PolarSSL v1.3.9
aes.c
Go to the documentation of this file.
1 /*
2  * FIPS-197 compliant AES implementation
3  *
4  * Copyright (C) 2006-2014, Brainspark B.V.
5  *
6  * This file is part of PolarSSL (http://www.polarssl.org)
7  * Lead Maintainer: Paul Bakker <polarssl_maintainer at polarssl.org>
8  *
9  * All rights reserved.
10  *
11  * This program is free software; you can redistribute it and/or modify
12  * it under the terms of the GNU General Public License as published by
13  * the Free Software Foundation; either version 2 of the License, or
14  * (at your option) any later version.
15  *
16  * This program is distributed in the hope that it will be useful,
17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19  * GNU General Public License for more details.
20  *
21  * You should have received a copy of the GNU General Public License along
22  * with this program; if not, write to the Free Software Foundation, Inc.,
23  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
24  */
25 /*
26  * The AES block cipher was designed by Vincent Rijmen and Joan Daemen.
27  *
28  * http://csrc.nist.gov/encryption/aes/rijndael/Rijndael.pdf
29  * http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf
30  */
31 
32 #if !defined(POLARSSL_CONFIG_FILE)
33 #include "polarssl/config.h"
34 #else
35 #include POLARSSL_CONFIG_FILE
36 #endif
37 
38 #if defined(POLARSSL_AES_C)
39 
40 #include "polarssl/aes.h"
41 #if defined(POLARSSL_PADLOCK_C)
42 #include "polarssl/padlock.h"
43 #endif
44 #if defined(POLARSSL_AESNI_C)
45 #include "polarssl/aesni.h"
46 #endif
47 
48 #if defined(POLARSSL_PLATFORM_C)
49 #include "polarssl/platform.h"
50 #else
51 #define polarssl_printf printf
52 #endif
53 
54 #if !defined(POLARSSL_AES_ALT)
55 
56 /* Implementation that should never be optimized out by the compiler */
57 static void polarssl_zeroize( void *v, size_t n ) {
58  volatile unsigned char *p = v; while( n-- ) *p++ = 0;
59 }
60 
61 /*
62  * 32-bit integer manipulation macros (little endian)
63  */
64 #ifndef GET_UINT32_LE
65 #define GET_UINT32_LE(n,b,i) \
66 { \
67  (n) = ( (uint32_t) (b)[(i) ] ) \
68  | ( (uint32_t) (b)[(i) + 1] << 8 ) \
69  | ( (uint32_t) (b)[(i) + 2] << 16 ) \
70  | ( (uint32_t) (b)[(i) + 3] << 24 ); \
71 }
72 #endif
73 
74 #ifndef PUT_UINT32_LE
75 #define PUT_UINT32_LE(n,b,i) \
76 { \
77  (b)[(i) ] = (unsigned char) ( (n) ); \
78  (b)[(i) + 1] = (unsigned char) ( (n) >> 8 ); \
79  (b)[(i) + 2] = (unsigned char) ( (n) >> 16 ); \
80  (b)[(i) + 3] = (unsigned char) ( (n) >> 24 ); \
81 }
82 #endif
83 
84 #if defined(POLARSSL_PADLOCK_C) && \
85  ( defined(POLARSSL_HAVE_X86) || defined(PADLOCK_ALIGN16) )
86 static int aes_padlock_ace = -1;
87 #endif
88 
89 #if defined(POLARSSL_AES_ROM_TABLES)
90 /*
91  * Forward S-box
92  */
93 static const unsigned char FSb[256] =
94 {
95  0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5,
96  0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76,
97  0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0,
98  0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0,
99  0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC,
100  0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,
101  0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A,
102  0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75,
103  0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0,
104  0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84,
105  0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B,
106  0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,
107  0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85,
108  0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8,
109  0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5,
110  0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2,
111  0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17,
112  0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73,
113  0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88,
114  0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB,
115  0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C,
116  0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79,
117  0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9,
118  0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08,
119  0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6,
120  0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A,
121  0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E,
122  0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E,
123  0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94,
124  0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,
125  0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68,
126  0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16
127 };
128 
129 /*
130  * Forward tables
131  */
132 #define FT \
133 \
134  V(A5,63,63,C6), V(84,7C,7C,F8), V(99,77,77,EE), V(8D,7B,7B,F6), \
135  V(0D,F2,F2,FF), V(BD,6B,6B,D6), V(B1,6F,6F,DE), V(54,C5,C5,91), \
136  V(50,30,30,60), V(03,01,01,02), V(A9,67,67,CE), V(7D,2B,2B,56), \
137  V(19,FE,FE,E7), V(62,D7,D7,B5), V(E6,AB,AB,4D), V(9A,76,76,EC), \
138  V(45,CA,CA,8F), V(9D,82,82,1F), V(40,C9,C9,89), V(87,7D,7D,FA), \
139  V(15,FA,FA,EF), V(EB,59,59,B2), V(C9,47,47,8E), V(0B,F0,F0,FB), \
140  V(EC,AD,AD,41), V(67,D4,D4,B3), V(FD,A2,A2,5F), V(EA,AF,AF,45), \
141  V(BF,9C,9C,23), V(F7,A4,A4,53), V(96,72,72,E4), V(5B,C0,C0,9B), \
142  V(C2,B7,B7,75), V(1C,FD,FD,E1), V(AE,93,93,3D), V(6A,26,26,4C), \
143  V(5A,36,36,6C), V(41,3F,3F,7E), V(02,F7,F7,F5), V(4F,CC,CC,83), \
144  V(5C,34,34,68), V(F4,A5,A5,51), V(34,E5,E5,D1), V(08,F1,F1,F9), \
145  V(93,71,71,E2), V(73,D8,D8,AB), V(53,31,31,62), V(3F,15,15,2A), \
146  V(0C,04,04,08), V(52,C7,C7,95), V(65,23,23,46), V(5E,C3,C3,9D), \
147  V(28,18,18,30), V(A1,96,96,37), V(0F,05,05,0A), V(B5,9A,9A,2F), \
148  V(09,07,07,0E), V(36,12,12,24), V(9B,80,80,1B), V(3D,E2,E2,DF), \
149  V(26,EB,EB,CD), V(69,27,27,4E), V(CD,B2,B2,7F), V(9F,75,75,EA), \
150  V(1B,09,09,12), V(9E,83,83,1D), V(74,2C,2C,58), V(2E,1A,1A,34), \
