1 /* $KAME: rijndael-api-fst.c,v 1.10 2001/05/27 09:34:18 itojun Exp $ */
4 * rijndael-api-fst.c v2.3 April '2000
6 * Optimised ANSI C code
8 * authors: v1.0: Antoon Bosselaers
10 * v2.1: Vincent Rijmen
11 * v2.2: Vincent Rijmen
13 * v2.4: Vincent Rijmen
15 * This code is placed in the public domain.
18 #include <sys/cdefs.h>
19 __FBSDID("$FreeBSD$");
21 #include <sys/param.h>
23 #include <sys/systm.h>
28 #include <crypto/rijndael/rijndael_local.h>
29 #include <crypto/rijndael/rijndael-api-fst.h>
37 int rijndael_makeKey(keyInstance *key, BYTE direction, int keyLen,
38 const char *keyMaterial) {
41 return BAD_KEY_INSTANCE;
44 if ((direction == DIR_ENCRYPT) || (direction == DIR_DECRYPT)) {
45 key->direction = direction;
50 if ((keyLen == 128) || (keyLen == 192) || (keyLen == 256)) {
56 if (keyMaterial != NULL) {
57 memcpy(key->keyMaterial, keyMaterial, keyLen/8);
60 /* initialize key schedule: */
61 if (direction == DIR_ENCRYPT) {
62 key->Nr = rijndaelKeySetupEnc(key->rk, key->keyMaterial, keyLen);
64 key->Nr = rijndaelKeySetupDec(key->rk, key->keyMaterial, keyLen);
66 rijndaelKeySetupEnc(key->ek, key->keyMaterial, keyLen);
70 int rijndael_cipherInit(cipherInstance *cipher, BYTE mode, char *IV) {
71 if ((mode == MODE_ECB) || (mode == MODE_CBC) || (mode == MODE_CFB1)) {
74 return BAD_CIPHER_MODE;
77 memcpy(cipher->IV, IV, RIJNDAEL_MAX_IV_SIZE);
79 memset(cipher->IV, 0, RIJNDAEL_MAX_IV_SIZE);
84 int rijndael_blockEncrypt(cipherInstance *cipher, keyInstance *key,
85 const BYTE *input, int inputLen, BYTE *outBuffer) {
87 uint8_t block[16], iv[4][4];
91 key->direction == DIR_DECRYPT) {
92 return BAD_CIPHER_STATE;
94 if (input == NULL || inputLen <= 0) {
95 return 0; /* nothing to do */
98 numBlocks = inputLen/128;
100 switch (cipher->mode) {
102 for (i = numBlocks; i > 0; i--) {
103 rijndaelEncrypt(key->rk, key->Nr, input, outBuffer);
110 #if 1 /*STRICT_ALIGN*/
111 memcpy(block, cipher->IV, 16);
112 memcpy(iv, input, 16);
113 ((uint32_t*)block)[0] ^= ((uint32_t*)iv)[0];
114 ((uint32_t*)block)[1] ^= ((uint32_t*)iv)[1];
115 ((uint32_t*)block)[2] ^= ((uint32_t*)iv)[2];
116 ((uint32_t*)block)[3] ^= ((uint32_t*)iv)[3];
118 ((uint32_t*)block)[0] = ((uint32_t*)cipher->IV)[0] ^ ((uint32_t*)input)[0];
119 ((uint32_t*)block)[1] = ((uint32_t*)cipher->IV)[1] ^ ((uint32_t*)input)[1];
120 ((uint32_t*)block)[2] = ((uint32_t*)cipher->IV)[2] ^ ((uint32_t*)input)[2];
121 ((uint32_t*)block)[3] = ((uint32_t*)cipher->IV)[3] ^ ((uint32_t*)input)[3];
123 rijndaelEncrypt(key->rk, key->Nr, block, outBuffer);
125 for (i = numBlocks - 1; i > 0; i--) {
126 #if 1 /*STRICT_ALIGN*/
