-/*\r
- ---------------------------------------------------------------------------\r
- Copyright (c) 2003, Dr Brian Gladman, Worcester, UK. All rights reserved.\r
-\r
- LICENSE TERMS\r
-\r
- The free distribution and use of this software in both source and binary\r
- form is allowed (with or without changes) provided that:\r
-\r
- 1. distributions of this source code include the above copyright\r
- notice, this list of conditions and the following disclaimer;\r
-\r
- 2. distributions in binary form include the above copyright\r
- notice, this list of conditions and the following disclaimer\r
- in the documentation and/or other associated materials;\r
-\r
- 3. the copyright holder's name is not used to endorse products\r
- built using this software without specific written permission.\r
-\r
- ALTERNATIVELY, provided that this notice is retained in full, this product\r
- may be distributed under the terms of the GNU General Public License (GPL),\r
- in which case the provisions of the GPL apply INSTEAD OF those given above.\r
-\r
- DISCLAIMER\r
-\r
- This software is provided 'as is' with no explicit or implied warranties\r
- in respect of its properties, including, but not limited to, correctness\r
- and/or fitness for purpose.\r
- ---------------------------------------------------------------------------\r
- Issue Date: 26/08/2003\r
-\r
- This file contains the code for implementing the key schedule for AES\r
- (Rijndael) for block and key sizes of 16, 24, and 32 bytes. See aesopt.h\r
- for further details including optimisation.\r
-*/\r
-\r
-#include "aesopt.h"\r
-#include "aestab.h"\r
-\r
-#if defined(__cplusplus)\r
-extern "C"\r
-{\r
-#endif\r
-\r
-/* Initialise the key schedule from the user supplied key. The key\r
- length can be specified in bytes, with legal values of 16, 24\r
- and 32, or in bits, with legal values of 128, 192 and 256. These\r
- values correspond with Nk values of 4, 6 and 8 respectively.\r
-\r
- The following macros implement a single cycle in the key\r
- schedule generation process. The number of cycles needed\r
- for each cx->n_col and nk value is:\r
-\r
- nk = 4 5 6 7 8\r
- ------------------------------\r
- cx->n_col = 4 10 9 8 7 7\r
- cx->n_col = 5 14 11 10 9 9\r
- cx->n_col = 6 19 15 12 11 11\r
- cx->n_col = 7 21 19 16 13 14\r
- cx->n_col = 8 29 23 19 17 14\r
-*/\r
-\r
-#define ke4(k,i) \\r
-{ k[4*(i)+4] = ss[0] ^= ls_box(ss[3],3) ^ t_use(r,c)[i]; k[4*(i)+5] = ss[1] ^= ss[0]; \\r
- k[4*(i)+6] = ss[2] ^= ss[1]; k[4*(i)+7] = ss[3] ^= ss[2]; \\r
-}\r
-#define kel4(k,i) \\r
-{ k[4*(i)+4] = ss[0] ^= ls_box(ss[3],3) ^ t_use(r,c)[i]; k[4*(i)+5] = ss[1] ^= ss[0]; \\r
- k[4*(i)+6] = ss[2] ^= ss[1]; k[4*(i)+7] = ss[3] ^= ss[2]; \\r
-}\r
-\r
-#define ke6(k,i) \\r
-{ k[6*(i)+ 6] = ss[0] ^= ls_box(ss[5],3) ^ t_use(r,c)[i]; k[6*(i)+ 7] = ss[1] ^= ss[0]; \\r
- k[6*(i)+ 8] = ss[2] ^= ss[1]; k[6*(i)+ 9] = ss[3] ^= ss[2]; \\r
- k[6*(i)+10] = ss[4] ^= ss[3]; k[6*(i)+11] = ss[5] ^= ss[4]; \\r
-}\r
-#define kel6(k,i) \\r
-{ k[6*(i)+ 6] = ss[0] ^= ls_box(ss[5],3) ^ t_use(r,c)[i]; k[6*(i)+ 7] = ss[1] ^= ss[0]; \\r
- k[6*(i)+ 8] = ss[2] ^= ss[1]; k[6*(i)+ 9] = ss[3] ^= ss[2]; \\r
-}\r
-\r
-#define ke8(k,i) \\r
-{ k[8*(i)+ 8] = ss[0] ^= ls_box(ss[7],3) ^ t_use(r,c)[i]; k[8*(i)+ 9] = ss[1] ^= ss[0]; \\r
- k[8*(i)+10] = ss[2] ^= ss[1]; k[8*(i)+11] = ss[3] ^= ss[2]; \\r
- k[8*(i)+12] = ss[4] ^= ls_box(ss[3],0); k[8*(i)+13] = ss[5] ^= ss[4]; \\r
- k[8*(i)+14] = ss[6] ^= ss[5]; k[8*(i)+15] = ss[7] ^= ss[6]; \\r
-}\r
-#define kel8(k,i) \\r
-{ k[8*(i)+ 8] = ss[0] ^= ls_box(ss[7],3) ^ t_use(r,c)[i]; k[8*(i)+ 9] = ss[1] ^= ss[0]; \\r
- k[8*(i)+10] = ss[2] ^= ss[1]; k[8*(i)+11] = ss[3] ^= ss[2]; \\r
-}\r
-\r
-#if defined(ENCRYPTION_KEY_SCHEDULE)\r
