1 /* 2 * Copyright (c) 2011 The Chromium OS Authors. 3 * (C) Copyright 2011 NVIDIA Corporation www.nvidia.com 4 * 5 * SPDX-License-Identifier: GPL-2.0+ 6 */ 7 8 /* 9 * advanced encryption standard 10 * author: karl malbrain, malbrain@yahoo.com 11 * 12 * This work, including the source code, documentation 13 * and related data, is placed into the public domain. 14 * 15 * The orginal author is Karl Malbrain. 16 * 17 * THIS SOFTWARE IS PROVIDED AS-IS WITHOUT WARRANTY 18 * OF ANY KIND, NOT EVEN THE IMPLIED WARRANTY OF 19 * MERCHANTABILITY. THE AUTHOR OF THIS SOFTWARE, 20 * ASSUMES _NO_ RESPONSIBILITY FOR ANY CONSEQUENCE 21 * RESULTING FROM THE USE, MODIFICATION, OR 22 * REDISTRIBUTION OF THIS SOFTWARE. 23 */ 24 25 #include <common.h> 26 #include "aes.h" 27 28 /* forward s-box */ 29 static const u8 sbox[256] = { 30 0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 31 0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76, 32 0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0, 33 0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0, 34 0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc, 35 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15, 36 0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 37 0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75, 38 0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0, 39 0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84, 40 0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b, 41 0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf, 42 0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, 43 0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8, 44 0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5, 45 0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2, 46 0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17, 47 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73, 48 0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88, 49 0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb, 50 0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c, 51 0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79, 52 0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9, 53 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08, 54 0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6, 55 0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a, 56 0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e, 57 0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e, 58 0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94, 59 0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf, 60 0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 61 0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16 62 }; 63 64 /* inverse s-box */ 65 static const u8 inv_sbox[256] = { 66 0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 67 0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7, 