xref: /reactos/dll/3rdparty/mbedtls/aes.c (revision 5100859e)
1 /*
2  *  FIPS-197 compliant AES implementation
3  *
4  *  Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
5  *  SPDX-License-Identifier: GPL-2.0
6  *
7  *  This program is free software; you can redistribute it and/or modify
8  *  it under the terms of the GNU General Public License as published by
9  *  the Free Software Foundation; either version 2 of the License, or
10  *  (at your option) any later version.
11  *
12  *  This program is distributed in the hope that it will be useful,
13  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
14  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15  *  GNU General Public License for more details.
16  *
17  *  You should have received a copy of the GNU General Public License along
18  *  with this program; if not, write to the Free Software Foundation, Inc.,
19  *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
20  *
21  *  This file is part of mbed TLS (https://tls.mbed.org)
22  */
23 /*
24  *  The AES block cipher was designed by Vincent Rijmen and Joan Daemen.
25  *
26  *  http://csrc.nist.gov/encryption/aes/rijndael/Rijndael.pdf
27  *  http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf
28  */
29 
30 #if !defined(MBEDTLS_CONFIG_FILE)
31 #include "mbedtls/config.h"
32 #else
33 #include MBEDTLS_CONFIG_FILE
34 #endif
35 
36 #if defined(MBEDTLS_AES_C)
37 
38 #include <string.h>
39 
40 #include "mbedtls/aes.h"
41 #if defined(MBEDTLS_PADLOCK_C)
42 #include "mbedtls/padlock.h"
43 #endif
44 #if defined(MBEDTLS_AESNI_C)
45 #include "mbedtls/aesni.h"
46 #endif
47 
48 #if defined(MBEDTLS_SELF_TEST)
49 #if defined(MBEDTLS_PLATFORM_C)
50 #include "mbedtls/platform.h"
51 #else
52 #include <stdio.h>
53 #define mbedtls_printf printf
54 #endif /* MBEDTLS_PLATFORM_C */
55 #endif /* MBEDTLS_SELF_TEST */
56 
57 #if !defined(MBEDTLS_AES_ALT)
58 
59 /* Implementation that should never be optimized out by the compiler */
60 static void mbedtls_zeroize( void *v, size_t n ) {
61     volatile unsigned char *p = (unsigned char*)v; while( n-- ) *p++ = 0;
62 }
63 
64 /*
65  * 32-bit integer manipulation macros (little endian)
66  */
67 #ifndef GET_UINT32_LE
68 #define GET_UINT32_LE(n,b,i)                            \
69 {                                                       \
70     (n) = ( (uint32_t) (b)[(i)    ]       )             \
71         | ( (uint32_t) (b)[(i) + 1] <<  8 )             \
72         | ( (uint32_t) (b)[(i) + 2] << 16 )             \
73         | ( (uint32_t) (b)[(i) + 3] << 24 );            \
74 }
75 #endif
76 
77 #ifndef PUT_UINT32_LE
78 #define PUT_UINT32_LE(n,b,i)                                    \
79 {                                                               \
80     (b)[(i)    ] = (unsigned char) ( ( (n)       ) & 0xFF );    \
81     (b)[(i) + 1] = (unsigned char) ( ( (n) >>  8 ) & 0xFF );    \
82     (b)[(i) + 2] = (unsigned char) ( ( (n) >> 16 ) & 0xFF );    \
83     (b)[(i) + 3] = (unsigned char) ( ( (n) >> 24 ) & 0xFF );    \
84 }
85 #endif
86 
87 #if defined(MBEDTLS_PADLOCK_C) &&                      \
88     ( defined(MBEDTLS_HAVE_X86) || defined(MBEDTLS_PADLOCK_ALIGN16) )
89 static int aes_padlock_ace = -1;
90 #endif
91 
92 #if defined(MBEDTLS_AES_ROM_TABLES)
93 /*
94  * Forward S-box
95  */
96 static const unsigned char FSb[256] =
97 {
98     0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5,
99     0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76,
100     0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0,
101     0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0,
102     0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC,
103     0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,
104     0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A,
105     0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75,
106     0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0,
107     0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84,
108     0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B,
109     0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,
110     0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85,
111     0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8,
112     0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5,
113     0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2,
114     0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17,
115     0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73,
116     0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88,
117     0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB,
118     0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C,
119     0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79,
120     0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9,
121     0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08,
122     0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6,
123     0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A,
124     0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E,
125     0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E,
126     0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94,
127     0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,
128     0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68,
129     0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16
130 };
131 
132 /*
133  * Forward tables
134  */
135 #define FT \
136 \
137     V(A5,63,63,C6), V(84,7C,7C,F8), V(99,77,77,EE), V(8D,7B,7B,F6), \
138     V(0D,F2,F2,FF), V(BD,6B,6B,D6), V(B1,6F,6F,DE), V(54,C5,C5,91), \
139     V(50,30,30,60), V(03,01,01,02), V(A9,67,67,CE), V(7D,2B,2B,56), \
140     V(19,FE,FE,E7), V(62,D7,D7,B5), V(E6,AB,AB,4D), V(9A,76,76,EC), \
141     V(45,CA,CA,8F), V(9D,82,82,1F), V(40,C9,C9,89), V(87,7D,7D,FA), \
142     V(15,FA,FA,EF), V(EB,59,59,B2), V(C9,47,47,8E), V(0B,F0,F0,FB), \
143     V(EC,AD,AD,41), V(67,D4,D4,B3), V(FD,A2,A2,5F), V(EA,AF,AF,45), \
144     V(BF,9C,9C,23), V(F7,A4,A4,53), V(96,72,72,E4), V(5B,C0,C0,9B), \
145     V(C2,B7,B7,75), V(1C,FD,FD,E1), V(AE,93,93,3D), V(6A,26,26,4C), \
146     V(5A,36,36,6C), V(41,3F,3F,7E), V(02,F7,F7,F5), V(4F,CC,CC,83), \
147     V(5C,34,34,68), V(F4,A5,A5,51), V(34,E5,E5,D1), V(08,F1,F1,F9), \
148     V(93,71,71,E2), V(73,D8,D8,AB), V(53,31,31,62), V(3F,15,15,2A), \
149     V(0C,04,04,08), V(52,C7,C7,95), V(65,23,23,46), V(5E,C3,C3,9D), \
150     V(28,18,18,30), V(A1,96,96,37), V(0F,05,05,0A), V(B5,9A,9A,2F), \
151     V(09,07,07,0E), V(36,12,12,24), V(9B,80,80,1B), V(3D,E2,E2,DF), \
152     V(26,EB,EB,CD), V(69,27,27,4E), V(CD,B2,B2,7F), V(9F,75,75,EA), \
153     V(1B,09,09,12), V(9E,83,83,1D), V(74,2C,2C,58), V(2E,1A,1A,34), \
154     V(2D,1B,1B,36), V(B2,6E,6E,DC), V(EE,5A,5A,B4), V(FB,A0,A0,5B), \
155     V(F6,52,52,A4), V(4D,3B,3B,76), V(61,D6,D6,B7), V(CE,B3,B3,7D), \
156     V(7B,29,29,52), V(3E,E3,E3,DD), V(71,2F,2F,5E), V(97,84,84,13), \
157     V(F5,53,53,A6), V(68,D1,D1,B9), V(00,00,00,00), V(2C,ED,ED,C1), \
158     V(60,20,20,40), V(1F,FC,FC,E3), V(C8,B1,B1,79), V(ED,5B,5B,B6), \
