1 /*
2  *  FIPS-197 compliant AES implementation
3  *
4  *  Copyright The Mbed TLS Contributors
5  *  SPDX-License-Identifier: Apache-2.0
6  *
7  *  Licensed under the Apache License, Version 2.0 (the "License"); you may
8  *  not use this file except in compliance with the License.
9  *  You may obtain a copy of the License at
10  *
11  *  http://www.apache.org/licenses/LICENSE-2.0
12  *
13  *  Unless required by applicable law or agreed to in writing, software
14  *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15  *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  *  See the License for the specific language governing permissions and
17  *  limitations under the License.
18  */
19 /*
20  *  The AES block cipher was designed by Vincent Rijmen and Joan Daemen.
21  *
22  *  http://csrc.nist.gov/encryption/aes/rijndael/Rijndael.pdf
23  *  http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf
24  */
25 
26 #include "common.h"
27 
28 #if defined(MBEDTLS_AES_C)
29 
30 #include <string.h>
31 
32 #include "mbedtls/aes.h"
33 #include "mbedtls/platform.h"
34 #include "mbedtls/platform_util.h"
35 #include "mbedtls/error.h"
36 #if defined(MBEDTLS_PADLOCK_C)
37 #include "mbedtls/padlock.h"
38 #endif
39 #if defined(MBEDTLS_AESNI_C)
40 #include "mbedtls/aesni.h"
41 #endif
42 
43 #if defined(MBEDTLS_SELF_TEST)
44 #if defined(MBEDTLS_PLATFORM_C)
45 #include "mbedtls/platform.h"
46 #else
47 #include <stdio.h>
48 #define mbedtls_printf printf
49 #endif /* MBEDTLS_PLATFORM_C */
50 #endif /* MBEDTLS_SELF_TEST */
51 
52 #if !defined(MBEDTLS_AES_ALT)
53 
54 /* Parameter validation macros based on platform_util.h */
55 #define AES_VALIDATE_RET( cond )    \
56     MBEDTLS_INTERNAL_VALIDATE_RET( cond, MBEDTLS_ERR_AES_BAD_INPUT_DATA )
57 #define AES_VALIDATE( cond )        \
58     MBEDTLS_INTERNAL_VALIDATE( cond )
59 
60 /*
61  * 32-bit integer manipulation macros (little endian)
62  */
63 #ifndef GET_UINT32_LE
64 #define GET_UINT32_LE(n,b,i)                            \
65 {                                                       \
66     (n) = ( (uint32_t) (b)[(i)    ]       )             \
67         | ( (uint32_t) (b)[(i) + 1] <<  8 )             \
68         | ( (uint32_t) (b)[(i) + 2] << 16 )             \
69         | ( (uint32_t) (b)[(i) + 3] << 24 );            \
70 }
71 #endif
72 
73 #ifndef PUT_UINT32_LE
74 #define PUT_UINT32_LE(n,b,i)                                    \
75 {                                                               \
76     (b)[(i)    ] = (unsigned char) ( ( (n)       ) & 0xFF );    \
77     (b)[(i) + 1] = (unsigned char) ( ( (n) >>  8 ) & 0xFF );    \
78     (b)[(i) + 2] = (unsigned char) ( ( (n) >> 16 ) & 0xFF );    \
79     (b)[(i) + 3] = (unsigned char) ( ( (n) >> 24 ) & 0xFF );    \
80 }
81 #endif
82 
83 #if defined(MBEDTLS_PADLOCK_C) &&                      \
84     ( defined(MBEDTLS_HAVE_X86) || defined(MBEDTLS_PADLOCK_ALIGN16) )
85 static int aes_padlock_ace = -1;
86 #endif
87 
88 #if defined(MBEDTLS_AES_ROM_TABLES)
89 /*
90  * Forward S-box
91  */
92 static const unsigned char FSb[256] =
93 {
94     0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5,
95     0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76,
96     0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0,
97     0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0,
98     0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC,
99     0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,
100     0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A,
101     0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75,
102     0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0,
103     0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84,
104     0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B,
105     0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,
106     0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85,
107     0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8,
108     0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5,
109     0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2,
110     0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17,
111     0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73,
112     0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88,
113     0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB,
114     0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C,
115     0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79,
116     0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9,
117     0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08,
118     0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6,
119     0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A,
120     0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E,
121     0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E,
122     0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94,
123     0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,
124     0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68,
125     0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16
126 };
127 
128 /*
129  * Forward tables
130  */
131 #define FT \
132 \
133     V(A5,63,63,C6), V(84,7C,7C,F8), V(99,77,77,EE), V(8D,7B,7B,F6), \
134     V(0D,F2,F2,FF), V(BD,6B,6B,D6), V(B1,6F,6F,DE), V(54,C5,C5,91), \
135     V(50,30,30,60), V(03,01,01,02), V(A9,67,67,CE), V(7D,2B,2B,56), \
136     V(19,FE,FE,E7), V(62,D7,D7,B5), V(E6,AB,AB,4D), V(9A,76,76,EC), \
137     V(45,CA,CA,8F), V(9D,82,82,1F), V(40,C9,C9,89), V(87,7D,7D,FA), \
138     V(15,FA,FA,EF), V(EB,59,59,B2), V(C9,47,47,8E), V(0B,F0,F0,FB), \
139     V(EC,AD,AD,41), V(67,D4,D4,B3), V(FD,A2,A2,5F), V(EA,AF,AF,45), \
140     V(BF,9C,9C,23), V(F7,A4,A4,53), V(96,72,72,E4), V(5B,C0,C0,9B), \
141     V(C2,B7,B7,75), V(1C,FD,FD,E1), V(AE,93,93,3D), V(6A,26,26,4C), \
142     V(5A,36,36,6C), V(41,3F,3F,7E), V(02,F7,F7,F5), V(4F,CC,CC,83), \
143     V(5C,34,34,68), V(F4,A5,A5,51), V(34,E5,E5,D1), V(08,F1,F1,F9), \
144     V(93,71,71,E2), V(73,D8,D8,AB), V(53,31,31,62), V(3F,15,15,2A), \
145     V(0C,04,04,08), V(52,C7,C7,95), V(65,23,23,46), V(5E,C3,C3,9D), \
146     V(28,18,18,30), V(A1,96,96,37), V(0F,05,05,0A), V(B5,9A,9A,2F), \
147     V(09,07,07,0E), V(36,12,12,24), V(9B,80,80,1B), V(3D,E2,E2,DF), \
148     V(26,EB,EB,CD), V(69,27,27,4E), V(CD,B2,B2,7F), V(9F,75,75,EA), \
149     V(1B,09,09,12), V(9E,83,83,1D), V(74,2C,2C,58), V(2E,1A,1A,34), \
150     V(2D,1B,1B,36), V(B2,6E,6E,DC), V(EE,5A,5A,B4), V(FB,A0,A0,5B), \
151     V(F6,52,52,A4), V(4D,3B,3B,76), V(61,D6,D6,B7), V(CE,B3,B3,7D), \
152     V(7B,29,29,52), V(3E,E3,E3,DD), V(71,2F,2F,5E), V(97,84,84,13), \
153     V(F5,53,53,A6), V(68,D1,D1,B9), V(00,00,00,00), V(2C,ED,ED,C1), \
154     V(60,20,20,40), V(1F,FC,FC,E3), V(C8,B1,B1,79), V(ED,5B,5B,B6), \
155     V(BE,6A,6A,D4), V(46,CB,CB,8D), V(D9,BE,BE,67), V(4B,39,39,72), \
156     V(DE,4A,4A,94), V(D4,4C,4C,98), V(E8,58,58,B0), V(4A,CF,CF,85), \
157     V(6B,D0,D0,BB), V(2A,EF,EF,C5), V(E5,AA,AA,4F), V(16,FB,FB,ED), \
158     V(C5,43,43,86), V(D7,4D,4D,9A), V(55,33,33,66), V(94,85,85,11), \
159     V(CF,45,45,8A), V(10,F9,F9,E9), V(06,02,02,04), V(81,7F,7F,FE), \
160     V(F0,50,50,A0), V(44,3C,3C,78), V(BA,9F,9F,25), V(E3,A8,A8,4B), \
161     V(F3,51,51,A2), V(FE,A3,A3,5D), V(C0,40,40,80), V(8A,8F,8F,05), \
162     V(AD,92,92,3F), V(BC,9D,9D,21), V(48,38,38,70), V(04,F5,F5,F1), \
163     V(DF,BC,BC,63), V(C1,B6,B6,77), V(75,DA,DA,AF), V(63,21,21,42), \
164     V(30,10,10,20), V(1A,FF,FF,E5), V(0E,F3,F3,FD), V(6D,D2,D2,BF), \
165     V(4C,CD,CD,81), V(14,0C,0C,18), V(35,13,13,26), V(2F,EC,EC,C3), \
166     V(E1,5F,5F,BE), V(A2,97,97,35), V(CC,44,44,88), V(39,17,17,2E), \
167     V(57,C4,C4,93), V(F2,A7,A7,55), V(82,7E,7E,FC), V(47,3D,3D,7A), \
168     V(AC,64,64,C8), V(E7,5D,5D,BA), V(2B,19,19,32), V(95,73,73,E6), \
169     V(A0,60,60,C0), V(98,81,81,19), V(D1,4F,4F,9E), V(7F,DC,DC,A3), \
170     V(66,22,22,44), V(7E,2A,2A,54), V(AB,90,90,3B), V(83,88,88,0B), \
171     V(CA,46,46,8C), V(29,EE,EE,C7), V(D3,B8,B8,6B), V(3C,14,14,28), \
172     V(79,DE,DE,A7), V(E2,5E,5E,BC), V(1D,0B,0B,16), V(76,DB,DB,AD), \
173     V(3B,E0,E0,DB), V(56,32,32,64), V(4E,3A,3A,74), V(1E,0A,0A,14), \
174     V(DB,49,49,92), V(0A,06,06,0C), V(6C,24,24,48), V(E4,5C,5C,B8), \
175     V(5D,C2,C2,9F), V(6E,D3,D3,BD), V(EF,AC,AC,43), V(A6,62,62,C4), \
176     V(A8,91,91,39), V(A4,95,95,31), V(37,E4,E4,D3), V(8B,79,79,F2), \
177     V(32,E7,E7,D5), V(43,C8,C8,8B), V(59,37,37,6E), V(B7,6D,6D,DA), \
178     V(8C,8D,8D,01), V(64,D5,D5,B1), V(D2,4E,4E,9C), V(E0,A9,A9,49), \
179     V(B4,6C,6C,D8), V(FA,56,56,AC), V(07,F4,F4,F3), V(25,EA,EA,CF), \
180     V(AF,65,65,CA), V(8E,7A,7A,F4), V(E9,AE,AE,47), V(18,08,08,10), \
181     V(D5,BA,BA,6F), V(88,78,78,F0), V(6F,25,25,4A), V(72,2E,2E,5C), \
182     V(24,1C,1C,38), V(F1,A6,A6,57), V(C7,B4,B4,73), V(51,C6,C6,97), \
183     V(23,E8,E8,CB), V(7C,DD,DD,A1), V(9C,74,74,E8), V(21,1F,1F,3E), \
184     V(DD,4B,4B,96), V(DC,BD,BD,61), V(86,8B,8B,0D), V(85,8A,8A,0F), \
185     V(90,70,70,E0), V(42,3E,3E,7C), V(C4,B5,B5,71), V(AA,66,66,CC), \
186     V(D8,48,48,90), V(05,03,03,06), V(01,F6,F6,F7), V(12,0E,0E,1C), \
187     V(A3,61,61,C2), V(5F,35,35,6A), V(F9,57,57,AE), V(D0,B9,B9,69), \
188     V(91,86,86,17), V(58,C1,C1,99), V(27,1D,1D,3A), V(B9,9E,9E,27), \
189     V(38,E1,E1,D9), V(13,F8,F8,EB), V(B3,98,98,2B), V(33,11,11,22), \
190     V(BB,69,69,D2), V(70,D9,D9,A9), V(89,8E,8E,07), V(A7,94,94,33), \
191     V(B6,9B,9B,2D), V(22,1E,1E,3C), V(92,87,87,15), V(20,E9,E9,C9), \
192     V(49,CE,CE,87), V(FF,55,55,AA), V(78,28,28,50), V(7A,DF,DF,A5), \
193     V(8F,8C,8C,03), V(F8,A1,A1,59), V(80,89,89,09), V(17,0D,0D,1A), \
194     V(DA,BF,BF,65), V(31,E6,E6,D7), V(C6,42,42,84), V(B8,68,68,D0), \
195     V(C3,41,41,82), V(B0,99,99,29), V(77,2D,2D,5A), V(11,0F,0F,1E), \
196     V(CB,B0,B0,7B), V(FC,54,54,A8), V(D6,BB,BB,6D), V(3A,16,16,2C)
197 
198 #define V(a,b,c,d) 0x##a##b##c##d
199 static const uint32_t FT0[256] = { FT };
200 #undef V
201 
202 #if !defined(MBEDTLS_AES_FEWER_TABLES)
203 
204 #define V(a,b,c,d) 0x##b##c##d##a
205 static const uint32_t FT1[256] = { FT };
206 #undef V
207 
208 #define V(a,b,c,d) 0x##c##d##a##b
209 static const uint32_t FT2[256] = { FT };
210 #undef V
211 
212 #define V(a,b,c,d) 0x##d##a##b##c
213 static const uint32_t FT3[256] = { FT };
214 #undef V
215 
216 #endif /* !MBEDTLS_AES_FEWER_TABLES */
217 
218 #undef FT
219 
220 /*
221  * Reverse S-box
222  */
223 static const unsigned char RSb[256] =
224 {
225     0x52, 0x09, 0x6A, 0xD5, 0x30, 0x36, 0xA5, 0x38,
226     0xBF, 0x40, 0xA3, 0x9E, 0x81, 0xF3, 0xD7, 0xFB,
227     0x7C, 0xE3, 0x39, 0x82, 0x9B, 0x2F, 0xFF, 0x87,
228     0x34, 0x8E, 0x43, 0x44, 0xC4, 0xDE, 0xE9, 0xCB,
229     0x54, 0x7B, 0x94, 0x32, 0xA6, 0xC2, 0x23, 0x3D,
