Fixed vc1 packetizer.
[vlc.git] / modules / mux / mpeg / csa.c
1 /*****************************************************************************
2  * libcsa.c: CSA scrambler/descrambler
3  *****************************************************************************
4  * Copyright (C) 2004-2005 Laurent Aimar
5  * $Id$
6  *
7  * Authors: Laurent Aimar <fenrir@via.ecp.fr>
8  *          Jean-Paul Saman <jpsaman #_at_# m2x.nl>
9  *
10  * This program is free software; you can redistribute it and/or modify
11  * it under the terms of the GNU General Public License as published by
12  * the Free Software Foundation; either version 2 of the License, or
13  * (at your option) any later version.
14  *
15  * This program is distributed in the hope that it will be useful,
16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18  * GNU General Public License for more details.
19  *
20  * You should have received a copy of the GNU General Public License
21  * along with this program; if not, write to the Free Software
22  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA 02110-1301, USA.
23  *****************************************************************************/
24
25 /*
26  * XXX: A great part is just a copy/past of deCSA but I can't find the
27  * author and the license. If there is a problem with it please e-mail me.
28  */
29
30 #ifdef HAVE_CONFIG_H
31 # include "config.h"
32 #endif
33
34 #include <vlc_common.h>
35
36 #include "csa.h"
37
38 struct csa_t
39 {
40     /* odd and even keys */
41     uint8_t o_ck[8];
42     uint8_t e_ck[8];
43
44     uint8_t o_kk[57];
45     uint8_t e_kk[57];
46
47     /* cypher state */
48     int     A[11];
49     int     B[11];
50     int     X, Y, Z;
51     int     D, E, F;
52     int     p, q, r;
53
54     bool    use_odd;
55 };
56
57 static void csa_ComputeKey( uint8_t kk[57], uint8_t ck[8] );
58
59 static void csa_StreamCypher( csa_t *c, int b_init, uint8_t *ck, uint8_t *sb, uint8_t *cb );
60
61 static void csa_BlockDecypher( uint8_t kk[57], uint8_t ib[8], uint8_t bd[8] );
62 static void csa_BlockCypher( uint8_t kk[57], uint8_t bd[8], uint8_t ib[8] );
63
64 /*****************************************************************************
65  * csa_New:
66  *****************************************************************************/
67 csa_t *csa_New( void )
68 {
69     return calloc( 1, sizeof( csa_t ) );
70 }
71
72 /*****************************************************************************
73  * csa_Delete:
74  *****************************************************************************/
75 void csa_Delete( csa_t *c )
76 {
77     free( c );
78 }
79
80 /*****************************************************************************
81  * csa_SetCW:
82  *****************************************************************************/
83 int csa_SetCW( vlc_object_t *p_caller, csa_t *c, char *psz_ck, bool set_odd )
84 {
85     if ( !c )
86     {
87         msg_Dbg( p_caller, "no CSA found" );
88         return VLC_ENOOBJ;
89     }
90     /* skip 0x */
