1/*
2 * FIPS-197 compliant AES implementation
3 *
4 * Copyright (C) 2006-2007 Christophe Devine
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * * Redistributions of source code _must_ retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * * Redistributions in binary form may or may not reproduce the above
13 * copyright notice, this list of conditions and the following
14 * disclaimer in the documentation and/or other materials provided
15 * with the distribution.
16 * * Neither the name of XySSL nor the names of its contributors may be
17 * used to endorse or promote products derived from this software
18 * without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
24 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
25 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
26 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
27 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
28 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
29 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
30 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31 */
32/*
33 * The AES block cipher was designed by Vincent Rijmen and Joan Daemen.
34 *
35 * http://csrc.nist.gov/encryption/aes/rijndael/Rijndael.pdf
36 * http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf
37 */
38
39#include "mupdf/fitz.h"
40
41#include <string.h>
42
43#define aes_context fz_aes
44
45/* AES block cipher implementation from XYSSL */
46
47/*
48 * 32-bit integer manipulation macros (little endian)
49 */
50#ifndef GET_ULONG_LE
51#define GET_ULONG_LE(n,b,i) \
52{ \
53 (n) = ( (unsigned long) (b)[(i)] ) \
54 | ( (unsigned long) (b)[(i) + 1] << 8 ) \
55 | ( (unsigned long) (b)[(i) + 2] << 16 ) \
56 | ( (unsigned long) (b)[(i) + 3] << 24 ); \
57}
58#endif
59
60#ifndef PUT_ULONG_LE
61#define PUT_ULONG_LE(n,b,i) \
62{ \
63 (b)[(i) ] = (unsigned char) ( (n) ); \
64 (b)[(i) + 1] = (unsigned char) ( (n) >> 8 ); \
65 (b)[(i) + 2] = (unsigned char) ( (n) >> 16 ); \
66 (b)[(i) + 3] = (unsigned char) ( (n) >> 24 ); \
67}
68#endif
69
70/*
71 * Forward S-box & tables
72 */
73static unsigned char FSb[256];
74static unsigned long FT0[256];
75static unsigned long FT1[256];
76static unsigned long FT2[256];
77static unsigned long FT3[256];
78
79/*
80 * Reverse S-box & tables
81 */
82static unsigned char RSb[256];
83static unsigned long RT0[256];
84static unsigned long RT1[256];
85static unsigned long RT2[256];
86static unsigned long RT3[256];
87
88/*
89 * Round constants
90 */
91static unsigned long RCON[10];
92
93/*
94 * Tables generation code
95 */
96#define ROTL8(x) ( ( x << 8 ) & 0xFFFFFFFF ) | ( x >> 24 )
97#define XTIME(x) ( ( x << 1 ) ^ ( ( x & 0x80 ) ? 0x1B : 0x00 ) )
98#define MUL(x,y) ( ( x && y ) ? pow[(log[x]+log[y]) % 255] : 0 )
99
