source: trunk/src/rijndael-alg-fst.c@ 468

Last change on this file since 468 was 440, checked in by katerina, 11 years ago

Fix for ticket #344 (Problems with Ubuntu 13.04)
File size: 14.3 KB
Line 
1/*
2 * rijndael-alg-fst.c v2.3 April '2000
3 *
4 * Optimised ANSI C code
5 *
6 * authors: v1.0: Antoon Bosselaers
7 * v2.0: Vincent Rijmen
8 * v2.3: Paulo Barreto
9 *
10 * This code is placed in the public domain.
11 */
12
13#include "config_xor.h"
14
15#include <stdio.h>
16#include <stdlib.h>
17#include <string.h>
18
19#ifdef SH_ENCRYPT
20
21#include "rijndael-alg-fst.h"
22
23#include "rijndael-boxes-fst.h"
24
25#if defined(GCC_VERSION_MAJOR)
26#if (GCC_VERSION_MAJOR > 4) || ((GCC_VERSION_MAJOR == 4) && (GCC_VERSION_MINOR > 4))
27#pragma GCC diagnostic ignored "-Wstrict-aliasing"
28#endif
29#endif
30
31int rijndaelKeySched(word8 k[MAXKC][4], word8 W[MAXROUNDS+1][4][4], int ROUNDS) {
32 /* Calculate the necessary round keys
33 * The number of calculations depends on keyBits and blockBits
34 */
35 int j, r, t, rconpointer = 0;
36 word8 tk[MAXKC][4] = { { 0 } }; /* init for llvm/clang analyzer */
37 int KC = ROUNDS - 6;
38 word32 tmp;
39
40 for (j = KC-1; j >= 0; j--) {
41 memmove( &(tk[j]), &(k[j]), sizeof(word32));
42 }
43 r = 0;
44 t = 0;
45
46 /* copy values into round key array */
47 for (j = 0; (j < KC) && (r < ROUNDS + 1); ) {
48 for (; (j < KC) && (t < 4); j++, t++) {
49 memmove( &(W[r][t]), &(tk[j]), sizeof(word32));
50 }
51 if (t == 4) {
52 r++;
53 t = 0;
54 }
55 }
56
57 while (r < ROUNDS + 1) { /* while not enough round key material calculated */
58 /* calculate new values */
59 tk[0][0] ^= S[tk[KC-1][1]];
60 tk[0][1] ^= S[tk[KC-1][2]];
61 tk[0][2] ^= S[tk[KC-1][3]];
62 tk[0][3] ^= S[tk[KC-1][0]];
63 tk[0][0] ^= rcon[rconpointer++];
64
65 if (KC != 8) {
66 for (j = 1; j < KC; j++) {
67 tmp = *((word32*)tk[j-1]);
68 *((word32*)tk[j]) ^= tmp;
69 }
70 } else {
71 for (j = 1; j < KC/2; j++) {
72 tmp = *((word32*)tk[j-1]);
73 *((word32*)tk[j]) ^= tmp;
74 }
75 tk[KC/2][0] ^= S[tk[KC/2 - 1][0]];
76 tk[KC/2][1] ^= S[tk[KC/2 - 1][1]];
77 tk[KC/2][2] ^= S[tk[KC/2 - 1][2]];
78 tk[KC/2][3] ^= S[tk[KC/2 - 1][3]];
79 for (j = KC/2 + 1; j < KC; j++) {
80 tmp = *((word32*)tk[j-1]);
81 *((word32*)tk[j]) ^= tmp;
82 }
83 }
84 /* copy values into round key array */
85 for (j = 0; (j < KC) && (r < ROUNDS + 1); ) {
86 for (; (j < KC) && (t < 4); j++, t++) {
87 memmove( &(W[r][t]), &(tk[j]), sizeof(word32));
88 }
89 if (t == 4) {
90 r++;
91 t = 0;
92 }
93 }
94 }
95 return 0;
96}
97
98int rijndaelKeyEncToDec(word8 W[MAXROUNDS+1][4][4], int ROUNDS) {
99 int r;
100 word8 *w;
101
102 for (r = 1; r < ROUNDS; r++) {
103 w = W[r][0];
104 *((word32*)w) =
105 *((word32*)U1[w[0]])
106 ^ *((word32*)U2[w[1]])
107 ^ *((word32*)U3[w[2]])
108 ^ *((word32*)U4[w[3]]);
109
110 w = W[r][1];
111 *((word32*)w) =
112 *((word32*)U1[w[0]])
113 ^ *((word32*)U2[w[1]])
114 ^ *((word32*)U3[w[2]])
115 ^ *((word32*)U4[w[3]]);
116
117 w = W[r][2];
118 *((word32*)w) =
119 *((word32*)U1[w[0]])
120 ^ *((word32*)U2[w[1]])
121 ^ *((word32*)U3[w[2]])
122 ^ *((word32*)U4[w[3]]);
123
124 w = W[r][3];
125 *((word32*)w) =
126 *((word32*)U1[w[0]])
127 ^ *((word32*)U2[w[1]])
128 ^ *((word32*)U3[w[2]])
129 ^ *((word32*)U4[w[3]]);
130 }
131 return 0;
132}
133
134/**
135 * Encrypt a single block.
