1 /*
2 * FIPS-197 compliant AES implementation
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 */
19 /*
20 * The AES block cipher was designed by Vincent Rijmen and Joan Daemen.
21 *
22 * http://csrc.nist.gov/encryption/aes/rijndael/Rijndael.pdf
23 * http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf
24 */
25
26 #include "common.h"
27
28 #if defined(MBEDTLS_AES_C)
29
30 #include <string.h>
31
32 #include "mbedtls/aes.h"
33 #include "mbedtls/platform.h"
34 #include "mbedtls/platform_util.h"
35 #include "mbedtls/error.h"
36 #if defined(VENDOR_REDEFINE_TEE_API_C)
37 #include "mbedtls/hw_redefine_tee_api.h"
38 #endif
39 #include "mbedtls/hw_tee_tag.h"
40 #if defined(MBEDTLS_PADLOCK_C)
41 #include "padlock.h"
42 #endif
43 #if defined(MBEDTLS_AESNI_C)
44 #include "aesni.h"
45 #endif
46
47 #if defined(MBEDTLS_SELF_TEST)
48 #if defined(MBEDTLS_PLATFORM_C)
49 #include "mbedtls/platform.h"
50 #else
51 #include <stdio.h>
52 #define mbedtls_printf printf
53 #endif /* MBEDTLS_PLATFORM_C */
54 #endif /* MBEDTLS_SELF_TEST */
55
56 #if !defined(MBEDTLS_AES_ALT)
57
58 /* Parameter validation macros based on platform_util.h */
59 #define AES_VALIDATE_RET( cond ) \
60 MBEDTLS_INTERNAL_VALIDATE_RET( cond, MBEDTLS_ERR_AES_BAD_INPUT_DATA )
61 #define AES_VALIDATE( cond ) \
62 MBEDTLS_INTERNAL_VALIDATE( cond )
63
64 #if defined(MBEDTLS_PADLOCK_C) && \
65 ( defined(MBEDTLS_HAVE_X86) || defined(MBEDTLS_PADLOCK_ALIGN16) )
66 static int aes_padlock_ace = -1;
67 #endif
68
69 #if defined(MBEDTLS_AES_ROM_TABLES)
70 /*
71 * Forward S-box
72 */
73 static const unsigned char FSb[256] =
74 {
75 0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5,
76 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76,
77 0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0,
78 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0,
79 0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC,
80 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,
81 0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A,
82 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75,
83 0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0,
84 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84,
85 0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B,
86 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,
87 0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85,
88 0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8,
89 0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5,
90 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2,
91 0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17,
92 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73,
93 0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88,
94 0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB,
95 0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C,
96 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79,
97 0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9,
98 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08,
99 0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6,
100 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A,
101 0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E,
102 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E,
103 0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94,
104 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,
105 0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68,
106 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16
107 };
108
109 /*
110 * Forward tables
111 */
112 #define FT \
113 \
114 V(A5,63,63,C6), V(84,7C,7C,F8), V(99,77,77,EE), V(8D,7B,7B,F6), \
115 V(0D,F2,F2,FF), V(BD,6B,6B,D6), V(B1,6F,6F,DE), V(54,C5,C5,91), \
116 V(50,30,30,60), V(03,01,01,02), V(A9,67,67,CE), V(7D,2B,2B,56), \
117 V(19,FE,FE,E7), V(62,D7,D7,B5), V(E6,AB,AB,4D), V(9A,76,76,EC), \
118 V(45,CA,CA,8F), V(9D,82,82,1F), V(40,C9,C9,89), V(87,7D,7D,FA), \
119 V(15,FA,FA,EF), V(EB,59,59,B2), V(C9,47,47,8E), V(0B,F0,F0,FB), \
120 V(EC,AD,AD,41), V(67,D4,D4,B3), V(FD,A2,A2,5F), V(EA,AF,AF,45), \
121 V(BF,9C,9C,23), V(F7,A4,A4,53), V(96,72,72,E4), V(5B,C0,C0,9B), \
122 V(C2,B7,B7,75), V(1C,FD,FD,E1), V(AE,93,93,3D), V(6A,26,26,4C), \
123 V(5A,36,36,6C), V(41,3F,3F,7E), V(02,F7,F7,F5), V(4F,CC,CC,83), \
124 V(5C,34,34,68), V(F4,A5,A5,51), V(34,E5,E5,D1), V(08,F1,F1,F9), \
125 V(93,71,71,E2), V(73,D8,D8,AB), V(53,31,31,62), V(3F,15,15,2A), \
126 V(0C,04,04,08), V(52,C7,C7,95), V(65,23,23,46), V(5E,C3,C3,9D), \
127 V(28,18,18,30), V(A1,96,96,37), V(0F,05,05,0A), V(B5,9A,9A,2F), \
128 V(09,07,07,0E), V(36,12,12,24), V(9B,80,80,1B), V(3D,E2,E2,DF), \
129 V(26,EB,EB,CD), V(69,27,27,4E), V(CD,B2,B2,7F), V(9F,75,75,EA), \
130 V(1B,09,09,12), V(9E,83,83,1D), V(74,2C,2C,58), V(2E,1A,1A,34), \
131 V(2D,1B,1B,36), V(B2,6E,6E,DC), V(EE,5A,5A,B4), V(FB,A0,A0,5B), \
132 V(F6,52,52,A4), V(4D,3B,3B,76), V(61,D6,D6,B7), V(CE,B3,B3,7D), \
133 V(7B,29,29,52), V(3E,E3,E3,DD), V(71,2F,2F,5E), V(97,84,84,13), \
134 V(F5,53,53,A6), V(68,D1,D1,B9), V(00,00,00,00), V(2C,ED,ED,C1), \
135 V(60,20,20,40), V(1F,FC,FC,E3), V(C8,B1,B1,79), V(ED,5B,5B,B6), \
136 V(BE,6A,6A,D4), V(46,CB,CB,8D), V(D9,BE,BE,67), V(4B,39,39,72), \
137 V(DE,4A,4A,94), V(D4,4C,4C,98), V(E8,58,58,B0), V(4A,CF,CF,85), \
138 V(6B,D0,D0,BB), V(2A,EF,EF,C5), V(E5,AA,AA,4F), V(16,FB,FB,ED), \
139 V(C5,43,43,86), V(D7,4D,4D,9A), V(55,33,33,66), V(94,85,85,11), \
140 V(CF,45,45,8A), V(10,F9,F9,E9), V(06,02,02,04), V(81,7F,7F,FE), \
141 V(F0,50,50,A0), V(44,3C,3C,78), V(BA,9F,9F,25), V(E3,A8,A8,4B), \
142 V(F3,51,51,A2), V(FE,A3,A3,5D), V(C0,40,40,80), V(8A,8F,8F,05), \
143 V(AD,92,92,3F), V(BC,9D,9D,21), V(48,38,38,70), V(04,F5,F5,F1), \
144 V(DF,BC,BC,63), V(C1,B6,B6,77), V(75,DA,DA,AF), V(63,21,21,42), \
145 V(30,10,10,20), V(1A,FF,FF,E5), V(0E,F3,F3,FD), V(6D,D2,D2,BF), \
146 V(4C,CD,CD,81), V(14,0C,0C,18), V(35,13,13,26), V(2F,EC,EC,C3), \
147 V(E1,5F,5F,BE), V(A2,97,97,35), V(CC,44,44,88), V(39,17,17,2E), \
148 V(57,C4,C4,93), V(F2,A7,A7,55), V(82,7E,7E,FC), V(47,3D,3D,7A), \
149 V(AC,64,64,C8), V(E7,5D,5D,BA), V(2B,19,19,32), V(95,73,73,E6), \
150 V(A0,60,60,C0), V(98,81,81,19), V(D1,4F,4F,9E), V(7F,DC,DC,A3), \
151 V(66,22,22,44), V(7E,2A,2A,54), V(AB,90,90,3B), V(83,88,88,0B), \
152 V(CA,46,46,8C), V(29,EE,EE,C7), V(D3,B8,B8,6B), V(3C,14,14,28), \
153 V(79,DE,DE,A7), V(E2,5E,5E,BC), V(1D,0B,0B,16), V(76,DB,DB,AD), \
154 V(3B,E0,E0,DB), V(56,32,32,64), V(4E,3A,3A,74), V(1E,0A,0A,14), \
155 V(DB,49,49,92), V(0A,06,06,0C), V(6C,24,24,48), V(E4,5C,5C,B8), \
156 V(5D,C2,C2,9F), V(6E,D3,D3,BD), V(EF,AC,AC,43), V(A6,62,62,C4), \
157 V(A8,91,91,39), V(A4,95,95,31), V(37,E4,E4,D3), V(8B,79,79,F2), \
158 V(32,E7,E7,D5), V(43,C8,C8,8B), V(59,37,37,6E), V(B7,6D,6D,DA), \
159 V(8C,8D,8D,01), V(64,D5,D5,B1), V(D2,4E,4E,9C), V(E0,A9,A9,49), \
160 V(B4,6C,6C,D8), V(FA,56,56,AC), V(07,F4,F4,F3), V(25,EA,EA,CF), \
161 V(AF,65,65,CA), V(8E,7A,7A,F4), V(E9,AE,AE,47), V(18,08,08,10), \
162 V(D5,BA,BA,6F), V(88,78,78,F0), V(6F,25,25,4A), V(72,2E,2E,5C), \
163 V(24,1C,1C,38), V(F1,A6,A6,57), V(C7,B4,B4,73), V(51,C6,C6,97), \
164 V(23,E8,E8,CB), V(7C,DD,DD,A1), V(9C,74,74,E8), V(21,1F,1F,3E), \
165 V(DD,4B,4B,96), V(DC,BD,BD,61), V(86,8B,8B,0D), V(85,8A,8A,0F), \
166 V(90,70,70,E0), V(42,3E,3E,7C), V(C4,B5,B5,71), V(AA,66,66,CC), \
167 V(D8,48,48,90), V(05,03,03,06), V(01,F6,F6,F7), V(12,0E,0E,1C), \
168 V(A3,61,61,C2), V(5F,35,35,6A), V(F9,57,57,AE), V(D0,B9,B9,69), \
169 V(91,86,86,17), V(58,C1,C1,99), V(27,1D,1D,3A), V(B9,9E,9E,27), \
170 V(38,E1,E1,D9), V(13,F8,F8,EB), V(B3,98,98,2B), V(33,11,11,22), \
171 V(BB,69,69,D2), V(70,D9,D9,A9), V(89,8E,8E,07), V(A7,94,94,33), \
172 V(B6,9B,9B,2D), V(22,1E,1E,3C), V(92,87,87,15), V(20,E9,E9,C9), \
173 V(49,CE,CE,87), V(FF,55,55,AA), V(78,28,28,50), V(7A,DF,DF,A5), \
174 V(8F,8C,8C,03), V(F8,A1,A1,59), V(80,89,89,09), V(17,0D,0D,1A), \
175 V(DA,BF,BF,65), V(31,E6,E6,D7), V(C6,42,42,84), V(B8,68,68,D0), \
176 V(C3,41,41,82), V(B0,99,99,29), V(77,2D,2D,5A), V(11,0F,0F,1E), \
177 V(CB,B0,B0,7B), V(FC,54,54,A8), V(D6,BB,BB,6D), V(3A,16,16,2C)
178
179 #define V(a,b,c,d) 0x##a##b##c##d
180 const uint32_t FT0[256] = { FT };
181 #undef V
182
183 #if !defined(MBEDTLS_AES_FEWER_TABLES)
184
185 #define V(a,b,c,d) 0x##b##c##d##a
186 const uint32_t FT1[256] = { FT };
187 #undef V
188
189 #define V(a,b,c,d) 0x##c##d##a##b
190 const uint32_t FT2[256] = { FT };
191 #undef V
192
193 #define V(a,b,c,d) 0x##d##a##b##c
194 const uint32_t FT3[256] = { FT };
195 #undef V
196
197 #endif /* !MBEDTLS_AES_FEWER_TABLES */
198
199 #undef FT
200
201 /*
202 * Reverse S-box
203 */
204 static const unsigned char RSb[256] =
205 {
206 0x52, 0x09, 0x6A, 0xD5, 0x30, 0x36, 0xA5, 0x38,
207 0xBF, 0x40, 0xA3, 0x9E, 0x81, 0xF3, 0xD7, 0xFB,
208 0x7C, 0xE3, 0x39, 0x82, 0x9B, 0x2F, 0xFF, 0x87,
209 0x34, 0x8E, 0x43, 0x44, 0xC4, 0xDE, 0xE9, 0xCB,
210 0x54, 0x7B, 0x94, 0x32, 0xA6, 0xC2, 0x23, 0x3D,
211 0xEE, 0x4C, 0x95, 0x0B, 0x42, 0xFA, 0xC3, 0x4E,
212 0x08, 0x2E, 0xA1, 0x66, 0x28, 0xD9, 0x24, 0xB2,
213 0x76, 0x5B, 0xA2, 0x49, 0x6D, 0x8B, 0xD1, 0x25,
