]>
git.saurik.com Git - apple/bootx.git/blob - bootx.tproj/sl.subproj/aeskey.c
2 ---------------------------------------------------------------------------
3 Copyright (c) 2003, Dr Brian Gladman, Worcester, UK. All rights reserved.
7 The free distribution and use of this software in both source and binary
8 form is allowed (with or without changes) provided that:
10 1. distributions of this source code include the above copyright
11 notice, this list of conditions and the following disclaimer;
13 2. distributions in binary form include the above copyright
14 notice, this list of conditions and the following disclaimer
15 in the documentation and/or other associated materials;
17 3. the copyright holder's name is not used to endorse products
18 built using this software without specific written permission.
20 ALTERNATIVELY, provided that this notice is retained in full, this product
21 may be distributed under the terms of the GNU General Public License (GPL),
22 in which case the provisions of the GPL apply INSTEAD OF those given above.
26 This software is provided 'as is' with no explicit or implied warranties
27 in respect of its properties, including, but not limited to, correctness
28 and/or fitness for purpose.
29 ---------------------------------------------------------------------------
30 Issue Date: 26/08/2003
32 This file contains the code for implementing the key schedule for AES
33 (Rijndael) for block and key sizes of 16, 24, and 32 bytes. See aesopt.h
34 for further details including optimisation.
40 #if defined(__cplusplus)
45 /* Initialise the key schedule from the user supplied key. The key
46 length can be specified in bytes, with legal values of 16, 24
47 and 32, or in bits, with legal values of 128, 192 and 256. These
48 values correspond with Nk values of 4, 6 and 8 respectively.
50 The following macros implement a single cycle in the key
51 schedule generation process. The number of cycles needed
52 for each cx->n_col and nk value is:
55 ------------------------------
56 cx->n_col = 4 10 9 8 7 7
57 cx->n_col = 5 14 11 10 9 9
58 cx->n_col = 6 19 15 12 11 11
59 cx->n_col = 7 21 19 16 13 14
60 cx->n_col = 8 29 23 19 17 14
64 { k[4*(i)+4] = ss[0] ^= ls_box(ss[3],3) ^ t_use(r,c)[i]; k[4*(i)+5] = ss[1] ^= ss[0]; \
65 k[4*(i)+6] = ss[2] ^= ss[1]; k[4*(i)+7] = ss[3] ^= ss[2]; \
68 { k[4*(i)+4] = ss[0] ^= ls_box(ss[3],3) ^ t_use(r,c)[i]; k[4*(i)+5] = ss[1] ^= ss[0]; \
69 k[4*(i)+6] = ss[2] ^= ss[1]; k[4*(i)+7] = ss[3] ^= ss[2]; \
73 { k[6*(i)+ 6] = ss[0] ^= ls_box(ss[5],3) ^ t_use(r,c)[i]; k[6*(i)+ 7] = ss[1] ^= ss[0]; \
