Subversion Repositories Kolibri OS

/*

 *	FIPS-197 compliant AES implementation

 *

 *	Copyright (C) 2006-2007 Christophe Devine

 *

 *	Redistribution and use in source and binary forms, with or without

 *	modification, are permitted provided that the following conditions

 *	are met:

 *

 *	* Redistributions of source code _must_ retain the above copyright

 *		notice, this list of conditions and the following disclaimer.

 *	* Redistributions in binary form may or may not reproduce the above

 *		copyright notice, this list of conditions and the following

 *		disclaimer in the documentation and/or other materials provided

 *		with the distribution.

 *	* Neither the name of XySSL nor the names of its contributors may be

 *		used to endorse or promote products derived from this software

 *		without specific prior written permission.

 *

 *	THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS

 *	"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT

 *	LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS

 *	FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT

 *	OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

 *	SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED

 *	TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

 *	PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF

 *	LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING

 *	NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS

 *	SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 */

/*

 *	The AES block cipher was designed by Vincent Rijmen and Joan Daemen.

 *

 *	http://csrc.nist.gov/encryption/aes/rijndael/Rijndael.pdf

 *	http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf

 */

#include "fitz.h"

#define aes_context fz_aes

/* AES block cipher implementation from XYSSL */

/*

 * 32-bit integer manipulation macros (little endian)

 */

#ifndef GET_ULONG_LE

#define GET_ULONG_LE(n,b,i)					\

{								\

	(n) = ( (unsigned long) (b)[(i)] )			\

		| ( (unsigned long) (b)[(i) + 1] << 8 )		\

		| ( (unsigned long) (b)[(i) + 2] << 16 )	\

		| ( (unsigned long) (b)[(i) + 3] << 24 );	\

}

#endif

#ifndef PUT_ULONG_LE

#define PUT_ULONG_LE(n,b,i)				\

{							\

	(b)[(i) ] = (unsigned char) ( (n) );		\

	(b)[(i) + 1] = (unsigned char) ( (n) >> 8 );	\

	(b)[(i) + 2] = (unsigned char) ( (n) >> 16 );	\

	(b)[(i) + 3] = (unsigned char) ( (n) >> 24 );	\

}

#endif

/*

 * Forward S-box & tables

 */

static unsigned char FSb[256];

static unsigned long FT0[256];

static unsigned long FT1[256];

static unsigned long FT2[256];

static unsigned long FT3[256];

/*

 * Reverse S-box & tables

 */

static unsigned char RSb[256];

static unsigned long RT0[256];

static unsigned long RT1[256];

static unsigned long RT2[256];

static unsigned long RT3[256];

/*

 * Round constants

 */

static unsigned long RCON[10];

/*

 * Tables generation code

 */

#define ROTL8(x) ( ( x << 8 ) & 0xFFFFFFFF ) | ( x >> 24 )

#define XTIME(x) ( ( x << 1 ) ^ ( ( x & 0x80 ) ? 0x1B : 0x00 ) )

#define MUL(x,y) ( ( x && y ) ? pow[(log[x]+log[y]) % 255] : 0 )

static int aes_init_done = 0;

static void aes_gen_tables( void )

{

	int i, x, y, z;

	int pow[256];

	int log[256];

	/*

	 * compute pow and log tables over GF(2^8)

	 */

	for( i = 0, x = 1; i < 256; i++ )

	{

		pow[i] = x;

		log[x] = i;

		x = ( x ^ XTIME( x ) ) & 0xFF;

	}

	/*

	 * calculate the round constants

	 */

	for( i = 0, x = 1; i < 10; i++ )

	{

		RCON[i] = (unsigned long) x;

		x = XTIME( x ) & 0xFF;

	}

	/*

	 * generate the forward and reverse S-boxes

	 */

	FSb[0x00] = 0x63;

	RSb[0x63] = 0x00;

	for( i = 1; i < 256; i++ )

	{

		x = pow[255 - log[i]];

		y = x; y = ( (y << 1) | (y >> 7) ) & 0xFF;

		x ^= y; y = ( (y << 1) | (y >> 7) ) & 0xFF;

		x ^= y; y = ( (y << 1) | (y >> 7) ) & 0xFF;

		x ^= y; y = ( (y << 1) | (y >> 7) ) & 0xFF;

		x ^= y ^ 0x63;

