source: trunk/src/rijndael-alg-fst.c@ 238

Last change on this file since 238 was 230, checked in by katerina, 16 years ago

Fix gcc 4.4 compiler warnings. Release 2.5.5.
File size: 13.9 KB
RevLine 
[1]1/*
2 * rijndael-alg-fst.c v2.3 April '2000
3 *
4 * Optimised ANSI C code
5 *
6 * authors: v1.0: Antoon Bosselaers
7 * v2.0: Vincent Rijmen
8 * v2.3: Paulo Barreto
9 *
10 * This code is placed in the public domain.
11 */
12
13#include "config_xor.h"
14
15#include <stdio.h>
16#include <stdlib.h>
17
18#ifdef SH_ENCRYPT
19
20#include "rijndael-alg-fst.h"
21
22#include "rijndael-boxes-fst.h"
23
24int rijndaelKeySched(word8 k[MAXKC][4], word8 W[MAXROUNDS+1][4][4], int ROUNDS) {
25 /* Calculate the necessary round keys
26 * The number of calculations depends on keyBits and blockBits
27 */
28 int j, r, t, rconpointer = 0;
29 word8 tk[MAXKC][4];
30 int KC = ROUNDS - 6;
31
32 for (j = KC-1; j >= 0; j--) {
33 *((word32*)tk[j]) = *((word32*)k[j]);
34 }
35 r = 0;
36 t = 0;
37 /* copy values into round key array */
38 for (j = 0; (j < KC) && (r < ROUNDS + 1); ) {
39 for (; (j < KC) && (t < 4); j++, t++) {
40 *((word32*)W[r][t]) = *((word32*)tk[j]);
41 }
42 if (t == 4) {
43 r++;
44 t = 0;
45 }
46 }
47
48 while (r < ROUNDS + 1) { /* while not enough round key material calculated */
49 /* calculate new values */
50 tk[0][0] ^= S[tk[KC-1][1]];
51 tk[0][1] ^= S[tk[KC-1][2]];
52 tk[0][2] ^= S[tk[KC-1][3]];
53 tk[0][3] ^= S[tk[KC-1][0]];
54 tk[0][0] ^= rcon[rconpointer++];
55
56 if (KC != 8) {
57 for (j = 1; j < KC; j++) {
58 *((word32*)tk[j]) ^= *((word32*)tk[j-1]);
59 }
60 } else {
61 for (j = 1; j < KC/2; j++) {
62 *((word32*)tk[j]) ^= *((word32*)tk[j-1]);
63 }
64 tk[KC/2][0] ^= S[tk[KC/2 - 1][0]];
65 tk[KC/2][1] ^= S[tk[KC/2 - 1][1]];
66 tk[KC/2][2] ^= S[tk[KC/2 - 1][2]];
67 tk[KC/2][3] ^= S[tk[KC/2 - 1][3]];
68 for (j = KC/2 + 1; j < KC; j++) {
69 *((word32*)tk[j]) ^= *((word32*)tk[j-1]);
70 }
71 }
72 /* copy values into round key array */
73 for (j = 0; (j < KC) && (r < ROUNDS + 1); ) {
74 for (; (j < KC) && (t < 4); j++, t++) {
75 *((word32*)W[r][t]) = *((word32*)tk[j]);
76 }
77 if (t == 4) {
78 r++;
79 t = 0;
80 }
81 }
82 }
83 return 0;
84}
85
86int rijndaelKeyEncToDec(word8 W[MAXROUNDS+1][4][4], int ROUNDS) {
87 int r;
88 word8 *w;
89
90 for (r = 1; r < ROUNDS; r++) {
91 w = W[r][0];
92 *((word32*)w) =
93 *((word32*)U1[w[0]])
94 ^ *((word32*)U2[w[1]])
95 ^ *((word32*)U3[w[2]])
96 ^ *((word32*)U4[w[3]]);
97
98 w = W[r][1];
99 *((word32*)w) =
100 *((word32*)U1[w[0]])
101 ^ *((word32*)U2[w[1]])
102 ^ *((word32*)U3[w[2]])
103 ^ *((word32*)U4[w[3]]);
104
105 w = W[r][2];
106 *((word32*)w) =
107 *((word32*)U1[w[0]])
108 ^ *((word32*)U2[w[1]])
109 ^ *((word32*)U3[w[2]])
110 ^ *((word32*)U4[w[3]]);
111
112 w = W[r][3];
113 *((word32*)w) =
114 *((word32*)U1[w[0]])
115 ^ *((word32*)U2[w[1]])
116 ^ *((word32*)U3[w[2]])
117 ^ *((word32*)U4[w[3]]);
118 }
119 return 0;
120}
121
122/**
123 * Encrypt a single block.
