0xff;
+ alpha0 = R1[4] >> 8;
+ alpha1 = R1[4] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha0] = beta2;
+ D8[alpha2] = beta0;
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+ D8[alpha1] = beta3;
+ D8[alpha3] = beta1;
+
+ /* Update R0[3] */
+ temp0 = beta2 | (beta1 << 8);
+ R0[9] += temp0;
+ R0[9] &= 0xffff;
+ b2 ^= (temp0 << 16);
+ temp1 = beta3 | (beta0 << 8);
+ b2 ^= temp1;;
+
+ R0[3] = GF216MUL(TL00, TH00, R0[6]) ^ GF216MUL(TL01, TH01, R0[7]);\
+ R0[4] = GF216MUL(TL00, TH00, R0[7]) ^ GF216MUL(TL01, TH01, R0[8]);\
+
+ /* Calculate alphas and betas */
+ alpha0 = R0[4] >> 8;
+ alpha1 = R0[4] & 0xff;
+ alpha2 = R0[3] >> 8;
+ alpha3 = R0[3] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha2] = beta0;
+ D8[alpha0] = beta2;
+ b3 = beta2;
+ b3 ^= (beta0 << 24);
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+
+ D8[alpha3] = beta1;
+ D8[alpha1] = beta3;
+ b3 ^= (beta3 << 8);
+ b3 ^= (beta1 << 16);
+
+ R1[5] = GF216MUL(TL10, TH10, R1[6]) ^ GF216MUL(TL11, TH11, R1[1]);\
+ R1[6] = GF216MUL(TL10, TH10, R1[7]) ^ GF216MUL(TL11, TH11, R1[2]);\
+
+ /* Calculate alphas and betas */
+ alpha2 = R1[5] >> 8;
+ alpha3 = R1[5] & 0xff;
+ alpha0 = R1[6] >> 8;
+ alpha1 = R1[6] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha0] = beta2;
+ D8[alpha2] = beta0;
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+ D8[alpha1] = beta3;
+ D8[alpha3] = beta1;
+
+ /* Update R0[3] */
+ temp0 = beta2 | (beta1 << 8);
+ R0[1] += temp0;
+ R0[1] &= 0xffff;
+ b3 ^= (temp0 << 16);
+ temp1 = beta3 | (beta0 << 8);
+ b3 ^= temp1;;
+
R0[5] = GF216MUL(TL00, TH00, R0[8]) ^ GF216MUL(TL01, TH01, R0[9]);\
+ R0[6] = GF216MUL(TL00, TH00, R0[9]) ^ GF216MUL(TL01, TH01, R0[0]);\
+
+ /* Calculate alphas and betas */
+ alpha0 = R0[6] >> 8;
+ alpha1 = R0[6] & 0xff;
+ alpha2 = R0[5] >> 8;
+ alpha3 = R0[5] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha2] = beta0;
+ D8[alpha0] = beta2;
+ b4 = beta2;
+ b4 ^= (beta0 << 24);
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+
+ D8[alpha3] = beta1;
+ D8[alpha1] = beta3;
+ b4 ^= (beta3 << 8);
+ b4 ^= (beta1 << 16);
+
+ R1[7] = GF216MUL(TL10, TH10, R1[8]) ^ GF216MUL(TL11, TH11, R1[3]);\
+ R1[8] = GF216MUL(TL10, TH10, R1[9]) ^ GF216MUL(TL11, TH11, R1[4]);\
+
+ /* Calculate alphas and betas */
+ alpha2 = R1[7] >> 8;
+ alpha3 = R1[7] & 0xff;
+ alpha0 = R1[8] >> 8;
+ alpha1 = R1[8] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha0] = beta2;
+ D8[alpha2] = beta0;
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+ D8[alpha1] = beta3;
+ D8[alpha3] = beta1;
+
+ /* Update R0[3] */
+ temp0 = beta2 | (beta1 << 8);
+ R0[3] += temp0;
+ R0[3] &= 0xffff;
+ b4 ^= (temp0 << 16);
+ temp1 = beta3 | (beta0 << 8);
+ b4 ^= temp1;;
+
+ R0[8] = GF216MUL(TL00, TH00, R0[1]) ^ GF216MUL(TL01, TH01, R0[2]);\
+ R0[7] = GF216MUL(TL00, TH00, R0[0]) ^ GF216MUL(TL01, TH01, R0[1]);\
