1 /* 2 * FIPS-197 compliant AES implementation 3 * 4 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved 5 * SPDX-License-Identifier: GPL-2.0 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License as published by 9 * the Free Software Foundation; either version 2 of the License, or 10 * (at your option) any later version. 11 * 12 * This program is distributed in the hope that it will be useful, 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15 * GNU General Public License for more details. 16 * 17 * You should have received a copy of the GNU General Public License along 18 * with this program; if not, write to the Free Software Foundation, Inc., 19 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. 20 * 21 * This file is part of mbed TLS (https://tls.mbed.org) 22 */ 23 /* 24 * The AES block cipher was designed by Vincent Rijmen and Joan Daemen. 25 * 26 * http://csrc.nist.gov/encryption/aes/rijndael/Rijndael.pdf 27 * http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf 28 */ 29 30 #if !defined(MBEDTLS_CONFIG_FILE) 31 #include "mbedtls/config.h" 32 #else 33 #include MBEDTLS_CONFIG_FILE 34 #endif 35 36 #if defined(MBEDTLS_AES_C) 37 38 #include <string.h> 39 40 #include "mbedtls/aes.h" 41 #if defined(MBEDTLS_PADLOCK_C) 42 #include "mbedtls/padlock.h" 43 #endif 44 #if defined(MBEDTLS_AESNI_C) 45 #include "mbedtls/aesni.h" 46 #endif 47 48 #if defined(MBEDTLS_SELF_TEST) 49 #if defined(MBEDTLS_PLATFORM_C) 50 #include "mbedtls/platform.h" 51 #else 52 #include <stdio.h> 53 #define mbedtls_printf printf 54 #endif /* MBEDTLS_PLATFORM_C */ 55 #endif /* MBEDTLS_SELF_TEST */ 56 57 #if !defined(MBEDTLS_AES_ALT) 58 59 /* Implementation that should never be optimized out by the compiler */ 60 static void mbedtls_zeroize( void *v, size_t n ) { 61 volatile unsigned char *p = (unsigned char*)v; while( n-- ) *p++ = 0; 62 } 63 64 /* 65 * 32-bit integer manipulation macros (little endian) 66 */ 67 #ifndef GET_UINT32_LE 68 #define GET_UINT32_LE(n,b,i) \ 69 { \ 70 (n) = ( (uint32_t) (b)[(i) ] ) \ 71 | ( (uint32_t) (b)[(i) + 1] << 8 ) \ 72 | ( (uint32_t) (b)[(i) + 2] << 16 ) \ 73 | ( (uint32_t) (b)[(i) + 3] << 24 ); \ 74 } 75 #endif 76 77 #ifndef PUT_UINT32_LE 78 #define PUT_UINT32_LE(n,b,i) \ 79 { \ 80 (b)[(i) ] = (unsigned char) ( ( (n) ) & 0xFF ); \ 81 (b)[(i) + 1] = (unsigned char) ( ( (n) >> 8 ) & 0xFF ); \ 82 (b)[(i) + 2] = (unsigned char) ( ( (n) >> 16 ) & 0xFF ); \ 83 (b)[(i) + 3] = (unsigned char) ( ( (n) >> 24 ) & 0xFF ); \ 84 } 85 #endif 86 87 #if defined(MBEDTLS_PADLOCK_C) && \ 88 ( defined(MBEDTLS_HAVE_X86) || defined(MBEDTLS_PADLOCK_ALIGN16) ) 89 static int aes_padlock_ace = -1; 90 #endif 91 92 #if defined(MBEDTLS_AES_ROM_TABLES) 93 /* 94 * Forward S-box 95 */ 96 static const unsigned char FSb[256] = 97 { 98 0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 99 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76, 100 0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 101 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0, 102 0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, 103 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15, 104 0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 105 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75, 106 0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, 107 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84, 108 0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 109 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF, 110 0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 111 0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8, 112 0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5, 113 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2, 114 0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, 115 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73, 116 0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 117 0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB, 118 0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, 119 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79, 120 0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9, 121 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08, 122 0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 123 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A, 124 0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, 125 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E, 126 0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94, 127 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF, 128 0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 129 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16 130 }; 131 132 /* 133 * Forward tables 134 */ 135 #define FT \ 136 \ 137 V(A5,63,63,C6), V(84,7C,7C,F8), V(99,77,77,EE), V(8D,7B,7B,F6), \ 138 V(0D,F2,F2,FF), V(BD,6B,6B,D6), V(B1,6F,6F,DE), V(54,C5,C5,91), \ 139 V(50,30,30,60), V(03,01,01,02), V(A9,67,67,CE), V(7D,2B,2B,56), \ 140 V(19,FE,FE,E7), V(62,D7,D7,B5), V(E6,AB,AB,4D), V(9A,76,76,EC), \ 141 V(45,CA,CA,8F), V(9D,82,82,1F), V(40,C9,C9,89), V(87,7D,7D,FA), \ 142 V(15,FA,FA,EF), V(EB,59,59,B2), V(C9,47,47,8E), V(0B,F0,F0,FB), \ 143 V(EC,AD,AD,41), V(67,D4,D4,B3), V(FD,A2,A2,5F), V(EA,AF,AF,45), \ 144 V(BF,9C,9C,23), V(F7,A4,A4,53), V(96,72,72,E4), V(5B,C0,C0,9B), \ 145 V(C2,B7,B7,75), V(1C,FD,FD,E1), V(AE,93,93,3D), V(6A,26,26,4C), \ 146 V(5A,36,36,6C), V(41,3F,3F,7E), V(02,F7,F7,F5), V(4F,CC,CC,83), \ 147 V(5C,34,34,68), V(F4,A5,A5,51), V(34,E5,E5,D1), V(08,F1,F1,F9), \ 148 V(93,71,71,E2), V(73,D8,D8,AB), V(53,31,31,62), V(3F,15,15,2A), \ 149 V(0C,04,04,08), V(52,C7,C7,95), V(65,23,23,46), V(5E,C3,C3,9D), \ 150 V(28,18,18,30), V(A1,96,96,37), V(0F,05,05,0A), V(B5,9A,9A,2F), \ 151 V(09,07,07,0E), V(36,12,12,24), V(9B,80,80,1B), V(3D,E2,E2,DF), \ 152 V(26,EB,EB,CD), V(69,27,27,4E), V(CD,B2,B2,7F), V(9F,75,75,EA), \ 153 V(1B,09,09,12), V(9E,83,83,1D), V(74,2C,2C,58), V(2E,1A,1A,34), \ 154 