Coverage Report

Created: 2020-11-21 08:34

/src/botan/src/lib/block/aes/aes.cpp
Line
Count
Source (jump to first uncovered line)
1
/*
2
* (C) 1999-2010,2015,2017,2018,2020 Jack Lloyd
3
*
4
* Botan is released under the Simplified BSD License (see license.txt)
5
*/
6
7
#include <botan/internal/aes.h>
8
#include <botan/internal/loadstor.h>
9
#include <botan/cpuid.h>
10
#include <botan/internal/rotate.h>
11
#include <botan/internal/bit_ops.h>
12
#include <botan/internal/ct_utils.h>
13
14
namespace Botan {
15
16
#if defined(BOTAN_HAS_AES_POWER8) || defined(BOTAN_HAS_AES_ARMV8) || defined(BOTAN_HAS_AES_NI)
17
   #define BOTAN_HAS_HW_AES_SUPPORT
18
#endif
19
20
/*
21
* One of three AES implementation strategies are used to get a constant time
22
* implementation which is immune to common cache/timing based side channels:
23
*
24
* - If AES hardware support is available (AES-NI, POWER8, Aarch64) use that
25
*
26
* - If 128-bit SIMD with byte shuffles are available (SSSE3, NEON, or Altivec),
27
*   use the vperm technique published by Mike Hamburg at CHES 2009.
28
*
29
* - If no hardware or SIMD support, fall back to a constant time bitsliced
30
*   implementation. This uses 32-bit words resulting in 2 blocks being processed
31
*   in parallel. Moving to 4 blocks (with 64-bit words) would approximately
32
*   double performance on 64-bit CPUs. Likewise moving to 128 bit SIMD would
33
*   again approximately double performance vs 64-bit. However the assumption is
34
*   that most 64-bit CPUs either have hardware AES or SIMD shuffle support and
35
*   that the majority of users falling back to this code will be 32-bit cores.
36
*   If this assumption proves to be unsound, the bitsliced code can easily be
37
*   extended to operate on either 32 or 64 bit words depending on the native
38
*   wordsize of the target processor.
39
*
40
* Useful references
41
*
42
* - "Accelerating AES with Vector Permute Instructions" Mike Hamburg
43
*   https://www.shiftleft.org/papers/vector_aes/vector_aes.pdf
44
*
45
* - "Faster and Timing-Attack Resistant AES-GCM" Käsper and Schwabe
46
*   https://eprint.iacr.org/2009/129.pdf
47
*
48
* - "A new combinational logic minimization technique with applications to cryptology."
49
*   Boyar and Peralta https://eprint.iacr.org/2009/191.pdf
50
*
51
* - "A depth-16 circuit for the AES S-box" Boyar and Peralta
52
*    https://eprint.iacr.org/2011/332.pdf
53
*
54
* - "A Very Compact S-box for AES" Canright
55
*   https://www.iacr.org/archive/ches2005/032.pdf
56
*   https://core.ac.uk/download/pdf/36694529.pdf (extended)
57
*/
58
59
namespace {
60
61
/*
62
This is an AES sbox circuit which can execute in bitsliced mode up to 32x in
63
parallel.
64
65
The circuit is from the "Circuit Minimization Team" group
66
http://www.cs.yale.edu/homes/peralta/CircuitStuff/CMT.html
67
http://www.cs.yale.edu/homes/peralta/CircuitStuff/SLP_AES_113.txt
68
69
This circuit has size 113 and depth 27. In software it is much faster than
70
circuits which are considered faster for hardware purposes (where circuit depth
71
is the critical constraint), because unlike in hardware, on common CPUs we can
72
only execute - at best - 3 or 4 logic operations per cycle. So a smaller circuit
73
is superior. On an x86-64 machine this circuit is about 15% faster than the
74
circuit of size 128 and depth 16 given in "A depth-16 circuit for the AES S-box".
75
76
Another circuit for AES Sbox of size 102 and depth 24 is describted in "New
77
Circuit Minimization Techniques for Smaller and Faster AES SBoxes"
78
[https://eprint.iacr.org/2019/802] however it relies on "non-standard" gates
79
like MUX, NOR, NAND, etc and so in practice in bitsliced software, its size is
80
actually a bit larger than this circuit, as few CPUs have such instructions and
81
otherwise they must be emulated using a sequence of available bit operations.
