/core/src/main/java/org/bouncycastle/crypto/engines/SerpentEngine.java

https://gitlab.com/edgardo001/bc-java · Java · 296 lines · 233 code · 16 blank · 47 comment · 6 complexity · ea529f15de51a52f5cc2faacedce0b7e MD5 · raw file 

    

  1. package org.bouncycastle.crypto.engines;
    2. 

  2. 

  3. import org.bouncycastle.util.Pack;
    4. 

  4. 

  5. /**
    6. 

  6.  * Serpent is a 128-bit 32-round block cipher with variable key lengths,
    7. 

  7.  * including 128, 192 and 256 bit keys conjectured to be at least as
    8. 

  8.  * secure as three-key triple-DES.
    9. 

  9.  * <p>
    10. 

  10.  * Serpent was designed by Ross Anderson, Eli Biham and Lars Knudsen as a
    11. 

  11.  * candidate algorithm for the NIST AES Quest.
    12. 

  12.  * <p>
    13. 

  13.  * For full details see <a href="http://www.cl.cam.ac.uk/~rja14/serpent.html">The Serpent home page</a>
    14. 

  14.  */
    15. 

  15. public final class SerpentEngine
    16. 

  16.     extends SerpentEngineBase
    17. 

  17. {
    18. 

  18.     /**
    19. 

  19.      * Expand a user-supplied key material into a session key.
    20. 

  20.      *
    21. 

  21.      * @param key  The user-key bytes (multiples of 4) to use.
    22. 

  22.      * @exception IllegalArgumentException
    23. 

  23.      */
    24. 

  24.     protected int[] makeWorkingKey(
    25. 

  25.         byte[] key)
    26. 

  26.     throws  IllegalArgumentException
    27. 

  27.     {
    28. 

  28.         //
    29. 

  29.         // pad key to 256 bits
    30. 

  30.         //
    31. 

  31.         int[]   kPad = new int[16];
    32. 

  32.         int     off = 0;
    33. 

  33.         int     length = 0;
    34. 

  34. 

  35.         for (off = 0; (off + 4) < key.length; off += 4)
    36. 

  36.         {
    37. 

  37.             kPad[length++] = Pack.littleEndianToInt(key, off);
    38. 

  38.         }
    39. 

  39. 

  40.         if (off % 4 == 0)
    41. 

  41.         {
    42. 

  42.             kPad[length++] = Pack.littleEndianToInt(key, off);
    43. 

  43.             if (length < 8)
    44. 

  44.             {
    45. 

  45.                 kPad[length] = 1;
    46. 

  46.             }
    47. 

  47.         }
    48. 

  48.         else
    49. 

  49.         {
    50. 

  50.             throw new IllegalArgumentException("key must be a multiple of 4 bytes");
    51. 

  51.         }
    52. 

  52. 

  53.         //
    54. 

  54.         // expand the padded key up to 33 x 128 bits of key material
    55. 

  55.         //
    56. 

  56.         int     amount = (ROUNDS + 1) * 4;
    57. 

  57.         int[]   w = new int[amount];
    58. 

  58. 

  59.         //
    60. 

  60.         // compute w0 to w7 from w-8 to w-1
    61. 

  61.         //
    62. 

  62.         for (int i = 8; i < 16; i++)
    63. 

  63.         {
    64. 

  64.             kPad[i] = rotateLeft(kPad[i - 8] ^ kPad[i - 5] ^ kPad[i - 3] ^ kPad[i - 1] ^ PHI ^ (i - 8), 11);
    65. 

  65.         }
    66. 

  66. 

  67.         System.arraycopy(kPad, 8, w, 0, 8);
    68. 

  68. 

  69.         //
    70. 

  70.         // compute w8 to w136
    71. 

  71.         //
    72. 

  72.         for (int i = 8; i < amount; i++)
    73. 

  73.         {
    74. 

  74.             w[i] = rotateLeft(w[i - 8] ^ w[i - 5] ^ w[i - 3] ^ w[i - 1] ^ PHI ^ i, 11);
    75. 

  75.         }
    76. 

  76. 

  77.         //
    78. 

  78.         // create the working keys by processing w with the Sbox and IP
    79. 

  79.         //
    80. 

  80.         sb3(w[0], w[1], w[2], w[3]);
    81. 

  81.         w[0] = X0; w[1] = X1; w[2] = X2; w[3] = X3; 
    82. 

