90bcde942a3919300ffc73f98ea903b58386c395da * ---------------------------------------------------------------------------
90bcde942a3919300ffc73f98ea903b58386c395da * Copyright (c) 1998-2007, Brian Gladman, Worcester, UK. All rights reserved.
90bcde942a3919300ffc73f98ea903b58386c395da * LICENSE TERMS
90bcde942a3919300ffc73f98ea903b58386c395da * The free distribution and use of this software is allowed (with or without
90bcde942a3919300ffc73f98ea903b58386c395da * changes) provided that:
90bcde942a3919300ffc73f98ea903b58386c395da * 1. source code distributions include the above copyright notice, this
90bcde942a3919300ffc73f98ea903b58386c395da * list of conditions and the following disclaimer;
90bcde942a3919300ffc73f98ea903b58386c395da * 2. binary distributions include the above copyright notice, this list
90bcde942a3919300ffc73f98ea903b58386c395da * of conditions and the following disclaimer in their documentation;
90bcde942a3919300ffc73f98ea903b58386c395da * 3. the name of the copyright holder is not used to endorse products
90bcde942a3919300ffc73f98ea903b58386c395da * built using this software without specific written permission.
90bcde942a3919300ffc73f98ea903b58386c395da * DISCLAIMER
90bcde942a3919300ffc73f98ea903b58386c395da * This software is provided 'as is' with no explicit or implied warranties
90bcde942a3919300ffc73f98ea903b58386c395da * in respect of its properties, including, but not limited to, correctness
90bcde942a3919300ffc73f98ea903b58386c395da * and/or fitness for purpose.
90bcde942a3919300ffc73f98ea903b58386c395da * ---------------------------------------------------------------------------
90bcde942a3919300ffc73f98ea903b58386c395da * Issue Date: 20/12/2007
90bcde942a3919300ffc73f98ea903b58386c395da * This file contains the compilation options for AES (Rijndael) and code
90bcde942a3919300ffc73f98ea903b58386c395da * that is common across encryption, key scheduling and table generation.
90bcde942a3919300ffc73f98ea903b58386c395da * OPERATION
90bcde942a3919300ffc73f98ea903b58386c395da * These source code files implement the AES algorithm Rijndael designed by
90bcde942a3919300ffc73f98ea903b58386c395da * Joan Daemen and Vincent Rijmen. This version is designed for the standard
90bcde942a3919300ffc73f98ea903b58386c395da * block size of 16 bytes and for key sizes of 128, 192 and 256 bits (16, 24
90bcde942a3919300ffc73f98ea903b58386c395da * and 32 bytes).
90bcde942a3919300ffc73f98ea903b58386c395da * This version is designed for flexibility and speed using operations on
90bcde942a3919300ffc73f98ea903b58386c395da * 32-bit words rather than operations on bytes. It can be compiled with
90bcde942a3919300ffc73f98ea903b58386c395da * either big or little endian internal byte order but is faster when the
90bcde942a3919300ffc73f98ea903b58386c395da * native byte order for the processor is used.
90bcde942a3919300ffc73f98ea903b58386c395da * THE CIPHER INTERFACE
90bcde942a3919300ffc73f98ea903b58386c395da * The cipher interface is implemented as an array of bytes in which lower
90bcde942a3919300ffc73f98ea903b58386c395da * AES bit sequence indexes map to higher numeric significance within bytes.
