aes.c (42361B)
1 /********************************************************************* 2 * Filename: aes.c 3 * Author: Brad Conte (brad AT bradconte.com) 4 * Copyright: 5 * Disclaimer: This code is presented "as is" without any guarantees. 6 * Details: This code is the implementation of the AES algorithm and 7 the CTR, CBC, and CCM modes of operation it can be used in. 8 AES is, specified by the NIST in in publication FIPS PUB 197, 9 availible at: 10 * http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf . 11 The CBC and CTR modes of operation are specified by 12 NIST SP 800-38 A, available at: 13 * http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf . 14 The CCM mode of operation is specified by NIST SP80-38 C, available at: 15 * http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C_updated-July20_2007.pdf 16 *********************************************************************/ 17 18 /*************************** HEADER FILES ***************************/ 19 #include <stdlib.h> 20 #include <memory.h> 21 #include "aes.h" 22 23 #include <stdio.h> 24 25 /****************************** MACROS ******************************/ 26 // The least significant byte of the word is rotated to the end. 27 #define KE_ROTWORD(x) (((x) << 8) | ((x) >> 24)) 28 29 #define TRUE 1 30 #define FALSE 0 31 32 /**************************** DATA TYPES ****************************/ 33 #define AES_128_ROUNDS 10 34 #define AES_192_ROUNDS 12 35 #define AES_256_ROUNDS 14 36 37 /*********************** FUNCTION DECLARATIONS **********************/ 38 void ccm_prepare_first_ctr_blk(BYTE counter[], const BYTE nonce[], int nonce_len, int payload_len_store_size); 39 void ccm_prepare_first_format_blk(BYTE buf[], int assoc_len, int payload_len, int payload_len_store_size, int mac_len, const BYTE nonce[], int nonce_len); 40 void ccm_format_assoc_data(BYTE buf[], int *end_of_buf, const BYTE assoc[], int assoc_len); 41 void ccm_format_payload_data(BYTE buf[], int *end_of_buf, const BYTE payload[], int payload_len); 42 43 /**************************** VARIABLES *****************************/ 44 // This is the specified AES SBox. To look up a substitution value, put the first 45 // nibble in the first index (row) and the second nibble in the second index (column). 46 static const BYTE aes_sbox[16][16] = { 47 {0x63,0x7C,0x77,0x7B,0xF2,0x6B,0x6F,0xC5,0x30,0x01,0x67,0x2B,0xFE,0xD7,0xAB,0x76}, 48 {0xCA,0x82,0xC9,0x7D,0xFA,0x59,0x47,0xF0,0xAD,0xD4,0xA2,0xAF,0x9C,0xA4,0x72,0xC0}, 49 {0xB7,0xFD,0x93,0x26,0x36,0x3F,0xF7,0xCC,0x34,0xA5,0xE5,0xF1,0x71,0xD8,0x31,0x15}, 50 {0x04,0xC7,0x23,0xC3,0x18,0x96,0x05,0x9A,0x07,0x12,0x80,0xE2,0xEB,0x27,0xB2,0x75}, 51 {0x09,0x83,0x2C,0x1A,0x1B,0x6E,0x5A,0xA0,0x52,0x3B,0xD6,0xB3,0x29,0xE3,0x2F,0x84}, 52 {0x53,0xD1,0x00,0xED,0x20,0xFC,0xB1,0x5B,0x6A,0xCB,0xBE,0x39,0x4A,0x4C,0x58,0xCF}, 53 {0xD0,0xEF,0xAA,0xFB,0x43,0x4D,0x33,0x85,0x45,0xF9,0x02,0x7F,0x50,0x3C,0x9F,0xA8}, 54 {0x51,0xA3,0x40,0x8F,0x92,0x9D,0x38,0xF5,0xBC,0xB6,0xDA,0x21,0x10,0xFF,0xF3,0xD2}, 55 {0xCD,0x0C,0x13,0xEC,0x5F,0x97,0x44,0x17,0xC4,0xA7,0x7E,0x3D,0x64,0x5D,0x19,0x73}, 56 {0x60,0x81,0x4F,0xDC,0x22,0x2A,0x90,0x88,0x46,0xEE,0xB8,0x14,0xDE,0x5E,0x0B,0xDB}, 57 {0xE0,0x32,0x3A,0x0A,0x49,0x06,0x24,0x5C,0xC2,0xD3,0xAC,0x62,0x91,0x95,0xE4,0x79}, 58 {0xE7,0xC8,0x37,0x6D,0x8D,0xD5,0x4E,0xA9,0x6C,0x56,0xF4,0xEA,0x65,0x7A,0xAE,0x08}, 59 {0xBA,0x78,0x25,0x2E,0x1C,0xA6,0xB4,0xC6,0xE8,0xDD,0x74,0x1F,0x4B,0xBD,0x8B,0x8A}, 60 {0x70,0x3E,0xB5,0x66,0x48,0x03,0xF6,0x0E,0x61,0x35,0x57,0xB9,0x86,0xC1,0x1D,0x9E}, 61 {0xE1,0xF8,0x98,0x11,0x69,0xD9,0x8E,0x94,0x9B,0x1E,0x87,0xE9,0xCE,0x55,0x28,0xDF}, 62 {0x8C,0xA1,0x89,0x0D,0xBF,0xE6,0x42,0x68,0x41,0x99,0x2D,0x0F,0xB0,0x54,0xBB,0x16} 63 }; 64 65 static const BYTE aes_invsbox[16][16] = { 66 {0x52,0x09,0x6A,0xD5,0x30,0x36,0xA5,0x38,0xBF,0x40,0xA3,0x9E,0x81,0xF3,0xD7,0xFB}, 67 {0x7C,0xE3,0x39,0x82,0x9B,0x2F,0xFF,0x87,0x34,0x8E,0x43,0x44,0xC4,0xDE,0xE9,0xCB}, 68 {0x54,0x7B,0x94,0x32,0xA6,0xC2,0x23,0x3D,0xEE,0x4C,0x95,0x0B,0x42,0xFA,0xC3,0x4E}, 69 {0x08,0x2E,0xA1,0x66,0x28,0xD9,0x24,0xB2,0x76,0x5B,0xA2,0x49,0x6D,0x8B,0xD1,0x25}, 70 {0x72,0xF8,0xF6,0x64,0x86,0x68,0x98,0x16,0xD4,0xA4,0x5C,0xCC,0x5D,0x65,0xB6,0x92}, 71 {0x6C,0x70,0x48,0x50,0xFD,0xED,0xB9,0xDA,0x5E,0x15,0x46,0x57,0xA7,0x8D,0x9D,0x84}, 72 {0x90,0xD8,0xAB,0x00,0x8C,0xBC,0xD3,0x0A,0xF7,0xE4,0x58,0x05,0xB8,0xB3,0x45,0x06}, 73 {0xD0,0x2C,0x1E,0x8F,0xCA,0x3F,0x0F,0x02,0xC1,0xAF,0xBD,0x03,0x01,0x13,0x8A,0x6B}, 74 {0x3A,0x91,0x11,0x41,0x4F,0x67,0xDC,0xEA,0x97,0xF2,0xCF,0xCE,0xF0,0xB4,0xE6,0x73}, 75 {0x96,0xAC,0x74,0x22,0xE7,0xAD,0x35,0x85,0xE2,0xF9,0x37,0xE8,0x1C,0x75,0xDF,0x6E}, 76 {0x47,0xF1,0x1A,0x71,0x1D,0x29,0xC5,0x89,0x6F,0xB7,0x62,0x0E,0xAA,0x18,0xBE,0x1B}, 77 {0xFC,0x56,0x3E,0x4B,0xC6,0xD2,0x79,0x20,0x9A,0xDB,0xC0,0xFE,0x78,0xCD,0x5A,0xF4}, 78 {0x1F,0xDD,0xA8,0x33,0x88,0x07,0xC7,0x31,0xB1,0x12,0x10,0x59,0x27,0x80,0xEC,0x5F}, 79 {0x60,0x51,0x7F,0xA9,0x19,0xB5,0x4A,0x0D,0x2D,0xE5,0x7A,0x9F,0x93,0xC9,0x9C,0xEF}, 80 {0xA0,0xE0,0x3B,0x4D,0xAE,0x2A,0xF5,0xB0,0xC8,0xEB,0xBB,0x3C,0x83,0x53,0x99,0x61}, 81 {0x17,0x2B,0x04,0x7E,0xBA,0x77,0xD6,0x26,0xE1,0x69,0x14,0x63,0x55,0x21,0x0C,0x7D} 82 }; 83 84 // This table stores pre-calculated values for all possible GF(2^8) calculations.This 85 // table is only used by the (Inv)MixColumns steps. 