Source file src/pkg/crypto/aes/block.go

     1	// Copyright 2009 The Go Authors. All rights reserved.
     2	// Use of this source code is governed by a BSD-style
     3	// license that can be found in the LICENSE file.
     4	
     5	// This Go implementation is derived in part from the reference
     6	// ANSI C implementation, which carries the following notice:
     7	//
     8	//	rijndael-alg-fst.c
     9	//
    10	//	@version 3.0 (December 2000)
    11	//
    12	//	Optimised ANSI C code for the Rijndael cipher (now AES)
    13	//
    14	//	@author Vincent Rijmen <vincent.rijmen@esat.kuleuven.ac.be>
    15	//	@author Antoon Bosselaers <antoon.bosselaers@esat.kuleuven.ac.be>
    16	//	@author Paulo Barreto <paulo.barreto@terra.com.br>
    17	//
    18	//	This code is hereby placed in the public domain.
    19	//
    20	//	THIS SOFTWARE IS PROVIDED BY THE AUTHORS ''AS IS'' AND ANY EXPRESS
    21	//	OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
    22	//	WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
    23	//	ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE
    24	//	LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
    25	//	CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
    26	//	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
    27	//	BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
    28	//	WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
    29	//	OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
    30	//	EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    31	//
    32	// See FIPS 197 for specification, and see Daemen and Rijmen's Rijndael submission
    33	// for implementation details.
    34	//	https://csrc.nist.gov/csrc/media/publications/fips/197/final/documents/fips-197.pdf
    35	//	https://csrc.nist.gov/archive/aes/rijndael/Rijndael-ammended.pdf
    36	
    37	package aes
    38	
    39	import (
    40		"encoding/binary"
    41	)
    42	
    43	// Encrypt one block from src into dst, using the expanded key xk.
    44	func encryptBlockGo(xk []uint32, dst, src []byte) {
    45		_ = src[15] // early bounds check
    46		s0 := binary.BigEndian.Uint32(src[0:4])
    47		s1 := binary.BigEndian.Uint32(src[4:8])
    48		s2 := binary.BigEndian.Uint32(src[8:12])
    49		s3 := binary.BigEndian.Uint32(src[12:16])
    50	
    51		// First round just XORs input with key.
    52		s0 ^= xk[0]
    53		s1 ^= xk[1]
    54		s2 ^= xk[2]
    55		s3 ^= xk[3]
    56	
    57		// Middle rounds shuffle using tables.
    58		// Number of rounds is set by length of expanded key.
    59		nr := len(xk)/4 - 2 // - 2: one above, one more below
    60		k := 4
    61		var t0, t1, t2, t3 uint32
    62		for r := 0; r < nr; r++ {
    63			t0 = xk[k+0] ^ te0[uint8(s0>>24)] ^ te1[uint8(s1>>16)] ^ te2[uint8(s2>>8)] ^ te3[uint8(s3)]
    64			t1 = xk[k+1] ^ te0[uint8(s1>>24)] ^ te1[uint8(s2>>16)] ^ te2[uint8(s3>>8)] ^ te3[uint8(s0)]
    65			t2 = xk[k+2] ^ te0[uint8(s2>>24)] ^ te1[uint8(s3>>16)] ^ te2[uint8(s0>>8)] ^ te3[uint8(s1)]
    66			t3 = xk[k+3] ^ te0[uint8(s3>>24)] ^ te1[uint8(s0>>16)] ^ te2[uint8(s1>>8)] ^ te3[uint8(s2)]
    67			k += 4
    68			s0, s1, s2, s3 = t0, t1, t2, t3
    69		}
    70	
    71		// Last round uses s-box directly and XORs to produce output.
    72		s0 = uint32(sbox0[t0>>24])<<24 | uint32(sbox0[t1>>16&0xff])<<16 | uint32(sbox0[t2>>8&0xff])<<8 | uint32(sbox0[t3&0xff])
    73		s1 = uint32(sbox0[t1>>24])<<24 | uint32(sbox0[t2>>16&0xff])<<16 | uint32(sbox0[t3>>8&0xff])<<8 | uint32(sbox0[t0&0xff])
    74		s2 = uint32(sbox0[t2>>24])<<24 | uint32(sbox0[t3>>16&0xff])<<16 | uint32(sbox0[t0>>8&0xff])<<8 | uint32(sbox0[t1&0xff])
    75		s3 = uint32(sbox0[t3>>24])<<24 | uint32(sbox0[t0>>16&0xff])<<16 | uint32(sbox0[t1>>8&0xff])<<8 | uint32(sbox0[t2&0xff])
    76	
    77		s0 ^= xk[k+0]
    78		s1 ^= xk[k+1]
    79		s2 ^= xk[k+2]
    80		s3 ^= xk[k+3]
    81	
    82		_ = dst[15] // early bounds check
    83		binary.BigEndian.PutUint32(dst[0:4], s0)
    84		binary.BigEndian.PutUint32(dst[4:8], s1)
    85		binary.BigEndian.PutUint32(dst[8:12], s2)
    86		binary.BigEndian.PutUint32(dst[12:16], s3)
    87	}
    88	
    89	// Decrypt one block from src into dst, using the expanded key xk.
