-/*

- ---------------------------------------------------------------------------

- Copyright (c) 1998-2007, Brian Gladman, Worcester, UK. All rights reserved.

-

- LICENSE TERMS

-

- The free distribution and use of this software is allowed (with or without

- changes) provided that:

-

- 1. source code distributions include the above copyright notice, this

- list of conditions and the following disclaimer;

-

- 2. binary distributions include the above copyright notice, this list

- of conditions and the following disclaimer in their documentation;

-

- 3. the name of the copyright holder is not used to endorse products

- built using this software without specific written permission.

-

- DISCLAIMER

-

- This software is provided 'as is' with no explicit or implied warranties

- in respect of its properties, including, but not limited to, correctness

- and/or fitness for purpose.

- ---------------------------------------------------------------------------

- Issue Date: 20/12/2007

-

- This file contains the definitions required to use AES in C. See aesopt.h

- for optimisation details.

-*/

-

-/* Adapted for TrueCrypt */

-

-#ifndef _AES_H

-#define _AES_H

-

-#include "Common/Tcdefs.h"

-

-#ifndef EXIT_SUCCESS

-#define EXIT_SUCCESS 0

-#define EXIT_FAILURE 1

-#endif

-#define INT_RETURN int

-

-#if defined(__cplusplus)

-extern "C"

-{

-#endif

-

-// #define AES_128 /* define if AES with 128 bit keys is needed */

-// #define AES_192 /* define if AES with 192 bit keys is needed */

-#define AES_256 /* define if AES with 256 bit keys is needed */

-// #define AES_VAR /* define if a variable key size is needed */

-// #define AES_MODES /* define if support is needed for modes */

-

-/* The following must also be set in assembler files if being used */

-

-#define AES_ENCRYPT /* if support for encryption is needed */

-#define AES_DECRYPT /* if support for decryption is needed */

-#define AES_ERR_CHK /* for parameter checks & error return codes */

-#define AES_REV_DKS /* define to reverse decryption key schedule */

-

-#define AES_BLOCK_SIZE 16 /* the AES block size in bytes */

-#define N_COLS 4 /* the number of columns in the state */

-

-/* The key schedule length is 11, 13 or 15 16-byte blocks for 128, */

-/* 192 or 256-bit keys respectively. That is 176, 208 or 240 bytes */

-/* or 44, 52 or 60 32-bit words. */

-

-#if defined( AES_VAR ) || defined( AES_256 )

-#define KS_LENGTH 60

-#elif defined( AES_192 )

-#define KS_LENGTH 52

-#else

-#define KS_LENGTH 44

-#endif

-

-#if defined( AES_ERR_CHK )

-#define AES_RETURN INT_RETURN

-#else

-#define AES_RETURN VOID_RETURN

-#endif

-

-/* the character array 'inf' in the following structures is used */

-/* to hold AES context information. This AES code uses cx->inf.b[0] */

-/* to hold the number of rounds multiplied by 16. The other three */

-/* elements can be used by code that implements additional modes */

-

-typedef union

-{ uint_32t l;

- uint_8t b[4];

-} aes_inf;

-

-typedef struct

-{ uint_32t ks[KS_LENGTH];

- aes_inf inf;

-} aes_encrypt_ctx;

-

-typedef struct

-{ uint_32t ks[KS_LENGTH];

- aes_inf inf;

-} aes_decrypt_ctx;

-

-/* This routine must be called before first use if non-static */

-/* tables are being used */

-

-AES_RETURN aes_init(void);

-

-/* Key lengths in the range 16 <= key_len <= 32 are given in bytes, */

-/* those in the range 128 <= key_len <= 256 are given in bits */

-

-#if defined( AES_ENCRYPT )

-

-#if defined(AES_128) || defined(AES_VAR)

-AES_RETURN aes_encrypt_key128(const unsigned char *key, aes_encrypt_ctx cx[1]);

-#endif

-

-#if defined(AES_192) || defined(AES_VAR)

-AES_RETURN aes_encrypt_key192(const unsigned char *key, aes_encrypt_ctx cx[1]);

-#endif

-

-#if defined(AES_256) || defined(AES_VAR)

-AES_RETURN aes_encrypt_key256(const unsigned char *key, aes_encrypt_ctx cx[1]);

-#endif

-

-#if defined(AES_VAR)

-AES_RETURN aes_encrypt_key(const unsigned char *key, int key_len, aes_encrypt_ctx cx[1]);

-#endif

-

-AES_RETURN aes_encrypt(const unsigned char *in, unsigned char *out, const aes_encrypt_ctx cx[1]);

-

-#endif

-

-#if defined( AES_DECRYPT )

-

-#if defined(AES_128) || defined(AES_VAR)

-AES_RETURN aes_decrypt_key128(const unsigned char *key, aes_decrypt_ctx cx[1]);

-#endif

-

-#if defined(AES_192) || defined(AES_VAR)

-AES_RETURN aes_decrypt_key192(const unsigned char *key, aes_decrypt_ctx cx[1]);

-#endif

-

-#if defined(AES_256) || defined(AES_VAR)

-AES_RETURN aes_decrypt_key256(const unsigned char *key, aes_decrypt_ctx cx[1]);

-#endif

-

-#if defined(AES_VAR)

-AES_RETURN aes_decrypt_key(const unsigned char *key, int key_len, aes_decrypt_ctx cx[1]);

-#endif

-

-AES_RETURN aes_decrypt(const unsigned char *in, unsigned char *out, const aes_decrypt_ctx cx[1]);

-

-#endif

-

-#if defined(AES_MODES)

-

-/* Multiple calls to the following subroutines for multiple block */

-/* ECB, CBC, CFB, OFB and CTR mode encryption can be used to handle */

-/* long messages incremantally provided that the context AND the iv */

-/* are preserved between all such calls. For the ECB and CBC modes */

-/* each individual call within a series of incremental calls must */

-/* process only full blocks (i.e. len must be a multiple of 16) but */

-/* the CFB, OFB and CTR mode calls can handle multiple incremental */

-/* calls of any length. Each mode is reset when a new AES key is */

-/* set but ECB and CBC operations can be reset without setting a */

-/* new key by setting a new IV value. To reset CFB, OFB and CTR */

-/* without setting the key, aes_mode_reset() must be called and the */

-/* IV must be set. NOTE: All these calls update the IV on exit so */

-/* this has to be reset if a new operation with the same IV as the */

-/* previous one is required (or decryption follows encryption with */

-/* the same IV array). */

-

-AES_RETURN aes_test_alignment_detection(unsigned int n);

-

-AES_RETURN aes_ecb_encrypt(const unsigned char *ibuf, unsigned char *obuf,

- int len, const aes_encrypt_ctx cx[1]);

-

-AES_RETURN aes_ecb_decrypt(const unsigned char *ibuf, unsigned char *obuf,

- int len, const aes_decrypt_ctx cx[1]);

-

-AES_RETURN aes_cbc_encrypt(const unsigned char *ibuf, unsigned char *obuf,

- int len, unsigned char *iv, const aes_encrypt_ctx cx[1]);

-

-AES_RETURN aes_cbc_decrypt(const unsigned char *ibuf, unsigned char *obuf,

- int len, unsigned char *iv, const aes_decrypt_ctx cx[1]);

-

-AES_RETURN aes_mode_reset(aes_encrypt_ctx cx[1]);

-

-AES_RETURN aes_cfb_encrypt(const unsigned char *ibuf, unsigned char *obuf,

- int len, unsigned char *iv, aes_encrypt_ctx cx[1]);

-

-AES_RETURN aes_cfb_decrypt(const unsigned char *ibuf, unsigned char *obuf,

- int len, unsigned char *iv, aes_encrypt_ctx cx[1]);

-

-#define aes_ofb_encrypt aes_ofb_crypt

-#define aes_ofb_decrypt aes_ofb_crypt

-

-AES_RETURN aes_ofb_crypt(const unsigned char *ibuf, unsigned char *obuf,

- int len, unsigned char *iv, aes_encrypt_ctx cx[1]);

-

-typedef void cbuf_inc(unsigned char *cbuf);

-

-#define aes_ctr_encrypt aes_ctr_crypt

-#define aes_ctr_decrypt aes_ctr_crypt

-

-AES_RETURN aes_ctr_crypt(const unsigned char *ibuf, unsigned char *obuf,

- int len, unsigned char *cbuf, cbuf_inc ctr_inc, aes_encrypt_ctx cx[1]);

-

-#endif

-

-#if defined(__cplusplus)

-}

-#endif

-

-#endif

-/*

- ---------------------------------------------------------------------------

- Copyright (c) 1998-2006, Brian Gladman, Worcester, UK. All rights reserved.

-

- LICENSE TERMS

-

- The free distribution and use of this software is allowed (with or without

- changes) provided that:

-

- 1. source code distributions include the above copyright notice, this

- list of conditions and the following disclaimer;

-

- 2. binary distributions include the above copyright notice, this list

- of conditions and the following disclaimer in their documentation;

-

- 3. the name of the copyright holder is not used to endorse products

- built using this software without specific written permission.

-

- DISCLAIMER

-

- This software is provided 'as is' with no explicit or implied warranties

- in respect of its properties, including, but not limited to, correctness

- and/or fitness for purpose.

- ---------------------------------------------------------------------------

- Issue 09/09/2006

-

- This is an AES implementation that uses only 8-bit byte operations on the

- cipher state (there are options to use 32-bit types if available).

-

- The combination of mix columns and byte substitution used here is based on

- that developed by Karl Malbrain. His contribution is acknowledged.

- */

-

-/* Adapted for TrueCrypt:

- - Macro-generated tables were replaced with static data to enable compiling

- with MSVC++ 1.5 which runs out of resources when expanding large macros.

-*/

-

-#pragma optimize ("t", on)

-

-/* define if you have a fast memcpy function on your system */

-#if 1

-# define HAVE_MEMCPY

-# include <string.h>

-# if defined( _MSC_VER )

-# ifndef DEBUG

-# pragma intrinsic( memcpy )

-# endif

-# endif

-#endif

-

-/* define if you have fast 32-bit types on your system */

-#if 1

-# define HAVE_UINT_32T

-#endif

-

-/* alternative versions (test for performance on your system) */

-#if 0

-# define VERSION_1

-#endif

-

-#include "AesSmall.h"

-

-#define WPOLY 0x011b

-#define DPOLY 0x008d

-#define f1(x) (x)

-#define f2(x) ((x<<1) ^ (((x>>7) & 1) * WPOLY))

-#define f4(x) ((x<<2) ^ (((x>>6) & 1) * WPOLY) ^ (((x>>6) & 2) * WPOLY))

-#define f8(x) ((x<<3) ^ (((x>>5) & 1) * WPOLY) ^ (((x>>5) & 2) * WPOLY) \

- ^ (((x>>5) & 4) * WPOLY))

-#define d2(x) (((x) >> 1) ^ ((x) & 1 ? DPOLY : 0))

-

-#define f3(x) (f2(x) ^ x)

-#define f9(x) (f8(x) ^ x)

-#define fb(x) (f8(x) ^ f2(x) ^ x)

-#define fd(x) (f8(x) ^ f4(x) ^ x)

-#define fe(x) (f8(x) ^ f4(x) ^ f2(x))

-

-static const uint_8t s_box[256] = {

- 0x63,0x7c,0x77,0x7b,0xf2,0x6b,0x6f,0xc5,

- 0x30,0x01,0x67,0x2b,0xfe,0xd7,0xab,0x76,

- 0xca,0x82,0xc9,0x7d,0xfa,0x59,0x47,0xf0,

- 0xad,0xd4,0xa2,0xaf,0x9c,0xa4,0x72,0xc0,

- 0xb7,0xfd,0x93,0x26,0x36,0x3f,0xf7,0xcc,

- 0x34,0xa5,0xe5,0xf1,0x71,0xd8,0x31,0x15,

- 0x04,0xc7,0x23,0xc3,0x18,0x96,0x05,0x9a,

- 0x07,0x12,0x80,0xe2,0xeb,0x27,0xb2,0x75,

- 0x09,0x83,0x2c,0x1a,0x1b,0x6e,0x5a,0xa0,

- 0x52,0x3b,0xd6,0xb3,0x29,0xe3,0x2f,0x84,

- 0x53,0xd1,0x00,0xed,0x20,0xfc,0xb1,0x5b,

- 0x6a,0xcb,0xbe,0x39,0x4a,0x4c,0x58,0xcf,

- 0xd0,0xef,0xaa,0xfb,0x43,0x4d,0x33,0x85,

- 0x45,0xf9,0x02,0x7f,0x50,0x3c,0x9f,0xa8,

- 0x51,0xa3,0x40,0x8f,0x92,0x9d,0x38,0xf5,

- 0xbc,0xb6,0xda,0x21,0x10,0xff,0xf3,0xd2,

- 0xcd,0x0c,0x13,0xec,0x5f,0x97,0x44,0x17,

- 0xc4,0xa7,0x7e,0x3d,0x64,0x5d,0x19,0x73,

- 0x60,0x81,0x4f,0xdc,0x22,0x2a,0x90,0x88,

- 0x46,0xee,0xb8,0x14,0xde,0x5e,0x0b,0xdb,

- 0xe0,0x32,0x3a,0x0a,0x49,0x06,0x24,0x5c,

- 0xc2,0xd3,0xac,0x62,0x91,0x95,0xe4,0x79,

- 0xe7,0xc8,0x37,0x6d,0x8d,0xd5,0x4e,0xa9,

- 0x6c,0x56,0xf4,0xea,0x65,0x7a,0xae,0x08,

- 0xba,0x78,0x25,0x2e,0x1c,0xa6,0xb4,0xc6,

- 0xe8,0xdd,0x74,0x1f,0x4b,0xbd,0x8b,0x8a,

- 0x70,0x3e,0xb5,0x66,0x48,0x03,0xf6,0x0e,

- 0x61,0x35,0x57,0xb9,0x86,0xc1,0x1d,0x9e,

- 0xe1,0xf8,0x98,0x11,0x69,0xd9,0x8e,0x94,

- 0x9b,0x1e,0x87,0xe9,0xce,0x55,0x28,0xdf,

- 0x8c,0xa1,0x89,0x0d,0xbf,0xe6,0x42,0x68,

- 0x41,0x99,0x2d,0x0f,0xb0,0x54,0xbb,0x16

-};

-

-static const uint_8t inv_s_box[256] = {

- 0x52,0x09,0x6a,0xd5,0x30,0x36,0xa5,0x38,

- 0xbf,0x40,0xa3,0x9e,0x81,0xf3,0xd7,0xfb,

- 0x7c,0xe3,0x39,0x82,0x9b,0x2f,0xff,0x87,

- 0x34,0x8e,0x43,0x44,0xc4,0xde,0xe9,0xcb,

- 0x54,0x7b,0x94,0x32,0xa6,0xc2,0x23,0x3d,

- 0xee,0x4c,0x95,0x0b,0x42,0xfa,0xc3,0x4e,

- 0x08,0x2e,0xa1,0x66,0x28,0xd9,0x24,0xb2,

- 0x76,0x5b,0xa2,0x49,0x6d,0x8b,0xd1,0x25,

- 0x72,0xf8,0xf6,0x64,0x86,0x68,0x98,0x16,

- 0xd4,0xa4,0x5c,0xcc,0x5d,0x65,0xb6,0x92,

- 0x6c,0x70,0x48,0x50,0xfd,0xed,0xb9,0xda,

- 0x5e,0x15,0x46,0x57,0xa7,0x8d,0x9d,0x84,

- 0x90,0xd8,0xab,0x00,0x8c,0xbc,0xd3,0x0a,

- 0xf7,0xe4,0x58,0x05,0xb8,0xb3,0x45,0x06,

- 0xd0,0x2c,0x1e,0x8f,0xca,0x3f,0x0f,0x02,

- 0xc1,0xaf,0xbd,0x03,0x01,0x13,0x8a,0x6b,

- 0x3a,0x91,0x11,0x41,0x4f,0x67,0xdc,0xea,

- 0x97,0xf2,0xcf,0xce,0xf0,0xb4,0xe6,0x73,

- 0x96,0xac,0x74,0x22,0xe7,0xad,0x35,0x85,

- 0xe2,0xf9,0x37,0xe8,0x1c,0x75,0xdf,0x6e,

- 0x47,0xf1,0x1a,0x71,0x1d,0x29,0xc5,0x89,

- 0x6f,0xb7,0x62,0x0e,0xaa,0x18,0xbe,0x1b,

- 0xfc,0x56,0x3e,0x4b,0xc6,0xd2,0x79,0x20,

- 0x9a,0xdb,0xc0,0xfe,0x78,0xcd,0x5a,0xf4,

- 0x1f,0xdd,0xa8,0x33,0x88,0x07,0xc7,0x31,

- 0xb1,0x12,0x10,0x59,0x27,0x80,0xec,0x5f,

- 0x60,0x51,0x7f,0xa9,0x19,0xb5,0x4a,0x0d,

- 0x2d,0xe5,0x7a,0x9f,0x93,0xc9,0x9c,0xef,

- 0xa0,0xe0,0x3b,0x4d,0xae,0x2a,0xf5,0xb0,

- 0xc8,0xeb,0xbb,0x3c,0x83,0x53,0x99,0x61,

- 0x17,0x2b,0x04,0x7e,0xba,0x77,0xd6,0x26,

- 0xe1,0x69,0x14,0x63,0x55,0x21,0x0c,0x7d

-};

-

-static const uint_8t gfm2_s_box[256] = {

- 0xc6,0xf8,0xee,0xf6,0xff,0xd6,0xde,0x91,

- 0x60,0x02,0xce,0x56,0xe7,0xb5,0x4d,0xec,

- 0x8f,0x1f,0x89,0xfa,0xef,0xb2,0x8e,0xfb,

- 0x41,0xb3,0x5f,0x45,0x23,0x53,0xe4,0x9b,

- 0x75,0xe1,0x3d,0x4c,0x6c,0x7e,0xf5,0x83,

- 0x68,0x51,0xd1,0xf9,0xe2,0xab,0x62,0x2a,

- 0x08,0x95,0x46,0x9d,0x30,0x37,0x0a,0x2f,

- 0x0e,0x24,0x1b,0xdf,0xcd,0x4e,0x7f,0xea,

- 0x12,0x1d,0x58,0x34,0x36,0xdc,0xb4,0x5b,

- 0xa4,0x76,0xb7,0x7d,0x52,0xdd,0x5e,0x13,

- 0xa6,0xb9,0x00,0xc1,0x40,0xe3,0x79,0xb6,

- 0xd4,0x8d,0x67,0x72,0x94,0x98,0xb0,0x85,

- 0xbb,0xc5,0x4f,0xed,0x86,0x9a,0x66,0x11,

- 0x8a,0xe9,0x04,0xfe,0xa0,0x78,0x25,0x4b,

- 0xa2,0x5d,0x80,0x05,0x3f,0x21,0x70,0xf1,

- 0x63,0x77,0xaf,0x42,0x20,0xe5,0xfd,0xbf,

- 0x81,0x18,0x26,0xc3,0xbe,0x35,0x88,0x2e,

- 0x93,0x55,0xfc,0x7a,0xc8,0xba,0x32,0xe6,

- 0xc0,0x19,0x9e,0xa3,0x44,0x54,0x3b,0x0b,

- 0x8c,0xc7,0x6b,0x28,0xa7,0xbc,0x16,0xad,

- 0xdb,0x64,0x74,0x14,0x92,0x0c,0x48,0xb8,

- 0x9f,0xbd,0x43,0xc4,0x39,0x31,0xd3,0xf2,

- 0xd5,0x8b,0x6e,0xda,0x01,0xb1,0x9c,0x49,

- 0xd8,0xac,0xf3,0xcf,0xca,0xf4,0x47,0x10,

- 0x6f,0xf0,0x4a,0x5c,0x38,0x57,0x73,0x97,

- 0xcb,0xa1,0xe8,0x3e,0x96,0x61,0x0d,0x0f,

- 0xe0,0x7c,0x71,0xcc,0x90,0x06,0xf7,0x1c,

- 0xc2,0x6a,0xae,0x69,0x17,0x99,0x3a,0x27,

- 0xd9,0xeb,0x2b,0x22,0xd2,0xa9,0x07,0x33,

- 0x2d,0x3c,0x15,0xc9,0x87,0xaa,0x50,0xa5,

- 0x03,0x59,0x09,0x1a,0x65,0xd7,0x84,0xd0,

- 0x82,0x29,0x5a,0x1e,0x7b,0xa8,0x6d,0x2c

-};

