package com.cscn; import javacard.framework.JCSystem; import static com.cscn.Zuc256Util.L1; import static com.cscn.Zuc256Util.L2; import static com.cscn.Zuc256Util.add31; import static com.cscn.Zuc256Util.add32; import static com.cscn.Zuc256Util.add64; import static com.cscn.Zuc256Util.and64_7FFFFFFF_to32; import static com.cscn.Zuc256Util.create_64b_from_32b; import static com.cscn.Zuc256Util.makeU31; import static com.cscn.Zuc256Util.makeU32; import static com.cscn.Zuc256Util.rot31; import static com.cscn.Zuc256Util.shr32u1; import static com.cscn.Zuc256Util.shr64u_31; import static com.cscn.Zuc256Util.xor32; /** * ZUC-256 核心：状态初始化、密钥字生成、密钥流生成。 */ public class Zuc256Core { private Zuc256Core() {} /** 初始化状态（Key + IV） */ public static void initState(Zuc256State state, byte[] key32, byte[] iv) { zuc256SetMacKey(state, key32, iv, (short)0); } /** 生成单个密钥字 */ public static void zuc256GenerateKeyword(Zuc256State state, short[] out) { // int[] LFSR = state.LFSR; // int R1 = state.R1; // int R2 = state.R2; // int X0, X1, X2, X3; // int W1, W2, U, V; // int Z; short[] LFSR_hi = state.LFSR_hi; short[] LFSR_lo = state.LFSR_lo; // 工作寄存器（32位值的临时 out32 缓冲，全用short[2]）[lo, hi] short[] X0 = JCSystem.makeTransientShortArray((short)2, JCSystem.MEMORY_TYPE_TRANSIENT_RESET); short[] X1 = JCSystem.makeTransientShortArray((short)2, JCSystem.MEMORY_TYPE_TRANSIENT_RESET); short[] X2 = JCSystem.makeTransientShortArray((short)2, JCSystem.MEMORY_TYPE_TRANSIENT_RESET); short[] X3 = JCSystem.makeTransientShortArray((short)2, JCSystem.MEMORY_TYPE_TRANSIENT_RESET); short[] R1 = JCSystem.makeTransientShortArray((short)2, JCSystem.MEMORY_TYPE_TRANSIENT_RESET); short[] R2 = JCSystem.makeTransientShortArray((short)2, JCSystem.MEMORY_TYPE_TRANSIENT_RESET); short[] W1 = JCSystem.makeTransientShortArray((short)2, JCSystem.MEMORY_TYPE_TRANSIENT_RESET); short[] W2 = JCSystem.makeTransientShortArray((short)2, JCSystem.MEMORY_TYPE_TRANSIENT_RESET); short[] U = JCSystem.makeTransientShortArray((short)2, JCSystem.MEMORY_TYPE_TRANSIENT_RESET); short[] V = JCSystem.makeTransientShortArray((short)2, JCSystem.MEMORY_TYPE_TRANSIENT_RESET); short[] Z = JCSystem.makeTransientShortArray((short)2, JCSystem.MEMORY_TYPE_TRANSIENT_RESET); short[] TMP0 = JCSystem.makeTransientShortArray((short)2, JCSystem.MEMORY_TYPE_TRANSIENT_RESET); short[] TMP1 = JCSystem.makeTransientShortArray((short)2, JCSystem.MEMORY_TYPE_TRANSIENT_RESET); short[] TMP2 = JCSystem.makeTransientShortArray((short)2, JCSystem.MEMORY_TYPE_TRANSIENT_RESET); // 载入 R1,R2 R1[0] = state.R1_lo; R1[1] = state.R1_hi; R2[0] = state.R2_lo; R2[1] = state.R2_hi; // BitReconstruction4 