151  V(2D,1B,1B,36), V(B2,6E,6E,DC), V(EE,5A,5A,B4), V(FB,A0,A0,5B), \
152  V(F6,52,52,A4), V(4D,3B,3B,76), V(61,D6,D6,B7), V(CE,B3,B3,7D), \
153  V(7B,29,29,52), V(3E,E3,E3,DD), V(71,2F,2F,5E), V(97,84,84,13), \
154  V(F5,53,53,A6), V(68,D1,D1,B9), V(00,00,00,00), V(2C,ED,ED,C1), \
155  V(60,20,20,40), V(1F,FC,FC,E3), V(C8,B1,B1,79), V(ED,5B,5B,B6), \
156  V(BE,6A,6A,D4), V(46,CB,CB,8D), V(D9,BE,BE,67), V(4B,39,39,72), \
157  V(DE,4A,4A,94), V(D4,4C,4C,98), V(E8,58,58,B0), V(4A,CF,CF,85), \
158  V(6B,D0,D0,BB), V(2A,EF,EF,C5), V(E5,AA,AA,4F), V(16,FB,FB,ED), \
159  V(C5,43,43,86), V(D7,4D,4D,9A), V(55,33,33,66), V(94,85,85,11), \
160  V(CF,45,45,8A), V(10,F9,F9,E9), V(06,02,02,04), V(81,7F,7F,FE), \
161  V(F0,50,50,A0), V(44,3C,3C,78), V(BA,9F,9F,25), V(E3,A8,A8,4B), \
162  V(F3,51,51,A2), V(FE,A3,A3,5D), V(C0,40,40,80), V(8A,8F,8F,05), \
163  V(AD,92,92,3F), V(BC,9D,9D,21), V(48,38,38,70), V(04,F5,F5,F1), \
164  V(DF,BC,BC,63), V(C1,B6,B6,77), V(75,DA,DA,AF), V(63,21,21,42), \
165  V(30,10,10,20), V(1A,FF,FF,E5), V(0E,F3,F3,FD), V(6D,D2,D2,BF), \
166  V(4C,CD,CD,81), V(14,0C,0C,18), V(35,13,13,26), V(2F,EC,EC,C3), \
167  V(E1,5F,5F,BE), V(A2,97,97,35), V(CC,44,44,88), V(39,17,17,2E), \
168  V(57,C4,C4,93), V(F2,A7,A7,55), V(82,7E,7E,FC), V(47,3D,3D,7A), \
169  V(AC,64,64,C8), V(E7,5D,5D,BA), V(2B,19,19,32), V(95,73,73,E6), \
170  V(A0,60,60,C0), V(98,81,81,19), V(D1,4F,4F,9E), V(7F,DC,DC,A3), \
171  V(66,22,22,44), V(7E,2A,2A,54), V(AB,90,90,3B), V(83,88,88,0B), \
172  V(CA,46,46,8C), V(29,EE,EE,C7), V(D3,B8,B8,6B), V(3C,14,14,28), \
173  V(79,DE,DE,A7), V(E2,5E,5E,BC), V(1D,0B,0B,16), V(76,DB,DB,AD), \
174  V(3B,E0,E0,DB), V(56,32,32,64), V(4E,3A,3A,74), V(1E,0A,0A,14), \
175  V(DB,49,49,92), V(0A,06,06,0C), V(6C,24,24,48), V(E4,5C,5C,B8), \
176  V(5D,C2,C2,9F), V(6E,D3,D3,BD), V(EF,AC,AC,43), V(A6,62,62,C4), \
177  V(A8,91,91,39), V(A4,95,95,31), V(37,E4,E4,D3), V(8B,79,79,F2), \
178  V(32,E7,E7,D5), V(43,C8,C8,8B), V(59,37,37,6E), V(B7,6D,6D,DA), \
179  V(8C,8D,8D,01), V(64,D5,D5,B1), V(D2,4E,4E,9C), V(E0,A9,A9,49), \
180  V(B4,6C,6C,D8), V(FA,56,56,AC), V(07,F4,F4,F3), V(25,EA,EA,CF), \
181  V(AF,65,65,CA), V(8E,7A,7A,F4), V(E9,AE,AE,47), V(18,08,08,10), \
182  V(D5,BA,BA,6F), V(88,78,78,F0), V(6F,25,25,4A), V(72,2E,2E,5C), \
183  V(24,1C,1C,38), V(F1,A6,A6,57), V(C7,B4,B4,73), V(51,C6,C6,97), \
184  V(23,E8,E8,CB), V(7C,DD,DD,A1), V(9C,74,74,E8), V(21,1F,1F,3E), \
185  V(DD,4B,4B,96), V(DC,BD,BD,61), V(86,8B,8B,0D), V(85,8A,8A,0F), \
186  V(90,70,70,E0), V(42,3E,3E,7C), V(C4,B5,B5,71), V(AA,66,66,CC), \
187  V(D8,48,48,90), V(05,03,03,06), V(01,F6,F6,F7), V(12,0E,0E,1C), \
188  V(A3,61,61,C2), V(5F,35,35,6A), V(F9,57,57,AE), V(D0,B9,B9,69), \
189  V(91,86,86,17), V(58,C1,C1,99), V(27,1D,1D,3A), V(B9,9E,9E,27), \
190  V(38,E1,E1,D9), V(13,F8,F8,EB), V(B3,98,98,2B), V(33,11,11,22), \
191  V(BB,69,69,D2), V(70,D9,D9,A9), V(89,8E,8E,07), V(A7,94,94,33), \
192  V(B6,9B,9B,2D), V(22,1E,1E,3C), V(92,87,87,15), V(20,E9,E9,C9), \
193  V(49,CE,CE,87), V(FF,55,55,AA), V(78,28,28,50), V(7A,DF,DF,A5), \
194  V(8F,8C,8C,03), V(F8,A1,A1,59), V(80,89,89,09), V(17,0D,0D,1A), \
195  V(DA,BF,BF,65), V(31,E6,E6,D7), V(C6,42,42,84), V(B8,68,68,D0), \
196  V(C3,41,41,82), V(B0,99,99,29), V(77,2D,2D,5A), V(11,0F,0F,1E), \
197  V(CB,B0,B0,7B), V(FC,54,54,A8), V(D6,BB,BB,6D), V(3A,16,16,2C)
198 
199 #define V(a,b,c,d) 0x##a##b##c##d
200 static const uint32_t FT0[256] = { FT };
201 #undef V
202 
203 #define V(a,b,c,d) 0x##b##c##d##a
204 static const uint32_t FT1[256] = { FT };
205 #undef V
206 
207 #define V(a,b,c,d) 0x##c##d##a##b
208 static const uint32_t FT2[256] = { FT };
209 #undef V
210 
211 #define V(a,b,c,d) 0x##d##a##b##c
212 static const uint32_t FT3[256] = { FT };
213 #undef V
214 
215 #undef FT
216 
217 /*
218  * Reverse S-box
219  */
220 static const unsigned char RSb[256] =
221 {
222  0x52, 0x09, 0x6A, 0xD5, 0x30, 0x36, 0xA5, 0x38,
223  0xBF, 0x40, 0xA3, 0x9E, 0x81, 0xF3, 0xD7, 0xFB,
224  0x7C, 0xE3, 0x39, 0x82, 0x9B, 0x2F, 0xFF, 0x87,
225  0x34, 0x8E, 0x43, 0x44, 0xC4, 0xDE, 0xE9, 0xCB,
226  0x54, 0x7B, 0x94, 0x32, 0xA6, 0xC2, 0x23, 0x3D,
227  0xEE, 0x4C, 0x95, 0x0B, 0x42, 0xFA, 0xC3, 0x4E,
228  0x08, 0x2E, 0xA1, 0x66, 0x28, 0xD9, 0x24, 0xB2,
229  0x76, 0x5B, 0xA2, 0x49, 0x6D, 0x8B, 0xD1, 0x25,
230  0x72, 0xF8, 0xF6, 0x64, 0x86, 0x68, 0x98, 0x16,
231  0xD4, 0xA4, 0x5C, 0xCC, 0x5D, 0x65, 0xB6, 0x92,
232  0x6C, 0x70, 0x48, 0x50, 0xFD, 0xED, 0xB9, 0xDA,
233  0x5E, 0x15, 0x46, 0x57, 0xA7, 0x8D, 0x9D, 0x84,
234  0x90, 0xD8, 0xAB, 0x00, 0x8C, 0xBC, 0xD3, 0x0A,
235  0xF7, 0xE4, 0x58, 0x05, 0xB8, 0xB3, 0x45, 0x06,
236  0xD0, 0x2C, 0x1E, 0x8F, 0xCA, 0x3F, 0x0F, 0x02,
237  0xC1, 0xAF, 0xBD, 0x03, 0x01, 0x13, 0x8A, 0x6B,
238  0x3A, 0x91, 0x11, 0x41, 0x4F, 0x67, 0xDC, 0xEA,
239  0x97, 0xF2, 0xCF, 0xCE, 0xF0, 0xB4, 0xE6, 0x73,
240  0x96, 0xAC, 0x74, 0x22, 0xE7, 0xAD, 0x35, 0x85,
241  0xE2, 0xF9, 0x37, 0xE8, 0x1C, 0x75, 0xDF, 0x6E,
242  0x47, 0xF1, 0x1A, 0x71, 0x1D, 0x29, 0xC5, 0x89,
243  0x6F, 0xB7, 0x62, 0x0E, 0xAA, 0x18, 0xBE, 0x1B,
244  0xFC, 0x56, 0x3E, 0x4B, 0xC6, 0xD2, 0x79, 0x20,
245  0x9A, 0xDB, 0xC0, 0xFE, 0x78, 0xCD, 0x5A, 0xF4,
246  0x1F, 0xDD, 0xA8, 0x33, 0x88, 0x07, 0xC7, 0x31,
247  0xB1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xEC, 0x5F,
248  0x60, 0x51, 0x7F, 0xA9, 0x19, 0xB5, 0x4A, 0x0D,
249  0x2D, 0xE5, 0x7A, 0x9F, 0x93, 0xC9, 0x9C, 0xEF,
250  0xA0, 0xE0, 0x3B, 0x4D, 0xAE, 0x2A, 0xF5, 0xB0,
251  0xC8, 0xEB, 0xBB, 0x3C, 0x83, 0x53, 0x99, 0x61,
252  0x17, 0x2B, 0x04, 0x7E, 0xBA, 0x77, 0xD6, 0x26,
253  0xE1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0C, 0x7D
254 };
255 
256 /*
257  * Reverse tables
258  */
259 #define RT \
260 \
261  V(50,A7,F4,51), V(53,65,41,7E), V(C3,A4,17,1A), V(96,5E,27,3A), \
262  V(CB,6B,AB,3B), V(F1,45,9D,1F), V(AB,58,FA,AC), V(93,03,E3,4B), \
263  V(55,FA,30,20), V(F6,6D,76,AD), V(91,76,CC,88), V(25,4C,02,F5), \
264  V(FC,D7,E5,4F), V(D7,CB,2A,C5), V(80,44,35,26), V(8F,A3,62,B5), \
265  V(49,5A,B1,DE), V(67,1B,BA,25), V(98,0E,EA,45), V(E1,C0,FE,5D), \
266  V(02,75,2F,C3), V(12,F0,4C,81), V(A3,97,46,8D), V(C6,F9,D3,6B), \