136 */
137int rijndaelEncrypt(word8 a[16], word8 b[16], word8 rk[MAXROUNDS+1][4][4], int ROUNDS) {
138 int r;
139 union {
140 word32 tem4[4];
141 word8 temp[4][4];
142 } tmpU;
143 tmpU.tem4[0] = tmpU.tem4[1] = tmpU.tem4[2] = tmpU.tem4[3] = 0;
144
145 tmpU.tem4[0] = *((word32*)(a )) ^ *((word32*)rk[0][0]);
146 tmpU.tem4[1] = *((word32*)(a+ 4)) ^ *((word32*)rk[0][1]);
147 tmpU.tem4[2] = *((word32*)(a+ 8)) ^ *((word32*)rk[0][2]);
148 tmpU.tem4[3] = *((word32*)(a+12)) ^ *((word32*)rk[0][3]);
149 *((word32*)(b )) = *((word32*)T1[tmpU.temp[0][0]])
150 ^ *((word32*)T2[tmpU.temp[1][1]])
151 ^ *((word32*)T3[tmpU.temp[2][2]])
152 ^ *((word32*)T4[tmpU.temp[3][3]]);
153 *((word32*)(b + 4)) = *((word32*)T1[tmpU.temp[1][0]])
154 ^ *((word32*)T2[tmpU.temp[2][1]])
155 ^ *((word32*)T3[tmpU.temp[3][2]])
156 ^ *((word32*)T4[tmpU.temp[0][3]]);
157 *((word32*)(b + 8)) = *((word32*)T1[tmpU.temp[2][0]])
158 ^ *((word32*)T2[tmpU.temp[3][1]])
159 ^ *((word32*)T3[tmpU.temp[0][2]])
160 ^ *((word32*)T4[tmpU.temp[1][3]]);
161 *((word32*)(b +12)) = *((word32*)T1[tmpU.temp[3][0]])
162 ^ *((word32*)T2[tmpU.temp[0][1]])
163 ^ *((word32*)T3[tmpU.temp[1][2]])
164 ^ *((word32*)T4[tmpU.temp[2][3]]);
165 for (r = 1; r < ROUNDS-1; r++) {
166 tmpU.tem4[0] = *((word32*)(b )) ^ *((word32*)rk[r][0]);
167 tmpU.tem4[1] = *((word32*)(b+ 4)) ^ *((word32*)rk[r][1]);
168 tmpU.tem4[2] = *((word32*)(b+ 8)) ^ *((word32*)rk[r][2]);
169 tmpU.tem4[3] = *((word32*)(b+12)) ^ *((word32*)rk[r][3]);
170
171 *((word32*)(b )) = *((word32*)T1[tmpU.temp[0][0]])
172 ^ *((word32*)T2[tmpU.temp[1][1]])
173 ^ *((word32*)T3[tmpU.temp[2][2]])
174 ^ *((word32*)T4[tmpU.temp[3][3]]);
175 *((word32*)(b + 4)) = *((word32*)T1[tmpU.temp[1][0]])
176 ^ *((word32*)T2[tmpU.temp[2][1]])
177 ^ *((word32*)T3[tmpU.temp[3][2]])
178 ^ *((word32*)T4[tmpU.temp[0][3]]);
179 *((word32*)(b + 8)) = *((word32*)T1[tmpU.temp[2][0]])
180 ^ *((word32*)T2[tmpU.temp[3][1]])
181 ^ *((word32*)T3[tmpU.temp[0][2]])
182 ^ *((word32*)T4[tmpU.temp[1][3]]);
183 *((word32*)(b +12)) = *((word32*)T1[tmpU.temp[3][0]])
184 ^ *((word32*)T2[tmpU.temp[0][1]])
185 ^ *((word32*)T3[tmpU.temp[1][2]])
186 ^ *((word32*)T4[tmpU.temp[2][3]]);
187 }
188 /* last round is special */