-

-static const uint_8t gfm3_s_box[256] = {

- 0xa5,0x84,0x99,0x8d,0x0d,0xbd,0xb1,0x54,

- 0x50,0x03,0xa9,0x7d,0x19,0x62,0xe6,0x9a,

- 0x45,0x9d,0x40,0x87,0x15,0xeb,0xc9,0x0b,

- 0xec,0x67,0xfd,0xea,0xbf,0xf7,0x96,0x5b,

- 0xc2,0x1c,0xae,0x6a,0x5a,0x41,0x02,0x4f,

- 0x5c,0xf4,0x34,0x08,0x93,0x73,0x53,0x3f,

- 0x0c,0x52,0x65,0x5e,0x28,0xa1,0x0f,0xb5,

- 0x09,0x36,0x9b,0x3d,0x26,0x69,0xcd,0x9f,

- 0x1b,0x9e,0x74,0x2e,0x2d,0xb2,0xee,0xfb,

- 0xf6,0x4d,0x61,0xce,0x7b,0x3e,0x71,0x97,

- 0xf5,0x68,0x00,0x2c,0x60,0x1f,0xc8,0xed,

- 0xbe,0x46,0xd9,0x4b,0xde,0xd4,0xe8,0x4a,

- 0x6b,0x2a,0xe5,0x16,0xc5,0xd7,0x55,0x94,

- 0xcf,0x10,0x06,0x81,0xf0,0x44,0xba,0xe3,

- 0xf3,0xfe,0xc0,0x8a,0xad,0xbc,0x48,0x04,

- 0xdf,0xc1,0x75,0x63,0x30,0x1a,0x0e,0x6d,

- 0x4c,0x14,0x35,0x2f,0xe1,0xa2,0xcc,0x39,

- 0x57,0xf2,0x82,0x47,0xac,0xe7,0x2b,0x95,

- 0xa0,0x98,0xd1,0x7f,0x66,0x7e,0xab,0x83,

- 0xca,0x29,0xd3,0x3c,0x79,0xe2,0x1d,0x76,

- 0x3b,0x56,0x4e,0x1e,0xdb,0x0a,0x6c,0xe4,

- 0x5d,0x6e,0xef,0xa6,0xa8,0xa4,0x37,0x8b,

- 0x32,0x43,0x59,0xb7,0x8c,0x64,0xd2,0xe0,

- 0xb4,0xfa,0x07,0x25,0xaf,0x8e,0xe9,0x18,

- 0xd5,0x88,0x6f,0x72,0x24,0xf1,0xc7,0x51,

- 0x23,0x7c,0x9c,0x21,0xdd,0xdc,0x86,0x85,

- 0x90,0x42,0xc4,0xaa,0xd8,0x05,0x01,0x12,

- 0xa3,0x5f,0xf9,0xd0,0x91,0x58,0x27,0xb9,

- 0x38,0x13,0xb3,0x33,0xbb,0x70,0x89,0xa7,

- 0xb6,0x22,0x92,0x20,0x49,0xff,0x78,0x7a,

- 0x8f,0xf8,0x80,0x17,0xda,0x31,0xc6,0xb8,

- 0xc3,0xb0,0x77,0x11,0xcb,0xfc,0xd6,0x3a

-};

-

-static const uint_8t gfmul_9[256] = {

- 0x00,0x09,0x12,0x1b,0x24,0x2d,0x36,0x3f,

- 0x48,0x41,0x5a,0x53,0x6c,0x65,0x7e,0x77,

- 0x90,0x99,0x82,0x8b,0xb4,0xbd,0xa6,0xaf,

- 0xd8,0xd1,0xca,0xc3,0xfc,0xf5,0xee,0xe7,

- 0x3b,0x32,0x29,0x20,0x1f,0x16,0x0d,0x04,

- 0x73,0x7a,0x61,0x68,0x57,0x5e,0x45,0x4c,

- 0xab,0xa2,0xb9,0xb0,0x8f,0x86,0x9d,0x94,

- 0xe3,0xea,0xf1,0xf8,0xc7,0xce,0xd5,0xdc,

- 0x76,0x7f,0x64,0x6d,0x52,0x5b,0x40,0x49,

- 0x3e,0x37,0x2c,0x25,0x1a,0x13,0x08,0x01,

- 0xe6,0xef,0xf4,0xfd,0xc2,0xcb,0xd0,0xd9,

- 0xae,0xa7,0xbc,0xb5,0x8a,0x83,0x98,0x91,

- 0x4d,0x44,0x5f,0x56,0x69,0x60,0x7b,0x72,

- 0x05,0x0c,0x17,0x1e,0x21,0x28,0x33,0x3a,

- 0xdd,0xd4,0xcf,0xc6,0xf9,0xf0,0xeb,0xe2,

- 0x95,0x9c,0x87,0x8e,0xb1,0xb8,0xa3,0xaa,

- 0xec,0xe5,0xfe,0xf7,0xc8,0xc1,0xda,0xd3,

- 0xa4,0xad,0xb6,0xbf,0x80,0x89,0x92,0x9b,

- 0x7c,0x75,0x6e,0x67,0x58,0x51,0x4a,0x43,

- 0x34,0x3d,0x26,0x2f,0x10,0x19,0x02,0x0b,

- 0xd7,0xde,0xc5,0xcc,0xf3,0xfa,0xe1,0xe8,

- 0x9f,0x96,0x8d,0x84,0xbb,0xb2,0xa9,0xa0,

- 0x47,0x4e,0x55,0x5c,0x63,0x6a,0x71,0x78,

- 0x0f,0x06,0x1d,0x14,0x2b,0x22,0x39,0x30,

- 0x9a,0x93,0x88,0x81,0xbe,0xb7,0xac,0xa5,

- 0xd2,0xdb,0xc0,0xc9,0xf6,0xff,0xe4,0xed,

- 0x0a,0x03,0x18,0x11,0x2e,0x27,0x3c,0x35,

- 0x42,0x4b,0x50,0x59,0x66,0x6f,0x74,0x7d,

- 0xa1,0xa8,0xb3,0xba,0x85,0x8c,0x97,0x9e,

- 0xe9,0xe0,0xfb,0xf2,0xcd,0xc4,0xdf,0xd6,

- 0x31,0x38,0x23,0x2a,0x15,0x1c,0x07,0x0e,

- 0x79,0x70,0x6b,0x62,0x5d,0x54,0x4f,0x46

-};

-

-static const uint_8t gfmul_b[256] = {

- 0x00,0x0b,0x16,0x1d,0x2c,0x27,0x3a,0x31,

- 0x58,0x53,0x4e,0x45,0x74,0x7f,0x62,0x69,

- 0xb0,0xbb,0xa6,0xad,0x9c,0x97,0x8a,0x81,

- 0xe8,0xe3,0xfe,0xf5,0xc4,0xcf,0xd2,0xd9,

- 0x7b,0x70,0x6d,0x66,0x57,0x5c,0x41,0x4a,

- 0x23,0x28,0x35,0x3e,0x0f,0x04,0x19,0x12,

- 0xcb,0xc0,0xdd,0xd6,0xe7,0xec,0xf1,0xfa,

- 0x93,0x98,0x85,0x8e,0xbf,0xb4,0xa9,0xa2,

- 0xf6,0xfd,0xe0,0xeb,0xda,0xd1,0xcc,0xc7,

- 0xae,0xa5,0xb8,0xb3,0x82,0x89,0x94,0x9f,

- 0x46,0x4d,0x50,0x5b,0x6a,0x61,0x7c,0x77,

- 0x1e,0x15,0x08,0x03,0x32,0x39,0x24,0x2f,

- 0x8d,0x86,0x9b,0x90,0xa1,0xaa,0xb7,0xbc,

- 0xd5,0xde,0xc3,0xc8,0xf9,0xf2,0xef,0xe4,

- 0x3d,0x36,0x2b,0x20,0x11,0x1a,0x07,0x0c,

- 0x65,0x6e,0x73,0x78,0x49,0x42,0x5f,0x54,

- 0xf7,0xfc,0xe1,0xea,0xdb,0xd0,0xcd,0xc6,

- 0xaf,0xa4,0xb9,0xb2,0x83,0x88,0x95,0x9e,

- 0x47,0x4c,0x51,0x5a,0x6b,0x60,0x7d,0x76,

- 0x1f,0x14,0x09,0x02,0x33,0x38,0x25,0x2e,

- 0x8c,0x87,0x9a,0x91,0xa0,0xab,0xb6,0xbd,

- 0xd4,0xdf,0xc2,0xc9,0xf8,0xf3,0xee,0xe5,

- 0x3c,0x37,0x2a,0x21,0x10,0x1b,0x06,0x0d,

- 0x64,0x6f,0x72,0x79,0x48,0x43,0x5e,0x55,

- 0x01,0x0a,0x17,0x1c,0x2d,0x26,0x3b,0x30,

- 0x59,0x52,0x4f,0x44,0x75,0x7e,0x63,0x68,

- 0xb1,0xba,0xa7,0xac,0x9d,0x96,0x8b,0x80,

- 0xe9,0xe2,0xff,0xf4,0xc5,0xce,0xd3,0xd8,

- 0x7a,0x71,0x6c,0x67,0x56,0x5d,0x40,0x4b,

- 0x22,0x29,0x34,0x3f,0x0e,0x05,0x18,0x13,

- 0xca,0xc1,0xdc,0xd7,0xe6,0xed,0xf0,0xfb,

- 0x92,0x99,0x84,0x8f,0xbe,0xb5,0xa8,0xa3

-};

-

-static const uint_8t gfmul_d[256] = {

- 0x00,0x0d,0x1a,0x17,0x34,0x39,0x2e,0x23,

- 0x68,0x65,0x72,0x7f,0x5c,0x51,0x46,0x4b,

- 0xd0,0xdd,0xca,0xc7,0xe4,0xe9,0xfe,0xf3,

- 0xb8,0xb5,0xa2,0xaf,0x8c,0x81,0x96,0x9b,

- 0xbb,0xb6,0xa1,0xac,0x8f,0x82,0x95,0x98,

- 0xd3,0xde,0xc9,0xc4,0xe7,0xea,0xfd,0xf0,

- 0x6b,0x66,0x71,0x7c,0x5f,0x52,0x45,0x48,

- 0x03,0x0e,0x19,0x14,0x37,0x3a,0x2d,0x20,

- 0x6d,0x60,0x77,0x7a,0x59,0x54,0x43,0x4e,

- 0x05,0x08,0x1f,0x12,0x31,0x3c,0x2b,0x26,

- 0xbd,0xb0,0xa7,0xaa,0x89,0x84,0x93,0x9e,

- 0xd5,0xd8,0xcf,0xc2,0xe1,0xec,0xfb,0xf6,

- 0xd6,0xdb,0xcc,0xc1,0xe2,0xef,0xf8,0xf5,

- 0xbe,0xb3,0xa4,0xa9,0x8a,0x87,0x90,0x9d,

- 0x06,0x0b,0x1c,0x11,0x32,0x3f,0x28,0x25,

- 0x6e,0x63,0x74,0x79,0x5a,0x57,0x40,0x4d,

- 0xda,0xd7,0xc0,0xcd,0xee,0xe3,0xf4,0xf9,

- 0xb2,0xbf,0xa8,0xa5,0x86,0x8b,0x9c,0x91,

- 0x0a,0x07,0x10,0x1d,0x3e,0x33,0x24,0x29,

- 0x62,0x6f,0x78,0x75,0x56,0x5b,0x4c,0x41,

- 0x61,0x6c,0x7b,0x76,0x55,0x58,0x4f,0x42,

- 0x09,0x04,0x13,0x1e,0x3d,0x30,0x27,0x2a,

- 0xb1,0xbc,0xab,0xa6,0x85,0x88,0x9f,0x92,

- 0xd9,0xd4,0xc3,0xce,0xed,0xe0,0xf7,0xfa,

- 0xb7,0xba,0xad,0xa0,0x83,0x8e,0x99,0x94,

- 0xdf,0xd2,0xc5,0xc8,0xeb,0xe6,0xf1,0xfc,

- 0x67,0x6a,0x7d,0x70,0x53,0x5e,0x49,0x44,

- 0x0f,0x02,0x15,0x18,0x3b,0x36,0x21,0x2c,

- 0x0c,0x01,0x16,0x1b,0x38,0x35,0x22,0x2f,

- 0x64,0x69,0x7e,0x73,0x50,0x5d,0x4a,0x47,

- 0xdc,0xd1,0xc6,0xcb,0xe8,0xe5,0xf2,0xff,

- 0xb4,0xb9,0xae,0xa3,0x80,0x8d,0x9a,0x97

-};

-

-static const uint_8t gfmul_e[256] = {

- 0x00,0x0e,0x1c,0x12,0x38,0x36,0x24,0x2a,

- 0x70,0x7e,0x6c,0x62,0x48,0x46,0x54,0x5a,

- 0xe0,0xee,0xfc,0xf2,0xd8,0xd6,0xc4,0xca,

- 0x90,0x9e,0x8c,0x82,0xa8,0xa6,0xb4,0xba,

- 0xdb,0xd5,0xc7,0xc9,0xe3,0xed,0xff,0xf1,

- 0xab,0xa5,0xb7,0xb9,0x93,0x9d,0x8f,0x81,

- 0x3b,0x35,0x27,0x29,0x03,0x0d,0x1f,0x11,

- 0x4b,0x45,0x57,0x59,0x73,0x7d,0x6f,0x61,

- 0xad,0xa3,0xb1,0xbf,0x95,0x9b,0x89,0x87,

- 0xdd,0xd3,0xc1,0xcf,0xe5,0xeb,0xf9,0xf7,

- 0x4d,0x43,0x51,0x5f,0x75,0x7b,0x69,0x67,

- 0x3d,0x33,0x21,0x2f,0x05,0x0b,0x19,0x17,

- 0x76,0x78,0x6a,0x64,0x4e,0x40,0x52,0x5c,

- 0x06,0x08,0x1a,0x14,0x3e,0x30,0x22,0x2c,

- 0x96,0x98,0x8a,0x84,0xae,0xa0,0xb2,0xbc,

- 0xe6,0xe8,0xfa,0xf4,0xde,0xd0,0xc2,0xcc,

- 0x41,0x4f,0x5d,0x53,0x79,0x77,0x65,0x6b,

- 0x31,0x3f,0x2d,0x23,0x09,0x07,0x15,0x1b,

- 0xa1,0xaf,0xbd,0xb3,0x99,0x97,0x85,0x8b,

- 0xd1,0xdf,0xcd,0xc3,0xe9,0xe7,0xf5,0xfb,

- 0x9a,0x94,0x86,0x88,0xa2,0xac,0xbe,0xb0,

- 0xea,0xe4,0xf6,0xf8,0xd2,0xdc,0xce,0xc0,

- 0x7a,0x74,0x66,0x68,0x42,0x4c,0x5e,0x50,

- 0x0a,0x04,0x16,0x18,0x32,0x3c,0x2e,0x20,

- 0xec,0xe2,0xf0,0xfe,0xd4,0xda,0xc8,0xc6,

- 0x9c,0x92,0x80,0x8e,0xa4,0xaa,0xb8,0xb6,

- 0x0c,0x02,0x10,0x1e,0x34,0x3a,0x28,0x26,

- 0x7c,0x72,0x60,0x6e,0x44,0x4a,0x58,0x56,

- 0x37,0x39,0x2b,0x25,0x0f,0x01,0x13,0x1d,

- 0x47,0x49,0x5b,0x55,0x7f,0x71,0x63,0x6d,

- 0xd7,0xd9,0xcb,0xc5,0xef,0xe1,0xf3,0xfd,

- 0xa7,0xa9,0xbb,0xb5,0x9f,0x91,0x83,0x8d

-};

-

-#if defined( HAVE_UINT_32T )

- typedef unsigned long uint_32t;

-#endif

-

-#if defined( HAVE_MEMCPY )

-# define block_copy(d, s, l) memcpy(d, s, l)

-# define block16_copy(d, s) memcpy(d, s, N_BLOCK)

-#else

-# define block_copy(d, s, l) copy_block(d, s, l)

-# define block16_copy(d, s) copy_block16(d, s)

-#endif

-

-/* block size 'nn' must be a multiple of four */

-

-static void copy_block16( void *d, const void *s )

-{

-#if defined( HAVE_UINT_32T )

- ((uint_32t*)d)[ 0] = ((uint_32t*)s)[ 0];

- ((uint_32t*)d)[ 1] = ((uint_32t*)s)[ 1];

- ((uint_32t*)d)[ 2] = ((uint_32t*)s)[ 2];

- ((uint_32t*)d)[ 3] = ((uint_32t*)s)[ 3];

-#else

- ((uint_8t*)d)[ 0] = ((uint_8t*)s)[ 0];

- ((uint_8t*)d)[ 1] = ((uint_8t*)s)[ 1];

- ((uint_8t*)d)[ 2] = ((uint_8t*)s)[ 2];

- ((uint_8t*)d)[ 3] = ((uint_8t*)s)[ 3];

- ((uint_8t*)d)[ 4] = ((uint_8t*)s)[ 4];

- ((uint_8t*)d)[ 5] = ((uint_8t*)s)[ 5];

- ((uint_8t*)d)[ 6] = ((uint_8t*)s)[ 6];

- ((uint_8t*)d)[ 7] = ((uint_8t*)s)[ 7];

- ((uint_8t*)d)[ 8] = ((uint_8t*)s)[ 8];

- ((uint_8t*)d)[ 9] = ((uint_8t*)s)[ 9];

- ((uint_8t*)d)[10] = ((uint_8t*)s)[10];

- ((uint_8t*)d)[11] = ((uint_8t*)s)[11];

- ((uint_8t*)d)[12] = ((uint_8t*)s)[12];

- ((uint_8t*)d)[13] = ((uint_8t*)s)[13];

- ((uint_8t*)d)[14] = ((uint_8t*)s)[14];

- ((uint_8t*)d)[15] = ((uint_8t*)s)[15];

-#endif

-}

-

-static void copy_block( void * d, void *s, uint_8t nn )

-{

- while( nn-- )

- *((uint_8t*)d)++ = *((uint_8t*)s)++;

-}

-

-static void xor_block( void *d, const void *s )

-{

-#if defined( HAVE_UINT_32T )

- ((uint_32t*)d)[ 0] ^= ((uint_32t*)s)[ 0];

- ((uint_32t*)d)[ 1] ^= ((uint_32t*)s)[ 1];

- ((uint_32t*)d)[ 2] ^= ((uint_32t*)s)[ 2];

- ((uint_32t*)d)[ 3] ^= ((uint_32t*)s)[ 3];

-#else

- ((uint_8t*)d)[ 0] ^= ((uint_8t*)s)[ 0];

- ((uint_8t*)d)[ 1] ^= ((uint_8t*)s)[ 1];

- ((uint_8t*)d)[ 2] ^= ((uint_8t*)s)[ 2];

- ((uint_8t*)d)[ 3] ^= ((uint_8t*)s)[ 3];

- ((uint_8t*)d)[ 4] ^= ((uint_8t*)s)[ 4];

- ((uint_8t*)d)[ 5] ^= ((uint_8t*)s)[ 5];

- ((uint_8t*)d)[ 6] ^= ((uint_8t*)s)[ 6];

- ((uint_8t*)d)[ 7] ^= ((uint_8t*)s)[ 7];

- ((uint_8t*)d)[ 8] ^= ((uint_8t*)s)[ 8];

- ((uint_8t*)d)[ 9] ^= ((uint_8t*)s)[ 9];

- ((uint_8t*)d)[10] ^= ((uint_8t*)s)[10];

- ((uint_8t*)d)[11] ^= ((uint_8t*)s)[11];

- ((uint_8t*)d)[12] ^= ((uint_8t*)s)[12];

- ((uint_8t*)d)[13] ^= ((uint_8t*)s)[13];

- ((uint_8t*)d)[14] ^= ((uint_8t*)s)[14];

- ((uint_8t*)d)[15] ^= ((uint_8t*)s)[15];

-#endif

-}

-

-static void copy_and_key( void *d, const void *s, const void *k )

-{

-#if defined( HAVE_UINT_32T )

- ((uint_32t*)d)[ 0] = ((uint_32t*)s)[ 0] ^ ((uint_32t*)k)[ 0];

- ((uint_32t*)d)[ 1] = ((uint_32t*)s)[ 1] ^ ((uint_32t*)k)[ 1];

- ((uint_32t*)d)[ 2] = ((uint_32t*)s)[ 2] ^ ((uint_32t*)k)[ 2];

- ((uint_32t*)d)[ 3] = ((uint_32t*)s)[ 3] ^ ((uint_32t*)k)[ 3];

-#elif 1

- ((uint_8t*)d)[ 0] = ((uint_8t*)s)[ 0] ^ ((uint_8t*)k)[ 0];

- ((uint_8t*)d)[ 1] = ((uint_8t*)s)[ 1] ^ ((uint_8t*)k)[ 1];

