summaryrefslogtreecommitdiff
path: root/rijndael.c
diff options
context:
space:
mode:
authorBen Lindstrom <mouring@eviladmin.org>2000-12-10 01:55:37 +0000
committerBen Lindstrom <mouring@eviladmin.org>2000-12-10 01:55:37 +0000
commitfa1b3d08421d263694d5fb3989d796a57d714f2a (patch)
treed3e8b0669d169e2c6c3ca8e3c30ddc5538ec6490 /rijndael.c
parenta688561ef4bf78651e60b112960b099c2bee1d90 (diff)
20001210
- (bal) OpenBSD CVS updates - markus@cvs.openbsd.org 2000/12/09 13:41:51 [cipher.c cipher.h rijndael.c rijndael.h rijndael_boxes.h] undo rijndael changes - markus@cvs.openbsd.org 2000/12/09 13:48:31 [rijndael.c] fix byte order bug w/o introducing new implementation - markus@cvs.openbsd.org 2000/12/09 14:08:27 [sftp-server.c] "" -> "." for realpath; from vinschen@redhat.com - markus@cvs.openbsd.org 2000/12/09 14:06:54 [ssh-agent.c] extern int optind; from stevesk@sweden.hp.com
Diffstat (limited to 'rijndael.c')
-rw-r--r--rijndael.c689
1 files changed, 395 insertions, 294 deletions
diff --git a/rijndael.c b/rijndael.c
index 92a39762f..10c779b4c 100644
--- a/rijndael.c
+++ b/rijndael.c
@@ -1,311 +1,412 @@
1/* 1/* $OpenBSD: rijndael.c,v 1.6 2000/12/09 13:48:31 markus Exp $ */
2 * rijndael-alg-fst.c v2.4 April '2000 2
3 * rijndael-alg-api.c v2.4 April '2000 3/* This is an independent implementation of the encryption algorithm: */
4 * 4/* */
5 * Optimised ANSI C code 5/* RIJNDAEL by Joan Daemen and Vincent Rijmen */
6 * 6/* */
7 * authors: v1.0: Antoon Bosselaers 7/* which is a candidate algorithm in the Advanced Encryption Standard */
8 * v2.0: Vincent Rijmen, K.U.Leuven 8/* programme of the US National Institute of Standards and Technology. */
9 * v2.3: Paulo Barreto 9/* */
10 * v2.4: Vincent Rijmen, K.U.Leuven 10/* Copyright in this implementation is held by Dr B R Gladman but I */
11 * 11/* hereby give permission for its free direct or derivative use subject */
12 * This code is placed in the public domain. 12/* to acknowledgment of its origin and compliance with any conditions */
13 */ 13/* that the originators of the algorithm place on its exploitation. */
14 14/* */
15#include <stdio.h> 15/* Dr Brian Gladman (gladman@seven77.demon.co.uk) 14th January 1999 */
16#include <stdlib.h> 16
17#include <assert.h> 17/* Timing data for Rijndael (rijndael.c)
18
19Algorithm: rijndael (rijndael.c)
20
21128 bit key:
22Key Setup: 305/1389 cycles (encrypt/decrypt)
23Encrypt: 374 cycles = 68.4 mbits/sec
24Decrypt: 352 cycles = 72.7 mbits/sec
25Mean: 363 cycles = 70.5 mbits/sec
26
27192 bit key:
28Key Setup: 277/1595 cycles (encrypt/decrypt)
29Encrypt: 439 cycles = 58.3 mbits/sec
30Decrypt: 425 cycles = 60.2 mbits/sec
31Mean: 432 cycles = 59.3 mbits/sec
32
33256 bit key:
34Key Setup: 374/1960 cycles (encrypt/decrypt)
35Encrypt: 502 cycles = 51.0 mbits/sec
36Decrypt: 498 cycles = 51.4 mbits/sec
37Mean: 500 cycles = 51.2 mbits/sec
38
39*/
18 40