		FSb[i] = (unsigned char) x;

		RSb[x] = (unsigned char) i;

	}

	/*

	 * generate the forward and reverse tables

	 */

	for( i = 0; i < 256; i++ )

	{

		x = FSb[i];

		y = XTIME( x ) & 0xFF;

		z = ( y ^ x ) & 0xFF;

		FT0[i] = ( (unsigned long) y ) ^

		( (unsigned long) x <<	8 ) ^

		( (unsigned long) x << 16 ) ^

		( (unsigned long) z << 24 );

		FT1[i] = ROTL8( FT0[i] );

		FT2[i] = ROTL8( FT1[i] );

		FT3[i] = ROTL8( FT2[i] );

		x = RSb[i];

		RT0[i] = ( (unsigned long) MUL( 0x0E, x ) ) ^

		( (unsigned long) MUL( 0x09, x ) << 8 ) ^

		( (unsigned long) MUL( 0x0D, x ) << 16 ) ^

		( (unsigned long) MUL( 0x0B, x ) << 24 );

		RT1[i] = ROTL8( RT0[i] );

		RT2[i] = ROTL8( RT1[i] );

		RT3[i] = ROTL8( RT2[i] );

	}

}

/*

 * AES key schedule (encryption)

 */

void aes_setkey_enc( aes_context *ctx, const unsigned char *key, int keysize )

{

	int i;

	unsigned long *RK;

#if !defined(XYSSL_AES_ROM_TABLES)

	if( aes_init_done == 0 )

	{

		aes_gen_tables();

		aes_init_done = 1;

	}

#endif

	switch( keysize )

	{

	case 128: ctx->nr = 10; break;

	case 192: ctx->nr = 12; break;

	case 256: ctx->nr = 14; break;

	default : return;

	}

#if defined(PADLOCK_ALIGN16)

	ctx->rk = RK = PADLOCK_ALIGN16( ctx->buf );

#else

	ctx->rk = RK = ctx->buf;

#endif

	for( i = 0; i < (keysize >> 5); i++ )

	{

		GET_ULONG_LE( RK[i], key, i << 2 );

	}

	switch( ctx->nr )

	{

	case 10:

		for( i = 0; i < 10; i++, RK += 4 )

		{

			RK[4] = RK[0] ^ RCON[i] ^

				( FSb[ ( RK[3] >> 8 ) & 0xFF ] ) ^

				( FSb[ ( RK[3] >> 16 ) & 0xFF ] << 8 ) ^

				( FSb[ ( RK[3] >> 24 ) & 0xFF ] << 16 ) ^

				( FSb[ ( RK[3] ) & 0xFF ] << 24 );

			RK[5] = RK[1] ^ RK[4];

			RK[6] = RK[2] ^ RK[5];

			RK[7] = RK[3] ^ RK[6];

		}

		break;

	case 12:

		for( i = 0; i < 8; i++, RK += 6 )

		{

			RK[6] = RK[0] ^ RCON[i] ^

				( FSb[ ( RK[5] >> 8 ) & 0xFF ] ) ^

				( FSb[ ( RK[5] >> 16 ) & 0xFF ] << 8 ) ^

				( FSb[ ( RK[5] >> 24 ) & 0xFF ] << 16 ) ^

				( FSb[ ( RK[5] ) & 0xFF ] << 24 );

			RK[7] = RK[1] ^ RK[6];

			RK[8] = RK[2] ^ RK[7];

			RK[9] = RK[3] ^ RK[8];

			RK[10] = RK[4] ^ RK[9];

			RK[11] = RK[5] ^ RK[10];

		}

		break;

	case 14:

		for( i = 0; i < 7; i++, RK += 8 )

		{

			RK[8] = RK[0] ^ RCON[i] ^

				( FSb[ ( RK[7] >> 8 ) & 0xFF ] ) ^

				( FSb[ ( RK[7] >> 16 ) & 0xFF ] << 8 ) ^

				( FSb[ ( RK[7] >> 24 ) & 0xFF ] << 16 ) ^

				( FSb[ ( RK[7] ) & 0xFF ] << 24 );