90bcde942a3919300ffc73f98ea903b58386c395da * OpenSolaris changes
90bcde942a3919300ffc73f98ea903b58386c395da * 1. Added __cplusplus and _AESTAB_H header guards
90bcde942a3919300ffc73f98ea903b58386c395da * 2. Added header files sys/types.h and aes_impl.h
90bcde942a3919300ffc73f98ea903b58386c395da * 3. Added defines for AES_ENCRYPT, AES_DECRYPT, AES_REV_DKS, and ASM_AMD64_C
90bcde942a3919300ffc73f98ea903b58386c395da * 4. Moved defines for IS_BIG_ENDIAN, IS_LITTLE_ENDIAN, PLATFORM_BYTE_ORDER
90bcde942a3919300ffc73f98ea903b58386c395da * 5. Undefined VIA_ACE_POSSIBLE and ASSUME_VIA_ACE_PRESENT
90bcde942a3919300ffc73f98ea903b58386c395da * 6. Changed uint_8t and uint_32t to uint8_t and uint32_t
4b56a00321e0ce508e55cc5e43e3ad7b00005a39Daniel Anderson * 7. Defined aes_sw32 as htonl() for byte swapping
4b56a00321e0ce508e55cc5e43e3ad7b00005a39Daniel Anderson * 8. Cstyled and hdrchk code
90bcde942a3919300ffc73f98ea903b58386c395daextern "C" {
90bcde942a3919300ffc73f98ea903b58386c395da/* SUPPORT FEATURES */
90bcde942a3919300ffc73f98ea903b58386c395da#define AES_ENCRYPT /* if support for encryption is needed */
90bcde942a3919300ffc73f98ea903b58386c395da#define AES_DECRYPT /* if support for decryption is needed */
90bcde942a3919300ffc73f98ea903b58386c395da/* PLATFORM-SPECIFIC FEATURES */
90bcde942a3919300ffc73f98ea903b58386c395da#define IS_BIG_ENDIAN 4321 /* byte 0 is most significant (mc68k) */
90bcde942a3919300ffc73f98ea903b58386c395da#define IS_LITTLE_ENDIAN 1234 /* byte 0 is least significant (i386) */
90bcde942a3919300ffc73f98ea903b58386c395da#define AES_REV_DKS /* define to reverse decryption key schedule */
90bcde942a3919300ffc73f98ea903b58386c395da * CONFIGURATION - THE USE OF DEFINES
90bcde942a3919300ffc73f98ea903b58386c395da * Later in this section there are a number of defines that control the
90bcde942a3919300ffc73f98ea903b58386c395da * operation of the code. In each section, the purpose of each define is
90bcde942a3919300ffc73f98ea903b58386c395da * explained so that the relevant form can be included or excluded by
90bcde942a3919300ffc73f98ea903b58386c395da * setting either 1's or 0's respectively on the branches of the related
90bcde942a3919300ffc73f98ea903b58386c395da * #if clauses. The following local defines should not be changed.
90bcde942a3919300ffc73f98ea903b58386c395da/* --- START OF USER CONFIGURED OPTIONS --- */
90bcde942a3919300ffc73f98ea903b58386c395da * 1. BYTE ORDER WITHIN 32 BIT WORDS
90bcde942a3919300ffc73f98ea903b58386c395da * The fundamental data processing units in Rijndael are 8-bit bytes. The
90bcde942a3919300ffc73f98ea903b58386c395da * input, output and key input are all enumerated arrays of bytes in which
90bcde942a3919300ffc73f98ea903b58386c395da * bytes are numbered starting at zero and increasing to one less than the
90bcde942a3919300ffc73f98ea903b58386c395da * number of bytes in the array in question. This enumeration is only used
90bcde942a3919300ffc73f98ea903b58386c395da * for naming bytes and does not imply any adjacency or order relationship
90bcde942a3919300ffc73f98ea903b58386c395da * from one byte to another. When these inputs and outputs are considered
90bcde942a3919300ffc73f98ea903b58386c395da * as bit sequences, bits 8*n to 8*n+7 of the bit sequence are mapped to
90bcde942a3919300ffc73f98ea903b58386c395da * byte[n] with bit 8n+i in the sequence mapped to bit 7-i within the byte.
90bcde942a3919300ffc73f98ea903b58386c395da * In this implementation bits are numbered from 0 to 7 starting at the
90bcde942a3919300ffc73f98ea903b58386c395da * numerically least significant end of each byte. Bit n represents 2^n.