short c15 = (short)((LFSR_lo[15] & (short)0x8000) >>> 15); // 左移产生的进位 X0[1] = (short)(((LFSR_hi[15] & (short)0x7FFF) << 1) | c15); // hi X0[0] = LFSR_lo[14]; // lo // X1 = ((L11 & 0xFFFF) << 16) | (L9 >>> 15) X1[1] = LFSR_lo[11]; X1[0] = (short)(((LFSR_lo[9] & (short)0x8000) >>> 15) | (LFSR_hi[9] << 1)); // X2 = ((L7 & 0xFFFF) << 16) | (L5 >>> 15) X2[1] = LFSR_lo[7]; X2[0] = (short)(((LFSR_lo[5] & (short)0x8000) >>> 15) | (LFSR_hi[5] << 1)); // X3 = ((L2 & 0xFFFF) << 16) | (L0 >>> 15) X3[1] = LFSR_lo[2]; X3[0] = (short)(((LFSR_lo[0] & (short)0x8000) >>> 15) | (LFSR_hi[0] << 1)); // ---- 输入：X0,X1,X2,X3,R1,R2 均为 short[2]; 输出：Z,W1,W2,U,V ---- // Z = X3 ^ ((X0 ^ R1) + R2) xor32(X0[0], X0[1], R1[0], R1[1], TMP0); // TMP0 = X0 ^ R1 add32(TMP0[0], TMP0[1], R2[0], R2[1], TMP1); // TMP1 = TMP0 + R2 xor32(X3[0], X3[1], TMP1[0], TMP1[1], Z); // Z = X3 ^ TMP1 // F_(X1, X2) // W1 = R1 + X1 add32(R1[0], R1[1], X1[0], X1[1], W1); // W2 = R2 ^ X2 xor32(R2[0], R2[1], X2[0], X2[1], W2); // U = L1((W1 << 16) | (W2 >>> 16)) // (W1<<16): lo=0, hi=W1_lo // (W2>>>16): lo=W2_hi, hi=0 // OR 结果： lo=W2_hi, hi=W1_lo L1(W2[1], W1[0], U); // V = L2((W2 << 16) | (W1 >>> 16)) // (W2<<16): lo=0, hi=W2_lo // (W1>>>16): lo=W1_hi, hi=0 // OR 结果： lo=W1_hi, hi=W2_lo L2(W1[1], W2[0], V); // R1 = makeU32(Zuc256Tables.S0[(U >>> 24) & 0xFF], // Zuc256Tables.S1[(U >>> 16) & 0xFF], // Zuc256Tables.S0[(U >>> 8) & 0xFF], // Zuc256Tables.S1[U & 0xFF]); makeU32( (short)(Zuc256Tables.S0[((U[1] >>> 8) & 0xFF)] & 0xFF), // (U >>> 24) & 0xFF (short)(Zuc256Tables.S1[(U[1] & 0xFF)] & 0xFF), // (U >>> 16) & 0xFF (short)(Zuc256Tables.S0[((U[0] >>> 8) & 0xFF)] & 0xFF), // (U >>> 8) & 0xFF (short)(Zuc256Tables.S1[(U[0] & 0xFF)] & 0xFF), // (U >>> 0) & 0xFF R1); // R2 = makeU32(Zuc256Tables.S0[(V >>> 24) & 0xFF], // Zuc256Tables.S1[(V >>> 16) & 0xFF], // Zuc256Tables.S0[(V >>> 8) & 0xFF], // Zuc256Tables.S1[V & 0xFF]); makeU32( (short)(Zuc256Tables.S0[((V[1] >>> 8) & 0xFF)] & 0xFF), // (V >>> 24) & 0xFF (short)(Zuc256Tables.S1[(V[1] & 0xFF)] & 0xFF), // (V >>> 16) & 0xFF (short)(Zuc256Tables.S0[((V[0] >>> 8) & 0xFF)] & 0xFF), // (V >>> 8) & 0xFF (short)(Zuc256Tables.S1[(V[0] & 0xFF)] & 0xFF), // (V >>> 0) & 0xFF R2); // // LFSRWithWorkMode // long a = LFSR[0]; // a += (long)LFSR[0] << 8; // a += (long)LFSR[4] << 20; // a += (long)LFSR[10] << 21; // a += (long)LFSR[13] << 17; // a += (long)LFSR[15] << 15; // ---- 先准备累加器 A (64位) ---- short[] A = new short[4]; // 64位累加器，初始全0 A[0] = 0; A[1] = 0; A[2] = 0; A[3] = 0; // 临时缓冲 short[] tmp32 = new short[2]; // 