82
*/
83
void AES_SBOX(uint32_t V[8])
84
0
   {
85
0
   const uint32_t U0 = V[0];
86
0
   const uint32_t U1 = V[1];
87
0
   const uint32_t U2 = V[2];
88
0
   const uint32_t U3 = V[3];
89
0
   const uint32_t U4 = V[4];
90
0
   const uint32_t U5 = V[5];
91
0
   const uint32_t U6 = V[6];
92
0
   const uint32_t U7 = V[7];
93
94
0
   const uint32_t y14 = U3 ^ U5;
95
0
   const uint32_t y13 = U0 ^ U6;
96
0
   const uint32_t y9 = U0 ^ U3;
97
0
   const uint32_t y8 = U0 ^ U5;
98
0
   const uint32_t t0 = U1 ^ U2;
99
0
   const uint32_t y1 = t0 ^ U7;
100
0
   const uint32_t y4 = y1 ^ U3;
101
0
   const uint32_t y12 = y13 ^ y14;
102
0
   const uint32_t y2 = y1 ^ U0;
103
0
   const uint32_t y5 = y1 ^ U6;
104
0
   const uint32_t y3 = y5 ^ y8;
105
0
   const uint32_t t1 = U4 ^ y12;
106
0
   const uint32_t y15 = t1 ^ U5;
107
0
   const uint32_t y20 = t1 ^ U1;
108
0
   const uint32_t y6 = y15 ^ U7;
109
0
   const uint32_t y10 = y15 ^ t0;
110
0
   const uint32_t y11 = y20 ^ y9;
111
0
   const uint32_t y7 = U7 ^ y11;
112
0
   const uint32_t y17 = y10 ^ y11;
113
0
   const uint32_t y19 = y10 ^ y8;
114
0
   const uint32_t y16 = t0 ^ y11;
115
0
   const uint32_t y21 = y13 ^ y16;
116
0
   const uint32_t y18 = U0 ^ y16;
117
0
   const uint32_t t2 = y12 & y15;
118
0
   const uint32_t t3 = y3 & y6;
119
0
   const uint32_t t4 = t3 ^ t2;
120
0
   const uint32_t t5 = y4 & U7;
121
0
   const uint32_t t6 = t5 ^ t2;
122
0
   const uint32_t t7 = y13 & y16;
123
0
   const uint32_t t8 = y5 & y1;
124
0
   const uint32_t t9 = t8 ^ t7;
125
0
   const uint32_t t10 = y2 & y7;
126
0
   const uint32_t t11 = t10 ^ t7;
127
0
   const uint32_t t12 = y9 & y11;
128
0
   const uint32_t t13 = y14 & y17;
129
0
   const uint32_t t14 = t13 ^ t12;
130
0
   const uint32_t t15 = y8 & y10;
131
0
   const uint32_t t16 = t15 ^ t12;
132
0
   const uint32_t t17 = t4 ^ y20;
133
0
   const uint32_t t18 = t6 ^ t16;
134
0
   const uint32_t t19 = t9 ^ t14;
135
0
   const uint32_t t20 = t11 ^ t16;
136
0
   const uint32_t t21 = t17 ^ t14;
137
0
   const uint32_t t22 = t18 ^ y19;
138
0
   const uint32_t t23 = t19 ^ y21;
139
0
   const uint32_t t24 = t20 ^ y18;
140
0
   const uint32_t t25 = t21 ^ t22;
141
0
   const uint32_t t26 = t21 & t23;
142
0
   const uint32_t t27 = t24 ^ t26;
143
0
   const uint32_t t28 = t25 & t27;
144
0
   const uint32_t t29 = t28 ^ t22;
145
0
   const uint32_t t30 = t23 ^ t24;
146
0
   const uint32_t t31 = t22 ^ t26;
147
0
   const uint32_t t32 = t31 & t30;
148
0
   const uint32_t t33 = t32 ^ t24;
149
0
   const uint32_t t34 = t23 ^ t33;
150
0
   const uint32_t t35 = t27 ^ t33;
151
0
   const uint32_t t36 = t24 & t35;
152
0
   const uint32_t t37 = t36 ^ t34;
153
0
   const uint32_t t38 = t27 ^ t36;
154
0
   const uint32_t t39 = t29 & t38;
155
0
   const uint32_t t40 = t25 ^ t39;
156
0
   const uint32_t t41 = t40 ^ t37;
157
0
   const uint32_t t42 = t29 ^ t33;
158
0
   const uint32_t t43 = t29 ^ t40;
159
0
   const uint32_t t44 = t33 ^ t37;
160
0
   const uint32_t t45 = t42 ^ t41;
161
0
   const uint32_t z0 = t44 & y15;
162
0
   const uint32_t z1 = t37 & y6;
163
0
   const uint32_t z2 = t33 & U7;
164
0
   const uint32_t z3 = t43 & y16;
165
0
   const uint32_t z4 = t40 & y1;
166
0
   const uint32_t z5 = t29 & y7;
167
0
   const uint32_t z6 = t42 & y11;
168
0
   const uint32_t z7 = t45 & y17;
169
0
   const uint32_t z8 = t41 & y10;
170
0
   const uint32_t z9 = t44 & y12;
171
0
   const uint32_t z10 = t37 & y3;
172
0
   const uint32_t z11 = t33 & y4;
173
0
   const uint32_t z12 = t43 & y13;
174
0
   const uint32_t z13 = t40 & y5;
175
0
   const uint32_t z14 = t29 & y2;
176
0
   const uint32_t z15 = t42 & y9;
177
0
   const uint32_t z16 = t45 & y14;
178
0
   const uint32_t z17 = t41 & y8;
179
0
   const uint32_t tc1 = z15 ^ z16;
180
0
   const uint32_t tc2 = z10 ^ tc1;
181
0
   const uint32_t tc3 = z9 ^ tc2;
182
0
   const uint32_t tc4 = z0 ^ z2;
183
0
   const uint32_t tc5 = z1 ^ z0;