230     0xEE, 0x4C, 0x95, 0x0B, 0x42, 0xFA, 0xC3, 0x4E,
231     0x08, 0x2E, 0xA1, 0x66, 0x28, 0xD9, 0x24, 0xB2,
232     0x76, 0x5B, 0xA2, 0x49, 0x6D, 0x8B, 0xD1, 0x25,
233     0x72, 0xF8, 0xF6, 0x64, 0x86, 0x68, 0x98, 0x16,
234     0xD4, 0xA4, 0x5C, 0xCC, 0x5D, 0x65, 0xB6, 0x92,
235     0x6C, 0x70, 0x48, 0x50, 0xFD, 0xED, 0xB9, 0xDA,
236     0x5E, 0x15, 0x46, 0x57, 0xA7, 0x8D, 0x9D, 0x84,
237     0x90, 0xD8, 0xAB, 0x00, 0x8C, 0xBC, 0xD3, 0x0A,
238     0xF7, 0xE4, 0x58, 0x05, 0xB8, 0xB3, 0x45, 0x06,
239     0xD0, 0x2C, 0x1E, 0x8F, 0xCA, 0x3F, 0x0F, 0x02,
240     0xC1, 0xAF, 0xBD, 0x03, 0x01, 0x13, 0x8A, 0x6B,
241     0x3A, 0x91, 0x11, 0x41, 0x4F, 0x67, 0xDC, 0xEA,
242     0x97, 0xF2, 0xCF, 0xCE, 0xF0, 0xB4, 0xE6, 0x73,
243     0x96, 0xAC, 0x74, 0x22, 0xE7, 0xAD, 0x35, 0x85,
244     0xE2, 0xF9, 0x37, 0xE8, 0x1C, 0x75, 0xDF, 0x6E,
245     0x47, 0xF1, 0x1A, 0x71, 0x1D, 0x29, 0xC5, 0x89,
246     0x6F, 0xB7, 0x62, 0x0E, 0xAA, 0x18, 0xBE, 0x1B,
247     0xFC, 0x56, 0x3E, 0x4B, 0xC6, 0xD2, 0x79, 0x20,
248     0x9A, 0xDB, 0xC0, 0xFE, 0x78, 0xCD, 0x5A, 0xF4,
249     0x1F, 0xDD, 0xA8, 0x33, 0x88, 0x07, 0xC7, 0x31,
250     0xB1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xEC, 0x5F,
251     0x60, 0x51, 0x7F, 0xA9, 0x19, 0xB5, 0x4A, 0x0D,
252     0x2D, 0xE5, 0x7A, 0x9F, 0x93, 0xC9, 0x9C, 0xEF,
253     0xA0, 0xE0, 0x3B, 0x4D, 0xAE, 0x2A, 0xF5, 0xB0,
254     0xC8, 0xEB, 0xBB, 0x3C, 0x83, 0x53, 0x99, 0x61,
255     0x17, 0x2B, 0x04, 0x7E, 0xBA, 0x77, 0xD6, 0x26,
256     0xE1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0C, 0x7D
257 };
258 
259 /*
260  * Reverse tables
261  */
262 #define RT \
263 \
264     V(50,A7,F4,51), V(53,65,41,7E), V(C3,A4,17,1A), V(96,5E,27,3A), \
265     V(CB,6B,AB,3B), V(F1,45,9D,1F), V(AB,58,FA,AC), V(93,03,E3,4B), \
266     V(55,FA,30,20), V(F6,6D,76,AD), V(91,76,CC,88), V(25,4C,02,F5), \
267     V(FC,D7,E5,4F), V(D7,CB,2A,C5), V(80,44,35,26), V(8F,A3,62,B5), \
268     V(49,5A,B1,DE), V(67,1B,BA,25), V(98,0E,EA,45), V(E1,C0,FE,5D), \
269     V(02,75,2F,C3), V(12,F0,4C,81), V(A3,97,46,8D), V(C6,F9,D3,6B), \
270     V(E7,5F,8F,03), V(95,9C,92,15), V(EB,7A,6D,BF), V(DA,59,52,95), \
271     V(2D,83,BE,D4), V(D3,21,74,58), V(29,69,E0,49), V(44,C8,C9,8E), \
272     V(6A,89,C2,75), V(78,79,8E,F4), V(6B,3E,58,99), V(DD,71,B9,27), \
273     V(B6,4F,E1,BE), V(17,AD,88,F0), V(66,AC,20,C9), V(B4,3A,CE,7D), \
274     V(18,4A,DF,63), V(82,31,1A,E5), V(60,33,51,97), V(45,7F,53,62), \
275     V(E0,77,64,B1), V(84,AE,6B,BB), V(1C,A0,81,FE), V(94,2B,08,F9), \
276     V(58,68,48,70), V(19,FD,45,8F), V(87,6C,DE,94), V(B7,F8,7B,52), \
277     V(23,D3,73,AB), V(E2,02,4B,72), V(57,8F,1F,E3), V(2A,AB,55,66), \
278     V(07,28,EB,B2), V(03,C2,B5,2F), V(9A,7B,C5,86), V(A5,08,37,D3), \
279     V(F2,87,28,30), V(B2,A5,BF,23), V(BA,6A,03,02), V(5C,82,16,ED), \
280     V(2B,1C,CF,8A), V(92,B4,79,A7), V(F0,F2,07,F3), V(A1,E2,69,4E), \
281     V(CD,F4,DA,65), V(D5,BE,05,06), V(1F,62,34,D1), V(8A,FE,A6,C4), \
282     V(9D,53,2E,34), V(A0,55,F3,A2), V(32,E1,8A,05), V(75,EB,F6,A4), \
283     V(39,EC,83,0B), V(AA,EF,60,40), V(06,9F,71,5E), V(51,10,6E,BD), \
284     V(F9,8A,21,3E), V(3D,06,DD,96), V(AE,05,3E,DD), V(46,BD,E6,4D), \
285     V(B5,8D,54,91), V(05,5D,C4,71), V(6F,D4,06,04), V(FF,15,50,60), \
286     V(24,FB,98,19), V(97,E9,BD,D6), V(CC,43,40,89), V(77,9E,D9,67), \
287     V(BD,42,E8,B0), V(88,8B,89,07), V(38,5B,19,E7), V(DB,EE,C8,79), \
288     V(47,0A,7C,A1), V(E9,0F,42,7C), V(C9,1E,84,F8), V(00,00,00,00), \
289     V(83,86,80,09), V(48,ED,2B,32), V(AC,70,11,1E), V(4E,72,5A,6C), \
290     V(FB,FF,0E,FD), V(56,38,85,0F), V(1E,D5,AE,3D), V(27,39,2D,36), \
291     V(64,D9,0F,0A), V(21,A6,5C,68), V(D1,54,5B,9B), V(3A,2E,36,24), \
292     V(B1,67,0A,0C), V(0F,E7,57,93), V(D2,96,EE,B4), V(9E,91,9B,1B), \
293     V(4F,C5,C0,80), V(A2,20,DC,61), V(69,4B,77,5A), V(16,1A,12,1C), \
294     V(0A,BA,93,E2), V(E5,2A,A0,C0), V(43,E0,22,3C), V(1D,17,1B,12), \
295     V(0B,0D,09,0E), V(AD,C7,8B,F2), V(B9,A8,B6,2D), V(C8,A9,1E,14), \
296     V(85,19,F1,57), V(4C,07,75,AF), V(BB,DD,99,EE), V(FD,60,7F,A3), \
297     V(9F,26,01,F7), V(BC,F5,72,5C), V(C5,3B,66,44), V(34,7E,FB,5B), \
298     V(76,29,43,8B), V(DC,C6,23,CB), V(68,FC,ED,B6), V(63,F1,E4,B8), \
299     V(CA,DC,31,D7), V(10,85,63,42), V(40,22,97,13), V(20,11,C6,84), \
300     V(7D,24,4A,85), V(F8,3D,BB,D2), V(11,32,F9,AE), V(6D,A1,29,C7), \
301     V(4B,2F,9E,1D), V(F3,30,B2,DC), V(EC,52,86,0D), V(D0,E3,C1,77), \
302     V(6C,16,B3,2B), V(99,B9,70,A9), V(FA,48,94,11), V(22,64,E9,47), \
303     V(C4,8C,FC,A8), V(1A,3F,F0,A0), V(D8,2C,7D,56), V(EF,90,33,22), \
304     V(C7,4E,49,87), V(C1,D1,38,D9), V(FE,A2,CA,8C), V(36,0B,D4,98), \
305     V(CF,81,F5,A6), V(28,DE,7A,A5), V(26,8E,B7,DA), V(A4,BF,AD,3F), \
306     V(E4,9D,3A,2C), V(0D,92,78,50), V(9B,CC,5F,6A), V(62,46,7E,54), \
307     V(C2,13,8D,F6), V(E8,B8,D8,90), V(5E,F7,39,2E), V(F5,AF,C3,82), \
308     V(BE,80,5D,9F), V(7C,93,D0,69), V(A9,2D,D5,6F), V(B3,12,25,CF), \
309     V(3B,99,AC,C8), V(A7,7D,18,10), V(6E,63,9C,E8), V(7B,BB,3B,DB), \
310     V(09,78,26,CD), V(F4,18,59,6E), V(01,B7,9A,EC), V(A8,9A,4F,83), \
311     V(65,6E,95,E6), V(7E,E6,FF,AA), V(08,CF,BC,21), V(E6,E8,15,EF), \
312     V(D9,9B,E7,BA), V(CE,36,6F,4A), V(D4,09,9F,EA), V(D6,7C,B0,29), \
313     V(AF,B2,A4,31), V(31,23,3F,2A), V(30,94,A5,C6), V(C0,66,A2,35), \
314     V(37,BC,4E,74), V(A6,CA,82,FC), V(B0,D0,90,E0), V(15,D8,A7,33), \
315     V(4A,98,04,F1), V(F7,DA,EC,41), V(0E,50,CD,7F), V(2F,F6,91,17), \
316     V(8D,D6,4D,76), V(4D,B0,EF,43), V(54,4D,AA,CC), V(DF,04,96,E4), \
317     V(E3,B5,D1,9E), V(1B,88,6A,4C), V(B8,1F,2C,C1), V(7F,51,65,46), \
318     V(04,EA,5E,9D), V(5D,35,8C,01), V(73,74,87,FA), V(2E,41,0B,FB), \
319     V(5A,1D,67,B3), V(52,D2,DB,92), V(33,56,10,E9), V(13,47,D6,6D), \
320     V(8C,61,D7,9A), V(7A,0C,A1,37), V(8E,14,F8,59), V(89,3C,13,EB), \
321     V(EE,27,A9,CE), V(35,C9,61,B7), V(ED,E5,1C,E1), V(3C,B1,47,7A), \
322     V(59,DF,D2,9C), V(3F,73,F2,55), V(79,CE,14,18), V(BF,37,C7,73), \
323     V(EA,CD,F7,53), V(5B,AA,FD,5F), V(14,6F,3D,DF), V(86,DB,44,78), \
324     V(81,F3,AF,CA), V(3E,C4,68,B9), V(2C,34,24,38), V(5F,40,A3,C2), \
325     V(72,C3,1D,16), V(0C,25,E2,BC), V(8B,49,3C,28), V(41,95,0D,FF), \
326     V(71,01,A8,39), V(DE,B3,0C,08), V(9C,E4,B4,D8), V(90,C1,56,64), \
327     V(61,84,CB,7B), V(70,B6,32,D5), V(74,5C,6C,48), V(42,57,B8,D0)
328 
329 #define V(a,b,c,d) 0x##a##b##c##d
330 static const uint32_t RT0[256] = { RT };
331 #undef V
332 
333 #if !defined(MBEDTLS_AES_FEWER_TABLES)
334 
335 #define V(a,b,c,d) 0x##b##c##d##a
336 static const uint32_t RT1[256] = { RT };
337 #undef V
338 
339 #define V(a,b,c,d) 0x##c##d##a##b
340 static const uint32_t RT2[256] = { RT };
341 #undef V
342 
343 #define V(a,b,c,d) 0x##d##a##b##c
344 static const uint32_t RT3[256] = { RT };
345 #undef V
346 
347 #endif /* !MBEDTLS_AES_FEWER_TABLES */
348 
349 #undef RT
350 
351 /*
352  * Round constants
353  */
354 static const uint32_t RCON[10] =
355 {
356     0x00000001, 0x00000002, 0x00000004, 0x00000008,
357     0x00000010, 0x00000020, 0x00000040, 0x00000080,
358     0x0000001B, 0x00000036
359 };
360 
361 #else /* MBEDTLS_AES_ROM_TABLES */
362 
363 /*
364  * Forward S-box & tables
365  */
366 static unsigned char FSb[256];
367 static uint32_t FT0[256];
368 #if !defined(MBEDTLS_AES_FEWER_TABLES)
369 static uint32_t FT1[256];
370 static uint32_t FT2[256];
371 static uint32_t FT3[256];
372 #endif /* !MBEDTLS_AES_FEWER_TABLES */
373 
374 /*
375  * Reverse S-box & tables
376  */
377 static unsigned char RSb[256];
378 static uint32_t RT0[256];
379 #if !defined(MBEDTLS_AES_FEWER_TABLES)
380 static uint32_t RT1[256];
381 static uint32_t RT2[256];
382 static uint32_t RT3[256];
383 #endif /* !MBEDTLS_AES_FEWER_TABLES */
384 
385 /*
386  * Round constants
387  */
388 static uint32_t RCON[10];
389 
390 /*
391  * Tables generation code
392  */
393 #define ROTL8(x) ( ( (x) << 8 ) & 0xFFFFFFFF ) | ( (x) >> 24 )
394 #define XTIME(x) ( ( (x) << 1 ) ^ ( ( (x) & 0x80 ) ? 0x1B : 0x00 ) )
395 #define MUL(x,y) ( ( (x) && (y) ) ? pow[(log[(x)]+log[(y)]) % 255] : 0 )
396 
397 static int aes_init_done = 0;
398 
aes_gen_tables(void)399 static void aes_gen_tables( void )
400 {
401     int i, x, y, z;
402     int pow[256];
403     int log[256];
404 
405     /*
406      * compute pow and log tables over GF(2^8)
407      */
408     for( i = 0, x = 1; i < 256; i++ )
409     {
410         pow[i] = x;
411         log[x] = i;
412         x = ( x ^ XTIME( x ) ) & 0xFF;
413     }
414 
415     /*
416      * calculate the round constants
417      */
418     for( i = 0, x = 1; i < 10; i++ )
419     {
420         RCON[i] = (uint32_t) x;
421         x = XTIME( x ) & 0xFF;
422     }
423 
424     /*
425      * generate the forward and reverse S-boxes
426      */
427     FSb[0x00] = 0x63;
428     RSb[0x63] = 0x00;
429 
430     for( i = 1; i < 256; i++ )
431     {
432         x = pow[255 - log[i]];
433 
434         y  = x; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF;
435         x ^= y; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF;
436         x ^= y; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF;
437         x ^= y; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF;
438         x ^= y ^ 0x63;
439 
440         FSb[i] = (unsigned char) x;
441         RSb[x] = (unsigned char) i;
442     }
443 
444     /*
445      * generate the forward and reverse tables
446      */
447     for( i = 0; i < 256; i++ )
448     {
449         x = FSb[i];
450         y = XTIME( x ) & 0xFF;
451         z =  ( y ^ x ) & 0xFF;
452 
453         FT0[i] = ( (uint32_t) y       ) ^
454                  ( (uint32_t) x <<  8 ) ^
455                  ( (uint32_t) x << 16 ) ^
456                  ( (uint32_t) z << 24 );
457 
458 #if !defined(MBEDTLS_AES_FEWER_TABLES)
459         FT1[i] = ROTL8( FT0[i] );
460         FT2[i] = ROTL8( FT1[i] );
461         FT3[i] = ROTL8( FT2[i] );
462 #endif /* !MBEDTLS_AES_FEWER_TABLES */
463 
464         x = RSb[i];
465 
466         RT0[i] = ( (uint32_t) MUL( 0x0E, x )       ) ^
467                  ( (uint32_t) MUL( 0x09, x ) <<  8 ) ^
468                  ( (uint32_t) MUL( 0x0D, x ) << 16 ) ^
469                  ( (uint32_t) MUL( 0x0B, x ) << 24 );
470 
471 #if !defined(MBEDTLS_AES_FEWER_TABLES)
472         RT1[i] = ROTL8( RT0[i] );
473         RT2[i] = ROTL8( RT1[i] );
474         RT3[i] = ROTL8( RT2[i] );
475 #endif /* !MBEDTLS_AES_FEWER_TABLES */
476     }
477 }
478 
479 #undef ROTL8
480 
481 #endif /* MBEDTLS_AES_ROM_TABLES */
482 
483 #if defined(MBEDTLS_AES_FEWER_TABLES)
484 
485 #define ROTL8(x)  ( (uint32_t)( ( x ) <<  8 ) + (uint32_t)( ( x ) >> 24 ) )
486 #define ROTL16(x) ( (uint32_t)( ( x ) << 16 ) + (uint32_t)( ( x ) >> 16 ) )
487 #define ROTL24(x) ( (uint32_t)( ( x ) << 24 ) + (uint32_t)( ( x ) >>  8 ) )
488 
489 #define AES_RT0(idx) RT0[idx]
