this looked like it might be interesting
Anonymous
/* TOP SECRET */
/* See label file for codeword restrictions */
/*****************************************************************/
/* TOP SECRET */
/* See label file for codeword restrictions */
/* */
/* S-1 CIPHER ALGORITHM software chip simulator */
/* */
/* NOT INTENDED FOR EXTERNAL, PRODUCTION, OR CONTRACTOR USE OR */
/* DISCLOSURE. */
/* NOT CERTIFIED OR APPROVED FOR USE AS REFERENCE. */
/* FOR SECONDARY ANALYTIC USE ONLY. */
/* */
/* Basic chip functions. Block encryption methods are not */
/* implemented. */
/* */
/* SOFTWARE HISTORY: */
/* 1 FEBRUARY 1989 --- Submitted to source control. */
/* 31 JULY 1991 --- Moved UFV support into basic functions. */
/* */
/* TOP SECRET */
/* See label file for codeword restrictions */
/*****************************************************************/
/* local declarations are for ANSI C */
#include <stdio.h>
#include <sys/types.h>
/* S-1 F table - these differ in the S-2 version */
static u_char F[4][256];
/* S-1 F selection (G) table */
static u_char G[2][256];
/* exported interface */
int S1_self_check(void);
int S1_zeroize(void);
int S1_load_key(int, u_char *);
int S1_encrypt_block(int, u_char *);
int S1_decrypt_block(int, u_char *);
int S1_create_key(u_char *, u_char *);
/* local functions */
static void f_initialize(void);
static void rotatekey(int, u_char *);
static u_char f(int,int);
static u_char g(int,int);
/* CHIP PARAMETERS */
#define KEYGEN_CHIP 1 /* delete this to simulate operational chipsets */
#define KEY_REGISTERS 4
#define INTEGRITY KEY_REGISTERS
/* user family vectors (UFV) */
static u_char clear_family[8] = {129,3,5,7,2,4,6,131};
static u_char cipher_family[8] = {1,254,253,252,128,129,130,8};
static u_char key_integrity_key[10] = {0,0,0,0,0,0,0,0,0,0};
static u_char key[KEY_REGISTERS+1][10];
static u_char fullkey[KEY_REGISTERS+1][32][6]; /* SOFTWARE ONLY */
static int initialized=0;
/* EXPORTED SIMULATED CHIP INTERFACE */
/* SEE NOTES FOR INTERFACE DESCRIPTIONS */
int S1_self_check()
{
f_initialize();
rotatekey(INTEGRITY,key_integrity_key);
initialized=1;
return 0;
}
int S1_zeroize()
{
int i, j, k;
i=0;
while (i<KEY_REGISTERS+1) {
j=0;
while (j<10) {
key[i][j] = 0;
j=j+1;
}
j=0;
while (j<32) {
k=0;
while (k<6) {
fullkey[i][j][k] = 0;
k++;
}
j=j+1;
}
i=i+1;
}
i=0;
while (i<4) {
j=0;
while (j<256) {
F[i][j] = 0;
j++;
}
i++;
}
return 0;
}
int S1_load_key(int key_register, u_char *key_vector)
{
u_char key_buffer[12];
if (initialized == 0)
return 1;
if ((key_register < 0) || (key_register >= KEY_REGISTERS))
return 9;
memcpy(key_buffer,key_vector,12);
S1_decrypt_block(INTEGRITY,key_buffer);
S1_decrypt_block(INTEGRITY,key_buffer+4);
if ((key_buffer[10] != 0) || (key_buffer[11] != 0))
return 2;
rotatekey(key_register,key_buffer);
memcpy(key[key_register],key_buffer,10);
return 0;
}
int S1_encrypt_block(int key_register, u_char *block)
{
int r, startf, i;
if (initialized == 0)
return 1;
i=0;
while (i<8) {
block[i] = block[i] ^ clear_family[i];
i=i+1;
}
i=0;
while (i<32) {
r=i*2;
startf = g(0,fullkey[key_register][r][0] ^ block[(r+4) % 8])
+ g(1,fullkey[key_register][r][1] ^ block[(r+5) % 8])*2;
block[(r+6) % 8] = block[(r+6) % 8]
^ f(((startf+0) % 4),
fullkey[key_register][r][2]
^ block[(r+2) % 8]);
block[(r+6) % 8] = block[(r+6) % 8]
^ (f(((startf+1) % 4),
fullkey[key_register][r][3]
^ block[(r+3) % 8]) << 4);
block[(r+7) % 8] = block[(r+7) % 8]
^ f(((startf+2) % 4),
fullkey[key_register][r][4]
^ block[(r+0) % 8]);
block[(r+7) % 8] = block[(r+7) % 8]
^ (f(((startf+3) % 4),
fullkey[key_register][r][5]
^ block[(r+1) % 8]) << 4);
i = i+1;
}
i=0;
while (i<8) {
block[i] = block[i] ^ cipher_family[i];
i=i+1;
}
return 0;
}
int S1_decrypt_block(int key_register, u_char *block)
{
int r, startf, i;
if (initialized == 0)
return 1;
i=0;
while (i<8) {
block[i] = block[i] ^ cipher_family[i];
i=i+1;
}
i=32;
while (i>0) {
i = i-1;
r=i*2;
startf = g(0,fullkey[key_register][r][0] ^ block[(r+4) % 8])
+ g(1,fullkey[key_register][r][1] ^ block[(r+5) % 8])*2;
block[(r+6) % 8] = block[(r+6) % 8]
^ f(((startf+0) % 4),
fullkey[key_register][r][2]
^ block[(r+2) % 8]);
block[(r+6) % 8] = block[(r+6) % 8]
^ (f(((startf+1) % 4),
fullkey[key_register][r][3]
^ block[(r+3) % 8]) << 4);
block[(r+7) % 8] = block[(r+7) % 8]
^ f(((startf+2) % 4),
fullkey[key_register][r][4]
^ block[(r+0) % 8]);
block[(r+7) % 8] = block[(r+7) % 8]
^ (f(((startf+3) % 4),
fullkey[key_register][r][5]
^ block[(r+1) % 8]) << 4);
}
i=0;
while (i<8) {
block[i] = block[i] ^ clear_family[i];
i=i+1;
}
return 0;
}
#ifdef KEYGEN_CHIP
/* WARNING: this feature is not implemented on all chip sets */
int S1_create_key(u_char *key_value, u_char *key_vector)
{
if (initialized == 0)
return 1;
memcpy(key_vector,key_value,10);
key_vector[10] = 0;
key_vector[11] = 0;
S1_encrypt_block(INTEGRITY,key_vector+4);
S1_encrypt_block(INTEGRITY,key_vector);
return 0;
}
#else
int S1_create_key(u_char *key_value, u_char *key_vector)
{
return 7;
}
#endif
/* SUPPORT FUNCTIONS */
static void
rotatekey(int key_register, u_char *key_value)
{
int i, j;
int jshift[6] = {5, 8, 3, 1, 4, 0};
key_register = key_register % KEY_REGISTERS;
i=0;
while (i<32) {
j=0;
while (j<6) {
fullkey[key_register][i][j] =
f(0,(key_value[(i*6+j+jshift[j]) % 10]))
^ f(1,(key_value[(i*6+j+jshift[(j+1)%6]) % 10]))
^ (f(2,(key_value[(i*6+j+jshift[(j+2)%6]) % 10]))<<4)
^ (f(3,(key_value[(i*6+j+jshift[(j+3)%6]) % 10]))<<4);
j=j+1;
}
i=i+1;
}
}
static void f_initialize() {
/* NON-LINEAR (F0, F1, F2, F3) */
F[0][0] = 07;
F[0][1] = 02;
F[0][2] = 011;
F[0][3] = 014;
F[0][4] = 010;
F[0][5] = 016;
F[0][6] = 01;
F[0][7] = 06;
F[0][8] = 015;
F[0][9] = 02;
F[0][10] = 00;
F[0][11] = 04;
F[0][12] = 017;
F[0][13] = 07;
F[0][14] = 03;
F[0][15] = 017;
F[0][16] = 010;
F[0][17] = 017;
F[0][18] = 012;
F[0][19] = 05;
F[0][20] = 013;
