mirror of
https://github.com/rdolbeau/VexRiscvBPluginGenerator.git
synced 2025-04-18 18:44:42 -04:00
AES256GCM w/ B+K
This commit is contained in:
Romain Dolbeau
parent
ea42adbd1a
commit
27bc05e368
19 changed files with 2446 additions and 0 deletions
47
aes256gcmv1standalone-rv32/Makefile
Normal file
47
aes256gcmv1standalone-rv32/Makefile
Normal file
|
|
@ -0,0 +1,47 @@
|
|||
SRCs=encrypt.c try-anything.c verify.c
|
||||
OBJs=$(SRCs:.c=.o)
|
||||
SCLIBS=cpucycles.o kernelrandombytes.o
|
||||
|
||||
COMPDIR=/home/dolbeau/LITEX/riscv64-unknown-elf-gcc-8.3.0-2019.08.0-x86_64-linux-ubuntu14
|
||||
ALTCOMPDIR=/opt/riscv64b
|
||||
|
||||
CC=$(COMPDIR)/bin/riscv64-unknown-elf-gcc
|
||||
ALTCC=$(ALTCOMPDIR)/bin/riscv64-unknown-elf-gcc
|
||||
CC=$(ALTCC)
|
||||
CXX=$(COMPDIR)/bin/riscv64-unknown-elf-g++
|
||||
STRIP=$(COMPDIR)/bin/riscv64-unknown-elf-strip
|
||||
NEWOPT=-march=rv32imab -mabi=ilp32 -I. -O3 -DRV32B #-fno-vectorize #-DUSE_EPI_CUSTOM
|
||||
OPT=-march=rv32ima -mabi=ilp32 -I. -O3 #-fno-vectorize #-DUSE_EPI_CUSTOM
|
||||
#NEWOPT=$(OPT)
|
||||
|
||||
all: aes256gcmv1 aes256gcmv1_small
|
||||
|
||||
clean:
|
||||
rm -f $(OBJs) try.o try_small.o encrypt.o aes256gcmv1 aes256gcmv1_small
|
||||
|
||||
%.o: %.c
|
||||
$(CC) $(NEWOPT) $< -c -o $@
|
||||
|
||||
try.o: try.c
|
||||
$(CC) $(NEWOPT) $< -c -o $@
|
||||
|
||||
try_small.o: try.c
|
||||
$(CC) $(NEWOPT) $< -c -o $@ -DSMALL
|
||||
|
||||
encrypt.S: encrypt.c
|
||||
$(CC) $(NEWOPT) $< -S -o $@
|
||||
|
||||
encrypt.o: encrypt.S
|
||||
$(CC) $(NEWOPT) $< -c -o $@
|
||||
|
||||
aes256gcmv1: $(OBJs) encrypt.o try.o $(SCLIBS)
|
||||
$(CXX) $(OPT) $^ -o $@
|
||||
|
||||
aes256gcmv1_small: $(OBJs) encrypt.o try_small.o $(SCLIBS)
|
||||
$(CXX) $(OPT) $^ -o $@
|
||||
|
||||
kernelrandombytes.o: random.cpp
|
||||
$(CXX) $(OPT) $< -c -o $@
|
||||
|
||||
cpucycles.o: riscv.c
|
||||
$(CC) $< -march=rv32ima -mabi=ilp32 -I. -O1 -c -o $@
|
||||
4
aes256gcmv1standalone-rv32/api.h
Normal file
4
aes256gcmv1standalone-rv32/api.h
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
#define CRYPTO_KEYBYTES 32
|
||||
#define CRYPTO_NSECBYTES 0
|
||||
#define CRYPTO_NPUBBYTES 12
|
||||
#define CRYPTO_ABYTES 16
|
||||
28
aes256gcmv1standalone-rv32/cpucycles.h
Normal file
28
aes256gcmv1standalone-rv32/cpucycles.h
Normal file
|
|
@ -0,0 +1,28 @@
|
|||
/*
|
||||
cpucycles riscv.h version 20190803
|
||||
D. J. Bernstein
|
||||
Romain Dolbeau
|
||||
Public domain.
|
||||
*/
|
||||
|
||||
#ifndef CPUCYCLES_riscv_h
|
||||
#define CPUCYCLES_riscv_h
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
extern long long cpucycles_riscv(void);
|
||||
extern long long cpucycles_riscv_persecond(void);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#ifndef cpucycles_implementation
|
||||
#define cpucycles_implementation "riscv"
|
||||
#define cpucycles cpucycles_riscv
|
||||
#define cpucycles_persecond cpucycles_riscv_persecond
|
||||
#endif
|
||||
|
||||
#endif
|
||||
17
aes256gcmv1standalone-rv32/crypto_aead.h
Normal file
17
aes256gcmv1standalone-rv32/crypto_aead.h
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
#ifndef crypto_aead_H
|
||||
#define crypto_aead_H
|
||||
|
||||
#include "crypto_aead_aes256gcmv1.h"
|
||||
|
||||
#define crypto_aead_encrypt crypto_aead_aes256gcmv1_encrypt
|
||||
#define crypto_aead_decrypt crypto_aead_aes256gcmv1_decrypt
|
||||
#define crypto_aead_KEYBYTES crypto_aead_aes256gcmv1_KEYBYTES
|
||||
#define crypto_aead_NSECBYTES crypto_aead_aes256gcmv1_NSECBYTES
|
||||
#define crypto_aead_NPUBBYTES crypto_aead_aes256gcmv1_NPUBBYTES
|
||||
#define crypto_aead_ABYTES crypto_aead_aes256gcmv1_ABYTES
|
||||
#define crypto_aead_NOOVERLAP crypto_aead_aes256gcmv1_NOOVERLAP
|
||||
#define crypto_aead_PRIMITIVE "aes256gcmv1"
|
||||
#define crypto_aead_IMPLEMENTATION crypto_aead_aes256gcmv1_IMPLEMENTATION
|
||||
#define crypto_aead_VERSION crypto_aead_aes256gcmv1_VERSION
|
||||
|
||||
#endif
|
||||
31
aes256gcmv1standalone-rv32/crypto_aead_aes256gcmv1.h
Normal file
31
aes256gcmv1standalone-rv32/crypto_aead_aes256gcmv1.h
Normal file
|
|
@ -0,0 +1,31 @@
|
|||
#ifndef crypto_aead_aes256gcmv1_H
|
||||
#define crypto_aead_aes256gcmv1_H
|
||||
|
||||
#define crypto_aead_aes256gcmv1_ref_KEYBYTES 32
|
||||
#define crypto_aead_aes256gcmv1_ref_NSECBYTES 0
|
||||
#define crypto_aead_aes256gcmv1_ref_NPUBBYTES 12
|
||||
#define crypto_aead_aes256gcmv1_ref_ABYTES 16
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
extern int crypto_aead_aes256gcmv1_ref_encrypt(unsigned char *,unsigned long long *,const unsigned char *,unsigned long long,const unsigned char *,unsigned long long,const unsigned char *,const unsigned char *,const unsigned char *);
|
||||
extern int crypto_aead_aes256gcmv1_ref_decrypt(unsigned char *,unsigned long long *,unsigned char *,const unsigned char *,unsigned long long,const unsigned char *,unsigned long long,const unsigned char *,const unsigned char *);
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#define crypto_aead_aes256gcmv1_encrypt crypto_aead_aes256gcmv1_ref_encrypt
|
||||
#define crypto_aead_aes256gcmv1_decrypt crypto_aead_aes256gcmv1_ref_decrypt
|
||||
#define crypto_aead_aes256gcmv1_KEYBYTES crypto_aead_aes256gcmv1_ref_KEYBYTES
|
||||
#define crypto_aead_aes256gcmv1_NSECBYTES crypto_aead_aes256gcmv1_ref_NSECBYTES
|
||||
#define crypto_aead_aes256gcmv1_NPUBBYTES crypto_aead_aes256gcmv1_ref_NPUBBYTES
|
||||
#define crypto_aead_aes256gcmv1_ABYTES crypto_aead_aes256gcmv1_ref_ABYTES
|
||||
#define crypto_aead_aes256gcmv1_NOOVERLAP crypto_aead_aes256gcmv1_ref_NOOVERLAP
|
||||
#define crypto_aead_aes256gcmv1_IMPLEMENTATION "crypto_aead/aes256gcmv1/ref"
|
||||
#ifndef crypto_aead_aes256gcmv1_ref_VERSION
|
||||
#define crypto_aead_aes256gcmv1_ref_VERSION "-"
|
||||
#endif
|
||||
#define crypto_aead_aes256gcmv1_VERSION crypto_aead_aes256gcmv1_ref_VERSION
|
||||
|
||||
#endif
|
||||
6
aes256gcmv1standalone-rv32/crypto_uint32.h
Normal file
6
aes256gcmv1standalone-rv32/crypto_uint32.h
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
#ifndef crypto_uint32_h
|
||||
#define crypto_uint32_h
|
||||
|
||||
typedef unsigned int crypto_uint32;
|
||||
|
||||
#endif
|
||||
6
aes256gcmv1standalone-rv32/crypto_uint64.h
Normal file
6
aes256gcmv1standalone-rv32/crypto_uint64.h
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
#ifndef crypto_uint64_h
|
||||
#define crypto_uint64_h
|
||||
|
||||
typedef unsigned long long crypto_uint64;
|
||||
|
||||
#endif
|
||||
6
aes256gcmv1standalone-rv32/crypto_uint8.h
Normal file
6
aes256gcmv1standalone-rv32/crypto_uint8.h
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
#ifndef crypto_uint8_h
|
||||
#define crypto_uint8_h
|
||||
|
||||
typedef unsigned char crypto_uint8;
|
||||
|
||||
#endif
|
||||
12
aes256gcmv1standalone-rv32/crypto_verify.h
Normal file
12
aes256gcmv1standalone-rv32/crypto_verify.h
Normal file
|
|
@ -0,0 +1,12 @@
|
|||
#ifndef crypto_verify_H
|
||||
#define crypto_verify_H
|
||||
|
||||
#include "crypto_verify_16.h"
|
||||
|
||||
#define crypto_verify crypto_verify_16
|
||||
#define crypto_verify_BYTES crypto_verify_16_BYTES
|
||||
#define crypto_verify_PRIMITIVE "16"
|
||||
#define crypto_verify_IMPLEMENTATION crypto_verify_16_IMPLEMENTATION
|
||||
#define crypto_verify_VERSION crypto_verify_16_VERSION
|
||||
|
||||
#endif
|
||||
22
aes256gcmv1standalone-rv32/crypto_verify_16.h
Normal file
22
aes256gcmv1standalone-rv32/crypto_verify_16.h
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
#ifndef crypto_verify_16_H
|
||||
#define crypto_verify_16_H
|
||||
|
||||
#define crypto_verify_16_ref_BYTES 16
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
extern int crypto_verify_16_ref(const unsigned char *,const unsigned char *);
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#define crypto_verify_16 crypto_verify_16_ref
|
||||
#define crypto_verify_16_BYTES crypto_verify_16_ref_BYTES
|
||||
#define crypto_verify_16_IMPLEMENTATION "crypto_verify/16/ref"
|
||||
#ifndef crypto_verify_16_ref_VERSION
|
||||
#define crypto_verify_16_ref_VERSION "-"
|
||||
#endif
|
||||
#define crypto_verify_16_VERSION crypto_verify_16_ref_VERSION
|
||||
|
||||
#endif
|
||||
652
aes256gcmv1standalone-rv32/encrypt.c
Normal file
652
aes256gcmv1standalone-rv32/encrypt.c
Normal file
|
|
@ -0,0 +1,652 @@
|
|||
#include <string.h>
|
||||
|
||||
#include "crypto_aead.h"
|
||||
#include "crypto_verify_16.h"
|
||||
|
||||
#include "stdaes-common.h"
|
||||
|
||||
#define _bswap64(a) __builtin_bswap64(a)
|
||||
#define _bswap(a) __builtin_bswap32(a)
|
||||
|
||||
#define ASM1MACRO(N, O) asm(".macro "#N" rd, rs1\n" \
|
||||
".word ("#O" | (\\rd << 7) | (\\rs1 << 15))\n" \
|
||||
".endm\n");
|
||||
#define ASM2MACRO(N, O) asm(".macro "#N" rd, rs1, rs2\n" \
|
||||
".word ("#O" | (\\rd << 7) | (\\rs1 << 15) | (\\rs2 << 20))\n" \
|
||||
".endm\n");
|
||||
asm("#define reg_zero 0\n");
|
||||
asm("#define reg_ra 1\n");
|
||||
asm("#define reg_sp 2\n");
|
||||
asm("#define reg_gp 3\n");
|
||||
asm("#define reg_tp 4\n");
|
||||
asm("#define reg_t0 5\n");
|
||||
asm("#define reg_t1 6\n");
|
||||
asm("#define reg_t2 7\n");
|
||||
asm("#define reg_s0 8\n");
|
||||
asm("#define reg_s1 9\n");
|
||||
asm("#define reg_a0 10\n");
|
||||
asm("#define reg_a1 11\n");
|
||||
asm("#define reg_a2 12\n");
|
||||
asm("#define reg_a3 13\n");
|
||||
asm("#define reg_a4 14\n");
|
||||
asm("#define reg_a5 15\n");
|
||||
asm("#define reg_a6 16\n");
|
||||
asm("#define reg_a7 17\n");
|
||||
asm("#define reg_s2 18\n");
|
||||
asm("#define reg_s3 19\n");
|
||||
asm("#define reg_s4 20\n");
|
||||
asm("#define reg_s5 21\n");
|
||||
asm("#define reg_s6 22\n");
|
||||
asm("#define reg_s7 23\n");
|
||||
asm("#define reg_s8 24\n");
|
||||
asm("#define reg_s9 25\n");
|
||||
asm("#define reg_s10 26\n");
|
||||
asm("#define reg_s11 27\n");
|
||||
asm("#define reg_t3 28\n");
|
||||
asm("#define reg_t4 29\n");
|
||||
asm("#define reg_t5 30\n");
|
||||
asm("#define reg_t6 31\n");
|
||||
|
||||
#define FUN1(NAME, ASNAME) \
|
||||
static inline uint32_t NAME(uint32_t rs1) { \
|
||||
uint32_t r; \
|
||||
asm (#ASNAME " reg_%0, reg_%1\n" \
|
||||
: "=r" (r) \
|
||||
: "r" (rs1)); \
|
||||
return r; \
|
||||
}
|
||||
#define FUN2(NAME, ASNAME) \
|
||||
static inline uint32_t NAME(uint32_t rs1, uint32_t rs2) { \
|
||||
uint32_t r; \
|
||||
asm (#ASNAME " reg_%0, reg_%1, reg_%2\n" \
|
||||
: "=r" (r) \
|
||||
: "r" (rs1), "r" (rs2)); \
|
||||
return r; \
|
||||
}
|
||||
|
||||
ASM2MACRO(AES32ESMI0,0x0000202b)
|
||||
ASM2MACRO(AES32ESMI1,0x4000202b)
|
||||
ASM2MACRO(AES32ESMI2,0x8000202b)
|
||||
ASM2MACRO(AES32ESMI3,0xc000202b)
|
||||
ASM2MACRO(AES32ESI0,0x0200202b)
|
||||
ASM2MACRO(AES32ESI1,0x4200202b)
|
||||
ASM2MACRO(AES32ESI2,0x8200202b)
|
||||
ASM2MACRO(AES32ESI3,0xc200202b)
|
||||
FUN2(aes32esmi0,AES32ESMI0)
|
||||
FUN2(aes32esmi1,AES32ESMI1)
|
||||
FUN2(aes32esmi2,AES32ESMI2)
|
||||
FUN2(aes32esmi3,AES32ESMI3)
|
||||
FUN2(aes32esi0,AES32ESI0)
|
||||
FUN2(aes32esi1,AES32ESI1)
|
||||
FUN2(aes32esi2,AES32ESI2)
|
||||
FUN2(aes32esi3,AES32ESI3)
|
||||
|
||||
#define AES_ROUND1T(TAB,I,X0,X1,X2,X3,Y0,Y1,Y2,Y3) \
|
||||
{ \
|
||||
X0 = aes32esmi0(TAB[I++],Y0); \
|
||||
X0 = aes32esmi1(X0,Y1); \
|
||||
X0 = aes32esmi2(X0,Y2); \
|
||||
X0 = aes32esmi3(X0,Y3); \
|
||||
X1 = aes32esmi0(TAB[I++],Y1); \
|
||||
X1 = aes32esmi1(X1,Y2); \
|
||||
X1 = aes32esmi2(X1,Y3); \
|
||||
X1 = aes32esmi3(X1,Y0); \
|
||||
X2 = aes32esmi0(TAB[I++],Y2); \
|
||||
X2 = aes32esmi1(X2,Y3); \
|
||||
X2 = aes32esmi2(X2,Y0); \
|
||||
X2 = aes32esmi3(X2,Y1); \
|
||||
X3 = aes32esmi0(TAB[I++],Y3); \
|
||||
X3 = aes32esmi1(X3,Y0); \
|
||||
X3 = aes32esmi2(X3,Y1); \
|
||||
X3 = aes32esmi3(X3,Y2); \
|
||||
}
|
||||
|
||||
/* using the K + B instructions */
|
||||
static inline void aes256_1Tft_encrypt(uint32_t *output, const uint32_t *input, const uint32_t *aes_edrk)
|
||||
{
|
||||
unsigned int X0, X1, X2, X3, Y0, Y1, Y2, Y3;
|
||||
unsigned int i = 0, j = 0;
|
||||
unsigned int l_aes_nr = 14;
|
||||
|
||||
X0 = ((input[0]) ^ aes_edrk[j++]);
|
||||
X1 = ((input[1]) ^ aes_edrk[j++]);
|
||||
X2 = ((input[2]) ^ aes_edrk[j++]);
|
||||
X3 = ((input[3]) ^ aes_edrk[j++]);
|
||||
|
||||
for (i = 4 ; i < (l_aes_nr<<2) ; ) {
|
||||
|
||||
AES_ROUND1T(aes_edrk, i, Y0, Y1, Y2, Y3, X0, X1, X2, X3 );
|
||||
|
||||
X0=Y0;
|
||||
X1=Y1;
|
||||
X2=Y2;
|
||||
X3=Y3;
|
||||
}
|
||||
/* last round */
|
||||
|
||||
Y0 = aes32esi0(aes_edrk[i], X0);
|
||||
Y0 = aes32esi1(Y0, X1);
|
||||
Y0 = aes32esi2(Y0, X2);
|
||||
Y0 = aes32esi3(Y0, X3);
|
||||
i++;
|
||||
Y1 = aes32esi0(aes_edrk[i], X1);
|
||||
Y1 = aes32esi1(Y1, X2);
|
||||
Y1 = aes32esi2(Y1, X3);
|
||||
Y1 = aes32esi3(Y1, X0);
|
||||
i++;
|
||||
Y2 = aes32esi0(aes_edrk[i], X2);
|
||||
Y2 = aes32esi1(Y2, X3);
|
||||
Y2 = aes32esi2(Y2, X0);
|
||||
Y2 = aes32esi3(Y2, X1);
|
||||
i++;
|
||||
Y3 = aes32esi0(aes_edrk[i], X3);
|
||||
Y3 = aes32esi1(Y3, X0);
|
||||
Y3 = aes32esi2(Y3, X1);
|
||||
Y3 = aes32esi3(Y3, X2);
|
||||
|
||||
output[0] = (Y0);
|
||||
output[1] = (Y1);
|
||||
output[2] = (Y2);
|
||||
output[3] = (Y3);
|
||||
}
|
||||
|
||||
/* same as above, but byte-revert the counter & increment it */
|
||||
static inline void aes256_1Tft_encrypt_rinc(uint32_t *output, uint32_t *input, const uint32_t *aes_edrk)
|
||||
{
|
||||
unsigned int X0, X1, X2, X3, Y0, Y1, Y2, Y3;
|
||||
unsigned int i = 0, j = 0;
|
||||
unsigned int l_aes_nr = 14;
|
||||
|
||||
X0 = ((input[0]) ^ aes_edrk[j++]);
|
||||
X1 = ((input[1]) ^ aes_edrk[j++]);
|
||||
