amcl/
aes.rs

1/*
2Licensed to the Apache Software Foundation (ASF) under one
3or more contributor license agreements.  See the NOTICE file
4distributed with this work for additional information
5regarding copyright ownership.  The ASF licenses this file
6to you under the Apache License, Version 2.0 (the
7"License"); you may not use this file except in compliance
8with the License.  You may obtain a copy of the License at
9
10  http://www.apache.org/licenses/LICENSE-2.0
11
12Unless required by applicable law or agreed to in writing,
13software distributed under the License is distributed on an
14"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15KIND, either express or implied.  See the License for the
16specific language governing permissions and limitations
17under the License.
18*/
19
20pub const ECB: usize = 0;
21pub const CBC: usize = 1;
22pub const CFB1: usize = 2;
23pub const CFB2: usize = 3;
24pub const CFB4: usize = 5;
25pub const OFB1: usize = 14;
26pub const OFB2: usize = 15;
27pub const OFB4: usize = 17;
28pub const OFB8: usize = 21;
29pub const OFB16: usize = 29;
30pub const CTR1: usize = 30;
31pub const CTR2: usize = 31;
32pub const CTR4: usize = 33;
33pub const CTR8: usize = 37;
34pub const CTR16: usize = 45;
35
36const INCO: [u8; 4] = [0xB, 0xD, 0x9, 0xE]; /* Inverse Coefficients */
37
38const PTAB: [u8; 256] = [
39    1, 3, 5, 15, 17, 51, 85, 255, 26, 46, 114, 150, 161, 248, 19, 53, 95, 225, 56, 72, 216, 115,
40    149, 164, 247, 2, 6, 10, 30, 34, 102, 170, 229, 52, 92, 228, 55, 89, 235, 38, 106, 190, 217,
41    112, 144, 171, 230, 49, 83, 245, 4, 12, 20, 60, 68, 204, 79, 209, 104, 184, 211, 110, 178, 205,
42    76, 212, 103, 169, 224, 59, 77, 215, 98, 166, 241, 8, 24, 40, 120, 136, 131, 158, 185, 208,
43    107, 189, 220, 127, 129, 152, 179, 206, 73, 219, 118, 154, 181, 196, 87, 249, 16, 48, 80, 240,
44    11, 29, 39, 105, 187, 214, 97, 163, 254, 25, 43, 125, 135, 146, 173, 236, 47, 113, 147, 174,
45    233, 32, 96, 160, 251, 22, 58, 78, 210, 109, 183, 194, 93, 231, 50, 86, 250, 21, 63, 65, 195,
46    94, 226, 61, 71, 201, 64, 192, 91, 237, 44, 116, 156, 191, 218, 117, 159, 186, 213, 100, 172,
47    239, 42, 126, 130, 157, 188, 223, 122, 142, 137, 128, 155, 182, 193, 88, 232, 35, 101, 175,
48    234, 37, 111, 177, 200, 67, 197, 84, 252, 31, 33, 99, 165, 244, 7, 9, 27, 45, 119, 153, 176,
49    203, 70, 202, 69, 207, 74, 222, 121, 139, 134, 145, 168, 227, 62, 66, 198, 81, 243, 14, 18, 54,
50    90, 238, 41, 123, 141, 140, 143, 138, 133, 148, 167, 242, 13, 23, 57, 75, 221, 124, 132, 151,
51    162, 253, 28, 36, 108, 180, 199, 82, 246, 1,
52];
53
54const LTAB: [u8; 256] = [
55    0, 255, 25, 1, 50, 2, 26, 198, 75, 199, 27, 104, 51, 238, 223, 3, 100, 4, 224, 14, 52, 141,
56    129, 239, 76, 113, 8, 200, 248, 105, 28, 193, 125, 194, 29, 181, 249, 185, 39, 106, 77, 228,
57    166, 114, 154, 201, 9, 120, 101, 47, 138, 5, 33, 15, 225, 36, 18, 240, 130, 69, 53, 147, 218,
58    142, 150, 143, 219, 189, 54, 208, 206, 148, 19, 92, 210, 241, 64, 70, 131, 56, 102, 221, 253,
59    48, 191, 6, 139, 98, 179, 37, 226, 152, 34, 136, 145, 16, 126, 110, 72, 195, 163, 182, 30, 66,
60    58, 107, 40, 84, 250, 133, 61, 186, 43, 121, 10, 21, 155, 159, 94, 202, 78, 212, 172, 229, 243,
61    115, 167, 87, 175, 88, 168, 80, 244, 234, 214, 116, 79, 174, 233, 213, 231, 230, 173, 232, 44,
62    215, 117, 122, 235, 22, 11, 245, 89, 203, 95, 176, 156, 169, 81, 160, 127, 12, 246, 111, 23,
63    196, 73, 236, 216, 67, 31, 45, 164, 118, 123, 183, 204, 187, 62, 90, 251, 96, 177, 134, 59, 82,
64    161, 108, 170, 85, 41, 157, 151, 178, 135, 144, 97, 190, 220, 252, 188, 149, 207, 205, 55, 63,
65    91, 209, 83, 57, 132, 60, 65, 162, 109, 71, 20, 42, 158, 93, 86, 242, 211, 171, 68, 17, 146,
66    217, 35, 32, 46, 137, 180, 124, 184, 38, 119, 153, 227, 165, 103, 74, 237, 222, 197, 49, 254,
67    24, 13, 99, 140, 128, 192, 247, 112, 7,
68];
69
70const FBSUB: [u8; 256] = [
71    99, 124, 119, 123, 242, 107, 111, 197, 48, 1, 103, 43, 254, 215, 171, 118, 202, 130, 201, 125,
