"Fossies" - the Fresh Open Source Software Archive

Member "src/Crypto/CamelliaSmall.c" (10 Oct 2018, 16903 Bytes) of package /windows/misc/VeraCrypt_1.23-Hotfix-2_Source.zip:


As a special service "Fossies" has tried to format the requested source page into HTML format using (guessed) C and C++ source code syntax highlighting (style: standard) with prefixed line numbers and code folding option. Alternatively you can here view or download the uninterpreted source code file. For more information about "CamelliaSmall.c" see the Fossies "Dox" file reference documentation and the last Fossies "Diffs" side-by-side code changes report: 1.21_Source_vs_1.22_Source.

    1 /*
    2  *  Camellia implementation
    3  *
    4  *  Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
    5  *  SPDX-License-Identifier: Apache-2.0
    6  *
    7  *  Licensed under the Apache License, Version 2.0 (the "License"); you may
    8  *  not use this file except in compliance with the License.
    9  *  You may obtain a copy of the License at
   10  *
   11  *  http://www.apache.org/licenses/LICENSE-2.0
   12  *
   13  *  Unless required by applicable law or agreed to in writing, software
   14  *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
   15  *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   16  *  See the License for the specific language governing permissions and
   17  *  limitations under the License.
   18  *
   19  *  This file is part of mbed TLS (https://tls.mbed.org)
   20  */
   21 /*
   22  *  The Camellia block cipher was designed by NTT and Mitsubishi Electric
   23  *  Corporation.
   24  *
   25  *  http://info.isl.ntt.co.jp/crypt/eng/camellia/dl/01espec.pdf
   26  */
   27 
   28 /* Adapted for VeraCrypt */
   29 
   30 #ifdef TC_WINDOWS_BOOT
   31 #pragma optimize ("t", on)
   32 #endif
   33 
   34 #include "camelliaSmall.h"
   35 #include <memory.h>
   36 
   37 
   38 //#define MBEDTLS_CAMELLIA_SMALL_MEMORY
   39 
   40 /*
   41  * 32-bit integer manipulation macros (big endian)
   42  */
   43 #ifndef GET_UINT32_BE
   44 #define GET_UINT32_BE(n,b,i)                            \
   45 {                                                       \
   46     (n) = ( (unsigned __int32) (b)[(i)    ] << 24 );             \
   47     (n)|= ( (unsigned __int32) (b)[(i) + 1] << 16 );             \
   48     (n)|= ( (unsigned __int32) (b)[(i) + 2] <<  8 );             \
   49     (n)|= ( (unsigned __int32) (b)[(i) + 3]       );            \
   50 }
   51 #endif
   52 
   53 #ifndef PUT_UINT32_BE
   54 #define PUT_UINT32_BE(n,b,i)                            \
   55 {                                                       \
   56     (b)[(i)    ] = (unsigned char) ( (n) >> 24 );       \
   57     (b)[(i) + 1] = (unsigned char) ( (n) >> 16 );       \
   58     (b)[(i) + 2] = (unsigned char) ( (n) >>  8 );       \
   59     (b)[(i) + 3] = (unsigned char) ( (n)       );       \