86 // USAGE: The second index (column) is the coefficient of multiplication. Only 7 different 87 // coefficients are used: 0x01, 0x02, 0x03, 0x09, 0x0b, 0x0d, 0x0e, but multiplication by 88 // 1 is negligible leaving only 6 coefficients. Each column of the table is devoted to one 89 // of these coefficients, in the ascending order of value, from values 0x00 to 0xFF. 90 static const BYTE gf_mul[256][6] = { 91 {0x00,0x00,0x00,0x00,0x00,0x00},{0x02,0x03,0x09,0x0b,0x0d,0x0e}, 92 {0x04,0x06,0x12,0x16,0x1a,0x1c},{0x06,0x05,0x1b,0x1d,0x17,0x12}, 93 {0x08,0x0c,0x24,0x2c,0x34,0x38},{0x0a,0x0f,0x2d,0x27,0x39,0x36}, 94 {0x0c,0x0a,0x36,0x3a,0x2e,0x24},{0x0e,0x09,0x3f,0x31,0x23,0x2a}, 95 {0x10,0x18,0x48,0x58,0x68,0x70},{0x12,0x1b,0x41,0x53,0x65,0x7e}, 96 {0x14,0x1e,0x5a,0x4e,0x72,0x6c},{0x16,0x1d,0x53,0x45,0x7f,0x62}, 97 {0x18,0x14,0x6c,0x74,0x5c,0x48},{0x1a,0x17,0x65,0x7f,0x51,0x46}, 98 {0x1c,0x12,0x7e,0x62,0x46,0x54},{0x1e,0x11,0x77,0x69,0x4b,0x5a}, 99 {0x20,0x30,0x90,0xb0,0xd0,0xe0},{0x22,0x33,0x99,0xbb,0xdd,0xee}, 100 {0x24,0x36,0x82,0xa6,0xca,0xfc},{0x26,0x35,0x8b,0xad,0xc7,0xf2}, 101 {0x28,0x3c,0xb4,0x9c,0xe4,0xd8},{0x2a,0x3f,0xbd,0x97,0xe9,0xd6}, 102 {0x2c,0x3a,0xa6,0x8a,0xfe,0xc4},{0x2e,0x39,0xaf,0x81,0xf3,0xca}, 103 {0x30,0x28,0xd8,0xe8,0xb8,0x90},{0x32,0x2b,0xd1,0xe3,0xb5,0x9e}, 104 {0x34,0x2e,0xca,0xfe,0xa2,0x8c},{0x36,0x2d,0xc3,0xf5,0xaf,0x82}, 105 {0x38,0x24,0xfc,0xc4,0x8c,0xa8},{0x3a,0x27,0xf5,0xcf,0x81,0xa6}, 106 {0x3c,0x22,0xee,0xd2,0x96,0xb4},{0x3e,0x21,0xe7,0xd9,0x9b,0xba}, 107 {0x40,0x60,0x3b,0x7b,0xbb,0xdb},{0x42,0x63,0x32,0x70,0xb6,0xd5}, 108 {0x44,0x66,0x29,0x6d,0xa1,0xc7},{0x46,0x65,0x20,0x66,0xac,0xc9}, 109 {0x48,0x6c,0x1f,0x57,0x8f,0xe3},{0x4a,0x6f,0x16,0x5c,0x82,0xed}, 110 {0x4c,0x6a,0x0d,0x41,0x95,0xff},{0x4e,0x69,0x04,0x4a,0x98,0xf1}, 111 {0x50,0x78,0x73,0x23,0xd3,0xab},{0x52,0x7b,0x7a,0x28,0xde,0xa5}, 112 {0x54,0x7e,0x61,0x35,0xc9,0xb7},{0x56,0x7d,0x68,0x3e,0xc4,0xb9}, 113 {0x58,0x74,0x57,0x0f,0xe7,0x93},{0x5a,0x77,0x5e,0x04,0xea,0x9d}, 114 {0x5c,0x72,0x45,0x19,0xfd,0x8f},{0x5e,0x71,0x4c,0x12,0xf0,0x81}, 115 {0x60,0x50,0xab,0xcb,0x6b,0x3b},{0x62,0x53,0xa2,0xc0,0x66,0x35}, 116 {0x64,0x56,0xb9,0xdd,0x71,0x27},{0x66,0x55,0xb0,0xd6,0x7c,0x29}, 117 {0x68,0x5c,0x8f,0xe7,0x5f,0x03},{0x6a,0x5f,0x86,0xec,0x52,0x0d}, 118 {0x6c,0x5a,0x9d,0xf1,0x45,0x1f},{0x6e,0x59,0x94,0xfa,0x48,0x11}, 119 {0x70,0x48,0xe3,0x93,0x03,0x4b},{0x72,0x4b,0xea,0x98,0x0e,0x45}, 120 {0x74,0x4e,0xf1,0x85,0x19,0x57},{0x76,0x4d,0xf8,0x8e,0x14,0x59}, 121 {0x78,0x44,0xc7,0xbf,0x37,0x73},{0x7a,0x47,0xce,0xb4,0x3a,0x7d}, 122 {0x7c,0x42,0xd5,0xa9,0x2d,0x6f},{0x7e,0x41,0xdc,0xa2,0x20,0x61}, 123 {0x80,0xc0,0x76,0xf6,0x6d,0xad},{0x82,0xc3,0x7f,0xfd,0x60,0xa3}, 124 {0x84,0xc6,0x64,0xe0,0x77,0xb1},{0x86,0xc5,0x6d,0xeb,0x7a,0xbf}, 125 {0x88,0xcc,0x52,0xda,0x59,0x95},{0x8a,0xcf,0x5b,0xd1,0x54,0x9b}, 126 {0x8c,0xca,0x40,0xcc,0x43,0x89},{0x8e,0xc9,0x49,0xc7,0x4e,0x87}, 127 {0x90,0xd8,0x3e,0xae,0x05,0xdd},{0x92,0xdb,0x37,0xa5,0x08,0xd3}, 128 {0x94,0xde,0x2c,0xb8,0x1f,0xc1},{0x96,0xdd,0x25,0xb3,0x12,0xcf}, 129 {0x98,0xd4,0x1a,0x82,0x31,0xe5},{0x9a,0xd7,0x13,0x89,0x3c,0xeb}, 130 {0x9c,0xd2,0x08,0x94,0x2b,0xf9},{0x9e,0xd1,0x01,0x9f,0x26,0xf7}, 131 {0xa0,0xf0,0xe6,0x46,0xbd,0x4d},{0xa2,0xf3,0xef,0x4d,0xb0,0x43}, 132 {0xa4,0xf6,0xf4,0x50,0xa7,0x51},{0xa6,0xf5,0xfd,0x5b,0xaa,0x5f}, 133 {0xa8,0xfc,0xc2,0x6a,0x89,0x75},{0xaa,0xff,0xcb,0x61,0x84,0x7b}, 134 {0xac,0xfa,0xd0,0x7c,0x93,0x69},{0xae,0xf9,0xd9,0x77,0x9e,0x67}, 135 {0xb0,0xe8,0xae,0x1e,0xd5,0x3d},{0xb2,0xeb,0xa7,0x15,0xd8,0x33}, 136 {0xb4,0xee,0xbc,0x08,0xcf,0x21},{0xb6,0xed,0xb5,0x03,0xc2,0x2f}, 137 {0xb8,0xe4,0x8a,0x32,0xe1,0x05},{0xba,0xe7,0x83,0x39,0xec,0x0b}, 138 {0xbc,0xe2,0x98,0x24,0xfb,0x19},{0xbe,0xe1,0x91,0x2f,0xf6,0x17}, 139 {0xc0,0xa0,0x4d,0x8d,0xd6,0x76},{0xc2,0xa3,0x44,0x86,0xdb,0x78}, 140 {0xc4,0xa6,0x5f,0x9b,0xcc,0x6a},{0xc6,0xa5,0x56,0x90,0xc1,0x64}, 141 {0xc8,0xac,0x69,0xa1,0xe2,0x4e},{0xca,0xaf,0x60,0xaa,0xef,0x40}, 142 {0xcc,0xaa,0x7b,0xb7,0xf8,0x52},{0xce,0xa9,0x72,0xbc,0xf5,0x5c}, 143 {0xd0,0xb8,0x05,0xd5,0xbe,0x06},{0xd2,0xbb,0x0c,0xde,0xb3,0x08}, 144 {0xd4,0xbe,0x17,0xc3,0xa4,0x1a},{0xd6,0xbd,0x1e,0xc8,0xa9,0x14}, 145 {0xd8,0xb4,0x21,0xf9,0x8a,0x3e},{0xda,0xb7,0x28,0xf2,0x87,0x30}, 146 {0xdc,0xb2,0x33,0xef,0x90,0x22},{0xde,0xb1,0x3a,0xe4,0x9d,0x2c}, 147 {0xe0,0x90,0xdd,0x3d,0x06,0x96},{0xe2,0x93,0xd4,0x36,0x0b,0x98}, 148 {0xe4,0x96,0xcf,0x2b,0x1c,0x8a},{0xe6,0x95,0xc6,0x20,0x11,0x84}, 149 {0xe8,0x9c,0xf9,0x11,0x32,0xae},{0xea,0x9f,0xf0,0x1a,0x3f,0xa0}, 150 {0xec,0x9a,0xeb,0x07,0x28,0xb2},{0xee,0x99,0xe2,0x0c,0x25,0xbc}, 151 {0xf0,0x88,0x95,0x65,0x6e,0xe6},{0xf2,0x8b,0x9c,0x6e,0x63,0xe8}, 152 {0xf4,0x8e,0x87,0x73,0x74,0xfa},{0xf6,0x8d,0x8e,0x78,0x79,0xf4}, 153 {0xf8,0x84,0xb1,0x49,0x5a,0xde},{0xfa,0x87,0xb8,0x42,0x57,0xd0}, 154 {0xfc,0x82,0xa3,0x5f,0x40,0xc2},{0xfe,0x81,0xaa,0x54,0x4d,0xcc}, 155 {0x1b,0x9b,0xec,0xf7,0xda,0x41},{0x19,0x98,0xe5,0xfc,0xd7,0x4f}, 156 {0x1f,0x9d,0xfe,0xe1,0xc0,0x5d},{0x1d,0x9e,0xf7,0xea,0xcd,0x53}, 157 {0x13,0x97,0xc8,0xdb,0xee,0x79},{0x11,0x94,0xc1,0xd0,0xe3,0x77}, 158 {0x17,0x91,0xda,0xcd,0xf4,0x65},{0x15,0x92,0xd3,0xc6,0xf9,0x6b}, 159 {0x0b,0x83,0xa4,0xaf,0xb2,0x31},{0x09,0x80,0xad,0xa4,0xbf,0x3f}, 160 {0x0f,0x85,0xb6,0xb9,0xa8,0x2d},{0x0d,0x86,0xbf,0xb2,0xa5,0x23}, 161 {0x03,0x8f,0x80,0x83,0x86,0x09},{0x01,0x8c,0x89,0x88,0x8b,0x07}, 162 {0x07,0x89,0x92,0x95,0x9c,0x15},{0x05,0x8a,0x9b,0x9e,0x91,0x1b}, 163 {0x3b,0xab,0x7c,0x47,0x0a,0xa1},{0x39,0xa8,0x75,0x4c,0x07,0xaf}, 164 {0x3f,0xad,0x6e,0x51,0x10,0xbd},{0x3d,0xae,0x67,0x5a,0x1d,0xb3}, 165 {0x33,0xa7,0x58,0x6b,0x3e,0x99},{0x31,0xa4,0x51,0x60,0x33,0x97}, 166 {0x37,0xa1,0x4a,0x7d,0x24,0x85},{0x35,0xa2,0x43,0x76,0x29,0x8b}, 167 {0x2b,0xb3,0x34,0x1f,0x62,0xd1},{0x29,0xb0,0x3d,0x14,0x6f,0xdf}, 168 {0x2f,0xb5,0x26,0x09,0x78,0xcd},{0x2d,0xb6,0x2f,0x02,0x75,0xc3}, 169 {0x23,0xbf,0x10,0x33,0x56,0xe9},{0x21,0xbc,0x19,0x38,0x5b,0xe7}, 170 {0x27,0xb9,0x02,0x25,0x4c,0xf5},{0x25,0xba,0x0b,0x2e,0x41,0xfb}, 171 {0x5b,0xfb,0xd7,0x8c,0x61,0x9a},{0x59,0xf8,0xde,0x87,0x6c,0x94}, 172 {0x5f,0xfd,0xc5,0x9a,0x7b,0x86},{0x5d,0xfe,0xcc,0x91,0x76,0x88}, 173 {0x53,0xf7,0xf3,0xa0,0x55,0xa2},{0x51,0xf4,0xfa,0xab,0x58,0xac}, 174 {0x57,0xf1,0xe1,0xb6,0x4f,0xbe},{0x55,0xf2,0xe8,0xbd,0x42,0xb0}, 175 {0x4b,0xe3,0x9f,0xd4,0x09,0xea},{0x49,0xe0,0x96,0xdf,0x04,0xe4}, 176 {0x4f,0xe5,0x8d,0xc2,0x13,0xf6},{0x4d,0xe6,0x84,0xc9,0x1e,0xf8}, 177 {0x43,0xef,0xbb,0xf8,0x3d,0xd2},{0x41,0xec,0xb2,0xf3,0x30,0xdc}, 178 {0x47,0xe9,0xa9,0xee,0x27,0xce},{0x45,0xea,0xa0,0xe5,0x2a,0xc0}, 179 {0x7b,0xcb,0x47,0x3c,0xb1,0x7a},{0x79,0xc8,0x4e,0x37,0xbc,0x74}, 180 {0x7f,0xcd,0x55,0x2a,0xab,0x66},{0x7d,0xce,0x5c,0x21,0xa6,0x68}, 181 {0x73,0xc7,0x63,0x10,0x85,0x42},{0x71,0xc4,0x6a,0x1b,0x88,0x4c}, 182 {0x77,0xc1,0x71,0x06,0x9f,0x5e},{0x75,0xc2,0x78,0x0d,0x92,0x50}, 183 {0x6b,0xd3,0x0f,0x64,0xd9,0x0a},{0x69,0xd0,0x06,0x6f,0xd4,0x04}, 184 {0x6f,0xd5,0x1d,0x72,0xc3,0x16},{0x6d,0xd6,0x14,0x79,0xce,0x18}, 185 {0x63,0xdf,0x2b,0x48,0xed,0x32},{0x61,0xdc,0x22,0x43,0xe0,0x3c}, 186 {0x67,0xd9,0x39,0x5e,0xf7,0x2e},{0x65,0xda,0x30,0x55,0xfa,0x20}, 187 {0x9b,0x5b,0x9a,0x01,0xb7,0xec},{0x99,0x58,0x93,0x0a,0xba,0xe2}, 188 {0x9f,0x5d,0x88,0x17,0xad,0xf0},{0x9d,0x5e,0x81,0x1c,0xa0,0xfe}, 189 {0x93,0x57,0xbe,0x2d,0x83,0xd4},{0x91,0x54,0xb7,0x26,0x8e,0xda}, 190 {0x97,0x51,0xac,0x3b,0x99,0xc8},{0x95,0x52,0xa5,0x30,0x94,0xc6}, 191 {0x8b,0x43,0xd2,0x59,0xdf,0x9c},{0x89,0x40,0xdb,0x52,0xd2,0x92}, 192 {0x8f,0x45,0xc0,0x4f,0xc5,0x80},{0x8d,0x46,0xc9,0x44,0xc8,0x8e}, 193 {0x83,0x4f,0xf6,0x75,0xeb,0xa4},{0x81,0x4c,0xff,0x7e,0xe6,0xaa}, 194 {0x87,0x49,0xe4,0x63,0xf1,0xb8},{0x85,0x4a,0xed,0x68,0xfc,0xb6}, 195 {0xbb,0x6b,0x0a,0xb1,0x67,0x0c},{0xb9,0x68,0x03,0xba,0x6a,0x02}, 196 {0xbf,0x6d,0x18,0xa7,0x7d,0x10},{0xbd,0x6e,0x11,0xac,0x70,0x1e}, 197 {0xb3,0x67,0x2e,0x9d,0x53,0x34},{0xb1,0x64,0x27,0x96,0x5e,0x3a}, 198 {0xb7,0x61,0x3c,0x8b,0x49,0x28},{0xb5,0x62,0x35,0x80,0x44,0x26}, 199 {0xab,0x73,0x42,0xe9,0x0f,0x7c},{0xa9,0x70,0x4b,0xe2,0x02,0x72}, 200 {0xaf,0x75,0x50,0xff,0x15,0x60},{0xad,0x76,0x59,0xf4,0x18,0x6e}, 201 {0xa3,0x7f,0x66,0xc5,0x3b,0x44},{0xa1,0x7c,0x6f,0xce,0x36,0x4a}, 202 {0xa7,0x79,0x74,0xd3,0x21,0x58},{0xa5,0x7a,0x7d,0xd8,0x2c,0x56}, 203 {0xdb,0x3b,0xa1,0x7a,0x0c,0x37},{0xd9,0x38,0xa8,0x71,0x01,0x39}, 204 {0xdf,0x3d,0xb3,0x6c,0x16,0x2b},{0xdd,0x3e,0xba,0x67,0x1b,0x25}, 205 {0xd3,0x37,0x85,0x56,0x38,0x0f},{0xd1,0x34,0x8c,0x5d,0x35,0x01}, 206 {0xd7,0x31,0x97,0x40,0x22,0x13},{0xd5,0x32,0x9e,0x4b,0x2f,0x1d}, 207 {0xcb,0x23,0xe9,0x22,0x64,0x47},{0xc9,0x20,0xe0,0x29,0x69,0x49}, 208 {0xcf,0x25,0xfb,0x34,0x7e,0x5b},{0xcd,0x26,0xf2,0x3f,0x73,0x55}, 209 {0xc3,0x2f,0xcd,0x0e,0x50,0x7f},{0xc1,0x2c,0xc4,0x05,0x5d,0x71}, 210 {0xc7,0x29,0xdf,0x18,0x4a,0x63},{0xc5,0x2a,0xd6,0x13,0x47,0x6d}, 211 {0xfb,0x0b,0x31,0xca,0xdc,0xd7},{0xf9,0x08,0x38,0xc1,0xd1,0xd9}, 212 {0xff,0x0d,0x23,0xdc,0xc6,0xcb},{0xfd,0x0e,0x2a,0xd7,0xcb,0xc5}, 213 {0xf3,0x07,0x15,0xe6,0xe8,0xef},{0xf1,0x04,0x1c,0xed,0xe5,0xe1}, 214 {0xf7,0x01,0x07,0xf0,0xf2,0xf3},{0xf5,0x02,0x0e,0xfb,0xff,0xfd}, 215 {0xeb,0x13,0x79,0x92,0xb4,0xa7},{0xe9,0x10,0x70,0x99,0xb9,0xa9}, 216 {0xef,0x15,0x6b,0x84,0xae,0xbb},{0xed,0x16,0x62,0x8f,0xa3,0xb5}, 217 {0xe3,0x1f,0x5d,0xbe,0x80,0x9f},{0xe1,0x1c,0x54,0xb5,0x8d,0x91}, 218 {0xe7,0x19,0x4f,0xa8,0x9a,0x83},{0xe5,0x1a,0x46,0xa3,0x97,0x8d} 219 }; 220 221 /*********************** FUNCTION DEFINITIONS ***********************/ 222 // XORs the in and out buffers, storing the result in out. Length is in bytes. 223 void xor_buf(const BYTE in[], BYTE out[], size_t len) 224 { 225 size_t idx; 226 227 for (idx = 0; idx < len; idx++) 228 out[idx] ^= in[idx]; 229 } 230 231 /******************* 232 * AES - CBC 233 *******************/ 234 int aes_encrypt_cbc(const BYTE in[], size_t in_len, BYTE out[], const WORD key[], int keysize, const BYTE iv[]) 235 { 236 BYTE buf_in[AES_BLOCK_SIZE], buf_out[AES_BLOCK_SIZE], iv_buf[AES_BLOCK_SIZE]; 237 int blocks, idx; 238 239 if (in_len % AES_BLOCK_SIZE != 0) 240 return(FALSE); 241 242 blocks = in_len / AES_BLOCK_SIZE; 243 244 memcpy(iv_buf, iv, AES_BLOCK_SIZE); 245 246 for (idx = 0; idx < blocks; idx++) { 247 memcpy(buf_in, &in[idx * AES_BLOCK_SIZE], AES_BLOCK_SIZE); 248 xor_buf(iv_buf, buf_in, AES_BLOCK_SIZE); 249 aes_encrypt(buf_in, buf_out, key, keysize); 250 memcpy(&out[idx * AES_BLOCK_SIZE], buf_out, AES_BLOCK_SIZE); 251 memcpy(iv_buf, buf_out, AES_BLOCK_SIZE); 252 } 253 254 return(TRUE); 255 } 256 257 int aes_encrypt_cbc_mac(const BYTE in[], size_t in_len, BYTE out[], const WORD key[], int keysize, const BYTE iv[]) 258 { 259 BYTE buf_in[AES_BLOCK_SIZE], buf_out[AES_BLOCK_SIZE], iv_buf[AES_BLOCK_SIZE]; 260 int blocks, idx; 261 262 if (in_len % AES_BLOCK_SIZE != 0) 263 return(FALSE); 264 265 blocks = in_len / AES_BLOCK_SIZE; 266 267 memcpy(iv_buf, iv, AES_BLOCK_SIZE); 268 269 for (idx = 0; idx < blocks; idx++) { 270 memcpy(buf_in, &in[idx * AES_BLOCK_SIZE], AES_BLOCK_SIZE); 271 xor_buf(iv_buf, buf_in, AES_BLOCK_SIZE); 272 aes_encrypt(buf_in, buf_out, key, keysize); 273 memcpy(iv_buf, buf_out, AES_BLOCK_SIZE); 274 // Do not output all encrypted blocks. 275 } 276 277 memcpy(out, buf_out, AES_BLOCK_SIZE); // Only output the last block. 278 279 return(TRUE); 280 } 281 282 int aes_decrypt_cbc(const BYTE in[], size_t in_len, BYTE out[], const WORD key[], int keysize, const BYTE iv[]) 283 { 284 BYTE buf_in[AES_BLOCK_SIZE], buf_out[AES_BLOCK_SIZE], iv_buf[AES_BLOCK_SIZE]; 285 int blocks, idx; 286 287 if (in_len % AES_BLOCK_SIZE != 0) 288 return(FALSE); 289 290 blocks = in_len / AES_BLOCK_SIZE; 291 292 memcpy(iv_buf, iv, AES_BLOCK_SIZE); 293 294 for (idx = 0; idx < blocks; idx++) { 295 memcpy(buf_in, &in[idx * AES_BLOCK_SIZE], AES_BLOCK_SIZE); 296 aes_decrypt(buf_in, buf_out, key, keysize); 297 xor_buf(iv_buf, buf_out, AES_BLOCK_SIZE); 298 memcpy(&out[idx * AES_BLOCK_SIZE], buf_out, AES_BLOCK_SIZE); 299 memcpy(iv_buf, buf_in, AES_BLOCK_SIZE); 300 } 301 302 return(TRUE); 303 } 304 305 /******************* 306 * AES - CTR 307 *******************/ 308 void increment_iv(BYTE iv[], int counter_size) 309 { 310 int idx; 311 312 // Use counter_size bytes at the end of the IV as the big-endian integer to increment. 