127 memcpy(block, outBuffer, 16);
128 memcpy(iv, input, 16);
129 ((uint32_t*)block)[0] ^= ((uint32_t*)iv)[0];
130 ((uint32_t*)block)[1] ^= ((uint32_t*)iv)[1];
131 ((uint32_t*)block)[2] ^= ((uint32_t*)iv)[2];
132 ((uint32_t*)block)[3] ^= ((uint32_t*)iv)[3];
134 ((uint32_t*)block)[0] = ((uint32_t*)outBuffer)[0] ^ ((uint32_t*)input)[0];
135 ((uint32_t*)block)[1] = ((uint32_t*)outBuffer)[1] ^ ((uint32_t*)input)[1];
136 ((uint32_t*)block)[2] = ((uint32_t*)outBuffer)[2] ^ ((uint32_t*)input)[2];
137 ((uint32_t*)block)[3] = ((uint32_t*)outBuffer)[3] ^ ((uint32_t*)input)[3];
140 rijndaelEncrypt(key->rk, key->Nr, block, outBuffer);
146 #if 1 /*STRICT_ALIGN*/
147 memcpy(iv, cipher->IV, 16);
148 #else /* !STRICT_ALIGN */
149 *((uint32_t*)iv[0]) = *((uint32_t*)(cipher->IV ));
150 *((uint32_t*)iv[1]) = *((uint32_t*)(cipher->IV+ 4));
151 *((uint32_t*)iv[2]) = *((uint32_t*)(cipher->IV+ 8));
152 *((uint32_t*)iv[3]) = *((uint32_t*)(cipher->IV+12));
153 #endif /* ?STRICT_ALIGN */
154 for (i = numBlocks; i > 0; i--) {
155 for (k = 0; k < 128; k++) {
156 *((uint32_t*) block ) = *((uint32_t*)iv[0]);
157 *((uint32_t*)(block+ 4)) = *((uint32_t*)iv[1]);
158 *((uint32_t*)(block+ 8)) = *((uint32_t*)iv[2]);
159 *((uint32_t*)(block+12)) = *((uint32_t*)iv[3]);
160 rijndaelEncrypt(key->ek, key->Nr, block,
162 outBuffer[k/8] ^= (block[0] & 0x80) >> (k & 7);
163 iv[0][0] = (iv[0][0] << 1) | (iv[0][1] >> 7);
164 iv[0][1] = (iv[0][1] << 1) | (iv[0][2] >> 7);
165 iv[0][2] = (iv[0][2] << 1) | (iv[0][3] >> 7);
166 iv[0][3] = (iv[0][3] << 1) | (iv[1][0] >> 7);
167 iv[1][0] = (iv[1][0] << 1) | (iv[1][1] >> 7);
168 iv[1][1] = (iv[1][1] << 1) | (iv[1][2] >> 7);
169 iv[1][2] = (iv[1][2] << 1) | (iv[1][3] >> 7);
170 iv[1][3] = (iv[1][3] << 1) | (iv[2][0] >> 7);
171 iv[2][0] = (iv[2][0] << 1) | (iv[2][1] >> 7);
172 iv[2][1] = (iv[2][1] << 1) | (iv[2][2] >> 7);
173 iv[2][2] = (iv[2][2] << 1) | (iv[2][3] >> 7);
174 iv[2][3] = (iv[2][3] << 1) | (iv[3][0] >> 7);
175 iv[3][0] = (iv[3][0] << 1) | (iv[3][1] >> 7);
176 iv[3][1] = (iv[3][1] << 1) | (iv[3][2] >> 7);
177 iv[3][2] = (iv[3][2] << 1) | (iv[3][3] >> 7);
178 iv[3][3] = (iv[3][3] << 1) | ((outBuffer[k/8] >> (7-(k&7))) & 1);
184 return BAD_CIPHER_STATE;
187 explicit_bzero(block, sizeof(block));
188 return 128*numBlocks;
192 * Encrypt data partitioned in octets, using RFC 2040-like padding.
194 * @param input data to be encrypted (octet sequence)
195 * @param inputOctets input length in octets (not bits)
196 * @param outBuffer encrypted output data
198 * @return length in octets (not bits) of the encrypted output buffer.
