bsd/crypto/aes/gen/aesopt.h

   1 /*
   2  ---------------------------------------------------------------------------
   3  Copyright (c) 2003, Dr Brian Gladman, Worcester, UK.   All rights reserved.
   4
   5  LICENSE TERMS
   6
   7  The free distribution and use of this software in both source and binary
   8  form is allowed (with or without changes) provided that:
   9
  10    1. distributions of this source code include the above copyright
  11       notice, this list of conditions and the following disclaimer;
  12
  13    2. distributions in binary form include the above copyright
  14       notice, this list of conditions and the following disclaimer
  15       in the documentation and/or other associated materials;
  16
  17    3. the copyright holder's name is not used to endorse products
  18       built using this software without specific written permission.
  19
  20  ALTERNATIVELY, provided that this notice is retained in full, this product
  21  may be distributed under the terms of the GNU General Public License (GPL),
  22  in which case the provisions of the GPL apply INSTEAD OF those given above.
  23
  24  DISCLAIMER
  25
  26  This software is provided 'as is' with no explicit or implied warranties
  27  in respect of its properties, including, but not limited to, correctness
  28  and/or fitness for purpose.
  29  ---------------------------------------------------------------------------
  30  Issue 28/01/2004
  31
  32  My thanks go to Dag Arne Osvik for devising the schemes used here for key
  33  length derivation from the form of the key schedule
  34
  35  This file contains the compilation options for AES (Rijndael) and code
  36  that is common across encryption, key scheduling and table generation.
  37
  38  OPERATION
  39
  40  These source code files implement the AES algorithm Rijndael designed by
  41  Joan Daemen and Vincent Rijmen. This version is designed for the standard
  42  block size of 16 bytes and for key sizes of 128, 192 and 256 bits (16, 24
  43  and 32 bytes).
  44
  45  This version is designed for flexibility and speed using operations on
  46  32-bit words rather than operations on bytes.  It can be compiled with
  47  either big or little endian internal byte order but is faster when the
  48  native byte order for the processor is used.
  49
  50  THE CIPHER INTERFACE
  51
  52  The cipher interface is implemented as an array of bytes in which lower
  53  AES bit sequence indexes map to higher numeric significance within bytes.
  54
  55   aes_08t                 (an unsigned  8-bit type)
  56   aes_32t                 (an unsigned 32-bit type)
  57   struct aes_encrypt_ctx  (structure for the cipher encryption context)
  58   struct aes_decrypt_ctx  (structure for the cipher decryption context)
  59   aes_rval                the function return type
  60
  61   C subroutine calls:
  62
  63   aes_rval aes_encrypt_key128(const unsigned char *key, aes_encrypt_ctx cx[1]);
  64   aes_rval aes_encrypt_key192(const unsigned char *key, aes_encrypt_ctx cx[1]);
  65   aes_rval aes_encrypt_key256(const unsigned char *key, aes_encrypt_ctx cx[1]);
  66   aes_rval aes_encrypt(const unsigned char *in, unsigned char *out,
  67                                                   const aes_encrypt_ctx cx[1]);
  68
  69   aes_rval aes_decrypt_key128(const unsigned char *key, aes_decrypt_ctx cx[1]);
  70   aes_rval aes_decrypt_key192(const unsigned char *key, aes_decrypt_ctx cx[1]);
  71   aes_rval aes_decrypt_key256(const unsigned char *key, aes_decrypt_ctx cx[1]);
  72   aes_rval aes_decrypt(const unsigned char *in, unsigned char *out,
  73                                                   const aes_decrypt_ctx cx[1]);
  74
  75  IMPORTANT NOTE: If you are using this C interface with dynamic tables make sure that
  76  you call genTabs() before AES is used so that the tables are initialised.
  77
  78  C++ aes class subroutines:
  79
  80      Class AESencrypt  for encryption
  81
  82       Construtors:
  83           AESencrypt(void)
  84           AESencrypt(const unsigned char *key) - 128 bit key
  85       Members:
  86           aes_rval key128(const unsigned char *key)
  87           aes_rval key192(const unsigned char *key)
  88           aes_rval key256(const unsigned char *key)
  89           aes_rval encrypt(const unsigned char *in, unsigned char *out) const
  90
  91       Class AESdecrypt  for encryption
  92       Construtors:
  93           AESdecrypt(void)
  94           AESdecrypt(const unsigned char *key) - 128 bit key
  95       Members:
  96           aes_rval key128(const unsigned char *key)
  97           aes_rval key192(const unsigned char *key)
  98           aes_rval key256(const unsigned char *key)
  99           aes_rval decrypt(const unsigned char *in, unsigned char *out) const
 100
 101     COMPILATION
 102
 103     The files used to provide AES (Rijndael) are
 104
 105     a. aes.h for the definitions needed for use in C.
