1// Copyright 2009 The Go Authors. All rights reserved. 2// Use of this source code is governed by a BSD-style 3// license that can be found in the LICENSE file. 4 5// This Go implementation is derived in part from the reference 6// ANSI C implementation, which carries the following notice: 7// 8// rijndael-alg-fst.c 9// 10// @version 3.0 (December 2000) 11// 12// Optimised ANSI C code for the Rijndael cipher (now AES) 13// 14// @author Vincent Rijmen <vincent.rijmen@esat.kuleuven.ac.be> 15// @author Antoon Bosselaers <antoon.bosselaers@esat.kuleuven.ac.be> 16// @author Paulo Barreto <paulo.barreto@terra.com.br> 17// 18// This code is hereby placed in the public domain. 19// 20// THIS SOFTWARE IS PROVIDED BY THE AUTHORS ''AS IS'' AND ANY EXPRESS 21// OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 22// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23// ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE 24// LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 25// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 26// SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR 27// BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 28// WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE 29// OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, 30// EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31// 32// See FIPS 197 for specification, and see Daemen and Rijmen's Rijndael submission 33// for implementation details. 34// https://csrc.nist.gov/csrc/media/publications/fips/197/final/documents/fips-197.pdf 35// https://csrc.nist.gov/archive/aes/rijndael/Rijndael-ammended.pdf 36 37package aes 38 39import ( 40 "encoding/binary" 41) 42 43// Encrypt one block from src into dst, using the expanded key xk. 44func encryptBlockGo(xk []uint32, dst, src []byte) { 45 _ = src[15] // early bounds check 46 s0 := binary.BigEndian.Uint32(src[0:4]) 47 s1 := binary.BigEndian.Uint32(src[4:8]) 48 s2 := binary.BigEndian.Uint32(src[8:12]) 49 s3 := binary.BigEndian.Uint32(src[12:16]) 50 51 // First round just XORs input with key. 52 s0 ^= xk[0] 53 s1 ^= xk[1] 54 s2 ^= xk[2] 55 s3 ^= xk[3] 56 57 // Middle rounds shuffle using tables. 58 // Number of rounds is set by length of expanded key. 59 nr := len(xk)/4 - 2 // - 2: one above, one more below 60 k := 4 61 var t0, t1, t2, t3 uint32 62 for r := 0; r < nr; r++ { 63 t0 = xk[k+0] ^ te0[uint8(s0>>24)] ^ te1[uint8(s1>>16)] ^ te2[uint8(s2>>8)] ^ te3[uint8(s3)] 64 t1 = xk[k+1] ^ te0[uint8(s1>>24)] ^ te1[uint8(s2>>16)] ^ te2[uint8(s3>>8)] ^ te3[uint8(s0)] 65 t2 = xk[k+2] ^ te0[uint8(s2>>24)] ^ te1[uint8(s3>>16)] ^ te2[uint8(s0>>8)] ^ te3[uint8(s1)] 66 t3 = xk[k+3] ^ te0[uint8(s3>>24)] ^ te1[uint8(s0>>16)] ^ te2[uint8(s1>>8)] ^ te3[uint8(s2)] 67 k += 4 68 s0, s1, s2, s3 = t0, t1, t2, t3 69 } 70 71 // Last round uses s-box directly and XORs to produce output. 72 s0 = uint32(sbox0[t0>>24])<<24 | uint32(sbox0[t1>>16&0xff])<<16 | uint32(sbox0[t2>>8&0xff])<<8 | uint32(sbox0[t3&0xff]) 73 s1 = uint32(sbox0[t1>>24])<<24 | uint32(sbox0[t2>>16&0xff])<<16 | uint32(sbox0[t3>>8&0xff])<<8 | uint32(sbox0[t0&0xff]) 74 s2 = uint32(sbox0[t2>>24])<<24 | uint32(sbox0[t3>>16&0xff])<<16 | uint32(sbox0[t0>>8&0xff])<<8 | uint32(sbox0[t1&0xff]) 75 s3 = uint32(sbox0[t3>>24])<<24 | uint32(sbox0[t0>>16&0xff])<<16 | uint32(sbox0[t1>>8&0xff])<<8 | uint32(sbox0[t2&0xff]) 76 77 s0 ^= xk[k+0] 78 s1 ^= xk[k+1] 79 s2 ^= xk[k+2] 80 s3 ^= xk[k+3] 81 82 _ = dst[15] // early bounds check 83 