19#include "config.h" 41#include "config.h"
20#include "rijndael.h" 42#include "rijndael.h"
21#include "rijndael_boxes.h"
22 43
23int 44void gen_tabs __P((void));
24rijndael_keysched(u_int8_t k[RIJNDAEL_MAXKC][4], 45
25 u_int8_t W[RIJNDAEL_MAXROUNDS+1][4][4], int ROUNDS) 46/* 3. Basic macros for speeding up generic operations */
47
48/* Circular rotate of 32 bit values */
49
50#define rotr(x,n) (((x) >> ((int)(n))) | ((x) << (32 - (int)(n))))
51#define rotl(x,n) (((x) << ((int)(n))) | ((x) >> (32 - (int)(n))))
52
53/* Invert byte order in a 32 bit variable */
54
55#define bswap(x) ((rotl(x, 8) & 0x00ff00ff) | (rotr(x, 8) & 0xff00ff00))
56
57/* Extract byte from a 32 bit quantity (little endian notation) */
58
59#define byte(x,n) ((u1byte)((x) >> (8 * n)))
60
61#if BYTE_ORDER != LITTLE_ENDIAN
62#define BYTE_SWAP
63#endif
64
65#ifdef BYTE_SWAP
66#define io_swap(x) bswap(x)
67#else
68#define io_swap(x) (x)
69#endif
70
71#define LARGE_TABLES
72
73u1byte pow_tab[256];
74u1byte log_tab[256];
75u1byte sbx_tab[256];
76u1byte isb_tab[256];
77u4byte rco_tab[ 10];
78u4byte ft_tab[4][256];
79u4byte it_tab[4][256];
80
81#ifdef LARGE_TABLES
82 u4byte fl_tab[4][256];
83 u4byte il_tab[4][256];
84#endif
85
86u4byte tab_gen = 0;
87
88#define ff_mult(a,b) (a && b ? pow_tab[(log_tab[a] + log_tab[b]) % 255] : 0)
89
90#define f_rn(bo, bi, n, k) \
91 bo[n] = ft_tab[0][byte(bi[n],0)] ^ \
92 ft_tab[1][byte(bi[(n + 1) & 3],1)] ^ \
93 ft_tab[2][byte(bi[(n + 2) & 3],2)] ^ \
94 ft_tab[3][byte(bi[(n + 3) & 3],3)] ^ *(k + n)
95
96#define i_rn(bo, bi, n, k) \
97 bo[n] = it_tab[0][byte(bi[n],0)] ^ \
98 it_tab[1][byte(bi[(n + 3) & 3],1)] ^ \
99 it_tab[2][byte(bi[(n + 2) & 3],2)] ^ \
100 it_tab[3][byte(bi[(n + 1) & 3],3)] ^ *(k + n)
101
102#ifdef LARGE_TABLES
103
104#define ls_box(x) \
105 ( fl_tab[0][byte(x, 0)] ^ \
106 fl_tab[1][byte(x, 1)] ^ \
107 fl_tab[2][byte(x, 2)] ^ \
108 fl_tab[3][byte(x, 3)] )
109
110#define f_rl(bo, bi, n, k) \
111 bo[n] = fl_tab[0][byte(bi[n],0)] ^ \
112 fl_tab[1][byte(bi[(n + 1) & 3],1)] ^ \
113 fl_tab[2][byte(bi[(n + 2) & 3],2)] ^ \
114 fl_tab[3][byte(bi[(n + 3) & 3],3)] ^ *(k + n)
115
116#define i_rl(bo, bi, n, k) \
117 bo[n] = il_tab[0][byte(bi[n],0)] ^ \
118 il_tab[1][byte(bi[(n + 3) & 3],1)] ^ \
119 il_tab[2][byte(bi[(n + 2) & 3],2)] ^ \
120 il_tab[3][byte(bi[(n + 1) & 3],3)] ^ *(k + n)
121
122#else
123
124#define ls_box(x) \
125 ((u4byte)sbx_tab[byte(x, 0)] << 0) ^ \
126 ((u4byte)sbx_tab[byte(x, 1)] << 8) ^ \
127 ((u4byte)sbx_tab[byte(x, 2)] << 16) ^ \
128 ((u4byte)sbx_tab[byte(x, 3)] << 24)
129
130#define f_rl(bo, bi, n, k) \
131 bo[n] = (u4byte)sbx_tab[byte(bi[n],0)] ^ \
132 rotl(((u4byte)sbx_tab[byte(bi[(n + 1) & 3],1)]), 8) ^ \
133 rotl(((u4byte)sbx_tab[byte(bi[(n + 2) & 3],2)]), 16) ^ \
134 rotl(((u4byte)sbx_tab[byte(bi[(n + 3) & 3],3)]), 24) ^ *(k + n)
135
136#define i_rl(bo, bi, n, k) \
137 bo[n] = (u4byte)isb_tab[byte(bi[n],0)] ^ \
