1 /* 2 * FIPS-197 compliant AES implementation 3 * 4 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved 5 * SPDX-License-Identifier: GPL-2.0 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License as published by 9 * the Free Software Foundation; either version 2 of the License, or 10 * (at your option) any later version. 11 * 12 * This program is distributed in the hope that it will be useful, 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15 * GNU General Public License for more details. 16 * 17 * You should have received a copy of the GNU General Public License along 18 * with this program; if not, write to the Free Software Foundation, Inc., 19 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. 20 * 21 * This file is part of mbed TLS (https://tls.mbed.org) 22 */ 23 /* 24 * The AES block cipher was designed by Vincent Rijmen and Joan Daemen. 25 * 26 * http://csrc.nist.gov/encryption/aes/rijndael/Rijndael.pdf 27 * http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf 28 */ 29 30 #if !defined(MBEDTLS_CONFIG_FILE) 31 #include "mbedtls/config.h" 32 #else 33 #include MBEDTLS_CONFIG_FILE 34 #endif 35 36 #if defined(MBEDTLS_AES_C) 37 38 #include <string.h> 39 40 #include "mbedtls/aes.h" 41 #if defined(MBEDTLS_PADLOCK_C) 42 #include "mbedtls/padlock.h" 43 #endif 44 #if defined(MBEDTLS_AESNI_C) 45 #include "mbedtls/aesni.h" 46 #endif 47 48 #if defined(MBEDTLS_SELF_TEST) 49 #if defined(MBEDTLS_PLATFORM_C) 50 #include "mbedtls/platform.h" 51 #else 52 #include <stdio.h> 53 #define mbedtls_printf printf 54 #endif /* MBEDTLS_PLATFORM_C */ 55 #endif /* MBEDTLS_SELF_TEST */ 56 57 #if !defined(MBEDTLS_AES_ALT) 58 59 /* Implementation that should never be optimized out by the compiler */ 60 static void mbedtls_zeroize( void *v, size_t n ) { 61 volatile unsigned char *p = (unsigned char*)v; while( n-- ) *p++ = 0; 62 } 63 64 /* 65 * 32-bit integer manipulation macros (little endian) 66 */ 67 #ifndef GET_UINT32_LE 68 #define GET_UINT32_LE(n,b,i) \ 69 { \ 70 (n) = ( (uint32_t) (b)[(i) ] ) \ 71 | ( (uint32_t) (b)[(i) + 1] << 8 ) \ 72 | ( (uint32_t) (b)[(i) + 2] << 16 ) \ 73 | ( (uint32_t) (b)[(i) + 3] << 24 ); \ 74 } 75 #endif 76 77 #ifndef PUT_UINT32_LE 78 #define PUT_UINT32_LE(n,b,i) \ 79 { \ 80 (b)[(i) ] = (unsigned char) ( ( (n) ) & 0xFF ); \ 81 (b)[(i) + 1] = (unsigned char) ( ( (n) >> 8 ) & 0xFF ); \ 82 (b)[(i) + 2] = (unsigned char) ( ( (n) >> 16 ) & 0xFF ); \ 83 (b)[(i) + 3] = (unsigned char) ( ( (n) >> 24 ) & 0xFF ); \ 84 } 85 #endif 86 87 #if defined(MBEDTLS_PADLOCK_C) && \ 88 ( defined(MBEDTLS_HAVE_X86) || defined(MBEDTLS_PADLOCK_ALIGN16) ) 89 static int aes_padlock_ace = -1; 90 #endif 91 92 #if defined(MBEDTLS_AES_ROM_TABLES) 93 /* 94 * Forward S-box 95 */ 96 static const unsigned char FSb[256] = 97 { 98 0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 99 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76, 100 0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 101 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0, 102 0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, 103 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15, 104 0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 105 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75, 106 0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, 107 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84, 108 0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 109 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF, 110 0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 111 0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8, 112 0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5, 113 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2, 114 0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, 115 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73, 116 0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 117 0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB, 118 0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, 119 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79, 120 0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9, 121 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08, 122 0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 123 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A, 124 0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, 125 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E, 126 0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94, 127 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF, 128 0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 129 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16 130 }; 131 132 /* 133 * Forward tables 134 */ 135 #define FT \ 136 \ 137 V(A5,63,63,C6), V(84,7C,7C,F8), V(99,77,77,EE), V(8D,7B,7B,F6), \ 138 V(0D,F2,F2,FF), V(BD,6B,6B,D6), V(B1,6F,6F,DE), V(54,C5,C5,91), \ 139 V(50,30,30,60), V(03,01,01,02), V(A9,67,67,CE), V(7D,2B,2B,56), \ 140 V(19,FE,FE,E7), V(62,D7,D7,B5), V(E6,AB,AB,4D), V(9A,76,76,EC), \ 141 V(45,CA,CA,8F), V(9D,82,82,1F), V(40,C9,C9,89), V(87,7D,7D,FA), \ 142 V(15,FA,FA,EF), V(EB,59,59,B2), V(C9,47,47,8E), V(0B,F0,F0,FB), \ 143 V(EC,AD,AD,41), V(67,D4,D4,B3), V(FD,A2,A2,5F), V(EA,AF,AF,45), \ 144 V(BF,9C,9C,23), V(F7,A4,A4,53), V(96,72,72,E4), V(5B,C0,C0,9B), \ 145 V(C2,B7,B7,75), V(1C,FD,FD,E1), V(AE,93,93,3D), V(6A,26,26,4C), \ 146 V(5A,36,36,6C), V(41,3F,3F,7E), V(02,F7,F7,F5), V(4F,CC,CC,83), \ 147 V(5C,34,34,68), V(F4,A5,A5,51), V(34,E5,E5,D1), V(08,F1,F1,F9), \ 148 V(93,71,71,E2), V(73,D8,D8,AB), V(53,31,31,62), V(3F,15,15,2A), \ 149 V(0C,04,04,08), V(52,C7,C7,95), V(65,23,23,46), V(5E,C3,C3,9D), \ 150 V(28,18,18,30), V(A1,96,96,37), V(0F,05,05,0A), V(B5,9A,9A,2F), \ 151 V(09,07,07,0E), V(36,12,12,24), V(9B,80,80,1B), V(3D,E2,E2,DF), \ 152 V(26,EB,EB,CD), V(69,27,27,4E), V(CD,B2,B2,7F), V(9F,75,75,EA), \ 153 V(1B,09,09,12), V(9E,83,83,1D), V(74,2C,2C,58), V(2E,1A,1A,34), \ 154 V(2D,1B,1B,36), V(B2,6E,6E,DC), V(EE,5A,5A,B4), V(FB,A0,A0,5B), \ 155 V(F6,52,52,A4), V(4D,3B,3B,76), V(61,D6,D6,B7), V(CE,B3,B3,7D), \ 