267  V(E7,5F,8F,03), V(95,9C,92,15), V(EB,7A,6D,BF), V(DA,59,52,95), \
268  V(2D,83,BE,D4), V(D3,21,74,58), V(29,69,E0,49), V(44,C8,C9,8E), \
269  V(6A,89,C2,75), V(78,79,8E,F4), V(6B,3E,58,99), V(DD,71,B9,27), \
270  V(B6,4F,E1,BE), V(17,AD,88,F0), V(66,AC,20,C9), V(B4,3A,CE,7D), \
271  V(18,4A,DF,63), V(82,31,1A,E5), V(60,33,51,97), V(45,7F,53,62), \
272  V(E0,77,64,B1), V(84,AE,6B,BB), V(1C,A0,81,FE), V(94,2B,08,F9), \
273  V(58,68,48,70), V(19,FD,45,8F), V(87,6C,DE,94), V(B7,F8,7B,52), \
274  V(23,D3,73,AB), V(E2,02,4B,72), V(57,8F,1F,E3), V(2A,AB,55,66), \
275  V(07,28,EB,B2), V(03,C2,B5,2F), V(9A,7B,C5,86), V(A5,08,37,D3), \
276  V(F2,87,28,30), V(B2,A5,BF,23), V(BA,6A,03,02), V(5C,82,16,ED), \
277  V(2B,1C,CF,8A), V(92,B4,79,A7), V(F0,F2,07,F3), V(A1,E2,69,4E), \
278  V(CD,F4,DA,65), V(D5,BE,05,06), V(1F,62,34,D1), V(8A,FE,A6,C4), \
279  V(9D,53,2E,34), V(A0,55,F3,A2), V(32,E1,8A,05), V(75,EB,F6,A4), \
280  V(39,EC,83,0B), V(AA,EF,60,40), V(06,9F,71,5E), V(51,10,6E,BD), \
281  V(F9,8A,21,3E), V(3D,06,DD,96), V(AE,05,3E,DD), V(46,BD,E6,4D), \
282  V(B5,8D,54,91), V(05,5D,C4,71), V(6F,D4,06,04), V(FF,15,50,60), \
283  V(24,FB,98,19), V(97,E9,BD,D6), V(CC,43,40,89), V(77,9E,D9,67), \
284  V(BD,42,E8,B0), V(88,8B,89,07), V(38,5B,19,E7), V(DB,EE,C8,79), \
285  V(47,0A,7C,A1), V(E9,0F,42,7C), V(C9,1E,84,F8), V(00,00,00,00), \
286  V(83,86,80,09), V(48,ED,2B,32), V(AC,70,11,1E), V(4E,72,5A,6C), \
287  V(FB,FF,0E,FD), V(56,38,85,0F), V(1E,D5,AE,3D), V(27,39,2D,36), \
288  V(64,D9,0F,0A), V(21,A6,5C,68), V(D1,54,5B,9B), V(3A,2E,36,24), \
289  V(B1,67,0A,0C), V(0F,E7,57,93), V(D2,96,EE,B4), V(9E,91,9B,1B), \
290  V(4F,C5,C0,80), V(A2,20,DC,61), V(69,4B,77,5A), V(16,1A,12,1C), \
291  V(0A,BA,93,E2), V(E5,2A,A0,C0), V(43,E0,22,3C), V(1D,17,1B,12), \
292  V(0B,0D,09,0E), V(AD,C7,8B,F2), V(B9,A8,B6,2D), V(C8,A9,1E,14), \
293  V(85,19,F1,57), V(4C,07,75,AF), V(BB,DD,99,EE), V(FD,60,7F,A3), \
294  V(9F,26,01,F7), V(BC,F5,72,5C), V(C5,3B,66,44), V(34,7E,FB,5B), \
295  V(76,29,43,8B), V(DC,C6,23,CB), V(68,FC,ED,B6), V(63,F1,E4,B8), \
296  V(CA,DC,31,D7), V(10,85,63,42), V(40,22,97,13), V(20,11,C6,84), \
297  V(7D,24,4A,85), V(F8,3D,BB,D2), V(11,32,F9,AE), V(6D,A1,29,C7), \
298  V(4B,2F,9E,1D), V(F3,30,B2,DC), V(EC,52,86,0D), V(D0,E3,C1,77), \
299  V(6C,16,B3,2B), V(99,B9,70,A9), V(FA,48,94,11), V(22,64,E9,47), \
300  V(C4,8C,FC,A8), V(1A,3F,F0,A0), V(D8,2C,7D,56), V(EF,90,33,22), \
301  V(C7,4E,49,87), V(C1,D1,38,D9), V(FE,A2,CA,8C), V(36,0B,D4,98), \
302  V(CF,81,F5,A6), V(28,DE,7A,A5), V(26,8E,B7,DA), V(A4,BF,AD,3F), \
303  V(E4,9D,3A,2C), V(0D,92,78,50), V(9B,CC,5F,6A), V(62,46,7E,54), \
304  V(C2,13,8D,F6), V(E8,B8,D8,90), V(5E,F7,39,2E), V(F5,AF,C3,82), \
305  V(BE,80,5D,9F), V(7C,93,D0,69), V(A9,2D,D5,6F), V(B3,12,25,CF), \
306  V(3B,99,AC,C8), V(A7,7D,18,10), V(6E,63,9C,E8), V(7B,BB,3B,DB), \
307  V(09,78,26,CD), V(F4,18,59,6E), V(01,B7,9A,EC), V(A8,9A,4F,83), \
308  V(65,6E,95,E6), V(7E,E6,FF,AA), V(08,CF,BC,21), V(E6,E8,15,EF), \
309  V(D9,9B,E7,BA), V(CE,36,6F,4A), V(D4,09,9F,EA), V(D6,7C,B0,29), \
310  V(AF,B2,A4,31), V(31,23,3F,2A), V(30,94,A5,C6), V(C0,66,A2,35), \
311  V(37,BC,4E,74), V(A6,CA,82,FC), V(B0,D0,90,E0), V(15,D8,A7,33), \
312  V(4A,98,04,F1), V(F7,DA,EC,41), V(0E,50,CD,7F), V(2F,F6,91,17), \
313  V(8D,D6,4D,76), V(4D,B0,EF,43), V(54,4D,AA,CC), V(DF,04,96,E4), \
314  V(E3,B5,D1,9E), V(1B,88,6A,4C), V(B8,1F,2C,C1), V(7F,51,65,46), \
315  V(04,EA,5E,9D), V(5D,35,8C,01), V(73,74,87,FA), V(2E,41,0B,FB), \
316  V(5A,1D,67,B3), V(52,D2,DB,92), V(33,56,10,E9), V(13,47,D6,6D), \
317  V(8C,61,D7,9A), V(7A,0C,A1,37), V(8E,14,F8,59), V(89,3C,13,EB), \
318  V(EE,27,A9,CE), V(35,C9,61,B7), V(ED,E5,1C,E1), V(3C,B1,47,7A), \
319  V(59,DF,D2,9C), V(3F,73,F2,55), V(79,CE,14,18), V(BF,37,C7,73), \
320  V(EA,CD,F7,53), V(5B,AA,FD,5F), V(14,6F,3D,DF), V(86,DB,44,78), \
321  V(81,F3,AF,CA), V(3E,C4,68,B9), V(2C,34,24,38), V(5F,40,A3,C2), \
322  V(72,C3,1D,16), V(0C,25,E2,BC), V(8B,49,3C,28), V(41,95,0D,FF), \
323  V(71,01,A8,39), V(DE,B3,0C,08), V(9C,E4,B4,D8), V(90,C1,56,64), \
324  V(61,84,CB,7B), V(70,B6,32,D5), V(74,5C,6C,48), V(42,57,B8,D0)
325 
326 #define V(a,b,c,d) 0x##a##b##c##d
327 static const uint32_t RT0[256] = { RT };
328 #undef V
329 
330 #define V(a,b,c,d) 0x##b##c##d##a
331 static const uint32_t RT1[256] = { RT };
332 #undef V
333 
334 #define V(a,b,c,d) 0x##c##d##a##b
335 static const uint32_t RT2[256] = { RT };
336 #undef V
337 
338 #define V(a,b,c,d) 0x##d##a##b##c
339 static const uint32_t RT3[256] = { RT };
340 #undef V
341 
342 #undef RT
343 
344 /*
345  * Round constants
346  */
347 static const uint32_t RCON[10] =
348 {
349  0x00000001, 0x00000002, 0x00000004, 0x00000008,
350  0x00000010, 0x00000020, 0x00000040, 0x00000080,
351  0x0000001B, 0x00000036
352 };
353 
354 #else /* POLARSSL_AES_ROM_TABLES */
355 
356 /*
357  * Forward S-box & tables
358  */
359 static unsigned char FSb[256];
360 static uint32_t FT0[256];
361 static uint32_t FT1[256];
362 static uint32_t FT2[256];
363 static uint32_t FT3[256];
364 
365 /*
366  * Reverse S-box & tables
367  */
368 static unsigned char RSb[256];
369 static uint32_t RT0[256];
370 static uint32_t RT1[256];
371 static uint32_t RT2[256];
372 static uint32_t RT3[256];
373 
374 /*
375  * Round constants
376  */
377 static uint32_t RCON[10];
378 
379 /*
380  * Tables generation code
381  */
382 #define ROTL8(x) ( ( x << 8 ) & 0xFFFFFFFF ) | ( x >> 24 )
383 #define XTIME(x) ( ( x << 1 ) ^ ( ( x & 0x80 ) ? 0x1B : 0x00 ) )
384 #define MUL(x,y) ( ( x && y ) ? pow[(log[x]+log[y]) % 255] : 0 )
385 
386 static int aes_init_done = 0;
387 
388 static void aes_gen_tables( void )
389 {
390  int i, x, y, z;
391  int pow[256];
392  int log[256];
393 
394  /*
395  * compute pow and log tables over GF(2^8)
396  */
397  for( i = 0, x = 1; i < 256; i++ )
398  {
399  pow[i] = x;
400  log[x] = i;
401  x = ( x ^ XTIME( x ) ) & 0xFF;
402  }
403 
404  /*
405  * calculate the round constants
406  */
407  for( i = 0, x = 1; i < 10; i++ )
408  {
409  RCON[i] = (uint32_t) x;
410  x = XTIME( x ) & 0xFF;
411  }
412 
413  /*
