1 /*
2 * FIPS-197 compliant AES implementation
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 */
19 /*
20 * The AES block cipher was designed by Vincent Rijmen and Joan Daemen.
21 *
22 * http://csrc.nist.gov/encryption/aes/rijndael/Rijndael.pdf
23 * http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf
24 */
25
26 #include "common.h"
27
28 #if defined(MBEDTLS_AES_C)
29
30 #include <string.h>
31
32 #include "mbedtls/aes.h"
33 #include "mbedtls/platform.h"
34 #include "mbedtls/platform_util.h"
35 #include "mbedtls/error.h"
36 #if defined(MBEDTLS_PADLOCK_C)
37 #include "padlock.h"
38 #endif
39 #if defined(MBEDTLS_AESNI_C)
40 #include "aesni.h"
41 #endif
42
43 #if defined(MBEDTLS_SELF_TEST)
44 #if defined(MBEDTLS_PLATFORM_C)
45 #include "mbedtls/platform.h"
46 #else
47 #include <stdio.h>
48 #define mbedtls_printf printf
49 #endif /* MBEDTLS_PLATFORM_C */
50 #endif /* MBEDTLS_SELF_TEST */
51
52 #if !defined(MBEDTLS_AES_ALT)
53
54 /* Parameter validation macros based on platform_util.h */
55 #define AES_VALIDATE_RET( cond ) \
56 MBEDTLS_INTERNAL_VALIDATE_RET( cond, MBEDTLS_ERR_AES_BAD_INPUT_DATA )
57 #define AES_VALIDATE( cond ) \
58 MBEDTLS_INTERNAL_VALIDATE( cond )
59
60 #if defined(MBEDTLS_PADLOCK_C) && \
61 ( defined(MBEDTLS_HAVE_X86) || defined(MBEDTLS_PADLOCK_ALIGN16) )
62 static int aes_padlock_ace = -1;
63 #endif
64
65 #if defined(MBEDTLS_AES_ROM_TABLES)
66 /*
67 * Forward S-box
68 */
69 static const unsigned char FSb[256] =
70 {
71 0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5,
72 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76,
73 0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0,
74 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0,
75 0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC,
76 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,
77 0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A,
78 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75,
79 0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0,
80 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84,
81 0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B,
82 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,
83 0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85,
84 0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8,
85 0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5,
86 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2,
87 0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17,
88 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73,
89 0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88,
90 0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB,
91 0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C,
92 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79,
93 0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9,
94 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08,
95 0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6,
96 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A,
97 0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E,
98 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E,
99 0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94,
100 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,
101 0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68,
102 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16
103 };
104
105 /*
106 * Forward tables
107 */
108 #define FT \
109 \
110 V(A5,63,63,C6), V(84,7C,7C,F8), V(99,77,77,EE), V(8D,7B,7B,F6), \
111 V(0D,F2,F2,FF), V(BD,6B,6B,D6), V(B1,6F,6F,DE), V(54,C5,C5,91), \
112 V(50,30,30,60), V(03,01,01,02), V(A9,67,67,CE), V(7D,2B,2B,56), \
113 V(19,FE,FE,E7), V(62,D7,D7,B5), V(E6,AB,AB,4D), V(9A,76,76,EC), \
114 V(45,CA,CA,8F), V(9D,82,82,1F), V(40,C9,C9,89), V(87,7D,7D,FA), \
115 V(15,FA,FA,EF), V(EB,59,59,B2), V(C9,47,47,8E), V(0B,F0,F0,FB), \
116 V(EC,AD,AD,41), V(67,D4,D4,B3), V(FD,A2,A2,5F), V(EA,AF,AF,45), \
117 V(BF,9C,9C,23), V(F7,A4,A4,53), V(96,72,72,E4), V(5B,C0,C0,9B), \
118 V(C2,B7,B7,75), V(1C,FD,FD,E1), V(AE,93,93,3D), V(6A,26,26,4C), \
119 V(5A,36,36,6C), V(41,3F,3F,7E), V(02,F7,F7,F5), V(4F,CC,CC,83), \
120 V(5C,34,34,68), V(F4,A5,A5,51), V(34,E5,E5,D1), V(08,F1,F1,F9), \
121 V(93,71,71,E2), V(73,D8,D8,AB), V(53,31,31,62), V(3F,15,15,2A), \
122 V(0C,04,04,08), V(52,C7,C7,95), V(65,23,23,46), V(5E,C3,C3,9D), \
123 V(28,18,18,30), V(A1,96,96,37), V(0F,05,05,0A), V(B5,9A,9A,2F), \
124 V(09,07,07,0E), V(36,12,12,24), V(9B,80,80,1B), V(3D,E2,E2,DF), \
125 V(26,EB,EB,CD), V(69,27,27,4E), V(CD,B2,B2,7F), V(9F,75,75,EA), \
126 V(1B,09,09,12), V(9E,83,83,1D), V(74,2C,2C,58), V(2E,1A,1A,34), \
127 V(2D,1B,1B,36), V(B2,6E,6E,DC), V(EE,5A,5A,B4), V(FB,A0,A0,5B), \
128 V(F6,52,52,A4), V(4D,3B,3B,76), V(61,D6,D6,B7), V(CE,B3,B3,7D), \
129 V(7B,29,29,52), V(3E,E3,E3,DD), V(71,2F,2F,5E), V(97,84,84,13), \
130 V(F5,53,53,A6), V(68,D1,D1,B9), V(00,00,00,00), V(2C,ED,ED,C1), \
131 V(60,20,20,40), V(1F,FC,FC,E3), V(C8,B1,B1,79), V(ED,5B,5B,B6), \
132 V(BE,6A,6A,D4), V(46,CB,CB,8D), V(D9,BE,BE,67), V(4B,39,39,72), \
133 V(DE,4A,4A,94), V(D4,4C,4C,98), V(E8,58,58,B0), V(4A,CF,CF,85), \
134 V(6B,D0,D0,BB), V(2A,EF,EF,C5), V(E5,AA,AA,4F), V(16,FB,FB,ED), \
135 V(C5,43,43,86), V(D7,4D,4D,9A), V(55,33,33,66), V(94,85,85,11), \
136 V(CF,45,45,8A), V(10,F9,F9,E9), V(06,02,02,04), V(81,7F,7F,FE), \
137 V(F0,50,50,A0), V(44,3C,3C,78), V(BA,9F,9F,25), V(E3,A8,A8,4B), \
138 V(F3,51,51,A2), V(FE,A3,A3,5D), V(C0,40,40,80), V(8A,8F,8F,05), \
139 V(AD,92,92,3F), V(BC,9D,9D,21), V(48,38,38,70), V(04,F5,F5,F1), \
140 V(DF,BC,BC,63), V(C1,B6,B6,77), V(75,DA,DA,AF), V(63,21,21,42), \
141 V(30,10,10,20), V(1A,FF,FF,E5), V(0E,F3,F3,FD), V(6D,D2,D2,BF), \
142 V(4C,CD,CD,81), V(14,0C,0C,18), V(35,13,13,26), V(2F,EC,EC,C3), \
143 V(E1,5F,5F,BE), V(A2,97,97,35), V(CC,44,44,88), V(39,17,17,2E), \
144 V(57,C4,C4,93), V(F2,A7,A7,55), V(82,7E,7E,FC), V(47,3D,3D,7A), \
145 V(AC,64,64,C8), V(E7,5D,5D,BA), V(2B,19,19,32), V(95,73,73,E6), \
146 V(A0,60,60,C0), V(98,81,81,19), V(D1,4F,4F,9E), V(7F,DC,DC,A3), \
147 V(66,22,22,44), V(7E,2A,2A,54), V(AB,90,90,3B), V(83,88,88,0B), \
148 V(CA,46,46,8C), V(29,EE,EE,C7), V(D3,B8,B8,6B), V(3C,14,14,28), \
149 V(79,DE,DE,A7), V(E2,5E,5E,BC), V(1D,0B,0B,16), V(76,DB,DB,AD), \
150 V(3B,E0,E0,DB), V(56,32,32,64), V(4E,3A,3A,74), V(1E,0A,0A,14), \
151 V(DB,49,49,92), V(0A,06,06,0C), V(6C,24,24,48), V(E4,5C,5C,B8), \
152 V(5D,C2,C2,9F), V(6E,D3,D3,BD), V(EF,AC,AC,43), V(A6,62,62,C4), \
153 V(A8,91,91,39), V(A4,95,95,31), V(37,E4,E4,D3), V(8B,79,79,F2), \
154 V(32,E7,E7,D5), V(43,C8,C8,8B), V(59,37,37,6E), V(B7,6D,6D,DA), \
155 V(8C,8D,8D,01), V(64,D5,D5,B1), V(D2,4E,4E,9C), V(E0,A9,A9,49), \
156 V(B4,6C,6C,D8), V(FA,56,56,AC), V(07,F4,F4,F3), V(25,EA,EA,CF), \
157 V(AF,65,65,CA), V(8E,7A,7A,F4), V(E9,AE,AE,47), V(18,08,08,10), \
158 V(D5,BA,BA,6F), V(88,78,78,F0), V(6F,25,25,4A), V(72,2E,2E,5C), \
159 V(24,1C,1C,38), V(F1,A6,A6,57), V(C7,B4,B4,73), V(51,C6,C6,97), \
160 V(23,E8,E8,CB), V(7C,DD,DD,A1), V(9C,74,74,E8), V(21,1F,1F,3E), \
161 V(DD,4B,4B,96), V(DC,BD,BD,61), V(86,8B,8B,0D), V(85,8A,8A,0F), \
162 V(90,70,70,E0), V(42,3E,3E,7C), V(C4,B5,B5,71), V(AA,66,66,CC), \
163 V(D8,48,48,90), V(05,03,03,06), V(01,F6,F6,F7), V(12,0E,0E,1C), \
164 V(A3,61,61,C2), V(5F,35,35,6A), V(F9,57,57,AE), V(D0,B9,B9,69), \
165 V(91,86,86,17), V(58,C1,C1,99), V(27,1D,1D,3A), V(B9,9E,9E,27), \
166 V(38,E1,E1,D9), V(13,F8,F8,EB), V(B3,98,98,2B), V(33,11,11,22), \
167 V(BB,69,69,D2), V(70,D9,D9,A9), V(89,8E,8E,07), V(A7,94,94,33), \
168 V(B6,9B,9B,2D), V(22,1E,1E,3C), V(92,87,87,15), V(20,E9,E9,C9), \
169 V(49,CE,CE,87), V(FF,55,55,AA), V(78,28,28,50), V(7A,DF,DF,A5), \
170 V(8F,8C,8C,03), V(F8,A1,A1,59), V(80,89,89,09), V(17,0D,0D,1A), \
171 V(DA,BF,BF,65), V(31,E6,E6,D7), V(C6,42,42,84), V(B8,68,68,D0), \
172 V(C3,41,41,82), V(B0,99,99,29), V(77,2D,2D,5A), V(11,0F,0F,1E), \
173 V(CB,B0,B0,7B), V(FC,54,54,A8), V(D6,BB,BB,6D), V(3A,16,16,2C)
174
175 #define V(a,b,c,d) 0x##a##b##c##d
176 static const uint32_t FT0[256] = { FT };
177 #undef V
178
179 #if !defined(MBEDTLS_AES_FEWER_TABLES)
180
181 #define V(a,b,c,d) 0x##b##c##d##a
182 static const uint32_t FT1[256] = { FT };
183 #undef V
184
185 #define V(a,b,c,d) 0x##c##d##a##b
186 static const uint32_t FT2[256] = { FT };
187 #undef V
188
189 #define V(a,b,c,d) 0x##d##a##b##c
190 static const uint32_t FT3[256] = { FT };
191 #undef V
192
193 #endif /* !MBEDTLS_AES_FEWER_TABLES */
194
195 #undef FT
196
197 /*
198 * Reverse S-box
199 */
200 static const unsigned char RSb[256] =
201 {
202 0x52, 0x09, 0x6A, 0xD5, 0x30, 0x36, 0xA5, 0x38,
203 0xBF, 0x40, 0xA3, 0x9E, 0x81, 0xF3, 0xD7, 0xFB,
204 0x7C, 0xE3, 0x39, 0x82, 0x9B, 0x2F, 0xFF, 0x87,
205 0x34, 0x8E, 0x43, 0x44, 0xC4, 0xDE, 0xE9, 0xCB,
206 0x54, 0x7B, 0x94, 0x32, 0xA6, 0xC2, 0x23, 0x3D,
207 0xEE, 0x4C, 0x95, 0x0B, 0x42, 0xFA, 0xC3, 0x4E,
208 0x08, 0x2E, 0xA1, 0x66, 0x28, 0xD9, 0x24, 0xB2,
209 0x76, 0x5B, 0xA2, 0x49, 0x6D, 0x8B, 0xD1, 0x25,
210 0x72, 0xF8, 0xF6, 0x64, 0x86, 0x68, 0x98, 0x16,