+
+ /* Calculate alphas and betas */
+ alpha3 = R0[7] & 0xff;
+ alpha2 = R0[7] >> 8;
+ alpha1 = R0[8] & 0xff;
+ alpha0 = R0[8] >> 8;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha2] = beta0;
+ D8[alpha0] = beta2;
+ b5 = beta2;
+ b5 ^= (beta0 << 24);
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+ D8[alpha3] = beta1;
+ D8[alpha1] = beta3;
+ b5 ^= (beta3 << 8);
+ b5 ^= (beta1 << 16);
+
+ R1[9] = GF216MUL(TL10, TH10, R1[0]) ^ GF216MUL(TL11, TH11, R1[5]);\
+ R1[0] = GF216MUL(TL10, TH10, R1[1]) ^ GF216MUL(TL11, TH11, R1[6]);\
+
+ /* Calculate alphas and betas */
+ alpha0 = R1[0] >> 8;
+ alpha1 = R1[0] & 0xff;
+ alpha2 = R1[9] >> 8;
+ alpha3 = R1[9] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha0] = beta2;
+ D8[alpha2] = beta0;
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+ D8[alpha1] = beta3;
+ D8[alpha3] = beta1;
+
+ /* Update R0[3] */
+ temp0 = beta2 | (beta1 << 8);
+ R0[5] += temp0;
+ R0[5] &= 0xffff;
+ b5 ^= (temp0 << 16);
+ temp1 = beta3 | (beta0 << 8);
+ b5 ^= temp1;;
+
+ R0[9] = GF216MUL(TL00, TH00, R0[2]) ^ GF216MUL(TL01, TH01, R0[3]);\
+ R0[0] = GF216MUL(TL00, TH00, R0[3]) ^ GF216MUL(TL01, TH01, R0[4]);\
+
+ /* Calculate alphas and betas */
+ alpha0 = R0[0] >> 8;
+ alpha1 = R0[0] & 0xff;
+ alpha2 = R0[9] >> 8;
+ alpha3 = R0[9] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha2] = beta0;
+ D8[alpha0] = beta2;
+ b6 = beta2;
+ b6 ^= (beta0 << 24);
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+
+ D8[alpha3] = beta1;
+ D8[alpha1] = beta3;
+ b6 ^= (beta3 << 8);
+ b6 ^= (beta1 << 16);
+
+ R1[1] = GF216MUL(TL10, TH10, R1[2]) ^ GF216MUL(TL11, TH11, R1[7]);\
+ R1[2] = GF216MUL(TL10, TH10, R1[3]) ^ GF216MUL(TL11, TH11, R1[8]);\
+
+ /* Calculate alphas and betas */
+ alpha2 = R1[1] >> 8;
+ alpha3 = R1[1] & 0xff;
+ alpha0 = R1[2] >> 8;
+ alpha1 = R1[2] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha0] = beta2;
+ D8[alpha2] = beta0;
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+ D8[alpha1] = beta3;
+ D8[alpha3] = beta1;
+
+ /* Update R0[3] */
+ temp0 = beta2 | (beta1 << 8);
+ R0[7] += temp0;
+ R0[7] &= 0xffff;
+ b6 ^= (temp0 << 16);
+ temp1 = beta3 | (beta0 << 8);
+ b6 ^= temp1;;
+
+ R0[1] = GF216MUL(TL00, TH00, R0[4]) ^ GF216MUL(TL01, TH01, R0[5]);\
+ R0[2] = GF216MUL(TL00, TH00, R0[5]) ^ GF216MUL(TL01, TH01, R0[6]);\
+
+ /* Calculate alphas and betas */
+ alpha0 = R0[2] >> 8;
+ alpha1 = R0[2] & 0xff;
+ alpha2 = R0[1] >> 8;
+ alpha3 = R0[1] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha2] = beta0;
+ D8[alpha0] = beta2;
+ b7 = beta2;
+ b7 ^= (beta0 << 24);
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+
+ D8[alpha3] = beta1;
+ D8[alpha1] = beta3;
+ b7 ^= (beta3 << 8);
+ b7 ^= (beta1 << 16);
+
+ R1[3] = GF216MUL(TL10, TH10, R1[4]) ^ GF216MUL(TL11, TH11, R1[9]);\
+ R1[4] = GF216MUL(TL10, TH10, R1[5]) ^ GF216MUL(TL11, TH11, R1[0]);\