156 V(7B,29,29,52), V(3E,E3,E3,DD), V(71,2F,2F,5E), V(97,84,84,13), \ 157 V(F5,53,53,A6), V(68,D1,D1,B9), V(00,00,00,00), V(2C,ED,ED,C1), \ 158 V(60,20,20,40), V(1F,FC,FC,E3), V(C8,B1,B1,79), V(ED,5B,5B,B6), \ 159 V(BE,6A,6A,D4), V(46,CB,CB,8D), V(D9,BE,BE,67), V(4B,39,39,72), \ 160 V(DE,4A,4A,94), V(D4,4C,4C,98), V(E8,58,58,B0), V(4A,CF,CF,85), \ 161 V(6B,D0,D0,BB), V(2A,EF,EF,C5), V(E5,AA,AA,4F), V(16,FB,FB,ED), \ 162 V(C5,43,43,86), V(D7,4D,4D,9A), V(55,33,33,66), V(94,85,85,11), \ 163 V(CF,45,45,8A), V(10,F9,F9,E9), V(06,02,02,04), V(81,7F,7F,FE), \ 164 V(F0,50,50,A0), V(44,3C,3C,78), V(BA,9F,9F,25), V(E3,A8,A8,4B), \ 165 V(F3,51,51,A2), V(FE,A3,A3,5D), V(C0,40,40,80), V(8A,8F,8F,05), \ 166 V(AD,92,92,3F), V(BC,9D,9D,21), V(48,38,38,70), V(04,F5,F5,F1), \ 167 V(DF,BC,BC,63), V(C1,B6,B6,77), V(75,DA,DA,AF), V(63,21,21,42), \ 168 V(30,10,10,20), V(1A,FF,FF,E5), V(0E,F3,F3,FD), V(6D,D2,D2,BF), \ 169 V(4C,CD,CD,81), V(14,0C,0C,18), V(35,13,13,26), V(2F,EC,EC,C3), \ 170 V(E1,5F,5F,BE), V(A2,97,97,35), V(CC,44,44,88), V(39,17,17,2E), \ 171 V(57,C4,C4,93), V(F2,A7,A7,55), V(82,7E,7E,FC), V(47,3D,3D,7A), \ 172 V(AC,64,64,C8), V(E7,5D,5D,BA), V(2B,19,19,32), V(95,73,73,E6), \ 173 V(A0,60,60,C0), V(98,81,81,19), V(D1,4F,4F,9E), V(7F,DC,DC,A3), \ 174 V(66,22,22,44), V(7E,2A,2A,54), V(AB,90,90,3B), V(83,88,88,0B), \ 175 V(CA,46,46,8C), V(29,EE,EE,C7), V(D3,B8,B8,6B), V(3C,14,14,28), \ 176 V(79,DE,DE,A7), V(E2,5E,5E,BC), V(1D,0B,0B,16), V(76,DB,DB,AD), \ 177 V(3B,E0,E0,DB), V(56,32,32,64), V(4E,3A,3A,74), V(1E,0A,0A,14), \ 178 V(DB,49,49,92), V(0A,06,06,0C), V(6C,24,24,48), V(E4,5C,5C,B8), \ 179 V(5D,C2,C2,9F), V(6E,D3,D3,BD), V(EF,AC,AC,43), V(A6,62,62,C4), \ 180 V(A8,91,91,39), V(A4,95,95,31), V(37,E4,E4,D3), V(8B,79,79,F2), \ 181 V(32,E7,E7,D5), V(43,C8,C8,8B), V(59,37,37,6E), V(B7,6D,6D,DA), \ 182 V(8C,8D,8D,01), V(64,D5,D5,B1), V(D2,4E,4E,9C), V(E0,A9,A9,49), \ 183 V(B4,6C,6C,D8), V(FA,56,56,AC), V(07,F4,F4,F3), V(25,EA,EA,CF), \ 184 V(AF,65,65,CA), V(8E,7A,7A,F4), V(E9,AE,AE,47), V(18,08,08,10), \ 185 V(D5,BA,BA,6F), V(88,78,78,F0), V(6F,25,25,4A), V(72,2E,2E,5C), \ 186 V(24,1C,1C,38), V(F1,A6,A6,57), V(C7,B4,B4,73), V(51,C6,C6,97), \ 187 V(23,E8,E8,CB), V(7C,DD,DD,A1), V(9C,74,74,E8), V(21,1F,1F,3E), \ 188 V(DD,4B,4B,96), V(DC,BD,BD,61), V(86,8B,8B,0D), V(85,8A,8A,0F), \ 189 V(90,70,70,E0), V(42,3E,3E,7C), V(C4,B5,B5,71), V(AA,66,66,CC), \ 190 V(D8,48,48,90), V(05,03,03,06), V(01,F6,F6,F7), V(12,0E,0E,1C), \ 191 V(A3,61,61,C2), V(5F,35,35,6A), V(F9,57,57,AE), V(D0,B9,B9,69), \ 192 V(91,86,86,17), V(58,C1,C1,99), V(27,1D,1D,3A), V(B9,9E,9E,27), \ 193 V(38,E1,E1,D9), V(13,F8,F8,EB), V(B3,98,98,2B), V(33,11,11,22), \ 194 V(BB,69,69,D2), V(70,D9,D9,A9), V(89,8E,8E,07), V(A7,94,94,33), \ 195 V(B6,9B,9B,2D), V(22,1E,1E,3C), V(92,87,87,15), V(20,E9,E9,C9), \ 196 V(49,CE,CE,87), V(FF,55,55,AA), V(78,28,28,50), V(7A,DF,DF,A5), \ 197 V(8F,8C,8C,03), V(F8,A1,A1,59), V(80,89,89,09), V(17,0D,0D,1A), \ 198 V(DA,BF,BF,65), V(31,E6,E6,D7), V(C6,42,42,84), V(B8,68,68,D0), \ 199 V(C3,41,41,82), V(B0,99,99,29), V(77,2D,2D,5A), V(11,0F,0F,1E), \ 200 V(CB,B0,B0,7B), V(FC,54,54,A8), V(D6,BB,BB,6D), V(3A,16,16,2C) 201 202 #define V(a,b,c,d) 0x##a##b##c##d 203 static const uint32_t FT0[256] = { FT }; 204 #undef V 205 206 #define V(a,b,c,d) 0x##b##c##d##a 207 static const uint32_t FT1[256] = { FT }; 208 #undef V 209 210 #define V(a,b,c,d) 0x##c##d##a##b 211 static const uint32_t FT2[256] = { FT }; 212 #undef V 213 214 #define V(a,b,c,d) 0x##d##a##b##c 215 static const uint32_t FT3[256] = { FT }; 216 #undef V 217 218 #undef FT 219 220 /* 221 * Reverse S-box 222 */ 223 static const unsigned char RSb[256] = 224 { 225 0x52, 0x09, 0x6A, 0xD5, 0x30, 0x36, 0xA5, 0x38, 226 0xBF, 0x40, 0xA3, 0x9E, 0x81, 0xF3, 0xD7, 0xFB, 227 0x7C, 0xE3, 0x39, 0x82, 0x9B, 0x2F, 0xFF, 0x87, 228 0x34, 0x8E, 0x43, 0x44, 0xC4, 0xDE, 0xE9, 0xCB, 229 0x54, 0x7B, 0x94, 0x32, 0xA6, 0xC2, 0x23, 0x3D, 230 0xEE, 0x4C, 0x95, 0x0B, 0x42, 0xFA, 0xC3, 0x4E, 231 0x08, 0x2E, 0xA1, 0x66, 0x28, 0xD9, 0x24, 0xB2, 232 0x76, 0x5B, 0xA2, 0x49, 0x6D, 0x8B, 0xD1, 0x25, 233 0x72, 0xF8, 0xF6, 0x64, 0x86, 0x68, 0x98, 0x16, 234 0xD4, 0xA4, 0x5C, 0xCC, 0x5D, 0x65, 0xB6, 0x92, 235 0x6C, 0x70, 0x48, 0x50, 0xFD, 0xED, 0xB9, 0xDA, 236 0x5E, 0x15, 0x46, 0x57, 0xA7, 0x8D, 0x9D, 0x84, 237 0x90, 0xD8, 0xAB, 0x00, 0x8C, 0xBC, 0xD3, 0x0A, 238 0xF7, 0xE4, 0x58, 0x05, 0xB8, 0xB3, 0x45, 0x06, 239 0xD0, 0x2C, 0x1E, 0x8F, 0xCA, 0x3F, 0x0F, 0x02, 240 0xC1, 0xAF, 0xBD, 0x03, 0x01, 0x13, 0x8A, 0x6B, 241 0x3A, 0x91, 0x11, 0x41, 0x4F, 0x67, 0xDC, 0xEA, 242 0x97, 0xF2, 0xCF, 0xCE, 0xF0, 0xB4, 0xE6, 0x73, 243 0x96, 0xAC, 0x74, 0x22, 0xE7, 0xAD, 0x35, 0x85, 244 0xE2, 0xF9, 0x37, 0xE8, 0x1C, 0x75, 0xDF, 0x6E, 245 0x47, 0xF1, 0x1A, 0x71, 0x1D, 0x29, 0xC5, 0x89, 246 0x6F, 0xB7, 0x62, 0x0E, 0xAA, 0x18, 0xBE, 0x1B, 247 0xFC, 0x56, 0x3E, 0x4B, 0xC6, 0xD2, 0x79, 0x20, 248 0x9A, 0xDB, 0xC0, 0xFE, 0x78, 0xCD, 0x5A, 0xF4, 249 0x1F, 0xDD, 0xA8, 0x33, 0x88, 0x07, 0xC7, 0x31, 250 0xB1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xEC, 0x5F, 251 0x60, 0x51, 0x7F, 0xA9, 0x19, 0xB5, 0x4A, 0x0D, 252 0x2D, 0xE5, 0x7A, 0x9F, 0x93, 0xC9, 0x9C, 0xEF, 253 0xA0, 0xE0, 0x3B, 0x4D, 0xAE, 0x2A, 0xF5, 0xB0, 254 0xC8, 0xEB, 0xBB, 0x3C, 0x83, 0x53, 0x99, 0x61, 255 0x17, 0x2B, 0x04, 0x7E, 0xBA, 0x77, 0xD6, 0x26, 256 0xE1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0C, 0x7D 257 }; 258 259 /* 260 * Reverse tables 261 */ 262 #define RT \ 263 \ 264 V(50,A7,F4,51), V(53,65,41,7E), V(C3,A4,17,1A), V(96,5E,27,3A), \ 265 V(CB,6B,AB,3B), V(F1,45,9D,1F), V(AB,58,FA,AC), V(93,03,E3,4B), \ 266 V(55,FA,30,20), V(F6,6D,76,AD), V(91,76,CC,88), V(25,4C,02,F5), \ 267 V(FC,D7,E5,4F), V(D7,CB,2A,C5), V(80,44,35,26), V(8F,A3,62,B5), \ 268 V(49,5A,B1,DE), V(67,1B,BA,25), V(98,0E,EA,45), V(E1,C0,FE,5D), \ 269 V(02,75,2F,C3), V(12,F0,4C,81), V(A3,97,46,8D), V(C6,F9,D3,6B), \ 270 V(E7,5F,8F,03), V(95,9C,92,15), V(EB,7A,6D,BF), V(DA,59,52,95), \ 271 V(2D,83,BE,D4), V(D3,21,74,58), V(29,69,E0,49), V(44,C8,C9,8E), \ 272 V(6A,89,C2,75), V(78,79,8E,F4), V(6B,3E,58,99), V(DD,71,B9,27), \ 273 