0,0 → 1,565 |
/* |
* FIPS-197 compliant AES implementation |
* |
* Copyright (C) 2006-2007 Christophe Devine |
* |
* Redistribution and use in source and binary forms, with or without |
* modification, are permitted provided that the following conditions |
* are met: |
* |
* * Redistributions of source code _must_ retain the above copyright |
* notice, this list of conditions and the following disclaimer. |
* * Redistributions in binary form may or may not reproduce the above |
* copyright notice, this list of conditions and the following |
* disclaimer in the documentation and/or other materials provided |
* with the distribution. |
* * Neither the name of XySSL nor the names of its contributors may be |
* used to endorse or promote products derived from this software |
* without specific prior written permission. |
* |
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS |
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT |
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED |
* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR |
* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF |
* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING |
* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS |
* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
*/ |
/* |
* The AES block cipher was designed by Vincent Rijmen and Joan Daemen. |
* |
* http://csrc.nist.gov/encryption/aes/rijndael/Rijndael.pdf |
* http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf |
*/ |
|
#include "fitz.h" |
|
#define aes_context fz_aes |
|
/* AES block cipher implementation from XYSSL */ |
|
/* |
* 32-bit integer manipulation macros (little endian) |
*/ |
#ifndef GET_ULONG_LE |
#define GET_ULONG_LE(n,b,i) \ |
{ \ |
(n) = ( (unsigned long) (b)[(i)] ) \ |
| ( (unsigned long) (b)[(i) + 1] << 8 ) \ |
| ( (unsigned long) (b)[(i) + 2] << 16 ) \ |
| ( (unsigned long) (b)[(i) + 3] << 24 ); \ |
} |
#endif |
|
#ifndef PUT_ULONG_LE |
#define PUT_ULONG_LE(n,b,i) \ |
{ \ |
(b)[(i) ] = (unsigned char) ( (n) ); \ |
(b)[(i) + 1] = (unsigned char) ( (n) >> 8 ); \ |
(b)[(i) + 2] = (unsigned char) ( (n) >> 16 ); \ |
(b)[(i) + 3] = (unsigned char) ( (n) >> 24 ); \ |
} |
#endif |
|
/* |
* Forward S-box & tables |
*/ |
static unsigned char FSb[256]; |
static unsigned long FT0[256]; |
static unsigned long FT1[256]; |
static unsigned long FT2[256]; |
static unsigned long FT3[256]; |
|
/* |
* Reverse S-box & tables |
*/ |
static unsigned char RSb[256]; |
static unsigned long RT0[256]; |
static unsigned long RT1[256]; |
static unsigned long RT2[256]; |
static unsigned long RT3[256]; |
