; ---------------------------------------------------------------------------

; Copyright (c) 1998-2007, Brian Gladman, Worcester, UK. All rights reserved.

; LICENSE TERMS

; The free distribution and use of this software is allowed (with or without

; changes) provided that:

; 1. source code distributions include the above copyright notice, this

; list of conditions and the following disclaimer;

; 2. binary distributions include the above copyright notice, this list

; of conditions and the following disclaimer in their documentation;

; 3. the name of the copyright holder is not used to endorse products

; built using this software without specific written permission.

; DISCLAIMER

; This software is provided 'as is' with no explicit or implied warranties

; in respect of its properties, including, but not limited to, correctness

; and/or fitness for purpose.

; Apply S-Box to the 4 bytes in a 32-bit word and rotate byte positions

%ifdef REDUCE_CODE_SIZE

l3s_col:

movzx ecx,al ; in eax

movzx ecx, etab_b(ecx) ; out eax

%endmacro

%endif

; offsets to parameters

in_blk equ 2 ; input byte array address parameter

xor ebx,[ebp+4]

add sp, 2

ret

%else

%macro enc_round 0

mov ax, sp

movzx esp, ax

push ebp

push ebx

push esi

; AES Decryption Subroutine

do_name _aes_decrypt,12

mov ax, sp

movzx esp, ax

%else

movzx ecx,dl ; input eax, edx

movzx ecx,etab_b(ecx) ; output eax

%endif

do_name _aes_decrypt_key256,8

mov ax, sp

movzx esp, ax

push ebp

push ebx

push esi

push edi

movzx eax, word [esp+20] ; ks

movzx edx, word [esp+18] ; key

push ax

cmp ax, 0

jl .decrypt

aesenc xmm1, xmm0

jmp .2

.decrypt:

add si, ax

movdqu xmm0, [si]

cmp ax, 0

jl .decrypt_last

Copyright (c) 2008-2012 TrueCrypt Developers Association and which is governed

by the TrueCrypt License 3.0.

and all other portions of this file are Copyright (c) 2013-2016 IDRIX

and are governed by the Apache License 2.0 the full text of which is

contained in the file License.txt included in VeraCrypt binary and source

; ---------------------------------------------------------------------------

; Copyright (c) 1998-2007, Brian Gladman, Worcester, UK. All rights reserved.

; LICENSE TERMS

; The free distribution and use of this software is allowed (with or without

; changes) provided that:

; 1. source code distributions include the above copyright notice, this

; list of conditions and the following disclaimer;

; 2. binary distributions include the above copyright notice, this list

; of conditions and the following disclaimer in their documentation;

; 3. the name of the copyright holder is not used to endorse products

; built using this software without specific written permission.

; DISCLAIMER

; This software is provided 'as is' with no explicit or implied warranties

; in respect of its properties, including, but not limited to, correctness

; and/or fitness for purpose.

; ---------------------------------------------------------------------------

; Copyright (c) 1998-2007, Brian Gladman, Worcester, UK. All rights reserved.

; LICENSE TERMS

; The free distribution and use of this software is allowed (with or without

; changes) provided that:

; 1. source code distributions include the above copyright notice, this

; list of conditions and the following disclaimer;

; 2. binary distributions include the above copyright notice, this list

; of conditions and the following disclaimer in their documentation;

; 3. the name of the copyright holder is not used to endorse products

; built using this software without specific written permission.

; DISCLAIMER

; This software is provided 'as is' with no explicit or implied warranties

; in respect of its properties, including, but not limited to, correctness

; and/or fitness for purpose.

return EXIT_SUCCESS;

for (i = 0; i < 256; ++i)

uint_8t x = fwd_affine(fi((uint_8t)i));

aes_enc_tab[i][0] = 0;

aes_enc_tab[i][1] = x;

#include "Common/Endian.h"

#include "Rmd160.h"

#define G(x, y, z) (z ^ (x & (y^z)))

#define H(x, y, z) (z ^ (x | ~y))

#define I(x, y, z) (y ^ (z & (x^y)))

Subround(J, b2, c2, d2, e2, a2, X[ 3], 12, k5);

Subround(J, a2, b2, c2, d2, e2, X[12], 6, k5);

Subround(I, d2, e2, a2, b2, c2, X[11], 13, k6);

Subround(I, c2, d2, e2, a2, b2, X[ 3], 15, k6);

