?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
added -y/--side-by-side option
[dfdiff.git] / sys / crypto / rijndael / rijndael-alg-fst.c
blob9426e4ab49c73230091d2fc8ac40a4fb798a03bd
1 /* $FreeBSD: src/sys/crypto/rijndael/rijndael-alg-fst.c,v 1.3.2.1 2001/07/03 11:01:35 ume Exp $ */
2 /* $DragonFly: src/sys/crypto/rijndael/rijndael-alg-fst.c,v 1.2 2003/06/17 04:28:20 dillon Exp $ */
3 /* $KAME: rijndael-alg-fst.c,v 1.7 2001/05/27 00:23:23 itojun Exp $ */
4
5 /*
6 * rijndael-alg-fst.c v2.3 April '2000
7 *
8 * Optimised ANSI C code
9 *
10 * authors: v1.0: Antoon Bosselaers
11 * v2.0: Vincent Rijmen
12 * v2.3: Paulo Barreto
13 *
14 * This code is placed in the public domain.
15 */
16
17 #include <sys/cdefs.h>
18 #include <sys/types.h>
19 #ifdef _KERNEL
20 #include <sys/systm.h>
21 #else
22 #include <string.h>
23 #endif
24 #include <crypto/rijndael/rijndael-alg-fst.h>
25 #include <crypto/rijndael/rijndael_local.h>
26
27 #include <crypto/rijndael/boxes-fst.dat>
28
29 int rijndaelKeySched(word8 k[MAXKC][4], word8 W[MAXROUNDS+1][4][4], int ROUNDS) {
30 /* Calculate the necessary round keys
31 * The number of calculations depends on keyBits and blockBits
32 */
33 int j, r, t, rconpointer = 0;
34 union {
35 word8 x8[MAXKC][4];
36 word32 x32[MAXKC];
37 } xtk;
38 #define tk xtk.x8
39 int KC = ROUNDS - 6;
40
41 for (j = KC-1; j >= 0; j--) {
42 *((word32*)tk[j]) = *((word32*)k[j]);
43 }
44 r = 0;
45 t = 0;
46 /* copy values into round key array */
47 for (j = 0; (j < KC) && (r < ROUNDS + 1); ) {
48 for (; (j < KC) && (t < 4); j++, t++) {
49 *((word32*)W[r][t]) = *((word32*)tk[j]);
50 }
51 if (t == 4) {
52 r++;
53 t = 0;
54 }
55 }
56
57 while (r < ROUNDS + 1) { /* while not enough round key material calculated */
58 /* calculate new values */
59 tk[0][0] ^= S[tk[KC-1][1]];
60 tk[0][1] ^= S[tk[KC-1][2]];
61 tk[0][2] ^= S[tk[KC-1][3]];
62 tk[0][3] ^= S[tk[KC-1][0]];
63 tk[0][0] ^= rcon[rconpointer++];
64
65 if (KC != 8) {
66 for (j = 1; j < KC; j++) {
67 *((word32*)tk[j]) ^= *((word32*)tk[j-1]);
68 }
69 } else {
70 for (j = 1; j < KC/2; j++) {
71 *((word32*)tk[j]) ^= *((word32*)tk[j-1]);
72 }
73 tk[KC/2][0] ^= S[tk[KC/2 - 1][0]];
74 tk[KC/2][1] ^= S[tk[KC/2 - 1][1]];
75 tk[KC/2][2] ^= S[tk[KC/2 - 1][2]];
76 tk[KC/2][3] ^= S[tk[KC/2 - 1][3]];
77 for (j = KC/2 + 1; j < KC; j++) {
78 *((word32*)tk[j]) ^= *((word32*)tk[j-1]);
79 }
80 }
81 /* copy values into round key array */
82 for (j = 0; (j < KC) && (r < ROUNDS + 1); ) {
83 for (; (j < KC) && (t < 4); j++, t++) {
84 *((word32*)W[r][t]) = *((word32*)tk[j]);
85 }
86 if (t == 4) {
87 r++;
88 t = 0;
89 }
90 }
91 }
92 return 0;
93 #undef tk
94 }
95
96 int rijndaelKeyEncToDec(word8 W[MAXROUNDS+1][4][4], int ROUNDS) {
97 int r;
98 word8 *w;
99
100 for (r = 1; r < ROUNDS; r++) {
101 w = W[r][0];
102 *((word32*)w) =
103 *((const word32*)U1[w[0]])
104 ^ *((const word32*)U2[w[1]])
105 ^ *((const word32*)U3[w[2]])
106 ^ *((const word32*)U4[w[3]]);
107
108 w = W[r][1];
109 *((word32*)w) =
110 *((const word32*)U1[w[0]])
111 ^ *((const word32*)U2[w[1]])
112 ^ *((const word32*)U3[w[2]])
113 ^ *((const word32*)U4[w[3]]);
114
115 w = W[r][2];
116 *((word32*)w) =
117 *((const word32*)U1[w[0]])
118 ^ *((const word32*)U2[w[1]])
119 ^ *((const word32*)U3[w[2]])
120 ^ *((const word32*)U4[w[3]]);
121
122 w = W[r][3];
123 *((word32*)w) =
124 *((const word32*)U1[w[0]])
125 ^ *((const word32*)U2[w[1]])
126 ^ *((const word32*)U3[w[2]])
127 ^ *((const word32*)U4[w[3]]);
128 }
129 return 0;
130 }
131
132 /**
133 * Encrypt a single block.
