wolfSSL SSL/TLS library, support up to TLS1.3
Dependents: CyaSSL-Twitter-OAuth4Tw Example-client-tls-cert TwitterReader TweetTest ... more
wolfcrypt/src/aes.c@13:f67a6c6013ca, 2017-08-22 (annotated)
- Committer:
- wolfSSL
- Date:
- Tue Aug 22 10:48:22 2017 +0000
- Revision:
- 13:f67a6c6013ca
wolfSSL3.12.0 with TLS1.3
Who changed what in which revision?
User | Revision | Line number | New contents of line |
---|---|---|---|
wolfSSL | 13:f67a6c6013ca | 1 | /* aes.c |
wolfSSL | 13:f67a6c6013ca | 2 | * |
wolfSSL | 13:f67a6c6013ca | 3 | * Copyright (C) 2006-2016 wolfSSL Inc. |
wolfSSL | 13:f67a6c6013ca | 4 | * |
wolfSSL | 13:f67a6c6013ca | 5 | * This file is part of wolfSSL. |
wolfSSL | 13:f67a6c6013ca | 6 | * |
wolfSSL | 13:f67a6c6013ca | 7 | * wolfSSL is free software; you can redistribute it and/or modify |
wolfSSL | 13:f67a6c6013ca | 8 | * it under the terms of the GNU General Public License as published by |
wolfSSL | 13:f67a6c6013ca | 9 | * the Free Software Foundation; either version 2 of the License, or |
wolfSSL | 13:f67a6c6013ca | 10 | * (at your option) any later version. |
wolfSSL | 13:f67a6c6013ca | 11 | * |
wolfSSL | 13:f67a6c6013ca | 12 | * wolfSSL is distributed in the hope that it will be useful, |
wolfSSL | 13:f67a6c6013ca | 13 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
wolfSSL | 13:f67a6c6013ca | 14 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
wolfSSL | 13:f67a6c6013ca | 15 | * GNU General Public License for more details. |
wolfSSL | 13:f67a6c6013ca | 16 | * |
wolfSSL | 13:f67a6c6013ca | 17 | * You should have received a copy of the GNU General Public License |
wolfSSL | 13:f67a6c6013ca | 18 | * along with this program; if not, write to the Free Software |
wolfSSL | 13:f67a6c6013ca | 19 | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA |
wolfSSL | 13:f67a6c6013ca | 20 | */ |
wolfSSL | 13:f67a6c6013ca | 21 | |
wolfSSL | 13:f67a6c6013ca | 22 | |
wolfSSL | 13:f67a6c6013ca | 23 | #ifdef HAVE_CONFIG_H |
wolfSSL | 13:f67a6c6013ca | 24 | #include <config.h> |
wolfSSL | 13:f67a6c6013ca | 25 | #endif |
wolfSSL | 13:f67a6c6013ca | 26 | |
wolfSSL | 13:f67a6c6013ca | 27 | #include <wolfssl/wolfcrypt/settings.h> |
wolfSSL | 13:f67a6c6013ca | 28 | #include <wolfssl/wolfcrypt/error-crypt.h> |
wolfSSL | 13:f67a6c6013ca | 29 | |
wolfSSL | 13:f67a6c6013ca | 30 | #ifndef NO_AES |
wolfSSL | 13:f67a6c6013ca | 31 | #include <wolfssl/wolfcrypt/aes.h> |
wolfSSL | 13:f67a6c6013ca | 32 | #include <wolfssl/wolfcrypt/cpuid.h> |
wolfSSL | 13:f67a6c6013ca | 33 | |
wolfSSL | 13:f67a6c6013ca | 34 | |
wolfSSL | 13:f67a6c6013ca | 35 | /* fips wrapper calls, user can call direct */ |
wolfSSL | 13:f67a6c6013ca | 36 | #ifdef HAVE_FIPS |
wolfSSL | 13:f67a6c6013ca | 37 | int wc_AesSetKey(Aes* aes, const byte* key, word32 len, const byte* iv, |
wolfSSL | 13:f67a6c6013ca | 38 | int dir) |
wolfSSL | 13:f67a6c6013ca | 39 | { |
wolfSSL | 13:f67a6c6013ca | 40 | if (aes == NULL || !( (len == 16) || (len == 24) || (len == 32)) ) { |
wolfSSL | 13:f67a6c6013ca | 41 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 42 | } |
wolfSSL | 13:f67a6c6013ca | 43 | |
wolfSSL | 13:f67a6c6013ca | 44 | return AesSetKey_fips(aes, key, len, iv, dir); |
wolfSSL | 13:f67a6c6013ca | 45 | } |
wolfSSL | 13:f67a6c6013ca | 46 | int wc_AesSetIV(Aes* aes, const byte* iv) |
wolfSSL | 13:f67a6c6013ca | 47 | { |
wolfSSL | 13:f67a6c6013ca | 48 | if (aes == NULL) { |
wolfSSL | 13:f67a6c6013ca | 49 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 50 | } |
wolfSSL | 13:f67a6c6013ca | 51 | |
wolfSSL | 13:f67a6c6013ca | 52 | return AesSetIV_fips(aes, iv); |
wolfSSL | 13:f67a6c6013ca | 53 | } |
wolfSSL | 13:f67a6c6013ca | 54 | #ifdef HAVE_AES_CBC |
wolfSSL | 13:f67a6c6013ca | 55 | int wc_AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz) |
wolfSSL | 13:f67a6c6013ca | 56 | { |
wolfSSL | 13:f67a6c6013ca | 57 | if (aes == NULL || out == NULL || in == NULL) { |
wolfSSL | 13:f67a6c6013ca | 58 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 59 | } |
wolfSSL | 13:f67a6c6013ca | 60 | |
wolfSSL | 13:f67a6c6013ca | 61 | return AesCbcEncrypt_fips(aes, out, in, sz); |
wolfSSL | 13:f67a6c6013ca | 62 | } |
wolfSSL | 13:f67a6c6013ca | 63 | #ifdef HAVE_AES_DECRYPT |
wolfSSL | 13:f67a6c6013ca | 64 | int wc_AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz) |
wolfSSL | 13:f67a6c6013ca | 65 | { |
wolfSSL | 13:f67a6c6013ca | 66 | if (aes == NULL || out == NULL || in == NULL |
wolfSSL | 13:f67a6c6013ca | 67 | || sz % AES_BLOCK_SIZE != 0) { |
wolfSSL | 13:f67a6c6013ca | 68 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 69 | } |
wolfSSL | 13:f67a6c6013ca | 70 | |
wolfSSL | 13:f67a6c6013ca | 71 | return AesCbcDecrypt_fips(aes, out, in, sz); |
wolfSSL | 13:f67a6c6013ca | 72 | } |
wolfSSL | 13:f67a6c6013ca | 73 | #endif /* HAVE_AES_DECRYPT */ |
wolfSSL | 13:f67a6c6013ca | 74 | #endif /* HAVE_AES_CBC */ |
wolfSSL | 13:f67a6c6013ca | 75 | |
wolfSSL | 13:f67a6c6013ca | 76 | /* AES-CTR */ |
wolfSSL | 13:f67a6c6013ca | 77 | #ifdef WOLFSSL_AES_COUNTER |
wolfSSL | 13:f67a6c6013ca | 78 | int wc_AesCtrEncrypt(Aes* aes, byte* out, const byte* in, word32 sz) |
wolfSSL | 13:f67a6c6013ca | 79 | { |
wolfSSL | 13:f67a6c6013ca | 80 | if (aes == NULL || out == NULL || in == NULL) { |
wolfSSL | 13:f67a6c6013ca | 81 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 82 | } |
wolfSSL | 13:f67a6c6013ca | 83 | |
wolfSSL | 13:f67a6c6013ca | 84 | return AesCtrEncrypt(aes, out, in, sz); |
wolfSSL | 13:f67a6c6013ca | 85 | } |
wolfSSL | 13:f67a6c6013ca | 86 | #endif |
wolfSSL | 13:f67a6c6013ca | 87 | |
wolfSSL | 13:f67a6c6013ca | 88 | /* AES-DIRECT */ |
wolfSSL | 13:f67a6c6013ca | 89 | #if defined(WOLFSSL_AES_DIRECT) |
wolfSSL | 13:f67a6c6013ca | 90 | void wc_AesEncryptDirect(Aes* aes, byte* out, const byte* in) |
wolfSSL | 13:f67a6c6013ca | 91 | { |
wolfSSL | 13:f67a6c6013ca | 92 | AesEncryptDirect(aes, out, in); |
wolfSSL | 13:f67a6c6013ca | 93 | } |
wolfSSL | 13:f67a6c6013ca | 94 | |
wolfSSL | 13:f67a6c6013ca | 95 | #ifdef HAVE_AES_DECRYPT |
wolfSSL | 13:f67a6c6013ca | 96 | void wc_AesDecryptDirect(Aes* aes, byte* out, const byte* in) |
wolfSSL | 13:f67a6c6013ca | 97 | { |
wolfSSL | 13:f67a6c6013ca | 98 | AesDecryptDirect(aes, out, in); |
wolfSSL | 13:f67a6c6013ca | 99 | } |
wolfSSL | 13:f67a6c6013ca | 100 | #endif /* HAVE_AES_DECRYPT */ |
wolfSSL | 13:f67a6c6013ca | 101 | |
wolfSSL | 13:f67a6c6013ca | 102 | int wc_AesSetKeyDirect(Aes* aes, const byte* key, word32 len, |
wolfSSL | 13:f67a6c6013ca | 103 | const byte* iv, int dir) |
wolfSSL | 13:f67a6c6013ca | 104 | { |
wolfSSL | 13:f67a6c6013ca | 105 | return AesSetKeyDirect(aes, key, len, iv, dir); |
wolfSSL | 13:f67a6c6013ca | 106 | } |
wolfSSL | 13:f67a6c6013ca | 107 | #endif /* WOLFSSL_AES_DIRECT */ |
wolfSSL | 13:f67a6c6013ca | 108 | |
wolfSSL | 13:f67a6c6013ca | 109 | /* AES-GCM */ |
wolfSSL | 13:f67a6c6013ca | 110 | #ifdef HAVE_AESGCM |
wolfSSL | 13:f67a6c6013ca | 111 | int wc_AesGcmSetKey(Aes* aes, const byte* key, word32 len) |
wolfSSL | 13:f67a6c6013ca | 112 | { |
wolfSSL | 13:f67a6c6013ca | 113 | if (aes == NULL || !( (len == 16) || (len == 24) || (len == 32)) ) { |
wolfSSL | 13:f67a6c6013ca | 114 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 115 | } |
wolfSSL | 13:f67a6c6013ca | 116 | |
wolfSSL | 13:f67a6c6013ca | 117 | return AesGcmSetKey_fips(aes, key, len); |
wolfSSL | 13:f67a6c6013ca | 118 | } |
wolfSSL | 13:f67a6c6013ca | 119 | int wc_AesGcmEncrypt(Aes* aes, byte* out, const byte* in, word32 sz, |
wolfSSL | 13:f67a6c6013ca | 120 | const byte* iv, word32 ivSz, |
wolfSSL | 13:f67a6c6013ca | 121 | byte* authTag, word32 authTagSz, |
wolfSSL | 13:f67a6c6013ca | 122 | const byte* authIn, word32 authInSz) |
wolfSSL | 13:f67a6c6013ca | 123 | { |
wolfSSL | 13:f67a6c6013ca | 124 | if (aes == NULL || authTagSz > AES_BLOCK_SIZE |
wolfSSL | 13:f67a6c6013ca | 125 | || authTagSz < WOLFSSL_MIN_AUTH_TAG_SZ || |
wolfSSL | 13:f67a6c6013ca | 126 | ivSz > AES_BLOCK_SIZE) { |
wolfSSL | 13:f67a6c6013ca | 127 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 128 | } |
wolfSSL | 13:f67a6c6013ca | 129 | |
wolfSSL | 13:f67a6c6013ca | 130 | return AesGcmEncrypt_fips(aes, out, in, sz, iv, ivSz, authTag, |
wolfSSL | 13:f67a6c6013ca | 131 | authTagSz, authIn, authInSz); |
wolfSSL | 13:f67a6c6013ca | 132 | } |
wolfSSL | 13:f67a6c6013ca | 133 | |
wolfSSL | 13:f67a6c6013ca | 134 | #ifdef HAVE_AES_DECRYPT |
wolfSSL | 13:f67a6c6013ca | 135 | int wc_AesGcmDecrypt(Aes* aes, byte* out, const byte* in, word32 sz, |
wolfSSL | 13:f67a6c6013ca | 136 | const byte* iv, word32 ivSz, |
wolfSSL | 13:f67a6c6013ca | 137 | const byte* authTag, word32 authTagSz, |
wolfSSL | 13:f67a6c6013ca | 138 | const byte* authIn, word32 authInSz) |
wolfSSL | 13:f67a6c6013ca | 139 | { |
wolfSSL | 13:f67a6c6013ca | 140 | if (aes == NULL || out == NULL || in == NULL || iv == NULL |
wolfSSL | 13:f67a6c6013ca | 141 | || authTag == NULL || authTagSz > AES_BLOCK_SIZE || |
wolfSSL | 13:f67a6c6013ca | 142 | ivSz > AES_BLOCK_SIZE) { |
wolfSSL | 13:f67a6c6013ca | 143 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 144 | } |
wolfSSL | 13:f67a6c6013ca | 145 | |
wolfSSL | 13:f67a6c6013ca | 146 | return AesGcmDecrypt_fips(aes, out, in, sz, iv, ivSz, authTag, |
wolfSSL | 13:f67a6c6013ca | 147 | authTagSz, authIn, authInSz); |
wolfSSL | 13:f67a6c6013ca | 148 | } |
wolfSSL | 13:f67a6c6013ca | 149 | #endif /* HAVE_AES_DECRYPT */ |
wolfSSL | 13:f67a6c6013ca | 150 | |
wolfSSL | 13:f67a6c6013ca | 151 | int wc_GmacSetKey(Gmac* gmac, const byte* key, word32 len) |
wolfSSL | 13:f67a6c6013ca | 152 | { |
wolfSSL | 13:f67a6c6013ca | 153 | if (gmac == NULL || key == NULL || !((len == 16) || |
wolfSSL | 13:f67a6c6013ca | 154 | (len == 24) || (len == 32)) ) { |
wolfSSL | 13:f67a6c6013ca | 155 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 156 | } |
wolfSSL | 13:f67a6c6013ca | 157 | |
wolfSSL | 13:f67a6c6013ca | 158 | return GmacSetKey(gmac, key, len); |
wolfSSL | 13:f67a6c6013ca | 159 | } |
wolfSSL | 13:f67a6c6013ca | 160 | int wc_GmacUpdate(Gmac* gmac, const byte* iv, word32 ivSz, |
wolfSSL | 13:f67a6c6013ca | 161 | const byte* authIn, word32 authInSz, |
wolfSSL | 13:f67a6c6013ca | 162 | byte* authTag, word32 authTagSz) |
wolfSSL | 13:f67a6c6013ca | 163 | { |
wolfSSL | 13:f67a6c6013ca | 164 | if (gmac == NULL || authTagSz > AES_BLOCK_SIZE || |
wolfSSL | 13:f67a6c6013ca | 165 | authTagSz < WOLFSSL_MIN_AUTH_TAG_SZ) { |
wolfSSL | 13:f67a6c6013ca | 166 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 167 | } |
wolfSSL | 13:f67a6c6013ca | 168 | |
wolfSSL | 13:f67a6c6013ca | 169 | return GmacUpdate(gmac, iv, ivSz, authIn, authInSz, |
wolfSSL | 13:f67a6c6013ca | 170 | authTag, authTagSz); |
wolfSSL | 13:f67a6c6013ca | 171 | } |
wolfSSL | 13:f67a6c6013ca | 172 | #endif /* HAVE_AESGCM */ |
wolfSSL | 13:f67a6c6013ca | 173 | |
wolfSSL | 13:f67a6c6013ca | 174 | /* AES-CCM */ |
wolfSSL | 13:f67a6c6013ca | 175 | #ifdef HAVE_AESCCM |
wolfSSL | 13:f67a6c6013ca | 176 | void wc_AesCcmSetKey(Aes* aes, const byte* key, word32 keySz) |
wolfSSL | 13:f67a6c6013ca | 177 | { |
wolfSSL | 13:f67a6c6013ca | 178 | AesCcmSetKey(aes, key, keySz); |
wolfSSL | 13:f67a6c6013ca | 179 | } |
wolfSSL | 13:f67a6c6013ca | 180 | int wc_AesCcmEncrypt(Aes* aes, byte* out, const byte* in, word32 inSz, |
wolfSSL | 13:f67a6c6013ca | 181 | const byte* nonce, word32 nonceSz, |
wolfSSL | 13:f67a6c6013ca | 182 | byte* authTag, word32 authTagSz, |
wolfSSL | 13:f67a6c6013ca | 183 | const byte* authIn, word32 authInSz) |
wolfSSL | 13:f67a6c6013ca | 184 | { |
wolfSSL | 13:f67a6c6013ca | 185 | /* sanity check on arguments */ |
wolfSSL | 13:f67a6c6013ca | 186 | if (aes == NULL || out == NULL || in == NULL || nonce == NULL |
wolfSSL | 13:f67a6c6013ca | 187 | || authTag == NULL || nonceSz < 7 || nonceSz > 13) |
wolfSSL | 13:f67a6c6013ca | 188 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 189 | |
wolfSSL | 13:f67a6c6013ca | 190 | AesCcmEncrypt(aes, out, in, inSz, nonce, nonceSz, authTag, |
wolfSSL | 13:f67a6c6013ca | 191 | authTagSz, authIn, authInSz); |
wolfSSL | 13:f67a6c6013ca | 192 | return 0; |
wolfSSL | 13:f67a6c6013ca | 193 | } |
wolfSSL | 13:f67a6c6013ca | 194 | |
wolfSSL | 13:f67a6c6013ca | 195 | #ifdef HAVE_AES_DECRYPT |
wolfSSL | 13:f67a6c6013ca | 196 | int wc_AesCcmDecrypt(Aes* aes, byte* out, |
wolfSSL | 13:f67a6c6013ca | 197 | const byte* in, word32 inSz, |
wolfSSL | 13:f67a6c6013ca | 198 | const byte* nonce, word32 nonceSz, |
wolfSSL | 13:f67a6c6013ca | 199 | const byte* authTag, word32 authTagSz, |
wolfSSL | 13:f67a6c6013ca | 200 | const byte* authIn, word32 authInSz) |
wolfSSL | 13:f67a6c6013ca | 201 | { |
wolfSSL | 13:f67a6c6013ca | 202 | |
wolfSSL | 13:f67a6c6013ca | 203 | if (aes == NULL || out == NULL || in == NULL || nonce == NULL |
wolfSSL | 13:f67a6c6013ca | 204 | || authTag == NULL || nonceSz < 7 || nonceSz > 13) { |
wolfSSL | 13:f67a6c6013ca | 205 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 206 | } |
wolfSSL | 13:f67a6c6013ca | 207 | |
wolfSSL | 13:f67a6c6013ca | 208 | return AesCcmDecrypt(aes, out, in, inSz, nonce, nonceSz, |
wolfSSL | 13:f67a6c6013ca | 209 | authTag, authTagSz, authIn, authInSz); |
wolfSSL | 13:f67a6c6013ca | 210 | } |
wolfSSL | 13:f67a6c6013ca | 211 | #endif /* HAVE_AES_DECRYPT */ |
wolfSSL | 13:f67a6c6013ca | 212 | #endif /* HAVE_AESCCM */ |
wolfSSL | 13:f67a6c6013ca | 213 | |
wolfSSL | 13:f67a6c6013ca | 214 | int wc_AesInit(Aes* aes, void* h, int i) |
wolfSSL | 13:f67a6c6013ca | 215 | { |
wolfSSL | 13:f67a6c6013ca | 216 | (void)aes; |
wolfSSL | 13:f67a6c6013ca | 217 | (void)h; |
wolfSSL | 13:f67a6c6013ca | 218 | (void)i; |
wolfSSL | 13:f67a6c6013ca | 219 | /* FIPS doesn't support: |
wolfSSL | 13:f67a6c6013ca | 220 | return AesInit(aes, h, i); */ |
wolfSSL | 13:f67a6c6013ca | 221 | return 0; |
wolfSSL | 13:f67a6c6013ca | 222 | } |
wolfSSL | 13:f67a6c6013ca | 223 | void wc_AesFree(Aes* aes) |
wolfSSL | 13:f67a6c6013ca | 224 | { |
wolfSSL | 13:f67a6c6013ca | 225 | (void)aes; |
wolfSSL | 13:f67a6c6013ca | 226 | /* FIPS doesn't support: |
wolfSSL | 13:f67a6c6013ca | 227 | AesFree(aes); */ |
wolfSSL | 13:f67a6c6013ca | 228 | } |
wolfSSL | 13:f67a6c6013ca | 229 | |
wolfSSL | 13:f67a6c6013ca | 230 | #else /* HAVE_FIPS */ |
wolfSSL | 13:f67a6c6013ca | 231 | |
wolfSSL | 13:f67a6c6013ca | 232 | |
wolfSSL | 13:f67a6c6013ca | 233 | #if defined(WOLFSSL_TI_CRYPT) |
wolfSSL | 13:f67a6c6013ca | 234 | #include <wolfcrypt/src/port/ti/ti-aes.c> |
wolfSSL | 13:f67a6c6013ca | 235 | #else |
wolfSSL | 13:f67a6c6013ca | 236 | |
wolfSSL | 13:f67a6c6013ca | 237 | #include <wolfssl/wolfcrypt/logging.h> |
wolfSSL | 13:f67a6c6013ca | 238 | |
wolfSSL | 13:f67a6c6013ca | 239 | #ifdef NO_INLINE |
wolfSSL | 13:f67a6c6013ca | 240 | #include <wolfssl/wolfcrypt/misc.h> |
wolfSSL | 13:f67a6c6013ca | 241 | #else |
wolfSSL | 13:f67a6c6013ca | 242 | #define WOLFSSL_MISC_INCLUDED |
wolfSSL | 13:f67a6c6013ca | 243 | #include <wolfcrypt/src/misc.c> |
wolfSSL | 13:f67a6c6013ca | 244 | #endif |
wolfSSL | 13:f67a6c6013ca | 245 | |
wolfSSL | 13:f67a6c6013ca | 246 | #ifndef WOLFSSL_ARMASM |
wolfSSL | 13:f67a6c6013ca | 247 | |
wolfSSL | 13:f67a6c6013ca | 248 | #ifdef DEBUG_AESNI |
wolfSSL | 13:f67a6c6013ca | 249 | #include <stdio.h> |
wolfSSL | 13:f67a6c6013ca | 250 | #endif |
wolfSSL | 13:f67a6c6013ca | 251 | |
wolfSSL | 13:f67a6c6013ca | 252 | #ifdef _MSC_VER |
wolfSSL | 13:f67a6c6013ca | 253 | /* 4127 warning constant while(1) */ |
wolfSSL | 13:f67a6c6013ca | 254 | #pragma warning(disable: 4127) |
wolfSSL | 13:f67a6c6013ca | 255 | #endif |
wolfSSL | 13:f67a6c6013ca | 256 | |
wolfSSL | 13:f67a6c6013ca | 257 | |
wolfSSL | 13:f67a6c6013ca | 258 | /* Define AES implementation includes and functions */ |
wolfSSL | 13:f67a6c6013ca | 259 | #if defined(STM32F2_CRYPTO) || defined(STM32F4_CRYPTO) |
wolfSSL | 13:f67a6c6013ca | 260 | /* STM32F2/F4 hardware AES support for CBC, CTR modes */ |
wolfSSL | 13:f67a6c6013ca | 261 | |
wolfSSL | 13:f67a6c6013ca | 262 | /* CRYPT_AES_GCM starts the IV with 2 */ |
wolfSSL | 13:f67a6c6013ca | 263 | #define STM32_GCM_IV_START 2 |
wolfSSL | 13:f67a6c6013ca | 264 | |
wolfSSL | 13:f67a6c6013ca | 265 | #if defined(WOLFSSL_AES_DIRECT) || defined(HAVE_AESGCM) || defined(HAVE_AESCCM) |
wolfSSL | 13:f67a6c6013ca | 266 | static int wc_AesEncrypt(Aes* aes, const byte* inBlock, byte* outBlock) |
wolfSSL | 13:f67a6c6013ca | 267 | { |
wolfSSL | 13:f67a6c6013ca | 268 | int ret = 0; |
wolfSSL | 13:f67a6c6013ca | 269 | #ifdef WOLFSSL_STM32_CUBEMX |
wolfSSL | 13:f67a6c6013ca | 270 | CRYP_HandleTypeDef hcryp; |
wolfSSL | 13:f67a6c6013ca | 271 | |
wolfSSL | 13:f67a6c6013ca | 272 | XMEMSET(&hcryp, 0, sizeof(CRYP_HandleTypeDef)); |
wolfSSL | 13:f67a6c6013ca | 273 | switch(aes->rounds) { |
wolfSSL | 13:f67a6c6013ca | 274 | case 10: /* 128-bit key */ |
wolfSSL | 13:f67a6c6013ca | 275 | hcryp.Init.KeySize = CRYP_KEYSIZE_128B; |
wolfSSL | 13:f67a6c6013ca | 276 | break; |
wolfSSL | 13:f67a6c6013ca | 277 | case 12: /* 192-bit key */ |
wolfSSL | 13:f67a6c6013ca | 278 | hcryp.Init.KeySize = CRYP_KEYSIZE_192B; |
wolfSSL | 13:f67a6c6013ca | 279 | break; |
wolfSSL | 13:f67a6c6013ca | 280 | case 14: /* 256-bit key */ |
wolfSSL | 13:f67a6c6013ca | 281 | hcryp.Init.KeySize = CRYP_KEYSIZE_256B; |
wolfSSL | 13:f67a6c6013ca | 282 | break; |
wolfSSL | 13:f67a6c6013ca | 283 | default: |
wolfSSL | 13:f67a6c6013ca | 284 | break; |
wolfSSL | 13:f67a6c6013ca | 285 | } |
wolfSSL | 13:f67a6c6013ca | 286 | hcryp.Instance = CRYP; |
wolfSSL | 13:f67a6c6013ca | 287 | hcryp.Init.DataType = CRYP_DATATYPE_8B; |
wolfSSL | 13:f67a6c6013ca | 288 | hcryp.Init.pKey = (uint8_t*)aes->key; |
wolfSSL | 13:f67a6c6013ca | 289 | |
wolfSSL | 13:f67a6c6013ca | 290 | HAL_CRYP_Init(&hcryp); |
wolfSSL | 13:f67a6c6013ca | 291 | |
wolfSSL | 13:f67a6c6013ca | 292 | if (HAL_CRYP_AESECB_Encrypt(&hcryp, (uint8_t*)inBlock, AES_BLOCK_SIZE, |
wolfSSL | 13:f67a6c6013ca | 293 | outBlock, STM32_HAL_TIMEOUT) != HAL_OK) { |
wolfSSL | 13:f67a6c6013ca | 294 | ret = WC_TIMEOUT_E; |
wolfSSL | 13:f67a6c6013ca | 295 | } |
wolfSSL | 13:f67a6c6013ca | 296 | |
wolfSSL | 13:f67a6c6013ca | 297 | HAL_CRYP_DeInit(&hcryp); |
wolfSSL | 13:f67a6c6013ca | 298 | #else |
wolfSSL | 13:f67a6c6013ca | 299 | word32 *enc_key; |
wolfSSL | 13:f67a6c6013ca | 300 | CRYP_InitTypeDef AES_CRYP_InitStructure; |
wolfSSL | 13:f67a6c6013ca | 301 | CRYP_KeyInitTypeDef AES_CRYP_KeyInitStructure; |
wolfSSL | 13:f67a6c6013ca | 302 | |
wolfSSL | 13:f67a6c6013ca | 303 | enc_key = aes->key; |
wolfSSL | 13:f67a6c6013ca | 304 | |
wolfSSL | 13:f67a6c6013ca | 305 | /* crypto structure initialization */ |
wolfSSL | 13:f67a6c6013ca | 306 | CRYP_KeyStructInit(&AES_CRYP_KeyInitStructure); |
wolfSSL | 13:f67a6c6013ca | 307 | CRYP_StructInit(&AES_CRYP_InitStructure); |
wolfSSL | 13:f67a6c6013ca | 308 | |
wolfSSL | 13:f67a6c6013ca | 309 | /* reset registers to their default values */ |
wolfSSL | 13:f67a6c6013ca | 310 | CRYP_DeInit(); |
wolfSSL | 13:f67a6c6013ca | 311 | |
wolfSSL | 13:f67a6c6013ca | 312 | /* load key into correct registers */ |
wolfSSL | 13:f67a6c6013ca | 313 | switch (aes->rounds) { |
wolfSSL | 13:f67a6c6013ca | 314 | case 10: /* 128-bit key */ |
wolfSSL | 13:f67a6c6013ca | 315 | AES_CRYP_InitStructure.CRYP_KeySize = CRYP_KeySize_128b; |
wolfSSL | 13:f67a6c6013ca | 316 | AES_CRYP_KeyInitStructure.CRYP_Key2Left = enc_key[0]; |
wolfSSL | 13:f67a6c6013ca | 317 | AES_CRYP_KeyInitStructure.CRYP_Key2Right = enc_key[1]; |
wolfSSL | 13:f67a6c6013ca | 318 | AES_CRYP_KeyInitStructure.CRYP_Key3Left = enc_key[2]; |
wolfSSL | 13:f67a6c6013ca | 319 | AES_CRYP_KeyInitStructure.CRYP_Key3Right = enc_key[3]; |
wolfSSL | 13:f67a6c6013ca | 320 | break; |
wolfSSL | 13:f67a6c6013ca | 321 | |
wolfSSL | 13:f67a6c6013ca | 322 | case 12: /* 192-bit key */ |
wolfSSL | 13:f67a6c6013ca | 323 | AES_CRYP_InitStructure.CRYP_KeySize = CRYP_KeySize_192b; |
wolfSSL | 13:f67a6c6013ca | 324 | AES_CRYP_KeyInitStructure.CRYP_Key1Left = enc_key[0]; |
wolfSSL | 13:f67a6c6013ca | 325 | AES_CRYP_KeyInitStructure.CRYP_Key1Right = enc_key[1]; |
wolfSSL | 13:f67a6c6013ca | 326 | AES_CRYP_KeyInitStructure.CRYP_Key2Left = enc_key[2]; |
wolfSSL | 13:f67a6c6013ca | 327 | AES_CRYP_KeyInitStructure.CRYP_Key2Right = enc_key[3]; |
wolfSSL | 13:f67a6c6013ca | 328 | AES_CRYP_KeyInitStructure.CRYP_Key3Left = enc_key[4]; |
wolfSSL | 13:f67a6c6013ca | 329 | AES_CRYP_KeyInitStructure.CRYP_Key3Right = enc_key[5]; |
wolfSSL | 13:f67a6c6013ca | 330 | break; |
wolfSSL | 13:f67a6c6013ca | 331 | |
wolfSSL | 13:f67a6c6013ca | 332 | case 14: /* 256-bit key */ |
wolfSSL | 13:f67a6c6013ca | 333 | AES_CRYP_InitStructure.CRYP_KeySize = CRYP_KeySize_256b; |
wolfSSL | 13:f67a6c6013ca | 334 | AES_CRYP_KeyInitStructure.CRYP_Key0Left = enc_key[0]; |
wolfSSL | 13:f67a6c6013ca | 335 | AES_CRYP_KeyInitStructure.CRYP_Key0Right = enc_key[1]; |
wolfSSL | 13:f67a6c6013ca | 336 | AES_CRYP_KeyInitStructure.CRYP_Key1Left = enc_key[2]; |
wolfSSL | 13:f67a6c6013ca | 337 | AES_CRYP_KeyInitStructure.CRYP_Key1Right = enc_key[3]; |
wolfSSL | 13:f67a6c6013ca | 338 | AES_CRYP_KeyInitStructure.CRYP_Key2Left = enc_key[4]; |
wolfSSL | 13:f67a6c6013ca | 339 | AES_CRYP_KeyInitStructure.CRYP_Key2Right = enc_key[5]; |
wolfSSL | 13:f67a6c6013ca | 340 | AES_CRYP_KeyInitStructure.CRYP_Key3Left = enc_key[6]; |
wolfSSL | 13:f67a6c6013ca | 341 | AES_CRYP_KeyInitStructure.CRYP_Key3Right = enc_key[7]; |
wolfSSL | 13:f67a6c6013ca | 342 | break; |
wolfSSL | 13:f67a6c6013ca | 343 | |
wolfSSL | 13:f67a6c6013ca | 344 | default: |
wolfSSL | 13:f67a6c6013ca | 345 | break; |
wolfSSL | 13:f67a6c6013ca | 346 | } |
wolfSSL | 13:f67a6c6013ca | 347 | CRYP_KeyInit(&AES_CRYP_KeyInitStructure); |
wolfSSL | 13:f67a6c6013ca | 348 | |
wolfSSL | 13:f67a6c6013ca | 349 | /* set direction, mode, and datatype */ |
wolfSSL | 13:f67a6c6013ca | 350 | AES_CRYP_InitStructure.CRYP_AlgoDir = CRYP_AlgoDir_Encrypt; |
wolfSSL | 13:f67a6c6013ca | 351 | AES_CRYP_InitStructure.CRYP_AlgoMode = CRYP_AlgoMode_AES_ECB; |
wolfSSL | 13:f67a6c6013ca | 352 | AES_CRYP_InitStructure.CRYP_DataType = CRYP_DataType_8b; |
wolfSSL | 13:f67a6c6013ca | 353 | CRYP_Init(&AES_CRYP_InitStructure); |
wolfSSL | 13:f67a6c6013ca | 354 | |
wolfSSL | 13:f67a6c6013ca | 355 | /* enable crypto processor */ |
wolfSSL | 13:f67a6c6013ca | 356 | CRYP_Cmd(ENABLE); |
wolfSSL | 13:f67a6c6013ca | 357 | |
wolfSSL | 13:f67a6c6013ca | 358 | /* flush IN/OUT FIFOs */ |
wolfSSL | 13:f67a6c6013ca | 359 | CRYP_FIFOFlush(); |
wolfSSL | 13:f67a6c6013ca | 360 | |
wolfSSL | 13:f67a6c6013ca | 361 | CRYP_DataIn(*(uint32_t*)&inBlock[0]); |
wolfSSL | 13:f67a6c6013ca | 362 | CRYP_DataIn(*(uint32_t*)&inBlock[4]); |
wolfSSL | 13:f67a6c6013ca | 363 | CRYP_DataIn(*(uint32_t*)&inBlock[8]); |
wolfSSL | 13:f67a6c6013ca | 364 | CRYP_DataIn(*(uint32_t*)&inBlock[12]); |
wolfSSL | 13:f67a6c6013ca | 365 | |
wolfSSL | 13:f67a6c6013ca | 366 | /* wait until the complete message has been processed */ |
wolfSSL | 13:f67a6c6013ca | 367 | while (CRYP_GetFlagStatus(CRYP_FLAG_BUSY) != RESET) {} |
wolfSSL | 13:f67a6c6013ca | 368 | |
wolfSSL | 13:f67a6c6013ca | 369 | *(uint32_t*)&outBlock[0] = CRYP_DataOut(); |
wolfSSL | 13:f67a6c6013ca | 370 | *(uint32_t*)&outBlock[4] = CRYP_DataOut(); |
wolfSSL | 13:f67a6c6013ca | 371 | *(uint32_t*)&outBlock[8] = CRYP_DataOut(); |
wolfSSL | 13:f67a6c6013ca | 372 | *(uint32_t*)&outBlock[12] = CRYP_DataOut(); |
wolfSSL | 13:f67a6c6013ca | 373 | |
wolfSSL | 13:f67a6c6013ca | 374 | /* disable crypto processor */ |
wolfSSL | 13:f67a6c6013ca | 375 | CRYP_Cmd(DISABLE); |
wolfSSL | 13:f67a6c6013ca | 376 | #endif /* WOLFSSL_STM32_CUBEMX */ |
wolfSSL | 13:f67a6c6013ca | 377 | return ret; |
wolfSSL | 13:f67a6c6013ca | 378 | } |
wolfSSL | 13:f67a6c6013ca | 379 | #endif /* WOLFSSL_AES_DIRECT || HAVE_AESGCM || HAVE_AESCCM */ |
wolfSSL | 13:f67a6c6013ca | 380 | |
wolfSSL | 13:f67a6c6013ca | 381 | #ifdef HAVE_AES_DECRYPT |
wolfSSL | 13:f67a6c6013ca | 382 | #if defined(WOLFSSL_AES_DIRECT) || defined(HAVE_AESCCM) |
wolfSSL | 13:f67a6c6013ca | 383 | static int wc_AesDecrypt(Aes* aes, const byte* inBlock, byte* outBlock) |
wolfSSL | 13:f67a6c6013ca | 384 | { |
wolfSSL | 13:f67a6c6013ca | 385 | int ret = 0; |
wolfSSL | 13:f67a6c6013ca | 386 | #ifdef WOLFSSL_STM32_CUBEMX |
wolfSSL | 13:f67a6c6013ca | 387 | CRYP_HandleTypeDef hcryp; |
wolfSSL | 13:f67a6c6013ca | 388 | |
wolfSSL | 13:f67a6c6013ca | 389 | XMEMSET(&hcryp, 0, sizeof(CRYP_HandleTypeDef)); |
wolfSSL | 13:f67a6c6013ca | 390 | switch(aes->rounds) { |
wolfSSL | 13:f67a6c6013ca | 391 | case 10: /* 128-bit key */ |
wolfSSL | 13:f67a6c6013ca | 392 | hcryp.Init.KeySize = CRYP_KEYSIZE_128B; |
wolfSSL | 13:f67a6c6013ca | 393 | break; |
wolfSSL | 13:f67a6c6013ca | 394 | case 12: /* 192-bit key */ |
wolfSSL | 13:f67a6c6013ca | 395 | hcryp.Init.KeySize = CRYP_KEYSIZE_192B; |
wolfSSL | 13:f67a6c6013ca | 396 | break; |
wolfSSL | 13:f67a6c6013ca | 397 | case 14: /* 256-bit key */ |
wolfSSL | 13:f67a6c6013ca | 398 | hcryp.Init.KeySize = CRYP_KEYSIZE_256B; |
wolfSSL | 13:f67a6c6013ca | 399 | break; |
wolfSSL | 13:f67a6c6013ca | 400 | default: |
wolfSSL | 13:f67a6c6013ca | 401 | break; |
wolfSSL | 13:f67a6c6013ca | 402 | } |
wolfSSL | 13:f67a6c6013ca | 403 | hcryp.Instance = CRYP; |
wolfSSL | 13:f67a6c6013ca | 404 | hcryp.Init.DataType = CRYP_DATATYPE_8B; |
wolfSSL | 13:f67a6c6013ca | 405 | hcryp.Init.pKey = (uint8_t*)aes->key; |
wolfSSL | 13:f67a6c6013ca | 406 | |
wolfSSL | 13:f67a6c6013ca | 407 | HAL_CRYP_Init(&hcryp); |
wolfSSL | 13:f67a6c6013ca | 408 | |
wolfSSL | 13:f67a6c6013ca | 409 | if (HAL_CRYP_AESECB_Decrypt(&hcryp, (uint8_t*)inBlock, AES_BLOCK_SIZE, |
wolfSSL | 13:f67a6c6013ca | 410 | outBlock, STM32_HAL_TIMEOUT) != HAL_OK) { |
wolfSSL | 13:f67a6c6013ca | 411 | ret = WC_TIMEOUT_E; |
wolfSSL | 13:f67a6c6013ca | 412 | } |
wolfSSL | 13:f67a6c6013ca | 413 | |
wolfSSL | 13:f67a6c6013ca | 414 | HAL_CRYP_DeInit(&hcryp); |
wolfSSL | 13:f67a6c6013ca | 415 | #else |
wolfSSL | 13:f67a6c6013ca | 416 | word32 *enc_key; |
wolfSSL | 13:f67a6c6013ca | 417 | CRYP_InitTypeDef AES_CRYP_InitStructure; |
wolfSSL | 13:f67a6c6013ca | 418 | CRYP_KeyInitTypeDef AES_CRYP_KeyInitStructure; |
wolfSSL | 13:f67a6c6013ca | 419 | |
wolfSSL | 13:f67a6c6013ca | 420 | enc_key = aes->key; |
wolfSSL | 13:f67a6c6013ca | 421 | |
wolfSSL | 13:f67a6c6013ca | 422 | /* crypto structure initialization */ |
wolfSSL | 13:f67a6c6013ca | 423 | CRYP_KeyStructInit(&AES_CRYP_KeyInitStructure); |
wolfSSL | 13:f67a6c6013ca | 424 | CRYP_StructInit(&AES_CRYP_InitStructure); |
wolfSSL | 13:f67a6c6013ca | 425 | |
wolfSSL | 13:f67a6c6013ca | 426 | /* reset registers to their default values */ |
wolfSSL | 13:f67a6c6013ca | 427 | CRYP_DeInit(); |
wolfSSL | 13:f67a6c6013ca | 428 | |
wolfSSL | 13:f67a6c6013ca | 429 | /* load key into correct registers */ |
wolfSSL | 13:f67a6c6013ca | 430 | switch (aes->rounds) { |
wolfSSL | 13:f67a6c6013ca | 431 | case 10: /* 128-bit key */ |
wolfSSL | 13:f67a6c6013ca | 432 | AES_CRYP_InitStructure.CRYP_KeySize = CRYP_KeySize_128b; |
wolfSSL | 13:f67a6c6013ca | 433 | AES_CRYP_KeyInitStructure.CRYP_Key2Left = enc_key[0]; |
wolfSSL | 13:f67a6c6013ca | 434 | AES_CRYP_KeyInitStructure.CRYP_Key2Right = enc_key[1]; |
wolfSSL | 13:f67a6c6013ca | 435 | AES_CRYP_KeyInitStructure.CRYP_Key3Left = enc_key[2]; |
wolfSSL | 13:f67a6c6013ca | 436 | AES_CRYP_KeyInitStructure.CRYP_Key3Right = enc_key[3]; |
wolfSSL | 13:f67a6c6013ca | 437 | break; |
wolfSSL | 13:f67a6c6013ca | 438 | |
wolfSSL | 13:f67a6c6013ca | 439 | case 12: /* 192-bit key */ |
wolfSSL | 13:f67a6c6013ca | 440 | AES_CRYP_InitStructure.CRYP_KeySize = CRYP_KeySize_192b; |
wolfSSL | 13:f67a6c6013ca | 441 | AES_CRYP_KeyInitStructure.CRYP_Key1Left = enc_key[0]; |
wolfSSL | 13:f67a6c6013ca | 442 | AES_CRYP_KeyInitStructure.CRYP_Key1Right = enc_key[1]; |
wolfSSL | 13:f67a6c6013ca | 443 | AES_CRYP_KeyInitStructure.CRYP_Key2Left = enc_key[2]; |
wolfSSL | 13:f67a6c6013ca | 444 | AES_CRYP_KeyInitStructure.CRYP_Key2Right = enc_key[3]; |
wolfSSL | 13:f67a6c6013ca | 445 | AES_CRYP_KeyInitStructure.CRYP_Key3Left = enc_key[4]; |
wolfSSL | 13:f67a6c6013ca | 446 | AES_CRYP_KeyInitStructure.CRYP_Key3Right = enc_key[5]; |
wolfSSL | 13:f67a6c6013ca | 447 | break; |
wolfSSL | 13:f67a6c6013ca | 448 | |
wolfSSL | 13:f67a6c6013ca | 449 | case 14: /* 256-bit key */ |
wolfSSL | 13:f67a6c6013ca | 450 | AES_CRYP_InitStructure.CRYP_KeySize = CRYP_KeySize_256b; |
wolfSSL | 13:f67a6c6013ca | 451 | AES_CRYP_KeyInitStructure.CRYP_Key0Left = enc_key[0]; |
wolfSSL | 13:f67a6c6013ca | 452 | AES_CRYP_KeyInitStructure.CRYP_Key0Right = enc_key[1]; |
wolfSSL | 13:f67a6c6013ca | 453 | AES_CRYP_KeyInitStructure.CRYP_Key1Left = enc_key[2]; |
wolfSSL | 13:f67a6c6013ca | 454 | AES_CRYP_KeyInitStructure.CRYP_Key1Right = enc_key[3]; |
wolfSSL | 13:f67a6c6013ca | 455 | AES_CRYP_KeyInitStructure.CRYP_Key2Left = enc_key[4]; |
wolfSSL | 13:f67a6c6013ca | 456 | AES_CRYP_KeyInitStructure.CRYP_Key2Right = enc_key[5]; |
wolfSSL | 13:f67a6c6013ca | 457 | AES_CRYP_KeyInitStructure.CRYP_Key3Left = enc_key[6]; |
wolfSSL | 13:f67a6c6013ca | 458 | AES_CRYP_KeyInitStructure.CRYP_Key3Right = enc_key[7]; |
wolfSSL | 13:f67a6c6013ca | 459 | break; |
wolfSSL | 13:f67a6c6013ca | 460 | |
wolfSSL | 13:f67a6c6013ca | 461 | default: |
wolfSSL | 13:f67a6c6013ca | 462 | break; |
wolfSSL | 13:f67a6c6013ca | 463 | } |
wolfSSL | 13:f67a6c6013ca | 464 | CRYP_KeyInit(&AES_CRYP_KeyInitStructure); |
wolfSSL | 13:f67a6c6013ca | 465 | |
wolfSSL | 13:f67a6c6013ca | 466 | /* set direction, mode, and datatype */ |
wolfSSL | 13:f67a6c6013ca | 467 | AES_CRYP_InitStructure.CRYP_AlgoDir = CRYP_AlgoDir_Decrypt; |
wolfSSL | 13:f67a6c6013ca | 468 | AES_CRYP_InitStructure.CRYP_AlgoMode = CRYP_AlgoMode_AES_ECB; |
wolfSSL | 13:f67a6c6013ca | 469 | AES_CRYP_InitStructure.CRYP_DataType = CRYP_DataType_8b; |
wolfSSL | 13:f67a6c6013ca | 470 | CRYP_Init(&AES_CRYP_InitStructure); |
wolfSSL | 13:f67a6c6013ca | 471 | |
wolfSSL | 13:f67a6c6013ca | 472 | /* enable crypto processor */ |
wolfSSL | 13:f67a6c6013ca | 473 | CRYP_Cmd(ENABLE); |
wolfSSL | 13:f67a6c6013ca | 474 | |
wolfSSL | 13:f67a6c6013ca | 475 | /* flush IN/OUT FIFOs */ |
wolfSSL | 13:f67a6c6013ca | 476 | CRYP_FIFOFlush(); |
wolfSSL | 13:f67a6c6013ca | 477 | |
wolfSSL | 13:f67a6c6013ca | 478 | CRYP_DataIn(*(uint32_t*)&inBlock[0]); |
wolfSSL | 13:f67a6c6013ca | 479 | CRYP_DataIn(*(uint32_t*)&inBlock[4]); |
wolfSSL | 13:f67a6c6013ca | 480 | CRYP_DataIn(*(uint32_t*)&inBlock[8]); |
wolfSSL | 13:f67a6c6013ca | 481 | CRYP_DataIn(*(uint32_t*)&inBlock[12]); |
wolfSSL | 13:f67a6c6013ca | 482 | |
wolfSSL | 13:f67a6c6013ca | 483 | /* wait until the complete message has been processed */ |
wolfSSL | 13:f67a6c6013ca | 484 | while (CRYP_GetFlagStatus(CRYP_FLAG_BUSY) != RESET) {} |
wolfSSL | 13:f67a6c6013ca | 485 | |
wolfSSL | 13:f67a6c6013ca | 486 | *(uint32_t*)&outBlock[0] = CRYP_DataOut(); |
wolfSSL | 13:f67a6c6013ca | 487 | *(uint32_t*)&outBlock[4] = CRYP_DataOut(); |
wolfSSL | 13:f67a6c6013ca | 488 | *(uint32_t*)&outBlock[8] = CRYP_DataOut(); |
wolfSSL | 13:f67a6c6013ca | 489 | *(uint32_t*)&outBlock[12] = CRYP_DataOut(); |
wolfSSL | 13:f67a6c6013ca | 490 | |
wolfSSL | 13:f67a6c6013ca | 491 | /* disable crypto processor */ |
wolfSSL | 13:f67a6c6013ca | 492 | CRYP_Cmd(DISABLE); |
wolfSSL | 13:f67a6c6013ca | 493 | #endif /* WOLFSSL_STM32_CUBEMX */ |
wolfSSL | 13:f67a6c6013ca | 494 | return ret; |
wolfSSL | 13:f67a6c6013ca | 495 | } |
wolfSSL | 13:f67a6c6013ca | 496 | #endif /* WOLFSSL_AES_DIRECT || HAVE_AESCCM */ |
wolfSSL | 13:f67a6c6013ca | 497 | #endif /* HAVE_AES_DECRYPT */ |
wolfSSL | 13:f67a6c6013ca | 498 | |
wolfSSL | 13:f67a6c6013ca | 499 | #elif defined(HAVE_COLDFIRE_SEC) |
wolfSSL | 13:f67a6c6013ca | 500 | /* Freescale Coldfire SEC support for CBC mode. |
wolfSSL | 13:f67a6c6013ca | 501 | * NOTE: no support for AES-CTR/GCM/CCM/Direct */ |
wolfSSL | 13:f67a6c6013ca | 502 | #include <wolfssl/wolfcrypt/types.h> |
wolfSSL | 13:f67a6c6013ca | 503 | #include "sec.h" |
wolfSSL | 13:f67a6c6013ca | 504 | #include "mcf5475_sec.h" |
wolfSSL | 13:f67a6c6013ca | 505 | #include "mcf5475_siu.h" |
wolfSSL | 13:f67a6c6013ca | 506 | #elif defined(FREESCALE_LTC) |
wolfSSL | 13:f67a6c6013ca | 507 | #include "fsl_ltc.h" |
wolfSSL | 13:f67a6c6013ca | 508 | #if defined(FREESCALE_LTC_AES_GCM) |
wolfSSL | 13:f67a6c6013ca | 509 | #undef NEED_AES_TABLES |
wolfSSL | 13:f67a6c6013ca | 510 | #undef GCM_TABLE |
wolfSSL | 13:f67a6c6013ca | 511 | #else |
wolfSSL | 13:f67a6c6013ca | 512 | /* if LTC doesn't have GCM, use software with LTC AES ECB mode */ |
wolfSSL | 13:f67a6c6013ca | 513 | static int wc_AesEncrypt(Aes* aes, const byte* inBlock, byte* outBlock) |
wolfSSL | 13:f67a6c6013ca | 514 | { |
wolfSSL | 13:f67a6c6013ca | 515 | wc_AesEncryptDirect(aes, outBlock, inBlock); |
wolfSSL | 13:f67a6c6013ca | 516 | return 0; |
wolfSSL | 13:f67a6c6013ca | 517 | } |
wolfSSL | 13:f67a6c6013ca | 518 | static int wc_AesDecrypt(Aes* aes, const byte* inBlock, byte* outBlock) |
wolfSSL | 13:f67a6c6013ca | 519 | { |
wolfSSL | 13:f67a6c6013ca | 520 | wc_AesDecryptDirect(aes, outBlock, inBlock); |
wolfSSL | 13:f67a6c6013ca | 521 | return 0; |
wolfSSL | 13:f67a6c6013ca | 522 | } |
wolfSSL | 13:f67a6c6013ca | 523 | #endif |
wolfSSL | 13:f67a6c6013ca | 524 | #elif defined(FREESCALE_MMCAU) |
wolfSSL | 13:f67a6c6013ca | 525 | /* Freescale mmCAU hardware AES support for Direct, CBC, CCM, GCM modes |
wolfSSL | 13:f67a6c6013ca | 526 | * through the CAU/mmCAU library. Documentation located in |
wolfSSL | 13:f67a6c6013ca | 527 | * ColdFire/ColdFire+ CAU and Kinetis mmCAU Software Library User |
wolfSSL | 13:f67a6c6013ca | 528 | * Guide (See note in README). */ |
wolfSSL | 13:f67a6c6013ca | 529 | #ifdef FREESCALE_MMCAU_CLASSIC |
wolfSSL | 13:f67a6c6013ca | 530 | /* MMCAU 1.4 library used with non-KSDK / classic MQX builds */ |
wolfSSL | 13:f67a6c6013ca | 531 | #include "cau_api.h" |
wolfSSL | 13:f67a6c6013ca | 532 | #else |
wolfSSL | 13:f67a6c6013ca | 533 | #include "fsl_mmcau.h" |
wolfSSL | 13:f67a6c6013ca | 534 | #endif |
wolfSSL | 13:f67a6c6013ca | 535 | |
wolfSSL | 13:f67a6c6013ca | 536 | static int wc_AesEncrypt(Aes* aes, const byte* inBlock, byte* outBlock) |
wolfSSL | 13:f67a6c6013ca | 537 | { |
wolfSSL | 13:f67a6c6013ca | 538 | int ret; |
wolfSSL | 13:f67a6c6013ca | 539 | |
wolfSSL | 13:f67a6c6013ca | 540 | #ifdef FREESCALE_MMCAU_CLASSIC |
wolfSSL | 13:f67a6c6013ca | 541 | if ((wolfssl_word)outBlock % WOLFSSL_MMCAU_ALIGNMENT) { |
wolfSSL | 13:f67a6c6013ca | 542 | WOLFSSL_MSG("Bad cau_aes_encrypt alignment"); |
wolfSSL | 13:f67a6c6013ca | 543 | return BAD_ALIGN_E; |
wolfSSL | 13:f67a6c6013ca | 544 | } |
wolfSSL | 13:f67a6c6013ca | 545 | #endif |
wolfSSL | 13:f67a6c6013ca | 546 | |
wolfSSL | 13:f67a6c6013ca | 547 | ret = wolfSSL_CryptHwMutexLock(); |
wolfSSL | 13:f67a6c6013ca | 548 | if(ret == 0) { |
wolfSSL | 13:f67a6c6013ca | 549 | #ifdef FREESCALE_MMCAU_CLASSIC |
wolfSSL | 13:f67a6c6013ca | 550 | cau_aes_encrypt(inBlock, (byte*)aes->key, aes->rounds, outBlock); |
wolfSSL | 13:f67a6c6013ca | 551 | #else |
wolfSSL | 13:f67a6c6013ca | 552 | MMCAU_AES_EncryptEcb(inBlock, (byte*)aes->key, aes->rounds, |
wolfSSL | 13:f67a6c6013ca | 553 | outBlock); |
wolfSSL | 13:f67a6c6013ca | 554 | #endif |
wolfSSL | 13:f67a6c6013ca | 555 | wolfSSL_CryptHwMutexUnLock(); |
wolfSSL | 13:f67a6c6013ca | 556 | } |
wolfSSL | 13:f67a6c6013ca | 557 | return ret; |
wolfSSL | 13:f67a6c6013ca | 558 | } |
wolfSSL | 13:f67a6c6013ca | 559 | #ifdef HAVE_AES_DECRYPT |
wolfSSL | 13:f67a6c6013ca | 560 | static int wc_AesDecrypt(Aes* aes, const byte* inBlock, byte* outBlock) |
wolfSSL | 13:f67a6c6013ca | 561 | { |
wolfSSL | 13:f67a6c6013ca | 562 | int ret; |
wolfSSL | 13:f67a6c6013ca | 563 | |
wolfSSL | 13:f67a6c6013ca | 564 | #ifdef FREESCALE_MMCAU_CLASSIC |
wolfSSL | 13:f67a6c6013ca | 565 | if ((wolfssl_word)outBlock % WOLFSSL_MMCAU_ALIGNMENT) { |
wolfSSL | 13:f67a6c6013ca | 566 | WOLFSSL_MSG("Bad cau_aes_decrypt alignment"); |
wolfSSL | 13:f67a6c6013ca | 567 | return BAD_ALIGN_E; |
wolfSSL | 13:f67a6c6013ca | 568 | } |
wolfSSL | 13:f67a6c6013ca | 569 | #endif |
wolfSSL | 13:f67a6c6013ca | 570 | |
wolfSSL | 13:f67a6c6013ca | 571 | ret = wolfSSL_CryptHwMutexLock(); |
wolfSSL | 13:f67a6c6013ca | 572 | if(ret == 0) { |
wolfSSL | 13:f67a6c6013ca | 573 | #ifdef FREESCALE_MMCAU_CLASSIC |
wolfSSL | 13:f67a6c6013ca | 574 | cau_aes_decrypt(inBlock, (byte*)aes->key, aes->rounds, outBlock); |
wolfSSL | 13:f67a6c6013ca | 575 | #else |
wolfSSL | 13:f67a6c6013ca | 576 | MMCAU_AES_DecryptEcb(inBlock, (byte*)aes->key, aes->rounds, |
wolfSSL | 13:f67a6c6013ca | 577 | outBlock); |
wolfSSL | 13:f67a6c6013ca | 578 | #endif |
wolfSSL | 13:f67a6c6013ca | 579 | wolfSSL_CryptHwMutexUnLock(); |
wolfSSL | 13:f67a6c6013ca | 580 | } |
wolfSSL | 13:f67a6c6013ca | 581 | return ret; |
wolfSSL | 13:f67a6c6013ca | 582 | } |
wolfSSL | 13:f67a6c6013ca | 583 | #endif /* HAVE_AES_DECRYPT */ |
wolfSSL | 13:f67a6c6013ca | 584 | |
wolfSSL | 13:f67a6c6013ca | 585 | #elif defined(WOLFSSL_PIC32MZ_CRYPT) |
wolfSSL | 13:f67a6c6013ca | 586 | |
wolfSSL | 13:f67a6c6013ca | 587 | #include <wolfssl/wolfcrypt/port/pic32/pic32mz-crypt.h> |
wolfSSL | 13:f67a6c6013ca | 588 | |
wolfSSL | 13:f67a6c6013ca | 589 | #if defined(HAVE_AESGCM) || defined(WOLFSSL_AES_DIRECT) |
wolfSSL | 13:f67a6c6013ca | 590 | |
wolfSSL | 13:f67a6c6013ca | 591 | static int wc_AesEncrypt(Aes* aes, const byte* inBlock, byte* outBlock) |
wolfSSL | 13:f67a6c6013ca | 592 | { |
wolfSSL | 13:f67a6c6013ca | 593 | return wc_Pic32AesCrypt(aes->key_ce, aes->keylen, NULL, 0, |
wolfSSL | 13:f67a6c6013ca | 594 | outBlock, inBlock, AES_BLOCK_SIZE, |
wolfSSL | 13:f67a6c6013ca | 595 | PIC32_ENCRYPTION, PIC32_ALGO_AES, PIC32_CRYPTOALGO_RECB); |
wolfSSL | 13:f67a6c6013ca | 596 | } |
wolfSSL | 13:f67a6c6013ca | 597 | |
wolfSSL | 13:f67a6c6013ca | 598 | #ifdef HAVE_AES_DECRYPT |
wolfSSL | 13:f67a6c6013ca | 599 | static int wc_AesDecrypt(Aes* aes, const byte* inBlock, byte* outBlock) |
wolfSSL | 13:f67a6c6013ca | 600 | { |
wolfSSL | 13:f67a6c6013ca | 601 | return wc_Pic32AesCrypt(aes->key_ce, aes->keylen, NULL, 0, |
wolfSSL | 13:f67a6c6013ca | 602 | outBlock, inBlock, AES_BLOCK_SIZE, |
wolfSSL | 13:f67a6c6013ca | 603 | PIC32_DECRYPTION, PIC32_ALGO_AES, PIC32_CRYPTOALGO_RECB); |
wolfSSL | 13:f67a6c6013ca | 604 | } |
wolfSSL | 13:f67a6c6013ca | 605 | #endif /* HAVE_AES_DECRYPT */ |
wolfSSL | 13:f67a6c6013ca | 606 | #endif |
wolfSSL | 13:f67a6c6013ca | 607 | |
wolfSSL | 13:f67a6c6013ca | 608 | #elif defined(WOLFSSL_NRF51_AES) |
wolfSSL | 13:f67a6c6013ca | 609 | /* Use built-in AES hardware - AES 128 ECB Encrypt Only */ |
wolfSSL | 13:f67a6c6013ca | 610 | #include "wolfssl/wolfcrypt/port/nrf51.h" |
wolfSSL | 13:f67a6c6013ca | 611 | |
wolfSSL | 13:f67a6c6013ca | 612 | static int wc_AesEncrypt(Aes* aes, const byte* inBlock, byte* outBlock) |
wolfSSL | 13:f67a6c6013ca | 613 | { |
wolfSSL | 13:f67a6c6013ca | 614 | return nrf51_aes_encrypt(inBlock, (byte*)aes->key, aes->rounds, outBlock); |
wolfSSL | 13:f67a6c6013ca | 615 | } |
wolfSSL | 13:f67a6c6013ca | 616 | |
wolfSSL | 13:f67a6c6013ca | 617 | #ifdef HAVE_AES_DECRYPT |
wolfSSL | 13:f67a6c6013ca | 618 | #error nRF51 AES Hardware does not support decrypt |
wolfSSL | 13:f67a6c6013ca | 619 | #endif /* HAVE_AES_DECRYPT */ |
wolfSSL | 13:f67a6c6013ca | 620 | |
wolfSSL | 13:f67a6c6013ca | 621 | |
wolfSSL | 13:f67a6c6013ca | 622 | #elif defined(WOLFSSL_AESNI) |
wolfSSL | 13:f67a6c6013ca | 623 | |
wolfSSL | 13:f67a6c6013ca | 624 | #define NEED_AES_TABLES |
wolfSSL | 13:f67a6c6013ca | 625 | |
wolfSSL | 13:f67a6c6013ca | 626 | /* Each platform needs to query info type 1 from cpuid to see if aesni is |
wolfSSL | 13:f67a6c6013ca | 627 | * supported. Also, let's setup a macro for proper linkage w/o ABI conflicts |
wolfSSL | 13:f67a6c6013ca | 628 | */ |
wolfSSL | 13:f67a6c6013ca | 629 | |
wolfSSL | 13:f67a6c6013ca | 630 | #ifndef AESNI_ALIGN |
wolfSSL | 13:f67a6c6013ca | 631 | #define AESNI_ALIGN 16 |
wolfSSL | 13:f67a6c6013ca | 632 | #endif |
wolfSSL | 13:f67a6c6013ca | 633 | |
wolfSSL | 13:f67a6c6013ca | 634 | #ifndef _MSC_VER |
wolfSSL | 13:f67a6c6013ca | 635 | #define XASM_LINK(f) asm(f) |
wolfSSL | 13:f67a6c6013ca | 636 | #else |
wolfSSL | 13:f67a6c6013ca | 637 | #define XASM_LINK(f) |
wolfSSL | 13:f67a6c6013ca | 638 | #endif /* _MSC_VER */ |
wolfSSL | 13:f67a6c6013ca | 639 | |
wolfSSL | 13:f67a6c6013ca | 640 | static int checkAESNI = 0; |
wolfSSL | 13:f67a6c6013ca | 641 | static int haveAESNI = 0; |
wolfSSL | 13:f67a6c6013ca | 642 | static word32 intel_flags = 0; |
wolfSSL | 13:f67a6c6013ca | 643 | |
wolfSSL | 13:f67a6c6013ca | 644 | static int Check_CPU_support_AES(void) |
wolfSSL | 13:f67a6c6013ca | 645 | { |
wolfSSL | 13:f67a6c6013ca | 646 | intel_flags = cpuid_get_flags(); |
wolfSSL | 13:f67a6c6013ca | 647 | |
wolfSSL | 13:f67a6c6013ca | 648 | return IS_INTEL_AESNI(intel_flags) != 0; |
wolfSSL | 13:f67a6c6013ca | 649 | } |
wolfSSL | 13:f67a6c6013ca | 650 | |
wolfSSL | 13:f67a6c6013ca | 651 | |
wolfSSL | 13:f67a6c6013ca | 652 | /* tell C compiler these are asm functions in case any mix up of ABI underscore |
wolfSSL | 13:f67a6c6013ca | 653 | prefix between clang/gcc/llvm etc */ |
wolfSSL | 13:f67a6c6013ca | 654 | #ifdef HAVE_AES_CBC |
wolfSSL | 13:f67a6c6013ca | 655 | void AES_CBC_encrypt(const unsigned char* in, unsigned char* out, |
wolfSSL | 13:f67a6c6013ca | 656 | unsigned char* ivec, unsigned long length, |
wolfSSL | 13:f67a6c6013ca | 657 | const unsigned char* KS, int nr) |
wolfSSL | 13:f67a6c6013ca | 658 | XASM_LINK("AES_CBC_encrypt"); |
wolfSSL | 13:f67a6c6013ca | 659 | |
wolfSSL | 13:f67a6c6013ca | 660 | #ifdef HAVE_AES_DECRYPT |
wolfSSL | 13:f67a6c6013ca | 661 | #if defined(WOLFSSL_AESNI_BY4) |
wolfSSL | 13:f67a6c6013ca | 662 | void AES_CBC_decrypt_by4(const unsigned char* in, unsigned char* out, |
wolfSSL | 13:f67a6c6013ca | 663 | unsigned char* ivec, unsigned long length, |
wolfSSL | 13:f67a6c6013ca | 664 | const unsigned char* KS, int nr) |
wolfSSL | 13:f67a6c6013ca | 665 | XASM_LINK("AES_CBC_decrypt_by4"); |
wolfSSL | 13:f67a6c6013ca | 666 | #elif defined(WOLFSSL_AESNI_BY6) |
wolfSSL | 13:f67a6c6013ca | 667 | void AES_CBC_decrypt_by6(const unsigned char* in, unsigned char* out, |
wolfSSL | 13:f67a6c6013ca | 668 | unsigned char* ivec, unsigned long length, |
wolfSSL | 13:f67a6c6013ca | 669 | const unsigned char* KS, int nr) |
wolfSSL | 13:f67a6c6013ca | 670 | XASM_LINK("AES_CBC_decrypt_by6"); |
wolfSSL | 13:f67a6c6013ca | 671 | #else /* WOLFSSL_AESNI_BYx */ |
wolfSSL | 13:f67a6c6013ca | 672 | void AES_CBC_decrypt_by8(const unsigned char* in, unsigned char* out, |
wolfSSL | 13:f67a6c6013ca | 673 | unsigned char* ivec, unsigned long length, |
wolfSSL | 13:f67a6c6013ca | 674 | const unsigned char* KS, int nr) |
wolfSSL | 13:f67a6c6013ca | 675 | XASM_LINK("AES_CBC_decrypt_by8"); |
wolfSSL | 13:f67a6c6013ca | 676 | #endif /* WOLFSSL_AESNI_BYx */ |
wolfSSL | 13:f67a6c6013ca | 677 | #endif /* HAVE_AES_DECRYPT */ |
wolfSSL | 13:f67a6c6013ca | 678 | #endif /* HAVE_AES_CBC */ |
wolfSSL | 13:f67a6c6013ca | 679 | |
wolfSSL | 13:f67a6c6013ca | 680 | void AES_ECB_encrypt(const unsigned char* in, unsigned char* out, |
wolfSSL | 13:f67a6c6013ca | 681 | unsigned long length, const unsigned char* KS, int nr) |
wolfSSL | 13:f67a6c6013ca | 682 | XASM_LINK("AES_ECB_encrypt"); |
wolfSSL | 13:f67a6c6013ca | 683 | |
wolfSSL | 13:f67a6c6013ca | 684 | #ifdef HAVE_AES_DECRYPT |
wolfSSL | 13:f67a6c6013ca | 685 | void AES_ECB_decrypt(const unsigned char* in, unsigned char* out, |
wolfSSL | 13:f67a6c6013ca | 686 | unsigned long length, const unsigned char* KS, int nr) |
wolfSSL | 13:f67a6c6013ca | 687 | XASM_LINK("AES_ECB_decrypt"); |
wolfSSL | 13:f67a6c6013ca | 688 | #endif |
wolfSSL | 13:f67a6c6013ca | 689 | |
wolfSSL | 13:f67a6c6013ca | 690 | void AES_128_Key_Expansion(const unsigned char* userkey, |
wolfSSL | 13:f67a6c6013ca | 691 | unsigned char* key_schedule) |
wolfSSL | 13:f67a6c6013ca | 692 | XASM_LINK("AES_128_Key_Expansion"); |
wolfSSL | 13:f67a6c6013ca | 693 | |
wolfSSL | 13:f67a6c6013ca | 694 | void AES_192_Key_Expansion(const unsigned char* userkey, |
wolfSSL | 13:f67a6c6013ca | 695 | unsigned char* key_schedule) |
wolfSSL | 13:f67a6c6013ca | 696 | XASM_LINK("AES_192_Key_Expansion"); |
wolfSSL | 13:f67a6c6013ca | 697 | |
wolfSSL | 13:f67a6c6013ca | 698 | void AES_256_Key_Expansion(const unsigned char* userkey, |
wolfSSL | 13:f67a6c6013ca | 699 | unsigned char* key_schedule) |
wolfSSL | 13:f67a6c6013ca | 700 | XASM_LINK("AES_256_Key_Expansion"); |
wolfSSL | 13:f67a6c6013ca | 701 | |
wolfSSL | 13:f67a6c6013ca | 702 | |
wolfSSL | 13:f67a6c6013ca | 703 | static int AES_set_encrypt_key(const unsigned char *userKey, const int bits, |
wolfSSL | 13:f67a6c6013ca | 704 | Aes* aes) |
wolfSSL | 13:f67a6c6013ca | 705 | { |
wolfSSL | 13:f67a6c6013ca | 706 | int ret; |
wolfSSL | 13:f67a6c6013ca | 707 | |
wolfSSL | 13:f67a6c6013ca | 708 | if (!userKey || !aes) |
wolfSSL | 13:f67a6c6013ca | 709 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 710 | |
wolfSSL | 13:f67a6c6013ca | 711 | switch (bits) { |
wolfSSL | 13:f67a6c6013ca | 712 | case 128: |
wolfSSL | 13:f67a6c6013ca | 713 | AES_128_Key_Expansion (userKey,(byte*)aes->key); aes->rounds = 10; |
wolfSSL | 13:f67a6c6013ca | 714 | return 0; |
wolfSSL | 13:f67a6c6013ca | 715 | case 192: |
wolfSSL | 13:f67a6c6013ca | 716 | AES_192_Key_Expansion (userKey,(byte*)aes->key); aes->rounds = 12; |
wolfSSL | 13:f67a6c6013ca | 717 | return 0; |
wolfSSL | 13:f67a6c6013ca | 718 | case 256: |
wolfSSL | 13:f67a6c6013ca | 719 | AES_256_Key_Expansion (userKey,(byte*)aes->key); aes->rounds = 14; |
wolfSSL | 13:f67a6c6013ca | 720 | return 0; |
wolfSSL | 13:f67a6c6013ca | 721 | default: |
wolfSSL | 13:f67a6c6013ca | 722 | ret = BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 723 | } |
wolfSSL | 13:f67a6c6013ca | 724 | |
wolfSSL | 13:f67a6c6013ca | 725 | return ret; |
wolfSSL | 13:f67a6c6013ca | 726 | } |
wolfSSL | 13:f67a6c6013ca | 727 | |
wolfSSL | 13:f67a6c6013ca | 728 | #ifdef HAVE_AES_DECRYPT |
wolfSSL | 13:f67a6c6013ca | 729 | static int AES_set_decrypt_key(const unsigned char* userKey, |
wolfSSL | 13:f67a6c6013ca | 730 | const int bits, Aes* aes) |
wolfSSL | 13:f67a6c6013ca | 731 | { |
wolfSSL | 13:f67a6c6013ca | 732 | int nr; |
wolfSSL | 13:f67a6c6013ca | 733 | Aes temp_key; |
wolfSSL | 13:f67a6c6013ca | 734 | __m128i *Key_Schedule = (__m128i*)aes->key; |
wolfSSL | 13:f67a6c6013ca | 735 | __m128i *Temp_Key_Schedule = (__m128i*)temp_key.key; |
wolfSSL | 13:f67a6c6013ca | 736 | |
wolfSSL | 13:f67a6c6013ca | 737 | if (!userKey || !aes) |
wolfSSL | 13:f67a6c6013ca | 738 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 739 | |
wolfSSL | 13:f67a6c6013ca | 740 | if (AES_set_encrypt_key(userKey,bits,&temp_key) == BAD_FUNC_ARG) |
wolfSSL | 13:f67a6c6013ca | 741 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 742 | |
wolfSSL | 13:f67a6c6013ca | 743 | nr = temp_key.rounds; |
wolfSSL | 13:f67a6c6013ca | 744 | aes->rounds = nr; |
wolfSSL | 13:f67a6c6013ca | 745 | |
wolfSSL | 13:f67a6c6013ca | 746 | Key_Schedule[nr] = Temp_Key_Schedule[0]; |
wolfSSL | 13:f67a6c6013ca | 747 | Key_Schedule[nr-1] = _mm_aesimc_si128(Temp_Key_Schedule[1]); |
wolfSSL | 13:f67a6c6013ca | 748 | Key_Schedule[nr-2] = _mm_aesimc_si128(Temp_Key_Schedule[2]); |
wolfSSL | 13:f67a6c6013ca | 749 | Key_Schedule[nr-3] = _mm_aesimc_si128(Temp_Key_Schedule[3]); |
wolfSSL | 13:f67a6c6013ca | 750 | Key_Schedule[nr-4] = _mm_aesimc_si128(Temp_Key_Schedule[4]); |
wolfSSL | 13:f67a6c6013ca | 751 | Key_Schedule[nr-5] = _mm_aesimc_si128(Temp_Key_Schedule[5]); |
wolfSSL | 13:f67a6c6013ca | 752 | Key_Schedule[nr-6] = _mm_aesimc_si128(Temp_Key_Schedule[6]); |
wolfSSL | 13:f67a6c6013ca | 753 | Key_Schedule[nr-7] = _mm_aesimc_si128(Temp_Key_Schedule[7]); |
wolfSSL | 13:f67a6c6013ca | 754 | Key_Schedule[nr-8] = _mm_aesimc_si128(Temp_Key_Schedule[8]); |
wolfSSL | 13:f67a6c6013ca | 755 | Key_Schedule[nr-9] = _mm_aesimc_si128(Temp_Key_Schedule[9]); |
wolfSSL | 13:f67a6c6013ca | 756 | |
wolfSSL | 13:f67a6c6013ca | 757 | if (nr>10) { |
wolfSSL | 13:f67a6c6013ca | 758 | Key_Schedule[nr-10] = _mm_aesimc_si128(Temp_Key_Schedule[10]); |
wolfSSL | 13:f67a6c6013ca | 759 | Key_Schedule[nr-11] = _mm_aesimc_si128(Temp_Key_Schedule[11]); |
wolfSSL | 13:f67a6c6013ca | 760 | } |
wolfSSL | 13:f67a6c6013ca | 761 | |
wolfSSL | 13:f67a6c6013ca | 762 | if (nr>12) { |
wolfSSL | 13:f67a6c6013ca | 763 | Key_Schedule[nr-12] = _mm_aesimc_si128(Temp_Key_Schedule[12]); |
wolfSSL | 13:f67a6c6013ca | 764 | Key_Schedule[nr-13] = _mm_aesimc_si128(Temp_Key_Schedule[13]); |
wolfSSL | 13:f67a6c6013ca | 765 | } |
wolfSSL | 13:f67a6c6013ca | 766 | |
wolfSSL | 13:f67a6c6013ca | 767 | Key_Schedule[0] = Temp_Key_Schedule[nr]; |
wolfSSL | 13:f67a6c6013ca | 768 | |
wolfSSL | 13:f67a6c6013ca | 769 | return 0; |
wolfSSL | 13:f67a6c6013ca | 770 | } |
wolfSSL | 13:f67a6c6013ca | 771 | #endif /* HAVE_AES_DECRYPT */ |
wolfSSL | 13:f67a6c6013ca | 772 | |
wolfSSL | 13:f67a6c6013ca | 773 | #else |
wolfSSL | 13:f67a6c6013ca | 774 | |
wolfSSL | 13:f67a6c6013ca | 775 | /* using wolfCrypt software AES implementation */ |
wolfSSL | 13:f67a6c6013ca | 776 | #define NEED_AES_TABLES |
wolfSSL | 13:f67a6c6013ca | 777 | #endif |
wolfSSL | 13:f67a6c6013ca | 778 | |
wolfSSL | 13:f67a6c6013ca | 779 | |
wolfSSL | 13:f67a6c6013ca | 780 | |
wolfSSL | 13:f67a6c6013ca | 781 | #ifdef NEED_AES_TABLES |
wolfSSL | 13:f67a6c6013ca | 782 | |
wolfSSL | 13:f67a6c6013ca | 783 | static const word32 rcon[] = { |
wolfSSL | 13:f67a6c6013ca | 784 | 0x01000000, 0x02000000, 0x04000000, 0x08000000, |
wolfSSL | 13:f67a6c6013ca | 785 | 0x10000000, 0x20000000, 0x40000000, 0x80000000, |
wolfSSL | 13:f67a6c6013ca | 786 | 0x1B000000, 0x36000000, |
wolfSSL | 13:f67a6c6013ca | 787 | /* for 128-bit blocks, Rijndael never uses more than 10 rcon values */ |
wolfSSL | 13:f67a6c6013ca | 788 | }; |
wolfSSL | 13:f67a6c6013ca | 789 | |
wolfSSL | 13:f67a6c6013ca | 790 | static const word32 Te[4][256] = { |
wolfSSL | 13:f67a6c6013ca | 791 | { |
wolfSSL | 13:f67a6c6013ca | 792 | 0xc66363a5U, 0xf87c7c84U, 0xee777799U, 0xf67b7b8dU, |
wolfSSL | 13:f67a6c6013ca | 793 | 0xfff2f20dU, 0xd66b6bbdU, 0xde6f6fb1U, 0x91c5c554U, |
wolfSSL | 13:f67a6c6013ca | 794 | 0x60303050U, 0x02010103U, 0xce6767a9U, 0x562b2b7dU, |
wolfSSL | 13:f67a6c6013ca | 795 | 0xe7fefe19U, 0xb5d7d762U, 0x4dababe6U, 0xec76769aU, |
wolfSSL | 13:f67a6c6013ca | 796 | 0x8fcaca45U, 0x1f82829dU, 0x89c9c940U, 0xfa7d7d87U, |
wolfSSL | 13:f67a6c6013ca | 797 | 0xeffafa15U, 0xb25959ebU, 0x8e4747c9U, 0xfbf0f00bU, |
wolfSSL | 13:f67a6c6013ca | 798 | 0x41adadecU, 0xb3d4d467U, 0x5fa2a2fdU, 0x45afafeaU, |
wolfSSL | 13:f67a6c6013ca | 799 | 0x239c9cbfU, 0x53a4a4f7U, 0xe4727296U, 0x9bc0c05bU, |
wolfSSL | 13:f67a6c6013ca | 800 | 0x75b7b7c2U, 0xe1fdfd1cU, 0x3d9393aeU, 0x4c26266aU, |
wolfSSL | 13:f67a6c6013ca | 801 | 0x6c36365aU, 0x7e3f3f41U, 0xf5f7f702U, 0x83cccc4fU, |
wolfSSL | 13:f67a6c6013ca | 802 | 0x6834345cU, 0x51a5a5f4U, 0xd1e5e534U, 0xf9f1f108U, |
wolfSSL | 13:f67a6c6013ca | 803 | 0xe2717193U, 0xabd8d873U, 0x62313153U, 0x2a15153fU, |
wolfSSL | 13:f67a6c6013ca | 804 | 0x0804040cU, 0x95c7c752U, 0x46232365U, 0x9dc3c35eU, |
wolfSSL | 13:f67a6c6013ca | 805 | 0x30181828U, 0x379696a1U, 0x0a05050fU, 0x2f9a9ab5U, |
wolfSSL | 13:f67a6c6013ca | 806 | 0x0e070709U, 0x24121236U, 0x1b80809bU, 0xdfe2e23dU, |
wolfSSL | 13:f67a6c6013ca | 807 | 0xcdebeb26U, 0x4e272769U, 0x7fb2b2cdU, 0xea75759fU, |
wolfSSL | 13:f67a6c6013ca | 808 | 0x1209091bU, 0x1d83839eU, 0x582c2c74U, 0x341a1a2eU, |
wolfSSL | 13:f67a6c6013ca | 809 | 0x361b1b2dU, 0xdc6e6eb2U, 0xb45a5aeeU, 0x5ba0a0fbU, |
wolfSSL | 13:f67a6c6013ca | 810 | 0xa45252f6U, 0x763b3b4dU, 0xb7d6d661U, 0x7db3b3ceU, |
wolfSSL | 13:f67a6c6013ca | 811 | 0x5229297bU, 0xdde3e33eU, 0x5e2f2f71U, 0x13848497U, |
wolfSSL | 13:f67a6c6013ca | 812 | 0xa65353f5U, 0xb9d1d168U, 0x00000000U, 0xc1eded2cU, |
wolfSSL | 13:f67a6c6013ca | 813 | 0x40202060U, 0xe3fcfc1fU, 0x79b1b1c8U, 0xb65b5bedU, |
wolfSSL | 13:f67a6c6013ca | 814 | 0xd46a6abeU, 0x8dcbcb46U, 0x67bebed9U, 0x7239394bU, |
wolfSSL | 13:f67a6c6013ca | 815 | 0x944a4adeU, 0x984c4cd4U, 0xb05858e8U, 0x85cfcf4aU, |
wolfSSL | 13:f67a6c6013ca | 816 | 0xbbd0d06bU, 0xc5efef2aU, 0x4faaaae5U, 0xedfbfb16U, |
wolfSSL | 13:f67a6c6013ca | 817 | 0x864343c5U, 0x9a4d4dd7U, 0x66333355U, 0x11858594U, |
wolfSSL | 13:f67a6c6013ca | 818 | 0x8a4545cfU, 0xe9f9f910U, 0x04020206U, 0xfe7f7f81U, |
wolfSSL | 13:f67a6c6013ca | 819 | 0xa05050f0U, 0x783c3c44U, 0x259f9fbaU, 0x4ba8a8e3U, |
wolfSSL | 13:f67a6c6013ca | 820 | 0xa25151f3U, 0x5da3a3feU, 0x804040c0U, 0x058f8f8aU, |
wolfSSL | 13:f67a6c6013ca | 821 | 0x3f9292adU, 0x219d9dbcU, 0x70383848U, 0xf1f5f504U, |
wolfSSL | 13:f67a6c6013ca | 822 | 0x63bcbcdfU, 0x77b6b6c1U, 0xafdada75U, 0x42212163U, |
wolfSSL | 13:f67a6c6013ca | 823 | 0x20101030U, 0xe5ffff1aU, 0xfdf3f30eU, 0xbfd2d26dU, |
wolfSSL | 13:f67a6c6013ca | 824 | 0x81cdcd4cU, 0x180c0c14U, 0x26131335U, 0xc3ecec2fU, |
wolfSSL | 13:f67a6c6013ca | 825 | 0xbe5f5fe1U, 0x359797a2U, 0x884444ccU, 0x2e171739U, |
wolfSSL | 13:f67a6c6013ca | 826 | 0x93c4c457U, 0x55a7a7f2U, 0xfc7e7e82U, 0x7a3d3d47U, |
wolfSSL | 13:f67a6c6013ca | 827 | 0xc86464acU, 0xba5d5de7U, 0x3219192bU, 0xe6737395U, |
wolfSSL | 13:f67a6c6013ca | 828 | 0xc06060a0U, 0x19818198U, 0x9e4f4fd1U, 0xa3dcdc7fU, |
wolfSSL | 13:f67a6c6013ca | 829 | 0x44222266U, 0x542a2a7eU, 0x3b9090abU, 0x0b888883U, |
wolfSSL | 13:f67a6c6013ca | 830 | 0x8c4646caU, 0xc7eeee29U, 0x6bb8b8d3U, 0x2814143cU, |
wolfSSL | 13:f67a6c6013ca | 831 | 0xa7dede79U, 0xbc5e5ee2U, 0x160b0b1dU, 0xaddbdb76U, |
wolfSSL | 13:f67a6c6013ca | 832 | 0xdbe0e03bU, 0x64323256U, 0x743a3a4eU, 0x140a0a1eU, |
wolfSSL | 13:f67a6c6013ca | 833 | 0x924949dbU, 0x0c06060aU, 0x4824246cU, 0xb85c5ce4U, |
wolfSSL | 13:f67a6c6013ca | 834 | 0x9fc2c25dU, 0xbdd3d36eU, 0x43acacefU, 0xc46262a6U, |
wolfSSL | 13:f67a6c6013ca | 835 | 0x399191a8U, 0x319595a4U, 0xd3e4e437U, 0xf279798bU, |
wolfSSL | 13:f67a6c6013ca | 836 | 0xd5e7e732U, 0x8bc8c843U, 0x6e373759U, 0xda6d6db7U, |
wolfSSL | 13:f67a6c6013ca | 837 | 0x018d8d8cU, 0xb1d5d564U, 0x9c4e4ed2U, 0x49a9a9e0U, |
wolfSSL | 13:f67a6c6013ca | 838 | 0xd86c6cb4U, 0xac5656faU, 0xf3f4f407U, 0xcfeaea25U, |
wolfSSL | 13:f67a6c6013ca | 839 | 0xca6565afU, 0xf47a7a8eU, 0x47aeaee9U, 0x10080818U, |
wolfSSL | 13:f67a6c6013ca | 840 | 0x6fbabad5U, 0xf0787888U, 0x4a25256fU, 0x5c2e2e72U, |
wolfSSL | 13:f67a6c6013ca | 841 | 0x381c1c24U, 0x57a6a6f1U, 0x73b4b4c7U, 0x97c6c651U, |
wolfSSL | 13:f67a6c6013ca | 842 | 0xcbe8e823U, 0xa1dddd7cU, 0xe874749cU, 0x3e1f1f21U, |
wolfSSL | 13:f67a6c6013ca | 843 | 0x964b4bddU, 0x61bdbddcU, 0x0d8b8b86U, 0x0f8a8a85U, |
wolfSSL | 13:f67a6c6013ca | 844 | 0xe0707090U, 0x7c3e3e42U, 0x71b5b5c4U, 0xcc6666aaU, |
wolfSSL | 13:f67a6c6013ca | 845 | 0x904848d8U, 0x06030305U, 0xf7f6f601U, 0x1c0e0e12U, |
wolfSSL | 13:f67a6c6013ca | 846 | 0xc26161a3U, 0x6a35355fU, 0xae5757f9U, 0x69b9b9d0U, |
wolfSSL | 13:f67a6c6013ca | 847 | 0x17868691U, 0x99c1c158U, 0x3a1d1d27U, 0x279e9eb9U, |
wolfSSL | 13:f67a6c6013ca | 848 | 0xd9e1e138U, 0xebf8f813U, 0x2b9898b3U, 0x22111133U, |
wolfSSL | 13:f67a6c6013ca | 849 | 0xd26969bbU, 0xa9d9d970U, 0x078e8e89U, 0x339494a7U, |
wolfSSL | 13:f67a6c6013ca | 850 | 0x2d9b9bb6U, 0x3c1e1e22U, 0x15878792U, 0xc9e9e920U, |
wolfSSL | 13:f67a6c6013ca | 851 | 0x87cece49U, 0xaa5555ffU, 0x50282878U, 0xa5dfdf7aU, |
wolfSSL | 13:f67a6c6013ca | 852 | 0x038c8c8fU, 0x59a1a1f8U, 0x09898980U, 0x1a0d0d17U, |
wolfSSL | 13:f67a6c6013ca | 853 | 0x65bfbfdaU, 0xd7e6e631U, 0x844242c6U, 0xd06868b8U, |
wolfSSL | 13:f67a6c6013ca | 854 | 0x824141c3U, 0x299999b0U, 0x5a2d2d77U, 0x1e0f0f11U, |
wolfSSL | 13:f67a6c6013ca | 855 | 0x7bb0b0cbU, 0xa85454fcU, 0x6dbbbbd6U, 0x2c16163aU, |
wolfSSL | 13:f67a6c6013ca | 856 | }, |
wolfSSL | 13:f67a6c6013ca | 857 | { |
wolfSSL | 13:f67a6c6013ca | 858 | 0xa5c66363U, 0x84f87c7cU, 0x99ee7777U, 0x8df67b7bU, |
wolfSSL | 13:f67a6c6013ca | 859 | 0x0dfff2f2U, 0xbdd66b6bU, 0xb1de6f6fU, 0x5491c5c5U, |
wolfSSL | 13:f67a6c6013ca | 860 | 0x50603030U, 0x03020101U, 0xa9ce6767U, 0x7d562b2bU, |
wolfSSL | 13:f67a6c6013ca | 861 | 0x19e7fefeU, 0x62b5d7d7U, 0xe64dababU, 0x9aec7676U, |
wolfSSL | 13:f67a6c6013ca | 862 | 0x458fcacaU, 0x9d1f8282U, 0x4089c9c9U, 0x87fa7d7dU, |
wolfSSL | 13:f67a6c6013ca | 863 | 0x15effafaU, 0xebb25959U, 0xc98e4747U, 0x0bfbf0f0U, |
wolfSSL | 13:f67a6c6013ca | 864 | 0xec41adadU, 0x67b3d4d4U, 0xfd5fa2a2U, 0xea45afafU, |
wolfSSL | 13:f67a6c6013ca | 865 | 0xbf239c9cU, 0xf753a4a4U, 0x96e47272U, 0x5b9bc0c0U, |
wolfSSL | 13:f67a6c6013ca | 866 | 0xc275b7b7U, 0x1ce1fdfdU, 0xae3d9393U, 0x6a4c2626U, |
wolfSSL | 13:f67a6c6013ca | 867 | 0x5a6c3636U, 0x417e3f3fU, 0x02f5f7f7U, 0x4f83ccccU, |
wolfSSL | 13:f67a6c6013ca | 868 | 0x5c683434U, 0xf451a5a5U, 0x34d1e5e5U, 0x08f9f1f1U, |
wolfSSL | 13:f67a6c6013ca | 869 | 0x93e27171U, 0x73abd8d8U, 0x53623131U, 0x3f2a1515U, |
wolfSSL | 13:f67a6c6013ca | 870 | 0x0c080404U, 0x5295c7c7U, 0x65462323U, 0x5e9dc3c3U, |
wolfSSL | 13:f67a6c6013ca | 871 | 0x28301818U, 0xa1379696U, 0x0f0a0505U, 0xb52f9a9aU, |
wolfSSL | 13:f67a6c6013ca | 872 | 0x090e0707U, 0x36241212U, 0x9b1b8080U, 0x3ddfe2e2U, |
wolfSSL | 13:f67a6c6013ca | 873 | 0x26cdebebU, 0x694e2727U, 0xcd7fb2b2U, 0x9fea7575U, |
wolfSSL | 13:f67a6c6013ca | 874 | 0x1b120909U, 0x9e1d8383U, 0x74582c2cU, 0x2e341a1aU, |
wolfSSL | 13:f67a6c6013ca | 875 | 0x2d361b1bU, 0xb2dc6e6eU, 0xeeb45a5aU, 0xfb5ba0a0U, |
wolfSSL | 13:f67a6c6013ca | 876 | 0xf6a45252U, 0x4d763b3bU, 0x61b7d6d6U, 0xce7db3b3U, |
wolfSSL | 13:f67a6c6013ca | 877 | 0x7b522929U, 0x3edde3e3U, 0x715e2f2fU, 0x97138484U, |
wolfSSL | 13:f67a6c6013ca | 878 | 0xf5a65353U, 0x68b9d1d1U, 0x00000000U, 0x2cc1ededU, |
wolfSSL | 13:f67a6c6013ca | 879 | 0x60402020U, 0x1fe3fcfcU, 0xc879b1b1U, 0xedb65b5bU, |
wolfSSL | 13:f67a6c6013ca | 880 | 0xbed46a6aU, 0x468dcbcbU, 0xd967bebeU, 0x4b723939U, |
wolfSSL | 13:f67a6c6013ca | 881 | 0xde944a4aU, 0xd4984c4cU, 0xe8b05858U, 0x4a85cfcfU, |
wolfSSL | 13:f67a6c6013ca | 882 | 0x6bbbd0d0U, 0x2ac5efefU, 0xe54faaaaU, 0x16edfbfbU, |
wolfSSL | 13:f67a6c6013ca | 883 | 0xc5864343U, 0xd79a4d4dU, 0x55663333U, 0x94118585U, |
wolfSSL | 13:f67a6c6013ca | 884 | 0xcf8a4545U, 0x10e9f9f9U, 0x06040202U, 0x81fe7f7fU, |
wolfSSL | 13:f67a6c6013ca | 885 | 0xf0a05050U, 0x44783c3cU, 0xba259f9fU, 0xe34ba8a8U, |
wolfSSL | 13:f67a6c6013ca | 886 | 0xf3a25151U, 0xfe5da3a3U, 0xc0804040U, 0x8a058f8fU, |
wolfSSL | 13:f67a6c6013ca | 887 | 0xad3f9292U, 0xbc219d9dU, 0x48703838U, 0x04f1f5f5U, |
wolfSSL | 13:f67a6c6013ca | 888 | 0xdf63bcbcU, 0xc177b6b6U, 0x75afdadaU, 0x63422121U, |
wolfSSL | 13:f67a6c6013ca | 889 | 0x30201010U, 0x1ae5ffffU, 0x0efdf3f3U, 0x6dbfd2d2U, |
wolfSSL | 13:f67a6c6013ca | 890 | 0x4c81cdcdU, 0x14180c0cU, 0x35261313U, 0x2fc3ececU, |
wolfSSL | 13:f67a6c6013ca | 891 | 0xe1be5f5fU, 0xa2359797U, 0xcc884444U, 0x392e1717U, |
wolfSSL | 13:f67a6c6013ca | 892 | 0x5793c4c4U, 0xf255a7a7U, 0x82fc7e7eU, 0x477a3d3dU, |
wolfSSL | 13:f67a6c6013ca | 893 | 0xacc86464U, 0xe7ba5d5dU, 0x2b321919U, 0x95e67373U, |
wolfSSL | 13:f67a6c6013ca | 894 | 0xa0c06060U, 0x98198181U, 0xd19e4f4fU, 0x7fa3dcdcU, |
wolfSSL | 13:f67a6c6013ca | 895 | 0x66442222U, 0x7e542a2aU, 0xab3b9090U, 0x830b8888U, |
wolfSSL | 13:f67a6c6013ca | 896 | 0xca8c4646U, 0x29c7eeeeU, 0xd36bb8b8U, 0x3c281414U, |
wolfSSL | 13:f67a6c6013ca | 897 | 0x79a7dedeU, 0xe2bc5e5eU, 0x1d160b0bU, 0x76addbdbU, |
wolfSSL | 13:f67a6c6013ca | 898 | 0x3bdbe0e0U, 0x56643232U, 0x4e743a3aU, 0x1e140a0aU, |
wolfSSL | 13:f67a6c6013ca | 899 | 0xdb924949U, 0x0a0c0606U, 0x6c482424U, 0xe4b85c5cU, |
wolfSSL | 13:f67a6c6013ca | 900 | 0x5d9fc2c2U, 0x6ebdd3d3U, 0xef43acacU, 0xa6c46262U, |
wolfSSL | 13:f67a6c6013ca | 901 | 0xa8399191U, 0xa4319595U, 0x37d3e4e4U, 0x8bf27979U, |
wolfSSL | 13:f67a6c6013ca | 902 | 0x32d5e7e7U, 0x438bc8c8U, 0x596e3737U, 0xb7da6d6dU, |
wolfSSL | 13:f67a6c6013ca | 903 | 0x8c018d8dU, 0x64b1d5d5U, 0xd29c4e4eU, 0xe049a9a9U, |
wolfSSL | 13:f67a6c6013ca | 904 | 0xb4d86c6cU, 0xfaac5656U, 0x07f3f4f4U, 0x25cfeaeaU, |
wolfSSL | 13:f67a6c6013ca | 905 | 0xafca6565U, 0x8ef47a7aU, 0xe947aeaeU, 0x18100808U, |
wolfSSL | 13:f67a6c6013ca | 906 | 0xd56fbabaU, 0x88f07878U, 0x6f4a2525U, 0x725c2e2eU, |
wolfSSL | 13:f67a6c6013ca | 907 | 0x24381c1cU, 0xf157a6a6U, 0xc773b4b4U, 0x5197c6c6U, |
wolfSSL | 13:f67a6c6013ca | 908 | 0x23cbe8e8U, 0x7ca1ddddU, 0x9ce87474U, 0x213e1f1fU, |
wolfSSL | 13:f67a6c6013ca | 909 | 0xdd964b4bU, 0xdc61bdbdU, 0x860d8b8bU, 0x850f8a8aU, |
wolfSSL | 13:f67a6c6013ca | 910 | 0x90e07070U, 0x427c3e3eU, 0xc471b5b5U, 0xaacc6666U, |
wolfSSL | 13:f67a6c6013ca | 911 | 0xd8904848U, 0x05060303U, 0x01f7f6f6U, 0x121c0e0eU, |
wolfSSL | 13:f67a6c6013ca | 912 | 0xa3c26161U, 0x5f6a3535U, 0xf9ae5757U, 0xd069b9b9U, |
wolfSSL | 13:f67a6c6013ca | 913 | 0x91178686U, 0x5899c1c1U, 0x273a1d1dU, 0xb9279e9eU, |
wolfSSL | 13:f67a6c6013ca | 914 | 0x38d9e1e1U, 0x13ebf8f8U, 0xb32b9898U, 0x33221111U, |
wolfSSL | 13:f67a6c6013ca | 915 | 0xbbd26969U, 0x70a9d9d9U, 0x89078e8eU, 0xa7339494U, |
wolfSSL | 13:f67a6c6013ca | 916 | 0xb62d9b9bU, 0x223c1e1eU, 0x92158787U, 0x20c9e9e9U, |
wolfSSL | 13:f67a6c6013ca | 917 | 0x4987ceceU, 0xffaa5555U, 0x78502828U, 0x7aa5dfdfU, |
wolfSSL | 13:f67a6c6013ca | 918 | 0x8f038c8cU, 0xf859a1a1U, 0x80098989U, 0x171a0d0dU, |
wolfSSL | 13:f67a6c6013ca | 919 | 0xda65bfbfU, 0x31d7e6e6U, 0xc6844242U, 0xb8d06868U, |
wolfSSL | 13:f67a6c6013ca | 920 | 0xc3824141U, 0xb0299999U, 0x775a2d2dU, 0x111e0f0fU, |
wolfSSL | 13:f67a6c6013ca | 921 | 0xcb7bb0b0U, 0xfca85454U, 0xd66dbbbbU, 0x3a2c1616U, |
wolfSSL | 13:f67a6c6013ca | 922 | }, |
wolfSSL | 13:f67a6c6013ca | 923 | { |
wolfSSL | 13:f67a6c6013ca | 924 | 0x63a5c663U, 0x7c84f87cU, 0x7799ee77U, 0x7b8df67bU, |
wolfSSL | 13:f67a6c6013ca | 925 | 0xf20dfff2U, 0x6bbdd66bU, 0x6fb1de6fU, 0xc55491c5U, |
wolfSSL | 13:f67a6c6013ca | 926 | 0x30506030U, 0x01030201U, 0x67a9ce67U, 0x2b7d562bU, |
wolfSSL | 13:f67a6c6013ca | 927 | 0xfe19e7feU, 0xd762b5d7U, 0xabe64dabU, 0x769aec76U, |
wolfSSL | 13:f67a6c6013ca | 928 | 0xca458fcaU, 0x829d1f82U, 0xc94089c9U, 0x7d87fa7dU, |
wolfSSL | 13:f67a6c6013ca | 929 | 0xfa15effaU, 0x59ebb259U, 0x47c98e47U, 0xf00bfbf0U, |
wolfSSL | 13:f67a6c6013ca | 930 | 0xadec41adU, 0xd467b3d4U, 0xa2fd5fa2U, 0xafea45afU, |
wolfSSL | 13:f67a6c6013ca | 931 | 0x9cbf239cU, 0xa4f753a4U, 0x7296e472U, 0xc05b9bc0U, |
wolfSSL | 13:f67a6c6013ca | 932 | 0xb7c275b7U, 0xfd1ce1fdU, 0x93ae3d93U, 0x266a4c26U, |
wolfSSL | 13:f67a6c6013ca | 933 | 0x365a6c36U, 0x3f417e3fU, 0xf702f5f7U, 0xcc4f83ccU, |
wolfSSL | 13:f67a6c6013ca | 934 | 0x345c6834U, 0xa5f451a5U, 0xe534d1e5U, 0xf108f9f1U, |
wolfSSL | 13:f67a6c6013ca | 935 | 0x7193e271U, 0xd873abd8U, 0x31536231U, 0x153f2a15U, |
wolfSSL | 13:f67a6c6013ca | 936 | 0x040c0804U, 0xc75295c7U, 0x23654623U, 0xc35e9dc3U, |
wolfSSL | 13:f67a6c6013ca | 937 | 0x18283018U, 0x96a13796U, 0x050f0a05U, 0x9ab52f9aU, |
wolfSSL | 13:f67a6c6013ca | 938 | 0x07090e07U, 0x12362412U, 0x809b1b80U, 0xe23ddfe2U, |
wolfSSL | 13:f67a6c6013ca | 939 | 0xeb26cdebU, 0x27694e27U, 0xb2cd7fb2U, 0x759fea75U, |
wolfSSL | 13:f67a6c6013ca | 940 | 0x091b1209U, 0x839e1d83U, 0x2c74582cU, 0x1a2e341aU, |
wolfSSL | 13:f67a6c6013ca | 941 | 0x1b2d361bU, 0x6eb2dc6eU, 0x5aeeb45aU, 0xa0fb5ba0U, |
wolfSSL | 13:f67a6c6013ca | 942 | 0x52f6a452U, 0x3b4d763bU, 0xd661b7d6U, 0xb3ce7db3U, |
wolfSSL | 13:f67a6c6013ca | 943 | 0x297b5229U, 0xe33edde3U, 0x2f715e2fU, 0x84971384U, |
wolfSSL | 13:f67a6c6013ca | 944 | 0x53f5a653U, 0xd168b9d1U, 0x00000000U, 0xed2cc1edU, |
wolfSSL | 13:f67a6c6013ca | 945 | 0x20604020U, 0xfc1fe3fcU, 0xb1c879b1U, 0x5bedb65bU, |
wolfSSL | 13:f67a6c6013ca | 946 | 0x6abed46aU, 0xcb468dcbU, 0xbed967beU, 0x394b7239U, |
wolfSSL | 13:f67a6c6013ca | 947 | 0x4ade944aU, 0x4cd4984cU, 0x58e8b058U, 0xcf4a85cfU, |
wolfSSL | 13:f67a6c6013ca | 948 | 0xd06bbbd0U, 0xef2ac5efU, 0xaae54faaU, 0xfb16edfbU, |
wolfSSL | 13:f67a6c6013ca | 949 | 0x43c58643U, 0x4dd79a4dU, 0x33556633U, 0x85941185U, |
wolfSSL | 13:f67a6c6013ca | 950 | 0x45cf8a45U, 0xf910e9f9U, 0x02060402U, 0x7f81fe7fU, |
wolfSSL | 13:f67a6c6013ca | 951 | 0x50f0a050U, 0x3c44783cU, 0x9fba259fU, 0xa8e34ba8U, |
wolfSSL | 13:f67a6c6013ca | 952 | 0x51f3a251U, 0xa3fe5da3U, 0x40c08040U, 0x8f8a058fU, |
wolfSSL | 13:f67a6c6013ca | 953 | 0x92ad3f92U, 0x9dbc219dU, 0x38487038U, 0xf504f1f5U, |
wolfSSL | 13:f67a6c6013ca | 954 | 0xbcdf63bcU, 0xb6c177b6U, 0xda75afdaU, 0x21634221U, |
wolfSSL | 13:f67a6c6013ca | 955 | 0x10302010U, 0xff1ae5ffU, 0xf30efdf3U, 0xd26dbfd2U, |
wolfSSL | 13:f67a6c6013ca | 956 | 0xcd4c81cdU, 0x0c14180cU, 0x13352613U, 0xec2fc3ecU, |
wolfSSL | 13:f67a6c6013ca | 957 | 0x5fe1be5fU, 0x97a23597U, 0x44cc8844U, 0x17392e17U, |
wolfSSL | 13:f67a6c6013ca | 958 | 0xc45793c4U, 0xa7f255a7U, 0x7e82fc7eU, 0x3d477a3dU, |
wolfSSL | 13:f67a6c6013ca | 959 | 0x64acc864U, 0x5de7ba5dU, 0x192b3219U, 0x7395e673U, |
wolfSSL | 13:f67a6c6013ca | 960 | 0x60a0c060U, 0x81981981U, 0x4fd19e4fU, 0xdc7fa3dcU, |
wolfSSL | 13:f67a6c6013ca | 961 | 0x22664422U, 0x2a7e542aU, 0x90ab3b90U, 0x88830b88U, |
wolfSSL | 13:f67a6c6013ca | 962 | 0x46ca8c46U, 0xee29c7eeU, 0xb8d36bb8U, 0x143c2814U, |
wolfSSL | 13:f67a6c6013ca | 963 | 0xde79a7deU, 0x5ee2bc5eU, 0x0b1d160bU, 0xdb76addbU, |
wolfSSL | 13:f67a6c6013ca | 964 | 0xe03bdbe0U, 0x32566432U, 0x3a4e743aU, 0x0a1e140aU, |
wolfSSL | 13:f67a6c6013ca | 965 | 0x49db9249U, 0x060a0c06U, 0x246c4824U, 0x5ce4b85cU, |
wolfSSL | 13:f67a6c6013ca | 966 | 0xc25d9fc2U, 0xd36ebdd3U, 0xacef43acU, 0x62a6c462U, |
wolfSSL | 13:f67a6c6013ca | 967 | 0x91a83991U, 0x95a43195U, 0xe437d3e4U, 0x798bf279U, |
wolfSSL | 13:f67a6c6013ca | 968 | 0xe732d5e7U, 0xc8438bc8U, 0x37596e37U, 0x6db7da6dU, |
wolfSSL | 13:f67a6c6013ca | 969 | 0x8d8c018dU, 0xd564b1d5U, 0x4ed29c4eU, 0xa9e049a9U, |
wolfSSL | 13:f67a6c6013ca | 970 | 0x6cb4d86cU, 0x56faac56U, 0xf407f3f4U, 0xea25cfeaU, |
wolfSSL | 13:f67a6c6013ca | 971 | 0x65afca65U, 0x7a8ef47aU, 0xaee947aeU, 0x08181008U, |
wolfSSL | 13:f67a6c6013ca | 972 | 0xbad56fbaU, 0x7888f078U, 0x256f4a25U, 0x2e725c2eU, |
wolfSSL | 13:f67a6c6013ca | 973 | 0x1c24381cU, 0xa6f157a6U, 0xb4c773b4U, 0xc65197c6U, |
wolfSSL | 13:f67a6c6013ca | 974 | 0xe823cbe8U, 0xdd7ca1ddU, 0x749ce874U, 0x1f213e1fU, |
wolfSSL | 13:f67a6c6013ca | 975 | 0x4bdd964bU, 0xbddc61bdU, 0x8b860d8bU, 0x8a850f8aU, |
wolfSSL | 13:f67a6c6013ca | 976 | 0x7090e070U, 0x3e427c3eU, 0xb5c471b5U, 0x66aacc66U, |
wolfSSL | 13:f67a6c6013ca | 977 | 0x48d89048U, 0x03050603U, 0xf601f7f6U, 0x0e121c0eU, |
wolfSSL | 13:f67a6c6013ca | 978 | 0x61a3c261U, 0x355f6a35U, 0x57f9ae57U, 0xb9d069b9U, |
wolfSSL | 13:f67a6c6013ca | 979 | 0x86911786U, 0xc15899c1U, 0x1d273a1dU, 0x9eb9279eU, |
wolfSSL | 13:f67a6c6013ca | 980 | 0xe138d9e1U, 0xf813ebf8U, 0x98b32b98U, 0x11332211U, |
wolfSSL | 13:f67a6c6013ca | 981 | 0x69bbd269U, 0xd970a9d9U, 0x8e89078eU, 0x94a73394U, |
wolfSSL | 13:f67a6c6013ca | 982 | 0x9bb62d9bU, 0x1e223c1eU, 0x87921587U, 0xe920c9e9U, |
wolfSSL | 13:f67a6c6013ca | 983 | 0xce4987ceU, 0x55ffaa55U, 0x28785028U, 0xdf7aa5dfU, |
wolfSSL | 13:f67a6c6013ca | 984 | 0x8c8f038cU, 0xa1f859a1U, 0x89800989U, 0x0d171a0dU, |
wolfSSL | 13:f67a6c6013ca | 985 | 0xbfda65bfU, 0xe631d7e6U, 0x42c68442U, 0x68b8d068U, |
wolfSSL | 13:f67a6c6013ca | 986 | 0x41c38241U, 0x99b02999U, 0x2d775a2dU, 0x0f111e0fU, |
wolfSSL | 13:f67a6c6013ca | 987 | 0xb0cb7bb0U, 0x54fca854U, 0xbbd66dbbU, 0x163a2c16U, |
wolfSSL | 13:f67a6c6013ca | 988 | }, |
wolfSSL | 13:f67a6c6013ca | 989 | { |
wolfSSL | 13:f67a6c6013ca | 990 | 0x6363a5c6U, 0x7c7c84f8U, 0x777799eeU, 0x7b7b8df6U, |
wolfSSL | 13:f67a6c6013ca | 991 | 0xf2f20dffU, 0x6b6bbdd6U, 0x6f6fb1deU, 0xc5c55491U, |
wolfSSL | 13:f67a6c6013ca | 992 | 0x30305060U, 0x01010302U, 0x6767a9ceU, 0x2b2b7d56U, |
