projects / apple / xnu.git / blame
| Commit | Line | Data |
|---|---|---|
| 13fec989 A |
1 | /* |
| 2 | --------------------------------------------------------------------------- | |
| 3 | Copyright (c) 2003, Dr Brian Gladman, Worcester, UK. All rights reserved. | |
| 4 | ||
| 5 | LICENSE TERMS | |
| 6 | ||
| 7 | The free distribution and use of this software in both source and binary | |
| 8 | form is allowed (with or without changes) provided that: | |
| 9 | ||
| 10 | 1. distributions of this source code include the above copyright | |
| 11 | notice, this list of conditions and the following disclaimer; | |
| 12 | ||
| 13 | 2. distributions in binary form include the above copyright | |
| 14 | notice, this list of conditions and the following disclaimer | |
| 15 | in the documentation and/or other associated materials; | |
| 16 | ||
| 17 | 3. the copyright holder's name is not used to endorse products | |
| 18 | built using this software without specific written permission. | |
| 19 | ||
| 20 | ALTERNATIVELY, provided that this notice is retained in full, this product | |
| 21 | may be distributed under the terms of the GNU General Public License (GPL), | |
| 22 | in which case the provisions of the GPL apply INSTEAD OF those given above. | |
| 23 | ||
| 24 | DISCLAIMER | |
| 25 | ||
| 26 | This software is provided 'as is' with no explicit or implied warranties | |
| 27 | in respect of its properties, including, but not limited to, correctness | |
| 28 | and/or fitness for purpose. | |
| 29 | --------------------------------------------------------------------------- | |
| 30 | Issue 28/01/2004 | |
| 31 | ||
| 32 | My thanks go to Dag Arne Osvik for devising the schemes used here for key | |
| 33 | length derivation from the form of the key schedule | |
| 34 | ||
| 35 | This file contains the compilation options for AES (Rijndael) and code | |
| 36 | that is common across encryption, key scheduling and table generation. | |
| 37 | ||
| 38 | OPERATION | |
| 39 | ||
| 40 | These source code files implement the AES algorithm Rijndael designed by | |
| 41 | Joan Daemen and Vincent Rijmen. This version is designed for the standard | |
| 42 | block size of 16 bytes and for key sizes of 128, 192 and 256 bits (16, 24 | |
| 43 | and 32 bytes). | |
| 44 | ||
| 45 | This version is designed for flexibility and speed using operations on | |
| 46 | 32-bit words rather than operations on bytes. It can be compiled with | |
| 47 | either big or little endian internal byte order but is faster when the | |
| 48 | native byte order for the processor is used. | |
| 49 | ||
| 50 | THE CIPHER INTERFACE | |
| 51 | ||
| 52 | The cipher interface is implemented as an array of bytes in which lower | |
| 53 | AES bit sequence indexes map to higher numeric significance within bytes. | |
| 54 | ||
| 55 | aes_08t (an unsigned 8-bit type) | |
| 56 | aes_32t (an unsigned 32-bit type) | |
| 57 | struct aes_encrypt_ctx (structure for the cipher encryption context) | |
| 58 | struct aes_decrypt_ctx (structure for the cipher decryption context) | |
| 59 | aes_rval the function return type | |
| 60 | ||
| 61 | C subroutine calls: | |
| 62 | ||
| 63 | aes_rval aes_encrypt_key128(const unsigned char *key, aes_encrypt_ctx cx[1]); | |
| 64 | aes_rval aes_encrypt_key192(const unsigned char *key, aes_encrypt_ctx cx[1]); | |
| 65 | aes_rval aes_encrypt_key256(const unsigned char *key, aes_encrypt_ctx cx[1]); | |
| 66 | aes_rval aes_encrypt(const unsigned char *in, unsigned char *out, | |
| 67 | const aes_encrypt_ctx cx[1]); | |
| 68 | ||
| 69 | aes_rval aes_decrypt_key128(const unsigned char *key, aes_decrypt_ctx cx[1]); | |
| 70 | aes_rval aes_decrypt_key192(const unsigned char *key, aes_decrypt_ctx cx[1]); | |
| 71 | aes_rval aes_decrypt_key256(const unsigned char *key, aes_decrypt_ctx cx[1]); | |
| 72 | aes_rval aes_decrypt(const unsigned char *in, unsigned char *out, | |
| 73 | const aes_decrypt_ctx cx[1]); | |
| 74 | ||
| 75 | IMPORTANT NOTE: If you are using this C interface with dynamic tables make sure that | |
| 76 | you call genTabs() before AES is used so that the tables are initialised. | |
| 77 | ||
| 78 | C++ aes class subroutines: | |
| 79 | ||
| 80 | Class AESencrypt for encryption | |
| 81 | ||
| 82 | Construtors: | |