414  * generate the forward and reverse S-boxes
415  */
416  FSb[0x00] = 0x63;
417  RSb[0x63] = 0x00;
418 
419  for( i = 1; i < 256; i++ )
420  {
421  x = pow[255 - log[i]];
422 
423  y = x; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF;
424  x ^= y; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF;
425  x ^= y; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF;
426  x ^= y; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF;
427  x ^= y ^ 0x63;
428 
429  FSb[i] = (unsigned char) x;
430  RSb[x] = (unsigned char) i;
431  }
432 
433  /*
434  * generate the forward and reverse tables
435  */
436  for( i = 0; i < 256; i++ )
437  {
438  x = FSb[i];
439  y = XTIME( x ) & 0xFF;
440  z = ( y ^ x ) & 0xFF;
441 
442  FT0[i] = ( (uint32_t) y ) ^
443  ( (uint32_t) x << 8 ) ^
444  ( (uint32_t) x << 16 ) ^
445  ( (uint32_t) z << 24 );
446 
447  FT1[i] = ROTL8( FT0[i] );
448  FT2[i] = ROTL8( FT1[i] );
449  FT3[i] = ROTL8( FT2[i] );
450 
451  x = RSb[i];
452 
453  RT0[i] = ( (uint32_t) MUL( 0x0E, x ) ) ^
454  ( (uint32_t) MUL( 0x09, x ) << 8 ) ^
455  ( (uint32_t) MUL( 0x0D, x ) << 16 ) ^
456  ( (uint32_t) MUL( 0x0B, x ) << 24 );
457 
458  RT1[i] = ROTL8( RT0[i] );
459  RT2[i] = ROTL8( RT1[i] );
460  RT3[i] = ROTL8( RT2[i] );
461  }
462 }
463 
464 #endif /* POLARSSL_AES_ROM_TABLES */
465 
466 void aes_init( aes_context *ctx )
467 {
468  memset( ctx, 0, sizeof( aes_context ) );
469 }
470 
471 void aes_free( aes_context *ctx )
472 {
473  if( ctx == NULL )
474  return;
475 
476  polarssl_zeroize( ctx, sizeof( aes_context ) );
477 }
478 
479 /*
480  * AES key schedule (encryption)
481  */
482 int aes_setkey_enc( aes_context *ctx, const unsigned char *key,
483  unsigned int keysize )
484 {
485  unsigned int i;
486  uint32_t *RK;
487 
488 #if !defined(POLARSSL_AES_ROM_TABLES)
489  if( aes_init_done == 0 )
490  {
491  aes_gen_tables();
492  aes_init_done = 1;
493 
494  }
495 #endif
496 
497  switch( keysize )
498  {
499  case 128: ctx->nr = 10; break;
500  case 192: ctx->nr = 12; break;
501  case 256: ctx->nr = 14; break;
502  default : return( POLARSSL_ERR_AES_INVALID_KEY_LENGTH );
503  }
504 
505 #if defined(POLARSSL_PADLOCK_C) && defined(PADLOCK_ALIGN16)
506  if( aes_padlock_ace == -1 )
507  aes_padlock_ace = padlock_supports( PADLOCK_ACE );
508 
509  if( aes_padlock_ace )
510  ctx->rk = RK = PADLOCK_ALIGN16( ctx->buf );
511  else
512 #endif
513  ctx->rk = RK = ctx->buf;
514 
515 #if defined(POLARSSL_AESNI_C) && defined(POLARSSL_HAVE_X86_64)
516  if( aesni_supports( POLARSSL_AESNI_AES ) )
517  return( aesni_setkey_enc( (unsigned char *) ctx->rk, key, keysize ) );
518 #endif
519 
520  for( i = 0; i < ( keysize >> 5 ); i++ )
521  {
522  GET_UINT32_LE( RK[i], key, i << 2 );
523  }
524 
525  switch( ctx->nr )
526  {
527  case 10:
528 
529  for( i = 0; i < 10; i++, RK += 4 )
530  {
531  RK[4] = RK[0] ^ RCON[i] ^
532  ( (uint32_t) FSb[ ( RK[3] >> 8 ) & 0xFF ] ) ^
533  ( (uint32_t) FSb[ ( RK[3] >> 16 ) & 0xFF ] << 8 ) ^
534  ( (uint32_t) FSb[ ( RK[3] >> 24 ) & 0xFF ] << 16 ) ^
535  ( (uint32_t) FSb[ ( RK[3] ) & 0xFF ] << 24 );
536 
537  RK[5] = RK[1] ^ RK[4];
538  RK[6] = RK[2] ^ RK[5];
539  RK[7] = RK[3] ^ RK[6];
540  }
541  break;
542 
543  case 12:
544 
545  for( i = 0; i < 8; i++, RK += 6 )
546  {
547  RK[6] = RK[0] ^ RCON[i] ^
548  ( (uint32_t) FSb[ ( RK[5] >> 8 ) & 0xFF ] ) ^
549  ( (uint32_t) FSb[ ( RK[5] >> 16 ) & 0xFF ] << 8 ) ^
550  ( (uint32_t) FSb[ ( RK[5] >> 24 ) & 0xFF ] << 16 ) ^
551  ( (uint32_t) FSb[ ( RK[5] ) & 0xFF ] << 24 );
552 
553  RK[7] = RK[1] ^ RK[6];
554  RK[8] = RK[2] ^ RK[7];
555  RK[9] = RK[3] ^ RK[8];
556  RK[10] = RK[4] ^ RK[9];
557  RK[11] = RK[5] ^ RK[10];
558  }
559  break;
560 
561  case 14:
562 
563  for( i = 0; i < 7; i++, RK += 8 )
564  {
565  RK[8] = RK[0] ^ RCON[i] ^
566  ( (uint32_t) FSb[ ( RK[7] >> 8 ) & 0xFF ] ) ^
567  ( (uint32_t) FSb[ ( RK[7] >> 16 ) & 0xFF ] << 8 ) ^
568  ( (uint32_t) FSb[ ( RK[7] >> 24 ) & 0xFF ] << 16 ) ^
569  ( (uint32_t) FSb[ ( RK[7] ) & 0xFF ] << 24 );
570 
571  RK[9] = RK[1] ^ RK[8];
572  RK[10] = RK[2] ^ RK[9];
573  RK[11] = RK[3] ^ RK[10];
574 
575  RK[12] = RK[4] ^
576  ( (uint32_t) FSb[ ( RK[11] ) & 0xFF ] ) ^
577  ( (uint32_t) FSb[ ( RK[11] >> 8 ) & 0xFF ] << 8 ) ^
578  ( (uint32_t) FSb[ ( RK[11] >> 16 ) & 0xFF ] << 16 ) ^
579  ( (uint32_t) FSb[ ( RK[11] >> 24 ) & 0xFF ] << 24 );
580 
581  RK[13] = RK[5] ^ RK[12];
582  RK[14] = RK[6] ^ RK[13];
583  RK[15] = RK[7] ^ RK[14];
584  }
585  break;
586  }
587 
588  return( 0 );
589 }
590 
591 /*
592  * AES key schedule (decryption)
593  */
594 int aes_setkey_dec( aes_context *ctx, const unsigned char *key,
595  unsigned int keysize )
596 {
597  int i, j, ret;
598  aes_context cty;
599  uint32_t *RK;
600  uint32_t *SK;
601 
602  aes_init( &cty );
603 
604 #if defined(POLARSSL_PADLOCK_C) && defined(PADLOCK_ALIGN16)
605  if( aes_padlock_ace == -1 )
606  aes_padlock_ace = padlock_supports( PADLOCK_ACE );
607 
608  if( aes_padlock_ace )
609  ctx->rk = RK = PADLOCK_ALIGN16( ctx->buf );
610  else
611 #endif
612  ctx->rk = RK = ctx->buf;
613 
614  /* Also checks keysize */
615  if( ( ret = aes_setkey_enc( &cty, key, keysize ) ) != 0 )
616  goto exit;
617 
618  ctx->nr = cty.nr;
619 
620 #if defined(POLARSSL_AESNI_C) && defined(POLARSSL_HAVE_X86_64)
621  if( aesni_supports( POLARSSL_AESNI_AES ) )
622  {
623  aesni_inverse_key( (unsigned char *) ctx->rk,
624  (const unsigned char *) cty.rk, ctx->nr );
625  goto exit;
626  }
627 #endif
628 
629  SK = cty.rk + cty.nr * 4;
630 
631  *RK++ = *SK++;
632  *RK++ = *SK++;
633  *RK++ = *SK++;
634  *RK++ = *SK++;
635 
636  for( i = ctx->nr - 1, SK -= 8; i > 0; i--, SK -= 8 )
637  {
638  for( j = 0; j < 4; j++, SK++ )
639  {
640  *RK++ = RT0[ FSb[ ( *SK ) & 0xFF ] ] ^
641  RT1[ FSb[ ( *SK >> 8 ) & 0xFF ] ] ^
642  RT2[ FSb[ ( *SK >> 16 ) & 0xFF ] ] ^
643  RT3[ FSb[ ( *SK >> 24 ) & 0xFF ] ];
644  }
645  }
646 
647  *RK++ = *SK++;
648  *RK++ = *SK++;
649  *RK++ = *SK++;
650  *RK++ = *SK++;
651 
652 exit:
653  aes_free( &cty );
654 
655  return( ret );
656 }
657 
658 #define AES_FROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3) \