V(2D,1B,1B,36), V(B2,6E,6E,DC), V(EE,5A,5A,B4), V(FB,A0,A0,5B), \ 155 V(F6,52,52,A4), V(4D,3B,3B,76), V(61,D6,D6,B7), V(CE,B3,B3,7D), \ 156 V(7B,29,29,52), V(3E,E3,E3,DD), V(71,2F,2F,5E), V(97,84,84,13), \ 157 V(F5,53,53,A6), V(68,D1,D1,B9), V(00,00,00,00), V(2C,ED,ED,C1), \ 158 V(60,20,20,40), V(1F,FC,FC,E3), V(C8,B1,B1,79), V(ED,5B,5B,B6), \ 159 V(BE,6A,6A,D4), V(46,CB,CB,8D), V(D9,BE,BE,67), V(4B,39,39,72), \ 160 V(DE,4A,4A,94), V(D4,4C,4C,98), V(E8,58,58,B0), V(4A,CF,CF,85), \ 161 V(6B,D0,D0,BB), V(2A,EF,EF,C5), V(E5,AA,AA,4F), V(16,FB,FB,ED), \ 162 V(C5,43,43,86), V(D7,4D,4D,9A), V(55,33,33,66), V(94,85,85,11), \ 163 V(CF,45,45,8A), V(10,F9,F9,E9), V(06,02,02,04), V(81,7F,7F,FE), \ 164 V(F0,50,50,A0), V(44,3C,3C,78), V(BA,9F,9F,25), V(E3,A8,A8,4B), \ 165 V(F3,51,51,A2), V(FE,A3,A3,5D), V(C0,40,40,80), V(8A,8F,8F,05), \ 166 V(AD,92,92,3F), V(BC,9D,9D,21), V(48,38,38,70), V(04,F5,F5,F1), \ 167 V(DF,BC,BC,63), V(C1,B6,B6,77), V(75,DA,DA,AF), V(63,21,21,42), \ 168 V(30,10,10,20), V(1A,FF,FF,E5), V(0E,F3,F3,FD), V(6D,D2,D2,BF), \ 169 V(4C,CD,CD,81), V(14,0C,0C,18), V(35,13,13,26), V(2F,EC,EC,C3), \ 170 V(E1,5F,5F,BE), V(A2,97,97,35), V(CC,44,44,88), V(39,17,17,2E), \ 171 V(57,C4,C4,93), V(F2,A7,A7,55), V(82,7E,7E,FC), V(47,3D,3D,7A), \ 172 V(AC,64,64,C8), V(E7,5D,5D,BA), V(2B,19,19,32), V(95,73,73,E6), \ 173 V(A0,60,60,C0), V(98,81,81,19), V(D1,4F,4F,9E), V(7F,DC,DC,A3), \ 174 V(66,22,22,44), V(7E,2A,2A,54), V(AB,90,90,3B), V(83,88,88,0B), \ 175 V(CA,46,46,8C), V(29,EE,EE,C7), V(D3,B8,B8,6B), V(3C,14,14,28), \ 176 V(79,DE,DE,A7), V(E2,5E,5E,BC), V(1D,0B,0B,16), V(76,DB,DB,AD), \ 177 V(3B,E0,E0,DB), V(56,32,32,64), V(4E,3A,3A,74), V(1E,0A,0A,14), \ 178 V(DB,49,49,92), V(0A,06,06,0C), V(6C,24,24,48), V(E4,5C,5C,B8), \ 179 V(5D,C2,C2,9F), V(6E,D3,D3,BD), V(EF,AC,AC,43), V(A6,62,62,C4), \ 180 V(A8,91,91,39), V(A4,95,95,31), V(37,E4,E4,D3), V(8B,79,79,F2), \ 181 V(32,E7,E7,D5), V(43,C8,C8,8B), V(59,37,37,6E), V(B7,6D,6D,DA), \ 182 V(8C,8D,8D,01), V(64,D5,D5,B1), V(D2,4E,4E,9C), V(E0,A9,A9,49), \ 183 V(B4,6C,6C,D8), V(FA,56,56,AC), V(07,F4,F4,F3), V(25,EA,EA,CF), \ 184 V(AF,65,65,CA), V(8E,7A,7A,F4), V(E9,AE,AE,47), V(18,08,08,10), \ 185 V(D5,BA,BA,6F), V(88,78,78,F0), V(6F,25,25,4A), V(72,2E,2E,5C), \ 186 V(24,1C,1C,38), V(F1,A6,A6,57), V(C7,B4,B4,73), V(51,C6,C6,97), \ 187 V(23,E8,E8,CB), V(7C,DD,DD,A1), V(9C,74,74,E8), V(21,1F,1F,3E), \ 188 V(DD,4B,4B,96), V(DC,BD,BD,61), V(86,8B,8B,0D), V(85,8A,8A,0F), \ 189 V(90,70,70,E0), V(42,3E,3E,7C), V(C4,B5,B5,71), V(AA,66,66,CC), \ 190 V(D8,48,48,90), V(05,03,03,06), V(01,F6,F6,F7), V(12,0E,0E,1C), \ 191 V(A3,61,61,C2), V(5F,35,35,6A), V(F9,57,57,AE), V(D0,B9,B9,69), \ 192 V(91,86,86,17), V(58,C1,C1,99), V(27,1D,1D,3A), V(B9,9E,9E,27), \ 193 V(38,E1,E1,D9), V(13,F8,F8,EB), V(B3,98,98,2B), V(33,11,11,22), \ 194 V(BB,69,69,D2), V(70,D9,D9,A9), V(89,8E,8E,07), V(A7,94,94,33), \ 195 V(B6,9B,9B,2D), V(22,1E,1E,3C), V(92,87,87,15), V(20,E9,E9,C9), \ 196 V(49,CE,CE,87), V(FF,55,55,AA), V(78,28,28,50), V(7A,DF,DF,A5), \ 197 V(8F,8C,8C,03), V(F8,A1,A1,59), V(80,89,89,09), V(17,0D,0D,1A), \ 198 V(DA,BF,BF,65), V(31,E6,E6,D7), V(C6,42,42,84), V(B8,68,68,D0), \ 199 V(C3,41,41,82), V(B0,99,99,29), V(77,2D,2D,5A), V(11,0F,0F,1E), \ 200 V(CB,B0,B0,7B), V(FC,54,54,A8), V(D6,BB,BB,6D), V(3A,16,16,2C) 201 202 #define V(a,b,c,d) 0x##a##b##c##d 203 static const uint32_t FT0[256] = { FT }; 204 #undef V 205 206 #define V(a,b,c,d) 0x##b##c##d##a 207 static const uint32_t FT1[256] = { FT }; 208 #undef V 209 210 #define V(a,b,c,d) 0x##c##d##a##b 211 static const uint32_t FT2[256] = { FT }; 212 #undef V 213 214 #define V(a,b,c,d) 0x##d##a##b##c 215 static const uint32_t FT3[256] = { FT }; 216 #undef V 217 218 #undef FT 219 220 /* 221 * Reverse S-box 222 */ 223 static const unsigned char RSb[256] = 224 { 225 0x52, 0x09, 0x6A, 0xD5, 0x30, 0x36, 0xA5, 0x38, 226 0xBF, 0x40, 0xA3, 0x9E, 0x81, 0xF3, 0xD7, 0xFB, 227 0x7C, 0xE3, 0x39, 0x82, 0x9B, 0x2F, 0xFF, 0x87, 228 0x34, 0x8E, 0x43, 0x44, 0xC4, 0xDE, 0xE9, 0xCB, 229 0x54, 0x7B, 0x94, 0x32, 0xA6, 0xC2, 0x23, 0x3D, 230 0xEE, 0x4C, 0x95, 0x0B, 0x42, 0xFA, 0xC3, 0x4E, 231 0x08, 0x2E, 0xA1, 0x66, 0x28, 0xD9, 0x24, 0xB2, 232 0x76, 0x5B, 0xA2, 0x49, 0x6D, 0x8B, 0xD1, 0x25, 233 0x72, 0xF8, 0xF6, 0x64, 0x86, 0x68, 0x98, 0x16, 234 0xD4, 0xA4, 0x5C, 0xCC, 0x5D, 0x65, 0xB6, 0x92, 235 0x6C, 0x70, 0x48, 0x50, 0xFD, 0xED, 0xB9, 0xDA, 236 0x5E, 0x15, 0x46, 0x57, 0xA7, 0x8D, 0x9D, 0x84, 237 0x90, 0xD8, 0xAB, 0x00, 0x8C, 0xBC, 0xD3, 0x0A, 238 0xF7, 0xE4, 0x58, 0x05, 0xB8, 0xB3, 0x45, 0x06, 239 0xD0, 0x2C, 0x1E, 0x8F, 0xCA, 0x3F, 0x0F, 0x02, 240 0xC1, 0xAF, 0xBD, 0x03, 0x01, 0x13, 0x8A, 0x6B, 241 0x3A, 0x91, 0x11, 0x41, 0x4F, 0x67, 0xDC, 0xEA, 242 0x97, 0xF2, 0xCF, 0xCE, 0xF0, 0xB4, 0xE6, 0x73, 243 0x96, 0xAC, 0x74, 0x22, 0xE7, 0xAD, 0x35, 0x85, 244 0xE2, 0xF9, 0x37, 0xE8, 0x1C, 0x75, 0xDF, 0x6E, 245 0x47, 0xF1, 0x1A, 0x71, 0x1D, 0x29, 0xC5, 0x89, 246 0x6F, 0xB7, 0x62, 0x0E, 0xAA, 0x18, 0xBE, 0x1B, 247 0xFC, 0x56, 0x3E, 0x4B, 0xC6, 0xD2, 0x79, 0x20, 248 0x9A, 0xDB, 0xC0, 0xFE, 0x78, 0xCD, 0x5A, 0xF4, 249 0x1F, 0xDD, 0xA8, 0x33, 0x88, 0x07, 0xC7, 0x31, 250 0xB1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xEC, 0x5F, 251 0x60, 0x51, 0x7F, 0xA9, 0x19, 0xB5, 0x4A, 0x0D, 252 0x2D, 0xE5, 0x7A, 0x9F, 0x93, 0xC9, 0x9C, 0xEF, 253 0xA0, 0xE0, 0x3B, 0x4D, 0xAE, 0x2A, 0xF5, 0xB0, 254 0xC8, 0xEB, 0xBB, 0x3C, 0x83, 0x53, 0x99, 0x61, 255 0x17, 0x2B, 0x04, 0x7E, 0xBA, 0x77, 0xD6, 0x26, 256 0xE1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0C, 0x7D 257 }; 258 259 /* 260 * Reverse tables 261 */ 262 #define RT \ 263 \ 264 V(50,A7,F4,51), V(53,65,41,7E), V(C3,A4,17,1A), V(96,5E,27,3A), \ 265 V(CB,6B,AB,3B), V(F1,45,9D,1F), V(AB,58,FA,AC), V(93,03,E3,4B), \ 266 V(55,FA,30,20), V(F6,6D,76,AD), V(91,76,CC,88), V(25,4C,02,F5), \ 267 V(FC,D7,E5,4F), V(D7,CB,2A,C5), V(80,44,35,26), V(8F,A3,62,B5), \ 268 V(49,5A,B1,DE), V(67,1B,BA,25), V(98,0E,EA,45), V(E1,C0,FE,5D), \ 269 V(02,75,2F,C3), V(12,F0,4C,81), V(A3,97,46,8D), V(C6,F9,D3,6B), \ 270 