   60 }
   61 #endif
   62 
   63 static const unsigned char SIGMA_CHARS[6][8] =
   64 {
   65     { 0xa0, 0x9e, 0x66, 0x7f, 0x3b, 0xcc, 0x90, 0x8b },
   66     { 0xb6, 0x7a, 0xe8, 0x58, 0x4c, 0xaa, 0x73, 0xb2 },
   67     { 0xc6, 0xef, 0x37, 0x2f, 0xe9, 0x4f, 0x82, 0xbe },
   68     { 0x54, 0xff, 0x53, 0xa5, 0xf1, 0xd3, 0x6f, 0x1c },
   69     { 0x10, 0xe5, 0x27, 0xfa, 0xde, 0x68, 0x2d, 0x1d },
   70     { 0xb0, 0x56, 0x88, 0xc2, 0xb3, 0xe6, 0xc1, 0xfd }
   71 };
   72 
   73 #if defined(MBEDTLS_CAMELLIA_SMALL_MEMORY)
   74 
   75 static const unsigned char FSb[256] =
   76 {
   77     112,130, 44,236,179, 39,192,229,228,133, 87, 53,234, 12,174, 65,
   78      35,239,107,147, 69, 25,165, 33,237, 14, 79, 78, 29,101,146,189,
   79     134,184,175,143,124,235, 31,206, 62, 48,220, 95, 94,197, 11, 26,
   80     166,225, 57,202,213, 71, 93, 61,217,  1, 90,214, 81, 86,108, 77,
   81     139, 13,154,102,251,204,176, 45,116, 18, 43, 32,240,177,132,153,
   82     223, 76,203,194, 52,126,118,  5,109,183,169, 49,209, 23,  4,215,
   83      20, 88, 58, 97,222, 27, 17, 28, 50, 15,156, 22, 83, 24,242, 34,
   84     254, 68,207,178,195,181,122,145, 36,  8,232,168, 96,252,105, 80,
   85     170,208,160,125,161,137, 98,151, 84, 91, 30,149,224,255,100,210,
   86      16,196,  0, 72,163,247,117,219,138,  3,230,218,  9, 63,221,148,
   87     135, 92,131,  2,205, 74,144, 51,115,103,246,243,157,127,191,226,
   88      82,155,216, 38,200, 55,198, 59,129,150,111, 75, 19,190, 99, 46,
   89     233,121,167,140,159,110,188,142, 41,245,249,182, 47,253,180, 89,
   90     120,152,  6,106,231, 70,113,186,212, 37,171, 66,136,162,141,250,
   91     114,  7,185, 85,248,238,172, 10, 54, 73, 42,104, 60, 56,241,164,
   92      64, 40,211,123,187,201, 67,193, 21,227,173,244,119,199,128,158
   93 };
   94 
   95 #define SBOX1(n) FSb[(n)]
   96 #define SBOX2(n) (unsigned char)((FSb[(n)] >> 7 ^ FSb[(n)] << 1) & 0xff)
   97 #define SBOX3(n) (unsigned char)((FSb[(n)] >> 1 ^ FSb[(n)] << 7) & 0xff)
   98 #define SBOX4(n) FSb[((n) << 1 ^ (n) >> 7) &0xff]
   99 
  100 #else /* MBEDTLS_CAMELLIA_SMALL_MEMORY */
  101 
  102 static const unsigned char FSb[256] =
  103 {
  104  112, 130,  44, 236, 179,  39, 192, 229, 228, 133,  87,  53, 234,  12, 174,  65,
  105   35, 239, 107, 147,  69,  25, 165,  33, 237,  14,  79,  78,  29, 101, 146, 189,
  106  134, 184, 175, 143, 124, 235,  31, 206,  62,  48, 220,  95,  94, 197,  11,  26,
  107  166, 225,  57, 202, 213,  71,  93,  61, 217,   1,  90, 214,  81,  86, 108,  77,
  108  139,  13, 154, 102, 251, 204, 176,  45, 116,  18,  43,  32, 240, 177, 132, 153,
  109  223,  76, 203, 194,  52, 126, 118,   5, 109, 183, 169,  49, 209,  23,   4, 215,
  110   20,  88,  58,  97, 222,  27,  17,  28,  50,  15, 156,  22,  83,  24, 242,  34,
  111  254,  68, 207, 178, 195, 181, 122, 145,  36,   8, 232, 168,  96, 252, 105,  80,