184
0
   const uint32_t tc6 = z3 ^ z4;
185
0
   const uint32_t tc7 = z12 ^ tc4;
186
0
   const uint32_t tc8 = z7 ^ tc6;
187
0
   const uint32_t tc9 = z8 ^ tc7;
188
0
   const uint32_t tc10 = tc8 ^ tc9;
189
0
   const uint32_t tc11 = tc6 ^ tc5;
190
0
   const uint32_t tc12 = z3 ^ z5;
191
0
   const uint32_t tc13 = z13 ^ tc1;
192
0
   const uint32_t tc14 = tc4 ^ tc12;
193
0
   const uint32_t S3 = tc3 ^ tc11;
194
0
   const uint32_t tc16 = z6 ^ tc8;
195
0
   const uint32_t tc17 = z14 ^ tc10;
196
0
   const uint32_t tc18 = ~tc13 ^ tc14;
197
0
   const uint32_t S7 = z12 ^ tc18;
198
0
   const uint32_t tc20 = z15 ^ tc16;
199
0
   const uint32_t tc21 = tc2 ^ z11;
200
0
   const uint32_t S0 = tc3 ^ tc16;
201
0
   const uint32_t S6 = tc10 ^ tc18;
202
0
   const uint32_t S4 = tc14 ^ S3;
203
0
   const uint32_t S1 = ~(S3 ^ tc16);
204
0
   const uint32_t tc26 = tc17 ^ tc20;
205
0
   const uint32_t S2 = ~(tc26 ^ z17);
206
0
   const uint32_t S5 = tc21 ^ tc17;
207
208
0
   V[0] = S0;
209
0
   V[1] = S1;
210
0
   V[2] = S2;
211
0
   V[3] = S3;
212
0
   V[4] = S4;
213
0
   V[5] = S5;
214
0
   V[6] = S6;
215
0
   V[7] = S7;
216
0
   }
217
218
/*
219
A circuit for inverse AES Sbox of size 121 and depth 21 from
220
http://www.cs.yale.edu/homes/peralta/CircuitStuff/CMT.html
221
http://www.cs.yale.edu/homes/peralta/CircuitStuff/Sinv.txt
222
*/
223
void AES_INV_SBOX(uint32_t V[8])
224
0
   {
225
0
   const uint32_t U0 = V[0];
226
0
   const uint32_t U1 = V[1];
227
0
   const uint32_t U2 = V[2];
228
0
   const uint32_t U3 = V[3];
229
0
   const uint32_t U4 = V[4];
230
0
   const uint32_t U5 = V[5];
231
0
   const uint32_t U6 = V[6];
232
0
   const uint32_t U7 = V[7];
233
234
0
   const uint32_t Y0 = U0 ^ U3;
235
0
   const uint32_t Y2 = ~(U1 ^ U3);
236
0
   const uint32_t Y4 = U0 ^ Y2;
237
0
   const uint32_t RTL0 = U6 ^ U7;
238
0
   const uint32_t Y1 = Y2 ^ RTL0;
239
0
   const uint32_t Y7 = ~(U2 ^ Y1);
240
0
   const uint32_t RTL1 = U3 ^ U4;
241
0
   const uint32_t Y6 = ~(U7 ^ RTL1);
242
0
   const uint32_t Y3 = Y1 ^ RTL1;
243
0
   const uint32_t RTL2 = ~(U0 ^ U2);
244
0
   const uint32_t Y5 = U5 ^ RTL2;
245
0
   const uint32_t sa1 = Y0 ^ Y2;
246
0
   const uint32_t sa0 = Y1 ^ Y3;
247
0
   const uint32_t sb1 = Y4 ^ Y6;
248
0
   const uint32_t sb0 = Y5 ^ Y7;
249
0
   const uint32_t ah = Y0 ^ Y1;
250
0
   const uint32_t al = Y2 ^ Y3;
251
0
   const uint32_t aa = sa0 ^ sa1;
252
0
   const uint32_t bh = Y4 ^ Y5;
253
0
   const uint32_t bl = Y6 ^ Y7;
254
0
   const uint32_t bb = sb0 ^ sb1;
255
0
   const uint32_t ab20 = sa0 ^ sb0;
256
0
   const uint32_t ab22 = al ^ bl;
257
0
   const uint32_t ab23 = Y3 ^ Y7;
258
0
   const uint32_t ab21 = sa1 ^ sb1;
259
0
   const uint32_t abcd1 = ah & bh;
260
0
   const uint32_t rr1 = Y0 & Y4;
261
0
   const uint32_t ph11 = ab20 ^ abcd1;
262
0
   const uint32_t t01 = Y1 & Y5;
263
0
   const uint32_t ph01 = t01 ^ abcd1;
264
0
   const uint32_t abcd2 = al & bl;
265
0
   const uint32_t r1 = Y2 & Y6;
266
0
   const uint32_t pl11 = ab22 ^ abcd2;
267
0
   const uint32_t r2 = Y3 & Y7;
268
0
   const uint32_t pl01 = r2 ^ abcd2;
269
0
   const uint32_t r3 = sa0 & sb0;
270
0
   const uint32_t vr1 = aa & bb;
271
0
   const uint32_t pr1 = vr1 ^ r3;
272
0
   const uint32_t wr1 = sa1 & sb1;
273
0
   const uint32_t qr1 = wr1 ^ r3;
274
0
   const uint32_t ab0 = ph11 ^ rr1;
275
0
   const uint32_t ab1 = ph01 ^ ab21;
276
0
   const uint32_t ab2 = pl11 ^ r1;
277
0
   const uint32_t ab3 = pl01 ^ qr1;
278
0
   const uint32_t cp1 = ab0 ^ pr1;
279
0
   const uint32_t cp2 = ab1 ^ qr1;
280
0
   const uint32_t cp3 = ab2 ^ pr1;
281
0
   const uint32_t cp4 = ab3 ^ ab23;
282
0
   const uint32_t tinv1 = cp3 ^ cp4;
283
0
   const uint32_t tinv2 = cp3 & cp1;
284
0
   const uint32_t tinv3 = cp2 ^ tinv2;
285
0
   const uint32_t tinv4 = cp1 ^ cp2;
286
0
   const uint32_t tinv5 = cp4 ^ tinv2;
287
0
   const uint32_t tinv6 = tinv5 & tinv4;
288
0
   const uint32_t tinv7 = tinv3 & tinv1;