V(E7,5F,8F,03), V(95,9C,92,15), V(EB,7A,6D,BF), V(DA,59,52,95), \ 271 V(2D,83,BE,D4), V(D3,21,74,58), V(29,69,E0,49), V(44,C8,C9,8E), \ 272 V(6A,89,C2,75), V(78,79,8E,F4), V(6B,3E,58,99), V(DD,71,B9,27), \ 273 V(B6,4F,E1,BE), V(17,AD,88,F0), V(66,AC,20,C9), V(B4,3A,CE,7D), \ 274 V(18,4A,DF,63), V(82,31,1A,E5), V(60,33,51,97), V(45,7F,53,62), \ 275 V(E0,77,64,B1), V(84,AE,6B,BB), V(1C,A0,81,FE), V(94,2B,08,F9), \ 276 V(58,68,48,70), V(19,FD,45,8F), V(87,6C,DE,94), V(B7,F8,7B,52), \ 277 V(23,D3,73,AB), V(E2,02,4B,72), V(57,8F,1F,E3), V(2A,AB,55,66), \ 278 V(07,28,EB,B2), V(03,C2,B5,2F), V(9A,7B,C5,86), V(A5,08,37,D3), \ 279 V(F2,87,28,30), V(B2,A5,BF,23), V(BA,6A,03,02), V(5C,82,16,ED), \ 280 V(2B,1C,CF,8A), V(92,B4,79,A7), V(F0,F2,07,F3), V(A1,E2,69,4E), \ 281 V(CD,F4,DA,65), V(D5,BE,05,06), V(1F,62,34,D1), V(8A,FE,A6,C4), \ 282 V(9D,53,2E,34), V(A0,55,F3,A2), V(32,E1,8A,05), V(75,EB,F6,A4), \ 283 V(39,EC,83,0B), V(AA,EF,60,40), V(06,9F,71,5E), V(51,10,6E,BD), \ 284 V(F9,8A,21,3E), V(3D,06,DD,96), V(AE,05,3E,DD), V(46,BD,E6,4D), \ 285 V(B5,8D,54,91), V(05,5D,C4,71), V(6F,D4,06,04), V(FF,15,50,60), \ 286 V(24,FB,98,19), V(97,E9,BD,D6), V(CC,43,40,89), V(77,9E,D9,67), \ 287 V(BD,42,E8,B0), V(88,8B,89,07), V(38,5B,19,E7), V(DB,EE,C8,79), \ 288 V(47,0A,7C,A1), V(E9,0F,42,7C), V(C9,1E,84,F8), V(00,00,00,00), \ 289 V(83,86,80,09), V(48,ED,2B,32), V(AC,70,11,1E), V(4E,72,5A,6C), \ 290 V(FB,FF,0E,FD), V(56,38,85,0F), V(1E,D5,AE,3D), V(27,39,2D,36), \ 291 V(64,D9,0F,0A), V(21,A6,5C,68), V(D1,54,5B,9B), V(3A,2E,36,24), \ 292 V(B1,67,0A,0C), V(0F,E7,57,93), V(D2,96,EE,B4), V(9E,91,9B,1B), \ 293 V(4F,C5,C0,80), V(A2,20,DC,61), V(69,4B,77,5A), V(16,1A,12,1C), \ 294 V(0A,BA,93,E2), V(E5,2A,A0,C0), V(43,E0,22,3C), V(1D,17,1B,12), \ 295 V(0B,0D,09,0E), V(AD,C7,8B,F2), V(B9,A8,B6,2D), V(C8,A9,1E,14), \ 296 V(85,19,F1,57), V(4C,07,75,AF), V(BB,DD,99,EE), V(FD,60,7F,A3), \ 297 V(9F,26,01,F7), V(BC,F5,72,5C), V(C5,3B,66,44), V(34,7E,FB,5B), \ 298 V(76,29,43,8B), V(DC,C6,23,CB), V(68,FC,ED,B6), V(63,F1,E4,B8), \ 299 V(CA,DC,31,D7), V(10,85,63,42), V(40,22,97,13), V(20,11,C6,84), \ 300 V(7D,24,4A,85), V(F8,3D,BB,D2), V(11,32,F9,AE), V(6D,A1,29,C7), \ 301 V(4B,2F,9E,1D), V(F3,30,B2,DC), V(EC,52,86,0D), V(D0,E3,C1,77), \ 302 V(6C,16,B3,2B), V(99,B9,70,A9), V(FA,48,94,11), V(22,64,E9,47), \ 303 V(C4,8C,FC,A8), V(1A,3F,F0,A0), V(D8,2C,7D,56), V(EF,90,33,22), \ 304 V(C7,4E,49,87), V(C1,D1,38,D9), V(FE,A2,CA,8C), V(36,0B,D4,98), \ 305 V(CF,81,F5,A6), V(28,DE,7A,A5), V(26,8E,B7,DA), V(A4,BF,AD,3F), \ 306 V(E4,9D,3A,2C), V(0D,92,78,50), V(9B,CC,5F,6A), V(62,46,7E,54), \ 307 V(C2,13,8D,F6), V(E8,B8,D8,90), V(5E,F7,39,2E), V(F5,AF,C3,82), \ 308 V(BE,80,5D,9F), V(7C,93,D0,69), V(A9,2D,D5,6F), V(B3,12,25,CF), \ 309 V(3B,99,AC,C8), V(A7,7D,18,10), V(6E,63,9C,E8), V(7B,BB,3B,DB), \ 310 V(09,78,26,CD), V(F4,18,59,6E), V(01,B7,9A,EC), V(A8,9A,4F,83), \ 311 V(65,6E,95,E6), V(7E,E6,FF,AA), V(08,CF,BC,21), V(E6,E8,15,EF), \ 312 V(D9,9B,E7,BA), V(CE,36,6F,4A), V(D4,09,9F,EA), V(D6,7C,B0,29), \ 313 V(AF,B2,A4,31), V(31,23,3F,2A), V(30,94,A5,C6), V(C0,66,A2,35), \ 314 V(37,BC,4E,74), V(A6,CA,82,FC), V(B0,D0,90,E0), V(15,D8,A7,33), \ 315 V(4A,98,04,F1), V(F7,DA,EC,41), V(0E,50,CD,7F), V(2F,F6,91,17), \ 316 V(8D,D6,4D,76), V(4D,B0,EF,43), V(54,4D,AA,CC), V(DF,04,96,E4), \ 317 V(E3,B5,D1,9E), V(1B,88,6A,4C), V(B8,1F,2C,C1), V(7F,51,65,46), \ 318 V(04,EA,5E,9D), V(5D,35,8C,01), V(73,74,87,FA), V(2E,41,0B,FB), \ 319 V(5A,1D,67,B3), V(52,D2,DB,92), V(33,56,10,E9), V(13,47,D6,6D), \ 320 V(8C,61,D7,9A), V(7A,0C,A1,37), V(8E,14,F8,59), V(89,3C,13,EB), \ 321 V(EE,27,A9,CE), V(35,C9,61,B7), V(ED,E5,1C,E1), V(3C,B1,47,7A), \ 322 V(59,DF,D2,9C), V(3F,73,F2,55), V(79,CE,14,18), V(BF,37,C7,73), \ 323 V(EA,CD,F7,53), V(5B,AA,FD,5F), V(14,6F,3D,DF), V(86,DB,44,78), \ 324 V(81,F3,AF,CA), V(3E,C4,68,B9), V(2C,34,24,38), V(5F,40,A3,C2), \ 325 V(72,C3,1D,16), V(0C,25,E2,BC), V(8B,49,3C,28), V(41,95,0D,FF), \ 326 V(71,01,A8,39), V(DE,B3,0C,08), V(9C,E4,B4,D8), V(90,C1,56,64), \ 327 V(61,84,CB,7B), V(70,B6,32,D5), V(74,5C,6C,48), V(42,57,B8,D0) 328 329 #define V(a,b,c,d) 0x##a##b##c##d 330 static const uint32_t RT0[256] = { RT }; 331 #undef V 332 333 #define V(a,b,c,d) 0x##b##c##d##a 334 static const uint32_t RT1[256] = { RT }; 335 #undef V 336 337 #define V(a,b,c,d) 0x##c##d##a##b 338 static const uint32_t RT2[256] = { RT }; 339 #undef V 340 341 #define V(a,b,c,d) 0x##d##a##b##c 342 static const uint32_t RT3[256] = { RT }; 343 #undef V 344 345 #undef RT 346 347 /* 348 * Round constants 349 */ 350 static const uint32_t RCON[10] = 351 { 352 0x00000001, 0x00000002, 0x00000004, 0x00000008, 353 0x00000010, 0x00000020, 0x00000040, 0x00000080, 354 0x0000001B, 0x00000036 355 }; 356 357 #else /* MBEDTLS_AES_ROM_TABLES */ 358 359 /* 360 * Forward S-box & tables 361 */ 362 static unsigned char FSb[256]; 363 static uint32_t FT0[256]; 364 static uint32_t FT1[256]; 365 static uint32_t FT2[256]; 366 static uint32_t FT3[256]; 367 368 /* 369 * Reverse S-box & tables 370 */ 371 static unsigned char RSb[256]; 372 static uint32_t RT0[256]; 373 static uint32_t RT1[256]; 374 static uint32_t RT2[256]; 375 static uint32_t RT3[256]; 376 377 /* 378 * Round constants 379 */ 380 static uint32_t RCON[10]; 381 382 /* 383 * Tables generation code 384 */ 385 #define ROTL8(x) ( ( x << 8 ) & 0xFFFFFFFF ) | ( x >> 24 ) 386 #define XTIME(x) ( ( x << 1 ) ^ ( ( x & 0x80 ) ? 