 106     b. aescpp.h for the definitions needed for use in C++.
 107     c. aesopt.h for setting compilation options (also includes common code).
 108     d. aescrypt.c for encryption and decrytpion, or
 109     e. aeskey.c for key scheduling.
 110     f. aestab.c for table loading or generation.
 111     g. aescrypt.asm for encryption and decryption using assembler code.
 112     h. aescrypt.mmx.asm for encryption and decryption using MMX assembler.
 113
 114     To compile AES (Rijndael) for use in C code use aes.h and set the
 115     defines here for the facilities you need (key lengths, encryption
 116     and/or decryption). Do not define AES_DLL or AES_CPP.  Set the options
 117     for optimisations and table sizes here.
 118
 119     To compile AES (Rijndael) for use in in C++ code use aescpp.h but do
 120     not define AES_DLL
 121
 122     To compile AES (Rijndael) in C as a Dynamic Link Library DLL) use
 123     aes.h and include the AES_DLL define.
 124
 125     CONFIGURATION OPTIONS (here and in aes.h)
 126
 127     a. set AES_DLL in aes.h if AES (Rijndael) is to be compiled as a DLL
 128     b. You may need to set PLATFORM_BYTE_ORDER to define the byte order.
 129     c. If you want the code to run in a specific internal byte order, then
 130        ALGORITHM_BYTE_ORDER must be set accordingly.
 131     d. set other configuration options decribed below.
 132 */
 133
 134 #if !defined( _AESOPT_H )
 135 #define _AESOPT_H
 136
 137 #include <crypto/aes/aes.h>
 138
 139 /*  CONFIGURATION - USE OF DEFINES
 140
 141     Later in this section there are a number of defines that control the
 142     operation of the code.  In each section, the purpose of each define is
 143     explained so that the relevant form can be included or excluded by
 144     setting either 1's or 0's respectively on the branches of the related
 145     #if clauses.
 146
 147     PLATFORM SPECIFIC INCLUDES AND BYTE ORDER IN 32-BIT WORDS
 148
 149     To obtain the highest speed on processors with 32-bit words, this code
 150     needs to determine the byte order of the target machine. The following
 151     block of code is an attempt to capture the most obvious ways in which
 152     various environemnts define byte order. It may well fail, in which case
 153     the definitions will need to be set by editing at the points marked
 154     **** EDIT HERE IF NECESSARY **** below.  My thanks go to Peter Gutmann
 155     for his assistance with this endian detection nightmare.
 156 */
 157
 158 #define BRG_LITTLE_ENDIAN   1234 /* byte 0 is least significant (i386) */
 159 #define BRG_BIG_ENDIAN      4321 /* byte 0 is most significant (mc68k) */
 160
 161 #if defined(__GNUC__) || defined(__GNU_LIBRARY__)
 162 #  if defined(__FreeBSD__) || defined(__OpenBSD__)
 163 #    include <sys/endian.h>
 164 #  elif defined( BSD ) && BSD >= 199103
 165 #      include <machine/endian.h>
 166 #  elif defined(__APPLE__)
 167 #    if defined(__BIG_ENDIAN__) && !defined( BIG_ENDIAN )
 168 #      define BIG_ENDIAN
 169 #    elif defined(__LITTLE_ENDIAN__) && !defined( LITTLE_ENDIAN )
 170 #      define LITTLE_ENDIAN
 171 #    endif
 172 #  else
 173 #    include <endian.h>
 174 #    if defined(__BEOS__)
 175 #      include <byteswap.h>
 176 #    endif
 177 #  endif
 178 #endif
 179
 180 #if !defined(PLATFORM_BYTE_ORDER)
 181 #  if defined(LITTLE_ENDIAN) || defined(BIG_ENDIAN)
 182 #    if    defined(LITTLE_ENDIAN) && !defined(BIG_ENDIAN)
 183 #      define PLATFORM_BYTE_ORDER BRG_LITTLE_ENDIAN
 184 #    elif !defined(LITTLE_ENDIAN) &&  defined(BIG_ENDIAN)
 185 #      define PLATFORM_BYTE_ORDER BRG_BIG_ENDIAN
 186 #    elif defined(BYTE_ORDER) && (BYTE_ORDER == LITTLE_ENDIAN)
 187 #      define PLATFORM_BYTE_ORDER BRG_LITTLE_ENDIAN
 188 #    elif defined(BYTE_ORDER) && (BYTE_ORDER == BIG_ENDIAN)