+
+ /* Calculate alphas and betas */
+ alpha2 = R1[3] >> 8;
+ alpha3 = R1[3] & 0xff;
+ alpha0 = R1[4] >> 8;
+ alpha1 = R1[4] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha0] = beta2;
+ D8[alpha2] = beta0;
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+ D8[alpha1] = beta3;
+ D8[alpha3] = beta1;
+
+ /* Update R0[3] */
+ temp0 = beta2 | (beta1 << 8);
+ R0[9] += temp0;
+ R0[9] &= 0xffff;
+ b7 ^= (temp0 << 16);
+ temp1 = beta3 | (beta0 << 8);
+ b7 ^= temp1;;
+
+ R0[3] = GF216MUL(TL00, TH00, R0[6]) ^ GF216MUL(TL01, TH01, R0[7]);\
+ R0[4] = GF216MUL(TL00, TH00, R0[7]) ^ GF216MUL(TL01, TH01, R0[8]);\
+
+ /* Calculate alphas and betas */
+ alpha0 = R0[4] >> 8;
+ alpha1 = R0[4] & 0xff;
+ alpha2 = R0[3] >> 8;
+ alpha3 = R0[3] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha2] = beta0;
+ D8[alpha0] = beta2;
+ b8 = beta2;
+ b8 ^= (beta0 << 24);
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+
+ D8[alpha3] = beta1;
+ D8[alpha1] = beta3;
+ b8 ^= (beta3 << 8);
+ b8 ^= (beta1 << 16);
+
+ R1[5] = GF216MUL(TL10, TH10, R1[6]) ^ GF216MUL(TL11, TH11, R1[1]);\
+ R1[6] = GF216MUL(TL10, TH10, R1[7]) ^ GF216MUL(TL11, TH11, R1[2]);\
+
+ /* Calculate alphas and betas */
+ alpha2 = R1[5] >> 8;
+ alpha3 = R1[5] & 0xff;
+ alpha0 = R1[6] >> 8;
+ alpha1 = R1[6] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha0] = beta2;
+ D8[alpha2] = beta0;
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+ D8[alpha1] = beta3;
+ D8[alpha3] = beta1;
+
+ /* Update R0[3] */
+ temp0 = beta2 | (beta1 << 8);
+ R0[1] += temp0;
+ R0[1] &= 0xffff;
+ b8 ^= (temp0 << 16);
+ temp1 = beta3 | (beta0 << 8);
+ b8 ^= temp1;;
+
R0[5] = GF216MUL(TL00, TH00, R0[8]) ^ GF216MUL(TL01, TH01, R0[9]);\
+ R0[6] = GF216MUL(TL00, TH00, R0[9]) ^ GF216MUL(TL01, TH01, R0[0]);\
+
+ /* Calculate alphas and betas */
+ alpha0 = R0[6] >> 8;
+ alpha1 = R0[6] & 0xff;
+ alpha2 = R0[5] >> 8;
+ alpha3 = R0[5] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha2] = beta0;
+ D8[alpha0] = beta2;
+ b9 = beta2;
+ b9 ^= (beta0 << 24);
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+
+ D8[alpha3] = beta1;
+ D8[alpha1] = beta3;
+ b9 ^= (beta3 << 8);
+ b9 ^= (beta1 << 16);
+
+ R1[7] = GF216MUL(TL10, TH10, R1[8]) ^ GF216MUL(TL11, TH11, R1[3]);\
+ R1[8] = GF216MUL(TL10, TH10, R1[9]) ^ GF216MUL(TL11, TH11, R1[4]);\
+
+ /* Calculate alphas and betas */
+ alpha2 = R1[7] >> 8;
+ alpha3 = R1[7] & 0xff;
+ alpha0 = R1[8] >> 8;
+ alpha1 = R1[8] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha0] = beta2;
+ D8[alpha2] = beta0;
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+ D8[alpha1] = beta3;
+ D8[alpha3] = beta1;
+
+ /* Update R0[3] */
+ temp0 = beta2 | (beta1 << 8);
+ R0[3] += temp0;
+ R0[3] &= 0xffff;
+ b9 ^= (temp0 << 16);
+ temp1 = beta3 | (beta0 << 8);
+ b9 ^= temp1;
+
+ /* Output 160 bits */