91     if( psz_ck[0] == '0' && ( psz_ck[1] == 'x' || psz_ck[1] == 'X' ) )
92     {
93         psz_ck += 2;
94     }
95     if( strlen( psz_ck ) != 16 )
96     {
97         msg_Warn( p_caller, "invalid csa ck (it must be 16 chars long)" );
98         return VLC_EBADVAR;
99     }
100     else
101     {
102 #ifndef UNDER_CE
103         uint64_t i_ck = strtoull( psz_ck, NULL, 16 );
104 #else
105         uint64_t i_ck = strtoll( psz_ck, NULL, 16 );
106 #endif
107         uint8_t  ck[8];
108         int      i;
109
110         for( i = 0; i < 8; i++ )
111         {
112             ck[i] = ( i_ck >> ( 56 - 8*i) )&0xff;
113         }
114 #ifndef TS_NO_CSA_CK_MSG
115         msg_Dbg( p_caller, "using CSA (de)scrambling with %s "
116                  "key=%x:%x:%x:%x:%x:%x:%x:%x", set_odd ? "odd" : "even",
117                  ck[0], ck[1], ck[2], ck[3], ck[4], ck[5], ck[6], ck[7] );
118 #endif
119         if( set_odd )
120         {
121             memcpy( c->o_ck, ck, 8 );
122             csa_ComputeKey( c->o_kk, ck );
123         }
124         else
125         {
126             memcpy( c->e_ck , ck, 8 );
127             csa_ComputeKey( c->e_kk , ck );
128         }
129         return VLC_SUCCESS;
130     }
131 }
132
133 /*****************************************************************************
134  * csa_UseKey:
135  *****************************************************************************/
136 int csa_UseKey( vlc_object_t *p_caller, csa_t *c, bool use_odd )
137 {
138     if ( !c ) return VLC_ENOOBJ;
139     c->use_odd = use_odd;
140 #ifndef TS_NO_CSA_CK_MSG
141         msg_Dbg( p_caller, "using the %s key for scrambling",
142                  use_odd ? "odd" : "even" );
143 #endif
144     return VLC_SUCCESS;
145 }
146
147 /*****************************************************************************
148  * csa_Decrypt:
149  *****************************************************************************/
150 void csa_Decrypt( csa_t *c, uint8_t *pkt, int i_pkt_size )
151 {
152     uint8_t *ck;
153     uint8_t *kk;
154
155     uint8_t  ib[8], stream[8], block[8];
156
157     int     i_hdr, i_residue;
158     int     i, j, n;
159
160     /* transport scrambling control */
161     if( (pkt[3]&0x80) == 0 )
162     {
163         /* not scrambled */
164         return;
165     }
166     if( pkt[3]&0x40 )
167     {
168         ck = c->o_ck;
169         kk = c->o_kk;
170     }
171     else
172     {
173         ck = c->e_ck;
174         kk = c->e_kk;
175     }
176
177     /* clear transport scrambling control */
178     pkt[3] &= 0x3f;
179
180     i_hdr = 4;
181     if( pkt[3]&0x20 )
182     {
183         /* skip adaption field */
184         i_hdr += pkt[4] + 1;
185     }
186
187     if( 188 - i_hdr < 8 )
188         return;
189
190     /* init csa state */
191     csa_StreamCypher( c, 1, ck, &pkt[i_hdr], ib );
192
193     /* */
194     n = (i_pkt_size - i_hdr) / 8;
195     if( n < 0 )
196         return;
197  
198     i_residue = (i_pkt_size - i_hdr) % 8;
199     for( i = 1; i < n + 1; i++ )
200     {
201         csa_BlockDecypher( kk, ib, block );