72    250, 89, 71, 240, 173, 212, 162, 175, 156, 164, 114, 192, 183, 253, 147, 38, 54, 63, 247, 204,
73    52, 165, 229, 241, 113, 216, 49, 21, 4, 199, 35, 195, 24, 150, 5, 154, 7, 18, 128, 226, 235,
74    39, 178, 117, 9, 131, 44, 26, 27, 110, 90, 160, 82, 59, 214, 179, 41, 227, 47, 132, 83, 209, 0,
75    237, 32, 252, 177, 91, 106, 203, 190, 57, 74, 76, 88, 207, 208, 239, 170, 251, 67, 77, 51, 133,
76    69, 249, 2, 127, 80, 60, 159, 168, 81, 163, 64, 143, 146, 157, 56, 245, 188, 182, 218, 33, 16,
77    255, 243, 210, 205, 12, 19, 236, 95, 151, 68, 23, 196, 167, 126, 61, 100, 93, 25, 115, 96, 129,
78    79, 220, 34, 42, 144, 136, 70, 238, 184, 20, 222, 94, 11, 219, 224, 50, 58, 10, 73, 6, 36, 92,
79    194, 211, 172, 98, 145, 149, 228, 121, 231, 200, 55, 109, 141, 213, 78, 169, 108, 86, 244, 234,
80    101, 122, 174, 8, 186, 120, 37, 46, 28, 166, 180, 198, 232, 221, 116, 31, 75, 189, 139, 138,
81    112, 62, 181, 102, 72, 3, 246, 14, 97, 53, 87, 185, 134, 193, 29, 158, 225, 248, 152, 17, 105,
82    217, 142, 148, 155, 30, 135, 233, 206, 85, 40, 223, 140, 161, 137, 13, 191, 230, 66, 104, 65,
83    153, 45, 15, 176, 84, 187, 22,
84];
85
86const RBSUB: [u8; 256] = [
87    82, 9, 106, 213, 48, 54, 165, 56, 191, 64, 163, 158, 129, 243, 215, 251, 124, 227, 57, 130,
88    155, 47, 255, 135, 52, 142, 67, 68, 196, 222, 233, 203, 84, 123, 148, 50, 166, 194, 35, 61,
89    238, 76, 149, 11, 66, 250, 195, 78, 8, 46, 161, 102, 40, 217, 36, 178, 118, 91, 162, 73, 109,
90    139, 209, 37, 114, 248, 246, 100, 134, 104, 152, 22, 212, 164, 92, 204, 93, 101, 182, 146, 108,
91    112, 72, 80, 253, 237, 185, 218, 94, 21, 70, 87, 167, 141, 157, 132, 144, 216, 171, 0, 140,
92    188, 211, 10, 247, 228, 88, 5, 184, 179, 69, 6, 208, 44, 30, 143, 202, 63, 15, 2, 193, 175,
93    189, 3, 1, 19, 138, 107, 58, 145, 17, 65, 79, 103, 220, 234, 151, 242, 207, 206, 240, 180, 230,
94    115, 150, 172, 116, 34, 231, 173, 53, 133, 226, 249, 55, 232, 28, 117, 223, 110, 71, 241, 26,
95    113, 29, 41, 197, 137, 111, 183, 98, 14, 170, 24, 190, 27, 252, 86, 62, 75, 198, 210, 121, 32,
96    154, 219, 192, 254, 120, 205, 90, 244, 31, 221, 168, 51, 136, 7, 199, 49, 177, 18, 16, 89, 39,
97    128, 236, 95, 96, 81, 127, 169, 25, 181, 74, 13, 45, 229, 122, 159, 147, 201, 156, 239, 160,
98    224, 59, 77, 174, 42, 245, 176, 200, 235, 187, 60, 131, 83, 153, 97, 23, 43, 4, 126, 186, 119,
99    214, 38, 225, 105, 20, 99, 85, 33, 12, 125,
100];
101
102const RCO: [u8; 16] = [
103    1, 2, 4, 8, 16, 32, 64, 128, 27, 54, 108, 216, 171, 77, 154, 47,
104];
105
106const FTABLE: [u32; 256] = [
107    0xa56363c6, 0x847c7cf8, 0x997777ee, 0x8d7b7bf6, 0xdf2f2ff, 0xbd6b6bd6, 0xb16f6fde, 0x54c5c591,
108    0x50303060, 0x3010102, 0xa96767ce, 0x7d2b2b56, 0x19fefee7, 0x62d7d7b5, 0xe6abab4d, 0x9a7676ec,
109    0x45caca8f, 0x9d82821f, 0x40c9c989, 0x877d7dfa, 0x15fafaef, 0xeb5959b2, 0xc947478e, 0xbf0f0fb,
110    0xecadad41, 0x67d4d4b3, 0xfda2a25f, 0xeaafaf45, 0xbf9c9c23, 0xf7a4a453, 0x967272e4, 0x5bc0c09b,
111    0xc2b7b775, 0x1cfdfde1, 0xae93933d, 0x6a26264c, 0x5a36366c, 0x413f3f7e, 0x2f7f7f5, 0x4fcccc83,
112    0x5c343468, 0xf4a5a551, 0x34e5e5d1, 0x8f1f1f9, 0x937171e2, 0x73d8d8ab, 0x53313162, 0x3f15152a,
113    0xc040408, 0x52c7c795, 0x65232346, 0x5ec3c39d, 0x28181830, 0xa1969637, 0xf05050a, 0xb59a9a2f,
114    0x907070e, 0x36121224, 0x9b80801b, 0x3de2e2df, 0x26ebebcd, 0x6927274e, 0xcdb2b27f, 0x9f7575ea,
115    0x1b090912, 0x9e83831d, 0x742c2c58, 0x2e1a1a34, 0x2d1b1b36, 0xb26e6edc, 0xee5a5ab4, 0xfba0a05b,
116    0xf65252a4, 0x4d3b3b76, 0x61d6d6b7, 0xceb3b37d, 0x7b292952, 0x3ee3e3dd, 0x712f2f5e, 0x97848413,
117    0xf55353a6, 0x68d1d1b9, 0x0, 0x2cededc1, 0x60202040, 0x1ffcfce3, 0xc8b1b179, 0xed5b5bb6,
118    0xbe6a6ad4, 0x46cbcb8d, 0xd9bebe67, 0x4b393972, 0xde4a4a94, 0xd44c4c98, 0xe85858b0, 0x4acfcf85,
119    0x6bd0d0bb, 0x2aefefc5, 0xe5aaaa4f, 0x16fbfbed, 0xc5434386, 0xd74d4d9a, 0x55333366, 0x94858511,
120    0xcf45458a, 0x10f9f9e9, 0x6020204, 0x817f7ffe, 0xf05050a0, 0x443c3c78, 0xba9f9f25, 0xe3a8a84b,
121    0xf35151a2, 0xfea3a35d, 0xc0404080, 0x8a8f8f05, 0xad92923f, 0xbc9d9d21, 0x48383870, 0x4f5f5f1,
