祖冲之算法（ZUC-128）C语言实现

ka5cas

已于 2022-04-25 16:54:51 修改

阅读量1.3w

点赞数 24

分类专栏：密码学文章标签：密码学

于 2020-04-28 21:04:49 首次发布

本文链接：https://blog.csdn.net/qq_43094622/article/details/105823724

版权

密码学专栏收录该内容

8 篇文章 6 订阅

订阅专栏

祖冲之算法

1、算法原理

算法整体结构分为上中下三层。上层为线性反馈移位寄存器LFSR，中层为比特重组BR，下层为非线性函数F。

在这里插入图片描述

（1）线性反馈移位寄存器

LFSR包括16个31比特寄存器单元s₀_s15~。LFSR的运行模式有两种：初始化模式和工作模式。

初始化模式下，LFSR接收一个31比特字u，u由非线性函数F的32比特输出W舍弃最低位（右移一位）得到。初始化模式下LFSR进行如下操作：

LFSRWithInitialisationMode(u)
{
    v = (2^15)*s[15]+(2^17)*s[13]+(2^21)*s[10]+(2^20)*s[4]+(1+2^8)*s[0] mod (2^31-1);
    s[16]=(v+u) mod (2^31-1);
    if (s[16]==0)
    	s[16]=2^31-1;
    (s[1],s[2],...,s[16])-→(s[0],s[1],...,s[15]);
}

工作模式下LFSR无输入，进行如下操作：

LFSRWithWorkMode()
{
    s[16] = (2^15)*s[15]+(2^17)*s[13]+(2^21)*s[10]+(2^20)*s[4]+(1+2^8)*s[0] mod (2^31-1);
    if (s[16]==0)
    	s[16]=2^31-1;
    (s[1],s[2],...,s[16])-→(s[0],s[1],...,s[15]);
}

（2）比特重组BR

设BR的输入为LFSR的s[0]~s[15]，输出为4个32比特字X₀，X₁，X₂，X₃。计算过程如下：

BitReconstruction()
//H表示截取高16位，L表示截取低16位，||表示连接
{
    X0=(s[15]~H)||(s[14]~L);
    X1=(s[11]~L)||(s[9]~H);
    X2=(s[7]~L)||(s[5]~H);
    X3=(s[2]~L)||(s[0]~H);
}

（3）非线性函数F

非线性函数的输入为3个32比特字X₀，X₁，X₂，输出为一个32比特字W。计算过程如下：

F(X0,X1,X2)
{
    W=(X0^R1)+R2;
    W1=R1+X1;
    W2=R2^x2;
    R1=S(L1((W1~L)||(W2~H)));
    R2=S(L2((W2~L)||(W1~H)));
}
// <<<表示循环左移
L1(x)=x^(x<<<2)^(x<<<10)^(x<<<18)^(x<<<24);
L2(x)=x^(x<<<8)^(x<<<14)^(x<<<22)^(x<<<30);

（4）密钥装入

初始密钥k和初始向量iv分别扩展位16个LFSR存储单元的初始状态。设k=k₀||…||k₁₅，iv=iv₀||…||iv₁₅（k_i与iv_i都是8比特）。规定D=d₀||…||d₁₅为240比特常量。有如下关系：s_i=k_i||d_i||iv_i。

2、算法流程

祖冲之算法的运行分为两个阶段：初始化阶段和工作阶段。

首先进行初始化阶段。这一阶段将初始密钥和初始向量装入LFSR作为其初态，并置R₁和R₂为0，然后进行一系列操作。具体流程如下：

Init(k,iv)
{
    k_iv_load(k,iv);
    R1=R2=0;
    do following 32 times:
    {
        BitReconstruction();
    	W=F(X0,X1,X2);
    	LFSRWithInitialisationMode(W>>1);
    }
}

然后进入工作阶段。工作阶段产生密钥流。具体流程如下：

Work()
{
    BitReconstruction();
    W=F(X0,X1,X2);
    LFSRWithWorkMode();
    while(true)
    {
        BitReconstruction();
        Z=F(X0,X1,X2)^X3;
        output Z;
        LFSRWithMode();
    }
}