214 0x72, 0xF8, 0xF6, 0x64, 0x86, 0x68, 0x98, 0x16,
215 0xD4, 0xA4, 0x5C, 0xCC, 0x5D, 0x65, 0xB6, 0x92,
216 0x6C, 0x70, 0x48, 0x50, 0xFD, 0xED, 0xB9, 0xDA,
217 0x5E, 0x15, 0x46, 0x57, 0xA7, 0x8D, 0x9D, 0x84,
218 0x90, 0xD8, 0xAB, 0x00, 0x8C, 0xBC, 0xD3, 0x0A,
219 0xF7, 0xE4, 0x58, 0x05, 0xB8, 0xB3, 0x45, 0x06,
220 0xD0, 0x2C, 0x1E, 0x8F, 0xCA, 0x3F, 0x0F, 0x02,
221 0xC1, 0xAF, 0xBD, 0x03, 0x01, 0x13, 0x8A, 0x6B,
222 0x3A, 0x91, 0x11, 0x41, 0x4F, 0x67, 0xDC, 0xEA,
223 0x97, 0xF2, 0xCF, 0xCE, 0xF0, 0xB4, 0xE6, 0x73,
224 0x96, 0xAC, 0x74, 0x22, 0xE7, 0xAD, 0x35, 0x85,
225 0xE2, 0xF9, 0x37, 0xE8, 0x1C, 0x75, 0xDF, 0x6E,
226 0x47, 0xF1, 0x1A, 0x71, 0x1D, 0x29, 0xC5, 0x89,
227 0x6F, 0xB7, 0x62, 0x0E, 0xAA, 0x18, 0xBE, 0x1B,
228 0xFC, 0x56, 0x3E, 0x4B, 0xC6, 0xD2, 0x79, 0x20,
229 0x9A, 0xDB, 0xC0, 0xFE, 0x78, 0xCD, 0x5A, 0xF4,
230 0x1F, 0xDD, 0xA8, 0x33, 0x88, 0x07, 0xC7, 0x31,
231 0xB1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xEC, 0x5F,
232 0x60, 0x51, 0x7F, 0xA9, 0x19, 0xB5, 0x4A, 0x0D,
233 0x2D, 0xE5, 0x7A, 0x9F, 0x93, 0xC9, 0x9C, 0xEF,
234 0xA0, 0xE0, 0x3B, 0x4D, 0xAE, 0x2A, 0xF5, 0xB0,
235 0xC8, 0xEB, 0xBB, 0x3C, 0x83, 0x53, 0x99, 0x61,
236 0x17, 0x2B, 0x04, 0x7E, 0xBA, 0x77, 0xD6, 0x26,
237 0xE1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0C, 0x7D
238 };
239
240 /*
241 * Reverse tables
242 */
243 #define RT \
244 \
245 V(50,A7,F4,51), V(53,65,41,7E), V(C3,A4,17,1A), V(96,5E,27,3A), \
246 V(CB,6B,AB,3B), V(F1,45,9D,1F), V(AB,58,FA,AC), V(93,03,E3,4B), \
247 V(55,FA,30,20), V(F6,6D,76,AD), V(91,76,CC,88), V(25,4C,02,F5), \
248 V(FC,D7,E5,4F), V(D7,CB,2A,C5), V(80,44,35,26), V(8F,A3,62,B5), \
249 V(49,5A,B1,DE), V(67,1B,BA,25), V(98,0E,EA,45), V(E1,C0,FE,5D), \
250 V(02,75,2F,C3), V(12,F0,4C,81), V(A3,97,46,8D), V(C6,F9,D3,6B), \
251 V(E7,5F,8F,03), V(95,9C,92,15), V(EB,7A,6D,BF), V(DA,59,52,95), \
252 V(2D,83,BE,D4), V(D3,21,74,58), V(29,69,E0,49), V(44,C8,C9,8E), \
253 V(6A,89,C2,75), V(78,79,8E,F4), V(6B,3E,58,99), V(DD,71,B9,27), \
254 V(B6,4F,E1,BE), V(17,AD,88,F0), V(66,AC,20,C9), V(B4,3A,CE,7D), \
255 V(18,4A,DF,63), V(82,31,1A,E5), V(60,33,51,97), V(45,7F,53,62), \
256 V(E0,77,64,B1), V(84,AE,6B,BB), V(1C,A0,81,FE), V(94,2B,08,F9), \
257 V(58,68,48,70), V(19,FD,45,8F), V(87,6C,DE,94), V(B7,F8,7B,52), \
258 V(23,D3,73,AB), V(E2,02,4B,72), V(57,8F,1F,E3), V(2A,AB,55,66), \
259 V(07,28,EB,B2), V(03,C2,B5,2F), V(9A,7B,C5,86), V(A5,08,37,D3), \
260 V(F2,87,28,30), V(B2,A5,BF,23), V(BA,6A,03,02), V(5C,82,16,ED), \
261 V(2B,1C,CF,8A), V(92,B4,79,A7), V(F0,F2,07,F3), V(A1,E2,69,4E), \
262 V(CD,F4,DA,65), V(D5,BE,05,06), V(1F,62,34,D1), V(8A,FE,A6,C4), \
263 V(9D,53,2E,34), V(A0,55,F3,A2), V(32,E1,8A,05), V(75,EB,F6,A4), \
264 V(39,EC,83,0B), V(AA,EF,60,40), V(06,9F,71,5E), V(51,10,6E,BD), \
265 V(F9,8A,21,3E), V(3D,06,DD,96), V(AE,05,3E,DD), V(46,BD,E6,4D), \
266 V(B5,8D,54,91), V(05,5D,C4,71), V(6F,D4,06,04), V(FF,15,50,60), \
267 V(24,FB,98,19), V(97,E9,BD,D6), V(CC,43,40,89), V(77,9E,D9,67), \
268 V(BD,42,E8,B0), V(88,8B,89,07), V(38,5B,19,E7), V(DB,EE,C8,79), \
269 V(47,0A,7C,A1), V(E9,0F,42,7C), V(C9,1E,84,F8), V(00,00,00,00), \
270 V(83,86,80,09), V(48,ED,2B,32), V(AC,70,11,1E), V(4E,72,5A,6C), \
271 V(FB,FF,0E,FD), V(56,38,85,0F), V(1E,D5,AE,3D), V(27,39,2D,36), \
272 V(64,D9,0F,0A), V(21,A6,5C,68), V(D1,54,5B,9B), V(3A,2E,36,24), \
273 V(B1,67,0A,0C), V(0F,E7,57,93), V(D2,96,EE,B4), V(9E,91,9B,1B), \
274 V(4F,C5,C0,80), V(A2,20,DC,61), V(69,4B,77,5A), V(16,1A,12,1C), \
275 V(0A,BA,93,E2), V(E5,2A,A0,C0), V(43,E0,22,3C), V(1D,17,1B,12), \
276 V(0B,0D,09,0E), V(AD,C7,8B,F2), V(B9,A8,B6,2D), V(C8,A9,1E,14), \
277 V(85,19,F1,57), V(4C,07,75,AF), V(BB,DD,99,EE), V(FD,60,7F,A3), \
278 V(9F,26,01,F7), V(BC,F5,72,5C), V(C5,3B,66,44), V(34,7E,FB,5B), \
279 V(76,29,43,8B), V(DC,C6,23,CB), V(68,FC,ED,B6), V(63,F1,E4,B8), \
280 V(CA,DC,31,D7), V(10,85,63,42), V(40,22,97,13), V(20,11,C6,84), \
281 V(7D,24,4A,85), V(F8,3D,BB,D2), V(11,32,F9,AE), V(6D,A1,29,C7), \
282 V(4B,2F,9E,1D), V(F3,30,B2,DC), V(EC,52,86,0D), V(D0,E3,C1,77), \
283 V(6C,16,B3,2B), V(99,B9,70,A9), V(FA,48,94,11), V(22,64,E9,47), \
284 V(C4,8C,FC,A8), V(1A,3F,F0,A0), V(D8,2C,7D,56), V(EF,90,33,22), \
285 V(C7,4E,49,87), V(C1,D1,38,D9), V(FE,A2,CA,8C), V(36,0B,D4,98), \
286 V(CF,81,F5,A6), V(28,DE,7A,A5), V(26,8E,B7,DA), V(A4,BF,AD,3F), \
287 V(E4,9D,3A,2C), V(0D,92,78,50), V(9B,CC,5F,6A), V(62,46,7E,54), \
288 V(C2,13,8D,F6), V(E8,B8,D8,90), V(5E,F7,39,2E), V(F5,AF,C3,82), \
289 V(BE,80,5D,9F), V(7C,93,D0,69), V(A9,2D,D5,6F), V(B3,12,25,CF), \
290 V(3B,99,AC,C8), V(A7,7D,18,10), V(6E,63,9C,E8), V(7B,BB,3B,DB), \
291 V(09,78,26,CD), V(F4,18,59,6E), V(01,B7,9A,EC), V(A8,9A,4F,83), \
292 V(65,6E,95,E6), V(7E,E6,FF,AA), V(08,CF,BC,21), V(E6,E8,15,EF), \
293 V(D9,9B,E7,BA), V(CE,36,6F,4A), V(D4,09,9F,EA), V(D6,7C,B0,29), \
294 V(AF,B2,A4,31), V(31,23,3F,2A), V(30,94,A5,C6), V(C0,66,A2,35), \
295 V(37,BC,4E,74), V(A6,CA,82,FC), V(B0,D0,90,E0), V(15,D8,A7,33), \
296 V(4A,98,04,F1), V(F7,DA,EC,41), V(0E,50,CD,7F), V(2F,F6,91,17), \
297 V(8D,D6,4D,76), V(4D,B0,EF,43), V(54,4D,AA,CC), V(DF,04,96,E4), \
298 V(E3,B5,D1,9E), V(1B,88,6A,4C), V(B8,1F,2C,C1), V(7F,51,65,46), \
299 V(04,EA,5E,9D), V(5D,35,8C,01), V(73,74,87,FA), V(2E,41,0B,FB), \
300 V(5A,1D,67,B3), V(52,D2,DB,92), V(33,56,10,E9), V(13,47,D6,6D), \
301 V(8C,61,D7,9A), V(7A,0C,A1,37), V(8E,14,F8,59), V(89,3C,13,EB), \
302 V(EE,27,A9,CE), V(35,C9,61,B7), V(ED,E5,1C,E1), V(3C,B1,47,7A), \
303 V(59,DF,D2,9C), V(3F,73,F2,55), V(79,CE,14,18), V(BF,37,C7,73), \
304 V(EA,CD,F7,53), V(5B,AA,FD,5F), V(14,6F,3D,DF), V(86,DB,44,78), \
305 V(81,F3,AF,CA), V(3E,C4,68,B9), V(2C,34,24,38), V(5F,40,A3,C2), \
306 V(72,C3,1D,16), V(0C,25,E2,BC), V(8B,49,3C,28), V(41,95,0D,FF), \
307 V(71,01,A8,39), V(DE,B3,0C,08), V(9C,E4,B4,D8), V(90,C1,56,64), \
308 V(61,84,CB,7B), V(70,B6,32,D5), V(74,5C,6C,48), V(42,57,B8,D0)
309
310 #define V(a,b,c,d) 0x##a##b##c##d
311 const uint32_t RT0[256] = { RT };
312 #undef V
313
314 #if !defined(MBEDTLS_AES_FEWER_TABLES)
315
316 #define V(a,b,c,d) 0x##b##c##d##a
317 const uint32_t RT1[256] = { RT };
318 #undef V
319
320 #define V(a,b,c,d) 0x##c##d##a##b
321 const uint32_t RT2[256] = { RT };
322 #undef V
323
324 #define V(a,b,c,d) 0x##d##a##b##c
325 const uint32_t RT3[256] = { RT };
326 #undef V
327
328 #endif /* !MBEDTLS_AES_FEWER_TABLES */
329
330 #undef RT
331
332 /*
333 * Round constants
334 */
335 static const uint32_t RCON[10] =
336 {
337 0x00000001, 0x00000002, 0x00000004, 0x00000008,
338 0x00000010, 0x00000020, 0x00000040, 0x00000080,
339 0x0000001B, 0x00000036
340 };
341
342 #else /* MBEDTLS_AES_ROM_TABLES */
343
344 /*
345 * Forward S-box & tables
346 */
347 static unsigned char FSb[256];
348 static uint32_t FT0[256];
349 #if !defined(MBEDTLS_AES_FEWER_TABLES)
350 static uint32_t FT1[256];
351 static uint32_t FT2[256];
352 static uint32_t FT3[256];
353 #endif /* !MBEDTLS_AES_FEWER_TABLES */
354
355 /*
356 * Reverse S-box & tables
357 */
358 static unsigned char RSb[256];
359 static uint32_t RT0[256];
360 #if !defined(MBEDTLS_AES_FEWER_TABLES)
361 static uint32_t RT1[256];
362 static uint32_t RT2[256];
363 static uint32_t RT3[256];
364 #endif /* !MBEDTLS_AES_FEWER_TABLES */
365
366 /*
367 * Round constants
368 */
369 static uint32_t RCON[10];
370
371 /*
372 * Tables generation code
373 */
374 #define ROTL8(x) ( ( (x) << 8 ) & 0xFFFFFFFF ) | ( (x) >> 24 )
375 #define XTIME(x) ( ( (x) << 1 ) ^ ( ( (x) & 0x80 ) ? 0x1B : 0x00 ) )
376 #define MUL(x,y) ( ( (x) && (y) ) ? pow[(log[(x)]+log[(y)]) % 255] : 0 )
377
378 static int aes_init_done = 0;
379
aes_gen_tables(void)380 static void aes_gen_tables( void )
381 {
382 int i, x, y, z;
383 int pow[256];
384 int log[256];
385
386 /*
387 * compute pow and log tables over GF(2^8)
388 */
389 for( i = 0, x = 1; i < 256; i++ )
390 {
391 pow[i] = x;
392 log[x] = i;
393 x = MBEDTLS_BYTE_0( x ^ XTIME( x ) );
394 }
395
396 /*
397 * calculate the round constants
398 */
399 for( i = 0, x = 1; i < 10; i++ )
400 {
401 RCON[i] = (uint32_t) x;
402 x = MBEDTLS_BYTE_0( XTIME( x ) );
403 }
404
405 /*
406 * generate the forward and reverse S-boxes
407 */
408 FSb[0x00] = 0x63;
409 RSb[0x63] = 0x00;
410
411 for( i = 1; i < 256; i++ )
412 {
413 x = pow[255 - log[i]];
414
415 y = x; y = MBEDTLS_BYTE_0( ( y << 1 ) | ( y >> 7 ) );
416 x ^= y; y = MBEDTLS_BYTE_0( ( y << 1 ) | ( y >> 7 ) );
417 x ^= y; y = MBEDTLS_BYTE_0( ( y << 1 ) | ( y >> 7 ) );
418 x ^= y; y = MBEDTLS_BYTE_0( ( y << 1 ) | ( y >> 7 ) );
419 x ^= y ^ 0x63;
420
421 FSb[i] = (unsigned char) x;
422 RSb[x] = (unsigned char) i;
423 }
424
425 /*
426 * generate the forward and reverse tables
427 */
428 for( i = 0; i < 256; i++ )
429 {
430 x = FSb[i];
431 y = MBEDTLS_BYTE_0( XTIME( x ) );
432 z = MBEDTLS_BYTE_0( y ^ x );
433
434 FT0[i] = ( (uint32_t) y ) ^
435 ( (uint32_t) x << 8 ) ^
436 ( (uint32_t) x << 16 ) ^
437 ( (uint32_t) z << 24 );
438
439 #if !defined(MBEDTLS_AES_FEWER_TABLES)
440 FT1[i] = ROTL8( FT0[i] );
441 FT2[i] = ROTL8( FT1[i] );
442 FT3[i] = ROTL8( FT2[i] );
443 #endif /* !MBEDTLS_AES_FEWER_TABLES */
444