159     V(BE,6A,6A,D4), V(46,CB,CB,8D), V(D9,BE,BE,67), V(4B,39,39,72), \
160     V(DE,4A,4A,94), V(D4,4C,4C,98), V(E8,58,58,B0), V(4A,CF,CF,85), \
161     V(6B,D0,D0,BB), V(2A,EF,EF,C5), V(E5,AA,AA,4F), V(16,FB,FB,ED), \
162     V(C5,43,43,86), V(D7,4D,4D,9A), V(55,33,33,66), V(94,85,85,11), \
163     V(CF,45,45,8A), V(10,F9,F9,E9), V(06,02,02,04), V(81,7F,7F,FE), \
164     V(F0,50,50,A0), V(44,3C,3C,78), V(BA,9F,9F,25), V(E3,A8,A8,4B), \
165     V(F3,51,51,A2), V(FE,A3,A3,5D), V(C0,40,40,80), V(8A,8F,8F,05), \
166     V(AD,92,92,3F), V(BC,9D,9D,21), V(48,38,38,70), V(04,F5,F5,F1), \
167     V(DF,BC,BC,63), V(C1,B6,B6,77), V(75,DA,DA,AF), V(63,21,21,42), \
168     V(30,10,10,20), V(1A,FF,FF,E5), V(0E,F3,F3,FD), V(6D,D2,D2,BF), \
169     V(4C,CD,CD,81), V(14,0C,0C,18), V(35,13,13,26), V(2F,EC,EC,C3), \
170     V(E1,5F,5F,BE), V(A2,97,97,35), V(CC,44,44,88), V(39,17,17,2E), \
171     V(57,C4,C4,93), V(F2,A7,A7,55), V(82,7E,7E,FC), V(47,3D,3D,7A), \
172     V(AC,64,64,C8), V(E7,5D,5D,BA), V(2B,19,19,32), V(95,73,73,E6), \
173     V(A0,60,60,C0), V(98,81,81,19), V(D1,4F,4F,9E), V(7F,DC,DC,A3), \
174     V(66,22,22,44), V(7E,2A,2A,54), V(AB,90,90,3B), V(83,88,88,0B), \
175     V(CA,46,46,8C), V(29,EE,EE,C7), V(D3,B8,B8,6B), V(3C,14,14,28), \
176     V(79,DE,DE,A7), V(E2,5E,5E,BC), V(1D,0B,0B,16), V(76,DB,DB,AD), \
177     V(3B,E0,E0,DB), V(56,32,32,64), V(4E,3A,3A,74), V(1E,0A,0A,14), \
178     V(DB,49,49,92), V(0A,06,06,0C), V(6C,24,24,48), V(E4,5C,5C,B8), \
179     V(5D,C2,C2,9F), V(6E,D3,D3,BD), V(EF,AC,AC,43), V(A6,62,62,C4), \
180     V(A8,91,91,39), V(A4,95,95,31), V(37,E4,E4,D3), V(8B,79,79,F2), \
181     V(32,E7,E7,D5), V(43,C8,C8,8B), V(59,37,37,6E), V(B7,6D,6D,DA), \
182     V(8C,8D,8D,01), V(64,D5,D5,B1), V(D2,4E,4E,9C), V(E0,A9,A9,49), \
183     V(B4,6C,6C,D8), V(FA,56,56,AC), V(07,F4,F4,F3), V(25,EA,EA,CF), \
184     V(AF,65,65,CA), V(8E,7A,7A,F4), V(E9,AE,AE,47), V(18,08,08,10), \
185     V(D5,BA,BA,6F), V(88,78,78,F0), V(6F,25,25,4A), V(72,2E,2E,5C), \
186     V(24,1C,1C,38), V(F1,A6,A6,57), V(C7,B4,B4,73), V(51,C6,C6,97), \
187     V(23,E8,E8,CB), V(7C,DD,DD,A1), V(9C,74,74,E8), V(21,1F,1F,3E), \
188     V(DD,4B,4B,96), V(DC,BD,BD,61), V(86,8B,8B,0D), V(85,8A,8A,0F), \
189     V(90,70,70,E0), V(42,3E,3E,7C), V(C4,B5,B5,71), V(AA,66,66,CC), \
190     V(D8,48,48,90), V(05,03,03,06), V(01,F6,F6,F7), V(12,0E,0E,1C), \
191     V(A3,61,61,C2), V(5F,35,35,6A), V(F9,57,57,AE), V(D0,B9,B9,69), \
192     V(91,86,86,17), V(58,C1,C1,99), V(27,1D,1D,3A), V(B9,9E,9E,27), \
193     V(38,E1,E1,D9), V(13,F8,F8,EB), V(B3,98,98,2B), V(33,11,11,22), \
194     V(BB,69,69,D2), V(70,D9,D9,A9), V(89,8E,8E,07), V(A7,94,94,33), \
195     V(B6,9B,9B,2D), V(22,1E,1E,3C), V(92,87,87,15), V(20,E9,E9,C9), \
196     V(49,CE,CE,87), V(FF,55,55,AA), V(78,28,28,50), V(7A,DF,DF,A5), \
197     V(8F,8C,8C,03), V(F8,A1,A1,59), V(80,89,89,09), V(17,0D,0D,1A), \
198     V(DA,BF,BF,65), V(31,E6,E6,D7), V(C6,42,42,84), V(B8,68,68,D0), \
199     V(C3,41,41,82), V(B0,99,99,29), V(77,2D,2D,5A), V(11,0F,0F,1E), \
200     V(CB,B0,B0,7B), V(FC,54,54,A8), V(D6,BB,BB,6D), V(3A,16,16,2C)
201 
202 #define V(a,b,c,d) 0x##a##b##c##d
203 static const uint32_t FT0[256] = { FT };
204 #undef V
205 
206 #define V(a,b,c,d) 0x##b##c##d##a
207 static const uint32_t FT1[256] = { FT };
208 #undef V
209 
210 #define V(a,b,c,d) 0x##c##d##a##b
211 static const uint32_t FT2[256] = { FT };
212 #undef V
213 
214 #define V(a,b,c,d) 0x##d##a##b##c
215 static const uint32_t FT3[256] = { FT };
216 #undef V
217 
218 #undef FT
219 
220 /*
221  * Reverse S-box
222  */
223 static const unsigned char RSb[256] =
224 {
225     0x52, 0x09, 0x6A, 0xD5, 0x30, 0x36, 0xA5, 0x38,
226     0xBF, 0x40, 0xA3, 0x9E, 0x81, 0xF3, 0xD7, 0xFB,
227     0x7C, 0xE3, 0x39, 0x82, 0x9B, 0x2F, 0xFF, 0x87,
228     0x34, 0x8E, 0x43, 0x44, 0xC4, 0xDE, 0xE9, 0xCB,
229     0x54, 0x7B, 0x94, 0x32, 0xA6, 0xC2, 0x23, 0x3D,
230     0xEE, 0x4C, 0x95, 0x0B, 0x42, 0xFA, 0xC3, 0x4E,
231     0x08, 0x2E, 0xA1, 0x66, 0x28, 0xD9, 0x24, 0xB2,
232     0x76, 0x5B, 0xA2, 0x49, 0x6D, 0x8B, 0xD1, 0x25,
233     0x72, 0xF8, 0xF6, 0x64, 0x86, 0x68, 0x98, 0x16,
234     0xD4, 0xA4, 0x5C, 0xCC, 0x5D, 0x65, 0xB6, 0x92,
235     0x6C, 0x70, 0x48, 0x50, 0xFD, 0xED, 0xB9, 0xDA,
236     0x5E, 0x15, 0x46, 0x57, 0xA7, 0x8D, 0x9D, 0x84,
237     0x90, 0xD8, 0xAB, 0x00, 0x8C, 0xBC, 0xD3, 0x0A,
238     0xF7, 0xE4, 0x58, 0x05, 0xB8, 0xB3, 0x45, 0x06,
239     0xD0, 0x2C, 0x1E, 0x8F, 0xCA, 0x3F, 0x0F, 0x02,
240     0xC1, 0xAF, 0xBD, 0x03, 0x01, 0x13, 0x8A, 0x6B,
241     0x3A, 0x91, 0x11, 0x41, 0x4F, 0x67, 0xDC, 0xEA,
242     0x97, 0xF2, 0xCF, 0xCE, 0xF0, 0xB4, 0xE6, 0x73,
243     0x96, 0xAC, 0x74, 0x22, 0xE7, 0xAD, 0x35, 0x85,
244     0xE2, 0xF9, 0x37, 0xE8, 0x1C, 0x75, 0xDF, 0x6E,
245     0x47, 0xF1, 0x1A, 0x71, 0x1D, 0x29, 0xC5, 0x89,
246     0x6F, 0xB7, 0x62, 0x0E, 0xAA, 0x18, 0xBE, 0x1B,
247     0xFC, 0x56, 0x3E, 0x4B, 0xC6, 0xD2, 0x79, 0x20,
248     0x9A, 0xDB, 0xC0, 0xFE, 0x78, 0xCD, 0x5A, 0xF4,
249     0x1F, 0xDD, 0xA8, 0x33, 0x88, 0x07, 0xC7, 0x31,
250     0xB1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xEC, 0x5F,
251     0x60, 0x51, 0x7F, 0xA9, 0x19, 0xB5, 0x4A, 0x0D,
252     0x2D, 0xE5, 0x7A, 0x9F, 0x93, 0xC9, 0x9C, 0xEF,
253     0xA0, 0xE0, 0x3B, 0x4D, 0xAE, 0x2A, 0xF5, 0xB0,
254     0xC8, 0xEB, 0xBB, 0x3C, 0x83, 0x53, 0x99, 0x61,
255     0x17, 0x2B, 0x04, 0x7E, 0xBA, 0x77, 0xD6, 0x26,
256     0xE1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0C, 0x7D
257 };
258 
259 /*
260  * Reverse tables
261  */
262 #define RT \
263 \
264     V(50,A7,F4,51), V(53,65,41,7E), V(C3,A4,17,1A), V(96,5E,27,3A), \
265     V(CB,6B,AB,3B), V(F1,45,9D,1F), V(AB,58,FA,AC), V(93,03,E3,4B), \
266     V(55,FA,30,20), V(F6,6D,76,AD), V(91,76,CC,88), V(25,4C,02,F5), \
267     V(FC,D7,E5,4F), V(D7,CB,2A,C5), V(80,44,35,26), V(8F,A3,62,B5), \
268     V(49,5A,B1,DE), V(67,1B,BA,25), V(98,0E,EA,45), V(E1,C0,FE,5D), \
269     V(02,75,2F,C3), V(12,F0,4C,81), V(A3,97,46,8D), V(C6,F9,D3,6B), \
270     V(E7,5F,8F,03), V(95,9C,92,15), V(EB,7A,6D,BF), V(DA,59,52,95), \
271     V(2D,83,BE,D4), V(D3,21,74,58), V(29,69,E0,49), V(44,C8,C9,8E), \
272     V(6A,89,C2,75), V(78,79,8E,F4), V(6B,3E,58,99), V(DD,71,B9,27), \
273     V(B6,4F,E1,BE), V(17,AD,88,F0), V(66,AC,20,C9), V(B4,3A,CE,7D), \
274     V(18,4A,DF,63), V(82,31,1A,E5), V(60,33,51,97), V(45,7F,53,62), \
275     V(E0,77,64,B1), V(84,AE,6B,BB), V(1C,A0,81,FE), V(94,2B,08,F9), \
276     V(58,68,48,70), V(19,FD,45,8F), V(87,6C,DE,94), V(B7,F8,7B,52), \
277     V(23,D3,73,AB), V(E2,02,4B,72), V(57,8F,1F,E3), V(2A,AB,55,66), \
278     V(07,28,EB,B2), V(03,C2,B5,2F), V(9A,7B,C5,86), V(A5,08,37,D3), \
279     V(F2,87,28,30), V(B2,A5,BF,23), V(BA,6A,03,02), V(5C,82,16,ED), \
280     V(2B,1C,CF,8A), V(92,B4,79,A7), V(F0,F2,07,F3), V(A1,E2,69,4E), \
281     V(CD,F4,DA,65), V(D5,BE,05,06), V(1F,62,34,D1), V(8A,FE,A6,C4), \
282     V(9D,53,2E,34), V(A0,55,F3,A2), V(32,E1,8A,05), V(75,EB,F6,A4), \
283     V(39,EC,83,0B), V(AA,EF,60,40), V(06,9F,71,5E), V(51,10,6E,BD), \
284     V(F9,8A,21,3E), V(3D,06,DD,96), V(AE,05,3E,DD), V(46,BD,E6,4D), \
285     V(B5,8D,54,91), V(05,5D,C4,71), V(6F,D4,06,04), V(FF,15,50,60), \