			RK[9] = RK[1] ^ RK[8];

			RK[10] = RK[2] ^ RK[9];

			RK[11] = RK[3] ^ RK[10];

			RK[12] = RK[4] ^

				( FSb[ ( RK[11] ) & 0xFF ] ) ^

				( FSb[ ( RK[11] >> 8 ) & 0xFF ] << 8 ) ^

				( FSb[ ( RK[11] >> 16 ) & 0xFF ] << 16 ) ^

				( FSb[ ( RK[11] >> 24 ) & 0xFF ] << 24 );

			RK[13] = RK[5] ^ RK[12];

			RK[14] = RK[6] ^ RK[13];

			RK[15] = RK[7] ^ RK[14];

		}

		break;

	default:

		break;

	}

}

/*

 * AES key schedule (decryption)

 */

void aes_setkey_dec( aes_context *ctx, const unsigned char *key, int keysize )

{

	int i, j;

	aes_context cty;

	unsigned long *RK;

	unsigned long *SK;

	switch( keysize )

	{

	case 128: ctx->nr = 10; break;

	case 192: ctx->nr = 12; break;

	case 256: ctx->nr = 14; break;

	default : return;

	}

#if defined(PADLOCK_ALIGN16)

	ctx->rk = RK = PADLOCK_ALIGN16( ctx->buf );

#else

	ctx->rk = RK = ctx->buf;

#endif

	aes_setkey_enc( &cty, key, keysize );

	SK = cty.rk + cty.nr * 4;

	*RK++ = *SK++;

	*RK++ = *SK++;

	*RK++ = *SK++;

	*RK++ = *SK++;

	for( i = ctx->nr - 1, SK -= 8; i > 0; i--, SK -= 8 )

	{

		for( j = 0; j < 4; j++, SK++ )

		{

			*RK++ = RT0[ FSb[ ( *SK ) & 0xFF ] ] ^

				RT1[ FSb[ ( *SK >> 8 ) & 0xFF ] ] ^

				RT2[ FSb[ ( *SK >> 16 ) & 0xFF ] ] ^

				RT3[ FSb[ ( *SK >> 24 ) & 0xFF ] ];

		}

	}

	*RK++ = *SK++;

	*RK++ = *SK++;

	*RK++ = *SK++;

	*RK++ = *SK++;

	memset( &cty, 0, sizeof( aes_context ) );