122    0xdfbcbc63, 0xc1b6b677, 0x75dadaaf, 0x63212142, 0x30101020, 0x1affffe5, 0xef3f3fd, 0x6dd2d2bf,
123    0x4ccdcd81, 0x140c0c18, 0x35131326, 0x2fececc3, 0xe15f5fbe, 0xa2979735, 0xcc444488, 0x3917172e,
124    0x57c4c493, 0xf2a7a755, 0x827e7efc, 0x473d3d7a, 0xac6464c8, 0xe75d5dba, 0x2b191932, 0x957373e6,
125    0xa06060c0, 0x98818119, 0xd14f4f9e, 0x7fdcdca3, 0x66222244, 0x7e2a2a54, 0xab90903b, 0x8388880b,
126    0xca46468c, 0x29eeeec7, 0xd3b8b86b, 0x3c141428, 0x79dedea7, 0xe25e5ebc, 0x1d0b0b16, 0x76dbdbad,
127    0x3be0e0db, 0x56323264, 0x4e3a3a74, 0x1e0a0a14, 0xdb494992, 0xa06060c, 0x6c242448, 0xe45c5cb8,
128    0x5dc2c29f, 0x6ed3d3bd, 0xefacac43, 0xa66262c4, 0xa8919139, 0xa4959531, 0x37e4e4d3, 0x8b7979f2,
129    0x32e7e7d5, 0x43c8c88b, 0x5937376e, 0xb76d6dda, 0x8c8d8d01, 0x64d5d5b1, 0xd24e4e9c, 0xe0a9a949,
130    0xb46c6cd8, 0xfa5656ac, 0x7f4f4f3, 0x25eaeacf, 0xaf6565ca, 0x8e7a7af4, 0xe9aeae47, 0x18080810,
131    0xd5baba6f, 0x887878f0, 0x6f25254a, 0x722e2e5c, 0x241c1c38, 0xf1a6a657, 0xc7b4b473, 0x51c6c697,
132    0x23e8e8cb, 0x7cdddda1, 0x9c7474e8, 0x211f1f3e, 0xdd4b4b96, 0xdcbdbd61, 0x868b8b0d, 0x858a8a0f,
133    0x907070e0, 0x423e3e7c, 0xc4b5b571, 0xaa6666cc, 0xd8484890, 0x5030306, 0x1f6f6f7, 0x120e0e1c,
134    0xa36161c2, 0x5f35356a, 0xf95757ae, 0xd0b9b969, 0x91868617, 0x58c1c199, 0x271d1d3a, 0xb99e9e27,
135    0x38e1e1d9, 0x13f8f8eb, 0xb398982b, 0x33111122, 0xbb6969d2, 0x70d9d9a9, 0x898e8e07, 0xa7949433,
136    0xb69b9b2d, 0x221e1e3c, 0x92878715, 0x20e9e9c9, 0x49cece87, 0xff5555aa, 0x78282850, 0x7adfdfa5,
137    0x8f8c8c03, 0xf8a1a159, 0x80898909, 0x170d0d1a, 0xdabfbf65, 0x31e6e6d7, 0xc6424284, 0xb86868d0,
138    0xc3414182, 0xb0999929, 0x772d2d5a, 0x110f0f1e, 0xcbb0b07b, 0xfc5454a8, 0xd6bbbb6d, 0x3a16162c,
139];
140
141const RTABLE: [u32; 256] = [
142    0x50a7f451, 0x5365417e, 0xc3a4171a, 0x965e273a, 0xcb6bab3b, 0xf1459d1f, 0xab58faac, 0x9303e34b,
143    0x55fa3020, 0xf66d76ad, 0x9176cc88, 0x254c02f5, 0xfcd7e54f, 0xd7cb2ac5, 0x80443526, 0x8fa362b5,
144    0x495ab1de, 0x671bba25, 0x980eea45, 0xe1c0fe5d, 0x2752fc3, 0x12f04c81, 0xa397468d, 0xc6f9d36b,
145    0xe75f8f03, 0x959c9215, 0xeb7a6dbf, 0xda595295, 0x2d83bed4, 0xd3217458, 0x2969e049, 0x44c8c98e,
146    0x6a89c275, 0x78798ef4, 0x6b3e5899, 0xdd71b927, 0xb64fe1be, 0x17ad88f0, 0x66ac20c9, 0xb43ace7d,
147    0x184adf63, 0x82311ae5, 0x60335197, 0x457f5362, 0xe07764b1, 0x84ae6bbb, 0x1ca081fe, 0x942b08f9,
148    0x58684870, 0x19fd458f, 0x876cde94, 0xb7f87b52, 0x23d373ab, 0xe2024b72, 0x578f1fe3, 0x2aab5566,
149    0x728ebb2, 0x3c2b52f, 0x9a7bc586, 0xa50837d3, 0xf2872830, 0xb2a5bf23, 0xba6a0302, 0x5c8216ed,
150    0x2b1ccf8a, 0x92b479a7, 0xf0f207f3, 0xa1e2694e, 0xcdf4da65, 0xd5be0506, 0x1f6234d1, 0x8afea6c4,
151    0x9d532e34, 0xa055f3a2, 0x32e18a05, 0x75ebf6a4, 0x39ec830b, 0xaaef6040, 0x69f715e, 0x51106ebd,
152    0xf98a213e, 0x3d06dd96, 0xae053edd, 0x46bde64d, 0xb58d5491, 0x55dc471, 0x6fd40604, 0xff155060,
153    0x24fb9819, 0x97e9bdd6, 0xcc434089, 0x779ed967, 0xbd42e8b0, 0x888b8907, 0x385b19e7, 0xdbeec879,
154    0x470a7ca1, 0xe90f427c, 0xc91e84f8, 0x0, 0x83868009, 0x48ed2b32, 0xac70111e, 0x4e725a6c,
155    0xfbff0efd, 0x5638850f, 0x1ed5ae3d, 0x27392d36, 0x64d90f0a, 0x21a65c68, 0xd1545b9b, 0x3a2e3624,
156    0xb1670a0c, 0xfe75793, 0xd296eeb4, 0x9e919b1b, 0x4fc5c080, 0xa220dc61, 0x694b775a, 0x161a121c,
157    0xaba93e2, 0xe52aa0c0, 0x43e0223c, 0x1d171b12, 0xb0d090e, 0xadc78bf2, 0xb9a8b62d, 0xc8a91e14,
158    0x8519f157, 0x4c0775af, 0xbbdd99ee, 0xfd607fa3, 0x9f2601f7, 0xbcf5725c, 0xc53b6644, 0x347efb5b,
159    0x7629438b, 0xdcc623cb, 0x68fcedb6, 0x63f1e4b8, 0xcadc31d7, 0x10856342, 0x40229713, 0x2011c684,
160    0x7d244a85, 0xf83dbbd2, 0x1132f9ae, 0x6da129c7, 0x4b2f9e1d, 0xf330b2dc, 0xec52860d, 0xd0e3c177,
161    0x6c16b32b, 0x99b970a9, 0xfa489411, 0x2264e947, 0xc48cfca8, 0x1a3ff0a0, 0xd82c7d56, 0xef903322,
162    0xc74e4987, 0xc1d138d9, 0xfea2ca8c, 0x360bd498, 0xcf81f5a6, 0x28de7aa5, 0x268eb7da, 0xa4bfad3f,
163    0xe49d3a2c, 0xd927850, 0x9bcc5f6a, 0x62467e54, 0xc2138df6, 0xe8b8d890, 0x5ef7392e, 0xf5afc382,
