770 lines
24 KiB
C
770 lines
24 KiB
C
/*
|
|
* ---------------------------------------------------------------------------
|
|
* Copyright (c) 1998-2007, Brian Gladman, Worcester, UK. All rights reserved.
|
|
*
|
|
* LICENSE TERMS
|
|
*
|
|
* The free distribution and use of this software is allowed (with or without
|
|
* changes) provided that:
|
|
*
|
|
* 1. source code distributions include the above copyright notice, this
|
|
* list of conditions and the following disclaimer;
|
|
*
|
|
* 2. binary distributions include the above copyright notice, this list
|
|
* of conditions and the following disclaimer in their documentation;
|
|
*
|
|
* 3. the name of the copyright holder is not used to endorse products
|
|
* built using this software without specific written permission.
|
|
*
|
|
* DISCLAIMER
|
|
*
|
|
* This software is provided 'as is' with no explicit or implied warranties
|
|
* in respect of its properties, including, but not limited to, correctness
|
|
* and/or fitness for purpose.
|
|
* ---------------------------------------------------------------------------
|
|
* Issue Date: 20/12/2007
|
|
*
|
|
* This file contains the compilation options for AES (Rijndael) and code
|
|
* that is common across encryption, key scheduling and table generation.
|
|
*
|
|
* OPERATION
|
|
*
|
|
* These source code files implement the AES algorithm Rijndael designed by
|
|
* Joan Daemen and Vincent Rijmen. This version is designed for the standard
|
|
* block size of 16 bytes and for key sizes of 128, 192 and 256 bits (16, 24
|
|
* and 32 bytes).
|
|
*
|
|
* This version is designed for flexibility and speed using operations on
|
|
* 32-bit words rather than operations on bytes. It can be compiled with
|
|
* either big or little endian internal byte order but is faster when the
|
|
* native byte order for the processor is used.
|
|
*
|
|
* THE CIPHER INTERFACE
|
|
*
|
|
* The cipher interface is implemented as an array of bytes in which lower
|
|
* AES bit sequence indexes map to higher numeric significance within bytes.
|
|
*/
|
|
|
|
/*
|
|
* OpenSolaris changes
|
|
* 1. Added __cplusplus and _AESTAB_H header guards
|
|
* 2. Added header files sys/types.h and aes_impl.h
|
|
* 3. Added defines for AES_ENCRYPT, AES_DECRYPT, AES_REV_DKS, and ASM_AMD64_C
|
|
* 4. Moved defines for IS_BIG_ENDIAN, IS_LITTLE_ENDIAN, PLATFORM_BYTE_ORDER
|
|
* from brg_endian.h
|
|
* 5. Undefined VIA_ACE_POSSIBLE and ASSUME_VIA_ACE_PRESENT
|
|
* 6. Changed uint_8t and uint_32t to uint8_t and uint32_t
|
|
* 7. Defined aes_sw32 as htonl() for byte swapping
|
|
* 8. Cstyled and hdrchk code
|
|
*
|
|
*/
|
|
|
|
#ifndef _AESOPT_H
|
|
#define _AESOPT_H
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
#include <sys/zfs_context.h>
|
|
#include <aes/aes_impl.h>
|
|
|
|
/* SUPPORT FEATURES */
|
|
#define AES_ENCRYPT /* if support for encryption is needed */
|
|
#define AES_DECRYPT /* if support for decryption is needed */
|
|
|
|
/* PLATFORM-SPECIFIC FEATURES */
|
|
#define IS_BIG_ENDIAN 4321 /* byte 0 is most significant (mc68k) */
|
|
#define IS_LITTLE_ENDIAN 1234 /* byte 0 is least significant (i386) */
|
|
#define PLATFORM_BYTE_ORDER IS_LITTLE_ENDIAN
|
|
#define AES_REV_DKS /* define to reverse decryption key schedule */
|
|
|
|
|
|
/*
|
|
* CONFIGURATION - THE USE OF DEFINES
|
|
* Later in this section there are a number of defines that control the
|
|
* operation of the code. In each section, the purpose of each define is
|
|
* explained so that the relevant form can be included or excluded by
|
|
* setting either 1's or 0's respectively on the branches of the related
|
|
* #if clauses. The following local defines should not be changed.
