sm4.c
Go to the documentation of this file.
1 /**
2  * @file sm4.c
3  * @brief SM4 encryption algorithm
4  *
5  * @section License
6  *
7  * SPDX-License-Identifier: GPL-2.0-or-later
8  *
9  * Copyright (C) 2010-2025 Oryx Embedded SARL. All rights reserved.
10  *
11  * This file is part of CycloneCRYPTO Open.
12  *
13  * This program is free software; you can redistribute it and/or
14  * modify it under the terms of the GNU General Public License
15  * as published by the Free Software Foundation; either version 2
16  * of the License, or (at your option) any later version.
17  *
18  * This program is distributed in the hope that it will be useful,
19  * but WITHOUT ANY WARRANTY; without even the implied warranty of
20  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
21  * GNU General Public License for more details.
22  *
23  * You should have received a copy of the GNU General Public License
24  * along with this program; if not, write to the Free Software Foundation,
25  * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
26  *
27  * @author Oryx Embedded SARL (www.oryx-embedded.com)
28  * @version 2.5.4
29  **/
30 
31 //Switch to the appropriate trace level
32 #define TRACE_LEVEL CRYPTO_TRACE_LEVEL
33 
34 //Dependencies
35 #include "core/crypto.h"
36 #include "cipher/sm4.h"
37 
38 //Check crypto library configuration
39 #if (SM4_SUPPORT == ENABLED)
40 
41 //Nonlinear transformation tau
42 #define TAU(a) ((uint32_t) s[(a) & 0xFF] | \
43  ((uint32_t) s[((a) >> 8) & 0xFF] << 8) | \
44  ((uint32_t) s[((a) >> 16) & 0xFF] << 16) | \
45  ((uint32_t) s[((a) >> 24) & 0xFF] << 24))
46 
47 //Linear transformations L and L'
48 #define L(b) ((b) ^ ROL32(b, 2) ^ ROL32(b, 10) ^ ROL32(b, 18) ^ ROL32(b, 24))
49 #define LP(b) ((b) ^ ROL32(b, 13) ^ ROL32(b, 23))
50 
51 //Round function F
52 #define F(x0, x1, x2, x3, rk) \
53 { \
54  uint32_t temp; \
55  temp = (x1) ^ (x2) ^ (x3) ^ (rk); \
56  temp = TAU(temp); \
57  x0 ^= L(temp); \
58 }
59 
60 //Family key FK
61 static const uint32_t fk[4] =
62 {
63  0xA3B1BAC6, 0x56AA3350, 0x677D9197, 0xB27022DC
64 };
65 
66 //Constant key CK
67 static const uint32_t ck[32] =
68 {
69  0x00070E15, 0x1C232A31, 0x383F464D, 0x545B6269, 0x70777E85, 0x8C939AA1, 0xA8AFB6BD, 0xC4CBD2D9,
70  0xE0E7EEF5, 0xFC030A11, 0x181F262D, 0x343B4249, 0x50575E65, 0x6C737A81, 0x888F969D, 0xA4ABB2B9,
71  0xC0C7CED5, 0xDCE3EAF1, 0xF8FF060D, 0x141B2229, 0x30373E45, 0x4C535A61, 0x686F767D, 0x848B9299,
72  0xA0A7AEB5, 0xBCC3CAD1, 0xD8DFE6ED, 0xF4FB0209, 0x10171E25, 0x2C333A41, 0x484F565D, 0x646B7279
73 };
74 
75 //S-box S
76 static const uint8_t s[256] =
77 {
78  0xD6, 0x90, 0xE9, 0xFE, 0xCC, 0xE1, 0x3D, 0xB7, 0x16, 0xB6, 0x14, 0xC2, 0x28, 0xFB, 0x2C, 0x05,
79  0x2B, 0x67, 0x9A, 0x76, 0x2A, 0xBE, 0x04, 0xC3, 0xAA, 0x44, 0x13, 0x26, 0x49, 0x86, 0x06, 0x99,
80  0x9C, 0x42, 0x50, 0xF4, 0x91, 0xEF, 0x98, 0x7A, 0x33, 0x54, 0x0B, 0x43, 0xED, 0xCF, 0xAC, 0x62,
81  0xE4, 0xB3, 0x1C, 0xA9, 0xC9, 0x08, 0xE8, 0x95, 0x80, 0xDF, 0x94, 0xFA, 0x75, 0x8F, 0x3F, 0xA6,
82  0x47, 0x07, 0xA7, 0xFC, 0xF3, 0x73, 0x17, 0xBA, 0x83, 0x59, 0x3C, 0x19, 0xE6, 0x85, 0x4F, 0xA8,
83  0x68, 0x6B, 0x81, 0xB2, 0x71, 0x64, 0xDA, 0x8B, 0xF8, 0xEB, 0x0F, 0x4B, 0x70, 0x56, 0x9D, 0x35,
84  0x1E, 0x24, 0x0E, 0x5E, 0x63, 0x58, 0xD1, 0xA2, 0x25, 0x22, 0x7C, 0x3B, 0x01, 0x21, 0x78, 0x87,