wolfSSL | 13:f67a6c6013ca | 993 | 0xfefe19e7U, 0xd7d762b5U, 0xababe64dU, 0x76769aecU, |
wolfSSL | 13:f67a6c6013ca | 994 | 0xcaca458fU, 0x82829d1fU, 0xc9c94089U, 0x7d7d87faU, |
wolfSSL | 13:f67a6c6013ca | 995 | 0xfafa15efU, 0x5959ebb2U, 0x4747c98eU, 0xf0f00bfbU, |
wolfSSL | 13:f67a6c6013ca | 996 | 0xadadec41U, 0xd4d467b3U, 0xa2a2fd5fU, 0xafafea45U, |
wolfSSL | 13:f67a6c6013ca | 997 | 0x9c9cbf23U, 0xa4a4f753U, 0x727296e4U, 0xc0c05b9bU, |
wolfSSL | 13:f67a6c6013ca | 998 | 0xb7b7c275U, 0xfdfd1ce1U, 0x9393ae3dU, 0x26266a4cU, |
wolfSSL | 13:f67a6c6013ca | 999 | 0x36365a6cU, 0x3f3f417eU, 0xf7f702f5U, 0xcccc4f83U, |
wolfSSL | 13:f67a6c6013ca | 1000 | 0x34345c68U, 0xa5a5f451U, 0xe5e534d1U, 0xf1f108f9U, |
wolfSSL | 13:f67a6c6013ca | 1001 | 0x717193e2U, 0xd8d873abU, 0x31315362U, 0x15153f2aU, |
wolfSSL | 13:f67a6c6013ca | 1002 | 0x04040c08U, 0xc7c75295U, 0x23236546U, 0xc3c35e9dU, |
wolfSSL | 13:f67a6c6013ca | 1003 | 0x18182830U, 0x9696a137U, 0x05050f0aU, 0x9a9ab52fU, |
wolfSSL | 13:f67a6c6013ca | 1004 | 0x0707090eU, 0x12123624U, 0x80809b1bU, 0xe2e23ddfU, |
wolfSSL | 13:f67a6c6013ca | 1005 | 0xebeb26cdU, 0x2727694eU, 0xb2b2cd7fU, 0x75759feaU, |
wolfSSL | 13:f67a6c6013ca | 1006 | 0x09091b12U, 0x83839e1dU, 0x2c2c7458U, 0x1a1a2e34U, |
wolfSSL | 13:f67a6c6013ca | 1007 | 0x1b1b2d36U, 0x6e6eb2dcU, 0x5a5aeeb4U, 0xa0a0fb5bU, |
wolfSSL | 13:f67a6c6013ca | 1008 | 0x5252f6a4U, 0x3b3b4d76U, 0xd6d661b7U, 0xb3b3ce7dU, |
wolfSSL | 13:f67a6c6013ca | 1009 | 0x29297b52U, 0xe3e33eddU, 0x2f2f715eU, 0x84849713U, |
wolfSSL | 13:f67a6c6013ca | 1010 | 0x5353f5a6U, 0xd1d168b9U, 0x00000000U, 0xeded2cc1U, |
wolfSSL | 13:f67a6c6013ca | 1011 | 0x20206040U, 0xfcfc1fe3U, 0xb1b1c879U, 0x5b5bedb6U, |
wolfSSL | 13:f67a6c6013ca | 1012 | 0x6a6abed4U, 0xcbcb468dU, 0xbebed967U, 0x39394b72U, |
wolfSSL | 13:f67a6c6013ca | 1013 | 0x4a4ade94U, 0x4c4cd498U, 0x5858e8b0U, 0xcfcf4a85U, |
wolfSSL | 13:f67a6c6013ca | 1014 | 0xd0d06bbbU, 0xefef2ac5U, 0xaaaae54fU, 0xfbfb16edU, |
wolfSSL | 13:f67a6c6013ca | 1015 | 0x4343c586U, 0x4d4dd79aU, 0x33335566U, 0x85859411U, |
wolfSSL | 13:f67a6c6013ca | 1016 | 0x4545cf8aU, 0xf9f910e9U, 0x02020604U, 0x7f7f81feU, |
wolfSSL | 13:f67a6c6013ca | 1017 | 0x5050f0a0U, 0x3c3c4478U, 0x9f9fba25U, 0xa8a8e34bU, |
wolfSSL | 13:f67a6c6013ca | 1018 | 0x5151f3a2U, 0xa3a3fe5dU, 0x4040c080U, 0x8f8f8a05U, |
wolfSSL | 13:f67a6c6013ca | 1019 | 0x9292ad3fU, 0x9d9dbc21U, 0x38384870U, 0xf5f504f1U, |
wolfSSL | 13:f67a6c6013ca | 1020 | 0xbcbcdf63U, 0xb6b6c177U, 0xdada75afU, 0x21216342U, |
wolfSSL | 13:f67a6c6013ca | 1021 | 0x10103020U, 0xffff1ae5U, 0xf3f30efdU, 0xd2d26dbfU, |
wolfSSL | 13:f67a6c6013ca | 1022 | 0xcdcd4c81U, 0x0c0c1418U, 0x13133526U, 0xecec2fc3U, |
wolfSSL | 13:f67a6c6013ca | 1023 | 0x5f5fe1beU, 0x9797a235U, 0x4444cc88U, 0x1717392eU, |
wolfSSL | 13:f67a6c6013ca | 1024 | 0xc4c45793U, 0xa7a7f255U, 0x7e7e82fcU, 0x3d3d477aU, |
wolfSSL | 13:f67a6c6013ca | 1025 | 0x6464acc8U, 0x5d5de7baU, 0x19192b32U, 0x737395e6U, |
wolfSSL | 13:f67a6c6013ca | 1026 | 0x6060a0c0U, 0x81819819U, 0x4f4fd19eU, 0xdcdc7fa3U, |
wolfSSL | 13:f67a6c6013ca | 1027 | 0x22226644U, 0x2a2a7e54U, 0x9090ab3bU, 0x8888830bU, |
wolfSSL | 13:f67a6c6013ca | 1028 | 0x4646ca8cU, 0xeeee29c7U, 0xb8b8d36bU, 0x14143c28U, |
wolfSSL | 13:f67a6c6013ca | 1029 | 0xdede79a7U, 0x5e5ee2bcU, 0x0b0b1d16U, 0xdbdb76adU, |
wolfSSL | 13:f67a6c6013ca | 1030 | 0xe0e03bdbU, 0x32325664U, 0x3a3a4e74U, 0x0a0a1e14U, |
wolfSSL | 13:f67a6c6013ca | 1031 | 0x4949db92U, 0x06060a0cU, 0x24246c48U, 0x5c5ce4b8U, |
wolfSSL | 13:f67a6c6013ca | 1032 | 0xc2c25d9fU, 0xd3d36ebdU, 0xacacef43U, 0x6262a6c4U, |
wolfSSL | 13:f67a6c6013ca | 1033 | 0x9191a839U, 0x9595a431U, 0xe4e437d3U, 0x79798bf2U, |
wolfSSL | 13:f67a6c6013ca | 1034 | 0xe7e732d5U, 0xc8c8438bU, 0x3737596eU, 0x6d6db7daU, |
wolfSSL | 13:f67a6c6013ca | 1035 | 0x8d8d8c01U, 0xd5d564b1U, 0x4e4ed29cU, 0xa9a9e049U, |
wolfSSL | 13:f67a6c6013ca | 1036 | 0x6c6cb4d8U, 0x5656faacU, 0xf4f407f3U, 0xeaea25cfU, |
wolfSSL | 13:f67a6c6013ca | 1037 | 0x6565afcaU, 0x7a7a8ef4U, 0xaeaee947U, 0x08081810U, |
wolfSSL | 13:f67a6c6013ca | 1038 | 0xbabad56fU, 0x787888f0U, 0x25256f4aU, 0x2e2e725cU, |
wolfSSL | 13:f67a6c6013ca | 1039 | 0x1c1c2438U, 0xa6a6f157U, 0xb4b4c773U, 0xc6c65197U, |
wolfSSL | 13:f67a6c6013ca | 1040 | 0xe8e823cbU, 0xdddd7ca1U, 0x74749ce8U, 0x1f1f213eU, |
wolfSSL | 13:f67a6c6013ca | 1041 | 0x4b4bdd96U, 0xbdbddc61U, 0x8b8b860dU, 0x8a8a850fU, |
wolfSSL | 13:f67a6c6013ca | 1042 | 0x707090e0U, 0x3e3e427cU, 0xb5b5c471U, 0x6666aaccU, |
wolfSSL | 13:f67a6c6013ca | 1043 | 0x4848d890U, 0x03030506U, 0xf6f601f7U, 0x0e0e121cU, |
wolfSSL | 13:f67a6c6013ca | 1044 | 0x6161a3c2U, 0x35355f6aU, 0x5757f9aeU, 0xb9b9d069U, |
wolfSSL | 13:f67a6c6013ca | 1045 | 0x86869117U, 0xc1c15899U, 0x1d1d273aU, 0x9e9eb927U, |
wolfSSL | 13:f67a6c6013ca | 1046 | 0xe1e138d9U, 0xf8f813ebU, 0x9898b32bU, 0x11113322U, |
wolfSSL | 13:f67a6c6013ca | 1047 | 0x6969bbd2U, 0xd9d970a9U, 0x8e8e8907U, 0x9494a733U, |
wolfSSL | 13:f67a6c6013ca | 1048 | 0x9b9bb62dU, 0x1e1e223cU, 0x87879215U, 0xe9e920c9U, |
wolfSSL | 13:f67a6c6013ca | 1049 | 0xcece4987U, 0x5555ffaaU, 0x28287850U, 0xdfdf7aa5U, |
wolfSSL | 13:f67a6c6013ca | 1050 | 0x8c8c8f03U, 0xa1a1f859U, 0x89898009U, 0x0d0d171aU, |
wolfSSL | 13:f67a6c6013ca | 1051 | 0xbfbfda65U, 0xe6e631d7U, 0x4242c684U, 0x6868b8d0U, |
wolfSSL | 13:f67a6c6013ca | 1052 | 0x4141c382U, 0x9999b029U, 0x2d2d775aU, 0x0f0f111eU, |
wolfSSL | 13:f67a6c6013ca | 1053 | 0xb0b0cb7bU, 0x5454fca8U, 0xbbbbd66dU, 0x16163a2cU, |
wolfSSL | 13:f67a6c6013ca | 1054 | } |
wolfSSL | 13:f67a6c6013ca | 1055 | }; |
wolfSSL | 13:f67a6c6013ca | 1056 | |
wolfSSL | 13:f67a6c6013ca | 1057 | #ifdef HAVE_AES_DECRYPT |
wolfSSL | 13:f67a6c6013ca | 1058 | static const word32 Td[4][256] = { |
wolfSSL | 13:f67a6c6013ca | 1059 | { |
wolfSSL | 13:f67a6c6013ca | 1060 | 0x51f4a750U, 0x7e416553U, 0x1a17a4c3U, 0x3a275e96U, |
wolfSSL | 13:f67a6c6013ca | 1061 | 0x3bab6bcbU, 0x1f9d45f1U, 0xacfa58abU, 0x4be30393U, |
wolfSSL | 13:f67a6c6013ca | 1062 | 0x2030fa55U, 0xad766df6U, 0x88cc7691U, 0xf5024c25U, |
wolfSSL | 13:f67a6c6013ca | 1063 | 0x4fe5d7fcU, 0xc52acbd7U, 0x26354480U, 0xb562a38fU, |
wolfSSL | 13:f67a6c6013ca | 1064 | 0xdeb15a49U, 0x25ba1b67U, 0x45ea0e98U, 0x5dfec0e1U, |
wolfSSL | 13:f67a6c6013ca | 1065 | 0xc32f7502U, 0x814cf012U, 0x8d4697a3U, 0x6bd3f9c6U, |
wolfSSL | 13:f67a6c6013ca | 1066 | 0x038f5fe7U, 0x15929c95U, 0xbf6d7aebU, 0x955259daU, |
wolfSSL | 13:f67a6c6013ca | 1067 | 0xd4be832dU, 0x587421d3U, 0x49e06929U, 0x8ec9c844U, |
wolfSSL | 13:f67a6c6013ca | 1068 | 0x75c2896aU, 0xf48e7978U, 0x99583e6bU, 0x27b971ddU, |
wolfSSL | 13:f67a6c6013ca | 1069 | 0xbee14fb6U, 0xf088ad17U, 0xc920ac66U, 0x7dce3ab4U, |
wolfSSL | 13:f67a6c6013ca | 1070 | 0x63df4a18U, 0xe51a3182U, 0x97513360U, 0x62537f45U, |
wolfSSL | 13:f67a6c6013ca | 1071 | 0xb16477e0U, 0xbb6bae84U, 0xfe81a01cU, 0xf9082b94U, |
wolfSSL | 13:f67a6c6013ca | 1072 | 0x70486858U, 0x8f45fd19U, 0x94de6c87U, 0x527bf8b7U, |
wolfSSL | 13:f67a6c6013ca | 1073 | 0xab73d323U, 0x724b02e2U, 0xe31f8f57U, 0x6655ab2aU, |
wolfSSL | 13:f67a6c6013ca | 1074 | 0xb2eb2807U, 0x2fb5c203U, 0x86c57b9aU, 0xd33708a5U, |
wolfSSL | 13:f67a6c6013ca | 1075 | 0x302887f2U, 0x23bfa5b2U, 0x02036abaU, 0xed16825cU, |
wolfSSL | 13:f67a6c6013ca | 1076 | 0x8acf1c2bU, 0xa779b492U, 0xf307f2f0U, 0x4e69e2a1U, |
wolfSSL | 13:f67a6c6013ca | 1077 | 0x65daf4cdU, 0x0605bed5U, 0xd134621fU, 0xc4a6fe8aU, |
wolfSSL | 13:f67a6c6013ca | 1078 | 0x342e539dU, 0xa2f355a0U, 0x058ae132U, 0xa4f6eb75U, |
wolfSSL | 13:f67a6c6013ca | 1079 | 0x0b83ec39U, 0x4060efaaU, 0x5e719f06U, 0xbd6e1051U, |
wolfSSL | 13:f67a6c6013ca | 1080 | 0x3e218af9U, 0x96dd063dU, 0xdd3e05aeU, 0x4de6bd46U, |
wolfSSL | 13:f67a6c6013ca | 1081 | 0x91548db5U, 0x71c45d05U, 0x0406d46fU, 0x605015ffU, |
wolfSSL | 13:f67a6c6013ca | 1082 | 0x1998fb24U, 0xd6bde997U, 0x894043ccU, 0x67d99e77U, |
wolfSSL | 13:f67a6c6013ca | 1083 | 0xb0e842bdU, 0x07898b88U, 0xe7195b38U, 0x79c8eedbU, |
wolfSSL | 13:f67a6c6013ca | 1084 | 0xa17c0a47U, 0x7c420fe9U, 0xf8841ec9U, 0x00000000U, |
wolfSSL | 13:f67a6c6013ca | 1085 | 0x09808683U, 0x322bed48U, 0x1e1170acU, 0x6c5a724eU, |
wolfSSL | 13:f67a6c6013ca | 1086 | 0xfd0efffbU, 0x0f853856U, 0x3daed51eU, 0x362d3927U, |
wolfSSL | 13:f67a6c6013ca | 1087 | 0x0a0fd964U, 0x685ca621U, 0x9b5b54d1U, 0x24362e3aU, |
wolfSSL | 13:f67a6c6013ca | 1088 | 0x0c0a67b1U, 0x9357e70fU, 0xb4ee96d2U, 0x1b9b919eU, |
wolfSSL | 13:f67a6c6013ca | 1089 | 0x80c0c54fU, 0x61dc20a2U, 0x5a774b69U, 0x1c121a16U, |
wolfSSL | 13:f67a6c6013ca | 1090 | 0xe293ba0aU, 0xc0a02ae5U, 0x3c22e043U, 0x121b171dU, |
wolfSSL | 13:f67a6c6013ca | 1091 | 0x0e090d0bU, 0xf28bc7adU, 0x2db6a8b9U, 0x141ea9c8U, |
wolfSSL | 13:f67a6c6013ca | 1092 | 0x57f11985U, 0xaf75074cU, 0xee99ddbbU, 0xa37f60fdU, |
wolfSSL | 13:f67a6c6013ca | 1093 | 0xf701269fU, 0x5c72f5bcU, 0x44663bc5U, 0x5bfb7e34U, |
wolfSSL | 13:f67a6c6013ca | 1094 | 0x8b432976U, 0xcb23c6dcU, 0xb6edfc68U, 0xb8e4f163U, |
wolfSSL | 13:f67a6c6013ca | 1095 | 0xd731dccaU, 0x42638510U, 0x13972240U, 0x84c61120U, |
wolfSSL | 13:f67a6c6013ca | 1096 | 0x854a247dU, 0xd2bb3df8U, 0xaef93211U, 0xc729a16dU, |
wolfSSL | 13:f67a6c6013ca | 1097 | 0x1d9e2f4bU, 0xdcb230f3U, 0x0d8652ecU, 0x77c1e3d0U, |
wolfSSL | 13:f67a6c6013ca | 1098 | 0x2bb3166cU, 0xa970b999U, 0x119448faU, 0x47e96422U, |
wolfSSL | 13:f67a6c6013ca | 1099 | 0xa8fc8cc4U, 0xa0f03f1aU, 0x567d2cd8U, 0x223390efU, |
wolfSSL | 13:f67a6c6013ca | 1100 | 0x87494ec7U, 0xd938d1c1U, 0x8ccaa2feU, 0x98d40b36U, |
wolfSSL | 13:f67a6c6013ca | 1101 | 0xa6f581cfU, 0xa57ade28U, 0xdab78e26U, 0x3fadbfa4U, |
wolfSSL | 13:f67a6c6013ca | 1102 | 0x2c3a9de4U, 0x5078920dU, 0x6a5fcc9bU, 0x547e4662U, |
wolfSSL | 13:f67a6c6013ca | 1103 | 0xf68d13c2U, 0x90d8b8e8U, 0x2e39f75eU, 0x82c3aff5U, |
wolfSSL | 13:f67a6c6013ca | 1104 | 0x9f5d80beU, 0x69d0937cU, 0x6fd52da9U, 0xcf2512b3U, |
wolfSSL | 13:f67a6c6013ca | 1105 | 0xc8ac993bU, 0x10187da7U, 0xe89c636eU, 0xdb3bbb7bU, |
wolfSSL | 13:f67a6c6013ca | 1106 | 0xcd267809U, 0x6e5918f4U, 0xec9ab701U, 0x834f9aa8U, |
wolfSSL | 13:f67a6c6013ca | 1107 | 0xe6956e65U, 0xaaffe67eU, 0x21bccf08U, 0xef15e8e6U, |
wolfSSL | 13:f67a6c6013ca | 1108 | 0xbae79bd9U, 0x4a6f36ceU, 0xea9f09d4U, 0x29b07cd6U, |
wolfSSL | 13:f67a6c6013ca | 1109 | 0x31a4b2afU, 0x2a3f2331U, 0xc6a59430U, 0x35a266c0U, |
wolfSSL | 13:f67a6c6013ca | 1110 | 0x744ebc37U, 0xfc82caa6U, 0xe090d0b0U, 0x33a7d815U, |
wolfSSL | 13:f67a6c6013ca | 1111 | 0xf104984aU, 0x41ecdaf7U, 0x7fcd500eU, 0x1791f62fU, |
wolfSSL | 13:f67a6c6013ca | 1112 | 0x764dd68dU, 0x43efb04dU, 0xccaa4d54U, 0xe49604dfU, |
wolfSSL | 13:f67a6c6013ca | 1113 | 0x9ed1b5e3U, 0x4c6a881bU, 0xc12c1fb8U, 0x4665517fU, |
wolfSSL | 13:f67a6c6013ca | 1114 | 0x9d5eea04U, 0x018c355dU, 0xfa877473U, 0xfb0b412eU, |
wolfSSL | 13:f67a6c6013ca | 1115 | 0xb3671d5aU, 0x92dbd252U, 0xe9105633U, 0x6dd64713U, |
wolfSSL | 13:f67a6c6013ca | 1116 | 0x9ad7618cU, 0x37a10c7aU, 0x59f8148eU, 0xeb133c89U, |
wolfSSL | 13:f67a6c6013ca | 1117 | 0xcea927eeU, 0xb761c935U, 0xe11ce5edU, 0x7a47b13cU, |
wolfSSL | 13:f67a6c6013ca | 1118 | 0x9cd2df59U, 0x55f2733fU, 0x1814ce79U, 0x73c737bfU, |
wolfSSL | 13:f67a6c6013ca | 1119 | 0x53f7cdeaU, 0x5ffdaa5bU, 0xdf3d6f14U, 0x7844db86U, |
wolfSSL | 13:f67a6c6013ca | 1120 | 0xcaaff381U, 0xb968c43eU, 0x3824342cU, 0xc2a3405fU, |
wolfSSL | 13:f67a6c6013ca | 1121 | 0x161dc372U, 0xbce2250cU, 0x283c498bU, 0xff0d9541U, |
wolfSSL | 13:f67a6c6013ca | 1122 | 0x39a80171U, 0x080cb3deU, 0xd8b4e49cU, 0x6456c190U, |
wolfSSL | 13:f67a6c6013ca | 1123 | 0x7bcb8461U, 0xd532b670U, 0x486c5c74U, 0xd0b85742U, |
wolfSSL | 13:f67a6c6013ca | 1124 | }, |
wolfSSL | 13:f67a6c6013ca | 1125 | { |
wolfSSL | 13:f67a6c6013ca | 1126 | 0x5051f4a7U, 0x537e4165U, 0xc31a17a4U, 0x963a275eU, |
wolfSSL | 13:f67a6c6013ca | 1127 | 0xcb3bab6bU, 0xf11f9d45U, 0xabacfa58U, 0x934be303U, |
wolfSSL | 13:f67a6c6013ca | 1128 | 0x552030faU, 0xf6ad766dU, 0x9188cc76U, 0x25f5024cU, |
wolfSSL | 13:f67a6c6013ca | 1129 | 0xfc4fe5d7U, 0xd7c52acbU, 0x80263544U, 0x8fb562a3U, |
wolfSSL | 13:f67a6c6013ca | 1130 | 0x49deb15aU, 0x6725ba1bU, 0x9845ea0eU, 0xe15dfec0U, |
wolfSSL | 13:f67a6c6013ca | 1131 | 0x02c32f75U, 0x12814cf0U, 0xa38d4697U, 0xc66bd3f9U, |
wolfSSL | 13:f67a6c6013ca | 1132 | 0xe7038f5fU, 0x9515929cU, 0xebbf6d7aU, 0xda955259U, |
wolfSSL | 13:f67a6c6013ca | 1133 | 0x2dd4be83U, 0xd3587421U, 0x2949e069U, 0x448ec9c8U, |
wolfSSL | 13:f67a6c6013ca | 1134 | 0x6a75c289U, 0x78f48e79U, 0x6b99583eU, 0xdd27b971U, |
wolfSSL | 13:f67a6c6013ca | 1135 | 0xb6bee14fU, 0x17f088adU, 0x66c920acU, 0xb47dce3aU, |
wolfSSL | 13:f67a6c6013ca | 1136 | 0x1863df4aU, 0x82e51a31U, 0x60975133U, 0x4562537fU, |
wolfSSL | 13:f67a6c6013ca | 1137 | 0xe0b16477U, 0x84bb6baeU, 0x1cfe81a0U, 0x94f9082bU, |
wolfSSL | 13:f67a6c6013ca | 1138 | 0x58704868U, 0x198f45fdU, 0x8794de6cU, 0xb7527bf8U, |
wolfSSL | 13:f67a6c6013ca | 1139 | 0x23ab73d3U, 0xe2724b02U, 0x57e31f8fU, 0x2a6655abU, |
wolfSSL | 13:f67a6c6013ca | 1140 | 0x07b2eb28U, 0x032fb5c2U, 0x9a86c57bU, 0xa5d33708U, |
wolfSSL | 13:f67a6c6013ca | 1141 | 0xf2302887U, 0xb223bfa5U, 0xba02036aU, 0x5ced1682U, |
wolfSSL | 13:f67a6c6013ca | 1142 | 0x2b8acf1cU, 0x92a779b4U, 0xf0f307f2U, 0xa14e69e2U, |
wolfSSL | 13:f67a6c6013ca | 1143 | 0xcd65daf4U, 0xd50605beU, 0x1fd13462U, 0x8ac4a6feU, |
wolfSSL | 13:f67a6c6013ca | 1144 | 0x9d342e53U, 0xa0a2f355U, 0x32058ae1U, 0x75a4f6ebU, |
wolfSSL | 13:f67a6c6013ca | 1145 | 0x390b83ecU, 0xaa4060efU, 0x065e719fU, 0x51bd6e10U, |
wolfSSL | 13:f67a6c6013ca | 1146 | 0xf93e218aU, 0x3d96dd06U, 0xaedd3e05U, 0x464de6bdU, |
wolfSSL | 13:f67a6c6013ca | 1147 | 0xb591548dU, 0x0571c45dU, 0x6f0406d4U, 0xff605015U, |
wolfSSL | 13:f67a6c6013ca | 1148 | 0x241998fbU, 0x97d6bde9U, 0xcc894043U, 0x7767d99eU, |
wolfSSL | 13:f67a6c6013ca | 1149 | 0xbdb0e842U, 0x8807898bU, 0x38e7195bU, 0xdb79c8eeU, |
wolfSSL | 13:f67a6c6013ca | 1150 | 0x47a17c0aU, 0xe97c420fU, 0xc9f8841eU, 0x00000000U, |
wolfSSL | 13:f67a6c6013ca | 1151 | 0x83098086U, 0x48322bedU, 0xac1e1170U, 0x4e6c5a72U, |
wolfSSL | 13:f67a6c6013ca | 1152 | 0xfbfd0effU, 0x560f8538U, 0x1e3daed5U, 0x27362d39U, |
wolfSSL | 13:f67a6c6013ca | 1153 | 0x640a0fd9U, 0x21685ca6U, 0xd19b5b54U, 0x3a24362eU, |
wolfSSL | 13:f67a6c6013ca | 1154 | 0xb10c0a67U, 0x0f9357e7U, 0xd2b4ee96U, 0x9e1b9b91U, |
wolfSSL | 13:f67a6c6013ca | 1155 | 0x4f80c0c5U, 0xa261dc20U, 0x695a774bU, 0x161c121aU, |
wolfSSL | 13:f67a6c6013ca | 1156 | 0x0ae293baU, 0xe5c0a02aU, 0x433c22e0U, 0x1d121b17U, |
wolfSSL | 13:f67a6c6013ca | 1157 | 0x0b0e090dU, 0xadf28bc7U, 0xb92db6a8U, 0xc8141ea9U, |
wolfSSL | 13:f67a6c6013ca | 1158 | 0x8557f119U, 0x4caf7507U, 0xbbee99ddU, 0xfda37f60U, |
wolfSSL | 13:f67a6c6013ca | 1159 | 0x9ff70126U, 0xbc5c72f5U, 0xc544663bU, 0x345bfb7eU, |
wolfSSL | 13:f67a6c6013ca | 1160 | 0x768b4329U, 0xdccb23c6U, 0x68b6edfcU, 0x63b8e4f1U, |
wolfSSL | 13:f67a6c6013ca | 1161 | 0xcad731dcU, 0x10426385U, 0x40139722U, 0x2084c611U, |
wolfSSL | 13:f67a6c6013ca | 1162 | 0x7d854a24U, 0xf8d2bb3dU, 0x11aef932U, 0x6dc729a1U, |
wolfSSL | 13:f67a6c6013ca | 1163 | 0x4b1d9e2fU, 0xf3dcb230U, 0xec0d8652U, 0xd077c1e3U, |
wolfSSL | 13:f67a6c6013ca | 1164 | 0x6c2bb316U, 0x99a970b9U, 0xfa119448U, 0x2247e964U, |
wolfSSL | 13:f67a6c6013ca | 1165 | 0xc4a8fc8cU, 0x1aa0f03fU, 0xd8567d2cU, 0xef223390U, |
wolfSSL | 13:f67a6c6013ca | 1166 | 0xc787494eU, 0xc1d938d1U, 0xfe8ccaa2U, 0x3698d40bU, |
wolfSSL | 13:f67a6c6013ca | 1167 | 0xcfa6f581U, 0x28a57adeU, 0x26dab78eU, 0xa43fadbfU, |
wolfSSL | 13:f67a6c6013ca | 1168 | 0xe42c3a9dU, 0x0d507892U, 0x9b6a5fccU, 0x62547e46U, |
wolfSSL | 13:f67a6c6013ca | 1169 | 0xc2f68d13U, 0xe890d8b8U, 0x5e2e39f7U, 0xf582c3afU, |
wolfSSL | 13:f67a6c6013ca | 1170 | 0xbe9f5d80U, 0x7c69d093U, 0xa96fd52dU, 0xb3cf2512U, |
wolfSSL | 13:f67a6c6013ca | 1171 | 0x3bc8ac99U, 0xa710187dU, 0x6ee89c63U, 0x7bdb3bbbU, |
wolfSSL | 13:f67a6c6013ca | 1172 | 0x09cd2678U, 0xf46e5918U, 0x01ec9ab7U, 0xa8834f9aU, |
wolfSSL | 13:f67a6c6013ca | 1173 | 0x65e6956eU, 0x7eaaffe6U, 0x0821bccfU, 0xe6ef15e8U, |
wolfSSL | 13:f67a6c6013ca | 1174 | 0xd9bae79bU, 0xce4a6f36U, 0xd4ea9f09U, 0xd629b07cU, |
wolfSSL | 13:f67a6c6013ca | 1175 | 0xaf31a4b2U, 0x312a3f23U, 0x30c6a594U, 0xc035a266U, |
wolfSSL | 13:f67a6c6013ca | 1176 | 0x37744ebcU, 0xa6fc82caU, 0xb0e090d0U, 0x1533a7d8U, |
wolfSSL | 13:f67a6c6013ca | 1177 | 0x4af10498U, 0xf741ecdaU, 0x0e7fcd50U, 0x2f1791f6U, |
wolfSSL | 13:f67a6c6013ca | 1178 | 0x8d764dd6U, 0x4d43efb0U, 0x54ccaa4dU, 0xdfe49604U, |
wolfSSL | 13:f67a6c6013ca | 1179 | 0xe39ed1b5U, 0x1b4c6a88U, 0xb8c12c1fU, 0x7f466551U, |
wolfSSL | 13:f67a6c6013ca | 1180 | 0x049d5eeaU, 0x5d018c35U, 0x73fa8774U, 0x2efb0b41U, |
wolfSSL | 13:f67a6c6013ca | 1181 | 0x5ab3671dU, 0x5292dbd2U, 0x33e91056U, 0x136dd647U, |
wolfSSL | 13:f67a6c6013ca | 1182 | 0x8c9ad761U, 0x7a37a10cU, 0x8e59f814U, 0x89eb133cU, |
wolfSSL | 13:f67a6c6013ca | 1183 | 0xeecea927U, 0x35b761c9U, 0xede11ce5U, 0x3c7a47b1U, |
wolfSSL | 13:f67a6c6013ca | 1184 | 0x599cd2dfU, 0x3f55f273U, 0x791814ceU, 0xbf73c737U, |
wolfSSL | 13:f67a6c6013ca | 1185 | 0xea53f7cdU, 0x5b5ffdaaU, 0x14df3d6fU, 0x867844dbU, |
wolfSSL | 13:f67a6c6013ca | 1186 | 0x81caaff3U, 0x3eb968c4U, 0x2c382434U, 0x5fc2a340U, |
wolfSSL | 13:f67a6c6013ca | 1187 | 0x72161dc3U, 0x0cbce225U, 0x8b283c49U, 0x41ff0d95U, |
wolfSSL | 13:f67a6c6013ca | 1188 | 0x7139a801U, 0xde080cb3U, 0x9cd8b4e4U, 0x906456c1U, |
wolfSSL | 13:f67a6c6013ca | 1189 | 0x617bcb84U, 0x70d532b6U, 0x74486c5cU, 0x42d0b857U, |
wolfSSL | 13:f67a6c6013ca | 1190 | }, |
wolfSSL | 13:f67a6c6013ca | 1191 | { |
wolfSSL | 13:f67a6c6013ca | 1192 | 0xa75051f4U, 0x65537e41U, 0xa4c31a17U, 0x5e963a27U, |
wolfSSL | 13:f67a6c6013ca | 1193 | 0x6bcb3babU, 0x45f11f9dU, 0x58abacfaU, 0x03934be3U, |
wolfSSL | 13:f67a6c6013ca | 1194 | 0xfa552030U, 0x6df6ad76U, 0x769188ccU, 0x4c25f502U, |
wolfSSL | 13:f67a6c6013ca | 1195 | 0xd7fc4fe5U, 0xcbd7c52aU, 0x44802635U, 0xa38fb562U, |
wolfSSL | 13:f67a6c6013ca | 1196 | 0x5a49deb1U, 0x1b6725baU, 0x0e9845eaU, 0xc0e15dfeU, |
wolfSSL | 13:f67a6c6013ca | 1197 | 0x7502c32fU, 0xf012814cU, 0x97a38d46U, 0xf9c66bd3U, |
wolfSSL | 13:f67a6c6013ca | 1198 | 0x5fe7038fU, 0x9c951592U, 0x7aebbf6dU, 0x59da9552U, |
wolfSSL | 13:f67a6c6013ca | 1199 | 0x832dd4beU, 0x21d35874U, 0x692949e0U, 0xc8448ec9U, |
wolfSSL | 13:f67a6c6013ca | 1200 | 0x896a75c2U, 0x7978f48eU, 0x3e6b9958U, 0x71dd27b9U, |
wolfSSL | 13:f67a6c6013ca | 1201 | 0x4fb6bee1U, 0xad17f088U, 0xac66c920U, 0x3ab47dceU, |
wolfSSL | 13:f67a6c6013ca | 1202 | 0x4a1863dfU, 0x3182e51aU, 0x33609751U, 0x7f456253U, |
wolfSSL | 13:f67a6c6013ca | 1203 | 0x77e0b164U, 0xae84bb6bU, 0xa01cfe81U, 0x2b94f908U, |
wolfSSL | 13:f67a6c6013ca | 1204 | 0x68587048U, 0xfd198f45U, 0x6c8794deU, 0xf8b7527bU, |
wolfSSL | 13:f67a6c6013ca | 1205 | 0xd323ab73U, 0x02e2724bU, 0x8f57e31fU, 0xab2a6655U, |
wolfSSL | 13:f67a6c6013ca | 1206 | 0x2807b2ebU, 0xc2032fb5U, 0x7b9a86c5U, 0x08a5d337U, |
wolfSSL | 13:f67a6c6013ca | 1207 | 0x87f23028U, 0xa5b223bfU, 0x6aba0203U, 0x825ced16U, |
wolfSSL | 13:f67a6c6013ca | 1208 | 0x1c2b8acfU, 0xb492a779U, 0xf2f0f307U, 0xe2a14e69U, |
wolfSSL | 13:f67a6c6013ca | 1209 | 0xf4cd65daU, 0xbed50605U, 0x621fd134U, 0xfe8ac4a6U, |
wolfSSL | 13:f67a6c6013ca | 1210 | 0x539d342eU, 0x55a0a2f3U, 0xe132058aU, 0xeb75a4f6U, |
wolfSSL | 13:f67a6c6013ca | 1211 | 0xec390b83U, 0xefaa4060U, 0x9f065e71U, 0x1051bd6eU, |
wolfSSL | 13:f67a6c6013ca | 1212 | |
wolfSSL | 13:f67a6c6013ca | 1213 | 0x8af93e21U, 0x063d96ddU, 0x05aedd3eU, 0xbd464de6U, |
wolfSSL | 13:f67a6c6013ca | 1214 | 0x8db59154U, 0x5d0571c4U, 0xd46f0406U, 0x15ff6050U, |
wolfSSL | 13:f67a6c6013ca | 1215 | 0xfb241998U, 0xe997d6bdU, 0x43cc8940U, 0x9e7767d9U, |
wolfSSL | 13:f67a6c6013ca | 1216 | 0x42bdb0e8U, 0x8b880789U, 0x5b38e719U, 0xeedb79c8U, |
wolfSSL | 13:f67a6c6013ca | 1217 | 0x0a47a17cU, 0x0fe97c42U, 0x1ec9f884U, 0x00000000U, |
wolfSSL | 13:f67a6c6013ca | 1218 | 0x86830980U, 0xed48322bU, 0x70ac1e11U, 0x724e6c5aU, |
wolfSSL | 13:f67a6c6013ca | 1219 | 0xfffbfd0eU, 0x38560f85U, 0xd51e3daeU, 0x3927362dU, |
wolfSSL | 13:f67a6c6013ca | 1220 | 0xd9640a0fU, 0xa621685cU, 0x54d19b5bU, 0x2e3a2436U, |
wolfSSL | 13:f67a6c6013ca | 1221 | 0x67b10c0aU, 0xe70f9357U, 0x96d2b4eeU, 0x919e1b9bU, |
wolfSSL | 13:f67a6c6013ca | 1222 | 0xc54f80c0U, 0x20a261dcU, 0x4b695a77U, 0x1a161c12U, |
wolfSSL | 13:f67a6c6013ca | 1223 | 0xba0ae293U, 0x2ae5c0a0U, 0xe0433c22U, 0x171d121bU, |
wolfSSL | 13:f67a6c6013ca | 1224 | 0x0d0b0e09U, 0xc7adf28bU, 0xa8b92db6U, 0xa9c8141eU, |
wolfSSL | 13:f67a6c6013ca | 1225 | 0x198557f1U, 0x074caf75U, 0xddbbee99U, 0x60fda37fU, |
wolfSSL | 13:f67a6c6013ca | 1226 | 0x269ff701U, 0xf5bc5c72U, 0x3bc54466U, 0x7e345bfbU, |
wolfSSL | 13:f67a6c6013ca | 1227 | 0x29768b43U, 0xc6dccb23U, 0xfc68b6edU, 0xf163b8e4U, |
wolfSSL | 13:f67a6c6013ca | 1228 | 0xdccad731U, 0x85104263U, 0x22401397U, 0x112084c6U, |
wolfSSL | 13:f67a6c6013ca | 1229 | 0x247d854aU, 0x3df8d2bbU, 0x3211aef9U, 0xa16dc729U, |
wolfSSL | 13:f67a6c6013ca | 1230 | 0x2f4b1d9eU, 0x30f3dcb2U, 0x52ec0d86U, 0xe3d077c1U, |
wolfSSL | 13:f67a6c6013ca | 1231 | 0x166c2bb3U, 0xb999a970U, 0x48fa1194U, 0x642247e9U, |
wolfSSL | 13:f67a6c6013ca | 1232 | 0x8cc4a8fcU, 0x3f1aa0f0U, 0x2cd8567dU, 0x90ef2233U, |
wolfSSL | 13:f67a6c6013ca | 1233 | 0x4ec78749U, 0xd1c1d938U, 0xa2fe8ccaU, 0x0b3698d4U, |
wolfSSL | 13:f67a6c6013ca | 1234 | 0x81cfa6f5U, 0xde28a57aU, 0x8e26dab7U, 0xbfa43fadU, |
wolfSSL | 13:f67a6c6013ca | 1235 | 0x9de42c3aU, 0x920d5078U, 0xcc9b6a5fU, 0x4662547eU, |
wolfSSL | 13:f67a6c6013ca | 1236 | 0x13c2f68dU, 0xb8e890d8U, 0xf75e2e39U, 0xaff582c3U, |
wolfSSL | 13:f67a6c6013ca | 1237 | 0x80be9f5dU, 0x937c69d0U, 0x2da96fd5U, 0x12b3cf25U, |
wolfSSL | 13:f67a6c6013ca | 1238 | 0x993bc8acU, 0x7da71018U, 0x636ee89cU, 0xbb7bdb3bU, |
wolfSSL | 13:f67a6c6013ca | 1239 | 0x7809cd26U, 0x18f46e59U, 0xb701ec9aU, 0x9aa8834fU, |
wolfSSL | 13:f67a6c6013ca | 1240 | 0x6e65e695U, 0xe67eaaffU, 0xcf0821bcU, 0xe8e6ef15U, |
wolfSSL | 13:f67a6c6013ca | 1241 | 0x9bd9bae7U, 0x36ce4a6fU, 0x09d4ea9fU, 0x7cd629b0U, |
wolfSSL | 13:f67a6c6013ca | 1242 | 0xb2af31a4U, 0x23312a3fU, 0x9430c6a5U, 0x66c035a2U, |
wolfSSL | 13:f67a6c6013ca | 1243 | 0xbc37744eU, 0xcaa6fc82U, 0xd0b0e090U, 0xd81533a7U, |
wolfSSL | 13:f67a6c6013ca | 1244 | 0x984af104U, 0xdaf741ecU, 0x500e7fcdU, 0xf62f1791U, |
wolfSSL | 13:f67a6c6013ca | 1245 | 0xd68d764dU, 0xb04d43efU, 0x4d54ccaaU, 0x04dfe496U, |
wolfSSL | 13:f67a6c6013ca | 1246 | 0xb5e39ed1U, 0x881b4c6aU, 0x1fb8c12cU, 0x517f4665U, |
wolfSSL | 13:f67a6c6013ca | 1247 | 0xea049d5eU, 0x355d018cU, 0x7473fa87U, 0x412efb0bU, |
wolfSSL | 13:f67a6c6013ca | 1248 | 0x1d5ab367U, 0xd25292dbU, 0x5633e910U, 0x47136dd6U, |
wolfSSL | 13:f67a6c6013ca | 1249 | 0x618c9ad7U, 0x0c7a37a1U, 0x148e59f8U, 0x3c89eb13U, |
wolfSSL | 13:f67a6c6013ca | 1250 | 0x27eecea9U, 0xc935b761U, 0xe5ede11cU, 0xb13c7a47U, |
wolfSSL | 13:f67a6c6013ca | 1251 | 0xdf599cd2U, 0x733f55f2U, 0xce791814U, 0x37bf73c7U, |
wolfSSL | 13:f67a6c6013ca | 1252 | 0xcdea53f7U, 0xaa5b5ffdU, 0x6f14df3dU, 0xdb867844U, |
wolfSSL | 13:f67a6c6013ca | 1253 | 0xf381caafU, 0xc43eb968U, 0x342c3824U, 0x405fc2a3U, |
wolfSSL | 13:f67a6c6013ca | 1254 | 0xc372161dU, 0x250cbce2U, 0x498b283cU, 0x9541ff0dU, |
wolfSSL | 13:f67a6c6013ca | 1255 | 0x017139a8U, 0xb3de080cU, 0xe49cd8b4U, 0xc1906456U, |
wolfSSL | 13:f67a6c6013ca | 1256 | 0x84617bcbU, 0xb670d532U, 0x5c74486cU, 0x5742d0b8U, |
wolfSSL | 13:f67a6c6013ca | 1257 | }, |
wolfSSL | 13:f67a6c6013ca | 1258 | { |
wolfSSL | 13:f67a6c6013ca | 1259 | 0xf4a75051U, 0x4165537eU, 0x17a4c31aU, 0x275e963aU, |
wolfSSL | 13:f67a6c6013ca | 1260 | 0xab6bcb3bU, 0x9d45f11fU, 0xfa58abacU, 0xe303934bU, |
wolfSSL | 13:f67a6c6013ca | 1261 | 0x30fa5520U, 0x766df6adU, 0xcc769188U, 0x024c25f5U, |
wolfSSL | 13:f67a6c6013ca | 1262 | 0xe5d7fc4fU, 0x2acbd7c5U, 0x35448026U, 0x62a38fb5U, |
wolfSSL | 13:f67a6c6013ca | 1263 | 0xb15a49deU, 0xba1b6725U, 0xea0e9845U, 0xfec0e15dU, |
wolfSSL | 13:f67a6c6013ca | 1264 | 0x2f7502c3U, 0x4cf01281U, 0x4697a38dU, 0xd3f9c66bU, |
wolfSSL | 13:f67a6c6013ca | 1265 | 0x8f5fe703U, 0x929c9515U, 0x6d7aebbfU, 0x5259da95U, |
wolfSSL | 13:f67a6c6013ca | 1266 | 0xbe832dd4U, 0x7421d358U, 0xe0692949U, 0xc9c8448eU, |
wolfSSL | 13:f67a6c6013ca | 1267 | 0xc2896a75U, 0x8e7978f4U, 0x583e6b99U, 0xb971dd27U, |
wolfSSL | 13:f67a6c6013ca | 1268 | 0xe14fb6beU, 0x88ad17f0U, 0x20ac66c9U, 0xce3ab47dU, |
wolfSSL | 13:f67a6c6013ca | 1269 | 0xdf4a1863U, 0x1a3182e5U, 0x51336097U, 0x537f4562U, |
wolfSSL | 13:f67a6c6013ca | 1270 | 0x6477e0b1U, 0x6bae84bbU, 0x81a01cfeU, 0x082b94f9U, |
wolfSSL | 13:f67a6c6013ca | 1271 | 0x48685870U, 0x45fd198fU, 0xde6c8794U, 0x7bf8b752U, |
wolfSSL | 13:f67a6c6013ca | 1272 | 0x73d323abU, 0x4b02e272U, 0x1f8f57e3U, 0x55ab2a66U, |
wolfSSL | 13:f67a6c6013ca | 1273 | 0xeb2807b2U, 0xb5c2032fU, 0xc57b9a86U, 0x3708a5d3U, |
wolfSSL | 13:f67a6c6013ca | 1274 | 0x2887f230U, 0xbfa5b223U, 0x036aba02U, 0x16825cedU, |
wolfSSL | 13:f67a6c6013ca | 1275 | 0xcf1c2b8aU, 0x79b492a7U, 0x07f2f0f3U, 0x69e2a14eU, |
wolfSSL | 13:f67a6c6013ca | 1276 | 0xdaf4cd65U, 0x05bed506U, 0x34621fd1U, 0xa6fe8ac4U, |
wolfSSL | 13:f67a6c6013ca | 1277 | 0x2e539d34U, 0xf355a0a2U, 0x8ae13205U, 0xf6eb75a4U, |
wolfSSL | 13:f67a6c6013ca | 1278 | 0x83ec390bU, 0x60efaa40U, 0x719f065eU, 0x6e1051bdU, |
wolfSSL | 13:f67a6c6013ca | 1279 | 0x218af93eU, 0xdd063d96U, 0x3e05aeddU, 0xe6bd464dU, |
wolfSSL | 13:f67a6c6013ca | 1280 | 0x548db591U, 0xc45d0571U, 0x06d46f04U, 0x5015ff60U, |
wolfSSL | 13:f67a6c6013ca | 1281 | 0x98fb2419U, 0xbde997d6U, 0x4043cc89U, 0xd99e7767U, |
wolfSSL | 13:f67a6c6013ca | 1282 | 0xe842bdb0U, 0x898b8807U, 0x195b38e7U, 0xc8eedb79U, |
wolfSSL | 13:f67a6c6013ca | 1283 | 0x7c0a47a1U, 0x420fe97cU, 0x841ec9f8U, 0x00000000U, |
wolfSSL | 13:f67a6c6013ca | 1284 | 0x80868309U, 0x2bed4832U, 0x1170ac1eU, 0x5a724e6cU, |
wolfSSL | 13:f67a6c6013ca | 1285 | 0x0efffbfdU, 0x8538560fU, 0xaed51e3dU, 0x2d392736U, |
wolfSSL | 13:f67a6c6013ca | 1286 | 0x0fd9640aU, 0x5ca62168U, 0x5b54d19bU, 0x362e3a24U, |
wolfSSL | 13:f67a6c6013ca | 1287 | 0x0a67b10cU, 0x57e70f93U, 0xee96d2b4U, 0x9b919e1bU, |
wolfSSL | 13:f67a6c6013ca | 1288 | 0xc0c54f80U, 0xdc20a261U, 0x774b695aU, 0x121a161cU, |
wolfSSL | 13:f67a6c6013ca | 1289 | 0x93ba0ae2U, 0xa02ae5c0U, 0x22e0433cU, 0x1b171d12U, |
wolfSSL | 13:f67a6c6013ca | 1290 | 0x090d0b0eU, 0x8bc7adf2U, 0xb6a8b92dU, 0x1ea9c814U, |
wolfSSL | 13:f67a6c6013ca | 1291 | 0xf1198557U, 0x75074cafU, 0x99ddbbeeU, 0x7f60fda3U, |
wolfSSL | 13:f67a6c6013ca | 1292 | 0x01269ff7U, 0x72f5bc5cU, 0x663bc544U, 0xfb7e345bU, |
wolfSSL | 13:f67a6c6013ca | 1293 | 0x4329768bU, 0x23c6dccbU, 0xedfc68b6U, 0xe4f163b8U, |
wolfSSL | 13:f67a6c6013ca | 1294 | 0x31dccad7U, 0x63851042U, 0x97224013U, 0xc6112084U, |
wolfSSL | 13:f67a6c6013ca | 1295 | 0x4a247d85U, 0xbb3df8d2U, 0xf93211aeU, 0x29a16dc7U, |
wolfSSL | 13:f67a6c6013ca | 1296 | 0x9e2f4b1dU, 0xb230f3dcU, 0x8652ec0dU, 0xc1e3d077U, |
wolfSSL | 13:f67a6c6013ca | 1297 | 0xb3166c2bU, 0x70b999a9U, 0x9448fa11U, 0xe9642247U, |
wolfSSL | 13:f67a6c6013ca | 1298 | 0xfc8cc4a8U, 0xf03f1aa0U, 0x7d2cd856U, 0x3390ef22U, |
wolfSSL | 13:f67a6c6013ca | 1299 | 0x494ec787U, 0x38d1c1d9U, 0xcaa2fe8cU, 0xd40b3698U, |
wolfSSL | 13:f67a6c6013ca | 1300 | 0xf581cfa6U, 0x7ade28a5U, 0xb78e26daU, 0xadbfa43fU, |
wolfSSL | 13:f67a6c6013ca | 1301 | 0x3a9de42cU, 0x78920d50U, 0x5fcc9b6aU, 0x7e466254U, |
wolfSSL | 13:f67a6c6013ca | 1302 | 0x8d13c2f6U, 0xd8b8e890U, 0x39f75e2eU, 0xc3aff582U, |
wolfSSL | 13:f67a6c6013ca | 1303 | 0x5d80be9fU, 0xd0937c69U, 0xd52da96fU, 0x2512b3cfU, |
wolfSSL | 13:f67a6c6013ca | 1304 | 0xac993bc8U, 0x187da710U, 0x9c636ee8U, 0x3bbb7bdbU, |
wolfSSL | 13:f67a6c6013ca | 1305 | 0x267809cdU, 0x5918f46eU, 0x9ab701ecU, 0x4f9aa883U, |
wolfSSL | 13:f67a6c6013ca | 1306 | 0x956e65e6U, 0xffe67eaaU, 0xbccf0821U, 0x15e8e6efU, |
wolfSSL | 13:f67a6c6013ca | 1307 | 0xe79bd9baU, 0x6f36ce4aU, 0x9f09d4eaU, 0xb07cd629U, |
wolfSSL | 13:f67a6c6013ca | 1308 | 0xa4b2af31U, 0x3f23312aU, 0xa59430c6U, 0xa266c035U, |
wolfSSL | 13:f67a6c6013ca | 1309 | 0x4ebc3774U, 0x82caa6fcU, 0x90d0b0e0U, 0xa7d81533U, |
wolfSSL | 13:f67a6c6013ca | 1310 | 0x04984af1U, 0xecdaf741U, 0xcd500e7fU, 0x91f62f17U, |
wolfSSL | 13:f67a6c6013ca | 1311 | 0x4dd68d76U, 0xefb04d43U, 0xaa4d54ccU, 0x9604dfe4U, |
wolfSSL | 13:f67a6c6013ca | 1312 | 0xd1b5e39eU, 0x6a881b4cU, 0x2c1fb8c1U, 0x65517f46U, |
wolfSSL | 13:f67a6c6013ca | 1313 | 0x5eea049dU, 0x8c355d01U, 0x877473faU, 0x0b412efbU, |
wolfSSL | 13:f67a6c6013ca | 1314 | 0x671d5ab3U, 0xdbd25292U, 0x105633e9U, 0xd647136dU, |
wolfSSL | 13:f67a6c6013ca | 1315 | 0xd7618c9aU, 0xa10c7a37U, 0xf8148e59U, 0x133c89ebU, |
wolfSSL | 13:f67a6c6013ca | 1316 | 0xa927eeceU, 0x61c935b7U, 0x1ce5ede1U, 0x47b13c7aU, |
wolfSSL | 13:f67a6c6013ca | 1317 | 0xd2df599cU, 0xf2733f55U, 0x14ce7918U, 0xc737bf73U, |
wolfSSL | 13:f67a6c6013ca | 1318 | 0xf7cdea53U, 0xfdaa5b5fU, 0x3d6f14dfU, 0x44db8678U, |
wolfSSL | 13:f67a6c6013ca | 1319 | 0xaff381caU, 0x68c43eb9U, 0x24342c38U, 0xa3405fc2U, |
wolfSSL | 13:f67a6c6013ca | 1320 | 0x1dc37216U, 0xe2250cbcU, 0x3c498b28U, 0x0d9541ffU, |
wolfSSL | 13:f67a6c6013ca | 1321 | 0xa8017139U, 0x0cb3de08U, 0xb4e49cd8U, 0x56c19064U, |
wolfSSL | 13:f67a6c6013ca | 1322 | 0xcb84617bU, 0x32b670d5U, 0x6c5c7448U, 0xb85742d0U, |
wolfSSL | 13:f67a6c6013ca | 1323 | } |
wolfSSL | 13:f67a6c6013ca | 1324 | }; |
wolfSSL | 13:f67a6c6013ca | 1325 | |
wolfSSL | 13:f67a6c6013ca | 1326 | |
wolfSSL | 13:f67a6c6013ca | 1327 | static const byte Td4[256] = |
wolfSSL | 13:f67a6c6013ca | 1328 | { |
wolfSSL | 13:f67a6c6013ca | 1329 | 0x52U, 0x09U, 0x6aU, 0xd5U, 0x30U, 0x36U, 0xa5U, 0x38U, |
wolfSSL | 13:f67a6c6013ca | 1330 | 0xbfU, 0x40U, 0xa3U, 0x9eU, 0x81U, 0xf3U, 0xd7U, 0xfbU, |
wolfSSL | 13:f67a6c6013ca | 1331 | 0x7cU, 0xe3U, 0x39U, 0x82U, 0x9bU, 0x2fU, 0xffU, 0x87U, |
wolfSSL | 13:f67a6c6013ca | 1332 | 0x34U, 0x8eU, 0x43U, 0x44U, 0xc4U, 0xdeU, 0xe9U, 0xcbU, |
wolfSSL | 13:f67a6c6013ca | 1333 | 0x54U, 0x7bU, 0x94U, 0x32U, 0xa6U, 0xc2U, 0x23U, 0x3dU, |
wolfSSL | 13:f67a6c6013ca | 1334 | 0xeeU, 0x4cU, 0x95U, 0x0bU, 0x42U, 0xfaU, 0xc3U, 0x4eU, |
wolfSSL | 13:f67a6c6013ca | 1335 | 0x08U, 0x2eU, 0xa1U, 0x66U, 0x28U, 0xd9U, 0x24U, 0xb2U, |
wolfSSL | 13:f67a6c6013ca | 1336 | 0x76U, 0x5bU, 0xa2U, 0x49U, 0x6dU, 0x8bU, 0xd1U, 0x25U, |
wolfSSL | 13:f67a6c6013ca | 1337 | 0x72U, 0xf8U, 0xf6U, 0x64U, 0x86U, 0x68U, 0x98U, 0x16U, |
wolfSSL | 13:f67a6c6013ca | 1338 | 0xd4U, 0xa4U, 0x5cU, 0xccU, 0x5dU, 0x65U, 0xb6U, 0x92U, |
wolfSSL | 13:f67a6c6013ca | 1339 | 0x6cU, 0x70U, 0x48U, 0x50U, 0xfdU, 0xedU, 0xb9U, 0xdaU, |
wolfSSL | 13:f67a6c6013ca | 1340 | 0x5eU, 0x15U, 0x46U, 0x57U, 0xa7U, 0x8dU, 0x9dU, 0x84U, |
wolfSSL | 13:f67a6c6013ca | 1341 | 0x90U, 0xd8U, 0xabU, 0x00U, 0x8cU, 0xbcU, 0xd3U, 0x0aU, |
wolfSSL | 13:f67a6c6013ca | 1342 | 0xf7U, 0xe4U, 0x58U, 0x05U, 0xb8U, 0xb3U, 0x45U, 0x06U, |
wolfSSL | 13:f67a6c6013ca | 1343 | 0xd0U, 0x2cU, 0x1eU, 0x8fU, 0xcaU, 0x3fU, 0x0fU, 0x02U, |
wolfSSL | 13:f67a6c6013ca | 1344 | 0xc1U, 0xafU, 0xbdU, 0x03U, 0x01U, 0x13U, 0x8aU, 0x6bU, |
wolfSSL | 13:f67a6c6013ca | 1345 | 0x3aU, 0x91U, 0x11U, 0x41U, 0x4fU, 0x67U, 0xdcU, 0xeaU, |
wolfSSL | 13:f67a6c6013ca | 1346 | 0x97U, 0xf2U, 0xcfU, 0xceU, 0xf0U, 0xb4U, 0xe6U, 0x73U, |
wolfSSL | 13:f67a6c6013ca | 1347 | 0x96U, 0xacU, 0x74U, 0x22U, 0xe7U, 0xadU, 0x35U, 0x85U, |
wolfSSL | 13:f67a6c6013ca | 1348 | 0xe2U, 0xf9U, 0x37U, 0xe8U, 0x1cU, 0x75U, 0xdfU, 0x6eU, |
wolfSSL | 13:f67a6c6013ca | 1349 | 0x47U, 0xf1U, 0x1aU, 0x71U, 0x1dU, 0x29U, 0xc5U, 0x89U, |
wolfSSL | 13:f67a6c6013ca | 1350 | 0x6fU, 0xb7U, 0x62U, 0x0eU, 0xaaU, 0x18U, 0xbeU, 0x1bU, |
wolfSSL | 13:f67a6c6013ca | 1351 | 0xfcU, 0x56U, 0x3eU, 0x4bU, 0xc6U, 0xd2U, 0x79U, 0x20U, |
wolfSSL | 13:f67a6c6013ca | 1352 | 0x9aU, 0xdbU, 0xc0U, 0xfeU, 0x78U, 0xcdU, 0x5aU, 0xf4U, |
wolfSSL | 13:f67a6c6013ca | 1353 | 0x1fU, 0xddU, 0xa8U, 0x33U, 0x88U, 0x07U, 0xc7U, 0x31U, |
wolfSSL | 13:f67a6c6013ca | 1354 | 0xb1U, 0x12U, 0x10U, 0x59U, 0x27U, 0x80U, 0xecU, 0x5fU, |
wolfSSL | 13:f67a6c6013ca | 1355 | 0x60U, 0x51U, 0x7fU, 0xa9U, 0x19U, 0xb5U, 0x4aU, 0x0dU, |
wolfSSL | 13:f67a6c6013ca | 1356 | 0x2dU, 0xe5U, 0x7aU, 0x9fU, 0x93U, 0xc9U, 0x9cU, 0xefU, |
wolfSSL | 13:f67a6c6013ca | 1357 | 0xa0U, 0xe0U, 0x3bU, 0x4dU, 0xaeU, 0x2aU, 0xf5U, 0xb0U, |
wolfSSL | 13:f67a6c6013ca | 1358 | 0xc8U, 0xebU, 0xbbU, 0x3cU, 0x83U, 0x53U, 0x99U, 0x61U, |
wolfSSL | 13:f67a6c6013ca | 1359 | 0x17U, 0x2bU, 0x04U, 0x7eU, 0xbaU, 0x77U, 0xd6U, 0x26U, |
wolfSSL | 13:f67a6c6013ca | 1360 | 0xe1U, 0x69U, 0x14U, 0x63U, 0x55U, 0x21U, 0x0cU, 0x7dU, |
wolfSSL | 13:f67a6c6013ca | 1361 | }; |
wolfSSL | 13:f67a6c6013ca | 1362 | #endif /* HAVE_AES_DECRYPT */ |
wolfSSL | 13:f67a6c6013ca | 1363 | |
wolfSSL | 13:f67a6c6013ca | 1364 | #define GETBYTE(x, y) (word32)((byte)((x) >> (8 * (y)))) |
wolfSSL | 13:f67a6c6013ca | 1365 | |
wolfSSL | 13:f67a6c6013ca | 1366 | |
wolfSSL | 13:f67a6c6013ca | 1367 | |
wolfSSL | 13:f67a6c6013ca | 1368 | #if defined(HAVE_AES_CBC) || defined(WOLFSSL_AES_DIRECT) || defined(HAVE_AESGCM) |
wolfSSL | 13:f67a6c6013ca | 1369 | |
wolfSSL | 13:f67a6c6013ca | 1370 | #ifndef WC_CACHE_LINE_SZ |
wolfSSL | 13:f67a6c6013ca | 1371 | #if defined(__x86_64__) || defined(_M_X64) || \ |
wolfSSL | 13:f67a6c6013ca | 1372 | (defined(__ILP32__) && (__ILP32__ >= 1)) |
wolfSSL | 13:f67a6c6013ca | 1373 | #define WC_CACHE_LINE_SZ 64 |
wolfSSL | 13:f67a6c6013ca | 1374 | #else |
wolfSSL | 13:f67a6c6013ca | 1375 | /* default cache line size */ |
wolfSSL | 13:f67a6c6013ca | 1376 | #define WC_CACHE_LINE_SZ 32 |
wolfSSL | 13:f67a6c6013ca | 1377 | #endif |
wolfSSL | 13:f67a6c6013ca | 1378 | #endif |
wolfSSL | 13:f67a6c6013ca | 1379 | |
wolfSSL | 13:f67a6c6013ca | 1380 | |
wolfSSL | 13:f67a6c6013ca | 1381 | /* load 4 Te Tables into cache by cache line stride */ |
wolfSSL | 13:f67a6c6013ca | 1382 | static INLINE word32 PreFetchTe(void) |
wolfSSL | 13:f67a6c6013ca | 1383 | { |
wolfSSL | 13:f67a6c6013ca | 1384 | word32 x = 0; |
wolfSSL | 13:f67a6c6013ca | 1385 | int i,j; |
wolfSSL | 13:f67a6c6013ca | 1386 | |
wolfSSL | 13:f67a6c6013ca | 1387 | for (i = 0; i < 4; i++) { |
wolfSSL | 13:f67a6c6013ca | 1388 | /* 256 elements, each one is 4 bytes */ |
wolfSSL | 13:f67a6c6013ca | 1389 | for (j = 0; j < 256; j += WC_CACHE_LINE_SZ/4) { |
wolfSSL | 13:f67a6c6013ca | 1390 | x &= Te[i][j]; |
wolfSSL | 13:f67a6c6013ca | 1391 | } |
wolfSSL | 13:f67a6c6013ca | 1392 | } |
wolfSSL | 13:f67a6c6013ca | 1393 | return x; |
wolfSSL | 13:f67a6c6013ca | 1394 | } |
wolfSSL | 13:f67a6c6013ca | 1395 | |
wolfSSL | 13:f67a6c6013ca | 1396 | |
wolfSSL | 13:f67a6c6013ca | 1397 | static void wc_AesEncrypt(Aes* aes, const byte* inBlock, byte* outBlock) |
wolfSSL | 13:f67a6c6013ca | 1398 | { |
wolfSSL | 13:f67a6c6013ca | 1399 | word32 s0, s1, s2, s3; |
wolfSSL | 13:f67a6c6013ca | 1400 | word32 t0, t1, t2, t3; |
wolfSSL | 13:f67a6c6013ca | 1401 | word32 r = aes->rounds >> 1; |
wolfSSL | 13:f67a6c6013ca | 1402 | const word32* rk = aes->key; |
wolfSSL | 13:f67a6c6013ca | 1403 | |
wolfSSL | 13:f67a6c6013ca | 1404 | if (r > 7 || r == 0) { |
wolfSSL | 13:f67a6c6013ca | 1405 | WOLFSSL_MSG("AesEncrypt encountered improper key, set it up"); |
wolfSSL | 13:f67a6c6013ca | 1406 | return; /* stop instead of segfaulting, set up your keys! */ |
wolfSSL | 13:f67a6c6013ca | 1407 | } |
wolfSSL | 13:f67a6c6013ca | 1408 | |
wolfSSL | 13:f67a6c6013ca | 1409 | #ifdef WOLFSSL_AESNI |
wolfSSL | 13:f67a6c6013ca | 1410 | if (haveAESNI && aes->use_aesni) { |
wolfSSL | 13:f67a6c6013ca | 1411 | #ifdef DEBUG_AESNI |
wolfSSL | 13:f67a6c6013ca | 1412 | printf("about to aes encrypt\n"); |
wolfSSL | 13:f67a6c6013ca | 1413 | printf("in = %p\n", inBlock); |
wolfSSL | 13:f67a6c6013ca | 1414 | printf("out = %p\n", outBlock); |
wolfSSL | 13:f67a6c6013ca | 1415 | printf("aes->key = %p\n", aes->key); |
wolfSSL | 13:f67a6c6013ca | 1416 | printf("aes->rounds = %d\n", aes->rounds); |
wolfSSL | 13:f67a6c6013ca | 1417 | printf("sz = %d\n", AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 1418 | #endif |
wolfSSL | 13:f67a6c6013ca | 1419 | |
wolfSSL | 13:f67a6c6013ca | 1420 | /* check alignment, decrypt doesn't need alignment */ |
wolfSSL | 13:f67a6c6013ca | 1421 | if ((wolfssl_word)inBlock % AESNI_ALIGN) { |
wolfSSL | 13:f67a6c6013ca | 1422 | #ifndef NO_WOLFSSL_ALLOC_ALIGN |
wolfSSL | 13:f67a6c6013ca | 1423 | byte* tmp = (byte*)XMALLOC(AES_BLOCK_SIZE + AESNI_ALIGN, aes->heap, |
wolfSSL | 13:f67a6c6013ca | 1424 | DYNAMIC_TYPE_TMP_BUFFER); |
wolfSSL | 13:f67a6c6013ca | 1425 | byte* tmp_align; |
wolfSSL | 13:f67a6c6013ca | 1426 | if (tmp == NULL) return; |
wolfSSL | 13:f67a6c6013ca | 1427 | |
wolfSSL | 13:f67a6c6013ca | 1428 | tmp_align = tmp + (AESNI_ALIGN - ((size_t)tmp % AESNI_ALIGN)); |
wolfSSL | 13:f67a6c6013ca | 1429 | |
wolfSSL | 13:f67a6c6013ca | 1430 | XMEMCPY(tmp_align, inBlock, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 1431 | AES_ECB_encrypt(tmp_align, tmp_align, AES_BLOCK_SIZE, (byte*)aes->key, |
wolfSSL | 13:f67a6c6013ca | 1432 | aes->rounds); |
wolfSSL | 13:f67a6c6013ca | 1433 | XMEMCPY(outBlock, tmp_align, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 1434 | XFREE(tmp, aes->heap, DYNAMIC_TYPE_TMP_BUFFER); |
wolfSSL | 13:f67a6c6013ca | 1435 | return; |
wolfSSL | 13:f67a6c6013ca | 1436 | #else |
wolfSSL | 13:f67a6c6013ca | 1437 | WOLFSSL_MSG("AES-ECB encrypt with bad alignment"); |
wolfSSL | 13:f67a6c6013ca | 1438 | return; |
wolfSSL | 13:f67a6c6013ca | 1439 | #endif |
wolfSSL | 13:f67a6c6013ca | 1440 | } |
wolfSSL | 13:f67a6c6013ca | 1441 | |
wolfSSL | 13:f67a6c6013ca | 1442 | AES_ECB_encrypt(inBlock, outBlock, AES_BLOCK_SIZE, (byte*)aes->key, |
wolfSSL | 13:f67a6c6013ca | 1443 | aes->rounds); |
wolfSSL | 13:f67a6c6013ca | 1444 | |
wolfSSL | 13:f67a6c6013ca | 1445 | return; |
wolfSSL | 13:f67a6c6013ca | 1446 | } |
wolfSSL | 13:f67a6c6013ca | 1447 | else { |
wolfSSL | 13:f67a6c6013ca | 1448 | #ifdef DEBUG_AESNI |
wolfSSL | 13:f67a6c6013ca | 1449 | printf("Skipping AES-NI\n"); |
wolfSSL | 13:f67a6c6013ca | 1450 | #endif |
wolfSSL | 13:f67a6c6013ca | 1451 | } |
wolfSSL | 13:f67a6c6013ca | 1452 | #endif |
wolfSSL | 13:f67a6c6013ca | 1453 | |
wolfSSL | 13:f67a6c6013ca | 1454 | /* |
wolfSSL | 13:f67a6c6013ca | 1455 | * map byte array block to cipher state |
wolfSSL | 13:f67a6c6013ca | 1456 | * and add initial round key: |
wolfSSL | 13:f67a6c6013ca | 1457 | */ |
wolfSSL | 13:f67a6c6013ca | 1458 | XMEMCPY(&s0, inBlock, sizeof(s0)); |
wolfSSL | 13:f67a6c6013ca | 1459 | XMEMCPY(&s1, inBlock + sizeof(s0), sizeof(s1)); |
wolfSSL | 13:f67a6c6013ca | 1460 | XMEMCPY(&s2, inBlock + 2 * sizeof(s0), sizeof(s2)); |
wolfSSL | 13:f67a6c6013ca | 1461 | XMEMCPY(&s3, inBlock + 3 * sizeof(s0), sizeof(s3)); |
wolfSSL | 13:f67a6c6013ca | 1462 | |
wolfSSL | 13:f67a6c6013ca | 1463 | #ifdef LITTLE_ENDIAN_ORDER |
wolfSSL | 13:f67a6c6013ca | 1464 | s0 = ByteReverseWord32(s0); |
wolfSSL | 13:f67a6c6013ca | 1465 | s1 = ByteReverseWord32(s1); |
wolfSSL | 13:f67a6c6013ca | 1466 | s2 = ByteReverseWord32(s2); |
wolfSSL | 13:f67a6c6013ca | 1467 | s3 = ByteReverseWord32(s3); |
wolfSSL | 13:f67a6c6013ca | 1468 | #endif |
wolfSSL | 13:f67a6c6013ca | 1469 | |
wolfSSL | 13:f67a6c6013ca | 1470 | s0 ^= rk[0]; |
wolfSSL | 13:f67a6c6013ca | 1471 | s1 ^= rk[1]; |
wolfSSL | 13:f67a6c6013ca | 1472 | s2 ^= rk[2]; |
wolfSSL | 13:f67a6c6013ca | 1473 | s3 ^= rk[3]; |
wolfSSL | 13:f67a6c6013ca | 1474 | |
wolfSSL | 13:f67a6c6013ca | 1475 | s0 |= PreFetchTe(); |
wolfSSL | 13:f67a6c6013ca | 1476 | |
wolfSSL | 13:f67a6c6013ca | 1477 | /* |
wolfSSL | 13:f67a6c6013ca | 1478 | * Nr - 1 full rounds: |
wolfSSL | 13:f67a6c6013ca | 1479 | */ |
wolfSSL | 13:f67a6c6013ca | 1480 | |
wolfSSL | 13:f67a6c6013ca | 1481 | for (;;) { |
wolfSSL | 13:f67a6c6013ca | 1482 | t0 = |
wolfSSL | 13:f67a6c6013ca | 1483 | Te[0][GETBYTE(s0, 3)] ^ |
wolfSSL | 13:f67a6c6013ca | 1484 | Te[1][GETBYTE(s1, 2)] ^ |
wolfSSL | 13:f67a6c6013ca | 1485 | Te[2][GETBYTE(s2, 1)] ^ |
wolfSSL | 13:f67a6c6013ca | 1486 | Te[3][GETBYTE(s3, 0)] ^ |
wolfSSL | 13:f67a6c6013ca | 1487 | rk[4]; |
wolfSSL | 13:f67a6c6013ca | 1488 | t1 = |
wolfSSL | 13:f67a6c6013ca | 1489 | Te[0][GETBYTE(s1, 3)] ^ |
wolfSSL | 13:f67a6c6013ca | 1490 | Te[1][GETBYTE(s2, 2)] ^ |
wolfSSL | 13:f67a6c6013ca | 1491 | Te[2][GETBYTE(s3, 1)] ^ |
wolfSSL | 13:f67a6c6013ca | 1492 | Te[3][GETBYTE(s0, 0)] ^ |
wolfSSL | 13:f67a6c6013ca | 1493 | rk[5]; |
wolfSSL | 13:f67a6c6013ca | 1494 | t2 = |
wolfSSL | 13:f67a6c6013ca | 1495 | Te[0][GETBYTE(s2, 3)] ^ |
wolfSSL | 13:f67a6c6013ca | 1496 | Te[1][GETBYTE(s3, 2)] ^ |
wolfSSL | 13:f67a6c6013ca | 1497 | Te[2][GETBYTE(s0, 1)] ^ |
wolfSSL | 13:f67a6c6013ca | 1498 | Te[3][GETBYTE(s1, 0)] ^ |
wolfSSL | 13:f67a6c6013ca | 1499 | rk[6]; |
wolfSSL | 13:f67a6c6013ca | 1500 | t3 = |
wolfSSL | 13:f67a6c6013ca | 1501 | Te[0][GETBYTE(s3, 3)] ^ |
wolfSSL | 13:f67a6c6013ca | 1502 | Te[1][GETBYTE(s0, 2)] ^ |
wolfSSL | 13:f67a6c6013ca | 1503 | Te[2][GETBYTE(s1, 1)] ^ |
wolfSSL | 13:f67a6c6013ca | 1504 | Te[3][GETBYTE(s2, 0)] ^ |
wolfSSL | 13:f67a6c6013ca | 1505 | rk[7]; |
wolfSSL | 13:f67a6c6013ca | 1506 | |
wolfSSL | 13:f67a6c6013ca | 1507 | rk += 8; |
wolfSSL | 13:f67a6c6013ca | 1508 | if (--r == 0) { |
wolfSSL | 13:f67a6c6013ca | 1509 | break; |
wolfSSL | 13:f67a6c6013ca | 1510 | } |
wolfSSL | 13:f67a6c6013ca | 1511 | |
wolfSSL | 13:f67a6c6013ca | 1512 | s0 = |
wolfSSL | 13:f67a6c6013ca | 1513 | Te[0][GETBYTE(t0, 3)] ^ |
wolfSSL | 13:f67a6c6013ca | 1514 | Te[1][GETBYTE(t1, 2)] ^ |
wolfSSL | 13:f67a6c6013ca | 1515 | Te[2][GETBYTE(t2, 1)] ^ |
wolfSSL | 13:f67a6c6013ca | 1516 | Te[3][GETBYTE(t3, 0)] ^ |
wolfSSL | 13:f67a6c6013ca | 1517 | rk[0]; |
wolfSSL | 13:f67a6c6013ca | 1518 | s1 = |
wolfSSL | 13:f67a6c6013ca | 1519 | Te[0][GETBYTE(t1, 3)] ^ |
wolfSSL | 13:f67a6c6013ca | 1520 | Te[1][GETBYTE(t2, 2)] ^ |
wolfSSL | 13:f67a6c6013ca | 1521 | Te[2][GETBYTE(t3, 1)] ^ |
wolfSSL | 13:f67a6c6013ca | 1522 | Te[3][GETBYTE(t0, 0)] ^ |
wolfSSL | 13:f67a6c6013ca | 1523 | rk[1]; |
wolfSSL | 13:f67a6c6013ca | 1524 | s2 = |
wolfSSL | 13:f67a6c6013ca | 1525 | Te[0][GETBYTE(t2, 3)] ^ |
wolfSSL | 13:f67a6c6013ca | 1526 | Te[1][GETBYTE(t3, 2)] ^ |
wolfSSL | 13:f67a6c6013ca | 1527 | Te[2][GETBYTE(t0, 1)] ^ |
wolfSSL | 13:f67a6c6013ca | 1528 | Te[3][GETBYTE(t1, 0)] ^ |
wolfSSL | 13:f67a6c6013ca | 1529 | rk[2]; |
wolfSSL | 13:f67a6c6013ca | 1530 | s3 = |
wolfSSL | 13:f67a6c6013ca | 1531 | Te[0][GETBYTE(t3, 3)] ^ |
wolfSSL | 13:f67a6c6013ca | 1532 | Te[1][GETBYTE(t0, 2)] ^ |
wolfSSL | 13:f67a6c6013ca | 1533 | Te[2][GETBYTE(t1, 1)] ^ |
wolfSSL | 13:f67a6c6013ca | 1534 | Te[3][GETBYTE(t2, 0)] ^ |
wolfSSL | 13:f67a6c6013ca | 1535 | rk[3]; |
wolfSSL | 13:f67a6c6013ca | 1536 | } |
wolfSSL | 13:f67a6c6013ca | 1537 | |
wolfSSL | 13:f67a6c6013ca | 1538 | /* |
wolfSSL | 13:f67a6c6013ca | 1539 | * apply last round and |
wolfSSL | 13:f67a6c6013ca | 1540 | * map cipher state to byte array block: |
wolfSSL | 13:f67a6c6013ca | 1541 | */ |
wolfSSL | 13:f67a6c6013ca | 1542 | |
wolfSSL | 13:f67a6c6013ca | 1543 | s0 = |
wolfSSL | 13:f67a6c6013ca | 1544 | (Te[2][GETBYTE(t0, 3)] & 0xff000000) ^ |
wolfSSL | 13:f67a6c6013ca | 1545 | (Te[3][GETBYTE(t1, 2)] & 0x00ff0000) ^ |
wolfSSL | 13:f67a6c6013ca | 1546 | (Te[0][GETBYTE(t2, 1)] & 0x0000ff00) ^ |
wolfSSL | 13:f67a6c6013ca | 1547 | (Te[1][GETBYTE(t3, 0)] & 0x000000ff) ^ |
wolfSSL | 13:f67a6c6013ca | 1548 | rk[0]; |
wolfSSL | 13:f67a6c6013ca | 1549 | s1 = |
wolfSSL | 13:f67a6c6013ca | 1550 | (Te[2][GETBYTE(t1, 3)] & 0xff000000) ^ |
wolfSSL | 13:f67a6c6013ca | 1551 | (Te[3][GETBYTE(t2, 2)] & 0x00ff0000) ^ |
wolfSSL | 13:f67a6c6013ca | 1552 | (Te[0][GETBYTE(t3, 1)] & 0x0000ff00) ^ |
wolfSSL | 13:f67a6c6013ca | 1553 | (Te[1][GETBYTE(t0, 0)] & 0x000000ff) ^ |
wolfSSL | 13:f67a6c6013ca | 1554 | rk[1]; |
wolfSSL | 13:f67a6c6013ca | 1555 | s2 = |
wolfSSL | 13:f67a6c6013ca | 1556 | (Te[2][GETBYTE(t2, 3)] & 0xff000000) ^ |
wolfSSL | 13:f67a6c6013ca | 1557 | (Te[3][GETBYTE(t3, 2)] & 0x00ff0000) ^ |
wolfSSL | 13:f67a6c6013ca | 1558 | (Te[0][GETBYTE(t0, 1)] & 0x0000ff00) ^ |
wolfSSL | 13:f67a6c6013ca | 1559 | (Te[1][GETBYTE(t1, 0)] & 0x000000ff) ^ |
wolfSSL | 13:f67a6c6013ca | 1560 | rk[2]; |
wolfSSL | 13:f67a6c6013ca | 1561 | s3 = |
wolfSSL | 13:f67a6c6013ca | 1562 | (Te[2][GETBYTE(t3, 3)] & 0xff000000) ^ |
wolfSSL | 13:f67a6c6013ca | 1563 | (Te[3][GETBYTE(t0, 2)] & 0x00ff0000) ^ |
wolfSSL | 13:f67a6c6013ca | 1564 | (Te[0][GETBYTE(t1, 1)] & 0x0000ff00) ^ |
wolfSSL | 13:f67a6c6013ca | 1565 | (Te[1][GETBYTE(t2, 0)] & 0x000000ff) ^ |
wolfSSL | 13:f67a6c6013ca | 1566 | rk[3]; |
wolfSSL | 13:f67a6c6013ca | 1567 | |
wolfSSL | 13:f67a6c6013ca | 1568 | /* write out */ |
wolfSSL | 13:f67a6c6013ca | 1569 | #ifdef LITTLE_ENDIAN_ORDER |
wolfSSL | 13:f67a6c6013ca | 1570 | s0 = ByteReverseWord32(s0); |
wolfSSL | 13:f67a6c6013ca | 1571 | s1 = ByteReverseWord32(s1); |
wolfSSL | 13:f67a6c6013ca | 1572 | s2 = ByteReverseWord32(s2); |
wolfSSL | 13:f67a6c6013ca | 1573 | s3 = ByteReverseWord32(s3); |
wolfSSL | 13:f67a6c6013ca | 1574 | #endif |
wolfSSL | 13:f67a6c6013ca | 1575 | |
wolfSSL | 13:f67a6c6013ca | 1576 | XMEMCPY(outBlock, &s0, sizeof(s0)); |
wolfSSL | 13:f67a6c6013ca | 1577 | XMEMCPY(outBlock + sizeof(s0), &s1, sizeof(s1)); |
wolfSSL | 13:f67a6c6013ca | 1578 | XMEMCPY(outBlock + 2 * sizeof(s0), &s2, sizeof(s2)); |
wolfSSL | 13:f67a6c6013ca | 1579 | XMEMCPY(outBlock + 3 * sizeof(s0), &s3, sizeof(s3)); |
wolfSSL | 13:f67a6c6013ca | 1580 | |
wolfSSL | 13:f67a6c6013ca | 1581 | } |
wolfSSL | 13:f67a6c6013ca | 1582 | #endif /* HAVE_AES_CBC || WOLFSSL_AES_DIRECT || HAVE_AESGCM */ |
wolfSSL | 13:f67a6c6013ca | 1583 | |
wolfSSL | 13:f67a6c6013ca | 1584 | #if defined(HAVE_AES_DECRYPT) |
wolfSSL | 13:f67a6c6013ca | 1585 | #if defined(HAVE_AES_CBC) || defined(WOLFSSL_AES_DIRECT) |
wolfSSL | 13:f67a6c6013ca | 1586 | |
wolfSSL | 13:f67a6c6013ca | 1587 | /* load 4 Td Tables into cache by cache line stride */ |
wolfSSL | 13:f67a6c6013ca | 1588 | static INLINE word32 PreFetchTd(void) |
wolfSSL | 13:f67a6c6013ca | 1589 | { |
wolfSSL | 13:f67a6c6013ca | 1590 | word32 x = 0; |
wolfSSL | 13:f67a6c6013ca | 1591 | int i,j; |
wolfSSL | 13:f67a6c6013ca | 1592 | |
wolfSSL | 13:f67a6c6013ca | 1593 | for (i = 0; i < 4; i++) { |
wolfSSL | 13:f67a6c6013ca | 1594 | /* 256 elements, each one is 4 bytes */ |
wolfSSL | 13:f67a6c6013ca | 1595 | for (j = 0; j < 256; j += WC_CACHE_LINE_SZ/4) { |
wolfSSL | 13:f67a6c6013ca | 1596 | x &= Td[i][j]; |
wolfSSL | 13:f67a6c6013ca | 1597 | } |
wolfSSL | 13:f67a6c6013ca | 1598 | } |
wolfSSL | 13:f67a6c6013ca | 1599 | return x; |
wolfSSL | 13:f67a6c6013ca | 1600 | } |
wolfSSL | 13:f67a6c6013ca | 1601 | |
wolfSSL | 13:f67a6c6013ca | 1602 | /* load Td Table4 into cache by cache line stride */ |
wolfSSL | 13:f67a6c6013ca | 1603 | static INLINE word32 PreFetchTd4(void) |
wolfSSL | 13:f67a6c6013ca | 1604 | { |
wolfSSL | 13:f67a6c6013ca | 1605 | word32 x = 0; |
wolfSSL | 13:f67a6c6013ca | 1606 | int i; |
wolfSSL | 13:f67a6c6013ca | 1607 | |
wolfSSL | 13:f67a6c6013ca | 1608 | for (i = 0; i < 256; i += WC_CACHE_LINE_SZ) { |
wolfSSL | 13:f67a6c6013ca | 1609 | x &= (word32)Td4[i]; |
wolfSSL | 13:f67a6c6013ca | 1610 | } |
wolfSSL | 13:f67a6c6013ca | 1611 | return x; |
wolfSSL | 13:f67a6c6013ca | 1612 | } |
wolfSSL | 13:f67a6c6013ca | 1613 | |
wolfSSL | 13:f67a6c6013ca | 1614 | static void wc_AesDecrypt(Aes* aes, const byte* inBlock, byte* outBlock) |
wolfSSL | 13:f67a6c6013ca | 1615 | { |
wolfSSL | 13:f67a6c6013ca | 1616 | word32 s0, s1, s2, s3; |
wolfSSL | 13:f67a6c6013ca | 1617 | word32 t0, t1, t2, t3; |
wolfSSL | 13:f67a6c6013ca | 1618 | word32 r = aes->rounds >> 1; |
wolfSSL | 13:f67a6c6013ca | 1619 | |
wolfSSL | 13:f67a6c6013ca | 1620 | const word32* rk = aes->key; |
wolfSSL | 13:f67a6c6013ca | 1621 | if (r > 7 || r == 0) { |
wolfSSL | 13:f67a6c6013ca | 1622 | WOLFSSL_MSG("AesDecrypt encountered improper key, set it up"); |
wolfSSL | 13:f67a6c6013ca | 1623 | return; /* stop instead of segfaulting, set up your keys! */ |
wolfSSL | 13:f67a6c6013ca | 1624 | } |
wolfSSL | 13:f67a6c6013ca | 1625 | #ifdef WOLFSSL_AESNI |
wolfSSL | 13:f67a6c6013ca | 1626 | if (haveAESNI && aes->use_aesni) { |
wolfSSL | 13:f67a6c6013ca | 1627 | #ifdef DEBUG_AESNI |
wolfSSL | 13:f67a6c6013ca | 1628 | printf("about to aes decrypt\n"); |
wolfSSL | 13:f67a6c6013ca | 1629 | printf("in = %p\n", inBlock); |
wolfSSL | 13:f67a6c6013ca | 1630 | printf("out = %p\n", outBlock); |
wolfSSL | 13:f67a6c6013ca | 1631 | printf("aes->key = %p\n", aes->key); |
wolfSSL | 13:f67a6c6013ca | 1632 | printf("aes->rounds = %d\n", aes->rounds); |
wolfSSL | 13:f67a6c6013ca | 1633 | printf("sz = %d\n", AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 1634 | #endif |
wolfSSL | 13:f67a6c6013ca | 1635 | |
wolfSSL | 13:f67a6c6013ca | 1636 | /* if input and output same will overwrite input iv */ |
wolfSSL | 13:f67a6c6013ca | 1637 | XMEMCPY(aes->tmp, inBlock, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 1638 | AES_ECB_decrypt(inBlock, outBlock, AES_BLOCK_SIZE, (byte*)aes->key, |
wolfSSL | 13:f67a6c6013ca | 1639 | aes->rounds); |
wolfSSL | 13:f67a6c6013ca | 1640 | return; |
wolfSSL | 13:f67a6c6013ca | 1641 | } |
wolfSSL | 13:f67a6c6013ca | 1642 | else { |
wolfSSL | 13:f67a6c6013ca | 1643 | #ifdef DEBUG_AESNI |
wolfSSL | 13:f67a6c6013ca | 1644 | printf("Skipping AES-NI\n"); |
wolfSSL | 13:f67a6c6013ca | 1645 | #endif |
wolfSSL | 13:f67a6c6013ca | 1646 | } |
wolfSSL | 13:f67a6c6013ca | 1647 | #endif /* WOLFSSL_AESNI */ |
wolfSSL | 13:f67a6c6013ca | 1648 | |
wolfSSL | 13:f67a6c6013ca | 1649 | /* |
wolfSSL | 13:f67a6c6013ca | 1650 | * map byte array block to cipher state |
wolfSSL | 13:f67a6c6013ca | 1651 | * and add initial round key: |
wolfSSL | 13:f67a6c6013ca | 1652 | */ |
wolfSSL | 13:f67a6c6013ca | 1653 | XMEMCPY(&s0, inBlock, sizeof(s0)); |
wolfSSL | 13:f67a6c6013ca | 1654 | XMEMCPY(&s1, inBlock + sizeof(s0), sizeof(s1)); |
wolfSSL | 13:f67a6c6013ca | 1655 | XMEMCPY(&s2, inBlock + 2 * sizeof(s0), sizeof(s2)); |
wolfSSL | 13:f67a6c6013ca | 1656 | XMEMCPY(&s3, inBlock + 3 * sizeof(s0), sizeof(s3)); |
wolfSSL | 13:f67a6c6013ca | 1657 | |
wolfSSL | 13:f67a6c6013ca | 1658 | #ifdef LITTLE_ENDIAN_ORDER |
wolfSSL | 13:f67a6c6013ca | 1659 | s0 = ByteReverseWord32(s0); |
wolfSSL | 13:f67a6c6013ca | 1660 | s1 = ByteReverseWord32(s1); |
wolfSSL | 13:f67a6c6013ca | 1661 | s2 = ByteReverseWord32(s2); |
wolfSSL | 13:f67a6c6013ca | 1662 | s3 = ByteReverseWord32(s3); |
wolfSSL | 13:f67a6c6013ca | 1663 | #endif |
wolfSSL | 13:f67a6c6013ca | 1664 | |
wolfSSL | 13:f67a6c6013ca | 1665 | s0 ^= rk[0]; |
wolfSSL | 13:f67a6c6013ca | 1666 | s1 ^= rk[1]; |
wolfSSL | 13:f67a6c6013ca | 1667 | s2 ^= rk[2]; |
wolfSSL | 13:f67a6c6013ca | 1668 | s3 ^= rk[3]; |
wolfSSL | 13:f67a6c6013ca | 1669 | |
wolfSSL | 13:f67a6c6013ca | 1670 | s0 |= PreFetchTd(); |
wolfSSL | 13:f67a6c6013ca | 1671 | |
wolfSSL | 13:f67a6c6013ca | 1672 | /* |
wolfSSL | 13:f67a6c6013ca | 1673 | * Nr - 1 full rounds: |
wolfSSL | 13:f67a6c6013ca | 1674 | */ |
wolfSSL | 13:f67a6c6013ca | 1675 | |
wolfSSL | 13:f67a6c6013ca | 1676 | for (;;) { |
wolfSSL | 13:f67a6c6013ca | 1677 | t0 = |
wolfSSL | 13:f67a6c6013ca | 1678 | Td[0][GETBYTE(s0, 3)] ^ |
wolfSSL | 13:f67a6c6013ca | 1679 | Td[1][GETBYTE(s3, 2)] ^ |
wolfSSL | 13:f67a6c6013ca | 1680 | Td[2][GETBYTE(s2, 1)] ^ |
wolfSSL | 13:f67a6c6013ca | 1681 | Td[3][GETBYTE(s1, 0)] ^ |
wolfSSL | 13:f67a6c6013ca | 1682 | rk[4]; |
wolfSSL | 13:f67a6c6013ca | 1683 | t1 = |
wolfSSL | 13:f67a6c6013ca | 1684 | Td[0][GETBYTE(s1, 3)] ^ |
wolfSSL | 13:f67a6c6013ca | 1685 | Td[1][GETBYTE(s0, 2)] ^ |
wolfSSL | 13:f67a6c6013ca | 1686 | Td[2][GETBYTE(s3, 1)] ^ |
wolfSSL | 13:f67a6c6013ca | 1687 | Td[3][GETBYTE(s2, 0)] ^ |
wolfSSL | 13:f67a6c6013ca | 1688 | rk[5]; |
wolfSSL | 13:f67a6c6013ca | 1689 | t2 = |
wolfSSL | 13:f67a6c6013ca | 1690 | Td[0][GETBYTE(s2, 3)] ^ |
wolfSSL | 13:f67a6c6013ca | 1691 | Td[1][GETBYTE(s1, 2)] ^ |
wolfSSL | 13:f67a6c6013ca | 1692 | Td[2][GETBYTE(s0, 1)] ^ |
wolfSSL | 13:f67a6c6013ca | 1693 | Td[3][GETBYTE(s3, 0)] ^ |
wolfSSL | 13:f67a6c6013ca | 1694 | rk[6]; |
wolfSSL | 13:f67a6c6013ca | 1695 | t3 = |
wolfSSL | 13:f67a6c6013ca | 1696 | Td[0][GETBYTE(s3, 3)] ^ |
wolfSSL | 13:f67a6c6013ca | 1697 | Td[1][GETBYTE(s2, 2)] ^ |
wolfSSL | 13:f67a6c6013ca | 1698 | Td[2][GETBYTE(s1, 1)] ^ |
wolfSSL | 13:f67a6c6013ca | 1699 | Td[3][GETBYTE(s0, 0)] ^ |
wolfSSL | 13:f67a6c6013ca | 1700 | rk[7]; |
wolfSSL | 13:f67a6c6013ca | 1701 | |
wolfSSL | 13:f67a6c6013ca | 1702 | rk += 8; |
wolfSSL | 13:f67a6c6013ca | 1703 | if (--r == 0) { |
wolfSSL | 13:f67a6c6013ca | 1704 | break; |
wolfSSL | 13:f67a6c6013ca | 1705 | } |
wolfSSL | 13:f67a6c6013ca | 1706 | |
wolfSSL | 13:f67a6c6013ca | 1707 | s0 = |
wolfSSL | 13:f67a6c6013ca | 1708 | Td[0][GETBYTE(t0, 3)] ^ |
wolfSSL | 13:f67a6c6013ca | 1709 | Td[1][GETBYTE(t3, 2)] ^ |
wolfSSL | 13:f67a6c6013ca | 1710 | Td[2][GETBYTE(t2, 1)] ^ |
wolfSSL | 13:f67a6c6013ca | 1711 | Td[3][GETBYTE(t1, 0)] ^ |
wolfSSL | 13:f67a6c6013ca | 1712 | rk[0]; |
wolfSSL | 13:f67a6c6013ca | 1713 | s1 = |
wolfSSL | 13:f67a6c6013ca | 1714 | Td[0][GETBYTE(t1, 3)] ^ |
wolfSSL | 13:f67a6c6013ca | 1715 | Td[1][GETBYTE(t0, 2)] ^ |
wolfSSL | 13:f67a6c6013ca | 1716 | Td[2][GETBYTE(t3, 1)] ^ |
wolfSSL | 13:f67a6c6013ca | 1717 | Td[3][GETBYTE(t2, 0)] ^ |
wolfSSL | 13:f67a6c6013ca | 1718 | rk[1]; |
wolfSSL | 13:f67a6c6013ca | 1719 | s2 = |
wolfSSL | 13:f67a6c6013ca | 1720 | Td[0][GETBYTE(t2, 3)] ^ |
wolfSSL | 13:f67a6c6013ca | 1721 | Td[1][GETBYTE(t1, 2)] ^ |
wolfSSL | 13:f67a6c6013ca | 1722 | Td[2][GETBYTE(t0, 1)] ^ |
wolfSSL | 13:f67a6c6013ca | 1723 | Td[3][GETBYTE(t3, 0)] ^ |
wolfSSL | 13:f67a6c6013ca | 1724 | rk[2]; |
wolfSSL | 13:f67a6c6013ca | 1725 | s3 = |
wolfSSL | 13:f67a6c6013ca | 1726 | Td[0][GETBYTE(t3, 3)] ^ |
wolfSSL | 13:f67a6c6013ca | 1727 | Td[1][GETBYTE(t2, 2)] ^ |
wolfSSL | 13:f67a6c6013ca | 1728 | Td[2][GETBYTE(t1, 1)] ^ |
wolfSSL | 13:f67a6c6013ca | 1729 | Td[3][GETBYTE(t0, 0)] ^ |
wolfSSL | 13:f67a6c6013ca | 1730 | rk[3]; |
wolfSSL | 13:f67a6c6013ca | 1731 | } |
wolfSSL | 13:f67a6c6013ca | 1732 | /* |
wolfSSL | 13:f67a6c6013ca | 1733 | * apply last round and |
wolfSSL | 13:f67a6c6013ca | 1734 | * map cipher state to byte array block: |
wolfSSL | 13:f67a6c6013ca | 1735 | */ |
wolfSSL | 13:f67a6c6013ca | 1736 | |
wolfSSL | 13:f67a6c6013ca | 1737 | t0 |= PreFetchTd4(); |
wolfSSL | 13:f67a6c6013ca | 1738 | |
wolfSSL | 13:f67a6c6013ca | 1739 | s0 = |
wolfSSL | 13:f67a6c6013ca | 1740 | ((word32)Td4[GETBYTE(t0, 3)] << 24) ^ |
wolfSSL | 13:f67a6c6013ca | 1741 | ((word32)Td4[GETBYTE(t3, 2)] << 16) ^ |
wolfSSL | 13:f67a6c6013ca | 1742 | ((word32)Td4[GETBYTE(t2, 1)] << 8) ^ |
wolfSSL | 13:f67a6c6013ca | 1743 | ((word32)Td4[GETBYTE(t1, 0)]) ^ |
wolfSSL | 13:f67a6c6013ca | 1744 | rk[0]; |
wolfSSL | 13:f67a6c6013ca | 1745 | s1 = |
wolfSSL | 13:f67a6c6013ca | 1746 | ((word32)Td4[GETBYTE(t1, 3)] << 24) ^ |
wolfSSL | 13:f67a6c6013ca | 1747 | ((word32)Td4[GETBYTE(t0, 2)] << 16) ^ |
wolfSSL | 13:f67a6c6013ca | 1748 | ((word32)Td4[GETBYTE(t3, 1)] << 8) ^ |
wolfSSL | 13:f67a6c6013ca | 1749 | ((word32)Td4[GETBYTE(t2, 0)]) ^ |
wolfSSL | 13:f67a6c6013ca | 1750 | rk[1]; |
wolfSSL | 13:f67a6c6013ca | 1751 | s2 = |
wolfSSL | 13:f67a6c6013ca | 1752 | ((word32)Td4[GETBYTE(t2, 3)] << 24) ^ |
wolfSSL | 13:f67a6c6013ca | 1753 | ((word32)Td4[GETBYTE(t1, 2)] << 16) ^ |
wolfSSL | 13:f67a6c6013ca | 1754 | ((word32)Td4[GETBYTE(t0, 1)] << 8) ^ |
wolfSSL | 13:f67a6c6013ca | 1755 | ((word32)Td4[GETBYTE(t3, 0)]) ^ |
wolfSSL | 13:f67a6c6013ca | 1756 | rk[2]; |
wolfSSL | 13:f67a6c6013ca | 1757 | s3 = |
wolfSSL | 13:f67a6c6013ca | 1758 | ((word32)Td4[GETBYTE(t3, 3)] << 24) ^ |
wolfSSL | 13:f67a6c6013ca | 1759 | ((word32)Td4[GETBYTE(t2, 2)] << 16) ^ |
wolfSSL | 13:f67a6c6013ca | 1760 | ((word32)Td4[GETBYTE(t1, 1)] << 8) ^ |
wolfSSL | 13:f67a6c6013ca | 1761 | ((word32)Td4[GETBYTE(t0, 0)]) ^ |
wolfSSL | 13:f67a6c6013ca | 1762 | rk[3]; |
wolfSSL | 13:f67a6c6013ca | 1763 | |
wolfSSL | 13:f67a6c6013ca | 1764 | /* write out */ |
wolfSSL | 13:f67a6c6013ca | 1765 | #ifdef LITTLE_ENDIAN_ORDER |
wolfSSL | 13:f67a6c6013ca | 1766 | s0 = ByteReverseWord32(s0); |
wolfSSL | 13:f67a6c6013ca | 1767 | s1 = ByteReverseWord32(s1); |
wolfSSL | 13:f67a6c6013ca | 1768 | s2 = ByteReverseWord32(s2); |
wolfSSL | 13:f67a6c6013ca | 1769 | s3 = ByteReverseWord32(s3); |
wolfSSL | 13:f67a6c6013ca | 1770 | #endif |
wolfSSL | 13:f67a6c6013ca | 1771 | |
wolfSSL | 13:f67a6c6013ca | 1772 | XMEMCPY(outBlock, &s0, sizeof(s0)); |
wolfSSL | 13:f67a6c6013ca | 1773 | XMEMCPY(outBlock + sizeof(s0), &s1, sizeof(s1)); |
wolfSSL | 13:f67a6c6013ca | 1774 | XMEMCPY(outBlock + 2 * sizeof(s0), &s2, sizeof(s2)); |
wolfSSL | 13:f67a6c6013ca | 1775 | XMEMCPY(outBlock + 3 * sizeof(s0), &s3, sizeof(s3)); |
wolfSSL | 13:f67a6c6013ca | 1776 | } |
wolfSSL | 13:f67a6c6013ca | 1777 | #endif /* HAVE_AES_CBC || WOLFSSL_AES_DIRECT */ |
wolfSSL | 13:f67a6c6013ca | 1778 | #endif /* HAVE_AES_DECRYPT */ |
wolfSSL | 13:f67a6c6013ca | 1779 | |
wolfSSL | 13:f67a6c6013ca | 1780 | #endif /* NEED_AES_TABLES */ |
wolfSSL | 13:f67a6c6013ca | 1781 | |
wolfSSL | 13:f67a6c6013ca | 1782 | |
wolfSSL | 13:f67a6c6013ca | 1783 | |
wolfSSL | 13:f67a6c6013ca | 1784 | /* wc_AesSetKey */ |
wolfSSL | 13:f67a6c6013ca | 1785 | #if defined(STM32F2_CRYPTO) || defined(STM32F4_CRYPTO) |
wolfSSL | 13:f67a6c6013ca | 1786 | |
wolfSSL | 13:f67a6c6013ca | 1787 | int wc_AesSetKey(Aes* aes, const byte* userKey, word32 keylen, |
wolfSSL | 13:f67a6c6013ca | 1788 | const byte* iv, int dir) |
wolfSSL | 13:f67a6c6013ca | 1789 | { |
wolfSSL | 13:f67a6c6013ca | 1790 | word32 *rk = aes->key; |
wolfSSL | 13:f67a6c6013ca | 1791 | |
wolfSSL | 13:f67a6c6013ca | 1792 | (void)dir; |
wolfSSL | 13:f67a6c6013ca | 1793 | |
wolfSSL | 13:f67a6c6013ca | 1794 | if (!((keylen == 16) || (keylen == 24) || (keylen == 32))) |
wolfSSL | 13:f67a6c6013ca | 1795 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 1796 | |
wolfSSL | 13:f67a6c6013ca | 1797 | aes->keylen = keylen; |
wolfSSL | 13:f67a6c6013ca | 1798 | aes->rounds = keylen/4 + 6; |
wolfSSL | 13:f67a6c6013ca | 1799 | XMEMCPY(rk, userKey, keylen); |
wolfSSL | 13:f67a6c6013ca | 1800 | #ifndef WOLFSSL_STM32_CUBEMX |
wolfSSL | 13:f67a6c6013ca | 1801 | ByteReverseWords(rk, rk, keylen); |
wolfSSL | 13:f67a6c6013ca | 1802 | #endif |
wolfSSL | 13:f67a6c6013ca | 1803 | |
wolfSSL | 13:f67a6c6013ca | 1804 | return wc_AesSetIV(aes, iv); |
wolfSSL | 13:f67a6c6013ca | 1805 | } |
wolfSSL | 13:f67a6c6013ca | 1806 | #if defined(WOLFSSL_AES_DIRECT) |
wolfSSL | 13:f67a6c6013ca | 1807 | int wc_AesSetKeyDirect(Aes* aes, const byte* userKey, word32 keylen, |
wolfSSL | 13:f67a6c6013ca | 1808 | const byte* iv, int dir) |
wolfSSL | 13:f67a6c6013ca | 1809 | { |
wolfSSL | 13:f67a6c6013ca | 1810 | return wc_AesSetKey(aes, userKey, keylen, iv, dir); |
wolfSSL | 13:f67a6c6013ca | 1811 | } |
wolfSSL | 13:f67a6c6013ca | 1812 | #endif |
wolfSSL | 13:f67a6c6013ca | 1813 | |
wolfSSL | 13:f67a6c6013ca | 1814 | #elif defined(HAVE_COLDFIRE_SEC) |
wolfSSL | 13:f67a6c6013ca | 1815 | #if defined (HAVE_THREADX) |
wolfSSL | 13:f67a6c6013ca | 1816 | #include "memory_pools.h" |
wolfSSL | 13:f67a6c6013ca | 1817 | extern TX_BYTE_POOL mp_ncached; /* Non Cached memory pool */ |
wolfSSL | 13:f67a6c6013ca | 1818 | #endif |
wolfSSL | 13:f67a6c6013ca | 1819 | |
wolfSSL | 13:f67a6c6013ca | 1820 | #define AES_BUFFER_SIZE (AES_BLOCK_SIZE * 64) |
wolfSSL | 13:f67a6c6013ca | 1821 | static unsigned char *AESBuffIn = NULL; |
wolfSSL | 13:f67a6c6013ca | 1822 | static unsigned char *AESBuffOut = NULL; |
wolfSSL | 13:f67a6c6013ca | 1823 | static byte *secReg; |
wolfSSL | 13:f67a6c6013ca | 1824 | static byte *secKey; |
wolfSSL | 13:f67a6c6013ca | 1825 | static volatile SECdescriptorType *secDesc; |
wolfSSL | 13:f67a6c6013ca | 1826 | |
wolfSSL | 13:f67a6c6013ca | 1827 | static wolfSSL_Mutex Mutex_AesSEC; |
wolfSSL | 13:f67a6c6013ca | 1828 | |
wolfSSL | 13:f67a6c6013ca | 1829 | #define SEC_DESC_AES_CBC_ENCRYPT 0x60300010 |
wolfSSL | 13:f67a6c6013ca | 1830 | #define SEC_DESC_AES_CBC_DECRYPT 0x60200010 |
wolfSSL | 13:f67a6c6013ca | 1831 | |
wolfSSL | 13:f67a6c6013ca | 1832 | extern volatile unsigned char __MBAR[]; |
wolfSSL | 13:f67a6c6013ca | 1833 | |
wolfSSL | 13:f67a6c6013ca | 1834 | int wc_AesSetKey(Aes* aes, const byte* userKey, word32 keylen, |
wolfSSL | 13:f67a6c6013ca | 1835 | const byte* iv, int dir) |
wolfSSL | 13:f67a6c6013ca | 1836 | { |
wolfSSL | 13:f67a6c6013ca | 1837 | if (AESBuffIn == NULL) { |
wolfSSL | 13:f67a6c6013ca | 1838 | #if defined (HAVE_THREADX) |
wolfSSL | 13:f67a6c6013ca | 1839 | int s1, s2, s3, s4, s5; |
wolfSSL | 13:f67a6c6013ca | 1840 | s5 = tx_byte_allocate(&mp_ncached,(void *)&secDesc, |
wolfSSL | 13:f67a6c6013ca | 1841 | sizeof(SECdescriptorType), TX_NO_WAIT); |
wolfSSL | 13:f67a6c6013ca | 1842 | s1 = tx_byte_allocate(&mp_ncached, (void *)&AESBuffIn, |
wolfSSL | 13:f67a6c6013ca | 1843 | AES_BUFFER_SIZE, TX_NO_WAIT); |
wolfSSL | 13:f67a6c6013ca | 1844 | s2 = tx_byte_allocate(&mp_ncached, (void *)&AESBuffOut, |
wolfSSL | 13:f67a6c6013ca | 1845 | AES_BUFFER_SIZE, TX_NO_WAIT); |
wolfSSL | 13:f67a6c6013ca | 1846 | s3 = tx_byte_allocate(&mp_ncached, (void *)&secKey, |
wolfSSL | 13:f67a6c6013ca | 1847 | AES_BLOCK_SIZE*2, TX_NO_WAIT); |
wolfSSL | 13:f67a6c6013ca | 1848 | s4 = tx_byte_allocate(&mp_ncached, (void *)&secReg, |
wolfSSL | 13:f67a6c6013ca | 1849 | AES_BLOCK_SIZE, TX_NO_WAIT); |
wolfSSL | 13:f67a6c6013ca | 1850 | |
wolfSSL | 13:f67a6c6013ca | 1851 | if (s1 || s2 || s3 || s4 || s5) |
wolfSSL | 13:f67a6c6013ca | 1852 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 1853 | #else |
wolfSSL | 13:f67a6c6013ca | 1854 | #warning "Allocate non-Cache buffers" |
wolfSSL | 13:f67a6c6013ca | 1855 | #endif |
wolfSSL | 13:f67a6c6013ca | 1856 | |
wolfSSL | 13:f67a6c6013ca | 1857 | wc_InitMutex(&Mutex_AesSEC); |
wolfSSL | 13:f67a6c6013ca | 1858 | } |
wolfSSL | 13:f67a6c6013ca | 1859 | |
wolfSSL | 13:f67a6c6013ca | 1860 | if (!((keylen == 16) || (keylen == 24) || (keylen == 32))) |
wolfSSL | 13:f67a6c6013ca | 1861 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 1862 | |
wolfSSL | 13:f67a6c6013ca | 1863 | if (aes == NULL) |
wolfSSL | 13:f67a6c6013ca | 1864 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 1865 | |
wolfSSL | 13:f67a6c6013ca | 1866 | aes->keylen = keylen; |
wolfSSL | 13:f67a6c6013ca | 1867 | aes->rounds = keylen/4 + 6; |
wolfSSL | 13:f67a6c6013ca | 1868 | XMEMCPY(aes->key, userKey, keylen); |
wolfSSL | 13:f67a6c6013ca | 1869 | |
wolfSSL | 13:f67a6c6013ca | 1870 | if (iv) |
wolfSSL | 13:f67a6c6013ca | 1871 | XMEMCPY(aes->reg, iv, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 1872 | |
wolfSSL | 13:f67a6c6013ca | 1873 | return 0; |
wolfSSL | 13:f67a6c6013ca | 1874 | } |
wolfSSL | 13:f67a6c6013ca | 1875 | #elif defined(FREESCALE_LTC) |
wolfSSL | 13:f67a6c6013ca | 1876 | int wc_AesSetKey(Aes* aes, const byte* userKey, word32 keylen, const byte* iv, |
wolfSSL | 13:f67a6c6013ca | 1877 | int dir) |
wolfSSL | 13:f67a6c6013ca | 1878 | { |
wolfSSL | 13:f67a6c6013ca | 1879 | if (!((keylen == 16) || (keylen == 24) || (keylen == 32))) |
wolfSSL | 13:f67a6c6013ca | 1880 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 1881 | |
wolfSSL | 13:f67a6c6013ca | 1882 | aes->rounds = keylen/4 + 6; |
wolfSSL | 13:f67a6c6013ca | 1883 | XMEMCPY(aes->key, userKey, keylen); |
wolfSSL | 13:f67a6c6013ca | 1884 | |
wolfSSL | 13:f67a6c6013ca | 1885 | #ifdef WOLFSSL_AES_COUNTER |
wolfSSL | 13:f67a6c6013ca | 1886 | aes->left = 0; |
wolfSSL | 13:f67a6c6013ca | 1887 | #endif /* WOLFSSL_AES_COUNTER */ |
wolfSSL | 13:f67a6c6013ca | 1888 | |
wolfSSL | 13:f67a6c6013ca | 1889 | return wc_AesSetIV(aes, iv); |
wolfSSL | 13:f67a6c6013ca | 1890 | } |
wolfSSL | 13:f67a6c6013ca | 1891 | |
wolfSSL | 13:f67a6c6013ca | 1892 | int wc_AesSetKeyDirect(Aes* aes, const byte* userKey, word32 keylen, |
wolfSSL | 13:f67a6c6013ca | 1893 | const byte* iv, int dir) |
wolfSSL | 13:f67a6c6013ca | 1894 | { |
wolfSSL | 13:f67a6c6013ca | 1895 | return wc_AesSetKey(aes, userKey, keylen, iv, dir); |
wolfSSL | 13:f67a6c6013ca | 1896 | } |
wolfSSL | 13:f67a6c6013ca | 1897 | #elif defined(FREESCALE_MMCAU) |
wolfSSL | 13:f67a6c6013ca | 1898 | int wc_AesSetKey(Aes* aes, const byte* userKey, word32 keylen, |
wolfSSL | 13:f67a6c6013ca | 1899 | const byte* iv, int dir) |
wolfSSL | 13:f67a6c6013ca | 1900 | { |
wolfSSL | 13:f67a6c6013ca | 1901 | int ret; |
wolfSSL | 13:f67a6c6013ca | 1902 | byte *rk = (byte*)aes->key; |
wolfSSL | 13:f67a6c6013ca | 1903 | |
wolfSSL | 13:f67a6c6013ca | 1904 | (void)dir; |
wolfSSL | 13:f67a6c6013ca | 1905 | |
wolfSSL | 13:f67a6c6013ca | 1906 | if (!((keylen == 16) || (keylen == 24) || (keylen == 32))) |
wolfSSL | 13:f67a6c6013ca | 1907 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 1908 | |
wolfSSL | 13:f67a6c6013ca | 1909 | if (rk == NULL) |
wolfSSL | 13:f67a6c6013ca | 1910 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 1911 | |
wolfSSL | 13:f67a6c6013ca | 1912 | #ifdef WOLFSSL_AES_COUNTER |
wolfSSL | 13:f67a6c6013ca | 1913 | aes->left = 0; |
wolfSSL | 13:f67a6c6013ca | 1914 | #endif /* WOLFSSL_AES_COUNTER */ |
wolfSSL | 13:f67a6c6013ca | 1915 | |
wolfSSL | 13:f67a6c6013ca | 1916 | aes->keylen = keylen; |
wolfSSL | 13:f67a6c6013ca | 1917 | aes->rounds = keylen/4 + 6; |
wolfSSL | 13:f67a6c6013ca | 1918 | |
wolfSSL | 13:f67a6c6013ca | 1919 | ret = wolfSSL_CryptHwMutexLock(); |
wolfSSL | 13:f67a6c6013ca | 1920 | if(ret == 0) { |
wolfSSL | 13:f67a6c6013ca | 1921 | #ifdef FREESCALE_MMCAU_CLASSIC |
wolfSSL | 13:f67a6c6013ca | 1922 | cau_aes_set_key(userKey, keylen*8, rk); |
wolfSSL | 13:f67a6c6013ca | 1923 | #else |
wolfSSL | 13:f67a6c6013ca | 1924 | MMCAU_AES_SetKey(userKey, keylen, rk); |
wolfSSL | 13:f67a6c6013ca | 1925 | #endif |
wolfSSL | 13:f67a6c6013ca | 1926 | wolfSSL_CryptHwMutexUnLock(); |
wolfSSL | 13:f67a6c6013ca | 1927 | |
wolfSSL | 13:f67a6c6013ca | 1928 | ret = wc_AesSetIV(aes, iv); |
wolfSSL | 13:f67a6c6013ca | 1929 | } |
wolfSSL | 13:f67a6c6013ca | 1930 | |
wolfSSL | 13:f67a6c6013ca | 1931 | return ret; |
wolfSSL | 13:f67a6c6013ca | 1932 | } |
wolfSSL | 13:f67a6c6013ca | 1933 | |
wolfSSL | 13:f67a6c6013ca | 1934 | int wc_AesSetKeyDirect(Aes* aes, const byte* userKey, word32 keylen, |
wolfSSL | 13:f67a6c6013ca | 1935 | const byte* iv, int dir) |
wolfSSL | 13:f67a6c6013ca | 1936 | { |
wolfSSL | 13:f67a6c6013ca | 1937 | return wc_AesSetKey(aes, userKey, keylen, iv, dir); |
wolfSSL | 13:f67a6c6013ca | 1938 | } |
wolfSSL | 13:f67a6c6013ca | 1939 | |
wolfSSL | 13:f67a6c6013ca | 1940 | #elif defined(WOLFSSL_NRF51_AES) |
wolfSSL | 13:f67a6c6013ca | 1941 | int wc_AesSetKey(Aes* aes, const byte* userKey, word32 keylen, |
wolfSSL | 13:f67a6c6013ca | 1942 | const byte* iv, int dir) |
wolfSSL | 13:f67a6c6013ca | 1943 | { |
wolfSSL | 13:f67a6c6013ca | 1944 | int ret; |
wolfSSL | 13:f67a6c6013ca | 1945 | |
wolfSSL | 13:f67a6c6013ca | 1946 | (void)dir; |
wolfSSL | 13:f67a6c6013ca | 1947 | (void)iv; |
wolfSSL | 13:f67a6c6013ca | 1948 | |
wolfSSL | 13:f67a6c6013ca | 1949 | if (keylen != 16) |
wolfSSL | 13:f67a6c6013ca | 1950 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 1951 | |
wolfSSL | 13:f67a6c6013ca | 1952 | aes->keylen = keylen; |
wolfSSL | 13:f67a6c6013ca | 1953 | aes->rounds = keylen/4 + 6; |
wolfSSL | 13:f67a6c6013ca | 1954 | ret = nrf51_aes_set_key(userKey); |
wolfSSL | 13:f67a6c6013ca | 1955 | |
wolfSSL | 13:f67a6c6013ca | 1956 | return ret; |
wolfSSL | 13:f67a6c6013ca | 1957 | } |
wolfSSL | 13:f67a6c6013ca | 1958 | |
wolfSSL | 13:f67a6c6013ca | 1959 | int wc_AesSetKeyDirect(Aes* aes, const byte* userKey, word32 keylen, |
wolfSSL | 13:f67a6c6013ca | 1960 | const byte* iv, int dir) |
wolfSSL | 13:f67a6c6013ca | 1961 | { |
wolfSSL | 13:f67a6c6013ca | 1962 | return wc_AesSetKey(aes, userKey, keylen, iv, dir); |
wolfSSL | 13:f67a6c6013ca | 1963 | } |
wolfSSL | 13:f67a6c6013ca | 1964 | |