445 x = RSb[i];
446
447 RT0[i] = ( (uint32_t) MUL( 0x0E, x ) ) ^
448 ( (uint32_t) MUL( 0x09, x ) << 8 ) ^
449 ( (uint32_t) MUL( 0x0D, x ) << 16 ) ^
450 ( (uint32_t) MUL( 0x0B, x ) << 24 );
451
452 #if !defined(MBEDTLS_AES_FEWER_TABLES)
453 RT1[i] = ROTL8( RT0[i] );
454 RT2[i] = ROTL8( RT1[i] );
455 RT3[i] = ROTL8( RT2[i] );
456 #endif /* !MBEDTLS_AES_FEWER_TABLES */
457 }
458 }
459
460 #undef ROTL8
461
462 #endif /* MBEDTLS_AES_ROM_TABLES */
463
464 #if defined(MBEDTLS_AES_FEWER_TABLES)
465
466 #define ROTL8(x) ( (uint32_t)( ( x ) << 8 ) + (uint32_t)( ( x ) >> 24 ) )
467 #define ROTL16(x) ( (uint32_t)( ( x ) << 16 ) + (uint32_t)( ( x ) >> 16 ) )
468 #define ROTL24(x) ( (uint32_t)( ( x ) << 24 ) + (uint32_t)( ( x ) >> 8 ) )
469
470 #define AES_RT0(idx) RT0[idx]
471 #define AES_RT1(idx) ROTL8( RT0[idx] )
472 #define AES_RT2(idx) ROTL16( RT0[idx] )
473 #define AES_RT3(idx) ROTL24( RT0[idx] )
474
475 #define AES_FT0(idx) FT0[idx]
476 #define AES_FT1(idx) ROTL8( FT0[idx] )
477 #define AES_FT2(idx) ROTL16( FT0[idx] )
478 #define AES_FT3(idx) ROTL24( FT0[idx] )
479
480 #else /* MBEDTLS_AES_FEWER_TABLES */
481
482 #define AES_RT0(idx) RT0[idx]
483 #define AES_RT1(idx) RT1[idx]
484 #define AES_RT2(idx) RT2[idx]
485 #define AES_RT3(idx) RT3[idx]
486
487 #define AES_FT0(idx) FT0[idx]
488 #define AES_FT1(idx) FT1[idx]
489 #define AES_FT2(idx) FT2[idx]
490 #define AES_FT3(idx) FT3[idx]
491
492 #endif /* MBEDTLS_AES_FEWER_TABLES */
493
mbedtls_aes_init(mbedtls_aes_context * ctx)494 void mbedtls_aes_init( mbedtls_aes_context *ctx )
495 {
496 AES_VALIDATE( ctx != NULL );
497
498 memset( ctx, 0, sizeof( mbedtls_aes_context ) );
499 }
500
mbedtls_aes_free(mbedtls_aes_context * ctx)501 void mbedtls_aes_free( mbedtls_aes_context *ctx )
502 {
503 if( ctx == NULL )
504 return;
505
506 mbedtls_platform_zeroize( ctx, sizeof( mbedtls_aes_context ) );
507 }
508
509 #if defined(MBEDTLS_CIPHER_MODE_XTS)
mbedtls_aes_xts_init(mbedtls_aes_xts_context * ctx)510 void mbedtls_aes_xts_init( mbedtls_aes_xts_context *ctx )
511 {
512 AES_VALIDATE( ctx != NULL );
513
514 mbedtls_aes_init( &ctx->crypt );
515 mbedtls_aes_init( &ctx->tweak );
516 }
517
mbedtls_aes_xts_free(mbedtls_aes_xts_context * ctx)518 void mbedtls_aes_xts_free( mbedtls_aes_xts_context *ctx )
519 {
520 if( ctx == NULL )
521 return;
522
523 mbedtls_aes_free( &ctx->crypt );
524 mbedtls_aes_free( &ctx->tweak );
525 }
526 #endif /* MBEDTLS_CIPHER_MODE_XTS */
527
528 /*
529 * AES key schedule (encryption)
530 */
531 #if !defined(MBEDTLS_AES_SETKEY_ENC_ALT)
532 FLA_TAG STROBF_TAG
mbedtls_aes_setkey_enc(mbedtls_aes_context * ctx,const unsigned char * key,unsigned int keybits)533 int mbedtls_aes_setkey_enc( mbedtls_aes_context *ctx, const unsigned char *key,
534 unsigned int keybits )
535 {
536 unsigned int i;
537 uint32_t *RK;
538
539 AES_VALIDATE_RET( ctx != NULL );
540 AES_VALIDATE_RET( key != NULL );
541
542 switch( keybits )
543 {
544 case 128: ctx->nr = 10; break;
545 case 192: ctx->nr = 12; break;
546 case 256: ctx->nr = 14; break;
547 default : return( MBEDTLS_ERR_AES_INVALID_KEY_LENGTH );
548 }
549
550 #if !defined(MBEDTLS_AES_ROM_TABLES)
551 if( aes_init_done == 0 )
552 {
553 aes_gen_tables();
554 aes_init_done = 1;
555 }
556 #endif
557
558 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_PADLOCK_ALIGN16)
559 if( aes_padlock_ace == -1 )
560 aes_padlock_ace = mbedtls_padlock_has_support( MBEDTLS_PADLOCK_ACE );
561
562 if( aes_padlock_ace )
563 ctx->rk = RK = MBEDTLS_PADLOCK_ALIGN16( ctx->buf );
564 else
565 #endif
566 ctx->rk = RK = ctx->buf;
567
568 #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64)
569 if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) )
570 return( mbedtls_aesni_setkey_enc( (unsigned char *) ctx->rk, key, keybits ) );
571 #endif
572
573 for( i = 0; i < ( keybits >> 5 ); i++ )
574 {
575 RK[i] = MBEDTLS_GET_UINT32_LE( key, i << 2 );
576 }
577
578 switch( ctx->nr )
579 {
580 case 10:
581
582 for( i = 0; i < 10; i++, RK += 4 )
583 {
584 RK[4] = RK[0] ^ RCON[i] ^
585 ( (uint32_t) FSb[ MBEDTLS_BYTE_1( RK[3] ) ] ) ^
586 ( (uint32_t) FSb[ MBEDTLS_BYTE_2( RK[3] ) ] << 8 ) ^
587 ( (uint32_t) FSb[ MBEDTLS_BYTE_3( RK[3] ) ] << 16 ) ^
588 ( (uint32_t) FSb[ MBEDTLS_BYTE_0( RK[3] ) ] << 24 );
589
590 RK[5] = RK[1] ^ RK[4];
591 RK[6] = RK[2] ^ RK[5];
592 RK[7] = RK[3] ^ RK[6];
593 }
594 break;
595
596 case 12:
597
598 for( i = 0; i < 8; i++, RK += 6 )
599 {
600 RK[6] = RK[0] ^ RCON[i] ^
601 ( (uint32_t) FSb[ MBEDTLS_BYTE_1( RK[5] ) ] ) ^
602 ( (uint32_t) FSb[ MBEDTLS_BYTE_2( RK[5] ) ] << 8 ) ^
603 ( (uint32_t) FSb[ MBEDTLS_BYTE_3( RK[5] ) ] << 16 ) ^
604 ( (uint32_t) FSb[ MBEDTLS_BYTE_0( RK[5] ) ] << 24 );
605
606 RK[7] = RK[1] ^ RK[6];
607 RK[8] = RK[2] ^ RK[7];
608 RK[9] = RK[3] ^ RK[8];
609 RK[10] = RK[4] ^ RK[9];
610 RK[11] = RK[5] ^ RK[10];
611 }
612 break;
613
614 case 14:
615
616 for( i = 0; i < 7; i++, RK += 8 )
617 {
618 RK[8] = RK[0] ^ RCON[i] ^
619 ( (uint32_t) FSb[ MBEDTLS_BYTE_1( RK[7] ) ] ) ^
620 ( (uint32_t) FSb[ MBEDTLS_BYTE_2( RK[7] ) ] << 8 ) ^
621 ( (uint32_t) FSb[ MBEDTLS_BYTE_3( RK[7] ) ] << 16 ) ^
622 ( (uint32_t) FSb[ MBEDTLS_BYTE_0( RK[7] ) ] << 24 );
623
624 RK[9] = RK[1] ^ RK[8];
625 RK[10] = RK[2] ^ RK[9];
626 RK[11] = RK[3] ^ RK[10];
627
628 RK[12] = RK[4] ^
629 ( (uint32_t) FSb[ MBEDTLS_BYTE_0( RK[11] ) ] ) ^
630 ( (uint32_t) FSb[ MBEDTLS_BYTE_1( RK[11] ) ] << 8 ) ^
631 ( (uint32_t) FSb[ MBEDTLS_BYTE_2( RK[11] ) ] << 16 ) ^
632 ( (uint32_t) FSb[ MBEDTLS_BYTE_3( RK[11] ) ] << 24 );
633
634 RK[13] = RK[5] ^ RK[12];
635 RK[14] = RK[6] ^ RK[13];
636 RK[15] = RK[7] ^ RK[14];
637 }
638 break;
639 }
640
641 return( 0 );
642 }
643 #endif /* !MBEDTLS_AES_SETKEY_ENC_ALT */
644
645 /*
646 * AES key schedule (decryption)
647 */
648 #if !defined(MBEDTLS_AES_SETKEY_DEC_ALT)
649 FLA_TAG STROBF_TAG
mbedtls_aes_setkey_dec(mbedtls_aes_context * ctx,const unsigned char * key,unsigned int keybits)650 int mbedtls_aes_setkey_dec( mbedtls_aes_context *ctx, const unsigned char *key,
651 unsigned int keybits )
652 {
653 int i, j, ret;
654 mbedtls_aes_context cty;
655 uint32_t *RK;
656 uint32_t *SK;
657
658 AES_VALIDATE_RET( ctx != NULL );
659 AES_VALIDATE_RET( key != NULL );
660
661 mbedtls_aes_init( &cty );
662
663 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_PADLOCK_ALIGN16)
664 if( aes_padlock_ace == -1 )
665 aes_padlock_ace = mbedtls_padlock_has_support( MBEDTLS_PADLOCK_ACE );
666
667 if( aes_padlock_ace )
668 ctx->rk = RK = MBEDTLS_PADLOCK_ALIGN16( ctx->buf );
669 else
670 #endif
671 ctx->rk = RK = ctx->buf;
672
673 /* Also checks keybits */
674 if( ( ret = mbedtls_aes_setkey_enc( &cty, key, keybits ) ) != 0 )
675 goto exit;
676
677 ctx->nr = cty.nr;
678
679 #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64)
680 if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) )
681 {
682 mbedtls_aesni_inverse_key( (unsigned char *) ctx->rk,
683 (const unsigned char *) cty.rk, ctx->nr );
684 goto exit;
685 }
686 #endif
687
688 SK = cty.rk + cty.nr * 4;
689
690 *RK++ = *SK++;
691 *RK++ = *SK++;
692 *RK++ = *SK++;
693 *RK++ = *SK++;
694
695 for( i = ctx->nr - 1, SK -= 8; i > 0; i--, SK -= 8 )
696 {
697 for( j = 0; j < 4; j++, SK++ )
698 {
699 *RK++ = AES_RT0( FSb[ MBEDTLS_BYTE_0( *SK ) ] ) ^
700 AES_RT1( FSb[ MBEDTLS_BYTE_1( *SK ) ] ) ^
701 AES_RT2( FSb[ MBEDTLS_BYTE_2( *SK ) ] ) ^
702 AES_RT3( FSb[ MBEDTLS_BYTE_3( *SK ) ] );
703 }
704 }
705
706 *RK++ = *SK++;
707 *RK++ = *SK++;
708 *RK++ = *SK++;
709 *RK++ = *SK++;
710
711 exit:
712 mbedtls_aes_free( &cty );
713
714 return( ret );
715 }
716 #endif /* !MBEDTLS_AES_SETKEY_DEC_ALT */
717
718 #if defined(MBEDTLS_CIPHER_MODE_XTS)
mbedtls_aes_xts_decode_keys(const unsigned char * key,unsigned int keybits,const unsigned char ** key1,unsigned int * key1bits,const unsigned char ** key2,unsigned int * key2bits)719 static int mbedtls_aes_xts_decode_keys( const unsigned char *key,
720 unsigned int keybits,
721 const unsigned char **key1,
722 unsigned int *key1bits,
723 const unsigned char **key2,
724 unsigned int *key2bits )
725 {
726 const unsigned int half_keybits = keybits / 2;
727 const unsigned int half_keybytes = half_keybits / 8;
728
729 switch( keybits )
730 {
731 case 256: break;
732 case 512: break;
733 default : return( MBEDTLS_ERR_AES_INVALID_KEY_LENGTH );
734 }
735
736 *key1bits = half_keybits;
737 *key2bits = half_keybits;
738 *key1 = &key[0];
739 *key2 = &key[half_keybytes];
740
741 return 0;
742 }
743
mbedtls_aes_xts_setkey_enc(mbedtls_aes_xts_context * ctx,const unsigned char * key,unsigned int keybits)744 int mbedtls_aes_xts_setkey_enc( mbedtls_aes_xts_context *ctx,
745 const unsigned char *key,
746 unsigned int keybits)
747 {
748 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
749 const unsigned char *key1, *key2;
750 unsigned int key1bits, key2bits;
751
752 AES_VALIDATE_RET( ctx != NULL );
753 AES_VALIDATE_RET( key != NULL );
754
755 ret = mbedtls_aes_xts_decode_keys( key, keybits, &key1, &key1bits,
756 &key2, &key2bits );
757 if( ret != 0 )
758 return( ret );
759
760 /* Set the tweak key. Always set tweak key for the encryption mode. */