X2 = ((input[2]) ^ aes_edrk[j++]);
|
||||
X3 = (_bswap(input[3]) ^ aes_edrk[j++]);
|
||||
input[3]++;
|
||||
|
||||
for (i = 4 ; i < (l_aes_nr<<2) ; ) {
|
||||
|
||||
AES_ROUND1T(aes_edrk, i, Y0, Y1, Y2, Y3, X0, X1, X2, X3 );
|
||||
|
||||
X0=Y0;
|
||||
X1=Y1;
|
||||
X2=Y2;
|
||||
X3=Y3;
|
||||
}
|
||||
/* last round */
|
||||
|
||||
Y0 = aes32esi0(aes_edrk[i], X0);
|
||||
Y0 = aes32esi1(Y0, X1);
|
||||
Y0 = aes32esi2(Y0, X2);
|
||||
Y0 = aes32esi3(Y0, X3);
|
||||
i++;
|
||||
Y1 = aes32esi0(aes_edrk[i], X1);
|
||||
Y1 = aes32esi1(Y1, X2);
|
||||
Y1 = aes32esi2(Y1, X3);
|
||||
Y1 = aes32esi3(Y1, X0);
|
||||
i++;
|
||||
Y2 = aes32esi0(aes_edrk[i], X2);
|
||||
Y2 = aes32esi1(Y2, X3);
|
||||
Y2 = aes32esi2(Y2, X0);
|
||||
Y2 = aes32esi3(Y2, X1);
|
||||
i++;
|
||||
Y3 = aes32esi0(aes_edrk[i], X3);
|
||||
Y3 = aes32esi1(Y3, X0);
|
||||
Y3 = aes32esi2(Y3, X1);
|
||||
Y3 = aes32esi3(Y3, X2);
|
||||
|
||||
output[0] = (Y0);
|
||||
output[1] = (Y1);
|
||||
output[2] = (Y2);
|
||||
output[3] = (Y3);
|
||||
}
|
||||
|
||||
/* emulates 64 bits clmul with 32 bit clmul/clmulh */
|
||||
static inline int64_t _rv64_clmul(int64_t rs1, int64_t rs2)
|
||||
{
|
||||
int64_t r = 0;
|
||||
uint32_t rs1l = rs1 & 0xFFFFFFFF;
|
||||
uint32_t rs1h = (rs1>>32) & 0xFFFFFFFF;
|
||||
uint32_t rs2l = rs2 & 0xFFFFFFFF;
|
||||
uint32_t rs2h = (rs2>>32) & 0xFFFFFFFF;
|
||||
uint32_t lll = _rv32_clmul(rs1l, rs2l);
|
||||
uint32_t llh = _rv32_clmulh(rs1l, rs2l);
|
||||
/* uint32_t hhl = _rv32_clmul(rs1h, rs2h); */
|
||||
/* uint32_t hhh = _rv32_clmulh(rs1h, rs2h); */
|
||||
uint32_t lhl = _rv32_clmul(rs1l, rs2h);
|
||||
/* uint32_t lhh = _rv32_clmulh(rs1l, rs2h); */
|
||||
uint32_t hll = _rv32_clmul(rs1h, rs2l);
|
||||
/* uint32_t hlh = _rv32_clmulh(rs1h, rs2l); */
|
||||
|
||||
uint32_t L = lll;
|
||||
uint32_t H = llh ^ lhl ^ hll;
|
||||
r = (int64_t)(((uint64_t)L)| ((uint64_t)H) << 32);
|
||||
return r;
|
||||
}
|
||||
static inline int64_t _rv64_clmulh(int64_t rs1, int64_t rs2)
|
||||
{
|
||||
int64_t r = 0;
|
||||
uint32_t rs1l = rs1 & 0xFFFFFFFF;
|
||||
uint32_t rs1h = (rs1>>32) & 0xFFFFFFFF;
|
||||
uint32_t rs2l = rs2 & 0xFFFFFFFF;
|
||||
uint32_t rs2h = (rs2>>32) & 0xFFFFFFFF;
|
||||
/* uint32_t lll = _rv32_clmul(rs1l, rs2l); */
|
||||
/* uint32_t llh = _rv32_clmulh(rs1l, rs2l); */
|
||||
uint32_t hhl = _rv32_clmul(rs1h, rs2h);
|
||||
uint32_t hhh = _rv32_clmulh(rs1h, rs2h);
|
||||
/* uint32_t lhl = _rv32_clmul(rs1l, rs2h); */
|
||||
uint32_t lhh = _rv32_clmulh(rs1l, rs2h);
|
||||
/* uint32_t hll = _rv32_clmul(rs1h, rs2l); */
|
||||
uint32_t hlh = _rv32_clmulh(rs1h, rs2l);
|
||||
|
||||
uint32_t L = hhl ^ lhh ^ hlh;
|
||||
uint32_t H = hhh;
|
||||
r = (int64_t)(((uint64_t)L)| ((uint64_t)H) << 32);
|
||||
return r;
|
||||
}
|
||||
|
||||
/* this is basically Supercop's crypto_aead/aes256gcmv1/dolbeau/aesenc-int,
|
||||
but without the unrolling.
|
||||
So we have a thin compatibility layer to SSE's __m128i data format
|
||||
and associated instructions to support GHASH & the full algo.
|
||||
*/
|
||||
|
||||
/* ouch */
|
||||
typedef struct {
|
||||
uint64_t l;
|
||||
uint64_t h;
|
||||
} __m128i;
|
||||
|
||||
//#define _mm_loadu_si128(a) (*(const __m128i*)a)
|
||||
static inline __m128i _mm_loadu_si128(const __m128i *ptr) {
|
||||
__m128i r;
|
||||
r.l = ((const uint64_t*)ptr)[0];
|
||||
r.h = ((const uint64_t*)ptr)[1];
|
||||
return r;
|
||||
}
|
||||
|
||||
//#define _mm_storeu_si128(x,a) (*(__m128i*)x)=a
|
||||
static inline void _mm_storeu_si128(__m128i *ptr, const __m128i data) {
|
||||
((uint64_t*)ptr)[0] = data.l;
|
||||
((uint64_t*)ptr)[1] = data.h;
|
||||
}
|
||||
|
||||
static inline __m128i _mm_clmulepi64_si128(const __m128i a, const __m128i b, const int x) {
|
||||
__m128i r;
|
||||
switch (x) {
|
||||
case 0x00:
|
||||
r.l = _rv64_clmul(a.l, b.l);
|
||||
r.h = _rv64_clmulh(a.l, b.l);
|
||||
break;
|
||||
case 0x01:
|
||||
r.l = _rv64_clmul(a.l, b.h);
|
||||
r.h = _rv64_clmulh(a.l, b.h);
|
||||
break;
|
||||
case 0x10:
|
||||
r.l = _rv64_clmul(a.h, b.l);
|
||||
r.h = _rv64_clmulh(a.h, b.l);
|
||||
break;
|
||||
case 0x11:
|
||||
r.l = _rv64_clmul(a.h, b.h);
|
||||
r.h = _rv64_clmulh(a.h, b.h);
|
||||
break;
|
||||
}
|
||||
return r;
|
||||
}
|
||||
|
||||
/*
|
||||
static inline __m128i (const __m128i a, const __m128i b) {
|
||||
__m128i r;
|
||||
return r;
|
||||
}
|
||||
*/
|
||||
static inline __m128i _mm_xor_si128(const __m128i a, const __m128i b) {
|
||||
__m128i r;
|
||||
r.l = a.l ^ b.l;
|
||||
r.h = a.h ^ b.h;
|
||||
return r;
|
||||
}
|
||||
static inline __m128i _mm_or_si128(const __m128i a, const __m128i b) {
|
||||
__m128i r;
|
||||
r.l = a.l | b.l;
|
||||
r.h = a.h | b.h;
|
||||
return r;
|
||||
}
|
||||
static inline __m128i _mm_and_si128(const __m128i a, const __m128i b) {
|
||||
__m128i r;
|
||||
r.l = a.l & b.l;
|
||||
r.h = a.h & b.h;
|
||||
return r;
|
||||
}
|
||||
static inline __m128i _mm_slli_si128(const __m128i a, const int b) {
|
||||
__m128i r;
|
||||
switch (b) {
|
||||
case 4:
|
||||
r.l = a.l << 32;
|
||||
r.h = a.h << 32 | a.l >> 32;
|
||||
break;
|
||||
case 8:
|
||||
r.l = 0;
|
||||
r.h = a.l;
|
||||
break;
|
||||
case 12:
|
||||
r.l = 0;
|
||||
r.h = a.l << 32;
|
||||
break;
|
||||
}
|
||||
return r;
|
||||
}
|
||||
static inline __m128i _mm_srli_si128(const __m128i a, const int b) {
|
||||
__m128i r;
|
||||
switch (b) {
|
||||
case 4:
|
||||
r.l = a.l >> 32 | a.h << 32;
|
||||
r.h = a.h >> 32;
|
||||
break;
|
||||
case 8:
|
||||
r.l = a.h;
|
||||
r.h = 0;
|
||||
break;
|
||||
case 12:
|
||||
r.l = a.h >> 32;
|
||||
r.h = 0;
|
||||
break;
|
||||
}
|
||||
return r;
|
||||
}
|
||||
static inline __m128i _mm_srli_epi32(const __m128i a, const int b) {
|
||||
__m128i r;
|
||||
r.l = ((a.l & 0x00000000FFFFFFFFull) >> b) | (((a.l & 0xFFFFFFFF00000000ull) >> b) & 0xFFFFFFFF00000000ull);
|
||||
r.h = ((a.h & 0x00000000FFFFFFFFull) >> b) | (((a.h & 0xFFFFFFFF00000000ull) >> b) & 0xFFFFFFFF00000000ull);
|
||||
return r;
|
||||
}
|
||||
static inline __m128i _mm_slli_epi32(const __m128i a, const int b) {
|
||||
__m128i r;
|
||||
r.l = (((a.l & 0x00000000FFFFFFFFull) << b) & 0x00000000FFFFFFFFull) | ((a.l & 0xFFFFFFFF00000000ull) << b);
|
||||
r.h = (((a.h & 0x00000000FFFFFFFFull) << b) & 0x00000000FFFFFFFFull) | ((a.h & 0xFFFFFFFF00000000ull) << b);
|
||||
return r;
|
||||
}
|
||||
static inline __m128i _mm_insert_epi64(const __m128i a, const uint64_t x, const int b) {
|
||||
__m128i r;
|
||||
if (b == 0) {
|
||||
r.l = x;
|
||||
r.h = a.h;
|
||||
} else {
|
||||
r.l = a.l;
|
||||
r.h = x;
|
||||
}
|
||||
return r;
|
||||
}
|
||||
static inline __m128i _mm_setzero_si128(void) {
|
||||
__m128i r;
|
||||
r.l = 0;
|
||||
r.h = 0;
|
||||
return r;
|
||||
}
|
||||
static inline __m128i _mm_set1_epi32(const uint32_t x) {
|
||||
__m128i r;
|
||||
r.l = x | ((uint64_t)x) << 32;
|
||||
r.h = x | ((uint64_t)x) << 32;
|
||||
return r;
|
||||
}
|
||||
|
||||
static inline uint64_t bytereverse64(const uint64_t a) {
|
||||
uint64_t r;
|
||||
r = (uint32_t)_rv32_grev((a>>32), 24) | (((uint64_t)_rv32_grev((a&0xFFFFFFFF), 24))<<32);
|
||||
return r;
|
||||
}
|
||||
static inline __m128i bytereverse128(const __m128i a) {
|
||||
__m128i r;
|
||||
r.l = bytereverse64(a.h);
|
||||
r.h = bytereverse64(a.l);
|
||||
return r;
|
||||
}
|
||||
|
||||
static inline uint64_t bitreverse64(const uint64_t a) {
|
||||
uint64_t r;
|
||||
r = (uint32_t)_rv32_grev((a&0xFFFFFFFF), 7) | (((uint64_t)_rv32_grev((a>>32), 7))<<32);
|
||||
return r;
|
||||
}
|
||||
static inline __m128i bitreverse128(const __m128i a) {
|
||||
__m128i r;
|
||||
r.l = bitreverse64(a.l);
|
||||
r.h = bitreverse64(a.h);
|
||||
return r;
|
||||
}
|
||||
|
||||
static inline uint64_t wordreverse64(const uint64_t a) {
|
||||
uint64_t r;
|
||||
r = (a>>32)|(a<<32);
|
||||
return r;
|
||||
}
|
||||
static inline __m128i wordreverse128(const __m128i a) {
|
||||
__m128i r;
|
||||
r.l = wordreverse64(a.h);
|
||||
r.h = wordreverse64(a.l);
|
||||
return r;
|
||||
}
|
||||
static inline __m128i doublewordreverse128(const __m128i a) {
|
||||
__m128i r;
|
||||
r.l = a.h;
|
||||
r.h = a.l;
|
||||
return r;
|
||||
}
|
||||
|
||||
static inline void addmul_rv(unsigned char *c,
|
||||
const unsigned char *a, int xlen,
|
||||
const unsigned char *b) {
|
||||
//const __m128i rev = _mm_set_epi8(0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15);
|
||||
const __m128i ff = _mm_set1_epi32(0xFFFFFFFF);
|
||||
__m128i A = _mm_loadu_si128((const __m128i*)a);
|
||||
//A = _mm_shuffle_epi8(A, rev);
|
||||
A = bytereverse128(A);
|
||||
if (xlen < 16) { // less than 16 useful bytes - insert zeroes where needed
|
||||
unsigned long long mask = -1ull ^ (1ull<<(((16-xlen)%8)*8))-1ull;
|
||||
__m128i vm;
|
||||
if (xlen>8) {
|
||||
vm = _mm_insert_epi64(ff, mask, 0);
|
||||
} else {
|
||||
vm = _mm_insert_epi64(_mm_setzero_si128(),mask,1);
|
||||
}
|
||||
A = _mm_and_si128(vm, A);
|
||||
}
|
||||
__m128i B = _mm_loadu_si128((const __m128i*)b);
|
||||
__m128i C = _mm_loadu_si128((const __m128i*)c);
|
||||
A = _mm_xor_si128(A,C);
|
||||
__m128i tmp3 = _mm_clmulepi64_si128(A, B, 0x00);
|
||||
__m128i tmp4 = _mm_clmulepi64_si128(A, B, 0x10);
|
||||
__m128i tmp5 = _mm_clmulepi64_si128(A, B, 0x01);
|
||||
__m128i tmp6 = _mm_clmulepi64_si128(A, B, 0x11);
|
||||
|
||||
__m128i tmp10 = _mm_xor_si128(tmp4, tmp5);
|
||||
__m128i tmp13 = _mm_slli_si128(tmp10, 8);
|
||||
__m128i tmp11 = _mm_srli_si128(tmp10, 8);
|
||||
__m128i tmp15 = _mm_xor_si128(tmp3, tmp13);
|
||||
__m128i tmp17 = _mm_xor_si128(tmp6, tmp11);
|
||||
__m128i tmp7 = _mm_srli_epi32(tmp15, 31);
|
||||
__m128i tmp8 = _mm_srli_epi32(tmp17, 31);
|
||||
__m128i tmp16 = _mm_slli_epi32(tmp15, 1);
|
||||
__m128i tmp18 = _mm_slli_epi32(tmp17, 1);
|
||||
__m128i tmp9 = _mm_srli_si128(tmp7, 12);
|
||||
__m128i tmp22 = _mm_slli_si128(tmp8, 4);
|
||||
__m128i tmp25 = _mm_slli_si128(tmp7, 4);
|
||||
__m128i tmp29 =_mm_or_si128(tmp16, tmp25);
|
||||
__m128i tmp19 = _mm_or_si128(tmp18, tmp22);
|
||||
__m128i tmp20 = _mm_or_si128(tmp19, tmp9);
|
||||
__m128i tmp26 = _mm_slli_epi32(tmp29, 31);
|
||||
__m128i tmp23 = _mm_slli_epi32(tmp29, 30);
|
||||
__m128i tmp32 = _mm_slli_epi32(tmp29, 25);
|
||||
__m128i tmp27 = _mm_xor_si128(tmp26, tmp23);
|
||||
__m128i tmp28 = _mm_xor_si128(tmp27, tmp32);
|
||||
__m128i tmp24 = _mm_srli_si128(tmp28, 4);
|
||||
__m128i tmp33 = _mm_slli_si128(tmp28, 12);
|
||||
__m128i tmp30 = _mm_xor_si128(tmp29, tmp33);
|
||||
__m128i tmp2 = _mm_srli_epi32(tmp30, 1);
|
||||
__m128i tmp12 = _mm_srli_epi32(tmp30, 2);
|
||||
__m128i tmp14 = _mm_srli_epi32(tmp30, 7);
|
||||
__m128i tmp34 = _mm_xor_si128(tmp2, tmp12);
|
||||
__m128i tmp35 = _mm_xor_si128(tmp34, tmp14);
|
||||
__m128i tmp36 = _mm_xor_si128(tmp35, tmp24);
|
||||
__m128i tmp31 = _mm_xor_si128(tmp30, tmp36);
|
||||
__m128i tmp21 = _mm_xor_si128(tmp20, tmp31);
|
||||
_mm_storeu_si128((__m128i*)c, tmp21);
|
||||
}
|
||||
|
||||
#define addmul(a,b,c,d) addmul_rv(a,b,c,d)
|
||||
static inline void incle(unsigned char *n) {
|
||||
(*(unsigned int*)&n[12]) = (1+(((*(unsigned int*)&n[12]))));
|
||||
}
|
||||
|
||||
/* full AES-GCM encryption function */
|
||||
int crypto_aead_encrypt(
|
||||
unsigned char *c,unsigned long long *clen,
|
||||
const unsigned char *m,unsigned long long mlen,
|
||||
const unsigned char *ad,unsigned long long adlen_,
|
||||
const unsigned char *nsec,
|
||||
const unsigned char *npub,
|
||||
const unsigned char *k
|
||||
)
|
||||
{
|
||||
__m128i rkeys[16];
|
||||
unsigned long long i, j;
|
||||
unsigned long long adlen = adlen_;
|
||||
unsigned char n2[16];
|
||||
unsigned char H[16];
|
||||
unsigned char T[16];
|
||||
unsigned char accum[16];
|
||||
unsigned char fb[16];
|
||||
aes256_setkey_encrypt(k, rkeys);
|
||||
for (i = 0;i < 12;i++) n2[i] = npub[i];
|
||||
for (i = 12; i < 16;i++) n2[i] = 0;
|
||||
memset(accum, 0, 16);
|
||||
|
||||
*clen = mlen + 16;
|
||||
|
||||
aes256_1Tft_encrypt(H, accum /* only because it's zero */, rkeys);
|
||||
n2[15]++;
|
||||
aes256_1Tft_encrypt(T, n2, rkeys);
|
||||
|
||||
(*(unsigned long long*)&fb[0]) = _bswap64((unsigned long long)(8*adlen));
|
||||
(*(unsigned long long*)&fb[8]) = _bswap64((unsigned long long)(8*mlen));
|
||||
|
||||
/* we store H byte-reverted once and for all */
|
||||
(*(__m128i*)H) = bytereverse128(*(__m128i*)H);
|
||||
|
||||
/* GCM remainder loop */
|
||||
for (i = 0 ; i < adlen ; i+= 16) {
|
||||
unsigned long long blocklen = 16;
|
||||
if (i+blocklen>adlen)
|
||||
blocklen=adlen-i;
|
||||
addmul(accum,ad+i,blocklen,H);
|
||||
}
|
||||
|
||||
#define LOOP(iter) \
|
||||
const int lb = iter * 16; \
|
||||
for (i = 0 ; i < mlen ; i+= lb) { \
|
||||
unsigned char outni[lb]; \
|
||||
aes256_1Tft_encrypt_rinc(outni, (unsigned int*)n2, rkeys); \
|
||||
unsigned long long mj = lb; \
|
||||
if ((i+mj)>=mlen) \
|
||||
mj = mlen-i; \
|
||||
for (j = 0 ; j < mj ; j++) \
|
||||
c[i+j] = m[i+j] ^ outni[j]; \
|
||||
for (j = 0 ; j < mj ; j+=16) { \
|
||||
unsigned long long bl = 16; \
|
||||
if (j+bl>=mj) { \
|
||||
bl = mj-j; \
|
||||
} \
|
||||
addmul(accum,c+i+j,bl,H); \
|
||||
} \
|
||||
}
|
||||
|
||||
n2[15]=0;
|
||||
incle(n2);
|
||||
incle(n2);
|
||||
LOOP(1)
|
||||
|
||||
addmul(accum,fb,16,H);
|
||||
|
||||
for (i = 0;i < 16;++i) c[i+mlen] = T[i] ^ accum[15-i];
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
/* full AES-GCM decryption function
|
||||
basically the same as encrypt, but the checksuming
|
||||
is done _before_ the decryption. And checksum is
|
||||
checked at the end.