490 #define AES_RT1(idx) ROTL8(  RT0[idx] )
491 #define AES_RT2(idx) ROTL16( RT0[idx] )
492 #define AES_RT3(idx) ROTL24( RT0[idx] )
493 
494 #define AES_FT0(idx) FT0[idx]
495 #define AES_FT1(idx) ROTL8(  FT0[idx] )
496 #define AES_FT2(idx) ROTL16( FT0[idx] )
497 #define AES_FT3(idx) ROTL24( FT0[idx] )
498 
499 #else /* MBEDTLS_AES_FEWER_TABLES */
500 
501 #define AES_RT0(idx) RT0[idx]
502 #define AES_RT1(idx) RT1[idx]
503 #define AES_RT2(idx) RT2[idx]
504 #define AES_RT3(idx) RT3[idx]
505 
506 #define AES_FT0(idx) FT0[idx]
507 #define AES_FT1(idx) FT1[idx]
508 #define AES_FT2(idx) FT2[idx]
509 #define AES_FT3(idx) FT3[idx]
510 
511 #endif /* MBEDTLS_AES_FEWER_TABLES */
512 
mbedtls_aes_init(mbedtls_aes_context * ctx)513 void mbedtls_aes_init( mbedtls_aes_context *ctx )
514 {
515     AES_VALIDATE( ctx != NULL );
516 
517     memset( ctx, 0, sizeof( mbedtls_aes_context ) );
518 }
519 
mbedtls_aes_free(mbedtls_aes_context * ctx)520 void mbedtls_aes_free( mbedtls_aes_context *ctx )
521 {
522     if( ctx == NULL )
523         return;
524 
525     mbedtls_platform_zeroize( ctx, sizeof( mbedtls_aes_context ) );
526 }
527 
528 #if defined(MBEDTLS_CIPHER_MODE_XTS)
mbedtls_aes_xts_init(mbedtls_aes_xts_context * ctx)529 void mbedtls_aes_xts_init( mbedtls_aes_xts_context *ctx )
530 {
531     AES_VALIDATE( ctx != NULL );
532 
533     mbedtls_aes_init( &ctx->crypt );
534     mbedtls_aes_init( &ctx->tweak );
535 }
536 
mbedtls_aes_xts_free(mbedtls_aes_xts_context * ctx)537 void mbedtls_aes_xts_free( mbedtls_aes_xts_context *ctx )
538 {
539     if( ctx == NULL )
540         return;
541 
542     mbedtls_aes_free( &ctx->crypt );
543     mbedtls_aes_free( &ctx->tweak );
544 }
545 #endif /* MBEDTLS_CIPHER_MODE_XTS */
546 
547 /*
548  * AES key schedule (encryption)
549  */
550 #if !defined(MBEDTLS_AES_SETKEY_ENC_ALT)
mbedtls_aes_setkey_enc(mbedtls_aes_context * ctx,const unsigned char * key,unsigned int keybits)551 int mbedtls_aes_setkey_enc( mbedtls_aes_context *ctx, const unsigned char *key,
552                     unsigned int keybits )
553 {
554     unsigned int i;
555     uint32_t *RK;
556 
557     AES_VALIDATE_RET( ctx != NULL );
558     AES_VALIDATE_RET( key != NULL );
559 
560     switch( keybits )
561     {
562         case 128: ctx->nr = 10; break;
563         case 192: ctx->nr = 12; break;
564         case 256: ctx->nr = 14; break;
565         default : return( MBEDTLS_ERR_AES_INVALID_KEY_LENGTH );
566     }
567 
568 #if !defined(MBEDTLS_AES_ROM_TABLES)
569     if( aes_init_done == 0 )
570     {
571         aes_gen_tables();
572         aes_init_done = 1;
573     }
574 #endif
575 
576 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_PADLOCK_ALIGN16)
577     if( aes_padlock_ace == -1 )
578         aes_padlock_ace = mbedtls_padlock_has_support( MBEDTLS_PADLOCK_ACE );
579 
580     if( aes_padlock_ace )
581         ctx->rk = RK = MBEDTLS_PADLOCK_ALIGN16( ctx->buf );
582     else
583 #endif
584     ctx->rk = RK = ctx->buf;
585 
586 #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64)
587     if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) )
588         return( mbedtls_aesni_setkey_enc( (unsigned char *) ctx->rk, key, keybits ) );
589 #endif
590 
591     for( i = 0; i < ( keybits >> 5 ); i++ )
592     {
593         GET_UINT32_LE( RK[i], key, i << 2 );
594     }
595 
596     switch( ctx->nr )
597     {
598         case 10:
599 
600             for( i = 0; i < 10; i++, RK += 4 )
601             {
602                 RK[4]  = RK[0] ^ RCON[i] ^
603                 ( (uint32_t) FSb[ ( RK[3] >>  8 ) & 0xFF ]       ) ^
604                 ( (uint32_t) FSb[ ( RK[3] >> 16 ) & 0xFF ] <<  8 ) ^
605                 ( (uint32_t) FSb[ ( RK[3] >> 24 ) & 0xFF ] << 16 ) ^
606                 ( (uint32_t) FSb[ ( RK[3]       ) & 0xFF ] << 24 );
607 
608                 RK[5]  = RK[1] ^ RK[4];
609                 RK[6]  = RK[2] ^ RK[5];
610                 RK[7]  = RK[3] ^ RK[6];
611             }
612             break;
613 
614         case 12:
615 
616             for( i = 0; i < 8; i++, RK += 6 )
617             {
618                 RK[6]  = RK[0] ^ RCON[i] ^
619                 ( (uint32_t) FSb[ ( RK[5] >>  8 ) & 0xFF ]       ) ^
620                 ( (uint32_t) FSb[ ( RK[5] >> 16 ) & 0xFF ] <<  8 ) ^
621                 ( (uint32_t) FSb[ ( RK[5] >> 24 ) & 0xFF ] << 16 ) ^
622                 ( (uint32_t) FSb[ ( RK[5]       ) & 0xFF ] << 24 );
623 
624                 RK[7]  = RK[1] ^ RK[6];
625                 RK[8]  = RK[2] ^ RK[7];
626                 RK[9]  = RK[3] ^ RK[8];
627                 RK[10] = RK[4] ^ RK[9];
628                 RK[11] = RK[5] ^ RK[10];
629             }
630             break;
631 
632         case 14:
633 
634             for( i = 0; i < 7; i++, RK += 8 )
635             {
636                 RK[8]  = RK[0] ^ RCON[i] ^
637                 ( (uint32_t) FSb[ ( RK[7] >>  8 ) & 0xFF ]       ) ^
638                 ( (uint32_t) FSb[ ( RK[7] >> 16 ) & 0xFF ] <<  8 ) ^
639                 ( (uint32_t) FSb[ ( RK[7] >> 24 ) & 0xFF ] << 16 ) ^
640                 ( (uint32_t) FSb[ ( RK[7]       ) & 0xFF ] << 24 );
641 
642                 RK[9]  = RK[1] ^ RK[8];
643                 RK[10] = RK[2] ^ RK[9];
644                 RK[11] = RK[3] ^ RK[10];
645 
646                 RK[12] = RK[4] ^
647                 ( (uint32_t) FSb[ ( RK[11]       ) & 0xFF ]       ) ^
648                 ( (uint32_t) FSb[ ( RK[11] >>  8 ) & 0xFF ] <<  8 ) ^
649                 ( (uint32_t) FSb[ ( RK[11] >> 16 ) & 0xFF ] << 16 ) ^
650                 ( (uint32_t) FSb[ ( RK[11] >> 24 ) & 0xFF ] << 24 );
651 
652                 RK[13] = RK[5] ^ RK[12];
653                 RK[14] = RK[6] ^ RK[13];
654                 RK[15] = RK[7] ^ RK[14];
655             }
656             break;
657     }
658 
659     return( 0 );
660 }
661 #endif /* !MBEDTLS_AES_SETKEY_ENC_ALT */
662 
663 /*
664  * AES key schedule (decryption)
665  */
666 #if !defined(MBEDTLS_AES_SETKEY_DEC_ALT)
mbedtls_aes_setkey_dec(mbedtls_aes_context * ctx,const unsigned char * key,unsigned int keybits)667 int mbedtls_aes_setkey_dec( mbedtls_aes_context *ctx, const unsigned char *key,
668                     unsigned int keybits )
669 {
670     int i, j, ret;
671     mbedtls_aes_context cty;
672     uint32_t *RK;
673     uint32_t *SK;
674 
675     AES_VALIDATE_RET( ctx != NULL );
676     AES_VALIDATE_RET( key != NULL );
677 
678     mbedtls_aes_init( &cty );
679 
680 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_PADLOCK_ALIGN16)
681     if( aes_padlock_ace == -1 )
682         aes_padlock_ace = mbedtls_padlock_has_support( MBEDTLS_PADLOCK_ACE );
683 
684     if( aes_padlock_ace )
685         ctx->rk = RK = MBEDTLS_PADLOCK_ALIGN16( ctx->buf );
686     else
687 #endif
688     ctx->rk = RK = ctx->buf;
689 
690     /* Also checks keybits */
691     if( ( ret = mbedtls_aes_setkey_enc( &cty, key, keybits ) ) != 0 )
692         goto exit;
693 
694     ctx->nr = cty.nr;
695 
696 #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64)
697     if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) )
698     {
699         mbedtls_aesni_inverse_key( (unsigned char *) ctx->rk,
700                            (const unsigned char *) cty.rk, ctx->nr );
701         goto exit;
702     }
703 #endif
704 
705     SK = cty.rk + cty.nr * 4;
706 
707     *RK++ = *SK++;
708     *RK++ = *SK++;
709     *RK++ = *SK++;
710     *RK++ = *SK++;
711 
712     for( i = ctx->nr - 1, SK -= 8; i > 0; i--, SK -= 8 )
713     {
714         for( j = 0; j < 4; j++, SK++ )
715         {
716             *RK++ = AES_RT0( FSb[ ( *SK       ) & 0xFF ] ) ^
717                     AES_RT1( FSb[ ( *SK >>  8 ) & 0xFF ] ) ^
718                     AES_RT2( FSb[ ( *SK >> 16 ) & 0xFF ] ) ^
719                     AES_RT3( FSb[ ( *SK >> 24 ) & 0xFF ] );
720         }
721     }
722 
723     *RK++ = *SK++;
724     *RK++ = *SK++;
725     *RK++ = *SK++;
726     *RK++ = *SK++;
727 
728 exit:
729     mbedtls_aes_free( &cty );
730 
731     return( ret );
732 }
733 #endif /* !MBEDTLS_AES_SETKEY_DEC_ALT */
734 
735 #if defined(MBEDTLS_CIPHER_MODE_XTS)
mbedtls_aes_xts_decode_keys(const unsigned char * key,unsigned int keybits,const unsigned char ** key1,unsigned int * key1bits,const unsigned char ** key2,unsigned int * key2bits)736 static int mbedtls_aes_xts_decode_keys( const unsigned char *key,
737                                         unsigned int keybits,
738                                         const unsigned char **key1,
739                                         unsigned int *key1bits,
740                                         const unsigned char **key2,
741                                         unsigned int *key2bits )
742 {
743     const unsigned int half_keybits = keybits / 2;
744     const unsigned int half_keybytes = half_keybits / 8;
745 
746     switch( keybits )
747     {
748         case 256: break;
749         case 512: break;
750         default : return( MBEDTLS_ERR_AES_INVALID_KEY_LENGTH );
751     }
752 
753     *key1bits = half_keybits;
754     *key2bits = half_keybits;
755     *key1 = &key[0];
756     *key2 = &key[half_keybytes];
757 
758     return 0;
759 }
760 
mbedtls_aes_xts_setkey_enc(mbedtls_aes_xts_context * ctx,const unsigned char * key,unsigned int keybits)761 int mbedtls_aes_xts_setkey_enc( mbedtls_aes_xts_context *ctx,
762                                 const unsigned char *key,
763                                 unsigned int keybits)
764 {
765     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
766     const unsigned char *key1, *key2;
767     unsigned int key1bits, key2bits;
768 
769     AES_VALIDATE_RET( ctx != NULL );
770     AES_VALIDATE_RET( key != NULL );
771 
772     ret = mbedtls_aes_xts_decode_keys( key, keybits, &key1, &key1bits,
773                                        &key2, &key2bits );
774     if( ret != 0 )
775         return( ret );
776 
777     /* Set the tweak key. Always set tweak key for the encryption mode. */
778     ret = mbedtls_aes_setkey_enc( &ctx->tweak, key2, key2bits );
779     if( ret != 0 )
780         return( ret );
781 
782     /* Set crypt key for encryption. */
783     return mbedtls_aes_setkey_enc( &ctx->crypt, key1, key1bits );
784 }
785 
mbedtls_aes_xts_setkey_dec(mbedtls_aes_xts_context * ctx,const unsigned char * key,unsigned int keybits)786 int mbedtls_aes_xts_setkey_dec( mbedtls_aes_xts_context *ctx,
787                                 const unsigned char *key,
788                                 unsigned int keybits)
789 {
790     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
791     const unsigned char *key1, *key2;
792     unsigned int key1bits, key2bits;
793 
794     AES_VALIDATE_RET( ctx != NULL );
795     AES_VALIDATE_RET( key != NULL );
796 
797     ret = mbedtls_aes_xts_decode_keys( key, keybits, &key1, &key1bits,
