1/* SPDX-License-Identifier: GPL-2.0-or-later */
2
3#include <stdint.h>
4#include <stdbool.h>
5#include <stdlib.h>
6#include <string.h>
7#include <stdio.h>
8
9static bool test_SB_SR(uint8_t *o, const uint8_t *i);
10static bool test_MC(uint8_t *o, const uint8_t *i);
11static bool test_SB_SR_MC_AK(uint8_t *o, const uint8_t *i, const uint8_t *k);
12
13static bool test_ISB_ISR(uint8_t *o, const uint8_t *i);
14static bool test_IMC(uint8_t *o, const uint8_t *i);
15static bool test_ISB_ISR_AK_IMC(uint8_t *o, const uint8_t *i, const uint8_t *k);
16static bool test_ISB_ISR_IMC_AK(uint8_t *o, const uint8_t *i, const uint8_t *k);
17
18/*
19 * From https://doi.org/10.6028/NIST.FIPS.197-upd1,
20 * Appendix B -- Cipher Example
21 *
22 * Note that the formatting of the 4x4 matrices in the document is
23 * column-major, whereas C is row-major.  Therefore to get the bytes
24 * in the same order as the text, the matrices are transposed.
25 *
26 * Note that we are not going to test SubBytes or ShiftRows separately,
27 * so the "After SubBytes" column is omitted, using only the combined
28 * result "After ShiftRows" column.
29 */
30
31/* Ease the inline assembly by aligning everything. */
32typedef struct {
33    uint8_t b[16] __attribute__((aligned(16)));
34} State;
35
36typedef struct {
37    State start, after_sr, after_mc, round_key;
38} Round;
39
40static const Round rounds[] = {
41    /* Round 1 */
42    { { { 0x19, 0x3d, 0xe3, 0xbe,       /* start */
43          0xa0, 0xf4, 0xe2, 0x2b,
44          0x9a, 0xc6, 0x8d, 0x2a,
45          0xe9, 0xf8, 0x48, 0x08, } },
46
47      { { 0xd4, 0xbf, 0x5d, 0x30,       /* after shiftrows */
48          0xe0, 0xb4, 0x52, 0xae,
49          0xb8, 0x41, 0x11, 0xf1,
50          0x1e, 0x27, 0x98, 0xe5, } },
51
52      { { 0x04, 0x66, 0x81, 0xe5,       /* after mixcolumns */
53          0xe0, 0xcb, 0x19, 0x9a,
54          0x48, 0xf8, 0xd3, 0x7a,
55          0x28, 0x06, 0x26, 0x4c, } },
56
57      { { 0xa0, 0xfa, 0xfe, 0x17,       /* round key */
58          0x88, 0x54, 0x2c, 0xb1,
59          0x23, 0xa3, 0x39, 0x39,
60          0x2a, 0x6c, 0x76, 0x05, } } },
61
62    /* Round 2 */
63    { { { 0xa4, 0x9c, 0x7f, 0xf2,       /* start */
64          0x68, 0x9f, 0x35, 0x2b,
65          0x6b, 0x5b, 0xea, 0x43,
66          0x02, 0x6a, 0x50, 0x49, } },
67
68      { { 0x49, 0xdb, 0x87, 0x3b,       /* after shiftrows */
69          0x45, 0x39, 0x53, 0x89,
70          0x7f, 0x02, 0xd2, 0xf1,
71          0x77, 0xde, 0x96, 0x1a, } },
72
73      { { 0x58, 0x4d, 0xca, 0xf1,       /* after mixcolumns */
74          0x1b, 0x4b, 0x5a, 0xac,
75          0xdb, 0xe7, 0xca, 0xa8,
76          0x1b, 0x6b, 0xb0, 0xe5, } },
77
78      { { 0xf2, 0xc2, 0x95, 0xf2,       /* round key */
79          0x7a, 0x96, 0xb9, 0x43,
80          0x59, 0x35, 0x80, 0x7a,
81          0x73, 0x59, 0xf6, 0x7f, } } },
82
83    /* Round 3 */
84    { { { 0xaa, 0x8f, 0x5f, 0x03,       /* start */
85          0x61, 0xdd, 0xe3, 0xef,