  112  170, 208, 160, 125, 161, 137,  98, 151,  84,  91,  30, 149, 224, 255, 100, 210,
  113   16, 196,   0,  72, 163, 247, 117, 219, 138,   3, 230, 218,   9,  63, 221, 148,
  114  135,  92, 131,   2, 205,  74, 144,  51, 115, 103, 246, 243, 157, 127, 191, 226,
  115   82, 155, 216,  38, 200,  55, 198,  59, 129, 150, 111,  75,  19, 190,  99,  46,
  116  233, 121, 167, 140, 159, 110, 188, 142,  41, 245, 249, 182,  47, 253, 180,  89,
  117  120, 152,   6, 106, 231,  70, 113, 186, 212,  37, 171,  66, 136, 162, 141, 250,
  118  114,   7, 185,  85, 248, 238, 172,  10,  54,  73,  42, 104,  60,  56, 241, 164,
  119  64,  40, 211, 123, 187, 201,  67, 193,  21, 227, 173, 244, 119, 199, 128, 158
  120 };
  121 
  122 static const unsigned char FSb2[256] =
  123 {
  124  224,   5,  88, 217, 103,  78, 129, 203, 201,  11, 174, 106, 213,  24,  93, 130,
  125   70, 223, 214,  39, 138,  50,  75,  66, 219,  28, 158, 156,  58, 202,  37, 123,
  126   13, 113,  95,  31, 248, 215,  62, 157, 124,  96, 185, 190, 188, 139,  22,  52,
  127   77, 195, 114, 149, 171, 142, 186, 122, 179,   2, 180, 173, 162, 172, 216, 154,
  128   23,  26,  53, 204, 247, 153,  97,  90, 232,  36,  86,  64, 225,  99,   9,  51,
  129  191, 152, 151, 133, 104, 252, 236,  10, 218, 111,  83,  98, 163,  46,   8, 175,
  130   40, 176, 116, 194, 189,  54,  34,  56, 100,  30,  57,  44, 166,  48, 229,  68,
  131  253, 136, 159, 101, 135, 107, 244,  35,  72,  16, 209,  81, 192, 249, 210, 160,
  132   85, 161,  65, 250,  67,  19, 196,  47, 168, 182,  60,  43, 193, 255, 200, 165,
  133   32, 137,   0, 144,  71, 239, 234, 183,  21,   6, 205, 181,  18, 126, 187,  41,
  134   15, 184,   7,   4, 155, 148,  33, 102, 230, 206, 237, 231,  59, 254, 127, 197,
  135  164,  55, 177,  76, 145, 110, 141, 118,   3,  45, 222, 150,  38, 125, 198,  92,
  136  211, 242,  79,  25,  63, 220, 121,  29,  82, 235, 243, 109,  94, 251, 105, 178,
  137  240,  49,  12, 212, 207, 140, 226, 117, 169,  74,  87, 132,  17,  69,  27, 245,
  138  228,  14, 115, 170, 241, 221,  89,  20, 108, 146,  84, 208, 120, 112, 227,  73,
  139  128,  80, 167, 246, 119, 147, 134, 131,  42, 199,  91, 233, 238, 143,   1,  61
  140 };
  141 
  142 static const unsigned char FSb3[256] =
  143 {
  144   56,  65,  22, 118, 217, 147,  96, 242, 114, 194, 171, 154, 117,   6,  87, 160,
  145  145, 247, 181, 201, 162, 140, 210, 144, 246,   7, 167,  39, 142, 178,  73, 222,
  146   67,  92, 215, 199,  62, 245, 143, 103,  31,  24, 110, 175,  47, 226, 133,  13,
  147   83, 240, 156, 101, 234, 163, 174, 158, 236, 128,  45, 107, 168,  43,  54, 166,
  148  197, 134,  77,  51, 253, 102,  88, 150,  58,   9, 149,  16, 120, 216,  66, 204,
  149  239,  38, 229,  97,  26,  63,  59, 130, 182, 219, 212, 152, 232, 139,   2, 235,
  150   10,  44,  29, 176, 111, 141, 136,  14,  25, 135,  78,  11, 169,  12, 121,  17,
  151  127,  34, 231,  89, 225, 218,  61, 200,  18,   4, 116,  84,  48, 126, 180,  40,
