1480 lines
41 KiB
Rust
1480 lines
41 KiB
Rust
//! Fixsliced implementations of AES-128, AES-192 and AES-256 (32-bit)
|
|
//! adapted from the C implementation
|
|
//!
|
|
//! All implementations are fully bitsliced and do not rely on any
|
|
//! Look-Up Table (LUT).
|
|
//!
|
|
//! See the paper at <https://eprint.iacr.org/2020/1123.pdf> for more details.
|
|
//!
|
|
//! # Author (original C code)
|
|
//!
|
|
//! Alexandre Adomnicai, Nanyang Technological University, Singapore
|
|
//! <alexandre.adomnicai@ntu.edu.sg>
|
|
//!
|
|
//! Originally licensed MIT. Relicensed as Apache 2.0+MIT with permission.
|
|
|
|
#![allow(clippy::unreadable_literal)]
|
|
|
|
use crate::Block;
|
|
use cipher::{consts::U2, generic_array::GenericArray};
|
|
|
|
/// AES block batch size for this implementation
|
|
pub(crate) type FixsliceBlocks = U2;
|
|
|
|
pub(crate) type BatchBlocks = GenericArray<Block, FixsliceBlocks>;
|
|
|
|
/// AES-128 round keys
|
|
pub(crate) type FixsliceKeys128 = [u32; 88];
|
|
|
|
/// AES-192 round keys
|
|
pub(crate) type FixsliceKeys192 = [u32; 104];
|
|
|
|
/// AES-256 round keys
|
|
pub(crate) type FixsliceKeys256 = [u32; 120];
|
|
|
|
/// 256-bit internal state
|
|
pub(crate) type State = [u32; 8];
|
|
|
|
/// Fully bitsliced AES-128 key schedule to match the fully-fixsliced representation.
|
|
pub(crate) fn aes128_key_schedule(key: &[u8; 16]) -> FixsliceKeys128 {
|
|
let mut rkeys = [0u32; 88];
|
|
|
|
bitslice(&mut rkeys[..8], key, key);
|
|
|
|
let mut rk_off = 0;
|
|
for rcon in 0..10 {
|
|
memshift32(&mut rkeys, rk_off);
|
|
rk_off += 8;
|
|
|
|
sub_bytes(&mut rkeys[rk_off..(rk_off + 8)]);
|
|
sub_bytes_nots(&mut rkeys[rk_off..(rk_off + 8)]);
|
|
|
|
if rcon < 8 {
|
|
add_round_constant_bit(&mut rkeys[rk_off..(rk_off + 8)], rcon);
|
|
} else {
|
|
add_round_constant_bit(&mut rkeys[rk_off..(rk_off + 8)], rcon - 8);
|
|
add_round_constant_bit(&mut rkeys[rk_off..(rk_off + 8)], rcon - 7);
|
|
add_round_constant_bit(&mut rkeys[rk_off..(rk_off + 8)], rcon - 5);
|
|
add_round_constant_bit(&mut rkeys[rk_off..(rk_off + 8)], rcon - 4);
|
|
}
|
|
|
|
xor_columns(&mut rkeys, rk_off, 8, ror_distance(1, 3));
|
|
}
|
|
|
|
// Adjust to match fixslicing format
|
|
#[cfg(aes_compact)]
|
|
{
|
|
for i in (8..88).step_by(16) {
|
|
inv_shift_rows_1(&mut rkeys[i..(i + 8)]);
|
|
}
|
|
}
|
|
#[cfg(not(aes_compact))]
|
|
{
|
|
for i in (8..72).step_by(32) {
|
|
inv_shift_rows_1(&mut rkeys[i..(i + 8)]);
|
|
inv_shift_rows_2(&mut rkeys[(i + 8)..(i + 16)]);
|
|
inv_shift_rows_3(&mut rkeys[(i + 16)..(i + 24)]);
|
|
}
|
|
inv_shift_rows_1(&mut rkeys[72..80]);
|
|
}
|
|
|
|
// Account for NOTs removed from sub_bytes
|
|
for i in 1..11 {
|
|
sub_bytes_nots(&mut rkeys[(i * 8)..(i * 8 + 8)]);
|
|
}
|
|
|
|
rkeys
|
|
}
|
|
|
|
/// Fully bitsliced AES-192 key schedule to match the fully-fixsliced representation.
|
|
pub(crate) fn aes192_key_schedule(key: &[u8; 24]) -> FixsliceKeys192 {
|
|
let mut rkeys = [0u32; 104];
|
|
let mut tmp = [0u32; 8];
|
|
|
|
bitslice(&mut rkeys[..8], &key[..16], &key[..16]);
|
|
bitslice(&mut tmp, &key[8..], &key[8..]);
|
|
|
|
let mut rcon = 0;
|
|
let mut rk_off = 8;
|
|
|
|
loop {
|
|
for i in 0..8 {
|
|
rkeys[rk_off + i] =
|
|
(0x0f0f0f0f & (tmp[i] >> 4)) | (0xf0f0f0f0 & (rkeys[(rk_off - 8) + i] << 4));
|
|
}
|
|
|
|
sub_bytes(&mut tmp);
|
|
sub_bytes_nots(&mut tmp);
|
|
|
|
add_round_constant_bit(&mut tmp, rcon);
|
|
rcon += 1;
|
|
|
|
for i in 0..8 {
|
|
let mut ti = rkeys[rk_off + i];
|
|
ti ^= 0x30303030 & ror(tmp[i], ror_distance(1, 1));
|
|
ti ^= 0xc0c0c0c0 & (ti << 2);
|
|
tmp[i] = ti;
|
|
}
|
|
rkeys[rk_off..(rk_off + 8)].copy_from_slice(&tmp);
|
|
rk_off += 8;
|
|
|
|
for i in 0..8 {
|
|
let ui = tmp[i];
|
|
let mut ti = (0x0f0f0f0f & (rkeys[(rk_off - 16) + i] >> 4)) | (0xf0f0f0f0 & (ui << 4));
|
|
ti ^= 0x03030303 & (ui >> 6);
|
|
tmp[i] =
|
|
ti ^ (0xfcfcfcfc & (ti << 2)) ^ (0xf0f0f0f0 & (ti << 4)) ^ (0xc0c0c0c0 & (ti << 6));
|
|
}
|
|
rkeys[rk_off..(rk_off + 8)].copy_from_slice(&tmp);
|
|
rk_off += 8;
|
|
|
|
sub_bytes(&mut tmp);
|
|
sub_bytes_nots(&mut tmp);
|
|
|
|
add_round_constant_bit(&mut tmp, rcon);
|
|
rcon += 1;
|
|
|
|
for i in 0..8 {
|
|
let mut ti = (0x0f0f0f0f & (rkeys[(rk_off - 16) + i] >> 4))
|
|
| (0xf0f0f0f0 & (rkeys[(rk_off - 8) + i] << 4));
|
|
ti ^= 0x03030303 & ror(tmp[i], ror_distance(1, 3));
|
|
rkeys[rk_off + i] =
|
|
ti ^ (0xfcfcfcfc & (ti << 2)) ^ (0xf0f0f0f0 & (ti << 4)) ^ (0xc0c0c0c0 & (ti << 6));
|
|
}
|
|
rk_off += 8;
|
|
|
|
if rcon >= 8 {
|
|
break;
|
|
}
|
|
|
|
for i in 0..8 {
|
|
let ui = rkeys[(rk_off - 8) + i];
|
|
let mut ti = rkeys[(rk_off - 16) + i];
|
|
ti ^= 0x30303030 & (ui >> 2);
|
|
ti ^= 0xc0c0c0c0 & (ti << 2);
|
|
tmp[i] = ti;
|
|
}
|
|
}
|
|
|
|
// Adjust to match fixslicing format
|
|
#[cfg(aes_compact)]
|
|
{
|
|
for i in (8..104).step_by(16) {
|
|
inv_shift_rows_1(&mut rkeys[i..(i + 8)]);
|
|
}
|
|
}
|
|
#[cfg(not(aes_compact))]
|
|
{
|
|
for i in (0..96).step_by(32) {
|
|
inv_shift_rows_1(&mut rkeys[(i + 8)..(i + 16)]);
|
|
inv_shift_rows_2(&mut rkeys[(i + 16)..(i + 24)]);
|
|
inv_shift_rows_3(&mut rkeys[(i + 24)..(i + 32)]);
|
|
}
|
|
}
|
|
|
|
// Account for NOTs removed from sub_bytes
|
|
for i in 1..13 {
|
|
sub_bytes_nots(&mut rkeys[(i * 8)..(i * 8 + 8)]);
|
|
}
|
|
|
|
rkeys
|
|
}
|
|
|
|
/// Fully bitsliced AES-256 key schedule to match the fully-fixsliced representation.
