safer.c
`
`Exhibit D
`
`Petitioner Oracle-Apple - Exhibit 1010 - Page 304
`
`

`
`/*‘k‘k******‘k‘k******‘k‘k****‘k‘k‘k‘k*****‘k‘k*9:****‘k‘k*9:***********************************
`
`* *
`
`* *
`
`FILE:
`
`safer.c
`
`DESCRIPTION:
`
`block-cipher algorithm SAFER (Secure And Fast Encryption
`Routine)
`in its four Versions: SAFER K-64, SAFER K—l28,
`SAFER SK—64 and SAFER SK—l28.
`
`AUTHOR:
`
`Richard De Moliner (demoliner@isi.ee.ethz.ch)
`
`Signal and Information Processing Laboratory
`
`Swiss Federal Institute of Technology
`CH-8092 Zuerich, Switzerland
`
`DATE:
`
`September 9, 1995
`
`CHANGE HISTORY:
`
`********************************************9:********9:*******~k**~k*****~k**~k****[
`
`*
`*
`
`* *
`
`*
`
`*
`*
`
`* *
`
`* *
`
`* *
`
`[*k*k*k*k*-k-k-k***k‘k*k-k-k-k**‘k
`
`Headers -k-k-kVkVkVkVkVk-k-k-k*9:*9:*9:************************[
`
`[~k*-k-k-k-k-k~k~k*-k-k-k-k-k~k~k*-k Local Headers -k-k-k-k-k‘k‘k‘k-k-k-k-k-k‘k*9:****************************[
`#inc1ude "safer.h"
`
`[******************* Constants *‘I:**********************************************[
`
`#define TAB_LEN
`
`256
`
`[******************* Assertions ************9:**********************************[
`
`[******************* Macros ‘I:**************************************************[
`
`#define ROL(x, n)
`
`((unsigned char)((unsigned int)(x) << (n)\
`
`#define EXP(x)
`
`#define LOG(x)
`
`|(unsigned int)((x) & OXFF) >> (8 —
`exp_tab[(x) & OxFF]
`
`(n))))
`
`log_tab[(x) & 0xFF]
`
`#define PHT(x, y)
`
`{ y += x; x += y;
`
`#define IPHT(x, y)
`
`{ x -= y; y -= X;
`
`}
`
`}
`
`[~k‘k-k-k-k-k-k~k~k*-k-k-k-k-k~k**-k Types -k-k-k-k-k~k~k*-k-k-k-k-k~k‘kVk-k-k-k-k-k~k******************************[
`
`static unsigned char exp_tab[TAB_LEN];
`
`static unsigned char log_tab[TAB_LEN];
`
`[*******************
`
`**********************************************[
`
`[******************* Functions *1:***********************************************[
`
`[***~k********************************************9:******9:~k*~k*~k*************~k***[
`
`#ifndef NOT_ANSI_C
`
`void Safer_Init_Module(void)
`#e1se
`
`Safer_Init_Module()
`#endif
`
`{
`
`unsigned int i, exp;
`
`exp = 1’
`i < TAB_LEN;
`for (i = O;
`EXNDHD
`
`i++)
`
`Petitioner Oracle-Apple — Exhibit 1010 — Page 305
`
`

`
`exp_tab[i1 =
`
`(unsigned char)(exp & OXFF);
`
`=
`1og_tab[exp_tab[i]]
`exp = exp * 45 % 257;
`
`(unsigned char)i;
`
`}
`
`}
`
`/* Safer_Init_Modu1e */
`
`/***‘k‘k****‘k*‘k‘k‘k‘k‘k***‘k‘k‘k‘k‘k*‘k‘k***‘k‘k***‘k‘k‘k*****‘k‘k‘k‘k‘k‘k*****‘k***********************/
`
`#ifndef NOT_ANSI_C
`
`void Safer_Expand_Userkey(safer_b1ock_t userkey_1,
`
`safer_b1ock_t userkey_2,
`
`unsigned int nof_rounds,
`int strengthened,
`
`safer_key_t key)
`
`#e1se
`
`Safer_Expand_Userkey(userkey_1, userkey_2, nof_rounds, strengthened, key)
`safer_b1ock_t userkey_1;
`
`safer_b1ock_t userkey_2;
`
`unsigned int nof_rounds;
`int strengthened;
`
`safer_key_t key;
`#endif
`
`{
`
`unsigned int i, j;
`unsigned char ka[SAFER_BLOCK_LEN + 11;
`
`unsigned char kb[SAFER_BLOCK_LEN + 1];
`
`if (SAFER_MAX_NOF_ROUNDS < nof_rounds)
`nof_rounds = SAFER_MAX_NOF_ROUNDS;
`
`*key++ =
`
`(unsigned char)nof_rounds;
`
`ka[SAFER_BLOCK_LEN]
`
`= O;
`
`kb[SAFER_BLOCK_LEN]
`
`= O;
`
`for (j = 0;
`
`j
`
`< SAFER_BLOCK_LEN;
`
`j++)
`
`{
`
`} f
`
`{
`
`ka[SAFER_BLOCK_LEN1 *= ka[j]
`
`= ROL(userkey_1[j1, 5);
`
`kb[SAFER_BLOCK_LEN1
`
`*= kb[j]
`
`= *key++ = userkey_2[j1;
`
`or (i = 1;
`
`i <= nof_rounds;
`
`i++)
`
`for (j = 0;
`
`j
`
`< SAFER_BLOCK_LEN + 1;
`
`j++)
`
`{
`
`} f
`
`ka[j]
`
`= ROL(ka[j]. 6);
`
`kb[j]
`
`= RoL(kb[j]. 6);
`
`< SAFER_BLOCK_LEN;
`j
`or (j = 0;
`if (strengthened)
`
`j++)
`
`*key++ = (ka[(j + 2 * i —
`
`l) % (SAFER_BLOCK_LEN + 1)]
`
`+ exp_tab[exp_tab[l8 * i + j + 11]) & 0xFF;
`
`else
`
`*key++ =
`
`(ka[j]
`
`+ exp_tab[exp_tab[l8 * i + j + 11]) & OXFF;
`
`< SAFER_BLOCK_LEN;
`j
`for (j = 0;
`if (strengthened)
`
`j++)
`
`*key++ =
`
`(kb[(j + 2 * i) % (SAFER_BLOCK_LEN + 1)]
`
`+ exp_tab[exp_tab[l8 * i + j + 101]) & OXFF;
`
`else
`
`*key++
`EXNDHD
`
`(kb[j]
`
`Petitioner Oracle-Apple — Exhibit 1010 — Page 306
`+ exp_tab[exp_tab[l8 * i + j + 101]) & OXFF;
`
`

