--- /dev/null
+/*
+ * Copyright (c) 2000-2001,2011-2012,2014 Apple Inc. All Rights Reserved.
+ *
+ * The contents of this file constitute Original Code as defined in and are
+ * subject to the Apple Public Source License Version 1.2 (the 'License').
+ * You may not use this file except in compliance with the License. Please obtain
+ * a copy of the License at http://www.apple.com/publicsource and read it before
+ * using this file.
+ *
+ * This Original Code and all software distributed under the License are
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS
+ * OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, INCLUDING WITHOUT
+ * LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
+ * PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. Please see the License for the
+ * specific language governing rights and limitations under the License.
+ */
+
+
+/* rijndael-alg-ref.c v2.0 August '99
+ * Reference ANSI C code
+ * authors: Paulo Barreto
+ * Vincent Rijmen
+ *
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "rijndael-alg-ref.h"
+#include <cspdebugging.h>
+
+#define SC ((BC - 4) >> 1)
+
+#include "boxes-ref.h"
+
+static const word8 shifts[3][4][2] = {
+ { { 0, 0 },
+ { 1, 3 },
+ { 2, 2 },
+ { 3, 1 }
+ },
+ { { 0, 0 },
+ { 1, 5 },
+ { 2, 4 },
+ { 3, 3 }
+ },
+ { { 0, 0 },
+ { 1, 7 },
+ { 3, 5 },
+ { 4, 4 }
+ }
+};
+
+#if !GLADMAN_AES_128_ENABLE
+
+/* 128 bit key/word shift table in bits */
+static const word8 shifts128[4][2] = {
+ { 0, 0 },
+ { 8, 24 },
+ { 16, 16 },
+ { 24, 8 }
+};
+
+#endif /* GLADMAN_AES_128_ENABLE */
+
+#if !AES_MUL_BY_LOOKUP
+/*
+ * Profiling measurements showed that the mul routine is where a large propertion of
+ * the time is spent. Since the first argument to mul is always one of six
+ * constants (2, 3, 0xe, etc.), we implement six 256x256 byte lookup tables to
+ * do the multiplies. This eliminates the need for the log/antilog tables, so
+ * it's only adding one kilobyte of const data. Throughput improvement for this
+ * mod is a factor of 3.3 for encrypt and 4.1 for decrypt in the 128-bit optimized
+ * case. Improvement for the general case (with a 256 bit key) is 1.46 for encrypt
+ * and 1.88 for decrypt. (Decrypt wins more for this enhancement because the
+ * InvMixColumn does four muls, vs. 2 muls for MixColumn). Measurements taken
+ * on a 500 MHz G4 with 1 MB of L2 cache.
+ */
+
+/*
+ * The mod 255 op in mul is really expensive...
+ *
+ * We know that b <= (254 * 2), so there are only two cases. Either return b,
+ * or return b-255.
+ *
+ * On a G4 this single optimization results in a 24% speedup for encrypt and
+ * a 25% speedup for decrypt.
+ */
+static inline word8 mod255(word32 b)
+{
+ if(b >= 255) {
+ b -= 255;
+ }
+ return b;
+}
+
+word8 mul(word8 a, word8 b) {
+ /* multiply two elements of GF(2^m)
+ * needed for MixColumn and InvMixColumn
+ */
+ if (a && b) return Alogtable[mod255(Logtable[a] + Logtable[b])];
+ else return 0;
+}
+#endif /* !AES_MUL_BY_LOOKUP */
+
+static
+void KeyAddition(word8 a[4][MAXBC], word8 rk[4][MAXBC], word8 BC) {
+ /* Exor corresponding text input and round key input bytes
+ */
+ int i, j;
+
+ for(i = 0; i < 4; i++)
+ for(j = 0; j < BC; j++) a[i][j] ^= rk[i][j];
+}
+
+static
+void ShiftRow(word8 a[4][MAXBC], word8 d, word8 BC) {
+ /* Row 0 remains unchanged
+ * The other three rows are shifted a variable amount
+ */
+ word8 tmp[MAXBC];
+ int i, j;
+
+ for(i = 1; i < 4; i++) {