 189 #      define PLATFORM_BYTE_ORDER BRG_BIG_ENDIAN
 190 #    endif
 191 #  elif defined(_LITTLE_ENDIAN) || defined(_BIG_ENDIAN)
 192 #    if    defined(_LITTLE_ENDIAN) && !defined(_BIG_ENDIAN)
 193 #      define PLATFORM_BYTE_ORDER BRG_LITTLE_ENDIAN
 194 #    elif !defined(_LITTLE_ENDIAN) &&  defined(_BIG_ENDIAN)
 195 #      define PLATFORM_BYTE_ORDER BRG_BIG_ENDIAN
 196 #    elif defined(_BYTE_ORDER) && (_BYTE_ORDER == _LITTLE_ENDIAN)
 197 #      define PLATFORM_BYTE_ORDER BRG_LITTLE_ENDIAN
 198 #    elif defined(_BYTE_ORDER) && (_BYTE_ORDER == _BIG_ENDIAN)
 199 #      define PLATFORM_BYTE_ORDER BRG_BIG_ENDIAN
 200 #   endif
 201 #  elif defined(__LITTLE_ENDIAN__) || defined(__BIG_ENDIAN__)
 202 #    if    defined(__LITTLE_ENDIAN__) && !defined(__BIG_ENDIAN__)
 203 #      define PLATFORM_BYTE_ORDER BRG_LITTLE_ENDIAN
 204 #    elif !defined(__LITTLE_ENDIAN__) &&  defined(__BIG_ENDIAN__)
 205 #      define PLATFORM_BYTE_ORDER BRG_BIG_ENDIAN
 206 #    elif defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __LITTLE_ENDIAN__)
 207 #      define PLATFORM_BYTE_ORDER BRG_LITTLE_ENDIAN
 208 #    elif defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __BIG_ENDIAN__)
 209 #      define PLATFORM_BYTE_ORDER BRG_BIG_ENDIAN
 210 #    endif
 211 #  endif
 212 #endif
 213
 214 /*  if the platform is still unknown, try to find its byte order    */
 215 /*  from commonly used machine defines                              */
 216
 217 #if !defined(PLATFORM_BYTE_ORDER)
 218
 219 #if   defined( __alpha__ ) || defined( __alpha ) || defined( i386 )       || \
 220       defined( __i386__ )  || defined( _M_I86 )  || defined( _M_IX86 )    || \
 221       defined( __OS2__ )   || defined( sun386 )  || defined( __TURBOC__ ) || \
 222       defined( vax )       || defined( vms )     || defined( VMS )        || \
 223       defined( __VMS )
 224 #  define PLATFORM_BYTE_ORDER BRG_LITTLE_ENDIAN
 225
 226 #elif defined( AMIGA )    || defined( applec )  || defined( __AS400__ )  || \
 227       defined( _CRAY )    || defined( __hppa )  || defined( __hp9000 )   || \
 228       defined( ibm370 )   || defined( mc68000 ) || defined( m68k )       || \
 229       defined( __MRC__ )  || defined( __MVS__ ) || defined( __MWERKS__ ) || \
 230       defined( sparc )    || defined( __sparc)  || defined( SYMANTEC_C ) || \
 231       defined( __TANDEM ) || defined( THINK_C ) || defined( __VMCMS__ )
 232 #  define PLATFORM_BYTE_ORDER BRG_BIG_ENDIAN
 233
 234 #elif 0     /* **** EDIT HERE IF NECESSARY **** */
 235 #  define PLATFORM_BYTE_ORDER BRG_LITTLE_ENDIAN
 236 #elif 0     /* **** EDIT HERE IF NECESSARY **** */
 237 #  define PLATFORM_BYTE_ORDER BRG_BIG_ENDIAN
 238 #else
 239 #  error Please edit aesopt.h (line 234 or 236) to set the platform byte order
 240 #endif
 241
 242 #endif
 243
 244 /*  SOME LOCAL DEFINITIONS  */
 245
 246 #define NO_TABLES              0
 247 #define ONE_TABLE              1
 248 #define FOUR_TABLES            4
 249 #define NONE                   0
 250 #define PARTIAL                1
 251 #define FULL                   2
 252
 253 #if defined(bswap32)
 254 #define aes_sw32    bswap32
 255 #elif defined(bswap_32)
 256 #define aes_sw32    bswap_32
 257 #else
 258 #define brot(x,n)   (((aes_32t)(x) <<  n) | ((aes_32t)(x) >> (32 - n)))
 259 #define aes_sw32(x) ((brot((x),8) & 0x00ff00ff) | (brot((x),24) & 0xff00ff00))
 260 #endif
 261
 262 /*  1. FUNCTIONS REQUIRED
 263
 264     This implementation provides subroutines for encryption, decryption
 265     and for setting the three key lengths (separately) for encryption
 266     and decryption. When the assembler code is not being used the following
 267     definition blocks allow the selection of the routines that are to be
 268     included in the compilation.