211 0xD4, 0xA4, 0x5C, 0xCC, 0x5D, 0x65, 0xB6, 0x92,
212 0x6C, 0x70, 0x48, 0x50, 0xFD, 0xED, 0xB9, 0xDA,
213 0x5E, 0x15, 0x46, 0x57, 0xA7, 0x8D, 0x9D, 0x84,
214 0x90, 0xD8, 0xAB, 0x00, 0x8C, 0xBC, 0xD3, 0x0A,
215 0xF7, 0xE4, 0x58, 0x05, 0xB8, 0xB3, 0x45, 0x06,
216 0xD0, 0x2C, 0x1E, 0x8F, 0xCA, 0x3F, 0x0F, 0x02,
217 0xC1, 0xAF, 0xBD, 0x03, 0x01, 0x13, 0x8A, 0x6B,
218 0x3A, 0x91, 0x11, 0x41, 0x4F, 0x67, 0xDC, 0xEA,
219 0x97, 0xF2, 0xCF, 0xCE, 0xF0, 0xB4, 0xE6, 0x73,
220 0x96, 0xAC, 0x74, 0x22, 0xE7, 0xAD, 0x35, 0x85,
221 0xE2, 0xF9, 0x37, 0xE8, 0x1C, 0x75, 0xDF, 0x6E,
222 0x47, 0xF1, 0x1A, 0x71, 0x1D, 0x29, 0xC5, 0x89,
223 0x6F, 0xB7, 0x62, 0x0E, 0xAA, 0x18, 0xBE, 0x1B,
224 0xFC, 0x56, 0x3E, 0x4B, 0xC6, 0xD2, 0x79, 0x20,
225 0x9A, 0xDB, 0xC0, 0xFE, 0x78, 0xCD, 0x5A, 0xF4,
226 0x1F, 0xDD, 0xA8, 0x33, 0x88, 0x07, 0xC7, 0x31,
227 0xB1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xEC, 0x5F,
228 0x60, 0x51, 0x7F, 0xA9, 0x19, 0xB5, 0x4A, 0x0D,
229 0x2D, 0xE5, 0x7A, 0x9F, 0x93, 0xC9, 0x9C, 0xEF,
230 0xA0, 0xE0, 0x3B, 0x4D, 0xAE, 0x2A, 0xF5, 0xB0,
231 0xC8, 0xEB, 0xBB, 0x3C, 0x83, 0x53, 0x99, 0x61,
232 0x17, 0x2B, 0x04, 0x7E, 0xBA, 0x77, 0xD6, 0x26,
233 0xE1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0C, 0x7D
234 };
235
236 /*
237 * Reverse tables
238 */
239 #define RT \
240 \
241 V(50,A7,F4,51), V(53,65,41,7E), V(C3,A4,17,1A), V(96,5E,27,3A), \
242 V(CB,6B,AB,3B), V(F1,45,9D,1F), V(AB,58,FA,AC), V(93,03,E3,4B), \
243 V(55,FA,30,20), V(F6,6D,76,AD), V(91,76,CC,88), V(25,4C,02,F5), \
244 V(FC,D7,E5,4F), V(D7,CB,2A,C5), V(80,44,35,26), V(8F,A3,62,B5), \
245 V(49,5A,B1,DE), V(67,1B,BA,25), V(98,0E,EA,45), V(E1,C0,FE,5D), \
246 V(02,75,2F,C3), V(12,F0,4C,81), V(A3,97,46,8D), V(C6,F9,D3,6B), \
247 V(E7,5F,8F,03), V(95,9C,92,15), V(EB,7A,6D,BF), V(DA,59,52,95), \
248 V(2D,83,BE,D4), V(D3,21,74,58), V(29,69,E0,49), V(44,C8,C9,8E), \
249 V(6A,89,C2,75), V(78,79,8E,F4), V(6B,3E,58,99), V(DD,71,B9,27), \
250 V(B6,4F,E1,BE), V(17,AD,88,F0), V(66,AC,20,C9), V(B4,3A,CE,7D), \
251 V(18,4A,DF,63), V(82,31,1A,E5), V(60,33,51,97), V(45,7F,53,62), \
252 V(E0,77,64,B1), V(84,AE,6B,BB), V(1C,A0,81,FE), V(94,2B,08,F9), \
253 V(58,68,48,70), V(19,FD,45,8F), V(87,6C,DE,94), V(B7,F8,7B,52), \
254 V(23,D3,73,AB), V(E2,02,4B,72), V(57,8F,1F,E3), V(2A,AB,55,66), \
255 V(07,28,EB,B2), V(03,C2,B5,2F), V(9A,7B,C5,86), V(A5,08,37,D3), \
256 V(F2,87,28,30), V(B2,A5,BF,23), V(BA,6A,03,02), V(5C,82,16,ED), \
257 V(2B,1C,CF,8A), V(92,B4,79,A7), V(F0,F2,07,F3), V(A1,E2,69,4E), \
258 V(CD,F4,DA,65), V(D5,BE,05,06), V(1F,62,34,D1), V(8A,FE,A6,C4), \
259 V(9D,53,2E,34), V(A0,55,F3,A2), V(32,E1,8A,05), V(75,EB,F6,A4), \
260 V(39,EC,83,0B), V(AA,EF,60,40), V(06,9F,71,5E), V(51,10,6E,BD), \
261 V(F9,8A,21,3E), V(3D,06,DD,96), V(AE,05,3E,DD), V(46,BD,E6,4D), \
262 V(B5,8D,54,91), V(05,5D,C4,71), V(6F,D4,06,04), V(FF,15,50,60), \
263 V(24,FB,98,19), V(97,E9,BD,D6), V(CC,43,40,89), V(77,9E,D9,67), \
264 V(BD,42,E8,B0), V(88,8B,89,07), V(38,5B,19,E7), V(DB,EE,C8,79), \
265 V(47,0A,7C,A1), V(E9,0F,42,7C), V(C9,1E,84,F8), V(00,00,00,00), \
266 V(83,86,80,09), V(48,ED,2B,32), V(AC,70,11,1E), V(4E,72,5A,6C), \
267 V(FB,FF,0E,FD), V(56,38,85,0F), V(1E,D5,AE,3D), V(27,39,2D,36), \
268 V(64,D9,0F,0A), V(21,A6,5C,68), V(D1,54,5B,9B), V(3A,2E,36,24), \
269 V(B1,67,0A,0C), V(0F,E7,57,93), V(D2,96,EE,B4), V(9E,91,9B,1B), \
270 V(4F,C5,C0,80), V(A2,20,DC,61), V(69,4B,77,5A), V(16,1A,12,1C), \
271 V(0A,BA,93,E2), V(E5,2A,A0,C0), V(43,E0,22,3C), V(1D,17,1B,12), \
272 V(0B,0D,09,0E), V(AD,C7,8B,F2), V(B9,A8,B6,2D), V(C8,A9,1E,14), \
273 V(85,19,F1,57), V(4C,07,75,AF), V(BB,DD,99,EE), V(FD,60,7F,A3), \
274 V(9F,26,01,F7), V(BC,F5,72,5C), V(C5,3B,66,44), V(34,7E,FB,5B), \
275 V(76,29,43,8B), V(DC,C6,23,CB), V(68,FC,ED,B6), V(63,F1,E4,B8), \
276 V(CA,DC,31,D7), V(10,85,63,42), V(40,22,97,13), V(20,11,C6,84), \
277 V(7D,24,4A,85), V(F8,3D,BB,D2), V(11,32,F9,AE), V(6D,A1,29,C7), \
278 V(4B,2F,9E,1D), V(F3,30,B2,DC), V(EC,52,86,0D), V(D0,E3,C1,77), \
279 V(6C,16,B3,2B), V(99,B9,70,A9), V(FA,48,94,11), V(22,64,E9,47), \
280 V(C4,8C,FC,A8), V(1A,3F,F0,A0), V(D8,2C,7D,56), V(EF,90,33,22), \
281 V(C7,4E,49,87), V(C1,D1,38,D9), V(FE,A2,CA,8C), V(36,0B,D4,98), \
282 V(CF,81,F5,A6), V(28,DE,7A,A5), V(26,8E,B7,DA), V(A4,BF,AD,3F), \
283 V(E4,9D,3A,2C), V(0D,92,78,50), V(9B,CC,5F,6A), V(62,46,7E,54), \
284 V(C2,13,8D,F6), V(E8,B8,D8,90), V(5E,F7,39,2E), V(F5,AF,C3,82), \
285 V(BE,80,5D,9F), V(7C,93,D0,69), V(A9,2D,D5,6F), V(B3,12,25,CF), \
286 V(3B,99,AC,C8), V(A7,7D,18,10), V(6E,63,9C,E8), V(7B,BB,3B,DB), \
287 V(09,78,26,CD), V(F4,18,59,6E), V(01,B7,9A,EC), V(A8,9A,4F,83), \
288 V(65,6E,95,E6), V(7E,E6,FF,AA), V(08,CF,BC,21), V(E6,E8,15,EF), \
289 V(D9,9B,E7,BA), V(CE,36,6F,4A), V(D4,09,9F,EA), V(D6,7C,B0,29), \
290 V(AF,B2,A4,31), V(31,23,3F,2A), V(30,94,A5,C6), V(C0,66,A2,35), \
291 V(37,BC,4E,74), V(A6,CA,82,FC), V(B0,D0,90,E0), V(15,D8,A7,33), \
292 V(4A,98,04,F1), V(F7,DA,EC,41), V(0E,50,CD,7F), V(2F,F6,91,17), \
293 V(8D,D6,4D,76), V(4D,B0,EF,43), V(54,4D,AA,CC), V(DF,04,96,E4), \
294 V(E3,B5,D1,9E), V(1B,88,6A,4C), V(B8,1F,2C,C1), V(7F,51,65,46), \
295 V(04,EA,5E,9D), V(5D,35,8C,01), V(73,74,87,FA), V(2E,41,0B,FB), \
296 V(5A,1D,67,B3), V(52,D2,DB,92), V(33,56,10,E9), V(13,47,D6,6D), \
297 V(8C,61,D7,9A), V(7A,0C,A1,37), V(8E,14,F8,59), V(89,3C,13,EB), \
298 V(EE,27,A9,CE), V(35,C9,61,B7), V(ED,E5,1C,E1), V(3C,B1,47,7A), \
299 V(59,DF,D2,9C), V(3F,73,F2,55), V(79,CE,14,18), V(BF,37,C7,73), \
300 V(EA,CD,F7,53), V(5B,AA,FD,5F), V(14,6F,3D,DF), V(86,DB,44,78), \
301 V(81,F3,AF,CA), V(3E,C4,68,B9), V(2C,34,24,38), V(5F,40,A3,C2), \
302 V(72,C3,1D,16), V(0C,25,E2,BC), V(8B,49,3C,28), V(41,95,0D,FF), \
303 V(71,01,A8,39), V(DE,B3,0C,08), V(9C,E4,B4,D8), V(90,C1,56,64), \
304 V(61,84,CB,7B), V(70,B6,32,D5), V(74,5C,6C,48), V(42,57,B8,D0)
305
306 #define V(a,b,c,d) 0x##a##b##c##d
307 static const uint32_t RT0[256] = { RT };
308 #undef V
309
310 #if !defined(MBEDTLS_AES_FEWER_TABLES)
311
312 #define V(a,b,c,d) 0x##b##c##d##a
313 static const uint32_t RT1[256] = { RT };
314 #undef V
315
316 #define V(a,b,c,d) 0x##c##d##a##b
317 static const uint32_t RT2[256] = { RT };
318 #undef V
319
320 #define V(a,b,c,d) 0x##d##a##b##c
321 static const uint32_t RT3[256] = { RT };
322 #undef V
323
324 #endif /* !MBEDTLS_AES_FEWER_TABLES */
325
326 #undef RT
327
328 /*
329 * Round constants
330 */
331 static const uint32_t RCON[10] =
332 {
333 0x00000001, 0x00000002, 0x00000004, 0x00000008,
334 0x00000010, 0x00000020, 0x00000040, 0x00000080,
335 0x0000001B, 0x00000036
336 };
337
338 #else /* MBEDTLS_AES_ROM_TABLES */
339
340 /*
341 * Forward S-box & tables
342 */
343 static unsigned char FSb[256];
344 static uint32_t FT0[256];
345 #if !defined(MBEDTLS_AES_FEWER_TABLES)
346 static uint32_t FT1[256];
347 static uint32_t FT2[256];
348 static uint32_t FT3[256];
349 #endif /* !MBEDTLS_AES_FEWER_TABLES */
350
351 /*
352 * Reverse S-box & tables
353 */
354 static unsigned char RSb[256];
355 static uint32_t RT0[256];
356 #if !defined(MBEDTLS_AES_FEWER_TABLES)
357 static uint32_t RT1[256];
358 static uint32_t RT2[256];
359 static uint32_t RT3[256];
360 #endif /* !MBEDTLS_AES_FEWER_TABLES */
361
362 /*
363 * Round constants
364 */
365 static uint32_t RCON[10];
366
367 /*
368 * Tables generation code
369 */
370 #define ROTL8(x) ( ( (x) << 8 ) & 0xFFFFFFFF ) | ( (x) >> 24 )
371 #define XTIME(x) ( ( (x) << 1 ) ^ ( ( (x) & 0x80 ) ? 0x1B : 0x00 ) )
372 #define MUL(x,y) ( ( (x) && (y) ) ? pow[(log[(x)]+log[(y)]) % 255] : 0 )
373
374 static int aes_init_done = 0;
375
aes_gen_tables(void)376 static void aes_gen_tables( void )
377 {
378 int i, x, y, z;
379 int pow[256];
380 int log[256];
381
382 /*
383 * compute pow and log tables over GF(2^8)
384 */
385 for( i = 0, x = 1; i < 256; i++ )
386 {
387 pow[i] = x;
388 log[x] = i;
389 x = MBEDTLS_BYTE_0( x ^ XTIME( x ) );
390 }
391
392 /*
393 * calculate the round constants
394 */
395 for( i = 0, x = 1; i < 10; i++ )
396 {
397 RCON[i] = (uint32_t) x;
398 x = MBEDTLS_BYTE_0( XTIME( x ) );
399 }
400
401 /*
402 * generate the forward and reverse S-boxes
403 */
404 FSb[0x00] = 0x63;
405 RSb[0x63] = 0x00;
406
407 for( i = 1; i < 256; i++ )
408 {
409 x = pow[255 - log[i]];
410
411 y = x; y = MBEDTLS_BYTE_0( ( y << 1 ) | ( y >> 7 ) );
412 x ^= y; y = MBEDTLS_BYTE_0( ( y << 1 ) | ( y >> 7 ) );
413 x ^= y; y = MBEDTLS_BYTE_0( ( y << 1 ) | ( y >> 7 ) );
414 x ^= y; y = MBEDTLS_BYTE_0( ( y << 1 ) | ( y >> 7 ) );
415 x ^= y ^ 0x63;
416
417 FSb[i] = (unsigned char) x;
418 RSb[x] = (unsigned char) i;
419 }
420
421 /*
422 * generate the forward and reverse tables
423 */
424 for( i = 0; i < 256; i++ )
425 {
426 x = FSb[i];
427 y = MBEDTLS_BYTE_0( XTIME( x ) );
428 z = MBEDTLS_BYTE_0( y ^ x );
429
430 FT0[i] = ( (uint32_t) y ) ^
431 ( (uint32_t) x << 8 ) ^
432 ( (uint32_t) x << 16 ) ^
433 ( (uint32_t) z << 24 );
434
435 #if !defined(MBEDTLS_AES_FEWER_TABLES)
436 FT1[i] = ROTL8( FT0[i] );
437 FT2[i] = ROTL8( FT1[i] );
438 FT3[i] = ROTL8( FT2[i] );
439 #endif /* !MBEDTLS_AES_FEWER_TABLES */
