1 // GoGOST -- Pure Go GOST cryptographic functions library
2 // Copyright (C) 2015-2021 Sergey Matveev <stargrave@stargrave.org>
4 // This program is free software: you can redistribute it and/or modify
5 // it under the terms of the GNU General Public License as published by
6 // the Free Software Foundation, version 3 of the License.
8 // This program is distributed in the hope that it will be useful,
9 // but WITHOUT ANY WARRANTY; without even the implied warranty of
10 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 // GNU General Public License for more details.
13 // You should have received a copy of the GNU General Public License
14 // along with this program. If not, see <http://www.gnu.org/licenses/>.
16 // GOST 34.12-2015 128-bit (Кузнечик (Kuznechik)) block cipher.
25 lc [BlockSize]byte = [BlockSize]byte{
26 148, 32, 133, 16, 194, 192, 1, 251, 1, 192, 194, 16,
29 pi [256]byte = [256]byte{
30 252, 238, 221, 17, 207, 110, 49, 22, 251, 196, 250,
31 218, 35, 197, 4, 77, 233, 119, 240, 219, 147, 46,
32 153, 186, 23, 54, 241, 187, 20, 205, 95, 193, 249,
33 24, 101, 90, 226, 92, 239, 33, 129, 28, 60, 66, 139,
34 1, 142, 79, 5, 132, 2, 174, 227, 106, 143, 160, 6,
35 11, 237, 152, 127, 212, 211, 31, 235, 52, 44, 81,
36 234, 200, 72, 171, 242, 42, 104, 162, 253, 58, 206,
37 204, 181, 112, 14, 86, 8, 12, 118, 18, 191, 114, 19,
38 71, 156, 183, 93, 135, 21, 161, 150, 41, 16, 123,
39 154, 199, 243, 145, 120, 111, 157, 158, 178, 177,
40 50, 117, 25, 61, 255, 53, 138, 126, 109, 84, 198,
41 128, 195, 189, 13, 87, 223, 245, 36, 169, 62, 168,
42 67, 201, 215, 121, 214, 246, 124, 34, 185, 3, 224,
43 15, 236, 222, 122, 148, 176, 188, 220, 232, 40, 80,
44 78, 51, 10, 74, 167, 151, 96, 115, 30, 0, 98, 68,
45 26, 184, 56, 130, 100, 159, 38, 65, 173, 69, 70,
46 146, 39, 94, 85, 47, 140, 163, 165, 125, 105, 213,
47 149, 59, 7, 88, 179, 64, 134, 172, 29, 247, 48, 55,
48 107, 228, 136, 217, 231, 137, 225, 27, 131, 73, 76,
49 63, 248, 254, 141, 83, 170, 144, 202, 216, 133, 97,
50 32, 113, 103, 164, 45, 43, 9, 91, 203, 155, 37, 208,
51 190, 229, 108, 82, 89, 166, 116, 210, 230, 244, 180,
52 192, 209, 102, 175, 194, 57, 75, 99, 182,
56 gfCache [256][256]byte
59 func gf(a, b byte) (c byte) {
75 for n := 0; n < BlockSize; n++ {
77 t ^= gfCache[blk[0]][lc[0]]
78 t ^= gfCache[blk[1]][lc[1]]
79 t ^= gfCache[blk[2]][lc[2]]
80 t ^= gfCache[blk[3]][lc[3]]
81 t ^= gfCache[blk[4]][lc[4]]
82 t ^= gfCache[blk[5]][lc[5]]
83 t ^= gfCache[blk[6]][lc[6]]
84 t ^= gfCache[blk[7]][lc[7]]
85 t ^= gfCache[blk[8]][lc[8]]
86 t ^= gfCache[blk[9]][lc[9]]
87 t ^= gfCache[blk[10]][lc[10]]
88 t ^= gfCache[blk[11]][lc[11]]
89 t ^= gfCache[blk[12]][lc[12]]
90 t ^= gfCache[blk[13]][lc[13]]
91 t ^= gfCache[blk[14]][lc[14]]
97 func lInv(blk []byte) {