- ((uint_8t*)d)[ 2] = ((uint_8t*)s)[ 2] ^ ((uint_8t*)k)[ 2];

- ((uint_8t*)d)[ 3] = ((uint_8t*)s)[ 3] ^ ((uint_8t*)k)[ 3];

- ((uint_8t*)d)[ 4] = ((uint_8t*)s)[ 4] ^ ((uint_8t*)k)[ 4];

- ((uint_8t*)d)[ 5] = ((uint_8t*)s)[ 5] ^ ((uint_8t*)k)[ 5];

- ((uint_8t*)d)[ 6] = ((uint_8t*)s)[ 6] ^ ((uint_8t*)k)[ 6];

- ((uint_8t*)d)[ 7] = ((uint_8t*)s)[ 7] ^ ((uint_8t*)k)[ 7];

- ((uint_8t*)d)[ 8] = ((uint_8t*)s)[ 8] ^ ((uint_8t*)k)[ 8];

- ((uint_8t*)d)[ 9] = ((uint_8t*)s)[ 9] ^ ((uint_8t*)k)[ 9];

- ((uint_8t*)d)[10] = ((uint_8t*)s)[10] ^ ((uint_8t*)k)[10];

- ((uint_8t*)d)[11] = ((uint_8t*)s)[11] ^ ((uint_8t*)k)[11];

- ((uint_8t*)d)[12] = ((uint_8t*)s)[12] ^ ((uint_8t*)k)[12];

- ((uint_8t*)d)[13] = ((uint_8t*)s)[13] ^ ((uint_8t*)k)[13];

- ((uint_8t*)d)[14] = ((uint_8t*)s)[14] ^ ((uint_8t*)k)[14];

- ((uint_8t*)d)[15] = ((uint_8t*)s)[15] ^ ((uint_8t*)k)[15];

-#else

- block16_copy(d, s);

- xor_block(d, k);

-#endif

-}

-

-static void add_round_key( uint_8t d[N_BLOCK], const uint_8t k[N_BLOCK] )

-{

- xor_block(d, k);

-}

-

-static void shift_sub_rows( uint_8t st[N_BLOCK] )

-{ uint_8t tt;

-

- st[ 0] = s_box[st[ 0]]; st[ 4] = s_box[st[ 4]];

- st[ 8] = s_box[st[ 8]]; st[12] = s_box[st[12]];

-

- tt = st[1]; st[ 1] = s_box[st[ 5]]; st[ 5] = s_box[st[ 9]];

- st[ 9] = s_box[st[13]]; st[13] = s_box[ tt ];

-

- tt = st[2]; st[ 2] = s_box[st[10]]; st[10] = s_box[ tt ];

- tt = st[6]; st[ 6] = s_box[st[14]]; st[14] = s_box[ tt ];

-

- tt = st[15]; st[15] = s_box[st[11]]; st[11] = s_box[st[ 7]];

- st[ 7] = s_box[st[ 3]]; st[ 3] = s_box[ tt ];

-}

-

-static void inv_shift_sub_rows( uint_8t st[N_BLOCK] )

-{ uint_8t tt;

-

- st[ 0] = inv_s_box[st[ 0]]; st[ 4] = inv_s_box[st[ 4]];

- st[ 8] = inv_s_box[st[ 8]]; st[12] = inv_s_box[st[12]];

-

- tt = st[13]; st[13] = inv_s_box[st[9]]; st[ 9] = inv_s_box[st[5]];

- st[ 5] = inv_s_box[st[1]]; st[ 1] = inv_s_box[ tt ];

-

- tt = st[2]; st[ 2] = inv_s_box[st[10]]; st[10] = inv_s_box[ tt ];

- tt = st[6]; st[ 6] = inv_s_box[st[14]]; st[14] = inv_s_box[ tt ];

-

- tt = st[3]; st[ 3] = inv_s_box[st[ 7]]; st[ 7] = inv_s_box[st[11]];

- st[11] = inv_s_box[st[15]]; st[15] = inv_s_box[ tt ];

-}

-

-#if defined( VERSION_1 )

- static void mix_sub_columns( uint_8t dt[N_BLOCK] )

- { uint_8t st[N_BLOCK];

- block16_copy(st, dt);

-#else

- static void mix_sub_columns( uint_8t dt[N_BLOCK], uint_8t st[N_BLOCK] )

- {

-#endif

- dt[ 0] = gfm2_s_box[st[0]] ^ gfm3_s_box[st[5]] ^ s_box[st[10]] ^ s_box[st[15]];

- dt[ 1] = s_box[st[0]] ^ gfm2_s_box[st[5]] ^ gfm3_s_box[st[10]] ^ s_box[st[15]];

- dt[ 2] = s_box[st[0]] ^ s_box[st[5]] ^ gfm2_s_box[st[10]] ^ gfm3_s_box[st[15]];

- dt[ 3] = gfm3_s_box[st[0]] ^ s_box[st[5]] ^ s_box[st[10]] ^ gfm2_s_box[st[15]];

-

- dt[ 4] = gfm2_s_box[st[4]] ^ gfm3_s_box[st[9]] ^ s_box[st[14]] ^ s_box[st[3]];

- dt[ 5] = s_box[st[4]] ^ gfm2_s_box[st[9]] ^ gfm3_s_box[st[14]] ^ s_box[st[3]];

- dt[ 6] = s_box[st[4]] ^ s_box[st[9]] ^ gfm2_s_box[st[14]] ^ gfm3_s_box[st[3]];

- dt[ 7] = gfm3_s_box[st[4]] ^ s_box[st[9]] ^ s_box[st[14]] ^ gfm2_s_box[st[3]];

-

- dt[ 8] = gfm2_s_box[st[8]] ^ gfm3_s_box[st[13]] ^ s_box[st[2]] ^ s_box[st[7]];

- dt[ 9] = s_box[st[8]] ^ gfm2_s_box[st[13]] ^ gfm3_s_box[st[2]] ^ s_box[st[7]];

- dt[10] = s_box[st[8]] ^ s_box[st[13]] ^ gfm2_s_box[st[2]] ^ gfm3_s_box[st[7]];

- dt[11] = gfm3_s_box[st[8]] ^ s_box[st[13]] ^ s_box[st[2]] ^ gfm2_s_box[st[7]];

-

- dt[12] = gfm2_s_box[st[12]] ^ gfm3_s_box[st[1]] ^ s_box[st[6]] ^ s_box[st[11]];

- dt[13] = s_box[st[12]] ^ gfm2_s_box[st[1]] ^ gfm3_s_box[st[6]] ^ s_box[st[11]];

- dt[14] = s_box[st[12]] ^ s_box[st[1]] ^ gfm2_s_box[st[6]] ^ gfm3_s_box[st[11]];

- dt[15] = gfm3_s_box[st[12]] ^ s_box[st[1]] ^ s_box[st[6]] ^ gfm2_s_box[st[11]];

- }

-

-#if defined( VERSION_1 )

- static void inv_mix_sub_columns( uint_8t dt[N_BLOCK] )

- { uint_8t st[N_BLOCK];

- block16_copy(st, dt);

-#else

- static void inv_mix_sub_columns( uint_8t dt[N_BLOCK], uint_8t st[N_BLOCK] )

- {

-#endif

- dt[ 0] = inv_s_box[gfmul_e[st[ 0]] ^ gfmul_b[st[ 1]] ^ gfmul_d[st[ 2]] ^ gfmul_9[st[ 3]]];

- dt[ 5] = inv_s_box[gfmul_9[st[ 0]] ^ gfmul_e[st[ 1]] ^ gfmul_b[st[ 2]] ^ gfmul_d[st[ 3]]];

- dt[10] = inv_s_box[gfmul_d[st[ 0]] ^ gfmul_9[st[ 1]] ^ gfmul_e[st[ 2]] ^ gfmul_b[st[ 3]]];

- dt[15] = inv_s_box[gfmul_b[st[ 0]] ^ gfmul_d[st[ 1]] ^ gfmul_9[st[ 2]] ^ gfmul_e[st[ 3]]];

-

- dt[ 4] = inv_s_box[gfmul_e[st[ 4]] ^ gfmul_b[st[ 5]] ^ gfmul_d[st[ 6]] ^ gfmul_9[st[ 7]]];

- dt[ 9] = inv_s_box[gfmul_9[st[ 4]] ^ gfmul_e[st[ 5]] ^ gfmul_b[st[ 6]] ^ gfmul_d[st[ 7]]];

- dt[14] = inv_s_box[gfmul_d[st[ 4]] ^ gfmul_9[st[ 5]] ^ gfmul_e[st[ 6]] ^ gfmul_b[st[ 7]]];

- dt[ 3] = inv_s_box[gfmul_b[st[ 4]] ^ gfmul_d[st[ 5]] ^ gfmul_9[st[ 6]] ^ gfmul_e[st[ 7]]];

-

- dt[ 8] = inv_s_box[gfmul_e[st[ 8]] ^ gfmul_b[st[ 9]] ^ gfmul_d[st[10]] ^ gfmul_9[st[11]]];

- dt[13] = inv_s_box[gfmul_9[st[ 8]] ^ gfmul_e[st[ 9]] ^ gfmul_b[st[10]] ^ gfmul_d[st[11]]];

- dt[ 2] = inv_s_box[gfmul_d[st[ 8]] ^ gfmul_9[st[ 9]] ^ gfmul_e[st[10]] ^ gfmul_b[st[11]]];

- dt[ 7] = inv_s_box[gfmul_b[st[ 8]] ^ gfmul_d[st[ 9]] ^ gfmul_9[st[10]] ^ gfmul_e[st[11]]];

-

- dt[12] = inv_s_box[gfmul_e[st[12]] ^ gfmul_b[st[13]] ^ gfmul_d[st[14]] ^ gfmul_9[st[15]]];

- dt[ 1] = inv_s_box[gfmul_9[st[12]] ^ gfmul_e[st[13]] ^ gfmul_b[st[14]] ^ gfmul_d[st[15]]];

- dt[ 6] = inv_s_box[gfmul_d[st[12]] ^ gfmul_9[st[13]] ^ gfmul_e[st[14]] ^ gfmul_b[st[15]]];

- dt[11] = inv_s_box[gfmul_b[st[12]] ^ gfmul_d[st[13]] ^ gfmul_9[st[14]] ^ gfmul_e[st[15]]];

- }

-

-#if defined( AES_ENC_PREKEYED ) || defined( AES_DEC_PREKEYED )

-

-/* Set the cipher key for the pre-keyed version */

-

-return_type aes_set_key( const unsigned char key[], length_type keylen, aes_context ctx[1] )

-{

- uint_8t cc, rc, hi;

-

- switch( keylen )

- {

- case 16:

- case 128:

- keylen = 16;

- break;

- case 24:

- case 192:

- keylen = 24;

- break;

- case 32:

- case 256:

- keylen = 32;

- break;

- default:

- ctx->rnd = 0;

- return (return_type) -1;

- }

- block_copy(ctx->ksch, key, keylen);

- hi = (keylen + 28) << 2;

- ctx->rnd = (hi >> 4) - 1;

- for( cc = keylen, rc = 1; cc < hi; cc += 4 )

- { uint_8t tt, t0, t1, t2, t3;

-

- t0 = ctx->ksch[cc - 4];

- t1 = ctx->ksch[cc - 3];

- t2 = ctx->ksch[cc - 2];

- t3 = ctx->ksch[cc - 1];

- if( cc % keylen == 0 )

- {

- tt = t0;

- t0 = s_box[t1] ^ rc;

- t1 = s_box[t2];

- t2 = s_box[t3];

- t3 = s_box[tt];

- rc = f2(rc);

- }

- else if( keylen > 24 && cc % keylen == 16 )

- {

- t0 = s_box[t0];

- t1 = s_box[t1];

- t2 = s_box[t2];

- t3 = s_box[t3];

- }

- tt = cc - keylen;

- ctx->ksch[cc + 0] = ctx->ksch[tt + 0] ^ t0;

- ctx->ksch[cc + 1] = ctx->ksch[tt + 1] ^ t1;

- ctx->ksch[cc + 2] = ctx->ksch[tt + 2] ^ t2;

- ctx->ksch[cc + 3] = ctx->ksch[tt + 3] ^ t3;

- }

- return 0;

-}

-

-#endif

-

-#if defined( AES_ENC_PREKEYED )

-

-/* Encrypt a single block of 16 bytes */

-

-return_type aes_encrypt( const unsigned char in[N_BLOCK], unsigned char out[N_BLOCK], const aes_context ctx[1] )

-{

- if( ctx->rnd )

- {

- uint_8t s1[N_BLOCK], r;

- copy_and_key( s1, in, ctx->ksch );

-

- for( r = 1 ; r < ctx->rnd ; ++r )

-#if defined( VERSION_1 )

- {

- mix_sub_columns( s1 );

- add_round_key( s1, ctx->ksch + r * N_BLOCK);

- }

-#else

- { uint_8t s2[N_BLOCK];

- mix_sub_columns( s2, s1 );

- copy_and_key( s1, s2, ctx->ksch + r * N_BLOCK);

- }

-#endif

- shift_sub_rows( s1 );

- copy_and_key( out, s1, ctx->ksch + r * N_BLOCK );

- }

- else

- return (return_type) -1;

- return 0;

-}

-

-#endif

-

-#if defined( AES_DEC_PREKEYED )

-

-/* Decrypt a single block of 16 bytes */

-

-return_type aes_decrypt( const unsigned char in[N_BLOCK], unsigned char out[N_BLOCK], const aes_context ctx[1] )

-{

- if( ctx->rnd )

- {

- uint_8t s1[N_BLOCK], r;

- copy_and_key( s1, in, ctx->ksch + ctx->rnd * N_BLOCK );

- inv_shift_sub_rows( s1 );

-

- for( r = ctx->rnd ; --r ; )

-#if defined( VERSION_1 )

- {

- add_round_key( s1, ctx->ksch + r * N_BLOCK );

- inv_mix_sub_columns( s1 );

- }

-#else

- { uint_8t s2[N_BLOCK];

- copy_and_key( s2, s1, ctx->ksch + r * N_BLOCK );

- inv_mix_sub_columns( s1, s2 );

- }

-#endif

- copy_and_key( out, s1, ctx->ksch );

- }

- else

- return (return_type) -1;

- return 0;

-}

-

-#endif

-

-#if defined( AES_ENC_128_OTFK )

-

-/* The 'on the fly' encryption key update for for 128 bit keys */

-

-static void update_encrypt_key_128( uint_8t k[N_BLOCK], uint_8t *rc )

-{ uint_8t cc;

-

- k[0] ^= s_box[k[13]] ^ *rc;

- k[1] ^= s_box[k[14]];

- k[2] ^= s_box[k[15]];

- k[3] ^= s_box[k[12]];

- *rc = f2( *rc );

-

- for(cc = 4; cc < 16; cc += 4 )

- {

- k[cc + 0] ^= k[cc - 4];

- k[cc + 1] ^= k[cc - 3];

- k[cc + 2] ^= k[cc - 2];

- k[cc + 3] ^= k[cc - 1];

- }

-}

-

-/* Encrypt a single block of 16 bytes with 'on the fly' 128 bit keying */

-

-void aes_encrypt_128( const unsigned char in[N_BLOCK], unsigned char out[N_BLOCK],

- const unsigned char key[N_BLOCK], unsigned char o_key[N_BLOCK] )

-{ uint_8t s1[N_BLOCK], r, rc = 1;

-

- if(o_key != key)

- block16_copy( o_key, key );

- copy_and_key( s1, in, o_key );

-

- for( r = 1 ; r < 10 ; ++r )

-#if defined( VERSION_1 )

- {

- mix_sub_columns( s1 );

- update_encrypt_key_128( o_key, &rc );

- add_round_key( s1, o_key );

- }

-#else

- { uint_8t s2[N_BLOCK];

- mix_sub_columns( s2, s1 );

- update_encrypt_key_128( o_key, &rc );

- copy_and_key( s1, s2, o_key );

- }

-#endif

-

- shift_sub_rows( s1 );

- update_encrypt_key_128( o_key, &rc );

- copy_and_key( out, s1, o_key );

-}

-

-#endif

-

-#if defined( AES_DEC_128_OTFK )

-

-/* The 'on the fly' decryption key update for for 128 bit keys */

-

-static void update_decrypt_key_128( uint_8t k[N_BLOCK], uint_8t *rc )

-{ uint_8t cc;

-

- for( cc = 12; cc > 0; cc -= 4 )

- {

- k[cc + 0] ^= k[cc - 4];

- k[cc + 1] ^= k[cc - 3];

- k[cc + 2] ^= k[cc - 2];

- k[cc + 3] ^= k[cc - 1];

- }

- *rc = d2(*rc);

- k[0] ^= s_box[k[13]] ^ *rc;

- k[1] ^= s_box[k[14]];

- k[2] ^= s_box[k[15]];

- k[3] ^= s_box[k[12]];

-}

-

-/* Decrypt a single block of 16 bytes with 'on the fly' 128 bit keying */

-

-void aes_decrypt_128( const unsigned char in[N_BLOCK], unsigned char out[N_BLOCK],

- const unsigned char key[N_BLOCK], unsigned char o_key[N_BLOCK] )

-{

- uint_8t s1[N_BLOCK], r, rc = 0x6c;

- if(o_key != key)

- block16_copy( o_key, key );

-

- copy_and_key( s1, in, o_key );

- inv_shift_sub_rows( s1 );

-

- for( r = 10 ; --r ; )

-#if defined( VERSION_1 )

- {

- update_decrypt_key_128( o_key, &rc );

- add_round_key( s1, o_key );

- inv_mix_sub_columns( s1 );

- }

-#else

- { uint_8t s2[N_BLOCK];

- update_decrypt_key_128( o_key, &rc );

- copy_and_key( s2, s1, o_key );

- inv_mix_sub_columns( s1, s2 );

- }

-#endif

- update_decrypt_key_128( o_key, &rc );

- copy_and_key( out, s1, o_key );

-}

-

-#endif

-

-#if defined( AES_ENC_256_OTFK )

-

-/* The 'on the fly' encryption key update for for 256 bit keys */

-

-static void update_encrypt_key_256( uint_8t k[2 * N_BLOCK], uint_8t *rc )

-{ uint_8t cc;

-

- k[0] ^= s_box[k[29]] ^ *rc;

- k[1] ^= s_box[k[30]];

- k[2] ^= s_box[k[31]];

- k[3] ^= s_box[k[28]];

- *rc = f2( *rc );

-

- for(cc = 4; cc < 16; cc += 4)

- {

- k[cc + 0] ^= k[cc - 4];

- k[cc + 1] ^= k[cc - 3];

- k[cc + 2] ^= k[cc - 2];

- k[cc + 3] ^= k[cc - 1];

- }

-

- k[16] ^= s_box[k[12]];

- k[17] ^= s_box[k[13]];

- k[18] ^= s_box[k[14]];

- k[19] ^= s_box[k[15]];

-

- for( cc = 20; cc < 32; cc += 4 )

- {

- k[cc + 0] ^= k[cc - 4];

- k[cc + 1] ^= k[cc - 3];

- k[cc + 2] ^= k[cc - 2];

- k[cc + 3] ^= k[cc - 1];

- }

-}

-

-/* Encrypt a single block of 16 bytes with 'on the fly' 256 bit keying */

-

-void aes_encrypt_256( const unsigned char in[N_BLOCK], unsigned char out[N_BLOCK],

- const unsigned char key[2 * N_BLOCK], unsigned char o_key[2 * N_BLOCK] )

-{

- uint_8t s1[N_BLOCK], r, rc = 1;

- if(o_key != key)

- {

- block16_copy( o_key, key );

- block16_copy( o_key + 16, key + 16 );

- }

- copy_and_key( s1, in, o_key );

-

- for( r = 1 ; r < 14 ; ++r )

-#if defined( VERSION_1 )

- {

- mix_sub_columns(s1);

- if( r & 1 )

- add_round_key( s1, o_key + 16 );

- else

- {

- update_encrypt_key_256( o_key, &rc );

- add_round_key( s1, o_key );

- }

- }

-#else

- { uint_8t s2[N_BLOCK];

- mix_sub_columns( s2, s1 );

- if( r & 1 )

- copy_and_key( s1, s2, o_key + 16 );

- else

- {

- update_encrypt_key_256( o_key, &rc );

- copy_and_key( s1, s2, o_key );

- }

- }

-#endif

-

- shift_sub_rows( s1 );

- update_encrypt_key_256( o_key, &rc );

- copy_and_key( out, s1, o_key );

-}

-

-#endif

-

-#if defined( AES_DEC_256_OTFK )

-

-/* The 'on the fly' encryption key update for for 256 bit keys */

-

-static void update_decrypt_key_256( uint_8t k[2 * N_BLOCK], uint_8t *rc )

-{ uint_8t cc;

-

- for(cc = 28; cc > 16; cc -= 4)

- {

- k[cc + 0] ^= k[cc - 4];

- k[cc + 1] ^= k[cc - 3];

- k[cc + 2] ^= k[cc - 2];

- k[cc + 3] ^= k[cc - 1];

- }

-

- k[16] ^= s_box[k[12]];

- k[17] ^= s_box[k[13]];

- k[18] ^= s_box[k[14]];

- k[19] ^= s_box[k[15]];

-

- for(cc = 12; cc > 0; cc -= 4)

- {

- k[cc + 0] ^= k[cc - 4];

- k[cc + 1] ^= k[cc - 3];

- k[cc + 2] ^= k[cc - 2];

- k[cc + 3] ^= k[cc - 1];

- }

-

- *rc = d2(*rc);

- k[0] ^= s_box[k[29]] ^ *rc;

- k[1] ^= s_box[k[30]];

- k[2] ^= s_box[k[31]];

- k[3] ^= s_box[k[28]];

-}

-

-/* Decrypt a single block of 16 bytes with 'on the fly'

- 256 bit keying

-*/

-void aes_decrypt_256( const unsigned char in[N_BLOCK], unsigned char out[N_BLOCK],

- const unsigned char key[2 * N_BLOCK], unsigned char o_key[2 * N_BLOCK] )

-{

- uint_8t s1[N_BLOCK], r, rc = 0x80;

-

- if(o_key != key)

- {

- block16_copy( o_key, key );

- block16_copy( o_key + 16, key + 16 );

- }

-

- copy_and_key( s1, in, o_key );

- inv_shift_sub_rows( s1 );

-

- for( r = 14 ; --r ; )

-#if defined( VERSION_1 )

- {

- if( ( r & 1 ) )

- {

- update_decrypt_key_256( o_key, &rc );

- add_round_key( s1, o_key + 16 );

- }

- else

- add_round_key( s1, o_key );

- inv_mix_sub_columns( s1 );

- }

-#else

- { uint_8t s2[N_BLOCK];

- if( ( r & 1 ) )

- {

- update_decrypt_key_256( o_key, &rc );

- copy_and_key( s2, s1, o_key + 16 );

- }

- else

- copy_and_key( s2, s1, o_key );

- inv_mix_sub_columns( s1, s2 );

- }

-#endif

- copy_and_key( out, s1, o_key );

-}

-

-#endif

-/*

- ---------------------------------------------------------------------------

- Copyright (c) 1998-2006, Brian Gladman, Worcester, UK. All rights reserved.