164    0xbe805d9f, 0x7c93d069, 0xa92dd56f, 0xb31225cf, 0x3b99acc8, 0xa77d1810, 0x6e639ce8, 0x7bbb3bdb,
165    0x97826cd, 0xf418596e, 0x1b79aec, 0xa89a4f83, 0x656e95e6, 0x7ee6ffaa, 0x8cfbc21, 0xe6e815ef,
166    0xd99be7ba, 0xce366f4a, 0xd4099fea, 0xd67cb029, 0xafb2a431, 0x31233f2a, 0x3094a5c6, 0xc066a235,
167    0x37bc4e74, 0xa6ca82fc, 0xb0d090e0, 0x15d8a733, 0x4a9804f1, 0xf7daec41, 0xe50cd7f, 0x2ff69117,
168    0x8dd64d76, 0x4db0ef43, 0x544daacc, 0xdf0496e4, 0xe3b5d19e, 0x1b886a4c, 0xb81f2cc1, 0x7f516546,
169    0x4ea5e9d, 0x5d358c01, 0x737487fa, 0x2e410bfb, 0x5a1d67b3, 0x52d2db92, 0x335610e9, 0x1347d66d,
170    0x8c61d79a, 0x7a0ca137, 0x8e14f859, 0x893c13eb, 0xee27a9ce, 0x35c961b7, 0xede51ce1, 0x3cb1477a,
171    0x59dfd29c, 0x3f73f255, 0x79ce1418, 0xbf37c773, 0xeacdf753, 0x5baafd5f, 0x146f3ddf, 0x86db4478,
172    0x81f3afca, 0x3ec468b9, 0x2c342438, 0x5f40a3c2, 0x72c31d16, 0xc25e2bc, 0x8b493c28, 0x41950dff,
173    0x7101a839, 0xdeb30c08, 0x9ce4b4d8, 0x90c15664, 0x6184cb7b, 0x70b632d5, 0x745c6c48, 0x4257b8d0,
174];
175
176pub struct AES {
177    nk: usize,
178    nr: usize,
179    mode: usize,
180    fkey: [u32; 60],
181    rkey: [u32; 60],
182    pub f: [u8; 16],
183}
184
185impl AES {
186    fn rotl8(x: u32) -> u32 {
187        return ((x) << 8) | ((x) >> 24);
188    }
189
190    fn rotl16(x: u32) -> u32 {
191        return ((x) << 16) | ((x) >> 16);
192    }
193
194    fn rotl24(x: u32) -> u32 {
195        return ((x) << 24) | ((x) >> 8);
196    }
197
198    fn pack(b: [u8; 4]) -> u32 {
199        /* pack bytes into a 32-bit Word */
200        return ((((b[3]) & 0xff) as u32) << 24)
201            | ((((b[2]) & 0xff) as u32) << 16)
202            | ((((b[1]) & 0xff) as u32) << 8)
203            | (((b[0]) & 0xff) as u32);
204    }
205
206    fn unpack(a: u32) -> [u8; 4] {
207        /* unpack bytes from a word */
208        let b: [u8; 4] = [
209            (a & 0xff) as u8,
210            ((a >> 8) & 0xff) as u8,
211            ((a >> 16) & 0xff) as u8,
212            ((a >> 24) & 0xff) as u8,
213        ];
214        return b;
215    }
216
217    fn bmul(x: u8, y: u8) -> u8 {
218        /* x.y= AntiLog(Log(x) + Log(y)) */
219        let ix = (x as usize) & 0xff;
220        let iy = (y as usize) & 0xff;
221        let lx = (LTAB[ix] as usize) & 0xff;
222        let ly = (LTAB[iy] as usize) & 0xff;
223
224        if x != 0 && y != 0 {
225            return PTAB[(lx + ly) % 255];
226        } else {
227            return 0;
228        }
229    }
230
231    fn subbyte(a: u32) -> u32 {
232        let mut b = AES::unpack(a);
233        b[0] = FBSUB[b[0] as usize];
234        b[1] = FBSUB[b[1] as usize];
235        b[2] = FBSUB[b[2] as usize];
236        b[3] = FBSUB[b[3] as usize];
237        return AES::pack(b);
238    }
239
240    fn product(x: u32, y: u32) -> u8 {
241        /* dot product of two 4-byte arrays */
242        let xb = AES::unpack(x);
243        let yb = AES::unpack(y);
244
245        return AES::bmul(xb[0], yb[0])
246            ^ AES::bmul(xb[1], yb[1])
247            ^ AES::bmul(xb[2], yb[2])
248            ^ AES::bmul(xb[3], yb[3]);
249    }
250
251    fn invmixcol(x: u32) -> u32 {
252        /* matrix Multiplication */
253        let mut b: [u8; 4] = [0; 4];
254        let mut m = AES::pack(INCO);
255        b[3] = AES::product(m, x);
256        m = AES::rotl24(m);
257        b[2] = AES::product(m, x);
258        m = AES::rotl24(m);
259        b[1] = AES::product(m, x);
260        m = AES::rotl24(m);
261        b[0] = AES::product(m, x);
262        let y = AES::pack(b);
263        return y;
264    }
265
266    fn increment(f: &mut [u8; 16]) {
267        for i in 0..16 {
268            f[i] += 1;
269            if f[i] != 0 {
270                break;
271            }
272        }
273    }
274
275    pub fn new() -> AES {
276        AES {
277            nk: 0,
278            nr: 0,
279            mode: 0,
280            fkey: [0; 60],
281            rkey: [0; 60],
282            f: [0; 16],
283        }
284    }
285
286    /* reset cipher */
287    pub fn reset(&mut self, m: usize, iv: Option<[u8; 16]>) {