761 ret = mbedtls_aes_setkey_enc( &ctx->tweak, key2, key2bits );
762 if( ret != 0 )
763 return( ret );
764
765 /* Set crypt key for encryption. */
766 return mbedtls_aes_setkey_enc( &ctx->crypt, key1, key1bits );
767 }
768
mbedtls_aes_xts_setkey_dec(mbedtls_aes_xts_context * ctx,const unsigned char * key,unsigned int keybits)769 int mbedtls_aes_xts_setkey_dec( mbedtls_aes_xts_context *ctx,
770 const unsigned char *key,
771 unsigned int keybits)
772 {
773 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
774 const unsigned char *key1, *key2;
775 unsigned int key1bits, key2bits;
776
777 AES_VALIDATE_RET( ctx != NULL );
778 AES_VALIDATE_RET( key != NULL );
779
780 ret = mbedtls_aes_xts_decode_keys( key, keybits, &key1, &key1bits,
781 &key2, &key2bits );
782 if( ret != 0 )
783 return( ret );
784
785 /* Set the tweak key. Always set tweak key for encryption. */
786 ret = mbedtls_aes_setkey_enc( &ctx->tweak, key2, key2bits );
787 if( ret != 0 )
788 return( ret );
789
790 /* Set crypt key for decryption. */
791 return mbedtls_aes_setkey_dec( &ctx->crypt, key1, key1bits );
792 }
793 #endif /* MBEDTLS_CIPHER_MODE_XTS */
794
795 #define AES_FROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3) \
796 do \
797 { \
798 (X0) = *RK++ ^ AES_FT0( MBEDTLS_BYTE_0( Y0 ) ) ^ \
799 AES_FT1( MBEDTLS_BYTE_1( Y1 ) ) ^ \
800 AES_FT2( MBEDTLS_BYTE_2( Y2 ) ) ^ \
801 AES_FT3( MBEDTLS_BYTE_3( Y3 ) ); \
802 \
803 (X1) = *RK++ ^ AES_FT0( MBEDTLS_BYTE_0( Y1 ) ) ^ \
804 AES_FT1( MBEDTLS_BYTE_1( Y2 ) ) ^ \
805 AES_FT2( MBEDTLS_BYTE_2( Y3 ) ) ^ \
806 AES_FT3( MBEDTLS_BYTE_3( Y0 ) ); \
807 \
808 (X2) = *RK++ ^ AES_FT0( MBEDTLS_BYTE_0( Y2 ) ) ^ \
809 AES_FT1( MBEDTLS_BYTE_1( Y3 ) ) ^ \
810 AES_FT2( MBEDTLS_BYTE_2( Y0 ) ) ^ \
811 AES_FT3( MBEDTLS_BYTE_3( Y1 ) ); \
812 \
813 (X3) = *RK++ ^ AES_FT0( MBEDTLS_BYTE_0( Y3 ) ) ^ \
814 AES_FT1( MBEDTLS_BYTE_1( Y0 ) ) ^ \
815 AES_FT2( MBEDTLS_BYTE_2( Y1 ) ) ^ \
816 AES_FT3( MBEDTLS_BYTE_3( Y2 ) ); \
817 } while( 0 )
818
819 #define AES_RROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3) \
820 do \
821 { \
822 (X0) = *RK++ ^ AES_RT0( MBEDTLS_BYTE_0( Y0 ) ) ^ \
823 AES_RT1( MBEDTLS_BYTE_1( Y3 ) ) ^ \
824 AES_RT2( MBEDTLS_BYTE_2( Y2 ) ) ^ \
825 AES_RT3( MBEDTLS_BYTE_3( Y1 ) ); \
826 \
827 (X1) = *RK++ ^ AES_RT0( MBEDTLS_BYTE_0( Y1 ) ) ^ \
828 AES_RT1( MBEDTLS_BYTE_1( Y0 ) ) ^ \
829 AES_RT2( MBEDTLS_BYTE_2( Y3 ) ) ^ \
830 AES_RT3( MBEDTLS_BYTE_3( Y2 ) ); \
831 \
832 (X2) = *RK++ ^ AES_RT0( MBEDTLS_BYTE_0( Y2 ) ) ^ \
833 AES_RT1( MBEDTLS_BYTE_1( Y1 ) ) ^ \
834 AES_RT2( MBEDTLS_BYTE_2( Y0 ) ) ^ \
835 AES_RT3( MBEDTLS_BYTE_3( Y3 ) ); \
836 \
837 (X3) = *RK++ ^ AES_RT0( MBEDTLS_BYTE_0( Y3 ) ) ^ \
838 AES_RT1( MBEDTLS_BYTE_1( Y2 ) ) ^ \
839 AES_RT2( MBEDTLS_BYTE_2( Y1 ) ) ^ \
840 AES_RT3( MBEDTLS_BYTE_3( Y0 ) ); \
841 } while( 0 )
842
843 /*
844 * AES-ECB block encryption
845 */
846 #if !defined(MBEDTLS_AES_ENCRYPT_ALT)
847 #if !defined(VENDOR_TEE_WRAP_C)
mbedtls_internal_aes_encrypt(mbedtls_aes_context * ctx,const unsigned char input[16],unsigned char output[16])848 int mbedtls_internal_aes_encrypt( mbedtls_aes_context *ctx,
849 const unsigned char input[16],
850 unsigned char output[16] )
851 {
852 int i;
853 uint32_t *RK = ctx->rk;
854 struct
855 {
856 uint32_t X[4];
857 uint32_t Y[4];
858 } t;
859
860 t.X[0] = MBEDTLS_GET_UINT32_LE( input, 0 ); t.X[0] ^= *RK++;
861 t.X[1] = MBEDTLS_GET_UINT32_LE( input, 4 ); t.X[1] ^= *RK++;
862 t.X[2] = MBEDTLS_GET_UINT32_LE( input, 8 ); t.X[2] ^= *RK++;
863 t.X[3] = MBEDTLS_GET_UINT32_LE( input, 12 ); t.X[3] ^= *RK++;
864
865 for( i = ( ctx->nr >> 1 ) - 1; i > 0; i-- )
866 {
867 AES_FROUND( t.Y[0], t.Y[1], t.Y[2], t.Y[3], t.X[0], t.X[1], t.X[2], t.X[3] );
868 AES_FROUND( t.X[0], t.X[1], t.X[2], t.X[3], t.Y[0], t.Y[1], t.Y[2], t.Y[3] );
869 }
870
871 AES_FROUND( t.Y[0], t.Y[1], t.Y[2], t.Y[3], t.X[0], t.X[1], t.X[2], t.X[3] );
872
873 t.X[0] = *RK++ ^ \
874 ( (uint32_t) FSb[ MBEDTLS_BYTE_0( t.Y[0] ) ] ) ^
875 ( (uint32_t) FSb[ MBEDTLS_BYTE_1( t.Y[1] ) ] << 8 ) ^
876 ( (uint32_t) FSb[ MBEDTLS_BYTE_2( t.Y[2] ) ] << 16 ) ^
877 ( (uint32_t) FSb[ MBEDTLS_BYTE_3( t.Y[3] ) ] << 24 );
878
879 t.X[1] = *RK++ ^ \
880 ( (uint32_t) FSb[ MBEDTLS_BYTE_0( t.Y[1] ) ] ) ^
881 ( (uint32_t) FSb[ MBEDTLS_BYTE_1( t.Y[2] ) ] << 8 ) ^
882 ( (uint32_t) FSb[ MBEDTLS_BYTE_2( t.Y[3] ) ] << 16 ) ^
883 ( (uint32_t) FSb[ MBEDTLS_BYTE_3( t.Y[0] ) ] << 24 );
884
885 t.X[2] = *RK++ ^ \
886 ( (uint32_t) FSb[ MBEDTLS_BYTE_0( t.Y[2] ) ] ) ^
887 ( (uint32_t) FSb[ MBEDTLS_BYTE_1( t.Y[3] ) ] << 8 ) ^
888 ( (uint32_t) FSb[ MBEDTLS_BYTE_2( t.Y[0] ) ] << 16 ) ^
889 ( (uint32_t) FSb[ MBEDTLS_BYTE_3( t.Y[1] ) ] << 24 );
890
891 t.X[3] = *RK++ ^ \
892 ( (uint32_t) FSb[ MBEDTLS_BYTE_0( t.Y[3] ) ] ) ^
893 ( (uint32_t) FSb[ MBEDTLS_BYTE_1( t.Y[0] ) ] << 8 ) ^
894 ( (uint32_t) FSb[ MBEDTLS_BYTE_2( t.Y[1] ) ] << 16 ) ^
895 ( (uint32_t) FSb[ MBEDTLS_BYTE_3( t.Y[2] ) ] << 24 );
896
897 MBEDTLS_PUT_UINT32_LE( t.X[0], output, 0 );
898 MBEDTLS_PUT_UINT32_LE( t.X[1], output, 4 );
899 MBEDTLS_PUT_UINT32_LE( t.X[2], output, 8 );
900 MBEDTLS_PUT_UINT32_LE( t.X[3], output, 12 );
901
902 mbedtls_platform_zeroize( &t, sizeof( t ) );
903
904 return( 0 );
905 }
906 #endif /* !VENDOR_TEE_WRAP_C */
907 #endif /* !MBEDTLS_AES_ENCRYPT_ALT */
908
909 /*
910 * AES-ECB block decryption
911 */
912 #if !defined(MBEDTLS_AES_DECRYPT_ALT)
913 #if !defined(VENDOR_TEE_WRAP_C)
mbedtls_internal_aes_decrypt(mbedtls_aes_context * ctx,const unsigned char input[16],unsigned char output[16])914 int mbedtls_internal_aes_decrypt( mbedtls_aes_context *ctx,
915 const unsigned char input[16],
916 unsigned char output[16] )
917 {
918 int i;
919 uint32_t *RK = ctx->rk;
920 struct
921 {
922 uint32_t X[4];
923 uint32_t Y[4];
924 } t;
925
926 t.X[0] = MBEDTLS_GET_UINT32_LE( input, 0 ); t.X[0] ^= *RK++;
927 t.X[1] = MBEDTLS_GET_UINT32_LE( input, 4 ); t.X[1] ^= *RK++;
928 t.X[2] = MBEDTLS_GET_UINT32_LE( input, 8 ); t.X[2] ^= *RK++;
929 t.X[3] = MBEDTLS_GET_UINT32_LE( input, 12 ); t.X[3] ^= *RK++;
930
931 for( i = ( ctx->nr >> 1 ) - 1; i > 0; i-- )
932 {
933 AES_RROUND( t.Y[0], t.Y[1], t.Y[2], t.Y[3], t.X[0], t.X[1], t.X[2], t.X[3] );
934 AES_RROUND( t.X[0], t.X[1], t.X[2], t.X[3], t.Y[0], t.Y[1], t.Y[2], t.Y[3] );
935 }
936
937 AES_RROUND( t.Y[0], t.Y[1], t.Y[2], t.Y[3], t.X[0], t.X[1], t.X[2], t.X[3] );
938
939 t.X[0] = *RK++ ^ \
940 ( (uint32_t) RSb[ MBEDTLS_BYTE_0( t.Y[0] ) ] ) ^
941 ( (uint32_t) RSb[ MBEDTLS_BYTE_1( t.Y[3] ) ] << 8 ) ^
942 ( (uint32_t) RSb[ MBEDTLS_BYTE_2( t.Y[2] ) ] << 16 ) ^
943 ( (uint32_t) RSb[ MBEDTLS_BYTE_3( t.Y[1] ) ] << 24 );
944
945 t.X[1] = *RK++ ^ \
946 ( (uint32_t) RSb[ MBEDTLS_BYTE_0( t.Y[1] ) ] ) ^
947 ( (uint32_t) RSb[ MBEDTLS_BYTE_1( t.Y[0] ) ] << 8 ) ^
948 ( (uint32_t) RSb[ MBEDTLS_BYTE_2( t.Y[3] ) ] << 16 ) ^
949 ( (uint32_t) RSb[ MBEDTLS_BYTE_3( t.Y[2] ) ] << 24 );
950
951 t.X[2] = *RK++ ^ \
952 ( (uint32_t) RSb[ MBEDTLS_BYTE_0( t.Y[2] ) ] ) ^
953 ( (uint32_t) RSb[ MBEDTLS_BYTE_1( t.Y[1] ) ] << 8 ) ^
954 ( (uint32_t) RSb[ MBEDTLS_BYTE_2( t.Y[0] ) ] << 16 ) ^
955 ( (uint32_t) RSb[ MBEDTLS_BYTE_3( t.Y[3] ) ] << 24 );
956
957 t.X[3] = *RK++ ^ \
958 ( (uint32_t) RSb[ MBEDTLS_BYTE_0( t.Y[3] ) ] ) ^
959 ( (uint32_t) RSb[ MBEDTLS_BYTE_1( t.Y[2] ) ] << 8 ) ^
960 ( (uint32_t) RSb[ MBEDTLS_BYTE_2( t.Y[1] ) ] << 16 ) ^
961 ( (uint32_t) RSb[ MBEDTLS_BYTE_3( t.Y[0] ) ] << 24 );
962
963 MBEDTLS_PUT_UINT32_LE( t.X[0], output, 0 );
964 MBEDTLS_PUT_UINT32_LE( t.X[1], output, 4 );
965 MBEDTLS_PUT_UINT32_LE( t.X[2], output, 8 );
966 MBEDTLS_PUT_UINT32_LE( t.X[3], output, 12 );
967
968 mbedtls_platform_zeroize( &t, sizeof( t ) );
969
970 return( 0 );
971 }
972 #endif /* !VENDOR_TEE_WRAP_C */
973 #endif /* !MBEDTLS_AES_DECRYPT_ALT */
974
975 /*
976 * AES-ECB block encryption/decryption
977 */
mbedtls_aes_crypt_ecb(mbedtls_aes_context * ctx,int mode,const unsigned char input[16],unsigned char output[16])978 int mbedtls_aes_crypt_ecb( mbedtls_aes_context *ctx,
979 int mode,
980 const unsigned char input[16],
981 unsigned char output[16] )
982 {
983 AES_VALIDATE_RET( ctx != NULL );
984 AES_VALIDATE_RET( input != NULL );
985 AES_VALIDATE_RET( output != NULL );
986 AES_VALIDATE_RET( mode == MBEDTLS_AES_ENCRYPT ||
987 mode == MBEDTLS_AES_DECRYPT );
988
989 #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64)
990 if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) )
991 return( mbedtls_aesni_crypt_ecb( ctx, mode, input, output ) );
992 #endif
993
994 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_HAVE_X86)
995 if( aes_padlock_ace > 0)
996 {
997 if( mbedtls_padlock_xcryptecb( ctx, mode, input, output ) == 0 )
998 return( 0 );
999
1000 // If padlock data misaligned, we just fall back to
1001 // unaccelerated mode
1002 //
1003 }
1004 #endif
1005
1006 if( mode == MBEDTLS_AES_ENCRYPT )
1007 return( mbedtls_internal_aes_encrypt( ctx, input, output ) );
1008 else
1009 return( mbedtls_internal_aes_decrypt( ctx, input, output ) );
1010 }
1011
1012 #if defined(MBEDTLS_CIPHER_MODE_CBC)
1013 /*
1014 * AES-CBC buffer encryption/decryption
1015 */
1016 FLA_TAG STROBF_TAG