98 for n := 0; n < BlockSize; n++ {
101 t ^= gfCache[blk[0]][lc[0]]
102 t ^= gfCache[blk[1]][lc[1]]
103 t ^= gfCache[blk[2]][lc[2]]
104 t ^= gfCache[blk[3]][lc[3]]
105 t ^= gfCache[blk[4]][lc[4]]
106 t ^= gfCache[blk[5]][lc[5]]
107 t ^= gfCache[blk[6]][lc[6]]
108 t ^= gfCache[blk[7]][lc[7]]
109 t ^= gfCache[blk[8]][lc[8]]
110 t ^= gfCache[blk[9]][lc[9]]
111 t ^= gfCache[blk[10]][lc[10]]
112 t ^= gfCache[blk[11]][lc[11]]
113 t ^= gfCache[blk[12]][lc[12]]
114 t ^= gfCache[blk[13]][lc[13]]
115 t ^= gfCache[blk[14]][lc[14]]
121 for a := 0; a < 256; a++ {
122 for b := 0; b < 256; b++ {
123 gfCache[a][b] = gf(byte(a), byte(b))
126 for i := 0; i < 256; i++ {
127 piInv[int(pi[i])] = byte(i)
129 for i := 0; i < 32; i++ {
130 cBlk[i] = make([]byte, BlockSize)
131 cBlk[i][15] = byte(i) + 1
137 blk[0] = pi[int(blk[0])]
138 blk[1] = pi[int(blk[1])]
139 blk[2] = pi[int(blk[2])]
140 blk[3] = pi[int(blk[3])]
141 blk[4] = pi[int(blk[4])]
142 blk[5] = pi[int(blk[5])]
143 blk[6] = pi[int(blk[6])]
144 blk[7] = pi[int(blk[7])]
145 blk[8] = pi[int(blk[8])]
146 blk[9] = pi[int(blk[9])]
147 blk[10] = pi[int(blk[10])]
148 blk[11] = pi[int(blk[11])]
149 blk[12] = pi[int(blk[12])]
150 blk[13] = pi[int(blk[13])]
151 blk[14] = pi[int(blk[14])]
152 blk[15] = pi[int(blk[15])]
155 func xor(dst, src1, src2 []byte) {
156 dst[0] = src1[0] ^ src2[0]
157 dst[1] = src1[1] ^ src2[1]
158 dst[2] = src1[2] ^ src2[2]
159 dst[3] = src1[3] ^ src2[3]
160 dst[4] = src1[4] ^ src2[4]
161 dst[5] = src1[5] ^ src2[5]
162 dst[6] = src1[6] ^ src2[6]
163 dst[7] = src1[7] ^ src2[7]
164 dst[8] = src1[8] ^ src2[8]
165 dst[9] = src1[9] ^ src2[9]
166 dst[10] = src1[10] ^ src2[10]
167 dst[11] = src1[11] ^ src2[11]
168 dst[12] = src1[12] ^ src2[12]
169 dst[13] = src1[13] ^ src2[13]
170 dst[14] = src1[14] ^ src2[14]
171 dst[15] = src1[15] ^ src2[15]
178 func (c *Cipher) BlockSize() int {
182 func NewCipher(key []byte) *Cipher {
183 if len(key) != KeySize {
184 panic("invalid key size")
187 for i := 0; i < len(ks); i++ {
188 ks[i] = make([]byte, BlockSize)
190 kr0 := make([]byte, BlockSize)
191 kr1 := make([]byte, BlockSize)
192 krt := make([]byte, BlockSize)
193 copy(kr0, key[:BlockSize])
194 copy(kr1, key[BlockSize:])
197 for i := 0; i < 4; i++ {
198 for j := 0; j < 8; j++ {
199 xor(krt, kr0, cBlk[8*i+j])
207 copy(ks[2+2*i+1], kr1)
212 func (c *Cipher) Encrypt(dst, src []byte) {
213 blk := make([]byte, BlockSize)
215 for i := 0; i < 9; i++ {
216 xor(blk, blk, c.ks[i])
220 xor(blk, blk, c.ks[9])
221 copy(dst[:BlockSize], blk)
224 func (c *Cipher) Decrypt(dst, src []byte) {
225 blk := make([]byte, BlockSize)
228 for i := 9; i > 0; i-- {
229 xor(blk, blk, c.ks[i])
231 for n = 0; n < BlockSize; n++ {
232 blk[n] = piInv[int(blk[n])]
235 xor(blk, blk, c.ks[0])
236 copy(dst[:BlockSize], blk)