-\r
-#if defined(AES_128) || defined(AES_VAR)\r
-\r
-aes_rval aes_encrypt_key128(const unsigned char *key, aes_encrypt_ctx cx[1])\r
-{ aes_32t ss[4];\r
-\r
- cx->ks[0] = ss[0] = word_in(key, 0);\r
- cx->ks[1] = ss[1] = word_in(key, 1);\r
- cx->ks[2] = ss[2] = word_in(key, 2);\r
- cx->ks[3] = ss[3] = word_in(key, 3);\r
-\r
-#if ENC_UNROLL == NONE\r
- { aes_32t i;\r
-\r
- for(i = 0; i < ((11 * N_COLS - 5) / 4); ++i)\r
- ke4(cx->ks, i);\r
- }\r
-#else\r
- ke4(cx->ks, 0); ke4(cx->ks, 1);\r
- ke4(cx->ks, 2); ke4(cx->ks, 3);\r
- ke4(cx->ks, 4); ke4(cx->ks, 5);\r
- ke4(cx->ks, 6); ke4(cx->ks, 7);\r
- ke4(cx->ks, 8);\r
-#endif\r
- kel4(cx->ks, 9);\r
- cx->rn = 10;\r
-#if defined( AES_ERR_CHK )\r
- return aes_good;\r
-#endif\r
-}\r
-\r
-#endif\r
-\r
-#if defined(AES_192) || defined(AES_VAR)\r
-\r
-aes_rval aes_encrypt_key192(const unsigned char *key, aes_encrypt_ctx cx[1])\r
-{ aes_32t ss[6];\r
-\r
- cx->ks[0] = ss[0] = word_in(key, 0);\r
- cx->ks[1] = ss[1] = word_in(key, 1);\r
- cx->ks[2] = ss[2] = word_in(key, 2);\r
- cx->ks[3] = ss[3] = word_in(key, 3);\r
- cx->ks[4] = ss[4] = word_in(key, 4);\r
- cx->ks[5] = ss[5] = word_in(key, 5);\r
-\r
-#if ENC_UNROLL == NONE\r
- { aes_32t i;\r
-\r
- for(i = 0; i < (13 * N_COLS - 7) / 6; ++i)\r
- ke6(cx->ks, i);\r
- }\r
-#else\r
- ke6(cx->ks, 0); ke6(cx->ks, 1);\r
- ke6(cx->ks, 2); ke6(cx->ks, 3);\r
- ke6(cx->ks, 4); ke6(cx->ks, 5);\r
- ke6(cx->ks, 6);\r
-#endif\r
- kel6(cx->ks, 7);\r
- cx->rn = 12;\r
-#if defined( AES_ERR_CHK )\r
- return aes_good;\r
-#endif\r
-}\r
-\r
-#endif\r
-\r
-#if defined(AES_256) || defined(AES_VAR)\r
-\r
-aes_rval aes_encrypt_key256(const unsigned char *key, aes_encrypt_ctx cx[1])\r
-{ aes_32t ss[8];\r
-\r
- cx->ks[0] = ss[0] = word_in(key, 0);\r
- cx->ks[1] = ss[1] = word_in(key, 1);\r
- cx->ks[2] = ss[2] = word_in(key, 2);\r
- cx->ks[3] = ss[3] = word_in(key, 3);\r
- cx->ks[4] = ss[4] = word_in(key, 4);\r
- cx->ks[5] = ss[5] = word_in(key, 5);\r
- cx->ks[6] = ss[6] = word_in(key, 6);\r
- cx->ks[7] = ss[7] = word_in(key, 7);\r
-\r
-#if ENC_UNROLL == NONE\r
- { aes_32t i;\r
-\r
- for(i = 0; i < (15 * N_COLS - 9) / 8; ++i)\r
- ke8(cx->ks, i);\r
- }\r
-#else\r
- ke8(cx->ks, 0); ke8(cx->ks, 1);\r
- ke8(cx->ks, 2); ke8(cx->ks, 3);\r
- ke8(cx->ks, 4); ke8(cx->ks, 5);\r
-#endif\r
- kel8(cx->ks, 6);\r
- cx->rn = 14;\r
-#if defined( AES_ERR_CHK )\r
- return aes_good;\r
-#endif\r
-}\r
-\r
-#endif\r
-\r
-#if defined(AES_VAR)\r
-\r
-aes_rval aes_encrypt_key(const unsigned char *key, int key_len, aes_encrypt_ctx cx[1])\r
-{\r
- switch(key_len)\r
- {\r
-#if defined( AES_ERR_CHK )\r
- case 16: case 128: return aes_encrypt_key128(key, cx);\r
- case 24: case 192: return aes_encrypt_key192(key, cx);\r
- case 32: case 256: return aes_encrypt_key256(key, cx);\r
- default: return aes_error;\r
-#else\r
- case 16: case 128: aes_encrypt_key128(key, cx); return;\r
- case 24: case 192: aes_encrypt_key192(key, cx); return;\r
- case 32: case 256: aes_encrypt_key256(key, cx); return;\r
-#endif\r
- }\r
-}\r
-\r
-#endif\r
-\r
-#endif\r
-\r
-#if defined(DECRYPTION_KEY_SCHEDULE)\r
-\r
-#if DEC_ROUND == NO_TABLES\r
-#define ff(x) (x)\r
-#else\r
-#define ff(x) inv_mcol(x)\r
-#if defined( dec_imvars )\r
-#define d_vars dec_imvars\r
-#endif\r
-#endif\r
-\r
-#if 1\r
-#define kdf4(k,i) \\r
-{ ss[0] = ss[0] ^ ss[2] ^ ss[1] ^ ss[3]; ss[1] = ss[1] ^ ss[3]; ss[2] = ss[2] ^ ss[3]; ss[3] = ss[3]; \\r
- ss[4] = ls_box(ss[(i+3) % 4], 3) ^ t_use(r,c)[i]; ss[i % 4] ^= ss[4]; \\r
- ss[4] ^= k[4*(i)]; k[4*(i)+4] = ff(ss[4]); ss[4] ^= k[4*(i)+1]; k[4*(i)+5] = ff(ss[4]); \\r
- ss[4] ^= k[4*(i)+2]; k[4*(i)+6] = ff(ss[4]); ss[4] ^= k[4*(i)+3]; k[4*(i)+7] = ff(ss[4]); \\r
-}\r
-#define kd4(k,i) \\r