124 */
125int rijndaelEncrypt(word8 a[16], word8 b[16], word8 rk[MAXROUNDS+1][4][4], int ROUNDS) {
126 int r;
[230]127 union {
128 word32 tem4[4];
129 word8 temp[4][4];
130 } tmpU;
131 tmpU.tem4[0] = tmpU.tem4[1] = tmpU.tem4[2] = tmpU.tem4[3] = 0;
[1]132
[230]133 tmpU.tem4[0] = *((word32*)(a )) ^ *((word32*)rk[0][0]);
134 tmpU.tem4[1] = *((word32*)(a+ 4)) ^ *((word32*)rk[0][1]);
135 tmpU.tem4[2] = *((word32*)(a+ 8)) ^ *((word32*)rk[0][2]);
136 tmpU.tem4[3] = *((word32*)(a+12)) ^ *((word32*)rk[0][3]);
137 *((word32*)(b )) = *((word32*)T1[tmpU.temp[0][0]])
138 ^ *((word32*)T2[tmpU.temp[1][1]])
139 ^ *((word32*)T3[tmpU.temp[2][2]])
140 ^ *((word32*)T4[tmpU.temp[3][3]]);
141 *((word32*)(b + 4)) = *((word32*)T1[tmpU.temp[1][0]])
142 ^ *((word32*)T2[tmpU.temp[2][1]])
143 ^ *((word32*)T3[tmpU.temp[3][2]])
144 ^ *((word32*)T4[tmpU.temp[0][3]]);
145 *((word32*)(b + 8)) = *((word32*)T1[tmpU.temp[2][0]])
146 ^ *((word32*)T2[tmpU.temp[3][1]])
147 ^ *((word32*)T3[tmpU.temp[0][2]])
148 ^ *((word32*)T4[tmpU.temp[1][3]]);
149 *((word32*)(b +12)) = *((word32*)T1[tmpU.temp[3][0]])
150 ^ *((word32*)T2[tmpU.temp[0][1]])
151 ^ *((word32*)T3[tmpU.temp[1][2]])
152 ^ *((word32*)T4[tmpU.temp[2][3]]);
[1]153 for (r = 1; r < ROUNDS-1; r++) {
[230]154 tmpU.tem4[0] = *((word32*)(b )) ^ *((word32*)rk[r][0]);
155 tmpU.tem4[1] = *((word32*)(b+ 4)) ^ *((word32*)rk[r][1]);
156 tmpU.tem4[2] = *((word32*)(b+ 8)) ^ *((word32*)rk[r][2]);
157 tmpU.tem4[3] = *((word32*)(b+12)) ^ *((word32*)rk[r][3]);
[1]158
[230]159 *((word32*)(b )) = *((word32*)T1[tmpU.temp[0][0]])
160 ^ *((word32*)T2[tmpU.temp[1][1]])
161 ^ *((word32*)T3[tmpU.temp[2][2]])
162 ^ *((word32*)T4[tmpU.temp[3][3]]);
163 *((word32*)(b + 4)) = *((word32*)T1[tmpU.temp[1][0]])
164 ^ *((word32*)T2[tmpU.temp[2][1]])
165 ^ *((word32*)T3[tmpU.temp[3][2]])
166 ^ *((word32*)T4[tmpU.temp[0][3]]);
167 *((word32*)(b + 8)) = *((word32*)T1[tmpU.temp[2][0]])
168 ^ *((word32*)T2[tmpU.temp[3][1]])
169 ^ *((word32*)T3[tmpU.temp[0][2]])
170 ^ *((word32*)T4[tmpU.temp[1][3]]);
171 *((word32*)(b +12)) = *((word32*)T1[tmpU.temp[3][0]])
172 ^ *((word32*)T2[tmpU.temp[0][1]])
173 ^ *((word32*)T3[tmpU.temp[1][2]])
174 ^ *((word32*)T4[tmpU.temp[2][3]]);
[1]175 }
176 /* last round is special */