下面是激动人心的C语言代码辣~~~

/***********************/
/*made by cute xp      */
/*2020.4.28            */
/***********************/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>

typedef unsigned char uint8;
typedef unsigned int uint32;

uint8 S0[256] = {
    0x3e, 0x72, 0x5b, 0x47, 0xca, 0xe0, 0x00, 0x33, 0x04, 0xd1, 0x54, 0x98, 0x09, 0xb9, 0x6d, 0xcb,
    0x7b, 0x1b, 0xf9, 0x32, 0xaf, 0x9d, 0x6a, 0xa5, 0xb8, 0x2d, 0xfc, 0x1d, 0x08, 0x53, 0x03, 0x90,
    0x4d, 0x4e, 0x84, 0x99, 0xe4, 0xce, 0xd9, 0x91, 0xdd, 0xb6, 0x85, 0x48, 0x8b, 0x29, 0x6e, 0xac,
    0xcd, 0xc1, 0xf8, 0x1e, 0x73, 0x43, 0x69, 0xc6, 0xb5, 0xbd, 0xfd, 0x39, 0x63, 0x20, 0xd4, 0x38,
    0x76, 0x7d, 0xb2, 0xa7, 0xcf, 0xed, 0x57, 0xc5, 0xf3, 0x2c, 0xbb, 0x14, 0x21, 0x06, 0x55, 0x9b,
    0xe3, 0xef, 0x5e, 0x31, 0x4f, 0x7f, 0x5a, 0xa4, 0x0d, 0x82, 0x51, 0x49, 0x5f, 0xba, 0x58, 0x1c,
    0x4a, 0x16, 0xd5, 0x17, 0xa8, 0x92, 0x24, 0x1f, 0x8c, 0xff, 0xd8, 0xae, 0x2e, 0x01, 0xd3, 0xad,
    0x3b, 0x4b, 0xda, 0x46, 0xeb, 0xc9, 0xde, 0x9a, 0x8f, 0x87, 0xd7, 0x3a, 0x80, 0x6f, 0x2f, 0xc8,
    0xb1, 0xb4, 0x37, 0xf7, 0x0a, 0x22, 0x13, 0x28, 0x7c, 0xcc, 0x3c, 0x89, 0xc7, 0xc3, 0x96, 0x56,
    0x07, 0xbf, 0x7e, 0xf0, 0x0b, 0x2b, 0x97, 0x52, 0x35, 0x41, 0x79, 0x61, 0xa6, 0x4c, 0x10, 0xfe,
    0xbc, 0x26, 0x95, 0x88, 0x8a, 0xb0, 0xa3, 0xfb, 0xc0, 0x18, 0x94, 0xf2, 0xe1, 0xe5, 0xe9, 0x5d,
    0xd0, 0xdc, 0x11, 0x66, 0x64, 0x5c, 0xec, 0x59, 0x42, 0x75, 0x12, 0xf5, 0x74, 0x9c, 0xaa, 0x23,
    0x0e, 0x86, 0xab, 0xbe, 0x2a, 0x02, 0xe7, 0x67, 0xe6, 0x44, 0xa2, 0x6c, 0xc2, 0x93, 0x9f, 0xf1,
    0xf6, 0xfa, 0x36, 0xd2, 0x50, 0x68, 0x9e, 0x62, 0x71, 0x15, 0x3d, 0xd6, 0x40, 0xc4, 0xe2, 0x0f,
    0x8e, 0x83, 0x77, 0x6b, 0x25, 0x05, 0x3f, 0x0c, 0x30, 0xea, 0x70, 0xb7, 0xa1, 0xe8, 0xa9, 0x65,
    0x8d, 0x27, 0x1a, 0xdb, 0x81, 0xb3, 0xa0, 0xf4, 0x45, 0x7a, 0x19, 0xdf, 0xee, 0x78, 0x34, 0x60};