-{ ss[4] = ls_box(ss[(i+3) % 4], 3) ^ t_use(r,c)[i]; ss[i % 4] ^= ss[4]; ss[4] = ff(ss[4]); \\r
- k[4*(i)+4] = ss[4] ^= k[4*(i)]; k[4*(i)+5] = ss[4] ^= k[4*(i)+1]; \\r
- k[4*(i)+6] = ss[4] ^= k[4*(i)+2]; k[4*(i)+7] = ss[4] ^= k[4*(i)+3]; \\r
-}\r
-#define kdl4(k,i) \\r
-{ ss[4] = ls_box(ss[(i+3) % 4], 3) ^ t_use(r,c)[i]; ss[i % 4] ^= ss[4]; \\r
- k[4*(i)+4] = (ss[0] ^= ss[1]) ^ ss[2] ^ ss[3]; k[4*(i)+5] = ss[1] ^ ss[3]; \\r
- k[4*(i)+6] = ss[0]; k[4*(i)+7] = ss[1]; \\r
-}\r
-#else\r
-#define kdf4(k,i) \\r
-{ ss[0] ^= ls_box(ss[3],3) ^ t_use(r,c)[i]; k[4*(i)+ 4] = ff(ss[0]); ss[1] ^= ss[0]; k[4*(i)+ 5] = ff(ss[1]); \\r
- ss[2] ^= ss[1]; k[4*(i)+ 6] = ff(ss[2]); ss[3] ^= ss[2]; k[4*(i)+ 7] = ff(ss[3]); \\r
-}\r
-#define kd4(k,i) \\r
-{ ss[4] = ls_box(ss[3],3) ^ t_use(r,c)[i]; \\r
- ss[0] ^= ss[4]; ss[4] = ff(ss[4]); k[4*(i)+ 4] = ss[4] ^= k[4*(i)]; \\r
- ss[1] ^= ss[0]; k[4*(i)+ 5] = ss[4] ^= k[4*(i)+ 1]; \\r
- ss[2] ^= ss[1]; k[4*(i)+ 6] = ss[4] ^= k[4*(i)+ 2]; \\r
- ss[3] ^= ss[2]; k[4*(i)+ 7] = ss[4] ^= k[4*(i)+ 3]; \\r
-}\r
-#define kdl4(k,i) \\r
-{ ss[0] ^= ls_box(ss[3],3) ^ t_use(r,c)[i]; k[4*(i)+ 4] = ss[0]; ss[1] ^= ss[0]; k[4*(i)+ 5] = ss[1]; \\r
- ss[2] ^= ss[1]; k[4*(i)+ 6] = ss[2]; ss[3] ^= ss[2]; k[4*(i)+ 7] = ss[3]; \\r
-}\r
-#endif\r
-\r
-#define kdf6(k,i) \\r
-{ ss[0] ^= ls_box(ss[5],3) ^ t_use(r,c)[i]; k[6*(i)+ 6] = ff(ss[0]); ss[1] ^= ss[0]; k[6*(i)+ 7] = ff(ss[1]); \\r
- ss[2] ^= ss[1]; k[6*(i)+ 8] = ff(ss[2]); ss[3] ^= ss[2]; k[6*(i)+ 9] = ff(ss[3]); \\r
- ss[4] ^= ss[3]; k[6*(i)+10] = ff(ss[4]); ss[5] ^= ss[4]; k[6*(i)+11] = ff(ss[5]); \\r
-}\r
-#define kd6(k,i) \\r
-{ ss[6] = ls_box(ss[5],3) ^ t_use(r,c)[i]; \\r
- ss[0] ^= ss[6]; ss[6] = ff(ss[6]); k[6*(i)+ 6] = ss[6] ^= k[6*(i)]; \\r
- ss[1] ^= ss[0]; k[6*(i)+ 7] = ss[6] ^= k[6*(i)+ 1]; \\r
- ss[2] ^= ss[1]; k[6*(i)+ 8] = ss[6] ^= k[6*(i)+ 2]; \\r
- ss[3] ^= ss[2]; k[6*(i)+ 9] = ss[6] ^= k[6*(i)+ 3]; \\r
- ss[4] ^= ss[3]; k[6*(i)+10] = ss[6] ^= k[6*(i)+ 4]; \\r
- ss[5] ^= ss[4]; k[6*(i)+11] = ss[6] ^= k[6*(i)+ 5]; \\r
-}\r
-#define kdl6(k,i) \\r
-{ ss[0] ^= ls_box(ss[5],3) ^ t_use(r,c)[i]; k[6*(i)+ 6] = ss[0]; ss[1] ^= ss[0]; k[6*(i)+ 7] = ss[1]; \\r
- ss[2] ^= ss[1]; k[6*(i)+ 8] = ss[2]; ss[3] ^= ss[2]; k[6*(i)+ 9] = ss[3]; \\r
-}\r
-\r
-#define kdf8(k,i) \\r
-{ ss[0] ^= ls_box(ss[7],3) ^ t_use(r,c)[i]; k[8*(i)+ 8] = ff(ss[0]); ss[1] ^= ss[0]; k[8*(i)+ 9] = ff(ss[1]); \\r
- ss[2] ^= ss[1]; k[8*(i)+10] = ff(ss[2]); ss[3] ^= ss[2]; k[8*(i)+11] = ff(ss[3]); \\r
- ss[4] ^= ls_box(ss[3],0); k[8*(i)+12] = ff(ss[4]); ss[5] ^= ss[4]; k[8*(i)+13] = ff(ss[5]); \\r
- ss[6] ^= ss[5]; k[8*(i)+14] = ff(ss[6]); ss[7] ^= ss[6]; k[8*(i)+15] = ff(ss[7]); \\r
-}\r
-#define kd8(k,i) \\r
-{ aes_32t g = ls_box(ss[7],3) ^ t_use(r,c)[i]; \\r
- ss[0] ^= g; g = ff(g); k[8*(i)+ 8] = g ^= k[8*(i)]; \\r
- ss[1] ^= ss[0]; k[8*(i)+ 9] = g ^= k[8*(i)+ 1]; \\r
- ss[2] ^= ss[1]; k[8*(i)+10] = g ^= k[8*(i)+ 2]; \\r
- ss[3] ^= ss[2]; k[8*(i)+11] = g ^= k[8*(i)+ 3]; \\r
- g = ls_box(ss[3],0); \\r
- ss[4] ^= g; g = ff(g); k[8*(i)+12] = g ^= k[8*(i)+ 4]; \\r
- ss[5] ^= ss[4]; k[8*(i)+13] = g ^= k[8*(i)+ 5]; \\r
- ss[6] ^= ss[5]; k[8*(i)+14] = g ^= k[8*(i)+ 6]; \\r
- ss[7] ^= ss[6]; k[8*(i)+15] = g ^= k[8*(i)+ 7]; \\r
-}\r
-#define kdl8(k,i) \\r
-{ ss[0] ^= ls_box(ss[7],3) ^ t_use(r,c)[i]; k[8*(i)+ 8] = ss[0]; ss[1] ^= ss[0]; k[8*(i)+ 9] = ss[1]; \\r
- ss[2] ^= ss[1]; k[8*(i)+10] = ss[2]; ss[3] ^= ss[2]; k[8*(i)+11] = ss[3]; \\r
-}\r
-\r
-#if defined(AES_128) || defined(AES_VAR)\r
-\r
-aes_rval aes_decrypt_key128(const unsigned char *key, aes_decrypt_ctx cx[1])\r
-{ aes_32t ss[5];\r
-#if defined( d_vars )\r
- d_vars;\r
-#endif\r
- cx->ks[0] = ss[0] = word_in(key, 0);\r
- cx->ks[1] = ss[1] = word_in(key, 1);\r
- cx->ks[2] = ss[2] = word_in(key, 2);\r