289
0
   const uint32_t d2 = cp4 ^ tinv7;
290
0
   const uint32_t d0 = cp2 ^ tinv6;
291
0
   const uint32_t tinv8 = cp1 & cp4;
292
0
   const uint32_t tinv9 = tinv4 & tinv8;
293
0
   const uint32_t tinv10 = tinv4 ^ tinv2;
294
0
   const uint32_t d1 = tinv9 ^ tinv10;
295
0
   const uint32_t tinv11 = cp2 & cp3;
296
0
   const uint32_t tinv12 = tinv1 & tinv11;
297
0
   const uint32_t tinv13 = tinv1 ^ tinv2;
298
0
   const uint32_t d3 = tinv12 ^ tinv13;
299
0
   const uint32_t sd1 = d1 ^ d3;
300
0
   const uint32_t sd0 = d0 ^ d2;
301
0
   const uint32_t dl = d0 ^ d1;
302
0
   const uint32_t dh = d2 ^ d3;
303
0
   const uint32_t dd = sd0 ^ sd1;
304
0
   const uint32_t abcd3 = dh & bh;
305
0
   const uint32_t rr2 = d3 & Y4;
306
0
   const uint32_t t02 = d2 & Y5;
307
0
   const uint32_t abcd4 = dl & bl;
308
0
   const uint32_t r4 = d1 & Y6;
309
0
   const uint32_t r5 = d0 & Y7;
310
0
   const uint32_t r6 = sd0 & sb0;
311
0
   const uint32_t vr2 = dd & bb;
312
0
   const uint32_t wr2 = sd1 & sb1;
313
0
   const uint32_t abcd5 = dh & ah;
314
0
   const uint32_t r7 = d3 & Y0;
315
0
   const uint32_t r8 = d2 & Y1;
316
0
   const uint32_t abcd6 = dl & al;
317
0
   const uint32_t r9 = d1 & Y2;
318
0
   const uint32_t r10 = d0 & Y3;
319
0
   const uint32_t r11 = sd0 & sa0;
320
0
   const uint32_t vr3 = dd & aa;
321
0
   const uint32_t wr3 = sd1 & sa1;
322
0
   const uint32_t ph12 = rr2 ^ abcd3;
323
0
   const uint32_t ph02 = t02 ^ abcd3;
324
0
   const uint32_t pl12 = r4 ^ abcd4;
325
0
   const uint32_t pl02 = r5 ^ abcd4;
326
0
   const uint32_t pr2 = vr2 ^ r6;
327
0
   const uint32_t qr2 = wr2 ^ r6;
328
0
   const uint32_t p0 = ph12 ^ pr2;
329
0
   const uint32_t p1 = ph02 ^ qr2;
330
0
   const uint32_t p2 = pl12 ^ pr2;
331
0
   const uint32_t p3 = pl02 ^ qr2;
332
0
   const uint32_t ph13 = r7 ^ abcd5;
333
0
   const uint32_t ph03 = r8 ^ abcd5;
334
0
   const uint32_t pl13 = r9 ^ abcd6;
335
0
   const uint32_t pl03 = r10 ^ abcd6;
336
0
   const uint32_t pr3 = vr3 ^ r11;
337
0
   const uint32_t qr3 = wr3 ^ r11;
338
0
   const uint32_t p4 = ph13 ^ pr3;
339
0
   const uint32_t S7 = ph03 ^ qr3;
340
0
   const uint32_t p6 = pl13 ^ pr3;
341
0
   const uint32_t p7 = pl03 ^ qr3;
342
0
   const uint32_t S3 = p1 ^ p6;
343
0
   const uint32_t S6 = p2 ^ p6;
344
0
   const uint32_t S0 = p3 ^ p6;
345
0
   const uint32_t X11 = p0 ^ p2;
346
0
   const uint32_t S5 = S0 ^ X11;
347
0
   const uint32_t X13 = p4 ^ p7;
348
0
   const uint32_t X14 = X11 ^ X13;
349
0
   const uint32_t S1 = S3 ^ X14;
350
0
   const uint32_t X16 = p1 ^ S7;
351
0
   const uint32_t S2 = X14 ^ X16;
352
0
   const uint32_t X18 = p0 ^ p4;
353
0
   const uint32_t X19 = S5 ^ X16;
354
0
   const uint32_t S4 = X18 ^ X19;
355
356
0
   V[0] = S0;
357
0
   V[1] = S1;
358
0
   V[2] = S2;
359
0
   V[3] = S3;
360
0
   V[4] = S4;
361
0
   V[5] = S5;
362
0
   V[6] = S6;
363
0
   V[7] = S7;
364
0
   }
365
366
inline void bit_transpose(uint32_t B[8])
367
0
   {
368
0
   swap_bits<uint32_t>(B[1], B[0], 0x55555555, 1);
369
0
   swap_bits<uint32_t>(B[3], B[2], 0x55555555, 1);
370
0
   swap_bits<uint32_t>(B[5], B[4], 0x55555555, 1);
371
0
   swap_bits<uint32_t>(B[7], B[6], 0x55555555, 1);
372
373
0
   swap_bits<uint32_t>(B[2], B[0], 0x33333333, 2);
374
0
   swap_bits<uint32_t>(B[3], B[1], 0x33333333, 2);
375
0
   swap_bits<uint32_t>(B[6], B[4], 0x33333333, 2);
376
0
   swap_bits<uint32_t>(B[7], B[5], 0x33333333, 2);
377
378
0
   swap_bits<uint32_t>(B[4], B[0], 0x0F0F0F0F, 4);
379
0
   swap_bits<uint32_t>(B[5], B[1], 0x0F0F0F0F, 4);
380
0
   swap_bits<uint32_t>(B[6], B[2], 0x0F0F0F0F, 4);
381
0
   swap_bits<uint32_t>(B[7], B[3], 0x0F0F0F0F, 4);
382
0
   }
383
384
inline void ks_expand(uint32_t B[8], const uint32_t K[], size_t r)
385
0
   {
386
   /*
387
   This is bit_transpose of K[r..r+4] || K[r..r+4], we can save some computation
388
   due to knowing the first and second halves are the same data.