|
|
pub(crate) fn aes256_key_schedule(key: &[u8; 32]) -> FixsliceKeys256 {
|
|
let mut rkeys = [0u32; 120];
|
|
|
|
bitslice(&mut rkeys[..8], &key[..16], &key[..16]);
|
|
bitslice(&mut rkeys[8..16], &key[16..], &key[16..]);
|
|
|
|
let mut rk_off = 8;
|
|
|
|
let mut rcon = 0;
|
|
loop {
|
|
memshift32(&mut rkeys, rk_off);
|
|
rk_off += 8;
|
|
|
|
sub_bytes(&mut rkeys[rk_off..(rk_off + 8)]);
|
|
sub_bytes_nots(&mut rkeys[rk_off..(rk_off + 8)]);
|
|
|
|
add_round_constant_bit(&mut rkeys[rk_off..(rk_off + 8)], rcon);
|
|
xor_columns(&mut rkeys, rk_off, 16, ror_distance(1, 3));
|
|
rcon += 1;
|
|
|
|
if rcon == 7 {
|
|
break;
|
|
}
|
|
|
|
memshift32(&mut rkeys, rk_off);
|
|
rk_off += 8;
|
|
|
|
sub_bytes(&mut rkeys[rk_off..(rk_off + 8)]);
|
|
sub_bytes_nots(&mut rkeys[rk_off..(rk_off + 8)]);
|
|
|
|
xor_columns(&mut rkeys, rk_off, 16, ror_distance(0, 3));
|
|
}
|
|
|
|
// Adjust to match fixslicing format
|
|
#[cfg(aes_compact)]
|
|
{
|
|
for i in (8..120).step_by(16) {
|
|
inv_shift_rows_1(&mut rkeys[i..(i + 8)]);
|
|
}
|
|
}
|
|
#[cfg(not(aes_compact))]
|
|
{
|
|
for i in (8..104).step_by(32) {
|
|
inv_shift_rows_1(&mut rkeys[i..(i + 8)]);
|
|
inv_shift_rows_2(&mut rkeys[(i + 8)..(i + 16)]);
|
|
inv_shift_rows_3(&mut rkeys[(i + 16)..(i + 24)]);
|
|
}
|
|
inv_shift_rows_1(&mut rkeys[104..112]);
|
|
}
|
|
|
|
// Account for NOTs removed from sub_bytes
|
|
for i in 1..15 {
|
|
sub_bytes_nots(&mut rkeys[(i * 8)..(i * 8 + 8)]);
|
|
}
|
|
|
|
rkeys
|
|
}
|
|
|
|
/// Fully-fixsliced AES-128 decryption (the InvShiftRows is completely omitted).
|
|
///
|
|
/// Decrypts four blocks in-place and in parallel.
|
|
pub(crate) fn aes128_decrypt(rkeys: &FixsliceKeys128, blocks: &BatchBlocks) -> BatchBlocks {
|
|
let mut state = State::default();
|
|
|
|
bitslice(&mut state, &blocks[0], &blocks[1]);
|
|
|
|
add_round_key(&mut state, &rkeys[80..]);
|
|
inv_sub_bytes(&mut state);
|
|
|
|
#[cfg(not(aes_compact))]
|
|
{
|
|
inv_shift_rows_2(&mut state);
|
|
}
|
|
|
|
let mut rk_off = 72;
|
|
loop {
|
|
#[cfg(aes_compact)]
|
|
{
|
|
inv_shift_rows_2(&mut state);
|
|
}
|
|
|
|
add_round_key(&mut state, &rkeys[rk_off..(rk_off + 8)]);
|
|
inv_mix_columns_1(&mut state);
|
|
inv_sub_bytes(&mut state);
|
|
rk_off -= 8;
|
|
|
|
if rk_off == 0 {
|
|
break;
|
|
}
|
|
|
|
add_round_key(&mut state, &rkeys[rk_off..(rk_off + 8)]);
|
|
inv_mix_columns_0(&mut state);
|
|
inv_sub_bytes(&mut state);
|
|
rk_off -= 8;
|
|
|
|
#[cfg(not(aes_compact))]
|
|
{
|
|
add_round_key(&mut state, &rkeys[rk_off..(rk_off + 8)]);
|
|
inv_mix_columns_3(&mut state);
|
|
inv_sub_bytes(&mut state);
|
|
rk_off -= 8;
|
|
|
|
add_round_key(&mut state, &rkeys[rk_off..(rk_off + 8)]);
|
|
inv_mix_columns_2(&mut state);
|
|
inv_sub_bytes(&mut state);
|
|
rk_off -= 8;
|
|
}
|
|
}
|
|
|
|
add_round_key(&mut state, &rkeys[..8]);
|
|
|
|
inv_bitslice(&state)
|
|
}
|
|
|
|
/// Fully-fixsliced AES-128 encryption (the ShiftRows is completely omitted).
|
|
///
|
|
/// Encrypts four blocks in-place and in parallel.
|
|
pub(crate) fn aes128_encrypt(rkeys: &FixsliceKeys128, blocks: &BatchBlocks) -> BatchBlocks {
|
|
let mut state = State::default();
|
|
|
|
bitslice(&mut state, &blocks[0], &blocks[1]);
|
|
|
|
add_round_key(&mut state, &rkeys[..8]);
|
|
|
|
let mut rk_off = 8;
|
|
loop {
|
|
sub_bytes(&mut state);
|
|
mix_columns_1(&mut state);
|
|
add_round_key(&mut state, &rkeys[rk_off..(rk_off + 8)]);
|
|
rk_off += 8;
|
|
|
|
#[cfg(aes_compact)]
|
|
{
|
|
shift_rows_2(&mut state);
|
|
}
|
|
|
|
if rk_off == 80 {
|
|
break;
|
|
}
|
|
|
|
#[cfg(not(aes_compact))]
|
|
{
|
|
sub_bytes(&mut state);
|
|
mix_columns_2(&mut state);
|
|
add_round_key(&mut state, &rkeys[rk_off..(rk_off + 8)]);
|
|
rk_off += 8;
|
|
|
|
sub_bytes(&mut state);
|
|
mix_columns_3(&mut state);
|
|
add_round_key(&mut state, &rkeys[rk_off..(rk_off + 8)]);
|
|
rk_off += 8;
|
|
}
|
|
|
|
sub_bytes(&mut state);
|
|
mix_columns_0(&mut state);
|
|
add_round_key(&mut state, &rkeys[rk_off..(rk_off + 8)]);
|
|
rk_off += 8;
|
|
}
|
|
|
|
#[cfg(not(aes_compact))]
|
|
{
|
|
shift_rows_2(&mut state);
|
|
}
|
|
|
|
sub_bytes(&mut state);
|
|
add_round_key(&mut state, &rkeys[80..]);
|
|
|
|
inv_bitslice(&state)
|
|
}
|
|
|
|
/// Fully-fixsliced AES-192 decryption (the InvShiftRows is completely omitted).
|
|
///
|
|
/// Decrypts four blocks in-place and in parallel.