659 { \
660  X0 = *RK++ ^ FT0[ ( Y0 ) & 0xFF ] ^ \
661  FT1[ ( Y1 >> 8 ) & 0xFF ] ^ \
662  FT2[ ( Y2 >> 16 ) & 0xFF ] ^ \
663  FT3[ ( Y3 >> 24 ) & 0xFF ]; \
664  \
665  X1 = *RK++ ^ FT0[ ( Y1 ) & 0xFF ] ^ \
666  FT1[ ( Y2 >> 8 ) & 0xFF ] ^ \
667  FT2[ ( Y3 >> 16 ) & 0xFF ] ^ \
668  FT3[ ( Y0 >> 24 ) & 0xFF ]; \
669  \
670  X2 = *RK++ ^ FT0[ ( Y2 ) & 0xFF ] ^ \
671  FT1[ ( Y3 >> 8 ) & 0xFF ] ^ \
672  FT2[ ( Y0 >> 16 ) & 0xFF ] ^ \
673  FT3[ ( Y1 >> 24 ) & 0xFF ]; \
674  \
675  X3 = *RK++ ^ FT0[ ( Y3 ) & 0xFF ] ^ \
676  FT1[ ( Y0 >> 8 ) & 0xFF ] ^ \
677  FT2[ ( Y1 >> 16 ) & 0xFF ] ^ \
678  FT3[ ( Y2 >> 24 ) & 0xFF ]; \
679 }
680 
681 #define AES_RROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3) \
682 { \
683  X0 = *RK++ ^ RT0[ ( Y0 ) & 0xFF ] ^ \
684  RT1[ ( Y3 >> 8 ) & 0xFF ] ^ \
685  RT2[ ( Y2 >> 16 ) & 0xFF ] ^ \
686  RT3[ ( Y1 >> 24 ) & 0xFF ]; \
687  \
688  X1 = *RK++ ^ RT0[ ( Y1 ) & 0xFF ] ^ \
689  RT1[ ( Y0 >> 8 ) & 0xFF ] ^ \
690  RT2[ ( Y3 >> 16 ) & 0xFF ] ^ \
691  RT3[ ( Y2 >> 24 ) & 0xFF ]; \
692  \
693  X2 = *RK++ ^ RT0[ ( Y2 ) & 0xFF ] ^ \
694  RT1[ ( Y1 >> 8 ) & 0xFF ] ^ \
695  RT2[ ( Y0 >> 16 ) & 0xFF ] ^ \
696  RT3[ ( Y3 >> 24 ) & 0xFF ]; \
697  \
698  X3 = *RK++ ^ RT0[ ( Y3 ) & 0xFF ] ^ \
699  RT1[ ( Y2 >> 8 ) & 0xFF ] ^ \
700  RT2[ ( Y1 >> 16 ) & 0xFF ] ^ \
701  RT3[ ( Y0 >> 24 ) & 0xFF ]; \
702 }
703 
704 /*
705  * AES-ECB block encryption/decryption
706  */
707 int aes_crypt_ecb( aes_context *ctx,
708  int mode,
709  const unsigned char input[16],
710  unsigned char output[16] )
711 {
712  int i;
713  uint32_t *RK, X0, X1, X2, X3, Y0, Y1, Y2, Y3;
714 
715 #if defined(POLARSSL_AESNI_C) && defined(POLARSSL_HAVE_X86_64)
716  if( aesni_supports( POLARSSL_AESNI_AES ) )
717  return( aesni_crypt_ecb( ctx, mode, input, output ) );
718 #endif
719 
720 #if defined(POLARSSL_PADLOCK_C) && defined(POLARSSL_HAVE_X86)
721  if( aes_padlock_ace )
722  {
723  if( padlock_xcryptecb( ctx, mode, input, output ) == 0 )
724  return( 0 );
725 
726  // If padlock data misaligned, we just fall back to
727  // unaccelerated mode
728  //
729  }
730 #endif
731 
732  RK = ctx->rk;
733 
734  GET_UINT32_LE( X0, input, 0 ); X0 ^= *RK++;
735  GET_UINT32_LE( X1, input, 4 ); X1 ^= *RK++;
736  GET_UINT32_LE( X2, input, 8 ); X2 ^= *RK++;
737  GET_UINT32_LE( X3, input, 12 ); X3 ^= *RK++;
738 
739  if( mode == AES_DECRYPT )
740  {
741  for( i = ( ctx->nr >> 1 ) - 1; i > 0; i-- )
742  {
743  AES_RROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 );
744  AES_RROUND( X0, X1, X2, X3, Y0, Y1, Y2, Y3 );
745  }
746 
747  AES_RROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 );
748 
749  X0 = *RK++ ^ \
750  ( (uint32_t) RSb[ ( Y0 ) & 0xFF ] ) ^
751  ( (uint32_t) RSb[ ( Y3 >> 8 ) & 0xFF ] << 8 ) ^
752  ( (uint32_t) RSb[ ( Y2 >> 16 ) & 0xFF ] << 16 ) ^
753  ( (uint32_t) RSb[ ( Y1 >> 24 ) & 0xFF ] << 24 );
754 
755  X1 = *RK++ ^ \
756  ( (uint32_t) RSb[ ( Y1 ) & 0xFF ] ) ^
757  ( (uint32_t) RSb[ ( Y0 >> 8 ) & 0xFF ] << 8 ) ^
758  ( (uint32_t) RSb[ ( Y3 >> 16 ) & 0xFF ] << 16 ) ^
759  ( (uint32_t) RSb[ ( Y2 >> 24 ) & 0xFF ] << 24 );
760 
761  X2 = *RK++ ^ \
762  ( (uint32_t) RSb[ ( Y2 ) & 0xFF ] ) ^
763  ( (uint32_t) RSb[ ( Y1 >> 8 ) & 0xFF ] << 8 ) ^
764  ( (uint32_t) RSb[ ( Y0 >> 16 ) & 0xFF ] << 16 ) ^
765  ( (uint32_t) RSb[ ( Y3 >> 24 ) & 0xFF ] << 24 );
766 
767  X3 = *RK++ ^ \
768  ( (uint32_t) RSb[ ( Y3 ) & 0xFF ] ) ^
769  ( (uint32_t) RSb[ ( Y2 >> 8 ) & 0xFF ] << 8 ) ^
770  ( (uint32_t) RSb[ ( Y1 >> 16 ) & 0xFF ] << 16 ) ^
771  ( (uint32_t) RSb[ ( Y0 >> 24 ) & 0xFF ] << 24 );
772  }
773  else /* AES_ENCRYPT */
774  {
775  for( i = ( ctx->nr >> 1 ) - 1; i > 0; i-- )
776  {
777  AES_FROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 );
778  AES_FROUND( X0, X1, X2, X3, Y0, Y1, Y2, Y3 );
779  }
780 
781  AES_FROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 );
782 
783  X0 = *RK++ ^ \
784  ( (uint32_t) FSb[ ( Y0 ) & 0xFF ] ) ^
785  ( (uint32_t) FSb[ ( Y1 >> 8 ) & 0xFF ] << 8 ) ^
786  ( (uint32_t) FSb[ ( Y2 >> 16 ) & 0xFF ] << 16 ) ^
787  ( (uint32_t) FSb[ ( Y3 >> 24 ) & 0xFF ] << 24 );
788 
789  X1 = *RK++ ^ \
790  ( (uint32_t) FSb[ ( Y1 ) & 0xFF ] ) ^
791  ( (uint32_t) FSb[ ( Y2 >> 8 ) & 0xFF ] << 8 ) ^
792  ( (uint32_t) FSb[ ( Y3 >> 16 ) & 0xFF ] << 16 ) ^
793  ( (uint32_t) FSb[ ( Y0 >> 24 ) & 0xFF ] << 24 );
794 
795  X2 = *RK++ ^ \
796  ( (uint32_t) FSb[ ( Y2 ) & 0xFF ] ) ^
797  ( (uint32_t) FSb[ ( Y3 >> 8 ) & 0xFF ] << 8 ) ^
798  ( (uint32_t) FSb[ ( Y0 >> 16 ) & 0xFF ] << 16 ) ^
799  ( (uint32_t) FSb[ ( Y1 >> 24 ) & 0xFF ] << 24 );
800 
801  X3 = *RK++ ^ \
802  ( (uint32_t) FSb[ ( Y3 ) & 0xFF ] ) ^
803  ( (uint32_t) FSb[ ( Y0 >> 8 ) & 0xFF ] << 8 ) ^
804  ( (uint32_t) FSb[ ( Y1 >> 16 ) & 0xFF ] << 16 ) ^
805  ( (uint32_t) FSb[ ( Y2 >> 24 ) & 0xFF ] << 24 );
806  }
807 
808  PUT_UINT32_LE( X0, output, 0 );
809  PUT_UINT32_LE( X1, output, 4 );
810  PUT_UINT32_LE( X2, output, 8 );
811  PUT_UINT32_LE( X3, output, 12 );
812 
813  return( 0 );
814 }
815 
816 #if defined(POLARSSL_CIPHER_MODE_CBC)
817 /*
818  * AES-CBC buffer encryption/decryption
819  */
820 int aes_crypt_cbc( aes_context *ctx,
821  int mode,
822  size_t length,
823  unsigned char iv[16],
824  const unsigned char *input,
825  unsigned char *output )
826 {
827  int i;
828  unsigned char temp[16];
829 
830  if( length % 16 )
832 
833 #if defined(POLARSSL_PADLOCK_C) && defined(POLARSSL_HAVE_X86)
834  if( aes_padlock_ace )
835  {
836  if( padlock_xcryptcbc( ctx, mode, length, iv, input, output ) == 0 )
837  return( 0 );
838 
839  // If padlock data misaligned, we just fall back to
840  // unaccelerated mode
841  //
842  }
843 #endif
844 
845  if( mode == AES_DECRYPT )
846  {
847  while( length > 0 )
848  {
849  memcpy( temp, input, 16 );
850  aes_crypt_ecb( ctx, mode, input, output );
851 
852  for( i = 0; i < 16; i++ )
853  output[i] = (unsigned char)( output[i] ^ iv[i] );
854 
855  memcpy( iv, temp, 16 );
856 
857  input += 16;
858  output += 16;
859  length -= 16;
860  }
861  }
862  else
863  {
864  while( length > 0 )
865  {
866  for( i = 0; i < 16; i++ )
867  output[i] = (unsigned char)( input[i] ^ iv[i] );