wolfSSL | 13:f67a6c6013ca | 1965 | #else |
wolfSSL | 13:f67a6c6013ca | 1966 | static int wc_AesSetKeyLocal(Aes* aes, const byte* userKey, word32 keylen, |
wolfSSL | 13:f67a6c6013ca | 1967 | const byte* iv, int dir) |
wolfSSL | 13:f67a6c6013ca | 1968 | { |
wolfSSL | 13:f67a6c6013ca | 1969 | word32 *rk = aes->key; |
wolfSSL | 13:f67a6c6013ca | 1970 | #ifdef NEED_AES_TABLES |
wolfSSL | 13:f67a6c6013ca | 1971 | word32 temp; |
wolfSSL | 13:f67a6c6013ca | 1972 | unsigned int i = 0; |
wolfSSL | 13:f67a6c6013ca | 1973 | #endif |
wolfSSL | 13:f67a6c6013ca | 1974 | |
wolfSSL | 13:f67a6c6013ca | 1975 | #ifdef WOLFSSL_AESNI |
wolfSSL | 13:f67a6c6013ca | 1976 | aes->use_aesni = 0; |
wolfSSL | 13:f67a6c6013ca | 1977 | #endif /* WOLFSSL_AESNI */ |
wolfSSL | 13:f67a6c6013ca | 1978 | #ifdef WOLFSSL_AES_COUNTER |
wolfSSL | 13:f67a6c6013ca | 1979 | aes->left = 0; |
wolfSSL | 13:f67a6c6013ca | 1980 | #endif /* WOLFSSL_AES_COUNTER */ |
wolfSSL | 13:f67a6c6013ca | 1981 | |
wolfSSL | 13:f67a6c6013ca | 1982 | aes->keylen = keylen; |
wolfSSL | 13:f67a6c6013ca | 1983 | aes->rounds = (keylen/4) + 6; |
wolfSSL | 13:f67a6c6013ca | 1984 | |
wolfSSL | 13:f67a6c6013ca | 1985 | XMEMCPY(rk, userKey, keylen); |
wolfSSL | 13:f67a6c6013ca | 1986 | #ifdef LITTLE_ENDIAN_ORDER |
wolfSSL | 13:f67a6c6013ca | 1987 | ByteReverseWords(rk, rk, keylen); |
wolfSSL | 13:f67a6c6013ca | 1988 | #endif |
wolfSSL | 13:f67a6c6013ca | 1989 | |
wolfSSL | 13:f67a6c6013ca | 1990 | #ifdef WOLFSSL_PIC32MZ_CRYPT |
wolfSSL | 13:f67a6c6013ca | 1991 | XMEMCPY((word32*)aes->key_ce, userKey, keylen); |
wolfSSL | 13:f67a6c6013ca | 1992 | #endif |
wolfSSL | 13:f67a6c6013ca | 1993 | |
wolfSSL | 13:f67a6c6013ca | 1994 | #ifdef NEED_AES_TABLES |
wolfSSL | 13:f67a6c6013ca | 1995 | |
wolfSSL | 13:f67a6c6013ca | 1996 | switch (keylen) { |
wolfSSL | 13:f67a6c6013ca | 1997 | #if defined(AES_MAX_KEY_SIZE) && AES_MAX_KEY_SIZE >= 128 |
wolfSSL | 13:f67a6c6013ca | 1998 | case 16: |
wolfSSL | 13:f67a6c6013ca | 1999 | while (1) |
wolfSSL | 13:f67a6c6013ca | 2000 | { |
wolfSSL | 13:f67a6c6013ca | 2001 | temp = rk[3]; |
wolfSSL | 13:f67a6c6013ca | 2002 | rk[4] = rk[0] ^ |
wolfSSL | 13:f67a6c6013ca | 2003 | (Te[2][GETBYTE(temp, 2)] & 0xff000000) ^ |
wolfSSL | 13:f67a6c6013ca | 2004 | (Te[3][GETBYTE(temp, 1)] & 0x00ff0000) ^ |
wolfSSL | 13:f67a6c6013ca | 2005 | (Te[0][GETBYTE(temp, 0)] & 0x0000ff00) ^ |
wolfSSL | 13:f67a6c6013ca | 2006 | (Te[1][GETBYTE(temp, 3)] & 0x000000ff) ^ |
wolfSSL | 13:f67a6c6013ca | 2007 | rcon[i]; |
wolfSSL | 13:f67a6c6013ca | 2008 | rk[5] = rk[1] ^ rk[4]; |
wolfSSL | 13:f67a6c6013ca | 2009 | rk[6] = rk[2] ^ rk[5]; |
wolfSSL | 13:f67a6c6013ca | 2010 | rk[7] = rk[3] ^ rk[6]; |
wolfSSL | 13:f67a6c6013ca | 2011 | if (++i == 10) |
wolfSSL | 13:f67a6c6013ca | 2012 | break; |
wolfSSL | 13:f67a6c6013ca | 2013 | rk += 4; |
wolfSSL | 13:f67a6c6013ca | 2014 | } |
wolfSSL | 13:f67a6c6013ca | 2015 | break; |
wolfSSL | 13:f67a6c6013ca | 2016 | #endif /* 128 */ |
wolfSSL | 13:f67a6c6013ca | 2017 | |
wolfSSL | 13:f67a6c6013ca | 2018 | #if defined(AES_MAX_KEY_SIZE) && AES_MAX_KEY_SIZE >= 192 |
wolfSSL | 13:f67a6c6013ca | 2019 | case 24: |
wolfSSL | 13:f67a6c6013ca | 2020 | /* for (;;) here triggers a bug in VC60 SP4 w/ Pro Pack */ |
wolfSSL | 13:f67a6c6013ca | 2021 | while (1) |
wolfSSL | 13:f67a6c6013ca | 2022 | { |
wolfSSL | 13:f67a6c6013ca | 2023 | temp = rk[ 5]; |
wolfSSL | 13:f67a6c6013ca | 2024 | rk[ 6] = rk[ 0] ^ |
wolfSSL | 13:f67a6c6013ca | 2025 | (Te[2][GETBYTE(temp, 2)] & 0xff000000) ^ |
wolfSSL | 13:f67a6c6013ca | 2026 | (Te[3][GETBYTE(temp, 1)] & 0x00ff0000) ^ |
wolfSSL | 13:f67a6c6013ca | 2027 | (Te[0][GETBYTE(temp, 0)] & 0x0000ff00) ^ |
wolfSSL | 13:f67a6c6013ca | 2028 | (Te[1][GETBYTE(temp, 3)] & 0x000000ff) ^ |
wolfSSL | 13:f67a6c6013ca | 2029 | rcon[i]; |
wolfSSL | 13:f67a6c6013ca | 2030 | rk[ 7] = rk[ 1] ^ rk[ 6]; |
wolfSSL | 13:f67a6c6013ca | 2031 | rk[ 8] = rk[ 2] ^ rk[ 7]; |
wolfSSL | 13:f67a6c6013ca | 2032 | rk[ 9] = rk[ 3] ^ rk[ 8]; |
wolfSSL | 13:f67a6c6013ca | 2033 | if (++i == 8) |
wolfSSL | 13:f67a6c6013ca | 2034 | break; |
wolfSSL | 13:f67a6c6013ca | 2035 | rk[10] = rk[ 4] ^ rk[ 9]; |
wolfSSL | 13:f67a6c6013ca | 2036 | rk[11] = rk[ 5] ^ rk[10]; |
wolfSSL | 13:f67a6c6013ca | 2037 | rk += 6; |
wolfSSL | 13:f67a6c6013ca | 2038 | } |
wolfSSL | 13:f67a6c6013ca | 2039 | break; |
wolfSSL | 13:f67a6c6013ca | 2040 | #endif /* 192 */ |
wolfSSL | 13:f67a6c6013ca | 2041 | |
wolfSSL | 13:f67a6c6013ca | 2042 | #if defined(AES_MAX_KEY_SIZE) && AES_MAX_KEY_SIZE >= 256 |
wolfSSL | 13:f67a6c6013ca | 2043 | case 32: |
wolfSSL | 13:f67a6c6013ca | 2044 | while (1) |
wolfSSL | 13:f67a6c6013ca | 2045 | { |
wolfSSL | 13:f67a6c6013ca | 2046 | temp = rk[ 7]; |
wolfSSL | 13:f67a6c6013ca | 2047 | rk[ 8] = rk[ 0] ^ |
wolfSSL | 13:f67a6c6013ca | 2048 | (Te[2][GETBYTE(temp, 2)] & 0xff000000) ^ |
wolfSSL | 13:f67a6c6013ca | 2049 | (Te[3][GETBYTE(temp, 1)] & 0x00ff0000) ^ |
wolfSSL | 13:f67a6c6013ca | 2050 | (Te[0][GETBYTE(temp, 0)] & 0x0000ff00) ^ |
wolfSSL | 13:f67a6c6013ca | 2051 | (Te[1][GETBYTE(temp, 3)] & 0x000000ff) ^ |
wolfSSL | 13:f67a6c6013ca | 2052 | rcon[i]; |
wolfSSL | 13:f67a6c6013ca | 2053 | rk[ 9] = rk[ 1] ^ rk[ 8]; |
wolfSSL | 13:f67a6c6013ca | 2054 | rk[10] = rk[ 2] ^ rk[ 9]; |
wolfSSL | 13:f67a6c6013ca | 2055 | rk[11] = rk[ 3] ^ rk[10]; |
wolfSSL | 13:f67a6c6013ca | 2056 | if (++i == 7) |
wolfSSL | 13:f67a6c6013ca | 2057 | break; |
wolfSSL | 13:f67a6c6013ca | 2058 | temp = rk[11]; |
wolfSSL | 13:f67a6c6013ca | 2059 | rk[12] = rk[ 4] ^ |
wolfSSL | 13:f67a6c6013ca | 2060 | (Te[2][GETBYTE(temp, 3)] & 0xff000000) ^ |
wolfSSL | 13:f67a6c6013ca | 2061 | (Te[3][GETBYTE(temp, 2)] & 0x00ff0000) ^ |
wolfSSL | 13:f67a6c6013ca | 2062 | (Te[0][GETBYTE(temp, 1)] & 0x0000ff00) ^ |
wolfSSL | 13:f67a6c6013ca | 2063 | (Te[1][GETBYTE(temp, 0)] & 0x000000ff); |
wolfSSL | 13:f67a6c6013ca | 2064 | rk[13] = rk[ 5] ^ rk[12]; |
wolfSSL | 13:f67a6c6013ca | 2065 | rk[14] = rk[ 6] ^ rk[13]; |
wolfSSL | 13:f67a6c6013ca | 2066 | rk[15] = rk[ 7] ^ rk[14]; |
wolfSSL | 13:f67a6c6013ca | 2067 | |
wolfSSL | 13:f67a6c6013ca | 2068 | rk += 8; |
wolfSSL | 13:f67a6c6013ca | 2069 | } |
wolfSSL | 13:f67a6c6013ca | 2070 | break; |
wolfSSL | 13:f67a6c6013ca | 2071 | #endif /* 256 */ |
wolfSSL | 13:f67a6c6013ca | 2072 | |
wolfSSL | 13:f67a6c6013ca | 2073 | default: |
wolfSSL | 13:f67a6c6013ca | 2074 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 2075 | } /* switch */ |
wolfSSL | 13:f67a6c6013ca | 2076 | |
wolfSSL | 13:f67a6c6013ca | 2077 | #ifdef HAVE_AES_DECRYPT |
wolfSSL | 13:f67a6c6013ca | 2078 | if (dir == AES_DECRYPTION) { |
wolfSSL | 13:f67a6c6013ca | 2079 | unsigned int j; |
wolfSSL | 13:f67a6c6013ca | 2080 | rk = aes->key; |
wolfSSL | 13:f67a6c6013ca | 2081 | |
wolfSSL | 13:f67a6c6013ca | 2082 | /* invert the order of the round keys: */ |
wolfSSL | 13:f67a6c6013ca | 2083 | for (i = 0, j = 4* aes->rounds; i < j; i += 4, j -= 4) { |
wolfSSL | 13:f67a6c6013ca | 2084 | temp = rk[i ]; rk[i ] = rk[j ]; rk[j ] = temp; |
wolfSSL | 13:f67a6c6013ca | 2085 | temp = rk[i + 1]; rk[i + 1] = rk[j + 1]; rk[j + 1] = temp; |
wolfSSL | 13:f67a6c6013ca | 2086 | temp = rk[i + 2]; rk[i + 2] = rk[j + 2]; rk[j + 2] = temp; |
wolfSSL | 13:f67a6c6013ca | 2087 | temp = rk[i + 3]; rk[i + 3] = rk[j + 3]; rk[j + 3] = temp; |
wolfSSL | 13:f67a6c6013ca | 2088 | } |
wolfSSL | 13:f67a6c6013ca | 2089 | /* apply the inverse MixColumn transform to all round keys but the |
wolfSSL | 13:f67a6c6013ca | 2090 | first and the last: */ |
wolfSSL | 13:f67a6c6013ca | 2091 | for (i = 1; i < aes->rounds; i++) { |
wolfSSL | 13:f67a6c6013ca | 2092 | rk += 4; |
wolfSSL | 13:f67a6c6013ca | 2093 | rk[0] = |
wolfSSL | 13:f67a6c6013ca | 2094 | Td[0][Te[1][GETBYTE(rk[0], 3)] & 0xff] ^ |
wolfSSL | 13:f67a6c6013ca | 2095 | Td[1][Te[1][GETBYTE(rk[0], 2)] & 0xff] ^ |
wolfSSL | 13:f67a6c6013ca | 2096 | Td[2][Te[1][GETBYTE(rk[0], 1)] & 0xff] ^ |
wolfSSL | 13:f67a6c6013ca | 2097 | Td[3][Te[1][GETBYTE(rk[0], 0)] & 0xff]; |
wolfSSL | 13:f67a6c6013ca | 2098 | rk[1] = |
wolfSSL | 13:f67a6c6013ca | 2099 | Td[0][Te[1][GETBYTE(rk[1], 3)] & 0xff] ^ |
wolfSSL | 13:f67a6c6013ca | 2100 | Td[1][Te[1][GETBYTE(rk[1], 2)] & 0xff] ^ |
wolfSSL | 13:f67a6c6013ca | 2101 | Td[2][Te[1][GETBYTE(rk[1], 1)] & 0xff] ^ |
wolfSSL | 13:f67a6c6013ca | 2102 | Td[3][Te[1][GETBYTE(rk[1], 0)] & 0xff]; |
wolfSSL | 13:f67a6c6013ca | 2103 | rk[2] = |
wolfSSL | 13:f67a6c6013ca | 2104 | Td[0][Te[1][GETBYTE(rk[2], 3)] & 0xff] ^ |
wolfSSL | 13:f67a6c6013ca | 2105 | Td[1][Te[1][GETBYTE(rk[2], 2)] & 0xff] ^ |
wolfSSL | 13:f67a6c6013ca | 2106 | Td[2][Te[1][GETBYTE(rk[2], 1)] & 0xff] ^ |
wolfSSL | 13:f67a6c6013ca | 2107 | Td[3][Te[1][GETBYTE(rk[2], 0)] & 0xff]; |
wolfSSL | 13:f67a6c6013ca | 2108 | rk[3] = |
wolfSSL | 13:f67a6c6013ca | 2109 | Td[0][Te[1][GETBYTE(rk[3], 3)] & 0xff] ^ |
wolfSSL | 13:f67a6c6013ca | 2110 | Td[1][Te[1][GETBYTE(rk[3], 2)] & 0xff] ^ |
wolfSSL | 13:f67a6c6013ca | 2111 | Td[2][Te[1][GETBYTE(rk[3], 1)] & 0xff] ^ |
wolfSSL | 13:f67a6c6013ca | 2112 | Td[3][Te[1][GETBYTE(rk[3], 0)] & 0xff]; |
wolfSSL | 13:f67a6c6013ca | 2113 | } |
wolfSSL | 13:f67a6c6013ca | 2114 | } |
wolfSSL | 13:f67a6c6013ca | 2115 | #else |
wolfSSL | 13:f67a6c6013ca | 2116 | (void)dir; |
wolfSSL | 13:f67a6c6013ca | 2117 | #endif /* HAVE_AES_DECRYPT */ |
wolfSSL | 13:f67a6c6013ca | 2118 | #endif /* NEED_AES_TABLES */ |
wolfSSL | 13:f67a6c6013ca | 2119 | |
wolfSSL | 13:f67a6c6013ca | 2120 | return wc_AesSetIV(aes, iv); |
wolfSSL | 13:f67a6c6013ca | 2121 | } |
wolfSSL | 13:f67a6c6013ca | 2122 | |
wolfSSL | 13:f67a6c6013ca | 2123 | int wc_AesSetKey(Aes* aes, const byte* userKey, word32 keylen, |
wolfSSL | 13:f67a6c6013ca | 2124 | const byte* iv, int dir) |
wolfSSL | 13:f67a6c6013ca | 2125 | { |
wolfSSL | 13:f67a6c6013ca | 2126 | #if defined(AES_MAX_KEY_SIZE) |
wolfSSL | 13:f67a6c6013ca | 2127 | const word32 max_key_len = (AES_MAX_KEY_SIZE / 8); |
wolfSSL | 13:f67a6c6013ca | 2128 | #endif |
wolfSSL | 13:f67a6c6013ca | 2129 | |
wolfSSL | 13:f67a6c6013ca | 2130 | if (aes == NULL || |
wolfSSL | 13:f67a6c6013ca | 2131 | !((keylen == 16) || (keylen == 24) || (keylen == 32))) { |
wolfSSL | 13:f67a6c6013ca | 2132 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 2133 | } |
wolfSSL | 13:f67a6c6013ca | 2134 | |
wolfSSL | 13:f67a6c6013ca | 2135 | #if defined(AES_MAX_KEY_SIZE) |
wolfSSL | 13:f67a6c6013ca | 2136 | /* Check key length */ |
wolfSSL | 13:f67a6c6013ca | 2137 | if (keylen > max_key_len) { |
wolfSSL | 13:f67a6c6013ca | 2138 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 2139 | } |
wolfSSL | 13:f67a6c6013ca | 2140 | #endif |
wolfSSL | 13:f67a6c6013ca | 2141 | aes->keylen = keylen; |
wolfSSL | 13:f67a6c6013ca | 2142 | aes->rounds = keylen/4 + 6; |
wolfSSL | 13:f67a6c6013ca | 2143 | |
wolfSSL | 13:f67a6c6013ca | 2144 | #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_AES) |
wolfSSL | 13:f67a6c6013ca | 2145 | if (aes->asyncDev.marker == WOLFSSL_ASYNC_MARKER_AES) { |
wolfSSL | 13:f67a6c6013ca | 2146 | XMEMCPY(aes->asyncKey, userKey, keylen); |
wolfSSL | 13:f67a6c6013ca | 2147 | XMEMCPY(aes->asyncIv, iv, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2148 | } |
wolfSSL | 13:f67a6c6013ca | 2149 | #endif /* WOLFSSL_ASYNC_CRYPT */ |
wolfSSL | 13:f67a6c6013ca | 2150 | |
wolfSSL | 13:f67a6c6013ca | 2151 | #ifdef WOLFSSL_AESNI |
wolfSSL | 13:f67a6c6013ca | 2152 | if (checkAESNI == 0) { |
wolfSSL | 13:f67a6c6013ca | 2153 | haveAESNI = Check_CPU_support_AES(); |
wolfSSL | 13:f67a6c6013ca | 2154 | checkAESNI = 1; |
wolfSSL | 13:f67a6c6013ca | 2155 | } |
wolfSSL | 13:f67a6c6013ca | 2156 | if (haveAESNI) { |
wolfSSL | 13:f67a6c6013ca | 2157 | #ifdef WOLFSSL_AES_COUNTER |
wolfSSL | 13:f67a6c6013ca | 2158 | aes->left = 0; |
wolfSSL | 13:f67a6c6013ca | 2159 | #endif /* WOLFSSL_AES_COUNTER */ |
wolfSSL | 13:f67a6c6013ca | 2160 | aes->use_aesni = 1; |
wolfSSL | 13:f67a6c6013ca | 2161 | if (iv) |
wolfSSL | 13:f67a6c6013ca | 2162 | XMEMCPY(aes->reg, iv, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2163 | if (dir == AES_ENCRYPTION) |
wolfSSL | 13:f67a6c6013ca | 2164 | return AES_set_encrypt_key(userKey, keylen * 8, aes); |
wolfSSL | 13:f67a6c6013ca | 2165 | #ifdef HAVE_AES_DECRYPT |
wolfSSL | 13:f67a6c6013ca | 2166 | else |
wolfSSL | 13:f67a6c6013ca | 2167 | return AES_set_decrypt_key(userKey, keylen * 8, aes); |
wolfSSL | 13:f67a6c6013ca | 2168 | #endif |
wolfSSL | 13:f67a6c6013ca | 2169 | } |
wolfSSL | 13:f67a6c6013ca | 2170 | #endif /* WOLFSSL_AESNI */ |
wolfSSL | 13:f67a6c6013ca | 2171 | |
wolfSSL | 13:f67a6c6013ca | 2172 | return wc_AesSetKeyLocal(aes, userKey, keylen, iv, dir); |
wolfSSL | 13:f67a6c6013ca | 2173 | } |
wolfSSL | 13:f67a6c6013ca | 2174 | |
wolfSSL | 13:f67a6c6013ca | 2175 | #if defined(WOLFSSL_AES_DIRECT) || defined(WOLFSSL_AES_COUNTER) |
wolfSSL | 13:f67a6c6013ca | 2176 | /* AES-CTR and AES-DIRECT need to use this for key setup, no aesni yet */ |
wolfSSL | 13:f67a6c6013ca | 2177 | int wc_AesSetKeyDirect(Aes* aes, const byte* userKey, word32 keylen, |
wolfSSL | 13:f67a6c6013ca | 2178 | const byte* iv, int dir) |
wolfSSL | 13:f67a6c6013ca | 2179 | { |
wolfSSL | 13:f67a6c6013ca | 2180 | return wc_AesSetKeyLocal(aes, userKey, keylen, iv, dir); |
wolfSSL | 13:f67a6c6013ca | 2181 | } |
wolfSSL | 13:f67a6c6013ca | 2182 | #endif /* WOLFSSL_AES_DIRECT || WOLFSSL_AES_COUNTER */ |
wolfSSL | 13:f67a6c6013ca | 2183 | #endif /* wc_AesSetKey block */ |
wolfSSL | 13:f67a6c6013ca | 2184 | |
wolfSSL | 13:f67a6c6013ca | 2185 | |
wolfSSL | 13:f67a6c6013ca | 2186 | /* wc_AesSetIV is shared between software and hardware */ |
wolfSSL | 13:f67a6c6013ca | 2187 | int wc_AesSetIV(Aes* aes, const byte* iv) |
wolfSSL | 13:f67a6c6013ca | 2188 | { |
wolfSSL | 13:f67a6c6013ca | 2189 | if (aes == NULL) |
wolfSSL | 13:f67a6c6013ca | 2190 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 2191 | |
wolfSSL | 13:f67a6c6013ca | 2192 | if (iv) |
wolfSSL | 13:f67a6c6013ca | 2193 | XMEMCPY(aes->reg, iv, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2194 | else |
wolfSSL | 13:f67a6c6013ca | 2195 | XMEMSET(aes->reg, 0, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2196 | |
wolfSSL | 13:f67a6c6013ca | 2197 | #ifdef WOLFSSL_PIC32MZ_CRYPT |
wolfSSL | 13:f67a6c6013ca | 2198 | XMEMCPY(aes->iv_ce, aes->reg, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2199 | #endif |
wolfSSL | 13:f67a6c6013ca | 2200 | |
wolfSSL | 13:f67a6c6013ca | 2201 | return 0; |
wolfSSL | 13:f67a6c6013ca | 2202 | } |
wolfSSL | 13:f67a6c6013ca | 2203 | |
wolfSSL | 13:f67a6c6013ca | 2204 | /* AES-DIRECT */ |
wolfSSL | 13:f67a6c6013ca | 2205 | #if defined(WOLFSSL_AES_DIRECT) |
wolfSSL | 13:f67a6c6013ca | 2206 | #if defined(HAVE_COLDFIRE_SEC) |
wolfSSL | 13:f67a6c6013ca | 2207 | #error "Coldfire SEC doesn't yet support AES direct" |
wolfSSL | 13:f67a6c6013ca | 2208 | |
wolfSSL | 13:f67a6c6013ca | 2209 | #elif defined(FREESCALE_LTC) |
wolfSSL | 13:f67a6c6013ca | 2210 | /* Allow direct access to one block encrypt */ |
wolfSSL | 13:f67a6c6013ca | 2211 | void wc_AesEncryptDirect(Aes* aes, byte* out, const byte* in) |
wolfSSL | 13:f67a6c6013ca | 2212 | { |
wolfSSL | 13:f67a6c6013ca | 2213 | byte *key; |
wolfSSL | 13:f67a6c6013ca | 2214 | uint32_t keySize; |
wolfSSL | 13:f67a6c6013ca | 2215 | |
wolfSSL | 13:f67a6c6013ca | 2216 | key = (byte*)aes->key; |
wolfSSL | 13:f67a6c6013ca | 2217 | wc_AesGetKeySize(aes, &keySize); |
wolfSSL | 13:f67a6c6013ca | 2218 | |
wolfSSL | 13:f67a6c6013ca | 2219 | LTC_AES_EncryptEcb(LTC_BASE, in, out, AES_BLOCK_SIZE, |
wolfSSL | 13:f67a6c6013ca | 2220 | key, keySize); |
wolfSSL | 13:f67a6c6013ca | 2221 | } |
wolfSSL | 13:f67a6c6013ca | 2222 | |
wolfSSL | 13:f67a6c6013ca | 2223 | /* Allow direct access to one block decrypt */ |
wolfSSL | 13:f67a6c6013ca | 2224 | void wc_AesDecryptDirect(Aes* aes, byte* out, const byte* in) |
wolfSSL | 13:f67a6c6013ca | 2225 | { |
wolfSSL | 13:f67a6c6013ca | 2226 | byte *key; |
wolfSSL | 13:f67a6c6013ca | 2227 | uint32_t keySize; |
wolfSSL | 13:f67a6c6013ca | 2228 | |
wolfSSL | 13:f67a6c6013ca | 2229 | key = (byte*)aes->key; |
wolfSSL | 13:f67a6c6013ca | 2230 | wc_AesGetKeySize(aes, &keySize); |
wolfSSL | 13:f67a6c6013ca | 2231 | |
wolfSSL | 13:f67a6c6013ca | 2232 | LTC_AES_DecryptEcb(LTC_BASE, in, out, AES_BLOCK_SIZE, |
wolfSSL | 13:f67a6c6013ca | 2233 | key, keySize, kLTC_EncryptKey); |
wolfSSL | 13:f67a6c6013ca | 2234 | } |
wolfSSL | 13:f67a6c6013ca | 2235 | |
wolfSSL | 13:f67a6c6013ca | 2236 | #else |
wolfSSL | 13:f67a6c6013ca | 2237 | /* Allow direct access to one block encrypt */ |
wolfSSL | 13:f67a6c6013ca | 2238 | void wc_AesEncryptDirect(Aes* aes, byte* out, const byte* in) |
wolfSSL | 13:f67a6c6013ca | 2239 | { |
wolfSSL | 13:f67a6c6013ca | 2240 | wc_AesEncrypt(aes, in, out); |
wolfSSL | 13:f67a6c6013ca | 2241 | } |
wolfSSL | 13:f67a6c6013ca | 2242 | #ifdef HAVE_AES_DECRYPT |
wolfSSL | 13:f67a6c6013ca | 2243 | /* Allow direct access to one block decrypt */ |
wolfSSL | 13:f67a6c6013ca | 2244 | void wc_AesDecryptDirect(Aes* aes, byte* out, const byte* in) |
wolfSSL | 13:f67a6c6013ca | 2245 | { |
wolfSSL | 13:f67a6c6013ca | 2246 | wc_AesDecrypt(aes, in, out); |
wolfSSL | 13:f67a6c6013ca | 2247 | } |
wolfSSL | 13:f67a6c6013ca | 2248 | #endif /* HAVE_AES_DECRYPT */ |
wolfSSL | 13:f67a6c6013ca | 2249 | #endif /* AES direct block */ |
wolfSSL | 13:f67a6c6013ca | 2250 | #endif /* WOLFSSL_AES_DIRECT */ |
wolfSSL | 13:f67a6c6013ca | 2251 | |
wolfSSL | 13:f67a6c6013ca | 2252 | |
wolfSSL | 13:f67a6c6013ca | 2253 | /* AES-CBC */ |
wolfSSL | 13:f67a6c6013ca | 2254 | #ifdef HAVE_AES_CBC |
wolfSSL | 13:f67a6c6013ca | 2255 | #if defined(STM32F2_CRYPTO) || defined(STM32F4_CRYPTO) |
wolfSSL | 13:f67a6c6013ca | 2256 | |
wolfSSL | 13:f67a6c6013ca | 2257 | #ifdef WOLFSSL_STM32_CUBEMX |
wolfSSL | 13:f67a6c6013ca | 2258 | int wc_AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz) |
wolfSSL | 13:f67a6c6013ca | 2259 | { |
wolfSSL | 13:f67a6c6013ca | 2260 | int ret = 0; |
wolfSSL | 13:f67a6c6013ca | 2261 | word32 blocks = (sz / AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2262 | CRYP_HandleTypeDef hcryp; |
wolfSSL | 13:f67a6c6013ca | 2263 | |
wolfSSL | 13:f67a6c6013ca | 2264 | XMEMSET(&hcryp, 0, sizeof(CRYP_HandleTypeDef)); |
wolfSSL | 13:f67a6c6013ca | 2265 | switch (aes->rounds) { |
wolfSSL | 13:f67a6c6013ca | 2266 | case 10: /* 128-bit key */ |
wolfSSL | 13:f67a6c6013ca | 2267 | hcryp.Init.KeySize = CRYP_KEYSIZE_128B; |
wolfSSL | 13:f67a6c6013ca | 2268 | break; |
wolfSSL | 13:f67a6c6013ca | 2269 | case 12: /* 192-bit key */ |
wolfSSL | 13:f67a6c6013ca | 2270 | hcryp.Init.KeySize = CRYP_KEYSIZE_192B; |
wolfSSL | 13:f67a6c6013ca | 2271 | break; |
wolfSSL | 13:f67a6c6013ca | 2272 | case 14: /* 256-bit key */ |
wolfSSL | 13:f67a6c6013ca | 2273 | hcryp.Init.KeySize = CRYP_KEYSIZE_256B; |
wolfSSL | 13:f67a6c6013ca | 2274 | break; |
wolfSSL | 13:f67a6c6013ca | 2275 | default: |
wolfSSL | 13:f67a6c6013ca | 2276 | break; |
wolfSSL | 13:f67a6c6013ca | 2277 | } |
wolfSSL | 13:f67a6c6013ca | 2278 | hcryp.Instance = CRYP; |
wolfSSL | 13:f67a6c6013ca | 2279 | hcryp.Init.DataType = CRYP_DATATYPE_8B; |
wolfSSL | 13:f67a6c6013ca | 2280 | hcryp.Init.pKey = (uint8_t*)aes->key; |
wolfSSL | 13:f67a6c6013ca | 2281 | hcryp.Init.pInitVect = (uint8_t*)aes->reg; |
wolfSSL | 13:f67a6c6013ca | 2282 | |
wolfSSL | 13:f67a6c6013ca | 2283 | HAL_CRYP_Init(&hcryp); |
wolfSSL | 13:f67a6c6013ca | 2284 | |
wolfSSL | 13:f67a6c6013ca | 2285 | while (blocks--) { |
wolfSSL | 13:f67a6c6013ca | 2286 | if (HAL_CRYP_AESCBC_Encrypt(&hcryp, (uint8_t*)in, AES_BLOCK_SIZE, |
wolfSSL | 13:f67a6c6013ca | 2287 | out, STM32_HAL_TIMEOUT) != HAL_OK) { |
wolfSSL | 13:f67a6c6013ca | 2288 | ret = WC_TIMEOUT_E; |
wolfSSL | 13:f67a6c6013ca | 2289 | break; |
wolfSSL | 13:f67a6c6013ca | 2290 | } |
wolfSSL | 13:f67a6c6013ca | 2291 | |
wolfSSL | 13:f67a6c6013ca | 2292 | /* store iv for next call */ |
wolfSSL | 13:f67a6c6013ca | 2293 | XMEMCPY(aes->reg, out + sz - AES_BLOCK_SIZE, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2294 | |
wolfSSL | 13:f67a6c6013ca | 2295 | sz -= AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 2296 | in += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 2297 | out += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 2298 | } |
wolfSSL | 13:f67a6c6013ca | 2299 | |
wolfSSL | 13:f67a6c6013ca | 2300 | HAL_CRYP_DeInit(&hcryp); |
wolfSSL | 13:f67a6c6013ca | 2301 | |
wolfSSL | 13:f67a6c6013ca | 2302 | return ret; |
wolfSSL | 13:f67a6c6013ca | 2303 | } |
wolfSSL | 13:f67a6c6013ca | 2304 | #ifdef HAVE_AES_DECRYPT |
wolfSSL | 13:f67a6c6013ca | 2305 | int wc_AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz) |
wolfSSL | 13:f67a6c6013ca | 2306 | { |
wolfSSL | 13:f67a6c6013ca | 2307 | int ret = 0; |
wolfSSL | 13:f67a6c6013ca | 2308 | word32 blocks = (sz / AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2309 | CRYP_HandleTypeDef hcryp; |
wolfSSL | 13:f67a6c6013ca | 2310 | |
wolfSSL | 13:f67a6c6013ca | 2311 | XMEMSET(&hcryp, 0, sizeof(CRYP_HandleTypeDef)); |
wolfSSL | 13:f67a6c6013ca | 2312 | switch (aes->rounds) { |
wolfSSL | 13:f67a6c6013ca | 2313 | case 10: /* 128-bit key */ |
wolfSSL | 13:f67a6c6013ca | 2314 | hcryp.Init.KeySize = CRYP_KEYSIZE_128B; |
wolfSSL | 13:f67a6c6013ca | 2315 | break; |
wolfSSL | 13:f67a6c6013ca | 2316 | case 12: /* 192-bit key */ |
wolfSSL | 13:f67a6c6013ca | 2317 | hcryp.Init.KeySize = CRYP_KEYSIZE_192B; |
wolfSSL | 13:f67a6c6013ca | 2318 | break; |
wolfSSL | 13:f67a6c6013ca | 2319 | case 14: /* 256-bit key */ |
wolfSSL | 13:f67a6c6013ca | 2320 | hcryp.Init.KeySize = CRYP_KEYSIZE_256B; |
wolfSSL | 13:f67a6c6013ca | 2321 | break; |
wolfSSL | 13:f67a6c6013ca | 2322 | default: |
wolfSSL | 13:f67a6c6013ca | 2323 | break; |
wolfSSL | 13:f67a6c6013ca | 2324 | } |
wolfSSL | 13:f67a6c6013ca | 2325 | hcryp.Instance = CRYP; |
wolfSSL | 13:f67a6c6013ca | 2326 | hcryp.Init.DataType = CRYP_DATATYPE_8B; |
wolfSSL | 13:f67a6c6013ca | 2327 | hcryp.Init.pKey = (uint8_t*)aes->key; |
wolfSSL | 13:f67a6c6013ca | 2328 | hcryp.Init.pInitVect = (uint8_t*)aes->reg; |
wolfSSL | 13:f67a6c6013ca | 2329 | |
wolfSSL | 13:f67a6c6013ca | 2330 | HAL_CRYP_Init(&hcryp); |
wolfSSL | 13:f67a6c6013ca | 2331 | |
wolfSSL | 13:f67a6c6013ca | 2332 | while (blocks--) { |
wolfSSL | 13:f67a6c6013ca | 2333 | if (HAL_CRYP_AESCBC_Decrypt(&hcryp, (uint8_t*)in, AES_BLOCK_SIZE, |
wolfSSL | 13:f67a6c6013ca | 2334 | out, STM32_HAL_TIMEOUT) != HAL_OK) { |
wolfSSL | 13:f67a6c6013ca | 2335 | ret = WC_TIMEOUT_E; |
wolfSSL | 13:f67a6c6013ca | 2336 | } |
wolfSSL | 13:f67a6c6013ca | 2337 | |
wolfSSL | 13:f67a6c6013ca | 2338 | /* store iv for next call */ |
wolfSSL | 13:f67a6c6013ca | 2339 | XMEMCPY(aes->reg, aes->tmp, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2340 | |
wolfSSL | 13:f67a6c6013ca | 2341 | in += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 2342 | out += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 2343 | } |
wolfSSL | 13:f67a6c6013ca | 2344 | |
wolfSSL | 13:f67a6c6013ca | 2345 | HAL_CRYP_DeInit(&hcryp); |
wolfSSL | 13:f67a6c6013ca | 2346 | |
wolfSSL | 13:f67a6c6013ca | 2347 | return ret; |
wolfSSL | 13:f67a6c6013ca | 2348 | } |
wolfSSL | 13:f67a6c6013ca | 2349 | #endif /* HAVE_AES_DECRYPT */ |
wolfSSL | 13:f67a6c6013ca | 2350 | #else |
wolfSSL | 13:f67a6c6013ca | 2351 | int wc_AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz) |
wolfSSL | 13:f67a6c6013ca | 2352 | { |
wolfSSL | 13:f67a6c6013ca | 2353 | word32 *enc_key, *iv; |
wolfSSL | 13:f67a6c6013ca | 2354 | word32 blocks = (sz / AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2355 | CRYP_InitTypeDef AES_CRYP_InitStructure; |
wolfSSL | 13:f67a6c6013ca | 2356 | CRYP_KeyInitTypeDef AES_CRYP_KeyInitStructure; |
wolfSSL | 13:f67a6c6013ca | 2357 | CRYP_IVInitTypeDef AES_CRYP_IVInitStructure; |
wolfSSL | 13:f67a6c6013ca | 2358 | |
wolfSSL | 13:f67a6c6013ca | 2359 | enc_key = aes->key; |
wolfSSL | 13:f67a6c6013ca | 2360 | iv = aes->reg; |
wolfSSL | 13:f67a6c6013ca | 2361 | |
wolfSSL | 13:f67a6c6013ca | 2362 | /* crypto structure initialization */ |
wolfSSL | 13:f67a6c6013ca | 2363 | CRYP_KeyStructInit(&AES_CRYP_KeyInitStructure); |
wolfSSL | 13:f67a6c6013ca | 2364 | CRYP_StructInit(&AES_CRYP_InitStructure); |
wolfSSL | 13:f67a6c6013ca | 2365 | CRYP_IVStructInit(&AES_CRYP_IVInitStructure); |
wolfSSL | 13:f67a6c6013ca | 2366 | |
wolfSSL | 13:f67a6c6013ca | 2367 | /* reset registers to their default values */ |
wolfSSL | 13:f67a6c6013ca | 2368 | CRYP_DeInit(); |
wolfSSL | 13:f67a6c6013ca | 2369 | |
wolfSSL | 13:f67a6c6013ca | 2370 | /* load key into correct registers */ |
wolfSSL | 13:f67a6c6013ca | 2371 | switch (aes->rounds) { |
wolfSSL | 13:f67a6c6013ca | 2372 | case 10: /* 128-bit key */ |
wolfSSL | 13:f67a6c6013ca | 2373 | AES_CRYP_InitStructure.CRYP_KeySize = CRYP_KeySize_128b; |
wolfSSL | 13:f67a6c6013ca | 2374 | AES_CRYP_KeyInitStructure.CRYP_Key2Left = enc_key[0]; |
wolfSSL | 13:f67a6c6013ca | 2375 | AES_CRYP_KeyInitStructure.CRYP_Key2Right = enc_key[1]; |
wolfSSL | 13:f67a6c6013ca | 2376 | AES_CRYP_KeyInitStructure.CRYP_Key3Left = enc_key[2]; |
wolfSSL | 13:f67a6c6013ca | 2377 | AES_CRYP_KeyInitStructure.CRYP_Key3Right = enc_key[3]; |
wolfSSL | 13:f67a6c6013ca | 2378 | break; |
wolfSSL | 13:f67a6c6013ca | 2379 | |
wolfSSL | 13:f67a6c6013ca | 2380 | case 12: /* 192-bit key */ |
wolfSSL | 13:f67a6c6013ca | 2381 | AES_CRYP_InitStructure.CRYP_KeySize = CRYP_KeySize_192b; |
wolfSSL | 13:f67a6c6013ca | 2382 | AES_CRYP_KeyInitStructure.CRYP_Key1Left = enc_key[0]; |
wolfSSL | 13:f67a6c6013ca | 2383 | AES_CRYP_KeyInitStructure.CRYP_Key1Right = enc_key[1]; |
wolfSSL | 13:f67a6c6013ca | 2384 | AES_CRYP_KeyInitStructure.CRYP_Key2Left = enc_key[2]; |
wolfSSL | 13:f67a6c6013ca | 2385 | AES_CRYP_KeyInitStructure.CRYP_Key2Right = enc_key[3]; |
wolfSSL | 13:f67a6c6013ca | 2386 | AES_CRYP_KeyInitStructure.CRYP_Key3Left = enc_key[4]; |
wolfSSL | 13:f67a6c6013ca | 2387 | AES_CRYP_KeyInitStructure.CRYP_Key3Right = enc_key[5]; |
wolfSSL | 13:f67a6c6013ca | 2388 | break; |
wolfSSL | 13:f67a6c6013ca | 2389 | |
wolfSSL | 13:f67a6c6013ca | 2390 | case 14: /* 256-bit key */ |
wolfSSL | 13:f67a6c6013ca | 2391 | AES_CRYP_InitStructure.CRYP_KeySize = CRYP_KeySize_256b; |
wolfSSL | 13:f67a6c6013ca | 2392 | AES_CRYP_KeyInitStructure.CRYP_Key0Left = enc_key[0]; |
wolfSSL | 13:f67a6c6013ca | 2393 | AES_CRYP_KeyInitStructure.CRYP_Key0Right = enc_key[1]; |
wolfSSL | 13:f67a6c6013ca | 2394 | AES_CRYP_KeyInitStructure.CRYP_Key1Left = enc_key[2]; |
wolfSSL | 13:f67a6c6013ca | 2395 | AES_CRYP_KeyInitStructure.CRYP_Key1Right = enc_key[3]; |
wolfSSL | 13:f67a6c6013ca | 2396 | AES_CRYP_KeyInitStructure.CRYP_Key2Left = enc_key[4]; |
wolfSSL | 13:f67a6c6013ca | 2397 | AES_CRYP_KeyInitStructure.CRYP_Key2Right = enc_key[5]; |
wolfSSL | 13:f67a6c6013ca | 2398 | AES_CRYP_KeyInitStructure.CRYP_Key3Left = enc_key[6]; |
wolfSSL | 13:f67a6c6013ca | 2399 | AES_CRYP_KeyInitStructure.CRYP_Key3Right = enc_key[7]; |
wolfSSL | 13:f67a6c6013ca | 2400 | break; |
wolfSSL | 13:f67a6c6013ca | 2401 | |
wolfSSL | 13:f67a6c6013ca | 2402 | default: |
wolfSSL | 13:f67a6c6013ca | 2403 | break; |
wolfSSL | 13:f67a6c6013ca | 2404 | } |
wolfSSL | 13:f67a6c6013ca | 2405 | CRYP_KeyInit(&AES_CRYP_KeyInitStructure); |
wolfSSL | 13:f67a6c6013ca | 2406 | |
wolfSSL | 13:f67a6c6013ca | 2407 | /* set iv */ |
wolfSSL | 13:f67a6c6013ca | 2408 | ByteReverseWords(iv, iv, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2409 | AES_CRYP_IVInitStructure.CRYP_IV0Left = iv[0]; |
wolfSSL | 13:f67a6c6013ca | 2410 | AES_CRYP_IVInitStructure.CRYP_IV0Right = iv[1]; |
wolfSSL | 13:f67a6c6013ca | 2411 | AES_CRYP_IVInitStructure.CRYP_IV1Left = iv[2]; |
wolfSSL | 13:f67a6c6013ca | 2412 | AES_CRYP_IVInitStructure.CRYP_IV1Right = iv[3]; |
wolfSSL | 13:f67a6c6013ca | 2413 | CRYP_IVInit(&AES_CRYP_IVInitStructure); |
wolfSSL | 13:f67a6c6013ca | 2414 | |
wolfSSL | 13:f67a6c6013ca | 2415 | /* set direction, mode, and datatype */ |
wolfSSL | 13:f67a6c6013ca | 2416 | AES_CRYP_InitStructure.CRYP_AlgoDir = CRYP_AlgoDir_Encrypt; |
wolfSSL | 13:f67a6c6013ca | 2417 | AES_CRYP_InitStructure.CRYP_AlgoMode = CRYP_AlgoMode_AES_CBC; |
wolfSSL | 13:f67a6c6013ca | 2418 | AES_CRYP_InitStructure.CRYP_DataType = CRYP_DataType_8b; |
wolfSSL | 13:f67a6c6013ca | 2419 | CRYP_Init(&AES_CRYP_InitStructure); |
wolfSSL | 13:f67a6c6013ca | 2420 | |
wolfSSL | 13:f67a6c6013ca | 2421 | /* enable crypto processor */ |
wolfSSL | 13:f67a6c6013ca | 2422 | CRYP_Cmd(ENABLE); |
wolfSSL | 13:f67a6c6013ca | 2423 | |
wolfSSL | 13:f67a6c6013ca | 2424 | while (blocks--) { |
wolfSSL | 13:f67a6c6013ca | 2425 | /* flush IN/OUT FIFOs */ |
wolfSSL | 13:f67a6c6013ca | 2426 | CRYP_FIFOFlush(); |
wolfSSL | 13:f67a6c6013ca | 2427 | |
wolfSSL | 13:f67a6c6013ca | 2428 | CRYP_DataIn(*(uint32_t*)&in[0]); |
wolfSSL | 13:f67a6c6013ca | 2429 | CRYP_DataIn(*(uint32_t*)&in[4]); |
wolfSSL | 13:f67a6c6013ca | 2430 | CRYP_DataIn(*(uint32_t*)&in[8]); |
wolfSSL | 13:f67a6c6013ca | 2431 | CRYP_DataIn(*(uint32_t*)&in[12]); |
wolfSSL | 13:f67a6c6013ca | 2432 | |
wolfSSL | 13:f67a6c6013ca | 2433 | /* wait until the complete message has been processed */ |
wolfSSL | 13:f67a6c6013ca | 2434 | while (CRYP_GetFlagStatus(CRYP_FLAG_BUSY) != RESET) {} |
wolfSSL | 13:f67a6c6013ca | 2435 | |
wolfSSL | 13:f67a6c6013ca | 2436 | *(uint32_t*)&out[0] = CRYP_DataOut(); |
wolfSSL | 13:f67a6c6013ca | 2437 | *(uint32_t*)&out[4] = CRYP_DataOut(); |
wolfSSL | 13:f67a6c6013ca | 2438 | *(uint32_t*)&out[8] = CRYP_DataOut(); |
wolfSSL | 13:f67a6c6013ca | 2439 | *(uint32_t*)&out[12] = CRYP_DataOut(); |
wolfSSL | 13:f67a6c6013ca | 2440 | |
wolfSSL | 13:f67a6c6013ca | 2441 | /* store iv for next call */ |
wolfSSL | 13:f67a6c6013ca | 2442 | XMEMCPY(aes->reg, out + sz - AES_BLOCK_SIZE, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2443 | |
wolfSSL | 13:f67a6c6013ca | 2444 | sz -= AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 2445 | in += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 2446 | out += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 2447 | } |
wolfSSL | 13:f67a6c6013ca | 2448 | |
wolfSSL | 13:f67a6c6013ca | 2449 | /* disable crypto processor */ |
wolfSSL | 13:f67a6c6013ca | 2450 | CRYP_Cmd(DISABLE); |
wolfSSL | 13:f67a6c6013ca | 2451 | |
wolfSSL | 13:f67a6c6013ca | 2452 | return 0; |
wolfSSL | 13:f67a6c6013ca | 2453 | } |
wolfSSL | 13:f67a6c6013ca | 2454 | |
wolfSSL | 13:f67a6c6013ca | 2455 | #ifdef HAVE_AES_DECRYPT |
wolfSSL | 13:f67a6c6013ca | 2456 | int wc_AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz) |
wolfSSL | 13:f67a6c6013ca | 2457 | { |
wolfSSL | 13:f67a6c6013ca | 2458 | word32 *dec_key, *iv; |
wolfSSL | 13:f67a6c6013ca | 2459 | word32 blocks = (sz / AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2460 | CRYP_InitTypeDef AES_CRYP_InitStructure; |
wolfSSL | 13:f67a6c6013ca | 2461 | CRYP_KeyInitTypeDef AES_CRYP_KeyInitStructure; |
wolfSSL | 13:f67a6c6013ca | 2462 | CRYP_IVInitTypeDef AES_CRYP_IVInitStructure; |
wolfSSL | 13:f67a6c6013ca | 2463 | |
wolfSSL | 13:f67a6c6013ca | 2464 | dec_key = aes->key; |
wolfSSL | 13:f67a6c6013ca | 2465 | iv = aes->reg; |
wolfSSL | 13:f67a6c6013ca | 2466 | |
wolfSSL | 13:f67a6c6013ca | 2467 | /* crypto structure initialization */ |
wolfSSL | 13:f67a6c6013ca | 2468 | CRYP_KeyStructInit(&AES_CRYP_KeyInitStructure); |
wolfSSL | 13:f67a6c6013ca | 2469 | CRYP_StructInit(&AES_CRYP_InitStructure); |
wolfSSL | 13:f67a6c6013ca | 2470 | CRYP_IVStructInit(&AES_CRYP_IVInitStructure); |
wolfSSL | 13:f67a6c6013ca | 2471 | |
wolfSSL | 13:f67a6c6013ca | 2472 | /* if input and output same will overwrite input iv */ |
wolfSSL | 13:f67a6c6013ca | 2473 | XMEMCPY(aes->tmp, in + sz - AES_BLOCK_SIZE, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2474 | |
wolfSSL | 13:f67a6c6013ca | 2475 | /* reset registers to their default values */ |
wolfSSL | 13:f67a6c6013ca | 2476 | CRYP_DeInit(); |
wolfSSL | 13:f67a6c6013ca | 2477 | |
wolfSSL | 13:f67a6c6013ca | 2478 | /* load key into correct registers */ |
wolfSSL | 13:f67a6c6013ca | 2479 | switch (aes->rounds) { |
wolfSSL | 13:f67a6c6013ca | 2480 | case 10: /* 128-bit key */ |
wolfSSL | 13:f67a6c6013ca | 2481 | AES_CRYP_InitStructure.CRYP_KeySize = CRYP_KeySize_128b; |
wolfSSL | 13:f67a6c6013ca | 2482 | AES_CRYP_KeyInitStructure.CRYP_Key2Left = dec_key[0]; |
wolfSSL | 13:f67a6c6013ca | 2483 | AES_CRYP_KeyInitStructure.CRYP_Key2Right = dec_key[1]; |
wolfSSL | 13:f67a6c6013ca | 2484 | AES_CRYP_KeyInitStructure.CRYP_Key3Left = dec_key[2]; |
wolfSSL | 13:f67a6c6013ca | 2485 | AES_CRYP_KeyInitStructure.CRYP_Key3Right = dec_key[3]; |
wolfSSL | 13:f67a6c6013ca | 2486 | break; |
wolfSSL | 13:f67a6c6013ca | 2487 | |
wolfSSL | 13:f67a6c6013ca | 2488 | case 12: /* 192-bit key */ |
wolfSSL | 13:f67a6c6013ca | 2489 | AES_CRYP_InitStructure.CRYP_KeySize = CRYP_KeySize_192b; |
wolfSSL | 13:f67a6c6013ca | 2490 | AES_CRYP_KeyInitStructure.CRYP_Key1Left = dec_key[0]; |
wolfSSL | 13:f67a6c6013ca | 2491 | AES_CRYP_KeyInitStructure.CRYP_Key1Right = dec_key[1]; |
wolfSSL | 13:f67a6c6013ca | 2492 | AES_CRYP_KeyInitStructure.CRYP_Key2Left = dec_key[2]; |
wolfSSL | 13:f67a6c6013ca | 2493 | AES_CRYP_KeyInitStructure.CRYP_Key2Right = dec_key[3]; |
wolfSSL | 13:f67a6c6013ca | 2494 | AES_CRYP_KeyInitStructure.CRYP_Key3Left = dec_key[4]; |
wolfSSL | 13:f67a6c6013ca | 2495 | AES_CRYP_KeyInitStructure.CRYP_Key3Right = dec_key[5]; |
wolfSSL | 13:f67a6c6013ca | 2496 | break; |
wolfSSL | 13:f67a6c6013ca | 2497 | |
wolfSSL | 13:f67a6c6013ca | 2498 | case 14: /* 256-bit key */ |
wolfSSL | 13:f67a6c6013ca | 2499 | AES_CRYP_InitStructure.CRYP_KeySize = CRYP_KeySize_256b; |
wolfSSL | 13:f67a6c6013ca | 2500 | AES_CRYP_KeyInitStructure.CRYP_Key0Left = dec_key[0]; |
wolfSSL | 13:f67a6c6013ca | 2501 | AES_CRYP_KeyInitStructure.CRYP_Key0Right = dec_key[1]; |
wolfSSL | 13:f67a6c6013ca | 2502 | AES_CRYP_KeyInitStructure.CRYP_Key1Left = dec_key[2]; |
wolfSSL | 13:f67a6c6013ca | 2503 | AES_CRYP_KeyInitStructure.CRYP_Key1Right = dec_key[3]; |
wolfSSL | 13:f67a6c6013ca | 2504 | AES_CRYP_KeyInitStructure.CRYP_Key2Left = dec_key[4]; |
wolfSSL | 13:f67a6c6013ca | 2505 | AES_CRYP_KeyInitStructure.CRYP_Key2Right = dec_key[5]; |
wolfSSL | 13:f67a6c6013ca | 2506 | AES_CRYP_KeyInitStructure.CRYP_Key3Left = dec_key[6]; |
wolfSSL | 13:f67a6c6013ca | 2507 | AES_CRYP_KeyInitStructure.CRYP_Key3Right = dec_key[7]; |
wolfSSL | 13:f67a6c6013ca | 2508 | break; |
wolfSSL | 13:f67a6c6013ca | 2509 | |
wolfSSL | 13:f67a6c6013ca | 2510 | default: |
wolfSSL | 13:f67a6c6013ca | 2511 | break; |
wolfSSL | 13:f67a6c6013ca | 2512 | } |
wolfSSL | 13:f67a6c6013ca | 2513 | |
wolfSSL | 13:f67a6c6013ca | 2514 | /* set direction, mode, and datatype for key preparation */ |
wolfSSL | 13:f67a6c6013ca | 2515 | AES_CRYP_InitStructure.CRYP_AlgoDir = CRYP_AlgoDir_Decrypt; |
wolfSSL | 13:f67a6c6013ca | 2516 | AES_CRYP_InitStructure.CRYP_AlgoMode = CRYP_AlgoMode_AES_Key; |
wolfSSL | 13:f67a6c6013ca | 2517 | AES_CRYP_InitStructure.CRYP_DataType = CRYP_DataType_32b; |
wolfSSL | 13:f67a6c6013ca | 2518 | CRYP_Init(&AES_CRYP_InitStructure); |
wolfSSL | 13:f67a6c6013ca | 2519 | CRYP_KeyInit(&AES_CRYP_KeyInitStructure); |
wolfSSL | 13:f67a6c6013ca | 2520 | |
wolfSSL | 13:f67a6c6013ca | 2521 | /* enable crypto processor */ |
wolfSSL | 13:f67a6c6013ca | 2522 | CRYP_Cmd(ENABLE); |
wolfSSL | 13:f67a6c6013ca | 2523 | |
wolfSSL | 13:f67a6c6013ca | 2524 | /* wait until key has been prepared */ |
wolfSSL | 13:f67a6c6013ca | 2525 | while (CRYP_GetFlagStatus(CRYP_FLAG_BUSY) != RESET) {} |
wolfSSL | 13:f67a6c6013ca | 2526 | |
wolfSSL | 13:f67a6c6013ca | 2527 | /* set direction, mode, and datatype for decryption */ |
wolfSSL | 13:f67a6c6013ca | 2528 | AES_CRYP_InitStructure.CRYP_AlgoDir = CRYP_AlgoDir_Decrypt; |
wolfSSL | 13:f67a6c6013ca | 2529 | AES_CRYP_InitStructure.CRYP_AlgoMode = CRYP_AlgoMode_AES_CBC; |
wolfSSL | 13:f67a6c6013ca | 2530 | AES_CRYP_InitStructure.CRYP_DataType = CRYP_DataType_8b; |
wolfSSL | 13:f67a6c6013ca | 2531 | CRYP_Init(&AES_CRYP_InitStructure); |
wolfSSL | 13:f67a6c6013ca | 2532 | |
wolfSSL | 13:f67a6c6013ca | 2533 | /* set iv */ |
wolfSSL | 13:f67a6c6013ca | 2534 | ByteReverseWords(iv, iv, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2535 | |
wolfSSL | 13:f67a6c6013ca | 2536 | AES_CRYP_IVInitStructure.CRYP_IV0Left = iv[0]; |
wolfSSL | 13:f67a6c6013ca | 2537 | AES_CRYP_IVInitStructure.CRYP_IV0Right = iv[1]; |
wolfSSL | 13:f67a6c6013ca | 2538 | AES_CRYP_IVInitStructure.CRYP_IV1Left = iv[2]; |
wolfSSL | 13:f67a6c6013ca | 2539 | AES_CRYP_IVInitStructure.CRYP_IV1Right = iv[3]; |
wolfSSL | 13:f67a6c6013ca | 2540 | CRYP_IVInit(&AES_CRYP_IVInitStructure); |
wolfSSL | 13:f67a6c6013ca | 2541 | |
wolfSSL | 13:f67a6c6013ca | 2542 | /* enable crypto processor */ |
wolfSSL | 13:f67a6c6013ca | 2543 | CRYP_Cmd(ENABLE); |
wolfSSL | 13:f67a6c6013ca | 2544 | |
wolfSSL | 13:f67a6c6013ca | 2545 | while (blocks--) { |
wolfSSL | 13:f67a6c6013ca | 2546 | /* flush IN/OUT FIFOs */ |
wolfSSL | 13:f67a6c6013ca | 2547 | CRYP_FIFOFlush(); |
wolfSSL | 13:f67a6c6013ca | 2548 | |
wolfSSL | 13:f67a6c6013ca | 2549 | CRYP_DataIn(*(uint32_t*)&in[0]); |
wolfSSL | 13:f67a6c6013ca | 2550 | CRYP_DataIn(*(uint32_t*)&in[4]); |
wolfSSL | 13:f67a6c6013ca | 2551 | CRYP_DataIn(*(uint32_t*)&in[8]); |
wolfSSL | 13:f67a6c6013ca | 2552 | CRYP_DataIn(*(uint32_t*)&in[12]); |
wolfSSL | 13:f67a6c6013ca | 2553 | |
wolfSSL | 13:f67a6c6013ca | 2554 | /* wait until the complete message has been processed */ |
wolfSSL | 13:f67a6c6013ca | 2555 | while (CRYP_GetFlagStatus(CRYP_FLAG_BUSY) != RESET) {} |
wolfSSL | 13:f67a6c6013ca | 2556 | |
wolfSSL | 13:f67a6c6013ca | 2557 | *(uint32_t*)&out[0] = CRYP_DataOut(); |
wolfSSL | 13:f67a6c6013ca | 2558 | *(uint32_t*)&out[4] = CRYP_DataOut(); |
wolfSSL | 13:f67a6c6013ca | 2559 | *(uint32_t*)&out[8] = CRYP_DataOut(); |
wolfSSL | 13:f67a6c6013ca | 2560 | *(uint32_t*)&out[12] = CRYP_DataOut(); |
wolfSSL | 13:f67a6c6013ca | 2561 | |
wolfSSL | 13:f67a6c6013ca | 2562 | /* store iv for next call */ |
wolfSSL | 13:f67a6c6013ca | 2563 | XMEMCPY(aes->reg, aes->tmp, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2564 | |
wolfSSL | 13:f67a6c6013ca | 2565 | in += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 2566 | out += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 2567 | } |
wolfSSL | 13:f67a6c6013ca | 2568 | |
wolfSSL | 13:f67a6c6013ca | 2569 | /* disable crypto processor */ |
wolfSSL | 13:f67a6c6013ca | 2570 | CRYP_Cmd(DISABLE); |
wolfSSL | 13:f67a6c6013ca | 2571 | |
wolfSSL | 13:f67a6c6013ca | 2572 | return 0; |
wolfSSL | 13:f67a6c6013ca | 2573 | } |
wolfSSL | 13:f67a6c6013ca | 2574 | #endif /* HAVE_AES_DECRYPT */ |
wolfSSL | 13:f67a6c6013ca | 2575 | #endif /* WOLFSSL_STM32_CUBEMX */ |
wolfSSL | 13:f67a6c6013ca | 2576 | |
wolfSSL | 13:f67a6c6013ca | 2577 | #elif defined(HAVE_COLDFIRE_SEC) |
wolfSSL | 13:f67a6c6013ca | 2578 | static int wc_AesCbcCrypt(Aes* aes, byte* po, const byte* pi, word32 sz, |
wolfSSL | 13:f67a6c6013ca | 2579 | word32 descHeader) |
wolfSSL | 13:f67a6c6013ca | 2580 | { |
wolfSSL | 13:f67a6c6013ca | 2581 | #ifdef DEBUG_WOLFSSL |
wolfSSL | 13:f67a6c6013ca | 2582 | int i; int stat1, stat2; int ret; |
wolfSSL | 13:f67a6c6013ca | 2583 | #endif |
wolfSSL | 13:f67a6c6013ca | 2584 | |
wolfSSL | 13:f67a6c6013ca | 2585 | int size; |
wolfSSL | 13:f67a6c6013ca | 2586 | volatile int v; |
wolfSSL | 13:f67a6c6013ca | 2587 | |
wolfSSL | 13:f67a6c6013ca | 2588 | if ((pi == NULL) || (po == NULL)) |
wolfSSL | 13:f67a6c6013ca | 2589 | return BAD_FUNC_ARG; /*wrong pointer*/ |
wolfSSL | 13:f67a6c6013ca | 2590 | |
wolfSSL | 13:f67a6c6013ca | 2591 | wc_LockMutex(&Mutex_AesSEC); |
wolfSSL | 13:f67a6c6013ca | 2592 | |
wolfSSL | 13:f67a6c6013ca | 2593 | /* Set descriptor for SEC */ |
wolfSSL | 13:f67a6c6013ca | 2594 | secDesc->length1 = 0x0; |
wolfSSL | 13:f67a6c6013ca | 2595 | secDesc->pointer1 = NULL; |
wolfSSL | 13:f67a6c6013ca | 2596 | |
wolfSSL | 13:f67a6c6013ca | 2597 | secDesc->length2 = AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 2598 | secDesc->pointer2 = (byte *)secReg; /* Initial Vector */ |
wolfSSL | 13:f67a6c6013ca | 2599 | |
wolfSSL | 13:f67a6c6013ca | 2600 | switch(aes->rounds) { |
wolfSSL | 13:f67a6c6013ca | 2601 | case 10: secDesc->length3 = 16; break; |
wolfSSL | 13:f67a6c6013ca | 2602 | case 12: secDesc->length3 = 24; break; |
wolfSSL | 13:f67a6c6013ca | 2603 | case 14: secDesc->length3 = 32; break; |
wolfSSL | 13:f67a6c6013ca | 2604 | } |
wolfSSL | 13:f67a6c6013ca | 2605 | XMEMCPY(secKey, aes->key, secDesc->length3); |
wolfSSL | 13:f67a6c6013ca | 2606 | |
wolfSSL | 13:f67a6c6013ca | 2607 | secDesc->pointer3 = (byte *)secKey; |
wolfSSL | 13:f67a6c6013ca | 2608 | secDesc->pointer4 = AESBuffIn; |
wolfSSL | 13:f67a6c6013ca | 2609 | secDesc->pointer5 = AESBuffOut; |
wolfSSL | 13:f67a6c6013ca | 2610 | secDesc->length6 = 0x0; |
wolfSSL | 13:f67a6c6013ca | 2611 | secDesc->pointer6 = NULL; |
wolfSSL | 13:f67a6c6013ca | 2612 | secDesc->length7 = 0x0; |
wolfSSL | 13:f67a6c6013ca | 2613 | secDesc->pointer7 = NULL; |
wolfSSL | 13:f67a6c6013ca | 2614 | secDesc->nextDescriptorPtr = NULL; |
wolfSSL | 13:f67a6c6013ca | 2615 | |
wolfSSL | 13:f67a6c6013ca | 2616 | while (sz) { |
wolfSSL | 13:f67a6c6013ca | 2617 | secDesc->header = descHeader; |
wolfSSL | 13:f67a6c6013ca | 2618 | XMEMCPY(secReg, aes->reg, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2619 | if ((sz % AES_BUFFER_SIZE) == sz) { |
wolfSSL | 13:f67a6c6013ca | 2620 | size = sz; |
wolfSSL | 13:f67a6c6013ca | 2621 | sz = 0; |
wolfSSL | 13:f67a6c6013ca | 2622 | } else { |
wolfSSL | 13:f67a6c6013ca | 2623 | size = AES_BUFFER_SIZE; |
wolfSSL | 13:f67a6c6013ca | 2624 | sz -= AES_BUFFER_SIZE; |
wolfSSL | 13:f67a6c6013ca | 2625 | } |
wolfSSL | 13:f67a6c6013ca | 2626 | secDesc->length4 = size; |
wolfSSL | 13:f67a6c6013ca | 2627 | secDesc->length5 = size; |
wolfSSL | 13:f67a6c6013ca | 2628 | |
wolfSSL | 13:f67a6c6013ca | 2629 | XMEMCPY(AESBuffIn, pi, size); |
wolfSSL | 13:f67a6c6013ca | 2630 | if(descHeader == SEC_DESC_AES_CBC_DECRYPT) { |
wolfSSL | 13:f67a6c6013ca | 2631 | XMEMCPY((void*)aes->tmp, (void*)&(pi[size-AES_BLOCK_SIZE]), |
wolfSSL | 13:f67a6c6013ca | 2632 | AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2633 | } |
wolfSSL | 13:f67a6c6013ca | 2634 | |
wolfSSL | 13:f67a6c6013ca | 2635 | /* Point SEC to the location of the descriptor */ |
wolfSSL | 13:f67a6c6013ca | 2636 | MCF_SEC_FR0 = (uint32)secDesc; |
wolfSSL | 13:f67a6c6013ca | 2637 | /* Initialize SEC and wait for encryption to complete */ |
wolfSSL | 13:f67a6c6013ca | 2638 | MCF_SEC_CCCR0 = 0x0000001a; |
wolfSSL | 13:f67a6c6013ca | 2639 | /* poll SISR to determine when channel is complete */ |
wolfSSL | 13:f67a6c6013ca | 2640 | v=0; |
wolfSSL | 13:f67a6c6013ca | 2641 | |
wolfSSL | 13:f67a6c6013ca | 2642 | while ((secDesc->header>> 24) != 0xff) v++; |
wolfSSL | 13:f67a6c6013ca | 2643 | |
wolfSSL | 13:f67a6c6013ca | 2644 | #ifdef DEBUG_WOLFSSL |
wolfSSL | 13:f67a6c6013ca | 2645 | ret = MCF_SEC_SISRH; |
wolfSSL | 13:f67a6c6013ca | 2646 | stat1 = MCF_SEC_AESSR; |
wolfSSL | 13:f67a6c6013ca | 2647 | stat2 = MCF_SEC_AESISR; |
wolfSSL | 13:f67a6c6013ca | 2648 | if (ret & 0xe0000000) { |
wolfSSL | 13:f67a6c6013ca | 2649 | db_printf("Aes_Cbc(i=%d):ISRH=%08x, AESSR=%08x, " |
wolfSSL | 13:f67a6c6013ca | 2650 | "AESISR=%08x\n", i, ret, stat1, stat2); |
wolfSSL | 13:f67a6c6013ca | 2651 | } |
wolfSSL | 13:f67a6c6013ca | 2652 | #endif |
wolfSSL | 13:f67a6c6013ca | 2653 | |
wolfSSL | 13:f67a6c6013ca | 2654 | XMEMCPY(po, AESBuffOut, size); |
wolfSSL | 13:f67a6c6013ca | 2655 | |
wolfSSL | 13:f67a6c6013ca | 2656 | if (descHeader == SEC_DESC_AES_CBC_ENCRYPT) { |
wolfSSL | 13:f67a6c6013ca | 2657 | XMEMCPY((void*)aes->reg, (void*)&(po[size-AES_BLOCK_SIZE]), |
wolfSSL | 13:f67a6c6013ca | 2658 | AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2659 | } else { |
wolfSSL | 13:f67a6c6013ca | 2660 | XMEMCPY((void*)aes->reg, (void*)aes->tmp, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2661 | } |
wolfSSL | 13:f67a6c6013ca | 2662 | |
wolfSSL | 13:f67a6c6013ca | 2663 | pi += size; |
wolfSSL | 13:f67a6c6013ca | 2664 | po += size; |
wolfSSL | 13:f67a6c6013ca | 2665 | } |
wolfSSL | 13:f67a6c6013ca | 2666 | |
wolfSSL | 13:f67a6c6013ca | 2667 | wc_UnLockMutex(&Mutex_AesSEC); |
wolfSSL | 13:f67a6c6013ca | 2668 | return 0; |
wolfSSL | 13:f67a6c6013ca | 2669 | } |
wolfSSL | 13:f67a6c6013ca | 2670 | |
wolfSSL | 13:f67a6c6013ca | 2671 | int wc_AesCbcEncrypt(Aes* aes, byte* po, const byte* pi, word32 sz) |
wolfSSL | 13:f67a6c6013ca | 2672 | { |
wolfSSL | 13:f67a6c6013ca | 2673 | return (wc_AesCbcCrypt(aes, po, pi, sz, SEC_DESC_AES_CBC_ENCRYPT)); |
wolfSSL | 13:f67a6c6013ca | 2674 | } |
wolfSSL | 13:f67a6c6013ca | 2675 | |
wolfSSL | 13:f67a6c6013ca | 2676 | #ifdef HAVE_AES_DECRYPT |
wolfSSL | 13:f67a6c6013ca | 2677 | int wc_AesCbcDecrypt(Aes* aes, byte* po, const byte* pi, word32 sz) |
wolfSSL | 13:f67a6c6013ca | 2678 | { |
wolfSSL | 13:f67a6c6013ca | 2679 | return (wc_AesCbcCrypt(aes, po, pi, sz, SEC_DESC_AES_CBC_DECRYPT)); |
wolfSSL | 13:f67a6c6013ca | 2680 | } |
wolfSSL | 13:f67a6c6013ca | 2681 | #endif /* HAVE_AES_DECRYPT */ |
wolfSSL | 13:f67a6c6013ca | 2682 | |
wolfSSL | 13:f67a6c6013ca | 2683 | #elif defined(FREESCALE_LTC) |
wolfSSL | 13:f67a6c6013ca | 2684 | int wc_AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz) |
wolfSSL | 13:f67a6c6013ca | 2685 | { |
wolfSSL | 13:f67a6c6013ca | 2686 | uint32_t keySize; |
wolfSSL | 13:f67a6c6013ca | 2687 | status_t status; |
wolfSSL | 13:f67a6c6013ca | 2688 | byte *iv, *enc_key; |
wolfSSL | 13:f67a6c6013ca | 2689 | word32 blocks = (sz / AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2690 | |
wolfSSL | 13:f67a6c6013ca | 2691 | iv = (byte*)aes->reg; |
wolfSSL | 13:f67a6c6013ca | 2692 | enc_key = (byte*)aes->key; |
wolfSSL | 13:f67a6c6013ca | 2693 | |
wolfSSL | 13:f67a6c6013ca | 2694 | status = wc_AesGetKeySize(aes, &keySize); |
wolfSSL | 13:f67a6c6013ca | 2695 | if (status != 0) { |
wolfSSL | 13:f67a6c6013ca | 2696 | return status; |
wolfSSL | 13:f67a6c6013ca | 2697 | } |
wolfSSL | 13:f67a6c6013ca | 2698 | |
wolfSSL | 13:f67a6c6013ca | 2699 | status = LTC_AES_EncryptCbc(LTC_BASE, in, out, blocks * AES_BLOCK_SIZE, |
wolfSSL | 13:f67a6c6013ca | 2700 | iv, enc_key, keySize); |
wolfSSL | 13:f67a6c6013ca | 2701 | return (status == kStatus_Success) ? 0 : -1; |
wolfSSL | 13:f67a6c6013ca | 2702 | } |
wolfSSL | 13:f67a6c6013ca | 2703 | |
wolfSSL | 13:f67a6c6013ca | 2704 | #ifdef HAVE_AES_DECRYPT |
wolfSSL | 13:f67a6c6013ca | 2705 | int wc_AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz) |
wolfSSL | 13:f67a6c6013ca | 2706 | { |
wolfSSL | 13:f67a6c6013ca | 2707 | uint32_t keySize; |
wolfSSL | 13:f67a6c6013ca | 2708 | status_t status; |
wolfSSL | 13:f67a6c6013ca | 2709 | byte* iv, *dec_key; |
wolfSSL | 13:f67a6c6013ca | 2710 | word32 blocks = (sz / AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2711 | |
wolfSSL | 13:f67a6c6013ca | 2712 | iv = (byte*)aes->reg; |
wolfSSL | 13:f67a6c6013ca | 2713 | dec_key = (byte*)aes->key; |
wolfSSL | 13:f67a6c6013ca | 2714 | |
wolfSSL | 13:f67a6c6013ca | 2715 | status = wc_AesGetKeySize(aes, &keySize); |
wolfSSL | 13:f67a6c6013ca | 2716 | if (status != 0) { |
wolfSSL | 13:f67a6c6013ca | 2717 | return status; |
wolfSSL | 13:f67a6c6013ca | 2718 | } |
wolfSSL | 13:f67a6c6013ca | 2719 | |
wolfSSL | 13:f67a6c6013ca | 2720 | status = LTC_AES_DecryptCbc(LTC_BASE, in, out, blocks * AES_BLOCK_SIZE, |
wolfSSL | 13:f67a6c6013ca | 2721 | iv, dec_key, keySize, kLTC_EncryptKey); |
wolfSSL | 13:f67a6c6013ca | 2722 | return (status == kStatus_Success) ? 0 : -1; |
wolfSSL | 13:f67a6c6013ca | 2723 | } |
wolfSSL | 13:f67a6c6013ca | 2724 | #endif /* HAVE_AES_DECRYPT */ |
wolfSSL | 13:f67a6c6013ca | 2725 | |
wolfSSL | 13:f67a6c6013ca | 2726 | #elif defined(FREESCALE_MMCAU) |
wolfSSL | 13:f67a6c6013ca | 2727 | int wc_AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz) |
wolfSSL | 13:f67a6c6013ca | 2728 | { |
wolfSSL | 13:f67a6c6013ca | 2729 | int i; |
wolfSSL | 13:f67a6c6013ca | 2730 | int offset = 0; |
wolfSSL | 13:f67a6c6013ca | 2731 | word32 blocks = (sz / AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2732 | byte *iv; |
wolfSSL | 13:f67a6c6013ca | 2733 | byte temp_block[AES_BLOCK_SIZE]; |
wolfSSL | 13:f67a6c6013ca | 2734 | |
wolfSSL | 13:f67a6c6013ca | 2735 | iv = (byte*)aes->reg; |
wolfSSL | 13:f67a6c6013ca | 2736 | |
wolfSSL | 13:f67a6c6013ca | 2737 | while (blocks--) { |
wolfSSL | 13:f67a6c6013ca | 2738 | XMEMCPY(temp_block, in + offset, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2739 | |
wolfSSL | 13:f67a6c6013ca | 2740 | /* XOR block with IV for CBC */ |
wolfSSL | 13:f67a6c6013ca | 2741 | for (i = 0; i < AES_BLOCK_SIZE; i++) |
wolfSSL | 13:f67a6c6013ca | 2742 | temp_block[i] ^= iv[i]; |
wolfSSL | 13:f67a6c6013ca | 2743 | |
wolfSSL | 13:f67a6c6013ca | 2744 | wc_AesEncrypt(aes, temp_block, out + offset); |
wolfSSL | 13:f67a6c6013ca | 2745 | |
wolfSSL | 13:f67a6c6013ca | 2746 | offset += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 2747 | |
wolfSSL | 13:f67a6c6013ca | 2748 | /* store IV for next block */ |
wolfSSL | 13:f67a6c6013ca | 2749 | XMEMCPY(iv, out + offset - AES_BLOCK_SIZE, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2750 | } |
wolfSSL | 13:f67a6c6013ca | 2751 | |
wolfSSL | 13:f67a6c6013ca | 2752 | return 0; |
wolfSSL | 13:f67a6c6013ca | 2753 | } |
wolfSSL | 13:f67a6c6013ca | 2754 | #ifdef HAVE_AES_DECRYPT |
wolfSSL | 13:f67a6c6013ca | 2755 | int wc_AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz) |
wolfSSL | 13:f67a6c6013ca | 2756 | { |
wolfSSL | 13:f67a6c6013ca | 2757 | int i; |
wolfSSL | 13:f67a6c6013ca | 2758 | int offset = 0; |
wolfSSL | 13:f67a6c6013ca | 2759 | word32 blocks = (sz / AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2760 | byte* iv; |
wolfSSL | 13:f67a6c6013ca | 2761 | byte temp_block[AES_BLOCK_SIZE]; |
wolfSSL | 13:f67a6c6013ca | 2762 | |
wolfSSL | 13:f67a6c6013ca | 2763 | iv = (byte*)aes->reg; |
wolfSSL | 13:f67a6c6013ca | 2764 | |
wolfSSL | 13:f67a6c6013ca | 2765 | while (blocks--) { |
wolfSSL | 13:f67a6c6013ca | 2766 | XMEMCPY(temp_block, in + offset, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2767 | |
wolfSSL | 13:f67a6c6013ca | 2768 | wc_AesDecrypt(aes, in + offset, out + offset); |
wolfSSL | 13:f67a6c6013ca | 2769 | |
wolfSSL | 13:f67a6c6013ca | 2770 | /* XOR block with IV for CBC */ |
wolfSSL | 13:f67a6c6013ca | 2771 | for (i = 0; i < AES_BLOCK_SIZE; i++) |
wolfSSL | 13:f67a6c6013ca | 2772 | (out + offset)[i] ^= iv[i]; |
wolfSSL | 13:f67a6c6013ca | 2773 | |
wolfSSL | 13:f67a6c6013ca | 2774 | /* store IV for next block */ |
wolfSSL | 13:f67a6c6013ca | 2775 | XMEMCPY(iv, temp_block, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2776 | |
wolfSSL | 13:f67a6c6013ca | 2777 | offset += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 2778 | } |
wolfSSL | 13:f67a6c6013ca | 2779 | |
wolfSSL | 13:f67a6c6013ca | 2780 | return 0; |
wolfSSL | 13:f67a6c6013ca | 2781 | } |
wolfSSL | 13:f67a6c6013ca | 2782 | #endif /* HAVE_AES_DECRYPT */ |
wolfSSL | 13:f67a6c6013ca | 2783 | |
wolfSSL | 13:f67a6c6013ca | 2784 | #elif defined(WOLFSSL_PIC32MZ_CRYPT) |
wolfSSL | 13:f67a6c6013ca | 2785 | |
wolfSSL | 13:f67a6c6013ca | 2786 | int wc_AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz) |
wolfSSL | 13:f67a6c6013ca | 2787 | { |
wolfSSL | 13:f67a6c6013ca | 2788 | return wc_Pic32AesCrypt( |
wolfSSL | 13:f67a6c6013ca | 2789 | aes->key_ce, aes->keylen, aes->iv_ce, AES_BLOCK_SIZE, |
wolfSSL | 13:f67a6c6013ca | 2790 | out, in, sz, PIC32_ENCRYPTION, |
wolfSSL | 13:f67a6c6013ca | 2791 | PIC32_ALGO_AES, PIC32_CRYPTOALGO_RCBC); |
wolfSSL | 13:f67a6c6013ca | 2792 | } |
wolfSSL | 13:f67a6c6013ca | 2793 | #ifdef HAVE_AES_DECRYPT |
wolfSSL | 13:f67a6c6013ca | 2794 | int wc_AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz) |
wolfSSL | 13:f67a6c6013ca | 2795 | { |
wolfSSL | 13:f67a6c6013ca | 2796 | return wc_Pic32AesCrypt( |
wolfSSL | 13:f67a6c6013ca | 2797 | aes->key_ce, aes->keylen, aes->iv_ce, AES_BLOCK_SIZE, |
wolfSSL | 13:f67a6c6013ca | 2798 | out, in, sz, PIC32_DECRYPTION, |
wolfSSL | 13:f67a6c6013ca | 2799 | PIC32_ALGO_AES, PIC32_CRYPTOALGO_RCBC); |
wolfSSL | 13:f67a6c6013ca | 2800 | } |
wolfSSL | 13:f67a6c6013ca | 2801 | #endif /* HAVE_AES_DECRYPT */ |
wolfSSL | 13:f67a6c6013ca | 2802 | |
wolfSSL | 13:f67a6c6013ca | 2803 | #else |
wolfSSL | 13:f67a6c6013ca | 2804 | |
wolfSSL | 13:f67a6c6013ca | 2805 | int wc_AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz) |
wolfSSL | 13:f67a6c6013ca | 2806 | { |
wolfSSL | 13:f67a6c6013ca | 2807 | word32 blocks = (sz / AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2808 | |
wolfSSL | 13:f67a6c6013ca | 2809 | if (aes == NULL || out == NULL || in == NULL) { |
wolfSSL | 13:f67a6c6013ca | 2810 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 2811 | } |
wolfSSL | 13:f67a6c6013ca | 2812 | |
wolfSSL | 13:f67a6c6013ca | 2813 | #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_AES) |
wolfSSL | 13:f67a6c6013ca | 2814 | /* if async and byte count above threshold */ |
wolfSSL | 13:f67a6c6013ca | 2815 | if (aes->asyncDev.marker == WOLFSSL_ASYNC_MARKER_AES && |
wolfSSL | 13:f67a6c6013ca | 2816 | sz >= WC_ASYNC_THRESH_AES_CBC) { |
wolfSSL | 13:f67a6c6013ca | 2817 | #if defined(HAVE_CAVIUM) |
wolfSSL | 13:f67a6c6013ca | 2818 | return NitroxAesCbcEncrypt(aes, out, in, sz); |
wolfSSL | 13:f67a6c6013ca | 2819 | #elif defined(HAVE_INTEL_QA) |
wolfSSL | 13:f67a6c6013ca | 2820 | return IntelQaSymAesCbcEncrypt(&aes->asyncDev, out, in, sz, |
wolfSSL | 13:f67a6c6013ca | 2821 | (const byte*)aes->asyncKey, aes->keylen, |
wolfSSL | 13:f67a6c6013ca | 2822 | (const byte*)aes->asyncIv, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2823 | #else /* WOLFSSL_ASYNC_CRYPT_TEST */ |
wolfSSL | 13:f67a6c6013ca | 2824 | WC_ASYNC_TEST* testDev = &aes->asyncDev.test; |
wolfSSL | 13:f67a6c6013ca | 2825 | if (testDev->type == ASYNC_TEST_NONE) { |
wolfSSL | 13:f67a6c6013ca | 2826 | testDev->type = ASYNC_TEST_AES_CBC_ENCRYPT; |
wolfSSL | 13:f67a6c6013ca | 2827 | testDev->aes.aes = aes; |
wolfSSL | 13:f67a6c6013ca | 2828 | testDev->aes.out = out; |
wolfSSL | 13:f67a6c6013ca | 2829 | testDev->aes.in = in; |
wolfSSL | 13:f67a6c6013ca | 2830 | testDev->aes.sz = sz; |
wolfSSL | 13:f67a6c6013ca | 2831 | return WC_PENDING_E; |
wolfSSL | 13:f67a6c6013ca | 2832 | } |
wolfSSL | 13:f67a6c6013ca | 2833 | #endif |
wolfSSL | 13:f67a6c6013ca | 2834 | } |
wolfSSL | 13:f67a6c6013ca | 2835 | #endif /* WOLFSSL_ASYNC_CRYPT */ |
wolfSSL | 13:f67a6c6013ca | 2836 | |
wolfSSL | 13:f67a6c6013ca | 2837 | #ifdef WOLFSSL_AESNI |
wolfSSL | 13:f67a6c6013ca | 2838 | if (haveAESNI) { |
wolfSSL | 13:f67a6c6013ca | 2839 | #ifdef DEBUG_AESNI |
wolfSSL | 13:f67a6c6013ca | 2840 | printf("about to aes cbc encrypt\n"); |
wolfSSL | 13:f67a6c6013ca | 2841 | printf("in = %p\n", in); |
wolfSSL | 13:f67a6c6013ca | 2842 | printf("out = %p\n", out); |
wolfSSL | 13:f67a6c6013ca | 2843 | printf("aes->key = %p\n", aes->key); |
wolfSSL | 13:f67a6c6013ca | 2844 | printf("aes->reg = %p\n", aes->reg); |
wolfSSL | 13:f67a6c6013ca | 2845 | printf("aes->rounds = %d\n", aes->rounds); |
wolfSSL | 13:f67a6c6013ca | 2846 | printf("sz = %d\n", sz); |
wolfSSL | 13:f67a6c6013ca | 2847 | #endif |
wolfSSL | 13:f67a6c6013ca | 2848 | |
wolfSSL | 13:f67a6c6013ca | 2849 | /* check alignment, decrypt doesn't need alignment */ |
wolfSSL | 13:f67a6c6013ca | 2850 | if ((wolfssl_word)in % AESNI_ALIGN) { |
wolfSSL | 13:f67a6c6013ca | 2851 | #ifndef NO_WOLFSSL_ALLOC_ALIGN |
wolfSSL | 13:f67a6c6013ca | 2852 | byte* tmp = (byte*)XMALLOC(sz + AES_BLOCK_SIZE + AESNI_ALIGN, |
wolfSSL | 13:f67a6c6013ca | 2853 | aes->heap, DYNAMIC_TYPE_TMP_BUFFER); |
wolfSSL | 13:f67a6c6013ca | 2854 | byte* tmp_align; |
wolfSSL | 13:f67a6c6013ca | 2855 | if (tmp == NULL) return MEMORY_E; |
wolfSSL | 13:f67a6c6013ca | 2856 | |
wolfSSL | 13:f67a6c6013ca | 2857 | tmp_align = tmp + (AESNI_ALIGN - ((size_t)tmp % AESNI_ALIGN)); |
wolfSSL | 13:f67a6c6013ca | 2858 | XMEMCPY(tmp_align, in, sz); |
wolfSSL | 13:f67a6c6013ca | 2859 | AES_CBC_encrypt(tmp_align, tmp_align, (byte*)aes->reg, sz, |
wolfSSL | 13:f67a6c6013ca | 2860 | (byte*)aes->key, aes->rounds); |
wolfSSL | 13:f67a6c6013ca | 2861 | /* store iv for next call */ |
wolfSSL | 13:f67a6c6013ca | 2862 | XMEMCPY(aes->reg, tmp_align + sz - AES_BLOCK_SIZE, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2863 | |
wolfSSL | 13:f67a6c6013ca | 2864 | XMEMCPY(out, tmp_align, sz); |
wolfSSL | 13:f67a6c6013ca | 2865 | XFREE(tmp, aes->heap, DYNAMIC_TYPE_TMP_BUFFER); |
wolfSSL | 13:f67a6c6013ca | 2866 | return 0; |
wolfSSL | 13:f67a6c6013ca | 2867 | #else |
wolfSSL | 13:f67a6c6013ca | 2868 | WOLFSSL_MSG("AES-CBC encrypt with bad alignment"); |
wolfSSL | 13:f67a6c6013ca | 2869 | return BAD_ALIGN_E; |
wolfSSL | 13:f67a6c6013ca | 2870 | #endif |
wolfSSL | 13:f67a6c6013ca | 2871 | } |
wolfSSL | 13:f67a6c6013ca | 2872 | |
wolfSSL | 13:f67a6c6013ca | 2873 | AES_CBC_encrypt(in, out, (byte*)aes->reg, sz, (byte*)aes->key, |
wolfSSL | 13:f67a6c6013ca | 2874 | aes->rounds); |
wolfSSL | 13:f67a6c6013ca | 2875 | /* store iv for next call */ |
wolfSSL | 13:f67a6c6013ca | 2876 | XMEMCPY(aes->reg, out + sz - AES_BLOCK_SIZE, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2877 | |
wolfSSL | 13:f67a6c6013ca | 2878 | return 0; |
wolfSSL | 13:f67a6c6013ca | 2879 | } |
wolfSSL | 13:f67a6c6013ca | 2880 | #endif |
wolfSSL | 13:f67a6c6013ca | 2881 | |
wolfSSL | 13:f67a6c6013ca | 2882 | while (blocks--) { |
wolfSSL | 13:f67a6c6013ca | 2883 | xorbuf((byte*)aes->reg, in, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2884 | wc_AesEncrypt(aes, (byte*)aes->reg, (byte*)aes->reg); |
wolfSSL | 13:f67a6c6013ca | 2885 | XMEMCPY(out, aes->reg, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2886 | |
wolfSSL | 13:f67a6c6013ca | 2887 | out += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 2888 | in += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 2889 | } |
wolfSSL | 13:f67a6c6013ca | 2890 | |
wolfSSL | 13:f67a6c6013ca | 2891 | return 0; |
wolfSSL | 13:f67a6c6013ca | 2892 | } |
wolfSSL | 13:f67a6c6013ca | 2893 | |
wolfSSL | 13:f67a6c6013ca | 2894 | #ifdef HAVE_AES_DECRYPT |
wolfSSL | 13:f67a6c6013ca | 2895 | int wc_AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz) |
wolfSSL | 13:f67a6c6013ca | 2896 | { |
wolfSSL | 13:f67a6c6013ca | 2897 | word32 blocks; |
wolfSSL | 13:f67a6c6013ca | 2898 | |
wolfSSL | 13:f67a6c6013ca | 2899 | if (aes == NULL || out == NULL || in == NULL |
wolfSSL | 13:f67a6c6013ca | 2900 | || sz % AES_BLOCK_SIZE != 0) { |
wolfSSL | 13:f67a6c6013ca | 2901 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 2902 | } |
wolfSSL | 13:f67a6c6013ca | 2903 | |
wolfSSL | 13:f67a6c6013ca | 2904 | #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_AES) |
wolfSSL | 13:f67a6c6013ca | 2905 | /* if async and byte count above threshold */ |
wolfSSL | 13:f67a6c6013ca | 2906 | if (aes->asyncDev.marker == WOLFSSL_ASYNC_MARKER_AES && |
wolfSSL | 13:f67a6c6013ca | 2907 | sz >= WC_ASYNC_THRESH_AES_CBC) { |
wolfSSL | 13:f67a6c6013ca | 2908 | #if defined(HAVE_CAVIUM) |
wolfSSL | 13:f67a6c6013ca | 2909 | return NitroxAesCbcDecrypt(aes, out, in, sz); |
wolfSSL | 13:f67a6c6013ca | 2910 | #elif defined(HAVE_INTEL_QA) |
wolfSSL | 13:f67a6c6013ca | 2911 | return IntelQaSymAesCbcDecrypt(&aes->asyncDev, out, in, sz, |
wolfSSL | 13:f67a6c6013ca | 2912 | (const byte*)aes->asyncKey, aes->keylen, |
wolfSSL | 13:f67a6c6013ca | 2913 | (const byte*)aes->asyncIv, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2914 | #else /* WOLFSSL_ASYNC_CRYPT_TEST */ |
wolfSSL | 13:f67a6c6013ca | 2915 | WC_ASYNC_TEST* testDev = &aes->asyncDev.test; |
wolfSSL | 13:f67a6c6013ca | 2916 | if (testDev->type == ASYNC_TEST_NONE) { |
wolfSSL | 13:f67a6c6013ca | 2917 | testDev->type = ASYNC_TEST_AES_CBC_DECRYPT; |
wolfSSL | 13:f67a6c6013ca | 2918 | testDev->aes.aes = aes; |
wolfSSL | 13:f67a6c6013ca | 2919 | testDev->aes.out = out; |
wolfSSL | 13:f67a6c6013ca | 2920 | testDev->aes.in = in; |
wolfSSL | 13:f67a6c6013ca | 2921 | testDev->aes.sz = sz; |
wolfSSL | 13:f67a6c6013ca | 2922 | return WC_PENDING_E; |
wolfSSL | 13:f67a6c6013ca | 2923 | } |
wolfSSL | 13:f67a6c6013ca | 2924 | #endif |
wolfSSL | 13:f67a6c6013ca | 2925 | } |
wolfSSL | 13:f67a6c6013ca | 2926 | #endif |
wolfSSL | 13:f67a6c6013ca | 2927 | |
wolfSSL | 13:f67a6c6013ca | 2928 | #ifdef WOLFSSL_AESNI |
wolfSSL | 13:f67a6c6013ca | 2929 | if (haveAESNI) { |
wolfSSL | 13:f67a6c6013ca | 2930 | #ifdef DEBUG_AESNI |
wolfSSL | 13:f67a6c6013ca | 2931 | printf("about to aes cbc decrypt\n"); |
wolfSSL | 13:f67a6c6013ca | 2932 | printf("in = %p\n", in); |
wolfSSL | 13:f67a6c6013ca | 2933 | printf("out = %p\n", out); |
wolfSSL | 13:f67a6c6013ca | 2934 | printf("aes->key = %p\n", aes->key); |
wolfSSL | 13:f67a6c6013ca | 2935 | printf("aes->reg = %p\n", aes->reg); |
wolfSSL | 13:f67a6c6013ca | 2936 | printf("aes->rounds = %d\n", aes->rounds); |
wolfSSL | 13:f67a6c6013ca | 2937 | printf("sz = %d\n", sz); |
wolfSSL | 13:f67a6c6013ca | 2938 | #endif |
wolfSSL | 13:f67a6c6013ca | 2939 | |
wolfSSL | 13:f67a6c6013ca | 2940 | /* if input and output same will overwrite input iv */ |
wolfSSL | 13:f67a6c6013ca | 2941 | XMEMCPY(aes->tmp, in + sz - AES_BLOCK_SIZE, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2942 | #if defined(WOLFSSL_AESNI_BY4) |
wolfSSL | 13:f67a6c6013ca | 2943 | AES_CBC_decrypt_by4(in, out, (byte*)aes->reg, sz, (byte*)aes->key, |
wolfSSL | 13:f67a6c6013ca | 2944 | aes->rounds); |
wolfSSL | 13:f67a6c6013ca | 2945 | #elif defined(WOLFSSL_AESNI_BY6) |
wolfSSL | 13:f67a6c6013ca | 2946 | AES_CBC_decrypt_by6(in, out, (byte*)aes->reg, sz, (byte*)aes->key, |
wolfSSL | 13:f67a6c6013ca | 2947 | aes->rounds); |
wolfSSL | 13:f67a6c6013ca | 2948 | #else /* WOLFSSL_AESNI_BYx */ |
wolfSSL | 13:f67a6c6013ca | 2949 | AES_CBC_decrypt_by8(in, out, (byte*)aes->reg, sz, (byte*)aes->key, |
wolfSSL | 13:f67a6c6013ca | 2950 | aes->rounds); |
wolfSSL | 13:f67a6c6013ca | 2951 | #endif /* WOLFSSL_AESNI_BYx */ |
wolfSSL | 13:f67a6c6013ca | 2952 | /* store iv for next call */ |
wolfSSL | 13:f67a6c6013ca | 2953 | XMEMCPY(aes->reg, aes->tmp, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2954 | return 0; |
wolfSSL | 13:f67a6c6013ca | 2955 | } |
wolfSSL | 13:f67a6c6013ca | 2956 | #endif |
wolfSSL | 13:f67a6c6013ca | 2957 | |
wolfSSL | 13:f67a6c6013ca | 2958 | blocks = sz / AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 2959 | while (blocks--) { |
wolfSSL | 13:f67a6c6013ca | 2960 | XMEMCPY(aes->tmp, in, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2961 | wc_AesDecrypt(aes, (byte*)aes->tmp, out); |
wolfSSL | 13:f67a6c6013ca | 2962 | xorbuf(out, (byte*)aes->reg, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2963 | XMEMCPY(aes->reg, aes->tmp, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 2964 | |
wolfSSL | 13:f67a6c6013ca | 2965 | out += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 2966 | in += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 2967 | } |
wolfSSL | 13:f67a6c6013ca | 2968 | |
wolfSSL | 13:f67a6c6013ca | 2969 | return 0; |
wolfSSL | 13:f67a6c6013ca | 2970 | } |
wolfSSL | 13:f67a6c6013ca | 2971 | #endif |
wolfSSL | 13:f67a6c6013ca | 2972 | |
wolfSSL | 13:f67a6c6013ca | 2973 | #endif /* AES-CBC block */ |
wolfSSL | 13:f67a6c6013ca | 2974 | #endif /* HAVE_AES_CBC */ |
wolfSSL | 13:f67a6c6013ca | 2975 | |
wolfSSL | 13:f67a6c6013ca | 2976 | #ifdef HAVE_AES_ECB |
wolfSSL | 13:f67a6c6013ca | 2977 | int wc_AesEcbEncrypt(Aes* aes, byte* out, const byte* in, word32 sz) |
wolfSSL | 13:f67a6c6013ca | 2978 | { |
wolfSSL | 13:f67a6c6013ca | 2979 | if ((in == NULL) || (out == NULL) || (aes == NULL)) |
wolfSSL | 13:f67a6c6013ca | 2980 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 2981 | while (sz>0) { |
wolfSSL | 13:f67a6c6013ca | 2982 | wc_AesEncryptDirect(aes, out, in); |
wolfSSL | 13:f67a6c6013ca | 2983 | out += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 2984 | in += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 2985 | sz -= AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 2986 | } |
wolfSSL | 13:f67a6c6013ca | 2987 | return 0; |
wolfSSL | 13:f67a6c6013ca | 2988 | } |
wolfSSL | 13:f67a6c6013ca | 2989 | int wc_AesEcbDecrypt(Aes* aes, byte* out, const byte* in, word32 sz) |
wolfSSL | 13:f67a6c6013ca | 2990 | { |
wolfSSL | 13:f67a6c6013ca | 2991 | if ((in == NULL) || (out == NULL) || (aes == NULL)) |
wolfSSL | 13:f67a6c6013ca | 2992 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 2993 | while (sz>0) { |
wolfSSL | 13:f67a6c6013ca | 2994 | wc_AesDecryptDirect(aes, out, in); |
wolfSSL | 13:f67a6c6013ca | 2995 | out += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 2996 | in += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 2997 | sz -= AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 2998 | } |
wolfSSL | 13:f67a6c6013ca | 2999 | return 0; |
wolfSSL | 13:f67a6c6013ca | 3000 | } |
wolfSSL | 13:f67a6c6013ca | 3001 | #endif |
wolfSSL | 13:f67a6c6013ca | 3002 | |
wolfSSL | 13:f67a6c6013ca | 3003 | /* AES-CTR */ |
wolfSSL | 13:f67a6c6013ca | 3004 | #if defined(WOLFSSL_AES_COUNTER) || (defined(HAVE_AESGCM_DECRYPT) && defined(STM32F4_CRYPTO)) |
wolfSSL | 13:f67a6c6013ca | 3005 | #if defined(STM32F2_CRYPTO) || defined(STM32F4_CRYPTO) |
wolfSSL | 13:f67a6c6013ca | 3006 | #ifdef WOLFSSL_STM32_CUBEMX |
wolfSSL | 13:f67a6c6013ca | 3007 | int wc_AesCtrEncrypt(Aes* aes, byte* out, const byte* in, word32 sz) |
wolfSSL | 13:f67a6c6013ca | 3008 | { |
wolfSSL | 13:f67a6c6013ca | 3009 | CRYP_HandleTypeDef hcryp; |
wolfSSL | 13:f67a6c6013ca | 3010 | |
wolfSSL | 13:f67a6c6013ca | 3011 | if (aes == NULL || out == NULL || in == NULL) { |
wolfSSL | 13:f67a6c6013ca | 3012 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 3013 | } |
wolfSSL | 13:f67a6c6013ca | 3014 | |
wolfSSL | 13:f67a6c6013ca | 3015 | XMEMSET(&hcryp, 0, sizeof(CRYP_HandleTypeDef)); |
wolfSSL | 13:f67a6c6013ca | 3016 | switch (aes->rounds) { |
wolfSSL | 13:f67a6c6013ca | 3017 | case 10: /* 128-bit key */ |
wolfSSL | 13:f67a6c6013ca | 3018 | hcryp.Init.KeySize = CRYP_KEYSIZE_128B; |
wolfSSL | 13:f67a6c6013ca | 3019 | break; |
wolfSSL | 13:f67a6c6013ca | 3020 | case 12: /* 192-bit key */ |
wolfSSL | 13:f67a6c6013ca | 3021 | hcryp.Init.KeySize = CRYP_KEYSIZE_192B; |
wolfSSL | 13:f67a6c6013ca | 3022 | break; |
wolfSSL | 13:f67a6c6013ca | 3023 | case 14: /* 256-bit key */ |
wolfSSL | 13:f67a6c6013ca | 3024 | hcryp.Init.KeySize = CRYP_KEYSIZE_256B; |
wolfSSL | 13:f67a6c6013ca | 3025 | break; |
wolfSSL | 13:f67a6c6013ca | 3026 | default: |
wolfSSL | 13:f67a6c6013ca | 3027 | break; |
wolfSSL | 13:f67a6c6013ca | 3028 | } |
wolfSSL | 13:f67a6c6013ca | 3029 | hcryp.Instance = CRYP; |
wolfSSL | 13:f67a6c6013ca | 3030 | hcryp.Init.DataType = CRYP_DATATYPE_8B; |
wolfSSL | 13:f67a6c6013ca | 3031 | hcryp.Init.pKey = (byte*)aes->key; |
wolfSSL | 13:f67a6c6013ca | 3032 | hcryp.Init.pInitVect = (byte*)aes->reg; |
wolfSSL | 13:f67a6c6013ca | 3033 | |
wolfSSL | 13:f67a6c6013ca | 3034 | HAL_CRYP_Init(&hcryp); |
wolfSSL | 13:f67a6c6013ca | 3035 | |
wolfSSL | 13:f67a6c6013ca | 3036 | if (HAL_CRYP_AESCTR_Encrypt(&hcryp, (byte*)in, sz, out, |
wolfSSL | 13:f67a6c6013ca | 3037 | STM32_HAL_TIMEOUT) != HAL_OK) { |
wolfSSL | 13:f67a6c6013ca | 3038 | /* failed */ |
wolfSSL | 13:f67a6c6013ca | 3039 | } |
wolfSSL | 13:f67a6c6013ca | 3040 | |
wolfSSL | 13:f67a6c6013ca | 3041 | HAL_CRYP_DeInit(&hcryp); |
wolfSSL | 13:f67a6c6013ca | 3042 | |