|
||||
*/
|
||||
int crypto_aead_decrypt(
|
||||
unsigned char *m,unsigned long long *mlen,
|
||||
unsigned char *nsec,
|
||||
const unsigned char *c,unsigned long long clen,
|
||||
const unsigned char *ad,unsigned long long adlen_,
|
||||
const unsigned char *npub,
|
||||
const unsigned char *k
|
||||
)
|
||||
{
|
||||
__m128i rkeys[16];
|
||||
unsigned long long i, j;
|
||||
unsigned long long adlen = adlen_;
|
||||
unsigned char n2[16];
|
||||
unsigned char H[16];
|
||||
unsigned char T[16];
|
||||
unsigned char accum[16];
|
||||
unsigned char fb[16];
|
||||
aes256_setkey_encrypt(k, rkeys);
|
||||
for (i = 0;i < 12;i++) n2[i] = npub[i];
|
||||
for (i = 12; i < 16;i++) n2[i] = 0;
|
||||
memset(accum, 0, 16);
|
||||
|
||||
*mlen = clen - 16;
|
||||
|
||||
aes256_1Tft_encrypt(H, accum /* only because it's zero */, rkeys);
|
||||
n2[15]++;
|
||||
aes256_1Tft_encrypt(T, n2, rkeys);
|
||||
|
||||
(*(unsigned long long*)&fb[0]) = _bswap64((unsigned long long)(8*adlen));
|
||||
(*(unsigned long long*)&fb[8]) = _bswap64((unsigned long long)(8*(*mlen)));
|
||||
|
||||
/* we store H byte-reverted once and for all */
|
||||
(*(__m128i*)H) = bytereverse128(*(__m128i*)H);
|
||||
|
||||
for (i = 0 ; i < adlen ; i+= 16) {
|
||||
unsigned long long blocklen = 16;
|
||||
if (i+blocklen>adlen)
|
||||
blocklen=adlen-i;
|
||||
addmul(accum,ad+i,blocklen,H);
|
||||
}
|
||||
#define LOOPD(iter) \
|
||||
const int lb = iter * 16; \
|
||||
for (i = 0 ; i < *mlen ; i+= lb) { \
|
||||
unsigned char outni[lb]; \
|
||||
unsigned long long mj = lb; \
|
||||
if ((i+mj)>=*mlen) \
|
||||
mj = *mlen-i; \
|
||||
for (j = 0 ; j < mj ; j+=16) { \
|
||||
unsigned long long bl = 16; \
|
||||
if (j+bl>=mj) { \
|
||||
bl = mj-j; \
|
||||
} \
|
||||
addmul(accum,c+i+j,bl,H); \
|
||||
} \
|
||||
aes256_1Tft_encrypt_rinc(outni, (unsigned int*)n2, rkeys); \
|
||||
for (j = 0 ; j < mj ; j++) \
|
||||
m[i+j] = c[i+j] ^ outni[j]; \
|
||||
}
|
||||
|
||||
n2[15]=0;
|
||||
incle(n2);
|
||||
incle(n2);
|
||||
LOOPD(1)
|
||||
|
||||
addmul(accum,fb,16,H);
|
||||
|
||||
unsigned char F = 0;
|
||||
|
||||
for (i = 0;i < 16;++i) F |= (c[i+(*mlen)] != (T[i] ^ accum[15-i]));
|
||||
if (F)
|
||||
return -111;
|
||||
|
||||
return 0;
|
||||
}
|
||||
14
aes256gcmv1standalone-rv32/kernelrandombytes.h
Normal file
14
aes256gcmv1standalone-rv32/kernelrandombytes.h
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
#ifndef kernelrandombytes_h
|
||||
#define kernelrandombytes_h
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
extern void kernelrandombytes(unsigned char *,unsigned long long);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif
|
||||
19
aes256gcmv1standalone-rv32/random.cpp
Normal file
19
aes256gcmv1standalone-rv32/random.cpp
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
#include <random>
|
||||
#include <functional>
|
||||
|
||||
std::default_random_engine generator;
|
||||
std::uniform_int_distribution<unsigned char> distribution(0,255);
|
||||
auto rbyte = std::bind ( distribution, generator );
|
||||
|
||||
extern "C" {
|
||||
void kernelrandombytes(unsigned char *x,unsigned long long xlen)
|
||||
{
|
||||
int i;
|
||||
|
||||
while (xlen > 0) {
|
||||
*x = rbyte();
|
||||
x++;
|
||||
xlen--;
|
||||
}
|
||||
}
|
||||
}
|
||||
83
aes256gcmv1standalone-rv32/riscv.c
Normal file
83
aes256gcmv1standalone-rv32/riscv.c
Normal file
|
|
@ -0,0 +1,83 @@
|
|||
/*
|
||||
cpucycles/riscv.c version 20190803
|
||||
D. J. Bernstein
|
||||
Romain Dolbeau
|
||||
Public domain.
|
||||
*/
|
||||
|
||||
#include <time.h>
|
||||
#include <sys/time.h>
|
||||
#include <sys/types.h>
|
||||
|
||||
long long cpucycles_riscv(void)
|
||||
{
|
||||
long long result;
|
||||
#if defined(__riscv_xlen)
|
||||
#if __riscv_xlen == 64
|
||||
asm volatile("rdcycle %0" : "=r" (result));
|
||||
#elif __riscv_xlen == 32
|
||||
unsigned int l, h, h2;
|
||||
asm volatile( "start:\n"
|
||||
"rdcycleh %0\n"
|
||||
"rdcycle %1\n"
|
||||
"rdcycleh %2\n"
|
||||
"bne %0, %2, start\n"
|
||||
: "=r" (h), "=r" (l), "=r" (h2));
|
||||
|
||||
result = (((unsigned long long)h)<<32) | ((unsigned long long)l);
|
||||
#else
|
||||
#error "unknown __riscv_xlen"
|
||||
#endif
|
||||
#else // __riscv_xlen
|
||||
#error "__riscv_xlen required for RISC-V support"
|
||||
#endif // __riscv_xlen
|
||||
return result;
|
||||
}
|
||||
|
||||
static long long microseconds(void)
|
||||
{
|
||||
struct timeval t;
|
||||
gettimeofday(&t,(struct timezone *) 0);
|
||||
return t.tv_sec * (long long) 1000000 + t.tv_usec;
|
||||
}
|
||||
|
||||
static double guessfreq(void)
|
||||
{
|
||||
long long tb0; long long us0;
|
||||
long long tb1; long long us1;
|
||||
|
||||
tb0 = cpucycles_riscv();
|
||||
us0 = microseconds();
|
||||
do {
|
||||
tb1 = cpucycles_riscv();
|
||||
us1 = microseconds();
|
||||
} while (us1 - us0 < 10000 || tb1 - tb0 < 1000);
|
||||
if (tb1 <= tb0) return 0;
|
||||
tb1 -= tb0;
|
||||
us1 -= us0;
|
||||
return ((double) tb1) / (0.000001 * (double) us1);
|
||||
}
|
||||
|
||||
static long long cpufrequency = 0;
|
||||
|
||||
static void init(void)
|
||||
{
|
||||
double guess1;
|
||||
double guess2;
|
||||
int loop;
|
||||
|
||||
for (loop = 0;loop < 100;++loop) {
|
||||
guess1 = guessfreq();
|
||||
guess2 = guessfreq();
|
||||
if (guess1 > 1.01 * guess2) continue;
|
||||
if (guess2 > 1.01 * guess1) continue;
|
||||
cpufrequency = 0.5 * (guess1 + guess2);
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
long long cpucycles_riscv_persecond(void)
|
||||
{
|
||||
if (!cpufrequency) init();
|
||||
return cpufrequency;
|
||||
}
|
||||
889
aes256gcmv1standalone-rv32/stdaes-common.h
Normal file
889
aes256gcmv1standalone-rv32/stdaes-common.h
Normal file
|
|
@ -0,0 +1,889 @@
|
|||
/*
|
||||
common.h version $Date: 2020/03/23 14:00:49 $
|
||||
Romain Dolbeau
|
||||
Public Domain
|
||||
*/
|
||||
|
||||
#define f_FSb_32__1(x) ((FSb[((x) >> 24) &0xFF] << 24) ^ \
|
||||
(FSb[((x) >> 16) &0xFF] << 16))
|
||||
|
||||
#define f_FSb_32__2(x) ((FSb[((x) >> 8) &0xFF] << 8 ) ^ \
|
||||
(FSb[((x) ) &0xFF] & 0xFF))
|
||||
|
||||
#define FT \
|
||||
V(C6,63,63,A5), V(F8,7C,7C,84), V(EE,77,77,99), V(F6,7B,7B,8D), \
|
||||
V(FF,F2,F2,0D), V(D6,6B,6B,BD), V(DE,6F,6F,B1), V(91,C5,C5,54), \
|
||||
V(60,30,30,50), V(02,01,01,03), V(CE,67,67,A9), V(56,2B,2B,7D), \
|
||||
V(E7,FE,FE,19), V(B5,D7,D7,62), V(4D,AB,AB,E6), V(EC,76,76,9A), \
|
||||
V(8F,CA,CA,45), V(1F,82,82,9D), V(89,C9,C9,40), V(FA,7D,7D,87), \
|
||||
V(EF,FA,FA,15), V(B2,59,59,EB), V(8E,47,47,C9), V(FB,F0,F0,0B), \
|
||||
V(41,AD,AD,EC), V(B3,D4,D4,67), V(5F,A2,A2,FD), V(45,AF,AF,EA), \
|
||||
V(23,9C,9C,BF), V(53,A4,A4,F7), V(E4,72,72,96), V(9B,C0,C0,5B), \
|
||||
V(75,B7,B7,C2), V(E1,FD,FD,1C), V(3D,93,93,AE), V(4C,26,26,6A), \
|
||||
V(6C,36,36,5A), V(7E,3F,3F,41), V(F5,F7,F7,02), V(83,CC,CC,4F), \
|
||||
V(68,34,34,5C), V(51,A5,A5,F4), V(D1,E5,E5,34), V(F9,F1,F1,08), \
|
||||
V(E2,71,71,93), V(AB,D8,D8,73), V(62,31,31,53), V(2A,15,15,3F), \
|
||||
V(08,04,04,0C), V(95,C7,C7,52), V(46,23,23,65), V(9D,C3,C3,5E), \
|
||||
V(30,18,18,28), V(37,96,96,A1), V(0A,05,05,0F), V(2F,9A,9A,B5), \
|
||||
V(0E,07,07,09), V(24,12,12,36), V(1B,80,80,9B), V(DF,E2,E2,3D), \
|
||||
V(CD,EB,EB,26), V(4E,27,27,69), V(7F,B2,B2,CD), V(EA,75,75,9F), \
|
||||
V(12,09,09,1B), V(1D,83,83,9E), V(58,2C,2C,74), V(34,1A,1A,2E), \
|
||||
V(36,1B,1B,2D), V(DC,6E,6E,B2), V(B4,5A,5A,EE), V(5B,A0,A0,FB), \
|
||||
V(A4,52,52,F6), V(76,3B,3B,4D), V(B7,D6,D6,61), V(7D,B3,B3,CE), \
|
||||
V(52,29,29,7B), V(DD,E3,E3,3E), V(5E,2F,2F,71), V(13,84,84,97), \
|
||||
V(A6,53,53,F5), V(B9,D1,D1,68), V(00,00,00,00), V(C1,ED,ED,2C), \
|
||||
V(40,20,20,60), V(E3,FC,FC,1F), V(79,B1,B1,C8), V(B6,5B,5B,ED), \
|
||||
V(D4,6A,6A,BE), V(8D,CB,CB,46), V(67,BE,BE,D9), V(72,39,39,4B), \
|
||||
V(94,4A,4A,DE), V(98,4C,4C,D4), V(B0,58,58,E8), V(85,CF,CF,4A), \
|
||||
V(BB,D0,D0,6B), V(C5,EF,EF,2A), V(4F,AA,AA,E5), V(ED,FB,FB,16), \
|
||||
V(86,43,43,C5), V(9A,4D,4D,D7), V(66,33,33,55), V(11,85,85,94), \
|
||||
V(8A,45,45,CF), V(E9,F9,F9,10), V(04,02,02,06), V(FE,7F,7F,81), \
|
||||
V(A0,50,50,F0), V(78,3C,3C,44), V(25,9F,9F,BA), V(4B,A8,A8,E3), \
|
||||
V(A2,51,51,F3), V(5D,A3,A3,FE), V(80,40,40,C0), V(05,8F,8F,8A), \
|
||||
V(3F,92,92,AD), V(21,9D,9D,BC), V(70,38,38,48), V(F1,F5,F5,04), \
|
||||
V(63,BC,BC,DF), V(77,B6,B6,C1), V(AF,DA,DA,75), V(42,21,21,63), \
|
||||
V(20,10,10,30), V(E5,FF,FF,1A), V(FD,F3,F3,0E), V(BF,D2,D2,6D), \
|
||||
V(81,CD,CD,4C), V(18,0C,0C,14), V(26,13,13,35), V(C3,EC,EC,2F), \
|
||||
V(BE,5F,5F,E1), V(35,97,97,A2), V(88,44,44,CC), V(2E,17,17,39), \
|
||||
V(93,C4,C4,57), V(55,A7,A7,F2), V(FC,7E,7E,82), V(7A,3D,3D,47), \
|
||||
V(C8,64,64,AC), V(BA,5D,5D,E7), V(32,19,19,2B), V(E6,73,73,95), \
|
||||
V(C0,60,60,A0), V(19,81,81,98), V(9E,4F,4F,D1), V(A3,DC,DC,7F), \
|
||||
V(44,22,22,66), V(54,2A,2A,7E), V(3B,90,90,AB), V(0B,88,88,83), \
|
||||
V(8C,46,46,CA), V(C7,EE,EE,29), V(6B,B8,B8,D3), V(28,14,14,3C), \
|
||||
V(A7,DE,DE,79), V(BC,5E,5E,E2), V(16,0B,0B,1D), V(AD,DB,DB,76), \
|
||||
V(DB,E0,E0,3B), V(64,32,32,56), V(74,3A,3A,4E), V(14,0A,0A,1E), \
|
||||
V(92,49,49,DB), V(0C,06,06,0A), V(48,24,24,6C), V(B8,5C,5C,E4), \
|
||||
V(9F,C2,C2,5D), V(BD,D3,D3,6E), V(43,AC,AC,EF), V(C4,62,62,A6), \
|
||||
V(39,91,91,A8), V(31,95,95,A4), V(D3,E4,E4,37), V(F2,79,79,8B), \
|
||||
V(D5,E7,E7,32), V(8B,C8,C8,43), V(6E,37,37,59), V(DA,6D,6D,B7), \
|
||||
V(01,8D,8D,8C), V(B1,D5,D5,64), V(9C,4E,4E,D2), V(49,A9,A9,E0), \
|
||||
V(D8,6C,6C,B4), V(AC,56,56,FA), V(F3,F4,F4,07), V(CF,EA,EA,25), \
|
||||
V(CA,65,65,AF), V(F4,7A,7A,8E), V(47,AE,AE,E9), V(10,08,08,18), \
|
||||
V(6F,BA,BA,D5), V(F0,78,78,88), V(4A,25,25,6F), V(5C,2E,2E,72), \
|
||||
V(38,1C,1C,24), V(57,A6,A6,F1), V(73,B4,B4,C7), V(97,C6,C6,51), \
|
||||
V(CB,E8,E8,23), V(A1,DD,DD,7C), V(E8,74,74,9C), V(3E,1F,1F,21), \
|
||||
V(96,4B,4B,DD), V(61,BD,BD,DC), V(0D,8B,8B,86), V(0F,8A,8A,85), \
|
||||
V(E0,70,70,90), V(7C,3E,3E,42), V(71,B5,B5,C4), V(CC,66,66,AA), \
|
||||
V(90,48,48,D8), V(06,03,03,05), V(F7,F6,F6,01), V(1C,0E,0E,12), \
|
||||
V(C2,61,61,A3), V(6A,35,35,5F), V(AE,57,57,F9), V(69,B9,B9,D0), \
|
||||
V(17,86,86,91), V(99,C1,C1,58), V(3A,1D,1D,27), V(27,9E,9E,B9), \
|
||||
V(D9,E1,E1,38), V(EB,F8,F8,13), V(2B,98,98,B3), V(22,11,11,33), \
|
||||
V(D2,69,69,BB), V(A9,D9,D9,70), V(07,8E,8E,89), V(33,94,94,A7), \
|
||||
V(2D,9B,9B,B6), V(3C,1E,1E,22), V(15,87,87,92), V(C9,E9,E9,20), \
|
||||
V(87,CE,CE,49), V(AA,55,55,FF), V(50,28,28,78), V(A5,DF,DF,7A), \
|
||||
V(03,8C,8C,8F), V(59,A1,A1,F8), V(09,89,89,80), V(1A,0D,0D,17), \
|
||||
V(65,BF,BF,DA), V(D7,E6,E6,31), V(84,42,42,C6), V(D0,68,68,B8), \
|
||||
V(82,41,41,C3), V(29,99,99,B0), V(5A,2D,2D,77), V(1E,0F,0F,11), \
|
||||
V(7B,B0,B0,CB), V(A8,54,54,FC), V(6D,BB,BB,D6), V(2C,16,16,3A)
|
||||
|
||||
#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
|
||||
#define V(a,b,c,d) 0x##a##b##c##d
|
||||
#else
|
||||
#define V(a,b,c,d) 0x##d##c##b##a
|
||||
#endif
|
||||
static unsigned int FT0[256] = { FT };
|
||||
#undef V
|
||||
|
||||
#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