Subround(I, b2, c2, d2, e2, a2, X[ 7], 7, k6);

Copyright (c) 2008-2012 TrueCrypt Developers Association and which is governed

by the TrueCrypt License 3.0.

and all other portions of this file are Copyright (c) 2013-2016 IDRIX

and are governed by the Apache License 2.0 the full text of which is

contained in the file License.txt included in VeraCrypt binary and source

for (pos = 0; pos < 160; ++pos)

{

tmp = a + data[OrderTab[pos]] + KTab[pos >> 4];

switch (pos >> 4)

{

case 0: case 9: tmp += F (b, c, d); break;

#define afterI1(f) f(1,a,b,c,e,d)

#define afterI0(f) f(0,a,d,b,e,c)

// come from Dag Arne Osvik's paper "Speeding up Serpent".

#define S0(i, r0, r1, r2, r3, r4) \

}

static void S1f (unsigned __int32 *r0, unsigned __int32 *r1, unsigned __int32 *r2, unsigned __int32 *r3, unsigned __int32 *r4)

*r4 = *r0;

*r0 &= *r1;

*r2 ^= *r0;

}

static void S2f (unsigned __int32 *r0, unsigned __int32 *r1, unsigned __int32 *r2, unsigned __int32 *r3, unsigned __int32 *r4)

*r4 = *r0;

*r0 &= *r2;

*r0 ^= *r3;

*r4 ^= *r0;

*r1 ^= *r3;

*r1 ^= *r4;

}

static void S3f (unsigned __int32 *r0, unsigned __int32 *r1, unsigned __int32 *r2, unsigned __int32 *r3, unsigned __int32 *r4)

*r4 = *r0;

*r0 |= *r3;

*r3 ^= *r1;

}

static void S4f (unsigned __int32 *r0, unsigned __int32 *r1, unsigned __int32 *r2, unsigned __int32 *r3, unsigned __int32 *r4)

*r1 ^= *r3;

*r2 ^= *r3;

*r3 ^= *r0;

*r4 = *r1;

*r0 |= *r3;

*r0 ^= *r2;

*r2 &= *r3;

*r4 ^= *r2;

}

static void S5f (unsigned __int32 *r0, unsigned __int32 *r1, unsigned __int32 *r2, unsigned __int32 *r3, unsigned __int32 *r4)

*r0 ^= *r1;

*r1 ^= *r3;

*r4 = *r1;

*r1 &= *r0;

*r2 ^= *r3;

*r4 ^= *r2;

*r2 ^= *r0;

*r0 &= *r3;

*r0 ^= *r4;

*r4 |= *r3;

*r2 ^= *r4;

}

static void S6f (unsigned __int32 *r0, unsigned __int32 *r1, unsigned __int32 *r2, unsigned __int32 *r3, unsigned __int32 *r4)

*r4 = *r3;

*r3 &= *r0;

*r0 ^= *r4;

*r0 ^= *r2;

*r4 ^= *r3;

*r4 ^= *r0;

*r2 &= *r4;

*r2 ^= *r3;

}

static void S7f (unsigned __int32 *r0, unsigned __int32 *r1, unsigned __int32 *r2, unsigned __int32 *r3, unsigned __int32 *r4)

*r4 = *r2;

*r2 &= *r1;

*r2 ^= *r3;

*r3 ^= *r4;

*r4 ^= *r2;

*r2 &= *r0;

*r2 ^= *r4;

*r4 &= *r0;

*r1 ^= *r3;

while (1);

afterS7(KX);

out[0] = LE32(d);

out[1] = LE32(e);

out[2] = LE32(b);

while (1);

KXf (k, 32, &d, &e, &b, &a);

out[0] = LE32(d);

out[1] = LE32(e);

out[2] = LE32(b);

k -= 32;

beforeI7(ILT);

start:

afterI1(ILT); afterI1(I0); afterI0(KX);

}

while (--i != 0);

out[0] = LE32(a);

out[1] = LE32(d);

out[2] = LE32(b);

#else // TC_MINIMIZE_CODE_SIZE

static void ILTf (uint32 *a, uint32 *b, uint32 *c, uint32 *d)

*c = rotrFixed(*c, 22);

*a = rotrFixed(*a, 5);