| 83 | AESencrypt(void) | |
| 84 | AESencrypt(const unsigned char *key) - 128 bit key | |
| 85 | Members: | |
| 86 | aes_rval key128(const unsigned char *key) | |
| 87 | aes_rval key192(const unsigned char *key) | |
| 88 | aes_rval key256(const unsigned char *key) | |
| 89 | aes_rval encrypt(const unsigned char *in, unsigned char *out) const | |
| 90 | ||
| 91 | Class AESdecrypt for encryption | |
| 92 | Construtors: | |
| 93 | AESdecrypt(void) | |
| 94 | AESdecrypt(const unsigned char *key) - 128 bit key | |
| 95 | Members: | |
| 96 | aes_rval key128(const unsigned char *key) | |
| 97 | aes_rval key192(const unsigned char *key) | |
| 98 | aes_rval key256(const unsigned char *key) | |
| 99 | aes_rval decrypt(const unsigned char *in, unsigned char *out) const | |
| 100 | ||
| 101 | COMPILATION | |
| 102 | ||
| 103 | The files used to provide AES (Rijndael) are | |
| 104 | ||
| 105 | a. aes.h for the definitions needed for use in C. | |
| 106 | b. aescpp.h for the definitions needed for use in C++. | |
| 107 | c. aesopt.h for setting compilation options (also includes common code). | |
| 108 | d. aescrypt.c for encryption and decrytpion, or | |
| 109 | e. aeskey.c for key scheduling. | |
| 110 | f. aestab.c for table loading or generation. | |
| 111 | g. aescrypt.asm for encryption and decryption using assembler code. | |
| 112 | h. aescrypt.mmx.asm for encryption and decryption using MMX assembler. | |
| 113 | ||
| 114 | To compile AES (Rijndael) for use in C code use aes.h and set the | |
| 115 | defines here for the facilities you need (key lengths, encryption | |
| 116 | and/or decryption). Do not define AES_DLL or AES_CPP. Set the options | |
| 117 | for optimisations and table sizes here. | |
| 118 | ||
| 119 | To compile AES (Rijndael) for use in in C++ code use aescpp.h but do | |
| 120 | not define AES_DLL | |
| 121 | ||
| 122 | To compile AES (Rijndael) in C as a Dynamic Link Library DLL) use | |
| 123 | aes.h and include the AES_DLL define. | |
| 124 | ||
| 125 | CONFIGURATION OPTIONS (here and in aes.h) | |
| 126 | ||
| 127 | a. set AES_DLL in aes.h if AES (Rijndael) is to be compiled as a DLL | |
| 128 | b. You may need to set PLATFORM_BYTE_ORDER to define the byte order. | |
| 129 | c. If you want the code to run in a specific internal byte order, then | |
| 130 | ALGORITHM_BYTE_ORDER must be set accordingly. | |
| 131 | d. set other configuration options decribed below. | |
| 132 | */ | |
| 133 | ||
| 134 | #if !defined( _AESOPT_H ) | |
| 135 | #define _AESOPT_H | |
| 136 | ||
| 137 | #include "aes.h" | |
| 138 | ||
| 139 | /* CONFIGURATION - USE OF DEFINES | |
| 140 | ||
| 141 | Later in this section there are a number of defines that control the | |
| 142 | operation of the code. In each section, the purpose of each define is | |
| 143 | explained so that the relevant form can be included or excluded by | |
| 144 | setting either 1's or 0's respectively on the branches of the related | |
| 145 | #if clauses. | |
| 146 | ||
| 147 | PLATFORM SPECIFIC INCLUDES AND BYTE ORDER IN 32-BIT WORDS | |
| 148 | ||
| 149 | To obtain the highest speed on processors with 32-bit words, this code | |
| 150 | needs to determine the byte order of the target machine. The following | |
| 151 | block of code is an attempt to capture the most obvious ways in which | |
| 152 | various environemnts define byte order. It may well fail, in which case | |
| 153 | the definitions will need to be set by editing at the points marked | |
| 154 | **** EDIT HERE IF NECESSARY **** below. My thanks go to Peter Gutmann | |
| 155 | for his assistance with this endian detection nightmare. | |
| 156 | */ | |
| 157 | ||
| 158 | #define BRG_LITTLE_ENDIAN 1234 /* byte 0 is least significant (i386) */ | |
| 159 | #define BRG_BIG_ENDIAN 4321 /* byte 0 is most significant (mc68k) */ | |
| 160 | ||
| 161 | #if defined(__GNUC__) || defined(__GNU_LIBRARY__) | |
| 162 | # if defined(__FreeBSD__) || defined(__OpenBSD__) | |
| 163 | # include <sys/endian.h> | |
| 164 | # elif defined( BSD ) && BSD >= 199103 | |
| 165 | # include <machine/endian.h> | |
| 166 | # elif defined(__APPLE__) | |
| 167 | # if defined(__BIG_ENDIAN__) && !defined( BIG_ENDIAN ) | |
| 168 | # define BIG_ENDIAN | |
