1 /* 2 * FIPS-197 compliant AES implementation 3 * 4 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved 5 * SPDX-License-Identifier: Apache-2.0 6 * 7 * Licensed under the Apache License, Version 2.0 (the "License"); you may 8 * not use this file except in compliance with the License. 9 * You may obtain a copy of the License at 10 * 11 * http://www.apache.org/licenses/LICENSE-2.0 12 * 13 * Unless required by applicable law or agreed to in writing, software 14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 16 * See the License for the specific language governing permissions and 17 * limitations under the License. 18 * 19 * This file is part of mbed TLS (https://tls.mbed.org) 20 */ 21 /* 22 * The AES block cipher was designed by Vincent Rijmen and Joan Daemen. 23 * 24 * http://csrc.nist.gov/encryption/aes/rijndael/Rijndael.pdf 25 * http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf 26 */ 27 28 #if !defined(MBEDTLS_CONFIG_FILE) 29 #include "mbedtls/config.h" 30 #else 31 #include MBEDTLS_CONFIG_FILE 32 #endif 33 34 #if defined(MBEDTLS_AES_C) 35 36 #include <string.h> 37 38 #include "mbedtls/aes.h" 39 #if defined(MBEDTLS_PADLOCK_C) 40 #include "mbedtls/padlock.h" 41 #endif 42 #if defined(MBEDTLS_AESNI_C) 43 #include "mbedtls/aesni.h" 44 #endif 45 46 #if defined(MBEDTLS_SELF_TEST) 47 #if defined(MBEDTLS_PLATFORM_C) 48 #include "mbedtls/platform.h" 49 #else 50 #include <stdio.h> 51 #define mbedtls_printf printf 52 #endif /* MBEDTLS_PLATFORM_C */ 53 #endif /* MBEDTLS_SELF_TEST */ 54 55 #if !defined(MBEDTLS_AES_ALT) 56 57 /* Implementation that should never be optimized out by the compiler */ 58 static void mbedtls_zeroize( void *v, size_t n ) { 59 volatile unsigned char *p = (unsigned char*)v; while( n-- ) *p++ = 0; 60 } 61 62 /* 63 * 32-bit integer manipulation macros (little endian) 64 */ 65 #ifndef GET_UINT32_LE 66 #define GET_UINT32_LE(n,b,i) \ 67 { \ 68 (n) = ( (uint32_t) (b)[(i) ] ) \ 69 | ( (uint32_t) (b)[(i) + 1] << 8 ) \ 70 | ( (uint32_t) (b)[(i) + 2] << 16 ) \ 71 | ( (uint32_t) (b)[(i) + 3] << 24 ); \ 72 } 73 #endif 74 75 #ifndef PUT_UINT32_LE 76 #define PUT_UINT32_LE(n,b,i) \ 77 { \ 78 (b)[(i) ] = (unsigned char) ( ( (n) ) & 0xFF ); \ 79 (b)[(i) + 1] = (unsigned char) ( ( (n) >> 8 ) & 0xFF ); \ 80 (b)[(i) + 2] = (unsigned char) ( ( (n) >> 16 ) & 0xFF ); \ 81 (b)[(i) + 3] = (unsigned char) ( ( (n) >> 24 ) & 0xFF ); \ 82 } 83 #endif 84 85 #if defined(MBEDTLS_PADLOCK_C) && \ 86 ( defined(MBEDTLS_HAVE_X86) || defined(MBEDTLS_PADLOCK_ALIGN16) ) 87 static int aes_padlock_ace = -1; 88 #endif 89 90 #if defined(MBEDTLS_AES_ROM_TABLES) 91 /* 92 * Forward S-box 93 */ 94 static const unsigned char FSb[256] = 95 { 96 0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 97 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76, 98 0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 99 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0, 100 0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, 101 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15, 102 0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 103 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75, 104 0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, 105 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84, 106 0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 107 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF, 108 0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 109 0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8, 110 0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5, 111 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2, 112 0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, 113 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73, 114 0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 115 0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB, 116 0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, 117 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79, 118 0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9, 119 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08, 120 0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 121 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A, 122 0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, 123 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E, 124 0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94, 125 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF, 126 0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 127 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16 128 }; 129 130 /* 131 * Forward tables 132 */ 133 #define FT \ 134 \ 135 V(A5,63,63,C6), V(84,7C,7C,F8), V(99,77,77,EE), V(8D,7B,7B,F6), \ 136 V(0D,F2,F2,FF), V(BD,6B,6B,D6), V(B1,6F,6F,DE), V(54,C5,C5,91), \ 137 V(50,30,30,60), V(03,01,01,02), V(A9,67,67,CE), V(7D,2B,2B,56), \ 138 V(19,FE,FE,E7), V(62,D7,D7,B5), V(E6,AB,AB,4D), V(9A,76,76,EC), \ 139 V(45,CA,CA,8F), V(9D,82,82,1F), V(40,C9,C9,89), V(87,7D,7D,FA), \ 140 V(15,FA,FA,EF), V(EB,59,59,B2), V(C9,47,47,8E), V(0B,F0,F0,FB), \ 141 V(EC,AD,AD,41), V(67,D4,D4,B3), V(FD,A2,A2,5F), V(EA,AF,AF,45), \ 142 V(BF,9C,9C,23), V(F7,A4,A4,53), V(96,72,72,E4), V(5B,C0,C0,9B), \ 143 V(C2,B7,B7,75), V(1C,FD,FD,E1), V(AE,93,93,3D), V(6A,26,26,4C), \ 144 V(5A,36,36,6C), V(41,3F,3F,7E), V(02,F7,F7,F5), V(4F,CC,CC,83), \ 145 V(5C,34,34,68), V(F4,A5,A5,51), V(34,E5,E5,D1), V(08,F1,F1,F9), \ 146 V(93,71,71,E2), V(73,D8,D8,AB), V(53,31,31,62), V(3F,15,15,2A), \ 147 V(0C,04,04,08), V(52,C7,C7,95), V(65,23,23,46), V(5E,C3,C3,9D), \ 148 V(28,18,18,30), V(A1,96,96,37), V(0F,05,05,0A), V(B5,9A,9A,2F), \ 149 V(09,07,07,0E), V(36,12,12,24), V(9B,80,80,1B), V(3D,E2,E2,DF), \ 150 V(26,EB,EB,CD), V(69,27,27,4E), V(CD,B2,B2,7F), V(9F,75,75,EA), \ 151 V(1B,09,09,12), V(9E,83,83,1D), V(74,2C,2C,58), V(2E,1A,1A,34), \ 152 V(2D,1B,1B,36), V(B2,6E,6E,DC), V(EE,5A,5A,B4), V(FB,A0,A0,5B), \ 153 V(F6,52,52,A4), V(4D,3B,3B,76), V(61,D6,D6,B7), V(CE,B3,B3,7D), \ 