/**
 * qarma128_14.h
 *
 * @version 1.0 (March 2019)
 *
 * Reference ANSI C code for the Qarma tweakable block cipher
 *
 * @author Roberto Avanzi <roberto.avanzi@gmail.com>, <roberto.avanzi@arm.com>
 * @author Subhadeep Banik <subhadeep.banik@epfl.ch>
 * @author Francesco Regazzoni <regazzoni@alari.ch>
 *
 * This code is hereby placed in the public domain.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ''AS IS'' AND ANY EXPRESS
 * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.	IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE
 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
 * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
 * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
 * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
 * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#include <string.h>

#define ROTATION_A	1
#define ROTATION_B	4
#define ROTATION_C	5

#define ROTATION_A_INV	1
#define ROTATION_B_INV	4
#define ROTATION_C_INV	5

#define ROTATION_A_MID	1
#define ROTATION_B_MID	4
#define ROTATION_C_MID	5

typedef unsigned char cell_t;
typedef unsigned char u8;
typedef unsigned long long u64;

// In the internal state matrix the data is stored as follows
//
//	0  1  2	 3
//	4  5  6	 7
//	8  9 10 11
// 12 13 14 15

// Definition of the 4-bit Sbox upon which the 8-bit ones are built

const cell_t sbox_4[16] =  { 10, 13, 14, 6, 15, 7, 3, 5, 9, 8, 0, 12, 11, 1, 2, 4 };
const cell_t *sbox_4_inv = sbox_4;

// ShuffleCells permutation (we use the INVERSE MIDORI permutation)

const int SHUFFLE_P[16]		= {0,11, 6,13,	10, 1,12, 7,   5,14, 3, 8,	15, 4, 9, 2};
const int SHUFFLE_P_inv[16] = {0, 5,15,10,	13, 8, 2, 7,  11,14, 4, 1,	 6, 3, 9,12};

// INVERSE Tweak permutation

const int TWEAKEY_P[16]		= {6,5,14,15,0,1,2,3,7,12,13,4,8,9,10,11};
const int TWEAKEY_P_inv[16] = {4,5,6,7,11,1,0,8,12,13,14,15,9,10,2,3};

// round constants

const cell_t RC[15][16] = 
{{0x00,0x00, 0x00,0x00, 0x00,0x00, 0x00,0x00, 0x00,0x00, 0x00,0x00, 0x00,0x00, 0x00,0x00},
 {0xA4,0x09, 0x38,0x22, 0x29,0x9F, 0x31,0xD0, 0x08,0x2E, 0xFA,0x98, 0xEC,0x4E, 0x6C,0x89},
 {0x45,0x28, 0x21,0xE6, 0x38,0xD0, 0x13,0x77, 0xBE,0x54, 0x66,0xCF, 0x34,0xE9, 0x0C,0x6C},
 {0xC0,0xAC, 0x29,0xB7, 0xC9,0x7C, 0x50,0xDD, 0x3F,0x84, 0xD5,0xB5, 0xB5,0x47, 0x09,0x17},
 {0x92,0x16, 0xD5,0xD9, 0x89,0x79, 0xFB,0x1B, 0xD1,0x31, 0x0B,0xA6, 0x98,0xDF, 0xB5,0xAC},
 {0x2F,0xFD, 0x72,0xDB, 0xD0,0x1A, 0xDF,0xB7, 0xB8,0xE1, 0xAF,0xED, 0x6A,0x26, 0x7E,0x96},
 {0xBA,0x7C, 0x90,0x45, 0xF1,0x2C, 0x7F,0x99, 0x24,0xA1, 0x99,0x47, 0xB3,0x91, 0x6C,0xF7},
 {0x08,0x01, 0xF2,0xE2, 0x85,0x8E, 0xFC,0x16, 0x63,0x69, 0x20,0xD8, 0x71,0x57, 0x4E,0x69},
 {0xA4,0x58, 0xFE,0xA3, 0xF4,0x93, 0x3D,0x7E, 0x0D,0x95, 0x74,0x8F, 0x72,0x8E, 0xB6,0x58},
 {0x71,0x8B, 0xCD,0x58, 0x82,0x15, 0x4A,0xEE, 0x7B,0x54, 0xA4,0x1D, 0xC2,0x5A, 0x59,0xB5},
 {0x9C,0x30, 0xD5,0x39, 0x2A,0xF2, 0x60,0x13, 0xC5,0xD1, 0xB0,0x23, 0x28,0x60, 0x85,0xF0},
 {0xCA,0x41, 0x79,0x18, 0xB8,0xDB, 0x38,0xEF, 0x8E,0x79, 0xDC,0xB0, 0x60,0x3A, 0x18,0x0E},
 {0x6C,0x9E, 0x0E,0x8B, 0xB0,0x1E, 0x8A,0x3E, 0xD7,0x15, 0x77,0xC1, 0xBD,0x31, 0x4B,0x27},
 {0x78,0xAF, 0x2F,0xDA, 0x55,0x60, 0x5C,0x60, 0xE6,0x55, 0x25,0xF3, 0xAA,0x55, 0xAB,0x94},
 {0x57,0x48, 0x98,0x62, 0x63,0xE8, 0x14,0x40, 0x55,0xCA, 0x39,0x6A, 0x2A,0xAB, 0x10,0xB6}};