mbedtls_aes_crypt_cbc(mbedtls_aes_context * ctx,int mode,size_t length,unsigned char iv[16],const unsigned char * input,unsigned char * output)1017 int mbedtls_aes_crypt_cbc( mbedtls_aes_context *ctx,
1018 int mode,
1019 size_t length,
1020 unsigned char iv[16],
1021 const unsigned char *input,
1022 unsigned char *output )
1023 {
1024 int i;
1025 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1026 unsigned char temp[16];
1027
1028 AES_VALIDATE_RET( ctx != NULL );
1029 AES_VALIDATE_RET( mode == MBEDTLS_AES_ENCRYPT ||
1030 mode == MBEDTLS_AES_DECRYPT );
1031 AES_VALIDATE_RET( iv != NULL );
1032 AES_VALIDATE_RET( input != NULL );
1033 AES_VALIDATE_RET( output != NULL );
1034
1035 if( length % 16 )
1036 return( MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH );
1037
1038 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_HAVE_X86)
1039 if( aes_padlock_ace > 0 )
1040 {
1041 if( mbedtls_padlock_xcryptcbc( ctx, mode, length, iv, input, output ) == 0 )
1042 return( 0 );
1043
1044 // If padlock data misaligned, we just fall back to
1045 // unaccelerated mode
1046 //
1047 }
1048 #endif
1049
1050 if( mode == MBEDTLS_AES_DECRYPT )
1051 {
1052 while( length > 0 )
1053 {
1054 memcpy( temp, input, 16 );
1055 ret = mbedtls_aes_crypt_ecb( ctx, mode, input, output );
1056 if( ret != 0 )
1057 goto exit;
1058
1059 for( i = 0; i < 16; i++ )
1060 output[i] = (unsigned char)( output[i] ^ iv[i] );
1061
1062 memcpy( iv, temp, 16 );
1063
1064 input += 16;
1065 output += 16;
1066 length -= 16;
1067 }
1068 }
1069 else
1070 {
1071 while( length > 0 )
1072 {
1073 for( i = 0; i < 16; i++ )
1074 output[i] = (unsigned char)( input[i] ^ iv[i] );
1075
1076 ret = mbedtls_aes_crypt_ecb( ctx, mode, output, output );
1077 if( ret != 0 )
1078 goto exit;
1079 memcpy( iv, output, 16 );
1080
1081 input += 16;
1082 output += 16;
1083 length -= 16;
1084 }
1085 }
1086 ret = 0;
1087
1088 exit:
1089 return( ret );
1090 }
1091 #endif /* MBEDTLS_CIPHER_MODE_CBC */
1092
1093 #if defined(MBEDTLS_CIPHER_MODE_XTS)
1094
1095 typedef unsigned char mbedtls_be128[16];
1096
1097 /*
1098 * GF(2^128) multiplication function
1099 *
1100 * This function multiplies a field element by x in the polynomial field
1101 * representation. It uses 64-bit word operations to gain speed but compensates
1102 * for machine endianess and hence works correctly on both big and little
1103 * endian machines.
1104 */
mbedtls_gf128mul_x_ble(unsigned char r[16],const unsigned char x[16])1105 static void mbedtls_gf128mul_x_ble( unsigned char r[16],
1106 const unsigned char x[16] )
1107 {
1108 uint64_t a, b, ra, rb;
1109
1110 a = MBEDTLS_GET_UINT64_LE( x, 0 );
1111 b = MBEDTLS_GET_UINT64_LE( x, 8 );
1112
1113 ra = ( a << 1 ) ^ 0x0087 >> ( 8 - ( ( b >> 63 ) << 3 ) );
1114 rb = ( a >> 63 ) | ( b << 1 );
1115
1116 MBEDTLS_PUT_UINT64_LE( ra, r, 0 );
1117 MBEDTLS_PUT_UINT64_LE( rb, r, 8 );
1118 }
1119
1120 /*
1121 * AES-XTS buffer encryption/decryption
1122 */
mbedtls_aes_crypt_xts(mbedtls_aes_xts_context * ctx,int mode,size_t length,const unsigned char data_unit[16],const unsigned char * input,unsigned char * output)1123 int mbedtls_aes_crypt_xts( mbedtls_aes_xts_context *ctx,
1124 int mode,
1125 size_t length,
1126 const unsigned char data_unit[16],
1127 const unsigned char *input,
1128 unsigned char *output )
1129 {
1130 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1131 size_t blocks = length / 16;
1132 size_t leftover = length % 16;
1133 unsigned char tweak[16];
1134 unsigned char prev_tweak[16];
1135 unsigned char tmp[16];
1136
1137 AES_VALIDATE_RET( ctx != NULL );
1138 AES_VALIDATE_RET( mode == MBEDTLS_AES_ENCRYPT ||
1139 mode == MBEDTLS_AES_DECRYPT );
1140 AES_VALIDATE_RET( data_unit != NULL );
1141 AES_VALIDATE_RET( input != NULL );
1142 AES_VALIDATE_RET( output != NULL );
1143
1144 /* Data units must be at least 16 bytes long. */
1145 if( length < 16 )
1146 return MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH;
1147
1148 /* NIST SP 800-38E disallows data units larger than 2**20 blocks. */
1149 if( length > ( 1 << 20 ) * 16 )
1150 return MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH;
1151
1152 /* Compute the tweak. */
1153 ret = mbedtls_aes_crypt_ecb( &ctx->tweak, MBEDTLS_AES_ENCRYPT,
1154 data_unit, tweak );
1155 if( ret != 0 )
1156 return( ret );
1157
1158 while( blocks-- )
1159 {
1160 size_t i;
1161
1162 if( leftover && ( mode == MBEDTLS_AES_DECRYPT ) && blocks == 0 )
1163 {
1164 /* We are on the last block in a decrypt operation that has
1165 * leftover bytes, so we need to use the next tweak for this block,
1166 * and this tweak for the lefover bytes. Save the current tweak for
1167 * the leftovers and then update the current tweak for use on this,
1168 * the last full block. */
1169 memcpy( prev_tweak, tweak, sizeof( tweak ) );
1170 mbedtls_gf128mul_x_ble( tweak, tweak );
1171 }
1172
1173 for( i = 0; i < 16; i++ )
1174 tmp[i] = input[i] ^ tweak[i];
1175
1176 ret = mbedtls_aes_crypt_ecb( &ctx->crypt, mode, tmp, tmp );
1177 if( ret != 0 )
1178 return( ret );
1179
1180 for( i = 0; i < 16; i++ )
1181 output[i] = tmp[i] ^ tweak[i];
1182
1183 /* Update the tweak for the next block. */
1184 mbedtls_gf128mul_x_ble( tweak, tweak );
1185
1186 output += 16;
1187 input += 16;
1188 }
1189
1190 if( leftover )
1191 {
1192 /* If we are on the leftover bytes in a decrypt operation, we need to
1193 * use the previous tweak for these bytes (as saved in prev_tweak). */
1194 unsigned char *t = mode == MBEDTLS_AES_DECRYPT ? prev_tweak : tweak;
1195
1196 /* We are now on the final part of the data unit, which doesn't divide
1197 * evenly by 16. It's time for ciphertext stealing. */
1198 size_t i;
1199 unsigned char *prev_output = output - 16;
1200
1201 /* Copy ciphertext bytes from the previous block to our output for each
1202 * byte of cyphertext we won't steal. At the same time, copy the
1203 * remainder of the input for this final round (since the loop bounds
1204 * are the same). */
1205 for( i = 0; i < leftover; i++ )
1206 {
1207 output[i] = prev_output[i];
1208 tmp[i] = input[i] ^ t[i];
1209 }
1210
1211 /* Copy ciphertext bytes from the previous block for input in this
1212 * round. */
1213 for( ; i < 16; i++ )
1214 tmp[i] = prev_output[i] ^ t[i];
1215
1216 ret = mbedtls_aes_crypt_ecb( &ctx->crypt, mode, tmp, tmp );
1217 if( ret != 0 )
1218 return ret;
1219
1220 /* Write the result back to the previous block, overriding the previous
1221 * output we copied. */
1222 for( i = 0; i < 16; i++ )
1223 prev_output[i] = tmp[i] ^ t[i];
1224 }
1225
1226 return( 0 );
1227 }
1228 #endif /* MBEDTLS_CIPHER_MODE_XTS */
1229
1230 #if defined(MBEDTLS_CIPHER_MODE_CFB)
1231 /*
1232 * AES-CFB128 buffer encryption/decryption
1233 */
mbedtls_aes_crypt_cfb128(mbedtls_aes_context * ctx,int mode,size_t length,size_t * iv_off,unsigned char iv[16],const unsigned char * input,unsigned char * output)1234 int mbedtls_aes_crypt_cfb128( mbedtls_aes_context *ctx,
1235 int mode,
1236 size_t length,
1237 size_t *iv_off,
1238 unsigned char iv[16],
1239 const unsigned char *input,
1240 unsigned char *output )
1241 {
1242 int c;
1243 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1244 size_t n;
1245
1246 AES_VALIDATE_RET( ctx != NULL );
1247 AES_VALIDATE_RET( mode == MBEDTLS_AES_ENCRYPT ||
1248 mode == MBEDTLS_AES_DECRYPT );
1249 AES_VALIDATE_RET( iv_off != NULL );
1250 AES_VALIDATE_RET( iv != NULL );
1251 AES_VALIDATE_RET( input != NULL );
1252 AES_VALIDATE_RET( output != NULL );
1253
1254 n = *iv_off;
1255
1256 if( n > 15 )
1257 return( MBEDTLS_ERR_AES_BAD_INPUT_DATA );
1258
1259 if( mode == MBEDTLS_AES_DECRYPT )
1260 {
1261 while( length-- )
1262 {
1263 if( n == 0 )
1264 {
1265 ret = mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv );
1266 if( ret != 0 )
1267 goto exit;
1268 }
1269
1270 c = *input++;
1271 *output++ = (unsigned char)( c ^ iv[n] );
1272 iv[n] = (unsigned char) c;
1273
1274 n = ( n + 1 ) & 0x0F;
1275 }
1276 }
1277 else
1278 {
1279 while( length-- )
1280 {
1281 if( n == 0 )
1282 {
1283 ret = mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv );
1284 if( ret != 0 )
1285 goto exit;
1286 }
1287
1288 iv[n] = *output++ = (unsigned char)( iv[n] ^ *input++ );
1289
1290 n = ( n + 1 ) & 0x0F;
1291 }
1292 }
1293
1294 *iv_off = n;
1295 ret = 0;
1296
1297 exit:
1298 return( ret );
1299 }
1300
1301 /*
1302 * AES-CFB8 buffer encryption/decryption
1303 */
mbedtls_aes_crypt_cfb8(mbedtls_aes_context * ctx,int mode,size_t length,unsigned char iv[16],const unsigned char * input,unsigned char * output)1304 int mbedtls_aes_crypt_cfb8( mbedtls_aes_context *ctx,
1305 int mode,
1306 size_t length,
1307 unsigned char iv[16],
1308 const unsigned char *input,
1309 unsigned char *output )
1310 {
1311 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1312 unsigned char c;
1313 unsigned char ov[17];
1314
1315 AES_VALIDATE_RET( ctx != NULL );
1316 AES_VALIDATE_RET( mode == MBEDTLS_AES_ENCRYPT ||
1317 mode == MBEDTLS_AES_DECRYPT );
1318 AES_VALIDATE_RET( iv != NULL );
1319 AES_VALIDATE_RET( input != NULL );
1320 AES_VALIDATE_RET( output != NULL );
