1 /* 2 * FIPS-197 compliant AES implementation 3 * 4 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved 5 * SPDX-License-Identifier: GPL-2.0 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License as published by 9 * the Free Software Foundation; either version 2 of the License, or 10 * (at your option) any later version. 11 * 12 * This program is distributed in the hope that it will be useful, 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15 * GNU General Public License for more details. 16 * 17 * You should have received a copy of the GNU General Public License along 18 * with this program; if not, write to the Free Software Foundation, Inc., 19 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. 20 * 21 * This file is part of mbed TLS (https://tls.mbed.org) 22 */ 23 /* 24 * The AES block cipher was designed by Vincent Rijmen and Joan Daemen. 25 * 26 * http://csrc.nist.gov/encryption/aes/rijndael/Rijndael.pdf 27 * http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf 28 */ 29 30 #if !defined(MBEDTLS_CONFIG_FILE) 31 #include "mbedtls/config.h" 32 #else 33 #include MBEDTLS_CONFIG_FILE 34 #endif 35 36 #if defined(MBEDTLS_AES_C) 37 38 #include <string.h> 39 40 #include "mbedtls/aes.h" 41 #if defined(MBEDTLS_PADLOCK_C) 42 #include "mbedtls/padlock.h" 43 #endif 44 #if defined(MBEDTLS_AESNI_C) 45 #include "mbedtls/aesni.h" 46 #endif 47 48 #if defined(MBEDTLS_SELF_TEST) 49 #if defined(MBEDTLS_PLATFORM_C) 50 #include "mbedtls/platform.h" 51 #else 52 #include <stdio.h> 53 #define mbedtls_printf printf 54 #endif /* MBEDTLS_PLATFORM_C */ 55 #endif /* MBEDTLS_SELF_TEST */ 56 57 #if !defined(MBEDTLS_AES_ALT) 58 59 /* Implementation that should never be optimized out by the compiler */ 60 static void mbedtls_zeroize( void *v, size_t n ) { 61 volatile unsigned char *p = (unsigned char*)v; while( n-- ) *p++ = 0; 62 } 63 64 /* 65 * 32-bit integer manipulation macros (little endian) 66 */ 67 #ifndef GET_UINT32_LE 68 #define GET_UINT32_LE(n,b,i) \ 69 { \ 70 (n) = ( (uint32_t) (b)[(i) ] ) \ 71 | ( (uint32_t) (b)[(i) + 1] << 8 ) \ 72 | ( (uint32_t) (b)[(i) + 2] << 16 ) \ 73 | ( (uint32_t) (b)[(i) + 3] << 24 ); \ 74 } 75 #endif 76 77 #ifndef PUT_UINT32_LE 78 #define PUT_UINT32_LE(n,b,i) \ 79 { \ 80 (b)[(i) ] = (unsigned char) ( ( (n) ) & 0xFF ); \ 81 (b)[(i) + 1] = (unsigned char) ( ( (n) >> 8 ) & 0xFF ); \ 82 (b)[(i) + 2] = (unsigned char) ( ( (n) >> 16 ) & 0xFF ); \ 83 (b)[(i) + 3] = (unsigned char) ( ( (n) >> 24 ) & 0xFF ); \ 84 } 85 #endif 86 87 #if defined(MBEDTLS_PADLOCK_C) && \ 88 ( defined(MBEDTLS_HAVE_X86) || defined(MBEDTLS_PADLOCK_ALIGN16) ) 89 static int aes_padlock_ace = -1; 90 #endif 91 92 #if defined(MBEDTLS_AES_ROM_TABLES) 93 /* 94 * Forward S-box 95 */ 96 static const unsigned char FSb[256] = 97 { 98 0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 99 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76, 100 0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 101 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0, 102 0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, 103 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15, 104 0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 105 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75, 106 0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, 107 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84, 108 0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 109 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF, 110 0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 111 0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8, 112 0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5, 113 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2, 114 0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, 115 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73, 116 0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 117 0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB, 118 0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, 119 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79, 120 0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9, 121 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08, 122 0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 123 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A, 124 0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, 125 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E, 126 0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94, 127 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF, 128 0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 129 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16 130 }; 131 132 /* 133 * Forward tables 134 */ 135 #define FT \ 136 \ 137 V(A5,63,63,C6), V(84,7C,7C,F8), V(99,77,77,EE), V(8D,7B,7B,F6), \ 138 V(0D,F2,F2,FF), V(BD,6B,6B,D6), V(B1,6F,6F,DE), V(54,C5,C5,91), \ 139 V(50,30,30,60), V(03,01,01,02), V(A9,67,67,CE), V(7D,2B,2B,56), \ 140 V(19,FE,FE,E7), V(62,D7,D7,B5), V(E6,AB,AB,4D), V(9A,76,76,EC), \ 141 V(45,CA,CA,8F), V(9D,82,82,1F), V(40,C9,C9,89), V(87,7D,7D,FA), \ 142 V(15,FA,FA,EF), V(EB,59,59,B2), V(C9,47,47,8E), V(0B,F0,F0,FB), \ 143 V(EC,AD,AD,41), V(67,D4,D4,B3), V(FD,A2,A2,5F), V(EA,AF,AF,45), \ 144 V(BF,9C,9C,23), V(F7,A4,A4,53), V(96,72,72,E4), V(5B,C0,C0,9B), \ 145 V(C2,B7,B7,75), V(1C,FD,FD,E1), V(AE,93,93,3D), V(6A,26,26,4C), \ 146 V(5A,36,36,6C), V(41,3F,3F,7E), V(02,F7,F7,F5), V(4F,CC,CC,83), \ 147 V(5C,34,34,68), V(F4,A5,A5,51), V(34,E5,E5,D1), V(08,F1,F1,F9), \ 148 V(93,71,71,E2), V(73,D8,D8,AB), V(53,31,31,62), V(3F,15,15,2A), \ 149 V(0C,04,04,08), V(52,C7,C7,95), V(65,23,23,46), V(5E,C3,C3,9D), \ 150 V(28,18,18,30), V(A1,96,96,37), V(0F,05,05,0A), V(B5,9A,9A,2F), \ 151 V(09,07,07,0E), V(36,12,12,24), V(9B,80,80,1B), V(3D,E2,E2,DF), \ 152 V(26,EB,EB,CD), V(69,27,27,4E), V(CD,B2,B2,7F), V(9F,75,75,EA), \ 153 V(1B,09,09,12), V(9E,83,83,1D), V(74,2C,2C,58), V(2E,1A,1A,34), \ 154 V(2D,1B,1B,36), V(B2,6E,6E,DC), V(EE,5A,5A,B4), V(FB,A0,A0,5B), \ 155 V(F6,52,52,A4), V(4D,3B,3B,76), V(61,D6,D6,B7), V(CE,B3,B3,7D), \ 156 V(7B,29,29,52), V(3E,E3,E3,DD), V(71,2F,2F,5E), V(97,84,84,13), \ 157 