389
   */
390
0
   for(size_t i = 0; i != 4; ++i)
391
0
      B[i] = K[r + i];
392
393
0
   swap_bits<uint32_t>(B[1], B[0], 0x55555555, 1);
394
0
   swap_bits<uint32_t>(B[3], B[2], 0x55555555, 1);
395
396
0
   swap_bits<uint32_t>(B[2], B[0], 0x33333333, 2);
397
0
   swap_bits<uint32_t>(B[3], B[1], 0x33333333, 2);
398
399
0
   B[4] = B[0];
400
0
   B[5] = B[1];
401
0
   B[6] = B[2];
402
0
   B[7] = B[3];
403
404
0
   swap_bits<uint32_t>(B[4], B[0], 0x0F0F0F0F, 4);
405
0
   swap_bits<uint32_t>(B[5], B[1], 0x0F0F0F0F, 4);
406
0
   swap_bits<uint32_t>(B[6], B[2], 0x0F0F0F0F, 4);
407
0
   swap_bits<uint32_t>(B[7], B[3], 0x0F0F0F0F, 4);
408
0
   }
409
410
inline void shift_rows(uint32_t B[8])
411
0
   {
412
   // 3 0 1 2 7 4 5 6 10 11 8 9 14 15 12 13 17 18 19 16 21 22 23 20 24 25 26 27 28 29 30 31
413
0
#if defined(BOTAN_TARGET_CPU_HAS_NATIVE_64BIT)
414
0
   for(size_t i = 0; i != 8; i += 2)
415
0
      {
416
0
      uint64_t x = (static_cast<uint64_t>(B[i]) << 32) | B[i+1];
417
0
      x = bit_permute_step<uint64_t>(x, 0x0022331100223311, 2);
418
0
      x = bit_permute_step<uint64_t>(x, 0x0055005500550055, 1);
419
0
      B[i] = static_cast<uint32_t>(x >> 32);
420
0
      B[i+1] = static_cast<uint32_t>(x);
421
0
      }
422
#else
423
   for(size_t i = 0; i != 8; ++i)
424
      {
425
      uint32_t x = B[i];
426
      x = bit_permute_step<uint32_t>(x, 0x00223311, 2);
427
      x = bit_permute_step<uint32_t>(x, 0x00550055, 1);
428
      B[i] = x;
429
      }
430
#endif
431
0
   }
432
433
inline void inv_shift_rows(uint32_t B[8])
434
0
   {
435
   // Inverse of shift_rows, just inverting the steps
436
437
0
#if defined(BOTAN_TARGET_CPU_HAS_NATIVE_64BIT)
438
0
   for(size_t i = 0; i != 8; i += 2)
439
0
      {
440
0
      uint64_t x = (static_cast<uint64_t>(B[i]) << 32) | B[i+1];
441
0
      x = bit_permute_step<uint64_t>(x, 0x0055005500550055, 1);
442
0
      x = bit_permute_step<uint64_t>(x, 0x0022331100223311, 2);
443
0
      B[i] = static_cast<uint32_t>(x >> 32);
444
0
      B[i+1] = static_cast<uint32_t>(x);
445
0
      }
446
#else
447
   for(size_t i = 0; i != 8; ++i)
448
      {
449
      uint32_t x = B[i];
450
      x = bit_permute_step<uint32_t>(x, 0x00550055, 1);
451
      x = bit_permute_step<uint32_t>(x, 0x00223311, 2);
452
      B[i] = x;
453
      }
454
#endif
455
0
   }
456
457
inline void mix_columns(uint32_t B[8])
458
0
   {
459
   // carry high bits in B[0] to positions in 0x1b == 0b11011
460
0
   const uint32_t X2[8] = {
461
0
      B[1],
462
0
      B[2],
463
0
      B[3],
464
0
      B[4] ^ B[0],
465
0
      B[5] ^ B[0],
466
0
      B[6],
467
0
      B[7] ^ B[0],
468
0
      B[0],
469
0
   };
470
471
0
   for(size_t i = 0; i != 8; i++)
472
0
      {
473
0
      const uint32_t X3 = B[i] ^ X2[i];
474
0
      B[i] = X2[i] ^ rotr<8>(B[i]) ^ rotr<16>(B[i]) ^ rotr<24>(X3);
475
0
      }
476
0
   }
477
478
void inv_mix_columns(uint32_t B[8])
479
0
   {
480
   /*
481
   OpenSSL's bsaes implementation credits Jussi Kivilinna with the lovely
482
   matrix decomposition
483
484
   | 0e 0b 0d 09 |   | 02 03 01 01 |   | 05 00 04 00 |
485
   | 09 0e 0b 0d | = | 01 02 03 01 | x | 00 05 00 04 |
486
   | 0d 09 0e 0b |   | 01 01 02 03 |   | 04 00 05 00 |
487
   | 0b 0d 09 0e |   | 03 01 01 02 |   | 00 04 00 05 |
488
489
   Notice the first component is simply the MixColumns matrix. So we can
490
   multiply first by (05,00,04,00) then perform MixColumns to get the equivalent
491
   of InvMixColumn.