|
|
*/
|
|
|
|
#define ENCRYPTION_IN_C 1
|
|
#define DECRYPTION_IN_C 2
|
|
#define ENC_KEYING_IN_C 4
|
|
#define DEC_KEYING_IN_C 8
|
|
|
|
#define NO_TABLES 0
|
|
#define ONE_TABLE 1
|
|
#define FOUR_TABLES 4
|
|
#define NONE 0
|
|
#define PARTIAL 1
|
|
#define FULL 2
|
|
|
|
/* --- START OF USER CONFIGURED OPTIONS --- */
|
|
|
|
/*
|
|
* 1. BYTE ORDER WITHIN 32 BIT WORDS
|
|
*
|
|
* The fundamental data processing units in Rijndael are 8-bit bytes. The
|
|
* input, output and key input are all enumerated arrays of bytes in which
|
|
* bytes are numbered starting at zero and increasing to one less than the
|
|
* number of bytes in the array in question. This enumeration is only used
|
|
* for naming bytes and does not imply any adjacency or order relationship
|
|
* from one byte to another. When these inputs and outputs are considered
|
|
* as bit sequences, bits 8*n to 8*n+7 of the bit sequence are mapped to
|
|
* byte[n] with bit 8n+i in the sequence mapped to bit 7-i within the byte.
|
|
* In this implementation bits are numbered from 0 to 7 starting at the
|
|
* numerically least significant end of each byte. Bit n represents 2^n.
|
|
*
|
|
* However, Rijndael can be implemented more efficiently using 32-bit
|
|
* words by packing bytes into words so that bytes 4*n to 4*n+3 are placed
|
|
* into word[n]. While in principle these bytes can be assembled into words
|
|
* in any positions, this implementation only supports the two formats in
|
|
* which bytes in adjacent positions within words also have adjacent byte
|
|
* numbers. This order is called big-endian if the lowest numbered bytes
|
|
* in words have the highest numeric significance and little-endian if the
|
|
* opposite applies.
|
|
*
|
|
* This code can work in either order irrespective of the order used by the
|
|
* machine on which it runs. Normally the internal byte order will be set
|
|
* to the order of the processor on which the code is to be run but this
|
|
* define can be used to reverse this in special situations
|
|
*
|
|
* WARNING: Assembler code versions rely on PLATFORM_BYTE_ORDER being set.
|
|
* This define will hence be redefined later (in section 4) if necessary
|
|
*/
|
|
|
|
#if 1
|
|
#define ALGORITHM_BYTE_ORDER PLATFORM_BYTE_ORDER
|
|
#elif 0
|
|
#define ALGORITHM_BYTE_ORDER IS_LITTLE_ENDIAN
|
|
#elif 0
|
|
#define ALGORITHM_BYTE_ORDER IS_BIG_ENDIAN
|
|
#else
|
|
#error The algorithm byte order is not defined
|
|
#endif
|
|
|
|
/* 2. VIA ACE SUPPORT */
|
|
|
|
#if defined(__GNUC__) && defined(__i386__) || \
|
|
defined(_WIN32) && defined(_M_IX86) && \
|
|
!(defined(_WIN64) || defined(_WIN32_WCE) || \
|
|
defined(_MSC_VER) && (_MSC_VER <= 800))
|
|
#define VIA_ACE_POSSIBLE
|
|
#endif
|
|
|
|
/*
|
|
* Define this option if support for the VIA ACE is required. This uses
|
|
* inline assembler instructions and is only implemented for the Microsoft,
|
|
* Intel and GCC compilers. If VIA ACE is known to be present, then defining
|
|
* ASSUME_VIA_ACE_PRESENT will remove the ordinary encryption/decryption
|
|
* code. If USE_VIA_ACE_IF_PRESENT is defined then VIA ACE will be used if
|
|
* it is detected (both present and enabled) but the normal AES code will
|
|
* also be present.
|
|
*
|
|
* When VIA ACE is to be used, all AES encryption contexts MUST be 16 byte
|
|
* aligned; other input/output buffers do not need to be 16 byte aligned
|
|
* but there are very large performance gains if this can be arranged.
|
|
* VIA ACE also requires the decryption key schedule to be in reverse
|
|
* order (which later checks below ensure).
|
|
*/
|
|
|
|
/* VIA ACE is not used here for OpenSolaris: */
|
|
#undef VIA_ACE_POSSIBLE
|
|
#undef ASSUME_VIA_ACE_PRESENT
|
|
|
|
#if 0 && defined(VIA_ACE_POSSIBLE) && !defined(USE_VIA_ACE_IF_PRESENT)
|
|
#define USE_VIA_ACE_IF_PRESENT
|
|
#endif
|
|
|
|
#if 0 && defined(VIA_ACE_POSSIBLE) && !defined(ASSUME_VIA_ACE_PRESENT)
|
|
#define ASSUME_VIA_ACE_PRESENT
|
|
#endif
|
|
|
|
|
|
/*
|
|
* 3. ASSEMBLER SUPPORT
|
|
*
|
|
* This define (which can be on the command line) enables the use of the
|
|
* assembler code routines for encryption, decryption and key scheduling
|
|
* as follows:
|
|
*
|
|
* ASM_X86_V1C uses the assembler (aes_x86_v1.asm) with large tables for
|
|
* encryption and decryption and but with key scheduling in C
|
|
* ASM_X86_V2 uses assembler (aes_x86_v2.asm) with compressed tables for
|
|
* encryption, decryption and key scheduling
|
|
* ASM_X86_V2C uses assembler (aes_x86_v2.asm) with compressed tables for
|
|
* encryption and decryption and but with key scheduling in C
|
|
* ASM_AMD64_C uses assembler (aes_amd64.asm) with compressed tables for
|
|
* encryption and decryption and but with key scheduling in C
|
|
*
|
|
* Change one 'if 0' below to 'if 1' to select the version or define
|
|
* as a compilation option.