  152   85, 104,  80, 190, 208, 196,  49, 203,  42, 173,  15, 202, 112, 255,  50, 105,
  153    8,  98,   0,  36, 209, 251, 186, 237,  69, 129, 115, 109, 132, 159, 238,  74,
  154  195,  46, 193,   1, 230,  37,  72, 153, 185, 179, 123, 249, 206, 191, 223, 113,
  155   41, 205, 108,  19, 100, 155,  99, 157, 192,  75, 183, 165, 137,  95, 177,  23,
  156  244, 188, 211,  70, 207,  55,  94,  71, 148, 250, 252,  91, 151, 254,  90, 172,
  157   60,  76,   3,  53, 243,  35, 184,  93, 106, 146, 213,  33,  68,  81, 198, 125,
  158   57, 131, 220, 170, 124, 119,  86,   5,  27, 164,  21,  52,  30,  28, 248,  82,
  159   32,  20, 233, 189, 221, 228, 161, 224, 138, 241, 214, 122, 187, 227,  64,  79
  160 };
  161 
  162 static const unsigned char FSb4[256] =
  163 {
  164  112,  44, 179, 192, 228,  87, 234, 174,  35, 107,  69, 165, 237,  79,  29, 146,
  165  134, 175, 124,  31,  62, 220,  94,  11, 166,  57, 213,  93, 217,  90,  81, 108,
  166  139, 154, 251, 176, 116,  43, 240, 132, 223, 203,  52, 118, 109, 169, 209,   4,
  167   20,  58, 222,  17,  50, 156,  83, 242, 254, 207, 195, 122,  36, 232,  96, 105,
  168  170, 160, 161,  98,  84,  30, 224, 100,  16,   0, 163, 117, 138, 230,   9, 221,
  169  135, 131, 205, 144, 115, 246, 157, 191,  82, 216, 200, 198, 129, 111,  19,  99,
  170  233, 167, 159, 188,  41, 249,  47, 180, 120,   6, 231, 113, 212, 171, 136, 141,
  171  114, 185, 248, 172,  54,  42,  60, 241,  64, 211, 187,  67,  21, 173, 119, 128,
  172  130, 236,  39, 229, 133,  53,  12,  65, 239, 147,  25,  33,  14,  78, 101, 189,
  173  184, 143, 235, 206,  48,  95, 197,  26, 225, 202,  71,  61,   1, 214,  86,  77,
  174   13, 102, 204,  45,  18,  32, 177, 153,  76, 194, 126,   5, 183,  49,  23, 215,
  175   88,  97,  27,  28,  15,  22,  24,  34,  68, 178, 181, 145,   8, 168, 252,  80,
  176  208, 125, 137, 151,  91, 149, 255, 210, 196,  72, 247, 219,   3, 218,  63, 148,
  177   92,   2,  74,  51, 103, 243, 127, 226, 155,  38,  55,  59, 150,  75, 190,  46,
  178  121, 140, 110, 142, 245, 182, 253,  89, 152, 106,  70, 186,  37,  66, 162, 250,
  179   7,  85, 238,  10,  73, 104,  56, 164,  40, 123, 201, 193, 227, 244, 199, 158
  180 };
  181 
  182 #define SBOX1(n) FSb[(n)]
  183 #define SBOX2(n) FSb2[(n)]
  184 #define SBOX3(n) FSb3[(n)]
  185 #define SBOX4(n) FSb4[(n)]
  186 
  187 #endif /* MBEDTLS_CAMELLIA_SMALL_MEMORY */
  188 
  189 static const unsigned char shifts[4][4] =
  190 {
  191     { 1, 0, 1, 1 }, /* KL */
  192     { 1, 1, 0, 1 }, /* KR */
  193     { 1, 1, 1, 0 }, /* KA */
  194     { 1, 1, 0, 1 }  /* KB */
  195 };
  196 
  197 static const signed char indexes[4][20] =
  198 {
  199     {  0,  1,  2,  3, 61, 62, 63, 60, -1, -1,
  200       -1, -1, 27, 24, 25, 26, 35, 32, 33, 34 }, /* KL -> RK */
  201     { -1, -1, -1, -1,  8,  9, 10, 11, 16, 17,
  202       18, 19, -1, -1, -1, -1, 39, 36, 37, 38 }, /* KR -> RK */
  203     { -1, -1, -1, -1, 12, 13, 14, 15, 58, 59,