0xfb, 68 0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87, 69 0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb, 70 0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d, 71 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e, 72 0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 73 0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25, 74 0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16, 75 0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92, 76 0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda, 77 0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84, 78 0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a, 79 0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06, 80 0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02, 81 0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b, 82 0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea, 83 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73, 84 0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 85 0xe2, 0xf9, 0x37, 0xe8, 0x1c, 0x75, 0xdf, 0x6e, 86 0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89, 87 0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b, 88 0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2, 0x79, 0x20, 89 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4, 90 0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31, 91 0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f, 92 0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d, 93 0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef, 94 0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0, 95 0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61, 96 0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 97 0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d 98 }; 99 100 /* combined Xtimes2[Sbox[]] */ 101 static const u8 x2_sbox[256] = { 102 0xc6, 0xf8, 0xee, 0xf6, 0xff, 0xd6, 0xde, 0x91, 103 0x60, 0x02, 0xce, 0x56, 0xe7, 0xb5, 0x4d, 0xec, 104 0x8f, 0x1f, 0x89, 0xfa, 0xef, 0xb2, 0x8e, 0xfb, 105 0x41, 0xb3, 0x5f, 0x45, 0x23, 0x53, 0xe4, 0x9b, 106 0x75, 0xe1, 0x3d, 0x4c, 0x6c, 0x7e, 0xf5, 0x83, 107 0x68, 0x51, 0xd1, 0xf9, 0xe2, 0xab, 0x62, 0x2a, 108 0x08, 0x95, 0x46, 0x9d, 0x30, 0x37, 0x0a, 0x2f, 109 0x0e, 0x24, 0x1b, 0xdf, 0xcd, 0x4e, 0x7f, 0xea, 110 0x12, 0x1d, 0x58, 0x34, 0x36, 0xdc, 0xb4, 0x5b, 111 0xa4, 0x76, 0xb7, 0x7d, 0x52, 0xdd, 0x5e, 0x13, 112 0xa6, 0xb9, 0x00, 0xc1, 0x40, 0xe3, 0x79, 0xb6, 113 0xd4, 0x8d, 0x67, 0x72, 0x94, 0x98, 0xb0, 0x85, 114 0xbb, 0xc5, 0x4f, 0xed, 0x86, 0x9a, 0x66, 0x11, 115 0x8a, 0xe9, 0x04, 0xfe, 0xa0, 0x78, 0x25, 0x4b, 116 0xa2, 0x5d, 0x80, 0x05, 0x3f, 0x21, 0x70, 0xf1, 117 0x63, 0x77, 0xaf, 0x42, 0x20, 0xe5, 0xfd, 0xbf, 118 0x81, 0x18, 0x26, 0xc3, 0xbe, 0x35, 0x88, 0x2e, 119 0x93, 0x55, 0xfc, 0x7a, 0xc8, 0xba, 0x32, 0xe6, 120 0xc0, 0x19, 0x9e, 0xa3, 0x44, 0x54, 0x3b, 0x0b, 121 