Line data Source code
1 : /* fd_aes_ref.c was imported from the OpenSSL project circa 2023-Aug.
2 : Original source file: crypto/aes/aes_core.c */
3 :
4 : /*
5 : * Copyright 2002-2022 The OpenSSL Project Authors. All Rights Reserved.
6 : *
7 : * Licensed under the Apache License 2.0 (the "License"). You may not use
8 : * this file except in compliance with the License. You can obtain a copy
9 : * in the file LICENSE in the source distribution or at
10 : * https://www.openssl.org/source/license.html
11 : */
12 :
13 : /**
14 : * rijndael-alg-fst.c
15 : *
16 : * @version 3.0 (December 2000)
17 : *
18 : * Optimised ANSI C code for the Rijndael cipher (now AES)
19 : *
20 : * @author Vincent Rijmen
21 : * @author Antoon Bosselaers
22 : * @author Paulo Barreto
23 : *
24 : * This code is hereby placed in the public domain.
25 : *
26 : * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ''AS IS'' AND ANY EXPRESS
27 : * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
28 : * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29 : * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE
30 : * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
31 : * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
32 : * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
33 : * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
34 : * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
35 : * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
36 : * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
37 : */
38 :
39 : /* Note: rewritten a little bit to provide error control and an OpenSSL-
40 : compatible API */
41 :
42 : #include <stdlib.h>
43 : #include "fd_aes_gcm_ref.h"
44 :
45 : typedef union {
46 : uchar b[8];
47 : uint w[2];
48 : ulong d;
49 : } uni;
50 :
51 : /*
52 : * Compute w := (w * x) mod (x^8 + x^4 + x^3 + x^1 + 1)
53 : * Therefore the name "xtime".
54 : */
55 : static void
56 0 : XtimeWord( uint * w ) {
57 0 : uint a, b;
58 :
59 0 : a = *w;
60 0 : b = a & 0x80808080u;
61 0 : a ^= b;
62 0 : b -= b >> 7;
63 0 : b &= 0x1B1B1B1Bu;
64 0 : b ^= a << 1;
65 0 : *w = b;
66 0 : }
67 :
68 : static void
69 0 : XtimeLong( ulong * w ) {
70 0 : ulong a, b;
71 :
72 0 : a = *w;
73 0 : b = a & (ulong)(0x8080808080808080);
74 0 : a ^= b;
75 0 : b -= b >> 7;
76 0 : b &= (ulong)(0x1B1B1B1B1B1B1B1B);
77 0 : b ^= a << 1;
78 0 : *w = b;
79 0 : }
80 :
81 : /*
82 : * This computes w := S * w ^ -1 + c, where c = {01100011}.
83 : * Instead of using GF(2^8) mod (x^8+x^4+x^3+x+1} we do the inversion
84 : * in GF(GF(GF(2^2)^2)^2) mod (X^2+X+8)
85 : * and GF(GF(2^2)^2) mod (X^2+X+2)
86 : * and GF(2^2) mod (X^2+X+1)
87 : * The first part of the algorithm below transfers the coordinates
88 : * {0x01,0x02,0x04,0x08,0x10,0x20,0x40,0x80} =>
89 : * {1,Y,Y^2,Y^3,Y^4,Y^5,Y^6,Y^7} with Y=0x41:
90 : * {0x01,0x41,0x66,0x6c,0x56,0x9a,0x58,0xc4}
91 : * The last part undoes the coordinate transfer and the final affine
92 : * transformation S:
93 : * b[i] = b[i] + b[(i+4)%8] + b[(i+5)%8] + b[(i+6)%8] + b[(i+7)%8] + c[i]
94 : * in one step.
95 : * The multiplication in GF(2^2^2^2) is done in ordinary coords:
96 : * A = (a0*1 + a1*x^4)
97 : * B = (b0*1 + b1*x^4)
98 : * AB = ((a0*b0 + 8*a1*b1)*1 + (a1*b0 + (a0+a1)*b1)*x^4)
99 : * When A = (a0,a1) is given we want to solve AB = 1:
100 : * (a) 1 = a0*b0 + 8*a1*b1
101 : * (b) 0 = a1*b0 + (a0+a1)*b1
102 : * => multiply (a) by a1 and (b) by a0
103 : * (c) a1 = a1*a0*b0 + (8*a1*a1)*b1
104 : * (d) 0 = a1*a0*b0 + (a0*a0+a1*a0)*b1
105 : * => add (c) + (d)
106 : * (e) a1 = (a0*a0 + a1*a0 + 8*a1*a1)*b1
107 : * => therefore
108 : * b1 = (a0*a0 + a1*a0 + 8*a1*a1)^-1 * a1
109 : * => and adding (a1*b0) to (b) we get
110 : * (f) a1*b0 = (a0+a1)*b1
111 : * => therefore
112 : * b0 = (a0*a0 + a1*a0 + 8*a1*a1)^-1 * (a0+a1)
113 : * Note this formula also works for the case
114 : * (a0+a1)*a0 + 8*a1*a1 = 0
115 : * if the inverse element for 0^-1 is mapped to 0.
