1/* SPDX-License-Identifier: GPL-2.0-or-later */ 2 3#include <stdint.h> 4#include <stdbool.h> 5#include <stdlib.h> 6#include <string.h> 7#include <stdio.h> 8 9static bool test_SB_SR(uint8_t *o, const uint8_t *i); 10static bool test_MC(uint8_t *o, const uint8_t *i); 11static bool test_SB_SR_MC_AK(uint8_t *o, const uint8_t *i, const uint8_t *k); 12 13static bool test_ISB_ISR(uint8_t *o, const uint8_t *i); 14static bool test_IMC(uint8_t *o, const uint8_t *i); 15static bool test_ISB_ISR_AK_IMC(uint8_t *o, const uint8_t *i, const uint8_t *k); 16static bool test_ISB_ISR_IMC_AK(uint8_t *o, const uint8_t *i, const uint8_t *k); 17 18/* 19 * From https://doi.org/10.6028/NIST.FIPS.197-upd1, 20 * Appendix B -- Cipher Example 21 * 22 * Note that the formatting of the 4x4 matrices in the document is 23 * column-major, whereas C is row-major. Therefore to get the bytes 24 * in the same order as the text, the matrices are transposed. 25 * 26 * Note that we are not going to test SubBytes or ShiftRows separately, 27 * so the "After SubBytes" column is omitted, using only the combined 28 * result "After ShiftRows" column. 29 */ 30 31/* Ease the inline assembly by aligning everything. */ 32typedef struct { 33 uint8_t b[16] __attribute__((aligned(16))); 34} State; 35 36typedef struct { 37 State start, after_sr, after_mc, round_key; 38} Round; 39 40static const Round rounds[] = { 41 /* Round 1 */ 42 { { { 0x19, 0x3d, 0xe3, 0xbe, /* start */ 43 0xa0, 0xf4, 0xe2, 0x2b, 44 0x9a, 0xc6, 0x8d, 0x2a, 45 0xe9, 0xf8, 0x48, 0x08, } }, 46 47 { { 0xd4, 0xbf, 0x5d, 0x30, /* after shiftrows */ 48 0xe0, 0xb4, 0x52, 0xae, 49 0xb8, 0x41, 0x11, 0xf1, 50 0x1e, 0x27, 0x98, 0xe5, } }, 51 52 { { 0x04, 0x66, 0x81, 0xe5, /* after mixcolumns */ 53 0xe0, 0xcb, 0x19, 0x9a, 54 0x48, 0xf8, 0xd3, 0x7a, 55 0x28, 0x06, 0x26, 0x4c, } }, 56 57 { { 0xa0, 0xfa, 0xfe, 0x17, /* round key */ 58 0x88, 0x54, 0x2c, 0xb1, 59 0x23, 0xa3, 0x39, 0x39, 60 0x2a, 0x6c, 0x76, 0x05, } } }, 61 62 /* Round 2 */ 63 { { { 0xa4, 0x9c, 0x7f, 0xf2, /* start */ 64 0x68, 0x9f, 0x35, 0x2b, 65 0x6b, 0x5b, 0xea, 0x43, 66 0x02, 0x6a, 0x50, 0x49, } }, 67 68 { { 0x49, 0xdb, 0x87, 0x3b, /* after shiftrows */ 69 0x45, 0x39, 0x53, 0x89, 70 0x7f, 0x02, 0xd2, 0xf1, 71 0x77, 0xde, 0x96, 0x1a, } }, 72 73 { { 0x58, 0x4d, 0xca, 0xf1, /* after mixcolumns */ 74 0x1b, 0x4b, 0x5a, 0xac, 75 0xdb, 0xe7, 0xca, 0xa8, 76 0x1b, 0x6b, 0xb0, 0xe5, } }, 77 78 { { 0xf2, 0xc2, 0x95, 0xf2, /* round key */ 79 0x7a, 0x96, 0xb9, 0x43, 80 0x59, 0x35, 0x80, 0x7a, 81 0x73, 0x59, 0xf6, 0x7f, } } }, 82 83 /* Round 3 */ 84 { { { 