0x8c, 0xc7, 0x6b, 0x28, 0xa7, 0xbc, 0x16, 0xad, 122 0xdb, 0x64, 0x74, 0x14, 0x92, 0x0c, 0x48, 0xb8, 123 0x9f, 0xbd, 0x43, 0xc4, 0x39, 0x31, 0xd3, 0xf2, 124 0xd5, 0x8b, 0x6e, 0xda, 0x01, 0xb1, 0x9c, 0x49, 125 0xd8, 0xac, 0xf3, 0xcf, 0xca, 0xf4, 0x47, 0x10, 126 0x6f, 0xf0, 0x4a, 0x5c, 0x38, 0x57, 0x73, 0x97, 127 0xcb, 0xa1, 0xe8, 0x3e, 0x96, 0x61, 0x0d, 0x0f, 128 0xe0, 0x7c, 0x71, 0xcc, 0x90, 0x06, 0xf7, 0x1c, 129 0xc2, 0x6a, 0xae, 0x69, 0x17, 0x99, 0x3a, 0x27, 130 0xd9, 0xeb, 0x2b, 0x22, 0xd2, 0xa9, 0x07, 0x33, 131 0x2d, 0x3c, 0x15, 0xc9, 0x87, 0xaa, 0x50, 0xa5, 132 0x03, 0x59, 0x09, 0x1a, 0x65, 0xd7, 0x84, 0xd0, 133 0x82, 0x29, 0x5a, 0x1e, 0x7b, 0xa8, 0x6d, 0x2c 134 }; 135 136 /* combined Xtimes3[Sbox[]] */ 137 static const u8 x3_sbox[256] = { 138 0xa5, 0x84, 0x99, 0x8d, 0x0d, 0xbd, 0xb1, 0x54, 139 0x50, 0x03, 0xa9, 0x7d, 0x19, 0x62, 0xe6, 0x9a, 140 0x45, 0x9d, 0x40, 0x87, 0x15, 0xeb, 0xc9, 0x0b, 141 0xec, 0x67, 0xfd, 0xea, 0xbf, 0xf7, 0x96, 0x5b, 142 0xc2, 0x1c, 0xae, 0x6a, 0x5a, 0x41, 0x02, 0x4f, 143 0x5c, 0xf4, 0x34, 0x08, 0x93, 0x73, 0x53, 0x3f, 144 0x0c, 0x52, 0x65, 0x5e, 0x28, 0xa1, 0x0f, 0xb5, 145 0x09, 0x36, 0x9b, 0x3d, 0x26, 0x69, 0xcd, 0x9f, 146 0x1b, 0x9e, 0x74, 0x2e, 0x2d, 0xb2, 0xee, 0xfb, 147 0xf6, 0x4d, 0x61, 0xce, 0x7b, 0x3e, 0x71, 0x97, 148 0xf5, 0x68, 0x00, 0x2c, 0x60, 0x1f, 0xc8, 0xed, 149 0xbe, 0x46, 0xd9, 0x4b, 0xde, 0xd4, 0xe8, 0x4a, 150 0x6b, 0x2a, 0xe5, 0x16, 0xc5, 0xd7, 0x55, 0x94, 151 0xcf, 0x10, 0x06, 0x81, 0xf0, 0x44, 0xba, 0xe3, 152 0xf3, 0xfe, 0xc0, 0x8a, 0xad, 0xbc, 0x48, 0x04, 153 0xdf, 0xc1, 0x75, 0x63, 0x30, 0x1a, 0x0e, 0x6d, 154 0x4c, 0x14, 0x35, 0x2f, 0xe1, 0xa2, 0xcc, 0x39, 155 0x57, 0xf2, 0x82, 0x47, 0xac, 0xe7, 0x2b, 0x95, 156 0xa0, 0x98, 0xd1, 0x7f, 0x66, 0x7e, 0xab, 0x83, 157 0xca, 0x29, 0xd3, 0x3c, 0x79, 0xe2, 0x1d, 0x76, 158 0x3b, 0x56, 0x4e, 0x1e, 0xdb, 0x0a, 0x6c, 0xe4, 159 0x5d, 0x6e, 0xef, 0xa6, 0xa8, 0xa4, 0x37, 0x8b, 160 0x32, 0x43, 0x59, 0xb7, 0x8c, 0x64, 0xd2, 0xe0, 161 0xb4, 0xfa, 0x07, 0x25, 0xaf, 0x8e, 0xe9, 0x18, 162 0xd5, 0x88, 0x6f, 0x72, 0x24, 0xf1, 0xc7, 0x51, 163 0x23, 0x7c, 0x9c, 0x21, 0xdd, 0xdc, 0x86, 0x85, 164 0x90, 0x42, 0xc4, 0xaa, 0xd8, 0x05, 0x01, 0x12, 165 0xa3, 0x5f, 0xf9, 0xd0, 0x91, 0x58, 0x27, 0xb9, 166 0x38, 0x13, 0xb3, 0x33, 0xbb, 0x70, 0x89, 0xa7, 167 0xb6, 0x22, 0x92, 0x20, 0x49, 0xff, 0x78, 0x7a, 168 0x8f, 0xf8, 0x80, 0x17, 0xda, 0x31, 0xc6, 0xb8, 169 0xc3, 0xb0, 0x77, 0x11, 0xcb, 0xfc, 0xd6, 0x3a 170 }; 171 172 /* 173 * modular multiplication tables based on: 174 * 175 * Xtime2[x] = (x & 0x80 ? 