440
441 x = RSb[i];
442
443 RT0[i] = ( (uint32_t) MUL( 0x0E, x ) ) ^
444 ( (uint32_t) MUL( 0x09, x ) << 8 ) ^
445 ( (uint32_t) MUL( 0x0D, x ) << 16 ) ^
446 ( (uint32_t) MUL( 0x0B, x ) << 24 );
447
448 #if !defined(MBEDTLS_AES_FEWER_TABLES)
449 RT1[i] = ROTL8( RT0[i] );
450 RT2[i] = ROTL8( RT1[i] );
451 RT3[i] = ROTL8( RT2[i] );
452 #endif /* !MBEDTLS_AES_FEWER_TABLES */
453 }
454 }
455
456 #undef ROTL8
457
458 #endif /* MBEDTLS_AES_ROM_TABLES */
459
460 #if defined(MBEDTLS_AES_FEWER_TABLES)
461
462 #define ROTL8(x) ( (uint32_t)( ( x ) << 8 ) + (uint32_t)( ( x ) >> 24 ) )
463 #define ROTL16(x) ( (uint32_t)( ( x ) << 16 ) + (uint32_t)( ( x ) >> 16 ) )
464 #define ROTL24(x) ( (uint32_t)( ( x ) << 24 ) + (uint32_t)( ( x ) >> 8 ) )
465
466 #define AES_RT0(idx) RT0[idx]
467 #define AES_RT1(idx) ROTL8( RT0[idx] )
468 #define AES_RT2(idx) ROTL16( RT0[idx] )
469 #define AES_RT3(idx) ROTL24( RT0[idx] )
470
471 #define AES_FT0(idx) FT0[idx]
472 #define AES_FT1(idx) ROTL8( FT0[idx] )
473 #define AES_FT2(idx) ROTL16( FT0[idx] )
474 #define AES_FT3(idx) ROTL24( FT0[idx] )
475
476 #else /* MBEDTLS_AES_FEWER_TABLES */
477
478 #define AES_RT0(idx) RT0[idx]
479 #define AES_RT1(idx) RT1[idx]
480 #define AES_RT2(idx) RT2[idx]
481 #define AES_RT3(idx) RT3[idx]
482
483 #define AES_FT0(idx) FT0[idx]
484 #define AES_FT1(idx) FT1[idx]
485 #define AES_FT2(idx) FT2[idx]
486 #define AES_FT3(idx) FT3[idx]
487
488 #endif /* MBEDTLS_AES_FEWER_TABLES */
489
mbedtls_aes_init(mbedtls_aes_context * ctx)490 void mbedtls_aes_init( mbedtls_aes_context *ctx )
491 {
492 AES_VALIDATE( ctx != NULL );
493
494 memset( ctx, 0, sizeof( mbedtls_aes_context ) );
495 }
496
mbedtls_aes_free(mbedtls_aes_context * ctx)497 void mbedtls_aes_free( mbedtls_aes_context *ctx )
498 {
499 if( ctx == NULL )
500 return;
501
502 mbedtls_platform_zeroize( ctx, sizeof( mbedtls_aes_context ) );
503 }
504
505 #if defined(MBEDTLS_CIPHER_MODE_XTS)
mbedtls_aes_xts_init(mbedtls_aes_xts_context * ctx)506 void mbedtls_aes_xts_init( mbedtls_aes_xts_context *ctx )
507 {
508 AES_VALIDATE( ctx != NULL );
509
510 mbedtls_aes_init( &ctx->crypt );
511 mbedtls_aes_init( &ctx->tweak );
512 }
513
mbedtls_aes_xts_free(mbedtls_aes_xts_context * ctx)514 void mbedtls_aes_xts_free( mbedtls_aes_xts_context *ctx )
515 {
516 if( ctx == NULL )
517 return;
518
519 mbedtls_aes_free( &ctx->crypt );
520 mbedtls_aes_free( &ctx->tweak );
521 }
522 #endif /* MBEDTLS_CIPHER_MODE_XTS */
523
524 /*
525 * AES key schedule (encryption)
526 */
527 #if !defined(MBEDTLS_AES_SETKEY_ENC_ALT)
mbedtls_aes_setkey_enc(mbedtls_aes_context * ctx,const unsigned char * key,unsigned int keybits)528 int mbedtls_aes_setkey_enc( mbedtls_aes_context *ctx, const unsigned char *key,
529 unsigned int keybits )
530 {
531 unsigned int i;
532 uint32_t *RK;
533
534 AES_VALIDATE_RET( ctx != NULL );
535 AES_VALIDATE_RET( key != NULL );
536
537 switch( keybits )
538 {
539 case 128: ctx->nr = 10; break;
540 case 192: ctx->nr = 12; break;
541 case 256: ctx->nr = 14; break;
542 default : return( MBEDTLS_ERR_AES_INVALID_KEY_LENGTH );
543 }
544
545 #if !defined(MBEDTLS_AES_ROM_TABLES)
546 if( aes_init_done == 0 )
547 {
548 aes_gen_tables();
549 aes_init_done = 1;
550 }
551 #endif
552
553 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_PADLOCK_ALIGN16)
554 if( aes_padlock_ace == -1 )
555 aes_padlock_ace = mbedtls_padlock_has_support( MBEDTLS_PADLOCK_ACE );
556
557 if( aes_padlock_ace )
558 ctx->rk = RK = MBEDTLS_PADLOCK_ALIGN16( ctx->buf );
559 else
560 #endif
561 ctx->rk = RK = ctx->buf;
562
563 #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64)
564 if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) )
565 return( mbedtls_aesni_setkey_enc( (unsigned char *) ctx->rk, key, keybits ) );
566 #endif
567
568 for( i = 0; i < ( keybits >> 5 ); i++ )
569 {
570 RK[i] = MBEDTLS_GET_UINT32_LE( key, i << 2 );
571 }
572
573 switch( ctx->nr )
574 {
575 case 10:
576
577 for( i = 0; i < 10; i++, RK += 4 )
578 {
579 RK[4] = RK[0] ^ RCON[i] ^
580 ( (uint32_t) FSb[ MBEDTLS_BYTE_1( RK[3] ) ] ) ^
581 ( (uint32_t) FSb[ MBEDTLS_BYTE_2( RK[3] ) ] << 8 ) ^
582 ( (uint32_t) FSb[ MBEDTLS_BYTE_3( RK[3] ) ] << 16 ) ^
583 ( (uint32_t) FSb[ MBEDTLS_BYTE_0( RK[3] ) ] << 24 );
584
585 RK[5] = RK[1] ^ RK[4];
586 RK[6] = RK[2] ^ RK[5];
587 RK[7] = RK[3] ^ RK[6];
588 }
589 break;
590
591 case 12:
592
593 for( i = 0; i < 8; i++, RK += 6 )
594 {
595 RK[6] = RK[0] ^ RCON[i] ^
596 ( (uint32_t) FSb[ MBEDTLS_BYTE_1( RK[5] ) ] ) ^
597 ( (uint32_t) FSb[ MBEDTLS_BYTE_2( RK[5] ) ] << 8 ) ^
598 ( (uint32_t) FSb[ MBEDTLS_BYTE_3( RK[5] ) ] << 16 ) ^
599 ( (uint32_t) FSb[ MBEDTLS_BYTE_0( RK[5] ) ] << 24 );
600
601 RK[7] = RK[1] ^ RK[6];
602 RK[8] = RK[2] ^ RK[7];
603 RK[9] = RK[3] ^ RK[8];
604 RK[10] = RK[4] ^ RK[9];
605 RK[11] = RK[5] ^ RK[10];
606 }
607 break;
608
609 case 14:
610
611 for( i = 0; i < 7; i++, RK += 8 )
612 {
613 RK[8] = RK[0] ^ RCON[i] ^
614 ( (uint32_t) FSb[ MBEDTLS_BYTE_1( RK[7] ) ] ) ^
615 ( (uint32_t) FSb[ MBEDTLS_BYTE_2( RK[7] ) ] << 8 ) ^
616 ( (uint32_t) FSb[ MBEDTLS_BYTE_3( RK[7] ) ] << 16 ) ^
617 ( (uint32_t) FSb[ MBEDTLS_BYTE_0( RK[7] ) ] << 24 );
618
619 RK[9] = RK[1] ^ RK[8];
620 RK[10] = RK[2] ^ RK[9];
621 RK[11] = RK[3] ^ RK[10];
622
623 RK[12] = RK[4] ^
624 ( (uint32_t) FSb[ MBEDTLS_BYTE_0( RK[11] ) ] ) ^
625 ( (uint32_t) FSb[ MBEDTLS_BYTE_1( RK[11] ) ] << 8 ) ^
626 ( (uint32_t) FSb[ MBEDTLS_BYTE_2( RK[11] ) ] << 16 ) ^
627 ( (uint32_t) FSb[ MBEDTLS_BYTE_3( RK[11] ) ] << 24 );
628
629 RK[13] = RK[5] ^ RK[12];
630 RK[14] = RK[6] ^ RK[13];
631 RK[15] = RK[7] ^ RK[14];
632 }
633 break;
634 }
635
636 return( 0 );
637 }
638 #endif /* !MBEDTLS_AES_SETKEY_ENC_ALT */
639
640 /*
641 * AES key schedule (decryption)
642 */
643 #if !defined(MBEDTLS_AES_SETKEY_DEC_ALT)
mbedtls_aes_setkey_dec(mbedtls_aes_context * ctx,const unsigned char * key,unsigned int keybits)644 int mbedtls_aes_setkey_dec( mbedtls_aes_context *ctx, const unsigned char *key,
645 unsigned int keybits )
646 {
647 int i, j, ret;
648 mbedtls_aes_context cty;
649 uint32_t *RK;
650 uint32_t *SK;
651
652 AES_VALIDATE_RET( ctx != NULL );
653 AES_VALIDATE_RET( key != NULL );
654
655 mbedtls_aes_init( &cty );
656
657 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_PADLOCK_ALIGN16)
658 if( aes_padlock_ace == -1 )
659 aes_padlock_ace = mbedtls_padlock_has_support( MBEDTLS_PADLOCK_ACE );
660
661 if( aes_padlock_ace )
662 ctx->rk = RK = MBEDTLS_PADLOCK_ALIGN16( ctx->buf );
663 else
664 #endif
665 ctx->rk = RK = ctx->buf;
666
667 /* Also checks keybits */
668 if( ( ret = mbedtls_aes_setkey_enc( &cty, key, keybits ) ) != 0 )
669 goto exit;
670
671 ctx->nr = cty.nr;
672
673 #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64)
674 if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) )
675 {
676 mbedtls_aesni_inverse_key( (unsigned char *) ctx->rk,
677 (const unsigned char *) cty.rk, ctx->nr );
678 goto exit;
679 }
680 #endif
681
682 SK = cty.rk + cty.nr * 4;
683
684 *RK++ = *SK++;
685 *RK++ = *SK++;
686 *RK++ = *SK++;
687 *RK++ = *SK++;
688
689 for( i = ctx->nr - 1, SK -= 8; i > 0; i--, SK -= 8 )
690 {
691 for( j = 0; j < 4; j++, SK++ )
692 {
693 *RK++ = AES_RT0( FSb[ MBEDTLS_BYTE_0( *SK ) ] ) ^
694 AES_RT1( FSb[ MBEDTLS_BYTE_1( *SK ) ] ) ^
695 AES_RT2( FSb[ MBEDTLS_BYTE_2( *SK ) ] ) ^
696 AES_RT3( FSb[ MBEDTLS_BYTE_3( *SK ) ] );
697 }
698 }
699
700 *RK++ = *SK++;
701 *RK++ = *SK++;
702 *RK++ = *SK++;
703 *RK++ = *SK++;
704
705 exit:
706 mbedtls_aes_free( &cty );
707
708 return( ret );
709 }
710 #endif /* !MBEDTLS_AES_SETKEY_DEC_ALT */
711
712 #if defined(MBEDTLS_CIPHER_MODE_XTS)
mbedtls_aes_xts_decode_keys(const unsigned char * key,unsigned int keybits,const unsigned char ** key1,unsigned int * key1bits,const unsigned char ** key2,unsigned int * key2bits)713 static int mbedtls_aes_xts_decode_keys( const unsigned char *key,
714 unsigned int keybits,
715 const unsigned char **key1,
716 unsigned int *key1bits,
717 const unsigned char **key2,
718 unsigned int *key2bits )
719 {
720 const unsigned int half_keybits = keybits / 2;
721 const unsigned int half_keybytes = half_keybits / 8;
722
723 switch( keybits )
724 {
725 case 256: break;
726 case 512: break;
727 default : return( MBEDTLS_ERR_AES_INVALID_KEY_LENGTH );
728 }
729
730 *key1bits = half_keybits;
731 *key2bits = half_keybits;
732 *key1 = &key[0];
733 *key2 = &key[half_keybytes];
734
735 return 0;
736 }
737
mbedtls_aes_xts_setkey_enc(mbedtls_aes_xts_context * ctx,const unsigned char * key,unsigned int keybits)738 int mbedtls_aes_xts_setkey_enc( mbedtls_aes_xts_context *ctx,
739 const unsigned char *key,
740 unsigned int keybits)
741 {
742 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
743 const unsigned char *key1, *key2;
744 unsigned int key1bits, key2bits;
745
746 AES_VALIDATE_RET( ctx != NULL );
747 AES_VALIDATE_RET( key != NULL );
748
749 ret = mbedtls_aes_xts_decode_keys( key, keybits, &key1, &key1bits,
750 &key2, &key2bits );
751 if( ret != 0 )
752 return( ret );
753
754 /* Set the tweak key. Always set tweak key for the encryption mode. */