138 rotl(((u4byte)isb_tab[byte(bi[(n + 3) & 3],1)]), 8) ^ \
139 rotl(((u4byte)isb_tab[byte(bi[(n + 2) & 3],2)]), 16) ^ \
140 rotl(((u4byte)isb_tab[byte(bi[(n + 1) & 3],3)]), 24) ^ *(k + n)
141
142#endif
143
144void
145gen_tabs(void)
26{ 146{
27 /* Calculate the necessary round keys 147 u4byte i, t;
28 * The number of calculations depends on keyBits and blockBits 148 u1byte p, q;
29 */ 149
30 int j, r, t, rconpointer = 0; 150 /* log and power tables for GF(2**8) finite field with */
31 u_int8_t tk[RIJNDAEL_MAXKC][4]; 151 /* 0x11b as modular polynomial - the simplest prmitive */
32 int KC = ROUNDS - 6; 152 /* root is 0x11, used here to generate the tables */
33 153
34 for (j = KC-1; j >= 0; j--) { 154 for(i = 0,p = 1; i < 256; ++i) {
35 *((u_int32_t*)tk[j]) = *((u_int32_t*)k[j]); 155 pow_tab[i] = (u1byte)p; log_tab[p] = (u1byte)i;
156
157 p = p ^ (p << 1) ^ (p & 0x80 ? 0x01b : 0);
36 } 158 }
37 r = 0; 159
38 t = 0; 160 log_tab[1] = 0; p = 1;
39 /* copy values into round key array */ 161
40 for (j = 0; (j < KC) && (r < ROUNDS + 1); ) { 162 for(i = 0; i < 10; ++i) {
41 for (; (j < KC) && (t < 4); j++, t++) { 163 rco_tab[i] = p;
42 *((u_int32_t*)W[r][t]) = *((u_int32_t*)tk[j]); 164
43 } 165 p = (p << 1) ^ (p & 0x80 ? 0x1b : 0);
44 if (t == 4) {
45 r++;
46 t = 0;
47 }
48 } 166 }
49
50 while (r < ROUNDS + 1) { /* while not enough round key material calculated */
51 /* calculate new values */
52 tk[0][0] ^= S[tk[KC-1][1]];
53 tk[0][1] ^= S[tk[KC-1][2]];
54 tk[0][2] ^= S[tk[KC-1][3]];
55 tk[0][3] ^= S[tk[KC-1][0]];
56 tk[0][0] ^= rcon[rconpointer++];
57
58 if (KC != 8) {
59 for (j = 1; j < KC; j++) {
60 *((u_int32_t*)tk[j]) ^= *((u_int32_t*)tk[j-1]);
61 }
62 } else {
63 for (j = 1; j < KC/2; j++) {
64 *((u_int32_t*)tk[j]) ^= *((u_int32_t*)tk[j-1]);
65 }
66 tk[KC/2][0] ^= S[tk[KC/2 - 1][0]];
67 tk[KC/2][1] ^= S[tk[KC/2 - 1][1]];
68 tk[KC/2][2] ^= S[tk[KC/2 - 1][2]];
69 tk[KC/2][3] ^= S[tk[KC/2 - 1][3]];
70 for (j = KC/2 + 1; j < KC; j++) {
71 *((u_int32_t*)tk[j]) ^= *((u_int32_t*)tk[j-1]);
72 }
73 }
74 /* copy values into round key array */
75 for (j = 0; (j < KC) && (r < ROUNDS + 1); ) {
76 for (; (j < KC) && (t < 4); j++, t++) {
77 *((u_int32_t*)W[r][t]) = *((u_int32_t*)tk[j]);
78 }
79 if (t == 4) {
80 r++;
81 t = 0;
82 }
83 }
84 }
85 return 0;
86}
87 167
88int 168 /* note that the affine byte transformation matrix in */
89rijndael_key_enc_to_dec(u_int8_t W[RIJNDAEL_MAXROUNDS+1][4][4], int ROUNDS) 169 /* rijndael specification is in big endian format with */
90{ 170 /* bit 0 as the most significant bit. In the remainder */
91 int r; 171 /* of the specification the bits are numbered from the */
92 u_int8_t *w; 172 /* least significant end of a byte. */
93 173
94 for (r = 1; r < ROUNDS; r++) { 174 for(i = 0; i < 256; ++i) {
95 w = W[r][0]; 175 p = (i ? pow_tab[255 - log_tab[i]] : 0); q = p;
96 *((u_int32_t*)w) = *((u_int32_t*)U1[w[0]]) 176 q = (q >> 7) | (q << 1); p ^= q;