0x1B : 0x00 ) ) 387 #define MUL(x,y) ( ( x && y ) ? pow[(log[x]+log[y]) % 255] : 0 ) 388 389 static int aes_init_done = 0; 390 391 static void aes_gen_tables( void ) 392 { 393 int i, x, y, z; 394 int pow[256]; 395 int log[256]; 396 397 /* 398 * compute pow and log tables over GF(2^8) 399 */ 400 for( i = 0, x = 1; i < 256; i++ ) 401 { 402 pow[i] = x; 403 log[x] = i; 404 x = ( x ^ XTIME( x ) ) & 0xFF; 405 } 406 407 /* 408 * calculate the round constants 409 */ 410 for( i = 0, x = 1; i < 10; i++ ) 411 { 412 RCON[i] = (uint32_t) x; 413 x = XTIME( x ) & 0xFF; 414 } 415 416 /* 417 * generate the forward and reverse S-boxes 418 */ 419 FSb[0x00] = 0x63; 420 RSb[0x63] = 0x00; 421 422 for( i = 1; i < 256; i++ ) 423 { 424 x = pow[255 - log[i]]; 425 426 y = x; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF; 427 x ^= y; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF; 428 x ^= y; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF; 429 x ^= y; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF; 430 x ^= y ^ 0x63; 431 432 FSb[i] = (unsigned char) x; 433 RSb[x] = (unsigned char) i; 434 } 435 436 /* 437 * generate the forward and reverse tables 438 */ 439 for( i = 0; i < 256; i++ ) 440 { 441 x = FSb[i]; 442 y = XTIME( x ) & 0xFF; 443 z = ( y ^ x ) & 0xFF; 444 445 FT0[i] = ( (uint32_t) y ) ^ 446 ( (uint32_t) x << 8 ) ^ 447 ( (uint32_t) x << 16 ) ^ 448 ( (uint32_t) z << 24 ); 449 450 FT1[i] = ROTL8( FT0[i] ); 451 FT2[i] = ROTL8( FT1[i] ); 452 FT3[i] = ROTL8( FT2[i] ); 453 454 x = RSb[i]; 455 456 RT0[i] = ( (uint32_t) MUL( 0x0E, x ) ) ^ 457 ( (uint32_t) MUL( 0x09, x ) << 8 ) ^ 458 ( (uint32_t) MUL( 0x0D, x ) << 16 ) ^ 459 ( (uint32_t) MUL( 0x0B, x ) << 24 ); 460 461 RT1[i] = ROTL8( RT0[i] ); 462 RT2[i] = ROTL8( RT1[i] ); 463 RT3[i] = ROTL8( RT2[i] ); 464 } 465 } 466 467 #endif /* MBEDTLS_AES_ROM_TABLES */ 468 469 void mbedtls_aes_init( mbedtls_aes_context *ctx ) 470 { 471 memset( ctx, 0, sizeof( mbedtls_aes_context ) ); 472 } 473 474 void mbedtls_aes_free( mbedtls_aes_context *ctx ) 475 { 476 if( ctx == NULL ) 477 return; 478 479 mbedtls_zeroize( ctx, sizeof( mbedtls_aes_context ) ); 480 } 481 482 /* 483 * AES key schedule (encryption) 484 */ 485 #if !defined(MBEDTLS_AES_SETKEY_ENC_ALT) 486 int mbedtls_aes_setkey_enc( mbedtls_aes_context *ctx, const unsigned char *key, 487 unsigned int keybits ) 488 { 489 unsigned int i; 490 uint32_t *RK; 491 492 #if !defined(MBEDTLS_AES_ROM_TABLES) 493 if( aes_init_done == 0 ) 494 { 495 aes_gen_tables(); 496 aes_init_done = 1; 497 498 } 499 #endif 500 501 switch( keybits ) 502 { 503 case 128: ctx->nr = 10; break; 504 case 192: ctx->nr = 12; break; 505 case 256: ctx->nr = 14; break; 506 default : return( MBEDTLS_ERR_AES_INVALID_KEY_LENGTH ); 507 } 508 509 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_PADLOCK_ALIGN16) 510 if( aes_padlock_ace == -1 ) 511 aes_padlock_ace = mbedtls_padlock_has_support( MBEDTLS_PADLOCK_ACE ); 512 513 if( aes_padlock_ace ) 514 ctx->rk = RK = MBEDTLS_PADLOCK_ALIGN16( ctx->buf ); 515 else 516 #endif 517 ctx->rk = RK = ctx->buf; 518 519 #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64) 520 if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) ) 521 return( mbedtls_aesni_setkey_enc( (unsigned char *) ctx->rk, key, keybits ) ); 522 #endif 523 524 for( i = 0; i < ( keybits >> 5 ); i++ ) 525 { 526 GET_UINT32_LE( RK[i], key, i << 2 ); 527 } 528 529 switch( ctx->nr ) 530 { 531 case 10: 532 533 for( i = 0; i < 10; i++, RK += 4 ) 534 { 535 RK[4] = RK[0] ^ RCON[i] ^ 536 ( (uint32_t) FSb[ ( RK[3] >> 8 ) & 0xFF ] ) ^ 537 ( (uint32_t) FSb[ ( RK[3] >> 16 ) & 0xFF ] << 8 ) ^ 538 ( (uint32_t) FSb[ ( RK[3] >> 24 ) & 0xFF ] << 16 ) ^ 539 ( (uint32_t) FSb[ ( RK[3] ) & 0xFF ] << 24 ); 540 541 RK[5] = RK[1] ^ RK[4]; 542 RK[6] = RK[2] ^ RK[5]; 543 RK[7] = RK[3] ^ RK[6]; 544 } 545 break; 546 547 case 12: 548 549 for( i = 0; i < 8; i++, RK += 6 ) 550 { 551 RK[6] = RK[0] ^ RCON[i] ^ 552 ( (uint32_t) FSb[ ( RK[5] >> 8 ) & 0xFF ] ) ^ 553 ( (uint32_t) FSb[ ( RK[5] >> 16 ) & 0xFF ] << 8 ) ^ 554 ( (uint32_t) FSb[ ( RK[5] >> 24 ) & 0xFF ] << 16 ) ^ 555 ( (uint32_t) FSb[ ( RK[5] ) & 0xFF ] << 24 ); 556 557 RK[7] = RK[1] ^ RK[6]; 558 RK[8] = RK[2] ^ RK[7]; 559 RK[9] = RK[3] ^ RK[8]; 560 RK[10] = RK[4] ^ RK[9]; 561 RK[11] = RK[5] ^ RK[10]; 562 } 563 break; 564 565 case 14: 566 567 for( i = 0; i < 7; i++, RK += 8 ) 568 { 569 RK[8] = RK[0] ^ RCON[i] ^ 570 ( (uint32_t) FSb[ ( RK[7] >> 8 ) & 0xFF ] ) ^ 571 ( (uint32_t) FSb[ ( RK[7] >> 16 ) & 0xFF ] << 8 ) ^ 572 ( (uint32_t) FSb[ ( RK[7] >> 24 ) & 0xFF ] << 16 ) ^ 573 ( (uint32_t) FSb[ ( RK[7] ) & 0xFF ] << 24 ); 574 575 RK[9] = RK[1] ^ RK[8]; 576 RK[10] = RK[2] ^ RK[9]; 577 RK[11] = RK[3] ^ RK[10]; 578 579 RK[12] = RK[4] ^ 580 ( (uint32_t) FSb[ ( RK[11] ) & 0xFF ] ) ^ 581 ( (uint32_t) FSb[ ( RK[11] >> 8 ) & 0xFF ] << 8 ) ^ 582 ( (uint32_t) FSb[ ( RK[11] >> 16 ) & 0xFF ] << 16 ) ^ 583 ( (uint32_t) FSb[ ( RK[11] >> 24 ) & 0xFF ] << 24 ); 584 585 RK[13] = RK[5] ^ RK[12]; 586 RK[14] = RK[6] ^ RK[13]; 587 RK[15] = RK[7] ^ RK[14]; 588 } 589 break; 590 } 591 592 return( 0 ); 593 } 594 #endif /* !MBEDTLS_AES_SETKEY_ENC_ALT */ 595 596 /* 597 * AES key schedule (decryption) 598 */ 599 #if !defined(MBEDTLS_AES_SETKEY_DEC_ALT) 600 int mbedtls_aes_setkey_dec( mbedtls_aes_context *ctx, const unsigned char *key, 601 unsigned int keybits ) 602 { 603 int i, j, ret; 604 mbedtls_aes_context cty; 605 uint32_t *RK; 606 uint32_t *SK; 607 608 mbedtls_aes_init( &cty ); 609 610 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_PADLOCK_ALIGN16) 611 if( aes_padlock_ace == -1 ) 612 aes_padlock_ace = mbedtls_padlock_has_support( MBEDTLS_PADLOCK_ACE ); 613 614 if( aes_padlock_ace ) 615 ctx->rk = RK = MBEDTLS_PADLOCK_ALIGN16( ctx->buf ); 616 else 617 #endif 618 ctx->rk = RK = ctx->buf; 619 620 /* Also checks keybits */ 621 if( ( ret = mbedtls_aes_setkey_enc( &cty, key, keybits ) ) != 0 ) 622 goto exit; 623 624 ctx->nr = cty.nr; 625 626 #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64) 627 if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) ) 628 { 629 mbedtls_aesni_inverse_key( (unsigned char *) ctx->rk, 630 (const unsigned char *) cty.rk, ctx->nr ); 631 goto exit; 632 } 633 #endif 634 635 SK = cty.rk + cty.nr * 4; 636 637 *RK++ = *SK++; 638 *RK++ = *SK++; 639 *RK++ = *SK++; 640 *RK++ = *SK++; 641 642 for( i = ctx->nr - 1, SK -= 8; i > 0; i--, SK -= 8 ) 643 { 644 for( j = 0; j < 4; j++, SK++ ) 645 { 646 *RK++ = RT0[ FSb[ ( *SK ) & 0xFF ] ] ^ 647 RT1[ FSb[ ( *SK >> 8 ) & 0xFF ] ] ^ 648 RT2[ FSb[ ( *SK >> 16 ) & 0xFF ] ] ^ 649 RT3[ FSb[ ( *SK >> 24 ) & 0xFF ] ]; 650 } 651 } 652 653 *RK++ = *SK++; 