755 ret = mbedtls_aes_setkey_enc( &ctx->tweak, key2, key2bits );
756 if( ret != 0 )
757 return( ret );
758
759 /* Set crypt key for encryption. */
760 return mbedtls_aes_setkey_enc( &ctx->crypt, key1, key1bits );
761 }
762
mbedtls_aes_xts_setkey_dec(mbedtls_aes_xts_context * ctx,const unsigned char * key,unsigned int keybits)763 int mbedtls_aes_xts_setkey_dec( mbedtls_aes_xts_context *ctx,
764 const unsigned char *key,
765 unsigned int keybits)
766 {
767 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
768 const unsigned char *key1, *key2;
769 unsigned int key1bits, key2bits;
770
771 AES_VALIDATE_RET( ctx != NULL );
772 AES_VALIDATE_RET( key != NULL );
773
774 ret = mbedtls_aes_xts_decode_keys( key, keybits, &key1, &key1bits,
775 &key2, &key2bits );
776 if( ret != 0 )
777 return( ret );
778
779 /* Set the tweak key. Always set tweak key for encryption. */
780 ret = mbedtls_aes_setkey_enc( &ctx->tweak, key2, key2bits );
781 if( ret != 0 )
782 return( ret );
783
784 /* Set crypt key for decryption. */
785 return mbedtls_aes_setkey_dec( &ctx->crypt, key1, key1bits );
786 }
787 #endif /* MBEDTLS_CIPHER_MODE_XTS */
788
789 #define AES_FROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3) \
790 do \
791 { \
792 (X0) = *RK++ ^ AES_FT0( MBEDTLS_BYTE_0( Y0 ) ) ^ \
793 AES_FT1( MBEDTLS_BYTE_1( Y1 ) ) ^ \
794 AES_FT2( MBEDTLS_BYTE_2( Y2 ) ) ^ \
795 AES_FT3( MBEDTLS_BYTE_3( Y3 ) ); \
796 \
797 (X1) = *RK++ ^ AES_FT0( MBEDTLS_BYTE_0( Y1 ) ) ^ \
798 AES_FT1( MBEDTLS_BYTE_1( Y2 ) ) ^ \
799 AES_FT2( MBEDTLS_BYTE_2( Y3 ) ) ^ \
800 AES_FT3( MBEDTLS_BYTE_3( Y0 ) ); \
801 \
802 (X2) = *RK++ ^ AES_FT0( MBEDTLS_BYTE_0( Y2 ) ) ^ \
803 AES_FT1( MBEDTLS_BYTE_1( Y3 ) ) ^ \
804 AES_FT2( MBEDTLS_BYTE_2( Y0 ) ) ^ \
805 AES_FT3( MBEDTLS_BYTE_3( Y1 ) ); \
806 \
807 (X3) = *RK++ ^ AES_FT0( MBEDTLS_BYTE_0( Y3 ) ) ^ \
808 AES_FT1( MBEDTLS_BYTE_1( Y0 ) ) ^ \
809 AES_FT2( MBEDTLS_BYTE_2( Y1 ) ) ^ \
810 AES_FT3( MBEDTLS_BYTE_3( Y2 ) ); \
811 } while( 0 )
812
813 #define AES_RROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3) \
814 do \
815 { \
816 (X0) = *RK++ ^ AES_RT0( MBEDTLS_BYTE_0( Y0 ) ) ^ \
817 AES_RT1( MBEDTLS_BYTE_1( Y3 ) ) ^ \
818 AES_RT2( MBEDTLS_BYTE_2( Y2 ) ) ^ \
819 AES_RT3( MBEDTLS_BYTE_3( Y1 ) ); \
820 \
821 (X1) = *RK++ ^ AES_RT0( MBEDTLS_BYTE_0( Y1 ) ) ^ \
822 AES_RT1( MBEDTLS_BYTE_1( Y0 ) ) ^ \
823 AES_RT2( MBEDTLS_BYTE_2( Y3 ) ) ^ \
824 AES_RT3( MBEDTLS_BYTE_3( Y2 ) ); \
825 \
826 (X2) = *RK++ ^ AES_RT0( MBEDTLS_BYTE_0( Y2 ) ) ^ \
827 AES_RT1( MBEDTLS_BYTE_1( Y1 ) ) ^ \
828 AES_RT2( MBEDTLS_BYTE_2( Y0 ) ) ^ \
829 AES_RT3( MBEDTLS_BYTE_3( Y3 ) ); \
830 \
831 (X3) = *RK++ ^ AES_RT0( MBEDTLS_BYTE_0( Y3 ) ) ^ \
832 AES_RT1( MBEDTLS_BYTE_1( Y2 ) ) ^ \
833 AES_RT2( MBEDTLS_BYTE_2( Y1 ) ) ^ \
834 AES_RT3( MBEDTLS_BYTE_3( Y0 ) ); \
835 } while( 0 )
836
837 /*
838 * AES-ECB block encryption
839 */
840 #if !defined(MBEDTLS_AES_ENCRYPT_ALT)
mbedtls_internal_aes_encrypt(mbedtls_aes_context * ctx,const unsigned char input[16],unsigned char output[16])841 int mbedtls_internal_aes_encrypt( mbedtls_aes_context *ctx,
842 const unsigned char input[16],
843 unsigned char output[16] )
844 {
845 int i;
846 uint32_t *RK = ctx->rk;
847 struct
848 {
849 uint32_t X[4];
850 uint32_t Y[4];
851 } t;
852
853 t.X[0] = MBEDTLS_GET_UINT32_LE( input, 0 ); t.X[0] ^= *RK++;
854 t.X[1] = MBEDTLS_GET_UINT32_LE( input, 4 ); t.X[1] ^= *RK++;
855 t.X[2] = MBEDTLS_GET_UINT32_LE( input, 8 ); t.X[2] ^= *RK++;
856 t.X[3] = MBEDTLS_GET_UINT32_LE( input, 12 ); t.X[3] ^= *RK++;
857
858 for( i = ( ctx->nr >> 1 ) - 1; i > 0; i-- )
859 {
860 AES_FROUND( t.Y[0], t.Y[1], t.Y[2], t.Y[3], t.X[0], t.X[1], t.X[2], t.X[3] );
861 AES_FROUND( t.X[0], t.X[1], t.X[2], t.X[3], t.Y[0], t.Y[1], t.Y[2], t.Y[3] );
862 }
863
864 AES_FROUND( t.Y[0], t.Y[1], t.Y[2], t.Y[3], t.X[0], t.X[1], t.X[2], t.X[3] );
865
866 t.X[0] = *RK++ ^ \
867 ( (uint32_t) FSb[ MBEDTLS_BYTE_0( t.Y[0] ) ] ) ^
868 ( (uint32_t) FSb[ MBEDTLS_BYTE_1( t.Y[1] ) ] << 8 ) ^
869 ( (uint32_t) FSb[ MBEDTLS_BYTE_2( t.Y[2] ) ] << 16 ) ^
870 ( (uint32_t) FSb[ MBEDTLS_BYTE_3( t.Y[3] ) ] << 24 );
871
872 t.X[1] = *RK++ ^ \
873 ( (uint32_t) FSb[ MBEDTLS_BYTE_0( t.Y[1] ) ] ) ^
874 ( (uint32_t) FSb[ MBEDTLS_BYTE_1( t.Y[2] ) ] << 8 ) ^
875 ( (uint32_t) FSb[ MBEDTLS_BYTE_2( t.Y[3] ) ] << 16 ) ^
876 ( (uint32_t) FSb[ MBEDTLS_BYTE_3( t.Y[0] ) ] << 24 );
877
878 t.X[2] = *RK++ ^ \
879 ( (uint32_t) FSb[ MBEDTLS_BYTE_0( t.Y[2] ) ] ) ^
880 ( (uint32_t) FSb[ MBEDTLS_BYTE_1( t.Y[3] ) ] << 8 ) ^
881 ( (uint32_t) FSb[ MBEDTLS_BYTE_2( t.Y[0] ) ] << 16 ) ^
882 ( (uint32_t) FSb[ MBEDTLS_BYTE_3( t.Y[1] ) ] << 24 );
883
884 t.X[3] = *RK++ ^ \
885 ( (uint32_t) FSb[ MBEDTLS_BYTE_0( t.Y[3] ) ] ) ^
886 ( (uint32_t) FSb[ MBEDTLS_BYTE_1( t.Y[0] ) ] << 8 ) ^
887 ( (uint32_t) FSb[ MBEDTLS_BYTE_2( t.Y[1] ) ] << 16 ) ^
888 ( (uint32_t) FSb[ MBEDTLS_BYTE_3( t.Y[2] ) ] << 24 );
889
890 MBEDTLS_PUT_UINT32_LE( t.X[0], output, 0 );
891 MBEDTLS_PUT_UINT32_LE( t.X[1], output, 4 );
892 MBEDTLS_PUT_UINT32_LE( t.X[2], output, 8 );
893 MBEDTLS_PUT_UINT32_LE( t.X[3], output, 12 );
894
895 mbedtls_platform_zeroize( &t, sizeof( t ) );
896
897 return( 0 );
898 }
899 #endif /* !MBEDTLS_AES_ENCRYPT_ALT */
900
901 /*
902 * AES-ECB block decryption
903 */
904 #if !defined(MBEDTLS_AES_DECRYPT_ALT)
mbedtls_internal_aes_decrypt(mbedtls_aes_context * ctx,const unsigned char input[16],unsigned char output[16])905 int mbedtls_internal_aes_decrypt( mbedtls_aes_context *ctx,
906 const unsigned char input[16],
907 unsigned char output[16] )
908 {
909 int i;
910 uint32_t *RK = ctx->rk;
911 struct
912 {
913 uint32_t X[4];
914 uint32_t Y[4];
915 } t;
916
917 t.X[0] = MBEDTLS_GET_UINT32_LE( input, 0 ); t.X[0] ^= *RK++;
918 t.X[1] = MBEDTLS_GET_UINT32_LE( input, 4 ); t.X[1] ^= *RK++;
919 t.X[2] = MBEDTLS_GET_UINT32_LE( input, 8 ); t.X[2] ^= *RK++;
920 t.X[3] = MBEDTLS_GET_UINT32_LE( input, 12 ); t.X[3] ^= *RK++;
921
922 for( i = ( ctx->nr >> 1 ) - 1; i > 0; i-- )
923 {
924 AES_RROUND( t.Y[0], t.Y[1], t.Y[2], t.Y[3], t.X[0], t.X[1], t.X[2], t.X[3] );
925 AES_RROUND( t.X[0], t.X[1], t.X[2], t.X[3], t.Y[0], t.Y[1], t.Y[2], t.Y[3] );
926 }
927
928 AES_RROUND( t.Y[0], t.Y[1], t.Y[2], t.Y[3], t.X[0], t.X[1], t.X[2], t.X[3] );
929
930 t.X[0] = *RK++ ^ \
931 ( (uint32_t) RSb[ MBEDTLS_BYTE_0( t.Y[0] ) ] ) ^
932 ( (uint32_t) RSb[ MBEDTLS_BYTE_1( t.Y[3] ) ] << 8 ) ^
933 ( (uint32_t) RSb[ MBEDTLS_BYTE_2( t.Y[2] ) ] << 16 ) ^
934 ( (uint32_t) RSb[ MBEDTLS_BYTE_3( t.Y[1] ) ] << 24 );
935
936 t.X[1] = *RK++ ^ \
937 ( (uint32_t) RSb[ MBEDTLS_BYTE_0( t.Y[1] ) ] ) ^
938 ( (uint32_t) RSb[ MBEDTLS_BYTE_1( t.Y[0] ) ] << 8 ) ^
939 ( (uint32_t) RSb[ MBEDTLS_BYTE_2( t.Y[3] ) ] << 16 ) ^
940 ( (uint32_t) RSb[ MBEDTLS_BYTE_3( t.Y[2] ) ] << 24 );
941
942 t.X[2] = *RK++ ^ \
943 ( (uint32_t) RSb[ MBEDTLS_BYTE_0( t.Y[2] ) ] ) ^
944 ( (uint32_t) RSb[ MBEDTLS_BYTE_1( t.Y[1] ) ] << 8 ) ^
945 ( (uint32_t) RSb[ MBEDTLS_BYTE_2( t.Y[0] ) ] << 16 ) ^
946 ( (uint32_t) RSb[ MBEDTLS_BYTE_3( t.Y[3] ) ] << 24 );
947
948 t.X[3] = *RK++ ^ \
949 ( (uint32_t) RSb[ MBEDTLS_BYTE_0( t.Y[3] ) ] ) ^
950 ( (uint32_t) RSb[ MBEDTLS_BYTE_1( t.Y[2] ) ] << 8 ) ^
951 ( (uint32_t) RSb[ MBEDTLS_BYTE_2( t.Y[1] ) ] << 16 ) ^
952 ( (uint32_t) RSb[ MBEDTLS_BYTE_3( t.Y[0] ) ] << 24 );
953
954 MBEDTLS_PUT_UINT32_LE( t.X[0], output, 0 );
955 MBEDTLS_PUT_UINT32_LE( t.X[1], output, 4 );
956 MBEDTLS_PUT_UINT32_LE( t.X[2], output, 8 );
957 MBEDTLS_PUT_UINT32_LE( t.X[3], output, 12 );
958
959 mbedtls_platform_zeroize( &t, sizeof( t ) );
960
961 return( 0 );
962 }
963 #endif /* !MBEDTLS_AES_DECRYPT_ALT */
964
965 /*
966 * AES-ECB block encryption/decryption
967 */
mbedtls_aes_crypt_ecb(mbedtls_aes_context * ctx,int mode,const unsigned char input[16],unsigned char output[16])968 int mbedtls_aes_crypt_ecb( mbedtls_aes_context *ctx,
969 int mode,
970 const unsigned char input[16],
971 unsigned char output[16] )
972 {
973 AES_VALIDATE_RET( ctx != NULL );
974 AES_VALIDATE_RET( input != NULL );
975 AES_VALIDATE_RET( output != NULL );
976 AES_VALIDATE_RET( mode == MBEDTLS_AES_ENCRYPT ||
977 mode == MBEDTLS_AES_DECRYPT );
978
979 #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64)
980 if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) )
981 return( mbedtls_aesni_crypt_ecb( ctx, mode, input, output ) );
982 #endif
983
984 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_HAVE_X86)
985 if( aes_padlock_ace > 0)
986 {
987 if( mbedtls_padlock_xcryptecb( ctx, mode, input, output ) == 0 )
988 return( 0 );
989
990 // If padlock data misaligned, we just fall back to
991 // unaccelerated mode
992 //
993 }
994 #endif
995
996 if( mode == MBEDTLS_AES_ENCRYPT )
997 return( mbedtls_internal_aes_encrypt( ctx, input, output ) );
998 else
999 return( mbedtls_internal_aes_decrypt( ctx, input, output ) );
1000 }
1001
1002 #if defined(MBEDTLS_CIPHER_MODE_CBC)
1003 /*
1004 * AES-CBC buffer encryption/decryption
1005 */
mbedtls_aes_crypt_cbc(mbedtls_aes_context * ctx,int mode,size_t length,unsigned char iv[16],const unsigned char * input,unsigned char * output)1006 int mbedtls_aes_crypt_cbc( mbedtls_aes_context *ctx,