0xaa, 0x8f, 0x5f, 0x03, /* start */ 85 0x61, 0xdd, 0xe3, 0xef, 86 0x82, 0xd2, 0x4a, 0xd2, 87 0x68, 0x32, 0x46, 0x9a, } }, 88 89 { { 0xac, 0xc1, 0xd6, 0xb8, /* after shiftrows */ 90 0xef, 0xb5, 0x5a, 0x7b, 91 0x13, 0x23, 0xcf, 0xdf, 92 0x45, 0x73, 0x11, 0xb5, } }, 93 94 { { 0x75, 0xec, 0x09, 0x93, /* after mixcolumns */ 95 0x20, 0x0b, 0x63, 0x33, 96 0x53, 0xc0, 0xcf, 0x7c, 97 0xbb, 0x25, 0xd0, 0xdc, } }, 98 99 { { 0x3d, 0x80, 0x47, 0x7d, /* round key */ 100 0x47, 0x16, 0xfe, 0x3e, 101 0x1e, 0x23, 0x7e, 0x44, 102 0x6d, 0x7a, 0x88, 0x3b, } } }, 103}; 104 105static void verify_log(const char *prefix, const State *s) 106{ 107 printf("%s:", prefix); 108 for (int i = 0; i < sizeof(State); ++i) { 109 printf(" %02x", s->b[i]); 110 } 111 printf("\n"); 112} 113 114static void verify(const State *ref, const State *tst, const char *which) 115{ 116 if (!memcmp(ref, tst, sizeof(State))) { 117 return; 118 } 119 120 printf("Mismatch on %s\n", which); 121 verify_log("ref", ref); 122 verify_log("tst", tst); 123 exit(EXIT_FAILURE); 124} 125 126int main() 127{ 128 int i, n = sizeof(rounds) / sizeof(Round); 129 State t; 130 131 for (i = 0; i < n; ++i) { 132 if (test_SB_SR(t.b, rounds[i].start.b)) { 133 verify(&rounds[i].after_sr, &t, "SB+SR"); 134 } 135 } 136 137 for (i = 0; i < n; ++i) { 138 if (test_MC(t.b, rounds[i].after_sr.b)) { 139 verify(&rounds[i].after_mc, &t, "MC"); 140 } 141 } 142 143 /* The kernel of Cipher(). */ 144 for (i = 0; i < n - 1; ++i) { 145 if (test_SB_SR_MC_AK(t.b, rounds[i].start.b, rounds[i].round_key.b)) { 146 verify(&rounds[i + 1].start, &t, "SB+SR+MC+AK"); 147 } 148 } 149 150 for (i = 0; i < n; ++i) { 151 if (test_ISB_ISR(t.b, rounds[i].after_sr.b)) { 152 verify(&rounds[i].start, &t, "ISB+ISR"); 153 } 154 } 155 156 for (i = 0; i < n; ++i) { 157 if (test_IMC(t.b, rounds[i].after_mc.b)) { 158 verify(&rounds[i].after_sr, &t, "IMC"); 159 } 160 } 161 162 /* The kernel of InvCipher(). */ 163 for (i = n - 1; i > 0; --i) { 164 if (test_ISB_ISR_AK_IMC(t.b, rounds[i].after_sr.b, 165 rounds[i - 1].round_key.b)) { 166 verify(&rounds[i - 1].after_sr, &t, "ISB+ISR+AK+IMC"); 167 } 168 } 169 170 /* 171 * The kernel of EqInvCipher(). 172 * We must compute a different round key: apply InvMixColumns to 173 * the standard round key, per KeyExpansion vs KeyExpansionEIC. 174 */ 175 for (i = 1; i < n; ++i) { 176 if (test_IMC(t.b, rounds[i - 1].round_key.b) && 177 test_ISB_ISR_IMC_AK(t.b, rounds[i].after_sr.b, t.b)) { 178 verify(&rounds[i - 1].after_sr, &t, "ISB+ISR+IMC+AK"); 179 } 180 } 181 182 return EXIT_SUCCESS; 183} 184