// Implementation of block cipher Kuznyechik, GOST R 34.12-2015 // // Author: Alexander Venedioukhin, dxdt.ru // 31.05.2016 // // Kuznyechik is 128-bit block cipher with 256 bits keys, standardized in 2015 // as GOST R 34.12-2015 (Russian Federation National Standard). // This is unoptimized example implementation in Go (no CPU optimizations, // does not have any leakage protection, constant-time computations and so on, // and so on). // Intended to be used as a reference code. // // General usage: // InitCipher() - initializes (computes values) in-memory lookup tables needed // for encryption/decryption; // Encrypt(Key,Block) - applies encryption algorithm to 128 bit block (plain // text) and returns cipher text; // Decrypt(Key,Block) - applies decryption algorithm to 128 bit block (cipher // text), returns result of decryption (plain text); // Decrypt_L(Key,Block) - reference variant of decryption function with only // L-substitution table. // // Reference: // C implementation - https://github.com/mjosaarinen/kuznechik // SAGE implementation - https://github.com/okazymyrov/kuznechik/ // Cipher informational RFC 7801 - https://tools.ietf.org/html/rfc7801 package grasshopper // Pi (S) substitution lookup table. var Pi_table = [256]uint8 { 0xFC, 0xEE, 0xDD, 0x11, 0xCF, 0x6E, 0x31, 0x16, 0xFB, 0xC4, 0xFA, 0xDA, 0x23, 0xC5, 0x04, 0x4D, 0xE9, 0x77, 0xF0, 0xDB, 0x93, 0x2E, 0x99, 0xBA, 0x17, 0x36, 0xF1, 0xBB, 0x14, 0xCD, 0x5F, 0xC1, 0xF9, 0x18, 0x65, 0x5A, 0xE2, 0x5C, 0xEF, 0x21, 0x81, 0x1C, 0x3C, 0x42, 0x8B, 0x01, 0x8E, 0x4F, 0x05, 0x84, 0x02, 0xAE, 0xE3, 0x6A, 0x8F, 0xA0, 0x06, 0x0B, 0xED, 0x98, 0x7F, 0xD4, 0xD3, 0x1F, 0xEB, 0x34, 0x2C, 0x51, 0xEA, 0xC8, 0x48, 0xAB, 0xF2, 0x2A, 0x68, 0xA2, 0xFD, 0x3A, 0xCE, 0xCC, 0xB5, 0x70, 0x0E, 0x56, 0x08, 0x0C, 0x76, 0x12, 0xBF, 0x72, 0x13, 0x47, 0x9C, 0xB7, 0x5D, 0x87, 0x15, 0xA1, 0x96, 0x29, 0x10, 0x7B, 0x9A, 0xC7, 0xF3, 0x91, 0x78, 0x6F, 0x9D, 0x9E, 0xB2, 0xB1, 0x32, 0x75, 0x19, 0x3D, 0xFF, 0x35, 0x8A, 0x7E, 0x6D, 0x54, 0xC6, 0x80, 0xC3, 0xBD, 0x0D, 0x57, 0xDF, 0xF5, 0x24, 0xA9, 0x3E, 0xA8, 0x43, 0xC9, 0xD7, 0x79, 0xD6, 0xF6, 0x7C, 0x22, 0xB9, 0x03, 0xE0, 0x0F, 0xEC, 0xDE, 0x7A, 0x94, 0xB0, 0xBC, 0xDC, 0xE8, 0x28, 0x50, 0x4E, 0x33, 0x0A, 0x4A, 0xA7, 0x97, 0x60, 0x73, 0x1E, 0x00, 0x62, 0x44, 0x1A, 0xB8, 0x38, 0x82, 0x64, 0x9F, 0x26, 0x41, 0xAD, 0x45, 0x46, 0x92, 0x27, 0x5E, 0x55, 0x2F, 0x8C, 0xA3, 0xA5, 0x7D, 0x69, 0xD5, 0x95, 0x3B, 0x07, 0x58, 0xB3, 0x40, 0x86, 0xAC, 0x1D, 0xF7, 0x30, 0x37, 0x6B, 0xE4, 0x88, 0xD9, 