134 */
135 int rijndaelEncrypt(word8 in[16], word8 out[16], word8 rk[MAXROUNDS+1][4][4], int ROUNDS) {
136 int r;
137 union {
138 word8 x8[16];
139 word32 x32[4];
140 } xa, xb;
141 #define a xa.x8
142 #define b xb.x8
143 union {
144 word8 x8[4][4];
145 word32 x32[4];
146 } xtemp;
147 #define temp xtemp.x8
148
149 memcpy(a, in, sizeof a);
150
151 *((word32*)temp[0]) = *((word32*)(a )) ^ *((word32*)rk[0][0]);
152 *((word32*)temp[1]) = *((word32*)(a+ 4)) ^ *((word32*)rk[0][1]);
153 *((word32*)temp[2]) = *((word32*)(a+ 8)) ^ *((word32*)rk[0][2]);
154 *((word32*)temp[3]) = *((word32*)(a+12)) ^ *((word32*)rk[0][3]);
155 *((word32*)(b )) = *((const word32*)T1[temp[0][0]])
156 ^ *((const word32*)T2[temp[1][1]])
157 ^ *((const word32*)T3[temp[2][2]])
158 ^ *((const word32*)T4[temp[3][3]]);
159 *((word32*)(b + 4)) = *((const word32*)T1[temp[1][0]])
160 ^ *((const word32*)T2[temp[2][1]])
161 ^ *((const word32*)T3[temp[3][2]])
162 ^ *((const word32*)T4[temp[0][3]]);
163 *((word32*)(b + 8)) = *((const word32*)T1[temp[2][0]])
164 ^ *((const word32*)T2[temp[3][1]])
165 ^ *((const word32*)T3[temp[0][2]])
166 ^ *((const word32*)T4[temp[1][3]]);
167 *((word32*)(b +12)) = *((const word32*)T1[temp[3][0]])
168 ^ *((const word32*)T2[temp[0][1]])
169 ^ *((const word32*)T3[temp[1][2]])
170 ^ *((const word32*)T4[temp[2][3]]);
171 for (r = 1; r < ROUNDS-1; r++) {
172 *((word32*)temp[0]) = *((word32*)(b )) ^ *((word32*)rk[r][0]);
173 *((word32*)temp[1]) = *((word32*)(b+ 4)) ^ *((word32*)rk[r][1]);
174 *((word32*)temp[2]) = *((word32*)(b+ 8)) ^ *((word32*)rk[r][2]);
175 *((word32*)temp[3]) = *((word32*)(b+12)) ^ *((word32*)rk[r][3]);
176
177 *((word32*)(b )) = *((const word32*)T1[temp[0][0]])
178 ^ *((const word32*)T2[temp[1][1]])
179 ^ *((const word32*)T3[temp[2][2]])
180 ^ *((const word32*)T4[temp[3][3]]);
181 *((word32*)(b + 4)) = *((const word32*)T1[temp[1][0]])
182 ^ *((const word32*)T2[temp[2][1]])
183 ^ *((const word32*)T3[temp[3][2]])
184 ^ *((const word32*)T4[temp[0][3]]);
185 *((word32*)(b + 8)) = *((const word32*)T1[temp[2][0]])
186 ^ *((const word32*)T2[temp[3][1]])
187 ^ *((const word32*)T3[temp[0][2]])
188 ^ *((const word32*)T4[temp[1][3]]);
189 *((word32*)(b +12)) = *((const word32*)T1[temp[3][0]])
190 ^ *((const word32*)T2[temp[0][1]])
191 ^ *((const word32*)T3[temp[1][2]])
192 ^ *((const word32*)T4[temp[2][3]]);
193 }
194 /* last round is special */
195 *((word32*)temp[0]) = *((word32*)(b )) ^ *((word32*)rk[ROUNDS-1][0]);