 269 */
 270 #if defined( AES_ENCRYPT )
 271 #define ENCRYPTION
 272 #define ENCRYPTION_KEY_SCHEDULE
 273 #endif
 274
 275 #if defined( AES_DECRYPT )
 276 #define DECRYPTION
 277 #define DECRYPTION_KEY_SCHEDULE
 278 #endif
 279
 280 /*  2. ASSEMBLER SUPPORT
 281
 282     This define (which can be on the command line) enables the use of the
 283     assembler code routines for encryption and decryption with the C code
 284     only providing key scheduling
 285 */
 286
 287 /*  3. BYTE ORDER WITHIN 32 BIT WORDS
 288
 289     The fundamental data processing units in Rijndael are 8-bit bytes. The
 290     input, output and key input are all enumerated arrays of bytes in which
 291     bytes are numbered starting at zero and increasing to one less than the
 292     number of bytes in the array in question. This enumeration is only used
 293     for naming bytes and does not imply any adjacency or order relationship
 294     from one byte to another. When these inputs and outputs are considered
 295     as bit sequences, bits 8*n to 8*n+7 of the bit sequence are mapped to
 296     byte[n] with bit 8n+i in the sequence mapped to bit 7-i within the byte.
 297     In this implementation bits are numbered from 0 to 7 starting at the
 298     numerically least significant end of each byte (bit n represents 2^n).
 299
 300     However, Rijndael can be implemented more efficiently using 32-bit
 301     words by packing bytes into words so that bytes 4*n to 4*n+3 are placed
 302     into word[n]. While in principle these bytes can be assembled into words
 303     in any positions, this implementation only supports the two formats in
 304     which bytes in adjacent positions within words also have adjacent byte
 305     numbers. This order is called big-endian if the lowest numbered bytes
 306     in words have the highest numeric significance and little-endian if the
 307     opposite applies.
 308
 309     This code can work in either order irrespective of the order used by the
 310     machine on which it runs. Normally the internal byte order will be set
 311     to the order of the processor on which the code is to be run but this
 312     define can be used to reverse this in special situations
 313
 314     NOTE: Assembler code versions rely on PLATFORM_BYTE_ORDER being set
 315 */
 316 #define ALGORITHM_BYTE_ORDER PLATFORM_BYTE_ORDER
 317
 318 /*  4. FAST INPUT/OUTPUT OPERATIONS.
 319
 320     On some machines it is possible to improve speed by transferring the
 321     bytes in the input and output arrays to and from the internal 32-bit
 322     variables by addressing these arrays as if they are arrays of 32-bit
 323     words.  On some machines this will always be possible but there may
 324     be a large performance penalty if the byte arrays are not aligned on
 325     the normal word boundaries. On other machines this technique will
 326     lead to memory access errors when such 32-bit word accesses are not
 327     properly aligned. The option SAFE_IO avoids such problems but will
 328     often be slower on those machines that support misaligned access
 329     (especially so if care is taken to align the input  and output byte
 330     arrays on 32-bit word boundaries). If SAFE_IO is not defined it is
 331     assumed that access to byte arrays as if they are arrays of 32-bit
 332     words will not cause problems when such accesses are misaligned.
 333 */
 334
 335 /*  5. LOOP UNROLLING
 336
 337     The code for encryption and decrytpion cycles through a number of rounds
 338     that can be implemented either in a loop or by expanding the code into a
 339     long sequence of instructions, the latter producing a larger program but
 340     one that will often be much faster. The latter is called loop unrolling.
 341     There are also potential speed advantages in expanding two iterations in
 342     a loop with half the number of iterations, which is called partial loop
 343     unrolling.  The following options allow partial or full loop unrolling
 344     to be set independently for encryption and decryption
 345 */
 346 #if 1
 347 #define ENC_UNROLL  FULL
 348 #elif 0
 349 #define ENC_UNROLL  PARTIAL
 350 #else
 351 #define ENC_UNROLL  NONE
 352 #endif
 353
 354 #if 1
 355 #define DEC_UNROLL  FULL
 356 #elif 0
 357 #define DEC_UNROLL  PARTIAL
 358 #else
 359 #define DEC_UNROLL  NONE
 360 #endif
 361
 362 /*  6. FAST FINITE FIELD OPERATIONS
 363
 364     If this section is included, tables are used to provide faster finite
 365     field arithmetic (this has no effect if FIXED_TABLES is defined).