1321 while( length-- )
1322 {
1323 memcpy( ov, iv, 16 );
1324 ret = mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv );
1325 if( ret != 0 )
1326 goto exit;
1327
1328 if( mode == MBEDTLS_AES_DECRYPT )
1329 ov[16] = *input;
1330
1331 c = *output++ = (unsigned char)( iv[0] ^ *input++ );
1332
1333 if( mode == MBEDTLS_AES_ENCRYPT )
1334 ov[16] = c;
1335
1336 memcpy( iv, ov + 1, 16 );
1337 }
1338 ret = 0;
1339
1340 exit:
1341 return( ret );
1342 }
1343 #endif /* MBEDTLS_CIPHER_MODE_CFB */
1344
1345 #if defined(MBEDTLS_CIPHER_MODE_OFB)
1346 /*
1347 * AES-OFB (Output Feedback Mode) buffer encryption/decryption
1348 */
mbedtls_aes_crypt_ofb(mbedtls_aes_context * ctx,size_t length,size_t * iv_off,unsigned char iv[16],const unsigned char * input,unsigned char * output)1349 int mbedtls_aes_crypt_ofb( mbedtls_aes_context *ctx,
1350 size_t length,
1351 size_t *iv_off,
1352 unsigned char iv[16],
1353 const unsigned char *input,
1354 unsigned char *output )
1355 {
1356 int ret = 0;
1357 size_t n;
1358
1359 AES_VALIDATE_RET( ctx != NULL );
1360 AES_VALIDATE_RET( iv_off != NULL );
1361 AES_VALIDATE_RET( iv != NULL );
1362 AES_VALIDATE_RET( input != NULL );
1363 AES_VALIDATE_RET( output != NULL );
1364
1365 n = *iv_off;
1366
1367 if( n > 15 )
1368 return( MBEDTLS_ERR_AES_BAD_INPUT_DATA );
1369
1370 while( length-- )
1371 {
1372 if( n == 0 )
1373 {
1374 ret = mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv );
1375 if( ret != 0 )
1376 goto exit;
1377 }
1378 *output++ = *input++ ^ iv[n];
1379
1380 n = ( n + 1 ) & 0x0F;
1381 }
1382
1383 *iv_off = n;
1384
1385 exit:
1386 return( ret );
1387 }
1388 #endif /* MBEDTLS_CIPHER_MODE_OFB */
1389
1390 #if defined(MBEDTLS_CIPHER_MODE_CTR)
1391 /*
1392 * AES-CTR buffer encryption/decryption
1393 */
mbedtls_aes_crypt_ctr(mbedtls_aes_context * ctx,size_t length,size_t * nc_off,unsigned char nonce_counter[16],unsigned char stream_block[16],const unsigned char * input,unsigned char * output)1394 int mbedtls_aes_crypt_ctr( mbedtls_aes_context *ctx,
1395 size_t length,
1396 size_t *nc_off,
1397 unsigned char nonce_counter[16],
1398 unsigned char stream_block[16],
1399 const unsigned char *input,
1400 unsigned char *output )
1401 {
1402 int c, i;
1403 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1404 size_t n;
1405
1406 AES_VALIDATE_RET( ctx != NULL );
1407 AES_VALIDATE_RET( nc_off != NULL );
1408 AES_VALIDATE_RET( nonce_counter != NULL );
1409 AES_VALIDATE_RET( stream_block != NULL );
1410 AES_VALIDATE_RET( input != NULL );
1411 AES_VALIDATE_RET( output != NULL );
1412
1413 n = *nc_off;
1414
1415 if ( n > 0x0F )
1416 return( MBEDTLS_ERR_AES_BAD_INPUT_DATA );
1417
1418 while( length-- )
1419 {
1420 if( n == 0 ) {
1421 ret = mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, nonce_counter, stream_block );
1422 if( ret != 0 )
1423 goto exit;
1424
1425 for( i = 16; i > 0; i-- )
1426 if( ++nonce_counter[i - 1] != 0 )
1427 break;
1428 }
1429 c = *input++;
1430 *output++ = (unsigned char)( c ^ stream_block[n] );
1431
1432 n = ( n + 1 ) & 0x0F;
1433 }
1434
1435 *nc_off = n;
1436 ret = 0;
1437
1438 exit:
1439 return( ret );
1440 }
1441 #endif /* MBEDTLS_CIPHER_MODE_CTR */
1442
1443 #endif /* !MBEDTLS_AES_ALT */
1444
1445 #if defined(MBEDTLS_SELF_TEST)
1446 /*
1447 * AES test vectors from:
1448 *
1449 * http://csrc.nist.gov/archive/aes/rijndael/rijndael-vals.zip
1450 */
1451 static const unsigned char aes_test_ecb_dec[3][16] =
1452 {
1453 { 0x44, 0x41, 0x6A, 0xC2, 0xD1, 0xF5, 0x3C, 0x58,
1454 0x33, 0x03, 0x91, 0x7E, 0x6B, 0xE9, 0xEB, 0xE0 },
1455 { 0x48, 0xE3, 0x1E, 0x9E, 0x25, 0x67, 0x18, 0xF2,
1456 0x92, 0x29, 0x31, 0x9C, 0x19, 0xF1, 0x5B, 0xA4 },
1457 { 0x05, 0x8C, 0xCF, 0xFD, 0xBB, 0xCB, 0x38, 0x2D,
1458 0x1F, 0x6F, 0x56, 0x58, 0x5D, 0x8A, 0x4A, 0xDE }
1459 };
1460
1461 static const unsigned char aes_test_ecb_enc[3][16] =
1462 {
1463 { 0xC3, 0x4C, 0x05, 0x2C, 0xC0, 0xDA, 0x8D, 0x73,
1464 0x45, 0x1A, 0xFE, 0x5F, 0x03, 0xBE, 0x29, 0x7F },
1465 { 0xF3, 0xF6, 0x75, 0x2A, 0xE8, 0xD7, 0x83, 0x11,
1466 0x38, 0xF0, 0x41, 0x56, 0x06, 0x31, 0xB1, 0x14 },
1467 { 0x8B, 0x79, 0xEE, 0xCC, 0x93, 0xA0, 0xEE, 0x5D,
1468 0xFF, 0x30, 0xB4, 0xEA, 0x21, 0x63, 0x6D, 0xA4 }
1469 };
1470
1471 #if defined(MBEDTLS_CIPHER_MODE_CBC)
1472 static const unsigned char aes_test_cbc_dec[3][16] =
1473 {
1474 { 0xFA, 0xCA, 0x37, 0xE0, 0xB0, 0xC8, 0x53, 0x73,
1475 0xDF, 0x70, 0x6E, 0x73, 0xF7, 0xC9, 0xAF, 0x86 },
1476 { 0x5D, 0xF6, 0x78, 0xDD, 0x17, 0xBA, 0x4E, 0x75,
1477 0xB6, 0x17, 0x68, 0xC6, 0xAD, 0xEF, 0x7C, 0x7B },
1478 { 0x48, 0x04, 0xE1, 0x81, 0x8F, 0xE6, 0x29, 0x75,
1479 0x19, 0xA3, 0xE8, 0x8C, 0x57, 0x31, 0x04, 0x13 }
1480 };
1481
1482 static const unsigned char aes_test_cbc_enc[3][16] =
1483 {
1484 { 0x8A, 0x05, 0xFC, 0x5E, 0x09, 0x5A, 0xF4, 0x84,
1485 0x8A, 0x08, 0xD3, 0x28, 0xD3, 0x68, 0x8E, 0x3D },
1486 { 0x7B, 0xD9, 0x66, 0xD5, 0x3A, 0xD8, 0xC1, 0xBB,
1487 0x85, 0xD2, 0xAD, 0xFA, 0xE8, 0x7B, 0xB1, 0x04 },
1488 { 0xFE, 0x3C, 0x53, 0x65, 0x3E, 0x2F, 0x45, 0xB5,
1489 0x6F, 0xCD, 0x88, 0xB2, 0xCC, 0x89, 0x8F, 0xF0 }
1490 };
1491 #endif /* MBEDTLS_CIPHER_MODE_CBC */
1492
1493 #if defined(MBEDTLS_CIPHER_MODE_CFB)
1494 /*
1495 * AES-CFB128 test vectors from:
1496 *
1497 * http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
1498 */
1499 static const unsigned char aes_test_cfb128_key[3][32] =
1500 {
1501 { 0x2B, 0x7E, 0x15, 0x16, 0x28, 0xAE, 0xD2, 0xA6,
1502 0xAB, 0xF7, 0x15, 0x88, 0x09, 0xCF, 0x4F, 0x3C },
1503 { 0x8E, 0x73, 0xB0, 0xF7, 0xDA, 0x0E, 0x64, 0x52,
1504 0xC8, 0x10, 0xF3, 0x2B, 0x80, 0x90, 0x79, 0xE5,
1505 0x62, 0xF8, 0xEA, 0xD2, 0x52, 0x2C, 0x6B, 0x7B },
1506 { 0x60, 0x3D, 0xEB, 0x10, 0x15, 0xCA, 0x71, 0xBE,
1507 0x2B, 0x73, 0xAE, 0xF0, 0x85, 0x7D, 0x77, 0x81,
1508 0x1F, 0x35, 0x2C, 0x07, 0x3B, 0x61, 0x08, 0xD7,
1509 0x2D, 0x98, 0x10, 0xA3, 0x09, 0x14, 0xDF, 0xF4 }
1510 };
1511
1512 static const unsigned char aes_test_cfb128_iv[16] =
1513 {
1514 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
1515 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F
1516 };
1517
1518 static const unsigned char aes_test_cfb128_pt[64] =
1519 {
1520 0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96,
1521 0xE9, 0x3D, 0x7E, 0x11, 0x73, 0x93, 0x17, 0x2A,
1522 0xAE, 0x2D, 0x8A, 0x57, 0x1E, 0x03, 0xAC, 0x9C,
1523 0x9E, 0xB7, 0x6F, 0xAC, 0x45, 0xAF, 0x8E, 0x51,
1524 0x30, 0xC8, 0x1C, 0x46, 0xA3, 0x5C, 0xE4, 0x11,
1525 0xE5, 0xFB, 0xC1, 0x19, 0x1A, 0x0A, 0x52, 0xEF,
1526 0xF6, 0x9F, 0x24, 0x45, 0xDF, 0x4F, 0x9B, 0x17,
1527 0xAD, 0x2B, 0x41, 0x7B, 0xE6, 0x6C, 0x37, 0x10
1528 };
1529
1530 static const unsigned char aes_test_cfb128_ct[3][64] =
1531 {
1532 { 0x3B, 0x3F, 0xD9, 0x2E, 0xB7, 0x2D, 0xAD, 0x20,
1533 0x33, 0x34, 0x49, 0xF8, 0xE8, 0x3C, 0xFB, 0x4A,
1534 0xC8, 0xA6, 0x45, 0x37, 0xA0, 0xB3, 0xA9, 0x3F,
1535 0xCD, 0xE3, 0xCD, 0xAD, 0x9F, 0x1C, 0xE5, 0x8B,
1536 0x26, 0x75, 0x1F, 0x67, 0xA3, 0xCB, 0xB1, 0x40,
1537 0xB1, 0x80, 0x8C, 0xF1, 0x87, 0xA4, 0xF4, 0xDF,
1538 0xC0, 0x4B, 0x05, 0x35, 0x7C, 0x5D, 0x1C, 0x0E,
1539 0xEA, 0xC4, 0xC6, 0x6F, 0x9F, 0xF7, 0xF2, 0xE6 },
1540 { 0xCD, 0xC8, 0x0D, 0x6F, 0xDD, 0xF1, 0x8C, 0xAB,
1541 0x34, 0xC2, 0x59, 0x09, 0xC9, 0x9A, 0x41, 0x74,
1542 0x67, 0xCE, 0x7F, 0x7F, 0x81, 0x17, 0x36, 0x21,
1543 0x96, 0x1A, 0x2B, 0x70, 0x17, 0x1D, 0x3D, 0x7A,
1544 0x2E, 0x1E, 0x8A, 0x1D, 0xD5, 0x9B, 0x88, 0xB1,
1545 0xC8, 0xE6, 0x0F, 0xED, 0x1E, 0xFA, 0xC4, 0xC9,
1546 0xC0, 0x5F, 0x9F, 0x9C, 0xA9, 0x83, 0x4F, 0xA0,
1547 0x42, 0xAE, 0x8F, 0xBA, 0x58, 0x4B, 0x09, 0xFF },
1548 { 0xDC, 0x7E, 0x84, 0xBF, 0xDA, 0x79, 0x16, 0x4B,
1549 0x7E, 0xCD, 0x84, 0x86, 0x98, 0x5D, 0x38, 0x60,
1550 0x39, 0xFF, 0xED, 0x14, 0x3B, 0x28, 0xB1, 0xC8,
1551 0x32, 0x11, 0x3C, 0x63, 0x31, 0xE5, 0x40, 0x7B,
1552 0xDF, 0x10, 0x13, 0x24, 0x15, 0xE5, 0x4B, 0x92,
1553 0xA1, 0x3E, 0xD0, 0xA8, 0x26, 0x7A, 0xE2, 0xF9,
1554 0x75, 0xA3, 0x85, 0x74, 0x1A, 0xB9, 0xCE, 0xF8,
1555 0x20, 0x31, 0x62, 0x3D, 0x55, 0xB1, 0xE4, 0x71 }
1556 };
1557 #endif /* MBEDTLS_CIPHER_MODE_CFB */
1558
1559 #if defined(MBEDTLS_CIPHER_MODE_OFB)
1560 /*
1561 * AES-OFB test vectors from:
1562 *
1563 * https://csrc.nist.gov/publications/detail/sp/800-38a/final
1564 */
1565 static const unsigned char aes_test_ofb_key[3][32] =
1566 {
1567 { 0x2B, 0x7E, 0x15, 0x16, 0x28, 0xAE, 0xD2, 0xA6,
1568 0xAB, 0xF7, 0x15, 0x88, 0x09, 0xCF, 0x4F, 0x3C },
1569 { 0x8E, 0x73, 0xB0, 0xF7, 0xDA, 0x0E, 0x64, 0x52,
1570 0xC8, 0x10, 0xF3, 0x2B, 0x80, 0x90, 0x79, 0xE5,
1571 0x62, 0xF8, 0xEA, 0xD2, 0x52, 0x2C, 0x6B, 0x7B },
1572 { 0x60, 0x3D, 0xEB, 0x10, 0x15, 0xCA, 0x71, 0xBE,
1573 0x2B, 0x73, 0xAE, 0xF0, 0x85, 0x7D, 0x77, 0x81,
1574 0x1F, 0x35, 0x2C, 0x07, 0x3B, 0x61, 0x08, 0xD7,
1575 0x2D, 0x98, 0x10, 0xA3, 0x09, 0x14, 0xDF, 0xF4 }
1576 };
1577
1578 static const unsigned char aes_test_ofb_iv[16] =
1579 {
1580 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
1581 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F
1582 };
1583
1584 static const unsigned char aes_test_ofb_pt[64] =
1585 {
1586 0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96,
1587 0xE9, 0x3D, 0x7E, 0x11, 0x73, 0x93, 0x17, 0x2A,