286     V(24,FB,98,19), V(97,E9,BD,D6), V(CC,43,40,89), V(77,9E,D9,67), \
287     V(BD,42,E8,B0), V(88,8B,89,07), V(38,5B,19,E7), V(DB,EE,C8,79), \
288     V(47,0A,7C,A1), V(E9,0F,42,7C), V(C9,1E,84,F8), V(00,00,00,00), \
289     V(83,86,80,09), V(48,ED,2B,32), V(AC,70,11,1E), V(4E,72,5A,6C), \
290     V(FB,FF,0E,FD), V(56,38,85,0F), V(1E,D5,AE,3D), V(27,39,2D,36), \
291     V(64,D9,0F,0A), V(21,A6,5C,68), V(D1,54,5B,9B), V(3A,2E,36,24), \
292     V(B1,67,0A,0C), V(0F,E7,57,93), V(D2,96,EE,B4), V(9E,91,9B,1B), \
293     V(4F,C5,C0,80), V(A2,20,DC,61), V(69,4B,77,5A), V(16,1A,12,1C), \
294     V(0A,BA,93,E2), V(E5,2A,A0,C0), V(43,E0,22,3C), V(1D,17,1B,12), \
295     V(0B,0D,09,0E), V(AD,C7,8B,F2), V(B9,A8,B6,2D), V(C8,A9,1E,14), \
296     V(85,19,F1,57), V(4C,07,75,AF), V(BB,DD,99,EE), V(FD,60,7F,A3), \
297     V(9F,26,01,F7), V(BC,F5,72,5C), V(C5,3B,66,44), V(34,7E,FB,5B), \
298     V(76,29,43,8B), V(DC,C6,23,CB), V(68,FC,ED,B6), V(63,F1,E4,B8), \
299     V(CA,DC,31,D7), V(10,85,63,42), V(40,22,97,13), V(20,11,C6,84), \
300     V(7D,24,4A,85), V(F8,3D,BB,D2), V(11,32,F9,AE), V(6D,A1,29,C7), \
301     V(4B,2F,9E,1D), V(F3,30,B2,DC), V(EC,52,86,0D), V(D0,E3,C1,77), \
302     V(6C,16,B3,2B), V(99,B9,70,A9), V(FA,48,94,11), V(22,64,E9,47), \
303     V(C4,8C,FC,A8), V(1A,3F,F0,A0), V(D8,2C,7D,56), V(EF,90,33,22), \
304     V(C7,4E,49,87), V(C1,D1,38,D9), V(FE,A2,CA,8C), V(36,0B,D4,98), \
305     V(CF,81,F5,A6), V(28,DE,7A,A5), V(26,8E,B7,DA), V(A4,BF,AD,3F), \
306     V(E4,9D,3A,2C), V(0D,92,78,50), V(9B,CC,5F,6A), V(62,46,7E,54), \
307     V(C2,13,8D,F6), V(E8,B8,D8,90), V(5E,F7,39,2E), V(F5,AF,C3,82), \
308     V(BE,80,5D,9F), V(7C,93,D0,69), V(A9,2D,D5,6F), V(B3,12,25,CF), \
309     V(3B,99,AC,C8), V(A7,7D,18,10), V(6E,63,9C,E8), V(7B,BB,3B,DB), \
310     V(09,78,26,CD), V(F4,18,59,6E), V(01,B7,9A,EC), V(A8,9A,4F,83), \
311     V(65,6E,95,E6), V(7E,E6,FF,AA), V(08,CF,BC,21), V(E6,E8,15,EF), \
312     V(D9,9B,E7,BA), V(CE,36,6F,4A), V(D4,09,9F,EA), V(D6,7C,B0,29), \
313     V(AF,B2,A4,31), V(31,23,3F,2A), V(30,94,A5,C6), V(C0,66,A2,35), \
314     V(37,BC,4E,74), V(A6,CA,82,FC), V(B0,D0,90,E0), V(15,D8,A7,33), \
315     V(4A,98,04,F1), V(F7,DA,EC,41), V(0E,50,CD,7F), V(2F,F6,91,17), \
316     V(8D,D6,4D,76), V(4D,B0,EF,43), V(54,4D,AA,CC), V(DF,04,96,E4), \
317     V(E3,B5,D1,9E), V(1B,88,6A,4C), V(B8,1F,2C,C1), V(7F,51,65,46), \
318     V(04,EA,5E,9D), V(5D,35,8C,01), V(73,74,87,FA), V(2E,41,0B,FB), \
319     V(5A,1D,67,B3), V(52,D2,DB,92), V(33,56,10,E9), V(13,47,D6,6D), \
320     V(8C,61,D7,9A), V(7A,0C,A1,37), V(8E,14,F8,59), V(89,3C,13,EB), \
321     V(EE,27,A9,CE), V(35,C9,61,B7), V(ED,E5,1C,E1), V(3C,B1,47,7A), \
322     V(59,DF,D2,9C), V(3F,73,F2,55), V(79,CE,14,18), V(BF,37,C7,73), \
323     V(EA,CD,F7,53), V(5B,AA,FD,5F), V(14,6F,3D,DF), V(86,DB,44,78), \
324     V(81,F3,AF,CA), V(3E,C4,68,B9), V(2C,34,24,38), V(5F,40,A3,C2), \
325     V(72,C3,1D,16), V(0C,25,E2,BC), V(8B,49,3C,28), V(41,95,0D,FF), \
326     V(71,01,A8,39), V(DE,B3,0C,08), V(9C,E4,B4,D8), V(90,C1,56,64), \
327     V(61,84,CB,7B), V(70,B6,32,D5), V(74,5C,6C,48), V(42,57,B8,D0)
328 
329 #define V(a,b,c,d) 0x##a##b##c##d
330 static const uint32_t RT0[256] = { RT };
331 #undef V
332 
333 #define V(a,b,c,d) 0x##b##c##d##a
334 static const uint32_t RT1[256] = { RT };
335 #undef V
336 
337 #define V(a,b,c,d) 0x##c##d##a##b
338 static const uint32_t RT2[256] = { RT };
339 #undef V
340 
341 #define V(a,b,c,d) 0x##d##a##b##c
342 static const uint32_t RT3[256] = { RT };
343 #undef V
344 
345 #undef RT
346 
347 /*
348  * Round constants
349  */
350 static const uint32_t RCON[10] =
351 {
352     0x00000001, 0x00000002, 0x00000004, 0x00000008,
353     0x00000010, 0x00000020, 0x00000040, 0x00000080,
354     0x0000001B, 0x00000036
355 };
356 
357 #else /* MBEDTLS_AES_ROM_TABLES */
358 
359 /*
360  * Forward S-box & tables
361  */
362 static unsigned char FSb[256];
363 static uint32_t FT0[256];
364 static uint32_t FT1[256];
365 static uint32_t FT2[256];
366 static uint32_t FT3[256];
367 
368 /*
369  * Reverse S-box & tables
370  */
371 static unsigned char RSb[256];
372 static uint32_t RT0[256];
373 static uint32_t RT1[256];
374 static uint32_t RT2[256];
375 static uint32_t RT3[256];
376 
377 /*
378  * Round constants
379  */
380 static uint32_t RCON[10];
381 
382 /*
383  * Tables generation code
384  */
385 #define ROTL8(x) ( ( x << 8 ) & 0xFFFFFFFF ) | ( x >> 24 )
386 #define XTIME(x) ( ( x << 1 ) ^ ( ( x & 0x80 ) ? 0x1B : 0x00 ) )
387 #define MUL(x,y) ( ( x && y ) ? pow[(log[x]+log[y]) % 255] : 0 )
388 
389 static int aes_init_done = 0;
390 
391 static void aes_gen_tables( void )
392 {
393     int i, x, y, z;
394     int pow[256];
395     int log[256];
396 
397     /*
398      * compute pow and log tables over GF(2^8)
399      */
400     for( i = 0, x = 1; i < 256; i++ )
401     {
402         pow[i] = x;
403         log[x] = i;
404         x = ( x ^ XTIME( x ) ) & 0xFF;
405     }
406 
407     /*
408      * calculate the round constants
409      */
410     for( i = 0, x = 1; i < 10; i++ )
411     {
412         RCON[i] = (uint32_t) x;
413         x = XTIME( x ) & 0xFF;
414     }
415 
416     /*
417      * generate the forward and reverse S-boxes
418      */
419     FSb[0x00] = 0x63;
420     RSb[0x63] = 0x00;
421 
422     for( i = 1; i < 256; i++ )
423     {
424         x = pow[255 - log[i]];
425 
426         y  = x; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF;
427         x ^= y; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF;
428         x ^= y; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF;
429         x ^= y; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF;
430         x ^= y ^ 0x63;
431 
432         FSb[i] = (unsigned char) x;
433         RSb[x] = (unsigned char) i;
434     }
435 
436     /*
437      * generate the forward and reverse tables
438      */
439     for( i = 0; i < 256; i++ )
440     {
441         x = FSb[i];
442         y = XTIME( x ) & 0xFF;
443         z =  ( y ^ x ) & 0xFF;
444 
445         FT0[i] = ( (uint32_t) y       ) ^
446                  ( (uint32_t) x <<  8 ) ^
447                  ( (uint32_t) x << 16 ) ^
448                  ( (uint32_t) z << 24 );
449 
450         FT1[i] = ROTL8( FT0[i] );
451         FT2[i] = ROTL8( FT1[i] );
452         FT3[i] = ROTL8( FT2[i] );
453 
454         x = RSb[i];
455 
456         RT0[i] = ( (uint32_t) MUL( 0x0E, x )       ) ^
457                  ( (uint32_t) MUL( 0x09, x ) <<  8 ) ^
458                  ( (uint32_t) MUL( 0x0D, x ) << 16 ) ^
459                  ( (uint32_t) MUL( 0x0B, x ) << 24 );
460 
461         RT1[i] = ROTL8( RT0[i] );
462         RT2[i] = ROTL8( RT1[i] );
463         RT3[i] = ROTL8( RT2[i] );
464     }
465 }
466 
467 #endif /* MBEDTLS_AES_ROM_TABLES */
468 
469 void mbedtls_aes_init( mbedtls_aes_context *ctx )
470 {
471     memset( ctx, 0, sizeof( mbedtls_aes_context ) );
472 }
473 
474 void mbedtls_aes_free( mbedtls_aes_context *ctx )
475 {
476     if( ctx == NULL )
477         return;
478 
479     mbedtls_zeroize( ctx, sizeof( mbedtls_aes_context ) );
480 }
481 
482 /*
483  * AES key schedule (encryption)
484  */
485 #if !defined(MBEDTLS_AES_SETKEY_ENC_ALT)
