crypto/rijndael/rd_fst.c

   1 /*
   2  * rijndael-alg-fst.c   v2.4   April '2000
   3  *
   4  * Optimised ANSI C code
   5  *
   6  * authors: v1.0: Antoon Bosselaers
   7  *          v2.0: Vincent Rijmen
   8  *          v2.3: Paulo Barreto
   9  *          v2.4: Vincent Rijmen
  10  *
  11  * This code is placed in the public domain.
  12  */
  13
  14 #include <stdio.h>
  15 #include <stdlib.h>
  16
  17 #include "rd_fst.h"
  18
  19 #include "boxes-fst-corrected.dat"
  20
  21 int rijndaelKeySched(const word8 k[RIJNDAEL_MAXKC][4],
  22                      word8 W[RIJNDAEL_MAXROUNDS+1][4][4],int ROUNDS)
  23     {
  24     /* Calculate the necessary round keys
  25      * The number of calculations depends on keyBits and blockBits
  26      */
  27     int j, r, t, rconpointer = 0;
  28     word8 tk[RIJNDAEL_MAXKC][4];
  29     int KC = ROUNDS - 6;
  30
  31     for (j = KC-1; j >= 0; j--)
  32         *((word32*)tk[j]) = *((word32*)k[j]);
  33     r = 0;
  34     t = 0;
  35     /* copy values into round key array */
  36     for (j = 0; (j < KC) && (r < ROUNDS + 1); )
  37         {
  38         for (; (j < KC) && (t < 4); j++, t++)
  39             *((word32*)W[r][t]) = *((word32*)tk[j]);
  40         if (t == 4)
  41             {
  42             r++;
  43             t = 0;
  44             }
  45         }
  46
  47     while (r < ROUNDS + 1)
  48         { /* while not enough round key material calculated */
  49         /* calculate new values */
  50         tk[0][0] ^= S[tk[KC-1][1]];
  51         tk[0][1] ^= S[tk[KC-1][2]];
  52         tk[0][2] ^= S[tk[KC-1][3]];
  53         tk[0][3] ^= S[tk[KC-1][0]];
  54         tk[0][0] ^= rcon[rconpointer++];
  55
  56         if (KC != 8)
  57             {
  58             for (j = 1; j < KC; j++)
  59                 {
  60                 *((word32*)tk[j]) ^= *((word32*)tk[j-1]);
  61                 }
  62             }
  63         else
  64             {
  65             for (j = 1; j < KC/2; j++)
  66                 {
  67                 *((word32*)tk[j]) ^= *((word32*)tk[j-1]);
  68                 }
  69             tk[KC/2][0] ^= S[tk[KC/2 - 1][0]];
  70             tk[KC/2][1] ^= S[tk[KC/2 - 1][1]];
  71             tk[KC/2][2] ^= S[tk[KC/2 - 1][2]];
  72             tk[KC/2][3] ^= S[tk[KC/2 - 1][3]];
  73             for (j = KC/2 + 1; j < KC; j++)
  74                 {
  75                 *((word32*)tk[j]) ^= *((word32*)tk[j-1]);
  76                 }
  77             }
  78         /* copy values into round key array */
  79         for (j = 0; (j < KC) && (r < ROUNDS + 1); )
  80             {
  81             for (; (j < KC) && (t < 4); j++, t++)
  82                 {
  83                 *((word32*)W[r][t]) = *((word32*)tk[j]);
  84                 }
  85             if (t == 4)
  86                 {
  87                 r++;
  88                 t = 0;
  89                 }
  90             }
  91         }
  92     return 0;
  93     }
  94
  95 int rijndaelKeyEncToDec(word8 W[RIJNDAEL_MAXROUNDS+1][4][4], int ROUNDS)
  96     {
  97     int r;
  98     word8 *w;
  99
 100     for (r = 1; r < ROUNDS; r++)
 101         {
 102         w = W[r][0];
 103         *((word32*)w) =
 104           *((word32*)U1[w[0]])
 105           ^ *((word32*)U2[w[1]])
 106           ^ *((word32*)U3[w[2]])
 107           ^ *((word32*)U4[w[3]]);
 108
 109         w = W[r][1];
 110         *((word32*)w) =
 111           *((word32*)U1[w[0]])
 112           ^ *((word32*)U2[w[1]])
 113           ^ *((word32*)U3[w[2]])
 114           ^ *((word32*)U4[w[3]]);
 115
 116         w = W[r][2];
 117         *((word32*)w) =
 118           *((word32*)U1[w[0]])
 119           ^ *((word32*)U2[w[1]])
 120           ^ *((word32*)U3[w[2]])
 121           ^ *((word32*)U4[w[3]]);
 122
 123         w = W[r][3];
 124         *((word32*)w) =
 125           *((word32*)U1[w[0]])
 126           ^ *((word32*)U2[w[1]])
 127           ^ *((word32*)U3[w[2]])
 128           ^ *((word32*)U4[w[3]]);
 129         }
 130     return 0;
 131     }
 132
 133 /**
 134  * Encrypt a single block.