798                                        &key2, &key2bits );
799     if( ret != 0 )
800         return( ret );
801 
802     /* Set the tweak key. Always set tweak key for encryption. */
803     ret = mbedtls_aes_setkey_enc( &ctx->tweak, key2, key2bits );
804     if( ret != 0 )
805         return( ret );
806 
807     /* Set crypt key for decryption. */
808     return mbedtls_aes_setkey_dec( &ctx->crypt, key1, key1bits );
809 }
810 #endif /* MBEDTLS_CIPHER_MODE_XTS */
811 
812 #define AES_FROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3)                     \
813     do                                                          \
814     {                                                           \
815         (X0) = *RK++ ^ AES_FT0( ( (Y0)       ) & 0xFF ) ^       \
816                        AES_FT1( ( (Y1) >>  8 ) & 0xFF ) ^       \
817                        AES_FT2( ( (Y2) >> 16 ) & 0xFF ) ^       \
818                        AES_FT3( ( (Y3) >> 24 ) & 0xFF );        \
819                                                                 \
820         (X1) = *RK++ ^ AES_FT0( ( (Y1)       ) & 0xFF ) ^       \
821                        AES_FT1( ( (Y2) >>  8 ) & 0xFF ) ^       \
822                        AES_FT2( ( (Y3) >> 16 ) & 0xFF ) ^       \
823                        AES_FT3( ( (Y0) >> 24 ) & 0xFF );        \
824                                                                 \
825         (X2) = *RK++ ^ AES_FT0( ( (Y2)       ) & 0xFF ) ^       \
826                        AES_FT1( ( (Y3) >>  8 ) & 0xFF ) ^       \
827                        AES_FT2( ( (Y0) >> 16 ) & 0xFF ) ^       \
828                        AES_FT3( ( (Y1) >> 24 ) & 0xFF );        \
829                                                                 \
830         (X3) = *RK++ ^ AES_FT0( ( (Y3)       ) & 0xFF ) ^       \
831                        AES_FT1( ( (Y0) >>  8 ) & 0xFF ) ^       \
832                        AES_FT2( ( (Y1) >> 16 ) & 0xFF ) ^       \
833                        AES_FT3( ( (Y2) >> 24 ) & 0xFF );        \
834     } while( 0 )
835 
836 #define AES_RROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3)                 \
837     do                                                      \
838     {                                                       \
839         (X0) = *RK++ ^ AES_RT0( ( (Y0)       ) & 0xFF ) ^   \
840                        AES_RT1( ( (Y3) >>  8 ) & 0xFF ) ^   \
841                        AES_RT2( ( (Y2) >> 16 ) & 0xFF ) ^   \
842                        AES_RT3( ( (Y1) >> 24 ) & 0xFF );    \
843                                                             \
844         (X1) = *RK++ ^ AES_RT0( ( (Y1)       ) & 0xFF ) ^   \
845                        AES_RT1( ( (Y0) >>  8 ) & 0xFF ) ^   \
846                        AES_RT2( ( (Y3) >> 16 ) & 0xFF ) ^   \
847                        AES_RT3( ( (Y2) >> 24 ) & 0xFF );    \
848                                                             \
849         (X2) = *RK++ ^ AES_RT0( ( (Y2)       ) & 0xFF ) ^   \
850                        AES_RT1( ( (Y1) >>  8 ) & 0xFF ) ^   \
851                        AES_RT2( ( (Y0) >> 16 ) & 0xFF ) ^   \
852                        AES_RT3( ( (Y3) >> 24 ) & 0xFF );    \
853                                                             \
854         (X3) = *RK++ ^ AES_RT0( ( (Y3)       ) & 0xFF ) ^   \
855                        AES_RT1( ( (Y2) >>  8 ) & 0xFF ) ^   \
856                        AES_RT2( ( (Y1) >> 16 ) & 0xFF ) ^   \
857                        AES_RT3( ( (Y0) >> 24 ) & 0xFF );    \
858     } while( 0 )
859 
860 /*
861  * AES-ECB block encryption
862  */
863 #if !defined(MBEDTLS_AES_ENCRYPT_ALT)
mbedtls_internal_aes_encrypt(mbedtls_aes_context * ctx,const unsigned char input[16],unsigned char output[16])864 int mbedtls_internal_aes_encrypt( mbedtls_aes_context *ctx,
865                                   const unsigned char input[16],
866                                   unsigned char output[16] )
867 {
868     int i;
869     uint32_t *RK = ctx->rk;
870     struct
871     {
872         uint32_t X[4];
873         uint32_t Y[4];
874     } t;
875 
876     GET_UINT32_LE( t.X[0], input,  0 ); t.X[0] ^= *RK++;
877     GET_UINT32_LE( t.X[1], input,  4 ); t.X[1] ^= *RK++;
878     GET_UINT32_LE( t.X[2], input,  8 ); t.X[2] ^= *RK++;
879     GET_UINT32_LE( t.X[3], input, 12 ); t.X[3] ^= *RK++;
880 
881     for( i = ( ctx->nr >> 1 ) - 1; i > 0; i-- )
882     {
883         AES_FROUND( t.Y[0], t.Y[1], t.Y[2], t.Y[3], t.X[0], t.X[1], t.X[2], t.X[3] );
884         AES_FROUND( t.X[0], t.X[1], t.X[2], t.X[3], t.Y[0], t.Y[1], t.Y[2], t.Y[3] );
885     }
886 
887     AES_FROUND( t.Y[0], t.Y[1], t.Y[2], t.Y[3], t.X[0], t.X[1], t.X[2], t.X[3] );
888 
889     t.X[0] = *RK++ ^ \
890             ( (uint32_t) FSb[ ( t.Y[0]       ) & 0xFF ]       ) ^
891             ( (uint32_t) FSb[ ( t.Y[1] >>  8 ) & 0xFF ] <<  8 ) ^
892             ( (uint32_t) FSb[ ( t.Y[2] >> 16 ) & 0xFF ] << 16 ) ^
893             ( (uint32_t) FSb[ ( t.Y[3] >> 24 ) & 0xFF ] << 24 );
894 
895     t.X[1] = *RK++ ^ \
896             ( (uint32_t) FSb[ ( t.Y[1]       ) & 0xFF ]       ) ^
897             ( (uint32_t) FSb[ ( t.Y[2] >>  8 ) & 0xFF ] <<  8 ) ^
898             ( (uint32_t) FSb[ ( t.Y[3] >> 16 ) & 0xFF ] << 16 ) ^
899             ( (uint32_t) FSb[ ( t.Y[0] >> 24 ) & 0xFF ] << 24 );
900 
901     t.X[2] = *RK++ ^ \
902             ( (uint32_t) FSb[ ( t.Y[2]       ) & 0xFF ]       ) ^
903             ( (uint32_t) FSb[ ( t.Y[3] >>  8 ) & 0xFF ] <<  8 ) ^
904             ( (uint32_t) FSb[ ( t.Y[0] >> 16 ) & 0xFF ] << 16 ) ^
905             ( (uint32_t) FSb[ ( t.Y[1] >> 24 ) & 0xFF ] << 24 );
906 
907     t.X[3] = *RK++ ^ \
908             ( (uint32_t) FSb[ ( t.Y[3]       ) & 0xFF ]       ) ^
909             ( (uint32_t) FSb[ ( t.Y[0] >>  8 ) & 0xFF ] <<  8 ) ^
910             ( (uint32_t) FSb[ ( t.Y[1] >> 16 ) & 0xFF ] << 16 ) ^
911             ( (uint32_t) FSb[ ( t.Y[2] >> 24 ) & 0xFF ] << 24 );
912 
913     PUT_UINT32_LE( t.X[0], output,  0 );
914     PUT_UINT32_LE( t.X[1], output,  4 );
915     PUT_UINT32_LE( t.X[2], output,  8 );
916     PUT_UINT32_LE( t.X[3], output, 12 );
917 
918     mbedtls_platform_zeroize( &t, sizeof( t ) );
919 
920     return( 0 );
921 }
922 #endif /* !MBEDTLS_AES_ENCRYPT_ALT */
923 
924 #if !defined(MBEDTLS_DEPRECATED_REMOVED)
mbedtls_aes_encrypt(mbedtls_aes_context * ctx,const unsigned char input[16],unsigned char output[16])925 void mbedtls_aes_encrypt( mbedtls_aes_context *ctx,
926                           const unsigned char input[16],
927                           unsigned char output[16] )
928 {
929     mbedtls_internal_aes_encrypt( ctx, input, output );
930 }
931 #endif /* !MBEDTLS_DEPRECATED_REMOVED */
932 
933 /*
934  * AES-ECB block decryption
935  */
936 #if !defined(MBEDTLS_AES_DECRYPT_ALT)
mbedtls_internal_aes_decrypt(mbedtls_aes_context * ctx,const unsigned char input[16],unsigned char output[16])937 int mbedtls_internal_aes_decrypt( mbedtls_aes_context *ctx,
938                                   const unsigned char input[16],
939                                   unsigned char output[16] )
940 {
941     int i;
942     uint32_t *RK = ctx->rk;
943     struct
944     {
945         uint32_t X[4];
946         uint32_t Y[4];
947     } t;
948 
949     GET_UINT32_LE( t.X[0], input,  0 ); t.X[0] ^= *RK++;
950     GET_UINT32_LE( t.X[1], input,  4 ); t.X[1] ^= *RK++;
951     GET_UINT32_LE( t.X[2], input,  8 ); t.X[2] ^= *RK++;
952     GET_UINT32_LE( t.X[3], input, 12 ); t.X[3] ^= *RK++;
953 
954     for( i = ( ctx->nr >> 1 ) - 1; i > 0; i-- )
955     {
956         AES_RROUND( t.Y[0], t.Y[1], t.Y[2], t.Y[3], t.X[0], t.X[1], t.X[2], t.X[3] );
957         AES_RROUND( t.X[0], t.X[1], t.X[2], t.X[3], t.Y[0], t.Y[1], t.Y[2], t.Y[3] );
958     }
959 
960     AES_RROUND( t.Y[0], t.Y[1], t.Y[2], t.Y[3], t.X[0], t.X[1], t.X[2], t.X[3] );
961 
962     t.X[0] = *RK++ ^ \
963             ( (uint32_t) RSb[ ( t.Y[0]       ) & 0xFF ]       ) ^
964             ( (uint32_t) RSb[ ( t.Y[3] >>  8 ) & 0xFF ] <<  8 ) ^
965             ( (uint32_t) RSb[ ( t.Y[2] >> 16 ) & 0xFF ] << 16 ) ^
966             ( (uint32_t) RSb[ ( t.Y[1] >> 24 ) & 0xFF ] << 24 );
967 
968     t.X[1] = *RK++ ^ \
969             ( (uint32_t) RSb[ ( t.Y[1]       ) & 0xFF ]       ) ^
970             ( (uint32_t) RSb[ ( t.Y[0] >>  8 ) & 0xFF ] <<  8 ) ^
971             ( (uint32_t) RSb[ ( t.Y[3] >> 16 ) & 0xFF ] << 16 ) ^
972             ( (uint32_t) RSb[ ( t.Y[2] >> 24 ) & 0xFF ] << 24 );
973 
974     t.X[2] = *RK++ ^ \
975             ( (uint32_t) RSb[ ( t.Y[2]       ) & 0xFF ]       ) ^
976             ( (uint32_t) RSb[ ( t.Y[1] >>  8 ) & 0xFF ] <<  8 ) ^
977             ( (uint32_t) RSb[ ( t.Y[0] >> 16 ) & 0xFF ] << 16 ) ^
978             ( (uint32_t) RSb[ ( t.Y[3] >> 24 ) & 0xFF ] << 24 );
979 
980     t.X[3] = *RK++ ^ \
981             ( (uint32_t) RSb[ ( t.Y[3]       ) & 0xFF ]       ) ^
982             ( (uint32_t) RSb[ ( t.Y[2] >>  8 ) & 0xFF ] <<  8 ) ^
983             ( (uint32_t) RSb[ ( t.Y[1] >> 16 ) & 0xFF ] << 16 ) ^
984             ( (uint32_t) RSb[ ( t.Y[0] >> 24 ) & 0xFF ] << 24 );
985 
986     PUT_UINT32_LE( t.X[0], output,  0 );
987     PUT_UINT32_LE( t.X[1], output,  4 );
988     PUT_UINT32_LE( t.X[2], output,  8 );
989     PUT_UINT32_LE( t.X[3], output, 12 );
990 
991     mbedtls_platform_zeroize( &t, sizeof( t ) );
992 
993     return( 0 );
994 }
995 #endif /* !MBEDTLS_AES_DECRYPT_ALT */
996 
997 #if !defined(MBEDTLS_DEPRECATED_REMOVED)
mbedtls_aes_decrypt(mbedtls_aes_context * ctx,const unsigned char input[16],unsigned char output[16])998 void mbedtls_aes_decrypt( mbedtls_aes_context *ctx,
999                           const unsigned char input[16],
1000                           unsigned char output[16] )
1001 {
1002     mbedtls_internal_aes_decrypt( ctx, input, output );
1003 }
1004 #endif /* !MBEDTLS_DEPRECATED_REMOVED */
1005 
1006 /*
1007  * AES-ECB block encryption/decryption
1008  */
mbedtls_aes_crypt_ecb(mbedtls_aes_context * ctx,int mode,const unsigned char input[16],unsigned char output[16])1009 int mbedtls_aes_crypt_ecb( mbedtls_aes_context *ctx,
1010                            int mode,
1011                            const unsigned char input[16],
1012                            unsigned char output[16] )
1013 {
1014     AES_VALIDATE_RET( ctx != NULL );
1015     AES_VALIDATE_RET( input != NULL );
1016     AES_VALIDATE_RET( output != NULL );
1017     AES_VALIDATE_RET( mode == MBEDTLS_AES_ENCRYPT ||
1018                       mode == MBEDTLS_AES_DECRYPT );
1019 
1020 #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64)
1021     if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) )
1022         return( mbedtls_aesni_crypt_ecb( ctx, mode, input, output ) );
1023 #endif
1024 
1025 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_HAVE_X86)