- cx->ks[3] = ss[3] = word_in(key, 3);\r
-\r
-#if DEC_UNROLL == NONE\r
- { aes_32t i;\r
-\r
- for(i = 0; i < (11 * N_COLS - 5) / 4; ++i)\r
- ke4(cx->ks, i);\r
- kel4(cx->ks, 9);\r
-#if !(DEC_ROUND == NO_TABLES)\r
- for(i = N_COLS; i < 10 * N_COLS; ++i)\r
- cx->ks[i] = inv_mcol(cx->ks[i]);\r
-#endif\r
- }\r
-#else\r
- kdf4(cx->ks, 0); kd4(cx->ks, 1);\r
- kd4(cx->ks, 2); kd4(cx->ks, 3);\r
- kd4(cx->ks, 4); kd4(cx->ks, 5);\r
- kd4(cx->ks, 6); kd4(cx->ks, 7);\r
- kd4(cx->ks, 8); kdl4(cx->ks, 9);\r
-#endif\r
- cx->rn = 10;\r
-#if defined( AES_ERR_CHK )\r
- return aes_good;\r
-#endif\r
-}\r
-\r
-#endif\r
-\r
-#if defined(AES_192) || defined(AES_VAR)\r
-\r
-aes_rval aes_decrypt_key192(const unsigned char *key, aes_decrypt_ctx cx[1])\r
-{ aes_32t ss[7];\r
-#if defined( d_vars )\r
- d_vars;\r
-#endif\r
- cx->ks[0] = ss[0] = word_in(key, 0);\r
- cx->ks[1] = ss[1] = word_in(key, 1);\r
- cx->ks[2] = ss[2] = word_in(key, 2);\r
- cx->ks[3] = ss[3] = word_in(key, 3);\r
-\r
-#if DEC_UNROLL == NONE\r
- cx->ks[4] = ss[4] = word_in(key, 4);\r
- cx->ks[5] = ss[5] = word_in(key, 5);\r
- { aes_32t i;\r
-\r
- for(i = 0; i < (13 * N_COLS - 7) / 6; ++i)\r
- ke6(cx->ks, i);\r
- kel6(cx->ks, 7);\r
-#if !(DEC_ROUND == NO_TABLES)\r
- for(i = N_COLS; i < 12 * N_COLS; ++i)\r
- cx->ks[i] = inv_mcol(cx->ks[i]);\r
-#endif\r
- }\r
-#else\r
- cx->ks[4] = ff(ss[4] = word_in(key, 4));\r
- cx->ks[5] = ff(ss[5] = word_in(key, 5));\r
- kdf6(cx->ks, 0); kd6(cx->ks, 1);\r
- kd6(cx->ks, 2); kd6(cx->ks, 3);\r
- kd6(cx->ks, 4); kd6(cx->ks, 5);\r
- kd6(cx->ks, 6); kdl6(cx->ks, 7);\r
-#endif\r
- cx->rn = 12;\r
-#if defined( AES_ERR_CHK )\r
- return aes_good;\r
-#endif\r
-}\r
-\r
-#endif\r
-\r
-#if defined(AES_256) || defined(AES_VAR)\r
-\r
-aes_rval aes_decrypt_key256(const unsigned char *key, aes_decrypt_ctx cx[1])\r
-{ aes_32t ss[8];\r
-#if defined( d_vars )\r
- d_vars;\r
-#endif\r
- cx->ks[0] = ss[0] = word_in(key, 0);\r
- cx->ks[1] = ss[1] = word_in(key, 1);\r
- cx->ks[2] = ss[2] = word_in(key, 2);\r
- cx->ks[3] = ss[3] = word_in(key, 3);\r
-\r
-#if DEC_UNROLL == NONE\r
- cx->ks[4] = ss[4] = word_in(key, 4);\r
- cx->ks[5] = ss[5] = word_in(key, 5);\r
- cx->ks[6] = ss[6] = word_in(key, 6);\r
- cx->ks[7] = ss[7] = word_in(key, 7);\r
- { aes_32t i;\r
-\r
- for(i = 0; i < (15 * N_COLS - 9) / 8; ++i)\r
- ke8(cx->ks, i);\r
- kel8(cx->ks, i);\r
-#if !(DEC_ROUND == NO_TABLES)\r
- for(i = N_COLS; i < 14 * N_COLS; ++i)\r
- cx->ks[i] = inv_mcol(cx->ks[i]);\r
-\r
-#endif\r
- }\r
-#else\r
- cx->ks[4] = ff(ss[4] = word_in(key, 4));\r
- cx->ks[5] = ff(ss[5] = word_in(key, 5));\r
- cx->ks[6] = ff(ss[6] = word_in(key, 6));\r
- cx->ks[7] = ff(ss[7] = word_in(key, 7));\r
- kdf8(cx->ks, 0); kd8(cx->ks, 1);\r
- kd8(cx->ks, 2); kd8(cx->ks, 3);\r
- kd8(cx->ks, 4); kd8(cx->ks, 5);\r
- kdl8(cx->ks, 6);\r
-#endif\r
- cx->rn = 14;\r
-#if defined( AES_ERR_CHK )\r
- return aes_good;\r
-#endif\r
-}\r
-\r
-#endif\r
-\r
-#if defined(AES_VAR)\r
-\r
-aes_rval aes_decrypt_key(const unsigned char *key, int key_len, aes_decrypt_ctx cx[1])\r
-{\r
- switch(key_len)\r
- {\r
-#if defined( AES_ERR_CHK )\r
- case 16: case 128: return aes_decrypt_key128(key, cx);\r
- case 24: case 192: return aes_decrypt_key192(key, cx);\r
- case 32: case 256: return aes_decrypt_key256(key, cx);\r
- default: return aes_error;\r
-#else\r
- case 16: case 128: aes_decrypt_key128(key, cx); return;\r
- case 24: case 192: aes_decrypt_key192(key, cx); return;\r
- case 32: case 256: aes_decrypt_key256(key, cx); return;\r
-#endif\r
- }\r
-}\r
-\r
-#endif\r
-\r
-#endif\r
-\r
-#if defined(__cplusplus)\r
-}\r
-#endif\r
+/*
+ ---------------------------------------------------------------------------
+ Copyright (c) 2003, Dr Brian Gladman, Worcester, UK. All rights reserved.