202         if( i != n )
203         {
204             csa_StreamCypher( c, 0, ck, NULL, stream );
205             for( j = 0; j < 8; j++ )
206             {
207                 /* xor ib with stream */
208                 ib[j] = pkt[i_hdr+8*i+j] ^ stream[j];
209             }
210         }
211         else
212         {
213             /* last block */
214             for( j = 0; j < 8; j++ )
215             {
216                 ib[j] = 0;
217             }
218         }
219         /* xor ib with block */
220         for( j = 0; j < 8; j++ )
221         {
222             pkt[i_hdr+8*(i-1)+j] = ib[j] ^ block[j];
223         }
224     }
225
226     if( i_residue > 0 )
227     {
228         csa_StreamCypher( c, 0, ck, NULL, stream );
229         for( j = 0; j < i_residue; j++ )
230         {
231             pkt[i_pkt_size - i_residue + j] ^= stream[j];
232         }
233     }
234 }
235
236 /*****************************************************************************
237  * csa_Encrypt:
238  *****************************************************************************/
239 void csa_Encrypt( csa_t *c, uint8_t *pkt, int i_pkt_size )
240 {
241     uint8_t *ck;
242     uint8_t *kk;
243
244     int i, j;
245     int i_hdr = 4; /* hdr len */
246     uint8_t  ib[184/8+2][8], stream[8], block[8];
247     int n, i_residue;
248
249     /* set transport scrambling control */
250     pkt[3] |= 0x80;
251
252     if( c->use_odd )
253     {
254         pkt[3] |= 0x40;
255         ck = c->o_ck;
256         kk = c->o_kk;
257     }
258     else
259     {
260         ck = c->e_ck;
261         kk = c->e_kk;
262     }
263
264     /* hdr len */
265     i_hdr = 4;
266     if( pkt[3]&0x20 )
267     {
268         /* skip adaption field */
269         i_hdr += pkt[4] + 1;
270     }
271     n = (i_pkt_size - i_hdr) / 8;
272     i_residue = (i_pkt_size - i_hdr) % 8;
273
274     if( n <= 0 )
275     {
276         pkt[3] &= 0x3f;
277         return;
278     }
279
280     /* */
281     for( i = 0; i < 8; i++ )
282     {
283         ib[n+1][i] = 0;
284     }
285     for( i = n; i  > 0; i-- )
286     {
287         for( j = 0; j < 8; j++ )
288         {
289             block[j] = pkt[i_hdr+8*(i-1)+j] ^ib[i+1][j];
290         }
291         csa_BlockCypher( kk, block, ib[i] );
292     }
293
294     /* init csa state */
295     csa_StreamCypher( c, 1, ck, ib[1], stream );
296
297     for( i = 0; i < 8; i++ )
298     {
299         pkt[i_hdr+i] = ib[1][i];
300     }
301     for( i = 2; i < n+1; i++ )
302     {
303         csa_StreamCypher( c, 0, ck, NULL, stream );
304         for( j = 0; j < 8; j++ )
305         {
306             pkt[i_hdr+8*(i-1)+j] = ib[i][j] ^ stream[j];
307         }
308     }
309     if( i_residue > 0 )
310     {
311         csa_StreamCypher( c, 0, ck, NULL, stream );
312         for( j = 0; j < i_residue; j++ )
313         {
314             pkt[i_pkt_size - i_residue + j] ^= stream[j];
315         }
316     }
317 }
318
319 /*****************************************************************************
320  * Divers
