/*      $NetBSD: aes_ct.c,v 1.3 2020/06/30 20:32:11 riastradh Exp $     */

/*
* Copyright (c) 2016 Thomas Pornin <[email protected]>
*
* Permission is hereby granted, free of charge, to any person obtaining
* a copy of this software and associated documentation files (the
* "Software"), to deal in the Software without restriction, including
* without limitation the rights to use, copy, modify, merge, publish,
* distribute, sublicense, and/or sell copies of the Software, and to
* permit persons to whom the Software is furnished to do so, subject to
* the following conditions:
*
* The above copyright notice and this permission notice shall be
* included in all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
* BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
* ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
* SOFTWARE.
*/

#include <sys/cdefs.h>
__KERNEL_RCSID(1, "$NetBSD: aes_ct.c,v 1.3 2020/06/30 20:32:11 riastradh Exp $");

#include <sys/types.h>

#ifdef _KERNEL
#include <lib/libkern/libkern.h>
#else
#include <string.h>
#endif

#include <crypto/aes/aes_bear.h>

/* see inner.h */
void
br_aes_ct_bitslice_Sbox(uint32_t *q)
{
       /*
        * This S-box implementation is a straightforward translation of
        * the circuit described by Boyar and Peralta in "A new
        * combinational logic minimization technique with applications
        * to cryptology" (https://eprint.iacr.org/2009/191.pdf).
        *
        * Note that variables x* (input) and s* (output) are numbered
        * in "reverse" order (x0 is the high bit, x7 is the low bit).
        */

       uint32_t x0, x1, x2, x3, x4, x5, x6, x7;
       uint32_t y1, y2, y3, y4, y5, y6, y7, y8, y9;
       uint32_t y10, y11, y12, y13, y14, y15, y16, y17, y18, y19;
       uint32_t y20, y21;
       uint32_t z0, z1, z2, z3, z4, z5, z6, z7, z8, z9;
       uint32_t z10, z11, z12, z13, z14, z15, z16, z17;
       uint32_t t0, t1, t2, t3, t4, t5, t6, t7, t8, t9;
       uint32_t t10, t11, t12, t13, t14, t15, t16, t17, t18, t19;
       uint32_t t20, t21, t22, t23, t24, t25, t26, t27, t28, t29;
       uint32_t t30, t31, t32, t33, t34, t35, t36, t37, t38, t39;
       uint32_t t40, t41, t42, t43, t44, t45, t46, t47, t48, t49;
       uint32_t t50, t51, t52, t53, t54, t55, t56, t57, t58, t59;
       uint32_t t60, t61, t62, t63, t64, t65, t66, t67;
       uint32_t s0, s1, s2, s3, s4, s5, s6, s7;

       x0 = q[7];
       x1 = q[6];
       x2 = q[5];
       x3 = q[4];
       x4 = q[3];
       x5 = q[2];
       x6 = q[1];
       x7 = q[0];

       /*
        * Top linear transformation.
        */
       y14 = x3 ^ x5;
       y13 = x0 ^ x6;
       y9 = x0 ^ x3;
       y8 = x0 ^ x5;
       t0 = x1 ^ x2;
       y1 = t0 ^ x7;
       y4 = y1 ^ x3;
       y12 = y13 ^ y14;
       y2 = y1 ^ x0;
       y5 = y1 ^ x6;
       y3 = y5 ^ y8;
       t1 = x4 ^ y12;
       y15 = t1 ^ x5;
       y20 = t1 ^ x1;
       y6 = y15 ^ x7;
       y10 = y15 ^ t0;
       y11 = y20 ^ y9;
       y7 = x7 ^ y11;
       y17 = y10 ^ y11;
       y19 = y10 ^ y8;
       y16 = t0 ^ y11;
       y21 = y13 ^ y16;
       y18 = x0 ^ y16;

       /*
        * Non-linear section.
        */
       t2 = y12 & y15;
       t3 = y3 & y6;
       t4 = t3 ^ t2;
       t5 = y4 & x7;
       t6 = t5 ^ t2;
       t7 = y13 & y16;
       t8 = y5 & y1;
       t9 = t8 ^ t7;
       t10 = y2 & y7;
       t11 = t10 ^ t7;
       t12 = y9 & y11;
       t13 = y14 & y17;
       t14 = t13 ^ t12;
       t15 = y8 & y10;
       t16 = t15 ^ t12;
       t17 = t4 ^ t14;
       t18 = t6 ^ t16;
       t19 = t9 ^ t14;
       t20 = t11 ^ t16;
       t21 = t17 ^ y20;
       t22 = t18 ^ y19;
       t23 = t19 ^ y21;
       t24 = t20 ^ y18;