*c ^= *d ^ (*b << 7);

beforeI7(ILT);

start:

beforeI7(I7); KXf (k, 28, &d, &a, &b, &e);

ILTf (&b, &c, &e, &a); afterI4(I3); KXf (k, 12, &a, &b, &e, &c);

ILTf (&a, &b, &e, &c); afterI3(I2); KXf (k, 8, &b, &d, &e, &c);

ILTf (&b, &d, &e, &c); afterI2(I1); KXf (k, 4, &a, &b, &c, &e);

ILTf (&a, &b, &c, &e); afterI1(I0); KXf (k, 0, &a, &d, &b, &e);

}

while (--i != 0);

out[0] = LE32(a);

out[1] = LE32(d);

out[2] = LE32(b);

Various logical functions

*/

#define Ch(x,y,z) (z ^ (x & (y ^ z)))

#define S(x, n) RORc((x),(n))

#define R(x, n) ((x)>>(n))

#define Sigma0(x) (S(x, 2) ^ S(x, 13) ^ S(x, 22))

for (i = 0; i < 64; ++i) {

RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],i);

S[4] = S[3]; S[3] = S[2]; S[2] = S[1]; S[1] = S[0]; S[0] = t;

}

{

uint32 n;

while (len > 0) {

sha256_compress(ctx, (unsigned char *)data);

n = ctx->lowLength + 512;

if (n < ctx->lowLength) {

ctx->highLength++;

}

ctx->curlen = 0;

}

}

STORE32H(ctx->highLength, ctx->buf, 56);

STORE32H(ctx->lowLength, ctx->buf, 60);

sha256_compress(ctx, ctx->buf);

/*

static u1byte ror4[16] = { 0, 8, 1, 9, 2, 10, 3, 11, 4, 12, 5, 13, 6, 14, 7, 15 };

static u1byte ashx[16] = { 0, 9, 2, 11, 4, 13, 6, 15, 8, 1, 10, 3, 12, 5, 14, 7 };

{ { 8, 1, 7, 13, 6, 15, 3, 2, 0, 11, 5, 9, 14, 12, 10, 4 },

{ 2, 8, 11, 13, 15, 7, 6, 14, 3, 1, 9, 4, 0, 10, 12, 5 }

};

static u1byte qt1[2][16] =

{ 1, 14, 2, 11, 4, 12, 3, 7, 6, 13, 10, 5, 15, 9, 0, 8 }

};

{ { 11, 10, 5, 14, 6, 13, 9, 0, 12, 8, 15, 3, 2, 4, 7, 1 },

{ 4, 12, 7, 5, 1, 6, 9, 10, 0, 14, 13, 8, 2, 11, 3, 15 }

};

{ { 13, 7, 15, 4, 1, 2, 6, 14, 9, 11, 3, 0, 8, 5, 12, 10 },

{ 11, 9, 5, 1, 12, 3, 13, 14, 6, 4, 7, 15, 2, 0, 8, 10 }

};

static u1byte qp(const u4byte n, const u1byte x)

{ u1byte a0, a1, a2, a3, a4, b0, b1, b2, b3, b4;

{ u4byte i;

for(i = 0; i < 256; ++i)

q(0,i) = qp(0, (u1byte)i);

q(1,i) = qp(1, (u1byte)i);

}

static void gen_mtab(void)

{ u4byte i, f01, f5b, fef;

for(i = 0; i < 256; ++i)

{

f01 = q(1,i); f5b = ffm_5b(f01); fef = ffm_ef(f01);

mk_tab[0 + 4*i] = mds(0, q20(by)); mk_tab[1 + 4*i] = mds(1, q21(by));

mk_tab[2 + 4*i] = mds(2, q22(by)); mk_tab[3 + 4*i] = mds(3, q23(by));

#else

sb[2][i] = q22(by); sb[3][i] = q23(by);

#endif

}

break;

case 3: for(i = 0; i < 256; ++i)

{

by = (u1byte)i;

mk_tab[0 + 4*i] = mds(0, q30(by)); mk_tab[1 + 4*i] = mds(1, q31(by));

mk_tab[2 + 4*i] = mds(2, q32(by)); mk_tab[3 + 4*i] = mds(3, q33(by));

#else

sb[2][i] = q32(by); sb[3][i] = q33(by);

#endif

}

break;

case 4: for(i = 0; i < 256; ++i)