321  *****************************************************************************/
322 static const uint8_t key_perm[0x40] =
323 {
324     0x12,0x24,0x09,0x07,0x2A,0x31,0x1D,0x15,0x1C,0x36,0x3E,0x32,0x13,0x21,0x3B,0x40,
325     0x18,0x14,0x25,0x27,0x02,0x35,0x1B,0x01,0x22,0x04,0x0D,0x0E,0x39,0x28,0x1A,0x29,
326     0x33,0x23,0x34,0x0C,0x16,0x30,0x1E,0x3A,0x2D,0x1F,0x08,0x19,0x17,0x2F,0x3D,0x11,
327     0x3C,0x05,0x38,0x2B,0x0B,0x06,0x0A,0x2C,0x20,0x3F,0x2E,0x0F,0x03,0x26,0x10,0x37,
328 };
329
330 static void csa_ComputeKey( uint8_t kk[57], uint8_t ck[8] )
331 {
332     int i,j,k;
333     int bit[64];
334     int newbit[64];
335     int kb[8][9];
336
337     /* from a cw create 56 key bytes, here kk[1..56] */
338
339     /* load ck into kb[7][1..8] */
340     for( i = 0; i < 8; i++ )
341     {
342         kb[7][i+1] = ck[i];
343     }
344
345     /* calculate all kb[6..1][*] */
346     for( i = 0; i < 7; i++ )
347     {
348         /* do a 64 bit perm on kb */
349         for( j = 0; j < 8; j++ )
350         {
351             for( k = 0; k < 8; k++ )
352             {
353                 bit[j*8+k] = (kb[7-i][1+j] >> (7-k)) & 1;
354                 newbit[key_perm[j*8+k]-1] = bit[j*8+k];
355             }
356         }
357         for( j = 0; j < 8; j++ )
358         {
359             kb[6-i][1+j] = 0;
360             for( k = 0; k < 8; k++ )
361             {
362                 kb[6-i][1+j] |= newbit[j*8+k] << (7-k);
363             }
364         }
365     }
366
367     /* xor to give kk */
368     for( i = 0; i < 7; i++ )
369     {
370         for( j = 0; j < 8; j++ )
371         {
372             kk[1+i*8+j] = kb[1+i][1+j] ^ i;
373         }
374     }
375 }
376
377
378 static const int sbox1[0x20] = {2,0,1,1,2,3,3,0, 3,2,2,0,1,1,0,3, 0,3,3,0,2,2,1,1, 2,2,0,3,1,1,3,0};
379 static const int sbox2[0x20] = {3,1,0,2,2,3,3,0, 1,3,2,1,0,0,1,2, 3,1,0,3,3,2,0,2, 0,0,1,2,2,1,3,1};
380 static const int sbox3[0x20] = {2,0,1,2,2,3,3,1, 1,1,0,3,3,0,2,0, 1,3,0,1,3,0,2,2, 2,0,1,2,0,3,3,1};
381 static const int sbox4[0x20] = {3,1,2,3,0,2,1,2, 1,2,0,1,3,0,0,3, 1,0,3,1,2,3,0,3, 0,3,2,0,1,2,2,1};
382 static const int sbox5[0x20] = {2,0,0,1,3,2,3,2, 0,1,3,3,1,0,2,1, 2,3,2,0,0,3,1,1, 1,0,3,2,3,1,0,2};
383 static const int sbox6[0x20] = {0,1,2,3,1,2,2,0, 0,1,3,0,2,3,1,3, 2,3,0,2,3,0,1,1, 2,1,1,2,0,3,3,0};
384 static const int sbox7[0x20] = {0,3,2,2,3,0,0,1, 3,0,1,3,1,2,2,1, 1,0,3,3,0,1,1,2, 2,3,1,0,2,3,0,2};
385
386 static void csa_StreamCypher( csa_t *c, int b_init, uint8_t *ck, uint8_t *sb, uint8_t *cb )
387 {
388     int i,j, k;
389     int extra_B;
390     int s1,s2,s3,s4,s5,s6,s7;
391     int next_A1;
392     int next_B1;
393     int next_E;
394
395     if( b_init )
396     {
397         // load first 32 bits of CK into A[1]..A[8]
398         // load last  32 bits of CK into B[1]..B[8]
399         // all other regs = 0
400         for( i = 0; i < 4; i++ )
401         {
402             c->A[1+2*i+0] = ( ck[i] >> 4 )&0x0f;
403             c->A[1+2*i+1] = ( ck[i] >> 0 )&0x0f;
404
405             c->B[1+2*i+0] = ( ck[4+i] >> 4 )&0x0f;