492
   */
493
0
   const uint32_t X4[8] = {
494
0
      B[2],
495
0
      B[3],
496
0
      B[4] ^ B[0],
497
0
      B[5] ^ B[0] ^ B[1],
498
0
      B[6] ^ B[1],
499
0
      B[7] ^ B[0],
500
0
      B[0] ^ B[1],
501
0
      B[1],
502
0
   };
503
504
0
   for(size_t i = 0; i != 8; i++)
505
0
      {
506
0
      const uint32_t X5 = X4[i] ^ B[i];
507
0
      B[i] = X5 ^ rotr<16>(X4[i]);
508
0
      }
509
510
0
   mix_columns(B);
511
0
   }
512
513
/*
514
* AES Encryption
515
*/
516
void aes_encrypt_n(const uint8_t in[], uint8_t out[],
517
                   size_t blocks,
518
                   const secure_vector<uint32_t>& EK)
519
0
   {
520
0
   BOTAN_ASSERT(EK.size() == 44 || EK.size() == 52 || EK.size() == 60, "Key was set");
521
522
0
   const size_t rounds = (EK.size() - 4) / 4;
523
524
0
   uint32_t KS[13*8] = { 0 }; // actual maximum is (rounds - 1) * 8
525
0
   for(size_t i = 0; i < rounds - 1; i += 1)
526
0
      {
527
0
      ks_expand(&KS[8*i], EK.data(), 4*i + 4);
528
0
      }
529
530
0
   const size_t BLOCK_SIZE = 16;
531
0
   const size_t BITSLICED_BLOCKS = 8*sizeof(uint32_t) / BLOCK_SIZE;
532
533
0
   while(blocks > 0)
534
0
      {
535
0
      const size_t this_loop = std::min(blocks, BITSLICED_BLOCKS);
536
537
0
      uint32_t B[8] = { 0 };
538
539
0
      load_be(B, in, this_loop*4);
540
541
0
      for(size_t i = 0; i != 8; ++i)
542
0
         B[i] ^= EK[i % 4];
543
544
0
      bit_transpose(B);
545
546
0
      for(size_t r = 0; r != rounds - 1; ++r)
547
0
         {
548
0
         AES_SBOX(B);
549
0
         shift_rows(B);
550
0
         mix_columns(B);
551
552
0
         for(size_t i = 0; i != 8; ++i)
553
0
            B[i] ^= KS[8*r + i];
554
0
         }
555
556
      // Final round:
557
0
      AES_SBOX(B);
558
0
      shift_rows(B);
559
0
      bit_transpose(B);
560
561
0
      for(size_t i = 0; i != 8; ++i)
562
0
         B[i] ^= EK[4*rounds + i % 4];
563
564
0
      copy_out_be(out, this_loop*4*sizeof(uint32_t), B);
565
566
0
      in += this_loop * BLOCK_SIZE;
567
0
      out += this_loop * BLOCK_SIZE;
568
0
      blocks -= this_loop;
569
0
      }
570
0
   }
571
572
/*
573
* AES Decryption
574
*/
575
void aes_decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks,
576
                   const secure_vector<uint32_t>& DK)
577
0
   {
578
0
   BOTAN_ASSERT(DK.size() == 44 || DK.size() == 52 || DK.size() == 60, "Key was set");
579
580
0
   const size_t rounds = (DK.size() - 4) / 4;
581
582
0
   uint32_t KS[13*8] = { 0 }; // actual maximum is (rounds - 1) * 8
583
0
   for(size_t i = 0; i < rounds - 1; i += 1)
584
0
      {
585
0
      ks_expand(&KS[8*i], DK.data(), 4*i + 4);
586
0
      }
587
588
0
   const size_t BLOCK_SIZE = 16;
589
0
   const size_t BITSLICED_BLOCKS = 8*sizeof(uint32_t) / BLOCK_SIZE;
590
591
0
   while(blocks > 0)
592
0
      {
593
0
      const size_t this_loop = std::min(blocks, BITSLICED_BLOCKS);
594
595
0
      uint32_t B[8] = { 0 };
596
597
0
      load_be(B, in, this_loop*4);
598
599
0
      for(size_t i = 0; i != 8; ++i)
600
0
         B[i] ^= DK[i % 4];
601
602
0
      bit_transpose(B);
603
604
0
      for(size_t r = 0; r != rounds - 1; ++r)
605
0
         {
606
0
         AES_INV_SBOX(B);
607
0
         inv_shift_rows(B);
608
0
         inv_mix_columns(B);
609
610
0
         for(size_t i = 0; i != 8; ++i)
611
0
            B[i] ^= KS[8*r + i];
612
0
         }
613
614
      // Final round:
615
0
      AES_INV_SBOX(B);
616
0
      inv_shift_rows(B);
617
0
      bit_transpose(B);
618
619
0
      for(size_t i = 0; i != 8; ++i)
620
0
         B[i] ^= DK[4*rounds + i % 4];
621
622
0
      copy_out_be(out, this_loop*4*sizeof(uint32_t), B);
623
624
0
      in += this_loop * BLOCK_SIZE;
625
0
      out += this_loop * BLOCK_SIZE;
626
0
      blocks -= this_loop;
627
0
      }
628
0
   }
629
630
inline uint32_t xtime32(uint32_t s)
631
0
   {
632
0
   const uint32_t lo_bit = 0x01010101;
633
0
   const uint32_t mask = 0x7F7F7F7F;
634
0
   const uint32_t poly = 0x1B;
635
636
0
   return ((s & mask) << 1) ^ (((s >> 7) & lo_bit) * poly);
637
0
   }
638
639
inline uint32_t InvMixColumn(uint32_t s1)
640
0
   {
641
0
   const uint32_t s2 = xtime32(s1);
642
0
   const uint32_t s4 = xtime32(s2);
643
0
   const uint32_t s8 = xtime32(s4);
644
0
   const uint32_t s9 = s8 ^ s1;
645
0
   const uint32_t s11 = s9 ^ s2;
646
0
   const uint32_t s13 = s9 ^ s4;
647
0
   const uint32_t s14 = s8 ^ s4 ^ s2;
648
649
0
   return s14 ^ rotr<8>(s9) ^ rotr<16>(s13) ^ rotr<24>(s11);
650
0
   }
651
652
void InvMixColumn_x4(uint32_t x[4])
653
0
   {
654
0
   x[0] = InvMixColumn(x[0]);
655
0
   x[1] = InvMixColumn(x[1]);
656
0
   x[2] = InvMixColumn(x[2]);
657
0
   x[3] = InvMixColumn(x[3]);
658
0
   }
659
660
uint32_t SE_word(uint32_t x)
661
0
   {
662