F[0][21] = 00;
F[0][22] = 017;
F[0][23] = 02;
F[0][24] = 05;
F[0][25] = 015;
F[0][26] = 017;
F[0][27] = 017;
F[0][28] = 011;
F[0][29] = 011;
F[0][30] = 06;
F[0][31] = 014;
F[0][32] = 07;
F[0][33] = 017;
F[0][34] = 012;
F[0][35] = 016;
F[0][36] = 012;
F[0][37] = 06;
F[0][38] = 04;
F[0][39] = 04;
F[0][40] = 014;
F[0][41] = 04;
F[0][42] = 017;
F[0][43] = 013;
F[0][44] = 03;
F[0][45] = 014;
F[0][46] = 014;
F[0][47] = 06;
F[0][48] = 06;
F[0][49] = 00;
F[0][50] = 02;
F[0][51] = 010;
F[0][52] = 012;
F[0][53] = 012;
F[0][54] = 03;
F[0][55] = 015;
F[0][56] = 013;
F[0][57] = 014;
F[0][58] = 017;
F[0][59] = 05;
F[0][60] = 05;
F[0][61] = 00;
F[0][62] = 07;
F[0][63] = 014;
F[0][64] = 016;
F[0][65] = 011;
F[0][66] = 03;
F[0][67] = 011;
F[0][68] = 010;
F[0][69] = 014;
F[0][70] = 012;
F[0][71] = 014;
F[0][72] = 017;
F[0][73] = 05;
F[0][74] = 07;
F[0][75] = 05;
F[0][76] = 07;
F[0][77] = 016;
F[0][78] = 03;
F[0][79] = 02;
F[0][80] = 011;
F[0][81] = 014;
F[0][82] = 04;
F[0][83] = 00;
F[0][84] = 010;
F[0][85] = 016;
F[0][86] = 02;
F[0][87] = 03;
F[0][88] = 02;
F[0][89] = 016;
F[0][90] = 013;
F[0][91] = 04;
F[0][92] = 010;
F[0][93] = 01;
F[0][94] = 06;
F[0][95] = 013;
F[0][96] = 016;
F[0][97] = 010;
F[0][98] = 017;
F[0][99] = 014;
F[0][100] = 00;
F[0][101] = 02;
F[0][102] = 00;
F[0][103] = 01;
F[0][104] = 01;
F[0][105] = 013;
F[0][106] = 016;
F[0][107] = 00;
F[0][108] = 02;
F[0][109] = 013;
F[0][110] = 017;
F[0][111] = 013;
F[0][112] = 016;
F[0][113] = 016;
F[0][114] = 02;
F[0][115] = 05;
F[0][116] = 02;
F[0][117] = 00;
F[0][118] = 016;
F[0][119] = 01;
F[0][120] = 010;
F[0][121] = 013;
F[0][122] = 011;
F[0][123] = 06;
F[0][124] = 01;
F[0][125] = 05;
F[0][126] = 07;
F[0][127] = 07;
F[0][128] = 016;
F[0][129] = 014;
F[0][130] = 012;
F[0][131] = 011;
F[0][132] = 011;
F[0][133] = 016;
F[0][134] = 07;
F[0][135] = 014;
F[0][136] = 011;
F[0][137] = 015;
F[0][138] = 012;
F[0][139] = 00;
F[0][140] = 010;
F[0][141] = 00;
F[0][142] = 07;
F[0][143] = 012;
F[0][144] = 015;
F[0][145] = 013;
F[0][146] = 00;
F[0][147] = 012;
F[0][148] = 04;
F[0][149] = 017;
F[0][150] = 05;
F[0][151] = 00;
F[0][152] = 015;
F[0][153] = 02;
F[0][154] = 016;
F[0][155] = 03;
F[0][156] = 03;
F[0][157] = 013;
F[0][158] = 06;
F[0][159] = 011;
F[0][160] = 014;
F[0][161] = 03;
F[0][162] = 017;
F[0][163] = 014;
F[0][164] = 00;
F[0][165] = 013;
F[0][166] = 06;
F[0][167] = 017;
F[0][168] = 010;
F[0][169] = 015;
F[0][170] = 01;
F[0][171] = 012;
F[0][172] = 05;
F[0][173] = 010;
F[0][174] = 06;
F[0][175] = 07;
F[0][176] = 06;
F[0][177] = 03;
F[0][178] = 017;
F[0][179] = 06;
F[0][180] = 015;
F[0][181] = 015;
F[0][182] = 01;
F[0][183] = 013;
F[0][184] = 04;
F[0][185] = 012;
F[0][186] = 03;
F[0][187] = 00;
F[0][188] = 06;
F[0][189] = 011;
F[0][190] = 011;
F[0][191] = 015;
F[0][192] = 012;
F[0][193] = 017;
F[0][194] = 016;
F[0][195] = 01;
F[0][196] = 015;
F[0][197] = 016;
F[0][198] = 017;
F[0][199] = 04;
F[0][200] = 015;
F[0][201] = 06;
F[0][202] = 07;
F[0][203] = 04;
F[0][204] = 00;
F[0][205] = 017;
F[0][206] = 016;
F[0][207] = 017;
F[0][208] = 010;
F[0][209] = 02;
F[0][210] = 04;
F[0][211] = 012;
F[0][212] = 01;
F[0][213] = 02;
F[0][214] = 011;
F[0][215] = 07;
F[0][216] = 010;
F[0][217] = 010;
F[0][218] = 02;
F[0][219] = 02;
F[0][220] = 07;
F[0][221] = 010;
F[0][222] = 010;
F[0][223] = 013;
F[0][224] = 03;
F[0][225] = 016;
F[0][226] = 017;
F[0][227] = 011;
F[0][228] = 06;
F[0][229] = 011;
F[0][230] = 00;
F[0][231] = 017;
F[0][232] = 014;
F[0][233] = 06;
F[0][234] = 04;
F[0][235] = 02;
F[0][236] = 03;
F[0][237] = 00;
F[0][238] = 011;
F[0][239] = 013;
F[0][240] = 014;
F[0][241] = 05;
F[0][242] = 03;
F[0][243] = 016;
F[0][244] = 013;
F[0][245] = 017;
F[0][246] = 04;
F[0][247] = 05;
F[0][248] = 017;
F[0][249] = 011;
F[0][250] = 03;
F[0][251] = 06;
F[0][252] = 010;
F[0][253] = 013;
F[0][254] = 014;
F[0][255] = 06;
F[1][0] = 017;
F[1][1] = 06;
F[1][2] = 016;
F[1][3] = 015;
F[1][4] = 012;
F[1][5] = 07;
F[1][6] = 07;
F[1][7] = 03;
F[1][8] = 03;
F[1][9] = 01;
F[1][10] = 017;
F[1][11] = 00;
F[1][12] = 013;
F[1][13] = 07;
F[1][14] = 02;
F[1][15] = 010;
F[1][16] = 01;
F[1][17] = 014;
F[1][18] = 012;
F[1][19] = 01;
F[1][20] = 07;
F[1][21] = 03;
F[1][22] = 01;
F[1][23] = 016;
F[1][24] = 014;
F[1][25] = 011;
F[1][26] = 00;
F[1][27] = 01;
F[1][28] = 06;
F[1][29] = 02;
F[1][30] = 011;
F[1][31] = 013;
F[1][32] = 014;
F[1][33] = 011;
F[1][34] = 07;
F[1][35] = 012;
F[1][36] = 03;
F[1][37] = 03;
F[1][38] = 010;
F[1][39] = 00;
F[1][40] = 00;
F[1][41] = 012;
F[1][42] = 04;
F[1][43] = 00;
F[1][44] = 02;
F[1][45] = 017;
F[1][46] = 015;
F[1][47] = 013;
F[1][48] = 02;
F[1][49] = 017;
F[1][50] = 05;
F[1][51] = 04;
F[1][52] = 03;
F[1][53] = 013;
F[1][54] = 017;
F[1][55] = 03;
F[1][56] = 011;
F[1][57] = 012;
F[1][58] = 01;
F[1][59] = 011;
F[1][60] = 07;
F[1][61] = 011;
F[1][62] = 011;
F[1][63] = 010;
F[1][64] = 01;
F[1][65] = 05;
F[1][66] = 02;
F[1][67] = 03;
F[1][68] = 010;
F[1][69] = 017;
F[1][70] = 07;
F[1][71] = 012;
F[1][72] = 015;
F[1][73] = 011;
F[1][74] = 010;
F[1][75] = 017;
F[1][76] = 03;
F[1][77] = 016;
F[1][78] = 03;
F[1][79] = 015;
F[1][80] = 011;
F[1][81] = 013;
F[1][82] = 05;
F[1][83] = 07;
F[1][84] = 017;
F[1][85] = 012;
F[1][86] = 012;
F[1][87] = 07;
F[1][88] = 017;
F[1][89] = 05;
F[1][90] = 07;
F[1][91] = 00;
F[1][92] = 04;
F[1][93] = 04;
F[1][94] = 04;
F[1][95] = 06;
F[1][96] = 011;
F[1][97] = 04;
F[1][98] = 07;
F[1][99] = 010;
F[1][100] = 010;
F[1][101] = 015;
F[1][102] = 017;
F[1][103] = 00;
F[1][104] = 012;
F[1][105] = 02;
F[1][106] = 01;
F[1][107] = 016;
F[1][108] = 00;
F[1][109] = 05;
F[1][110] = 03;
F[1][111] = 011;
F[1][112] = 05;
F[1][113] = 014;
F[1][114] = 011;
F[1][115] = 00;
F[1][116] = 011;
F[1][117] = 00;
F[1][118] = 013;
F[1][119] = 010;
F[1][120] = 016;
F[1][121] = 014;
F[1][122] = 04;
F[1][123] = 03;
F[1][124] = 015;
F[1][125] = 016;
F[1][126] = 02;
F[1][127] = 03;