V(B6,4F,E1,BE), V(17,AD,88,F0), V(66,AC,20,C9), V(B4,3A,CE,7D), \ 274 V(18,4A,DF,63), V(82,31,1A,E5), V(60,33,51,97), V(45,7F,53,62), \ 275 V(E0,77,64,B1), V(84,AE,6B,BB), V(1C,A0,81,FE), V(94,2B,08,F9), \ 276 V(58,68,48,70), V(19,FD,45,8F), V(87,6C,DE,94), V(B7,F8,7B,52), \ 277 V(23,D3,73,AB), V(E2,02,4B,72), V(57,8F,1F,E3), V(2A,AB,55,66), \ 278 V(07,28,EB,B2), V(03,C2,B5,2F), V(9A,7B,C5,86), V(A5,08,37,D3), \ 279 V(F2,87,28,30), V(B2,A5,BF,23), V(BA,6A,03,02), V(5C,82,16,ED), \ 280 V(2B,1C,CF,8A), V(92,B4,79,A7), V(F0,F2,07,F3), V(A1,E2,69,4E), \ 281 V(CD,F4,DA,65), V(D5,BE,05,06), V(1F,62,34,D1), V(8A,FE,A6,C4), \ 282 V(9D,53,2E,34), V(A0,55,F3,A2), V(32,E1,8A,05), V(75,EB,F6,A4), \ 283 V(39,EC,83,0B), V(AA,EF,60,40), V(06,9F,71,5E), V(51,10,6E,BD), \ 284 V(F9,8A,21,3E), V(3D,06,DD,96), V(AE,05,3E,DD), V(46,BD,E6,4D), \ 285 V(B5,8D,54,91), V(05,5D,C4,71), V(6F,D4,06,04), V(FF,15,50,60), \ 286 V(24,FB,98,19), V(97,E9,BD,D6), V(CC,43,40,89), V(77,9E,D9,67), \ 287 V(BD,42,E8,B0), V(88,8B,89,07), V(38,5B,19,E7), V(DB,EE,C8,79), \ 288 V(47,0A,7C,A1), V(E9,0F,42,7C), V(C9,1E,84,F8), V(00,00,00,00), \ 289 V(83,86,80,09), V(48,ED,2B,32), V(AC,70,11,1E), V(4E,72,5A,6C), \ 290 V(FB,FF,0E,FD), V(56,38,85,0F), V(1E,D5,AE,3D), V(27,39,2D,36), \ 291 V(64,D9,0F,0A), V(21,A6,5C,68), V(D1,54,5B,9B), V(3A,2E,36,24), \ 292 V(B1,67,0A,0C), V(0F,E7,57,93), V(D2,96,EE,B4), V(9E,91,9B,1B), \ 293 V(4F,C5,C0,80), V(A2,20,DC,61), V(69,4B,77,5A), V(16,1A,12,1C), \ 294 V(0A,BA,93,E2), V(E5,2A,A0,C0), V(43,E0,22,3C), V(1D,17,1B,12), \ 295 V(0B,0D,09,0E), V(AD,C7,8B,F2), V(B9,A8,B6,2D), V(C8,A9,1E,14), \ 296 V(85,19,F1,57), V(4C,07,75,AF), V(BB,DD,99,EE), V(FD,60,7F,A3), \ 297 V(9F,26,01,F7), V(BC,F5,72,5C), V(C5,3B,66,44), V(34,7E,FB,5B), \ 298 V(76,29,43,8B), V(DC,C6,23,CB), V(68,FC,ED,B6), V(63,F1,E4,B8), \ 299 V(CA,DC,31,D7), V(10,85,63,42), V(40,22,97,13), V(20,11,C6,84), \ 300 V(7D,24,4A,85), V(F8,3D,BB,D2), V(11,32,F9,AE), V(6D,A1,29,C7), \ 301 V(4B,2F,9E,1D), V(F3,30,B2,DC), V(EC,52,86,0D), V(D0,E3,C1,77), \ 302 V(6C,16,B3,2B), V(99,B9,70,A9), V(FA,48,94,11), V(22,64,E9,47), \ 303 V(C4,8C,FC,A8), V(1A,3F,F0,A0), V(D8,2C,7D,56), V(EF,90,33,22), \ 304 V(C7,4E,49,87), V(C1,D1,38,D9), V(FE,A2,CA,8C), V(36,0B,D4,98), \ 305 V(CF,81,F5,A6), V(28,DE,7A,A5), V(26,8E,B7,DA), V(A4,BF,AD,3F), \ 306 V(E4,9D,3A,2C), V(0D,92,78,50), V(9B,CC,5F,6A), V(62,46,7E,54), \ 307 V(C2,13,8D,F6), V(E8,B8,D8,90), V(5E,F7,39,2E), V(F5,AF,C3,82), \ 308 V(BE,80,5D,9F), V(7C,93,D0,69), V(A9,2D,D5,6F), V(B3,12,25,CF), \ 309 V(3B,99,AC,C8), V(A7,7D,18,10), V(6E,63,9C,E8), V(7B,BB,3B,DB), \ 310 V(09,78,26,CD), V(F4,18,59,6E), V(01,B7,9A,EC), V(A8,9A,4F,83), \ 311 V(65,6E,95,E6), V(7E,E6,FF,AA), V(08,CF,BC,21), V(E6,E8,15,EF), \ 312 V(D9,9B,E7,BA), V(CE,36,6F,4A), V(D4,09,9F,EA), V(D6,7C,B0,29), \ 313 V(AF,B2,A4,31), V(31,23,3F,2A), V(30,94,A5,C6), V(C0,66,A2,35), \ 314 V(37,BC,4E,74), V(A6,CA,82,FC), V(B0,D0,90,E0), V(15,D8,A7,33), \ 315 V(4A,98,04,F1), V(F7,DA,EC,41), V(0E,50,CD,7F), V(2F,F6,91,17), \ 316 V(8D,D6,4D,76), V(4D,B0,EF,43), V(54,4D,AA,CC), V(DF,04,96,E4), \ 317 V(E3,B5,D1,9E), V(1B,88,6A,4C), V(B8,1F,2C,C1), V(7F,51,65,46), \ 318 V(04,EA,5E,9D), V(5D,35,8C,01), V(73,74,87,FA), V(2E,41,0B,FB), \ 319 V(5A,1D,67,B3), V(52,D2,DB,92), V(33,56,10,E9), V(13,47,D6,6D), \ 320 V(8C,61,D7,9A), V(7A,0C,A1,37), V(8E,14,F8,59), V(89,3C,13,EB), \ 321 V(EE,27,A9,CE), V(35,C9,61,B7), V(ED,E5,1C,E1), V(3C,B1,47,7A), \ 322 V(59,DF,D2,9C), V(3F,73,F2,55), V(79,CE,14,18), V(BF,37,C7,73), \ 323 V(EA,CD,F7,53), V(5B,AA,FD,5F), V(14,6F,3D,DF), V(86,DB,44,78), \ 324 V(81,F3,AF,CA), V(3E,C4,68,B9), V(2C,34,24,38), V(5F,40,A3,C2), \ 325 V(72,C3,1D,16), V(0C,25,E2,BC), V(8B,49,3C,28), V(41,95,0D,FF), \ 326 V(71,01,A8,39), V(DE,B3,0C,08), V(9C,E4,B4,D8), V(90,C1,56,64), \ 327 V(61,84,CB,7B), V(70,B6,32,D5), V(74,5C,6C,48), V(42,57,B8,D0) 328 329 #define V(a,b,c,d) 0x##a##b##c##d 330 static const uint32_t RT0[256] = { RT }; 331 #undef V 332 333 #define V(a,b,c,d) 0x##b##c##d##a 334 static const uint32_t RT1[256] = { RT }; 335 #undef V 336 337 #define V(a,b,c,d) 0x##c##d##a##b 338 static const uint32_t RT2[256] = { RT }; 339 #undef V 340 341 #define V(a,b,c,d) 0x##d##a##b##c 342 static const uint32_t RT3[256] = { RT }; 343 #undef V 344 345 #undef RT 346 347 /* 348 * Round constants 349 */ 350 static const uint32_t RCON[10] = 351 { 352 0x00000001, 0x00000002, 0x00000004, 0x00000008, 353 0x00000010, 0x00000020, 0x00000040, 0x00000080, 354 0x0000001B, 0x00000036 355 }; 356 357 #else /* MBEDTLS_AES_ROM_TABLES */ 358 359 /* 360 * Forward S-box & tables 361 */ 362 static unsigned char FSb[256]; 363 static uint32_t FT0[256]; 364 static uint32_t FT1[256]; 365 static uint32_t FT2[256]; 366 static uint32_t FT3[256]; 367 368 /* 369 * Reverse S-box & tables 370 */ 371 static unsigned char RSb[256]; 372 static uint32_t RT0[256]; 373 static uint32_t RT1[256]; 374 static uint32_t RT2[256]; 375 static uint32_t RT3[256]; 376 377 /* 378 * Round constants 379 */ 380 static uint32_t RCON[10]; 381 382 /* 383 * Tables generation code 384 */ 385 #define ROTL8(x) ( ( x << 8 ) & 0xFFFFFFFF ) | ( x >> 24 ) 386 #define XTIME(x) ( ( x << 1 ) ^ ( ( x & 0x80 ) ? 0x1B : 0x00 ) ) 387 #define MUL(x,y) ( ( x && y ) ? pow[(log[x]+log[y]) % 255] : 0 ) 388 389 static int aes_init_done = 0; 390 391 static void aes_gen_tables( void ) 392 { 393 int i, x, y, z; 394 int pow[256]; 395 int log[256]; 396 397 /* 398 * compute pow and log tables over GF(2^8) 399 */ 400 for( i = 0, x = 1; i < 256; i++ ) 401 { 402 pow[i] = x; 403 log[x] = i; 404 x = ( x ^ XTIME( x ) ) & 0xFF; 405 } 406 407 /* 408 * calculate the round constants 409 */ 410 for( i = 0, x = 1; i < 10; i++ ) 411 { 412 RCON[i] = (uint32_t) x; 413 x = XTIME( x ) & 0xFF; 414 } 415 416 /* 417 * generate the forward and reverse S-boxes 418 */ 419 FSb[0x00] = 0x63; 420 RSb[0x63] = 0x00; 421 422 for( i = 1; i < 256; i++ ) 423 { 424 x = pow[255 - log[i]]; 425 426 y = x; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF; 427 x ^= y; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF; 428 x ^= y; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF; 