`
`} f
`
`< SAFER_BLOCK_LEN + 1;
`j
`or (j = 0;
`ka[j]
`= kb[j]
`= 0;
`
`j++)
`
`}
`
`/* Safer_Expand_Userkey */
`
`[~k~k~k******************************************************************~k********[
`
`#ifndef NOT_ANSI_C
`
`void Safer_EnCrypt_B1oCk(safer_b1oCk_t b1oCk_in, safer_key_t key,
`
`safer_b1oCk_t b1oCk_out)
`
`#e1se
`
`Safer_EnCrypt_B1oCk(b1oCk_in, key, b1oCk_out)
`
`safer_b1oCk_t b1oCk_in;
`safer_key_t key;
`
`safer_b1oCk_t b1oCk_out;
`#endif
`
`{
`
`unsigned Char a, b, C, d, e, f, g, h, t;
`unsigned int round;
`
`a = b1ock_in[O]; b = b1oCk_in[1];
`
`e = b1oCk_in[4];
`
`f = b1ock_in[5];
`
`if (SAFER_MAX_NOF_ROUNDS <
`whi1e(round--)
`
`(round
`
`IILQO
`
`= b1ock_in[2]; d = b1ock_in[3];
`
`= b1ock_in[6]; h = b1oCk_in[7];
`
`*key))
`
`round = SAFER_MAX_NOF_ROUNDS;
`
`A: *++key; b +: *++key; C +: *++key; d A: *++key;
`
`A: *++key;
`
`f +: *++key; g +: *++key; h A: *++key;
`
`= EXP(a)
`
`+ *++key; b = LOG(b)
`
`A *++key;
`
`: LOG(C)
`
`A *++key;
`
`: EXP(e)
`
`+ *++key;
`
`: EXP(d)
`
`+ *++key;
`
`: LOG(f)
`
`A *++key;
`
`I3"|'hQ-
`
`+ *++key;
`= EXP(h)
`A *++key;
`= LOG(g)
`PHT(a, b); PHT(C, d); PHT(e, f); PHT(g, h);
`
`LQFDOQJQQJ
`
`{
`
`} a
`
`PHT(a, C); PHT(e, g); PHT(b, d); PHT(f, h);
`
`PHT(a, e); PHT(b, f); PHT(C, g); PHT(d, h);
`
`t = b; b = e; e = C; C = t; t = d; d = f;
`
`f = g; g = t;
`
`A: *++key; b +: *++key; C +: *++key; d
`
`: *++key;
`
`e A: *++key;
`
`f +: *++key; g +: *++key; h A: *++key;
`
`b1ock_out[O]
`
`= a & OxFF; b1oCk_out[l]
`
`= b & OXFF;
`
`b1ock_out[2]
`
`= C & OxFF; b1oCk_out[3]
`
`= d & OxFF;
`
`b1oCk_out[4]
`
`= e & OxFF; b1oCk_out[5]
`
`= f & OXFF;
`
`b1oCk_out[6]
`
`= g & OXFF; b1oCk_out[7]
`
`= h & OxFF;
`
`}
`
`/* Safer_EnCrypt Block */
`
`[~k~k~k******************************************************************~k********[
`
`#ifndef NOT_ANSI_C
`
`void Safer_DeCrypt_B1oCk(safer_b1oCk_t b1oCk_in, safer_key_t key,
`
`safer_b1oCk_t b1oCk_out)
`
`#e1se
`
`Safer_DeCrypt_B1oCk(b1oCk_in, key, b1oCk_out)
`
`safer_b1oCk_t b1oCk_in;
`
`safer_key_t key;
`
`safer_b1oCk_t b1oCk_out;
`#endif
`
`{
`
`unsigned Char 5“ b’ C’ d’ e’
`unsigned int round;
`EXNbflD
`
`f’ 9' h’
`
`t’
`
`Petitioner Oracle-Apple-Exhibit1010-Page 307
`
`

`
`block_in[O]; b = block_in[l]; c = block_in[2]; d =
`
`block_in[3];
`
`block_in[4];
`
`SAFER_MAX_NOF_ROUNDS <
`
`block_in[7];
`f = block_in[5]; g = block_in[6]; h =
`SAFER_MAX_NO F_ROUNDS ;
`
`(round = *key))
`
`round =
`
`+= SAFER_BLOCK_LEN *
`*key; g —= *——key;
`
`(l + 2 * round);
`f —= *——key; e
`= *——key;
`
`a e i
`
`f (
`
`key
`
`A
`
`d w
`
`{
`
`*——key; c -= *——key; b -= *——key; a
`e (round——)
`
`hil
`
`= *——key;
`
`t = e; e = b; b = c; c = t; t = f;
`
`f = d; d = g; g = t;
`
`IPHT(a, e);
`
`IPHT(b, f); IPHT(C, g);
`
`IPHT(d, h);
`
`IPHT(a, C);
`
`IPHT(e, g);
`
`IPHT(b, d);
`
`IPHT(f, h);
`
`IPHT(a, b);
`
`IPHT(C, d);
`
`IPHT(e, f); IPHT(g, h);
`
`h -— *——key; g ‘= *——key;
`
`f ‘= *——key; e -= *——key;
`
`d -— *——key; c
`
`= *——key; b ‘= *——key; a —— *——key;
`
`h = LOG(h)
`
`" *——key; g = EXP(g)
`
`- *——key;
`
`f = EXP(f)
`
`— *——key; e = LOG(e)
`
`‘ *——key;
`
`d = LOG(d)
`
`A *——key; c = EXP(c)
`
`— *——key;
`
`b = EXP(b)
`
`— *——key; a = LOG(a)
`
`‘ *——key;
`
`k_out[O]
`
`= a & OXFF; block_out[l]
`
`= b & OxFF;
`
`k_out[2]
`
`= c & OXFF; block_out[3]
`
`= d & OxFF;
`
`k_out[4]
`
`= e & OxFF; block_out[5]
`
`= f & OXFF;
`
`k_out[6]
`
`= g & OXFF; block_out[7]
`
`= h & OxFF;
`
`}b
`
`loc
`
`bloc
`
`bloc
`
`bloc
`
`}
`
`/* Saf
`
`er_Decrypt Block */
`
`/*******
`
`****************************************************~k********~k*********[
`
`EXNbflD
`
`Petitioner Oracle-Apple - Exhibit 1010 - Page 308
`
`