V(F5,53,53,A6), V(68,D1,D1,B9), V(00,00,00,00), V(2C,ED,ED,C1), \ 158 V(60,20,20,40), V(1F,FC,FC,E3), V(C8,B1,B1,79), V(ED,5B,5B,B6), \ 159 V(BE,6A,6A,D4), V(46,CB,CB,8D), V(D9,BE,BE,67), V(4B,39,39,72), \ 160 V(DE,4A,4A,94), V(D4,4C,4C,98), V(E8,58,58,B0), V(4A,CF,CF,85), \ 161 V(6B,D0,D0,BB), V(2A,EF,EF,C5), V(E5,AA,AA,4F), V(16,FB,FB,ED), \ 162 V(C5,43,43,86), V(D7,4D,4D,9A), V(55,33,33,66), V(94,85,85,11), \ 163 V(CF,45,45,8A), V(10,F9,F9,E9), V(06,02,02,04), V(81,7F,7F,FE), \ 164 V(F0,50,50,A0), V(44,3C,3C,78), V(BA,9F,9F,25), V(E3,A8,A8,4B), \ 165 V(F3,51,51,A2), V(FE,A3,A3,5D), V(C0,40,40,80), V(8A,8F,8F,05), \ 166 V(AD,92,92,3F), V(BC,9D,9D,21), V(48,38,38,70), V(04,F5,F5,F1), \ 167 V(DF,BC,BC,63), V(C1,B6,B6,77), V(75,DA,DA,AF), V(63,21,21,42), \ 168 V(30,10,10,20), V(1A,FF,FF,E5), V(0E,F3,F3,FD), V(6D,D2,D2,BF), \ 169 V(4C,CD,CD,81), V(14,0C,0C,18), V(35,13,13,26), V(2F,EC,EC,C3), \ 170 V(E1,5F,5F,BE), V(A2,97,97,35), V(CC,44,44,88), V(39,17,17,2E), \ 171 V(57,C4,C4,93), V(F2,A7,A7,55), V(82,7E,7E,FC), V(47,3D,3D,7A), \ 172 V(AC,64,64,C8), V(E7,5D,5D,BA), V(2B,19,19,32), V(95,73,73,E6), \ 173 V(A0,60,60,C0), V(98,81,81,19), V(D1,4F,4F,9E), V(7F,DC,DC,A3), \ 174 V(66,22,22,44), V(7E,2A,2A,54), V(AB,90,90,3B), V(83,88,88,0B), \ 175 V(CA,46,46,8C), V(29,EE,EE,C7), V(D3,B8,B8,6B), V(3C,14,14,28), \ 176 V(79,DE,DE,A7), V(E2,5E,5E,BC), V(1D,0B,0B,16), V(76,DB,DB,AD), \ 177 V(3B,E0,E0,DB), V(56,32,32,64), V(4E,3A,3A,74), V(1E,0A,0A,14), \ 178 V(DB,49,49,92), V(0A,06,06,0C), V(6C,24,24,48), V(E4,5C,5C,B8), \ 179 V(5D,C2,C2,9F), V(6E,D3,D3,BD), V(EF,AC,AC,43), V(A6,62,62,C4), \ 180 V(A8,91,91,39), V(A4,95,95,31), V(37,E4,E4,D3), V(8B,79,79,F2), \ 181 V(32,E7,E7,D5), V(43,C8,C8,8B), V(59,37,37,6E), V(B7,6D,6D,DA), \ 182 V(8C,8D,8D,01), V(64,D5,D5,B1), V(D2,4E,4E,9C), V(E0,A9,A9,49), \ 183 V(B4,6C,6C,D8), V(FA,56,56,AC), V(07,F4,F4,F3), V(25,EA,EA,CF), \ 184 V(AF,65,65,CA), V(8E,7A,7A,F4), V(E9,AE,AE,47), V(18,08,08,10), \ 185 V(D5,BA,BA,6F), V(88,78,78,F0), V(6F,25,25,4A), V(72,2E,2E,5C), \ 186 V(24,1C,1C,38), V(F1,A6,A6,57), V(C7,B4,B4,73), V(51,C6,C6,97), \ 187 V(23,E8,E8,CB), V(7C,DD,DD,A1), V(9C,74,74,E8), V(21,1F,1F,3E), \ 188 V(DD,4B,4B,96), V(DC,BD,BD,61), V(86,8B,8B,0D), V(85,8A,8A,0F), \ 189 V(90,70,70,E0), V(42,3E,3E,7C), V(C4,B5,B5,71), V(AA,66,66,CC), \ 190 V(D8,48,48,90), V(05,03,03,06), V(01,F6,F6,F7), V(12,0E,0E,1C), \ 191 V(A3,61,61,C2), V(5F,35,35,6A), V(F9,57,57,AE), V(D0,B9,B9,69), \ 192 V(91,86,86,17), V(58,C1,C1,99), V(27,1D,1D,3A), V(B9,9E,9E,27), \ 193 V(38,E1,E1,D9), V(13,F8,F8,EB), V(B3,98,98,2B), V(33,11,11,22), \ 194 V(BB,69,69,D2), V(70,D9,D9,A9), V(89,8E,8E,07), V(A7,94,94,33), \ 195 V(B6,9B,9B,2D), V(22,1E,1E,3C), V(92,87,87,15), V(20,E9,E9,C9), \ 196 V(49,CE,CE,87), V(FF,55,55,AA), V(78,28,28,50), V(7A,DF,DF,A5), \ 197 V(8F,8C,8C,03), V(F8,A1,A1,59), V(80,89,89,09), V(17,0D,0D,1A), \ 198 V(DA,BF,BF,65), V(31,E6,E6,D7), V(C6,42,42,84), V(B8,68,68,D0), \ 199 V(C3,41,41,82), V(B0,99,99,29), V(77,2D,2D,5A), V(11,0F,0F,1E), \ 200 V(CB,B0,B0,7B), V(FC,54,54,A8), V(D6,BB,BB,6D), V(3A,16,16,2C) 201 202 #define V(a,b,c,d) 0x##a##b##c##d 203 static const uint32_t FT0[256] = { FT }; 204 #undef V 205 206 #define V(a,b,c,d) 0x##b##c##d##a 207 static const uint32_t FT1[256] = { FT }; 208 #undef V 209 210 #define V(a,b,c,d) 0x##c##d##a##b 211 static const uint32_t FT2[256] = { FT }; 212 #undef V 213 214 #define V(a,b,c,d) 0x##d##a##b##c 215 static const uint32_t FT3[256] = { FT }; 216 #undef V 217 218 #undef FT 219 220 /* 221 * Reverse S-box 222 */ 223 static const unsigned char RSb[256] = 224 { 225 0x52, 0x09, 0x6A, 0xD5, 0x30, 0x36, 0xA5, 0x38, 226 0xBF, 0x40, 0xA3, 0x9E, 0x81, 0xF3, 0xD7, 0xFB, 227 0x7C, 0xE3, 0x39, 0x82, 0x9B, 0x2F, 0xFF, 0x87, 228 0x34, 0x8E, 0x43, 0x44, 0xC4, 0xDE, 0xE9, 0xCB, 229 0x54, 0x7B, 0x94, 0x32, 0xA6, 0xC2, 0x23, 0x3D, 230 0xEE, 0x4C, 0x95, 0x0B, 0x42, 0xFA, 0xC3, 0x4E, 231 0x08, 0x2E, 0xA1, 0x66, 0x28, 0xD9, 0x24, 0xB2, 232 0x76, 0x5B, 0xA2, 0x49, 0x6D, 0x8B, 0xD1, 0x25, 233 0x72, 0xF8, 0xF6, 0x64, 0x86, 0x68, 0x98, 0x16, 234 0xD4, 0xA4, 0x5C, 0xCC, 0x5D, 0x65, 0xB6, 0x92, 235 0x6C, 0x70, 0x48, 0x50, 0xFD, 0xED, 0xB9, 0xDA, 236 0x5E, 0x15, 0x46, 0x57, 0xA7, 0x8D, 0x9D, 0x84, 237 0x90, 0xD8, 0xAB, 0x00, 0x8C, 0xBC, 0xD3, 0x0A, 238 0xF7, 0xE4, 0x58, 0x05, 0xB8, 0xB3, 0x45, 0x06, 239 0xD0, 0x2C, 0x1E, 0x8F, 0xCA, 0x3F, 0x0F, 0x02, 240 0xC1, 0xAF, 0xBD, 0x03, 0x01, 0x13, 0x8A, 0x6B, 241 0x3A, 0x91, 0x11, 0x41, 0x4F, 0x67, 0xDC, 0xEA, 242 0x97, 0xF2, 0xCF, 0xCE, 0xF0, 0xB4, 0xE6, 0x73, 243 0x96, 0xAC, 0x74, 0x22, 0xE7, 0xAD, 0x35, 0x85, 244 0xE2, 0xF9, 0x37, 0xE8, 0x1C, 0x75, 0xDF, 0x6E, 245 0x47, 0xF1, 0x1A, 0x71, 0x1D, 0x29, 0xC5, 0x89, 246 0x6F, 0xB7, 0x62, 0x0E, 0xAA, 0x18, 0xBE, 0x1B, 247 0xFC, 0x56, 0x3E, 0x4B, 0xC6, 0xD2, 0x79, 0x20, 248 0x9A, 0xDB, 0xC0, 0xFE, 0x78, 0xCD, 0x5A, 0xF4, 249 0x1F, 0xDD, 0xA8, 0x33, 0x88, 0x07, 0xC7, 0x31, 250 0xB1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xEC, 0x5F, 251 0x60, 0x51, 0x7F, 0xA9, 0x19, 0xB5, 0x4A, 0x0D, 252 0x2D, 0xE5, 0x7A, 0x9F, 0x93, 0xC9, 0x9C, 0xEF, 253 0xA0, 0xE0, 0x3B, 0x4D, 0xAE, 0x2A, 0xF5, 0xB0, 254 0xC8, 0xEB, 0xBB, 0x3C, 0x83, 0x53, 0x99, 0x61, 255 0x17, 0x2B, 0x04, 0x7E, 0xBA, 0x77, 0xD6, 0x26, 256 0xE1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0C, 0x7D 257 }; 258 259 /* 260 * Reverse tables 261 */ 262 #define RT \ 263 \ 264 V(50,A7,F4,51), V(53,65,41,7E), V(C3,A4,17,1A), V(96,5E,27,3A), \ 265 V(CB,6B,AB,3B), V(F1,45,9D,1F), V(AB,58,FA,AC), V(93,03,E3,4B), \ 266 V(55,FA,30,20), V(F6,6D,76,AD), V(91,76,CC,88), V(25,4C,02,F5), \ 267 V(FC,D7,E5,4F), V(D7,CB,2A,C5), V(80,44,35,26), V(8F,A3,62,B5), \ 268 V(49,5A,B1,DE), V(67,1B,BA,25), V(98,0E,EA,45), V(E1,C0,FE,5D), \ 269 V(02,75,2F,C3), V(12,F0,4C,81), V(A3,97,46,8D), V(C6,F9,D3,6B), \ 270 V(E7,5F,8F,03), V(95,9C,92,15), V(EB,7A,6D,BF), V(DA,59,52,95), \ 271 V(2D,83,BE,D4), V(D3,21,74,58), V(29,69,E0,49), V(44,C8,C9,8E), \ 272 V(6A,89,C2,75), V(78,79,8E,F4), V(6B,3E,58,99), V(DD,71,B9,27), \ 273 V(B6,4F,E1,BE), V(17,AD,88,F0), V(66,AC,20,C9), V(B4,3A,CE,7D), \ 274 V(18,4A,DF,63), V(82,31,1A,E5), V(60,33,51,97), V(45,7F,53,62), \ 275 V(E0,77,64,B1), V(84,AE,6B,BB), V(1C,A0,81,FE), V(94,2B,08,F9), \ 276 