wolfSSL | 13:f67a6c6013ca | 3043 | return 0; |
wolfSSL | 13:f67a6c6013ca | 3044 | } |
wolfSSL | 13:f67a6c6013ca | 3045 | #else |
wolfSSL | 13:f67a6c6013ca | 3046 | int wc_AesCtrEncrypt(Aes* aes, byte* out, const byte* in, word32 sz) |
wolfSSL | 13:f67a6c6013ca | 3047 | { |
wolfSSL | 13:f67a6c6013ca | 3048 | word32 *enc_key, *iv; |
wolfSSL | 13:f67a6c6013ca | 3049 | int len = (int)sz; |
wolfSSL | 13:f67a6c6013ca | 3050 | |
wolfSSL | 13:f67a6c6013ca | 3051 | if (aes == NULL || out == NULL || in == NULL) { |
wolfSSL | 13:f67a6c6013ca | 3052 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 3053 | } |
wolfSSL | 13:f67a6c6013ca | 3054 | CRYP_InitTypeDef AES_CRYP_InitStructure; |
wolfSSL | 13:f67a6c6013ca | 3055 | CRYP_KeyInitTypeDef AES_CRYP_KeyInitStructure; |
wolfSSL | 13:f67a6c6013ca | 3056 | CRYP_IVInitTypeDef AES_CRYP_IVInitStructure; |
wolfSSL | 13:f67a6c6013ca | 3057 | |
wolfSSL | 13:f67a6c6013ca | 3058 | enc_key = aes->key; |
wolfSSL | 13:f67a6c6013ca | 3059 | iv = aes->reg; |
wolfSSL | 13:f67a6c6013ca | 3060 | |
wolfSSL | 13:f67a6c6013ca | 3061 | /* crypto structure initialization */ |
wolfSSL | 13:f67a6c6013ca | 3062 | CRYP_KeyStructInit(&AES_CRYP_KeyInitStructure); |
wolfSSL | 13:f67a6c6013ca | 3063 | CRYP_StructInit(&AES_CRYP_InitStructure); |
wolfSSL | 13:f67a6c6013ca | 3064 | CRYP_IVStructInit(&AES_CRYP_IVInitStructure); |
wolfSSL | 13:f67a6c6013ca | 3065 | |
wolfSSL | 13:f67a6c6013ca | 3066 | /* reset registers to their default values */ |
wolfSSL | 13:f67a6c6013ca | 3067 | CRYP_DeInit(); |
wolfSSL | 13:f67a6c6013ca | 3068 | |
wolfSSL | 13:f67a6c6013ca | 3069 | /* load key into correct registers */ |
wolfSSL | 13:f67a6c6013ca | 3070 | switch (aes->rounds) { |
wolfSSL | 13:f67a6c6013ca | 3071 | case 10: /* 128-bit key */ |
wolfSSL | 13:f67a6c6013ca | 3072 | AES_CRYP_InitStructure.CRYP_KeySize = CRYP_KeySize_128b; |
wolfSSL | 13:f67a6c6013ca | 3073 | AES_CRYP_KeyInitStructure.CRYP_Key2Left = enc_key[0]; |
wolfSSL | 13:f67a6c6013ca | 3074 | AES_CRYP_KeyInitStructure.CRYP_Key2Right = enc_key[1]; |
wolfSSL | 13:f67a6c6013ca | 3075 | AES_CRYP_KeyInitStructure.CRYP_Key3Left = enc_key[2]; |
wolfSSL | 13:f67a6c6013ca | 3076 | AES_CRYP_KeyInitStructure.CRYP_Key3Right = enc_key[3]; |
wolfSSL | 13:f67a6c6013ca | 3077 | break; |
wolfSSL | 13:f67a6c6013ca | 3078 | |
wolfSSL | 13:f67a6c6013ca | 3079 | case 12: /* 192-bit key */ |
wolfSSL | 13:f67a6c6013ca | 3080 | AES_CRYP_InitStructure.CRYP_KeySize = CRYP_KeySize_192b; |
wolfSSL | 13:f67a6c6013ca | 3081 | AES_CRYP_KeyInitStructure.CRYP_Key1Left = enc_key[0]; |
wolfSSL | 13:f67a6c6013ca | 3082 | AES_CRYP_KeyInitStructure.CRYP_Key1Right = enc_key[1]; |
wolfSSL | 13:f67a6c6013ca | 3083 | AES_CRYP_KeyInitStructure.CRYP_Key2Left = enc_key[2]; |
wolfSSL | 13:f67a6c6013ca | 3084 | AES_CRYP_KeyInitStructure.CRYP_Key2Right = enc_key[3]; |
wolfSSL | 13:f67a6c6013ca | 3085 | AES_CRYP_KeyInitStructure.CRYP_Key3Left = enc_key[4]; |
wolfSSL | 13:f67a6c6013ca | 3086 | AES_CRYP_KeyInitStructure.CRYP_Key3Right = enc_key[5]; |
wolfSSL | 13:f67a6c6013ca | 3087 | break; |
wolfSSL | 13:f67a6c6013ca | 3088 | |
wolfSSL | 13:f67a6c6013ca | 3089 | case 14: /* 256-bit key */ |
wolfSSL | 13:f67a6c6013ca | 3090 | AES_CRYP_InitStructure.CRYP_KeySize = CRYP_KeySize_256b; |
wolfSSL | 13:f67a6c6013ca | 3091 | AES_CRYP_KeyInitStructure.CRYP_Key0Left = enc_key[0]; |
wolfSSL | 13:f67a6c6013ca | 3092 | AES_CRYP_KeyInitStructure.CRYP_Key0Right = enc_key[1]; |
wolfSSL | 13:f67a6c6013ca | 3093 | AES_CRYP_KeyInitStructure.CRYP_Key1Left = enc_key[2]; |
wolfSSL | 13:f67a6c6013ca | 3094 | AES_CRYP_KeyInitStructure.CRYP_Key1Right = enc_key[3]; |
wolfSSL | 13:f67a6c6013ca | 3095 | AES_CRYP_KeyInitStructure.CRYP_Key2Left = enc_key[4]; |
wolfSSL | 13:f67a6c6013ca | 3096 | AES_CRYP_KeyInitStructure.CRYP_Key2Right = enc_key[5]; |
wolfSSL | 13:f67a6c6013ca | 3097 | AES_CRYP_KeyInitStructure.CRYP_Key3Left = enc_key[6]; |
wolfSSL | 13:f67a6c6013ca | 3098 | AES_CRYP_KeyInitStructure.CRYP_Key3Right = enc_key[7]; |
wolfSSL | 13:f67a6c6013ca | 3099 | break; |
wolfSSL | 13:f67a6c6013ca | 3100 | |
wolfSSL | 13:f67a6c6013ca | 3101 | default: |
wolfSSL | 13:f67a6c6013ca | 3102 | break; |
wolfSSL | 13:f67a6c6013ca | 3103 | } |
wolfSSL | 13:f67a6c6013ca | 3104 | CRYP_KeyInit(&AES_CRYP_KeyInitStructure); |
wolfSSL | 13:f67a6c6013ca | 3105 | |
wolfSSL | 13:f67a6c6013ca | 3106 | /* set iv */ |
wolfSSL | 13:f67a6c6013ca | 3107 | ByteReverseWords(iv, iv, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 3108 | AES_CRYP_IVInitStructure.CRYP_IV0Left = iv[0]; |
wolfSSL | 13:f67a6c6013ca | 3109 | AES_CRYP_IVInitStructure.CRYP_IV0Right = iv[1]; |
wolfSSL | 13:f67a6c6013ca | 3110 | AES_CRYP_IVInitStructure.CRYP_IV1Left = iv[2]; |
wolfSSL | 13:f67a6c6013ca | 3111 | AES_CRYP_IVInitStructure.CRYP_IV1Right = iv[3]; |
wolfSSL | 13:f67a6c6013ca | 3112 | CRYP_IVInit(&AES_CRYP_IVInitStructure); |
wolfSSL | 13:f67a6c6013ca | 3113 | |
wolfSSL | 13:f67a6c6013ca | 3114 | /* set direction, mode, and datatype */ |
wolfSSL | 13:f67a6c6013ca | 3115 | AES_CRYP_InitStructure.CRYP_AlgoDir = CRYP_AlgoDir_Encrypt; |
wolfSSL | 13:f67a6c6013ca | 3116 | AES_CRYP_InitStructure.CRYP_AlgoMode = CRYP_AlgoMode_AES_CTR; |
wolfSSL | 13:f67a6c6013ca | 3117 | AES_CRYP_InitStructure.CRYP_DataType = CRYP_DataType_8b; |
wolfSSL | 13:f67a6c6013ca | 3118 | CRYP_Init(&AES_CRYP_InitStructure); |
wolfSSL | 13:f67a6c6013ca | 3119 | |
wolfSSL | 13:f67a6c6013ca | 3120 | /* enable crypto processor */ |
wolfSSL | 13:f67a6c6013ca | 3121 | CRYP_Cmd(ENABLE); |
wolfSSL | 13:f67a6c6013ca | 3122 | |
wolfSSL | 13:f67a6c6013ca | 3123 | while (len > 0) { |
wolfSSL | 13:f67a6c6013ca | 3124 | /* flush IN/OUT FIFOs */ |
wolfSSL | 13:f67a6c6013ca | 3125 | CRYP_FIFOFlush(); |
wolfSSL | 13:f67a6c6013ca | 3126 | |
wolfSSL | 13:f67a6c6013ca | 3127 | CRYP_DataIn(*(uint32_t*)&in[0]); |
wolfSSL | 13:f67a6c6013ca | 3128 | CRYP_DataIn(*(uint32_t*)&in[4]); |
wolfSSL | 13:f67a6c6013ca | 3129 | CRYP_DataIn(*(uint32_t*)&in[8]); |
wolfSSL | 13:f67a6c6013ca | 3130 | CRYP_DataIn(*(uint32_t*)&in[12]); |
wolfSSL | 13:f67a6c6013ca | 3131 | |
wolfSSL | 13:f67a6c6013ca | 3132 | /* wait until the complete message has been processed */ |
wolfSSL | 13:f67a6c6013ca | 3133 | while (CRYP_GetFlagStatus(CRYP_FLAG_BUSY) != RESET) {} |
wolfSSL | 13:f67a6c6013ca | 3134 | |
wolfSSL | 13:f67a6c6013ca | 3135 | *(uint32_t*)&out[0] = CRYP_DataOut(); |
wolfSSL | 13:f67a6c6013ca | 3136 | *(uint32_t*)&out[4] = CRYP_DataOut(); |
wolfSSL | 13:f67a6c6013ca | 3137 | *(uint32_t*)&out[8] = CRYP_DataOut(); |
wolfSSL | 13:f67a6c6013ca | 3138 | *(uint32_t*)&out[12] = CRYP_DataOut(); |
wolfSSL | 13:f67a6c6013ca | 3139 | |
wolfSSL | 13:f67a6c6013ca | 3140 | /* store iv for next call */ |
wolfSSL | 13:f67a6c6013ca | 3141 | XMEMCPY(aes->reg, out + len - AES_BLOCK_SIZE, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 3142 | |
wolfSSL | 13:f67a6c6013ca | 3143 | len -= AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 3144 | in += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 3145 | out += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 3146 | } |
wolfSSL | 13:f67a6c6013ca | 3147 | |
wolfSSL | 13:f67a6c6013ca | 3148 | /* disable crypto processor */ |
wolfSSL | 13:f67a6c6013ca | 3149 | CRYP_Cmd(DISABLE); |
wolfSSL | 13:f67a6c6013ca | 3150 | } |
wolfSSL | 13:f67a6c6013ca | 3151 | #endif /* WOLFSSL_STM32_CUBEMX */ |
wolfSSL | 13:f67a6c6013ca | 3152 | |
wolfSSL | 13:f67a6c6013ca | 3153 | #elif defined(WOLFSSL_PIC32MZ_CRYPT) |
wolfSSL | 13:f67a6c6013ca | 3154 | static void Pic32AesIncIV(Aes* aes) { |
wolfSSL | 13:f67a6c6013ca | 3155 | int i; |
wolfSSL | 13:f67a6c6013ca | 3156 | for (i = AES_BLOCK_SIZE - 1; i >= 0; i--) { |
wolfSSL | 13:f67a6c6013ca | 3157 | if (++((byte *)aes->iv_ce)[i]) |
wolfSSL | 13:f67a6c6013ca | 3158 | break; |
wolfSSL | 13:f67a6c6013ca | 3159 | } |
wolfSSL | 13:f67a6c6013ca | 3160 | } |
wolfSSL | 13:f67a6c6013ca | 3161 | int wc_AesCtrEncrypt(Aes* aes, byte* out, const byte* in, word32 sz) |
wolfSSL | 13:f67a6c6013ca | 3162 | { |
wolfSSL | 13:f67a6c6013ca | 3163 | int ret = 0; |
wolfSSL | 13:f67a6c6013ca | 3164 | byte out_block[AES_BLOCK_SIZE]; |
wolfSSL | 13:f67a6c6013ca | 3165 | int odd, even, blocks; |
wolfSSL | 13:f67a6c6013ca | 3166 | byte *tmp; |
wolfSSL | 13:f67a6c6013ca | 3167 | |
wolfSSL | 13:f67a6c6013ca | 3168 | if (aes == NULL || out == NULL || in == NULL) { |
wolfSSL | 13:f67a6c6013ca | 3169 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 3170 | } |
wolfSSL | 13:f67a6c6013ca | 3171 | |
wolfSSL | 13:f67a6c6013ca | 3172 | tmp = (byte *)aes->tmp; |
wolfSSL | 13:f67a6c6013ca | 3173 | if (aes->left) { |
wolfSSL | 13:f67a6c6013ca | 3174 | if ((aes->left + sz) >= AES_BLOCK_SIZE) { |
wolfSSL | 13:f67a6c6013ca | 3175 | odd = AES_BLOCK_SIZE - aes->left; |
wolfSSL | 13:f67a6c6013ca | 3176 | } else { |
wolfSSL | 13:f67a6c6013ca | 3177 | odd = sz; |
wolfSSL | 13:f67a6c6013ca | 3178 | } |
wolfSSL | 13:f67a6c6013ca | 3179 | XMEMCPY(tmp + aes->left, in, odd); |
wolfSSL | 13:f67a6c6013ca | 3180 | if ((odd + aes->left) == AES_BLOCK_SIZE) { |
wolfSSL | 13:f67a6c6013ca | 3181 | ret = wc_Pic32AesCrypt( |
wolfSSL | 13:f67a6c6013ca | 3182 | aes->key_ce, aes->keylen, aes->iv_ce, AES_BLOCK_SIZE, |
wolfSSL | 13:f67a6c6013ca | 3183 | out_block, tmp, AES_BLOCK_SIZE, |
wolfSSL | 13:f67a6c6013ca | 3184 | PIC32_ENCRYPTION, PIC32_ALGO_AES, PIC32_CRYPTOALGO_RCTR); |
wolfSSL | 13:f67a6c6013ca | 3185 | XMEMCPY(out, out_block + aes->left, odd); |
wolfSSL | 13:f67a6c6013ca | 3186 | aes->left = 0; |
wolfSSL | 13:f67a6c6013ca | 3187 | XMEMSET(tmp, 0x0, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 3188 | Pic32AesIncIV(aes); |
wolfSSL | 13:f67a6c6013ca | 3189 | } |
wolfSSL | 13:f67a6c6013ca | 3190 | in += odd; |
wolfSSL | 13:f67a6c6013ca | 3191 | out+= odd; |
wolfSSL | 13:f67a6c6013ca | 3192 | sz -= odd; |
wolfSSL | 13:f67a6c6013ca | 3193 | } |
wolfSSL | 13:f67a6c6013ca | 3194 | |
wolfSSL | 13:f67a6c6013ca | 3195 | blocks = sz / AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 3196 | if (blocks) { |
wolfSSL | 13:f67a6c6013ca | 3197 | even = blocks * AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 3198 | ret = wc_Pic32AesCrypt( |
wolfSSL | 13:f67a6c6013ca | 3199 | aes->key_ce, aes->keylen, aes->iv_ce, AES_BLOCK_SIZE, |
wolfSSL | 13:f67a6c6013ca | 3200 | out, in, even, |
wolfSSL | 13:f67a6c6013ca | 3201 | PIC32_ENCRYPTION, PIC32_ALGO_AES, PIC32_CRYPTOALGO_RCTR); |
wolfSSL | 13:f67a6c6013ca | 3202 | out += even; |
wolfSSL | 13:f67a6c6013ca | 3203 | in += even; |
wolfSSL | 13:f67a6c6013ca | 3204 | do { |
wolfSSL | 13:f67a6c6013ca | 3205 | Pic32AesIncIV(aes); |
wolfSSL | 13:f67a6c6013ca | 3206 | even -= AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 3207 | } while (even > 0); |
wolfSSL | 13:f67a6c6013ca | 3208 | } |
wolfSSL | 13:f67a6c6013ca | 3209 | |
wolfSSL | 13:f67a6c6013ca | 3210 | /* if there is tail fragment */ |
wolfSSL | 13:f67a6c6013ca | 3211 | odd = sz % AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 3212 | if (odd) { |
wolfSSL | 13:f67a6c6013ca | 3213 | XMEMSET(tmp + aes->left, 0x0, AES_BLOCK_SIZE - aes->left); |
wolfSSL | 13:f67a6c6013ca | 3214 | XMEMCPY(tmp + aes->left, in, odd); |
wolfSSL | 13:f67a6c6013ca | 3215 | ret = wc_Pic32AesCrypt( |
wolfSSL | 13:f67a6c6013ca | 3216 | aes->key_ce, aes->keylen, aes->iv_ce, AES_BLOCK_SIZE, |
wolfSSL | 13:f67a6c6013ca | 3217 | out_block, tmp, AES_BLOCK_SIZE, |
wolfSSL | 13:f67a6c6013ca | 3218 | PIC32_ENCRYPTION, PIC32_ALGO_AES, PIC32_CRYPTOALGO_RCTR); |
wolfSSL | 13:f67a6c6013ca | 3219 | XMEMCPY(out, out_block + aes->left, odd); |
wolfSSL | 13:f67a6c6013ca | 3220 | aes->left += odd; |
wolfSSL | 13:f67a6c6013ca | 3221 | } |
wolfSSL | 13:f67a6c6013ca | 3222 | |
wolfSSL | 13:f67a6c6013ca | 3223 | return ret; |
wolfSSL | 13:f67a6c6013ca | 3224 | } |
wolfSSL | 13:f67a6c6013ca | 3225 | |
wolfSSL | 13:f67a6c6013ca | 3226 | #elif defined(HAVE_COLDFIRE_SEC) |
wolfSSL | 13:f67a6c6013ca | 3227 | #error "Coldfire SEC doesn't currently support AES-CTR mode" |
wolfSSL | 13:f67a6c6013ca | 3228 | |
wolfSSL | 13:f67a6c6013ca | 3229 | #elif defined(FREESCALE_LTC) |
wolfSSL | 13:f67a6c6013ca | 3230 | int wc_AesCtrEncrypt(Aes* aes, byte* out, const byte* in, word32 sz) |
wolfSSL | 13:f67a6c6013ca | 3231 | { |
wolfSSL | 13:f67a6c6013ca | 3232 | uint32_t keySize; |
wolfSSL | 13:f67a6c6013ca | 3233 | byte *iv, *enc_key; |
wolfSSL | 13:f67a6c6013ca | 3234 | byte* tmp; |
wolfSSL | 13:f67a6c6013ca | 3235 | |
wolfSSL | 13:f67a6c6013ca | 3236 | if (aes == NULL || out == NULL || in == NULL) { |
wolfSSL | 13:f67a6c6013ca | 3237 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 3238 | } |
wolfSSL | 13:f67a6c6013ca | 3239 | tmp = (byte*)aes->tmp + AES_BLOCK_SIZE - aes->left; |
wolfSSL | 13:f67a6c6013ca | 3240 | |
wolfSSL | 13:f67a6c6013ca | 3241 | /* consume any unused bytes left in aes->tmp */ |
wolfSSL | 13:f67a6c6013ca | 3242 | while (aes->left && sz) { |
wolfSSL | 13:f67a6c6013ca | 3243 | *(out++) = *(in++) ^ *(tmp++); |
wolfSSL | 13:f67a6c6013ca | 3244 | aes->left--; |
wolfSSL | 13:f67a6c6013ca | 3245 | sz--; |
wolfSSL | 13:f67a6c6013ca | 3246 | } |
wolfSSL | 13:f67a6c6013ca | 3247 | |
wolfSSL | 13:f67a6c6013ca | 3248 | if (sz) { |
wolfSSL | 13:f67a6c6013ca | 3249 | iv = (byte*)aes->reg; |
wolfSSL | 13:f67a6c6013ca | 3250 | enc_key = (byte*)aes->key; |
wolfSSL | 13:f67a6c6013ca | 3251 | |
wolfSSL | 13:f67a6c6013ca | 3252 | wc_AesGetKeySize(aes, &keySize); |
wolfSSL | 13:f67a6c6013ca | 3253 | |
wolfSSL | 13:f67a6c6013ca | 3254 | LTC_AES_CryptCtr(LTC_BASE, in, out, sz, |
wolfSSL | 13:f67a6c6013ca | 3255 | iv, enc_key, keySize, (byte*)aes->tmp, |
wolfSSL | 13:f67a6c6013ca | 3256 | (uint32_t*)&(aes->left)); |
wolfSSL | 13:f67a6c6013ca | 3257 | } |
wolfSSL | 13:f67a6c6013ca | 3258 | |
wolfSSL | 13:f67a6c6013ca | 3259 | return 0; |
wolfSSL | 13:f67a6c6013ca | 3260 | } |
wolfSSL | 13:f67a6c6013ca | 3261 | |
wolfSSL | 13:f67a6c6013ca | 3262 | #else |
wolfSSL | 13:f67a6c6013ca | 3263 | /* Increment AES counter */ |
wolfSSL | 13:f67a6c6013ca | 3264 | static INLINE void IncrementAesCounter(byte* inOutCtr) |
wolfSSL | 13:f67a6c6013ca | 3265 | { |
wolfSSL | 13:f67a6c6013ca | 3266 | int i; |
wolfSSL | 13:f67a6c6013ca | 3267 | |
wolfSSL | 13:f67a6c6013ca | 3268 | /* in network byte order so start at end and work back */ |
wolfSSL | 13:f67a6c6013ca | 3269 | for (i = AES_BLOCK_SIZE - 1; i >= 0; i--) { |
wolfSSL | 13:f67a6c6013ca | 3270 | if (++inOutCtr[i]) /* we're done unless we overflow */ |
wolfSSL | 13:f67a6c6013ca | 3271 | return; |
wolfSSL | 13:f67a6c6013ca | 3272 | } |
wolfSSL | 13:f67a6c6013ca | 3273 | } |
wolfSSL | 13:f67a6c6013ca | 3274 | |
wolfSSL | 13:f67a6c6013ca | 3275 | int wc_AesCtrEncrypt(Aes* aes, byte* out, const byte* in, word32 sz) |
wolfSSL | 13:f67a6c6013ca | 3276 | { |
wolfSSL | 13:f67a6c6013ca | 3277 | byte* tmp; |
wolfSSL | 13:f67a6c6013ca | 3278 | |
wolfSSL | 13:f67a6c6013ca | 3279 | if (aes == NULL || out == NULL || in == NULL) { |
wolfSSL | 13:f67a6c6013ca | 3280 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 3281 | } |
wolfSSL | 13:f67a6c6013ca | 3282 | tmp = (byte*)aes->tmp + AES_BLOCK_SIZE - aes->left; |
wolfSSL | 13:f67a6c6013ca | 3283 | |
wolfSSL | 13:f67a6c6013ca | 3284 | /* consume any unused bytes left in aes->tmp */ |
wolfSSL | 13:f67a6c6013ca | 3285 | while (aes->left && sz) { |
wolfSSL | 13:f67a6c6013ca | 3286 | *(out++) = *(in++) ^ *(tmp++); |
wolfSSL | 13:f67a6c6013ca | 3287 | aes->left--; |
wolfSSL | 13:f67a6c6013ca | 3288 | sz--; |
wolfSSL | 13:f67a6c6013ca | 3289 | } |
wolfSSL | 13:f67a6c6013ca | 3290 | |
wolfSSL | 13:f67a6c6013ca | 3291 | /* do as many block size ops as possible */ |
wolfSSL | 13:f67a6c6013ca | 3292 | while (sz >= AES_BLOCK_SIZE) { |
wolfSSL | 13:f67a6c6013ca | 3293 | wc_AesEncrypt(aes, (byte*)aes->reg, out); |
wolfSSL | 13:f67a6c6013ca | 3294 | IncrementAesCounter((byte*)aes->reg); |
wolfSSL | 13:f67a6c6013ca | 3295 | xorbuf(out, in, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 3296 | |
wolfSSL | 13:f67a6c6013ca | 3297 | out += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 3298 | in += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 3299 | sz -= AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 3300 | aes->left = 0; |
wolfSSL | 13:f67a6c6013ca | 3301 | } |
wolfSSL | 13:f67a6c6013ca | 3302 | |
wolfSSL | 13:f67a6c6013ca | 3303 | /* handle non block size remaining and store unused byte count in left */ |
wolfSSL | 13:f67a6c6013ca | 3304 | if (sz) { |
wolfSSL | 13:f67a6c6013ca | 3305 | wc_AesEncrypt(aes, (byte*)aes->reg, (byte*)aes->tmp); |
wolfSSL | 13:f67a6c6013ca | 3306 | IncrementAesCounter((byte*)aes->reg); |
wolfSSL | 13:f67a6c6013ca | 3307 | |
wolfSSL | 13:f67a6c6013ca | 3308 | aes->left = AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 3309 | tmp = (byte*)aes->tmp; |
wolfSSL | 13:f67a6c6013ca | 3310 | |
wolfSSL | 13:f67a6c6013ca | 3311 | while (sz--) { |
wolfSSL | 13:f67a6c6013ca | 3312 | *(out++) = *(in++) ^ *(tmp++); |
wolfSSL | 13:f67a6c6013ca | 3313 | aes->left--; |
wolfSSL | 13:f67a6c6013ca | 3314 | } |
wolfSSL | 13:f67a6c6013ca | 3315 | } |
wolfSSL | 13:f67a6c6013ca | 3316 | |
wolfSSL | 13:f67a6c6013ca | 3317 | return 0; |
wolfSSL | 13:f67a6c6013ca | 3318 | } |
wolfSSL | 13:f67a6c6013ca | 3319 | |
wolfSSL | 13:f67a6c6013ca | 3320 | #endif /* AES-CTR block */ |
wolfSSL | 13:f67a6c6013ca | 3321 | |
wolfSSL | 13:f67a6c6013ca | 3322 | #endif /* WOLFSSL_AES_COUNTER */ |
wolfSSL | 13:f67a6c6013ca | 3323 | |
wolfSSL | 13:f67a6c6013ca | 3324 | |
wolfSSL | 13:f67a6c6013ca | 3325 | #ifdef HAVE_AESGCM |
wolfSSL | 13:f67a6c6013ca | 3326 | |
wolfSSL | 13:f67a6c6013ca | 3327 | /* |
wolfSSL | 13:f67a6c6013ca | 3328 | * The IV for AES GCM, stored in struct Aes's member reg, is comprised of |
wolfSSL | 13:f67a6c6013ca | 3329 | * three parts in order: |
wolfSSL | 13:f67a6c6013ca | 3330 | * 1. The implicit IV. This is generated from the PRF using the shared |
wolfSSL | 13:f67a6c6013ca | 3331 | * secrets between endpoints. It is 4 bytes long. |
wolfSSL | 13:f67a6c6013ca | 3332 | * 2. The explicit IV. This is set by the user of the AES. It needs to be |
wolfSSL | 13:f67a6c6013ca | 3333 | * unique for each call to encrypt. The explicit IV is shared with the |
wolfSSL | 13:f67a6c6013ca | 3334 | * other end of the transaction in the clear. |
wolfSSL | 13:f67a6c6013ca | 3335 | * 3. The counter. Each block of data is encrypted with its own sequence |
wolfSSL | 13:f67a6c6013ca | 3336 | * number counter. |
wolfSSL | 13:f67a6c6013ca | 3337 | */ |
wolfSSL | 13:f67a6c6013ca | 3338 | |
wolfSSL | 13:f67a6c6013ca | 3339 | #if defined(HAVE_COLDFIRE_SEC) |
wolfSSL | 13:f67a6c6013ca | 3340 | #error "Coldfire SEC doesn't currently support AES-GCM mode" |
wolfSSL | 13:f67a6c6013ca | 3341 | |
wolfSSL | 13:f67a6c6013ca | 3342 | #elif defined(WOLFSSL_NRF51_AES) |
wolfSSL | 13:f67a6c6013ca | 3343 | #error "nRF51 doesn't currently support AES-GCM mode" |
wolfSSL | 13:f67a6c6013ca | 3344 | |
wolfSSL | 13:f67a6c6013ca | 3345 | #endif |
wolfSSL | 13:f67a6c6013ca | 3346 | |
wolfSSL | 13:f67a6c6013ca | 3347 | enum { |
wolfSSL | 13:f67a6c6013ca | 3348 | NONCE_SZ = 12, |
wolfSSL | 13:f67a6c6013ca | 3349 | CTR_SZ = 4 |
wolfSSL | 13:f67a6c6013ca | 3350 | }; |
wolfSSL | 13:f67a6c6013ca | 3351 | |
wolfSSL | 13:f67a6c6013ca | 3352 | #if !defined(FREESCALE_LTC_AES_GCM) |
wolfSSL | 13:f67a6c6013ca | 3353 | static INLINE void IncrementGcmCounter(byte* inOutCtr) |
wolfSSL | 13:f67a6c6013ca | 3354 | { |
wolfSSL | 13:f67a6c6013ca | 3355 | int i; |
wolfSSL | 13:f67a6c6013ca | 3356 | |
wolfSSL | 13:f67a6c6013ca | 3357 | /* in network byte order so start at end and work back */ |
wolfSSL | 13:f67a6c6013ca | 3358 | for (i = AES_BLOCK_SIZE - 1; i >= AES_BLOCK_SIZE - CTR_SZ; i--) { |
wolfSSL | 13:f67a6c6013ca | 3359 | if (++inOutCtr[i]) /* we're done unless we overflow */ |
wolfSSL | 13:f67a6c6013ca | 3360 | return; |
wolfSSL | 13:f67a6c6013ca | 3361 | } |
wolfSSL | 13:f67a6c6013ca | 3362 | } |
wolfSSL | 13:f67a6c6013ca | 3363 | #endif /* !FREESCALE_LTC_AES_GCM */ |
wolfSSL | 13:f67a6c6013ca | 3364 | |
wolfSSL | 13:f67a6c6013ca | 3365 | #if defined(GCM_SMALL) || defined(GCM_TABLE) |
wolfSSL | 13:f67a6c6013ca | 3366 | |
wolfSSL | 13:f67a6c6013ca | 3367 | static INLINE void FlattenSzInBits(byte* buf, word32 sz) |
wolfSSL | 13:f67a6c6013ca | 3368 | { |
wolfSSL | 13:f67a6c6013ca | 3369 | /* Multiply the sz by 8 */ |
wolfSSL | 13:f67a6c6013ca | 3370 | word32 szHi = (sz >> (8*sizeof(sz) - 3)); |
wolfSSL | 13:f67a6c6013ca | 3371 | sz <<= 3; |
wolfSSL | 13:f67a6c6013ca | 3372 | |
wolfSSL | 13:f67a6c6013ca | 3373 | /* copy over the words of the sz into the destination buffer */ |
wolfSSL | 13:f67a6c6013ca | 3374 | buf[0] = (szHi >> 24) & 0xff; |
wolfSSL | 13:f67a6c6013ca | 3375 | buf[1] = (szHi >> 16) & 0xff; |
wolfSSL | 13:f67a6c6013ca | 3376 | buf[2] = (szHi >> 8) & 0xff; |
wolfSSL | 13:f67a6c6013ca | 3377 | buf[3] = szHi & 0xff; |
wolfSSL | 13:f67a6c6013ca | 3378 | buf[4] = (sz >> 24) & 0xff; |
wolfSSL | 13:f67a6c6013ca | 3379 | buf[5] = (sz >> 16) & 0xff; |
wolfSSL | 13:f67a6c6013ca | 3380 | buf[6] = (sz >> 8) & 0xff; |
wolfSSL | 13:f67a6c6013ca | 3381 | buf[7] = sz & 0xff; |
wolfSSL | 13:f67a6c6013ca | 3382 | } |
wolfSSL | 13:f67a6c6013ca | 3383 | |
wolfSSL | 13:f67a6c6013ca | 3384 | |
wolfSSL | 13:f67a6c6013ca | 3385 | static INLINE void RIGHTSHIFTX(byte* x) |
wolfSSL | 13:f67a6c6013ca | 3386 | { |
wolfSSL | 13:f67a6c6013ca | 3387 | int i; |
wolfSSL | 13:f67a6c6013ca | 3388 | int carryOut = 0; |
wolfSSL | 13:f67a6c6013ca | 3389 | int carryIn = 0; |
wolfSSL | 13:f67a6c6013ca | 3390 | int borrow = x[15] & 0x01; |
wolfSSL | 13:f67a6c6013ca | 3391 | |
wolfSSL | 13:f67a6c6013ca | 3392 | for (i = 0; i < AES_BLOCK_SIZE; i++) { |
wolfSSL | 13:f67a6c6013ca | 3393 | carryOut = x[i] & 0x01; |
wolfSSL | 13:f67a6c6013ca | 3394 | x[i] = (x[i] >> 1) | (carryIn ? 0x80 : 0); |
wolfSSL | 13:f67a6c6013ca | 3395 | carryIn = carryOut; |
wolfSSL | 13:f67a6c6013ca | 3396 | } |
wolfSSL | 13:f67a6c6013ca | 3397 | if (borrow) x[0] ^= 0xE1; |
wolfSSL | 13:f67a6c6013ca | 3398 | } |
wolfSSL | 13:f67a6c6013ca | 3399 | |
wolfSSL | 13:f67a6c6013ca | 3400 | #endif /* defined(GCM_SMALL) || defined(GCM_TABLE) */ |
wolfSSL | 13:f67a6c6013ca | 3401 | |
wolfSSL | 13:f67a6c6013ca | 3402 | |
wolfSSL | 13:f67a6c6013ca | 3403 | #ifdef GCM_TABLE |
wolfSSL | 13:f67a6c6013ca | 3404 | |
wolfSSL | 13:f67a6c6013ca | 3405 | static void GenerateM0(Aes* aes) |
wolfSSL | 13:f67a6c6013ca | 3406 | { |
wolfSSL | 13:f67a6c6013ca | 3407 | int i, j; |
wolfSSL | 13:f67a6c6013ca | 3408 | byte (*m)[AES_BLOCK_SIZE] = aes->M0; |
wolfSSL | 13:f67a6c6013ca | 3409 | |
wolfSSL | 13:f67a6c6013ca | 3410 | XMEMCPY(m[128], aes->H, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 3411 | |
wolfSSL | 13:f67a6c6013ca | 3412 | for (i = 64; i > 0; i /= 2) { |
wolfSSL | 13:f67a6c6013ca | 3413 | XMEMCPY(m[i], m[i*2], AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 3414 | RIGHTSHIFTX(m[i]); |
wolfSSL | 13:f67a6c6013ca | 3415 | } |
wolfSSL | 13:f67a6c6013ca | 3416 | |
wolfSSL | 13:f67a6c6013ca | 3417 | for (i = 2; i < 256; i *= 2) { |
wolfSSL | 13:f67a6c6013ca | 3418 | for (j = 1; j < i; j++) { |
wolfSSL | 13:f67a6c6013ca | 3419 | XMEMCPY(m[i+j], m[i], AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 3420 | xorbuf(m[i+j], m[j], AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 3421 | } |
wolfSSL | 13:f67a6c6013ca | 3422 | } |
wolfSSL | 13:f67a6c6013ca | 3423 | |
wolfSSL | 13:f67a6c6013ca | 3424 | XMEMSET(m[0], 0, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 3425 | } |
wolfSSL | 13:f67a6c6013ca | 3426 | |
wolfSSL | 13:f67a6c6013ca | 3427 | #endif /* GCM_TABLE */ |
wolfSSL | 13:f67a6c6013ca | 3428 | |
wolfSSL | 13:f67a6c6013ca | 3429 | |
wolfSSL | 13:f67a6c6013ca | 3430 | int wc_AesGcmSetKey(Aes* aes, const byte* key, word32 len) |
wolfSSL | 13:f67a6c6013ca | 3431 | { |
wolfSSL | 13:f67a6c6013ca | 3432 | int ret; |
wolfSSL | 13:f67a6c6013ca | 3433 | byte iv[AES_BLOCK_SIZE]; |
wolfSSL | 13:f67a6c6013ca | 3434 | |
wolfSSL | 13:f67a6c6013ca | 3435 | if (!((len == 16) || (len == 24) || (len == 32))) |
wolfSSL | 13:f67a6c6013ca | 3436 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 3437 | |
wolfSSL | 13:f67a6c6013ca | 3438 | XMEMSET(iv, 0, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 3439 | ret = wc_AesSetKey(aes, key, len, iv, AES_ENCRYPTION); |
wolfSSL | 13:f67a6c6013ca | 3440 | |
wolfSSL | 13:f67a6c6013ca | 3441 | #ifdef WOLFSSL_AESNI |
wolfSSL | 13:f67a6c6013ca | 3442 | /* AES-NI code generates its own H value. */ |
wolfSSL | 13:f67a6c6013ca | 3443 | if (haveAESNI) |
wolfSSL | 13:f67a6c6013ca | 3444 | return ret; |
wolfSSL | 13:f67a6c6013ca | 3445 | #endif /* WOLFSSL_AESNI */ |
wolfSSL | 13:f67a6c6013ca | 3446 | |
wolfSSL | 13:f67a6c6013ca | 3447 | #if !defined(FREESCALE_LTC_AES_GCM) |
wolfSSL | 13:f67a6c6013ca | 3448 | if (ret == 0) { |
wolfSSL | 13:f67a6c6013ca | 3449 | wc_AesEncrypt(aes, iv, aes->H); |
wolfSSL | 13:f67a6c6013ca | 3450 | #ifdef GCM_TABLE |
wolfSSL | 13:f67a6c6013ca | 3451 | GenerateM0(aes); |
wolfSSL | 13:f67a6c6013ca | 3452 | #endif /* GCM_TABLE */ |
wolfSSL | 13:f67a6c6013ca | 3453 | } |
wolfSSL | 13:f67a6c6013ca | 3454 | #endif /* FREESCALE_LTC_AES_GCM */ |
wolfSSL | 13:f67a6c6013ca | 3455 | |
wolfSSL | 13:f67a6c6013ca | 3456 | #if defined(WOLFSSL_XILINX_CRYPT) |
wolfSSL | 13:f67a6c6013ca | 3457 | wc_AesGcmSetKey_ex(aes, key, len, XSECURE_CSU_AES_KEY_SRC_KUP); |
wolfSSL | 13:f67a6c6013ca | 3458 | #endif |
wolfSSL | 13:f67a6c6013ca | 3459 | |
wolfSSL | 13:f67a6c6013ca | 3460 | return ret; |
wolfSSL | 13:f67a6c6013ca | 3461 | } |
wolfSSL | 13:f67a6c6013ca | 3462 | |
wolfSSL | 13:f67a6c6013ca | 3463 | |
wolfSSL | 13:f67a6c6013ca | 3464 | #ifdef WOLFSSL_AESNI |
wolfSSL | 13:f67a6c6013ca | 3465 | |
wolfSSL | 13:f67a6c6013ca | 3466 | #if defined(USE_INTEL_SPEEDUP) |
wolfSSL | 13:f67a6c6013ca | 3467 | #define HAVE_INTEL_AVX1 |
wolfSSL | 13:f67a6c6013ca | 3468 | #define HAVE_INTEL_AVX2 |
wolfSSL | 13:f67a6c6013ca | 3469 | |
wolfSSL | 13:f67a6c6013ca | 3470 | /* CLANG has AES GCM failure with AVX2 speedups */ |
wolfSSL | 13:f67a6c6013ca | 3471 | #ifdef __clang__ |
wolfSSL | 13:f67a6c6013ca | 3472 | #undef AES_GCM_AVX2_NO_UNROLL |
wolfSSL | 13:f67a6c6013ca | 3473 | #define AES_GCM_AVX2_NO_UNROLL |
wolfSSL | 13:f67a6c6013ca | 3474 | #endif |
wolfSSL | 13:f67a6c6013ca | 3475 | #endif /* USE_INTEL_SPEEDUP */ |
wolfSSL | 13:f67a6c6013ca | 3476 | |
wolfSSL | 13:f67a6c6013ca | 3477 | static const __m128i MOD2_128 = { 0x1, 0xc200000000000000UL }; |
wolfSSL | 13:f67a6c6013ca | 3478 | |
wolfSSL | 13:f67a6c6013ca | 3479 | static __m128i gfmul_sw(__m128i a, __m128i b) |
wolfSSL | 13:f67a6c6013ca | 3480 | { |
wolfSSL | 13:f67a6c6013ca | 3481 | __m128i r, t1, t2, t3, t4, t5, t6, t7; |
wolfSSL | 13:f67a6c6013ca | 3482 | #ifndef WOLFSSL_AES_GCM_SLOW_CLMUL |
wolfSSL | 13:f67a6c6013ca | 3483 | /* 128 x 128 Carryless Multiply */ |
wolfSSL | 13:f67a6c6013ca | 3484 | t3 = _mm_clmulepi64_si128(a, b, 0x10); |
wolfSSL | 13:f67a6c6013ca | 3485 | t2 = _mm_clmulepi64_si128(a, b, 0x01); |
wolfSSL | 13:f67a6c6013ca | 3486 | t1 = _mm_clmulepi64_si128(a, b, 0x00); |
wolfSSL | 13:f67a6c6013ca | 3487 | t4 = _mm_clmulepi64_si128(a, b, 0x11); |
wolfSSL | 13:f67a6c6013ca | 3488 | t3 = _mm_xor_si128(t3, t2); |
wolfSSL | 13:f67a6c6013ca | 3489 | t2 = _mm_slli_si128(t3, 8); |
wolfSSL | 13:f67a6c6013ca | 3490 | t3 = _mm_srli_si128(t3, 8); |
wolfSSL | 13:f67a6c6013ca | 3491 | t1 = _mm_xor_si128(t1, t2); |
wolfSSL | 13:f67a6c6013ca | 3492 | t4 = _mm_xor_si128(t4, t3); |
wolfSSL | 13:f67a6c6013ca | 3493 | |
wolfSSL | 13:f67a6c6013ca | 3494 | /* shift left 1 bit - bits reversed */ |
wolfSSL | 13:f67a6c6013ca | 3495 | t5 = _mm_srli_epi32(t1, 31); |
wolfSSL | 13:f67a6c6013ca | 3496 | t6 = _mm_srli_epi32(t4, 31); |
wolfSSL | 13:f67a6c6013ca | 3497 | t1 = _mm_slli_epi32(t1, 1); |
wolfSSL | 13:f67a6c6013ca | 3498 | t4 = _mm_slli_epi32(t4, 1); |
wolfSSL | 13:f67a6c6013ca | 3499 | t7 = _mm_srli_si128(t5, 12); |
wolfSSL | 13:f67a6c6013ca | 3500 | t5 = _mm_slli_si128(t5, 4); |
wolfSSL | 13:f67a6c6013ca | 3501 | t6 = _mm_slli_si128(t6, 4); |
wolfSSL | 13:f67a6c6013ca | 3502 | t4 = _mm_or_si128(t4, t7); |
wolfSSL | 13:f67a6c6013ca | 3503 | t1 = _mm_or_si128(t1, t5); |
wolfSSL | 13:f67a6c6013ca | 3504 | t4 = _mm_or_si128(t4, t6); |
wolfSSL | 13:f67a6c6013ca | 3505 | |
wolfSSL | 13:f67a6c6013ca | 3506 | /* Reduction */ |
wolfSSL | 13:f67a6c6013ca | 3507 | t2 = _mm_clmulepi64_si128(t1, MOD2_128, 0x10); |
wolfSSL | 13:f67a6c6013ca | 3508 | t3 = _mm_shuffle_epi32(t1, 78); |
wolfSSL | 13:f67a6c6013ca | 3509 | t3 = _mm_xor_si128(t3, t2); |
wolfSSL | 13:f67a6c6013ca | 3510 | t2 = _mm_clmulepi64_si128(t3, MOD2_128, 0x10); |
wolfSSL | 13:f67a6c6013ca | 3511 | t3 = _mm_shuffle_epi32(t3, 78); |
wolfSSL | 13:f67a6c6013ca | 3512 | t3 = _mm_xor_si128(t3, t2); |
wolfSSL | 13:f67a6c6013ca | 3513 | r = _mm_xor_si128(t4, t3); |
wolfSSL | 13:f67a6c6013ca | 3514 | #else |
wolfSSL | 13:f67a6c6013ca | 3515 | t2 = _mm_shuffle_epi32(b, 78); |
wolfSSL | 13:f67a6c6013ca | 3516 | t3 = _mm_shuffle_epi32(a, 78); |
wolfSSL | 13:f67a6c6013ca | 3517 | t2 = _mm_xor_si128(t2, b); |
wolfSSL | 13:f67a6c6013ca | 3518 | t3 = _mm_xor_si128(t3, a); |
wolfSSL | 13:f67a6c6013ca | 3519 | t4 = _mm_clmulepi64_si128(b, a, 0x11); |
wolfSSL | 13:f67a6c6013ca | 3520 | t1 = _mm_clmulepi64_si128(b, a, 0x00); |
wolfSSL | 13:f67a6c6013ca | 3521 | t2 = _mm_clmulepi64_si128(t2, t3, 0x00); |
wolfSSL | 13:f67a6c6013ca | 3522 | t2 = _mm_xor_si128(t2, t1); |
wolfSSL | 13:f67a6c6013ca | 3523 | t2 = _mm_xor_si128(t2, t4); |
wolfSSL | 13:f67a6c6013ca | 3524 | t3 = _mm_slli_si128(t2, 8); |
wolfSSL | 13:f67a6c6013ca | 3525 | t2 = _mm_srli_si128(t2, 8); |
wolfSSL | 13:f67a6c6013ca | 3526 | t1 = _mm_xor_si128(t1, t3); |
wolfSSL | 13:f67a6c6013ca | 3527 | t4 = _mm_xor_si128(t4, t2); |
wolfSSL | 13:f67a6c6013ca | 3528 | |
wolfSSL | 13:f67a6c6013ca | 3529 | t5 = _mm_srli_epi32(t1, 31); |
wolfSSL | 13:f67a6c6013ca | 3530 | t6 = _mm_srli_epi32(t4, 31); |
wolfSSL | 13:f67a6c6013ca | 3531 | t1 = _mm_slli_epi32(t1, 1); |
wolfSSL | 13:f67a6c6013ca | 3532 | t4 = _mm_slli_epi32(t4, 1); |
wolfSSL | 13:f67a6c6013ca | 3533 | t7 = _mm_srli_si128(t5, 12); |
wolfSSL | 13:f67a6c6013ca | 3534 | t5 = _mm_slli_si128(t5, 4); |
wolfSSL | 13:f67a6c6013ca | 3535 | t6 = _mm_slli_si128(t6, 4); |
wolfSSL | 13:f67a6c6013ca | 3536 | t4 = _mm_or_si128(t4, t7); |
wolfSSL | 13:f67a6c6013ca | 3537 | t1 = _mm_or_si128(t1, t5); |
wolfSSL | 13:f67a6c6013ca | 3538 | t4 = _mm_or_si128(t4, t6); |
wolfSSL | 13:f67a6c6013ca | 3539 | |
wolfSSL | 13:f67a6c6013ca | 3540 | t5 = _mm_slli_epi32(t1, 31); |
wolfSSL | 13:f67a6c6013ca | 3541 | t6 = _mm_slli_epi32(t1, 30); |
wolfSSL | 13:f67a6c6013ca | 3542 | t7 = _mm_slli_epi32(t1, 25); |
wolfSSL | 13:f67a6c6013ca | 3543 | t5 = _mm_xor_si128(t5, t6); |
wolfSSL | 13:f67a6c6013ca | 3544 | t5 = _mm_xor_si128(t5, t7); |
wolfSSL | 13:f67a6c6013ca | 3545 | |
wolfSSL | 13:f67a6c6013ca | 3546 | t6 = _mm_srli_si128(t5, 4); |
wolfSSL | 13:f67a6c6013ca | 3547 | t5 = _mm_slli_si128(t5, 12); |
wolfSSL | 13:f67a6c6013ca | 3548 | t1 = _mm_xor_si128(t1, t5); |
wolfSSL | 13:f67a6c6013ca | 3549 | t7 = _mm_srli_epi32(t1, 1); |
wolfSSL | 13:f67a6c6013ca | 3550 | t3 = _mm_srli_epi32(t1, 2); |
wolfSSL | 13:f67a6c6013ca | 3551 | t2 = _mm_srli_epi32(t1, 7); |
wolfSSL | 13:f67a6c6013ca | 3552 | |
wolfSSL | 13:f67a6c6013ca | 3553 | t7 = _mm_xor_si128(t7, t3); |
wolfSSL | 13:f67a6c6013ca | 3554 | t7 = _mm_xor_si128(t7, t2); |
wolfSSL | 13:f67a6c6013ca | 3555 | t7 = _mm_xor_si128(t7, t6); |
wolfSSL | 13:f67a6c6013ca | 3556 | t7 = _mm_xor_si128(t7, t1); |
wolfSSL | 13:f67a6c6013ca | 3557 | r = _mm_xor_si128(t4, t7); |
wolfSSL | 13:f67a6c6013ca | 3558 | #endif |
wolfSSL | 13:f67a6c6013ca | 3559 | |
wolfSSL | 13:f67a6c6013ca | 3560 | return r; |
wolfSSL | 13:f67a6c6013ca | 3561 | } |
wolfSSL | 13:f67a6c6013ca | 3562 | |
wolfSSL | 13:f67a6c6013ca | 3563 | static void gfmul_only(__m128i a, __m128i b, __m128i* r0, __m128i* r1) |
wolfSSL | 13:f67a6c6013ca | 3564 | { |
wolfSSL | 13:f67a6c6013ca | 3565 | __m128i t1, t2, t3, t4; |
wolfSSL | 13:f67a6c6013ca | 3566 | |
wolfSSL | 13:f67a6c6013ca | 3567 | /* 128 x 128 Carryless Multiply */ |
wolfSSL | 13:f67a6c6013ca | 3568 | #ifndef WOLFSSL_AES_GCM_SLOW_CLMUL |
wolfSSL | 13:f67a6c6013ca | 3569 | t3 = _mm_clmulepi64_si128(a, b, 0x10); |
wolfSSL | 13:f67a6c6013ca | 3570 | t2 = _mm_clmulepi64_si128(a, b, 0x01); |
wolfSSL | 13:f67a6c6013ca | 3571 | t1 = _mm_clmulepi64_si128(a, b, 0x00); |
wolfSSL | 13:f67a6c6013ca | 3572 | t4 = _mm_clmulepi64_si128(a, b, 0x11); |
wolfSSL | 13:f67a6c6013ca | 3573 | t3 = _mm_xor_si128(t3, t2); |
wolfSSL | 13:f67a6c6013ca | 3574 | t2 = _mm_slli_si128(t3, 8); |
wolfSSL | 13:f67a6c6013ca | 3575 | t3 = _mm_srli_si128(t3, 8); |
wolfSSL | 13:f67a6c6013ca | 3576 | t1 = _mm_xor_si128(t1, t2); |
wolfSSL | 13:f67a6c6013ca | 3577 | t4 = _mm_xor_si128(t4, t3); |
wolfSSL | 13:f67a6c6013ca | 3578 | #else |
wolfSSL | 13:f67a6c6013ca | 3579 | t2 = _mm_shuffle_epi32(b, 78); |
wolfSSL | 13:f67a6c6013ca | 3580 | t3 = _mm_shuffle_epi32(a, 78); |
wolfSSL | 13:f67a6c6013ca | 3581 | t2 = _mm_xor_si128(t2, b); |
wolfSSL | 13:f67a6c6013ca | 3582 | t3 = _mm_xor_si128(t3, a); |
wolfSSL | 13:f67a6c6013ca | 3583 | t4 = _mm_clmulepi64_si128(b, a, 0x11); |
wolfSSL | 13:f67a6c6013ca | 3584 | t1 = _mm_clmulepi64_si128(b, a, 0x00); |
wolfSSL | 13:f67a6c6013ca | 3585 | t2 = _mm_clmulepi64_si128(t2, t3, 0x00); |
wolfSSL | 13:f67a6c6013ca | 3586 | t2 = _mm_xor_si128(t2, t1); |
wolfSSL | 13:f67a6c6013ca | 3587 | t2 = _mm_xor_si128(t2, t4); |
wolfSSL | 13:f67a6c6013ca | 3588 | t3 = _mm_slli_si128(t2, 8); |
wolfSSL | 13:f67a6c6013ca | 3589 | t2 = _mm_srli_si128(t2, 8); |
wolfSSL | 13:f67a6c6013ca | 3590 | t1 = _mm_xor_si128(t1, t3); |
wolfSSL | 13:f67a6c6013ca | 3591 | t4 = _mm_xor_si128(t4, t2); |
wolfSSL | 13:f67a6c6013ca | 3592 | #endif |
wolfSSL | 13:f67a6c6013ca | 3593 | *r0 = _mm_xor_si128(t1, *r0); |
wolfSSL | 13:f67a6c6013ca | 3594 | *r1 = _mm_xor_si128(t4, *r1); |
wolfSSL | 13:f67a6c6013ca | 3595 | } |
wolfSSL | 13:f67a6c6013ca | 3596 | |
wolfSSL | 13:f67a6c6013ca | 3597 | static __m128i gfmul_shl1(__m128i a) |
wolfSSL | 13:f67a6c6013ca | 3598 | { |
wolfSSL | 13:f67a6c6013ca | 3599 | __m128i t1 = a, t2; |
wolfSSL | 13:f67a6c6013ca | 3600 | t2 = _mm_srli_epi64(t1, 63); |
wolfSSL | 13:f67a6c6013ca | 3601 | t1 = _mm_slli_epi64(t1, 1); |
wolfSSL | 13:f67a6c6013ca | 3602 | t2 = _mm_slli_si128(t2, 8); |
wolfSSL | 13:f67a6c6013ca | 3603 | t1 = _mm_or_si128(t1, t2); |
wolfSSL | 13:f67a6c6013ca | 3604 | /* if (a[1] >> 63) t1 = _mm_xor_si128(t1, MOD2_128); */ |
wolfSSL | 13:f67a6c6013ca | 3605 | a = _mm_shuffle_epi32(a, 0xff); |
wolfSSL | 13:f67a6c6013ca | 3606 | a = _mm_srai_epi32(a, 31); |
wolfSSL | 13:f67a6c6013ca | 3607 | a = _mm_and_si128(a, MOD2_128); |
wolfSSL | 13:f67a6c6013ca | 3608 | t1 = _mm_xor_si128(t1, a); |
wolfSSL | 13:f67a6c6013ca | 3609 | return t1; |
wolfSSL | 13:f67a6c6013ca | 3610 | } |
wolfSSL | 13:f67a6c6013ca | 3611 | |
wolfSSL | 13:f67a6c6013ca | 3612 | static __m128i ghash_red(__m128i r0, __m128i r1) |
wolfSSL | 13:f67a6c6013ca | 3613 | { |
wolfSSL | 13:f67a6c6013ca | 3614 | __m128i t2, t3; |
wolfSSL | 13:f67a6c6013ca | 3615 | #ifndef WOLFSSL_AES_GCM_SLOW_CLMUL |
wolfSSL | 13:f67a6c6013ca | 3616 | t2 = _mm_clmulepi64_si128(r0, MOD2_128, 0x10); |
wolfSSL | 13:f67a6c6013ca | 3617 | t3 = _mm_shuffle_epi32(r0, 78); |
wolfSSL | 13:f67a6c6013ca | 3618 | t3 = _mm_xor_si128(t3, t2); |
wolfSSL | 13:f67a6c6013ca | 3619 | t2 = _mm_clmulepi64_si128(t3, MOD2_128, 0x10); |
wolfSSL | 13:f67a6c6013ca | 3620 | t3 = _mm_shuffle_epi32(t3, 78); |
wolfSSL | 13:f67a6c6013ca | 3621 | t3 = _mm_xor_si128(t3, t2); |
wolfSSL | 13:f67a6c6013ca | 3622 | return _mm_xor_si128(r1, t3); |
wolfSSL | 13:f67a6c6013ca | 3623 | #else |
wolfSSL | 13:f67a6c6013ca | 3624 | __m128i t5, t6, t7; |
wolfSSL | 13:f67a6c6013ca | 3625 | |
wolfSSL | 13:f67a6c6013ca | 3626 | t5 = _mm_slli_epi32(r0, 31); |
wolfSSL | 13:f67a6c6013ca | 3627 | t6 = _mm_slli_epi32(r0, 30); |
wolfSSL | 13:f67a6c6013ca | 3628 | t7 = _mm_slli_epi32(r0, 25); |
wolfSSL | 13:f67a6c6013ca | 3629 | t5 = _mm_xor_si128(t5, t6); |
wolfSSL | 13:f67a6c6013ca | 3630 | t5 = _mm_xor_si128(t5, t7); |
wolfSSL | 13:f67a6c6013ca | 3631 | |
wolfSSL | 13:f67a6c6013ca | 3632 | t6 = _mm_srli_si128(t5, 4); |
wolfSSL | 13:f67a6c6013ca | 3633 | t5 = _mm_slli_si128(t5, 12); |
wolfSSL | 13:f67a6c6013ca | 3634 | r0 = _mm_xor_si128(r0, t5); |
wolfSSL | 13:f67a6c6013ca | 3635 | t7 = _mm_srli_epi32(r0, 1); |
wolfSSL | 13:f67a6c6013ca | 3636 | t3 = _mm_srli_epi32(r0, 2); |
wolfSSL | 13:f67a6c6013ca | 3637 | t2 = _mm_srli_epi32(r0, 7); |
wolfSSL | 13:f67a6c6013ca | 3638 | |
wolfSSL | 13:f67a6c6013ca | 3639 | t7 = _mm_xor_si128(t7, t3); |
wolfSSL | 13:f67a6c6013ca | 3640 | t7 = _mm_xor_si128(t7, t2); |
wolfSSL | 13:f67a6c6013ca | 3641 | t7 = _mm_xor_si128(t7, t6); |
wolfSSL | 13:f67a6c6013ca | 3642 | t7 = _mm_xor_si128(t7, r0); |
wolfSSL | 13:f67a6c6013ca | 3643 | return _mm_xor_si128(r1, t7); |
wolfSSL | 13:f67a6c6013ca | 3644 | #endif |
wolfSSL | 13:f67a6c6013ca | 3645 | } |
wolfSSL | 13:f67a6c6013ca | 3646 | |
wolfSSL | 13:f67a6c6013ca | 3647 | static __m128i gfmul_shifted(__m128i a, __m128i b) |
wolfSSL | 13:f67a6c6013ca | 3648 | { |
wolfSSL | 13:f67a6c6013ca | 3649 | __m128i t0 = _mm_setzero_si128(), t1 = _mm_setzero_si128(); |
wolfSSL | 13:f67a6c6013ca | 3650 | gfmul_only(a, b, &t0, &t1); |
wolfSSL | 13:f67a6c6013ca | 3651 | return ghash_red(t0, t1); |
wolfSSL | 13:f67a6c6013ca | 3652 | } |
wolfSSL | 13:f67a6c6013ca | 3653 | |
wolfSSL | 13:f67a6c6013ca | 3654 | #ifndef AES_GCM_AESNI_NO_UNROLL |
wolfSSL | 13:f67a6c6013ca | 3655 | static __m128i gfmul8(__m128i a1, __m128i a2, __m128i a3, __m128i a4, |
wolfSSL | 13:f67a6c6013ca | 3656 | __m128i a5, __m128i a6, __m128i a7, __m128i a8, |
wolfSSL | 13:f67a6c6013ca | 3657 | __m128i b1, __m128i b2, __m128i b3, __m128i b4, |
wolfSSL | 13:f67a6c6013ca | 3658 | __m128i b5, __m128i b6, __m128i b7, __m128i b8) |
wolfSSL | 13:f67a6c6013ca | 3659 | { |
wolfSSL | 13:f67a6c6013ca | 3660 | __m128i t0 = _mm_setzero_si128(), t1 = _mm_setzero_si128(); |
wolfSSL | 13:f67a6c6013ca | 3661 | gfmul_only(a1, b8, &t0, &t1); |
wolfSSL | 13:f67a6c6013ca | 3662 | gfmul_only(a2, b7, &t0, &t1); |
wolfSSL | 13:f67a6c6013ca | 3663 | gfmul_only(a3, b6, &t0, &t1); |
wolfSSL | 13:f67a6c6013ca | 3664 | gfmul_only(a4, b5, &t0, &t1); |
wolfSSL | 13:f67a6c6013ca | 3665 | gfmul_only(a5, b4, &t0, &t1); |
wolfSSL | 13:f67a6c6013ca | 3666 | gfmul_only(a6, b3, &t0, &t1); |
wolfSSL | 13:f67a6c6013ca | 3667 | gfmul_only(a7, b2, &t0, &t1); |
wolfSSL | 13:f67a6c6013ca | 3668 | gfmul_only(a8, b1, &t0, &t1); |
wolfSSL | 13:f67a6c6013ca | 3669 | return ghash_red(t0, t1); |
wolfSSL | 13:f67a6c6013ca | 3670 | } |
wolfSSL | 13:f67a6c6013ca | 3671 | #endif |
wolfSSL | 13:f67a6c6013ca | 3672 | |
wolfSSL | 13:f67a6c6013ca | 3673 | /* See Intel® Carry-Less Multiplication Instruction |
wolfSSL | 13:f67a6c6013ca | 3674 | * and its Usage for Computing the GCM Mode White Paper |
wolfSSL | 13:f67a6c6013ca | 3675 | * by Shay Gueron, Intel Mobility Group, Israel Development Center; |
wolfSSL | 13:f67a6c6013ca | 3676 | * and Michael E. Kounavis, Intel Labs, Circuits and Systems Research */ |
wolfSSL | 13:f67a6c6013ca | 3677 | |
wolfSSL | 13:f67a6c6013ca | 3678 | |
wolfSSL | 13:f67a6c6013ca | 3679 | /* Figure 9. AES-GCM – Encrypt With Single Block Ghash at a Time */ |
wolfSSL | 13:f67a6c6013ca | 3680 | |
wolfSSL | 13:f67a6c6013ca | 3681 | static const __m128i ONE = { 0x0, 0x1 }; |
wolfSSL | 13:f67a6c6013ca | 3682 | #ifndef AES_GCM_AESNI_NO_UNROLL |
wolfSSL | 13:f67a6c6013ca | 3683 | static const __m128i TWO = { 0x0, 0x2 }; |
wolfSSL | 13:f67a6c6013ca | 3684 | static const __m128i THREE = { 0x0, 0x3 }; |
wolfSSL | 13:f67a6c6013ca | 3685 | static const __m128i FOUR = { 0x0, 0x4 }; |
wolfSSL | 13:f67a6c6013ca | 3686 | static const __m128i FIVE = { 0x0, 0x5 }; |
wolfSSL | 13:f67a6c6013ca | 3687 | static const __m128i SIX = { 0x0, 0x6 }; |
wolfSSL | 13:f67a6c6013ca | 3688 | static const __m128i SEVEN = { 0x0, 0x7 }; |
wolfSSL | 13:f67a6c6013ca | 3689 | static const __m128i EIGHT = { 0x0, 0x8 }; |
wolfSSL | 13:f67a6c6013ca | 3690 | #endif |
wolfSSL | 13:f67a6c6013ca | 3691 | static const __m128i BSWAP_EPI64 = { 0x0001020304050607, 0x08090a0b0c0d0e0f }; |
wolfSSL | 13:f67a6c6013ca | 3692 | static const __m128i BSWAP_MASK = { 0x08090a0b0c0d0e0f, 0x0001020304050607 }; |
wolfSSL | 13:f67a6c6013ca | 3693 | |
wolfSSL | 13:f67a6c6013ca | 3694 | static void AES_GCM_encrypt(const unsigned char *in, unsigned char *out, |
wolfSSL | 13:f67a6c6013ca | 3695 | const unsigned char* addt, |
wolfSSL | 13:f67a6c6013ca | 3696 | const unsigned char* ivec, |
wolfSSL | 13:f67a6c6013ca | 3697 | unsigned char *tag, unsigned int nbytes, |
wolfSSL | 13:f67a6c6013ca | 3698 | unsigned int abytes, unsigned int ibytes, |
wolfSSL | 13:f67a6c6013ca | 3699 | const unsigned char* key, int nr) |
wolfSSL | 13:f67a6c6013ca | 3700 | { |
wolfSSL | 13:f67a6c6013ca | 3701 | int i, j ,k; |
wolfSSL | 13:f67a6c6013ca | 3702 | __m128i ctr1; |
wolfSSL | 13:f67a6c6013ca | 3703 | __m128i H, Y, T; |
wolfSSL | 13:f67a6c6013ca | 3704 | __m128i X = _mm_setzero_si128(); |
wolfSSL | 13:f67a6c6013ca | 3705 | __m128i *KEY = (__m128i*)key, lastKey; |
wolfSSL | 13:f67a6c6013ca | 3706 | __m128i last_block = _mm_setzero_si128(); |
wolfSSL | 13:f67a6c6013ca | 3707 | __m128i tmp1, tmp2; |
wolfSSL | 13:f67a6c6013ca | 3708 | #ifndef AES_GCM_AESNI_NO_UNROLL |
wolfSSL | 13:f67a6c6013ca | 3709 | __m128i HT[8]; |
wolfSSL | 13:f67a6c6013ca | 3710 | __m128i r0, r1; |
wolfSSL | 13:f67a6c6013ca | 3711 | __m128i XV; |
wolfSSL | 13:f67a6c6013ca | 3712 | __m128i tmp3, tmp4, tmp5, tmp6, tmp7, tmp8; |
wolfSSL | 13:f67a6c6013ca | 3713 | #endif |
wolfSSL | 13:f67a6c6013ca | 3714 | |
wolfSSL | 13:f67a6c6013ca | 3715 | if (ibytes == 12) { |
wolfSSL | 13:f67a6c6013ca | 3716 | Y = _mm_setzero_si128(); |
wolfSSL | 13:f67a6c6013ca | 3717 | for (j=0; j < 12; j++) |
wolfSSL | 13:f67a6c6013ca | 3718 | ((unsigned char*)&Y)[j] = ivec[j]; |
wolfSSL | 13:f67a6c6013ca | 3719 | Y = _mm_insert_epi32(Y, 0x1000000, 3); |
wolfSSL | 13:f67a6c6013ca | 3720 | /* (Compute E[ZERO, KS] and E[Y0, KS] together */ |
wolfSSL | 13:f67a6c6013ca | 3721 | tmp1 = _mm_xor_si128(X, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 3722 | tmp2 = _mm_xor_si128(Y, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 3723 | tmp1 = _mm_aesenc_si128(tmp1, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 3724 | tmp2 = _mm_aesenc_si128(tmp2, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 3725 | tmp1 = _mm_aesenc_si128(tmp1, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 3726 | tmp2 = _mm_aesenc_si128(tmp2, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 3727 | tmp1 = _mm_aesenc_si128(tmp1, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 3728 | tmp2 = _mm_aesenc_si128(tmp2, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 3729 | tmp1 = _mm_aesenc_si128(tmp1, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 3730 | tmp2 = _mm_aesenc_si128(tmp2, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 3731 | tmp1 = _mm_aesenc_si128(tmp1, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 3732 | tmp2 = _mm_aesenc_si128(tmp2, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 3733 | tmp1 = _mm_aesenc_si128(tmp1, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 3734 | tmp2 = _mm_aesenc_si128(tmp2, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 3735 | tmp1 = _mm_aesenc_si128(tmp1, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 3736 | tmp2 = _mm_aesenc_si128(tmp2, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 3737 | tmp1 = _mm_aesenc_si128(tmp1, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 3738 | tmp2 = _mm_aesenc_si128(tmp2, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 3739 | tmp1 = _mm_aesenc_si128(tmp1, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 3740 | tmp2 = _mm_aesenc_si128(tmp2, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 3741 | lastKey = KEY[10]; |
wolfSSL | 13:f67a6c6013ca | 3742 | if (nr > 10) { |
wolfSSL | 13:f67a6c6013ca | 3743 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 3744 | tmp2 = _mm_aesenc_si128(tmp2, lastKey); |
wolfSSL | 13:f67a6c6013ca | 3745 | tmp1 = _mm_aesenc_si128(tmp1, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 3746 | tmp2 = _mm_aesenc_si128(tmp2, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 3747 | lastKey = KEY[12]; |
wolfSSL | 13:f67a6c6013ca | 3748 | if (nr > 12) { |
wolfSSL | 13:f67a6c6013ca | 3749 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 3750 | tmp2 = _mm_aesenc_si128(tmp2, lastKey); |
wolfSSL | 13:f67a6c6013ca | 3751 | tmp1 = _mm_aesenc_si128(tmp1, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 3752 | tmp2 = _mm_aesenc_si128(tmp2, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 3753 | lastKey = KEY[14]; |
wolfSSL | 13:f67a6c6013ca | 3754 | } |
wolfSSL | 13:f67a6c6013ca | 3755 | } |
wolfSSL | 13:f67a6c6013ca | 3756 | H = _mm_aesenclast_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 3757 | T = _mm_aesenclast_si128(tmp2, lastKey); |
wolfSSL | 13:f67a6c6013ca | 3758 | H = _mm_shuffle_epi8(H, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 3759 | } |
wolfSSL | 13:f67a6c6013ca | 3760 | else { |
wolfSSL | 13:f67a6c6013ca | 3761 | if (ibytes % 16) { |
wolfSSL | 13:f67a6c6013ca | 3762 | i = ibytes / 16; |
wolfSSL | 13:f67a6c6013ca | 3763 | for (j=0; j < (int)(ibytes%16); j++) |
wolfSSL | 13:f67a6c6013ca | 3764 | ((unsigned char*)&last_block)[j] = ivec[i*16+j]; |
wolfSSL | 13:f67a6c6013ca | 3765 | } |
wolfSSL | 13:f67a6c6013ca | 3766 | tmp1 = _mm_xor_si128(X, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 3767 | tmp1 = _mm_aesenc_si128(tmp1, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 3768 | tmp1 = _mm_aesenc_si128(tmp1, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 3769 | tmp1 = _mm_aesenc_si128(tmp1, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 3770 | tmp1 = _mm_aesenc_si128(tmp1, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 3771 | tmp1 = _mm_aesenc_si128(tmp1, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 3772 | tmp1 = _mm_aesenc_si128(tmp1, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 3773 | tmp1 = _mm_aesenc_si128(tmp1, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 3774 | tmp1 = _mm_aesenc_si128(tmp1, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 3775 | tmp1 = _mm_aesenc_si128(tmp1, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 3776 | lastKey = KEY[10]; |
wolfSSL | 13:f67a6c6013ca | 3777 | if (nr > 10) { |
wolfSSL | 13:f67a6c6013ca | 3778 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 3779 | tmp1 = _mm_aesenc_si128(tmp1, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 3780 | lastKey = KEY[12]; |
wolfSSL | 13:f67a6c6013ca | 3781 | if (nr > 12) { |
wolfSSL | 13:f67a6c6013ca | 3782 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 3783 | tmp1 = _mm_aesenc_si128(tmp1, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 3784 | lastKey = KEY[14]; |
wolfSSL | 13:f67a6c6013ca | 3785 | } |
wolfSSL | 13:f67a6c6013ca | 3786 | } |
wolfSSL | 13:f67a6c6013ca | 3787 | H = _mm_aesenclast_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 3788 | H = _mm_shuffle_epi8(H, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 3789 | Y = _mm_setzero_si128(); |
wolfSSL | 13:f67a6c6013ca | 3790 | for (i=0; i < (int)(ibytes/16); i++) { |
wolfSSL | 13:f67a6c6013ca | 3791 | tmp1 = _mm_loadu_si128(&((__m128i*)ivec)[i]); |
wolfSSL | 13:f67a6c6013ca | 3792 | tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 3793 | Y = _mm_xor_si128(Y, tmp1); |
wolfSSL | 13:f67a6c6013ca | 3794 | Y = gfmul_sw(Y, H); |
wolfSSL | 13:f67a6c6013ca | 3795 | } |
wolfSSL | 13:f67a6c6013ca | 3796 | if (ibytes % 16) { |
wolfSSL | 13:f67a6c6013ca | 3797 | tmp1 = last_block; |
wolfSSL | 13:f67a6c6013ca | 3798 | tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 3799 | Y = _mm_xor_si128(Y, tmp1); |
wolfSSL | 13:f67a6c6013ca | 3800 | Y = gfmul_sw(Y, H); |
wolfSSL | 13:f67a6c6013ca | 3801 | } |
wolfSSL | 13:f67a6c6013ca | 3802 | tmp1 = _mm_insert_epi64(tmp1, ibytes*8, 0); |
wolfSSL | 13:f67a6c6013ca | 3803 | tmp1 = _mm_insert_epi64(tmp1, 0, 1); |
wolfSSL | 13:f67a6c6013ca | 3804 | Y = _mm_xor_si128(Y, tmp1); |
wolfSSL | 13:f67a6c6013ca | 3805 | Y = gfmul_sw(Y, H); |
wolfSSL | 13:f67a6c6013ca | 3806 | Y = _mm_shuffle_epi8(Y, BSWAP_MASK); /* Compute E(K, Y0) */ |
wolfSSL | 13:f67a6c6013ca | 3807 | tmp1 = _mm_xor_si128(Y, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 3808 | tmp1 = _mm_aesenc_si128(tmp1, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 3809 | tmp1 = _mm_aesenc_si128(tmp1, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 3810 | tmp1 = _mm_aesenc_si128(tmp1, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 3811 | tmp1 = _mm_aesenc_si128(tmp1, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 3812 | tmp1 = _mm_aesenc_si128(tmp1, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 3813 | tmp1 = _mm_aesenc_si128(tmp1, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 3814 | tmp1 = _mm_aesenc_si128(tmp1, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 3815 | tmp1 = _mm_aesenc_si128(tmp1, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 3816 | tmp1 = _mm_aesenc_si128(tmp1, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 3817 | lastKey = KEY[10]; |
wolfSSL | 13:f67a6c6013ca | 3818 | if (nr > 10) { |
wolfSSL | 13:f67a6c6013ca | 3819 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 3820 | tmp1 = _mm_aesenc_si128(tmp1, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 3821 | lastKey = KEY[12]; |
wolfSSL | 13:f67a6c6013ca | 3822 | if (nr > 12) { |
wolfSSL | 13:f67a6c6013ca | 3823 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 3824 | tmp1 = _mm_aesenc_si128(tmp1, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 3825 | lastKey = KEY[14]; |
wolfSSL | 13:f67a6c6013ca | 3826 | } |
wolfSSL | 13:f67a6c6013ca | 3827 | } |
wolfSSL | 13:f67a6c6013ca | 3828 | T = _mm_aesenclast_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 3829 | } |
wolfSSL | 13:f67a6c6013ca | 3830 | |
wolfSSL | 13:f67a6c6013ca | 3831 | for (i=0; i < (int)(abytes/16); i++) { |
wolfSSL | 13:f67a6c6013ca | 3832 | tmp1 = _mm_loadu_si128(&((__m128i*)addt)[i]); |
wolfSSL | 13:f67a6c6013ca | 3833 | tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 3834 | X = _mm_xor_si128(X, tmp1); |
wolfSSL | 13:f67a6c6013ca | 3835 | X = gfmul_sw(X, H); |
wolfSSL | 13:f67a6c6013ca | 3836 | } |
wolfSSL | 13:f67a6c6013ca | 3837 | if (abytes%16) { |
wolfSSL | 13:f67a6c6013ca | 3838 | last_block = _mm_setzero_si128(); |
wolfSSL | 13:f67a6c6013ca | 3839 | for (j=0; j < (int)(abytes%16); j++) |
wolfSSL | 13:f67a6c6013ca | 3840 | ((unsigned char*)&last_block)[j] = addt[i*16+j]; |
wolfSSL | 13:f67a6c6013ca | 3841 | tmp1 = last_block; |
wolfSSL | 13:f67a6c6013ca | 3842 | tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 3843 | X = _mm_xor_si128(X, tmp1); |
wolfSSL | 13:f67a6c6013ca | 3844 | X = gfmul_sw(X, H); |
wolfSSL | 13:f67a6c6013ca | 3845 | } |
wolfSSL | 13:f67a6c6013ca | 3846 | |
wolfSSL | 13:f67a6c6013ca | 3847 | tmp1 = _mm_shuffle_epi8(Y, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 3848 | ctr1 = _mm_add_epi32(tmp1, ONE); |
wolfSSL | 13:f67a6c6013ca | 3849 | H = gfmul_shl1(H); |
wolfSSL | 13:f67a6c6013ca | 3850 | |
wolfSSL | 13:f67a6c6013ca | 3851 | #ifndef AES_GCM_AESNI_NO_UNROLL |
wolfSSL | 13:f67a6c6013ca | 3852 | i = 0; |
wolfSSL | 13:f67a6c6013ca | 3853 | if (nbytes >= 16*8) { |
wolfSSL | 13:f67a6c6013ca | 3854 | HT[0] = H; |
wolfSSL | 13:f67a6c6013ca | 3855 | HT[1] = gfmul_shifted(H, H); |
wolfSSL | 13:f67a6c6013ca | 3856 | HT[2] = gfmul_shifted(H, HT[1]); |
wolfSSL | 13:f67a6c6013ca | 3857 | HT[3] = gfmul_shifted(HT[1], HT[1]); |
wolfSSL | 13:f67a6c6013ca | 3858 | HT[4] = gfmul_shifted(HT[1], HT[2]); |
wolfSSL | 13:f67a6c6013ca | 3859 | HT[5] = gfmul_shifted(HT[2], HT[2]); |
wolfSSL | 13:f67a6c6013ca | 3860 | HT[6] = gfmul_shifted(HT[2], HT[3]); |
wolfSSL | 13:f67a6c6013ca | 3861 | HT[7] = gfmul_shifted(HT[3], HT[3]); |
wolfSSL | 13:f67a6c6013ca | 3862 | |
wolfSSL | 13:f67a6c6013ca | 3863 | tmp1 = _mm_shuffle_epi8(ctr1, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 3864 | tmp2 = _mm_add_epi32(ctr1, ONE); |
wolfSSL | 13:f67a6c6013ca | 3865 | tmp2 = _mm_shuffle_epi8(tmp2, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 3866 | tmp3 = _mm_add_epi32(ctr1, TWO); |
wolfSSL | 13:f67a6c6013ca | 3867 | tmp3 = _mm_shuffle_epi8(tmp3, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 3868 | tmp4 = _mm_add_epi32(ctr1, THREE); |
wolfSSL | 13:f67a6c6013ca | 3869 | tmp4 = _mm_shuffle_epi8(tmp4, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 3870 | tmp5 = _mm_add_epi32(ctr1, FOUR); |
wolfSSL | 13:f67a6c6013ca | 3871 | tmp5 = _mm_shuffle_epi8(tmp5, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 3872 | tmp6 = _mm_add_epi32(ctr1, FIVE); |
wolfSSL | 13:f67a6c6013ca | 3873 | tmp6 = _mm_shuffle_epi8(tmp6, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 3874 | tmp7 = _mm_add_epi32(ctr1, SIX); |
wolfSSL | 13:f67a6c6013ca | 3875 | tmp7 = _mm_shuffle_epi8(tmp7, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 3876 | tmp8 = _mm_add_epi32(ctr1, SEVEN); |
wolfSSL | 13:f67a6c6013ca | 3877 | tmp8 = _mm_shuffle_epi8(tmp8, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 3878 | ctr1 = _mm_add_epi32(ctr1, EIGHT); |
wolfSSL | 13:f67a6c6013ca | 3879 | tmp1 =_mm_xor_si128(tmp1, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 3880 | tmp2 =_mm_xor_si128(tmp2, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 3881 | tmp3 =_mm_xor_si128(tmp3, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 3882 | tmp4 =_mm_xor_si128(tmp4, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 3883 | tmp5 =_mm_xor_si128(tmp5, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 3884 | tmp6 =_mm_xor_si128(tmp6, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 3885 | tmp7 =_mm_xor_si128(tmp7, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 3886 | tmp8 =_mm_xor_si128(tmp8, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 3887 | tmp1 = _mm_aesenc_si128(tmp1, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 3888 | tmp2 = _mm_aesenc_si128(tmp2, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 3889 | tmp3 = _mm_aesenc_si128(tmp3, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 3890 | tmp4 = _mm_aesenc_si128(tmp4, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 3891 | tmp5 = _mm_aesenc_si128(tmp5, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 3892 | tmp6 = _mm_aesenc_si128(tmp6, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 3893 | tmp7 = _mm_aesenc_si128(tmp7, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 3894 | tmp8 = _mm_aesenc_si128(tmp8, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 3895 | tmp1 = _mm_aesenc_si128(tmp1, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 3896 | tmp2 = _mm_aesenc_si128(tmp2, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 3897 | tmp3 = _mm_aesenc_si128(tmp3, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 3898 | tmp4 = _mm_aesenc_si128(tmp4, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 3899 | tmp5 = _mm_aesenc_si128(tmp5, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 3900 | tmp6 = _mm_aesenc_si128(tmp6, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 3901 | tmp7 = _mm_aesenc_si128(tmp7, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 3902 | tmp8 = _mm_aesenc_si128(tmp8, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 3903 | tmp1 = _mm_aesenc_si128(tmp1, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 3904 | tmp2 = _mm_aesenc_si128(tmp2, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 3905 | tmp3 = _mm_aesenc_si128(tmp3, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 3906 | tmp4 = _mm_aesenc_si128(tmp4, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 3907 | tmp5 = _mm_aesenc_si128(tmp5, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 3908 | tmp6 = _mm_aesenc_si128(tmp6, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 3909 | tmp7 = _mm_aesenc_si128(tmp7, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 3910 | tmp8 = _mm_aesenc_si128(tmp8, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 3911 | tmp1 = _mm_aesenc_si128(tmp1, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 3912 | tmp2 = _mm_aesenc_si128(tmp2, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 3913 | tmp3 = _mm_aesenc_si128(tmp3, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 3914 | tmp4 = _mm_aesenc_si128(tmp4, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 3915 | tmp5 = _mm_aesenc_si128(tmp5, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 3916 | tmp6 = _mm_aesenc_si128(tmp6, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 3917 | tmp7 = _mm_aesenc_si128(tmp7, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 3918 | tmp8 = _mm_aesenc_si128(tmp8, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 3919 | tmp1 = _mm_aesenc_si128(tmp1, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 3920 | tmp2 = _mm_aesenc_si128(tmp2, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 3921 | tmp3 = _mm_aesenc_si128(tmp3, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 3922 | tmp4 = _mm_aesenc_si128(tmp4, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 3923 | tmp5 = _mm_aesenc_si128(tmp5, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 3924 | tmp6 = _mm_aesenc_si128(tmp6, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 3925 | tmp7 = _mm_aesenc_si128(tmp7, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 3926 | tmp8 = _mm_aesenc_si128(tmp8, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 3927 | tmp1 = _mm_aesenc_si128(tmp1, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 3928 | tmp2 = _mm_aesenc_si128(tmp2, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 3929 | tmp3 = _mm_aesenc_si128(tmp3, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 3930 | tmp4 = _mm_aesenc_si128(tmp4, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 3931 | tmp5 = _mm_aesenc_si128(tmp5, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 3932 | tmp6 = _mm_aesenc_si128(tmp6, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 3933 | tmp7 = _mm_aesenc_si128(tmp7, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 3934 | tmp8 = _mm_aesenc_si128(tmp8, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 3935 | tmp1 = _mm_aesenc_si128(tmp1, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 3936 | tmp2 = _mm_aesenc_si128(tmp2, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 3937 | tmp3 = _mm_aesenc_si128(tmp3, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 3938 | tmp4 = _mm_aesenc_si128(tmp4, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 3939 | tmp5 = _mm_aesenc_si128(tmp5, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 3940 | tmp6 = _mm_aesenc_si128(tmp6, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 3941 | tmp7 = _mm_aesenc_si128(tmp7, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 3942 | tmp8 = _mm_aesenc_si128(tmp8, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 3943 | tmp1 = _mm_aesenc_si128(tmp1, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 3944 | tmp2 = _mm_aesenc_si128(tmp2, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 3945 | tmp3 = _mm_aesenc_si128(tmp3, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 3946 | tmp4 = _mm_aesenc_si128(tmp4, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 3947 | tmp5 = _mm_aesenc_si128(tmp5, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 3948 | tmp6 = _mm_aesenc_si128(tmp6, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 3949 | tmp7 = _mm_aesenc_si128(tmp7, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 3950 | tmp8 = _mm_aesenc_si128(tmp8, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 3951 | tmp1 = _mm_aesenc_si128(tmp1, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 3952 | tmp2 = _mm_aesenc_si128(tmp2, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 3953 | tmp3 = _mm_aesenc_si128(tmp3, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 3954 | tmp4 = _mm_aesenc_si128(tmp4, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 3955 | tmp5 = _mm_aesenc_si128(tmp5, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 3956 | tmp6 = _mm_aesenc_si128(tmp6, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 3957 | tmp7 = _mm_aesenc_si128(tmp7, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 3958 | tmp8 = _mm_aesenc_si128(tmp8, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 3959 | lastKey = KEY[10]; |
wolfSSL | 13:f67a6c6013ca | 3960 | if (nr > 10) { |
wolfSSL | 13:f67a6c6013ca | 3961 | tmp1 = _mm_aesenc_si128(tmp1, KEY[10]); |
wolfSSL | 13:f67a6c6013ca | 3962 | tmp2 = _mm_aesenc_si128(tmp2, KEY[10]); |
wolfSSL | 13:f67a6c6013ca | 3963 | tmp3 = _mm_aesenc_si128(tmp3, KEY[10]); |
wolfSSL | 13:f67a6c6013ca | 3964 | tmp4 = _mm_aesenc_si128(tmp4, KEY[10]); |
wolfSSL | 13:f67a6c6013ca | 3965 | tmp5 = _mm_aesenc_si128(tmp5, KEY[10]); |
wolfSSL | 13:f67a6c6013ca | 3966 | tmp6 = _mm_aesenc_si128(tmp6, KEY[10]); |
wolfSSL | 13:f67a6c6013ca | 3967 | tmp7 = _mm_aesenc_si128(tmp7, KEY[10]); |
wolfSSL | 13:f67a6c6013ca | 3968 | tmp8 = _mm_aesenc_si128(tmp8, KEY[10]); |
wolfSSL | 13:f67a6c6013ca | 3969 | tmp1 = _mm_aesenc_si128(tmp1, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 3970 | tmp2 = _mm_aesenc_si128(tmp2, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 3971 | tmp3 = _mm_aesenc_si128(tmp3, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 3972 | tmp4 = _mm_aesenc_si128(tmp4, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 3973 | tmp5 = _mm_aesenc_si128(tmp5, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 3974 | tmp6 = _mm_aesenc_si128(tmp6, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 3975 | tmp7 = _mm_aesenc_si128(tmp7, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 3976 | tmp8 = _mm_aesenc_si128(tmp8, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 3977 | lastKey = KEY[12]; |
wolfSSL | 13:f67a6c6013ca | 3978 | if (nr > 12) { |
wolfSSL | 13:f67a6c6013ca | 3979 | tmp1 = _mm_aesenc_si128(tmp1, KEY[12]); |
wolfSSL | 13:f67a6c6013ca | 3980 | tmp2 = _mm_aesenc_si128(tmp2, KEY[12]); |
wolfSSL | 13:f67a6c6013ca | 3981 | tmp3 = _mm_aesenc_si128(tmp3, KEY[12]); |
wolfSSL | 13:f67a6c6013ca | 3982 | tmp4 = _mm_aesenc_si128(tmp4, KEY[12]); |
wolfSSL | 13:f67a6c6013ca | 3983 | tmp5 = _mm_aesenc_si128(tmp5, KEY[12]); |
wolfSSL | 13:f67a6c6013ca | 3984 | tmp6 = _mm_aesenc_si128(tmp6, KEY[12]); |
wolfSSL | 13:f67a6c6013ca | 3985 | tmp7 = _mm_aesenc_si128(tmp7, KEY[12]); |
wolfSSL | 13:f67a6c6013ca | 3986 | tmp8 = _mm_aesenc_si128(tmp8, KEY[12]); |
wolfSSL | 13:f67a6c6013ca | 3987 | tmp1 = _mm_aesenc_si128(tmp1, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 3988 | tmp2 = _mm_aesenc_si128(tmp2, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 3989 | tmp3 = _mm_aesenc_si128(tmp3, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 3990 | tmp4 = _mm_aesenc_si128(tmp4, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 3991 | tmp5 = _mm_aesenc_si128(tmp5, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 3992 | tmp6 = _mm_aesenc_si128(tmp6, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 3993 | tmp7 = _mm_aesenc_si128(tmp7, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 3994 | tmp8 = _mm_aesenc_si128(tmp8, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 3995 | lastKey = KEY[14]; |
wolfSSL | 13:f67a6c6013ca | 3996 | } |
wolfSSL | 13:f67a6c6013ca | 3997 | } |
wolfSSL | 13:f67a6c6013ca | 3998 | tmp1 =_mm_aesenclast_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 3999 | tmp2 =_mm_aesenclast_si128(tmp2, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4000 | tmp3 =_mm_aesenclast_si128(tmp3, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4001 | tmp4 =_mm_aesenclast_si128(tmp4, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4002 | tmp5 =_mm_aesenclast_si128(tmp5, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4003 | tmp6 =_mm_aesenclast_si128(tmp6, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4004 | tmp7 =_mm_aesenclast_si128(tmp7, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4005 | tmp8 =_mm_aesenclast_si128(tmp8, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4006 | tmp1 = _mm_xor_si128(tmp1, _mm_loadu_si128(&((__m128i*)in)[0])); |
wolfSSL | 13:f67a6c6013ca | 4007 | tmp2 = _mm_xor_si128(tmp2, _mm_loadu_si128(&((__m128i*)in)[1])); |
wolfSSL | 13:f67a6c6013ca | 4008 | tmp3 = _mm_xor_si128(tmp3, _mm_loadu_si128(&((__m128i*)in)[2])); |
wolfSSL | 13:f67a6c6013ca | 4009 | tmp4 = _mm_xor_si128(tmp4, _mm_loadu_si128(&((__m128i*)in)[3])); |
wolfSSL | 13:f67a6c6013ca | 4010 | tmp5 = _mm_xor_si128(tmp5, _mm_loadu_si128(&((__m128i*)in)[4])); |
wolfSSL | 13:f67a6c6013ca | 4011 | tmp6 = _mm_xor_si128(tmp6, _mm_loadu_si128(&((__m128i*)in)[5])); |
wolfSSL | 13:f67a6c6013ca | 4012 | tmp7 = _mm_xor_si128(tmp7, _mm_loadu_si128(&((__m128i*)in)[6])); |
wolfSSL | 13:f67a6c6013ca | 4013 | tmp8 = _mm_xor_si128(tmp8, _mm_loadu_si128(&((__m128i*)in)[7])); |
wolfSSL | 13:f67a6c6013ca | 4014 | _mm_storeu_si128(&((__m128i*)out)[0], tmp1); |
wolfSSL | 13:f67a6c6013ca | 4015 | _mm_storeu_si128(&((__m128i*)out)[1], tmp2); |
wolfSSL | 13:f67a6c6013ca | 4016 | _mm_storeu_si128(&((__m128i*)out)[2], tmp3); |
wolfSSL | 13:f67a6c6013ca | 4017 | _mm_storeu_si128(&((__m128i*)out)[3], tmp4); |
wolfSSL | 13:f67a6c6013ca | 4018 | _mm_storeu_si128(&((__m128i*)out)[4], tmp5); |
wolfSSL | 13:f67a6c6013ca | 4019 | _mm_storeu_si128(&((__m128i*)out)[5], tmp6); |
wolfSSL | 13:f67a6c6013ca | 4020 | _mm_storeu_si128(&((__m128i*)out)[6], tmp7); |
wolfSSL | 13:f67a6c6013ca | 4021 | _mm_storeu_si128(&((__m128i*)out)[7], tmp8); |
wolfSSL | 13:f67a6c6013ca | 4022 | |
wolfSSL | 13:f67a6c6013ca | 4023 | for (i=1; i < (int)(nbytes/16/8); i++) { |
wolfSSL | 13:f67a6c6013ca | 4024 | r0 = _mm_setzero_si128(); |
wolfSSL | 13:f67a6c6013ca | 4025 | r1 = _mm_setzero_si128(); |
wolfSSL | 13:f67a6c6013ca | 4026 | tmp1 = _mm_shuffle_epi8(ctr1, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 4027 | tmp2 = _mm_add_epi32(ctr1, ONE); |
wolfSSL | 13:f67a6c6013ca | 4028 | tmp2 = _mm_shuffle_epi8(tmp2, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 4029 | tmp3 = _mm_add_epi32(ctr1, TWO); |
wolfSSL | 13:f67a6c6013ca | 4030 | tmp3 = _mm_shuffle_epi8(tmp3, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 4031 | tmp4 = _mm_add_epi32(ctr1, THREE); |
wolfSSL | 13:f67a6c6013ca | 4032 | tmp4 = _mm_shuffle_epi8(tmp4, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 4033 | tmp5 = _mm_add_epi32(ctr1, FOUR); |
wolfSSL | 13:f67a6c6013ca | 4034 | tmp5 = _mm_shuffle_epi8(tmp5, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 4035 | tmp6 = _mm_add_epi32(ctr1, FIVE); |
wolfSSL | 13:f67a6c6013ca | 4036 | tmp6 = _mm_shuffle_epi8(tmp6, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 4037 | tmp7 = _mm_add_epi32(ctr1, SIX); |
wolfSSL | 13:f67a6c6013ca | 4038 | tmp7 = _mm_shuffle_epi8(tmp7, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 4039 | tmp8 = _mm_add_epi32(ctr1, SEVEN); |