486 int mbedtls_aes_setkey_enc( mbedtls_aes_context *ctx, const unsigned char *key,
487                     unsigned int keybits )
488 {
489     unsigned int i;
490     uint32_t *RK;
491 
492 #if !defined(MBEDTLS_AES_ROM_TABLES)
493     if( aes_init_done == 0 )
494     {
495         aes_gen_tables();
496         aes_init_done = 1;
497 
498     }
499 #endif
500 
501     switch( keybits )
502     {
503         case 128: ctx->nr = 10; break;
504         case 192: ctx->nr = 12; break;
505         case 256: ctx->nr = 14; break;
506         default : return( MBEDTLS_ERR_AES_INVALID_KEY_LENGTH );
507     }
508 
509 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_PADLOCK_ALIGN16)
510     if( aes_padlock_ace == -1 )
511         aes_padlock_ace = mbedtls_padlock_has_support( MBEDTLS_PADLOCK_ACE );
512 
513     if( aes_padlock_ace )
514         ctx->rk = RK = MBEDTLS_PADLOCK_ALIGN16( ctx->buf );
515     else
516 #endif
517     ctx->rk = RK = ctx->buf;
518 
519 #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64)
520     if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) )
521         return( mbedtls_aesni_setkey_enc( (unsigned char *) ctx->rk, key, keybits ) );
522 #endif
523 
524     for( i = 0; i < ( keybits >> 5 ); i++ )
525     {
526         GET_UINT32_LE( RK[i], key, i << 2 );
527     }
528 
529     switch( ctx->nr )
530     {
531         case 10:
532 
533             for( i = 0; i < 10; i++, RK += 4 )
534             {
535                 RK[4]  = RK[0] ^ RCON[i] ^
536                 ( (uint32_t) FSb[ ( RK[3] >>  8 ) & 0xFF ]       ) ^
537                 ( (uint32_t) FSb[ ( RK[3] >> 16 ) & 0xFF ] <<  8 ) ^
538                 ( (uint32_t) FSb[ ( RK[3] >> 24 ) & 0xFF ] << 16 ) ^
539                 ( (uint32_t) FSb[ ( RK[3]       ) & 0xFF ] << 24 );
540 
541                 RK[5]  = RK[1] ^ RK[4];
542                 RK[6]  = RK[2] ^ RK[5];
543                 RK[7]  = RK[3] ^ RK[6];
544             }
545             break;
546 
547         case 12:
548 
549             for( i = 0; i < 8; i++, RK += 6 )
550             {
551                 RK[6]  = RK[0] ^ RCON[i] ^
552                 ( (uint32_t) FSb[ ( RK[5] >>  8 ) & 0xFF ]       ) ^
553                 ( (uint32_t) FSb[ ( RK[5] >> 16 ) & 0xFF ] <<  8 ) ^
554                 ( (uint32_t) FSb[ ( RK[5] >> 24 ) & 0xFF ] << 16 ) ^
555                 ( (uint32_t) FSb[ ( RK[5]       ) & 0xFF ] << 24 );
556 
557                 RK[7]  = RK[1] ^ RK[6];
558                 RK[8]  = RK[2] ^ RK[7];
559                 RK[9]  = RK[3] ^ RK[8];
560                 RK[10] = RK[4] ^ RK[9];
561                 RK[11] = RK[5] ^ RK[10];
562             }
563             break;
564 
565         case 14:
566 
567             for( i = 0; i < 7; i++, RK += 8 )
568             {
569                 RK[8]  = RK[0] ^ RCON[i] ^
570                 ( (uint32_t) FSb[ ( RK[7] >>  8 ) & 0xFF ]       ) ^
571                 ( (uint32_t) FSb[ ( RK[7] >> 16 ) & 0xFF ] <<  8 ) ^
572                 ( (uint32_t) FSb[ ( RK[7] >> 24 ) & 0xFF ] << 16 ) ^
573                 ( (uint32_t) FSb[ ( RK[7]       ) & 0xFF ] << 24 );
574 
575                 RK[9]  = RK[1] ^ RK[8];
576                 RK[10] = RK[2] ^ RK[9];
577                 RK[11] = RK[3] ^ RK[10];
578 
579                 RK[12] = RK[4] ^
580                 ( (uint32_t) FSb[ ( RK[11]       ) & 0xFF ]       ) ^
581                 ( (uint32_t) FSb[ ( RK[11] >>  8 ) & 0xFF ] <<  8 ) ^
582                 ( (uint32_t) FSb[ ( RK[11] >> 16 ) & 0xFF ] << 16 ) ^
583                 ( (uint32_t) FSb[ ( RK[11] >> 24 ) & 0xFF ] << 24 );
584 
585                 RK[13] = RK[5] ^ RK[12];
586                 RK[14] = RK[6] ^ RK[13];
587                 RK[15] = RK[7] ^ RK[14];
588             }
589             break;
590     }
591 
592     return( 0 );
593 }
594 #endif /* !MBEDTLS_AES_SETKEY_ENC_ALT */
595 
596 /*
597  * AES key schedule (decryption)
598  */
599 #if !defined(MBEDTLS_AES_SETKEY_DEC_ALT)
600 int mbedtls_aes_setkey_dec( mbedtls_aes_context *ctx, const unsigned char *key,
601                     unsigned int keybits )
602 {
603     int i, j, ret;
604     mbedtls_aes_context cty;
605     uint32_t *RK;
606     uint32_t *SK;
607 
608     mbedtls_aes_init( &cty );
609 
610 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_PADLOCK_ALIGN16)
611     if( aes_padlock_ace == -1 )
612         aes_padlock_ace = mbedtls_padlock_has_support( MBEDTLS_PADLOCK_ACE );
613 
614     if( aes_padlock_ace )
615         ctx->rk = RK = MBEDTLS_PADLOCK_ALIGN16( ctx->buf );
616     else
617 #endif
618     ctx->rk = RK = ctx->buf;
619 
620     /* Also checks keybits */
621     if( ( ret = mbedtls_aes_setkey_enc( &cty, key, keybits ) ) != 0 )
622         goto exit;
623 
624     ctx->nr = cty.nr;
625 
626 #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64)
627     if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) )
628     {
629         mbedtls_aesni_inverse_key( (unsigned char *) ctx->rk,
630                            (const unsigned char *) cty.rk, ctx->nr );
631         goto exit;
632     }
633 #endif
634 
635     SK = cty.rk + cty.nr * 4;
636 
637     *RK++ = *SK++;
638     *RK++ = *SK++;
639     *RK++ = *SK++;
640     *RK++ = *SK++;
641 
642     for( i = ctx->nr - 1, SK -= 8; i > 0; i--, SK -= 8 )
643     {
644         for( j = 0; j < 4; j++, SK++ )
645         {
646             *RK++ = RT0[ FSb[ ( *SK       ) & 0xFF ] ] ^
647                     RT1[ FSb[ ( *SK >>  8 ) & 0xFF ] ] ^
648                     RT2[ FSb[ ( *SK >> 16 ) & 0xFF ] ] ^
649                     RT3[ FSb[ ( *SK >> 24 ) & 0xFF ] ];
650         }
651     }
652 
653     *RK++ = *SK++;
654     *RK++ = *SK++;
655     *RK++ = *SK++;
656     *RK++ = *SK++;
657 
658 exit:
659     mbedtls_aes_free( &cty );
660 
661     return( ret );
662 }
663 #endif /* !MBEDTLS_AES_SETKEY_DEC_ALT */
664 
665 #define AES_FROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3)     \
666 {                                               \
667     X0 = *RK++ ^ FT0[ ( Y0       ) & 0xFF ] ^   \
668                  FT1[ ( Y1 >>  8 ) & 0xFF ] ^   \
669                  FT2[ ( Y2 >> 16 ) & 0xFF ] ^   \
670                  FT3[ ( Y3 >> 24 ) & 0xFF ];    \
671                                                 \
672     X1 = *RK++ ^ FT0[ ( Y1       ) & 0xFF ] ^   \
673                  FT1[ ( Y2 >>  8 ) & 0xFF ] ^   \
674                  FT2[ ( Y3 >> 16 ) & 0xFF ] ^   \
675                  FT3[ ( Y0 >> 24 ) & 0xFF ];    \
676                                                 \
677     X2 = *RK++ ^ FT0[ ( Y2       ) & 0xFF ] ^   \
678                  FT1[ ( Y3 >>  8 ) & 0xFF ] ^   \
679                  FT2[ ( Y0 >> 16 ) & 0xFF ] ^   \
680                  FT3[ ( Y1 >> 24 ) & 0xFF ];    \
681                                                 \
682     X3 = *RK++ ^ FT0[ ( Y3       ) & 0xFF ] ^   \
683                  FT1[ ( Y0 >>  8 ) & 0xFF ] ^   \
684                  FT2[ ( Y1 >> 16 ) & 0xFF ] ^   \
685                  FT3[ ( Y2 >> 24 ) & 0xFF ];    \
686 }
687 
688 #define AES_RROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3)     \
689 {                                               \