74 k[6*(i)+ 8] = ss[2] ^= ss[1]; k[6*(i)+ 9] = ss[3] ^= ss[2]; \
75 k[6*(i)+10] = ss[4] ^= ss[3]; k[6*(i)+11] = ss[5] ^= ss[4]; \
78 { k[6*(i)+ 6] = ss[0] ^= ls_box(ss[5],3) ^ t_use(r,c)[i]; k[6*(i)+ 7] = ss[1] ^= ss[0]; \
79 k[6*(i)+ 8] = ss[2] ^= ss[1]; k[6*(i)+ 9] = ss[3] ^= ss[2]; \
83 { k[8*(i)+ 8] = ss[0] ^= ls_box(ss[7],3) ^ t_use(r,c)[i]; k[8*(i)+ 9] = ss[1] ^= ss[0]; \
84 k[8*(i)+10] = ss[2] ^= ss[1]; k[8*(i)+11] = ss[3] ^= ss[2]; \
85 k[8*(i)+12] = ss[4] ^= ls_box(ss[3],0); k[8*(i)+13] = ss[5] ^= ss[4]; \
86 k[8*(i)+14] = ss[6] ^= ss[5]; k[8*(i)+15] = ss[7] ^= ss[6]; \
89 { k[8*(i)+ 8] = ss[0] ^= ls_box(ss[7],3) ^ t_use(r,c)[i]; k[8*(i)+ 9] = ss[1] ^= ss[0]; \
90 k[8*(i)+10] = ss[2] ^= ss[1]; k[8*(i)+11] = ss[3] ^= ss[2]; \
93 #if defined(ENCRYPTION_KEY_SCHEDULE)
95 #if defined(AES_128) || defined(AES_VAR)
97 aes_rval
aes_encrypt_key128(const unsigned char *key
, aes_encrypt_ctx cx
[1])
100 cx
->ks
[0] = ss
[0] = word_in(key
, 0);
101 cx
->ks
[1] = ss
[1] = word_in(key
, 1);
102 cx
->ks
[2] = ss
[2] = word_in(key
, 2);
103 cx
->ks
[3] = ss
[3] = word_in(key
, 3);
105 #if ENC_UNROLL == NONE
108 for(i
= 0; i
< ((11 * N_COLS
- 5) / 4); ++i
)
112 ke4(cx
->ks
, 0); ke4(cx
->ks
, 1);
113 ke4(cx
->ks
, 2); ke4(cx
->ks
, 3);
114 ke4(cx
->ks
, 4); ke4(cx
->ks
, 5);
115 ke4(cx
->ks
, 6); ke4(cx
->ks
, 7);
120 #if defined( AES_ERR_CHK )
127 #if defined(AES_192) || defined(AES_VAR)
129 aes_rval
aes_encrypt_key192(const unsigned char *key
, aes_encrypt_ctx cx
[1])
132 cx
->ks
[0] = ss
[0] = word_in(key
, 0);
133 cx
->ks
[1] = ss
[1] = word_in(key
, 1);
134 cx
->ks
[2] = ss
[2] = word_in(key
, 2);
135 cx
->ks
[3] = ss
[3] = word_in(key
, 3);
136 cx
->ks
[4] = ss
[4] = word_in(key
, 4);
137 cx
->ks
[5] = ss
[5] = word_in(key
, 5);
139 #if ENC_UNROLL == NONE
142 for(i
= 0; i
< (13 * N_COLS
- 7) / 6; ++i
)
146 ke6(cx
->ks
, 0); ke6(cx
->ks
, 1);
147 ke6(cx
->ks
, 2); ke6(cx
->ks
, 3);
148 ke6(cx
->ks
, 4); ke6(cx
->ks
, 5);
153 #if defined( AES_ERR_CHK )
160 #if defined(AES_256) || defined(AES_VAR)
162 aes_rval
aes_encrypt_key256(const unsigned char *key
, aes_encrypt_ctx cx
[1])
165 cx
->ks
[0] = ss
[0] = word_in(key
, 0);
166 cx
->ks
[1] = ss
[1] = word_in(key
, 1);
167 cx
->ks
[2] = ss
[2] = word_in(key
, 2);
168 cx
->ks
[3] = ss
[3] = word_in(key
, 3);
169 cx
->ks
[4] = ss
[4] = word_in(key
, 4);
170 cx
->ks
[5] = ss
[5] = word_in(key
, 5);
171 cx
->ks
[6] = ss
[6] = word_in(key
, 6);
172 cx
->ks
[7] = ss
[7] = word_in(key
, 7);
174 #if ENC_UNROLL == NONE
177 for(i
= 0; i
< (15 * N_COLS