 135  */
 136 int rijndaelEncrypt(const word8 a[16],word8 b[16],
 137                     word8 rk[RIJNDAEL_MAXROUNDS+1][4][4],
 138                     int ROUNDS)
 139     {
 140     int r;
 141     word8 temp[4][4];
 142
 143     *((word32*)temp[0]) = *((word32*)(a   )) ^ *((word32*)rk[0][0]);
 144     *((word32*)temp[1]) = *((word32*)(a+ 4)) ^ *((word32*)rk[0][1]);
 145     *((word32*)temp[2]) = *((word32*)(a+ 8)) ^ *((word32*)rk[0][2]);
 146     *((word32*)temp[3]) = *((word32*)(a+12)) ^ *((word32*)rk[0][3]);
 147     *((word32*)(b    )) = *((word32*)T1[temp[0][0]])
 148       ^ *((word32*)T2[temp[1][1]])
 149       ^ *((word32*)T3[temp[2][2]])
 150       ^ *((word32*)T4[temp[3][3]]);
 151     *((word32*)(b + 4)) = *((word32*)T1[temp[1][0]])
 152       ^ *((word32*)T2[temp[2][1]])
 153       ^ *((word32*)T3[temp[3][2]])
 154       ^ *((word32*)T4[temp[0][3]]);
 155     *((word32*)(b + 8)) = *((word32*)T1[temp[2][0]])
 156       ^ *((word32*)T2[temp[3][1]])
 157       ^ *((word32*)T3[temp[0][2]])
 158       ^ *((word32*)T4[temp[1][3]]);
 159     *((word32*)(b +12)) = *((word32*)T1[temp[3][0]])
 160       ^ *((word32*)T2[temp[0][1]])
 161       ^ *((word32*)T3[temp[1][2]])
 162       ^ *((word32*)T4[temp[2][3]]);
 163     for (r = 1; r < ROUNDS-1; r++)
 164         {
 165         *((word32*)temp[0]) = *((word32*)(b   )) ^ *((word32*)rk[r][0]);
 166         *((word32*)temp[1]) = *((word32*)(b+ 4)) ^ *((word32*)rk[r][1]);
 167         *((word32*)temp[2]) = *((word32*)(b+ 8)) ^ *((word32*)rk[r][2]);
 168         *((word32*)temp[3]) = *((word32*)(b+12)) ^ *((word32*)rk[r][3]);
 169
 170         *((word32*)(b    )) = *((word32*)T1[temp[0][0]])
 171           ^ *((word32*)T2[temp[1][1]])
 172           ^ *((word32*)T3[temp[2][2]])
 173           ^ *((word32*)T4[temp[3][3]]);
 174         *((word32*)(b + 4)) = *((word32*)T1[temp[1][0]])
 175           ^ *((word32*)T2[temp[2][1]])
 176           ^ *((word32*)T3[temp[3][2]])
 177           ^ *((word32*)T4[temp[0][3]]);
 178         *((word32*)(b + 8)) = *((word32*)T1[temp[2][0]])
 179           ^ *((word32*)T2[temp[3][1]])
 180           ^ *((word32*)T3[temp[0][2]])
 181           ^ *((word32*)T4[temp[1][3]]);
 182         *((word32*)(b +12)) = *((word32*)T1[temp[3][0]])
 183           ^ *((word32*)T2[temp[0][1]])
 184           ^ *((word32*)T3[temp[1][2]])
 185           ^ *((word32*)T4[temp[2][3]]);
 186         }
 187     /* last round is special */
 188     *((word32*)temp[0]) = *((word32*)(b   )) ^ *((word32*)rk[ROUNDS-1][0]);
 189     *((word32*)temp[1]) = *((word32*)(b+ 4)) ^ *((word32*)rk[ROUNDS-1][1]);