 366 */
 367 #if 1
 368 #define FF_TABLES
 369 #endif
 370
 371 /*  7. INTERNAL STATE VARIABLE FORMAT
 372
 373     The internal state of Rijndael is stored in a number of local 32-bit
 374     word varaibles which can be defined either as an array or as individual
 375     names variables. Include this section if you want to store these local
 376     varaibles in arrays. Otherwise individual local variables will be used.
 377 */
 378 #if 0
 379 #define ARRAYS
 380 #endif
 381
 382 /* In this implementation the columns of the state array are each held in
 383    32-bit words. The state array can be held in various ways: in an array
 384    of words, in a number of individual word variables or in a number of
 385    processor registers. The following define maps a variable name x and
 386    a column number c to the way the state array variable is to be held.
 387    The first define below maps the state into an array x[c] whereas the
 388    second form maps the state into a number of individual variables x0,
 389    x1, etc.  Another form could map individual state colums to machine
 390    register names.
 391 */
 392
 393 #if defined(ARRAYS)
 394 #define s(x,c) x[c]
 395 #else
 396 #define s(x,c) x##c
 397 #endif
 398
 399 /*  8. FIXED OR DYNAMIC TABLES
 400
 401     When this section is included the tables used by the code are compiled
 402     statically into the binary file.  Otherwise the subroutine gen_tabs()
 403     must be called to compute them before the code is first used.
 404 */
 405 #if 1
 406 #define FIXED_TABLES
 407 #endif
 408
 409 /*  9. TABLE ALIGNMENT
 410
 411     On some sytsems speed will be improved by aligning the AES large lookup
 412     tables on particular boundaries. This define should be set to a power of
 413     two giving the desired alignment. It can be left undefined if alignment
 414     is not needed.  This option is specific to the Microsft VC++ compiler -
 415     it seems to sometimes cause trouble for the VC++ version 6 compiler.
 416 */
 417
 418
 419 /*  10. INTERNAL TABLE CONFIGURATION
 420
 421     This cipher proceeds by repeating in a number of cycles known as 'rounds'
 422     which are implemented by a round function which can optionally be speeded
 423     up using tables.  The basic tables are each 256 32-bit words, with either
 424     one or four tables being required for each round function depending on
 425     how much speed is required. The encryption and decryption round functions
 426     are different and the last encryption and decrytpion round functions are
 427     different again making four different round functions in all.
 428
 429     This means that:
 430       1. Normal encryption and decryption rounds can each use either 0, 1
 431          or 4 tables and table spaces of 0, 1024 or 4096 bytes each.
 432       2. The last encryption and decryption rounds can also use either 0, 1
 433          or 4 tables and table spaces of 0, 1024 or 4096 bytes each.
 434
 435     Include or exclude the appropriate definitions below to set the number
 436     of tables used by this implementation.
 437 */
 438
 439 #if 1   /* set tables for the normal encryption round */
 440 #define ENC_ROUND   FOUR_TABLES
 441 #elif 0
 442 #define ENC_ROUND   ONE_TABLE
 443 #else
 444 #define ENC_ROUND   NO_TABLES
 445 #endif
 446
 447 #if 1   /* set tables for the last encryption round */
 448 #define LAST_ENC_ROUND  FOUR_TABLES
 449 #elif 0
 450 #define LAST_ENC_ROUND  ONE_TABLE
 451 #else
 452 #define LAST_ENC_ROUND  NO_TABLES
 453 #endif
 454
 455 #if 1   /* set tables for the normal decryption round */
 456 #define DEC_ROUND   FOUR_TABLES
 457 #elif 0
 458 #define DEC_ROUND   ONE_TABLE
 459 #else
 460 #define DEC_ROUND   NO_TABLES
 461 #endif
 462
 463 #if 1   /* set tables for the last decryption round */
 464 #define LAST_DEC_ROUND  FOUR_TABLES
 465 #elif 0
 466 #define LAST_DEC_ROUND  ONE_TABLE
 467 #else
 468 #define LAST_DEC_ROUND  NO_TABLES
 469 #endif
 470
 471 /*  The decryption key schedule can be speeded up with tables in the same
 472     way that the round functions can.  Include or exclude the following
 473     defines to set this requirement.