154 V(7B,29,29,52), V(3E,E3,E3,DD), V(71,2F,2F,5E), V(97,84,84,13), \ 155 V(F5,53,53,A6), V(68,D1,D1,B9), V(00,00,00,00), V(2C,ED,ED,C1), \ 156 V(60,20,20,40), V(1F,FC,FC,E3), V(C8,B1,B1,79), V(ED,5B,5B,B6), \ 157 V(BE,6A,6A,D4), V(46,CB,CB,8D), V(D9,BE,BE,67), V(4B,39,39,72), \ 158 V(DE,4A,4A,94), V(D4,4C,4C,98), V(E8,58,58,B0), V(4A,CF,CF,85), \ 159 V(6B,D0,D0,BB), V(2A,EF,EF,C5), V(E5,AA,AA,4F), V(16,FB,FB,ED), \ 160 V(C5,43,43,86), V(D7,4D,4D,9A), V(55,33,33,66), V(94,85,85,11), \ 161 V(CF,45,45,8A), V(10,F9,F9,E9), V(06,02,02,04), V(81,7F,7F,FE), \ 162 V(F0,50,50,A0), V(44,3C,3C,78), V(BA,9F,9F,25), V(E3,A8,A8,4B), \ 163 V(F3,51,51,A2), V(FE,A3,A3,5D), V(C0,40,40,80), V(8A,8F,8F,05), \ 164 V(AD,92,92,3F), V(BC,9D,9D,21), V(48,38,38,70), V(04,F5,F5,F1), \ 165 V(DF,BC,BC,63), V(C1,B6,B6,77), V(75,DA,DA,AF), V(63,21,21,42), \ 166 V(30,10,10,20), V(1A,FF,FF,E5), V(0E,F3,F3,FD), V(6D,D2,D2,BF), \ 167 V(4C,CD,CD,81), V(14,0C,0C,18), V(35,13,13,26), V(2F,EC,EC,C3), \ 168 V(E1,5F,5F,BE), V(A2,97,97,35), V(CC,44,44,88), V(39,17,17,2E), \ 169 V(57,C4,C4,93), V(F2,A7,A7,55), V(82,7E,7E,FC), V(47,3D,3D,7A), \ 170 V(AC,64,64,C8), V(E7,5D,5D,BA), V(2B,19,19,32), V(95,73,73,E6), \ 171 V(A0,60,60,C0), V(98,81,81,19), V(D1,4F,4F,9E), V(7F,DC,DC,A3), \ 172 V(66,22,22,44), V(7E,2A,2A,54), V(AB,90,90,3B), V(83,88,88,0B), \ 173 V(CA,46,46,8C), V(29,EE,EE,C7), V(D3,B8,B8,6B), V(3C,14,14,28), \ 174 V(79,DE,DE,A7), V(E2,5E,5E,BC), V(1D,0B,0B,16), V(76,DB,DB,AD), \ 175 V(3B,E0,E0,DB), V(56,32,32,64), V(4E,3A,3A,74), V(1E,0A,0A,14), \ 176 V(DB,49,49,92), V(0A,06,06,0C), V(6C,24,24,48), V(E4,5C,5C,B8), \ 177 V(5D,C2,C2,9F), V(6E,D3,D3,BD), V(EF,AC,AC,43), V(A6,62,62,C4), \ 178 V(A8,91,91,39), V(A4,95,95,31), V(37,E4,E4,D3), V(8B,79,79,F2), \ 179 V(32,E7,E7,D5), V(43,C8,C8,8B), V(59,37,37,6E), V(B7,6D,6D,DA), \ 180 V(8C,8D,8D,01), V(64,D5,D5,B1), V(D2,4E,4E,9C), V(E0,A9,A9,49), \ 181 V(B4,6C,6C,D8), V(FA,56,56,AC), V(07,F4,F4,F3), V(25,EA,EA,CF), \ 182 V(AF,65,65,CA), V(8E,7A,7A,F4), V(E9,AE,AE,47), V(18,08,08,10), \ 183 V(D5,BA,BA,6F), V(88,78,78,F0), V(6F,25,25,4A), V(72,2E,2E,5C), \ 184 V(24,1C,1C,38), V(F1,A6,A6,57), V(C7,B4,B4,73), V(51,C6,C6,97), \ 185 V(23,E8,E8,CB), V(7C,DD,DD,A1), V(9C,74,74,E8), V(21,1F,1F,3E), \ 186 V(DD,4B,4B,96), V(DC,BD,BD,61), V(86,8B,8B,0D), V(85,8A,8A,0F), \ 187 V(90,70,70,E0), V(42,3E,3E,7C), V(C4,B5,B5,71), V(AA,66,66,CC), \ 188 V(D8,48,48,90), V(05,03,03,06), V(01,F6,F6,F7), V(12,0E,0E,1C), \ 189 V(A3,61,61,C2), V(5F,35,35,6A), V(F9,57,57,AE), V(D0,B9,B9,69), \ 190 V(91,86,86,17), V(58,C1,C1,99), V(27,1D,1D,3A), V(B9,9E,9E,27), \ 191 V(38,E1,E1,D9), V(13,F8,F8,EB), V(B3,98,98,2B), V(33,11,11,22), \ 192 V(BB,69,69,D2), V(70,D9,D9,A9), V(89,8E,8E,07), V(A7,94,94,33), \ 193 V(B6,9B,9B,2D), V(22,1E,1E,3C), V(92,87,87,15), V(20,E9,E9,C9), \ 194 V(49,CE,CE,87), V(FF,55,55,AA), V(78,28,28,50), V(7A,DF,DF,A5), \ 195 V(8F,8C,8C,03), V(F8,A1,A1,59), V(80,89,89,09), V(17,0D,0D,1A), \ 196 V(DA,BF,BF,65), V(31,E6,E6,D7), V(C6,42,42,84), V(B8,68,68,D0), \ 197 V(C3,41,41,82), V(B0,99,99,29), V(77,2D,2D,5A), V(11,0F,0F,1E), \ 198 V(CB,B0,B0,7B), V(FC,54,54,A8), V(D6,BB,BB,6D), V(3A,16,16,2C) 199 200 #define V(a,b,c,d) 0x##a##b##c##d 201 static const uint32_t FT0[256] = { FT }; 202 #undef V 203 204 #define V(a,b,c,d) 0x##b##c##d##a 205 static const uint32_t FT1[256] = { FT }; 206 #undef V 207 208 #define V(a,b,c,d) 0x##c##d##a##b 209 static const uint32_t FT2[256] = { FT }; 210 #undef V 211 212 #define V(a,b,c,d) 0x##d##a##b##c 213 static const uint32_t FT3[256] = { FT }; 214 #undef V 215 216 #undef FT 217 218 /* 219 * Reverse S-box 220 */ 221 static const unsigned char RSb[256] = 222 { 223 0x52, 0x09, 0x6A, 0xD5, 0x30, 0x36, 0xA5, 0x38, 224 0xBF, 0x40, 0xA3, 0x9E, 0x81, 0xF3, 0xD7, 0xFB, 225 0x7C, 0xE3, 0x39, 0x82, 0x9B, 0x2F, 0xFF, 0x87, 226 0x34, 0x8E, 0x43, 0x44, 0xC4, 0xDE, 0xE9, 0xCB, 227 0x54, 0x7B, 0x94, 0x32, 0xA6, 0xC2, 0x23, 0x3D, 228 0xEE, 0x4C, 0x95, 0x0B, 0x42, 0xFA, 0xC3, 0x4E, 229 0x08, 0x2E, 0xA1, 0x66, 0x28, 0xD9, 0x24, 0xB2, 230 0x76, 0x5B, 0xA2, 0x49, 0x6D, 0x8B, 0xD1, 0x25, 231 0x72, 0xF8, 0xF6, 0x64, 0x86, 0x68, 0x98, 0x16, 232 0xD4, 0xA4, 0x5C, 0xCC, 0x5D, 0x65, 0xB6, 0x92, 233 0x6C, 0x70, 0x48, 0x50, 0xFD, 0xED, 0xB9, 0xDA, 234 0x5E, 0x15, 0x46, 0x57, 0xA7, 0x8D, 0x9D, 0x84, 235 0x90, 0xD8, 0xAB, 0x00, 0x8C, 0xBC, 0xD3, 0x0A, 236 0xF7, 0xE4, 0x58, 0x05, 0xB8, 0xB3, 0x45, 0x06, 237 0xD0, 0x2C, 0x1E, 0x8F, 0xCA, 0x3F, 0x0F, 0x02, 238 0xC1, 0xAF, 0xBD, 0x03, 0x01, 0x13, 0x8A, 0x6B, 239 0x3A, 0x91, 0x11, 0x41, 0x4F, 0x67, 0xDC, 0xEA, 240 0x97, 0xF2, 0xCF, 0xCE, 0xF0, 0xB4, 0xE6, 0x73, 241 0x96, 0xAC, 0x74, 0x22, 0xE7, 0xAD, 0x35, 0x85, 242 0xE2, 0xF9, 0x37, 0xE8, 0x1C, 0x75, 0xDF, 0x6E, 243 0x47, 0xF1, 0x1A, 0x71, 0x1D, 0x29, 0xC5, 0x89, 244 0x6F, 0xB7, 0x62, 0x0E, 0xAA, 0x18, 0xBE, 0x1B, 245 0xFC, 0x56, 0x3E, 0x4B, 0xC6, 0xD2, 0x79, 0x20, 246 0x9A, 0xDB, 0xC0, 0xFE, 0x78, 0xCD, 0x5A, 0xF4, 247 0x1F, 0xDD, 0xA8, 0x33, 0x88, 0x07, 0xC7, 0x31, 248 0xB1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xEC, 0x5F, 249 0x60, 0x51, 0x7F, 0xA9, 0x19, 0xB5, 0x4A, 0x0D, 250 0x2D, 0xE5, 0x7A, 0x9F, 0x93, 0xC9, 0x9C, 0xEF, 251 0xA0, 0xE0, 0x3B, 0x4D, 0xAE, 0x2A, 0xF5, 0xB0, 252 0xC8, 0xEB, 0xBB, 0x3C, 0x83, 0x53, 0x99, 0x61, 253 0x17, 0x2B, 0x04, 0x7E, 0xBA, 0x77, 0xD6, 0x26, 254 0xE1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0C, 0x7D 255 }; 256 257 /* 258 * Reverse tables 259 */ 260 #define RT \ 261 \ 262 V(50,A7,F4,51), V(53,65,41,7E), V(C3,A4,17,1A), V(96,5E,27,3A), \ 263 V(CB,6B,AB,3B), V(F1,45,9D,1F), V(AB,58,FA,AC), V(93,03,E3,4B), \ 264 V(55,FA,30,20), V(F6,6D,76,AD), V(91,76,CC,88), V(25,4C,02,F5), \ 265 V(FC,D7,E5,4F), V(D7,CB,2A,C5), V(80,44,35,26), V(8F,A3,62,B5), \ 266 V(49,5A,B1,DE), V(67,1B,BA,25), V(98,0E,EA,45), V(E1,C0,FE,5D), \ 267 V(02,75,2F,C3), V(12,F0,4C,81), V(A3,97,46,8D), V(C6,F9,D3,6B), \ 268 V(E7,5F,8F,03), V(95,9C,92,15), V(EB,7A,6D,BF), V(DA,59,52,95), \ 269 