116 : * Repeat the same for GF(2^2^2) and GF(2^2).
117 : * We get the following algorithm:
118 : * inv8(a0,a1):
119 : * x0 = a0^a1
120 : * [y0,y1] = mul4([x0,a1],[a0,a1]); (*)
121 : * y1 = mul4(8,y1);
122 : * t = inv4(y0^y1);
123 : * [b0,b1] = mul4([x0,a1],[t,t]); (*)
124 : * return [b0,b1];
125 : * The non-linear multiplies (*) can be done in parallel at no extra cost.
126 : */
127 : static void
128 0 : SubWord( uint * w ) {
129 0 : uint x, y, a1, a2, a3, a4, a5, a6;
130 :
131 0 : x = *w;
132 0 : y = ((x & 0xFEFEFEFEu) >> 1) | ((x & 0x01010101u) << 7);
133 0 : x &= 0xDDDDDDDDu;
134 0 : x ^= y & 0x57575757u;
135 0 : y = ((y & 0xFEFEFEFEu) >> 1) | ((y & 0x01010101u) << 7);
136 0 : x ^= y & 0x1C1C1C1Cu;
137 0 : y = ((y & 0xFEFEFEFEu) >> 1) | ((y & 0x01010101u) << 7);
138 0 : x ^= y & 0x4A4A4A4Au;
139 0 : y = ((y & 0xFEFEFEFEu) >> 1) | ((y & 0x01010101u) << 7);
140 0 : x ^= y & 0x42424242u;
141 0 : y = ((y & 0xFEFEFEFEu) >> 1) | ((y & 0x01010101u) << 7);
142 0 : x ^= y & 0x64646464u;
143 0 : y = ((y & 0xFEFEFEFEu) >> 1) | ((y & 0x01010101u) << 7);
144 0 : x ^= y & 0xE0E0E0E0u;
145 0 : a1 = x;
146 0 : a1 ^= (x & 0xF0F0F0F0u) >> 4;
147 0 : a2 = ((x & 0xCCCCCCCCu) >> 2) | ((x & 0x33333333u) << 2);
148 0 : a3 = x & a1;
149 0 : a3 ^= (a3 & 0xAAAAAAAAu) >> 1;
150 0 : a3 ^= (((x << 1) & a1) ^ ((a1 << 1) & x)) & 0xAAAAAAAAu;
151 0 : a4 = a2 & a1;
152 0 : a4 ^= (a4 & 0xAAAAAAAAu) >> 1;
153 0 : a4 ^= (((a2 << 1) & a1) ^ ((a1 << 1) & a2)) & 0xAAAAAAAAu;
154 0 : a5 = (a3 & 0xCCCCCCCCu) >> 2;
155 0 : a3 ^= ((a4 << 2) ^ a4) & 0xCCCCCCCCu;
156 0 : a4 = a5 & 0x22222222u;
157 0 : a4 |= a4 >> 1;
158 0 : a4 ^= (a5 << 1) & 0x22222222u;
159 0 : a3 ^= a4;
160 0 : a5 = a3 & 0xA0A0A0A0u;
161 0 : a5 |= a5 >> 1;
162 0 : a5 ^= (a3 << 1) & 0xA0A0A0A0u;
163 0 : a4 = a5 & 0xC0C0C0C0u;
164 0 : a6 = a4 >> 2;
165 0 : a4 ^= (a5 << 2) & 0xC0C0C0C0u;
166 0 : a5 = a6 & 0x20202020u;
167 0 : a5 |= a5 >> 1;
168 0 : a5 ^= (a6 << 1) & 0x20202020u;
169 0 : a4 |= a5;
170 0 : a3 ^= a4 >> 4;
171 0 : a3 &= 0x0F0F0F0Fu;
172 0 : a2 = a3;
173 0 : a2 ^= (a3 & 0x0C0C0C0Cu) >> 2;
174 0 : a4 = a3 & a2;
175 0 : a4 ^= (uint)(a4 & 0x0A0A0A0A0Au) >> 1u;
176 0 : a4 ^= (((a3 << 1) & a2) ^ ((a2 << 1) & a3)) & 0x0A0A0A0Au;
177 0 : a5 = a4 & 0x08080808u;
178 0 : a5 |= a5 >> 1;
179 0 : a5 ^= (a4 << 1) & 0x08080808u;
180 0 : a4 ^= a5 >> 2;
181 0 : a4 &= 0x03030303u;
182 0 : a4 ^= (a4 & 0x02020202u) >> 1;
183 0 : a4 |= a4 << 2;
184 0 : a3 = a2 & a4;
185 0 : a3 ^= (a3 & 0x0A0A0A0Au) >> 1;
186 0 : a3 ^= (((a2 << 1) & a4) ^ ((a4 << 1) & a2)) & 0x0A0A0A0Au;
187 0 : a3 |= a3 << 4;
188 0 : a2 = ((a1 & 0xCCCCCCCCu) >> 2) | ((a1 & 0x33333333u) << 2);
189 0 : x = a1 & a3;
190 0 : x ^= (x & 0xAAAAAAAAu) >> 1;
191 0 : x ^= (((a1 << 1) & a3) ^ ((a3 << 1) & a1)) & 0xAAAAAAAAu;