  204       56, 57, 31, 28, 29, 30, -1, -1, -1, -1 }, /* KA -> RK */
  205     {  4,  5,  6,  7, 65, 66, 67, 64, 20, 21,
  206       22, 23, -1, -1, -1, -1, 43, 40, 41, 42 }  /* KB -> RK */
  207 };
  208 
  209 static const signed char transposes[20] =
  210 {
  211     25, 26, 27, 24,
  212     29, 30, 31, 28,
  213     18, 19, 16, 17,
  214     -1, -1, -1, -1,
  215     -1, -1, -1, -1
  216 };
  217 
  218 /* Shift macro for 128 bit strings with rotation smaller than 32 bits (!) */
  219 #define ROTL(DEST, SRC, SHIFT)                                      \
  220 {                                                                   \
  221     (DEST)[0] = (SRC)[0] << (SHIFT) ^ (SRC)[1] >> (32 - (SHIFT));   \
  222     (DEST)[1] = (SRC)[1] << (SHIFT) ^ (SRC)[2] >> (32 - (SHIFT));   \
  223     (DEST)[2] = (SRC)[2] << (SHIFT) ^ (SRC)[3] >> (32 - (SHIFT));   \
  224     (DEST)[3] = (SRC)[3] << (SHIFT) ^ (SRC)[0] >> (32 - (SHIFT));   \
  225 }
  226 
  227 #define FL(XL, XR, KL, KR)                                          \
  228 {                                                                   \
  229     (XR) = ((((XL) & (KL)) << 1) | (((XL) & (KL)) >> 31)) ^ (XR);   \
  230     (XL) = ((XR) | (KR)) ^ (XL);                                    \
  231 }
  232 
  233 #define FLInv(YL, YR, KL, KR)                                       \
  234 {                                                                   \
  235     (YL) = ((YR) | (KR)) ^ (YL);                                    \
  236     (YR) = ((((YL) & (KL)) << 1) | (((YL) & (KL)) >> 31)) ^ (YR);   \
  237 }
  238 
  239 #define SHIFT_AND_PLACE(OFFSET)                      \
  240 {                                                           \
  241     TK[0] = KC[(OFFSET) * 4 + 0];                           \
  242     TK[1] = KC[(OFFSET) * 4 + 1];                           \
  243     TK[2] = KC[(OFFSET) * 4 + 2];                           \
  244     TK[3] = KC[(OFFSET) * 4 + 3];                           \
  245                                                             \
  246     for( i = 1; i <= 4; i++ )                               \
  247         if( shifts[(OFFSET)][i -1] )               \
  248             ROTL(TK + i * 4, TK, ( 15 * i ) % 32);          \
  249                                                             \
  250     for( i = 0; i < 20; i++ )                               \
  251         if( indexes[(OFFSET)][i] != -1 ) {         \
  252             RK[indexes[(OFFSET)][i]] = TK[ i ];    \
  253         }                                                   \
  254 }
  255 
  256 static void camellia_feistel( const unsigned __int32 x[2], const unsigned __int32 k[2],
  257                               unsigned __int32 z[2])
  258 {
  259     unsigned __int32 I0, I1;
  260     I0 = x[0] ^ k[0];
  261     I1 = x[1] ^ k[1];
  262 
  263     I0 = ((unsigned __int32) SBOX1((I0 >> 24) & 0xFF) << 24) |