       t25 = t21 ^ t22;
       t26 = t21 & t23;
       t27 = t24 ^ t26;
       t28 = t25 & t27;
       t29 = t28 ^ t22;
       t30 = t23 ^ t24;
       t31 = t22 ^ t26;
       t32 = t31 & t30;
       t33 = t32 ^ t24;
       t34 = t23 ^ t33;
       t35 = t27 ^ t33;
       t36 = t24 & t35;
       t37 = t36 ^ t34;
       t38 = t27 ^ t36;
       t39 = t29 & t38;
       t40 = t25 ^ t39;

       t41 = t40 ^ t37;
       t42 = t29 ^ t33;
       t43 = t29 ^ t40;
       t44 = t33 ^ t37;
       t45 = t42 ^ t41;
       z0 = t44 & y15;
       z1 = t37 & y6;
       z2 = t33 & x7;
       z3 = t43 & y16;
       z4 = t40 & y1;
       z5 = t29 & y7;
       z6 = t42 & y11;
       z7 = t45 & y17;
       z8 = t41 & y10;
       z9 = t44 & y12;
       z10 = t37 & y3;
       z11 = t33 & y4;
       z12 = t43 & y13;
       z13 = t40 & y5;
       z14 = t29 & y2;
       z15 = t42 & y9;
       z16 = t45 & y14;
       z17 = t41 & y8;

       /*
        * Bottom linear transformation.
        */
       t46 = z15 ^ z16;
       t47 = z10 ^ z11;
       t48 = z5 ^ z13;
       t49 = z9 ^ z10;
       t50 = z2 ^ z12;
       t51 = z2 ^ z5;
       t52 = z7 ^ z8;
       t53 = z0 ^ z3;
       t54 = z6 ^ z7;
       t55 = z16 ^ z17;
       t56 = z12 ^ t48;
       t57 = t50 ^ t53;
       t58 = z4 ^ t46;
       t59 = z3 ^ t54;
       t60 = t46 ^ t57;
       t61 = z14 ^ t57;
       t62 = t52 ^ t58;
       t63 = t49 ^ t58;
       t64 = z4 ^ t59;
       t65 = t61 ^ t62;
       t66 = z1 ^ t63;
       s0 = t59 ^ t63;
       s6 = t56 ^ ~t62;
       s7 = t48 ^ ~t60;
       t67 = t64 ^ t65;
       s3 = t53 ^ t66;
       s4 = t51 ^ t66;
       s5 = t47 ^ t65;
       s1 = t64 ^ ~s3;
       s2 = t55 ^ ~t67;

       q[7] = s0;
       q[6] = s1;
       q[5] = s2;
       q[4] = s3;
       q[3] = s4;
       q[2] = s5;
       q[1] = s6;
       q[0] = s7;
}

/* see inner.h */
void
br_aes_ct_ortho(uint32_t *q)
{
#define SWAPN(cl, ch, s, x, y)   do { \
               uint32_t a, b; \
               a = (x); \
               b = (y); \
               (x) = (a & (uint32_t)cl) | ((b & (uint32_t)cl) << (s)); \
               (y) = ((a & (uint32_t)ch) >> (s)) | (b & (uint32_t)ch); \
       } while (0)

#define SWAP2(x, y)   SWAPN(0x55555555, 0xAAAAAAAA, 1, x, y)
#define SWAP4(x, y)   SWAPN(0x33333333, 0xCCCCCCCC, 2, x, y)
#define SWAP8(x, y)   SWAPN(0x0F0F0F0F, 0xF0F0F0F0, 4, x, y)

       SWAP2(q[0], q[1]);
       SWAP2(q[2], q[3]);
       SWAP2(q[4], q[5]);
       SWAP2(q[6], q[7]);

       SWAP4(q[0], q[2]);
       SWAP4(q[1], q[3]);
       SWAP4(q[4], q[6]);
       SWAP4(q[5], q[7]);

       SWAP8(q[0], q[4]);
       SWAP8(q[1], q[5]);
       SWAP8(q[2], q[6]);
       SWAP8(q[3], q[7]);
}

static const unsigned char Rcon[] = {
       0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1B, 0x36
};

static uint32_t
sub_word(uint32_t x)
{
       uint32_t q[8];
       int i;

       for (i = 0; i < 8; i ++) {
               q[i] = x;
       }
       br_aes_ct_ortho(q);
       br_aes_ct_bitslice_Sbox(q);
       br_aes_ct_ortho(q);
       return q[0];
}