|
|
*/
|
|
|
|
#if 0 && !defined(ASM_X86_V1C)
|
|
#define ASM_X86_V1C
|
|
#elif 0 && !defined(ASM_X86_V2)
|
|
#define ASM_X86_V2
|
|
#elif 0 && !defined(ASM_X86_V2C)
|
|
#define ASM_X86_V2C
|
|
#elif 1 && !defined(ASM_AMD64_C)
|
|
#define ASM_AMD64_C
|
|
#endif
|
|
|
|
#if (defined(ASM_X86_V1C) || defined(ASM_X86_V2) || defined(ASM_X86_V2C)) && \
|
|
!defined(_M_IX86) || defined(ASM_AMD64_C) && !defined(_M_X64) && \
|
|
!defined(__amd64)
|
|
#error Assembler code is only available for x86 and AMD64 systems
|
|
#endif
|
|
|
|
/*
|
|
* 4. FAST INPUT/OUTPUT OPERATIONS.
|
|
*
|
|
* On some machines it is possible to improve speed by transferring the
|
|
* bytes in the input and output arrays to and from the internal 32-bit
|
|
* variables by addressing these arrays as if they are arrays of 32-bit
|
|
* words. On some machines this will always be possible but there may
|
|
* be a large performance penalty if the byte arrays are not aligned on
|
|
* the normal word boundaries. On other machines this technique will
|
|
* lead to memory access errors when such 32-bit word accesses are not
|
|
* properly aligned. The option SAFE_IO avoids such problems but will
|
|
* often be slower on those machines that support misaligned access
|
|
* (especially so if care is taken to align the input and output byte
|
|
* arrays on 32-bit word boundaries). If SAFE_IO is not defined it is
|
|
* assumed that access to byte arrays as if they are arrays of 32-bit
|
|
* words will not cause problems when such accesses are misaligned.
|
|
*/
|
|
#if 1 && !defined(_MSC_VER)
|
|
#define SAFE_IO
|
|
#endif
|
|
|
|
/*
|
|
* 5. LOOP UNROLLING
|
|
*
|
|
* The code for encryption and decryption cycles through a number of rounds
|
|
* that can be implemented either in a loop or by expanding the code into a
|
|
* long sequence of instructions, the latter producing a larger program but
|
|
* one that will often be much faster. The latter is called loop unrolling.
|
|
* There are also potential speed advantages in expanding two iterations in
|
|
* a loop with half the number of iterations, which is called partial loop
|
|
* unrolling. The following options allow partial or full loop unrolling
|
|
* to be set independently for encryption and decryption
|
|
*/
|
|
#if 1
|
|
#define ENC_UNROLL FULL
|
|
#elif 0
|
|
#define ENC_UNROLL PARTIAL
|
|
#else
|
|
#define ENC_UNROLL NONE
|
|
#endif
|
|
|
|
#if 1
|
|
#define DEC_UNROLL FULL
|
|
#elif 0
|
|
#define DEC_UNROLL PARTIAL
|
|
#else
|
|
#define DEC_UNROLL NONE
|
|
#endif
|
|
|
|
#if 1
|
|
#define ENC_KS_UNROLL
|
|
#endif
|
|
|
|
#if 1
|
|
#define DEC_KS_UNROLL
|
|
#endif
|
|
|
|
/*
|
|
* 6. FAST FINITE FIELD OPERATIONS
|
|
*
|
|
* If this section is included, tables are used to provide faster finite
|
|
* field arithmetic. This has no effect if FIXED_TABLES is defined.
|
|
*/
|
|
#if 1
|
|
#define FF_TABLES
|
|
#endif
|
|
|
|
/*
|
|
* 7. INTERNAL STATE VARIABLE FORMAT
|
|
*
|
|
* The internal state of Rijndael is stored in a number of local 32-bit
|
|
* word variables which can be defined either as an array or as individual
|
|
* names variables. Include this section if you want to store these local
|
|
* variables in arrays. Otherwise individual local variables will be used.