wolfSSL | 13:f67a6c6013ca | 4040 | tmp8 = _mm_shuffle_epi8(tmp8, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 4041 | ctr1 = _mm_add_epi32(ctr1, EIGHT); |
wolfSSL | 13:f67a6c6013ca | 4042 | tmp1 =_mm_xor_si128(tmp1, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 4043 | tmp2 =_mm_xor_si128(tmp2, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 4044 | tmp3 =_mm_xor_si128(tmp3, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 4045 | tmp4 =_mm_xor_si128(tmp4, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 4046 | tmp5 =_mm_xor_si128(tmp5, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 4047 | tmp6 =_mm_xor_si128(tmp6, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 4048 | tmp7 =_mm_xor_si128(tmp7, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 4049 | tmp8 =_mm_xor_si128(tmp8, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 4050 | /* 128 x 128 Carryless Multiply */ |
wolfSSL | 13:f67a6c6013ca | 4051 | XV = _mm_loadu_si128(&((__m128i*)out)[(i-1)*8+0]); |
wolfSSL | 13:f67a6c6013ca | 4052 | XV = _mm_shuffle_epi8(XV, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 4053 | XV = _mm_xor_si128(XV, X); |
wolfSSL | 13:f67a6c6013ca | 4054 | gfmul_only(XV, HT[7], &r0, &r1); |
wolfSSL | 13:f67a6c6013ca | 4055 | tmp1 = _mm_aesenc_si128(tmp1, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 4056 | tmp2 = _mm_aesenc_si128(tmp2, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 4057 | tmp3 = _mm_aesenc_si128(tmp3, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 4058 | tmp4 = _mm_aesenc_si128(tmp4, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 4059 | tmp5 = _mm_aesenc_si128(tmp5, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 4060 | tmp6 = _mm_aesenc_si128(tmp6, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 4061 | tmp7 = _mm_aesenc_si128(tmp7, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 4062 | tmp8 = _mm_aesenc_si128(tmp8, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 4063 | /* 128 x 128 Carryless Multiply */ |
wolfSSL | 13:f67a6c6013ca | 4064 | XV = _mm_loadu_si128(&((__m128i*)out)[(i-1)*8+1]); |
wolfSSL | 13:f67a6c6013ca | 4065 | XV = _mm_shuffle_epi8(XV, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 4066 | gfmul_only(XV, HT[6], &r0, &r1); |
wolfSSL | 13:f67a6c6013ca | 4067 | tmp1 = _mm_aesenc_si128(tmp1, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 4068 | tmp2 = _mm_aesenc_si128(tmp2, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 4069 | tmp3 = _mm_aesenc_si128(tmp3, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 4070 | tmp4 = _mm_aesenc_si128(tmp4, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 4071 | tmp5 = _mm_aesenc_si128(tmp5, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 4072 | tmp6 = _mm_aesenc_si128(tmp6, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 4073 | tmp7 = _mm_aesenc_si128(tmp7, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 4074 | tmp8 = _mm_aesenc_si128(tmp8, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 4075 | /* 128 x 128 Carryless Multiply */ |
wolfSSL | 13:f67a6c6013ca | 4076 | XV = _mm_loadu_si128(&((__m128i*)out)[(i-1)*8+2]); |
wolfSSL | 13:f67a6c6013ca | 4077 | XV = _mm_shuffle_epi8(XV, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 4078 | gfmul_only(XV, HT[5], &r0, &r1); |
wolfSSL | 13:f67a6c6013ca | 4079 | tmp1 = _mm_aesenc_si128(tmp1, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 4080 | tmp2 = _mm_aesenc_si128(tmp2, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 4081 | tmp3 = _mm_aesenc_si128(tmp3, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 4082 | tmp4 = _mm_aesenc_si128(tmp4, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 4083 | tmp5 = _mm_aesenc_si128(tmp5, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 4084 | tmp6 = _mm_aesenc_si128(tmp6, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 4085 | tmp7 = _mm_aesenc_si128(tmp7, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 4086 | tmp8 = _mm_aesenc_si128(tmp8, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 4087 | /* 128 x 128 Carryless Multiply */ |
wolfSSL | 13:f67a6c6013ca | 4088 | XV = _mm_loadu_si128(&((__m128i*)out)[(i-1)*8+3]); |
wolfSSL | 13:f67a6c6013ca | 4089 | XV = _mm_shuffle_epi8(XV, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 4090 | gfmul_only(XV, HT[4], &r0, &r1); |
wolfSSL | 13:f67a6c6013ca | 4091 | tmp1 = _mm_aesenc_si128(tmp1, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 4092 | tmp2 = _mm_aesenc_si128(tmp2, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 4093 | tmp3 = _mm_aesenc_si128(tmp3, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 4094 | tmp4 = _mm_aesenc_si128(tmp4, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 4095 | tmp5 = _mm_aesenc_si128(tmp5, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 4096 | tmp6 = _mm_aesenc_si128(tmp6, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 4097 | tmp7 = _mm_aesenc_si128(tmp7, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 4098 | tmp8 = _mm_aesenc_si128(tmp8, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 4099 | /* 128 x 128 Carryless Multiply */ |
wolfSSL | 13:f67a6c6013ca | 4100 | XV = _mm_loadu_si128(&((__m128i*)out)[(i-1)*8+4]); |
wolfSSL | 13:f67a6c6013ca | 4101 | XV = _mm_shuffle_epi8(XV, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 4102 | gfmul_only(XV, HT[3], &r0, &r1); |
wolfSSL | 13:f67a6c6013ca | 4103 | tmp1 = _mm_aesenc_si128(tmp1, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 4104 | tmp2 = _mm_aesenc_si128(tmp2, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 4105 | tmp3 = _mm_aesenc_si128(tmp3, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 4106 | tmp4 = _mm_aesenc_si128(tmp4, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 4107 | tmp5 = _mm_aesenc_si128(tmp5, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 4108 | tmp6 = _mm_aesenc_si128(tmp6, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 4109 | tmp7 = _mm_aesenc_si128(tmp7, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 4110 | tmp8 = _mm_aesenc_si128(tmp8, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 4111 | /* 128 x 128 Carryless Multiply */ |
wolfSSL | 13:f67a6c6013ca | 4112 | XV = _mm_loadu_si128(&((__m128i*)out)[(i-1)*8+5]); |
wolfSSL | 13:f67a6c6013ca | 4113 | XV = _mm_shuffle_epi8(XV, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 4114 | gfmul_only(XV, HT[2], &r0, &r1); |
wolfSSL | 13:f67a6c6013ca | 4115 | tmp1 = _mm_aesenc_si128(tmp1, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 4116 | tmp2 = _mm_aesenc_si128(tmp2, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 4117 | tmp3 = _mm_aesenc_si128(tmp3, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 4118 | tmp4 = _mm_aesenc_si128(tmp4, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 4119 | tmp5 = _mm_aesenc_si128(tmp5, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 4120 | tmp6 = _mm_aesenc_si128(tmp6, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 4121 | tmp7 = _mm_aesenc_si128(tmp7, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 4122 | tmp8 = _mm_aesenc_si128(tmp8, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 4123 | /* 128 x 128 Carryless Multiply */ |
wolfSSL | 13:f67a6c6013ca | 4124 | XV = _mm_loadu_si128(&((__m128i*)out)[(i-1)*8+6]); |
wolfSSL | 13:f67a6c6013ca | 4125 | XV = _mm_shuffle_epi8(XV, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 4126 | gfmul_only(XV, HT[1], &r0, &r1); |
wolfSSL | 13:f67a6c6013ca | 4127 | tmp1 = _mm_aesenc_si128(tmp1, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 4128 | tmp2 = _mm_aesenc_si128(tmp2, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 4129 | tmp3 = _mm_aesenc_si128(tmp3, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 4130 | tmp4 = _mm_aesenc_si128(tmp4, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 4131 | tmp5 = _mm_aesenc_si128(tmp5, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 4132 | tmp6 = _mm_aesenc_si128(tmp6, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 4133 | tmp7 = _mm_aesenc_si128(tmp7, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 4134 | tmp8 = _mm_aesenc_si128(tmp8, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 4135 | /* 128 x 128 Carryless Multiply */ |
wolfSSL | 13:f67a6c6013ca | 4136 | XV = _mm_loadu_si128(&((__m128i*)out)[(i-1)*8+7]); |
wolfSSL | 13:f67a6c6013ca | 4137 | XV = _mm_shuffle_epi8(XV, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 4138 | gfmul_only(XV, HT[0], &r0, &r1); |
wolfSSL | 13:f67a6c6013ca | 4139 | tmp1 = _mm_aesenc_si128(tmp1, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 4140 | tmp2 = _mm_aesenc_si128(tmp2, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 4141 | tmp3 = _mm_aesenc_si128(tmp3, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 4142 | tmp4 = _mm_aesenc_si128(tmp4, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 4143 | tmp5 = _mm_aesenc_si128(tmp5, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 4144 | tmp6 = _mm_aesenc_si128(tmp6, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 4145 | tmp7 = _mm_aesenc_si128(tmp7, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 4146 | tmp8 = _mm_aesenc_si128(tmp8, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 4147 | /* Reduction */ |
wolfSSL | 13:f67a6c6013ca | 4148 | X = ghash_red(r0, r1); |
wolfSSL | 13:f67a6c6013ca | 4149 | tmp1 = _mm_aesenc_si128(tmp1, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 4150 | tmp2 = _mm_aesenc_si128(tmp2, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 4151 | tmp3 = _mm_aesenc_si128(tmp3, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 4152 | tmp4 = _mm_aesenc_si128(tmp4, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 4153 | tmp5 = _mm_aesenc_si128(tmp5, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 4154 | tmp6 = _mm_aesenc_si128(tmp6, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 4155 | tmp7 = _mm_aesenc_si128(tmp7, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 4156 | tmp8 = _mm_aesenc_si128(tmp8, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 4157 | lastKey = KEY[10]; |
wolfSSL | 13:f67a6c6013ca | 4158 | if (nr > 10) { |
wolfSSL | 13:f67a6c6013ca | 4159 | tmp1 = _mm_aesenc_si128(tmp1, KEY[10]); |
wolfSSL | 13:f67a6c6013ca | 4160 | tmp2 = _mm_aesenc_si128(tmp2, KEY[10]); |
wolfSSL | 13:f67a6c6013ca | 4161 | tmp3 = _mm_aesenc_si128(tmp3, KEY[10]); |
wolfSSL | 13:f67a6c6013ca | 4162 | tmp4 = _mm_aesenc_si128(tmp4, KEY[10]); |
wolfSSL | 13:f67a6c6013ca | 4163 | tmp5 = _mm_aesenc_si128(tmp5, KEY[10]); |
wolfSSL | 13:f67a6c6013ca | 4164 | tmp6 = _mm_aesenc_si128(tmp6, KEY[10]); |
wolfSSL | 13:f67a6c6013ca | 4165 | tmp7 = _mm_aesenc_si128(tmp7, KEY[10]); |
wolfSSL | 13:f67a6c6013ca | 4166 | tmp8 = _mm_aesenc_si128(tmp8, KEY[10]); |
wolfSSL | 13:f67a6c6013ca | 4167 | tmp1 = _mm_aesenc_si128(tmp1, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 4168 | tmp2 = _mm_aesenc_si128(tmp2, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 4169 | tmp3 = _mm_aesenc_si128(tmp3, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 4170 | tmp4 = _mm_aesenc_si128(tmp4, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 4171 | tmp5 = _mm_aesenc_si128(tmp5, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 4172 | tmp6 = _mm_aesenc_si128(tmp6, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 4173 | tmp7 = _mm_aesenc_si128(tmp7, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 4174 | tmp8 = _mm_aesenc_si128(tmp8, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 4175 | lastKey = KEY[12]; |
wolfSSL | 13:f67a6c6013ca | 4176 | if (nr > 12) { |
wolfSSL | 13:f67a6c6013ca | 4177 | tmp1 = _mm_aesenc_si128(tmp1, KEY[12]); |
wolfSSL | 13:f67a6c6013ca | 4178 | tmp2 = _mm_aesenc_si128(tmp2, KEY[12]); |
wolfSSL | 13:f67a6c6013ca | 4179 | tmp3 = _mm_aesenc_si128(tmp3, KEY[12]); |
wolfSSL | 13:f67a6c6013ca | 4180 | tmp4 = _mm_aesenc_si128(tmp4, KEY[12]); |
wolfSSL | 13:f67a6c6013ca | 4181 | tmp5 = _mm_aesenc_si128(tmp5, KEY[12]); |
wolfSSL | 13:f67a6c6013ca | 4182 | tmp6 = _mm_aesenc_si128(tmp6, KEY[12]); |
wolfSSL | 13:f67a6c6013ca | 4183 | tmp7 = _mm_aesenc_si128(tmp7, KEY[12]); |
wolfSSL | 13:f67a6c6013ca | 4184 | tmp8 = _mm_aesenc_si128(tmp8, KEY[12]); |
wolfSSL | 13:f67a6c6013ca | 4185 | tmp1 = _mm_aesenc_si128(tmp1, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 4186 | tmp2 = _mm_aesenc_si128(tmp2, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 4187 | tmp3 = _mm_aesenc_si128(tmp3, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 4188 | tmp4 = _mm_aesenc_si128(tmp4, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 4189 | tmp5 = _mm_aesenc_si128(tmp5, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 4190 | tmp6 = _mm_aesenc_si128(tmp6, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 4191 | tmp7 = _mm_aesenc_si128(tmp7, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 4192 | tmp8 = _mm_aesenc_si128(tmp8, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 4193 | lastKey = KEY[14]; |
wolfSSL | 13:f67a6c6013ca | 4194 | } |
wolfSSL | 13:f67a6c6013ca | 4195 | } |
wolfSSL | 13:f67a6c6013ca | 4196 | tmp1 =_mm_aesenclast_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4197 | tmp2 =_mm_aesenclast_si128(tmp2, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4198 | tmp3 =_mm_aesenclast_si128(tmp3, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4199 | tmp4 =_mm_aesenclast_si128(tmp4, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4200 | tmp5 =_mm_aesenclast_si128(tmp5, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4201 | tmp6 =_mm_aesenclast_si128(tmp6, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4202 | tmp7 =_mm_aesenclast_si128(tmp7, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4203 | tmp8 =_mm_aesenclast_si128(tmp8, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4204 | tmp1 = _mm_xor_si128(tmp1, _mm_loadu_si128(&((__m128i*)in)[i*8+0])); |
wolfSSL | 13:f67a6c6013ca | 4205 | tmp2 = _mm_xor_si128(tmp2, _mm_loadu_si128(&((__m128i*)in)[i*8+1])); |
wolfSSL | 13:f67a6c6013ca | 4206 | tmp3 = _mm_xor_si128(tmp3, _mm_loadu_si128(&((__m128i*)in)[i*8+2])); |
wolfSSL | 13:f67a6c6013ca | 4207 | tmp4 = _mm_xor_si128(tmp4, _mm_loadu_si128(&((__m128i*)in)[i*8+3])); |
wolfSSL | 13:f67a6c6013ca | 4208 | tmp5 = _mm_xor_si128(tmp5, _mm_loadu_si128(&((__m128i*)in)[i*8+4])); |
wolfSSL | 13:f67a6c6013ca | 4209 | tmp6 = _mm_xor_si128(tmp6, _mm_loadu_si128(&((__m128i*)in)[i*8+5])); |
wolfSSL | 13:f67a6c6013ca | 4210 | tmp7 = _mm_xor_si128(tmp7, _mm_loadu_si128(&((__m128i*)in)[i*8+6])); |
wolfSSL | 13:f67a6c6013ca | 4211 | tmp8 = _mm_xor_si128(tmp8, _mm_loadu_si128(&((__m128i*)in)[i*8+7])); |
wolfSSL | 13:f67a6c6013ca | 4212 | _mm_storeu_si128(&((__m128i*)out)[i*8+0], tmp1); |
wolfSSL | 13:f67a6c6013ca | 4213 | _mm_storeu_si128(&((__m128i*)out)[i*8+1], tmp2); |
wolfSSL | 13:f67a6c6013ca | 4214 | _mm_storeu_si128(&((__m128i*)out)[i*8+2], tmp3); |
wolfSSL | 13:f67a6c6013ca | 4215 | _mm_storeu_si128(&((__m128i*)out)[i*8+3], tmp4); |
wolfSSL | 13:f67a6c6013ca | 4216 | _mm_storeu_si128(&((__m128i*)out)[i*8+4], tmp5); |
wolfSSL | 13:f67a6c6013ca | 4217 | _mm_storeu_si128(&((__m128i*)out)[i*8+5], tmp6); |
wolfSSL | 13:f67a6c6013ca | 4218 | _mm_storeu_si128(&((__m128i*)out)[i*8+6], tmp7); |
wolfSSL | 13:f67a6c6013ca | 4219 | _mm_storeu_si128(&((__m128i*)out)[i*8+7], tmp8); |
wolfSSL | 13:f67a6c6013ca | 4220 | } |
wolfSSL | 13:f67a6c6013ca | 4221 | |
wolfSSL | 13:f67a6c6013ca | 4222 | tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 4223 | tmp2 = _mm_shuffle_epi8(tmp2, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 4224 | tmp3 = _mm_shuffle_epi8(tmp3, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 4225 | tmp4 = _mm_shuffle_epi8(tmp4, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 4226 | tmp5 = _mm_shuffle_epi8(tmp5, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 4227 | tmp6 = _mm_shuffle_epi8(tmp6, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 4228 | tmp7 = _mm_shuffle_epi8(tmp7, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 4229 | tmp8 = _mm_shuffle_epi8(tmp8, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 4230 | tmp1 = _mm_xor_si128(X, tmp1); |
wolfSSL | 13:f67a6c6013ca | 4231 | X = gfmul8(tmp1, tmp2, tmp3, tmp4, tmp5, tmp6, tmp7, tmp8, |
wolfSSL | 13:f67a6c6013ca | 4232 | HT[0], HT[1], HT[2], HT[3], HT[4], HT[5], HT[6], HT[7]); |
wolfSSL | 13:f67a6c6013ca | 4233 | } |
wolfSSL | 13:f67a6c6013ca | 4234 | for (k = i*8; k < (int)(nbytes/16); k++) { |
wolfSSL | 13:f67a6c6013ca | 4235 | tmp1 = _mm_shuffle_epi8(ctr1, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 4236 | ctr1 = _mm_add_epi32(ctr1, ONE); |
wolfSSL | 13:f67a6c6013ca | 4237 | tmp1 = _mm_xor_si128(tmp1, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 4238 | tmp1 = _mm_aesenc_si128(tmp1, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 4239 | tmp1 = _mm_aesenc_si128(tmp1, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 4240 | tmp1 = _mm_aesenc_si128(tmp1, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 4241 | tmp1 = _mm_aesenc_si128(tmp1, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 4242 | tmp1 = _mm_aesenc_si128(tmp1, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 4243 | tmp1 = _mm_aesenc_si128(tmp1, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 4244 | tmp1 = _mm_aesenc_si128(tmp1, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 4245 | tmp1 = _mm_aesenc_si128(tmp1, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 4246 | tmp1 = _mm_aesenc_si128(tmp1, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 4247 | lastKey = KEY[10]; |
wolfSSL | 13:f67a6c6013ca | 4248 | if (nr > 10) { |
wolfSSL | 13:f67a6c6013ca | 4249 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4250 | tmp1 = _mm_aesenc_si128(tmp1, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 4251 | lastKey = KEY[12]; |
wolfSSL | 13:f67a6c6013ca | 4252 | if (nr > 12) { |
wolfSSL | 13:f67a6c6013ca | 4253 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4254 | tmp1 = _mm_aesenc_si128(tmp1, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 4255 | lastKey = KEY[14]; |
wolfSSL | 13:f67a6c6013ca | 4256 | } |
wolfSSL | 13:f67a6c6013ca | 4257 | } |
wolfSSL | 13:f67a6c6013ca | 4258 | tmp1 = _mm_aesenclast_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4259 | tmp1 = _mm_xor_si128(tmp1, _mm_loadu_si128(&((__m128i*)in)[k])); |
wolfSSL | 13:f67a6c6013ca | 4260 | _mm_storeu_si128(&((__m128i*)out)[k], tmp1); |
wolfSSL | 13:f67a6c6013ca | 4261 | tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 4262 | X =_mm_xor_si128(X, tmp1); |
wolfSSL | 13:f67a6c6013ca | 4263 | X = gfmul_shifted(X, H); |
wolfSSL | 13:f67a6c6013ca | 4264 | } |
wolfSSL | 13:f67a6c6013ca | 4265 | #else |
wolfSSL | 13:f67a6c6013ca | 4266 | for (k = 0; k < (int)(nbytes/16) && k < 1; k++) { |
wolfSSL | 13:f67a6c6013ca | 4267 | tmp1 = _mm_shuffle_epi8(ctr1, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 4268 | ctr1 = _mm_add_epi32(ctr1, ONE); |
wolfSSL | 13:f67a6c6013ca | 4269 | tmp1 = _mm_xor_si128(tmp1, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 4270 | tmp1 = _mm_aesenc_si128(tmp1, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 4271 | tmp1 = _mm_aesenc_si128(tmp1, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 4272 | tmp1 = _mm_aesenc_si128(tmp1, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 4273 | tmp1 = _mm_aesenc_si128(tmp1, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 4274 | tmp1 = _mm_aesenc_si128(tmp1, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 4275 | tmp1 = _mm_aesenc_si128(tmp1, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 4276 | tmp1 = _mm_aesenc_si128(tmp1, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 4277 | tmp1 = _mm_aesenc_si128(tmp1, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 4278 | tmp1 = _mm_aesenc_si128(tmp1, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 4279 | lastKey = KEY[10]; |
wolfSSL | 13:f67a6c6013ca | 4280 | if (nr > 10) { |
wolfSSL | 13:f67a6c6013ca | 4281 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4282 | tmp1 = _mm_aesenc_si128(tmp1, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 4283 | lastKey = KEY[12]; |
wolfSSL | 13:f67a6c6013ca | 4284 | if (nr > 12) { |
wolfSSL | 13:f67a6c6013ca | 4285 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4286 | tmp1 = _mm_aesenc_si128(tmp1, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 4287 | lastKey = KEY[14]; |
wolfSSL | 13:f67a6c6013ca | 4288 | } |
wolfSSL | 13:f67a6c6013ca | 4289 | } |
wolfSSL | 13:f67a6c6013ca | 4290 | tmp1 = _mm_aesenclast_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4291 | tmp1 = _mm_xor_si128(tmp1, _mm_loadu_si128(&((__m128i*)in)[k])); |
wolfSSL | 13:f67a6c6013ca | 4292 | _mm_storeu_si128(&((__m128i*)out)[k], tmp1); |
wolfSSL | 13:f67a6c6013ca | 4293 | tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 4294 | X =_mm_xor_si128(X, tmp1); |
wolfSSL | 13:f67a6c6013ca | 4295 | } |
wolfSSL | 13:f67a6c6013ca | 4296 | for (; k < (int)(nbytes/16); k++) { |
wolfSSL | 13:f67a6c6013ca | 4297 | tmp1 = _mm_shuffle_epi8(ctr1, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 4298 | ctr1 = _mm_add_epi32(ctr1, ONE); |
wolfSSL | 13:f67a6c6013ca | 4299 | tmp1 = _mm_xor_si128(tmp1, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 4300 | tmp1 = _mm_aesenc_si128(tmp1, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 4301 | tmp1 = _mm_aesenc_si128(tmp1, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 4302 | tmp1 = _mm_aesenc_si128(tmp1, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 4303 | tmp1 = _mm_aesenc_si128(tmp1, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 4304 | tmp1 = _mm_aesenc_si128(tmp1, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 4305 | tmp1 = _mm_aesenc_si128(tmp1, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 4306 | tmp1 = _mm_aesenc_si128(tmp1, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 4307 | tmp1 = _mm_aesenc_si128(tmp1, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 4308 | tmp1 = _mm_aesenc_si128(tmp1, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 4309 | X = gfmul_shifted(X, H); |
wolfSSL | 13:f67a6c6013ca | 4310 | lastKey = KEY[10]; |
wolfSSL | 13:f67a6c6013ca | 4311 | if (nr > 10) { |
wolfSSL | 13:f67a6c6013ca | 4312 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4313 | tmp1 = _mm_aesenc_si128(tmp1, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 4314 | lastKey = KEY[12]; |
wolfSSL | 13:f67a6c6013ca | 4315 | if (nr > 12) { |
wolfSSL | 13:f67a6c6013ca | 4316 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4317 | tmp1 = _mm_aesenc_si128(tmp1, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 4318 | lastKey = KEY[14]; |
wolfSSL | 13:f67a6c6013ca | 4319 | } |
wolfSSL | 13:f67a6c6013ca | 4320 | } |
wolfSSL | 13:f67a6c6013ca | 4321 | tmp1 = _mm_aesenclast_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4322 | tmp1 = _mm_xor_si128(tmp1, _mm_loadu_si128(&((__m128i*)in)[k])); |
wolfSSL | 13:f67a6c6013ca | 4323 | _mm_storeu_si128(&((__m128i*)out)[k], tmp1); |
wolfSSL | 13:f67a6c6013ca | 4324 | tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 4325 | X =_mm_xor_si128(X, tmp1); |
wolfSSL | 13:f67a6c6013ca | 4326 | } |
wolfSSL | 13:f67a6c6013ca | 4327 | if (k > 0) { |
wolfSSL | 13:f67a6c6013ca | 4328 | X = gfmul_shifted(X, H); |
wolfSSL | 13:f67a6c6013ca | 4329 | } |
wolfSSL | 13:f67a6c6013ca | 4330 | #endif |
wolfSSL | 13:f67a6c6013ca | 4331 | /* If one partial block remains */ |
wolfSSL | 13:f67a6c6013ca | 4332 | if (nbytes % 16) { |
wolfSSL | 13:f67a6c6013ca | 4333 | tmp1 = _mm_shuffle_epi8(ctr1, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 4334 | tmp1 = _mm_xor_si128(tmp1, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 4335 | tmp1 = _mm_aesenc_si128(tmp1, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 4336 | tmp1 = _mm_aesenc_si128(tmp1, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 4337 | tmp1 = _mm_aesenc_si128(tmp1, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 4338 | tmp1 = _mm_aesenc_si128(tmp1, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 4339 | tmp1 = _mm_aesenc_si128(tmp1, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 4340 | tmp1 = _mm_aesenc_si128(tmp1, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 4341 | tmp1 = _mm_aesenc_si128(tmp1, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 4342 | tmp1 = _mm_aesenc_si128(tmp1, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 4343 | tmp1 = _mm_aesenc_si128(tmp1, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 4344 | lastKey = KEY[10]; |
wolfSSL | 13:f67a6c6013ca | 4345 | if (nr > 10) { |
wolfSSL | 13:f67a6c6013ca | 4346 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4347 | tmp1 = _mm_aesenc_si128(tmp1, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 4348 | lastKey = KEY[12]; |
wolfSSL | 13:f67a6c6013ca | 4349 | if (nr > 12) { |
wolfSSL | 13:f67a6c6013ca | 4350 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4351 | tmp1 = _mm_aesenc_si128(tmp1, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 4352 | lastKey = KEY[14]; |
wolfSSL | 13:f67a6c6013ca | 4353 | } |
wolfSSL | 13:f67a6c6013ca | 4354 | } |
wolfSSL | 13:f67a6c6013ca | 4355 | tmp1 = _mm_aesenclast_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4356 | last_block = tmp1; |
wolfSSL | 13:f67a6c6013ca | 4357 | for (j=0; j < (int)(nbytes%16); j++) |
wolfSSL | 13:f67a6c6013ca | 4358 | ((unsigned char*)&last_block)[j] = in[k*16+j]; |
wolfSSL | 13:f67a6c6013ca | 4359 | tmp1 = _mm_xor_si128(tmp1, last_block); |
wolfSSL | 13:f67a6c6013ca | 4360 | last_block = tmp1; |
wolfSSL | 13:f67a6c6013ca | 4361 | for (j=0; j < (int)(nbytes%16); j++) |
wolfSSL | 13:f67a6c6013ca | 4362 | out[k*16+j] = ((unsigned char*)&last_block)[j]; |
wolfSSL | 13:f67a6c6013ca | 4363 | tmp1 = last_block; |
wolfSSL | 13:f67a6c6013ca | 4364 | tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 4365 | X =_mm_xor_si128(X, tmp1); |
wolfSSL | 13:f67a6c6013ca | 4366 | X = gfmul_shifted(X, H); |
wolfSSL | 13:f67a6c6013ca | 4367 | } |
wolfSSL | 13:f67a6c6013ca | 4368 | tmp1 = _mm_insert_epi64(tmp1, nbytes*8, 0); |
wolfSSL | 13:f67a6c6013ca | 4369 | tmp1 = _mm_insert_epi64(tmp1, abytes*8, 1); |
wolfSSL | 13:f67a6c6013ca | 4370 | X = _mm_xor_si128(X, tmp1); |
wolfSSL | 13:f67a6c6013ca | 4371 | X = gfmul_shifted(X, H); |
wolfSSL | 13:f67a6c6013ca | 4372 | X = _mm_shuffle_epi8(X, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 4373 | T = _mm_xor_si128(X, T); |
wolfSSL | 13:f67a6c6013ca | 4374 | _mm_storeu_si128((__m128i*)tag, T); |
wolfSSL | 13:f67a6c6013ca | 4375 | } |
wolfSSL | 13:f67a6c6013ca | 4376 | |
wolfSSL | 13:f67a6c6013ca | 4377 | #ifdef HAVE_INTEL_AVX2 |
wolfSSL | 13:f67a6c6013ca | 4378 | static void AES_GCM_encrypt_avx2(const unsigned char *in, unsigned char *out, |
wolfSSL | 13:f67a6c6013ca | 4379 | const unsigned char* addt, |
wolfSSL | 13:f67a6c6013ca | 4380 | const unsigned char* ivec, |
wolfSSL | 13:f67a6c6013ca | 4381 | unsigned char *tag, unsigned int nbytes, |
wolfSSL | 13:f67a6c6013ca | 4382 | unsigned int abytes, unsigned int ibytes, |
wolfSSL | 13:f67a6c6013ca | 4383 | const unsigned char* key, int nr) |
wolfSSL | 13:f67a6c6013ca | 4384 | { |
wolfSSL | 13:f67a6c6013ca | 4385 | int i, j ,k; |
wolfSSL | 13:f67a6c6013ca | 4386 | __m128i ctr1; |
wolfSSL | 13:f67a6c6013ca | 4387 | __m128i H, Y, T; |
wolfSSL | 13:f67a6c6013ca | 4388 | __m128i X = _mm_setzero_si128(); |
wolfSSL | 13:f67a6c6013ca | 4389 | __m128i *KEY = (__m128i*)key, lastKey; |
wolfSSL | 13:f67a6c6013ca | 4390 | __m128i last_block = _mm_setzero_si128(); |
wolfSSL | 13:f67a6c6013ca | 4391 | #if !defined(AES_GCM_AESNI_NO_UNROLL) && !defined(AES_GCM_AVX2_NO_UNROLL) |
wolfSSL | 13:f67a6c6013ca | 4392 | __m128i HT[8]; |
wolfSSL | 13:f67a6c6013ca | 4393 | register __m128i tmp1 asm("xmm4"); |
wolfSSL | 13:f67a6c6013ca | 4394 | register __m128i tmp2 asm("xmm5"); |
wolfSSL | 13:f67a6c6013ca | 4395 | register __m128i tmp3 asm("xmm6"); |
wolfSSL | 13:f67a6c6013ca | 4396 | register __m128i tmp4 asm("xmm7"); |
wolfSSL | 13:f67a6c6013ca | 4397 | register __m128i tmp5 asm("xmm8"); |
wolfSSL | 13:f67a6c6013ca | 4398 | register __m128i tmp6 asm("xmm9"); |
wolfSSL | 13:f67a6c6013ca | 4399 | register __m128i tmp7 asm("xmm10"); |
wolfSSL | 13:f67a6c6013ca | 4400 | register __m128i tmp8 asm("xmm11"); |
wolfSSL | 13:f67a6c6013ca | 4401 | __m128i pctr1[1]; |
wolfSSL | 13:f67a6c6013ca | 4402 | register __m128i XV asm("xmm2"); |
wolfSSL | 13:f67a6c6013ca | 4403 | #else |
wolfSSL | 13:f67a6c6013ca | 4404 | __m128i tmp1, tmp2; |
wolfSSL | 13:f67a6c6013ca | 4405 | #endif |
wolfSSL | 13:f67a6c6013ca | 4406 | |
wolfSSL | 13:f67a6c6013ca | 4407 | if (ibytes == 12) { |
wolfSSL | 13:f67a6c6013ca | 4408 | Y = _mm_setzero_si128(); |
wolfSSL | 13:f67a6c6013ca | 4409 | for (j=0; j < 12; j++) |
wolfSSL | 13:f67a6c6013ca | 4410 | ((unsigned char*)&Y)[j] = ivec[j]; |
wolfSSL | 13:f67a6c6013ca | 4411 | Y = _mm_insert_epi32(Y, 0x1000000, 3); |
wolfSSL | 13:f67a6c6013ca | 4412 | /* (Compute E[ZERO, KS] and E[Y0, KS] together */ |
wolfSSL | 13:f67a6c6013ca | 4413 | tmp1 = _mm_xor_si128(X, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 4414 | tmp2 = _mm_xor_si128(Y, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 4415 | tmp1 = _mm_aesenc_si128(tmp1, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 4416 | tmp2 = _mm_aesenc_si128(tmp2, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 4417 | tmp1 = _mm_aesenc_si128(tmp1, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 4418 | tmp2 = _mm_aesenc_si128(tmp2, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 4419 | tmp1 = _mm_aesenc_si128(tmp1, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 4420 | tmp2 = _mm_aesenc_si128(tmp2, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 4421 | tmp1 = _mm_aesenc_si128(tmp1, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 4422 | tmp2 = _mm_aesenc_si128(tmp2, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 4423 | tmp1 = _mm_aesenc_si128(tmp1, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 4424 | tmp2 = _mm_aesenc_si128(tmp2, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 4425 | tmp1 = _mm_aesenc_si128(tmp1, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 4426 | tmp2 = _mm_aesenc_si128(tmp2, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 4427 | tmp1 = _mm_aesenc_si128(tmp1, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 4428 | tmp2 = _mm_aesenc_si128(tmp2, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 4429 | tmp1 = _mm_aesenc_si128(tmp1, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 4430 | tmp2 = _mm_aesenc_si128(tmp2, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 4431 | tmp1 = _mm_aesenc_si128(tmp1, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 4432 | tmp2 = _mm_aesenc_si128(tmp2, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 4433 | lastKey = KEY[10]; |
wolfSSL | 13:f67a6c6013ca | 4434 | if (nr > 10) { |
wolfSSL | 13:f67a6c6013ca | 4435 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4436 | tmp2 = _mm_aesenc_si128(tmp2, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4437 | tmp1 = _mm_aesenc_si128(tmp1, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 4438 | tmp2 = _mm_aesenc_si128(tmp2, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 4439 | lastKey = KEY[12]; |
wolfSSL | 13:f67a6c6013ca | 4440 | if (nr > 12) { |
wolfSSL | 13:f67a6c6013ca | 4441 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4442 | tmp2 = _mm_aesenc_si128(tmp2, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4443 | tmp1 = _mm_aesenc_si128(tmp1, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 4444 | tmp2 = _mm_aesenc_si128(tmp2, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 4445 | lastKey = KEY[14]; |
wolfSSL | 13:f67a6c6013ca | 4446 | } |
wolfSSL | 13:f67a6c6013ca | 4447 | } |
wolfSSL | 13:f67a6c6013ca | 4448 | H = _mm_aesenclast_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4449 | T = _mm_aesenclast_si128(tmp2, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4450 | H = _mm_shuffle_epi8(H, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 4451 | } |
wolfSSL | 13:f67a6c6013ca | 4452 | else { |
wolfSSL | 13:f67a6c6013ca | 4453 | if (ibytes % 16) { |
wolfSSL | 13:f67a6c6013ca | 4454 | i = ibytes / 16; |
wolfSSL | 13:f67a6c6013ca | 4455 | for (j=0; j < (int)(ibytes%16); j++) |
wolfSSL | 13:f67a6c6013ca | 4456 | ((unsigned char*)&last_block)[j] = ivec[i*16+j]; |
wolfSSL | 13:f67a6c6013ca | 4457 | } |
wolfSSL | 13:f67a6c6013ca | 4458 | tmp1 = _mm_xor_si128(X, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 4459 | tmp1 = _mm_aesenc_si128(tmp1, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 4460 | tmp1 = _mm_aesenc_si128(tmp1, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 4461 | tmp1 = _mm_aesenc_si128(tmp1, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 4462 | tmp1 = _mm_aesenc_si128(tmp1, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 4463 | tmp1 = _mm_aesenc_si128(tmp1, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 4464 | tmp1 = _mm_aesenc_si128(tmp1, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 4465 | tmp1 = _mm_aesenc_si128(tmp1, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 4466 | tmp1 = _mm_aesenc_si128(tmp1, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 4467 | tmp1 = _mm_aesenc_si128(tmp1, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 4468 | lastKey = KEY[10]; |
wolfSSL | 13:f67a6c6013ca | 4469 | if (nr > 10) { |
wolfSSL | 13:f67a6c6013ca | 4470 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4471 | tmp1 = _mm_aesenc_si128(tmp1, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 4472 | lastKey = KEY[12]; |
wolfSSL | 13:f67a6c6013ca | 4473 | if (nr > 12) { |
wolfSSL | 13:f67a6c6013ca | 4474 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4475 | tmp1 = _mm_aesenc_si128(tmp1, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 4476 | lastKey = KEY[14]; |
wolfSSL | 13:f67a6c6013ca | 4477 | } |
wolfSSL | 13:f67a6c6013ca | 4478 | } |
wolfSSL | 13:f67a6c6013ca | 4479 | H = _mm_aesenclast_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4480 | H = _mm_shuffle_epi8(H, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 4481 | Y = _mm_setzero_si128(); |
wolfSSL | 13:f67a6c6013ca | 4482 | for (i=0; i < (int)(ibytes/16); i++) { |
wolfSSL | 13:f67a6c6013ca | 4483 | tmp1 = _mm_loadu_si128(&((__m128i*)ivec)[i]); |
wolfSSL | 13:f67a6c6013ca | 4484 | tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 4485 | Y = _mm_xor_si128(Y, tmp1); |
wolfSSL | 13:f67a6c6013ca | 4486 | Y = gfmul_sw(Y, H); |
wolfSSL | 13:f67a6c6013ca | 4487 | } |
wolfSSL | 13:f67a6c6013ca | 4488 | if (ibytes % 16) { |
wolfSSL | 13:f67a6c6013ca | 4489 | tmp1 = last_block; |
wolfSSL | 13:f67a6c6013ca | 4490 | tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 4491 | Y = _mm_xor_si128(Y, tmp1); |
wolfSSL | 13:f67a6c6013ca | 4492 | Y = gfmul_sw(Y, H); |
wolfSSL | 13:f67a6c6013ca | 4493 | } |
wolfSSL | 13:f67a6c6013ca | 4494 | tmp1 = _mm_insert_epi64(tmp1, ibytes*8, 0); |
wolfSSL | 13:f67a6c6013ca | 4495 | tmp1 = _mm_insert_epi64(tmp1, 0, 1); |
wolfSSL | 13:f67a6c6013ca | 4496 | Y = _mm_xor_si128(Y, tmp1); |
wolfSSL | 13:f67a6c6013ca | 4497 | Y = gfmul_sw(Y, H); |
wolfSSL | 13:f67a6c6013ca | 4498 | Y = _mm_shuffle_epi8(Y, BSWAP_MASK); /* Compute E(K, Y0) */ |
wolfSSL | 13:f67a6c6013ca | 4499 | tmp1 = _mm_xor_si128(Y, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 4500 | tmp1 = _mm_aesenc_si128(tmp1, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 4501 | tmp1 = _mm_aesenc_si128(tmp1, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 4502 | tmp1 = _mm_aesenc_si128(tmp1, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 4503 | tmp1 = _mm_aesenc_si128(tmp1, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 4504 | tmp1 = _mm_aesenc_si128(tmp1, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 4505 | tmp1 = _mm_aesenc_si128(tmp1, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 4506 | tmp1 = _mm_aesenc_si128(tmp1, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 4507 | tmp1 = _mm_aesenc_si128(tmp1, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 4508 | tmp1 = _mm_aesenc_si128(tmp1, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 4509 | lastKey = KEY[10]; |
wolfSSL | 13:f67a6c6013ca | 4510 | if (nr > 10) { |
wolfSSL | 13:f67a6c6013ca | 4511 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4512 | tmp1 = _mm_aesenc_si128(tmp1, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 4513 | lastKey = KEY[12]; |
wolfSSL | 13:f67a6c6013ca | 4514 | if (nr > 12) { |
wolfSSL | 13:f67a6c6013ca | 4515 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4516 | tmp1 = _mm_aesenc_si128(tmp1, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 4517 | lastKey = KEY[14]; |
wolfSSL | 13:f67a6c6013ca | 4518 | } |
wolfSSL | 13:f67a6c6013ca | 4519 | } |
wolfSSL | 13:f67a6c6013ca | 4520 | T = _mm_aesenclast_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 4521 | } |
wolfSSL | 13:f67a6c6013ca | 4522 | |
wolfSSL | 13:f67a6c6013ca | 4523 | for (i=0; i < (int)(abytes/16); i++) { |
wolfSSL | 13:f67a6c6013ca | 4524 | tmp1 = _mm_loadu_si128(&((__m128i*)addt)[i]); |
wolfSSL | 13:f67a6c6013ca | 4525 | tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 4526 | X = _mm_xor_si128(X, tmp1); |
wolfSSL | 13:f67a6c6013ca | 4527 | X = gfmul_sw(X, H); |
wolfSSL | 13:f67a6c6013ca | 4528 | } |
wolfSSL | 13:f67a6c6013ca | 4529 | if (abytes%16) { |
wolfSSL | 13:f67a6c6013ca | 4530 | last_block = _mm_setzero_si128(); |
wolfSSL | 13:f67a6c6013ca | 4531 | for (j=0; j < (int)(abytes%16); j++) |
wolfSSL | 13:f67a6c6013ca | 4532 | ((unsigned char*)&last_block)[j] = addt[i*16+j]; |
wolfSSL | 13:f67a6c6013ca | 4533 | tmp1 = last_block; |
wolfSSL | 13:f67a6c6013ca | 4534 | tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 4535 | X = _mm_xor_si128(X, tmp1); |
wolfSSL | 13:f67a6c6013ca | 4536 | X = gfmul_sw(X, H); |
wolfSSL | 13:f67a6c6013ca | 4537 | } |
wolfSSL | 13:f67a6c6013ca | 4538 | |
wolfSSL | 13:f67a6c6013ca | 4539 | tmp1 = _mm_shuffle_epi8(Y, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 4540 | ctr1 = _mm_add_epi32(tmp1, ONE); |
wolfSSL | 13:f67a6c6013ca | 4541 | H = gfmul_shl1(H); |
wolfSSL | 13:f67a6c6013ca | 4542 | |
wolfSSL | 13:f67a6c6013ca | 4543 | #if !defined(AES_GCM_AESNI_NO_UNROLL) && !defined(AES_GCM_AVX2_NO_UNROLL) |
wolfSSL | 13:f67a6c6013ca | 4544 | i = 0; |
wolfSSL | 13:f67a6c6013ca | 4545 | if (nbytes >= 16*8) { |
wolfSSL | 13:f67a6c6013ca | 4546 | HT[0] = H; |
wolfSSL | 13:f67a6c6013ca | 4547 | HT[1] = gfmul_shifted(H, H); |
wolfSSL | 13:f67a6c6013ca | 4548 | HT[2] = gfmul_shifted(H, HT[1]); |
wolfSSL | 13:f67a6c6013ca | 4549 | HT[3] = gfmul_shifted(HT[1], HT[1]); |
wolfSSL | 13:f67a6c6013ca | 4550 | HT[4] = gfmul_shifted(HT[1], HT[2]); |
wolfSSL | 13:f67a6c6013ca | 4551 | HT[5] = gfmul_shifted(HT[2], HT[2]); |
wolfSSL | 13:f67a6c6013ca | 4552 | HT[6] = gfmul_shifted(HT[2], HT[3]); |
wolfSSL | 13:f67a6c6013ca | 4553 | HT[7] = gfmul_shifted(HT[3], HT[3]); |
wolfSSL | 13:f67a6c6013ca | 4554 | |
wolfSSL | 13:f67a6c6013ca | 4555 | pctr1[0] = ctr1; |
wolfSSL | 13:f67a6c6013ca | 4556 | __asm__ __volatile__ ( |
wolfSSL | 13:f67a6c6013ca | 4557 | "vmovaps (%[pctr1]), %%xmm0\n\t" |
wolfSSL | 13:f67a6c6013ca | 4558 | "vmovaps %[BSWAP_EPI64], %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 4559 | "vpshufb %%xmm1, %%xmm0, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 4560 | "vpaddd %[ONE], %%xmm0, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 4561 | "vpshufb %%xmm1, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 4562 | "vpaddd %[TWO], %%xmm0, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 4563 | "vpshufb %%xmm1, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 4564 | "vpaddd %[THREE], %%xmm0, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 4565 | "vpshufb %%xmm1, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 4566 | "vpaddd %[FOUR], %%xmm0, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 4567 | "vpshufb %%xmm1, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 4568 | "vpaddd %[FIVE], %%xmm0, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 4569 | "vpshufb %%xmm1, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 4570 | "vpaddd %[SIX], %%xmm0, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 4571 | "vpshufb %%xmm1, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 4572 | "vpaddd %[SEVEN], %%xmm0, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 4573 | "vpshufb %%xmm1, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 4574 | "vpaddd %[EIGHT], %%xmm0, %%xmm0\n\t" |
wolfSSL | 13:f67a6c6013ca | 4575 | |
wolfSSL | 13:f67a6c6013ca | 4576 | "vmovaps (%[KEY]), %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 4577 | "vmovaps %%xmm0, (%[pctr1])\n\t" |
wolfSSL | 13:f67a6c6013ca | 4578 | "vpxor %%xmm1, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 4579 | "vpxor %%xmm1, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 4580 | "vpxor %%xmm1, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 4581 | "vpxor %%xmm1, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 4582 | "vpxor %%xmm1, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 4583 | "vpxor %%xmm1, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 4584 | "vpxor %%xmm1, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 4585 | "vpxor %%xmm1, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 4586 | |
wolfSSL | 13:f67a6c6013ca | 4587 | "vmovaps 16(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 4588 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 4589 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 4590 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 4591 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 4592 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 4593 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 4594 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 4595 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 4596 | |
wolfSSL | 13:f67a6c6013ca | 4597 | "vmovaps 32(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 4598 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 4599 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 4600 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 4601 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 4602 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 4603 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 4604 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 4605 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 4606 | |
wolfSSL | 13:f67a6c6013ca | 4607 | "vmovaps 48(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 4608 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 4609 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 4610 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 4611 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 4612 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 4613 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 4614 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 4615 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 4616 | |
wolfSSL | 13:f67a6c6013ca | 4617 | "vmovaps 64(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 4618 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 4619 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 4620 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 4621 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 4622 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 4623 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 4624 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 4625 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 4626 | |
wolfSSL | 13:f67a6c6013ca | 4627 | "vmovaps 80(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 4628 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 4629 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 4630 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 4631 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 4632 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 4633 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 4634 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 4635 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 4636 | |
wolfSSL | 13:f67a6c6013ca | 4637 | "vmovaps 96(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 4638 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 4639 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 4640 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 4641 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 4642 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 4643 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 4644 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 4645 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 4646 | |
wolfSSL | 13:f67a6c6013ca | 4647 | "vmovaps 112(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 4648 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 4649 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 4650 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 4651 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 4652 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 4653 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 4654 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 4655 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 4656 | |
wolfSSL | 13:f67a6c6013ca | 4657 | "vmovaps 128(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 4658 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 4659 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 4660 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 4661 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 4662 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 4663 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 4664 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 4665 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 4666 | |
wolfSSL | 13:f67a6c6013ca | 4667 | "vmovaps 144(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 4668 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 4669 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 4670 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 4671 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 4672 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 4673 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 4674 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 4675 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 4676 | "cmpl $11, %[nr]\n\t" |
wolfSSL | 13:f67a6c6013ca | 4677 | "vmovaps 160(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 4678 | "jl L_enc128_enclast\n\t" |
wolfSSL | 13:f67a6c6013ca | 4679 | |
wolfSSL | 13:f67a6c6013ca | 4680 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 4681 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 4682 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 4683 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 4684 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 4685 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 4686 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 4687 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 4688 | "vmovaps 176(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 4689 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 4690 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 4691 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 4692 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 4693 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 4694 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 4695 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 4696 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 4697 | "cmpl $13, %[nr]\n\t" |
wolfSSL | 13:f67a6c6013ca | 4698 | "vmovaps 192(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 4699 | "jl L_enc128_enclast\n\t" |
wolfSSL | 13:f67a6c6013ca | 4700 | |
wolfSSL | 13:f67a6c6013ca | 4701 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 4702 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 4703 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 4704 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 4705 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 4706 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 4707 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 4708 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 4709 | "vmovaps 208(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 4710 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 4711 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 4712 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 4713 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 4714 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 4715 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 4716 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 4717 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 4718 | "vmovaps 224(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 4719 | "\n" |
wolfSSL | 13:f67a6c6013ca | 4720 | "L_enc128_enclast:\n\t" |
wolfSSL | 13:f67a6c6013ca | 4721 | "vaesenclast %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 4722 | "vaesenclast %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 4723 | "vpxor (%[in]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 4724 | "vpxor 16(%[in]), %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 4725 | "vmovdqu %%xmm4, (%[out])\n\t" |
wolfSSL | 13:f67a6c6013ca | 4726 | "vmovdqu %%xmm5, 16(%[out])\n\t" |
wolfSSL | 13:f67a6c6013ca | 4727 | "vaesenclast %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 4728 | "vaesenclast %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 4729 | "vpxor 32(%[in]), %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 4730 | "vpxor 48(%[in]), %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 4731 | "vmovdqu %%xmm6, 32(%[out])\n\t" |
wolfSSL | 13:f67a6c6013ca | 4732 | "vmovdqu %%xmm7, 48(%[out])\n\t" |
wolfSSL | 13:f67a6c6013ca | 4733 | "vaesenclast %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 4734 | "vaesenclast %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 4735 | "vpxor 64(%[in]), %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 4736 | "vpxor 80(%[in]), %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 4737 | "vmovdqu %%xmm8, 64(%[out])\n\t" |
wolfSSL | 13:f67a6c6013ca | 4738 | "vmovdqu %%xmm9, 80(%[out])\n\t" |
wolfSSL | 13:f67a6c6013ca | 4739 | "vaesenclast %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 4740 | "vaesenclast %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 4741 | "vpxor 96(%[in]), %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 4742 | "vpxor 112(%[in]), %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 4743 | "vmovdqu %%xmm10, 96(%[out])\n\t" |
wolfSSL | 13:f67a6c6013ca | 4744 | "vmovdqu %%xmm11, 112(%[out])\n\t" |
wolfSSL | 13:f67a6c6013ca | 4745 | |
wolfSSL | 13:f67a6c6013ca | 4746 | : |
wolfSSL | 13:f67a6c6013ca | 4747 | : [KEY] "r" (KEY), [pctr1] "r" (pctr1), |
wolfSSL | 13:f67a6c6013ca | 4748 | [in] "r" (&in[i*16*8]), [out] "r" (&out[i*16*8]), [nr] "r" (nr), |
wolfSSL | 13:f67a6c6013ca | 4749 | [BSWAP_EPI64] "xrm" (BSWAP_EPI64), |
wolfSSL | 13:f67a6c6013ca | 4750 | [ONE] "xrm" (ONE), [TWO] "xrm" (TWO), |
wolfSSL | 13:f67a6c6013ca | 4751 | [THREE] "xrm" (THREE), [FOUR] "xrm" (FOUR), |
wolfSSL | 13:f67a6c6013ca | 4752 | [FIVE] "xrm" (FIVE), [SIX] "xrm" (SIX), |
wolfSSL | 13:f67a6c6013ca | 4753 | [SEVEN] "xrm" (SEVEN), [EIGHT] "xrm" (EIGHT) |
wolfSSL | 13:f67a6c6013ca | 4754 | : "xmm15", "xmm14", "xmm13", "xmm12", |
wolfSSL | 13:f67a6c6013ca | 4755 | "xmm11", "xmm10", "xmm9", "xmm8", |
wolfSSL | 13:f67a6c6013ca | 4756 | "xmm7", "xmm6", "xmm5", "xmm4", |
wolfSSL | 13:f67a6c6013ca | 4757 | "xmm0", "xmm1", "xmm3", "memory" |
wolfSSL | 13:f67a6c6013ca | 4758 | ); |
wolfSSL | 13:f67a6c6013ca | 4759 | |
wolfSSL | 13:f67a6c6013ca | 4760 | XV = X; |
wolfSSL | 13:f67a6c6013ca | 4761 | for (i=1; i < (int)(nbytes/16/8); i++) { |
wolfSSL | 13:f67a6c6013ca | 4762 | __asm__ __volatile__ ( |
wolfSSL | 13:f67a6c6013ca | 4763 | "vmovaps (%[pctr1]), %%xmm0\n\t" |
wolfSSL | 13:f67a6c6013ca | 4764 | "vmovaps %[BSWAP_EPI64], %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 4765 | "vpshufb %%xmm1, %%xmm0, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 4766 | "vpaddd %[ONE], %%xmm0, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 4767 | "vpshufb %%xmm1, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 4768 | "vpaddd %[TWO], %%xmm0, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 4769 | "vpshufb %%xmm1, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 4770 | "vpaddd %[THREE], %%xmm0, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 4771 | "vpshufb %%xmm1, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 4772 | "vpaddd %[FOUR], %%xmm0, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 4773 | "vpshufb %%xmm1, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 4774 | "vpaddd %[FIVE], %%xmm0, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 4775 | "vpshufb %%xmm1, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 4776 | "vpaddd %[SIX], %%xmm0, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 4777 | "vpshufb %%xmm1, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 4778 | "vpaddd %[SEVEN], %%xmm0, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 4779 | "vpshufb %%xmm1, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 4780 | "vpaddd %[EIGHT], %%xmm0, %%xmm0\n\t" |
wolfSSL | 13:f67a6c6013ca | 4781 | |
wolfSSL | 13:f67a6c6013ca | 4782 | "vmovaps (%[KEY]), %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 4783 | "vmovaps %%xmm0, (%[pctr1])\n\t" |
wolfSSL | 13:f67a6c6013ca | 4784 | "vpxor %%xmm1, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 4785 | "vpxor %%xmm1, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 4786 | "vpxor %%xmm1, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 4787 | "vpxor %%xmm1, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 4788 | "vpxor %%xmm1, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 4789 | "vpxor %%xmm1, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 4790 | "vpxor %%xmm1, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 4791 | "vpxor %%xmm1, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 4792 | |
wolfSSL | 13:f67a6c6013ca | 4793 | "vmovaps 16(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 4794 | "vmovdqu -128(%[out]), %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 4795 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 4796 | "vmovaps 112(%[HT]), %%xmm0\n\t" |
wolfSSL | 13:f67a6c6013ca | 4797 | "vpshufb %[BSWAP_MASK], %%xmm1, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 4798 | "vpxor %[XV], %%xmm1, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 4799 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 4800 | "vpclmulqdq $16, %%xmm1, %%xmm0, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 4801 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 4802 | "vpclmulqdq $1, %%xmm1, %%xmm0, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 4803 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 4804 | "vpclmulqdq $0, %%xmm1, %%xmm0, %%xmm15\n\t" |
wolfSSL | 13:f67a6c6013ca | 4805 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 4806 | "vpclmulqdq $17, %%xmm1, %%xmm0, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 4807 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 4808 | "vpxor %%xmm14, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 4809 | "vpslldq $8, %%xmm13, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 4810 | "vpsrldq $8, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 4811 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 4812 | "vpxor %%xmm15, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 4813 | "vpxor %%xmm13, %%xmm1, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 4814 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 4815 | |
wolfSSL | 13:f67a6c6013ca | 4816 | "vmovaps 32(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 4817 | "vmovdqu -112(%[out]), %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 4818 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 4819 | "vmovaps 96(%[HT]), %%xmm0\n\t" |
wolfSSL | 13:f67a6c6013ca | 4820 | "vpshufb %[BSWAP_MASK], %%xmm1, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 4821 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 4822 | "vpclmulqdq $16, %%xmm1, %%xmm0, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 4823 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 4824 | "vpclmulqdq $1, %%xmm1, %%xmm0, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 4825 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 4826 | "vpclmulqdq $0, %%xmm1, %%xmm0, %%xmm15\n\t" |
wolfSSL | 13:f67a6c6013ca | 4827 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 4828 | "vpclmulqdq $17, %%xmm1, %%xmm0, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 4829 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 4830 | "vpxor %%xmm14, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 4831 | "vpslldq $8, %%xmm13, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 4832 | "vpsrldq $8, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 4833 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 4834 | "vpxor %%xmm15, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 4835 | "vpxor %%xmm1, %%xmm3, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 4836 | "vpxor %%xmm14, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 4837 | "vpxor %%xmm13, %%xmm3, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 4838 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 4839 | |
wolfSSL | 13:f67a6c6013ca | 4840 | "vmovaps 48(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 4841 | "vmovdqu -96(%[out]), %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 4842 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 4843 | "vmovaps 80(%[HT]), %%xmm0\n\t" |
wolfSSL | 13:f67a6c6013ca | 4844 | "vpshufb %[BSWAP_MASK], %%xmm1, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 4845 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 4846 | "vpclmulqdq $16, %%xmm1, %%xmm0, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 4847 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 4848 | "vpclmulqdq $1, %%xmm1, %%xmm0, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 4849 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 4850 | "vpclmulqdq $0, %%xmm1, %%xmm0, %%xmm15\n\t" |
wolfSSL | 13:f67a6c6013ca | 4851 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 4852 | "vpclmulqdq $17, %%xmm1, %%xmm0, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 4853 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 4854 | "vpxor %%xmm14, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 4855 | "vpslldq $8, %%xmm13, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 4856 | "vpsrldq $8, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 4857 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 4858 | "vpxor %%xmm15, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 4859 | "vpxor %%xmm1, %%xmm3, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 4860 | "vpxor %%xmm14, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 4861 | "vpxor %%xmm13, %%xmm3, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 4862 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 4863 | |
wolfSSL | 13:f67a6c6013ca | 4864 | "vmovaps 64(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 4865 | "vmovdqu -80(%[out]), %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 4866 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 4867 | "vmovaps 64(%[HT]), %%xmm0\n\t" |
wolfSSL | 13:f67a6c6013ca | 4868 | "vpshufb %[BSWAP_MASK], %%xmm1, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 4869 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 4870 | "vpclmulqdq $16, %%xmm1, %%xmm0, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 4871 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 4872 | "vpclmulqdq $1, %%xmm1, %%xmm0, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 4873 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 4874 | "vpclmulqdq $0, %%xmm1, %%xmm0, %%xmm15\n\t" |
wolfSSL | 13:f67a6c6013ca | 4875 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 4876 | "vpclmulqdq $17, %%xmm1, %%xmm0, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 4877 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 4878 | "vpxor %%xmm14, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 4879 | "vpslldq $8, %%xmm13, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 4880 | "vpsrldq $8, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 4881 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 4882 | "vpxor %%xmm15, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 4883 | "vpxor %%xmm1, %%xmm3, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 4884 | "vpxor %%xmm14, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 4885 | "vpxor %%xmm13, %%xmm3, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 4886 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 4887 | |
wolfSSL | 13:f67a6c6013ca | 4888 | "vmovaps 80(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 4889 | "vmovdqu -64(%[out]), %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 4890 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 4891 | "vmovaps 48(%[HT]), %%xmm0\n\t" |
wolfSSL | 13:f67a6c6013ca | 4892 | "vpshufb %[BSWAP_MASK], %%xmm1, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 4893 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 4894 | "vpclmulqdq $16, %%xmm1, %%xmm0, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 4895 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 4896 | "vpclmulqdq $1, %%xmm1, %%xmm0, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 4897 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 4898 | "vpclmulqdq $0, %%xmm1, %%xmm0, %%xmm15\n\t" |
wolfSSL | 13:f67a6c6013ca | 4899 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 4900 | "vpclmulqdq $17, %%xmm1, %%xmm0, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 4901 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 4902 | "vpxor %%xmm14, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 4903 | "vpslldq $8, %%xmm13, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 4904 | "vpsrldq $8, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 4905 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 4906 | "vpxor %%xmm15, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 4907 | "vpxor %%xmm1, %%xmm3, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 4908 | "vpxor %%xmm14, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 4909 | "vpxor %%xmm13, %%xmm3, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 4910 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 4911 | |
wolfSSL | 13:f67a6c6013ca | 4912 | "vmovaps 96(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 4913 | "vmovdqu -48(%[out]), %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 4914 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 4915 | "vmovaps 32(%[HT]), %%xmm0\n\t" |
wolfSSL | 13:f67a6c6013ca | 4916 | "vpshufb %[BSWAP_MASK], %%xmm1, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 4917 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 4918 | "vpclmulqdq $16, %%xmm1, %%xmm0, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 4919 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 4920 | "vpclmulqdq $1, %%xmm1, %%xmm0, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 4921 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 4922 | "vpclmulqdq $0, %%xmm1, %%xmm0, %%xmm15\n\t" |
wolfSSL | 13:f67a6c6013ca | 4923 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 4924 | "vpclmulqdq $17, %%xmm1, %%xmm0, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 4925 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 4926 | "vpxor %%xmm14, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 4927 | "vpslldq $8, %%xmm13, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 4928 | "vpsrldq $8, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 4929 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 4930 | "vpxor %%xmm15, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 4931 | "vpxor %%xmm1, %%xmm3, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 4932 | "vpxor %%xmm14, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 4933 | "vpxor %%xmm13, %%xmm3, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 4934 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 4935 | |
wolfSSL | 13:f67a6c6013ca | 4936 | "vmovaps 112(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 4937 | "vmovdqu -32(%[out]), %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 4938 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 4939 | "vmovaps 16(%[HT]), %%xmm0\n\t" |
wolfSSL | 13:f67a6c6013ca | 4940 | "vpshufb %[BSWAP_MASK], %%xmm1, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 4941 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 4942 | "vpclmulqdq $16, %%xmm1, %%xmm0, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 4943 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 4944 | "vpclmulqdq $1, %%xmm1, %%xmm0, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 4945 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 4946 | "vpclmulqdq $0, %%xmm1, %%xmm0, %%xmm15\n\t" |
wolfSSL | 13:f67a6c6013ca | 4947 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 4948 | "vpclmulqdq $17, %%xmm1, %%xmm0, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 4949 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 4950 | "vpxor %%xmm14, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 4951 | "vpslldq $8, %%xmm13, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 4952 | "vpsrldq $8, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 4953 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 4954 | "vpxor %%xmm15, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 4955 | "vpxor %%xmm1, %%xmm3, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 4956 | "vpxor %%xmm14, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 4957 | "vpxor %%xmm13, %%xmm3, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 4958 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 4959 | |
wolfSSL | 13:f67a6c6013ca | 4960 | "vmovaps 128(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 4961 | "vmovdqu -16(%[out]), %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 4962 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 4963 | "vmovaps (%[HT]), %%xmm0\n\t" |