 190     *((word32*)temp[2]) = *((word32*)(b+ 8)) ^ *((word32*)rk[ROUNDS-1][2]);
 191     *((word32*)temp[3]) = *((word32*)(b+12)) ^ *((word32*)rk[ROUNDS-1][3]);
 192     b[ 0] = T1[temp[0][0]][1];
 193     b[ 1] = T1[temp[1][1]][1];
 194     b[ 2] = T1[temp[2][2]][1];
 195     b[ 3] = T1[temp[3][3]][1];
 196     b[ 4] = T1[temp[1][0]][1];
 197     b[ 5] = T1[temp[2][1]][1];
 198     b[ 6] = T1[temp[3][2]][1];
 199     b[ 7] = T1[temp[0][3]][1];
 200     b[ 8] = T1[temp[2][0]][1];
 201     b[ 9] = T1[temp[3][1]][1];
 202     b[10] = T1[temp[0][2]][1];
 203     b[11] = T1[temp[1][3]][1];
 204     b[12] = T1[temp[3][0]][1];
 205     b[13] = T1[temp[0][1]][1];
 206     b[14] = T1[temp[1][2]][1];
 207     b[15] = T1[temp[2][3]][1];
 208     *((word32*)(b   )) ^= *((word32*)rk[ROUNDS][0]);
 209     *((word32*)(b+ 4)) ^= *((word32*)rk[ROUNDS][1]);
 210     *((word32*)(b+ 8)) ^= *((word32*)rk[ROUNDS][2]);
 211     *((word32*)(b+12)) ^= *((word32*)rk[ROUNDS][3]);
 212
 213     return 0;
 214     }
 215
 216 #ifdef INTERMEDIATE_VALUE_KAT
 217 /**
 218  * Encrypt only a certain number of rounds.
 219  * Only used in the Intermediate Value Known Answer Test.
 220  */
 221 int rijndaelEncryptRound(word8 a[4][4],word8 rk[RIJNDAEL_MAXROUNDS+1][4][4],
 222                          int ROUNDS, int rounds)
 223     {
 224     int r;
 225     word8 temp[4][4];
 226
 227     /* make number of rounds sane */
 228     if (rounds > ROUNDS)
 229         {
 230         rounds = ROUNDS;
 231         }
 232
 233     *((word32*)a[0]) = *((word32*)a[0]) ^ *((word32*)rk[0][0]);
 234     *((word32*)a[1]) = *((word32*)a[1]) ^ *((word32*)rk[0][1]);
 235     *((word32*)a[2]) = *((word32*)a[2]) ^ *((word32*)rk[0][2]);
 236     *((word32*)a[3]) = *((word32*)a[3]) ^ *((word32*)rk[0][3]);
 237
 238     for (r = 1; (r <= rounds) && (r < ROUNDS); r++) {
 239     *((word32*)temp[0]) = *((word32*)T1[a[0][0]])
 240       ^ *((word32*)T2[a[1][1]])
 241       ^ *((word32*)T3[a[2][2]])
 242       ^ *((word32*)T4[a[3][3]]);
 243     *((word32*)temp[1]) = *((word32*)T1[a[1][0]])
 244       ^ *((word32*)T2[a[2][1]])
 245       ^ *((word32*)T3[a[3][2]])
 246       ^ *((word32*)T4[a[0][3]]);
 247     *((word32*)temp[2]) = *((word32*)T1[a[2][0]])
 248       ^ *((word32*)T2[a[3][1]])
 249       ^ *((word32*)T3[a[0][2]])
 250       ^ *((word32*)T4[a[1][3]]);
 251     *((word32*)temp[3]) = *((word32*)T1[a[3][0]])
 252       ^ *((word32*)T2[a[0][1]])
 253       ^ *((word32*)T3[a[1][2]])
 254       ^ *((word32*)T4[a[2][3]]);
 255     *((word32*)a[0]) = *((word32*)temp[0]) ^ *((word32*)rk[r][0]);