V(58,68,48,70), V(19,FD,45,8F), V(87,6C,DE,94), V(B7,F8,7B,52), \ 277 V(23,D3,73,AB), V(E2,02,4B,72), V(57,8F,1F,E3), V(2A,AB,55,66), \ 278 V(07,28,EB,B2), V(03,C2,B5,2F), V(9A,7B,C5,86), V(A5,08,37,D3), \ 279 V(F2,87,28,30), V(B2,A5,BF,23), V(BA,6A,03,02), V(5C,82,16,ED), \ 280 V(2B,1C,CF,8A), V(92,B4,79,A7), V(F0,F2,07,F3), V(A1,E2,69,4E), \ 281 V(CD,F4,DA,65), V(D5,BE,05,06), V(1F,62,34,D1), V(8A,FE,A6,C4), \ 282 V(9D,53,2E,34), V(A0,55,F3,A2), V(32,E1,8A,05), V(75,EB,F6,A4), \ 283 V(39,EC,83,0B), V(AA,EF,60,40), V(06,9F,71,5E), V(51,10,6E,BD), \ 284 V(F9,8A,21,3E), V(3D,06,DD,96), V(AE,05,3E,DD), V(46,BD,E6,4D), \ 285 V(B5,8D,54,91), V(05,5D,C4,71), V(6F,D4,06,04), V(FF,15,50,60), \ 286 V(24,FB,98,19), V(97,E9,BD,D6), V(CC,43,40,89), V(77,9E,D9,67), \ 287 V(BD,42,E8,B0), V(88,8B,89,07), V(38,5B,19,E7), V(DB,EE,C8,79), \ 288 V(47,0A,7C,A1), V(E9,0F,42,7C), V(C9,1E,84,F8), V(00,00,00,00), \ 289 V(83,86,80,09), V(48,ED,2B,32), V(AC,70,11,1E), V(4E,72,5A,6C), \ 290 V(FB,FF,0E,FD), V(56,38,85,0F), V(1E,D5,AE,3D), V(27,39,2D,36), \ 291 V(64,D9,0F,0A), V(21,A6,5C,68), V(D1,54,5B,9B), V(3A,2E,36,24), \ 292 V(B1,67,0A,0C), V(0F,E7,57,93), V(D2,96,EE,B4), V(9E,91,9B,1B), \ 293 V(4F,C5,C0,80), V(A2,20,DC,61), V(69,4B,77,5A), V(16,1A,12,1C), \ 294 V(0A,BA,93,E2), V(E5,2A,A0,C0), V(43,E0,22,3C), V(1D,17,1B,12), \ 295 V(0B,0D,09,0E), V(AD,C7,8B,F2), V(B9,A8,B6,2D), V(C8,A9,1E,14), \ 296 V(85,19,F1,57), V(4C,07,75,AF), V(BB,DD,99,EE), V(FD,60,7F,A3), \ 297 V(9F,26,01,F7), V(BC,F5,72,5C), V(C5,3B,66,44), V(34,7E,FB,5B), \ 298 V(76,29,43,8B), V(DC,C6,23,CB), V(68,FC,ED,B6), V(63,F1,E4,B8), \ 299 V(CA,DC,31,D7), V(10,85,63,42), V(40,22,97,13), V(20,11,C6,84), \ 300 V(7D,24,4A,85), V(F8,3D,BB,D2), V(11,32,F9,AE), V(6D,A1,29,C7), \ 301 V(4B,2F,9E,1D), V(F3,30,B2,DC), V(EC,52,86,0D), V(D0,E3,C1,77), \ 302 V(6C,16,B3,2B), V(99,B9,70,A9), V(FA,48,94,11), V(22,64,E9,47), \ 303 V(C4,8C,FC,A8), V(1A,3F,F0,A0), V(D8,2C,7D,56), V(EF,90,33,22), \ 304 V(C7,4E,49,87), V(C1,D1,38,D9), V(FE,A2,CA,8C), V(36,0B,D4,98), \ 305 V(CF,81,F5,A6), V(28,DE,7A,A5), V(26,8E,B7,DA), V(A4,BF,AD,3F), \ 306 V(E4,9D,3A,2C), V(0D,92,78,50), V(9B,CC,5F,6A), V(62,46,7E,54), \ 307 V(C2,13,8D,F6), V(E8,B8,D8,90), V(5E,F7,39,2E), V(F5,AF,C3,82), \ 308 V(BE,80,5D,9F), V(7C,93,D0,69), V(A9,2D,D5,6F), V(B3,12,25,CF), \ 309 V(3B,99,AC,C8), V(A7,7D,18,10), V(6E,63,9C,E8), V(7B,BB,3B,DB), \ 310 V(09,78,26,CD), V(F4,18,59,6E), V(01,B7,9A,EC), V(A8,9A,4F,83), \ 311 V(65,6E,95,E6), V(7E,E6,FF,AA), V(08,CF,BC,21), V(E6,E8,15,EF), \ 312 V(D9,9B,E7,BA), V(CE,36,6F,4A), V(D4,09,9F,EA), V(D6,7C,B0,29), \ 313 V(AF,B2,A4,31), V(31,23,3F,2A), V(30,94,A5,C6), V(C0,66,A2,35), \ 314 V(37,BC,4E,74), V(A6,CA,82,FC), V(B0,D0,90,E0), V(15,D8,A7,33), \ 315 V(4A,98,04,F1), V(F7,DA,EC,41), V(0E,50,CD,7F), V(2F,F6,91,17), \ 316 V(8D,D6,4D,76), V(4D,B0,EF,43), V(54,4D,AA,CC), V(DF,04,96,E4), \ 317 V(E3,B5,D1,9E), V(1B,88,6A,4C), V(B8,1F,2C,C1), V(7F,51,65,46), \ 318 V(04,EA,5E,9D), V(5D,35,8C,01), V(73,74,87,FA), V(2E,41,0B,FB), \ 319 V(5A,1D,67,B3), V(52,D2,DB,92), V(33,56,10,E9), V(13,47,D6,6D), \ 320 V(8C,61,D7,9A), V(7A,0C,A1,37), V(8E,14,F8,59), V(89,3C,13,EB), \ 321 V(EE,27,A9,CE), V(35,C9,61,B7), V(ED,E5,1C,E1), V(3C,B1,47,7A), \ 322 V(59,DF,D2,9C), V(3F,73,F2,55), V(79,CE,14,18), V(BF,37,C7,73), \ 323 V(EA,CD,F7,53), V(5B,AA,FD,5F), V(14,6F,3D,DF), V(86,DB,44,78), \ 324 V(81,F3,AF,CA), V(3E,C4,68,B9), V(2C,34,24,38), V(5F,40,A3,C2), \ 325 V(72,C3,1D,16), V(0C,25,E2,BC), V(8B,49,3C,28), V(41,95,0D,FF), \ 326 V(71,01,A8,39), V(DE,B3,0C,08), V(9C,E4,B4,D8), V(90,C1,56,64), \ 327 V(61,84,CB,7B), V(70,B6,32,D5), V(74,5C,6C,48), V(42,57,B8,D0) 328 329 #define V(a,b,c,d) 0x##a##b##c##d 330 static const uint32_t RT0[256] = { RT }; 331 #undef V 332 333 #define V(a,b,c,d) 0x##b##c##d##a 334 static const uint32_t RT1[256] = { RT }; 335 #undef V 336 337 #define V(a,b,c,d) 0x##c##d##a##b 338 static const uint32_t RT2[256] = { RT }; 339 #undef V 340 341 #define V(a,b,c,d) 0x##d##a##b##c 342 static const uint32_t RT3[256] = { RT }; 343 #undef V 344 345 #undef RT 346 347 /* 348 * Round constants 349 */ 350 static const uint32_t RCON[10] = 351 { 352 0x00000001, 0x00000002, 0x00000004, 0x00000008, 353 0x00000010, 0x00000020, 0x00000040, 0x00000080, 354 0x0000001B, 0x00000036 355 }; 356 357 #else /* MBEDTLS_AES_ROM_TABLES */ 358 359 /* 360 * Forward S-box & tables 361 */ 362 static unsigned char FSb[256]; 363 static uint32_t FT0[256]; 364 static uint32_t FT1[256]; 365 static uint32_t FT2[256]; 366 static uint32_t FT3[256]; 367 368 /* 369 * Reverse S-box & tables 370 */ 371 static unsigned char RSb[256]; 372 static uint32_t RT0[256]; 373 static uint32_t RT1[256]; 374 static uint32_t RT2[256]; 375 static uint32_t RT3[256]; 376 377 /* 378 * Round constants 379 */ 380 static uint32_t RCON[10]; 381 382 /* 383 * Tables generation code 384 */ 385 #define ROTL8(x) ( ( x << 8 ) & 0xFFFFFFFF ) | ( x >> 24 ) 386 #define XTIME(x) ( ( x << 1 ) ^ ( ( x & 0x80 ) ? 0x1B : 0x00 ) ) 387 #define MUL(x,y) ( ( x && y ) ? pow[(log[x]+log[y]) % 255] : 0 ) 388 389 static int aes_init_done = 0; 390 391 static void aes_gen_tables( void ) 392 { 393 int i, x, y, z; 394 int pow[256]; 395 int log[256]; 396 397 /* 398 * compute pow and log tables over GF(2^8) 399 */ 400 for( i = 0, x = 1; i < 256; i++ ) 401 { 402 pow[i] = x; 403 log[x] = i; 404 x = ( x ^ XTIME( x ) ) & 0xFF; 405 } 406 407 /* 408 * calculate the round constants 409 */ 410 for( i = 0, x = 1; i < 10; i++ ) 411 { 412 RCON[i] = (uint32_t) x; 413 x = XTIME( x ) & 0xFF; 414 } 415 416 /* 417 * generate the forward and reverse S-boxes 418 */ 419 FSb[0x00] = 0x63; 420 RSb[0x63] = 0x00; 421 422 for( i = 1; i < 256; i++ ) 423 { 424 x = pow[255 - log[i]]; 425 426 y = x; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF; 427 x ^= y; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF; 428 x ^= y; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF; 429 x ^= y; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF; 430 x ^= y ^ 0x63; 431 432 FSb[i] = (unsigned char) x; 433 RSb[x] = (unsigned char) i; 434 } 435 436 /* 437 * generate the forward and reverse tables 438 */ 439 for( i = 0; i < 256; i++ ) 440 { 441 x = FSb[i]; 442 y = XTIME( x ) & 0xFF; 443 z = ( y ^ x ) & 0xFF; 444 445 FT0[i] = ( (uint32_t) y ) ^ 446 ( (uint32_t) x << 8 ) ^ 447 ( (uint32_t) x << 16 ) ^ 448 ( (uint32_t) z << 24 ); 449 450 FT1[i] = ROTL8( FT0[i] ); 451 FT2[i] = ROTL8( FT1[i] ); 452 FT3[i] = ROTL8( FT2[i] ); 453 454 x = RSb[i]; 455 456 RT0[i] = ( (uint32_t) MUL( 0x0E, x ) ) ^ 457 ( (uint32_t) MUL( 0x09, x ) << 8 ) ^ 458 ( (uint32_t) MUL( 0x0D, x ) << 16 ) ^ 459 ( (uint32_t) MUL( 0x0B, x ) << 24 ); 460 461 RT1[i] = ROTL8( RT0[i] ); 462 RT2[i] = ROTL8( RT1[i] ); 463 RT3[i] = ROTL8( RT2[i] ); 464 } 465 } 466 467 #endif /* MBEDTLS_AES_ROM_TABLES */ 468 469 void mbedtls_aes_init( mbedtls_aes_context *ctx ) 470 { 471 memset( ctx, 0, sizeof( mbedtls_aes_context ) ); 472 } 473 474 void mbedtls_aes_free( mbedtls_aes_context *ctx ) 475 { 476 if( ctx == NULL ) 477 return; 478 479 mbedtls_zeroize( ctx, sizeof( mbedtls_aes_context ) ); 480 } 481 482 /* 483 * AES key schedule (encryption) 484 */ 485 #if !defined(MBEDTLS_AES_SETKEY_ENC_ALT) 486 int mbedtls_aes_setkey_enc( mbedtls_aes_context *ctx, const unsigned char *key, 487 unsigned int keybits ) 488 { 489 unsigned int i; 490 uint32_t *RK; 491 492 #if !defined(MBEDTLS_AES_ROM_TABLES) 493 if( aes_init_done == 0 ) 494 { 495 aes_gen_tables(); 496 aes_init_done = 1; 497 498 } 499 #endif 500 501 switch( keybits ) 502 { 503 case 128: ctx->nr = 10; break; 504 case 192: ctx->nr = 12; break; 505 case 256: ctx->nr = 14; break; 506 default : return( MBEDTLS_ERR_AES_INVALID_KEY_LENGTH ); 507 } 508 509 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_PADLOCK_ALIGN16) 510 if( aes_padlock_ace == -1 ) 511 aes_padlock_ace = mbedtls_padlock_has_support( MBEDTLS_PADLOCK_ACE ); 512 513 if( aes_padlock_ace ) 514 ctx->rk = RK = MBEDTLS_PADLOCK_ALIGN16( ctx->buf ); 515 else 516 #endif 517 ctx->rk = RK = ctx->buf; 518 519 #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64) 520 if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) ) 521 return( mbedtls_aesni_setkey_enc( (unsigned char *) ctx->rk, key, keybits ) ); 522 #endif 523 524 for( i = 0; i < ( keybits >> 5 ); i++ ) 525 { 526 GET_UINT32_LE( RK[i], key, i << 2 ); 527 } 528 529 switch( ctx->nr ) 530 { 531 case 10: 532 533 for( i = 0; i < 10; i++, RK += 4 ) 534 { 535 RK[4] = RK[0] ^ RCON[i] ^ 536 ( (uint32_t) FSb[ ( RK[3] >> 8 ) & 0xFF ] ) ^ 537 ( (uint32_t) FSb[ ( RK[3] >> 16 ) & 0xFF ] << 8 ) ^ 538 ( (uint32_t) FSb[ ( RK[3] >> 24 ) & 0xFF ] << 16 ) ^ 539 ( (uint32_t) FSb[ ( RK[3] ) & 0xFF ] << 24 ); 540 541 RK[5] = RK[1] ^ RK[4]; 542 RK[6] = RK[2] ^ RK[5]; 543 RK[7] = RK[3] ^ RK[6]; 544 } 545 break; 546 547 case 12: 548 549 for( i = 0; i < 8; i++, RK += 6 ) 550 { 551 RK[6] = RK[0] ^ RCON[i] ^ 552 ( (uint32_t) FSb[ ( RK[5] >> 8 ) & 0xFF ] ) ^ 553 ( (uint32_t) FSb[ ( RK[5] >> 16 ) & 0xFF ] << 8 ) ^ 554 ( (uint32_t) FSb[ ( RK[5] >> 24 ) & 0xFF ] << 16 ) ^ 555 ( (uint32_t) FSb[ ( RK[5] ) & 0xFF ] << 24 ); 556 557 RK[7] = RK[1] ^ RK[6]; 558 RK[8] = RK[2] ^ RK[7]; 559 RK[9] = RK[3] ^ RK[8]; 560 RK[10] = RK[4] ^ RK[9]; 561 RK[11] = RK[5] ^ RK[10]; 562 } 563 break; 564 565 case 14: 566 567 for( i = 0; i < 7; i++, RK += 8 ) 568 { 569 RK[8] = RK[0] ^ RCON[i] ^ 570 ( (uint32_t) FSb[ ( RK[7] >> 8 ) & 0xFF ] ) ^ 571 ( (uint32_t) FSb[ ( RK[7] >> 16 ) & 0xFF ] << 8 ) ^ 572 ( (uint32_t) FSb[ ( RK[7] >> 24 ) & 0xFF ] << 16 ) ^ 573 ( (uint32_t) FSb[ ( RK[7] ) & 0xFF ] << 24 ); 574 575 RK[9] = RK[1] ^ RK[8]; 576 RK[10] = RK[2] ^ RK[9]; 577 RK[11] = RK[3] ^ RK[10]; 578 579 RK[12] = RK[4] ^ 580 ( (uint32_t) FSb[ ( RK[11] ) & 0xFF ] ) ^ 581 ( (uint32_t) FSb[ ( RK[11] >> 8 ) & 0xFF ] << 8 ) ^ 582 ( (uint32_t) FSb[ ( RK[11] >> 16 ) & 0xFF ] << 16 ) ^ 583 ( (uint32_t) FSb[ ( RK[11] >> 24 ) & 0xFF ] << 24 ); 584 585 RK[13] = RK[5] ^ RK[12]; 586 RK[14] = RK[6] ^ RK[13]; 587 RK[15] = RK[7] ^ RK[14]; 588 } 589 break; 590 } 591 592 return( 0 ); 593 } 594 #endif /* !MBEDTLS_AES_SETKEY_ENC_ALT */ 595 596 /* 597 * AES key schedule (decryption) 598 */ 599 #if !defined(MBEDTLS_AES_SETKEY_DEC_ALT) 600 int mbedtls_aes_setkey_dec( mbedtls_aes_context *ctx, const unsigned char *key, 601 unsigned int keybits ) 602 { 603 int i, j, ret; 604 mbedtls_aes_context cty; 605 uint32_t *RK; 606 uint32_t *SK; 607 608 mbedtls_aes_init( &cty ); 609 610 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_PADLOCK_ALIGN16) 611 if( aes_padlock_ace == -1 ) 612 aes_padlock_ace = mbedtls_padlock_has_support( MBEDTLS_PADLOCK_ACE ); 613 614 if( aes_padlock_ace ) 615 ctx->rk = RK = MBEDTLS_PADLOCK_ALIGN16( ctx->buf ); 616 else 617 #endif 618 ctx->rk = RK = ctx->buf; 619 620 /* Also checks keybits */ 621 if( ( ret = mbedtls_aes_setkey_enc( &cty, key, keybits ) ) != 0 ) 622 goto exit; 623 624 ctx->nr = cty.nr; 625 626 #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64) 627 if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) ) 628 { 629 mbedtls_aesni_inverse_key( (unsigned char *) ctx->rk, 630 (const unsigned char *) cty.rk, ctx->nr ); 631 goto exit; 632 } 633 #endif 634 635 SK = cty.rk + cty.nr * 4; 636 637 *RK++ = *SK++; 638 *RK++ = *SK++; 639 *RK++ = *SK++; 640 *RK++ = *SK++; 641 642 for( i = ctx->nr - 1, SK -= 8; i > 0; i--, SK -= 8 ) 643 { 644 for( j = 0; j < 4; j++, SK++ ) 645 { 646 *RK++ = RT0[ FSb[ ( *SK ) & 0xFF ] ] ^ 647 RT1[ FSb[ ( *SK >> 8 ) & 0xFF ] ] ^ 648 RT2[ FSb[ ( *SK >> 16 ) & 0xFF ] ] ^ 649 RT3[ FSb[ ( *SK >> 24 ) & 0xFF ] ]; 650 } 651 } 652 653 *RK++ = *SK++; 654 *RK++ = *SK++; 655 *RK++ = *SK++; 656 *RK++ = *SK++; 657 658 exit: 659 mbedtls_aes_free( &cty ); 660 661 return( ret ); 662 } 663 #endif /* !MBEDTLS_AES_SETKEY_DEC_ALT */ 664 665 #define AES_FROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3) \ 666 { \ 667 X0 = *RK++ ^ FT0[ ( Y0 ) & 0xFF ] ^ \ 668 FT1[ ( Y1 >> 8 ) & 0xFF ] ^ \ 669 FT2[ ( Y2 >> 16 ) & 0xFF ] ^ \ 670 FT3[ ( Y3 >> 24 ) & 0xFF ]; \ 671 \ 672 X1 = *RK++ ^ FT0[ ( Y1 ) & 0xFF ] ^ \ 673 FT1[ ( Y2 >> 8 ) & 0xFF ] ^ \ 674 FT2[ ( Y3 >> 16 ) & 0xFF ] ^ \ 675 FT3[ ( Y0 >> 24 ) & 0xFF ]; \ 676 \ 677 X2 = *RK++ ^ FT0[ ( Y2 ) & 0xFF ] ^ \ 678 FT1[ ( Y3 >> 8 ) & 0xFF ] ^ \ 679 FT2[ ( Y0 >> 16 ) & 0xFF ] ^ \ 680 FT3[ ( Y1 >> 24 ) & 0xFF ]; \ 681 \ 682 X3 = *RK++ ^ FT0[ ( Y3 ) & 0xFF ] ^ \ 683 FT1[ ( Y0 >> 8 ) & 0xFF ] ^ \ 684 FT2[ ( Y1 >> 16 ) & 0xFF ] ^ \ 