const cell_t ALPHA[16] =
 {0x24,0x3F, 0x6A,0x88, 0x85,0xA3, 0x08,0xD3, 0x13,0x19, 0x8A,0x2E, 0x03,0x70, 0x73,0x44};

FILE* file;

void display_cells(const cell_t state[16])
{
	int i;
	unsigned char input[16];

	for(i = 0; i < 16; i++) input[i] = state[i] & 0xFF;
	for(i = 0; i < 8; i++) fprintf(file,"%02x", input[i]);
	fprintf(file," ");
	for(	 ; i < 16; i++) fprintf(file,"%02x", input[i]);
}

void display_cipher_state(unsigned char state[16], unsigned char tweakCells[16])
{
	fprintf(file,"S = "); display_cells(state);
	fprintf(file," - T = "); display_cells(tweakCells);
}

// XOR Cells to the state

void Add(cell_t state[16], const cell_t Cells[16])
{
	for(int i = 0; i < 16; i++) state[i] ^= Cells[i];
}

// Apply the tweak update

void apply_perm(cell_t cells[16], const int permutation[16])
{
	int i;
	cell_t tmp[16];

	// Apply the TWEAK permutation, store in temporary array

	for(i = 0; i < 16; i++) tmp[i] = cells[permutation[i]];

	// copy back, destructing input

	for(i = 0; i < 16; i++) cells[i] = tmp[i];
}

// Apply the tweak update, its inverse

// maps (b_7,...,b_2,b_1,b_0) to ( b_0 + b_2 ,b_7,...,b_2,b_1)

int lfsr(int v)
{
	return (v >> 1) ^ (((v & 1) ^ ((v >> 2) & 1)) << 7);
}

// maps	 ( b_8 = b_0 + b_2 ,b_7,...b_3,b_2,b_1) to (b_7,...,b_3,b_2,b_1,b_8 + b_2)

int lfsr_inv(int v)
{
	return ((v << 1) & 0xFF) ^ (((v >> 1) & 1) ^ ((v >> 7) & 1));
}

void updateTweak(cell_t cells[16])
{
	apply_perm(cells, TWEAKEY_P);

	cells[ 0] = lfsr(cells[ 0]);
	cells[ 1] = lfsr(cells[ 1]);
	cells[ 3] = lfsr(cells[ 3]);
	cells[ 4] = lfsr(cells[ 4]);
	cells[ 8] = lfsr(cells[ 8]);
	cells[11] = lfsr(cells[11]);
	cells[13] = lfsr(cells[13]);
}

void updateTweak_inv(cell_t cells[16])
{
	cells[ 0] = lfsr_inv(cells[ 0]);
	cells[ 1] = lfsr_inv(cells[ 1]);
	cells[ 3] = lfsr_inv(cells[ 3]);
	cells[ 4] = lfsr_inv(cells[ 4]);
	cells[ 8] = lfsr_inv(cells[ 8]);
	cells[11] = lfsr_inv(cells[11]);
	cells[13] = lfsr_inv(cells[13]);