wolfSSL | 13:f67a6c6013ca | 4964 | "vpshufb %[BSWAP_MASK], %%xmm1, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 4965 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 4966 | "vpclmulqdq $16, %%xmm1, %%xmm0, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 4967 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 4968 | "vpclmulqdq $1, %%xmm1, %%xmm0, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 4969 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 4970 | "vpclmulqdq $0, %%xmm1, %%xmm0, %%xmm15\n\t" |
wolfSSL | 13:f67a6c6013ca | 4971 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 4972 | "vpclmulqdq $17, %%xmm1, %%xmm0, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 4973 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 4974 | "vpxor %%xmm14, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 4975 | "vpslldq $8, %%xmm13, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 4976 | "vpsrldq $8, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 4977 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 4978 | "vpxor %%xmm15, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 4979 | "vpxor %%xmm1, %%xmm3, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 4980 | "vpxor %%xmm14, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 4981 | "vpxor %%xmm13, %%xmm3, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 4982 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 4983 | |
wolfSSL | 13:f67a6c6013ca | 4984 | "vmovaps 144(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 4985 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 4986 | "vmovdqa %[MOD2_128], %%xmm0\n\t" |
wolfSSL | 13:f67a6c6013ca | 4987 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 4988 | "vpclmulqdq $16, %%xmm0, %%xmm2, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 4989 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 4990 | "vpshufd $78, %%xmm2, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 4991 | "vpxor %%xmm14, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 4992 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 4993 | "vpclmulqdq $16, %%xmm0, %%xmm13, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 4994 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 4995 | "vpshufd $78, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 4996 | "vpxor %%xmm14, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 4997 | "vpxor %%xmm3, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 4998 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 4999 | "vmovdqa %%xmm13, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 5000 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 5001 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 5002 | "cmpl $11, %[nr]\n\t" |
wolfSSL | 13:f67a6c6013ca | 5003 | "vmovaps 160(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 5004 | "jl %=f\n\t" |
wolfSSL | 13:f67a6c6013ca | 5005 | |
wolfSSL | 13:f67a6c6013ca | 5006 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5007 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 5008 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 5009 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 5010 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 5011 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 5012 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 5013 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 5014 | "vmovaps 176(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 5015 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5016 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 5017 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 5018 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 5019 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 5020 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 5021 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 5022 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 5023 | "cmpl $13, %[nr]\n\t" |
wolfSSL | 13:f67a6c6013ca | 5024 | "vmovaps 192(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 5025 | "jl %=f\n\t" |
wolfSSL | 13:f67a6c6013ca | 5026 | |
wolfSSL | 13:f67a6c6013ca | 5027 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5028 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 5029 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 5030 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 5031 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 5032 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 5033 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 5034 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 5035 | "vmovaps 208(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 5036 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5037 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 5038 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 5039 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 5040 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 5041 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 5042 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 5043 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 5044 | "vmovaps 224(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 5045 | |
wolfSSL | 13:f67a6c6013ca | 5046 | "%=:\n\t" |
wolfSSL | 13:f67a6c6013ca | 5047 | "vaesenclast %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5048 | "vaesenclast %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 5049 | "vpxor (%[in]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5050 | "vpxor 16(%[in]), %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 5051 | "vmovdqu %%xmm4, (%[out])\n\t" |
wolfSSL | 13:f67a6c6013ca | 5052 | "vmovdqu %%xmm5, 16(%[out])\n\t" |
wolfSSL | 13:f67a6c6013ca | 5053 | "vaesenclast %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 5054 | "vaesenclast %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 5055 | "vpxor 32(%[in]), %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 5056 | "vpxor 48(%[in]), %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 5057 | "vmovdqu %%xmm6, 32(%[out])\n\t" |
wolfSSL | 13:f67a6c6013ca | 5058 | "vmovdqu %%xmm7, 48(%[out])\n\t" |
wolfSSL | 13:f67a6c6013ca | 5059 | "vaesenclast %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 5060 | "vaesenclast %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 5061 | "vpxor 64(%[in]), %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 5062 | "vpxor 80(%[in]), %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 5063 | "vmovdqu %%xmm8, 64(%[out])\n\t" |
wolfSSL | 13:f67a6c6013ca | 5064 | "vmovdqu %%xmm9, 80(%[out])\n\t" |
wolfSSL | 13:f67a6c6013ca | 5065 | "vaesenclast %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 5066 | "vaesenclast %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 5067 | "vpxor 96(%[in]), %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 5068 | "vpxor 112(%[in]), %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 5069 | "vmovdqu %%xmm10, 96(%[out])\n\t" |
wolfSSL | 13:f67a6c6013ca | 5070 | "vmovdqu %%xmm11, 112(%[out])\n\t" |
wolfSSL | 13:f67a6c6013ca | 5071 | |
wolfSSL | 13:f67a6c6013ca | 5072 | : [XV] "+xr" (XV) |
wolfSSL | 13:f67a6c6013ca | 5073 | : [KEY] "r" (KEY), [HT] "r" (HT), [pctr1] "r" (pctr1), |
wolfSSL | 13:f67a6c6013ca | 5074 | [in] "r" (&in[i*16*8]), [out] "r" (&out[i*16*8]), [nr] "r" (nr), |
wolfSSL | 13:f67a6c6013ca | 5075 | [BSWAP_MASK] "xrm" (BSWAP_MASK), |
wolfSSL | 13:f67a6c6013ca | 5076 | [BSWAP_EPI64] "xrm" (BSWAP_EPI64), |
wolfSSL | 13:f67a6c6013ca | 5077 | [ONE] "xrm" (ONE), [TWO] "xrm" (TWO), |
wolfSSL | 13:f67a6c6013ca | 5078 | [THREE] "xrm" (THREE), [FOUR] "xrm" (FOUR), |
wolfSSL | 13:f67a6c6013ca | 5079 | [FIVE] "xrm" (FIVE), [SIX] "xrm" (SIX), |
wolfSSL | 13:f67a6c6013ca | 5080 | [SEVEN] "xrm" (SEVEN), [EIGHT] "xrm" (EIGHT), |
wolfSSL | 13:f67a6c6013ca | 5081 | [MOD2_128] "xrm" (MOD2_128) |
wolfSSL | 13:f67a6c6013ca | 5082 | : "xmm15", "xmm14", "xmm13", "xmm12", |
wolfSSL | 13:f67a6c6013ca | 5083 | "xmm11", "xmm10", "xmm9", "xmm8", |
wolfSSL | 13:f67a6c6013ca | 5084 | "xmm7", "xmm6", "xmm5", "xmm4", |
wolfSSL | 13:f67a6c6013ca | 5085 | "xmm0", "xmm1", "xmm3", "memory" |
wolfSSL | 13:f67a6c6013ca | 5086 | ); |
wolfSSL | 13:f67a6c6013ca | 5087 | } |
wolfSSL | 13:f67a6c6013ca | 5088 | X = XV; |
wolfSSL | 13:f67a6c6013ca | 5089 | ctr1 = pctr1[0]; |
wolfSSL | 13:f67a6c6013ca | 5090 | tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5091 | tmp2 = _mm_shuffle_epi8(tmp2, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5092 | tmp3 = _mm_shuffle_epi8(tmp3, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5093 | tmp4 = _mm_shuffle_epi8(tmp4, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5094 | tmp5 = _mm_shuffle_epi8(tmp5, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5095 | tmp6 = _mm_shuffle_epi8(tmp6, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5096 | tmp7 = _mm_shuffle_epi8(tmp7, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5097 | tmp8 = _mm_shuffle_epi8(tmp8, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5098 | tmp1 = _mm_xor_si128(X, tmp1); |
wolfSSL | 13:f67a6c6013ca | 5099 | X = gfmul8(tmp1, tmp2, tmp3, tmp4, tmp5, tmp6, tmp7, tmp8, |
wolfSSL | 13:f67a6c6013ca | 5100 | HT[0], HT[1], HT[2], HT[3], HT[4], HT[5], HT[6], HT[7]); |
wolfSSL | 13:f67a6c6013ca | 5101 | } |
wolfSSL | 13:f67a6c6013ca | 5102 | for (k = i*8; k < (int)(nbytes/16); k++) { |
wolfSSL | 13:f67a6c6013ca | 5103 | __asm__ __volatile__ ( |
wolfSSL | 13:f67a6c6013ca | 5104 | "vpshufb %[BSWAP_EPI64], %[ctr1], %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5105 | "vpaddd %[ONE], %[ctr1], %[ctr1]\n\t" |
wolfSSL | 13:f67a6c6013ca | 5106 | "vpxor (%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5107 | "vaesenc 16(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5108 | "vaesenc 32(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5109 | "vaesenc 48(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5110 | "vaesenc 64(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5111 | "vaesenc 80(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5112 | "vaesenc 96(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5113 | "vaesenc 112(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5114 | "vaesenc 128(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5115 | "vaesenc 144(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5116 | "cmpl $11, %[nr]\n\t" |
wolfSSL | 13:f67a6c6013ca | 5117 | "vmovaps 160(%[KEY]), %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 5118 | "jl %=f\n\t" |
wolfSSL | 13:f67a6c6013ca | 5119 | "vaesenc %%xmm5, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5120 | "vaesenc 176(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5121 | "cmpl $13, %[nr]\n\t" |
wolfSSL | 13:f67a6c6013ca | 5122 | "vmovaps 192(%[KEY]), %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 5123 | "jl %=f\n\t" |
wolfSSL | 13:f67a6c6013ca | 5124 | "vaesenc %%xmm5, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5125 | "vaesenc 208(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5126 | "vmovaps 224(%[KEY]), %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 5127 | "%=:\n\t" |
wolfSSL | 13:f67a6c6013ca | 5128 | "vaesenclast %%xmm5, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5129 | "vpxor (%[in]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5130 | "vmovdqu %%xmm4, (%[out])\n\t" |
wolfSSL | 13:f67a6c6013ca | 5131 | "vpshufb %[BSWAP_MASK], %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5132 | |
wolfSSL | 13:f67a6c6013ca | 5133 | "vpxor %%xmm4, %[X], %[X]\n\t" |
wolfSSL | 13:f67a6c6013ca | 5134 | "# Carryless Multiply X by H (128 x 128)\n\t" |
wolfSSL | 13:f67a6c6013ca | 5135 | "vpclmulqdq $16, %[H], %[X], %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 5136 | "vpclmulqdq $1, %[H], %[X], %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 5137 | "vpclmulqdq $0, %[H], %[X], %%xmm15\n\t" |
wolfSSL | 13:f67a6c6013ca | 5138 | "vpclmulqdq $17, %[H], %[X], %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 5139 | "vpxor %%xmm14, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 5140 | "vpslldq $8, %%xmm13, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 5141 | "vpsrldq $8, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 5142 | "vpxor %%xmm15, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 5143 | "vpxor %%xmm13, %%xmm1, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 5144 | "# Reduce\n\t" |
wolfSSL | 13:f67a6c6013ca | 5145 | "vmovdqa %[MOD2_128], %%xmm0\n\t" |
wolfSSL | 13:f67a6c6013ca | 5146 | "vpclmulqdq $16, %%xmm0, %%xmm2, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 5147 | "vpshufd $78, %%xmm2, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 5148 | "vpxor %%xmm14, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 5149 | "vpclmulqdq $16, %%xmm0, %%xmm13, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 5150 | "vpshufd $78, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 5151 | "vpxor %%xmm14, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 5152 | "vpxor %%xmm3, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 5153 | "vmovdqa %%xmm13, %[X]\n\t" |
wolfSSL | 13:f67a6c6013ca | 5154 | "# End Reduce\n\t" |
wolfSSL | 13:f67a6c6013ca | 5155 | |
wolfSSL | 13:f67a6c6013ca | 5156 | : [H] "+xr" (H), [X] "+xr" (X), |
wolfSSL | 13:f67a6c6013ca | 5157 | [ctr1] "+xr" (ctr1) |
wolfSSL | 13:f67a6c6013ca | 5158 | : [KEY] "r" (KEY), |
wolfSSL | 13:f67a6c6013ca | 5159 | [in] "r" (&in[k*16]), [out] "r" (&out[k*16]), [nr] "r" (nr), |
wolfSSL | 13:f67a6c6013ca | 5160 | [BSWAP_MASK] "xrm" (BSWAP_MASK), |
wolfSSL | 13:f67a6c6013ca | 5161 | [BSWAP_EPI64] "xrm" (BSWAP_EPI64), |
wolfSSL | 13:f67a6c6013ca | 5162 | [ONE] "xrm" (ONE), |
wolfSSL | 13:f67a6c6013ca | 5163 | [MOD2_128] "xrm" (MOD2_128) |
wolfSSL | 13:f67a6c6013ca | 5164 | : "xmm15", "xmm14", "xmm13", |
wolfSSL | 13:f67a6c6013ca | 5165 | "xmm5", "xmm4", |
wolfSSL | 13:f67a6c6013ca | 5166 | "xmm0", "xmm1", "xmm2", "xmm3", "memory" |
wolfSSL | 13:f67a6c6013ca | 5167 | ); |
wolfSSL | 13:f67a6c6013ca | 5168 | } |
wolfSSL | 13:f67a6c6013ca | 5169 | #else |
wolfSSL | 13:f67a6c6013ca | 5170 | for (k = 0; k < (int)(nbytes/16) && k < 1; k++) { |
wolfSSL | 13:f67a6c6013ca | 5171 | __asm__ __volatile__ ( |
wolfSSL | 13:f67a6c6013ca | 5172 | "vpshufb %[BSWAP_EPI64], %[ctr1], %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5173 | "vpaddd %[ONE], %[ctr1], %[ctr1]\n\t" |
wolfSSL | 13:f67a6c6013ca | 5174 | "vpxor (%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5175 | "vaesenc 16(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5176 | "vaesenc 32(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5177 | "vaesenc 48(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5178 | "vaesenc 64(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5179 | "vaesenc 80(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5180 | "vaesenc 96(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5181 | "vaesenc 112(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5182 | "vaesenc 128(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5183 | "vaesenc 144(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5184 | "cmpl $11, %[nr]\n\t" |
wolfSSL | 13:f67a6c6013ca | 5185 | "vmovaps 160(%[KEY]), %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 5186 | "jl %=f\n\t" |
wolfSSL | 13:f67a6c6013ca | 5187 | "vaesenc %%xmm5, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5188 | "vaesenc 176(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5189 | "cmpl $13, %[nr]\n\t" |
wolfSSL | 13:f67a6c6013ca | 5190 | "vmovaps 192(%[KEY]), %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 5191 | "jl %=f\n\t" |
wolfSSL | 13:f67a6c6013ca | 5192 | "vaesenc %%xmm5, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5193 | "vaesenc 208(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5194 | "vmovaps 224(%[KEY]), %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 5195 | "%=:\n\t" |
wolfSSL | 13:f67a6c6013ca | 5196 | "vaesenclast %%xmm5, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5197 | "vpxor (%[in]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5198 | "vmovdqu %%xmm4, (%[out])\n\t" |
wolfSSL | 13:f67a6c6013ca | 5199 | "vpshufb %[BSWAP_MASK], %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5200 | "vpxor %%xmm4, %[X], %[X]\n\t" |
wolfSSL | 13:f67a6c6013ca | 5201 | |
wolfSSL | 13:f67a6c6013ca | 5202 | : [H] "+xr" (H), [X] "+xr" (X), |
wolfSSL | 13:f67a6c6013ca | 5203 | [ctr1] "+xr" (ctr1) |
wolfSSL | 13:f67a6c6013ca | 5204 | : [KEY] "r" (KEY), |
wolfSSL | 13:f67a6c6013ca | 5205 | [in] "r" (&in[k*16]), [out] "r" (&out[k*16]), [nr] "r" (nr), |
wolfSSL | 13:f67a6c6013ca | 5206 | [BSWAP_MASK] "xrm" (BSWAP_MASK), |
wolfSSL | 13:f67a6c6013ca | 5207 | [BSWAP_EPI64] "xrm" (BSWAP_EPI64), |
wolfSSL | 13:f67a6c6013ca | 5208 | [ONE] "xrm" (ONE), |
wolfSSL | 13:f67a6c6013ca | 5209 | [MOD2_128] "xrm" (MOD2_128) |
wolfSSL | 13:f67a6c6013ca | 5210 | : "xmm4", "xmm5", "memory" |
wolfSSL | 13:f67a6c6013ca | 5211 | ); |
wolfSSL | 13:f67a6c6013ca | 5212 | } |
wolfSSL | 13:f67a6c6013ca | 5213 | for (; k < (int)(nbytes/16); k++) { |
wolfSSL | 13:f67a6c6013ca | 5214 | __asm__ __volatile__ ( |
wolfSSL | 13:f67a6c6013ca | 5215 | "vpshufb %[BSWAP_EPI64], %[ctr1], %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5216 | "vpaddd %[ONE], %[ctr1], %[ctr1]\n\t" |
wolfSSL | 13:f67a6c6013ca | 5217 | "vpxor (%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5218 | "vaesenc 16(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5219 | "vpclmulqdq $16, %[H], %[X], %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 5220 | "vaesenc 32(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5221 | "vpclmulqdq $1, %[H], %[X], %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 5222 | "vaesenc 48(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5223 | "vpclmulqdq $0, %[H], %[X], %%xmm15\n\t" |
wolfSSL | 13:f67a6c6013ca | 5224 | "vaesenc 64(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5225 | "vpclmulqdq $17, %[H], %[X], %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 5226 | "vaesenc 80(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5227 | "vpxor %%xmm14, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 5228 | "vpslldq $8, %%xmm13, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 5229 | "vpsrldq $8, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 5230 | "vaesenc 96(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5231 | "vpxor %%xmm15, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 5232 | "vpxor %%xmm13, %%xmm1, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 5233 | "vmovdqa %[MOD2_128], %%xmm0\n\t" |
wolfSSL | 13:f67a6c6013ca | 5234 | "vpclmulqdq $16, %%xmm0, %%xmm2, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 5235 | "vaesenc 112(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5236 | "vpshufd $78, %%xmm2, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 5237 | "vpxor %%xmm14, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 5238 | "vpclmulqdq $16, %%xmm0, %%xmm13, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 5239 | "vaesenc 128(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5240 | "vpshufd $78, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 5241 | "vpxor %%xmm14, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 5242 | "vpxor %%xmm3, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 5243 | "vaesenc 144(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5244 | "vmovdqa %%xmm13, %[X]\n\t" |
wolfSSL | 13:f67a6c6013ca | 5245 | "cmpl $11, %[nr]\n\t" |
wolfSSL | 13:f67a6c6013ca | 5246 | "vmovaps 160(%[KEY]), %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 5247 | "jl %=f\n\t" |
wolfSSL | 13:f67a6c6013ca | 5248 | "vaesenc %%xmm5, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5249 | "vaesenc 176(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5250 | "cmpl $13, %[nr]\n\t" |
wolfSSL | 13:f67a6c6013ca | 5251 | "vmovaps 192(%[KEY]), %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 5252 | "jl %=f\n\t" |
wolfSSL | 13:f67a6c6013ca | 5253 | "vaesenc %%xmm5, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5254 | "vaesenc 208(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5255 | "vmovaps 224(%[KEY]), %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 5256 | "%=:\n\t" |
wolfSSL | 13:f67a6c6013ca | 5257 | "vaesenclast %%xmm5, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5258 | "vpxor (%[in]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5259 | "vmovdqu %%xmm4, (%[out])\n\t" |
wolfSSL | 13:f67a6c6013ca | 5260 | "vpshufb %[BSWAP_MASK], %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5261 | "vpxor %%xmm4, %[X], %[X]\n\t" |
wolfSSL | 13:f67a6c6013ca | 5262 | |
wolfSSL | 13:f67a6c6013ca | 5263 | : [H] "+xr" (H), [X] "+xr" (X), |
wolfSSL | 13:f67a6c6013ca | 5264 | [ctr1] "+xr" (ctr1) |
wolfSSL | 13:f67a6c6013ca | 5265 | : [KEY] "r" (KEY), |
wolfSSL | 13:f67a6c6013ca | 5266 | [in] "r" (&in[k*16]), [out] "r" (&out[k*16]), [nr] "r" (nr), |
wolfSSL | 13:f67a6c6013ca | 5267 | [BSWAP_MASK] "xrm" (BSWAP_MASK), |
wolfSSL | 13:f67a6c6013ca | 5268 | [BSWAP_EPI64] "xrm" (BSWAP_EPI64), |
wolfSSL | 13:f67a6c6013ca | 5269 | [ONE] "xrm" (ONE), |
wolfSSL | 13:f67a6c6013ca | 5270 | [MOD2_128] "xrm" (MOD2_128) |
wolfSSL | 13:f67a6c6013ca | 5271 | : "xmm15", "xmm14", "xmm13", "xmm4", "xmm5", |
wolfSSL | 13:f67a6c6013ca | 5272 | "xmm0", "xmm1", "xmm2", "xmm3", "memory" |
wolfSSL | 13:f67a6c6013ca | 5273 | ); |
wolfSSL | 13:f67a6c6013ca | 5274 | } |
wolfSSL | 13:f67a6c6013ca | 5275 | if (k > 0) { |
wolfSSL | 13:f67a6c6013ca | 5276 | X = gfmul_shifted(X, H); |
wolfSSL | 13:f67a6c6013ca | 5277 | } |
wolfSSL | 13:f67a6c6013ca | 5278 | #endif |
wolfSSL | 13:f67a6c6013ca | 5279 | /* If one partial block remains */ |
wolfSSL | 13:f67a6c6013ca | 5280 | if (nbytes % 16) { |
wolfSSL | 13:f67a6c6013ca | 5281 | tmp1 = _mm_shuffle_epi8(ctr1, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 5282 | tmp1 = _mm_xor_si128(tmp1, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 5283 | tmp1 = _mm_aesenc_si128(tmp1, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 5284 | tmp1 = _mm_aesenc_si128(tmp1, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 5285 | tmp1 = _mm_aesenc_si128(tmp1, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 5286 | tmp1 = _mm_aesenc_si128(tmp1, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 5287 | tmp1 = _mm_aesenc_si128(tmp1, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 5288 | tmp1 = _mm_aesenc_si128(tmp1, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 5289 | tmp1 = _mm_aesenc_si128(tmp1, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 5290 | tmp1 = _mm_aesenc_si128(tmp1, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 5291 | tmp1 = _mm_aesenc_si128(tmp1, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 5292 | lastKey = KEY[10]; |
wolfSSL | 13:f67a6c6013ca | 5293 | if (nr > 10) { |
wolfSSL | 13:f67a6c6013ca | 5294 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5295 | tmp1 = _mm_aesenc_si128(tmp1, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 5296 | lastKey = KEY[12]; |
wolfSSL | 13:f67a6c6013ca | 5297 | if (nr > 12) { |
wolfSSL | 13:f67a6c6013ca | 5298 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5299 | tmp1 = _mm_aesenc_si128(tmp1, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 5300 | lastKey = KEY[14]; |
wolfSSL | 13:f67a6c6013ca | 5301 | } |
wolfSSL | 13:f67a6c6013ca | 5302 | } |
wolfSSL | 13:f67a6c6013ca | 5303 | tmp1 = _mm_aesenclast_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5304 | last_block = tmp1; |
wolfSSL | 13:f67a6c6013ca | 5305 | for (j=0; j < (int)(nbytes%16); j++) |
wolfSSL | 13:f67a6c6013ca | 5306 | ((unsigned char*)&last_block)[j] = in[k*16+j]; |
wolfSSL | 13:f67a6c6013ca | 5307 | tmp1 = _mm_xor_si128(tmp1, last_block); |
wolfSSL | 13:f67a6c6013ca | 5308 | last_block = tmp1; |
wolfSSL | 13:f67a6c6013ca | 5309 | for (j=0; j < (int)(nbytes%16); j++) |
wolfSSL | 13:f67a6c6013ca | 5310 | out[k*16+j] = ((unsigned char*)&last_block)[j]; |
wolfSSL | 13:f67a6c6013ca | 5311 | tmp1 = last_block; |
wolfSSL | 13:f67a6c6013ca | 5312 | tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5313 | X =_mm_xor_si128(X, tmp1); |
wolfSSL | 13:f67a6c6013ca | 5314 | X = gfmul_shifted(X, H); |
wolfSSL | 13:f67a6c6013ca | 5315 | } |
wolfSSL | 13:f67a6c6013ca | 5316 | tmp1 = _mm_insert_epi64(tmp1, nbytes*8, 0); |
wolfSSL | 13:f67a6c6013ca | 5317 | tmp1 = _mm_insert_epi64(tmp1, abytes*8, 1); |
wolfSSL | 13:f67a6c6013ca | 5318 | X = _mm_xor_si128(X, tmp1); |
wolfSSL | 13:f67a6c6013ca | 5319 | X = gfmul_shifted(X, H); |
wolfSSL | 13:f67a6c6013ca | 5320 | X = _mm_shuffle_epi8(X, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5321 | T = _mm_xor_si128(X, T); |
wolfSSL | 13:f67a6c6013ca | 5322 | _mm_storeu_si128((__m128i*)tag, T); |
wolfSSL | 13:f67a6c6013ca | 5323 | } |
wolfSSL | 13:f67a6c6013ca | 5324 | #endif /* HAVE_INTEL_AVX2 */ |
wolfSSL | 13:f67a6c6013ca | 5325 | |
wolfSSL | 13:f67a6c6013ca | 5326 | |
wolfSSL | 13:f67a6c6013ca | 5327 | #ifdef HAVE_AES_DECRYPT |
wolfSSL | 13:f67a6c6013ca | 5328 | /* Figure 10. AES-GCM – Decrypt With Single Block Ghash at a Time */ |
wolfSSL | 13:f67a6c6013ca | 5329 | |
wolfSSL | 13:f67a6c6013ca | 5330 | static int AES_GCM_decrypt(const unsigned char *in, unsigned char *out, |
wolfSSL | 13:f67a6c6013ca | 5331 | const unsigned char* addt, const unsigned char* ivec, |
wolfSSL | 13:f67a6c6013ca | 5332 | const unsigned char *tag, int nbytes, int abytes, |
wolfSSL | 13:f67a6c6013ca | 5333 | int ibytes, const unsigned char* key, int nr) |
wolfSSL | 13:f67a6c6013ca | 5334 | { |
wolfSSL | 13:f67a6c6013ca | 5335 | int i, j ,k; |
wolfSSL | 13:f67a6c6013ca | 5336 | __m128i H, Y, T; |
wolfSSL | 13:f67a6c6013ca | 5337 | __m128i *KEY = (__m128i*)key, lastKey; |
wolfSSL | 13:f67a6c6013ca | 5338 | __m128i ctr1; |
wolfSSL | 13:f67a6c6013ca | 5339 | __m128i last_block = _mm_setzero_si128(); |
wolfSSL | 13:f67a6c6013ca | 5340 | __m128i X = _mm_setzero_si128(); |
wolfSSL | 13:f67a6c6013ca | 5341 | __m128i tmp1, tmp2, XV; |
wolfSSL | 13:f67a6c6013ca | 5342 | #ifndef AES_GCM_AESNI_NO_UNROLL |
wolfSSL | 13:f67a6c6013ca | 5343 | __m128i HT[8]; |
wolfSSL | 13:f67a6c6013ca | 5344 | __m128i r0, r1; |
wolfSSL | 13:f67a6c6013ca | 5345 | __m128i tmp3, tmp4, tmp5, tmp6, tmp7, tmp8; |
wolfSSL | 13:f67a6c6013ca | 5346 | #endif |
wolfSSL | 13:f67a6c6013ca | 5347 | |
wolfSSL | 13:f67a6c6013ca | 5348 | if (ibytes == 12) { |
wolfSSL | 13:f67a6c6013ca | 5349 | Y = _mm_setzero_si128(); |
wolfSSL | 13:f67a6c6013ca | 5350 | for (j=0; j < 12; j++) |
wolfSSL | 13:f67a6c6013ca | 5351 | ((unsigned char*)&Y)[j] = ivec[j]; |
wolfSSL | 13:f67a6c6013ca | 5352 | Y = _mm_insert_epi32(Y, 0x1000000, 3); |
wolfSSL | 13:f67a6c6013ca | 5353 | /* (Compute E[ZERO, KS] and E[Y0, KS] together */ |
wolfSSL | 13:f67a6c6013ca | 5354 | tmp1 = _mm_xor_si128(X, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 5355 | tmp2 = _mm_xor_si128(Y, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 5356 | tmp1 = _mm_aesenc_si128(tmp1, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 5357 | tmp2 = _mm_aesenc_si128(tmp2, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 5358 | tmp1 = _mm_aesenc_si128(tmp1, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 5359 | tmp2 = _mm_aesenc_si128(tmp2, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 5360 | tmp1 = _mm_aesenc_si128(tmp1, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 5361 | tmp2 = _mm_aesenc_si128(tmp2, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 5362 | tmp1 = _mm_aesenc_si128(tmp1, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 5363 | tmp2 = _mm_aesenc_si128(tmp2, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 5364 | tmp1 = _mm_aesenc_si128(tmp1, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 5365 | tmp2 = _mm_aesenc_si128(tmp2, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 5366 | tmp1 = _mm_aesenc_si128(tmp1, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 5367 | tmp2 = _mm_aesenc_si128(tmp2, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 5368 | tmp1 = _mm_aesenc_si128(tmp1, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 5369 | tmp2 = _mm_aesenc_si128(tmp2, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 5370 | tmp1 = _mm_aesenc_si128(tmp1, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 5371 | tmp2 = _mm_aesenc_si128(tmp2, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 5372 | tmp1 = _mm_aesenc_si128(tmp1, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 5373 | tmp2 = _mm_aesenc_si128(tmp2, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 5374 | lastKey = KEY[10]; |
wolfSSL | 13:f67a6c6013ca | 5375 | if (nr > 10) { |
wolfSSL | 13:f67a6c6013ca | 5376 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5377 | tmp2 = _mm_aesenc_si128(tmp2, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5378 | tmp1 = _mm_aesenc_si128(tmp1, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 5379 | tmp2 = _mm_aesenc_si128(tmp2, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 5380 | lastKey = KEY[12]; |
wolfSSL | 13:f67a6c6013ca | 5381 | if (nr > 12) { |
wolfSSL | 13:f67a6c6013ca | 5382 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5383 | tmp2 = _mm_aesenc_si128(tmp2, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5384 | tmp1 = _mm_aesenc_si128(tmp1, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 5385 | tmp2 = _mm_aesenc_si128(tmp2, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 5386 | lastKey = KEY[14]; |
wolfSSL | 13:f67a6c6013ca | 5387 | } |
wolfSSL | 13:f67a6c6013ca | 5388 | } |
wolfSSL | 13:f67a6c6013ca | 5389 | H = _mm_aesenclast_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5390 | T = _mm_aesenclast_si128(tmp2, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5391 | H = _mm_shuffle_epi8(H, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5392 | } |
wolfSSL | 13:f67a6c6013ca | 5393 | else { |
wolfSSL | 13:f67a6c6013ca | 5394 | if (ibytes % 16) { |
wolfSSL | 13:f67a6c6013ca | 5395 | i = ibytes / 16; |
wolfSSL | 13:f67a6c6013ca | 5396 | for (j=0; j < ibytes%16; j++) |
wolfSSL | 13:f67a6c6013ca | 5397 | ((unsigned char*)&last_block)[j] = ivec[i*16+j]; |
wolfSSL | 13:f67a6c6013ca | 5398 | } |
wolfSSL | 13:f67a6c6013ca | 5399 | tmp1 = _mm_xor_si128(X, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 5400 | tmp1 = _mm_aesenc_si128(tmp1, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 5401 | tmp1 = _mm_aesenc_si128(tmp1, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 5402 | tmp1 = _mm_aesenc_si128(tmp1, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 5403 | tmp1 = _mm_aesenc_si128(tmp1, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 5404 | tmp1 = _mm_aesenc_si128(tmp1, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 5405 | tmp1 = _mm_aesenc_si128(tmp1, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 5406 | tmp1 = _mm_aesenc_si128(tmp1, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 5407 | tmp1 = _mm_aesenc_si128(tmp1, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 5408 | tmp1 = _mm_aesenc_si128(tmp1, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 5409 | lastKey = KEY[10]; |
wolfSSL | 13:f67a6c6013ca | 5410 | if (nr > 10) { |
wolfSSL | 13:f67a6c6013ca | 5411 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5412 | tmp1 = _mm_aesenc_si128(tmp1, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 5413 | lastKey = KEY[12]; |
wolfSSL | 13:f67a6c6013ca | 5414 | if (nr > 12) { |
wolfSSL | 13:f67a6c6013ca | 5415 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5416 | tmp1 = _mm_aesenc_si128(tmp1, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 5417 | lastKey = KEY[14]; |
wolfSSL | 13:f67a6c6013ca | 5418 | } |
wolfSSL | 13:f67a6c6013ca | 5419 | } |
wolfSSL | 13:f67a6c6013ca | 5420 | H = _mm_aesenclast_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5421 | H = _mm_shuffle_epi8(H, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5422 | |
wolfSSL | 13:f67a6c6013ca | 5423 | Y = _mm_setzero_si128(); |
wolfSSL | 13:f67a6c6013ca | 5424 | for (i=0; i < ibytes/16; i++) { |
wolfSSL | 13:f67a6c6013ca | 5425 | tmp1 = _mm_loadu_si128(&((__m128i*)ivec)[i]); |
wolfSSL | 13:f67a6c6013ca | 5426 | tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5427 | Y = _mm_xor_si128(Y, tmp1); |
wolfSSL | 13:f67a6c6013ca | 5428 | Y = gfmul_sw(Y, H); |
wolfSSL | 13:f67a6c6013ca | 5429 | } |
wolfSSL | 13:f67a6c6013ca | 5430 | if (ibytes % 16) { |
wolfSSL | 13:f67a6c6013ca | 5431 | tmp1 = last_block; |
wolfSSL | 13:f67a6c6013ca | 5432 | tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5433 | Y = _mm_xor_si128(Y, tmp1); |
wolfSSL | 13:f67a6c6013ca | 5434 | Y = gfmul_sw(Y, H); |
wolfSSL | 13:f67a6c6013ca | 5435 | } |
wolfSSL | 13:f67a6c6013ca | 5436 | tmp1 = _mm_insert_epi64(tmp1, ibytes*8, 0); |
wolfSSL | 13:f67a6c6013ca | 5437 | tmp1 = _mm_insert_epi64(tmp1, 0, 1); |
wolfSSL | 13:f67a6c6013ca | 5438 | Y = _mm_xor_si128(Y, tmp1); |
wolfSSL | 13:f67a6c6013ca | 5439 | Y = gfmul_sw(Y, H); |
wolfSSL | 13:f67a6c6013ca | 5440 | Y = _mm_shuffle_epi8(Y, BSWAP_MASK); /* Compute E(K, Y0) */ |
wolfSSL | 13:f67a6c6013ca | 5441 | tmp1 = _mm_xor_si128(Y, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 5442 | tmp1 = _mm_aesenc_si128(tmp1, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 5443 | tmp1 = _mm_aesenc_si128(tmp1, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 5444 | tmp1 = _mm_aesenc_si128(tmp1, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 5445 | tmp1 = _mm_aesenc_si128(tmp1, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 5446 | tmp1 = _mm_aesenc_si128(tmp1, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 5447 | tmp1 = _mm_aesenc_si128(tmp1, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 5448 | tmp1 = _mm_aesenc_si128(tmp1, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 5449 | tmp1 = _mm_aesenc_si128(tmp1, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 5450 | tmp1 = _mm_aesenc_si128(tmp1, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 5451 | lastKey = KEY[10]; |
wolfSSL | 13:f67a6c6013ca | 5452 | if (nr > 10) { |
wolfSSL | 13:f67a6c6013ca | 5453 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5454 | tmp1 = _mm_aesenc_si128(tmp1, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 5455 | lastKey = KEY[12]; |
wolfSSL | 13:f67a6c6013ca | 5456 | if (nr > 12) { |
wolfSSL | 13:f67a6c6013ca | 5457 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5458 | tmp1 = _mm_aesenc_si128(tmp1, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 5459 | lastKey = KEY[14]; |
wolfSSL | 13:f67a6c6013ca | 5460 | } |
wolfSSL | 13:f67a6c6013ca | 5461 | } |
wolfSSL | 13:f67a6c6013ca | 5462 | T = _mm_aesenclast_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5463 | } |
wolfSSL | 13:f67a6c6013ca | 5464 | |
wolfSSL | 13:f67a6c6013ca | 5465 | for (i=0; i<abytes/16; i++) { |
wolfSSL | 13:f67a6c6013ca | 5466 | tmp1 = _mm_loadu_si128(&((__m128i*)addt)[i]); |
wolfSSL | 13:f67a6c6013ca | 5467 | tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5468 | X = _mm_xor_si128(X, tmp1); |
wolfSSL | 13:f67a6c6013ca | 5469 | X = gfmul_sw(X, H); |
wolfSSL | 13:f67a6c6013ca | 5470 | } |
wolfSSL | 13:f67a6c6013ca | 5471 | if (abytes%16) { |
wolfSSL | 13:f67a6c6013ca | 5472 | last_block = _mm_setzero_si128(); |
wolfSSL | 13:f67a6c6013ca | 5473 | for (j=0; j<abytes%16; j++) |
wolfSSL | 13:f67a6c6013ca | 5474 | ((unsigned char*)&last_block)[j] = addt[i*16+j]; |
wolfSSL | 13:f67a6c6013ca | 5475 | tmp1 = last_block; |
wolfSSL | 13:f67a6c6013ca | 5476 | tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5477 | X = _mm_xor_si128(X, tmp1); |
wolfSSL | 13:f67a6c6013ca | 5478 | X = gfmul_sw(X, H); |
wolfSSL | 13:f67a6c6013ca | 5479 | } |
wolfSSL | 13:f67a6c6013ca | 5480 | |
wolfSSL | 13:f67a6c6013ca | 5481 | tmp1 = _mm_shuffle_epi8(Y, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 5482 | ctr1 = _mm_add_epi32(tmp1, ONE); |
wolfSSL | 13:f67a6c6013ca | 5483 | H = gfmul_shl1(H); |
wolfSSL | 13:f67a6c6013ca | 5484 | i = 0; |
wolfSSL | 13:f67a6c6013ca | 5485 | |
wolfSSL | 13:f67a6c6013ca | 5486 | #ifndef AES_GCM_AESNI_NO_UNROLL |
wolfSSL | 13:f67a6c6013ca | 5487 | |
wolfSSL | 13:f67a6c6013ca | 5488 | if (0 < nbytes/16/8) { |
wolfSSL | 13:f67a6c6013ca | 5489 | HT[0] = H; |
wolfSSL | 13:f67a6c6013ca | 5490 | HT[1] = gfmul_shifted(H, H); |
wolfSSL | 13:f67a6c6013ca | 5491 | HT[2] = gfmul_shifted(H, HT[1]); |
wolfSSL | 13:f67a6c6013ca | 5492 | HT[3] = gfmul_shifted(HT[1], HT[1]); |
wolfSSL | 13:f67a6c6013ca | 5493 | HT[4] = gfmul_shifted(HT[1], HT[2]); |
wolfSSL | 13:f67a6c6013ca | 5494 | HT[5] = gfmul_shifted(HT[2], HT[2]); |
wolfSSL | 13:f67a6c6013ca | 5495 | HT[6] = gfmul_shifted(HT[2], HT[3]); |
wolfSSL | 13:f67a6c6013ca | 5496 | HT[7] = gfmul_shifted(HT[3], HT[3]); |
wolfSSL | 13:f67a6c6013ca | 5497 | |
wolfSSL | 13:f67a6c6013ca | 5498 | for (; i < nbytes/16/8; i++) { |
wolfSSL | 13:f67a6c6013ca | 5499 | r0 = _mm_setzero_si128(); |
wolfSSL | 13:f67a6c6013ca | 5500 | r1 = _mm_setzero_si128(); |
wolfSSL | 13:f67a6c6013ca | 5501 | |
wolfSSL | 13:f67a6c6013ca | 5502 | tmp1 = _mm_shuffle_epi8(ctr1, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 5503 | tmp2 = _mm_add_epi32(ctr1, ONE); |
wolfSSL | 13:f67a6c6013ca | 5504 | tmp2 = _mm_shuffle_epi8(tmp2, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 5505 | tmp3 = _mm_add_epi32(ctr1, TWO); |
wolfSSL | 13:f67a6c6013ca | 5506 | tmp3 = _mm_shuffle_epi8(tmp3, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 5507 | tmp4 = _mm_add_epi32(ctr1, THREE); |
wolfSSL | 13:f67a6c6013ca | 5508 | tmp4 = _mm_shuffle_epi8(tmp4, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 5509 | tmp5 = _mm_add_epi32(ctr1, FOUR); |
wolfSSL | 13:f67a6c6013ca | 5510 | tmp5 = _mm_shuffle_epi8(tmp5, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 5511 | tmp6 = _mm_add_epi32(ctr1, FIVE); |
wolfSSL | 13:f67a6c6013ca | 5512 | tmp6 = _mm_shuffle_epi8(tmp6, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 5513 | tmp7 = _mm_add_epi32(ctr1, SIX); |
wolfSSL | 13:f67a6c6013ca | 5514 | tmp7 = _mm_shuffle_epi8(tmp7, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 5515 | tmp8 = _mm_add_epi32(ctr1, SEVEN); |
wolfSSL | 13:f67a6c6013ca | 5516 | tmp8 = _mm_shuffle_epi8(tmp8, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 5517 | ctr1 = _mm_add_epi32(ctr1, EIGHT); |
wolfSSL | 13:f67a6c6013ca | 5518 | tmp1 =_mm_xor_si128(tmp1, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 5519 | tmp2 =_mm_xor_si128(tmp2, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 5520 | tmp3 =_mm_xor_si128(tmp3, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 5521 | tmp4 =_mm_xor_si128(tmp4, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 5522 | tmp5 =_mm_xor_si128(tmp5, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 5523 | tmp6 =_mm_xor_si128(tmp6, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 5524 | tmp7 =_mm_xor_si128(tmp7, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 5525 | tmp8 =_mm_xor_si128(tmp8, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 5526 | /* 128 x 128 Carryless Multiply */ |
wolfSSL | 13:f67a6c6013ca | 5527 | XV = _mm_loadu_si128(&((__m128i*)in)[i*8+0]); |
wolfSSL | 13:f67a6c6013ca | 5528 | XV = _mm_shuffle_epi8(XV, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5529 | XV = _mm_xor_si128(XV, X); |
wolfSSL | 13:f67a6c6013ca | 5530 | gfmul_only(XV, HT[7], &r0, &r1); |
wolfSSL | 13:f67a6c6013ca | 5531 | tmp1 = _mm_aesenc_si128(tmp1, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 5532 | tmp2 = _mm_aesenc_si128(tmp2, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 5533 | tmp3 = _mm_aesenc_si128(tmp3, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 5534 | tmp4 = _mm_aesenc_si128(tmp4, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 5535 | tmp5 = _mm_aesenc_si128(tmp5, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 5536 | tmp6 = _mm_aesenc_si128(tmp6, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 5537 | tmp7 = _mm_aesenc_si128(tmp7, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 5538 | tmp8 = _mm_aesenc_si128(tmp8, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 5539 | /* 128 x 128 Carryless Multiply */ |
wolfSSL | 13:f67a6c6013ca | 5540 | XV = _mm_loadu_si128(&((__m128i*)in)[i*8+1]); |
wolfSSL | 13:f67a6c6013ca | 5541 | XV = _mm_shuffle_epi8(XV, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5542 | gfmul_only(XV, HT[6], &r0, &r1); |
wolfSSL | 13:f67a6c6013ca | 5543 | tmp1 = _mm_aesenc_si128(tmp1, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 5544 | tmp2 = _mm_aesenc_si128(tmp2, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 5545 | tmp3 = _mm_aesenc_si128(tmp3, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 5546 | tmp4 = _mm_aesenc_si128(tmp4, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 5547 | tmp5 = _mm_aesenc_si128(tmp5, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 5548 | tmp6 = _mm_aesenc_si128(tmp6, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 5549 | tmp7 = _mm_aesenc_si128(tmp7, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 5550 | tmp8 = _mm_aesenc_si128(tmp8, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 5551 | /* 128 x 128 Carryless Multiply */ |
wolfSSL | 13:f67a6c6013ca | 5552 | XV = _mm_loadu_si128(&((__m128i*)in)[i*8+2]); |
wolfSSL | 13:f67a6c6013ca | 5553 | XV = _mm_shuffle_epi8(XV, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5554 | gfmul_only(XV, HT[5], &r0, &r1); |
wolfSSL | 13:f67a6c6013ca | 5555 | tmp1 = _mm_aesenc_si128(tmp1, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 5556 | tmp2 = _mm_aesenc_si128(tmp2, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 5557 | tmp3 = _mm_aesenc_si128(tmp3, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 5558 | tmp4 = _mm_aesenc_si128(tmp4, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 5559 | tmp5 = _mm_aesenc_si128(tmp5, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 5560 | tmp6 = _mm_aesenc_si128(tmp6, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 5561 | tmp7 = _mm_aesenc_si128(tmp7, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 5562 | tmp8 = _mm_aesenc_si128(tmp8, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 5563 | /* 128 x 128 Carryless Multiply */ |
wolfSSL | 13:f67a6c6013ca | 5564 | XV = _mm_loadu_si128(&((__m128i*)in)[i*8+3]); |
wolfSSL | 13:f67a6c6013ca | 5565 | XV = _mm_shuffle_epi8(XV, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5566 | gfmul_only(XV, HT[4], &r0, &r1); |
wolfSSL | 13:f67a6c6013ca | 5567 | tmp1 = _mm_aesenc_si128(tmp1, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 5568 | tmp2 = _mm_aesenc_si128(tmp2, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 5569 | tmp3 = _mm_aesenc_si128(tmp3, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 5570 | tmp4 = _mm_aesenc_si128(tmp4, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 5571 | tmp5 = _mm_aesenc_si128(tmp5, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 5572 | tmp6 = _mm_aesenc_si128(tmp6, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 5573 | tmp7 = _mm_aesenc_si128(tmp7, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 5574 | tmp8 = _mm_aesenc_si128(tmp8, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 5575 | /* 128 x 128 Carryless Multiply */ |
wolfSSL | 13:f67a6c6013ca | 5576 | XV = _mm_loadu_si128(&((__m128i*)in)[i*8+4]); |
wolfSSL | 13:f67a6c6013ca | 5577 | XV = _mm_shuffle_epi8(XV, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5578 | gfmul_only(XV, HT[3], &r0, &r1); |
wolfSSL | 13:f67a6c6013ca | 5579 | tmp1 = _mm_aesenc_si128(tmp1, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 5580 | tmp2 = _mm_aesenc_si128(tmp2, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 5581 | tmp3 = _mm_aesenc_si128(tmp3, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 5582 | tmp4 = _mm_aesenc_si128(tmp4, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 5583 | tmp5 = _mm_aesenc_si128(tmp5, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 5584 | tmp6 = _mm_aesenc_si128(tmp6, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 5585 | tmp7 = _mm_aesenc_si128(tmp7, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 5586 | tmp8 = _mm_aesenc_si128(tmp8, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 5587 | /* 128 x 128 Carryless Multiply */ |
wolfSSL | 13:f67a6c6013ca | 5588 | XV = _mm_loadu_si128(&((__m128i*)in)[i*8+5]); |
wolfSSL | 13:f67a6c6013ca | 5589 | XV = _mm_shuffle_epi8(XV, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5590 | gfmul_only(XV, HT[2], &r0, &r1); |
wolfSSL | 13:f67a6c6013ca | 5591 | tmp1 = _mm_aesenc_si128(tmp1, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 5592 | tmp2 = _mm_aesenc_si128(tmp2, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 5593 | tmp3 = _mm_aesenc_si128(tmp3, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 5594 | tmp4 = _mm_aesenc_si128(tmp4, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 5595 | tmp5 = _mm_aesenc_si128(tmp5, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 5596 | tmp6 = _mm_aesenc_si128(tmp6, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 5597 | tmp7 = _mm_aesenc_si128(tmp7, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 5598 | tmp8 = _mm_aesenc_si128(tmp8, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 5599 | /* 128 x 128 Carryless Multiply */ |
wolfSSL | 13:f67a6c6013ca | 5600 | XV = _mm_loadu_si128(&((__m128i*)in)[i*8+6]); |
wolfSSL | 13:f67a6c6013ca | 5601 | XV = _mm_shuffle_epi8(XV, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5602 | gfmul_only(XV, HT[1], &r0, &r1); |
wolfSSL | 13:f67a6c6013ca | 5603 | tmp1 = _mm_aesenc_si128(tmp1, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 5604 | tmp2 = _mm_aesenc_si128(tmp2, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 5605 | tmp3 = _mm_aesenc_si128(tmp3, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 5606 | tmp4 = _mm_aesenc_si128(tmp4, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 5607 | tmp5 = _mm_aesenc_si128(tmp5, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 5608 | tmp6 = _mm_aesenc_si128(tmp6, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 5609 | tmp7 = _mm_aesenc_si128(tmp7, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 5610 | tmp8 = _mm_aesenc_si128(tmp8, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 5611 | /* 128 x 128 Carryless Multiply */ |
wolfSSL | 13:f67a6c6013ca | 5612 | XV = _mm_loadu_si128(&((__m128i*)in)[i*8+7]); |
wolfSSL | 13:f67a6c6013ca | 5613 | XV = _mm_shuffle_epi8(XV, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5614 | gfmul_only(XV, HT[0], &r0, &r1); |
wolfSSL | 13:f67a6c6013ca | 5615 | tmp1 = _mm_aesenc_si128(tmp1, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 5616 | tmp2 = _mm_aesenc_si128(tmp2, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 5617 | tmp3 = _mm_aesenc_si128(tmp3, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 5618 | tmp4 = _mm_aesenc_si128(tmp4, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 5619 | tmp5 = _mm_aesenc_si128(tmp5, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 5620 | tmp6 = _mm_aesenc_si128(tmp6, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 5621 | tmp7 = _mm_aesenc_si128(tmp7, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 5622 | tmp8 = _mm_aesenc_si128(tmp8, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 5623 | /* Reduction */ |
wolfSSL | 13:f67a6c6013ca | 5624 | X = ghash_red(r0, r1); |
wolfSSL | 13:f67a6c6013ca | 5625 | tmp1 = _mm_aesenc_si128(tmp1, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 5626 | tmp2 = _mm_aesenc_si128(tmp2, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 5627 | tmp3 = _mm_aesenc_si128(tmp3, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 5628 | tmp4 = _mm_aesenc_si128(tmp4, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 5629 | tmp5 = _mm_aesenc_si128(tmp5, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 5630 | tmp6 = _mm_aesenc_si128(tmp6, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 5631 | tmp7 = _mm_aesenc_si128(tmp7, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 5632 | tmp8 = _mm_aesenc_si128(tmp8, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 5633 | lastKey = KEY[10]; |
wolfSSL | 13:f67a6c6013ca | 5634 | if (nr > 10) { |
wolfSSL | 13:f67a6c6013ca | 5635 | tmp1 = _mm_aesenc_si128(tmp1, KEY[10]); |
wolfSSL | 13:f67a6c6013ca | 5636 | tmp2 = _mm_aesenc_si128(tmp2, KEY[10]); |
wolfSSL | 13:f67a6c6013ca | 5637 | tmp3 = _mm_aesenc_si128(tmp3, KEY[10]); |
wolfSSL | 13:f67a6c6013ca | 5638 | tmp4 = _mm_aesenc_si128(tmp4, KEY[10]); |
wolfSSL | 13:f67a6c6013ca | 5639 | tmp5 = _mm_aesenc_si128(tmp5, KEY[10]); |
wolfSSL | 13:f67a6c6013ca | 5640 | tmp6 = _mm_aesenc_si128(tmp6, KEY[10]); |
wolfSSL | 13:f67a6c6013ca | 5641 | tmp7 = _mm_aesenc_si128(tmp7, KEY[10]); |
wolfSSL | 13:f67a6c6013ca | 5642 | tmp8 = _mm_aesenc_si128(tmp8, KEY[10]); |
wolfSSL | 13:f67a6c6013ca | 5643 | tmp1 = _mm_aesenc_si128(tmp1, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 5644 | tmp2 = _mm_aesenc_si128(tmp2, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 5645 | tmp3 = _mm_aesenc_si128(tmp3, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 5646 | tmp4 = _mm_aesenc_si128(tmp4, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 5647 | tmp5 = _mm_aesenc_si128(tmp5, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 5648 | tmp6 = _mm_aesenc_si128(tmp6, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 5649 | tmp7 = _mm_aesenc_si128(tmp7, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 5650 | tmp8 = _mm_aesenc_si128(tmp8, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 5651 | lastKey = KEY[12]; |
wolfSSL | 13:f67a6c6013ca | 5652 | if (nr > 12) { |
wolfSSL | 13:f67a6c6013ca | 5653 | tmp1 = _mm_aesenc_si128(tmp1, KEY[12]); |
wolfSSL | 13:f67a6c6013ca | 5654 | tmp2 = _mm_aesenc_si128(tmp2, KEY[12]); |
wolfSSL | 13:f67a6c6013ca | 5655 | tmp3 = _mm_aesenc_si128(tmp3, KEY[12]); |
wolfSSL | 13:f67a6c6013ca | 5656 | tmp4 = _mm_aesenc_si128(tmp4, KEY[12]); |
wolfSSL | 13:f67a6c6013ca | 5657 | tmp5 = _mm_aesenc_si128(tmp5, KEY[12]); |
wolfSSL | 13:f67a6c6013ca | 5658 | tmp6 = _mm_aesenc_si128(tmp6, KEY[12]); |
wolfSSL | 13:f67a6c6013ca | 5659 | tmp7 = _mm_aesenc_si128(tmp7, KEY[12]); |
wolfSSL | 13:f67a6c6013ca | 5660 | tmp8 = _mm_aesenc_si128(tmp8, KEY[12]); |
wolfSSL | 13:f67a6c6013ca | 5661 | tmp1 = _mm_aesenc_si128(tmp1, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 5662 | tmp2 = _mm_aesenc_si128(tmp2, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 5663 | tmp3 = _mm_aesenc_si128(tmp3, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 5664 | tmp4 = _mm_aesenc_si128(tmp4, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 5665 | tmp5 = _mm_aesenc_si128(tmp5, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 5666 | tmp6 = _mm_aesenc_si128(tmp6, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 5667 | tmp7 = _mm_aesenc_si128(tmp7, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 5668 | tmp8 = _mm_aesenc_si128(tmp8, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 5669 | lastKey = KEY[14]; |
wolfSSL | 13:f67a6c6013ca | 5670 | } |
wolfSSL | 13:f67a6c6013ca | 5671 | } |
wolfSSL | 13:f67a6c6013ca | 5672 | tmp1 =_mm_aesenclast_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5673 | tmp2 =_mm_aesenclast_si128(tmp2, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5674 | tmp3 =_mm_aesenclast_si128(tmp3, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5675 | tmp4 =_mm_aesenclast_si128(tmp4, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5676 | tmp5 =_mm_aesenclast_si128(tmp5, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5677 | tmp6 =_mm_aesenclast_si128(tmp6, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5678 | tmp7 =_mm_aesenclast_si128(tmp7, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5679 | tmp8 =_mm_aesenclast_si128(tmp8, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5680 | tmp1 = _mm_xor_si128(tmp1, _mm_loadu_si128(&((__m128i*)in)[i*8+0])); |
wolfSSL | 13:f67a6c6013ca | 5681 | tmp2 = _mm_xor_si128(tmp2, _mm_loadu_si128(&((__m128i*)in)[i*8+1])); |
wolfSSL | 13:f67a6c6013ca | 5682 | tmp3 = _mm_xor_si128(tmp3, _mm_loadu_si128(&((__m128i*)in)[i*8+2])); |
wolfSSL | 13:f67a6c6013ca | 5683 | tmp4 = _mm_xor_si128(tmp4, _mm_loadu_si128(&((__m128i*)in)[i*8+3])); |
wolfSSL | 13:f67a6c6013ca | 5684 | tmp5 = _mm_xor_si128(tmp5, _mm_loadu_si128(&((__m128i*)in)[i*8+4])); |
wolfSSL | 13:f67a6c6013ca | 5685 | tmp6 = _mm_xor_si128(tmp6, _mm_loadu_si128(&((__m128i*)in)[i*8+5])); |
wolfSSL | 13:f67a6c6013ca | 5686 | tmp7 = _mm_xor_si128(tmp7, _mm_loadu_si128(&((__m128i*)in)[i*8+6])); |
wolfSSL | 13:f67a6c6013ca | 5687 | tmp8 = _mm_xor_si128(tmp8, _mm_loadu_si128(&((__m128i*)in)[i*8+7])); |
wolfSSL | 13:f67a6c6013ca | 5688 | _mm_storeu_si128(&((__m128i*)out)[i*8+0], tmp1); |
wolfSSL | 13:f67a6c6013ca | 5689 | _mm_storeu_si128(&((__m128i*)out)[i*8+1], tmp2); |
wolfSSL | 13:f67a6c6013ca | 5690 | _mm_storeu_si128(&((__m128i*)out)[i*8+2], tmp3); |
wolfSSL | 13:f67a6c6013ca | 5691 | _mm_storeu_si128(&((__m128i*)out)[i*8+3], tmp4); |
wolfSSL | 13:f67a6c6013ca | 5692 | _mm_storeu_si128(&((__m128i*)out)[i*8+4], tmp5); |
wolfSSL | 13:f67a6c6013ca | 5693 | _mm_storeu_si128(&((__m128i*)out)[i*8+5], tmp6); |
wolfSSL | 13:f67a6c6013ca | 5694 | _mm_storeu_si128(&((__m128i*)out)[i*8+6], tmp7); |
wolfSSL | 13:f67a6c6013ca | 5695 | _mm_storeu_si128(&((__m128i*)out)[i*8+7], tmp8); |
wolfSSL | 13:f67a6c6013ca | 5696 | } |
wolfSSL | 13:f67a6c6013ca | 5697 | } |
wolfSSL | 13:f67a6c6013ca | 5698 | #endif |
wolfSSL | 13:f67a6c6013ca | 5699 | for (k = i*8; k < nbytes/16; k++) { |
wolfSSL | 13:f67a6c6013ca | 5700 | tmp1 = _mm_shuffle_epi8(ctr1, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 5701 | ctr1 = _mm_add_epi32(ctr1, ONE); |
wolfSSL | 13:f67a6c6013ca | 5702 | tmp1 = _mm_xor_si128(tmp1, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 5703 | tmp1 = _mm_aesenc_si128(tmp1, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 5704 | tmp1 = _mm_aesenc_si128(tmp1, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 5705 | tmp1 = _mm_aesenc_si128(tmp1, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 5706 | tmp1 = _mm_aesenc_si128(tmp1, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 5707 | tmp1 = _mm_aesenc_si128(tmp1, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 5708 | tmp1 = _mm_aesenc_si128(tmp1, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 5709 | tmp1 = _mm_aesenc_si128(tmp1, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 5710 | tmp1 = _mm_aesenc_si128(tmp1, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 5711 | tmp1 = _mm_aesenc_si128(tmp1, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 5712 | /* 128 x 128 Carryless Multiply */ |
wolfSSL | 13:f67a6c6013ca | 5713 | XV = _mm_loadu_si128(&((__m128i*)in)[k]); |
wolfSSL | 13:f67a6c6013ca | 5714 | XV = _mm_shuffle_epi8(XV, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5715 | XV = _mm_xor_si128(XV, X); |
wolfSSL | 13:f67a6c6013ca | 5716 | X = gfmul_shifted(XV, H); |
wolfSSL | 13:f67a6c6013ca | 5717 | lastKey = KEY[10]; |
wolfSSL | 13:f67a6c6013ca | 5718 | if (nr > 10) { |
wolfSSL | 13:f67a6c6013ca | 5719 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5720 | tmp1 = _mm_aesenc_si128(tmp1, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 5721 | lastKey = KEY[12]; |
wolfSSL | 13:f67a6c6013ca | 5722 | if (nr > 12) { |
wolfSSL | 13:f67a6c6013ca | 5723 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5724 | tmp1 = _mm_aesenc_si128(tmp1, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 5725 | lastKey = KEY[14]; |
wolfSSL | 13:f67a6c6013ca | 5726 | } |
wolfSSL | 13:f67a6c6013ca | 5727 | } |
wolfSSL | 13:f67a6c6013ca | 5728 | tmp1 = _mm_aesenclast_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5729 | tmp2 = _mm_loadu_si128(&((__m128i*)in)[k]); |
wolfSSL | 13:f67a6c6013ca | 5730 | tmp1 = _mm_xor_si128(tmp1, tmp2); |
wolfSSL | 13:f67a6c6013ca | 5731 | _mm_storeu_si128(&((__m128i*)out)[k], tmp1); |
wolfSSL | 13:f67a6c6013ca | 5732 | } |
wolfSSL | 13:f67a6c6013ca | 5733 | |
wolfSSL | 13:f67a6c6013ca | 5734 | /* If one partial block remains */ |
wolfSSL | 13:f67a6c6013ca | 5735 | if (nbytes % 16) { |
wolfSSL | 13:f67a6c6013ca | 5736 | tmp1 = _mm_shuffle_epi8(ctr1, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 5737 | tmp1 = _mm_xor_si128(tmp1, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 5738 | tmp1 = _mm_aesenc_si128(tmp1, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 5739 | tmp1 = _mm_aesenc_si128(tmp1, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 5740 | tmp1 = _mm_aesenc_si128(tmp1, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 5741 | tmp1 = _mm_aesenc_si128(tmp1, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 5742 | tmp1 = _mm_aesenc_si128(tmp1, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 5743 | tmp1 = _mm_aesenc_si128(tmp1, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 5744 | tmp1 = _mm_aesenc_si128(tmp1, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 5745 | tmp1 = _mm_aesenc_si128(tmp1, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 5746 | tmp1 = _mm_aesenc_si128(tmp1, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 5747 | lastKey = KEY[10]; |
wolfSSL | 13:f67a6c6013ca | 5748 | if (nr > 10) { |
wolfSSL | 13:f67a6c6013ca | 5749 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5750 | tmp1 = _mm_aesenc_si128(tmp1, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 5751 | lastKey = KEY[12]; |
wolfSSL | 13:f67a6c6013ca | 5752 | if (nr > 12) { |
wolfSSL | 13:f67a6c6013ca | 5753 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5754 | tmp1 = _mm_aesenc_si128(tmp1, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 5755 | lastKey = KEY[14]; |
wolfSSL | 13:f67a6c6013ca | 5756 | } |
wolfSSL | 13:f67a6c6013ca | 5757 | } |
wolfSSL | 13:f67a6c6013ca | 5758 | tmp1 = _mm_aesenclast_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5759 | last_block = _mm_setzero_si128(); |
wolfSSL | 13:f67a6c6013ca | 5760 | for (j=0; j < nbytes%16; j++) |
wolfSSL | 13:f67a6c6013ca | 5761 | ((unsigned char*)&last_block)[j] = in[k*16+j]; |
wolfSSL | 13:f67a6c6013ca | 5762 | XV = last_block; |
wolfSSL | 13:f67a6c6013ca | 5763 | tmp1 = _mm_xor_si128(tmp1, last_block); |
wolfSSL | 13:f67a6c6013ca | 5764 | last_block = tmp1; |
wolfSSL | 13:f67a6c6013ca | 5765 | for (j=0; j < nbytes%16; j++) |
wolfSSL | 13:f67a6c6013ca | 5766 | out[k*16+j] = ((unsigned char*)&last_block)[j]; |
wolfSSL | 13:f67a6c6013ca | 5767 | XV = _mm_shuffle_epi8(XV, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5768 | XV = _mm_xor_si128(XV, X); |
wolfSSL | 13:f67a6c6013ca | 5769 | X = gfmul_shifted(XV, H); |
wolfSSL | 13:f67a6c6013ca | 5770 | } |
wolfSSL | 13:f67a6c6013ca | 5771 | |
wolfSSL | 13:f67a6c6013ca | 5772 | tmp1 = _mm_insert_epi64(tmp1, nbytes*8, 0); |
wolfSSL | 13:f67a6c6013ca | 5773 | tmp1 = _mm_insert_epi64(tmp1, abytes*8, 1); |
wolfSSL | 13:f67a6c6013ca | 5774 | /* 128 x 128 Carryless Multiply */ |
wolfSSL | 13:f67a6c6013ca | 5775 | X = _mm_xor_si128(X, tmp1); |
wolfSSL | 13:f67a6c6013ca | 5776 | X = gfmul_shifted(X, H); |
wolfSSL | 13:f67a6c6013ca | 5777 | X = _mm_shuffle_epi8(X, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5778 | T = _mm_xor_si128(X, T); |
wolfSSL | 13:f67a6c6013ca | 5779 | |
wolfSSL | 13:f67a6c6013ca | 5780 | if (0xffff != |
wolfSSL | 13:f67a6c6013ca | 5781 | _mm_movemask_epi8(_mm_cmpeq_epi8(T, _mm_loadu_si128((__m128i*)tag)))) |
wolfSSL | 13:f67a6c6013ca | 5782 | return 0; /* in case the authentication failed */ |
wolfSSL | 13:f67a6c6013ca | 5783 | |
wolfSSL | 13:f67a6c6013ca | 5784 | return 1; /* when successful returns 1 */ |
wolfSSL | 13:f67a6c6013ca | 5785 | } |
wolfSSL | 13:f67a6c6013ca | 5786 | |
wolfSSL | 13:f67a6c6013ca | 5787 | #ifdef HAVE_INTEL_AVX2 |
wolfSSL | 13:f67a6c6013ca | 5788 | static int AES_GCM_decrypt_avx2(const unsigned char *in, unsigned char *out, |
wolfSSL | 13:f67a6c6013ca | 5789 | const unsigned char* addt, |
wolfSSL | 13:f67a6c6013ca | 5790 | const unsigned char* ivec, |
wolfSSL | 13:f67a6c6013ca | 5791 | const unsigned char *tag, int nbytes, |
wolfSSL | 13:f67a6c6013ca | 5792 | int abytes, int ibytes, |
wolfSSL | 13:f67a6c6013ca | 5793 | const unsigned char* key, int nr) |
wolfSSL | 13:f67a6c6013ca | 5794 | { |
wolfSSL | 13:f67a6c6013ca | 5795 | int i, j ,k; |
wolfSSL | 13:f67a6c6013ca | 5796 | __m128i H, Y, T; |
wolfSSL | 13:f67a6c6013ca | 5797 | __m128i *KEY = (__m128i*)key, lastKey; |
wolfSSL | 13:f67a6c6013ca | 5798 | __m128i ctr1; |
wolfSSL | 13:f67a6c6013ca | 5799 | __m128i last_block = _mm_setzero_si128(); |
wolfSSL | 13:f67a6c6013ca | 5800 | __m128i X = _mm_setzero_si128(); |
wolfSSL | 13:f67a6c6013ca | 5801 | __m128i tmp1, tmp2; |
wolfSSL | 13:f67a6c6013ca | 5802 | #if !defined(AES_GCM_AESNI_NO_UNROLL) && !defined(AES_GCM_AVX2_NO_UNROLL) |
wolfSSL | 13:f67a6c6013ca | 5803 | __m128i HT[8]; |
wolfSSL | 13:f67a6c6013ca | 5804 | __m128i pctr1[1]; |
wolfSSL | 13:f67a6c6013ca | 5805 | register __m128i XV asm("xmm2"); |
wolfSSL | 13:f67a6c6013ca | 5806 | #else |
wolfSSL | 13:f67a6c6013ca | 5807 | __m128i XV; |
wolfSSL | 13:f67a6c6013ca | 5808 | #endif |
wolfSSL | 13:f67a6c6013ca | 5809 | |
wolfSSL | 13:f67a6c6013ca | 5810 | if (ibytes == 12) { |
wolfSSL | 13:f67a6c6013ca | 5811 | Y = _mm_setzero_si128(); |
wolfSSL | 13:f67a6c6013ca | 5812 | for (j=0; j < 12; j++) |
wolfSSL | 13:f67a6c6013ca | 5813 | ((unsigned char*)&Y)[j] = ivec[j]; |
wolfSSL | 13:f67a6c6013ca | 5814 | Y = _mm_insert_epi32(Y, 0x1000000, 3); |
wolfSSL | 13:f67a6c6013ca | 5815 | /* (Compute E[ZERO, KS] and E[Y0, KS] together */ |
wolfSSL | 13:f67a6c6013ca | 5816 | tmp1 = _mm_xor_si128(X, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 5817 | tmp2 = _mm_xor_si128(Y, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 5818 | tmp1 = _mm_aesenc_si128(tmp1, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 5819 | tmp2 = _mm_aesenc_si128(tmp2, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 5820 | tmp1 = _mm_aesenc_si128(tmp1, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 5821 | tmp2 = _mm_aesenc_si128(tmp2, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 5822 | tmp1 = _mm_aesenc_si128(tmp1, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 5823 | tmp2 = _mm_aesenc_si128(tmp2, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 5824 | tmp1 = _mm_aesenc_si128(tmp1, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 5825 | tmp2 = _mm_aesenc_si128(tmp2, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 5826 | tmp1 = _mm_aesenc_si128(tmp1, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 5827 | tmp2 = _mm_aesenc_si128(tmp2, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 5828 | tmp1 = _mm_aesenc_si128(tmp1, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 5829 | tmp2 = _mm_aesenc_si128(tmp2, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 5830 | tmp1 = _mm_aesenc_si128(tmp1, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 5831 | tmp2 = _mm_aesenc_si128(tmp2, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 5832 | tmp1 = _mm_aesenc_si128(tmp1, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 5833 | tmp2 = _mm_aesenc_si128(tmp2, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 5834 | tmp1 = _mm_aesenc_si128(tmp1, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 5835 | tmp2 = _mm_aesenc_si128(tmp2, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 5836 | lastKey = KEY[10]; |
wolfSSL | 13:f67a6c6013ca | 5837 | if (nr > 10) { |
wolfSSL | 13:f67a6c6013ca | 5838 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5839 | tmp2 = _mm_aesenc_si128(tmp2, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5840 | tmp1 = _mm_aesenc_si128(tmp1, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 5841 | tmp2 = _mm_aesenc_si128(tmp2, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 5842 | lastKey = KEY[12]; |
wolfSSL | 13:f67a6c6013ca | 5843 | if (nr > 12) { |
wolfSSL | 13:f67a6c6013ca | 5844 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5845 | tmp2 = _mm_aesenc_si128(tmp2, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5846 | tmp1 = _mm_aesenc_si128(tmp1, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 5847 | tmp2 = _mm_aesenc_si128(tmp2, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 5848 | lastKey = KEY[14]; |
wolfSSL | 13:f67a6c6013ca | 5849 | } |
wolfSSL | 13:f67a6c6013ca | 5850 | } |
wolfSSL | 13:f67a6c6013ca | 5851 | H = _mm_aesenclast_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5852 | T = _mm_aesenclast_si128(tmp2, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5853 | H = _mm_shuffle_epi8(H, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5854 | } |
wolfSSL | 13:f67a6c6013ca | 5855 | else { |
wolfSSL | 13:f67a6c6013ca | 5856 | if (ibytes % 16) { |
wolfSSL | 13:f67a6c6013ca | 5857 | i = ibytes / 16; |
wolfSSL | 13:f67a6c6013ca | 5858 | for (j=0; j < ibytes%16; j++) |
wolfSSL | 13:f67a6c6013ca | 5859 | ((unsigned char*)&last_block)[j] = ivec[i*16+j]; |
wolfSSL | 13:f67a6c6013ca | 5860 | } |
wolfSSL | 13:f67a6c6013ca | 5861 | tmp1 = _mm_xor_si128(X, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 5862 | tmp1 = _mm_aesenc_si128(tmp1, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 5863 | tmp1 = _mm_aesenc_si128(tmp1, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 5864 | tmp1 = _mm_aesenc_si128(tmp1, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 5865 | tmp1 = _mm_aesenc_si128(tmp1, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 5866 | tmp1 = _mm_aesenc_si128(tmp1, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 5867 | tmp1 = _mm_aesenc_si128(tmp1, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 5868 | tmp1 = _mm_aesenc_si128(tmp1, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 5869 | tmp1 = _mm_aesenc_si128(tmp1, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 5870 | tmp1 = _mm_aesenc_si128(tmp1, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 5871 | lastKey = KEY[10]; |
wolfSSL | 13:f67a6c6013ca | 5872 | if (nr > 10) { |
wolfSSL | 13:f67a6c6013ca | 5873 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5874 | tmp1 = _mm_aesenc_si128(tmp1, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 5875 | lastKey = KEY[12]; |
wolfSSL | 13:f67a6c6013ca | 5876 | if (nr > 12) { |
wolfSSL | 13:f67a6c6013ca | 5877 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5878 | tmp1 = _mm_aesenc_si128(tmp1, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 5879 | lastKey = KEY[14]; |
wolfSSL | 13:f67a6c6013ca | 5880 | } |
wolfSSL | 13:f67a6c6013ca | 5881 | } |
wolfSSL | 13:f67a6c6013ca | 5882 | H = _mm_aesenclast_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5883 | H = _mm_shuffle_epi8(H, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5884 | |
wolfSSL | 13:f67a6c6013ca | 5885 | Y = _mm_setzero_si128(); |
wolfSSL | 13:f67a6c6013ca | 5886 | for (i=0; i < ibytes/16; i++) { |
wolfSSL | 13:f67a6c6013ca | 5887 | tmp1 = _mm_loadu_si128(&((__m128i*)ivec)[i]); |