90bcde942a3919300ffc73f98ea903b58386c395da * However, Rijndael can be implemented more efficiently using 32-bit
90bcde942a3919300ffc73f98ea903b58386c395da * words by packing bytes into words so that bytes 4*n to 4*n+3 are placed
90bcde942a3919300ffc73f98ea903b58386c395da * into word[n]. While in principle these bytes can be assembled into words
90bcde942a3919300ffc73f98ea903b58386c395da * in any positions, this implementation only supports the two formats in
90bcde942a3919300ffc73f98ea903b58386c395da * which bytes in adjacent positions within words also have adjacent byte
90bcde942a3919300ffc73f98ea903b58386c395da * numbers. This order is called big-endian if the lowest numbered bytes
90bcde942a3919300ffc73f98ea903b58386c395da * in words have the highest numeric significance and little-endian if the
90bcde942a3919300ffc73f98ea903b58386c395da * opposite applies.
90bcde942a3919300ffc73f98ea903b58386c395da * This code can work in either order irrespective of the order used by the
90bcde942a3919300ffc73f98ea903b58386c395da * machine on which it runs. Normally the internal byte order will be set
90bcde942a3919300ffc73f98ea903b58386c395da * to the order of the processor on which the code is to be run but this
90bcde942a3919300ffc73f98ea903b58386c395da * define can be used to reverse this in special situations
90bcde942a3919300ffc73f98ea903b58386c395da * WARNING: Assembler code versions rely on PLATFORM_BYTE_ORDER being set.
90bcde942a3919300ffc73f98ea903b58386c395da * This define will hence be redefined later (in section 4) if necessary
90bcde942a3919300ffc73f98ea903b58386c395da/* 2. VIA ACE SUPPORT */
90bcde942a3919300ffc73f98ea903b58386c395da * Define this option if support for the VIA ACE is required. This uses
90bcde942a3919300ffc73f98ea903b58386c395da * inline assembler instructions and is only implemented for the Microsoft,
90bcde942a3919300ffc73f98ea903b58386c395da * Intel and GCC compilers. If VIA ACE is known to be present, then defining
90bcde942a3919300ffc73f98ea903b58386c395da * ASSUME_VIA_ACE_PRESENT will remove the ordinary encryption/decryption
90bcde942a3919300ffc73f98ea903b58386c395da * code. If USE_VIA_ACE_IF_PRESENT is defined then VIA ACE will be used if
90bcde942a3919300ffc73f98ea903b58386c395da * it is detected (both present and enabled) but the normal AES code will
90bcde942a3919300ffc73f98ea903b58386c395da * also be present.
90bcde942a3919300ffc73f98ea903b58386c395da * When VIA ACE is to be used, all AES encryption contexts MUST be 16 byte
90bcde942a3919300ffc73f98ea903b58386c395da * aligned; other input/output buffers do not need to be 16 byte aligned
90bcde942a3919300ffc73f98ea903b58386c395da * but there are very large performance gains if this can be arranged.
90bcde942a3919300ffc73f98ea903b58386c395da * VIA ACE also requires the decryption key schedule to be in reverse
90bcde942a3919300ffc73f98ea903b58386c395da * order (which later checks below ensure).
90bcde942a3919300ffc73f98ea903b58386c395da/* VIA ACE is not used here for OpenSolaris: */
90bcde942a3919300ffc73f98ea903b58386c395da#if 0 && defined(VIA_ACE_POSSIBLE) && !defined(USE_VIA_ACE_IF_PRESENT)
90bcde942a3919300ffc73f98ea903b58386c395da#if 0 && defined(VIA_ACE_POSSIBLE) && !defined(ASSUME_VIA_ACE_PRESENT)
90bcde942a3919300ffc73f98ea903b58386c395da * 3. ASSEMBLER SUPPORT
90bcde942a3919300ffc73f98ea903b58386c395da * This define (which can be on the command line) enables the use of the
90bcde942a3919300ffc73f98ea903b58386c395da * assembler code routines for encryption, decryption and key scheduling
90bcde942a3919300ffc73f98ea903b58386c395da * as follows:
90bcde942a3919300ffc73f98ea903b58386c395da * ASM_X86_V1C uses the assembler (aes_x86_v1.asm) with large tables for
90bcde942a3919300ffc73f98ea903b58386c395da * encryption and decryption and but with key scheduling in C
90bcde942a3919300ffc73f98ea903b58386c395da * ASM_X86_V2 uses assembler (aes_x86_v2.asm) with compressed tables for
90bcde942a3919300ffc73f98ea903b58386c395da * encryption, decryption and key scheduling
90bcde942a3919300ffc73f98ea903b58386c395da * ASM_X86_V2C uses assembler (aes_x86_v2.asm) with compressed tables for
90bcde942a3919300ffc73f98ea903b58386c395da * encryption and decryption and but with key scheduling in C
90bcde942a3919300ffc73f98ea903b58386c395da * ASM_AMD64_C uses assembler (aes_amd64.asm) with compressed tables for
90bcde942a3919300ffc73f98ea903b58386c395da * encryption and decryption and but with key scheduling in C
90bcde942a3919300ffc73f98ea903b58386c395da * Change one 'if 0' below to 'if 1' to select the version or define
90bcde942a3919300ffc73f98ea903b58386c395da * as a compilation option.