  82.         sb2(w[4], w[5], w[6], w[7]);
    83. 

  83.         w[4] = X0; w[5] = X1; w[6] = X2; w[7] = X3; 
    84. 

  84.         sb1(w[8], w[9], w[10], w[11]);
    85. 

  85.         w[8] = X0; w[9] = X1; w[10] = X2; w[11] = X3; 
    86. 

  86.         sb0(w[12], w[13], w[14], w[15]);
    87. 

  87.         w[12] = X0; w[13] = X1; w[14] = X2; w[15] = X3; 
    88. 

  88.         sb7(w[16], w[17], w[18], w[19]);
    89. 

  89.         w[16] = X0; w[17] = X1; w[18] = X2; w[19] = X3; 
    90. 

  90.         sb6(w[20], w[21], w[22], w[23]);
    91. 

  91.         w[20] = X0; w[21] = X1; w[22] = X2; w[23] = X3; 
    92. 

  92.         sb5(w[24], w[25], w[26], w[27]);
    93. 

  93.         w[24] = X0; w[25] = X1; w[26] = X2; w[27] = X3; 
    94. 

  94.         sb4(w[28], w[29], w[30], w[31]);
    95. 

  95.         w[28] = X0; w[29] = X1; w[30] = X2; w[31] = X3; 
    96. 

  96.         sb3(w[32], w[33], w[34], w[35]);
    97. 

  97.         w[32] = X0; w[33] = X1; w[34] = X2; w[35] = X3; 
    98. 

  98.         sb2(w[36], w[37], w[38], w[39]);
    99. 

  99.         w[36] = X0; w[37] = X1; w[38] = X2; w[39] = X3; 
    100. 

  100.         sb1(w[40], w[41], w[42], w[43]);
    101. 

  101.         w[40] = X0; w[41] = X1; w[42] = X2; w[43] = X3; 
    102. 

  102.         sb0(w[44], w[45], w[46], w[47]);
    103. 

  103.         w[44] = X0; w[45] = X1; w[46] = X2; w[47] = X3; 
    104. 

  104.         sb7(w[48], w[49], w[50], w[51]);
    105. 

  105.         w[48] = X0; w[49] = X1; w[50] = X2; w[51] = X3; 
    106. 

  106.         sb6(w[52], w[53], w[54], w[55]);
    107. 

  107.         w[52] = X0; w[53] = X1; w[54] = X2; w[55] = X3; 
    108. 

  108.         sb5(w[56], w[57], w[58], w[59]);
    109. 

  109.         w[56] = X0; w[57] = X1; w[58] = X2; w[59] = X3; 
    110. 

  110.         sb4(w[60], w[61], w[62], w[63]);
    111. 

  111.         w[60] = X0; w[61] = X1; w[62] = X2; w[63] = X3; 
    112. 

  112.         sb3(w[64], w[65], w[66], w[67]);
    113. 

  113.         w[64] = X0; w[65] = X1; w[66] = X2; w[67] = X3; 
    114. 

  114.         sb2(w[68], w[69], w[70], w[71]);
    115. 

  115.         w[68] = X0; w[69] = X1; w[70] = X2; w[71] = X3; 
    116. 

  116.         sb1(w[72], w[73], w[74], w[75]);
    117. 

  117.         w[72] = X0; w[73] = X1; w[74] = X2; w[75] = X3; 
    118. 

  118.         sb0(w[76], w[77], w[78], w[79]);
    119. 

  119.         w[76] = X0; w[77] = X1; w[78] = X2; w[79] = X3; 
    120. 

  120.         sb7(w[80], w[81], w[82], w[83]);
    121. 

  121.         w[80] = X0; w[81] = X1; w[82] = X2; w[83] = X3; 
    122. 

  122.         sb6(w[84], w[85], w[86], w[87]);
    123. 

  123.         w[84] = X0; w[85] = X1; w[86] = X2; w[87] = X3; 
    124. 

  124.         sb5(w[88], w[89], w[90], w[91]);
    125. 

  125.         w[88] = X0; w[89] = X1; w[90] = X2; w[91] = X3; 
    126. 

  126.         sb4(w[92], w[93], w[94], w[95]);
    127. 

  127.         w[92] = X0; w[93] = X1; w[94] = X2; w[95] = X3; 
    128. 

  128.         sb3(w[96], w[97], w[98], w[99]);
    129. 