uint8 S1[256] = {
    0x55, 0xc2, 0x63, 0x71, 0x3b, 0xc8, 0x47, 0x86, 0x9f, 0x3c, 0xda, 0x5b, 0x29, 0xaa, 0xfd, 0x77,
    0x8c, 0xc5, 0x94, 0x0c, 0xa6, 0x1a, 0x13, 0x00, 0xe3, 0xa8, 0x16, 0x72, 0x40, 0xf9, 0xf8, 0x42,
    0x44, 0x26, 0x68, 0x96, 0x81, 0xd9, 0x45, 0x3e, 0x10, 0x76, 0xc6, 0xa7, 0x8b, 0x39, 0x43, 0xe1,
    0x3a, 0xb5, 0x56, 0x2a, 0xc0, 0x6d, 0xb3, 0x05, 0x22, 0x66, 0xbf, 0xdc, 0x0b, 0xfa, 0x62, 0x48,
    0xdd, 0x20, 0x11, 0x06, 0x36, 0xc9, 0xc1, 0xcf, 0xf6, 0x27, 0x52, 0xbb, 0x69, 0xf5, 0xd4, 0x87,
    0x7f, 0x84, 0x4c, 0xd2, 0x9c, 0x57, 0xa4, 0xbc, 0x4f, 0x9a, 0xdf, 0xfe, 0xd6, 0x8d, 0x7a, 0xeb,
    0x2b, 0x53, 0xd8, 0x5c, 0xa1, 0x14, 0x17, 0xfb, 0x23, 0xd5, 0x7d, 0x30, 0x67, 0x73, 0x08, 0x09,
    0xee, 0xb7, 0x70, 0x3f, 0x61, 0xb2, 0x19, 0x8e, 0x4e, 0xe5, 0x4b, 0x93, 0x8f, 0x5d, 0xdb, 0xa9,
    0xad, 0xf1, 0xae, 0x2e, 0xcb, 0x0d, 0xfc, 0xf4, 0x2d, 0x46, 0x6e, 0x1d, 0x97, 0xe8, 0xd1, 0xe9,
    0x4d, 0x37, 0xa5, 0x75, 0x5e, 0x83, 0x9e, 0xab, 0x82, 0x9d, 0xb9, 0x1c, 0xe0, 0xcd, 0x49, 0x89,
    0x01, 0xb6, 0xbd, 0x58, 0x24, 0xa2, 0x5f, 0x38, 0x78, 0x99, 0x15, 0x90, 0x50, 0xb8, 0x95, 0xe4,
    0xd0, 0x91, 0xc7, 0xce, 0xed, 0x0f, 0xb4, 0x6f, 0xa0, 0xcc, 0xf0, 0x02, 0x4a, 0x79, 0xc3, 0xde,
    0xa3, 0xef, 0xea, 0x51, 0xe6, 0x6b, 0x18, 0xec, 0x1b, 0x2c, 0x80, 0xf7, 0x74, 0xe7, 0xff, 0x21,
    0x5a, 0x6a, 0x54, 0x1e, 0x41, 0x31, 0x92, 0x35, 0xc4, 0x33, 0x07, 0x0a, 0xba, 0x7e, 0x0e, 0x34,
    0x88, 0xb1, 0x98, 0x7c, 0xf3, 0x3d, 0x60, 0x6c, 0x7b, 0xca, 0xd3, 0x1f, 0x32, 0x65, 0x04, 0x28,
    0x64, 0xbe, 0x85, 0x9b, 0x2f, 0x59, 0x8a, 0xd7, 0xb0, 0x25, 0xac, 0xaf, 0x12, 0x03, 0xe2, 0xf2};

uint32 D[16] = {
    0x44d7, 0x26bc, 0x626b, 0x135e, 0x5789, 0x35e2, 0x7135, 0x09af,
    0x4d78, 0x2f13, 0x6bc4, 0x1af1, 0x5e26, 0x3c4d, 0x789a, 0x47ac};

uint32 LFSR[16] = {0};
uint32 X[4] = {0};
uint32 R1 = 0, R2 = 0;
uint32 W = 0;

uint32 mod_add(uint32 a, uint32 b);
uint32 mod_2exp_mul(uint32 x, int exp);
void LFSRWithInitMode(uint32 u);
void LFSRWithWorkMode();
void BitReconstruction();

uint32 mod_add(uint32 a, uint32 b)
{
    uint32 c = a + b;
    c = (c & 0x7fffffff) + (c >> 31);
    return c;
}

uint32 mod_2exp_mul(uint32 x, int exp)
{
    return ((x << exp) | (x >> (31 - exp))) & 0x7fffffff;
}

uint32 Rot(uint32 x, int move)
{
    return ((x << move) | (x >> (32 - move)));
}

void LFSRWithInitMode(uint32 u)
{
    uint32 v = 0, tmp = 0, i = 0;

    v = LFSR[0];
    tmp = mod_2exp_mul(LFSR[0], 8);
    v = mod_add(v, tmp);

    tmp = mod_2exp_mul(LFSR[4], 20);
    v = mod_add(v, tmp);

    tmp = mod_2exp_mul(LFSR[10], 21);
    v = mod_add(v, tmp);

    tmp = mod_2exp_mul(LFSR[13], 17);
    v = mod_add(v, tmp);

    tmp = mod_2exp_mul(LFSR[15], 15);
    v = mod_add(v, tmp);

    v = mod_add(v, u);
    if (v == 0)
        v = 0x7fffffff;

    for (i = 0; i < 16; i++)
        LFSR[i] = LFSR[i + 1];
    LFSR[15] = v;
}

void LFSRWithWorkMode()
{
    uint32 v = 0, tmp = 0, i = 0;

    v = LFSR[0];
    tmp = mod_2exp_mul(LFSR[0], 8);
    v = mod_add(v, tmp);

    tmp = mod_2exp_mul(LFSR[4], 20);
    v = mod_add(v, tmp);

