1 /* Copyright (C) 2000-2009 Peter Selinger.
2 This file is part of ccrypt. It is free software and it is covered
3 by the GNU general public license. See the file COPYING for details. */
5 /* rijndael.c - optimized version of the Rijndeal cipher */
6 /* $Id: rijndael.c 258 2009-08-26 17:46:10Z selinger $ */
8 /* derived from original source: rijndael-alg-ref.c v2.0 August '99
9 * Reference ANSI C code for NIST competition
10 * authors: Paulo Barreto
16 #include "ao_aes_int.h"
18 static const int xshifts[3][2][4] = {
29 /* Exor corresponding text input and round key input bytes */
30 /* the result is written to res, which can be the same as a */
31 static inline void xKeyAddition(word32 res[MAXBC], word32 a[MAXBC],
32 word32 rk[MAXBC], int BC)
36 for (j = 0; j < BC; j++) {
37 res[j] = a[j] ^ rk[j];
41 #if 0 /* code included for reference */
43 /* shift rows a, return result in res. This avoids having to copy a
44 tmp array back to a. res must not be a. */
45 static inline void xShiftRow(word32 res[MAXBC], word32 a[MAXBC], int shift[4],
48 word8 (*a8)[4] = (word8 (*)[4]) a;
49 word8 (*res8)[4] = (word8 (*)[4]) res;
51 /* Row 0 remains unchanged
52 * The other three rows are shifted a variable amount
57 for (j = 0; j < BC; j++) {
58 res8[j][0] = a8[j][0];
60 for (i = 1; i < 4; i++) {
62 for (j = 0; j < BC; j++) {
63 res8[j][i] = a8[(j + s) % BC][i];
68 static inline void xSubstitution(word32 a[MAXBC], word8 box[256], int BC)
70 word8 (*a8)[4] = (word8 (*)[4]) a;
72 /* Replace every byte of the input by the byte at that place
73 * in the nonlinear S-box
77 for (i = 0; i < 4; i++) {
78 for (j = 0; j < BC; j++) {
79 a8[j][i] = box[a[j][i]];
84 #endif /* code included for reference */
86 /* profiling shows that the ccrypt program spends about 50% of its
87 time in the function xShiftSubst. Splitting the inner "for"
88 statement into two parts - versus using the expensive "%" modulo
89 operation, makes this function about 44% faster, thereby making the
90 entire program about 28% faster. With -O3 optimization, the time
91 savings are even more dramatic - ccrypt runs between 55% and 65%
92 faster on most platforms. */
94 /* do ShiftRow and Substitution together. res must not be a. */
95 static inline void xShiftSubst(word32 res[MAXBC], word32 a[MAXBC],
96 int shift[4], int BC, const word8 box[256])
100 word8 (*a8)[4] = (word8 (*)[4]) a;
101 word8 (*res8)[4] = (word8 (*)[4]) res;
103 for (j = 0; j < BC; j++) {
104 res8[j][0] = box[a8[j][0]];
106 for (i = 1; i < 4; i++) {
108 for (j = 0; j < BC - s; j++) {
109 res8[j][i] = box[a8[(j + s)][i]];
111 for (j = BC - s; j < BC; j++) {
112 res8[j][i] = box[a8[(j + s) - BC][i]];
117 #if 0 /* code included for reference */
119 /* Mix the four bytes of every column in a linear way */
120 /* the result is written to res, which may equal a */
121 static inline void xMixColumn(word32 res[MAXBC], word32 a[MAXBC], int BC)
125 word8 (*a8)[4] = (word8 (*)[4]) a;
127 for (j = 0; j < BC; j++) {
128 b = M0[0][a8[j][0]].w32;
129 b ^= M0[1][a8[j][1]].w32;
130 b ^= M0[2][a8[j][2]].w32;
131 b ^= M0[3][a8[j][3]].w32;
136 #endif /* code included for reference */
138 /* do MixColumn and KeyAddition together */
139 static inline void xMixAdd(word32 res[MAXBC], word32 a[MAXBC],
140 word32 rk[MAXBC], int BC)
144 word8 (*a8)[4] = (word8 (*)[4]) a;
146 for (j = 0; j < BC; j++) {
147 b = M0[0][a8[j][0]].w32;
148 b ^= M0[1][a8[j][1]].w32;
149 b ^= M0[2][a8[j][2]].w32;
150 b ^= M0[3][a8[j][3]].w32;
156 /* Mix the four bytes of every column in a linear way
157 * This is the opposite operation of xMixColumn */
158 /* the result is written to res, which may equal a */
159 static inline void xInvMixColumn(word32 res[MAXBC], word32 a[MAXBC], int BC)