85  0xD4, 0x00, 0x46, 0x57, 0x9F, 0xD3, 0x27, 0x52, 0x4C, 0x36, 0x02, 0xE7, 0xA0, 0xC4, 0xC8, 0x9E,
86  0xEA, 0xBF, 0x8A, 0xD2, 0x40, 0xC7, 0x38, 0xB5, 0xA3, 0xF7, 0xF2, 0xCE, 0xF9, 0x61, 0x15, 0xA1,
87  0xE0, 0xAE, 0x5D, 0xA4, 0x9B, 0x34, 0x1A, 0x55, 0xAD, 0x93, 0x32, 0x30, 0xF5, 0x8C, 0xB1, 0xE3,
88  0x1D, 0xF6, 0xE2, 0x2E, 0x82, 0x66, 0xCA, 0x60, 0xC0, 0x29, 0x23, 0xAB, 0x0D, 0x53, 0x4E, 0x6F,
89  0xD5, 0xDB, 0x37, 0x45, 0xDE, 0xFD, 0x8E, 0x2F, 0x03, 0xFF, 0x6A, 0x72, 0x6D, 0x6C, 0x5B, 0x51,
90  0x8D, 0x1B, 0xAF, 0x92, 0xBB, 0xDD, 0xBC, 0x7F, 0x11, 0xD9, 0x5C, 0x41, 0x1F, 0x10, 0x5A, 0xD8,
91  0x0A, 0xC1, 0x31, 0x88, 0xA5, 0xCD, 0x7B, 0xBD, 0x2D, 0x74, 0xD0, 0x12, 0xB8, 0xE5, 0xB4, 0xB0,
92  0x89, 0x69, 0x97, 0x4A, 0x0C, 0x96, 0x77, 0x7E, 0x65, 0xB9, 0xF1, 0x09, 0xC5, 0x6E, 0xC6, 0x84,
93  0x18, 0xF0, 0x7D, 0xEC, 0x3A, 0xDC, 0x4D, 0x20, 0x79, 0xEE, 0x5F, 0x3E, 0xD7, 0xCB, 0x39, 0x48
94 };
95 
96 //SM4-ECB OID (1.2.156.10197.1.104.1)
97 const uint8_t SM4_ECB_OID[8] = {0x2A, 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x68, 0x01};
98 //SM4-CBC OID (1.2.156.10197.1.104.2)
99 const uint8_t SM4_CBC_OID[8] = {0x2A, 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x68, 0x02};
100 //SM4-OFB OID (1.2.156.10197.1.104.3)
101 const uint8_t SM4_OFB_OID[8] = {0x2A, 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x68, 0x03};
102 //SM4-CFB OID (1.2.156.10197.1.104.4)
103 const uint8_t SM4_CFB_OID[8] = {0x2A, 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x68, 0x04};
104 //SM4-CTR OID (1.2.156.10197.1.104.7)
105 const uint8_t SM4_CTR_OID[8] = {0x2A, 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x68, 0x07};
106 //SM4-GCM OID (1.2.156.10197.1.104.8)
107 const uint8_t SM4_GCM_OID[8] = {0x2A, 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x68, 0x08};
108 //SM4-CCM OID (1.2.156.10197.1.104.9)
109 const uint8_t SM4_CCM_OID[8] = {0x2A, 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x68, 0x09};
110 //SM4-XTS OID (1.2.156.10197.1.104.10)
111 const uint8_t SM4_XTS_OID[8] = {0x2A, 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x68, 0x0A};
112 
113 //Common interface for encryption algorithms
114 const CipherAlgo sm4CipherAlgo =
115 {
116  "SM4",
117  sizeof(Sm4Context),
118  CIPHER_ALGO_TYPE_BLOCK,
119  SM4_BLOCK_SIZE,
120  (CipherAlgoInit) sm4Init,
121  NULL,
122  NULL,
123  (CipherAlgoEncryptBlock) sm4EncryptBlock,
124  (CipherAlgoDecryptBlock) sm4DecryptBlock,
125  (CipherAlgoDeinit) sm4Deinit
126 };
127 
128 
129 /**
130  * @brief Key expansion
131  * @param[in] context Pointer to the SM4 context to initialize
132  * @param[in] key Pointer to the key
133  * @param[in] keyLen Length of the key
134  * @return Error code
135  **/
136 
137 __weak_func error_t sm4Init(Sm4Context *context, const uint8_t *key,
138  size_t keyLen)
139 {
140  uint_t i;
141  uint32_t temp;
142  uint32_t k[4];
143 
144  //Check parameters
145  if(context == NULL || key == NULL)
146  return ERROR_INVALID_PARAMETER;
147 
148  //The SM4 encryption key is 128 bits long
149  if(keyLen != 16)
150  return ERROR_INVALID_KEY_LENGTH;
151 
152  //The family key is used for key expansion
153  k[0] = LOAD32BE(key) ^ fk[0];
154  k[1] = LOAD32BE(key + 4) ^ fk[1];
155  k[2] = LOAD32BE(key + 8) ^ fk[2];