189 tmpU.tem4[0] = *((word32*)(b )) ^ *((word32*)rk[ROUNDS-1][0]);
190 tmpU.tem4[1] = *((word32*)(b+ 4)) ^ *((word32*)rk[ROUNDS-1][1]);
191 tmpU.tem4[2] = *((word32*)(b+ 8)) ^ *((word32*)rk[ROUNDS-1][2]);
192 tmpU.tem4[3] = *((word32*)(b+12)) ^ *((word32*)rk[ROUNDS-1][3]);
193 b[ 0] = T1[tmpU.temp[0][0]][1];
194 b[ 1] = T1[tmpU.temp[1][1]][1];
195 b[ 2] = T1[tmpU.temp[2][2]][1];
196 b[ 3] = T1[tmpU.temp[3][3]][1];
197 b[ 4] = T1[tmpU.temp[1][0]][1];
198 b[ 5] = T1[tmpU.temp[2][1]][1];
199 b[ 6] = T1[tmpU.temp[3][2]][1];
200 b[ 7] = T1[tmpU.temp[0][3]][1];
201 b[ 8] = T1[tmpU.temp[2][0]][1];
202 b[ 9] = T1[tmpU.temp[3][1]][1];
203 b[10] = T1[tmpU.temp[0][2]][1];
204 b[11] = T1[tmpU.temp[1][3]][1];
205 b[12] = T1[tmpU.temp[3][0]][1];
206 b[13] = T1[tmpU.temp[0][1]][1];
207 b[14] = T1[tmpU.temp[1][2]][1];
208 b[15] = T1[tmpU.temp[2][3]][1];
209 *((word32*)(b )) ^= *((word32*)rk[ROUNDS][0]);
210 *((word32*)(b+ 4)) ^= *((word32*)rk[ROUNDS][1]);
211 *((word32*)(b+ 8)) ^= *((word32*)rk[ROUNDS][2]);
212 *((word32*)(b+12)) ^= *((word32*)rk[ROUNDS][3]);
213
214 return 0;
215}
216
217/**
218 * Decrypt a single block.
219 */
220int rijndaelDecrypt(word8 a[16], word8 b[16], word8 rk[MAXROUNDS+1][4][4], int ROUNDS) {
221 int r;
222 union {
223 word32 tem4[4];
224 word8 temp[4][4];
225 } tmpU;
226 tmpU.tem4[0] = tmpU.tem4[1] = tmpU.tem4[2] = tmpU.tem4[3] = 0;
227
228 tmpU.tem4[0] = *((word32*)(a )) ^ *((word32*)rk[ROUNDS][0]);
229 tmpU.tem4[1] = *((word32*)(a+ 4)) ^ *((word32*)rk[ROUNDS][1]);
230 tmpU.tem4[2] = *((word32*)(a+ 8)) ^ *((word32*)rk[ROUNDS][2]);
231 tmpU.tem4[3] = *((word32*)(a+12)) ^ *((word32*)rk[ROUNDS][3]);
232
233 *((word32*)(b )) = *((word32*)T5[tmpU.temp[0][0]])
234 ^ *((word32*)T6[tmpU.temp[3][1]])
235 ^ *((word32*)T7[tmpU.temp[2][2]])
236 ^ *((word32*)T8[tmpU.temp[1][3]]);
237 *((word32*)(b+ 4)) = *((word32*)T5[tmpU.temp[1][0]])
238 ^ *((word32*)T6[tmpU.temp[0][1]])
239 ^ *((word32*)T7[tmpU.temp[3][2]])
240 ^ *((word32*)T8[tmpU.temp[2][3]]);
241 *((word32*)(b+ 8)) = *((word32*)T5[tmpU.temp[2][0]])
242 ^ *((word32*)T6[tmpU.temp[1][1]])
243 ^ *((word32*)T7[tmpU.temp[0][2]])
244 ^ *((word32*)T8[tmpU.temp[3][3]]);
245 *((word32*)(b+12)) = *((word32*)T5[tmpU.temp[3][0]])