+
+ LICENSE TERMS
+
+ The free distribution and use of this software in both source and binary
+ form is allowed (with or without changes) provided that:
+
+ 1. distributions of this source code include the above copyright
+ notice, this list of conditions and the following disclaimer;
+
+ 2. distributions in binary form include the above copyright
+ notice, this list of conditions and the following disclaimer
+ in the documentation and/or other associated materials;
+
+ 3. the copyright holder's name is not used to endorse products
+ built using this software without specific written permission.
+
+ ALTERNATIVELY, provided that this notice is retained in full, this product
+ may be distributed under the terms of the GNU General Public License (GPL),
+ in which case the provisions of the GPL apply INSTEAD OF those given above.
+
+ DISCLAIMER
+
+ This software is provided 'as is' with no explicit or implied warranties
+ in respect of its properties, including, but not limited to, correctness
+ and/or fitness for purpose.
+ ---------------------------------------------------------------------------
+ Issue Date: 26/08/2003
+
+ This file contains the code for implementing the key schedule for AES
+ (Rijndael) for block and key sizes of 16, 24, and 32 bytes. See aesopt.h
+ for further details including optimisation.
+*/
+
+#include "aesopt.h"
+#include "aestab.h"
+
+#if defined(__cplusplus)
+extern "C"
+{
+#endif
+
+/* Initialise the key schedule from the user supplied key. The key
+ length can be specified in bytes, with legal values of 16, 24
+ and 32, or in bits, with legal values of 128, 192 and 256. These
+ values correspond with Nk values of 4, 6 and 8 respectively.
+
+ The following macros implement a single cycle in the key
+ schedule generation process. The number of cycles needed
+ for each cx->n_col and nk value is:
+
+ nk = 4 5 6 7 8
+ ------------------------------
+ cx->n_col = 4 10 9 8 7 7
+ cx->n_col = 5 14 11 10 9 9
+ cx->n_col = 6 19 15 12 11 11
+ cx->n_col = 7 21 19 16 13 14
+ cx->n_col = 8 29 23 19 17 14
+*/
+
+#define ke4(k,i) \
+{ k[4*(i)+4] = ss[0] ^= ls_box(ss[3],3) ^ t_use(r,c)[i]; k[4*(i)+5] = ss[1] ^= ss[0]; \
+ k[4*(i)+6] = ss[2] ^= ss[1]; k[4*(i)+7] = ss[3] ^= ss[2]; \
+}
+#define kel4(k,i) \
+{ k[4*(i)+4] = ss[0] ^= ls_box(ss[3],3) ^ t_use(r,c)[i]; k[4*(i)+5] = ss[1] ^= ss[0]; \
+ k[4*(i)+6] = ss[2] ^= ss[1]; k[4*(i)+7] = ss[3] ^= ss[2]; \
+}
+
+#define ke6(k,i) \
+{ k[6*(i)+ 6] = ss[0] ^= ls_box(ss[5],3) ^ t_use(r,c)[i]; k[6*(i)+ 7] = ss[1] ^= ss[0]; \
+ k[6*(i)+ 8] = ss[2] ^= ss[1]; k[6*(i)+ 9] = ss[3] ^= ss[2]; \
+ k[6*(i)+10] = ss[4] ^= ss[3]; k[6*(i)+11] = ss[5] ^= ss[4]; \
+}
+#define kel6(k,i) \
+{ k[6*(i)+ 6] = ss[0] ^= ls_box(ss[5],3) ^ t_use(r,c)[i]; k[6*(i)+ 7] = ss[1] ^= ss[0]; \
+ k[6*(i)+ 8] = ss[2] ^= ss[1]; k[6*(i)+ 9] = ss[3] ^= ss[2]; \
+}
+
+#define ke8(k,i) \
+{ k[8*(i)+ 8] = ss[0] ^= ls_box(ss[7],3) ^ t_use(r,c)[i]; k[8*(i)+ 9] = ss[1] ^= ss[0]; \
+ k[8*(i)+10] = ss[2] ^= ss[1]; k[8*(i)+11] = ss[3] ^= ss[2]; \
+ k[8*(i)+12] = ss[4] ^= ls_box(ss[3],0); k[8*(i)+13] = ss[5] ^= ss[4]; \
+ k[8*(i)+14] = ss[6] ^= ss[5]; k[8*(i)+15] = ss[7] ^= ss[6]; \
+}
+#define kel8(k,i) \
+{ k[8*(i)+ 8] = ss[0] ^= ls_box(ss[7],3) ^ t_use(r,c)[i]; k[8*(i)+ 9] = ss[1] ^= ss[0]; \
+ k[8*(i)+10] = ss[2] ^= ss[1]; k[8*(i)+11] = ss[3] ^= ss[2]; \
+}
+
+#if defined(ENCRYPTION_KEY_SCHEDULE)
+
+#if defined(AES_128) || defined(AES_VAR)
+