{

by = (u1byte)i;

mk_tab[0 + 4*i] = mds(0, q40(by)); mk_tab[1 + 4*i] = mds(1, q41(by));

mk_tab[2 + 4*i] = mds(2, q42(by)); mk_tab[3 + 4*i] = mds(3, q43(by));

#else

sb[2][i] = q42(by); sb[3][i] = q43(by);

#endif

}

where the coefficients are in the finite field GF(2^8) with a

modular polynomial a^8 + a^6 + a^3 + a^2 + 1. To generate the

remainder we have to start with a 12th order polynomial with our

That is:

m[7] * x^11 + m[6] * x^10 ... + m[0] * x^4 + 0 * x^3 +... + 0

We then multiply the generator polynomial by m[7] * x^7 and subtract

the generator polynomial by x^6 * coeff(x^10) and use this to remove

the x^10 term. We carry on in this way until the x^4 term is removed

so that we are left with:

r[3] * x^3 + r[2] * x^2 + r[1] 8 x^1 + r[0]

to implement.

*/

for(i = 0; i < 8; ++i)

{

t = p1 >> 24; // get most significant coefficient

p1 = (p1 << 8) | (p0 >> 24); p0 <<= 8; // shift others up

// multiply t by a (the primitive element - i.e. left shift)

if(t & 0x80) // subtract modular polynomial on overflow

if(t & 0x01) // add the modular polynomial on underflow

u ^= G_MOD >> 1;

p1 ^= (u << 24) | (u << 8); // remove t * (a + 1/a) * (x^3 + x)

out_blk[0] = LE32(blk[2] ^ l_key[4]);

out_blk[1] = LE32(blk[3] ^ l_key[5]);

out_blk[2] = LE32(blk[0] ^ l_key[6]);

};

#else // TC_MINIMIZE_CODE_SIZE

out_blk[0] = LE32(blk[2] ^ l_key[4]);

out_blk[1] = LE32(blk[3] ^ l_key[5]);

out_blk[2] = LE32(blk[0] ^ l_key[6]);

};

#endif // TC_MINIMIZE_CODE_SIZE

out_blk[0] = LE32(blk[2] ^ l_key[0]);

out_blk[1] = LE32(blk[3] ^ l_key[1]);

out_blk[2] = LE32(blk[0] ^ l_key[2]);

};

#else // TC_MINIMIZE_CODE_SIZE

out_blk[0] = LE32(blk[2] ^ l_key[0]);

out_blk[1] = LE32(blk[3] ^ l_key[1]);

out_blk[2] = LE32(blk[0] ^ l_key[2]);

};

#endif // TC_MINIMIZE_CODE_SIZE

* ``The Whirlpool hashing function,''

* NESSIE submission, 2000 (tweaked version, 2001),

* <https://www.cosic.esat.kuleuven.ac.be/nessie/workshop/submissions/whirlpool.zip>

* @author Paulo S.L.M. Barreto

* @author Vincent Rijmen.

*

AS2( and esp, -16)

AS2( sub esp, 16*8)

AS_PUSH_IF86( ax)

#if CRYPTOPP_BOOL_X86

#define SSE2_workspace esp+WORD_SZ

#elif CRYPTOPP_BOOL_X32

*/

void WHIRLPOOL_add(const unsigned char * input,

unsigned __int32 sourceBits,

{

uint64 num, oldCountLo = ctx->countLo, oldCountHi = ctx->countHi;

uint64 len = sourceBits >> 3;

else

{

uint64* dataBuf = ctx->data;

num = oldCountLo & 63;

if (num != 0) // process left over data

/**

* Get the hash value from the hashing state.

* This method uses the invariant: bufferBits < DIGESTBITS

*/

void WHIRLPOOL_finalize(WHIRLPOOL_CTX * const ctx,

{

unsigned int num = ctx->countLo & 63;

uint64* dataBuf = ctx->data;

{

return 0;

}

// function 0 returns the highest basic function understood in EAX

if(input == 0)

return !!output[0]? 1 : 0;

#if (defined(__AES__) && defined(__PCLMUL__)) || defined(__INTEL_COMPILER)

#ifdef TC_WINDOWS_DRIVER

const int imm8);

extern __m128i _mm_aeskeygenassist_si128(__m128i ckey, const int rcon);

extern __m128i _mm_aesimc_si128(__m128i v);