685 FT3[ ( Y2 >> 24 ) & 0xFF ]; \ 686 } 687 688 #define AES_RROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3) \ 689 { \ 690 X0 = *RK++ ^ RT0[ ( Y0 ) & 0xFF ] ^ \ 691 RT1[ ( Y3 >> 8 ) & 0xFF ] ^ \ 692 RT2[ ( Y2 >> 16 ) & 0xFF ] ^ \ 693 RT3[ ( Y1 >> 24 ) & 0xFF ]; \ 694 \ 695 X1 = *RK++ ^ RT0[ ( Y1 ) & 0xFF ] ^ \ 696 RT1[ ( Y0 >> 8 ) & 0xFF ] ^ \ 697 RT2[ ( Y3 >> 16 ) & 0xFF ] ^ \ 698 RT3[ ( Y2 >> 24 ) & 0xFF ]; \ 699 \ 700 X2 = *RK++ ^ RT0[ ( Y2 ) & 0xFF ] ^ \ 701 RT1[ ( Y1 >> 8 ) & 0xFF ] ^ \ 702 RT2[ ( Y0 >> 16 ) & 0xFF ] ^ \ 703 RT3[ ( Y3 >> 24 ) & 0xFF ]; \ 704 \ 705 X3 = *RK++ ^ RT0[ ( Y3 ) & 0xFF ] ^ \ 706 RT1[ ( Y2 >> 8 ) & 0xFF ] ^ \ 707 RT2[ ( Y1 >> 16 ) & 0xFF ] ^ \ 708 RT3[ ( Y0 >> 24 ) & 0xFF ]; \ 709 } 710 711 /* 712 * AES-ECB block encryption 713 */ 714 #if !defined(MBEDTLS_AES_ENCRYPT_ALT) 715 int mbedtls_internal_aes_encrypt( mbedtls_aes_context *ctx, 716 const unsigned char input[16], 717 unsigned char output[16] ) 718 { 719 int i; 720 uint32_t *RK, X0, X1, X2, X3, Y0, Y1, Y2, Y3; 721 722 RK = ctx->rk; 723 724 GET_UINT32_LE( X0, input, 0 ); X0 ^= *RK++; 725 GET_UINT32_LE( X1, input, 4 ); X1 ^= *RK++; 726 GET_UINT32_LE( X2, input, 8 ); X2 ^= *RK++; 727 GET_UINT32_LE( X3, input, 12 ); X3 ^= *RK++; 728 729 for( i = ( ctx->nr >> 1 ) - 1; i > 0; i-- ) 730 { 731 AES_FROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 ); 732 AES_FROUND( X0, X1, X2, X3, Y0, Y1, Y2, Y3 ); 733 } 734 735 AES_FROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 ); 736 737 X0 = *RK++ ^ \ 738 ( (uint32_t) FSb[ ( Y0 ) & 0xFF ] ) ^ 739 ( (uint32_t) FSb[ ( Y1 >> 8 ) & 0xFF ] << 8 ) ^ 740 ( (uint32_t) FSb[ ( Y2 >> 16 ) & 0xFF ] << 16 ) ^ 741 ( (uint32_t) FSb[ ( Y3 >> 24 ) & 0xFF ] << 24 ); 742 743 X1 = *RK++ ^ \ 744 ( (uint32_t) FSb[ ( Y1 ) & 0xFF ] ) ^ 745 ( (uint32_t) FSb[ ( Y2 >> 8 ) & 0xFF ] << 8 ) ^ 746 ( (uint32_t) FSb[ ( Y3 >> 16 ) & 0xFF ] << 16 ) ^ 747 ( (uint32_t) FSb[ ( Y0 >> 24 ) & 0xFF ] << 24 ); 748 749 X2 = *RK++ ^ \ 750 ( (uint32_t) FSb[ ( Y2 ) & 0xFF ] ) ^ 751 ( (uint32_t) FSb[ ( Y3 >> 8 ) & 0xFF ] << 8 ) ^ 752 ( (uint32_t) FSb[ ( Y0 >> 16 ) & 0xFF ] << 16 ) ^ 753 ( (uint32_t) FSb[ ( Y1 >> 24 ) & 0xFF ] << 24 ); 754 755 X3 = *RK++ ^ \ 756 ( (uint32_t) FSb[ ( Y3 ) & 0xFF ] ) ^ 757 ( (uint32_t) FSb[ ( Y0 >> 8 ) & 0xFF ] << 8 ) ^ 758 ( (uint32_t) FSb[ ( Y1 >> 16 ) & 0xFF ] << 16 ) ^ 759 ( (uint32_t) FSb[ ( Y2 >> 24 ) & 0xFF ] << 24 ); 760 761 PUT_UINT32_LE( X0, output, 0 ); 762 PUT_UINT32_LE( X1, output, 4 ); 763 PUT_UINT32_LE( X2, output, 8 ); 764 PUT_UINT32_LE( X3, output, 12 ); 765 766 mbedtls_zeroize( &X0, sizeof( X0 ) ); 767 mbedtls_zeroize( &X1, sizeof( X1 ) ); 768 mbedtls_zeroize( &X2, sizeof( X2 ) ); 769 mbedtls_zeroize( &X3, sizeof( X3 ) ); 770 771 mbedtls_zeroize( &Y0, sizeof( Y0 ) ); 772 mbedtls_zeroize( &Y1, sizeof( Y1 ) ); 773 mbedtls_zeroize( &Y2, sizeof( Y2 ) ); 774 mbedtls_zeroize( &Y3, sizeof( Y3 ) ); 775 776 mbedtls_zeroize( &RK, sizeof( RK ) ); 777 778 return( 0 ); 779 } 780 #endif /* !MBEDTLS_AES_ENCRYPT_ALT */ 781 782 #if !defined(MBEDTLS_DEPRECATED_REMOVED) 783 void mbedtls_aes_encrypt( mbedtls_aes_context *ctx, 784 const unsigned char input[16], 785 unsigned char output[16] ) 786 { 787 mbedtls_internal_aes_encrypt( ctx, input, output ); 788 } 789 #endif /* !MBEDTLS_DEPRECATED_REMOVED */ 790 791 /* 792 * AES-ECB block decryption 793 */ 794 #if !defined(MBEDTLS_AES_DECRYPT_ALT) 795 int mbedtls_internal_aes_decrypt( mbedtls_aes_context *ctx, 796 const unsigned char input[16], 797 unsigned char output[16] ) 798 { 799 int i; 800 uint32_t *RK, X0, X1, X2, X3, Y0, Y1, Y2, Y3; 801 802 RK = ctx->rk; 803 804 GET_UINT32_LE( X0, input, 0 ); X0 ^= *RK++; 805 GET_UINT32_LE( X1, input, 4 ); X1 ^= *RK++; 806 GET_UINT32_LE( X2, input, 8 ); X2 ^= *RK++; 807 GET_UINT32_LE( X3, input, 12 ); X3 ^= *RK++; 808 809 for( i = ( ctx->nr >> 1 ) - 1; i > 0; i-- ) 810 { 811 AES_RROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 ); 812 AES_RROUND( X0, X1, X2, X3, Y0, Y1, Y2, Y3 ); 813 } 814 815 AES_RROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 ); 816 817 X0 = *RK++ ^ \ 818 ( (uint32_t) RSb[ ( Y0 ) & 0xFF ] ) ^ 819 ( (uint32_t) RSb[ ( Y3 >> 8 ) & 0xFF ] << 8 ) ^ 820 ( (uint32_t) RSb[ ( Y2 >> 16 ) & 0xFF ] << 16 ) ^ 821 ( (uint32_t) RSb[ ( Y1 >> 24 ) & 0xFF ] << 24 ); 822 823 X1 = *RK++ ^ \ 824 ( (uint32_t) RSb[ ( Y1 ) & 0xFF ] ) ^ 825 ( (uint32_t) RSb[ ( Y0 >> 8 ) & 0xFF ] << 8 ) ^ 826 ( (uint32_t) RSb[ ( Y3 >> 16 ) & 0xFF ] << 16 ) ^ 827 ( (uint32_t) RSb[ ( Y2 >> 24 ) & 0xFF ] << 24 ); 828 829 X2 = *RK++ ^ \ 830 ( (uint32_t) RSb[ ( Y2 ) & 0xFF ] ) ^ 831 ( (uint32_t) RSb[ ( Y1 >> 8 ) & 0xFF ] << 8 ) ^ 832 ( (uint32_t) RSb[ ( Y0 >> 16 ) & 0xFF ] << 16 ) ^ 833 ( (uint32_t) RSb[ ( Y3 >> 24 ) & 0xFF ] << 24 ); 834 835 X3 = *RK++ ^ \ 836 ( (uint32_t) RSb[ ( Y3 ) & 0xFF ] ) ^ 837 ( (uint32_t) RSb[ ( Y2 >> 8 ) & 0xFF ] << 8 ) ^ 838 ( (uint32_t) RSb[ ( Y1 >> 16 ) & 0xFF ] << 16 ) ^ 839 ( (uint32_t) RSb[ ( Y0 >> 24 ) & 0xFF ] << 24 ); 840 841 PUT_UINT32_LE( X0, output, 0 ); 842 PUT_UINT32_LE( X1, output, 4 ); 843 PUT_UINT32_LE( X2, output, 8 ); 844 PUT_UINT32_LE( X3, output, 12 ); 845 846 mbedtls_zeroize( &X0, sizeof( X0 ) ); 847 mbedtls_zeroize( &X1, sizeof( X1 ) ); 848 mbedtls_zeroize( &X2, sizeof( X2 ) ); 849 mbedtls_zeroize( &X3, sizeof( X3 ) ); 850 851 mbedtls_zeroize( &Y0, sizeof( Y0 ) ); 852 mbedtls_zeroize( &Y1, sizeof( Y1 ) ); 853 mbedtls_zeroize( &Y2, sizeof( Y2 ) ); 854 mbedtls_zeroize( &Y3, sizeof( Y3 ) ); 855 856 mbedtls_zeroize( &RK, sizeof( RK ) ); 857 858 return( 0 ); 859 } 860 #endif /* !MBEDTLS_AES_DECRYPT_ALT */ 861 862 #if !defined(MBEDTLS_DEPRECATED_REMOVED) 863 void mbedtls_aes_decrypt( mbedtls_aes_context *ctx, 864 const unsigned char input[16], 865 unsigned char output[16] ) 866 { 867 mbedtls_internal_aes_decrypt( ctx, input, output ); 868 } 869 #endif /* !MBEDTLS_DEPRECATED_REMOVED */ 870 871 /* 872 * AES-ECB block encryption/decryption 873 */ 874 int mbedtls_aes_crypt_ecb( mbedtls_aes_context *ctx, 875 int mode, 876 const unsigned char input[16], 877 unsigned char output[16] ) 878 { 879 #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64) 880 if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) ) 881 