10 #include <botan/aes.h>
11 #include <botan/loadstor.h>
12 #include <botan/cpuid.h>
13 #include <botan/internal/bit_ops.h>
50 const uint8_t SE[256] = {
51 0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B,
52 0xFE, 0xD7, 0xAB, 0x76, 0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0,
53 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0, 0xB7, 0xFD, 0x93, 0x26,
54 0x36, 0x3F, 0xF7, 0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,
55 0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2,
56 0xEB, 0x27, 0xB2, 0x75, 0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0,
57 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84, 0x53, 0xD1, 0x00, 0xED,
58 0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,
59 0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 0x45, 0xF9, 0x02, 0x7F,
60 0x50, 0x3C, 0x9F, 0xA8, 0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5,
61 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2, 0xCD, 0x0C, 0x13, 0xEC,
62 0x5F, 0x97, 0x44, 0x17, 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73,
63 0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 0x46, 0xEE, 0xB8, 0x14,
64 0xDE, 0x5E, 0x0B, 0xDB, 0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C,
65 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79, 0xE7, 0xC8, 0x37, 0x6D,
66 0x8D, 0xD5, 0x4E, 0xA9, 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08,
67 0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 0xE8, 0xDD, 0x74, 0x1F,
68 0x4B, 0xBD, 0x8B, 0x8A, 0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E,
69 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E, 0xE1, 0xF8, 0x98, 0x11,
70 0x69, 0xD9, 0x8E, 0x94, 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,
71 0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 0x41, 0x99, 0x2D, 0x0F,
72 0xB0, 0x54, 0xBB, 0x16 };
74 const uint8_t SD[256] = {
75 0x52, 0x09, 0x6A, 0xD5, 0x30, 0x36, 0xA5, 0x38, 0xBF, 0x40, 0xA3, 0x9E,
76 0x81, 0xF3, 0xD7, 0xFB, 0x7C, 0xE3, 0x39, 0x82, 0x9B, 0x2F, 0xFF, 0x87,
77 0x34, 0x8E, 0x43, 0x44, 0xC4, 0xDE, 0xE9, 0xCB, 0x54, 0x7B, 0x94, 0x32,
78 0xA6, 0xC2, 0x23, 0x3D, 0xEE, 0x4C, 0x95, 0x0B, 0x42, 0xFA, 0xC3, 0x4E,
79 0x08, 0x2E, 0xA1, 0x66, 0x28, 0xD9, 0x24, 0xB2, 0x76, 0x5B, 0xA2, 0x49,
80 0x6D, 0x8B, 0xD1, 0x25, 0x72, 0xF8, 0xF6, 0x64, 0x86, 0x68, 0x98, 0x16,
81 0xD4, 0xA4, 0x5C, 0xCC, 0x5D, 0x65, 0xB6, 0x92, 0x6C, 0x70, 0x48, 0x50,
82 0xFD, 0xED, 0xB9, 0xDA, 0x5E, 0x15, 0x46, 0x57, 0xA7, 0x8D, 0x9D, 0x84,
83 0x90, 0xD8, 0xAB, 0x00, 0x8C, 0xBC, 0xD3, 0x0A, 0xF7, 0xE4, 0x58, 0x05,
84 0xB8, 0xB3, 0x45, 0x06, 0xD0, 0x2C, 0x1E, 0x8F, 0xCA, 0x3F, 0x0F, 0x02,
85 0xC1, 0xAF, 0xBD, 0x03, 0x01, 0x13, 0x8A, 0x6B, 0x3A, 0x91, 0x11, 0x41,
86 0x4F, 0x67, 0xDC, 0xEA, 0x97, 0xF2, 0xCF, 0xCE, 0xF0, 0xB4, 0xE6, 0x73,
87 0x96, 0xAC, 0x74, 0x22, 0xE7, 0xAD, 0x35, 0x85, 0xE2, 0xF9, 0x37, 0xE8,
88 0x1C, 0x75, 0xDF, 0x6E, 0x47, 0xF1, 0x1A, 0x71, 0x1D, 0x29, 0xC5, 0x89,
89 0x6F, 0xB7, 0x62, 0x0E, 0xAA, 0x18, 0xBE, 0x1B, 0xFC, 0x56, 0x3E, 0x4B,
90 0xC6, 0xD2, 0x79, 0x20, 0x9A, 0xDB, 0xC0, 0xFE, 0x78, 0xCD, 0x5A, 0xF4,