|
|
pub(crate) fn aes192_decrypt(rkeys: &FixsliceKeys192, blocks: &BatchBlocks) -> BatchBlocks {
|
|
let mut state = State::default();
|
|
|
|
bitslice(&mut state, &blocks[0], &blocks[1]);
|
|
|
|
add_round_key(&mut state, &rkeys[96..]);
|
|
inv_sub_bytes(&mut state);
|
|
|
|
let mut rk_off = 88;
|
|
loop {
|
|
#[cfg(aes_compact)]
|
|
{
|
|
inv_shift_rows_2(&mut state);
|
|
}
|
|
#[cfg(not(aes_compact))]
|
|
{
|
|
add_round_key(&mut state, &rkeys[rk_off..(rk_off + 8)]);
|
|
inv_mix_columns_3(&mut state);
|
|
inv_sub_bytes(&mut state);
|
|
rk_off -= 8;
|
|
|
|
add_round_key(&mut state, &rkeys[rk_off..(rk_off + 8)]);
|
|
inv_mix_columns_2(&mut state);
|
|
inv_sub_bytes(&mut state);
|
|
rk_off -= 8;
|
|
}
|
|
|
|
add_round_key(&mut state, &rkeys[rk_off..(rk_off + 8)]);
|
|
inv_mix_columns_1(&mut state);
|
|
inv_sub_bytes(&mut state);
|
|
rk_off -= 8;
|
|
|
|
if rk_off == 0 {
|
|
break;
|
|
}
|
|
|
|
add_round_key(&mut state, &rkeys[rk_off..(rk_off + 8)]);
|
|
inv_mix_columns_0(&mut state);
|
|
inv_sub_bytes(&mut state);
|
|
rk_off -= 8;
|
|
}
|
|
|
|
add_round_key(&mut state, &rkeys[..8]);
|
|
|
|
inv_bitslice(&state)
|
|
}
|
|
|
|
/// Fully-fixsliced AES-192 encryption (the ShiftRows is completely omitted).
|
|
///
|
|
/// Encrypts four blocks in-place and in parallel.
|
|
pub(crate) fn aes192_encrypt(rkeys: &FixsliceKeys192, blocks: &BatchBlocks) -> BatchBlocks {
|
|
let mut state = State::default();
|
|
|
|
bitslice(&mut state, &blocks[0], &blocks[1]);
|
|
|
|
add_round_key(&mut state, &rkeys[..8]);
|
|
|
|
let mut rk_off = 8;
|
|
loop {
|
|
sub_bytes(&mut state);
|
|
mix_columns_1(&mut state);
|
|
add_round_key(&mut state, &rkeys[rk_off..(rk_off + 8)]);
|
|
rk_off += 8;
|
|
|
|
#[cfg(aes_compact)]
|
|
{
|
|
shift_rows_2(&mut state);
|
|
}
|
|
#[cfg(not(aes_compact))]
|
|
{
|
|
sub_bytes(&mut state);
|
|
mix_columns_2(&mut state);
|
|
add_round_key(&mut state, &rkeys[rk_off..(rk_off + 8)]);
|
|
rk_off += 8;
|
|
|
|
sub_bytes(&mut state);
|
|
mix_columns_3(&mut state);
|
|
add_round_key(&mut state, &rkeys[rk_off..(rk_off + 8)]);
|
|
rk_off += 8;
|
|
}
|
|
|
|
if rk_off == 96 {
|
|
break;
|
|
}
|
|
|
|
sub_bytes(&mut state);
|
|
mix_columns_0(&mut state);
|
|
add_round_key(&mut state, &rkeys[rk_off..(rk_off + 8)]);
|
|
rk_off += 8;
|
|
}
|
|
|
|
sub_bytes(&mut state);
|
|
add_round_key(&mut state, &rkeys[96..]);
|
|
|
|
inv_bitslice(&state)
|
|
}
|
|
|
|
/// Fully-fixsliced AES-256 decryption (the InvShiftRows is completely omitted).
|
|
///
|
|
/// Decrypts four blocks in-place and in parallel.
|
|
pub(crate) fn aes256_decrypt(rkeys: &FixsliceKeys256, blocks: &BatchBlocks) -> BatchBlocks {
|
|
let mut state = State::default();
|
|
|
|
bitslice(&mut state, &blocks[0], &blocks[1]);
|
|
|
|
add_round_key(&mut state, &rkeys[112..]);
|
|
inv_sub_bytes(&mut state);
|
|
|
|
#[cfg(not(aes_compact))]
|
|
{
|
|
inv_shift_rows_2(&mut state);
|
|
}
|
|
|
|
let mut rk_off = 104;
|
|
loop {
|
|
#[cfg(aes_compact)]
|
|
{
|
|
inv_shift_rows_2(&mut state);
|
|
}
|
|
|
|
add_round_key(&mut state, &rkeys[rk_off..(rk_off + 8)]);
|
|
inv_mix_columns_1(&mut state);
|
|
inv_sub_bytes(&mut state);
|
|
rk_off -= 8;
|
|
|
|
if rk_off == 0 {
|
|
break;
|
|
}
|
|
|
|
add_round_key(&mut state, &rkeys[rk_off..(rk_off + 8)]);
|
|
inv_mix_columns_0(&mut state);
|
|
inv_sub_bytes(&mut state);
|
|
rk_off -= 8;
|
|
|
|
#[cfg(not(aes_compact))]
|
|
{
|
|
add_round_key(&mut state, &rkeys[rk_off..(rk_off + 8)]);
|
|
inv_mix_columns_3(&mut state);
|
|
inv_sub_bytes(&mut state);
|
|
rk_off -= 8;
|
|
|
|
add_round_key(&mut state, &rkeys[rk_off..(rk_off + 8)]);
|
|
inv_mix_columns_2(&mut state);
|
|
inv_sub_bytes(&mut state);
|
|
rk_off -= 8;
|
|
}
|
|
}
|
|
|
|
add_round_key(&mut state, &rkeys[..8]);
|
|
|
|
inv_bitslice(&state)
|
|
}
|
|
|
|
/// Fully-fixsliced AES-256 encryption (the ShiftRows is completely omitted).
|
|
///
|
|
/// Encrypts four blocks in-place and in parallel.
|
|
pub(crate) fn aes256_encrypt(rkeys: &FixsliceKeys256, blocks: &BatchBlocks) -> BatchBlocks {
|
|
let mut state = State::default();
|
|
|
|
bitslice(&mut state, &blocks[0], &blocks[1]);
|
|
|
|
add_round_key(&mut state, &rkeys[..8]);
|
|
|
|
let mut rk_off = 8;
|
|
loop {
|
|
sub_bytes(&mut state);
|
|
mix_columns_1(&mut state);
|
|
add_round_key(&mut state, &rkeys[rk_off..(rk_off + 8)]);
|
|
rk_off += 8;
|
|
|
|
#[cfg(aes_compact)]
|
|
{
|
|
shift_rows_2(&mut state);
|
|
}
|
|
|
|
if rk_off == 112 {
|
|
break;
|
|
}
|
|
|
|
#[cfg(not(aes_compact))]
|
|
{
|
|
sub_bytes(&mut state);
|
|
mix_columns_2(&mut state);
|
|
add_round_key(&mut state, &rkeys[rk_off..(rk_off + 8)]);
|
|
rk_off += 8;
|
|
|
|
sub_bytes(&mut state);
|
|
mix_columns_3(&mut state);
|
|
add_round_key(&mut state, &rkeys[rk_off..(rk_off + 8)]);
|
|
rk_off += 8;
|
|
}
|
|
|
|
sub_bytes(&mut state);
|
|
mix_columns_0(&mut state);
|
|
add_round_key(&mut state, &rkeys[rk_off..(rk_off + 8)]);
|
|
rk_off += 8;
|
|
}
|
|
|
|
#[cfg(not(aes_compact))]
|
|
{
|
|
shift_rows_2(&mut state);
|
|
}
|
|
|
|
sub_bytes(&mut state);
|
|
add_round_key(&mut state, &rkeys[112..]);
|
|
|
|
inv_bitslice(&state)
|
|
}
|
|
|
|
/// Note that the 4 bitwise NOT (^= 0xffffffff) are accounted for here so that it is a true
|
|
/// inverse of 'sub_bytes'.
