csa.c
上传用户:kjfoods
上传日期:2020-07-06
资源大小:29949k
文件大小:19k
源码类别:

midi

开发平台:

Unix_Linux

  1. /*****************************************************************************
  2.  * libcsa.c: CSA scrambler/descrambler
  3.  *****************************************************************************
  4.  * Copyright (C) 2004-2005 Laurent Aimar
  5.  * $Id: 99ae905b57c1e9efb7744c45a78fec4c0f95582c $
  6.  *
  7.  * Authors: Laurent Aimar <fenrir@via.ecp.fr>
  8.  *          Jean-Paul Saman <jpsaman #_at_# m2x.nl>
  9.  *
  10.  * This program is free software; you can redistribute it and/or modify
  11.  * it under the terms of the GNU General Public License as published by
  12.  * the Free Software Foundation; either version 2 of the License, or
  13.  * (at your option) any later version.
  14.  *
  15.  * This program is distributed in the hope that it will be useful,
  16.  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17.  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18.  * GNU General Public License for more details.
  19.  *
  20.  * You should have received a copy of the GNU General Public License
  21.  * along with this program; if not, write to the Free Software
  22.  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA 02110-1301, USA.
  23.  *****************************************************************************/
  24. /*
  25.  * XXX: A great part is just a copy/past of deCSA but I can't find the
  26.  * author and the license. If there is a problem with it please e-mail me.
  27.  */
  28. #ifdef HAVE_CONFIG_H
  29. # include "config.h"
  30. #endif
  31. #include <vlc_common.h>
  32. #include "csa.h"
  33. struct csa_t
  34. {
  35.     /* odd and even keys */
  36.     uint8_t o_ck[8];
  37.     uint8_t e_ck[8];
  38.     uint8_t o_kk[57];
  39.     uint8_t e_kk[57];
  40.     /* cypher state */
  41.     int     A[11];
  42.     int     B[11];
  43.     int     X, Y, Z;
  44.     int     D, E, F;
  45.     int     p, q, r;
  46.     bool    use_odd;
  47. };
  48. static void csa_ComputeKey( uint8_t kk[57], uint8_t ck[8] );
  49. static void csa_StreamCypher( csa_t *c, int b_init, uint8_t *ck, uint8_t *sb, uint8_t *cb );
  50. static void csa_BlockDecypher( uint8_t kk[57], uint8_t ib[8], uint8_t bd[8] );
  51. static void csa_BlockCypher( uint8_t kk[57], uint8_t bd[8], uint8_t ib[8] );
  52. /*****************************************************************************
  53.  * csa_New:
  54.  *****************************************************************************/
  55. csa_t *csa_New( void )
  56. {
  57.     return calloc( 1, sizeof( csa_t ) );
  58. }
  59. /*****************************************************************************
  60.  * csa_Delete:
  61.  *****************************************************************************/
  62. void csa_Delete( csa_t *c )
  63. {
  64.     free( c );
  65. }
  66. /*****************************************************************************
  67.  * csa_SetCW:
  68.  *****************************************************************************/
  69. int csa_SetCW( vlc_object_t *p_caller, csa_t *c, char *psz_ck, bool set_odd )
  70. {
  71.     if ( !c )
  72.     {
  73.         msg_Dbg( p_caller, "no CSA found" );