|
|
*/
|
|
#if 1
|
|
#define ARRAYS
|
|
#endif
|
|
|
|
/*
|
|
* 8. FIXED OR DYNAMIC TABLES
|
|
*
|
|
* When this section is included the tables used by the code are compiled
|
|
* statically into the binary file. Otherwise the subroutine aes_init()
|
|
* must be called to compute them before the code is first used.
|
|
*/
|
|
#if 1 && !(defined(_MSC_VER) && (_MSC_VER <= 800))
|
|
#define FIXED_TABLES
|
|
#endif
|
|
|
|
/*
|
|
* 9. MASKING OR CASTING FROM LONGER VALUES TO BYTES
|
|
*
|
|
* In some systems it is better to mask longer values to extract bytes
|
|
* rather than using a cast. This option allows this choice.
|
|
*/
|
|
#if 0
|
|
#define to_byte(x) ((uint8_t)(x))
|
|
#else
|
|
#define to_byte(x) ((x) & 0xff)
|
|
#endif
|
|
|
|
/*
|
|
* 10. TABLE ALIGNMENT
|
|
*
|
|
* On some systems speed will be improved by aligning the AES large lookup
|
|
* tables on particular boundaries. This define should be set to a power of
|
|
* two giving the desired alignment. It can be left undefined if alignment
|
|
* is not needed. This option is specific to the Microsoft VC++ compiler -
|
|
* it seems to sometimes cause trouble for the VC++ version 6 compiler.
|
|
*/
|
|
|
|
#if 1 && defined(_MSC_VER) && (_MSC_VER >= 1300)
|
|
#define TABLE_ALIGN 32
|
|
#endif
|
|
|
|
/*
|
|
* 11. REDUCE CODE AND TABLE SIZE
|
|
*
|
|
* This replaces some expanded macros with function calls if AES_ASM_V2 or
|
|
* AES_ASM_V2C are defined
|
|
*/
|
|
|
|
#if 1 && (defined(ASM_X86_V2) || defined(ASM_X86_V2C))
|
|
#define REDUCE_CODE_SIZE
|
|
#endif
|
|
|
|
/*
|
|
* 12. TABLE OPTIONS
|
|
*
|
|
* This cipher proceeds by repeating in a number of cycles known as rounds
|
|
* which are implemented by a round function which is optionally be speeded
|
|
* up using tables. The basic tables are 256 32-bit words, with either
|
|
* one or four tables being required for each round function depending on
|
|
* how much speed is required. Encryption and decryption round functions
|
|
* are different and the last encryption and decryption round functions are
|
|
* different again making four different round functions in all.
|
|
*
|
|
* This means that:
|
|
* 1. Normal encryption and decryption rounds can each use either 0, 1
|
|
* or 4 tables and table spaces of 0, 1024 or 4096 bytes each.
|
|
* 2. The last encryption and decryption rounds can also use either 0, 1
|
|
* or 4 tables and table spaces of 0, 1024 or 4096 bytes each.
|
|
*
|
|
* Include or exclude the appropriate definitions below to set the number
|
|
* of tables used by this implementation.
|
|
*/
|
|
|
|
#if 1 /* set tables for the normal encryption round */
|
|
#define ENC_ROUND FOUR_TABLES
|
|
#elif 0
|
|
#define ENC_ROUND ONE_TABLE
|
|
#else
|
|
#define ENC_ROUND NO_TABLES
|
|
#endif
|
|
|
|
#if 1 /* set tables for the last encryption round */
|
|
#define LAST_ENC_ROUND FOUR_TABLES
|
|
#elif 0
|
|
#define LAST_ENC_ROUND ONE_TABLE
|
|
#else
|
|
#define LAST_ENC_ROUND NO_TABLES
|
|
#endif
|
|
|
|
#if 1 /* set tables for the normal decryption round */
|
|
#define DEC_ROUND FOUR_TABLES
|
|
#elif 0
|
|
#define DEC_ROUND ONE_TABLE
|
|
#else
|
|
#define DEC_ROUND NO_TABLES
|
|
#endif
|
|
|
|
#if 1 /* set tables for the last decryption round */
|
|
#define LAST_DEC_ROUND FOUR_TABLES
|
|
#elif 0
|
|
#define LAST_DEC_ROUND ONE_TABLE
|
|
#else
|
|
#define LAST_DEC_ROUND NO_TABLES
|
|
#endif
|
|
|
|
/*
|
|
* The decryption key schedule can be speeded up with tables in the same
|
|
* way that the round functions can. Include or exclude the following
|
|
* defines to set this requirement.