429 x ^= y; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF; 430 x ^= y ^ 0x63; 431 432 FSb[i] = (unsigned char) x; 433 RSb[x] = (unsigned char) i; 434 } 435 436 /* 437 * generate the forward and reverse tables 438 */ 439 for( i = 0; i < 256; i++ ) 440 { 441 x = FSb[i]; 442 y = XTIME( x ) & 0xFF; 443 z = ( y ^ x ) & 0xFF; 444 445 FT0[i] = ( (uint32_t) y ) ^ 446 ( (uint32_t) x << 8 ) ^ 447 ( (uint32_t) x << 16 ) ^ 448 ( (uint32_t) z << 24 ); 449 450 FT1[i] = ROTL8( FT0[i] ); 451 FT2[i] = ROTL8( FT1[i] ); 452 FT3[i] = ROTL8( FT2[i] ); 453 454 x = RSb[i]; 455 456 RT0[i] = ( (uint32_t) MUL( 0x0E, x ) ) ^ 457 ( (uint32_t) MUL( 0x09, x ) << 8 ) ^ 458 ( (uint32_t) MUL( 0x0D, x ) << 16 ) ^ 459 ( (uint32_t) MUL( 0x0B, x ) << 24 ); 460 461 RT1[i] = ROTL8( RT0[i] ); 462 RT2[i] = ROTL8( RT1[i] ); 463 RT3[i] = ROTL8( RT2[i] ); 464 } 465 } 466 467 #endif /* MBEDTLS_AES_ROM_TABLES */ 468 469 void mbedtls_aes_init( mbedtls_aes_context *ctx ) 470 { 471 memset( ctx, 0, sizeof( mbedtls_aes_context ) ); 472 } 473 474 void mbedtls_aes_free( mbedtls_aes_context *ctx ) 475 { 476 if( ctx == NULL ) 477 return; 478 479 mbedtls_zeroize( ctx, sizeof( mbedtls_aes_context ) ); 480 } 481 482 /* 483 * AES key schedule (encryption) 484 */ 485 #if !defined(MBEDTLS_AES_SETKEY_ENC_ALT) 486 int mbedtls_aes_setkey_enc( mbedtls_aes_context *ctx, const unsigned char *key, 487 unsigned int keybits ) 488 { 489 unsigned int i; 490 uint32_t *RK; 491 492 #if !defined(MBEDTLS_AES_ROM_TABLES) 493 if( aes_init_done == 0 ) 494 { 495 aes_gen_tables(); 496 aes_init_done = 1; 497 498 } 499 #endif 500 501 switch( keybits ) 502 { 503 case 128: ctx->nr = 10; break; 504 case 192: ctx->nr = 12; break; 505 case 256: ctx->nr = 14; break; 506 default : return( MBEDTLS_ERR_AES_INVALID_KEY_LENGTH ); 507 } 508 509 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_PADLOCK_ALIGN16) 510 if( aes_padlock_ace == -1 ) 511 aes_padlock_ace = mbedtls_padlock_has_support( MBEDTLS_PADLOCK_ACE ); 512 513 if( aes_padlock_ace ) 514 ctx->rk = RK = MBEDTLS_PADLOCK_ALIGN16( ctx->buf ); 515 else 516 #endif 517 ctx->rk = RK = ctx->buf; 518 519 #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64) 520 if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) ) 521 return( mbedtls_aesni_setkey_enc( (unsigned char *) ctx->rk, key, keybits ) ); 522 #endif 523 524 for( i = 0; i < ( keybits >> 5 ); i++ ) 525 { 526 GET_UINT32_LE( RK[i], key, i << 2 ); 527 } 528 529 switch( ctx->nr ) 530 { 531 case 10: 532 533 for( i = 0; i < 10; i++, RK += 4 ) 534 { 535 RK[4] = RK[0] ^ RCON[i] ^ 536 ( (uint32_t) FSb[ ( RK[3] >> 8 ) & 0xFF ] ) ^ 537 ( (uint32_t) FSb[ ( RK[3] >> 16 ) & 0xFF ] << 8 ) ^ 538 ( (uint32_t) FSb[ ( RK[3] >> 24 ) & 0xFF ] << 16 ) ^ 539 ( (uint32_t) FSb[ ( RK[3] ) & 0xFF ] << 24 ); 540 541 RK[5] = RK[1] ^ RK[4]; 542 RK[6] = RK[2] ^ RK[5]; 543 RK[7] = RK[3] ^ RK[6]; 544 } 545 break; 546 547 case 12: 548 549 for( i = 0; i < 8; i++, RK += 6 ) 550 { 551 RK[6] = RK[0] ^ RCON[i] ^ 552 ( (uint32_t) FSb[ ( RK[5] >> 8 ) & 0xFF ] ) ^ 553 ( (uint32_t) FSb[ ( RK[5] >> 16 ) & 0xFF ] << 8 ) ^ 554 ( (uint32_t) FSb[ ( RK[5] >> 24 ) & 0xFF ] << 16 ) ^ 555 ( (uint32_t) FSb[ ( RK[5] ) & 0xFF ] << 24 ); 556 557 RK[7] = RK[1] ^ RK[6]; 558 RK[8] = RK[2] ^ RK[7]; 559 RK[9] = RK[3] ^ RK[8]; 560 RK[10] = RK[4] ^ RK[9]; 561 RK[11] = RK[5] ^ RK[10]; 562 } 563 break; 564 565 case 14: 566 567 for( i = 0; i < 7; i++, RK += 8 ) 568 { 569 RK[8] = RK[0] ^ RCON[i] ^ 570 ( (uint32_t) FSb[ ( RK[7] >> 8 ) & 0xFF ] ) ^ 571 ( (uint32_t) FSb[ ( RK[7] >> 16 ) & 0xFF ] << 8 ) ^ 572 ( (uint32_t) FSb[ ( RK[7] >> 24 ) & 0xFF ] << 16 ) ^ 573 ( (uint32_t) FSb[ ( RK[7] ) & 0xFF ] << 24 ); 574 575 RK[9] = RK[1] ^ RK[8]; 576 RK[10] = RK[2] ^ RK[9]; 577 RK[11] = RK[3] ^ RK[10]; 578 579 RK[12] = RK[4] ^ 580 ( (uint32_t) FSb[ ( RK[11] ) & 0xFF ] ) ^ 581 ( (uint32_t) FSb[ ( RK[11] >> 8 ) & 0xFF ] << 8 ) ^ 582 ( (uint32_t) FSb[ ( RK[11] >> 16 ) & 0xFF ] << 16 ) ^ 583 ( (uint32_t) FSb[ ( RK[11] >> 24 ) & 0xFF ] << 24 ); 584 585 RK[13] = RK[5] ^ RK[12]; 586 RK[14] = RK[6] ^ RK[13]; 587 RK[15] = RK[7] ^ RK[14]; 588 } 589 break; 590 } 591 592 return( 0 ); 593 } 594 #endif /* !MBEDTLS_AES_SETKEY_ENC_ALT */ 595 596 /* 597 * AES key schedule (decryption) 598 */ 599 #if !defined(MBEDTLS_AES_SETKEY_DEC_ALT) 600 int mbedtls_aes_setkey_dec( mbedtls_aes_context *ctx, const unsigned char *key, 601 unsigned int keybits ) 602 { 603 int i, j, ret; 604 mbedtls_aes_context cty; 605 uint32_t *RK; 606 uint32_t *SK; 607 608 mbedtls_aes_init( &cty ); 609 610 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_PADLOCK_ALIGN16) 611 if( aes_padlock_ace == -1 ) 612 aes_padlock_ace = mbedtls_padlock_has_support( MBEDTLS_PADLOCK_ACE ); 613 614 if( aes_padlock_ace ) 615 ctx->rk = RK = MBEDTLS_PADLOCK_ALIGN16( ctx->buf ); 616 else 617 #endif 618 ctx->rk = RK = ctx->buf; 619 620 /* Also checks keybits */ 621 if( ( ret = mbedtls_aes_setkey_enc( &cty, key, keybits ) ) != 0 ) 622 goto exit; 623 624 ctx->nr = cty.nr; 625 626 #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64) 627 if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) ) 628 { 629 mbedtls_aesni_inverse_key( (unsigned char *) ctx->rk, 630 (const unsigned char *) cty.rk, ctx->nr ); 631 goto exit; 632 } 633 #endif 634 635 SK = cty.rk + cty.nr * 4; 636 637 *RK++ = *SK++; 638 *RK++ = *SK++; 639 *RK++ = *SK++; 640 *RK++ = *SK++; 641 642 for( i = ctx->nr - 1, SK -= 8; i > 0; i--, SK -= 8 ) 643 { 644 for( j = 0; j < 4; j++, SK++ ) 645 { 646 *RK++ = RT0[ FSb[ ( *SK ) & 0xFF ] ] ^ 647 RT1[ FSb[ ( *SK >> 8 ) & 0xFF ] ] ^ 648 RT2[ FSb[ ( *SK >> 16 ) & 0xFF ] ] ^ 649 RT3[ FSb[ ( *SK >> 24 ) & 0xFF ] ]; 650 } 651 } 652 653 *RK++ = *SK++; 654 *RK++ = *SK++; 655 *RK++ = *SK++; 656 *RK++ = *SK++; 657 658 exit: 659 mbedtls_aes_free( &cty ); 660 661 return( ret ); 662 } 663 #endif /* !MBEDTLS_AES_SETKEY_DEC_ALT */ 664 665 #define AES_FROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3) \ 666 { \ 667 X0 = *RK++ ^ FT0[ ( Y0 ) & 0xFF ] ^ \ 668 FT1[ ( Y1 >> 8 ) & 0xFF ] ^ \ 669 FT2[ ( Y2 >> 16 ) & 0xFF ] ^ \ 670 FT3[ ( Y3 >> 24 ) & 0xFF ]; \ 671 \ 672 X1 = *RK++ ^ FT0[ ( Y1 ) & 0xFF ] ^ \ 673 FT1[ ( Y2 >> 8 ) & 0xFF ] ^ \ 674 FT2[ ( Y3 >> 16 ) & 0xFF ] ^ \ 675 FT3[ ( Y0 >> 24 ) & 0xFF ]; \ 676 \ 677 X2 = *RK++ ^ FT0[ ( Y2 ) & 0xFF ] ^ \ 678 FT1[ ( Y3 >> 8 ) & 0xFF ] ^ \ 679 FT2[ ( Y0 >> 16 ) & 0xFF ] ^ \ 680 FT3[ ( Y1 >> 24 ) & 0xFF ]; \ 681 \ 682 X3 = *RK++ ^ FT0[ ( Y3 ) & 0xFF ] ^ \ 683 FT1[ ( Y0 >> 8 ) & 0xFF ] ^ \ 684 FT2[ ( Y1 >> 16 ) & 0xFF ] ^ \ 685 FT3[ ( Y2 >> 24 ) & 0xFF ]; \ 686 } 687 688 #define AES_RROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3) \ 689 { \ 690 X0 = *RK++ ^ RT0[ ( Y0 ) & 0xFF ] ^ \ 691 RT1[ ( Y3 >> 8 ) & 0xFF ] ^ \ 692 RT2[ ( Y2 >> 16 ) & 0xFF ] ^ \ 693 RT3[ ( Y1 >> 24 ) & 0xFF ]; \ 694 \ 695 X1 = *RK++ ^ RT0[ ( Y1 ) & 0xFF ] ^ \ 696 RT1[ ( Y0 >> 8 ) & 0xFF ] ^ \ 697 RT2[ ( Y3 >> 16 ) & 0xFF ] ^ \ 698 RT3[ ( Y2 >> 24 ) & 0xFF ]; \ 699 \ 700 X2 = *RK++ ^ RT0[ ( Y2 ) & 0xFF ] ^ \ 701 RT1[ ( Y1 >> 8 ) & 0xFF ] ^ \ 702 RT2[ ( Y0 >> 16 ) & 0xFF ] ^ \ 703 RT3[ ( Y3 >> 24 ) & 0xFF ]; \ 704 \ 705 X3 = *RK++ ^ RT0[ ( Y3 ) & 0xFF ] ^ \ 706 RT1[ ( Y2 >> 8 ) & 0xFF ] ^ \ 707 RT2[ ( Y1 >> 16 ) & 0xFF ] ^ \ 708 RT3[ ( Y0 >> 24 ) & 0xFF ]; \ 709 } 710 711 /* 712 * AES-ECB block encryption 713 */ 714 #if !defined(MBEDTLS_AES_ENCRYPT_ALT) 715 int mbedtls_internal_aes_encrypt( mbedtls_aes_context *ctx, 716 const unsigned char input[16], 717 unsigned char output[16] ) 718 { 719 int i; 720 uint32_t *RK, X0, X1, X2, X3, Y0, Y1, Y2, Y3; 721 722 RK = ctx->rk; 723 724 GET_UINT32_LE( X0, input, 0 ); X0 ^= *RK++; 725 GET_UINT32_LE( X1, input, 4 ); X1 ^= *RK++; 726 GET_UINT32_LE( X2, input, 8 ); X2 ^= *RK++; 727 GET_UINT32_LE( X3, input, 12 ); X3 ^= *RK++; 728 729 for( i = ( ctx->nr >> 1 ) - 1; i > 0; i-- ) 730 { 731 AES_FROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 ); 732 AES_FROUND( X0, X1, X2, X3, Y0, Y1, Y2, Y3 ); 733 } 734 735 AES_FROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 ); 736 737 X0 = *RK++ ^ \ 738 ( (uint32_t) FSb[ ( Y0 ) & 0xFF ] ) ^ 739 ( (uint32_t) FSb[ ( Y1 >> 8 ) & 0xFF ] << 8 ) ^ 740 ( (uint32_t) FSb[ ( Y2 >> 16 ) & 0xFF ] << 16 ) ^ 741 ( (uint32_t) FSb[ ( Y3 >> 24 ) & 0xFF ] << 24 ); 742 743 X1 = *RK++ ^ \ 744 ( (uint32_t) FSb[ ( Y1 ) & 0xFF ] ) ^ 745 ( (uint32_t) FSb[ ( Y2 >> 8 ) & 0xFF ] << 8 ) ^ 746 ( (uint32_t) FSb[ ( Y3 >> 16 ) & 0xFF ] << 16 ) ^ 747 ( (uint32_t) FSb[ ( Y0 >> 24 ) & 0xFF ] << 24 ); 748 749 X2 = *RK++ ^ \ 750 ( (uint32_t) FSb[ ( Y2 ) & 0xFF ] ) ^ 751 ( (uint32_t) FSb[ ( Y3 >> 8 ) & 0xFF ] << 8 ) ^ 752 ( (uint32_t) FSb[ ( Y0 >> 16 ) & 0xFF ] << 16 ) ^ 753 ( (uint32_t) FSb[ ( Y1 >> 24 ) & 0xFF ] << 24 ); 754 755 X3 = *RK++ ^ \ 756 ( (uint32_t) FSb[ ( Y3 ) & 0xFF ] ) ^ 757 ( (uint32_t) FSb[ ( Y0 >> 8 ) & 0xFF ] << 8 ) ^ 758 ( (uint32_t) FSb[ ( Y1 >> 16 ) & 0xFF ] << 16 ) ^ 759 ( (uint32_t) FSb[ ( Y2 >> 24 ) & 0xFF ] << 24 ); 760 761 PUT_UINT32_LE( X0, output, 0 ); 762 PUT_UINT32_LE( X1, output, 4 ); 763 PUT_UINT32_LE( X2, output, 8 ); 764 PUT_UINT32_LE( X3, output, 12 ); 765 766 return( 0 ); 767 } 768 #endif /* !MBEDTLS_AES_ENCRYPT_ALT */ 769 770 #if !defined(MBEDTLS_DEPRECATED_REMOVED) 771 void mbedtls_aes_encrypt( mbedtls_aes_context *ctx, 772 const unsigned char input[16], 773 unsigned char output[16] ) 774 { 775 mbedtls_internal_aes_encrypt( ctx, input, output ); 776 } 777 #endif /* !MBEDTLS_DEPRECATED_REMOVED */ 778 779 /* 780 * AES-ECB block decryption 781 */ 782 #if !defined(MBEDTLS_AES_DECRYPT_ALT) 783 int mbedtls_internal_aes_decrypt( mbedtls_aes_context *ctx, 784 const unsigned char input[16], 785 unsigned char output[16] ) 786 { 787 int i; 788 uint32_t *RK, X0, X1, X2, X3, Y0, Y1, Y2, Y3; 789 790 RK = ctx->rk; 791 792 GET_UINT32_LE( X0, input, 0 ); X0 ^= *RK++; 793 GET_UINT32_LE( X1, input, 4 ); X1 ^= *RK++; 794 GET_UINT32_LE( X2, input, 8 ); X2 ^= *RK++; 795 GET_UINT32_LE( X3, input, 12 ); X3 ^= *RK++; 796 797 for( i = ( ctx->nr >> 1 ) - 1; i > 0; i-- ) 798 { 799 AES_RROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 ); 800 AES_RROUND( X0, X1, X2, X3, Y0, Y1, Y2, Y3 ); 801 } 802 803 AES_RROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 ); 804 805 X0 = *RK++ ^ \ 806 ( (uint32_t) RSb[ ( Y0 ) & 0xFF ] ) ^ 807 ( (uint32_t) RSb[ ( Y3 >> 8 ) & 0xFF ] << 8 ) ^ 808 ( (uint32_t) RSb[ ( Y2 >> 16 ) & 0xFF ] << 16 ) ^ 809 ( (uint32_t) RSb[ ( Y1 >> 24 ) & 0xFF ] << 24 ); 810 811 X1 = *RK++ ^ \ 812 ( (uint32_t) RSb[ ( Y1 ) & 0xFF ] ) ^ 813 ( (uint32_t) RSb[ ( Y0 >> 8 ) & 0xFF ] << 8 ) ^ 814 ( (uint32_t) RSb[ ( Y3 >> 16 ) & 0xFF ] << 16 ) ^ 815 ( (uint32_t) RSb[ ( Y2 >> 24 ) & 0xFF ] << 24 ); 816 817 X2 = *RK++ ^ \ 818 ( (uint32_t) RSb[ ( Y2 ) & 0xFF ] ) ^ 819 ( (uint32_t) RSb[ ( Y1 >> 8 ) & 0xFF ] << 8 ) ^ 820 ( (uint32_t) RSb[ ( Y0 >> 16 ) & 0xFF ] << 16 ) ^ 821 ( (uint32_t) RSb[ ( Y3 >> 24 ) & 0xFF ] << 24 ); 822 823 X3 = *RK++ ^ \ 824 ( (uint32_t) RSb[ ( Y3 ) & 0xFF ] ) ^ 825 ( (uint32_t) RSb[ ( Y2 >> 8 ) & 0xFF ] << 8 ) ^ 826 ( (uint32_t) RSb[ ( Y1 >> 16 ) & 0xFF ] << 16 ) ^ 827 ( (uint32_t) RSb[ ( Y0 >> 24 ) & 0xFF ] << 24 ); 828 829 PUT_UINT32_LE( X0, output, 0 ); 830 PUT_UINT32_LE( X1, output, 4 ); 831 PUT_UINT32_LE( X2, output, 8 ); 832 PUT_UINT32_LE( X3, output, 12 ); 833 834 return( 0 ); 835 } 836 #endif /* !MBEDTLS_AES_DECRYPT_ALT */ 837 838 #if !defined(MBEDTLS_DEPRECATED_REMOVED) 839 void mbedtls_aes_decrypt( mbedtls_aes_context *ctx, 840 const unsigned char input[16], 841 unsigned char output[16] ) 842 { 843 mbedtls_internal_aes_decrypt( ctx, input, output ); 844 } 845 #endif /* !MBEDTLS_DEPRECATED_REMOVED */ 846 847 /* 848 * AES-ECB block encryption/decryption 849 */ 850 int mbedtls_aes_crypt_ecb( mbedtls_aes_context *ctx, 851 int mode, 852 const unsigned char input[16], 853 unsigned char output[16] ) 854 { 855 #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64) 856 if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) ) 857 return( mbedtls_aesni_crypt_ecb( ctx, mode, input, output ) ); 858 #endif 859 860 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_HAVE_X86) 861 if( aes_padlock_ace ) 862 { 863 if( mbedtls_padlock_xcryptecb( ctx, mode, input, output ) == 0 ) 864 return( 0 ); 865 866 // If padlock data misaligned, we