-

- LICENSE TERMS

-

- The free distribution and use of this software in both source and binary

- form is allowed (with or without changes) provided that:

-

- 1. distributions of this source code include the above copyright

- notice, this list of conditions and the following disclaimer;

-

- 2. distributions in binary form include the above copyright

- notice, this list of conditions and the following disclaimer

- in the documentation and/or other associated materials;

-

- 3. the copyright holder's name is not used to endorse products

- built using this software without specific written permission.

-

- ALTERNATIVELY, provided that this notice is retained in full, this product

- may be distributed under the terms of the GNU General Public License (GPL),

- in which case the provisions of the GPL apply INSTEAD OF those given above.

-

- DISCLAIMER

-

- This software is provided 'as is' with no explicit or implied warranties

- in respect of its properties, including, but not limited to, correctness

- and/or fitness for purpose.

- ---------------------------------------------------------------------------

- Issue 09/09/2006

-

- This is an AES implementation that uses only 8-bit byte operations on the

- cipher state.

- */

-

-#ifndef AES_H

-#define AES_H

-

-#if defined(__cplusplus)

-extern "C"

-{

-#endif

-

-/* This provides speed optimisation opportunities if 32-bit word

- operations are available

-*/

-#if 1

-# define HAVE_UINT_32T

-#endif

-

-#if 1

-# define AES_ENC_PREKEYED /* AES encryption with a precomputed key schedule */

-#endif

-#if 1

-# define AES_DEC_PREKEYED /* AES decryption with a precomputed key schedule */

-#endif

-#if 0

-# define AES_ENC_128_OTFK /* AES encryption with 'on the fly' 128 bit keying */

-#endif

-#if 0

-# define AES_DEC_128_OTFK /* AES decryption with 'on the fly' 128 bit keying */

-#endif

-#if 0

-# define AES_ENC_256_OTFK /* AES encryption with 'on the fly' 256 bit keying */

-#endif

-#if 0

-# define AES_DEC_256_OTFK /* AES decryption with 'on the fly' 256 bit keying */

-#endif

-

-#define N_ROW 4

-#define N_COL 4

-#define N_BLOCK (N_ROW * N_COL)

-#define N_MAX_ROUNDS 14

-

-typedef unsigned char uint_8t;

-

-typedef uint_8t return_type;

-typedef uint_8t length_type;

-typedef uint_8t uint_type;

-

-typedef unsigned char uint_8t;

-

-typedef struct

-{ uint_8t ksch[(N_MAX_ROUNDS + 1) * N_BLOCK];

- uint_8t rnd;

-} aes_context;

-

-/* The following calls are for a precomputed key schedule

-

- NOTE: If the length_type used for the key length is an

- unsigned 8-bit character, a key length of 256 bits must

- be entered as a length in bytes (valid inputs are hence

- 128, 192, 16, 24 and 32).

-*/

-

-#if defined( AES_ENC_PREKEYED ) || defined( AES_DEC_PREKEYED )

-

-return_type aes_set_key( const unsigned char key[],

- length_type keylen,

- aes_context ctx[1] );

-#endif

-

-#if defined( AES_ENC_PREKEYED )

-

-return_type aes_encrypt( const unsigned char in[N_BLOCK],

- unsigned char out[N_BLOCK],

- const aes_context ctx[1] );

-#endif

-

-#if defined( AES_DEC_PREKEYED )

-

-return_type aes_decrypt( const unsigned char in[N_BLOCK],

- unsigned char out[N_BLOCK],

- const aes_context ctx[1] );

-#endif

-

-/* The following calls are for 'on the fly' keying. In this case the

- encryption and decryption keys are different.

-

- The encryption subroutines take a key in an array of bytes in

- key[L] where L is 16, 24 or 32 bytes for key lengths of 128,

- 192, and 256 bits respectively. They then encrypts the input

- data, in[] with this key and put the reult in the output array

- out[]. In addition, the second key array, o_key[L], is used

- to output the key that is needed by the decryption subroutine

- to reverse the encryption operation. The two key arrays can

- be the same array but in this case the original key will be

- overwritten.

-

- In the same way, the decryption subroutines output keys that

- can be used to reverse their effect when used for encryption.

-

- Only 128 and 256 bit keys are supported in these 'on the fly'

- modes.

-*/

-

-#if defined( AES_ENC_128_OTFK )

-void aes_encrypt_128( const unsigned char in[N_BLOCK],

- unsigned char out[N_BLOCK],

- const unsigned char key[N_BLOCK],

- uint_8t o_key[N_BLOCK] );

-#endif

-

-#if defined( AES_DEC_128_OTFK )

-void aes_decrypt_128( const unsigned char in[N_BLOCK],

- unsigned char out[N_BLOCK],

- const unsigned char key[N_BLOCK],

- unsigned char o_key[N_BLOCK] );

-#endif

-

-#if defined( AES_ENC_256_OTFK )

-void aes_encrypt_256( const unsigned char in[N_BLOCK],

- unsigned char out[N_BLOCK],

- const unsigned char key[2 * N_BLOCK],

- unsigned char o_key[2 * N_BLOCK] );

-#endif

-

-#if defined( AES_DEC_256_OTFK )

-void aes_decrypt_256( const unsigned char in[N_BLOCK],

- unsigned char out[N_BLOCK],

- const unsigned char key[2 * N_BLOCK],

- unsigned char o_key[2 * N_BLOCK] );

-#endif

-

-#if defined(__cplusplus)

-}

-#endif

-

-#endif

-

-; ---------------------------------------------------------------------------

-; Copyright (c) 1998-2007, Brian Gladman, Worcester, UK. All rights reserved.

-;

-; LICENSE TERMS

-;

-; The free distribution and use of this software is allowed (with or without

-; changes) provided that:

-;

-; 1. source code distributions include the above copyright notice, this

-; list of conditions and the following disclaimer;

-;

-; 2. binary distributions include the above copyright notice, this list

-; of conditions and the following disclaimer in their documentation;

-;

-; 3. the name of the copyright holder is not used to endorse products

-; built using this software without specific written permission.

-;

-; DISCLAIMER

-;

-; This software is provided 'as is' with no explicit or implied warranties

-; in respect of its properties, including, but not limited to, correctness

-; and/or fitness for purpose.

-; ---------------------------------------------------------------------------

-; Issue 20/12/2007

-;

-; This code requires either ASM_X86_V2 or ASM_X86_V2C to be set in aesopt.h

-; and the same define to be set here as well. If AES_V2C is set this file

-; requires the C files aeskey.c and aestab.c for support.

-

-; An AES implementation for x86 processors using the YASM (or NASM) assembler.

-; This is a full assembler implementation covering encryption, decryption and

-; key scheduling. It uses 2k bytes of tables but its encryption and decryption

-; performance is very close to that obtained using large tables. Key schedule

-; expansion is slower for both encryption and decryption but this is likely to

-; be offset by the much smaller load that this version places on the processor

-; cache. I acknowledge the contribution made by Daniel Bernstein to aspects of

-; the design of the AES round function used here.

-;

-; This code provides the standard AES block size (128 bits, 16 bytes) and the

-; three standard AES key sizes (128, 192 and 256 bits). It has the same call

-; interface as my C implementation. The ebx, esi, edi and ebp registers are

-; preserved across calls but eax, ecx and edx and the artihmetic status flags

-; are not. Although this is a full assembler implementation, it can be used

-; in conjunction with my C code which provides faster key scheduling using

-; large tables. In this case aeskey.c should be compiled with ASM_X86_V2C

-; defined. It is also important that the defines below match those used in the

-; C code. This code uses the VC++ register saving conentions; if it is used

-; with another compiler, conventions for using and saving registers may need

-; to be checked (and calling conventions). The YASM command line for the VC++

-; custom build step is:

-;

-; yasm -Xvc -f win32 -D <Z> -o "$(TargetDir)\$(InputName).obj" "$(InputPath)"

-;

-; For the cryptlib build this is (pcg):

-;

-; yasm -Xvc -f win32 -D ASM_X86_V2C -o aescrypt2.obj aes_x86_v2.asm

-;

-; where <Z> is ASM_X86_V2 or ASM_X86_V2C. The calling intefaces are:

-;

-; AES_RETURN aes_encrypt(const unsigned char in_blk[],

-; unsigned char out_blk[], const aes_encrypt_ctx cx[1]);

-;

-; AES_RETURN aes_decrypt(const unsigned char in_blk[],

-; unsigned char out_blk[], const aes_decrypt_ctx cx[1]);

-;

-; AES_RETURN aes_encrypt_key<NNN>(const unsigned char key[],

-; const aes_encrypt_ctx cx[1]);

-;

-; AES_RETURN aes_decrypt_key<NNN>(const unsigned char key[],

-; const aes_decrypt_ctx cx[1]);

-;

-; AES_RETURN aes_encrypt_key(const unsigned char key[],

-; unsigned int len, const aes_decrypt_ctx cx[1]);

-;

-; AES_RETURN aes_decrypt_key(const unsigned char key[],

-; unsigned int len, const aes_decrypt_ctx cx[1]);

-;

-; where <NNN> is 128, 102 or 256. In the last two calls the length can be in

-; either bits or bytes.

-

-; The DLL interface must use the _stdcall convention in which the number

-; of bytes of parameter space is added after an @ to the sutine's name.

-; We must also remove our parameters from the stack before return (see

-; the do_exit macro). Define DLL_EXPORT for the Dynamic Link Library version.

-

-;

-; Adapted for TrueCrypt:

-; - All tables generated at run-time

-; - Adapted for 16-bit environment

-;

-

-CPU 386

-USE16

-SEGMENT _TEXT PUBLIC CLASS=CODE USE16

-SEGMENT _DATA PUBLIC CLASS=DATA USE16

-

-GROUP DGROUP _TEXT _DATA

-

-extern _aes_dec_tab ; Aestab.c

-extern _aes_enc_tab

-

-; %define DLL_EXPORT

-

-; The size of the code can be reduced by using functions for the encryption

-; and decryption rounds in place of macro expansion

-

-%define REDUCE_CODE_SIZE

-

-; Comment in/out the following lines to obtain the desired subroutines. These

-; selections MUST match those in the C header file aes.h

-

-; %define AES_128 ; define if AES with 128 bit keys is needed

-; %define AES_192 ; define if AES with 192 bit keys is needed

-%define AES_256 ; define if AES with 256 bit keys is needed

-; %define AES_VAR ; define if a variable key size is needed

-%define ENCRYPTION ; define if encryption is needed

-%define DECRYPTION ; define if decryption is needed

-; %define AES_REV_DKS ; define if key decryption schedule is reversed

-

-%ifndef ASM_X86_V2C

-%define ENCRYPTION_KEY_SCHEDULE ; define if encryption key expansion is needed

-%define DECRYPTION_KEY_SCHEDULE ; define if decryption key expansion is needed

-%endif

-

-; The encryption key schedule has the following in memory layout where N is the

-; number of rounds (10, 12 or 14):

-;

-; lo: | input key (round 0) | ; each round is four 32-bit words

-; | encryption round 1 |

-; | encryption round 2 |

-; ....

-; | encryption round N-1 |

-; hi: | encryption round N |

-;

-; The decryption key schedule is normally set up so that it has the same

-; layout as above by actually reversing the order of the encryption key

-; schedule in memory (this happens when AES_REV_DKS is set):

-;

-; lo: | decryption round 0 | = | encryption round N |

-; | decryption round 1 | = INV_MIX_COL[ | encryption round N-1 | ]

-; | decryption round 2 | = INV_MIX_COL[ | encryption round N-2 | ]

-; .... ....

-; | decryption round N-1 | = INV_MIX_COL[ | encryption round 1 | ]

-; hi: | decryption round N | = | input key (round 0) |

-;

-; with rounds except the first and last modified using inv_mix_column()

-; But if AES_REV_DKS is NOT set the order of keys is left as it is for

-; encryption so that it has to be accessed in reverse when used for

-; decryption (although the inverse mix column modifications are done)

-;

-; lo: | decryption round 0 | = | input key (round 0) |

-; | decryption round 1 | = INV_MIX_COL[ | encryption round 1 | ]

-; | decryption round 2 | = INV_MIX_COL[ | encryption round 2 | ]

-; .... ....

-; | decryption round N-1 | = INV_MIX_COL[ | encryption round N-1 | ]

-; hi: | decryption round N | = | encryption round N |

-;

-; This layout is faster when the assembler key scheduling provided here

-; is used.

-;

-; End of user defines

-

-%ifdef AES_VAR

-%ifndef AES_128

-%define AES_128

-%endif

-%ifndef AES_192

-%define AES_192

-%endif

-%ifndef AES_256

-%define AES_256

-%endif

-%endif

-

-%ifdef AES_VAR

-%define KS_LENGTH 60

-%elifdef AES_256

-%define KS_LENGTH 60

-%elifdef AES_192

-%define KS_LENGTH 52

-%else

-%define KS_LENGTH 44

-%endif

-

-; These macros implement stack based local variables

-

-%macro save 2

- mov [esp+4*%1],%2

-%endmacro

-

-%macro restore 2

- mov %1,[esp+4*%2]

-%endmacro

-

-%ifdef REDUCE_CODE_SIZE

- %macro mf_call 1

- call %1

- %endmacro

-%else

- %macro mf_call 1

- %1

- %endmacro

-%endif

-

-; the DLL has to implement the _stdcall calling interface on return

-; In this case we have to take our parameters (3 4-byte pointers)

-; off the stack

-

-%define parms 12

-

-%macro do_name 1-2 parms

-%ifndef DLL_EXPORT

- global %1

-%1:

-%else

- global %1@%2

- export %1@%2

-%1@%2:

-%endif

-%endmacro

-

-%macro do_call 1-2 parms

-%ifndef DLL_EXPORT

- call %1

- add esp,%2

-%else

- call %1@%2

-%endif

-%endmacro

-

-%macro do_exit 0-1 parms

-%ifdef DLL_EXPORT

- ret %1

-%else

- ret

-%endif

-%endmacro

-

-; finite field multiplies by {02}, {04} and {08}

-

-%define f2(x) ((x<<1)^(((x>>7)&1)*0x11b))

-%define f4(x) ((x<<2)^(((x>>6)&1)*0x11b)^(((x>>6)&2)*0x11b))

-%define f8(x) ((x<<3)^(((x>>5)&1)*0x11b)^(((x>>5)&2)*0x11b)^(((x>>5)&4)*0x11b))

-

-; finite field multiplies required in table generation

-

-%define f3(x) (f2(x) ^ x)

-%define f9(x) (f8(x) ^ x)

-%define fb(x) (f8(x) ^ f2(x) ^ x)

-%define fd(x) (f8(x) ^ f4(x) ^ x)

-%define fe(x) (f8(x) ^ f4(x) ^ f2(x))

-

-%define etab_0(x) [_aes_enc_tab+4+8*x]

-%define etab_1(x) [_aes_enc_tab+3+8*x]

-%define etab_2(x) [_aes_enc_tab+2+8*x]

-%define etab_3(x) [_aes_enc_tab+1+8*x]

-%define etab_b(x) byte [_aes_enc_tab+1+8*x] ; used with movzx for 0x000000xx

-%define etab_w(x) word [_aes_enc_tab+8*x] ; used with movzx for 0x0000xx00

-

-%define btab_0(x) [_aes_enc_tab+6+8*x]

-%define btab_1(x) [_aes_enc_tab+5+8*x]

-%define btab_2(x) [_aes_enc_tab+4+8*x]

-%define btab_3(x) [_aes_enc_tab+3+8*x]

-

-; ROUND FUNCTION. Build column[2] on ESI and column[3] on EDI that have the

-; round keys pre-loaded. Build column[0] in EBP and column[1] in EBX.