- 9) / 8; ++i
)
181 ke8(cx
->ks
, 0); ke8(cx
->ks
, 1);
182 ke8(cx
->ks
, 2); ke8(cx
->ks
, 3);
183 ke8(cx
->ks
, 4); ke8(cx
->ks
, 5);
187 #if defined( AES_ERR_CHK )
196 aes_rval
aes_encrypt_key(const unsigned char *key
, int key_len
, aes_encrypt_ctx cx
[1])
200 #if defined( AES_ERR_CHK )
201 case 16: case 128: return aes_encrypt_key128(key
, cx
);
202 case 24: case 192: return aes_encrypt_key192(key
, cx
);
203 case 32: case 256: return aes_encrypt_key256(key
, cx
);
204 default: return aes_error
;
206 case 16: case 128: aes_encrypt_key128(key
, cx
); return;
207 case 24: case 192: aes_encrypt_key192(key
, cx
); return;
208 case 32: case 256: aes_encrypt_key256(key
, cx
); return;
217 #if defined(DECRYPTION_KEY_SCHEDULE)
219 #if DEC_ROUND == NO_TABLES
222 #define ff(x) inv_mcol(x)
223 #if defined( dec_imvars )
224 #define d_vars dec_imvars
230 { ss[0] = ss[0] ^ ss[2] ^ ss[1] ^ ss[3]; ss[1] = ss[1] ^ ss[3]; ss[2] = ss[2] ^ ss[3]; ss[3] = ss[3]; \
231 ss[4] = ls_box(ss[(i+3) % 4], 3) ^ t_use(r,c)[i]; ss[i % 4] ^= ss[4]; \
232 ss[4] ^= k[4*(i)]; k[4*(i)+4] = ff(ss[4]); ss[4] ^= k[4*(i)+1]; k[4*(i)+5] = ff(ss[4]); \
233 ss[4] ^= k[4*(i)+2]; k[4*(i)+6] = ff(ss[4]); ss[4] ^= k[4*(i)+3]; k[4*(i)+7] = ff(ss[4]); \
236 { ss[4] = ls_box(ss[(i+3) % 4], 3) ^ t_use(r,c)[i]; ss[i % 4] ^= ss[4]; ss[4] = ff(ss[4]); \
237 k[4*(i)+4] = ss[4] ^= k[4*(i)]; k[4*(i)+5] = ss[4] ^= k[4*(i)+1]; \
238 k[4*(i)+6] = ss[4] ^= k[4*(i)+2]; k[4*(i)+7] = ss[4] ^= k[4*(i)+3]; \
241 { ss[4] = ls_box(ss[(i+3) % 4], 3) ^ t_use(r,c)[i]; ss[i % 4] ^= ss[4]; \
242 k[4*(i)+4] = (ss[0] ^= ss[1]) ^ ss[2] ^ ss[3]; k[4*(i)+5] = ss[1] ^ ss[3]; \
243 k[4*(i)+6] = ss[0]; k[4*(i)+7] = ss[1]; \
247 { ss[0] ^= ls_box(ss[3],3) ^ t_use(r,c)[i]; k[4*(i)+ 4] = ff(ss[0]); ss[1] ^= ss[0]; k[4*(i)+ 5] = ff(ss[1]); \
248 ss[2] ^= ss[1]; k[4*(i)+ 6] = ff(ss[2]); ss[3] ^= ss[2]; k[4*(i)+ 7] = ff(ss[3]); \
251 { ss[4] = ls_box(ss[3],3) ^ t_use(r,c)[i]; \
252 ss[0] ^= ss[4]; ss[4] = ff(ss[4]); k[4*(i)+ 4] = ss[4] ^= k[4*(i)]; \
253 ss[1] ^= ss[0]; k[4*(i)+ 5] = ss[4] ^= k[4*(i)+ 1]; \
254 ss[2] ^= ss[1]; k[4*(i)+ 6] = ss[4] ^= k[4*(i)+ 2]; \
255 ss[3] ^= ss[2]; k[4*(i)+ 7] = ss[4] ^= k[4*(i)+ 3]; \
258 { ss[0] ^= ls_box(ss[3],3) ^ t_use(r,c)[i]; k[4*(i)+ 4] = ss[0]; ss[1] ^= ss[0]; k[4*(i)+ 5] = ss[1]; \
259 ss[2] ^= ss[1]; k[4*(i)+ 6] = ss[2]; ss[3] ^= ss[2]; k[4*(i)+ 7] = ss[3]; \
264 { ss[0] ^= ls_box(ss[5],3) ^ t_use(r,c)[i]; k[6*(i)+ 6] = ff(ss[0]); ss[1] ^= ss[0]; k[6*(i)+ 7] = ff(ss[1]); \
265 ss[2] ^= ss[1]; k[6*(i)+ 8] = ff(ss[2]); ss[3] ^= ss[2]; k[6*(i)+ 9] = ff(ss[3]); \