|
|
*/
|
|
#if 1
|
|
#define KEY_SCHED FOUR_TABLES
|
|
#elif 0
|
|
#define KEY_SCHED ONE_TABLE
|
|
#else
|
|
#define KEY_SCHED NO_TABLES
|
|
#endif
|
|
|
|
/* ---- END OF USER CONFIGURED OPTIONS ---- */
|
|
|
|
/* VIA ACE support is only available for VC++ and GCC */
|
|
|
|
#if !defined(_MSC_VER) && !defined(__GNUC__)
|
|
#if defined(ASSUME_VIA_ACE_PRESENT)
|
|
#undef ASSUME_VIA_ACE_PRESENT
|
|
#endif
|
|
#if defined(USE_VIA_ACE_IF_PRESENT)
|
|
#undef USE_VIA_ACE_IF_PRESENT
|
|
#endif
|
|
#endif
|
|
|
|
#if defined(ASSUME_VIA_ACE_PRESENT) && !defined(USE_VIA_ACE_IF_PRESENT)
|
|
#define USE_VIA_ACE_IF_PRESENT
|
|
#endif
|
|
|
|
#if defined(USE_VIA_ACE_IF_PRESENT) && !defined(AES_REV_DKS)
|
|
#define AES_REV_DKS
|
|
#endif
|
|
|
|
/* Assembler support requires the use of platform byte order */
|
|
|
|
#if (defined(ASM_X86_V1C) || defined(ASM_X86_V2C) || defined(ASM_AMD64_C)) && \
|
|
(ALGORITHM_BYTE_ORDER != PLATFORM_BYTE_ORDER)
|
|
#undef ALGORITHM_BYTE_ORDER
|
|
#define ALGORITHM_BYTE_ORDER PLATFORM_BYTE_ORDER
|
|
#endif
|
|
|
|
/*
|
|
* In this implementation the columns of the state array are each held in
|
|
* 32-bit words. The state array can be held in various ways: in an array
|
|
* of words, in a number of individual word variables or in a number of
|
|
* processor registers. The following define maps a variable name x and
|
|
* a column number c to the way the state array variable is to be held.
|
|
* The first define below maps the state into an array x[c] whereas the
|
|
* second form maps the state into a number of individual variables x0,
|
|
* x1, etc. Another form could map individual state columns to machine
|
|
* register names.
|
|
*/
|
|
|
|
#if defined(ARRAYS)
|
|
#define s(x, c) x[c]
|
|
#else
|
|
#define s(x, c) x##c
|
|
#endif
|
|
|
|
/*
|
|
* This implementation provides subroutines for encryption, decryption
|
|
* and for setting the three key lengths (separately) for encryption
|
|
* and decryption. Since not all functions are needed, masks are set
|
|
* up here to determine which will be implemented in C
|
|
*/
|
|
|
|
#if !defined(AES_ENCRYPT)
|
|
#define EFUNCS_IN_C 0
|
|
#elif defined(ASSUME_VIA_ACE_PRESENT) || defined(ASM_X86_V1C) || \
|
|
defined(ASM_X86_V2C) || defined(ASM_AMD64_C)
|
|
#define EFUNCS_IN_C ENC_KEYING_IN_C
|
|
#elif !defined(ASM_X86_V2)
|
|
#define EFUNCS_IN_C (ENCRYPTION_IN_C | ENC_KEYING_IN_C)
|
|
#else
|
|
#define EFUNCS_IN_C 0
|
|
#endif
|
|
|
|
#if !defined(AES_DECRYPT)
|
|
#define DFUNCS_IN_C 0
|
|
#elif defined(ASSUME_VIA_ACE_PRESENT) || defined(ASM_X86_V1C) || \
|
|
defined(ASM_X86_V2C) || defined(ASM_AMD64_C)
|
|
#define DFUNCS_IN_C DEC_KEYING_IN_C
|
|
#elif !defined(ASM_X86_V2)
|
|
#define DFUNCS_IN_C (DECRYPTION_IN_C | DEC_KEYING_IN_C)
|
|
#else
|
|
#define DFUNCS_IN_C 0
|
|
#endif
|
|
|
|
#define FUNCS_IN_C (EFUNCS_IN_C | DFUNCS_IN_C)
|
|
|
|
/* END OF CONFIGURATION OPTIONS */
|
|
|
|
/* Disable or report errors on some combinations of options */
|
|
|
|
#if ENC_ROUND == NO_TABLES && LAST_ENC_ROUND != NO_TABLES
|
|
#undef LAST_ENC_ROUND
|
|
#define LAST_ENC_ROUND NO_TABLES
|
|
#elif ENC_ROUND == ONE_TABLE && LAST_ENC_ROUND == FOUR_TABLES
|
|
#undef LAST_ENC_ROUND
|
|
#define LAST_ENC_ROUND ONE_TABLE
|
|
#endif
|
|
|
|
#if ENC_ROUND == NO_TABLES && ENC_UNROLL != NONE
|
|
#undef ENC_UNROLL
|
|
#define ENC_UNROLL NONE
|
|
#endif
|
|
|
|