|
||||
#define V(a,b,c,d) 0x##d##a##b##c
|
||||
#else
|
||||
#define V(a,b,c,d) 0x##c##b##a##d
|
||||
#endif
|
||||
static unsigned int FT1[256] = { FT };
|
||||
#undef V
|
||||
|
||||
#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
|
||||
#define V(a,b,c,d) 0x##c##d##a##b
|
||||
#else
|
||||
#define V(a,b,c,d) 0x##b##a##d##c
|
||||
#endif
|
||||
static unsigned int FT2[256] = { FT };
|
||||
#undef V
|
||||
|
||||
#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
|
||||
#define V(a,b,c,d) 0x##b##c##d##a
|
||||
#else
|
||||
#define V(a,b,c,d) 0x##a##d##c##b
|
||||
#endif
|
||||
static unsigned int FT3[256] = { FT };
|
||||
#undef V
|
||||
|
||||
#undef FT
|
||||
|
||||
|
||||
#define FSbData \
|
||||
{ \
|
||||
0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, \
|
||||
0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76, \
|
||||
0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, \
|
||||
0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0, \
|
||||
0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, \
|
||||
0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15, \
|
||||
0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, \
|
||||
0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75, \
|
||||
0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, \
|
||||
0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84, \
|
||||
0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, \
|
||||
0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF, \
|
||||
0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, \
|
||||
0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8, \
|
||||
0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5, \
|
||||
0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2, \
|
||||
0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, \
|
||||
0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73, \
|
||||
0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, \
|
||||
0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB, \
|
||||
0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, \
|
||||
0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79, \
|
||||
0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9, \
|
||||
0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08, \
|
||||
0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, \
|
||||
0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A, \
|
||||
0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, \
|
||||
0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E, \
|
||||
0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94, \
|
||||
0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF, \
|
||||
0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, \
|
||||
0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16 \
|
||||
}
|
||||
|
||||
static unsigned int FSb[256] = FSbData;
|
||||
#undef FSbData
|
||||
|
||||
#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
|
||||
#define AES_ROUND1(TAB,I,X0,X1,X2,X3,Y0,Y1,Y2,Y3) \
|
||||
{ \
|
||||
X0 = FT0[( Y0 >> 24 ) &0xFF ]; \
|
||||
X0 ^= rotr(FT0[( Y1 >> 16 ) &0xFF ],8); \
|
||||
X0 ^= rotr(FT0[( Y2 >> 8 ) &0xFF ],16); \
|
||||
X0 ^= rotr(FT0[( Y3 ) &0xFF ],24); \
|
||||
\
|
||||
X1 = FT0[( Y1 >> 24 ) &0xFF ]; \
|
||||
X1 ^= rotr(FT0[( Y2 >> 16 ) &0xFF ],8); \
|
||||
X1 ^= rotr(FT0[( Y3 >> 8 ) &0xFF ],16); \
|
||||
X1 ^= rotr(FT0[( Y0 ) &0xFF ],24); \
|
||||
\
|
||||
X2 = FT0[( Y2 >> 24 ) &0xFF ]; \
|
||||
X2 ^= rotr(FT0[( Y3 >> 16 ) &0xFF ],8); \
|
||||
X2 ^= rotr(FT0[( Y0 >> 8 ) &0xFF ],16); \
|
||||
X2 ^= rotr(FT0[( Y1 ) &0xFF ],24); \
|
||||
\
|
||||
X3 = FT0[( Y3 >> 24 ) &0xFF ]; \
|
||||
X3 ^= rotr(FT0[( Y0 >> 16 ) &0xFF ],8); \
|
||||
X3 ^= rotr(FT0[( Y1 >> 8 ) &0xFF ],16); \
|
||||
X3 ^= rotr(FT0[( Y2 ) &0xFF ],24); \
|
||||
\
|
||||
X0 ^= TAB[I++]; \
|
||||
X1 ^= TAB[I++]; \
|
||||
X2 ^= TAB[I++]; \
|
||||
X3 ^= TAB[I++]; \
|
||||
}
|
||||
#define AES_ROUND2(TAB,I,X0,X1,X2,X3,Y0,Y1,Y2,Y3) \
|
||||
{ \
|
||||
X0 = FT0[( Y0 >> 24 ) &0xFF ]; \
|
||||
X0 ^= FT1[( Y1 >> 16 ) &0xFF ]; \
|
||||
X0 ^= rotr(FT0[( Y2 >> 8 ) &0xFF ],16); \
|
||||
X0 ^= rotr(FT1[( Y3 ) &0xFF ],16); \
|
||||
\
|
||||
X1 = FT0[( Y1 >> 24 ) &0xFF ]; \
|
||||
X1 ^= FT1[( Y2 >> 16 ) &0xFF ]; \
|
||||
X1 ^= rotr(FT0[( Y3 >> 8 ) &0xFF ],16); \
|
||||
X1 ^= rotr(FT1[( Y0 ) &0xFF ],16); \
|
||||
\
|
||||
X2 = FT0[( Y2 >> 24 ) &0xFF ]; \
|
||||
X2 ^= FT1[( Y3 >> 16 ) &0xFF ]; \
|
||||
X2 ^= rotr(FT0[( Y0 >> 8 ) &0xFF ],16); \
|
||||
X2 ^= rotr(FT1[( Y1 ) &0xFF ],16); \
|
||||
\
|
||||
X3 = FT0[( Y3 >> 24 ) &0xFF ]; \
|
||||
X3 ^= FT1[( Y0 >> 16 ) &0xFF ]; \
|
||||
X3 ^= rotr(FT0[( Y1 >> 8 ) &0xFF ],16); \
|
||||
X3 ^= rotr(FT1[( Y2 ) &0xFF ],16); \
|
||||
\
|
||||
X0 ^= TAB[I++]; \
|
||||
X1 ^= TAB[I++]; \
|
||||
X2 ^= TAB[I++]; \
|
||||
X3 ^= TAB[I++]; \
|
||||
}
|
||||
#define AES_ROUND4(TAB,I,X0,X1,X2,X3,Y0,Y1,Y2,Y3) \
|
||||
{ \
|
||||
X0 = FT0[( Y0 >> 24 ) &0xFF ]; \
|
||||
X0 ^= FT1[( Y1 >> 16 ) &0xFF ]; \
|
||||
X0 ^= FT2[( Y2 >> 8 ) &0xFF ]; \
|
||||
X0 ^= FT3[( Y3 ) &0xFF ]; \
|
||||
\
|
||||
X1 = FT0[( Y1 >> 24 ) &0xFF ]; \
|
||||
X1 ^= FT1[( Y2 >> 16 ) &0xFF ]; \
|
||||
X1 ^= FT2[( Y3 >> 8 ) &0xFF ]; \
|
||||
X1 ^= FT3[( Y0 ) &0xFF ]; \
|
||||
\
|
||||
X2 = FT0[( Y2 >> 24 ) &0xFF ]; \
|
||||
X2 ^= FT1[( Y3 >> 16 ) &0xFF ]; \
|
||||
X2 ^= FT2[( Y0 >> 8 ) &0xFF ]; \
|
||||
X2 ^= FT3[( Y1 ) &0xFF ]; \
|
||||
\
|
||||
X3 = FT0[( Y3 >> 24 ) &0xFF ]; \
|
||||
X3 ^= FT1[( Y0 >> 16 ) &0xFF ]; \
|
||||
X3 ^= FT2[( Y1 >> 8 ) &0xFF ]; \
|
||||
X3 ^= FT3[( Y2 ) &0xFF ]; \
|
||||
\
|
||||
X0 ^= TAB[I++]; \
|
||||
X1 ^= TAB[I++]; \
|
||||
X2 ^= TAB[I++]; \
|
||||
X3 ^= TAB[I++]; \
|
||||
}
|
||||
#else
|
||||
#define AES_ROUND1(TAB,I,X0,X1,X2,X3,Y0,Y1,Y2,Y3) \
|
||||
{ \
|
||||
X0 = FT0[( Y0 ) &0xFF ]; \
|
||||
X0 ^= rotr(FT0[( Y1 >> 8 ) &0xFF ],24); \
|
||||
X0 ^= rotr(FT0[( Y2 >> 16 ) &0xFF ],16); \
|
||||
X0 ^= rotr(FT0[( Y3 >> 24 ) &0xFF ],8); \
|
||||
\
|
||||
X1 = FT0[( Y1 ) &0xFF ]; \
|
||||
X1 ^= rotr(FT0[( Y2 >> 8 ) &0xFF ],24); \
|
||||
X1 ^= rotr(FT0[( Y3 >> 16 ) &0xFF ],16); \
|
||||
X1 ^= rotr(FT0[( Y0 >> 24 ) &0xFF ],8); \
|
||||
\
|
||||
X2 = FT0[( Y2 ) &0xFF ]; \
|
||||
X2 ^= rotr(FT0[( Y3 >> 8 ) &0xFF ],24); \
|
||||
X2 ^= rotr(FT0[( Y0 >> 16 ) &0xFF ],16); \
|
||||
X2 ^= rotr(FT0[( Y1 >> 24 ) &0xFF ],8); \
|
||||
\
|
||||
X3 = FT0[( Y3 ) &0xFF ]; \
|
||||
X3 ^= rotr(FT0[( Y0 >> 8 ) &0xFF ],24); \
|
||||
X3 ^= rotr(FT0[( Y1 >> 16 ) &0xFF ],16); \
|
||||
X3 ^= rotr(FT0[( Y2 >> 24 ) &0xFF ],8); \
|
||||
\
|
||||
X0 ^= (TAB[I++]); \
|
||||
X1 ^= (TAB[I++]); \
|
||||
X2 ^= (TAB[I++]); \
|
||||
X3 ^= (TAB[I++]); \
|
||||
}
|
||||
#define AES_ROUND2(TAB,I,X0,X1,X2,X3,Y0,Y1,Y2,Y3) \
|
||||
{ \
|
||||
X0 = FT0[( Y0 ) &0xFF ]; \
|
||||
X0 ^= FT1[( Y1 >> 8 ) &0xFF ]; \
|
||||
X0 ^= rotr(FT0[( Y2 >> 16 ) &0xFF ],16); \
|
||||
X0 ^= rotr(FT1[( Y3 >> 24 ) &0xFF ],16); \
|
||||
\
|
||||
X1 = FT0[( Y1 ) &0xFF ]; \
|
||||
X1 ^= FT1[( Y2 >> 8 ) &0xFF ]; \
|
||||
X1 ^= rotr(FT0[( Y3 >> 16 ) &0xFF ],16); \
|
||||
X1 ^= rotr(FT1[( Y0 >> 24 ) &0xFF ],16); \
|
||||
\
|
||||
X2 = FT0[( Y2 ) &0xFF ]; \
|
||||
X2 ^= FT1[( Y3 >> 8 ) &0xFF ]; \
|
||||
X2 ^= rotr(FT0[( Y0 >> 16 ) &0xFF ],16); \
|
||||
X2 ^= rotr(FT1[( Y1 >> 24 ) &0xFF ],16); \
|
||||
\
|
||||
X3 = FT0[( Y3 ) &0xFF ]; \
|
||||
X3 ^= FT1[( Y0 >> 8 ) &0xFF ]; \
|
||||
X3 ^= rotr(FT0[( Y1 >> 16 ) &0xFF ],16); \
|
||||
X3 ^= rotr(FT1[( Y2 >> 24 ) &0xFF ],16); \
|
||||
\
|
||||
X0 ^= (TAB[I++]); \
|
||||
X1 ^= (TAB[I++]); \
|
||||
X2 ^= (TAB[I++]); \
|
||||
X3 ^= (TAB[I++]); \
|
||||
}
|
||||
#define AES_ROUND4(TAB,I,X0,X1,X2,X3,Y0,Y1,Y2,Y3) \
|
||||
{ \
|
||||
X0 = FT0[( Y0 ) &0xFF ]; \
|
||||
X0 ^= FT1[( Y1 >> 8 ) &0xFF ]; \
|
||||
X0 ^= FT2[( Y2 >> 16 ) &0xFF ]; \
|
||||
X0 ^= FT3[( Y3 >> 24 ) &0xFF ]; \
|
||||
\
|
||||
X1 = FT0[( Y1 ) &0xFF ]; \
|
||||
X1 ^= FT1[( Y2 >> 8 ) &0xFF ]; \
|
||||
X1 ^= FT2[( Y3 >> 16 ) &0xFF ]; \
|
||||
X1 ^= FT3[( Y0 >> 24 ) &0xFF ]; \
|
||||
\
|
||||
X2 = FT0[( Y2 ) &0xFF ]; \
|
||||
X2 ^= FT1[( Y3 >> 8 ) &0xFF ]; \
|
||||
X2 ^= FT2[( Y0 >> 16 ) &0xFF ]; \
|
||||
X2 ^= FT3[( Y1 >> 24 ) &0xFF ]; \
|
||||
\
|
||||
X3 = FT0[( Y3 ) &0xFF ]; \
|
||||
X3 ^= FT1[( Y0 >> 8 ) &0xFF ]; \
|
||||
X3 ^= FT2[( Y1 >> 16 ) &0xFF ]; \
|
||||
X3 ^= FT3[( Y2 >> 24 ) &0xFF ]; \
|
||||
\
|
||||
X0 ^= (TAB[I++]); \
|
||||
X1 ^= (TAB[I++]); \
|
||||
X2 ^= (TAB[I++]); \
|
||||
X3 ^= (TAB[I++]); \
|
||||
}
|
||||
#endif
|
||||
|
||||
#define RSbData \
|
||||
{ \
|
||||
0x52, 0x09, 0x6A, 0xD5, 0x30, 0x36, 0xA5, 0x38, \
|
||||
0xBF, 0x40, 0xA3, 0x9E, 0x81, 0xF3, 0xD7, 0xFB, \
|
||||
0x7C, 0xE3, 0x39, 0x82, 0x9B, 0x2F, 0xFF, 0x87, \
|
||||
0x34, 0x8E, 0x43, 0x44, 0xC4, 0xDE, 0xE9, 0xCB, \
|
||||
0x54, 0x7B, 0x94, 0x32, 0xA6, 0xC2, 0x23, 0x3D, \
|
||||
0xEE, 0x4C, 0x95, 0x0B, 0x42, 0xFA, 0xC3, 0x4E, \
|
||||
0x08, 0x2E, 0xA1, 0x66, 0x28, 0xD9, 0x24, 0xB2, \
|
||||
0x76, 0x5B, 0xA2, 0x49, 0x6D, 0x8B, 0xD1, 0x25, \
|
||||
0x72, 0xF8, 0xF6, 0x64, 0x86, 0x68, 0x98, 0x16, \
|
||||
0xD4, 0xA4, 0x5C, 0xCC, 0x5D, 0x65, 0xB6, 0x92, \
|
||||
0x6C, 0x70, 0x48, 0x50, 0xFD, 0xED, 0xB9, 0xDA, \
|
||||
0x5E, 0x15, 0x46, 0x57, 0xA7, 0x8D, 0x9D, 0x84, \
|
||||
0x90, 0xD8, 0xAB, 0x00, 0x8C, 0xBC, 0xD3, 0x0A, \
|
||||
0xF7, 0xE4, 0x58, 0x05, 0xB8, 0xB3, 0x45, 0x06, \
|
||||
0xD0, 0x2C, 0x1E, 0x8F, 0xCA, 0x3F, 0x0F, 0x02, \
|
||||
0xC1, 0xAF, 0xBD, 0x03, 0x01, 0x13, 0x8A, 0x6B, \
|
||||
0x3A, 0x91, 0x11, 0x41, 0x4F, 0x67, 0xDC, 0xEA, \
|
||||
0x97, 0xF2, 0xCF, 0xCE, 0xF0, 0xB4, 0xE6, 0x73, \
|
||||
0x96, 0xAC, 0x74, 0x22, 0xE7, 0xAD, 0x35, 0x85, \
|
||||
0xE2, 0xF9, 0x37, 0xE8, 0x1C, 0x75, 0xDF, 0x6E, \
|
||||
0x47, 0xF1, 0x1A, 0x71, 0x1D, 0x29, 0xC5, 0x89, \
|
||||
0x6F, 0xB7, 0x62, 0x0E, 0xAA, 0x18, 0xBE, 0x1B, \
|
||||
0xFC, 0x56, 0x3E, 0x4B, 0xC6, 0xD2, 0x79, 0x20, \
|
||||
0x9A, 0xDB, 0xC0, 0xFE, 0x78, 0xCD, 0x5A, 0xF4, \
|
||||
0x1F, 0xDD, 0xA8, 0x33, 0x88, 0x07, 0xC7, 0x31, \
|
||||
0xB1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xEC, 0x5F, \
|
||||
0x60, 0x51, 0x7F, 0xA9, 0x19, 0xB5, 0x4A, 0x0D, \
|
||||
0x2D, 0xE5, 0x7A, 0x9F, 0x93, 0xC9, 0x9C, 0xEF, \
|
||||
0xA0, 0xE0, 0x3B, 0x4D, 0xAE, 0x2A, 0xF5, 0xB0, \
|
||||
0xC8, 0xEB, 0xBB, 0x3C, 0x83, 0x53, 0x99, 0x61, \
|
||||
0x17, 0x2B, 0x04, 0x7E, 0xBA, 0x77, 0xD6, 0x26, \
|
||||
0xE1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0C, 0x7D \
|
||||
}
|
||||
|
||||
static unsigned int RSb[256] = RSbData;
|
||||
#undef RSbData
|
||||
|
||||
#define RT \
|
||||
V(51,F4,A7,50), V(7E,41,65,53), V(1A,17,A4,C3), V(3A,27,5E,96), \
|
||||
V(3B,AB,6B,CB), V(1F,9D,45,F1), V(AC,FA,58,AB), V(4B,E3,03,93), \
|
||||
V(20,30,FA,55), V(AD,76,6D,F6), V(88,CC,76,91), V(F5,02,4C,25), \
|
||||
V(4F,E5,D7,FC), V(C5,2A,CB,D7), V(26,35,44,80), V(B5,62,A3,8F), \
|
||||
V(DE,B1,5A,49), V(25,BA,1B,67), V(45,EA,0E,98), V(5D,FE,C0,E1), \
|
||||
V(C3,2F,75,02), V(81,4C,F0,12), V(8D,46,97,A3), V(6B,D3,F9,C6), \
|
||||
V(03,8F,5F,E7), V(15,92,9C,95), V(BF,6D,7A,EB), V(95,52,59,DA), \
|
||||