|
/* |
* Round constants |
*/ |
static unsigned long RCON[10]; |
|
/* |
* Tables generation code |
*/ |
#define ROTL8(x) ( ( x << 8 ) & 0xFFFFFFFF ) | ( x >> 24 ) |
#define XTIME(x) ( ( x << 1 ) ^ ( ( x & 0x80 ) ? 0x1B : 0x00 ) ) |
#define MUL(x,y) ( ( x && y ) ? pow[(log[x]+log[y]) % 255] : 0 ) |
|
static int aes_init_done = 0; |
|
static void aes_gen_tables( void ) |
{ |
int i, x, y, z; |
int pow[256]; |
int log[256]; |
|
/* |
* compute pow and log tables over GF(2^8) |
*/ |
for( i = 0, x = 1; i < 256; i++ ) |
{ |
pow[i] = x; |
log[x] = i; |
x = ( x ^ XTIME( x ) ) & 0xFF; |
} |
|
/* |
* calculate the round constants |
*/ |
for( i = 0, x = 1; i < 10; i++ ) |
{ |
RCON[i] = (unsigned long) x; |
x = XTIME( x ) & 0xFF; |
} |
|
/* |
* generate the forward and reverse S-boxes |
*/ |
FSb[0x00] = 0x63; |
RSb[0x63] = 0x00; |
|
for( i = 1; i < 256; i++ ) |
{ |
x = pow[255 - log[i]]; |
|
y = x; y = ( (y << 1) | (y >> 7) ) & 0xFF; |
x ^= y; y = ( (y << 1) | (y >> 7) ) & 0xFF; |
x ^= y; y = ( (y << 1) | (y >> 7) ) & 0xFF; |
x ^= y; y = ( (y << 1) | (y >> 7) ) & 0xFF; |
x ^= y ^ 0x63; |
|
FSb[i] = (unsigned char) x; |
RSb[x] = (unsigned char) i; |
} |
|
/* |
* generate the forward and reverse tables |
*/ |
for( i = 0; i < 256; i++ ) |
{ |
x = FSb[i]; |
y = XTIME( x ) & 0xFF; |
z = ( y ^ x ) & 0xFF; |
|
FT0[i] = ( (unsigned long) y ) ^ |
( (unsigned long) x << 8 ) ^ |
( (unsigned long) x << 16 ) ^ |
( (unsigned long) z << 24 ); |
|
FT1[i] = ROTL8( FT0[i] ); |
FT2[i] = ROTL8( FT1[i] ); |
FT3[i] = ROTL8( FT2[i] ); |
|
x = RSb[i]; |
|
RT0[i] = ( (unsigned long) MUL( 0x0E, x ) ) ^ |
( (unsigned long) MUL( 0x09, x ) << 8 ) ^ |
( (unsigned long) MUL( 0x0D, x ) << 16 ) ^ |
( (unsigned long) MUL( 0x0B, x ) << 24 ); |
|
RT1[i] = ROTL8( RT0[i] ); |
RT2[i] = ROTL8( RT1[i] ); |
RT3[i] = ROTL8( RT2[i] ); |
} |
} |
|
/* |
* AES key schedule (encryption) |
*/ |
void aes_setkey_enc( aes_context *ctx, const unsigned char *key, int keysize ) |
{ |
int i; |
unsigned long *RK; |
|
#if !defined(XYSSL_AES_ROM_TABLES) |
if( aes_init_done == 0 ) |
{ |
aes_gen_tables(); |
aes_init_done = 1; |
} |
#endif |
|
switch( keysize ) |
{ |
case 128: ctx->nr = 10; break; |
case 192: ctx->nr = 12; break; |
case 256: ctx->nr = 14; break; |
default : return; |
} |
|
#if defined(PADLOCK_ALIGN16) |
ctx->rk = RK = PADLOCK_ALIGN16( ctx->buf ); |
#else |
ctx->rk = RK = ctx->buf; |
#endif |
|
for( i = 0; i < (keysize >> 5); i++ ) |
{ |
GET_ULONG_LE( RK[i], key, i << 2 ); |
} |
|
switch( ctx->nr ) |
{ |
case 10: |
|
for( i = 0; i < 10; i++, RK += 4 ) |
{ |
RK[4] = RK[0] ^ RCON[i] ^ |
( FSb[ ( RK[3] >> 8 ) & 0xFF ] ) ^ |