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b0);
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b1);
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b2);
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b3);
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b4);
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b5);
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b6);
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b7);
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b8);
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b9);
+
+ msglen -= 40;
+ }
+
+ if (msglen >= 20)
+ {
+ R0[8] = GF216MUL(TL00, TH00, R0[1]) ^ GF216MUL(TL01, TH01, R0[2]);\
+ R0[7] = GF216MUL(TL00, TH00, R0[0]) ^ GF216MUL(TL01, TH01, R0[1]);\
+
+ /* Calculate alphas and betas */
+ alpha3 = R0[7] & 0xff;
+ alpha2 = R0[7] >> 8;
+ alpha1 = R0[8] & 0xff;
+ alpha0 = R0[8] >> 8;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha2] = beta0;
+ D8[alpha0] = beta2;
+ b0 = beta2;
+ b0 ^= (beta0 << 24);
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+ D8[alpha3] = beta1;
+ D8[alpha1] = beta3;
+ b0 ^= (beta3 << 8);
+ b0 ^= (beta1 << 16);
+
+ R1[9] = GF216MUL(TL10, TH10, R1[0]) ^ GF216MUL(TL11, TH11, R1[5]);\
+ R1[0] = GF216MUL(TL10, TH10, R1[1]) ^ GF216MUL(TL11, TH11, R1[6]);\
+
+ /* Calculate alphas and betas */
+ alpha0 = R1[0] >> 8;
+ alpha1 = R1[0] & 0xff;
+ alpha2 = R1[9] >> 8;
+ alpha3 = R1[9] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha0] = beta2;
+ D8[alpha2] = beta0;
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+ D8[alpha1] = beta3;
+ D8[alpha3] = beta1;
+
+ /* Update R0[3] */
+ temp0 = beta2 | (beta1 << 8);
+ R0[5] += temp0;
+ R0[5] &= 0xffff;
+ b0 ^= (temp0 << 16);
+ temp1 = beta3 | (beta0 << 8);
+ b0 ^= temp1;;
+
+ R0[9] = GF216MUL(TL00, TH00, R0[2]) ^ GF216MUL(TL01, TH01, R0[3]);\
+ R0[0] = GF216MUL(TL00, TH00, R0[3]) ^ GF216MUL(TL01, TH01, R0[4]);\
+
+ /* Calculate alphas and betas */
+ alpha0 = R0[0] >> 8;
+ alpha1 = R0[0] & 0xff;
+ alpha2 = R0[9] >> 8;
+ alpha3 = R0[9] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha2] = beta0;
+ D8[alpha0] = beta2;
+ b1 = beta2;
+ b1 ^= (beta0 << 24);
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+
+ D8[alpha3] = beta1;
+ D8[alpha1] = beta3;
+ b1 ^= (beta3 << 8);
+ b1 ^= (beta1 << 16);
+
+ R1[1] = GF216MUL(TL10, TH10, R1[2]) ^ GF216MUL(TL11, TH11, R1[7]);\
+ R1[2] = GF216MUL(TL10, TH10, R1[3]) ^ GF216MUL(TL11, TH11, R1[8]);\
+
+ /* Calculate alphas and betas */
+ alpha2 = R1[1] >> 8;
+ alpha3 = R1[1] & 0xff;
+ alpha0 = R1[2] >> 8;
+ alpha1 = R1[2] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha0] = beta2;
+ D8[alpha2] = beta0;
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+ D8[alpha1] = beta3;
+ D8[alpha3] = beta1;
+
+ /* Update R0[3] */
+ temp0 = beta2 | (beta1 << 8);