868 
869  aes_crypt_ecb( ctx, mode, output, output );
870  memcpy( iv, output, 16 );
871 
872  input += 16;
873  output += 16;
874  length -= 16;
875  }
876  }
877 
878  return( 0 );
879 }
880 #endif /* POLARSSL_CIPHER_MODE_CBC */
881 
882 #if defined(POLARSSL_CIPHER_MODE_CFB)
883 /*
884  * AES-CFB128 buffer encryption/decryption
885  */
886 int aes_crypt_cfb128( aes_context *ctx,
887  int mode,
888  size_t length,
889  size_t *iv_off,
890  unsigned char iv[16],
891  const unsigned char *input,
892  unsigned char *output )
893 {
894  int c;
895  size_t n = *iv_off;
896 
897  if( mode == AES_DECRYPT )
898  {
899  while( length-- )
900  {
901  if( n == 0 )
902  aes_crypt_ecb( ctx, AES_ENCRYPT, iv, iv );
903 
904  c = *input++;
905  *output++ = (unsigned char)( c ^ iv[n] );
906  iv[n] = (unsigned char) c;
907 
908  n = ( n + 1 ) & 0x0F;
909  }
910  }
911  else
912  {
913  while( length-- )
914  {
915  if( n == 0 )
916  aes_crypt_ecb( ctx, AES_ENCRYPT, iv, iv );
917 
918  iv[n] = *output++ = (unsigned char)( iv[n] ^ *input++ );
919 
920  n = ( n + 1 ) & 0x0F;
921  }
922  }
923 
924  *iv_off = n;
925 
926  return( 0 );
927 }
928 
929 /*
930  * AES-CFB8 buffer encryption/decryption
931  */
932 #include <stdio.h>
933 int aes_crypt_cfb8( aes_context *ctx,
934  int mode,
935  size_t length,
936  unsigned char iv[16],
937  const unsigned char *input,
938  unsigned char *output )
939 {
940  unsigned char c;
941  unsigned char ov[17];
942 
943  while( length-- )
944  {
945  memcpy( ov, iv, 16 );
946  aes_crypt_ecb( ctx, AES_ENCRYPT, iv, iv );
947 
948  if( mode == AES_DECRYPT )
949  ov[16] = *input;
950 
951  c = *output++ = (unsigned char)( iv[0] ^ *input++ );
952 
953  if( mode == AES_ENCRYPT )
954  ov[16] = c;
955 
956  memcpy( iv, ov + 1, 16 );
957  }
958 
959  return( 0 );
960 }
961 #endif /*POLARSSL_CIPHER_MODE_CFB */
962 
963 #if defined(POLARSSL_CIPHER_MODE_CTR)
964 /*
965  * AES-CTR buffer encryption/decryption
966  */
967 int aes_crypt_ctr( aes_context *ctx,
968  size_t length,
969  size_t *nc_off,
970  unsigned char nonce_counter[16],
971  unsigned char stream_block[16],
972  const unsigned char *input,
973  unsigned char *output )
974 {
975  int c, i;
976  size_t n = *nc_off;
977 
978  while( length-- )
979  {
980  if( n == 0 ) {
981  aes_crypt_ecb( ctx, AES_ENCRYPT, nonce_counter, stream_block );
982 
983  for( i = 16; i > 0; i-- )
984  if( ++nonce_counter[i - 1] != 0 )
985  break;
986  }
987  c = *input++;
988  *output++ = (unsigned char)( c ^ stream_block[n] );
989 
990  n = ( n + 1 ) & 0x0F;
991  }
992 
993  *nc_off = n;
994 
995  return( 0 );
996 }
997 #endif /* POLARSSL_CIPHER_MODE_CTR */
998 
999 #endif /* !POLARSSL_AES_ALT */
1000 
1001 #if defined(POLARSSL_SELF_TEST)
1002 
1003 #include <stdio.h>
1004 
1005 /*
1006  * AES test vectors from:
1007  *
1008  * http://csrc.nist.gov/archive/aes/rijndael/rijndael-vals.zip
1009  */
1010 static const unsigned char aes_test_ecb_dec[3][16] =
1011 {
1012  { 0x44, 0x41, 0x6A, 0xC2, 0xD1, 0xF5, 0x3C, 0x58,
1013  0x33, 0x03, 0x91, 0x7E, 0x6B, 0xE9, 0xEB, 0xE0 },
1014  { 0x48, 0xE3, 0x1E, 0x9E, 0x25, 0x67, 0x18, 0xF2,
1015  0x92, 0x29, 0x31, 0x9C, 0x19, 0xF1, 0x5B, 0xA4 },
1016  { 0x05, 0x8C, 0xCF, 0xFD, 0xBB, 0xCB, 0x38, 0x2D,
1017  0x1F, 0x6F, 0x56, 0x58, 0x5D, 0x8A, 0x4A, 0xDE }
1018 };
1019 
1020 static const unsigned char aes_test_ecb_enc[3][16] =
1021 {
1022  { 0xC3, 0x4C, 0x05, 0x2C, 0xC0, 0xDA, 0x8D, 0x73,
1023  0x45, 0x1A, 0xFE, 0x5F, 0x03, 0xBE, 0x29, 0x7F },
1024  { 0xF3, 0xF6, 0x75, 0x2A, 0xE8, 0xD7, 0x83, 0x11,
1025  0x38, 0xF0, 0x41, 0x56, 0x06, 0x31, 0xB1, 0x14 },
1026  { 0x8B, 0x79, 0xEE, 0xCC, 0x93, 0xA0, 0xEE, 0x5D,
1027  0xFF, 0x30, 0xB4, 0xEA, 0x21, 0x63, 0x6D, 0xA4 }
1028 };
1029 
1030 #if defined(POLARSSL_CIPHER_MODE_CBC)
1031 static const unsigned char aes_test_cbc_dec[3][16] =
1032 {
1033  { 0xFA, 0xCA, 0x37, 0xE0, 0xB0, 0xC8, 0x53, 0x73,
1034  0xDF, 0x70, 0x6E, 0x73, 0xF7, 0xC9, 0xAF, 0x86 },
1035  { 0x5D, 0xF6, 0x78, 0xDD, 0x17, 0xBA, 0x4E, 0x75,
1036  0xB6, 0x17, 0x68, 0xC6, 0xAD, 0xEF, 0x7C, 0x7B },
1037  { 0x48, 0x04, 0xE1, 0x81, 0x8F, 0xE6, 0x29, 0x75,
1038  0x19, 0xA3, 0xE8, 0x8C, 0x57, 0x31, 0x04, 0x13 }
1039 };
1040 
1041 static const unsigned char aes_test_cbc_enc[3][16] =
1042 {
1043  { 0x8A, 0x05, 0xFC, 0x5E, 0x09, 0x5A, 0xF4, 0x84,
1044  0x8A, 0x08, 0xD3, 0x28, 0xD3, 0x68, 0x8E, 0x3D },
1045  { 0x7B, 0xD9, 0x66, 0xD5, 0x3A, 0xD8, 0xC1, 0xBB,
1046  0x85, 0xD2, 0xAD, 0xFA, 0xE8, 0x7B, 0xB1, 0x04 },
1047  { 0xFE, 0x3C, 0x53, 0x65, 0x3E, 0x2F, 0x45, 0xB5,
1048  0x6F, 0xCD, 0x88, 0xB2, 0xCC, 0x89, 0x8F, 0xF0 }
1049 };
1050 #endif /* POLARSSL_CIPHER_MODE_CBC */
1051 
1052 #if defined(POLARSSL_CIPHER_MODE_CFB)
1053 /*
1054  * AES-CFB128 test vectors from:
1055  *
1056  * http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
1057  */
1058 static const unsigned char aes_test_cfb128_key[3][32] =
1059 {
1060  { 0x2B, 0x7E, 0x15, 0x16, 0x28, 0xAE, 0xD2, 0xA6,
1061  0xAB, 0xF7, 0x15, 0x88, 0x09, 0xCF, 0x4F, 0x3C },
1062  { 0x8E, 0x73, 0xB0, 0xF7, 0xDA, 0x0E, 0x64, 0x52,
1063  0xC8, 0x10, 0xF3, 0x2B, 0x80, 0x90, 0x79, 0xE5,
1064  0x62, 0xF8, 0xEA, 0xD2, 0x52, 0x2C, 0x6B, 0x7B },
1065  { 0x60, 0x3D, 0xEB, 0x10, 0x15, 0xCA, 0x71, 0xBE,
1066  0x2B, 0x73, 0xAE, 0xF0, 0x85, 0x7D, 0x77, 0x81,
1067  0x1F, 0x35, 0x2C, 0x07, 0x3B, 0x61, 0x08, 0xD7,
1068  0x2D, 0x98, 0x10, 0xA3, 0x09, 0x14, 0xDF, 0xF4 }
1069 };
1070 
1071 static const unsigned char aes_test_cfb128_iv[16] =
1072 {
1073  0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
1074  0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F
1075 };
1076 
1077 static const unsigned char aes_test_cfb128_pt[64] =
1078 {
1079  0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96,
1080  0xE9, 0x3D, 0x7E, 0x11, 0x73, 0x93, 0x17, 0x2A,
1081  0xAE, 0x2D, 0x8A, 0x57, 0x1E, 0x03, 0xAC, 0x9C,
1082  0x9E, 0xB7, 0x6F, 0xAC, 0x45, 0xAF, 0x8E, 0x51,
1083  0x30, 0xC8, 0x1C, 0x46, 0xA3, 0x5C, 0xE4, 0x11,
1084  0xE5, 0xFB, 0xC1, 0x19, 0x1A, 0x0A, 0x52, 0xEF,
1085  0xF6, 0x9F, 0x24, 0x45, 0xDF, 0x4F, 0x9B, 0x17,
1086  0xAD, 0x2B, 0x41, 0x7B, 0xE6, 0x6C, 0x37, 0x10