  74.         return VLC_ENOOBJ;
  75.     }
  76.     /* skip 0x */
  77.     if( psz_ck[0] == '0' && ( psz_ck[1] == 'x' || psz_ck[1] == 'X' ) )
  78.     {
  79.         psz_ck += 2;
  80.     }
  81.     if( strlen( psz_ck ) != 16 )
  82.     {
  83.         msg_Warn( p_caller, "invalid csa ck (it must be 16 chars long)" );
  84.         return VLC_EBADVAR;
  85.     }
  86.     else
  87.     {
  88. #ifndef UNDER_CE
  89.         uint64_t i_ck = strtoull( psz_ck, NULL, 16 );
  90. #else
  91.         uint64_t i_ck = strtoll( psz_ck, NULL, 16 );
  92. #endif
  93.         uint8_t  ck[8];
  94.         int      i;
  95.         for( i = 0; i < 8; i++ )
  96.         {
  97.             ck[i] = ( i_ck >> ( 56 - 8*i) )&0xff;
  98.         }
  99. #ifndef TS_NO_CSA_CK_MSG
  100.         msg_Dbg( p_caller, "using CSA (de)scrambling with %s "
  101.                  "key=%x:%x:%x:%x:%x:%x:%x:%x", set_odd ? "odd" : "even",
  102.                  ck[0], ck[1], ck[2], ck[3], ck[4], ck[5], ck[6], ck[7] );
  103. #endif
  104.         if( set_odd )
  105.         {
  106.             memcpy( c->o_ck, ck, 8 );
  107.             csa_ComputeKey( c->o_kk, ck );
  108.         }
  109.         else
  110.         {
  111.             memcpy( c->e_ck , ck, 8 );
  112.             csa_ComputeKey( c->e_kk , ck );
  113.         }
  114.         return VLC_SUCCESS;
  115.     }
  116. }
  117. /*****************************************************************************
  118.  * csa_UseKey:
  119.  *****************************************************************************/
  120. int csa_UseKey( vlc_object_t *p_caller, csa_t *c, bool use_odd )
  121. {
  122.     if ( !c ) return VLC_ENOOBJ;
  123.     c->use_odd = use_odd;
  124. #ifndef TS_NO_CSA_CK_MSG
  125.         msg_Dbg( p_caller, "using the %s key for scrambling",
  126.                  use_odd ? "odd" : "even" );
  127. #endif
  128.     return VLC_SUCCESS;
  129. }
  130. /*****************************************************************************
  131.  * csa_Decrypt:
  132.  *****************************************************************************/
  133. void csa_Decrypt( csa_t *c, uint8_t *pkt, int i_pkt_size )
  134. {
  135.     uint8_t *ck;
  136.     uint8_t *kk;
  137.     uint8_t  ib[8], stream[8], block[8];
  138.     int     i_hdr, i_residue;
  139.     int     i, j, n;
  140.     /* transport scrambling control */
  141.     if( (pkt[3]&0x80) == 0 )
  142.     {
  143.         /* not scrambled */
  144.         return;
  145.     }
  146.     if( pkt[3]&0x40 )
  147.     {
  148.         ck = c->o_ck;
  149.         kk = c->o_kk;
  150.     }
  151.     else
  152.     {
  153.         ck = c->e_ck;
  154.         kk = c->e_kk;
  155.     }
  156.     /* clear transport scrambling control */
  157.     pkt[3] &= 0x3f;
  158.     i_hdr = 4;
  159.     if( pkt[3]&0x20 )
  160.     {
  161.         /* skip adaption field */
  162.         i_hdr += pkt[4] + 1;
  163.     }
  164.     if( 188 - i_hdr < 8 )
  165.         return;
  166.     /* init csa state */
  167.     csa_StreamCypher( c, 1, ck, &pkt[i_hdr], ib );
  168.     /* */
  169.     n = (i_pkt_size - i_hdr) / 8;
  170.     if( n < 0 )
  171.         return;
  172.  