+ R0[7] += temp0;
+ R0[7] &= 0xffff;
+ b1 ^= (temp0 << 16);
+ temp1 = beta3 | (beta0 << 8);
+ b1 ^= temp1;;
+
+ R0[1] = GF216MUL(TL00, TH00, R0[4]) ^ GF216MUL(TL01, TH01, R0[5]);\
+ R0[2] = GF216MUL(TL00, TH00, R0[5]) ^ GF216MUL(TL01, TH01, R0[6]);\
+
+ /* Calculate alphas and betas */
+ alpha0 = R0[2] >> 8;
+ alpha1 = R0[2] & 0xff;
+ alpha2 = R0[1] >> 8;
+ alpha3 = R0[1] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha2] = beta0;
+ D8[alpha0] = beta2;
+ b2 = beta2;
+ b2 ^= (beta0 << 24);
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+
+ D8[alpha3] = beta1;
+ D8[alpha1] = beta3;
+ b2 ^= (beta3 << 8);
+ b2 ^= (beta1 << 16);
+
+ R1[3] = GF216MUL(TL10, TH10, R1[4]) ^ GF216MUL(TL11, TH11, R1[9]);\
+ R1[4] = GF216MUL(TL10, TH10, R1[5]) ^ GF216MUL(TL11, TH11, R1[0]);\
+
+ /* Calculate alphas and betas */
+ alpha2 = R1[3] >> 8;
+ alpha3 = R1[3] & 0xff;
+ alpha0 = R1[4] >> 8;
+ alpha1 = R1[4] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha0] = beta2;
+ D8[alpha2] = beta0;
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+ D8[alpha1] = beta3;
+ D8[alpha3] = beta1;
+
+ /* Update R0[3] */
+ temp0 = beta2 | (beta1 << 8);
+ R0[9] += temp0;
+ R0[9] &= 0xffff;
+ b2 ^= (temp0 << 16);
+ temp1 = beta3 | (beta0 << 8);
+ b2 ^= temp1;;
+
+ R0[3] = GF216MUL(TL00, TH00, R0[6]) ^ GF216MUL(TL01, TH01, R0[7]);\
+ R0[4] = GF216MUL(TL00, TH00, R0[7]) ^ GF216MUL(TL01, TH01, R0[8]);\
+
+ /* Calculate alphas and betas */
+ alpha0 = R0[4] >> 8;
+ alpha1 = R0[4] & 0xff;
+ alpha2 = R0[3] >> 8;
+ alpha3 = R0[3] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha2] = beta0;
+ D8[alpha0] = beta2;
+ b3 = beta2;
+ b3 ^= (beta0 << 24);
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+
+ D8[alpha3] = beta1;
+ D8[alpha1] = beta3;
+ b3 ^= (beta3 << 8);
+ b3 ^= (beta1 << 16);
+
+ R1[5] = GF216MUL(TL10, TH10, R1[6]) ^ GF216MUL(TL11, TH11, R1[1]);\
+ R1[6] = GF216MUL(TL10, TH10, R1[7]) ^ GF216MUL(TL11, TH11, R1[2]);\
+
+ /* Calculate alphas and betas */
+ alpha2 = R1[5] >> 8;
+ alpha3 = R1[5] & 0xff;
+ alpha0 = R1[6] >> 8;
+ alpha1 = R1[6] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha0] = beta2;
+ D8[alpha2] = beta0;
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+ D8[alpha1] = beta3;
+ D8[alpha3] = beta1;
+
+ /* Update R0[3] */
+ temp0 = beta2 | (beta1 << 8);
+ R0[1] += temp0;
+ R0[1] &= 0xffff;
+ b3 ^= (temp0 << 16);
+ temp1 = beta3 | (beta0 << 8);
+ b3 ^= temp1;;
+
R0[5] = GF216MUL(TL00, TH00, R0[8]) ^ GF216MUL(TL01, TH01, R0[9]);\
+ R0[6] = GF216MUL(TL00, TH00, R0[9]) ^ GF216MUL(TL01, TH01, R0[0]);\
+
+ /* Calculate alphas and betas */
+ alpha0 = R0[6] >> 8;
+ alpha1 = R0[6] & 0xff;
+ alpha2 = R0[5] >> 8;
+ alpha3 = R0[5] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha2] = beta0;
+ D8[alpha0] = beta2;
+ b4 = beta2;
+ b4 ^= (beta0 << 24);
