4 * AES Cipher Algorithm.
6 * Based on Brian Gladman's code.
9 * Alexander Kjeldaas <astor@fast.no>
10 * Herbert Valerio Riedel <hvr@hvrlab.org>
11 * Kyle McMartin <kyle@debian.org>
12 * Adam J. Richter <adam@yggdrasil.com> (conversion to 2.5 API).
14 * This program is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License as published by
16 * the Free Software Foundation; either version 2 of the License, or
17 * (at your option) any later version.
19 * ---------------------------------------------------------------------------
20 * Copyright (c) 2002, Dr Brian Gladman <brg@gladman.me.uk>, Worcester, UK.
21 * All rights reserved.
25 * The free distribution and use of this software in both source and binary
26 * form is allowed (with or without changes) provided that:
28 * 1. distributions of this source code include the above copyright
29 * notice, this list of conditions and the following disclaimer;
31 * 2. distributions in binary form include the above copyright
32 * notice, this list of conditions and the following disclaimer
33 * in the documentation and/or other associated materials;
35 * 3. the copyright holder's name is not used to endorse products
36 * built using this software without specific written permission.
38 * ALTERNATIVELY, provided that this notice is retained in full, this product
39 * may be distributed under the terms of the GNU General Public License (GPL),
40 * in which case the provisions of the GPL apply INSTEAD OF those given above.
44 * This software is provided 'as is' with no explicit or implied warranties
45 * in respect of its properties, including, but not limited to, correctness
46 * and/or fitness for purpose.
47 * ---------------------------------------------------------------------------
50 /* Some changes from the Gladman version:
51 s/RIJNDAEL(e_key)/E_KEY/g
52 s/RIJNDAEL(d_key)/D_KEY/g
55 /* This file was originally part of the Linux kernel (2.6.11). It is
56 licensed under the GPL as stated above. */
58 #define BUILD_FOR_L4 1
61 #include <linux/module.h>
62 #include <linux/init.h>
63 #include <linux/types.h>
64 #include <linux/errno.h>
65 #include <linux/crypto.h>
66 #include <asm/byteorder.h>
70 #define __LIBCRYPTO_INTERNAL__
71 #include <l4/crypto/aes.h>
73 #endif /* BUILD_FOR_L4 */
75 #define AES_MIN_KEY_SIZE 16
76 #define AES_MAX_KEY_SIZE 32
78 #define AES_BLOCK_SIZE 16
81 u32 generic_rotr32 (const u32 x, const unsigned bits)
83 const unsigned n = bits % 32;
84 return (x >> n) | (x << (32 - n));
88 u32 generic_rotl32 (const u32 x, const unsigned bits)
90 const unsigned n = bits % 32;
91 return (x << n) | (x >> (32 - n));
94 #define rotl generic_rotl32
95 #define rotr generic_rotr32
98 * #define byte(x, nr) ((unsigned char)((x) >> (nr*8)))
101 byte(const u32 x, const unsigned n)