V(2D,83,BE,D4), V(D3,21,74,58), V(29,69,E0,49), V(44,C8,C9,8E), \ 270 V(6A,89,C2,75), V(78,79,8E,F4), V(6B,3E,58,99), V(DD,71,B9,27), \ 271 V(B6,4F,E1,BE), V(17,AD,88,F0), V(66,AC,20,C9), V(B4,3A,CE,7D), \ 272 V(18,4A,DF,63), V(82,31,1A,E5), V(60,33,51,97), V(45,7F,53,62), \ 273 V(E0,77,64,B1), V(84,AE,6B,BB), V(1C,A0,81,FE), V(94,2B,08,F9), \ 274 V(58,68,48,70), V(19,FD,45,8F), V(87,6C,DE,94), V(B7,F8,7B,52), \ 275 V(23,D3,73,AB), V(E2,02,4B,72), V(57,8F,1F,E3), V(2A,AB,55,66), \ 276 V(07,28,EB,B2), V(03,C2,B5,2F), V(9A,7B,C5,86), V(A5,08,37,D3), \ 277 V(F2,87,28,30), V(B2,A5,BF,23), V(BA,6A,03,02), V(5C,82,16,ED), \ 278 V(2B,1C,CF,8A), V(92,B4,79,A7), V(F0,F2,07,F3), V(A1,E2,69,4E), \ 279 V(CD,F4,DA,65), V(D5,BE,05,06), V(1F,62,34,D1), V(8A,FE,A6,C4), \ 280 V(9D,53,2E,34), V(A0,55,F3,A2), V(32,E1,8A,05), V(75,EB,F6,A4), \ 281 V(39,EC,83,0B), V(AA,EF,60,40), V(06,9F,71,5E), V(51,10,6E,BD), \ 282 V(F9,8A,21,3E), V(3D,06,DD,96), V(AE,05,3E,DD), V(46,BD,E6,4D), \ 283 V(B5,8D,54,91), V(05,5D,C4,71), V(6F,D4,06,04), V(FF,15,50,60), \ 284 V(24,FB,98,19), V(97,E9,BD,D6), V(CC,43,40,89), V(77,9E,D9,67), \ 285 V(BD,42,E8,B0), V(88,8B,89,07), V(38,5B,19,E7), V(DB,EE,C8,79), \ 286 V(47,0A,7C,A1), V(E9,0F,42,7C), V(C9,1E,84,F8), V(00,00,00,00), \ 287 V(83,86,80,09), V(48,ED,2B,32), V(AC,70,11,1E), V(4E,72,5A,6C), \ 288 V(FB,FF,0E,FD), V(56,38,85,0F), V(1E,D5,AE,3D), V(27,39,2D,36), \ 289 V(64,D9,0F,0A), V(21,A6,5C,68), V(D1,54,5B,9B), V(3A,2E,36,24), \ 290 V(B1,67,0A,0C), V(0F,E7,57,93), V(D2,96,EE,B4), V(9E,91,9B,1B), \ 291 V(4F,C5,C0,80), V(A2,20,DC,61), V(69,4B,77,5A), V(16,1A,12,1C), \ 292 V(0A,BA,93,E2), V(E5,2A,A0,C0), V(43,E0,22,3C), V(1D,17,1B,12), \ 293 V(0B,0D,09,0E), V(AD,C7,8B,F2), V(B9,A8,B6,2D), V(C8,A9,1E,14), \ 294 V(85,19,F1,57), V(4C,07,75,AF), V(BB,DD,99,EE), V(FD,60,7F,A3), \ 295 V(9F,26,01,F7), V(BC,F5,72,5C), V(C5,3B,66,44), V(34,7E,FB,5B), \ 296 V(76,29,43,8B), V(DC,C6,23,CB), V(68,FC,ED,B6), V(63,F1,E4,B8), \ 297 V(CA,DC,31,D7), V(10,85,63,42), V(40,22,97,13), V(20,11,C6,84), \ 298 V(7D,24,4A,85), V(F8,3D,BB,D2), V(11,32,F9,AE), V(6D,A1,29,C7), \ 299 V(4B,2F,9E,1D), V(F3,30,B2,DC), V(EC,52,86,0D), V(D0,E3,C1,77), \ 300 V(6C,16,B3,2B), V(99,B9,70,A9), V(FA,48,94,11), V(22,64,E9,47), \ 301 V(C4,8C,FC,A8), V(1A,3F,F0,A0), V(D8,2C,7D,56), V(EF,90,33,22), \ 302 V(C7,4E,49,87), V(C1,D1,38,D9), V(FE,A2,CA,8C), V(36,0B,D4,98), \ 303 V(CF,81,F5,A6), V(28,DE,7A,A5), V(26,8E,B7,DA), V(A4,BF,AD,3F), \ 304 V(E4,9D,3A,2C), V(0D,92,78,50), V(9B,CC,5F,6A), V(62,46,7E,54), \ 305 V(C2,13,8D,F6), V(E8,B8,D8,90), V(5E,F7,39,2E), V(F5,AF,C3,82), \ 306 V(BE,80,5D,9F), V(7C,93,D0,69), V(A9,2D,D5,6F), V(B3,12,25,CF), \ 307 V(3B,99,AC,C8), V(A7,7D,18,10), V(6E,63,9C,E8), V(7B,BB,3B,DB), \ 308 V(09,78,26,CD), V(F4,18,59,6E), V(01,B7,9A,EC), V(A8,9A,4F,83), \ 309 V(65,6E,95,E6), V(7E,E6,FF,AA), V(08,CF,BC,21), V(E6,E8,15,EF), \ 310 V(D9,9B,E7,BA), V(CE,36,6F,4A), V(D4,09,9F,EA), V(D6,7C,B0,29), \ 311 V(AF,B2,A4,31), V(31,23,3F,2A), V(30,94,A5,C6), V(C0,66,A2,35), \ 312 V(37,BC,4E,74), V(A6,CA,82,FC), V(B0,D0,90,E0), V(15,D8,A7,33), \ 313 V(4A,98,04,F1), V(F7,DA,EC,41), V(0E,50,CD,7F), V(2F,F6,91,17), \ 314 V(8D,D6,4D,76), V(4D,B0,EF,43), V(54,4D,AA,CC), V(DF,04,96,E4), \ 315 V(E3,B5,D1,9E), V(1B,88,6A,4C), V(B8,1F,2C,C1), V(7F,51,65,46), \ 316 V(04,EA,5E,9D), V(5D,35,8C,01), V(73,74,87,FA), V(2E,41,0B,FB), \ 317 V(5A,1D,67,B3), V(52,D2,DB,92), V(33,56,10,E9), V(13,47,D6,6D), \ 318 V(8C,61,D7,9A), V(7A,0C,A1,37), V(8E,14,F8,59), V(89,3C,13,EB), \ 319 V(EE,27,A9,CE), V(35,C9,61,B7), V(ED,E5,1C,E1), V(3C,B1,47,7A), \ 320 V(59,DF,D2,9C), V(3F,73,F2,55), V(79,CE,14,18), V(BF,37,C7,73), \ 321 V(EA,CD,F7,53), V(5B,AA,FD,5F), V(14,6F,3D,DF), V(86,DB,44,78), \ 322 V(81,F3,AF,CA), V(3E,C4,68,B9), V(2C,34,24,38), V(5F,40,A3,C2), \ 323 V(72,C3,1D,16), V(0C,25,E2,BC), V(8B,49,3C,28), V(41,95,0D,FF), \ 324 V(71,01,A8,39), V(DE,B3,0C,08), V(9C,E4,B4,D8), V(90,C1,56,64), \ 325 V(61,84,CB,7B), V(70,B6,32,D5), V(74,5C,6C,48), V(42,57,B8,D0) 326 327 #define V(a,b,c,d) 0x##a##b##c##d 328 static const uint32_t RT0[256] = { RT }; 329 #undef V 330 331 #define V(a,b,c,d) 0x##b##c##d##a 332 static const uint32_t RT1[256] = { RT }; 333 #undef V 334 335 #define V(a,b,c,d) 0x##c##d##a##b 336 static const uint32_t RT2[256] = { RT }; 337 #undef V 338 339 #define V(a,b,c,d) 0x##d##a##b##c 340 static const uint32_t RT3[256] = { RT }; 341 #undef V 342 343 #undef RT 344 345 /* 346 * Round constants 347 */ 348 static const uint32_t RCON[10] = 349 { 350 0x00000001, 0x00000002, 0x00000004, 0x00000008, 351 0x00000010, 0x00000020, 0x00000040, 0x00000080, 352 0x0000001B, 0x00000036 353 }; 354 355 #else /* MBEDTLS_AES_ROM_TABLES */ 356 357 /* 358 * Forward S-box & tables 359 */ 360 static unsigned char FSb[256]; 361 static uint32_t FT0[256]; 362 static uint32_t FT1[256]; 363 static uint32_t FT2[256]; 364 static uint32_t FT3[256]; 365 366 /* 367 * Reverse S-box & tables 368 */ 369 static unsigned char RSb[256]; 370 static uint32_t RT0[256]; 371 static uint32_t RT1[256]; 372 static uint32_t RT2[256]; 373 static uint32_t RT3[256]; 374 375 /* 376 * Round constants 377 */ 378 static uint32_t RCON[10]; 379 380 /* 381 * Tables generation code 382 */ 383 #define ROTL8(x) ( ( x << 8 ) & 0xFFFFFFFF ) | ( x >> 24 ) 384 #define XTIME(x) ( ( x << 1 ) ^ ( ( x & 0x80 ) ? 