1214501Srpaulo/* 2214501Srpaulo * AES (Rijndael) cipher - encrypt 3214501Srpaulo * 4214501Srpaulo * Modifications to public domain implementation: 5214501Srpaulo * - cleanup 6214501Srpaulo * - use C pre-processor to make it easier to change S table access 7214501Srpaulo * - added option (AES_SMALL_TABLES) for reducing code size by about 8 kB at 8214501Srpaulo * cost of reduced throughput (quite small difference on Pentium 4, 9214501Srpaulo * 10-25% when using -O1 or -O2 optimization) 10214501Srpaulo * 11252726Srpaulo * Copyright (c) 2003-2012, Jouni Malinen <j@w1.fi> 12214501Srpaulo * 13252726Srpaulo * This software may be distributed under the terms of the BSD license. 14252726Srpaulo * See README for more details. 15214501Srpaulo */ 16214501Srpaulo 17214501Srpaulo#include "includes.h" 18214501Srpaulo 19214501Srpaulo#include "common.h" 20214501Srpaulo#include "crypto.h" 21214501Srpaulo#include "aes_i.h" 22214501Srpaulo 23252726Srpaulostatic void rijndaelEncrypt(const u32 rk[], int Nr, const u8 pt[16], u8 ct[16]) 24214501Srpaulo{ 25214501Srpaulo u32 s0, s1, s2, s3, t0, t1, t2, t3; 26214501Srpaulo#ifndef FULL_UNROLL 27214501Srpaulo int r; 28214501Srpaulo#endif /* ?FULL_UNROLL */ 29214501Srpaulo 30214501Srpaulo /* 31214501Srpaulo * map byte array block to cipher state 32214501Srpaulo * and add initial round key: 33214501Srpaulo */ 34214501Srpaulo s0 = GETU32(pt ) ^ rk[0]; 35214501Srpaulo s1 = GETU32(pt + 4) ^ rk[1]; 36214501Srpaulo s2 = GETU32(pt + 8) ^ rk[2]; 37214501Srpaulo s3 = GETU32(pt + 12) ^ rk[3]; 38214501Srpaulo 39214501Srpaulo#define ROUND(i,d,s) \ 40214501Srpaulod##0 = TE0(s##0) ^ TE1(s##1) ^ TE2(s##2) ^ TE3(s##3) ^ rk[4 * i]; \ 41214501Srpaulod##1 = TE0(s##1) ^ TE1(s##2) ^ TE2(s##3) ^ TE3(s##0) ^ rk[4 * i + 1]; \ 42214501Srpaulod##2 = TE0(s##2) ^ TE1(s##3) ^ TE2(s##0) ^ TE3(s##1) ^ rk[4 * i + 2]; \ 43214501Srpaulod##3 = TE0(s##3) ^ TE1(s##0) ^ TE2(s##1) ^ TE3(s##2) ^ rk[4 * i + 3] 44214501Srpaulo 45214501Srpaulo#ifdef FULL_UNROLL 46214501Srpaulo 47214501Srpaulo ROUND(1,t,s); 48214501Srpaulo ROUND(2,s,t); 49214501Srpaulo ROUND(3,t,s); 50214501Srpaulo ROUND(4,s,t); 51214501Srpaulo ROUND(5,t,s); 52214501Srpaulo ROUND(6,s,t); 53214501Srpaulo ROUND(7,t,s); 54214501Srpaulo ROUND(8,s,t); 55214501Srpaulo ROUND(9,t,s); 56252726Srpaulo if (Nr > 10) { 57252726Srpaulo ROUND(10,s,t); 58252726Srpaulo ROUND(11,t,s); 59252726Srpaulo if (Nr > 12) { 60252726Srpaulo ROUND(12,s,t); 61252726Srpaulo ROUND(13,t,s); 62252726Srpaulo } 63252726Srpaulo } 64214501Srpaulo 65214501Srpaulo rk += Nr << 2; 66214501Srpaulo 67214501Srpaulo#else /* !FULL_UNROLL */ 68214501Srpaulo 69214501Srpaulo /* Nr - 1 full rounds: */ 70214501Srpaulo r = Nr >> 1; 71214501Srpaulo for (;;) { 72214501Srpaulo ROUND(1,t,s); 73214501Srpaulo rk += 8; 74214501Srpaulo if (--r == 0) 75214501Srpaulo break; 76214501Srpaulo ROUND(0,s,t); 77214501Srpaulo } 78214501Srpaulo 79214501Srpaulo#endif /* ?FULL_UNROLL */ 80214501Srpaulo 81214501Srpaulo#undef ROUND 82214501Srpaulo 83214501Srpaulo /* 84214501Srpaulo * apply last round and 85214501Srpaulo * map cipher state to byte array block: 86214501Srpaulo */ 87214501Srpaulo s0 = TE41(t0) ^ TE42(t1) ^ TE43(t2) ^ TE44(t3) ^ rk[0]; 88214501Srpaulo PUTU32(ct , s0); 89214501Srpaulo s1 = TE41(t1) ^ TE42(t2) ^ TE43(t3) ^ TE44(t0) ^ rk[1]; 90214501Srpaulo PUTU32(ct + 4, s1); 91214501Srpaulo s2 = TE41(t2) ^ TE42(t3) ^ TE43(t0) ^ TE44(t1) ^ rk[2]; 92214501Srpaulo PUTU32(ct + 8, s2); 93214501Srpaulo s3 = TE41(t3) ^ TE42(t0) ^ TE43(t1) ^ TE44(t2) ^ rk[3]; 94214501Srpaulo PUTU32(ct + 12, s3); 95214501Srpaulo} 96214501Srpaulo 97214501Srpaulo 98214501Srpaulovoid * aes_encrypt_init(const u8 *key, size_t len) 99214501Srpaulo{ 100214501Srpaulo u32 *rk; 101252726Srpaulo int res; 102214501Srpaulo rk = os_malloc(AES_PRIV_SIZE); 103214501Srpaulo if (rk == NULL) 104214501Srpaulo return NULL; 105252726Srpaulo res = rijndaelKeySetupEnc(rk, key, len * 8); 106252726Srpaulo if (res < 0) { 107252726Srpaulo os_free(rk); 108252726Srpaulo return NULL; 109252726Srpaulo } 110252726Srpaulo rk[AES_PRIV_NR_POS] = res; 111214501Srpaulo return rk; 112214501Srpaulo} 113214501Srpaulo 114214501Srpaulo 115214501Srpaulovoid aes_encrypt(void *ctx, const u8 *plain, u8 *crypt) 116214501Srpaulo{ 117252726Srpaulo u32 *rk = ctx; 118252726Srpaulo rijndaelEncrypt(ctx, rk[AES_PRIV_NR_POS], plain, crypt); 119214501Srpaulo} 120214501Srpaulo 121214501Srpaulo 122214501Srpaulovoid aes_encrypt_deinit(void *ctx) 123214501Srpaulo{ 124214501Srpaulo os_memset(ctx, 0, AES_PRIV_SIZE); 125214501Srpaulo os_free(ctx); 126214501Srpaulo} 127