  173.     i_residue = (i_pkt_size - i_hdr) % 8;
  174.     for( i = 1; i < n + 1; i++ )
  175.     {
  176.         csa_BlockDecypher( kk, ib, block );
  177.         if( i != n )
  178.         {
  179.             csa_StreamCypher( c, 0, ck, NULL, stream );
  180.             for( j = 0; j < 8; j++ )
  181.             {
  182.                 /* xor ib with stream */
  183.                 ib[j] = pkt[i_hdr+8*i+j] ^ stream[j];
  184.             }
  185.         }
  186.         else
  187.         {
  188.             /* last block */
  189.             for( j = 0; j < 8; j++ )
  190.             {
  191.                 ib[j] = 0;
  192.             }
  193.         }
  194.         /* xor ib with block */
  195.         for( j = 0; j < 8; j++ )
  196.         {
  197.             pkt[i_hdr+8*(i-1)+j] = ib[j] ^ block[j];
  198.         }
  199.     }
  200.     if( i_residue > 0 )
  201.     {
  202.         csa_StreamCypher( c, 0, ck, NULL, stream );
  203.         for( j = 0; j < i_residue; j++ )
  204.         {
  205.             pkt[i_pkt_size - i_residue + j] ^= stream[j];
  206.         }
  207.     }
  208. }
  209. /*****************************************************************************
  210.  * csa_Encrypt:
  211.  *****************************************************************************/
  212. void csa_Encrypt( csa_t *c, uint8_t *pkt, int i_pkt_size )
  213. {
  214.     uint8_t *ck;
  215.     uint8_t *kk;
  216.     int i, j;
  217.     int i_hdr = 4; /* hdr len */
  218.     uint8_t  ib[184/8+2][8], stream[8], block[8];
  219.     int n, i_residue;
  220.     /* set transport scrambling control */
  221.     pkt[3] |= 0x80;
  222.     if( c->use_odd )
  223.     {
  224.         pkt[3] |= 0x40;
  225.         ck = c->o_ck;
  226.         kk = c->o_kk;
  227.     }
  228.     else
  229.     {
  230.         ck = c->e_ck;
  231.         kk = c->e_kk;
  232.     }
  233.     /* hdr len */
  234.     i_hdr = 4;
  235.     if( pkt[3]&0x20 )
  236.     {
  237.         /* skip adaption field */
  238.         i_hdr += pkt[4] + 1;
  239.     }
  240.     n = (i_pkt_size - i_hdr) / 8;
  241.     i_residue = (i_pkt_size - i_hdr) % 8;
  242.     if( n <= 0 )
  243.     {
  244.         pkt[3] &= 0x3f;
  245.         return;
  246.     }
  247.     /* */
  248.     for( i = 0; i < 8; i++ )
  249.     {
  250.         ib[n+1][i] = 0;
  251.     }
  252.     for( i = n; i  > 0; i-- )
  253.     {
  254.         for( j = 0; j < 8; j++ )
  255.         {
  256.             block[j] = pkt[i_hdr+8*(i-1)+j] ^ib[i+1][j];
  257.         }
  258.         csa_BlockCypher( kk, block, ib[i] );
  259.     }
  260.     /* init csa state */
  261.     csa_StreamCypher( c, 1, ck, ib[1], stream );