0x1B : 0x00 ) ) 385 #define MUL(x,y) ( ( x && y ) ? pow[(log[x]+log[y]) % 255] : 0 ) 386 387 static int aes_init_done = 0; 388 389 static void aes_gen_tables( void ) 390 { 391 int i, x, y, z; 392 int pow[256]; 393 int log[256]; 394 395 /* 396 * compute pow and log tables over GF(2^8) 397 */ 398 for( i = 0, x = 1; i < 256; i++ ) 399 { 400 pow[i] = x; 401 log[x] = i; 402 x = ( x ^ XTIME( x ) ) & 0xFF; 403 } 404 405 /* 406 * calculate the round constants 407 */ 408 for( i = 0, x = 1; i < 10; i++ ) 409 { 410 RCON[i] = (uint32_t) x; 411 x = XTIME( x ) & 0xFF; 412 } 413 414 /* 415 * generate the forward and reverse S-boxes 416 */ 417 FSb[0x00] = 0x63; 418 RSb[0x63] = 0x00; 419 420 for( i = 1; i < 256; i++ ) 421 { 422 x = pow[255 - log[i]]; 423 424 y = x; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF; 425 x ^= y; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF; 426 x ^= y; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF; 427 x ^= y; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF; 428 x ^= y ^ 0x63; 429 430 FSb[i] = (unsigned char) x; 431 RSb[x] = (unsigned char) i; 432 } 433 434 /* 435 * generate the forward and reverse tables 436 */ 437 for( i = 0; i < 256; i++ ) 438 { 439 x = FSb[i]; 440 y = XTIME( x ) & 0xFF; 441 z = ( y ^ x ) & 0xFF; 442 443 FT0[i] = ( (uint32_t) y ) ^ 444 ( (uint32_t) x << 8 ) ^ 445 ( (uint32_t) x << 16 ) ^ 446 ( (uint32_t) z << 24 ); 447 448 FT1[i] = ROTL8( FT0[i] ); 449 FT2[i] = ROTL8( FT1[i] ); 450 FT3[i] = ROTL8( FT2[i] ); 451 452 x = RSb[i]; 453 454 RT0[i] = ( (uint32_t) MUL( 0x0E, x ) ) ^ 455 ( (uint32_t) MUL( 0x09, x ) << 8 ) ^ 456 ( (uint32_t) MUL( 0x0D, x ) << 16 ) ^ 457 ( (uint32_t) MUL( 0x0B, x ) << 24 ); 458 459 RT1[i] = ROTL8( RT0[i] ); 460 RT2[i] = ROTL8( RT1[i] ); 461 RT3[i] = ROTL8( RT2[i] ); 462 } 463 } 464 465 #endif /* MBEDTLS_AES_ROM_TABLES */ 466 467 void mbedtls_aes_init( mbedtls_aes_context *ctx ) 468 { 469 memset( ctx, 0, sizeof( mbedtls_aes_context ) ); 470 } 471 472 void mbedtls_aes_free( mbedtls_aes_context *ctx ) 473 { 474 if( ctx == NULL ) 475 return; 476 477 mbedtls_zeroize( ctx, sizeof( mbedtls_aes_context ) ); 478 } 479 480 /* 481 * AES key schedule (encryption) 482 */ 483 #if !defined(MBEDTLS_AES_SETKEY_ENC_ALT) 484 int mbedtls_aes_setkey_enc( mbedtls_aes_context *ctx, const unsigned char *key, 485 unsigned int keybits ) 486 { 487 unsigned int i; 488 uint32_t *RK; 489 490 #if !defined(MBEDTLS_AES_ROM_TABLES) 491 if( aes_init_done == 0 ) 492 { 493 aes_gen_tables(); 494 aes_init_done = 1; 495 496 } 497 #endif 498 499 switch( keybits ) 500 { 501 case 128: ctx->nr = 10; break; 502 case 192: ctx->nr = 12; break; 503 case 256: ctx->nr = 14; break; 504 default : return( MBEDTLS_ERR_AES_INVALID_KEY_LENGTH ); 505 } 506 507 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_PADLOCK_ALIGN16) 508 if( aes_padlock_ace == -1 ) 509 aes_padlock_ace = mbedtls_padlock_has_support( MBEDTLS_PADLOCK_ACE ); 510 511 if( aes_padlock_ace ) 512 ctx->rk = RK = MBEDTLS_PADLOCK_ALIGN16( ctx->buf ); 513 else 514 #endif 515 ctx->rk = RK = ctx->buf; 516 517 #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64) 518 if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) ) 519 return( mbedtls_aesni_setkey_enc( (unsigned char *) ctx->rk, key, keybits ) ); 520 #endif 521 522 for( i = 0; i < ( keybits >> 5 ); i++ ) 523 { 524 GET_UINT32_LE( RK[i], key, i << 2 ); 525 } 526 527 switch( ctx->nr ) 528 { 529 case 10: 530 531 for( i = 0; i < 10; i++, RK += 4 ) 532 { 533 RK[4] = RK[0] ^ RCON[i] ^ 534 ( (uint32_t) FSb[ ( RK[3] >> 8 ) & 0xFF ] ) ^ 535 ( (uint32_t) FSb[ ( RK[3] >> 16 ) & 0xFF ] << 8 ) ^ 536 ( (uint32_t) FSb[ ( RK[3] >> 24 ) & 0xFF ] << 16 ) ^ 537 ( (uint32_t) FSb[ ( RK[3] ) & 0xFF ] << 24 ); 538 539 RK[5] = RK[1] ^ RK[4]; 540 RK[6] = RK[2] ^ RK[5]; 541 RK[7] = RK[3] ^ RK[6]; 542 } 543 break; 544 545 case 12: 546 547 for( i = 0; i < 8; i++, RK += 6 ) 548 { 549 RK[6] = RK[0] ^ RCON[i] ^ 550 ( (uint32_t) FSb[ ( RK[5] >> 8 ) & 0xFF ] ) ^ 551 ( (uint32_t) FSb[ ( RK[5] >> 16 ) & 0xFF ] << 8 ) ^ 552 ( (uint32_t) FSb[ ( RK[5] >> 24 ) & 0xFF ] << 16 ) ^ 553 ( (uint32_t) FSb[ ( RK[5] ) & 0xFF ] << 24 ); 554 555 RK[7] = RK[1] ^ RK[6]; 556 RK[8] = RK[2] ^ RK[7]; 557 RK[9] = RK[3] ^ RK[8]; 558 RK[10] = RK[4] ^ RK[9]; 559 RK[11] = RK[5] ^ RK[10]; 560 } 561 break; 562 563 case 14: 564 565 for( i = 0; i < 7; i++, RK += 8 ) 566 { 567 RK[8] = RK[0] ^ RCON[i] ^ 568 ( (uint32_t) FSb[ ( RK[7] >> 8 ) & 0xFF ] ) ^ 569 ( (uint32_t) FSb[ ( RK[7] >> 16 ) & 0xFF ] << 8 ) ^ 570 ( (uint32_t) FSb[ ( RK[7] >> 24 ) & 0xFF ] << 16 ) ^ 571 ( (uint32_t) FSb[ ( RK[7] ) & 0xFF ] << 24 ); 572 573 RK[9] = RK[1] ^ RK[8]; 574 RK[10] = RK[2] ^ RK[9]; 575 RK[11] = RK[3] ^ RK[10]; 576 577 RK[12] = RK[4] ^ 578 ( (uint32_t) FSb[ ( RK[11] ) & 0xFF ] ) ^ 579 ( (uint32_t) FSb[ ( RK[11] >> 8 ) & 0xFF ] << 8 ) ^ 580 ( (uint32_t) FSb[ ( RK[11] >> 16 ) & 0xFF ] << 16 ) ^ 581 ( (uint32_t) FSb[ ( RK[11] >> 24 ) & 0xFF ] << 24 ); 582 583 RK[13] = RK[5] ^ RK[12]; 584 RK[14] = RK[6] ^ RK[13]; 585 RK[15] = RK[7] ^ RK[14]; 586 } 587 break; 588 } 589 590 return( 0 ); 591 } 592 #endif /* !MBEDTLS_AES_SETKEY_ENC_ALT */ 593 594 /* 595 * AES key schedule (decryption) 596 */ 597 #if !defined(MBEDTLS_AES_SETKEY_DEC_ALT) 598 int mbedtls_aes_setkey_dec( mbedtls_aes_context *ctx, const unsigned char *key, 599 unsigned int keybits ) 600 { 601 int i, j, ret; 602 mbedtls_aes_context cty; 603 uint32_t *RK; 604 uint32_t *SK; 605 606 mbedtls_aes_init( &cty ); 607 608 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_PADLOCK_ALIGN16) 609 if( aes_padlock_ace == -1 ) 610 aes_padlock_ace = mbedtls_padlock_has_support( MBEDTLS_PADLOCK_ACE ); 611 612 if( aes_padlock_ace ) 613 ctx->rk = RK = MBEDTLS_PADLOCK_ALIGN16( ctx->buf ); 614 else 615 #endif 616 ctx->rk = RK = ctx->buf; 617 618 /* Also checks keybits */ 619 if( ( ret = mbedtls_aes_setkey_enc( &cty, key, keybits ) ) != 0 ) 620 goto exit; 621 622 ctx->nr = cty.nr; 623 624 #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64) 625 if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) ) 626 { 627 mbedtls_aesni_inverse_key( (unsigned char *) ctx->rk, 628 (const unsigned char *) cty.rk, ctx->nr ); 629 goto exit; 630 } 631 #endif 632 633 SK = cty.rk + cty.nr * 4; 634 635 *RK++ = *SK++; 636 *RK++ = *SK++; 637 *RK++ = *SK++; 638 *RK++ = *SK++; 639 640 for( i = ctx->nr - 1, SK -= 8; i > 0; i--, SK -= 8 ) 641 { 642 for( j = 0; j < 4; j++, SK++ ) 643 { 644 *RK++ = RT0[ FSb[ ( *SK ) & 0xFF ] ] ^ 645 RT1[ FSb[ ( *SK >> 8 ) & 0xFF ] ] ^ 646 RT2[ FSb[ ( *SK >> 16 ) & 0xFF ] ] ^ 647 RT3[ FSb[ ( *SK >> 24 ) & 0xFF ] ]; 648 } 649 } 650 651 *RK++ = *SK++; 652 *RK++ = *SK++; 653 *RK++ = *SK++; 654 *RK++ = *SK++; 655 656 exit: 657 mbedtls_aes_free( &cty ); 658 659 return( ret ); 660 } 661 #endif /* !MBEDTLS_AES_SETKEY_DEC_ALT */ 662 663 #define AES_FROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3) \ 664 { \ 665 X0 = *RK++ ^ FT0[ ( Y0 ) & 0xFF ] ^ \ 666 FT1[ ( Y1 >> 8 ) & 0xFF ] ^ \ 667 FT2[ ( Y2 >> 16 ) & 0xFF ] ^ \ 668 FT3[ ( Y3 >> 24 ) & 0xFF ]; \ 669 \ 670 X1 = *RK++ ^ FT0[ ( Y1 ) & 0xFF ] ^ \ 671 FT1[ ( Y2 >> 8 ) & 0xFF ] ^ \ 672 FT2[ ( Y3 >> 16 ) & 0xFF ] ^ \ 673 FT3[ ( Y0 >> 24 ) & 0xFF ]; \ 674 \ 675 X2 = *RK++ ^ FT0[ ( Y2 ) & 0xFF ] ^ \ 676 FT1[ ( Y3 >> 8 ) & 0xFF ] ^ \ 677 FT2[ ( Y0 >> 16 ) & 0xFF ] ^ \ 678 FT3[ ( Y1 >> 24 ) & 0xFF ]; \ 679 \ 680 X3 = *RK++ ^ FT0[ ( Y3 ) & 0xFF ] ^ \ 681 FT1[ ( Y0 >> 8 ) & 0xFF ] ^ \ 682 FT2[ ( Y1 >> 16 ) & 0xFF ] ^ \ 683 FT3[ ( Y2 >> 24 ) & 0xFF ]; \ 684 } 685 686 #define AES_RROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3) \ 687 { \ 688 X0 = *RK++ ^ RT0[ ( Y0 ) & 0xFF ] ^ \ 689 RT1[ ( Y3 >> 8 ) & 0xFF ] ^ \ 690 RT2[ ( Y2 >> 16 ) & 0xFF ] ^ \ 691 RT3[ ( Y1 >> 24 ) & 0xFF ]; \ 692 \ 693 X1 = *RK++ ^ RT0[ ( Y1 ) & 0xFF ] ^ \ 694 RT1[ ( Y0 >> 8 ) & 0xFF ] ^ \ 695 RT2[ ( Y3 >> 16 ) & 0xFF ] ^ \ 696 RT3[ ( Y2 >> 24 ) & 0xFF ]; \ 697 \ 698 X2 = *RK++ ^ RT0[ ( Y2 ) & 0xFF ] ^ \ 699 RT1[ ( Y1 >> 8 ) & 0xFF ] ^ \ 700 RT2[ ( Y0 >> 16 ) & 0xFF ] ^ \ 701 RT3[ ( Y3 >> 24 ) & 0xFF ]; \ 702 \ 703 X3 = *RK++ ^ RT0[ ( Y3 ) & 0xFF ] ^ \ 704 RT1[ ( Y2 >> 8 ) & 0xFF ] ^ \ 705 RT2[ ( Y1 >> 16 ) & 0xFF ] ^ \ 706 RT3[ ( Y0 >> 24 ) & 0xFF ]; \ 707 } 708 709 /* 710 * AES-ECB block encryption 711 */ 712 #if !defined(MBEDTLS_AES_ENCRYPT_ALT) 713 int mbedtls_internal_aes_encrypt( mbedtls_aes_context *ctx, 714 const unsigned char input[16], 715 unsigned char output[16] ) 716 { 717 int i; 718 uint32_t *RK, X0, X1, X2, X3, Y0, Y1, Y2, Y3; 719 720 RK = ctx->rk; 721 722 GET_UINT32_LE( X0, input, 0 ); X0 ^= *RK++; 723 GET_UINT32_LE( X1, input, 4 ); X1 ^= *RK++; 724 GET_UINT32_LE( X2, input, 8 ); X2 ^= *RK++; 725 GET_UINT32_LE( X3, input, 12 ); X3 ^= *RK++; 726 727 for( i = ( ctx->nr >> 1 ) - 1; i > 0; i-- ) 728 { 729 AES_FROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 ); 730 AES_FROUND( X0, X1, X2, X3, Y0, Y1, Y2, Y3 ); 731 } 732 733 AES_FROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 ); 734 735 X0 = *RK++ ^ \ 736 ( (uint32_t) FSb[ ( Y0 ) & 0xFF ] ) ^ 737 ( (uint32_t) FSb[ ( Y1 >> 8 ) & 0xFF ] << 8 ) ^ 738 ( (uint32_t) FSb[ ( Y2 >> 16 ) & 0xFF ] << 16 ) ^ 739 ( (uint32_t) FSb[ ( Y3 >> 24 ) & 0xFF ] << 24 ); 740 741 X1 = *RK++ ^ \ 742 ( (uint32_t) FSb[ ( Y1 ) & 0xFF ] ) ^ 743 ( (uint32_t) FSb[ ( Y2 >> 8 ) & 0xFF ] << 8 ) ^ 744 ( (uint32_t) FSb[ ( Y3 >> 16 ) & 0xFF ] << 16 ) ^ 745 ( (uint32_t) FSb[ ( Y0 >> 24 ) & 0xFF ] << 24 ); 746 747 X2 = *RK++ ^ \ 748 ( (uint32_t) FSb[ ( Y2 ) & 0xFF ] ) ^ 749 ( (uint32_t) FSb[ ( Y3 >> 8 ) & 0xFF ] << 8 ) ^ 750 ( (uint32_t) FSb[ ( Y0 >> 16 ) & 0xFF ] << 16 ) ^ 751 ( (uint32_t) FSb[ ( Y1 >> 24 ) & 0xFF ] << 24 ); 752 753 X3 = *RK++ ^ \ 754 ( (uint32_t) FSb[ ( Y3 ) & 0xFF ] ) ^ 755 ( (uint32_t) FSb[ ( Y0 >> 8 ) & 0xFF ] << 8 ) ^ 756 ( (uint32_t) FSb[ ( Y1 >> 16 ) & 0xFF ] << 16 ) ^ 757 ( (uint32_t) FSb[ ( Y2 >> 24 ) & 0xFF ] << 24 ); 758 759 PUT_UINT32_LE( X0, output, 0 ); 760 PUT_UINT32_LE( X1, output, 4 ); 761 PUT_UINT32_LE( X2, output, 8 ); 762 PUT_UINT32_LE( X3, output, 12 ); 763 764 return( 0 ); 765 } 766 #endif /* !MBEDTLS_AES_ENCRYPT_ALT */ 767 768 void mbedtls_aes_encrypt( mbedtls_aes_context *ctx, 769 const unsigned char input[16], 770 unsigned char output[16] ) 771 { 772 mbedtls_internal_aes_encrypt( ctx, input, output ); 773 } 774 775 /* 776 * AES-ECB block decryption 777 */ 778 #if !defined(MBEDTLS_AES_DECRYPT_ALT) 779 int mbedtls_internal_aes_decrypt( mbedtls_aes_context *ctx, 780 const unsigned char input[16], 781 unsigned char output[16] ) 782 { 783 int i; 784 uint32_t *RK, X0, X1, X2, X3, Y0, Y1, Y2, Y3; 785 786 RK = ctx->rk; 787 788 GET_UINT32_LE( X0, input, 0 ); X0 ^= *RK++; 789 GET_UINT32_LE( X1, input, 4 ); X1 ^= *RK++; 790 GET_UINT32_LE( X2, input, 8 ); X2 ^= *RK++; 791 GET_UINT32_LE( X3, input, 12 ); X3 ^= *RK++; 792 793 for( i = ( ctx->nr >> 1 ) - 1; i > 0; i-- ) 794 { 795 AES_RROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 ); 796 AES_RROUND( X0, X1, X2, X3, Y0, Y1, Y2, Y3 ); 797 } 798 799 AES_RROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 ); 800 801 X0 = *RK++ ^ \ 802 ( (uint32_t) RSb[ ( Y0 ) & 0xFF ] ) ^ 803 ( (uint32_t) RSb[ ( Y3 >> 8 ) & 0xFF ] << 8 ) ^ 804 ( (uint32_t) RSb[ ( Y2 >> 16 ) & 0xFF ] << 16 ) ^ 805 ( (uint32_t) RSb[ ( Y1 >> 24 ) & 0xFF ] << 24 ); 806 807 X1 = *RK++ ^ \ 808 ( (uint32_t) RSb[ ( Y1 ) & 0xFF ] ) ^ 809 ( (uint32_t) RSb[ ( Y0 >> 8 ) & 0xFF ] << 8 ) ^ 810 ( (uint32_t) RSb[ ( Y3 >> 16 ) & 0xFF ] << 16 ) ^ 811 ( (uint32_t) RSb[ ( Y2 >> 24 ) & 0xFF ] << 24 ); 812 813 X2 = *RK++ ^ \ 814 ( (uint32_t) RSb[ ( Y2 ) & 0xFF ] ) ^ 815 ( (uint32_t) RSb[ ( Y1 >> 8 ) & 0xFF ] << 8 ) ^ 816 ( (uint32_t) RSb[ ( Y0 >> 16 ) & 0xFF ] << 16 ) ^ 817 ( (uint32_t) RSb[ ( Y3 >> 24 ) & 0xFF ] << 24 ); 818 819 X3 = *RK++ ^ \ 820 ( (uint32_t) RSb[ ( Y3 ) & 0xFF ] ) ^ 821 ( (uint32_t) RSb[ ( Y2 >> 8 ) & 0xFF ] << 8 ) ^ 822 ( (uint32_t) RSb[ ( Y1 >> 16 ) & 0xFF ] << 16 ) ^ 823 ( (uint32_t) RSb[ ( Y0 >> 24 ) & 0xFF ] << 24 ); 824 825 PUT_UINT32_LE( X0, output, 0 ); 826 PUT_UINT32_LE( X1, output, 4 ); 827 PUT_UINT32_LE( X2, output, 8 ); 828 PUT_UINT32_LE( X3, output, 12 ); 829 830 return( 0 ); 831 } 832 #endif /* !MBEDTLS_AES_DECRYPT_ALT */ 833 834 void mbedtls_aes_decrypt( mbedtls_aes_context *ctx, 835 const unsigned char input[16], 836 unsigned char output[16] ) 837 { 838 mbedtls_internal_aes_decrypt( ctx, input, output ); 839 } 840 841 /* 842 * AES-ECB block encryption/decryption 843 */ 844 int mbedtls_aes_crypt_ecb( mbedtls_aes_context *ctx, 845 int mode, 846 const unsigned char input[16], 847 unsigned char output[16] ) 848 { 849 #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64) 850 if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) ) 