192 0 : a4 = a2 & a3;
193 0 : a4 ^= (a4 & 0xAAAAAAAAu) >> 1;
194 0 : a4 ^= (((a2 << 1) & a3) ^ ((a3 << 1) & a2)) & 0xAAAAAAAAu;
195 0 : a5 = (x & 0xCCCCCCCCu) >> 2;
196 0 : x ^= ((a4 << 2) ^ a4) & 0xCCCCCCCCu;
197 0 : a4 = a5 & 0x22222222u;
198 0 : a4 |= a4 >> 1;
199 0 : a4 ^= (a5 << 1) & 0x22222222u;
200 0 : x ^= a4;
201 0 : y = ((x & 0xFEFEFEFEu) >> 1) | ((x & 0x01010101u) << 7);
202 0 : x &= 0x39393939u;
203 0 : x ^= y & 0x3F3F3F3Fu;
204 0 : y = ((y & 0xFCFCFCFCu) >> 2) | ((y & 0x03030303u) << 6);
205 0 : x ^= y & 0x97979797u;
206 0 : y = ((y & 0xFEFEFEFEu) >> 1) | ((y & 0x01010101u) << 7);
207 0 : x ^= y & 0x9B9B9B9Bu;
208 0 : y = ((y & 0xFEFEFEFEu) >> 1) | ((y & 0x01010101u) << 7);
209 0 : x ^= y & 0x3C3C3C3Cu;
210 0 : y = ((y & 0xFEFEFEFEu) >> 1) | ((y & 0x01010101u) << 7);
211 0 : x ^= y & 0xDDDDDDDDu;
212 0 : y = ((y & 0xFEFEFEFEu) >> 1) | ((y & 0x01010101u) << 7);
213 0 : x ^= y & 0x72727272u;
214 0 : x ^= 0x63636363u;
215 0 : *w = x;
216 0 : }
217 :
218 : static void
219 0 : SubLong( ulong * w ) {
220 0 : ulong x, y, a1, a2, a3, a4, a5, a6;
221 :
222 0 : x = *w;
223 0 : y = ((x & (0xFEFEFEFEFEFEFEFEUL)) >> 1) | ((x & (0x0101010101010101UL)) << 7);
224 0 : x &= (0xDDDDDDDDDDDDDDDDUL);
225 0 : x ^= y & (0x5757575757575757UL);
226 0 : y = ((y & (0xFEFEFEFEFEFEFEFEUL)) >> 1) | ((y & (0x0101010101010101UL)) << 7);
227 0 : x ^= y & (0x1C1C1C1C1C1C1C1CUL);
228 0 : y = ((y & (0xFEFEFEFEFEFEFEFEUL)) >> 1) | ((y & (0x0101010101010101UL)) << 7);
229 0 : x ^= y & (0x4A4A4A4A4A4A4A4AUL);
230 0 : y = ((y & (0xFEFEFEFEFEFEFEFEUL)) >> 1) | ((y & (0x0101010101010101UL)) << 7);
231 0 : x ^= y & (0x4242424242424242UL);
232 0 : y = ((y & (0xFEFEFEFEFEFEFEFEUL)) >> 1) | ((y & (0x0101010101010101UL)) << 7);
233 0 : x ^= y & (0x6464646464646464UL);
234 0 : y = ((y & (0xFEFEFEFEFEFEFEFEUL)) >> 1) | ((y & (0x0101010101010101UL)) << 7);
235 0 : x ^= y & (0xE0E0E0E0E0E0E0E0UL);
236 0 : a1 = x;
237 0 : a1 ^= (x & (0xF0F0F0F0F0F0F0F0UL)) >> 4;
238 0 : a2 = ((x & (0xCCCCCCCCCCCCCCCCUL)) >> 2) | ((x & (0x3333333333333333UL)) << 2);
239 0 : a3 = x & a1;
240 0 : a3 ^= (a3 & (0xAAAAAAAAAAAAAAAAUL)) >> 1;
241 0 : a3 ^= (((x << 1) & a1) ^ ((a1 << 1) & x)) & (0xAAAAAAAAAAAAAAAAUL);
242 0 : a4 = a2 & a1;
243 0 : a4 ^= (a4 & (0xAAAAAAAAAAAAAAAAUL)) >> 1;
244 0 : a4 ^= (((a2 << 1) & a1) ^ ((a1 << 1) & a2)) & (0xAAAAAAAAAAAAAAAAUL);
245 0 : a5 = (a3 & (0xCCCCCCCCCCCCCCCCUL)) >> 2;
246 0 : a3 ^= ((a4 << 2) ^ a4) & (0xCCCCCCCCCCCCCCCCUL);
247 0 : a4 = a5 & (0x2222222222222222UL);
248 0 : a4 |= a4 >> 1;
249 0 : a4 ^= (a5 << 1) & (0x2222222222222222UL);
250 0 : a3 ^= a4;
251 0 : a5 = a3 & (0xA0A0A0A0A0A0A0A0UL);
252 0 : a5 |= a5 >> 1;
253 0 : a5 ^= (a3 << 1) & (0xA0A0A0A0A0A0A0A0UL);
254 0 : a4 = a5 & (0xC0C0C0C0C0C0C0C0UL);