  262.     for( i = 0; i < 8; i++ )
  263.     {
  264.         pkt[i_hdr+i] = ib[1][i];
  265.     }
  266.     for( i = 2; i < n+1; i++ )
  267.     {
  268.         csa_StreamCypher( c, 0, ck, NULL, stream );
  269.         for( j = 0; j < 8; j++ )
  270.         {
  271.             pkt[i_hdr+8*(i-1)+j] = ib[i][j] ^ stream[j];
  272.         }
  273.     }
  274.     if( i_residue > 0 )
  275.     {
  276.         csa_StreamCypher( c, 0, ck, NULL, stream );
  277.         for( j = 0; j < i_residue; j++ )
  278.         {
  279.             pkt[i_pkt_size - i_residue + j] ^= stream[j];
  280.         }
  281.     }
  282. }
  283. /*****************************************************************************
  284.  * Divers
  285.  *****************************************************************************/
  286. static const uint8_t key_perm[0x40] =
  287. {
  288.     0x12,0x24,0x09,0x07,0x2A,0x31,0x1D,0x15,0x1C,0x36,0x3E,0x32,0x13,0x21,0x3B,0x40,
  289.     0x18,0x14,0x25,0x27,0x02,0x35,0x1B,0x01,0x22,0x04,0x0D,0x0E,0x39,0x28,0x1A,0x29,
  290.     0x33,0x23,0x34,0x0C,0x16,0x30,0x1E,0x3A,0x2D,0x1F,0x08,0x19,0x17,0x2F,0x3D,0x11,
  291.     0x3C,0x05,0x38,0x2B,0x0B,0x06,0x0A,0x2C,0x20,0x3F,0x2E,0x0F,0x03,0x26,0x10,0x37,
  292. };
  293. static void csa_ComputeKey( uint8_t kk[57], uint8_t ck[8] )
  294. {
  295.     int i,j,k;
  296.     int bit[64];
  297.     int newbit[64];
  298.     int kb[8][9];
  299.     /* from a cw create 56 key bytes, here kk[1..56] */
  300.     /* load ck into kb[7][1..8] */
  301.     for( i = 0; i < 8; i++ )
  302.     {
  303.         kb[7][i+1] = ck[i];
  304.     }
  305.     /* calculate all kb[6..1][*] */
  306.     for( i = 0; i < 7; i++ )
  307.     {
  308.         /* do a 64 bit perm on kb */
  309.         for( j = 0; j < 8; j++ )
  310.         {
  311.             for( k = 0; k < 8; k++ )
  312.             {
  313.                 bit[j*8+k] = (kb[7-i][1+j] >> (7-k)) & 1;
  314.                 newbit[key_perm[j*8+k]-1] = bit[j*8+k];
  315.             }
  316.         }
  317.         for( j = 0; j < 8; j++ )
  318.         {
  319.             kb[6-i][1+j] = 0;
  320.             for( k = 0; k < 8; k++ )
  321.             {
  322.                 kb[6-i][1+j] |= newbit[j*8+k] << (7-k);
  323.             }
  324.         }
  325.     }
  326.     /* xor to give kk */
  327.     for( i = 0; i < 7; i++ )
  328.     {
  329.         for( j = 0; j < 8; j++ )
  330.         {
  331.             kk[1+i*8+j] = kb[1+i][1+j] ^ i;
  332.         }
  333.     }
  334. }
  335. static const int sbox1[0x20] = {2,0,1,1,2,3,3,0, 3,2,2,0,1,1,0,3, 0,3,3,0,2,2,1,1, 2,2,0,3,1,1,3,0};