406             c->B[1+2*i+1] = ( ck[4+i] >> 0 )&0x0f;
407         }
408
409         c->A[9] = c->A[10] = 0;
410         c->B[9] = c->B[10] = 0;
411
412         c->X = c->Y = c->Z = 0;
413         c->D = c->E = c->F = 0;
414         c->p = c->q = c->r = 0;
415     }
416
417     // 8 bytes per operation
418     for( i = 0; i < 8; i++ )
419     {
420         int op = 0;
421         int in1 = 0;    /* gcc warn */
422         int in2 = 0;
423
424         if( b_init )
425         {
426             in1 = ( sb[i] >> 4 )&0x0f;
427             in2 = ( sb[i] >> 0 )&0x0f;
428         }
429
430         // 2 bits per iteration
431         for( j = 0; j < 4; j++ )
432         {
433             // from A[1]..A[10], 35 bits are selected as inputs to 7 s-boxes
434             // 5 bits input per s-box, 2 bits output per s-box
435             s1 = sbox1[ (((c->A[4]>>0)&1)<<4) | (((c->A[1]>>2)&1)<<3) | (((c->A[6]>>1)&1)<<2) | (((c->A[7]>>3)&1)<<1) | (((c->A[9]>>0)&1)<<0) ];
436             s2 = sbox2[ (((c->A[2]>>1)&1)<<4) | (((c->A[3]>>2)&1)<<3) | (((c->A[6]>>3)&1)<<2) | (((c->A[7]>>0)&1)<<1) | (((c->A[9]>>1)&1)<<0) ];
437             s3 = sbox3[ (((c->A[1]>>3)&1)<<4) | (((c->A[2]>>0)&1)<<3) | (((c->A[5]>>1)&1)<<2) | (((c->A[5]>>3)&1)<<1) | (((c->A[6]>>2)&1)<<0) ];
438             s4 = sbox4[ (((c->A[3]>>3)&1)<<4) | (((c->A[1]>>1)&1)<<3) | (((c->A[2]>>3)&1)<<2) | (((c->A[4]>>2)&1)<<1) | (((c->A[8]>>0)&1)<<0) ];
439             s5 = sbox5[ (((c->A[5]>>2)&1)<<4) | (((c->A[4]>>3)&1)<<3) | (((c->A[6]>>0)&1)<<2) | (((c->A[8]>>1)&1)<<1) | (((c->A[9]>>2)&1)<<0) ];
440             s6 = sbox6[ (((c->A[3]>>1)&1)<<4) | (((c->A[4]>>1)&1)<<3) | (((c->A[5]>>0)&1)<<2) | (((c->A[7]>>2)&1)<<1) | (((c->A[9]>>3)&1)<<0) ];
441             s7 = sbox7[ (((c->A[2]>>2)&1)<<4) | (((c->A[3]>>0)&1)<<3) | (((c->A[7]>>1)&1)<<2) | (((c->A[8]>>2)&1)<<1) | (((c->A[8]>>3)&1)<<0) ];
442
443             /* use 4x4 xor to produce extra nibble for T3 */
444             extra_B = ( ((c->B[3]&1)<<3) ^ ((c->B[6]&2)<<2) ^ ((c->B[7]&4)<<1) ^ ((c->B[9]&8)>>0) ) |
445                       ( ((c->B[6]&1)<<2) ^ ((c->B[8]&2)<<1) ^ ((c->B[3]&8)>>1) ^ ((c->B[4]&4)>>0) ) |
446                       ( ((c->B[5]&8)>>2) ^ ((c->B[8]&4)>>1) ^ ((c->B[4]&1)<<1) ^ ((c->B[5]&2)>>0) ) |
447                       ( ((c->B[9]&4)>>2) ^ ((c->B[6]&8)>>3) ^ ((c->B[3]&2)>>1) ^ ((c->B[8]&1)>>0) ) ;
448
449             // T1 = xor all inputs
450             // in1,in2, D are only used in T1 during initialisation, not generation
451             next_A1 = c->A[10] ^ c->X;
452             if( b_init ) next_A1 = next_A1 ^ c->D ^ ((j % 2) ? in2 : in1);
453
454             // T2 =  xor all inputs
455             // in1,in2 are only used in T1 during initialisation, not generation
456             // if p=0, use this, if p=1, rotate the result left
457             next_B1 = c->B[7] ^ c->B[10] ^ c->Y;
458             if( b_init) next_B1 = next_B1 ^ ((j % 2) ? in1 : in2);
459
460             // if p=1, rotate left
461             if( c->p ) next_B1 = ( (next_B1 << 1) | ((next_B1 >> 3) & 1) ) & 0xf;