255 0 : a6 = a4 >> 2;
256 0 : a4 ^= (a5 << 2) & (0xC0C0C0C0C0C0C0C0UL);
257 0 : a5 = a6 & (0x2020202020202020UL);
258 0 : a5 |= a5 >> 1;
259 0 : a5 ^= (a6 << 1) & (0x2020202020202020UL);
260 0 : a4 |= a5;
261 0 : a3 ^= a4 >> 4;
262 0 : a3 &= (0x0F0F0F0F0F0F0F0FUL);
263 0 : a2 = a3;
264 0 : a2 ^= (a3 & (0x0C0C0C0C0C0C0C0CUL)) >> 2;
265 0 : a4 = a3 & a2;
266 0 : a4 ^= (a4 & (0x0A0A0A0A0A0A0A0AUL)) >> 1;
267 0 : a4 ^= (((a3 << 1) & a2) ^ ((a2 << 1) & a3)) & (0x0A0A0A0A0A0A0A0AUL);
268 0 : a5 = a4 & (0x0808080808080808UL);
269 0 : a5 |= a5 >> 1;
270 0 : a5 ^= (a4 << 1) & (0x0808080808080808UL);
271 0 : a4 ^= a5 >> 2;
272 0 : a4 &= (0x0303030303030303UL);
273 0 : a4 ^= (a4 & (0x0202020202020202UL)) >> 1;
274 0 : a4 |= a4 << 2;
275 0 : a3 = a2 & a4;
276 0 : a3 ^= (a3 & (0x0A0A0A0A0A0A0A0AUL)) >> 1;
277 0 : a3 ^= (((a2 << 1) & a4) ^ ((a4 << 1) & a2)) & (0x0A0A0A0A0A0A0A0AUL);
278 0 : a3 |= a3 << 4;
279 0 : a2 = ((a1 & (0xCCCCCCCCCCCCCCCCUL)) >> 2) | ((a1 & (0x3333333333333333UL)) << 2);
280 0 : x = a1 & a3;
281 0 : x ^= (x & (0xAAAAAAAAAAAAAAAAUL)) >> 1;
282 0 : x ^= (((a1 << 1) & a3) ^ ((a3 << 1) & a1)) & (0xAAAAAAAAAAAAAAAAUL);
283 0 : a4 = a2 & a3;
284 0 : a4 ^= (a4 & (0xAAAAAAAAAAAAAAAAUL)) >> 1;
285 0 : a4 ^= (((a2 << 1) & a3) ^ ((a3 << 1) & a2)) & (0xAAAAAAAAAAAAAAAAUL);
286 0 : a5 = (x & (0xCCCCCCCCCCCCCCCCUL)) >> 2;
287 0 : x ^= ((a4 << 2) ^ a4) & (0xCCCCCCCCCCCCCCCCUL);
288 0 : a4 = a5 & (0x2222222222222222UL);
289 0 : a4 |= a4 >> 1;
290 0 : a4 ^= (a5 << 1) & (0x2222222222222222UL);
291 0 : x ^= a4;
292 0 : y = ((x & (0xFEFEFEFEFEFEFEFEUL)) >> 1) | ((x & (0x0101010101010101UL)) << 7);
293 0 : x &= (0x3939393939393939UL);
294 0 : x ^= y & (0x3F3F3F3F3F3F3F3FUL);
295 0 : y = ((y & (0xFCFCFCFCFCFCFCFCUL)) >> 2) | ((y & (0x0303030303030303UL)) << 6);
296 0 : x ^= y & (0x9797979797979797UL);
297 0 : y = ((y & (0xFEFEFEFEFEFEFEFEUL)) >> 1) | ((y & (0x0101010101010101UL)) << 7);
298 0 : x ^= y & (0x9B9B9B9B9B9B9B9BUL);
299 0 : y = ((y & (0xFEFEFEFEFEFEFEFEUL)) >> 1) | ((y & (0x0101010101010101UL)) << 7);
300 0 : x ^= y & (0x3C3C3C3C3C3C3C3CUL);
301 0 : y = ((y & (0xFEFEFEFEFEFEFEFEUL)) >> 1) | ((y & (0x0101010101010101UL)) << 7);
302 0 : x ^= y & (0xDDDDDDDDDDDDDDDDUL);
303 0 : y = ((y & (0xFEFEFEFEFEFEFEFEUL)) >> 1) | ((y & (0x0101010101010101UL)) << 7);
304 0 : x ^= y & (0x7272727272727272UL);
305 0 : x ^= (0x6363636363636363UL);
306 0 : *w = x;
307 0 : }
308 :
309 : /*
310 : * This computes w := (S^-1 * (w + c))^-1
311 : */
312 : static void
313 0 : InvSubLong( ulong * w ) {
314 0 : ulong x, y, a1, a2, a3, a4, a5, a6;
315 :
316 0 : x = *w;
317 0 : x ^= (0x6363636363636363UL);
318 0 : y = ((x & (0xFEFEFEFEFEFEFEFEUL)) >> 1) | ((x & (0x0101010101010101UL)) << 7);
319 0 : x &= (0xFDFDFDFDFDFDFDFDUL);