-;

-; Input:

-;

-; EAX column[0]

-; EBX column[1]

-; ECX column[2]

-; EDX column[3]

-; ESI column key[round][2]

-; EDI column key[round][3]

-; EBP scratch

-;

-; Output:

-;

-; EBP column[0] unkeyed

-; EBX column[1] unkeyed

-; ESI column[2] keyed

-; EDI column[3] keyed

-; EAX scratch

-; ECX scratch

-; EDX scratch

-

-%macro rnd_fun 2

-

- rol ebx,16

- %1 esi, cl, 0, ebp

- %1 esi, dh, 1, ebp

- %1 esi, bh, 3, ebp

- %1 edi, dl, 0, ebp

- %1 edi, ah, 1, ebp

- %1 edi, bl, 2, ebp

- %2 ebp, al, 0, ebp

- shr ebx,16

- and eax,0xffff0000

- or eax,ebx

- shr edx,16

- %1 ebp, ah, 1, ebx

- %1 ebp, dh, 3, ebx

- %2 ebx, dl, 2, ebx

- %1 ebx, ch, 1, edx

- %1 ebx, al, 0, edx

- shr eax,16

- shr ecx,16

- %1 ebp, cl, 2, edx

- %1 edi, ch, 3, edx

- %1 esi, al, 2, edx

- %1 ebx, ah, 3, edx

-

-%endmacro

-

-; Basic MOV and XOR Operations for normal rounds

-

-%macro nr_xor 4

- movzx %4,%2

- xor %1,etab_%3(%4)

-%endmacro

-

-%macro nr_mov 4

- movzx %4,%2

- mov %1,etab_%3(%4)

-%endmacro

-

-; Basic MOV and XOR Operations for last round

-

-%if 1

-

- %macro lr_xor 4

- movzx %4,%2

- movzx %4,etab_b(%4)

- %if %3 != 0

- shl %4,8*%3

- %endif

- xor %1,%4

- %endmacro

-

- %macro lr_mov 4

- movzx %4,%2

- movzx %1,etab_b(%4)

- %if %3 != 0

- shl %1,8*%3

- %endif

- %endmacro

-

-%else ; less effective but worth leaving as an option

-

- %macro lr_xor 4

- movzx %4,%2

- mov %4,btab_%3(%4)

- and %4,0x000000ff << 8 * %3

- xor %1,%4

- %endmacro

-

- %macro lr_mov 4

- movzx %4,%2

- mov %1,btab_%3(%4)

- and %1,0x000000ff << 8 * %3

- %endmacro

-

-%endif

-

-; Apply S-Box to the 4 bytes in a 32-bit word and rotate byte positions

-

-%ifdef REDUCE_CODE_SIZE

-

-l3s_col:

- movzx ecx,al ; in eax

- movzx ecx, etab_b(ecx) ; out eax

- xor edx,ecx ; scratch ecx,edx

- movzx ecx,ah

- movzx ecx, etab_b(ecx)

- shl ecx,8

- xor edx,ecx

- shr eax,16

- movzx ecx,al

- movzx ecx, etab_b(ecx)

- shl ecx,16

- xor edx,ecx

- movzx ecx,ah

- movzx ecx, etab_b(ecx)

- shl ecx,24

- xor edx,ecx

- mov eax,edx

- ret

-

-%else

-

-%macro l3s_col 0

-

- movzx ecx,al ; in eax

- movzx ecx, etab_b(ecx) ; out eax

- xor edx,ecx ; scratch ecx,edx

- movzx ecx,ah

- movzx ecx, etab_b(ecx)

- shl ecx,8

- xor edx,ecx

- shr eax,16

- movzx ecx,al

- movzx ecx, etab_b(ecx)

- shl ecx,16

- xor edx,ecx

- movzx ecx,ah

- movzx ecx, etab_b(ecx)

- shl ecx,24

- xor edx,ecx

- mov eax,edx

-

-%endmacro

-

-%endif

-

-; offsets to parameters

-

-in_blk equ 2 ; input byte array address parameter

-out_blk equ 4 ; output byte array address parameter

-ctx equ 6 ; AES context structure

-stk_spc equ 20 ; stack space

-

-%ifdef ENCRYPTION

-

-; %define ENCRYPTION_TABLE

-

-%ifdef REDUCE_CODE_SIZE

-

-enc_round:

- sub sp, 2

- add ebp,16

- save 1,ebp

- mov esi,[ebp+8]

- mov edi,[ebp+12]

-

- rnd_fun nr_xor, nr_mov

-

- mov eax,ebp

- mov ecx,esi

- mov edx,edi

- restore ebp,1

- xor eax,[ebp]

- xor ebx,[ebp+4]

- add sp, 2

- ret

-

-%else

-

-%macro enc_round 0

-

- add ebp,16

- save 0,ebp

- mov esi,[ebp+8]

- mov edi,[ebp+12]

-

- rnd_fun nr_xor, nr_mov

-

- mov eax,ebp

- mov ecx,esi

- mov edx,edi

- restore ebp,0

- xor eax,[ebp]

- xor ebx,[ebp+4]

-

-%endmacro

-

-%endif

-

-%macro enc_last_round 0

-

- add ebp,16

- save 0,ebp

- mov esi,[ebp+8]

- mov edi,[ebp+12]

-

- rnd_fun lr_xor, lr_mov

-

- mov eax,ebp

- restore ebp,0

- xor eax,[ebp]

- xor ebx,[ebp+4]

-

-%endmacro

-

- section _TEXT

-

-; AES Encryption Subroutine

-

- do_name _aes_encrypt,12

-

- mov ax, sp

- movzx esp, ax

-

- sub esp,stk_spc

- mov [esp+16],ebp

- mov [esp+12],ebx

- mov [esp+ 8],esi

- mov [esp+ 4],edi

-

- movzx esi,word [esp+in_blk+stk_spc] ; input pointer

- mov eax,[esi ]

- mov ebx,[esi+ 4]

- mov ecx,[esi+ 8]

- mov edx,[esi+12]

-

- movzx ebp,word [esp+ctx+stk_spc] ; key pointer

- movzx edi,byte [ebp+4*KS_LENGTH]

- xor eax,[ebp ]

- xor ebx,[ebp+ 4]

- xor ecx,[ebp+ 8]

- xor edx,[ebp+12]

-

-; determine the number of rounds

-

-%ifndef AES_256

- cmp edi,10*16

- je .3

- cmp edi,12*16

- je .2

- cmp edi,14*16

- je .1

- mov eax,-1

- jmp .5

-%endif

-

-.1: mf_call enc_round

- mf_call enc_round

-.2: mf_call enc_round

- mf_call enc_round

-.3: mf_call enc_round

- mf_call enc_round

- mf_call enc_round

- mf_call enc_round

- mf_call enc_round

- mf_call enc_round

- mf_call enc_round

- mf_call enc_round

- mf_call enc_round

- enc_last_round

-

- movzx edx,word [esp+out_blk+stk_spc]

- mov [edx],eax

- mov [edx+4],ebx

- mov [edx+8],esi

- mov [edx+12],edi

- xor eax,eax

-

-.5: mov ebp,[esp+16]

- mov ebx,[esp+12]

- mov esi,[esp+ 8]

- mov edi,[esp+ 4]

- add esp,stk_spc

- do_exit 12

-

-%endif

-

-%macro f_key 2

-

- push ecx

- push edx

- mov edx,esi

- ror eax,8

- mf_call l3s_col

- mov esi,eax

- pop edx

- pop ecx

- xor esi,rc_val

-

- mov [ebp+%1*%2],esi

- xor edi,esi

- mov [ebp+%1*%2+4],edi

- xor ecx,edi

- mov [ebp+%1*%2+8],ecx

- xor edx,ecx

- mov [ebp+%1*%2+12],edx

- mov eax,edx

-

-%if %2 == 24

-

-%if %1 < 7

- xor eax,[ebp+%1*%2+16-%2]

- mov [ebp+%1*%2+16],eax

- xor eax,[ebp+%1*%2+20-%2]

- mov [ebp+%1*%2+20],eax

-%endif

-

-%elif %2 == 32

-

-%if %1 < 6

- push ecx

- push edx

- mov edx,[ebp+%1*%2+16-%2]

- mf_call l3s_col

- pop edx

- pop ecx

- mov [ebp+%1*%2+16],eax

- xor eax,[ebp+%1*%2+20-%2]

- mov [ebp+%1*%2+20],eax

- xor eax,[ebp+%1*%2+24-%2]

- mov [ebp+%1*%2+24],eax

- xor eax,[ebp+%1*%2+28-%2]

- mov [ebp+%1*%2+28],eax

-%endif

-

-%endif

-

-%assign rc_val f2(rc_val)

-

-%endmacro

-

-%ifdef ENCRYPTION_KEY_SCHEDULE

-

-%ifdef AES_128

-

-%ifndef ENCRYPTION_TABLE

-; %define ENCRYPTION_TABLE

-%endif

-

-%assign rc_val 1

-

- do_name _aes_encrypt_key128,8

-

- push ebp

- push ebx

- push esi

- push edi

-

- mov ebp,[esp+24]

- mov [ebp+4*KS_LENGTH],dword 10*16

- mov ebx,[esp+20]

-

- mov esi,[ebx]

- mov [ebp],esi

- mov edi,[ebx+4]

- mov [ebp+4],edi

- mov ecx,[ebx+8]

- mov [ebp+8],ecx

- mov edx,[ebx+12]

- mov [ebp+12],edx

- add ebp,16

- mov eax,edx

-

- f_key 0,16 ; 11 * 4 = 44 unsigned longs

- f_key 1,16 ; 4 + 4 * 10 generated = 44

- f_key 2,16

- f_key 3,16

- f_key 4,16

- f_key 5,16

- f_key 6,16

- f_key 7,16

- f_key 8,16

- f_key 9,16

-

- pop edi

- pop esi

- pop ebx

- pop ebp

- xor eax,eax

- do_exit 8

-

-%endif

-

-%ifdef AES_192

-

-%ifndef ENCRYPTION_TABLE

-; %define ENCRYPTION_TABLE

-%endif

-

-%assign rc_val 1

-

- do_name _aes_encrypt_key192,8

-

- push ebp

- push ebx

- push esi

- push edi

-

- mov ebp,[esp+24]

- mov [ebp+4*KS_LENGTH],dword 12 * 16

- mov ebx,[esp+20]

-

- mov esi,[ebx]

- mov [ebp],esi

- mov edi,[ebx+4]

- mov [ebp+4],edi

- mov ecx,[ebx+8]

- mov [ebp+8],ecx

- mov edx,[ebx+12]

- mov [ebp+12],edx

- mov eax,[ebx+16]

- mov [ebp+16],eax

- mov eax,[ebx+20]

- mov [ebp+20],eax

- add ebp,24

-

- f_key 0,24 ; 13 * 4 = 52 unsigned longs

- f_key 1,24 ; 6 + 6 * 8 generated = 54

- f_key 2,24

- f_key 3,24

- f_key 4,24

- f_key 5,24

- f_key 6,24

- f_key 7,24

-

- pop edi

- pop esi

- pop ebx

- pop ebp

- xor eax,eax

- do_exit 8

-

-%endif

-

-%ifdef AES_256

-

-%ifndef ENCRYPTION_TABLE

-; %define ENCRYPTION_TABLE

-%endif

-

-%assign rc_val 1

-

- do_name _aes_encrypt_key256,8

-

- mov ax, sp

- movzx esp, ax

-

- push ebp

- push ebx

- push esi

- push edi

-

- movzx ebp, word [esp+20] ; ks

- mov [ebp+4*KS_LENGTH],dword 14 * 16

- movzx ebx, word [esp+18] ; key

-

- mov esi,[ebx]

- mov [ebp],esi

- mov edi,[ebx+4]

- mov [ebp+4],edi

- mov ecx,[ebx+8]

- mov [ebp+8],ecx

- mov edx,[ebx+12]

- mov [ebp+12],edx

- mov eax,[ebx+16]

- mov [ebp+16],eax

- mov eax,[ebx+20]

- mov [ebp+20],eax

- mov eax,[ebx+24]

- mov [ebp+24],eax

- mov eax,[ebx+28]

- mov [ebp+28],eax

- add ebp,32

-

- f_key 0,32 ; 15 * 4 = 60 unsigned longs

- f_key 1,32 ; 8 + 8 * 7 generated = 64

- f_key 2,32

- f_key 3,32

- f_key 4,32

- f_key 5,32

- f_key 6,32

-

- pop edi

- pop esi

- pop ebx

- pop ebp

- xor eax,eax

- do_exit 8

-

-%endif

-

-%ifdef AES_VAR

-

-%ifndef ENCRYPTION_TABLE

-; %define ENCRYPTION_TABLE

-%endif

-

- do_name _aes_encrypt_key,12

-

- mov ecx,[esp+4]

- mov eax,[esp+8]

- mov edx,[esp+12]

- push edx

- push ecx

-

- cmp eax,16

- je .1

- cmp eax,128

- je .1

-

- cmp eax,24

- je .2

- cmp eax,192

- je .2

-

- cmp eax,32

- je .3

- cmp eax,256

- je .3

- mov eax,-1

- add esp,8

- do_exit 12

-

-.1: do_call _aes_encrypt_key128,8

- do_exit 12

-.2: do_call _aes_encrypt_key192,8

- do_exit 12

-.3: do_call _aes_encrypt_key256,8

- do_exit 12

-

-%endif

-

-%endif

-

-%ifdef ENCRYPTION_TABLE

-

-; S-box data - 256 entries

-

- section _DATA

-

-%define u8(x) 0, x, x, f3(x), f2(x), x, x, f3(x)

-

-_aes_enc_tab:

- db u8(0x63),u8(0x7c),u8(0x77),u8(0x7b),u8(0xf2),u8(0x6b),u8(0x6f),u8(0xc5)

- db u8(0x30),u8(0x01),u8(0x67),u8(0x2b),u8(0xfe),u8(0xd7),u8(0xab),u8(0x76)

- db u8(0xca),u8(0x82),u8(0xc9),u8(0x7d),u8(0xfa),u8(0x59),u8(0x47),u8(0xf0)

- db u8(0xad),u8(0xd4),u8(0xa2),u8(0xaf),u8(0x9c),u8(0xa4),u8(0x72),u8(0xc0)

- db u8(0xb7),u8(0xfd),u8(0x93),u8(0x26),u8(0x36),u8(0x3f),u8(0xf7),u8(0xcc)

- db u8(0x34),u8(0xa5),u8(0xe5),u8(0xf1),u8(0x71),u8(0xd8),u8(0x31),u8(0x15)

- db u8(0x04),u8(0xc7),u8(0x23),u8(0xc3),u8(0x18),u8(0x96),u8(0x05),u8(0x9a)

- db u8(0x07),u8(0x12),u8(0x80),u8(0xe2),u8(0xeb),u8(0x27),u8(0xb2),u8(0x75)

- db u8(0x09),u8(0x83),u8(0x2c),u8(0x1a),u8(0x1b),u8(0x6e),u8(0x5a),u8(0xa0)

- db u8(0x52),u8(0x3b),u8(0xd6),u8(0xb3),u8(0x29),u8(0xe3),u8(0x2f),u8(0x84)

- db u8(0x53),u8(0xd1),u8(0x00),u8(0xed),u8(0x20),u8(0xfc),u8(0xb1),u8(0x5b)

- db u8(0x6a),u8(0xcb),u8(0xbe),u8(0x39),u8(0x4a),u8(0x4c),u8(0x58),u8(0xcf)

- db u8(0xd0),u8(0xef),u8(0xaa),u8(0xfb),u8(0x43),u8(0x4d),u8(0x33),u8(0x85)

- db u8(0x45),u8(0xf9),u8(0x02),u8(0x7f),u8(0x50),u8(0x3c),u8(0x9f),u8(0xa8)

- db u8(0x51),u8(0xa3),u8(0x40),u8(0x8f),u8(0x92),u8(0x9d),u8(0x38),u8(0xf5)

- db u8(0xbc),u8(0xb6),u8(0xda),u8(0x21),u8(0x10),u8(0xff),u8(0xf3),u8(0xd2)

- db u8(0xcd),u8(0x0c),u8(0x13),u8(0xec),u8(0x5f),u8(0x97),u8(0x44),u8(0x17)

- db u8(0xc4),u8(0xa7),u8(0x7e),u8(0x3d),u8(0x64),u8(0x5d),u8(0x19),u8(0x73)

- db u8(0x60),u8(0x81),u8(0x4f),u8(0xdc),u8(0x22),u8(0x2a),u8(0x90),u8(0x88)

- db u8(0x46),u8(0xee),u8(0xb8),u8(0x14),u8(0xde),u8(0x5e),u8(0x0b),u8(0xdb)

- db u8(0xe0),u8(0x32),u8(0x3a),u8(0x0a),u8(0x49),u8(0x06),u8(0x24),u8(0x5c)

- db u8(0xc2),u8(0xd3),u8(0xac),u8(0x62),u8(0x91),u8(0x95),u8(0xe4),u8(0x79)

- db u8(0xe7),u8(0xc8),u8(0x37),u8(0x6d),u8(0x8d),u8(0xd5),u8(0x4e),u8(0xa9)

- db u8(0x6c),u8(0x56),u8(0xf4),u8(0xea),u8(0x65),u8(0x7a),u8(0xae),u8(0x08)

- db u8(0xba),u8(0x78),u8(0x25),u8(0x2e),u8(0x1c),u8(0xa6),u8(0xb4),u8(0xc6)

- db u8(0xe8),u8(0xdd),u8(0x74),u8(0x1f),u8(0x4b),u8(0xbd),u8(0x8b),u8(0x8a)

- db u8(0x70),u8(0x3e),u8(0xb5),u8(0x66),u8(0x48),u8(0x03),u8(0xf6),u8(0x0e)

- db u8(0x61),u8(0x35),u8(0x57),u8(0xb9),u8(0x86),u8(0xc1),u8(0x1d),u8(0x9e)

- db u8(0xe1),u8(0xf8),u8(0x98),u8(0x11),u8(0x69),u8(0xd9),u8(0x8e),u8(0x94)

- db u8(0x9b),u8(0x1e),u8(0x87),u8(0xe9),u8(0xce),u8(0x55),u8(0x28),u8(0xdf)

- db u8(0x8c),u8(0xa1),u8(0x89),u8(0x0d),u8(0xbf),u8(0xe6),u8(0x42),u8(0x68)

- db u8(0x41),u8(0x99),u8(0x2d),u8(0x0f),u8(0xb0),u8(0x54),u8(0xbb),u8(0x16)

-

-%endif

-

-%ifdef DECRYPTION

-

-; %define DECRYPTION_TABLE

-

-%define dtab_0(x) [_aes_dec_tab+ 8*x]

-%define dtab_1(x) [_aes_dec_tab+3+8*x]

-%define dtab_2(x) [_aes_dec_tab+2+8*x]

-%define dtab_3(x) [_aes_dec_tab+1+8*x]

-%define dtab_x(x) byte [_aes_dec_tab+7+8*x]

-

-%macro irn_fun 2

-

- rol eax,16

- %1 esi, cl, 0, ebp

- %1 esi, bh, 1, ebp

- %1 esi, al, 2, ebp

- %1 edi, dl, 0, ebp

- %1 edi, ch, 1, ebp

- %1 edi, ah, 3, ebp

- %2 ebp, bl, 0, ebp

- shr eax,16

- and ebx,0xffff0000

- or ebx,eax

- shr ecx,16

- %1 ebp, bh, 1, eax

- %1 ebp, ch, 3, eax

- %2 eax, cl, 2, ecx

- %1 eax, bl, 0, ecx

- %1 eax, dh, 1, ecx

- shr ebx,16

- shr edx,16

- %1 esi, dh, 3, ecx

- %1 ebp, dl, 2, ecx

- %1 eax, bh, 3, ecx

- %1 edi, bl, 2, ecx

-

-%endmacro

-

-; Basic MOV and XOR Operations for normal rounds

-

-%macro ni_xor 4

- movzx %4,%2

- xor %1,dtab_%3(%4)

-%endmacro

-

-%macro ni_mov 4

- movzx %4,%2

- mov %1,dtab_%3(%4)

-%endmacro

-

-; Basic MOV and XOR Operations for last round

-

-%macro li_xor 4

- movzx %4,%2

- movzx %4,dtab_x(%4)

-%if %3 != 0

- shl %4,8*%3

-%endif

- xor %1,%4

-%endmacro

-

-%macro li_mov 4

- movzx %4,%2

- movzx %1,dtab_x(%4)

-%if %3 != 0

- shl %1,8*%3

-%endif

-%endmacro

-

-%ifdef REDUCE_CODE_SIZE

-

-dec_round:

- sub sp, 2

-%ifdef AES_REV_DKS

- add ebp,16

-%else

- sub ebp,16

-%endif

- save 1,ebp

- mov esi,[ebp+8]

- mov edi,[ebp+12]

-

- irn_fun ni_xor, ni_mov

-

- mov ebx,ebp

- mov ecx,esi

- mov edx,edi

- restore ebp,1

- xor eax,[ebp]

- xor ebx,[ebp+4]

- add sp, 2

- ret

-

-%else

-

-%macro dec_round 0

-

-%ifdef AES_REV_DKS

- add ebp,16

-%else

- sub ebp,16

-%endif

- save 0,ebp

- mov esi,[ebp+8]

- mov edi,[ebp+12]

-

- irn_fun ni_xor, ni_mov

-

- mov ebx,ebp

- mov ecx,esi

- mov edx,edi

- restore ebp,0

- xor eax,[ebp]

- xor ebx,[ebp+4]

-

-%endmacro

-

-%endif

-

-%macro dec_last_round 0

-

-%ifdef AES_REV_DKS

- add ebp,16

-%else

- sub ebp,16

-%endif

- save 0,ebp

- mov esi,[ebp+8]

- mov edi,[ebp+12]

-

- irn_fun li_xor, li_mov

-

- mov ebx,ebp

- restore ebp,0

- xor eax,[ebp]

- xor ebx,[ebp+4]

-

-%endmacro

-

- section _TEXT

-

-; AES Decryption Subroutine

-

- do_name _aes_decrypt,12

-

- mov ax, sp

- movzx esp, ax

-

- sub esp,stk_spc

- mov [esp+16],ebp

- mov [esp+12],ebx

- mov [esp+ 8],esi

- mov [esp+ 4],edi

-

-; input four columns and xor in first round key

-

- movzx esi,word [esp+in_blk+stk_spc] ; input pointer

- mov eax,[esi ]

- mov ebx,[esi+ 4]

- mov ecx,[esi+ 8]

- mov edx,[esi+12]

- lea esi,[esi+16]

-

- movzx ebp, word [esp+ctx+stk_spc] ; key pointer

- movzx edi,byte[ebp+4*KS_LENGTH]

-%ifndef AES_REV_DKS ; if decryption key schedule is not reversed

- lea ebp,[ebp+edi] ; we have to access it from the top down

-%endif

- xor eax,[ebp ] ; key schedule

- xor ebx,[ebp+ 4]

- xor ecx,[ebp+ 8]

- xor edx,[ebp+12]

-

-; determine the number of rounds

-

-%ifndef AES_256

- cmp edi,10*16

- je .3

- cmp edi,12*16

- je .2

- cmp edi,14*16

- je .1

- mov eax,-1

- jmp .5

-%endif

-

-.1: mf_call dec_round

- mf_call dec_round

-.2: mf_call dec_round

- mf_call dec_round

-.3: mf_call dec_round

- mf_call dec_round

- mf_call dec_round

- mf_call dec_round

- mf_call dec_round

- mf_call dec_round

- mf_call dec_round

- mf_call dec_round

- mf_call dec_round

- dec_last_round

-

-; move final values to the output array.