return( mbedtls_aesni_crypt_ecb( ctx, mode, input, output ) ); 882 #endif 883 884 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_HAVE_X86) 885 if( aes_padlock_ace ) 886 { 887 if( mbedtls_padlock_xcryptecb( ctx, mode, input, output ) == 0 ) 888 return( 0 ); 889 890 // If padlock data misaligned, we just fall back to 891 // unaccelerated mode 892 // 893 } 894 #endif 895 896 if( mode == MBEDTLS_AES_ENCRYPT ) 897 return( mbedtls_internal_aes_encrypt( ctx, input, output ) ); 898 else 899 return( mbedtls_internal_aes_decrypt( ctx, input, output ) ); 900 } 901 902 #if defined(MBEDTLS_CIPHER_MODE_CBC) 903 /* 904 * AES-CBC buffer encryption/decryption 905 */ 906 int mbedtls_aes_crypt_cbc( mbedtls_aes_context *ctx, 907 int mode, 908 size_t length, 909 unsigned char iv[16], 910 const unsigned char *input, 911 unsigned char *output ) 912 { 913 int i; 914 unsigned char temp[16]; 915 916 if( length % 16 ) 917 return( MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH ); 918 919 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_HAVE_X86) 920 if( aes_padlock_ace ) 921 { 922 if( mbedtls_padlock_xcryptcbc( ctx, mode, length, iv, input, output ) == 0 ) 923 return( 0 ); 924 925 // If padlock data misaligned, we just fall back to 926 // unaccelerated mode 927 // 928 } 929 #endif 930 931 if( mode == MBEDTLS_AES_DECRYPT ) 932 { 933 while( length > 0 ) 934 { 935 memcpy( temp, input, 16 ); 936 mbedtls_aes_crypt_ecb( ctx, mode, input, output ); 937 938 for( i = 0; i < 16; i++ ) 939 output[i] = (unsigned char)( output[i] ^ iv[i] ); 940 941 memcpy( iv, temp, 16 ); 942 943 input += 16; 944 output += 16; 945 length -= 16; 946 } 947 } 948 else 949 { 950 while( length > 0 ) 951 { 952 for( i = 0; i < 16; i++ ) 953 output[i] = (unsigned char)( input[i] ^ iv[i] ); 954 955 mbedtls_aes_crypt_ecb( ctx, mode, output, output ); 956 memcpy( iv, output, 16 ); 957 958 input += 16; 959 output += 16; 960 length -= 16; 961 } 962 } 963 964 return( 0 ); 965 } 966 #endif /* MBEDTLS_CIPHER_MODE_CBC */ 967 968 #if defined(MBEDTLS_CIPHER_MODE_CFB) 969 /* 970 * AES-CFB128 buffer encryption/decryption 971 */ 972 int mbedtls_aes_crypt_cfb128( mbedtls_aes_context *ctx, 973 int mode, 974 size_t length, 975 size_t *iv_off, 976 unsigned char iv[16], 977 const unsigned char *input, 978 unsigned char *output ) 979 { 980 int c; 981 size_t n = *iv_off; 982 983 if( mode == MBEDTLS_AES_DECRYPT ) 984 { 985 while( length-- ) 986 { 987 if( n == 0 ) 988 mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv ); 989 990 c = *input++; 991 *output++ = (unsigned char)( c ^ iv[n] ); 992 iv[n] = (unsigned char) c; 993 994 n = ( n + 1 ) & 0x0F; 995 } 996 } 997 else 998 { 999 while( length-- ) 1000 { 1001 if( n == 0 ) 1002 mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv ); 1003 1004 iv[n] = *output++ = (unsigned char)( iv[n] ^ *input++ ); 1005 1006 n = ( n + 1 ) & 0x0F; 1007 } 1008 } 1009 1010 *iv_off = n; 1011 1012 return( 0 ); 1013 } 1014 1015 /* 1016 * AES-CFB8 buffer encryption/decryption 1017 */ 1018 int mbedtls_aes_crypt_cfb8( mbedtls_aes_context *ctx, 1019 int mode, 1020 size_t length, 1021 unsigned char iv[16], 1022 const unsigned char *input, 1023 unsigned char *output ) 1024 { 1025 unsigned char c; 1026 unsigned char ov[17]; 1027 1028 while( length-- ) 1029 { 1030 memcpy( ov, iv, 16 ); 1031 mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv ); 1032 1033 if( mode == MBEDTLS_AES_DECRYPT ) 1034 ov[16] = *input; 1035 1036 c = *output++ = (unsigned char)( iv[0] ^ *input++ ); 1037 1038 if( mode == MBEDTLS_AES_ENCRYPT ) 1039 ov[16] = c; 1040 1041 memcpy( iv, ov + 1, 16 ); 1042 } 1043 1044 return( 0 ); 1045 } 1046 #endif /*MBEDTLS_CIPHER_MODE_CFB */ 1047 1048 #if defined(MBEDTLS_CIPHER_MODE_CTR) 1049 /* 1050 * AES-CTR buffer encryption/decryption 1051 */ 1052 int mbedtls_aes_crypt_ctr( mbedtls_aes_context *ctx, 1053 size_t length, 1054 size_t *nc_off, 1055 unsigned char nonce_counter[16], 1056 unsigned char stream_block[16], 1057 const unsigned char *input, 1058 unsigned char *output ) 1059 { 1060 int c, i; 1061 size_t n = *nc_off; 1062 1063 while( length-- ) 1064 { 1065 if( n == 0 ) { 1066 mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, nonce_counter, stream_block ); 1067 1068 for( i = 16; i > 0; i-- ) 1069 if( ++nonce_counter[i - 1] != 0 ) 1070 break; 1071 } 1072 c = *input++; 1073 *output++ = (unsigned char)( c ^ stream_block[n] ); 1074 1075 n = ( n + 1 ) & 0x0F; 1076 } 1077 1078 *nc_off = n; 1079 1080 return( 0 ); 1081 } 1082 #endif /* MBEDTLS_CIPHER_MODE_CTR */ 1083 1084 #endif /* !MBEDTLS_AES_ALT */ 1085 1086 #if defined(MBEDTLS_SELF_TEST) 1087 /* 1088 * AES test vectors from: 1089 * 1090 * http://csrc.nist.gov/archive/aes/rijndael/rijndael-vals.zip 1091 */ 1092 static const unsigned char aes_test_ecb_dec[3][16] = 1093 { 1094 { 0x44, 0x41, 0x6A, 0xC2, 0xD1, 0xF5, 0x3C, 0x58, 1095 0x33, 0x03, 0x91, 0x7E, 0x6B, 0xE9, 0xEB, 0xE0 }, 1096 { 0x48, 0xE3, 0x1E, 0x9E, 0x25, 0x67, 0x18, 0xF2, 1097 0x92, 0x29, 0x31, 0x9C, 0x19, 0xF1, 0x5B, 0xA4 }, 1098 { 0x05, 0x8C, 0xCF, 0xFD, 0xBB, 0xCB, 0x38, 0x2D, 1099 0x1F, 0x6F, 0x56, 0x58, 0x5D, 0x8A, 0x4A, 0xDE } 1100 }; 1101 1102 static const unsigned char aes_test_ecb_enc[3][16] = 1103 { 1104 { 0xC3, 0x4C, 0x05, 0x2C, 0xC0, 0xDA, 0x8D, 0x73, 1105 0x45, 0x1A, 0xFE, 0x5F, 0x03, 0xBE, 0x29, 0x7F }, 1106 { 0xF3, 0xF6, 0x75, 0x2A, 0xE8, 0xD7, 0x83, 0x11, 1107 0x38, 0xF0, 0x41, 0x56, 0x06, 0x31, 0xB1, 0x14 }, 1108 { 0x8B, 0x79, 0xEE, 0xCC, 0x93, 0xA0, 0xEE, 0x5D, 1109 0xFF, 0x30, 0xB4, 0xEA, 0x21, 0x63, 0x6D, 0xA4 } 1110 }; 1111 1112 #if defined(MBEDTLS_CIPHER_MODE_CBC) 1113 static const unsigned char aes_test_cbc_dec[3][16] = 1114 { 1115 { 0xFA, 0xCA, 0x37, 0xE0, 0xB0, 0xC8, 0x53, 0x73, 1116 0xDF, 0x70, 0x6E, 0x73, 0xF7, 0xC9, 0xAF, 0x86 }, 1117 { 0x5D, 0xF6, 0x78, 0xDD, 0x17, 0xBA, 0x4E, 0x75, 1118 0xB6, 0x17, 0x68, 0xC6, 0xAD, 0xEF, 0x7C, 0x7B }, 1119 { 0x48, 0x04, 0xE1, 0x81, 0x8F, 0xE6, 0x29, 0x75, 1120 0x19, 0xA3, 0xE8, 0x8C, 0x57, 0x31, 0x04, 0x13 } 1121 }; 1122 1123 static const unsigned char aes_test_cbc_enc[3][16] = 1124 { 1125 { 0x8A, 0x05, 0xFC, 0x5E, 0x09, 0x5A, 0xF4, 0x84, 1126 0x8A, 0x08, 0xD3, 0x28, 0xD3, 0x68, 0x8E, 0x3D }, 1127 { 0x7B, 0xD9, 0x66, 0xD5, 0x3A, 0xD8, 0xC1, 0xBB, 