#if DEC_ROUND == NO_TABLES && LAST_DEC_ROUND != NO_TABLES
|
|
#undef LAST_DEC_ROUND
|
|
#define LAST_DEC_ROUND NO_TABLES
|
|
#elif DEC_ROUND == ONE_TABLE && LAST_DEC_ROUND == FOUR_TABLES
|
|
#undef LAST_DEC_ROUND
|
|
#define LAST_DEC_ROUND ONE_TABLE
|
|
#endif
|
|
|
|
#if DEC_ROUND == NO_TABLES && DEC_UNROLL != NONE
|
|
#undef DEC_UNROLL
|
|
#define DEC_UNROLL NONE
|
|
#endif
|
|
|
|
#if (ALGORITHM_BYTE_ORDER == IS_LITTLE_ENDIAN)
|
|
#define aes_sw32 htonl
|
|
#elif defined(bswap32)
|
|
#define aes_sw32 bswap32
|
|
#elif defined(bswap_32)
|
|
#define aes_sw32 bswap_32
|
|
#else
|
|
#define brot(x, n) (((uint32_t)(x) << (n)) | ((uint32_t)(x) >> (32 - (n))))
|
|
#define aes_sw32(x) ((brot((x), 8) & 0x00ff00ff) | (brot((x), 24) & 0xff00ff00))
|
|
#endif
|
|
|
|
|
|
/*
|
|
* upr(x, n): rotates bytes within words by n positions, moving bytes to
|
|
* higher index positions with wrap around into low positions
|
|
* ups(x, n): moves bytes by n positions to higher index positions in
|
|
* words but without wrap around
|
|
* bval(x, n): extracts a byte from a word
|
|
*
|
|
* WARNING: The definitions given here are intended only for use with
|
|
* unsigned variables and with shift counts that are compile
|
|
* time constants
|
|
*/
|
|
|
|
#if (ALGORITHM_BYTE_ORDER == IS_LITTLE_ENDIAN)
|
|
#define upr(x, n) (((uint32_t)(x) << (8 * (n))) | \
|
|
((uint32_t)(x) >> (32 - 8 * (n))))
|
|
#define ups(x, n) ((uint32_t)(x) << (8 * (n)))
|
|
#define bval(x, n) to_byte((x) >> (8 * (n)))
|
|
#define bytes2word(b0, b1, b2, b3) \
|
|
(((uint32_t)(b3) << 24) | ((uint32_t)(b2) << 16) | \
|
|
((uint32_t)(b1) << 8) | (b0))
|
|
#endif
|
|
|
|
#if (ALGORITHM_BYTE_ORDER == IS_BIG_ENDIAN)
|
|
#define upr(x, n) (((uint32_t)(x) >> (8 * (n))) | \
|
|
((uint32_t)(x) << (32 - 8 * (n))))
|
|
#define ups(x, n) ((uint32_t)(x) >> (8 * (n)))
|
|
#define bval(x, n) to_byte((x) >> (24 - 8 * (n)))
|
|
#define bytes2word(b0, b1, b2, b3) \
|
|
(((uint32_t)(b0) << 24) | ((uint32_t)(b1) << 16) | \
|
|
((uint32_t)(b2) << 8) | (b3))
|
|
#endif
|
|
|
|
#if defined(SAFE_IO)
|
|
#define word_in(x, c) bytes2word(((const uint8_t *)(x) + 4 * c)[0], \
|
|
((const uint8_t *)(x) + 4 * c)[1], \
|
|
((const uint8_t *)(x) + 4 * c)[2], \
|
|
((const uint8_t *)(x) + 4 * c)[3])
|
|
#define word_out(x, c, v) { ((uint8_t *)(x) + 4 * c)[0] = bval(v, 0); \
|
|
((uint8_t *)(x) + 4 * c)[1] = bval(v, 1); \
|
|
((uint8_t *)(x) + 4 * c)[2] = bval(v, 2); \
|
|
((uint8_t *)(x) + 4 * c)[3] = bval(v, 3); }
|
|
#elif (ALGORITHM_BYTE_ORDER == PLATFORM_BYTE_ORDER)
|
|
#define word_in(x, c) (*((uint32_t *)(x) + (c)))
|
|
#define word_out(x, c, v) (*((uint32_t *)(x) + (c)) = (v))
|
|
#else
|
|
#define word_in(x, c) aes_sw32(*((uint32_t *)(x) + (c)))
|
|
#define word_out(x, c, v) (*((uint32_t *)(x) + (c)) = aes_sw32(v))
|
|
#endif
|
|
|
|
/* the finite field modular polynomial and elements */
|
|
|
|
#define WPOLY 0x011b
|
|
#define BPOLY 0x1b
|
|
|
|
/* multiply four bytes in GF(2^8) by 'x' {02} in parallel */
|
|
|
|
#define m1 0x80808080
|
|
#define m2 0x7f7f7f7f
|
|
#define gf_mulx(x) ((((x) & m2) << 1) ^ ((((x) & m1) >> 7) * BPOLY))
|
|
|
|
/*
|
|
* The following defines provide alternative definitions of gf_mulx that might
|
|
* give improved performance if a fast 32-bit multiply is not available. Note
|
|
* that a temporary variable u needs to be defined where gf_mulx is used.