|
|
fn inv_sub_bytes(state: &mut [u32]) {
|
|
debug_assert_eq!(state.len(), 8);
|
|
|
|
// Scheduled using https://github.com/Ko-/aes-armcortexm/tree/public/scheduler
|
|
// Inline "stack" comments reflect suggested stores and loads (ARM Cortex-M3 and M4)
|
|
|
|
let u7 = state[0];
|
|
let u6 = state[1];
|
|
let u5 = state[2];
|
|
let u4 = state[3];
|
|
let u3 = state[4];
|
|
let u2 = state[5];
|
|
let u1 = state[6];
|
|
let u0 = state[7];
|
|
|
|
let t23 = u0 ^ u3;
|
|
let t8 = u1 ^ t23;
|
|
let m2 = t23 & t8;
|
|
let t4 = u4 ^ t8;
|
|
let t22 = u1 ^ u3;
|
|
let t2 = u0 ^ u1;
|
|
let t1 = u3 ^ u4;
|
|
// t23 -> stack
|
|
let t9 = u7 ^ t1;
|
|
// t8 -> stack
|
|
let m7 = t22 & t9;
|
|
// t9 -> stack
|
|
let t24 = u4 ^ u7;
|
|
// m7 -> stack
|
|
let t10 = t2 ^ t24;
|
|
// u4 -> stack
|
|
let m14 = t2 & t10;
|
|
let r5 = u6 ^ u7;
|
|
// m2 -> stack
|
|
let t3 = t1 ^ r5;
|
|
// t2 -> stack
|
|
let t13 = t2 ^ r5;
|
|
let t19 = t22 ^ r5;
|
|
// t3 -> stack
|
|
let t17 = u2 ^ t19;
|
|
// t4 -> stack
|
|
let t25 = u2 ^ t1;
|
|
let r13 = u1 ^ u6;
|
|
// t25 -> stack
|
|
let t20 = t24 ^ r13;
|
|
// t17 -> stack
|
|
let m9 = t20 & t17;
|
|
// t20 -> stack
|
|
let r17 = u2 ^ u5;
|
|
// t22 -> stack
|
|
let t6 = t22 ^ r17;
|
|
// t13 -> stack
|
|
let m1 = t13 & t6;
|
|
let y5 = u0 ^ r17;
|
|
let m4 = t19 & y5;
|
|
let m5 = m4 ^ m1;
|
|
let m17 = m5 ^ t24;
|
|
let r18 = u5 ^ u6;
|
|
let t27 = t1 ^ r18;
|
|
let t15 = t10 ^ t27;
|
|
// t6 -> stack
|
|
let m11 = t1 & t15;
|
|
let m15 = m14 ^ m11;
|
|
let m21 = m17 ^ m15;
|
|
// t1 -> stack
|
|
// t4 <- stack
|
|
let m12 = t4 & t27;
|
|
let m13 = m12 ^ m11;
|
|
let t14 = t10 ^ r18;
|
|
let m3 = t14 ^ m1;
|
|
// m2 <- stack
|
|
let m16 = m3 ^ m2;
|
|
let m20 = m16 ^ m13;
|
|
// u4 <- stack
|
|
let r19 = u2 ^ u4;
|
|
let t16 = r13 ^ r19;
|
|
// t3 <- stack
|
|
let t26 = t3 ^ t16;
|
|
let m6 = t3 & t16;
|
|
let m8 = t26 ^ m6;
|
|
// t10 -> stack
|
|
// m7 <- stack
|
|
let m18 = m8 ^ m7;
|
|
let m22 = m18 ^ m13;
|
|
let m25 = m22 & m20;
|
|
let m26 = m21 ^ m25;
|
|
let m10 = m9 ^ m6;
|
|
let m19 = m10 ^ m15;
|
|
// t25 <- stack
|
|
let m23 = m19 ^ t25;
|
|
let m28 = m23 ^ m25;
|
|
let m24 = m22 ^ m23;
|
|
let m30 = m26 & m24;
|
|
let m39 = m23 ^ m30;
|
|
let m48 = m39 & y5;
|
|
let m57 = m39 & t19;
|
|
// m48 -> stack
|
|
let m36 = m24 ^ m25;
|
|
let m31 = m20 & m23;
|
|
let m27 = m20 ^ m21;
|
|
let m32 = m27 & m31;
|
|
let m29 = m28 & m27;
|
|
let m37 = m21 ^ m29;
|
|
// m39 -> stack
|
|
let m42 = m37 ^ m39;
|
|
let m52 = m42 & t15;
|
|
// t27 -> stack
|
|
// t1 <- stack
|
|
let m61 = m42 & t1;
|
|
let p0 = m52 ^ m61;
|
|
let p16 = m57 ^ m61;
|
|
// m57 -> stack
|
|
// t20 <- stack
|
|
let m60 = m37 & t20;
|
|
// p16 -> stack
|
|
// t17 <- stack
|
|
let m51 = m37 & t17;
|
|
let m33 = m27 ^ m25;
|
|
let m38 = m32 ^ m33;
|
|
let m43 = m37 ^ m38;
|
|
let m49 = m43 & t16;
|
|
let p6 = m49 ^ m60;
|
|
let p13 = m49 ^ m51;
|
|
let m58 = m43 & t3;
|
|
// t9 <- stack
|
|
let m50 = m38 & t9;
|
|
// t22 <- stack
|
|
let m59 = m38 & t22;
|
|
// p6 -> stack
|
|
let p1 = m58 ^ m59;
|
|
let p7 = p0 ^ p1;
|
|
let m34 = m21 & m22;
|
|
let m35 = m24 & m34;
|
|
let m40 = m35 ^ m36;
|
|
let m41 = m38 ^ m40;
|
|
let m45 = m42 ^ m41;
|
|
// t27 <- stack
|
|
let m53 = m45 & t27;
|
|
let p8 = m50 ^ m53;
|
|
let p23 = p7 ^ p8;
|
|
// t4 <- stack
|
|
let m62 = m45 & t4;
|
|
let p14 = m49 ^ m62;
|
|
let s6 = p14 ^ p23;
|
|
// t10 <- stack
|
|
let m54 = m41 & t10;
|
|
let p2 = m54 ^ m62;
|
|
let p22 = p2 ^ p7;
|
|
let s0 = p13 ^ p22;
|
|
let p17 = m58 ^ p2;
|
|
let p15 = m54 ^ m59;
|
|
// t2 <- stack
|
|
let m63 = m41 & t2;
|
|
// m39 <- stack
|
|
let m44 = m39 ^ m40;
|
|
// p17 -> stack
|
|
// t6 <- stack
|
|
let m46 = m44 & t6;
|
|
let p5 = m46 ^ m51;
|
|
// p23 -> stack
|
|
let p18 = m63 ^ p5;
|
|
let p24 = p5 ^ p7;
|
|
// m48 <- stack
|
|
let p12 = m46 ^ m48;
|
|
let s3 = p12 ^ p22;
|
|
// t13 <- stack
|
|
let m55 = m44 & t13;
|
|
let p9 = m55 ^ m63;
|
|
// p16 <- stack
|
|
let s7 = p9 ^ p16;
|
|
// t8 <- stack
|
|
let m47 = m40 & t8;
|
|
let p3 = m47 ^ m50;
|
|
let p19 = p2 ^ p3;
|
|
let s5 = p19 ^ p24;
|
|
let p11 = p0 ^ p3;
|
|
let p26 = p9 ^ p11;
|
|
// t23 <- stack
|
|
let m56 = m40 & t23;
|
|
let p4 = m48 ^ m56;
|
|
// p6 <- stack
|
|
let p20 = p4 ^ p6;
|
|
let p29 = p15 ^ p20;
|
|
let s1 = p26 ^ p29;
|
|
// m57 <- stack
|
|
let p10 = m57 ^ p4;
|
|
let p27 = p10 ^ p18;
|
|
// p23 <- stack
|
|
let s4 = p23 ^ p27;
|
|
let p25 = p6 ^ p10;
|
|
let p28 = p11 ^ p25;
|
|
// p17 <- stack
|
|
let s2 = p17 ^ p28;
|
|
|
|
state[0] = s7;
|
|
state[1] = s6;
|
|
state[2] = s5;
|
|
state[3] = s4;
|
|
state[4] = s3;
|
|
state[5] = s2;
|
|
state[6] = s1;
|
|
state[7] = s0;
|
|
}
|
|
|
|
/// Bitsliced implementation of the AES Sbox based on Boyar, Peralta and Calik.
|
|
///
|
|
/// See: <http://www.cs.yale.edu/homes/peralta/CircuitStuff/SLP_AES_113.txt>
|
|
///
|
|
/// Note that the 4 bitwise NOT (^= 0xffffffff) are moved to the key schedule.