86          0x82, 0xd2, 0x4a, 0xd2,
87          0x68, 0x32, 0x46, 0x9a, } },
88
89      { { 0xac, 0xc1, 0xd6, 0xb8,       /* after shiftrows */
90          0xef, 0xb5, 0x5a, 0x7b,
91          0x13, 0x23, 0xcf, 0xdf,
92          0x45, 0x73, 0x11, 0xb5, } },
93
94      { { 0x75, 0xec, 0x09, 0x93,       /* after mixcolumns */
95          0x20, 0x0b, 0x63, 0x33,
96          0x53, 0xc0, 0xcf, 0x7c,
97          0xbb, 0x25, 0xd0, 0xdc, } },
98
99      { { 0x3d, 0x80, 0x47, 0x7d,       /* round key */
100          0x47, 0x16, 0xfe, 0x3e,
101          0x1e, 0x23, 0x7e, 0x44,
102          0x6d, 0x7a, 0x88, 0x3b, } } },
103};
104
105static void verify_log(const char *prefix, const State *s)
106{
107    printf("%s:", prefix);
108    for (int i = 0; i < sizeof(State); ++i) {
109        printf(" %02x", s->b[i]);
110    }
111    printf("\n");
112}
113
114static void verify(const State *ref, const State *tst, const char *which)
115{
116    if (!memcmp(ref, tst, sizeof(State))) {
117        return;
118    }
119
120    printf("Mismatch on %s\n", which);
121    verify_log("ref", ref);
122    verify_log("tst", tst);
123    exit(EXIT_FAILURE);
124}
125
126int main()
127{
128    int i, n = sizeof(rounds) / sizeof(Round);
129    State t;
130
131    for (i = 0; i < n; ++i) {
132        if (test_SB_SR(t.b, rounds[i].start.b)) {
133            verify(&rounds[i].after_sr, &t, "SB+SR");
134        }
135    }
136
137    for (i = 0; i < n; ++i) {
138        if (test_MC(t.b, rounds[i].after_sr.b)) {
139            verify(&rounds[i].after_mc, &t, "MC");
140        }
141    }
142
143    /* The kernel of Cipher(). */
144    for (i = 0; i < n - 1; ++i) {
145        if (test_SB_SR_MC_AK(t.b, rounds[i].start.b, rounds[i].round_key.b)) {
146            verify(&rounds[i + 1].start, &t, "SB+SR+MC+AK");
147        }
148    }
149
150    for (i = 0; i < n; ++i) {
151        if (test_ISB_ISR(t.b, rounds[i].after_sr.b)) {
152            verify(&rounds[i].start, &t, "ISB+ISR");
153        }
154    }
155
156    for (i = 0; i < n; ++i) {
157        if (test_IMC(t.b, rounds[i].after_mc.b)) {
158            verify(&rounds[i].after_sr, &t, "IMC");
159        }
160    }
161
162    /* The kernel of InvCipher(). */
163    for (i = n - 1; i > 0; --i) {
164        if (test_ISB_ISR_AK_IMC(t.b, rounds[i].after_sr.b,
165                                rounds[i - 1].round_key.b)) {
166            verify(&rounds[i - 1].after_sr, &t, "ISB+ISR+AK+IMC");
167        }
168    }
169
170    /*
171     * The kernel of EqInvCipher().
172     * We must compute a different round key: apply InvMixColumns to
173     * the standard round key, per KeyExpansion vs KeyExpansionEIC.
174     */
175    for (i = 1; i < n; ++i) {
176        if (test_IMC(t.b, rounds[i - 1].round_key.b) &&
177            test_ISB_ISR_IMC_AK(t.b, rounds[i].after_sr.b, t.b)) {
178            verify(&rounds[i - 1].after_sr, &t, "ISB+ISR+IMC+AK");
179        }
180    }
181
182    return EXIT_SUCCESS;
183}
184