  129.         w[96] = X0; w[97] = X1; w[98] = X2; w[99] = X3; 
    130. 

  130.         sb2(w[100], w[101], w[102], w[103]);
    131. 

  131.         w[100] = X0; w[101] = X1; w[102] = X2; w[103] = X3; 
    132. 

  132.         sb1(w[104], w[105], w[106], w[107]);
    133. 

  133.         w[104] = X0; w[105] = X1; w[106] = X2; w[107] = X3; 
    134. 

  134.         sb0(w[108], w[109], w[110], w[111]);
    135. 

  135.         w[108] = X0; w[109] = X1; w[110] = X2; w[111] = X3; 
    136. 

  136.         sb7(w[112], w[113], w[114], w[115]);
    137. 

  137.         w[112] = X0; w[113] = X1; w[114] = X2; w[115] = X3; 
    138. 

  138.         sb6(w[116], w[117], w[118], w[119]);
    139. 

  139.         w[116] = X0; w[117] = X1; w[118] = X2; w[119] = X3; 
    140. 

  140.         sb5(w[120], w[121], w[122], w[123]);
    141. 

  141.         w[120] = X0; w[121] = X1; w[122] = X2; w[123] = X3; 
    142. 

  142.         sb4(w[124], w[125], w[126], w[127]);
    143. 

  143.         w[124] = X0; w[125] = X1; w[126] = X2; w[127] = X3; 
    144. 

  144.         sb3(w[128], w[129], w[130], w[131]);
    145. 

  145.         w[128] = X0; w[129] = X1; w[130] = X2; w[131] = X3; 
    146. 

  146. 

  147.         return w;
    148. 

  148.     }
    149. 

  149. 

  150.     /**
    151. 

  151.      * Encrypt one block of plaintext.
    152. 

  152.      *
    153. 

  153.      * @param input the array containing the input data.
    154. 

  154.      * @param inOff offset into the in array the data starts at.
    155. 

  155.      * @param output the array the output data will be copied into.
    156. 

  156.      * @param outOff the offset into the out array the output will start at.
    157. 

  157.      */
    158. 

  158.     protected void encryptBlock(
    159. 

  159.         byte[]  input,
    160. 

  160.         int     inOff,
    161. 

  161.         byte[]  output,
    162. 

  162.         int     outOff)
    163. 

  163.     {
    164. 

  164.         X0 = Pack.littleEndianToInt(input, inOff);
    165. 

  165.         X1 = Pack.littleEndianToInt(input, inOff + 4);
    166. 

  166.         X2 = Pack.littleEndianToInt(input, inOff + 8);
    167. 

  167.         X3 = Pack.littleEndianToInt(input, inOff + 12);
    168. 

  168. 

  169.         sb0(wKey[0] ^ X0, wKey[1] ^ X1, wKey[2] ^ X2, wKey[3] ^ X3); LT();
    170. 

  170.         sb1(wKey[4] ^ X0, wKey[5] ^ X1, wKey[6] ^ X2, wKey[7] ^ X3); LT();
    171. 

  171.         sb2(wKey[8] ^ X0, wKey[9] ^ X1, wKey[10] ^ X2, wKey[11] ^ X3); LT();
    172. 

  172.         sb3(wKey[12] ^ X0, wKey[13] ^ X1, wKey[14] ^ X2, wKey[15] ^ X3); LT();
    173. 

  173.         sb4(wKey[16] ^ X0, wKey[17] ^ X1, wKey[18] ^ X2, wKey[19] ^ X3); LT();
    174. 

  174.         sb5(wKey[20] ^ X0, wKey[21] ^ X1, wKey[22] ^ X2, wKey[23] ^ X3); LT();
    175. 

  175.         sb6(wKey[24] ^ X0, wKey[25] ^ X1, wKey[26] ^ X2, wKey[27] ^ X3); LT();
    176. 

  176.         sb7(wKey[28] ^ X0, wKey[29] ^ X1, wKey[30] ^ X2, wKey[31] ^ X3); LT();
    177. 

  177.         sb0(wKey[32] ^ X0, wKey[33] ^ X1, wKey[34] ^ X2, wKey[35] ^ X3); LT();
    178. 

  178.         sb1(wKey[36] ^ X0, wKey[37] ^ X1, wKey[38] ^ X2, wKey[39] ^ X3); LT();
    179. 