1007 int mode,
1008 size_t length,
1009 unsigned char iv[16],
1010 const unsigned char *input,
1011 unsigned char *output )
1012 {
1013 int i;
1014 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1015 unsigned char temp[16];
1016
1017 AES_VALIDATE_RET( ctx != NULL );
1018 AES_VALIDATE_RET( mode == MBEDTLS_AES_ENCRYPT ||
1019 mode == MBEDTLS_AES_DECRYPT );
1020 AES_VALIDATE_RET( iv != NULL );
1021 AES_VALIDATE_RET( input != NULL );
1022 AES_VALIDATE_RET( output != NULL );
1023
1024 if( length % 16 )
1025 return( MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH );
1026
1027 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_HAVE_X86)
1028 if( aes_padlock_ace > 0 )
1029 {
1030 if( mbedtls_padlock_xcryptcbc( ctx, mode, length, iv, input, output ) == 0 )
1031 return( 0 );
1032
1033 // If padlock data misaligned, we just fall back to
1034 // unaccelerated mode
1035 //
1036 }
1037 #endif
1038
1039 if( mode == MBEDTLS_AES_DECRYPT )
1040 {
1041 while( length > 0 )
1042 {
1043 memcpy( temp, input, 16 );
1044 ret = mbedtls_aes_crypt_ecb( ctx, mode, input, output );
1045 if( ret != 0 )
1046 goto exit;
1047
1048 for( i = 0; i < 16; i++ )
1049 output[i] = (unsigned char)( output[i] ^ iv[i] );
1050
1051 memcpy( iv, temp, 16 );
1052
1053 input += 16;
1054 output += 16;
1055 length -= 16;
1056 }
1057 }
1058 else
1059 {
1060 while( length > 0 )
1061 {
1062 for( i = 0; i < 16; i++ )
1063 output[i] = (unsigned char)( input[i] ^ iv[i] );
1064
1065 ret = mbedtls_aes_crypt_ecb( ctx, mode, output, output );
1066 if( ret != 0 )
1067 goto exit;
1068 memcpy( iv, output, 16 );
1069
1070 input += 16;
1071 output += 16;
1072 length -= 16;
1073 }
1074 }
1075 ret = 0;
1076
1077 exit:
1078 return( ret );
1079 }
1080 #endif /* MBEDTLS_CIPHER_MODE_CBC */
1081
1082 #if defined(MBEDTLS_CIPHER_MODE_XTS)
1083
1084 typedef unsigned char mbedtls_be128[16];
1085
1086 /*
1087 * GF(2^128) multiplication function
1088 *
1089 * This function multiplies a field element by x in the polynomial field
1090 * representation. It uses 64-bit word operations to gain speed but compensates
1091 * for machine endianess and hence works correctly on both big and little
1092 * endian machines.
1093 */
mbedtls_gf128mul_x_ble(unsigned char r[16],const unsigned char x[16])1094 static void mbedtls_gf128mul_x_ble( unsigned char r[16],
1095 const unsigned char x[16] )
1096 {
1097 uint64_t a, b, ra, rb;
1098
1099 a = MBEDTLS_GET_UINT64_LE( x, 0 );
1100 b = MBEDTLS_GET_UINT64_LE( x, 8 );
1101
1102 ra = ( a << 1 ) ^ 0x0087 >> ( 8 - ( ( b >> 63 ) << 3 ) );
1103 rb = ( a >> 63 ) | ( b << 1 );
1104
1105 MBEDTLS_PUT_UINT64_LE( ra, r, 0 );
1106 MBEDTLS_PUT_UINT64_LE( rb, r, 8 );
1107 }
1108
1109 /*
1110 * AES-XTS buffer encryption/decryption
1111 */
mbedtls_aes_crypt_xts(mbedtls_aes_xts_context * ctx,int mode,size_t length,const unsigned char data_unit[16],const unsigned char * input,unsigned char * output)1112 int mbedtls_aes_crypt_xts( mbedtls_aes_xts_context *ctx,
1113 int mode,
1114 size_t length,
1115 const unsigned char data_unit[16],
1116 const unsigned char *input,
1117 unsigned char *output )
1118 {
1119 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1120 size_t blocks = length / 16;
1121 size_t leftover = length % 16;
1122 unsigned char tweak[16];
1123 unsigned char prev_tweak[16];
1124 unsigned char tmp[16];
1125
1126 AES_VALIDATE_RET( ctx != NULL );
1127 AES_VALIDATE_RET( mode == MBEDTLS_AES_ENCRYPT ||
1128 mode == MBEDTLS_AES_DECRYPT );
1129 AES_VALIDATE_RET( data_unit != NULL );
1130 AES_VALIDATE_RET( input != NULL );
1131 AES_VALIDATE_RET( output != NULL );
1132
1133 /* Data units must be at least 16 bytes long. */
1134 if( length < 16 )
1135 return MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH;
1136
1137 /* NIST SP 800-38E disallows data units larger than 2**20 blocks. */
1138 if( length > ( 1 << 20 ) * 16 )
1139 return MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH;
1140
1141 /* Compute the tweak. */
1142 ret = mbedtls_aes_crypt_ecb( &ctx->tweak, MBEDTLS_AES_ENCRYPT,
1143 data_unit, tweak );
1144 if( ret != 0 )
1145 return( ret );
1146
1147 while( blocks-- )
1148 {
1149 size_t i;
1150
1151 if( leftover && ( mode == MBEDTLS_AES_DECRYPT ) && blocks == 0 )
1152 {
1153 /* We are on the last block in a decrypt operation that has
1154 * leftover bytes, so we need to use the next tweak for this block,
1155 * and this tweak for the lefover bytes. Save the current tweak for
1156 * the leftovers and then update the current tweak for use on this,
1157 * the last full block. */
1158 memcpy( prev_tweak, tweak, sizeof( tweak ) );
1159 mbedtls_gf128mul_x_ble( tweak, tweak );
1160 }
1161
1162 for( i = 0; i < 16; i++ )
1163 tmp[i] = input[i] ^ tweak[i];
1164
1165 ret = mbedtls_aes_crypt_ecb( &ctx->crypt, mode, tmp, tmp );
1166 if( ret != 0 )
1167 return( ret );
1168
1169 for( i = 0; i < 16; i++ )
1170 output[i] = tmp[i] ^ tweak[i];
1171
1172 /* Update the tweak for the next block. */
1173 mbedtls_gf128mul_x_ble( tweak, tweak );
1174
1175 output += 16;
1176 input += 16;
1177 }
1178
1179 if( leftover )
1180 {
1181 /* If we are on the leftover bytes in a decrypt operation, we need to
1182 * use the previous tweak for these bytes (as saved in prev_tweak). */
1183 unsigned char *t = mode == MBEDTLS_AES_DECRYPT ? prev_tweak : tweak;
1184
1185 /* We are now on the final part of the data unit, which doesn't divide
1186 * evenly by 16. It's time for ciphertext stealing. */
1187 size_t i;
1188 unsigned char *prev_output = output - 16;
1189
1190 /* Copy ciphertext bytes from the previous block to our output for each
1191 * byte of cyphertext we won't steal. At the same time, copy the
1192 * remainder of the input for this final round (since the loop bounds
1193 * are the same). */
1194 for( i = 0; i < leftover; i++ )
1195 {
1196 output[i] = prev_output[i];
1197 tmp[i] = input[i] ^ t[i];
1198 }
1199
1200 /* Copy ciphertext bytes from the previous block for input in this
1201 * round. */
1202 for( ; i < 16; i++ )
1203 tmp[i] = prev_output[i] ^ t[i];
1204
1205 ret = mbedtls_aes_crypt_ecb( &ctx->crypt, mode, tmp, tmp );
1206 if( ret != 0 )
1207 return ret;
1208
1209 /* Write the result back to the previous block, overriding the previous
1210 * output we copied. */
1211 for( i = 0; i < 16; i++ )
1212 prev_output[i] = tmp[i] ^ t[i];
1213 }
1214
1215 return( 0 );
1216 }
1217 #endif /* MBEDTLS_CIPHER_MODE_XTS */
1218
1219 #if defined(MBEDTLS_CIPHER_MODE_CFB)
1220 /*
1221 * AES-CFB128 buffer encryption/decryption
1222 */
mbedtls_aes_crypt_cfb128(mbedtls_aes_context * ctx,int mode,size_t length,size_t * iv_off,unsigned char iv[16],const unsigned char * input,unsigned char * output)1223 int mbedtls_aes_crypt_cfb128( mbedtls_aes_context *ctx,
1224 int mode,
1225 size_t length,
1226 size_t *iv_off,
1227 unsigned char iv[16],
1228 const unsigned char *input,
1229 unsigned char *output )
1230 {
1231 int c;
1232 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1233 size_t n;
1234
1235 AES_VALIDATE_RET( ctx != NULL );
1236 AES_VALIDATE_RET( mode == MBEDTLS_AES_ENCRYPT ||
1237 mode == MBEDTLS_AES_DECRYPT );
1238 AES_VALIDATE_RET( iv_off != NULL );
1239 AES_VALIDATE_RET( iv != NULL );
1240 AES_VALIDATE_RET( input != NULL );
1241 AES_VALIDATE_RET( output != NULL );
1242
1243 n = *iv_off;
1244
1245 if( n > 15 )
1246 return( MBEDTLS_ERR_AES_BAD_INPUT_DATA );
1247
1248 if( mode == MBEDTLS_AES_DECRYPT )
1249 {
1250 while( length-- )
1251 {
1252 if( n == 0 )
1253 {
1254 ret = mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv );
1255 if( ret != 0 )
1256 goto exit;
1257 }
1258
1259 c = *input++;
1260 *output++ = (unsigned char)( c ^ iv[n] );
1261 iv[n] = (unsigned char) c;
1262
1263 n = ( n + 1 ) & 0x0F;
1264 }
1265 }
1266 else
1267 {
1268 while( length-- )
1269 {
1270 if( n == 0 )
1271 {
1272 ret = mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv );
1273 if( ret != 0 )
1274 goto exit;
1275 }
1276
1277 iv[n] = *output++ = (unsigned char)( iv[n] ^ *input++ );
1278
1279 n = ( n + 1 ) & 0x0F;
1280 }
1281 }
1282
1283 *iv_off = n;
1284 ret = 0;
1285
1286 exit:
1287 return( ret );
1288 }
1289
1290 /*
1291 * AES-CFB8 buffer encryption/decryption
1292 */
mbedtls_aes_crypt_cfb8(mbedtls_aes_context * ctx,int mode,size_t length,unsigned char iv[16],const unsigned char * input,unsigned char * output)1293 int mbedtls_aes_crypt_cfb8( mbedtls_aes_context *ctx,
1294 int mode,
1295 size_t length,
1296 unsigned char iv[16],
1297 const unsigned char *input,
1298 unsigned char *output )
1299 {
1300 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1301 unsigned char c;
1302 unsigned char ov[17];
1303
1304 AES_VALIDATE_RET( ctx != NULL );
1305 AES_VALIDATE_RET( mode == MBEDTLS_AES_ENCRYPT ||
1306 mode == MBEDTLS_AES_DECRYPT );
1307 AES_VALIDATE_RET( iv != NULL );
1308 AES_VALIDATE_RET( input != NULL );
1309 AES_VALIDATE_RET( output != NULL );
1310 while( length-- )
1311 {
1312 memcpy( ov, iv, 16 );