-

- movzx ebp,word [esp+out_blk+stk_spc]

- mov [ebp],eax

- mov [ebp+4],ebx

- mov [ebp+8],esi

- mov [ebp+12],edi

- xor eax,eax

-

-.5: mov ebp,[esp+16]

- mov ebx,[esp+12]

- mov esi,[esp+ 8]

- mov edi,[esp+ 4]

- add esp,stk_spc

- do_exit 12

-

-%endif

-

-%ifdef REDUCE_CODE_SIZE

-

-inv_mix_col:

- movzx ecx,dl ; input eax, edx

- movzx ecx,etab_b(ecx) ; output eax

- mov eax,dtab_0(ecx) ; used ecx

- movzx ecx,dh

- shr edx,16

- movzx ecx,etab_b(ecx)

- xor eax,dtab_1(ecx)

- movzx ecx,dl

- movzx ecx,etab_b(ecx)

- xor eax,dtab_2(ecx)

- movzx ecx,dh

- movzx ecx,etab_b(ecx)

- xor eax,dtab_3(ecx)

- ret

-

-%else

-

-%macro inv_mix_col 0

-

- movzx ecx,dl ; input eax, edx

- movzx ecx,etab_b(ecx) ; output eax

- mov eax,dtab_0(ecx) ; used ecx

- movzx ecx,dh

- shr edx,16

- movzx ecx,etab_b(ecx)

- xor eax,dtab_1(ecx)

- movzx ecx,dl

- movzx ecx,etab_b(ecx)

- xor eax,dtab_2(ecx)

- movzx ecx,dh

- movzx ecx,etab_b(ecx)

- xor eax,dtab_3(ecx)

-

-%endmacro

-

-%endif

-

-%ifdef DECRYPTION_KEY_SCHEDULE

-

-%ifdef AES_128

-

-%ifndef DECRYPTION_TABLE

-; %define DECRYPTION_TABLE

-%endif

-

- do_name _aes_decrypt_key128,8

-

- push ebp

- push ebx

- push esi

- push edi

- mov eax,[esp+24] ; context

- mov edx,[esp+20] ; key

- push eax

- push edx

- do_call _aes_encrypt_key128,8 ; generate expanded encryption key

- mov eax,10*16

- mov esi,[esp+24] ; pointer to first round key

- lea edi,[esi+eax] ; pointer to last round key

- add esi,32

- ; the inverse mix column transformation

- mov edx,[esi-16] ; needs to be applied to all round keys

- mf_call inv_mix_col ; except first and last. Hence start by

- mov [esi-16],eax ; transforming the four sub-keys in the

- mov edx,[esi-12] ; second round key

- mf_call inv_mix_col

- mov [esi-12],eax ; transformations for subsequent rounds

- mov edx,[esi-8] ; can then be made more efficient by

- mf_call inv_mix_col ; noting that for three of the four sub-keys

- mov [esi-8],eax ; in the encryption round key ek[r]:

- mov edx,[esi-4] ;

- mf_call inv_mix_col ; ek[r][n] = ek[r][n-1] ^ ek[r-1][n]

- mov [esi-4],eax ;

- ; where n is 1..3. Hence the corresponding

-.0: mov edx,[esi] ; subkeys in the decryption round key dk[r]

- mf_call inv_mix_col ; also obey since inv_mix_col is linear in

- mov [esi],eax ; GF(256):

- xor eax,[esi-12] ;

- mov [esi+4],eax ; dk[r][n] = dk[r][n-1] ^ dk[r-1][n]

- xor eax,[esi-8] ;

- mov [esi+8],eax ; So we only need one inverse mix column

- xor eax,[esi-4] ; operation (n = 0) for each four word cycle

- mov [esi+12],eax ; in the expanded key.

- add esi,16

- cmp edi,esi

- jg .0

- jmp dec_end

-

-%endif

-

-%ifdef AES_192

-

-%ifndef DECRYPTION_TABLE

-; %define DECRYPTION_TABLE

-%endif

-

- do_name _aes_decrypt_key192,8

-

- push ebp

- push ebx

- push esi

- push edi

- mov eax,[esp+24] ; context

- mov edx,[esp+20] ; key

- push eax

- push edx

- do_call _aes_encrypt_key192,8 ; generate expanded encryption key

- mov eax,12*16

- mov esi,[esp+24] ; first round key

- lea edi,[esi+eax] ; last round key

- add esi,48 ; the first 6 words are the key, of

- ; which the top 2 words are part of

- mov edx,[esi-32] ; the second round key and hence

- mf_call inv_mix_col ; need to be modified. After this we

- mov [esi-32],eax ; need to do a further six values prior

- mov edx,[esi-28] ; to using a more efficient technique

- mf_call inv_mix_col ; based on:

- mov [esi-28],eax ;

- ; dk[r][n] = dk[r][n-1] ^ dk[r-1][n]

- mov edx,[esi-24] ;

- mf_call inv_mix_col ; for n = 1 .. 5 where the key expansion

- mov [esi-24],eax ; cycle is now 6 words long

- mov edx,[esi-20]

- mf_call inv_mix_col

- mov [esi-20],eax

- mov edx,[esi-16]

- mf_call inv_mix_col

- mov [esi-16],eax

- mov edx,[esi-12]

- mf_call inv_mix_col

- mov [esi-12],eax

- mov edx,[esi-8]

- mf_call inv_mix_col

- mov [esi-8],eax

- mov edx,[esi-4]

- mf_call inv_mix_col

- mov [esi-4],eax

-

-.0: mov edx,[esi] ; the expanded key is 13 * 4 = 44 32-bit words

- mf_call inv_mix_col ; of which 11 * 4 = 44 have to be modified

- mov [esi],eax ; using inv_mix_col. We have already done 8

- xor eax,[esi-20] ; of these so 36 are left - hence we need

- mov [esi+4],eax ; exactly 6 loops of six here

- xor eax,[esi-16]

- mov [esi+8],eax

- xor eax,[esi-12]

- mov [esi+12],eax

- xor eax,[esi-8]

- mov [esi+16],eax

- xor eax,[esi-4]

- mov [esi+20],eax

- add esi,24

- cmp edi,esi

- jg .0

- jmp dec_end

-

-%endif

-

-%ifdef AES_256

-

-%ifndef DECRYPTION_TABLE

-; %define DECRYPTION_TABLE

-%endif

-

- do_name _aes_decrypt_key256,8

-

- mov ax, sp

- movzx esp, ax

- push ebp

- push ebx

- push esi

- push edi

-

- movzx eax, word [esp+20] ; ks

- movzx edx, word [esp+18] ; key

- push ax

- push dx

- do_call _aes_encrypt_key256,4 ; generate expanded encryption key

- mov eax,14*16

- movzx esi, word [esp+20] ; ks

- lea edi,[esi+eax]

- add esi,64

-

- mov edx,[esi-48] ; the primary key is 8 words, of which

- mf_call inv_mix_col ; the top four require modification

- mov [esi-48],eax

- mov edx,[esi-44]

- mf_call inv_mix_col

- mov [esi-44],eax

- mov edx,[esi-40]

- mf_call inv_mix_col

- mov [esi-40],eax

- mov edx,[esi-36]

- mf_call inv_mix_col

- mov [esi-36],eax

-

- mov edx,[esi-32] ; the encryption key expansion cycle is

- mf_call inv_mix_col ; now eight words long so we need to

- mov [esi-32],eax ; start by doing one complete block

- mov edx,[esi-28]

- mf_call inv_mix_col

- mov [esi-28],eax

- mov edx,[esi-24]

- mf_call inv_mix_col

- mov [esi-24],eax

- mov edx,[esi-20]

- mf_call inv_mix_col

- mov [esi-20],eax

- mov edx,[esi-16]

- mf_call inv_mix_col

- mov [esi-16],eax

- mov edx,[esi-12]

- mf_call inv_mix_col

- mov [esi-12],eax

- mov edx,[esi-8]

- mf_call inv_mix_col

- mov [esi-8],eax

- mov edx,[esi-4]

- mf_call inv_mix_col

- mov [esi-4],eax

-

-.0: mov edx,[esi] ; we can now speed up the remaining

- mf_call inv_mix_col ; rounds by using the technique

- mov [esi],eax ; outlined earlier. But note that

- xor eax,[esi-28] ; there is one extra inverse mix

- mov [esi+4],eax ; column operation as the 256 bit

- xor eax,[esi-24] ; key has an extra non-linear step

- mov [esi+8],eax ; for the midway element.

- xor eax,[esi-20]

- mov [esi+12],eax ; the expanded key is 15 * 4 = 60

- mov edx,[esi+16] ; 32-bit words of which 52 need to

- mf_call inv_mix_col ; be modified. We have already done

- mov [esi+16],eax ; 12 so 40 are left - which means

- xor eax,[esi-12] ; that we need exactly 5 loops of 8

- mov [esi+20],eax

- xor eax,[esi-8]

- mov [esi+24],eax

- xor eax,[esi-4]

- mov [esi+28],eax

- add esi,32

- cmp edi,esi

- jg .0

-

-%endif

-

-dec_end:

-

-%ifdef AES_REV_DKS

-

- movzx esi,word [esp+20] ; this reverses the order of the

-.1: mov eax,[esi] ; round keys if required

- mov ebx,[esi+4]

- mov ebp,[edi]

- mov edx,[edi+4]

- mov [esi],ebp

- mov [esi+4],edx

- mov [edi],eax

- mov [edi+4],ebx

-

- mov eax,[esi+8]

- mov ebx,[esi+12]

- mov ebp,[edi+8]

- mov edx,[edi+12]

- mov [esi+8],ebp

- mov [esi+12],edx

- mov [edi+8],eax

- mov [edi+12],ebx

-

- add esi,16

- sub edi,16

- cmp edi,esi

- jg .1

-

-%endif

-

- pop edi

- pop esi

- pop ebx

- pop ebp

- xor eax,eax

- do_exit 8

-

-%ifdef AES_VAR

-

- do_name _aes_decrypt_key,12

-

- mov ecx,[esp+4]

- mov eax,[esp+8]

- mov edx,[esp+12]

- push edx

- push ecx

-

- cmp eax,16

- je .1

- cmp eax,128

- je .1

-

- cmp eax,24

- je .2

- cmp eax,192

- je .2

-

- cmp eax,32

- je .3

- cmp eax,256

- je .3

- mov eax,-1

- add esp,8

- do_exit 12

-

-.1: do_call _aes_decrypt_key128,8

- do_exit 12

-.2: do_call _aes_decrypt_key192,8

- do_exit 12

-.3: do_call _aes_decrypt_key256,8

- do_exit 12

-

-%endif

-

-%endif

-

-%ifdef DECRYPTION_TABLE

-

-; Inverse S-box data - 256 entries

-

- section _DATA

-

-%define v8(x) fe(x), f9(x), fd(x), fb(x), fe(x), f9(x), fd(x), x

-

-_aes_dec_tab:

- db v8(0x52),v8(0x09),v8(0x6a),v8(0xd5),v8(0x30),v8(0x36),v8(0xa5),v8(0x38)

- db v8(0xbf),v8(0x40),v8(0xa3),v8(0x9e),v8(0x81),v8(0xf3),v8(0xd7),v8(0xfb)

- db v8(0x7c),v8(0xe3),v8(0x39),v8(0x82),v8(0x9b),v8(0x2f),v8(0xff),v8(0x87)

- db v8(0x34),v8(0x8e),v8(0x43),v8(0x44),v8(0xc4),v8(0xde),v8(0xe9),v8(0xcb)

- db v8(0x54),v8(0x7b),v8(0x94),v8(0x32),v8(0xa6),v8(0xc2),v8(0x23),v8(0x3d)

- db v8(0xee),v8(0x4c),v8(0x95),v8(0x0b),v8(0x42),v8(0xfa),v8(0xc3),v8(0x4e)

- db v8(0x08),v8(0x2e),v8(0xa1),v8(0x66),v8(0x28),v8(0xd9),v8(0x24),v8(0xb2)

- db v8(0x76),v8(0x5b),v8(0xa2),v8(0x49),v8(0x6d),v8(0x8b),v8(0xd1),v8(0x25)

- db v8(0x72),v8(0xf8),v8(0xf6),v8(0x64),v8(0x86),v8(0x68),v8(0x98),v8(0x16)

- db v8(0xd4),v8(0xa4),v8(0x5c),v8(0xcc),v8(0x5d),v8(0x65),v8(0xb6),v8(0x92)

- db v8(0x6c),v8(0x70),v8(0x48),v8(0x50),v8(0xfd),v8(0xed),v8(0xb9),v8(0xda)

- db v8(0x5e),v8(0x15),v8(0x46),v8(0x57),v8(0xa7),v8(0x8d),v8(0x9d),v8(0x84)

- db v8(0x90),v8(0xd8),v8(0xab),v8(0x00),v8(0x8c),v8(0xbc),v8(0xd3),v8(0x0a)

- db v8(0xf7),v8(0xe4),v8(0x58),v8(0x05),v8(0xb8),v8(0xb3),v8(0x45),v8(0x06)

- db v8(0xd0),v8(0x2c),v8(0x1e),v8(0x8f),v8(0xca),v8(0x3f),v8(0x0f),v8(0x02)

- db v8(0xc1),v8(0xaf),v8(0xbd),v8(0x03),v8(0x01),v8(0x13),v8(0x8a),v8(0x6b)

- db v8(0x3a),v8(0x91),v8(0x11),v8(0x41),v8(0x4f),v8(0x67),v8(0xdc),v8(0xea)

- db v8(0x97),v8(0xf2),v8(0xcf),v8(0xce),v8(0xf0),v8(0xb4),v8(0xe6),v8(0x73)

- db v8(0x96),v8(0xac),v8(0x74),v8(0x22),v8(0xe7),v8(0xad),v8(0x35),v8(0x85)

- db v8(0xe2),v8(0xf9),v8(0x37),v8(0xe8),v8(0x1c),v8(0x75),v8(0xdf),v8(0x6e)

- db v8(0x47),v8(0xf1),v8(0x1a),v8(0x71),v8(0x1d),v8(0x29),v8(0xc5),v8(0x89)

- db v8(0x6f),v8(0xb7),v8(0x62),v8(0x0e),v8(0xaa),v8(0x18),v8(0xbe),v8(0x1b)

- db v8(0xfc),v8(0x56),v8(0x3e),v8(0x4b),v8(0xc6),v8(0xd2),v8(0x79),v8(0x20)

- db v8(0x9a),v8(0xdb),v8(0xc0),v8(0xfe),v8(0x78),v8(0xcd),v8(0x5a),v8(0xf4)

- db v8(0x1f),v8(0xdd),v8(0xa8),v8(0x33),v8(0x88),v8(0x07),v8(0xc7),v8(0x31)

- db v8(0xb1),v8(0x12),v8(0x10),v8(0x59),v8(0x27),v8(0x80),v8(0xec),v8(0x5f)

- db v8(0x60),v8(0x51),v8(0x7f),v8(0xa9),v8(0x19),v8(0xb5),v8(0x4a),v8(0x0d)

- db v8(0x2d),v8(0xe5),v8(0x7a),v8(0x9f),v8(0x93),v8(0xc9),v8(0x9c),v8(0xef)

- db v8(0xa0),v8(0xe0),v8(0x3b),v8(0x4d),v8(0xae),v8(0x2a),v8(0xf5),v8(0xb0)

- db v8(0xc8),v8(0xeb),v8(0xbb),v8(0x3c),v8(0x83),v8(0x53),v8(0x99),v8(0x61)

- db v8(0x17),v8(0x2b),v8(0x04),v8(0x7e),v8(0xba),v8(0x77),v8(0xd6),v8(0x26)

- db v8(0xe1),v8(0x69),v8(0x14),v8(0x63),v8(0x55),v8(0x21),v8(0x0c),v8(0x7d)

-

-%endif

-;

-; Copyright (c) 2010 TrueCrypt Developers Association. All rights reserved.

-;

-; Governed by the TrueCrypt License 3.0 the full text of which is contained in

-; the file License.txt included in TrueCrypt binary and source code distribution

-; packages.

-;

-

-

-%ifidn __BITS__, 16

- %define R e

-%elifidn __BITS__, 32

- %define R e

-%elifidn __BITS__, 64

- %define R r

-%endif

-

-

-%macro export_function 1-2 0

-

- %ifdef MS_STDCALL

- global %1@%2

- export _%1@%2

- %1@%2:

- %elifidn __BITS__, 16

- global _%1

- _%1:

- %else

- global %1

- %1:

- %endif

-

-%endmacro

-

-

-%macro aes_function_entry 1

-

- ; void (const byte *ks, byte *data);

-

- export_function %1, 8

-

- %ifidn __BITS__, 32

- mov ecx, [esp + 4 + 4 * 0]

- mov edx, [esp + 4 + 4 * 1]

- %elifidn __BITS__, 64

- %ifnidn __OUTPUT_FORMAT__, win64

- mov rcx, rdi

- mov rdx, rsi

- %endif

- %endif

-

- ; ecx/rcx = ks

- ; edx/rdx = data

-

-%endmacro

-

-

-%macro aes_function_exit 0

-

- ; void (const byte *, byte *);

-

- %ifdef MS_STDCALL

- ret 8

- %else

- ret

- %endif

-

-%endmacro

-

-

-%macro push_xmm 2

- sub rsp, 16 * (%2 - %1 + 1)

-

- %assign stackoffset 0

- %assign regnumber %1

-

- %rep (%2 - %1 + 1)

- movdqu [rsp + 16 * stackoffset], xmm%[regnumber]

-

- %assign stackoffset stackoffset+1

- %assign regnumber regnumber+1

- %endrep

-%endmacro

-

-

-%macro pop_xmm 2

- %assign stackoffset 0

- %assign regnumber %1

-

- %rep (%2 - %1 + 1)

- movdqu xmm%[regnumber], [rsp + 16 * stackoffset]

-

- %assign stackoffset stackoffset+1

- %assign regnumber regnumber+1

- %endrep

-

- add rsp, 16 * (%2 - %1 + 1)

-%endmacro

-

-

-%macro aes_hw_cpu 2

- %define OPERATION %1

- %define BLOCK_COUNT %2

-

- ; Load data blocks

- %assign block 1

- %rep BLOCK_COUNT

- movdqu xmm%[block], [%[R]dx + 16 * (block - 1)]

- %assign block block+1

- %endrep

-

- ; Encrypt/decrypt data blocks

- %assign round 0

- %rep 15

- movdqu xmm0, [%[R]cx + 16 * round]

-

- %assign block 1

- %rep BLOCK_COUNT

-

- %if round = 0

- pxor xmm%[block], xmm0

- %else

- %if round < 14

- aes%[OPERATION] xmm%[block], xmm0

- %else

- aes%[OPERATION]last xmm%[block], xmm0

- %endif

- %endif

-

- %assign block block+1

- %endrep

-

- %assign round round+1

- %endrep

-

- ; Store data blocks

- %assign block 1

- %rep BLOCK_COUNT

- movdqu [%[R]dx + 16 * (block - 1)], xmm%[block]

- %assign block block+1

- %endrep

-

- %undef OPERATION

- %undef BLOCK_COUNT

-%endmacro

-

-

-%macro aes_hw_cpu_32_blocks 1

- %define OPERATION_32_BLOCKS %1

-

- %ifidn __BITS__, 64

- %define MAX_REG_BLOCK_COUNT 15

- %else

- %define MAX_REG_BLOCK_COUNT 7

- %endif

-

- %ifidn __OUTPUT_FORMAT__, win64

- %if MAX_REG_BLOCK_COUNT > 5

- push_xmm 6, MAX_REG_BLOCK_COUNT

- %endif

- %endif

-

- mov eax, 32 / MAX_REG_BLOCK_COUNT

- .1:

- aes_hw_cpu %[OPERATION_32_BLOCKS], MAX_REG_BLOCK_COUNT

-

- add %[R]dx, 16 * MAX_REG_BLOCK_COUNT

- dec eax

- jnz .1

-

- %if (32 % MAX_REG_BLOCK_COUNT) != 0

- aes_hw_cpu %[OPERATION_32_BLOCKS], (32 % MAX_REG_BLOCK_COUNT)