  264          ((unsigned __int32) SBOX2((I0 >> 16) & 0xFF) << 16) |
  265          ((unsigned __int32) SBOX3((I0 >>  8) & 0xFF) <<  8) |
  266          ((unsigned __int32) SBOX4((I0      ) & 0xFF)      );
  267     I1 = ((unsigned __int32) SBOX2((I1 >> 24) & 0xFF) << 24) |
  268          ((unsigned __int32) SBOX3((I1 >> 16) & 0xFF) << 16) |
  269          ((unsigned __int32) SBOX4((I1 >>  8) & 0xFF) <<  8) |
  270          ((unsigned __int32) SBOX1((I1      ) & 0xFF)      );
  271 
  272     I0 ^= (I1 << 8) | (I1 >> 24);
  273     I1 ^= (I0 << 16) | (I0 >> 16);
  274     I0 ^= (I1 >> 8) | (I1 << 24);
  275     I1 ^= (I0 >> 8) | (I0 << 24);
  276 
  277     z[0] ^= I1;
  278     z[1] ^= I0;
  279 }
  280 
  281 /*
  282  * Camellia key schedule (encryption)
  283  */
  284 void mbedtls_camellia_setkey_enc( const unsigned char *key, unsigned __int32 *RK)
  285 {
  286     int i;
  287     unsigned char t[64];
  288     unsigned __int32 SIGMA[6][2];
  289     unsigned __int32 KC[16];
  290     unsigned __int32 TK[20];
  291 
  292     memset( t, 0, 64 );
  293     memset( RK, 0, CAMELLIA_KS/2 );
  294 
  295     for( i = 0; i < 32; ++i )
  296         t[i] = key[i];
  297 
  298     /*
  299      * Prepare SIGMA values
  300      */
  301     for( i = 0; i < 6; i++ ) {
  302         GET_UINT32_BE( SIGMA[i][0], SIGMA_CHARS[i], 0 );
  303         GET_UINT32_BE( SIGMA[i][1], SIGMA_CHARS[i], 4 );
  304     }
  305 
  306     /*
  307      * Key storage in KC
  308      * Order: KL, KR, KA, KB
  309      */
  310     memset( KC, 0, sizeof(KC) );
  311 
  312     /* Store KL, KR */
  313     for( i = 0; i < 8; i++ )
  314         GET_UINT32_BE( KC[i], t, i * 4 );
  315 
  316     /* Generate KA */
  317     for( i = 0; i < 4; ++i )
  318         KC[8 + i] = KC[i] ^ KC[4 + i];
  319 
  320     camellia_feistel( KC + 8, SIGMA[0], KC + 10 );
  321     camellia_feistel( KC + 10, SIGMA[1], KC + 8 );
  322 
  323     for( i = 0; i < 4; ++i )
  324         KC[8 + i] ^= KC[i];
  325 
  326     camellia_feistel( KC + 8, SIGMA[2], KC + 10 );
  327     camellia_feistel( KC + 10, SIGMA[3], KC + 8 );
  328 
  329     /* Generate KB */
  330     for( i = 0; i < 4; ++i )
  331         KC[12 + i] = KC[4 + i] ^ KC[8 + i];
  332 
  333     camellia_feistel( KC + 12, SIGMA[4], KC + 14 );
  334     camellia_feistel( KC + 14, SIGMA[5], KC + 12 );
  335 
  336     /*
  337      * Generating subkeys
  338      */
  339 
  340     /* Manipulating KL */
  341     SHIFT_AND_PLACE( 0 );
  342 
  343     /* Manipulating KR */
  344     SHIFT_AND_PLACE( 1 );
  345 
  346     /* Manipulating KA */
  347     SHIFT_AND_PLACE( 2 );
  348 
  349     /* Manipulating KB */
  350     SHIFT_AND_PLACE( 3 );
  351 
  352     /* Do transpositions */
  353     for( i = 0; i < 20; i++ ) {
  354         if( transposes[i] != -1 ) {
  355             RK[32 + 12 + i] = RK[transposes[i]];