	apply_perm(cells, TWEAKEY_P_inv);
}

// Apply the ShuffleCells function, its inverse

void ShuffleCells(cell_t cells[16])
{
	apply_perm(cells, SHUFFLE_P);
}

void ShuffleCells_inv(cell_t cells[16])
{
	apply_perm(cells, SHUFFLE_P_inv);
}

// Add a round constant

void AddConstants(cell_t cells[16], int r)
{
	for(int i = 0; i < 16; i++) cells[i] ^= RC[r][i];
}

// Apply alpha to cells state

void AddAlpha(cell_t cells[16])
{
	for(int i = 0; i < 16; i++) cells[i] ^= ALPHA[i];
}

// Apply the 8-bit Sbox

unsigned char bit_permute[256] = {
  0,   1,	4,	 5,	 16,  17,  20,	21,	 64,  65,  68,	69,	 80,  81,  84,	85, 
  2,   3,	6,	 7,	 18,  19,  22,	23,	 66,  67,  70,	71,	 82,  83,  86,	87, 
  8,   9,  12,	13,	 24,  25,  28,	29,	 72,  73,  76,	77,	 88,  89,  92,	93, 
 10,  11,  14,	15,	 26,  27,  30,	31,	 74,  75,  78,	79,	 90,  91,  94,	95, 
 32,  33,  36,	37,	 48,  49,  52,	53,	 96,  97, 100, 101, 112, 113, 116, 117, 
 34,  35,  38,	39,	 50,  51,  54,	55,	 98,  99, 102, 103, 114, 115, 118, 119, 
 40,  41,  44,	45,	 56,  57,  60,	61, 104, 105, 108, 109, 120, 121, 124, 125, 
 42,  43,  46,	47,	 58,  59,  62,	63, 106, 107, 110, 111, 122, 123, 126, 127, 
128, 129, 132, 133, 144, 145, 148, 149, 192, 193, 196, 197, 208, 209, 212, 213, 
130, 131, 134, 135, 146, 147, 150, 151, 194, 195, 198, 199, 210, 211, 214, 215, 
136, 137, 140, 141, 152, 153, 156, 157, 200, 201, 204, 205, 216, 217, 220, 221, 
138, 139, 142, 143, 154, 155, 158, 159, 202, 203, 206, 207, 218, 219, 222, 223, 
160, 161, 164, 165, 176, 177, 180, 181, 224, 225, 228, 229, 240, 241, 244, 245, 
162, 163, 166, 167, 178, 179, 182, 183, 226, 227, 230, 231, 242, 243, 246, 247, 
168, 169, 172, 173, 184, 185, 188, 189, 232, 233, 236, 237, 248, 249, 252, 253, 
170, 171, 174, 175, 186, 187, 190, 191, 234, 235, 238, 239, 250, 251, 254, 255, 
};