288        /* reset mode, or reset iv */
289        self.mode = m;
290        for i in 0..16 {
291            self.f[i] = 0
292        }
293        if self.mode != ECB {
294            if let Some(x) = iv {
295                for i in 0..16 {
296                    self.f[i] = x[i]
297                }
298            }
299        }
300    }
301
302    pub fn init(&mut self, m: usize, nkey: usize, key: &[u8], iv: Option<[u8; 16]>) -> bool {
303        /* Key Scheduler. Create expanded encryption key */
304        let mut cipherkey: [u32; 8] = [0; 8];
305        let mut b: [u8; 4] = [0; 4];
306        let nk = nkey / 4;
307        if nk != 4 && nk != 6 && nk != 8 {
308            return false;
309        }
310        let nr = 6 + nk;
311        self.nk = nk;
312        self.nr = nr;
313        self.reset(m, iv);
314        let n = 4 * (nr + 1);
315
316        let mut j = 0;
317        for i in 0..nk {
318            for k in 0..4 {
319                b[k] = key[j + k]
320            }
321            cipherkey[i] = AES::pack(b);
322            j += 4;
323        }
324
325        for i in 0..nk {
326            self.fkey[i] = cipherkey[i]
327        }
328
329        j = nk;
330        let mut k = 0;
331        while j < n {
332            self.fkey[j] =
333                self.fkey[j - nk] ^ AES::subbyte(AES::rotl24(self.fkey[j - 1])) ^ (RCO[k] as u32);
334            if nk<=6 { 
335		for i in 1..nk {
336			if (i + j) >= n {
337				break;
338			}
339			self.fkey[i + j] = self.fkey[i + j - nk] ^ self.fkey[i + j - 1];
340		}
341	    } else {
342		for i in 1..4  {
343			if (i + j) >= n {
344				break;
345			}
346			self.fkey[i + j] = self.fkey[i + j - nk] ^ self.fkey[i + j - 1];
347		}
348		
349		if (j + 4) < n {
350			self.fkey[j + 4] = self.fkey[j + 4 - nk] ^ AES::subbyte(self.fkey[j + 3]);
351		}
352		for i in 5..nk {
353			if (i + j) >= n {
354				break;
355			}
356			self.fkey[i + j] = self.fkey[i + j - nk] ^ self.fkey[i + j - 1];
357		}	        
358	    }
359            j += nk;
360            k += 1;
361        }
362
363        /* now for the expanded decrypt key in reverse order */
364
365        for j in 0..4 {
366            self.rkey[j + n - 4] = self.fkey[j]
367        }
368        let mut i = 4;
369        while i < n - 4 {
370            let k = n - 4 - i;
371            for j in 0..4 {
372                self.rkey[k + j] = AES::invmixcol(self.fkey[i + j])
373            }
374            i += 4;
375        }
376        for j in n - 4..n {
377            self.rkey[j + 4 - n] = self.fkey[j]
378        }
379        return true;
380    }
381
382    pub fn getreg(&mut self) -> [u8; 16] {
383        let mut ir: [u8; 16] = [0; 16];
384        for i in 0..16 {
385            ir[i] = self.f[i]
386        }
387        return ir;
388    }
389
390    /* Encrypt a single block */
391    pub fn ecb_encrypt(&mut self, buff: &mut [u8; 16]) {
392        let mut b: [u8; 4] = [0; 4];
393        let mut p: [u32; 4] = [0; 4];
394        let mut q: [u32; 4] = [0; 4];
395
396        let mut j = 0;
397        for i in 0..4 {
398            for k in 0..4 {
399                b[k] = buff[j + k]
400            }
401            p[i] = AES::pack(b);
402            p[i] ^= self.fkey[i];
403            j += 4;
404        }
405
406        let mut k = 4;
407
408        /* State alternates between p and q */
409        for _ in 1..self.nr {
410            q[0] = self.fkey[k]
411                ^ FTABLE[(p[0] & 0xff) as usize]
412                ^ AES::rotl8(FTABLE[((p[1] >> 8) & 0xff) as usize])
413                ^ AES::rotl16(FTABLE[((p[2] >> 16) & 0xff) as usize])
414                ^ AES::rotl24(FTABLE[((p[3] >> 24) & 0xff) as usize]);
415
416            q[1] = self.fkey[k + 1]
417                ^ FTABLE[(p[1] & 0xff) as usize]
418                ^ AES::rotl8(FTABLE[((p[2] >> 8) & 0xff) as usize])
419                ^ AES::rotl16(FTABLE[((p[3] >> 16) & 0xff) as usize])
420                ^ AES::rotl24(FTABLE[((p[0] >> 24) & 0xff) as usize]);
421
422            q[2] = self.fkey[k + 2]