[230]177 tmpU.tem4[0] = *((word32*)(b )) ^ *((word32*)rk[ROUNDS-1][0]);
178 tmpU.tem4[1] = *((word32*)(b+ 4)) ^ *((word32*)rk[ROUNDS-1][1]);
179 tmpU.tem4[2] = *((word32*)(b+ 8)) ^ *((word32*)rk[ROUNDS-1][2]);
180 tmpU.tem4[3] = *((word32*)(b+12)) ^ *((word32*)rk[ROUNDS-1][3]);
181 b[ 0] = T1[tmpU.temp[0][0]][1];
182 b[ 1] = T1[tmpU.temp[1][1]][1];
183 b[ 2] = T1[tmpU.temp[2][2]][1];
184 b[ 3] = T1[tmpU.temp[3][3]][1];
185 b[ 4] = T1[tmpU.temp[1][0]][1];
186 b[ 5] = T1[tmpU.temp[2][1]][1];
187 b[ 6] = T1[tmpU.temp[3][2]][1];
188 b[ 7] = T1[tmpU.temp[0][3]][1];
189 b[ 8] = T1[tmpU.temp[2][0]][1];
190 b[ 9] = T1[tmpU.temp[3][1]][1];
191 b[10] = T1[tmpU.temp[0][2]][1];
192 b[11] = T1[tmpU.temp[1][3]][1];
193 b[12] = T1[tmpU.temp[3][0]][1];
194 b[13] = T1[tmpU.temp[0][1]][1];
195 b[14] = T1[tmpU.temp[1][2]][1];
196 b[15] = T1[tmpU.temp[2][3]][1];
[1]197 *((word32*)(b )) ^= *((word32*)rk[ROUNDS][0]);
198 *((word32*)(b+ 4)) ^= *((word32*)rk[ROUNDS][1]);
199 *((word32*)(b+ 8)) ^= *((word32*)rk[ROUNDS][2]);
200 *((word32*)(b+12)) ^= *((word32*)rk[ROUNDS][3]);
201
202 return 0;
203}
204
205/**
206 * Decrypt a single block.
207 */
208int rijndaelDecrypt(word8 a[16], word8 b[16], word8 rk[MAXROUNDS+1][4][4], int ROUNDS) {
209 int r;
[230]210 union {
211 word32 tem4[4];
212 word8 temp[4][4];
213 } tmpU;
214 tmpU.tem4[0] = tmpU.tem4[1] = tmpU.tem4[2] = tmpU.tem4[3] = 0;
[1]215
[230]216 tmpU.tem4[0] = *((word32*)(a )) ^ *((word32*)rk[ROUNDS][0]);
217 tmpU.tem4[1] = *((word32*)(a+ 4)) ^ *((word32*)rk[ROUNDS][1]);
218 tmpU.tem4[2] = *((word32*)(a+ 8)) ^ *((word32*)rk[ROUNDS][2]);
219 tmpU.tem4[3] = *((word32*)(a+12)) ^ *((word32*)rk[ROUNDS][3]);
[1]220
[230]221 *((word32*)(b )) = *((word32*)T5[tmpU.temp[0][0]])
222 ^ *((word32*)T6[tmpU.temp[3][1]])
223 ^ *((word32*)T7[tmpU.temp[2][2]])
224 ^ *((word32*)T8[tmpU.temp[1][3]]);
225 *((word32*)(b+ 4)) = *((word32*)T5[tmpU.temp[1][0]])
226 ^ *((word32*)T6[tmpU.temp[0][1]])
227 ^ *((word32*)T7[tmpU.temp[3][2]])
228 ^ *((word32*)T8[tmpU.temp[2][3]]);
229 *((word32*)(b+ 8)) = *((word32*)T5[tmpU.temp[2][0]])
230 ^ *((word32*)T6[tmpU.temp[1][1]])
231 ^ *((word32*)T7[tmpU.temp[0][2]])
232 ^ *((word32*)T8[tmpU.temp[3][3]]);
233 *((word32*)(b+12)) = *((word32*)T5[tmpU.temp[3][0]])
234 ^ *((word32*)T6[tmpU.temp[2][1]])