156  k[3] = LOAD32BE(key + 12) ^ fk[3];
157 
158  //Generate round keys
159  for(i = 0; i < 32; i++)
160  {
161  temp = k[(i + 1) % 4] ^ k[(i + 2) % 4] ^ k[(i + 3) % 4] ^ ck[i];
162  temp = TAU(temp);
163  k[i % 4] ^= LP(temp);
164  context->rk[i] = k[i % 4];
165  }
166 
167  //Successful initialization
168  return NO_ERROR;
169 }
170 
171 
172 /**
173  * @brief Encrypt a 16-byte block using SM4 algorithm
174  * @param[in] context Pointer to the SM4 context
175  * @param[in] input Plaintext block to encrypt
176  * @param[out] output Ciphertext block resulting from encryption
177  **/
178 
179 __weak_func void sm4EncryptBlock(Sm4Context *context, const uint8_t *input,
180  uint8_t *output)
181 {
182  uint_t i;
183  uint32_t x0;
184  uint32_t x1;
185  uint32_t x2;
186  uint32_t x3;
187 
188  //The 16 bytes of plaintext are split into 4 words
189  x0 = LOAD32BE(input);
190  x1 = LOAD32BE(input + 4);
191  x2 = LOAD32BE(input + 8);
192  x3 = LOAD32BE(input + 12);
193 
194  //Encryption use 32 rounds of a nonlinear key schedule per block
195  for(i = 0; i < 32; i += 4)
196  {
197  F(x0, x1, x2, x3, context->rk[i]);
198  F(x1, x0, x2, x3, context->rk[i + 1]);
199  F(x2, x0, x1, x3, context->rk[i + 2]);
200  F(x3, x0, x1, x2, context->rk[i + 3]);
201  }
202 
203  //The 4 words of ciphertext are then written as 16 bytes
204  STORE32BE(x3, output);
205  STORE32BE(x2, output + 4);
206  STORE32BE(x1, output + 8);
207  STORE32BE(x0, output + 12);
208 }
209 
210 
211 /**
212  * @brief Decrypt a 16-byte block using SM4 algorithm
213  * @param[in] context Pointer to the SM4 context
214  * @param[in] input Ciphertext block to decrypt
215  * @param[out] output Plaintext block resulting from decryption
216  **/
217 
218 __weak_func void sm4DecryptBlock(Sm4Context *context, const uint8_t *input,
219  uint8_t *output)
220 {
221  uint_t i;
222  uint32_t x0;
223  uint32_t x1;
224  uint32_t x2;
225  uint32_t x3;
226 
227  //The 16 bytes of ciphertext are split into 4 words
228  x0 = LOAD32BE(input);
229  x1 = LOAD32BE(input + 4);
230  x2 = LOAD32BE(input + 8);
231  x3 = LOAD32BE(input + 12);
232 
233  //The structure of encryption and decryption are identical, except that
234  //the round key schedule has its order reversed during decryption
235  for(i = 32; i > 0; i -= 4)
236  {
237  F(x0, x1, x2, x3, context->rk[i - 1]);
238  F(x1, x0, x2, x3, context->rk[i - 2]);
239  F(x2, x0, x1, x3, context->rk[i - 3]);
240  F(x3, x0, x1, x2, context->rk[i - 4]);
241  }
242 
243  //The 4 words of plaintext are then written as 16 bytes
244  STORE32BE(x3, output);
245  STORE32BE(x2, output + 4);
246  STORE32BE(x1, output + 8);
247  STORE32BE(x0, output + 12);
248 }
249 
250 
251 /**
252  * @brief Release SM4 context
253  * @param[in] context Pointer to the SM4 context
254  **/
255 
256 __weak_func void sm4Deinit(Sm4Context *context)
257 {
258  //Clear SM4 context
259  osMemset(context, 0, sizeof(Sm4Context));
260 }
261 
262 #endif
CipherAlgoEncryptBlock
void(* CipherAlgoEncryptBlock)(void *context, const uint8_t *input, uint8_t *output)
Definition: crypto.h:1086
LOAD32BE
#define LOAD32BE(p)
Definition: cpu_endian.h:210
LP
#define LP(b)
Definition: sm4.c:49
CIPHER_ALGO_TYPE_BLOCK
@ CIPHER_ALGO_TYPE_BLOCK
Definition: crypto.h:1023
Sm4Context
SM4 algorithm context.