|
|
fn sub_bytes(state: &mut [u32]) {
|
|
debug_assert_eq!(state.len(), 8);
|
|
|
|
// Scheduled using https://github.com/Ko-/aes-armcortexm/tree/public/scheduler
|
|
// Inline "stack" comments reflect suggested stores and loads (ARM Cortex-M3 and M4)
|
|
|
|
let u7 = state[0];
|
|
let u6 = state[1];
|
|
let u5 = state[2];
|
|
let u4 = state[3];
|
|
let u3 = state[4];
|
|
let u2 = state[5];
|
|
let u1 = state[6];
|
|
let u0 = state[7];
|
|
|
|
let y14 = u3 ^ u5;
|
|
let y13 = u0 ^ u6;
|
|
let y12 = y13 ^ y14;
|
|
let t1 = u4 ^ y12;
|
|
let y15 = t1 ^ u5;
|
|
let t2 = y12 & y15;
|
|
let y6 = y15 ^ u7;
|
|
let y20 = t1 ^ u1;
|
|
// y12 -> stack
|
|
let y9 = u0 ^ u3;
|
|
// y20 -> stack
|
|
let y11 = y20 ^ y9;
|
|
// y9 -> stack
|
|
let t12 = y9 & y11;
|
|
// y6 -> stack
|
|
let y7 = u7 ^ y11;
|
|
let y8 = u0 ^ u5;
|
|
let t0 = u1 ^ u2;
|
|
let y10 = y15 ^ t0;
|
|
// y15 -> stack
|
|
let y17 = y10 ^ y11;
|
|
// y14 -> stack
|
|
let t13 = y14 & y17;
|
|
let t14 = t13 ^ t12;
|
|
// y17 -> stack
|
|
let y19 = y10 ^ y8;
|
|
// y10 -> stack
|
|
let t15 = y8 & y10;
|
|
let t16 = t15 ^ t12;
|
|
let y16 = t0 ^ y11;
|
|
// y11 -> stack
|
|
let y21 = y13 ^ y16;
|
|
// y13 -> stack
|
|
let t7 = y13 & y16;
|
|
// y16 -> stack
|
|
let y18 = u0 ^ y16;
|
|
let y1 = t0 ^ u7;
|
|
let y4 = y1 ^ u3;
|
|
// u7 -> stack
|
|
let t5 = y4 & u7;
|
|
let t6 = t5 ^ t2;
|
|
let t18 = t6 ^ t16;
|
|
let t22 = t18 ^ y19;
|
|
let y2 = y1 ^ u0;
|
|
let t10 = y2 & y7;
|
|
let t11 = t10 ^ t7;
|
|
let t20 = t11 ^ t16;
|
|
let t24 = t20 ^ y18;
|
|
let y5 = y1 ^ u6;
|
|
let t8 = y5 & y1;
|
|
let t9 = t8 ^ t7;
|
|
let t19 = t9 ^ t14;
|
|
let t23 = t19 ^ y21;
|
|
let y3 = y5 ^ y8;
|
|
// y6 <- stack
|
|
let t3 = y3 & y6;
|
|
let t4 = t3 ^ t2;
|
|
// y20 <- stack
|
|
let t17 = t4 ^ y20;
|
|
let t21 = t17 ^ t14;
|
|
let t26 = t21 & t23;
|
|
let t27 = t24 ^ t26;
|
|
let t31 = t22 ^ t26;
|
|
let t25 = t21 ^ t22;
|
|
// y4 -> stack
|
|
let t28 = t25 & t27;
|
|
let t29 = t28 ^ t22;
|
|
let z14 = t29 & y2;
|
|
let z5 = t29 & y7;
|
|
let t30 = t23 ^ t24;
|
|
let t32 = t31 & t30;
|
|
let t33 = t32 ^ t24;
|
|
let t35 = t27 ^ t33;
|
|
let t36 = t24 & t35;
|
|
let t38 = t27 ^ t36;
|
|
let t39 = t29 & t38;
|
|
let t40 = t25 ^ t39;
|
|
let t43 = t29 ^ t40;
|
|
// y16 <- stack
|
|
let z3 = t43 & y16;
|
|
let tc12 = z3 ^ z5;
|
|
// tc12 -> stack
|
|
// y13 <- stack
|
|
let z12 = t43 & y13;
|
|
let z13 = t40 & y5;
|
|
let z4 = t40 & y1;
|
|
let tc6 = z3 ^ z4;
|
|
let t34 = t23 ^ t33;
|
|
let t37 = t36 ^ t34;
|
|
let t41 = t40 ^ t37;
|
|
// y10 <- stack
|
|
let z8 = t41 & y10;
|
|
let z17 = t41 & y8;
|
|
let t44 = t33 ^ t37;
|
|
// y15 <- stack
|
|
let z0 = t44 & y15;
|
|
// z17 -> stack
|
|
// y12 <- stack
|
|
let z9 = t44 & y12;
|
|
let z10 = t37 & y3;
|
|
let z1 = t37 & y6;
|
|
let tc5 = z1 ^ z0;
|
|
let tc11 = tc6 ^ tc5;
|
|
// y4 <- stack
|
|
let z11 = t33 & y4;
|
|
let t42 = t29 ^ t33;
|
|
let t45 = t42 ^ t41;
|
|
// y17 <- stack
|
|
let z7 = t45 & y17;
|
|
let tc8 = z7 ^ tc6;
|
|
// y14 <- stack
|
|
let z16 = t45 & y14;
|
|
// y11 <- stack
|
|
let z6 = t42 & y11;
|
|
let tc16 = z6 ^ tc8;
|
|
// z14 -> stack
|
|
// y9 <- stack
|
|
let z15 = t42 & y9;
|
|
let tc20 = z15 ^ tc16;
|
|
let tc1 = z15 ^ z16;
|
|
let tc2 = z10 ^ tc1;
|
|
let tc21 = tc2 ^ z11;
|
|
let tc3 = z9 ^ tc2;
|
|
let s0 = tc3 ^ tc16;
|
|
let s3 = tc3 ^ tc11;
|
|
let s1 = s3 ^ tc16;
|
|
let tc13 = z13 ^ tc1;
|
|
// u7 <- stack
|
|
let z2 = t33 & u7;
|
|
let tc4 = z0 ^ z2;
|
|
let tc7 = z12 ^ tc4;
|
|
let tc9 = z8 ^ tc7;
|
|
let tc10 = tc8 ^ tc9;
|
|
// z14 <- stack
|
|
let tc17 = z14 ^ tc10;
|
|
let s5 = tc21 ^ tc17;
|
|
let tc26 = tc17 ^ tc20;
|
|
// z17 <- stack
|
|
let s2 = tc26 ^ z17;
|
|
// tc12 <- stack
|
|
let tc14 = tc4 ^ tc12;
|
|
let tc18 = tc13 ^ tc14;
|
|
let s6 = tc10 ^ tc18;
|
|
let s7 = z12 ^ tc18;
|
|
let s4 = tc14 ^ s3;
|
|
|
|
state[0] = s7;
|
|
state[1] = s6;
|
|
state[2] = s5;
|
|
state[3] = s4;
|
|
state[4] = s3;
|
|
state[5] = s2;
|
|
state[6] = s1;
|
|
state[7] = s0;
|
|
}
|
|
|
|
/// NOT operations that are omitted in S-box
|
|
#[inline]
|
|
fn sub_bytes_nots(state: &mut [u32]) {
|
|
debug_assert_eq!(state.len(), 8);
|
|
state[0] ^= 0xffffffff;
|
|
state[1] ^= 0xffffffff;
|
|
state[5] ^= 0xffffffff;
|
|
state[6] ^= 0xffffffff;
|
|
}
|
|
|
|
/// Computation of the MixColumns transformation in the fixsliced representation, with different
|
|
/// rotations used according to the round number mod 4.
|
|
///
|
|
/// Based on Käsper-Schwabe, similar to https://github.com/Ko-/aes-armcortexm.