0x1b : 0) ^ (x + x) 176 * Xtime3[x] = x^Xtime2[x]; 177 */ 178 static const u8 x_time_9[256] = { 179 0x00, 0x09, 0x12, 0x1b, 0x24, 0x2d, 0x36, 0x3f, 180 0x48, 0x41, 0x5a, 0x53, 0x6c, 0x65, 0x7e, 0x77, 181 0x90, 0x99, 0x82, 0x8b, 0xb4, 0xbd, 0xa6, 0xaf, 182 0xd8, 0xd1, 0xca, 0xc3, 0xfc, 0xf5, 0xee, 0xe7, 183 0x3b, 0x32, 0x29, 0x20, 0x1f, 0x16, 0x0d, 0x04, 184 0x73, 0x7a, 0x61, 0x68, 0x57, 0x5e, 0x45, 0x4c, 185 0xab, 0xa2, 0xb9, 0xb0, 0x8f, 0x86, 0x9d, 0x94, 186 0xe3, 0xea, 0xf1, 0xf8, 0xc7, 0xce, 0xd5, 0xdc, 187 0x76, 0x7f, 0x64, 0x6d, 0x52, 0x5b, 0x40, 0x49, 188 0x3e, 0x37, 0x2c, 0x25, 0x1a, 0x13, 0x08, 0x01, 189 0xe6, 0xef, 0xf4, 0xfd, 0xc2, 0xcb, 0xd0, 0xd9, 190 0xae, 0xa7, 0xbc, 0xb5, 0x8a, 0x83, 0x98, 0x91, 191 0x4d, 0x44, 0x5f, 0x56, 0x69, 0x60, 0x7b, 0x72, 192 0x05, 0x0c, 0x17, 0x1e, 0x21, 0x28, 0x33, 0x3a, 193 0xdd, 0xd4, 0xcf, 0xc6, 0xf9, 0xf0, 0xeb, 0xe2, 194 0x95, 0x9c, 0x87, 0x8e, 0xb1, 0xb8, 0xa3, 0xaa, 195 0xec, 0xe5, 0xfe, 0xf7, 0xc8, 0xc1, 0xda, 0xd3, 196 0xa4, 0xad, 0xb6, 0xbf, 0x80, 0x89, 0x92, 0x9b, 197 0x7c, 0x75, 0x6e, 0x67, 0x58, 0x51, 0x4a, 0x43, 198 0x34, 0x3d, 0x26, 0x2f, 0x10, 0x19, 0x02, 0x0b, 199 0xd7, 0xde, 0xc5, 0xcc, 0xf3, 0xfa, 0xe1, 0xe8, 200 0x9f, 0x96, 0x8d, 0x84, 0xbb, 0xb2, 0xa9, 0xa0, 201 0x47, 0x4e, 0x55, 0x5c, 0x63, 0x6a, 0x71, 0x78, 202 0x0f, 0x06, 0x1d, 0x14, 0x2b, 0x22, 0x39, 0x30, 203 0x9a, 0x93, 0x88, 0x81, 0xbe, 0xb7, 0xac, 0xa5, 204 0xd2, 0xdb, 0xc0, 0xc9, 0xf6, 0xff, 0xe4, 0xed, 205 0x0a, 0x03, 0x18, 0x11, 0x2e, 0x27, 0x3c, 0x35, 206 0x42, 0x4b, 0x50, 0x59, 0x66, 0x6f, 0x74, 0x7d, 207 0xa1, 0xa8, 0xb3, 0xba, 0x85, 0x8c, 0x97, 0x9e, 208 0xe9, 0xe0, 0xfb, 0xf2, 0xcd, 0xc4, 0xdf, 0xd6, 209 0x31, 0x38, 0x23, 0x2a, 0x15, 0x1c, 0x07, 0x0e, 210 0x79, 0x70, 0x6b, 0x62, 0x5d, 0x54, 0x4f, 0x46 211 }; 212 213 static const u8 x_time_b[256] = { 214 0x00, 0x0b, 0x16, 0x1d, 0x2c, 0x27, 0x3a, 0x31, 215 0x58, 0x53, 0x4e, 0x45, 0x74, 0x7f, 0x62, 0x69, 216 0xb0, 0xbb, 0xa6, 0xad, 0x9c, 0x97, 0x8a, 0x81, 217 0xe8, 0xe3, 0xfe, 0xf5, 0xc4, 0xcf, 0xd2, 0xd9, 218 0x7b, 0x70, 0x6d, 0x66, 0x57, 0x5c, 0x41, 0x4a, 219 0x23, 0x28, 0x35, 0x3e, 0x0f, 0x04, 0x19, 0x12, 220 0xcb, 0xc0, 0xdd, 0xd6, 0xe7, 0xec, 0xf1, 0xfa, 221 0x93, 0x98, 0x85, 0x8e, 0xbf, 0xb4, 0xa9, 0xa2, 222 0xf6, 0xfd, 0xe0, 0xeb, 0xda, 0xd1, 0xcc, 0xc7, 223 0xae, 0xa5, 0xb8, 0xb3, 0x82, 0x89, 0x94, 0x9f, 224 0x46, 0x4d, 0x50, 0x5b, 0x6a, 0x61, 0x7c, 0x77, 225 0x1e, 0x15, 0x08, 0x03, 0x32, 0x39, 0x24, 0x2f, 226 0x8d, 0x86, 0x9b, 0x90, 0xa1, 0xaa, 0xb7, 0xbc, 227 0xd5, 0xde, 0xc3, 0xc8, 0xf9, 0xf2, 0xef, 0xe4, 228 0x3d, 0x36, 0x2b, 0x20, 0x11, 0x1a, 0x07, 0x0c, 229 0x65, 0x6e, 0x73, 0x78, 0x49, 0x42, 0x5f, 0x54, 230 0xf7, 0xfc, 0xe1, 0xea, 0xdb, 0xd0, 0xcd, 0xc6, 231 0xaf, 0xa4, 0xb9, 0xb2, 0x83, 0x88, 0x95, 0x9e, 232 0x47, 0x4c, 0x51, 0x5a, 0x6b, 0x60, 0x7d, 0x76, 233 0x1f, 0x14, 0x09, 0x02, 0x33, 0x38, 0x25, 0x2e, 234 0x8c, 0x87, 0x9a, 0x91, 0xa0, 0xab, 0xb6, 0xbd, 235 0xd4, 0xdf, 0xc2, 0xc9, 0xf8, 0xf3, 0xee, 0xe5, 236 0x3c, 0x37, 0x2a, 0x21, 0x10, 0x1b, 0x06, 0x0d, 237 0x64, 0x6f, 0x72, 0x79, 0x48, 0x43, 0x5e, 0x55, 238 0x01, 0x0a, 0x17, 0x1c, 0x2d, 0x26, 0x3b, 0x30, 239 0x59, 0x52, 0x4f, 0x44, 0x75, 0x7e, 0x63, 0x68, 240 0xb1, 0xba, 0xa7, 0xac, 0x9d, 0x96, 0x8b, 0x80, 241 0xe9, 0xe2, 0xff, 0xf4, 0xc5, 0xce, 0xd3, 0xd8, 242 0x7a, 0x71, 0x6c, 0x67, 0x56, 