90bcde942a3919300ffc73f98ea903b58386c395da#if 0 && !defined(ASM_X86_V1C)
90bcde942a3919300ffc73f98ea903b58386c395da#if (defined(ASM_X86_V1C) || defined(ASM_X86_V2) || defined(ASM_X86_V2C)) && \
90bcde942a3919300ffc73f98ea903b58386c395da !defined(_M_IX86) || defined(ASM_AMD64_C) && !defined(_M_X64) && \
90bcde942a3919300ffc73f98ea903b58386c395da#error Assembler code is only available for x86 and AMD64 systems
90bcde942a3919300ffc73f98ea903b58386c395da * 4. FAST INPUT/OUTPUT OPERATIONS.
90bcde942a3919300ffc73f98ea903b58386c395da * On some machines it is possible to improve speed by transferring the
90bcde942a3919300ffc73f98ea903b58386c395da * bytes in the input and output arrays to and from the internal 32-bit
90bcde942a3919300ffc73f98ea903b58386c395da * variables by addressing these arrays as if they are arrays of 32-bit
90bcde942a3919300ffc73f98ea903b58386c395da * words. On some machines this will always be possible but there may
90bcde942a3919300ffc73f98ea903b58386c395da * be a large performance penalty if the byte arrays are not aligned on
90bcde942a3919300ffc73f98ea903b58386c395da * the normal word boundaries. On other machines this technique will
90bcde942a3919300ffc73f98ea903b58386c395da * lead to memory access errors when such 32-bit word accesses are not
90bcde942a3919300ffc73f98ea903b58386c395da * properly aligned. The option SAFE_IO avoids such problems but will
90bcde942a3919300ffc73f98ea903b58386c395da * often be slower on those machines that support misaligned access
90bcde942a3919300ffc73f98ea903b58386c395da * (especially so if care is taken to align the input and output byte
90bcde942a3919300ffc73f98ea903b58386c395da * arrays on 32-bit word boundaries). If SAFE_IO is not defined it is
90bcde942a3919300ffc73f98ea903b58386c395da * assumed that access to byte arrays as if they are arrays of 32-bit
90bcde942a3919300ffc73f98ea903b58386c395da * words will not cause problems when such accesses are misaligned.
90bcde942a3919300ffc73f98ea903b58386c395da * 5. LOOP UNROLLING
90bcde942a3919300ffc73f98ea903b58386c395da * The code for encryption and decryption cycles through a number of rounds
90bcde942a3919300ffc73f98ea903b58386c395da * that can be implemented either in a loop or by expanding the code into a
90bcde942a3919300ffc73f98ea903b58386c395da * long sequence of instructions, the latter producing a larger program but
90bcde942a3919300ffc73f98ea903b58386c395da * one that will often be much faster. The latter is called loop unrolling.