  336. static const int sbox2[0x20] = {3,1,0,2,2,3,3,0, 1,3,2,1,0,0,1,2, 3,1,0,3,3,2,0,2, 0,0,1,2,2,1,3,1};
  337. static const int sbox3[0x20] = {2,0,1,2,2,3,3,1, 1,1,0,3,3,0,2,0, 1,3,0,1,3,0,2,2, 2,0,1,2,0,3,3,1};
  338. static const int sbox4[0x20] = {3,1,2,3,0,2,1,2, 1,2,0,1,3,0,0,3, 1,0,3,1,2,3,0,3, 0,3,2,0,1,2,2,1};
  339. static const int sbox5[0x20] = {2,0,0,1,3,2,3,2, 0,1,3,3,1,0,2,1, 2,3,2,0,0,3,1,1, 1,0,3,2,3,1,0,2};
  340. static const int sbox6[0x20] = {0,1,2,3,1,2,2,0, 0,1,3,0,2,3,1,3, 2,3,0,2,3,0,1,1, 2,1,1,2,0,3,3,0};
  341. static const int sbox7[0x20] = {0,3,2,2,3,0,0,1, 3,0,1,3,1,2,2,1, 1,0,3,3,0,1,1,2, 2,3,1,0,2,3,0,2};
  342. static void csa_StreamCypher( csa_t *c, int b_init, uint8_t *ck, uint8_t *sb, uint8_t *cb )
  343. {
  344.     int i,j, k;
  345.     int extra_B;
  346.     int s1,s2,s3,s4,s5,s6,s7;
  347.     int next_A1;
  348.     int next_B1;
  349.     int next_E;
  350.     if( b_init )
  351.     {
  352.         // load first 32 bits of CK into A[1]..A[8]
  353.         // load last  32 bits of CK into B[1]..B[8]
  354.         // all other regs = 0
  355.         for( i = 0; i < 4; i++ )
  356.         {
  357.             c->A[1+2*i+0] = ( ck[i] >> 4 )&0x0f;
  358.             c->A[1+2*i+1] = ( ck[i] >> 0 )&0x0f;
  359.             c->B[1+2*i+0] = ( ck[4+i] >> 4 )&0x0f;
  360.             c->B[1+2*i+1] = ( ck[4+i] >> 0 )&0x0f;
  361.         }
  362.         c->A[9] = c->A[10] = 0;
  363.         c->B[9] = c->B[10] = 0;
  364.         c->X = c->Y = c->Z = 0;
  365.         c->D = c->E = c->F = 0;
  366.         c->p = c->q = c->r = 0;
  367.     }
  368.     // 8 bytes per operation
  369.     for( i = 0; i < 8; i++ )
  370.     {
  371.         int op = 0;
  372.         int in1 = 0;    /* gcc warn */
  373.         int in2 = 0;
  374.         if( b_init )
  375.         {
  376.             in1 = ( sb[i] >> 4 )&0x0f;
  377.             in2 = ( sb[i] >> 0 )&0x0f;
  378.         }
  379.         // 2 bits per iteration
  380.         for( j = 0; j < 4; j++ )
  381.         {
  382.             // from A[1]..A[10], 35 bits are selected as inputs to 7 s-boxes
  383.             // 5 bits input per s-box, 2 bits output per s-box
  384.             s1 = sbox1[ (((c->A[4]>>0)&1)<<4) | (((c->A[1]>>2)&1)<<3) | (((c->A[6]>>1)&1)<<2) | (((c->A[7]>>3)&1)<<1) | (((c->A[9]>>0)&1)<<0) ];
  385.             s2 = sbox2[ (((c->A[2]>>1)&1)<<4) | (((c->A[3]>>2)&1)<<3) | (((c->A[6]>>3)&1)<<2) | (((c->A[7]>>0)&1)<<1) | (((c->A[9]>>1)&1)<<0) ];
  386.             s3 = sbox3[ (((c->A[1]>>3)&1)<<4) | (((c->A[2]>>0)&1)<<3) | (((c->A[5]>>1)&1)<<2) | (((c->A[5]>>3)&1)<<1) | (((c->A[6]>>2)&1)<<0) ];
  387.             s4 = sbox4[ (((c->A[3]>>3)&1)<<4) | (((c->A[1]>>1)&1)<<3) | (((c->A[2]>>3)&1)<<2) | (((c->A[4]>>2)&1)<<1) | (((c->A[8]>>0)&1)<<0) ];