- %endif

-

- %ifidn __OUTPUT_FORMAT__, win64

- %if MAX_REG_BLOCK_COUNT > 5

- pop_xmm 6, MAX_REG_BLOCK_COUNT

- %endif

- %endif

-

- %undef OPERATION_32_BLOCKS

- %undef MAX_REG_BLOCK_COUNT

-%endmacro

-

-

-%ifidn __BITS__, 16

-

- USE16

- SEGMENT _TEXT PUBLIC CLASS=CODE USE16

- SEGMENT _DATA PUBLIC CLASS=DATA USE16

- GROUP DGROUP _TEXT _DATA

- SECTION _TEXT

-

-%else

-

- SECTION .text

-

-%endif

-

-

-; void aes_hw_cpu_enable_sse ();

-

- export_function aes_hw_cpu_enable_sse

- mov %[R]ax, cr4

- or ax, 1 << 9

- mov cr4, %[R]ax

- ret

-

-

-%ifidn __BITS__, 16

-

-

-; byte is_aes_hw_cpu_supported ();

-

- export_function is_aes_hw_cpu_supported

- mov eax, 1

- cpuid

- mov eax, ecx

- shr eax, 25

- and al, 1

- ret

-

-

-; void aes_hw_cpu_decrypt (const byte *ks, byte *data);

-

- export_function aes_hw_cpu_decrypt

- mov ax, -16

- jmp aes_hw_cpu_encrypt_decrypt

-

-; void aes_hw_cpu_encrypt (const byte *ks, byte *data);

-

- export_function aes_hw_cpu_encrypt

- mov ax, 16

-

- aes_hw_cpu_encrypt_decrypt:

- push bp

- mov bp, sp

- push di

- push si

-

- mov si, [bp + 4] ; ks

- mov di, [bp + 4 + 2] ; data

-

- movdqu xmm0, [si]

- movdqu xmm1, [di]

-

- pxor xmm1, xmm0

-

- mov cx, 13

-

- .round1_13:

- add si, ax

- movdqu xmm0, [si]

-

- cmp ax, 0

- jl .decrypt

-

- aesenc xmm1, xmm0

- jmp .2

- .decrypt:

- aesdec xmm1, xmm0

- .2:

- loop .round1_13

-

- add si, ax

- movdqu xmm0, [si]

-

- cmp ax, 0

- jl .decrypt_last

-

- aesenclast xmm1, xmm0

- jmp .3

- .decrypt_last:

- aesdeclast xmm1, xmm0

- .3:

- movdqu [di], xmm1

-

- pop si

- pop di

- pop bp

- ret

-

-

-%else ; __BITS__ != 16

-

-

-; byte is_aes_hw_cpu_supported ();

-

- export_function is_aes_hw_cpu_supported

- push %[R]bx

-

- mov eax, 1

- cpuid

- mov eax, ecx

- shr eax, 25

- and eax, 1

-

- pop %[R]bx

- ret

-

-

-; void aes_hw_cpu_decrypt (const byte *ks, byte *data);

-

- aes_function_entry aes_hw_cpu_decrypt

- aes_hw_cpu dec, 1

- aes_function_exit

-

-

-; void aes_hw_cpu_decrypt_32_blocks (const byte *ks, byte *data);

-

- aes_function_entry aes_hw_cpu_decrypt_32_blocks

- aes_hw_cpu_32_blocks dec

- aes_function_exit

-

-

-; void aes_hw_cpu_encrypt (const byte *ks, byte *data);

-

- aes_function_entry aes_hw_cpu_encrypt

- aes_hw_cpu enc, 1

- aes_function_exit

-

-

-; void aes_hw_cpu_encrypt_32_blocks (const byte *ks, byte *data);

-

- aes_function_entry aes_hw_cpu_encrypt_32_blocks

- aes_hw_cpu_32_blocks enc

- aes_function_exit

-

-

-%endif ; __BITS__ != 16

-*/

-

-#ifndef TC_HEADER_Crypto_Aes_Hw_Cpu

-#define TC_HEADER_Crypto_Aes_Hw_Cpu

-

-#include "Common/Tcdefs.h"

-

-#if defined(__cplusplus)

-extern "C"

-{

-#endif

-

-byte is_aes_hw_cpu_supported ();

-void aes_hw_cpu_enable_sse ();

-void aes_hw_cpu_decrypt (const byte *ks, byte *data);

-void aes_hw_cpu_decrypt_32_blocks (const byte *ks, byte *data);

-void aes_hw_cpu_encrypt (const byte *ks, byte *data);

-void aes_hw_cpu_encrypt_32_blocks (const byte *ks, byte *data);

-

-#if defined(__cplusplus)

-}

-#endif

-

-#endif // TC_HEADER_Crypto_Aes_Hw_Cpu

-

-; ---------------------------------------------------------------------------

-; Copyright (c) 1998-2007, Brian Gladman, Worcester, UK. All rights reserved.

-;

-; LICENSE TERMS

-;

-; The free distribution and use of this software is allowed (with or without

-; changes) provided that:

-;

-; 1. source code distributions include the above copyright notice, this

-; list of conditions and the following disclaimer;

-;

-; 2. binary distributions include the above copyright notice, this list

-; of conditions and the following disclaimer in their documentation;

-;

-; 3. the name of the copyright holder is not used to endorse products

-; built using this software without specific written permission.

-;

-; DISCLAIMER

-;

-; This software is provided 'as is' with no explicit or implied warranties

-; in respect of its properties, including, but not limited to, correctness

-; and/or fitness for purpose.

-; ---------------------------------------------------------------------------

-; Issue 20/12/2007

-;

-; I am grateful to Dag Arne Osvik for many discussions of the techniques that

-; can be used to optimise AES assembler code on AMD64/EM64T architectures.

-; Some of the techniques used in this implementation are the result of

-; suggestions made by him for which I am most grateful.

-

-;

-; Adapted for TrueCrypt:

-; - Compatibility with NASM

-;

-

-; An AES implementation for AMD64 processors using the YASM assembler. This

-; implemetation provides only encryption, decryption and hence requires key

-; scheduling support in C. It uses 8k bytes of tables but its encryption and

-; decryption performance is very close to that obtained using large tables.

-; It can use either Windows or Gnu/Linux calling conventions, which are as

-; follows:

-; windows gnu/linux

-;

-; in_blk rcx rdi

-; out_blk rdx rsi

-; context (cx) r8 rdx

-;

-; preserved rsi - + rbx, rbp, rsp, r12, r13, r14 & r15

-; registers rdi - on both

-;

-; destroyed - rsi + rax, rcx, rdx, r8, r9, r10 & r11

-; registers - rdi on both

-;

-; The default convention is that for windows, the gnu/linux convention being

-; used if __GNUC__ is defined.

-;

-; Define _SEH_ to include support for Win64 structured exception handling

-; (this requires YASM version 0.6 or later).

-;

-; This code provides the standard AES block size (128 bits, 16 bytes) and the

-; three standard AES key sizes (128, 192 and 256 bits). It has the same call

-; interface as my C implementation. It uses the Microsoft C AMD64 calling

-; conventions in which the three parameters are placed in rcx, rdx and r8

-; respectively. The rbx, rsi, rdi, rbp and r12..r15 registers are preserved.

-;

-; AES_RETURN aes_encrypt(const unsigned char in_blk[],

-; unsigned char out_blk[], const aes_encrypt_ctx cx[1]);

-;

-; AES_RETURN aes_decrypt(const unsigned char in_blk[],

-; unsigned char out_blk[], const aes_decrypt_ctx cx[1]);

-;

-; AES_RETURN aes_encrypt_key<NNN>(const unsigned char key[],

-; const aes_encrypt_ctx cx[1]);

-;

-; AES_RETURN aes_decrypt_key<NNN>(const unsigned char key[],

-; const aes_decrypt_ctx cx[1]);

-;

-; AES_RETURN aes_encrypt_key(const unsigned char key[],

-; unsigned int len, const aes_decrypt_ctx cx[1]);

-;

-; AES_RETURN aes_decrypt_key(const unsigned char key[],

-; unsigned int len, const aes_decrypt_ctx cx[1]);

-;

-; where <NNN> is 128, 102 or 256. In the last two calls the length can be in

-; either bits or bytes.

-;

-; Comment in/out the following lines to obtain the desired subroutines. These

-; selections MUST match those in the C header file aes.h

-

-; %define AES_128 ; define if AES with 128 bit keys is needed

-; %define AES_192 ; define if AES with 192 bit keys is needed

-%define AES_256 ; define if AES with 256 bit keys is needed

-; %define AES_VAR ; define if a variable key size is needed

-%define ENCRYPTION ; define if encryption is needed

-%define DECRYPTION ; define if decryption is needed

-%define AES_REV_DKS ; define if key decryption schedule is reversed

-%define LAST_ROUND_TABLES ; define for the faster version using extra tables

-

-; The encryption key schedule has the following in memory layout where N is the

-; number of rounds (10, 12 or 14):

-;

-; lo: | input key (round 0) | ; each round is four 32-bit words

-; | encryption round 1 |

-; | encryption round 2 |

-; ....

-; | encryption round N-1 |

-; hi: | encryption round N |

-;

-; The decryption key schedule is normally set up so that it has the same

-; layout as above by actually reversing the order of the encryption key

-; schedule in memory (this happens when AES_REV_DKS is set):

-;

-; lo: | decryption round 0 | = | encryption round N |

-; | decryption round 1 | = INV_MIX_COL[ | encryption round N-1 | ]

-; | decryption round 2 | = INV_MIX_COL[ | encryption round N-2 | ]

-; .... ....

-; | decryption round N-1 | = INV_MIX_COL[ | encryption round 1 | ]

-; hi: | decryption round N | = | input key (round 0) |

-;

-; with rounds except the first and last modified using inv_mix_column()

-; But if AES_REV_DKS is NOT set the order of keys is left as it is for

-; encryption so that it has to be accessed in reverse when used for

-; decryption (although the inverse mix column modifications are done)

-;

-; lo: | decryption round 0 | = | input key (round 0) |

-; | decryption round 1 | = INV_MIX_COL[ | encryption round 1 | ]

-; | decryption round 2 | = INV_MIX_COL[ | encryption round 2 | ]

-; .... ....

-; | decryption round N-1 | = INV_MIX_COL[ | encryption round N-1 | ]

-; hi: | decryption round N | = | encryption round N |

-;

-; This layout is faster when the assembler key scheduling provided here

-; is used.

-;

-; The DLL interface must use the _stdcall convention in which the number

-; of bytes of parameter space is added after an @ to the sutine's name.

-; We must also remove our parameters from the stack before return (see

-; the do_exit macro). Define DLL_EXPORT for the Dynamic Link Library version.

-

-;%define DLL_EXPORT

-

-; End of user defines

-

-%ifdef AES_VAR

-%ifndef AES_128

-%define AES_128

-%endif

-%ifndef AES_192

-%define AES_192

-%endif

-%ifndef AES_256

-%define AES_256

-%endif

-%endif

-

-%ifdef AES_VAR

-%define KS_LENGTH 60

-%elifdef AES_256

-%define KS_LENGTH 60

-%elifdef AES_192

-%define KS_LENGTH 52

-%else

-%define KS_LENGTH 44

-%endif

-

-%define r0 rax

-%define r1 rdx

-%define r2 rcx

-%define r3 rbx

-%define r4 rsi

-%define r5 rdi

-%define r6 rbp

-%define r7 rsp

-

-%define raxd eax

-%define rdxd edx

-%define rcxd ecx

-%define rbxd ebx

-%define rsid esi

-%define rdid edi

-%define rbpd ebp

-%define rspd esp

-

-%define raxb al

-%define rdxb dl

-%define rcxb cl

-%define rbxb bl

-%define rsib sil

-%define rdib dil

-%define rbpb bpl

-%define rspb spl

-

-%define r0h ah

-%define r1h dh

-%define r2h ch

-%define r3h bh

-

-%define r0d eax

-%define r1d edx

-%define r2d ecx

-%define r3d ebx

-

-; finite field multiplies by {02}, {04} and {08}

-

-%define f2(x) ((x<<1)^(((x>>7)&1)*0x11b))

-%define f4(x) ((x<<2)^(((x>>6)&1)*0x11b)^(((x>>6)&2)*0x11b))

-%define f8(x) ((x<<3)^(((x>>5)&1)*0x11b)^(((x>>5)&2)*0x11b)^(((x>>5)&4)*0x11b))

-

-; finite field multiplies required in table generation

-

-%define f3(x) (f2(x) ^ x)

-%define f9(x) (f8(x) ^ x)

-%define fb(x) (f8(x) ^ f2(x) ^ x)

-%define fd(x) (f8(x) ^ f4(x) ^ x)

-%define fe(x) (f8(x) ^ f4(x) ^ f2(x))

-

-; macro for expanding S-box data

-

-%macro enc_vals 1

- db %1(0x63),%1(0x7c),%1(0x77),%1(0x7b),%1(0xf2),%1(0x6b),%1(0x6f),%1(0xc5)

- db %1(0x30),%1(0x01),%1(0x67),%1(0x2b),%1(0xfe),%1(0xd7),%1(0xab),%1(0x76)

- db %1(0xca),%1(0x82),%1(0xc9),%1(0x7d),%1(0xfa),%1(0x59),%1(0x47),%1(0xf0)

- db %1(0xad),%1(0xd4),%1(0xa2),%1(0xaf),%1(0x9c),%1(0xa4),%1(0x72),%1(0xc0)

- db %1(0xb7),%1(0xfd),%1(0x93),%1(0x26),%1(0x36),%1(0x3f),%1(0xf7),%1(0xcc)

- db %1(0x34),%1(0xa5),%1(0xe5),%1(0xf1),%1(0x71),%1(0xd8),%1(0x31),%1(0x15)

- db %1(0x04),%1(0xc7),%1(0x23),%1(0xc3),%1(0x18),%1(0x96),%1(0x05),%1(0x9a)

- db %1(0x07),%1(0x12),%1(0x80),%1(0xe2),%1(0xeb),%1(0x27),%1(0xb2),%1(0x75)

- db %1(0x09),%1(0x83),%1(0x2c),%1(0x1a),%1(0x1b),%1(0x6e),%1(0x5a),%1(0xa0)

- db %1(0x52),%1(0x3b),%1(0xd6),%1(0xb3),%1(0x29),%1(0xe3),%1(0x2f),%1(0x84)

- db %1(0x53),%1(0xd1),%1(0x00),%1(0xed),%1(0x20),%1(0xfc),%1(0xb1),%1(0x5b)

- db %1(0x6a),%1(0xcb),%1(0xbe),%1(0x39),%1(0x4a),%1(0x4c),%1(0x58),%1(0xcf)

- db %1(0xd0),%1(0xef),%1(0xaa),%1(0xfb),%1(0x43),%1(0x4d),%1(0x33),%1(0x85)

- db %1(0x45),%1(0xf9),%1(0x02),%1(0x7f),%1(0x50),%1(0x3c),%1(0x9f),%1(0xa8)

- db %1(0x51),%1(0xa3),%1(0x40),%1(0x8f),%1(0x92),%1(0x9d),%1(0x38),%1(0xf5)

- db %1(0xbc),%1(0xb6),%1(0xda),%1(0x21),%1(0x10),%1(0xff),%1(0xf3),%1(0xd2)

- db %1(0xcd),%1(0x0c),%1(0x13),%1(0xec),%1(0x5f),%1(0x97),%1(0x44),%1(0x17)

- db %1(0xc4),%1(0xa7),%1(0x7e),%1(0x3d),%1(0x64),%1(0x5d),%1(0x19),%1(0x73)

- db %1(0x60),%1(0x81),%1(0x4f),%1(0xdc),%1(0x22),%1(0x2a),%1(0x90),%1(0x88)

- db %1(0x46),%1(0xee),%1(0xb8),%1(0x14),%1(0xde),%1(0x5e),%1(0x0b),%1(0xdb)

- db %1(0xe0),%1(0x32),%1(0x3a),%1(0x0a),%1(0x49),%1(0x06),%1(0x24),%1(0x5c)

- db %1(0xc2),%1(0xd3),%1(0xac),%1(0x62),%1(0x91),%1(0x95),%1(0xe4),%1(0x79)

- db %1(0xe7),%1(0xc8),%1(0x37),%1(0x6d),%1(0x8d),%1(0xd5),%1(0x4e),%1(0xa9)

- db %1(0x6c),%1(0x56),%1(0xf4),%1(0xea),%1(0x65),%1(0x7a),%1(0xae),%1(0x08)

- db %1(0xba),%1(0x78),%1(0x25),%1(0x2e),%1(0x1c),%1(0xa6),%1(0xb4),%1(0xc6)

- db %1(0xe8),%1(0xdd),%1(0x74),%1(0x1f),%1(0x4b),%1(0xbd),%1(0x8b),%1(0x8a)

- db %1(0x70),%1(0x3e),%1(0xb5),%1(0x66),%1(0x48),%1(0x03),%1(0xf6),%1(0x0e)

- db %1(0x61),%1(0x35),%1(0x57),%1(0xb9),%1(0x86),%1(0xc1),%1(0x1d),%1(0x9e)

- db %1(0xe1),%1(0xf8),%1(0x98),%1(0x11),%1(0x69),%1(0xd9),%1(0x8e),%1(0x94)

- db %1(0x9b),%1(0x1e),%1(0x87),%1(0xe9),%1(0xce),%1(0x55),%1(0x28),%1(0xdf)

- db %1(0x8c),%1(0xa1),%1(0x89),%1(0x0d),%1(0xbf),%1(0xe6),%1(0x42),%1(0x68)

- db %1(0x41),%1(0x99),%1(0x2d),%1(0x0f),%1(0xb0),%1(0x54),%1(0xbb),%1(0x16)

-%endmacro

-

-%macro dec_vals 1

- db %1(0x52),%1(0x09),%1(0x6a),%1(0xd5),%1(0x30),%1(0x36),%1(0xa5),%1(0x38)

- db %1(0xbf),%1(0x40),%1(0xa3),%1(0x9e),%1(0x81),%1(0xf3),%1(0xd7),%1(0xfb)

- db %1(0x7c),%1(0xe3),%1(0x39),%1(0x82),%1(0x9b),%1(0x2f),%1(0xff),%1(0x87)

- db %1(0x34),%1(0x8e),%1(0x43),%1(0x44),%1(0xc4),%1(0xde),%1(0xe9),%1(0xcb)

- db %1(0x54),%1(0x7b),%1(0x94),%1(0x32),%1(0xa6),%1(0xc2),%1(0x23),%1(0x3d)

- db %1(0xee),%1(0x4c),%1(0x95),%1(0x0b),%1(0x42),%1(0xfa),%1(0xc3),%1(0x4e)

- db %1(0x08),%1(0x2e),%1(0xa1),%1(0x66),%1(0x28),%1(0xd9),%1(0x24),%1(0xb2)

- db %1(0x76),%1(0x5b),%1(0xa2),%1(0x49),%1(0x6d),%1(0x8b),%1(0xd1),%1(0x25)

- db %1(0x72),%1(0xf8),%1(0xf6),%1(0x64),%1(0x86),%1(0x68),%1(0x98),%1(0x16)

- db %1(0xd4),%1(0xa4),%1(0x5c),%1(0xcc),%1(0x5d),%1(0x65),%1(0xb6),%1(0x92)

- db %1(0x6c),%1(0x70),%1(0x48),%1(0x50),%1(0xfd),%1(0xed),%1(0xb9),%1(0xda)

- db %1(0x5e),%1(0x15),%1(0x46),%1(0x57),%1(0xa7),%1(0x8d),%1(0x9d),%1(0x84)

- db %1(0x90),%1(0xd8),%1(0xab),%1(0x00),%1(0x8c),%1(0xbc),%1(0xd3),%1(0x0a)

- db %1(0xf7),%1(0xe4),%1(0x58),%1(0x05),%1(0xb8),%1(0xb3),%1(0x45),%1(0x06)

- db %1(0xd0),%1(0x2c),%1(0x1e),%1(0x8f),%1(0xca),%1(0x3f),%1(0x0f),%1(0x02)

- db %1(0xc1),%1(0xaf),%1(0xbd),%1(0x03),%1(0x01),%1(0x13),%1(0x8a),%1(0x6b)

- db %1(0x3a),%1(0x91),%1(0x11),%1(0x41),%1(0x4f),%1(0x67),%1(0xdc),%1(0xea)

- db %1(0x97),%1(0xf2),%1(0xcf),%1(0xce),%1(0xf0),%1(0xb4),%1(0xe6),%1(0x73)

- db %1(0x96),%1(0xac),%1(0x74),%1(0x22),%1(0xe7),%1(0xad),%1(0x35),%1(0x85)

- db %1(0xe2),%1(0xf9),%1(0x37),%1(0xe8),%1(0x1c),%1(0x75),%1(0xdf),%1(0x6e)

- db %1(0x47),%1(0xf1),%1(0x1a),%1(0x71),%1(0x1d),%1(0x29),%1(0xc5),%1(0x89)