851 return( mbedtls_aesni_crypt_ecb( ctx, mode, input, output ) ); 852 #endif 853 854 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_HAVE_X86) 855 if( aes_padlock_ace ) 856 { 857 if( mbedtls_padlock_xcryptecb( ctx, mode, input, output ) == 0 ) 858 return( 0 ); 859 860 // If padlock data misaligned, we just fall back to 861 // unaccelerated mode 862 // 863 } 864 #endif 865 866 if( mode == MBEDTLS_AES_ENCRYPT ) 867 return( mbedtls_internal_aes_encrypt( ctx, input, output ) ); 868 else 869 return( mbedtls_internal_aes_decrypt( ctx, input, output ) ); 870 } 871 872 #if defined(MBEDTLS_CIPHER_MODE_CBC) 873 /* 874 * AES-CBC buffer encryption/decryption 875 */ 876 int mbedtls_aes_crypt_cbc( mbedtls_aes_context *ctx, 877 int mode, 878 size_t length, 879 unsigned char iv[16], 880 const unsigned char *input, 881 unsigned char *output ) 882 { 883 int i; 884 unsigned char temp[16]; 885 886 if( length % 16 ) 887 return( MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH ); 888 889 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_HAVE_X86) 890 if( aes_padlock_ace ) 891 { 892 if( mbedtls_padlock_xcryptcbc( ctx, mode, length, iv, input, output ) == 0 ) 893 return( 0 ); 894 895 // If padlock data misaligned, we just fall back to 896 // unaccelerated mode 897 // 898 } 899 #endif 900 901 if( mode == MBEDTLS_AES_DECRYPT ) 902 { 903 while( length > 0 ) 904 { 905 memcpy( temp, input, 16 ); 906 mbedtls_aes_crypt_ecb( ctx, mode, input, output ); 907 908 for( i = 0; i < 16; i++ ) 909 output[i] = (unsigned char)( output[i] ^ iv[i] ); 910 911 memcpy( iv, temp, 16 ); 912 913 input += 16; 914 output += 16; 915 length -= 16; 916 } 917 } 918 else 919 { 920 while( length > 0 ) 921 { 922 for( i = 0; i < 16; i++ ) 923 output[i] = (unsigned char)( input[i] ^ iv[i] ); 924 925 mbedtls_aes_crypt_ecb( ctx, mode, output, output ); 926 memcpy( iv, output, 16 ); 927 928 input += 16; 929 output += 16; 930 length -= 16; 931 } 932 } 933 934 return( 0 ); 935 } 936 #endif /* MBEDTLS_CIPHER_MODE_CBC */ 937 938 #if defined(MBEDTLS_CIPHER_MODE_CFB) 939 /* 940 * AES-CFB128 buffer encryption/decryption 941 */ 942 int mbedtls_aes_crypt_cfb128( mbedtls_aes_context *ctx, 943 int mode, 944 size_t length, 945 size_t *iv_off, 946 unsigned char iv[16], 947 const unsigned char *input, 948 unsigned char *output ) 949 { 950 int c; 951 size_t n = *iv_off; 952 953 if( mode == MBEDTLS_AES_DECRYPT ) 954 { 955 while( length-- ) 956 { 957 if( n == 0 ) 958 mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv ); 959 960 c = *input++; 961 *output++ = (unsigned char)( c ^ iv[n] ); 962 iv[n] = (unsigned char) c; 963 964 n = ( n + 1 ) & 0x0F; 965 } 966 } 967 else 968 { 969 while( length-- ) 970 { 971 if( n == 0 ) 972 mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv ); 973 974 iv[n] = *output++ = (unsigned char)( iv[n] ^ *input++ ); 975 976 n = ( n + 1 ) & 0x0F; 977 } 978 } 979 980 *iv_off = n; 981 982 return( 0 ); 983 } 984 985 /* 986 * AES-CFB8 buffer encryption/decryption 987 */ 988 int mbedtls_aes_crypt_cfb8( mbedtls_aes_context *ctx, 989 int mode, 990 size_t length, 991 unsigned char iv[16], 992 const unsigned char *input, 993 unsigned char *output ) 994 { 995 unsigned char c; 996 unsigned char ov[17]; 997 998 while( length-- ) 999 { 1000 memcpy( ov, iv, 16 ); 1001 mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv ); 1002 1003 if( mode == MBEDTLS_AES_DECRYPT ) 1004 ov[16] = *input; 1005 1006 c = *output++ = (unsigned char)( iv[0] ^ *input++ ); 1007 1008 if( mode == MBEDTLS_AES_ENCRYPT ) 1009 ov[16] = c; 1010 1011 memcpy( iv, ov + 1, 16 ); 1012 } 1013 1014 return( 0 ); 1015 } 1016 #endif /*MBEDTLS_CIPHER_MODE_CFB */ 1017 1018 #if defined(MBEDTLS_CIPHER_MODE_CTR) 1019 /* 1020 * AES-CTR buffer encryption/decryption 1021 */ 1022 int mbedtls_aes_crypt_ctr( mbedtls_aes_context *ctx, 1023 size_t length, 1024 size_t *nc_off, 1025 unsigned char nonce_counter[16], 1026 unsigned char stream_block[16], 1027 const unsigned char *input, 1028 unsigned char *output ) 1029 { 1030 int c, i; 1031 size_t n = *nc_off; 1032 1033 while( length-- ) 1034 { 1035 if( n == 0 ) { 1036 mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, nonce_counter, stream_block ); 1037 1038 for( i = 16; i > 0; i-- ) 1039 if( ++nonce_counter[i - 1] != 0 ) 1040 break; 1041 } 1042 c = *input++; 1043 *output++ = (unsigned char)( c ^ stream_block[n] ); 1044 1045 n = ( n + 1 ) & 0x0F; 1046 } 1047 1048 *nc_off = n; 1049 1050 return( 0 ); 1051 } 1052 #endif /* MBEDTLS_CIPHER_MODE_CTR */ 1053 1054 #endif /* !MBEDTLS_AES_ALT */ 1055 1056 #if defined(MBEDTLS_SELF_TEST) 1057 /* 1058 * AES test vectors from: 1059 * 1060 * http://csrc.nist.gov/archive/aes/rijndael/rijndael-vals.zip 1061 */ 1062 static const unsigned char aes_test_ecb_dec[3][16] = 1063 { 1064 { 0x44, 0x41, 0x6A, 0xC2, 0xD1, 0xF5, 0x3C, 0x58, 1065 0x33, 0x03, 0x91, 0x7E, 0x6B, 0xE9, 0xEB, 0xE0 }, 1066 { 0x48, 0xE3, 0x1E, 0x9E, 0x25, 0x67, 0x18, 0xF2, 1067 0x92, 0x29, 0x31, 0x9C, 0x19, 0xF1, 0x5B, 0xA4 }, 1068 { 0x05, 0x8C, 0xCF, 0xFD, 0xBB, 0xCB, 0x38, 0x2D, 1069 0x1F, 0x6F, 0x56, 0x58, 0x5D, 0x8A, 0x4A, 0xDE } 1070 }; 1071 1072 static const unsigned char aes_test_ecb_enc[3][16] = 1073 { 1074 { 0xC3, 0x4C, 0x05, 0x2C, 0xC0, 0xDA, 0x8D, 0x73, 1075 0x45, 0x1A, 0xFE, 0x5F, 0x03, 0xBE, 0x29, 0x7F }, 1076 { 0xF3, 0xF6, 0x75, 0x2A, 0xE8, 0xD7, 0x83, 0x11, 1077 0x38, 0xF0, 0x41, 0x56, 0x06, 0x31, 0xB1, 0x14 }, 1078 { 0x8B, 0x79, 0xEE, 0xCC, 0x93, 0xA0, 0xEE, 0x5D, 1079 0xFF, 0x30, 0xB4, 0xEA, 0x21, 0x63, 0x6D, 0xA4 } 1080 }; 1081 1082 #if defined(MBEDTLS_CIPHER_MODE_CBC) 1083 static const unsigned char aes_test_cbc_dec[3][16] = 1084 { 1085 { 0xFA, 0xCA, 0x37, 0xE0, 0xB0, 0xC8, 0x53, 0x73, 1086 0xDF, 0x70, 0x6E, 0x73, 0xF7, 0xC9, 0xAF, 0x86 }, 1087 { 0x5D, 0xF6, 0x78, 0xDD, 0x17, 0xBA, 0x4E, 0x75, 1088 0xB6, 0x17, 0x68, 0xC6, 0xAD, 0xEF, 0x7C, 0x7B }, 1089 { 0x48, 0x04, 0xE1, 0x81, 0x8F, 0xE6, 0x29, 0x75, 1090 0x19, 0xA3, 0xE8, 0x8C, 0x57, 0x31, 0x04, 0x13 } 1091 }; 