1026     if( aes_padlock_ace )
1027     {
1028         if( mbedtls_padlock_xcryptecb( ctx, mode, input, output ) == 0 )
1029             return( 0 );
1030 
1031         // If padlock data misaligned, we just fall back to
1032         // unaccelerated mode
1033         //
1034     }
1035 #endif
1036 
1037     if( mode == MBEDTLS_AES_ENCRYPT )
1038         return( mbedtls_internal_aes_encrypt( ctx, input, output ) );
1039     else
1040         return( mbedtls_internal_aes_decrypt( ctx, input, output ) );
1041 }
1042 
1043 #if defined(MBEDTLS_CIPHER_MODE_CBC)
1044 /*
1045  * AES-CBC buffer encryption/decryption
1046  */
mbedtls_aes_crypt_cbc(mbedtls_aes_context * ctx,int mode,size_t length,unsigned char iv[16],const unsigned char * input,unsigned char * output)1047 int mbedtls_aes_crypt_cbc( mbedtls_aes_context *ctx,
1048                     int mode,
1049                     size_t length,
1050                     unsigned char iv[16],
1051                     const unsigned char *input,
1052                     unsigned char *output )
1053 {
1054     int i;
1055     unsigned char temp[16];
1056 
1057     AES_VALIDATE_RET( ctx != NULL );
1058     AES_VALIDATE_RET( mode == MBEDTLS_AES_ENCRYPT ||
1059                       mode == MBEDTLS_AES_DECRYPT );
1060     AES_VALIDATE_RET( iv != NULL );
1061     AES_VALIDATE_RET( input != NULL );
1062     AES_VALIDATE_RET( output != NULL );
1063 
1064     if( length % 16 )
1065         return( MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH );
1066 
1067 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_HAVE_X86)
1068     if( aes_padlock_ace )
1069     {
1070         if( mbedtls_padlock_xcryptcbc( ctx, mode, length, iv, input, output ) == 0 )
1071             return( 0 );
1072 
1073         // If padlock data misaligned, we just fall back to
1074         // unaccelerated mode
1075         //
1076     }
1077 #endif
1078 
1079     if( mode == MBEDTLS_AES_DECRYPT )
1080     {
1081         while( length > 0 )
1082         {
1083             memcpy( temp, input, 16 );
1084             mbedtls_aes_crypt_ecb( ctx, mode, input, output );
1085 
1086             for( i = 0; i < 16; i++ )
1087                 output[i] = (unsigned char)( output[i] ^ iv[i] );
1088 
1089             memcpy( iv, temp, 16 );
1090 
1091             input  += 16;
1092             output += 16;
1093             length -= 16;
1094         }
1095     }
1096     else
1097     {
1098         while( length > 0 )
1099         {
1100             for( i = 0; i < 16; i++ )
1101                 output[i] = (unsigned char)( input[i] ^ iv[i] );
1102 
1103             mbedtls_aes_crypt_ecb( ctx, mode, output, output );
1104             memcpy( iv, output, 16 );
1105 
1106             input  += 16;
1107             output += 16;
1108             length -= 16;
1109         }
1110     }
1111 
1112     return( 0 );
1113 }
1114 #endif /* MBEDTLS_CIPHER_MODE_CBC */
1115 
1116 #if defined(MBEDTLS_CIPHER_MODE_XTS)
1117 
1118 /* Endianess with 64 bits values */
1119 #ifndef GET_UINT64_LE
1120 #define GET_UINT64_LE(n,b,i)                            \
1121 {                                                       \
1122     (n) = ( (uint64_t) (b)[(i) + 7] << 56 )             \
1123         | ( (uint64_t) (b)[(i) + 6] << 48 )             \
1124         | ( (uint64_t) (b)[(i) + 5] << 40 )             \
1125         | ( (uint64_t) (b)[(i) + 4] << 32 )             \
1126         | ( (uint64_t) (b)[(i) + 3] << 24 )             \
1127         | ( (uint64_t) (b)[(i) + 2] << 16 )             \
1128         | ( (uint64_t) (b)[(i) + 1] <<  8 )             \
1129         | ( (uint64_t) (b)[(i)    ]       );            \
1130 }
1131 #endif
1132 
1133 #ifndef PUT_UINT64_LE
1134 #define PUT_UINT64_LE(n,b,i)                            \
1135 {                                                       \
1136     (b)[(i) + 7] = (unsigned char) ( (n) >> 56 );       \
1137     (b)[(i) + 6] = (unsigned char) ( (n) >> 48 );       \
1138     (b)[(i) + 5] = (unsigned char) ( (n) >> 40 );       \
1139     (b)[(i) + 4] = (unsigned char) ( (n) >> 32 );       \
1140     (b)[(i) + 3] = (unsigned char) ( (n) >> 24 );       \
1141     (b)[(i) + 2] = (unsigned char) ( (n) >> 16 );       \
1142     (b)[(i) + 1] = (unsigned char) ( (n) >>  8 );       \
1143     (b)[(i)    ] = (unsigned char) ( (n)       );       \
1144 }
1145 #endif
1146 
1147 typedef unsigned char mbedtls_be128[16];
1148 
1149 /*
1150  * GF(2^128) multiplication function
1151  *
1152  * This function multiplies a field element by x in the polynomial field
1153  * representation. It uses 64-bit word operations to gain speed but compensates
1154  * for machine endianess and hence works correctly on both big and little
1155  * endian machines.
1156  */
mbedtls_gf128mul_x_ble(unsigned char r[16],const unsigned char x[16])1157 static void mbedtls_gf128mul_x_ble( unsigned char r[16],
1158                                     const unsigned char x[16] )
1159 {
1160     uint64_t a, b, ra, rb;
1161 
1162     GET_UINT64_LE( a, x, 0 );
1163     GET_UINT64_LE( b, x, 8 );
1164 
1165     ra = ( a << 1 )  ^ 0x0087 >> ( 8 - ( ( b >> 63 ) << 3 ) );
1166     rb = ( a >> 63 ) | ( b << 1 );
1167 
1168     PUT_UINT64_LE( ra, r, 0 );
1169     PUT_UINT64_LE( rb, r, 8 );
1170 }
1171 
1172 /*
1173  * AES-XTS buffer encryption/decryption
1174  */
mbedtls_aes_crypt_xts(mbedtls_aes_xts_context * ctx,int mode,size_t length,const unsigned char data_unit[16],const unsigned char * input,unsigned char * output)1175 int mbedtls_aes_crypt_xts( mbedtls_aes_xts_context *ctx,
1176                            int mode,
1177                            size_t length,
1178                            const unsigned char data_unit[16],
1179                            const unsigned char *input,
1180                            unsigned char *output )
1181 {
1182     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1183     size_t blocks = length / 16;
1184     size_t leftover = length % 16;
1185     unsigned char tweak[16];
1186     unsigned char prev_tweak[16];
1187     unsigned char tmp[16];
1188 
1189     AES_VALIDATE_RET( ctx != NULL );
1190     AES_VALIDATE_RET( mode == MBEDTLS_AES_ENCRYPT ||
1191                       mode == MBEDTLS_AES_DECRYPT );
1192     AES_VALIDATE_RET( data_unit != NULL );
1193     AES_VALIDATE_RET( input != NULL );
1194     AES_VALIDATE_RET( output != NULL );
1195 
1196     /* Data units must be at least 16 bytes long. */
1197     if( length < 16 )
1198         return MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH;
1199 
1200     /* NIST SP 800-38E disallows data units larger than 2**20 blocks. */
1201     if( length > ( 1 << 20 ) * 16 )
1202         return MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH;
1203 
1204     /* Compute the tweak. */
1205     ret = mbedtls_aes_crypt_ecb( &ctx->tweak, MBEDTLS_AES_ENCRYPT,
1206                                  data_unit, tweak );
1207     if( ret != 0 )
1208         return( ret );
1209 
1210     while( blocks-- )
1211     {
1212         size_t i;
1213 
1214         if( leftover && ( mode == MBEDTLS_AES_DECRYPT ) && blocks == 0 )
1215         {
1216             /* We are on the last block in a decrypt operation that has
1217              * leftover bytes, so we need to use the next tweak for this block,
1218              * and this tweak for the lefover bytes. Save the current tweak for
1219              * the leftovers and then update the current tweak for use on this,
1220              * the last full block. */
1221             memcpy( prev_tweak, tweak, sizeof( tweak ) );
1222             mbedtls_gf128mul_x_ble( tweak, tweak );
1223         }
1224 
1225         for( i = 0; i < 16; i++ )
1226             tmp[i] = input[i] ^ tweak[i];
1227 
1228         ret = mbedtls_aes_crypt_ecb( &ctx->crypt, mode, tmp, tmp );
1229         if( ret != 0 )
1230             return( ret );
1231 
1232         for( i = 0; i < 16; i++ )
1233             output[i] = tmp[i] ^ tweak[i];
1234 
1235         /* Update the tweak for the next block. */
1236         mbedtls_gf128mul_x_ble( tweak, tweak );
1237 
1238         output += 16;
1239         input += 16;
1240     }
1241 
1242     if( leftover )
1243     {
1244         /* If we are on the leftover bytes in a decrypt operation, we need to
1245          * use the previous tweak for these bytes (as saved in prev_tweak). */
1246         unsigned char *t = mode == MBEDTLS_AES_DECRYPT ? prev_tweak : tweak;
1247 
1248         /* We are now on the final part of the data unit, which doesn't divide
1249          * evenly by 16. It's time for ciphertext stealing. */
1250         size_t i;
1251         unsigned char *prev_output = output - 16;
1252 
1253         /* Copy ciphertext bytes from the previous block to our output for each
1254          * byte of cyphertext we won't steal. At the same time, copy the
1255          * remainder of the input for this final round (since the loop bounds
1256          * are the same). */
1257         for( i = 0; i < leftover; i++ )
1258         {
1259             output[i] = prev_output[i];
1260             tmp[i] = input[i] ^ t[i];
1261         }
1262 
1263         /* Copy ciphertext bytes from the previous block for input in this
1264          * round. */
1265         for( ; i < 16; i++ )
1266             tmp[i] = prev_output[i] ^ t[i];
1267 
1268         ret = mbedtls_aes_crypt_ecb( &ctx->crypt, mode, tmp, tmp );
1269         if( ret != 0 )
1270             return ret;
1271 
1272         /* Write the result back to the previous block, overriding the previous
1273          * output we copied. */
1274         for( i = 0; i < 16; i++ )
1275             prev_output[i] = tmp[i] ^ t[i];
1276     }
1277 
1278     return( 0 );
1279 }
1280 #endif /* MBEDTLS_CIPHER_MODE_XTS */
1281 
1282 #if defined(MBEDTLS_CIPHER_MODE_CFB)
1283 /*
1284  * AES-CFB128 buffer encryption/decryption
1285  */
mbedtls_aes_crypt_cfb128(mbedtls_aes_context * ctx,int mode,size_t length,size_t * iv_off,unsigned char iv[16],const unsigned char * input,unsigned char * output)1286 int mbedtls_aes_crypt_cfb128( mbedtls_aes_context *ctx,
1287                        int mode,
1288                        size_t length,
1289                        size_t *iv_off,
1290                        unsigned char iv[16],
1291                        const unsigned char *input,
1292                        unsigned char *output )
1293 {
1294     int c;
1295     size_t n;
1296 
1297     AES_VALIDATE_RET( ctx != NULL );
1298     AES_VALIDATE_RET( mode == MBEDTLS_AES_ENCRYPT ||
1299                       mode == MBEDTLS_AES_DECRYPT );
1300     AES_VALIDATE_RET( iv_off != NULL );
1301     AES_VALIDATE_RET( iv != NULL );
1302     AES_VALIDATE_RET( input != NULL );
1303     AES_VALIDATE_RET( output != NULL );
1304 
1305     n = *iv_off;
1306 
1307     if( n > 15 )