462
463             // T3 = xor all inputs
464             c->D = c->E ^ c->Z ^ extra_B;
465
466             // T4 = sum, carry of Z + E + r
467             next_E = c->F;
468             if( c->q )
469             {
470                 c->F = c->Z + c->E + c->r;
471                 // r is the carry
472                 c->r = (c->F >> 4) & 1;
473                 c->F = c->F & 0x0f;
474             }
475             else
476             {
477                 c->F = c->E;
478             }
479             c->E = next_E;
480
481             for( k = 10; k > 1; k-- )
482             {
483                 c->A[k] = c->A[k-1];
484                 c->B[k] = c->B[k-1];
485             }
486             c->A[1] = next_A1;
487             c->B[1] = next_B1;
488
489             c->X = ((s4&1)<<3) | ((s3&1)<<2) | (s2&2) | ((s1&2)>>1);
490             c->Y = ((s6&1)<<3) | ((s5&1)<<2) | (s4&2) | ((s3&2)>>1);
491             c->Z = ((s2&1)<<3) | ((s1&1)<<2) | (s6&2) | ((s5&2)>>1);
492             c->p = (s7&2)>>1;
493             c->q = (s7&1);
494
495             // require 4 loops per output byte
496             // 2 output bits are a function of the 4 bits of D
497             // xor 2 by 2
498             op = (op << 2)^ ( (((c->D^(c->D>>1))>>1)&2) | ((c->D^(c->D>>1))&1) );
499         }
500         // return input data during init
501         cb[i] = b_init ? sb[i] : op;
502     }
503 }
504
505
506 // block - sbox
507 static const uint8_t block_sbox[256] =
508 {
509     0x3A,0xEA,0x68,0xFE,0x33,0xE9,0x88,0x1A,0x83,0xCF,0xE1,0x7F,0xBA,0xE2,0x38,0x12,
510     0xE8,0x27,0x61,0x95,0x0C,0x36,0xE5,0x70,0xA2,0x06,0x82,0x7C,0x17,0xA3,0x26,0x49,
511     0xBE,0x7A,0x6D,0x47,0xC1,0x51,0x8F,0xF3,0xCC,0x5B,0x67,0xBD,0xCD,0x18,0x08,0xC9,
512     0xFF,0x69,0xEF,0x03,0x4E,0x48,0x4A,0x84,0x3F,0xB4,0x10,0x04,0xDC,0xF5,0x5C,0xC6,
513     0x16,0xAB,0xAC,0x4C,0xF1,0x6A,0x2F,0x3C,0x3B,0xD4,0xD5,0x94,0xD0,0xC4,0x63,0x62,
514     0x71,0xA1,0xF9,0x4F,0x2E,0xAA,0xC5,0x56,0xE3,0x39,0x93,0xCE,0x65,0x64,0xE4,0x58,
515     0x6C,0x19,0x42,0x79,0xDD,0xEE,0x96,0xF6,0x8A,0xEC,0x1E,0x85,0x53,0x45,0xDE,0xBB,
516     0x7E,0x0A,0x9A,0x13,0x2A,0x9D,0xC2,0x5E,0x5A,0x1F,0x32,0x35,0x9C,0xA8,0x73,0x30,
517
518     0x29,0x3D,0xE7,0x92,0x87,0x1B,0x2B,0x4B,0xA5,0x57,0x97,0x40,0x15,0xE6,0xBC,0x0E,
519     0xEB,0xC3,0x34,0x2D,0xB8,0x44,0x25,0xA4,0x1C,0xC7,0x23,0xED,0x90,0x6E,0x50,0x00,
520     0x99,0x9E,0x4D,0xD9,0xDA,0x8D,0x6F,0x5F,0x3E,0xD7,0x21,0x74,0x86,0xDF,0x6B,0x05,
521     0x8E,0x5D,0x37,0x11,0xD2,0x28,0x75,0xD6,0xA7,0x77,0x24,0xBF,0xF0,0xB0,0x02,0xB7,
522     0xF8,0xFC,0x81,0x09,0xB1,0x01,0x76,0x91,0x7D,0x0F,0xC8,0xA0,0xF2,0xCB,0x78,0x60,
523     0xD1,0xF7,0xE0,0xB5,0x98,0x22,0xB3,0x20,0x1D,0xA6,0xDB,0x7B,0x59,0x9F,0xAE,0x31,
524     0xFB,0xD3,0xB6,0xCA,0x43,0x72,0x07,0xF4,0xD8,0x41,0x14,0x55,0x0D,0x54,0x8B,0xB9,
525     0xAD,0x46,0x0B,0xAF,0x80,0x52,0x2C,0xFA,0x8C,0x89,0x66,0xFD,0xB2,0xA9,0x9B,0xC0,
526 };
527
528 // block - perm
529 static const uint8_t block_perm[256] =
530 {
531     0x00,0x02,0x80,0x82,0x20,0x22,0xA0,0xA2, 0x10,0x12,0x90,0x92,0x30,0x32,0xB0,0xB2,