654 *RK++ = *SK++; 655 *RK++ = *SK++; 656 *RK++ = *SK++; 657 658 exit: 659 mbedtls_aes_free( &cty ); 660 661 return( ret ); 662 } 663 #endif /* !MBEDTLS_AES_SETKEY_DEC_ALT */ 664 665 #define AES_FROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3) \ 666 { \ 667 X0 = *RK++ ^ FT0[ ( Y0 ) & 0xFF ] ^ \ 668 FT1[ ( Y1 >> 8 ) & 0xFF ] ^ \ 669 FT2[ ( Y2 >> 16 ) & 0xFF ] ^ \ 670 FT3[ ( Y3 >> 24 ) & 0xFF ]; \ 671 \ 672 X1 = *RK++ ^ FT0[ ( Y1 ) & 0xFF ] ^ \ 673 FT1[ ( Y2 >> 8 ) & 0xFF ] ^ \ 674 FT2[ ( Y3 >> 16 ) & 0xFF ] ^ \ 675 FT3[ ( Y0 >> 24 ) & 0xFF ]; \ 676 \ 677 X2 = *RK++ ^ FT0[ ( Y2 ) & 0xFF ] ^ \ 678 FT1[ ( Y3 >> 8 ) & 0xFF ] ^ \ 679 FT2[ ( Y0 >> 16 ) & 0xFF ] ^ \ 680 FT3[ ( Y1 >> 24 ) & 0xFF ]; \ 681 \ 682 X3 = *RK++ ^ FT0[ ( Y3 ) & 0xFF ] ^ \ 683 FT1[ ( Y0 >> 8 ) & 0xFF ] ^ \ 684 FT2[ ( Y1 >> 16 ) & 0xFF ] ^ \ 685 FT3[ ( Y2 >> 24 ) & 0xFF ]; \ 686 } 687 688 #define AES_RROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3) \ 689 { \ 690 X0 = *RK++ ^ RT0[ ( Y0 ) & 0xFF ] ^ \ 691 RT1[ ( Y3 >> 8 ) & 0xFF ] ^ \ 692 RT2[ ( Y2 >> 16 ) & 0xFF ] ^ \ 693 RT3[ ( Y1 >> 24 ) & 0xFF ]; \ 694 \ 695 X1 = *RK++ ^ RT0[ ( Y1 ) & 0xFF ] ^ \ 696 RT1[ ( Y0 >> 8 ) & 0xFF ] ^ \ 697 RT2[ ( Y3 >> 16 ) & 0xFF ] ^ \ 698 RT3[ ( Y2 >> 24 ) & 0xFF ]; \ 699 \ 700 X2 = *RK++ ^ RT0[ ( Y2 ) & 0xFF ] ^ \ 701 RT1[ ( Y1 >> 8 ) & 0xFF ] ^ \ 702 RT2[ ( Y0 >> 16 ) & 0xFF ] ^ \ 703 RT3[ ( Y3 >> 24 ) & 0xFF ]; \ 704 \ 705 X3 = *RK++ ^ RT0[ ( Y3 ) & 0xFF ] ^ \ 706 RT1[ ( Y2 >> 8 ) & 0xFF ] ^ \ 707 RT2[ ( Y1 >> 16 ) & 0xFF ] ^ \ 708 RT3[ ( Y0 >> 24 ) & 0xFF ]; \ 709 } 710 711 /* 712 * AES-ECB block encryption 713 */ 714 #if !defined(MBEDTLS_AES_ENCRYPT_ALT) 715 int mbedtls_internal_aes_encrypt( mbedtls_aes_context *ctx, 716 const unsigned char input[16], 717 unsigned char output[16] ) 718 { 719 int i; 720 uint32_t *RK, X0, X1, X2, X3, Y0, Y1, Y2, Y3; 721 722 RK = ctx->rk; 723 724 GET_UINT32_LE( X0, input, 0 ); X0 ^= *RK++; 725 GET_UINT32_LE( X1, input, 4 ); X1 ^= *RK++; 726 GET_UINT32_LE( X2, input, 8 ); X2 ^= *RK++; 727 GET_UINT32_LE( X3, input, 12 ); X3 ^= *RK++; 728 729 for( i = ( ctx->nr >> 1 ) - 1; i > 0; i-- ) 730 { 731 AES_FROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 ); 732 AES_FROUND( X0, X1, X2, X3, Y0, Y1, Y2, Y3 ); 733 } 734 735 AES_FROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 ); 736 737 X0 = *RK++ ^ \ 738 ( (uint32_t) FSb[ ( Y0 ) & 0xFF ] ) ^ 739 ( (uint32_t) FSb[ ( Y1 >> 8 ) & 0xFF ] << 8 ) ^ 740 ( (uint32_t) FSb[ ( Y2 >> 16 ) & 0xFF ] << 16 ) ^ 741 ( (uint32_t) FSb[ ( Y3 >> 24 ) & 0xFF ] << 24 ); 742 743 X1 = *RK++ ^ \ 744 ( (uint32_t) FSb[ ( Y1 ) & 0xFF ] ) ^ 745 ( (uint32_t) FSb[ ( Y2 >> 8 ) & 0xFF ] << 8 ) ^ 746 ( (uint32_t) FSb[ ( Y3 >> 16 ) & 0xFF ] << 16 ) ^ 747 ( (uint32_t) FSb[ ( Y0 >> 24 ) & 0xFF ] << 24 ); 748 749 X2 = *RK++ ^ \ 750 ( (uint32_t) FSb[ ( Y2 ) & 0xFF ] ) ^ 751 ( (uint32_t) FSb[ ( Y3 >> 8 ) & 0xFF ] << 8 ) ^ 752 ( (uint32_t) FSb[ ( Y0 >> 16 ) & 0xFF ] << 16 ) ^ 753 ( (uint32_t) FSb[ ( Y1 >> 24 ) & 0xFF ] << 24 ); 754 755 X3 = *RK++ ^ \ 756 ( (uint32_t) FSb[ ( Y3 ) & 0xFF ] ) ^ 757 ( (uint32_t) FSb[ ( Y0 >> 8 ) & 0xFF ] << 8 ) ^ 758 ( (uint32_t) FSb[ ( Y1 >> 16 ) & 0xFF ] << 16 ) ^ 759 ( (uint32_t) FSb[ ( Y2 >> 24 ) & 0xFF ] << 24 ); 760 761 PUT_UINT32_LE( X0, output, 0 ); 762 PUT_UINT32_LE( X1, output, 4 ); 763 PUT_UINT32_LE( X2, output, 8 ); 764 PUT_UINT32_LE( X3, output, 12 ); 765 766 return( 0 ); 767 } 768 #endif /* !MBEDTLS_AES_ENCRYPT_ALT */ 769 770 void mbedtls_aes_encrypt( mbedtls_aes_context *ctx, 771 const unsigned char input[16], 772 unsigned char output[16] ) 773 { 774 mbedtls_internal_aes_encrypt( ctx, input, output ); 775 } 776 777 /* 778 * AES-ECB block decryption 779 */ 780 #if !defined(MBEDTLS_AES_DECRYPT_ALT) 781 int mbedtls_internal_aes_decrypt( mbedtls_aes_context *ctx, 782 const unsigned char input[16], 783 unsigned char output[16] ) 784 { 785 int i; 786 uint32_t *RK, X0, X1, X2, X3, Y0, Y1, Y2, Y3; 787 788 RK = ctx->rk; 789 790 GET_UINT32_LE( X0, input, 0 ); X0 ^= *RK++; 791 GET_UINT32_LE( X1, input, 4 ); X1 ^= *RK++; 792 GET_UINT32_LE( X2, input, 8 ); X2 ^= *RK++; 793 GET_UINT32_LE( X3, input, 12 ); X3 ^= *RK++; 794 795 for( i = ( ctx->nr >> 1 ) - 1; i > 0; i-- ) 796 { 797 AES_RROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 ); 798 AES_RROUND( X0, X1, X2, X3, Y0, Y1, Y2, Y3 ); 799 } 800 801 AES_RROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 ); 802 803 X0 = *RK++ ^ \ 804 ( (uint32_t) RSb[ ( Y0 ) & 0xFF ] ) ^ 805 ( (uint32_t) RSb[ ( Y3 >> 8 ) & 0xFF ] << 8 ) ^ 806 ( (uint32_t) RSb[ ( Y2 >> 16 ) & 0xFF ] << 16 ) ^ 807 ( (uint32_t) RSb[ ( Y1 >> 24 ) & 0xFF ] << 24 ); 808 809 X1 = *RK++ ^ \ 810 ( (uint32_t) RSb[ ( Y1 ) & 0xFF ] ) ^ 811 ( (uint32_t) RSb[ ( Y0 >> 8 ) & 0xFF ] << 8 ) ^ 812 ( (uint32_t) RSb[ ( Y3 >> 16 ) & 0xFF ] << 16 ) ^ 813 ( (uint32_t) RSb[ ( Y2 >> 24 ) & 0xFF ] << 24 ); 814 815 X2 = *RK++ ^ \ 816 ( (uint32_t) RSb[ ( Y2 ) & 0xFF ] ) ^ 817 ( (uint32_t) RSb[ ( Y1 >> 8 ) & 0xFF ] << 8 ) ^ 818 ( (uint32_t) RSb[ ( Y0 >> 16 ) & 0xFF ] << 16 ) ^ 819 ( (uint32_t) RSb[ ( Y3 >> 24 ) & 0xFF ] << 24 ); 820 821 X3 = *RK++ ^ \ 822 ( (uint32_t) RSb[ ( Y3 ) & 0xFF ] ) ^ 823 ( (uint32_t) RSb[ ( Y2 >> 8 ) & 0xFF ] << 8 ) ^ 824 ( (uint32_t) RSb[ ( Y1 >> 16 ) & 0xFF ] << 16 ) ^ 825 ( (uint32_t) RSb[ ( Y0 >> 24 ) & 0xFF ] << 24 ); 826 827 PUT_UINT32_LE( X0, output, 0 ); 828 PUT_UINT32_LE( X1, output, 4 ); 829 PUT_UINT32_LE( X2, output, 8 ); 830 PUT_UINT32_LE( X3, output, 12 ); 831 832 return( 0 ); 833 } 834 #endif /* !MBEDTLS_AES_DECRYPT_ALT */ 835 836 void mbedtls_aes_decrypt( mbedtls_aes_context *ctx, 837 const unsigned char input[16], 838 unsigned char output[16] ) 839 { 840 mbedtls_internal_aes_decrypt( ctx, input, output ); 841 } 842 843 /* 844 * AES-ECB block encryption/decryption 845 */ 846 int mbedtls_aes_crypt_ecb( mbedtls_aes_context *ctx, 847 int mode, 848 const unsigned char input[16], 849 unsigned char output[16] ) 850 { 851 #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64) 852 