200 int rijndael_padEncrypt(cipherInstance *cipher, keyInstance *key,
201 const BYTE *input, int inputOctets, BYTE *outBuffer) {
202 int i, numBlocks, padLen;
203 uint8_t block[16], *iv, *cp;
205 if (cipher == NULL ||
207 key->direction == DIR_DECRYPT) {
208 return BAD_CIPHER_STATE;
210 if (input == NULL || inputOctets <= 0) {
211 return 0; /* nothing to do */
214 numBlocks = inputOctets/16;
216 switch (cipher->mode) {
218 for (i = numBlocks; i > 0; i--) {
219 rijndaelEncrypt(key->rk, key->Nr, input, outBuffer);
223 padLen = 16 - (inputOctets - 16*numBlocks);
224 if (padLen <= 0 || padLen > 16)
225 return BAD_CIPHER_STATE;
226 memcpy(block, input, 16 - padLen);
227 for (cp = block + 16 - padLen; cp < block + 16; cp++)
229 rijndaelEncrypt(key->rk, key->Nr, block, outBuffer);
234 for (i = numBlocks; i > 0; i--) {
235 ((uint32_t*)block)[0] = ((const uint32_t*)input)[0] ^ ((uint32_t*)iv)[0];
236 ((uint32_t*)block)[1] = ((const uint32_t*)input)[1] ^ ((uint32_t*)iv)[1];
237 ((uint32_t*)block)[2] = ((const uint32_t*)input)[2] ^ ((uint32_t*)iv)[2];
238 ((uint32_t*)block)[3] = ((const uint32_t*)input)[3] ^ ((uint32_t*)iv)[3];
239 rijndaelEncrypt(key->rk, key->Nr, block, outBuffer);
244 padLen = 16 - (inputOctets - 16*numBlocks);
245 if (padLen <= 0 || padLen > 16)
246 return BAD_CIPHER_STATE;
247 for (i = 0; i < 16 - padLen; i++) {
248 block[i] = input[i] ^ iv[i];
250 for (i = 16 - padLen; i < 16; i++) {
251 block[i] = (BYTE)padLen ^ iv[i];
253 rijndaelEncrypt(key->rk, key->Nr, block, outBuffer);
257 return BAD_CIPHER_STATE;
260 explicit_bzero(block, sizeof(block));
261 return 16*(numBlocks + 1);
264 int rijndael_blockDecrypt(cipherInstance *cipher, keyInstance *key,
265 const BYTE *input, int inputLen, BYTE *outBuffer) {
267 uint8_t block[16], iv[4][4];
269 if (cipher == NULL ||
271 (cipher->mode != MODE_CFB1 && key->direction == DIR_ENCRYPT)) {
272 return BAD_CIPHER_STATE;
274 if (input == NULL || inputLen <= 0) {
275 return 0; /* nothing to do */
278 numBlocks = inputLen/128;
280 switch (cipher->mode) {
282 for (i = numBlocks; i > 0; i--) {
283 rijndaelDecrypt(key->rk, key->Nr, input, outBuffer);
290 #if 1 /*STRICT_ALIGN */
291 memcpy(iv, cipher->IV, 16);
293 *((uint32_t*)iv[0]) = *((uint32_t*)(cipher->IV ));
294 *((uint32_t*)iv[1]) = *((uint32_t*)(cipher->IV+ 4));
295 *((uint32_t*)iv[2]) = *((uint32_t*)(cipher->IV+ 8));
296 *((uint32_t*)iv[3]) = *((uint32_t*)(cipher->IV+12));
298 for (i = numBlocks; i > 0; i--) {
299 rijndaelDecrypt(key->rk, key->Nr, input, block);
300 ((uint32_t*)block)[0] ^= *((uint32_t*)iv[0]);
301 ((uint32_t*)block)[1] ^= *((uint32_t*)iv[1]);
302 ((uint32_t*)block)[2] ^= *((uint32_t*)iv[2]);
303 ((uint32_t*)block)[3] ^= *((uint32_t*)iv[3]);
304 #if 1 /*STRICT_ALIGN*/
305 memcpy(iv, input, 16);
306 memcpy(outBuffer, block, 16);
308 *((uint32_t*)iv[0]) = ((uint32_t*)input)[0]; ((uint32_t*)outBuffer)[0] = ((uint32_t*)block)[0];
309 *((uint32_t*)iv[1]) = ((uint32_t*)input)[1]; ((uint32_t*)outBuffer)[1] = ((uint32_t*)block)[1];
310 *((uint32_t*)iv[2]) = ((uint32_t*)input)[2]; ((uint32_t*)outBuffer)[2] = ((uint32_t*)block)[2];
311 *((uint32_t*)iv[3]) = ((uint32_t*)input)[3]; ((uint32_t*)outBuffer)[3] = ((uint32_t*)block)[3];