196 *((word32*)temp[1]) = *((word32*)(b+ 4)) ^ *((word32*)rk[ROUNDS-1][1]);
197 *((word32*)temp[2]) = *((word32*)(b+ 8)) ^ *((word32*)rk[ROUNDS-1][2]);
198 *((word32*)temp[3]) = *((word32*)(b+12)) ^ *((word32*)rk[ROUNDS-1][3]);
199 b[ 0] = T1[temp[0][0]][1];
200 b[ 1] = T1[temp[1][1]][1];
201 b[ 2] = T1[temp[2][2]][1];
202 b[ 3] = T1[temp[3][3]][1];
203 b[ 4] = T1[temp[1][0]][1];
204 b[ 5] = T1[temp[2][1]][1];
205 b[ 6] = T1[temp[3][2]][1];
206 b[ 7] = T1[temp[0][3]][1];
207 b[ 8] = T1[temp[2][0]][1];
208 b[ 9] = T1[temp[3][1]][1];
209 b[10] = T1[temp[0][2]][1];
210 b[11] = T1[temp[1][3]][1];
211 b[12] = T1[temp[3][0]][1];
212 b[13] = T1[temp[0][1]][1];
213 b[14] = T1[temp[1][2]][1];
214 b[15] = T1[temp[2][3]][1];
215 *((word32*)(b )) ^= *((word32*)rk[ROUNDS][0]);
216 *((word32*)(b+ 4)) ^= *((word32*)rk[ROUNDS][1]);
217 *((word32*)(b+ 8)) ^= *((word32*)rk[ROUNDS][2]);
218 *((word32*)(b+12)) ^= *((word32*)rk[ROUNDS][3]);
219
220 memcpy(out, b, sizeof b /* XXX out */);
221
222 return 0;
223 #undef a
224 #undef b
225 #undef temp
226 }
227
228 #ifdef INTERMEDIATE_VALUE_KAT
229 /**
230 * Encrypt only a certain number of rounds.
231 * Only used in the Intermediate Value Known Answer Test.
232 */
233 int rijndaelEncryptRound(word8 a[4][4], word8 rk[MAXROUNDS+1][4][4], int ROUNDS, int rounds) {
234 int r;
235 word8 temp[4][4];
236
237 /* make number of rounds sane */
238 if (rounds > ROUNDS) {
239 rounds = ROUNDS;
240 }
241
242 *((word32*)a[0]) = *((word32*)a[0]) ^ *((word32*)rk[0][0]);
243 *((word32*)a[1]) = *((word32*)a[1]) ^ *((word32*)rk[0][1]);
244 *((word32*)a[2]) = *((word32*)a[2]) ^ *((word32*)rk[0][2]);
245 *((word32*)a[3]) = *((word32*)a[3]) ^ *((word32*)rk[0][3]);
246
247 for (r = 1; (r <= rounds) && (r < ROUNDS); r++) {
248 *((word32*)temp[0]) = *((word32*)T1[a[0][0]])
249 ^ *((word32*)T2[a[1][1]])
250 ^ *((word32*)T3[a[2][2]])
251 ^ *((word32*)T4[a[3][3]]);
252 *((word32*)temp[1]) = *((word32*)T1[a[1][0]])
253 ^ *((word32*)T2[a[2][1]])
254 ^ *((word32*)T3[a[3][2]])
255 ^ *((word32*)T4[a[0][3]]);
256 *((word32*)temp[2]) = *((word32*)T1[a[2][0]])
257 ^ *((word32*)T2[a[3][1]])
258 ^ *((word32*)T3[a[0][2]])
259 ^ *((word32*)T4[a[1][3]]);
260 *((word32*)temp[3]) = *((word32*)T1[a[3][0]])
261 ^ *((word32*)T2[a[0][1]])
262 ^ *((word32*)T3[a[1][2]])
263 ^ *((word32*)T4[a[2][3]]);
264 *((word32*)a[0]) = *((word32*)temp[0]) ^ *((word32*)rk[r][0]);
265 *((word32*)a[1]) = *((word32*)temp[1]) ^ *((word32*)rk[r][1]);