320 0 : x ^= y & (0x5E5E5E5E5E5E5E5EUL);
321 0 : y = ((y & (0xFEFEFEFEFEFEFEFEUL)) >> 1) | ((y & (0x0101010101010101UL)) << 7);
322 0 : x ^= y & (0xF3F3F3F3F3F3F3F3UL);
323 0 : y = ((y & (0xFEFEFEFEFEFEFEFEUL)) >> 1) | ((y & (0x0101010101010101UL)) << 7);
324 0 : x ^= y & (0xF5F5F5F5F5F5F5F5UL);
325 0 : y = ((y & (0xFEFEFEFEFEFEFEFEUL)) >> 1) | ((y & (0x0101010101010101UL)) << 7);
326 0 : x ^= y & (0x7878787878787878UL);
327 0 : y = ((y & (0xFEFEFEFEFEFEFEFEUL)) >> 1) | ((y & (0x0101010101010101UL)) << 7);
328 0 : x ^= y & (0x7777777777777777UL);
329 0 : y = ((y & (0xFEFEFEFEFEFEFEFEUL)) >> 1) | ((y & (0x0101010101010101UL)) << 7);
330 0 : x ^= y & (0x1515151515151515UL);
331 0 : y = ((y & (0xFEFEFEFEFEFEFEFEUL)) >> 1) | ((y & (0x0101010101010101UL)) << 7);
332 0 : x ^= y & (0xA5A5A5A5A5A5A5A5UL);
333 0 : a1 = x;
334 0 : a1 ^= (x & (0xF0F0F0F0F0F0F0F0UL)) >> 4;
335 0 : a2 = ((x & (0xCCCCCCCCCCCCCCCCUL)) >> 2) | ((x & (0x3333333333333333UL)) << 2);
336 0 : a3 = x & a1;
337 0 : a3 ^= (a3 & (0xAAAAAAAAAAAAAAAAUL)) >> 1;
338 0 : a3 ^= (((x << 1) & a1) ^ ((a1 << 1) & x)) & (0xAAAAAAAAAAAAAAAAUL);
339 0 : a4 = a2 & a1;
340 0 : a4 ^= (a4 & (0xAAAAAAAAAAAAAAAAUL)) >> 1;
341 0 : a4 ^= (((a2 << 1) & a1) ^ ((a1 << 1) & a2)) & (0xAAAAAAAAAAAAAAAAUL);
342 0 : a5 = (a3 & (0xCCCCCCCCCCCCCCCCUL)) >> 2;
343 0 : a3 ^= ((a4 << 2) ^ a4) & (0xCCCCCCCCCCCCCCCCUL);
344 0 : a4 = a5 & (0x2222222222222222UL);
345 0 : a4 |= a4 >> 1;
346 0 : a4 ^= (a5 << 1) & (0x2222222222222222UL);
347 0 : a3 ^= a4;
348 0 : a5 = a3 & (0xA0A0A0A0A0A0A0A0UL);
349 0 : a5 |= a5 >> 1;
350 0 : a5 ^= (a3 << 1) & (0xA0A0A0A0A0A0A0A0UL);
351 0 : a4 = a5 & (0xC0C0C0C0C0C0C0C0UL);
352 0 : a6 = a4 >> 2;
353 0 : a4 ^= (a5 << 2) & (0xC0C0C0C0C0C0C0C0UL);
354 0 : a5 = a6 & (0x2020202020202020UL);
355 0 : a5 |= a5 >> 1;
356 0 : a5 ^= (a6 << 1) & (0x2020202020202020UL);
357 0 : a4 |= a5;
358 0 : a3 ^= a4 >> 4;
359 0 : a3 &= (0x0F0F0F0F0F0F0F0FUL);
360 0 : a2 = a3;
361 0 : a2 ^= (a3 & (0x0C0C0C0C0C0C0C0CUL)) >> 2;
362 0 : a4 = a3 & a2;
363 0 : a4 ^= (a4 & (0x0A0A0A0A0A0A0A0AUL)) >> 1;
364 0 : a4 ^= (((a3 << 1) & a2) ^ ((a2 << 1) & a3)) & (0x0A0A0A0A0A0A0A0AUL);
365 0 : a5 = a4 & (0x0808080808080808UL);
366 0 : a5 |= a5 >> 1;
367 0 : a5 ^= (a4 << 1) & (0x0808080808080808UL);
368 0 : a4 ^= a5 >> 2;
369 0 : a4 &= (0x0303030303030303UL);
370 0 : a4 ^= (a4 & (0x0202020202020202UL)) >> 1;
371 0 : a4 |= a4 << 2;
372 0 : a3 = a2 & a4;
373 0 : a3 ^= (a3 & (0x0A0A0A0A0A0A0A0AUL)) >> 1;
374 0 : a3 ^= (((a2 << 1) & a4) ^ ((a4 << 1) & a2)) & (0x0A0A0A0A0A0A0A0AUL);
375 0 : a3 |= a3 << 4;
376 0 : a2 = ((a1 & (0xCCCCCCCCCCCCCCCCUL)) >> 2) | ((a1 & (0x3333333333333333UL)) << 2);
377 0 : x = a1 & a3;
378 0 : x ^= (x & (0xAAAAAAAAAAAAAAAAUL)) >> 1;