313 for (idx = AES_BLOCK_SIZE - 1; idx >= AES_BLOCK_SIZE - counter_size; idx--) { 314 iv[idx]++; 315 if (iv[idx] != 0 || idx == AES_BLOCK_SIZE - counter_size) 316 break; 317 } 318 } 319 320 // Performs the encryption in-place, the input and output buffers may be the same. 321 // Input may be an arbitrary length (in bytes). 322 void aes_encrypt_ctr(const BYTE in[], size_t in_len, BYTE out[], const WORD key[], int keysize, const BYTE iv[]) 323 { 324 size_t idx = 0, last_block_length; 325 BYTE iv_buf[AES_BLOCK_SIZE], out_buf[AES_BLOCK_SIZE]; 326 327 if (in != out) 328 memcpy(out, in, in_len); 329 330 memcpy(iv_buf, iv, AES_BLOCK_SIZE); 331 last_block_length = in_len - AES_BLOCK_SIZE; 332 333 if (in_len > AES_BLOCK_SIZE) { 334 for (idx = 0; idx < last_block_length; idx += AES_BLOCK_SIZE) { 335 aes_encrypt(iv_buf, out_buf, key, keysize); 336 xor_buf(out_buf, &out[idx], AES_BLOCK_SIZE); 337 increment_iv(iv_buf, AES_BLOCK_SIZE); 338 } 339 } 340 341 aes_encrypt(iv_buf, out_buf, key, keysize); 342 xor_buf(out_buf, &out[idx], in_len - idx); // Use the Most Significant bytes. 343 } 344 345 void aes_decrypt_ctr(const BYTE in[], size_t in_len, BYTE out[], const WORD key[], int keysize, const BYTE iv[]) 346 { 347 // CTR encryption is its own inverse function. 348 aes_encrypt_ctr(in, in_len, out, key, keysize, iv); 349 } 350 351 /******************* 352 * AES - CCM 353 *******************/ 354 // out_len = payload_len + assoc_len 355 int aes_encrypt_ccm(const BYTE payload[], WORD payload_len, const BYTE assoc[], unsigned short assoc_len, 356 const BYTE nonce[], unsigned short nonce_len, BYTE out[], WORD *out_len, 357 WORD mac_len, const BYTE key_str[], int keysize) 358 { 359 BYTE temp_iv[AES_BLOCK_SIZE], counter[AES_BLOCK_SIZE], mac[16], *buf; 360 int end_of_buf, payload_len_store_size; 361 WORD key[60]; 362 363 if (mac_len != 4 && mac_len != 6 && mac_len != 8 && mac_len != 10 && 364 mac_len != 12 && mac_len != 14 && mac_len != 16) 365 return(FALSE); 366 367 if (nonce_len < 7 || nonce_len > 13) 368 return(FALSE); 369 370 if (assoc_len > 32768 /* = 2^15 */) 371 return(FALSE); 372 373 buf = (BYTE*)malloc(payload_len + assoc_len + 48 /*Round both payload and associated data up a block size and add an extra block.*/); 374 if (! buf) 375 return(FALSE); 376 377 // Prepare the key for usage. 378 aes_key_setup(key_str, key, keysize); 379 380 // Format the first block of the formatted data. 381 payload_len_store_size = AES_BLOCK_SIZE - 1 - nonce_len; 382 ccm_prepare_first_format_blk(buf, assoc_len, payload_len, payload_len_store_size, mac_len, nonce, nonce_len); 383 end_of_buf = AES_BLOCK_SIZE; 384 385 // Format the Associated Data, aka, assoc[]. 386 ccm_format_assoc_data(buf, &end_of_buf, assoc, assoc_len); 387 388 // Format the Payload, aka payload[]. 389 ccm_format_payload_data(buf, &end_of_buf, payload, payload_len); 390 391 // Create the first counter block. 392 ccm_prepare_first_ctr_blk(counter, nonce, nonce_len, payload_len_store_size); 393 394 // Perform the CBC operation with an IV of zeros on the formatted buffer to calculate the MAC. 395 memset(temp_iv, 0, AES_BLOCK_SIZE); 396 aes_encrypt_cbc_mac(buf, end_of_buf, mac, key, keysize, temp_iv); 397 398 // Copy the Payload and MAC to the output buffer. 399 memcpy(out, payload, payload_len); 400 memcpy(&out[payload_len], mac, mac_len); 401 402 // Encrypt the Payload with CTR mode with a counter starting at 1. 403 memcpy(temp_iv, counter, AES_BLOCK_SIZE); 404 increment_iv(temp_iv, AES_BLOCK_SIZE - 1 - mac_len); // Last argument is the byte size of the counting portion of the counter block. /*BUG?*/ 405 aes_encrypt_ctr(out, payload_len, out, key, keysize, temp_iv); 406 407 // Encrypt the MAC with CTR mode with a counter starting at 0. 408 aes_encrypt_ctr(&out[payload_len], mac_len, &out[payload_len], key, keysize, counter); 409 410 free(buf); 411 *out_len = payload_len + mac_len; 412 413 return(TRUE); 414 } 415 416 // plaintext_len = ciphertext_len - mac_len 417 // Needs a flag for whether the MAC matches. 418 int aes_decrypt_ccm(const BYTE ciphertext[], WORD ciphertext_len, const BYTE assoc[], unsigned short assoc_len, 419 const BYTE nonce[], unsigned short nonce_len, BYTE plaintext[], WORD *plaintext_len, 420 WORD mac_len, int *mac_auth, const BYTE key_str[], int keysize) 421 { 422 BYTE temp_iv[AES_BLOCK_SIZE], counter[AES_BLOCK_SIZE], mac[16], mac_buf[16], *buf; 423 int end_of_buf, plaintext_len_store_size; 424 WORD key[60]; 425 426 if (ciphertext_len <= mac_len) 427 return(FALSE); 428 429 buf = (BYTE*)malloc(assoc_len + ciphertext_len /*ciphertext_len = plaintext_len + mac_len*/ + 48); 430 if (! buf) 431 return(FALSE); 432 433 // Prepare the key for usage. 434 aes_key_setup(key_str, key, keysize); 435 436 // Copy the plaintext and MAC to the output buffers. 437 *plaintext_len = ciphertext_len - mac_len; 438 plaintext_len_store_size = AES_BLOCK_SIZE - 1 - nonce_len; 439 memcpy(plaintext, ciphertext, *plaintext_len); 440 memcpy(mac, &ciphertext[*plaintext_len], mac_len); 441 442 // Prepare the first counter block for use in decryption. 443 ccm_prepare_first_ctr_blk(counter, nonce, nonce_len, plaintext_len_store_size); 444 445 // Decrypt the Payload with CTR mode with a counter starting at 1. 446 memcpy(temp_iv, counter, AES_BLOCK_SIZE); 447 increment_iv(temp_iv, AES_BLOCK_SIZE - 1 - mac_len); // (AES_BLOCK_SIZE - 1 - mac_len) is the byte size of the counting portion of the counter block. 