690     X0 = *RK++ ^ RT0[ ( Y0       ) & 0xFF ] ^   \
691                  RT1[ ( Y3 >>  8 ) & 0xFF ] ^   \
692                  RT2[ ( Y2 >> 16 ) & 0xFF ] ^   \
693                  RT3[ ( Y1 >> 24 ) & 0xFF ];    \
694                                                 \
695     X1 = *RK++ ^ RT0[ ( Y1       ) & 0xFF ] ^   \
696                  RT1[ ( Y0 >>  8 ) & 0xFF ] ^   \
697                  RT2[ ( Y3 >> 16 ) & 0xFF ] ^   \
698                  RT3[ ( Y2 >> 24 ) & 0xFF ];    \
699                                                 \
700     X2 = *RK++ ^ RT0[ ( Y2       ) & 0xFF ] ^   \
701                  RT1[ ( Y1 >>  8 ) & 0xFF ] ^   \
702                  RT2[ ( Y0 >> 16 ) & 0xFF ] ^   \
703                  RT3[ ( Y3 >> 24 ) & 0xFF ];    \
704                                                 \
705     X3 = *RK++ ^ RT0[ ( Y3       ) & 0xFF ] ^   \
706                  RT1[ ( Y2 >>  8 ) & 0xFF ] ^   \
707                  RT2[ ( Y1 >> 16 ) & 0xFF ] ^   \
708                  RT3[ ( Y0 >> 24 ) & 0xFF ];    \
709 }
710 
711 /*
712  * AES-ECB block encryption
713  */
714 #if !defined(MBEDTLS_AES_ENCRYPT_ALT)
715 int mbedtls_internal_aes_encrypt( mbedtls_aes_context *ctx,
716                                   const unsigned char input[16],
717                                   unsigned char output[16] )
718 {
719     int i;
720     uint32_t *RK, X0, X1, X2, X3, Y0, Y1, Y2, Y3;
721 
722     RK = ctx->rk;
723 
724     GET_UINT32_LE( X0, input,  0 ); X0 ^= *RK++;
725     GET_UINT32_LE( X1, input,  4 ); X1 ^= *RK++;
726     GET_UINT32_LE( X2, input,  8 ); X2 ^= *RK++;
727     GET_UINT32_LE( X3, input, 12 ); X3 ^= *RK++;
728 
729     for( i = ( ctx->nr >> 1 ) - 1; i > 0; i-- )
730     {
731         AES_FROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 );
732         AES_FROUND( X0, X1, X2, X3, Y0, Y1, Y2, Y3 );
733     }
734 
735     AES_FROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 );
736 
737     X0 = *RK++ ^ \
738             ( (uint32_t) FSb[ ( Y0       ) & 0xFF ]       ) ^
739             ( (uint32_t) FSb[ ( Y1 >>  8 ) & 0xFF ] <<  8 ) ^
740             ( (uint32_t) FSb[ ( Y2 >> 16 ) & 0xFF ] << 16 ) ^
741             ( (uint32_t) FSb[ ( Y3 >> 24 ) & 0xFF ] << 24 );
742 
743     X1 = *RK++ ^ \
744             ( (uint32_t) FSb[ ( Y1       ) & 0xFF ]       ) ^
745             ( (uint32_t) FSb[ ( Y2 >>  8 ) & 0xFF ] <<  8 ) ^
746             ( (uint32_t) FSb[ ( Y3 >> 16 ) & 0xFF ] << 16 ) ^
747             ( (uint32_t) FSb[ ( Y0 >> 24 ) & 0xFF ] << 24 );
748 
749     X2 = *RK++ ^ \
750             ( (uint32_t) FSb[ ( Y2       ) & 0xFF ]       ) ^
751             ( (uint32_t) FSb[ ( Y3 >>  8 ) & 0xFF ] <<  8 ) ^
752             ( (uint32_t) FSb[ ( Y0 >> 16 ) & 0xFF ] << 16 ) ^
753             ( (uint32_t) FSb[ ( Y1 >> 24 ) & 0xFF ] << 24 );
754 
755     X3 = *RK++ ^ \
756             ( (uint32_t) FSb[ ( Y3       ) & 0xFF ]       ) ^
757             ( (uint32_t) FSb[ ( Y0 >>  8 ) & 0xFF ] <<  8 ) ^
758             ( (uint32_t) FSb[ ( Y1 >> 16 ) & 0xFF ] << 16 ) ^
759             ( (uint32_t) FSb[ ( Y2 >> 24 ) & 0xFF ] << 24 );
760 
761     PUT_UINT32_LE( X0, output,  0 );
762     PUT_UINT32_LE( X1, output,  4 );
763     PUT_UINT32_LE( X2, output,  8 );
764     PUT_UINT32_LE( X3, output, 12 );
765 
766     return( 0 );
767 }
768 #endif /* !MBEDTLS_AES_ENCRYPT_ALT */
769 
770 void mbedtls_aes_encrypt( mbedtls_aes_context *ctx,
771                           const unsigned char input[16],
772                           unsigned char output[16] )
773 {
774     mbedtls_internal_aes_encrypt( ctx, input, output );
775 }
776 
777 /*
778  * AES-ECB block decryption
779  */
780 #if !defined(MBEDTLS_AES_DECRYPT_ALT)
781 int mbedtls_internal_aes_decrypt( mbedtls_aes_context *ctx,
782                                   const unsigned char input[16],
783                                   unsigned char output[16] )
784 {
785     int i;
786     uint32_t *RK, X0, X1, X2, X3, Y0, Y1, Y2, Y3;
787 
788     RK = ctx->rk;
789 
790     GET_UINT32_LE( X0, input,  0 ); X0 ^= *RK++;
791     GET_UINT32_LE( X1, input,  4 ); X1 ^= *RK++;
792     GET_UINT32_LE( X2, input,  8 ); X2 ^= *RK++;
793     GET_UINT32_LE( X3, input, 12 ); X3 ^= *RK++;
794 
795     for( i = ( ctx->nr >> 1 ) - 1; i > 0; i-- )
796     {
797         AES_RROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 );
798         AES_RROUND( X0, X1, X2, X3, Y0, Y1, Y2, Y3 );
799     }
800 
801     AES_RROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 );
802 
803     X0 = *RK++ ^ \
804             ( (uint32_t) RSb[ ( Y0       ) & 0xFF ]       ) ^
805             ( (uint32_t) RSb[ ( Y3 >>  8 ) & 0xFF ] <<  8 ) ^
806             ( (uint32_t) RSb[ ( Y2 >> 16 ) & 0xFF ] << 16 ) ^
807             ( (uint32_t) RSb[ ( Y1 >> 24 ) & 0xFF ] << 24 );
808 
809     X1 = *RK++ ^ \
810             ( (uint32_t) RSb[ ( Y1       ) & 0xFF ]       ) ^
811             ( (uint32_t) RSb[ ( Y0 >>  8 ) & 0xFF ] <<  8 ) ^
812             ( (uint32_t) RSb[ ( Y3 >> 16 ) & 0xFF ] << 16 ) ^
813             ( (uint32_t) RSb[ ( Y2 >> 24 ) & 0xFF ] << 24 );
814 
815     X2 = *RK++ ^ \
816             ( (uint32_t) RSb[ ( Y2       ) & 0xFF ]       ) ^
817             ( (uint32_t) RSb[ ( Y1 >>  8 ) & 0xFF ] <<  8 ) ^
818             ( (uint32_t) RSb[ ( Y0 >> 16 ) & 0xFF ] << 16 ) ^
819             ( (uint32_t) RSb[ ( Y3 >> 24 ) & 0xFF ] << 24 );
820 
821     X3 = *RK++ ^ \
822             ( (uint32_t) RSb[ ( Y3       ) & 0xFF ]       ) ^
823             ( (uint32_t) RSb[ ( Y2 >>  8 ) & 0xFF ] <<  8 ) ^
824             ( (uint32_t) RSb[ ( Y1 >> 16 ) & 0xFF ] << 16 ) ^
825             ( (uint32_t) RSb[ ( Y0 >> 24 ) & 0xFF ] << 24 );
826 
827     PUT_UINT32_LE( X0, output,  0 );
828     PUT_UINT32_LE( X1, output,  4 );
829     PUT_UINT32_LE( X2, output,  8 );
830     PUT_UINT32_LE( X3, output, 12 );
831 
832     return( 0 );
833 }
834 #endif /* !MBEDTLS_AES_DECRYPT_ALT */
835 
836 void mbedtls_aes_decrypt( mbedtls_aes_context *ctx,
837                           const unsigned char input[16],
838                           unsigned char output[16] )
839 {
840     mbedtls_internal_aes_decrypt( ctx, input, output );
841 }
842 
843 /*
844  * AES-ECB block encryption/decryption
845  */
846 int mbedtls_aes_crypt_ecb( mbedtls_aes_context *ctx,
847                     int mode,
848                     const unsigned char input[16],
849                     unsigned char output[16] )
850 {
851 #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64)
852     if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) )
853         return( mbedtls_aesni_crypt_ecb( ctx, mode, input, output ) );
854 #endif
855 
856 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_HAVE_X86)
857     if( aes_padlock_ace )
858     {
859         if( mbedtls_padlock_xcryptecb( ctx, mode, input, output ) == 0 )
860             return( 0 );
861 
862         // If padlock data misaligned, we just fall back to
863         // unaccelerated mode
864         //
865     }
866 #endif
867 
868     if( mode == MBEDTLS_AES_ENCRYPT )
869         return( mbedtls_internal_aes_encrypt( ctx, input, output ) );
870     else