1092 1093 static const unsigned char aes_test_cbc_enc[3][16] = 1094 { 1095 { 0x8A, 0x05, 0xFC, 0x5E, 0x09, 0x5A, 0xF4, 0x84, 1096 0x8A, 0x08, 0xD3, 0x28, 0xD3, 0x68, 0x8E, 0x3D }, 1097 { 0x7B, 0xD9, 0x66, 0xD5, 0x3A, 0xD8, 0xC1, 0xBB, 1098 0x85, 0xD2, 0xAD, 0xFA, 0xE8, 0x7B, 0xB1, 0x04 }, 1099 { 0xFE, 0x3C, 0x53, 0x65, 0x3E, 0x2F, 0x45, 0xB5, 1100 0x6F, 0xCD, 0x88, 0xB2, 0xCC, 0x89, 0x8F, 0xF0 } 1101 }; 1102 #endif /* MBEDTLS_CIPHER_MODE_CBC */ 1103 1104 #if defined(MBEDTLS_CIPHER_MODE_CFB) 1105 /* 1106 * AES-CFB128 test vectors from: 1107 * 1108 * http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf 1109 */ 1110 static const unsigned char aes_test_cfb128_key[3][32] = 1111 { 1112 { 0x2B, 0x7E, 0x15, 0x16, 0x28, 0xAE, 0xD2, 0xA6, 1113 0xAB, 0xF7, 0x15, 0x88, 0x09, 0xCF, 0x4F, 0x3C }, 1114 { 0x8E, 0x73, 0xB0, 0xF7, 0xDA, 0x0E, 0x64, 0x52, 1115 0xC8, 0x10, 0xF3, 0x2B, 0x80, 0x90, 0x79, 0xE5, 1116 0x62, 0xF8, 0xEA, 0xD2, 0x52, 0x2C, 0x6B, 0x7B }, 1117 { 0x60, 0x3D, 0xEB, 0x10, 0x15, 0xCA, 0x71, 0xBE, 1118 0x2B, 0x73, 0xAE, 0xF0, 0x85, 0x7D, 0x77, 0x81, 1119 0x1F, 0x35, 0x2C, 0x07, 0x3B, 0x61, 0x08, 0xD7, 1120 0x2D, 0x98, 0x10, 0xA3, 0x09, 0x14, 0xDF, 0xF4 } 1121 }; 1122 1123 static const unsigned char aes_test_cfb128_iv[16] = 1124 { 1125 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 1126 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F 1127 }; 1128 1129 static const unsigned char aes_test_cfb128_pt[64] = 1130 { 1131 0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96, 1132 0xE9, 0x3D, 0x7E, 0x11, 0x73, 0x93, 0x17, 0x2A, 1133 0xAE, 0x2D, 0x8A, 0x57, 0x1E, 0x03, 0xAC, 0x9C, 1134 0x9E, 0xB7, 0x6F, 0xAC, 0x45, 0xAF, 0x8E, 0x51, 1135 0x30, 0xC8, 0x1C, 0x46, 0xA3, 0x5C, 0xE4, 0x11, 1136 0xE5, 0xFB, 0xC1, 0x19, 0x1A, 0x0A, 0x52, 0xEF, 1137 0xF6, 0x9F, 0x24, 0x45, 0xDF, 0x4F, 0x9B, 0x17, 1138 0xAD, 0x2B, 0x41, 0x7B, 0xE6, 0x6C, 0x37, 0x10 1139 }; 1140 1141 static const unsigned char aes_test_cfb128_ct[3][64] = 1142 { 1143 { 0x3B, 0x3F, 0xD9, 0x2E, 0xB7, 0x2D, 0xAD, 0x20, 1144 0x33, 0x34, 0x49, 0xF8, 0xE8, 0x3C, 0xFB, 0x4A, 1145 0xC8, 0xA6, 0x45, 0x37, 0xA0, 0xB3, 0xA9, 0x3F, 1146 0xCD, 0xE3, 0xCD, 0xAD, 0x9F, 0x1C, 0xE5, 0x8B, 1147 0x26, 0x75, 0x1F, 0x67, 0xA3, 0xCB, 0xB1, 0x40, 1148 0xB1, 0x80, 0x8C, 0xF1, 0x87, 0xA4, 0xF4, 0xDF, 1149 0xC0, 0x4B, 0x05, 0x35, 0x7C, 0x5D, 0x1C, 0x0E, 1150 0xEA, 0xC4, 0xC6, 0x6F, 0x9F, 0xF7, 0xF2, 0xE6 }, 1151 { 0xCD, 0xC8, 0x0D, 0x6F, 0xDD, 0xF1, 0x8C, 0xAB, 1152 0x34, 0xC2, 0x59, 0x09, 0xC9, 0x9A, 0x41, 0x74, 1153 0x67, 0xCE, 0x7F, 0x7F, 0x81, 0x17, 0x36, 0x21, 1154 0x96, 0x1A, 0x2B, 0x70, 0x17, 0x1D, 0x3D, 0x7A, 1155 0x2E, 0x1E, 0x8A, 0x1D, 0xD5, 0x9B, 0x88, 0xB1, 1156 0xC8, 0xE6, 0x0F, 0xED, 0x1E, 0xFA, 0xC4, 0xC9, 1157 0xC0, 0x5F, 0x9F, 0x9C, 0xA9, 0x83, 0x4F, 0xA0, 1158 0x42, 0xAE, 0x8F, 0xBA, 0x58, 0x4B, 0x09, 0xFF }, 1159 { 0xDC, 0x7E, 0x84, 0xBF, 0xDA, 0x79, 0x16, 0x4B, 1160 0x7E, 0xCD, 0x84, 0x86, 0x98, 0x5D, 0x38, 0x60, 1161 0x39, 0xFF, 0xED, 0x14, 0x3B, 0x28, 0xB1, 0xC8, 1162 0x32, 0x11, 0x3C, 0x63, 0x31, 0xE5, 0x40, 0x7B, 1163 0xDF, 0x10, 0x13, 0x24, 0x15, 0xE5, 0x4B, 0x92, 1164 0xA1, 0x3E, 0xD0, 0xA8, 0x26, 0x7A, 0xE2, 0xF9, 1165 0x75, 0xA3, 0x85, 0x74, 0x1A, 0xB9, 0xCE, 0xF8, 1166 0x20, 0x31, 0x62, 0x3D, 0x55, 0xB1, 0xE4, 0x71 } 1167 }; 1168 #endif /* MBEDTLS_CIPHER_MODE_CFB */ 1169 1170 #if defined(MBEDTLS_CIPHER_MODE_CTR) 1171 /* 1172 * AES-CTR test vectors from: 1173 * 1174 * http://www.faqs.org/rfcs/rfc3686.html 1175 */ 1176 1177 static const unsigned char aes_test_ctr_key[3][16] = 1178 { 1179 { 0xAE, 0x68, 0x52, 0xF8, 0x12, 0x10, 0x67, 0xCC, 1180 0x4B, 0xF7, 0xA5, 0x76, 0x55, 0x77, 0xF3, 0x9E }, 1181 { 0x7E, 0x24, 0x06, 0x78, 0x17, 0xFA, 0xE0, 0xD7, 1182 0x43, 0xD6, 0xCE, 0x1F, 0x32, 0x53, 0x91, 0x63 }, 1183 { 0x76, 0x91, 0xBE, 0x03, 0x5E, 0x50, 0x20, 0xA8, 1184 0xAC, 0x6E, 0x61, 0x85, 0x29, 0xF9, 0xA0, 0xDC } 1185 }; 1186 1187 static const unsigned char aes_test_ctr_nonce_counter[3][16] = 1188 { 1189 { 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x00, 1190 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 }, 1191 { 0x00, 0x6C, 0xB6, 0xDB, 0xC0, 0x54, 0x3B, 0x59, 1192 0xDA, 0x48, 0xD9, 0x0B, 0x00, 0x00, 0x00, 0x01 }, 1193 { 0x00, 0xE0, 0x01, 0x7B, 0x27, 0x77, 0x7F, 0x3F, 1194 0x4A, 0x17, 0x86, 0xF0, 0x00, 0x00, 0x00, 0x01 } 1195 }; 1196 1197 static const unsigned char aes_test_ctr_pt[3][48] = 1198 { 1199 { 0x53, 0x69, 0x6E, 0x67, 0x6C, 0x65, 0x20, 0x62, 1200 0x6C, 0x6F, 0x63, 0x6B, 0x20, 0x6D, 0x73, 0x67 }, 1201 1202 { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 1203 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 1204 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 1205 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F }, 1206 1207 { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 1208 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 1209 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 1210 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 1211 0x20, 0x21, 0x22, 0x23 } 1212 }; 1213 1214 static const unsigned char aes_test_ctr_ct[3][48] = 1215 { 1216 { 0xE4, 0x09, 0x5D, 0x4F, 0xB7, 0xA7, 0xB3, 0x79, 1217 0x2D, 0x61, 0x75, 0xA3, 0x26, 0x13, 0x11, 0xB8 }, 1218 { 0x51, 0x04, 0xA1, 0x06, 0x16, 0x8A, 0x72, 0xD9, 1219 0x79, 0x0D, 0x41, 0xEE, 0x8E, 0xDA, 0xD3, 0x88, 1220 0xEB, 0x2E, 0x1E, 0xFC, 0x46, 0xDA, 0x57, 0xC8, 1221 0xFC, 0xE6, 0x30, 0xDF, 0x91, 0x41, 0xBE, 0x28 }, 1222 { 0xC1, 0xCF, 0x48, 0xA8, 0x9F, 0x2F, 0xFD, 0xD9, 1223 0xCF, 0x46, 0x52, 0xE9, 0xEF, 0xDB, 0x72, 0xD7, 1224 0x45, 0x40, 0xA4, 0x2B, 0xDE, 0x6D, 0x78, 0x36, 1225 0xD5, 0x9A, 0x5C, 0xEA, 0xAE, 0xF3, 0x10, 0x53, 1226 0x25, 0xB2, 0x07, 0x2F } 1227 }; 1228 1229 static const int aes_test_ctr_len[3] = 1230 { 16, 32, 36 }; 1231 #endif /* MBEDTLS_CIPHER_MODE_CTR */ 1232 1233 /* 1234 * Checkup routine 1235 */ 1236 int mbedtls_aes_self_test( int verbose ) 1237 { 1238 int ret = 0, i, j, u, v; 1239 unsigned char key[32]; 1240 unsigned char buf[64]; 1241 #if