1 /* $KAME: rijndael-alg-fst.c,v 1.7 2001/05/27 00:23:23 itojun Exp $ */ 2 3 /* 4 * rijndael-alg-fst.c v2.3 April '2000 5 * 6 * Optimised ANSI C code 7 * 8 * authors: v1.0: Antoon Bosselaers 9 * v2.0: Vincent Rijmen 10 * v2.3: Paulo Barreto 11 * 12 * This code is placed in the public domain. 13 */ 14 15 #include <sys/cdefs.h> 16 __FBSDID("$FreeBSD$"); 17 18 #include <sys/cdefs.h> 19 #include <sys/types.h> 20 #ifdef _KERNEL 21 #include <sys/systm.h> 22 #else 23 #include <string.h> 24 #endif 25 #include <crypto/rijndael/rijndael-alg-fst.h> 26 #include <crypto/rijndael/rijndael_local.h> 27 28 #include <crypto/rijndael/boxes-fst.dat> 29 30 int rijndaelKeySched(word8 k[MAXKC][4], word8 W[MAXROUNDS+1][4][4], int ROUNDS) { 31 /* Calculate the necessary round keys 32 * The number of calculations depends on keyBits and blockBits 33 */ 34 int j, r, t, rconpointer = 0; 35 union { 36 word8 x8[MAXKC][4]; 37 word32 x32[MAXKC]; 38 } xtk; 39 #define tk xtk.x8 40 int KC = ROUNDS - 6; 41 42 for (j = KC-1; j >= 0; j--) { 43 *((word32*)tk[j]) = *((word32*)k[j]); 44 } 45 r = 0; 46 t = 0; 47 /* copy values into round key array */ 48 for (j = 0; (j < KC) && (r < ROUNDS + 1); ) { 49 for (; (j < KC) && (t < 4); j++, t++) { 50 *((word32*)W[r][t]) = *((word32*)tk[j]); 51 } 52 if (t == 4) { 53 r++; 54 t = 0; 55 } 56 } 57 58 while (r < ROUNDS + 1) { /* while not enough round key material calculated */ 59 /* calculate new values */ 60 tk[0][0] ^= S[tk[KC-1][1]]; 61 tk[0][1] ^= S[tk[KC-1][2]]; 62 tk[0][2] ^= S[tk[KC-1][3]]; 63 tk[0][3] ^= S[tk[KC-1][0]]; 64 tk[0][0] ^= rcon[rconpointer++]; 65 66 if (KC != 8) { 67 for (j = 1; j < KC; j++) { 68 *((word32*)tk[j]) ^= *((word32*)tk[j-1]); 69 } 70 } else { 71 for (j = 1; j < KC/2; j++) { 72 *((word32*)tk[j]) ^= *((word32*)tk[j-1]); 73 } 74 tk[KC/2][0] ^= S[tk[KC/2 - 1][0]]; 75 tk[KC/2][1] ^= S[tk[KC/2 - 1][1]]; 76 tk[KC/2][2] ^= S[tk[KC/2 - 1][2]]; 77 tk[KC/2][3] ^= S[tk[KC/2 - 1][3]]; 78 for (j = KC/2 + 1; j < KC; j++) { 79 *((word32*)tk[j]) ^= *((word32*)tk[j-1]); 80 } 81 } 82 /* copy values into round key array */ 83 for (j = 0; (j < KC) && (r < ROUNDS + 1); ) { 84 for (; (j < KC) && (t < 4); j++, t++) { 85 *((word32*)W[r][t]) = *((word32*)tk[j]); 86 } 87 if (t == 4) { 88 r++; 89 t = 0; 90 } 91 } 92 } 93 return 0; 94 #undef tk 95 } 96 97 int rijndaelKeyEncToDec(word8 W[MAXROUNDS+1][4][4], int ROUNDS) { 98 int r; 99 word8 *w; 100 101 for (r = 1; r < ROUNDS; r++) { 102 w = W[r][0]; 103 *((word32*)w) = 104 *((const word32*)U1[w[0]]) 105 ^ *((const word32*)U2[w[1]]) 106 ^ *((const word32*)U3[w[2]]) 107 ^ *((const