90bcde942a3919300ffc73f98ea903b58386c395da * There are also potential speed advantages in expanding two iterations in
90bcde942a3919300ffc73f98ea903b58386c395da * a loop with half the number of iterations, which is called partial loop
90bcde942a3919300ffc73f98ea903b58386c395da * unrolling. The following options allow partial or full loop unrolling
90bcde942a3919300ffc73f98ea903b58386c395da * to be set independently for encryption and decryption
90bcde942a3919300ffc73f98ea903b58386c395da * 6. FAST FINITE FIELD OPERATIONS
90bcde942a3919300ffc73f98ea903b58386c395da * If this section is included, tables are used to provide faster finite
90bcde942a3919300ffc73f98ea903b58386c395da * field arithmetic. This has no effect if FIXED_TABLES is defined.
90bcde942a3919300ffc73f98ea903b58386c395da * 7. INTERNAL STATE VARIABLE FORMAT
90bcde942a3919300ffc73f98ea903b58386c395da * The internal state of Rijndael is stored in a number of local 32-bit
90bcde942a3919300ffc73f98ea903b58386c395da * word variables which can be defined either as an array or as individual
90bcde942a3919300ffc73f98ea903b58386c395da * names variables. Include this section if you want to store these local
90bcde942a3919300ffc73f98ea903b58386c395da * variables in arrays. Otherwise individual local variables will be used.
90bcde942a3919300ffc73f98ea903b58386c395da * 8. FIXED OR DYNAMIC TABLES
90bcde942a3919300ffc73f98ea903b58386c395da * When this section is included the tables used by the code are compiled
90bcde942a3919300ffc73f98ea903b58386c395da * statically into the binary file. Otherwise the subroutine aes_init()
90bcde942a3919300ffc73f98ea903b58386c395da * must be called to compute them before the code is first used.
90bcde942a3919300ffc73f98ea903b58386c395da * 9. MASKING OR CASTING FROM LONGER VALUES TO BYTES
90bcde942a3919300ffc73f98ea903b58386c395da * In some systems it is better to mask longer values to extract bytes
90bcde942a3919300ffc73f98ea903b58386c395da * rather than using a cast. This option allows this choice.
90bcde942a3919300ffc73f98ea903b58386c395da * 10. TABLE ALIGNMENT
90bcde942a3919300ffc73f98ea903b58386c395da * On some systems speed will be improved by aligning the AES large lookup
90bcde942a3919300ffc73f98ea903b58386c395da * tables on particular boundaries. This define should be set to a power of
90bcde942a3919300ffc73f98ea903b58386c395da * two giving the desired alignment. It can be left undefined if alignment
90bcde942a3919300ffc73f98ea903b58386c395da * is not needed. This option is specific to the Micrsoft VC++ compiler -
90bcde942a3919300ffc73f98ea903b58386c395da * it seems to sometimes cause trouble for the VC++ version 6 compiler.
90bcde942a3919300ffc73f98ea903b58386c395da * 11. REDUCE CODE AND TABLE SIZE
90bcde942a3919300ffc73f98ea903b58386c395da * This replaces some expanded macros with function calls if AES_ASM_V2 or
90bcde942a3919300ffc73f98ea903b58386c395da * AES_ASM_V2C are defined
90bcde942a3919300ffc73f98ea903b58386c395da * 12. TABLE OPTIONS
90bcde942a3919300ffc73f98ea903b58386c395da * This cipher proceeds by repeating in a number of cycles known as rounds
90bcde942a3919300ffc73f98ea903b58386c395da * which are implemented by a round function which is optionally be speeded
90bcde942a3919300ffc73f98ea903b58386c395da * up using tables. The basic tables are 256 32-bit words, with either
90bcde942a3919300ffc73f98ea903b58386c395da * one or four tables being required for each round function depending on
90bcde942a3919300ffc73f98ea903b58386c395da * how much speed is required. Encryption and decryption round functions
90bcde942a3919300ffc73f98ea903b58386c395da * are different and the last encryption and decryption round functions are
90bcde942a3919300ffc73f98ea903b58386c395da * different again making four different round functions in all.
90bcde942a3919300ffc73f98ea903b58386c395da * This means that:
90bcde942a3919300ffc73f98ea903b58386c395da * 1. Normal encryption and decryption rounds can each use either 0, 1
90bcde942a3919300ffc73f98ea903b58386c395da * or 4 tables and table spaces of 0, 1024 or 4096 bytes each.