246 ^ *((word32*)T6[tmpU.temp[2][1]])
247 ^ *((word32*)T7[tmpU.temp[1][2]])
248 ^ *((word32*)T8[tmpU.temp[0][3]]);
249 for (r = ROUNDS-1; r > 1; r--) {
250 tmpU.tem4[0] = *((word32*)(b )) ^ *((word32*)rk[r][0]);
251 tmpU.tem4[1] = *((word32*)(b+ 4)) ^ *((word32*)rk[r][1]);
252 tmpU.tem4[2] = *((word32*)(b+ 8)) ^ *((word32*)rk[r][2]);
253 tmpU.tem4[3] = *((word32*)(b+12)) ^ *((word32*)rk[r][3]);
254 *((word32*)(b )) = *((word32*)T5[tmpU.temp[0][0]])
255 ^ *((word32*)T6[tmpU.temp[3][1]])
256 ^ *((word32*)T7[tmpU.temp[2][2]])
257 ^ *((word32*)T8[tmpU.temp[1][3]]);
258 *((word32*)(b+ 4)) = *((word32*)T5[tmpU.temp[1][0]])
259 ^ *((word32*)T6[tmpU.temp[0][1]])
260 ^ *((word32*)T7[tmpU.temp[3][2]])
261 ^ *((word32*)T8[tmpU.temp[2][3]]);
262 *((word32*)(b+ 8)) = *((word32*)T5[tmpU.temp[2][0]])
263 ^ *((word32*)T6[tmpU.temp[1][1]])
264 ^ *((word32*)T7[tmpU.temp[0][2]])
265 ^ *((word32*)T8[tmpU.temp[3][3]]);
266 *((word32*)(b+12)) = *((word32*)T5[tmpU.temp[3][0]])
267 ^ *((word32*)T6[tmpU.temp[2][1]])
268 ^ *((word32*)T7[tmpU.temp[1][2]])
269 ^ *((word32*)T8[tmpU.temp[0][3]]);
270 }
271 /* last round is special */
272 tmpU.tem4[0] = *((word32*)(b )) ^ *((word32*)rk[1][0]);
273 tmpU.tem4[1] = *((word32*)(b+ 4)) ^ *((word32*)rk[1][1]);
274 tmpU.tem4[2] = *((word32*)(b+ 8)) ^ *((word32*)rk[1][2]);
275 tmpU.tem4[3] = *((word32*)(b+12)) ^ *((word32*)rk[1][3]);
276 b[ 0] = S5[tmpU.temp[0][0]];
277 b[ 1] = S5[tmpU.temp[3][1]];
278 b[ 2] = S5[tmpU.temp[2][2]];
279 b[ 3] = S5[tmpU.temp[1][3]];
280 b[ 4] = S5[tmpU.temp[1][0]];
281 b[ 5] = S5[tmpU.temp[0][1]];
282 b[ 6] = S5[tmpU.temp[3][2]];
283 b[ 7] = S5[tmpU.temp[2][3]];
284 b[ 8] = S5[tmpU.temp[2][0]];
285 b[ 9] = S5[tmpU.temp[1][1]];
286 b[10] = S5[tmpU.temp[0][2]];
287 b[11] = S5[tmpU.temp[3][3]];
288 b[12] = S5[tmpU.temp[3][0]];
289 b[13] = S5[tmpU.temp[2][1]];
290 b[14] = S5[tmpU.temp[1][2]];
291 b[15] = S5[tmpU.temp[0][3]];
292 *((word32*)(b )) ^= *((word32*)rk[0][0]);
293 *((word32*)(b+ 4)) ^= *((word32*)rk[0][1]);
294 *((word32*)(b+ 8)) ^= *((word32*)rk[0][2]);
295 *((word32*)(b+12)) ^= *((word32*)rk[0][3]);
296
297 return 0;
298}
299
300#ifdef INTERMEDIATE_VALUE_KAT
301/**
302 * Encrypt only a certain number of rounds.