word32*)U4[w[3]]); 108 109 w = W[r][1]; 110 *((word32*)w) = 111 *((const word32*)U1[w[0]]) 112 ^ *((const word32*)U2[w[1]]) 113 ^ *((const word32*)U3[w[2]]) 114 ^ *((const word32*)U4[w[3]]); 115 116 w = W[r][2]; 117 *((word32*)w) = 118 *((const word32*)U1[w[0]]) 119 ^ *((const word32*)U2[w[1]]) 120 ^ *((const word32*)U3[w[2]]) 121 ^ *((const word32*)U4[w[3]]); 122 123 w = W[r][3]; 124 *((word32*)w) = 125 *((const word32*)U1[w[0]]) 126 ^ *((const word32*)U2[w[1]]) 127 ^ *((const word32*)U3[w[2]]) 128 ^ *((const word32*)U4[w[3]]); 129 } 130 return 0; 131 } 132 133 /** 134 * Encrypt a single block. 135 */ 136 int rijndaelEncrypt(word8 in[16], word8 out[16], word8 rk[MAXROUNDS+1][4][4], int ROUNDS) { 137 int r; 138 union { 139 word8 x8[16]; 140 word32 x32[4]; 141 } xa, xb; 142 #define a xa.x8 143 #define b xb.x8 144 union { 145 word8 x8[4][4]; 146 word32 x32[4]; 147 } xtemp; 148 #define temp xtemp.x8 149 150 memcpy(a, in, sizeof a); 151 152 *((word32*)temp[0]) = *((word32*)(a )) ^ *((word32*)rk[0][0]); 153 *((word32*)temp[1]) = *((word32*)(a+ 4)) ^ *((word32*)rk[0][1]); 154 *((word32*)temp[2]) = *((word32*)(a+ 8)) ^ *((word32*)rk[0][2]); 155 *((word32*)temp[3]) = *((word32*)(a+12)) ^ *((word32*)rk[0][3]); 156 *((word32*)(b )) = *((const word32*)T1[temp[0][0]]) 157 ^ *((const word32*)T2[temp[1][1]]) 158 ^ *((const word32*)T3[temp[2][2]]) 159 ^ *((const word32*)T4[temp[3][3]]); 160 *((word32*)(b + 4)) = *((const word32*)T1[temp[1][0]]) 161 ^ *((const word32*)T2[temp[2][1]]) 162 ^ *((const word32*)T3[temp[3][2]]) 163 ^ *((const word32*)T4[temp[0][3]]); 164 *((word32*)(b + 8)) = *((const word32*)T1[temp[2][0]]) 165 ^ *((const word32*)T2[temp[3][1]]) 166 ^ *((const word32*)T3[temp[0][2]]) 167 ^ *((const word32*)T4[temp[1][3]]); 168 *((word32*)(b +12)) = *((const word32*)T1[temp[3][0]]) 169 ^ *((const word32*)T2[temp[0][1]]) 170 ^ *((const word32*)T3[temp[1][2]]) 171 ^ *((const word32*)T4[temp[2][3]]); 172 for (r = 1; r < ROUNDS-1; r++) { 173 *((word32*)temp[0]) = *((word32*)(b )) ^ *((word32*)rk[r][0]); 174 *((word32*)temp[1]) = *((word32*)(b+ 4)) ^ *((word32*)rk[r][1]); 175 *((word32*)temp[2]) = *((word32*)(b+ 8)) ^ *((word32*)rk[r][2]); 176 *((word32*)temp[3]) = *((word32*)(b+12)) ^ *((word32*)rk[r][3]); 177 178 *((word32*)(b )) = *((const word32*)T1[temp[0][0]]) 179 ^ *((const word32*)T2[temp[1][1]]) 180 ^ *((const word32*)T3[temp[2][2]]) 181 ^ *((const word32*)T4[temp[3][3]]); 182 *((word32*)(b + 4)) = *((const word32*)T1[temp[1][0]]) 183 ^ *((const word32*)T2[temp[2][1]]) 184 ^ *((const word32*)T3[temp[3][2]]) 185 ^ *((const