}

#define AES_FROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3)	\

{						\

	X0 = *RK++ ^ FT0[ ( Y0 ) & 0xFF ] ^	\

		FT1[ ( Y1 >> 8 ) & 0xFF ] ^	\

		FT2[ ( Y2 >> 16 ) & 0xFF ] ^	\

		FT3[ ( Y3 >> 24 ) & 0xFF ];	\

						\

	X1 = *RK++ ^ FT0[ ( Y1 ) & 0xFF ] ^	\

		FT1[ ( Y2 >> 8 ) & 0xFF ] ^	\

		FT2[ ( Y3 >> 16 ) & 0xFF ] ^	\

		FT3[ ( Y0 >> 24 ) & 0xFF ];	\

						\

	X2 = *RK++ ^ FT0[ ( Y2 ) & 0xFF ] ^	\

		FT1[ ( Y3 >> 8 ) & 0xFF ] ^	\

		FT2[ ( Y0 >> 16 ) & 0xFF ] ^	\

		FT3[ ( Y1 >> 24 ) & 0xFF ];	\

						\

	X3 = *RK++ ^ FT0[ ( Y3 ) & 0xFF ] ^	\

		FT1[ ( Y0 >> 8 ) & 0xFF ] ^	\

		FT2[ ( Y1 >> 16 ) & 0xFF ] ^	\

		FT3[ ( Y2 >> 24 ) & 0xFF ];	\

}

#define AES_RROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3)	\

{						\

	X0 = *RK++ ^ RT0[ ( Y0 ) & 0xFF ] ^	\

		RT1[ ( Y3 >> 8 ) & 0xFF ] ^	\

		RT2[ ( Y2 >> 16 ) & 0xFF ] ^	\

		RT3[ ( Y1 >> 24 ) & 0xFF ];	\

						\

	X1 = *RK++ ^ RT0[ ( Y1 ) & 0xFF ] ^	\

		RT1[ ( Y0 >> 8 ) & 0xFF ] ^	\

		RT2[ ( Y3 >> 16 ) & 0xFF ] ^	\

		RT3[ ( Y2 >> 24 ) & 0xFF ];	\

						\

	X2 = *RK++ ^ RT0[ ( Y2 ) & 0xFF ] ^	\

		RT1[ ( Y1 >> 8 ) & 0xFF ] ^	\

		RT2[ ( Y0 >> 16 ) & 0xFF ] ^	\

		RT3[ ( Y3 >> 24 ) & 0xFF ];	\

						\

	X3 = *RK++ ^ RT0[ ( Y3 ) & 0xFF ] ^	\

		RT1[ ( Y2 >> 8 ) & 0xFF ] ^	\

		RT2[ ( Y1 >> 16 ) & 0xFF ] ^	\

		RT3[ ( Y0 >> 24 ) & 0xFF ];	\

}

/*

 * AES-ECB block encryption/decryption

 */

void aes_crypt_ecb( aes_context *ctx,

	int mode,

	const unsigned char input[16],

	unsigned char output[16] )

{

	int i;

	unsigned long *RK, X0, X1, X2, X3, Y0, Y1, Y2, Y3;

#if defined(XYSSL_PADLOCK_C) && defined(XYSSL_HAVE_X86)

	if( padlock_supports( PADLOCK_ACE ) )

	{

		if( padlock_xcryptecb( ctx, mode, input, output ) == 0 )

			return;

	}

#endif

	RK = ctx->rk;

	GET_ULONG_LE( X0, input, 0 ); X0 ^= *RK++;

	GET_ULONG_LE( X1, input, 4 ); X1 ^= *RK++;

	GET_ULONG_LE( X2, input, 8 ); X2 ^= *RK++;

	GET_ULONG_LE( X3, input, 12 ); X3 ^= *RK++;

	if( mode == AES_DECRYPT )

	{

		for( i = (ctx->nr >> 1) - 1; i > 0; i-- )

		{

			AES_RROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 );

			AES_RROUND( X0, X1, X2, X3, Y0, Y1, Y2, Y3 );

		}

		AES_RROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 );

		X0 = *RK++ ^ ( RSb[ ( Y0 ) & 0xFF ] ) ^

			( RSb[ ( Y3 >> 8 ) & 0xFF ] << 8 ) ^

			( RSb[ ( Y2 >> 16 ) & 0xFF ] << 16 ) ^

			( RSb[ ( Y1 >> 24 ) & 0xFF ] << 24 );

		X1 = *RK++ ^ ( RSb[ ( Y1 ) & 0xFF ] ) ^

			( RSb[ ( Y0 >>8 ) & 0xFF ] << 8 ) ^

			( RSb[ ( Y3 >> 16 ) & 0xFF ] << 16 ) ^

			( RSb[ ( Y2 >> 24 ) & 0xFF ] << 24 );

		X2 = *RK++ ^ ( RSb[ ( Y2 ) & 0xFF ] ) ^

			( RSb[ ( Y1 >> 8 ) & 0xFF ] << 8 ) ^

			( RSb[ ( Y0 >> 16 ) & 0xFF ] << 16 ) ^

			( RSb[ ( Y3 >> 24 ) & 0xFF ] << 24 );

		X3 = *RK++ ^ ( RSb[ ( Y3 ) & 0xFF ] ) ^

			( RSb[ ( Y2 >> 8 ) & 0xFF ] << 8 ) ^

			( RSb[ ( Y1 >> 16 ) & 0xFF ] << 16 ) ^

			( RSb[ ( Y0 >> 24 ) & 0xFF ] << 24 );

	}

	else /* AES_ENCRYPT */

	{

		for( i = (ctx->nr >> 1) - 1; i > 0; i-- )

		{

			AES_FROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 );