| 169 | # elif defined(__LITTLE_ENDIAN__) && !defined( LITTLE_ENDIAN ) | |
| 170 | # define LITTLE_ENDIAN | |
| 171 | # endif | |
| 172 | # else | |
| 173 | # include <endian.h> | |
| 174 | # if defined(__BEOS__) | |
| 175 | # include <byteswap.h> | |
| 176 | # endif | |
| 177 | # endif | |
| 178 | #endif | |
| 179 | ||
| 180 | #if !defined(PLATFORM_BYTE_ORDER) | |
| 181 | # if defined(LITTLE_ENDIAN) || defined(BIG_ENDIAN) | |
| 182 | # if defined(LITTLE_ENDIAN) && !defined(BIG_ENDIAN) | |
| 183 | # define PLATFORM_BYTE_ORDER BRG_LITTLE_ENDIAN | |
| 184 | # elif !defined(LITTLE_ENDIAN) && defined(BIG_ENDIAN) | |
| 185 | # define PLATFORM_BYTE_ORDER BRG_BIG_ENDIAN | |
| 186 | # elif defined(BYTE_ORDER) && (BYTE_ORDER == LITTLE_ENDIAN) | |
| 187 | # define PLATFORM_BYTE_ORDER BRG_LITTLE_ENDIAN | |
| 188 | # elif defined(BYTE_ORDER) && (BYTE_ORDER == BIG_ENDIAN) | |
| 189 | # define PLATFORM_BYTE_ORDER BRG_BIG_ENDIAN | |
| 190 | # endif | |
| 191 | # elif defined(_LITTLE_ENDIAN) || defined(_BIG_ENDIAN) | |
| 192 | # if defined(_LITTLE_ENDIAN) && !defined(_BIG_ENDIAN) | |
| 193 | # define PLATFORM_BYTE_ORDER BRG_LITTLE_ENDIAN | |
| 194 | # elif !defined(_LITTLE_ENDIAN) && defined(_BIG_ENDIAN) | |
| 195 | # define PLATFORM_BYTE_ORDER BRG_BIG_ENDIAN | |
| 196 | # elif defined(_BYTE_ORDER) && (_BYTE_ORDER == _LITTLE_ENDIAN) | |
| 197 | # define PLATFORM_BYTE_ORDER BRG_LITTLE_ENDIAN | |
| 198 | # elif defined(_BYTE_ORDER) && (_BYTE_ORDER == _BIG_ENDIAN) | |
| 199 | # define PLATFORM_BYTE_ORDER BRG_BIG_ENDIAN | |
| 200 | # endif | |
| 201 | # elif defined(__LITTLE_ENDIAN__) || defined(__BIG_ENDIAN__) | |
| 202 | # if defined(__LITTLE_ENDIAN__) && !defined(__BIG_ENDIAN__) | |
| 203 | # define PLATFORM_BYTE_ORDER BRG_LITTLE_ENDIAN | |
| 204 | # elif !defined(__LITTLE_ENDIAN__) && defined(__BIG_ENDIAN__) | |
| 205 | # define PLATFORM_BYTE_ORDER BRG_BIG_ENDIAN | |
| 206 | # elif defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __LITTLE_ENDIAN__) | |
| 207 | # define PLATFORM_BYTE_ORDER BRG_LITTLE_ENDIAN | |
| 208 | # elif defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __BIG_ENDIAN__) | |
| 209 | # define PLATFORM_BYTE_ORDER BRG_BIG_ENDIAN | |
| 210 | # endif | |
| 211 | # endif | |
| 212 | #endif | |
| 213 | ||
| 214 | /* if the platform is still unknown, try to find its byte order */ | |
| 215 | /* from commonly used machine defines */ | |
| 216 | ||
| 217 | #if !defined(PLATFORM_BYTE_ORDER) | |
| 218 | ||
| 219 | #if defined( __alpha__ ) || defined( __alpha ) || defined( i386 ) || \ | |
| 220 | defined( __i386__ ) || defined( _M_I86 ) || defined( _M_IX86 ) || \ | |
| 221 | defined( __OS2__ ) || defined( sun386 ) || defined( __TURBOC__ ) || \ | |
| 222 | defined( vax ) || defined( vms ) || defined( VMS ) || \ | |
| 223 | defined( __VMS ) | |
| 224 | # define PLATFORM_BYTE_ORDER BRG_LITTLE_ENDIAN | |
| 225 | ||
| 226 | #elif defined( AMIGA ) || defined( applec ) || defined( __AS400__ ) || \ | |
| 227 | defined( _CRAY ) || defined( __hppa ) || defined( __hp9000 ) || \ | |
| 228 | defined( ibm370 ) || defined( mc68000 ) || defined( m68k ) || \ | |
| 229 | defined( __MRC__ ) || defined( __MVS__ ) || defined( __MWERKS__ ) || \ | |
| 230 | defined( sparc ) || defined( __sparc) || defined( SYMANTEC_C ) || \ | |
| 231 | defined( __TANDEM ) || defined( THINK_C ) || defined( __VMCMS__ ) | |
| 232 | # define PLATFORM_BYTE_ORDER BRG_BIG_ENDIAN | |
| 233 | ||
| 234 | #elif 0 /* **** EDIT HERE IF NECESSARY **** */ | |
| 235 | # define PLATFORM_BYTE_ORDER BRG_LITTLE_ENDIAN | |
| 236 | #elif 0 /* **** EDIT HERE IF NECESSARY **** */ | |
| 237 | # define PLATFORM_BYTE_ORDER BRG_BIG_ENDIAN | |
| 238 | #else | |
| 239 | # error Please edit aesopt.h (line 234 or 236) to set the platform byte order | |
| 240 | #endif | |
| 241 | ||
| 242 | #endif | |
| 243 | ||
| 244 | /* SOME LOCAL DEFINITIONS */ | |
| 245 | ||
| 246 | #define NO_TABLES 0 | |
| 247 | #define ONE_TABLE 1 | |
| 248 | #define FOUR_TABLES 4 | |
| 249 | #define NONE 0 | |
| 250 | #define PARTIAL 1 | |
| 251 | #define FULL 2 | |
| 252 | ||
| 253 | #if defined(bswap32) | |
| 254 | #define aes_sw32 bswap32 | |
| 255 | #elif defined(bswap_32) | |
| 256 | #define aes_sw32 bswap_32 | |
| 257 | #else | |
| 258 | #define brot(x,n) (((aes_32t)(x) << n) | ((aes_32t)(x) >> (32 - n))) | |