1128 0x85, 0xD2, 0xAD, 0xFA, 0xE8, 0x7B, 0xB1, 0x04 }, 1129 { 0xFE, 0x3C, 0x53, 0x65, 0x3E, 0x2F, 0x45, 0xB5, 1130 0x6F, 0xCD, 0x88, 0xB2, 0xCC, 0x89, 0x8F, 0xF0 } 1131 }; 1132 #endif /* MBEDTLS_CIPHER_MODE_CBC */ 1133 1134 #if defined(MBEDTLS_CIPHER_MODE_CFB) 1135 /* 1136 * AES-CFB128 test vectors from: 1137 * 1138 * http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf 1139 */ 1140 static const unsigned char aes_test_cfb128_key[3][32] = 1141 { 1142 { 0x2B, 0x7E, 0x15, 0x16, 0x28, 0xAE, 0xD2, 0xA6, 1143 0xAB, 0xF7, 0x15, 0x88, 0x09, 0xCF, 0x4F, 0x3C }, 1144 { 0x8E, 0x73, 0xB0, 0xF7, 0xDA, 0x0E, 0x64, 0x52, 1145 0xC8, 0x10, 0xF3, 0x2B, 0x80, 0x90, 0x79, 0xE5, 1146 0x62, 0xF8, 0xEA, 0xD2, 0x52, 0x2C, 0x6B, 0x7B }, 1147 { 0x60, 0x3D, 0xEB, 0x10, 0x15, 0xCA, 0x71, 0xBE, 1148 0x2B, 0x73, 0xAE, 0xF0, 0x85, 0x7D, 0x77, 0x81, 1149 0x1F, 0x35, 0x2C, 0x07, 0x3B, 0x61, 0x08, 0xD7, 1150 0x2D, 0x98, 0x10, 0xA3, 0x09, 0x14, 0xDF, 0xF4 } 1151 }; 1152 1153 static const unsigned char aes_test_cfb128_iv[16] = 1154 { 1155 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 1156 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F 1157 }; 1158 1159 static const unsigned char aes_test_cfb128_pt[64] = 1160 { 1161 0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96, 1162 0xE9, 0x3D, 0x7E, 0x11, 0x73, 0x93, 0x17, 0x2A, 1163 0xAE, 0x2D, 0x8A, 0x57, 0x1E, 0x03, 0xAC, 0x9C, 1164 0x9E, 0xB7, 0x6F, 0xAC, 0x45, 0xAF, 0x8E, 0x51, 1165 0x30, 0xC8, 0x1C, 0x46, 0xA3, 0x5C, 0xE4, 0x11, 1166 0xE5, 0xFB, 0xC1, 0x19, 0x1A, 0x0A, 0x52, 0xEF, 1167 0xF6, 0x9F, 0x24, 0x45, 0xDF, 0x4F, 0x9B, 0x17, 1168 0xAD, 0x2B, 0x41, 0x7B, 0xE6, 0x6C, 0x37, 0x10 1169 }; 1170 1171 static const unsigned char aes_test_cfb128_ct[3][64] = 1172 { 1173 { 0x3B, 0x3F, 0xD9, 0x2E, 0xB7, 0x2D, 0xAD, 0x20, 1174 0x33, 0x34, 0x49, 0xF8, 0xE8, 0x3C, 0xFB, 0x4A, 1175 0xC8, 0xA6, 0x45, 0x37, 0xA0, 0xB3, 0xA9, 0x3F, 1176 0xCD, 0xE3, 0xCD, 0xAD, 0x9F, 0x1C, 0xE5, 0x8B, 1177 0x26, 0x75, 0x1F, 0x67, 0xA3, 0xCB, 0xB1, 0x40, 1178 0xB1, 0x80, 0x8C, 0xF1, 0x87, 0xA4, 0xF4, 0xDF, 1179 0xC0, 0x4B, 0x05, 0x35, 0x7C, 0x5D, 0x1C, 0x0E, 1180 0xEA, 0xC4, 0xC6, 0x6F, 0x9F, 0xF7, 0xF2, 0xE6 }, 1181 { 0xCD, 0xC8, 0x0D, 0x6F, 0xDD, 0xF1, 0x8C, 0xAB, 1182 0x34, 0xC2, 0x59, 0x09, 0xC9, 0x9A, 0x41, 0x74, 1183 0x67, 0xCE, 0x7F, 0x7F, 0x81, 0x17, 0x36, 0x21, 1184 0x96, 0x1A, 0x2B, 0x70, 0x17, 0x1D, 0x3D, 0x7A, 1185 0x2E, 0x1E, 0x8A, 0x1D, 0xD5, 0x9B, 0x88, 0xB1, 1186 0xC8, 0xE6, 0x0F, 0xED, 0x1E, 0xFA, 0xC4, 0xC9, 1187 0xC0, 0x5F, 0x9F, 0x9C, 0xA9, 0x83, 0x4F, 0xA0, 1188 0x42, 0xAE, 0x8F, 0xBA, 0x58, 0x4B, 0x09, 0xFF }, 1189 { 0xDC, 0x7E, 0x84, 0xBF, 0xDA, 0x79, 0x16, 0x4B, 1190 0x7E, 0xCD, 0x84, 0x86, 0x98, 0x5D, 0x38, 0x60, 1191 0x39, 0xFF, 0xED, 0x14, 0x3B, 0x28, 0xB1, 0xC8, 1192 0x32, 0x11, 0x3C, 0x63, 0x31, 0xE5, 0x40, 0x7B, 1193 0xDF, 0x10, 0x13, 0x24, 0x15, 0xE5, 0x4B, 0x92, 1194 0xA1, 0x3E, 0xD0, 0xA8, 0x26, 0x7A, 0xE2, 0xF9, 1195 0x75, 0xA3, 0x85, 0x74, 0x1A, 0xB9, 0xCE, 0xF8, 1196 0x20, 0x31, 0x62, 0x3D, 0x55, 0xB1, 0xE4, 0x71 } 1197 }; 1198 #endif /* MBEDTLS_CIPHER_MODE_CFB */ 1199 1200 #if defined(MBEDTLS_CIPHER_MODE_CTR) 1201 /* 1202 * AES-CTR test vectors from: 1203 * 1204 * http://www.faqs.org/rfcs/rfc3686.html 1205 */ 1206 1207 static const unsigned char aes_test_ctr_key[3][16] = 1208 { 1209 { 0xAE, 0x68, 0x52, 0xF8, 0x12, 0x10, 0x67, 0xCC, 1210 0x4B, 0xF7, 0xA5, 0x76, 0x55, 0x77, 0xF3, 0x9E }, 1211 { 0x7E, 0x24, 0x06, 0x78, 0x17, 0xFA, 0xE0, 0xD7, 1212 0x43, 0xD6, 0xCE, 0x1F, 0x32, 0x53, 0x91, 0x63 }, 1213 { 0x76, 0x91, 0xBE, 0x03, 0x5E, 0x50, 0x20, 0xA8, 1214 0xAC, 0x6E, 0x61, 0x85, 0x29, 0xF9, 0xA0, 0xDC } 1215 }; 1216 1217 static const unsigned char aes_test_ctr_nonce_counter[3][16] = 1218 { 1219 { 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x00, 1220 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 }, 1221 { 0x00, 0x6C, 0xB6, 0xDB, 0xC0, 0x54, 0x3B, 0x59, 1222 0xDA, 0x48, 0xD9, 0x0B, 0x00, 0x00, 0x00, 0x01 }, 1223 { 0x00, 0xE0, 0x01, 0x7B, 0x27, 0x77, 0x7F, 0x3F, 1224 0x4A, 0x17, 0x86, 0xF0, 0x00, 0x00, 0x00, 0x01 } 1225 }; 1226 1227 static const unsigned char aes_test_ctr_pt[3][48] = 1228 { 1229 { 0x53, 0x69, 0x6E, 0x67, 0x6C, 0x65, 0x20, 0x62, 1230 0x6C, 0x6F, 0x63, 0x6B, 0x20, 0x6D, 0x73, 0x67 }, 1231 1232 { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 1233 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 1234 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 1235 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F }, 1236 1237 { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 1238 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 1239 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 1240 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 1241 0x20, 0x21, 0x22, 0x23 } 1242 }; 1243 1244 static const unsigned char aes_test_ctr_ct[3][48] = 1245 { 1246 { 0xE4, 0x09, 0x5D, 0x4F, 0xB7, 0xA7, 0xB3, 0x79, 1247 0x2D, 0x61, 0x75, 0xA3, 0x26, 0x13, 0x11, 0xB8 }, 1248 { 0x51, 0x04, 0xA1, 0x06, 0x16, 0x8A, 0x72, 0xD9, 1249 0x79, 0x0D, 0x41, 0xEE, 0x8E, 0xDA, 0xD3, 0x88, 1250 0xEB, 0x2E, 0x1E, 0xFC, 0x46, 0xDA, 0x57, 0xC8, 1251 0xFC, 0xE6, 0x30, 0xDF, 0x91, 0x41, 0xBE, 0x28 }, 1252 { 0xC1, 0xCF, 0x48, 0xA8, 0x9F, 0x2F, 0xFD, 0xD9, 1253 0xCF, 0x46, 0x52, 0xE9, 0xEF, 0xDB, 0x72, 0xD7, 1254 0x45, 0x40, 0xA4, 0x2B, 0xDE, 0x6D, 0x78, 0x36, 1255 0xD5, 0x9A, 0x5C, 0xEA, 0xAE, 0xF3, 0x10, 0x53, 1256 0x25, 0xB2, 0x07, 0x2F } 1257 }; 1258 1259 static const int aes_test_ctr_len[3] = 1260 { 16, 32, 36 }; 1261 #endif /* MBEDTLS_CIPHER_MODE_CTR */ 1262 1263 /* 1264 * Checkup routine 1265 */ 1266 int mbedtls_aes_self_test( int verbose ) 1267 { 1268 int ret = 0, i, j, u, mode; 1269 unsigned int keybits; 1270 unsigned char key[32]; 1271 unsigned char buf[64]; 1272 const unsigned char *aes_tests; 1273 #if defined(MBEDTLS_CIPHER_MODE_CBC) || defined(MBEDTLS_CIPHER_MODE_CFB) 1274 unsigned char iv[16]; 1275 #endif 1276 #if defined(MBEDTLS_CIPHER_MODE_CBC) 1277 unsigned char prv[16]; 1278 #endif 1279 #if defined(MBEDTLS_CIPHER_MODE_CTR) || defined(MBEDTLS_CIPHER_MODE_CFB) 1280 size_t offset; 1281 #endif 1282 #if defined(MBEDTLS_CIPHER_MODE_CTR) 1283 int len; 1284 unsigned char nonce_counter[16]; 1285 unsigned char stream_block[16]; 1286 #endif 1287 mbedtls_aes_context ctx; 1288 1289 memset( key, 0, 32 ); 1290 mbedtls_aes_init( &ctx ); 1291 1292 /* 1293 * ECB mode 1294 */ 1295 for( i = 0; i < 6; i++ ) 1296 { 1297 u = i >> 1; 1298 keybits = 128 + u * 64; 1299 mode = i & 1; 1300 1301 if( verbose != 0 ) 1302 mbedtls_printf( " AES-ECB-%3d (%s): ", keybits, 1303 ( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" ); 1304 1305 memset( buf, 0, 16 ); 1306 1307 if( mode == MBEDTLS_AES_DECRYPT ) 1308 { 1309 ret = mbedtls_aes_setkey_dec( &ctx, key, keybits ); 1310 aes_tests = aes_test_ecb_dec[u]; 1311 } 1312 else 1313 { 1314 ret = mbedtls_aes_setkey_enc( &ctx, key, keybits ); 1315 aes_tests = aes_test_ecb_enc[u]; 1316 } 1317 1318 /* 1319 * AES-192 is an optional feature that may be unavailable when 1320 * there is an alternative underlying implementation i.e. when 1321 * MBEDTLS_AES_ALT is defined. 