1087 };
1088 
1089 static const unsigned char aes_test_cfb128_ct[3][64] =
1090 {
1091  { 0x3B, 0x3F, 0xD9, 0x2E, 0xB7, 0x2D, 0xAD, 0x20,
1092  0x33, 0x34, 0x49, 0xF8, 0xE8, 0x3C, 0xFB, 0x4A,
1093  0xC8, 0xA6, 0x45, 0x37, 0xA0, 0xB3, 0xA9, 0x3F,
1094  0xCD, 0xE3, 0xCD, 0xAD, 0x9F, 0x1C, 0xE5, 0x8B,
1095  0x26, 0x75, 0x1F, 0x67, 0xA3, 0xCB, 0xB1, 0x40,
1096  0xB1, 0x80, 0x8C, 0xF1, 0x87, 0xA4, 0xF4, 0xDF,
1097  0xC0, 0x4B, 0x05, 0x35, 0x7C, 0x5D, 0x1C, 0x0E,
1098  0xEA, 0xC4, 0xC6, 0x6F, 0x9F, 0xF7, 0xF2, 0xE6 },
1099  { 0xCD, 0xC8, 0x0D, 0x6F, 0xDD, 0xF1, 0x8C, 0xAB,
1100  0x34, 0xC2, 0x59, 0x09, 0xC9, 0x9A, 0x41, 0x74,
1101  0x67, 0xCE, 0x7F, 0x7F, 0x81, 0x17, 0x36, 0x21,
1102  0x96, 0x1A, 0x2B, 0x70, 0x17, 0x1D, 0x3D, 0x7A,
1103  0x2E, 0x1E, 0x8A, 0x1D, 0xD5, 0x9B, 0x88, 0xB1,
1104  0xC8, 0xE6, 0x0F, 0xED, 0x1E, 0xFA, 0xC4, 0xC9,
1105  0xC0, 0x5F, 0x9F, 0x9C, 0xA9, 0x83, 0x4F, 0xA0,
1106  0x42, 0xAE, 0x8F, 0xBA, 0x58, 0x4B, 0x09, 0xFF },
1107  { 0xDC, 0x7E, 0x84, 0xBF, 0xDA, 0x79, 0x16, 0x4B,
1108  0x7E, 0xCD, 0x84, 0x86, 0x98, 0x5D, 0x38, 0x60,
1109  0x39, 0xFF, 0xED, 0x14, 0x3B, 0x28, 0xB1, 0xC8,
1110  0x32, 0x11, 0x3C, 0x63, 0x31, 0xE5, 0x40, 0x7B,
1111  0xDF, 0x10, 0x13, 0x24, 0x15, 0xE5, 0x4B, 0x92,
1112  0xA1, 0x3E, 0xD0, 0xA8, 0x26, 0x7A, 0xE2, 0xF9,
1113  0x75, 0xA3, 0x85, 0x74, 0x1A, 0xB9, 0xCE, 0xF8,
1114  0x20, 0x31, 0x62, 0x3D, 0x55, 0xB1, 0xE4, 0x71 }
1115 };
1116 #endif /* POLARSSL_CIPHER_MODE_CFB */
1117 
1118 #if defined(POLARSSL_CIPHER_MODE_CTR)
1119 /*
1120  * AES-CTR test vectors from:
1121  *
1122  * http://www.faqs.org/rfcs/rfc3686.html
1123  */
1124 
1125 static const unsigned char aes_test_ctr_key[3][16] =
1126 {
1127  { 0xAE, 0x68, 0x52, 0xF8, 0x12, 0x10, 0x67, 0xCC,
1128  0x4B, 0xF7, 0xA5, 0x76, 0x55, 0x77, 0xF3, 0x9E },
1129  { 0x7E, 0x24, 0x06, 0x78, 0x17, 0xFA, 0xE0, 0xD7,
1130  0x43, 0xD6, 0xCE, 0x1F, 0x32, 0x53, 0x91, 0x63 },
1131  { 0x76, 0x91, 0xBE, 0x03, 0x5E, 0x50, 0x20, 0xA8,
1132  0xAC, 0x6E, 0x61, 0x85, 0x29, 0xF9, 0xA0, 0xDC }
1133 };
1134 
1135 static const unsigned char aes_test_ctr_nonce_counter[3][16] =
1136 {
1137  { 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x00,
1138  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 },
1139  { 0x00, 0x6C, 0xB6, 0xDB, 0xC0, 0x54, 0x3B, 0x59,
1140  0xDA, 0x48, 0xD9, 0x0B, 0x00, 0x00, 0x00, 0x01 },
1141  { 0x00, 0xE0, 0x01, 0x7B, 0x27, 0x77, 0x7F, 0x3F,
1142  0x4A, 0x17, 0x86, 0xF0, 0x00, 0x00, 0x00, 0x01 }
1143 };
1144 
1145 static const unsigned char aes_test_ctr_pt[3][48] =
1146 {
1147  { 0x53, 0x69, 0x6E, 0x67, 0x6C, 0x65, 0x20, 0x62,
1148  0x6C, 0x6F, 0x63, 0x6B, 0x20, 0x6D, 0x73, 0x67 },
1149 
1150  { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
1151  0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
1152  0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
1153  0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F },
1154 
1155  { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
1156  0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
1157  0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
1158  0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F,
1159  0x20, 0x21, 0x22, 0x23 }
1160 };
1161 
1162 static const unsigned char aes_test_ctr_ct[3][48] =
1163 {
1164  { 0xE4, 0x09, 0x5D, 0x4F, 0xB7, 0xA7, 0xB3, 0x79,
1165  0x2D, 0x61, 0x75, 0xA3, 0x26, 0x13, 0x11, 0xB8 },
1166  { 0x51, 0x04, 0xA1, 0x06, 0x16, 0x8A, 0x72, 0xD9,
1167  0x79, 0x0D, 0x41, 0xEE, 0x8E, 0xDA, 0xD3, 0x88,
1168  0xEB, 0x2E, 0x1E, 0xFC, 0x46, 0xDA, 0x57, 0xC8,
1169  0xFC, 0xE6, 0x30, 0xDF, 0x91, 0x41, 0xBE, 0x28 },
1170  { 0xC1, 0xCF, 0x48, 0xA8, 0x9F, 0x2F, 0xFD, 0xD9,
1171  0xCF, 0x46, 0x52, 0xE9, 0xEF, 0xDB, 0x72, 0xD7,
1172  0x45, 0x40, 0xA4, 0x2B, 0xDE, 0x6D, 0x78, 0x36,
1173  0xD5, 0x9A, 0x5C, 0xEA, 0xAE, 0xF3, 0x10, 0x53,
1174  0x25, 0xB2, 0x07, 0x2F }
1175 };
1176 
1177 static const int aes_test_ctr_len[3] =
1178  { 16, 32, 36 };
1179 #endif /* POLARSSL_CIPHER_MODE_CTR */
1180 
1181 /*
1182  * Checkup routine
1183  */
1184 int aes_self_test( int verbose )
1185 {
1186  int ret = 0, i, j, u, v;
1187  unsigned char key[32];
1188  unsigned char buf[64];
1189  unsigned char iv[16];
1190 #if defined(POLARSSL_CIPHER_MODE_CBC)
1191  unsigned char prv[16];
1192 #endif
1193 #if defined(POLARSSL_CIPHER_MODE_CTR) || defined(POLARSSL_CIPHER_MODE_CFB)
1194  size_t offset;
1195 #endif
1196 #if defined(POLARSSL_CIPHER_MODE_CTR)
1197  int len;
1198  unsigned char nonce_counter[16];
1199  unsigned char stream_block[16];
1200 #endif
1201  aes_context ctx;
1202 
1203  memset( key, 0, 32 );
1204  aes_init( &ctx );
1205 
1206  /*
1207  * ECB mode
1208  */
1209  for( i = 0; i < 6; i++ )
1210  {
1211  u = i >> 1;
1212  v = i & 1;
1213 
1214  if( verbose != 0 )
1215  polarssl_printf( " AES-ECB-%3d (%s): ", 128 + u * 64,
1216  ( v == AES_DECRYPT ) ? "dec" : "enc" );
1217 
1218  memset( buf, 0, 16 );
1219 
1220  if( v == AES_DECRYPT )
1221  {
1222  aes_setkey_dec( &ctx, key, 128 + u * 64 );
1223 
1224  for( j = 0; j < 10000; j++ )
1225  aes_crypt_ecb( &ctx, v, buf, buf );
1226 
1227  if( memcmp( buf, aes_test_ecb_dec[u], 16 ) != 0 )
1228  {
1229  if( verbose != 0 )
1230  polarssl_printf( "failed\n" );
1231 
1232  ret = 1;
1233  goto exit;
1234  }
1235  }
1236  else
1237  {
1238  aes_setkey_enc( &ctx, key, 128 + u * 64 );
1239 
1240  for( j = 0; j < 10000; j++ )
1241  aes_crypt_ecb( &ctx, v, buf, buf );
1242 
1243  if( memcmp( buf, aes_test_ecb_enc[u], 16 ) != 0 )
1244  {
1245  if( verbose != 0 )
1246  polarssl_printf( "failed\n" );
1247 
1248  ret = 1;
1249  goto exit;
1250  }
1251  }
1252 
1253  if( verbose != 0 )
1254  polarssl_printf( "passed\n" );
1255  }
1256 
1257  if( verbose != 0 )
1258  polarssl_printf( "\n" );
1259 
1260 #if defined(POLARSSL_CIPHER_MODE_CBC)
1261  /*
1262  * CBC mode
1263  */
1264  for( i = 0; i < 6; i++ )
1265  {
1266  u = i >> 1;
1267  v = i & 1;
1268 
1269  if( verbose != 0 )
1270  polarssl_printf( " AES-CBC-%3d (%s): ", 128 + u * 64,
1271  ( v == AES_DECRYPT ) ? "dec" : "enc" );
1272 
1273  memset( iv , 0, 16 );
1274  memset( prv, 0, 16 );