379 0 : x ^= (((a1 << 1) & a3) ^ ((a3 << 1) & a1)) & (0xAAAAAAAAAAAAAAAAUL);
380 0 : a4 = a2 & a3;
381 0 : a4 ^= (a4 & (0xAAAAAAAAAAAAAAAAUL)) >> 1;
382 0 : a4 ^= (((a2 << 1) & a3) ^ ((a3 << 1) & a2)) & (0xAAAAAAAAAAAAAAAAUL);
383 0 : a5 = (x & (0xCCCCCCCCCCCCCCCCUL)) >> 2;
384 0 : x ^= ((a4 << 2) ^ a4) & (0xCCCCCCCCCCCCCCCCUL);
385 0 : a4 = a5 & (0x2222222222222222UL);
386 0 : a4 |= a4 >> 1;
387 0 : a4 ^= (a5 << 1) & (0x2222222222222222UL);
388 0 : x ^= a4;
389 0 : y = ((x & (0xFEFEFEFEFEFEFEFEUL)) >> 1) | ((x & (0x0101010101010101UL)) << 7);
390 0 : x &= (0xB5B5B5B5B5B5B5B5UL);
391 0 : x ^= y & (0x4040404040404040UL);
392 0 : y = ((y & (0xFEFEFEFEFEFEFEFEUL)) >> 1) | ((y & (0x0101010101010101UL)) << 7);
393 0 : x ^= y & (0x8080808080808080UL);
394 0 : y = ((y & (0xFEFEFEFEFEFEFEFEUL)) >> 1) | ((y & (0x0101010101010101UL)) << 7);
395 0 : x ^= y & (0x1616161616161616UL);
396 0 : y = ((y & (0xFEFEFEFEFEFEFEFEUL)) >> 1) | ((y & (0x0101010101010101UL)) << 7);
397 0 : x ^= y & (0xEBEBEBEBEBEBEBEBUL);
398 0 : y = ((y & (0xFEFEFEFEFEFEFEFEUL)) >> 1) | ((y & (0x0101010101010101UL)) << 7);
399 0 : x ^= y & (0x9797979797979797UL);
400 0 : y = ((y & (0xFEFEFEFEFEFEFEFEUL)) >> 1) | ((y & (0x0101010101010101UL)) << 7);
401 0 : x ^= y & (0xFBFBFBFBFBFBFBFBUL);
402 0 : y = ((y & (0xFEFEFEFEFEFEFEFEUL)) >> 1) | ((y & (0x0101010101010101UL)) << 7);
403 0 : x ^= y & (0x7D7D7D7D7D7D7D7DUL);
404 0 : *w = x;
405 0 : }
406 :
407 : static void
408 0 : ShiftRows( ulong * state ) {
409 0 : uchar s[4];
410 0 : uchar *s0;
411 0 : int r;
412 :
413 0 : s0 = (uchar *)state;
414 0 : for (r = 0; r < 4; r++) {
415 0 : s[0] = s0[0*4 + r];
416 0 : s[1] = s0[1*4 + r];
417 0 : s[2] = s0[2*4 + r];
418 0 : s[3] = s0[3*4 + r];
419 0 : s0[0*4 + r] = s[(r+0) % 4];
420 0 : s0[1*4 + r] = s[(r+1) % 4];
421 0 : s0[2*4 + r] = s[(r+2) % 4];
422 0 : s0[3*4 + r] = s[(r+3) % 4];
423 0 : }
424 0 : }
425 :
426 : static void
427 0 : InvShiftRows( ulong * state ) {
428 0 : uchar s[4];
429 0 : uchar *s0;
430 0 : int r;
431 :
432 0 : s0 = (uchar *)state;
433 0 : for (r = 0; r < 4; r++) {
434 0 : s[0] = s0[0*4 + r];
435 0 : s[1] = s0[1*4 + r];
436 0 : s[2] = s0[2*4 + r];
437 0 : s[3] = s0[3*4 + r];
438 0 : s0[0*4 + r] = s[(4-r) % 4];
439 0 : s0[1*4 + r] = s[(5-r) % 4];
440 0 : s0[2*4 + r] = s[(6-r) % 4];
441 0 : s0[3*4 + r] = s[(7-r) % 4];
442 0 : }
443 0 : }
444 :
445 : static void
446 0 : MixColumns( ulong * state ) {
447 0 : uni s1;
448 0 : uni s;
449 0 : int c;
450 :
451 0 : for (c = 0; c < 2; c++) {
452 0 : s1.d = state[c];
453 0 : s.d = s1.d;
454 0 : s.d ^= ((s.d & (0xFFFF0000FFFF0000UL)) >> 16)
455 0 : | ((s.d & (0x0000FFFF0000FFFFUL)) << 16);
456 0 : s.d ^= ((s.d & (0xFF00FF00FF00FF00UL)) >> 8)
457 0 : | ((s.d & (0x00FF00FF00FF00FFUL)) << 8);
458 0 : s.d ^= s1.d;