binary.BigEndian.PutUint32(dst[0:4], s0) 84 binary.BigEndian.PutUint32(dst[4:8], s1) 85 binary.BigEndian.PutUint32(dst[8:12], s2) 86 binary.BigEndian.PutUint32(dst[12:16], s3) 87} 88 89// Decrypt one block from src into dst, using the expanded key xk. 90func decryptBlockGo(xk []uint32, dst, src []byte) { 91 _ = src[15] // early bounds check 92 s0 := binary.BigEndian.Uint32(src[0:4]) 93 s1 := binary.BigEndian.Uint32(src[4:8]) 94 s2 := binary.BigEndian.Uint32(src[8:12]) 95 s3 := binary.BigEndian.Uint32(src[12:16]) 96 97 // First round just XORs input with key. 98 s0 ^= xk[0] 99 s1 ^= xk[1] 100 s2 ^= xk[2] 101 s3 ^= xk[3] 102 103 // Middle rounds shuffle using tables. 104 // Number of rounds is set by length of expanded key. 105 nr := len(xk)/4 - 2 // - 2: one above, one more below 106 k := 4 107 var t0, t1, t2, t3 uint32 108 for r := 0; r < nr; r++ { 109 t0 = xk[k+0] ^ td0[uint8(s0>>24)] ^ td1[uint8(s3>>16)] ^ td2[uint8(s2>>8)] ^ td3[uint8(s1)] 110 t1 = xk[k+1] ^ td0[uint8(s1>>24)] ^ td1[uint8(s0>>16)] ^ td2[uint8(s3>>8)] ^ td3[uint8(s2)] 111 t2 = xk[k+2] ^ td0[uint8(s2>>24)] ^ td1[uint8(s1>>16)] ^ td2[uint8(s0>>8)] ^ td3[uint8(s3)] 112 t3 = xk[k+3] ^ td0[uint8(s3>>24)] ^ td1[uint8(s2>>16)] ^ td2[uint8(s1>>8)] ^ td3[uint8(s0)] 113 k += 4 114 s0, s1, s2, s3 = t0, t1, t2, t3 115 } 116 117 // Last round uses s-box directly and XORs to produce output. 118 s0 = uint32(sbox1[t0>>24])<<24 | uint32(sbox1[t3>>16&0xff])<<16 | uint32(sbox1[t2>>8&0xff])<<8 | uint32(sbox1[t1&0xff]) 119 s1 = uint32(sbox1[t1>>24])<<24 | uint32(sbox1[t0>>16&0xff])<<16 | uint32(sbox1[t3>>8&0xff])<<8 | uint32(sbox1[t2&0xff]) 120 s2 = uint32(sbox1[t2>>24])<<24 | uint32(sbox1[t1>>16&0xff])<<16 | uint32(sbox1[t0>>8&0xff])<<8 | uint32(sbox1[t3&0xff]) 121 s3 = uint32(sbox1[t3>>24])<<24 | uint32(sbox1[t2>>16&0xff])<<16 | uint32(sbox1[t1>>8&0xff])<<8 | uint32(sbox1[t0&0xff]) 122 123 s0 ^= xk[k+0] 124 s1 ^= xk[k+1] 125 s2 ^= xk[k+2] 126 s3 ^= xk[k+3] 127 128 _ = dst[15] // early bounds check 129 binary.BigEndian.PutUint32(dst[0:4], s0) 130 binary.BigEndian.PutUint32(dst[4:8], s1) 131 binary.BigEndian.PutUint32(dst[8:12], s2) 132 binary.BigEndian.PutUint32(dst[12:16], s3) 133} 134 135// Apply sbox0 to each byte in w. 136func subw(w uint32) uint32 { 137 return uint32(sbox0[w>>24])<<24 | 138 uint32(sbox0[w>>16&0xff])<<16 | 139 uint32(sbox0[w>>8&0xff])<<8 | 140 uint32(sbox0[w&0xff]) 141} 142 143// Rotate 144func rotw(w uint32) uint32 { return w<<8 | w>>24 } 145 146// Key expansion algorithm. See FIPS-197, Figure 11. 147// Their rcon[i] is our powx[i-1] << 24. 148func expandKeyGo(key []byte, enc, dec []uint32) { 149 // Encryption key setup. 150 var i int 151 nk := len(key) / 4 152 for i = 0; i < nk; i++ { 153 enc[i] = binary.BigEndian.Uint32(key[4*i:]) 154 } 155 for ; i < len(enc); i++ { 156 t := enc[i-1] 157 if i%nk == 0 { 158 t = subw(rotw(t)) ^ (uint32(powx[i/nk-1]) << 24) 159 } else if nk > 6 && i%nk == 4 { 160 t = subw(t) 161 } 162 enc[i] = enc[i-nk] ^ t 163 } 164 165 // Derive decryption key from encryption key. 166 // Reverse the 4-word round key sets from enc to produce dec. 167 // All sets but the first and last get the MixColumn transform applied. 168 if dec == nil { 169 return 170 } 171 n := len(enc) 172 for i := 0; i < n; i += 4 { 173 ei := n - i - 4 174 for j := 0; j < 4; j++ { 175 x := enc[ei+j] 176 if i > 0 && i+4 < n { 177 x = td0[sbox0[x>>24]] ^ td1[sbox0[x>>16&0xff]] ^ td2[sbox0[x>>8&0xff]] ^ td3[sbox0[x&0xff]] 178 } 179 dec[i+j] = x 180 } 181 } 182} 183