 474 */
 475 #if 1
 476 #define KEY_SCHED   FOUR_TABLES
 477 #elif 0
 478 #define KEY_SCHED   ONE_TABLE
 479 #else
 480 #define KEY_SCHED   NO_TABLES
 481 #endif
 482
 483 /*  11. TABLE POINTER CACHING
 484
 485     Normally tables are referenced directly, Enable this option if you wish to
 486     cache pointers to the tables in the encrypt/decrypt code.  Note that this
 487         only works if you are using FOUR_TABLES for the ROUND you enable this for.
 488 */
 489 #if 1
 490 #define ENC_ROUND_CACHE_TABLES
 491 #endif
 492 #if 1
 493 #define LAST_ENC_ROUND_CACHE_TABLES
 494 #endif
 495 #if 1
 496 #define DEC_ROUND_CACHE_TABLES
 497 #endif
 498 #if 1
 499 #define LAST_DEC_ROUND_CACHE_TABLES
 500 #endif
 501
 502
 503 /* END OF CONFIGURATION OPTIONS */
 504
 505 #define RC_LENGTH   (5 * (AES_BLOCK_SIZE / 4 - 2))
 506
 507 /* Disable or report errors on some combinations of options */
 508
 509 #if ENC_ROUND == NO_TABLES && LAST_ENC_ROUND != NO_TABLES
 510 #undef  LAST_ENC_ROUND
 511 #define LAST_ENC_ROUND  NO_TABLES
 512 #elif ENC_ROUND == ONE_TABLE && LAST_ENC_ROUND == FOUR_TABLES
 513 #undef  LAST_ENC_ROUND
 514 #define LAST_ENC_ROUND  ONE_TABLE
 515 #endif
 516
 517 #if ENC_ROUND == NO_TABLES && ENC_UNROLL != NONE
 518 #undef  ENC_UNROLL
 519 #define ENC_UNROLL  NONE
 520 #endif
 521
 522 #if DEC_ROUND == NO_TABLES && LAST_DEC_ROUND != NO_TABLES
 523 #undef  LAST_DEC_ROUND
 524 #define LAST_DEC_ROUND  NO_TABLES
 525 #elif DEC_ROUND == ONE_TABLE && LAST_DEC_ROUND == FOUR_TABLES
 526 #undef  LAST_DEC_ROUND
 527 #define LAST_DEC_ROUND  ONE_TABLE
 528 #endif
 529
 530 #if DEC_ROUND == NO_TABLES && DEC_UNROLL != NONE
 531 #undef  DEC_UNROLL
 532 #define DEC_UNROLL  NONE
 533 #endif
 534
 535 /*  upr(x,n):  rotates bytes within words by n positions, moving bytes to
 536                higher index positions with wrap around into low positions
 537     ups(x,n):  moves bytes by n positions to higher index positions in
 538                words but without wrap around
 539     bval(x,n): extracts a byte from a word
 540
 541     NOTE:      The definitions given here are intended only for use with
 542                unsigned variables and with shift counts that are compile
 543                time constants
 544 */
 545
 546 #if (ALGORITHM_BYTE_ORDER == BRG_LITTLE_ENDIAN)
 547 #define upr(x,n)        (((aes_32t)(x) << (8 * (n))) | ((aes_32t)(x) >> (32 - 8 * (n))))
 548 #define ups(x,n)        ((aes_32t) (x) << (8 * (n)))
 549 #define bval(x,n)       ((aes_08t)((x) >> (8 * (n))))
 550 #define bytes2word(b0, b1, b2, b3)  \
 551         (((aes_32t)(b3) << 24) | ((aes_32t)(b2) << 16) | ((aes_32t)(b1) << 8) | (b0))
 552 #endif
 553
 554 #if (ALGORITHM_BYTE_ORDER == BRG_BIG_ENDIAN)
 555 #define upr(x,n)        (((aes_32t)(x) >> (8 * (n))) | ((aes_32t)(x) << (32 - 8 * (n))))
 556 #define ups(x,n)        ((aes_32t) (x) >> (8 * (n))))
 557 #define bval(x,n)       ((aes_08t)((x) >> (24 - 8 * (n))))
 558 #define bytes2word(b0, b1, b2, b3)  \