103 return x >> (n << 3);
106 #define u32_in(x) le32_to_cpu(*(const u32 *)(x))
107 #define u32_out(to, from) (*(u32 *)(to) = cpu_to_le32(from))
116 # define aes_ctx aes_c_ctx
122 static u8 pow_tab[256] __initdata;
123 static u8 log_tab[256] __initdata;
124 static u8 sbx_tab[256] __initdata;
125 static u8 isb_tab[256] __initdata;
126 static u32 rco_tab[10];
127 static u32 ft_tab[4][256];
128 static u32 it_tab[4][256];
130 static u32 fl_tab[4][256];
131 static u32 il_tab[4][256];
133 static inline u8 __init
136 u8 aa = log_tab[a], cc = aa + log_tab[b];
138 return pow_tab[cc + (cc < aa ? 1 : 0)];
141 #define ff_mult(a,b) (a && b ? f_mult(a, b) : 0)
143 #define f_rn(bo, bi, n, k) \
144 bo[n] = ft_tab[0][byte(bi[n],0)] ^ \
145 ft_tab[1][byte(bi[(n + 1) & 3],1)] ^ \
146 ft_tab[2][byte(bi[(n + 2) & 3],2)] ^ \
147 ft_tab[3][byte(bi[(n + 3) & 3],3)] ^ *(k + n)
149 #define i_rn(bo, bi, n, k) \
150 bo[n] = it_tab[0][byte(bi[n],0)] ^ \
151 it_tab[1][byte(bi[(n + 3) & 3],1)] ^ \
152 it_tab[2][byte(bi[(n + 2) & 3],2)] ^ \
153 it_tab[3][byte(bi[(n + 1) & 3],3)] ^ *(k + n)
156 ( fl_tab[0][byte(x, 0)] ^ \
157 fl_tab[1][byte(x, 1)] ^ \
158 fl_tab[2][byte(x, 2)] ^ \
159 fl_tab[3][byte(x, 3)] )
161 #define f_rl(bo, bi, n, k) \
162 bo[n] = fl_tab[0][byte(bi[n],0)] ^ \
163 fl_tab[1][byte(bi[(n + 1) & 3],1)] ^ \
164 fl_tab[2][byte(bi[(n + 2) & 3],2)] ^ \
165 fl_tab[3][byte(bi[(n + 3) & 3],3)] ^ *(k + n)
167 #define i_rl(bo, bi, n, k) \
168 bo[n] = il_tab[0][byte(bi[n],0)] ^ \
169 il_tab[1][byte(bi[(n + 3) & 3],1)] ^ \
170 il_tab[2][byte(bi[(n + 2) & 3],2)] ^ \
171 il_tab[3][byte(bi[(n + 1) & 3],3)] ^ *(k + n)
179 /* log and power tables for GF(2**8) finite field with
180 0x011b as modular polynomial - the simplest primitive
181 root is 0x03, used here to generate the tables */
183 for (i = 0, p = 1; i < 256; ++i) {
187 p ^= (p << 1) ^ (p & 0x80 ? 0x01b : 0);
192 for (i = 0, p = 1; i < 10; ++i) {
195 p = (p << 1) ^ (p & 0x80 ? 0x01b : 0);
198 for (i = 0; i < 256; ++i) {
199 p = (i ? pow_tab[255 - log_tab[i]] : 0);
200 q = ((p >> 7) | (p << 1)) ^ ((p >> 6) | (p << 2));
201 p ^= 0x63 ^ q ^ ((q >> 6) | (q << 2));
206 for (i = 0; i < 256; ++i) {
211 fl_tab[1][i] = rotl (t, 8);
212 fl_tab[2][i] = rotl (t, 16);
213 fl_tab[3][i] = rotl (t, 24);
215 t = ((u32) ff_mult (2, p)) |
217 ((u32) p << 16) | ((u32) ff_mult (3, p) << 24);
220 ft_tab[1][i] = rotl (t, 8);
221 ft_tab[2][i] = rotl (t, 16);
222 ft_tab[3][i] = rotl (t, 24);
228 il_tab[1][i] = rotl (t, 8);
229 il_tab[2][i] = rotl (t, 16);
230 il_tab[3][i] = rotl (t, 24);
232 t = ((u32) ff_mult (14, p)) |
233 ((u32) ff_mult (9, p) << 8) |
234 ((u32) ff_mult (13, p) << 16) |
235 ((u32) ff_mult (11, p) << 24);
238 it_tab[1][i] = rotl (t, 8);
239 it_tab[2][i] = rotl (t, 16);
240 it_tab[3][i] = rotl (t, 24);