V(D4,BE,83,2D), V(58,74,21,D3), V(49,E0,69,29), V(8E,C9,C8,44), \
|
||||
V(75,C2,89,6A), V(F4,8E,79,78), V(99,58,3E,6B), V(27,B9,71,DD), \
|
||||
V(BE,E1,4F,B6), V(F0,88,AD,17), V(C9,20,AC,66), V(7D,CE,3A,B4), \
|
||||
V(63,DF,4A,18), V(E5,1A,31,82), V(97,51,33,60), V(62,53,7F,45), \
|
||||
V(B1,64,77,E0), V(BB,6B,AE,84), V(FE,81,A0,1C), V(F9,08,2B,94), \
|
||||
V(70,48,68,58), V(8F,45,FD,19), V(94,DE,6C,87), V(52,7B,F8,B7), \
|
||||
V(AB,73,D3,23), V(72,4B,02,E2), V(E3,1F,8F,57), V(66,55,AB,2A), \
|
||||
V(B2,EB,28,07), V(2F,B5,C2,03), V(86,C5,7B,9A), V(D3,37,08,A5), \
|
||||
V(30,28,87,F2), V(23,BF,A5,B2), V(02,03,6A,BA), V(ED,16,82,5C), \
|
||||
V(8A,CF,1C,2B), V(A7,79,B4,92), V(F3,07,F2,F0), V(4E,69,E2,A1), \
|
||||
V(65,DA,F4,CD), V(06,05,BE,D5), V(D1,34,62,1F), V(C4,A6,FE,8A), \
|
||||
V(34,2E,53,9D), V(A2,F3,55,A0), V(05,8A,E1,32), V(A4,F6,EB,75), \
|
||||
V(0B,83,EC,39), V(40,60,EF,AA), V(5E,71,9F,06), V(BD,6E,10,51), \
|
||||
V(3E,21,8A,F9), V(96,DD,06,3D), V(DD,3E,05,AE), V(4D,E6,BD,46), \
|
||||
V(91,54,8D,B5), V(71,C4,5D,05), V(04,06,D4,6F), V(60,50,15,FF), \
|
||||
V(19,98,FB,24), V(D6,BD,E9,97), V(89,40,43,CC), V(67,D9,9E,77), \
|
||||
V(B0,E8,42,BD), V(07,89,8B,88), V(E7,19,5B,38), V(79,C8,EE,DB), \
|
||||
V(A1,7C,0A,47), V(7C,42,0F,E9), V(F8,84,1E,C9), V(00,00,00,00), \
|
||||
V(09,80,86,83), V(32,2B,ED,48), V(1E,11,70,AC), V(6C,5A,72,4E), \
|
||||
V(FD,0E,FF,FB), V(0F,85,38,56), V(3D,AE,D5,1E), V(36,2D,39,27), \
|
||||
V(0A,0F,D9,64), V(68,5C,A6,21), V(9B,5B,54,D1), V(24,36,2E,3A), \
|
||||
V(0C,0A,67,B1), V(93,57,E7,0F), V(B4,EE,96,D2), V(1B,9B,91,9E), \
|
||||
V(80,C0,C5,4F), V(61,DC,20,A2), V(5A,77,4B,69), V(1C,12,1A,16), \
|
||||
V(E2,93,BA,0A), V(C0,A0,2A,E5), V(3C,22,E0,43), V(12,1B,17,1D), \
|
||||
V(0E,09,0D,0B), V(F2,8B,C7,AD), V(2D,B6,A8,B9), V(14,1E,A9,C8), \
|
||||
V(57,F1,19,85), V(AF,75,07,4C), V(EE,99,DD,BB), V(A3,7F,60,FD), \
|
||||
V(F7,01,26,9F), V(5C,72,F5,BC), V(44,66,3B,C5), V(5B,FB,7E,34), \
|
||||
V(8B,43,29,76), V(CB,23,C6,DC), V(B6,ED,FC,68), V(B8,E4,F1,63), \
|
||||
V(D7,31,DC,CA), V(42,63,85,10), V(13,97,22,40), V(84,C6,11,20), \
|
||||
V(85,4A,24,7D), V(D2,BB,3D,F8), V(AE,F9,32,11), V(C7,29,A1,6D), \
|
||||
V(1D,9E,2F,4B), V(DC,B2,30,F3), V(0D,86,52,EC), V(77,C1,E3,D0), \
|
||||
V(2B,B3,16,6C), V(A9,70,B9,99), V(11,94,48,FA), V(47,E9,64,22), \
|
||||
V(A8,FC,8C,C4), V(A0,F0,3F,1A), V(56,7D,2C,D8), V(22,33,90,EF), \
|
||||
V(87,49,4E,C7), V(D9,38,D1,C1), V(8C,CA,A2,FE), V(98,D4,0B,36), \
|
||||
V(A6,F5,81,CF), V(A5,7A,DE,28), V(DA,B7,8E,26), V(3F,AD,BF,A4), \
|
||||
V(2C,3A,9D,E4), V(50,78,92,0D), V(6A,5F,CC,9B), V(54,7E,46,62), \
|
||||
V(F6,8D,13,C2), V(90,D8,B8,E8), V(2E,39,F7,5E), V(82,C3,AF,F5), \
|
||||
V(9F,5D,80,BE), V(69,D0,93,7C), V(6F,D5,2D,A9), V(CF,25,12,B3), \
|
||||
V(C8,AC,99,3B), V(10,18,7D,A7), V(E8,9C,63,6E), V(DB,3B,BB,7B), \
|
||||
V(CD,26,78,09), V(6E,59,18,F4), V(EC,9A,B7,01), V(83,4F,9A,A8), \
|
||||
V(E6,95,6E,65), V(AA,FF,E6,7E), V(21,BC,CF,08), V(EF,15,E8,E6), \
|
||||
V(BA,E7,9B,D9), V(4A,6F,36,CE), V(EA,9F,09,D4), V(29,B0,7C,D6), \
|
||||
V(31,A4,B2,AF), V(2A,3F,23,31), V(C6,A5,94,30), V(35,A2,66,C0), \
|
||||
V(74,4E,BC,37), V(FC,82,CA,A6), V(E0,90,D0,B0), V(33,A7,D8,15), \
|
||||
V(F1,04,98,4A), V(41,EC,DA,F7), V(7F,CD,50,0E), V(17,91,F6,2F), \
|
||||
V(76,4D,D6,8D), V(43,EF,B0,4D), V(CC,AA,4D,54), V(E4,96,04,DF), \
|
||||
V(9E,D1,B5,E3), V(4C,6A,88,1B), V(C1,2C,1F,B8), V(46,65,51,7F), \
|
||||
V(9D,5E,EA,04), V(01,8C,35,5D), V(FA,87,74,73), V(FB,0B,41,2E), \
|
||||
V(B3,67,1D,5A), V(92,DB,D2,52), V(E9,10,56,33), V(6D,D6,47,13), \
|
||||
V(9A,D7,61,8C), V(37,A1,0C,7A), V(59,F8,14,8E), V(EB,13,3C,89), \
|
||||
V(CE,A9,27,EE), V(B7,61,C9,35), V(E1,1C,E5,ED), V(7A,47,B1,3C), \
|
||||
V(9C,D2,DF,59), V(55,F2,73,3F), V(18,14,CE,79), V(73,C7,37,BF), \
|
||||
V(53,F7,CD,EA), V(5F,FD,AA,5B), V(DF,3D,6F,14), V(78,44,DB,86), \
|
||||
V(CA,AF,F3,81), V(B9,68,C4,3E), V(38,24,34,2C), V(C2,A3,40,5F), \
|
||||
V(16,1D,C3,72), V(BC,E2,25,0C), V(28,3C,49,8B), V(FF,0D,95,41), \
|
||||
V(39,A8,01,71), V(08,0C,B3,DE), V(D8,B4,E4,9C), V(64,56,C1,90), \
|
||||
V(7B,CB,84,61), V(D5,32,B6,70), V(48,6C,5C,74), V(D0,B8,57,42)
|
||||
|
||||
#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
|
||||
#define V(a,b,c,d) 0x##a##b##c##d
|
||||
#else
|
||||
#define V(a,b,c,d) 0x##d##c##b##a
|
||||
#endif
|
||||
static unsigned int RT0[256] = { RT };
|
||||
#undef V
|
||||
#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
|
||||
#define V(a,b,c,d) 0x##d##a##b##c
|
||||
#else
|
||||
#define V(a,b,c,d) 0x##c##b##a##d
|
||||
#endif
|
||||
static unsigned int RT1[256] = { RT };
|
||||
#undef V
|
||||
#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
|
||||
#define V(a,b,c,d) 0x##c##d##a##b
|
||||
#else
|
||||
#define V(a,b,c,d) 0x##b##a##d##c
|
||||
#endif
|
||||
static unsigned int RT2[256] = { RT };
|
||||
#undef V
|
||||
#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
|
||||
#define V(a,b,c,d) 0x##b##c##d##a
|
||||
#else
|
||||
#define V(a,b,c,d) 0x##a##d##c##b
|
||||
#endif
|
||||
static unsigned int RT3[256] = { RT };
|
||||
#undef V
|
||||
#undef RT
|
||||
|
||||
#define KT0Data \
|
||||
{ \
|
||||
V(00,00,00,00) ,V(0E,09,0D,0B) ,V(1C,12,1A,16) ,V(12,1B,17,1D) , \
|
||||
V(38,24,34,2C) ,V(36,2D,39,27) ,V(24,36,2E,3A) ,V(2A,3F,23,31) , \
|
||||
V(70,48,68,58) ,V(7E,41,65,53) ,V(6C,5A,72,4E) ,V(62,53,7F,45) , \
|
||||
V(48,6C,5C,74) ,V(46,65,51,7F) ,V(54,7E,46,62) ,V(5A,77,4B,69) , \
|
||||
V(E0,90,D0,B0) ,V(EE,99,DD,BB) ,V(FC,82,CA,A6) ,V(F2,8B,C7,AD) , \
|
||||
V(D8,B4,E4,9C) ,V(D6,BD,E9,97) ,V(C4,A6,FE,8A) ,V(CA,AF,F3,81) , \
|
||||
V(90,D8,B8,E8) ,V(9E,D1,B5,E3) ,V(8C,CA,A2,FE) ,V(82,C3,AF,F5) , \
|
||||
V(A8,FC,8C,C4) ,V(A6,F5,81,CF) ,V(B4,EE,96,D2) ,V(BA,E7,9B,D9) , \
|
||||
V(DB,3B,BB,7B) ,V(D5,32,B6,70) ,V(C7,29,A1,6D) ,V(C9,20,AC,66) , \
|
||||
V(E3,1F,8F,57) ,V(ED,16,82,5C) ,V(FF,0D,95,41) ,V(F1,04,98,4A) , \
|
||||
V(AB,73,D3,23) ,V(A5,7A,DE,28) ,V(B7,61,C9,35) ,V(B9,68,C4,3E) , \
|
||||
V(93,57,E7,0F) ,V(9D,5E,EA,04) ,V(8F,45,FD,19) ,V(81,4C,F0,12) , \
|
||||
V(3B,AB,6B,CB) ,V(35,A2,66,C0) ,V(27,B9,71,DD) ,V(29,B0,7C,D6) , \
|
||||
V(03,8F,5F,E7) ,V(0D,86,52,EC) ,V(1F,9D,45,F1) ,V(11,94,48,FA) , \
|
||||
V(4B,E3,03,93) ,V(45,EA,0E,98) ,V(57,F1,19,85) ,V(59,F8,14,8E) , \
|
||||
V(73,C7,37,BF) ,V(7D,CE,3A,B4) ,V(6F,D5,2D,A9) ,V(61,DC,20,A2) , \
|
||||
V(AD,76,6D,F6) ,V(A3,7F,60,FD) ,V(B1,64,77,E0) ,V(BF,6D,7A,EB) , \
|
||||
V(95,52,59,DA) ,V(9B,5B,54,D1) ,V(89,40,43,CC) ,V(87,49,4E,C7) , \
|
||||
V(DD,3E,05,AE) ,V(D3,37,08,A5) ,V(C1,2C,1F,B8) ,V(CF,25,12,B3) , \
|
||||
V(E5,1A,31,82) ,V(EB,13,3C,89) ,V(F9,08,2B,94) ,V(F7,01,26,9F) , \
|
||||
V(4D,E6,BD,46) ,V(43,EF,B0,4D) ,V(51,F4,A7,50) ,V(5F,FD,AA,5B) , \
|
||||
V(75,C2,89,6A) ,V(7B,CB,84,61) ,V(69,D0,93,7C) ,V(67,D9,9E,77) , \
|
||||
V(3D,AE,D5,1E) ,V(33,A7,D8,15) ,V(21,BC,CF,08) ,V(2F,B5,C2,03) , \
|
||||
V(05,8A,E1,32) ,V(0B,83,EC,39) ,V(19,98,FB,24) ,V(17,91,F6,2F) , \
|
||||
V(76,4D,D6,8D) ,V(78,44,DB,86) ,V(6A,5F,CC,9B) ,V(64,56,C1,90) , \
|
||||
V(4E,69,E2,A1) ,V(40,60,EF,AA) ,V(52,7B,F8,B7) ,V(5C,72,F5,BC) , \
|
||||
V(06,05,BE,D5) ,V(08,0C,B3,DE) ,V(1A,17,A4,C3) ,V(14,1E,A9,C8) , \
|
||||
V(3E,21,8A,F9) ,V(30,28,87,F2) ,V(22,33,90,EF) ,V(2C,3A,9D,E4) , \
|
||||
V(96,DD,06,3D) ,V(98,D4,0B,36) ,V(8A,CF,1C,2B) ,V(84,C6,11,20) , \
|
||||
V(AE,F9,32,11) ,V(A0,F0,3F,1A) ,V(B2,EB,28,07) ,V(BC,E2,25,0C) , \
|
||||
V(E6,95,6E,65) ,V(E8,9C,63,6E) ,V(FA,87,74,73) ,V(F4,8E,79,78) , \
|
||||
V(DE,B1,5A,49) ,V(D0,B8,57,42) ,V(C2,A3,40,5F) ,V(CC,AA,4D,54) , \
|
||||
V(41,EC,DA,F7) ,V(4F,E5,D7,FC) ,V(5D,FE,C0,E1) ,V(53,F7,CD,EA) , \
|
||||
V(79,C8,EE,DB) ,V(77,C1,E3,D0) ,V(65,DA,F4,CD) ,V(6B,D3,F9,C6) , \
|
||||
V(31,A4,B2,AF) ,V(3F,AD,BF,A4) ,V(2D,B6,A8,B9) ,V(23,BF,A5,B2) , \
|
||||
V(09,80,86,83) ,V(07,89,8B,88) ,V(15,92,9C,95) ,V(1B,9B,91,9E) , \
|
||||
V(A1,7C,0A,47) ,V(AF,75,07,4C) ,V(BD,6E,10,51) ,V(B3,67,1D,5A) , \
|
||||
V(99,58,3E,6B) ,V(97,51,33,60) ,V(85,4A,24,7D) ,V(8B,43,29,76) , \
|
||||
V(D1,34,62,1F) ,V(DF,3D,6F,14) ,V(CD,26,78,09) ,V(C3,2F,75,02) , \
|
||||
V(E9,10,56,33) ,V(E7,19,5B,38) ,V(F5,02,4C,25) ,V(FB,0B,41,2E) , \
|
||||
V(9A,D7,61,8C) ,V(94,DE,6C,87) ,V(86,C5,7B,9A) ,V(88,CC,76,91) , \
|
||||
V(A2,F3,55,A0) ,V(AC,FA,58,AB) ,V(BE,E1,4F,B6) ,V(B0,E8,42,BD) , \
|
||||
V(EA,9F,09,D4) ,V(E4,96,04,DF) ,V(F6,8D,13,C2) ,V(F8,84,1E,C9) , \
|
||||
V(D2,BB,3D,F8) ,V(DC,B2,30,F3) ,V(CE,A9,27,EE) ,V(C0,A0,2A,E5) , \
|
||||
V(7A,47,B1,3C) ,V(74,4E,BC,37) ,V(66,55,AB,2A) ,V(68,5C,A6,21) , \
|
||||
V(42,63,85,10) ,V(4C,6A,88,1B) ,V(5E,71,9F,06) ,V(50,78,92,0D) , \
|
||||
V(0A,0F,D9,64) ,V(04,06,D4,6F) ,V(16,1D,C3,72) ,V(18,14,CE,79) , \
|
||||
V(32,2B,ED,48) ,V(3C,22,E0,43) ,V(2E,39,F7,5E) ,V(20,30,FA,55) , \
|
||||
V(EC,9A,B7,01) ,V(E2,93,BA,0A) ,V(F0,88,AD,17) ,V(FE,81,A0,1C) , \
|
||||
V(D4,BE,83,2D) ,V(DA,B7,8E,26) ,V(C8,AC,99,3B) ,V(C6,A5,94,30) , \
|
||||
V(9C,D2,DF,59) ,V(92,DB,D2,52) ,V(80,C0,C5,4F) ,V(8E,C9,C8,44) , \
|
||||
V(A4,F6,EB,75) ,V(AA,FF,E6,7E) ,V(B8,E4,F1,63) ,V(B6,ED,FC,68) , \
|
||||
V(0C,0A,67,B1) ,V(02,03,6A,BA) ,V(10,18,7D,A7) ,V(1E,11,70,AC) , \
|
||||
V(34,2E,53,9D) ,V(3A,27,5E,96) ,V(28,3C,49,8B) ,V(26,35,44,80) , \
|
||||
V(7C,42,0F,E9) ,V(72,4B,02,E2) ,V(60,50,15,FF) ,V(6E,59,18,F4) , \
|
||||
V(44,66,3B,C5) ,V(4A,6F,36,CE) ,V(58,74,21,D3) ,V(56,7D,2C,D8) , \
|
||||
V(37,A1,0C,7A) ,V(39,A8,01,71) ,V(2B,B3,16,6C) ,V(25,BA,1B,67) , \
|
||||
V(0F,85,38,56) ,V(01,8C,35,5D) ,V(13,97,22,40) ,V(1D,9E,2F,4B) , \
|
||||
V(47,E9,64,22) ,V(49,E0,69,29) ,V(5B,FB,7E,34) ,V(55,F2,73,3F) , \
|
||||
V(7F,CD,50,0E) ,V(71,C4,5D,05) ,V(63,DF,4A,18) ,V(6D,D6,47,13) , \
|
||||
V(D7,31,DC,CA) ,V(D9,38,D1,C1) ,V(CB,23,C6,DC) ,V(C5,2A,CB,D7) , \
|
||||
V(EF,15,E8,E6) ,V(E1,1C,E5,ED) ,V(F3,07,F2,F0) ,V(FD,0E,FF,FB) , \
|
||||
V(A7,79,B4,92) ,V(A9,70,B9,99) ,V(BB,6B,AE,84) ,V(B5,62,A3,8F) , \
|
||||
V(9F,5D,80,BE) ,V(91,54,8D,B5) ,V(83,4F,9A,A8) ,V(8D,46,97,A3) \
|
||||
}
|
||||
|
||||
#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
|
||||
#define V(a,b,c,d) 0x##a##b##c##d
|
||||
#else
|
||||
#define V(a,b,c,d) 0x##d##c##b##a
|
||||
#endif
|
||||
static unsigned int KT0[256] = KT0Data;
|
||||
#undef V
|
||||
#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
|
||||
#define V(a,b,c,d) 0x##d##a##b##c
|
||||
#else
|
||||
#define V(a,b,c,d) 0x##c##b##a##d
|
||||
#endif
|
||||
static unsigned int KT1[256] = KT0Data;
|
||||
#undef V
|
||||
#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
|
||||
#define V(a,b,c,d) 0x##c##d##a##b
|
||||
#else
|
||||
#define V(a,b,c,d) 0x##b##a##d##c
|
||||
#endif
|
||||
static unsigned int KT2[256] = KT0Data;
|
||||
#undef V
|
||||
#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
|
||||
#define V(a,b,c,d) 0x##b##c##d##a
|
||||
#else
|
||||
#define V(a,b,c,d) 0x##a##d##c##b
|
||||
#endif
|
||||
static unsigned int KT3[256] = KT0Data;
|
||||
#undef V
|
||||
#undef KT0Data
|
||||
|
||||
#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
|
||||
#define AES_ROUND1NODK_DEC(TAB,I,X0,X1,X2,X3,Y0,Y1,Y2,Y3) \
|
||||
{ \
|
||||
unsigned int ta0 = TAB[I]; \