235 ^ *((word32*)T7[tmpU.temp[1][2]])
236 ^ *((word32*)T8[tmpU.temp[0][3]]);
[1]237 for (r = ROUNDS-1; r > 1; r--) {
[230]238 tmpU.tem4[0] = *((word32*)(b )) ^ *((word32*)rk[r][0]);
239 tmpU.tem4[1] = *((word32*)(b+ 4)) ^ *((word32*)rk[r][1]);
240 tmpU.tem4[2] = *((word32*)(b+ 8)) ^ *((word32*)rk[r][2]);
241 tmpU.tem4[3] = *((word32*)(b+12)) ^ *((word32*)rk[r][3]);
242 *((word32*)(b )) = *((word32*)T5[tmpU.temp[0][0]])
243 ^ *((word32*)T6[tmpU.temp[3][1]])
244 ^ *((word32*)T7[tmpU.temp[2][2]])
245 ^ *((word32*)T8[tmpU.temp[1][3]]);
246 *((word32*)(b+ 4)) = *((word32*)T5[tmpU.temp[1][0]])
247 ^ *((word32*)T6[tmpU.temp[0][1]])
248 ^ *((word32*)T7[tmpU.temp[3][2]])
249 ^ *((word32*)T8[tmpU.temp[2][3]]);
250 *((word32*)(b+ 8)) = *((word32*)T5[tmpU.temp[2][0]])
251 ^ *((word32*)T6[tmpU.temp[1][1]])
252 ^ *((word32*)T7[tmpU.temp[0][2]])
253 ^ *((word32*)T8[tmpU.temp[3][3]]);
254 *((word32*)(b+12)) = *((word32*)T5[tmpU.temp[3][0]])
255 ^ *((word32*)T6[tmpU.temp[2][1]])
256 ^ *((word32*)T7[tmpU.temp[1][2]])
257 ^ *((word32*)T8[tmpU.temp[0][3]]);
[1]258 }
259 /* last round is special */
[230]260 tmpU.tem4[0] = *((word32*)(b )) ^ *((word32*)rk[1][0]);
261 tmpU.tem4[1] = *((word32*)(b+ 4)) ^ *((word32*)rk[1][1]);
262 tmpU.tem4[2] = *((word32*)(b+ 8)) ^ *((word32*)rk[1][2]);
263 tmpU.tem4[3] = *((word32*)(b+12)) ^ *((word32*)rk[1][3]);
264 b[ 0] = S5[tmpU.temp[0][0]];
265 b[ 1] = S5[tmpU.temp[3][1]];
266 b[ 2] = S5[tmpU.temp[2][2]];
267 b[ 3] = S5[tmpU.temp[1][3]];
268 b[ 4] = S5[tmpU.temp[1][0]];
269 b[ 5] = S5[tmpU.temp[0][1]];
270 b[ 6] = S5[tmpU.temp[3][2]];
271 b[ 7] = S5[tmpU.temp[2][3]];
272 b[ 8] = S5[tmpU.temp[2][0]];
273 b[ 9] = S5[tmpU.temp[1][1]];
274 b[10] = S5[tmpU.temp[0][2]];
275 b[11] = S5[tmpU.temp[3][3]];
276 b[12] = S5[tmpU.temp[3][0]];
277 b[13] = S5[tmpU.temp[2][1]];
278 b[14] = S5[tmpU.temp[1][2]];
279 b[15] = S5[tmpU.temp[0][3]];
[1]280 *((word32*)(b )) ^= *((word32*)rk[0][0]);
281 *((word32*)(b+ 4)) ^= *((word32*)rk[0][1]);
282 *((word32*)(b+ 8)) ^= *((word32*)rk[0][2]);
283 *((word32*)(b+12)) ^= *((word32*)rk[0][3]);
284
285 return 0;
286}
287
[230]288#ifdef INTERMEDIATE_VALUE_KAT
289/**
290 * Encrypt only a certain number of rounds.
291 * Only used in the Intermediate Value Known Answer Test.