163 word8 (*a8)[4] = (word8 (*)[4]) a;
165 for (j = 0; j < BC; j++) {
166 b = M1[0][a8[j][0]].w32;
167 b ^= M1[1][a8[j][1]].w32;
168 b ^= M1[2][a8[j][2]].w32;
169 b ^= M1[3][a8[j][3]].w32;
174 #if 0 /* code included for reference */
176 /* do KeyAddition and InvMixColumn together */
177 static inline void xAddInvMix(word32 res[MAXBC], word32 a[MAXBC],
178 word32 rk[MAXBC], int BC)
182 word8 (*a8)[4] = (word8 (*)[4]) a;
184 for (j = 0; j < BC; j++) {
186 b = M1[0][a8[j][0]].w32;
187 b ^= M1[1][a8[j][1]].w32;
188 b ^= M1[2][a8[j][2]].w32;
189 b ^= M1[3][a8[j][3]].w32;
194 #endif /* code included for reference */
196 int xrijndaelKeySched(word32 key[], int keyBits, int blockBits,
199 /* Calculate the necessary round keys
200 * The number of calculations depends on keyBits and blockBits */
202 int i, j, t, rconpointer = 0;
203 word8 (*k8)[4] = (word8 (*)[4]) key;
233 ROUNDS = KC > BC ? KC + 6 : BC + 6;
236 /* copy values into round key array */
237 for (j = 0; (j < KC) && (t < (ROUNDS + 1) * BC); j++, t++)
240 while (t < (ROUNDS + 1) * BC) { /* while not enough round key material */
241 /* calculate new values */
242 for (i = 0; i < 4; i++) {
243 k8[0][i] ^= xS[k8[KC - 1][(i + 1) % 4]];
245 k8[0][0] ^= xrcon[rconpointer++];
248 for (j = 1; j < KC; j++) {
249 key[j] ^= key[j - 1];
252 for (j = 1; j < 4; j++) {
253 key[j] ^= key[j - 1];
255 for (i = 0; i < 4; i++) {
256 k8[4][i] ^= xS[k8[3][i]];
258 for (j = 5; j < 8; j++) {
259 key[j] ^= key[j - 1];
262 /* copy values into round key array */
263 for (j = 0; (j < KC) && (t < (ROUNDS + 1) * BC); j++, t++) {
268 /* make roundkey structure */
271 rkk->ROUNDS = ROUNDS;
272 for (i = 0; i < 2; i++) {
273 for (j = 0; j < 4; j++) {
274 rkk->shift[i][j] = xshifts[(BC - 4) >> 1][i][j];
281 /* Encryption of one block. */
283 void xrijndaelEncrypt(word32 block[], roundkey *rkk)
285 word32 block2[MAXBC]; /* hold intermediate result */
288 int *shift = rkk->shift[0];
290 int ROUNDS = rkk->ROUNDS;
291 word32 *rp = rkk->rk;
293 /* begin with a key addition */
294 xKeyAddition(block, block, rp, BC);
297 /* ROUNDS-1 ordinary rounds */
298 for (r = 1; r < ROUNDS; r++) {
299 xShiftSubst(block2, block, shift, BC, xS);
300 xMixAdd(block, block2, rp, BC);
304 /* Last round is special: there is no xMixColumn */
305 xShiftSubst(block2, block, shift, BC, xS);
306 xKeyAddition(block, block2, rp, BC);
309 void xrijndaelDecrypt(word32 block[], roundkey *rkk)
311 word32 block2[MAXBC]; /* hold intermediate result */
314 int *shift = rkk->shift[1];
316 int ROUNDS = rkk->ROUNDS;
317 word32 *rp = rkk->rk + ROUNDS * BC;
319 /* To decrypt: apply the inverse operations of the encrypt routine,
322 * (xKeyAddition is an involution: it's equal to its inverse)
323 * (the inverse of xSubstitution with table S is xSubstitution with the
324 * inverse table of S)
325 * (the inverse of xShiftRow is xShiftRow over a suitable distance)
328 /* First the special round:
329 * without xInvMixColumn
330 * with extra xKeyAddition
332 xKeyAddition(block2, block, rp, BC);
333 xShiftSubst(block, block2, shift, BC, xSi);
336 /* ROUNDS-1 ordinary rounds
338 for (r = ROUNDS - 1; r > 0; r--) {
339 xKeyAddition(block, block, rp, BC);
340 xInvMixColumn(block2, block, BC);
341 xShiftSubst(block, block2, shift, BC, xSi);
345 /* End with the extra key addition
348 xKeyAddition(block, block, rp, BC);
351 uint8_t ao_aes_mutex;
354 static uint8_t iv[16];
357 ao_aes_set_mode(enum ao_aes_mode mode)
359 /* we only do CBC_MAC anyways... */
363 ao_aes_set_key(__xdata uint8_t *in)
365 xrijndaelKeySched((word32 *) in, 128, 128, &rkk);
371 memset(iv, '\0', sizeof (iv));
375 ao_aes_run(__xdata uint8_t *in,
376 __xdata uint8_t *out)
380 for (i = 0; i < 16; i++)
382 xrijndaelEncrypt((word32 *) iv, &rkk);