  388.             s5 = sbox5[ (((c->A[5]>>2)&1)<<4) | (((c->A[4]>>3)&1)<<3) | (((c->A[6]>>0)&1)<<2) | (((c->A[8]>>1)&1)<<1) | (((c->A[9]>>2)&1)<<0) ];
  389.             s6 = sbox6[ (((c->A[3]>>1)&1)<<4) | (((c->A[4]>>1)&1)<<3) | (((c->A[5]>>0)&1)<<2) | (((c->A[7]>>2)&1)<<1) | (((c->A[9]>>3)&1)<<0) ];
  390.             s7 = sbox7[ (((c->A[2]>>2)&1)<<4) | (((c->A[3]>>0)&1)<<3) | (((c->A[7]>>1)&1)<<2) | (((c->A[8]>>2)&1)<<1) | (((c->A[8]>>3)&1)<<0) ];
  391.             /* use 4x4 xor to produce extra nibble for T3 */
  392.             extra_B = ( ((c->B[3]&1)<<3) ^ ((c->B[6]&2)<<2) ^ ((c->B[7]&4)<<1) ^ ((c->B[9]&8)>>0) ) |
  393.                       ( ((c->B[6]&1)<<2) ^ ((c->B[8]&2)<<1) ^ ((c->B[3]&8)>>1) ^ ((c->B[4]&4)>>0) ) |
  394.                       ( ((c->B[5]&8)>>2) ^ ((c->B[8]&4)>>1) ^ ((c->B[4]&1)<<1) ^ ((c->B[5]&2)>>0) ) |
  395.                       ( ((c->B[9]&4)>>2) ^ ((c->B[6]&8)>>3) ^ ((c->B[3]&2)>>1) ^ ((c->B[8]&1)>>0) ) ;
  396.             // T1 = xor all inputs
  397.             // in1,in2, D are only used in T1 during initialisation, not generation
  398.             next_A1 = c->A[10] ^ c->X;
  399.             if( b_init ) next_A1 = next_A1 ^ c->D ^ ((j % 2) ? in2 : in1);
  400.             // T2 =  xor all inputs
  401.             // in1,in2 are only used in T1 during initialisation, not generation
  402.             // if p=0, use this, if p=1, rotate the result left
  403.             next_B1 = c->B[7] ^ c->B[10] ^ c->Y;
  404.             if( b_init) next_B1 = next_B1 ^ ((j % 2) ? in1 : in2);
  405.             // if p=1, rotate left
  406.             if( c->p ) next_B1 = ( (next_B1 << 1) | ((next_B1 >> 3) & 1) ) & 0xf;
  407.             // T3 = xor all inputs
  408.             c->D = c->E ^ c->Z ^ extra_B;
  409.             // T4 = sum, carry of Z + E + r
  410.             next_E = c->F;
  411.             if( c->q )
  412.             {
  413.                 c->F = c->Z + c->E + c->r;
  414.                 // r is the carry
  415.                 c->r = (c->F >> 4) & 1;
  416.                 c->F = c->F & 0x0f;
  417.             }
  418.             else
  419.             {
  420.                 c->F = c->E;
  421.             }
  422.             c->E = next_E;
  423.             for( k = 10; k > 1; k-- )
  424.             {
  425.                 c->A[k] = c->A[k-1];
  426.                 c->B[k] = c->B[k-1];
  427.             }
  428.             c->A[1] = next_A1;
  429.             c->B[1] = next_B1;
  430.             c->X = ((s4&1)<<3) | ((s3&1)<<2) | (s2&2) | ((s1&2)>>1);
  431.             c->Y = ((s6&1)<<3) | ((s5&1)<<2) | (s4&2) | ((s3&2)>>1);