  179.         sb2(wKey[40] ^ X0, wKey[41] ^ X1, wKey[42] ^ X2, wKey[43] ^ X3); LT();
    180. 

  180.         sb3(wKey[44] ^ X0, wKey[45] ^ X1, wKey[46] ^ X2, wKey[47] ^ X3); LT();
    181. 

  181.         sb4(wKey[48] ^ X0, wKey[49] ^ X1, wKey[50] ^ X2, wKey[51] ^ X3); LT();
    182. 

  182.         sb5(wKey[52] ^ X0, wKey[53] ^ X1, wKey[54] ^ X2, wKey[55] ^ X3); LT();
    183. 

  183.         sb6(wKey[56] ^ X0, wKey[57] ^ X1, wKey[58] ^ X2, wKey[59] ^ X3); LT();
    184. 

  184.         sb7(wKey[60] ^ X0, wKey[61] ^ X1, wKey[62] ^ X2, wKey[63] ^ X3); LT();
    185. 

  185.         sb0(wKey[64] ^ X0, wKey[65] ^ X1, wKey[66] ^ X2, wKey[67] ^ X3); LT();
    186. 

  186.         sb1(wKey[68] ^ X0, wKey[69] ^ X1, wKey[70] ^ X2, wKey[71] ^ X3); LT();
    187. 

  187.         sb2(wKey[72] ^ X0, wKey[73] ^ X1, wKey[74] ^ X2, wKey[75] ^ X3); LT();
    188. 

  188.         sb3(wKey[76] ^ X0, wKey[77] ^ X1, wKey[78] ^ X2, wKey[79] ^ X3); LT();
    189. 

  189.         sb4(wKey[80] ^ X0, wKey[81] ^ X1, wKey[82] ^ X2, wKey[83] ^ X3); LT();
    190. 

  190.         sb5(wKey[84] ^ X0, wKey[85] ^ X1, wKey[86] ^ X2, wKey[87] ^ X3); LT();
    191. 

  191.         sb6(wKey[88] ^ X0, wKey[89] ^ X1, wKey[90] ^ X2, wKey[91] ^ X3); LT();
    192. 

  192.         sb7(wKey[92] ^ X0, wKey[93] ^ X1, wKey[94] ^ X2, wKey[95] ^ X3); LT();
    193. 

  193.         sb0(wKey[96] ^ X0, wKey[97] ^ X1, wKey[98] ^ X2, wKey[99] ^ X3); LT();
    194. 

  194.         sb1(wKey[100] ^ X0, wKey[101] ^ X1, wKey[102] ^ X2, wKey[103] ^ X3); LT();
    195. 

  195.         sb2(wKey[104] ^ X0, wKey[105] ^ X1, wKey[106] ^ X2, wKey[107] ^ X3); LT();
    196. 

  196.         sb3(wKey[108] ^ X0, wKey[109] ^ X1, wKey[110] ^ X2, wKey[111] ^ X3); LT();
    197. 

  197.         sb4(wKey[112] ^ X0, wKey[113] ^ X1, wKey[114] ^ X2, wKey[115] ^ X3); LT();
    198. 

  198.         sb5(wKey[116] ^ X0, wKey[117] ^ X1, wKey[118] ^ X2, wKey[119] ^ X3); LT();
    199. 

  199.         sb6(wKey[120] ^ X0, wKey[121] ^ X1, wKey[122] ^ X2, wKey[123] ^ X3); LT();
    200. 

  200.         sb7(wKey[124] ^ X0, wKey[125] ^ X1, wKey[126] ^ X2, wKey[127] ^ X3);
    201. 

  201. 

  202.         Pack.intToLittleEndian(wKey[128] ^ X0, output, outOff);
    203. 

  203.         Pack.intToLittleEndian(wKey[129] ^ X1, output, outOff + 4);
    204. 

  204.         Pack.intToLittleEndian(wKey[130] ^ X2, output, outOff + 8);
    205. 

  205.         Pack.intToLittleEndian(wKey[131] ^ X3, output, outOff + 12);
    206. 

  206.     }
    207. 

  207. 

  208.     /**
    209. 

  209.      * Decrypt one block of ciphertext.
    210. 

  210.      *
    211. 

  211.      * @param input the array containing the input data.
    212. 

  212.      * @param inOff offset into the in array the data starts at.
    213. 

  213.      * @param output the array the output data will be copied into.
    214. 