if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) ) 853 return( mbedtls_aesni_crypt_ecb( ctx, mode, input, output ) ); 854 #endif 855 856 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_HAVE_X86) 857 if( aes_padlock_ace ) 858 { 859 if( mbedtls_padlock_xcryptecb( ctx, mode, input, output ) == 0 ) 860 return( 0 ); 861 862 // If padlock data misaligned, we just fall back to 863 // unaccelerated mode 864 // 865 } 866 #endif 867 868 if( mode == MBEDTLS_AES_ENCRYPT ) 869 return( mbedtls_internal_aes_encrypt( ctx, input, output ) ); 870 else 871 return( mbedtls_internal_aes_decrypt( ctx, input, output ) ); 872 } 873 874 #if defined(MBEDTLS_CIPHER_MODE_CBC) 875 /* 876 * AES-CBC buffer encryption/decryption 877 */ 878 int mbedtls_aes_crypt_cbc( mbedtls_aes_context *ctx, 879 int mode, 880 size_t length, 881 unsigned char iv[16], 882 const unsigned char *input, 883 unsigned char *output ) 884 { 885 int i; 886 unsigned char temp[16]; 887 888 if( length % 16 ) 889 return( MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH ); 890 891 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_HAVE_X86) 892 if( aes_padlock_ace ) 893 { 894 if( mbedtls_padlock_xcryptcbc( ctx, mode, length, iv, input, output ) == 0 ) 895 return( 0 ); 896 897 // If padlock data misaligned, we just fall back to 898 // unaccelerated mode 899 // 900 } 901 #endif 902 903 if( mode == MBEDTLS_AES_DECRYPT ) 904 { 905 while( length > 0 ) 906 { 907 memcpy( temp, input, 16 ); 908 mbedtls_aes_crypt_ecb( ctx, mode, input, output ); 909 910 for( i = 0; i < 16; i++ ) 911 output[i] = (unsigned char)( output[i] ^ iv[i] ); 912 913 memcpy( iv, temp, 16 ); 914 915 input += 16; 916 output += 16; 917 length -= 16; 918 } 919 } 920 else 921 { 922 while( length > 0 ) 923 { 924 for( i = 0; i < 16; i++ ) 925 output[i] = (unsigned char)( input[i] ^ iv[i] ); 926 927 mbedtls_aes_crypt_ecb( ctx, mode, output, output ); 928 memcpy( iv, output, 16 ); 929 930 input += 16; 931 output += 16; 932 length -= 16; 933 } 934 } 935 936 return( 0 ); 937 } 938 #endif /* MBEDTLS_CIPHER_MODE_CBC */ 939 940 #if defined(MBEDTLS_CIPHER_MODE_CFB) 941 /* 942 * AES-CFB128 buffer encryption/decryption 943 */ 944 int mbedtls_aes_crypt_cfb128( mbedtls_aes_context *ctx, 945 int mode, 946 size_t length, 947 size_t *iv_off, 948 unsigned char iv[16], 949 const unsigned char *input, 950 unsigned char *output ) 951 { 952 int c; 953 size_t n = *iv_off; 954 955 if( mode == MBEDTLS_AES_DECRYPT ) 956 { 957 while( length-- ) 958 { 959 if( n == 0 ) 960 mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv ); 961 962 c = *input++; 963 *output++ = (unsigned char)( c ^ iv[n] ); 964 iv[n] = (unsigned char) c; 965 966 n = ( n + 1 ) & 0x0F; 967 } 968 } 969 else 970 { 971 while( length-- ) 972 { 973 if( n == 0 ) 974 mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv ); 975 976 iv[n] = *output++ = (unsigned char)( iv[n] ^ *input++ ); 977 978 n = ( n + 1 ) & 0x0F; 979 } 980 } 981 982 *iv_off = n; 983 984 return( 0 ); 985 } 986 987 /* 988 * AES-CFB8 buffer encryption/decryption 989 */ 990 int mbedtls_aes_crypt_cfb8( mbedtls_aes_context *ctx, 991 int mode, 992 size_t length, 993 unsigned char iv[16], 994 const unsigned char *input, 995 unsigned char *output ) 996 { 997 unsigned char c; 998 unsigned char ov[17]; 999 1000 while( length-- ) 1001 { 1002 memcpy( ov, iv, 16 ); 1003 mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv ); 1004 1005 if( mode == MBEDTLS_AES_DECRYPT ) 1006 ov[16] = *input; 1007 1008 c = *output++ = (unsigned char)( iv[0] ^ *input++ ); 1009 1010 if( mode == MBEDTLS_AES_ENCRYPT ) 1011 ov[16] = c; 1012 1013 memcpy( iv, ov + 1, 16 ); 1014 } 1015 1016 return( 0 ); 1017 } 1018 #endif /*MBEDTLS_CIPHER_MODE_CFB */ 1019 1020 #if defined(MBEDTLS_CIPHER_MODE_CTR) 1021 /* 1022 * AES-CTR buffer encryption/decryption 1023 */ 1024 int mbedtls_aes_crypt_ctr( mbedtls_aes_context *ctx, 1025 size_t length, 1026 size_t *nc_off, 1027 unsigned char nonce_counter[16], 1028 unsigned char stream_block[16], 1029 const unsigned char *input, 1030 unsigned char *output ) 1031 { 1032 int c, i; 1033 size_t n = *nc_off; 1034 1035 while( length-- ) 1036 { 1037 if( n == 0 ) { 1038 mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, nonce_counter, stream_block ); 1039 1040 for( i = 16; i > 0; i-- ) 1041 if( ++nonce_counter[i - 1] != 0 ) 1042 break; 1043 } 1044 c = *input++; 1045 *output++ = (unsigned char)( c ^ stream_block[n] ); 1046 1047 n = ( n + 1 ) & 0x0F; 1048 } 1049 1050 *nc_off = n; 1051 1052 return( 0 ); 1053 } 1054 #endif /* MBEDTLS_CIPHER_MODE_CTR */ 1055 1056 #endif /* !MBEDTLS_AES_ALT */ 1057 1058 #if defined(MBEDTLS_SELF_TEST) 1059 /* 1060 * AES test vectors from: 1061 * 1062 * http://csrc.nist.gov/archive/aes/rijndael/rijndael-vals.zip 1063 */ 1064 static const unsigned char aes_test_ecb_dec[3][16] = 1065 { 1066 { 0x44, 0x41, 0x6A, 0xC2, 0xD1, 0xF5, 0x3C, 0x58, 1067 0x33, 0x03, 0x91, 0x7E, 0x6B, 0xE9, 0xEB, 0xE0 }, 1068 { 0x48, 0xE3, 0x1E, 0x9E, 0x25, 0x67, 0x18, 0xF2, 1069 0x92, 0x29, 0x31, 0x9C, 0x19, 0xF1, 0x5B, 0xA4 }, 1070 { 0x05, 0x8C, 0xCF, 0xFD, 0xBB, 0xCB, 0x38, 0x2D, 1071 0x1F, 0x6F, 0x56, 0x58, 0x5D, 0x8A, 0x4A, 0xDE } 1072 }; 1073 1074 static const unsigned char aes_test_ecb_enc[3][16] = 1075 { 1076 { 0xC3, 0x4C, 0x05, 0x2C, 0xC0, 0xDA, 0x8D, 0x73, 1077 0x45, 0x1A, 0xFE, 0x5F, 0x03, 0xBE, 0x29, 0x7F }, 1078 { 0xF3, 0xF6, 0x75, 0x2A, 0xE8, 0xD7, 0x83, 0x11, 1079 0x38, 0xF0, 0x41, 0x56, 0x06, 0x31, 0xB1, 0x14 }, 1080 { 0x8B, 0x79, 0xEE, 0xCC, 0x93, 0xA0, 0xEE, 0x5D, 1081 0xFF, 0x30, 0xB4, 0xEA, 0x21, 0x63, 0x6D, 0xA4 } 1082 }; 1083 1084 #if defined(MBEDTLS_CIPHER_MODE_CBC) 1085 static const unsigned char aes_test_cbc_dec[3][16] = 1086 { 1087 { 0xFA, 0xCA, 0x37, 0xE0, 0xB0, 0xC8, 0x53, 0x73, 1088 0xDF, 0x70, 0x6E, 0x73, 0xF7, 0xC9, 0xAF, 0x86 }, 1089 { 0x5D, 0xF6, 0x78, 0xDD, 0x17, 0xBA, 0x4E, 0x75, 1090 0xB6, 0x17, 0x68, 0xC6, 0xAD, 0xEF, 0x7C, 0x7B }, 1091 { 0x48, 0x04, 0xE1, 0x81, 0x8F, 0xE6, 0x29, 0x75, 1092 0x19, 0xA3, 0xE8, 0x8C, 0x57, 0x31, 