defined(MBEDTLS_CIPHER_MODE_CBC) || defined(MBEDTLS_CIPHER_MODE_CFB) 1242 unsigned char iv[16]; 1243 #endif 1244 #if defined(MBEDTLS_CIPHER_MODE_CBC) 1245 unsigned char prv[16]; 1246 #endif 1247 #if defined(MBEDTLS_CIPHER_MODE_CTR) || defined(MBEDTLS_CIPHER_MODE_CFB) 1248 size_t offset; 1249 #endif 1250 #if defined(MBEDTLS_CIPHER_MODE_CTR) 1251 int len; 1252 unsigned char nonce_counter[16]; 1253 unsigned char stream_block[16]; 1254 #endif 1255 mbedtls_aes_context ctx; 1256 1257 memset( key, 0, 32 ); 1258 mbedtls_aes_init( &ctx ); 1259 1260 /* 1261 * ECB mode 1262 */ 1263 for( i = 0; i < 6; i++ ) 1264 { 1265 u = i >> 1; 1266 v = i & 1; 1267 1268 if( verbose != 0 ) 1269 mbedtls_printf( " AES-ECB-%3d (%s): ", 128 + u * 64, 1270 ( v == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" ); 1271 1272 memset( buf, 0, 16 ); 1273 1274 if( v == MBEDTLS_AES_DECRYPT ) 1275 { 1276 mbedtls_aes_setkey_dec( &ctx, key, 128 + u * 64 ); 1277 1278 for( j = 0; j < 10000; j++ ) 1279 mbedtls_aes_crypt_ecb( &ctx, v, buf, buf ); 1280 1281 if( memcmp( buf, aes_test_ecb_dec[u], 16 ) != 0 ) 1282 { 1283 if( verbose != 0 ) 1284 mbedtls_printf( "failed\n" ); 1285 1286 ret = 1; 1287 goto exit; 1288 } 1289 } 1290 else 1291 { 1292 mbedtls_aes_setkey_enc( &ctx, key, 128 + u * 64 ); 1293 1294 for( j = 0; j < 10000; j++ ) 1295 mbedtls_aes_crypt_ecb( &ctx, v, buf, buf ); 1296 1297 if( memcmp( buf, aes_test_ecb_enc[u], 16 ) != 0 ) 1298 { 1299 if( verbose != 0 ) 1300 mbedtls_printf( "failed\n" ); 1301 1302 ret = 1; 1303 goto exit; 1304 } 1305 } 1306 1307 if( verbose != 0 ) 1308 mbedtls_printf( "passed\n" ); 1309 } 1310 1311 if( verbose != 0 ) 1312 mbedtls_printf( "\n" ); 1313 1314 #if defined(MBEDTLS_CIPHER_MODE_CBC) 1315 /* 1316 * CBC mode 1317 */ 1318 for( i = 0; i < 6; i++ ) 1319 { 1320 u = i >> 1; 1321 v = i & 1; 1322 1323 if( verbose != 0 ) 1324 mbedtls_printf( " AES-CBC-%3d (%s): ", 128 + u * 64, 1325 ( v == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" ); 1326 1327 memset( iv , 0, 16 ); 1328 memset( prv, 0, 16 ); 1329 memset( buf, 0, 16 ); 1330 1331 if( v == MBEDTLS_AES_DECRYPT ) 1332 { 1333 mbedtls_aes_setkey_dec( &ctx, key, 128 + u * 64 ); 1334 1335 for( j = 0; j < 10000; j++ ) 1336 mbedtls_aes_crypt_cbc( &ctx, v, 16, iv, buf, buf ); 1337 1338 if( memcmp( buf, aes_test_cbc_dec[u], 16 ) != 0 ) 1339 { 1340 if( verbose != 0 ) 1341 mbedtls_printf( "failed\n" ); 1342 1343 ret = 1; 1344 goto exit; 1345 } 1346 } 1347 else 1348 { 1349 mbedtls_aes_setkey_enc( &ctx, key, 128 + u * 64 ); 1350 1351 for( j = 0; j < 10000; j++ ) 1352 { 1353 unsigned char tmp[16]; 1354 1355 mbedtls_aes_crypt_cbc( &ctx, v, 16, iv, buf, buf ); 1356 1357 memcpy( tmp, prv, 16 ); 1358 memcpy( prv, buf, 16 ); 1359 memcpy( buf, tmp, 16 ); 1360 } 1361 1362 if( memcmp( prv, aes_test_cbc_enc[u], 16 ) != 0 ) 1363 { 1364 if( verbose != 0 ) 1365 mbedtls_printf( "failed\n" ); 1366 1367 ret = 1; 1368 goto exit; 1369 } 1370 } 1371 1372 if( verbose != 0 ) 1373 mbedtls_printf( "passed\n" ); 1374 } 1375 1376 if( verbose != 0 ) 1377 mbedtls_printf( "\n" ); 1378 #endif /* MBEDTLS_CIPHER_MODE_CBC */ 1379 1380 #if defined(MBEDTLS_CIPHER_MODE_CFB) 1381 /* 1382 * CFB128 mode 1383 */ 1384 for( i = 0; i < 6; i++ ) 1385 { 1386 u = i >> 1; 1387 v = i & 1; 1388 1389 if( verbose != 0 ) 1390 mbedtls_printf( " AES-CFB128-%3d (%s): ", 128 + u * 64, 1391 ( v == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" ); 1392 1393 memcpy( iv, aes_test_cfb128_iv, 16 ); 1394 memcpy( key, aes_test_cfb128_key[u], 16 + u * 8 ); 1395 1396 offset = 0; 1397 mbedtls_aes_setkey_enc( &ctx, key, 128 + u * 64 ); 1398 1399 if( v == MBEDTLS_AES_DECRYPT ) 1400 { 1401 memcpy( buf, aes_test_cfb128_ct[u], 64 ); 1402 mbedtls_aes_crypt_cfb128( &ctx, v, 64, &offset, iv, buf, buf ); 1403 1404 if( memcmp( buf, aes_test_cfb128_pt, 64 ) != 0 ) 1405 { 1406 if( verbose != 0 ) 1407 mbedtls_printf( "failed\n" ); 1408 1409 ret = 1; 1410 goto exit; 1411 } 1412 } 1413 else 1414 { 1415 memcpy( buf, aes_test_cfb128_pt, 64 ); 1416 mbedtls_aes_crypt_cfb128( &ctx, v, 64, &offset, iv, buf, buf ); 1417 1418 if( memcmp( buf, aes_test_cfb128_ct[u], 64 ) != 0 ) 1419 { 1420 if( verbose != 0 ) 1421 mbedtls_printf( "failed\n" ); 1422 1423 ret = 1; 1424 goto exit; 1425 } 1426 } 1427 1428 if( verbose != 0 ) 1429 mbedtls_printf( "passed\n" ); 1430 } 1431 1432 if( verbose != 0 ) 1433 mbedtls_printf( "\n" ); 1434 #endif /* MBEDTLS_CIPHER_MODE_CFB */ 1435 1436 #if defined(MBEDTLS_CIPHER_MODE_CTR) 1437 /* 1438 * CTR mode 1439 */ 1440 for( i = 0; i < 6; i++ ) 1441 { 1442 u = i >> 1; 1443 v = i & 1; 1444 1445 if( verbose != 0 ) 1446 mbedtls_printf( " AES-CTR-128 (%s): ", 1447 ( v == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" ); 1448 1449 memcpy( nonce_counter, aes_test_ctr_nonce_counter[u], 16 ); 1450 memcpy( key, aes_test_ctr_key[u], 16 ); 1451 1452 offset = 0; 1453 mbedtls_aes_setkey_enc( &ctx, key, 128 ); 1454 1455 if( v == MBEDTLS_AES_DECRYPT ) 1456 { 1457 len = aes_test_ctr_len[u]; 1458 memcpy( buf, aes_test_ctr_ct[u], len ); 1459 1460 mbedtls_aes_crypt_ctr( &ctx, len, &offset, nonce_counter, stream_block, 1461 buf, buf ); 1462 1463 if( memcmp( buf, aes_test_ctr_pt[u], len ) != 0 ) 1464 { 1465 if( verbose != 0 ) 1466 mbedtls_printf( "failed\n" ); 1467 1468 ret = 1; 1469 goto exit; 1470 } 1471 } 1472 else 1473 { 1474 len = aes_test_ctr_len[u]; 1475 memcpy( buf, aes_test_ctr_pt[u], len ); 1476 1477 mbedtls_aes_crypt_ctr( &ctx, len, &offset, nonce_counter, stream_block, 1478 buf, buf ); 1479 1480 if( memcmp( buf, aes_test_ctr_ct[u], len ) != 0 ) 1481 { 1482 if( verbose != 0 ) 1483 mbedtls_printf( "failed\n" ); 1484 1485 ret = 1; 1486 goto exit; 1487 } 1488 } 1489 1490 if( verbose != 0 ) 1491 mbedtls_printf( "passed\n" ); 1492 } 1493 1494 if( verbose != 0 ) 1495 mbedtls_printf( "\n" ); 1496 #endif /* MBEDTLS_CIPHER_MODE_CTR */ 1497 1498 ret = 0; 1499 1500 exit: 1501 mbedtls_aes_free( &ctx ); 1502 1503 return( ret ); 1504 } 1505 1506 #endif /* MBEDTLS_SELF_TEST */ 1507 1508 #endif /* MBEDTLS_AES_C */ 1509