  214.      * @param outOff the offset into the out array the output will start at.
    215. 

  215.      */
    216. 

  216.     protected void decryptBlock(
    217. 

  217.         byte[]  input,
    218. 

  218.         int     inOff,
    219. 

  219.         byte[]  output,
    220. 

  220.         int     outOff)
    221. 

  221.     {
    222. 

  222.         X0 = wKey[128] ^ Pack.littleEndianToInt(input, inOff);
    223. 

  223.         X1 = wKey[129] ^ Pack.littleEndianToInt(input, inOff + 4);
    224. 

  224.         X2 = wKey[130] ^ Pack.littleEndianToInt(input, inOff + 8);
    225. 

  225.         X3 = wKey[131] ^ Pack.littleEndianToInt(input, inOff + 12);
    226. 

  226. 

  227.         ib7(X0, X1, X2, X3);
    228. 

  228.         X0 ^= wKey[124]; X1 ^= wKey[125]; X2 ^= wKey[126]; X3 ^= wKey[127];
    229. 

  229.         inverseLT(); ib6(X0, X1, X2, X3);
    230. 

  230.         X0 ^= wKey[120]; X1 ^= wKey[121]; X2 ^= wKey[122]; X3 ^= wKey[123];
    231. 

  231.         inverseLT(); ib5(X0, X1, X2, X3);
    232. 

  232.         X0 ^= wKey[116]; X1 ^= wKey[117]; X2 ^= wKey[118]; X3 ^= wKey[119];
    233. 

  233.         inverseLT(); ib4(X0, X1, X2, X3);
    234. 

  234.         X0 ^= wKey[112]; X1 ^= wKey[113]; X2 ^= wKey[114]; X3 ^= wKey[115];
    235. 

  235.         inverseLT(); ib3(X0, X1, X2, X3);
    236. 

  236.         X0 ^= wKey[108]; X1 ^= wKey[109]; X2 ^= wKey[110]; X3 ^= wKey[111];
    237. 

  237.         inverseLT(); ib2(X0, X1, X2, X3);
    238. 

  238.         X0 ^= wKey[104]; X1 ^= wKey[105]; X2 ^= wKey[106]; X3 ^= wKey[107];
    239. 

  239.         inverseLT(); ib1(X0, X1, X2, X3);
    240. 

  240.         X0 ^= wKey[100]; X1 ^= wKey[101]; X2 ^= wKey[102]; X3 ^= wKey[103];
    241. 

  241.         inverseLT(); ib0(X0, X1, X2, X3);
    242. 

  242.         X0 ^= wKey[96]; X1 ^= wKey[97]; X2 ^= wKey[98]; X3 ^= wKey[99];
    243. 

  243.         inverseLT(); ib7(X0, X1, X2, X3);
    244. 

  244.         X0 ^= wKey[92]; X1 ^= wKey[93]; X2 ^= wKey[94]; X3 ^= wKey[95];
    245. 

  245.         inverseLT(); ib6(X0, X1, X2, X3);
    246. 

  246.         X0 ^= wKey[88]; X1 ^= wKey[89]; X2 ^= wKey[90]; X3 ^= wKey[91];
    247. 

  247.         inverseLT(); ib5(X0, X1, X2, X3);
    248. 

  248.         X0 ^= wKey[84]; X1 ^= wKey[85]; X2 ^= wKey[86]; X3 ^= wKey[87];
    249. 

  249.         inverseLT(); ib4(X0, X1, X2, X3);
    250. 

  250.         X0 ^= wKey[80]; X1 ^= wKey[81]; X2 ^= wKey[82]; X3 ^= wKey[83];
    251. 

  251.         inverseLT(); ib3(X0, X1, X2, X3);
    252. 

  252.         X0 ^= wKey[76]; X1 ^= wKey[77]; X2 ^= wKey[78]; X3 ^= wKey[79];
    253. 

  253.         inverseLT(); ib2(X0, X1, X2, X3);
    254. 

  254.         X0 ^= wKey[72]; X1 ^= wKey[73]; X2 ^= wKey[74]; X3 ^= wKey[75];
    255. 

  255.         inverseLT(); ib1(X0, X1, X2, X3);
    256. 

  256.         X0 ^= wKey[68]; X1 ^= wKey[69]; X2 ^= wKey[70]; X3 ^= wKey[71];
    257. 

  257.         inverseLT(); ib0(X0, X1, X2, X3);
    258. 