+ for(j = 0; j < BC; j++) tmp[j] = a[i][(j + shifts[SC][i][d]) % BC];
+ for(j = 0; j < BC; j++) a[i][j] = tmp[j];
+ }
+}
+
+static
+void Substitution(word8 a[4][MAXBC], const word8 box[256], word8 BC) {
+ /* Replace every byte of the input by the byte at that place
+ * in the nonlinear S-box
+ */
+ int i, j;
+
+ for(i = 0; i < 4; i++)
+ for(j = 0; j < BC; j++) a[i][j] = box[a[i][j]] ;
+}
+
+static
+void MixColumn(word8 a[4][MAXBC], word8 BC) {
+ /* Mix the four bytes of every column in a linear way
+ */
+ word8 b[4][MAXBC];
+ int i, j;
+
+ for(j = 0; j < BC; j++) {
+ for(i = 0; i < 4; i++) {
+ #if AES_MUL_BY_LOOKUP
+ b[i][j] = mulBy0x02[a[i][j]]
+ ^ mulBy0x03[a[(i + 1) % 4][j]]
+ ^ a[(i + 2) % 4][j]
+ ^ a[(i + 3) % 4][j];
+ #else
+ b[i][j] = mul(2,a[i][j])
+ ^ mul(3,a[(i + 1) % 4][j])
+ ^ a[(i + 2) % 4][j]
+ ^ a[(i + 3) % 4][j];
+ #endif
+ }
+ }
+ for(i = 0; i < 4; i++) {
+ for(j = 0; j < BC; j++) a[i][j] = b[i][j];
+ }
+}
+
+static
+void InvMixColumn(word8 a[4][MAXBC], word8 BC) {
+ /* Mix the four bytes of every column in a linear way
+ * This is the opposite operation of Mixcolumn
+ */
+ word8 b[4][MAXBC];
+ int i, j;
+
+ for(j = 0; j < BC; j++) {
+ for(i = 0; i < 4; i++) {
+ #if AES_MUL_BY_LOOKUP
+ b[i][j] = mulBy0x0e[a[i][j]]
+ ^ mulBy0x0b[a[(i + 1) % 4][j]]
+ ^ mulBy0x0d[a[(i + 2) % 4][j]]
+ ^ mulBy0x09[a[(i + 3) % 4][j]];
+ #else
+ b[i][j] = mul(0xe,a[i][j])
+ ^ mul(0xb,a[(i + 1) % 4][j])
+ ^ mul(0xd,a[(i + 2) % 4][j])
+ ^ mul(0x9,a[(i + 3) % 4][j]);
+ #endif
+ }
+ }
+ for(i = 0; i < 4; i++) {
+ for(j = 0; j < BC; j++) a[i][j] = b[i][j];
+ }
+}
+
+int rijndaelKeySched (
+ word8 k[4][MAXKC],
+ int keyBits,
+ int blockBits,
+ word8 W[MAXROUNDS+1][4][MAXBC]) {
+
+ /* Calculate the necessary round keys
+ * The number of calculations depends on keyBits and blockBits
+ */
+ int KC, BC, ROUNDS;
+ int i, j, t, rconpointer = 0;
+ word8 tk[4][MAXKC];
+
+ switch (keyBits) {
+ case 128: KC = 4; break;
+ case 192: KC = 6; break;
+ case 256: KC = 8; break;
+ default : return (-1);
+ }
+
+ switch (blockBits) {
+ case 128: BC = 4; break;
+ case 192: BC = 6; break;
+ case 256: BC = 8; break;
+ default : return (-2);
+ }
+
+ switch (keyBits >= blockBits ? keyBits : blockBits) {
+ case 128: ROUNDS = 10; break;
+ case 192: ROUNDS = 12; break;
+ case 256: ROUNDS = 14; break;
+ default : return (-3); /* this cannot happen */
+ }
+
+
+ for(j = 0; j < KC; j++)
+ for(i = 0; i < 4; i++)
+ tk[i][j] = k[i][j];
+ t = 0;
+ /* copy values into round key array */
+ for(j = 0; (j < KC) && (t < (ROUNDS+1)*BC); j++, t++)
+ for(i = 0; i < 4; i++) W[t / BC][i][t % BC] = tk[i][j];
+
+ while (t < (ROUNDS+1)*BC) { /* while not enough round key material calculated */
+ /* calculate new values */
+ for(i = 0; i < 4; i++)
+ tk[i][0] ^= S[tk[(i+1)%4][KC-1]];
+ tk[0][0] ^= rcon[rconpointer++];
+
+ if (KC != 8)
+ for(j = 1; j < KC; j++)
+ for(i = 0; i < 4; i++) tk[i][j] ^= tk[i][j-1];
+ else {
+ for(j = 1; j < KC/2; j++)
+ for(i = 0; i < 4; i++) tk[i][j] ^= tk[i][j-1];
+ for(i = 0; i < 4; i++) tk[i][KC/2] ^= S[tk[i][KC/2 - 1]];
+ for(j = KC/2 + 1; j < KC; j++)
+ for(i = 0; i < 4; i++) tk[i][j] ^= tk[i][j-1];
+ }
+ /* copy values into round key array */
+ for(j = 0; (j < KC) && (t < (ROUNDS+1)*BC); j++, t++)
+ for(i = 0; i < 4; i++) W[t / BC][i][t % BC] = tk[i][j];
+ }
+
+ return 0;
+}
+
+int rijndaelEncrypt (
+ word8 a[4][MAXBC],
+ int keyBits,
+ int blockBits,
+ word8 rk[MAXROUNDS+1][4][MAXBC])
+{
+ /* Encryption of one block, general case.