100static int aes_init_done = 0;
101
102static void aes_gen_tables( void )
103{
104 int i, x, y, z;
105 int pow[256];
106 int log[256];
107
108 /*
109 * compute pow and log tables over GF(2^8)
110 */
111 for( i = 0, x = 1; i < 256; i++ )
112 {
113 pow[i] = x;
114 log[x] = i;
115 x = ( x ^ XTIME( x ) ) & 0xFF;
116 }
117
118 /*
119 * calculate the round constants
120 */
121 for( i = 0, x = 1; i < 10; i++ )
122 {
123 RCON[i] = (unsigned long) x;
124 x = XTIME( x ) & 0xFF;
125 }
126
127 /*
128 * generate the forward and reverse S-boxes
129 */
130 FSb[0x00] = 0x63;
131 RSb[0x63] = 0x00;
132
133 for( i = 1; i < 256; i++ )
134 {
135 x = pow[255 - log[i]];
136
137 y = x; y = ( (y << 1) | (y >> 7) ) & 0xFF;
138 x ^= y; y = ( (y << 1) | (y >> 7) ) & 0xFF;
139 x ^= y; y = ( (y << 1) | (y >> 7) ) & 0xFF;
140 x ^= y; y = ( (y << 1) | (y >> 7) ) & 0xFF;
141 x ^= y ^ 0x63;
142
143 FSb[i] = (unsigned char) x;
144 RSb[x] = (unsigned char) i;
145 }
146
147 /*
148 * generate the forward and reverse tables
149 */
150 for( i = 0; i < 256; i++ )
151 {
152 x = FSb[i];
153 y = XTIME( x ) & 0xFF;
154 z = ( y ^ x ) & 0xFF;
155
156 FT0[i] = ( (unsigned long) y ) ^
157 ( (unsigned long) x << 8 ) ^
158 ( (unsigned long) x << 16 ) ^
159 ( (unsigned long) z << 24 );
160
161 FT1[i] = ROTL8( FT0[i] );
162 FT2[i] = ROTL8( FT1[i] );
163 FT3[i] = ROTL8( FT2[i] );
164
165 x = RSb[i];
166
167 RT0[i] = ( (unsigned long) MUL( 0x0E, x ) ) ^
168 ( (unsigned long) MUL( 0x09, x ) << 8 ) ^
169 ( (unsigned long) MUL( 0x0D, x ) << 16 ) ^
170 ( (unsigned long) MUL( 0x0B, x ) << 24 );
171
172 RT1[i] = ROTL8( RT0[i] );
173 RT2[i] = ROTL8( RT1[i] );
174 RT3[i] = ROTL8( RT2[i] );
175 }
176}
177
178/*
179 * AES key schedule (encryption)
180 */
181int fz_aes_setkey_enc( aes_context *ctx, const unsigned char *key, int keysize )
182{
183 int i;
184 unsigned long *RK;
185
186#if !defined(XYSSL_AES_ROM_TABLES)
187 if( aes_init_done == 0 )
188 {
189 aes_gen_tables();
190 aes_init_done = 1;
191 }
192#endif
193
194 switch( keysize )
195 {
196 case 128: ctx->nr = 10; break;
197 case 192: ctx->nr = 12; break;
198 case 256: ctx->nr = 14; break;
199 default : return 1;
200 }
201
202#if defined(PADLOCK_ALIGN16)
203 ctx->rk = RK = PADLOCK_ALIGN16( ctx->buf );
204#else
205 ctx->rk = RK = ctx->buf;
206#endif
207
208 for( i = 0; i < (keysize >> 5); i++ )
209 {
210 GET_ULONG_LE( RK[i], key, i << 2 );
211 }
212
213 switch( ctx->nr )
214 {
215 case 10:
216
217 for( i = 0; i < 10; i++, RK += 4 )
218 {
219 RK[4] = RK[0] ^ RCON[i] ^
220 ( FSb[ ( RK[3] >> 8 ) & 0xFF ] ) ^
221 ( FSb[ ( RK[3] >> 16 ) & 0xFF ] << 8 ) ^
222 ( FSb[ ( RK[3] >> 24 ) & 0xFF ] << 16 ) ^
223 ( FSb[ ( RK[3] ) & 0xFF ] << 24 );
224
225 RK[5] = RK[1] ^ RK[4];
226 RK[6] = RK[2] ^ RK[5];
227 RK[7] = RK[3] ^ RK[6];
228 }
229 break;
230
231 case 12:
232
233 for( i = 0; i < 8; i++, RK += 6 )
234 {
235 RK[6] = RK[0] ^ RCON[i] ^
236 ( FSb[ ( RK[5] >> 8 ) & 0xFF ] ) ^
237 ( FSb[ ( RK[5] >> 16 ) & 0xFF ] << 8 ) ^
238 ( FSb[ ( RK[5] >> 24 ) & 0xFF ] << 16 ) ^
239 ( FSb[ ( RK[5] ) & 0xFF ] << 24 );
240
241 RK[7] = RK[1] ^ RK[6];
242 RK[8] = RK[2] ^ RK[7];
243 RK[9] = RK[3] ^ RK[8];
244 RK[10] = RK[4] ^ RK[9];
245 RK[11] = RK[5] ^ RK[10];
246 }
247 break;
248
249 case 14:
250
251 for( i = 0; i < 7; i++, RK += 8 )
252 {
253 RK[8] = RK[0] ^ RCON[i] ^
254 ( FSb[ ( RK[7] >> 8 ) & 0xFF ] ) ^
255 ( FSb[ ( RK[7] >> 16 ) & 0xFF ] << 8 ) ^
256 ( FSb[ ( RK[7] >> 24 ) & 0xFF ] << 16 ) ^
257 ( FSb[ ( RK[7] ) & 0xFF ] << 24 );
258
259 RK[9] = RK[1] ^ RK[8];
260 RK[10] = RK[2] ^ RK[9];
261 RK[11] = RK[3] ^ RK[10];
262
263 RK[12] = RK[4] ^
264 ( FSb[ ( RK[11] ) & 0xFF ] ) ^
265 ( FSb[ ( RK[11] >> 8 ) & 0xFF ] << 8 ) ^
266 ( FSb[ ( RK[11] >> 16 ) & 0xFF ] << 16 ) ^
267 ( FSb[ ( RK[11] >> 24 ) & 0xFF ] << 24 );
268
269 RK[13] = RK[5] ^ RK[12];
270 RK[14] = RK[6] ^ RK[13];
271 RK[15] = RK[7] ^ RK[14];
272 }
273 break;
274
275 default:
276
277 break;
278 }
279 return 0;
280}
281
282/*
283 * AES key schedule (decryption)
284 */
285int fz_aes_setkey_dec(aes_context *ctx, const unsigned char *key, int keysize)
286{
287 int i, j;
288 aes_context cty;
289 unsigned long *RK;
290 unsigned long *SK;
291
292 switch( keysize )
293 {
294 case 128: ctx->nr = 10; break;
295 case 192: ctx->nr = 12; break;
296 case 256: ctx->nr = 14; break;
297 default: return 1;
298 }
299
300#if defined(PADLOCK_ALIGN16)
301 ctx->rk = RK = PADLOCK_ALIGN16( ctx->buf );
302#else
303 ctx->rk = RK = ctx->buf;
304#endif
305
306 i = fz_aes_setkey_enc( &cty, key, keysize );
307 if (i)
308 return i;
309 SK = cty.rk + cty.nr * 4;
310
311 *RK++ = *SK++;
312 *RK++ = *SK++;
313 *RK++ = *SK++;
314 *RK++ = *SK++;
315
316 for( i = ctx->nr - 1, SK -= 8; i > 0; i--, SK -= 8 )
317 {
318 for( j = 0; j < 4; j++, SK++ )
319 {
320 *RK++ = RT0[ FSb[ ( *SK ) & 0xFF ] ] ^
321 RT1[ FSb[ ( *SK >> 8 ) & 0xFF ] ] ^
322 RT2[ FSb[ ( *SK >> 16 ) & 0xFF ] ] ^
323 RT3[ FSb[ ( *SK >> 24 ) & 0xFF ] ];
324 }
325 }
326
327 *RK++ = *SK++;
328 *RK++ = *SK++;
329 *RK++ = *SK++;
330 *RK = *SK;
331
332 memset( &cty, 0, sizeof( aes_context ) );
333 return 0;
334}
335
336#define AES_FROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3) \
337{ \
338 X0 = *RK++ ^ FT0[ ( Y0 ) & 0xFF ] ^ \
339 FT1[ ( Y1 >> 8 ) & 0xFF ] ^ \
340 FT2[ ( Y2 >> 16 ) & 0xFF ] ^ \
341 FT3[ ( Y3 >> 24 ) & 0xFF ]; \
342 \
343 X1 = *RK++ ^ FT0[ ( Y1 ) & 0xFF ] ^ \
344 FT1[ ( Y2 >> 8 ) & 0xFF ] ^ \
345 FT2[ ( Y3 >> 16 ) & 0xFF ] ^ \
346 FT3[ ( Y0 >> 24 ) & 0xFF ]; \
347 \
348 X2 = *RK++ ^ FT0[ ( Y2 ) & 0xFF ] ^ \
349 FT1[ ( Y3 >> 8 ) & 0xFF ] ^ \
350 FT2[ ( Y0 >> 16 ) & 0xFF ] ^ \
351 FT3[ ( Y1 >> 24 ) & 0xFF ]; \