91 0x1F, 0xDD, 0xA8, 0x33, 0x88, 0x07, 0xC7, 0x31, 0xB1, 0x12, 0x10, 0x59,
92 0x27, 0x80, 0xEC, 0x5F, 0x60, 0x51, 0x7F, 0xA9, 0x19, 0xB5, 0x4A, 0x0D,
93 0x2D, 0xE5, 0x7A, 0x9F, 0x93, 0xC9, 0x9C, 0xEF, 0xA0, 0xE0, 0x3B, 0x4D,
94 0xAE, 0x2A, 0xF5, 0xB0, 0xC8, 0xEB, 0xBB, 0x3C, 0x83, 0x53, 0x99, 0x61,
95 0x17, 0x2B, 0x04, 0x7E, 0xBA, 0x77, 0xD6, 0x26, 0xE1, 0x69, 0x14, 0x63,
96 0x55, 0x21, 0x0C, 0x7D };
98 inline uint8_t xtime(uint8_t s) {
return (s << 1) ^ ((s >> 7) * 0x1B); }
99 inline uint8_t xtime4(uint8_t s) {
return xtime(xtime(s)); }
100 inline uint8_t xtime8(uint8_t s) {
return xtime(xtime(xtime(s))); }
102 inline uint8_t xtime3(uint8_t s) {
return xtime(s) ^ s; }
103 inline uint8_t xtime9(uint8_t s) {
return xtime8(s) ^ s; }
104 inline uint8_t xtime11(uint8_t s) {
return xtime8(s) ^ xtime(s) ^ s; }
105 inline uint8_t xtime13(uint8_t s) {
return xtime8(s) ^ xtime4(s) ^ s; }
106 inline uint8_t xtime14(uint8_t s) {
return xtime8(s) ^ xtime4(s) ^ xtime(s); }
108 const std::vector<uint32_t>& AES_TE()
110 auto compute_TE = []() -> std::vector<uint32_t> {
111 std::vector<uint32_t> TE(1024);
112 for(
size_t i = 0; i != 256; ++i)
114 const uint8_t s = SE[i];
115 const uint32_t x =
make_uint32(xtime(s), s, s, xtime3(s));
125 static const std::vector<uint32_t> TE = compute_TE();
129 const std::vector<uint32_t>& AES_TD()
131 auto compute_TD = []() -> std::vector<uint32_t> {
132 std::vector<uint32_t> TD(1024);
133 for(
size_t i = 0; i != 256; ++i)
135 const uint8_t s = SD[i];
136 const uint32_t x =
make_uint32(xtime14(s), xtime9(s), xtime13(s), xtime11(s));
145 static const std::vector<uint32_t> TD = compute_TD();
152 void aes_encrypt_n(
const uint8_t in[], uint8_t out[],
154 const secure_vector<uint32_t>& EK,
155 const secure_vector<uint8_t>& ME)
157 BOTAN_ASSERT(EK.size() && ME.size() == 16,
"Key was set");
161 const std::vector<uint32_t>& TE = AES_TE();
165 for(
size_t i = 0; i < TE.size(); i += cache_line_size /
sizeof(uint32_t))
173 uint32_t T0, T1, T2, T3;
174 load_be(in + 16*i, T0, T1, T2, T3);
211 for(
size_t r = 2*4; r < EK.size(); r += 2*4)
232 out[16*i+ 0] = SE[
get_byte(0, B0)] ^ ME[0];
233 out[16*i+ 1] = SE[
get_byte(1, B1)] ^ ME[1];
234 out[16*i+ 2] = SE[
get_byte(2, B2)] ^ ME[2];
235 out[16*i+ 3] = SE[
get_byte(3, B3)] ^ ME[3];
236 out[16*i+ 4] = SE[
get_byte(0, B1)] ^ ME[4];
237 out[16*i+ 5] = SE[
get_byte(1, B2)] ^ ME[5];
238 out[16*i+ 6] = SE[
get_byte(2, B3)] ^ ME[6];
239 out[16*i+ 7] = SE[
get_byte(3, B0)] ^ ME[7];
240 out[16*i+ 8] = SE[
get_byte(0, B2)] ^ ME[8];
241 out[16*i+ 9] = SE[
get_byte(1, B3)] ^ ME[9];
242 out[16*i+10] = SE[
get_byte(2, B0)] ^ ME[10];
243 out[16*i+11] = SE[
get_byte(3, B1)] ^ ME[11];
244 out[16*i+12] = SE[
get_byte(0, B3)] ^ ME[12];
245 out[16*i+13] = SE[
get_byte(1, B0)] ^ ME[13];
246 out[16*i+14] = SE[
get_byte(2, B1)] ^ ME[14];
247 out[16*i+15] = SE[
get_byte(3, B2)] ^ ME[15];
254 void aes_decrypt_n(
const uint8_t in[], uint8_t out[],
size_t blocks,
255 const secure_vector<uint32_t>& DK,
256 const secure_vector<uint8_t>& MD)