保存一个32位数 (lo,hi) short[] tmp64 = new short[4]; // 保存移位后的64位数 // a = LFSR[0] tmp32[0] = state.LFSR_lo[0]; tmp32[1] = state.LFSR_hi[0]; create_64b_from_32b(tmp64, tmp32, (short)0); add64(A, tmp64); // a += (LFSR[0] << 8) create_64b_from_32b(tmp64, tmp32, (short)8); add64(A, tmp64); // a += (LFSR[4] << 20) tmp32[0] = state.LFSR_lo[4]; tmp32[1] = state.LFSR_hi[4]; create_64b_from_32b(tmp64, tmp32, (short)20); add64(A, tmp64); // a += (LFSR[10] << 21) tmp32[0] = state.LFSR_lo[10]; tmp32[1] = state.LFSR_hi[10]; create_64b_from_32b(tmp64, tmp32, (short)21); add64(A, tmp64); // a += (LFSR[13] << 17) tmp32[0] = state.LFSR_lo[13]; tmp32[1] = state.LFSR_hi[13]; create_64b_from_32b(tmp64, tmp32, (short)17); add64(A, tmp64); // a += (LFSR[15] << 15) tmp32[0] = state.LFSR_lo[15]; tmp32[1] = state.LFSR_hi[15]; create_64b_from_32b(tmp64, tmp32, (short)15); add64(A, tmp64); // a = (a & 0x7FFFFFFF) + (a >>> 31); // ---- 第一次折叠：a = (a & 0x7FFFFFFF) + (a >>> 31) ---- short[] low31 = new short[4]; short[] r31 = new short[4]; and64_7FFFFFFF_to32(A, low31); // low31 = A & 0x7FFFFFFF shr64u_31(A, r31); // r31 = A >>> 31 A[0]=0; A[1]=0; A[2]=0; A[3]=0; add64(A, low31); add64(A, r31); // int v = (int) ((a & 0x7FFFFFFF) + (a >>> 31)); // ---- 第二次折叠，得到 v（32位）---- short[] low31b = new short[4]; short[] r31b = new short[4]; short[] v64 = new short[4]; and64_7FFFFFFF_to32(A, low31b); shr64u_31(A, r31b); v64[0]=0; v64[1]=0; v64[2]=0; v64[3]=0; add64(v64, low31b); add64(v64, r31b); // v = 32位，取 v64 的低两段 short v_lo = v64[0]; short v_hi = (short)(v64[1] & 0x7FFF); // 只保留31位 // System.arraycopy(LFSR, 1, LFSR, 0, 15); // LFSR_lo 向左移 for (short i = 0; i < (short)15; i++) { state.LFSR_lo[i] = state.LFSR_lo[(short)(i + 1)]; } // LFSR_hi 向左移 for (short i = 0; i < (short)15; i++) { state.LFSR_hi[i] = state.LFSR_hi[(short)(i + 1)]; } // LFSR[15] = v; // ---- 写回 LFSR[15] ---- state.LFSR_lo[15] = v_lo; state.LFSR_hi[15] = v_hi; // state.R1 = R1; // state.R2 = R2; state.R1_lo = R1[0]; state.R1_hi = R1[1]; state.R2_lo = R2[0]; state.R2_hi = R2[1]; // return Z; out[0] = Z[0]; out[1] = Z[1]; } // 生成指定长度的密钥流 public static void zuc256GenerateKeystream(Zuc256State state, short nwords, short[] keystream_hi, short[] keystream_lo) { // 临时存放一个 32 位关键字 short[] tmp = JCSystem.makeTransientShortArray((short)2, JCSystem.MEMORY_TYPE_TRANSIENT_RESET); for (short i = 0; i < nwords; i++) { // 生成一个关键字 -> tmp[0]=lo, tmp[1]=hi zuc256GenerateKeyword(state, tmp); // 存入输出数组 keystream_lo[i] = tmp[0]; keystream_hi[i] = tmp[1]; } } // 初始化MAC密钥 private static void zuc256SetMacKey(Zuc256State