97 ^ *((u_int32_t*)U2[w[1]]) 177 q = (q >> 7) | (q << 1); p ^= q;
98 ^ *((u_int32_t*)U3[w[2]]) 178 q = (q >> 7) | (q << 1); p ^= q;
99 ^ *((u_int32_t*)U4[w[3]]); 179 q = (q >> 7) | (q << 1); p ^= q ^ 0x63;
100 180 sbx_tab[i] = (u1byte)p; isb_tab[p] = (u1byte)i;
101 w = W[r][1];
102 *((u_int32_t*)w) = *((u_int32_t*)U1[w[0]])
103 ^ *((u_int32_t*)U2[w[1]])
104 ^ *((u_int32_t*)U3[w[2]])
105 ^ *((u_int32_t*)U4[w[3]]);
106
107 w = W[r][2];
108 *((u_int32_t*)w) = *((u_int32_t*)U1[w[0]])
109 ^ *((u_int32_t*)U2[w[1]])
110 ^ *((u_int32_t*)U3[w[2]])
111 ^ *((u_int32_t*)U4[w[3]]);
112
113 w = W[r][3];
114 *((u_int32_t*)w) = *((u_int32_t*)U1[w[0]])
115 ^ *((u_int32_t*)U2[w[1]])
116 ^ *((u_int32_t*)U3[w[2]])
117 ^ *((u_int32_t*)U4[w[3]]);
118 } 181 }
119 return 0; 182
120} 183 for(i = 0; i < 256; ++i) {
121 184 p = sbx_tab[i];
122/** 185
123 * Encrypt a single block. 186#ifdef LARGE_TABLES
124 */ 187
125int 188 t = p; fl_tab[0][i] = t;
126rijndael_encrypt(rijndael_key *key, u_int8_t a[16], u_int8_t b[16]) 189 fl_tab[1][i] = rotl(t, 8);
127{ 190 fl_tab[2][i] = rotl(t, 16);
128 u_int8_t (*rk)[4][4] = key->keySched; 191 fl_tab[3][i] = rotl(t, 24);
129 int ROUNDS = key->ROUNDS; 192#endif
130 int r; 193 t = ((u4byte)ff_mult(2, p)) |
131 u_int8_t temp[4][4]; 194 ((u4byte)p << 8) |
132 195 ((u4byte)p << 16) |
133 *((u_int32_t*)temp[0]) = *((u_int32_t*)(a )) ^ *((u_int32_t*)rk[0][0]); 196 ((u4byte)ff_mult(3, p) << 24);
134 *((u_int32_t*)temp[1]) = *((u_int32_t*)(a+ 4)) ^ *((u_int32_t*)rk[0][1]); 197
135 *((u_int32_t*)temp[2]) = *((u_int32_t*)(a+ 8)) ^ *((u_int32_t*)rk[0][2]); 198 ft_tab[0][i] = t;
136 *((u_int32_t*)temp[3]) = *((u_int32_t*)(a+12)) ^ *((u_int32_t*)rk[0][3]); 199 ft_tab[1][i] = rotl(t, 8);
137 *((u_int32_t*)(b )) = *((u_int32_t*)T1[temp[0][0]]) 200 ft_tab[2][i] = rotl(t, 16);
138 ^ *((u_int32_t*)T2[temp[1][1]]) 201 ft_tab[3][i] = rotl(t, 24);
139 ^ *((u_int32_t*)T3[temp[2][2]]) 202
140 ^ *((u_int32_t*)T4[temp[3][3]]); 203 p = isb_tab[i];
141 *((u_int32_t*)(b + 4)) = *((u_int32_t*)T1[temp[1][0]]) 204
142 ^ *((u_int32_t*)T2[temp[2][1]]) 205#ifdef LARGE_TABLES
143 ^ *((u_int32_t*)T3[temp[3][2]]) 206
144 ^ *((u_int32_t*)T4[temp[0][3]]); 207 t = p; il_tab[0][i] = t;
145 *((u_int32_t*)(b + 8)) = *((u_int32_t*)T1[temp[2][0]]) 208 il_tab[1][i] = rotl(t, 8);
146 ^ *((u_int32_t*)T2[temp[3][1]]) 209 il_tab[2][i] = rotl(t, 16);
147 ^ *((u_int32_t*)T3[temp[0][2]]) 210 il_tab[3][i] = rotl(t, 24);
148 ^ *((u_int32_t*)T4[temp[1][3]]); 211#endif
149 *((u_int32_t*)(b +12)) = *((u_int32_t*)T1[temp[3][0]]) 212 t = ((u4byte)ff_mult(14, p)) |
150 ^ *((u_int32_t*)T2[temp[0][1]]) 213 ((u4byte)ff_mult( 9, p) << 8) |
151 ^ *((u_int32_t*)T3[temp[1][2]]) 214 ((u4byte)ff_mult(13, p) << 16) |
152 ^ *((u_int32_t*)T4[temp[2][3]]); 215 ((u4byte)ff_mult(11, p) << 24);
153 for (r = 1; r < ROUNDS-1; r++) { 216