1313 ret = mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv );
1314 if( ret != 0 )
1315 goto exit;
1316
1317 if( mode == MBEDTLS_AES_DECRYPT )
1318 ov[16] = *input;
1319
1320 c = *output++ = (unsigned char)( iv[0] ^ *input++ );
1321
1322 if( mode == MBEDTLS_AES_ENCRYPT )
1323 ov[16] = c;
1324
1325 memcpy( iv, ov + 1, 16 );
1326 }
1327 ret = 0;
1328
1329 exit:
1330 return( ret );
1331 }
1332 #endif /* MBEDTLS_CIPHER_MODE_CFB */
1333
1334 #if defined(MBEDTLS_CIPHER_MODE_OFB)
1335 /*
1336 * AES-OFB (Output Feedback Mode) buffer encryption/decryption
1337 */
mbedtls_aes_crypt_ofb(mbedtls_aes_context * ctx,size_t length,size_t * iv_off,unsigned char iv[16],const unsigned char * input,unsigned char * output)1338 int mbedtls_aes_crypt_ofb( mbedtls_aes_context *ctx,
1339 size_t length,
1340 size_t *iv_off,
1341 unsigned char iv[16],
1342 const unsigned char *input,
1343 unsigned char *output )
1344 {
1345 int ret = 0;
1346 size_t n;
1347
1348 AES_VALIDATE_RET( ctx != NULL );
1349 AES_VALIDATE_RET( iv_off != NULL );
1350 AES_VALIDATE_RET( iv != NULL );
1351 AES_VALIDATE_RET( input != NULL );
1352 AES_VALIDATE_RET( output != NULL );
1353
1354 n = *iv_off;
1355
1356 if( n > 15 )
1357 return( MBEDTLS_ERR_AES_BAD_INPUT_DATA );
1358
1359 while( length-- )
1360 {
1361 if( n == 0 )
1362 {
1363 ret = mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv );
1364 if( ret != 0 )
1365 goto exit;
1366 }
1367 *output++ = *input++ ^ iv[n];
1368
1369 n = ( n + 1 ) & 0x0F;
1370 }
1371
1372 *iv_off = n;
1373
1374 exit:
1375 return( ret );
1376 }
1377 #endif /* MBEDTLS_CIPHER_MODE_OFB */
1378
1379 #if defined(MBEDTLS_CIPHER_MODE_CTR)
1380 /*
1381 * AES-CTR buffer encryption/decryption
1382 */
mbedtls_aes_crypt_ctr(mbedtls_aes_context * ctx,size_t length,size_t * nc_off,unsigned char nonce_counter[16],unsigned char stream_block[16],const unsigned char * input,unsigned char * output)1383 int mbedtls_aes_crypt_ctr( mbedtls_aes_context *ctx,
1384 size_t length,
1385 size_t *nc_off,
1386 unsigned char nonce_counter[16],
1387 unsigned char stream_block[16],
1388 const unsigned char *input,
1389 unsigned char *output )
1390 {
1391 int c, i;
1392 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1393 size_t n;
1394
1395 AES_VALIDATE_RET( ctx != NULL );
1396 AES_VALIDATE_RET( nc_off != NULL );
1397 AES_VALIDATE_RET( nonce_counter != NULL );
1398 AES_VALIDATE_RET( stream_block != NULL );
1399 AES_VALIDATE_RET( input != NULL );
1400 AES_VALIDATE_RET( output != NULL );
1401
1402 n = *nc_off;
1403
1404 if ( n > 0x0F )
1405 return( MBEDTLS_ERR_AES_BAD_INPUT_DATA );
1406
1407 while( length-- )
1408 {
1409 if( n == 0 ) {
1410 ret = mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, nonce_counter, stream_block );
1411 if( ret != 0 )
1412 goto exit;
1413
1414 for( i = 16; i > 0; i-- )
1415 if( ++nonce_counter[i - 1] != 0 )
1416 break;
1417 }
1418 c = *input++;
1419 *output++ = (unsigned char)( c ^ stream_block[n] );
1420
1421 n = ( n + 1 ) & 0x0F;
1422 }
1423
1424 *nc_off = n;
1425 ret = 0;
1426
1427 exit:
1428 return( ret );
1429 }
1430 #endif /* MBEDTLS_CIPHER_MODE_CTR */
1431
1432 #endif /* !MBEDTLS_AES_ALT */
1433
1434 #if defined(MBEDTLS_SELF_TEST)
1435 /*
1436 * AES test vectors from:
1437 *
1438 * http://csrc.nist.gov/archive/aes/rijndael/rijndael-vals.zip
1439 */
1440 static const unsigned char aes_test_ecb_dec[3][16] =
1441 {
1442 { 0x44, 0x41, 0x6A, 0xC2, 0xD1, 0xF5, 0x3C, 0x58,
1443 0x33, 0x03, 0x91, 0x7E, 0x6B, 0xE9, 0xEB, 0xE0 },
1444 { 0x48, 0xE3, 0x1E, 0x9E, 0x25, 0x67, 0x18, 0xF2,
1445 0x92, 0x29, 0x31, 0x9C, 0x19, 0xF1, 0x5B, 0xA4 },
1446 { 0x05, 0x8C, 0xCF, 0xFD, 0xBB, 0xCB, 0x38, 0x2D,
1447 0x1F, 0x6F, 0x56, 0x58, 0x5D, 0x8A, 0x4A, 0xDE }
1448 };
1449
1450 static const unsigned char aes_test_ecb_enc[3][16] =
1451 {
1452 { 0xC3, 0x4C, 0x05, 0x2C, 0xC0, 0xDA, 0x8D, 0x73,
1453 0x45, 0x1A, 0xFE, 0x5F, 0x03, 0xBE, 0x29, 0x7F },
1454 { 0xF3, 0xF6, 0x75, 0x2A, 0xE8, 0xD7, 0x83, 0x11,
1455 0x38, 0xF0, 0x41, 0x56, 0x06, 0x31, 0xB1, 0x14 },
1456 { 0x8B, 0x79, 0xEE, 0xCC, 0x93, 0xA0, 0xEE, 0x5D,
1457 0xFF, 0x30, 0xB4, 0xEA, 0x21, 0x63, 0x6D, 0xA4 }
1458 };
1459
1460 #if defined(MBEDTLS_CIPHER_MODE_CBC)
1461 static const unsigned char aes_test_cbc_dec[3][16] =
1462 {
1463 { 0xFA, 0xCA, 0x37, 0xE0, 0xB0, 0xC8, 0x53, 0x73,
1464 0xDF, 0x70, 0x6E, 0x73, 0xF7, 0xC9, 0xAF, 0x86 },
1465 { 0x5D, 0xF6, 0x78, 0xDD, 0x17, 0xBA, 0x4E, 0x75,
1466 0xB6, 0x17, 0x68, 0xC6, 0xAD, 0xEF, 0x7C, 0x7B },
1467 { 0x48, 0x04, 0xE1, 0x81, 0x8F, 0xE6, 0x29, 0x75,
1468 0x19, 0xA3, 0xE8, 0x8C, 0x57, 0x31, 0x04, 0x13 }
1469 };
1470
1471 static const unsigned char aes_test_cbc_enc[3][16] =
1472 {
1473 { 0x8A, 0x05, 0xFC, 0x5E, 0x09, 0x5A, 0xF4, 0x84,
1474 0x8A, 0x08, 0xD3, 0x28, 0xD3, 0x68, 0x8E, 0x3D },
1475 { 0x7B, 0xD9, 0x66, 0xD5, 0x3A, 0xD8, 0xC1, 0xBB,
1476 0x85, 0xD2, 0xAD, 0xFA, 0xE8, 0x7B, 0xB1, 0x04 },
1477 { 0xFE, 0x3C, 0x53, 0x65, 0x3E, 0x2F, 0x45, 0xB5,
1478 0x6F, 0xCD, 0x88, 0xB2, 0xCC, 0x89, 0x8F, 0xF0 }
1479 };
1480 #endif /* MBEDTLS_CIPHER_MODE_CBC */
1481
1482 #if defined(MBEDTLS_CIPHER_MODE_CFB)
1483 /*
1484 * AES-CFB128 test vectors from:
1485 *
1486 * http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
1487 */
1488 static const unsigned char aes_test_cfb128_key[3][32] =
1489 {
1490 { 0x2B, 0x7E, 0x15, 0x16, 0x28, 0xAE, 0xD2, 0xA6,
1491 0xAB, 0xF7, 0x15, 0x88, 0x09, 0xCF, 0x4F, 0x3C },
1492 { 0x8E, 0x73, 0xB0, 0xF7, 0xDA, 0x0E, 0x64, 0x52,
1493 0xC8, 0x10, 0xF3, 0x2B, 0x80, 0x90, 0x79, 0xE5,
1494 0x62, 0xF8, 0xEA, 0xD2, 0x52, 0x2C, 0x6B, 0x7B },
1495 { 0x60, 0x3D, 0xEB, 0x10, 0x15, 0xCA, 0x71, 0xBE,
1496 0x2B, 0x73, 0xAE, 0xF0, 0x85, 0x7D, 0x77, 0x81,
1497 0x1F, 0x35, 0x2C, 0x07, 0x3B, 0x61, 0x08, 0xD7,
1498 0x2D, 0x98, 0x10, 0xA3, 0x09, 0x14, 0xDF, 0xF4 }
1499 };
1500
1501 static const unsigned char aes_test_cfb128_iv[16] =
1502 {
1503 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
1504 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F
1505 };
1506
1507 static const unsigned char aes_test_cfb128_pt[64] =
1508 {
1509 0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96,
1510 0xE9, 0x3D, 0x7E, 0x11, 0x73, 0x93, 0x17, 0x2A,
1511 0xAE, 0x2D, 0x8A, 0x57, 0x1E, 0x03, 0xAC, 0x9C,
1512 0x9E, 0xB7, 0x6F, 0xAC, 0x45, 0xAF, 0x8E, 0x51,
1513 0x30, 0xC8, 0x1C, 0x46, 0xA3, 0x5C, 0xE4, 0x11,
1514 0xE5, 0xFB, 0xC1, 0x19, 0x1A, 0x0A, 0x52, 0xEF,
1515 0xF6, 0x9F, 0x24, 0x45, 0xDF, 0x4F, 0x9B, 0x17,
1516 0xAD, 0x2B, 0x41, 0x7B, 0xE6, 0x6C, 0x37, 0x10
1517 };
1518
1519 static const unsigned char aes_test_cfb128_ct[3][64] =
1520 {
1521 { 0x3B, 0x3F, 0xD9, 0x2E, 0xB7, 0x2D, 0xAD, 0x20,
1522 0x33, 0x34, 0x49, 0xF8, 0xE8, 0x3C, 0xFB, 0x4A,
1523 0xC8, 0xA6, 0x45, 0x37, 0xA0, 0xB3, 0xA9, 0x3F,
1524 0xCD, 0xE3, 0xCD, 0xAD, 0x9F, 0x1C, 0xE5, 0x8B,
1525 0x26, 0x75, 0x1F, 0x67, 0xA3, 0xCB, 0xB1, 0x40,
1526 0xB1, 0x80, 0x8C, 0xF1, 0x87, 0xA4, 0xF4, 0xDF,
1527 0xC0, 0x4B, 0x05, 0x35, 0x7C, 0x5D, 0x1C, 0x0E,
1528 0xEA, 0xC4, 0xC6, 0x6F, 0x9F, 0xF7, 0xF2, 0xE6 },
1529 { 0xCD, 0xC8, 0x0D, 0x6F, 0xDD, 0xF1, 0x8C, 0xAB,
1530 0x34, 0xC2, 0x59, 0x09, 0xC9, 0x9A, 0x41, 0x74,
1531 0x67, 0xCE, 0x7F, 0x7F, 0x81, 0x17, 0x36, 0x21,
1532 0x96, 0x1A, 0x2B, 0x70, 0x17, 0x1D, 0x3D, 0x7A,
1533 0x2E, 0x1E, 0x8A, 0x1D, 0xD5, 0x9B, 0x88, 0xB1,
1534 0xC8, 0xE6, 0x0F, 0xED, 0x1E, 0xFA, 0xC4, 0xC9,
1535 0xC0, 0x5F, 0x9F, 0x9C, 0xA9, 0x83, 0x4F, 0xA0,
1536 0x42, 0xAE, 0x8F, 0xBA, 0x58, 0x4B, 0x09, 0xFF },
1537 { 0xDC, 0x7E, 0x84, 0xBF, 0xDA, 0x79, 0x16, 0x4B,
1538 0x7E, 0xCD, 0x84, 0x86, 0x98, 0x5D, 0x38, 0x60,
1539 0x39, 0xFF, 0xED, 0x14, 0x3B, 0x28, 0xB1, 0xC8,
1540 0x32, 0x11, 0x3C, 0x63, 0x31, 0xE5, 0x40, 0x7B,
1541 0xDF, 0x10, 0x13, 0x24, 0x15, 0xE5, 0x4B, 0x92,
1542 0xA1, 0x3E, 0xD0, 0xA8, 0x26, 0x7A, 0xE2, 0xF9,
1543 0x75, 0xA3, 0x85, 0x74, 0x1A, 0xB9, 0xCE, 0xF8,
1544 0x20, 0x31, 0x62, 0x3D, 0x55, 0xB1, 0xE4, 0x71 }
1545 };
1546 #endif /* MBEDTLS_CIPHER_MODE_CFB */
1547
1548 #if defined(MBEDTLS_CIPHER_MODE_OFB)
1549 /*
1550 * AES-OFB test vectors from:
1551 *
1552 * https://csrc.nist.gov/publications/detail/sp/800-38a/final
1553 */
1554 static const unsigned char aes_test_ofb_key[3][32] =
1555 {
1556 { 0x2B, 0x7E, 0x15, 0x16, 0x28, 0xAE, 0xD2, 0xA6,
1557 0xAB, 0xF7, 0x15, 0x88, 0x09, 0xCF, 0x4F, 0x3C },
1558 { 0x8E, 0x73, 0xB0, 0xF7, 0xDA, 0x0E, 0x64, 0x52,
1559 0xC8, 0x10, 0xF3, 0x2B, 0x80, 0x90, 0x79, 0xE5,
1560 0x62, 0xF8, 0xEA, 0xD2, 0x52, 0x2C, 0x6B, 0x7B },
1561 { 0x60, 0x3D, 0xEB, 0x10, 0x15, 0xCA, 0x71, 0xBE,
1562 0x2B, 0x73, 0xAE, 0xF0, 0x85, 0x7D, 0x77, 0x81,
1563 0x1F, 0x35, 0x2C, 0x07, 0x3B, 0x61, 0x08, 0xD7,
1564 0x2D, 0x98, 0x10, 0xA3, 0x09, 0x14, 0xDF, 0xF4 }
1565 };
1566
1567 static const unsigned char aes_test_ofb_iv[16] =
1568 {
1569 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
1570 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F
1571 };
1572
1573 static const unsigned char aes_test_ofb_pt[64] =
1574 {
1575 0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96,
1576 0xE9, 0x3D, 0x7E, 0x11, 0x73, 0x93, 0x17, 0x2A,
1577 0xAE, 0x2D, 0x8A, 0x57, 0x1E, 0x03, 0xAC, 0x9C,