state, byte[] K, byte[] IV, short macbits) { short[] D = JCSystem.makeTransientShortArray(Zuc256Tables.D_COLS, JCSystem.MEMORY_TYPE_TRANSIENT_RESET); short[] TMP = JCSystem.makeTransientShortArray((short)2, JCSystem.MEMORY_TYPE_TRANSIENT_RESET); short[] X0 = JCSystem.makeTransientShortArray((short)2, JCSystem.MEMORY_TYPE_TRANSIENT_RESET); short[] X1 = JCSystem.makeTransientShortArray((short)2, JCSystem.MEMORY_TYPE_TRANSIENT_RESET); short[] X2 = JCSystem.makeTransientShortArray((short)2, JCSystem.MEMORY_TYPE_TRANSIENT_RESET); short[] R1 = JCSystem.makeTransientShortArray((short)2, JCSystem.MEMORY_TYPE_TRANSIENT_RESET); short[] R2 = JCSystem.makeTransientShortArray((short)2, JCSystem.MEMORY_TYPE_TRANSIENT_RESET); short[] W = JCSystem.makeTransientShortArray((short)2, JCSystem.MEMORY_TYPE_TRANSIENT_RESET); short[] W1 = JCSystem.makeTransientShortArray((short)2, JCSystem.MEMORY_TYPE_TRANSIENT_RESET); short[] W2 = JCSystem.makeTransientShortArray((short)2, JCSystem.MEMORY_TYPE_TRANSIENT_RESET); short[] U = JCSystem.makeTransientShortArray((short)2, JCSystem.MEMORY_TYPE_TRANSIENT_RESET); short[] V = JCSystem.makeTransientShortArray((short)2, JCSystem.MEMORY_TYPE_TRANSIENT_RESET); short[] T = JCSystem.makeTransientShortArray((short)2, JCSystem.MEMORY_TYPE_TRANSIENT_RESET); short[] T2 = JCSystem.makeTransientShortArray((short)2, JCSystem.MEMORY_TYPE_TRANSIENT_RESET); // int IV17 = (IV[17] & 0xFF) >> 2; // int IV18 = ((IV[17] & 0x03) << 4) | ((IV[18] & 0xFF) >> 4); // int IV19 = ((IV[18] & 0x0F) << 2) | ((IV[19] & 0xFF) >> 6); // int IV20 = IV[19] & 0x3F; // int IV21 = (IV[20] & 0xFF) >> 2; // int IV22 = ((IV[20] & 0x03) << 4) | ((IV[21] & 0xFF) >> 4); // int IV23 = ((IV[21] & 0x0F) << 2) | ((IV[22] & 0xFF) >> 6); // int IV24 = IV[22] & 0x3F; // IV 拆分 short IV17 = (short)((IV[17] & 0xFF) >>> 2); short IV18 = (short)(((IV[17] & 0x03) << 4) | ((IV[18] & 0xFF) >>> 4)); short IV19 = (short)(((IV[18] & 0x0F) << 2) | ((IV[19] & 0xFF) >>> 6)); short IV20 = (short)(IV[19] & 0x3F); short IV21 = (short)((IV[20] & 0xFF) >>> 2); short IV22 = (short)(((IV[20] & 0x03) << 4) | ((IV[21] & 0xFF) >>> 4)); short IV23 = (short)(((IV[21] & 0x0F) << 2) | ((IV[22] & 0xFF) >>> 6)); short IV24 = (short)(IV[22] & 0x3F); // D = (macbits / 32 < 3) ? Zuc256Tables.ZUC256_D[macbits / 32] : Zuc256Tables.ZUC256_D[3]; short row = (short)((macbits / 32) < 3 ? (macbits / 32) : 3); Zuc256Tables.getDRow(row, D, (short)0); Zuc256Tables.getDRow(row, D, (short)0); short[] tmp = new short[2]; // 临时存储 makeU31 输出 (lo,hi) // 逐项装载 LFSR // LFSR[0] = makeU31(K[0] & 0xFF, D[0], K[21] & 0xFF, K[16] & 