0x04, 0x13 } 1093 }; 1094 1095 static const unsigned char aes_test_cbc_enc[3][16] = 1096 { 1097 { 0x8A, 0x05, 0xFC, 0x5E, 0x09, 0x5A, 0xF4, 0x84, 1098 0x8A, 0x08, 0xD3, 0x28, 0xD3, 0x68, 0x8E, 0x3D }, 1099 { 0x7B, 0xD9, 0x66, 0xD5, 0x3A, 0xD8, 0xC1, 0xBB, 1100 0x85, 0xD2, 0xAD, 0xFA, 0xE8, 0x7B, 0xB1, 0x04 }, 1101 { 0xFE, 0x3C, 0x53, 0x65, 0x3E, 0x2F, 0x45, 0xB5, 1102 0x6F, 0xCD, 0x88, 0xB2, 0xCC, 0x89, 0x8F, 0xF0 } 1103 }; 1104 #endif /* MBEDTLS_CIPHER_MODE_CBC */ 1105 1106 #if defined(MBEDTLS_CIPHER_MODE_CFB) 1107 /* 1108 * AES-CFB128 test vectors from: 1109 * 1110 * http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf 1111 */ 1112 static const unsigned char aes_test_cfb128_key[3][32] = 1113 { 1114 { 0x2B, 0x7E, 0x15, 0x16, 0x28, 0xAE, 0xD2, 0xA6, 1115 0xAB, 0xF7, 0x15, 0x88, 0x09, 0xCF, 0x4F, 0x3C }, 1116 { 0x8E, 0x73, 0xB0, 0xF7, 0xDA, 0x0E, 0x64, 0x52, 1117 0xC8, 0x10, 0xF3, 0x2B, 0x80, 0x90, 0x79, 0xE5, 1118 0x62, 0xF8, 0xEA, 0xD2, 0x52, 0x2C, 0x6B, 0x7B }, 1119 { 0x60, 0x3D, 0xEB, 0x10, 0x15, 0xCA, 0x71, 0xBE, 1120 0x2B, 0x73, 0xAE, 0xF0, 0x85, 0x7D, 0x77, 0x81, 1121 0x1F, 0x35, 0x2C, 0x07, 0x3B, 0x61, 0x08, 0xD7, 1122 0x2D, 0x98, 0x10, 0xA3, 0x09, 0x14, 0xDF, 0xF4 } 1123 }; 1124 1125 static const unsigned char aes_test_cfb128_iv[16] = 1126 { 1127 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 1128 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F 1129 }; 1130 1131 static const unsigned char aes_test_cfb128_pt[64] = 1132 { 1133 0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96, 1134 0xE9, 0x3D, 0x7E, 0x11, 0x73, 0x93, 0x17, 0x2A, 1135 0xAE, 0x2D, 0x8A, 0x57, 0x1E, 0x03, 0xAC, 0x9C, 1136 0x9E, 0xB7, 0x6F, 0xAC, 0x45, 0xAF, 0x8E, 0x51, 1137 0x30, 0xC8, 0x1C, 0x46, 0xA3, 0x5C, 0xE4, 0x11, 1138 0xE5, 0xFB, 0xC1, 0x19, 0x1A, 0x0A, 0x52, 0xEF, 1139 0xF6, 0x9F, 0x24, 0x45, 0xDF, 0x4F, 0x9B, 0x17, 1140 0xAD, 0x2B, 0x41, 0x7B, 0xE6, 0x6C, 0x37, 0x10 1141 }; 1142 1143 static const unsigned char aes_test_cfb128_ct[3][64] = 1144 { 1145 { 0x3B, 0x3F, 0xD9, 0x2E, 0xB7, 0x2D, 0xAD, 0x20, 1146 0x33, 0x34, 0x49, 0xF8, 0xE8, 0x3C, 0xFB, 0x4A, 1147 0xC8, 0xA6, 0x45, 0x37, 0xA0, 0xB3, 0xA9, 0x3F, 1148 0xCD, 0xE3, 0xCD, 0xAD, 0x9F, 0x1C, 0xE5, 0x8B, 1149 0x26, 0x75, 0x1F, 0x67, 0xA3, 0xCB, 0xB1, 0x40, 1150 0xB1, 0x80, 0x8C, 0xF1, 0x87, 0xA4, 0xF4, 0xDF, 1151 0xC0, 0x4B, 0x05, 0x35, 0x7C, 0x5D, 0x1C, 0x0E, 1152 0xEA, 0xC4, 0xC6, 0x6F, 0x9F, 0xF7, 0xF2, 0xE6 }, 1153 { 0xCD, 0xC8, 0x0D, 0x6F, 0xDD, 0xF1, 0x8C, 0xAB, 1154 0x34, 0xC2, 0x59, 0x09, 0xC9, 0x9A, 0x41, 0x74, 1155 0x67, 0xCE, 0x7F, 0x7F, 0x81, 0x17, 0x36, 0x21, 1156 0x96, 0x1A, 0x2B, 0x70, 0x17, 0x1D, 0x3D, 0x7A, 1157 0x2E, 0x1E, 0x8A, 0x1D, 0xD5, 0x9B, 0x88, 0xB1, 1158 0xC8, 0xE6, 0x0F, 0xED, 0x1E, 0xFA, 0xC4, 0xC9, 1159 0xC0, 0x5F, 0x9F, 0x9C, 0xA9, 0x83, 0x4F, 0xA0, 1160 0x42, 0xAE, 0x8F, 0xBA, 0x58, 0x4B, 0x09, 0xFF }, 1161 { 0xDC, 0x7E, 0x84, 0xBF, 0xDA, 0x79, 0x16, 0x4B, 1162 0x7E, 0xCD, 0x84, 0x86, 0x98, 0x5D, 0x38, 0x60, 1163 0x39, 0xFF, 0xED, 0x14, 0x3B, 0x28, 0xB1, 0xC8, 1164 0x32, 0x11, 0x3C, 0x63, 0x31, 0xE5, 0x40, 0x7B, 1165 0xDF, 0x10, 0x13, 0x24, 0x15, 0xE5, 0x4B, 0x92, 1166 0xA1, 0x3E, 0xD0, 0xA8, 0x26, 0x7A, 0xE2, 0xF9, 1167 0x75, 0xA3, 0x85, 0x74, 0x1A, 0xB9, 0xCE, 0xF8, 1168 0x20, 0x31, 0x62, 0x3D, 0x55, 0xB1, 0xE4, 0x71 } 1169 }; 1170 #endif /* MBEDTLS_CIPHER_MODE_CFB */ 1171 1172 #if defined(MBEDTLS_CIPHER_MODE_CTR) 1173 /* 1174 * AES-CTR test vectors from: 1175 * 1176 * http://www.faqs.org/rfcs/rfc3686.html 1177 */ 1178 1179 static const unsigned char aes_test_ctr_key[3][16] = 1180 { 1181 { 0xAE, 0x68, 0x52, 0xF8, 0x12, 0x10, 0x67, 0xCC, 1182 0x4B, 0xF7, 0xA5, 0x76, 0x55, 0x77, 0xF3, 0x9E }, 1183 { 0x7E, 0x24, 0x06, 0x78, 0x17, 0xFA, 0xE0, 0xD7, 1184 0x43, 0xD6, 0xCE, 0x1F, 0x32, 0x53, 0x91, 0x63 }, 1185 { 0x76, 0x91, 0xBE, 0x03, 0x5E, 0x50, 0x20, 0xA8, 1186 0xAC, 0x6E, 0x61, 0x85, 0x29, 0xF9, 0xA0, 0xDC } 1187 }; 1188 1189 static const unsigned char aes_test_ctr_nonce_counter[3][16] = 1190 { 1191 { 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x00, 1192 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 }, 1193 { 0x00, 0x6C, 0xB6, 0xDB, 0xC0, 0x54, 0x3B, 0x59, 1194 0xDA, 0x48, 0xD9, 0x0B, 0x00, 0x00, 0x00, 0x01 }, 1195 { 0x00, 0xE0, 0x01, 0x7B, 0x27, 0x77, 0x7F, 0x3F, 1196 0x4A, 0x17, 0x86, 0xF0, 0x00, 0x00, 0x00, 0x01 } 1197 }; 1198 1199 static const unsigned char aes_test_ctr_pt[3][48] = 1200 { 1201 { 0x53, 0x69, 0x6E, 0x67, 0x6C, 0x65, 0x20, 0x62, 1202 0x6C, 0x6F, 0x63, 0x6B, 0x20, 0x6D, 0x73, 0x67 }, 1203 1204 { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 1205 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 1206 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 1207 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F }, 1208 1209 { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 1210 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 1211 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 1212 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 1213 0x20, 0x21, 0x22, 0x23 } 1214 }; 1215 1216 static const unsigned char aes_test_ctr_ct[3][48] = 1217 { 1218 { 0xE4, 0x09, 0x5D, 0x4F, 0xB7, 0xA7, 0xB3, 0x79, 1219 0x2D, 0x61, 0x75, 0xA3, 0x26, 0x13, 0x11, 0xB8 }, 1220 { 0x51, 0x04, 0xA1, 0x06, 0x16, 0x8A, 0x72, 0xD9, 1221 0x79, 0x0D, 0x41, 0xEE, 0x8E, 0xDA, 0xD3, 0x88, 1222 0xEB, 0x2E, 0x1E, 0xFC, 0x46, 0xDA, 0x57, 0xC8, 1223 0xFC, 0xE6, 0x30, 0xDF, 0x91, 0x41, 0xBE, 0x28 }, 1224 { 0xC1, 0xCF, 0x48, 0xA8, 0x9F, 0x2F, 0xFD, 0xD9, 1225 0xCF, 0x46, 0x52, 0xE9, 0xEF, 0xDB, 0x72, 0xD7, 1226 0x45, 0x40, 0xA4, 0x2B, 0xDE, 0x6D, 0x78, 0x36, 1227 0xD5, 0x9A, 0x5C, 0xEA, 0xAE, 0xF3, 0x10, 0x53, 1228 0x25, 0xB2, 0x07, 0x2F } 1229 }; 1230 1231 static const int aes_test_ctr_len[3] = 1232 { 16, 32, 36 }; 1233 #endif /* MBEDTLS_CIPHER_MODE_CTR */ 1234 1235 /* 1236 * Checkup routine 1237 */ 1238 int mbedtls_aes_self_test( int verbose ) 1239 { 1240 int ret = 0, i, j, u, v; 1241 unsigned char key[32]; 1242 unsigned char buf[64]; 1243 #if