Add implementation of the RC2 block cipher (RFC 2268)

8 files changed, 555 insertions, 4 deletions

diff --git a/src/libstrongswan/Makefile.am b/src/libstrongswan/Makefile.am
index 5968a3b3f..ae4fc75b6 100644
--- a/src/libstrongswan/Makefile.am
+++ b/src/libstrongswan/Makefile.am
@@ -175,6 +175,13 @@ if MONOLITHIC
 endif
 endif
 
+if USE_RC2
+  SUBDIRS += plugins/rc2
+if MONOLITHIC
+  libstrongswan_la_LIBADD += plugins/rc2/libstrongswan-rc2.la
+endif
+endif
+
 if USE_MD4
   SUBDIRS += plugins/md4
 if MONOLITHIC
diff --git a/src/libstrongswan/crypto/crypters/crypter.c b/src/libstrongswan/crypto/crypters/crypter.c
index 0730c707c..8123adde5 100644
--- a/src/libstrongswan/crypto/crypters/crypter.c
+++ b/src/libstrongswan/crypto/crypters/crypter.c
@@ -46,12 +46,13 @@ ENUM_NEXT(encryption_algorithm_names, ENCR_CAMELLIA_CBC, ENCR_CAMELLIA_CCM_ICV16
 	"CAMELLIA_CCM_8",
 	"CAMELLIA_CCM_12",
 	"CAMELLIA_CCM_16");
-ENUM_NEXT(encryption_algorithm_names, ENCR_UNDEFINED, ENCR_TWOFISH_CBC, ENCR_CAMELLIA_CCM_ICV16,
+ENUM_NEXT(encryption_algorithm_names, ENCR_UNDEFINED, ENCR_RC2_CBC, ENCR_CAMELLIA_CCM_ICV16,
 	"UNDEFINED",
 	"DES_ECB",
 	"SERPENT_CBC",
-	"TWOFISH_CBC");
-ENUM_END(encryption_algorithm_names, ENCR_TWOFISH_CBC);
+	"TWOFISH_CBC",
+	"RC2_CBC");
+ENUM_END(encryption_algorithm_names, ENCR_RC2_CBC);
 
 /*
  * Described in header.
diff --git a/src/libstrongswan/crypto/crypters/crypter.h b/src/libstrongswan/crypto/crypters/crypter.h
index fe854f53d..849aea500 100644
--- a/src/libstrongswan/crypto/crypters/crypter.h
+++ b/src/libstrongswan/crypto/crypters/crypter.h
@@ -60,7 +60,9 @@ enum encryption_algorithm_t {
 	ENCR_UNDEFINED =        1024,
 	ENCR_DES_ECB =          1025,
 	ENCR_SERPENT_CBC =      1026,
-	ENCR_TWOFISH_CBC =      1027
+	ENCR_TWOFISH_CBC =      1027,
+	/* see macros below to handle RC2 (effective) key length */
+	ENCR_RC2_CBC =          1028,
 };
 
 #define DES_BLOCK_SIZE			 8
@@ -71,6 +73,15 @@ enum encryption_algorithm_t {
 #define TWOFISH_BLOCK_SIZE		16
 
 /**
+ * For RC2, if the effective key size in bits is not key_size * 8, it should
+ * be encoded with the macro below. It can be decoded with the other two macros.
+ * After decoding the value should be validated.
+ */
+#define RC2_KEY_SIZE(kl, eff) ((kl) | ((eff) << 8))
+#define RC2_EFFECTIVE_KEY_LEN(ks) ((ks) >> 8)
+#define RC2_KEY_LEN(ks) ((ks) & 0xff)
+
+/**
  * enum name for encryption_algorithm_t.