|
|
macro_rules! define_mix_columns {
|
|
(
|
|
$name:ident,
|
|
$name_inv:ident,
|
|
$first_rotate:path,
|
|
$second_rotate:path
|
|
) => {
|
|
#[rustfmt::skip]
|
|
fn $name(state: &mut State) {
|
|
let (a0, a1, a2, a3, a4, a5, a6, a7) = (
|
|
state[0], state[1], state[2], state[3], state[4], state[5], state[6], state[7]
|
|
);
|
|
let (b0, b1, b2, b3, b4, b5, b6, b7) = (
|
|
$first_rotate(a0),
|
|
$first_rotate(a1),
|
|
$first_rotate(a2),
|
|
$first_rotate(a3),
|
|
$first_rotate(a4),
|
|
$first_rotate(a5),
|
|
$first_rotate(a6),
|
|
$first_rotate(a7),
|
|
);
|
|
let (c0, c1, c2, c3, c4, c5, c6, c7) = (
|
|
a0 ^ b0,
|
|
a1 ^ b1,
|
|
a2 ^ b2,
|
|
a3 ^ b3,
|
|
a4 ^ b4,
|
|
a5 ^ b5,
|
|
a6 ^ b6,
|
|
a7 ^ b7,
|
|
);
|
|
state[0] = b0 ^ c7 ^ $second_rotate(c0);
|
|
state[1] = b1 ^ c0 ^ c7 ^ $second_rotate(c1);
|
|
state[2] = b2 ^ c1 ^ $second_rotate(c2);
|
|
state[3] = b3 ^ c2 ^ c7 ^ $second_rotate(c3);
|
|
state[4] = b4 ^ c3 ^ c7 ^ $second_rotate(c4);
|
|
state[5] = b5 ^ c4 ^ $second_rotate(c5);
|
|
state[6] = b6 ^ c5 ^ $second_rotate(c6);
|
|
state[7] = b7 ^ c6 ^ $second_rotate(c7);
|
|
}
|
|
|
|
#[rustfmt::skip]
|
|
fn $name_inv(state: &mut State) {
|
|
let (a0, a1, a2, a3, a4, a5, a6, a7) = (
|
|
state[0], state[1], state[2], state[3], state[4], state[5], state[6], state[7]
|
|
);
|
|
let (b0, b1, b2, b3, b4, b5, b6, b7) = (
|
|
$first_rotate(a0),
|
|
$first_rotate(a1),
|
|
$first_rotate(a2),
|
|
$first_rotate(a3),
|
|
$first_rotate(a4),
|
|
$first_rotate(a5),
|
|
$first_rotate(a6),
|
|
$first_rotate(a7),
|
|
);
|
|
let (c0, c1, c2, c3, c4, c5, c6, c7) = (
|
|
a0 ^ b0,
|
|
a1 ^ b1,
|
|
a2 ^ b2,
|
|
a3 ^ b3,
|
|
a4 ^ b4,
|
|
a5 ^ b5,
|
|
a6 ^ b6,
|
|
a7 ^ b7,
|
|
);
|
|
let (d0, d1, d2, d3, d4, d5, d6, d7) = (
|
|
a0 ^ c7,
|
|
a1 ^ c0 ^ c7,
|
|
a2 ^ c1,
|
|
a3 ^ c2 ^ c7,
|
|
a4 ^ c3 ^ c7,
|
|
a5 ^ c4,
|
|
a6 ^ c5,
|
|
a7 ^ c6,
|
|
);
|
|
let (e0, e1, e2, e3, e4, e5, e6, e7) = (
|
|
c0 ^ d6,
|
|
c1 ^ d6 ^ d7,
|
|
c2 ^ d0 ^ d7,
|
|
c3 ^ d1 ^ d6,
|
|
c4 ^ d2 ^ d6 ^ d7,
|
|
c5 ^ d3 ^ d7,
|
|
c6 ^ d4,
|
|
c7 ^ d5,
|
|
);
|
|
state[0] = d0 ^ e0 ^ $second_rotate(e0);
|
|
state[1] = d1 ^ e1 ^ $second_rotate(e1);
|
|
state[2] = d2 ^ e2 ^ $second_rotate(e2);
|
|
state[3] = d3 ^ e3 ^ $second_rotate(e3);
|
|
state[4] = d4 ^ e4 ^ $second_rotate(e4);
|
|
state[5] = d5 ^ e5 ^ $second_rotate(e5);
|
|
state[6] = d6 ^ e6 ^ $second_rotate(e6);
|
|
state[7] = d7 ^ e7 ^ $second_rotate(e7);
|
|
}
|
|
}
|
|
}
|
|
|
|
define_mix_columns!(
|
|
mix_columns_0,
|
|
inv_mix_columns_0,
|
|
rotate_rows_1,
|
|
rotate_rows_2
|
|
);
|
|
|
|
define_mix_columns!(
|
|
mix_columns_1,
|
|
inv_mix_columns_1,
|
|
rotate_rows_and_columns_1_1,
|
|
rotate_rows_and_columns_2_2
|
|
);
|
|
|
|
#[cfg(not(aes_compact))]
|
|
define_mix_columns!(
|
|
mix_columns_2,
|
|
inv_mix_columns_2,
|
|
rotate_rows_and_columns_1_2,
|
|
rotate_rows_2
|
|
);
|
|
|
|
#[cfg(not(aes_compact))]
|
|
define_mix_columns!(
|
|
mix_columns_3,
|
|
inv_mix_columns_3,
|
|
rotate_rows_and_columns_1_3,
|
|
rotate_rows_and_columns_2_2
|
|
);
|
|
|
|
#[inline]
|
|
fn delta_swap_1(a: &mut u32, shift: u32, mask: u32) {
|
|
let t = (*a ^ ((*a) >> shift)) & mask;
|
|
*a ^= t ^ (t << shift);
|
|
}
|
|
|
|
#[inline]
|
|
fn delta_swap_2(a: &mut u32, b: &mut u32, shift: u32, mask: u32) {
|
|
let t = (*a ^ ((*b) >> shift)) & mask;
|
|
*a ^= t;
|
|
*b ^= t << shift;
|
|
}
|
|
|
|
/// Applies ShiftRows once on an AES state (or key).
|
|
#[cfg(any(not(aes_compact), feature = "hazmat"))]
|
|
#[inline]
|
|
fn shift_rows_1(state: &mut [u32]) {
|
|
debug_assert_eq!(state.len(), 8);
|
|
for x in state.iter_mut() {
|
|
delta_swap_1(x, 4, 0x0c0f0300);
|
|
delta_swap_1(x, 2, 0x33003300);
|
|
}
|
|
}
|
|
|
|
/// Applies ShiftRows twice on an AES state (or key).
|
|
#[inline]
|
|
fn shift_rows_2(state: &mut [u32]) {
|
|
debug_assert_eq!(state.len(), 8);
|
|
for x in state.iter_mut() {
|
|
delta_swap_1(x, 4, 0x0f000f00);
|
|
}
|
|
}
|
|
|
|
/// Applies ShiftRows three times on an AES state (or key).
|
|
#[inline]
|
|
fn shift_rows_3(state: &mut [u32]) {
|
|
debug_assert_eq!(state.len(), 8);
|
|
for x in state.iter_mut() {
|
|
delta_swap_1(x, 4, 0x030f0c00);
|
|
delta_swap_1(x, 2, 0x33003300);
|
|
}
|
|
}
|
|
|
|
#[inline(always)]
|
|
fn inv_shift_rows_1(state: &mut [u32]) {
|
|
shift_rows_3(state);
|
|
}
|
|
|
|
#[inline(always)]
|
|
fn inv_shift_rows_2(state: &mut [u32]) {
|
|
shift_rows_2(state);
|
|
}
|
|
|
|
#[cfg(not(aes_compact))]
|
|
#[inline(always)]
|
|
fn inv_shift_rows_3(state: &mut [u32]) {
|
|
shift_rows_1(state);
|
|
}
|
|
|
|
/// XOR the columns after the S-box during the key schedule round function.
|
|
///
|
|
/// The `idx_xor` parameter refers to the index of the previous round key that is
|
|
/// involved in the XOR computation (should be 8 and 16 for AES-128 and AES-256,
|
|
/// respectively).
|
|
///
|
|
/// The `idx_ror` parameter refers to the rotation value, which varies between the
|
|
/// different key schedules.