`
`safer.h
`
`Exhibit D
`
`Petitioner Oracle-Apple - Exhibit 1010 - Page 309
`
`

`
`/*‘k‘k******‘k‘k******‘k‘k****‘k‘k‘k‘k*****‘k‘k*9:****‘k‘k*9:***********************************
`
`* *
`
`* *
`
`*
`*
`
`* *
`
`*
`
`*
`*
`
`* *
`
`* *
`
`* *
`
`FILE:
`
`safer.h
`
`DESCRIPTION:
`
`block-cipher algorithm SAFER (Secure And Fast Encryption
`Routine)
`in its four Versions: SAFER K-64, SAFER K—l28,
`SAFER SK—64 and SAFER SK—l28.
`
`AUTHOR:
`
`Richard De Moliner (demoliner@isi.ee.ethz.ch)
`
`Signal and Information Processing Laboratory
`
`Swiss Federal Institute of Technology
`CH-8092 Zuerich, Switzerland
`
`DATE:
`
`September 9, 1995
`
`CHANGE HISTORY:
`
`‘k‘k‘k*‘k****‘k‘k**‘k***‘k‘k**‘k***‘k‘k*‘k‘k‘k**‘k**‘k‘k***‘k**‘k‘k********************************/
`
`#ifndef SAFER_H
`
`#define SAFER_H
`
`[*******************
`
`Headers **********9:*9:*9:*9:************************[
`
`[‘k*~k‘k-k-k*k*k*k*~k‘k-k-k*k*‘k** Local Headers ‘kit-k-Ir‘):VkVk**Vk-k-kVkVk*9:****************************[
`
`[*k*k*k*k*-k-k-k****k*-k-k-k*** constants ************‘k***********************************/
`
`#define SAFER_K64_DEFAULT_NOF_ROUNDS
`
`#define SAFER_Kl28_DEFAULT_NOF_ROUNDS
`
`#define SAFER_SK64_DEFAULT_NOF_ROUNDS
`
`#define SAFER_SKl28_DEFAULT_NOF_ROUNDS
`
`#define SAFER_MAX_NOF_ROUNDS
`
`#define SAFER_BLOCK_LEN
`
`6
`
`10
`
`8
`
`10
`
`13
`
`8
`
`#define SAFER_KEY_LEN
`
`(1 + SAFER_BLOCK_LEN *
`
`(1 + 2
`
`* SAFER_MAX_NOF_ROUNDS))
`
`[******************* Assertions ************9:**********************************[
`
`[******************* Macros ***************************************************[
`
`[*k‘k*k-k-k*-k**‘k‘k-k-k*-k**k‘k‘k Types ‘k*‘k***‘k‘k‘k*******‘k*‘k******‘k‘k‘k************************/
`
`typedef unsigned char safer_block_t[SAFER_BLOCK_LEN];
`
`typedef unsigned char safer_key_t[SAFER_KEY_LEN];
`
`[~k*-k-k~k-k-k~k~k*-k-k-k~k-k~k~k*-k
`
`‘k‘k~k-k-k-k-k‘k~k*-k-k-k-k-k~k********~k**~k**~k***~k*******~k***[
`
`[*k*k*k-k-k*-k**k‘k‘k-k-k*-k*‘k‘k‘k
`
`~kVk*9:-k-k~k-k~kVk*9:-k-k~k-k~k******************************[
`
`[Vic‘kit‘kit-k-k-k‘kit‘kit‘k~k-k~k‘k‘kit‘kit-k~k-k‘k‘k‘kit‘k~k-k~k‘kick‘kit-k-k-k‘k‘kit‘kit-k~k-k*9:*****************************
`
`* void Safer_Init_Module(void)
`
`initializes this module.
`
`**************************************************9:**9:*************************
`
`* *
`
`* *
`
`* void Safer_Expand_Userkey(safer_b1ock_t userkey_l,
`
`*
`
`*
`*
`
`EXNbflD
`
`safer_b1ock_t userkey_2,
`
`unsigned int “°f—r°““dS'
`int strengthened,
`
`Petitioner Oracle-Apple — Exhibit 1010 — Page 310
`
`

`
`*
`
`*
`
`*
`
`*
`
`*
`*
`
`*
`
`*
`
`*
`
`*
`
`*
`*
`*
`
`*
`*
`
`*
`
`safer_key_t key)
`
`expands a user-selected key of length 64 bits or 128 bits to a encryption /
`
`decryption key. If your user-selected key is of length 64 bits,
`
`then give
`
`this key to both arguments 'userkey_l' and 'userkey_2', e.g.
`
`'Safer_Expand_Userkey(z, z, key)‘. Note: SAFER K-64 and SAFER SK—64 with a
`user-selected key 'z' of length 64 bits are identical to SAFER K—l28 and
`
`SAFER SK—l28 with a user-selected key 'z z‘ of length 128 bits,
`
`respectively.
`
`pre:
`
`'userkey_l'
`
`contains the first 64 bits of user key.
`
`'userkey_2'
`
`contains the second 64 bits of user key.
`
`'nof_rounds' contains the number of encryption rounds
`'nof_rounds' <= 'SAFER_MAX_NOF_ROUNDS'
`'strengthened'
`is non—zero if the strengthened key schedule should be
`
`used and zero if the original key schedule should be
`used.
`
`post:
`
`'key'
`
`contains the expanded key.
`
`******************‘I:*************************************************************
`
`* void Safer_Encrypt_Block(safer_block_t block_in, safer_key_t key,
`
`safer_block_t block_out)
`
`encryption algorithm.
`
`pre:
`
`'block_in'
`'key'
`
`contains the plain—text block.
`contains the expanded key.
`
`post:
`
`'block_out' contains the cipher—text block.
`
`*****************‘Ir*************************************************************
`
`*
`
`*
`
`*
`*
`
`*
`
`* *
`
`* void Safer_Decrypt_Block(safer_block_t block_in, safer_key_t key,
`
`safer_block_t block_out)
`
`decryption algorithm.
`
`pre:
`
`'block_in'
`'key'
`
`contains the cipher—text block.
`contains the expanded key.
`
`post:
`
`'block_out' contains the plain—text block.
`
`********************************************************~k~k~k*~k*****************[
`
`*
`
`*
`
`*
`*
`
`*
`
`* *
`
`#ifndef NOT_ANSI_C
`
`extern void Safer_Init_Module(void);
`
`extern void Safer_Expand_Userkey(safer_block_t userkey_1,
`
`safer_block_t userkey_2,
`
`unsigned int nof_rounds,
`int strengthened,
`
`safer_key_t key);
`
`extern void Safer_Encrypt_Block (safer_block_t block_in, safer_key_t key,
`
`safer_block_t block_out);
`
`extern void Safer_Decrypt_Block (safer_block_t block_in, safer_key_t key,
`
`safer_block_t block_out);
`
`#else
`
`#endif
`
`[~k~k~k******************************************************************~k********[
`
`#endif /* SAFER_H */
`
`EXNbflD
`
`Petitioner Oracle-Apple - Exhibit 1010 - Page 311
`
`