871         return( mbedtls_internal_aes_decrypt( ctx, input, output ) );
872 }
873 
874 #if defined(MBEDTLS_CIPHER_MODE_CBC)
875 /*
876  * AES-CBC buffer encryption/decryption
877  */
878 int mbedtls_aes_crypt_cbc( mbedtls_aes_context *ctx,
879                     int mode,
880                     size_t length,
881                     unsigned char iv[16],
882                     const unsigned char *input,
883                     unsigned char *output )
884 {
885     int i;
886     unsigned char temp[16];
887 
888     if( length % 16 )
889         return( MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH );
890 
891 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_HAVE_X86)
892     if( aes_padlock_ace )
893     {
894         if( mbedtls_padlock_xcryptcbc( ctx, mode, length, iv, input, output ) == 0 )
895             return( 0 );
896 
897         // If padlock data misaligned, we just fall back to
898         // unaccelerated mode
899         //
900     }
901 #endif
902 
903     if( mode == MBEDTLS_AES_DECRYPT )
904     {
905         while( length > 0 )
906         {
907             memcpy( temp, input, 16 );
908             mbedtls_aes_crypt_ecb( ctx, mode, input, output );
909 
910             for( i = 0; i < 16; i++ )
911                 output[i] = (unsigned char)( output[i] ^ iv[i] );
912 
913             memcpy( iv, temp, 16 );
914 
915             input  += 16;
916             output += 16;
917             length -= 16;
918         }
919     }
920     else
921     {
922         while( length > 0 )
923         {
924             for( i = 0; i < 16; i++ )
925                 output[i] = (unsigned char)( input[i] ^ iv[i] );
926 
927             mbedtls_aes_crypt_ecb( ctx, mode, output, output );
928             memcpy( iv, output, 16 );
929 
930             input  += 16;
931             output += 16;
932             length -= 16;
933         }
934     }
935 
936     return( 0 );
937 }
938 #endif /* MBEDTLS_CIPHER_MODE_CBC */
939 
940 #if defined(MBEDTLS_CIPHER_MODE_CFB)
941 /*
942  * AES-CFB128 buffer encryption/decryption
943  */
944 int mbedtls_aes_crypt_cfb128( mbedtls_aes_context *ctx,
945                        int mode,
946                        size_t length,
947                        size_t *iv_off,
948                        unsigned char iv[16],
949                        const unsigned char *input,
950                        unsigned char *output )
951 {
952     int c;
953     size_t n = *iv_off;
954 
955     if( mode == MBEDTLS_AES_DECRYPT )
956     {
957         while( length-- )
958         {
959             if( n == 0 )
960                 mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv );
961 
962             c = *input++;
963             *output++ = (unsigned char)( c ^ iv[n] );
964             iv[n] = (unsigned char) c;
965 
966             n = ( n + 1 ) & 0x0F;
967         }
968     }
969     else
970     {
971         while( length-- )
972         {
973             if( n == 0 )
974                 mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv );
975 
976             iv[n] = *output++ = (unsigned char)( iv[n] ^ *input++ );
977 
978             n = ( n + 1 ) & 0x0F;
979         }
980     }
981 
982     *iv_off = n;
983 
984     return( 0 );
985 }
986 
987 /*
988  * AES-CFB8 buffer encryption/decryption
989  */
990 int mbedtls_aes_crypt_cfb8( mbedtls_aes_context *ctx,
991                        int mode,
992                        size_t length,
993                        unsigned char iv[16],
994                        const unsigned char *input,
995                        unsigned char *output )
996 {
997     unsigned char c;
998     unsigned char ov[17];
999 
1000     while( length-- )
1001     {
1002         memcpy( ov, iv, 16 );
1003         mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv );
1004 
1005         if( mode == MBEDTLS_AES_DECRYPT )
1006             ov[16] = *input;
1007 
1008         c = *output++ = (unsigned char)( iv[0] ^ *input++ );
1009 
1010         if( mode == MBEDTLS_AES_ENCRYPT )
1011             ov[16] = c;
1012 
1013         memcpy( iv, ov + 1, 16 );
1014     }
1015 
1016     return( 0 );
1017 }
1018 #endif /*MBEDTLS_CIPHER_MODE_CFB */
1019 
1020 #if defined(MBEDTLS_CIPHER_MODE_CTR)
1021 /*
1022  * AES-CTR buffer encryption/decryption
1023  */
1024 int mbedtls_aes_crypt_ctr( mbedtls_aes_context *ctx,
1025                        size_t length,
1026                        size_t *nc_off,
1027                        unsigned char nonce_counter[16],
1028                        unsigned char stream_block[16],
1029                        const unsigned char *input,
1030                        unsigned char *output )
1031 {
1032     int c, i;
1033     size_t n = *nc_off;
1034 
1035     while( length-- )
1036     {
1037         if( n == 0 ) {
1038             mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, nonce_counter, stream_block );
1039 
1040             for( i = 16; i > 0; i-- )
1041                 if( ++nonce_counter[i - 1] != 0 )
1042                     break;
1043         }
1044         c = *input++;
1045         *output++ = (unsigned char)( c ^ stream_block[n] );
1046 
1047         n = ( n + 1 ) & 0x0F;
1048     }
1049 
1050     *nc_off = n;
1051 
1052     return( 0 );
1053 }
1054 #endif /* MBEDTLS_CIPHER_MODE_CTR */
1055 
1056 #endif /* !MBEDTLS_AES_ALT */
1057 
1058 #if defined(MBEDTLS_SELF_TEST)
1059 /*
1060  * AES test vectors from:
1061  *
1062  * http://csrc.nist.gov/archive/aes/rijndael/rijndael-vals.zip
1063  */
1064 static const unsigned char aes_test_ecb_dec[3][16] =
1065 {
1066     { 0x44, 0x41, 0x6A, 0xC2, 0xD1, 0xF5, 0x3C, 0x58,
1067       0x33, 0x03, 0x91, 0x7E, 0x6B, 0xE9, 0xEB, 0xE0 },
1068     { 0x48, 0xE3, 0x1E, 0x9E, 0x25, 0x67, 0x18, 0xF2,
1069       0x92, 0x29, 0x31, 0x9C, 0x19, 0xF1, 0x5B, 0xA4 },
1070     { 0x05, 0x8C, 0xCF, 0xFD, 0xBB, 0xCB, 0x38, 0x2D,
1071       0x1F, 0x6F, 0x56, 0x58, 0x5D, 0x8A, 0x4A, 0xDE }
1072 };
1073 
1074 static const unsigned char aes_test_ecb_enc[3][16] =
1075 {
1076     { 0xC3, 0x4C, 0x05, 0x2C, 0xC0, 0xDA, 0x8D, 0x73,
1077       0x45, 0x1A, 0xFE, 0x5F, 0x03, 0xBE, 0x29, 0x7F },
1078     { 0xF3, 0xF6, 0x75, 0x2A, 0xE8, 0xD7, 0x83, 0x11,
1079       0x38, 0xF0, 0x41, 0x56, 0x06, 0x31, 0xB1, 0x14 },
1080     { 0x8B, 0x79, 0xEE, 0xCC, 0x93, 0xA0, 0xEE, 0x5D,
1081       0xFF, 0x30, 0xB4, 0xEA, 0x21, 0x63, 0x6D, 0xA4 }
1082 };
1083 
1084 #if defined(MBEDTLS_CIPHER_MODE_CBC)
1085 static const unsigned char aes_test_cbc_dec[3][16] =
1086 {
1087     { 0xFA, 0xCA, 0x37, 0xE0, 0xB0, 0xC8, 0x53, 0x73,
1088       0xDF, 0x70, 0x6E, 0x73, 0xF7, 0xC9, 0xAF, 0x86 },
1089     { 0x5D, 0xF6, 0x78, 0xDD, 0x17, 0xBA, 0x4E, 0x75,
1090       0xB6, 0x17, 0x68, 0xC6, 0xAD, 0xEF, 0x7C, 0x7B },
1091     { 0x48, 0x04, 0xE1, 0x81, 0x8F, 0xE6, 0x29, 0x75,
1092       0x19, 0xA3, 0xE8, 0x8C, 0x57, 0x31, 0x04, 0x13 }
1093 };
1094 
1095 static const unsigned char aes_test_cbc_enc[3][16] =
1096 {
1097     { 0x8A, 0x05, 0xFC, 0x5E, 0x09, 0x5A, 0xF4, 0x84,
1098       0x8A, 0x08, 0xD3, 0x28, 0xD3, 0x68, 0x8E, 0x3D },
1099     { 0x7B, 0xD9, 0x66, 0xD5, 0x3A, 0xD8, 0xC1, 0xBB,