292 */
293int rijndaelEncryptRound(word8 a[4][4], word8 rk[MAXROUNDS+1][4][4], int ROUNDS, int rounds) {
294 int r;
295 word8 temp[4][4];
296
297 /* make number of rounds sane */
298 if (rounds > ROUNDS) {
299 rounds = ROUNDS;
300 }
301
302 *((word32*)a[0]) = *((word32*)a[0]) ^ *((word32*)rk[0][0]);
303 *((word32*)a[1]) = *((word32*)a[1]) ^ *((word32*)rk[0][1]);
304 *((word32*)a[2]) = *((word32*)a[2]) ^ *((word32*)rk[0][2]);
305 *((word32*)a[3]) = *((word32*)a[3]) ^ *((word32*)rk[0][3]);
306
307 for (r = 1; (r <= rounds) && (r < ROUNDS); r++) {
308 *((word32*)temp[0]) = *((word32*)T1[a[0][0]])
309 ^ *((word32*)T2[a[1][1]])
310 ^ *((word32*)T3[a[2][2]])
311 ^ *((word32*)T4[a[3][3]]);
312 *((word32*)temp[1]) = *((word32*)T1[a[1][0]])
313 ^ *((word32*)T2[a[2][1]])
314 ^ *((word32*)T3[a[3][2]])
315 ^ *((word32*)T4[a[0][3]]);
316 *((word32*)temp[2]) = *((word32*)T1[a[2][0]])
317 ^ *((word32*)T2[a[3][1]])
318 ^ *((word32*)T3[a[0][2]])
319 ^ *((word32*)T4[a[1][3]]);
320 *((word32*)temp[3]) = *((word32*)T1[a[3][0]])
321 ^ *((word32*)T2[a[0][1]])
322 ^ *((word32*)T3[a[1][2]])
323 ^ *((word32*)T4[a[2][3]]);
324 *((word32*)a[0]) = *((word32*)temp[0]) ^ *((word32*)rk[r][0]);
325 *((word32*)a[1]) = *((word32*)temp[1]) ^ *((word32*)rk[r][1]);
326 *((word32*)a[2]) = *((word32*)temp[2]) ^ *((word32*)rk[r][2]);
327 *((word32*)a[3]) = *((word32*)temp[3]) ^ *((word32*)rk[r][3]);
328 }
329 if (rounds == ROUNDS) {
330 /* last round is special */
331 temp[0][0] = T1[a[0][0]][1];
332 temp[0][1] = T1[a[1][1]][1];
333 temp[0][2] = T1[a[2][2]][1];
334 temp[0][3] = T1[a[3][3]][1];
335 temp[1][0] = T1[a[1][0]][1];
336 temp[1][1] = T1[a[2][1]][1];
337 temp[1][2] = T1[a[3][2]][1];
338 temp[1][3] = T1[a[0][3]][1];
339 temp[2][0] = T1[a[2][0]][1];
340 temp[2][1] = T1[a[3][1]][1];
341 temp[2][2] = T1[a[0][2]][1];
342 temp[2][3] = T1[a[1][3]][1];
343 temp[3][0] = T1[a[3][0]][1];
344 temp[3][1] = T1[a[0][1]][1];
345 temp[3][2] = T1[a[1][2]][1];
346 temp[3][3] = T1[a[2][3]][1];
347 *((word32*)a[0]) = *((word32*)temp[0]) ^ *((word32*)rk[ROUNDS][0]);
348 *((word32*)a[1]) = *((word32*)temp[1]) ^ *((word32*)rk[ROUNDS][1]);
349 *((word32*)a[2]) = *((word32*)temp[2]) ^ *((word32*)rk[ROUNDS][2]);
350 *((word32*)a[3]) = *((word32*)temp[3]) ^ *((word32*)rk[ROUNDS][3]);
351 }
352
353 return 0;
354}
355#endif /* INTERMEDIATE_VALUE_KAT */
356
357#ifdef INTERMEDIATE_VALUE_KAT
358/**
359 * Decrypt only a certain number of rounds.
360 * Only used in the Intermediate Value Known Answer Test.
361 * Operations rearranged such that the intermediate values
362 * of decryption correspond with the intermediate values
363 * of encryption.