1578 0x9E, 0xB7, 0x6F, 0xAC, 0x45, 0xAF, 0x8E, 0x51,
1579 0x30, 0xC8, 0x1C, 0x46, 0xA3, 0x5C, 0xE4, 0x11,
1580 0xE5, 0xFB, 0xC1, 0x19, 0x1A, 0x0A, 0x52, 0xEF,
1581 0xF6, 0x9F, 0x24, 0x45, 0xDF, 0x4F, 0x9B, 0x17,
1582 0xAD, 0x2B, 0x41, 0x7B, 0xE6, 0x6C, 0x37, 0x10
1583 };
1584
1585 static const unsigned char aes_test_ofb_ct[3][64] =
1586 {
1587 { 0x3B, 0x3F, 0xD9, 0x2E, 0xB7, 0x2D, 0xAD, 0x20,
1588 0x33, 0x34, 0x49, 0xF8, 0xE8, 0x3C, 0xFB, 0x4A,
1589 0x77, 0x89, 0x50, 0x8d, 0x16, 0x91, 0x8f, 0x03,
1590 0xf5, 0x3c, 0x52, 0xda, 0xc5, 0x4e, 0xd8, 0x25,
1591 0x97, 0x40, 0x05, 0x1e, 0x9c, 0x5f, 0xec, 0xf6,
1592 0x43, 0x44, 0xf7, 0xa8, 0x22, 0x60, 0xed, 0xcc,
1593 0x30, 0x4c, 0x65, 0x28, 0xf6, 0x59, 0xc7, 0x78,
1594 0x66, 0xa5, 0x10, 0xd9, 0xc1, 0xd6, 0xae, 0x5e },
1595 { 0xCD, 0xC8, 0x0D, 0x6F, 0xDD, 0xF1, 0x8C, 0xAB,
1596 0x34, 0xC2, 0x59, 0x09, 0xC9, 0x9A, 0x41, 0x74,
1597 0xfc, 0xc2, 0x8b, 0x8d, 0x4c, 0x63, 0x83, 0x7c,
1598 0x09, 0xe8, 0x17, 0x00, 0xc1, 0x10, 0x04, 0x01,
1599 0x8d, 0x9a, 0x9a, 0xea, 0xc0, 0xf6, 0x59, 0x6f,
1600 0x55, 0x9c, 0x6d, 0x4d, 0xaf, 0x59, 0xa5, 0xf2,
1601 0x6d, 0x9f, 0x20, 0x08, 0x57, 0xca, 0x6c, 0x3e,
1602 0x9c, 0xac, 0x52, 0x4b, 0xd9, 0xac, 0xc9, 0x2a },
1603 { 0xDC, 0x7E, 0x84, 0xBF, 0xDA, 0x79, 0x16, 0x4B,
1604 0x7E, 0xCD, 0x84, 0x86, 0x98, 0x5D, 0x38, 0x60,
1605 0x4f, 0xeb, 0xdc, 0x67, 0x40, 0xd2, 0x0b, 0x3a,
1606 0xc8, 0x8f, 0x6a, 0xd8, 0x2a, 0x4f, 0xb0, 0x8d,
1607 0x71, 0xab, 0x47, 0xa0, 0x86, 0xe8, 0x6e, 0xed,
1608 0xf3, 0x9d, 0x1c, 0x5b, 0xba, 0x97, 0xc4, 0x08,
1609 0x01, 0x26, 0x14, 0x1d, 0x67, 0xf3, 0x7b, 0xe8,
1610 0x53, 0x8f, 0x5a, 0x8b, 0xe7, 0x40, 0xe4, 0x84 }
1611 };
1612 #endif /* MBEDTLS_CIPHER_MODE_OFB */
1613
1614 #if defined(MBEDTLS_CIPHER_MODE_CTR)
1615 /*
1616 * AES-CTR test vectors from:
1617 *
1618 * http://www.faqs.org/rfcs/rfc3686.html
1619 */
1620
1621 static const unsigned char aes_test_ctr_key[3][16] =
1622 {
1623 { 0xAE, 0x68, 0x52, 0xF8, 0x12, 0x10, 0x67, 0xCC,
1624 0x4B, 0xF7, 0xA5, 0x76, 0x55, 0x77, 0xF3, 0x9E },
1625 { 0x7E, 0x24, 0x06, 0x78, 0x17, 0xFA, 0xE0, 0xD7,
1626 0x43, 0xD6, 0xCE, 0x1F, 0x32, 0x53, 0x91, 0x63 },
1627 { 0x76, 0x91, 0xBE, 0x03, 0x5E, 0x50, 0x20, 0xA8,
1628 0xAC, 0x6E, 0x61, 0x85, 0x29, 0xF9, 0xA0, 0xDC }
1629 };
1630
1631 static const unsigned char aes_test_ctr_nonce_counter[3][16] =
1632 {
1633 { 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x00,
1634 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 },
1635 { 0x00, 0x6C, 0xB6, 0xDB, 0xC0, 0x54, 0x3B, 0x59,
1636 0xDA, 0x48, 0xD9, 0x0B, 0x00, 0x00, 0x00, 0x01 },
1637 { 0x00, 0xE0, 0x01, 0x7B, 0x27, 0x77, 0x7F, 0x3F,
1638 0x4A, 0x17, 0x86, 0xF0, 0x00, 0x00, 0x00, 0x01 }
1639 };
1640
1641 static const unsigned char aes_test_ctr_pt[3][48] =
1642 {
1643 { 0x53, 0x69, 0x6E, 0x67, 0x6C, 0x65, 0x20, 0x62,
1644 0x6C, 0x6F, 0x63, 0x6B, 0x20, 0x6D, 0x73, 0x67 },
1645
1646 { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
1647 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
1648 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
1649 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F },
1650
1651 { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
1652 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
1653 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
1654 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F,
1655 0x20, 0x21, 0x22, 0x23 }
1656 };
1657
1658 static const unsigned char aes_test_ctr_ct[3][48] =
1659 {
1660 { 0xE4, 0x09, 0x5D, 0x4F, 0xB7, 0xA7, 0xB3, 0x79,
1661 0x2D, 0x61, 0x75, 0xA3, 0x26, 0x13, 0x11, 0xB8 },
1662 { 0x51, 0x04, 0xA1, 0x06, 0x16, 0x8A, 0x72, 0xD9,
1663 0x79, 0x0D, 0x41, 0xEE, 0x8E, 0xDA, 0xD3, 0x88,
1664 0xEB, 0x2E, 0x1E, 0xFC, 0x46, 0xDA, 0x57, 0xC8,
1665 0xFC, 0xE6, 0x30, 0xDF, 0x91, 0x41, 0xBE, 0x28 },
1666 { 0xC1, 0xCF, 0x48, 0xA8, 0x9F, 0x2F, 0xFD, 0xD9,
1667 0xCF, 0x46, 0x52, 0xE9, 0xEF, 0xDB, 0x72, 0xD7,
1668 0x45, 0x40, 0xA4, 0x2B, 0xDE, 0x6D, 0x78, 0x36,
1669 0xD5, 0x9A, 0x5C, 0xEA, 0xAE, 0xF3, 0x10, 0x53,
1670 0x25, 0xB2, 0x07, 0x2F }
1671 };
1672
1673 static const int aes_test_ctr_len[3] =
1674 { 16, 32, 36 };
1675 #endif /* MBEDTLS_CIPHER_MODE_CTR */
1676
1677 #if defined(MBEDTLS_CIPHER_MODE_XTS)
1678 /*
1679 * AES-XTS test vectors from:
1680 *
1681 * IEEE P1619/D16 Annex B
1682 * https://web.archive.org/web/20150629024421/http://grouper.ieee.org/groups/1619/email/pdf00086.pdf
1683 * (Archived from original at http://grouper.ieee.org/groups/1619/email/pdf00086.pdf)
1684 */
1685 static const unsigned char aes_test_xts_key[][32] =
1686 {
1687 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1688 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1689 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1690 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
1691 { 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11,
1692 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11,
1693 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22,
1694 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22 },
1695 { 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8,
1696 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1697 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22,
1698 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22 },
1699 };
1700
1701 static const unsigned char aes_test_xts_pt32[][32] =
1702 {
1703 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1704 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1705 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1706 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
1707 { 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
1708 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
1709 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
1710 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44 },
1711 { 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
1712 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
1713 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
1714 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44 },
1715 };
1716
1717 static const unsigned char aes_test_xts_ct32[][32] =
1718 {
1719 { 0x91, 0x7c, 0xf6, 0x9e, 0xbd, 0x68, 0xb2, 0xec,
1720 0x9b, 0x9f, 0xe9, 0xa3, 0xea, 0xdd, 0xa6, 0x92,
1721 0xcd, 0x43, 0xd2, 0xf5, 0x95, 0x98, 0xed, 0x85,
1722 0x8c, 0x02, 0xc2, 0x65, 0x2f, 0xbf, 0x92, 0x2e },
1723 { 0xc4, 0x54, 0x18, 0x5e, 0x6a, 0x16, 0x93, 0x6e,
1724 0x39, 0x33, 0x40, 0x38, 0xac, 0xef, 0x83, 0x8b,
1725 0xfb, 0x18, 0x6f, 0xff, 0x74, 0x80, 0xad, 0xc4,
1726 0x28, 0x93, 0x82, 0xec, 0xd6, 0xd3, 0x94, 0xf0 },
1727 { 0xaf, 0x85, 0x33, 0x6b, 0x59, 0x7a, 0xfc, 0x1a,
1728 0x90, 0x0b, 0x2e, 0xb2, 0x1e, 0xc9, 0x49, 0xd2,
1729 0x92, 0xdf, 0x4c, 0x04, 0x7e, 0x0b, 0x21, 0x53,
1730 0x21, 0x86, 0xa5, 0x97, 0x1a, 0x22, 0x7a, 0x89 },
1731 };
1732
1733 static const unsigned char aes_test_xts_data_unit[][16] =
1734 {
1735 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1736 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
1737 { 0x33, 0x33, 0x33, 0x33, 0x33, 0x00, 0x00, 0x00,
1738 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
1739 { 0x33, 0x33, 0x33, 0x33, 0x33, 0x00, 0x00, 0x00,
1740 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
1741 };
1742
1743 #endif /* MBEDTLS_CIPHER_MODE_XTS */
1744
1745 /*
1746 * Checkup routine
1747 */
mbedtls_aes_self_test(int verbose)1748 int mbedtls_aes_self_test( int verbose )
1749 {
1750 int ret = 0, i, j, u, mode;
1751 unsigned int keybits;
1752 unsigned char key[32];
1753 unsigned char buf[64];
1754 const unsigned char *aes_tests;
1755 #if defined(MBEDTLS_CIPHER_MODE_CBC) || defined(MBEDTLS_CIPHER_MODE_CFB)
1756 unsigned char iv[16];
1757 #endif
1758 #if defined(MBEDTLS_CIPHER_MODE_CBC)
1759 unsigned char prv[16];
1760 #endif
1761 #if defined(MBEDTLS_CIPHER_MODE_CTR) || defined(MBEDTLS_CIPHER_MODE_CFB) || \
1762 defined(MBEDTLS_CIPHER_MODE_OFB)
1763 size_t offset;
1764 #endif
1765 #if defined(MBEDTLS_CIPHER_MODE_CTR) || defined(MBEDTLS_CIPHER_MODE_XTS)
1766 int len;
1767 #endif
1768 #if defined(MBEDTLS_CIPHER_MODE_CTR)
1769 unsigned char nonce_counter[16];
1770 unsigned char stream_block[16];
1771 #endif
1772 mbedtls_aes_context ctx;
1773
1774 memset( key, 0, 32 );
1775 mbedtls_aes_init( &ctx );
1776
1777 /*
1778 * ECB mode
1779 */
1780 for( i = 0; i < 6; i++ )
1781 {
1782 u = i >> 1;
1783 keybits = 128 + u * 64;
1784 mode = i & 1;
1785
1786 if( verbose != 0 )
1787 mbedtls_printf( " AES-ECB-%3u (%s): ", keybits,
1788 ( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" );
1789
1790 memset( buf, 0, 16 );
1791
1792 if( mode == MBEDTLS_AES_DECRYPT )
1793 {
1794 ret = mbedtls_aes_setkey_dec( &ctx, key, keybits );
1795 aes_tests = aes_test_ecb_dec[u];
1796 }
1797 else
1798 {
1799 ret = mbedtls_aes_setkey_enc( &ctx, key, keybits );
1800 aes_tests = aes_test_ecb_enc[u];
1801 }
1802
1803 /*
1804 * AES-192 is an optional feature that may be unavailable when
1805 * there is an alternative underlying implementation i.e. when
1806 * MBEDTLS_AES_ALT is defined.