459 0 : XtimeLong(&s1.d);
460 0 : s.d ^= s1.d;
461 0 : s.b[0] ^= s1.b[1];
462 0 : s.b[1] ^= s1.b[2];
463 0 : s.b[2] ^= s1.b[3];
464 0 : s.b[3] ^= s1.b[0];
465 0 : s.b[4] ^= s1.b[5];
466 0 : s.b[5] ^= s1.b[6];
467 0 : s.b[6] ^= s1.b[7];
468 0 : s.b[7] ^= s1.b[4];
469 0 : state[c] = s.d;
470 0 : }
471 0 : }
472 :
473 : static void InvMixColumns(ulong * state)
474 0 : {
475 0 : uni s1;
476 0 : uni s;
477 0 : int c;
478 :
479 0 : for (c = 0; c < 2; c++) {
480 0 : s1.d = state[c];
481 0 : s.d = s1.d;
482 0 : s.d ^= ((s.d & (0xFFFF0000FFFF0000UL)) >> 16)
483 0 : | ((s.d & (0x0000FFFF0000FFFFUL)) << 16);
484 0 : s.d ^= ((s.d & (0xFF00FF00FF00FF00UL)) >> 8)
485 0 : | ((s.d & (0x00FF00FF00FF00FFUL)) << 8);
486 0 : s.d ^= s1.d;
487 0 : XtimeLong(&s1.d);
488 0 : s.d ^= s1.d;
489 0 : s.b[0] ^= s1.b[1];
490 0 : s.b[1] ^= s1.b[2];
491 0 : s.b[2] ^= s1.b[3];
492 0 : s.b[3] ^= s1.b[0];
493 0 : s.b[4] ^= s1.b[5];
494 0 : s.b[5] ^= s1.b[6];
495 0 : s.b[6] ^= s1.b[7];
496 0 : s.b[7] ^= s1.b[4];
497 0 : XtimeLong(&s1.d);
498 0 : s1.d ^= ((s1.d & (0xFFFF0000FFFF0000UL)) >> 16)
499 0 : | ((s1.d & (0x0000FFFF0000FFFFUL)) << 16);
500 0 : s.d ^= s1.d;
501 0 : XtimeLong(&s1.d);
502 0 : s1.d ^= ((s1.d & (0xFF00FF00FF00FF00UL)) >> 8)
503 0 : | ((s1.d & (0x00FF00FF00FF00FFUL)) << 8);
504 0 : s.d ^= s1.d;
505 0 : state[c] = s.d;
506 0 : }
507 0 : }
508 :
509 : static void
510 : AddRoundKey( ulong * state,
511 0 : ulong const * w ) {
512 0 : state[0] ^= w[0];
513 0 : state[1] ^= w[1];
514 0 : }
515 :
516 : static void
517 : Cipher( uchar const * in,
518 : uchar * out,
519 : ulong const * w,
520 0 : int nr ) {
521 0 : ulong state[2];
522 0 : int i;
523 :
524 0 : memcpy(state, in, 16);
525 :
526 0 : AddRoundKey(state, w);
527 :
528 0 : for (i = 1; i < nr; i++) {
529 0 : SubLong(&state[0]);
530 0 : SubLong(&state[1]);
531 0 : ShiftRows(state);
532 0 : MixColumns(state);
533 0 : AddRoundKey(state, w + i*2);
534 0 : }
535 :
536 0 : SubLong(&state[0]);
537 0 : SubLong(&state[1]);
538 0 : ShiftRows(state);
539 0 : AddRoundKey(state, w + nr*2);
540 :
541 0 : memcpy(out, state, 16);
542 0 : }
543 :
544 : static void
545 : InvCipher( uchar const * in,
546 : uchar * out,
547 : ulong const * w,
548 0 : int nr ) {
549 0 : ulong state[2];
550 0 : int i;
551 :
552 0 : memcpy(state, in, 16);
553 :
554 0 : AddRoundKey(state, w + nr*2);
555 :
556 0 : for (i = nr - 1; i > 0; i--) {
557 0 : InvShiftRows(state);
558 0 : InvSubLong(&state[0]);
559 0 : InvSubLong(&state[1]);
560 0 : AddRoundKey(state, w + i*2);
561 0 : InvMixColumns(state);
562 0 : }
563 :
564 0 : InvShiftRows(state);
565 0 : InvSubLong(&state[0]);
566 0 : InvSubLong(&state[1]);
567 0 : AddRoundKey(state, w);
568 :
569 0 : memcpy(out, state, 16);
570 0 : }
571 :
572 : static void