word32*)T4[temp[0][3]]); 186 *((word32*)(b + 8)) = *((const word32*)T1[temp[2][0]]) 187 ^ *((const word32*)T2[temp[3][1]]) 188 ^ *((const word32*)T3[temp[0][2]]) 189 ^ *((const word32*)T4[temp[1][3]]); 190 *((word32*)(b +12)) = *((const word32*)T1[temp[3][0]]) 191 ^ *((const word32*)T2[temp[0][1]]) 192 ^ *((const word32*)T3[temp[1][2]]) 193 ^ *((const word32*)T4[temp[2][3]]); 194 } 195 /* last round is special */ 196 *((word32*)temp[0]) = *((word32*)(b )) ^ *((word32*)rk[ROUNDS-1][0]); 197 *((word32*)temp[1]) = *((word32*)(b+ 4)) ^ *((word32*)rk[ROUNDS-1][1]); 198 *((word32*)temp[2]) = *((word32*)(b+ 8)) ^ *((word32*)rk[ROUNDS-1][2]); 199 *((word32*)temp[3]) = *((word32*)(b+12)) ^ *((word32*)rk[ROUNDS-1][3]); 200 b[ 0] = T1[temp[0][0]][1]; 201 b[ 1] = T1[temp[1][1]][1]; 202 b[ 2] = T1[temp[2][2]][1]; 203 b[ 3] = T1[temp[3][3]][1]; 204 b[ 4] = T1[temp[1][0]][1]; 205 b[ 5] = T1[temp[2][1]][1]; 206 b[ 6] = T1[temp[3][2]][1]; 207 b[ 7] = T1[temp[0][3]][1]; 208 b[ 8] = T1[temp[2][0]][1]; 209 b[ 9] = T1[temp[3][1]][1]; 210 b[10] = T1[temp[0][2]][1]; 211 b[11] = T1[temp[1][3]][1]; 212 b[12] = T1[temp[3][0]][1]; 213 b[13] = T1[temp[0][1]][1]; 214 b[14] = T1[temp[1][2]][1]; 215 b[15] = T1[temp[2][3]][1]; 216 *((word32*)(b )) ^= *((word32*)rk[ROUNDS][0]); 217 *((word32*)(b+ 4)) ^= *((word32*)rk[ROUNDS][1]); 218 *((word32*)(b+ 8)) ^= *((word32*)rk[ROUNDS][2]); 219 *((word32*)(b+12)) ^= *((word32*)rk[ROUNDS][3]); 220 221 memcpy(out, b, sizeof b /* XXX out */); 222 223 return 0; 224 #undef a 225 #undef b 226 #undef temp 227 } 228 229 #ifdef INTERMEDIATE_VALUE_KAT 230 /** 231 * Encrypt only a certain number of rounds. 232 * Only used in the Intermediate Value Known Answer Test. 233 */ 234 int rijndaelEncryptRound(word8 a[4][4], word8 rk[MAXROUNDS+1][4][4], int ROUNDS, int rounds) { 235 int r; 236 word8 temp[4][4]; 237 238 /* make number of rounds sane */ 239 if (rounds > ROUNDS) { 240 rounds = ROUNDS; 241 } 242 243 *((word32*)a[0]) = *((word32*)a[0]) ^ *((word32*)rk[0][0]); 244 *((word32*)a[1]) = *((word32*)a[1]) ^ *((word32*)rk[0][1]); 245 *((word32*)a[2]) = *((word32*)a[2]) ^ *((word32*)rk[0][2]); 246 *((word32*)a[3]) = *((word32*)a[3]) ^ *((word32*)rk[0][3]); 247 248 for (r = 1; (r <= rounds) && (r < ROUNDS); r++) { 249 *((word32*)temp[0]) = *((word32*)T1[a[0][0]]) 250 ^ *((word32*)T2[a[1][1]]) 251 ^ *((word32*)T3[a[2][2]]) 252 ^ *((word32*)T4[a[3][3]]); 253 *((word32*)temp[1]) = *((word32*)T1[a[1][0]]) 254 ^ *((word32*)T2[a[2][1]]) 255 ^ *((word32*)T3[a[3][2]]) 256 ^ *((word32*)T4[a[0][3]]); 257 *((word32*)temp[2]) = *((word32*)T1[a[2][0]]) 258 ^ *((word32*)T2[a[3][1]]) 259 ^ *((word32*)T3[a[0][2]]) 260 ^ *((word32*)T4[a[1][3]]); 261 *((word32*)temp[3]) = *((word32*)T1[a[3][0]]) 262 ^ *((word32*)T2[a[0][1]]) 263 ^ *((word32*)T3[a[1][2]]) 264 ^ *((word32*)T4[a[2][3]]); 265 *((word32*)a[0]) = *((word32*)temp[0]) ^ *((word32*)rk[r][0]); 266 *((word32*)a[1]) = *((word32*)temp[1]) ^ *((word32*)rk[r][1]); 267 *((word32*)a[2]) = *((word32*)temp[2]) ^ *((word32*)rk[r][2]); 268 *((word32*)a[3]) = *((word32*)temp[3]) ^ *((word32*)rk[r][3]); 269 } 270 if (rounds == ROUNDS) { 271 /* last round is special */ 272 temp[0][0] = T1[a[0][0]][1]; 273 temp[0][1] = T1[a[1][1]][1]; 274 temp[0][2] = T1[a[2][2]][1]; 275 temp[0][3] = T1[a[3][3]][1]; 276 temp[1][0] = T1[a[1][0]][1]; 277 temp[1][1] = T1[a[2][1]][1]; 278 temp[1][2] = T1[a[3][2]][1]; 279 temp[1][3] = T1[a[0][3]][1]; 280 temp[2][0] = T1[a[2][0]][1]; 281 temp[2][1] = T1[a[3][1]][1]; 282 temp[2][2] = T1[a[0][2]][1]; 283 temp[2][3] = T1[a[1][3]][1]; 284 temp[3][0] = T1[a[3][0]][1]; 285 temp[3][1] = T1[a[0][1]][1]; 286 temp[3][2] = T1[a[1][2]][1]; 287 temp[3][3] = T1[a[2][3]][1]; 288 *((word32*)a[0]) = *((word32*)temp[0]) ^ *((word32*)rk[ROUNDS][0]); 289 *((word32*)a[1]) = *((word32*)temp[1]) ^ *((word32*)rk[ROUNDS][1]); 290 *((word32*)a[2]) = *((word32*)temp[2]) ^ *((word32*)rk[ROUNDS][2]); 291 *((word32*)a[3]) = *((word32*)temp[3]) ^ *((word32*)rk[ROUNDS][3]); 292 } 293 294 return 0; 295 } 296 #endif /* INTERMEDIATE_VALUE_KAT */ 297 298 /** 299 * Decrypt a single block. 300 */ 301 int rijndaelDecrypt(word8 in[16], word8 out[16], word8 rk[MAXROUNDS+1][4][4], int ROUNDS) { 302 int r; 303 union { 304 word8 x8[16]; 305 word32 x32[4]; 306 } xa, xb; 307 #define a xa.x8 308 #define b xb.x8 309 union { 310 word8 x8[4][4]; 311 word32 x32[4]; 312 } xtemp; 313 #define temp xtemp.x8 314 315 memcpy(a, in, sizeof a); 316 317 *((word32*)temp[0]) = *((word32*)(a )) ^ *((word32*)rk[ROUNDS][0]); 318 *((word32*)temp[1]) = *((word32*)(a+ 4)) ^ *((word32*)rk[ROUNDS][1]); 319 *((word32*)temp[2]) = *((word32*)(a+ 8)) ^ *((word32*)rk[ROUNDS][2]); 320 *((word32*)temp[3]) = *((word32*)(a+12)) ^ *((word32*)rk[ROUNDS][3]); 321 322 *((word32*)(b )) = *((const word32*)T5[temp[0][0]]) 323 ^ *((const word32*)T6[temp[3][1]]) 324 ^ *((const word32*)T7[temp[2][2]]) 325 ^ *((const word32*)T8[temp[1][3]]); 326 *((word32*)(b+ 4)) = *((const word32*)T5[temp[1][0]]) 327 ^ *((const word32*)T6[temp[0][1]]) 328 ^ *((const word32*)T7[temp[3][2]]) 329 ^ *((const word32*)T8[temp[2][3]]); 330 *((word32*)(b+ 8)) = *((const word32*)T5[temp[2][0]]) 331 ^ *((const word32*)T6[temp[1][1]]) 