364 */
365int rijndaelDecryptRound(word8 a[4][4], word8 rk[MAXROUNDS+1][4][4], int ROUNDS, int rounds) {
366 int r, i;
367 word8 temp[4], shift;
368
369 /* make number of rounds sane */
370 if (rounds > ROUNDS) {
371 rounds = ROUNDS;
372 }
373 /* first round is special: */
374 *(word32 *)a[0] ^= *(word32 *)rk[ROUNDS][0];
375 *(word32 *)a[1] ^= *(word32 *)rk[ROUNDS][1];
376 *(word32 *)a[2] ^= *(word32 *)rk[ROUNDS][2];
377 *(word32 *)a[3] ^= *(word32 *)rk[ROUNDS][3];
378 for (i = 0; i < 4; i++) {
379 a[i][0] = Si[a[i][0]];
380 a[i][1] = Si[a[i][1]];
381 a[i][2] = Si[a[i][2]];
382 a[i][3] = Si[a[i][3]];
383 }
384 for (i = 1; i < 4; i++) {
385 shift = (4 - i) & 3;
386 temp[0] = a[(0 + shift) & 3][i];
387 temp[1] = a[(1 + shift) & 3][i];
388 temp[2] = a[(2 + shift) & 3][i];
389 temp[3] = a[(3 + shift) & 3][i];
390 a[0][i] = temp[0];
391 a[1][i] = temp[1];
392 a[2][i] = temp[2];
393 a[3][i] = temp[3];
394 }
395 /* ROUNDS-1 ordinary rounds */
396 for (r = ROUNDS-1; r > rounds; r--) {
397 *(word32 *)a[0] ^= *(word32 *)rk[r][0];
398 *(word32 *)a[1] ^= *(word32 *)rk[r][1];
399 *(word32 *)a[2] ^= *(word32 *)rk[r][2];
400 *(word32 *)a[3] ^= *(word32 *)rk[r][3];
401
402 *((word32*)a[0]) =
403 *((word32*)U1[a[0][0]])
404 ^ *((word32*)U2[a[0][1]])
405 ^ *((word32*)U3[a[0][2]])
406 ^ *((word32*)U4[a[0][3]]);
407
408 *((word32*)a[1]) =
409 *((word32*)U1[a[1][0]])
410 ^ *((word32*)U2[a[1][1]])
411 ^ *((word32*)U3[a[1][2]])
412 ^ *((word32*)U4[a[1][3]]);
413
414 *((word32*)a[2]) =
415 *((word32*)U1[a[2][0]])
416 ^ *((word32*)U2[a[2][1]])
417 ^ *((word32*)U3[a[2][2]])
418 ^ *((word32*)U4[a[2][3]]);
419
420 *((word32*)a[3]) =
421 *((word32*)U1[a[3][0]])
422 ^ *((word32*)U2[a[3][1]])
423 ^ *((word32*)U3[a[3][2]])
424 ^ *((word32*)U4[a[3][3]]);
425 for (i = 0; i < 4; i++) {
426 a[i][0] = Si[a[i][0]];
427 a[i][1] = Si[a[i][1]];
428 a[i][2] = Si[a[i][2]];
429 a[i][3] = Si[a[i][3]];
430 }
431 for (i = 1; i < 4; i++) {
432 shift = (4 - i) & 3;
433 temp[0] = a[(0 + shift) & 3][i];
434 temp[1] = a[(1 + shift) & 3][i];
435 temp[2] = a[(2 + shift) & 3][i];
436 temp[3] = a[(3 + shift) & 3][i];
437 a[0][i] = temp[0];
438 a[1][i] = temp[1];
439 a[2][i] = temp[2];
440 a[3][i] = temp[3];
441 }
442 }
443 if (rounds == 0) {
444 /* End with the extra key addition */
445 *(word32 *)a[0] ^= *(word32 *)rk[0][0];
446 *(word32 *)a[1] ^= *(word32 *)rk[0][1];
447 *(word32 *)a[2] ^= *(word32 *)rk[0][2];
448 *(word32 *)a[3] ^= *(word32 *)rk[0][3];
449 }
450 return 0;
451}
452#endif /* INTERMEDIATE_VALUE_KAT */
[1]453#endif
Note: See TracBrowser for help on using the repository browser.