F[1][128] = 012;
F[1][129] = 06;
F[1][130] = 017;
F[1][131] = 00;
F[1][132] = 011;
F[1][133] = 011;
F[1][134] = 02;
F[1][135] = 017;
F[1][136] = 013;
F[1][137] = 04;
F[1][138] = 07;
F[1][139] = 02;
F[1][140] = 02;
F[1][141] = 014;
F[1][142] = 04;
F[1][143] = 07;
F[1][144] = 014;
F[1][145] = 01;
F[1][146] = 00;
F[1][147] = 03;
F[1][148] = 01;
F[1][149] = 010;
F[1][150] = 01;
F[1][151] = 07;
F[1][152] = 012;
F[1][153] = 00;
F[1][154] = 015;
F[1][155] = 04;
F[1][156] = 00;
F[1][157] = 017;
F[1][158] = 04;
F[1][159] = 00;
F[1][160] = 017;
F[1][161] = 014;
F[1][162] = 04;
F[1][163] = 07;
F[1][164] = 013;
F[1][165] = 011;
F[1][166] = 012;
F[1][167] = 017;
F[1][168] = 017;
F[1][169] = 03;
F[1][170] = 07;
F[1][171] = 00;
F[1][172] = 04;
F[1][173] = 07;
F[1][174] = 07;
F[1][175] = 03;
F[1][176] = 05;
F[1][177] = 06;
F[1][178] = 017;
F[1][179] = 03;
F[1][180] = 017;
F[1][181] = 02;
F[1][182] = 04;
F[1][183] = 017;
F[1][184] = 00;
F[1][185] = 014;
F[1][186] = 017;
F[1][187] = 04;
F[1][188] = 05;
F[1][189] = 016;
F[1][190] = 015;
F[1][191] = 04;
F[1][192] = 012;
F[1][193] = 013;
F[1][194] = 00;
F[1][195] = 04;
F[1][196] = 017;
F[1][197] = 07;
F[1][198] = 013;
F[1][199] = 04;
F[1][200] = 010;
F[1][201] = 05;
F[1][202] = 07;
F[1][203] = 04;
F[1][204] = 013;
F[1][205] = 05;
F[1][206] = 016;
F[1][207] = 010;
F[1][208] = 015;
F[1][209] = 00;
F[1][210] = 04;
F[1][211] = 04;
F[1][212] = 017;
F[1][213] = 010;
F[1][214] = 05;
F[1][215] = 015;
F[1][216] = 011;
F[1][217] = 01;
F[1][218] = 012;
F[1][219] = 013;
F[1][220] = 015;
F[1][221] = 03;
F[1][222] = 010;
F[1][223] = 05;
F[1][224] = 07;
F[1][225] = 06;
F[1][226] = 00;
F[1][227] = 02;
F[1][228] = 011;
F[1][229] = 06;
F[1][230] = 00;
F[1][231] = 017;
F[1][232] = 01;
F[1][233] = 010;
F[1][234] = 03;
F[1][235] = 06;
F[1][236] = 05;
F[1][237] = 010;
F[1][238] = 010;
F[1][239] = 012;
F[1][240] = 014;
F[1][241] = 02;
F[1][242] = 02;
F[1][243] = 02;
F[1][244] = 010;
F[1][245] = 04;
F[1][246] = 013;
F[1][247] = 07;
F[1][248] = 016;
F[1][249] = 015;
F[1][250] = 05;
F[1][251] = 017;
F[1][252] = 05;
F[1][253] = 03;
F[1][254] = 010;
F[1][255] = 010;
F[2][0] = 013;
F[2][1] = 011;
F[2][2] = 017;
F[2][3] = 07;
F[2][4] = 01;
F[2][5] = 012;
F[2][6] = 00;
F[2][7] = 011;
F[2][8] = 06;
F[2][9] = 010;
F[2][10] = 012;
F[2][11] = 014;
F[2][12] = 00;
F[2][13] = 012;
F[2][14] = 01;
F[2][15] = 012;
F[2][16] = 011;
F[2][17] = 014;
F[2][18] = 05;
F[2][19] = 05;
F[2][20] = 07;
F[2][21] = 04;
F[2][22] = 013;
F[2][23] = 015;
F[2][24] = 04;
F[2][25] = 00;
F[2][26] = 01;
F[2][27] = 010;
F[2][28] = 017;
F[2][29] = 02;
F[2][30] = 015;
F[2][31] = 012;
F[2][32] = 06;
F[2][33] = 00;
F[2][34] = 07;
F[2][35] = 017;
F[2][36] = 014;
F[2][37] = 013;
F[2][38] = 011;
F[2][39] = 03;
F[2][40] = 07;
F[2][41] = 013;
F[2][42] = 06;
F[2][43] = 05;
F[2][44] = 011;
F[2][45] = 010;
F[2][46] = 00;
F[2][47] = 02;
F[2][48] = 07;
F[2][49] = 011;
F[2][50] = 016;
F[2][51] = 01;
F[2][52] = 012;
F[2][53] = 014;
F[2][54] = 012;
F[2][55] = 06;
F[2][56] = 011;
F[2][57] = 016;
F[2][58] = 015;
F[2][59] = 06;
F[2][60] = 07;
F[2][61] = 05;
F[2][62] = 014;
F[2][63] = 07;
F[2][64] = 01;
F[2][65] = 06;
F[2][66] = 012;
F[2][67] = 06;
F[2][68] = 05;
F[2][69] = 04;
F[2][70] = 03;
F[2][71] = 011;
F[2][72] = 04;
F[2][73] = 014;
F[2][74] = 013;
F[2][75] = 00;
F[2][76] = 010;
F[2][77] = 016;
F[2][78] = 03;
F[2][79] = 06;
F[2][80] = 00;
F[2][81] = 017;
F[2][82] = 02;
F[2][83] = 010;
F[2][84] = 010;
F[2][85] = 012;
F[2][86] = 012;
F[2][87] = 017;
F[2][88] = 07;
F[2][89] = 03;
F[2][90] = 012;
F[2][91] = 012;
F[2][92] = 013;
F[2][93] = 014;
F[2][94] = 013;
F[2][95] = 03;
F[2][96] = 011;
F[2][97] = 012;
F[2][98] = 06;
F[2][99] = 02;
F[2][100] = 02;
F[2][101] = 02;
F[2][102] = 011;
F[2][103] = 04;
F[2][104] = 06;
F[2][105] = 010;
F[2][106] = 05;
F[2][107] = 01;
F[2][108] = 016;
F[2][109] = 07;
F[2][110] = 017;
F[2][111] = 00;
F[2][112] = 013;
F[2][113] = 012;
F[2][114] = 016;
F[2][115] = 07;
F[2][116] = 016;
F[2][117] = 01;
F[2][118] = 04;
F[2][119] = 015;
F[2][120] = 07;
F[2][121] = 014;
F[2][122] = 00;
F[2][123] = 04;
F[2][124] = 06;
F[2][125] = 016;
F[2][126] = 011;
F[2][127] = 014;
F[2][128] = 06;
F[2][129] = 011;
F[2][130] = 012;
F[2][131] = 02;
F[2][132] = 012;
F[2][133] = 016;
F[2][134] = 013;
F[2][135] = 00;
F[2][136] = 00;
F[2][137] = 03;
F[2][138] = 03;
F[2][139] = 015;
F[2][140] = 07;
F[2][141] = 012;
F[2][142] = 00;
F[2][143] = 012;
F[2][144] = 017;
F[2][145] = 011;
F[2][146] = 05;
F[2][147] = 05;
F[2][148] = 010;
F[2][149] = 04;
F[2][150] = 04;
F[2][151] = 05;
F[2][152] = 014;
F[2][153] = 012;
F[2][154] = 011;
F[2][155] = 015;
F[2][156] = 015;
F[2][157] = 013;
F[2][158] = 017;
F[2][159] = 014;
F[2][160] = 011;
F[2][161] = 07;
F[2][162] = 013;
F[2][163] = 01;
F[2][164] = 00;
F[2][165] = 015;
F[2][166] = 011;
F[2][167] = 05;
F[2][168] = 015;
F[2][169] = 016;
F[2][170] = 012;
F[2][171] = 017;
F[2][172] = 01;
F[2][173] = 015;
F[2][174] = 07;
F[2][175] = 012;
F[2][176] = 010;
F[2][177] = 017;
F[2][178] = 07;
F[2][179] = 04;
F[2][180] = 011;
F[2][181] = 013;
F[2][182] = 01;
F[2][183] = 010;
F[2][184] = 06;
F[2][185] = 03;
F[2][186] = 010;
F[2][187] = 02;
F[2][188] = 05;
F[2][189] = 010;
F[2][190] = 011;
F[2][191] = 02;
F[2][192] = 04;
F[2][193] = 017;
F[2][194] = 012;
F[2][195] = 06;
F[2][196] = 05;
F[2][197] = 05;
F[2][198] = 015;
F[2][199] = 012;
F[2][200] = 00;
F[2][201] = 03;
F[2][202] = 04;
F[2][203] = 015;
F[2][204] = 016;
F[2][205] = 015;
F[2][206] = 015;
F[2][207] = 011;
F[2][208] = 03;
F[2][209] = 05;
F[2][210] = 013;
F[2][211] = 016;
F[2][212] = 02;
F[2][213] = 017;
F[2][214] = 013;
F[2][215] = 00;
F[2][216] = 03;
F[2][217] = 012;
F[2][218] = 02;
F[2][219] = 07;
F[2][220] = 03;
F[2][221] = 010;
F[2][222] = 011;
F[2][223] = 01;
F[2][224] = 06;
F[2][225] = 02;
F[2][226] = 014;
F[2][227] = 01;
F[2][228] = 012;
F[2][229] = 010;
F[2][230] = 02;