332 ^ *((const word32*)T7[temp[0][2]]) 333 ^ *((const word32*)T8[temp[3][3]]); 334 *((word32*)(b+12)) = *((const word32*)T5[temp[3][0]]) 335 ^ *((const word32*)T6[temp[2][1]]) 336 ^ *((const word32*)T7[temp[1][2]]) 337 ^ *((const word32*)T8[temp[0][3]]); 338 for (r = ROUNDS-1; r > 1; r--) { 339 *((word32*)temp[0]) = *((word32*)(b )) ^ *((word32*)rk[r][0]); 340 *((word32*)temp[1]) = *((word32*)(b+ 4)) ^ *((word32*)rk[r][1]); 341 *((word32*)temp[2]) = *((word32*)(b+ 8)) ^ *((word32*)rk[r][2]); 342 *((word32*)temp[3]) = *((word32*)(b+12)) ^ *((word32*)rk[r][3]); 343 *((word32*)(b )) = *((const word32*)T5[temp[0][0]]) 344 ^ *((const word32*)T6[temp[3][1]]) 345 ^ *((const word32*)T7[temp[2][2]]) 346 ^ *((const word32*)T8[temp[1][3]]); 347 *((word32*)(b+ 4)) = *((const word32*)T5[temp[1][0]]) 348 ^ *((const word32*)T6[temp[0][1]]) 349 ^ *((const word32*)T7[temp[3][2]]) 350 ^ *((const word32*)T8[temp[2][3]]); 351 *((word32*)(b+ 8)) = *((const word32*)T5[temp[2][0]]) 352 ^ *((const word32*)T6[temp[1][1]]) 353 ^ *((const word32*)T7[temp[0][2]]) 354 ^ *((const word32*)T8[temp[3][3]]); 355 *((word32*)(b+12)) = *((const word32*)T5[temp[3][0]]) 356 ^ *((const word32*)T6[temp[2][1]]) 357 ^ *((const word32*)T7[temp[1][2]]) 358 ^ *((const word32*)T8[temp[0][3]]); 359 } 360 /* last round is special */ 361 *((word32*)temp[0]) = *((word32*)(b )) ^ *((word32*)rk[1][0]); 362 *((word32*)temp[1]) = *((word32*)(b+ 4)) ^ *((word32*)rk[1][1]); 363 *((word32*)temp[2]) = *((word32*)(b+ 8)) ^ *((word32*)rk[1][2]); 364 *((word32*)temp[3]) = *((word32*)(b+12)) ^ *((word32*)rk[1][3]); 365 b[ 0] = S5[temp[0][0]]; 366 b[ 1] = S5[temp[3][1]]; 367 b[ 2] = S5[temp[2][2]]; 368 b[ 3] = S5[temp[1][3]]; 369 b[ 4] = S5[temp[1][0]]; 370 b[ 5] = S5[temp[0][1]]; 371 b[ 6] = S5[temp[3][2]]; 372 b[ 7] = S5[temp[2][3]]; 373 b[ 8] = S5[temp[2][0]]; 374 b[ 9] = S5[temp[1][1]]; 375 b[10] = S5[temp[0][2]]; 376 b[11] = S5[temp[3][3]]; 377 b[12] = S5[temp[3][0]]; 378 b[13] = S5[temp[2][1]]; 379 b[14] = S5[temp[1][2]]; 380 b[15] = S5[temp[0][3]]; 381 *((word32*)(b )) ^= *((word32*)rk[0][0]); 382 *((word32*)(b+ 4)) ^= *((word32*)rk[0][1]); 383 *((word32*)(b+ 8)) ^= *((word32*)rk[0][2]); 384 *((word32*)(b+12)) ^= *((word32*)rk[0][3]); 385 386 memcpy(out, b, sizeof b /* XXX out */); 387 388 return 0; 389 #undef a 390 #undef b 391 #undef temp 392 } 393 394 395 #ifdef INTERMEDIATE_VALUE_KAT 396 /** 397 * Decrypt only a certain number of rounds. 398 * Only used in the Intermediate Value Known Answer Test. 399 * Operations rearranged such that the intermediate values 400 * of decryption correspond with the intermediate values 401 * of encryption. 