352 \
353 X3 = *RK++ ^ FT0[ ( Y3 ) & 0xFF ] ^ \
354 FT1[ ( Y0 >> 8 ) & 0xFF ] ^ \
355 FT2[ ( Y1 >> 16 ) & 0xFF ] ^ \
356 FT3[ ( Y2 >> 24 ) & 0xFF ]; \
357}
358
359#define AES_RROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3) \
360{ \
361 X0 = *RK++ ^ RT0[ ( Y0 ) & 0xFF ] ^ \
362 RT1[ ( Y3 >> 8 ) & 0xFF ] ^ \
363 RT2[ ( Y2 >> 16 ) & 0xFF ] ^ \
364 RT3[ ( Y1 >> 24 ) & 0xFF ]; \
365 \
366 X1 = *RK++ ^ RT0[ ( Y1 ) & 0xFF ] ^ \
367 RT1[ ( Y0 >> 8 ) & 0xFF ] ^ \
368 RT2[ ( Y3 >> 16 ) & 0xFF ] ^ \
369 RT3[ ( Y2 >> 24 ) & 0xFF ]; \
370 \
371 X2 = *RK++ ^ RT0[ ( Y2 ) & 0xFF ] ^ \
372 RT1[ ( Y1 >> 8 ) & 0xFF ] ^ \
373 RT2[ ( Y0 >> 16 ) & 0xFF ] ^ \
374 RT3[ ( Y3 >> 24 ) & 0xFF ]; \
375 \
376 X3 = *RK++ ^ RT0[ ( Y3 ) & 0xFF ] ^ \
377 RT1[ ( Y2 >> 8 ) & 0xFF ] ^ \
378 RT2[ ( Y1 >> 16 ) & 0xFF ] ^ \
379 RT3[ ( Y0 >> 24 ) & 0xFF ]; \
380}
381
382/*
383 * AES-ECB block encryption/decryption
384 */
385void fz_aes_crypt_ecb( aes_context *ctx,
386 int mode,
387 const unsigned char input[16],
388 unsigned char output[16] )
389{
390 int i;
391 unsigned long *RK, X0, X1, X2, X3, Y0, Y1, Y2, Y3;
392
393#if defined(XYSSL_PADLOCK_C) && defined(XYSSL_HAVE_X86)
394 if( padlock_supports( PADLOCK_ACE ) )
395 {
396 if( padlock_xcryptecb( ctx, mode, input, output ) == 0 )
397 return;
398 }
399#endif
400
401 RK = ctx->rk;
402
403 GET_ULONG_LE( X0, input, 0 ); X0 ^= *RK++;
404 GET_ULONG_LE( X1, input, 4 ); X1 ^= *RK++;
405 GET_ULONG_LE( X2, input, 8 ); X2 ^= *RK++;
406 GET_ULONG_LE( X3, input, 12 ); X3 ^= *RK++;
407
408 if( mode == FZ_AES_DECRYPT )
409 {
410 for( i = (ctx->nr >> 1) - 1; i > 0; i-- )
411 {
412 AES_RROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 );
413 AES_RROUND( X0, X1, X2, X3, Y0, Y1, Y2, Y3 );
414 }
415
416 AES_RROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 );
417
418 X0 = *RK++ ^ ( RSb[ ( Y0 ) & 0xFF ] ) ^
419 ( RSb[ ( Y3 >> 8 ) & 0xFF ] << 8 ) ^
420 ( RSb[ ( Y2 >> 16 ) & 0xFF ] << 16 ) ^
421 ( RSb[ ( Y1 >> 24 ) & 0xFF ] << 24 );
422
423 X1 = *RK++ ^ ( RSb[ ( Y1 ) & 0xFF ] ) ^
424 ( RSb[ ( Y0 >>8 ) & 0xFF ] << 8 ) ^
425 ( RSb[ ( Y3 >> 16 ) & 0xFF ] << 16 ) ^
426 ( RSb[ ( Y2 >> 24 ) & 0xFF ] << 24 );
427
428 X2 = *RK++ ^ ( RSb[ ( Y2 ) & 0xFF ] ) ^
429 ( RSb[ ( Y1 >> 8 ) & 0xFF ] << 8 ) ^
430 ( RSb[ ( Y0 >> 16 ) & 0xFF ] << 16 ) ^
431 ( RSb[ ( Y3 >> 24 ) & 0xFF ] << 24 );
432
433 X3 = *RK ^ ( RSb[ ( Y3 ) & 0xFF ] ) ^
434 ( RSb[ ( Y2 >> 8 ) & 0xFF ] << 8 ) ^
435 ( RSb[ ( Y1 >> 16 ) & 0xFF ] << 16 ) ^
436 ( RSb[ ( Y0 >> 24 ) & 0xFF ] << 24 );
437 }
438 else /* FZ_AES_ENCRYPT */
439 {
440 for( i = (ctx->nr >> 1) - 1; i > 0; i-- )
441 {
442 AES_FROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 );
443 AES_FROUND( X0, X1, X2, X3, Y0, Y1, Y2, Y3 );
444 }
445
446 AES_FROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 );