F[2][231] = 012;
F[2][232] = 013;
F[2][233] = 017;
F[2][234] = 013;
F[2][235] = 014;
F[2][236] = 05;
F[2][237] = 02;
F[2][238] = 02;
F[2][239] = 013;
F[2][240] = 011;
F[2][241] = 013;
F[2][242] = 02;
F[2][243] = 05;
F[2][244] = 014;
F[2][245] = 017;
F[2][246] = 06;
F[2][247] = 015;
F[2][248] = 01;
F[2][249] = 011;
F[2][250] = 012;
F[2][251] = 00;
F[2][252] = 013;
F[2][253] = 05;
F[2][254] = 03;
F[2][255] = 015;
F[3][0] = 013;
F[3][1] = 07;
F[3][2] = 04;
F[3][3] = 01;
F[3][4] = 03;
F[3][5] = 017;
F[3][6] = 07;
F[3][7] = 05;
F[3][8] = 014;
F[3][9] = 02;
F[3][10] = 05;
F[3][11] = 016;
F[3][12] = 013;
F[3][13] = 04;
F[3][14] = 013;
F[3][15] = 01;
F[3][16] = 015;
F[3][17] = 015;
F[3][18] = 014;
F[3][19] = 015;
F[3][20] = 01;
F[3][21] = 010;
F[3][22] = 04;
F[3][23] = 02;
F[3][24] = 07;
F[3][25] = 015;
F[3][26] = 016;
F[3][27] = 016;
F[3][28] = 01;
F[3][29] = 03;
F[3][30] = 011;
F[3][31] = 011;
F[3][32] = 010;
F[3][33] = 017;
F[3][34] = 06;
F[3][35] = 04;
F[3][36] = 013;
F[3][37] = 010;
F[3][38] = 014;
F[3][39] = 013;
F[3][40] = 03;
F[3][41] = 010;
F[3][42] = 015;
F[3][43] = 07;
F[3][44] = 07;
F[3][45] = 00;
F[3][46] = 05;
F[3][47] = 01;
F[3][48] = 03;
F[3][49] = 013;
F[3][50] = 015;
F[3][51] = 04;
F[3][52] = 017;
F[3][53] = 015;
F[3][54] = 03;
F[3][55] = 017;
F[3][56] = 013;
F[3][57] = 03;
F[3][58] = 013;
F[3][59] = 011;
F[3][60] = 00;
F[3][61] = 010;
F[3][62] = 01;
F[3][63] = 07;
F[3][64] = 03;
F[3][65] = 04;
F[3][66] = 04;
F[3][67] = 03;
F[3][68] = 03;
F[3][69] = 010;
F[3][70] = 016;
F[3][71] = 00;
F[3][72] = 01;
F[3][73] = 011;
F[3][74] = 015;
F[3][75] = 02;
F[3][76] = 013;
F[3][77] = 03;
F[3][78] = 07;
F[3][79] = 010;
F[3][80] = 010;
F[3][81] = 07;
F[3][82] = 014;
F[3][83] = 015;
F[3][84] = 013;
F[3][85] = 05;
F[3][86] = 00;
F[3][87] = 012;
F[3][88] = 012;
F[3][89] = 016;
F[3][90] = 07;
F[3][91] = 02;
F[3][92] = 017;
F[3][93] = 06;
F[3][94] = 017;
F[3][95] = 015;
F[3][96] = 013;
F[3][97] = 02;
F[3][98] = 03;
F[3][99] = 013;
F[3][100] = 01;
F[3][101] = 02;
F[3][102] = 017;
F[3][103] = 06;
F[3][104] = 04;
F[3][105] = 07;
F[3][106] = 04;
F[3][107] = 017;
F[3][108] = 03;
F[3][109] = 03;
F[3][110] = 02;
F[3][111] = 00;
F[3][112] = 05;
F[3][113] = 01;
F[3][114] = 00;
F[3][115] = 016;
F[3][116] = 014;
F[3][117] = 05;
F[3][118] = 02;
F[3][119] = 04;
F[3][120] = 07;
F[3][121] = 014;
F[3][122] = 07;
F[3][123] = 012;
F[3][124] = 05;
F[3][125] = 017;
F[3][126] = 011;
F[3][127] = 01;
F[3][128] = 06;
F[3][129] = 00;
F[3][130] = 015;
F[3][131] = 014;
F[3][132] = 017;
F[3][133] = 01;
F[3][134] = 00;
F[3][135] = 04;
F[3][136] = 00;
F[3][137] = 00;
F[3][138] = 011;
F[3][139] = 04;
F[3][140] = 013;
F[3][141] = 012;
F[3][142] = 03;
F[3][143] = 015;
F[3][144] = 01;
F[3][145] = 05;
F[3][146] = 04;
F[3][147] = 02;
F[3][148] = 011;
F[3][149] = 07;
F[3][150] = 00;
F[3][151] = 011;
F[3][152] = 015;
F[3][153] = 011;
F[3][154] = 00;
F[3][155] = 05;
F[3][156] = 07;
F[3][157] = 016;
F[3][158] = 017;
F[3][159] = 02;
F[3][160] = 05;
F[3][161] = 013;
F[3][162] = 06;
F[3][163] = 04;
F[3][164] = 06;
F[3][165] = 01;
F[3][166] = 013;
F[3][167] = 04;
F[3][168] = 06;
F[3][169] = 015;
F[3][170] = 010;
F[3][171] = 012;
F[3][172] = 03;
F[3][173] = 010;
F[3][174] = 017;
F[3][175] = 013;
F[3][176] = 011;
F[3][177] = 010;
F[3][178] = 07;
F[3][179] = 00;
F[3][180] = 014;
F[3][181] = 03;
F[3][182] = 05;
F[3][183] = 00;
F[3][184] = 013;
F[3][185] = 016;
F[3][186] = 013;
F[3][187] = 014;
F[3][188] = 01;
F[3][189] = 02;
F[3][190] = 016;
F[3][191] = 06;
F[3][192] = 012;
F[3][193] = 016;
F[3][194] = 014;
F[3][195] = 03;
F[3][196] = 04;
F[3][197] = 06;
F[3][198] = 00;
F[3][199] = 017;
F[3][200] = 00;
F[3][201] = 014;
F[3][202] = 05;
F[3][203] = 016;
F[3][204] = 01;
F[3][205] = 01;
F[3][206] = 04;
F[3][207] = 03;
F[3][208] = 01;
F[3][209] = 010;
F[3][210] = 00;
F[3][211] = 013;
F[3][212] = 010;
F[3][213] = 03;
F[3][214] = 015;
F[3][215] = 03;
F[3][216] = 07;
F[3][217] = 017;
F[3][218] = 014;
F[3][219] = 012;
F[3][220] = 06;
F[3][221] = 01;
F[3][222] = 01;
F[3][223] = 03;
F[3][224] = 00;
F[3][225] = 06;
F[3][226] = 012;
F[3][227] = 05;
F[3][228] = 05;
F[3][229] = 06;
F[3][230] = 07;
F[3][231] = 010;
F[3][232] = 017;
F[3][233] = 016;
F[3][234] = 01;
F[3][235] = 05;
F[3][236] = 00;
F[3][237] = 016;
F[3][238] = 00;
F[3][239] = 00;
F[3][240] = 014;
F[3][241] = 017;
F[3][242] = 010;
F[3][243] = 00;
F[3][244] = 06;
F[3][245] = 012;
F[3][246] = 011;
F[3][247] = 016;
F[3][248] = 017;
F[3][249] = 017;
F[3][250] = 03;
F[3][251] = 03;
F[3][252] = 014;
F[3][253] = 00;
F[3][254] = 015;
F[3][255] = 017;
/* PSEUDO-LINEAR (G0, G1) */
G[0][0] = 00;
G[0][1] = 00;
G[0][2] = 01;
G[0][3] = 01;
G[0][4] = 00;
G[0][5] = 01;
G[0][6] = 01;
G[0][7] = 00;
G[0][8] = 00;
G[0][9] = 01;
G[0][10] = 00;
G[0][11] = 00;
G[0][12] = 01;
G[0][13] = 01;
G[0][14] = 00;
G[0][15] = 01;
G[0][16] = 01;
G[0][17] = 00;
G[0][18] = 00;
G[0][19] = 01;
G[0][20] = 00;
G[0][21] = 00;
G[0][22] = 01;
G[0][23] = 01;
G[0][24] = 00;
G[0][25] = 01;
G[0][26] = 01;
G[0][27] = 00;
G[0][28] = 00;
G[0][29] = 01;
G[0][30] = 00;
G[0][31] = 00;
G[0][32] = 01;
G[0][33] = 01;
G[0][34] = 00;
G[0][35] = 01;
G[0][36] = 01;
G[0][37] = 00;
G[0][38] = 00;
G[0][39] = 01;
G[0][40] = 00;
G[0][41] = 00;
G[0][42] = 01;
G[0][43] = 01;
G[0][44] = 00;
G[0][45] = 01;
G[0][46] = 01;
G[0][47] = 00;
G[0][48] = 00;
G[0][49] = 01;
G[0][50] = 00;
G[0][51] = 00;
G[0][52] = 01;
G[0][53] = 01;
G[0][54] = 00;
G[0][55] = 01;
G[0][56] = 01;
G[0][57] = 00;
G[0][58] = 00;
G[0][59] = 01;
G[0][60] = 00;
G[0][61] = 00;
G[0][62] = 01;
G[0][63] = 01;
G[0][64] = 00;
G[0][65] = 01;
G[0][66] = 01;
G[0][67] = 00;
G[0][68] = 00;
G[0][69] = 01;
G[0][70] = 00;
G[0][71] = 00;
G[0][72] = 01;
G[0][73] = 01;
G[0][74] = 00;
G[0][75] = 01;
G[0][76] = 01;
G[0][77] = 00;
G[0][78] = 00;
G[0][79] = 01;
G[0][80] = 00;
G[0][81] = 00;
G[0][82] = 01;
G[0][83] = 01;
G[0][84] = 00;