90bcde942a3919300ffc73f98ea903b58386c395da * 2. The last encryption and decryption rounds can also use either 0, 1
90bcde942a3919300ffc73f98ea903b58386c395da * or 4 tables and table spaces of 0, 1024 or 4096 bytes each.
90bcde942a3919300ffc73f98ea903b58386c395da * Include or exclude the appropriate definitions below to set the number
90bcde942a3919300ffc73f98ea903b58386c395da * of tables used by this implementation.
90bcde942a3919300ffc73f98ea903b58386c395da * The decryption key schedule can be speeded up with tables in the same
90bcde942a3919300ffc73f98ea903b58386c395da * way that the round functions can. Include or exclude the following
90bcde942a3919300ffc73f98ea903b58386c395da * defines to set this requirement.
90bcde942a3919300ffc73f98ea903b58386c395da/* ---- END OF USER CONFIGURED OPTIONS ---- */
90bcde942a3919300ffc73f98ea903b58386c395da/* VIA ACE support is only available for VC++ and GCC */
90bcde942a3919300ffc73f98ea903b58386c395da#if defined(ASSUME_VIA_ACE_PRESENT) && !defined(USE_VIA_ACE_IF_PRESENT)
90bcde942a3919300ffc73f98ea903b58386c395da#if defined(USE_VIA_ACE_IF_PRESENT) && !defined(AES_REV_DKS)
90bcde942a3919300ffc73f98ea903b58386c395da/* Assembler support requires the use of platform byte order */
90bcde942a3919300ffc73f98ea903b58386c395da#if (defined(ASM_X86_V1C) || defined(ASM_X86_V2C) || defined(ASM_AMD64_C)) && \
90bcde942a3919300ffc73f98ea903b58386c395da * In this implementation the columns of the state array are each held in
90bcde942a3919300ffc73f98ea903b58386c395da * 32-bit words. The state array can be held in various ways: in an array
90bcde942a3919300ffc73f98ea903b58386c395da * of words, in a number of individual word variables or in a number of
90bcde942a3919300ffc73f98ea903b58386c395da * processor registers. The following define maps a variable name x and
90bcde942a3919300ffc73f98ea903b58386c395da * a column number c to the way the state array variable is to be held.
90bcde942a3919300ffc73f98ea903b58386c395da * The first define below maps the state into an array x[c] whereas the
90bcde942a3919300ffc73f98ea903b58386c395da * second form maps the state into a number of individual variables x0,
90bcde942a3919300ffc73f98ea903b58386c395da * x1, etc. Another form could map individual state columns to machine
90bcde942a3919300ffc73f98ea903b58386c395da * register names.
90bcde942a3919300ffc73f98ea903b58386c395da#if defined(ARRAYS)
90bcde942a3919300ffc73f98ea903b58386c395da#define s(x, c) x[c]
90bcde942a3919300ffc73f98ea903b58386c395da#define s(x, c) x##c
90bcde942a3919300ffc73f98ea903b58386c395da * This implementation provides subroutines for encryption, decryption
90bcde942a3919300ffc73f98ea903b58386c395da * and for setting the three key lengths (separately) for encryption
90bcde942a3919300ffc73f98ea903b58386c395da * and decryption. Since not all functions are needed, masks are set
90bcde942a3919300ffc73f98ea903b58386c395da * up here to determine which will be implemented in C
90bcde942a3919300ffc73f98ea903b58386c395da#if !defined(AES_ENCRYPT)