just fall back to 867 // unaccelerated mode 868 // 869 } 870 #endif 871 872 if( mode == MBEDTLS_AES_ENCRYPT ) 873 return( mbedtls_internal_aes_encrypt( ctx, input, output ) ); 874 else 875 return( mbedtls_internal_aes_decrypt( ctx, input, output ) ); 876 } 877 878 #if defined(MBEDTLS_CIPHER_MODE_CBC) 879 /* 880 * AES-CBC buffer encryption/decryption 881 */ 882 int mbedtls_aes_crypt_cbc( mbedtls_aes_context *ctx, 883 int mode, 884 size_t length, 885 unsigned char iv[16], 886 const unsigned char *input, 887 unsigned char *output ) 888 { 889 int i; 890 unsigned char temp[16]; 891 892 if( length % 16 ) 893 return( MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH ); 894 895 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_HAVE_X86) 896 if( aes_padlock_ace ) 897 { 898 if( mbedtls_padlock_xcryptcbc( ctx, mode, length, iv, input, output ) == 0 ) 899 return( 0 ); 900 901 // If padlock data misaligned, we just fall back to 902 // unaccelerated mode 903 // 904 } 905 #endif 906 907 if( mode == MBEDTLS_AES_DECRYPT ) 908 { 909 while( length > 0 ) 910 { 911 memcpy( temp, input, 16 ); 912 mbedtls_aes_crypt_ecb( ctx, mode, input, output ); 913 914 for( i = 0; i < 16; i++ ) 915 output[i] = (unsigned char)( output[i] ^ iv[i] ); 916 917 memcpy( iv, temp, 16 ); 918 919 input += 16; 920 output += 16; 921 length -= 16; 922 } 923 } 924 else 925 { 926 while( length > 0 ) 927 { 928 for( i = 0; i < 16; i++ ) 929 output[i] = (unsigned char)( input[i] ^ iv[i] ); 930 931 mbedtls_aes_crypt_ecb( ctx, mode, output, output ); 932 memcpy( iv, output, 16 ); 933 934 input += 16; 935 output += 16; 936 length -= 16; 937 } 938 } 939 940 return( 0 ); 941 } 942 #endif /* MBEDTLS_CIPHER_MODE_CBC */ 943 944 #if defined(MBEDTLS_CIPHER_MODE_CFB) 945 /* 946 * AES-CFB128 buffer encryption/decryption 947 */ 948 int mbedtls_aes_crypt_cfb128( mbedtls_aes_context *ctx, 949 int mode, 950 size_t length, 951 size_t *iv_off, 952 unsigned char iv[16], 953 const unsigned char *input, 954 unsigned char *output ) 955 { 956 int c; 957 size_t n = *iv_off; 958 959 if( mode == MBEDTLS_AES_DECRYPT ) 960 { 961 while( length-- ) 962 { 963 if( n == 0 ) 964 mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv ); 965 966 c = *input++; 967 *output++ = (unsigned char)( c ^ iv[n] ); 968 iv[n] = (unsigned char) c; 969 970 n = ( n + 1 ) & 0x0F; 971 } 972 } 973 else 974 { 975 while( length-- ) 976 { 977 if( n == 0 ) 978 mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv ); 979 980 iv[n] = *output++ = (unsigned char)( iv[n] ^ *input++ ); 981 982 n = ( n + 1 ) & 0x0F; 983 } 984 } 985 986 *iv_off = n; 987 988 return( 0 ); 989 } 990 991 /* 992 * AES-CFB8 buffer encryption/decryption 993 */ 994 int mbedtls_aes_crypt_cfb8( mbedtls_aes_context *ctx, 995 int mode, 996 size_t length, 997 unsigned char iv[16], 998 const unsigned char *input, 999 unsigned char *output ) 1000 { 1001 unsigned char c; 1002 unsigned char ov[17]; 1003 1004 while( length-- ) 1005 { 1006 memcpy( ov, iv, 16 ); 1007 mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv ); 1008 1009 if( mode == MBEDTLS_AES_DECRYPT ) 1010 ov[16] = *input; 1011 1012 c = *output++ = (unsigned char)( iv[0] ^ *input++ ); 1013 1014 if( mode == MBEDTLS_AES_ENCRYPT ) 1015 ov[16] = c; 1016 1017 memcpy( iv, ov + 1, 16 ); 1018 } 1019 1020 return( 0 ); 1021 } 1022 #endif /*MBEDTLS_CIPHER_MODE_CFB */ 1023 1024 #if defined(MBEDTLS_CIPHER_MODE_CTR) 1025 /* 1026 * AES-CTR buffer encryption/decryption 1027 */ 1028 int mbedtls_aes_crypt_ctr( mbedtls_aes_context *ctx, 1029 size_t length, 1030 size_t *nc_off, 1031 unsigned char nonce_counter[16], 1032 unsigned char stream_block[16], 1033 const unsigned char *input, 1034 unsigned char *output ) 1035 { 1036 int c, i; 1037 size_t n = *nc_off; 1038 1039 while( length-- ) 1040 { 1041 if( n == 0 ) { 1042 mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, nonce_counter, stream_block ); 1043 1044 for( i = 16; i > 0; i-- ) 1045 if( ++nonce_counter[i - 1] != 0 ) 1046 break; 1047 } 1048 c = *input++; 1049 *output++ = (unsigned char)( c ^ stream_block[n] ); 1050 1051 n = ( n + 1 ) & 0x0F; 1052 } 1053 1054 *nc_off = n; 1055 1056 return( 0 ); 1057 } 1058 #endif /* MBEDTLS_CIPHER_MODE_CTR */ 1059 1060 #endif /* !MBEDTLS_AES_ALT */ 1061 1062 #if defined(MBEDTLS_SELF_TEST) 1063 /* 1064 * AES test vectors from: 1065 * 1066 * http://csrc.nist.gov/archive/aes/rijndael/rijndael-vals.zip 1067 */ 1068 static const unsigned char aes_test_ecb_dec[3][16] = 1069 { 1070 { 0x44, 0x41, 0x6A, 0xC2, 0xD1, 0xF5, 0x3C, 0x58, 1071 0x33, 0x03, 0x91, 0x7E, 0x6B, 0xE9, 0xEB, 0xE0 }, 1072 { 0x48, 0xE3, 0x1E, 0x9E, 0x25, 0x67, 0x18, 0xF2, 1073 0x92, 0x29, 0x31, 0x9C, 0x19, 0xF1, 0x5B, 0xA4 }, 1074 { 0x05, 0x8C, 0xCF, 0xFD, 0xBB, 0xCB, 0x38, 0x2D, 1075 0x1F, 0x6F, 0x56, 0x58, 0x5D, 0x8A, 0x4A, 0xDE } 1076 }; 1077 1078 static const unsigned char aes_test_ecb_enc[3][16] = 1079 { 1080 { 0xC3, 0x4C, 0x05, 0x2C, 0xC0, 0xDA, 0x8D, 0x73, 1081 0x45, 0x1A, 0xFE, 0x5F, 0x03, 0xBE, 0x29, 0x7F }, 1082 { 0xF3, 0xF6, 0x75, 0x2A, 0xE8, 0xD7, 0x83, 0x11, 1083 0x38, 0xF0, 0x41, 0x56, 0x06, 0x31, 0xB1, 0x14 }, 1084 { 0x8B, 0x79, 0xEE, 0xCC, 0x93, 0xA0, 0xEE, 0x5D, 1085 0xFF, 0x30, 0xB4, 0xEA, 0x21, 0x63, 0x6D, 0xA4 } 1086 }; 1087 1088 #if defined(MBEDTLS_CIPHER_MODE_CBC) 1089 static const unsigned char aes_test_cbc_dec[3][16] = 1090 { 1091 { 0xFA, 0xCA, 0x37, 0xE0, 0xB0, 0xC8, 0x53, 0x73, 1092 0xDF, 0x70, 0x6E, 0x73, 0xF7, 0xC9, 0xAF, 0x86 }, 1093 { 0x5D, 0xF6, 0x78, 0xDD, 0x17, 0xBA, 0x4E, 0x75, 1094 0xB6, 0x17, 0x68, 0xC6, 0xAD, 0xEF, 0x7C, 0x7B }, 1095 { 0x48, 0x04, 0xE1, 0x81, 0x8F, 0xE6, 0x29, 0x75, 1096 0x19, 0xA3, 0xE8, 0x8C, 0x57, 0x31, 0x04, 0x13 } 1097 }; 1098 1099 static const unsigned char aes_test_cbc_enc[3][16] = 1100 { 1101 { 0x8A, 0x05, 0xFC, 0x5E, 0x09, 0x5A, 0xF4, 0x84, 1102 0x8A, 0x08, 0xD3, 0x28, 0xD3, 0x68, 0x8E, 0x3D }, 1103 { 0x7B, 0xD9, 0x66, 0xD5, 0x3A, 0xD8, 0xC1, 0xBB, 1104 0x85, 0xD2, 0xAD, 0xFA, 0xE8, 0x7B, 0xB1, 0x04 }, 1105 { 0xFE, 0x3C, 0x53, 0x65, 0x3E, 0x2F, 0x45, 0xB5, 1106 0x6F, 0xCD, 0x88, 0xB2, 0xCC, 0x89, 0x8F, 0xF0 } 1107 }; 1108 #endif /* MBEDTLS_CIPHER_MODE_CBC */ 1109 1110 #if defined(MBEDTLS_CIPHER_MODE_CFB) 1111 /* 1112 * AES-CFB128 test vectors from: 1113 * 1114 * http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf 1115 */ 1116 static const unsigned char aes_test_cfb128_key[3][32] = 1117 { 1118 { 0x2B, 0x7E, 0x15, 0x16, 0x28, 0xAE, 0xD2, 0xA6, 1119 0xAB, 0xF7, 0x15, 0x88, 0x09, 0xCF, 0x4F, 0x3C }, 1120 { 0x8E, 0x73, 0xB0, 0xF7, 0xDA, 0x0E, 0x64, 0x52, 1121 0xC8, 0x10, 0xF3, 0x2B, 0x80, 0x90, 0x79, 0xE5, 1122 0x62, 0xF8, 0xEA, 0xD2, 0x52, 0x2C, 0x6B, 0x7B }, 1123 { 0x60, 0x3D, 0xEB, 0x10, 0x15, 0xCA, 0x71, 0xBE, 1124 0x2B, 0x73, 0xAE, 0xF0, 0x85, 0x7D, 0x77, 0x81, 1125 0x1F, 0x35, 0x2C, 0x07, 0x3B, 0x61, 0x08, 0xD7, 1126 0x2D, 0x98, 0x10, 0xA3, 0x09, 0x14, 0xDF, 0xF4 } 1127 }; 1128 1129 static const unsigned char aes_test_cfb128_iv[16] = 1130 { 1131 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 1132 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F 1133 }; 1134 1135 static const unsigned char aes_test_cfb128_pt[64] = 1136 { 1137 0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96, 1138 0xE9, 0x3D, 0x7E, 0x11, 0x73, 0x93, 0x17, 0x2A, 1139 0xAE, 0x2D, 0x8A, 0x57, 0x1E, 0x03, 0xAC, 0x9C, 1140 0x9E, 0xB7, 0x6F, 0xAC, 0x45, 0xAF, 0x8E, 0x51, 1141 0x30, 0xC8, 0x1C, 0x46, 0xA3, 0x5C, 0xE4, 0x11, 1142 0xE5, 0xFB, 0xC1, 0x19, 0x1A, 0x0A, 0x52, 0xEF, 1143 0xF6, 0x9F, 0x24, 0x45, 0xDF, 0x4F, 0x9B, 0x17, 1144 0xAD, 0x2B, 0x41, 0x7B, 0xE6, 0x6C, 0x37, 0x10 1145 }; 1146 1147 static const unsigned char aes_test_cfb128_ct[3][64] = 1148 { 1149 { 0x3B, 0x3F, 0xD9, 0x2E, 0xB7, 0x2D, 0xAD, 0x20, 1150 0x33, 0x34, 0x49, 0xF8, 0xE8, 0x3C, 0xFB, 0x4A, 1151 0xC8, 0xA6, 0x45, 0x37, 0xA0, 0xB3, 0xA9, 0x3F, 1152 0xCD, 0xE3, 0xCD, 0xAD, 0x9F, 0x1C, 0xE5, 0x8B, 1153 0x26, 0x75, 0x1F, 0x67, 0xA3, 0xCB, 0xB1, 0x40, 1154 0xB1, 0x80, 0x8C, 0xF1, 0x87, 0xA4, 0xF4, 0xDF, 1155 0xC0, 0x4B, 0x05, 0x35, 0x7C, 0x5D, 0x1C, 0x0E, 1156 0xEA, 0xC4, 0xC6, 0x6F, 0x9F, 0xF7, 0xF2, 0xE6 }, 1157 { 0xCD, 0xC8, 0x0D, 0x6F, 0xDD, 0xF1, 0x8C, 0xAB, 1158 0x34, 0xC2, 0x59, 0x09, 0xC9, 0x9A, 0x41, 0x74, 1159 0x67, 0xCE, 0x7F, 0x7F, 0x81, 0x17, 0x36, 0x21, 1160 0x96, 0x1A, 0x2B, 0x70, 0x17, 0x1D, 0x3D, 0x7A, 1161 0x2E, 0x1E, 0x8A, 0x1D, 0xD5, 0x9B, 0x88, 0xB1, 1162 0xC8, 0xE6, 0x0F, 0xED, 0x1E, 0xFA, 0xC4, 0xC9, 1163 0xC0, 0x5F, 0x9F, 0x9C, 0xA9, 0x83, 0x4F, 0xA0, 1164 0x42, 0xAE, 0x8F, 0xBA, 0x58, 0x4B, 0x09, 0xFF }, 1165 { 0xDC, 0x7E, 0x84, 0xBF, 0xDA, 0x79, 0x16, 0x4B, 1166 0x7E, 0xCD, 0x84, 0x86, 0x98, 0x5D, 0x38, 0x60, 1167 0x39, 0xFF, 0xED, 0x14, 0x3B, 0x28, 0xB1, 0xC8, 1168 0x32, 0x11, 0x3C, 0x63, 0x31, 0xE5, 0x40, 0x7B, 1169 0xDF, 0x10, 0x13, 0x24, 0x15, 0xE5, 0x4B, 0x92, 1170 0xA1, 0x3E, 0xD0, 0xA8, 0x26, 0x7A, 0xE2, 0xF9, 1171 0x75, 0xA3, 0x85, 0x74, 0x1A, 0xB9, 0xCE, 0xF8, 1172 0x20, 0x31, 0x62, 0x3D, 0x55, 0xB1, 0xE4, 0x71 } 1173 }; 1174 #endif /* MBEDTLS_CIPHER_MODE_CFB */ 1175 1176 #if defined(MBEDTLS_CIPHER_MODE_CTR) 1177 /* 1178 * AES-CTR test vectors from: 1179 * 1180 * http://www.faqs.org/rfcs/rfc3686.html 1181 */ 1182 1183 static const unsigned char aes_test_ctr_key[3][16] = 1184 { 1185 { 0xAE, 0x68, 0x52, 0xF8, 0x12, 0x10, 0x67, 0xCC, 1186 0x4B, 0xF7, 0xA5, 0x76, 0x55, 0x77, 0xF3, 0x9E }, 1187 { 0x7E, 0x24, 0x06, 0x78, 0x17, 0xFA, 0xE0, 0xD7, 1188 0x43, 0xD6, 0xCE, 0x1F, 0x32, 0x53, 0x91, 0x63 }, 1189 { 0x76, 0x91, 0xBE, 0x03, 0x5E, 0x50, 0x20, 0xA8, 1190 0xAC, 0x6E, 0x61, 0x85, 0x29, 0xF9, 0xA0, 0xDC } 1191 }; 1192 1193 static const unsigned char aes_test_ctr_nonce_counter[3][16] = 1194 { 1195 { 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x00, 1196 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 }, 1197 { 0x00, 0x6C, 0xB6, 0xDB, 0xC0, 0x54, 0x3B, 0x59, 1198 0xDA, 0x48, 0xD9, 0x0B, 0x00, 0x00, 0x00, 0x01 }, 1199 { 0x00, 0xE0, 0x01, 0x7B, 0x27, 0x77, 0x7F, 0x3F, 1200 0x4A, 0x17, 0x86, 0xF0, 0x00, 0x00, 0x00, 0x01 } 1201 }; 1202 1203 static const unsigned char aes_test_ctr_pt[3][48] = 1204 { 1205 { 0x53, 0x69, 0x6E, 0x67, 0x6C, 0x65, 0x20, 0x62, 1206 0x6C, 0x6F, 0x63, 0x6B, 0x20, 0x6D, 0x73, 0x67 }, 1207 1208 { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 1209 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 1210 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 1211 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F }, 1212 1213 { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 1214 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 1215 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 1216 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 1217 0x20, 0x21, 0x22, 0x23 } 1218 }; 1219 1220 static const unsigned char aes_test_ctr_ct[3][48] = 1221 { 1222 { 0xE4, 0x09, 0x5D, 0x4F, 0xB7, 0xA7, 0xB3, 0x79, 1223 0x2D, 0x61, 0x75, 0xA3, 0x26, 0x13, 0x11, 0xB8 }, 1224 { 0x51, 0x04, 0xA1, 0x06, 0x16, 0x8A, 0x72, 0xD9, 1225 0x79, 0x0D, 0x41, 0xEE, 0x8E, 0xDA, 0xD3, 0x88, 1226 0xEB, 0x2E, 0x1E, 0xFC, 0x46, 0xDA, 0x57, 0xC8, 1227 0xFC, 0xE6, 0x30, 0xDF, 0x91, 0x41, 0xBE, 0x28 }, 1228 { 0xC1, 0xCF, 0x48, 0xA8, 0x9F, 0x2F, 0xFD, 0xD9, 1229 0xCF, 0x46, 0x52, 0xE9, 0xEF, 0xDB, 0x72, 0xD7, 1230 0x45, 0x40, 0xA4, 0x2B, 0xDE, 0x6D, 0x78, 0x36, 1231 0xD5, 0x9A, 0x5C, 0xEA, 0xAE, 0xF3, 0x10, 0x53, 1232 0x25, 0xB2, 0x07, 0x2F } 1233 }; 1234 1235 static const int aes_test_ctr_len[3] = 1236 { 16, 32, 36 }; 1237 #endif /* MBEDTLS_CIPHER_MODE_CTR */ 1238 1239 /* 1240 * Checkup routine 1241 */ 1242 int mbedtls_aes_self_test( int verbose ) 1243 { 1244 int ret = 0, i, j, u, mode; 1245 unsigned int keybits; 1246 unsigned char key[32]; 1247 unsigned char buf[64]; 1248 const unsigned char *aes_tests; 1249 #if defined(MBEDTLS_CIPHER_MODE_CBC) || defined(MBEDTLS_CIPHER_MODE_CFB) 1250 unsigned char iv[16]; 1251 #endif 1252 #if defined(MBEDTLS_CIPHER_MODE_CBC) 1253 unsigned char prv[16]; 1254 #endif 1255 #if defined(MBEDTLS_CIPHER_MODE_CTR) || defined(MBEDTLS_CIPHER_MODE_CFB) 1256 size_t offset; 1257 #endif 1258 #if defined(MBEDTLS_CIPHER_MODE_CTR) 1259 int len; 1260 unsigned char nonce_counter[16]; 1261 unsigned char stream_block[16]; 1262 #endif 1263 mbedtls_aes_context ctx; 1264 1265 memset( key, 0, 32 ); 1266 mbedtls_aes_init( &ctx ); 1267 1268 /* 1269 * ECB mode 1270 */ 1271 for( i = 0; i < 6; i++ ) 1272 { 1273 u = i >> 1; 1274 keybits = 128 + u * 64; 1275 mode = i & 1; 1276 1277 if( verbose != 0 ) 1278 mbedtls_printf( " AES-ECB-%3d (%s): ", keybits, 1279 ( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" ); 1280 1281 memset( buf, 0, 16 ); 1282 1283 if( mode == MBEDTLS_AES_DECRYPT ) 1284 { 1285 ret = mbedtls_aes_setkey_dec( &ctx, key, keybits ); 1286 aes_tests = aes_test_ecb_dec[u]; 1287 } 1288 else 1289 { 1290 ret = mbedtls_aes_setkey_enc( &ctx, key, keybits ); 1291 aes_tests = aes_test_ecb_enc[u]; 1292 } 1293 1294 /* 1295 * AES-192 is an optional feature that may be unavailable when 1296 * there is an alternative underlying implementation i.e. when 1297 * MBEDTLS_AES_ALT is defined. 