`
`shs.c
`
`Exhibit D
`
`Petitioner Oracle-Apple - Exhibit 1010 - Page 312
`
`

`
`* The authors of this software are Jim Reeds and Jack Lacy
`
`*
`
`Copyright
`
`(c) 1992, 1994 by AT&T.
`
`* Permission to use, Copy, and modify this software without fee
`
`* is hereby granted, provided that this entire notice is included in
`
`* all copies of any software which is or includes a copy or
`
`* modification of this software and in all copies of the supporting
`* documentation for such software.
`
`* This software is subject to United States export controls.
`
`* THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR IMPLIED
`
`IN PARTICULAR, NEITHER THE AUTHORS NOR AT&T MAKE ANY
`* WARRANTY.
`* REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE MERCHANTABILITY
`
`* OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR PURPOSE.
`
`* Secure Hash Standard
`
`* proposed NIST SHS
`
`* coded for byte strings: number of bits is a multiple of 8
`
`* Copyright
`
`(c) 1992, 1994 AT&T Bell Laboratories
`
`* Coded by Jim Reeds 5 Feb 1992
`* Enhanced by Jack Lacy 1993
`*/
`
`/*
`
`* unsigned long qshs(char *s,
`
`int n);
`
`input:
`
`* *
`
`*
`
`*
`* output:
`
`*
`
`s character array to be hashed
`
`n length of s in BYTES
`
`return value: address of 5 unsigned longs holding hash
`
`* machine dependencies:
`*
`assumes a char is 8 bits
`
`*/
`
`/*
`
`* passes test on:
`
`*
`
`*
`
`*
`
`*
`*/
`
`gauss (vax)
`
`3k (cray)
`
`slepian (MIPS)
`
`bird (sparcstation II)
`
`#include <sys/types.h>
`#include <stdio.h>
`
`#include "shs.h"
`
`static long nbits;
`
`static unsigned long *h;
`
`Static unsigned 1°“9 *“”
`static void shs1();
`EXNbflD
`
`Petitioner Oracle-Apple-Exhibit1010-Page 313
`
`

`
`/9:
`
`static void packl
`
`(unsigned long);
`
`static void pack (unsigned char, unsigned char, unsigned char, unsigned char);
`static void shs1(void);
`
`static void opack(unsigned char);
`*/
`
`#define MASK
`
`(unsigned long)OxffffffffL
`
`/* in case more than 32 bits per long */
`
`/9:
`
`* stick one byte into the current block; process the block when full
`*
`/
`
`static void opack(c)
`
`unsigned char c;
`
`{
`
`int n32, nd32, shiftbits;
`
`register unsigned long x, mask, y;
`
`nd32 = (int)(nbits >> 5);
`
`/* nbits/32 */
`
`n32 = (int)(nbits & Oxlf);
`shiftbits = 24—n32;
`
`/* nbits%32 */
`
`x =
`
`(unsigned long)(c<<shiftbits);
`
`(unsigned long)(Oxff << shiftbits);
`mask =
`mask = ~mask;
`
`y = w[nd32];
`
`y =
`
`(y & mask)
`
`+ x;
`
`w[nd32]
`
`= y;
`
`nbits += 8;
`
`if(nbits==512){
`nbits = O;
`
`shsl();
`
`static void pack(cO, cl, c2, c3)
`
`unsigned char c0, cl, c2, c3;
`
`{
`
`int nd32;
`
`nd32 = (int)(nbits >> 5);
`
`w[nd32]
`
`=
`
`(u_long)(((u_long)cO<<24)
`
`|
`
`((u_long)cl<<l6)
`
`|
`
`((u_long)c2<<8)
`
`|
`
`(u_long)c3);
`
`Petitioner Oracle-Apple - Exhibit 1010 - Page 314
`
`nbits += 32;
`
`if(nbits==5l2){
`nbits = O;
`
`shsl();
`
`}
`
`stick a 4 byte number into the current block
`
`} /
`
`* *
`
`*/
`static void
`
`EXMDHD
`
`