- db %1(0x6f),%1(0xb7),%1(0x62),%1(0x0e),%1(0xaa),%1(0x18),%1(0xbe),%1(0x1b)

- db %1(0xfc),%1(0x56),%1(0x3e),%1(0x4b),%1(0xc6),%1(0xd2),%1(0x79),%1(0x20)

- db %1(0x9a),%1(0xdb),%1(0xc0),%1(0xfe),%1(0x78),%1(0xcd),%1(0x5a),%1(0xf4)

- db %1(0x1f),%1(0xdd),%1(0xa8),%1(0x33),%1(0x88),%1(0x07),%1(0xc7),%1(0x31)

- db %1(0xb1),%1(0x12),%1(0x10),%1(0x59),%1(0x27),%1(0x80),%1(0xec),%1(0x5f)

- db %1(0x60),%1(0x51),%1(0x7f),%1(0xa9),%1(0x19),%1(0xb5),%1(0x4a),%1(0x0d)

- db %1(0x2d),%1(0xe5),%1(0x7a),%1(0x9f),%1(0x93),%1(0xc9),%1(0x9c),%1(0xef)

- db %1(0xa0),%1(0xe0),%1(0x3b),%1(0x4d),%1(0xae),%1(0x2a),%1(0xf5),%1(0xb0)

- db %1(0xc8),%1(0xeb),%1(0xbb),%1(0x3c),%1(0x83),%1(0x53),%1(0x99),%1(0x61)

- db %1(0x17),%1(0x2b),%1(0x04),%1(0x7e),%1(0xba),%1(0x77),%1(0xd6),%1(0x26)

- db %1(0xe1),%1(0x69),%1(0x14),%1(0x63),%1(0x55),%1(0x21),%1(0x0c),%1(0x7d)

-%endmacro

-

-%define u8(x) f2(x), x, x, f3(x), f2(x), x, x, f3(x)

-%define v8(x) fe(x), f9(x), fd(x), fb(x), fe(x), f9(x), fd(x), x

-%define w8(x) x, 0, 0, 0, x, 0, 0, 0

-

-%define tptr rbp ; table pointer

-%define kptr r8 ; key schedule pointer

-%define fofs 128 ; adjust offset in key schedule to keep |disp| < 128

-%define fk_ref(x,y) [kptr-16*x+fofs+4*y]

-%ifdef AES_REV_DKS

-%define rofs 128

-%define ik_ref(x,y) [kptr-16*x+rofs+4*y]

-%else

-%define rofs -128

-%define ik_ref(x,y) [kptr+16*x+rofs+4*y]

-%endif

-

-%define tab_0(x) [tptr+8*x]

-%define tab_1(x) [tptr+8*x+3]

-%define tab_2(x) [tptr+8*x+2]

-%define tab_3(x) [tptr+8*x+1]

-%define tab_f(x) byte [tptr+8*x+1]

-%define tab_i(x) byte [tptr+8*x+7]

-%define t_ref(x,r) tab_ %+ x(r)

-

-%macro ff_rnd 5 ; normal forward round

- mov %1d, fk_ref(%5,0)

- mov %2d, fk_ref(%5,1)

- mov %3d, fk_ref(%5,2)

- mov %4d, fk_ref(%5,3)

-

- movzx esi, al

- movzx edi, ah

- shr eax, 16

- xor %1d, t_ref(0,rsi)

- xor %4d, t_ref(1,rdi)

- movzx esi, al

- movzx edi, ah

- xor %3d, t_ref(2,rsi)

- xor %2d, t_ref(3,rdi)

-

- movzx esi, bl

- movzx edi, bh

- shr ebx, 16

- xor %2d, t_ref(0,rsi)

- xor %1d, t_ref(1,rdi)

- movzx esi, bl

- movzx edi, bh

- xor %4d, t_ref(2,rsi)

- xor %3d, t_ref(3,rdi)

-

- movzx esi, cl

- movzx edi, ch

- shr ecx, 16

- xor %3d, t_ref(0,rsi)

- xor %2d, t_ref(1,rdi)

- movzx esi, cl

- movzx edi, ch

- xor %1d, t_ref(2,rsi)

- xor %4d, t_ref(3,rdi)

-

- movzx esi, dl

- movzx edi, dh

- shr edx, 16

- xor %4d, t_ref(0,rsi)

- xor %3d, t_ref(1,rdi)

- movzx esi, dl

- movzx edi, dh

- xor %2d, t_ref(2,rsi)

- xor %1d, t_ref(3,rdi)

-

- mov eax,%1d

- mov ebx,%2d

- mov ecx,%3d

- mov edx,%4d

-%endmacro

-

-%ifdef LAST_ROUND_TABLES

-

-%macro fl_rnd 5 ; last forward round

- add tptr, 2048

- mov %1d, fk_ref(%5,0)

- mov %2d, fk_ref(%5,1)

- mov %3d, fk_ref(%5,2)

- mov %4d, fk_ref(%5,3)

-

- movzx esi, al

- movzx edi, ah

- shr eax, 16

- xor %1d, t_ref(0,rsi)

- xor %4d, t_ref(1,rdi)

- movzx esi, al

- movzx edi, ah

- xor %3d, t_ref(2,rsi)

- xor %2d, t_ref(3,rdi)

-

- movzx esi, bl

- movzx edi, bh

- shr ebx, 16

- xor %2d, t_ref(0,rsi)

- xor %1d, t_ref(1,rdi)

- movzx esi, bl

- movzx edi, bh

- xor %4d, t_ref(2,rsi)

- xor %3d, t_ref(3,rdi)

-

- movzx esi, cl

- movzx edi, ch

- shr ecx, 16

- xor %3d, t_ref(0,rsi)

- xor %2d, t_ref(1,rdi)

- movzx esi, cl

- movzx edi, ch

- xor %1d, t_ref(2,rsi)

- xor %4d, t_ref(3,rdi)

-

- movzx esi, dl

- movzx edi, dh

- shr edx, 16

- xor %4d, t_ref(0,rsi)

- xor %3d, t_ref(1,rdi)

- movzx esi, dl

- movzx edi, dh

- xor %2d, t_ref(2,rsi)

- xor %1d, t_ref(3,rdi)

-%endmacro

-

-%else

-

-%macro fl_rnd 5 ; last forward round

- mov %1d, fk_ref(%5,0)

- mov %2d, fk_ref(%5,1)

- mov %3d, fk_ref(%5,2)

- mov %4d, fk_ref(%5,3)

-

- movzx esi, al

- movzx edi, ah

- shr eax, 16

- movzx esi, t_ref(f,rsi)

- movzx edi, t_ref(f,rdi)

- xor %1d, esi

- rol edi, 8

- xor %4d, edi

- movzx esi, al

- movzx edi, ah

- movzx esi, t_ref(f,rsi)

- movzx edi, t_ref(f,rdi)

- rol esi, 16

- rol edi, 24

- xor %3d, esi

- xor %2d, edi

-

- movzx esi, bl

- movzx edi, bh

- shr ebx, 16

- movzx esi, t_ref(f,rsi)

- movzx edi, t_ref(f,rdi)

- xor %2d, esi

- rol edi, 8

- xor %1d, edi

- movzx esi, bl

- movzx edi, bh

- movzx esi, t_ref(f,rsi)

- movzx edi, t_ref(f,rdi)

- rol esi, 16

- rol edi, 24

- xor %4d, esi

- xor %3d, edi

-

- movzx esi, cl

- movzx edi, ch

- movzx esi, t_ref(f,rsi)

- movzx edi, t_ref(f,rdi)

- shr ecx, 16

- xor %3d, esi

- rol edi, 8

- xor %2d, edi

- movzx esi, cl

- movzx edi, ch

- movzx esi, t_ref(f,rsi)

- movzx edi, t_ref(f,rdi)

- rol esi, 16

- rol edi, 24

- xor %1d, esi

- xor %4d, edi

-

- movzx esi, dl

- movzx edi, dh

- movzx esi, t_ref(f,rsi)

- movzx edi, t_ref(f,rdi)

- shr edx, 16

- xor %4d, esi

- rol edi, 8

- xor %3d, edi

- movzx esi, dl

- movzx edi, dh

- movzx esi, t_ref(f,rsi)

- movzx edi, t_ref(f,rdi)

- rol esi, 16

- rol edi, 24

- xor %2d, esi

- xor %1d, edi

-%endmacro

-

-%endif

-

-%macro ii_rnd 5 ; normal inverse round

- mov %1d, ik_ref(%5,0)

- mov %2d, ik_ref(%5,1)

- mov %3d, ik_ref(%5,2)

- mov %4d, ik_ref(%5,3)

-

- movzx esi, al

- movzx edi, ah

- shr eax, 16

- xor %1d, t_ref(0,rsi)

- xor %2d, t_ref(1,rdi)

- movzx esi, al

- movzx edi, ah

- xor %3d, t_ref(2,rsi)

- xor %4d, t_ref(3,rdi)

-

- movzx esi, bl

- movzx edi, bh

- shr ebx, 16

- xor %2d, t_ref(0,rsi)

- xor %3d, t_ref(1,rdi)

- movzx esi, bl

- movzx edi, bh

- xor %4d, t_ref(2,rsi)

- xor %1d, t_ref(3,rdi)

-

- movzx esi, cl

- movzx edi, ch

- shr ecx, 16

- xor %3d, t_ref(0,rsi)

- xor %4d, t_ref(1,rdi)

- movzx esi, cl

- movzx edi, ch

- xor %1d, t_ref(2,rsi)

- xor %2d, t_ref(3,rdi)

-

- movzx esi, dl

- movzx edi, dh

- shr edx, 16

- xor %4d, t_ref(0,rsi)

- xor %1d, t_ref(1,rdi)

- movzx esi, dl

- movzx edi, dh

- xor %2d, t_ref(2,rsi)

- xor %3d, t_ref(3,rdi)

-

- mov eax,%1d

- mov ebx,%2d

- mov ecx,%3d

- mov edx,%4d

-%endmacro

-

-%ifdef LAST_ROUND_TABLES

-

-%macro il_rnd 5 ; last inverse round

- add tptr, 2048

- mov %1d, ik_ref(%5,0)

- mov %2d, ik_ref(%5,1)

- mov %3d, ik_ref(%5,2)

- mov %4d, ik_ref(%5,3)

-

- movzx esi, al

- movzx edi, ah

- shr eax, 16

- xor %1d, t_ref(0,rsi)

- xor %2d, t_ref(1,rdi)

- movzx esi, al

- movzx edi, ah

- xor %3d, t_ref(2,rsi)

- xor %4d, t_ref(3,rdi)

-

- movzx esi, bl

- movzx edi, bh

- shr ebx, 16

- xor %2d, t_ref(0,rsi)

- xor %3d, t_ref(1,rdi)

- movzx esi, bl

- movzx edi, bh

- xor %4d, t_ref(2,rsi)

- xor %1d, t_ref(3,rdi)

-

- movzx esi, cl

- movzx edi, ch

- shr ecx, 16

- xor %3d, t_ref(0,rsi)

- xor %4d, t_ref(1,rdi)

- movzx esi, cl

- movzx edi, ch

- xor %1d, t_ref(2,rsi)

- xor %2d, t_ref(3,rdi)

-

- movzx esi, dl

- movzx edi, dh

- shr edx, 16

- xor %4d, t_ref(0,rsi)

- xor %1d, t_ref(1,rdi)

- movzx esi, dl

- movzx edi, dh

- xor %2d, t_ref(2,rsi)

- xor %3d, t_ref(3,rdi)

-%endmacro

-

-%else

-

-%macro il_rnd 5 ; last inverse round

- mov %1d, ik_ref(%5,0)

- mov %2d, ik_ref(%5,1)

- mov %3d, ik_ref(%5,2)

- mov %4d, ik_ref(%5,3)

-

- movzx esi, al

- movzx edi, ah

- movzx esi, t_ref(i,rsi)

- movzx edi, t_ref(i,rdi)

- shr eax, 16

- xor %1d, esi

- rol edi, 8

- xor %2d, edi

- movzx esi, al

- movzx edi, ah

- movzx esi, t_ref(i,rsi)

- movzx edi, t_ref(i,rdi)

- rol esi, 16

- rol edi, 24

- xor %3d, esi

- xor %4d, edi

-

- movzx esi, bl

- movzx edi, bh

- movzx esi, t_ref(i,rsi)

- movzx edi, t_ref(i,rdi)

- shr ebx, 16

- xor %2d, esi

- rol edi, 8

- xor %3d, edi

- movzx esi, bl

- movzx edi, bh

- movzx esi, t_ref(i,rsi)

- movzx edi, t_ref(i,rdi)

- rol esi, 16

- rol edi, 24

- xor %4d, esi

- xor %1d, edi

-

- movzx esi, cl

- movzx edi, ch

- movzx esi, t_ref(i,rsi)

- movzx edi, t_ref(i,rdi)

- shr ecx, 16

- xor %3d, esi

- rol edi, 8

- xor %4d, edi

- movzx esi, cl

- movzx edi, ch

- movzx esi, t_ref(i,rsi)

- movzx edi, t_ref(i,rdi)

- rol esi, 16

- rol edi, 24

- xor %1d, esi

- xor %2d, edi

-

- movzx esi, dl

- movzx edi, dh

- movzx esi, t_ref(i,rsi)

- movzx edi, t_ref(i,rdi)

- shr edx, 16

- xor %4d, esi

- rol edi, 8

- xor %1d, edi

- movzx esi, dl

- movzx edi, dh

- movzx esi, t_ref(i,rsi)

- movzx edi, t_ref(i,rdi)

- rol esi, 16

- rol edi, 24

- xor %2d, esi

- xor %3d, edi

-%endmacro

-

-%endif

-

-%ifdef ENCRYPTION

-

- global aes_encrypt

-%ifdef DLL_EXPORT

- export aes_encrypt

-%endif

-

- section .data align=64

- align 64

-enc_tab:

- enc_vals u8

-%ifdef LAST_ROUND_TABLES

- enc_vals w8

-%endif

-

- section .text align=16

- align 16

-

-%ifdef _SEH_

-proc_frame aes_encrypt

- alloc_stack 7*8 ; 7 to align stack to 16 bytes

- save_reg rsi,4*8

- save_reg rdi,5*8

- save_reg rbx,1*8

- save_reg rbp,2*8

- save_reg r12,3*8

-end_prologue

- mov rdi, rcx ; input pointer

- mov [rsp+0*8], rdx ; output pointer

-%else

- aes_encrypt:

- %ifdef __GNUC__

- sub rsp, 4*8 ; gnu/linux binary interface

- mov [rsp+0*8], rsi ; output pointer

- mov r8, rdx ; context

- %else

- sub rsp, 6*8 ; windows binary interface

- mov [rsp+4*8], rsi

- mov [rsp+5*8], rdi

- mov rdi, rcx ; input pointer

- mov [rsp+0*8], rdx ; output pointer

- %endif

- mov [rsp+1*8], rbx ; input pointer in rdi

- mov [rsp+2*8], rbp ; output pointer in [rsp]

- mov [rsp+3*8], r12 ; context in r8

-%endif

-

- movzx esi, byte [kptr+4*KS_LENGTH]

- lea tptr, [rel enc_tab]

- sub kptr, fofs

-

- mov eax, [rdi+0*4]

- mov ebx, [rdi+1*4]

- mov ecx, [rdi+2*4]

- mov edx, [rdi+3*4]

-

- xor eax, [kptr+fofs]

- xor ebx, [kptr+fofs+4]

- xor ecx, [kptr+fofs+8]

- xor edx, [kptr+fofs+12]

-

- lea kptr,[kptr+rsi]

- cmp esi, 10*16

- je .3

- cmp esi, 12*16

- je .2

- cmp esi, 14*16

- je .1

- mov rax, -1

- jmp .4

-

-.1: ff_rnd r9, r10, r11, r12, 13

- ff_rnd r9, r10, r11, r12, 12

-.2: ff_rnd r9, r10, r11, r12, 11

- ff_rnd r9, r10, r11, r12, 10

-.3: ff_rnd r9, r10, r11, r12, 9

- ff_rnd r9, r10, r11, r12, 8

- ff_rnd r9, r10, r11, r12, 7

- ff_rnd r9, r10, r11, r12, 6

- ff_rnd r9, r10, r11, r12, 5

- ff_rnd r9, r10, r11, r12, 4

- ff_rnd r9, r10, r11, r12, 3

- ff_rnd r9, r10, r11, r12, 2

- ff_rnd r9, r10, r11, r12, 1

- fl_rnd r9, r10, r11, r12, 0

-

- mov rbx, [rsp]

- mov [rbx], r9d

- mov [rbx+4], r10d

- mov [rbx+8], r11d

- mov [rbx+12], r12d

- xor rax, rax

-.4:

- mov rbx, [rsp+1*8]

- mov rbp, [rsp+2*8]

- mov r12, [rsp+3*8]

-%ifdef __GNUC__

- add rsp, 4*8

- ret

-%else

- mov rsi, [rsp+4*8]

- mov rdi, [rsp+5*8]

- %ifdef _SEH_

- add rsp, 7*8

- ret

- endproc_frame

- %else

- add rsp, 6*8

- ret

- %endif

-%endif

-

-%endif

-

-%ifdef DECRYPTION

-

- global aes_decrypt

-%ifdef DLL_EXPORT

- export aes_decrypt

-%endif

-

- section .data

- align 64

-dec_tab:

- dec_vals v8

-%ifdef LAST_ROUND_TABLES

- dec_vals w8

-%endif

-

- section .text

- align 16

-

-%ifdef _SEH_

-proc_frame aes_decrypt

- alloc_stack 7*8 ; 7 to align stack to 16 bytes

- save_reg rsi,4*8

- save_reg rdi,5*8

- save_reg rbx,1*8

- save_reg rbp,2*8

- save_reg r12,3*8

-end_prologue

- mov rdi, rcx ; input pointer

- mov [rsp+0*8], rdx ; output pointer

-%else

- aes_decrypt:

- %ifdef __GNUC__

- sub rsp, 4*8 ; gnu/linux binary interface

- mov [rsp+0*8], rsi ; output pointer

- mov r8, rdx ; context

- %else

- sub rsp, 6*8 ; windows binary interface

- mov [rsp+4*8], rsi

- mov [rsp+5*8], rdi

- mov rdi, rcx ; input pointer

- mov [rsp+0*8], rdx ; output pointer

- %endif

- mov [rsp+1*8], rbx ; input pointer in rdi

- mov [rsp+2*8], rbp ; output pointer in [rsp]

- mov [rsp+3*8], r12 ; context in r8

-%endif

-

- movzx esi,byte[kptr+4*KS_LENGTH]

- lea tptr, [rel dec_tab]

- sub kptr, rofs

-

- mov eax, [rdi+0*4]

- mov ebx, [rdi+1*4]

- mov ecx, [rdi+2*4]

- mov edx, [rdi+3*4]

-

-%ifdef AES_REV_DKS

- mov rdi, kptr

- lea kptr,[kptr+rsi]

-%else

- lea rdi,[kptr+rsi]

-%endif

-

- xor eax, [rdi+rofs]

- xor ebx, [rdi+rofs+4]

- xor ecx, [rdi+rofs+8]

- xor edx, [rdi+rofs+12]

-

- cmp esi, 10*16

- je .3

- cmp esi, 12*16

- je .2

- cmp esi, 14*16

- je .1

- mov rax, -1

- jmp .4

-

-.1: ii_rnd r9, r10, r11, r12, 13

- ii_rnd r9, r10, r11, r12, 12

-.2: ii_rnd r9, r10, r11, r12, 11

- ii_rnd r9, r10, r11, r12, 10

-.3: ii_rnd r9, r10, r11, r12, 9

- ii_rnd r9, r10, r11, r12, 8

- ii_rnd r9, r10, r11, r12, 7

- ii_rnd r9, r10, r11, r12, 6

- ii_rnd r9, r10, r11, r12, 5

- ii_rnd r9, r10, r11, r12, 4

- ii_rnd r9, r10, r11, r12, 3

- ii_rnd r9, r10, r11, r12, 2

- ii_rnd r9, r10, r11, r12, 1

- il_rnd r9, r10, r11, r12, 0

-

- mov rbx, [rsp]

- mov [rbx], r9d

- mov [rbx+4], r10d

- mov [rbx+8], r11d

- mov [rbx+12], r12d

- xor rax, rax

-.4: mov rbx, [rsp+1*8]

- mov rbp, [rsp+2*8]

- mov r12, [rsp+3*8]

-%ifdef __GNUC__

- add rsp, 4*8

- ret

-%else

- mov rsi, [rsp+4*8]

- mov rdi, [rsp+5*8]

- %ifdef _SEH_

- add rsp, 7*8

- ret

- endproc_frame

- %else

- add rsp, 6*8

- ret

- %endif

-%endif

-

-%endif