303 * Only used in the Intermediate Value Known Answer Test.
304 */
305int rijndaelEncryptRound(word8 a[4][4], word8 rk[MAXROUNDS+1][4][4], int ROUNDS, int rounds) {
306 int r;
307 word8 temp[4][4];
308
309 /* make number of rounds sane */
310 if (rounds > ROUNDS) {
311 rounds = ROUNDS;
312 }
313
314 *((word32*)a[0]) = *((word32*)a[0]) ^ *((word32*)rk[0][0]);
315 *((word32*)a[1]) = *((word32*)a[1]) ^ *((word32*)rk[0][1]);
316 *((word32*)a[2]) = *((word32*)a[2]) ^ *((word32*)rk[0][2]);
317 *((word32*)a[3]) = *((word32*)a[3]) ^ *((word32*)rk[0][3]);
318
319 for (r = 1; (r <= rounds) && (r < ROUNDS); r++) {
320 *((word32*)temp[0]) = *((word32*)T1[a[0][0]])
321 ^ *((word32*)T2[a[1][1]])
322 ^ *((word32*)T3[a[2][2]])
323 ^ *((word32*)T4[a[3][3]]);
324 *((word32*)temp[1]) = *((word32*)T1[a[1][0]])
325 ^ *((word32*)T2[a[2][1]])
326 ^ *((word32*)T3[a[3][2]])
327 ^ *((word32*)T4[a[0][3]]);
328 *((word32*)temp[2]) = *((word32*)T1[a[2][0]])
329 ^ *((word32*)T2[a[3][1]])
330 ^ *((word32*)T3[a[0][2]])
331 ^ *((word32*)T4[a[1][3]]);
332 *((word32*)temp[3]) = *((word32*)T1[a[3][0]])
333 ^ *((word32*)T2[a[0][1]])
334 ^ *((word32*)T3[a[1][2]])
335 ^ *((word32*)T4[a[2][3]]);
336 *((word32*)a[0]) = *((word32*)temp[0]) ^ *((word32*)rk[r][0]);
337 *((word32*)a[1]) = *((word32*)temp[1]) ^ *((word32*)rk[r][1]);
338 *((word32*)a[2]) = *((word32*)temp[2]) ^ *((word32*)rk[r][2]);
339 *((word32*)a[3]) = *((word32*)temp[3]) ^ *((word32*)rk[r][3]);
340 }
341 if (rounds == ROUNDS) {
342 /* last round is special */
343 temp[0][0] = T1[a[0][0]][1];
344 temp[0][1] = T1[a[1][1]][1];
345 temp[0][2] = T1[a[2][2]][1];
346 temp[0][3] = T1[a[3][3]][1];
347 temp[1][0] = T1[a[1][0]][1];
348 temp[1][1] = T1[a[2][1]][1];
349 temp[1][2] = T1[a[3][2]][1];
350 temp[1][3] = T1[a[0][3]][1];
351 temp[2][0] = T1[a[2][0]][1];
352 temp[2][1] = T1[a[3][1]][1];
353 temp[2][2] = T1[a[0][2]][1];
354 temp[2][3] = T1[a[1][3]][1];
355 temp[3][0] = T1[a[3][0]][1];
356 temp[3][1] = T1[a[0][1]][1];
357 temp[3][2] = T1[a[1][2]][1];
358 temp[3][3] = T1[a[2][3]][1];
359 *((word32*)a[0]) = *((word32*)temp[0]) ^ *((word32*)rk[ROUNDS][0]);
360 *((word32*)a[1]) = *((word32*)temp[1]) ^ *((word32*)rk[ROUNDS][1]);
361 *((word32*)a[2]) = *((word32*)temp[2]) ^ *((word32*)rk[ROUNDS][2]);
362 *((word32*)a[3]) = *((word32*)temp[3]) ^ *((word32*)rk[ROUNDS][3]);
363 }
364
365 return 0;
366}
367#endif /* INTERMEDIATE_VALUE_KAT */
368
369#ifdef INTERMEDIATE_VALUE_KAT
370/**
371 * Decrypt only a certain number of rounds.
372 * Only used in the Intermediate Value Known Answer Test.
373 * Operations rearranged such that the intermediate values
374 * of decryption correspond with the intermediate values
375 * of encryption.