 256     *((word32*)a[1]) = *((word32*)temp[1]) ^ *((word32*)rk[r][1]);
 257     *((word32*)a[2]) = *((word32*)temp[2]) ^ *((word32*)rk[r][2]);
 258     *((word32*)a[3]) = *((word32*)temp[3]) ^ *((word32*)rk[r][3]);
 259     }
 260     if (rounds == ROUNDS)
 261         {
 262         /* last round is special */
 263         temp[0][0] = T1[a[0][0]][1];
 264         temp[0][1] = T1[a[1][1]][1];
 265         temp[0][2] = T1[a[2][2]][1];
 266         temp[0][3] = T1[a[3][3]][1];
 267         temp[1][0] = T1[a[1][0]][1];
 268         temp[1][1] = T1[a[2][1]][1];
 269         temp[1][2] = T1[a[3][2]][1];
 270         temp[1][3] = T1[a[0][3]][1];
 271         temp[2][0] = T1[a[2][0]][1];
 272         temp[2][1] = T1[a[3][1]][1];
 273         temp[2][2] = T1[a[0][2]][1];
 274         temp[2][3] = T1[a[1][3]][1];
 275         temp[3][0] = T1[a[3][0]][1];
 276         temp[3][1] = T1[a[0][1]][1];
 277         temp[3][2] = T1[a[1][2]][1];
 278         temp[3][3] = T1[a[2][3]][1];
 279         *((word32*)a[0]) = *((word32*)temp[0]) ^ *((word32*)rk[ROUNDS][0]);
 280         *((word32*)a[1]) = *((word32*)temp[1]) ^ *((word32*)rk[ROUNDS][1]);
 281         *((word32*)a[2]) = *((word32*)temp[2]) ^ *((word32*)rk[ROUNDS][2]);
 282         *((word32*)a[3]) = *((word32*)temp[3]) ^ *((word32*)rk[ROUNDS][3]);
 283         }
 284
 285     return 0;
 286     }
 287 #endif /* INTERMEDIATE_VALUE_KAT */
 288
 289 /**
 290  * Decrypt a single block.
 291  */
 292 int rijndaelDecrypt(const word8 a[16],word8 b[16],
 293                     word8 rk[RIJNDAEL_MAXROUNDS+1][4][4],int ROUNDS)
 294     {
 295     int r;
 296     word8 temp[4][4];
 297
 298     *((word32*)temp[0]) = *((word32*)(a   )) ^ *((word32*)rk[ROUNDS][0]);
 299     *((word32*)temp[1]) = *((word32*)(a+ 4)) ^ *((word32*)rk[ROUNDS][1]);
 300     *((word32*)temp[2]) = *((word32*)(a+ 8)) ^ *((word32*)rk[ROUNDS][2]);
 301     *((word32*)temp[3]) = *((word32*)(a+12)) ^ *((word32*)rk[ROUNDS][3]);
 302
 303     *((word32*)(b   )) = *((word32*)T5[temp[0][0]])
 304       ^ *((word32*)T6[temp[3][1]])
 305       ^ *((word32*)T7[temp[2][2]])
 306       ^ *((word32*)T8[temp[1][3]]);
 307     *((word32*)(b+ 4)) = *((word32*)T5[temp[1][0]])
 308       ^ *((word32*)T6[temp[0][1]])
 309       ^ *((word32*)T7[temp[3][2]])
 310       ^ *((word32*)T8[temp[2][3]]);
 311     *((word32*)(b+ 8)) = *((word32*)T5[temp[2][0]])
 312       ^ *((word32*)T6[temp[1][1]])
 313       ^ *((word32*)T7[temp[0][2]])
 314       ^ *((word32*)T8[temp[3][3]]);
 315     *((word32*)(b+12)) = *((word32*)T5[temp[3][0]])
 316       ^ *((word32*)T6[temp[2][1]])
 317       ^ *((word32*)T7[temp[1][2]])