|
|
*
|
|
* #define gf_mulx(x) (u = (x) & m1, u |= (u >> 1), ((x) & m2) << 1) ^ \
|
|
* ((u >> 3) | (u >> 6))
|
|
* #define m4 (0x01010101 * BPOLY)
|
|
* #define gf_mulx(x) (u = (x) & m1, ((x) & m2) << 1) ^ ((u - (u >> 7)) \
|
|
* & m4)
|
|
*/
|
|
|
|
/* Work out which tables are needed for the different options */
|
|
|
|
#if defined(ASM_X86_V1C)
|
|
#if defined(ENC_ROUND)
|
|
#undef ENC_ROUND
|
|
#endif
|
|
#define ENC_ROUND FOUR_TABLES
|
|
#if defined(LAST_ENC_ROUND)
|
|
#undef LAST_ENC_ROUND
|
|
#endif
|
|
#define LAST_ENC_ROUND FOUR_TABLES
|
|
#if defined(DEC_ROUND)
|
|
#undef DEC_ROUND
|
|
#endif
|
|
#define DEC_ROUND FOUR_TABLES
|
|
#if defined(LAST_DEC_ROUND)
|
|
#undef LAST_DEC_ROUND
|
|
#endif
|
|
#define LAST_DEC_ROUND FOUR_TABLES
|
|
#if defined(KEY_SCHED)
|
|
#undef KEY_SCHED
|
|
#define KEY_SCHED FOUR_TABLES
|
|
#endif
|
|
#endif
|
|
|
|
#if (FUNCS_IN_C & ENCRYPTION_IN_C) || defined(ASM_X86_V1C)
|
|
#if ENC_ROUND == ONE_TABLE
|
|
#define FT1_SET
|
|
#elif ENC_ROUND == FOUR_TABLES
|
|
#define FT4_SET
|
|
#else
|
|
#define SBX_SET
|
|
#endif
|
|
#if LAST_ENC_ROUND == ONE_TABLE
|
|
#define FL1_SET
|
|
#elif LAST_ENC_ROUND == FOUR_TABLES
|
|
#define FL4_SET
|
|
#elif !defined(SBX_SET)
|
|
#define SBX_SET
|
|
#endif
|
|
#endif
|
|
|
|
#if (FUNCS_IN_C & DECRYPTION_IN_C) || defined(ASM_X86_V1C)
|
|
#if DEC_ROUND == ONE_TABLE
|
|
#define IT1_SET
|
|
#elif DEC_ROUND == FOUR_TABLES
|
|
#define IT4_SET
|
|
#else
|
|
#define ISB_SET
|
|
#endif
|
|
#if LAST_DEC_ROUND == ONE_TABLE
|
|
#define IL1_SET
|
|
#elif LAST_DEC_ROUND == FOUR_TABLES
|
|
#define IL4_SET
|
|
#elif !defined(ISB_SET)
|
|
#define ISB_SET
|
|
#endif
|
|
#endif
|
|
|
|
|
|
#if !(defined(REDUCE_CODE_SIZE) && (defined(ASM_X86_V2) || \
|
|
defined(ASM_X86_V2C)))
|
|
#if ((FUNCS_IN_C & ENC_KEYING_IN_C) || (FUNCS_IN_C & DEC_KEYING_IN_C))
|
|
#if KEY_SCHED == ONE_TABLE
|
|
#if !defined(FL1_SET) && !defined(FL4_SET)
|
|
#define LS1_SET
|
|
#endif
|
|
#elif KEY_SCHED == FOUR_TABLES
|
|
#if !defined(FL4_SET)
|
|
#define LS4_SET
|
|
#endif
|
|
#elif !defined(SBX_SET)
|
|
#define SBX_SET
|
|
#endif
|
|
#endif
|
|
#if (FUNCS_IN_C & DEC_KEYING_IN_C)
|
|
#if KEY_SCHED == ONE_TABLE
|
|
#define IM1_SET
|
|
#elif KEY_SCHED == FOUR_TABLES
|
|
#define IM4_SET
|
|
#elif !defined(SBX_SET)
|
|
#define SBX_SET
|
|
#endif
|
|
#endif
|
|
#endif
|
|
|
|
/* generic definitions of Rijndael macros that use tables */
|
|
|
|
#define no_table(x, box, vf, rf, c) bytes2word(\
|
|