  */
 extern enum_name_t *encryption_algorithm_names;
diff --git a/src/libstrongswan/plugins/rc2/Makefile.am b/src/libstrongswan/plugins/rc2/Makefile.am
new file mode 100644
index 000000000..156574de3
--- /dev/null
+++ b/src/libstrongswan/plugins/rc2/Makefile.am
@@ -0,0 +1,15 @@
+
+INCLUDES = -I$(top_srcdir)/src/libstrongswan
+
+AM_CFLAGS = -rdynamic
+
+if MONOLITHIC
+noinst_LTLIBRARIES = libstrongswan-rc2.la
+else
+plugin_LTLIBRARIES = libstrongswan-rc2.la
+endif
+
+libstrongswan_rc2_la_SOURCES = \
+	rc2_plugin.h rc2_plugin.c rc2_crypter.c rc2_crypter.h
+
+libstrongswan_rc2_la_LDFLAGS = -module -avoid-version
diff --git a/src/libstrongswan/plugins/rc2/rc2_crypter.c b/src/libstrongswan/plugins/rc2/rc2_crypter.c
new file mode 100644
index 000000000..256acf817
--- /dev/null
+++ b/src/libstrongswan/plugins/rc2/rc2_crypter.c
@@ -0,0 +1,349 @@
+/*
+ * Copyright (C) 2013 Tobias Brunner
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#include "rc2_crypter.h"
+
+typedef struct private_rc2_crypter_t private_rc2_crypter_t;
+
+#define RC2_BLOCK_SIZE 8
+
+#define ROL16(x, k)	({ u_int16_t _x = (x); (_x << (k)) | (_x >> (16 - (k))); })
+#define ROR16(x, k)	({ u_int16_t _x = (x); (_x >> (k)) | (_x << (16 - (k))); })
+
+#define GET16(x)	({ u_char *_x = (x); (u_int16_t)_x[0] | ((u_int16_t)_x[1] << 8); })
+#define PUT16(x, v)	({ u_char *_x = (x); u_int16_t _v = (v); _x[0] = _v, _x[1] = _v >> 8; })
+
+/**
+ * Private data of rc2_crypter_t
+ */
+struct private_rc2_crypter_t {
+
+	/**
+	 * Public interface
+	 */
+	rc2_crypter_t public;
+
+	/**
+	* The expanded key in 16-bit words
+	*/
+	u_int16_t  K[64];
+
+	/**
+	* Key size in bytes
+	*/
+	size_t T;
+
+	/**
+	* Effective key size in bits
+	*/
+	size_t T1;
+};
+
+/**
+ * PITABLE
+ */
+static const u_char PITABLE[256] =
+{
+	0xd9, 0x78, 0xf9, 0xc4, 0x19, 0xdd, 0xb5, 0xed,
+	0x28, 0xe9, 0xfd, 0x79, 0x4a, 0xa0, 0xd8, 0x9d,
+	0xc6, 0x7e, 0x37, 0x83, 0x2b, 0x76, 0x53, 0x8e,
+	0x62, 0x4c, 0x64, 0x88, 0x44, 0x8b, 0xfb, 0xa2,
+	0x17, 0x9a, 0x59, 0xf5, 0x87, 0xb3, 0x4f, 0x13,
+	0x61, 0x45, 0x6d, 0x8d, 0x09, 0x81, 0x7d, 0x32,
+	0xbd, 0x8f, 0x40, 0xeb, 0x86, 0xb7, 0x7b, 0x0b,
+	0xf0, 0x95, 0x21, 0x22, 0x5c, 0x6b, 0x4e, 0x82,
+	0x54, 0xd6, 0x65, 0x93, 0xce, 0x60, 0xb2, 0x1c,
+	0x73, 0x56, 0xc0, 0x14, 0xa7, 0x8c, 0xf1, 0xdc,
+	0x12, 0x75, 0xca, 0x1f, 0x3b, 0xbe, 0xe4, 0xd1,
+	0x42, 0x3d, 0xd4, 0x30, 0xa3, 0x3c, 0xb6, 0x26,
+	0x6f, 0xbf, 0x0e, 0xda, 0x46, 0x69, 0x07, 0x57,
+	0x27, 0xf2, 0x1d, 0x9b, 0xbc, 0x94, 0x43, 0x03,
+	0xf8, 0x11, 0xc7, 0xf6, 0x90, 0xef, 0x3e, 0xe7,
+	0x06, 0xc3, 0xd5, 0x2f, 0xc8, 0x66, 0x1e, 0xd7,
+	0x08, 0xe8, 0xea, 0xde, 0x80, 0x52, 0xee, 0xf7,
+	0x84, 0xaa, 0x72, 0xac, 0x35, 0x4d, 0x6a, 0x2a,
+	0x96, 0x1a, 0xd2, 0x71, 0x5a, 0x15, 0x49, 0x74,
+	0x4b, 0x9f, 0xd0, 0x5e, 0x04, 0x18, 0xa4, 0xec,
+	0xc2, 0xe0, 0x41, 0x6e, 0x0f, 0x51, 0xcb, 0xcc,
+	0x24, 0x91, 0xaf, 0x50, 0xa1, 0xf4, 0x70, 0x39,
+	0x99, 0x7c, 0x3a, 0x85, 0x23, 0xb8, 0xb4, 0x7a,
+	0xfc, 0x02, 0x36, 0x5b, 0x25, 0x55, 0x97, 0x31,
+	0x2d, 0x5d, 0xfa, 0x98, 0xe3, 0x8a, 0x92, 0xae,