			AES_FROUND( X0, X1, X2, X3, Y0, Y1, Y2, Y3 );

		}

		AES_FROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 );

		X0 = *RK++ ^ ( FSb[ ( Y0 ) & 0xFF ] ) ^

			( FSb[ ( Y1 >> 8 ) & 0xFF ] << 8 ) ^

			( FSb[ ( Y2 >> 16 ) & 0xFF ] << 16 ) ^

			( FSb[ ( Y3 >> 24 ) & 0xFF ] << 24 );

		X1 = *RK++ ^ ( FSb[ ( Y1 ) & 0xFF ] ) ^

			( FSb[ ( Y2 >> 8 ) & 0xFF ] << 8 ) ^

			( FSb[ ( Y3 >> 16 ) & 0xFF ] << 16 ) ^

			( FSb[ ( Y0 >> 24 ) & 0xFF ] << 24 );

		X2 = *RK++ ^ ( FSb[ ( Y2 ) & 0xFF ] ) ^

			( FSb[ ( Y3 >> 8 ) & 0xFF ] << 8 ) ^

			( FSb[ ( Y0 >> 16 ) & 0xFF ] << 16 ) ^

			( FSb[ ( Y1 >> 24 ) & 0xFF ] << 24 );

		X3 = *RK++ ^ ( FSb[ ( Y3 ) & 0xFF ] ) ^

			( FSb[ ( Y0 >> 8 ) & 0xFF ] << 8 ) ^

			( FSb[ ( Y1 >> 16 ) & 0xFF ] << 16 ) ^

			( FSb[ ( Y2 >> 24 ) & 0xFF ] << 24 );

	}

	PUT_ULONG_LE( X0, output, 0 );

	PUT_ULONG_LE( X1, output, 4 );

	PUT_ULONG_LE( X2, output, 8 );

	PUT_ULONG_LE( X3, output, 12 );

}

/*

 * AES-CBC buffer encryption/decryption

 */

void aes_crypt_cbc( aes_context *ctx,

	int mode,

	int length,

	unsigned char iv[16],

	const unsigned char *input,

	unsigned char *output )

{

	int i;

	unsigned char temp[16];

#if defined(XYSSL_PADLOCK_C) && defined(XYSSL_HAVE_X86)

	if( padlock_supports( PADLOCK_ACE ) )

	{

		if( padlock_xcryptcbc( ctx, mode, length, iv, input, output ) == 0 )

			return;

	}

#endif

	if( mode == AES_DECRYPT )

	{

		while( length > 0 )

		{

			memcpy( temp, input, 16 );

			aes_crypt_ecb( ctx, mode, input, output );

			for( i = 0; i < 16; i++ )

				output[i] = (unsigned char)( output[i] ^ iv[i] );

			memcpy( iv, temp, 16 );

			input += 16;

			output += 16;

			length -= 16;

		}

	}

	else

	{

		while( length > 0 )

		{

			for( i = 0; i < 16; i++ )

				output[i] = (unsigned char)( input[i] ^ iv[i] );

			aes_crypt_ecb( ctx, mode, output, output );

			memcpy( iv, output, 16 );

			input += 16;

			output += 16;

			length -= 16;

		}

	}

}

/*

 * AES-CFB buffer encryption/decryption

 */

void aes_crypt_cfb( aes_context *ctx,

	int mode,

	int length,

	int *iv_off,

	unsigned char iv[16],

	const unsigned char *input,

	unsigned char *output )

{

	int c, n = *iv_off;

	if( mode == AES_DECRYPT )

	{

		while( length-- )

		{

			if( n == 0 )

				aes_crypt_ecb( ctx, AES_ENCRYPT, iv, iv );

			c = *input++;

			*output++ = (unsigned char)( c ^ iv[n] );

			iv[n] = (unsigned char) c;

			n = (n + 1) & 0x0F;

		}

	}

	else

	{

		while( length-- )

		{

			if( n == 0 )

				aes_crypt_ecb( ctx, AES_ENCRYPT, iv, iv );

			iv[n] = *output++ = (unsigned char)( iv[n] ^ *input++ );

			n = (n + 1) & 0x0F;

		}

	}

	*iv_off = n;

}