1308         return( MBEDTLS_ERR_AES_BAD_INPUT_DATA );
1309 
1310     if( mode == MBEDTLS_AES_DECRYPT )
1311     {
1312         while( length-- )
1313         {
1314             if( n == 0 )
1315                 mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv );
1316 
1317             c = *input++;
1318             *output++ = (unsigned char)( c ^ iv[n] );
1319             iv[n] = (unsigned char) c;
1320 
1321             n = ( n + 1 ) & 0x0F;
1322         }
1323     }
1324     else
1325     {
1326         while( length-- )
1327         {
1328             if( n == 0 )
1329                 mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv );
1330 
1331             iv[n] = *output++ = (unsigned char)( iv[n] ^ *input++ );
1332 
1333             n = ( n + 1 ) & 0x0F;
1334         }
1335     }
1336 
1337     *iv_off = n;
1338 
1339     return( 0 );
1340 }
1341 
1342 /*
1343  * AES-CFB8 buffer encryption/decryption
1344  */
mbedtls_aes_crypt_cfb8(mbedtls_aes_context * ctx,int mode,size_t length,unsigned char iv[16],const unsigned char * input,unsigned char * output)1345 int mbedtls_aes_crypt_cfb8( mbedtls_aes_context *ctx,
1346                             int mode,
1347                             size_t length,
1348                             unsigned char iv[16],
1349                             const unsigned char *input,
1350                             unsigned char *output )
1351 {
1352     unsigned char c;
1353     unsigned char ov[17];
1354 
1355     AES_VALIDATE_RET( ctx != NULL );
1356     AES_VALIDATE_RET( mode == MBEDTLS_AES_ENCRYPT ||
1357                       mode == MBEDTLS_AES_DECRYPT );
1358     AES_VALIDATE_RET( iv != NULL );
1359     AES_VALIDATE_RET( input != NULL );
1360     AES_VALIDATE_RET( output != NULL );
1361     while( length-- )
1362     {
1363         memcpy( ov, iv, 16 );
1364         mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv );
1365 
1366         if( mode == MBEDTLS_AES_DECRYPT )
1367             ov[16] = *input;
1368 
1369         c = *output++ = (unsigned char)( iv[0] ^ *input++ );
1370 
1371         if( mode == MBEDTLS_AES_ENCRYPT )
1372             ov[16] = c;
1373 
1374         memcpy( iv, ov + 1, 16 );
1375     }
1376 
1377     return( 0 );
1378 }
1379 #endif /* MBEDTLS_CIPHER_MODE_CFB */
1380 
1381 #if defined(MBEDTLS_CIPHER_MODE_OFB)
1382 /*
1383  * AES-OFB (Output Feedback Mode) buffer encryption/decryption
1384  */
mbedtls_aes_crypt_ofb(mbedtls_aes_context * ctx,size_t length,size_t * iv_off,unsigned char iv[16],const unsigned char * input,unsigned char * output)1385 int mbedtls_aes_crypt_ofb( mbedtls_aes_context *ctx,
1386                            size_t length,
1387                            size_t *iv_off,
1388                            unsigned char iv[16],
1389                            const unsigned char *input,
1390                            unsigned char *output )
1391 {
1392     int ret = 0;
1393     size_t n;
1394 
1395     AES_VALIDATE_RET( ctx != NULL );
1396     AES_VALIDATE_RET( iv_off != NULL );
1397     AES_VALIDATE_RET( iv != NULL );
1398     AES_VALIDATE_RET( input != NULL );
1399     AES_VALIDATE_RET( output != NULL );
1400 
1401     n = *iv_off;
1402 
1403     if( n > 15 )
1404         return( MBEDTLS_ERR_AES_BAD_INPUT_DATA );
1405 
1406     while( length-- )
1407     {
1408         if( n == 0 )
1409         {
1410             ret = mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv );
1411             if( ret != 0 )
1412                 goto exit;
1413         }
1414         *output++ =  *input++ ^ iv[n];
1415 
1416         n = ( n + 1 ) & 0x0F;
1417     }
1418 
1419     *iv_off = n;
1420 
1421 exit:
1422     return( ret );
1423 }
1424 #endif /* MBEDTLS_CIPHER_MODE_OFB */
1425 
1426 #if defined(MBEDTLS_CIPHER_MODE_CTR)
1427 /*
1428  * AES-CTR buffer encryption/decryption
1429  */
mbedtls_aes_crypt_ctr(mbedtls_aes_context * ctx,size_t length,size_t * nc_off,unsigned char nonce_counter[16],unsigned char stream_block[16],const unsigned char * input,unsigned char * output)1430 int mbedtls_aes_crypt_ctr( mbedtls_aes_context *ctx,
1431                        size_t length,
1432                        size_t *nc_off,
1433                        unsigned char nonce_counter[16],
1434                        unsigned char stream_block[16],
1435                        const unsigned char *input,
1436                        unsigned char *output )
1437 {
1438     int c, i;
1439     size_t n;
1440 
1441     AES_VALIDATE_RET( ctx != NULL );
1442     AES_VALIDATE_RET( nc_off != NULL );
1443     AES_VALIDATE_RET( nonce_counter != NULL );
1444     AES_VALIDATE_RET( stream_block != NULL );
1445     AES_VALIDATE_RET( input != NULL );
1446     AES_VALIDATE_RET( output != NULL );
1447 
1448     n = *nc_off;
1449 
1450     if ( n > 0x0F )
1451         return( MBEDTLS_ERR_AES_BAD_INPUT_DATA );
1452 
1453     while( length-- )
1454     {
1455         if( n == 0 ) {
1456             mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, nonce_counter, stream_block );
1457 
1458             for( i = 16; i > 0; i-- )
1459                 if( ++nonce_counter[i - 1] != 0 )
1460                     break;
1461         }
1462         c = *input++;
1463         *output++ = (unsigned char)( c ^ stream_block[n] );
1464 
1465         n = ( n + 1 ) & 0x0F;
1466     }
1467 
1468     *nc_off = n;
1469 
1470     return( 0 );
1471 }
1472 #endif /* MBEDTLS_CIPHER_MODE_CTR */
1473 
1474 #endif /* !MBEDTLS_AES_ALT */
1475 
1476 #if defined(MBEDTLS_SELF_TEST)
1477 /*
1478  * AES test vectors from:
1479  *
1480  * http://csrc.nist.gov/archive/aes/rijndael/rijndael-vals.zip
1481  */
1482 static const unsigned char aes_test_ecb_dec[3][16] =
1483 {
1484     { 0x44, 0x41, 0x6A, 0xC2, 0xD1, 0xF5, 0x3C, 0x58,
1485       0x33, 0x03, 0x91, 0x7E, 0x6B, 0xE9, 0xEB, 0xE0 },
1486     { 0x48, 0xE3, 0x1E, 0x9E, 0x25, 0x67, 0x18, 0xF2,
1487       0x92, 0x29, 0x31, 0x9C, 0x19, 0xF1, 0x5B, 0xA4 },
1488     { 0x05, 0x8C, 0xCF, 0xFD, 0xBB, 0xCB, 0x38, 0x2D,
1489       0x1F, 0x6F, 0x56, 0x58, 0x5D, 0x8A, 0x4A, 0xDE }
1490 };
1491 
1492 static const unsigned char aes_test_ecb_enc[3][16] =
1493 {
1494     { 0xC3, 0x4C, 0x05, 0x2C, 0xC0, 0xDA, 0x8D, 0x73,
1495       0x45, 0x1A, 0xFE, 0x5F, 0x03, 0xBE, 0x29, 0x7F },
1496     { 0xF3, 0xF6, 0x75, 0x2A, 0xE8, 0xD7, 0x83, 0x11,
1497       0x38, 0xF0, 0x41, 0x56, 0x06, 0x31, 0xB1, 0x14 },
1498     { 0x8B, 0x79, 0xEE, 0xCC, 0x93, 0xA0, 0xEE, 0x5D,
1499       0xFF, 0x30, 0xB4, 0xEA, 0x21, 0x63, 0x6D, 0xA4 }
1500 };
1501 
1502 #if defined(MBEDTLS_CIPHER_MODE_CBC)
1503 static const unsigned char aes_test_cbc_dec[3][16] =
1504 {
1505     { 0xFA, 0xCA, 0x37, 0xE0, 0xB0, 0xC8, 0x53, 0x73,
1506       0xDF, 0x70, 0x6E, 0x73, 0xF7, 0xC9, 0xAF, 0x86 },
1507     { 0x5D, 0xF6, 0x78, 0xDD, 0x17, 0xBA, 0x4E, 0x75,
1508       0xB6, 0x17, 0x68, 0xC6, 0xAD, 0xEF, 0x7C, 0x7B },
1509     { 0x48, 0x04, 0xE1, 0x81, 0x8F, 0xE6, 0x29, 0x75,
1510       0x19, 0xA3, 0xE8, 0x8C, 0x57, 0x31, 0x04, 0x13 }
1511 };
1512 
1513 static const unsigned char aes_test_cbc_enc[3][16] =
1514 {
1515     { 0x8A, 0x05, 0xFC, 0x5E, 0x09, 0x5A, 0xF4, 0x84,
1516       0x8A, 0x08, 0xD3, 0x28, 0xD3, 0x68, 0x8E, 0x3D },
1517     { 0x7B, 0xD9, 0x66, 0xD5, 0x3A, 0xD8, 0xC1, 0xBB,
1518       0x85, 0xD2, 0xAD, 0xFA, 0xE8, 0x7B, 0xB1, 0x04 },
1519     { 0xFE, 0x3C, 0x53, 0x65, 0x3E, 0x2F, 0x45, 0xB5,
1520       0x6F, 0xCD, 0x88, 0xB2, 0xCC, 0x89, 0x8F, 0xF0 }
1521 };
1522 #endif /* MBEDTLS_CIPHER_MODE_CBC */
1523 
1524 #if defined(MBEDTLS_CIPHER_MODE_CFB)
1525 /*
1526  * AES-CFB128 test vectors from:
1527  *
1528  * http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
1529  */
1530 static const unsigned char aes_test_cfb128_key[3][32] =
1531 {
1532     { 0x2B, 0x7E, 0x15, 0x16, 0x28, 0xAE, 0xD2, 0xA6,
1533       0xAB, 0xF7, 0x15, 0x88, 0x09, 0xCF, 0x4F, 0x3C },
1534     { 0x8E, 0x73, 0xB0, 0xF7, 0xDA, 0x0E, 0x64, 0x52,
1535       0xC8, 0x10, 0xF3, 0x2B, 0x80, 0x90, 0x79, 0xE5,
1536       0x62, 0xF8, 0xEA, 0xD2, 0x52, 0x2C, 0x6B, 0x7B },
1537     { 0x60, 0x3D, 0xEB, 0x10, 0x15, 0xCA, 0x71, 0xBE,
1538       0x2B, 0x73, 0xAE, 0xF0, 0x85, 0x7D, 0x77, 0x81,
1539       0x1F, 0x35, 0x2C, 0x07, 0x3B, 0x61, 0x08, 0xD7,
1540       0x2D, 0x98, 0x10, 0xA3, 0x09, 0x14, 0xDF, 0xF4 }
1541 };
1542 
1543 static const unsigned char aes_test_cfb128_iv[16] =
1544 {
1545     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
1546     0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F
1547 };
1548 
1549 static const unsigned char aes_test_cfb128_pt[64] =
1550 {
1551     0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96,
1552     0xE9, 0x3D, 0x7E, 0x11, 0x73, 0x93, 0x17, 0x2A,
1553     0xAE, 0x2D, 0x8A, 0x57, 0x1E, 0x03, 0xAC, 0x9C,
1554     0x9E, 0xB7, 0x6F, 0xAC, 0x45, 0xAF, 0x8E, 0x51,
1555     0x30, 0xC8, 0x1C, 0x46, 0xA3, 0x5C, 0xE4, 0x11,
1556     0xE5, 0xFB, 0xC1, 0x19, 0x1A, 0x0A, 0x52, 0xEF,
1557     0xF6, 0x9F, 0x24, 0x45, 0xDF, 0x4F, 0x9B, 0x17,
1558     0xAD, 0x2B, 0x41, 0x7B, 0xE6, 0x6C, 0x37, 0x10
1559 };
1560 
1561 static const unsigned char aes_test_cfb128_ct[3][64] =
1562 {
1563     { 0x3B, 0x3F, 0xD9, 0x2E, 0xB7, 0x2D, 0xAD, 0x20,
1564       0x33, 0x34, 0x49, 0xF8, 0xE8, 0x3C, 0xFB, 0x4A,
1565       0xC8, 0xA6, 0x45, 0x37, 0xA0, 0xB3, 0xA9, 0x3F,
1566       0xCD, 0xE3, 0xCD, 0xAD, 0x9F, 0x1C, 0xE5, 0x8B,
1567       0x26, 0x75, 0x1F, 0x67, 0xA3, 0xCB, 0xB1, 0x40,
1568       0xB1, 0x80, 0x8C, 0xF1, 0x87, 0xA4, 0xF4, 0xDF,
1569       0xC0, 0x4B, 0x05, 0x35, 0x7C, 0x5D, 0x1C, 0x0E,
1570       0xEA, 0xC4, 0xC6, 0x6F, 0x9F, 0xF7, 0xF2, 0xE6 },
1571     { 0xCD, 0xC8, 0x0D, 0x6F, 0xDD, 0xF1, 0x8C, 0xAB,
1572       0x34, 0xC2, 0x59, 0x09, 0xC9, 0x9A, 0x41, 0x74,
1573       0x67, 0xCE, 0x7F, 0x7F, 0x81, 0x17, 0x36, 0x21,
1574       0x96, 0x1A, 0x2B, 0x70, 0x17, 0x1D, 0x3D, 0x7A,
1575       0x2E, 0x1E, 0x8A, 0x1D, 0xD5, 0x9B, 0x88, 0xB1,
1576       0xC8, 0xE6, 0x0F, 0xED, 0x1E, 0xFA, 0xC4, 0xC9,
1577       0xC0, 0x5F, 0x9F, 0x9C, 0xA9, 0x83, 0x4F, 0xA0,
1578       0x42, 0xAE, 0x8F, 0xBA, 0x58, 0x4B, 0x09, 0xFF },
1579     { 0xDC, 0x7E, 0x84, 0xBF, 0xDA, 0x79, 0x16, 0x4B,
1580       0x7E, 0xCD, 0x84, 0x86, 0x98, 0x5D, 0x38, 0x60,
1581       0x39, 0xFF, 0xED, 0x14, 0x3B, 0x28, 0xB1, 0xC8,
1582       0x32, 0x11, 0x3C, 0x63, 0x31, 0xE5, 0x40, 0x7B,
1583       0xDF, 0x10, 0x13, 0x24, 0x15, 0xE5, 0x4B, 0x92,
1584       0xA1, 0x3E, 0xD0, 0xA8, 0x26, 0x7A, 0xE2, 0xF9,
1585       0x75, 0xA3, 0x85, 0x74, 0x1A, 0xB9, 0xCE, 0xF8,
1586       0x20, 0x31, 0x62, 0x3D, 0x55, 0xB1, 0xE4, 0x71 }
1587 };
1588 #endif /* MBEDTLS_CIPHER_MODE_CFB */
1589 
1590 #if defined(MBEDTLS_CIPHER_MODE_OFB)
1591 /*
1592  * AES-OFB test vectors from:
1593  *
1594  * https://csrc.nist.gov/publications/detail/sp/800-38a/final
1595  */
1596 static const unsigned char aes_test_ofb_key[3][32] =
1597 {
1598     { 0x2B, 0x7E, 0x15, 0x16, 0x28, 0xAE, 0xD2, 0xA6,