1100       0x85, 0xD2, 0xAD, 0xFA, 0xE8, 0x7B, 0xB1, 0x04 },
1101     { 0xFE, 0x3C, 0x53, 0x65, 0x3E, 0x2F, 0x45, 0xB5,
1102       0x6F, 0xCD, 0x88, 0xB2, 0xCC, 0x89, 0x8F, 0xF0 }
1103 };
1104 #endif /* MBEDTLS_CIPHER_MODE_CBC */
1105 
1106 #if defined(MBEDTLS_CIPHER_MODE_CFB)
1107 /*
1108  * AES-CFB128 test vectors from:
1109  *
1110  * http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
1111  */
1112 static const unsigned char aes_test_cfb128_key[3][32] =
1113 {
1114     { 0x2B, 0x7E, 0x15, 0x16, 0x28, 0xAE, 0xD2, 0xA6,
1115       0xAB, 0xF7, 0x15, 0x88, 0x09, 0xCF, 0x4F, 0x3C },
1116     { 0x8E, 0x73, 0xB0, 0xF7, 0xDA, 0x0E, 0x64, 0x52,
1117       0xC8, 0x10, 0xF3, 0x2B, 0x80, 0x90, 0x79, 0xE5,
1118       0x62, 0xF8, 0xEA, 0xD2, 0x52, 0x2C, 0x6B, 0x7B },
1119     { 0x60, 0x3D, 0xEB, 0x10, 0x15, 0xCA, 0x71, 0xBE,
1120       0x2B, 0x73, 0xAE, 0xF0, 0x85, 0x7D, 0x77, 0x81,
1121       0x1F, 0x35, 0x2C, 0x07, 0x3B, 0x61, 0x08, 0xD7,
1122       0x2D, 0x98, 0x10, 0xA3, 0x09, 0x14, 0xDF, 0xF4 }
1123 };
1124 
1125 static const unsigned char aes_test_cfb128_iv[16] =
1126 {
1127     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
1128     0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F
1129 };
1130 
1131 static const unsigned char aes_test_cfb128_pt[64] =
1132 {
1133     0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96,
1134     0xE9, 0x3D, 0x7E, 0x11, 0x73, 0x93, 0x17, 0x2A,
1135     0xAE, 0x2D, 0x8A, 0x57, 0x1E, 0x03, 0xAC, 0x9C,
1136     0x9E, 0xB7, 0x6F, 0xAC, 0x45, 0xAF, 0x8E, 0x51,
1137     0x30, 0xC8, 0x1C, 0x46, 0xA3, 0x5C, 0xE4, 0x11,
1138     0xE5, 0xFB, 0xC1, 0x19, 0x1A, 0x0A, 0x52, 0xEF,
1139     0xF6, 0x9F, 0x24, 0x45, 0xDF, 0x4F, 0x9B, 0x17,
1140     0xAD, 0x2B, 0x41, 0x7B, 0xE6, 0x6C, 0x37, 0x10
1141 };
1142 
1143 static const unsigned char aes_test_cfb128_ct[3][64] =
1144 {
1145     { 0x3B, 0x3F, 0xD9, 0x2E, 0xB7, 0x2D, 0xAD, 0x20,
1146       0x33, 0x34, 0x49, 0xF8, 0xE8, 0x3C, 0xFB, 0x4A,
1147       0xC8, 0xA6, 0x45, 0x37, 0xA0, 0xB3, 0xA9, 0x3F,
1148       0xCD, 0xE3, 0xCD, 0xAD, 0x9F, 0x1C, 0xE5, 0x8B,
1149       0x26, 0x75, 0x1F, 0x67, 0xA3, 0xCB, 0xB1, 0x40,
1150       0xB1, 0x80, 0x8C, 0xF1, 0x87, 0xA4, 0xF4, 0xDF,
1151       0xC0, 0x4B, 0x05, 0x35, 0x7C, 0x5D, 0x1C, 0x0E,
1152       0xEA, 0xC4, 0xC6, 0x6F, 0x9F, 0xF7, 0xF2, 0xE6 },
1153     { 0xCD, 0xC8, 0x0D, 0x6F, 0xDD, 0xF1, 0x8C, 0xAB,
1154       0x34, 0xC2, 0x59, 0x09, 0xC9, 0x9A, 0x41, 0x74,
1155       0x67, 0xCE, 0x7F, 0x7F, 0x81, 0x17, 0x36, 0x21,
1156       0x96, 0x1A, 0x2B, 0x70, 0x17, 0x1D, 0x3D, 0x7A,
1157       0x2E, 0x1E, 0x8A, 0x1D, 0xD5, 0x9B, 0x88, 0xB1,
1158       0xC8, 0xE6, 0x0F, 0xED, 0x1E, 0xFA, 0xC4, 0xC9,
1159       0xC0, 0x5F, 0x9F, 0x9C, 0xA9, 0x83, 0x4F, 0xA0,
1160       0x42, 0xAE, 0x8F, 0xBA, 0x58, 0x4B, 0x09, 0xFF },
1161     { 0xDC, 0x7E, 0x84, 0xBF, 0xDA, 0x79, 0x16, 0x4B,
1162       0x7E, 0xCD, 0x84, 0x86, 0x98, 0x5D, 0x38, 0x60,
1163       0x39, 0xFF, 0xED, 0x14, 0x3B, 0x28, 0xB1, 0xC8,
1164       0x32, 0x11, 0x3C, 0x63, 0x31, 0xE5, 0x40, 0x7B,
1165       0xDF, 0x10, 0x13, 0x24, 0x15, 0xE5, 0x4B, 0x92,
1166       0xA1, 0x3E, 0xD0, 0xA8, 0x26, 0x7A, 0xE2, 0xF9,
1167       0x75, 0xA3, 0x85, 0x74, 0x1A, 0xB9, 0xCE, 0xF8,
1168       0x20, 0x31, 0x62, 0x3D, 0x55, 0xB1, 0xE4, 0x71 }
1169 };
1170 #endif /* MBEDTLS_CIPHER_MODE_CFB */
1171 
1172 #if defined(MBEDTLS_CIPHER_MODE_CTR)
1173 /*
1174  * AES-CTR test vectors from:
1175  *
1176  * http://www.faqs.org/rfcs/rfc3686.html
1177  */
1178 
1179 static const unsigned char aes_test_ctr_key[3][16] =
1180 {
1181     { 0xAE, 0x68, 0x52, 0xF8, 0x12, 0x10, 0x67, 0xCC,
1182       0x4B, 0xF7, 0xA5, 0x76, 0x55, 0x77, 0xF3, 0x9E },
1183     { 0x7E, 0x24, 0x06, 0x78, 0x17, 0xFA, 0xE0, 0xD7,
1184       0x43, 0xD6, 0xCE, 0x1F, 0x32, 0x53, 0x91, 0x63 },
1185     { 0x76, 0x91, 0xBE, 0x03, 0x5E, 0x50, 0x20, 0xA8,
1186       0xAC, 0x6E, 0x61, 0x85, 0x29, 0xF9, 0xA0, 0xDC }
1187 };
1188 
1189 static const unsigned char aes_test_ctr_nonce_counter[3][16] =
1190 {
1191     { 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x00,
1192       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 },
1193     { 0x00, 0x6C, 0xB6, 0xDB, 0xC0, 0x54, 0x3B, 0x59,
1194       0xDA, 0x48, 0xD9, 0x0B, 0x00, 0x00, 0x00, 0x01 },
1195     { 0x00, 0xE0, 0x01, 0x7B, 0x27, 0x77, 0x7F, 0x3F,
1196       0x4A, 0x17, 0x86, 0xF0, 0x00, 0x00, 0x00, 0x01 }
1197 };
1198 
1199 static const unsigned char aes_test_ctr_pt[3][48] =
1200 {
1201     { 0x53, 0x69, 0x6E, 0x67, 0x6C, 0x65, 0x20, 0x62,
1202       0x6C, 0x6F, 0x63, 0x6B, 0x20, 0x6D, 0x73, 0x67 },
1203 
1204     { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
1205       0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
1206       0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
1207       0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F },
1208 
1209     { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
1210       0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
1211       0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
1212       0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F,
1213       0x20, 0x21, 0x22, 0x23 }
1214 };
1215 
1216 static const unsigned char aes_test_ctr_ct[3][48] =
1217 {
1218     { 0xE4, 0x09, 0x5D, 0x4F, 0xB7, 0xA7, 0xB3, 0x79,
1219       0x2D, 0x61, 0x75, 0xA3, 0x26, 0x13, 0x11, 0xB8 },
1220     { 0x51, 0x04, 0xA1, 0x06, 0x16, 0x8A, 0x72, 0xD9,
1221       0x79, 0x0D, 0x41, 0xEE, 0x8E, 0xDA, 0xD3, 0x88,
1222       0xEB, 0x2E, 0x1E, 0xFC, 0x46, 0xDA, 0x57, 0xC8,
1223       0xFC, 0xE6, 0x30, 0xDF, 0x91, 0x41, 0xBE, 0x28 },
1224     { 0xC1, 0xCF, 0x48, 0xA8, 0x9F, 0x2F, 0xFD, 0xD9,
1225       0xCF, 0x46, 0x52, 0xE9, 0xEF, 0xDB, 0x72, 0xD7,
1226       0x45, 0x40, 0xA4, 0x2B, 0xDE, 0x6D, 0x78, 0x36,
1227       0xD5, 0x9A, 0x5C, 0xEA, 0xAE, 0xF3, 0x10, 0x53,
1228       0x25, 0xB2, 0x07, 0x2F }
1229 };
1230 
1231 static const int aes_test_ctr_len[3] =
1232     { 16, 32, 36 };
1233 #endif /* MBEDTLS_CIPHER_MODE_CTR */
1234 
1235 /*
1236  * Checkup routine
1237  */
1238 int mbedtls_aes_self_test( int verbose )
1239 {
1240     int ret = 0, i, j, u, v;
1241     unsigned char key[32];
1242     unsigned char buf[64];
1243 #if defined(MBEDTLS_CIPHER_MODE_CBC) || defined(MBEDTLS_CIPHER_MODE_CFB)
1244     unsigned char iv[16];
1245 #endif
1246 #if defined(MBEDTLS_CIPHER_MODE_CBC)
1247     unsigned char prv[16];
1248 #endif
1249 #if defined(MBEDTLS_CIPHER_MODE_CTR) || defined(MBEDTLS_CIPHER_MODE_CFB)
1250     size_t offset;
1251 #endif
1252 #if defined(MBEDTLS_CIPHER_MODE_CTR)
1253     int len;
1254     unsigned char nonce_counter[16];
1255     unsigned char stream_block[16];
1256 #endif
1257     mbedtls_aes_context ctx;
1258 
1259     memset( key, 0, 32 );
1260     mbedtls_aes_init( &ctx );
1261 
1262     /*
1263      * ECB mode
1264      */
1265     for( i = 0; i < 6; i++ )
1266     {
1267         u = i >> 1;
1268         v = i  & 1;
1269 
1270         if( verbose != 0 )
1271             mbedtls_printf( "  AES-ECB-%3d (%s): ", 128 + u * 64,
1272                              ( v == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" );
1273 
1274         memset( buf, 0, 16 );
1275 