+aes_rval aes_encrypt_key128(const unsigned char *key, aes_encrypt_ctx cx[1])
+{ aes_32t ss[4];
+
+ cx->ks[0] = ss[0] = word_in(key, 0);
+ cx->ks[1] = ss[1] = word_in(key, 1);
+ cx->ks[2] = ss[2] = word_in(key, 2);
+ cx->ks[3] = ss[3] = word_in(key, 3);
+
+#if ENC_UNROLL == NONE
+ { aes_32t i;
+
+ for(i = 0; i < ((11 * N_COLS - 5) / 4); ++i)
+ ke4(cx->ks, i);
+ }
+#else
+ ke4(cx->ks, 0); ke4(cx->ks, 1);
+ ke4(cx->ks, 2); ke4(cx->ks, 3);
+ ke4(cx->ks, 4); ke4(cx->ks, 5);
+ ke4(cx->ks, 6); ke4(cx->ks, 7);
+ ke4(cx->ks, 8);
+#endif
+ kel4(cx->ks, 9);
+ cx->rn = 10;
+#if defined( AES_ERR_CHK )
+ return aes_good;
+#endif
+}
+
+#endif
+
+#if defined(AES_192) || defined(AES_VAR)
+
+aes_rval aes_encrypt_key192(const unsigned char *key, aes_encrypt_ctx cx[1])
+{ aes_32t ss[6];
+
+ cx->ks[0] = ss[0] = word_in(key, 0);
+ cx->ks[1] = ss[1] = word_in(key, 1);
+ cx->ks[2] = ss[2] = word_in(key, 2);
+ cx->ks[3] = ss[3] = word_in(key, 3);
+ cx->ks[4] = ss[4] = word_in(key, 4);
+ cx->ks[5] = ss[5] = word_in(key, 5);
+
+#if ENC_UNROLL == NONE
+ { aes_32t i;
+
+ for(i = 0; i < (13 * N_COLS - 7) / 6; ++i)
+ ke6(cx->ks, i);
+ }
+#else
+ ke6(cx->ks, 0); ke6(cx->ks, 1);
+ ke6(cx->ks, 2); ke6(cx->ks, 3);
+ ke6(cx->ks, 4); ke6(cx->ks, 5);
+ ke6(cx->ks, 6);
+#endif
+ kel6(cx->ks, 7);
+ cx->rn = 12;
+#if defined( AES_ERR_CHK )
+ return aes_good;
+#endif
+}
+
+#endif
+
+#if defined(AES_256) || defined(AES_VAR)
+
+aes_rval aes_encrypt_key256(const unsigned char *key, aes_encrypt_ctx cx[1])
+{ aes_32t ss[8];
+
+ cx->ks[0] = ss[0] = word_in(key, 0);
+ cx->ks[1] = ss[1] = word_in(key, 1);
+ cx->ks[2] = ss[2] = word_in(key, 2);
+ cx->ks[3] = ss[3] = word_in(key, 3);
+ cx->ks[4] = ss[4] = word_in(key, 4);
+ cx->ks[5] = ss[5] = word_in(key, 5);
+ cx->ks[6] = ss[6] = word_in(key, 6);
+ cx->ks[7] = ss[7] = word_in(key, 7);
+
+#if ENC_UNROLL == NONE
+ { aes_32t i;
+
+ for(i = 0; i < (15 * N_COLS - 9) / 8; ++i)
+ ke8(cx->ks, i);
+ }
+#else
+ ke8(cx->ks, 0); ke8(cx->ks, 1);
+ ke8(cx->ks, 2); ke8(cx->ks, 3);
+ ke8(cx->ks, 4); ke8(cx->ks, 5);
+#endif
+ kel8(cx->ks, 6);
+ cx->rn = 14;
+#if defined( AES_ERR_CHK )
+ return aes_good;
+#endif
+}
+
+#endif
+
+#if defined(AES_VAR)
+
+aes_rval aes_encrypt_key(const unsigned char *key, int key_len, aes_encrypt_ctx cx[1])
+{
+ switch(key_len)
+ {
+#if defined( AES_ERR_CHK )
+ case 16: case 128: return aes_encrypt_key128(key, cx);
+ case 24: case 192: return aes_encrypt_key192(key, cx);
+ case 32: case 256: return aes_encrypt_key256(key, cx);
+ default: return aes_error;
+#else
+ case 16: case 128: aes_encrypt_key128(key, cx); return;
+ case 24: case 192: aes_encrypt_key192(key, cx); return;
+ case 32: case 256: aes_encrypt_key256(key, cx); return;
+#endif
+ }
+}
+
+#endif
+
+#endif
+
+#if defined(DECRYPTION_KEY_SCHEDULE)
+
+#if DEC_ROUND == NO_TABLES
+#define ff(x) (x)
+#else
+#define ff(x) inv_mcol(x)
+#if defined( dec_imvars )
+#define d_vars dec_imvars
+#endif
+#endif
+
+#if 1
+#define kdf4(k,i) \
+{ ss[0] = ss[0] ^ ss[2] ^ ss[1] ^ ss[3]; ss[1] = ss[1] ^ ss[3]; ss[2] = ss[2] ^ ss[3]; ss[3] = ss[3]; \
+ ss[4] = ls_box(ss[(i+3) % 4], 3) ^ t_use(r,c)[i]; ss[i % 4] ^= ss[4]; \
+ ss[4] ^= k[4*(i)]; k[4*(i)+4] = ff(ss[4]); ss[4] ^= k[4*(i)+1]; k[4*(i)+5] = ff(ss[4]); \
+ ss[4] ^= k[4*(i)+2]; k[4*(i)+6] = ff(ss[4]); ss[4] ^= k[4*(i)+3]; k[4*(i)+7] = ff(ss[4]); \
+}
+#define kd4(k,i) \
+{ ss[4] = ls_box(ss[(i+3) % 4], 3) ^ t_use(r,c)[i]; ss[i % 4] ^= ss[4]; ss[4] = ff(ss[4]); \