266 *((word32*)a[2]) = *((word32*)temp[2]) ^ *((word32*)rk[r][2]);
267 *((word32*)a[3]) = *((word32*)temp[3]) ^ *((word32*)rk[r][3]);
268 }
269 if (rounds == ROUNDS) {
270 /* last round is special */
271 temp[0][0] = T1[a[0][0]][1];
272 temp[0][1] = T1[a[1][1]][1];
273 temp[0][2] = T1[a[2][2]][1];
274 temp[0][3] = T1[a[3][3]][1];
275 temp[1][0] = T1[a[1][0]][1];
276 temp[1][1] = T1[a[2][1]][1];
277 temp[1][2] = T1[a[3][2]][1];
278 temp[1][3] = T1[a[0][3]][1];
279 temp[2][0] = T1[a[2][0]][1];
280 temp[2][1] = T1[a[3][1]][1];
281 temp[2][2] = T1[a[0][2]][1];
282 temp[2][3] = T1[a[1][3]][1];
283 temp[3][0] = T1[a[3][0]][1];
284 temp[3][1] = T1[a[0][1]][1];
285 temp[3][2] = T1[a[1][2]][1];
286 temp[3][3] = T1[a[2][3]][1];
287 *((word32*)a[0]) = *((word32*)temp[0]) ^ *((word32*)rk[ROUNDS][0]);
288 *((word32*)a[1]) = *((word32*)temp[1]) ^ *((word32*)rk[ROUNDS][1]);
289 *((word32*)a[2]) = *((word32*)temp[2]) ^ *((word32*)rk[ROUNDS][2]);
290 *((word32*)a[3]) = *((word32*)temp[3]) ^ *((word32*)rk[ROUNDS][3]);
291 }
292
293 return 0;
294 }
295 #endif /* INTERMEDIATE_VALUE_KAT */
296
297 /**
298 * Decrypt a single block.
299 */
300 int rijndaelDecrypt(word8 in[16], word8 out[16], word8 rk[MAXROUNDS+1][4][4], int ROUNDS) {
301 int r;
302 union {
303 word8 x8[16];
304 word32 x32[4];
305 } xa, xb;
306 #define a xa.x8
307 #define b xb.x8
308 union {
309 word8 x8[4][4];
310 word32 x32[4];
311 } xtemp;
312 #define temp xtemp.x8
313
314 memcpy(a, in, sizeof a);
315
316 *((word32*)temp[0]) = *((word32*)(a )) ^ *((word32*)rk[ROUNDS][0]);
317 *((word32*)temp[1]) = *((word32*)(a+ 4)) ^ *((word32*)rk[ROUNDS][1]);
318 *((word32*)temp[2]) = *((word32*)(a+ 8)) ^ *((word32*)rk[ROUNDS][2]);
319 *((word32*)temp[3]) = *((word32*)(a+12)) ^ *((word32*)rk[ROUNDS][3]);
320
321 *((word32*)(b )) = *((const word32*)T5[temp[0][0]])
322 ^ *((const word32*)T6[temp[3][1]])
323 ^ *((const word32*)T7[temp[2][2]])
324 ^ *((const word32*)T8[temp[1][3]]);
325 *((word32*)(b+ 4)) = *((const word32*)T5[temp[1][0]])
326 ^ *((const word32*)T6[temp[0][1]])
327 ^ *((const word32*)T7[temp[3][2]])
328 ^ *((const word32*)T8[temp[2][3]]);
329 *((word32*)(b+ 8)) = *((const word32*)T5[temp[2][0]])
330 ^ *((const word32*)T6[temp[1][1]])
331 ^ *((const word32*)T7[temp[0][2]])
332 ^ *((const word32*)T8[temp[3][3]]);
333 *((word32*)(b+12)) = *((const word32*)T5[temp[3][0]])
334 ^ *((const word32*)T6[temp[2][1]])