0x5d, 0x40, 0x4b, 243 0x22, 0x29, 0x34, 0x3f, 0x0e, 0x05, 0x18, 0x13, 244 0xca, 0xc1, 0xdc, 0xd7, 0xe6, 0xed, 0xf0, 0xfb, 245 0x92, 0x99, 0x84, 0x8f, 0xbe, 0xb5, 0xa8, 0xa3 246 }; 247 248 static const u8 x_time_d[256] = { 249 0x00, 0x0d, 0x1a, 0x17, 0x34, 0x39, 0x2e, 0x23, 250 0x68, 0x65, 0x72, 0x7f, 0x5c, 0x51, 0x46, 0x4b, 251 0xd0, 0xdd, 0xca, 0xc7, 0xe4, 0xe9, 0xfe, 0xf3, 252 0xb8, 0xb5, 0xa2, 0xaf, 0x8c, 0x81, 0x96, 0x9b, 253 0xbb, 0xb6, 0xa1, 0xac, 0x8f, 0x82, 0x95, 0x98, 254 0xd3, 0xde, 0xc9, 0xc4, 0xe7, 0xea, 0xfd, 0xf0, 255 0x6b, 0x66, 0x71, 0x7c, 0x5f, 0x52, 0x45, 0x48, 256 0x03, 0x0e, 0x19, 0x14, 0x37, 0x3a, 0x2d, 0x20, 257 0x6d, 0x60, 0x77, 0x7a, 0x59, 0x54, 0x43, 0x4e, 258 0x05, 0x08, 0x1f, 0x12, 0x31, 0x3c, 0x2b, 0x26, 259 0xbd, 0xb0, 0xa7, 0xaa, 0x89, 0x84, 0x93, 0x9e, 260 0xd5, 0xd8, 0xcf, 0xc2, 0xe1, 0xec, 0xfb, 0xf6, 261 0xd6, 0xdb, 0xcc, 0xc1, 0xe2, 0xef, 0xf8, 0xf5, 262 0xbe, 0xb3, 0xa4, 0xa9, 0x8a, 0x87, 0x90, 0x9d, 263 0x06, 0x0b, 0x1c, 0x11, 0x32, 0x3f, 0x28, 0x25, 264 0x6e, 0x63, 0x74, 0x79, 0x5a, 0x57, 0x40, 0x4d, 265 0xda, 0xd7, 0xc0, 0xcd, 0xee, 0xe3, 0xf4, 0xf9, 266 0xb2, 0xbf, 0xa8, 0xa5, 0x86, 0x8b, 0x9c, 0x91, 267 0x0a, 0x07, 0x10, 0x1d, 0x3e, 0x33, 0x24, 0x29, 268 0x62, 0x6f, 0x78, 0x75, 0x56, 0x5b, 0x4c, 0x41, 269 0x61, 0x6c, 0x7b, 0x76, 0x55, 0x58, 0x4f, 0x42, 270 0x09, 0x04, 0x13, 0x1e, 0x3d, 0x30, 0x27, 0x2a, 271 0xb1, 0xbc, 0xab, 0xa6, 0x85, 0x88, 0x9f, 0x92, 272 0xd9, 0xd4, 0xc3, 0xce, 0xed, 0xe0, 0xf7, 0xfa, 273 0xb7, 0xba, 0xad, 0xa0, 0x83, 0x8e, 0x99, 0x94, 274 0xdf, 0xd2, 0xc5, 0xc8, 0xeb, 0xe6, 0xf1, 0xfc, 275 0x67, 0x6a, 0x7d, 0x70, 0x53, 0x5e, 0x49, 0x44, 276 0x0f, 0x02, 0x15, 0x18, 0x3b, 0x36, 0x21, 0x2c, 277 0x0c, 0x01, 0x16, 0x1b, 0x38, 0x35, 0x22, 0x2f, 278 0x64, 0x69, 0x7e, 0x73, 0x50, 0x5d, 0x4a, 0x47, 279 0xdc, 0xd1, 0xc6, 0xcb, 0xe8, 0xe5, 0xf2, 0xff, 280 0xb4, 0xb9, 0xae, 0xa3, 0x80, 0x8d, 0x9a, 0x97 281 }; 282 283 static const u8 x_time_e[256] = { 284 0x00, 0x0e, 0x1c, 0x12, 0x38, 0x36, 0x24, 0x2a, 285 0x70, 0x7e, 0x6c, 0x62, 0x48, 0x46, 0x54, 0x5a, 286 0xe0, 0xee, 0xfc, 0xf2, 0xd8, 0xd6, 0xc4, 0xca, 287 0x90, 0x9e, 0x8c, 0x82, 0xa8, 0xa6, 0xb4, 0xba, 288 0xdb, 0xd5, 0xc7, 0xc9, 0xe3, 0xed, 0xff, 0xf1, 289 0xab, 0xa5, 0xb7, 0xb9, 0x93, 0x9d, 0x8f, 0x81, 290 0x3b, 0x35, 0x27, 0x29, 0x03, 0x0d, 0x1f, 0x11, 291 0x4b, 0x45, 0x57, 0x59, 0x73, 0x7d, 0x6f, 0x61, 292 0xad, 0xa3, 0xb1, 0xbf, 0x95, 0x9b, 0x89, 0x87, 293 0xdd, 0xd3, 0xc1, 0xcf, 0xe5, 0xeb, 0xf9, 0xf7, 294 0x4d, 0x43, 0x51, 0x5f, 0x75, 0x7b, 0x69, 0x67, 295 0x3d, 0x33, 0x21, 0x2f, 0x05, 0x0b, 0x19, 0x17, 296 0x76, 0x78, 0x6a, 0x64, 0x4e, 0x40, 0x52, 0x5c, 297 0x06, 0x08, 0x1a, 0x14, 0x3e, 0x30, 0x22, 0x2c, 298 0x96, 0x98, 0x8a, 0x84, 0xae, 0xa0, 0xb2, 0xbc, 299 0xe6, 0xe8, 0xfa, 0xf4, 0xde, 0xd0, 0xc2, 0xcc, 300 0x41, 0x4f, 0x5d, 0x53, 0x79, 0x77, 0x65, 0x6b, 301 0x31, 0x3f, 0x2d, 0x23, 0x09, 0x07, 0x15, 0x1b, 302 0xa1, 0xaf, 0xbd, 0xb3, 0x99, 