box[bval(vf(x, 0, c), rf(0, c))], \
|
|
box[bval(vf(x, 1, c), rf(1, c))], \
|
|
box[bval(vf(x, 2, c), rf(2, c))], \
|
|
box[bval(vf(x, 3, c), rf(3, c))])
|
|
|
|
#define one_table(x, op, tab, vf, rf, c) \
|
|
(tab[bval(vf(x, 0, c), rf(0, c))] \
|
|
^ op(tab[bval(vf(x, 1, c), rf(1, c))], 1) \
|
|
^ op(tab[bval(vf(x, 2, c), rf(2, c))], 2) \
|
|
^ op(tab[bval(vf(x, 3, c), rf(3, c))], 3))
|
|
|
|
#define four_tables(x, tab, vf, rf, c) \
|
|
(tab[0][bval(vf(x, 0, c), rf(0, c))] \
|
|
^ tab[1][bval(vf(x, 1, c), rf(1, c))] \
|
|
^ tab[2][bval(vf(x, 2, c), rf(2, c))] \
|
|
^ tab[3][bval(vf(x, 3, c), rf(3, c))])
|
|
|
|
#define vf1(x, r, c) (x)
|
|
#define rf1(r, c) (r)
|
|
#define rf2(r, c) ((8+r-c)&3)
|
|
|
|
/*
|
|
* Perform forward and inverse column mix operation on four bytes in long word
|
|
* x in parallel. NOTE: x must be a simple variable, NOT an expression in
|
|
* these macros.
|
|
*/
|
|
|
|
#if !(defined(REDUCE_CODE_SIZE) && (defined(ASM_X86_V2) || \
|
|
defined(ASM_X86_V2C)))
|
|
|
|
#if defined(FM4_SET) /* not currently used */
|
|
#define fwd_mcol(x) four_tables(x, t_use(f, m), vf1, rf1, 0)
|
|
#elif defined(FM1_SET) /* not currently used */
|
|
#define fwd_mcol(x) one_table(x, upr, t_use(f, m), vf1, rf1, 0)
|
|
#else
|
|
#define dec_fmvars uint32_t g2
|
|
#define fwd_mcol(x) (g2 = gf_mulx(x), g2 ^ upr((x) ^ g2, 3) ^ \
|
|
upr((x), 2) ^ upr((x), 1))
|
|
#endif
|
|
|
|
#if defined(IM4_SET)
|
|
#define inv_mcol(x) four_tables(x, t_use(i, m), vf1, rf1, 0)
|
|
#elif defined(IM1_SET)
|
|
#define inv_mcol(x) one_table(x, upr, t_use(i, m), vf1, rf1, 0)
|
|
#else
|
|
#define dec_imvars uint32_t g2, g4, g9
|
|
#define inv_mcol(x) (g2 = gf_mulx(x), g4 = gf_mulx(g2), g9 = \
|
|
(x) ^ gf_mulx(g4), g4 ^= g9, \
|
|
(x) ^ g2 ^ g4 ^ upr(g2 ^ g9, 3) ^ \
|
|
upr(g4, 2) ^ upr(g9, 1))
|
|
#endif
|
|
|
|
#if defined(FL4_SET)
|
|
#define ls_box(x, c) four_tables(x, t_use(f, l), vf1, rf2, c)
|
|
#elif defined(LS4_SET)
|
|
#define ls_box(x, c) four_tables(x, t_use(l, s), vf1, rf2, c)
|
|
#elif defined(FL1_SET)
|
|
#define ls_box(x, c) one_table(x, upr, t_use(f, l), vf1, rf2, c)
|
|
#elif defined(LS1_SET)
|
|
#define ls_box(x, c) one_table(x, upr, t_use(l, s), vf1, rf2, c)
|
|
#else
|
|
#define ls_box(x, c) no_table(x, t_use(s, box), vf1, rf2, c)
|
|
#endif
|
|
|
|
#endif
|
|
|
|
#if defined(ASM_X86_V1C) && defined(AES_DECRYPT) && !defined(ISB_SET)
|
|
#define ISB_SET
|
|
#endif
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|
|
|
|
#endif /* _AESOPT_H */
|