1298 */ 1299 if( ret == MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE && keybits == 192 ) 1300 { 1301 mbedtls_printf( "skipped\n" ); 1302 continue; 1303 } 1304 else if( ret != 0 ) 1305 { 1306 goto exit; 1307 } 1308 1309 for( j = 0; j < 10000; j++ ) 1310 { 1311 ret = mbedtls_aes_crypt_ecb( &ctx, mode, buf, buf ); 1312 if( ret != 0 ) 1313 goto exit; 1314 } 1315 1316 if( memcmp( buf, aes_tests, 16 ) != 0 ) 1317 { 1318 ret = 1; 1319 goto exit; 1320 } 1321 1322 if( verbose != 0 ) 1323 mbedtls_printf( "passed\n" ); 1324 } 1325 1326 if( verbose != 0 ) 1327 mbedtls_printf( "\n" ); 1328 1329 #if defined(MBEDTLS_CIPHER_MODE_CBC) 1330 /* 1331 * CBC mode 1332 */ 1333 for( i = 0; i < 6; i++ ) 1334 { 1335 u = i >> 1; 1336 keybits = 128 + u * 64; 1337 mode = i & 1; 1338 1339 if( verbose != 0 ) 1340 mbedtls_printf( " AES-CBC-%3d (%s): ", keybits, 1341 ( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" ); 1342 1343 memset( iv , 0, 16 ); 1344 memset( prv, 0, 16 ); 1345 memset( buf, 0, 16 ); 1346 1347 if( mode == MBEDTLS_AES_DECRYPT ) 1348 { 1349 ret = mbedtls_aes_setkey_dec( &ctx, key, keybits ); 1350 aes_tests = aes_test_cbc_dec[u]; 1351 } 1352 else 1353 { 1354 ret = mbedtls_aes_setkey_enc( &ctx, key, keybits ); 1355 aes_tests = aes_test_cbc_enc[u]; 1356 } 1357 1358 /* 1359 * AES-192 is an optional feature that may be unavailable when 1360 * there is an alternative underlying implementation i.e. when 1361 * MBEDTLS_AES_ALT is defined. 1362 */ 1363 if( ret == MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE && keybits == 192 ) 1364 { 1365 mbedtls_printf( "skipped\n" ); 1366 continue; 1367 } 1368 else if( ret != 0 ) 1369 { 1370 goto exit; 1371 } 1372 1373 for( j = 0; j < 10000; j++ ) 1374 { 1375 if( mode == MBEDTLS_AES_ENCRYPT ) 1376 { 1377 unsigned char tmp[16]; 1378 1379 memcpy( tmp, prv, 16 ); 1380 memcpy( prv, buf, 16 ); 1381 memcpy( buf, tmp, 16 ); 1382 } 1383 1384 ret = mbedtls_aes_crypt_cbc( &ctx, mode, 16, iv, buf, buf ); 1385 if( ret != 0 ) 1386 goto exit; 1387 1388 } 1389 1390 if( memcmp( buf, aes_tests, 16 ) != 0 ) 1391 { 1392 ret = 1; 1393 goto exit; 1394 } 1395 1396 if( verbose != 0 ) 1397 mbedtls_printf( "passed\n" ); 1398 } 1399 1400 if( verbose != 0 ) 1401 mbedtls_printf( "\n" ); 1402 #endif /* MBEDTLS_CIPHER_MODE_CBC */ 1403 1404 #if defined(MBEDTLS_CIPHER_MODE_CFB) 1405 /* 1406 * CFB128 mode 1407 */ 1408 for( i = 0; i < 6; i++ ) 1409 { 1410 u = i >> 1; 1411 keybits = 128 + u * 64; 1412 mode = i & 1; 1413 1414 if( verbose != 0 ) 1415 mbedtls_printf( " AES-CFB128-%3d (%s): ", keybits, 1416 ( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" ); 1417 1418 memcpy( iv, aes_test_cfb128_iv, 16 ); 1419 memcpy( key, aes_test_cfb128_key[u], keybits / 8 ); 1420 1421 offset = 0; 1422 ret = mbedtls_aes_setkey_enc( &ctx, key, keybits ); 1423 /* 1424 * AES-192 is an optional feature that may be unavailable when 1425 * there is an alternative underlying implementation i.e. when 1426 * MBEDTLS_AES_ALT is defined. 1427 */ 1428 if( ret == MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE && keybits == 192 ) 1429 { 1430 mbedtls_printf( "skipped\n" ); 1431 continue; 1432 } 1433 else if( ret != 0 ) 1434 { 1435 goto exit; 1436 } 1437 1438 if( mode == MBEDTLS_AES_DECRYPT ) 1439 { 1440 memcpy( buf, aes_test_cfb128_ct[u], 64 ); 1441 aes_tests = aes_test_cfb128_pt; 1442 } 1443 else 1444 { 1445 memcpy( buf, aes_test_cfb128_pt, 64 ); 1446 aes_tests = aes_test_cfb128_ct[u]; 1447 } 1448 1449 ret = mbedtls_aes_crypt_cfb128( &ctx, mode, 64, &offset, iv, buf, buf ); 1450 if( ret != 0 ) 1451 goto exit; 1452 1453 if( memcmp( buf, aes_tests, 64 ) != 0 ) 1454 { 1455 ret = 1; 1456 goto exit; 1457 } 1458 1459 if( verbose != 0 ) 1460 mbedtls_printf( "passed\n" ); 1461 } 1462 1463 if( verbose != 0 ) 1464 mbedtls_printf( "\n" ); 1465 #endif /* MBEDTLS_CIPHER_MODE_CFB */ 1466 1467 #if defined(MBEDTLS_CIPHER_MODE_CTR) 1468 /* 1469 * CTR mode 1470 */ 1471 for( i = 0; i < 6; i++ ) 1472 { 1473 u = i >> 1; 1474 mode = i & 1; 1475 1476 if( verbose != 0 ) 1477 mbedtls_printf( " AES-CTR-128 (%s): ", 1478 ( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" ); 1479 1480 memcpy( nonce_counter, aes_test_ctr_nonce_counter[u], 16 ); 1481 memcpy( key, aes_test_ctr_key[u], 16 ); 1482 1483 offset = 0; 1484 if( ( ret = mbedtls_aes_setkey_enc( &ctx, key, 128 ) ) != 0 ) 1485 goto exit; 1486 1487 len = aes_test_ctr_len[u]; 1488 1489 if( mode == MBEDTLS_AES_DECRYPT ) 1490 { 1491 memcpy( buf, aes_test_ctr_ct[u], len ); 1492 aes_tests = aes_test_ctr_pt[u]; 1493 } 1494 else 1495 { 1496 memcpy( buf, aes_test_ctr_pt[u], len ); 1497 aes_tests = aes_test_ctr_ct[u]; 1498 } 1499 1500 ret = mbedtls_aes_crypt_ctr( &ctx, len, &offset, nonce_counter, 1501 stream_block, buf, buf ); 1502 if( ret != 0 ) 1503 goto exit; 1504 1505 if( memcmp( buf, aes_tests, len ) != 0 ) 1506 { 1507 ret = 1; 1508 goto exit; 1509 } 1510 1511 if( verbose != 0 ) 1512 mbedtls_printf( "passed\n" ); 1513 } 1514 1515 if( verbose != 0 ) 1516 mbedtls_printf( "\n" ); 1517 #endif /* MBEDTLS_CIPHER_MODE_CTR */ 1518 1519 ret = 0; 1520 1521 exit: 1522 if( ret != 0 && verbose != 0 ) 1523 mbedtls_printf( "failed\n" ); 1524 1525 mbedtls_aes_free( &ctx ); 1526 1527 return( ret ); 1528 } 1529 1530 #endif /* MBEDTLS_SELF_TEST */ 1531 1532 #endif /* MBEDTLS_AES_C */ 1533