( FSb[ ( RK[3] >> 16 ) & 0xFF ] << 8 ) ^ |
( FSb[ ( RK[3] >> 24 ) & 0xFF ] << 16 ) ^ |
( FSb[ ( RK[3] ) & 0xFF ] << 24 ); |
|
RK[5] = RK[1] ^ RK[4]; |
RK[6] = RK[2] ^ RK[5]; |
RK[7] = RK[3] ^ RK[6]; |
} |
break; |
|
case 12: |
|
for( i = 0; i < 8; i++, RK += 6 ) |
{ |
RK[6] = RK[0] ^ RCON[i] ^ |
( FSb[ ( RK[5] >> 8 ) & 0xFF ] ) ^ |
( FSb[ ( RK[5] >> 16 ) & 0xFF ] << 8 ) ^ |
( FSb[ ( RK[5] >> 24 ) & 0xFF ] << 16 ) ^ |
( FSb[ ( RK[5] ) & 0xFF ] << 24 ); |
|
RK[7] = RK[1] ^ RK[6]; |
RK[8] = RK[2] ^ RK[7]; |
RK[9] = RK[3] ^ RK[8]; |
RK[10] = RK[4] ^ RK[9]; |
RK[11] = RK[5] ^ RK[10]; |
} |
break; |
|
case 14: |
|
for( i = 0; i < 7; i++, RK += 8 ) |
{ |
RK[8] = RK[0] ^ RCON[i] ^ |
( FSb[ ( RK[7] >> 8 ) & 0xFF ] ) ^ |
( FSb[ ( RK[7] >> 16 ) & 0xFF ] << 8 ) ^ |
( FSb[ ( RK[7] >> 24 ) & 0xFF ] << 16 ) ^ |
( FSb[ ( RK[7] ) & 0xFF ] << 24 ); |
|
RK[9] = RK[1] ^ RK[8]; |
RK[10] = RK[2] ^ RK[9]; |
RK[11] = RK[3] ^ RK[10]; |
|
RK[12] = RK[4] ^ |
( FSb[ ( RK[11] ) & 0xFF ] ) ^ |
( FSb[ ( RK[11] >> 8 ) & 0xFF ] << 8 ) ^ |
( FSb[ ( RK[11] >> 16 ) & 0xFF ] << 16 ) ^ |
( FSb[ ( RK[11] >> 24 ) & 0xFF ] << 24 ); |
|
RK[13] = RK[5] ^ RK[12]; |
RK[14] = RK[6] ^ RK[13]; |
RK[15] = RK[7] ^ RK[14]; |
} |
break; |
|
default: |
|
break; |
} |
} |
|
/* |
* AES key schedule (decryption) |
*/ |
void aes_setkey_dec( aes_context *ctx, const unsigned char *key, int keysize ) |
{ |
int i, j; |
aes_context cty; |
unsigned long *RK; |
unsigned long *SK; |
|
switch( keysize ) |
{ |
case 128: ctx->nr = 10; break; |
case 192: ctx->nr = 12; break; |
case 256: ctx->nr = 14; break; |
default : return; |
} |
|
#if defined(PADLOCK_ALIGN16) |
ctx->rk = RK = PADLOCK_ALIGN16( ctx->buf ); |
#else |
ctx->rk = RK = ctx->buf; |
#endif |
|
aes_setkey_enc( &cty, key, keysize ); |
SK = cty.rk + cty.nr * 4; |
|
*RK++ = *SK++; |
*RK++ = *SK++; |
*RK++ = *SK++; |
*RK++ = *SK++; |
|
for( i = ctx->nr - 1, SK -= 8; i > 0; i--, SK -= 8 ) |
{ |
for( j = 0; j < 4; j++, SK++ ) |
{ |
*RK++ = RT0[ FSb[ ( *SK ) & 0xFF ] ] ^ |
RT1[ FSb[ ( *SK >> 8 ) & 0xFF ] ] ^ |
RT2[ FSb[ ( *SK >> 16 ) & 0xFF ] ] ^ |
RT3[ FSb[ ( *SK >> 24 ) & 0xFF ] ]; |
} |
} |
|
*RK++ = *SK++; |
*RK++ = *SK++; |
*RK++ = *SK++; |
*RK++ = *SK++; |
|
memset( &cty, 0, sizeof( aes_context ) ); |
} |
|
#define AES_FROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3) \ |
{ \ |
X0 = *RK++ ^ FT0[ ( Y0 ) & 0xFF ] ^ \ |
FT1[ ( Y1 >> 8 ) & 0xFF ] ^ \ |
FT2[ ( Y2 >> 16 ) & 0xFF ] ^ \ |
FT3[ ( Y3 >> 24 ) & 0xFF ]; \ |
\ |
X1 = *RK++ ^ FT0[ ( Y1 ) & 0xFF ] ^ \ |
FT1[ ( Y2 >> 8 ) & 0xFF ] ^ \ |
FT2[ ( Y3 >> 16 ) & 0xFF ] ^ \ |
FT3[ ( Y0 >> 24 ) & 0xFF ]; \ |
\ |