defined(MBEDTLS_CIPHER_MODE_CBC) || defined(MBEDTLS_CIPHER_MODE_CFB) 1244 unsigned char iv[16]; 1245 #endif 1246 #if defined(MBEDTLS_CIPHER_MODE_CBC) 1247 unsigned char prv[16]; 1248 #endif 1249 #if defined(MBEDTLS_CIPHER_MODE_CTR) || defined(MBEDTLS_CIPHER_MODE_CFB) 1250 size_t offset; 1251 #endif 1252 #if defined(MBEDTLS_CIPHER_MODE_CTR) 1253 int len; 1254 unsigned char nonce_counter[16]; 1255 unsigned char stream_block[16]; 1256 #endif 1257 mbedtls_aes_context ctx; 1258 1259 memset( key, 0, 32 ); 1260 mbedtls_aes_init( &ctx ); 1261 1262 /* 1263 * ECB mode 1264 */ 1265 for( i = 0; i < 6; i++ ) 1266 { 1267 u = i >> 1; 1268 v = i & 1; 1269 1270 if( verbose != 0 ) 1271 mbedtls_printf( " AES-ECB-%3d (%s): ", 128 + u * 64, 1272 ( v == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" ); 1273 1274 memset( buf, 0, 16 ); 1275 1276 if( v == MBEDTLS_AES_DECRYPT ) 1277 { 1278 mbedtls_aes_setkey_dec( &ctx, key, 128 + u * 64 ); 1279 1280 for( j = 0; j < 10000; j++ ) 1281 mbedtls_aes_crypt_ecb( &ctx, v, buf, buf ); 1282 1283 if( memcmp( buf, aes_test_ecb_dec[u], 16 ) != 0 ) 1284 { 1285 if( verbose != 0 ) 1286 mbedtls_printf( "failed\n" ); 1287 1288 ret = 1; 1289 goto exit; 1290 } 1291 } 1292 else 1293 { 1294 mbedtls_aes_setkey_enc( &ctx, key, 128 + u * 64 ); 1295 1296 for( j = 0; j < 10000; j++ ) 1297 mbedtls_aes_crypt_ecb( &ctx, v, buf, buf ); 1298 1299 if( memcmp( buf, aes_test_ecb_enc[u], 16 ) != 0 ) 1300 { 1301 if( verbose != 0 ) 1302 mbedtls_printf( "failed\n" ); 1303 1304 ret = 1; 1305 goto exit; 1306 } 1307 } 1308 1309 if( verbose != 0 ) 1310 mbedtls_printf( "passed\n" ); 1311 } 1312 1313 if( verbose != 0 ) 1314 mbedtls_printf( "\n" ); 1315 1316 #if defined(MBEDTLS_CIPHER_MODE_CBC) 1317 /* 1318 * CBC mode 1319 */ 1320 for( i = 0; i < 6; i++ ) 1321 { 1322 u = i >> 1; 1323 v = i & 1; 1324 1325 if( verbose != 0 ) 1326 mbedtls_printf( " AES-CBC-%3d (%s): ", 128 + u * 64, 1327 ( v == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" ); 1328 1329 memset( iv , 0, 16 ); 1330 memset( prv, 0, 16 ); 1331 memset( buf, 0, 16 ); 1332 1333 if( v == MBEDTLS_AES_DECRYPT ) 1334 { 1335 mbedtls_aes_setkey_dec( &ctx, key, 128 + u * 64 ); 1336 1337 for( j = 0; j < 10000; j++ ) 1338 mbedtls_aes_crypt_cbc( &ctx, v, 16, iv, buf, buf ); 1339 1340 if( memcmp( buf, aes_test_cbc_dec[u], 16 ) != 0 ) 1341 { 1342 if( verbose != 0 ) 1343 mbedtls_printf( "failed\n" ); 1344 1345 ret = 1; 1346 goto exit; 1347 } 1348 } 1349 else 1350 { 1351 mbedtls_aes_setkey_enc( &ctx, key, 128 + u * 64 ); 1352 1353 for( j = 0; j < 10000; j++ ) 1354 { 1355 unsigned char tmp[16]; 1356 1357 mbedtls_aes_crypt_cbc( &ctx, v, 16, iv, buf, buf ); 1358 1359 memcpy( tmp, prv, 16 ); 1360 memcpy( prv, buf, 16 ); 1361 memcpy( buf, tmp, 16 ); 1362 } 1363 1364 if( memcmp( prv, aes_test_cbc_enc[u], 16 ) != 0 ) 1365 { 1366 if( verbose != 0 ) 1367 mbedtls_printf( "failed\n" ); 1368 1369 ret = 1; 1370 goto exit; 1371 } 1372 } 1373 1374 if( verbose != 0 ) 1375 mbedtls_printf( "passed\n" ); 1376 } 1377 1378 if( verbose != 0 ) 1379 mbedtls_printf( "\n" ); 1380 #endif /* MBEDTLS_CIPHER_MODE_CBC */ 1381 1382 #if defined(MBEDTLS_CIPHER_MODE_CFB) 1383 /* 1384 * CFB128 mode 1385 */ 1386 for( i = 0; i < 6; i++ ) 1387 { 1388 u = i >> 1; 1389 v = i & 1; 1390 1391 if( verbose != 0 ) 1392 mbedtls_printf( " AES-CFB128-%3d (%s): ", 128 + u * 64, 1393 ( v == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" ); 1394 1395 memcpy( iv, aes_test_cfb128_iv, 16 ); 1396 memcpy( key, aes_test_cfb128_key[u], 16 + u * 8 ); 1397 1398 offset = 0; 1399 mbedtls_aes_setkey_enc( &ctx, key, 128 + u * 64 ); 1400 1401 if( v == MBEDTLS_AES_DECRYPT ) 1402 { 1403 memcpy( buf, aes_test_cfb128_ct[u], 64 ); 1404 mbedtls_aes_crypt_cfb128( &ctx, v, 64, &offset, iv, buf, buf ); 1405 1406 if( memcmp( buf, aes_test_cfb128_pt, 64 ) != 0 ) 1407 { 1408 if( verbose != 0 ) 1409 mbedtls_printf( "failed\n" ); 1410 1411 ret = 1; 1412 goto exit; 1413 } 1414 } 1415 else 1416 { 1417 memcpy( buf, aes_test_cfb128_pt, 64 ); 1418 mbedtls_aes_crypt_cfb128( &ctx, v, 64, &offset, iv, buf, buf ); 1419 1420 if( memcmp( buf, aes_test_cfb128_ct[u], 64 ) != 0 ) 1421 { 1422 if( verbose != 0 ) 1423 mbedtls_printf( "failed\n" ); 1424 1425 ret = 1; 1426 goto exit; 1427 } 1428 } 1429 1430 if( verbose != 0 ) 1431 mbedtls_printf( "passed\n" ); 1432 } 1433 1434 if( verbose != 0 ) 1435 mbedtls_printf( "\n" ); 1436 #endif /* MBEDTLS_CIPHER_MODE_CFB */ 1437 1438 #if defined(MBEDTLS_CIPHER_MODE_CTR) 1439 /* 1440 * CTR mode 1441 */ 1442 for( i = 0; i < 6; i++ ) 1443 { 1444 u = i >> 1; 1445 v = i & 1; 1446 1447 if( verbose != 0 ) 1448 mbedtls_printf( " AES-CTR-128 (%s): ", 1449 ( v == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" ); 1450 1451 memcpy( nonce_counter, aes_test_ctr_nonce_counter[u], 16 ); 1452 memcpy( key, aes_test_ctr_key[u], 16 ); 1453 1454 offset = 0; 1455 mbedtls_aes_setkey_enc( &ctx, key, 128 ); 1456 1457 if( v == MBEDTLS_AES_DECRYPT ) 1458 { 1459 len = aes_test_ctr_len[u]; 1460 memcpy( buf, aes_test_ctr_ct[u], len ); 1461 1462 mbedtls_aes_crypt_ctr( &ctx, len, &offset, nonce_counter, stream_block, 1463 buf, buf ); 1464 1465 if( memcmp( buf, aes_test_ctr_pt[u], len ) != 0 ) 1466 { 1467 if( verbose != 0 ) 1468 mbedtls_printf( "failed\n" ); 1469 1470 ret = 1; 1471 goto exit; 1472 } 1473 } 1474 else 1475 { 1476 len = aes_test_ctr_len[u]; 1477 memcpy( buf, aes_test_ctr_pt[u], len ); 1478 1479 mbedtls_aes_crypt_ctr( &ctx, len, &offset, nonce_counter, stream_block, 1480 buf, buf ); 1481 1482 if( memcmp( buf, aes_test_ctr_ct[u], len ) != 0 ) 1483 { 1484 if( verbose != 0 ) 1485 mbedtls_printf( "failed\n" ); 1486 1487 ret = 1; 1488 goto exit; 1489 } 1490 } 1491 1492 if( verbose != 0 ) 1493 mbedtls_printf( "passed\n" ); 1494 } 1495 1496 if( verbose != 0 ) 1497 mbedtls_printf( "\n" ); 1498 #endif /* MBEDTLS_CIPHER_MODE_CTR */ 1499 1500 ret = 0; 1501 1502 exit: 1503 mbedtls_aes_free( &ctx ); 1504 1505 return( ret ); 1506 } 1507 1508 #endif /* MBEDTLS_SELF_TEST */ 1509 1510 #endif /* MBEDTLS_AES_C */ 1511