1599       0xAB, 0xF7, 0x15, 0x88, 0x09, 0xCF, 0x4F, 0x3C },
1600     { 0x8E, 0x73, 0xB0, 0xF7, 0xDA, 0x0E, 0x64, 0x52,
1601       0xC8, 0x10, 0xF3, 0x2B, 0x80, 0x90, 0x79, 0xE5,
1602       0x62, 0xF8, 0xEA, 0xD2, 0x52, 0x2C, 0x6B, 0x7B },
1603     { 0x60, 0x3D, 0xEB, 0x10, 0x15, 0xCA, 0x71, 0xBE,
1604       0x2B, 0x73, 0xAE, 0xF0, 0x85, 0x7D, 0x77, 0x81,
1605       0x1F, 0x35, 0x2C, 0x07, 0x3B, 0x61, 0x08, 0xD7,
1606       0x2D, 0x98, 0x10, 0xA3, 0x09, 0x14, 0xDF, 0xF4 }
1607 };
1608 
1609 static const unsigned char aes_test_ofb_iv[16] =
1610 {
1611     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
1612     0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F
1613 };
1614 
1615 static const unsigned char aes_test_ofb_pt[64] =
1616 {
1617     0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96,
1618     0xE9, 0x3D, 0x7E, 0x11, 0x73, 0x93, 0x17, 0x2A,
1619     0xAE, 0x2D, 0x8A, 0x57, 0x1E, 0x03, 0xAC, 0x9C,
1620     0x9E, 0xB7, 0x6F, 0xAC, 0x45, 0xAF, 0x8E, 0x51,
1621     0x30, 0xC8, 0x1C, 0x46, 0xA3, 0x5C, 0xE4, 0x11,
1622     0xE5, 0xFB, 0xC1, 0x19, 0x1A, 0x0A, 0x52, 0xEF,
1623     0xF6, 0x9F, 0x24, 0x45, 0xDF, 0x4F, 0x9B, 0x17,
1624     0xAD, 0x2B, 0x41, 0x7B, 0xE6, 0x6C, 0x37, 0x10
1625 };
1626 
1627 static const unsigned char aes_test_ofb_ct[3][64] =
1628 {
1629     { 0x3B, 0x3F, 0xD9, 0x2E, 0xB7, 0x2D, 0xAD, 0x20,
1630       0x33, 0x34, 0x49, 0xF8, 0xE8, 0x3C, 0xFB, 0x4A,
1631       0x77, 0x89, 0x50, 0x8d, 0x16, 0x91, 0x8f, 0x03,
1632       0xf5, 0x3c, 0x52, 0xda, 0xc5, 0x4e, 0xd8, 0x25,
1633       0x97, 0x40, 0x05, 0x1e, 0x9c, 0x5f, 0xec, 0xf6,
1634       0x43, 0x44, 0xf7, 0xa8, 0x22, 0x60, 0xed, 0xcc,
1635       0x30, 0x4c, 0x65, 0x28, 0xf6, 0x59, 0xc7, 0x78,
1636       0x66, 0xa5, 0x10, 0xd9, 0xc1, 0xd6, 0xae, 0x5e },
1637     { 0xCD, 0xC8, 0x0D, 0x6F, 0xDD, 0xF1, 0x8C, 0xAB,
1638       0x34, 0xC2, 0x59, 0x09, 0xC9, 0x9A, 0x41, 0x74,
1639       0xfc, 0xc2, 0x8b, 0x8d, 0x4c, 0x63, 0x83, 0x7c,
1640       0x09, 0xe8, 0x17, 0x00, 0xc1, 0x10, 0x04, 0x01,
1641       0x8d, 0x9a, 0x9a, 0xea, 0xc0, 0xf6, 0x59, 0x6f,
1642       0x55, 0x9c, 0x6d, 0x4d, 0xaf, 0x59, 0xa5, 0xf2,
1643       0x6d, 0x9f, 0x20, 0x08, 0x57, 0xca, 0x6c, 0x3e,
1644       0x9c, 0xac, 0x52, 0x4b, 0xd9, 0xac, 0xc9, 0x2a },
1645     { 0xDC, 0x7E, 0x84, 0xBF, 0xDA, 0x79, 0x16, 0x4B,
1646       0x7E, 0xCD, 0x84, 0x86, 0x98, 0x5D, 0x38, 0x60,
1647       0x4f, 0xeb, 0xdc, 0x67, 0x40, 0xd2, 0x0b, 0x3a,
1648       0xc8, 0x8f, 0x6a, 0xd8, 0x2a, 0x4f, 0xb0, 0x8d,
1649       0x71, 0xab, 0x47, 0xa0, 0x86, 0xe8, 0x6e, 0xed,
1650       0xf3, 0x9d, 0x1c, 0x5b, 0xba, 0x97, 0xc4, 0x08,
1651       0x01, 0x26, 0x14, 0x1d, 0x67, 0xf3, 0x7b, 0xe8,
1652       0x53, 0x8f, 0x5a, 0x8b, 0xe7, 0x40, 0xe4, 0x84 }
1653 };
1654 #endif /* MBEDTLS_CIPHER_MODE_OFB */
1655 
1656 #if defined(MBEDTLS_CIPHER_MODE_CTR)
1657 /*
1658  * AES-CTR test vectors from:
1659  *
1660  * http://www.faqs.org/rfcs/rfc3686.html
1661  */
1662 
1663 static const unsigned char aes_test_ctr_key[3][16] =
1664 {
1665     { 0xAE, 0x68, 0x52, 0xF8, 0x12, 0x10, 0x67, 0xCC,
1666       0x4B, 0xF7, 0xA5, 0x76, 0x55, 0x77, 0xF3, 0x9E },
1667     { 0x7E, 0x24, 0x06, 0x78, 0x17, 0xFA, 0xE0, 0xD7,
1668       0x43, 0xD6, 0xCE, 0x1F, 0x32, 0x53, 0x91, 0x63 },
1669     { 0x76, 0x91, 0xBE, 0x03, 0x5E, 0x50, 0x20, 0xA8,
1670       0xAC, 0x6E, 0x61, 0x85, 0x29, 0xF9, 0xA0, 0xDC }
1671 };
1672 
1673 static const unsigned char aes_test_ctr_nonce_counter[3][16] =
1674 {
1675     { 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x00,
1676       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 },
1677     { 0x00, 0x6C, 0xB6, 0xDB, 0xC0, 0x54, 0x3B, 0x59,
1678       0xDA, 0x48, 0xD9, 0x0B, 0x00, 0x00, 0x00, 0x01 },
1679     { 0x00, 0xE0, 0x01, 0x7B, 0x27, 0x77, 0x7F, 0x3F,
1680       0x4A, 0x17, 0x86, 0xF0, 0x00, 0x00, 0x00, 0x01 }
1681 };
1682 
1683 static const unsigned char aes_test_ctr_pt[3][48] =
1684 {
1685     { 0x53, 0x69, 0x6E, 0x67, 0x6C, 0x65, 0x20, 0x62,
1686       0x6C, 0x6F, 0x63, 0x6B, 0x20, 0x6D, 0x73, 0x67 },
1687 
1688     { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
1689       0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
1690       0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
1691       0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F },
1692 
1693     { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
1694       0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
1695       0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
1696       0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F,
1697       0x20, 0x21, 0x22, 0x23 }
1698 };
1699 
1700 static const unsigned char aes_test_ctr_ct[3][48] =
1701 {
1702     { 0xE4, 0x09, 0x5D, 0x4F, 0xB7, 0xA7, 0xB3, 0x79,
1703       0x2D, 0x61, 0x75, 0xA3, 0x26, 0x13, 0x11, 0xB8 },
1704     { 0x51, 0x04, 0xA1, 0x06, 0x16, 0x8A, 0x72, 0xD9,
1705       0x79, 0x0D, 0x41, 0xEE, 0x8E, 0xDA, 0xD3, 0x88,
1706       0xEB, 0x2E, 0x1E, 0xFC, 0x46, 0xDA, 0x57, 0xC8,
1707       0xFC, 0xE6, 0x30, 0xDF, 0x91, 0x41, 0xBE, 0x28 },
1708     { 0xC1, 0xCF, 0x48, 0xA8, 0x9F, 0x2F, 0xFD, 0xD9,
1709       0xCF, 0x46, 0x52, 0xE9, 0xEF, 0xDB, 0x72, 0xD7,
1710       0x45, 0x40, 0xA4, 0x2B, 0xDE, 0x6D, 0x78, 0x36,
1711       0xD5, 0x9A, 0x5C, 0xEA, 0xAE, 0xF3, 0x10, 0x53,
1712       0x25, 0xB2, 0x07, 0x2F }
1713 };
1714 
1715 static const int aes_test_ctr_len[3] =
1716     { 16, 32, 36 };
1717 #endif /* MBEDTLS_CIPHER_MODE_CTR */
1718 
1719 #if defined(MBEDTLS_CIPHER_MODE_XTS)
1720 /*
1721  * AES-XTS test vectors from:
1722  *
1723  * IEEE P1619/D16 Annex B
1724  * https://web.archive.org/web/20150629024421/http://grouper.ieee.org/groups/1619/email/pdf00086.pdf
1725  * (Archived from original at http://grouper.ieee.org/groups/1619/email/pdf00086.pdf)
1726  */
1727 static const unsigned char aes_test_xts_key[][32] =
1728 {
1729     { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1730       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1731       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1732       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
1733     { 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11,
1734       0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11,
1735       0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22,
1736       0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22 },
1737     { 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8,
1738       0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1739       0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22,
1740       0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22 },
1741 };
1742 
1743 static const unsigned char aes_test_xts_pt32[][32] =
1744 {
1745     { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1746       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1747       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1748       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
1749     { 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
1750       0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
1751       0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
1752       0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44 },
1753     { 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
1754       0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
1755       0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
1756       0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44 },
1757 };
1758 
1759 static const unsigned char aes_test_xts_ct32[][32] =
1760 {
1761     { 0x91, 0x7c, 0xf6, 0x9e, 0xbd, 0x68, 0xb2, 0xec,
1762       0x9b, 0x9f, 0xe9, 0xa3, 0xea, 0xdd, 0xa6, 0x92,
1763       0xcd, 0x43, 0xd2, 0xf5, 0x95, 0x98, 0xed, 0x85,
1764       0x8c, 0x02, 0xc2, 0x65, 0x2f, 0xbf, 0x92, 0x2e },
1765     { 0xc4, 0x54, 0x18, 0x5e, 0x6a, 0x16, 0x93, 0x6e,
1766       0x39, 0x33, 0x40, 0x38, 0xac, 0xef, 0x83, 0x8b,
1767       0xfb, 0x18, 0x6f, 0xff, 0x74, 0x80, 0xad, 0xc4,
1768       0x28, 0x93, 0x82, 0xec, 0xd6, 0xd3, 0x94, 0xf0 },
1769     { 0xaf, 0x85, 0x33, 0x6b, 0x59, 0x7a, 0xfc, 0x1a,
1770       0x90, 0x0b, 0x2e, 0xb2, 0x1e, 0xc9, 0x49, 0xd2,
1771       0x92, 0xdf, 0x4c, 0x04, 0x7e, 0x0b, 0x21, 0x53,
1772       0x21, 0x86, 0xa5, 0x97, 0x1a, 0x22, 0x7a, 0x89 },
1773 };
1774 
1775 static const unsigned char aes_test_xts_data_unit[][16] =
1776 {
1777    { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1778      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
1779    { 0x33, 0x33, 0x33, 0x33, 0x33, 0x00, 0x00, 0x00,
1780      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
1781    { 0x33, 0x33, 0x33, 0x33, 0x33, 0x00, 0x00, 0x00,
1782      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
1783 };
1784 
1785 #endif /* MBEDTLS_CIPHER_MODE_XTS */
1786 
1787 /*
1788  * Checkup routine
1789  */
mbedtls_aes_self_test(int verbose)1790 int mbedtls_aes_self_test( int verbose )
1791 {
1792     int ret = 0, i, j, u, mode;
1793     unsigned int keybits;
1794     unsigned char key[32];
1795     unsigned char buf[64];
1796     const unsigned char *aes_tests;
1797 #if defined(MBEDTLS_CIPHER_MODE_CBC) || defined(MBEDTLS_CIPHER_MODE_CFB)
1798     unsigned char iv[16];
1799 #endif
1800 #if defined(MBEDTLS_CIPHER_MODE_CBC)
1801     unsigned char prv[16];
1802 #endif
1803 #if defined(MBEDTLS_CIPHER_MODE_CTR) || defined(MBEDTLS_CIPHER_MODE_CFB) || \
1804     defined(MBEDTLS_CIPHER_MODE_OFB)
1805     size_t offset;
1806 #endif
1807 #if defined(MBEDTLS_CIPHER_MODE_CTR) || defined(MBEDTLS_CIPHER_MODE_XTS)
1808     int len;
1809 #endif
1810 #if defined(MBEDTLS_CIPHER_MODE_CTR)
1811     unsigned char nonce_counter[16];
1812     unsigned char stream_block[16];
1813 #endif
1814     mbedtls_aes_context ctx;
1815 
1816     memset( key, 0, 32 );
1817     mbedtls_aes_init( &ctx );
1818 
1819     /*
1820      * ECB mode
1821      */
1822     for( i = 0; i < 6; i++ )
1823     {
1824         u = i >> 1;
1825         keybits = 128 + u * 64;
1826         mode = i & 1;
1827 
1828         if( verbose != 0 )
1829             mbedtls_printf( "  AES-ECB-%3u (%s): ", keybits,
1830                             ( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" );
1831 
1832         memset( buf, 0, 16 );
1833 
1834         if( mode == MBEDTLS_AES_DECRYPT )
1835         {
1836             ret = mbedtls_aes_setkey_dec( &ctx, key, keybits );
1837             aes_tests = aes_test_ecb_dec[u];
1838         }
1839         else
1840         {
1841             ret = mbedtls_aes_setkey_enc( &ctx, key, keybits );
1842             aes_tests = aes_test_ecb_enc[u];
1843         }
1844 
1845         /*
1846          * AES-192 is an optional feature that may be unavailable when
1847          * there is an alternative underlying implementation i.e. when
1848          * MBEDTLS_AES_ALT is defined.