X2 = *RK++ ^ FT0[ ( Y2 ) & 0xFF ] ^ \ |
FT1[ ( Y3 >> 8 ) & 0xFF ] ^ \ |
FT2[ ( Y0 >> 16 ) & 0xFF ] ^ \ |
FT3[ ( Y1 >> 24 ) & 0xFF ]; \ |
\ |
X3 = *RK++ ^ FT0[ ( Y3 ) & 0xFF ] ^ \ |
FT1[ ( Y0 >> 8 ) & 0xFF ] ^ \ |
FT2[ ( Y1 >> 16 ) & 0xFF ] ^ \ |
FT3[ ( Y2 >> 24 ) & 0xFF ]; \ |
} |
|
#define AES_RROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3) \ |
{ \ |
X0 = *RK++ ^ RT0[ ( Y0 ) & 0xFF ] ^ \ |
RT1[ ( Y3 >> 8 ) & 0xFF ] ^ \ |
RT2[ ( Y2 >> 16 ) & 0xFF ] ^ \ |
RT3[ ( Y1 >> 24 ) & 0xFF ]; \ |
\ |
X1 = *RK++ ^ RT0[ ( Y1 ) & 0xFF ] ^ \ |
RT1[ ( Y0 >> 8 ) & 0xFF ] ^ \ |
RT2[ ( Y3 >> 16 ) & 0xFF ] ^ \ |
RT3[ ( Y2 >> 24 ) & 0xFF ]; \ |
\ |
X2 = *RK++ ^ RT0[ ( Y2 ) & 0xFF ] ^ \ |
RT1[ ( Y1 >> 8 ) & 0xFF ] ^ \ |
RT2[ ( Y0 >> 16 ) & 0xFF ] ^ \ |
RT3[ ( Y3 >> 24 ) & 0xFF ]; \ |
\ |
X3 = *RK++ ^ RT0[ ( Y3 ) & 0xFF ] ^ \ |
RT1[ ( Y2 >> 8 ) & 0xFF ] ^ \ |
RT2[ ( Y1 >> 16 ) & 0xFF ] ^ \ |
RT3[ ( Y0 >> 24 ) & 0xFF ]; \ |
} |
|
/* |
* AES-ECB block encryption/decryption |
*/ |
void aes_crypt_ecb( aes_context *ctx, |
int mode, |
const unsigned char input[16], |
unsigned char output[16] ) |
{ |
int i; |
unsigned long *RK, X0, X1, X2, X3, Y0, Y1, Y2, Y3; |
|
#if defined(XYSSL_PADLOCK_C) && defined(XYSSL_HAVE_X86) |
if( padlock_supports( PADLOCK_ACE ) ) |
{ |
if( padlock_xcryptecb( ctx, mode, input, output ) == 0 ) |
return; |
} |
#endif |
|
RK = ctx->rk; |
|
GET_ULONG_LE( X0, input, 0 ); X0 ^= *RK++; |
GET_ULONG_LE( X1, input, 4 ); X1 ^= *RK++; |
GET_ULONG_LE( X2, input, 8 ); X2 ^= *RK++; |
GET_ULONG_LE( X3, input, 12 ); X3 ^= *RK++; |
|
if( mode == AES_DECRYPT ) |
{ |
for( i = (ctx->nr >> 1) - 1; i > 0; i-- ) |
{ |
AES_RROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 ); |
AES_RROUND( X0, X1, X2, X3, Y0, Y1, Y2, Y3 ); |
} |
|
AES_RROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 ); |
|
X0 = *RK++ ^ ( RSb[ ( Y0 ) & 0xFF ] ) ^ |
( RSb[ ( Y3 >> 8 ) & 0xFF ] << 8 ) ^ |
( RSb[ ( Y2 >> 16 ) & 0xFF ] << 16 ) ^ |
( RSb[ ( Y1 >> 24 ) & 0xFF ] << 24 ); |
|
X1 = *RK++ ^ ( RSb[ ( Y1 ) & 0xFF ] ) ^ |
( RSb[ ( Y0 >>8 ) & 0xFF ] << 8 ) ^ |
( RSb[ ( Y3 >> 16 ) & 0xFF ] << 16 ) ^ |
( RSb[ ( Y2 >> 24 ) & 0xFF ] << 24 ); |
|
X2 = *RK++ ^ ( RSb[ ( Y2 ) & 0xFF ] ) ^ |
( RSb[ ( Y1 >> 8 ) & 0xFF ] << 8 ) ^ |
( RSb[ ( Y0 >> 16 ) & 0xFF ] << 16 ) ^ |
( RSb[ ( Y3 >> 24 ) & 0xFF ] << 24 ); |
|
X3 = *RK++ ^ ( RSb[ ( Y3 ) & 0xFF ] ) ^ |
( RSb[ ( Y2 >> 8 ) & 0xFF ] << 8 ) ^ |
( RSb[ ( Y1 >> 16 ) & 0xFF ] << 16 ) ^ |
( RSb[ ( Y0 >> 24 ) & 0xFF ] << 24 ); |
} |
else /* AES_ENCRYPT */ |
{ |
for( i = (ctx->nr >> 1) - 1; i > 0; i-- ) |
{ |
AES_FROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 ); |