| 259 | #define aes_sw32(x) ((brot((x),8) & 0x00ff00ff) | (brot((x),24) & 0xff00ff00)) | |
| 260 | #endif | |
| 261 | ||
| 262 | /* 1. FUNCTIONS REQUIRED | |
| 263 | ||
| 264 | This implementation provides subroutines for encryption, decryption | |
| 265 | and for setting the three key lengths (separately) for encryption | |
| 266 | and decryption. When the assembler code is not being used the following | |
| 267 | definition blocks allow the selection of the routines that are to be | |
| 268 | included in the compilation. | |
| 269 | */ | |
| 270 | #if defined( AES_ENCRYPT ) | |
| 271 | #define ENCRYPTION | |
| 272 | #define ENCRYPTION_KEY_SCHEDULE | |
| 273 | #endif | |
| 274 | ||
| 275 | #if defined( AES_DECRYPT ) | |
| 276 | #define DECRYPTION | |
| 277 | #define DECRYPTION_KEY_SCHEDULE | |
| 278 | #endif | |
| 279 | ||
| 280 | /* 2. ASSEMBLER SUPPORT | |
| 281 | ||
| 282 | This define (which can be on the command line) enables the use of the | |
| 283 | assembler code routines for encryption and decryption with the C code | |
| 284 | only providing key scheduling | |
| 285 | */ | |
| 286 | #if 0 && !defined(AES_ASM) | |
| 287 | #define AES_ASM | |
| 288 | #endif | |
| 289 | ||
| 290 | /* 3. BYTE ORDER WITHIN 32 BIT WORDS | |
| 291 | ||
| 292 | The fundamental data processing units in Rijndael are 8-bit bytes. The | |
| 293 | input, output and key input are all enumerated arrays of bytes in which | |
| 294 | bytes are numbered starting at zero and increasing to one less than the | |
| 295 | number of bytes in the array in question. This enumeration is only used | |
| 296 | for naming bytes and does not imply any adjacency or order relationship | |
| 297 | from one byte to another. When these inputs and outputs are considered | |
| 298 | as bit sequences, bits 8*n to 8*n+7 of the bit sequence are mapped to | |
| 299 | byte[n] with bit 8n+i in the sequence mapped to bit 7-i within the byte. | |
| 300 | In this implementation bits are numbered from 0 to 7 starting at the | |
| 301 | numerically least significant end of each byte (bit n represents 2^n). | |
| 302 | ||
| 303 | However, Rijndael can be implemented more efficiently using 32-bit | |
| 304 | words by packing bytes into words so that bytes 4*n to 4*n+3 are placed | |
| 305 | into word[n]. While in principle these bytes can be assembled into words | |
| 306 | in any positions, this implementation only supports the two formats in | |
| 307 | which bytes in adjacent positions within words also have adjacent byte | |
| 308 | numbers. This order is called big-endian if the lowest numbered bytes | |
| 309 | in words have the highest numeric significance and little-endian if the | |
| 310 | opposite applies. | |
| 311 | ||
| 312 | This code can work in either order irrespective of the order used by the | |
| 313 | machine on which it runs. Normally the internal byte order will be set | |
| 314 | to the order of the processor on which the code is to be run but this | |
| 315 | define can be used to reverse this in special situations | |
| 316 | ||
| 317 | NOTE: Assembler code versions rely on PLATFORM_BYTE_ORDER being set | |
| 318 | */ | |
| 319 | #if 1 || defined(AES_ASM) | |
| 320 | #define ALGORITHM_BYTE_ORDER PLATFORM_BYTE_ORDER | |
| 321 | #elif 0 | |
| 322 | #define ALGORITHM_BYTE_ORDER BRG_LITTLE_ENDIAN | |
| 323 | #elif 0 | |
| 324 | #define ALGORITHM_BYTE_ORDER BRG_BIG_ENDIAN | |
| 325 | #else | |
| 326 | #error The algorithm byte order is not defined | |
| 327 | #endif | |
| 328 | ||
| 329 | /* 4. FAST INPUT/OUTPUT OPERATIONS. | |
| 330 | ||
| 331 | On some machines it is possible to improve speed by transferring the | |
| 332 | bytes in the input and output arrays to and from the internal 32-bit | |
| 333 | variables by addressing these arrays as if they are arrays of 32-bit | |
| 334 | words. On some machines this will always be possible but there may | |
| 335 | be a large performance penalty if the byte arrays are not aligned on | |
| 336 | the normal word boundaries. On other machines this technique will | |
| 337 | lead to memory access errors when such 32-bit word accesses are not | |
| 338 | properly aligned. The option SAFE_IO avoids such problems but will | |