266 ss[4] ^= ss[3]; k[6*(i)+10] = ff(ss[4]); ss[5] ^= ss[4]; k[6*(i)+11] = ff(ss[5]); \
269 { ss[6] = ls_box(ss[5],3) ^ t_use(r,c)[i]; \
270 ss[0] ^= ss[6]; ss[6] = ff(ss[6]); k[6*(i)+ 6] = ss[6] ^= k[6*(i)]; \
271 ss[1] ^= ss[0]; k[6*(i)+ 7] = ss[6] ^= k[6*(i)+ 1]; \
272 ss[2] ^= ss[1]; k[6*(i)+ 8] = ss[6] ^= k[6*(i)+ 2]; \
273 ss[3] ^= ss[2]; k[6*(i)+ 9] = ss[6] ^= k[6*(i)+ 3]; \
274 ss[4] ^= ss[3]; k[6*(i)+10] = ss[6] ^= k[6*(i)+ 4]; \
275 ss[5] ^= ss[4]; k[6*(i)+11] = ss[6] ^= k[6*(i)+ 5]; \
278 { ss[0] ^= ls_box(ss[5],3) ^ t_use(r,c)[i]; k[6*(i)+ 6] = ss[0]; ss[1] ^= ss[0]; k[6*(i)+ 7] = ss[1]; \
279 ss[2] ^= ss[1]; k[6*(i)+ 8] = ss[2]; ss[3] ^= ss[2]; k[6*(i)+ 9] = ss[3]; \
283 { ss[0] ^= ls_box(ss[7],3) ^ t_use(r,c)[i]; k[8*(i)+ 8] = ff(ss[0]); ss[1] ^= ss[0]; k[8*(i)+ 9] = ff(ss[1]); \
284 ss[2] ^= ss[1]; k[8*(i)+10] = ff(ss[2]); ss[3] ^= ss[2]; k[8*(i)+11] = ff(ss[3]); \
285 ss[4] ^= ls_box(ss[3],0); k[8*(i)+12] = ff(ss[4]); ss[5] ^= ss[4]; k[8*(i)+13] = ff(ss[5]); \
286 ss[6] ^= ss[5]; k[8*(i)+14] = ff(ss[6]); ss[7] ^= ss[6]; k[8*(i)+15] = ff(ss[7]); \
289 { aes_32t g = ls_box(ss[7],3) ^ t_use(r,c)[i]; \
290 ss[0] ^= g; g = ff(g); k[8*(i)+ 8] = g ^= k[8*(i)]; \
291 ss[1] ^= ss[0]; k[8*(i)+ 9] = g ^= k[8*(i)+ 1]; \
292 ss[2] ^= ss[1]; k[8*(i)+10] = g ^= k[8*(i)+ 2]; \
293 ss[3] ^= ss[2]; k[8*(i)+11] = g ^= k[8*(i)+ 3]; \
294 g = ls_box(ss[3],0); \
295 ss[4] ^= g; g = ff(g); k[8*(i)+12] = g ^= k[8*(i)+ 4]; \
296 ss[5] ^= ss[4]; k[8*(i)+13] = g ^= k[8*(i)+ 5]; \
297 ss[6] ^= ss[5]; k[8*(i)+14] = g ^= k[8*(i)+ 6]; \
298 ss[7] ^= ss[6]; k[8*(i)+15] = g ^= k[8*(i)+ 7]; \
301 { ss[0] ^= ls_box(ss[7],3) ^ t_use(r,c)[i]; k[8*(i)+ 8] = ss[0]; ss[1] ^= ss[0]; k[8*(i)+ 9] = ss[1]; \
302 ss[2] ^= ss[1]; k[8*(i)+10] = ss[2]; ss[3] ^= ss[2]; k[8*(i)+11] = ss[3]; \
305 #if defined(AES_128) || defined(AES_VAR)
307 aes_rval
aes_decrypt_key128(const unsigned char *key
, aes_decrypt_ctx cx
[1])
309 #if defined( d_vars )
312 cx
->ks
[0] = ss
[0] = word_in(key
, 0);
313 cx
->ks
[1] = ss
[1] = word_in(key
, 1);
314 cx
->ks
[2] = ss
[2] = word_in(key
, 2);
315 cx
->ks
[3] = ss
[3] = word_in(key
, 3);
317 #if DEC_UNROLL == NONE
320 for(i
= 0; i
< (11 * N_COLS
- 5) / 4; ++i
)
323 #if !(DEC_ROUND == NO_TABLES)
324 for(i
= N_COLS
; i
< 10 * N_COLS
; ++i
)
325 cx
->ks
[i
] = inv_mcol(cx
->ks
[i
]);
329 kdf4(cx
->ks
, 0); kd4(cx
->ks
, 1);
330 kd4(cx
->ks
, 2); kd4(cx
->ks
, 3);
331 kd4(cx
->ks
, 4); kd4(cx
->ks
, 5);
332 kd4(cx
->ks
, 6); kd4(cx
->ks
, 7);
333 kd4(cx
->ks
, 8); kdl4(cx
->ks
, 9);