154 *((u_int32_t*)temp[0]) = *((u_int32_t*)(b )) ^ *((u_int32_t*)rk[r][0]); 217 it_tab[0][i] = t;
155 *((u_int32_t*)temp[1]) = *((u_int32_t*)(b+ 4)) ^ *((u_int32_t*)rk[r][1]); 218 it_tab[1][i] = rotl(t, 8);
156 *((u_int32_t*)temp[2]) = *((u_int32_t*)(b+ 8)) ^ *((u_int32_t*)rk[r][2]); 219 it_tab[2][i] = rotl(t, 16);
157 *((u_int32_t*)temp[3]) = *((u_int32_t*)(b+12)) ^ *((u_int32_t*)rk[r][3]); 220 it_tab[3][i] = rotl(t, 24);
158
159 *((u_int32_t*)(b )) = *((u_int32_t*)T1[temp[0][0]])
160 ^ *((u_int32_t*)T2[temp[1][1]])
161 ^ *((u_int32_t*)T3[temp[2][2]])
162 ^ *((u_int32_t*)T4[temp[3][3]]);
163 *((u_int32_t*)(b + 4)) = *((u_int32_t*)T1[temp[1][0]])
164 ^ *((u_int32_t*)T2[temp[2][1]])
165 ^ *((u_int32_t*)T3[temp[3][2]])
166 ^ *((u_int32_t*)T4[temp[0][3]]);
167 *((u_int32_t*)(b + 8)) = *((u_int32_t*)T1[temp[2][0]])
168 ^ *((u_int32_t*)T2[temp[3][1]])
169 ^ *((u_int32_t*)T3[temp[0][2]])
170 ^ *((u_int32_t*)T4[temp[1][3]]);
171 *((u_int32_t*)(b +12)) = *((u_int32_t*)T1[temp[3][0]])
172 ^ *((u_int32_t*)T2[temp[0][1]])
173 ^ *((u_int32_t*)T3[temp[1][2]])
174 ^ *((u_int32_t*)T4[temp[2][3]]);
175 } 221 }
176 /* last round is special */ 222
177 *((u_int32_t*)temp[0]) = *((u_int32_t*)(b )) ^ *((u_int32_t*)rk[ROUNDS-1][0]); 223 tab_gen = 1;
178 *((u_int32_t*)temp[1]) = *((u_int32_t*)(b+ 4)) ^ *((u_int32_t*)rk[ROUNDS-1][1]);
179 *((u_int32_t*)temp[2]) = *((u_int32_t*)(b+ 8)) ^ *((u_int32_t*)rk[ROUNDS-1][2]);
180 *((u_int32_t*)temp[3]) = *((u_int32_t*)(b+12)) ^ *((u_int32_t*)rk[ROUNDS-1][3]);
181 b[ 0] = T1[temp[0][0]][1];
182 b[ 1] = T1[temp[1][1]][1];
183 b[ 2] = T1[temp[2][2]][1];
184 b[ 3] = T1[temp[3][3]][1];
185 b[ 4] = T1[temp[1][0]][1];
186 b[ 5] = T1[temp[2][1]][1];
187 b[ 6] = T1[temp[3][2]][1];
188 b[ 7] = T1[temp[0][3]][1];
189 b[ 8] = T1[temp[2][0]][1];
190 b[ 9] = T1[temp[3][1]][1];
191 b[10] = T1[temp[0][2]][1];
192 b[11] = T1[temp[1][3]][1];
193 b[12] = T1[temp[3][0]][1];
194 b[13] = T1[temp[0][1]][1];
195 b[14] = T1[temp[1][2]][1];
196 b[15] = T1[temp[2][3]][1];
197 *((u_int32_t*)(b )) ^= *((u_int32_t*)rk[ROUNDS][0]);
198 *((u_int32_t*)(b+ 4)) ^= *((u_int32_t*)rk[ROUNDS][1]);
199 *((u_int32_t*)(b+ 8)) ^= *((u_int32_t*)rk[ROUNDS][2]);
200 *((u_int32_t*)(b+12)) ^= *((u_int32_t*)rk[ROUNDS][3]);
201
202 return 0;
203} 224}
204 225
205/** 226#define star_x(x) (((x) & 0x7f7f7f7f) << 1) ^ ((((x) & 0x80808080) >> 7) * 0x1b)
206 * Decrypt a single block. 227
207 */ 228#define imix_col(y,x) \
208int 229 u = star_x(x); \
209rijndael_decrypt(rijndael_key *key, u_int8_t a[16], u_int8_t b[16]) 230 v = star_x(u); \
210{ 231 w = star_x(v); \
211 u_int8_t (*rk)[4][4] = key->keySched; 232 t = w ^ (x); \
212 int ROUNDS = key->ROUNDS; 233 (y) = u ^ v ^ w; \
213 int r; 234 (y) ^= rotr(u ^ t, 8) ^ \
214 u_int8_t temp[4][4]; 235 rotr(v ^ t, 16) ^ \
236 rotr(t,24)
237
238/* initialise the key schedule from the user supplied key */
239
240#define loop4(i) \
241{ t = ls_box(rotr(t, 8)) ^ rco_tab[i]; \