0
   uint32_t I[8] = { 0 };
663
664
0
   for(size_t i = 0; i != 8; ++i)
665
0
      I[i] = (x >> (7-i)) & 0x01010101;
666
667
0
   AES_SBOX(I);
668
669
0
   x = 0;
670
671
0
   for(size_t i = 0; i != 8; ++i)
672
0
      x |= ((I[i] & 0x01010101) << (7-i));
673
674
0
   return x;
675
0
   }
676
677
void aes_key_schedule(const uint8_t key[], size_t length,
678
                      secure_vector<uint32_t>& EK,
679
                      secure_vector<uint32_t>& DK,
680
                      bool bswap_keys = false)
681
0
   {
682
0
   static const uint32_t RC[10] = {
683
0
      0x01000000, 0x02000000, 0x04000000, 0x08000000, 0x10000000,
684
0
      0x20000000, 0x40000000, 0x80000000, 0x1B000000, 0x36000000 };
685
686
0
   const size_t X = length / 4;
687
688
   // Can't happen, but make static analyzers happy
689
0
   BOTAN_ASSERT_NOMSG(X == 4 || X == 6 || X == 8);
690
691
0
   const size_t rounds = (length / 4) + 6;
692
693
   // Help the optimizer
694
0
   BOTAN_ASSERT_NOMSG(rounds == 10 || rounds == 12 || rounds == 14);
695
696
0
   CT::poison(key, length);
697
698
0
   EK.resize(length + 28);
699
0
   DK.resize(length + 28);
700
701
0
   for(size_t i = 0; i != X; ++i)
702
0
      EK[i] = load_be<uint32_t>(key, i);
703
704
0
   for(size_t i = X; i < 4*(rounds+1); i += X)
705
0
      {
706
0
      EK[i] = EK[i-X] ^ RC[(i-X)/X] ^ rotl<8>(SE_word(EK[i-1]));
707
708
0
      for(size_t j = 1; j != X && (i+j) < EK.size(); ++j)
709
0
         {
710
0
         EK[i+j] = EK[i+j-X];
711
712
0
         if(X == 8 && j == 4)
713
0
            EK[i+j] ^= SE_word(EK[i+j-1]);
714
0
         else
715
0
            EK[i+j] ^= EK[i+j-1];
716
0
         }
717
0
      }
718
719
0
   for(size_t i = 0; i != 4*(rounds+1); i += 4)
720
0
      {
721
0
      DK[i  ] = EK[4*rounds - i  ];
722
0
      DK[i+1] = EK[4*rounds - i+1];
723
0
      DK[i+2] = EK[4*rounds - i+2];
724
0
      DK[i+3] = EK[4*rounds - i+3];
725
0
      }
726
727
0
   for(size_t i = 4; i != 4*rounds; i += 4)
728
0
      {
729
0
      InvMixColumn_x4(&DK[i]);
730
0
      }
731
732
0
   if(bswap_keys)
733
0
      {
734
      // HW AES on little endian needs the subkeys to be byte reversed
735
0
      for(size_t i = 0; i != EK.size(); ++i)
736
0
         EK[i] = reverse_bytes(EK[i]);
737
0
      for(size_t i = 0; i != DK.size(); ++i)
738
0
         DK[i] = reverse_bytes(DK[i]);
739
0
      }
740
741
0
   CT::unpoison(EK.data(), EK.size());
742
0
   CT::unpoison(DK.data(), DK.size());
743
0
   CT::unpoison(key, length);
744
0
   }
745
746
size_t aes_parallelism()
747
2.92k
   {
748
2.92k
#if defined(BOTAN_HAS_HW_AES_SUPPORT)
749
2.92k
   if(CPUID::has_hw_aes())
750
2.92k
      {
751
2.92k
      return 4; // pipelined
752
2.92k
      }
753
0
#endif
754
755
0
#if defined(BOTAN_HAS_AES_VPERM)
756
0
   if(CPUID::has_vperm())
757
0
      {
758
0
      return 2; // pipelined
759
0
      }
760
0
#endif
761
762
   // bitsliced:
763
0
   return 2;
764
0
   }
765
766
const char* aes_provider()
767
0
   {
768
0
#if defined(BOTAN_HAS_HW_AES_SUPPORT)
769
0
   if(CPUID::has_hw_aes())
770
0
      {
771
0
      return "cpu";
772
0
      }
773
0
#endif
774
775
0
#if defined(BOTAN_HAS_AES_VPERM)
776
0
   if(CPUID::has_vperm())
777
0
      {
778
0
      return "vperm";
779
0
      }
780
0
#endif
781
782
0
   return "base";
783
0
   }
784
785
}
786
787
0
std::string AES_128::provider() const { return aes_provider(); }
788
0
std::string AES_192::provider() const { return aes_provider(); }
789
0
std::string AES_256::provider() const { return aes_provider(); }
790
791
753
size_t AES_128::parallelism() const { return aes_parallelism(); }
792
0
size_t AES_192::parallelism() const { return aes_parallelism(); }
793
2.17k
size_t AES_256::parallelism() const { return aes_parallelism(); }
794
795
void AES_128::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
796
8.64k
   {
797
8.64k
   verify_key_set(m_EK.empty() == false);
798
799
8.64k
#if defined(BOTAN_HAS_HW_AES_SUPPORT)
800
8.64k
   if(CPUID::has_hw_aes())
801
8.64k
      {
802
8.64k
      return hw_aes_encrypt_n(in, out, blocks);
803
8.64k
      }
804
0
#endif
805
806
0
#if defined(BOTAN_HAS_AES_VPERM)
807
0
   if(CPUID::has_vperm())
808
0
      {
809
0
      return vperm_encrypt_n(in, out, blocks);
810
0
      }
811
0
#endif
812
813
0
   aes_encrypt_n(in, out, blocks, m_EK);
814
0
   }
815
816
void AES_128::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
817
789
   {
818
789
   verify_key_set(m_DK.empty() == false);
819
820
789
#if defined(BOTAN_HAS_HW_AES_SUPPORT)
821
789
   if(CPUID::has_hw_aes())
822
789
      {
823
789
      return hw_aes_decrypt_n(in, out, blocks);
824
789
      }
825
0
#endif
826
827
0
#if defined(BOTAN_HAS_AES_VPERM)
828
0
   if(CPUID::has_vperm())
829
0
      {
830