0xFF); makeU31((short)(K[0] & 0xFF), (short)D[0], (short)(K[21] & 0xFF), (short)(K[16] & 0xFF), tmp); state.LFSR_lo[0] = tmp[0]; state.LFSR_hi[0] = tmp[1]; // LFSR[1] = makeU31(K[1] & 0xFF, D[1], K[22] & 0xFF, K[17] & 0xFF); makeU31((short)(K[1] & 0xFF), (short)D[1], (short)(K[22] & 0xFF), (short)(K[17] & 0xFF), tmp); state.LFSR_lo[1] = tmp[0]; state.LFSR_hi[1] = tmp[1]; // LFSR[2] = makeU31(K[2] & 0xFF, D[2], K[23] & 0xFF, K[18] & 0xFF); makeU31((short)(K[2] & 0xFF), (short)D[2], (short)(K[23] & 0xFF), (short)(K[18] & 0xFF), tmp); state.LFSR_lo[2] = tmp[0]; state.LFSR_hi[2] = tmp[1]; // LFSR[3] = makeU31(K[3] & 0xFF, D[3], K[24] & 0xFF, K[19] & 0xFF); makeU31((short)(K[3] & 0xFF), (short)D[3], (short)(K[24] & 0xFF), (short)(K[19] & 0xFF), tmp); state.LFSR_lo[3] = tmp[0]; state.LFSR_hi[3] = tmp[1]; // LFSR[4] = makeU31(K[4] & 0xFF, D[4], K[25] & 0xFF, K[20] & 0xFF); makeU31((short)(K[4] & 0xFF), (short)D[4], (short)(K[25] & 0xFF), (short)(K[20] & 0xFF), tmp); state.LFSR_lo[4] = tmp[0]; state.LFSR_hi[4] = tmp[1]; // LFSR[5] = makeU31(IV[0] & 0xFF, (D[5] | IV17), K[5] & 0xFF, K[26] & 0xFF); makeU31((short)(IV[0] & 0xFF), (short)(D[5] | IV17), (short)(K[5] & 0xFF), (short)(K[26] & 0xFF), tmp); state.LFSR_lo[5] = tmp[0]; state.LFSR_hi[5] = tmp[1]; // LFSR[6] = makeU31(IV[1] & 0xFF, (D[6] | IV18), K[6] & 0xFF, K[27] & 0xFF); makeU31((short)(IV[1] & 0xFF), (short)(D[6] | IV18), (short)(K[6] & 0xFF), (short)(K[27] & 0xFF), tmp); state.LFSR_lo[6] = tmp[0]; state.LFSR_hi[6] = tmp[1]; // LFSR[7] = makeU31(IV[10] & 0xFF, (D[7] | IV19), K[7] & 0xFF, IV[2] & 0xFF); makeU31((short)(IV[10] & 0xFF), (short)(D[7] | IV19), (short)(K[7] & 0xFF), (short)(IV[2] & 0xFF), tmp); state.LFSR_lo[7] = tmp[0]; state.LFSR_hi[7] = tmp[1]; // LFSR[8] = makeU31(K[8] & 0xFF, (D[8] | IV20), IV[3] & 0xFF, IV[11] & 0xFF); makeU31((short)(K[8] & 0xFF), (short)(D[8] | IV20), (short)(IV[3] & 0xFF), (short)(IV[11] & 0xFF), tmp); state.LFSR_lo[8] = tmp[0]; state.LFSR_hi[8] = tmp[1]; // LFSR[9] = makeU31(K[9] & 0xFF, (D[9] | IV21), IV[12] & 0xFF, IV[4] & 0xFF); makeU31((short)(K[9] & 0xFF), (short)(D[9] | IV21), (short)(IV[12] & 0xFF), (short)(IV[4] & 0xFF), tmp); state.LFSR_lo[9] = tmp[0]; state.LFSR_hi[9] = tmp[1]; // LFSR[10] = makeU31(IV[5] & 0xFF, (D[10] | IV22), K[10] & 0xFF, K[28] & 0xFF); makeU31((short)(IV[5] & 0xFF), (short)(D[10] | IV22), (short)(K[10] & 0xFF), (short)(K[28] & 0xFF), tmp); state.LFSR_lo[10] = tmp[0]; state.LFSR_hi[10] = tmp[1]; // LFSR[11] = makeU31(K[11] & 0xFF, (D[11] | IV23), IV[6] & 0xFF, IV[13] & 0xFF); makeU31((short)(K[11] & 0xFF), (short)(D[11] | IV23), (short)(IV[6] & 