| 339 | often be slower on those machines that support misaligned access | |
| 340 | (especially so if care is taken to align the input and output byte | |
| 341 | arrays on 32-bit word boundaries). If SAFE_IO is not defined it is | |
| 342 | assumed that access to byte arrays as if they are arrays of 32-bit | |
| 343 | words will not cause problems when such accesses are misaligned. | |
| 344 | */ | |
| 345 | #if 0 && !defined(_MSC_VER) | |
| 346 | #define SAFE_IO | |
| 347 | #endif | |
| 348 | ||
| 349 | /* 5. LOOP UNROLLING | |
| 350 | ||
| 351 | The code for encryption and decrytpion cycles through a number of rounds | |
| 352 | that can be implemented either in a loop or by expanding the code into a | |
| 353 | long sequence of instructions, the latter producing a larger program but | |
| 354 | one that will often be much faster. The latter is called loop unrolling. | |
| 355 | There are also potential speed advantages in expanding two iterations in | |
| 356 | a loop with half the number of iterations, which is called partial loop | |
| 357 | unrolling. The following options allow partial or full loop unrolling | |
| 358 | to be set independently for encryption and decryption | |
| 359 | */ | |
| 360 | #if 1 | |
| 361 | #define ENC_UNROLL FULL | |
| 362 | #elif 0 | |
| 363 | #define ENC_UNROLL PARTIAL | |
| 364 | #else | |
| 365 | #define ENC_UNROLL NONE | |
| 366 | #endif | |
| 367 | ||
| 368 | #if 1 | |
| 369 | #define DEC_UNROLL FULL | |
| 370 | #elif 0 | |
| 371 | #define DEC_UNROLL PARTIAL | |
| 372 | #else | |
| 373 | #define DEC_UNROLL NONE | |
| 374 | #endif | |
| 375 | ||
| 376 | /* 6. FAST FINITE FIELD OPERATIONS | |
| 377 | ||
| 378 | If this section is included, tables are used to provide faster finite | |
| 379 | field arithmetic (this has no effect if FIXED_TABLES is defined). | |
| 380 | */ | |
| 381 | #if 1 | |
| 382 | #define FF_TABLES | |
| 383 | #endif | |
| 384 | ||
| 385 | /* 7. INTERNAL STATE VARIABLE FORMAT | |
| 386 | ||
| 387 | The internal state of Rijndael is stored in a number of local 32-bit | |
| 388 | word varaibles which can be defined either as an array or as individual | |
| 389 | names variables. Include this section if you want to store these local | |
| 390 | varaibles in arrays. Otherwise individual local variables will be used. | |
| 391 | */ | |
| 392 | #if 0 | |
| 393 | #define ARRAYS | |
| 394 | #endif | |
| 395 | ||
| 396 | /* In this implementation the columns of the state array are each held in | |
| 397 | 32-bit words. The state array can be held in various ways: in an array | |
| 398 | of words, in a number of individual word variables or in a number of | |
| 399 | processor registers. The following define maps a variable name x and | |
| 400 | a column number c to the way the state array variable is to be held. | |
| 401 | The first define below maps the state into an array x[c] whereas the | |
| 402 | second form maps the state into a number of individual variables x0, | |
| 403 | x1, etc. Another form could map individual state colums to machine | |
| 404 | register names. | |
| 405 | */ | |
| 406 | ||
| 407 | #if defined(ARRAYS) | |
| 408 | #define s(x,c) x[c] | |
| 409 | #else | |
| 410 | #define s(x,c) x##c | |
| 411 | #endif | |
| 412 | ||
| 413 | /* 8. FIXED OR DYNAMIC TABLES | |
| 414 | ||
| 415 | When this section is included the tables used by the code are compiled | |
| 416 | statically into the binary file. Otherwise the subroutine gen_tabs() | |
| 417 | must be called to compute them before the code is first used. | |
| 418 | */ | |
| 419 | #if 1 | |
| 420 | #define FIXED_TABLES | |
| 421 | #endif | |
| 422 | ||
| 423 | /* 9. TABLE ALIGNMENT | |
| 424 | ||
| 425 | On some sytsems speed will be improved by aligning the AES large lookup | |
| 426 | tables on particular boundaries. This define should be set to a power of | |
| 427 | two giving the desired alignment. It can be left undefined if alignment | |
| 428 | is not needed. This option is specific to the Microsft VC++ compiler - | |
| 429 | it seems to sometimes cause trouble for the VC++ version 6 compiler. | |
| 430 | */ | |
| 431 | ||
| 432 | #if 0 && defined(_MSC_VER) && (_MSC_VER >= 1300) | |
| 433 | #define TABLE_ALIGN 64 | |
| 434 | #endif | |
| 435 | ||
| 436 | /* 10. INTERNAL TABLE CONFIGURATION | |