+ */
+ int r, BC, ROUNDS;
+
+ switch (blockBits) {
+ case 128: BC = 4; break;
+ case 192: BC = 6; break;
+ case 256: BC = 8; break;
+ default : return (-2);
+ }
+
+ switch (keyBits >= blockBits ? keyBits : blockBits) {
+ case 128: ROUNDS = 10; break;
+ case 192: ROUNDS = 12; break;
+ case 256: ROUNDS = 14; break;
+ default : return (-3); /* this cannot happen */
+ }
+
+ /* begin with a key addition
+ */
+ KeyAddition(a,rk[0],BC);
+
+ /* ROUNDS-1 ordinary rounds
+ */
+ for(r = 1; r < ROUNDS; r++) {
+ Substitution(a,S,BC);
+ ShiftRow(a,0,BC);
+ MixColumn(a,BC);
+ KeyAddition(a,rk[r],BC);
+ }
+
+ /* Last round is special: there is no MixColumn
+ */
+ Substitution(a,S,BC);
+ ShiftRow(a,0,BC);
+ KeyAddition(a,rk[ROUNDS],BC);
+
+ return 0;
+}
+
+int rijndaelDecrypt (
+ word8 a[4][MAXBC],
+ int keyBits,
+ int blockBits,
+ word8 rk[MAXROUNDS+1][4][MAXBC])
+{
+ int r, BC, ROUNDS;
+
+ switch (blockBits) {
+ case 128: BC = 4; break;
+ case 192: BC = 6; break;
+ case 256: BC = 8; break;
+ default : return (-2);
+ }
+
+ switch (keyBits >= blockBits ? keyBits : blockBits) {
+ case 128: ROUNDS = 10; break;
+ case 192: ROUNDS = 12; break;
+ case 256: ROUNDS = 14; break;
+ default : return (-3); /* this cannot happen */
+ }
+
+ /* To decrypt: apply the inverse operations of the encrypt routine,
+ * in opposite order
+ *
+ * (KeyAddition is an involution: it 's equal to its inverse)
+ * (the inverse of Substitution with table S is Substitution with the
+ * inverse table of S)
+ * (the inverse of Shiftrow is Shiftrow over a suitable distance)
+ */
+
+ /* First the special round:
+ * without InvMixColumn
+ * with extra KeyAddition
+ */
+ KeyAddition(a,rk[ROUNDS],BC);
+ Substitution(a,Si,BC);
+ ShiftRow(a,1,BC);
+
+ /* ROUNDS-1 ordinary rounds
+ */
+ for(r = ROUNDS-1; r > 0; r--) {
+ KeyAddition(a,rk[r],BC);
+ InvMixColumn(a,BC);
+ Substitution(a,Si,BC);
+ ShiftRow(a,1,BC);
+ }
+
+ /* End with the extra key addition
+ */
+
+ KeyAddition(a,rk[0],BC);
+
+ return 0;
+}
+
+#if !GLADMAN_AES_128_ENABLE
+
+/*
+ * All of these 128-bit-key-and-block routines require 32-bit word-aligned
+ * char array pointers.ÊThe key schedule arrays are easy; they come from
+ * keyInstance which has a 4-byte-aligned element preceeding the key schedule.
+ * Others require manual alignment of a local variable by the caller.