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+
+ D8[alpha3] = beta1;
+ D8[alpha1] = beta3;
+ b4 ^= (beta3 << 8);
+ b4 ^= (beta1 << 16);
+
+ R1[7] = GF216MUL(TL10, TH10, R1[8]) ^ GF216MUL(TL11, TH11, R1[3]);\
+ R1[8] = GF216MUL(TL10, TH10, R1[9]) ^ GF216MUL(TL11, TH11, R1[4]);\
+
+ /* Calculate alphas and betas */
+ alpha2 = R1[7] >> 8;
+ alpha3 = R1[7] & 0xff;
+ alpha0 = R1[8] >> 8;
+ alpha1 = R1[8] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha0] = beta2;
+ D8[alpha2] = beta0;
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+ D8[alpha1] = beta3;
+ D8[alpha3] = beta1;
+
+ /* Update R0[3] */
+ temp0 = beta2 | (beta1 << 8);
+ R0[3] += temp0;
+ R0[3] &= 0xffff;
+ b4 ^= (temp0 << 16);
+ temp1 = beta3 | (beta0 << 8);
+ b4 ^= temp1;;
+
+ /* Output 32 bits */
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b0);
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b1);
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b2);
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b3);
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b4);
+
+ msglen -= 20;
+ }
+
+ while (msglen)
+ {
+ STEP_R0_TWO_STEPS;
+
+ /* Calculate alphas and betas */
+ alpha0 = R0[6] >> 8;
+ alpha1 = R0[6] & 0xff;
+ alpha2 = R0[5] >> 8;
+ alpha3 = R0[5] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha2] = beta0;
+ D8[alpha0] = beta2;
+ b0 = beta2;
+ b0 ^= (beta0 << 24);
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+
+ D8[alpha3] = beta1;
+ D8[alpha1] = beta3;
+ b0 ^= (beta3 << 8);
+ b0 ^= (beta1 << 16);
+
+ STEP_R1_TWO_STEPS;
+
+ /* Calculate alphas and betas */
+ alpha2 = R1[7] >> 8;
+ alpha3 = R1[7] & 0xff;
+ alpha0 = R1[8] >> 8;
+ alpha1 = R1[8] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha0] = beta2;
+ D8[alpha2] = beta0;
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+ D8[alpha1] = beta3;
+ D8[alpha3] = beta1;
+
+ /* Update R0[3] */
+ temp0 = beta2 | (beta1 << 8);
+ R0[3] += temp0;
+ R0[3] &= 0xffff;
+ b0 ^= (temp0 << 16);
+ temp1 = beta3 | (beta0 << 8);
+ b0 ^= temp1;;
+
+ /* Output 32 bits */
+ *(out++) = *(in++) ^ U32TO32_LITTLE(b0);
+ msglen -= 4;
+ }
+}
+
+void ECRYPT_keystream_bytes(ECRYPT_ctx* ctx, u8* keystream, u32 length)
+{
+ u32 alpha0, alpha1, alpha2, alpha3, beta0, beta1, beta2, beta3;
+ u32 temp0, temp1, b;
+ u32 *R0 = ctx->R0, *R1 = ctx->R1;
+ u8 *D8 = ctx->D8;
+ u32 *ks = (u32*)keystream;
+
+ while (length)
+ {
+ STEP_R0_TWO_STEPS;
+
+ /* Calculate alphas and betas */
+ alpha0 = R0[6] >> 8;
+ alpha1 = R0[6] & 0xff;
+ alpha2 = R0[5] >> 8;
+ alpha3 = R0[5] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha2] = beta0;
+ D8[alpha0] = beta2;
+ b = beta2;
+ b ^= (beta0 << 24);
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+
+ D8[alpha3] = beta1;
+ D8[alpha1] = beta3;
+ b ^= (beta3 << 8);
+ b ^= (beta1 << 16);
+
+ STEP_R1_TWO_STEPS;
+
+ /* Calculate alphas and betas */