unsigned char bit_permute_inv[256] = {
  0,   1,  16,	17,	  2,   3,  18,	19,	 32,  33,  48,	49,	 34,  35,  50,	51, 
  4,   5,  20,	21,	  6,   7,  22,	23,	 36,  37,  52,	53,	 38,  39,  54,	55, 
 64,  65,  80,	81,	 66,  67,  82,	83,	 96,  97, 112, 113,	 98,  99, 114, 115, 
 68,  69,  84,	85,	 70,  71,  86,	87, 100, 101, 116, 117, 102, 103, 118, 119, 
  8,   9,  24,	25,	 10,  11,  26,	27,	 40,  41,  56,	57,	 42,  43,  58,	59, 
 12,  13,  28,	29,	 14,  15,  30,	31,	 44,  45,  60,	61,	 46,  47,  62,	63, 
 72,  73,  88,	89,	 74,  75,  90,	91, 104, 105, 120, 121, 106, 107, 122, 123, 
 76,  77,  92,	93,	 78,  79,  94,	95, 108, 109, 124, 125, 110, 111, 126, 127, 
128, 129, 144, 145, 130, 131, 146, 147, 160, 161, 176, 177, 162, 163, 178, 179, 
132, 133, 148, 149, 134, 135, 150, 151, 164, 165, 180, 181, 166, 167, 182, 183, 
192, 193, 208, 209, 194, 195, 210, 211, 224, 225, 240, 241, 226, 227, 242, 243, 
196, 197, 212, 213, 198, 199, 214, 215, 228, 229, 244, 245, 230, 231, 246, 247, 
136, 137, 152, 153, 138, 139, 154, 155, 168, 169, 184, 185, 170, 171, 186, 187, 
140, 141, 156, 157, 142, 143, 158, 159, 172, 173, 188, 189, 174, 175, 190, 191, 
200, 201, 216, 217, 202, 203, 218, 219, 232, 233, 248, 249, 234, 235, 250, 251, 
204, 205, 220, 221, 206, 207, 222, 223, 236, 237, 252, 253, 238, 239, 254, 255, 
};

cell_t sbox_8(cell_t v)
{
	cell_t vh = (v >> 4) & 0xF;
	cell_t vl =	 v		 & 0xF;
	cell_t u;

	u = (sbox_4[vh] << 4) | sbox_4[vl];

	u = bit_permute[u];
	
	return u;
}

cell_t sbox_8_inv(cell_t v)
{
	cell_t u;

	u = bit_permute_inv[v];

	cell_t vh = (u >> 4) & 0xF;
	cell_t vl =	 u		 & 0xF;

	u = (sbox_4_inv[vh] << 4) | sbox_4_inv[vl];

	return u;
}

void SubCell8(cell_t cells[16])
{
	for(int i = 0; i < 16; i++) cells[i] = sbox_8(cells[i]);
}

// Apply the 4-bit inverse Sbox

void SubCell8_inv(cell_t cells[16])
{
	for(int i = 0; i < 16; i++) cells[i] = sbox_8_inv(cells[i]);
}

// Apply the linear diffusion matrix
//
// M =
// 0 a b c	a,b,c means rotate by a,b,c
// c 0 a b
// b c 0 a
// a b c 0
//
// 0 a b c	   s 0 s 1 s 2 s 3	  
// c 0 a b	   s 4 s 5 s 6 s 7	  
// b c 0 a	X  s 8 s 9 s10 s11
// a b c 0	   s12 s13 s14 s15	  

cell_t RotCell(cell_t val, int amount)
{
	return ( ((val << amount) | (val >> (8-amount))) & 0xFF );
}

void MixColumns(cell_t state[16], int a, int b, int c)
{
	int j;
	cell_t temp0, temp1, temp2, temp3;

	for(j = 0; j < 4; j++) // for each column, that has 0,1,2,3 at the top
	{
		temp0 =						  RotCell(state[j+4],a) ^ RotCell(state[j+8],b) ^ RotCell(state[j+12],c);
		temp1 = RotCell(state[j],c) ^						  RotCell(state[j+8],a) ^ RotCell(state[j+12],b);
		temp2 = RotCell(state[j],b) ^ RotCell(state[j+4],c) ^						  RotCell(state[j+12],a);
		temp3 = RotCell(state[j],a) ^ RotCell(state[j+4],b) ^ RotCell(state[j+8],c);

		state[j]	= temp0;
		state[j+4]	= temp1;
		state[j+8]	= temp2;
		state[j+12] = temp3;
	}
}

// ////////////////////////////////////////////////////////////////////

// encryption function of qarma128_R
 

void qarma128(const cell_t * input,
			 const cell_t W[16], const cell_t W_p[16],
			 const cell_t core_key[16], const cell_t middle_key[16],
			 const cell_t tweak[16],
			 int R, cell_t *output)
{
	cell_t state[16];
	cell_t T[16];
	cell_t K[16];

	int i;

	for(i = 0; i < 16; i++) {
		state[i] = input[i];
		T[i]	 = tweak[i];
		K[i]	 = core_key[i];
	}