G[0][85] = 01;
G[0][86] = 01;
G[0][87] = 00;
G[0][88] = 00;
G[0][89] = 01;
G[0][90] = 00;
G[0][91] = 00;
G[0][92] = 01;
G[0][93] = 01;
G[0][94] = 00;
G[0][95] = 01;
G[0][96] = 01;
G[0][97] = 00;
G[0][98] = 00;
G[0][99] = 01;
G[0][100] = 00;
G[0][101] = 00;
G[0][102] = 01;
G[0][103] = 01;
G[0][104] = 00;
G[0][105] = 01;
G[0][106] = 01;
G[0][107] = 00;
G[0][108] = 00;
G[0][109] = 01;
G[0][110] = 00;
G[0][111] = 00;
G[0][112] = 01;
G[0][113] = 01;
G[0][114] = 00;
G[0][115] = 01;
G[0][116] = 01;
G[0][117] = 00;
G[0][118] = 00;
G[0][119] = 01;
G[0][120] = 00;
G[0][121] = 00;
G[0][122] = 01;
G[0][123] = 01;
G[0][124] = 00;
G[0][125] = 01;
G[0][126] = 01;
G[0][127] = 00;
G[0][128] = 00;
G[0][129] = 01;
G[0][130] = 00;
G[0][131] = 00;
G[0][132] = 01;
G[0][133] = 01;
G[0][134] = 00;
G[0][135] = 01;
G[0][136] = 01;
G[0][137] = 00;
G[0][138] = 00;
G[0][139] = 01;
G[0][140] = 00;
G[0][141] = 00;
G[0][142] = 01;
G[0][143] = 01;
G[0][144] = 00;
G[0][145] = 01;
G[0][146] = 01;
G[0][147] = 00;
G[0][148] = 00;
G[0][149] = 01;
G[0][150] = 00;
G[0][151] = 00;
G[0][152] = 01;
G[0][153] = 01;
G[0][154] = 00;
G[0][155] = 01;
G[0][156] = 01;
G[0][157] = 00;
G[0][158] = 00;
G[0][159] = 01;
G[0][160] = 00;
G[0][161] = 00;
G[0][162] = 01;
G[0][163] = 01;
G[0][164] = 00;
G[0][165] = 01;
G[0][166] = 01;
G[0][167] = 00;
G[0][168] = 00;
G[0][169] = 01;
G[0][170] = 00;
G[0][171] = 00;
G[0][172] = 01;
G[0][173] = 01;
G[0][174] = 00;
G[0][175] = 01;
G[0][176] = 01;
G[0][177] = 00;
G[0][178] = 00;
G[0][179] = 01;
G[0][180] = 00;
G[0][181] = 00;
G[0][182] = 01;
G[0][183] = 01;
G[0][184] = 00;
G[0][185] = 01;
G[0][186] = 01;
G[0][187] = 00;
G[0][188] = 00;
G[0][189] = 01;
G[0][190] = 00;
G[0][191] = 00;
G[0][192] = 01;
G[0][193] = 01;
G[0][194] = 00;
G[0][195] = 01;
G[0][196] = 01;
G[0][197] = 00;
G[0][198] = 00;
G[0][199] = 01;
G[0][200] = 00;
G[0][201] = 00;
G[0][202] = 01;
G[0][203] = 01;
G[0][204] = 00;
G[0][205] = 01;
G[0][206] = 01;
G[0][207] = 00;
G[0][208] = 00;
G[0][209] = 01;
G[0][210] = 00;
G[0][211] = 00;
G[0][212] = 01;
G[0][213] = 01;
G[0][214] = 00;
G[0][215] = 01;
G[0][216] = 01;
G[0][217] = 00;
G[0][218] = 00;
G[0][219] = 01;
G[0][220] = 00;
G[0][221] = 00;
G[0][222] = 01;
G[0][223] = 01;
G[0][224] = 00;
G[0][225] = 01;
G[0][226] = 01;
G[0][227] = 00;
G[0][228] = 00;
G[0][229] = 01;
G[0][230] = 00;
G[0][231] = 00;
G[0][232] = 01;
G[0][233] = 01;
G[0][234] = 00;
G[0][235] = 01;
G[0][236] = 01;
G[0][237] = 00;
G[0][238] = 00;
G[0][239] = 01;
G[0][240] = 00;
G[0][241] = 00;
G[0][242] = 01;
G[0][243] = 01;
G[0][244] = 00;
G[0][245] = 01;
G[0][246] = 01;
G[0][247] = 00;
G[0][248] = 00;
G[0][249] = 01;
G[0][250] = 00;
G[0][251] = 00;
G[0][252] = 01;
G[0][253] = 01;
G[0][254] = 00;
G[0][255] = 01;
G[1][0] = 00;
G[1][1] = 01;
G[1][2] = 01;
G[1][3] = 00;
G[1][4] = 01;
G[1][5] = 00;
G[1][6] = 00;
G[1][7] = 01;
G[1][8] = 00;
G[1][9] = 01;
G[1][10] = 01;
G[1][11] = 00;
G[1][12] = 01;
G[1][13] = 00;
G[1][14] = 00;
G[1][15] = 01;
G[1][16] = 01;
G[1][17] = 00;
G[1][18] = 00;
G[1][19] = 01;
G[1][20] = 00;
G[1][21] = 01;
G[1][22] = 01;
G[1][23] = 00;
G[1][24] = 01;
G[1][25] = 00;
G[1][26] = 00;
G[1][27] = 01;
G[1][28] = 00;
G[1][29] = 01;
G[1][30] = 01;
G[1][31] = 00;
G[1][32] = 00;
G[1][33] = 01;
G[1][34] = 01;
G[1][35] = 00;
G[1][36] = 01;
G[1][37] = 00;
G[1][38] = 00;
G[1][39] = 01;
G[1][40] = 00;
G[1][41] = 01;
G[1][42] = 01;
G[1][43] = 00;
G[1][44] = 01;
G[1][45] = 00;
G[1][46] = 00;
G[1][47] = 01;
G[1][48] = 01;
G[1][49] = 00;
G[1][50] = 00;
G[1][51] = 01;
G[1][52] = 00;
G[1][53] = 01;
G[1][54] = 01;
G[1][55] = 00;
G[1][56] = 01;
G[1][57] = 00;
G[1][58] = 00;
G[1][59] = 01;
G[1][60] = 00;
G[1][61] = 01;
G[1][62] = 01;
G[1][63] = 00;
G[1][64] = 00;
G[1][65] = 01;
G[1][66] = 01;
G[1][67] = 00;
G[1][68] = 01;
G[1][69] = 00;
G[1][70] = 00;
G[1][71] = 01;
G[1][72] = 00;
G[1][73] = 01;
G[1][74] = 01;
G[1][75] = 00;
G[1][76] = 01;
G[1][77] = 00;
G[1][78] = 00;
G[1][79] = 01;
G[1][80] = 01;
G[1][81] = 00;
G[1][82] = 00;
G[1][83] = 01;
G[1][84] = 00;
G[1][85] = 01;
G[1][86] = 01;
G[1][87] = 00;
G[1][88] = 01;
G[1][89] = 00;
G[1][90] = 00;
G[1][91] = 01;
G[1][92] = 00;
G[1][93] = 01;
G[1][94] = 01;
G[1][95] = 00;
G[1][96] = 00;
G[1][97] = 01;
G[1][98] = 01;
G[1][99] = 00;
G[1][100] = 01;
G[1][101] = 00;
G[1][102] = 00;
G[1][103] = 01;
G[1][104] = 00;
G[1][105] = 01;
G[1][106] = 01;
G[1][107] = 00;
G[1][108] = 01;
G[1][109] = 00;
G[1][110] = 00;
G[1][111] = 01;
G[1][112] = 01;
G[1][113] = 00;
G[1][114] = 00;
G[1][115] = 01;
G[1][116] = 00;
G[1][117] = 01;
G[1][118] = 01;
G[1][119] = 00;
G[1][120] = 01;
G[1][121] = 00;
G[1][122] = 00;
G[1][123] = 01;
G[1][124] = 00;
G[1][125] = 01;
G[1][126] = 01;
G[1][127] = 00;
G[1][128] = 00;
G[1][129] = 01;
G[1][130] = 01;
G[1][131] = 00;
G[1][132] = 01;
G[1][133] = 00;
G[1][134] = 00;
G[1][135] = 01;
G[1][136] = 00;
G[1][137] = 01;
G[1][138] = 01;
G[1][139] = 00;
G[1][140] = 01;
G[1][141] = 00;
G[1][142] = 00;
G[1][143] = 01;
G[1][144] = 01;
G[1][145] = 00;
G[1][146] = 00;
G[1][147] = 01;
G[1][148] = 00;
G[1][149] = 01;
G[1][150] = 01;
G[1][151] = 00;
G[1][152] = 01;
G[1][153] = 00;
G[1][154] = 00;
G[1][155] = 01;
G[1][156] = 00;
G[1][157] = 01;
G[1][158] = 01;
G[1][159] = 00;
G[1][160] = 00;
G[1][161] = 01;
G[1][162] = 01;
G[1][163] = 00;
G[1][164] = 01;
G[1][165] = 00;
G[1][166] = 00;
G[1][167] = 01;
G[1][168] = 00;
G[1][169] = 01;
G[1][170] = 01;
G[1][171] = 00;
G[1][172] = 01;
G[1][173] = 00;
G[1][174] = 00;
G[1][175] = 01;
G[1][176] = 01;
G[1][177] = 00;
G[1][178] = 00;
G[1][179] = 01;
G[1][180] = 00;
G[1][181] = 01;
G[1][182] = 01;
G[1][183] = 00;
G[1][184] = 01;
G[1][185] = 00;
G[1][186] = 00;
G[1][187] = 01;
G[1][188] = 00;
G[1][189] = 01;
G[1][190] = 01;
G[1][191] = 00;
G[1][192] = 00;
G[1][193] = 01;
G[1][194] = 01;
G[1][195] = 00;
G[1][196] = 01;
G[1][197] = 00;
G[1][198] = 00;
G[1][199] = 01;