319 #if 1 /*STRICT_ALIGN */
320 memcpy(iv, cipher->IV, 16);
322 *((uint32_t*)iv[0]) = *((uint32_t*)(cipher->IV));
323 *((uint32_t*)iv[1]) = *((uint32_t*)(cipher->IV+ 4));
324 *((uint32_t*)iv[2]) = *((uint32_t*)(cipher->IV+ 8));
325 *((uint32_t*)iv[3]) = *((uint32_t*)(cipher->IV+12));
327 for (i = numBlocks; i > 0; i--) {
328 for (k = 0; k < 128; k++) {
329 *((uint32_t*) block ) = *((uint32_t*)iv[0]);
330 *((uint32_t*)(block+ 4)) = *((uint32_t*)iv[1]);
331 *((uint32_t*)(block+ 8)) = *((uint32_t*)iv[2]);
332 *((uint32_t*)(block+12)) = *((uint32_t*)iv[3]);
333 rijndaelEncrypt(key->ek, key->Nr, block,
335 iv[0][0] = (iv[0][0] << 1) | (iv[0][1] >> 7);
336 iv[0][1] = (iv[0][1] << 1) | (iv[0][2] >> 7);
337 iv[0][2] = (iv[0][2] << 1) | (iv[0][3] >> 7);
338 iv[0][3] = (iv[0][3] << 1) | (iv[1][0] >> 7);
339 iv[1][0] = (iv[1][0] << 1) | (iv[1][1] >> 7);
340 iv[1][1] = (iv[1][1] << 1) | (iv[1][2] >> 7);
341 iv[1][2] = (iv[1][2] << 1) | (iv[1][3] >> 7);
342 iv[1][3] = (iv[1][3] << 1) | (iv[2][0] >> 7);
343 iv[2][0] = (iv[2][0] << 1) | (iv[2][1] >> 7);
344 iv[2][1] = (iv[2][1] << 1) | (iv[2][2] >> 7);
345 iv[2][2] = (iv[2][2] << 1) | (iv[2][3] >> 7);
346 iv[2][3] = (iv[2][3] << 1) | (iv[3][0] >> 7);
347 iv[3][0] = (iv[3][0] << 1) | (iv[3][1] >> 7);
348 iv[3][1] = (iv[3][1] << 1) | (iv[3][2] >> 7);
349 iv[3][2] = (iv[3][2] << 1) | (iv[3][3] >> 7);
350 iv[3][3] = (iv[3][3] << 1) | ((input[k/8] >> (7-(k&7))) & 1);
351 outBuffer[k/8] ^= (block[0] & 0x80) >> (k & 7);
357 return BAD_CIPHER_STATE;
360 explicit_bzero(block, sizeof(block));
361 return 128*numBlocks;
364 int rijndael_padDecrypt(cipherInstance *cipher, keyInstance *key,
365 const BYTE *input, int inputOctets, BYTE *outBuffer) {
366 int i, numBlocks, padLen, rval;
370 if (cipher == NULL ||
372 key->direction == DIR_ENCRYPT) {
373 return BAD_CIPHER_STATE;
375 if (input == NULL || inputOctets <= 0) {
376 return 0; /* nothing to do */
378 if (inputOctets % 16 != 0) {
382 numBlocks = inputOctets/16;
384 switch (cipher->mode) {
386 /* all blocks but last */
387 for (i = numBlocks - 1; i > 0; i--) {
388 rijndaelDecrypt(key->rk, key->Nr, input, outBuffer);
393 rijndaelDecrypt(key->rk, key->Nr, input, block);
399 for (i = 16 - padLen; i < 16; i++) {
400 if (block[i] != padLen) {
405 memcpy(outBuffer, block, 16 - padLen);
409 memcpy(iv, cipher->IV, 16);
410 /* all blocks but last */
411 for (i = numBlocks - 1; i > 0; i--) {
412 rijndaelDecrypt(key->rk, key->Nr, input, block);
413 ((uint32_t*)block)[0] ^= iv[0];
414 ((uint32_t*)block)[1] ^= iv[1];
415 ((uint32_t*)block)[2] ^= iv[2];
416 ((uint32_t*)block)[3] ^= iv[3];
417 memcpy(iv, input, 16);
418 memcpy(outBuffer, block, 16);
423 rijndaelDecrypt(key->rk, key->Nr, input, block);
424 ((uint32_t*)block)[0] ^= iv[0];
425 ((uint32_t*)block)[1] ^= iv[1];
426 ((uint32_t*)block)[2] ^= iv[2];
427 ((uint32_t*)block)[3] ^= iv[3];
429 if (padLen <= 0 || padLen > 16) {
433 for (i = 16 - padLen; i < 16; i++) {
434 if (block[i] != padLen) {
439 memcpy(outBuffer, block, 16 - padLen);
443 return BAD_CIPHER_STATE;
446 rval = 16*numBlocks - padLen;
449 explicit_bzero(block, sizeof(block));