402 */ 403 int rijndaelDecryptRound(word8 a[4][4], word8 rk[MAXROUNDS+1][4][4], int ROUNDS, int rounds) { 404 int r, i; 405 word8 temp[4], shift; 406 407 /* make number of rounds sane */ 408 if (rounds > ROUNDS) { 409 rounds = ROUNDS; 410 } 411 /* first round is special: */ 412 *(word32 *)a[0] ^= *(word32 *)rk[ROUNDS][0]; 413 *(word32 *)a[1] ^= *(word32 *)rk[ROUNDS][1]; 414 *(word32 *)a[2] ^= *(word32 *)rk[ROUNDS][2]; 415 *(word32 *)a[3] ^= *(word32 *)rk[ROUNDS][3]; 416 for (i = 0; i < 4; i++) { 417 a[i][0] = Si[a[i][0]]; 418 a[i][1] = Si[a[i][1]]; 419 a[i][2] = Si[a[i][2]]; 420 a[i][3] = Si[a[i][3]]; 421 } 422 for (i = 1; i < 4; i++) { 423 shift = (4 - i) & 3; 424 temp[0] = a[(0 + shift) & 3][i]; 425 temp[1] = a[(1 + shift) & 3][i]; 426 temp[2] = a[(2 + shift) & 3][i]; 427 temp[3] = a[(3 + shift) & 3][i]; 428 a[0][i] = temp[0]; 429 a[1][i] = temp[1]; 430 a[2][i] = temp[2]; 431 a[3][i] = temp[3]; 432 } 433 /* ROUNDS-1 ordinary rounds */ 434 for (r = ROUNDS-1; r > rounds; r--) { 435 *(word32 *)a[0] ^= *(word32 *)rk[r][0]; 436 *(word32 *)a[1] ^= *(word32 *)rk[r][1]; 437 *(word32 *)a[2] ^= *(word32 *)rk[r][2]; 438 *(word32 *)a[3] ^= *(word32 *)rk[r][3]; 439 440 *((word32*)a[0]) = 441 *((word32*)U1[a[0][0]]) 442 ^ *((word32*)U2[a[0][1]]) 443 ^ *((word32*)U3[a[0][2]]) 444 ^ *((word32*)U4[a[0][3]]); 445 446 *((word32*)a[1]) = 447 *((word32*)U1[a[1][0]]) 448 ^ *((word32*)U2[a[1][1]]) 449 ^ *((word32*)U3[a[1][2]]) 450 ^ *((word32*)U4[a[1][3]]); 451 452 *((word32*)a[2]) = 453 *((word32*)U1[a[2][0]]) 454 ^ *((word32*)U2[a[2][1]]) 455 ^ *((word32*)U3[a[2][2]]) 456 ^ *((word32*)U4[a[2][3]]); 457 458 *((word32*)a[3]) = 459 *((word32*)U1[a[3][0]]) 460 ^ *((word32*)U2[a[3][1]]) 461 ^ *((word32*)U3[a[3][2]]) 462 ^ *((word32*)U4[a[3][3]]); 463 for (i = 0; i < 4; i++) { 464 a[i][0] = Si[a[i][0]]; 465 a[i][1] = Si[a[i][1]]; 466 a[i][2] = Si[a[i][2]]; 467 a[i][3] = Si[a[i][3]]; 468 } 469 for (i = 1; i < 4; i++) { 470 shift = (4 - i) & 3; 471 temp[0] = a[(0 + shift) & 3][i]; 472 temp[1] = a[(1 + shift) & 3][i]; 473 temp[2] = a[(2 + shift) & 3][i]; 474 temp[3] = a[(3 + shift) & 3][i]; 475 a[0][i] = temp[0]; 476 a[1][i] = temp[1]; 477 a[2][i] = temp[2]; 478 a[3][i] = temp[3]; 479 } 480 } 481 if (rounds == 0) { 482 /* End with the extra key addition */ 483 *(word32 *)a[0] ^= *(word32 *)rk[0][0]; 484 *(word32 *)a[1] ^= *(word32 *)rk[0][1]; 485 *(word32 *)a[2] ^= *(word32 *)rk[0][2]; 486 *(word32 *)a[3] ^= *(word32 *)rk[0][3]; 487 } 488 return 0; 489 } 490 #endif /* INTERMEDIATE_VALUE_KAT */ 491