`
`packl(x)
`
`unsigned long x;
`
`pack((unsigned char)(x>>24),
`
`(unsigned char)(x>>16),
`
`(unsigned char)(x>>8),
`
`(unsigned char)(x>>O));
`
`process one block
`
`{
`
`} /
`
`* *
`
`*/
`static void
`
`shs1()
`
`{
`
`unsigned long *wp;
`
`unsigned long temp;
`
`unsigned long A, B, C, D, E;
`int t;
`
`#define S(n,x)
`
`(u_1ong)(((x)<<(n))|((MASK&(x))>>(32-(n))))
`
`wp = W.
`t = 8.
`
`do {
`
`wp[16]
`
`= s(1.
`
`(u_1ong)(wp[13]"wp[8]"wp[2]"wp[0]));
`
`wp[l7]
`
`= s(1.
`
`(u_1ong)(wp[14]‘wp[9]‘wp[3]‘wp[1]));
`
`Wp[l8]
`
`= s(1.
`
`(u_1ong)(wp[15]‘wp[1o]‘wp[4]‘wp[2]));
`
`Wp[l9]
`
`= s(1.
`
`(u_1ong)(wp[16]‘wp[11]‘wp[5]‘wp[3]));
`
`wp[20]
`
`= s(1.
`
`(u_1ong)(wp[17]‘wp[12]‘wp[6]‘wp[4]));
`
`wp[21]
`
`= s(1.
`
`(u_1ong)(wp[18]‘wp[13]‘wp[7]‘wp[5]));
`
`wp[22]
`
`= s(1.
`
`(u_1ong)(wp[19]‘wp[14]‘wp[8]‘wp[6]));
`
`(u_1ong)(wp[2o]‘wp[15]‘wp[9]‘wp[7]));
`
`= s(1.
`wp[23]
`wp += 8;
`t—-;
`
`} while (t > O);
`
`h[O];
`
`h[l];
`
`h[2];
`
`h[3];
`
`h[4];
`
`EIJUQUUIF HIIn
`
`t = 0;
`
`{
`while (t<20)
`temp = S(5,A)
`
`+ E + w[t++];
`
`((B&C)|(D&~B));
`temp += (unsigned long)Ox5a827999L +
`E = D; D = C; C = S(30,B); B = A; A = temp;
`
`} w
`
`} w
`
`{
`hile (t<40)
`temp = S(5,A)
`
`+ E + w[t++];
`
`(B‘C‘D);
`temp += (unsigned long)Ox6ed9ebalL +
`E = D; D = C; C = S(30,B); B = A; A = temp;
`
`{
`hile (t<60)
`temp = S(5,A)
`
`+ E + w[t++];
`
`‘‘B‘‘C’ ' ‘B“D’ i=&$ifi83elfioracIe—AppIe—Exhibit1010-Page 315
`temp *= ‘unsigned 1°“9’°X8f1bbCdCL *
`E = D; D = C; C = S(30,B); B = A; A = temp;
`EXMDHD
`
`

`
`} w
`
`{
`hile (t<80)
`temp = S(5,A)
`
`+ E + w[t++];
`
`(BACAD);
`temp += (unsigned long)Oxca62cld6L +
`E=D;D=C;C=
`S(30.B)7 B = A; A = temp;
`
`h[0]
`
`h[l]
`
`h[2]
`
`h[3]
`
`h[4]
`
`MASK&(h[O]
`
`MASK&(h[l]
`
`MASK&(h[2]
`
`MASK&(h[3]
`
`MASK&(h[4]
`
`IIII
`
`‘O
`
`+++++ O ‘f
`
`#define CHARSTOLONG(Wp,s,i)
`
`{*wH+=
`
`(u_long)((((u_long)(s[i])&Oxff)<<24)|(((u_long)(s[i+l])&Oxff)<<l6)|(((u_long)(s[i+2])&0xff)<<8)|(
`
`
`
`long)Ox67452301L,
`
`long)Oxefcdab89L,
`
`long)Ox98badcfeL,
`
`long)Ox10325476L,
`
`long)Oxc3d2e1f0L,
`
`Petitioner Oracle-Apple - Exhibit 1010 - Page 316
`
`u_long)(s[i+3]&0xff));}
`
`Void
`
`shsInit(mdContext)
`
`SHS_CTX *mdContext;
`
`{
`
`nbits = O;
`
`mdContext->h[O]
`
`mdContext->h[1]
`
`mdContext->h[2]
`
`mdContext->h[3]
`
`=
`
`=
`
`=
`
`=
`
`(unsigned
`
`(unsigned
`
`(unsigned
`
`(unsigned
`
`(unsigned
`=
`mdContext->h[4]
`mdContext—>tota1Length = 0;
`
`Void
`
`shsUpdate(mdContext, s, n)
`
`SHS_CTX *mdContext;
`unsigned char *s;
`
`unsigned int n;
`
`{
`
`register unsigned long
`
`long nn = n;
`
`long i;
`
`w = mdContext->w;
`h =
`
`mdContext—>h;
`
`mdContext—>tota1Length += n;
`
`nbits = O;
`
`n = n/(u_long)64;
`WP = W7
`
`whi1e(n>O){
`CHARSTOLONG(wp.s.0);
`
`CHARSTOLONG(wp.s,4);
`
`CHARSTOLONG(wp.s.8);
`
`CHARsToLoNG(wp.s,12);
`
`CHARsToLoNG(wp.s,16);
`ExmbHD
`
`

`
`CHARsToLoNG(wp.s,2o);
`
`CHARsToLoNG(wp.s,24);
`
`CHARsToLoNG(wp.s,28);
`
`CHARSTOLONG(wp.s.32);
`
`CHARsToLoNG(wp.s,36);
`
`CHARsToLoNG(wp.s,4o);
`
`CHARsToLoNG(wp.s,44);
`
`CHARsToLoNG(wp.s,48);
`
`CHARSTOLONG(wp.s.52);
`
`CHARsToLoNG(wp.s,56);
`
`CHARsToLoNG(wp.s,60);
`1'1--7
`
`WP = W7
`
`s =
`
`(s + 64);
`
`shs1();
`
`} i
`
`=nn%64;
`
`{
`while(i>3)
`CHARSTOLONG(wp.s.O);
`s =
`(s + 4);
`
`nbits += (u_1ong)32;
`i -= 4;
`
`} w
`
`{
`hile (1)
`opack((unsigned char)*s++);
`i--;
`
`Void
`
`shsFina1(mdContext)
`
`SHS_CTX *mdContext;
`
`{
`
`long nn = mdContext->tota1Length;
`w = mdContext—>w;
`
`h = mdContext—>h;
`
`opack(l28);
`
`whi1e(nbits != 448)opack(O);
`
`pack1((unsigned 1ong)(nn>>29));
`
`pack1((unsigned 1ong)(nn<<3));
`
`/* if(nbits != O)
`
`hand1e_exception(CRITICAL,"shsFina1(): nbits != O\n");*/
`
`unsigned char *
`
`qshs(s, n)
`
`unsigned char *s;
`
`long n;
`
`SHS_CTX *mdContext;
`
`static SHS_CTX mdC;
`static unsigned char ret[20];
`int i;
`
`ExmbflD
`
`Petitioner Oracle-Apple - Exhibit 1010 - Page 317
`
`