1849          */
1850         if( ret == MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED && keybits == 192 )
1851         {
1852             mbedtls_printf( "skipped\n" );
1853             continue;
1854         }
1855         else if( ret != 0 )
1856         {
1857             goto exit;
1858         }
1859 
1860         for( j = 0; j < 10000; j++ )
1861         {
1862             ret = mbedtls_aes_crypt_ecb( &ctx, mode, buf, buf );
1863             if( ret != 0 )
1864                 goto exit;
1865         }
1866 
1867         if( memcmp( buf, aes_tests, 16 ) != 0 )
1868         {
1869             ret = 1;
1870             goto exit;
1871         }
1872 
1873         if( verbose != 0 )
1874             mbedtls_printf( "passed\n" );
1875     }
1876 
1877     if( verbose != 0 )
1878         mbedtls_printf( "\n" );
1879 
1880 #if defined(MBEDTLS_CIPHER_MODE_CBC)
1881     /*
1882      * CBC mode
1883      */
1884     for( i = 0; i < 6; i++ )
1885     {
1886         u = i >> 1;
1887         keybits = 128 + u * 64;
1888         mode = i & 1;
1889 
1890         if( verbose != 0 )
1891             mbedtls_printf( "  AES-CBC-%3u (%s): ", keybits,
1892                             ( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" );
1893 
1894         memset( iv , 0, 16 );
1895         memset( prv, 0, 16 );
1896         memset( buf, 0, 16 );
1897 
1898         if( mode == MBEDTLS_AES_DECRYPT )
1899         {
1900             ret = mbedtls_aes_setkey_dec( &ctx, key, keybits );
1901             aes_tests = aes_test_cbc_dec[u];
1902         }
1903         else
1904         {
1905             ret = mbedtls_aes_setkey_enc( &ctx, key, keybits );
1906             aes_tests = aes_test_cbc_enc[u];
1907         }
1908 
1909         /*
1910          * AES-192 is an optional feature that may be unavailable when
1911          * there is an alternative underlying implementation i.e. when
1912          * MBEDTLS_AES_ALT is defined.
1913          */
1914         if( ret == MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED && keybits == 192 )
1915         {
1916             mbedtls_printf( "skipped\n" );
1917             continue;
1918         }
1919         else if( ret != 0 )
1920         {
1921             goto exit;
1922         }
1923 
1924         for( j = 0; j < 10000; j++ )
1925         {
1926             if( mode == MBEDTLS_AES_ENCRYPT )
1927             {
1928                 unsigned char tmp[16];
1929 
1930                 memcpy( tmp, prv, 16 );
1931                 memcpy( prv, buf, 16 );
1932                 memcpy( buf, tmp, 16 );
1933             }
1934 
1935             ret = mbedtls_aes_crypt_cbc( &ctx, mode, 16, iv, buf, buf );
1936             if( ret != 0 )
1937                 goto exit;
1938 
1939         }
1940 
1941         if( memcmp( buf, aes_tests, 16 ) != 0 )
1942         {
1943             ret = 1;
1944             goto exit;
1945         }
1946 
1947         if( verbose != 0 )
1948             mbedtls_printf( "passed\n" );
1949     }
1950 
1951     if( verbose != 0 )
1952         mbedtls_printf( "\n" );
1953 #endif /* MBEDTLS_CIPHER_MODE_CBC */
1954 
1955 #if defined(MBEDTLS_CIPHER_MODE_CFB)
1956     /*
1957      * CFB128 mode
1958      */
1959     for( i = 0; i < 6; i++ )
1960     {
1961         u = i >> 1;
1962         keybits = 128 + u * 64;
1963         mode = i & 1;
1964 
1965         if( verbose != 0 )
1966             mbedtls_printf( "  AES-CFB128-%3u (%s): ", keybits,
1967                             ( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" );
1968 
1969         memcpy( iv,  aes_test_cfb128_iv, 16 );
1970         memcpy( key, aes_test_cfb128_key[u], keybits / 8 );
1971 
1972         offset = 0;
1973         ret = mbedtls_aes_setkey_enc( &ctx, key, keybits );
1974         /*
1975          * AES-192 is an optional feature that may be unavailable when
1976          * there is an alternative underlying implementation i.e. when
1977          * MBEDTLS_AES_ALT is defined.
1978          */
1979         if( ret == MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED && keybits == 192 )
1980         {
1981             mbedtls_printf( "skipped\n" );
1982             continue;
1983         }
1984         else if( ret != 0 )
1985         {
1986             goto exit;
1987         }
1988 
1989         if( mode == MBEDTLS_AES_DECRYPT )
1990         {
1991             memcpy( buf, aes_test_cfb128_ct[u], 64 );
1992             aes_tests = aes_test_cfb128_pt;
1993         }
1994         else
1995         {
1996             memcpy( buf, aes_test_cfb128_pt, 64 );
1997             aes_tests = aes_test_cfb128_ct[u];
1998         }
1999 
2000         ret = mbedtls_aes_crypt_cfb128( &ctx, mode, 64, &offset, iv, buf, buf );
2001         if( ret != 0 )
2002             goto exit;
2003 
2004         if( memcmp( buf, aes_tests, 64 ) != 0 )
2005         {
2006             ret = 1;
2007             goto exit;
2008         }
2009 
2010         if( verbose != 0 )
2011             mbedtls_printf( "passed\n" );
2012     }
2013 
2014     if( verbose != 0 )
2015         mbedtls_printf( "\n" );
2016 #endif /* MBEDTLS_CIPHER_MODE_CFB */
2017 
2018 #if defined(MBEDTLS_CIPHER_MODE_OFB)
2019     /*
2020      * OFB mode
2021      */
2022     for( i = 0; i < 6; i++ )
2023     {
2024         u = i >> 1;
2025         keybits = 128 + u * 64;
2026         mode = i & 1;
2027 
2028         if( verbose != 0 )
2029             mbedtls_printf( "  AES-OFB-%3u (%s): ", keybits,
2030                             ( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" );
2031 
2032         memcpy( iv,  aes_test_ofb_iv, 16 );
2033         memcpy( key, aes_test_ofb_key[u], keybits / 8 );
2034 
2035         offset = 0;
2036         ret = mbedtls_aes_setkey_enc( &ctx, key, keybits );
2037         /*
2038          * AES-192 is an optional feature that may be unavailable when
2039          * there is an alternative underlying implementation i.e. when
2040          * MBEDTLS_AES_ALT is defined.
2041          */
2042         if( ret == MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED && keybits == 192 )
2043         {
2044             mbedtls_printf( "skipped\n" );
2045             continue;
2046         }
2047         else if( ret != 0 )
2048         {
2049             goto exit;
2050         }
2051 
2052         if( mode == MBEDTLS_AES_DECRYPT )
2053         {
2054             memcpy( buf, aes_test_ofb_ct[u], 64 );
2055             aes_tests = aes_test_ofb_pt;
2056         }
2057         else
2058         {
2059             memcpy( buf, aes_test_ofb_pt, 64 );
2060             aes_tests = aes_test_ofb_ct[u];
2061         }
2062 
2063         ret = mbedtls_aes_crypt_ofb( &ctx, 64, &offset, iv, buf, buf );
2064         if( ret != 0 )
2065             goto exit;
2066 
2067         if( memcmp( buf, aes_tests, 64 ) != 0 )
2068         {
2069             ret = 1;
2070             goto exit;
2071         }
2072 
2073         if( verbose != 0 )
2074             mbedtls_printf( "passed\n" );
2075     }
2076 
2077     if( verbose != 0 )
2078         mbedtls_printf( "\n" );
2079 #endif /* MBEDTLS_CIPHER_MODE_OFB */
2080 
2081 #if defined(MBEDTLS_CIPHER_MODE_CTR)
2082     /*
2083      * CTR mode
2084      */
2085     for( i = 0; i < 6; i++ )
2086     {
2087         u = i >> 1;
2088         mode = i & 1;
2089 
2090         if( verbose != 0 )
2091             mbedtls_printf( "  AES-CTR-128 (%s): ",
2092                             ( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" );
2093 
2094         memcpy( nonce_counter, aes_test_ctr_nonce_counter[u], 16 );
2095         memcpy( key, aes_test_ctr_key[u], 16 );
2096 
2097         offset = 0;
2098         if( ( ret = mbedtls_aes_setkey_enc( &ctx, key, 128 ) ) != 0 )
2099             goto exit;
2100 
2101         len = aes_test_ctr_len[u];
2102 
2103         if( mode == MBEDTLS_AES_DECRYPT )
2104         {
2105             memcpy( buf, aes_test_ctr_ct[u], len );
2106             aes_tests = aes_test_ctr_pt[u];
2107         }
2108         else
2109         {
2110             memcpy( buf, aes_test_ctr_pt[u], len );
2111             aes_tests = aes_test_ctr_ct[u];
2112         }
2113 
2114         ret = mbedtls_aes_crypt_ctr( &ctx, len, &offset, nonce_counter,
2115                                      stream_block, buf, buf );
2116         if( ret != 0 )
2117             goto exit;
2118 
2119         if( memcmp( buf, aes_tests, len ) != 0 )
2120         {
2121             ret = 1;
2122             goto exit;
2123         }
2124 
2125         if( verbose != 0 )
2126             mbedtls_printf( "passed\n" );
2127     }
2128 
2129     if( verbose != 0 )
2130         mbedtls_printf( "\n" );
2131 #endif /* MBEDTLS_CIPHER_MODE_CTR */
2132 
2133 #if defined(MBEDTLS_CIPHER_MODE_XTS)
2134     {
2135     static const int num_tests =
2136         sizeof(aes_test_xts_key) / sizeof(*aes_test_xts_key);
2137     mbedtls_aes_xts_context ctx_xts;
2138 
2139     /*
2140      * XTS mode
2141      */
2142     mbedtls_aes_xts_init( &ctx_xts );
2143 
2144     for( i = 0; i < num_tests << 1; i++ )
2145     {
2146         const unsigned char *data_unit;
2147         u = i >> 1;
2148         mode = i & 1;
2149 
2150         if( verbose != 0 )
2151             mbedtls_printf( "  AES-XTS-128 (%s): ",
2152                             ( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" );
2153 
2154         memset( key, 0, sizeof( key ) );
2155         memcpy( key, aes_test_xts_key[u], 32 );
2156         data_unit = aes_test_xts_data_unit[u];
2157 
2158         len = sizeof( *aes_test_xts_ct32 );
2159 
2160         if( mode == MBEDTLS_AES_DECRYPT )
2161         {
2162             ret = mbedtls_aes_xts_setkey_dec( &ctx_xts, key, 256 );
2163             if( ret != 0)
2164                 goto exit;
2165             memcpy( buf, aes_test_xts_ct32[u], len );
2166             aes_tests = aes_test_xts_pt32[u];
2167         }
2168         else
2169         {
2170             ret = mbedtls_aes_xts_setkey_enc( &ctx_xts, key, 256 );
2171             if( ret != 0)
2172                 goto exit;
2173             memcpy( buf, aes_test_xts_pt32[u], len );
2174             aes_tests = aes_test_xts_ct32[u];
2175         }
2176 
2177 
2178         ret = mbedtls_aes_crypt_xts( &ctx_xts, mode, len, data_unit,
2179                                      buf, buf );
2180         if( ret != 0 )
2181             goto exit;
2182 
2183         if( memcmp( buf, aes_tests, len ) != 0 )
2184         {
2185             ret = 1;
2186             goto exit;
2187         }
2188 
2189         if( verbose != 0 )
2190             mbedtls_printf( "passed\n" );
2191     }
2192 
2193     if( verbose != 0 )
2194         mbedtls_printf( "\n" );
2195 
2196     mbedtls_aes_xts_free( &ctx_xts );
2197     }
2198 #endif /* MBEDTLS_CIPHER_MODE_XTS */
2199 
2200     ret = 0;
2201 
2202 exit:
2203     if( ret != 0 && verbose != 0 )
2204         mbedtls_printf( "failed\n" );
2205 
2206     mbedtls_aes_free( &ctx );
2207 
2208     return( ret );
2209 }
2210 
2211 #endif /* MBEDTLS_SELF_TEST */
2212 
2213 #endif /* MBEDTLS_AES_C */
2214