1588 0xAE, 0x2D, 0x8A, 0x57, 0x1E, 0x03, 0xAC, 0x9C,
1589 0x9E, 0xB7, 0x6F, 0xAC, 0x45, 0xAF, 0x8E, 0x51,
1590 0x30, 0xC8, 0x1C, 0x46, 0xA3, 0x5C, 0xE4, 0x11,
1591 0xE5, 0xFB, 0xC1, 0x19, 0x1A, 0x0A, 0x52, 0xEF,
1592 0xF6, 0x9F, 0x24, 0x45, 0xDF, 0x4F, 0x9B, 0x17,
1593 0xAD, 0x2B, 0x41, 0x7B, 0xE6, 0x6C, 0x37, 0x10
1594 };
1595
1596 static const unsigned char aes_test_ofb_ct[3][64] =
1597 {
1598 { 0x3B, 0x3F, 0xD9, 0x2E, 0xB7, 0x2D, 0xAD, 0x20,
1599 0x33, 0x34, 0x49, 0xF8, 0xE8, 0x3C, 0xFB, 0x4A,
1600 0x77, 0x89, 0x50, 0x8d, 0x16, 0x91, 0x8f, 0x03,
1601 0xf5, 0x3c, 0x52, 0xda, 0xc5, 0x4e, 0xd8, 0x25,
1602 0x97, 0x40, 0x05, 0x1e, 0x9c, 0x5f, 0xec, 0xf6,
1603 0x43, 0x44, 0xf7, 0xa8, 0x22, 0x60, 0xed, 0xcc,
1604 0x30, 0x4c, 0x65, 0x28, 0xf6, 0x59, 0xc7, 0x78,
1605 0x66, 0xa5, 0x10, 0xd9, 0xc1, 0xd6, 0xae, 0x5e },
1606 { 0xCD, 0xC8, 0x0D, 0x6F, 0xDD, 0xF1, 0x8C, 0xAB,
1607 0x34, 0xC2, 0x59, 0x09, 0xC9, 0x9A, 0x41, 0x74,
1608 0xfc, 0xc2, 0x8b, 0x8d, 0x4c, 0x63, 0x83, 0x7c,
1609 0x09, 0xe8, 0x17, 0x00, 0xc1, 0x10, 0x04, 0x01,
1610 0x8d, 0x9a, 0x9a, 0xea, 0xc0, 0xf6, 0x59, 0x6f,
1611 0x55, 0x9c, 0x6d, 0x4d, 0xaf, 0x59, 0xa5, 0xf2,
1612 0x6d, 0x9f, 0x20, 0x08, 0x57, 0xca, 0x6c, 0x3e,
1613 0x9c, 0xac, 0x52, 0x4b, 0xd9, 0xac, 0xc9, 0x2a },
1614 { 0xDC, 0x7E, 0x84, 0xBF, 0xDA, 0x79, 0x16, 0x4B,
1615 0x7E, 0xCD, 0x84, 0x86, 0x98, 0x5D, 0x38, 0x60,
1616 0x4f, 0xeb, 0xdc, 0x67, 0x40, 0xd2, 0x0b, 0x3a,
1617 0xc8, 0x8f, 0x6a, 0xd8, 0x2a, 0x4f, 0xb0, 0x8d,
1618 0x71, 0xab, 0x47, 0xa0, 0x86, 0xe8, 0x6e, 0xed,
1619 0xf3, 0x9d, 0x1c, 0x5b, 0xba, 0x97, 0xc4, 0x08,
1620 0x01, 0x26, 0x14, 0x1d, 0x67, 0xf3, 0x7b, 0xe8,
1621 0x53, 0x8f, 0x5a, 0x8b, 0xe7, 0x40, 0xe4, 0x84 }
1622 };
1623 #endif /* MBEDTLS_CIPHER_MODE_OFB */
1624
1625 #if defined(MBEDTLS_CIPHER_MODE_CTR)
1626 /*
1627 * AES-CTR test vectors from:
1628 *
1629 * http://www.faqs.org/rfcs/rfc3686.html
1630 */
1631
1632 static const unsigned char aes_test_ctr_key[3][16] =
1633 {
1634 { 0xAE, 0x68, 0x52, 0xF8, 0x12, 0x10, 0x67, 0xCC,
1635 0x4B, 0xF7, 0xA5, 0x76, 0x55, 0x77, 0xF3, 0x9E },
1636 { 0x7E, 0x24, 0x06, 0x78, 0x17, 0xFA, 0xE0, 0xD7,
1637 0x43, 0xD6, 0xCE, 0x1F, 0x32, 0x53, 0x91, 0x63 },
1638 { 0x76, 0x91, 0xBE, 0x03, 0x5E, 0x50, 0x20, 0xA8,
1639 0xAC, 0x6E, 0x61, 0x85, 0x29, 0xF9, 0xA0, 0xDC }
1640 };
1641
1642 static const unsigned char aes_test_ctr_nonce_counter[3][16] =
1643 {
1644 { 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x00,
1645 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 },
1646 { 0x00, 0x6C, 0xB6, 0xDB, 0xC0, 0x54, 0x3B, 0x59,
1647 0xDA, 0x48, 0xD9, 0x0B, 0x00, 0x00, 0x00, 0x01 },
1648 { 0x00, 0xE0, 0x01, 0x7B, 0x27, 0x77, 0x7F, 0x3F,
1649 0x4A, 0x17, 0x86, 0xF0, 0x00, 0x00, 0x00, 0x01 }
1650 };
1651
1652 static const unsigned char aes_test_ctr_pt[3][48] =
1653 {
1654 { 0x53, 0x69, 0x6E, 0x67, 0x6C, 0x65, 0x20, 0x62,
1655 0x6C, 0x6F, 0x63, 0x6B, 0x20, 0x6D, 0x73, 0x67 },
1656
1657 { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
1658 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
1659 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
1660 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F },
1661
1662 { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
1663 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
1664 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
1665 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F,
1666 0x20, 0x21, 0x22, 0x23 }
1667 };
1668
1669 static const unsigned char aes_test_ctr_ct[3][48] =
1670 {
1671 { 0xE4, 0x09, 0x5D, 0x4F, 0xB7, 0xA7, 0xB3, 0x79,
1672 0x2D, 0x61, 0x75, 0xA3, 0x26, 0x13, 0x11, 0xB8 },
1673 { 0x51, 0x04, 0xA1, 0x06, 0x16, 0x8A, 0x72, 0xD9,
1674 0x79, 0x0D, 0x41, 0xEE, 0x8E, 0xDA, 0xD3, 0x88,
1675 0xEB, 0x2E, 0x1E, 0xFC, 0x46, 0xDA, 0x57, 0xC8,
1676 0xFC, 0xE6, 0x30, 0xDF, 0x91, 0x41, 0xBE, 0x28 },
1677 { 0xC1, 0xCF, 0x48, 0xA8, 0x9F, 0x2F, 0xFD, 0xD9,
1678 0xCF, 0x46, 0x52, 0xE9, 0xEF, 0xDB, 0x72, 0xD7,
1679 0x45, 0x40, 0xA4, 0x2B, 0xDE, 0x6D, 0x78, 0x36,
1680 0xD5, 0x9A, 0x5C, 0xEA, 0xAE, 0xF3, 0x10, 0x53,
1681 0x25, 0xB2, 0x07, 0x2F }
1682 };
1683
1684 static const int aes_test_ctr_len[3] =
1685 { 16, 32, 36 };
1686 #endif /* MBEDTLS_CIPHER_MODE_CTR */
1687
1688 #if defined(MBEDTLS_CIPHER_MODE_XTS)
1689 /*
1690 * AES-XTS test vectors from:
1691 *
1692 * IEEE P1619/D16 Annex B
1693 * https://web.archive.org/web/20150629024421/http://grouper.ieee.org/groups/1619/email/pdf00086.pdf
1694 * (Archived from original at http://grouper.ieee.org/groups/1619/email/pdf00086.pdf)
1695 */
1696 static const unsigned char aes_test_xts_key[][32] =
1697 {
1698 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1699 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1700 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1701 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
1702 { 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11,
1703 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11,
1704 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22,
1705 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22 },
1706 { 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8,
1707 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1708 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22,
1709 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22 },
1710 };
1711
1712 static const unsigned char aes_test_xts_pt32[][32] =
1713 {
1714 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1715 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1716 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1717 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
1718 { 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
1719 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
1720 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
1721 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44 },
1722 { 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
1723 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
1724 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
1725 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44 },
1726 };
1727
1728 static const unsigned char aes_test_xts_ct32[][32] =
1729 {
1730 { 0x91, 0x7c, 0xf6, 0x9e, 0xbd, 0x68, 0xb2, 0xec,
1731 0x9b, 0x9f, 0xe9, 0xa3, 0xea, 0xdd, 0xa6, 0x92,
1732 0xcd, 0x43, 0xd2, 0xf5, 0x95, 0x98, 0xed, 0x85,
1733 0x8c, 0x02, 0xc2, 0x65, 0x2f, 0xbf, 0x92, 0x2e },
1734 { 0xc4, 0x54, 0x18, 0x5e, 0x6a, 0x16, 0x93, 0x6e,
1735 0x39, 0x33, 0x40, 0x38, 0xac, 0xef, 0x83, 0x8b,
1736 0xfb, 0x18, 0x6f, 0xff, 0x74, 0x80, 0xad, 0xc4,
1737 0x28, 0x93, 0x82, 0xec, 0xd6, 0xd3, 0x94, 0xf0 },
1738 { 0xaf, 0x85, 0x33, 0x6b, 0x59, 0x7a, 0xfc, 0x1a,
1739 0x90, 0x0b, 0x2e, 0xb2, 0x1e, 0xc9, 0x49, 0xd2,
1740 0x92, 0xdf, 0x4c, 0x04, 0x7e, 0x0b, 0x21, 0x53,
1741 0x21, 0x86, 0xa5, 0x97, 0x1a, 0x22, 0x7a, 0x89 },
1742 };
1743
1744 static const unsigned char aes_test_xts_data_unit[][16] =
1745 {
1746 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1747 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
1748 { 0x33, 0x33, 0x33, 0x33, 0x33, 0x00, 0x00, 0x00,
1749 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
1750 { 0x33, 0x33, 0x33, 0x33, 0x33, 0x00, 0x00, 0x00,
1751 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
1752 };
1753
1754 #endif /* MBEDTLS_CIPHER_MODE_XTS */
1755
1756 /*
1757 * Checkup routine
1758 */
mbedtls_aes_self_test(int verbose)1759 int mbedtls_aes_self_test( int verbose )
1760 {
1761 int ret = 0, i, j, u, mode;
1762 unsigned int keybits;
1763 unsigned char key[32];
1764 unsigned char buf[64];
1765 const unsigned char *aes_tests;
1766 #if defined(MBEDTLS_CIPHER_MODE_CBC) || defined(MBEDTLS_CIPHER_MODE_CFB)
1767 unsigned char iv[16];
1768 #endif
1769 #if defined(MBEDTLS_CIPHER_MODE_CBC)
1770 unsigned char prv[16];
1771 #endif
1772 #if defined(MBEDTLS_CIPHER_MODE_CTR) || defined(MBEDTLS_CIPHER_MODE_CFB) || \
1773 defined(MBEDTLS_CIPHER_MODE_OFB)
1774 size_t offset;
1775 #endif
1776 #if defined(MBEDTLS_CIPHER_MODE_CTR) || defined(MBEDTLS_CIPHER_MODE_XTS)
1777 int len;
1778 #endif
1779 #if defined(MBEDTLS_CIPHER_MODE_CTR)
1780 unsigned char nonce_counter[16];
1781 unsigned char stream_block[16];
1782 #endif
1783 mbedtls_aes_context ctx;
1784
1785 memset( key, 0, 32 );
1786 mbedtls_aes_init( &ctx );
1787
1788 /*
1789 * ECB mode
1790 */
1791 for( i = 0; i < 6; i++ )
1792 {
1793 u = i >> 1;
1794 keybits = 128 + u * 64;
1795 mode = i & 1;
1796
1797 if( verbose != 0 )
1798 mbedtls_printf( " AES-ECB-%3u (%s): ", keybits,
1799 ( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" );
1800
1801 memset( buf, 0, 16 );
1802
1803 if( mode == MBEDTLS_AES_DECRYPT )
1804 {
1805 ret = mbedtls_aes_setkey_dec( &ctx, key, keybits );
1806 aes_tests = aes_test_ecb_dec[u];
1807 }
1808 else
1809 {
1810 ret = mbedtls_aes_setkey_enc( &ctx, key, keybits );
1811 aes_tests = aes_test_ecb_enc[u];
1812 }
1813
1814 /*
1815 * AES-192 is an optional feature that may be unavailable when
1816 * there is an alternative underlying implementation i.e. when
1817 * MBEDTLS_AES_ALT is defined.