`
`mdcontext
`
`&mdC;
`
`shsInit(mdContext);
`
`shsUpdate(mdContext, s, n);
`shsFinal(mdContext);
`
`i<5;
`for (i=0;
`ret[i*4] =
`
`{
`i++)
`(mdContext—>h[i]>>24)&Oxff;
`
`ret[i*4+l] =
`
`(mdContext—>h[i]>>l6)&Oxff;
`
`ret[i*4+2]
`
`ret[i*4+3]
`
`=
`
`=
`
`(mdContext—>h[i]>>8)&Oxff;
`
`(mdContext->h[i])&Oxff;
`
`return ret;
`
`/*int fread(char *,
`
`int,
`
`int, FILE *);*/
`
`unsigned long *
`
`fShsDigest(in)
`FILE *in;
`
`SHS_CTX *mdContext;
`
`SHS_CTX mdc;
`unsigned char buffer[l024];
`long length, total;
`
`mdcontext
`
`&mdC;
`
`bzero(buffer, 1024);
`
`total = O;
`
`shsInit(mdContext);
`
`while ((length = fread(buffer, l, 1024,
`total += length;
`
`in))
`
`!= O)
`
`{
`
`shsUpdate(mdContext, buffer,
`
`length);
`
`} s
`
`hsFinal(mdContext);
`
`return mdContext—>h;
`
`EXNbflD
`
`Petitioner Oracle-Apple - Exhibit 1010 - Page 318
`
`

`
`shs.h
`
`Exhibit D
`
`Petitioner Oracle-Apple - Exhibit 1010 - Page 319
`
`

`
`typedef struct {
`long totalLength;
`
`unsigned long h[5];
`
`unsigned long w[80];
`
`} SHS_CTX;
`
`unsigned char *qshs();
`#ifdef SOLARISZX
`
`#define bzero(b,
`
`l)
`
`#define bcopy(s, d,
`
`l)
`
`#define bcmp(s, d,
`#endif
`
`l)
`
`memset(b, O, 1)
`
`memcpy(d, s, 1)
`
`(memcmp(s, d,
`
`l)? 1
`
`: 0)
`
`ExmbflD
`
`Petitioner Oracle-Apple - Exhibit 1010 - Page 320
`
`

`
`ssh.1
`
`Exhibit D
`
`Petitioner Oracle-Apple - Exhibit 1010 - Page 321
`
`

`
`.TH SSH 1 ""
`
`.SH NAME
`
`(somewhat) secure CFS shell
`ssh —
`.SH SYNOPSIS
`
`.B ssh
`
`\fIdirectory\fP
`.SH DESCRIPTION
`
`\fBssh\fP uses \fBcattach\fP(l) to associate the encrypted
`
`\fIdirectory\fP (previously created with \fBcmkdir\fP(l)) with a
`
`randomly selected name. Once the correct passphrase is provided,
`
`\fBssh\fP invokes a new shell with the random directory in /crypt as its
`
`working directory.
`
`When the shell exits,
`cdetach(l).
`
`the temporary attach name is deleted with
`
`Since the generated names are somewhat obscure and are hidden from
`
`view with CFS's "." mechanism, casual attackers cannot easily exploit
`
`the attached cleartext even if they can spoof the UID of the user.
`.LP
`
`This command assumes the Korn Shell is installed as /bin/ksh.
`.SH SEE ALSO
`
`cfsd(8), cattach(l), cdetach(l), cmkdir(l)
`.SH BUGS
`
`The temporary names generated are not random in any cryptographically
`
`strong sense, so this command should really only be viewed as an
`
`example.
`
`A determined attacker could probably guess the generated
`
`name by exploiting the known properties of the way the ksh random
`function is seeded.
`.LP
`
`There's no hiding from an attacker who can compromise root on the
`
`client system while an attach is active.
`.SH AUTHOR
`
`Matt Blaze; for information on cfs, email to
`cfs@research.att.com.
`
`EXNbflD
`
`Petitioner Oracle-Apple - Exhibit 1010 - Page 322
`
`

`
`ssh
`
`Exhibit D
`
`Petitioner Oracle-Apple - Exhibit 1010 - Page 323
`
`

`
`#1/bin/ksh
`
`if [ -z "$1" ];
`
`then
`
`echo Usage: ssh directory
`exit
`
`fi
`
`export PSl="crypto:‘basename $1‘$ "
`D= . $RANDOM. $RANDOM
`
`cattach $1 $D || exit 1
`echo "Directory is /crypt/$D"
`
`cd /crypt/$D
`D2"
`
`n
`
`CWD=‘/bin/pwd‘
`D=‘basename $CWD‘
`
`PWD= $CWD
`
`export RANDOM=O
`
`exec /bin/sh —c
`
`"$SHELL ; cdetach $D"
`
`EXNbflD
`
`Petitioner Oracle-Apple - Exhibit 1010 - Page 324
`
`

`
`truerand.c
`
`Exhibit D
`
`Petitioner Oracle-Apple - Exhibit 1010 - Page 325
`
`