447
448 X0 = *RK++ ^ ( FSb[ ( Y0 ) & 0xFF ] ) ^
449 ( FSb[ ( Y1 >> 8 ) & 0xFF ] << 8 ) ^
450 ( FSb[ ( Y2 >> 16 ) & 0xFF ] << 16 ) ^
451 ( FSb[ ( Y3 >> 24 ) & 0xFF ] << 24 );
452
453 X1 = *RK++ ^ ( FSb[ ( Y1 ) & 0xFF ] ) ^
454 ( FSb[ ( Y2 >> 8 ) & 0xFF ] << 8 ) ^
455 ( FSb[ ( Y3 >> 16 ) & 0xFF ] << 16 ) ^
456 ( FSb[ ( Y0 >> 24 ) & 0xFF ] << 24 );
457
458 X2 = *RK++ ^ ( FSb[ ( Y2 ) & 0xFF ] ) ^
459 ( FSb[ ( Y3 >> 8 ) & 0xFF ] << 8 ) ^
460 ( FSb[ ( Y0 >> 16 ) & 0xFF ] << 16 ) ^
461 ( FSb[ ( Y1 >> 24 ) & 0xFF ] << 24 );
462
463 X3 = *RK ^ ( FSb[ ( Y3 ) & 0xFF ] ) ^
464 ( FSb[ ( Y0 >> 8 ) & 0xFF ] << 8 ) ^
465 ( FSb[ ( Y1 >> 16 ) & 0xFF ] << 16 ) ^
466 ( FSb[ ( Y2 >> 24 ) & 0xFF ] << 24 );
467 }
468
469 PUT_ULONG_LE( X0, output, 0 );
470 PUT_ULONG_LE( X1, output, 4 );
471 PUT_ULONG_LE( X2, output, 8 );
472 PUT_ULONG_LE( X3, output, 12 );
473}
474
475/*
476 * AES-CBC buffer encryption/decryption
477 */
478void fz_aes_crypt_cbc( aes_context *ctx,
479 int mode,
480 size_t length,
481 unsigned char iv[16],
482 const unsigned char *input,
483 unsigned char *output )
484{
485 int i;
486 unsigned char temp[16];
487
488#if defined(XYSSL_PADLOCK_C) && defined(XYSSL_HAVE_X86)
489 if( padlock_supports( PADLOCK_ACE ) )
490 {
491 if( padlock_xcryptcbc( ctx, mode, length, iv, input, output ) == 0 )
492 return;
493 }
494#endif
495
496 if( mode == FZ_AES_DECRYPT )
497 {
498 while( length > 0 )
499 {
500 memcpy( temp, input, 16 );
501 fz_aes_crypt_ecb( ctx, mode, input, output );
502
503 for( i = 0; i < 16; i++ )
504 output[i] = (unsigned char)( output[i] ^ iv[i] );
505
506 memcpy( iv, temp, 16 );
507
508 input += 16;
509 output += 16;
510 length -= 16;
511 }
512 }
513 else
514 {
515 while( length > 0 )
516 {
517 for( i = 0; i < 16; i++ )
518 output[i] = (unsigned char)( input[i] ^ iv[i] );
519
520 fz_aes_crypt_ecb( ctx, mode, output, output );
521 memcpy( iv, output, 16 );
522
523 input += 16;
524 output += 16;
525 length -= 16;
526 }
527 }
528}
529
530/*
531 * AES-CFB buffer encryption/decryption
532 */
533void fz_aes_crypt_cfb( aes_context *ctx,
534 int mode,
535 int length,
536 int *iv_off,
537 unsigned char iv[16],
538 const unsigned char *input,
539 unsigned char *output )
540{
541 int c, n = *iv_off;
542
543 if( mode == FZ_AES_DECRYPT )
544 {
545 while( length-- )
546 {
547 if( n == 0 )
548 fz_aes_crypt_ecb( ctx, FZ_AES_ENCRYPT, iv, iv );
549
550 c = *input++;
551 *output++ = (unsigned char)( c ^ iv[n] );
552 iv[n] = (unsigned char) c;
553
554 n = (n + 1) & 0x0F;
555 }
556 }
557 else
558 {
559 while( length-- )
560 {
561 if( n == 0 )
562 fz_aes_crypt_ecb( ctx, FZ_AES_ENCRYPT, iv, iv );
563
564 iv[n] = *output++ = (unsigned char)( iv[n] ^ *input++ );
565
566 n = (n + 1) & 0x0F;
567 }
568 }
569
570 *iv_off = n;
571}
572