244 #define star_x(x) (((x) & 0x7f7f7f7f) << 1) ^ ((((x) & 0x80808080) >> 7) * 0x1b)
246 #define imix_col(y,x) \
252 (y) ^= rotr(u ^ t, 8) ^ \
256 /* initialise the key schedule from the user supplied key */
259 { t = rotr(t, 8); t = ls_box(t) ^ rco_tab[i]; \
260 t ^= E_KEY[4 * i]; E_KEY[4 * i + 4] = t; \
261 t ^= E_KEY[4 * i + 1]; E_KEY[4 * i + 5] = t; \
262 t ^= E_KEY[4 * i + 2]; E_KEY[4 * i + 6] = t; \
263 t ^= E_KEY[4 * i + 3]; E_KEY[4 * i + 7] = t; \
267 { t = rotr(t, 8); t = ls_box(t) ^ rco_tab[i]; \
268 t ^= E_KEY[6 * i]; E_KEY[6 * i + 6] = t; \
269 t ^= E_KEY[6 * i + 1]; E_KEY[6 * i + 7] = t; \
270 t ^= E_KEY[6 * i + 2]; E_KEY[6 * i + 8] = t; \
271 t ^= E_KEY[6 * i + 3]; E_KEY[6 * i + 9] = t; \
272 t ^= E_KEY[6 * i + 4]; E_KEY[6 * i + 10] = t; \
273 t ^= E_KEY[6 * i + 5]; E_KEY[6 * i + 11] = t; \
277 { t = rotr(t, 8); ; t = ls_box(t) ^ rco_tab[i]; \
278 t ^= E_KEY[8 * i]; E_KEY[8 * i + 8] = t; \
279 t ^= E_KEY[8 * i + 1]; E_KEY[8 * i + 9] = t; \
280 t ^= E_KEY[8 * i + 2]; E_KEY[8 * i + 10] = t; \
281 t ^= E_KEY[8 * i + 3]; E_KEY[8 * i + 11] = t; \
282 t = E_KEY[8 * i + 4] ^ ls_box(t); \
283 E_KEY[8 * i + 12] = t; \
284 t ^= E_KEY[8 * i + 5]; E_KEY[8 * i + 13] = t; \
285 t ^= E_KEY[8 * i + 6]; E_KEY[8 * i + 14] = t; \
286 t ^= E_KEY[8 * i + 7]; E_KEY[8 * i + 15] = t; \
290 aes_set_key(void *ctx_arg, const u8 *in_key, unsigned int key_len, u32 *flags)
292 struct aes_ctx *ctx = ctx_arg;
295 if (key_len != 16 && key_len != 24 && key_len != 32) {
296 *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
300 ctx->key_length = key_len;
302 E_KEY[0] = u32_in (in_key);
303 E_KEY[1] = u32_in (in_key + 4);
304 E_KEY[2] = u32_in (in_key + 8);
305 E_KEY[3] = u32_in (in_key + 12);
310 for (i = 0; i < 10; ++i)
315 E_KEY[4] = u32_in (in_key + 16);
316 t = E_KEY[5] = u32_in (in_key + 20);
317 for (i = 0; i < 8; ++i)
322 E_KEY[4] = u32_in (in_key + 16);
323 E_KEY[5] = u32_in (in_key + 20);
324 E_KEY[6] = u32_in (in_key + 24);
325 t = E_KEY[7] = u32_in (in_key + 28);
326 for (i = 0; i < 7; ++i)
336 for (i = 4; i < key_len + 24; ++i) {
337 imix_col (D_KEY[i], E_KEY[i]);
343 /* encrypt a block of text */
345 #define f_nround(bo, bi, k) \
346 f_rn(bo, bi, 0, k); \
347 f_rn(bo, bi, 1, k); \
348 f_rn(bo, bi, 2, k); \
349 f_rn(bo, bi, 3, k); \
352 #define f_lround(bo, bi, k) \
353 f_rl(bo, bi, 0, k); \
354 f_rl(bo, bi, 1, k); \
355 f_rl(bo, bi, 2, k); \
358 static void aes_encrypt(void *ctx_arg, u8 *out, const u8 *in)
360 const struct aes_ctx *ctx = ctx_arg;
362 const u32 *kp = E_KEY + 4;
364 b0[0] = u32_in (in) ^ E_KEY[0];
365 b0[1] = u32_in (in + 4) ^ E_KEY[1];
366 b0[2] = u32_in (in + 8) ^ E_KEY[2];
367 b0[3] = u32_in (in + 12) ^ E_KEY[3];
369 if (ctx->key_length > 24) {
370 f_nround (b1, b0, kp);
371 f_nround (b0, b1, kp);