|
||||
unsigned int ta1 = TAB[I+1]; \
|
||||
unsigned int ta2 = TAB[I+2]; \
|
||||
unsigned int ta3 = TAB[I+3]; \
|
||||
X0 = RT0[(Y0 >> 24) &0xFF ] ^ KT0[(ta0 >> 24) & 0xFF]; \
|
||||
X0 ^= rotr(RT0[(Y3 >> 16) &0xFF ] ^ KT0[(ta0 >> 16) & 0xFF],8); \
|
||||
X0 ^= rotr(RT0[(Y2 >> 8) &0xFF ] ^ KT0[(ta0 >> 8 ) & 0xFF],16); \
|
||||
X0 ^= rotr(RT0[(Y1 ) &0xFF ] ^ KT0[(ta0 ) & 0xFF],24); \
|
||||
\
|
||||
X1 = RT0[( Y1 >> 24 ) &0xFF ] ^ KT0[(ta1 >> 24) & 0xFF]; \
|
||||
X1 ^= rotr(RT0[( Y0 >> 16 ) &0xFF ] ^ KT0[(ta1 >> 16) & 0xFF],8); \
|
||||
X1 ^= rotr(RT0[( Y3 >> 8 ) &0xFF ] ^ KT0[(ta1 >> 8) & 0xFF],16); \
|
||||
X1 ^= rotr(RT0[( Y2 ) &0xFF ] ^ KT0[(ta1 ) & 0xFF],24); \
|
||||
\
|
||||
X2 = RT0[( Y2 >> 24 ) &0xFF ] ^ KT0[(ta2 >> 24) & 0xFF]; \
|
||||
X2 ^= rotr(RT0[( Y1 >> 16 ) &0xFF ] ^ KT0[(ta2 >> 16) & 0xFF],8); \
|
||||
X2 ^= rotr(RT0[( Y0 >> 8 ) &0xFF ] ^ KT0[(ta2 >> 8) & 0xFF],16); \
|
||||
X2 ^= rotr(RT0[( Y3 ) &0xFF ] ^ KT0[(ta2 ) & 0xFF],24); \
|
||||
\
|
||||
X3 = RT0[( Y3 >> 24 ) &0xFF ] ^ KT0[(ta3 >> 24) & 0xFF]; \
|
||||
X3 ^= rotr(RT0[( Y2 >> 16 ) &0xFF ] ^ KT0[(ta3 >> 16) & 0xFF],8); \
|
||||
X3 ^= rotr(RT0[( Y1 >> 8 ) &0xFF ] ^ KT0[(ta3 >> 8) & 0xFF],16); \
|
||||
X3 ^= rotr(RT0[( Y0 ) &0xFF ] ^ KT0[(ta3 ) & 0xFF],24); \
|
||||
}
|
||||
#define AES_ROUND2NODK_DEC(TAB,I,X0,X1,X2,X3,Y0,Y1,Y2,Y3) \
|
||||
{ \
|
||||
unsigned int ta0 = TAB[I]; \
|
||||
unsigned int ta1 = TAB[I+1]; \
|
||||
unsigned int ta2 = TAB[I+2]; \
|
||||
unsigned int ta3 = TAB[I+3]; \
|
||||
X0 = RT0[(Y0 >> 24) &0xFF ] ^ KT0[(ta0 >> 24) & 0xFF]; \
|
||||
X0 ^= RT1[(Y3 >> 16) &0xFF ] ^ KT1[(ta0 >> 16) & 0xFF]; \
|
||||
X0 ^= rotr(RT0[(Y2 >> 8) &0xFF ] ^ KT0[(ta0 >> 8 ) & 0xFF],16); \
|
||||
X0 ^= rotr(RT1[(Y1 ) &0xFF ] ^ KT1[(ta0 ) & 0xFF],16); \
|
||||
\
|
||||
X1 = RT0[( Y1 >> 24 ) &0xFF ] ^ KT0[(ta1 >> 24) & 0xFF]; \
|
||||
X1 ^= RT1[( Y0 >> 16 ) &0xFF ] ^ KT1[(ta1 >> 16) & 0xFF]; \
|
||||
X1 ^= rotr(RT0[( Y3 >> 8 ) &0xFF ] ^ KT0[(ta1 >> 8) & 0xFF],16); \
|
||||
X1 ^= rotr(RT1[( Y2 ) &0xFF ] ^ KT1[(ta1 ) & 0xFF],16); \
|
||||
\
|
||||
X2 = RT0[( Y2 >> 24 ) &0xFF ] ^ KT0[(ta2 >> 24) & 0xFF]; \
|
||||
X2 ^= RT1[( Y1 >> 16 ) &0xFF ] ^ KT1[(ta2 >> 16) & 0xFF]; \
|
||||
X2 ^= rotr(RT0[( Y0 >> 8 ) &0xFF ] ^ KT0[(ta2 >> 8) & 0xFF],16); \
|
||||
X2 ^= rotr(RT1[( Y3 ) &0xFF ] ^ KT1[(ta2 ) & 0xFF],16); \
|
||||
\
|
||||
X3 = RT0[( Y3 >> 24 ) &0xFF ] ^ KT0[(ta3 >> 24) & 0xFF]; \
|
||||
X3 ^= RT1[( Y2 >> 16 ) &0xFF ] ^ KT1[(ta3 >> 16) & 0xFF]; \
|
||||
X3 ^= rotr(RT0[( Y1 >> 8 ) &0xFF ] ^ KT0[(ta3 >> 8) & 0xFF],16); \
|
||||
X3 ^= rotr(RT1[( Y0 ) &0xFF ] ^ KT1[(ta3 ) & 0xFF],16); \
|
||||
}
|
||||
#define AES_ROUND4NODK_DEC(TAB,I,X0,X1,X2,X3,Y0,Y1,Y2,Y3) \
|
||||
{ \
|
||||
unsigned int ta0 = TAB[I]; \
|
||||
unsigned int ta1 = TAB[I+1]; \
|
||||
unsigned int ta2 = TAB[I+2]; \
|
||||
unsigned int ta3 = TAB[I+3]; \
|
||||
X0 = RT0[(Y0 >> 24) &0xFF ] ^ KT0[(ta0 >> 24) & 0xFF]; \
|
||||
X0 ^= RT1[(Y3 >> 16) &0xFF ] ^ KT1[(ta0 >> 16) & 0xFF]; \
|
||||
X0 ^= RT2[(Y2 >> 8) &0xFF ] ^ KT2[(ta0 >> 8 ) & 0xFF]; \
|
||||
X0 ^= RT3[(Y1 ) &0xFF ] ^ KT3[(ta0 ) & 0xFF]; \
|
||||
\
|
||||
X1 = RT0[( Y1 >> 24 ) &0xFF ] ^ KT0[(ta1 >> 24) & 0xFF]; \
|
||||
X1 ^= RT1[( Y0 >> 16 ) &0xFF ] ^ KT1[(ta1 >> 16) & 0xFF]; \
|
||||
X1 ^= RT2[( Y3 >> 8 ) &0xFF ] ^ KT2[(ta1 >> 8) & 0xFF]; \
|
||||
X1 ^= RT3[( Y2 ) &0xFF ] ^ KT3[(ta1 ) & 0xFF]; \
|
||||
\
|
||||
X2 = RT0[( Y2 >> 24 ) &0xFF ] ^ KT0[(ta2 >> 24) & 0xFF]; \
|
||||
X2 ^= RT1[( Y1 >> 16 ) &0xFF ] ^ KT1[(ta2 >> 16) & 0xFF]; \
|
||||
X2 ^= RT2[( Y0 >> 8 ) &0xFF ] ^ KT2[(ta2 >> 8) & 0xFF]; \
|
||||
X2 ^= RT3[( Y3 ) &0xFF ] ^ KT3[(ta2 ) & 0xFF]; \
|
||||
\
|
||||
X3 = RT0[( Y3 >> 24 ) &0xFF ] ^ KT0[(ta3 >> 24) & 0xFF]; \
|
||||
X3 ^= RT1[( Y2 >> 16 ) &0xFF ] ^ KT1[(ta3 >> 16) & 0xFF]; \
|
||||
X3 ^= RT2[( Y1 >> 8 ) &0xFF ] ^ KT2[(ta3 >> 8) & 0xFF]; \
|
||||
X3 ^= RT3[( Y0 ) &0xFF ] ^ KT3[(ta3 ) & 0xFF]; \
|
||||
}
|
||||
#else
|
||||
#define AES_ROUND1NODK_DEC(TAB,I,X0,X1,X2,X3,Y0,Y1,Y2,Y3) \
|
||||
{ \
|
||||
unsigned int ta0 = TAB[I]; \
|
||||
unsigned int ta1 = TAB[I+1]; \
|
||||
unsigned int ta2 = TAB[I+2]; \
|
||||
unsigned int ta3 = TAB[I+3]; \
|
||||
X0 = RT0[(Y0 ) &0xFF ] ^ KT0[(ta0 ) & 0xFF]; \
|
||||
X0 ^= rotl(RT0[(Y3 >> 8) &0xFF ] ^ KT0[(ta0 >> 8) & 0xFF],8); \
|
||||
X0 ^= rotl(RT0[(Y2 >> 16) &0xFF ] ^ KT0[(ta0 >> 16) & 0xFF],16); \
|
||||
X0 ^= rotl(RT0[(Y1 >> 24) &0xFF ] ^ KT0[(ta0 >> 24) & 0xFF],24); \
|
||||
\
|
||||
X1 = RT0[( Y1 ) &0xFF ] ^ KT0[(ta1 ) & 0xFF]; \
|
||||
X1 ^= rotl(RT0[( Y0 >> 8) &0xFF ] ^ KT0[(ta1 >> 8) & 0xFF],8); \
|
||||
X1 ^= rotl(RT0[( Y3 >> 16) &0xFF ] ^ KT0[(ta1 >> 16) & 0xFF],16); \
|
||||
X1 ^= rotl(RT0[( Y2 >> 24) &0xFF ] ^ KT0[(ta1 >> 24) & 0xFF],24); \
|
||||
\
|
||||
X2 = RT0[( Y2 ) &0xFF ] ^ KT0[(ta2 ) & 0xFF]; \
|
||||
X2 ^= rotl(RT0[( Y1 >> 8) &0xFF ] ^ KT0[(ta2 >> 8) & 0xFF],8); \
|
||||
X2 ^= rotl(RT0[( Y0 >> 16) &0xFF ] ^ KT0[(ta2 >> 16) & 0xFF],16); \
|
||||
X2 ^= rotl(RT0[( Y3 >> 24) &0xFF ] ^ KT0[(ta2 >> 24) & 0xFF],24); \
|
||||
\
|
||||
X3 = RT0[( Y3 ) &0xFF ] ^ KT0[(ta3 ) & 0xFF]; \
|
||||
X3 ^= rotl(RT0[( Y2 >> 8) &0xFF ] ^ KT0[(ta3 >> 8) & 0xFF],8); \
|
||||
X3 ^= rotl(RT0[( Y1 >> 16) &0xFF ] ^ KT0[(ta3 >> 16) & 0xFF],16); \
|
||||
X3 ^= rotl(RT0[( Y0 >> 24) &0xFF ] ^ KT0[(ta3 >> 24) & 0xFF],24); \
|
||||
}
|
||||
#define AES_ROUND2NODK_DEC(TAB,I,X0,X1,X2,X3,Y0,Y1,Y2,Y3) \
|
||||
{ \
|
||||
unsigned int ta0 = TAB[I]; \
|
||||
unsigned int ta1 = TAB[I+1]; \
|
||||
unsigned int ta2 = TAB[I+2]; \
|
||||
unsigned int ta3 = TAB[I+3]; \
|
||||
X0 = RT0[(Y0 ) &0xFF ] ^ KT0[(ta0 ) & 0xFF]; \
|
||||
X0 ^= RT1[(Y3 >> 8) &0xFF ] ^ KT1[(ta0 >> 8) & 0xFF]; \
|
||||
X0 ^= rotl(RT0[(Y2 >> 16) &0xFF ] ^ KT0[(ta0 >> 16) & 0xFF],16); \
|
||||
X0 ^= rotl(RT1[(Y1 >> 24) &0xFF ] ^ KT1[(ta0 >> 24) & 0xFF],16); \
|
||||
\
|
||||
X1 = RT0[( Y1 ) &0xFF ] ^ KT0[(ta1 ) & 0xFF]; \
|
||||
X1 ^= RT1[( Y0 >> 8) &0xFF ] ^ KT1[(ta1 >> 8) & 0xFF]; \
|
||||
X1 ^= rotl(RT0[( Y3 >> 16) &0xFF ] ^ KT0[(ta1 >> 16) & 0xFF],16); \
|
||||
X1 ^= rotl(RT1[( Y2 >> 24) &0xFF ] ^ KT1[(ta1 >> 24) & 0xFF],16); \
|
||||
\
|
||||
X2 = RT0[( Y2 ) &0xFF ] ^ KT0[(ta2 ) & 0xFF]; \
|
||||
X2 ^= RT1[( Y1 >> 8) &0xFF ] ^ KT1[(ta2 >> 8) & 0xFF]; \
|
||||
X2 ^= rotl(RT0[( Y0 >> 16) &0xFF ] ^ KT0[(ta2 >> 16) & 0xFF],16); \
|
||||
X2 ^= rotl(RT1[( Y3 >> 24) &0xFF ] ^ KT1[(ta2 >> 24) & 0xFF],16); \
|
||||
\
|
||||
X3 = RT0[( Y3 ) &0xFF ] ^ KT0[(ta3 ) & 0xFF]; \
|
||||
X3 ^= RT1[( Y2 >> 8) &0xFF ] ^ KT1[(ta3 >> 8) & 0xFF]; \
|
||||
X3 ^= rotl(RT0[( Y1 >> 16) &0xFF ] ^ KT0[(ta3 >> 16) & 0xFF],16); \
|
||||
X3 ^= rotl(RT1[( Y0 >> 24) &0xFF ] ^ KT1[(ta3 >> 24) & 0xFF],16); \
|
||||
}
|
||||
#define AES_ROUND4NODK_DEC(TAB,I,X0,X1,X2,X3,Y0,Y1,Y2,Y3) \
|
||||
{ \
|
||||
unsigned int ta0 = TAB[I]; \
|
||||
unsigned int ta1 = TAB[I+1]; \
|
||||
unsigned int ta2 = TAB[I+2]; \
|
||||
unsigned int ta3 = TAB[I+3]; \
|
||||
X0 = RT0[(Y0 ) &0xFF ] ^ KT0[(ta0 ) & 0xFF]; \
|
||||
X0 ^= RT1[(Y3 >> 8) &0xFF ] ^ KT1[(ta0 >> 8) & 0xFF]; \
|
||||
X0 ^= RT2[(Y2 >> 16) &0xFF ] ^ KT2[(ta0 >> 16) & 0xFF]; \
|
||||
X0 ^= RT3[(Y1 >> 24) &0xFF ] ^ KT3[(ta0 >> 24) & 0xFF]; \
|
||||
\
|
||||
X1 = RT0[( Y1 ) &0xFF ] ^ KT0[(ta1 ) & 0xFF]; \
|
||||
X1 ^= RT1[( Y0 >> 8) &0xFF ] ^ KT1[(ta1 >> 8) & 0xFF]; \
|
||||
X1 ^= RT2[( Y3 >> 16) &0xFF ] ^ KT2[(ta1 >> 16) & 0xFF]; \
|
||||
X1 ^= RT3[( Y2 >> 24) &0xFF ] ^ KT3[(ta1 >> 24) & 0xFF]; \
|
||||
\
|
||||
X2 = RT0[( Y2 ) &0xFF ] ^ KT0[(ta2 ) & 0xFF]; \
|
||||
X2 ^= RT1[( Y1 >> 8) &0xFF ] ^ KT1[(ta2 >> 8) & 0xFF]; \
|
||||
X2 ^= RT2[( Y0 >> 16) &0xFF ] ^ KT2[(ta2 >> 16) & 0xFF]; \
|
||||
X2 ^= RT3[( Y3 >> 24) &0xFF ] ^ KT3[(ta2 >> 24) & 0xFF]; \
|
||||
\
|
||||
X3 = RT0[( Y3 ) &0xFF ] ^ KT0[(ta3 ) & 0xFF]; \
|
||||
X3 ^= RT1[( Y2 >> 8) &0xFF ] ^ KT1[(ta3 >> 8) & 0xFF]; \
|
||||
X3 ^= RT2[( Y1 >> 16) &0xFF ] ^ KT2[(ta3 >> 16) & 0xFF]; \
|
||||
X3 ^= RT3[( Y0 >> 24) &0xFF ] ^ KT3[(ta3 >> 24) & 0xFF]; \
|
||||
}
|
||||
#endif
|
||||
|
||||
#ifndef RV32B
|
||||
#include <stdint.h>
|
||||
static inline unsigned int rotr(const unsigned int x, const unsigned int n) {
|
||||
unsigned int r;
|
||||
r = ((x >> n) | (x << (32 - n)));
|
||||
return r;
|
||||
}
|
||||
static inline unsigned int rotl(const unsigned int x, const unsigned int n) {
|
||||
unsigned int r;
|
||||
r = ((x << n) | (x >> (32 - n)));
|
||||
return r;
|
||||
}
|
||||
#else
|
||||
#include "rvintrin.h"
|
||||
#define rotr(a,b) _rv32_ror(a,b)
|
||||
#define rotl(a,b) _rv32_rol(a,b)
|
||||
#endif
|
||||
|
||||
static inline void aes128_setkey_encrypt(const unsigned int key[], unsigned int *aes_edrk) {
|
||||
unsigned int i = 0;
|
||||
unsigned int rotl_aes_edrk;
|
||||
unsigned int tmp8, tmp9, tmp10, tmp11;
|
||||
unsigned int temp_lds;
|
||||
#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
|
||||
unsigned int round = 0x01000000;
|
||||
#else
|
||||
unsigned int round = 0x00000001;
|
||||
#endif
|
||||
|
||||
tmp8 = (key[0]);
|
||||
aes_edrk[0] = tmp8;
|
||||
tmp9 = (key[1]);
|
||||
aes_edrk[1] = tmp9;
|
||||
tmp10 = (key[2]);
|
||||
aes_edrk[2] = tmp10;
|
||||
tmp11 = (key[3]);
|
||||
aes_edrk[3] = tmp11;
|
||||
|
||||
for( i = 4; i < 36; /* i+=4 */ )
|
||||
{
|
||||
#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
|
||||
rotl_aes_edrk = rotl(tmp11,8);
|
||||
#else
|
||||
rotl_aes_edrk = rotr(tmp11,8);
|
||||
#endif
|
||||
temp_lds = f_FSb_32__1(rotl_aes_edrk) ^ f_FSb_32__2( rotl_aes_edrk );
|
||||
|
||||
tmp8 = tmp8 ^ round ^ temp_lds;
|
||||
round = round << 1;
|
||||
|
||||
aes_edrk[i++] = tmp8;
|
||||
tmp9 = tmp9 ^ tmp8;
|
||||
aes_edrk[i++] = tmp9;
|
||||
tmp10 = tmp10 ^ tmp9;
|
||||
aes_edrk[i++] = tmp10;
|
||||
tmp11 = tmp11 ^ tmp10;
|
||||
aes_edrk[i++] = tmp11;
|
||||
}
|
||||
|
||||
#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
|
||||
round = 0x1B000000;
|
||||
rotl_aes_edrk = rotl(tmp11,8);
|
||||
#else
|
||||
round = 0x0000001B;
|
||||
rotl_aes_edrk = rotr(tmp11,8);
|
||||
#endif
|
||||
temp_lds = f_FSb_32__1(rotl_aes_edrk) ^ f_FSb_32__2( rotl_aes_edrk );
|
||||
|
||||
tmp8 = tmp8 ^ round ^ temp_lds;
|
||||
|
||||
aes_edrk[i++] = tmp8;
|
||||
tmp9 = tmp9 ^ tmp8;
|
||||
aes_edrk[i++] = tmp9;
|
||||
tmp10 = tmp10 ^ tmp9;
|
||||
aes_edrk[i++] = tmp10;
|
||||
tmp11 = tmp11 ^ tmp10;
|
||||
aes_edrk[i++] = tmp11;
|
||||
|
||||
#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
|
||||
round = 0x36000000;
|
||||
rotl_aes_edrk = rotl(tmp11,8);
|
||||
#else
|
||||
round = 0x00000036;
|
||||
rotl_aes_edrk = rotr(tmp11,8);
|
||||
#endif
|
||||
temp_lds = f_FSb_32__1(rotl_aes_edrk) ^ f_FSb_32__2( rotl_aes_edrk );
|
||||
|
||||
tmp8 = tmp8 ^ round ^ temp_lds;
|
||||
|
||||
aes_edrk[i++] = tmp8;
|
||||
tmp9 = tmp9 ^ tmp8;
|
||||
aes_edrk[i++] = tmp9;
|
||||
tmp10 = tmp10 ^ tmp9;
|
||||
aes_edrk[i++] = tmp10;
|
||||
tmp11 = tmp11 ^ tmp10;
|
||||
aes_edrk[i++] = tmp11;
|
||||
}
|
||||
|
||||
static inline void aes256_setkey_encrypt(const unsigned int key[], unsigned int *aes_edrk) {
|
||||
unsigned int i = 0;
|
||||
unsigned int rotl_aes_edrk;
|
||||
unsigned int tmp8, tmp9, tmp10, tmp11;
|
||||