| 437 | ||
| 438 | This cipher proceeds by repeating in a number of cycles known as 'rounds' | |
| 439 | which are implemented by a round function which can optionally be speeded | |
| 440 | up using tables. The basic tables are each 256 32-bit words, with either | |
| 441 | one or four tables being required for each round function depending on | |
| 442 | how much speed is required. The encryption and decryption round functions | |
| 443 | are different and the last encryption and decrytpion round functions are | |
| 444 | different again making four different round functions in all. | |
| 445 | ||
| 446 | This means that: | |
| 447 | 1. Normal encryption and decryption rounds can each use either 0, 1 | |
| 448 | or 4 tables and table spaces of 0, 1024 or 4096 bytes each. | |
| 449 | 2. The last encryption and decryption rounds can also use either 0, 1 | |
| 450 | or 4 tables and table spaces of 0, 1024 or 4096 bytes each. | |
| 451 | ||
| 452 | Include or exclude the appropriate definitions below to set the number | |
| 453 | of tables used by this implementation. | |
| 454 | */ | |
| 455 | ||
| 456 | #if 1 /* set tables for the normal encryption round */ | |
| 457 | #define ENC_ROUND FOUR_TABLES | |
| 458 | #elif 0 | |
| 459 | #define ENC_ROUND ONE_TABLE | |
| 460 | #else | |
| 461 | #define ENC_ROUND NO_TABLES | |
| 462 | #endif | |
| 463 | ||
| 464 | #if 1 /* set tables for the last encryption round */ | |
| 465 | #define LAST_ENC_ROUND FOUR_TABLES | |
| 466 | #elif 0 | |
| 467 | #define LAST_ENC_ROUND ONE_TABLE | |
| 468 | #else | |
| 469 | #define LAST_ENC_ROUND NO_TABLES | |
| 470 | #endif | |
| 471 | ||
| 472 | #if 1 /* set tables for the normal decryption round */ | |
| 473 | #define DEC_ROUND FOUR_TABLES | |
| 474 | #elif 0 | |
| 475 | #define DEC_ROUND ONE_TABLE | |
| 476 | #else | |
| 477 | #define DEC_ROUND NO_TABLES | |
| 478 | #endif | |
| 479 | ||
| 480 | #if 1 /* set tables for the last decryption round */ | |
| 481 | #define LAST_DEC_ROUND FOUR_TABLES | |
| 482 | #elif 0 | |
| 483 | #define LAST_DEC_ROUND ONE_TABLE | |
| 484 | #else | |
| 485 | #define LAST_DEC_ROUND NO_TABLES | |
| 486 | #endif | |
| 487 | ||
| 488 | /* The decryption key schedule can be speeded up with tables in the same | |
| 489 | way that the round functions can. Include or exclude the following | |
| 490 | defines to set this requirement. | |
| 491 | */ | |
| 492 | #if 1 | |
| 493 | #define KEY_SCHED FOUR_TABLES | |
| 494 | #elif 0 | |
| 495 | #define KEY_SCHED ONE_TABLE | |
| 496 | #else | |
| 497 | #define KEY_SCHED NO_TABLES | |
| 498 | #endif | |
| 499 | ||
| 500 | /* 11. TABLE POINTER CACHING | |
| 501 | ||
| 502 | Normally tables are referenced directly, Enable this option if you wish to | |
| 503 | cache pointers to the tables in the encrypt/decrypt code. Note that this | |
| 504 | only works if you are using FOUR_TABLES for the ROUND you enable this for. | |
| 505 | */ | |
| 506 | #if 1 | |
| 507 | #define ENC_ROUND_CACHE_TABLES | |
| 508 | #endif | |
| 509 | #if 1 | |
| 510 | #define LAST_ENC_ROUND_CACHE_TABLES | |
| 511 | #endif | |
| 512 | #if 1 | |
| 513 | #define DEC_ROUND_CACHE_TABLES | |
| 514 | #endif | |
| 515 | #if 1 | |
| 516 | #define LAST_DEC_ROUND_CACHE_TABLES | |
| 517 | #endif | |
| 518 | ||
| 519 | ||
| 520 | /* END OF CONFIGURATION OPTIONS */ | |
| 521 | ||
| 522 | #define RC_LENGTH (5 * (AES_BLOCK_SIZE / 4 - 2)) | |
| 523 | ||
| 524 | /* Disable or report errors on some combinations of options */ | |
| 525 | ||
| 526 | #if ENC_ROUND == NO_TABLES && LAST_ENC_ROUND != NO_TABLES | |
| 527 | #undef LAST_ENC_ROUND | |
| 528 | #define LAST_ENC_ROUND NO_TABLES | |
| 529 | #elif ENC_ROUND == ONE_TABLE && LAST_ENC_ROUND == FOUR_TABLES | |
| 530 | #undef LAST_ENC_ROUND | |
| 531 | #define LAST_ENC_ROUND ONE_TABLE | |
| 532 | #endif | |
| 533 | ||
| 534 | #if ENC_ROUND == NO_TABLES && ENC_UNROLL != NONE | |
| 535 | #undef ENC_UNROLL | |
| 536 | #define ENC_UNROLL NONE | |
| 537 | #endif | |
| 538 | ||
| 539 | #if DEC_ROUND == NO_TABLES && LAST_DEC_ROUND != NO_TABLES | |
| 540 | #undef LAST_DEC_ROUND | |
| 541 | #define LAST_DEC_ROUND NO_TABLES | |
| 542 | #elif DEC_ROUND == ONE_TABLE && LAST_DEC_ROUND == FOUR_TABLES | |
| 543 | #undef LAST_DEC_ROUND | |