 559         (((aes_32t)(b0) << 24) | ((aes_32t)(b1) << 16) | ((aes_32t)(b2) << 8) | (b3))
 560 #endif
 561
 562 #if defined(SAFE_IO)
 563
 564 #define word_in(x,c)    bytes2word(((aes_08t*)(x)+4*c)[0], ((aes_08t*)(x)+4*c)[1], \
 565                                    ((aes_08t*)(x)+4*c)[2], ((aes_08t*)(x)+4*c)[3])
 566 #define word_out(x,c,v) { ((aes_08t*)(x)+4*c)[0] = bval(v,0); ((aes_08t*)(x)+4*c)[1] = bval(v,1); \
 567                           ((aes_08t*)(x)+4*c)[2] = bval(v,2); ((aes_08t*)(x)+4*c)[3] = bval(v,3); }
 568
 569 #elif (ALGORITHM_BYTE_ORDER == PLATFORM_BYTE_ORDER)
 570
 571 #define word_in(x,c)    (*((const aes_32t*)(x)+(c)))
 572 #define word_out(x,c,v) (*((aes_32t*)(x)+(c)) = (v))
 573
 574 #else
 575
 576 #define word_in(x,c)    aes_sw32(*((const aes_32t*)(x)+(c)))
 577 #define word_out(x,c,v) (*((aes_32t*)(x)+(c)) = aes_sw32(v))
 578
 579 #endif
 580
 581 /* the finite field modular polynomial and elements */
 582
 583 #define WPOLY   0x011b
 584 #define BPOLY     0x1b
 585
 586 /* multiply four bytes in GF(2^8) by 'x' {02} in parallel */
 587
 588 #define m1  0x80808080
 589 #define m2  0x7f7f7f7f
 590 #define gf_mulx(x)  ((((x) & m2) << 1) ^ ((((x) & m1) >> 7) * BPOLY))
 591
 592 /* The following defines provide alternative definitions of gf_mulx that might
 593    give improved performance if a fast 32-bit multiply is not available. Note
 594    that a temporary variable u needs to be defined where gf_mulx is used.
 595
 596 #define gf_mulx(x) (u = (x) & m1, u |= (u >> 1), ((x) & m2) << 1) ^ ((u >> 3) | (u >> 6))
 597 #define m4  (0x01010101 * BPOLY)
 598 #define gf_mulx(x) (u = (x) & m1, ((x) & m2) << 1) ^ ((u - (u >> 7)) & m4)
 599 */
 600
 601 /* Work out which tables are needed for the different options   */
 602
 603 #if defined( AES_ASM )
 604 #if defined( ENC_ROUND )
 605 #undef  ENC_ROUND
 606 #endif
 607 #define ENC_ROUND   FOUR_TABLES
 608 #if defined( LAST_ENC_ROUND )
 609 #undef  LAST_ENC_ROUND
 610 #endif
 611 #define LAST_ENC_ROUND  FOUR_TABLES
 612 #if defined( DEC_ROUND )
 613 #undef  DEC_ROUND
 614 #endif
 615 #define DEC_ROUND   FOUR_TABLES
 616 #if defined( LAST_DEC_ROUND )
 617 #undef  LAST_DEC_ROUND
 618 #endif
 619 #define LAST_DEC_ROUND  FOUR_TABLES
 620 #if defined( KEY_SCHED )
 621 #undef  KEY_SCHED
 622 #define KEY_SCHED   FOUR_TABLES
 623 #endif
 624 #endif
 625
 626 #if defined(ENCRYPTION) || defined(AES_ASM)
 627 #if ENC_ROUND == ONE_TABLE
 628 #define FT1_SET
 629 #elif ENC_ROUND == FOUR_TABLES
 630 #define FT4_SET
 631 #else
 632 #define SBX_SET
 633 #endif
 634 #if LAST_ENC_ROUND == ONE_TABLE
 635 #define FL1_SET
 636 #elif LAST_ENC_ROUND == FOUR_TABLES
 637 #define FL4_SET
 638 #elif !defined(SBX_SET)
 639 #define SBX_SET
 640 #endif
 641 #endif
 642
 643 #if defined(DECRYPTION) || defined(AES_ASM)
 644 #if DEC_ROUND == ONE_TABLE
 645 #define IT1_SET
 646 #elif DEC_ROUND == FOUR_TABLES
 647 #define IT4_SET
 648 #else
 649 #define ISB_SET
 650 #endif
 651 #if LAST_DEC_ROUND == ONE_TABLE
 652 #define IL1_SET
 653 #elif LAST_DEC_ROUND == FOUR_TABLES