90bcde942a3919300ffc73f98ea903b58386c395da#elif defined(ASSUME_VIA_ACE_PRESENT) || defined(ASM_X86_V1C) || \
90bcde942a3919300ffc73f98ea903b58386c395da#if !defined(AES_DECRYPT)
90bcde942a3919300ffc73f98ea903b58386c395da#elif defined(ASSUME_VIA_ACE_PRESENT) || defined(ASM_X86_V1C) || \
90bcde942a3919300ffc73f98ea903b58386c395da/* END OF CONFIGURATION OPTIONS */
90bcde942a3919300ffc73f98ea903b58386c395da/* Disable or report errors on some combinations of options */
90bcde942a3919300ffc73f98ea903b58386c395da#elif ENC_ROUND == ONE_TABLE && LAST_ENC_ROUND == FOUR_TABLES
90bcde942a3919300ffc73f98ea903b58386c395da#elif DEC_ROUND == ONE_TABLE && LAST_DEC_ROUND == FOUR_TABLES
4b56a00321e0ce508e55cc5e43e3ad7b00005a39Daniel Anderson#if (ALGORITHM_BYTE_ORDER == IS_LITTLE_ENDIAN)
4b56a00321e0ce508e55cc5e43e3ad7b00005a39Daniel Anderson#define brot(x, n) (((uint32_t)(x) << (n)) | ((uint32_t)(x) >> (32 - (n))))
90bcde942a3919300ffc73f98ea903b58386c395da#define aes_sw32(x) ((brot((x), 8) & 0x00ff00ff) | (brot((x), 24) & 0xff00ff00))
4b56a00321e0ce508e55cc5e43e3ad7b00005a39Daniel Anderson * upr(x, n): rotates bytes within words by n positions, moving bytes to
90bcde942a3919300ffc73f98ea903b58386c395da * higher index positions with wrap around into low positions
90bcde942a3919300ffc73f98ea903b58386c395da * ups(x, n): moves bytes by n positions to higher index positions in
90bcde942a3919300ffc73f98ea903b58386c395da * words but without wrap around
90bcde942a3919300ffc73f98ea903b58386c395da * bval(x, n): extracts a byte from a word
90bcde942a3919300ffc73f98ea903b58386c395da * WARNING: The definitions given here are intended only for use with
90bcde942a3919300ffc73f98ea903b58386c395da * unsigned variables and with shift counts that are compile
90bcde942a3919300ffc73f98ea903b58386c395da * time constants
90bcde942a3919300ffc73f98ea903b58386c395da#if defined(SAFE_IO)
90bcde942a3919300ffc73f98ea903b58386c395da#define word_in(x, c) bytes2word(((const uint8_t *)(x) + 4 * c)[0], \
90bcde942a3919300ffc73f98ea903b58386c395da#define word_out(x, c, v) { ((uint8_t *)(x) + 4 * c)[0] = bval(v, 0); \
90bcde942a3919300ffc73f98ea903b58386c395da#define word_out(x, c, v) (*((uint32_t *)(x) + (c)) = (v))
90bcde942a3919300ffc73f98ea903b58386c395da#define word_out(x, c, v) (*((uint32_t *)(x) + (c)) = aes_sw32(v))
90bcde942a3919300ffc73f98ea903b58386c395da/* the finite field modular polynomial and elements */
90bcde942a3919300ffc73f98ea903b58386c395da/* multiply four bytes in GF(2^8) by 'x' {02} in parallel */
90bcde942a3919300ffc73f98ea903b58386c395da#define gf_mulx(x) ((((x) & m2) << 1) ^ ((((x) & m1) >> 7) * BPOLY))
90bcde942a3919300ffc73f98ea903b58386c395da * The following defines provide alternative definitions of gf_mulx that might
90bcde942a3919300ffc73f98ea903b58386c395da * give improved performance if a fast 32-bit multiply is not available. Note
90bcde942a3919300ffc73f98ea903b58386c395da * that a temporary variable u needs to be defined where gf_mulx is used.