AES_FROUND( X0, X1, X2, X3, Y0, Y1, Y2, Y3 ); |
} |
|
AES_FROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 ); |
|
X0 = *RK++ ^ ( FSb[ ( Y0 ) & 0xFF ] ) ^ |
( FSb[ ( Y1 >> 8 ) & 0xFF ] << 8 ) ^ |
( FSb[ ( Y2 >> 16 ) & 0xFF ] << 16 ) ^ |
( FSb[ ( Y3 >> 24 ) & 0xFF ] << 24 ); |
|
X1 = *RK++ ^ ( FSb[ ( Y1 ) & 0xFF ] ) ^ |
( FSb[ ( Y2 >> 8 ) & 0xFF ] << 8 ) ^ |
( FSb[ ( Y3 >> 16 ) & 0xFF ] << 16 ) ^ |
( FSb[ ( Y0 >> 24 ) & 0xFF ] << 24 ); |
|
X2 = *RK++ ^ ( FSb[ ( Y2 ) & 0xFF ] ) ^ |
( FSb[ ( Y3 >> 8 ) & 0xFF ] << 8 ) ^ |
( FSb[ ( Y0 >> 16 ) & 0xFF ] << 16 ) ^ |
( FSb[ ( Y1 >> 24 ) & 0xFF ] << 24 ); |
|
X3 = *RK++ ^ ( FSb[ ( Y3 ) & 0xFF ] ) ^ |
( FSb[ ( Y0 >> 8 ) & 0xFF ] << 8 ) ^ |
( FSb[ ( Y1 >> 16 ) & 0xFF ] << 16 ) ^ |
( FSb[ ( Y2 >> 24 ) & 0xFF ] << 24 ); |
} |
|
PUT_ULONG_LE( X0, output, 0 ); |
PUT_ULONG_LE( X1, output, 4 ); |
PUT_ULONG_LE( X2, output, 8 ); |
PUT_ULONG_LE( X3, output, 12 ); |
} |
|
/* |
* AES-CBC buffer encryption/decryption |
*/ |
void aes_crypt_cbc( aes_context *ctx, |
int mode, |
int length, |
unsigned char iv[16], |
const unsigned char *input, |
unsigned char *output ) |
{ |
int i; |
unsigned char temp[16]; |
|
#if defined(XYSSL_PADLOCK_C) && defined(XYSSL_HAVE_X86) |
if( padlock_supports( PADLOCK_ACE ) ) |
{ |
if( padlock_xcryptcbc( ctx, mode, length, iv, input, output ) == 0 ) |
return; |
} |
#endif |
|
if( mode == AES_DECRYPT ) |
{ |
while( length > 0 ) |
{ |
memcpy( temp, input, 16 ); |
aes_crypt_ecb( ctx, mode, input, output ); |
|
for( i = 0; i < 16; i++ ) |
output[i] = (unsigned char)( output[i] ^ iv[i] ); |
|
memcpy( iv, temp, 16 ); |
|
input += 16; |
output += 16; |
length -= 16; |
} |
} |
else |
{ |
while( length > 0 ) |
{ |
for( i = 0; i < 16; i++ ) |
output[i] = (unsigned char)( input[i] ^ iv[i] ); |
|
aes_crypt_ecb( ctx, mode, output, output ); |
memcpy( iv, output, 16 ); |
|
input += 16; |
output += 16; |
length -= 16; |
} |
} |
} |
|
/* |
* AES-CFB buffer encryption/decryption |
*/ |
void aes_crypt_cfb( aes_context *ctx, |
int mode, |
int length, |
int *iv_off, |
unsigned char iv[16], |
const unsigned char *input, |
unsigned char *output ) |
{ |
int c, n = *iv_off; |
|
if( mode == AES_DECRYPT ) |
{ |
while( length-- ) |
{ |
if( n == 0 ) |
aes_crypt_ecb( ctx, AES_ENCRYPT, iv, iv ); |
|
c = *input++; |
*output++ = (unsigned char)( c ^ iv[n] ); |
iv[n] = (unsigned char) c; |
|
n = (n + 1) & 0x0F; |
} |
} |
else |
{ |
while( length-- ) |
{ |
if( n == 0 ) |
aes_crypt_ecb( ctx, AES_ENCRYPT, iv, iv ); |
|
iv[n] = *output++ = (unsigned char)( iv[n] ^ *input++ ); |
|
n = (n + 1) & 0x0F; |
} |
} |
|
*iv_off = n; |
} |