 318       ^ *((word32*)T8[temp[0][3]]);
 319     for (r = ROUNDS-1; r > 1; r--)
 320         {
 321         *((word32*)temp[0]) = *((word32*)(b   )) ^ *((word32*)rk[r][0]);
 322         *((word32*)temp[1]) = *((word32*)(b+ 4)) ^ *((word32*)rk[r][1]);
 323         *((word32*)temp[2]) = *((word32*)(b+ 8)) ^ *((word32*)rk[r][2]);
 324         *((word32*)temp[3]) = *((word32*)(b+12)) ^ *((word32*)rk[r][3]);
 325         *((word32*)(b   )) = *((word32*)T5[temp[0][0]])
 326           ^ *((word32*)T6[temp[3][1]])
 327           ^ *((word32*)T7[temp[2][2]])
 328           ^ *((word32*)T8[temp[1][3]]);
 329         *((word32*)(b+ 4)) = *((word32*)T5[temp[1][0]])
 330           ^ *((word32*)T6[temp[0][1]])
 331           ^ *((word32*)T7[temp[3][2]])
 332           ^ *((word32*)T8[temp[2][3]]);
 333         *((word32*)(b+ 8)) = *((word32*)T5[temp[2][0]])
 334           ^ *((word32*)T6[temp[1][1]])
 335           ^ *((word32*)T7[temp[0][2]])
 336           ^ *((word32*)T8[temp[3][3]]);
 337         *((word32*)(b+12)) = *((word32*)T5[temp[3][0]])
 338           ^ *((word32*)T6[temp[2][1]])
 339           ^ *((word32*)T7[temp[1][2]])
 340           ^ *((word32*)T8[temp[0][3]]);
 341         }
 342     /* last round is special */
 343     *((word32*)temp[0]) = *((word32*)(b   )) ^ *((word32*)rk[1][0]);
 344     *((word32*)temp[1]) = *((word32*)(b+ 4)) ^ *((word32*)rk[1][1]);
 345     *((word32*)temp[2]) = *((word32*)(b+ 8)) ^ *((word32*)rk[1][2]);
 346     *((word32*)temp[3]) = *((word32*)(b+12)) ^ *((word32*)rk[1][3]);
 347     b[ 0] = S5[temp[0][0]];
 348     b[ 1] = S5[temp[3][1]];
 349     b[ 2] = S5[temp[2][2]];
 350     b[ 3] = S5[temp[1][3]];
 351     b[ 4] = S5[temp[1][0]];
 352     b[ 5] = S5[temp[0][1]];
 353     b[ 6] = S5[temp[3][2]];
 354     b[ 7] = S5[temp[2][3]];
 355     b[ 8] = S5[temp[2][0]];
 356     b[ 9] = S5[temp[1][1]];
 357     b[10] = S5[temp[0][2]];
 358     b[11] = S5[temp[3][3]];
 359     b[12] = S5[temp[3][0]];
 360     b[13] = S5[temp[2][1]];
 361     b[14] = S5[temp[1][2]];
 362     b[15] = S5[temp[0][3]];
 363     *((word32*)(b   )) ^= *((word32*)rk[0][0]);
 364     *((word32*)(b+ 4)) ^= *((word32*)rk[0][1]);
 365     *((word32*)(b+ 8)) ^= *((word32*)rk[0][2]);
 366     *((word32*)(b+12)) ^= *((word32*)rk[0][3]);
 367
 368     return 0;
 369     }
 370
 371 #ifdef INTERMEDIATE_VALUE_KAT
 372 /**
 373  * Decrypt only a certain number of rounds.
 374  * Only used in the Intermediate Value Known Answer Test.
 375  * Operations rearranged such that the intermediate values
 376  * of decryption correspond with the intermediate values
 377  * of encryption.