0xE7, 0x89, 0xE1, 0x1B, 0x83, 0x49, 0x4C, 0x3F, 0xF8, 0xFE, 0x8D, 0x53, 0xAA, 0x90, 0xCA, 0xD8, 0x85, 0x61, 0x20, 0x71, 0x67, 0xA4, 0x2D, 0x2B, 0x09, 0x5B, 0xCB, 0x9B, 0x25, 0xD0, 0xBE, 0xE5, 0x6C, 0x52, 0x59, 0xA6, 0x74, 0xD2, 0xE6, 0xF4, 0xB4, 0xC0, 0xD1, 0x66, 0xAF, 0xC2, 0x39, 0x4B, 0x63, 0xB6, } // Inverse Pi (S) substitution lookup table. var Pi_inverse_table = [256]uint8 { 0xA5, 0x2D, 0x32, 0x8F, 0x0E, 0x30, 0x38, 0xC0, 0x54, 0xE6, 0x9E, 0x39, 0x55, 0x7E, 0x52, 0x91, 0x64, 0x03, 0x57, 0x5A, 0x1C, 0x60, 0x07, 0x18, 0x21, 0x72, 0xA8, 0xD1, 0x29, 0xC6, 0xA4, 0x3F, 0xE0, 0x27, 0x8D, 0x0C, 0x82, 0xEA, 0xAE, 0xB4, 0x9A, 0x63, 0x49, 0xE5, 0x42, 0xE4, 0x15, 0xB7, 0xC8, 0x06, 0x70, 0x9D, 0x41, 0x75, 0x19, 0xC9, 0xAA, 0xFC, 0x4D, 0xBF, 0x2A, 0x73, 0x84, 0xD5, 0xC3, 0xAF, 0x2B, 0x86, 0xA7, 0xB1, 0xB2, 0x5B, 0x46, 0xD3, 0x9F, 0xFD, 0xD4, 0x0F, 0x9C, 0x2F, 0x9B, 0x43, 0xEF, 0xD9, 0x79, 0xB6, 0x53, 0x7F, 0xC1, 0xF0, 0x23, 0xE7, 0x25, 0x5E, 0xB5, 0x1E, 0xA2, 0xDF, 0xA6, 0xFE, 0xAC, 0x22, 0xF9, 0xE2, 0x4A, 0xBC, 0x35, 0xCA, 0xEE, 0x78, 0x05, 0x6B, 0x51, 0xE1, 0x59, 0xA3, 0xF2, 0x71, 0x56, 0x11, 0x6A, 0x89, 0x94, 0x65, 0x8C, 0xBB, 0x77, 0x3C, 0x7B, 0x28, 0xAB, 0xD2, 0x31, 0xDE, 0xC4, 0x5F, 0xCC, 0xCF, 0x76, 0x2C, 0xB8, 0xD8, 0x2E, 0x36, 0xDB, 0x69, 0xB3, 0x14, 0x95, 0xBE, 0x62, 0xA1, 0x3B, 0x16, 0x66, 0xE9, 0x5C, 0x6C, 0x6D, 0xAD, 0x37, 0x61, 0x4B, 0xB9, 0xE3, 0xBA, 0xF1, 0xA0, 0x85, 0x83, 0xDA, 0x47, 0xC5, 0xB0, 0x33, 0xFA, 0x96, 0x6F, 0x6E, 0xC2, 0xF6, 0x50, 0xFF, 0x5D, 0xA9, 0x8E, 0x17, 0x1B, 0x97, 0x7D, 0xEC, 0x58, 0xF7, 0x1F, 0xFB, 0x7C, 0x09, 0x0D, 0x7A, 0x67, 0x45, 0x87, 0xDC, 0xE8, 0x4F, 0x1D, 0x4E, 0x04, 0xEB, 0xF8, 0xF3, 0x3E, 0x3D, 0xBD, 0x8A, 0x88, 0xDD, 0xCD, 0x0B, 0x13, 0x98, 0x02, 0x93, 0x80, 0x90, 0xD0, 0x24, 0x34, 0xCB, 0xED, 0xF4, 0xCE, 0x99, 0x10, 0x44, 0x40, 0x92, 0x3A, 0x01, 0x26, 0x12, 0x1A, 0x48, 0x68, 0xF5, 0x81, 0x8B, 0xC7, 0xD6, 0x20, 0x0A, 0x08, 0x00, 0x4C, 0xD7, 0x74, } // L-function (transformation) substitution vector. var L_vector = [16]uint8 { 0x94, 0x20, 0x85, 0x10, 0xC2, 0xC0, 0x01, 0xFB, 0x01, 0xC0, 0xC2, 0x10, 0x85, 0x20, 0x94, 0x01 } // Lookup table for precomputated encryption transformations (LS). var LS_enc_lookup [16][256][16]uint8 // Lookup table for precomputated inverse of L-function. var L_inv_lookup [16][256][16]uint8 // Lookup table for precomputated decryption transformations (SL). var SL_dec_lookup [16][256][16]uint8 // Multiplication in GF(2^8) with P(x)=x^8+x^7+x^6+x+1. // Used by L-function. func GF2_mul(x,y