376 */
377int rijndaelDecryptRound(word8 a[4][4], word8 rk[MAXROUNDS+1][4][4], int ROUNDS, int rounds) {
378 int r, i;
379 word8 temp[4], shift;
380
381 /* make number of rounds sane */
382 if (rounds > ROUNDS) {
383 rounds = ROUNDS;
384 }
385 /* first round is special: */
386 *(word32 *)a[0] ^= *(word32 *)rk[ROUNDS][0];
387 *(word32 *)a[1] ^= *(word32 *)rk[ROUNDS][1];
388 *(word32 *)a[2] ^= *(word32 *)rk[ROUNDS][2];
389 *(word32 *)a[3] ^= *(word32 *)rk[ROUNDS][3];
390 for (i = 0; i < 4; i++) {
391 a[i][0] = Si[a[i][0]];
392 a[i][1] = Si[a[i][1]];
393 a[i][2] = Si[a[i][2]];
394 a[i][3] = Si[a[i][3]];
395 }
396 for (i = 1; i < 4; i++) {
397 shift = (4 - i) & 3;
398 temp[0] = a[(0 + shift) & 3][i];
399 temp[1] = a[(1 + shift) & 3][i];
400 temp[2] = a[(2 + shift) & 3][i];
401 temp[3] = a[(3 + shift) & 3][i];
402 a[0][i] = temp[0];
403 a[1][i] = temp[1];
404 a[2][i] = temp[2];
405 a[3][i] = temp[3];
406 }
407 /* ROUNDS-1 ordinary rounds */
408 for (r = ROUNDS-1; r > rounds; r--) {
409 *(word32 *)a[0] ^= *(word32 *)rk[r][0];
410 *(word32 *)a[1] ^= *(word32 *)rk[r][1];
411 *(word32 *)a[2] ^= *(word32 *)rk[r][2];
412 *(word32 *)a[3] ^= *(word32 *)rk[r][3];
413
414 *((word32*)a[0]) =
415 *((word32*)U1[a[0][0]])
416 ^ *((word32*)U2[a[0][1]])
417 ^ *((word32*)U3[a[0][2]])
418 ^ *((word32*)U4[a[0][3]]);
419
420 *((word32*)a[1]) =
421 *((word32*)U1[a[1][0]])
422 ^ *((word32*)U2[a[1][1]])
423 ^ *((word32*)U3[a[1][2]])
424 ^ *((word32*)U4[a[1][3]]);
425
426 *((word32*)a[2]) =
427 *((word32*)U1[a[2][0]])
428 ^ *((word32*)U2[a[2][1]])
429 ^ *((word32*)U3[a[2][2]])
430 ^ *((word32*)U4[a[2][3]]);
431
432 *((word32*)a[3]) =
433 *((word32*)U1[a[3][0]])
434 ^ *((word32*)U2[a[3][1]])
435 ^ *((word32*)U3[a[3][2]])
436 ^ *((word32*)U4[a[3][3]]);
437 for (i = 0; i < 4; i++) {
438 a[i][0] = Si[a[i][0]];
439 a[i][1] = Si[a[i][1]];
440 a[i][2] = Si[a[i][2]];
441 a[i][3] = Si[a[i][3]];
442 }
443 for (i = 1; i < 4; i++) {
444 shift = (4 - i) & 3;
445 temp[0] = a[(0 + shift) & 3][i];
446 temp[1] = a[(1 + shift) & 3][i];
447 temp[2] = a[(2 + shift) & 3][i];
448 temp[3] = a[(3 + shift) & 3][i];
449 a[0][i] = temp[0];
450 a[1][i] = temp[1];
451 a[2][i] = temp[2];
452 a[3][i] = temp[3];
453 }
454 }
455 if (rounds == 0) {
456 /* End with the extra key addition */
457 *(word32 *)a[0] ^= *(word32 *)rk[0][0];
458 *(word32 *)a[1] ^= *(word32 *)rk[0][1];
459 *(word32 *)a[2] ^= *(word32 *)rk[0][2];
460 *(word32 *)a[3] ^= *(word32 *)rk[0][3];
461 }
462 return 0;
463}
464#endif /* INTERMEDIATE_VALUE_KAT */
465#endif
Note: See TracBrowser for help on using the repository browser.