1807 */
1808 if( ret == MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED && keybits == 192 )
1809 {
1810 mbedtls_printf( "skipped\n" );
1811 continue;
1812 }
1813 else if( ret != 0 )
1814 {
1815 goto exit;
1816 }
1817
1818 for( j = 0; j < 10000; j++ )
1819 {
1820 ret = mbedtls_aes_crypt_ecb( &ctx, mode, buf, buf );
1821 if( ret != 0 )
1822 goto exit;
1823 }
1824
1825 if( memcmp( buf, aes_tests, 16 ) != 0 )
1826 {
1827 ret = 1;
1828 goto exit;
1829 }
1830
1831 if( verbose != 0 )
1832 mbedtls_printf( "passed\n" );
1833 }
1834
1835 if( verbose != 0 )
1836 mbedtls_printf( "\n" );
1837
1838 #if defined(MBEDTLS_CIPHER_MODE_CBC)
1839 /*
1840 * CBC mode
1841 */
1842 for( i = 0; i < 6; i++ )
1843 {
1844 u = i >> 1;
1845 keybits = 128 + u * 64;
1846 mode = i & 1;
1847
1848 if( verbose != 0 )
1849 mbedtls_printf( " AES-CBC-%3u (%s): ", keybits,
1850 ( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" );
1851
1852 memset( iv , 0, 16 );
1853 memset( prv, 0, 16 );
1854 memset( buf, 0, 16 );
1855
1856 if( mode == MBEDTLS_AES_DECRYPT )
1857 {
1858 ret = mbedtls_aes_setkey_dec( &ctx, key, keybits );
1859 aes_tests = aes_test_cbc_dec[u];
1860 }
1861 else
1862 {
1863 ret = mbedtls_aes_setkey_enc( &ctx, key, keybits );
1864 aes_tests = aes_test_cbc_enc[u];
1865 }
1866
1867 /*
1868 * AES-192 is an optional feature that may be unavailable when
1869 * there is an alternative underlying implementation i.e. when
1870 * MBEDTLS_AES_ALT is defined.
1871 */
1872 if( ret == MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED && keybits == 192 )
1873 {
1874 mbedtls_printf( "skipped\n" );
1875 continue;
1876 }
1877 else if( ret != 0 )
1878 {
1879 goto exit;
1880 }
1881
1882 for( j = 0; j < 10000; j++ )
1883 {
1884 if( mode == MBEDTLS_AES_ENCRYPT )
1885 {
1886 unsigned char tmp[16];
1887
1888 memcpy( tmp, prv, 16 );
1889 memcpy( prv, buf, 16 );
1890 memcpy( buf, tmp, 16 );
1891 }
1892
1893 ret = mbedtls_aes_crypt_cbc( &ctx, mode, 16, iv, buf, buf );
1894 if( ret != 0 )
1895 goto exit;
1896
1897 }
1898
1899 if( memcmp( buf, aes_tests, 16 ) != 0 )
1900 {
1901 ret = 1;
1902 goto exit;
1903 }
1904
1905 if( verbose != 0 )
1906 mbedtls_printf( "passed\n" );
1907 }
1908
1909 if( verbose != 0 )
1910 mbedtls_printf( "\n" );
1911 #endif /* MBEDTLS_CIPHER_MODE_CBC */
1912
1913 #if defined(MBEDTLS_CIPHER_MODE_CFB)
1914 /*
1915 * CFB128 mode
1916 */
1917 for( i = 0; i < 6; i++ )
1918 {
1919 u = i >> 1;
1920 keybits = 128 + u * 64;
1921 mode = i & 1;
1922
1923 if( verbose != 0 )
1924 mbedtls_printf( " AES-CFB128-%3u (%s): ", keybits,
1925 ( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" );
1926
1927 memcpy( iv, aes_test_cfb128_iv, 16 );
1928 memcpy( key, aes_test_cfb128_key[u], keybits / 8 );
1929
1930 offset = 0;
1931 ret = mbedtls_aes_setkey_enc( &ctx, key, keybits );
1932 /*
1933 * AES-192 is an optional feature that may be unavailable when
1934 * there is an alternative underlying implementation i.e. when
1935 * MBEDTLS_AES_ALT is defined.
1936 */
1937 if( ret == MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED && keybits == 192 )
1938 {
1939 mbedtls_printf( "skipped\n" );
1940 continue;
1941 }
1942 else if( ret != 0 )
1943 {
1944 goto exit;
1945 }
1946
1947 if( mode == MBEDTLS_AES_DECRYPT )
1948 {
1949 memcpy( buf, aes_test_cfb128_ct[u], 64 );
1950 aes_tests = aes_test_cfb128_pt;
1951 }
1952 else
1953 {
1954 memcpy( buf, aes_test_cfb128_pt, 64 );
1955 aes_tests = aes_test_cfb128_ct[u];
1956 }
1957
1958 ret = mbedtls_aes_crypt_cfb128( &ctx, mode, 64, &offset, iv, buf, buf );
1959 if( ret != 0 )
1960 goto exit;
1961
1962 if( memcmp( buf, aes_tests, 64 ) != 0 )
1963 {
1964 ret = 1;
1965 goto exit;
1966 }
1967
1968 if( verbose != 0 )
1969 mbedtls_printf( "passed\n" );
1970 }
1971
1972 if( verbose != 0 )
1973 mbedtls_printf( "\n" );
1974 #endif /* MBEDTLS_CIPHER_MODE_CFB */
1975
1976 #if defined(MBEDTLS_CIPHER_MODE_OFB)
1977 /*
1978 * OFB mode
1979 */
1980 for( i = 0; i < 6; i++ )
1981 {
1982 u = i >> 1;
1983 keybits = 128 + u * 64;
1984 mode = i & 1;
1985
1986 if( verbose != 0 )
1987 mbedtls_printf( " AES-OFB-%3u (%s): ", keybits,
1988 ( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" );
1989
1990 memcpy( iv, aes_test_ofb_iv, 16 );
1991 memcpy( key, aes_test_ofb_key[u], keybits / 8 );
1992
1993 offset = 0;
1994 ret = mbedtls_aes_setkey_enc( &ctx, key, keybits );
1995 /*
1996 * AES-192 is an optional feature that may be unavailable when
1997 * there is an alternative underlying implementation i.e. when
1998 * MBEDTLS_AES_ALT is defined.
1999 */
2000 if( ret == MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED && keybits == 192 )
2001 {
2002 mbedtls_printf( "skipped\n" );
2003 continue;
2004 }
2005 else if( ret != 0 )
2006 {
2007 goto exit;
2008 }
2009
2010 if( mode == MBEDTLS_AES_DECRYPT )
2011 {
2012 memcpy( buf, aes_test_ofb_ct[u], 64 );
2013 aes_tests = aes_test_ofb_pt;
2014 }
2015 else
2016 {
2017 memcpy( buf, aes_test_ofb_pt, 64 );
2018 aes_tests = aes_test_ofb_ct[u];
2019 }
2020
2021 ret = mbedtls_aes_crypt_ofb( &ctx, 64, &offset, iv, buf, buf );
2022 if( ret != 0 )
2023 goto exit;
2024
2025 if( memcmp( buf, aes_tests, 64 ) != 0 )
2026 {
2027 ret = 1;
2028 goto exit;
2029 }
2030
2031 if( verbose != 0 )
2032 mbedtls_printf( "passed\n" );
2033 }
2034
2035 if( verbose != 0 )
2036 mbedtls_printf( "\n" );
2037 #endif /* MBEDTLS_CIPHER_MODE_OFB */
2038
2039 #if defined(MBEDTLS_CIPHER_MODE_CTR)
2040 /*
2041 * CTR mode
2042 */
2043 for( i = 0; i < 6; i++ )
2044 {
2045 u = i >> 1;
2046 mode = i & 1;
2047
2048 if( verbose != 0 )
2049 mbedtls_printf( " AES-CTR-128 (%s): ",
2050 ( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" );
2051
2052 memcpy( nonce_counter, aes_test_ctr_nonce_counter[u], 16 );
2053 memcpy( key, aes_test_ctr_key[u], 16 );
2054
2055 offset = 0;
2056 if( ( ret = mbedtls_aes_setkey_enc( &ctx, key, 128 ) ) != 0 )
2057 goto exit;
2058
2059 len = aes_test_ctr_len[u];
2060
2061 if( mode == MBEDTLS_AES_DECRYPT )
2062 {
2063 memcpy( buf, aes_test_ctr_ct[u], len );
2064 aes_tests = aes_test_ctr_pt[u];
2065 }
2066 else
2067 {
2068 memcpy( buf, aes_test_ctr_pt[u], len );
2069 aes_tests = aes_test_ctr_ct[u];
2070 }
2071
2072 ret = mbedtls_aes_crypt_ctr( &ctx, len, &offset, nonce_counter,
2073 stream_block, buf, buf );
2074 if( ret != 0 )
2075 goto exit;
2076
2077 if( memcmp( buf, aes_tests, len ) != 0 )
2078 {
2079 ret = 1;
2080 goto exit;
2081 }
2082
2083 if( verbose != 0 )
2084 mbedtls_printf( "passed\n" );
2085 }
2086
2087 if( verbose != 0 )
2088 mbedtls_printf( "\n" );
2089 #endif /* MBEDTLS_CIPHER_MODE_CTR */
2090
2091 #if defined(MBEDTLS_CIPHER_MODE_XTS)
2092 {
2093 static const int num_tests =
2094 sizeof(aes_test_xts_key) / sizeof(*aes_test_xts_key);
2095 mbedtls_aes_xts_context ctx_xts;
2096
2097 /*
2098 * XTS mode
2099 */
2100 mbedtls_aes_xts_init( &ctx_xts );
2101
2102 for( i = 0; i < num_tests << 1; i++ )
2103 {
2104 const unsigned char *data_unit;
2105 u = i >> 1;
2106 mode = i & 1;
2107
2108 if( verbose != 0 )
2109 mbedtls_printf( " AES-XTS-128 (%s): ",
2110 ( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" );
2111
2112 memset( key, 0, sizeof( key ) );
2113 memcpy( key, aes_test_xts_key[u], 32 );
2114 data_unit = aes_test_xts_data_unit[u];
2115
2116 len = sizeof( *aes_test_xts_ct32 );
2117
2118 if( mode == MBEDTLS_AES_DECRYPT )
2119 {
2120 ret = mbedtls_aes_xts_setkey_dec( &ctx_xts, key, 256 );
2121 if( ret != 0)
2122 goto exit;
2123 memcpy( buf, aes_test_xts_ct32[u], len );
2124 aes_tests = aes_test_xts_pt32[u];
2125 }
2126 else
2127 {
2128 ret = mbedtls_aes_xts_setkey_enc( &ctx_xts, key, 256 );
2129 if( ret != 0)
2130 goto exit;
2131 memcpy( buf, aes_test_xts_pt32[u], len );
2132 aes_tests = aes_test_xts_ct32[u];
2133 }
2134
2135
2136 ret = mbedtls_aes_crypt_xts( &ctx_xts, mode, len, data_unit,
2137 buf, buf );
2138 if( ret != 0 )
2139 goto exit;
2140
2141 if( memcmp( buf, aes_tests, len ) != 0 )
2142 {
2143 ret = 1;
2144 goto exit;
2145 }
2146
2147 if( verbose != 0 )
2148 mbedtls_printf( "passed\n" );
2149 }
2150
2151 if( verbose != 0 )
2152 mbedtls_printf( "\n" );
2153
2154 mbedtls_aes_xts_free( &ctx_xts );
2155 }
2156 #endif /* MBEDTLS_CIPHER_MODE_XTS */
2157
2158 ret = 0;
2159
2160 exit:
2161 if( ret != 0 && verbose != 0 )
2162 mbedtls_printf( "failed\n" );
2163
2164 mbedtls_aes_free( &ctx );
2165
2166 return( ret );
2167 }
2168
2169 #endif /* MBEDTLS_SELF_TEST */
2170
2171 #endif /* MBEDTLS_AES_C */
2172