1	# CAST-128: RFC 2144 B.1's three vectors, both ways (the ciphertext, then
2	# the plaintext decrypted back), and CAST-128 through modes64.bend's CBC over
3	# 16 KB both ways.
4	import Base
5	import bend-osdev-bytes@0.1.1.0/bytes.bend as B
6	import bend-osdev-cipher-core@0.1.0.0/cipher_core.bend as L
7	import bend-osdev-cipher-core@0.1.0.0/modes64.bend as X
8	import ./cast5.bend as C5
9	
10	def err(e: L.LcError) -> String:
11	  match e:
12	    case L.LcBadKeyLength{n}:
13	      "bad key " ++ Nat.show(n)
14	    case L.LcBadIvLength{n}:
15	      "bad iv " ++ Nat.show(n)
16	    case L.LcNotBlockMultiple{n}:
17	      "not whole blocks " ++ Nat.show(n)
18	
19	def b64.of(m: Maybe<&2, L.LcBlock64>) -> L.LcBlock64:
20	  match m:
21	    case None{}:
22	      L.LcBlock64.zero()
23	    case Some{b}:
24	      b
25	
26	def b64(o: B.Octets) -> L.LcBlock64:
27	  b64.of(L.LcBlock64.of_octets(o))
28	
29	def key(~K: Data, r: Result<&2, &2, L.LcError, K>, d: K) -> K:
30	  match r:
31	    case Fail{e}:
32	      d
33	    case Done{k}:
34	      k
35	
36	def both64(~K: Data, ~enc: K -> L.LcBlock64 -> L.LcBlock64, ~dec: K -> L.LcBlock64 -> L.LcBlock64, +k: K, b: L.LcBlock64) -> String:
37	  +c = enc(k, b)
38	  L.LcBlock64.hex(c) ++ " " ++ L.LcBlock64.hex(dec(k, c))
39	
40	def cast5_key(k: B.Octets) -> C5.LcCast5Key:
41	  key(~C5.LcCast5Key, C5.LcCast5.key(k), C5.LcCast5Key{Nil{}})
42	
43	def cast5(k: B.Octets, b: B.Octets) -> String:
44	  both64(~C5.LcCast5Key, ~C5.LcCast5.encrypt, ~C5.LcCast5.decrypt, cast5_key(k), b64(b))
45	
46	# n bytes, byte i = 7i + 3 (mod 256)
47	def big.go(n: Nat, +i: U32, acc: List<&2, U32>) -> List<&2, U32>:
48	  match n:
49	    case 0n:
50	      B.rev(acc)
51	    case 1n+p:
52	      big.go(p, U32.add(i, 1), Con{U32.and(255, U32.add(U32.mul(i, 7), 3)), acc})
53	
54	def big(n: Nat) -> B.Octets:
55	  B.Octets.of_list(big.go(n, 0, Nil{}))
56	
57	def verdict(b: Bool) -> String:
58	  match b:
59	    case True{}:
60	      "ok"
61	    case False{}:
62	      "differs"
63	
64	def last8(r: Result<&2, &2, L.LcError, B.Octets>) -> String:
65	  match r:
66	    case Fail{e}:
67	      err(e)
68	    case Done{+o}:
69	      B.Octets.hex(B.Octets.drop(Nat.sub(B.Octets.len(o), 8n), o))
70	
71	def same64(r: Result<&2, &2, L.LcError, B.Octets>, +m: B.Octets) -> String:
72	  match r:
73	    case Fail{e}:
74	      err(e)
75	    case Done{o}:
76	      verdict(B.Octets.is_eq(o, m))
77	
78	def cbc64(~K: Data, ~enc: K -> L.LcBlock64 -> L.LcBlock64, ~dec: K -> L.LcBlock64 -> L.LcBlock64, +k: K, n: Nat) -> String:
79	  +m = big(n)
80	  +c = X.Lc64.cbc_encrypt(~K, ~enc, k, B.Octets.zeros(8n), m)
81	  last8(c) ++ " " ++ same64(Result.bind(&2, &2, L.LcError, B.Octets, B.Octets, c, x => X.Lc64.cbc_decrypt(~K, ~dec, k, B.Octets.zeros(8n), x)), m)
82	
83	def cast5_cbc(k: B.Octets, n: Nat) -> String:
84	  cbc64(~C5.LcCast5Key, ~C5.LcCast5.encrypt, ~C5.LcCast5.decrypt, cast5_key(k), n)
85	
86	# BEGIN GENERATED by gen/vectors.py: check
87	def main() -> IO(Unit):
88	  do IO<Unit>:
89	    IO.print(cast5(B.Octets.of_list([1, 35, 69, 103, 18, 52, 86, 120, 35, 69, 103, 137, 52, 86, 120, 154]), B.Octets.of_list([1, 35, 69, 103, 137, 171, 205, 239])))
90	    IO.print(cast5(B.Octets.of_list([1, 35, 69, 103, 18, 52, 86, 120, 35, 69]), B.Octets.of_list([1, 35, 69, 103, 137, 171, 205, 239])))
91	    IO.print(cast5(B.Octets.of_list([1, 35, 69, 103, 18]), B.Octets.of_list([1, 35, 69, 103, 137, 171, 205, 239])))
92	    IO.print(cast5_cbc(B.Octets.of_list([1, 35, 69, 103, 137, 171, 205, 239, 254, 220, 186, 152, 118, 84, 50, 16]), 16384n))
93	
94	#|238b4fe5847e44b2 0123456789abcdef
95	#|eb6a711a2c02271b 0123456789abcdef
96	#|7ac816d16e9b302e 0123456789abcdef
97	#|1701cdf260449014 ok
98	# END GENERATED: check