| 544 | #define LAST_DEC_ROUND ONE_TABLE | |
| 545 | #endif | |
| 546 | ||
| 547 | #if DEC_ROUND == NO_TABLES && DEC_UNROLL != NONE | |
| 548 | #undef DEC_UNROLL | |
| 549 | #define DEC_UNROLL NONE | |
| 550 | #endif | |
| 551 | ||
| 552 | /* upr(x,n): rotates bytes within words by n positions, moving bytes to | |
| 553 | higher index positions with wrap around into low positions | |
| 554 | ups(x,n): moves bytes by n positions to higher index positions in | |
| 555 | words but without wrap around | |
| 556 | bval(x,n): extracts a byte from a word | |
| 557 | ||
| 558 | NOTE: The definitions given here are intended only for use with | |
| 559 | unsigned variables and with shift counts that are compile | |
| 560 | time constants | |
| 561 | */ | |
| 562 | ||
| 563 | #if (ALGORITHM_BYTE_ORDER == BRG_LITTLE_ENDIAN) | |
| 564 | #define upr(x,n) (((aes_32t)(x) << (8 * (n))) | ((aes_32t)(x) >> (32 - 8 * (n)))) | |
| 565 | #define ups(x,n) ((aes_32t) (x) << (8 * (n))) | |
| 566 | #define bval(x,n) ((aes_08t)((x) >> (8 * (n)))) | |
| 567 | #define bytes2word(b0, b1, b2, b3) \ | |
| 568 | (((aes_32t)(b3) << 24) | ((aes_32t)(b2) << 16) | ((aes_32t)(b1) << 8) | (b0)) | |
| 569 | #endif | |
| 570 | ||
| 571 | #if (ALGORITHM_BYTE_ORDER == BRG_BIG_ENDIAN) | |
| 572 | #define upr(x,n) (((aes_32t)(x) >> (8 * (n))) | ((aes_32t)(x) << (32 - 8 * (n)))) | |
| 573 | #define ups(x,n) ((aes_32t) (x) >> (8 * (n)))) | |
| 574 | #define bval(x,n) ((aes_08t)((x) >> (24 - 8 * (n)))) | |
| 575 | #define bytes2word(b0, b1, b2, b3) \ | |
| 576 | (((aes_32t)(b0) << 24) | ((aes_32t)(b1) << 16) | ((aes_32t)(b2) << 8) | (b3)) | |
| 577 | #endif | |
| 578 | ||
| 579 | #if defined(SAFE_IO) | |
| 580 | ||
| 581 | #define word_in(x,c) bytes2word(((aes_08t*)(x)+4*c)[0], ((aes_08t*)(x)+4*c)[1], \ | |
| 582 | ((aes_08t*)(x)+4*c)[2], ((aes_08t*)(x)+4*c)[3]) | |
| 583 | #define word_out(x,c,v) { ((aes_08t*)(x)+4*c)[0] = bval(v,0); ((aes_08t*)(x)+4*c)[1] = bval(v,1); \ | |
| 584 | ((aes_08t*)(x)+4*c)[2] = bval(v,2); ((aes_08t*)(x)+4*c)[3] = bval(v,3); } | |
| 585 | ||
| 586 | #elif (ALGORITHM_BYTE_ORDER == PLATFORM_BYTE_ORDER) | |
| 587 | ||
| 588 | #define word_in(x,c) (*((aes_32t*)(x)+(c))) | |
| 589 | #define word_out(x,c,v) (*((aes_32t*)(x)+(c)) = (v)) | |
| 590 | ||
| 591 | #else | |
| 592 | ||
| 593 | #define word_in(x,c) aes_sw32(*((aes_32t*)(x)+(c))) | |
| 594 | #define word_out(x,c,v) (*((aes_32t*)(x)+(c)) = aes_sw32(v)) | |
| 595 | ||
| 596 | #endif | |
| 597 | ||
| 598 | /* the finite field modular polynomial and elements */ | |
| 599 | ||
| 600 | #define WPOLY 0x011b | |
| 601 | #define BPOLY 0x1b | |
| 602 | ||
| 603 | /* multiply four bytes in GF(2^8) by 'x' {02} in parallel */ | |
| 604 | ||
| 605 | #define m1 0x80808080 | |
| 606 | #define m2 0x7f7f7f7f | |
| 607 | #define gf_mulx(x) ((((x) & m2) << 1) ^ ((((x) & m1) >> 7) * BPOLY)) | |
| 608 | ||
| 609 | /* The following defines provide alternative definitions of gf_mulx that might | |
| 610 | give improved performance if a fast 32-bit multiply is not available. Note | |
| 611 | that a temporary variable u needs to be defined where gf_mulx is used. | |
| 612 | ||
| 613 | #define gf_mulx(x) (u = (x) & m1, u |= (u >> 1), ((x) & m2) << 1) ^ ((u >> 3) | (u >> 6)) | |
| 614 | #define m4 (0x01010101 * BPOLY) | |
| 615 | #define gf_mulx(x) (u = (x) & m1, ((x) & m2) << 1) ^ ((u - (u >> 7)) & m4) | |
| 616 | */ | |
| 617 | ||
| 618 | /* Work out which tables are needed for the different options */ | |
| 619 | ||
| 620 | #if defined( AES_ASM ) | |
| 621 | #if defined( ENC_ROUND ) | |
| 622 | #undef ENC_ROUND | |
| 623 | #endif | |
| 624 | #define ENC_ROUND FOUR_TABLES | |
| 625 | #if defined( LAST_ENC_ROUND ) | |
| 626 | #undef LAST_ENC_ROUND | |
| 627 | #endif | |
| 628 | #define LAST_ENC_ROUND FOUR_TABLES | |
| 629 | #if defined( DEC_ROUND ) | |
| 630 | #undef DEC_ROUND | |
| 631 | #endif | |
| 632 | #define DEC_ROUND FOUR_TABLES | |
| 633 | #if defined( LAST_DEC_ROUND ) | |
| 634 | #undef LAST_DEC_ROUND | |
| 635 | #endif | |
| 636 | #define LAST_DEC_ROUND FOUR_TABLES | |
| 637 | #if defined( KEY_SCHED ) | |
| 638 | #undef KEY_SCHED | |
| 639 | #define KEY_SCHED FOUR_TABLES | |
| 640 | #endif | |
| 641 | #endif | |
| 642 | ||
| 643 | #if defined(ENCRYPTION) || defined(AES_ASM) | |