G[1][200] = 00;
G[1][201] = 01;
G[1][202] = 01;
G[1][203] = 00;
G[1][204] = 01;
G[1][205] = 00;
G[1][206] = 00;
G[1][207] = 01;
G[1][208] = 01;
G[1][209] = 00;
G[1][210] = 00;
G[1][211] = 01;
G[1][212] = 00;
G[1][213] = 01;
G[1][214] = 01;
G[1][215] = 00;
G[1][216] = 01;
G[1][217] = 00;
G[1][218] = 00;
G[1][219] = 01;
G[1][220] = 00;
G[1][221] = 01;
G[1][222] = 01;
G[1][223] = 00;
G[1][224] = 00;
G[1][225] = 01;
G[1][226] = 01;
G[1][227] = 00;
G[1][228] = 01;
G[1][229] = 00;
G[1][230] = 00;
G[1][231] = 01;
G[1][232] = 00;
G[1][233] = 01;
G[1][234] = 01;
G[1][235] = 00;
G[1][236] = 01;
G[1][237] = 00;
G[1][238] = 00;
G[1][239] = 01;
G[1][240] = 01;
G[1][241] = 00;
G[1][242] = 00;
G[1][243] = 01;
G[1][244] = 00;
G[1][245] = 01;
G[1][246] = 01;
G[1][247] = 00;
G[1][248] = 01;
G[1][249] = 00;
G[1][250] = 00;
G[1][251] = 01;
G[1][252] = 00;
G[1][253] = 01;
G[1][254] = 01;
G[1][255] = 00;
}
static u_char f(int table, int value)
{
if ((table<0) || (table>3) || (value<0) || (value>255)) {
fprintf(stderr,"\n\nF TABLE EXCEPTION %x %x\n\n",table,value);
exit(1001);
}
return F[table][value];
}
static u_char g(int table, int value)
{
if ((table<0) || (table>2) || (value<0) || (value>255)) {
fprintf(stderr,"\n\nG TABLE EXCEPTION %x %x\n\n",table,value);
exit(1001);
}
return G[table][value];
}
/* TOP SECRET */
/* See label file for codeword restrictions */
Falstaff
What's this S-1 cipher algorithm?? The frequent use of the word
'chip' might indicate that it has something to do with clipper???
Or is it a hoax?
Frank
Paul Rubin
>
>What's this S-1 cipher algorithm?? The frequent use of the word
>'chip' might indicate that it has something to do with clipper???
>Or is it a hoax?
If it is a hoax, it is a pretty convincing one.
If it is real, the shit is probably about to hit the fan.
Either way, it is sure to give cryptographers something
to think about...
Colin Plumb
The fact that this cipher is clearly designed for software
implementation and avoids some seemingly obvious diffusion
possibilities makes me suspect that it is not Skipjack.
/*
* This is an overview of the round transformation, repeated 32 times.
*
* Each double line represents 8 bits, and each single line represents 4 bits,
* except for the lines out of the G0 and G1 boxes, which are 1 bit each
* and are combined (the G1 bit is the most significant) to choose the
* base F value. The other 4 F boxes are taken as offsets from the
* base F value, modulo 4.
*
* Each of the function boxes takes an 8-bit input and an 8-bit key
* (Indicated above the box) and maps the 8-bit XOR of the two to a
* smaller range - 1 bit for the G function and 4 bits for the F function.
* The keys K0 through K5 vary in each round.
*
* Note how the "high" and "low" halves of each byte are indicated, and
* how the position in which each 4-bit F-function output is XORed into
* a byte is indicated.
*
* 0 1 2 3 4 5 6 7
* HL HL HL HL HL HL HL HL
* || || || || K0 || K1 || || ||
* || || || ||/--\ ||/--\ || || ||
* || || || |||G0|<=++|G1|<=++ || ||
* || || || ||\--/ ||\--/ || || ||
* || || || || | || | || || ||
* || || || || | || | || || ||
* || || || || /-------/ || || ||
* || || || || || || || || ||
* || || || || \/ || || || ||
* || || || || F || || || ||
* || || || || || || || ||
* || || || || K2 || || || ||
* || || || ||/---\ || || |v ||
* || || ++=======>|F+0|----------------->* ||
* || || || ||\---/ || || || ||
* || || || || ||/---\ || v| ||
* || || || ++=======>|F+1|-------->*| ||
* || || || || ||\---/ || || ||
* || || K4 || || || K3 || || ||
* || ||/---\ || || || || || |v
* ++=======>|F+2|----------------------------------------->*
* || ||\---/ || || || || || ||
* || || ||/---\ || || || || v|
* || ++=======>|F+3|-------------------------------->*|
* || || ||\---/ || || || || ||
* || || || K5 || || || || ||
* || || || || || || || ||
* \\ \\ // // // // // //
* \\ \\ // // // // // //
* \\ \\ // // // // // //
* \\ \// // // // // //
* \\ //\ // // // // //
* \\ // \\ // // // // //
* \\ // \================================\ //
* \// // // // // \//
* //\ // // // // //\
* // \\ // // // // // \\
* // \================================\ // \\
* // // // // // \// \\
* // // // // // //\ \\
* // // // // // // \\ \\
* // // // // // // \\ \\
* // // // // // // \\ \\
* || || || || || || || ||
* HL HL HL HL HL HL HL HL
* 0 1 2 3 4 5 6 7
*
* Note that the bytes that were just operated on (6 and 7) are the
* inputs to the G functions next round, choosing the permutation of
* the F functions for the next round.
*/
Due to the nature of the G1 function, only 4 bits of byte 5 (and K1)
matter to the output of G1 and thus the selection of the F box.
That seems odd. Also, the fact that each F box only affects 1 byte
instead of 2 is unusual, only affecting the input of 1 of the F boxes
on the following rounds. And the F+3 box hardly affects G1 at all -
only one bit of output matters.
Matt Blaze has done some analysis of the F boxes, and found that they
are quite skewed. The output distributions are quite non-flat.
Even the individual bit distributions aren't flat. This leads,
through the key scheduling algorithm, to non-flat distributions on
the inner working keys. This seems very Bad.
I wonder what else people will find.
--
-Colin
Colin Plumb
> /* S-1 CIPHER ALGORITHM software chip simulator */
H'm! Very intriguing. Thank you. I'll have to have a look at this.
In the meantime, I noticed a bug in the code:
> static u_char fullkey[KEY_REGISTERS+1][32][6]; /* SOFTWARE ONLY */
...
There's clearly a bug in that code. fullkey[key_register][r] is out of
bounds for the array, since r goes from 0 to 62 in steps of 2, while
fullkey is declared with 32 elements in that dimension. The fix is
obvious - replace [r] with [i] in this and in the decryption function -
but it makes the provenance of the code even more obscure.