  258.         X0 ^= wKey[64]; X1 ^= wKey[65]; X2 ^= wKey[66]; X3 ^= wKey[67];
    259. 

  259.         inverseLT(); ib7(X0, X1, X2, X3);
    260. 

  260.         X0 ^= wKey[60]; X1 ^= wKey[61]; X2 ^= wKey[62]; X3 ^= wKey[63];
    261. 

  261.         inverseLT(); ib6(X0, X1, X2, X3);
    262. 

  262.         X0 ^= wKey[56]; X1 ^= wKey[57]; X2 ^= wKey[58]; X3 ^= wKey[59];
    263. 

  263.         inverseLT(); ib5(X0, X1, X2, X3);
    264. 

  264.         X0 ^= wKey[52]; X1 ^= wKey[53]; X2 ^= wKey[54]; X3 ^= wKey[55];
    265. 

  265.         inverseLT(); ib4(X0, X1, X2, X3);
    266. 

  266.         X0 ^= wKey[48]; X1 ^= wKey[49]; X2 ^= wKey[50]; X3 ^= wKey[51];
    267. 

  267.         inverseLT(); ib3(X0, X1, X2, X3);
    268. 

  268.         X0 ^= wKey[44]; X1 ^= wKey[45]; X2 ^= wKey[46]; X3 ^= wKey[47];
    269. 

  269.         inverseLT(); ib2(X0, X1, X2, X3);
    270. 

  270.         X0 ^= wKey[40]; X1 ^= wKey[41]; X2 ^= wKey[42]; X3 ^= wKey[43];
    271. 

  271.         inverseLT(); ib1(X0, X1, X2, X3);
    272. 

  272.         X0 ^= wKey[36]; X1 ^= wKey[37]; X2 ^= wKey[38]; X3 ^= wKey[39];
    273. 

  273.         inverseLT(); ib0(X0, X1, X2, X3);
    274. 

  274.         X0 ^= wKey[32]; X1 ^= wKey[33]; X2 ^= wKey[34]; X3 ^= wKey[35];
    275. 

  275.         inverseLT(); ib7(X0, X1, X2, X3);
    276. 

  276.         X0 ^= wKey[28]; X1 ^= wKey[29]; X2 ^= wKey[30]; X3 ^= wKey[31];
    277. 

  277.         inverseLT(); ib6(X0, X1, X2, X3);
    278. 

  278.         X0 ^= wKey[24]; X1 ^= wKey[25]; X2 ^= wKey[26]; X3 ^= wKey[27];
    279. 

  279.         inverseLT(); ib5(X0, X1, X2, X3);
    280. 

  280.         X0 ^= wKey[20]; X1 ^= wKey[21]; X2 ^= wKey[22]; X3 ^= wKey[23];
    281. 

  281.         inverseLT(); ib4(X0, X1, X2, X3);
    282. 

  282.         X0 ^= wKey[16]; X1 ^= wKey[17]; X2 ^= wKey[18]; X3 ^= wKey[19];
    283. 

  283.         inverseLT(); ib3(X0, X1, X2, X3);
    284. 

  284.         X0 ^= wKey[12]; X1 ^= wKey[13]; X2 ^= wKey[14]; X3 ^= wKey[15];
    285. 

  285.         inverseLT(); ib2(X0, X1, X2, X3);
    286. 

  286.         X0 ^= wKey[8]; X1 ^= wKey[9]; X2 ^= wKey[10]; X3 ^= wKey[11];
    287. 

  287.         inverseLT(); ib1(X0, X1, X2, X3);
    288. 

  288.         X0 ^= wKey[4]; X1 ^= wKey[5]; X2 ^= wKey[6]; X3 ^= wKey[7];
    289. 

  289.         inverseLT(); ib0(X0, X1, X2, X3);
    290. 

  290. 

  291.         Pack.intToLittleEndian(X0 ^ wKey[0], output, outOff);
    292. 

  292.         Pack.intToLittleEndian(X1 ^ wKey[1], output, outOff + 4);
    293. 

  293.         Pack.intToLittleEndian(X2 ^ wKey[2], output, outOff + 8);
    294. 

  294.         Pack.intToLittleEndian(X3 ^ wKey[3], output, outOff + 12);
    295. 

  295.     }
    296. 

  296. }
    297.