/* see inner.h */
unsigned
br_aes_ct_keysched(uint32_t *comp_skey, const void *key, size_t key_len)
{
       unsigned num_rounds;
       int i, j, k, nk, nkf;
       uint32_t tmp;
       uint32_t skey[120];

       switch (key_len) {
       case 16:
               num_rounds = 10;
               break;
       case 24:
               num_rounds = 12;
               break;
       case 32:
               num_rounds = 14;
               break;
       default:
               /* abort(); */
               return 0;
       }
       nk = (int)(key_len >> 2);
       nkf = (int)((num_rounds + 1) << 2);
       tmp = 0;
       for (i = 0; i < nk; i ++) {
               tmp = br_dec32le((const unsigned char *)key + (i << 2));
               skey[(i << 1) + 0] = tmp;
               skey[(i << 1) + 1] = tmp;
       }
       for (i = nk, j = 0, k = 0; i < nkf; i ++) {
               if (j == 0) {
                       tmp = (tmp << 24) | (tmp >> 8);
                       tmp = sub_word(tmp) ^ Rcon[k];
               } else if (nk > 6 && j == 4) {
                       tmp = sub_word(tmp);
               }
               tmp ^= skey[(i - nk) << 1];
               skey[(i << 1) + 0] = tmp;
               skey[(i << 1) + 1] = tmp;
               if (++ j == nk) {
                       j = 0;
                       k ++;
               }
       }
       for (i = 0; i < nkf; i += 4) {
               br_aes_ct_ortho(skey + (i << 1));
       }
       for (i = 0, j = 0; i < nkf; i ++, j += 2) {
               comp_skey[i] = (skey[j + 0] & 0x55555555)
                       | (skey[j + 1] & 0xAAAAAAAA);
       }
       return num_rounds;
}

/* see inner.h */
void
br_aes_ct_skey_expand(uint32_t *skey,
       unsigned num_rounds, const uint32_t *comp_skey)
{
       unsigned u, v, n;

       n = (num_rounds + 1) << 2;
       for (u = 0, v = 0; u < n; u ++, v += 2) {
               uint32_t x, y;

               x = y = comp_skey[u];
               x &= 0x55555555;
               skey[v + 0] = x | (x << 1);
               y &= 0xAAAAAAAA;
               skey[v + 1] = y | (y >> 1);
       }
}

/* NetBSD additions, for computing the standard AES key schedule */

unsigned
br_aes_ct_keysched_stdenc(uint32_t *skey, const void *key, size_t key_len)
{
       unsigned num_rounds;
       int i, j, k, nk, nkf;
       uint32_t tmp;

       switch (key_len) {
       case 16:
               num_rounds = 10;
               break;
       case 24:
               num_rounds = 12;
               break;
       case 32:
               num_rounds = 14;
               break;
       default:
               /* abort(); */
               return 0;
       }
       nk = (int)(key_len >> 2);
       nkf = (int)((num_rounds + 1) << 2);
       tmp = 0;
       for (i = 0; i < nk; i ++) {
               tmp = br_dec32le((const unsigned char *)key + (i << 2));
               skey[i] = tmp;
       }
       for (i = nk, j = 0, k = 0; i < nkf; i ++) {
               if (j == 0) {
                       tmp = (tmp << 24) | (tmp >> 8);
                       tmp = sub_word(tmp) ^ Rcon[k];
               } else if (nk > 6 && j == 4) {
                       tmp = sub_word(tmp);
               }
               tmp ^= skey[i - nk];
               skey[i] = tmp;
               if (++ j == nk) {
                       j = 0;
                       k ++;
               }
       }
       return num_rounds;
}

unsigned
br_aes_ct_keysched_stddec(uint32_t *skey, const void *key, size_t key_len)
{
       uint32_t tkey[60];
       uint32_t q[8];
       unsigned num_rounds;
       unsigned i;

       num_rounds = br_aes_ct_keysched_stdenc(skey, key, key_len);
       if (num_rounds == 0)
               return 0;

       tkey[0] = skey[4*num_rounds + 0];
       tkey[1] = skey[4*num_rounds + 1];
       tkey[2] = skey[4*num_rounds + 2];
       tkey[3] = skey[4*num_rounds + 3];
       for (i = 1; i < num_rounds; i++) {
               q[2*0] = skey[4*i + 0];
               q[2*1] = skey[4*i + 1];
               q[2*2] = skey[4*i + 2];
               q[2*3] = skey[4*i + 3];
               q[1] = q[3] = q[5] = q[7] = 0;

               br_aes_ct_ortho(q);
               br_aes_ct_inv_mix_columns(q);
               br_aes_ct_ortho(q);

               tkey[4*(num_rounds - i) + 0] = q[2*0];
               tkey[4*(num_rounds - i) + 1] = q[2*1];
               tkey[4*(num_rounds - i) + 2] = q[2*2];
               tkey[4*(num_rounds - i) + 3] = q[2*3];
       }
       tkey[4*num_rounds + 0] = skey[0];
       tkey[4*num_rounds + 1] = skey[1];
       tkey[4*num_rounds + 2] = skey[2];
       tkey[4*num_rounds + 3] = skey[3];

       memcpy(skey, tkey, 4*(num_rounds + 1)*sizeof(uint32_t));
       explicit_memset(tkey, 0, 4*(num_rounds + 1)*sizeof(uint32_t));
       return num_rounds;
}

You are viewing proxied material from ftp.icm.edu.pl. The copyright of proxied material belongs to its original authors. Any comments or complaints in relation to proxied material should be directed to the original authors of the content concerned. Please see the disclaimer for more details.