Oh, for anyone who's interested, here are the F- and G-boxes in a
more compact form:
/* F boxes (These differ in S-2) */
static unsigned char const F[4][256] = {
{ 7, 2, 9, 12, 8, 14, 1, 6, 13, 2, 0, 4, 15, 7, 3, 15,
8, 15, 10, 5, 11, 0, 15, 2, 5, 13, 15, 15, 9, 9, 6, 12,
7, 15, 10, 14, 10, 6, 4, 4, 12, 4, 15, 11, 3, 12, 12, 6,
6, 0, 2, 8, 10, 10, 3, 13, 11, 12, 15, 5, 5, 0, 7, 12,
14, 9, 3, 9, 8, 12, 10, 12, 15, 5, 7, 5, 7, 14, 3, 2,
9, 12, 4, 0, 8, 14, 2, 3, 2, 14, 11, 4, 8, 1, 6, 11,
14, 8, 15, 12, 0, 2, 0, 1, 1, 11, 14, 0, 2, 11, 15, 11,
14, 14, 2, 5, 2, 0, 14, 1, 8, 11, 9, 6, 1, 5, 7, 7,
14, 12, 10, 9, 9, 14, 7, 12, 9, 13, 10, 0, 8, 0, 7, 10,
13, 11, 0, 10, 4, 15, 5, 0, 13, 2, 14, 3, 3, 11, 6, 9,
12, 3, 15, 12, 0, 11, 6, 15, 8, 13, 1, 10, 5, 8, 6, 7,
6, 3, 15, 6, 13, 13, 1, 11, 4, 10, 3, 0, 6, 9, 9, 13,
10, 15, 14, 1, 13, 14, 15, 4, 13, 6, 7, 4, 0, 15, 14, 15,
8, 2, 4, 10, 1, 2, 9, 7, 8, 8, 2, 2, 7, 8, 8, 11,
3, 14, 15, 9, 6, 9, 0, 15, 12, 6, 4, 2, 3, 0, 9, 11,
12, 5, 3, 14, 11, 15, 4, 5, 15, 9, 3, 6, 8, 11, 12, 6 },
{ 15, 6, 14, 13, 10, 7, 7, 3, 3, 1, 15, 0, 11, 7, 2, 8,
1, 12, 10, 1, 7, 3, 1, 14, 12, 9, 0, 1, 6, 2, 9, 11,
12, 9, 7, 10, 3, 3, 8, 0, 0, 10, 4, 0, 2, 15, 13, 11,
2, 15, 5, 4, 3, 11, 15, 3, 9, 10, 1, 9, 7, 9, 9, 8,
1, 5, 2, 3, 8, 15, 7, 10, 13, 9, 8, 15, 3, 14, 3, 13,
9, 11, 5, 7, 15, 10, 10, 7, 15, 5, 7, 0, 4, 4, 4, 6,
9, 4, 7, 8, 8, 13, 15, 0, 10, 2, 1, 14, 0, 5, 3, 9,
5, 12, 9, 0, 9, 0, 11, 8, 14, 12, 4, 3, 13, 14, 2, 3,
10, 6, 15, 0, 9, 9, 2, 15, 11, 4, 7, 2, 2, 12, 4, 7,
12, 1, 0, 3, 1, 8, 1, 7, 10, 0, 13, 4, 0, 15, 4, 0,
15, 12, 4, 7, 11, 9, 10, 15, 15, 3, 7, 0, 4, 7, 7, 3,
5, 6, 15, 3, 15, 2, 4, 15, 0, 12, 15, 4, 5, 14, 13, 4,
10, 11, 0, 4, 15, 7, 11, 4, 8, 5, 7, 4, 11, 5, 14, 8,
13, 0, 4, 4, 15, 8, 5, 13, 9, 1, 10, 11, 13, 3, 8, 5,
7, 6, 0, 2, 9, 6, 0, 15, 1, 8, 3, 6, 5, 8, 8, 10,
12, 2, 2, 2, 8, 4, 11, 7, 14, 13, 5, 15, 5, 3, 8, 8 },
{ 11, 9, 15, 7, 1, 10, 0, 9, 6, 8, 10, 12, 0, 10, 1, 10,
9, 12, 5, 5, 7, 4, 11, 13, 4, 0, 1, 8, 15, 2, 13, 10,
6, 0, 7, 15, 12, 11, 9, 3, 7, 11, 6, 5, 9, 8, 0, 2,
7, 9, 14, 1, 10, 12, 10, 6, 9, 14, 13, 6, 7, 5, 12, 7,
1, 6, 10, 6, 5, 4, 3, 9, 4, 12, 11, 0, 8, 14, 3, 6,
0, 15, 2, 8, 8, 10, 10, 15, 7, 3, 10, 10, 11, 12, 11, 3,
9, 10, 6, 2, 2, 2, 9, 4, 6, 8, 5, 1, 14, 7, 15, 0,
11, 10, 14, 7, 14, 1, 4, 13, 7, 12, 0, 4, 6, 14, 9, 12,
6, 9, 10, 2, 10, 14, 11, 0, 0, 3, 3, 13, 7, 10, 0, 10,
15, 9, 5, 5, 8, 4, 4, 5, 12, 10, 9, 13, 13, 11, 15, 12,
9, 7, 11, 1, 0, 13, 9, 5, 13, 14, 10, 15, 1, 13, 7, 10,
8, 15, 7, 4, 9, 11, 1, 8, 6, 3, 8, 2, 5, 8, 9, 2,
4, 15, 10, 6, 5, 5, 13, 10, 0, 3, 4, 13, 14, 13, 13, 9,
3, 5, 11, 14, 2, 15, 11, 0, 3, 10, 2, 7, 3, 8, 9, 1,
6, 2, 12, 1, 10, 8, 2, 10, 11, 15, 11, 12, 5, 2, 2, 11,
9, 11, 2, 5, 12, 15, 6, 13, 1, 9, 10, 0, 11, 5, 3, 13 },
{ 11, 7, 4, 1, 3, 15, 7, 5, 12, 2, 5, 14, 11, 4, 11, 1,
13, 13, 12, 13, 1, 8, 4, 2, 7, 13, 14, 14, 1, 3, 9, 9,
8, 15, 6, 4, 11, 8, 12, 11, 3, 8, 13, 7, 7, 0, 5, 1,
3, 11, 13, 4, 15, 13, 3, 15, 11, 3, 11, 9, 0, 8, 1, 7,
3, 4, 4, 3, 3, 8, 14, 0, 1, 9, 13, 2, 11, 3, 7, 8,
8, 7, 12, 13, 11, 5, 0, 10, 10, 14, 7, 2, 15, 6, 15, 13,
11, 2, 3, 11, 1, 2, 15, 6, 4, 7, 4, 15, 3, 3, 2, 0,
5, 1, 0, 14, 12, 5, 2, 4, 7, 12, 7, 10, 5, 15, 9, 1,
6, 0, 13, 12, 15, 1, 0, 4, 0, 0, 9, 4, 11, 10, 3, 13,
1, 5, 4, 2, 9, 7, 0, 9, 13, 9, 0, 5, 7, 14, 15, 2,
5, 11, 6, 4, 6, 1, 11, 4, 6, 13, 8, 10, 3, 8, 15, 11,
9, 8, 7, 0, 12, 3, 5, 0, 11, 14, 11, 12, 1, 2, 14, 6,
10, 14, 12, 3, 4, 6, 0, 15, 0, 12, 5, 14, 1, 1, 4, 3,
1, 8, 0, 11, 8, 3, 13, 3, 7, 15, 12, 10, 6, 1, 1, 3,
0, 6, 10, 5, 5, 6, 7, 8, 15, 14, 1, 5, 0, 14, 0, 0,
12, 15, 8, 0, 6, 10, 9, 14, 15, 15, 3, 3, 12, 0, 13, 15 }
};
/* These are the F-box-selection tables, and are somewhat linear. */
static unsigned char const G[2][256] = {
{ 0, 0, 1, 1, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 1,
1, 0, 0, 1, 0, 0, 1, 1, 0, 1, 1, 0, 0, 1, 0, 0,
1, 1, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 1, 1, 0,
0, 1, 0, 0, 1, 1, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1,
0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 1, 1, 0, 0, 1,
0, 0, 1, 1, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 1,
1, 0, 0, 1, 0, 0, 1, 1, 0, 1, 1, 0, 0, 1, 0, 0,
1, 1, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 1, 1, 0,
0, 1, 0, 0, 1, 1, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1,
0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 1, 1, 0, 0, 1,
0, 0, 1, 1, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 1,
1, 0, 0, 1, 0, 0, 1, 1, 0, 1, 1, 0, 0, 1, 0, 0,
1, 1, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 1, 1, 0,
0, 1, 0, 0, 1, 1, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1,
0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 1, 1, 0, 0, 1,
0, 0, 1, 1, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 1 },
{ 0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1,
1, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0,
0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1,
1, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0,
0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1,
1, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0,
0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1,
1, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0,
0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1,
1, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0,
0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1,
1, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0,
0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1,
1, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0,
0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1,
1, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0 }
};
G[0][i] repeats with a cycle of 10 bits, in the pattern 0011011001.
This pattern is, itself, produced by (i%5 >> 1) ^ (i / 5).
G[1][i] is the sum of the bits in (i & 0x17).
I haven't done any analysis on the F boxes yet.
--
-Colin
Thomas Jakobsen (TH)
The source posted describes a 32 round block cipher with 64 bit width and
80 bit full key. This matches the description of Skipjack more or less.
However:
There are some oddities about the source code:
a) The expression fullkey[.][r][.] in the encryption (and decryption)
function in invalid when i>=16, because r=2*i, and the definition of
fullkey is: fullkey[.][32][.].
b) A detail perhaps, but the exception routine for g doesn't catch table=2,
which it should. This is not a fatal bug.
c) The keys will repeat after 5 rounds (see rotatekey(); 6*5 mod 10 = 0).
d) The clear_family[] and the cipher_family[] does not enhance security,
unless, of course, they are unknown.
Ad a), the correct version of the expression is probably fullkey[.][i][.].
I don't think the source posted will work properly - this is a bit curious,
as it states that it has a history of at least 2 1/2 years. But then again,
bugs can be introduced at any time...
Ad c), this is probably intentional, but I wouldn't be surprised if it weakened
the cipher - be it intentionally or not. However, I haven't looked enough into
this to be able to support it.
I might try to have a look at the claimed non-linearity of the F array. I have
no clue as to why G is only "pseudo-linear" (suggestions?).
If you examine the first eight G[0] values, you will notice that they are
(pairwise) (0,0), (1,1), (0,1), (1,0). These four possible pairs also pop
up in the next eight G values and so on. For G[1] the first *four* values are
(pairwise) (0,1) (1,0). These two pairs are used in the next four values as
well etc.
Other findings?
Thomas Jakobsen
Phillip M. Hallam-Baker
>For the interested, here's a picture of the cipher's operation.
>The fact that this cipher is clearly designed for software
>implementation and avoids some seemingly obvious diffusion
>possibilities makes me suspect that it is not Skipjack.