uint8) uint8 { var z uint8 z = 0 for y != 0 { // While we have any bits left. if (y & 1 == 1) { z = z ^ x } // Add... if (x & 0x80 != 0) { // and calculate residue. x = (x << 1) ^ 0xC3 } else { x = x << 1 } y = y >> 1 // Shift out processed term. } return z } // L-function (linear transfromation). func L(block [16]uint8) [16]uint8 { // Takes 128-bit block and returns result of L-function. var i,j int var x uint8 for j = 0; j < 16; j++ { // 16 rounds of transformation R (LFSR). // Single round of R. x = block[15] for i = 14; i >= 0 ; i-- { block[i+1] = block[i] // Multiplication and addition in GF. x = x ^ GF2_mul(block[i],L_vector[i]) } block[0] = x } return block } // Inverse of L-function. func L_inv(block [16]uint8) [16]uint8 { var i,j int var x uint8 for j = 0; j < 16; j++ { x = block[0] for i = 0; i < 15 ; i++ { // Just process in reverse sequence. block[i] = block[i+1] x = x ^ GF2_mul(block[i],L_vector[i]) } block[15] = x } return block } // Stretches main key (256 bits) to 10 round keys K_1...K_10 (128 bits each). func StretchKey(key [32]uint8) [10][16]uint8 { var i,k int var C,x,y,z [16]uint8 var rkeys [10][16]uint8 // First - split key to pair of subkeys (K_1 = x, K_2 = y). for i = 0; i < 16; i++ { x[i] = key[i] y[i] = key[i + 16] } rkeys[0] = x rkeys[1] = y for i = 1; i <= 32; i++ { for k = range C { C[k] = 0 } // Compute C_i constants. C[15] = uint8(i) C = L(C) // Compute sequence of round keys. for k = range z { z[k] = Pi_table[(x[k] ^ C[k])] } z = L(z) for k = range z { z[k] = z[k] ^ y[k] } y = x x = z if i % 8 == 0 { // Store each pair of round keys. rkeys[(i >> 2)] = x rkeys[(i >> 2)+1] = y } } return rkeys } // Encrypts block using given 256-bit key. func Encrypt(key [32]uint8, block [16]uint8) [16]uint8 { // Takes key and block of plain text, returns cipher text. var i,j,k int var ct,r [16]uint8 // 10 round keys. var rkeys [10][16]uint8 rkeys = StretchKey(key) // Get round keys. ct = block // Encryption process follows. for i = 0; i < 9; i++ { // We have nine basic rounds. for k = range ct { ct[k] = ct[k] ^ rkeys[i][k] } // XOR with current round key. for k = range r { r[k] = LS_enc_lookup[0][ct[0]][k]} // Prepare for lookup. for j = 1; j <= 15; j++ { // There are 15 values from lookup table to XOR. // Calculate XOR with lookup table elements. Each element corresponds // to particular value of byte at current block position (ct[j]). for k = range r { r[k] = r[k] ^ LS_enc_lookup[j][ct[j]][k] } } ct = r } for k = range ct { ct[k] = ct[k] ^ rkeys[9][k]} // XOR with the last round key. return ct // Cipher text. } // Decrypts block using given key. Variant with L-lookup table only. // This variant may be used to conserve memory in some applications. func Decrypt_L(key [32]uint8, block [16]uint8) [16]uint8 { // Decrypt_L() works in reverse order compared to Encrypt(). var i,j,k int var pt,r [16]uint8 var rkeys [10][16]uint8 rkeys = StretchKey(key) // Get round keys (no inversion). pt = block for i=9; i > 0; i-- { // We have nine rounds here; start from K_10. for k = range pt { pt[k] = pt[k] ^ rkeys[i][k] } // XOR with current round key. for k = range r { r[k] = L_inv_lookup[0][pt[0]][k] } // Prepare for inverse L lookup. for j = 1; j <= 15; j++ { for k = range r { r[k] = r[k] ^ L_inv_lookup[j][pt[j]][k] } // L lookup. } pt = r // Make r the current block state. for k = range pt { pt[k] = Pi_inverse_table[pt[k]] } // Apply inverse S (Pi). } for k = range pt { pt[k] = pt[k] ^ rkeys[0][k] } // XOR with final round key. return pt // Plain text. } // "Standard" decrypt function with full in-memory precomputation. func Decrypt(key [32]uint8, block [16]uint8) [16]uint8 { // Takes key, returns plain text (possibly). var i,j,k int var pt,r [16]uint8 var rkeys [10][16]uint8 rkeys = StretchKey(key) // Calculate inverse (L function) of 9 round keys K_2..K_10. for k = 1; k < 10; k++ { rkeys[k] = L_inv(rkeys[k]) } pt = block // First - apply inverse L using lookup table. for k = range r { r[k] = L_inv_lookup[0][pt[0]][k] } for j = 1; j <= 15; j++ { for k = range r { r[k] = r[k] ^ L_inv_lookup[j][pt[j]][k] } } pt = r for i = 9; i > 1; i-- { // XOR with current round key (inversed). for k = range pt { pt[k] = pt[k] ^ rkeys[i][k] } // Apply SL transformations using lookup table. for k = range r { r[k] = SL_dec_lookup[0][pt[0]][k] } for j = 1; j <= 15; j++ { for k = range r { r[k] = r[k] ^ SL_dec_lookup[j][pt[j]][k] } } pt = r } for k = range pt { pt[k] = pt[k] ^ rkeys[1][k] // XOR with K_2 pt[k] = Pi_inverse_table[pt[k]] // Inverse Pi pt[k] = pt[k] ^ rkeys[0][k] // XOR with K_1 } return pt // Plain text. } // Creates lookup tables for cipher runtime. func InitCipher() { var i,j,k int var x [16]uint8 for i = 0; i < 16; i++ { for j = 0; j < 256; j++ { for k = range x { x[k] = 0 } x[i] = Pi_table[j] x = L(x) LS_enc_lookup[i][j] = x for k = range x { x[k] = 0 } x[i] = uint8(j) x = L_inv(x) L_inv_lookup[i][j] = x for k = range x { x[k] = 0 } x[i] = Pi_inverse_table[j] x = L_inv(x) SL_dec_lookup[i][j] = x } } }