0xFF), (short)(IV[13] & 0xFF), tmp); state.LFSR_lo[11] = tmp[0]; state.LFSR_hi[11] = tmp[1]; // LFSR[12] = makeU31(K[12] & 0xFF, (D[12] | IV24), IV[7] & 0xFF, IV[14] & 0xFF); makeU31((short)(K[12] & 0xFF), (short)(D[12] | IV24), (short)(IV[7] & 0xFF), (short)(IV[14] & 0xFF), tmp); state.LFSR_lo[12] = tmp[0]; state.LFSR_hi[12] = tmp[1]; // LFSR[13] = makeU31(K[13] & 0xFF, D[13], IV[15] & 0xFF, IV[8] & 0xFF); makeU31((short)(K[13] & 0xFF), (short)D[13], (short)(IV[15] & 0xFF), (short)(IV[8] & 0xFF), tmp); state.LFSR_lo[13] = tmp[0]; state.LFSR_hi[13] = tmp[1]; // LFSR[14] = makeU31(K[14] & 0xFF, (D[14] | (K[31] >>> 4)), IV[16] & 0xFF, IV[9] & 0xFF); makeU31((short)(K[14] & 0xFF), (short)(D[14] | ((K[31] & 0xFF) >>> 4)), (short)(IV[16] & 0xFF), (short)(IV[9] & 0xFF), tmp); state.LFSR_lo[14] = tmp[0]; state.LFSR_hi[14] = tmp[1]; // LFSR[15] = makeU31(K[15] & 0xFF, (D[15] | (K[31] & 0x0F)), K[30] & 0xFF, K[29] & 0xFF); makeU31((short)(K[15] & 0xFF), (short)(D[15] | (K[31] & 0x0F)), (short)(K[30] & 0xFF), (short)(K[29] & 0xFF), tmp); state.LFSR_lo[15] = tmp[0]; state.LFSR_hi[15] = tmp[1]; for (short i = 0; i < 32; i++) { // BitReconstruction3 // X0 = ((LFSR[15] & 0x7FFF8000) << 1) | (LFSR[14] & 0xFFFF); // X0 = ((L15 & 0x7FFF8000)<<1) | (L14 & 0xFFFF) short c15 = (short)((state.LFSR_lo[15] & (short)0x8000) >>> 15); X0[1] = (short)(((state.LFSR_hi[15] & (short)0x7FFF) << 1) | c15); X0[0] = state.LFSR_lo[14]; // X1 = ((LFSR[11] & 0xFFFF) << 16) | (LFSR[9] >>> 15); // X1 = ((L11 & 0xFFFF)<<16) | (L9>>>15) X1[1] = state.LFSR_lo[11]; X1[0] = (short)(((state.LFSR_lo[9] & (short)0x8000) >>> 15) | (state.LFSR_hi[9] << 1)); // X2 = ((LFSR[7] & 0xFFFF) << 16) | (LFSR[5] >>> 15); // X2 = ((L7 & 0xFFFF)<<16) | (L5>>>15) X2[1] = state.LFSR_lo[7]; X2[0] = (short)(((state.LFSR_lo[5] & (short)0x8000) >>> 15) | (state.LFSR_hi[5] << 1)); // F(X0, X1, X2) // W = (X0 ^ R1) + R2 xor32(X0[0], X0[1], R1[0], R1[1], TMP); add32(TMP[0], TMP[1], R2[0], R2[1], W); // W1 = R1 + X1 add32(R1[0], R1[1], X1[0], X1[1], W1); // W2 = R2 ^ X2 xor32(R2[0], R2[1], X2[0], X2[1], W2); // U = L1((W1<<16) | (W2>>>16)) L1(W2[1], W1[0], U); // V = L2((W2<<16) | (W1>>>16)) L2(W1[1], W2[0], V); // R1 = makeU32(Zuc256Tables.S0[(U >>> 24) & 0xFF], // Zuc256Tables.S1[(U >>> 16) & 0xFF], // Zuc256Tables.S0[(U >>> 8) & 0xFF], // Zuc256Tables.S1[U & 0xFF]); // // R2 = makeU32(Zuc256Tables.S0[(V >>> 24) & 0xFF], // Zuc256Tables.S1[(V >>> 16) & 0xFF], // Zuc256Tables.S0[(V >>> 8) & 0xFF], // Zuc256Tables.S1[V & 0xFF]); // 更新 R1,R2 makeU32( (short)(Zuc256Tables.S0[((U[1] >>> 8) & 