`
`* Physically random numbers
`* D. P. Mitchell
`
`(very nearly uniform)
`
`* Modified by Matt Blaze 7/95
`*/
`
`/*
`* The authors of this software are Don Mitchell and Matt Blaze.
`
`*
`
`Copyright
`
`(c) 1995 by AT&T.
`
`* Permission to use, Copy, and modify this software without fee
`
`* is hereby granted, provided that this entire notice is included in
`
`* all copies of any software which is or includes a copy or
`
`* modification of this software and in all copies of the supporting
`* documentation for such software.
`
`* This software may be subject to United States export controls.
`
`* THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR IMPLIED
`
`IN PARTICULAR, NEITHER THE AUTHORS NOR AT&T MAKE ANY
`* WARRANTY.
`* REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE MERCHANTABILITY
`
`* OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR PURPOSE.
`
`raw_truerand()
`* WARNING: depending on the particular platform,
`* output may be biased or correlated.
`In general, you can expect
`
`* about 12 bits of "pseudo—entropy" out of each 32 bit word returned
`
`* by raw_truerand(), but it may not be uniformly diffused. You should
`* therefore run the output through some post-whitening function
`
`*
`
`(like MD5 or DES or whatever) before using it to generate key
`
`* material.
`
`(RSAREF's random package does this for you when you feed
`
`* raw_truerand() bits to the seed input function.)
`
`* The application interface, for 8, 16, and 32 bit properly "whitened"
`*
`random numbers, can be found in trand8(),
`trandl6(), and trand32().
`
`* Use those instead of calling raw_truerand() directly.
`
`* The basic idea here is that between clock "skew" and various
`
`* hard—to—predict OS event arrivals, counting a tight loop will yield
`
`* a little (maybe a third of a bit or so) of "good" randomness per
`* interval clock tick. This seems to work well even on unloaded
`
`* machines.
`
`If there is a human operator at the machine, you should
`
`* augment trand with other measures,
`
`like keyboard event timing.
`
`* On server machines (e.g., when you need to generate a
`
`* Diffie—Hellman secret) trand alone may be good enough.
`
`* Test these assumptions on your own platform before fielding a
`
`* system based on this software or these techniques.
`
`* This software seems to work well
`
`(at 10 or so bits per
`
`* raw_truerand() call) on a Sun Sparc—2O under SunOS 4.1.3 and on a
`* P100 under BSDI 2.0. You're on your own elsewhere.
`
`#-“elude <Si9“a1*h>
`#include <setjmp.h>
`EXNbflD
`
`Petitioner Oracle-Apple — Exhibit 1010 — Page 326
`
`

`
`Petitioner Oracle-Apple - Exhibit 1010 - Page 327
`
`#inc1ude <sys/time.h>
`#inc1ude <math.h>
`
`#include <stdio.h>
`
`static
`
`static
`
`static
`
`static
`
`jmp_buf env;
`unsigned count;
`
`unsigned ocount;
`
`unsigned buffer;
`
`static
`
`int
`
`tick()
`
`{
`
`struct itimerval it, oit;
`
`timerc1ear(&it.it_interva1);
`it.
`
`it_va1ue.tv_sec = O;
`
`it.
`
`it_va1ue.tv_usec
`
`16665;
`
`if (setitimer(ITIMER_REAL, &it, &oit)
`perror("tick");
`
`< 0)
`
`static
`
`Void
`
`interrupt()
`
`{
`
`if (count)
`
`1ongjmp(enV, 1);
`
`(void)
`tiCk();
`
`signa1(SIGALRM,
`
`interrupt);
`
`static unsigned long
`rou1ette()
`
`{
`
`{
`if (setjmp(env))
`count “= (count>>3)
`count &= OX7;
`
`ocount=count;
`
`(count>>6)
`
`A ocount;
`
`(buffer<<3)
`buffer =
`return buffer;
`
`‘ count;
`
`interrupt);
`
`} (
`
`signa1(SIGALRM,
`void)
`count = 0;
`
`tiCk();
`
`for (2;
`
`count++;
`
`/* about 1 MHz on VAX
`
`ll/780 */
`
`unsigned long
`
`raw_truerand()
`
`{
`
`COuI'1t=0 7
`
`(Void) rou1ette();
`
`(Void) rou1ette();
`
`(Void) rou1ette();
`EXNbflD
`
`

`
`(Void) rou1ette();
`
`(Void) rou1ette();
`
`(Void) rou1ette();
`
`(Void) rou1ette();
`
`(Void) rou1ette();
`
`(Void) rou1ette();
`
`(Void) rou1ette();
`
`return roulette();
`
`int
`
`raw_n_truerand(n)
`int n;
`
`{
`
`int slop, V;
`
`slop = OX7FFFFFFF % n;
`
`do {
`
`V = raw_truerand() >> 1;
`
`} while (V <= slop);
`return V % n;
`
`* Random byte interface to truerand()
`* Matt Blaze 9/95
`
`8, 16, 32 really random bits, at about
`
`.35 bits per clock
`
`interrupt.
`
`usage:
`
`unsigned char r8;
`
`unsigned short r16;
`
`unsigned long r32;
`
`unsigned long trand8(),
`r8=trand8();
`
`r16=trand16();
`
`r32=trand32();
`
`trandl6().
`
`trand32();
`
`is the same as trand8().
`randbyte()
`trand8()
`takes about
`.3 seconds on most machines.
`
`*
`
`*
`
`* *
`
`*
`
`*
`
`*
`
`*
`*
`
`*
`
`*
`
`*
`*
`
`*/
`
`/*
`* The author of this software is Matt Blaze.
`
`*
`
`Copyright
`
`(c) 1995 by AT&T.
`
`* Permission to use, Copy, and modify this software without fee
`
`* is hereby granted, provided that this entire notice is included in
`
`* all copies of any software which is or includes a copy or
`
`* modification of this software and in all copies of the supporting
`* documentation for such software.
`
`* THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR IMPLIED
`
`* WARRANTY.
`
`IN PARTICULAR, NEITHER THE AUTHORS NOR AT&T MAKE ANY
`
`* REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE ¥%%Egfi8PEfiEk£K%pb__EXmb“1010__Page328
`* OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR PURPOSE.
`
`EXNbflD
`
`

`
`*/
`
`unsigned long randbyte()
`
`{
`
`unsigned long raw_truerand();
`unsigned char *qshs();
`
`unsigned long r[2];
`
`unsigned char *hash;
`
`r[O]=raw_truerand(); r[1]=raw_truerand();
`hash = qshs(r,sizeof(r));
`return ((int)
`(*hash)) & Oxff;
`
`unsigned long trand8()
`
`{
`
`return randbyte();
`
`unsigned long trand16()
`
`{
`
`return randbyte()
`
`A
`
`(randbyte()<<8);
`
`unsigned long trand32()
`
`{
`
`return randbyte()
`
`‘
`
`(randbyte()<<8)
`
`(randbyte()<<l6)
`
`‘
`
`(randbyte()<<24);
`
`ExmbflD
`
`Petitioner Oracle-Apple - Exhibit 1010 - Page 329
`
`