573 0 : RotWord( uint * x ) {
574 0 : uchar *w0;
575 0 : uchar tmp;
576 :
577 0 : w0 = (uchar *)x;
578 0 : tmp = w0[0];
579 0 : w0[0] = w0[1];
580 0 : w0[1] = w0[2];
581 0 : w0[2] = w0[3];
582 0 : w0[3] = tmp;
583 0 : }
584 :
585 : static void
586 : KeyExpansion( uchar const * key,
587 : ulong * w,
588 : int nr,
589 0 : int nk ) {
590 0 : uint rcon;
591 0 : uni prev;
592 0 : uint temp;
593 0 : int i, n;
594 :
595 0 : memcpy( w, key, (ulong)nk*4UL );
596 0 : memcpy( &rcon, "\1\0\0\0", 4 );
597 0 : n = nk/2;
598 0 : prev.d = w[n-1];
599 0 : for (i = n; i < (nr+1)*2; i++) {
600 0 : temp = prev.w[1];
601 0 : if (i % n == 0) {
602 0 : RotWord(&temp);
603 0 : SubWord(&temp);
604 0 : temp ^= rcon;
605 0 : XtimeWord(&rcon);
606 0 : } else if (nk > 6 && i % n == 2) {
607 0 : SubWord(&temp);
608 0 : }
609 0 : prev.d = w[i-n];
610 0 : prev.w[0] ^= temp;
611 0 : prev.w[1] ^= prev.w[0];
612 0 : w[i] = prev.d;
613 0 : }
614 0 : }
615 :
616 : /**
617 : * Expand the cipher key into the encryption key schedule.
618 : */
619 : int
620 : fd_aes_ref_set_encrypt_key( uchar const * userKey,
621 : ulong const bits,
622 0 : fd_aes_key_ref_t * key ) {
623 0 : ulong *rk;
624 :
625 0 : if (!userKey || !key)
626 0 : return -1;
627 0 : if (bits != 128 && bits != 192 && bits != 256)
628 0 : return -2;
629 :
630 0 : rk = (ulong *)fd_type_pun( key->rd_key ); /* strict aliasing violation */
631 :
632 0 : if (bits == 128)
633 0 : key->rounds = 10;
634 0 : else if (bits == 192)
635 0 : key->rounds = 12;
636 0 : else
637 0 : key->rounds = 14;
638 :
639 0 : KeyExpansion(userKey, rk, key->rounds, (int)(bits/32UL) );
640 0 : return 0;
641 0 : }
642 :
643 : /**
644 : * Expand the cipher key into the decryption key schedule.
645 : */
646 : int
647 : fd_aes_ref_set_decrypt_key( uchar const * userKey,
648 : ulong const bits,
649 0 : fd_aes_key_ref_t * key ) {
650 0 : return fd_aes_ref_set_encrypt_key(userKey, bits, key);
651 0 : }
652 :
653 : /*
654 : * Encrypt a single block
655 : * in and out can overlap
656 : */
657 : void
658 : fd_aes_ref_encrypt_core( uchar const * in,
659 : uchar * out,
660 0 : fd_aes_key_ref_t const * key ) {
661 :
662 0 : FD_DCHECK_CRIT( in && out && key, "invalid params" );
663 0 : ulong const * rk = (ulong *)fd_type_pun_const( key->rd_key );
664 :
665 0 : Cipher(in, out, rk, key->rounds);
666 0 : }
667 :
668 : /*
669 : * Decrypt a single block
670 : * in and out can overlap
671 : */
672 : void
673 : fd_aes_ref_decrypt_core( uchar const * in,
674 : uchar * out,
675 0 : fd_aes_key_ref_t const * key ) {
676 :
677 0 : FD_DCHECK_CRIT( in && out && key, "invalid params" );
678 0 : ulong const * rk = (ulong const *)fd_type_pun_const( key->rd_key );
679 :
680 0 : InvCipher(in, out, rk, key->rounds );
681 0 : }
|