423                ^ FTABLE[(p[2] & 0xff) as usize]
424                ^ AES::rotl8(FTABLE[((p[3] >> 8) & 0xff) as usize])
425                ^ AES::rotl16(FTABLE[((p[0] >> 16) & 0xff) as usize])
426                ^ AES::rotl24(FTABLE[((p[1] >> 24) & 0xff) as usize]);
427
428            q[3] = self.fkey[k + 3]
429                ^ FTABLE[(p[3] & 0xff) as usize]
430                ^ AES::rotl8(FTABLE[((p[0] >> 8) & 0xff) as usize])
431                ^ AES::rotl16(FTABLE[((p[1] >> 16) & 0xff) as usize])
432                ^ AES::rotl24(FTABLE[((p[2] >> 24) & 0xff) as usize]);
433
434            k += 4;
435            for j in 0..4 {
436                let t = p[j];
437                p[j] = q[j];
438                q[j] = t;
439            }
440        }
441
442        /* Last Round */
443
444        q[0] = self.fkey[k]
445            ^ (FBSUB[(p[0] & 0xff) as usize] as u32)
446            ^ AES::rotl8((FBSUB[((p[1] >> 8) & 0xff) as usize]) as u32)
447            ^ AES::rotl16((FBSUB[((p[2] >> 16) & 0xff) as usize]) as u32)
448            ^ AES::rotl24((FBSUB[((p[3] >> 24) & 0xff) as usize]) as u32);
449
450        q[1] = self.fkey[k + 1]
451            ^ (FBSUB[(p[1] & 0xff) as usize] as u32)
452            ^ AES::rotl8((FBSUB[((p[2] >> 8) & 0xff) as usize]) as u32)
453            ^ AES::rotl16((FBSUB[((p[3] >> 16) & 0xff) as usize]) as u32)
454            ^ AES::rotl24((FBSUB[((p[0] >> 24) & 0xff) as usize]) as u32);
455
456        q[2] = self.fkey[k + 2]
457            ^ (FBSUB[(p[2] & 0xff) as usize] as u32)
458            ^ AES::rotl8((FBSUB[((p[3] >> 8) & 0xff) as usize]) as u32)
459            ^ AES::rotl16((FBSUB[((p[0] >> 16) & 0xff) as usize]) as u32)
460            ^ AES::rotl24((FBSUB[((p[1] >> 24) & 0xff) as usize]) as u32);
461
462        q[3] = self.fkey[k + 3]
463            ^ (FBSUB[(p[3] & 0xff) as usize] as u32)
464            ^ AES::rotl8((FBSUB[((p[0] >> 8) & 0xff) as usize]) as u32)
465            ^ AES::rotl16((FBSUB[((p[1] >> 16) & 0xff) as usize]) as u32)
466            ^ AES::rotl24((FBSUB[((p[2] >> 24) & 0xff) as usize]) as u32);
467
468        j = 0;
469        for i in 0..4 {
470            b = AES::unpack(q[i]);
471            for k in 0..4 {
472                buff[j + k] = b[k]
473            }
474            j += 4;
475        }
476    }
477
478    /* Decrypt a single block */
479    pub fn ecb_decrypt(&mut self, buff: &mut [u8; 16]) {
480        let mut b: [u8; 4] = [0; 4];
481        let mut p: [u32; 4] = [0; 4];
482        let mut q: [u32; 4] = [0; 4];
483
484        let mut j = 0;
485        for i in 0..4 {
486            for k in 0..4 {
487                b[k] = buff[j + k]
488            }
489            p[i] = AES::pack(b);
490            p[i] ^= self.rkey[i];
491            j += 4;
492        }
493
494        let mut k = 4;
495
496        /* State alternates between p and q */
497        for _ in 1..self.nr {
498            q[0] = self.rkey[k]
499                ^ RTABLE[(p[0] & 0xff) as usize]
500                ^ AES::rotl8(RTABLE[((p[3] >> 8) & 0xff) as usize])
501                ^ AES::rotl16(RTABLE[((p[2] >> 16) & 0xff) as usize])
502                ^ AES::rotl24(RTABLE[((p[1] >> 24) & 0xff) as usize]);
503
504            q[1] = self.rkey[k + 1]
505                ^ RTABLE[(p[1] & 0xff) as usize]
506                ^ AES::rotl8(RTABLE[((p[0] >> 8) & 0xff) as usize])
507                ^ AES::rotl16(RTABLE[((p[3] >> 16) & 0xff) as usize])
508                ^ AES::rotl24(RTABLE[((p[2] >> 24) & 0xff) as usize]);
509
510            q[2] = self.rkey[k + 2]
511                ^ RTABLE[(p[2] & 0xff) as usize]
512                ^ AES::rotl8(RTABLE[((p[1] >> 8) & 0xff) as usize])
513                ^ AES::rotl16(RTABLE[((p[0] >> 16) & 0xff) as usize])
514                ^ AES::rotl24(RTABLE[((p[3] >> 24) & 0xff) as usize]);
515
516            q[3] = self.rkey[k + 3]
517                ^ RTABLE[(p[3] & 0xff) as usize]
518                ^ AES::rotl8(RTABLE[((p[2] >> 8) & 0xff) as usize])
519                ^ AES::rotl16(RTABLE[((p[1] >> 16) & 0xff) as usize])