336 #if defined( AES_ERR_CHK )
343 #if defined(AES_192) || defined(AES_VAR)
345 aes_rval
aes_decrypt_key192(const unsigned char *key
, aes_decrypt_ctx cx
[1])
347 #if defined( d_vars )
350 cx
->ks
[0] = ss
[0] = word_in(key
, 0);
351 cx
->ks
[1] = ss
[1] = word_in(key
, 1);
352 cx
->ks
[2] = ss
[2] = word_in(key
, 2);
353 cx
->ks
[3] = ss
[3] = word_in(key
, 3);
355 #if DEC_UNROLL == NONE
356 cx
->ks
[4] = ss
[4] = word_in(key
, 4);
357 cx
->ks
[5] = ss
[5] = word_in(key
, 5);
360 for(i
= 0; i
< (13 * N_COLS
- 7) / 6; ++i
)
363 #if !(DEC_ROUND == NO_TABLES)
364 for(i
= N_COLS
; i
< 12 * N_COLS
; ++i
)
365 cx
->ks
[i
] = inv_mcol(cx
->ks
[i
]);
369 cx
->ks
[4] = ff(ss
[4] = word_in(key
, 4));
370 cx
->ks
[5] = ff(ss
[5] = word_in(key
, 5));
371 kdf6(cx
->ks
, 0); kd6(cx
->ks
, 1);
372 kd6(cx
->ks
, 2); kd6(cx
->ks
, 3);
373 kd6(cx
->ks
, 4); kd6(cx
->ks
, 5);
374 kd6(cx
->ks
, 6); kdl6(cx
->ks
, 7);
377 #if defined( AES_ERR_CHK )
384 #if defined(AES_256) || defined(AES_VAR)
386 aes_rval
aes_decrypt_key256(const unsigned char *key
, aes_decrypt_ctx cx
[1])
388 #if defined( d_vars )
391 cx
->ks
[0] = ss
[0] = word_in(key
, 0);
392 cx
->ks
[1] = ss
[1] = word_in(key
, 1);
393 cx
->ks
[2] = ss
[2] = word_in(key
, 2);
394 cx
->ks
[3] = ss
[3] = word_in(key
, 3);
396 #if DEC_UNROLL == NONE
397 cx
->ks
[4] = ss
[4] = word_in(key
, 4);
398 cx
->ks
[5] = ss
[5] = word_in(key
, 5);
399 cx
->ks
[6] = ss
[6] = word_in(key
, 6);
400 cx
->ks
[7] = ss
[7] = word_in(key
, 7);
403 for(i
= 0; i
< (15 * N_COLS
- 9) / 8; ++i
)
406 #if !(DEC_ROUND == NO_TABLES)
407 for(i
= N_COLS
; i
< 14 * N_COLS
; ++i
)
408 cx
->ks
[i
] = inv_mcol(cx
->ks
[i
]);
413 cx
->ks
[4] = ff(ss
[4] = word_in(key
, 4));
414 cx
->ks
[5] = ff(ss
[5] = word_in(key
, 5));
415 cx
->ks
[6] = ff(ss
[6] = word_in(key
, 6));
416 cx
->ks
[7] = ff(ss
[7] = word_in(key
, 7));
417 kdf8(cx
->ks
, 0); kd8(cx
->ks
, 1);
418 kd8(cx
->ks
, 2); kd8(cx
->ks
, 3);
419 kd8(cx
->ks
, 4); kd8(cx
->ks
, 5);
423 #if defined( AES_ERR_CHK )
432 aes_rval
aes_decrypt_key(const unsigned char *key
, int key_len
, aes_decrypt_ctx cx
[1])
436 #if defined( AES_ERR_CHK )
437 case 16: case 128: return aes_decrypt_key128(key
, cx
);
438 case 24: case 192: return aes_decrypt_key192(key
, cx
);
439 case 32: case 256: return aes_decrypt_key256(key
, cx
);
440 default: return aes_error
;
442 case 16: case 128: aes_decrypt_key128(key
, cx
); return;
443 case 24: case 192: aes_decrypt_key192(key
, cx
); return;
444 case 32: case 256: aes_decrypt_key256(key
, cx
); return;
453 #if defined(__cplusplus)