+ k[4*(i)+4] = ss[4] ^= k[4*(i)]; k[4*(i)+5] = ss[4] ^= k[4*(i)+1]; \
+ k[4*(i)+6] = ss[4] ^= k[4*(i)+2]; k[4*(i)+7] = ss[4] ^= k[4*(i)+3]; \
+}
+#define kdl4(k,i) \
+{ ss[4] = ls_box(ss[(i+3) % 4], 3) ^ t_use(r,c)[i]; ss[i % 4] ^= ss[4]; \
+ k[4*(i)+4] = (ss[0] ^= ss[1]) ^ ss[2] ^ ss[3]; k[4*(i)+5] = ss[1] ^ ss[3]; \
+ k[4*(i)+6] = ss[0]; k[4*(i)+7] = ss[1]; \
+}
+#else
+#define kdf4(k,i) \
+{ ss[0] ^= ls_box(ss[3],3) ^ t_use(r,c)[i]; k[4*(i)+ 4] = ff(ss[0]); ss[1] ^= ss[0]; k[4*(i)+ 5] = ff(ss[1]); \
+ ss[2] ^= ss[1]; k[4*(i)+ 6] = ff(ss[2]); ss[3] ^= ss[2]; k[4*(i)+ 7] = ff(ss[3]); \
+}
+#define kd4(k,i) \
+{ ss[4] = ls_box(ss[3],3) ^ t_use(r,c)[i]; \
+ ss[0] ^= ss[4]; ss[4] = ff(ss[4]); k[4*(i)+ 4] = ss[4] ^= k[4*(i)]; \
+ ss[1] ^= ss[0]; k[4*(i)+ 5] = ss[4] ^= k[4*(i)+ 1]; \
+ ss[2] ^= ss[1]; k[4*(i)+ 6] = ss[4] ^= k[4*(i)+ 2]; \
+ ss[3] ^= ss[2]; k[4*(i)+ 7] = ss[4] ^= k[4*(i)+ 3]; \
+}
+#define kdl4(k,i) \
+{ ss[0] ^= ls_box(ss[3],3) ^ t_use(r,c)[i]; k[4*(i)+ 4] = ss[0]; ss[1] ^= ss[0]; k[4*(i)+ 5] = ss[1]; \
+ ss[2] ^= ss[1]; k[4*(i)+ 6] = ss[2]; ss[3] ^= ss[2]; k[4*(i)+ 7] = ss[3]; \
+}
+#endif
+
+#define kdf6(k,i) \
+{ ss[0] ^= ls_box(ss[5],3) ^ t_use(r,c)[i]; k[6*(i)+ 6] = ff(ss[0]); ss[1] ^= ss[0]; k[6*(i)+ 7] = ff(ss[1]); \
+ ss[2] ^= ss[1]; k[6*(i)+ 8] = ff(ss[2]); ss[3] ^= ss[2]; k[6*(i)+ 9] = ff(ss[3]); \
+ ss[4] ^= ss[3]; k[6*(i)+10] = ff(ss[4]); ss[5] ^= ss[4]; k[6*(i)+11] = ff(ss[5]); \
+}
+#define kd6(k,i) \
+{ ss[6] = ls_box(ss[5],3) ^ t_use(r,c)[i]; \
+ ss[0] ^= ss[6]; ss[6] = ff(ss[6]); k[6*(i)+ 6] = ss[6] ^= k[6*(i)]; \
+ ss[1] ^= ss[0]; k[6*(i)+ 7] = ss[6] ^= k[6*(i)+ 1]; \
+ ss[2] ^= ss[1]; k[6*(i)+ 8] = ss[6] ^= k[6*(i)+ 2]; \
+ ss[3] ^= ss[2]; k[6*(i)+ 9] = ss[6] ^= k[6*(i)+ 3]; \
+ ss[4] ^= ss[3]; k[6*(i)+10] = ss[6] ^= k[6*(i)+ 4]; \
+ ss[5] ^= ss[4]; k[6*(i)+11] = ss[6] ^= k[6*(i)+ 5]; \
+}
+#define kdl6(k,i) \
+{ ss[0] ^= ls_box(ss[5],3) ^ t_use(r,c)[i]; k[6*(i)+ 6] = ss[0]; ss[1] ^= ss[0]; k[6*(i)+ 7] = ss[1]; \
+ ss[2] ^= ss[1]; k[6*(i)+ 8] = ss[2]; ss[3] ^= ss[2]; k[6*(i)+ 9] = ss[3]; \
+}
+
+#define kdf8(k,i) \
+{ ss[0] ^= ls_box(ss[7],3) ^ t_use(r,c)[i]; k[8*(i)+ 8] = ff(ss[0]); ss[1] ^= ss[0]; k[8*(i)+ 9] = ff(ss[1]); \
+ ss[2] ^= ss[1]; k[8*(i)+10] = ff(ss[2]); ss[3] ^= ss[2]; k[8*(i)+11] = ff(ss[3]); \
+ ss[4] ^= ls_box(ss[3],0); k[8*(i)+12] = ff(ss[4]); ss[5] ^= ss[4]; k[8*(i)+13] = ff(ss[5]); \
+ ss[6] ^= ss[5]; k[8*(i)+14] = ff(ss[6]); ss[7] ^= ss[6]; k[8*(i)+15] = ff(ss[7]); \
+}
+#define kd8(k,i) \
+{ aes_32t g = ls_box(ss[7],3) ^ t_use(r,c)[i]; \
+ ss[0] ^= g; g = ff(g); k[8*(i)+ 8] = g ^= k[8*(i)]; \
+ ss[1] ^= ss[0]; k[8*(i)+ 9] = g ^= k[8*(i)+ 1]; \
+ ss[2] ^= ss[1]; k[8*(i)+10] = g ^= k[8*(i)+ 2]; \
+ ss[3] ^= ss[2]; k[8*(i)+11] = g ^= k[8*(i)+ 3]; \
+ g = ls_box(ss[3],0); \
+ ss[4] ^= g; g = ff(g); k[8*(i)+12] = g ^= k[8*(i)+ 4]; \
+ ss[5] ^= ss[4]; k[8*(i)+13] = g ^= k[8*(i)+ 5]; \
+ ss[6] ^= ss[5]; k[8*(i)+14] = g ^= k[8*(i)+ 6]; \
+ ss[7] ^= ss[6]; k[8*(i)+15] = g ^= k[8*(i)+ 7]; \
+}
+#define kdl8(k,i) \
+{ ss[0] ^= ls_box(ss[7],3) ^ t_use(r,c)[i]; k[8*(i)+ 8] = ss[0]; ss[1] ^= ss[0]; k[8*(i)+ 9] = ss[1]; \
+ ss[2] ^= ss[1]; k[8*(i)+10] = ss[2]; ss[3] ^= ss[2]; k[8*(i)+11] = ss[3]; \
+}
+
+#if defined(AES_128) || defined(AES_VAR)
+
+aes_rval aes_decrypt_key128(const unsigned char *key, aes_decrypt_ctx cx[1])
+{ aes_32t ss[5];
+#if defined( d_vars )
+ d_vars;
+#endif
+ cx->ks[0] = ss[0] = word_in(key, 0);