448 aes_decrypt_ctr(plaintext, *plaintext_len, plaintext, key, keysize, temp_iv); 449 450 // Setting mac_auth to NULL disables the authentication check. 451 if (mac_auth != NULL) { 452 // Decrypt the MAC with CTR mode with a counter starting at 0. 453 aes_decrypt_ctr(mac, mac_len, mac, key, keysize, counter); 454 455 // Format the first block of the formatted data. 456 plaintext_len_store_size = AES_BLOCK_SIZE - 1 - nonce_len; 457 ccm_prepare_first_format_blk(buf, assoc_len, *plaintext_len, plaintext_len_store_size, mac_len, nonce, nonce_len); 458 end_of_buf = AES_BLOCK_SIZE; 459 460 // Format the Associated Data into the authentication buffer. 461 ccm_format_assoc_data(buf, &end_of_buf, assoc, assoc_len); 462 463 // Format the Payload into the authentication buffer. 464 ccm_format_payload_data(buf, &end_of_buf, plaintext, *plaintext_len); 465 466 // Perform the CBC operation with an IV of zeros on the formatted buffer to calculate the MAC. 467 memset(temp_iv, 0, AES_BLOCK_SIZE); 468 aes_encrypt_cbc_mac(buf, end_of_buf, mac_buf, key, keysize, temp_iv); 469 470 // Compare the calculated MAC against the MAC embedded in the ciphertext to see if they are the same. 471 if (! memcmp(mac, mac_buf, mac_len)) { 472 *mac_auth = TRUE; 473 } 474 else { 475 *mac_auth = FALSE; 476 memset(plaintext, 0, *plaintext_len); 477 } 478 } 479 480 free(buf); 481 482 return(TRUE); 483 } 484 485 // Creates the first counter block. First byte is flags, then the nonce, then the incremented part. 486 void ccm_prepare_first_ctr_blk(BYTE counter[], const BYTE nonce[], int nonce_len, int payload_len_store_size) 487 { 488 memset(counter, 0, AES_BLOCK_SIZE); 489 counter[0] = (payload_len_store_size - 1) & 0x07; 490 memcpy(&counter[1], nonce, nonce_len); 491 } 492 493 void ccm_prepare_first_format_blk(BYTE buf[], int assoc_len, int payload_len, int payload_len_store_size, int mac_len, const BYTE nonce[], int nonce_len) 494 { 495 // Set the flags for the first byte of the first block. 496 buf[0] = ((((mac_len - 2) / 2) & 0x07) << 3) | ((payload_len_store_size - 1) & 0x07); 497 if (assoc_len > 0) 498 buf[0] += 0x40; 499 // Format the rest of the first block, storing the nonce and the size of the payload. 500 memcpy(&buf[1], nonce, nonce_len); 501 memset(&buf[1 + nonce_len], 0, AES_BLOCK_SIZE - 1 - nonce_len); 502 buf[15] = payload_len & 0x000000FF; 503 buf[14] = (payload_len >> 8) & 0x000000FF; 504 } 505 506 void ccm_format_assoc_data(BYTE buf[], int *end_of_buf, const BYTE assoc[], int assoc_len) 507 { 508 int pad; 509 510 buf[*end_of_buf + 1] = assoc_len & 0x00FF; 511 buf[*end_of_buf] = (assoc_len >> 8) & 0x00FF; 512 *end_of_buf += 2; 513 memcpy(&buf[*end_of_buf], assoc, assoc_len); 514 *end_of_buf += assoc_len; 515 pad = AES_BLOCK_SIZE - (*end_of_buf % AES_BLOCK_SIZE); /*BUG?*/ 516 memset(&buf[*end_of_buf], 0, pad); 517 *end_of_buf += pad; 518 } 519 520 void ccm_format_payload_data(BYTE buf[], int *end_of_buf, const BYTE payload[], int payload_len) 521 { 522 int pad; 523 524 memcpy(&buf[*end_of_buf], payload, payload_len); 525 *end_of_buf += payload_len; 526 pad = *end_of_buf % AES_BLOCK_SIZE; 527 if (pad != 0) 528 pad = AES_BLOCK_SIZE - pad; 529 memset(&buf[*end_of_buf], 0, pad); 530 *end_of_buf += pad; 531 } 532 533 /******************* 534 * AES 535 *******************/ 536 ///////////////// 537 // KEY EXPANSION 538 ///////////////// 539 540 // Substitutes a word using the AES S-Box. 541 WORD SubWord(WORD word) 542 { 543 unsigned int result; 544 545 result = (int)aes_sbox[(word >> 4) & 0x0000000F][word & 0x0000000F]; 546 result += (int)aes_sbox[(word >> 12) & 0x0000000F][(word >> 8) & 0x0000000F] << 8; 547 result += (int)aes_sbox[(word >> 20) & 0x0000000F][(word >> 16) & 0x0000000F] << 16; 548 result += (int)aes_sbox[(word >> 28) & 0x0000000F][(word >> 24) & 0x0000000F] << 24; 549 return(result); 550 } 551 552 // Performs the action of generating the keys that will be used in every round of 553 // encryption. "key" is the user-supplied input key, "w" is the output key schedule, 554 // "keysize" is the length in bits of "key", must be 128, 192, or 256. 555 void aes_key_setup(const BYTE key[], WORD w[], int keysize) 556 { 557 int Nb=4,Nr,Nk,idx; 558 WORD temp,Rcon[]={0x01000000,0x02000000,0x04000000,0x08000000,0x10000000,0x20000000, 559 0x40000000,0x80000000,0x1b000000,0x36000000,0x6c000000,0xd8000000, 560 0xab000000,0x4d000000,0x9a000000}; 561 562 switch (keysize) { 563 case 128: Nr = 10; Nk = 4; break; 564 case 192: Nr = 12; Nk = 6; break; 565 case 256: Nr = 14; Nk = 8; break; 566 default: return; 567 } 568 569 for (idx=0; idx < Nk; ++idx) { 570 w[idx] = ((key[4 * idx]) << 24) | ((key[4 * idx + 1]) << 16) | 571 ((key[4 * idx + 2]) << 8) | ((key[4 * idx + 3])); 572 } 573 574 for (idx = Nk; idx < Nb * (Nr+1); ++idx) { 575 temp = w[idx - 1]; 576 if ((idx % Nk) == 0) 577 temp = SubWord(KE_ROTWORD(temp)) ^ Rcon[(idx-1)/Nk]; 578 else if (Nk > 6 && (idx % Nk) == 4) 579 temp = SubWord(temp); 580 w[idx] = w[idx-Nk] ^ temp; 581 } 582 } 583 584 ///////////////// 585 // ADD ROUND KEY 586 ///////////////// 587 588 // Performs the AddRoundKey step. Each round has its own pre-generated 16-byte key in the 589 // form of 4 integers (the "w" array). Each integer is XOR'd by one column of the state. 590 // Also performs the job of InvAddRoundKey(); since the function is a simple XOR process, 591 // it is its own inverse. 