 

	// Initial whitening

	Add(state, W);					 

	// The R forward rounds

	for(i = 0; i < R; i++)
	{
		// A round is Add(constant+key+tweak), then S-Box, MixColumns, and Shuffle
	
		AddConstants(state, i);
		Add(state, K);
		Add(state, T);				 
		if (i != 0)
		{
			ShuffleCells(state);	 
			MixColumns(state,ROTATION_A,ROTATION_B,ROTATION_C); 
									 
		}
		SubCell8(state);			 
		updateTweak(T);
	} 

	// The pseudo-reflector

	   // first whitening key addition

	Add(state, W_p);
	Add(state, T);					 

	// full forward diffusion layer

	ShuffleCells(state);			 
	MixColumns(state,ROTATION_A,ROTATION_B,ROTATION_C); 
									 
	SubCell8(state);

	// pseudo reflector

	ShuffleCells(state);

	MixColumns(state,ROTATION_A_MID,ROTATION_B_MID,ROTATION_C_MID); 
	Add(state, middle_key);

	ShuffleCells_inv(state);

	// backward round with whitening key in place of core key

	SubCell8_inv(state);			 

	MixColumns(state,ROTATION_A_INV,ROTATION_B_INV,ROTATION_C_INV); 
									 
	ShuffleCells_inv(state);		 

	// second whitening key addition

	Add(state, W);
	Add(state, T);					 

	// The R backward rounds

	for(i = 0; i < R; i++)
	{
		updateTweak_inv(T);

		SubCell8_inv(state);		 

		if (i != R-1)
		{
			MixColumns(state,ROTATION_A_INV,ROTATION_B_INV,ROTATION_C_INV); 
										 
			ShuffleCells_inv(state);	 
		}
		Add(state, T);				
		Add(state, K);				
		AddAlpha(state); // inverse has + alpha
		AddConstants(state, R-1-i);	 
	}

	// Final whitening with W_p 

	Add(state, W_p);				 

	for(i = 0; i < 16; i++)
		output[i] = state[i] & 0xFF;
}

 
// in: core and whitening keys w0 and k0
// out: center core keys k1 and k1_M, second whitening key w1

void Orthomorphism(const cell_t w0[16], cell_t * w1)
{
	cell_t oldtemp;
	cell_t newtemp;
	int i;

	// create w1 by expansion
	// first w0 >>> 1

	oldtemp = 0;
	for (i = 0; i<16; i++)
	{
		newtemp = w0[i] & 0x1;
		w1[i]	= w0[i] >>	1;
		w1[i]	= w1[i] ^ oldtemp;
		oldtemp = (newtemp << 7) & 0xff;
	}
	w1[0]  ^= oldtemp;

	// then add w0 >> 127

	w1[15] ^= (w0[0] >> 7);
}

void KeySpecialisation( const cell_t k0[16], const	cell_t w0[16],
	cell_t * k1, cell_t * k1_M, cell_t * w1)
{
	int i;
	
	Orthomorphism(w0, w1); 
	for (i = 0; i<16; i++)
		k1[i] = k0[i];
 
	for (i = 0; i<16; i++)
		k1_M[i] = k1[i];

	MixColumns(k1_M,ROTATION_A_MID,ROTATION_B_MID,ROTATION_C_MID);	
}

void KeySpecialisation_dec(const  cell_t k0[16],  const cell_t w0[16],
	cell_t * k1, cell_t * k1_M, cell_t * w1, cell_t * w0d,cell_t * w1d, cell_t *k0d)
{
	int i;
 
	Orthomorphism(w0, w1);

	for (i = 0; i<16; i++)
	{		   
		k1[i] = k0[i];
		w0d[i] = w1[i];	 
		w1d[i] = w0[i];
	}

	for (i = 0; i<16; i++)
		k1_M[i] = k1[i];

	MixColumns(k1_M,ROTATION_A_MID,ROTATION_B_MID,ROTATION_C_MID);	
		for (i = 0; i<16; i++)
			k0d[i]=k0[i] ^ ALPHA[i];

}