+ alpha2 = R1[7] >> 8;
+ alpha3 = R1[7] & 0xff;
+ alpha0 = R1[8] >> 8;
+ alpha1 = R1[8] & 0xff;
+
+ /* Swap(D8[alpha0], D8[alpha2]) */
+ beta0 = D8[alpha0];
+ beta2 = D8[alpha2];
+ D8[alpha0] = beta2;
+ D8[alpha2] = beta0;
+
+ /* Swap(D8[alpha1], D8[alpha3]) */
+ beta1 = D8[alpha1];
+ beta3 = D8[alpha3];
+ D8[alpha1] = beta3;
+ D8[alpha3] = beta1;
+
+ /* Update R0[3] */
+ temp0 = beta2 | (beta1 << 8);
+ R0[3] += temp0;
+ R0[3] &= 0xffff;
+ b ^= (temp0 << 16);
+ temp1 = beta3 | (beta0 << 8);
+ b ^= temp1;;
+
+ /* Output 32 bits */
+ *(ks++) = U32TO32_LITTLE(b);
+ length -= 4;
}
}
New: streamciphers/timings/estreambench/submissions/provest-16
New: streamciphers/timings/estreambench/submissions/provest-32
New: streamciphers/timings/estreambench/submissions/provest-4
New: streamciphers/timings/estreambench/submissions/sfinks/Makefile
New: streamciphers/timings/estreambench/submissions/sfinks/README
New: streamciphers/timings/estreambench/submissions/sfinks/ecrypt-sync.h
New: streamciphers/timings/estreambench/submissions/sfinks/sfinks.c
New: streamciphers/timings/estreambench/submissions/sfinks/unverified.test-vectors
New: streamciphers/timings/estreambench/submissions/sfinks-ae
New: streamciphers/timings/estreambench/submissions/wg-v1-long-iv
New: streamciphers/timings/estreambench/submissions/wg-v1-small-iv
New: streamciphers/timings/estreambench/submissions/wg-v2-long-iv
New: streamciphers/timings/estreambench-20061206.tar.bz2
diff -ru .old-crypto/streamciphers.html cr.yp.to/streamciphers.html
--- .old-crypto/streamciphers.html 2006-11-30 11:33:09.000000000 -0500
+++ cr.yp.to/streamciphers.html 2006-12-06 02:34:19.000000000 -0500
@@ -200,9 +200,9 @@
to include ``phase 2'' cipher implementations (written by the cipher authors).
Here's how to download and benchmark the updated collection:
<pre>
- wget <a href="streamciphers/timings/estreambench-20061130.tar.gz">http://cr.yp.to/streamciphers/timings/estreambench-20061130.tar.gz</a>
- tar -xzf estreambench-20061130.tar.gz
- cd estreambench-20061130
+ wget <a href="streamciphers/timings/estreambench-20061206.tar.bz2">http://cr.yp.to/streamciphers/timings/estreambench-20061206.tar.bz2</a>
+ bunzip2 < estreambench-20061206.tar.bz2 | tar -xf -
+ cd estreambench-20061206
(echo '';echo '';echo '';echo '';echo '') | scripts/configure
cd reports-`hostname`
(../scripts/run; echo ''|../scripts/collect) > run.log 2>&1
@@ -215,6 +215,7 @@
<a href="streamciphers/timings/estreambench-20061122.tar.gz">20061122</a>.
<a href="streamciphers/timings/estreambench-20061126.tar.gz">20061126</a>.
<a href="streamciphers/timings/estreambench-20061130.tar.gz">20061130</a>.
+<a href="streamciphers/timings/estreambench-20061206.tar.bz2">20061206</a>.
<p>
If you want to download and benchmark the official collection instead, here's how:
<pre>