|
|
fn xor_columns(rkeys: &mut [u32], offset: usize, idx_xor: usize, idx_ror: u32) {
|
|
for i in 0..8 {
|
|
let off_i = offset + i;
|
|
let rk = rkeys[off_i - idx_xor] ^ (0x03030303 & ror(rkeys[off_i], idx_ror));
|
|
rkeys[off_i] =
|
|
rk ^ (0xfcfcfcfc & (rk << 2)) ^ (0xf0f0f0f0 & (rk << 4)) ^ (0xc0c0c0c0 & (rk << 6));
|
|
}
|
|
}
|
|
|
|
/// Bitslice two 128-bit input blocks input0, input1 into a 256-bit internal state.
|
|
fn bitslice(output: &mut [u32], input0: &[u8], input1: &[u8]) {
|
|
debug_assert_eq!(output.len(), 8);
|
|
debug_assert_eq!(input0.len(), 16);
|
|
debug_assert_eq!(input1.len(), 16);
|
|
|
|
// Bitslicing is a bit index manipulation. 256 bits of data means each bit is positioned at an
|
|
// 8-bit index. AES data is 2 blocks, each one a 4x4 column-major matrix of bytes, so the
|
|
// index is initially ([b]lock, [c]olumn, [r]ow, [p]osition):
|
|
// b0 c1 c0 r1 r0 p2 p1 p0
|
|
//
|
|
// The desired bitsliced data groups first by bit position, then row, column, block:
|
|
// p2 p1 p0 r1 r0 c1 c0 b0
|
|
|
|
// Interleave the columns on input (note the order of input)
|
|
// b0 c1 c0 __ __ __ __ __ => c1 c0 b0 __ __ __ __ __
|
|
let mut t0 = u32::from_le_bytes(input0[0x00..0x04].try_into().unwrap());
|
|
let mut t2 = u32::from_le_bytes(input0[0x04..0x08].try_into().unwrap());
|
|
let mut t4 = u32::from_le_bytes(input0[0x08..0x0c].try_into().unwrap());
|
|
let mut t6 = u32::from_le_bytes(input0[0x0c..0x10].try_into().unwrap());
|
|
let mut t1 = u32::from_le_bytes(input1[0x00..0x04].try_into().unwrap());
|
|
let mut t3 = u32::from_le_bytes(input1[0x04..0x08].try_into().unwrap());
|
|
let mut t5 = u32::from_le_bytes(input1[0x08..0x0c].try_into().unwrap());
|
|
let mut t7 = u32::from_le_bytes(input1[0x0c..0x10].try_into().unwrap());
|
|
|
|
// Bit Index Swap 5 <-> 0:
|
|
// __ __ b0 __ __ __ __ p0 => __ __ p0 __ __ __ __ b0
|
|
let m0 = 0x55555555;
|
|
delta_swap_2(&mut t1, &mut t0, 1, m0);
|
|
delta_swap_2(&mut t3, &mut t2, 1, m0);
|
|
delta_swap_2(&mut t5, &mut t4, 1, m0);
|
|
delta_swap_2(&mut t7, &mut t6, 1, m0);
|
|
|
|
// Bit Index Swap 6 <-> 1:
|
|
// __ c0 __ __ __ __ p1 __ => __ p1 __ __ __ __ c0 __
|
|
let m1 = 0x33333333;
|
|
delta_swap_2(&mut t2, &mut t0, 2, m1);
|
|
delta_swap_2(&mut t3, &mut t1, 2, m1);
|
|
delta_swap_2(&mut t6, &mut t4, 2, m1);
|
|
delta_swap_2(&mut t7, &mut t5, 2, m1);
|
|
|
|
// Bit Index Swap 7 <-> 2:
|
|
// c1 __ __ __ __ p2 __ __ => p2 __ __ __ __ c1 __ __
|
|
let m2 = 0x0f0f0f0f;
|
|
delta_swap_2(&mut t4, &mut t0, 4, m2);
|
|
delta_swap_2(&mut t5, &mut t1, 4, m2);
|
|
delta_swap_2(&mut t6, &mut t2, 4, m2);
|
|
delta_swap_2(&mut t7, &mut t3, 4, m2);
|
|
|
|
// Final bitsliced bit index, as desired:
|
|
// p2 p1 p0 r1 r0 c1 c0 b0
|
|
output[0] = t0;
|
|
output[1] = t1;
|
|
output[2] = t2;
|
|
output[3] = t3;
|
|
output[4] = t4;
|
|
output[5] = t5;
|
|
output[6] = t6;
|
|
output[7] = t7;
|
|
}
|
|
|
|
/// Un-bitslice a 256-bit internal state into two 128-bit blocks of output.
|
|
fn inv_bitslice(input: &[u32]) -> BatchBlocks {
|
|
debug_assert_eq!(input.len(), 8);
|
|
|
|
// Unbitslicing is a bit index manipulation. 256 bits of data means each bit is positioned at
|
|
// an 8-bit index. AES data is 2 blocks, each one a 4x4 column-major matrix of bytes, so the
|
|
// desired index for the output is ([b]lock, [c]olumn, [r]ow, [p]osition):
|
|
// b0 c1 c0 r1 r0 p2 p1 p0
|
|
//
|
|
// The initially bitsliced data groups first by bit position, then row, column, block:
|
|
// p2 p1 p0 r1 r0 c1 c0 b0
|
|
|
|
let mut t0 = input[0];
|
|
let mut t1 = input[1];
|
|
let mut t2 = input[2];
|
|
let mut t3 = input[3];
|
|
let mut t4 = input[4];
|
|
let mut t5 = input[5];
|
|
let mut t6 = input[6];
|
|
let mut t7 = input[7];
|
|
|
|
// TODO: these bit index swaps are identical to those in 'packing'
|
|
|
|
// Bit Index Swap 5 <-> 0:
|
|
// __ __ p0 __ __ __ __ b0 => __ __ b0 __ __ __ __ p0
|
|
let m0 = 0x55555555;
|
|
delta_swap_2(&mut t1, &mut t0, 1, m0);
|
|
delta_swap_2(&mut t3, &mut t2, 1, m0);
|
|
delta_swap_2(&mut t5, &mut t4, 1, m0);
|
|
delta_swap_2(&mut t7, &mut t6, 1, m0);
|
|
|
|
// Bit Index Swap 6 <-> 1:
|
|
// __ p1 __ __ __ __ c0 __ => __ c0 __ __ __ __ p1 __
|
|
let m1 = 0x33333333;
|
|
delta_swap_2(&mut t2, &mut t0, 2, m1);
|
|
delta_swap_2(&mut t3, &mut t1, 2, m1);
|
|
delta_swap_2(&mut t6, &mut t4, 2, m1);
|
|
delta_swap_2(&mut t7, &mut t5, 2, m1);
|
|
|
|
// Bit Index Swap 7 <-> 2:
|
|
// p2 __ __ __ __ c1 __ __ => c1 __ __ __ __ p2 __ __
|
|
let m2 = 0x0f0f0f0f;
|
|
delta_swap_2(&mut t4, &mut t0, 4, m2);
|
|
delta_swap_2(&mut t5, &mut t1, 4, m2);
|
|
delta_swap_2(&mut t6, &mut t2, 4, m2);
|
|
delta_swap_2(&mut t7, &mut t3, 4, m2);
|
|
|
|
let mut output = BatchBlocks::default();
|
|
// De-interleave the columns on output (note the order of output)
|
|
// c1 c0 b0 __ __ __ __ __ => b0 c1 c0 __ __ __ __ __
|
|
output[0][0x00..0x04].copy_from_slice(&t0.to_le_bytes());
|
|
output[0][0x04..0x08].copy_from_slice(&t2.to_le_bytes());
|
|
output[0][0x08..0x0c].copy_from_slice(&t4.to_le_bytes());
|
|
output[0][0x0c..0x10].copy_from_slice(&t6.to_le_bytes());
|
|
output[1][0x00..0x04].copy_from_slice(&t1.to_le_bytes());
|
|
output[1][0x04..0x08].copy_from_slice(&t3.to_le_bytes());
|
|
output[1][0x08..0x0c].copy_from_slice(&t5.to_le_bytes());
|
|
output[1][0x0c..0x10].copy_from_slice(&t7.to_le_bytes());
|
|
|
|
// Final AES bit index, as desired:
|
|
// b0 c1 c0 r1 r0 p2 p1 p0
|
|
output
|
|
}
|
|
|
|
/// Copy 32-bytes within the provided slice to an 8-byte offset
|
|
fn memshift32(buffer: &mut [u32], src_offset: usize) {
|
|
debug_assert_eq!(src_offset % 8, 0);
|
|
|
|
let dst_offset = src_offset + 8;
|
|
debug_assert!(dst_offset + 8 <= buffer.len());
|
|
|
|
for i in (0..8).rev() {
|
|
buffer[dst_offset + i] = buffer[src_offset + i];
|
|
}
|
|
}
|
|
|
|
/// XOR the round key to the internal state. The round keys are expected to be
|
|
/// pre-computed and to be packed in the fixsliced representation.