unsigned int tmp12, tmp13, tmp14, tmp15;
|
||||
unsigned int temp_lds;
|
||||
#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
|
||||
unsigned int round = 0x01000000;
|
||||
#else
|
||||
unsigned int round = 0x00000001;
|
||||
#endif
|
||||
|
||||
tmp8 = (key[0]);
|
||||
aes_edrk[0] = tmp8;
|
||||
tmp9 = (key[1]);
|
||||
aes_edrk[1] = tmp9;
|
||||
tmp10 = (key[2]);
|
||||
aes_edrk[2] = tmp10;
|
||||
tmp11 = (key[3]);
|
||||
aes_edrk[3] = tmp11;
|
||||
tmp12 = (key[4]);
|
||||
aes_edrk[4] = tmp12;
|
||||
tmp13 = (key[5]);
|
||||
aes_edrk[5] = tmp13;
|
||||
tmp14 = (key[6]);
|
||||
aes_edrk[6] = tmp14;
|
||||
tmp15 = (key[7]);
|
||||
aes_edrk[7] = tmp15;
|
||||
|
||||
for( i = 8; i < 56; /* i+=8 */ )
|
||||
{
|
||||
|
||||
#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
|
||||
rotl_aes_edrk = rotl(tmp15,8);
|
||||
#else
|
||||
rotl_aes_edrk = rotr(tmp15,8);
|
||||
#endif
|
||||
temp_lds = f_FSb_32__1(rotl_aes_edrk) ^ f_FSb_32__2( rotl_aes_edrk );
|
||||
|
||||
tmp8 = tmp8 ^ round ^ temp_lds;
|
||||
round = round << 1;
|
||||
|
||||
aes_edrk[i++] = tmp8;
|
||||
tmp9 = tmp9 ^ tmp8;
|
||||
aes_edrk[i++] = tmp9;
|
||||
tmp10 = tmp10 ^ tmp9;
|
||||
aes_edrk[i++] = tmp10;
|
||||
tmp11 = tmp11 ^ tmp10;
|
||||
aes_edrk[i++] = tmp11;
|
||||
|
||||
temp_lds = f_FSb_32__1(tmp11) ^ f_FSb_32__2(tmp11);
|
||||
|
||||
tmp12 = tmp12 ^ temp_lds;
|
||||
aes_edrk[i++] = tmp12;
|
||||
tmp13 = tmp13 ^ tmp12;
|
||||
aes_edrk[i++] = tmp13;
|
||||
tmp14 = tmp14 ^ tmp13;
|
||||
aes_edrk[i++] = tmp14;
|
||||
tmp15 = tmp15 ^ tmp14;
|
||||
aes_edrk[i++] = tmp15;
|
||||
}
|
||||
|
||||
#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
|
||||
rotl_aes_edrk = rotl(tmp15,8);
|
||||
#else
|
||||
rotl_aes_edrk = rotr(tmp15,8);
|
||||
#endif
|
||||
temp_lds = f_FSb_32__1(rotl_aes_edrk) ^ f_FSb_32__2( rotl_aes_edrk );
|
||||
|
||||
tmp8 = tmp8 ^ round ^ temp_lds;
|
||||
round = round << 1;
|
||||
|
||||
aes_edrk[i++] = tmp8;
|
||||
tmp9 = tmp9 ^ tmp8;
|
||||
aes_edrk[i++] = tmp9;
|
||||
tmp10 = tmp10 ^ tmp9;
|
||||
aes_edrk[i++] = tmp10;
|
||||
tmp11 = tmp11 ^ tmp10;
|
||||
aes_edrk[i++] = tmp11;
|
||||
}
|
||||
323
aes256gcmv1standalone-rv32/try-anything.c
Normal file
323
aes256gcmv1standalone-rv32/try-anything.c
Normal file
|
|
@ -0,0 +1,323 @@
|
|||
/*
|
||||
* try-anything.c version 20190729
|
||||
* D. J. Bernstein
|
||||
* Some portions adapted from TweetNaCl by Bernstein, Janssen, Lange, Schwabe.
|
||||
* Public domain.
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <time.h>
|
||||
#include <unistd.h>
|
||||
#include <sys/time.h>
|
||||
#include <sys/types.h>
|
||||
#include <sys/resource.h>
|
||||
#include "kernelrandombytes.h"
|
||||
#include "cpucycles.h"
|
||||
#include "crypto_uint8.h"
|
||||
#include "crypto_uint32.h"
|
||||
#include "crypto_uint64.h"
|
||||
#include "try.h"
|
||||
|
||||
typedef crypto_uint8 u8;
|
||||
typedef crypto_uint32 u32;
|
||||
typedef crypto_uint64 u64;
|
||||
|
||||
#define FOR(i,n) for (i = 0;i < n;++i)
|
||||
|
||||
static u32 L32(u32 x,int c) { return (x << c) | ((x&0xffffffff) >> (32 - c)); }
|
||||
|
||||
static u32 ld32(const u8 *x)
|
||||
{
|
||||
u32 u = x[3];
|
||||
u = (u<<8)|x[2];
|
||||
u = (u<<8)|x[1];
|
||||
return (u<<8)|x[0];
|
||||
}
|
||||
|
||||
static void st32(u8 *x,u32 u)
|
||||
{
|
||||
int i;
|
||||
FOR(i,4) { x[i] = u; u >>= 8; }
|
||||
}
|
||||
|
||||
static const u8 sigma[17] = "expand 32-byte k";
|
||||
|
||||
static void core(u8 *out,const u8 *in,const u8 *k)
|
||||
{
|
||||
u32 w[16],x[16],y[16],t[4];
|
||||
int i,j,m;
|
||||
|
||||
FOR(i,4) {
|
||||
x[5*i] = ld32(sigma+4*i);
|
||||
x[1+i] = ld32(k+4*i);
|
||||
x[6+i] = ld32(in+4*i);
|
||||
x[11+i] = ld32(k+16+4*i);
|
||||
}
|
||||
|
||||
FOR(i,16) y[i] = x[i];
|
||||
|
||||
FOR(i,20) {
|
||||
FOR(j,4) {
|
||||
FOR(m,4) t[m] = x[(5*j+4*m)%16];
|
||||
t[1] ^= L32(t[0]+t[3], 7);
|
||||
t[2] ^= L32(t[1]+t[0], 9);
|
||||
t[3] ^= L32(t[2]+t[1],13);
|
||||
t[0] ^= L32(t[3]+t[2],18);
|
||||
FOR(m,4) w[4*j+(j+m)%4] = t[m];
|
||||
}
|
||||
FOR(m,16) x[m] = w[m];
|
||||
}
|
||||
|
||||
FOR(i,16) st32(out + 4 * i,x[i] + y[i]);
|
||||
}
|
||||
|
||||
static void salsa20(u8 *c,u64 b,const u8 *n,const u8 *k)
|
||||
{
|
||||
u8 z[16],x[64];
|
||||
u32 u,i;
|
||||
if (!b) return;
|
||||
FOR(i,16) z[i] = 0;
|
||||
FOR(i,8) z[i] = n[i];
|
||||
while (b >= 64) {
|
||||
core(x,z,k);
|
||||
FOR(i,64) c[i] = x[i];
|
||||
u = 1;
|
||||
for (i = 8;i < 16;++i) {
|
||||
u += (u32) z[i];
|
||||
z[i] = u;
|
||||
u >>= 8;
|
||||
}
|
||||
b -= 64;
|
||||
c += 64;
|
||||
}
|
||||
if (b) {
|
||||
core(x,z,k);
|
||||
FOR(i,b) c[i] = x[i];
|
||||
}
|
||||
}
|
||||
|
||||
static void increment(u8 *n)
|
||||
{
|
||||
if (!++n[0])
|
||||
if (!++n[1])
|
||||
if (!++n[2])
|
||||
if (!++n[3])
|
||||
if (!++n[4])
|
||||
if (!++n[5])
|
||||
if (!++n[6])
|
||||
if (!++n[7])
|
||||
;
|
||||
}
|
||||
|
||||
static void testvector(unsigned char *x,unsigned long long xlen)
|
||||
{
|
||||
const static unsigned char testvector_k[33] = "generate inputs for test vectors";
|
||||
static unsigned char testvector_n[8];
|
||||
salsa20(x,xlen,testvector_n,testvector_k);
|
||||
increment(testvector_n);
|
||||
}
|
||||
|
||||
unsigned long long myrandom(void)
|
||||
{
|
||||
unsigned char x[8];
|
||||
unsigned long long result;
|
||||
testvector(x,8);
|
||||
result = x[7];
|
||||
result = (result<<8)|x[6];
|
||||
result = (result<<8)|x[5];
|
||||
result = (result<<8)|x[4];
|
||||
result = (result<<8)|x[3];
|
||||
result = (result<<8)|x[2];
|
||||
result = (result<<8)|x[1];
|
||||
result = (result<<8)|x[0];
|
||||
return result;
|
||||
}
|
||||
|
||||
static void canary(unsigned char *x,unsigned long long xlen)
|
||||
{
|
||||
const static unsigned char canary_k[33] = "generate pad to catch overwrites";
|
||||
static unsigned char canary_n[8];
|
||||
salsa20(x,xlen,canary_n,canary_k);
|
||||
increment(canary_n);
|
||||
}
|
||||
|
||||
void double_canary(unsigned char *x2,unsigned char *x,unsigned long long xlen)
|
||||
{
|
||||
canary(x - 16,16);
|
||||
canary(x + xlen,16);
|
||||
memcpy(x2 - 16,x - 16,16);
|
||||
memcpy(x2 + xlen,x + xlen,16);
|
||||
}
|
||||
|
||||
void input_prepare(unsigned char *x2,unsigned char *x,unsigned long long xlen)
|
||||
{
|
||||
testvector(x,xlen);
|
||||
canary(x - 16,16);
|
||||
canary(x + xlen,16);
|
||||
memcpy(x2 - 16,x - 16,xlen + 32);
|
||||
}
|
||||
|
||||
void input_compare(const unsigned char *x2,const unsigned char *x,unsigned long long xlen,const char *fun)
|
||||
{
|
||||
if (memcmp(x2 - 16,x - 16,xlen + 32)) {
|
||||
fprintf(stderr,"%s overwrites input\n",fun);
|
||||
exit(111);
|
||||
}
|
||||
}
|
||||
|
||||
void output_prepare(unsigned char *x2,unsigned char *x,unsigned long long xlen)
|
||||
{
|
||||
canary(x - 16,xlen + 32);
|
||||
memcpy(x2 - 16,x - 16,xlen + 32);
|
||||
}
|
||||
|
||||
void output_compare(const unsigned char *x2,const unsigned char *x,unsigned long long xlen,const char *fun)
|
||||
{
|
||||
if (memcmp(x2 - 16,x - 16,16)) {
|
||||
fprintf(stderr,"%s writes before output\n",fun);
|
||||
exit(111);
|
||||
}
|
||||
if (memcmp(x2 + xlen,x + xlen,16)) {
|
||||
fprintf(stderr,"%s writes after output\n",fun);
|
||||
exit(111);
|
||||
}
|
||||
}
|
||||
|
||||
static unsigned char checksum_state[64];
|
||||
static char checksum_hex[65];
|
||||
|
||||
void checksum(const unsigned char *x,unsigned long long xlen)
|
||||
{
|
||||
u8 block[16];
|
||||
int i;
|
||||
while (xlen >= 16) {
|
||||
core(checksum_state,x,checksum_state);
|
||||
x += 16;
|
||||
xlen -= 16;
|
||||
}
|
||||
FOR(i,16) block[i] = 0;
|
||||
FOR(i,xlen) block[i] = x[i];
|
||||
block[xlen] = 1;
|
||||
checksum_state[0] ^= 1;
|
||||
core(checksum_state,block,checksum_state);
|
||||
}
|
||||
|
||||
static void printword(const char *s)
|
||||
{
|
||||
if (!*s) putchar('-');
|
||||
while (*s) {
|
||||
if (*s == ' ') putchar('_');
|
||||
else if (*s == '\t') putchar('_');
|
||||
else if (*s == '\r') putchar('_');
|
||||
else if (*s == '\n') putchar('_');
|
||||
else putchar(*s);
|
||||
++s;
|
||||
}
|
||||
putchar(' ');
|
||||
}
|
||||
|
||||
static void printnum(long long x)
|
||||
{
|
||||
printf("%lld ",x);
|
||||
}
|
||||
|
||||
void fail(const char *why)
|
||||
{
|
||||
fprintf(stderr,"%s\n",why);
|
||||
exit(111);
|
||||
}
|
||||
|
||||
unsigned char *alignedcalloc(unsigned long long len)
|
||||
{
|
||||
unsigned char *x = (unsigned char *) calloc(1,len + 256);
|
||||
long long i;
|
||||
if (!x) fail("out of memory");
|
||||
/* will never deallocate so shifting is ok */
|
||||
for (i = 0;i < len + 256;++i) x[i] = random();
|
||||
x += 64;
|
||||
x += 63 & (-(unsigned long) x);
|
||||
for (i = 0;i < len;++i) x[i] = 0;
|
||||
return x;
|
||||
}
|
||||
|
||||
#define TIMINGS 63
|
||||
static long long cycles[TIMINGS + 1];
|
||||
|
||||
void limits()
|
||||
{
|
||||
#ifdef RLIM_INFINITY
|
||||
struct rlimit r;
|
||||
r.rlim_cur = 0;
|
||||
r.rlim_max = 0;
|
||||
#ifdef RLIMIT_NOFILE
|
||||
setrlimit(RLIMIT_NOFILE,&r);
|
||||
#endif
|
||||
#ifdef RLIMIT_NPROC
|
||||
setrlimit(RLIMIT_NPROC,&r);
|
||||
#endif
|
||||
#ifdef RLIMIT_CORE
|
||||
setrlimit(RLIMIT_CORE,&r);
|
||||
#endif
|
||||
#endif
|
||||
}
|
||||
|
||||
static unsigned char randombyte[1];
|
||||
|
||||
int main()
|
||||
{
|
||||
long long i;
|
||||
long long j;
|
||||
long long abovej;
|
||||
long long belowj;
|
||||
long long checksumcycles;
|
||||
long long cyclespersecond;
|
||||
|
||||
cycles[0] = cpucycles();
|
||||
cycles[1] = cpucycles();
|
||||
cyclespersecond = cpucycles_persecond();
|
||||
|
||||
kernelrandombytes(randombyte,1);
|
||||
preallocate();
|
||||
limits();
|
||||
|
||||
allocate();
|
||||
srandom(getpid());
|
||||
|
||||
cycles[0] = cpucycles();
|
||||
test();
|
||||
cycles[1] = cpucycles();
|
||||
checksumcycles = cycles[1] - cycles[0];
|
||||
|
||||
predoit();
|
||||
for (i = 0;i <= TIMINGS;++i) {
|
||||
cycles[i] = cpucycles();
|
||||
}
|
||||
for (i = 0;i <= TIMINGS;++i) {
|
||||
cycles[i] = cpucycles();
|
||||
doit();
|
||||
}
|
||||
for (i = 0;i < TIMINGS;++i) cycles[i] = cycles[i + 1] - cycles[i];
|
||||
for (j = 0;j < TIMINGS;++j) {
|
||||
belowj = 0;
|
||||
for (i = 0;i < TIMINGS;++i) if (cycles[i] < cycles[j]) ++belowj;
|
||||
abovej = 0;
|
||||
for (i = 0;i < TIMINGS;++i) if (cycles[i] > cycles[j]) ++abovej;
|
||||
if (belowj * 2 < TIMINGS && abovej * 2 < TIMINGS) break;
|
||||
}
|
||||
|
||||
for (i = 0;i < 32;++i) {
|
||||
checksum_hex[2 * i] = "0123456789abcdef"[15 & (checksum_state[i] >> 4)];
|
||||
checksum_hex[2 * i + 1] = "0123456789abcdef"[15 & checksum_state[i]];
|
||||
}
|
||||
checksum_hex[2 * i] = 0;
|
||||
|
||||
printword(checksum_hex);
|
||||
printnum(cycles[j]);
|
||||
printnum(checksumcycles);
|
||||
printnum(cyclespersecond);
|
||||
printword(primitiveimplementation);
|
||||
printf("\n");
|
||||
return 0;
|
||||
}
|
||||
242
aes256gcmv1standalone-rv32/try.c
Normal file
242
aes256gcmv1standalone-rv32/try.c
Normal file
|
|
@ -0,0 +1,242 @@
|
|||
/*
|
||||
* crypto_aead/try.c version 20200406
|
||||
* D. J. Bernstein
|
||||
* Public domain.