0xFF)] & 0xFF), (short)(Zuc256Tables.S1[(U[1] & 0xFF)] & 0xFF), (short)(Zuc256Tables.S0[((U[0] >>> 8) & 0xFF)] & 0xFF), (short)(Zuc256Tables.S1[(U[0] & 0xFF)] & 0xFF), R1); makeU32( (short)(Zuc256Tables.S0[((V[1] >>> 8) & 0xFF)] & 0xFF), (short)(Zuc256Tables.S1[(V[1] & 0xFF)] & 0xFF), (short)(Zuc256Tables.S0[((V[0] >>> 8) & 0xFF)] & 0xFF), (short)(Zuc256Tables.S1[(V[0] & 0xFF)] & 0xFF), R2); // LFSRWithInitialisationMode(W >> 1) // int v = LFSR[0]; V[0] = state.LFSR_lo[0]; V[1] = state.LFSR_hi[0]; // v = add31(v, rot31(state.LFSR[0], 8)) rot31(state.LFSR_lo[0], state.LFSR_hi[0], (short)8, T); add31(V[0], V[1], T[0], T[1], V); // v = add31(v, rot31(state.LFSR[4], 20)); rot31(state.LFSR_lo[4], state.LFSR_hi[4], (short)20, T); add31(V[0], V[1], T[0], T[1], V); // v = add31(v, rot31(state.LFSR[10], 21)); rot31(state.LFSR_lo[10], state.LFSR_hi[10], (short)21, T); add31(V[0], V[1], T[0], T[1], V); // v = add31(v, rot31(state.LFSR[13], 17)); rot31(state.LFSR_lo[13], state.LFSR_hi[13], (short)17, T); add31(V[0], V[1], T[0], T[1], V); // v = add31(v, rot31(state.LFSR[15], 15)); rot31(state.LFSR_lo[15], state.LFSR_hi[15], (short)15, T); add31(V[0], V[1], T[0], T[1], V); // v = add31(v, W >>> 1); shr32u1(W[0], W[1], T2); // T2[0]=lo, T2[1]=hi（无符号>>>1） T2[1] = (short)(T2[1] & 0x7FFF); // 只保留31位 add31(V[0], V[1], T2[0], T2[1], V); // System.arraycopy(state.LFSR, 1, state.LFSR, 0, 15) // 相当于 System.arraycopy(state.LFSR_lo, 1, state.LFSR_lo, 0, 15); for (short j = 0; j < (short)15; j++) { state.LFSR_lo[j] = state.LFSR_lo[(short)(j + 1)]; } // 相当于 System.arraycopy(state.LFSR_hi, 1, state.LFSR_hi, 0, 15); for (short j = 0; j < (short)15; j++) { state.LFSR_hi[j] = state.LFSR_hi[(short)(j + 1)]; } // state.LFSR[15] = v; state.LFSR_lo[15] = V[0]; state.LFSR_hi[15] = (short)(V[1] & 0x7FFF); } // BitReconstruction2 // X1 = ((LFSR[11] & 0xFFFF) << 16) | (LFSR[9] >>> 15); X1[1] = state.LFSR_lo[11]; X1[0] = (short)(((state.LFSR_lo[9] & (short)0x8000) >>> 15) | (state.LFSR_hi[9] << 1)); // X2 = ((LFSR[7] & 0xFFFF) << 16) | (LFSR[5] >>> 15); X2[1] = state.LFSR_lo[7]; X2[0] = (short)(((state.LFSR_lo[5] & (short)0x8000) >>> 15) | (state.LFSR_hi[5] << 1)); // F_(X1, X2) // W1 = R1 + X1; add32(state.R1_lo, state.R1_hi, X1[0], X1[1], W1); // W1 = R1 + X1 // W2 = R2 ^ X2; xor32(state.R2_lo, state.R2_hi, X2[0], X2[1], W2); // W2 = R2 ^ X2 // U = L1((W1 << 16) | (W2 >>> 16)); // U = L1((W1<<16)|(W2>>>16)) → lo=W2_hi, hi=W1_lo L1(W2[1], W1[0], U); // V = L2((W2 << 16) | (W1 >>> 16)); // V = L2((W2<<16)|(W1>>>16)) → lo=W1_hi, hi=W2_lo L2(W1[1], W2[0], V); // R1 = makeU32(Zuc256Tables.S0[(U >>> 24) & 0xFF], // Zuc256Tables.S1[(U >>> 16) & 0xFF], // Zuc256Tables.S0[(U >>> 8) & 0xFF], // Zuc256Tables.S1[U & 0xFF]); makeU32( (short)(Zuc256Tables.S0[((U[1] >>> 8) & 0xFF)] & 0xFF), (short)(Zuc256Tables.S1[(U[1] & 0xFF)] & 0xFF), (short)(Zuc256Tables.S0[((U[0] >>> 8) & 0xFF)] & 0xFF), (short)(Zuc256Tables.S1[(U[0] & 0xFF)] & 0xFF), R1); // R2 = makeU32(Zuc256Tables.S0[(V >>> 24) & 0xFF], // Zuc256Tables.S1[(V >>> 16) & 0xFF], // Zuc256Tables.S0[(V >>> 8) & 0xFF], // Zuc256Tables.S1[V & 0xFF]); makeU32( (short)(Zuc256Tables.S0[((V[1] >>> 8) & 0xFF)] & 0xFF), (short)(Zuc256Tables.S1[(V[1] & 0xFF)] & 0xFF), (short)(Zuc256Tables.S0[((V[0] >>> 8) & 0xFF)] & 0xFF), (short)(Zuc256Tables.S1[(V[0] & 0xFF)] & 0xFF), R2); // ---- LFSRWithWorkMode ---- short[] A = new short[4]; // 64位累加器 short[] tmp32 = new short[2]; short[] tmp64 = new short[4]; // LFSRWithWorkMode // long a = LFSR[0]; tmp32[0] = state.LFSR_lo[0]; tmp32[1] = state.LFSR_hi[0]; create_64b_from_32b(tmp64, tmp32, (short)0); add64(A, tmp64); // a += (long)LFSR[0] << 8; create_64b_from_32b(tmp64, tmp32, (short)8); add64(A, tmp64); // a += (long)LFSR[4] << 20; tmp32[0] = state.LFSR_lo[4]; tmp32[1] = state.LFSR_hi[4]; create_64b_from_32b(tmp64, tmp32, (short)20); add64(A, tmp64); // a += (long)LFSR[10] << 21; tmp32[0] = state.LFSR_lo[10]; tmp32[1] = state.LFSR_hi[10]; create_64b_from_32b(tmp64, tmp32, (short)21); add64(A, tmp64); // a += (long)LFSR[13] << 17; tmp32[0] = state.LFSR_lo[13]; tmp32[1] = state.LFSR_hi[13]; create_64b_from_32b(tmp64, tmp32, (short)17); add64(A, tmp64); // a += (long)LFSR[15] << 15; tmp32[0] = state.LFSR_lo[15]; tmp32[1] = state.LFSR_hi[15]; create_64b_from_32b(tmp64, tmp32, (short)15); add64(A, tmp64); // a = (a & 0x7FFFFFFF) + (a >>> 31); short[] low31 = new short[4]; short[] r31 = new short[4]; and64_7FFFFFFF_to32(A, low31); shr64u_31(A, r31); short[] v64 = new short[4]; add64(v64, low31); add64(v64, r31); // int v = (int) ((a & 0x7FFFFFFF) + (a >>> 31)); and64_7FFFFFFF_to32(v64, low31); shr64u_31(v64, r31); short[] vv = new short[4]; add64(vv, low31); add64(vv, r31); short v_lo = vv[0]; short v_hi = (short)(vv[1] & 0x7FFF); // LFSR左移 // System.arraycopy(LFSR, 1, LFSR, 0, 15); // LFSR_lo 向左移 for (short i = 0; i < (short)15; i++) { state.LFSR_lo[i] = state.LFSR_lo[(short)(i + 1)]; } // LFSR_hi 向左移 for (short i = 0; i < (short)15; i++) { state.LFSR_hi[i] = state.LFSR_hi[(short)(i + 1)]; } // LFSR[15] = v; state.LFSR_lo[15] = v_lo; state.LFSR_hi[15] = v_hi; state.R1_lo = R1[0]; state.R1_hi = R1[1]; state.R2_lo = R2[0]; state.R2_hi = R2[1]; } }