+	0x05, 0xdf, 0x29, 0x10, 0x67, 0x6c, 0xba, 0xc9,
+	0xd3, 0x00, 0xe6, 0xcf, 0xe1, 0x9e, 0xa8, 0x2c,
+	0x63, 0x16, 0x01, 0x3f, 0x58, 0xe2, 0x89, 0xa9,
+	0x0d, 0x38, 0x34, 0x1b, 0xab, 0x33, 0xff, 0xb0,
+	0xbb, 0x48, 0x0c, 0x5f, 0xb9, 0xb1, 0xcd, 0x2e,
+	0xc5, 0xf3, 0xdb, 0x47, 0xe5, 0xa5, 0x9c, 0x77,
+	0x0a, 0xa6, 0x20, 0x68, 0xfe, 0x7f, 0xc1, 0xad,
+};
+
+/**
+ * Encrypt a single block of data
+ */
+static void encrypt_block(private_rc2_crypter_t *this, u_char R[])
+{
+	register u_int16_t R0, R1, R2, R3, *Kj;
+	int rounds = 3, mix = 5;
+
+	R0 = GET16(R);
+	R1 = GET16(R + 2);
+	R2 = GET16(R + 4);
+	R3 = GET16(R + 6);
+	Kj = &this->K[0];
+
+	/* 5 mix, mash, 6 mix, mash, 5 mix */
+	while (TRUE)
+	{
+		/* mix */
+		R0 = ROL16(R0 + *(Kj++) + (R3 & R2) + (~R3 & R1), 1);
+		R1 = ROL16(R1 + *(Kj++) + (R0 & R3) + (~R0 & R2), 2);
+		R2 = ROL16(R2 + *(Kj++) + (R1 & R0) + (~R1 & R3), 3);
+		R3 = ROL16(R3 + *(Kj++) + (R2 & R1) + (~R2 & R0), 5);
+
+		if (--mix == 0)
+		{
+			if (--rounds == 0)
+			{
+				break;
+			}
+			mix = (rounds == 2) ? 6 : 5;
+			/* mash */
+			R0 += this->K[R3 & 63];
+			R1 += this->K[R0 & 63];
+			R2 += this->K[R1 & 63];
+			R3 += this->K[R2 & 63];
+		}
+	}
+
+	PUT16(R, R0);
+	PUT16(R + 2, R1);
+	PUT16(R + 4, R2);
+	PUT16(R + 6, R3);
+}
+
+/**
+ * Decrypt a single block of data.
+ */
+static void decrypt_block(private_rc2_crypter_t *this, u_char R[])
+{
+	register u_int16_t R0, R1, R2, R3, *Kj;
+	int rounds = 3, mix = 5;
+
+	R0 = GET16(R);
+	R1 = GET16(R + 2);
+	R2 = GET16(R + 4);
+	R3 = GET16(R + 6);
+	Kj = &this->K[63];
+
+	/* 5 r-mix, r-mash, 6 r-mix, r-mash, 5 r-mix */
+	while (TRUE)
+	{
+		/* r-mix */
+		R3 = ROR16(R3, 5);
+		R3 = R3 - *(Kj--) - (R2 & R1) - (~R2 & R0);
+		R2 = ROR16(R2, 3);
+		R2 = R2 - *(Kj--) - (R1 & R0) - (~R1 & R3);
+		R1 = ROR16(R1, 2);
+		R1 = R1 - *(Kj--) - (R0 & R3) - (~R0 & R2);
+		R0 = ROR16(R0, 1);
+		R0 = R0 - *(Kj--) - (R3 & R2) - (~R3 & R1);
+
+		if (--mix == 0)
+		{
+			if (--rounds == 0)
+			{
+				break;
+			}
+			mix = (rounds == 2) ? 6 : 5;
+			/* r-mash */
+			R3 -= this->K[R2 & 63];
+			R2 -= this->K[R1 & 63];
+			R1 -= this->K[R0 & 63];
+			R0 -= this->K[R3 & 63];
+		}
+	}
+
+	PUT16(R, R0);
+	PUT16(R + 2, R1);
+	PUT16(R + 4, R2);
+	PUT16(R + 6, R3);
+}
+
+METHOD(crypter_t, decrypt, bool,
+	private_rc2_crypter_t *this, chunk_t data, chunk_t iv, chunk_t *decrypted)
+{
+	u_int8_t *in, *out, *prev;
+
+	if (data.len % RC2_BLOCK_SIZE || iv.len != RC2_BLOCK_SIZE)
+	{
+		return FALSE;
+	}
+
+	in = data.ptr + data.len - RC2_BLOCK_SIZE;
+	out = data.ptr;
+	if (decrypted)
+	{
+		*decrypted = chunk_alloc(data.len);
+		out = decrypted->ptr;
+	}
+	out += data.len - RC2_BLOCK_SIZE;
+
+	prev = in;
+	for (; in >= data.ptr; in -= RC2_BLOCK_SIZE, out -= RC2_BLOCK_SIZE)
+	{
+		if (decrypted)
+		{
+			memcpy(out, in, RC2_BLOCK_SIZE);
+		}
+		decrypt_block(this, out);
+		prev -= RC2_BLOCK_SIZE;
+		if (prev < data.ptr)
+		{
+			prev = iv.ptr;
+		}
+		memxor(out, prev, RC2_BLOCK_SIZE);
+	}
+	return TRUE;
+}
+
+METHOD(crypter_t, encrypt, bool,