258 BOTAN_ASSERT(DK.size() && MD.size() == 16,
"Key was set");
261 const std::vector<uint32_t>& TD = AES_TD();
264 for(
size_t i = 0; i < TD.size(); i += cache_line_size /
sizeof(uint32_t))
270 for(
size_t i = 0; i != blocks; ++i)
299 for(
size_t r = 2*4; r < DK.size(); r += 2*4)
320 out[ 0] = SD[
get_byte(0, B0)] ^ MD[0];
321 out[ 1] = SD[
get_byte(1, B3)] ^ MD[1];
322 out[ 2] = SD[
get_byte(2, B2)] ^ MD[2];
323 out[ 3] = SD[
get_byte(3, B1)] ^ MD[3];
324 out[ 4] = SD[
get_byte(0, B1)] ^ MD[4];
325 out[ 5] = SD[
get_byte(1, B0)] ^ MD[5];
326 out[ 6] = SD[
get_byte(2, B3)] ^ MD[6];
327 out[ 7] = SD[
get_byte(3, B2)] ^ MD[7];
328 out[ 8] = SD[
get_byte(0, B2)] ^ MD[8];
329 out[ 9] = SD[
get_byte(1, B1)] ^ MD[9];
330 out[10] = SD[
get_byte(2, B0)] ^ MD[10];
331 out[11] = SD[
get_byte(3, B3)] ^ MD[11];
332 out[12] = SD[
get_byte(0, B3)] ^ MD[12];
333 out[13] = SD[
get_byte(1, B2)] ^ MD[13];
334 out[14] = SD[
get_byte(2, B1)] ^ MD[14];
335 out[15] = SD[
get_byte(3, B0)] ^ MD[15];
342 void aes_key_schedule(
const uint8_t key[],
size_t length,
343 secure_vector<uint32_t>& EK,
344 secure_vector<uint32_t>& DK,
345 secure_vector<uint8_t>& ME,
346 secure_vector<uint8_t>& MD)
348 static const uint32_t RC[10] = {
349 0x01000000, 0x02000000, 0x04000000, 0x08000000, 0x10000000,
350 0x20000000, 0x40000000, 0x80000000, 0x1B000000, 0x36000000 };
352 const size_t rounds = (length / 4) + 6;
354 secure_vector<uint32_t> XEK(length + 32), XDK(length + 32);
356 const size_t X = length / 4;
359 BOTAN_ASSERT(X == 4 || X == 6 || X == 8,
"Valid AES key size");
361 for(
size_t i = 0; i != X; ++i)
364 for(
size_t i = X; i < 4*(rounds+1); i += X)
366 XEK[i] = XEK[i-X] ^ RC[(i-X)/X] ^
372 for(
size_t j = 1; j != X; ++j)
374 XEK[i+j] = XEK[i+j-X];
382 XEK[i+j] ^= XEK[i+j-1];
386 const std::vector<uint32_t>& TD = AES_TD();
388 for(
size_t i = 0; i != 4*(rounds+1); i += 4)
390 XDK[i ] = XEK[4*rounds-i ];
391 XDK[i+1] = XEK[4*rounds-i+1];
392 XDK[i+2] = XEK[4*rounds-i+2];
393 XDK[i+3] = XEK[4*rounds-i+3];
396 for(
size_t i = 4; i != length + 24; ++i)
397 XDK[i] = TD[SE[
get_byte(0, XDK[i])] + 0] ^
405 for(
size_t i = 0; i != 4; ++i)
407 store_be(XEK[i+4*rounds], &ME[4*i]);
411 EK.resize(length + 24);
412 DK.resize(length + 24);
413 copy_mem(EK.data(), XEK.data(), EK.size());
414 copy_mem(DK.data(), XDK.data(), DK.size());
417 const char* aes_provider()
419 #if defined(BOTAN_HAS_AES_NI)
420 if(CPUID::has_aes_ni())
426 #if defined(BOTAN_HAS_AES_SSSE3)
427 if(CPUID::has_ssse3())
444 #if defined(BOTAN_HAS_AES_NI)
445 if(CPUID::has_aes_ni())
447 return aesni_encrypt_n(in, out, blocks);
451 #if defined(BOTAN_HAS_AES_SSSE3)
452 if(CPUID::has_ssse3())
454 return ssse3_encrypt_n(in, out, blocks);
458 aes_encrypt_n(in, out, blocks, m_EK, m_ME);
463 #if defined(BOTAN_HAS_AES_NI)
464 if(CPUID::has_aes_ni())
466 return aesni_decrypt_n(in, out, blocks);
470 #if defined(BOTAN_HAS_AES_SSSE3)
471 if(CPUID::has_ssse3())
473 return ssse3_decrypt_n(in, out, blocks);
477 aes_decrypt_n(in, out, blocks, m_DK, m_MD);
480 void AES_128::key_schedule(
const uint8_t key[],
size_t length)