Clearly the code is intended to look like skipjack, the source looks to me as if
it has been synthesized. It is clearly the output of some sort of silicon
compiler. Look at the use of while () to construct the for loops. Also consider
the bizare choice of octal for the constant table. The provision of a self test
routine gives added versimillitude.
Another explanation is that this is the result of translating ADA into C. Such a
system might give the same properties. That would make less sense however.
I discount the bias towards software implementation as being significant. I would
expect all ciphers to be designed to be easy to implement in software these days
since a large part of the design work would require software tuning. Pople don't
design in hardware. Eight bits is the most convenient unit for dealing with
software, its also quite handy to use when building hardware.
One of the hypothetical designs I drew up for clipper was a DSP type design with
a microcode controller. This would allow large parts of the internal design of
the chip to be effectively concealled by incorporating them in ROMs constructed
so as to self destruct on the chip being tampered with. Thus the hardware device
could easilly be simply a software analogue. If one takes the design date (1989)
as being significant consider that 6502 was avaliable in standard cell at that
time and might have made a suitable (if limited) alternative base.
Don't beleive the distinction between hardware and software genuinely exists
anymore. Clipper is hardware for reasons of the key escrow scheme, nothing more.
It was an off the shelf cipher developed in advance for general purpose use.
There is no reason to beleive that the NSA don't build all their ciphers to be
software friendly. In addition the chip may be the output of a silicon compiler
or DSP compiler with the simulation a secondary output. Those techniques are the
only logical ones for the NSA to use to build chips. They would allow a small
group of cryptographers to design the chip without VLSI engineers knowing
anything about the project. It would also allow for rapid prototypes (DSP
system).
Developing a cipher means having to prove that the diffusion properties do in
fact exist. Adding ad-hoc mumbo jumbo diffusers because "they are free" may well
mess up the proofs. I would expect an NSA implementation to avoid any operation
that did not have a known cryptographic affect. Ciphers tend to be broken by
brute force rather than sophistication, expect them to be built using brute force
(extra rounds) in preference to sophistication. I'm not sure how much an extra
bit of diffusion buys you. After three rounds we have the diffusion affect. With
an extra multiplex you would get it in two. Thats out of eight rounds however. I
would prefer an extra round to a twist in the data path which is NOT free, it
takes space and requires vias to be fabricated. They can be unreliable, lower
yield. Plus the equations get harder.
The hoaxer is more likely to lard the design with every ornament possible than to
choose spartan elegance.
Another line to consider is whether the code was *intended* to actually work. In
a compartmentalised project the exact settings of the f and g arrays might well
be kept secret from the VLSI layout engineers. I would expect them to be
downloaded after fabrication. So the "S1" code might simply be an internal
release with a known to be defective set of constants that was good enough for
some purpose or other.
Note that the code refers to multiple chipsets. Some with key generation
"functional". What other sort would one build? I would build special purpose
hardware for cracking as well. This would not be usefull for encoding or decoding
but simply speed up fast automated searches. Again there might well be multiple
chipsets with different parameters loaded.
What is interesting is the apparent elegance of the design. There is a good
reason for the structural mechanism, it is balanced. What is surprising however
is that a more agressive diffusion in the link between steps. Essentially the
diffusion is simply a rotation. This seems more than odd, it means that the
rotation is effectively unnecessary, the proceedures could be specified as
operations on indicies instead. Again why not write the software implementation
in that manner?
What it does do is guarantee that every bit of the input affects every bit of the
output. This is very rapid (2*4 rounds). There are three levels of granularity,
the bit, the octet and the double octet. In the first set of 4 rounds every 16
bit block influences every 16 bit block. Every bit in the third sixteen bit block
affects every bit in the operated on block. Thus after these changes are picked
up in the next round every bit affects every bit.
There are no asymmetries in the scheme, unlike DES. There is no hook for a key
complementation property. Ther is no gratuitous confusion likely to induce
errors. Possibly the most convincing part of the scheme is that it is so
ordinary. The strength comes from the large number of rounds not gratuitous bus
mangling.
It would be very easy to present us with somethin very difficult to analyse.
It is a clean version of DES with larger S boxes, whoever built it could
certainly propose a very credible cipher. There is good reason to consider the f
and g registers suspect. I would expect a hoaxer to be able to produce provide
random data however.
Ultimately this is the Hitler Diaries problem. It is safest to dismiss the idea
as a hoax since it is very unlikely it will be proven to be genuine. Even if the
NSA stated it was real it would still be impossible to take seriously because it
could easilly be a provocation. Maybe the NSA has some really clever stuff that
breaks Feistel networks and would like to see more of them in use. Even when
someone nitrates their clipper chip I don't expect the matter will be settled. OK
the structure may match but the constants are the tricky part and we don't trust
the ones donnated.
Even if the datapaths happened to match I would still have severe difficulties
accepting the validity of S1, Clipper probably has more than one cipher
implemented, I would add bogus circuitry to distract the unwary. Either that or
give the poor schmoo a bog standard DSP with only a bit of ROM storage whose
contents don't survive the top slicing to look at. If they had "NSA for those who
fnoord the very best" it would be style.
Clearly the cipher is not ready for use, the code is broken for one thing. A
hoaxer would have been well advised to put the disclaimer about being incomplete
into the thing. Nevertheless I do not think the arguments against its being
genuine make their case either. I think that it is the product of someone with
considerable VLSI and cryptographic knowledge. More than a casual reading of
Meade and Conway followed by Schneier.
I don't think it unlikely that an NSA mole may have leaked the code, the
political situation makes that a very likely possibility. If so that would be the
most serious outcome of the Clipper affair. A leak in the cryptographic or
cryptanalytic departments is the most serious event. It would be a very clear and
very serious breach of national security. I am not aware of a similar incident.
One question, what of the method of distribution? If only the annonymous poster
got a copy that counts against it. If Rivest, Schneier, Diffie et al also have
copies then it might be more convincing, perhaps not. I would like to see the
packaging however. If the NSA raid the third floor of LCS tommorow for the
packaging then its probably genuine.
Thanks to Clipper we now have the analogue of the perpetual motion machine
problem of physics. Proving something is not the Clipper chip algorithm.
--
Phillip M. Hallam-Baker Not speaking for anoyone else
hal...@w3.org http://www.w3.org/hypertext/WWW/People/hallam.html
Information Superhighway -----> Hi-ho! Yow! I'm surfing Arpanet!
Joshua Goodall
hal...@w3.org ("Phillip M. Hallam-Baker") wrote:
> co...@nyx10.cs.du.edu (Colin Plumb) wrote:
> >For the interested, here's a picture of the cipher's operation.
> >The fact that this cipher is clearly designed for software
> >implementation and avoids some seemingly obvious diffusion
> >possibilities makes me suspect that it is not Skipjack.
I was on holiday for the original post. Could someone email it to me/
repost please?
--
Joshua Goodall
TECHNIQUEST Exhibit Developer
jo...@tquest.demon.co.uk PGP key: mailto:p...@tquest.demon.co.uk
Phillip M. Hallam-Baker
>
> Isn't it possible to check whether this is "clipper" just by
> comparing it with real thing ? I understand "Clipper" cards are
> available for developers ?
No, the code claims to be an early version of "S1" and mentions another
verision "S2". Plus the constant tables look like they might be deliberately
weakened (testing?).
Of course this increases the grounds for scepticism considerably but then again
if someone proved that it was the clipper algorithm by showing the same outputs
there would be little more discussion.
Another consideration, maybe the NSA sent the disk out themselves to throw
people off the track.
Mark S. Feldman
mkag...@lynx.dac.neu.edu (Michael Kagalenko) writes:
> Isn't it possible to check whether this is "clipper" just by
> comparing it with real thing ? I understand "Clipper" cards are
> available for developers ?
It's not that easy. At least not for a user/developer with a FORTEZZA
card (PCMCIA card with Skipjack, KEA, SHA, DSA). There is no
documented way for an end user to extract a Skipjack encryption key
from or insert a Skipjack encryption key into a FORTEZZA card in the
clear. The card generates encryption keys using its own internal
random number generator and only sends them out after they've been
wrapped using the FORTEZZA key exchange algorithm (KEA) for the
intended recipient(s).
The result of all this is that you must do a brute force key search
using the "s-1" algorithm on a message encrypted with a FORTEZZA card
to see if they're the same. With 80-bit keys, that will take a while.
And the algorithms must be exactly the same. If "s-1" differs from
Skipjack in as much as one table entry, this method will fail. Other
options are to find a way to directly access (see or set) the
encryption key on the card or to find a way to unrwap a KEA-wrapped
encryption key outside of the card.
Mark
Colin James III (The Rt Rev'd)
| In article <40b8tk$c...@news.xs4all.nl>, Falstaff <fals...@xs4all.nl> wrote:
| >
| >What's this S-1 cipher algorithm?? The frequent use of the word
| >'chip' might indicate that it has something to do with clipper???
| >Or is it a hoax?
|
| If it is a hoax, it is a pretty convincing one.
| If it is real, the shit is probably about to hit the fan.
| Either way, it is sure to give cryptographers something
| to think about...
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Colin James III, Principal Scientist cja...@cec-services.com
CEC Services, 2080 Kipling St, Lakewood, CO 80215-1502 USA
Voice: 303.231.9437; Facsimile: .231.9438; Data: .231.9434
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~