wolfSSL | 13:f67a6c6013ca | 5888 | tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5889 | Y = _mm_xor_si128(Y, tmp1); |
wolfSSL | 13:f67a6c6013ca | 5890 | Y = gfmul_sw(Y, H); |
wolfSSL | 13:f67a6c6013ca | 5891 | } |
wolfSSL | 13:f67a6c6013ca | 5892 | if (ibytes % 16) { |
wolfSSL | 13:f67a6c6013ca | 5893 | tmp1 = last_block; |
wolfSSL | 13:f67a6c6013ca | 5894 | tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5895 | Y = _mm_xor_si128(Y, tmp1); |
wolfSSL | 13:f67a6c6013ca | 5896 | Y = gfmul_sw(Y, H); |
wolfSSL | 13:f67a6c6013ca | 5897 | } |
wolfSSL | 13:f67a6c6013ca | 5898 | tmp1 = _mm_insert_epi64(tmp1, ibytes*8, 0); |
wolfSSL | 13:f67a6c6013ca | 5899 | tmp1 = _mm_insert_epi64(tmp1, 0, 1); |
wolfSSL | 13:f67a6c6013ca | 5900 | Y = _mm_xor_si128(Y, tmp1); |
wolfSSL | 13:f67a6c6013ca | 5901 | Y = gfmul_sw(Y, H); |
wolfSSL | 13:f67a6c6013ca | 5902 | Y = _mm_shuffle_epi8(Y, BSWAP_MASK); /* Compute E(K, Y0) */ |
wolfSSL | 13:f67a6c6013ca | 5903 | tmp1 = _mm_xor_si128(Y, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 5904 | tmp1 = _mm_aesenc_si128(tmp1, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 5905 | tmp1 = _mm_aesenc_si128(tmp1, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 5906 | tmp1 = _mm_aesenc_si128(tmp1, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 5907 | tmp1 = _mm_aesenc_si128(tmp1, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 5908 | tmp1 = _mm_aesenc_si128(tmp1, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 5909 | tmp1 = _mm_aesenc_si128(tmp1, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 5910 | tmp1 = _mm_aesenc_si128(tmp1, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 5911 | tmp1 = _mm_aesenc_si128(tmp1, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 5912 | tmp1 = _mm_aesenc_si128(tmp1, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 5913 | lastKey = KEY[10]; |
wolfSSL | 13:f67a6c6013ca | 5914 | if (nr > 10) { |
wolfSSL | 13:f67a6c6013ca | 5915 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5916 | tmp1 = _mm_aesenc_si128(tmp1, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 5917 | lastKey = KEY[12]; |
wolfSSL | 13:f67a6c6013ca | 5918 | if (nr > 12) { |
wolfSSL | 13:f67a6c6013ca | 5919 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5920 | tmp1 = _mm_aesenc_si128(tmp1, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 5921 | lastKey = KEY[14]; |
wolfSSL | 13:f67a6c6013ca | 5922 | } |
wolfSSL | 13:f67a6c6013ca | 5923 | } |
wolfSSL | 13:f67a6c6013ca | 5924 | T = _mm_aesenclast_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 5925 | } |
wolfSSL | 13:f67a6c6013ca | 5926 | |
wolfSSL | 13:f67a6c6013ca | 5927 | for (i=0; i<abytes/16; i++) { |
wolfSSL | 13:f67a6c6013ca | 5928 | tmp1 = _mm_loadu_si128(&((__m128i*)addt)[i]); |
wolfSSL | 13:f67a6c6013ca | 5929 | tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5930 | X = _mm_xor_si128(X, tmp1); |
wolfSSL | 13:f67a6c6013ca | 5931 | X = gfmul_sw(X, H); |
wolfSSL | 13:f67a6c6013ca | 5932 | } |
wolfSSL | 13:f67a6c6013ca | 5933 | if (abytes%16) { |
wolfSSL | 13:f67a6c6013ca | 5934 | last_block = _mm_setzero_si128(); |
wolfSSL | 13:f67a6c6013ca | 5935 | for (j=0; j<abytes%16; j++) |
wolfSSL | 13:f67a6c6013ca | 5936 | ((unsigned char*)&last_block)[j] = addt[i*16+j]; |
wolfSSL | 13:f67a6c6013ca | 5937 | tmp1 = last_block; |
wolfSSL | 13:f67a6c6013ca | 5938 | tmp1 = _mm_shuffle_epi8(tmp1, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 5939 | X = _mm_xor_si128(X, tmp1); |
wolfSSL | 13:f67a6c6013ca | 5940 | X = gfmul_sw(X, H); |
wolfSSL | 13:f67a6c6013ca | 5941 | } |
wolfSSL | 13:f67a6c6013ca | 5942 | |
wolfSSL | 13:f67a6c6013ca | 5943 | tmp1 = _mm_shuffle_epi8(Y, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 5944 | ctr1 = _mm_add_epi32(tmp1, ONE); |
wolfSSL | 13:f67a6c6013ca | 5945 | H = gfmul_shl1(H); |
wolfSSL | 13:f67a6c6013ca | 5946 | i = 0; |
wolfSSL | 13:f67a6c6013ca | 5947 | |
wolfSSL | 13:f67a6c6013ca | 5948 | #if !defined(AES_GCM_AESNI_NO_UNROLL) && !defined(AES_GCM_AVX2_NO_UNROLL) |
wolfSSL | 13:f67a6c6013ca | 5949 | |
wolfSSL | 13:f67a6c6013ca | 5950 | if (0 < nbytes/16/8) { |
wolfSSL | 13:f67a6c6013ca | 5951 | HT[0] = H; |
wolfSSL | 13:f67a6c6013ca | 5952 | HT[1] = gfmul_shifted(H, H); |
wolfSSL | 13:f67a6c6013ca | 5953 | HT[2] = gfmul_shifted(H, HT[1]); |
wolfSSL | 13:f67a6c6013ca | 5954 | HT[3] = gfmul_shifted(HT[1], HT[1]); |
wolfSSL | 13:f67a6c6013ca | 5955 | HT[4] = gfmul_shifted(HT[1], HT[2]); |
wolfSSL | 13:f67a6c6013ca | 5956 | HT[5] = gfmul_shifted(HT[2], HT[2]); |
wolfSSL | 13:f67a6c6013ca | 5957 | HT[6] = gfmul_shifted(HT[2], HT[3]); |
wolfSSL | 13:f67a6c6013ca | 5958 | HT[7] = gfmul_shifted(HT[3], HT[3]); |
wolfSSL | 13:f67a6c6013ca | 5959 | |
wolfSSL | 13:f67a6c6013ca | 5960 | pctr1[0] = ctr1; |
wolfSSL | 13:f67a6c6013ca | 5961 | XV = X; |
wolfSSL | 13:f67a6c6013ca | 5962 | for (; i < nbytes/16/8; i++) { |
wolfSSL | 13:f67a6c6013ca | 5963 | __asm__ __volatile__ ( |
wolfSSL | 13:f67a6c6013ca | 5964 | "vmovaps (%[pctr1]), %%xmm0\n\t" |
wolfSSL | 13:f67a6c6013ca | 5965 | "vmovaps %[BSWAP_EPI64], %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 5966 | "vpshufb %%xmm1, %%xmm0, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5967 | "vpaddd %[ONE], %%xmm0, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 5968 | "vpshufb %%xmm1, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 5969 | "vpaddd %[TWO], %%xmm0, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 5970 | "vpshufb %%xmm1, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 5971 | "vpaddd %[THREE], %%xmm0, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 5972 | "vpshufb %%xmm1, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 5973 | "vpaddd %[FOUR], %%xmm0, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 5974 | "vpshufb %%xmm1, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 5975 | "vpaddd %[FIVE], %%xmm0, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 5976 | "vpshufb %%xmm1, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 5977 | "vpaddd %[SIX], %%xmm0, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 5978 | "vpshufb %%xmm1, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 5979 | "vpaddd %[SEVEN], %%xmm0, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 5980 | "vpshufb %%xmm1, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 5981 | "vpaddd %[EIGHT], %%xmm0, %%xmm0\n\t" |
wolfSSL | 13:f67a6c6013ca | 5982 | |
wolfSSL | 13:f67a6c6013ca | 5983 | "vmovaps (%[KEY]), %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 5984 | "vmovaps %%xmm0, (%[pctr1])\n\t" |
wolfSSL | 13:f67a6c6013ca | 5985 | "vpxor %%xmm1, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5986 | "vpxor %%xmm1, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 5987 | "vpxor %%xmm1, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 5988 | "vpxor %%xmm1, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 5989 | "vpxor %%xmm1, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 5990 | "vpxor %%xmm1, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 5991 | "vpxor %%xmm1, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 5992 | "vpxor %%xmm1, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 5993 | |
wolfSSL | 13:f67a6c6013ca | 5994 | "vmovaps 16(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 5995 | "vmovdqu (%[in]), %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 5996 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 5997 | "vmovaps 112(%[HT]), %%xmm0\n\t" |
wolfSSL | 13:f67a6c6013ca | 5998 | "vpshufb %[BSWAP_MASK], %%xmm1, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 5999 | "vpxor %[XV], %%xmm1, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 6000 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 6001 | "vpclmulqdq $16, %%xmm1, %%xmm0, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6002 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 6003 | "vpclmulqdq $1, %%xmm1, %%xmm0, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 6004 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 6005 | "vpclmulqdq $0, %%xmm1, %%xmm0, %%xmm15\n\t" |
wolfSSL | 13:f67a6c6013ca | 6006 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 6007 | "vpclmulqdq $17, %%xmm1, %%xmm0, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 6008 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 6009 | "vpxor %%xmm14, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6010 | "vpslldq $8, %%xmm13, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 6011 | "vpsrldq $8, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6012 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 6013 | "vpxor %%xmm15, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 6014 | "vpxor %%xmm13, %%xmm1, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 6015 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 6016 | |
wolfSSL | 13:f67a6c6013ca | 6017 | "vmovaps 32(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 6018 | "vmovdqu 16(%[in]), %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 6019 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6020 | "vmovaps 96(%[HT]), %%xmm0\n\t" |
wolfSSL | 13:f67a6c6013ca | 6021 | "vpshufb %[BSWAP_MASK], %%xmm1, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 6022 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 6023 | "vpclmulqdq $16, %%xmm1, %%xmm0, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6024 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 6025 | "vpclmulqdq $1, %%xmm1, %%xmm0, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 6026 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 6027 | "vpclmulqdq $0, %%xmm1, %%xmm0, %%xmm15\n\t" |
wolfSSL | 13:f67a6c6013ca | 6028 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 6029 | "vpclmulqdq $17, %%xmm1, %%xmm0, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 6030 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 6031 | "vpxor %%xmm14, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6032 | "vpslldq $8, %%xmm13, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 6033 | "vpsrldq $8, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6034 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 6035 | "vpxor %%xmm15, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 6036 | "vpxor %%xmm1, %%xmm3, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 6037 | "vpxor %%xmm14, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 6038 | "vpxor %%xmm13, %%xmm3, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 6039 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 6040 | |
wolfSSL | 13:f67a6c6013ca | 6041 | "vmovaps 48(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 6042 | "vmovdqu 32(%[in]), %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 6043 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6044 | "vmovaps 80(%[HT]), %%xmm0\n\t" |
wolfSSL | 13:f67a6c6013ca | 6045 | "vpshufb %[BSWAP_MASK], %%xmm1, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 6046 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 6047 | "vpclmulqdq $16, %%xmm1, %%xmm0, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6048 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 6049 | "vpclmulqdq $1, %%xmm1, %%xmm0, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 6050 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 6051 | "vpclmulqdq $0, %%xmm1, %%xmm0, %%xmm15\n\t" |
wolfSSL | 13:f67a6c6013ca | 6052 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 6053 | "vpclmulqdq $17, %%xmm1, %%xmm0, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 6054 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 6055 | "vpxor %%xmm14, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6056 | "vpslldq $8, %%xmm13, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 6057 | "vpsrldq $8, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6058 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 6059 | "vpxor %%xmm15, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 6060 | "vpxor %%xmm1, %%xmm3, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 6061 | "vpxor %%xmm14, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 6062 | "vpxor %%xmm13, %%xmm3, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 6063 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 6064 | |
wolfSSL | 13:f67a6c6013ca | 6065 | "vmovaps 64(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 6066 | "vmovdqu 48(%[in]), %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 6067 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6068 | "vmovaps 64(%[HT]), %%xmm0\n\t" |
wolfSSL | 13:f67a6c6013ca | 6069 | "vpshufb %[BSWAP_MASK], %%xmm1, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 6070 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 6071 | "vpclmulqdq $16, %%xmm1, %%xmm0, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6072 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 6073 | "vpclmulqdq $1, %%xmm1, %%xmm0, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 6074 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 6075 | "vpclmulqdq $0, %%xmm1, %%xmm0, %%xmm15\n\t" |
wolfSSL | 13:f67a6c6013ca | 6076 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 6077 | "vpclmulqdq $17, %%xmm1, %%xmm0, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 6078 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 6079 | "vpxor %%xmm14, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6080 | "vpslldq $8, %%xmm13, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 6081 | "vpsrldq $8, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6082 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 6083 | "vpxor %%xmm15, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 6084 | "vpxor %%xmm1, %%xmm3, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 6085 | "vpxor %%xmm14, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 6086 | "vpxor %%xmm13, %%xmm3, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 6087 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 6088 | |
wolfSSL | 13:f67a6c6013ca | 6089 | "vmovaps 80(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 6090 | "vmovdqu 64(%[in]), %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 6091 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6092 | "vmovaps 48(%[HT]), %%xmm0\n\t" |
wolfSSL | 13:f67a6c6013ca | 6093 | "vpshufb %[BSWAP_MASK], %%xmm1, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 6094 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 6095 | "vpclmulqdq $16, %%xmm1, %%xmm0, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6096 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 6097 | "vpclmulqdq $1, %%xmm1, %%xmm0, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 6098 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 6099 | "vpclmulqdq $0, %%xmm1, %%xmm0, %%xmm15\n\t" |
wolfSSL | 13:f67a6c6013ca | 6100 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 6101 | "vpclmulqdq $17, %%xmm1, %%xmm0, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 6102 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 6103 | "vpxor %%xmm14, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6104 | "vpslldq $8, %%xmm13, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 6105 | "vpsrldq $8, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6106 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 6107 | "vpxor %%xmm15, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 6108 | "vpxor %%xmm1, %%xmm3, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 6109 | "vpxor %%xmm14, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 6110 | "vpxor %%xmm13, %%xmm3, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 6111 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 6112 | |
wolfSSL | 13:f67a6c6013ca | 6113 | "vmovaps 96(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 6114 | "vmovdqu 80(%[in]), %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 6115 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6116 | "vmovaps 32(%[HT]), %%xmm0\n\t" |
wolfSSL | 13:f67a6c6013ca | 6117 | "vpshufb %[BSWAP_MASK], %%xmm1, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 6118 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 6119 | "vpclmulqdq $16, %%xmm1, %%xmm0, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6120 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 6121 | "vpclmulqdq $1, %%xmm1, %%xmm0, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 6122 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 6123 | "vpclmulqdq $0, %%xmm1, %%xmm0, %%xmm15\n\t" |
wolfSSL | 13:f67a6c6013ca | 6124 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 6125 | "vpclmulqdq $17, %%xmm1, %%xmm0, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 6126 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 6127 | "vpxor %%xmm14, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6128 | "vpslldq $8, %%xmm13, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 6129 | "vpsrldq $8, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6130 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 6131 | "vpxor %%xmm15, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 6132 | "vpxor %%xmm1, %%xmm3, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 6133 | "vpxor %%xmm14, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 6134 | "vpxor %%xmm13, %%xmm3, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 6135 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 6136 | |
wolfSSL | 13:f67a6c6013ca | 6137 | "vmovaps 112(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 6138 | "vmovdqu 96(%[in]), %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 6139 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6140 | "vmovaps 16(%[HT]), %%xmm0\n\t" |
wolfSSL | 13:f67a6c6013ca | 6141 | "vpshufb %[BSWAP_MASK], %%xmm1, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 6142 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 6143 | "vpclmulqdq $16, %%xmm1, %%xmm0, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6144 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 6145 | "vpclmulqdq $1, %%xmm1, %%xmm0, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 6146 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 6147 | "vpclmulqdq $0, %%xmm1, %%xmm0, %%xmm15\n\t" |
wolfSSL | 13:f67a6c6013ca | 6148 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 6149 | "vpclmulqdq $17, %%xmm1, %%xmm0, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 6150 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 6151 | "vpxor %%xmm14, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6152 | "vpslldq $8, %%xmm13, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 6153 | "vpsrldq $8, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6154 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 6155 | "vpxor %%xmm15, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 6156 | "vpxor %%xmm1, %%xmm3, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 6157 | "vpxor %%xmm14, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 6158 | "vpxor %%xmm13, %%xmm3, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 6159 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 6160 | |
wolfSSL | 13:f67a6c6013ca | 6161 | "vmovaps 128(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 6162 | "vmovdqu 112(%[in]), %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 6163 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6164 | "vmovaps (%[HT]), %%xmm0\n\t" |
wolfSSL | 13:f67a6c6013ca | 6165 | "vpshufb %[BSWAP_MASK], %%xmm1, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 6166 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 6167 | "vpclmulqdq $16, %%xmm1, %%xmm0, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6168 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 6169 | "vpclmulqdq $1, %%xmm1, %%xmm0, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 6170 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 6171 | "vpclmulqdq $0, %%xmm1, %%xmm0, %%xmm15\n\t" |
wolfSSL | 13:f67a6c6013ca | 6172 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 6173 | "vpclmulqdq $17, %%xmm1, %%xmm0, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 6174 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 6175 | "vpxor %%xmm14, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6176 | "vpslldq $8, %%xmm13, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 6177 | "vpsrldq $8, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6178 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 6179 | "vpxor %%xmm15, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 6180 | "vpxor %%xmm1, %%xmm3, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 6181 | "vpxor %%xmm14, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 6182 | "vpxor %%xmm13, %%xmm3, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 6183 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 6184 | |
wolfSSL | 13:f67a6c6013ca | 6185 | "vmovaps 144(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 6186 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6187 | "vmovdqa %[MOD2_128], %%xmm0\n\t" |
wolfSSL | 13:f67a6c6013ca | 6188 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 6189 | "vpclmulqdq $16, %%xmm0, %%xmm2, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 6190 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 6191 | "vpshufd $78, %%xmm2, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6192 | "vpxor %%xmm14, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6193 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 6194 | "vpclmulqdq $16, %%xmm0, %%xmm13, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 6195 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 6196 | "vpshufd $78, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6197 | "vpxor %%xmm14, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6198 | "vpxor %%xmm3, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6199 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 6200 | "vmovdqa %%xmm13, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 6201 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 6202 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 6203 | "cmpl $11, %[nr]\n\t" |
wolfSSL | 13:f67a6c6013ca | 6204 | "vmovaps 160(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 6205 | "jl %=f\n\t" |
wolfSSL | 13:f67a6c6013ca | 6206 | |
wolfSSL | 13:f67a6c6013ca | 6207 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6208 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 6209 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 6210 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 6211 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 6212 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 6213 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 6214 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 6215 | "vmovaps 176(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 6216 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6217 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 6218 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 6219 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 6220 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 6221 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 6222 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 6223 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 6224 | "cmpl $13, %[nr]\n\t" |
wolfSSL | 13:f67a6c6013ca | 6225 | "vmovaps 192(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 6226 | "jl %=f\n\t" |
wolfSSL | 13:f67a6c6013ca | 6227 | |
wolfSSL | 13:f67a6c6013ca | 6228 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6229 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 6230 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 6231 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 6232 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 6233 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 6234 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 6235 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 6236 | "vmovaps 208(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 6237 | "vaesenc %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6238 | "vaesenc %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 6239 | "vaesenc %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 6240 | "vaesenc %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 6241 | "vaesenc %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 6242 | "vaesenc %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 6243 | "vaesenc %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 6244 | "vaesenc %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 6245 | "vmovaps 224(%[KEY]), %%xmm12\n\t" |
wolfSSL | 13:f67a6c6013ca | 6246 | |
wolfSSL | 13:f67a6c6013ca | 6247 | "%=:\n\t" |
wolfSSL | 13:f67a6c6013ca | 6248 | "vaesenclast %%xmm12, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6249 | "vaesenclast %%xmm12, %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 6250 | "vpxor (%[in]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6251 | "vpxor 16(%[in]), %%xmm5, %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 6252 | "vmovdqu %%xmm4, (%[out])\n\t" |
wolfSSL | 13:f67a6c6013ca | 6253 | "vmovdqu %%xmm5, 16(%[out])\n\t" |
wolfSSL | 13:f67a6c6013ca | 6254 | "vaesenclast %%xmm12, %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 6255 | "vaesenclast %%xmm12, %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 6256 | "vpxor 32(%[in]), %%xmm6, %%xmm6\n\t" |
wolfSSL | 13:f67a6c6013ca | 6257 | "vpxor 48(%[in]), %%xmm7, %%xmm7\n\t" |
wolfSSL | 13:f67a6c6013ca | 6258 | "vmovdqu %%xmm6, 32(%[out])\n\t" |
wolfSSL | 13:f67a6c6013ca | 6259 | "vmovdqu %%xmm7, 48(%[out])\n\t" |
wolfSSL | 13:f67a6c6013ca | 6260 | "vaesenclast %%xmm12, %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 6261 | "vaesenclast %%xmm12, %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 6262 | "vpxor 64(%[in]), %%xmm8, %%xmm8\n\t" |
wolfSSL | 13:f67a6c6013ca | 6263 | "vpxor 80(%[in]), %%xmm9, %%xmm9\n\t" |
wolfSSL | 13:f67a6c6013ca | 6264 | "vmovdqu %%xmm8, 64(%[out])\n\t" |
wolfSSL | 13:f67a6c6013ca | 6265 | "vmovdqu %%xmm9, 80(%[out])\n\t" |
wolfSSL | 13:f67a6c6013ca | 6266 | "vaesenclast %%xmm12, %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 6267 | "vaesenclast %%xmm12, %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 6268 | "vpxor 96(%[in]), %%xmm10, %%xmm10\n\t" |
wolfSSL | 13:f67a6c6013ca | 6269 | "vpxor 112(%[in]), %%xmm11, %%xmm11\n\t" |
wolfSSL | 13:f67a6c6013ca | 6270 | "vmovdqu %%xmm10, 96(%[out])\n\t" |
wolfSSL | 13:f67a6c6013ca | 6271 | "vmovdqu %%xmm11, 112(%[out])\n\t" |
wolfSSL | 13:f67a6c6013ca | 6272 | |
wolfSSL | 13:f67a6c6013ca | 6273 | : [XV] "+xr" (XV) |
wolfSSL | 13:f67a6c6013ca | 6274 | : [KEY] "r" (KEY), [HT] "r" (HT), [pctr1] "r" (pctr1), |
wolfSSL | 13:f67a6c6013ca | 6275 | [in] "r" (&in[i*16*8]), [out] "r" (&out[i*16*8]), [nr] "r" (nr), |
wolfSSL | 13:f67a6c6013ca | 6276 | [BSWAP_MASK] "xrm" (BSWAP_MASK), |
wolfSSL | 13:f67a6c6013ca | 6277 | [BSWAP_EPI64] "xrm" (BSWAP_EPI64), |
wolfSSL | 13:f67a6c6013ca | 6278 | [ONE] "xrm" (ONE), [TWO] "xrm" (TWO), |
wolfSSL | 13:f67a6c6013ca | 6279 | [THREE] "xrm" (THREE), [FOUR] "xrm" (FOUR), |
wolfSSL | 13:f67a6c6013ca | 6280 | [FIVE] "xrm" (FIVE), [SIX] "xrm" (SIX), |
wolfSSL | 13:f67a6c6013ca | 6281 | [SEVEN] "xrm" (SEVEN), [EIGHT] "xrm" (EIGHT), |
wolfSSL | 13:f67a6c6013ca | 6282 | [MOD2_128] "xrm" (MOD2_128) |
wolfSSL | 13:f67a6c6013ca | 6283 | : "xmm15", "xmm14", "xmm13", "xmm12", |
wolfSSL | 13:f67a6c6013ca | 6284 | "xmm11", "xmm10", "xmm9", "xmm8", |
wolfSSL | 13:f67a6c6013ca | 6285 | "xmm7", "xmm6", "xmm5", "xmm4", |
wolfSSL | 13:f67a6c6013ca | 6286 | "xmm0", "xmm1", "xmm3", "memory" |
wolfSSL | 13:f67a6c6013ca | 6287 | ); |
wolfSSL | 13:f67a6c6013ca | 6288 | } |
wolfSSL | 13:f67a6c6013ca | 6289 | X = XV; |
wolfSSL | 13:f67a6c6013ca | 6290 | ctr1 = pctr1[0]; |
wolfSSL | 13:f67a6c6013ca | 6291 | } |
wolfSSL | 13:f67a6c6013ca | 6292 | #endif |
wolfSSL | 13:f67a6c6013ca | 6293 | for (k = i*8; k < nbytes/16; k++) { |
wolfSSL | 13:f67a6c6013ca | 6294 | __asm__ __volatile__ ( |
wolfSSL | 13:f67a6c6013ca | 6295 | "vpshufb %[BSWAP_EPI64], %[ctr1], %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6296 | "vpaddd %[ONE], %[ctr1], %[ctr1]\n\t" |
wolfSSL | 13:f67a6c6013ca | 6297 | "vpxor (%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6298 | "vaesenc 16(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6299 | "vmovaps %[H], %%xmm0\n\t" |
wolfSSL | 13:f67a6c6013ca | 6300 | "vmovdqu (%[in]), %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 6301 | "vaesenc 32(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6302 | "vpshufb %[BSWAP_MASK], %%xmm1, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 6303 | "vpxor %[X], %%xmm1, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 6304 | "vaesenc 48(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6305 | "vpclmulqdq $16, %%xmm1, %%xmm0, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6306 | "vaesenc 64(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6307 | "vpclmulqdq $1, %%xmm1, %%xmm0, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 6308 | "vaesenc 80(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6309 | "vpclmulqdq $0, %%xmm1, %%xmm0, %%xmm15\n\t" |
wolfSSL | 13:f67a6c6013ca | 6310 | "vaesenc 96(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6311 | "vpclmulqdq $17, %%xmm1, %%xmm0, %%xmm1\n\t" |
wolfSSL | 13:f67a6c6013ca | 6312 | "vaesenc 112(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6313 | "vpxor %%xmm14, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6314 | "vpslldq $8, %%xmm13, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 6315 | "vpsrldq $8, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6316 | "vaesenc 128(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6317 | "vpxor %%xmm15, %%xmm2, %%xmm2\n\t" |
wolfSSL | 13:f67a6c6013ca | 6318 | "vpxor %%xmm13, %%xmm1, %%xmm3\n\t" |
wolfSSL | 13:f67a6c6013ca | 6319 | "vaesenc 144(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6320 | "# Reduce\n\t" |
wolfSSL | 13:f67a6c6013ca | 6321 | "vmovdqa %[MOD2_128], %%xmm0\n\t" |
wolfSSL | 13:f67a6c6013ca | 6322 | "vpclmulqdq $16, %%xmm0, %%xmm2, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 6323 | "vpshufd $78, %%xmm2, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6324 | "vpxor %%xmm14, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6325 | "vpclmulqdq $16, %%xmm0, %%xmm13, %%xmm14\n\t" |
wolfSSL | 13:f67a6c6013ca | 6326 | "vpshufd $78, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6327 | "vpxor %%xmm14, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6328 | "vpxor %%xmm3, %%xmm13, %%xmm13\n\t" |
wolfSSL | 13:f67a6c6013ca | 6329 | "vmovdqa %%xmm13, %[X]\n\t" |
wolfSSL | 13:f67a6c6013ca | 6330 | "# End Reduce\n\t" |
wolfSSL | 13:f67a6c6013ca | 6331 | "cmpl $11, %[nr]\n\t" |
wolfSSL | 13:f67a6c6013ca | 6332 | "vmovaps 160(%[KEY]), %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 6333 | "jl %=f\n\t" |
wolfSSL | 13:f67a6c6013ca | 6334 | "vaesenc %%xmm5, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6335 | "vaesenc 176(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6336 | "cmpl $13, %[nr]\n\t" |
wolfSSL | 13:f67a6c6013ca | 6337 | "vmovaps 192(%[KEY]), %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 6338 | "jl %=f\n\t" |
wolfSSL | 13:f67a6c6013ca | 6339 | "vaesenc %%xmm5, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6340 | "vaesenc 208(%[KEY]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6341 | "vmovaps 224(%[KEY]), %%xmm5\n\t" |
wolfSSL | 13:f67a6c6013ca | 6342 | "%=:\n\t" |
wolfSSL | 13:f67a6c6013ca | 6343 | "vaesenclast %%xmm5, %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6344 | "vpxor (%[in]), %%xmm4, %%xmm4\n\t" |
wolfSSL | 13:f67a6c6013ca | 6345 | "vmovdqu %%xmm4, (%[out])\n\t" |
wolfSSL | 13:f67a6c6013ca | 6346 | |
wolfSSL | 13:f67a6c6013ca | 6347 | : [H] "+xr" (H), [X] "+xr" (X), |
wolfSSL | 13:f67a6c6013ca | 6348 | [ctr1] "+xr" (ctr1) |
wolfSSL | 13:f67a6c6013ca | 6349 | : [KEY] "r" (KEY), |
wolfSSL | 13:f67a6c6013ca | 6350 | [in] "r" (&in[k*16]), [out] "r" (&out[k*16]), [nr] "r" (nr), |
wolfSSL | 13:f67a6c6013ca | 6351 | [BSWAP_MASK] "xrm" (BSWAP_MASK), |
wolfSSL | 13:f67a6c6013ca | 6352 | [BSWAP_EPI64] "xrm" (BSWAP_EPI64), |
wolfSSL | 13:f67a6c6013ca | 6353 | [ONE] "xrm" (ONE), |
wolfSSL | 13:f67a6c6013ca | 6354 | [MOD2_128] "xrm" (MOD2_128) |
wolfSSL | 13:f67a6c6013ca | 6355 | : "xmm15", "xmm14", "xmm13", "xmm4", "xmm5", |
wolfSSL | 13:f67a6c6013ca | 6356 | "xmm0", "xmm1", "xmm2", "xmm3", "memory" |
wolfSSL | 13:f67a6c6013ca | 6357 | ); |
wolfSSL | 13:f67a6c6013ca | 6358 | } |
wolfSSL | 13:f67a6c6013ca | 6359 | |
wolfSSL | 13:f67a6c6013ca | 6360 | /* If one partial block remains */ |
wolfSSL | 13:f67a6c6013ca | 6361 | if (nbytes % 16) { |
wolfSSL | 13:f67a6c6013ca | 6362 | tmp1 = _mm_shuffle_epi8(ctr1, BSWAP_EPI64); |
wolfSSL | 13:f67a6c6013ca | 6363 | tmp1 = _mm_xor_si128(tmp1, KEY[0]); |
wolfSSL | 13:f67a6c6013ca | 6364 | tmp1 = _mm_aesenc_si128(tmp1, KEY[1]); |
wolfSSL | 13:f67a6c6013ca | 6365 | tmp1 = _mm_aesenc_si128(tmp1, KEY[2]); |
wolfSSL | 13:f67a6c6013ca | 6366 | tmp1 = _mm_aesenc_si128(tmp1, KEY[3]); |
wolfSSL | 13:f67a6c6013ca | 6367 | tmp1 = _mm_aesenc_si128(tmp1, KEY[4]); |
wolfSSL | 13:f67a6c6013ca | 6368 | tmp1 = _mm_aesenc_si128(tmp1, KEY[5]); |
wolfSSL | 13:f67a6c6013ca | 6369 | tmp1 = _mm_aesenc_si128(tmp1, KEY[6]); |
wolfSSL | 13:f67a6c6013ca | 6370 | tmp1 = _mm_aesenc_si128(tmp1, KEY[7]); |
wolfSSL | 13:f67a6c6013ca | 6371 | tmp1 = _mm_aesenc_si128(tmp1, KEY[8]); |
wolfSSL | 13:f67a6c6013ca | 6372 | tmp1 = _mm_aesenc_si128(tmp1, KEY[9]); |
wolfSSL | 13:f67a6c6013ca | 6373 | lastKey = KEY[10]; |
wolfSSL | 13:f67a6c6013ca | 6374 | if (nr > 10) { |
wolfSSL | 13:f67a6c6013ca | 6375 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 6376 | tmp1 = _mm_aesenc_si128(tmp1, KEY[11]); |
wolfSSL | 13:f67a6c6013ca | 6377 | lastKey = KEY[12]; |
wolfSSL | 13:f67a6c6013ca | 6378 | if (nr > 12) { |
wolfSSL | 13:f67a6c6013ca | 6379 | tmp1 = _mm_aesenc_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 6380 | tmp1 = _mm_aesenc_si128(tmp1, KEY[13]); |
wolfSSL | 13:f67a6c6013ca | 6381 | lastKey = KEY[14]; |
wolfSSL | 13:f67a6c6013ca | 6382 | } |
wolfSSL | 13:f67a6c6013ca | 6383 | } |
wolfSSL | 13:f67a6c6013ca | 6384 | tmp1 = _mm_aesenclast_si128(tmp1, lastKey); |
wolfSSL | 13:f67a6c6013ca | 6385 | last_block = _mm_setzero_si128(); |
wolfSSL | 13:f67a6c6013ca | 6386 | for (j=0; j < nbytes%16; j++) |
wolfSSL | 13:f67a6c6013ca | 6387 | ((unsigned char*)&last_block)[j] = in[k*16+j]; |
wolfSSL | 13:f67a6c6013ca | 6388 | XV = last_block; |
wolfSSL | 13:f67a6c6013ca | 6389 | tmp1 = _mm_xor_si128(tmp1, last_block); |
wolfSSL | 13:f67a6c6013ca | 6390 | last_block = tmp1; |
wolfSSL | 13:f67a6c6013ca | 6391 | for (j=0; j < nbytes%16; j++) |
wolfSSL | 13:f67a6c6013ca | 6392 | out[k*16+j] = ((unsigned char*)&last_block)[j]; |
wolfSSL | 13:f67a6c6013ca | 6393 | XV = _mm_shuffle_epi8(XV, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 6394 | XV = _mm_xor_si128(XV, X); |
wolfSSL | 13:f67a6c6013ca | 6395 | X = gfmul_shifted(XV, H); |
wolfSSL | 13:f67a6c6013ca | 6396 | } |
wolfSSL | 13:f67a6c6013ca | 6397 | |
wolfSSL | 13:f67a6c6013ca | 6398 | tmp1 = _mm_insert_epi64(tmp1, nbytes*8, 0); |
wolfSSL | 13:f67a6c6013ca | 6399 | tmp1 = _mm_insert_epi64(tmp1, abytes*8, 1); |
wolfSSL | 13:f67a6c6013ca | 6400 | /* 128 x 128 Carryless Multiply */ |
wolfSSL | 13:f67a6c6013ca | 6401 | X = _mm_xor_si128(X, tmp1); |
wolfSSL | 13:f67a6c6013ca | 6402 | X = gfmul_shifted(X, H); |
wolfSSL | 13:f67a6c6013ca | 6403 | X = _mm_shuffle_epi8(X, BSWAP_MASK); |
wolfSSL | 13:f67a6c6013ca | 6404 | T = _mm_xor_si128(X, T); |
wolfSSL | 13:f67a6c6013ca | 6405 | |
wolfSSL | 13:f67a6c6013ca | 6406 | if (0xffff != |
wolfSSL | 13:f67a6c6013ca | 6407 | _mm_movemask_epi8(_mm_cmpeq_epi8(T, _mm_loadu_si128((__m128i*)tag)))) |
wolfSSL | 13:f67a6c6013ca | 6408 | return 0; /* in case the authentication failed */ |
wolfSSL | 13:f67a6c6013ca | 6409 | |
wolfSSL | 13:f67a6c6013ca | 6410 | return 1; /* when successful returns 1 */ |
wolfSSL | 13:f67a6c6013ca | 6411 | } |
wolfSSL | 13:f67a6c6013ca | 6412 | #endif /* HAVE_INTEL_AVX2 */ |
wolfSSL | 13:f67a6c6013ca | 6413 | #endif /* HAVE_AES_DECRYPT */ |
wolfSSL | 13:f67a6c6013ca | 6414 | #endif /* WOLFSSL_AESNI */ |
wolfSSL | 13:f67a6c6013ca | 6415 | |
wolfSSL | 13:f67a6c6013ca | 6416 | |
wolfSSL | 13:f67a6c6013ca | 6417 | #if defined(GCM_SMALL) |
wolfSSL | 13:f67a6c6013ca | 6418 | static void GMULT(byte* X, byte* Y) |
wolfSSL | 13:f67a6c6013ca | 6419 | { |
wolfSSL | 13:f67a6c6013ca | 6420 | byte Z[AES_BLOCK_SIZE]; |
wolfSSL | 13:f67a6c6013ca | 6421 | byte V[AES_BLOCK_SIZE]; |
wolfSSL | 13:f67a6c6013ca | 6422 | int i, j; |
wolfSSL | 13:f67a6c6013ca | 6423 | |
wolfSSL | 13:f67a6c6013ca | 6424 | XMEMSET(Z, 0, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6425 | XMEMCPY(V, X, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6426 | for (i = 0; i < AES_BLOCK_SIZE; i++) |
wolfSSL | 13:f67a6c6013ca | 6427 | { |
wolfSSL | 13:f67a6c6013ca | 6428 | byte y = Y[i]; |
wolfSSL | 13:f67a6c6013ca | 6429 | for (j = 0; j < 8; j++) |
wolfSSL | 13:f67a6c6013ca | 6430 | { |
wolfSSL | 13:f67a6c6013ca | 6431 | if (y & 0x80) { |
wolfSSL | 13:f67a6c6013ca | 6432 | xorbuf(Z, V, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6433 | } |
wolfSSL | 13:f67a6c6013ca | 6434 | |
wolfSSL | 13:f67a6c6013ca | 6435 | RIGHTSHIFTX(V); |
wolfSSL | 13:f67a6c6013ca | 6436 | y = y << 1; |
wolfSSL | 13:f67a6c6013ca | 6437 | } |
wolfSSL | 13:f67a6c6013ca | 6438 | } |
wolfSSL | 13:f67a6c6013ca | 6439 | XMEMCPY(X, Z, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6440 | } |
wolfSSL | 13:f67a6c6013ca | 6441 | |
wolfSSL | 13:f67a6c6013ca | 6442 | |
wolfSSL | 13:f67a6c6013ca | 6443 | void GHASH(Aes* aes, const byte* a, word32 aSz, const byte* c, |
wolfSSL | 13:f67a6c6013ca | 6444 | word32 cSz, byte* s, word32 sSz) |
wolfSSL | 13:f67a6c6013ca | 6445 | { |
wolfSSL | 13:f67a6c6013ca | 6446 | byte x[AES_BLOCK_SIZE]; |
wolfSSL | 13:f67a6c6013ca | 6447 | byte scratch[AES_BLOCK_SIZE]; |
wolfSSL | 13:f67a6c6013ca | 6448 | word32 blocks, partial; |
wolfSSL | 13:f67a6c6013ca | 6449 | byte* h = aes->H; |
wolfSSL | 13:f67a6c6013ca | 6450 | |
wolfSSL | 13:f67a6c6013ca | 6451 | XMEMSET(x, 0, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6452 | |
wolfSSL | 13:f67a6c6013ca | 6453 | /* Hash in A, the Additional Authentication Data */ |
wolfSSL | 13:f67a6c6013ca | 6454 | if (aSz != 0 && a != NULL) { |
wolfSSL | 13:f67a6c6013ca | 6455 | blocks = aSz / AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 6456 | partial = aSz % AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 6457 | while (blocks--) { |
wolfSSL | 13:f67a6c6013ca | 6458 | xorbuf(x, a, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6459 | GMULT(x, h); |
wolfSSL | 13:f67a6c6013ca | 6460 | a += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 6461 | } |
wolfSSL | 13:f67a6c6013ca | 6462 | if (partial != 0) { |
wolfSSL | 13:f67a6c6013ca | 6463 | XMEMSET(scratch, 0, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6464 | XMEMCPY(scratch, a, partial); |
wolfSSL | 13:f67a6c6013ca | 6465 | xorbuf(x, scratch, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6466 | GMULT(x, h); |
wolfSSL | 13:f67a6c6013ca | 6467 | } |
wolfSSL | 13:f67a6c6013ca | 6468 | } |
wolfSSL | 13:f67a6c6013ca | 6469 | |
wolfSSL | 13:f67a6c6013ca | 6470 | /* Hash in C, the Ciphertext */ |
wolfSSL | 13:f67a6c6013ca | 6471 | if (cSz != 0 && c != NULL) { |
wolfSSL | 13:f67a6c6013ca | 6472 | blocks = cSz / AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 6473 | partial = cSz % AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 6474 | while (blocks--) { |
wolfSSL | 13:f67a6c6013ca | 6475 | xorbuf(x, c, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6476 | GMULT(x, h); |
wolfSSL | 13:f67a6c6013ca | 6477 | c += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 6478 | } |
wolfSSL | 13:f67a6c6013ca | 6479 | if (partial != 0) { |
wolfSSL | 13:f67a6c6013ca | 6480 | XMEMSET(scratch, 0, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6481 | XMEMCPY(scratch, c, partial); |
wolfSSL | 13:f67a6c6013ca | 6482 | xorbuf(x, scratch, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6483 | GMULT(x, h); |
wolfSSL | 13:f67a6c6013ca | 6484 | } |
wolfSSL | 13:f67a6c6013ca | 6485 | } |
wolfSSL | 13:f67a6c6013ca | 6486 | |
wolfSSL | 13:f67a6c6013ca | 6487 | /* Hash in the lengths of A and C in bits */ |
wolfSSL | 13:f67a6c6013ca | 6488 | FlattenSzInBits(&scratch[0], aSz); |
wolfSSL | 13:f67a6c6013ca | 6489 | FlattenSzInBits(&scratch[8], cSz); |
wolfSSL | 13:f67a6c6013ca | 6490 | xorbuf(x, scratch, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6491 | GMULT(x, h); |
wolfSSL | 13:f67a6c6013ca | 6492 | |
wolfSSL | 13:f67a6c6013ca | 6493 | /* Copy the result into s. */ |
wolfSSL | 13:f67a6c6013ca | 6494 | XMEMCPY(s, x, sSz); |
wolfSSL | 13:f67a6c6013ca | 6495 | } |
wolfSSL | 13:f67a6c6013ca | 6496 | |
wolfSSL | 13:f67a6c6013ca | 6497 | /* end GCM_SMALL */ |
wolfSSL | 13:f67a6c6013ca | 6498 | #elif defined(GCM_TABLE) |
wolfSSL | 13:f67a6c6013ca | 6499 | |
wolfSSL | 13:f67a6c6013ca | 6500 | static const byte R[256][2] = { |
wolfSSL | 13:f67a6c6013ca | 6501 | {0x00, 0x00}, {0x01, 0xc2}, {0x03, 0x84}, {0x02, 0x46}, |
wolfSSL | 13:f67a6c6013ca | 6502 | {0x07, 0x08}, {0x06, 0xca}, {0x04, 0x8c}, {0x05, 0x4e}, |
wolfSSL | 13:f67a6c6013ca | 6503 | {0x0e, 0x10}, {0x0f, 0xd2}, {0x0d, 0x94}, {0x0c, 0x56}, |
wolfSSL | 13:f67a6c6013ca | 6504 | {0x09, 0x18}, {0x08, 0xda}, {0x0a, 0x9c}, {0x0b, 0x5e}, |
wolfSSL | 13:f67a6c6013ca | 6505 | {0x1c, 0x20}, {0x1d, 0xe2}, {0x1f, 0xa4}, {0x1e, 0x66}, |
wolfSSL | 13:f67a6c6013ca | 6506 | {0x1b, 0x28}, {0x1a, 0xea}, {0x18, 0xac}, {0x19, 0x6e}, |
wolfSSL | 13:f67a6c6013ca | 6507 | {0x12, 0x30}, {0x13, 0xf2}, {0x11, 0xb4}, {0x10, 0x76}, |
wolfSSL | 13:f67a6c6013ca | 6508 | {0x15, 0x38}, {0x14, 0xfa}, {0x16, 0xbc}, {0x17, 0x7e}, |
wolfSSL | 13:f67a6c6013ca | 6509 | {0x38, 0x40}, {0x39, 0x82}, {0x3b, 0xc4}, {0x3a, 0x06}, |
wolfSSL | 13:f67a6c6013ca | 6510 | {0x3f, 0x48}, {0x3e, 0x8a}, {0x3c, 0xcc}, {0x3d, 0x0e}, |
wolfSSL | 13:f67a6c6013ca | 6511 | {0x36, 0x50}, {0x37, 0x92}, {0x35, 0xd4}, {0x34, 0x16}, |
wolfSSL | 13:f67a6c6013ca | 6512 | {0x31, 0x58}, {0x30, 0x9a}, {0x32, 0xdc}, {0x33, 0x1e}, |
wolfSSL | 13:f67a6c6013ca | 6513 | {0x24, 0x60}, {0x25, 0xa2}, {0x27, 0xe4}, {0x26, 0x26}, |
wolfSSL | 13:f67a6c6013ca | 6514 | {0x23, 0x68}, {0x22, 0xaa}, {0x20, 0xec}, {0x21, 0x2e}, |
wolfSSL | 13:f67a6c6013ca | 6515 | {0x2a, 0x70}, {0x2b, 0xb2}, {0x29, 0xf4}, {0x28, 0x36}, |
wolfSSL | 13:f67a6c6013ca | 6516 | {0x2d, 0x78}, {0x2c, 0xba}, {0x2e, 0xfc}, {0x2f, 0x3e}, |
wolfSSL | 13:f67a6c6013ca | 6517 | {0x70, 0x80}, {0x71, 0x42}, {0x73, 0x04}, {0x72, 0xc6}, |
wolfSSL | 13:f67a6c6013ca | 6518 | {0x77, 0x88}, {0x76, 0x4a}, {0x74, 0x0c}, {0x75, 0xce}, |
wolfSSL | 13:f67a6c6013ca | 6519 | {0x7e, 0x90}, {0x7f, 0x52}, {0x7d, 0x14}, {0x7c, 0xd6}, |
wolfSSL | 13:f67a6c6013ca | 6520 | {0x79, 0x98}, {0x78, 0x5a}, {0x7a, 0x1c}, {0x7b, 0xde}, |
wolfSSL | 13:f67a6c6013ca | 6521 | {0x6c, 0xa0}, {0x6d, 0x62}, {0x6f, 0x24}, {0x6e, 0xe6}, |
wolfSSL | 13:f67a6c6013ca | 6522 | {0x6b, 0xa8}, {0x6a, 0x6a}, {0x68, 0x2c}, {0x69, 0xee}, |
wolfSSL | 13:f67a6c6013ca | 6523 | {0x62, 0xb0}, {0x63, 0x72}, {0x61, 0x34}, {0x60, 0xf6}, |
wolfSSL | 13:f67a6c6013ca | 6524 | {0x65, 0xb8}, {0x64, 0x7a}, {0x66, 0x3c}, {0x67, 0xfe}, |
wolfSSL | 13:f67a6c6013ca | 6525 | {0x48, 0xc0}, {0x49, 0x02}, {0x4b, 0x44}, {0x4a, 0x86}, |
wolfSSL | 13:f67a6c6013ca | 6526 | {0x4f, 0xc8}, {0x4e, 0x0a}, {0x4c, 0x4c}, {0x4d, 0x8e}, |
wolfSSL | 13:f67a6c6013ca | 6527 | {0x46, 0xd0}, {0x47, 0x12}, {0x45, 0x54}, {0x44, 0x96}, |
wolfSSL | 13:f67a6c6013ca | 6528 | {0x41, 0xd8}, {0x40, 0x1a}, {0x42, 0x5c}, {0x43, 0x9e}, |
wolfSSL | 13:f67a6c6013ca | 6529 | {0x54, 0xe0}, {0x55, 0x22}, {0x57, 0x64}, {0x56, 0xa6}, |
wolfSSL | 13:f67a6c6013ca | 6530 | {0x53, 0xe8}, {0x52, 0x2a}, {0x50, 0x6c}, {0x51, 0xae}, |
wolfSSL | 13:f67a6c6013ca | 6531 | {0x5a, 0xf0}, {0x5b, 0x32}, {0x59, 0x74}, {0x58, 0xb6}, |
wolfSSL | 13:f67a6c6013ca | 6532 | {0x5d, 0xf8}, {0x5c, 0x3a}, {0x5e, 0x7c}, {0x5f, 0xbe}, |
wolfSSL | 13:f67a6c6013ca | 6533 | {0xe1, 0x00}, {0xe0, 0xc2}, {0xe2, 0x84}, {0xe3, 0x46}, |
wolfSSL | 13:f67a6c6013ca | 6534 | {0xe6, 0x08}, {0xe7, 0xca}, {0xe5, 0x8c}, {0xe4, 0x4e}, |
wolfSSL | 13:f67a6c6013ca | 6535 | {0xef, 0x10}, {0xee, 0xd2}, {0xec, 0x94}, {0xed, 0x56}, |
wolfSSL | 13:f67a6c6013ca | 6536 | {0xe8, 0x18}, {0xe9, 0xda}, {0xeb, 0x9c}, {0xea, 0x5e}, |
wolfSSL | 13:f67a6c6013ca | 6537 | {0xfd, 0x20}, {0xfc, 0xe2}, {0xfe, 0xa4}, {0xff, 0x66}, |
wolfSSL | 13:f67a6c6013ca | 6538 | {0xfa, 0x28}, {0xfb, 0xea}, {0xf9, 0xac}, {0xf8, 0x6e}, |
wolfSSL | 13:f67a6c6013ca | 6539 | {0xf3, 0x30}, {0xf2, 0xf2}, {0xf0, 0xb4}, {0xf1, 0x76}, |
wolfSSL | 13:f67a6c6013ca | 6540 | {0xf4, 0x38}, {0xf5, 0xfa}, {0xf7, 0xbc}, {0xf6, 0x7e}, |
wolfSSL | 13:f67a6c6013ca | 6541 | {0xd9, 0x40}, {0xd8, 0x82}, {0xda, 0xc4}, {0xdb, 0x06}, |
wolfSSL | 13:f67a6c6013ca | 6542 | {0xde, 0x48}, {0xdf, 0x8a}, {0xdd, 0xcc}, {0xdc, 0x0e}, |
wolfSSL | 13:f67a6c6013ca | 6543 | {0xd7, 0x50}, {0xd6, 0x92}, {0xd4, 0xd4}, {0xd5, 0x16}, |
wolfSSL | 13:f67a6c6013ca | 6544 | {0xd0, 0x58}, {0xd1, 0x9a}, {0xd3, 0xdc}, {0xd2, 0x1e}, |
wolfSSL | 13:f67a6c6013ca | 6545 | {0xc5, 0x60}, {0xc4, 0xa2}, {0xc6, 0xe4}, {0xc7, 0x26}, |
wolfSSL | 13:f67a6c6013ca | 6546 | {0xc2, 0x68}, {0xc3, 0xaa}, {0xc1, 0xec}, {0xc0, 0x2e}, |
wolfSSL | 13:f67a6c6013ca | 6547 | {0xcb, 0x70}, {0xca, 0xb2}, {0xc8, 0xf4}, {0xc9, 0x36}, |
wolfSSL | 13:f67a6c6013ca | 6548 | {0xcc, 0x78}, {0xcd, 0xba}, {0xcf, 0xfc}, {0xce, 0x3e}, |
wolfSSL | 13:f67a6c6013ca | 6549 | {0x91, 0x80}, {0x90, 0x42}, {0x92, 0x04}, {0x93, 0xc6}, |
wolfSSL | 13:f67a6c6013ca | 6550 | {0x96, 0x88}, {0x97, 0x4a}, {0x95, 0x0c}, {0x94, 0xce}, |
wolfSSL | 13:f67a6c6013ca | 6551 | {0x9f, 0x90}, {0x9e, 0x52}, {0x9c, 0x14}, {0x9d, 0xd6}, |
wolfSSL | 13:f67a6c6013ca | 6552 | {0x98, 0x98}, {0x99, 0x5a}, {0x9b, 0x1c}, {0x9a, 0xde}, |
wolfSSL | 13:f67a6c6013ca | 6553 | {0x8d, 0xa0}, {0x8c, 0x62}, {0x8e, 0x24}, {0x8f, 0xe6}, |
wolfSSL | 13:f67a6c6013ca | 6554 | {0x8a, 0xa8}, {0x8b, 0x6a}, {0x89, 0x2c}, {0x88, 0xee}, |
wolfSSL | 13:f67a6c6013ca | 6555 | {0x83, 0xb0}, {0x82, 0x72}, {0x80, 0x34}, {0x81, 0xf6}, |
wolfSSL | 13:f67a6c6013ca | 6556 | {0x84, 0xb8}, {0x85, 0x7a}, {0x87, 0x3c}, {0x86, 0xfe}, |
wolfSSL | 13:f67a6c6013ca | 6557 | {0xa9, 0xc0}, {0xa8, 0x02}, {0xaa, 0x44}, {0xab, 0x86}, |
wolfSSL | 13:f67a6c6013ca | 6558 | {0xae, 0xc8}, {0xaf, 0x0a}, {0xad, 0x4c}, {0xac, 0x8e}, |
wolfSSL | 13:f67a6c6013ca | 6559 | {0xa7, 0xd0}, {0xa6, 0x12}, {0xa4, 0x54}, {0xa5, 0x96}, |
wolfSSL | 13:f67a6c6013ca | 6560 | {0xa0, 0xd8}, {0xa1, 0x1a}, {0xa3, 0x5c}, {0xa2, 0x9e}, |
wolfSSL | 13:f67a6c6013ca | 6561 | {0xb5, 0xe0}, {0xb4, 0x22}, {0xb6, 0x64}, {0xb7, 0xa6}, |
wolfSSL | 13:f67a6c6013ca | 6562 | {0xb2, 0xe8}, {0xb3, 0x2a}, {0xb1, 0x6c}, {0xb0, 0xae}, |
wolfSSL | 13:f67a6c6013ca | 6563 | {0xbb, 0xf0}, {0xba, 0x32}, {0xb8, 0x74}, {0xb9, 0xb6}, |
wolfSSL | 13:f67a6c6013ca | 6564 | {0xbc, 0xf8}, {0xbd, 0x3a}, {0xbf, 0x7c}, {0xbe, 0xbe} }; |
wolfSSL | 13:f67a6c6013ca | 6565 | |
wolfSSL | 13:f67a6c6013ca | 6566 | |
wolfSSL | 13:f67a6c6013ca | 6567 | static void GMULT(byte *x, byte m[256][AES_BLOCK_SIZE]) |
wolfSSL | 13:f67a6c6013ca | 6568 | { |
wolfSSL | 13:f67a6c6013ca | 6569 | int i, j; |
wolfSSL | 13:f67a6c6013ca | 6570 | byte Z[AES_BLOCK_SIZE]; |
wolfSSL | 13:f67a6c6013ca | 6571 | byte a; |
wolfSSL | 13:f67a6c6013ca | 6572 | |
wolfSSL | 13:f67a6c6013ca | 6573 | XMEMSET(Z, 0, sizeof(Z)); |
wolfSSL | 13:f67a6c6013ca | 6574 | |
wolfSSL | 13:f67a6c6013ca | 6575 | for (i = 15; i > 0; i--) { |
wolfSSL | 13:f67a6c6013ca | 6576 | xorbuf(Z, m[x[i]], AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6577 | a = Z[15]; |
wolfSSL | 13:f67a6c6013ca | 6578 | |
wolfSSL | 13:f67a6c6013ca | 6579 | for (j = 15; j > 0; j--) { |
wolfSSL | 13:f67a6c6013ca | 6580 | Z[j] = Z[j-1]; |
wolfSSL | 13:f67a6c6013ca | 6581 | } |
wolfSSL | 13:f67a6c6013ca | 6582 | |
wolfSSL | 13:f67a6c6013ca | 6583 | Z[0] = R[a][0]; |
wolfSSL | 13:f67a6c6013ca | 6584 | Z[1] ^= R[a][1]; |
wolfSSL | 13:f67a6c6013ca | 6585 | } |
wolfSSL | 13:f67a6c6013ca | 6586 | xorbuf(Z, m[x[0]], AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6587 | |
wolfSSL | 13:f67a6c6013ca | 6588 | XMEMCPY(x, Z, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6589 | } |
wolfSSL | 13:f67a6c6013ca | 6590 | |
wolfSSL | 13:f67a6c6013ca | 6591 | |
wolfSSL | 13:f67a6c6013ca | 6592 | void GHASH(Aes* aes, const byte* a, word32 aSz, const byte* c, |
wolfSSL | 13:f67a6c6013ca | 6593 | word32 cSz, byte* s, word32 sSz) |
wolfSSL | 13:f67a6c6013ca | 6594 | { |
wolfSSL | 13:f67a6c6013ca | 6595 | byte x[AES_BLOCK_SIZE]; |
wolfSSL | 13:f67a6c6013ca | 6596 | byte scratch[AES_BLOCK_SIZE]; |
wolfSSL | 13:f67a6c6013ca | 6597 | word32 blocks, partial; |
wolfSSL | 13:f67a6c6013ca | 6598 | |
wolfSSL | 13:f67a6c6013ca | 6599 | XMEMSET(x, 0, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6600 | |
wolfSSL | 13:f67a6c6013ca | 6601 | /* Hash in A, the Additional Authentication Data */ |
wolfSSL | 13:f67a6c6013ca | 6602 | if (aSz != 0 && a != NULL) { |
wolfSSL | 13:f67a6c6013ca | 6603 | blocks = aSz / AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 6604 | partial = aSz % AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 6605 | while (blocks--) { |
wolfSSL | 13:f67a6c6013ca | 6606 | xorbuf(x, a, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6607 | GMULT(x, aes->M0); |
wolfSSL | 13:f67a6c6013ca | 6608 | a += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 6609 | } |
wolfSSL | 13:f67a6c6013ca | 6610 | if (partial != 0) { |
wolfSSL | 13:f67a6c6013ca | 6611 | XMEMSET(scratch, 0, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6612 | XMEMCPY(scratch, a, partial); |
wolfSSL | 13:f67a6c6013ca | 6613 | xorbuf(x, scratch, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6614 | GMULT(x, aes->M0); |
wolfSSL | 13:f67a6c6013ca | 6615 | } |
wolfSSL | 13:f67a6c6013ca | 6616 | } |
wolfSSL | 13:f67a6c6013ca | 6617 | |
wolfSSL | 13:f67a6c6013ca | 6618 | /* Hash in C, the Ciphertext */ |
wolfSSL | 13:f67a6c6013ca | 6619 | if (cSz != 0 && c != NULL) { |
wolfSSL | 13:f67a6c6013ca | 6620 | blocks = cSz / AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 6621 | partial = cSz % AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 6622 | while (blocks--) { |
wolfSSL | 13:f67a6c6013ca | 6623 | xorbuf(x, c, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6624 | GMULT(x, aes->M0); |
wolfSSL | 13:f67a6c6013ca | 6625 | c += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 6626 | } |
wolfSSL | 13:f67a6c6013ca | 6627 | if (partial != 0) { |
wolfSSL | 13:f67a6c6013ca | 6628 | XMEMSET(scratch, 0, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6629 | XMEMCPY(scratch, c, partial); |
wolfSSL | 13:f67a6c6013ca | 6630 | xorbuf(x, scratch, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6631 | GMULT(x, aes->M0); |
wolfSSL | 13:f67a6c6013ca | 6632 | } |
wolfSSL | 13:f67a6c6013ca | 6633 | } |
wolfSSL | 13:f67a6c6013ca | 6634 | |
wolfSSL | 13:f67a6c6013ca | 6635 | /* Hash in the lengths of A and C in bits */ |
wolfSSL | 13:f67a6c6013ca | 6636 | FlattenSzInBits(&scratch[0], aSz); |
wolfSSL | 13:f67a6c6013ca | 6637 | FlattenSzInBits(&scratch[8], cSz); |
wolfSSL | 13:f67a6c6013ca | 6638 | xorbuf(x, scratch, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6639 | GMULT(x, aes->M0); |
wolfSSL | 13:f67a6c6013ca | 6640 | |
wolfSSL | 13:f67a6c6013ca | 6641 | /* Copy the result into s. */ |
wolfSSL | 13:f67a6c6013ca | 6642 | XMEMCPY(s, x, sSz); |
wolfSSL | 13:f67a6c6013ca | 6643 | } |
wolfSSL | 13:f67a6c6013ca | 6644 | |
wolfSSL | 13:f67a6c6013ca | 6645 | /* end GCM_TABLE */ |
wolfSSL | 13:f67a6c6013ca | 6646 | #elif defined(WORD64_AVAILABLE) && !defined(GCM_WORD32) |
wolfSSL | 13:f67a6c6013ca | 6647 | |
wolfSSL | 13:f67a6c6013ca | 6648 | #if !defined(FREESCALE_LTC_AES_GCM) |
wolfSSL | 13:f67a6c6013ca | 6649 | static void GMULT(word64* X, word64* Y) |
wolfSSL | 13:f67a6c6013ca | 6650 | { |
wolfSSL | 13:f67a6c6013ca | 6651 | word64 Z[2] = {0,0}; |
wolfSSL | 13:f67a6c6013ca | 6652 | word64 V[2]; |
wolfSSL | 13:f67a6c6013ca | 6653 | int i, j; |
wolfSSL | 13:f67a6c6013ca | 6654 | V[0] = X[0]; V[1] = X[1]; |
wolfSSL | 13:f67a6c6013ca | 6655 | |
wolfSSL | 13:f67a6c6013ca | 6656 | for (i = 0; i < 2; i++) |
wolfSSL | 13:f67a6c6013ca | 6657 | { |
wolfSSL | 13:f67a6c6013ca | 6658 | word64 y = Y[i]; |
wolfSSL | 13:f67a6c6013ca | 6659 | for (j = 0; j < 64; j++) |
wolfSSL | 13:f67a6c6013ca | 6660 | { |
wolfSSL | 13:f67a6c6013ca | 6661 | if (y & 0x8000000000000000ULL) { |
wolfSSL | 13:f67a6c6013ca | 6662 | Z[0] ^= V[0]; |
wolfSSL | 13:f67a6c6013ca | 6663 | Z[1] ^= V[1]; |
wolfSSL | 13:f67a6c6013ca | 6664 | } |
wolfSSL | 13:f67a6c6013ca | 6665 | |
wolfSSL | 13:f67a6c6013ca | 6666 | if (V[1] & 0x0000000000000001) { |
wolfSSL | 13:f67a6c6013ca | 6667 | V[1] >>= 1; |
wolfSSL | 13:f67a6c6013ca | 6668 | V[1] |= ((V[0] & 0x0000000000000001) ? |
wolfSSL | 13:f67a6c6013ca | 6669 | 0x8000000000000000ULL : 0); |
wolfSSL | 13:f67a6c6013ca | 6670 | V[0] >>= 1; |
wolfSSL | 13:f67a6c6013ca | 6671 | V[0] ^= 0xE100000000000000ULL; |
wolfSSL | 13:f67a6c6013ca | 6672 | } |
wolfSSL | 13:f67a6c6013ca | 6673 | else { |
wolfSSL | 13:f67a6c6013ca | 6674 | V[1] >>= 1; |
wolfSSL | 13:f67a6c6013ca | 6675 | V[1] |= ((V[0] & 0x0000000000000001) ? |
wolfSSL | 13:f67a6c6013ca | 6676 | 0x8000000000000000ULL : 0); |
wolfSSL | 13:f67a6c6013ca | 6677 | V[0] >>= 1; |
wolfSSL | 13:f67a6c6013ca | 6678 | } |
wolfSSL | 13:f67a6c6013ca | 6679 | y <<= 1; |
wolfSSL | 13:f67a6c6013ca | 6680 | } |
wolfSSL | 13:f67a6c6013ca | 6681 | } |
wolfSSL | 13:f67a6c6013ca | 6682 | X[0] = Z[0]; |
wolfSSL | 13:f67a6c6013ca | 6683 | X[1] = Z[1]; |
wolfSSL | 13:f67a6c6013ca | 6684 | } |
wolfSSL | 13:f67a6c6013ca | 6685 | |
wolfSSL | 13:f67a6c6013ca | 6686 | |
wolfSSL | 13:f67a6c6013ca | 6687 | void GHASH(Aes* aes, const byte* a, word32 aSz, const byte* c, |
wolfSSL | 13:f67a6c6013ca | 6688 | word32 cSz, byte* s, word32 sSz) |
wolfSSL | 13:f67a6c6013ca | 6689 | { |
wolfSSL | 13:f67a6c6013ca | 6690 | word64 x[2] = {0,0}; |
wolfSSL | 13:f67a6c6013ca | 6691 | word32 blocks, partial; |
wolfSSL | 13:f67a6c6013ca | 6692 | word64 bigH[2]; |
wolfSSL | 13:f67a6c6013ca | 6693 | |
wolfSSL | 13:f67a6c6013ca | 6694 | XMEMCPY(bigH, aes->H, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6695 | #ifdef LITTLE_ENDIAN_ORDER |
wolfSSL | 13:f67a6c6013ca | 6696 | ByteReverseWords64(bigH, bigH, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6697 | #endif |
wolfSSL | 13:f67a6c6013ca | 6698 | |
wolfSSL | 13:f67a6c6013ca | 6699 | /* Hash in A, the Additional Authentication Data */ |
wolfSSL | 13:f67a6c6013ca | 6700 | if (aSz != 0 && a != NULL) { |
wolfSSL | 13:f67a6c6013ca | 6701 | word64 bigA[2]; |
wolfSSL | 13:f67a6c6013ca | 6702 | blocks = aSz / AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 6703 | partial = aSz % AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 6704 | while (blocks--) { |
wolfSSL | 13:f67a6c6013ca | 6705 | XMEMCPY(bigA, a, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6706 | #ifdef LITTLE_ENDIAN_ORDER |
wolfSSL | 13:f67a6c6013ca | 6707 | ByteReverseWords64(bigA, bigA, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6708 | #endif |
wolfSSL | 13:f67a6c6013ca | 6709 | x[0] ^= bigA[0]; |
wolfSSL | 13:f67a6c6013ca | 6710 | x[1] ^= bigA[1]; |
wolfSSL | 13:f67a6c6013ca | 6711 | GMULT(x, bigH); |
wolfSSL | 13:f67a6c6013ca | 6712 | a += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 6713 | } |
wolfSSL | 13:f67a6c6013ca | 6714 | if (partial != 0) { |
wolfSSL | 13:f67a6c6013ca | 6715 | XMEMSET(bigA, 0, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6716 | XMEMCPY(bigA, a, partial); |
wolfSSL | 13:f67a6c6013ca | 6717 | #ifdef LITTLE_ENDIAN_ORDER |
wolfSSL | 13:f67a6c6013ca | 6718 | ByteReverseWords64(bigA, bigA, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6719 | #endif |
wolfSSL | 13:f67a6c6013ca | 6720 | x[0] ^= bigA[0]; |
wolfSSL | 13:f67a6c6013ca | 6721 | x[1] ^= bigA[1]; |
wolfSSL | 13:f67a6c6013ca | 6722 | GMULT(x, bigH); |
wolfSSL | 13:f67a6c6013ca | 6723 | } |
wolfSSL | 13:f67a6c6013ca | 6724 | } |
wolfSSL | 13:f67a6c6013ca | 6725 | |
wolfSSL | 13:f67a6c6013ca | 6726 | /* Hash in C, the Ciphertext */ |
wolfSSL | 13:f67a6c6013ca | 6727 | if (cSz != 0 && c != NULL) { |
wolfSSL | 13:f67a6c6013ca | 6728 | word64 bigC[2]; |
wolfSSL | 13:f67a6c6013ca | 6729 | blocks = cSz / AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 6730 | partial = cSz % AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 6731 | while (blocks--) { |
wolfSSL | 13:f67a6c6013ca | 6732 | XMEMCPY(bigC, c, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6733 | #ifdef LITTLE_ENDIAN_ORDER |
wolfSSL | 13:f67a6c6013ca | 6734 | ByteReverseWords64(bigC, bigC, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6735 | #endif |
wolfSSL | 13:f67a6c6013ca | 6736 | x[0] ^= bigC[0]; |
wolfSSL | 13:f67a6c6013ca | 6737 | x[1] ^= bigC[1]; |
wolfSSL | 13:f67a6c6013ca | 6738 | GMULT(x, bigH); |
wolfSSL | 13:f67a6c6013ca | 6739 | c += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 6740 | } |
wolfSSL | 13:f67a6c6013ca | 6741 | if (partial != 0) { |
wolfSSL | 13:f67a6c6013ca | 6742 | XMEMSET(bigC, 0, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6743 | XMEMCPY(bigC, c, partial); |
wolfSSL | 13:f67a6c6013ca | 6744 | #ifdef LITTLE_ENDIAN_ORDER |
wolfSSL | 13:f67a6c6013ca | 6745 | ByteReverseWords64(bigC, bigC, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6746 | #endif |
wolfSSL | 13:f67a6c6013ca | 6747 | x[0] ^= bigC[0]; |
wolfSSL | 13:f67a6c6013ca | 6748 | x[1] ^= bigC[1]; |
wolfSSL | 13:f67a6c6013ca | 6749 | GMULT(x, bigH); |
wolfSSL | 13:f67a6c6013ca | 6750 | } |
wolfSSL | 13:f67a6c6013ca | 6751 | } |
wolfSSL | 13:f67a6c6013ca | 6752 | |
wolfSSL | 13:f67a6c6013ca | 6753 | /* Hash in the lengths in bits of A and C */ |
wolfSSL | 13:f67a6c6013ca | 6754 | { |
wolfSSL | 13:f67a6c6013ca | 6755 | word64 len[2]; |
wolfSSL | 13:f67a6c6013ca | 6756 | len[0] = aSz; len[1] = cSz; |
wolfSSL | 13:f67a6c6013ca | 6757 | |
wolfSSL | 13:f67a6c6013ca | 6758 | /* Lengths are in bytes. Convert to bits. */ |
wolfSSL | 13:f67a6c6013ca | 6759 | len[0] *= 8; |
wolfSSL | 13:f67a6c6013ca | 6760 | len[1] *= 8; |
wolfSSL | 13:f67a6c6013ca | 6761 | |
wolfSSL | 13:f67a6c6013ca | 6762 | x[0] ^= len[0]; |
wolfSSL | 13:f67a6c6013ca | 6763 | x[1] ^= len[1]; |
wolfSSL | 13:f67a6c6013ca | 6764 | GMULT(x, bigH); |
wolfSSL | 13:f67a6c6013ca | 6765 | } |
wolfSSL | 13:f67a6c6013ca | 6766 | #ifdef LITTLE_ENDIAN_ORDER |
wolfSSL | 13:f67a6c6013ca | 6767 | ByteReverseWords64(x, x, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6768 | #endif |
wolfSSL | 13:f67a6c6013ca | 6769 | XMEMCPY(s, x, sSz); |
wolfSSL | 13:f67a6c6013ca | 6770 | } |
wolfSSL | 13:f67a6c6013ca | 6771 | #endif /* !FREESCALE_LTC_AES_GCM */ |
wolfSSL | 13:f67a6c6013ca | 6772 | |
wolfSSL | 13:f67a6c6013ca | 6773 | /* end defined(WORD64_AVAILABLE) && !defined(GCM_WORD32) */ |
wolfSSL | 13:f67a6c6013ca | 6774 | #else /* GCM_WORD32 */ |
wolfSSL | 13:f67a6c6013ca | 6775 | |
wolfSSL | 13:f67a6c6013ca | 6776 | static void GMULT(word32* X, word32* Y) |
wolfSSL | 13:f67a6c6013ca | 6777 | { |
wolfSSL | 13:f67a6c6013ca | 6778 | word32 Z[4] = {0,0,0,0}; |
wolfSSL | 13:f67a6c6013ca | 6779 | word32 V[4]; |
wolfSSL | 13:f67a6c6013ca | 6780 | int i, j; |
wolfSSL | 13:f67a6c6013ca | 6781 | |
wolfSSL | 13:f67a6c6013ca | 6782 | V[0] = X[0]; V[1] = X[1]; V[2] = X[2]; V[3] = X[3]; |
wolfSSL | 13:f67a6c6013ca | 6783 | |
wolfSSL | 13:f67a6c6013ca | 6784 | for (i = 0; i < 4; i++) |
wolfSSL | 13:f67a6c6013ca | 6785 | { |
wolfSSL | 13:f67a6c6013ca | 6786 | word32 y = Y[i]; |
wolfSSL | 13:f67a6c6013ca | 6787 | for (j = 0; j < 32; j++) |
wolfSSL | 13:f67a6c6013ca | 6788 | { |
wolfSSL | 13:f67a6c6013ca | 6789 | if (y & 0x80000000) { |
wolfSSL | 13:f67a6c6013ca | 6790 | Z[0] ^= V[0]; |
wolfSSL | 13:f67a6c6013ca | 6791 | Z[1] ^= V[1]; |
wolfSSL | 13:f67a6c6013ca | 6792 | Z[2] ^= V[2]; |
wolfSSL | 13:f67a6c6013ca | 6793 | Z[3] ^= V[3]; |
wolfSSL | 13:f67a6c6013ca | 6794 | } |
wolfSSL | 13:f67a6c6013ca | 6795 | |
wolfSSL | 13:f67a6c6013ca | 6796 | if (V[3] & 0x00000001) { |
wolfSSL | 13:f67a6c6013ca | 6797 | V[3] >>= 1; |
wolfSSL | 13:f67a6c6013ca | 6798 | V[3] |= ((V[2] & 0x00000001) ? 0x80000000 : 0); |
wolfSSL | 13:f67a6c6013ca | 6799 | V[2] >>= 1; |
wolfSSL | 13:f67a6c6013ca | 6800 | V[2] |= ((V[1] & 0x00000001) ? 0x80000000 : 0); |
wolfSSL | 13:f67a6c6013ca | 6801 | V[1] >>= 1; |
wolfSSL | 13:f67a6c6013ca | 6802 | V[1] |= ((V[0] & 0x00000001) ? 0x80000000 : 0); |
wolfSSL | 13:f67a6c6013ca | 6803 | V[0] >>= 1; |
wolfSSL | 13:f67a6c6013ca | 6804 | V[0] ^= 0xE1000000; |
wolfSSL | 13:f67a6c6013ca | 6805 | } else { |
wolfSSL | 13:f67a6c6013ca | 6806 | V[3] >>= 1; |
wolfSSL | 13:f67a6c6013ca | 6807 | V[3] |= ((V[2] & 0x00000001) ? 0x80000000 : 0); |
wolfSSL | 13:f67a6c6013ca | 6808 | V[2] >>= 1; |
wolfSSL | 13:f67a6c6013ca | 6809 | V[2] |= ((V[1] & 0x00000001) ? 0x80000000 : 0); |
wolfSSL | 13:f67a6c6013ca | 6810 | V[1] >>= 1; |
wolfSSL | 13:f67a6c6013ca | 6811 | V[1] |= ((V[0] & 0x00000001) ? 0x80000000 : 0); |
wolfSSL | 13:f67a6c6013ca | 6812 | V[0] >>= 1; |
wolfSSL | 13:f67a6c6013ca | 6813 | } |
wolfSSL | 13:f67a6c6013ca | 6814 | y <<= 1; |
wolfSSL | 13:f67a6c6013ca | 6815 | } |
wolfSSL | 13:f67a6c6013ca | 6816 | } |
wolfSSL | 13:f67a6c6013ca | 6817 | X[0] = Z[0]; |
wolfSSL | 13:f67a6c6013ca | 6818 | X[1] = Z[1]; |
wolfSSL | 13:f67a6c6013ca | 6819 | X[2] = Z[2]; |
wolfSSL | 13:f67a6c6013ca | 6820 | X[3] = Z[3]; |
wolfSSL | 13:f67a6c6013ca | 6821 | } |
wolfSSL | 13:f67a6c6013ca | 6822 | |
wolfSSL | 13:f67a6c6013ca | 6823 | |
wolfSSL | 13:f67a6c6013ca | 6824 | void GHASH(Aes* aes, const byte* a, word32 aSz, const byte* c, |
wolfSSL | 13:f67a6c6013ca | 6825 | word32 cSz, byte* s, word32 sSz) |
wolfSSL | 13:f67a6c6013ca | 6826 | { |
wolfSSL | 13:f67a6c6013ca | 6827 | word32 x[4] = {0,0,0,0}; |
wolfSSL | 13:f67a6c6013ca | 6828 | word32 blocks, partial; |
wolfSSL | 13:f67a6c6013ca | 6829 | word32 bigH[4]; |
wolfSSL | 13:f67a6c6013ca | 6830 | |
wolfSSL | 13:f67a6c6013ca | 6831 | XMEMCPY(bigH, aes->H, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6832 | #ifdef LITTLE_ENDIAN_ORDER |
wolfSSL | 13:f67a6c6013ca | 6833 | ByteReverseWords(bigH, bigH, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6834 | #endif |
wolfSSL | 13:f67a6c6013ca | 6835 | |
wolfSSL | 13:f67a6c6013ca | 6836 | /* Hash in A, the Additional Authentication Data */ |
wolfSSL | 13:f67a6c6013ca | 6837 | if (aSz != 0 && a != NULL) { |
wolfSSL | 13:f67a6c6013ca | 6838 | word32 bigA[4]; |
wolfSSL | 13:f67a6c6013ca | 6839 | blocks = aSz / AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 6840 | partial = aSz % AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 6841 | while (blocks--) { |
wolfSSL | 13:f67a6c6013ca | 6842 | XMEMCPY(bigA, a, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6843 | #ifdef LITTLE_ENDIAN_ORDER |
wolfSSL | 13:f67a6c6013ca | 6844 | ByteReverseWords(bigA, bigA, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6845 | #endif |
wolfSSL | 13:f67a6c6013ca | 6846 | x[0] ^= bigA[0]; |
wolfSSL | 13:f67a6c6013ca | 6847 | x[1] ^= bigA[1]; |
wolfSSL | 13:f67a6c6013ca | 6848 | x[2] ^= bigA[2]; |
wolfSSL | 13:f67a6c6013ca | 6849 | x[3] ^= bigA[3]; |
wolfSSL | 13:f67a6c6013ca | 6850 | GMULT(x, bigH); |
wolfSSL | 13:f67a6c6013ca | 6851 | a += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 6852 | } |
wolfSSL | 13:f67a6c6013ca | 6853 | if (partial != 0) { |
wolfSSL | 13:f67a6c6013ca | 6854 | XMEMSET(bigA, 0, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6855 | XMEMCPY(bigA, a, partial); |
wolfSSL | 13:f67a6c6013ca | 6856 | #ifdef LITTLE_ENDIAN_ORDER |
wolfSSL | 13:f67a6c6013ca | 6857 | ByteReverseWords(bigA, bigA, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6858 | #endif |
wolfSSL | 13:f67a6c6013ca | 6859 | x[0] ^= bigA[0]; |
wolfSSL | 13:f67a6c6013ca | 6860 | x[1] ^= bigA[1]; |
wolfSSL | 13:f67a6c6013ca | 6861 | x[2] ^= bigA[2]; |
wolfSSL | 13:f67a6c6013ca | 6862 | x[3] ^= bigA[3]; |
wolfSSL | 13:f67a6c6013ca | 6863 | GMULT(x, bigH); |
wolfSSL | 13:f67a6c6013ca | 6864 | } |
wolfSSL | 13:f67a6c6013ca | 6865 | } |
wolfSSL | 13:f67a6c6013ca | 6866 | |
wolfSSL | 13:f67a6c6013ca | 6867 | /* Hash in C, the Ciphertext */ |
wolfSSL | 13:f67a6c6013ca | 6868 | if (cSz != 0 && c != NULL) { |
wolfSSL | 13:f67a6c6013ca | 6869 | word32 bigC[4]; |
wolfSSL | 13:f67a6c6013ca | 6870 | blocks = cSz / AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 6871 | partial = cSz % AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 6872 | while (blocks--) { |
wolfSSL | 13:f67a6c6013ca | 6873 | XMEMCPY(bigC, c, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6874 | #ifdef LITTLE_ENDIAN_ORDER |
wolfSSL | 13:f67a6c6013ca | 6875 | ByteReverseWords(bigC, bigC, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6876 | #endif |
wolfSSL | 13:f67a6c6013ca | 6877 | x[0] ^= bigC[0]; |
wolfSSL | 13:f67a6c6013ca | 6878 | x[1] ^= bigC[1]; |
wolfSSL | 13:f67a6c6013ca | 6879 | x[2] ^= bigC[2]; |
wolfSSL | 13:f67a6c6013ca | 6880 | x[3] ^= bigC[3]; |
wolfSSL | 13:f67a6c6013ca | 6881 | GMULT(x, bigH); |
wolfSSL | 13:f67a6c6013ca | 6882 | c += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 6883 | } |
wolfSSL | 13:f67a6c6013ca | 6884 | if (partial != 0) { |
wolfSSL | 13:f67a6c6013ca | 6885 | XMEMSET(bigC, 0, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6886 | XMEMCPY(bigC, c, partial); |
wolfSSL | 13:f67a6c6013ca | 6887 | #ifdef LITTLE_ENDIAN_ORDER |
wolfSSL | 13:f67a6c6013ca | 6888 | ByteReverseWords(bigC, bigC, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6889 | #endif |
wolfSSL | 13:f67a6c6013ca | 6890 | x[0] ^= bigC[0]; |
wolfSSL | 13:f67a6c6013ca | 6891 | x[1] ^= bigC[1]; |
wolfSSL | 13:f67a6c6013ca | 6892 | x[2] ^= bigC[2]; |
wolfSSL | 13:f67a6c6013ca | 6893 | x[3] ^= bigC[3]; |
wolfSSL | 13:f67a6c6013ca | 6894 | GMULT(x, bigH); |
wolfSSL | 13:f67a6c6013ca | 6895 | } |
wolfSSL | 13:f67a6c6013ca | 6896 | } |
wolfSSL | 13:f67a6c6013ca | 6897 | |
wolfSSL | 13:f67a6c6013ca | 6898 | /* Hash in the lengths in bits of A and C */ |
wolfSSL | 13:f67a6c6013ca | 6899 | { |
wolfSSL | 13:f67a6c6013ca | 6900 | word32 len[4]; |
wolfSSL | 13:f67a6c6013ca | 6901 | |
wolfSSL | 13:f67a6c6013ca | 6902 | /* Lengths are in bytes. Convert to bits. */ |
wolfSSL | 13:f67a6c6013ca | 6903 | len[0] = (aSz >> (8*sizeof(aSz) - 3)); |
wolfSSL | 13:f67a6c6013ca | 6904 | len[1] = aSz << 3; |
wolfSSL | 13:f67a6c6013ca | 6905 | len[2] = (cSz >> (8*sizeof(cSz) - 3)); |
wolfSSL | 13:f67a6c6013ca | 6906 | len[3] = cSz << 3; |
wolfSSL | 13:f67a6c6013ca | 6907 | |