+	private_rc2_crypter_t *this, chunk_t data, chunk_t iv, chunk_t *encrypted)
+{
+	u_int8_t *in, *out, *end, *prev;
+
+	if (data.len % RC2_BLOCK_SIZE || iv.len != RC2_BLOCK_SIZE)
+	{
+		return FALSE;
+	}
+
+	in = data.ptr;
+	end = data.ptr + data.len;
+	out = data.ptr;
+	if (encrypted)
+	{
+		*encrypted = chunk_alloc(data.len);
+		out = encrypted->ptr;
+	}
+
+	prev = iv.ptr;
+	for (; in < end; in += RC2_BLOCK_SIZE, out += RC2_BLOCK_SIZE)
+	{
+		if (encrypted)
+		{
+			memcpy(out, in, RC2_BLOCK_SIZE);
+		}
+		memxor(out, prev, RC2_BLOCK_SIZE);
+		encrypt_block(this, out);
+		prev = out;
+	}
+	return TRUE;
+}
+
+METHOD(crypter_t, get_block_size, size_t,
+	private_rc2_crypter_t *this)
+{
+	return RC2_BLOCK_SIZE;
+}
+
+METHOD(crypter_t, get_iv_size, size_t,
+	private_rc2_crypter_t *this)
+{
+	return RC2_BLOCK_SIZE;
+}
+
+METHOD(crypter_t, get_key_size, size_t,
+	private_rc2_crypter_t *this)
+{
+	return this->T;
+}
+
+METHOD(crypter_t, set_key, bool,
+	private_rc2_crypter_t *this, chunk_t key)
+{
+	u_int8_t L[128], T8, TM, idx;
+	int i;
+
+	if (key.len != this->T)
+	{
+		return FALSE;
+	}
+	for (i = 0; i < key.len; i++)
+	{
+		L[i] = key.ptr[i];
+	}
+	for (; i < 128; i++)
+	{
+		idx = L[i-1] + L[i-key.len];
+		L[i] = PITABLE[idx];
+	}
+	T8 = (this->T1 + 7) / 8;
+	TM = ~(0xff << (8 - (8*T8 - this->T1)));
+	L[128-T8] = PITABLE[L[128-T8] & TM];
+	for (i = 127-T8; i >= 0; i--)
+	{
+		idx = L[i+1] ^ L[i+T8];
+		L[i] = PITABLE[idx];
+	}
+	for (i = 0; i < 64; i++)
+	{
+		this->K[i] = GET16(&L[i << 1]);
+	}
+	memwipe(L, sizeof(L));
+	return TRUE;
+}
+
+METHOD(crypter_t, destroy, void,
+	private_rc2_crypter_t *this)
+{
+	memwipe(this->K, sizeof(this->K));
+	free(this);
+}
+
+/*
+ * Described in header
+ */
+rc2_crypter_t *rc2_crypter_create(encryption_algorithm_t algo, size_t key_size)
+{
+	private_rc2_crypter_t *this;
+	size_t effective;
+
+	if (algo != ENCR_RC2_CBC)
+	{
+		return NULL;
+	}
+	key_size = max(1, key_size);
+	effective = RC2_EFFECTIVE_KEY_LEN(key_size);
+	key_size = min(128, RC2_KEY_LEN(key_size));
+	effective = max(1, min(1024, effective ?: key_size * 8));
+
+	INIT(this,
+		.public = {
+			.crypter = {
+				.encrypt = _encrypt,
+				.decrypt = _decrypt,
+				.get_block_size = _get_block_size,
+				.get_iv_size = _get_iv_size,
+				.get_key_size = _get_key_size,
+				.set_key = _set_key,
+				.destroy = _destroy,
+			},
+		},
+		.T = key_size,
+		.T1 = effective,
+	);
+
+	return &this->public;
+}
diff --git a/src/libstrongswan/plugins/rc2/rc2_crypter.h b/src/libstrongswan/plugins/rc2/rc2_crypter.h
new file mode 100644
index 000000000..d478762a6
--- /dev/null
+++ b/src/libstrongswan/plugins/rc2/rc2_crypter.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2013 Tobias Brunner
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup rc2_crypter rc2_crypter
+ * @{ @ingroup rc2_p
+ */
+
+#ifndef RC2_CRYPTER_H_
+#define RC2_CRYPTER_H_
+
+typedef struct rc2_crypter_t rc2_crypter_t;
+
+#include <crypto/crypters/crypter.h>
+
+/**
+ * Class implementing the RC2 block cipher as defined in RFC 2268.