1818 */
1819 if( ret == MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED && keybits == 192 )
1820 {
1821 mbedtls_printf( "skipped\n" );
1822 continue;
1823 }
1824 else if( ret != 0 )
1825 {
1826 goto exit;
1827 }
1828
1829 for( j = 0; j < 10000; j++ )
1830 {
1831 ret = mbedtls_aes_crypt_ecb( &ctx, mode, buf, buf );
1832 if( ret != 0 )
1833 goto exit;
1834 }
1835
1836 if( memcmp( buf, aes_tests, 16 ) != 0 )
1837 {
1838 ret = 1;
1839 goto exit;
1840 }
1841
1842 if( verbose != 0 )
1843 mbedtls_printf( "passed\n" );
1844 }
1845
1846 if( verbose != 0 )
1847 mbedtls_printf( "\n" );
1848
1849 #if defined(MBEDTLS_CIPHER_MODE_CBC)
1850 /*
1851 * CBC mode
1852 */
1853 for( i = 0; i < 6; i++ )
1854 {
1855 u = i >> 1;
1856 keybits = 128 + u * 64;
1857 mode = i & 1;
1858
1859 if( verbose != 0 )
1860 mbedtls_printf( " AES-CBC-%3u (%s): ", keybits,
1861 ( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" );
1862
1863 memset( iv , 0, 16 );
1864 memset( prv, 0, 16 );
1865 memset( buf, 0, 16 );
1866
1867 if( mode == MBEDTLS_AES_DECRYPT )
1868 {
1869 ret = mbedtls_aes_setkey_dec( &ctx, key, keybits );
1870 aes_tests = aes_test_cbc_dec[u];
1871 }
1872 else
1873 {
1874 ret = mbedtls_aes_setkey_enc( &ctx, key, keybits );
1875 aes_tests = aes_test_cbc_enc[u];
1876 }
1877
1878 /*
1879 * AES-192 is an optional feature that may be unavailable when
1880 * there is an alternative underlying implementation i.e. when
1881 * MBEDTLS_AES_ALT is defined.
1882 */
1883 if( ret == MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED && keybits == 192 )
1884 {
1885 mbedtls_printf( "skipped\n" );
1886 continue;
1887 }
1888 else if( ret != 0 )
1889 {
1890 goto exit;
1891 }
1892
1893 for( j = 0; j < 10000; j++ )
1894 {
1895 if( mode == MBEDTLS_AES_ENCRYPT )
1896 {
1897 unsigned char tmp[16];
1898
1899 memcpy( tmp, prv, 16 );
1900 memcpy( prv, buf, 16 );
1901 memcpy( buf, tmp, 16 );
1902 }
1903
1904 ret = mbedtls_aes_crypt_cbc( &ctx, mode, 16, iv, buf, buf );
1905 if( ret != 0 )
1906 goto exit;
1907
1908 }
1909
1910 if( memcmp( buf, aes_tests, 16 ) != 0 )
1911 {
1912 ret = 1;
1913 goto exit;
1914 }
1915
1916 if( verbose != 0 )
1917 mbedtls_printf( "passed\n" );
1918 }
1919
1920 if( verbose != 0 )
1921 mbedtls_printf( "\n" );
1922 #endif /* MBEDTLS_CIPHER_MODE_CBC */
1923
1924 #if defined(MBEDTLS_CIPHER_MODE_CFB)
1925 /*
1926 * CFB128 mode
1927 */
1928 for( i = 0; i < 6; i++ )
1929 {
1930 u = i >> 1;
1931 keybits = 128 + u * 64;
1932 mode = i & 1;
1933
1934 if( verbose != 0 )
1935 mbedtls_printf( " AES-CFB128-%3u (%s): ", keybits,
1936 ( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" );
1937
1938 memcpy( iv, aes_test_cfb128_iv, 16 );
1939 memcpy( key, aes_test_cfb128_key[u], keybits / 8 );
1940
1941 offset = 0;
1942 ret = mbedtls_aes_setkey_enc( &ctx, key, keybits );
1943 /*
1944 * AES-192 is an optional feature that may be unavailable when
1945 * there is an alternative underlying implementation i.e. when
1946 * MBEDTLS_AES_ALT is defined.
1947 */
1948 if( ret == MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED && keybits == 192 )
1949 {
1950 mbedtls_printf( "skipped\n" );
1951 continue;
1952 }
1953 else if( ret != 0 )
1954 {
1955 goto exit;
1956 }
1957
1958 if( mode == MBEDTLS_AES_DECRYPT )
1959 {
1960 memcpy( buf, aes_test_cfb128_ct[u], 64 );
1961 aes_tests = aes_test_cfb128_pt;
1962 }
1963 else
1964 {
1965 memcpy( buf, aes_test_cfb128_pt, 64 );
1966 aes_tests = aes_test_cfb128_ct[u];
1967 }
1968
1969 ret = mbedtls_aes_crypt_cfb128( &ctx, mode, 64, &offset, iv, buf, buf );
1970 if( ret != 0 )
1971 goto exit;
1972
1973 if( memcmp( buf, aes_tests, 64 ) != 0 )
1974 {
1975 ret = 1;
1976 goto exit;
1977 }
1978
1979 if( verbose != 0 )
1980 mbedtls_printf( "passed\n" );
1981 }
1982
1983 if( verbose != 0 )
1984 mbedtls_printf( "\n" );
1985 #endif /* MBEDTLS_CIPHER_MODE_CFB */
1986
1987 #if defined(MBEDTLS_CIPHER_MODE_OFB)
1988 /*
1989 * OFB mode
1990 */
1991 for( i = 0; i < 6; i++ )
1992 {
1993 u = i >> 1;
1994 keybits = 128 + u * 64;
1995 mode = i & 1;
1996
1997 if( verbose != 0 )
1998 mbedtls_printf( " AES-OFB-%3u (%s): ", keybits,
1999 ( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" );
2000
2001 memcpy( iv, aes_test_ofb_iv, 16 );
2002 memcpy( key, aes_test_ofb_key[u], keybits / 8 );
2003
2004 offset = 0;
2005 ret = mbedtls_aes_setkey_enc( &ctx, key, keybits );
2006 /*
2007 * AES-192 is an optional feature that may be unavailable when
2008 * there is an alternative underlying implementation i.e. when
2009 * MBEDTLS_AES_ALT is defined.
2010 */
2011 if( ret == MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED && keybits == 192 )
2012 {
2013 mbedtls_printf( "skipped\n" );
2014 continue;
2015 }
2016 else if( ret != 0 )
2017 {
2018 goto exit;
2019 }
2020
2021 if( mode == MBEDTLS_AES_DECRYPT )
2022 {
2023 memcpy( buf, aes_test_ofb_ct[u], 64 );
2024 aes_tests = aes_test_ofb_pt;
2025 }
2026 else
2027 {
2028 memcpy( buf, aes_test_ofb_pt, 64 );
2029 aes_tests = aes_test_ofb_ct[u];
2030 }
2031
2032 ret = mbedtls_aes_crypt_ofb( &ctx, 64, &offset, iv, buf, buf );
2033 if( ret != 0 )
2034 goto exit;
2035
2036 if( memcmp( buf, aes_tests, 64 ) != 0 )
2037 {
2038 ret = 1;
2039 goto exit;
2040 }
2041
2042 if( verbose != 0 )
2043 mbedtls_printf( "passed\n" );
2044 }
2045
2046 if( verbose != 0 )
2047 mbedtls_printf( "\n" );
2048 #endif /* MBEDTLS_CIPHER_MODE_OFB */
2049
2050 #if defined(MBEDTLS_CIPHER_MODE_CTR)
2051 /*
2052 * CTR mode
2053 */
2054 for( i = 0; i < 6; i++ )
2055 {
2056 u = i >> 1;
2057 mode = i & 1;
2058
2059 if( verbose != 0 )
2060 mbedtls_printf( " AES-CTR-128 (%s): ",
2061 ( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" );
2062
2063 memcpy( nonce_counter, aes_test_ctr_nonce_counter[u], 16 );
2064 memcpy( key, aes_test_ctr_key[u], 16 );
2065
2066 offset = 0;
2067 if( ( ret = mbedtls_aes_setkey_enc( &ctx, key, 128 ) ) != 0 )
2068 goto exit;
2069
2070 len = aes_test_ctr_len[u];
2071
2072 if( mode == MBEDTLS_AES_DECRYPT )
2073 {
2074 memcpy( buf, aes_test_ctr_ct[u], len );
2075 aes_tests = aes_test_ctr_pt[u];
2076 }
2077 else
2078 {
2079 memcpy( buf, aes_test_ctr_pt[u], len );
2080 aes_tests = aes_test_ctr_ct[u];
2081 }
2082
2083 ret = mbedtls_aes_crypt_ctr( &ctx, len, &offset, nonce_counter,
2084 stream_block, buf, buf );
2085 if( ret != 0 )
2086 goto exit;
2087
2088 if( memcmp( buf, aes_tests, len ) != 0 )
2089 {
2090 ret = 1;
2091 goto exit;
2092 }
2093
2094 if( verbose != 0 )
2095 mbedtls_printf( "passed\n" );
2096 }
2097
2098 if( verbose != 0 )
2099 mbedtls_printf( "\n" );
2100 #endif /* MBEDTLS_CIPHER_MODE_CTR */
2101
2102 #if defined(MBEDTLS_CIPHER_MODE_XTS)
2103 {
2104 static const int num_tests =
2105 sizeof(aes_test_xts_key) / sizeof(*aes_test_xts_key);
2106 mbedtls_aes_xts_context ctx_xts;
2107
2108 /*
2109 * XTS mode
2110 */
2111 mbedtls_aes_xts_init( &ctx_xts );
2112
2113 for( i = 0; i < num_tests << 1; i++ )
2114 {
2115 const unsigned char *data_unit;
2116 u = i >> 1;
2117 mode = i & 1;
2118
2119 if( verbose != 0 )
2120 mbedtls_printf( " AES-XTS-128 (%s): ",
2121 ( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" );
2122
2123 memset( key, 0, sizeof( key ) );
2124 memcpy( key, aes_test_xts_key[u], 32 );
2125 data_unit = aes_test_xts_data_unit[u];
2126
2127 len = sizeof( *aes_test_xts_ct32 );
2128
2129 if( mode == MBEDTLS_AES_DECRYPT )
2130 {
2131 ret = mbedtls_aes_xts_setkey_dec( &ctx_xts, key, 256 );
2132 if( ret != 0)
2133 goto exit;
2134 memcpy( buf, aes_test_xts_ct32[u], len );
2135 aes_tests = aes_test_xts_pt32[u];
2136 }
2137 else
2138 {
2139 ret = mbedtls_aes_xts_setkey_enc( &ctx_xts, key, 256 );
2140 if( ret != 0)
2141 goto exit;
2142 memcpy( buf, aes_test_xts_pt32[u], len );
2143 aes_tests = aes_test_xts_ct32[u];
2144 }
2145
2146
2147 ret = mbedtls_aes_crypt_xts( &ctx_xts, mode, len, data_unit,
2148 buf, buf );
2149 if( ret != 0 )
2150 goto exit;
2151
2152 if( memcmp( buf, aes_tests, len ) != 0 )
2153 {
2154 ret = 1;
2155 goto exit;
2156 }
2157
2158 if( verbose != 0 )
2159 mbedtls_printf( "passed\n" );
2160 }
2161
2162 if( verbose != 0 )
2163 mbedtls_printf( "\n" );
2164
2165 mbedtls_aes_xts_free( &ctx_xts );
2166 }
2167 #endif /* MBEDTLS_CIPHER_MODE_XTS */
2168
2169 ret = 0;
2170
2171 exit:
2172 if( ret != 0 && verbose != 0 )
2173 mbedtls_printf( "failed\n" );
2174
2175 mbedtls_aes_free( &ctx );
2176
2177 return( ret );
2178 }
2179
2180 #endif /* MBEDTLS_SELF_TEST */
2181
2182 #endif /* MBEDTLS_AES_C */
2183