| 644 | #if ENC_ROUND == ONE_TABLE | |
| 645 | #define FT1_SET | |
| 646 | #elif ENC_ROUND == FOUR_TABLES | |
| 647 | #define FT4_SET | |
| 648 | #else | |
| 649 | #define SBX_SET | |
| 650 | #endif | |
| 651 | #if LAST_ENC_ROUND == ONE_TABLE | |
| 652 | #define FL1_SET | |
| 653 | #elif LAST_ENC_ROUND == FOUR_TABLES | |
| 654 | #define FL4_SET | |
| 655 | #elif !defined(SBX_SET) | |
| 656 | #define SBX_SET | |
| 657 | #endif | |
| 658 | #endif | |
| 659 | ||
| 660 | #if defined(DECRYPTION) || defined(AES_ASM) | |
| 661 | #if DEC_ROUND == ONE_TABLE | |
| 662 | #define IT1_SET | |
| 663 | #elif DEC_ROUND == FOUR_TABLES | |
| 664 | #define IT4_SET | |
| 665 | #else | |
| 666 | #define ISB_SET | |
| 667 | #endif | |
| 668 | #if LAST_DEC_ROUND == ONE_TABLE | |
| 669 | #define IL1_SET | |
| 670 | #elif LAST_DEC_ROUND == FOUR_TABLES | |
| 671 | #define IL4_SET | |
| 672 | #elif !defined(ISB_SET) | |
| 673 | #define ISB_SET | |
| 674 | #endif | |
| 675 | #endif | |
| 676 | ||
| 677 | #if defined(ENCRYPTION_KEY_SCHEDULE) || defined(DECRYPTION_KEY_SCHEDULE) | |
| 678 | #if KEY_SCHED == ONE_TABLE | |
| 679 | #define LS1_SET | |
| 680 | #define IM1_SET | |
| 681 | #elif KEY_SCHED == FOUR_TABLES | |
| 682 | #define LS4_SET | |
| 683 | #define IM4_SET | |
| 684 | #elif !defined(SBX_SET) | |
| 685 | #define SBX_SET | |
| 686 | #endif | |
| 687 | #endif | |
| 688 | ||
| 689 | /* generic definitions of Rijndael macros that use tables */ | |
| 690 | ||
| 691 | #define no_table(x,box,vf,rf,c) bytes2word( \ | |
| 692 | box[bval(vf(x,0,c),rf(0,c))], \ | |
| 693 | box[bval(vf(x,1,c),rf(1,c))], \ | |
| 694 | box[bval(vf(x,2,c),rf(2,c))], \ | |
| 695 | box[bval(vf(x,3,c),rf(3,c))]) | |
| 696 | ||
| 697 | #define one_table(x,op,tab,vf,rf,c) \ | |
| 698 | ( tab[bval(vf(x,0,c),rf(0,c))] \ | |
| 699 | ^ op(tab[bval(vf(x,1,c),rf(1,c))],1) \ | |
| 700 | ^ op(tab[bval(vf(x,2,c),rf(2,c))],2) \ | |
| 701 | ^ op(tab[bval(vf(x,3,c),rf(3,c))],3)) | |
| 702 | ||
| 703 | #define four_tables(x,tab,vf,rf,c) \ | |
| 704 | ( tab[0][bval(vf(x,0,c),rf(0,c))] \ | |
| 705 | ^ tab[1][bval(vf(x,1,c),rf(1,c))] \ | |
| 706 | ^ tab[2][bval(vf(x,2,c),rf(2,c))] \ | |
| 707 | ^ tab[3][bval(vf(x,3,c),rf(3,c))]) | |
| 708 | ||
| 709 | #define four_cached_tables(x,tab,vf,rf,c) \ | |
| 710 | ( tab##0[bval(vf(x,0,c),rf(0,c))] \ | |
| 711 | ^ tab##1[bval(vf(x,1,c),rf(1,c))] \ | |
| 712 | ^ tab##2[bval(vf(x,2,c),rf(2,c))] \ | |
| 713 | ^ tab##3[bval(vf(x,3,c),rf(3,c))]) | |
| 714 | ||
| 715 | #define vf1(x,r,c) (x) | |
| 716 | #define rf1(r,c) (r) | |
| 717 | #define rf2(r,c) ((8+r-c)&3) | |
| 718 | ||
| 719 | /* perform forward and inverse column mix operation on four bytes in long word x in */ | |
| 720 | /* parallel. NOTE: x must be a simple variable, NOT an expression in these macros. */ | |
| 721 | ||
| 722 | #if defined(FM4_SET) /* not currently used */ | |
| 723 | #define fwd_mcol(x) four_tables(x,t_use(f,m),vf1,rf1,0) | |
| 724 | #elif defined(FM1_SET) /* not currently used */ | |
| 725 | #define fwd_mcol(x) one_table(x,upr,t_use(f,m),vf1,rf1,0) | |
| 726 | #else | |
| 727 | #define dec_fmvars aes_32t g2 | |
| 728 | #define fwd_mcol(x) (g2 = gf_mulx(x), g2 ^ upr((x) ^ g2, 3) ^ upr((x), 2) ^ upr((x), 1)) | |
| 729 | #endif | |
| 730 | ||
| 731 | #if defined(IM4_SET) | |
| 732 | #define inv_mcol(x) four_tables(x,t_use(i,m),vf1,rf1,0) | |
| 733 | #elif defined(IM1_SET) | |
| 734 | #define inv_mcol(x) one_table(x,upr,t_use(i,m),vf1,rf1,0) | |
| 735 | #else | |
| 736 | #define dec_imvars aes_32t g2, g4, g9 | |
| 737 | #define inv_mcol(x) (g2 = gf_mulx(x), g4 = gf_mulx(g2), g9 = (x) ^ gf_mulx(g4), g4 ^= g9, \ | |
| 738 | (x) ^ g2 ^ g4 ^ upr(g2 ^ g9, 3) ^ upr(g4, 2) ^ upr(g9, 1)) | |
| 739 | #endif | |
| 740 | ||
| 741 | #if defined(FL4_SET) | |
| 742 | #define ls_box(x,c) four_tables(x,t_use(f,l),vf1,rf2,c) | |
| 743 | #elif defined(LS4_SET) | |
| 744 | #define ls_box(x,c) four_tables(x,t_use(l,s),vf1,rf2,c) | |
| 745 | #elif defined(FL1_SET) | |
| 746 | #define ls_box(x,c) one_table(x,upr,t_use(f,l),vf1,rf2,c) | |
| 747 | #elif defined(LS1_SET) | |
| 748 | #define ls_box(x,c) one_table(x,upr,t_use(l,s),vf1,rf2,c) | |
| 749 | #else | |
| 750 | #define ls_box(x,c) no_table(x,t_use(s,box),vf1,rf2,c) | |
| 751 | #endif | |
| 752 | ||
| 753 | #endif |