    tmp = mod_2exp_mul(LFSR[10], 21);
    v = mod_add(v, tmp);

    tmp = mod_2exp_mul(LFSR[13], 17);
    v = mod_add(v, tmp);

    tmp = mod_2exp_mul(LFSR[15], 15);
    v = mod_add(v, tmp);

    if (v == 0)
        v = 0x7fffffff;

    for (i = 0; i < 16; i++)
        LFSR[i] = LFSR[i + 1];
    LFSR[15] = v;
}

void BitReconstruction()
{
    X[0] = ((LFSR[15] & 0x7fff8000) << 1) | (LFSR[14] & 0xffff);
    X[1] = (LFSR[11] << 16) | (LFSR[9] >> 15);
    X[2] = (LFSR[7] << 16) | (LFSR[5] >> 15);
    X[3] = (LFSR[2] << 16) | (LFSR[0] >> 15);
}

uint32 L1(uint32 x)
{
    return (x ^ Rot(x, 2) ^ Rot(x, 10) ^ Rot(x, 18) ^ Rot(x, 24));
}

uint32 L2(uint32 x)
{
    return (x ^ Rot(x, 8) ^ Rot(x, 14) ^ Rot(x, 22) ^ Rot(x, 30));
}

uint32 S(uint32 a)
{
    uint8 x[4] = {0}, y[4] = {0};
    uint32 b = 0;
    int i = 0, row = 0, line = 0;
    x[0] = a >> 24;
    x[1] = (a >> 16) & 0xff;
    x[2] = (a >> 8) & 0xff;
    x[3] = a & 0xff;
    for (i = 0; i < 4; i++)
    {
        //row = x[i] >> 4;
        //line = x[i] & 0xf;
        if (i == 0 || i == 2)
            y[i] = S0[x[i]];
        else
            y[i] = S1[x[i]];
    }
    b = (y[0] << 24) | (y[1] << 16) | (y[2] << 8) | y[3];
    return b;
}

void F()
{
    uint32 W1 = 0, W2 = 0;
    uint32 tmp1 = 0, tmp2 = 0;
    W = (X[0] ^ R1) + R2;
    W1 = R1 + X[1];
    W2 = R2 ^ X[2];
    R1 = S(L1((W1 << 16) | (W2 >> 16)));
    R2 = S(L2((W2 << 16) | (W1 >> 16)));
}

void Key_IV_Insert(uint8 *k, uint8 *iv)
{
    int i = 0;
    for (i = 0; i < 16; i++)
        LFSR[i] = (k[i] << 23) | (D[i] << 8) | iv[i];
}

void Init(uint8 *k, uint8 *iv)
{
    Key_IV_Insert(k, iv);
    R1 = R2 = 0;
    uint32 i = 0;
    for (i = 0; i < 32; i++)
    {
        BitReconstruction();
        F();
        LFSRWithInitMode(W >> 1);
    }
}

uint32 *KeyStream_Generator(int keylen)
{
    uint32 Z = 0, i = 0;
    uint32 *keystream = (uint32 *)malloc(keylen * sizeof(uint32));
    BitReconstruction();
    F();
    LFSRWithWorkMode();
    for (i = 0; i < keylen; i++)
    {
        BitReconstruction();
        F();
        keystream[i] = W ^ X[3];
        LFSRWithWorkMode();
    }
    return keystream;
}

int main()
{
    int i = 0, keylen = 0;
    uint8 key[16] = {0};
    uint8 iv[16] = {0};

    char k[50] = {0};
    char v[50] = {0};
    char tmp[2] = {0};
    printf("key: ");
    scanf("%s", k);
    printf("IV : ");
    scanf("%s", v);
    printf("keylen : ");
    scanf("%d", &keylen);
    for (i = 0; i < 16; i++)
    {
        key[i] = (((k[2 * i] <= '9') ? (k[2 * i] - '0') : (k[2 * i] - 'a' + 10)) << 4) +
                 ((k[2 * i + 1] <= '9') ? (k[2 * i + 1] - '0') : (k[2 * i + 1] - 'a' + 10));
        iv[i] = (((v[2 * i] <= '9') ? (v[2 * i] - '0') : (v[2 * i] - 'a' + 10)) << 4) +
                ((v[2 * i + 1] <= '9') ? (v[2 * i + 1] - '0') : (v[2 * i + 1] - 'a' + 10));
    }

    Init(key, iv);
    uint32 *keylist = KeyStream_Generator(keylen);
    for (i = 0; i < keylen; i++)
        printf("%08x ", keylist[i]);
    system("pause");
    free(keylist);
	keylist = NULL;
    return 0;
}