90bcde942a3919300ffc73f98ea903b58386c395da * #define gf_mulx(x) (u = (x) & m1, u |= (u >> 1), ((x) & m2) << 1) ^ \
90bcde942a3919300ffc73f98ea903b58386c395da * ((u >> 3) | (u >> 6))
90bcde942a3919300ffc73f98ea903b58386c395da * #define m4 (0x01010101 * BPOLY)
90bcde942a3919300ffc73f98ea903b58386c395da * #define gf_mulx(x) (u = (x) & m1, ((x) & m2) << 1) ^ ((u - (u >> 7)) \
90bcde942a3919300ffc73f98ea903b58386c395da/* Work out which tables are needed for the different options */
90bcde942a3919300ffc73f98ea903b58386c395da#if defined(ENC_ROUND)
90bcde942a3919300ffc73f98ea903b58386c395da#if defined(DEC_ROUND)
90bcde942a3919300ffc73f98ea903b58386c395da#if defined(KEY_SCHED)
90bcde942a3919300ffc73f98ea903b58386c395da#if (FUNCS_IN_C & ENCRYPTION_IN_C) || defined(ASM_X86_V1C)
90bcde942a3919300ffc73f98ea903b58386c395da#if (FUNCS_IN_C & DECRYPTION_IN_C) || defined(ASM_X86_V1C)
90bcde942a3919300ffc73f98ea903b58386c395da#if !(defined(REDUCE_CODE_SIZE) && (defined(ASM_X86_V2) || \
90bcde942a3919300ffc73f98ea903b58386c395da#if ((FUNCS_IN_C & ENC_KEYING_IN_C) || (FUNCS_IN_C & DEC_KEYING_IN_C))
90bcde942a3919300ffc73f98ea903b58386c395da#if !defined(FL4_SET)
90bcde942a3919300ffc73f98ea903b58386c395da/* generic definitions of Rijndael macros that use tables */
90bcde942a3919300ffc73f98ea903b58386c395da * Perform forward and inverse column mix operation on four bytes in long word
90bcde942a3919300ffc73f98ea903b58386c395da * x in parallel. NOTE: x must be a simple variable, NOT an expression in
90bcde942a3919300ffc73f98ea903b58386c395da * these macros.
90bcde942a3919300ffc73f98ea903b58386c395da#if !(defined(REDUCE_CODE_SIZE) && (defined(ASM_X86_V2) || \
90bcde942a3919300ffc73f98ea903b58386c395da#define fwd_mcol(x) four_tables(x, t_use(f, m), vf1, rf1, 0)
90bcde942a3919300ffc73f98ea903b58386c395da#define fwd_mcol(x) one_table(x, upr, t_use(f, m), vf1, rf1, 0)
90bcde942a3919300ffc73f98ea903b58386c395da#define fwd_mcol(x) (g2 = gf_mulx(x), g2 ^ upr((x) ^ g2, 3) ^ \
90bcde942a3919300ffc73f98ea903b58386c395da#if defined(IM4_SET)
90bcde942a3919300ffc73f98ea903b58386c395da#define inv_mcol(x) four_tables(x, t_use(i, m), vf1, rf1, 0)
90bcde942a3919300ffc73f98ea903b58386c395da#define inv_mcol(x) one_table(x, upr, t_use(i, m), vf1, rf1, 0)
90bcde942a3919300ffc73f98ea903b58386c395da#define inv_mcol(x) (g2 = gf_mulx(x), g4 = gf_mulx(g2), g9 = \
90bcde942a3919300ffc73f98ea903b58386c395da#if defined(FL4_SET)
90bcde942a3919300ffc73f98ea903b58386c395da#define ls_box(x, c) four_tables(x, t_use(f, l), vf1, rf2, c)
90bcde942a3919300ffc73f98ea903b58386c395da#define ls_box(x, c) four_tables(x, t_use(l, s), vf1, rf2, c)
90bcde942a3919300ffc73f98ea903b58386c395da#define ls_box(x, c) one_table(x, upr, t_use(f, l), vf1, rf2, c)
90bcde942a3919300ffc73f98ea903b58386c395da#define ls_box(x, c) one_table(x, upr, t_use(l, s), vf1, rf2, c)
90bcde942a3919300ffc73f98ea903b58386c395da#define ls_box(x, c) no_table(x, t_use(s, box), vf1, rf2, c)
90bcde942a3919300ffc73f98ea903b58386c395da#if defined(ASM_X86_V1C) && defined(AES_DECRYPT) && !defined(ISB_SET)
90bcde942a3919300ffc73f98ea903b58386c395da#endif /* _AESOPT_H */