1275  memset( buf, 0, 16 );
1276 
1277  if( v == AES_DECRYPT )
1278  {
1279  aes_setkey_dec( &ctx, key, 128 + u * 64 );
1280 
1281  for( j = 0; j < 10000; j++ )
1282  aes_crypt_cbc( &ctx, v, 16, iv, buf, buf );
1283 
1284  if( memcmp( buf, aes_test_cbc_dec[u], 16 ) != 0 )
1285  {
1286  if( verbose != 0 )
1287  polarssl_printf( "failed\n" );
1288 
1289  ret = 1;
1290  goto exit;
1291  }
1292  }
1293  else
1294  {
1295  aes_setkey_enc( &ctx, key, 128 + u * 64 );
1296 
1297  for( j = 0; j < 10000; j++ )
1298  {
1299  unsigned char tmp[16];
1300 
1301  aes_crypt_cbc( &ctx, v, 16, iv, buf, buf );
1302 
1303  memcpy( tmp, prv, 16 );
1304  memcpy( prv, buf, 16 );
1305  memcpy( buf, tmp, 16 );
1306  }
1307 
1308  if( memcmp( prv, aes_test_cbc_enc[u], 16 ) != 0 )
1309  {
1310  if( verbose != 0 )
1311  polarssl_printf( "failed\n" );
1312 
1313  ret = 1;
1314  goto exit;
1315  }
1316  }
1317 
1318  if( verbose != 0 )
1319  polarssl_printf( "passed\n" );
1320  }
1321 
1322  if( verbose != 0 )
1323  polarssl_printf( "\n" );
1324 #endif /* POLARSSL_CIPHER_MODE_CBC */
1325 
1326 #if defined(POLARSSL_CIPHER_MODE_CFB)
1327  /*
1328  * CFB128 mode
1329  */
1330  for( i = 0; i < 6; i++ )
1331  {
1332  u = i >> 1;
1333  v = i & 1;
1334 
1335  if( verbose != 0 )
1336  polarssl_printf( " AES-CFB128-%3d (%s): ", 128 + u * 64,
1337  ( v == AES_DECRYPT ) ? "dec" : "enc" );
1338 
1339  memcpy( iv, aes_test_cfb128_iv, 16 );
1340  memcpy( key, aes_test_cfb128_key[u], 16 + u * 8 );
1341 
1342  offset = 0;
1343  aes_setkey_enc( &ctx, key, 128 + u * 64 );
1344 
1345  if( v == AES_DECRYPT )
1346  {
1347  memcpy( buf, aes_test_cfb128_ct[u], 64 );
1348  aes_crypt_cfb128( &ctx, v, 64, &offset, iv, buf, buf );
1349 
1350  if( memcmp( buf, aes_test_cfb128_pt, 64 ) != 0 )
1351  {
1352  if( verbose != 0 )
1353  polarssl_printf( "failed\n" );
1354 
1355  ret = 1;
1356  goto exit;
1357  }
1358  }
1359  else
1360  {
1361  memcpy( buf, aes_test_cfb128_pt, 64 );
1362  aes_crypt_cfb128( &ctx, v, 64, &offset, iv, buf, buf );
1363 
1364  if( memcmp( buf, aes_test_cfb128_ct[u], 64 ) != 0 )
1365  {
1366  if( verbose != 0 )
1367  polarssl_printf( "failed\n" );
1368 
1369  ret = 1;
1370  goto exit;
1371  }
1372  }
1373 
1374  if( verbose != 0 )
1375  polarssl_printf( "passed\n" );
1376  }
1377 
1378  if( verbose != 0 )
1379  polarssl_printf( "\n" );
1380 #endif /* POLARSSL_CIPHER_MODE_CFB */
1381 
1382 #if defined(POLARSSL_CIPHER_MODE_CTR)
1383  /*
1384  * CTR mode
1385  */
1386  for( i = 0; i < 6; i++ )
1387  {
1388  u = i >> 1;
1389  v = i & 1;
1390 
1391  if( verbose != 0 )
1392  polarssl_printf( " AES-CTR-128 (%s): ",
1393  ( v == AES_DECRYPT ) ? "dec" : "enc" );
1394 
1395  memcpy( nonce_counter, aes_test_ctr_nonce_counter[u], 16 );
1396  memcpy( key, aes_test_ctr_key[u], 16 );
1397 
1398  offset = 0;
1399  aes_setkey_enc( &ctx, key, 128 );
1400 
1401  if( v == AES_DECRYPT )
1402  {
1403  len = aes_test_ctr_len[u];
1404  memcpy( buf, aes_test_ctr_ct[u], len );
1405 
1406  aes_crypt_ctr( &ctx, len, &offset, nonce_counter, stream_block,
1407  buf, buf );
1408 
1409  if( memcmp( buf, aes_test_ctr_pt[u], len ) != 0 )
1410  {
1411  if( verbose != 0 )
1412  polarssl_printf( "failed\n" );
1413 
1414  ret = 1;
1415  goto exit;
1416  }
1417  }
1418  else
1419  {
1420  len = aes_test_ctr_len[u];
1421  memcpy( buf, aes_test_ctr_pt[u], len );
1422 
1423  aes_crypt_ctr( &ctx, len, &offset, nonce_counter, stream_block,
1424  buf, buf );
1425 
1426  if( memcmp( buf, aes_test_ctr_ct[u], len ) != 0 )
1427  {
1428  if( verbose != 0 )
1429  polarssl_printf( "failed\n" );
1430 
1431  ret = 1;
1432  goto exit;
1433  }
1434  }
1435 
1436  if( verbose != 0 )
1437  polarssl_printf( "passed\n" );
1438  }
1439 
1440  if( verbose != 0 )
1441  polarssl_printf( "\n" );
1442 #endif /* POLARSSL_CIPHER_MODE_CTR */
1443 
1444  ret = 0;
1445 
1446 exit:
1447  aes_free( &ctx );
1448 
1449  return( ret );
1450 }
1451 
1452 #endif /* POLARSSL_SELF_TEST */
1453 
1454 #endif /* POLARSSL_AES_C */
#define POLARSSL_AESNI_AES
Definition: aesni.h:32
int aes_crypt_cfb128(aes_context *ctx, int mode, size_t length, size_t *iv_off, unsigned char iv[16], const unsigned char *input, unsigned char *output)
AES-CFB128 buffer encryption/decryption.
uint32_t buf[68]
Definition: aes.h:72
#define AES_DECRYPT
Definition: aes.h:47
AES context structure.
Definition: aes.h:68
Configuration options (set of defines)
int aes_setkey_dec(aes_context *ctx, const unsigned char *key, unsigned int keysize)
AES key schedule (decryption)
PolarSSL Platform abstraction layer.
AES-NI for hardware AES acceleration on some Intel processors.
int aes_crypt_cbc(aes_context *ctx, int mode, size_t length, unsigned char iv[16], const unsigned char *input, unsigned char *output)
AES-CBC buffer encryption/decryption Length should be a multiple of the block size (16 bytes) ...
AES block cipher.
int aes_self_test(int verbose)
Checkup routine.
#define POLARSSL_ERR_AES_INVALID_KEY_LENGTH
Invalid key length.
Definition: aes.h:49
int aes_crypt_cfb8(aes_context *ctx, int mode, size_t length, unsigned char iv[16], const unsigned char *input, unsigned char *output)
AES-CFB8 buffer encryption/decryption.
#define AES_ENCRYPT
Definition: aes.h:46
void aes_free(aes_context *ctx)
Clear AES context.
#define polarssl_printf
Definition: platform.h:109
uint32_t * rk
Definition: aes.h:71
VIA PadLock ACE for HW encryption/decryption supported by some processors.
int nr
Definition: aes.h:70
#define POLARSSL_ERR_AES_INVALID_INPUT_LENGTH
Invalid data input length.
Definition: aes.h:50
int aes_setkey_enc(aes_context *ctx, const unsigned char *key, unsigned int keysize)
AES key schedule (encryption)
int aes_crypt_ecb(aes_context *ctx, int mode, const unsigned char input[16], unsigned char output[16])
AES-ECB block encryption/decryption.
void aes_init(aes_context *ctx)
Initialize AES context.
int aes_crypt_ctr(aes_context *ctx, size_t length, size_t *nc_off, unsigned char nonce_counter[16], unsigned char stream_block[16], const unsigned char *input, unsigned char *output)
AES-CTR buffer encryption/decryption.