Definition: sm4.h:58
SM4_ECB_OID
const uint8_t SM4_ECB_OID[8]
Definition: sm4.c:97
sm4Deinit
__weak_func void sm4Deinit(Sm4Context *context)
Release SM4 context.
Definition: sm4.c:256
F
#define F(x0, x1, x2, x3, rk)
Definition: sm4.c:52
ERROR_INVALID_PARAMETER
@ ERROR_INVALID_PARAMETER
Invalid parameter.
Definition: error.h:47
error_t
error_t
Error codes.
Definition: error.h:43
CipherAlgoDecryptBlock
void(* CipherAlgoDecryptBlock)(void *context, const uint8_t *input, uint8_t *output)
Definition: crypto.h:1089
SM4_XTS_OID
const uint8_t SM4_XTS_OID[8]
Definition: sm4.c:111
SM4_BLOCK_SIZE
#define SM4_BLOCK_SIZE
Definition: sm4.h:43
SM4_OFB_OID
const uint8_t SM4_OFB_OID[8]
Definition: sm4.c:101
ERROR_INVALID_KEY_LENGTH
@ ERROR_INVALID_KEY_LENGTH
Definition: error.h:107
crypto.h
General definitions for cryptographic algorithms.
sm4.h
SM4 encryption algorithm.
SM4_CFB_OID
const uint8_t SM4_CFB_OID[8]
Definition: sm4.c:103
SM4_CBC_OID
const uint8_t SM4_CBC_OID[8]
Definition: sm4.c:99
CipherAlgoInit
error_t(* CipherAlgoInit)(void *context, const uint8_t *key, size_t keyLen)
Definition: crypto.h:1077
sm4Init
__weak_func error_t sm4Init(Sm4Context *context, const uint8_t *key, size_t keyLen)
Key expansion.
Definition: sm4.c:137
SM4_CTR_OID
const uint8_t SM4_CTR_OID[8]
Definition: sm4.c:105
SM4_GCM_OID
const uint8_t SM4_GCM_OID[8]
Definition: sm4.c:107
sm4DecryptBlock
__weak_func void sm4DecryptBlock(Sm4Context *context, const uint8_t *input, uint8_t *output)
Decrypt a 16-byte block using SM4 algorithm.
Definition: sm4.c:218
TAU
#define TAU(a)
Definition: sm4.c:42
sm4CipherAlgo
const CipherAlgo sm4CipherAlgo
Definition: sm4.c:114
CipherAlgo
Common interface for encryption algorithms.
Definition: crypto.h:1164
s
uint8_t s
Definition: igmp_common.h:234
SM4_CCM_OID
const uint8_t SM4_CCM_OID[8]
Definition: sm4.c:109
sm4EncryptBlock
__weak_func void sm4EncryptBlock(Sm4Context *context, const uint8_t *input, uint8_t *output)
Encrypt a 16-byte block using SM4 algorithm.
Definition: sm4.c:179
uint_t
unsigned int uint_t
Definition: compiler_port.h:57
osMemset
#define osMemset(p, value, length)
Definition: os_port.h:138
CipherAlgoDeinit
void(* CipherAlgoDeinit)(void *context)
Definition: crypto.h:1092
STORE32BE
#define STORE32BE(a, p)
Definition: cpu_endian.h:286
Sm4Context::rk
uint32_t rk[32]
Definition: sm4.h:60
NO_ERROR
@ NO_ERROR
Success.
Definition: error.h:44