520                ^ AES::rotl24(RTABLE[((p[0] >> 24) & 0xff) as usize]);
521
522            k += 4;
523            for j in 0..4 {
524                let t = p[j];
525                p[j] = q[j];
526                q[j] = t;
527            }
528        }
529
530        /* Last Round */
531
532        q[0] = self.rkey[k]
533            ^ (RBSUB[(p[0] & 0xff) as usize] as u32)
534            ^ AES::rotl8((RBSUB[((p[3] >> 8) & 0xff) as usize]) as u32)
535            ^ AES::rotl16((RBSUB[((p[2] >> 16) & 0xff) as usize]) as u32)
536            ^ AES::rotl24((RBSUB[((p[1] >> 24) & 0xff) as usize]) as u32);
537
538        q[1] = self.rkey[k + 1]
539            ^ (RBSUB[(p[1] & 0xff) as usize] as u32)
540            ^ AES::rotl8((RBSUB[((p[0] >> 8) & 0xff) as usize]) as u32)
541            ^ AES::rotl16((RBSUB[((p[3] >> 16) & 0xff) as usize]) as u32)
542            ^ AES::rotl24((RBSUB[((p[2] >> 24) & 0xff) as usize]) as u32);
543
544        q[2] = self.rkey[k + 2]
545            ^ (RBSUB[(p[2] & 0xff) as usize] as u32)
546            ^ AES::rotl8((RBSUB[((p[1] >> 8) & 0xff) as usize]) as u32)
547            ^ AES::rotl16((RBSUB[((p[0] >> 16) & 0xff) as usize]) as u32)
548            ^ AES::rotl24((RBSUB[((p[3] >> 24) & 0xff) as usize]) as u32);
549
550        q[3] = self.rkey[k + 3]
551            ^ (RBSUB[((p[3]) & 0xff) as usize] as u32)
552            ^ AES::rotl8((RBSUB[((p[2] >> 8) & 0xff) as usize]) as u32)
553            ^ AES::rotl16((RBSUB[((p[1] >> 16) & 0xff) as usize]) as u32)
554            ^ AES::rotl24((RBSUB[((p[0] >> 24) & 0xff) as usize]) as u32);
555
556        j = 0;
557        for i in 0..4 {
558            b = AES::unpack(q[i]);
559            for k in 0..4 {
560                buff[j + k] = b[k]
561            }
562            j += 4;
563        }
564    }
565
566    /* Encrypt using selected mode of operation */
567    pub fn encrypt(&mut self, buff: &mut [u8; 16]) -> u32 {
568        let mut st: [u8; 16] = [0; 16];
569
570        // Supported Modes of Operation
571
572        let mut fell_off: u32 = 0;
573
574        match self.mode {
575            ECB => {
576                self.ecb_encrypt(buff);
577                return 0;
578            }
579            CBC => {
580                for j in 0..16 {
581                    buff[j] ^= self.f[j]
582                }
583                self.ecb_encrypt(buff);
584                for j in 0..16 {
585                    self.f[j] = buff[j]
586                }
587                return 0;
588            }
589
590            CFB1 | CFB2 | CFB4 => {
591                let bytes = self.mode - CFB1 + 1;
592                for j in 0..bytes {
593                    fell_off = (fell_off << 8) | (self.f[j] as u32)
594                }
595                for j in 0..16 {
596                    st[j] = self.f[j]
597                }
598                for j in bytes..16 {
599                    self.f[j - bytes] = self.f[j]
600                }
601                self.ecb_encrypt(&mut st);
602                for j in 0..bytes {
603                    buff[j] ^= st[j];
604                    self.f[16 - bytes + j] = buff[j];
605                }
606                return fell_off;
607            }
608
609            OFB1 | OFB2 | OFB4 | OFB8 | OFB16 => {
610                let bytes = self.mode - OFB1 + 1;
611                for j in 0..16 {
612                    st[j] = self.f[j]
613                }
614                self.ecb_encrypt(&mut st);
615                for j in 0..bytes {
616                    buff[j] ^= st[j]
617                }
618                for j in 0..16 {
619                    self.f[j] = st[j]
620                }
621
622                //self.ecb_encrypt(&mut (self.f));
623                //for j in 0..bytes {buff[j]^=self.f[j]}
624                return 0;
625            }
626
627            CTR1 | CTR2 | CTR4 | CTR8 | CTR16 => {
628                let bytes = self.mode - CTR1 + 1;
629                for j in 0..16 {
630                    st[j] = self.f[j]
631                }
632                self.ecb_encrypt(&mut st);