+ */
+
+static inline void KeyAddition128(
+ word8 a[4][BC_128_OPT],
+ word8 rk[4][MAXBC]) {
+
+ /* these casts are endian-independent */
+ ((word32 *)a)[0] ^= *((word32 *)(&rk[0]));
+ ((word32 *)a)[1] ^= *((word32 *)(&rk[1]));
+ ((word32 *)a)[2] ^= *((word32 *)(&rk[2]));
+ ((word32 *)a)[3] ^= *((word32 *)(&rk[3]));
+}
+
+static void Substitution128(
+ word8 a[4][BC_128_OPT],
+ const word8 box[256]) {
+ /* Replace every byte of the input by the byte at that place
+ * in the nonlinear S-box
+ */
+ int i, j;
+
+ /* still to be optimized - larger S boxes? */
+ for(i = 0; i < 4; i++) {
+ for(j = 0; j < BC_128_OPT; j++) {
+ a[i][j] = box[a[i][j]];
+ }
+ }
+}
+
+#if defined(__ppc__) && defined(__GNUC__)
+
+static inline void rotateWordLeft(
+ word8 *word, // known to be word aligned
+ unsigned rotCount) // in bits
+{
+ word32 lword = *((word32 *)word);
+ asm("rlwnm %0,%1,%2,0,31" : "=r"(lword) : "0"(lword), "r"(rotCount));
+ *((word32 *)word) = lword;
+}
+
+#else
+
+/*
+ * Insert your machine/compiler dependent code here,
+ * or just use this, which works on any platform and compiler
+ * which supports the __attribute__((aligned(4))) directive.
+ */
+static void rotateWordLeft(
+ word8 *word, // known to be word aligned
+ unsigned rotCount) // in bits
+{
+ word8 tmp[BC_128_OPT] __attribute__((aligned(4)));
+ unsigned bytes = rotCount / 8;
+
+ tmp[0] = word[bytes & (BC_128_OPT-1)];
+ tmp[1] = word[(1+bytes) & (BC_128_OPT-1)];
+ tmp[2] = word[(2+bytes) & (BC_128_OPT-1)];
+ tmp[3] = word[(3+bytes) & (BC_128_OPT-1)];
+ *((word32 *)word) = *((word32 *)tmp);
+}
+#endif
+
+static inline void ShiftRow128(
+ word8 a[4][BC_128_OPT],
+ word8 d) {
+ /* Row 0 remains unchanged
+ * The other three rows are shifted (actually rotated) a variable amount
+ */
+ int i;
+
+ for(i = 1; i < 4; i++) {
+ rotateWordLeft(a[i], shifts128[i][d]);
+ }
+}
+
+/*
+ * The following two routines are where most of the time is spent in this
+ * module. Further optimization would have to focus here.
+ */
+static void MixColumn128(word8 a[4][BC_128_OPT]) {
+ /* Mix the four bytes of every column in a linear way
+ */
+ word8 b[4][BC_128_OPT];
+ int i, j;
+
+ for(j = 0; j < BC_128_OPT; j++) {
+ for(i = 0; i < 4; i++) {
+ #if AES_MUL_BY_LOOKUP
+ b[i][j] = mulBy0x02[a[i][j]]
+ ^ mulBy0x03[a[(i + 1) % 4][j]]
+ ^ a[(i + 2) % 4][j]
+ ^ a[(i + 3) % 4][j];
+ #else
+ b[i][j] = mul(2,a[i][j])
+ ^ mul(3,a[(i + 1) % 4][j])
+ ^ a[(i + 2) % 4][j]
+ ^ a[(i + 3) % 4][j];
+ #endif
+ }
+ }
+ memmove(a, b, 4 * BC_128_OPT);
+}
+
+static void InvMixColumn128(word8 a[4][BC_128_OPT]) {
+ /* Mix the four bytes of every column in a linear way
+ * This is the opposite operation of Mixcolumn
+ */
+ word8 b[4][BC_128_OPT];
+ int i, j;
+
+ for(j = 0; j < BC_128_OPT; j++) {
+ for(i = 0; i < 4; i++) {
+ #if AES_MUL_BY_LOOKUP
+ b[i][j] = mulBy0x0e[a[i][j]]
+ ^ mulBy0x0b[a[(i + 1) % 4][j]]