    90	func decryptBlockGo(xk []uint32, dst, src []byte) {
    91		_ = src[15] // early bounds check
    92		s0 := binary.BigEndian.Uint32(src[0:4])
    93		s1 := binary.BigEndian.Uint32(src[4:8])
    94		s2 := binary.BigEndian.Uint32(src[8:12])
    95		s3 := binary.BigEndian.Uint32(src[12:16])
    96	
    97		// First round just XORs input with key.
    98		s0 ^= xk[0]
    99		s1 ^= xk[1]
   100		s2 ^= xk[2]
   101		s3 ^= xk[3]
   102	
   103		// Middle rounds shuffle using tables.
   104		// Number of rounds is set by length of expanded key.
   105		nr := len(xk)/4 - 2 // - 2: one above, one more below
   106		k := 4
   107		var t0, t1, t2, t3 uint32
   108		for r := 0; r < nr; r++ {
   109			t0 = xk[k+0] ^ td0[uint8(s0>>24)] ^ td1[uint8(s3>>16)] ^ td2[uint8(s2>>8)] ^ td3[uint8(s1)]
   110			t1 = xk[k+1] ^ td0[uint8(s1>>24)] ^ td1[uint8(s0>>16)] ^ td2[uint8(s3>>8)] ^ td3[uint8(s2)]
   111			t2 = xk[k+2] ^ td0[uint8(s2>>24)] ^ td1[uint8(s1>>16)] ^ td2[uint8(s0>>8)] ^ td3[uint8(s3)]
   112			t3 = xk[k+3] ^ td0[uint8(s3>>24)] ^ td1[uint8(s2>>16)] ^ td2[uint8(s1>>8)] ^ td3[uint8(s0)]
   113			k += 4
   114			s0, s1, s2, s3 = t0, t1, t2, t3
   115		}
   116	
   117		// Last round uses s-box directly and XORs to produce output.
   118		s0 = uint32(sbox1[t0>>24])<<24 | uint32(sbox1[t3>>16&0xff])<<16 | uint32(sbox1[t2>>8&0xff])<<8 | uint32(sbox1[t1&0xff])
   119		s1 = uint32(sbox1[t1>>24])<<24 | uint32(sbox1[t0>>16&0xff])<<16 | uint32(sbox1[t3>>8&0xff])<<8 | uint32(sbox1[t2&0xff])
   120		s2 = uint32(sbox1[t2>>24])<<24 | uint32(sbox1[t1>>16&0xff])<<16 | uint32(sbox1[t0>>8&0xff])<<8 | uint32(sbox1[t3&0xff])
   121		s3 = uint32(sbox1[t3>>24])<<24 | uint32(sbox1[t2>>16&0xff])<<16 | uint32(sbox1[t1>>8&0xff])<<8 | uint32(sbox1[t0&0xff])
   122	
   123		s0 ^= xk[k+0]
   124		s1 ^= xk[k+1]
   125		s2 ^= xk[k+2]
   126		s3 ^= xk[k+3]
   127	
   128		_ = dst[15] // early bounds check
   129		binary.BigEndian.PutUint32(dst[0:4], s0)
   130		binary.BigEndian.PutUint32(dst[4:8], s1)
   131		binary.BigEndian.PutUint32(dst[8:12], s2)
   132		binary.BigEndian.PutUint32(dst[12:16], s3)
   133	}
   134	
   135	// Apply sbox0 to each byte in w.
   136	func subw(w uint32) uint32 {
   137		return uint32(sbox0[w>>24])<<24 |
   138			uint32(sbox0[w>>16&0xff])<<16 |
   139			uint32(sbox0[w>>8&0xff])<<8 |
   140			uint32(sbox0[w&0xff])
   141	}
   142	
   143	// Rotate
   144	func rotw(w uint32) uint32 { return w<<8 | w>>24 }
   145	
   146	// Key expansion algorithm. See FIPS-197, Figure 11.
   147	// Their rcon[i] is our powx[i-1] << 24.
   148	func expandKeyGo(key []byte, enc, dec []uint32) {
   149		// Encryption key setup.
   150		var i int
   151		nk := len(key) / 4
   152		for i = 0; i < nk; i++ {
   153			enc[i] = binary.BigEndian.Uint32(key[4*i:])
   154		}
   155		for ; i < len(enc); i++ {
   156			t := enc[i-1]
   157			if i%nk == 0 {
   158				t = subw(rotw(t)) ^ (uint32(powx[i/nk-1]) << 24)
   159			} else if nk > 6 && i%nk == 4 {
   160				t = subw(t)
   161			}
   162			enc[i] = enc[i-nk] ^ t
   163		}
   164	
   165		// Derive decryption key from encryption key.
   166		// Reverse the 4-word round key sets from enc to produce dec.
   167		// All sets but the first and last get the MixColumn transform applied.
   168		if dec == nil {
   169			return
   170		}
   171		n := len(enc)
   172		for i := 0; i < n; i += 4 {
   173			ei := n - i - 4
   174			for j := 0; j < 4; j++ {
   175				x := enc[ei+j]
   176				if i > 0 && i+4 < n {
   177					x = td0[sbox0[x>>24]] ^ td1[sbox0[x>>16&0xff]] ^ td2[sbox0[x>>8&0xff]] ^ td3[sbox0[x&0xff]]
   178				}
   179				dec[i+j] = x
   180			}
   181		}
   182	}
   183	

View as plain text