1ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta/*
2ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta ---------------------------------------------------------------------------
3ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta Copyright (c) 1998-2008, Brian Gladman, Worcester, UK. All rights reserved.
4ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
5ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta LICENSE TERMS
6ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
7ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta The redistribution and use of this software (with or without changes)
8ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta is allowed without the payment of fees or royalties provided that:
9ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
10ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta  1. source code distributions include the above copyright notice, this
11ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta     list of conditions and the following disclaimer;
12ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
13ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta  2. binary distributions include the above copyright notice, this list
14ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta     of conditions and the following disclaimer in their documentation;
15ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
16ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta  3. the name of the copyright holder is not used to endorse products
17ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta     built using this software without specific written permission.
18ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
19ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta DISCLAIMER
20ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
21ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta This software is provided 'as is' with no explicit or implied warranties
22ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta in respect of its properties, including, but not limited to, correctness
23ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta and/or fitness for purpose.
24ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta ---------------------------------------------------------------------------
25ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta Issue 09/09/2006
26ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
27ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta This is an AES implementation that uses only 8-bit byte operations on the
28ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta cipher state.
29ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta */
30ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
31ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#ifndef AES_H
32ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#define AES_H
33ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
34ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#if 1
35ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#  define AES_ENC_PREKEYED  /* AES encryption with a precomputed key schedule  */
36ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#endif
37ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#if 1
38ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#  define AES_DEC_PREKEYED  /* AES decryption with a precomputed key schedule  */
39ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#endif
40ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#if 1
41ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#  define AES_ENC_128_OTFK  /* AES encryption with 'on the fly' 128 bit keying */
42ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#endif
43ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#if 1
44ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#  define AES_DEC_128_OTFK  /* AES decryption with 'on the fly' 128 bit keying */
45ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#endif
46ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#if 1
47ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#  define AES_ENC_256_OTFK  /* AES encryption with 'on the fly' 256 bit keying */
48ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#endif
49ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#if 1
50ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#  define AES_DEC_256_OTFK  /* AES decryption with 'on the fly' 256 bit keying */
51ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#endif
52ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
53ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#define N_ROW                   4
54ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#define N_COL                   4
55ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#define N_BLOCK   (N_ROW * N_COL)
56ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#define N_MAX_ROUNDS           14
57ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
58ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Battatypedef unsigned char uint_8t;
59ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
60ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Battatypedef uint_8t return_type;
61ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
62ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta/*  Warning: The key length for 256 bit keys overflows a byte
63ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta    (see comment below)
64ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta*/
65ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
66ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Battatypedef uint_8t length_type;
67ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
68ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Battatypedef struct
69ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta{   uint_8t ksch[(N_MAX_ROUNDS + 1) * N_BLOCK];
70ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta    uint_8t rnd;
71ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta} aes_context;
72ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
73ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta/*  The following calls are for a precomputed key schedule
74ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
75ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta    NOTE: If the length_type used for the key length is an
76ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta    unsigned 8-bit character, a key length of 256 bits must
77ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta    be entered as a length in bytes (valid inputs are hence
78ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta    128, 192, 16, 24 and 32).
79ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta*/
80ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
81ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#if defined( AES_ENC_PREKEYED ) || defined( AES_DEC_PREKEYED )
82ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
83ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Battareturn_type aes_set_key( const unsigned char key[],
84ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta                         length_type keylen,
85ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta                         aes_context ctx[1] );
86ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#endif
87ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
88ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#if defined( AES_ENC_PREKEYED )
89ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
90ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Battareturn_type aes_encrypt( const unsigned char in[N_BLOCK],
91ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta                         unsigned char out[N_BLOCK],
92ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta                         const aes_context ctx[1] );
93ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
94ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Battareturn_type aes_cbc_encrypt( const unsigned char *in,
95ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta                         unsigned char *out,
96ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta                         int n_block,
97ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta                         unsigned char iv[N_BLOCK],
98ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta                         const aes_context ctx[1] );
99ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#endif
100ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
101ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#if defined( AES_DEC_PREKEYED )
102ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
103ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Battareturn_type aes_decrypt( const unsigned char in[N_BLOCK],
104ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta                         unsigned char out[N_BLOCK],
105ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta                         const aes_context ctx[1] );
106ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
107ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Battareturn_type aes_cbc_decrypt( const unsigned char *in,
108ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta                         unsigned char *out,
109ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta                         int n_block,
110ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta                         unsigned char iv[N_BLOCK],
111ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta                         const aes_context ctx[1] );
112ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#endif
113ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
114ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta/*  The following calls are for 'on the fly' keying.  In this case the
115ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta    encryption and decryption keys are different.
116ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
117ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta    The encryption subroutines take a key in an array of bytes in
118ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta    key[L] where L is 16, 24 or 32 bytes for key lengths of 128,
119ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta    192, and 256 bits respectively.  They then encrypts the input
120ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta    data, in[] with this key and put the reult in the output array
121ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta    out[].  In addition, the second key array, o_key[L], is used
122ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta    to output the key that is needed by the decryption subroutine
123ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta    to reverse the encryption operation.  The two key arrays can
124ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta    be the same array but in this case the original key will be
125ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta    overwritten.
126ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
127ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta    In the same way, the decryption subroutines output keys that
128ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta    can be used to reverse their effect when used for encryption.
129ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
130ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta    Only 128 and 256 bit keys are supported in these 'on the fly'
131ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta    modes.
132ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta*/
133ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
134ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#if defined( AES_ENC_128_OTFK )
135ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Battavoid aes_encrypt_128( const unsigned char in[N_BLOCK],
136ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta                      unsigned char out[N_BLOCK],
137ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta                      const unsigned char key[N_BLOCK],
138ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta                      uint_8t o_key[N_BLOCK] );
139ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#endif
140ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
141ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#if defined( AES_DEC_128_OTFK )
142ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Battavoid aes_decrypt_128( const unsigned char in[N_BLOCK],
143ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta                      unsigned char out[N_BLOCK],
144ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta                      const unsigned char key[N_BLOCK],
145ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta                      unsigned char o_key[N_BLOCK] );
146ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#endif
147ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
148ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#if defined( AES_ENC_256_OTFK )
149ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Battavoid aes_encrypt_256( const unsigned char in[N_BLOCK],
150ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta                      unsigned char out[N_BLOCK],
151ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta                      const unsigned char key[2 * N_BLOCK],
152ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta                      unsigned char o_key[2 * N_BLOCK] );
153ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#endif
154ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
155ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#if defined( AES_DEC_256_OTFK )
156ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Battavoid aes_decrypt_256( const unsigned char in[N_BLOCK],
157ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta                      unsigned char out[N_BLOCK],
158ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta                      const unsigned char key[2 * N_BLOCK],
159ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta                      unsigned char o_key[2 * N_BLOCK] );
160ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#endif
161ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta
162ead3cde4bac0c3e32cd31f149093f004eef8ceebGanesh Ganapathi Batta#endif
163