+ cx->ks[1] = ss[1] = word_in(key, 1);
+ cx->ks[2] = ss[2] = word_in(key, 2);
+ cx->ks[3] = ss[3] = word_in(key, 3);
+
+#if DEC_UNROLL == NONE
+ { aes_32t i;
+
+ for(i = 0; i < (11 * N_COLS - 5) / 4; ++i)
+ ke4(cx->ks, i);
+ kel4(cx->ks, 9);
+#if !(DEC_ROUND == NO_TABLES)
+ for(i = N_COLS; i < 10 * N_COLS; ++i)
+ cx->ks[i] = inv_mcol(cx->ks[i]);
+#endif
+ }
+#else
+ kdf4(cx->ks, 0); kd4(cx->ks, 1);
+ kd4(cx->ks, 2); kd4(cx->ks, 3);
+ kd4(cx->ks, 4); kd4(cx->ks, 5);
+ kd4(cx->ks, 6); kd4(cx->ks, 7);
+ kd4(cx->ks, 8); kdl4(cx->ks, 9);
+#endif
+ cx->rn = 10;
+#if defined( AES_ERR_CHK )
+ return aes_good;
+#endif
+}
+
+#endif
+
+#if defined(AES_192) || defined(AES_VAR)
+
+aes_rval aes_decrypt_key192(const unsigned char *key, aes_decrypt_ctx cx[1])
+{ aes_32t ss[7];
+#if defined( d_vars )
+ d_vars;
+#endif
+ cx->ks[0] = ss[0] = word_in(key, 0);
+ cx->ks[1] = ss[1] = word_in(key, 1);
+ cx->ks[2] = ss[2] = word_in(key, 2);
+ cx->ks[3] = ss[3] = word_in(key, 3);
+
+#if DEC_UNROLL == NONE
+ cx->ks[4] = ss[4] = word_in(key, 4);
+ cx->ks[5] = ss[5] = word_in(key, 5);
+ { aes_32t i;
+
+ for(i = 0; i < (13 * N_COLS - 7) / 6; ++i)
+ ke6(cx->ks, i);
+ kel6(cx->ks, 7);
+#if !(DEC_ROUND == NO_TABLES)
+ for(i = N_COLS; i < 12 * N_COLS; ++i)
+ cx->ks[i] = inv_mcol(cx->ks[i]);
+#endif
+ }
+#else
+ cx->ks[4] = ff(ss[4] = word_in(key, 4));
+ cx->ks[5] = ff(ss[5] = word_in(key, 5));
+ kdf6(cx->ks, 0); kd6(cx->ks, 1);
+ kd6(cx->ks, 2); kd6(cx->ks, 3);
+ kd6(cx->ks, 4); kd6(cx->ks, 5);
+ kd6(cx->ks, 6); kdl6(cx->ks, 7);
+#endif
+ cx->rn = 12;
+#if defined( AES_ERR_CHK )
+ return aes_good;
+#endif
+}
+
+#endif
+
+#if defined(AES_256) || defined(AES_VAR)
+
+aes_rval aes_decrypt_key256(const unsigned char *key, aes_decrypt_ctx cx[1])
+{ aes_32t ss[8];
+#if defined( d_vars )
+ d_vars;
+#endif
+ cx->ks[0] = ss[0] = word_in(key, 0);
+ cx->ks[1] = ss[1] = word_in(key, 1);
+ cx->ks[2] = ss[2] = word_in(key, 2);
+ cx->ks[3] = ss[3] = word_in(key, 3);
+
+#if DEC_UNROLL == NONE
+ cx->ks[4] = ss[4] = word_in(key, 4);
+ cx->ks[5] = ss[5] = word_in(key, 5);
+ cx->ks[6] = ss[6] = word_in(key, 6);
+ cx->ks[7] = ss[7] = word_in(key, 7);
+ { aes_32t i;
+
+ for(i = 0; i < (15 * N_COLS - 9) / 8; ++i)
+ ke8(cx->ks, i);
+ kel8(cx->ks, i);
+#if !(DEC_ROUND == NO_TABLES)
+ for(i = N_COLS; i < 14 * N_COLS; ++i)
+ cx->ks[i] = inv_mcol(cx->ks[i]);
+
+#endif
+ }
+#else
+ cx->ks[4] = ff(ss[4] = word_in(key, 4));
+ cx->ks[5] = ff(ss[5] = word_in(key, 5));
+ cx->ks[6] = ff(ss[6] = word_in(key, 6));
+ cx->ks[7] = ff(ss[7] = word_in(key, 7));
+ kdf8(cx->ks, 0); kd8(cx->ks, 1);
+ kd8(cx->ks, 2); kd8(cx->ks, 3);
+ kd8(cx->ks, 4); kd8(cx->ks, 5);
+ kdl8(cx->ks, 6);
+#endif
+ cx->rn = 14;
+#if defined( AES_ERR_CHK )
+ return aes_good;
+#endif
+}
+
+#endif
+
+#if defined(AES_VAR)
+
+aes_rval aes_decrypt_key(const unsigned char *key, int key_len, aes_decrypt_ctx cx[1])
+{
+ switch(key_len)
+ {
+#if defined( AES_ERR_CHK )
+ case 16: case 128: return aes_decrypt_key128(key, cx);
+ case 24: case 192: return aes_decrypt_key192(key, cx);
+ case 32: case 256: return aes_decrypt_key256(key, cx);
+ default: return aes_error;
+#else
+ case 16: case 128: aes_decrypt_key128(key, cx); return;
+ case 24: case 192: aes_decrypt_key192(key, cx); return;
+ case 32: case 256: aes_decrypt_key256(key, cx); return;
+#endif
+ }
+}
+
+#endif
+
+#endif
+
+#if defined(__cplusplus)
+}
+#endif
projects / apple / xnu.git / blobdiff