 378  */
 379 int rijndaelDecryptRound(word8 a[4][4], word8 rk[RIJNDAEL_MAXROUNDS+1][4][4],
 380                          int ROUNDS, int rounds)
 381     {
 382     int r, i;
 383     word8 temp[4], shift;
 384
 385     /* make number of rounds sane */
 386     if (rounds > ROUNDS)
 387         {
 388         rounds = ROUNDS;
 389         }
 390     /* first round is special: */
 391     *(word32 *)a[0] ^= *(word32 *)rk[ROUNDS][0];
 392     *(word32 *)a[1] ^= *(word32 *)rk[ROUNDS][1];
 393     *(word32 *)a[2] ^= *(word32 *)rk[ROUNDS][2];
 394     *(word32 *)a[3] ^= *(word32 *)rk[ROUNDS][3];
 395     for (i = 0; i < 4; i++)
 396         {
 397         a[i][0] = Si[a[i][0]];
 398         a[i][1] = Si[a[i][1]];
 399         a[i][2] = Si[a[i][2]];
 400         a[i][3] = Si[a[i][3]];
 401         }
 402     for (i = 1; i < 4; i++)
 403         {
 404         shift = (4 - i) & 3;
 405         temp[0] = a[(0 + shift) & 3][i];
 406         temp[1] = a[(1 + shift) & 3][i];
 407         temp[2] = a[(2 + shift) & 3][i];
 408         temp[3] = a[(3 + shift) & 3][i];
 409         a[0][i] = temp[0];
 410         a[1][i] = temp[1];
 411         a[2][i] = temp[2];
 412         a[3][i] = temp[3];
 413         }
 414     /* ROUNDS-1 ordinary rounds */
 415     for (r = ROUNDS-1; r > rounds; r--)
 416         {
 417         *(word32 *)a[0] ^= *(word32 *)rk[r][0];
 418         *(word32 *)a[1] ^= *(word32 *)rk[r][1];
 419         *(word32 *)a[2] ^= *(word32 *)rk[r][2];
 420         *(word32 *)a[3] ^= *(word32 *)rk[r][3];
 421
 422         *((word32*)a[0]) =
 423           *((word32*)U1[a[0][0]])
 424           ^ *((word32*)U2[a[0][1]])
 425           ^ *((word32*)U3[a[0][2]])
 426           ^ *((word32*)U4[a[0][3]]);
 427
 428         *((word32*)a[1]) =
 429           *((word32*)U1[a[1][0]])
 430           ^ *((word32*)U2[a[1][1]])
 431           ^ *((word32*)U3[a[1][2]])
 432           ^ *((word32*)U4[a[1][3]]);
 433
 434         *((word32*)a[2]) =
 435           *((word32*)U1[a[2][0]])
 436           ^ *((word32*)U2[a[2][1]])
 437           ^ *((word32*)U3[a[2][2]])
 438           ^ *((word32*)U4[a[2][3]]);
 439
 440         *((word32*)a[3]) =
 441           *((word32*)U1[a[3][0]])
 442           ^ *((word32*)U2[a[3][1]])
 443           ^ *((word32*)U3[a[3][2]])
 444           ^ *((word32*)U4[a[3][3]]);
 445         for (i = 0; i < 4; i++)
 446             {
 447             a[i][0] = Si[a[i][0]];
 448             a[i][1] = Si[a[i][1]];
 449             a[i][2] = Si[a[i][2]];
 450             a[i][3] = Si[a[i][3]];
 451             }
 452         for (i = 1; i < 4; i++)
 453             {
 454             shift = (4 - i) & 3;
 455             temp[0] = a[(0 + shift) & 3][i];
 456             temp[1] = a[(1 + shift) & 3][i];
 457             temp[2] = a[(2 + shift) & 3][i];
 458             temp[3] = a[(3 + shift) & 3][i];
 459             a[0][i] = temp[0];
 460             a[1][i] = temp[1];
 461             a[2][i] = temp[2];
 462             a[3][i] = temp[3];
 463             }
 464         }
 465     if (rounds == 0)
 466         {
 467         /* End with the extra key addition */
 468         *(word32 *)a[0] ^= *(word32 *)rk[0][0];
 469         *(word32 *)a[1] ^= *(word32 *)rk[0][1];
 470         *(word32 *)a[2] ^= *(word32 *)rk[0][2];
 471         *(word32 *)a[3] ^= *(word32 *)rk[0][3];
 472         }
 473     return 0;
 474     }
 475
 476 #endif /* INTERMEDIATE_VALUE_KAT */