532     0x04,0x06,0x84,0x86,0x24,0x26,0xA4,0xA6, 0x14,0x16,0x94,0x96,0x34,0x36,0xB4,0xB6,
533     0x40,0x42,0xC0,0xC2,0x60,0x62,0xE0,0xE2, 0x50,0x52,0xD0,0xD2,0x70,0x72,0xF0,0xF2,
534     0x44,0x46,0xC4,0xC6,0x64,0x66,0xE4,0xE6, 0x54,0x56,0xD4,0xD6,0x74,0x76,0xF4,0xF6,
535     0x01,0x03,0x81,0x83,0x21,0x23,0xA1,0xA3, 0x11,0x13,0x91,0x93,0x31,0x33,0xB1,0xB3,
536     0x05,0x07,0x85,0x87,0x25,0x27,0xA5,0xA7, 0x15,0x17,0x95,0x97,0x35,0x37,0xB5,0xB7,
537     0x41,0x43,0xC1,0xC3,0x61,0x63,0xE1,0xE3, 0x51,0x53,0xD1,0xD3,0x71,0x73,0xF1,0xF3,
538     0x45,0x47,0xC5,0xC7,0x65,0x67,0xE5,0xE7, 0x55,0x57,0xD5,0xD7,0x75,0x77,0xF5,0xF7,
539
540     0x08,0x0A,0x88,0x8A,0x28,0x2A,0xA8,0xAA, 0x18,0x1A,0x98,0x9A,0x38,0x3A,0xB8,0xBA,
541     0x0C,0x0E,0x8C,0x8E,0x2C,0x2E,0xAC,0xAE, 0x1C,0x1E,0x9C,0x9E,0x3C,0x3E,0xBC,0xBE,
542     0x48,0x4A,0xC8,0xCA,0x68,0x6A,0xE8,0xEA, 0x58,0x5A,0xD8,0xDA,0x78,0x7A,0xF8,0xFA,
543     0x4C,0x4E,0xCC,0xCE,0x6C,0x6E,0xEC,0xEE, 0x5C,0x5E,0xDC,0xDE,0x7C,0x7E,0xFC,0xFE,
544     0x09,0x0B,0x89,0x8B,0x29,0x2B,0xA9,0xAB, 0x19,0x1B,0x99,0x9B,0x39,0x3B,0xB9,0xBB,
545     0x0D,0x0F,0x8D,0x8F,0x2D,0x2F,0xAD,0xAF, 0x1D,0x1F,0x9D,0x9F,0x3D,0x3F,0xBD,0xBF,
546     0x49,0x4B,0xC9,0xCB,0x69,0x6B,0xE9,0xEB, 0x59,0x5B,0xD9,0xDB,0x79,0x7B,0xF9,0xFB,
547     0x4D,0x4F,0xCD,0xCF,0x6D,0x6F,0xED,0xEF, 0x5D,0x5F,0xDD,0xDF,0x7D,0x7F,0xFD,0xFF,
548 };
549
550 static void csa_BlockDecypher( uint8_t kk[57], uint8_t ib[8], uint8_t bd[8] )
551 {
552     int i;
553     int perm_out;
554     int R[9];
555     int next_R8;
556
557     for( i = 0; i < 8; i++ )
558     {
559         R[i+1] = ib[i];
560     }
561
562     // loop over kk[56]..kk[1]
563     for( i = 56; i > 0; i-- )
564     {
565         const int sbox_out = block_sbox[ kk[i]^R[7] ];
566         perm_out = block_perm[sbox_out];
567
568         next_R8 = R[7];
569         R[7] = R[6] ^ perm_out;
570         R[6] = R[5];
571         R[5] = R[4] ^ R[8] ^ sbox_out;
572         R[4] = R[3] ^ R[8] ^ sbox_out;
573         R[3] = R[2] ^ R[8] ^ sbox_out;
574         R[2] = R[1];
575         R[1] = R[8] ^ sbox_out;
576
577         R[8] = next_R8;
578     }
579
580     for( i = 0; i < 8; i++ )
581     {
582         bd[i] = R[i+1];
583     }
584 }
585
586 static void csa_BlockCypher( uint8_t kk[57], uint8_t bd[8], uint8_t ib[8] )
587 {
588     int i;
589     int perm_out;
590     int R[9];
591     int next_R1;
592
593     for( i = 0; i < 8; i++ )
594     {
595         R[i+1] = bd[i];
596     }
597
598     // loop over kk[1]..kk[56]
599     for( i = 1; i <= 56; i++ )
600     {
601         const int sbox_out = block_sbox[ kk[i]^R[8] ];
602         perm_out = block_perm[sbox_out];
603
604         next_R1 = R[2];
605         R[2] = R[3] ^ R[1];
606         R[3] = R[4] ^ R[1];
607         R[4] = R[5] ^ R[1];
608         R[5] = R[6];
609         R[6] = R[7] ^ perm_out;
610         R[7] = R[8];
611         R[8] = R[1] ^ sbox_out;
612
613         R[1] = next_R1;
614     }
615
616     for( i = 0; i < 8; i++ )
617     {
618         ib[i] = R[i+1];
619     }
620 }
621