1322 */ 1323 if( ret == MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE && keybits == 192 ) 1324 { 1325 mbedtls_printf( "skipped\n" ); 1326 continue; 1327 } 1328 else if( ret != 0 ) 1329 { 1330 goto exit; 1331 } 1332 1333 for( j = 0; j < 10000; j++ ) 1334 { 1335 ret = mbedtls_aes_crypt_ecb( &ctx, mode, buf, buf ); 1336 if( ret != 0 ) 1337 goto exit; 1338 } 1339 1340 if( memcmp( buf, aes_tests, 16 ) != 0 ) 1341 { 1342 ret = 1; 1343 goto exit; 1344 } 1345 1346 if( verbose != 0 ) 1347 mbedtls_printf( "passed\n" ); 1348 } 1349 1350 if( verbose != 0 ) 1351 mbedtls_printf( "\n" ); 1352 1353 #if defined(MBEDTLS_CIPHER_MODE_CBC) 1354 /* 1355 * CBC mode 1356 */ 1357 for( i = 0; i < 6; i++ ) 1358 { 1359 u = i >> 1; 1360 keybits = 128 + u * 64; 1361 mode = i & 1; 1362 1363 if( verbose != 0 ) 1364 mbedtls_printf( " AES-CBC-%3d (%s): ", keybits, 1365 ( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" ); 1366 1367 memset( iv , 0, 16 ); 1368 memset( prv, 0, 16 ); 1369 memset( buf, 0, 16 ); 1370 1371 if( mode == MBEDTLS_AES_DECRYPT ) 1372 { 1373 ret = mbedtls_aes_setkey_dec( &ctx, key, keybits ); 1374 aes_tests = aes_test_cbc_dec[u]; 1375 } 1376 else 1377 { 1378 ret = mbedtls_aes_setkey_enc( &ctx, key, keybits ); 1379 aes_tests = aes_test_cbc_enc[u]; 1380 } 1381 1382 /* 1383 * AES-192 is an optional feature that may be unavailable when 1384 * there is an alternative underlying implementation i.e. when 1385 * MBEDTLS_AES_ALT is defined. 1386 */ 1387 if( ret == MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE && keybits == 192 ) 1388 { 1389 mbedtls_printf( "skipped\n" ); 1390 continue; 1391 } 1392 else if( ret != 0 ) 1393 { 1394 goto exit; 1395 } 1396 1397 for( j = 0; j < 10000; j++ ) 1398 { 1399 if( mode == MBEDTLS_AES_ENCRYPT ) 1400 { 1401 unsigned char tmp[16]; 1402 1403 memcpy( tmp, prv, 16 ); 1404 memcpy( prv, buf, 16 ); 1405 memcpy( buf, tmp, 16 ); 1406 } 1407 1408 ret = mbedtls_aes_crypt_cbc( &ctx, mode, 16, iv, buf, buf ); 1409 if( ret != 0 ) 1410 goto exit; 1411 1412 } 1413 1414 if( memcmp( buf, aes_tests, 16 ) != 0 ) 1415 { 1416 ret = 1; 1417 goto exit; 1418 } 1419 1420 if( verbose != 0 ) 1421 mbedtls_printf( "passed\n" ); 1422 } 1423 1424 if( verbose != 0 ) 1425 mbedtls_printf( "\n" ); 1426 #endif /* MBEDTLS_CIPHER_MODE_CBC */ 1427 1428 #if defined(MBEDTLS_CIPHER_MODE_CFB) 1429 /* 1430 * CFB128 mode 1431 */ 1432 for( i = 0; i < 6; i++ ) 1433 { 1434 u = i >> 1; 1435 keybits = 128 + u * 64; 1436 mode = i & 1; 1437 1438 if( verbose != 0 ) 1439 mbedtls_printf( " AES-CFB128-%3d (%s): ", keybits, 1440 ( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" ); 1441 1442 memcpy( iv, aes_test_cfb128_iv, 16 ); 1443 memcpy( key, aes_test_cfb128_key[u], keybits / 8 ); 1444 1445 offset = 0; 1446 ret = mbedtls_aes_setkey_enc( &ctx, key, keybits ); 1447 /* 1448 * AES-192 is an optional feature that may be unavailable when 1449 * there is an alternative underlying implementation i.e. when 1450 * MBEDTLS_AES_ALT is defined. 1451 */ 1452 if( ret == MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE && keybits == 192 ) 1453 { 1454 mbedtls_printf( "skipped\n" ); 1455 continue; 1456 } 1457 else if( ret != 0 ) 1458 { 1459 goto exit; 1460 } 1461 1462 if( mode == MBEDTLS_AES_DECRYPT ) 1463 { 1464 memcpy( buf, aes_test_cfb128_ct[u], 64 ); 1465 aes_tests = aes_test_cfb128_pt; 1466 } 1467 else 1468 { 1469 memcpy( buf, aes_test_cfb128_pt, 64 ); 1470 aes_tests = aes_test_cfb128_ct[u]; 1471 } 1472 1473 ret = mbedtls_aes_crypt_cfb128( &ctx, mode, 64, &offset, iv, buf, buf ); 1474 if( ret != 0 ) 1475 goto exit; 1476 1477 if( memcmp( buf, aes_tests, 64 ) != 0 ) 1478 { 1479 ret = 1; 1480 goto exit; 1481 } 1482 1483 if( verbose != 0 ) 1484 mbedtls_printf( "passed\n" ); 1485 } 1486 1487 if( verbose != 0 ) 1488 mbedtls_printf( "\n" ); 1489 #endif /* MBEDTLS_CIPHER_MODE_CFB */ 1490 1491 #if defined(MBEDTLS_CIPHER_MODE_CTR) 1492 /* 1493 * CTR mode 1494 */ 1495 for( i = 0; i < 6; i++ ) 1496 { 1497 u = i >> 1; 1498 mode = i & 1; 1499 1500 if( verbose != 0 ) 1501 mbedtls_printf( " AES-CTR-128 (%s): ", 1502 ( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" ); 1503 1504 memcpy( nonce_counter, aes_test_ctr_nonce_counter[u], 16 ); 1505 memcpy( key, aes_test_ctr_key[u], 16 ); 1506 1507 offset = 0; 1508 if( ( ret = mbedtls_aes_setkey_enc( &ctx, key, 128 ) ) != 0 ) 1509 goto exit; 1510 1511 len = aes_test_ctr_len[u]; 1512 1513 if( mode == MBEDTLS_AES_DECRYPT ) 1514 { 1515 memcpy( buf, aes_test_ctr_ct[u], len ); 1516 aes_tests = aes_test_ctr_pt[u]; 1517 } 1518 else 1519 { 1520 memcpy( buf, aes_test_ctr_pt[u], len ); 1521 aes_tests = aes_test_ctr_ct[u]; 1522 } 1523 1524 ret = mbedtls_aes_crypt_ctr( &ctx, len, &offset, nonce_counter, 1525 stream_block, buf, buf ); 1526 if( ret != 0 ) 1527 goto exit; 1528 1529 if( memcmp( buf, aes_tests, len ) != 0 ) 1530 { 1531 ret = 1; 1532 goto exit; 1533 } 1534 1535 if( verbose != 0 ) 1536 mbedtls_printf( "passed\n" ); 1537 } 1538 1539 if( verbose != 0 ) 1540 mbedtls_printf( "\n" ); 1541 #endif /* MBEDTLS_CIPHER_MODE_CTR */ 1542 1543 ret = 0; 1544 1545 exit: 1546 if( ret != 0 && verbose != 0 ) 1547 mbedtls_printf( "failed\n" ); 1548 1549 mbedtls_aes_free( &ctx ); 1550 1551 return( ret ); 1552 } 1553 1554 #endif /* MBEDTLS_SELF_TEST */ 1555 1556 #endif /* MBEDTLS_AES_C */ 1557