335 ^ *((const word32*)T7[temp[1][2]])
336 ^ *((const word32*)T8[temp[0][3]]);
337 for (r = ROUNDS-1; r > 1; r--) {
338 *((word32*)temp[0]) = *((word32*)(b )) ^ *((word32*)rk[r][0]);
339 *((word32*)temp[1]) = *((word32*)(b+ 4)) ^ *((word32*)rk[r][1]);
340 *((word32*)temp[2]) = *((word32*)(b+ 8)) ^ *((word32*)rk[r][2]);
341 *((word32*)temp[3]) = *((word32*)(b+12)) ^ *((word32*)rk[r][3]);
342 *((word32*)(b )) = *((const word32*)T5[temp[0][0]])
343 ^ *((const word32*)T6[temp[3][1]])
344 ^ *((const word32*)T7[temp[2][2]])
345 ^ *((const word32*)T8[temp[1][3]]);
346 *((word32*)(b+ 4)) = *((const word32*)T5[temp[1][0]])
347 ^ *((const word32*)T6[temp[0][1]])
348 ^ *((const word32*)T7[temp[3][2]])
349 ^ *((const word32*)T8[temp[2][3]]);
350 *((word32*)(b+ 8)) = *((const word32*)T5[temp[2][0]])
351 ^ *((const word32*)T6[temp[1][1]])
352 ^ *((const word32*)T7[temp[0][2]])
353 ^ *((const word32*)T8[temp[3][3]]);
354 *((word32*)(b+12)) = *((const word32*)T5[temp[3][0]])
355 ^ *((const word32*)T6[temp[2][1]])
356 ^ *((const word32*)T7[temp[1][2]])
357 ^ *((const word32*)T8[temp[0][3]]);
358 }
359 /* last round is special */
360 *((word32*)temp[0]) = *((word32*)(b )) ^ *((word32*)rk[1][0]);
361 *((word32*)temp[1]) = *((word32*)(b+ 4)) ^ *((word32*)rk[1][1]);
362 *((word32*)temp[2]) = *((word32*)(b+ 8)) ^ *((word32*)rk[1][2]);
363 *((word32*)temp[3]) = *((word32*)(b+12)) ^ *((word32*)rk[1][3]);
364 b[ 0] = S5[temp[0][0]];
365 b[ 1] = S5[temp[3][1]];
366 b[ 2] = S5[temp[2][2]];
367 b[ 3] = S5[temp[1][3]];
368 b[ 4] = S5[temp[1][0]];
369 b[ 5] = S5[temp[0][1]];
370 b[ 6] = S5[temp[3][2]];
371 b[ 7] = S5[temp[2][3]];
372 b[ 8] = S5[temp[2][0]];
373 b[ 9] = S5[temp[1][1]];
374 b[10] = S5[temp[0][2]];
375 b[11] = S5[temp[3][3]];
376 b[12] = S5[temp[3][0]];
377 b[13] = S5[temp[2][1]];
378 b[14] = S5[temp[1][2]];
379 b[15] = S5[temp[0][3]];
380 *((word32*)(b )) ^= *((word32*)rk[0][0]);
381 *((word32*)(b+ 4)) ^= *((word32*)rk[0][1]);
382 *((word32*)(b+ 8)) ^= *((word32*)rk[0][2]);
383 *((word32*)(b+12)) ^= *((word32*)rk[0][3]);
384
385 memcpy(out, b, sizeof b /* XXX out */);
386
387 return 0;
388 #undef a
389 #undef b
390 #undef temp
391 }
392
393
394 #ifdef INTERMEDIATE_VALUE_KAT
395 /**
396 * Decrypt only a certain number of rounds.
397 * Only used in the Intermediate Value Known Answer Test.
398 * Operations rearranged such that the intermediate values
399 * of decryption correspond with the intermediate values
400 * of encryption.