242 t ^= e_key[4 * i]; e_key[4 * i + 4] = t; \
243 t ^= e_key[4 * i + 1]; e_key[4 * i + 5] = t; \
244 t ^= e_key[4 * i + 2]; e_key[4 * i + 6] = t; \
245 t ^= e_key[4 * i + 3]; e_key[4 * i + 7] = t; \
246}
247
248#define loop6(i) \
249{ t = ls_box(rotr(t, 8)) ^ rco_tab[i]; \
250 t ^= e_key[6 * i]; e_key[6 * i + 6] = t; \
251 t ^= e_key[6 * i + 1]; e_key[6 * i + 7] = t; \
252 t ^= e_key[6 * i + 2]; e_key[6 * i + 8] = t; \
253 t ^= e_key[6 * i + 3]; e_key[6 * i + 9] = t; \
254 t ^= e_key[6 * i + 4]; e_key[6 * i + 10] = t; \
255 t ^= e_key[6 * i + 5]; e_key[6 * i + 11] = t; \
256}
257
258#define loop8(i) \
259{ t = ls_box(rotr(t, 8)) ^ rco_tab[i]; \
260 t ^= e_key[8 * i]; e_key[8 * i + 8] = t; \
261 t ^= e_key[8 * i + 1]; e_key[8 * i + 9] = t; \
262 t ^= e_key[8 * i + 2]; e_key[8 * i + 10] = t; \
263 t ^= e_key[8 * i + 3]; e_key[8 * i + 11] = t; \
264 t = e_key[8 * i + 4] ^ ls_box(t); \
265 e_key[8 * i + 12] = t; \
266 t ^= e_key[8 * i + 5]; e_key[8 * i + 13] = t; \
267 t ^= e_key[8 * i + 6]; e_key[8 * i + 14] = t; \
268 t ^= e_key[8 * i + 7]; e_key[8 * i + 15] = t; \
269}
270
271rijndael_ctx *
272rijndael_set_key(rijndael_ctx *ctx, const u4byte *in_key, const u4byte key_len,
273 int encrypt)
274{
275 u4byte i, t, u, v, w;
276 u4byte *e_key = ctx->e_key;
277 u4byte *d_key = ctx->d_key;
278
279 ctx->decrypt = !encrypt;
280
281 if(!tab_gen)
282 gen_tabs();
283
284 ctx->k_len = (key_len + 31) / 32;
285
286 e_key[0] = io_swap(in_key[0]); e_key[1] = io_swap(in_key[1]);
287 e_key[2] = io_swap(in_key[2]); e_key[3] = io_swap(in_key[3]);
215 288
216 *((u_int32_t*)temp[0]) = *((u_int32_t*)(a )) ^ *((u_int32_t*)rk[ROUNDS][0]); 289 switch(ctx->k_len) {
217 *((u_int32_t*)temp[1]) = *((u_int32_t*)(a+ 4)) ^ *((u_int32_t*)rk[ROUNDS][1]); 290 case 4: t = e_key[3];
218 *((u_int32_t*)temp[2]) = *((u_int32_t*)(a+ 8)) ^ *((u_int32_t*)rk[ROUNDS][2]); 291 for(i = 0; i < 10; ++i)
219 *((u_int32_t*)temp[3]) = *((u_int32_t*)(a+12)) ^ *((u_int32_t*)rk[ROUNDS][3]); 292 loop4(i);
220 293 break;
221 *((u_int32_t*)(b )) = *((u_int32_t*)T5[temp[0][0]]) 294
222 ^ *((u_int32_t*)T6[temp[3][1]]) 295 case 6: e_key[4] = io_swap(in_key[4]); t = e_key[5] = io_swap(in_key[5]);
223 ^ *((u_int32_t*)T7[temp[2][2]]) 296 for(i = 0; i < 8; ++i)
224 ^ *((u_int32_t*)T8[temp[1][3]]); 297 loop6(i);
225 *((u_int32_t*)(b+ 4)) = *((u_int32_t*)T5[temp[1][0]]) 298 break;
226 ^ *((u_int32_t*)T6[temp[0][1]]) 299
227 ^ *((u_int32_t*)T7[temp[3][2]]) 300 case 8: e_key[4] = io_swap(in_key[4]); e_key[5] = io_swap(in_key[5]);
228 ^ *((u_int32_t*)T8[temp[2][3]]); 301 e_key[6] = io_swap(in_key[6]); t = e_key[7] = io_swap(in_key[7]);
229 *((u_int32_t*)(b+ 8)) = *((u_int32_t*)T5[temp[2][0]]) 302 for(i = 0; i < 7; ++i)
230 ^ *((u_int32_t*)T6[temp[1][1]]) 303 loop8(i);
231 ^ *((u_int32_t*)T7[temp[0][2]]) 304 break;
232 ^ *((u_int32_t*)T8[temp[3][3]]); 305 }
233 *((u_int32_t*)(b+12)) = *((u_int32_t*)T5[temp[3][0]]) 306