0
      return vperm_decrypt_n(in, out, blocks);
831
0
      }
832
0
#endif
833
834
0
   aes_decrypt_n(in, out, blocks, m_DK);
835
0
   }
836
837
void AES_128::key_schedule(const uint8_t key[], size_t length)
838
656
   {
839
656
#if defined(BOTAN_HAS_AES_NI)
840
656
   if(CPUID::has_aes_ni())
841
656
      {
842
656
      return aesni_key_schedule(key, length);
843
656
      }
844
0
#endif
845
846
0
#if defined(BOTAN_HAS_HW_AES_SUPPORT)
847
0
   if(CPUID::has_hw_aes())
848
0
      {
849
0
      return aes_key_schedule(key, length, m_EK, m_DK, CPUID::is_little_endian());
850
0
      }
851
0
#endif
852
853
0
#if defined(BOTAN_HAS_AES_VPERM)
854
0
   if(CPUID::has_vperm())
855
0
      {
856
0
      return vperm_key_schedule(key, length);
857
0
      }
858
0
#endif
859
860
0
   aes_key_schedule(key, length, m_EK, m_DK);
861
0
   }
862
863
void AES_128::clear()
864
0
   {
865
0
   zap(m_EK);
866
0
   zap(m_DK);
867
0
   }
868
869
void AES_192::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
870
0
   {
871
0
   verify_key_set(m_EK.empty() == false);
872
873
0
#if defined(BOTAN_HAS_HW_AES_SUPPORT)
874
0
   if(CPUID::has_hw_aes())
875
0
      {
876
0
      return hw_aes_encrypt_n(in, out, blocks);
877
0
      }
878
0
#endif
879
880
0
#if defined(BOTAN_HAS_AES_VPERM)
881
0
   if(CPUID::has_vperm())
882
0
      {
883
0
      return vperm_encrypt_n(in, out, blocks);
884
0
      }
885
0
#endif
886
887
0
   aes_encrypt_n(in, out, blocks, m_EK);
888
0
   }
889
890
void AES_192::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
891
0
   {
892
0
   verify_key_set(m_DK.empty() == false);
893
894
0
#if defined(BOTAN_HAS_HW_AES_SUPPORT)
895
0
   if(CPUID::has_hw_aes())
896
0
      {
897
0
      return hw_aes_decrypt_n(in, out, blocks);
898
0
      }
899
0
#endif
900
901
0
#if defined(BOTAN_HAS_AES_VPERM)
902
0
   if(CPUID::has_vperm())
903
0
      {
904
0
      return vperm_decrypt_n(in, out, blocks);
905
0
      }
906
0
#endif
907
908
0
   aes_decrypt_n(in, out, blocks, m_DK);
909
0
   }
910
911
void AES_192::key_schedule(const uint8_t key[], size_t length)
912
0
   {
913
0
#if defined(BOTAN_HAS_AES_NI)
914
0
   if(CPUID::has_aes_ni())
915
0
      {
916
0
      return aesni_key_schedule(key, length);
917
0
      }
918
0
#endif
919
920
0
#if defined(BOTAN_HAS_HW_AES_SUPPORT)
921
0
   if(CPUID::has_hw_aes())
922
0
      {
923
0
      return aes_key_schedule(key, length, m_EK, m_DK, CPUID::is_little_endian());
924
0
      }
925
0
#endif
926
927
0
#if defined(BOTAN_HAS_AES_VPERM)
928
0
   if(CPUID::has_vperm())
929
0
      {
930
0
      return vperm_key_schedule(key, length);
931
0
      }
932
0
#endif
933
934
0
   aes_key_schedule(key, length, m_EK, m_DK);
935
0
   }
936
937
void AES_192::clear()
938
0
   {
939
0
   zap(m_EK);
940
0
   zap(m_DK);
941
0
   }
942
943
void AES_256::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
944
9.39k
   {
945
9.39k
   verify_key_set(m_EK.empty() == false);
946
947
9.39k
#if defined(BOTAN_HAS_HW_AES_SUPPORT)
948
9.39k
   if(CPUID::has_hw_aes())
949
9.39k
      {
950
9.39k
      return hw_aes_encrypt_n(in, out, blocks);
951
9.39k
      }
952
0
#endif
953
954
0
#if defined(BOTAN_HAS_AES_VPERM)
955
0
   if(CPUID::has_vperm())
956
0
      {
957
0
      return vperm_encrypt_n(in, out, blocks);
958
0
      }
959
0
#endif
960
961
0
   aes_encrypt_n(in, out, blocks, m_EK);
962
0
   }
963
964
void AES_256::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
965
573
   {
966
573
   verify_key_set(m_DK.empty() == false);
967
968
573
#if defined(BOTAN_HAS_HW_AES_SUPPORT)
969
573
   if(CPUID::has_hw_aes())
970
573
      {
971
573
      return hw_aes_decrypt_n(in, out, blocks);
972
573
      }
973
0
#endif
974
975
0
#if defined(BOTAN_HAS_AES_VPERM)
976
0
   if(CPUID::has_vperm())
977
0
      {
978
0
      return vperm_decrypt_n(in, out, blocks);
979
0
      }
980
0
#endif
981
982
0
   aes_decrypt_n(in, out, blocks, m_DK);
983
0
   }
984
985
void AES_256::key_schedule(const uint8_t key[], size_t length)
986
1.18k
   {
987
1.18k
#if defined(BOTAN_HAS_AES_NI)
988
1.18k
   if(CPUID::has_aes_ni())
989
1.18k
      {
990
1.18k
      return aesni_key_schedule(key, length);
991
1.18k
      }
992
0
#endif
993
994
0
#if defined(BOTAN_HAS_HW_AES_SUPPORT)
995
0
   if(CPUID::has_hw_aes())
996
0
      {
997
0
      return aes_key_schedule(key, length, m_EK, m_DK, CPUID::is_little_endian());
998
0
      }
999
0
#endif
1000
1001
0
#if defined(BOTAN_HAS_AES_VPERM)
1002
0
   if(CPUID::has_vperm())
1003
0
      {
1004
0
      return vperm_key_schedule(key, length);
1005
0
      }
1006
0
#endif
1007
1008
0
   aes_key_schedule(key, length, m_EK, m_DK);
1009
0
   }
1010
1011
void AES_256::clear()
1012
0
   {
1013
0
   zap(m_EK);
1014
0
   zap(m_DK);
1015
0
   }
1016
1017
}