633                for j in 0..bytes {
634                    buff[j] ^= st[j]
635                }
636                AES::increment(&mut (self.f));
637                return 0;
638            }
639
640            _ => {
641                return 0;
642            }
643        }
644    }
645
646    /* Decrypt using selected mode of operation */
647    pub fn decrypt(&mut self, buff: &mut [u8; 16]) -> u32 {
648        let mut st: [u8; 16] = [0; 16];
649
650        // Supported Modes of Operation
651
652        let mut fell_off: u32 = 0;
653
654        match self.mode {
655            ECB => {
656                self.ecb_decrypt(buff);
657                return 0;
658            }
659            CBC => {
660                for j in 0..16 {
661                    st[j] = self.f[j];
662                    self.f[j] = buff[j];
663                }
664                self.ecb_decrypt(buff);
665                for j in 0..16 {
666                    buff[j] ^= st[j];
667                    st[j] = 0;
668                }
669                return 0;
670            }
671            CFB1 | CFB2 | CFB4 => {
672                let bytes = self.mode - CFB1 + 1;
673                for j in 0..bytes {
674                    fell_off = (fell_off << 8) | (self.f[j] as u32)
675                }
676                for j in 0..16 {
677                    st[j] = self.f[j]
678                }
679                for j in bytes..16 {
680                    self.f[j - bytes] = self.f[j]
681                }
682                self.ecb_encrypt(&mut st);
683                for j in 0..bytes {
684                    self.f[16 - bytes + j] = buff[j];
685                    buff[j] ^= st[j];
686                }
687                return fell_off;
688            }
689            OFB1 | OFB2 | OFB4 | OFB8 | OFB16 => {
690                let bytes = self.mode - OFB1 + 1;
691                for j in 0..16 {
692                    st[j] = self.f[j]
693                }
694                self.ecb_encrypt(&mut st);
695                for j in 0..bytes {
696                    buff[j] ^= st[j]
697                }
698                for j in 0..16 {
699                    self.f[j] = st[j]
700                }
701                //  self.ecb_encrypt(A.f[:]);
702                //  for j in 0..bytes {buff[j]^=self.f[j]}
703                return 0;
704            }
705
706            CTR1 | CTR2 | CTR4 | CTR8 | CTR16 => {
707                let bytes = self.mode - CTR1 + 1;
708                for j in 0..16 {
709                    st[j] = self.f[j]
710                }
711                self.ecb_encrypt(&mut st);
712                for j in 0..bytes {
713                    buff[j] ^= st[j]
714                }
715                AES::increment(&mut (self.f));
716                return 0;
717            }
718
719            _ => {
720                return 0;
721            }
722        }
723    }
724
725    /* Clean up and delete left-overs */
726    pub fn end(&mut self) {
727        // clean up
728        for i in 0..4 * (self.nr + 1) {
729            self.fkey[i] = 0;
730            self.rkey[i] = 0
731        }
732        for i in 0..16 {
733            self.f[i] = 0
734        }
735    }
736}
737
738/*
739fn main()
740{
741    let mut key:[u8;32]=[0;32];
742    let mut block:[u8;16]=[0;16];
743    let mut iv: [u8;16] = [0;16];
744
745    for i in 0..32 {key[i]=0}
746    key[0]=1;
747    for i in 0..16 {iv[i]=i as u8}
748    for i in 0..16 {block[i]=i as u8}
749
750    let mut aes=AES::new();
751    aes.init(CTR16,32,&key,Some(iv));
752
753    println!("Plain= ");
754    for i in 0..16 {print!("{:02x} ",block[i])}
755    println!("");
756
757    aes.encrypt(&mut block);
758
759    println!("Encrypt= ");
760    for i in 0..16 {print!("{:02x} ",block[i])}
761    println!("");
762
763    aes.reset(CTR16,Some(iv));
764    aes.decrypt(&mut block);
765
766    println!("Decrypt= ");
767    for i in 0..16 {print!("{:02x} ",block[i])}
768    println!("");
769
770    aes.end();
771}
772*/
amcl/aes.rs

amcl/
aes.rs