592 void AddRoundKey(BYTE state[][4], const WORD w[]) 593 { 594 BYTE subkey[4]; 595 596 // memcpy(subkey,&w[idx],4); // Not accurate for big endian machines 597 // Subkey 1 598 subkey[0] = w[0] >> 24; 599 subkey[1] = w[0] >> 16; 600 subkey[2] = w[0] >> 8; 601 subkey[3] = w[0]; 602 state[0][0] ^= subkey[0]; 603 state[1][0] ^= subkey[1]; 604 state[2][0] ^= subkey[2]; 605 state[3][0] ^= subkey[3]; 606 // Subkey 2 607 subkey[0] = w[1] >> 24; 608 subkey[1] = w[1] >> 16; 609 subkey[2] = w[1] >> 8; 610 subkey[3] = w[1]; 611 state[0][1] ^= subkey[0]; 612 state[1][1] ^= subkey[1]; 613 state[2][1] ^= subkey[2]; 614 state[3][1] ^= subkey[3]; 615 // Subkey 3 616 subkey[0] = w[2] >> 24; 617 subkey[1] = w[2] >> 16; 618 subkey[2] = w[2] >> 8; 619 subkey[3] = w[2]; 620 state[0][2] ^= subkey[0]; 621 state[1][2] ^= subkey[1]; 622 state[2][2] ^= subkey[2]; 623 state[3][2] ^= subkey[3]; 624 // Subkey 4 625 subkey[0] = w[3] >> 24; 626 subkey[1] = w[3] >> 16; 627 subkey[2] = w[3] >> 8; 628 subkey[3] = w[3]; 629 state[0][3] ^= subkey[0]; 630 state[1][3] ^= subkey[1]; 631 state[2][3] ^= subkey[2]; 632 state[3][3] ^= subkey[3]; 633 } 634 635 ///////////////// 636 // (Inv)SubBytes 637 ///////////////// 638 639 // Performs the SubBytes step. All bytes in the state are substituted with a 640 // pre-calculated value from a lookup table. 641 void SubBytes(BYTE state[][4]) 642 { 643 state[0][0] = aes_sbox[state[0][0] >> 4][state[0][0] & 0x0F]; 644 state[0][1] = aes_sbox[state[0][1] >> 4][state[0][1] & 0x0F]; 645 state[0][2] = aes_sbox[state[0][2] >> 4][state[0][2] & 0x0F]; 646 state[0][3] = aes_sbox[state[0][3] >> 4][state[0][3] & 0x0F]; 647 state[1][0] = aes_sbox[state[1][0] >> 4][state[1][0] & 0x0F]; 648 state[1][1] = aes_sbox[state[1][1] >> 4][state[1][1] & 0x0F]; 649 state[1][2] = aes_sbox[state[1][2] >> 4][state[1][2] & 0x0F]; 650 state[1][3] = aes_sbox[state[1][3] >> 4][state[1][3] & 0x0F]; 651 state[2][0] = aes_sbox[state[2][0] >> 4][state[2][0] & 0x0F]; 652 state[2][1] = aes_sbox[state[2][1] >> 4][state[2][1] & 0x0F]; 653 state[2][2] = aes_sbox[state[2][2] >> 4][state[2][2] & 0x0F]; 654 state[2][3] = aes_sbox[state[2][3] >> 4][state[2][3] & 0x0F]; 655 state[3][0] = aes_sbox[state[3][0] >> 4][state[3][0] & 0x0F]; 656 state[3][1] = aes_sbox[state[3][1] >> 4][state[3][1] & 0x0F]; 657 state[3][2] = aes_sbox[state[3][2] >> 4][state[3][2] & 0x0F]; 658 state[3][3] = aes_sbox[state[3][3] >> 4][state[3][3] & 0x0F]; 659 } 660 661 void InvSubBytes(BYTE state[][4]) 662 { 663 state[0][0] = aes_invsbox[state[0][0] >> 4][state[0][0] & 0x0F]; 664 state[0][1] = aes_invsbox[state[0][1] >> 4][state[0][1] & 0x0F]; 665 state[0][2] = aes_invsbox[state[0][2] >> 4][state[0][2] & 0x0F]; 666 state[0][3] = aes_invsbox[state[0][3] >> 4][state[0][3] & 0x0F]; 667 state[1][0] = aes_invsbox[state[1][0] >> 4][state[1][0] & 0x0F]; 668 state[1][1] = aes_invsbox[state[1][1] >> 4][state[1][1] & 0x0F]; 669 state[1][2] = aes_invsbox[state[1][2] >> 4][state[1][2] & 0x0F]; 670 state[1][3] = aes_invsbox[state[1][3] >> 4][state[1][3] & 0x0F]; 671 state[2][0] = aes_invsbox[state[2][0] >> 4][state[2][0] & 0x0F]; 672 state[2][1] = aes_invsbox[state[2][1] >> 4][state[2][1] & 0x0F]; 673 state[2][2] = aes_invsbox[state[2][2] >> 4][state[2][2] & 0x0F]; 674 state[2][3] = aes_invsbox[state[2][3] >> 4][state[2][3] & 0x0F]; 675 state[3][0] = aes_invsbox[state[3][0] >> 4][state[3][0] & 0x0F]; 676 state[3][1] = aes_invsbox[state[3][1] >> 4][state[3][1] & 0x0F]; 677 state[3][2] = aes_invsbox[state[3][2] >> 4][state[3][2] & 0x0F]; 678 state[3][3] = aes_invsbox[state[3][3] >> 4][state[3][3] & 0x0F]; 679 } 680 681 ///////////////// 682 // (Inv)ShiftRows 683 ///////////////// 684 685 // Performs the ShiftRows step. All rows are shifted cylindrically to the left. 686 void ShiftRows(BYTE state[][4]) 687 { 688 int t; 689 690 // Shift left by 1 691 t = state[1][0]; 692 state[1][0] = state[1][1]; 693 state[1][1] = state[1][2]; 694 state[1][2] = state[1][3]; 695 state[1][3] = t; 696 // Shift left by 2 697 t = state[2][0]; 698 state[2][0] = state[2][2]; 699 state[2][2] = t; 700 t = state[2][1]; 701 state[2][1] = state[2][3]; 702 state[2][3] = t; 703 // Shift left by 3 704 t = state[3][0]; 705 state[3][0] = state[3][3]; 706 state[3][3] = state[3][2]; 707 state[3][2] = state[3][1]; 708 state[3][1] = t; 709 } 710 711 // All rows are shifted cylindrically to the right. 712 void InvShiftRows(BYTE state[][4]) 713 { 714 int t; 715 716 // Shift right by 1 717 t = state[1][3]; 718 state[1][3] = state[1][2]; 719 state[1][2] = state[1][1]; 720 state[1][1] = state[1][0]; 721 state[1][0] = t; 722 // Shift right by 2 723 t = state[2][3]; 724 state[2][3] = state[2][1]; 725 state[2][1] = t; 726 t = state[2][2]; 727 state[2][2] = state[2][0]; 728 state[2][0] = t; 729 // Shift right by 3 730 t = state[3][3]; 731 state[3][3] = state[3][0]; 732 state[3][0] = state[3][1]; 733 state[3][1] = state[3][2]; 734 state[3][2] = t; 735 } 736 737 ///////////////// 738 // (Inv)MixColumns 739 ///////////////// 740 741 // Performs the MixColums step. The state is multiplied by itself using matrix 742 // multiplication in a Galios Field 2^8. All multiplication is pre-computed in a table. 743 // Addition is equivilent to XOR. (Must always make a copy of the column as the original 744 // values will be destoyed.) 