  432.             c->Z = ((s2&1)<<3) | ((s1&1)<<2) | (s6&2) | ((s5&2)>>1);
  433.             c->p = (s7&2)>>1;
  434.             c->q = (s7&1);
  435.             // require 4 loops per output byte
  436.             // 2 output bits are a function of the 4 bits of D
  437.             // xor 2 by 2
  438.             op = (op << 2)^ ( (((c->D^(c->D>>1))>>1)&2) | ((c->D^(c->D>>1))&1) );
  439.         }
  440.         // return input data during init
  441.         cb[i] = b_init ? sb[i] : op;
  442.     }
  443. }
  444. // block - sbox
  445. static const uint8_t block_sbox[256] =
  446. {
  447.     0x3A,0xEA,0x68,0xFE,0x33,0xE9,0x88,0x1A,0x83,0xCF,0xE1,0x7F,0xBA,0xE2,0x38,0x12,
  448.     0xE8,0x27,0x61,0x95,0x0C,0x36,0xE5,0x70,0xA2,0x06,0x82,0x7C,0x17,0xA3,0x26,0x49,
  449.     0xBE,0x7A,0x6D,0x47,0xC1,0x51,0x8F,0xF3,0xCC,0x5B,0x67,0xBD,0xCD,0x18,0x08,0xC9,
  450.     0xFF,0x69,0xEF,0x03,0x4E,0x48,0x4A,0x84,0x3F,0xB4,0x10,0x04,0xDC,0xF5,0x5C,0xC6,
  451.     0x16,0xAB,0xAC,0x4C,0xF1,0x6A,0x2F,0x3C,0x3B,0xD4,0xD5,0x94,0xD0,0xC4,0x63,0x62,
  452.     0x71,0xA1,0xF9,0x4F,0x2E,0xAA,0xC5,0x56,0xE3,0x39,0x93,0xCE,0x65,0x64,0xE4,0x58,
  453.     0x6C,0x19,0x42,0x79,0xDD,0xEE,0x96,0xF6,0x8A,0xEC,0x1E,0x85,0x53,0x45,0xDE,0xBB,
  454.     0x7E,0x0A,0x9A,0x13,0x2A,0x9D,0xC2,0x5E,0x5A,0x1F,0x32,0x35,0x9C,0xA8,0x73,0x30,
  455.     0x29,0x3D,0xE7,0x92,0x87,0x1B,0x2B,0x4B,0xA5,0x57,0x97,0x40,0x15,0xE6,0xBC,0x0E,
  456.     0xEB,0xC3,0x34,0x2D,0xB8,0x44,0x25,0xA4,0x1C,0xC7,0x23,0xED,0x90,0x6E,0x50,0x00,
  457.     0x99,0x9E,0x4D,0xD9,0xDA,0x8D,0x6F,0x5F,0x3E,0xD7,0x21,0x74,0x86,0xDF,0x6B,0x05,
  458.     0x8E,0x5D,0x37,0x11,0xD2,0x28,0x75,0xD6,0xA7,0x77,0x24,0xBF,0xF0,0xB0,0x02,0xB7,
  459.     0xF8,0xFC,0x81,0x09,0xB1,0x01,0x76,0x91,0x7D,0x0F,0xC8,0xA0,0xF2,0xCB,0x78,0x60,
  460.     0xD1,0xF7,0xE0,0xB5,0x98,0x22,0xB3,0x20,0x1D,0xA6,0xDB,0x7B,0x59,0x9F,0xAE,0x31,
  461.     0xFB,0xD3,0xB6,0xCA,0x43,0x72,0x07,0xF4,0xD8,0x41,0x14,0x55,0x0D,0x54,0x8B,0xB9,
  462.     0xAD,0x46,0x0B,0xAF,0x80,0x52,0x2C,0xFA,0x8C,0x89,0x66,0xFD,0xB2,0xA9,0x9B,0xC0,
  463. };
  464. // block - perm
  465. static const uint8_t block_perm[256] =
  466. {
  467.     0x00,0x02,0x80,0x82,0x20,0x22,0xA0,0xA2, 0x10,0x12,0x90,0x92,0x30,0x32,0xB0,0xB2,
  468.     0x04,0x06,0x84,0x86,0x24,0x26,0xA4,0xA6, 0x14,0x16,0x94,0x96,0x34,0x36,0xB4,0xB6,
  469.     0x40,0x42,0xC0,0xC2,0x60,0x62,0xE0,0xE2, 0x50,0x52,0xD0,0xD2,0x70,0x72,0xF0,0xF2,
  470.     0x44,0x46,0xC4,0xC6,0x64,0x66,0xE4,0xE6, 0x54,0x56,0xD4,0xD6,0x74,0x76,0xF4,0xF6,
  471.     0x01,0x03,0x81,0x83,0x21,0x23,0xA1,0xA3, 0x11,0x13,0x91,0x93,0x31,0x33,0xB1,0xB3,
  472.     0x05,0x07,0x85,0x87,0x25,0x27,0xA5,0xA7, 0x15,0x17,0x95,0x97,0x35,0x37,0xB5,0xB7,