+ */
+struct rc2_crypter_t {
+
+	/**
+	 * Implements crypter_t interface.
+	 */
+	crypter_t crypter;
+};
+
+/**
+ * Constructor to create rc2_crypter_t objects.
+ *
+ * @param algo			algorithm to implement (ENCR_RC2_CBC)
+ * @param key_size		use the RC2_KEY_SIZE macro if the effective key size
+ * 						in bits is different than the actual length of the key
+ * @return				rc2_crypter_t object, NULL if not supported
+ */
+rc2_crypter_t *rc2_crypter_create(encryption_algorithm_t algo,
+								  size_t key_size);
+
+#endif /** RC2_CRYPTER_H_ @}*/
diff --git a/src/libstrongswan/plugins/rc2/rc2_plugin.c b/src/libstrongswan/plugins/rc2/rc2_plugin.c
new file mode 100644
index 000000000..6c6fa76d6
--- /dev/null
+++ b/src/libstrongswan/plugins/rc2/rc2_plugin.c
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2013 Tobias Brunner
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#include "rc2_plugin.h"
+
+#include <library.h>
+#include "rc2_crypter.h"
+
+typedef struct private_rc2_plugin_t private_rc2_plugin_t;
+
+/**
+ * Private data of rc2_plugin
+ */
+struct private_rc2_plugin_t {
+
+	/**
+	 * Public interface
+	 */
+	rc2_plugin_t public;
+};
+
+METHOD(plugin_t, get_name, char*,
+	private_rc2_plugin_t *this)
+{
+	return "rc2";
+}
+
+METHOD(plugin_t, get_features, int,
+	private_rc2_plugin_t *this, plugin_feature_t *features[])
+{
+	static plugin_feature_t f[] = {
+		PLUGIN_REGISTER(CRYPTER, rc2_crypter_create),
+			PLUGIN_PROVIDE(CRYPTER, ENCR_RC2_CBC, 0),
+	};
+	*features = f;
+	return countof(f);
+}
+
+METHOD(plugin_t, destroy, void,
+	private_rc2_plugin_t *this)
+{
+	free(this);
+}
+
+/*
+ * Described in header
+ */
+plugin_t *rc2_plugin_create()
+{
+	private_rc2_plugin_t *this;
+
+	INIT(this,
+		.public = {
+			.plugin = {
+				.get_name = _get_name,
+				.get_features = _get_features,
+				.destroy = _destroy,
+			},
+		},
+	);
+
+	return &this->public.plugin;
+}
+
diff --git a/src/libstrongswan/plugins/rc2/rc2_plugin.h b/src/libstrongswan/plugins/rc2/rc2_plugin.h
new file mode 100644
index 000000000..cbbac51af
--- /dev/null
+++ b/src/libstrongswan/plugins/rc2/rc2_plugin.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2013 Tobias Brunner
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup rc2_p rc2
+ * @ingroup plugins
+ *
+ * @defgroup rc2_plugin rc2_plugin
+ * @{ @ingroup rc2_p
+ */
+
+#ifndef RC2_PLUGIN_H_
+#define RC2_PLUGIN_H_
+
+#include <plugins/plugin.h>
+
+typedef struct rc2_plugin_t rc2_plugin_t;
+
+/**
+ * Plugin implementing RC2 (RFC 2268).
+ */
+struct rc2_plugin_t {
+
+	/**
+	 * Implements plugin interface
+	 */
+	plugin_t plugin;
+};
+
+#endif /** RC2_PLUGIN_H_ @}*/