 654 #define IL4_SET
 655 #elif !defined(ISB_SET)
 656 #define ISB_SET
 657 #endif
 658 #endif
 659
 660 #if defined(ENCRYPTION_KEY_SCHEDULE) || defined(DECRYPTION_KEY_SCHEDULE)
 661 #if KEY_SCHED == ONE_TABLE
 662 #define LS1_SET
 663 #define IM1_SET
 664 #elif KEY_SCHED == FOUR_TABLES
 665 #define LS4_SET
 666 #define IM4_SET
 667 #elif !defined(SBX_SET)
 668 #define SBX_SET
 669 #endif
 670 #endif
 671
 672 /* generic definitions of Rijndael macros that use tables    */
 673
 674 #define no_table(x,box,vf,rf,c) bytes2word( \
 675     box[bval(vf(x,0,c),rf(0,c))], \
 676     box[bval(vf(x,1,c),rf(1,c))], \
 677     box[bval(vf(x,2,c),rf(2,c))], \
 678     box[bval(vf(x,3,c),rf(3,c))])
 679
 680 #define one_table(x,op,tab,vf,rf,c) \
 681  (     tab[bval(vf(x,0,c),rf(0,c))] \
 682   ^ op(tab[bval(vf(x,1,c),rf(1,c))],1) \
 683   ^ op(tab[bval(vf(x,2,c),rf(2,c))],2) \
 684   ^ op(tab[bval(vf(x,3,c),rf(3,c))],3))
 685
 686 #define four_tables(x,tab,vf,rf,c) \
 687  (  tab[0][bval(vf(x,0,c),rf(0,c))] \
 688   ^ tab[1][bval(vf(x,1,c),rf(1,c))] \
 689   ^ tab[2][bval(vf(x,2,c),rf(2,c))] \
 690   ^ tab[3][bval(vf(x,3,c),rf(3,c))])
 691
 692 #define four_cached_tables(x,tab,vf,rf,c) \
 693 (  tab##0[bval(vf(x,0,c),rf(0,c))] \
 694    ^ tab##1[bval(vf(x,1,c),rf(1,c))] \
 695    ^ tab##2[bval(vf(x,2,c),rf(2,c))] \
 696    ^ tab##3[bval(vf(x,3,c),rf(3,c))])
 697
 698 #define vf1(x,r,c)  (x)
 699 #define rf1(r,c)    (r)
 700 #define rf2(r,c)    ((8+r-c)&3)
 701
 702 /* perform forward and inverse column mix operation on four bytes in long word x in */
 703 /* parallel. NOTE: x must be a simple variable, NOT an expression in these macros.  */
 704
 705 #if defined(FM4_SET)    /* not currently used */
 706 #define fwd_mcol(x)     four_tables(x,t_use(f,m),vf1,rf1,0)
 707 #elif defined(FM1_SET)  /* not currently used */
 708 #define fwd_mcol(x)     one_table(x,upr,t_use(f,m),vf1,rf1,0)
 709 #else
 710 #define dec_fmvars      aes_32t g2
 711 #define fwd_mcol(x)     (g2 = gf_mulx(x), g2 ^ upr((x) ^ g2, 3) ^ upr((x), 2) ^ upr((x), 1))
 712 #endif
 713
 714 #if defined(IM4_SET)
 715 #define inv_mcol(x)     four_tables(x,t_use(i,m),vf1,rf1,0)
 716 #elif defined(IM1_SET)
 717 #define inv_mcol(x)     one_table(x,upr,t_use(i,m),vf1,rf1,0)
 718 #else
 719 #define dec_imvars      aes_32t g2, g4, g9
 720 #define inv_mcol(x)     (g2 = gf_mulx(x), g4 = gf_mulx(g2), g9 = (x) ^ gf_mulx(g4), g4 ^= g9, \
 721                         (x) ^ g2 ^ g4 ^ upr(g2 ^ g9, 3) ^ upr(g4, 2) ^ upr(g9, 1))
 722 #endif
 723
 724 #if defined(FL4_SET)
 725 #define ls_box(x,c)     four_tables(x,t_use(f,l),vf1,rf2,c)
 726 #elif   defined(LS4_SET)
 727 #define ls_box(x,c)     four_tables(x,t_use(l,s),vf1,rf2,c)
 728 #elif defined(FL1_SET)
 729 #define ls_box(x,c)     one_table(x,upr,t_use(f,l),vf1,rf2,c)
 730 #elif defined(LS1_SET)
 731 #define ls_box(x,c)     one_table(x,upr,t_use(l,s),vf1,rf2,c)
 732 #else
 733 #define ls_box(x,c)     no_table(x,t_use(s,box),vf1,rf2,c)
 734 #endif
 735
 736 #endif