1276         if( v == MBEDTLS_AES_DECRYPT )
1277         {
1278             mbedtls_aes_setkey_dec( &ctx, key, 128 + u * 64 );
1279 
1280             for( j = 0; j < 10000; j++ )
1281                 mbedtls_aes_crypt_ecb( &ctx, v, buf, buf );
1282 
1283             if( memcmp( buf, aes_test_ecb_dec[u], 16 ) != 0 )
1284             {
1285                 if( verbose != 0 )
1286                     mbedtls_printf( "failed\n" );
1287 
1288                 ret = 1;
1289                 goto exit;
1290             }
1291         }
1292         else
1293         {
1294             mbedtls_aes_setkey_enc( &ctx, key, 128 + u * 64 );
1295 
1296             for( j = 0; j < 10000; j++ )
1297                 mbedtls_aes_crypt_ecb( &ctx, v, buf, buf );
1298 
1299             if( memcmp( buf, aes_test_ecb_enc[u], 16 ) != 0 )
1300             {
1301                 if( verbose != 0 )
1302                     mbedtls_printf( "failed\n" );
1303 
1304                 ret = 1;
1305                 goto exit;
1306             }
1307         }
1308 
1309         if( verbose != 0 )
1310             mbedtls_printf( "passed\n" );
1311     }
1312 
1313     if( verbose != 0 )
1314         mbedtls_printf( "\n" );
1315 
1316 #if defined(MBEDTLS_CIPHER_MODE_CBC)
1317     /*
1318      * CBC mode
1319      */
1320     for( i = 0; i < 6; i++ )
1321     {
1322         u = i >> 1;
1323         v = i  & 1;
1324 
1325         if( verbose != 0 )
1326             mbedtls_printf( "  AES-CBC-%3d (%s): ", 128 + u * 64,
1327                              ( v == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" );
1328 
1329         memset( iv , 0, 16 );
1330         memset( prv, 0, 16 );
1331         memset( buf, 0, 16 );
1332 
1333         if( v == MBEDTLS_AES_DECRYPT )
1334         {
1335             mbedtls_aes_setkey_dec( &ctx, key, 128 + u * 64 );
1336 
1337             for( j = 0; j < 10000; j++ )
1338                 mbedtls_aes_crypt_cbc( &ctx, v, 16, iv, buf, buf );
1339 
1340             if( memcmp( buf, aes_test_cbc_dec[u], 16 ) != 0 )
1341             {
1342                 if( verbose != 0 )
1343                     mbedtls_printf( "failed\n" );
1344 
1345                 ret = 1;
1346                 goto exit;
1347             }
1348         }
1349         else
1350         {
1351             mbedtls_aes_setkey_enc( &ctx, key, 128 + u * 64 );
1352 
1353             for( j = 0; j < 10000; j++ )
1354             {
1355                 unsigned char tmp[16];
1356 
1357                 mbedtls_aes_crypt_cbc( &ctx, v, 16, iv, buf, buf );
1358 
1359                 memcpy( tmp, prv, 16 );
1360                 memcpy( prv, buf, 16 );
1361                 memcpy( buf, tmp, 16 );
1362             }
1363 
1364             if( memcmp( prv, aes_test_cbc_enc[u], 16 ) != 0 )
1365             {
1366                 if( verbose != 0 )
1367                     mbedtls_printf( "failed\n" );
1368 
1369                 ret = 1;
1370                 goto exit;
1371             }
1372         }
1373 
1374         if( verbose != 0 )
1375             mbedtls_printf( "passed\n" );
1376     }
1377 
1378     if( verbose != 0 )
1379         mbedtls_printf( "\n" );
1380 #endif /* MBEDTLS_CIPHER_MODE_CBC */
1381 
1382 #if defined(MBEDTLS_CIPHER_MODE_CFB)
1383     /*
1384      * CFB128 mode
1385      */
1386     for( i = 0; i < 6; i++ )
1387     {
1388         u = i >> 1;
1389         v = i  & 1;
1390 
1391         if( verbose != 0 )
1392             mbedtls_printf( "  AES-CFB128-%3d (%s): ", 128 + u * 64,
1393                              ( v == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" );
1394 
1395         memcpy( iv,  aes_test_cfb128_iv, 16 );
1396         memcpy( key, aes_test_cfb128_key[u], 16 + u * 8 );
1397 
1398         offset = 0;
1399         mbedtls_aes_setkey_enc( &ctx, key, 128 + u * 64 );
1400 
1401         if( v == MBEDTLS_AES_DECRYPT )
1402         {
1403             memcpy( buf, aes_test_cfb128_ct[u], 64 );
1404             mbedtls_aes_crypt_cfb128( &ctx, v, 64, &offset, iv, buf, buf );
1405 
1406             if( memcmp( buf, aes_test_cfb128_pt, 64 ) != 0 )
1407             {
1408                 if( verbose != 0 )
1409                     mbedtls_printf( "failed\n" );
1410 
1411                 ret = 1;
1412                 goto exit;
1413             }
1414         }
1415         else
1416         {
1417             memcpy( buf, aes_test_cfb128_pt, 64 );
1418             mbedtls_aes_crypt_cfb128( &ctx, v, 64, &offset, iv, buf, buf );
1419 
1420             if( memcmp( buf, aes_test_cfb128_ct[u], 64 ) != 0 )
1421             {
1422                 if( verbose != 0 )
1423                     mbedtls_printf( "failed\n" );
1424 
1425                 ret = 1;
1426                 goto exit;
1427             }
1428         }
1429 
1430         if( verbose != 0 )
1431             mbedtls_printf( "passed\n" );
1432     }
1433 
1434     if( verbose != 0 )
1435         mbedtls_printf( "\n" );
1436 #endif /* MBEDTLS_CIPHER_MODE_CFB */
1437 
1438 #if defined(MBEDTLS_CIPHER_MODE_CTR)
1439     /*
1440      * CTR mode
1441      */
1442     for( i = 0; i < 6; i++ )
1443     {
1444         u = i >> 1;
1445         v = i  & 1;
1446 
1447         if( verbose != 0 )
1448             mbedtls_printf( "  AES-CTR-128 (%s): ",
1449                              ( v == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" );
1450 
1451         memcpy( nonce_counter, aes_test_ctr_nonce_counter[u], 16 );
1452         memcpy( key, aes_test_ctr_key[u], 16 );
1453 
1454         offset = 0;
1455         mbedtls_aes_setkey_enc( &ctx, key, 128 );
1456 
1457         if( v == MBEDTLS_AES_DECRYPT )
1458         {
1459             len = aes_test_ctr_len[u];
1460             memcpy( buf, aes_test_ctr_ct[u], len );
1461 
1462             mbedtls_aes_crypt_ctr( &ctx, len, &offset, nonce_counter, stream_block,
1463                            buf, buf );
1464 
1465             if( memcmp( buf, aes_test_ctr_pt[u], len ) != 0 )
1466             {
1467                 if( verbose != 0 )
1468                     mbedtls_printf( "failed\n" );
1469 
1470                 ret = 1;
1471                 goto exit;
1472             }
1473         }
1474         else
1475         {
1476             len = aes_test_ctr_len[u];
1477             memcpy( buf, aes_test_ctr_pt[u], len );
1478 
1479             mbedtls_aes_crypt_ctr( &ctx, len, &offset, nonce_counter, stream_block,
1480                            buf, buf );
1481 
1482             if( memcmp( buf, aes_test_ctr_ct[u], len ) != 0 )
1483             {
1484                 if( verbose != 0 )
1485                     mbedtls_printf( "failed\n" );
1486 
1487                 ret = 1;
1488                 goto exit;
1489             }
1490         }
1491 
1492         if( verbose != 0 )
1493             mbedtls_printf( "passed\n" );
1494     }
1495 
1496     if( verbose != 0 )
1497         mbedtls_printf( "\n" );
1498 #endif /* MBEDTLS_CIPHER_MODE_CTR */
1499 
1500     ret = 0;
1501 
1502 exit:
1503     mbedtls_aes_free( &ctx );
1504 
1505     return( ret );
1506 }
1507 
1508 #endif /* MBEDTLS_SELF_TEST */
1509 
1510 #endif /* MBEDTLS_AES_C */
1511