`
`Vef. C
`
`Exhibit D
`
`Petitioner Oracle-Apple - Exhibit 1010 - Page 330
`
`

`
`static char version[]=
`
`"CFS 1.3.3 - Cryptlevel: DES=5, 3DES=3, T3DES=l, MCG=3, SAFER=l";
`
`Exhibit D
`
`Petitioner Oracle-Apple - Exhibit 1010 - Page 331
`
`

`
`Google Groups
`
`New release of CFS Unix encrypting filesystem available
`
`Matt Blaze
`
`Posted in group: sci.crypt
`
`Mar 17, 1996 3:00 AM
`
`Source code for the latest version (release 1.3.3) of CFS, the Cryptographic
`File System, is now available upon request for research and experimental
`use in the US and Canada. This version works under most BSD-derived Unix
`
`systems and should now run without modification under most current Linux
`releases as well.
`
`It
`CFS pushes encryption services into the Unix(tm) file system.
`supports secure storage at the system level through a standard Unix
`file system interface to encrypted files. Users associate a
`cryptographic key with the directories they wish to protect. Files in
`these directories (as well as their pathname components) are
`transparently encrypted and decrypted with the specified key without
`further user intervention; cleartext is never stored on a disk or sent
`to a remote file server. CFS employs a novel combination of DES
`stream and codebook cipher modes to provide high security with good
`performance on a modern workstation. CFS can use any available file
`system for its underlying storage without modification, including
`remote file servers such as NFS. System management functions, such as
`file backup, work in a normal manner and without knowledge of the key.
`
`CFS runs under SunOS and several other BSD-derived systems with NFS.
`It is implemented entirely at user level, as a local NFS server
`running on the client machine's "|oopback" interface.
`It consists of
`about 5000 lines of code and supporting documentation. You must have
`"root" access to install CFS.
`
`CFS was first mentioned at the work-in-progress session at the Winter
`'93 USENIX Conference and was more fully detailed in:
`
`Matt Blaze. "A Cryptographic File System for Unix", Proc. 1st ACM
`Conference on Computer and Communications Security, Fairfax, VA,
`November 1993. (Postscript available by anonymous ftp from
`research.att.com in the file dist/mab/cfs.ps.)
`
`and in
`
`Matt Blaze. "Key Management in an Encrypting File System", Proc.
`Summer '94 USENIX Tech. Conference, Boston, MA, June 1994.
`(PostScript available by anonymous ftp from research.att.com
`in the file dist/mab/cfskey.ps.)
`
`Version 1.3 of CFS also includes ESM, the Encrypting Session Manager.
`ESM provides shell-to-shell encrypted sessions across insecure links
`and requires no 08 or network support.
`It is useful for typing cfs
`passphrases when logged in over the network. ESM needs RSAREF 2.0 to
`compile and is tested only on SunOS and BSDI. ESM is the first released
`part of a suite of session encryption tools that are described in
`
`Exhibit E
`
`Petitioner Oracle-Apple - Exhibit 1010 - Page 332
`
`

`
`Matt Blaze and Steve Bellovin. "Session-layer Encryption."
`Proc. 1995 USENIX Security Workshop, Salt Lake City, June 1995.
`(PostScript is available from
`ftp://research.att.com/dist/mab/sesscrypt.ps)
`
`The new version of CFS differs from the version described in the
`
`papers in a few ways:
`
`* The DES-based encryption scheme has been strengthened, and now
`provides greater security but with the online latency of only single-DES.
`
`* Support for the smartcard-based key management system is not
`included and a few of the tools are not included.
`
`* An impoved key management scheme now allows chaning the passphrase
`associated with a directory.
`
`* The performance has been improved.
`
`* The security of the system against certain non-cryptanalytic attacks
`has been improved somewhat.
`
`* User-contributed ports to a number of additional platforms.
`
`* Hooks for adding new ciphers.
`
`* 3-DES, MacGuffin, and SAFER-SK128 encryption options.
`
`* Timeout options allow automatic detach of encrypted directories
`after a set time or period of inactivity.
`
`CFS is distributed as a research prototype; it is COMPLETELY
`UNSUPPORTED software. No warranty of any kind is provided. We will
`not be responsible if the system deletes all your files and emails the
`cleartext directly to the NSA or your mother. Also, we do not have
`the resources to port the software to other platforms, although you
`are welcome to do this yourself. The software was developed under
`SunOS and BSDI, and there are also unsupported user-contributed ports
`available for Al)(, HP/UX, lrix, Linux, Solaris and Ultrix. We really
`can't promise to provide any technical support at all, beyond the
`source code itself. We also maintain a mailing list for CFS users and
`developers; subscription information is included with the source code.
`
`Because of export restrictions on cryptographic software, we are only
`able to make the software available within the US and Canada to US and
`
`Canadian citizens and permanent residents. Unfortunately, we cannot
`make it available for general anonymous ftp or other uncontrolled
`access, nor can we allow others to do so. Sorry.
`
`Legal stuff from the README file:
`
`Copyright (c) 1992, 1993, 1994, 1995 by AT&T.
`*
`* Permission to use, copy, and modify this software without fee
`* is hereby granted, provided that this entire notice is included in
`* all copies of any software which is or includes a copy or
`* modification of this software and in all copies of the supporting
`* documentation for such software.
`
`This software is subject to United States export controls.
`Exhibit E
`
`Petitioner OraC|e_App|e _ Exhibit 1010 _ Page 333
`
`* *
`
`

`
`* *
`
`THIS SOFTWARE IS BEING PROVIDED ''AS IS'', WITHOUT ANY EXPRESS OR IMPLIED
`* WARRANTY.
`IN PARTICULAR, NEITHER THE AUTHORS NOR AT&T MAKE ANY
`* REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE MERCHANTABILITY
`* OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR PURPOSE.
`
`If you would like a copy of the CFS source code, please read to the end
`of this message and then send email to:
`
`c...@research.att.com
`
`DO NOT REPLY DIRECTLY TO THIS MESSAGE. You must include a statement
`
`that you are in the US or Canada, are a citizen or legal permanent
`resident of the US or Canada, and have read and understand the license
`conditions stated above. Be sure to include an email address in a US-
`
`or Canada-registered domain. The code will be sent