401 */
402 int rijndaelDecryptRound(word8 a[4][4], word8 rk[MAXROUNDS+1][4][4], int ROUNDS, int rounds) {
403 int r, i;
404 word8 temp[4], shift;
405
406 /* make number of rounds sane */
407 if (rounds > ROUNDS) {
408 rounds = ROUNDS;
409 }
410 /* first round is special: */
411 *(word32 *)a[0] ^= *(word32 *)rk[ROUNDS][0];
412 *(word32 *)a[1] ^= *(word32 *)rk[ROUNDS][1];
413 *(word32 *)a[2] ^= *(word32 *)rk[ROUNDS][2];
414 *(word32 *)a[3] ^= *(word32 *)rk[ROUNDS][3];
415 for (i = 0; i < 4; i++) {
416 a[i][0] = Si[a[i][0]];
417 a[i][1] = Si[a[i][1]];
418 a[i][2] = Si[a[i][2]];
419 a[i][3] = Si[a[i][3]];
420 }
421 for (i = 1; i < 4; i++) {
422 shift = (4 - i) & 3;
423 temp[0] = a[(0 + shift) & 3][i];
424 temp[1] = a[(1 + shift) & 3][i];
425 temp[2] = a[(2 + shift) & 3][i];
426 temp[3] = a[(3 + shift) & 3][i];
427 a[0][i] = temp[0];
428 a[1][i] = temp[1];
429 a[2][i] = temp[2];
430 a[3][i] = temp[3];
431 }
432 /* ROUNDS-1 ordinary rounds */
433 for (r = ROUNDS-1; r > rounds; r--) {
434 *(word32 *)a[0] ^= *(word32 *)rk[r][0];
435 *(word32 *)a[1] ^= *(word32 *)rk[r][1];
436 *(word32 *)a[2] ^= *(word32 *)rk[r][2];
437 *(word32 *)a[3] ^= *(word32 *)rk[r][3];
438
439 *((word32*)a[0]) =
440 *((word32*)U1[a[0][0]])
441 ^ *((word32*)U2[a[0][1]])
442 ^ *((word32*)U3[a[0][2]])
443 ^ *((word32*)U4[a[0][3]]);
444
445 *((word32*)a[1]) =
446 *((word32*)U1[a[1][0]])
447 ^ *((word32*)U2[a[1][1]])
448 ^ *((word32*)U3[a[1][2]])
449 ^ *((word32*)U4[a[1][3]]);
450
451 *((word32*)a[2]) =
452 *((word32*)U1[a[2][0]])
453 ^ *((word32*)U2[a[2][1]])
454 ^ *((word32*)U3[a[2][2]])
455 ^ *((word32*)U4[a[2][3]]);
456
457 *((word32*)a[3]) =
458 *((word32*)U1[a[3][0]])
459 ^ *((word32*)U2[a[3][1]])
460 ^ *((word32*)U3[a[3][2]])
461 ^ *((word32*)U4[a[3][3]]);
462 for (i = 0; i < 4; i++) {
463 a[i][0] = Si[a[i][0]];
464 a[i][1] = Si[a[i][1]];
465 a[i][2] = Si[a[i][2]];
466 a[i][3] = Si[a[i][3]];
467 }
468 for (i = 1; i < 4; i++) {
469 shift = (4 - i) & 3;
470 temp[0] = a[(0 + shift) & 3][i];
471 temp[1] = a[(1 + shift) & 3][i];
472 temp[2] = a[(2 + shift) & 3][i];
473 temp[3] = a[(3 + shift) & 3][i];
474 a[0][i] = temp[0];
475 a[1][i] = temp[1];
476 a[2][i] = temp[2];
477 a[3][i] = temp[3];
478 }
479 }
480 if (rounds == 0) {
481 /* End with the extra key addition */
482 *(word32 *)a[0] ^= *(word32 *)rk[0][0];
483 *(word32 *)a[1] ^= *(word32 *)rk[0][1];
484 *(word32 *)a[2] ^= *(word32 *)rk[0][2];
485 *(word32 *)a[3] ^= *(word32 *)rk[0][3];
486 }
487 return 0;
488 }
489 #endif /* INTERMEDIATE_VALUE_KAT */
Port diff from OpenBSD to DragonFly