745 void MixColumns(BYTE state[][4]) 746 { 747 BYTE col[4]; 748 749 // Column 1 750 col[0] = state[0][0]; 751 col[1] = state[1][0]; 752 col[2] = state[2][0]; 753 col[3] = state[3][0]; 754 state[0][0] = gf_mul[col[0]][0]; 755 state[0][0] ^= gf_mul[col[1]][1]; 756 state[0][0] ^= col[2]; 757 state[0][0] ^= col[3]; 758 state[1][0] = col[0]; 759 state[1][0] ^= gf_mul[col[1]][0]; 760 state[1][0] ^= gf_mul[col[2]][1]; 761 state[1][0] ^= col[3]; 762 state[2][0] = col[0]; 763 state[2][0] ^= col[1]; 764 state[2][0] ^= gf_mul[col[2]][0]; 765 state[2][0] ^= gf_mul[col[3]][1]; 766 state[3][0] = gf_mul[col[0]][1]; 767 state[3][0] ^= col[1]; 768 state[3][0] ^= col[2]; 769 state[3][0] ^= gf_mul[col[3]][0]; 770 // Column 2 771 col[0] = state[0][1]; 772 col[1] = state[1][1]; 773 col[2] = state[2][1]; 774 col[3] = state[3][1]; 775 state[0][1] = gf_mul[col[0]][0]; 776 state[0][1] ^= gf_mul[col[1]][1]; 777 state[0][1] ^= col[2]; 778 state[0][1] ^= col[3]; 779 state[1][1] = col[0]; 780 state[1][1] ^= gf_mul[col[1]][0]; 781 state[1][1] ^= gf_mul[col[2]][1]; 782 state[1][1] ^= col[3]; 783 state[2][1] = col[0]; 784 state[2][1] ^= col[1]; 785 state[2][1] ^= gf_mul[col[2]][0]; 786 state[2][1] ^= gf_mul[col[3]][1]; 787 state[3][1] = gf_mul[col[0]][1]; 788 state[3][1] ^= col[1]; 789 state[3][1] ^= col[2]; 790 state[3][1] ^= gf_mul[col[3]][0]; 791 // Column 3 792 col[0] = state[0][2]; 793 col[1] = state[1][2]; 794 col[2] = state[2][2]; 795 col[3] = state[3][2]; 796 state[0][2] = gf_mul[col[0]][0]; 797 state[0][2] ^= gf_mul[col[1]][1]; 798 state[0][2] ^= col[2]; 799 state[0][2] ^= col[3]; 800 state[1][2] = col[0]; 801 state[1][2] ^= gf_mul[col[1]][0]; 802 state[1][2] ^= gf_mul[col[2]][1]; 803 state[1][2] ^= col[3]; 804 state[2][2] = col[0]; 805 state[2][2] ^= col[1]; 806 state[2][2] ^= gf_mul[col[2]][0]; 807 state[2][2] ^= gf_mul[col[3]][1]; 808 state[3][2] = gf_mul[col[0]][1]; 809 state[3][2] ^= col[1]; 810 state[3][2] ^= col[2]; 811 state[3][2] ^= gf_mul[col[3]][0]; 812 // Column 4 813 col[0] = state[0][3]; 814 col[1] = state[1][3]; 815 col[2] = state[2][3]; 816 col[3] = state[3][3]; 817 state[0][3] = gf_mul[col[0]][0]; 818 state[0][3] ^= gf_mul[col[1]][1]; 819 state[0][3] ^= col[2]; 820 state[0][3] ^= col[3]; 821 state[1][3] = col[0]; 822 state[1][3] ^= gf_mul[col[1]][0]; 823 state[1][3] ^= gf_mul[col[2]][1]; 824 state[1][3] ^= col[3]; 825 state[2][3] = col[0]; 826 state[2][3] ^= col[1]; 827 state[2][3] ^= gf_mul[col[2]][0]; 828 state[2][3] ^= gf_mul[col[3]][1]; 829 state[3][3] = gf_mul[col[0]][1]; 830 state[3][3] ^= col[1]; 831 state[3][3] ^= col[2]; 832 state[3][3] ^= gf_mul[col[3]][0]; 833 } 834 835 void InvMixColumns(BYTE state[][4]) 836 { 837 BYTE col[4]; 838 839 // Column 1 840 col[0] = state[0][0]; 841 col[1] = state[1][0]; 842 col[2] = state[2][0]; 843 col[3] = state[3][0]; 844 state[0][0] = gf_mul[col[0]][5]; 845 state[0][0] ^= gf_mul[col[1]][3]; 846 state[0][0] ^= gf_mul[col[2]][4]; 847 state[0][0] ^= gf_mul[col[3]][2]; 848 state[1][0] = gf_mul[col[0]][2]; 849 state[1][0] ^= gf_mul[col[1]][5]; 850 state[1][0] ^= gf_mul[col[2]][3]; 851 state[1][0] ^= gf_mul[col[3]][4]; 852 state[2][0] = gf_mul[col[0]][4]; 853 state[2][0] ^= gf_mul[col[1]][2]; 854 state[2][0] ^= gf_mul[col[2]][5]; 855 state[2][0] ^= gf_mul[col[3]][3]; 856 state[3][0] = gf_mul[col[0]][3]; 857 state[3][0] ^= gf_mul[col[1]][4]; 858 state[3][0] ^= gf_mul[col[2]][2]; 859 state[3][0] ^= gf_mul[col[3]][5]; 860 // Column 2 861 col[0] = state[0][1]; 862 col[1] = state[1][1]; 863 col[2] = state[2][1]; 864 col[3] = state[3][1]; 865 state[0][1] = gf_mul[col[0]][5]; 866 state[0][1] ^= gf_mul[col[1]][3]; 867 state[0][1] ^= gf_mul[col[2]][4]; 868 state[0][1] ^= gf_mul[col[3]][2]; 869 state[1][1] = gf_mul[col[0]][2]; 870 state[1][1] ^= gf_mul[col[1]][5]; 871 state[1][1] ^= gf_mul[col[2]][3]; 872 state[1][1] ^= gf_mul[col[3]][4]; 873 state[2][1] = gf_mul[col[0]][4]; 874 state[2][1] ^= gf_mul[col[1]][2]; 875 state[2][1] ^= gf_mul[col[2]][5]; 876 state[2][1] ^= gf_mul[col[3]][3]; 877 state[3][1] = gf_mul[col[0]][3]; 878 state[3][1] ^= gf_mul[col[1]][4]; 879 state[3][1] ^= gf_mul[col[2]][2]; 880 state[3][1] ^= gf_mul[col[3]][5]; 881 // Column 3 882 col[0] = state[0][2]; 883 col[1] = state[1][2]; 884 col[2] = state[2][2]; 885 col[3] = state[3][2]; 886 state[0][2] = gf_mul[col[0]][5]; 887 state[0][2] ^= gf_mul[col[1]][3]; 888 state[0][2] ^= gf_mul[col[2]][4]; 889 state[0][2] ^= gf_mul[col[3]][2]; 890 state[1][2] = gf_mul[col[0]][2]; 891 state[1][2] ^= gf_mul[col[1]][5]; 892 state[1][2] ^= gf_mul[col[2]][3]; 893 state[1][2] ^= gf_mul[col[3]][4]; 894 state[2][2] = gf_mul[col[0]][4]; 895 state[2][2] ^= gf_mul[col[1]][2]; 896 state[2][2] ^= gf_mul[col[2]][5]; 897 state[2][2] ^= gf_mul[col[3]][3]; 898 state[3][2] = gf_mul[col[0]][3]; 899 state[3][2] ^= gf_mul[col[1]][4]; 900 state[3][2] ^= gf_mul[col[2]][2]; 901 state[3][2] ^= gf_mul[col[3]][5]; 902 // Column 4 903 col[0] = state[0][3]; 904 col[1] = state[1][3]; 905 col[2] = state[2][3]; 906 col[3] = state[3][3]; 907 state[0][3] = gf_mul[col[0]][5]; 908 state[0][3] ^= gf_mul[col[1]][3]; 909 state[0][3] ^= gf_mul[col[2]][4]; 910 state[0][3] ^= gf_mul[col[3]][2]; 911 state[1][3] = gf_mul[col[0]][2]; 912 state[1][3] ^= gf_mul[col[1]][5]; 913 state[1][3] ^= gf_mul[col[2]][3]; 914 state[1][3] ^= gf_mul[col[3]][4]; 915 state[2][3] = gf_mul[col[0]][4]; 916 state[2][3] ^= gf_mul[col[1]][2]; 917 state[2][3] ^= gf_mul[col[2]][5]; 918 state[2][3] ^= gf_mul[col[3]][3]; 919 state[3][3] = gf_mul[col[0]][3]; 920 state[3][3] ^= gf_mul[col[1]][4]; 921 state[3][3] ^= gf_mul[col[2]][2]; 922 state[3][3] ^= gf_mul[col[3]][5]; 923 } 924 925 ///////////////// 926 // (En/De)Crypt 927 ///////////////// 928 929 void aes_encrypt(const BYTE in[], BYTE out[], const WORD key[], int keysize) 930 { 931 BYTE state[4][4]; 932 933 // Copy input array (should be 16 bytes long) to a matrix (sequential bytes are ordered 934 // by row, not col) called "state" for processing. 935 // *** Implementation note: The official AES documentation references the state by 936 // column, then row. Accessing an element in C requires row then column. Thus, all state 937 // references in AES must have the column and row indexes reversed for C implementation. 