+ ^ mulBy0x0d[a[(i + 2) % 4][j]]
+ ^ mulBy0x09[a[(i + 3) % 4][j]];
+ #else
+ b[i][j] = mul(0xe,a[i][j])
+ ^ mul(0xb,a[(i + 1) % 4][j])
+ ^ mul(0xd,a[(i + 2) % 4][j])
+ ^ mul(0x9,a[(i + 3) % 4][j]);
+ #endif
+ }
+ }
+ memmove(a, b, 4 * BC_128_OPT);
+}
+
+int rijndaelKeySched128 (
+ word8 k[4][KC_128_OPT],
+ word8 W[MAXROUNDS+1][4][MAXBC]) {
+
+ /* Calculate the necessary round keys
+ * The number of calculations depends on keyBits and blockBits
+ */
+ int i, j, t, rconpointer = 0;
+ word8 tk[4][KC_128_OPT];
+ unsigned numSchedRows = (ROUNDS_128_OPT + 1) * BC_128_OPT;
+
+ for(j = 0; j < KC_128_OPT; j++)
+ for(i = 0; i < 4; i++)
+ tk[i][j] = k[i][j];
+ t = 0;
+ /* copy values into round key array */
+ for(j = 0; (j < KC_128_OPT) && (t < numSchedRows); j++, t++) {
+ for(i = 0; i < 4; i++) {
+ W[t / BC_128_OPT][i][t % BC_128_OPT] = tk[i][j];
+ }
+ }
+
+ while (t < numSchedRows) {
+ /* while not enough round key material calculated */
+ /* calculate new values */
+ for(i = 0; i < 4; i++) {
+ tk[i][0] ^= S[tk[(i+1)%4][KC_128_OPT-1]];
+ }
+ tk[0][0] ^= rcon[rconpointer++];
+
+ for(j = 1; j < KC_128_OPT; j++) {
+ for(i = 0; i < 4; i++) {
+ tk[i][j] ^= tk[i][j-1];
+ }
+ }
+
+ /* copy values into round key array */
+ for(j = 0; (j < KC_128_OPT) && (t < numSchedRows); j++, t++) {
+ for(i = 0; i < 4; i++) {
+ W[t / BC_128_OPT][i][t % BC_128_OPT] = tk[i][j];
+ }
+ }
+ }
+
+ return 0;
+}
+
+int rijndaelEncrypt128 (
+ word8 a[4][BC_128_OPT],
+ word8 rk[MAXROUNDS+1][4][MAXBC])
+{
+ /* Encryption of one block.
+ */
+ int r;
+
+ /* begin with a key addition
+ */
+ KeyAddition128(a,rk[0]);
+
+ /* ROUNDS-1 ordinary rounds
+ */
+ for(r = 1; r < ROUNDS_128_OPT; r++) {
+ Substitution128(a,S);
+ ShiftRow128(a,0);
+ MixColumn128(a);
+ KeyAddition128(a,rk[r]);
+ }
+
+ /* Last round is special: there is no MixColumn
+ */
+ Substitution128(a,S);
+ ShiftRow128(a,0);
+ KeyAddition128(a,rk[ROUNDS_128_OPT]);
+
+ return 0;
+}
+
+int rijndaelDecrypt128 (
+ word8 a[4][BC_128_OPT],
+ word8 rk[MAXROUNDS+1][4][MAXBC])
+{
+ int r;
+
+ /* To decrypt: apply the inverse operations of the encrypt routine,
+ * in opposite order
+ *
+ * (KeyAddition is an involution: it 's equal to its inverse)
+ * (the inverse of Substitution with table S is Substitution with the
+ * inverse table of S)
+ * (the inverse of Shiftrow is Shiftrow over a suitable distance)
+ */
+
+ /* First the special round:
+ * without InvMixColumn
+ * with extra KeyAddition
+ */
+ KeyAddition128(a,rk[ROUNDS_128_OPT]);
+ Substitution128(a,Si);
+ ShiftRow128(a,1);
+
+ /* ROUNDS-1 ordinary rounds
+ */
+ for(r = ROUNDS_128_OPT-1; r > 0; r--) {
+ KeyAddition128(a,rk[r]);
+ InvMixColumn128(a);
+ Substitution128(a,Si);
+ ShiftRow128(a,1);
+ }
+
+ /* End with the extra key addition
+ */
+
+ KeyAddition128(a,rk[0]);
+
+ return 0;
+}
+
+#endif /* !GLADMAN_AES_128_ENABLE */
+
projects / apple / security.git / blobdiff