|
|
#[inline]
|
|
fn add_round_key(state: &mut State, rkey: &[u32]) {
|
|
debug_assert_eq!(rkey.len(), 8);
|
|
for (a, b) in state.iter_mut().zip(rkey) {
|
|
*a ^= b;
|
|
}
|
|
}
|
|
|
|
#[inline(always)]
|
|
fn add_round_constant_bit(state: &mut [u32], bit: usize) {
|
|
state[bit] ^= 0x0000c000;
|
|
}
|
|
|
|
#[inline(always)]
|
|
fn ror(x: u32, y: u32) -> u32 {
|
|
x.rotate_right(y)
|
|
}
|
|
|
|
#[inline(always)]
|
|
fn ror_distance(rows: u32, cols: u32) -> u32 {
|
|
(rows << 3) + (cols << 1)
|
|
}
|
|
|
|
#[inline(always)]
|
|
fn rotate_rows_1(x: u32) -> u32 {
|
|
ror(x, ror_distance(1, 0))
|
|
}
|
|
|
|
#[inline(always)]
|
|
fn rotate_rows_2(x: u32) -> u32 {
|
|
ror(x, ror_distance(2, 0))
|
|
}
|
|
|
|
#[inline(always)]
|
|
#[rustfmt::skip]
|
|
fn rotate_rows_and_columns_1_1(x: u32) -> u32 {
|
|
(ror(x, ror_distance(1, 1)) & 0x3f3f3f3f) |
|
|
(ror(x, ror_distance(0, 1)) & 0xc0c0c0c0)
|
|
}
|
|
|
|
#[cfg(not(aes_compact))]
|
|
#[inline(always)]
|
|
#[rustfmt::skip]
|
|
fn rotate_rows_and_columns_1_2(x: u32) -> u32 {
|
|
(ror(x, ror_distance(1, 2)) & 0x0f0f0f0f) |
|
|
(ror(x, ror_distance(0, 2)) & 0xf0f0f0f0)
|
|
}
|
|
|
|
#[cfg(not(aes_compact))]
|
|
#[inline(always)]
|
|
#[rustfmt::skip]
|
|
fn rotate_rows_and_columns_1_3(x: u32) -> u32 {
|
|
(ror(x, ror_distance(1, 3)) & 0x03030303) |
|
|
(ror(x, ror_distance(0, 3)) & 0xfcfcfcfc)
|
|
}
|
|
|
|
#[inline(always)]
|
|
#[rustfmt::skip]
|
|
fn rotate_rows_and_columns_2_2(x: u32) -> u32 {
|
|
(ror(x, ror_distance(2, 2)) & 0x0f0f0f0f) |
|
|
(ror(x, ror_distance(1, 2)) & 0xf0f0f0f0)
|
|
}
|
|
|
|
/// Low-level "hazmat" AES functions.
|
|
///
|
|
/// Note: this isn't actually used in the `Aes128`/`Aes192`/`Aes256`
|
|
/// implementations in this crate, but instead provides raw access to
|
|
/// the AES round function gated under the `hazmat` crate feature.
|
|
#[cfg(feature = "hazmat")]
|
|
pub(crate) mod hazmat {
|
|
use super::{
|
|
bitslice, inv_bitslice, inv_mix_columns_0, inv_shift_rows_1, inv_sub_bytes, mix_columns_0,
|
|
shift_rows_1, sub_bytes, sub_bytes_nots, State,
|
|
};
|
|
use crate::{Block, Block8};
|
|
|
|
/// XOR the `src` block into the `dst` block in-place.
|
|
fn xor_in_place(dst: &mut Block, src: &Block) {
|
|
for (a, b) in dst.iter_mut().zip(src.as_slice()) {
|
|
*a ^= *b;
|
|
}
|
|
}
|
|
|
|
/// Perform a bitslice operation, loading a single block.
|
|
fn bitslice_block(block: &Block) -> State {
|
|
let mut state = State::default();
|
|
bitslice(&mut state, block, block);
|
|
state
|
|
}
|
|
|
|
/// Perform an inverse bitslice operation, extracting a single block.
|
|
fn inv_bitslice_block(block: &mut Block, state: &State) {
|
|
let out = inv_bitslice(state);
|
|
block.copy_from_slice(&out[0]);
|
|
}
|
|
|
|
/// AES cipher (encrypt) round function.
|
|
#[inline]
|
|
pub(crate) fn cipher_round(block: &mut Block, round_key: &Block) {
|
|
let mut state = bitslice_block(block);
|
|
sub_bytes(&mut state);
|
|
sub_bytes_nots(&mut state);
|
|
shift_rows_1(&mut state);
|
|
mix_columns_0(&mut state);
|
|
inv_bitslice_block(block, &state);
|
|
xor_in_place(block, round_key);
|
|
}
|
|
|
|
/// AES cipher (encrypt) round function: parallel version.
|
|
#[inline]
|
|
pub(crate) fn cipher_round_par(blocks: &mut Block8, round_keys: &Block8) {
|
|
for (chunk, keys) in blocks.chunks_exact_mut(2).zip(round_keys.chunks_exact(2)) {
|
|
let mut state = State::default();
|
|
bitslice(&mut state, &chunk[0], &chunk[1]);
|
|
sub_bytes(&mut state);
|
|
sub_bytes_nots(&mut state);
|
|
shift_rows_1(&mut state);
|
|
mix_columns_0(&mut state);
|
|
let res = inv_bitslice(&state);
|
|
|
|
for i in 0..2 {
|
|
chunk[i] = res[i];
|
|
xor_in_place(&mut chunk[i], &keys[i]);
|
|
}
|
|
}
|
|
}
|
|
|
|
/// AES cipher (encrypt) round function.
|
|
#[inline]
|
|
pub(crate) fn equiv_inv_cipher_round(block: &mut Block, round_key: &Block) {
|
|
let mut state = bitslice_block(block);
|
|
sub_bytes_nots(&mut state);
|
|
inv_sub_bytes(&mut state);
|
|
inv_shift_rows_1(&mut state);
|
|
inv_mix_columns_0(&mut state);
|
|
inv_bitslice_block(block, &state);
|
|
xor_in_place(block, round_key);
|
|
}
|
|
|
|
/// AES cipher (encrypt) round function: parallel version.
|
|
#[inline]
|
|
pub(crate) fn equiv_inv_cipher_round_par(blocks: &mut Block8, round_keys: &Block8) {
|
|
for (chunk, keys) in blocks.chunks_exact_mut(2).zip(round_keys.chunks_exact(2)) {
|
|
let mut state = State::default();
|
|
bitslice(&mut state, &chunk[0], &chunk[1]);
|
|
sub_bytes_nots(&mut state);
|
|
inv_sub_bytes(&mut state);
|
|
inv_shift_rows_1(&mut state);
|
|
inv_mix_columns_0(&mut state);
|
|
let res = inv_bitslice(&state);
|
|
|
|
for i in 0..2 {
|
|
chunk[i] = res[i];
|
|
xor_in_place(&mut chunk[i], &keys[i]);
|
|
}
|
|
}
|
|
}
|
|
|
|
/// AES mix columns function.
|
|
#[inline]
|
|
pub(crate) fn mix_columns(block: &mut Block) {
|
|
let mut state = bitslice_block(block);
|
|
mix_columns_0(&mut state);
|
|
inv_bitslice_block(block, &state);
|
|
}
|
|
|
|
/// AES inverse mix columns function.
|
|
#[inline]
|
|
pub(crate) fn inv_mix_columns(block: &mut Block) {
|
|
let mut state = bitslice_block(block);
|
|
inv_mix_columns_0(&mut state);
|
|
inv_bitslice_block(block, &state);
|
|
}
|
|
}
|