374 if (ctx->key_length > 16) {
375 f_nround (b1, b0, kp);
376 f_nround (b0, b1, kp);
379 f_nround (b1, b0, kp);
380 f_nround (b0, b1, kp);
381 f_nround (b1, b0, kp);
382 f_nround (b0, b1, kp);
383 f_nround (b1, b0, kp);
384 f_nround (b0, b1, kp);
385 f_nround (b1, b0, kp);
386 f_nround (b0, b1, kp);
387 f_nround (b1, b0, kp);
388 f_lround (b0, b1, kp);
390 u32_out (out, b0[0]);
391 u32_out (out + 4, b0[1]);
392 u32_out (out + 8, b0[2]);
393 u32_out (out + 12, b0[3]);
396 /* decrypt a block of text */
398 #define i_nround(bo, bi, k) \
399 i_rn(bo, bi, 0, k); \
400 i_rn(bo, bi, 1, k); \
401 i_rn(bo, bi, 2, k); \
402 i_rn(bo, bi, 3, k); \
405 #define i_lround(bo, bi, k) \
406 i_rl(bo, bi, 0, k); \
407 i_rl(bo, bi, 1, k); \
408 i_rl(bo, bi, 2, k); \
411 static void aes_decrypt(void *ctx_arg, u8 *out, const u8 *in)
413 const struct aes_ctx *ctx = ctx_arg;
415 const int key_len = ctx->key_length;
416 const u32 *kp = D_KEY + key_len + 20;
418 b0[0] = u32_in (in) ^ E_KEY[key_len + 24];
419 b0[1] = u32_in (in + 4) ^ E_KEY[key_len + 25];
420 b0[2] = u32_in (in + 8) ^ E_KEY[key_len + 26];
421 b0[3] = u32_in (in + 12) ^ E_KEY[key_len + 27];
424 i_nround (b1, b0, kp);
425 i_nround (b0, b1, kp);
429 i_nround (b1, b0, kp);
430 i_nround (b0, b1, kp);
433 i_nround (b1, b0, kp);
434 i_nround (b0, b1, kp);
435 i_nround (b1, b0, kp);
436 i_nround (b0, b1, kp);
437 i_nround (b1, b0, kp);
438 i_nround (b0, b1, kp);
439 i_nround (b1, b0, kp);
440 i_nround (b0, b1, kp);
441 i_nround (b1, b0, kp);
442 i_lround (b0, b1, kp);
444 u32_out (out, b0[0]);
445 u32_out (out + 4, b0[1]);
446 u32_out (out + 8, b0[2]);
447 u32_out (out + 12, b0[3]);
453 static struct crypto_alg aes_alg = {
455 .cra_flags = CRYPTO_ALG_TYPE_CIPHER,
456 .cra_blocksize = AES_BLOCK_SIZE,
457 .cra_ctxsize = sizeof(struct aes_ctx),
458 .cra_module = THIS_MODULE,
459 .cra_list = LIST_HEAD_INIT(aes_alg.cra_list),
462 .cia_min_keysize = AES_MIN_KEY_SIZE,
463 .cia_max_keysize = AES_MAX_KEY_SIZE,
464 .cia_setkey = aes_set_key,
465 .cia_encrypt = aes_encrypt,
466 .cia_decrypt = aes_decrypt
471 static int __init aes_init(void)
474 return crypto_register_alg(&aes_alg);
477 static void __exit aes_fini(void)
479 crypto_unregister_alg(&aes_alg);
482 module_init(aes_init);
483 module_exit(aes_fini);
485 MODULE_DESCRIPTION("Rijndael (AES) Cipher Algorithm");
486 MODULE_LICENSE("Dual BSD/GPL");
490 crypto_cipher_set_key_fn_t aes_cipher_set_key = (crypto_cipher_set_key_fn_t) aes_set_key;
491 crypto_cipher_encrypt_fn_t aes_cipher_encrypt = (crypto_cipher_encrypt_fn_t) aes_encrypt;
492 crypto_cipher_decrypt_fn_t aes_cipher_decrypt = (crypto_cipher_decrypt_fn_t) aes_decrypt;
494 static void init(void) __attribute__((constructor));
495 static void init(void)
500 #endif /* BUILD_FOR_L4 */