234 ^ *((u_int32_t*)T6[temp[2][1]]) 307 if (!encrypt) {
235 ^ *((u_int32_t*)T7[temp[1][2]]) 308 d_key[0] = e_key[0]; d_key[1] = e_key[1];
236 ^ *((u_int32_t*)T8[temp[0][3]]); 309 d_key[2] = e_key[2]; d_key[3] = e_key[3];
237 for (r = ROUNDS-1; r > 1; r--) { 310
238 *((u_int32_t*)temp[0]) = *((u_int32_t*)(b )) ^ *((u_int32_t*)rk[r][0]); 311 for(i = 4; i < 4 * ctx->k_len + 24; ++i) {
239 *((u_int32_t*)temp[1]) = *((u_int32_t*)(b+ 4)) ^ *((u_int32_t*)rk[r][1]); 312 imix_col(d_key[i], e_key[i]);
240 *((u_int32_t*)temp[2]) = *((u_int32_t*)(b+ 8)) ^ *((u_int32_t*)rk[r][2]); 313 }
241 *((u_int32_t*)temp[3]) = *((u_int32_t*)(b+12)) ^ *((u_int32_t*)rk[r][3]);
242 *((u_int32_t*)(b )) = *((u_int32_t*)T5[temp[0][0]])
243 ^ *((u_int32_t*)T6[temp[3][1]])
244 ^ *((u_int32_t*)T7[temp[2][2]])
245 ^ *((u_int32_t*)T8[temp[1][3]]);
246 *((u_int32_t*)(b+ 4)) = *((u_int32_t*)T5[temp[1][0]])
247 ^ *((u_int32_t*)T6[temp[0][1]])
248 ^ *((u_int32_t*)T7[temp[3][2]])
249 ^ *((u_int32_t*)T8[temp[2][3]]);
250 *((u_int32_t*)(b+ 8)) = *((u_int32_t*)T5[temp[2][0]])
251 ^ *((u_int32_t*)T6[temp[1][1]])
252 ^ *((u_int32_t*)T7[temp[0][2]])
253 ^ *((u_int32_t*)T8[temp[3][3]]);
254 *((u_int32_t*)(b+12)) = *((u_int32_t*)T5[temp[3][0]])
255 ^ *((u_int32_t*)T6[temp[2][1]])
256 ^ *((u_int32_t*)T7[temp[1][2]])
257 ^ *((u_int32_t*)T8[temp[0][3]]);
258 } 314 }
259 /* last round is special */ 315
260 *((u_int32_t*)temp[0]) = *((u_int32_t*)(b )) ^ *((u_int32_t*)rk[1][0]); 316 return ctx;
261 *((u_int32_t*)temp[1]) = *((u_int32_t*)(b+ 4)) ^ *((u_int32_t*)rk[1][1]);
262 *((u_int32_t*)temp[2]) = *((u_int32_t*)(b+ 8)) ^ *((u_int32_t*)rk[1][2]);
263 *((u_int32_t*)temp[3]) = *((u_int32_t*)(b+12)) ^ *((u_int32_t*)rk[1][3]);
264 b[ 0] = S5[temp[0][0]];
265 b[ 1] = S5[temp[3][1]];
266 b[ 2] = S5[temp[2][2]];
267 b[ 3] = S5[temp[1][3]];
268 b[ 4] = S5[temp[1][0]];
269 b[ 5] = S5[temp[0][1]];
270 b[ 6] = S5[temp[3][2]];
271 b[ 7] = S5[temp[2][3]];
272 b[ 8] = S5[temp[2][0]];
273 b[ 9] = S5[temp[1][1]];
274 b[10] = S5[temp[0][2]];
275 b[11] = S5[temp[3][3]];
276 b[12] = S5[temp[3][0]];
277 b[13] = S5[temp[2][1]];
278 b[14] = S5[temp[1][2]];
279 b[15] = S5[temp[0][3]];
280 *((u_int32_t*)(b )) ^= *((u_int32_t*)rk[0][0]);
281 *((u_int32_t*)(b+ 4)) ^= *((u_int32_t*)rk[0][1]);
282 *((u_int32_t*)(b+ 8)) ^= *((u_int32_t*)rk[0][2]);
283 *((u_int32_t*)(b+12)) ^= *((u_int32_t*)rk[0][3]);
284
285 return 0;
286} 317}
287 318
288int 319/* encrypt a block of text */
289rijndael_makekey(rijndael_key *key, int direction, int keyLen, u_int8_t *keyMaterial) 320
290{ 321#define f_nround(bo, bi, k) \
291 u_int8_t k[RIJNDAEL_MAXKC][4]; 322 f_rn(bo, bi, 0, k); \
292 int i; 323 f_rn(bo, bi, 1, k); \
293 324 f_rn(bo, bi, 2, k); \
294 if (key == NULL) 325 f_rn(bo, bi, 3, k); \
295 return -1; 326 k += 4
296 if ((direction != RIJNDAEL_ENCRYPT) && (direction != RIJNDAEL_DECRYPT)) 327