0x97, 0x85, 0x8b, 303 0xd1, 0xdf, 0xcd, 0xc3, 0xe9, 0xe7, 0xf5, 0xfb, 304 0x9a, 0x94, 0x86, 0x88, 0xa2, 0xac, 0xbe, 0xb0, 305 0xea, 0xe4, 0xf6, 0xf8, 0xd2, 0xdc, 0xce, 0xc0, 306 0x7a, 0x74, 0x66, 0x68, 0x42, 0x4c, 0x5e, 0x50, 307 0x0a, 0x04, 0x16, 0x18, 0x32, 0x3c, 0x2e, 0x20, 308 0xec, 0xe2, 0xf0, 0xfe, 0xd4, 0xda, 0xc8, 0xc6, 309 0x9c, 0x92, 0x80, 0x8e, 0xa4, 0xaa, 0xb8, 0xb6, 310 0x0c, 0x02, 0x10, 0x1e, 0x34, 0x3a, 0x28, 0x26, 311 0x7c, 0x72, 0x60, 0x6e, 0x44, 0x4a, 0x58, 0x56, 312 0x37, 0x39, 0x2b, 0x25, 0x0f, 0x01, 0x13, 0x1d, 313 0x47, 0x49, 0x5b, 0x55, 0x7f, 0x71, 0x63, 0x6d, 314 0xd7, 0xd9, 0xcb, 0xc5, 0xef, 0xe1, 0xf3, 0xfd, 315 0xa7, 0xa9, 0xbb, 0xb5, 0x9f, 0x91, 0x83, 0x8d 316 }; 317 318 /* 319 * Exchanges columns in each of 4 rows 320 * row0 - unchanged, row1- shifted left 1, 321 * row2 - shifted left 2 and row3 - shifted left 3 322 */ 323 static void shift_rows(u8 *state) 324 { 325 u8 tmp; 326 327 /* just substitute row 0 */ 328 state[0] = sbox[state[0]]; 329 state[4] = sbox[state[4]]; 330 state[8] = sbox[state[8]]; 331 state[12] = sbox[state[12]]; 332 333 /* rotate row 1 */ 334 tmp = sbox[state[1]]; 335 state[1] = sbox[state[5]]; 336 state[5] = sbox[state[9]]; 337 state[9] = sbox[state[13]]; 338 state[13] = tmp; 339 340 /* rotate row 2 */ 341 tmp = sbox[state[2]]; 342 state[2] = sbox[state[10]]; 343 state[10] = tmp; 344 tmp = sbox[state[6]]; 345 state[6] = sbox[state[14]]; 346 state[14] = tmp; 347 348 /* rotate row 3 */ 349 tmp = sbox[state[15]]; 350 state[15] = sbox[state[11]]; 351 state[11] = sbox[state[7]]; 352 state[7] = sbox[state[3]]; 353 state[3] = tmp; 354 } 355 356 /* 357 * restores columns in each of 4 rows 358 * row0 - unchanged, row1- shifted right 1, 359 * row2 - shifted right 2 and row3 - shifted right 3 360 */ 361 static void inv_shift_rows(u8 *state) 362 { 363 u8 tmp; 364 365 /* restore row 0 */ 366 state[0] = inv_sbox[state[0]]; 367 state[4] = inv_sbox[state[4]]; 368 state[8] = inv_sbox[state[8]]; 369 state[12] = inv_sbox[state[12]]; 370 371 /* restore row 1 */ 372 tmp = inv_sbox[state[13]]; 373 state[13] = inv_sbox[state[9]]; 374 state[9] = inv_sbox[state[5]]; 375 state[5] = inv_sbox[state[1]]; 376 state[1] = tmp; 377 378 /* restore row 2 */ 379 tmp = inv_sbox[state[2]]; 380 state[2] = inv_sbox[state[10]]; 381 state[10] = tmp; 382 tmp = inv_sbox[state[6]]; 383 state[6] = inv_sbox[state[14]]; 384 state[14] = tmp; 385 386 /* restore row 3 */ 387 tmp = inv_sbox[state[3]]; 388 state[3] = inv_sbox[state[7]]; 389 state[7] = inv_sbox[state[11]]; 390 state[11] = inv_sbox[state[15]]; 391 state[15] = tmp; 392 } 393 394 /* recombine and mix each row in a column */ 395 static void mix_sub_columns(u8 *state) 396 { 397 u8 tmp[4 * AES_STATECOLS]; 398 399 /* mixing column 0 */ 400 tmp[0] = x2_sbox[state[0]] ^ x3_sbox[state[5]] ^ 401 sbox[state[10]] ^ sbox[state[15]]; 402 tmp[1] = sbox[state[0]] ^ x2_sbox[state[5]] ^ 403 x3_sbox[state[10]] ^ sbox[state[15]]; 404 tmp[2] = sbox[state[0]] ^ sbox[state[5]] ^ 405 x2_sbox[state[10]] ^ x3_sbox[state[15]]; 406 tmp[3] = x3_sbox[state[0]] ^ sbox[state[5]] ^ 407 sbox[state[10]] ^ x2_sbox[state[15]]; 408 409 /* mixing column 1 */ 410 tmp[4] = x2_sbox[state[4]] ^ x3_sbox[state[9]] ^ 411 sbox[state[14]] ^ sbox[state[3]]; 412 tmp[5] = sbox[state[4]] ^ x2_sbox[state[9]] ^ 413 x3_sbox[state[14]] ^ sbox[state[3]]; 414 tmp[6] = sbox[state[4]] ^ sbox[state[9]] ^ 415 x2_sbox[state[14]] ^ x3_sbox[state[3]]; 416 tmp[7] = x3_sbox[state[4]] ^ sbox[state[9]] ^ 417 sbox[state[14]] ^ x2_sbox[state[3]]; 418 419 /* mixing column 2 */ 420 tmp[8] = x2_sbox[state[8]] ^ x3_sbox[state[13]] ^ 421 sbox[state[2]] ^ sbox[state[7]]; 422 tmp[9] = sbox[state[8]] ^ x2_sbox[state[13]] ^ 423 x3_sbox[state[2]] ^ sbox[state[7]]; 424 tmp[10] = sbox[state[8]] ^ sbox[state[13]] ^ 425 x2_sbox[state[2]] ^ x3_sbox[state[7]]; 426 tmp[11] = x3_sbox[state[8]] ^ sbox[state[13]] ^ 427 sbox[state[2]] ^ x2_sbox[state[7]]; 428 429 /* mixing column 3 */ 430 tmp[12] = x2_sbox[state[12]] ^ x3_sbox[state[1]] ^ 431 sbox[state[6]] ^ sbox[state[11]]; 432 tmp[13] = sbox[state[12]] ^ x2_sbox[state[1]] ^ 433 x3_sbox[state[6]] ^ sbox[state[11]]; 434 tmp[14] = sbox[state[12]] ^ sbox[state[1]] ^ 435 x2_sbox[state[6]] ^ x3_sbox[state[11]]; 436 tmp[15] = x3_sbox[state[12]] ^ sbox[state[1]] ^ 437 sbox[state[6]] ^ x2_sbox[state[11]]; 438 439 memcpy(state, tmp, sizeof(tmp)); 440 } 441 442 /* restore and un-mix each row in a column */ 443 static void inv_mix_sub_columns(u8 *state) 444 { 445 u8 tmp[4 * AES_STATECOLS]; 446 int i; 447 448 /* restore column 0 */ 449 tmp[0] = x_time_e[state[0]] ^ x_time_b[state[1]] ^ 450 x_time_d[state[2]] ^ x_time_9[state[3]]; 451 tmp[5] = x_time_9[state[0]] ^ x_time_e[state[1]] ^ 452 x_time_b[state[2]] ^ x_time_d[state[3]]; 453 tmp[10] = x_time_d[state[0]] ^ x_time_9[state[1]] ^ 454 x_time_e[state[2]] ^ x_time_b[state[3]]; 455 tmp[15] = x_time_b[state[0]] ^ x_time_d[state[1]] ^ 456 x_time_9[state[2]] ^ x_time_e[state[3]]; 457 458 /* restore column 1 */ 459 tmp[4] = x_time_e[state[4]] ^ x_time_b[state[5]] ^ 460 x_time_d[state[6]] ^ x_time_9[state[7]]; 461 tmp[9] = x_time_9[state[4]] ^ x_time_e[state[5]] ^ 462 x_time_b[state[6]] ^ x_time_d[state[7]]; 463 tmp[14] = x_time_d[state[4]] ^ x_time_9[state[5]] ^ 464 x_time_e[state[6]] ^ x_time_b[state[7]]; 465 tmp[3] = x_time_b[state[4]] ^ x_time_d[state[5]] ^ 466 x_time_9[state[6]] ^ x_time_e[state[7]]; 467 468 /* restore column 2 */ 469 tmp[8] = x_time_e[state[8]] ^ x_time_b[state[9]] ^ 470 x_time_d[state[10]] ^ x_time_9[state[11]]; 471 tmp[13] = x_time_9[state[8]] ^ x_time_e[state[9]] ^ 472 x_time_b[state[10]] ^ x_time_d[state[11]]; 473 tmp[2] = x_time_d[state[8]] ^ x_time_9[state[9]] ^ 474 x_time_e[state[10]] ^ x_time_b[state[11]]; 475 tmp[7] = x_time_b[state[8]] ^ x_time_d[state[9]] ^ 476 x_time_9[state[10]] ^ x_time_e[state[11]]; 477 478 /* restore column 3 */ 479 tmp[12] = x_time_e[state[12]] ^ x_time_b[state[13]] ^ 480 x_time_d[state[14]] ^ x_time_9[state[15]]; 481 tmp[1] = x_time_9[state[12]] ^ x_time_e[state[13]] ^ 482 x_time_b[state[14]] ^ x_time_d[state[15]]; 483 tmp[6] = x_time_d[state[12]] ^ x_time_9[state[13]] ^ 484 x_time_e[state[14]] ^ x_time_b[state[15]]; 485 tmp[11] = x_time_b[state[12]] ^ x_time_d[state[13]] ^ 486 x_time_9[state[14]] ^ x_time_e[state[15]]; 487 488 for (i = 0; i < 4 * AES_STATECOLS; i++) 489 state[i] = inv_sbox[tmp[i]]; 490 } 491 492 /* 493 * encrypt/decrypt columns of the key 494 * n.b. you can replace this with byte-wise xor if you wish. 495 */ 496 static void add_round_key(u32 *state, u32 *key) 497 { 498 int idx; 499 500 for (idx = 0; idx < 4; idx++) 501 state[idx] ^= key[idx]; 502 } 503 504 static u8 rcon[11] = { 505 0x00, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36 506 }; 507 508 /* produce AES_STATECOLS bytes for each round */ 509 void aes_expand_key(u8 *key, u8 *expkey) 510 { 511 u8 tmp0, tmp1, tmp2, tmp3, tmp4; 512 u32 idx; 513 514 memcpy(expkey, key, AES_KEYCOLS * 4); 515 516 for (idx = AES_KEYCOLS; idx < AES_STATECOLS * (AES_ROUNDS + 1); idx++) { 517 tmp0 = expkey[4*idx - 4]; 518 tmp1 = expkey[4*idx - 3]; 519 tmp2 = expkey[4*idx - 2]; 520 tmp3 = expkey[4*idx - 1]; 521 if (!(idx % AES_KEYCOLS)) { 522 tmp4 = tmp3; 523 tmp3 = sbox[tmp0]; 524 tmp0 = sbox[tmp1] ^ rcon[idx / AES_KEYCOLS]; 525 tmp1 = sbox[tmp2]; 526 tmp2 = sbox[tmp4]; 527 } else if ((AES_KEYCOLS > 6) && (idx % AES_KEYCOLS == 4)) { 528 tmp0 = sbox[tmp0]; 529 tmp1 = sbox[tmp1]; 530 tmp2 = sbox[tmp2]; 531 tmp3 = sbox[tmp3]; 532 } 533 534 expkey[4*idx+0] = expkey[4*idx - 4*AES_KEYCOLS + 0] ^ tmp0; 535 expkey[4*idx+1] = expkey[4*idx - 4*AES_KEYCOLS + 1] ^ tmp1; 536 expkey[4*idx+2] = expkey[4*idx - 4*AES_KEYCOLS + 2] ^ tmp2; 537 expkey[4*idx+3] = expkey[4*idx - 4*AES_KEYCOLS + 3] ^ tmp3; 538 } 539 } 540 541 /* encrypt one 128 bit block */ 542 void aes_encrypt(u8 *in, u8 *expkey, u8 *out) 543 { 544 u8 state[AES_STATECOLS * 4]; 545 u32 round; 546 547 memcpy(state, in, AES_STATECOLS * 4); 548 add_round_key((u32 *)state, (u32 *)expkey); 549 550 for (round = 1; round < AES_ROUNDS + 1; round++) { 551 if (round < AES_ROUNDS) 552 mix_sub_columns(state); 553 else 554 shift_rows(state); 555 556 add_round_key((u32 *)state, 557 (u32 *)expkey + round * AES_STATECOLS); 558 } 559 560 memcpy(out, state, sizeof(state)); 561 } 562 563 void aes_decrypt(u8 *in, u8 *expkey, u8 *out) 564 { 565 u8 state[AES_STATECOLS * 4]; 566 int round; 567 568 memcpy(state, in, sizeof(state)); 569 570 add_round_key((u32 *)state, 571 (u32 *)expkey + AES_ROUNDS * AES_STATECOLS); 572 inv_shift_rows(state); 573 574 for (round = AES_ROUNDS; round--; ) { 575 add_round_key((u32 *)state, 576 (u32 *)expkey + round * AES_STATECOLS); 577 if (round) 578 inv_mix_sub_columns(state); 579 } 580 581 memcpy(out, state, sizeof(state)); 582 } 583