|
||||
* Auto-generated by trygen.py; do not edit.
|
||||
*/
|
||||
|
||||
#include "crypto_aead.h"
|
||||
#include "try.h"
|
||||
|
||||
const char *primitiveimplementation = crypto_aead_IMPLEMENTATION;
|
||||
|
||||
#define TUNE_BYTES 1536
|
||||
#ifdef SMALL
|
||||
#define MAXTEST_BYTES 128
|
||||
#else
|
||||
#define MAXTEST_BYTES 4096
|
||||
#endif
|
||||
#ifdef SMALL
|
||||
#define LOOPS 64
|
||||
#else
|
||||
#define LOOPS 512
|
||||
#endif
|
||||
|
||||
static unsigned char *k;
|
||||
static unsigned char *s;
|
||||
static unsigned char *p;
|
||||
static unsigned char *a;
|
||||
static unsigned char *m;
|
||||
static unsigned char *c;
|
||||
static unsigned char *t;
|
||||
static unsigned char *r;
|
||||
static unsigned char *k2;
|
||||
static unsigned char *s2;
|
||||
static unsigned char *p2;
|
||||
static unsigned char *a2;
|
||||
static unsigned char *m2;
|
||||
static unsigned char *c2;
|
||||
static unsigned char *t2;
|
||||
static unsigned char *r2;
|
||||
#define klen crypto_aead_KEYBYTES
|
||||
#define slen crypto_aead_NSECBYTES
|
||||
#define plen crypto_aead_NPUBBYTES
|
||||
unsigned long long alen;
|
||||
unsigned long long mlen;
|
||||
unsigned long long clen;
|
||||
unsigned long long tlen;
|
||||
#define rlen crypto_aead_NSECBYTES
|
||||
|
||||
void preallocate(void)
|
||||
{
|
||||
}
|
||||
|
||||
void allocate(void)
|
||||
{
|
||||
unsigned long long alloclen = 0;
|
||||
if (alloclen < TUNE_BYTES) alloclen = TUNE_BYTES;
|
||||
if (alloclen < MAXTEST_BYTES + crypto_aead_ABYTES) alloclen = MAXTEST_BYTES + crypto_aead_ABYTES;
|
||||
if (alloclen < crypto_aead_KEYBYTES) alloclen = crypto_aead_KEYBYTES;
|
||||
if (alloclen < crypto_aead_NSECBYTES) alloclen = crypto_aead_NSECBYTES;
|
||||
if (alloclen < crypto_aead_NPUBBYTES) alloclen = crypto_aead_NPUBBYTES;
|
||||
if (alloclen < crypto_aead_NSECBYTES) alloclen = crypto_aead_NSECBYTES;
|
||||
k = alignedcalloc(alloclen);
|
||||
s = alignedcalloc(alloclen);
|
||||
p = alignedcalloc(alloclen);
|
||||
a = alignedcalloc(alloclen);
|
||||
m = alignedcalloc(alloclen);
|
||||
c = alignedcalloc(alloclen);
|
||||
t = alignedcalloc(alloclen);
|
||||
r = alignedcalloc(alloclen);
|
||||
k2 = alignedcalloc(alloclen);
|
||||
s2 = alignedcalloc(alloclen);
|
||||
p2 = alignedcalloc(alloclen);
|
||||
a2 = alignedcalloc(alloclen);
|
||||
m2 = alignedcalloc(alloclen);
|
||||
c2 = alignedcalloc(alloclen);
|
||||
t2 = alignedcalloc(alloclen);
|
||||
r2 = alignedcalloc(alloclen);
|
||||
}
|
||||
|
||||
void predoit(void)
|
||||
{
|
||||
}
|
||||
|
||||
void doit(void)
|
||||
{
|
||||
crypto_aead_encrypt(c,&clen,m,TUNE_BYTES,a,TUNE_BYTES,s,p,k);
|
||||
crypto_aead_decrypt(t,&tlen,r,c,clen,a,TUNE_BYTES,p,k);
|
||||
}
|
||||
|
||||
void test(void)
|
||||
{
|
||||
unsigned long long loop;
|
||||
|
||||
for (loop = 0;loop < LOOPS;++loop) {
|
||||
mlen = myrandom() % (MAXTEST_BYTES + 1);
|
||||
alen = myrandom() % (MAXTEST_BYTES + 1);
|
||||
|
||||
clen = mlen + crypto_aead_ABYTES;
|
||||
output_prepare(c2,c,clen);
|
||||
input_prepare(m2,m,mlen);
|
||||
input_prepare(a2,a,alen);
|
||||
input_prepare(s2,s,slen);
|
||||
input_prepare(p2,p,plen);
|
||||
input_prepare(k2,k,klen);
|
||||
if (crypto_aead_encrypt(c,&clen,m,mlen,a,alen,s,p,k) != 0) fail("crypto_aead_encrypt returns nonzero");
|
||||
if (clen < mlen) fail("crypto_aead_encrypt returns smaller output than input");
|
||||
if (clen > mlen + crypto_aead_ABYTES) fail("crypto_aead_encrypt returns more than crypto_aead_ABYTES extra bytes");
|
||||
checksum(c,clen);
|
||||
output_compare(c2,c,clen,"crypto_aead_encrypt");
|
||||
input_compare(m2,m,mlen,"crypto_aead_encrypt");
|
||||
input_compare(a2,a,alen,"crypto_aead_encrypt");
|
||||
input_compare(s2,s,slen,"crypto_aead_encrypt");
|
||||
input_compare(p2,p,plen,"crypto_aead_encrypt");
|
||||
input_compare(k2,k,klen,"crypto_aead_encrypt");
|
||||
|
||||
double_canary(c2,c,clen);
|
||||
double_canary(m2,m,mlen);
|
||||
double_canary(a2,a,alen);
|
||||
double_canary(s2,s,slen);
|
||||
double_canary(p2,p,plen);
|
||||
double_canary(k2,k,klen);
|
||||
if (crypto_aead_encrypt(c2,&clen,m2,mlen,a2,alen,s2,p2,k2) != 0) fail("crypto_aead_encrypt returns nonzero");
|
||||
if (memcmp(c2,c,clen) != 0) fail("crypto_aead_encrypt is nondeterministic");
|
||||
|
||||
#if crypto_aead_NOOVERLAP == 1
|
||||
#else
|
||||
double_canary(c2,c,clen);
|
||||
double_canary(m2,m,mlen);
|
||||
double_canary(a2,a,alen);
|
||||
double_canary(s2,s,slen);
|
||||
double_canary(p2,p,plen);
|
||||
double_canary(k2,k,klen);
|
||||
if (crypto_aead_encrypt(m2,&clen,m2,mlen,a,alen,s,p,k) != 0) fail("crypto_aead_encrypt with m=c overlap returns nonzero");
|
||||
if (memcmp(m2,c,clen) != 0) fail("crypto_aead_encrypt does not handle m=c overlap");
|
||||
memcpy(m2,m,mlen);
|
||||
if (crypto_aead_encrypt(a2,&clen,m,mlen,a2,alen,s,p,k) != 0) fail("crypto_aead_encrypt with a=c overlap returns nonzero");
|
||||
if (memcmp(a2,c,clen) != 0) fail("crypto_aead_encrypt does not handle a=c overlap");
|
||||
memcpy(a2,a,alen);
|
||||
if (crypto_aead_encrypt(s2,&clen,m,mlen,a,alen,s2,p,k) != 0) fail("crypto_aead_encrypt with s=c overlap returns nonzero");
|
||||
if (memcmp(s2,c,clen) != 0) fail("crypto_aead_encrypt does not handle s=c overlap");
|
||||
memcpy(s2,s,slen);
|
||||
if (crypto_aead_encrypt(p2,&clen,m,mlen,a,alen,s,p2,k) != 0) fail("crypto_aead_encrypt with p=c overlap returns nonzero");
|
||||
if (memcmp(p2,c,clen) != 0) fail("crypto_aead_encrypt does not handle p=c overlap");
|
||||
memcpy(p2,p,plen);
|
||||
if (crypto_aead_encrypt(k2,&clen,m,mlen,a,alen,s,p,k2) != 0) fail("crypto_aead_encrypt with k=c overlap returns nonzero");
|
||||
if (memcmp(k2,c,clen) != 0) fail("crypto_aead_encrypt does not handle k=c overlap");
|
||||
memcpy(k2,k,klen);
|
||||
#endif
|
||||
|
||||
tlen = clen;
|
||||
output_prepare(t2,t,tlen);
|
||||
output_prepare(r2,r,rlen);
|
||||
memcpy(c2,c,clen);
|
||||
double_canary(c2,c,clen);
|
||||
memcpy(a2,a,alen);
|
||||
double_canary(a2,a,alen);
|
||||
memcpy(p2,p,plen);
|
||||
double_canary(p2,p,plen);
|
||||
memcpy(k2,k,klen);
|
||||
double_canary(k2,k,klen);
|
||||
if (crypto_aead_decrypt(t,&tlen,r,c,clen,a,alen,p,k) != 0) fail("crypto_aead_decrypt returns nonzero");
|
||||
if (tlen != mlen) fail("crypto_aead_decrypt does not match mlen");
|
||||
if (memcmp(t,m,mlen) != 0) fail("crypto_aead_decrypt does not match m");
|
||||
if (memcmp(r,s,slen) != 0) fail("crypto_aead_decrypt does not match s");
|
||||
checksum(t,tlen);
|
||||
checksum(r,rlen);
|
||||
output_compare(t2,t,clen,"crypto_aead_decrypt");
|
||||
output_compare(r2,r,rlen,"crypto_aead_decrypt");
|
||||
input_compare(c2,c,clen,"crypto_aead_decrypt");
|
||||
input_compare(a2,a,alen,"crypto_aead_decrypt");
|
||||
input_compare(p2,p,plen,"crypto_aead_decrypt");
|
||||
input_compare(k2,k,klen,"crypto_aead_decrypt");
|
||||
|
||||
double_canary(t2,t,tlen);
|
||||
double_canary(r2,r,rlen);
|
||||
double_canary(c2,c,clen);
|
||||
double_canary(a2,a,alen);
|
||||
double_canary(p2,p,plen);
|
||||
double_canary(k2,k,klen);
|
||||
if (crypto_aead_decrypt(t2,&tlen,r2,c2,clen,a2,alen,p2,k2) != 0) fail("crypto_aead_decrypt returns nonzero");
|
||||
if (memcmp(t2,t,tlen) != 0) fail("crypto_aead_decrypt is nondeterministic");
|
||||
if (memcmp(r2,r,rlen) != 0) fail("crypto_aead_decrypt is nondeterministic");
|
||||
|
||||
#if crypto_aead_NOOVERLAP == 1
|
||||
#else
|
||||
double_canary(t2,t,tlen);
|
||||
double_canary(r2,r,rlen);
|
||||
double_canary(c2,c,clen);
|
||||
double_canary(a2,a,alen);
|
||||
double_canary(p2,p,plen);
|
||||
double_canary(k2,k,klen);
|
||||
if (crypto_aead_decrypt(c2,&tlen,r,c2,clen,a,alen,p,k) != 0) fail("crypto_aead_decrypt with c=t overlap returns nonzero");
|
||||
if (memcmp(c2,t,tlen) != 0) fail("crypto_aead_decrypt does not handle c=t overlap");
|
||||
memcpy(c2,c,clen);
|
||||
if (crypto_aead_decrypt(a2,&tlen,r,c,clen,a2,alen,p,k) != 0) fail("crypto_aead_decrypt with a=t overlap returns nonzero");
|
||||
if (memcmp(a2,t,tlen) != 0) fail("crypto_aead_decrypt does not handle a=t overlap");
|
||||
memcpy(a2,a,alen);
|
||||
if (crypto_aead_decrypt(p2,&tlen,r,c,clen,a,alen,p2,k) != 0) fail("crypto_aead_decrypt with p=t overlap returns nonzero");
|
||||
if (memcmp(p2,t,tlen) != 0) fail("crypto_aead_decrypt does not handle p=t overlap");
|
||||
memcpy(p2,p,plen);
|
||||
if (crypto_aead_decrypt(k2,&tlen,r,c,clen,a,alen,p,k2) != 0) fail("crypto_aead_decrypt with k=t overlap returns nonzero");
|
||||
if (memcmp(k2,t,tlen) != 0) fail("crypto_aead_decrypt does not handle k=t overlap");
|
||||
memcpy(k2,k,klen);
|
||||
#endif
|
||||
|
||||
#if crypto_aead_NOOVERLAP == 1
|
||||
#else
|
||||
double_canary(t2,t,tlen);
|
||||
double_canary(r2,r,rlen);
|
||||
double_canary(c2,c,clen);
|
||||
double_canary(a2,a,alen);
|
||||
double_canary(p2,p,plen);
|
||||
double_canary(k2,k,klen);
|
||||
if (crypto_aead_decrypt(t,&tlen,c2,c2,clen,a,alen,p,k) != 0) fail("crypto_aead_decrypt with c=r overlap returns nonzero");
|
||||
if (memcmp(c2,r,rlen) != 0) fail("crypto_aead_decrypt does not handle c=r overlap");
|
||||
memcpy(c2,c,clen);
|
||||
if (crypto_aead_decrypt(t,&tlen,a2,c,clen,a2,alen,p,k) != 0) fail("crypto_aead_decrypt with a=r overlap returns nonzero");
|
||||
if (memcmp(a2,r,rlen) != 0) fail("crypto_aead_decrypt does not handle a=r overlap");
|
||||
memcpy(a2,a,alen);
|
||||
if (crypto_aead_decrypt(t,&tlen,p2,c,clen,a,alen,p2,k) != 0) fail("crypto_aead_decrypt with p=r overlap returns nonzero");
|
||||
if (memcmp(p2,r,rlen) != 0) fail("crypto_aead_decrypt does not handle p=r overlap");
|
||||
memcpy(p2,p,plen);
|
||||
if (crypto_aead_decrypt(t,&tlen,k2,c,clen,a,alen,p,k2) != 0) fail("crypto_aead_decrypt with k=r overlap returns nonzero");
|
||||
if (memcmp(k2,r,rlen) != 0) fail("crypto_aead_decrypt does not handle k=r overlap");
|
||||
memcpy(k2,k,klen);
|
||||
#endif
|
||||
|
||||
c[myrandom() % clen] += 1 + (myrandom() % 255);
|
||||
if (crypto_aead_decrypt(t,&tlen,r,c,clen,a,alen,p,k) == 0)
|
||||
if ((tlen != mlen) || (memcmp(t,m,mlen) != 0) || (memcmp(r,s,slen) != 0))
|
||||
fail("crypto_aead_decrypt allows trivial forgeries");
|
||||
c[myrandom() % clen] += 1 + (myrandom() % 255);
|
||||
if (crypto_aead_decrypt(t,&tlen,r,c,clen,a,alen,p,k) == 0)
|
||||
if ((tlen != mlen) || (memcmp(t,m,mlen) != 0) || (memcmp(r,s,slen) != 0))
|
||||
fail("crypto_aead_decrypt allows trivial forgeries");
|
||||
c[myrandom() % clen] += 1 + (myrandom() % 255);
|
||||
if (crypto_aead_decrypt(t,&tlen,r,c,clen,a,alen,p,k) == 0)
|
||||
if ((tlen != mlen) || (memcmp(t,m,mlen) != 0) || (memcmp(r,s,slen) != 0))
|
||||
fail("crypto_aead_decrypt allows trivial forgeries");
|
||||
}
|
||||
}
|
||||
21
aes256gcmv1standalone-rv32/try.h
Normal file
21
aes256gcmv1standalone-rv32/try.h
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
/* provided by try.c: */
|
||||
extern const char *primitiveimplementation;
|
||||
extern void preallocate(void);
|
||||
extern void allocate(void);;
|
||||
extern void test(void);
|
||||
extern void predoit(void);
|
||||
extern void doit(void);
|
||||
|
||||
/* provided by try-anything.c: */
|
||||
extern void fail(const char *);
|
||||
extern unsigned char *alignedcalloc(unsigned long long);
|
||||
extern void checksum(const unsigned char *,unsigned long long);
|
||||
extern void double_canary(unsigned char *,unsigned char *,unsigned long long);
|
||||
extern void input_prepare(unsigned char *,unsigned char *,unsigned long long);
|
||||
extern void output_prepare(unsigned char *,unsigned char *,unsigned long long);
|
||||
extern void input_compare(const unsigned char *,const unsigned char *,unsigned long long,const char *);
|
||||
extern void output_compare(const unsigned char *,const unsigned char *,unsigned long long,const char *);
|
||||
extern unsigned long long myrandom(void);
|
||||
24
aes256gcmv1standalone-rv32/verify.c
Normal file
24
aes256gcmv1standalone-rv32/verify.c
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
#include "crypto_verify.h"
|
||||
|
||||
int crypto_verify(const unsigned char *x,const unsigned char *y)
|
||||
{
|
||||
unsigned int differentbits = 0;
|
||||
#define F(i) differentbits |= x[i] ^ y[i];
|
||||
F(0)
|
||||
F(1)
|
||||
F(2)
|
||||
F(3)
|
||||
F(4)
|
||||
F(5)
|
||||
F(6)
|
||||
F(7)
|
||||
F(8)
|
||||
F(9)
|
||||
F(10)
|
||||
F(11)
|
||||
F(12)
|
||||
F(13)
|
||||
F(14)
|
||||
F(15)
|
||||
return (1 & ((differentbits - 1) >> 8)) - 1;
|
||||
}
|
||||
Loading…
Add table
Reference in a new issue