  356         }
  357     }
  358 }
  359 
  360 /*
  361  * Camellia key schedule (decryption)
  362  */
  363 void camellia_set_key(const unsigned __int8 key[], unsigned __int8 *ks)
  364 {
  365     int i;
  366     unsigned __int32 *RK = (unsigned __int32 *) (ks + (CAMELLIA_KS /2));
  367     unsigned __int32 *SK;
  368 
  369     mbedtls_camellia_setkey_enc( key, (unsigned __int32 *) ks );
  370 
  371     SK = ((unsigned __int32 *) ks) + 24 * 2 + 8 * 2;
  372 
  373     *RK++ = *SK++;
  374     *RK++ = *SK++;
  375     *RK++ = *SK++;
  376     *RK++ = *SK++;
  377 
  378     for( i = 22 + 8, SK -= 6; i > 0; i--, SK -= 4 )
  379     {
  380         *RK++ = *SK++;
  381         *RK++ = *SK++;
  382     }
  383 
  384     SK -= 2;
  385 
  386     *RK++ = *SK++;
  387     *RK++ = *SK++;
  388     *RK++ = *SK++;
  389     *RK++ = *SK++;
  390 }
  391 
  392 /*
  393  * Camellia-ECB block encryption/decryption
  394  */
  395 void mbedtls_camellia_crypt_ecb(const unsigned __int8 *input,
  396                     unsigned __int8 *output,  unsigned __int8 * ks)
  397 {
  398     int NR = 4;
  399     unsigned __int32 *RK = (unsigned __int32 *) ks;
  400     unsigned __int32 X[4];
  401 
  402     GET_UINT32_BE( X[0], input,  0 );
  403     GET_UINT32_BE( X[1], input,  4 );
  404     GET_UINT32_BE( X[2], input,  8 );
  405     GET_UINT32_BE( X[3], input, 12 );
  406 
  407     X[0] ^= *RK++;
  408     X[1] ^= *RK++;
  409     X[2] ^= *RK++;
  410     X[3] ^= *RK++;
  411 
  412     while( NR ) {
  413         --NR;
  414         camellia_feistel( X, RK, X + 2 );
  415         RK += 2;
  416         camellia_feistel( X + 2, RK, X );
  417         RK += 2;
  418         camellia_feistel( X, RK, X + 2 );
  419         RK += 2;
  420         camellia_feistel( X + 2, RK, X );
  421         RK += 2;
  422         camellia_feistel( X, RK, X + 2 );
  423         RK += 2;
  424         camellia_feistel( X + 2, RK, X );
  425         RK += 2;
  426 
  427         if( NR ) {
  428             FL(X[0], X[1], RK[0], RK[1]);
  429             RK += 2;
  430             FLInv(X[2], X[3], RK[0], RK[1]);
  431             RK += 2;
  432         }
  433     }
  434 
  435     X[2] ^= *RK++;
  436     X[3] ^= *RK++;
  437     X[0] ^= *RK++;
  438     X[1] ^= *RK++;
  439 
  440     PUT_UINT32_BE( X[2], output,  0 );
  441     PUT_UINT32_BE( X[3], output,  4 );
  442     PUT_UINT32_BE( X[0], output,  8 );
  443     PUT_UINT32_BE( X[1], output, 12 );
  444 }
  445 
  446 void camellia_encrypt(const unsigned __int8 *inBlock, unsigned __int8 *outBlock, unsigned __int8 *ks)
  447 {
  448     mbedtls_camellia_crypt_ecb (inBlock, outBlock, ks);
  449 }
  450 
  451 void camellia_decrypt(const unsigned __int8 *inBlock,  unsigned __int8 *outBlock, unsigned __int8 *ks)
  452 {
  453     mbedtls_camellia_crypt_ecb (inBlock, outBlock, ks + (CAMELLIA_KS / 2));
  454 }
  455