297 return -1; 328#define f_lround(bo, bi, k) \
298 if ((keyLen != 128) && (keyLen != 192) && (keyLen != 256)) 329 f_rl(bo, bi, 0, k); \
299 return -1; 330 f_rl(bo, bi, 1, k); \
300 331 f_rl(bo, bi, 2, k); \
301 key->ROUNDS = keyLen/32 + 6; 332 f_rl(bo, bi, 3, k)
302 333
303 /* initialize key schedule: */ 334void
304 for (i = 0; i < keyLen/8; i++) 335rijndael_encrypt(rijndael_ctx *ctx, const u4byte *in_blk, u4byte *out_blk)
305 k[i >> 2][i & 3] = (u_int8_t)keyMaterial[i]; 336{
306 337 u4byte k_len = ctx->k_len;
307 rijndael_keysched(k, key->keySched, key->ROUNDS); 338 u4byte *e_key = ctx->e_key;
308 if (direction == RIJNDAEL_DECRYPT) 339 u4byte b0[4], b1[4], *kp;
309 rijndael_key_enc_to_dec(key->keySched, key->ROUNDS); 340
310 return 0; 341 b0[0] = io_swap(in_blk[0]) ^ e_key[0];
342 b0[1] = io_swap(in_blk[1]) ^ e_key[1];
343 b0[2] = io_swap(in_blk[2]) ^ e_key[2];
344 b0[3] = io_swap(in_blk[3]) ^ e_key[3];
345
346 kp = e_key + 4;
347
348 if(k_len > 6) {
349 f_nround(b1, b0, kp); f_nround(b0, b1, kp);
350 }
351
352 if(k_len > 4) {
353 f_nround(b1, b0, kp); f_nround(b0, b1, kp);
354 }
355
356 f_nround(b1, b0, kp); f_nround(b0, b1, kp);
357 f_nround(b1, b0, kp); f_nround(b0, b1, kp);
358 f_nround(b1, b0, kp); f_nround(b0, b1, kp);
359 f_nround(b1, b0, kp); f_nround(b0, b1, kp);
360 f_nround(b1, b0, kp); f_lround(b0, b1, kp);
361
362 out_blk[0] = io_swap(b0[0]); out_blk[1] = io_swap(b0[1]);
363 out_blk[2] = io_swap(b0[2]); out_blk[3] = io_swap(b0[3]);
364}
365
366/* decrypt a block of text */
367
368#define i_nround(bo, bi, k) \
369 i_rn(bo, bi, 0, k); \
370 i_rn(bo, bi, 1, k); \
371 i_rn(bo, bi, 2, k); \
372 i_rn(bo, bi, 3, k); \
373 k -= 4
374
375#define i_lround(bo, bi, k) \
376 i_rl(bo, bi, 0, k); \
377 i_rl(bo, bi, 1, k); \
378 i_rl(bo, bi, 2, k); \
379 i_rl(bo, bi, 3, k)
380
381void
382rijndael_decrypt(rijndael_ctx *ctx, const u4byte *in_blk, u4byte *out_blk)
383{
384 u4byte b0[4], b1[4], *kp;
385 u4byte k_len = ctx->k_len;
386 u4byte *e_key = ctx->e_key;
387 u4byte *d_key = ctx->d_key;
388
389 b0[0] = io_swap(in_blk[0]) ^ e_key[4 * k_len + 24];
390 b0[1] = io_swap(in_blk[1]) ^ e_key[4 * k_len + 25];
391 b0[2] = io_swap(in_blk[2]) ^ e_key[4 * k_len + 26];
392 b0[3] = io_swap(in_blk[3]) ^ e_key[4 * k_len + 27];
393
394 kp = d_key + 4 * (k_len + 5);
395
396 if(k_len > 6) {
397 i_nround(b1, b0, kp); i_nround(b0, b1, kp);
398 }
399
400 if(k_len > 4) {
401 i_nround(b1, b0, kp); i_nround(b0, b1, kp);
402 }
403
404 i_nround(b1, b0, kp); i_nround(b0, b1, kp);
405 i_nround(b1, b0, kp); i_nround(b0, b1, kp);
406 i_nround(b1, b0, kp); i_nround(b0, b1, kp);
407 i_nround(b1, b0, kp); i_nround(b0, b1, kp);
408 i_nround(b1, b0, kp); i_lround(b0, b1, kp);
409
410 out_blk[0] = io_swap(b0[0]); out_blk[1] = io_swap(b0[1]);
411 out_blk[2] = io_swap(b0[2]); out_blk[3] = io_swap(b0[3]);
311} 412}
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-02 11:26:50 +0000