482 #if defined(BOTAN_HAS_AES_NI)
483 if(CPUID::has_aes_ni())
485 return aesni_key_schedule(key, length);
489 #if defined(BOTAN_HAS_AES_SSSE3)
490 if(CPUID::has_ssse3())
492 return ssse3_key_schedule(key, length);
496 aes_key_schedule(key, length, m_EK, m_DK, m_ME, m_MD);
509 #if defined(BOTAN_HAS_AES_NI)
510 if(CPUID::has_aes_ni())
512 return aesni_encrypt_n(in, out, blocks);
516 #if defined(BOTAN_HAS_AES_SSSE3)
517 if(CPUID::has_ssse3())
519 return ssse3_encrypt_n(in, out, blocks);
523 aes_encrypt_n(in, out, blocks, m_EK, m_ME);
528 #if defined(BOTAN_HAS_AES_NI)
529 if(CPUID::has_aes_ni())
531 return aesni_decrypt_n(in, out, blocks);
535 #if defined(BOTAN_HAS_AES_SSSE3)
536 if(CPUID::has_ssse3())
538 return ssse3_decrypt_n(in, out, blocks);
542 aes_decrypt_n(in, out, blocks, m_DK, m_MD);
545 void AES_192::key_schedule(
const uint8_t key[],
size_t length)
547 #if defined(BOTAN_HAS_AES_NI)
548 if(CPUID::has_aes_ni())
550 return aesni_key_schedule(key, length);
554 #if defined(BOTAN_HAS_AES_SSSE3)
555 if(CPUID::has_ssse3())
557 return ssse3_key_schedule(key, length);
561 aes_key_schedule(key, length, m_EK, m_DK, m_ME, m_MD);
574 #if defined(BOTAN_HAS_AES_NI)
575 if(CPUID::has_aes_ni())
577 return aesni_encrypt_n(in, out, blocks);
581 #if defined(BOTAN_HAS_AES_SSSE3)
582 if(CPUID::has_ssse3())
584 return ssse3_encrypt_n(in, out, blocks);
588 aes_encrypt_n(in, out, blocks, m_EK, m_ME);
593 #if defined(BOTAN_HAS_AES_NI)
594 if(CPUID::has_aes_ni())
596 return aesni_decrypt_n(in, out, blocks);
600 #if defined(BOTAN_HAS_AES_SSSE3)
601 if(CPUID::has_ssse3())
603 return ssse3_decrypt_n(in, out, blocks);
607 aes_decrypt_n(in, out, blocks, m_DK, m_MD);
610 void AES_256::key_schedule(
const uint8_t key[],
size_t length)
612 #if defined(BOTAN_HAS_AES_NI)
613 if(CPUID::has_aes_ni())
615 return aesni_key_schedule(key, length);
619 #if defined(BOTAN_HAS_AES_SSSE3)
620 if(CPUID::has_ssse3())
622 return ssse3_key_schedule(key, length);
626 aes_key_schedule(key, length, m_EK, m_DK, m_ME, m_MD);
void encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const override
void zap(std::vector< T, Alloc > &vec)
void store_be(uint16_t in, uint8_t out[2])
void decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const override
uint32_t load_be< uint32_t >(const uint8_t in[], size_t off)
static size_t cache_line_size()
#define BOTAN_PARALLEL_FOR
#define BOTAN_ASSERT(expr, assertion_made)
std::string provider() const override
T rotate_right(T input, size_t rot)
T load_be(const uint8_t in[], size_t off)
std::string provider() const override
void decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const override
void copy_mem(T *out, const T *in, size_t n)
void encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const override
std::string provider() const override
void decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const override
uint8_t get_byte(size_t byte_num, T input)
void encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const override
uint32_t make_uint32(uint8_t i0, uint8_t i1, uint8_t i2, uint8_t i3)