938 state[0][0] = in[0]; 939 state[1][0] = in[1]; 940 state[2][0] = in[2]; 941 state[3][0] = in[3]; 942 state[0][1] = in[4]; 943 state[1][1] = in[5]; 944 state[2][1] = in[6]; 945 state[3][1] = in[7]; 946 state[0][2] = in[8]; 947 state[1][2] = in[9]; 948 state[2][2] = in[10]; 949 state[3][2] = in[11]; 950 state[0][3] = in[12]; 951 state[1][3] = in[13]; 952 state[2][3] = in[14]; 953 state[3][3] = in[15]; 954 955 // Perform the necessary number of rounds. The round key is added first. 956 // The last round does not perform the MixColumns step. 957 AddRoundKey(state,&key[0]); 958 SubBytes(state); ShiftRows(state); MixColumns(state); AddRoundKey(state,&key[4]); 959 SubBytes(state); ShiftRows(state); MixColumns(state); AddRoundKey(state,&key[8]); 960 SubBytes(state); ShiftRows(state); MixColumns(state); AddRoundKey(state,&key[12]); 961 SubBytes(state); ShiftRows(state); MixColumns(state); AddRoundKey(state,&key[16]); 962 SubBytes(state); ShiftRows(state); MixColumns(state); AddRoundKey(state,&key[20]); 963 SubBytes(state); ShiftRows(state); MixColumns(state); AddRoundKey(state,&key[24]); 964 SubBytes(state); ShiftRows(state); MixColumns(state); AddRoundKey(state,&key[28]); 965 SubBytes(state); ShiftRows(state); MixColumns(state); AddRoundKey(state,&key[32]); 966 SubBytes(state); ShiftRows(state); MixColumns(state); AddRoundKey(state,&key[36]); 967 if (keysize != 128) { 968 SubBytes(state); ShiftRows(state); MixColumns(state); AddRoundKey(state,&key[40]); 969 SubBytes(state); ShiftRows(state); MixColumns(state); AddRoundKey(state,&key[44]); 970 if (keysize != 192) { 971 SubBytes(state); ShiftRows(state); MixColumns(state); AddRoundKey(state,&key[48]); 972 SubBytes(state); ShiftRows(state); MixColumns(state); AddRoundKey(state,&key[52]); 973 SubBytes(state); ShiftRows(state); AddRoundKey(state,&key[56]); 974 } 975 else { 976 SubBytes(state); ShiftRows(state); AddRoundKey(state,&key[48]); 977 } 978 } 979 else { 980 SubBytes(state); ShiftRows(state); AddRoundKey(state,&key[40]); 981 } 982 983 // Copy the state to the output array. 984 out[0] = state[0][0]; 985 out[1] = state[1][0]; 986 out[2] = state[2][0]; 987 out[3] = state[3][0]; 988 out[4] = state[0][1]; 989 out[5] = state[1][1]; 990 out[6] = state[2][1]; 991 out[7] = state[3][1]; 992 out[8] = state[0][2]; 993 out[9] = state[1][2]; 994 out[10] = state[2][2]; 995 out[11] = state[3][2]; 996 out[12] = state[0][3]; 997 out[13] = state[1][3]; 998 out[14] = state[2][3]; 999 out[15] = state[3][3]; 1000 } 1001 1002 void aes_decrypt(const BYTE in[], BYTE out[], const WORD key[], int keysize) 1003 { 1004 BYTE state[4][4]; 1005 1006 // Copy the input to the state. 1007 state[0][0] = in[0]; 1008 state[1][0] = in[1]; 1009 state[2][0] = in[2]; 1010 state[3][0] = in[3]; 1011 state[0][1] = in[4]; 1012 state[1][1] = in[5]; 1013 state[2][1] = in[6]; 1014 state[3][1] = in[7]; 1015 state[0][2] = in[8]; 1016 state[1][2] = in[9]; 1017 state[2][2] = in[10]; 1018 state[3][2] = in[11]; 1019 state[0][3] = in[12]; 1020 state[1][3] = in[13]; 1021 state[2][3] = in[14]; 1022 state[3][3] = in[15]; 1023 1024 // Perform the necessary number of rounds. The round key is added first. 1025 // The last round does not perform the MixColumns step. 1026 if (keysize > 128) { 1027 if (keysize > 192) { 1028 AddRoundKey(state,&key[56]); 1029 InvShiftRows(state);InvSubBytes(state);AddRoundKey(state,&key[52]);InvMixColumns(state); 1030 InvShiftRows(state);InvSubBytes(state);AddRoundKey(state,&key[48]);InvMixColumns(state); 1031 } 1032 else { 1033 AddRoundKey(state,&key[48]); 1034 } 1035 InvShiftRows(state);InvSubBytes(state);AddRoundKey(state,&key[44]);InvMixColumns(state); 1036 InvShiftRows(state);InvSubBytes(state);AddRoundKey(state,&key[40]);InvMixColumns(state); 1037 } 1038 else { 1039 AddRoundKey(state,&key[40]); 1040 } 1041 InvShiftRows(state);InvSubBytes(state);AddRoundKey(state,&key[36]);InvMixColumns(state); 1042 InvShiftRows(state);InvSubBytes(state);AddRoundKey(state,&key[32]);InvMixColumns(state); 1043 InvShiftRows(state);InvSubBytes(state);AddRoundKey(state,&key[28]);InvMixColumns(state); 1044 InvShiftRows(state);InvSubBytes(state);AddRoundKey(state,&key[24]);InvMixColumns(state); 1045 InvShiftRows(state);InvSubBytes(state);AddRoundKey(state,&key[20]);InvMixColumns(state); 1046 InvShiftRows(state);InvSubBytes(state);AddRoundKey(state,&key[16]);InvMixColumns(state); 1047 InvShiftRows(state);InvSubBytes(state);AddRoundKey(state,&key[12]);InvMixColumns(state); 1048 InvShiftRows(state);InvSubBytes(state);AddRoundKey(state,&key[8]);InvMixColumns(state); 1049 InvShiftRows(state);InvSubBytes(state);AddRoundKey(state,&key[4]);InvMixColumns(state); 1050 InvShiftRows(state);InvSubBytes(state);AddRoundKey(state,&key[0]); 1051 1052 // Copy the state to the output array. 1053 out[0] = state[0][0]; 1054 out[1] = state[1][0]; 1055 out[2] = state[2][0]; 1056 out[3] = state[3][0]; 1057 out[4] = state[0][1]; 1058 out[5] = state[1][1]; 1059 out[6] = state[2][1]; 1060 out[7] = state[3][1]; 1061 out[8] = state[0][2]; 1062 out[9] = state[1][2]; 1063 out[10] = state[2][2]; 1064 out[11] = state[3][2]; 1065 out[12] = state[0][3]; 1066 out[13] = state[1][3]; 1067 out[14] = state[2][3]; 1068 out[15] = state[3][3]; 1069 } 1070 1071 /******************* 1072 ** AES DEBUGGING FUNCTIONS 1073 *******************/ 1074 /* 1075 // This prints the "state" grid as a linear hex string. 1076 void print_state(BYTE state[][4]) 1077 { 1078 int idx,idx2; 1079 1080 for (idx=0; idx < 4; idx++) 1081 for (idx2=0; idx2 < 4; idx2++) 1082 printf("%02x",state[idx2][idx]); 1083 printf("\n"); 1084 } 1085 1086 // This prints the key (4 consecutive ints) used for a given round as a linear hex string. 1087 void print_rnd_key(WORD key[]) 1088 { 1089 int idx; 1090 1091 for (idx=0; idx < 4; idx++) 1092 printf("%08x",key[idx]); 1093 printf("\n"); 1094 } 1095 */