  473.     0x41,0x43,0xC1,0xC3,0x61,0x63,0xE1,0xE3, 0x51,0x53,0xD1,0xD3,0x71,0x73,0xF1,0xF3,
  474.     0x45,0x47,0xC5,0xC7,0x65,0x67,0xE5,0xE7, 0x55,0x57,0xD5,0xD7,0x75,0x77,0xF5,0xF7,
  475.     0x08,0x0A,0x88,0x8A,0x28,0x2A,0xA8,0xAA, 0x18,0x1A,0x98,0x9A,0x38,0x3A,0xB8,0xBA,
  476.     0x0C,0x0E,0x8C,0x8E,0x2C,0x2E,0xAC,0xAE, 0x1C,0x1E,0x9C,0x9E,0x3C,0x3E,0xBC,0xBE,
  477.     0x48,0x4A,0xC8,0xCA,0x68,0x6A,0xE8,0xEA, 0x58,0x5A,0xD8,0xDA,0x78,0x7A,0xF8,0xFA,
  478.     0x4C,0x4E,0xCC,0xCE,0x6C,0x6E,0xEC,0xEE, 0x5C,0x5E,0xDC,0xDE,0x7C,0x7E,0xFC,0xFE,
  479.     0x09,0x0B,0x89,0x8B,0x29,0x2B,0xA9,0xAB, 0x19,0x1B,0x99,0x9B,0x39,0x3B,0xB9,0xBB,
  480.     0x0D,0x0F,0x8D,0x8F,0x2D,0x2F,0xAD,0xAF, 0x1D,0x1F,0x9D,0x9F,0x3D,0x3F,0xBD,0xBF,
  481.     0x49,0x4B,0xC9,0xCB,0x69,0x6B,0xE9,0xEB, 0x59,0x5B,0xD9,0xDB,0x79,0x7B,0xF9,0xFB,
  482.     0x4D,0x4F,0xCD,0xCF,0x6D,0x6F,0xED,0xEF, 0x5D,0x5F,0xDD,0xDF,0x7D,0x7F,0xFD,0xFF,
  483. };
  484. static void csa_BlockDecypher( uint8_t kk[57], uint8_t ib[8], uint8_t bd[8] )
  485. {
  486.     int i;
  487.     int perm_out;
  488.     int R[9];
  489.     int next_R8;
  490.     for( i = 0; i < 8; i++ )
  491.     {
  492.         R[i+1] = ib[i];
  493.     }
  494.     // loop over kk[56]..kk[1]
  495.     for( i = 56; i > 0; i-- )
  496.     {
  497.         const int sbox_out = block_sbox[ kk[i]^R[7] ];
  498.         perm_out = block_perm[sbox_out];
  499.         next_R8 = R[7];
  500.         R[7] = R[6] ^ perm_out;
  501.         R[6] = R[5];
  502.         R[5] = R[4] ^ R[8] ^ sbox_out;
  503.         R[4] = R[3] ^ R[8] ^ sbox_out;
  504.         R[3] = R[2] ^ R[8] ^ sbox_out;
  505.         R[2] = R[1];
  506.         R[1] = R[8] ^ sbox_out;
  507.         R[8] = next_R8;
  508.     }
  509.     for( i = 0; i < 8; i++ )
  510.     {
  511.         bd[i] = R[i+1];
  512.     }
  513. }
  514. static void csa_BlockCypher( uint8_t kk[57], uint8_t bd[8], uint8_t ib[8] )
  515. {
  516.     int i;
  517.     int perm_out;
  518.     int R[9];
  519.     int next_R1;
  520.     for( i = 0; i < 8; i++ )
  521.     {
  522.         R[i+1] = bd[i];
  523.     }
  524.     // loop over kk[1]..kk[56]
  525.     for( i = 1; i <= 56; i++ )
  526.     {
  527.         const int sbox_out = block_sbox[ kk[i]^R[8] ];
  528.         perm_out = block_perm[sbox_out];
  529.         next_R1 = R[2];
  530.         R[2] = R[3] ^ R[1];
  531.         R[3] = R[4] ^ R[1];
  532.         R[4] = R[5] ^ R[1];
  533.         R[5] = R[6];
  534.         R[6] = R[7] ^ perm_out;
  535.         R[7] = R[8];
  536.         R[8] = R[1] ^ sbox_out;
  537.         R[1] = next_R1;
  538.     }
  539.     for( i = 0; i < 8; i++ )
  540.     {
  541.         ib[i] = R[i+1];
  542.     }
  543. }