wolfSSL | 13:f67a6c6013ca | 6908 | x[0] ^= len[0]; |
wolfSSL | 13:f67a6c6013ca | 6909 | x[1] ^= len[1]; |
wolfSSL | 13:f67a6c6013ca | 6910 | x[2] ^= len[2]; |
wolfSSL | 13:f67a6c6013ca | 6911 | x[3] ^= len[3]; |
wolfSSL | 13:f67a6c6013ca | 6912 | GMULT(x, bigH); |
wolfSSL | 13:f67a6c6013ca | 6913 | } |
wolfSSL | 13:f67a6c6013ca | 6914 | #ifdef LITTLE_ENDIAN_ORDER |
wolfSSL | 13:f67a6c6013ca | 6915 | ByteReverseWords(x, x, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6916 | #endif |
wolfSSL | 13:f67a6c6013ca | 6917 | XMEMCPY(s, x, sSz); |
wolfSSL | 13:f67a6c6013ca | 6918 | } |
wolfSSL | 13:f67a6c6013ca | 6919 | |
wolfSSL | 13:f67a6c6013ca | 6920 | #endif /* end GCM_WORD32 */ |
wolfSSL | 13:f67a6c6013ca | 6921 | |
wolfSSL | 13:f67a6c6013ca | 6922 | |
wolfSSL | 13:f67a6c6013ca | 6923 | #if !defined(WOLFSSL_XILINX_CRYPT) |
wolfSSL | 13:f67a6c6013ca | 6924 | int wc_AesGcmEncrypt(Aes* aes, byte* out, const byte* in, word32 sz, |
wolfSSL | 13:f67a6c6013ca | 6925 | const byte* iv, word32 ivSz, |
wolfSSL | 13:f67a6c6013ca | 6926 | byte* authTag, word32 authTagSz, |
wolfSSL | 13:f67a6c6013ca | 6927 | const byte* authIn, word32 authInSz) |
wolfSSL | 13:f67a6c6013ca | 6928 | { |
wolfSSL | 13:f67a6c6013ca | 6929 | int ret = 0; |
wolfSSL | 13:f67a6c6013ca | 6930 | word32 keySize; |
wolfSSL | 13:f67a6c6013ca | 6931 | #ifdef FREESCALE_LTC_AES_GCM |
wolfSSL | 13:f67a6c6013ca | 6932 | status_t status; |
wolfSSL | 13:f67a6c6013ca | 6933 | #else |
wolfSSL | 13:f67a6c6013ca | 6934 | word32 blocks = sz / AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 6935 | word32 partial = sz % AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 6936 | const byte* p = in; |
wolfSSL | 13:f67a6c6013ca | 6937 | byte* c = out; |
wolfSSL | 13:f67a6c6013ca | 6938 | byte counter[AES_BLOCK_SIZE]; |
wolfSSL | 13:f67a6c6013ca | 6939 | byte initialCounter[AES_BLOCK_SIZE]; |
wolfSSL | 13:f67a6c6013ca | 6940 | byte *ctr; |
wolfSSL | 13:f67a6c6013ca | 6941 | byte scratch[AES_BLOCK_SIZE]; |
wolfSSL | 13:f67a6c6013ca | 6942 | #if defined(STM32F2_CRYPTO) || defined(STM32F4_CRYPTO) |
wolfSSL | 13:f67a6c6013ca | 6943 | #ifdef WOLFSSL_STM32_CUBEMX |
wolfSSL | 13:f67a6c6013ca | 6944 | CRYP_HandleTypeDef hcryp; |
wolfSSL | 13:f67a6c6013ca | 6945 | #else |
wolfSSL | 13:f67a6c6013ca | 6946 | byte keyCopy[AES_BLOCK_SIZE * 2]; |
wolfSSL | 13:f67a6c6013ca | 6947 | #endif /* WOLFSSL_STM32_CUBEMX */ |
wolfSSL | 13:f67a6c6013ca | 6948 | int status = 0; |
wolfSSL | 13:f67a6c6013ca | 6949 | byte* authInPadded = NULL; |
wolfSSL | 13:f67a6c6013ca | 6950 | byte tag[AES_BLOCK_SIZE]; |
wolfSSL | 13:f67a6c6013ca | 6951 | int authPadSz; |
wolfSSL | 13:f67a6c6013ca | 6952 | #endif /* STM32F2_CRYPTO || STM32F4_CRYPTO */ |
wolfSSL | 13:f67a6c6013ca | 6953 | #endif /* FREESCALE_LTC_AES_GCM */ |
wolfSSL | 13:f67a6c6013ca | 6954 | |
wolfSSL | 13:f67a6c6013ca | 6955 | /* argument checks */ |
wolfSSL | 13:f67a6c6013ca | 6956 | if (aes == NULL || authTagSz > AES_BLOCK_SIZE) { |
wolfSSL | 13:f67a6c6013ca | 6957 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 6958 | } |
wolfSSL | 13:f67a6c6013ca | 6959 | |
wolfSSL | 13:f67a6c6013ca | 6960 | if (authTagSz < WOLFSSL_MIN_AUTH_TAG_SZ) { |
wolfSSL | 13:f67a6c6013ca | 6961 | WOLFSSL_MSG("GcmEncrypt authTagSz too small error"); |
wolfSSL | 13:f67a6c6013ca | 6962 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 6963 | } |
wolfSSL | 13:f67a6c6013ca | 6964 | |
wolfSSL | 13:f67a6c6013ca | 6965 | ret = wc_AesGetKeySize(aes, &keySize); |
wolfSSL | 13:f67a6c6013ca | 6966 | if (ret != 0) |
wolfSSL | 13:f67a6c6013ca | 6967 | return ret; |
wolfSSL | 13:f67a6c6013ca | 6968 | |
wolfSSL | 13:f67a6c6013ca | 6969 | #ifdef FREESCALE_LTC_AES_GCM |
wolfSSL | 13:f67a6c6013ca | 6970 | |
wolfSSL | 13:f67a6c6013ca | 6971 | status = LTC_AES_EncryptTagGcm(LTC_BASE, in, out, sz, iv, ivSz, |
wolfSSL | 13:f67a6c6013ca | 6972 | authIn, authInSz, (byte*)aes->key, keySize, authTag, authTagSz); |
wolfSSL | 13:f67a6c6013ca | 6973 | |
wolfSSL | 13:f67a6c6013ca | 6974 | ret = (status == kStatus_Success) ? 0 : AES_GCM_AUTH_E; |
wolfSSL | 13:f67a6c6013ca | 6975 | |
wolfSSL | 13:f67a6c6013ca | 6976 | #else |
wolfSSL | 13:f67a6c6013ca | 6977 | |
wolfSSL | 13:f67a6c6013ca | 6978 | #if defined(STM32F2_CRYPTO) || defined(STM32F4_CRYPTO) |
wolfSSL | 13:f67a6c6013ca | 6979 | |
wolfSSL | 13:f67a6c6013ca | 6980 | /* additional argument checks - STM32 HW only supports 12 byte IV */ |
wolfSSL | 13:f67a6c6013ca | 6981 | if (ivSz != NONCE_SZ) { |
wolfSSL | 13:f67a6c6013ca | 6982 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 6983 | } |
wolfSSL | 13:f67a6c6013ca | 6984 | |
wolfSSL | 13:f67a6c6013ca | 6985 | XMEMSET(initialCounter, 0, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 6986 | XMEMCPY(initialCounter, iv, ivSz); |
wolfSSL | 13:f67a6c6013ca | 6987 | initialCounter[AES_BLOCK_SIZE - 1] = STM32_GCM_IV_START; |
wolfSSL | 13:f67a6c6013ca | 6988 | |
wolfSSL | 13:f67a6c6013ca | 6989 | /* STM32 HW AES-GCM requires / assumes inputs are a multiple of block size. |
wolfSSL | 13:f67a6c6013ca | 6990 | * We can avoid this by zero padding (authIn) AAD, but zero-padded plaintext |
wolfSSL | 13:f67a6c6013ca | 6991 | * will be encrypted and output incorrectly, causing a bad authTag. |
wolfSSL | 13:f67a6c6013ca | 6992 | * We will use HW accelerated AES-GCM if plain%AES_BLOCK_SZ==0. |
wolfSSL | 13:f67a6c6013ca | 6993 | * Otherwise, we will use accelerated AES_CTR for encrypt, and then |
wolfSSL | 13:f67a6c6013ca | 6994 | * perform GHASH in software. |
wolfSSL | 13:f67a6c6013ca | 6995 | * See NIST SP 800-38D */ |
wolfSSL | 13:f67a6c6013ca | 6996 | |
wolfSSL | 13:f67a6c6013ca | 6997 | /* Plain text is a multiple of block size, so use HW-Accelerated AES_GCM */ |
wolfSSL | 13:f67a6c6013ca | 6998 | if (!partial) { |
wolfSSL | 13:f67a6c6013ca | 6999 | /* pad authIn if it is not a block multiple */ |
wolfSSL | 13:f67a6c6013ca | 7000 | if ((authInSz % AES_BLOCK_SIZE) != 0) { |
wolfSSL | 13:f67a6c6013ca | 7001 | authPadSz = ((authInSz / AES_BLOCK_SIZE) + 1) * AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 7002 | /* Need to pad the AAD to a full block with zeros. */ |
wolfSSL | 13:f67a6c6013ca | 7003 | authInPadded = XMALLOC(authPadSz, aes->heap, DYNAMIC_TYPE_TMP_BUFFER); |
wolfSSL | 13:f67a6c6013ca | 7004 | if (authInPadded == NULL) { |
wolfSSL | 13:f67a6c6013ca | 7005 | return MEMORY_E; |
wolfSSL | 13:f67a6c6013ca | 7006 | } |
wolfSSL | 13:f67a6c6013ca | 7007 | XMEMSET(authInPadded, 0, authPadSz); |
wolfSSL | 13:f67a6c6013ca | 7008 | XMEMCPY(authInPadded, authIn, authInSz); |
wolfSSL | 13:f67a6c6013ca | 7009 | } else { |
wolfSSL | 13:f67a6c6013ca | 7010 | authPadSz = authInSz; |
wolfSSL | 13:f67a6c6013ca | 7011 | authInPadded = (byte*)authIn; |
wolfSSL | 13:f67a6c6013ca | 7012 | } |
wolfSSL | 13:f67a6c6013ca | 7013 | |
wolfSSL | 13:f67a6c6013ca | 7014 | |
wolfSSL | 13:f67a6c6013ca | 7015 | #ifdef WOLFSSL_STM32_CUBEMX |
wolfSSL | 13:f67a6c6013ca | 7016 | XMEMSET(&hcryp, 0, sizeof(CRYP_HandleTypeDef)); |
wolfSSL | 13:f67a6c6013ca | 7017 | switch (keySize) { |
wolfSSL | 13:f67a6c6013ca | 7018 | case 16: /* 128-bit key */ |
wolfSSL | 13:f67a6c6013ca | 7019 | hcryp.Init.KeySize = CRYP_KEYSIZE_128B; |
wolfSSL | 13:f67a6c6013ca | 7020 | break; |
wolfSSL | 13:f67a6c6013ca | 7021 | case 24: /* 192-bit key */ |
wolfSSL | 13:f67a6c6013ca | 7022 | hcryp.Init.KeySize = CRYP_KEYSIZE_192B; |
wolfSSL | 13:f67a6c6013ca | 7023 | break; |
wolfSSL | 13:f67a6c6013ca | 7024 | case 32: /* 256-bit key */ |
wolfSSL | 13:f67a6c6013ca | 7025 | hcryp.Init.KeySize = CRYP_KEYSIZE_256B; |
wolfSSL | 13:f67a6c6013ca | 7026 | break; |
wolfSSL | 13:f67a6c6013ca | 7027 | default: |
wolfSSL | 13:f67a6c6013ca | 7028 | break; |
wolfSSL | 13:f67a6c6013ca | 7029 | } |
wolfSSL | 13:f67a6c6013ca | 7030 | hcryp.Instance = CRYP; |
wolfSSL | 13:f67a6c6013ca | 7031 | hcryp.Init.DataType = CRYP_DATATYPE_8B; |
wolfSSL | 13:f67a6c6013ca | 7032 | hcryp.Init.pKey = (byte*)aes->key; |
wolfSSL | 13:f67a6c6013ca | 7033 | hcryp.Init.pInitVect = initialCounter; |
wolfSSL | 13:f67a6c6013ca | 7034 | hcryp.Init.Header = authInPadded; |
wolfSSL | 13:f67a6c6013ca | 7035 | hcryp.Init.HeaderSize = authInSz; |
wolfSSL | 13:f67a6c6013ca | 7036 | |
wolfSSL | 13:f67a6c6013ca | 7037 | HAL_CRYP_Init(&hcryp); |
wolfSSL | 13:f67a6c6013ca | 7038 | status = HAL_CRYPEx_AESGCM_Encrypt(&hcryp, (byte*)in, sz, |
wolfSSL | 13:f67a6c6013ca | 7039 | out, STM32_HAL_TIMEOUT); |
wolfSSL | 13:f67a6c6013ca | 7040 | /* Compute the authTag */ |
wolfSSL | 13:f67a6c6013ca | 7041 | if (status == HAL_OK) |
wolfSSL | 13:f67a6c6013ca | 7042 | status = HAL_CRYPEx_AESGCM_Finish(&hcryp, sz, tag, STM32_HAL_TIMEOUT); |
wolfSSL | 13:f67a6c6013ca | 7043 | |
wolfSSL | 13:f67a6c6013ca | 7044 | if (status != HAL_OK) |
wolfSSL | 13:f67a6c6013ca | 7045 | ret = AES_GCM_AUTH_E; |
wolfSSL | 13:f67a6c6013ca | 7046 | HAL_CRYP_DeInit(&hcryp); |
wolfSSL | 13:f67a6c6013ca | 7047 | #else |
wolfSSL | 13:f67a6c6013ca | 7048 | ByteReverseWords((word32*)keyCopy, (word32*)aes->key, keySize); |
wolfSSL | 13:f67a6c6013ca | 7049 | status = CRYP_AES_GCM(MODE_ENCRYPT, (uint8_t*)initialCounter, |
wolfSSL | 13:f67a6c6013ca | 7050 | (uint8_t*)keyCopy, keySize * 8, |
wolfSSL | 13:f67a6c6013ca | 7051 | (uint8_t*)in, sz, |
wolfSSL | 13:f67a6c6013ca | 7052 | (uint8_t*)authInPadded,authInSz, |
wolfSSL | 13:f67a6c6013ca | 7053 | (uint8_t*)out, tag); |
wolfSSL | 13:f67a6c6013ca | 7054 | if (status != SUCCESS) |
wolfSSL | 13:f67a6c6013ca | 7055 | ret = AES_GCM_AUTH_E; |
wolfSSL | 13:f67a6c6013ca | 7056 | #endif /* WOLFSSL_STM32_CUBEMX */ |
wolfSSL | 13:f67a6c6013ca | 7057 | |
wolfSSL | 13:f67a6c6013ca | 7058 | /* authTag may be shorter than AES_BLOCK_SZ, store separately */ |
wolfSSL | 13:f67a6c6013ca | 7059 | if (ret == 0) |
wolfSSL | 13:f67a6c6013ca | 7060 | XMEMCPY(authTag, tag, authTagSz); |
wolfSSL | 13:f67a6c6013ca | 7061 | |
wolfSSL | 13:f67a6c6013ca | 7062 | /* We only allocate extra memory if authInPadded is not a multiple of AES_BLOCK_SZ */ |
wolfSSL | 13:f67a6c6013ca | 7063 | if (authInPadded != NULL && authInSz != authPadSz) { |
wolfSSL | 13:f67a6c6013ca | 7064 | XFREE(authInPadded, aes->heap, DYNAMIC_TYPE_TMP_BUFFER); |
wolfSSL | 13:f67a6c6013ca | 7065 | } |
wolfSSL | 13:f67a6c6013ca | 7066 | |
wolfSSL | 13:f67a6c6013ca | 7067 | return ret; |
wolfSSL | 13:f67a6c6013ca | 7068 | } |
wolfSSL | 13:f67a6c6013ca | 7069 | |
wolfSSL | 13:f67a6c6013ca | 7070 | #endif |
wolfSSL | 13:f67a6c6013ca | 7071 | |
wolfSSL | 13:f67a6c6013ca | 7072 | /* Software AES-GCM */ |
wolfSSL | 13:f67a6c6013ca | 7073 | |
wolfSSL | 13:f67a6c6013ca | 7074 | #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_AES) |
wolfSSL | 13:f67a6c6013ca | 7075 | /* if async and byte count above threshold */ |
wolfSSL | 13:f67a6c6013ca | 7076 | if (aes->asyncDev.marker == WOLFSSL_ASYNC_MARKER_AES && |
wolfSSL | 13:f67a6c6013ca | 7077 | sz >= WC_ASYNC_THRESH_AES_GCM) { |
wolfSSL | 13:f67a6c6013ca | 7078 | #if defined(HAVE_CAVIUM) |
wolfSSL | 13:f67a6c6013ca | 7079 | /* Not yet supported, contact wolfSSL if interested in using */ |
wolfSSL | 13:f67a6c6013ca | 7080 | #elif defined(HAVE_INTEL_QA) |
wolfSSL | 13:f67a6c6013ca | 7081 | return IntelQaSymAesGcmEncrypt(&aes->asyncDev, out, in, sz, |
wolfSSL | 13:f67a6c6013ca | 7082 | (const byte*)aes->asyncKey, aes->keylen, iv, ivSz, |
wolfSSL | 13:f67a6c6013ca | 7083 | authTag, authTagSz, authIn, authInSz); |
wolfSSL | 13:f67a6c6013ca | 7084 | #else /* WOLFSSL_ASYNC_CRYPT_TEST */ |
wolfSSL | 13:f67a6c6013ca | 7085 | WC_ASYNC_TEST* testDev = &aes->asyncDev.test; |
wolfSSL | 13:f67a6c6013ca | 7086 | if (testDev->type == ASYNC_TEST_NONE) { |
wolfSSL | 13:f67a6c6013ca | 7087 | testDev->type = ASYNC_TEST_AES_GCM_ENCRYPT; |
wolfSSL | 13:f67a6c6013ca | 7088 | testDev->aes.aes = aes; |
wolfSSL | 13:f67a6c6013ca | 7089 | testDev->aes.out = out; |
wolfSSL | 13:f67a6c6013ca | 7090 | testDev->aes.in = in; |
wolfSSL | 13:f67a6c6013ca | 7091 | testDev->aes.sz = sz; |
wolfSSL | 13:f67a6c6013ca | 7092 | testDev->aes.iv = iv; |
wolfSSL | 13:f67a6c6013ca | 7093 | testDev->aes.ivSz = ivSz; |
wolfSSL | 13:f67a6c6013ca | 7094 | testDev->aes.authTag = authTag; |
wolfSSL | 13:f67a6c6013ca | 7095 | testDev->aes.authTagSz = authTagSz; |
wolfSSL | 13:f67a6c6013ca | 7096 | testDev->aes.authIn = authIn; |
wolfSSL | 13:f67a6c6013ca | 7097 | testDev->aes.authInSz = authInSz; |
wolfSSL | 13:f67a6c6013ca | 7098 | } |
wolfSSL | 13:f67a6c6013ca | 7099 | #endif |
wolfSSL | 13:f67a6c6013ca | 7100 | } |
wolfSSL | 13:f67a6c6013ca | 7101 | #endif /* WOLFSSL_ASYNC_CRYPT */ |
wolfSSL | 13:f67a6c6013ca | 7102 | |
wolfSSL | 13:f67a6c6013ca | 7103 | #ifdef WOLFSSL_AESNI |
wolfSSL | 13:f67a6c6013ca | 7104 | if (haveAESNI) { |
wolfSSL | 13:f67a6c6013ca | 7105 | #ifdef HAVE_INTEL_AVX2 |
wolfSSL | 13:f67a6c6013ca | 7106 | if (IS_INTEL_AVX2(intel_flags)) { |
wolfSSL | 13:f67a6c6013ca | 7107 | AES_GCM_encrypt_avx2(in, out, authIn, iv, authTag, |
wolfSSL | 13:f67a6c6013ca | 7108 | sz, authInSz, ivSz, (const byte*)aes->key, aes->rounds); |
wolfSSL | 13:f67a6c6013ca | 7109 | } |
wolfSSL | 13:f67a6c6013ca | 7110 | else |
wolfSSL | 13:f67a6c6013ca | 7111 | #endif |
wolfSSL | 13:f67a6c6013ca | 7112 | AES_GCM_encrypt(in, out, authIn, iv, authTag, |
wolfSSL | 13:f67a6c6013ca | 7113 | sz, authInSz, ivSz, (const byte*)aes->key, aes->rounds); |
wolfSSL | 13:f67a6c6013ca | 7114 | return 0; |
wolfSSL | 13:f67a6c6013ca | 7115 | } |
wolfSSL | 13:f67a6c6013ca | 7116 | #endif |
wolfSSL | 13:f67a6c6013ca | 7117 | |
wolfSSL | 13:f67a6c6013ca | 7118 | ctr = counter; |
wolfSSL | 13:f67a6c6013ca | 7119 | XMEMSET(initialCounter, 0, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7120 | if (ivSz == NONCE_SZ) { |
wolfSSL | 13:f67a6c6013ca | 7121 | XMEMCPY(initialCounter, iv, ivSz); |
wolfSSL | 13:f67a6c6013ca | 7122 | initialCounter[AES_BLOCK_SIZE - 1] = 1; |
wolfSSL | 13:f67a6c6013ca | 7123 | } |
wolfSSL | 13:f67a6c6013ca | 7124 | else { |
wolfSSL | 13:f67a6c6013ca | 7125 | GHASH(aes, NULL, 0, iv, ivSz, initialCounter, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7126 | } |
wolfSSL | 13:f67a6c6013ca | 7127 | XMEMCPY(ctr, initialCounter, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7128 | |
wolfSSL | 13:f67a6c6013ca | 7129 | #ifdef WOLFSSL_PIC32MZ_CRYPT |
wolfSSL | 13:f67a6c6013ca | 7130 | if (blocks) { |
wolfSSL | 13:f67a6c6013ca | 7131 | /* use intitial IV for PIC32 HW, but don't use it below */ |
wolfSSL | 13:f67a6c6013ca | 7132 | XMEMCPY(aes->iv_ce, ctr, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7133 | |
wolfSSL | 13:f67a6c6013ca | 7134 | ret = wc_Pic32AesCrypt( |
wolfSSL | 13:f67a6c6013ca | 7135 | aes->key_ce, aes->keylen, aes->iv_ce, AES_BLOCK_SIZE, |
wolfSSL | 13:f67a6c6013ca | 7136 | out, in, (blocks * AES_BLOCK_SIZE), |
wolfSSL | 13:f67a6c6013ca | 7137 | PIC32_ENCRYPTION, PIC32_ALGO_AES, PIC32_CRYPTOALGO_AES_GCM); |
wolfSSL | 13:f67a6c6013ca | 7138 | if (ret != 0) |
wolfSSL | 13:f67a6c6013ca | 7139 | return ret; |
wolfSSL | 13:f67a6c6013ca | 7140 | } |
wolfSSL | 13:f67a6c6013ca | 7141 | /* process remainder using partial handling */ |
wolfSSL | 13:f67a6c6013ca | 7142 | #endif |
wolfSSL | 13:f67a6c6013ca | 7143 | while (blocks--) { |
wolfSSL | 13:f67a6c6013ca | 7144 | IncrementGcmCounter(ctr); |
wolfSSL | 13:f67a6c6013ca | 7145 | #ifndef WOLFSSL_PIC32MZ_CRYPT |
wolfSSL | 13:f67a6c6013ca | 7146 | wc_AesEncrypt(aes, ctr, scratch); |
wolfSSL | 13:f67a6c6013ca | 7147 | xorbuf(scratch, p, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7148 | XMEMCPY(c, scratch, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7149 | #endif |
wolfSSL | 13:f67a6c6013ca | 7150 | p += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 7151 | c += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 7152 | } |
wolfSSL | 13:f67a6c6013ca | 7153 | |
wolfSSL | 13:f67a6c6013ca | 7154 | if (partial != 0) { |
wolfSSL | 13:f67a6c6013ca | 7155 | IncrementGcmCounter(ctr); |
wolfSSL | 13:f67a6c6013ca | 7156 | wc_AesEncrypt(aes, ctr, scratch); |
wolfSSL | 13:f67a6c6013ca | 7157 | xorbuf(scratch, p, partial); |
wolfSSL | 13:f67a6c6013ca | 7158 | XMEMCPY(c, scratch, partial); |
wolfSSL | 13:f67a6c6013ca | 7159 | |
wolfSSL | 13:f67a6c6013ca | 7160 | } |
wolfSSL | 13:f67a6c6013ca | 7161 | |
wolfSSL | 13:f67a6c6013ca | 7162 | GHASH(aes, authIn, authInSz, out, sz, authTag, authTagSz); |
wolfSSL | 13:f67a6c6013ca | 7163 | wc_AesEncrypt(aes, initialCounter, scratch); |
wolfSSL | 13:f67a6c6013ca | 7164 | xorbuf(authTag, scratch, authTagSz); |
wolfSSL | 13:f67a6c6013ca | 7165 | |
wolfSSL | 13:f67a6c6013ca | 7166 | #endif /* FREESCALE_LTC_AES_GCM */ |
wolfSSL | 13:f67a6c6013ca | 7167 | |
wolfSSL | 13:f67a6c6013ca | 7168 | return ret; |
wolfSSL | 13:f67a6c6013ca | 7169 | } |
wolfSSL | 13:f67a6c6013ca | 7170 | |
wolfSSL | 13:f67a6c6013ca | 7171 | |
wolfSSL | 13:f67a6c6013ca | 7172 | #if defined(HAVE_AES_DECRYPT) || defined(HAVE_AESGCM_DECRYPT) |
wolfSSL | 13:f67a6c6013ca | 7173 | int wc_AesGcmDecrypt(Aes* aes, byte* out, const byte* in, word32 sz, |
wolfSSL | 13:f67a6c6013ca | 7174 | const byte* iv, word32 ivSz, |
wolfSSL | 13:f67a6c6013ca | 7175 | const byte* authTag, word32 authTagSz, |
wolfSSL | 13:f67a6c6013ca | 7176 | const byte* authIn, word32 authInSz) |
wolfSSL | 13:f67a6c6013ca | 7177 | { |
wolfSSL | 13:f67a6c6013ca | 7178 | int ret = 0; |
wolfSSL | 13:f67a6c6013ca | 7179 | word32 keySize; |
wolfSSL | 13:f67a6c6013ca | 7180 | #ifdef FREESCALE_LTC_AES_GCM |
wolfSSL | 13:f67a6c6013ca | 7181 | status_t status; |
wolfSSL | 13:f67a6c6013ca | 7182 | #elif defined(STM32F2_CRYPTO) || defined(STM32F4_CRYPTO) |
wolfSSL | 13:f67a6c6013ca | 7183 | #ifdef WOLFSSL_STM32_CUBEMX |
wolfSSL | 13:f67a6c6013ca | 7184 | CRYP_HandleTypeDef hcryp; |
wolfSSL | 13:f67a6c6013ca | 7185 | #else |
wolfSSL | 13:f67a6c6013ca | 7186 | byte keyCopy[AES_BLOCK_SIZE * 2]; |
wolfSSL | 13:f67a6c6013ca | 7187 | #endif /* WOLFSSL_STM32_CUBEMX */ |
wolfSSL | 13:f67a6c6013ca | 7188 | int status; |
wolfSSL | 13:f67a6c6013ca | 7189 | int inPadSz, authPadSz; |
wolfSSL | 13:f67a6c6013ca | 7190 | byte tag[AES_BLOCK_SIZE]; |
wolfSSL | 13:f67a6c6013ca | 7191 | byte *inPadded = NULL; |
wolfSSL | 13:f67a6c6013ca | 7192 | byte *authInPadded = NULL; |
wolfSSL | 13:f67a6c6013ca | 7193 | byte initialCounter[AES_BLOCK_SIZE]; |
wolfSSL | 13:f67a6c6013ca | 7194 | #else /* software AES-GCM */ |
wolfSSL | 13:f67a6c6013ca | 7195 | word32 blocks = sz / AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 7196 | word32 partial = sz % AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 7197 | const byte* c = in; |
wolfSSL | 13:f67a6c6013ca | 7198 | byte* p = out; |
wolfSSL | 13:f67a6c6013ca | 7199 | byte counter[AES_BLOCK_SIZE]; |
wolfSSL | 13:f67a6c6013ca | 7200 | byte initialCounter[AES_BLOCK_SIZE]; |
wolfSSL | 13:f67a6c6013ca | 7201 | byte *ctr; |
wolfSSL | 13:f67a6c6013ca | 7202 | byte scratch[AES_BLOCK_SIZE]; |
wolfSSL | 13:f67a6c6013ca | 7203 | byte Tprime[AES_BLOCK_SIZE]; |
wolfSSL | 13:f67a6c6013ca | 7204 | byte EKY0[AES_BLOCK_SIZE]; |
wolfSSL | 13:f67a6c6013ca | 7205 | #endif |
wolfSSL | 13:f67a6c6013ca | 7206 | |
wolfSSL | 13:f67a6c6013ca | 7207 | /* argument checks */ |
wolfSSL | 13:f67a6c6013ca | 7208 | if (aes == NULL || out == NULL || in == NULL || iv == NULL || |
wolfSSL | 13:f67a6c6013ca | 7209 | authTag == NULL || authTagSz > AES_BLOCK_SIZE) { |
wolfSSL | 13:f67a6c6013ca | 7210 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 7211 | } |
wolfSSL | 13:f67a6c6013ca | 7212 | |
wolfSSL | 13:f67a6c6013ca | 7213 | ret = wc_AesGetKeySize(aes, &keySize); |
wolfSSL | 13:f67a6c6013ca | 7214 | if (ret != 0) { |
wolfSSL | 13:f67a6c6013ca | 7215 | return ret; |
wolfSSL | 13:f67a6c6013ca | 7216 | } |
wolfSSL | 13:f67a6c6013ca | 7217 | |
wolfSSL | 13:f67a6c6013ca | 7218 | #ifdef FREESCALE_LTC_AES_GCM |
wolfSSL | 13:f67a6c6013ca | 7219 | |
wolfSSL | 13:f67a6c6013ca | 7220 | status = LTC_AES_DecryptTagGcm(LTC_BASE, in, out, sz, iv, ivSz, |
wolfSSL | 13:f67a6c6013ca | 7221 | authIn, authInSz, (byte*)aes->key, keySize, authTag, authTagSz); |
wolfSSL | 13:f67a6c6013ca | 7222 | |
wolfSSL | 13:f67a6c6013ca | 7223 | ret = (status == kStatus_Success) ? 0 : AES_GCM_AUTH_E; |
wolfSSL | 13:f67a6c6013ca | 7224 | |
wolfSSL | 13:f67a6c6013ca | 7225 | #elif defined(STM32F2_CRYPTO) || defined(STM32F4_CRYPTO) |
wolfSSL | 13:f67a6c6013ca | 7226 | |
wolfSSL | 13:f67a6c6013ca | 7227 | /* additional argument checks - STM32 HW only supports 12 byte IV */ |
wolfSSL | 13:f67a6c6013ca | 7228 | if (ivSz != NONCE_SZ) { |
wolfSSL | 13:f67a6c6013ca | 7229 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 7230 | } |
wolfSSL | 13:f67a6c6013ca | 7231 | |
wolfSSL | 13:f67a6c6013ca | 7232 | XMEMSET(initialCounter, 0, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7233 | XMEMCPY(initialCounter, iv, ivSz); |
wolfSSL | 13:f67a6c6013ca | 7234 | initialCounter[AES_BLOCK_SIZE - 1] = STM32_GCM_IV_START; |
wolfSSL | 13:f67a6c6013ca | 7235 | |
wolfSSL | 13:f67a6c6013ca | 7236 | /* Need to pad the AAD and input cipher text to a full block size since |
wolfSSL | 13:f67a6c6013ca | 7237 | * CRYP_AES_GCM will assume these are a multiple of AES_BLOCK_SIZE. |
wolfSSL | 13:f67a6c6013ca | 7238 | * It is okay to pad with zeros because GCM does this before GHASH already. |
wolfSSL | 13:f67a6c6013ca | 7239 | * See NIST SP 800-38D */ |
wolfSSL | 13:f67a6c6013ca | 7240 | |
wolfSSL | 13:f67a6c6013ca | 7241 | if ((sz % AES_BLOCK_SIZE) > 0) { |
wolfSSL | 13:f67a6c6013ca | 7242 | inPadSz = ((sz / AES_BLOCK_SIZE) + 1) * AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 7243 | inPadded = XMALLOC(inPadSz, aes->heap, DYNAMIC_TYPE_TMP_BUFFER); |
wolfSSL | 13:f67a6c6013ca | 7244 | if (inPadded == NULL) { |
wolfSSL | 13:f67a6c6013ca | 7245 | return MEMORY_E; |
wolfSSL | 13:f67a6c6013ca | 7246 | } |
wolfSSL | 13:f67a6c6013ca | 7247 | XMEMSET(inPadded, 0, inPadSz); |
wolfSSL | 13:f67a6c6013ca | 7248 | XMEMCPY(inPadded, in, sz); |
wolfSSL | 13:f67a6c6013ca | 7249 | } else { |
wolfSSL | 13:f67a6c6013ca | 7250 | inPadSz = sz; |
wolfSSL | 13:f67a6c6013ca | 7251 | inPadded = (byte*)in; |
wolfSSL | 13:f67a6c6013ca | 7252 | } |
wolfSSL | 13:f67a6c6013ca | 7253 | |
wolfSSL | 13:f67a6c6013ca | 7254 | if ((authInSz % AES_BLOCK_SIZE) > 0) { |
wolfSSL | 13:f67a6c6013ca | 7255 | authPadSz = ((authInSz / AES_BLOCK_SIZE) + 1) * AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 7256 | authInPadded = XMALLOC(authPadSz, aes->heap, DYNAMIC_TYPE_TMP_BUFFER); |
wolfSSL | 13:f67a6c6013ca | 7257 | if (authInPadded == NULL) { |
wolfSSL | 13:f67a6c6013ca | 7258 | if (inPadded != NULL && inPadSz != sz) |
wolfSSL | 13:f67a6c6013ca | 7259 | XFREE(inPadded , aes->heap, DYNAMIC_TYPE_TMP_BUFFER); |
wolfSSL | 13:f67a6c6013ca | 7260 | return MEMORY_E; |
wolfSSL | 13:f67a6c6013ca | 7261 | } |
wolfSSL | 13:f67a6c6013ca | 7262 | XMEMSET(authInPadded, 0, authPadSz); |
wolfSSL | 13:f67a6c6013ca | 7263 | XMEMCPY(authInPadded, authIn, authInSz); |
wolfSSL | 13:f67a6c6013ca | 7264 | } else { |
wolfSSL | 13:f67a6c6013ca | 7265 | authPadSz = authInSz; |
wolfSSL | 13:f67a6c6013ca | 7266 | authInPadded = (byte*)authIn; |
wolfSSL | 13:f67a6c6013ca | 7267 | } |
wolfSSL | 13:f67a6c6013ca | 7268 | |
wolfSSL | 13:f67a6c6013ca | 7269 | #ifdef WOLFSSL_STM32_CUBEMX |
wolfSSL | 13:f67a6c6013ca | 7270 | XMEMSET(&hcryp, 0, sizeof(CRYP_HandleTypeDef)); |
wolfSSL | 13:f67a6c6013ca | 7271 | switch(keySize) { |
wolfSSL | 13:f67a6c6013ca | 7272 | case 16: /* 128-bit key */ |
wolfSSL | 13:f67a6c6013ca | 7273 | hcryp.Init.KeySize = CRYP_KEYSIZE_128B; |
wolfSSL | 13:f67a6c6013ca | 7274 | break; |
wolfSSL | 13:f67a6c6013ca | 7275 | case 24: /* 192-bit key */ |
wolfSSL | 13:f67a6c6013ca | 7276 | hcryp.Init.KeySize = CRYP_KEYSIZE_192B; |
wolfSSL | 13:f67a6c6013ca | 7277 | break; |
wolfSSL | 13:f67a6c6013ca | 7278 | case 32: /* 256-bit key */ |
wolfSSL | 13:f67a6c6013ca | 7279 | hcryp.Init.KeySize = CRYP_KEYSIZE_256B; |
wolfSSL | 13:f67a6c6013ca | 7280 | break; |
wolfSSL | 13:f67a6c6013ca | 7281 | default: |
wolfSSL | 13:f67a6c6013ca | 7282 | break; |
wolfSSL | 13:f67a6c6013ca | 7283 | } |
wolfSSL | 13:f67a6c6013ca | 7284 | hcryp.Instance = CRYP; |
wolfSSL | 13:f67a6c6013ca | 7285 | hcryp.Init.DataType = CRYP_DATATYPE_8B; |
wolfSSL | 13:f67a6c6013ca | 7286 | hcryp.Init.pKey = (byte*)aes->key; |
wolfSSL | 13:f67a6c6013ca | 7287 | hcryp.Init.pInitVect = initialCounter; |
wolfSSL | 13:f67a6c6013ca | 7288 | hcryp.Init.Header = authInPadded; |
wolfSSL | 13:f67a6c6013ca | 7289 | hcryp.Init.HeaderSize = authInSz; |
wolfSSL | 13:f67a6c6013ca | 7290 | |
wolfSSL | 13:f67a6c6013ca | 7291 | HAL_CRYP_Init(&hcryp); |
wolfSSL | 13:f67a6c6013ca | 7292 | /* Use inPadded for output buffer instead of |
wolfSSL | 13:f67a6c6013ca | 7293 | * out so that we don't overflow our size. */ |
wolfSSL | 13:f67a6c6013ca | 7294 | status = HAL_CRYPEx_AESGCM_Decrypt(&hcryp, (byte*)inPadded, |
wolfSSL | 13:f67a6c6013ca | 7295 | sz, inPadded, STM32_HAL_TIMEOUT); |
wolfSSL | 13:f67a6c6013ca | 7296 | /* Compute the authTag */ |
wolfSSL | 13:f67a6c6013ca | 7297 | if (status == HAL_OK) |
wolfSSL | 13:f67a6c6013ca | 7298 | status = HAL_CRYPEx_AESGCM_Finish(&hcryp, sz, tag, STM32_HAL_TIMEOUT); |
wolfSSL | 13:f67a6c6013ca | 7299 | |
wolfSSL | 13:f67a6c6013ca | 7300 | if (status != HAL_OK) |
wolfSSL | 13:f67a6c6013ca | 7301 | ret = AES_GCM_AUTH_E; |
wolfSSL | 13:f67a6c6013ca | 7302 | |
wolfSSL | 13:f67a6c6013ca | 7303 | HAL_CRYP_DeInit(&hcryp); |
wolfSSL | 13:f67a6c6013ca | 7304 | #else |
wolfSSL | 13:f67a6c6013ca | 7305 | ByteReverseWords((word32*)keyCopy, (word32*)aes->key, keySize); |
wolfSSL | 13:f67a6c6013ca | 7306 | |
wolfSSL | 13:f67a6c6013ca | 7307 | /* Input size and auth size need to be the actual sizes, even though |
wolfSSL | 13:f67a6c6013ca | 7308 | * they are not block aligned, because this length (in bits) is used |
wolfSSL | 13:f67a6c6013ca | 7309 | * in the final GHASH. Use inPadded for output buffer instead of |
wolfSSL | 13:f67a6c6013ca | 7310 | * out so that we don't overflow our size. */ |
wolfSSL | 13:f67a6c6013ca | 7311 | status = CRYP_AES_GCM(MODE_DECRYPT, (uint8_t*)initialCounter, |
wolfSSL | 13:f67a6c6013ca | 7312 | (uint8_t*)keyCopy, keySize * 8, |
wolfSSL | 13:f67a6c6013ca | 7313 | (uint8_t*)inPadded, sz, |
wolfSSL | 13:f67a6c6013ca | 7314 | (uint8_t*)authInPadded,authInSz, |
wolfSSL | 13:f67a6c6013ca | 7315 | (uint8_t*)inPadded, tag); |
wolfSSL | 13:f67a6c6013ca | 7316 | if (status != SUCCESS) |
wolfSSL | 13:f67a6c6013ca | 7317 | ret = AES_GCM_AUTH_E; |
wolfSSL | 13:f67a6c6013ca | 7318 | #endif /* WOLFSSL_STM32_CUBEMX */ |
wolfSSL | 13:f67a6c6013ca | 7319 | |
wolfSSL | 13:f67a6c6013ca | 7320 | if (ret == 0 && ConstantCompare(authTag, tag, authTagSz) == 0) { |
wolfSSL | 13:f67a6c6013ca | 7321 | /* Only keep the decrypted data if authTag success. */ |
wolfSSL | 13:f67a6c6013ca | 7322 | XMEMCPY(out, inPadded, sz); |
wolfSSL | 13:f67a6c6013ca | 7323 | ret = 0; /* success */ |
wolfSSL | 13:f67a6c6013ca | 7324 | } |
wolfSSL | 13:f67a6c6013ca | 7325 | |
wolfSSL | 13:f67a6c6013ca | 7326 | /* only allocate padding buffers if the inputs are not a multiple of block sz */ |
wolfSSL | 13:f67a6c6013ca | 7327 | if (inPadded != NULL && inPadSz != sz) |
wolfSSL | 13:f67a6c6013ca | 7328 | XFREE(inPadded , aes->heap, DYNAMIC_TYPE_TMP_BUFFER); |
wolfSSL | 13:f67a6c6013ca | 7329 | if (authInPadded != NULL && authPadSz != authInSz) |
wolfSSL | 13:f67a6c6013ca | 7330 | XFREE(authInPadded, aes->heap, DYNAMIC_TYPE_TMP_BUFFER); |
wolfSSL | 13:f67a6c6013ca | 7331 | |
wolfSSL | 13:f67a6c6013ca | 7332 | #else |
wolfSSL | 13:f67a6c6013ca | 7333 | |
wolfSSL | 13:f67a6c6013ca | 7334 | /* software AES GCM */ |
wolfSSL | 13:f67a6c6013ca | 7335 | |
wolfSSL | 13:f67a6c6013ca | 7336 | #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_AES) |
wolfSSL | 13:f67a6c6013ca | 7337 | /* if async and byte count above threshold */ |
wolfSSL | 13:f67a6c6013ca | 7338 | if (aes->asyncDev.marker == WOLFSSL_ASYNC_MARKER_AES && |
wolfSSL | 13:f67a6c6013ca | 7339 | sz >= WC_ASYNC_THRESH_AES_GCM) { |
wolfSSL | 13:f67a6c6013ca | 7340 | #if defined(HAVE_CAVIUM) |
wolfSSL | 13:f67a6c6013ca | 7341 | /* Not yet supported, contact wolfSSL if interested in using */ |
wolfSSL | 13:f67a6c6013ca | 7342 | #elif defined(HAVE_INTEL_QA) |
wolfSSL | 13:f67a6c6013ca | 7343 | return IntelQaSymAesGcmDecrypt(&aes->asyncDev, out, in, sz, |
wolfSSL | 13:f67a6c6013ca | 7344 | (const byte*)aes->asyncKey, aes->keylen, iv, ivSz, |
wolfSSL | 13:f67a6c6013ca | 7345 | authTag, authTagSz, authIn, authInSz); |
wolfSSL | 13:f67a6c6013ca | 7346 | #else /* WOLFSSL_ASYNC_CRYPT_TEST */ |
wolfSSL | 13:f67a6c6013ca | 7347 | WC_ASYNC_TEST* testDev = &aes->asyncDev.test; |
wolfSSL | 13:f67a6c6013ca | 7348 | if (testDev->type == ASYNC_TEST_NONE) { |
wolfSSL | 13:f67a6c6013ca | 7349 | testDev->type = ASYNC_TEST_AES_GCM_DECRYPT; |
wolfSSL | 13:f67a6c6013ca | 7350 | testDev->aes.aes = aes; |
wolfSSL | 13:f67a6c6013ca | 7351 | testDev->aes.out = out; |
wolfSSL | 13:f67a6c6013ca | 7352 | testDev->aes.in = in; |
wolfSSL | 13:f67a6c6013ca | 7353 | testDev->aes.sz = sz; |
wolfSSL | 13:f67a6c6013ca | 7354 | testDev->aes.iv = iv; |
wolfSSL | 13:f67a6c6013ca | 7355 | testDev->aes.ivSz = ivSz; |
wolfSSL | 13:f67a6c6013ca | 7356 | testDev->aes.authTag = (byte*)authTag; |
wolfSSL | 13:f67a6c6013ca | 7357 | testDev->aes.authTagSz = authTagSz; |
wolfSSL | 13:f67a6c6013ca | 7358 | testDev->aes.authIn = authIn; |
wolfSSL | 13:f67a6c6013ca | 7359 | testDev->aes.authInSz = authInSz; |
wolfSSL | 13:f67a6c6013ca | 7360 | return WC_PENDING_E; |
wolfSSL | 13:f67a6c6013ca | 7361 | } |
wolfSSL | 13:f67a6c6013ca | 7362 | #endif |
wolfSSL | 13:f67a6c6013ca | 7363 | } |
wolfSSL | 13:f67a6c6013ca | 7364 | #endif /* WOLFSSL_ASYNC_CRYPT */ |
wolfSSL | 13:f67a6c6013ca | 7365 | |
wolfSSL | 13:f67a6c6013ca | 7366 | #ifdef WOLFSSL_AESNI |
wolfSSL | 13:f67a6c6013ca | 7367 | if (haveAESNI) { |
wolfSSL | 13:f67a6c6013ca | 7368 | #ifdef HAVE_INTEL_AVX2 |
wolfSSL | 13:f67a6c6013ca | 7369 | if (IS_INTEL_AVX2(intel_flags)) { |
wolfSSL | 13:f67a6c6013ca | 7370 | if (AES_GCM_decrypt_avx2(in, out, authIn, iv, authTag, sz, authInSz, |
wolfSSL | 13:f67a6c6013ca | 7371 | ivSz, (byte*)aes->key, aes->rounds) == 0) |
wolfSSL | 13:f67a6c6013ca | 7372 | return AES_GCM_AUTH_E; |
wolfSSL | 13:f67a6c6013ca | 7373 | } |
wolfSSL | 13:f67a6c6013ca | 7374 | else |
wolfSSL | 13:f67a6c6013ca | 7375 | #endif |
wolfSSL | 13:f67a6c6013ca | 7376 | if (AES_GCM_decrypt(in, out, authIn, iv, authTag, sz, authInSz, ivSz, |
wolfSSL | 13:f67a6c6013ca | 7377 | (byte*)aes->key, aes->rounds) == 0) |
wolfSSL | 13:f67a6c6013ca | 7378 | return AES_GCM_AUTH_E; |
wolfSSL | 13:f67a6c6013ca | 7379 | return 0; |
wolfSSL | 13:f67a6c6013ca | 7380 | } |
wolfSSL | 13:f67a6c6013ca | 7381 | #endif |
wolfSSL | 13:f67a6c6013ca | 7382 | |
wolfSSL | 13:f67a6c6013ca | 7383 | ctr = counter; |
wolfSSL | 13:f67a6c6013ca | 7384 | XMEMSET(initialCounter, 0, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7385 | if (ivSz == NONCE_SZ) { |
wolfSSL | 13:f67a6c6013ca | 7386 | XMEMCPY(initialCounter, iv, ivSz); |
wolfSSL | 13:f67a6c6013ca | 7387 | initialCounter[AES_BLOCK_SIZE - 1] = 1; |
wolfSSL | 13:f67a6c6013ca | 7388 | } |
wolfSSL | 13:f67a6c6013ca | 7389 | else { |
wolfSSL | 13:f67a6c6013ca | 7390 | GHASH(aes, NULL, 0, iv, ivSz, initialCounter, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7391 | } |
wolfSSL | 13:f67a6c6013ca | 7392 | XMEMCPY(ctr, initialCounter, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7393 | |
wolfSSL | 13:f67a6c6013ca | 7394 | /* Calc the authTag again using the received auth data and the cipher text */ |
wolfSSL | 13:f67a6c6013ca | 7395 | GHASH(aes, authIn, authInSz, in, sz, Tprime, sizeof(Tprime)); |
wolfSSL | 13:f67a6c6013ca | 7396 | wc_AesEncrypt(aes, ctr, EKY0); |
wolfSSL | 13:f67a6c6013ca | 7397 | xorbuf(Tprime, EKY0, sizeof(Tprime)); |
wolfSSL | 13:f67a6c6013ca | 7398 | |
wolfSSL | 13:f67a6c6013ca | 7399 | if (ConstantCompare(authTag, Tprime, authTagSz) != 0) { |
wolfSSL | 13:f67a6c6013ca | 7400 | return AES_GCM_AUTH_E; |
wolfSSL | 13:f67a6c6013ca | 7401 | } |
wolfSSL | 13:f67a6c6013ca | 7402 | |
wolfSSL | 13:f67a6c6013ca | 7403 | #ifdef WOLFSSL_PIC32MZ_CRYPT |
wolfSSL | 13:f67a6c6013ca | 7404 | if (blocks) { |
wolfSSL | 13:f67a6c6013ca | 7405 | /* use intitial IV for PIC32 HW, but don't use it below */ |
wolfSSL | 13:f67a6c6013ca | 7406 | XMEMCPY(aes->iv_ce, ctr, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7407 | |
wolfSSL | 13:f67a6c6013ca | 7408 | ret = wc_Pic32AesCrypt( |
wolfSSL | 13:f67a6c6013ca | 7409 | aes->key_ce, aes->keylen, aes->iv_ce, AES_BLOCK_SIZE, |
wolfSSL | 13:f67a6c6013ca | 7410 | out, in, (blocks * AES_BLOCK_SIZE), |
wolfSSL | 13:f67a6c6013ca | 7411 | PIC32_DECRYPTION, PIC32_ALGO_AES, PIC32_CRYPTOALGO_AES_GCM); |
wolfSSL | 13:f67a6c6013ca | 7412 | if (ret != 0) |
wolfSSL | 13:f67a6c6013ca | 7413 | return ret; |
wolfSSL | 13:f67a6c6013ca | 7414 | } |
wolfSSL | 13:f67a6c6013ca | 7415 | /* process remainder using partial handling */ |
wolfSSL | 13:f67a6c6013ca | 7416 | #endif |
wolfSSL | 13:f67a6c6013ca | 7417 | |
wolfSSL | 13:f67a6c6013ca | 7418 | while (blocks--) { |
wolfSSL | 13:f67a6c6013ca | 7419 | IncrementGcmCounter(ctr); |
wolfSSL | 13:f67a6c6013ca | 7420 | #ifndef WOLFSSL_PIC32MZ_CRYPT |
wolfSSL | 13:f67a6c6013ca | 7421 | wc_AesEncrypt(aes, ctr, scratch); |
wolfSSL | 13:f67a6c6013ca | 7422 | xorbuf(scratch, c, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7423 | XMEMCPY(p, scratch, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7424 | #endif |
wolfSSL | 13:f67a6c6013ca | 7425 | p += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 7426 | c += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 7427 | } |
wolfSSL | 13:f67a6c6013ca | 7428 | if (partial != 0) { |
wolfSSL | 13:f67a6c6013ca | 7429 | IncrementGcmCounter(ctr); |
wolfSSL | 13:f67a6c6013ca | 7430 | wc_AesEncrypt(aes, ctr, scratch); |
wolfSSL | 13:f67a6c6013ca | 7431 | xorbuf(scratch, c, partial); |
wolfSSL | 13:f67a6c6013ca | 7432 | XMEMCPY(p, scratch, partial); |
wolfSSL | 13:f67a6c6013ca | 7433 | } |
wolfSSL | 13:f67a6c6013ca | 7434 | |
wolfSSL | 13:f67a6c6013ca | 7435 | #endif |
wolfSSL | 13:f67a6c6013ca | 7436 | |
wolfSSL | 13:f67a6c6013ca | 7437 | return ret; |
wolfSSL | 13:f67a6c6013ca | 7438 | } |
wolfSSL | 13:f67a6c6013ca | 7439 | |
wolfSSL | 13:f67a6c6013ca | 7440 | #endif /* HAVE_AES_DECRYPT || HAVE_AESGCM_DECRYPT */ |
wolfSSL | 13:f67a6c6013ca | 7441 | #endif /* (WOLFSSL_XILINX_CRYPT) */ |
wolfSSL | 13:f67a6c6013ca | 7442 | |
wolfSSL | 13:f67a6c6013ca | 7443 | WOLFSSL_API int wc_GmacSetKey(Gmac* gmac, const byte* key, word32 len) |
wolfSSL | 13:f67a6c6013ca | 7444 | { |
wolfSSL | 13:f67a6c6013ca | 7445 | if (gmac == NULL || key == NULL) { |
wolfSSL | 13:f67a6c6013ca | 7446 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 7447 | } |
wolfSSL | 13:f67a6c6013ca | 7448 | return wc_AesGcmSetKey(&gmac->aes, key, len); |
wolfSSL | 13:f67a6c6013ca | 7449 | } |
wolfSSL | 13:f67a6c6013ca | 7450 | |
wolfSSL | 13:f67a6c6013ca | 7451 | |
wolfSSL | 13:f67a6c6013ca | 7452 | WOLFSSL_API int wc_GmacUpdate(Gmac* gmac, const byte* iv, word32 ivSz, |
wolfSSL | 13:f67a6c6013ca | 7453 | const byte* authIn, word32 authInSz, |
wolfSSL | 13:f67a6c6013ca | 7454 | byte* authTag, word32 authTagSz) |
wolfSSL | 13:f67a6c6013ca | 7455 | { |
wolfSSL | 13:f67a6c6013ca | 7456 | return wc_AesGcmEncrypt(&gmac->aes, NULL, NULL, 0, iv, ivSz, |
wolfSSL | 13:f67a6c6013ca | 7457 | authTag, authTagSz, authIn, authInSz); |
wolfSSL | 13:f67a6c6013ca | 7458 | } |
wolfSSL | 13:f67a6c6013ca | 7459 | |
wolfSSL | 13:f67a6c6013ca | 7460 | #endif /* HAVE_AESGCM */ |
wolfSSL | 13:f67a6c6013ca | 7461 | |
wolfSSL | 13:f67a6c6013ca | 7462 | |
wolfSSL | 13:f67a6c6013ca | 7463 | #ifdef HAVE_AESCCM |
wolfSSL | 13:f67a6c6013ca | 7464 | |
wolfSSL | 13:f67a6c6013ca | 7465 | int wc_AesCcmSetKey(Aes* aes, const byte* key, word32 keySz) |
wolfSSL | 13:f67a6c6013ca | 7466 | { |
wolfSSL | 13:f67a6c6013ca | 7467 | return wc_AesSetKey(aes, key, keySz, NULL, AES_ENCRYPTION); |
wolfSSL | 13:f67a6c6013ca | 7468 | } |
wolfSSL | 13:f67a6c6013ca | 7469 | |
wolfSSL | 13:f67a6c6013ca | 7470 | #if defined(HAVE_COLDFIRE_SEC) |
wolfSSL | 13:f67a6c6013ca | 7471 | #error "Coldfire SEC doesn't currently support AES-CCM mode" |
wolfSSL | 13:f67a6c6013ca | 7472 | |
wolfSSL | 13:f67a6c6013ca | 7473 | #elif defined(FREESCALE_LTC) |
wolfSSL | 13:f67a6c6013ca | 7474 | |
wolfSSL | 13:f67a6c6013ca | 7475 | /* return 0 on success */ |
wolfSSL | 13:f67a6c6013ca | 7476 | int wc_AesCcmEncrypt(Aes* aes, byte* out, const byte* in, word32 inSz, |
wolfSSL | 13:f67a6c6013ca | 7477 | const byte* nonce, word32 nonceSz, |
wolfSSL | 13:f67a6c6013ca | 7478 | byte* authTag, word32 authTagSz, |
wolfSSL | 13:f67a6c6013ca | 7479 | const byte* authIn, word32 authInSz) |
wolfSSL | 13:f67a6c6013ca | 7480 | { |
wolfSSL | 13:f67a6c6013ca | 7481 | byte *key; |
wolfSSL | 13:f67a6c6013ca | 7482 | uint32_t keySize; |
wolfSSL | 13:f67a6c6013ca | 7483 | status_t status; |
wolfSSL | 13:f67a6c6013ca | 7484 | |
wolfSSL | 13:f67a6c6013ca | 7485 | /* sanity check on arguments */ |
wolfSSL | 13:f67a6c6013ca | 7486 | if (aes == NULL || out == NULL || in == NULL || nonce == NULL |
wolfSSL | 13:f67a6c6013ca | 7487 | || authTag == NULL || nonceSz < 7 || nonceSz > 13) |
wolfSSL | 13:f67a6c6013ca | 7488 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 7489 | |
wolfSSL | 13:f67a6c6013ca | 7490 | key = (byte*)aes->key; |
wolfSSL | 13:f67a6c6013ca | 7491 | |
wolfSSL | 13:f67a6c6013ca | 7492 | status = wc_AesGetKeySize(aes, &keySize); |
wolfSSL | 13:f67a6c6013ca | 7493 | if (status != 0) { |
wolfSSL | 13:f67a6c6013ca | 7494 | return status; |
wolfSSL | 13:f67a6c6013ca | 7495 | } |
wolfSSL | 13:f67a6c6013ca | 7496 | |
wolfSSL | 13:f67a6c6013ca | 7497 | status = LTC_AES_EncryptTagCcm(LTC_BASE, in, out, inSz, |
wolfSSL | 13:f67a6c6013ca | 7498 | nonce, nonceSz, authIn, authInSz, key, keySize, authTag, authTagSz); |
wolfSSL | 13:f67a6c6013ca | 7499 | |
wolfSSL | 13:f67a6c6013ca | 7500 | return (kStatus_Success == status) ? 0 : BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 7501 | } |
wolfSSL | 13:f67a6c6013ca | 7502 | |
wolfSSL | 13:f67a6c6013ca | 7503 | #ifdef HAVE_AES_DECRYPT |
wolfSSL | 13:f67a6c6013ca | 7504 | int wc_AesCcmDecrypt(Aes* aes, byte* out, const byte* in, word32 inSz, |
wolfSSL | 13:f67a6c6013ca | 7505 | const byte* nonce, word32 nonceSz, |
wolfSSL | 13:f67a6c6013ca | 7506 | const byte* authTag, word32 authTagSz, |
wolfSSL | 13:f67a6c6013ca | 7507 | const byte* authIn, word32 authInSz) |
wolfSSL | 13:f67a6c6013ca | 7508 | { |
wolfSSL | 13:f67a6c6013ca | 7509 | byte *key; |
wolfSSL | 13:f67a6c6013ca | 7510 | uint32_t keySize; |
wolfSSL | 13:f67a6c6013ca | 7511 | status_t status; |
wolfSSL | 13:f67a6c6013ca | 7512 | |
wolfSSL | 13:f67a6c6013ca | 7513 | /* sanity check on arguments */ |
wolfSSL | 13:f67a6c6013ca | 7514 | if (aes == NULL || out == NULL || in == NULL || nonce == NULL |
wolfSSL | 13:f67a6c6013ca | 7515 | || authTag == NULL || nonceSz < 7 || nonceSz > 13) |
wolfSSL | 13:f67a6c6013ca | 7516 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 7517 | |
wolfSSL | 13:f67a6c6013ca | 7518 | key = (byte*)aes->key; |
wolfSSL | 13:f67a6c6013ca | 7519 | |
wolfSSL | 13:f67a6c6013ca | 7520 | status = wc_AesGetKeySize(aes, &keySize); |
wolfSSL | 13:f67a6c6013ca | 7521 | if (status != 0) { |
wolfSSL | 13:f67a6c6013ca | 7522 | return status; |
wolfSSL | 13:f67a6c6013ca | 7523 | } |
wolfSSL | 13:f67a6c6013ca | 7524 | |
wolfSSL | 13:f67a6c6013ca | 7525 | status = LTC_AES_DecryptTagCcm(LTC_BASE, in, out, inSz, |
wolfSSL | 13:f67a6c6013ca | 7526 | nonce, nonceSz, authIn, authInSz, key, keySize, authTag, authTagSz); |
wolfSSL | 13:f67a6c6013ca | 7527 | |
wolfSSL | 13:f67a6c6013ca | 7528 | if (status == kStatus_Success) { |
wolfSSL | 13:f67a6c6013ca | 7529 | return 0; |
wolfSSL | 13:f67a6c6013ca | 7530 | } |
wolfSSL | 13:f67a6c6013ca | 7531 | else { |
wolfSSL | 13:f67a6c6013ca | 7532 | XMEMSET(out, 0, inSz); |
wolfSSL | 13:f67a6c6013ca | 7533 | return AES_CCM_AUTH_E; |
wolfSSL | 13:f67a6c6013ca | 7534 | } |
wolfSSL | 13:f67a6c6013ca | 7535 | } |
wolfSSL | 13:f67a6c6013ca | 7536 | #endif /* HAVE_AES_DECRYPT */ |
wolfSSL | 13:f67a6c6013ca | 7537 | |
wolfSSL | 13:f67a6c6013ca | 7538 | |
wolfSSL | 13:f67a6c6013ca | 7539 | /* software AES CCM */ |
wolfSSL | 13:f67a6c6013ca | 7540 | #else |
wolfSSL | 13:f67a6c6013ca | 7541 | |
wolfSSL | 13:f67a6c6013ca | 7542 | static void roll_x(Aes* aes, const byte* in, word32 inSz, byte* out) |
wolfSSL | 13:f67a6c6013ca | 7543 | { |
wolfSSL | 13:f67a6c6013ca | 7544 | /* process the bulk of the data */ |
wolfSSL | 13:f67a6c6013ca | 7545 | while (inSz >= AES_BLOCK_SIZE) { |
wolfSSL | 13:f67a6c6013ca | 7546 | xorbuf(out, in, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7547 | in += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 7548 | inSz -= AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 7549 | |
wolfSSL | 13:f67a6c6013ca | 7550 | wc_AesEncrypt(aes, out, out); |
wolfSSL | 13:f67a6c6013ca | 7551 | } |
wolfSSL | 13:f67a6c6013ca | 7552 | |
wolfSSL | 13:f67a6c6013ca | 7553 | /* process remainder of the data */ |
wolfSSL | 13:f67a6c6013ca | 7554 | if (inSz > 0) { |
wolfSSL | 13:f67a6c6013ca | 7555 | xorbuf(out, in, inSz); |
wolfSSL | 13:f67a6c6013ca | 7556 | wc_AesEncrypt(aes, out, out); |
wolfSSL | 13:f67a6c6013ca | 7557 | } |
wolfSSL | 13:f67a6c6013ca | 7558 | } |
wolfSSL | 13:f67a6c6013ca | 7559 | |
wolfSSL | 13:f67a6c6013ca | 7560 | static void roll_auth(Aes* aes, const byte* in, word32 inSz, byte* out) |
wolfSSL | 13:f67a6c6013ca | 7561 | { |
wolfSSL | 13:f67a6c6013ca | 7562 | word32 authLenSz; |
wolfSSL | 13:f67a6c6013ca | 7563 | word32 remainder; |
wolfSSL | 13:f67a6c6013ca | 7564 | |
wolfSSL | 13:f67a6c6013ca | 7565 | /* encode the length in */ |
wolfSSL | 13:f67a6c6013ca | 7566 | if (inSz <= 0xFEFF) { |
wolfSSL | 13:f67a6c6013ca | 7567 | authLenSz = 2; |
wolfSSL | 13:f67a6c6013ca | 7568 | out[0] ^= ((inSz & 0xFF00) >> 8); |
wolfSSL | 13:f67a6c6013ca | 7569 | out[1] ^= (inSz & 0x00FF); |
wolfSSL | 13:f67a6c6013ca | 7570 | } |
wolfSSL | 13:f67a6c6013ca | 7571 | else if (inSz <= 0xFFFFFFFF) { |
wolfSSL | 13:f67a6c6013ca | 7572 | authLenSz = 6; |
wolfSSL | 13:f67a6c6013ca | 7573 | out[0] ^= 0xFF; out[1] ^= 0xFE; |
wolfSSL | 13:f67a6c6013ca | 7574 | out[2] ^= ((inSz & 0xFF000000) >> 24); |
wolfSSL | 13:f67a6c6013ca | 7575 | out[3] ^= ((inSz & 0x00FF0000) >> 16); |
wolfSSL | 13:f67a6c6013ca | 7576 | out[4] ^= ((inSz & 0x0000FF00) >> 8); |
wolfSSL | 13:f67a6c6013ca | 7577 | out[5] ^= (inSz & 0x000000FF); |
wolfSSL | 13:f67a6c6013ca | 7578 | } |
wolfSSL | 13:f67a6c6013ca | 7579 | /* Note, the protocol handles auth data up to 2^64, but we are |
wolfSSL | 13:f67a6c6013ca | 7580 | * using 32-bit sizes right now, so the bigger data isn't handled |
wolfSSL | 13:f67a6c6013ca | 7581 | * else if (inSz <= 0xFFFFFFFFFFFFFFFF) {} */ |
wolfSSL | 13:f67a6c6013ca | 7582 | else |
wolfSSL | 13:f67a6c6013ca | 7583 | return; |
wolfSSL | 13:f67a6c6013ca | 7584 | |
wolfSSL | 13:f67a6c6013ca | 7585 | /* start fill out the rest of the first block */ |
wolfSSL | 13:f67a6c6013ca | 7586 | remainder = AES_BLOCK_SIZE - authLenSz; |
wolfSSL | 13:f67a6c6013ca | 7587 | if (inSz >= remainder) { |
wolfSSL | 13:f67a6c6013ca | 7588 | /* plenty of bulk data to fill the remainder of this block */ |
wolfSSL | 13:f67a6c6013ca | 7589 | xorbuf(out + authLenSz, in, remainder); |
wolfSSL | 13:f67a6c6013ca | 7590 | inSz -= remainder; |
wolfSSL | 13:f67a6c6013ca | 7591 | in += remainder; |
wolfSSL | 13:f67a6c6013ca | 7592 | } |
wolfSSL | 13:f67a6c6013ca | 7593 | else { |
wolfSSL | 13:f67a6c6013ca | 7594 | /* not enough bulk data, copy what is available, and pad zero */ |
wolfSSL | 13:f67a6c6013ca | 7595 | xorbuf(out + authLenSz, in, inSz); |
wolfSSL | 13:f67a6c6013ca | 7596 | inSz = 0; |
wolfSSL | 13:f67a6c6013ca | 7597 | } |
wolfSSL | 13:f67a6c6013ca | 7598 | wc_AesEncrypt(aes, out, out); |
wolfSSL | 13:f67a6c6013ca | 7599 | |
wolfSSL | 13:f67a6c6013ca | 7600 | if (inSz > 0) |
wolfSSL | 13:f67a6c6013ca | 7601 | roll_x(aes, in, inSz, out); |
wolfSSL | 13:f67a6c6013ca | 7602 | } |
wolfSSL | 13:f67a6c6013ca | 7603 | |
wolfSSL | 13:f67a6c6013ca | 7604 | |
wolfSSL | 13:f67a6c6013ca | 7605 | static INLINE void AesCcmCtrInc(byte* B, word32 lenSz) |
wolfSSL | 13:f67a6c6013ca | 7606 | { |
wolfSSL | 13:f67a6c6013ca | 7607 | word32 i; |
wolfSSL | 13:f67a6c6013ca | 7608 | |
wolfSSL | 13:f67a6c6013ca | 7609 | for (i = 0; i < lenSz; i++) { |
wolfSSL | 13:f67a6c6013ca | 7610 | if (++B[AES_BLOCK_SIZE - 1 - i] != 0) return; |
wolfSSL | 13:f67a6c6013ca | 7611 | } |
wolfSSL | 13:f67a6c6013ca | 7612 | } |
wolfSSL | 13:f67a6c6013ca | 7613 | |
wolfSSL | 13:f67a6c6013ca | 7614 | /* return 0 on success */ |
wolfSSL | 13:f67a6c6013ca | 7615 | int wc_AesCcmEncrypt(Aes* aes, byte* out, const byte* in, word32 inSz, |
wolfSSL | 13:f67a6c6013ca | 7616 | const byte* nonce, word32 nonceSz, |
wolfSSL | 13:f67a6c6013ca | 7617 | byte* authTag, word32 authTagSz, |
wolfSSL | 13:f67a6c6013ca | 7618 | const byte* authIn, word32 authInSz) |
wolfSSL | 13:f67a6c6013ca | 7619 | { |
wolfSSL | 13:f67a6c6013ca | 7620 | byte A[AES_BLOCK_SIZE]; |
wolfSSL | 13:f67a6c6013ca | 7621 | byte B[AES_BLOCK_SIZE]; |
wolfSSL | 13:f67a6c6013ca | 7622 | byte lenSz; |
wolfSSL | 13:f67a6c6013ca | 7623 | word32 i; |
wolfSSL | 13:f67a6c6013ca | 7624 | byte mask = 0xFF; |
wolfSSL | 13:f67a6c6013ca | 7625 | const word32 wordSz = (word32)sizeof(word32); |
wolfSSL | 13:f67a6c6013ca | 7626 | |
wolfSSL | 13:f67a6c6013ca | 7627 | /* sanity check on arguments */ |
wolfSSL | 13:f67a6c6013ca | 7628 | if (aes == NULL || out == NULL || in == NULL || nonce == NULL |
wolfSSL | 13:f67a6c6013ca | 7629 | || authTag == NULL || nonceSz < 7 || nonceSz > 13) |
wolfSSL | 13:f67a6c6013ca | 7630 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 7631 | |
wolfSSL | 13:f67a6c6013ca | 7632 | XMEMCPY(B+1, nonce, nonceSz); |
wolfSSL | 13:f67a6c6013ca | 7633 | lenSz = AES_BLOCK_SIZE - 1 - (byte)nonceSz; |
wolfSSL | 13:f67a6c6013ca | 7634 | B[0] = (authInSz > 0 ? 64 : 0) |
wolfSSL | 13:f67a6c6013ca | 7635 | + (8 * (((byte)authTagSz - 2) / 2)) |
wolfSSL | 13:f67a6c6013ca | 7636 | + (lenSz - 1); |
wolfSSL | 13:f67a6c6013ca | 7637 | for (i = 0; i < lenSz; i++) { |
wolfSSL | 13:f67a6c6013ca | 7638 | if (mask && i >= wordSz) |
wolfSSL | 13:f67a6c6013ca | 7639 | mask = 0x00; |
wolfSSL | 13:f67a6c6013ca | 7640 | B[AES_BLOCK_SIZE - 1 - i] = (inSz >> ((8 * i) & mask)) & mask; |
wolfSSL | 13:f67a6c6013ca | 7641 | } |
wolfSSL | 13:f67a6c6013ca | 7642 | |
wolfSSL | 13:f67a6c6013ca | 7643 | wc_AesEncrypt(aes, B, A); |
wolfSSL | 13:f67a6c6013ca | 7644 | |
wolfSSL | 13:f67a6c6013ca | 7645 | if (authInSz > 0) |
wolfSSL | 13:f67a6c6013ca | 7646 | roll_auth(aes, authIn, authInSz, A); |
wolfSSL | 13:f67a6c6013ca | 7647 | if (inSz > 0) |
wolfSSL | 13:f67a6c6013ca | 7648 | roll_x(aes, in, inSz, A); |
wolfSSL | 13:f67a6c6013ca | 7649 | XMEMCPY(authTag, A, authTagSz); |
wolfSSL | 13:f67a6c6013ca | 7650 | |
wolfSSL | 13:f67a6c6013ca | 7651 | B[0] = lenSz - 1; |
wolfSSL | 13:f67a6c6013ca | 7652 | for (i = 0; i < lenSz; i++) |
wolfSSL | 13:f67a6c6013ca | 7653 | B[AES_BLOCK_SIZE - 1 - i] = 0; |
wolfSSL | 13:f67a6c6013ca | 7654 | wc_AesEncrypt(aes, B, A); |
wolfSSL | 13:f67a6c6013ca | 7655 | xorbuf(authTag, A, authTagSz); |
wolfSSL | 13:f67a6c6013ca | 7656 | |
wolfSSL | 13:f67a6c6013ca | 7657 | B[15] = 1; |
wolfSSL | 13:f67a6c6013ca | 7658 | while (inSz >= AES_BLOCK_SIZE) { |
wolfSSL | 13:f67a6c6013ca | 7659 | wc_AesEncrypt(aes, B, A); |
wolfSSL | 13:f67a6c6013ca | 7660 | xorbuf(A, in, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7661 | XMEMCPY(out, A, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7662 | |
wolfSSL | 13:f67a6c6013ca | 7663 | AesCcmCtrInc(B, lenSz); |
wolfSSL | 13:f67a6c6013ca | 7664 | inSz -= AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 7665 | in += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 7666 | out += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 7667 | } |
wolfSSL | 13:f67a6c6013ca | 7668 | if (inSz > 0) { |
wolfSSL | 13:f67a6c6013ca | 7669 | wc_AesEncrypt(aes, B, A); |
wolfSSL | 13:f67a6c6013ca | 7670 | xorbuf(A, in, inSz); |
wolfSSL | 13:f67a6c6013ca | 7671 | XMEMCPY(out, A, inSz); |
wolfSSL | 13:f67a6c6013ca | 7672 | } |
wolfSSL | 13:f67a6c6013ca | 7673 | |
wolfSSL | 13:f67a6c6013ca | 7674 | ForceZero(A, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7675 | ForceZero(B, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7676 | |
wolfSSL | 13:f67a6c6013ca | 7677 | return 0; |
wolfSSL | 13:f67a6c6013ca | 7678 | } |
wolfSSL | 13:f67a6c6013ca | 7679 | |
wolfSSL | 13:f67a6c6013ca | 7680 | #ifdef HAVE_AES_DECRYPT |
wolfSSL | 13:f67a6c6013ca | 7681 | int wc_AesCcmDecrypt(Aes* aes, byte* out, const byte* in, word32 inSz, |
wolfSSL | 13:f67a6c6013ca | 7682 | const byte* nonce, word32 nonceSz, |
wolfSSL | 13:f67a6c6013ca | 7683 | const byte* authTag, word32 authTagSz, |
wolfSSL | 13:f67a6c6013ca | 7684 | const byte* authIn, word32 authInSz) |
wolfSSL | 13:f67a6c6013ca | 7685 | { |
wolfSSL | 13:f67a6c6013ca | 7686 | byte A[AES_BLOCK_SIZE]; |
wolfSSL | 13:f67a6c6013ca | 7687 | byte B[AES_BLOCK_SIZE]; |
wolfSSL | 13:f67a6c6013ca | 7688 | byte* o; |
wolfSSL | 13:f67a6c6013ca | 7689 | byte lenSz; |
wolfSSL | 13:f67a6c6013ca | 7690 | word32 i, oSz; |
wolfSSL | 13:f67a6c6013ca | 7691 | int result = 0; |
wolfSSL | 13:f67a6c6013ca | 7692 | byte mask = 0xFF; |
wolfSSL | 13:f67a6c6013ca | 7693 | const word32 wordSz = (word32)sizeof(word32); |
wolfSSL | 13:f67a6c6013ca | 7694 | |
wolfSSL | 13:f67a6c6013ca | 7695 | /* sanity check on arguments */ |
wolfSSL | 13:f67a6c6013ca | 7696 | if (aes == NULL || out == NULL || in == NULL || nonce == NULL |
wolfSSL | 13:f67a6c6013ca | 7697 | || authTag == NULL || nonceSz < 7 || nonceSz > 13) |
wolfSSL | 13:f67a6c6013ca | 7698 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 7699 | |
wolfSSL | 13:f67a6c6013ca | 7700 | o = out; |
wolfSSL | 13:f67a6c6013ca | 7701 | oSz = inSz; |
wolfSSL | 13:f67a6c6013ca | 7702 | XMEMCPY(B+1, nonce, nonceSz); |
wolfSSL | 13:f67a6c6013ca | 7703 | lenSz = AES_BLOCK_SIZE - 1 - (byte)nonceSz; |
wolfSSL | 13:f67a6c6013ca | 7704 | |
wolfSSL | 13:f67a6c6013ca | 7705 | B[0] = lenSz - 1; |
wolfSSL | 13:f67a6c6013ca | 7706 | for (i = 0; i < lenSz; i++) |
wolfSSL | 13:f67a6c6013ca | 7707 | B[AES_BLOCK_SIZE - 1 - i] = 0; |
wolfSSL | 13:f67a6c6013ca | 7708 | B[15] = 1; |
wolfSSL | 13:f67a6c6013ca | 7709 | |
wolfSSL | 13:f67a6c6013ca | 7710 | while (oSz >= AES_BLOCK_SIZE) { |
wolfSSL | 13:f67a6c6013ca | 7711 | wc_AesEncrypt(aes, B, A); |
wolfSSL | 13:f67a6c6013ca | 7712 | xorbuf(A, in, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7713 | XMEMCPY(o, A, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7714 | |
wolfSSL | 13:f67a6c6013ca | 7715 | AesCcmCtrInc(B, lenSz); |
wolfSSL | 13:f67a6c6013ca | 7716 | oSz -= AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 7717 | in += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 7718 | o += AES_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 7719 | } |
wolfSSL | 13:f67a6c6013ca | 7720 | if (inSz > 0) { |
wolfSSL | 13:f67a6c6013ca | 7721 | wc_AesEncrypt(aes, B, A); |
wolfSSL | 13:f67a6c6013ca | 7722 | xorbuf(A, in, oSz); |
wolfSSL | 13:f67a6c6013ca | 7723 | XMEMCPY(o, A, oSz); |
wolfSSL | 13:f67a6c6013ca | 7724 | } |
wolfSSL | 13:f67a6c6013ca | 7725 | |
wolfSSL | 13:f67a6c6013ca | 7726 | for (i = 0; i < lenSz; i++) |
wolfSSL | 13:f67a6c6013ca | 7727 | B[AES_BLOCK_SIZE - 1 - i] = 0; |
wolfSSL | 13:f67a6c6013ca | 7728 | wc_AesEncrypt(aes, B, A); |
wolfSSL | 13:f67a6c6013ca | 7729 | |
wolfSSL | 13:f67a6c6013ca | 7730 | o = out; |
wolfSSL | 13:f67a6c6013ca | 7731 | oSz = inSz; |
wolfSSL | 13:f67a6c6013ca | 7732 | |
wolfSSL | 13:f67a6c6013ca | 7733 | B[0] = (authInSz > 0 ? 64 : 0) |
wolfSSL | 13:f67a6c6013ca | 7734 | + (8 * (((byte)authTagSz - 2) / 2)) |
wolfSSL | 13:f67a6c6013ca | 7735 | + (lenSz - 1); |
wolfSSL | 13:f67a6c6013ca | 7736 | for (i = 0; i < lenSz; i++) { |
wolfSSL | 13:f67a6c6013ca | 7737 | if (mask && i >= wordSz) |
wolfSSL | 13:f67a6c6013ca | 7738 | mask = 0x00; |
wolfSSL | 13:f67a6c6013ca | 7739 | B[AES_BLOCK_SIZE - 1 - i] = (inSz >> ((8 * i) & mask)) & mask; |
wolfSSL | 13:f67a6c6013ca | 7740 | } |
wolfSSL | 13:f67a6c6013ca | 7741 | |
wolfSSL | 13:f67a6c6013ca | 7742 | wc_AesEncrypt(aes, B, A); |
wolfSSL | 13:f67a6c6013ca | 7743 | |
wolfSSL | 13:f67a6c6013ca | 7744 | if (authInSz > 0) |
wolfSSL | 13:f67a6c6013ca | 7745 | roll_auth(aes, authIn, authInSz, A); |
wolfSSL | 13:f67a6c6013ca | 7746 | if (inSz > 0) |
wolfSSL | 13:f67a6c6013ca | 7747 | roll_x(aes, o, oSz, A); |
wolfSSL | 13:f67a6c6013ca | 7748 | |
wolfSSL | 13:f67a6c6013ca | 7749 | B[0] = lenSz - 1; |
wolfSSL | 13:f67a6c6013ca | 7750 | for (i = 0; i < lenSz; i++) |
wolfSSL | 13:f67a6c6013ca | 7751 | B[AES_BLOCK_SIZE - 1 - i] = 0; |
wolfSSL | 13:f67a6c6013ca | 7752 | wc_AesEncrypt(aes, B, B); |
wolfSSL | 13:f67a6c6013ca | 7753 | xorbuf(A, B, authTagSz); |
wolfSSL | 13:f67a6c6013ca | 7754 | |
wolfSSL | 13:f67a6c6013ca | 7755 | if (ConstantCompare(A, authTag, authTagSz) != 0) { |
wolfSSL | 13:f67a6c6013ca | 7756 | /* If the authTag check fails, don't keep the decrypted data. |
wolfSSL | 13:f67a6c6013ca | 7757 | * Unfortunately, you need the decrypted data to calculate the |
wolfSSL | 13:f67a6c6013ca | 7758 | * check value. */ |
wolfSSL | 13:f67a6c6013ca | 7759 | XMEMSET(out, 0, inSz); |
wolfSSL | 13:f67a6c6013ca | 7760 | result = AES_CCM_AUTH_E; |
wolfSSL | 13:f67a6c6013ca | 7761 | } |
wolfSSL | 13:f67a6c6013ca | 7762 | |
wolfSSL | 13:f67a6c6013ca | 7763 | ForceZero(A, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7764 | ForceZero(B, AES_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7765 | o = NULL; |
wolfSSL | 13:f67a6c6013ca | 7766 | |
wolfSSL | 13:f67a6c6013ca | 7767 | return result; |
wolfSSL | 13:f67a6c6013ca | 7768 | } |
wolfSSL | 13:f67a6c6013ca | 7769 | #endif /* HAVE_AES_DECRYPT */ |
wolfSSL | 13:f67a6c6013ca | 7770 | #endif /* software AES CCM */ |
wolfSSL | 13:f67a6c6013ca | 7771 | |
wolfSSL | 13:f67a6c6013ca | 7772 | #endif /* HAVE_AESCCM */ |
wolfSSL | 13:f67a6c6013ca | 7773 | |
wolfSSL | 13:f67a6c6013ca | 7774 | |
wolfSSL | 13:f67a6c6013ca | 7775 | /* Initialize Aes for use with async hardware */ |
wolfSSL | 13:f67a6c6013ca | 7776 | int wc_AesInit(Aes* aes, void* heap, int devId) |
wolfSSL | 13:f67a6c6013ca | 7777 | { |
wolfSSL | 13:f67a6c6013ca | 7778 | int ret = 0; |
wolfSSL | 13:f67a6c6013ca | 7779 | |
wolfSSL | 13:f67a6c6013ca | 7780 | if (aes == NULL) |
wolfSSL | 13:f67a6c6013ca | 7781 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 7782 | |
wolfSSL | 13:f67a6c6013ca | 7783 | aes->heap = heap; |
wolfSSL | 13:f67a6c6013ca | 7784 | |
wolfSSL | 13:f67a6c6013ca | 7785 | #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_AES) |
wolfSSL | 13:f67a6c6013ca | 7786 | ret = wolfAsync_DevCtxInit(&aes->asyncDev, WOLFSSL_ASYNC_MARKER_AES, |
wolfSSL | 13:f67a6c6013ca | 7787 | aes->heap, devId); |
wolfSSL | 13:f67a6c6013ca | 7788 | #else |
wolfSSL | 13:f67a6c6013ca | 7789 | (void)devId; |
wolfSSL | 13:f67a6c6013ca | 7790 | #endif /* WOLFSSL_ASYNC_CRYPT */ |
wolfSSL | 13:f67a6c6013ca | 7791 | |
wolfSSL | 13:f67a6c6013ca | 7792 | return ret; |
wolfSSL | 13:f67a6c6013ca | 7793 | } |
wolfSSL | 13:f67a6c6013ca | 7794 | |
wolfSSL | 13:f67a6c6013ca | 7795 | /* Free Aes from use with async hardware */ |
wolfSSL | 13:f67a6c6013ca | 7796 | void wc_AesFree(Aes* aes) |
wolfSSL | 13:f67a6c6013ca | 7797 | { |
wolfSSL | 13:f67a6c6013ca | 7798 | if (aes == NULL) |
wolfSSL | 13:f67a6c6013ca | 7799 | return; |
wolfSSL | 13:f67a6c6013ca | 7800 | |
wolfSSL | 13:f67a6c6013ca | 7801 | #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_AES) |
wolfSSL | 13:f67a6c6013ca | 7802 | wolfAsync_DevCtxFree(&aes->asyncDev, WOLFSSL_ASYNC_MARKER_AES); |
wolfSSL | 13:f67a6c6013ca | 7803 | #endif /* WOLFSSL_ASYNC_CRYPT */ |
wolfSSL | 13:f67a6c6013ca | 7804 | } |
wolfSSL | 13:f67a6c6013ca | 7805 | |
wolfSSL | 13:f67a6c6013ca | 7806 | |
wolfSSL | 13:f67a6c6013ca | 7807 | int wc_AesGetKeySize(Aes* aes, word32* keySize) |
wolfSSL | 13:f67a6c6013ca | 7808 | { |
wolfSSL | 13:f67a6c6013ca | 7809 | int ret = 0; |
wolfSSL | 13:f67a6c6013ca | 7810 | |
wolfSSL | 13:f67a6c6013ca | 7811 | if (aes == NULL || keySize == NULL) { |
wolfSSL | 13:f67a6c6013ca | 7812 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 7813 | } |
wolfSSL | 13:f67a6c6013ca | 7814 | |
wolfSSL | 13:f67a6c6013ca | 7815 | switch (aes->rounds) { |
wolfSSL | 13:f67a6c6013ca | 7816 | case 10: |
wolfSSL | 13:f67a6c6013ca | 7817 | *keySize = 16; |
wolfSSL | 13:f67a6c6013ca | 7818 | break; |
wolfSSL | 13:f67a6c6013ca | 7819 | case 12: |
wolfSSL | 13:f67a6c6013ca | 7820 | *keySize = 24; |
wolfSSL | 13:f67a6c6013ca | 7821 | break; |
wolfSSL | 13:f67a6c6013ca | 7822 | case 14: |
wolfSSL | 13:f67a6c6013ca | 7823 | *keySize = 32; |
wolfSSL | 13:f67a6c6013ca | 7824 | break; |
wolfSSL | 13:f67a6c6013ca | 7825 | default: |
wolfSSL | 13:f67a6c6013ca | 7826 | *keySize = 0; |
wolfSSL | 13:f67a6c6013ca | 7827 | ret = BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 7828 | } |
wolfSSL | 13:f67a6c6013ca | 7829 | |
wolfSSL | 13:f67a6c6013ca | 7830 | return ret; |
wolfSSL | 13:f67a6c6013ca | 7831 | } |
wolfSSL | 13:f67a6c6013ca | 7832 | |
wolfSSL | 13:f67a6c6013ca | 7833 | #endif /* !WOLFSSL_ARMASM */ |
wolfSSL | 13:f67a6c6013ca | 7834 | #endif /* !WOLFSSL_TI_CRYPT */ |
wolfSSL | 13:f67a6c6013ca | 7835 | |
wolfSSL | 13:f67a6c6013ca | 7836 | |
wolfSSL | 13:f67a6c6013ca | 7837 | #ifdef HAVE_AES_KEYWRAP |
wolfSSL | 13:f67a6c6013ca | 7838 | |
wolfSSL | 13:f67a6c6013ca | 7839 | /* Initialize key wrap counter with value */ |
wolfSSL | 13:f67a6c6013ca | 7840 | static INLINE void InitKeyWrapCounter(byte* inOutCtr, word32 value) |
wolfSSL | 13:f67a6c6013ca | 7841 | { |
wolfSSL | 13:f67a6c6013ca | 7842 | int i; |
wolfSSL | 13:f67a6c6013ca | 7843 | word32 bytes; |
wolfSSL | 13:f67a6c6013ca | 7844 | |
wolfSSL | 13:f67a6c6013ca | 7845 | bytes = sizeof(word32); |
wolfSSL | 13:f67a6c6013ca | 7846 | for (i = 0; i < (int)sizeof(word32); i++) { |
wolfSSL | 13:f67a6c6013ca | 7847 | inOutCtr[i+sizeof(word32)] = (value >> ((bytes - 1) * 8)) & 0xFF; |
wolfSSL | 13:f67a6c6013ca | 7848 | bytes--; |
wolfSSL | 13:f67a6c6013ca | 7849 | } |
wolfSSL | 13:f67a6c6013ca | 7850 | } |
wolfSSL | 13:f67a6c6013ca | 7851 | |
wolfSSL | 13:f67a6c6013ca | 7852 | /* Increment key wrap counter */ |
wolfSSL | 13:f67a6c6013ca | 7853 | static INLINE void IncrementKeyWrapCounter(byte* inOutCtr) |
wolfSSL | 13:f67a6c6013ca | 7854 | { |
wolfSSL | 13:f67a6c6013ca | 7855 | int i; |
wolfSSL | 13:f67a6c6013ca | 7856 | |
wolfSSL | 13:f67a6c6013ca | 7857 | /* in network byte order so start at end and work back */ |
wolfSSL | 13:f67a6c6013ca | 7858 | for (i = KEYWRAP_BLOCK_SIZE - 1; i >= 0; i--) { |
wolfSSL | 13:f67a6c6013ca | 7859 | if (++inOutCtr[i]) /* we're done unless we overflow */ |
wolfSSL | 13:f67a6c6013ca | 7860 | return; |
wolfSSL | 13:f67a6c6013ca | 7861 | } |
wolfSSL | 13:f67a6c6013ca | 7862 | } |
wolfSSL | 13:f67a6c6013ca | 7863 | |
wolfSSL | 13:f67a6c6013ca | 7864 | /* Decrement key wrap counter */ |
wolfSSL | 13:f67a6c6013ca | 7865 | static INLINE void DecrementKeyWrapCounter(byte* inOutCtr) |
wolfSSL | 13:f67a6c6013ca | 7866 | { |
wolfSSL | 13:f67a6c6013ca | 7867 | int i; |
wolfSSL | 13:f67a6c6013ca | 7868 | |
wolfSSL | 13:f67a6c6013ca | 7869 | for (i = KEYWRAP_BLOCK_SIZE - 1; i >= 0; i--) { |
wolfSSL | 13:f67a6c6013ca | 7870 | if (--inOutCtr[i] != 0xFF) /* we're done unless we underflow */ |
wolfSSL | 13:f67a6c6013ca | 7871 | return; |
wolfSSL | 13:f67a6c6013ca | 7872 | } |
wolfSSL | 13:f67a6c6013ca | 7873 | } |
wolfSSL | 13:f67a6c6013ca | 7874 | |
wolfSSL | 13:f67a6c6013ca | 7875 | /* perform AES key wrap (RFC3394), return out sz on success, negative on err */ |
wolfSSL | 13:f67a6c6013ca | 7876 | int wc_AesKeyWrap(const byte* key, word32 keySz, const byte* in, word32 inSz, |
wolfSSL | 13:f67a6c6013ca | 7877 | byte* out, word32 outSz, const byte* iv) |
wolfSSL | 13:f67a6c6013ca | 7878 | { |
wolfSSL | 13:f67a6c6013ca | 7879 | Aes aes; |
wolfSSL | 13:f67a6c6013ca | 7880 | byte* r; |
wolfSSL | 13:f67a6c6013ca | 7881 | word32 i; |
wolfSSL | 13:f67a6c6013ca | 7882 | int ret, j; |
wolfSSL | 13:f67a6c6013ca | 7883 | |
wolfSSL | 13:f67a6c6013ca | 7884 | byte t[KEYWRAP_BLOCK_SIZE]; |
wolfSSL | 13:f67a6c6013ca | 7885 | byte tmp[AES_BLOCK_SIZE]; |
wolfSSL | 13:f67a6c6013ca | 7886 | |
wolfSSL | 13:f67a6c6013ca | 7887 | /* n must be at least 2, output size is n + 8 bytes */ |
wolfSSL | 13:f67a6c6013ca | 7888 | if (key == NULL || in == NULL || inSz < 2 || |
wolfSSL | 13:f67a6c6013ca | 7889 | out == NULL || outSz < (inSz + KEYWRAP_BLOCK_SIZE)) |
wolfSSL | 13:f67a6c6013ca | 7890 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 7891 | |
wolfSSL | 13:f67a6c6013ca | 7892 | /* input must be multiple of 64-bits */ |
wolfSSL | 13:f67a6c6013ca | 7893 | if (inSz % KEYWRAP_BLOCK_SIZE != 0) |
wolfSSL | 13:f67a6c6013ca | 7894 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 7895 | |
wolfSSL | 13:f67a6c6013ca | 7896 | /* user IV is optional */ |
wolfSSL | 13:f67a6c6013ca | 7897 | if (iv == NULL) { |
wolfSSL | 13:f67a6c6013ca | 7898 | XMEMSET(tmp, 0xA6, KEYWRAP_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7899 | } else { |
wolfSSL | 13:f67a6c6013ca | 7900 | XMEMCPY(tmp, iv, KEYWRAP_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7901 | } |
wolfSSL | 13:f67a6c6013ca | 7902 | |
wolfSSL | 13:f67a6c6013ca | 7903 | r = out + 8; |
wolfSSL | 13:f67a6c6013ca | 7904 | XMEMCPY(r, in, inSz); |
wolfSSL | 13:f67a6c6013ca | 7905 | XMEMSET(t, 0, sizeof(t)); |
wolfSSL | 13:f67a6c6013ca | 7906 | |
wolfSSL | 13:f67a6c6013ca | 7907 | ret = wc_AesSetKey(&aes, key, keySz, NULL, AES_ENCRYPTION); |
wolfSSL | 13:f67a6c6013ca | 7908 | if (ret != 0) |
wolfSSL | 13:f67a6c6013ca | 7909 | return ret; |
wolfSSL | 13:f67a6c6013ca | 7910 | |
wolfSSL | 13:f67a6c6013ca | 7911 | for (j = 0; j <= 5; j++) { |
wolfSSL | 13:f67a6c6013ca | 7912 | for (i = 1; i <= inSz / KEYWRAP_BLOCK_SIZE; i++) { |
wolfSSL | 13:f67a6c6013ca | 7913 | |
wolfSSL | 13:f67a6c6013ca | 7914 | /* load R[i] */ |
wolfSSL | 13:f67a6c6013ca | 7915 | XMEMCPY(tmp + KEYWRAP_BLOCK_SIZE, r, KEYWRAP_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7916 | |
wolfSSL | 13:f67a6c6013ca | 7917 | wc_AesEncryptDirect(&aes, tmp, tmp); |
wolfSSL | 13:f67a6c6013ca | 7918 | |
wolfSSL | 13:f67a6c6013ca | 7919 | /* calculate new A */ |
wolfSSL | 13:f67a6c6013ca | 7920 | IncrementKeyWrapCounter(t); |
wolfSSL | 13:f67a6c6013ca | 7921 | xorbuf(tmp, t, KEYWRAP_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7922 | |
wolfSSL | 13:f67a6c6013ca | 7923 | /* save R[i] */ |
wolfSSL | 13:f67a6c6013ca | 7924 | XMEMCPY(r, tmp + KEYWRAP_BLOCK_SIZE, KEYWRAP_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7925 | r += KEYWRAP_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 7926 | } |
wolfSSL | 13:f67a6c6013ca | 7927 | r = out + KEYWRAP_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 7928 | } |
wolfSSL | 13:f67a6c6013ca | 7929 | |
wolfSSL | 13:f67a6c6013ca | 7930 | /* C[0] = A */ |
wolfSSL | 13:f67a6c6013ca | 7931 | XMEMCPY(out, tmp, KEYWRAP_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7932 | |
wolfSSL | 13:f67a6c6013ca | 7933 | return inSz + KEYWRAP_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 7934 | } |
wolfSSL | 13:f67a6c6013ca | 7935 | |
wolfSSL | 13:f67a6c6013ca | 7936 | int wc_AesKeyUnWrap(const byte* key, word32 keySz, const byte* in, word32 inSz, |
wolfSSL | 13:f67a6c6013ca | 7937 | byte* out, word32 outSz, const byte* iv) |
wolfSSL | 13:f67a6c6013ca | 7938 | { |
wolfSSL | 13:f67a6c6013ca | 7939 | Aes aes; |
wolfSSL | 13:f67a6c6013ca | 7940 | byte* r; |
wolfSSL | 13:f67a6c6013ca | 7941 | word32 i, n; |
wolfSSL | 13:f67a6c6013ca | 7942 | int ret, j; |
wolfSSL | 13:f67a6c6013ca | 7943 | |
wolfSSL | 13:f67a6c6013ca | 7944 | byte t[KEYWRAP_BLOCK_SIZE]; |
wolfSSL | 13:f67a6c6013ca | 7945 | byte tmp[AES_BLOCK_SIZE]; |
wolfSSL | 13:f67a6c6013ca | 7946 | |
wolfSSL | 13:f67a6c6013ca | 7947 | const byte* expIv; |
wolfSSL | 13:f67a6c6013ca | 7948 | const byte defaultIV[] = { |
wolfSSL | 13:f67a6c6013ca | 7949 | 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6 |
wolfSSL | 13:f67a6c6013ca | 7950 | }; |
wolfSSL | 13:f67a6c6013ca | 7951 | |
wolfSSL | 13:f67a6c6013ca | 7952 | (void)iv; |
wolfSSL | 13:f67a6c6013ca | 7953 | |
wolfSSL | 13:f67a6c6013ca | 7954 | if (key == NULL || in == NULL || inSz < 3 || |
wolfSSL | 13:f67a6c6013ca | 7955 | out == NULL || outSz < (inSz - KEYWRAP_BLOCK_SIZE)) |
wolfSSL | 13:f67a6c6013ca | 7956 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 7957 | |
wolfSSL | 13:f67a6c6013ca | 7958 | /* input must be multiple of 64-bits */ |
wolfSSL | 13:f67a6c6013ca | 7959 | if (inSz % KEYWRAP_BLOCK_SIZE != 0) |
wolfSSL | 13:f67a6c6013ca | 7960 | return BAD_FUNC_ARG; |
wolfSSL | 13:f67a6c6013ca | 7961 | |
wolfSSL | 13:f67a6c6013ca | 7962 | /* user IV optional */ |
wolfSSL | 13:f67a6c6013ca | 7963 | if (iv != NULL) { |
wolfSSL | 13:f67a6c6013ca | 7964 | expIv = iv; |
wolfSSL | 13:f67a6c6013ca | 7965 | } else { |
wolfSSL | 13:f67a6c6013ca | 7966 | expIv = defaultIV; |
wolfSSL | 13:f67a6c6013ca | 7967 | } |
wolfSSL | 13:f67a6c6013ca | 7968 | |
wolfSSL | 13:f67a6c6013ca | 7969 | /* A = C[0], R[i] = C[i] */ |
wolfSSL | 13:f67a6c6013ca | 7970 | XMEMCPY(tmp, in, KEYWRAP_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7971 | XMEMCPY(out, in + KEYWRAP_BLOCK_SIZE, inSz - KEYWRAP_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7972 | XMEMSET(t, 0, sizeof(t)); |
wolfSSL | 13:f67a6c6013ca | 7973 | |
wolfSSL | 13:f67a6c6013ca | 7974 | ret = wc_AesSetKey(&aes, key, keySz, NULL, AES_DECRYPTION); |
wolfSSL | 13:f67a6c6013ca | 7975 | if (ret != 0) |
wolfSSL | 13:f67a6c6013ca | 7976 | return ret; |
wolfSSL | 13:f67a6c6013ca | 7977 | |
wolfSSL | 13:f67a6c6013ca | 7978 | /* initialize counter to 6n */ |
wolfSSL | 13:f67a6c6013ca | 7979 | n = (inSz - 1) / KEYWRAP_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 7980 | InitKeyWrapCounter(t, 6 * n); |
wolfSSL | 13:f67a6c6013ca | 7981 | |
wolfSSL | 13:f67a6c6013ca | 7982 | for (j = 5; j >= 0; j--) { |
wolfSSL | 13:f67a6c6013ca | 7983 | for (i = n; i >= 1; i--) { |
wolfSSL | 13:f67a6c6013ca | 7984 | |
wolfSSL | 13:f67a6c6013ca | 7985 | /* calculate A */ |
wolfSSL | 13:f67a6c6013ca | 7986 | xorbuf(tmp, t, KEYWRAP_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7987 | DecrementKeyWrapCounter(t); |
wolfSSL | 13:f67a6c6013ca | 7988 | |
wolfSSL | 13:f67a6c6013ca | 7989 | /* load R[i], starting at end of R */ |
wolfSSL | 13:f67a6c6013ca | 7990 | r = out + ((i - 1) * KEYWRAP_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7991 | XMEMCPY(tmp + KEYWRAP_BLOCK_SIZE, r, KEYWRAP_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7992 | wc_AesDecryptDirect(&aes, tmp, tmp); |
wolfSSL | 13:f67a6c6013ca | 7993 | |
wolfSSL | 13:f67a6c6013ca | 7994 | /* save R[i] */ |
wolfSSL | 13:f67a6c6013ca | 7995 | XMEMCPY(r, tmp + KEYWRAP_BLOCK_SIZE, KEYWRAP_BLOCK_SIZE); |
wolfSSL | 13:f67a6c6013ca | 7996 | } |
wolfSSL | 13:f67a6c6013ca | 7997 | } |
wolfSSL | 13:f67a6c6013ca | 7998 | |
wolfSSL | 13:f67a6c6013ca | 7999 | /* verify IV */ |
wolfSSL | 13:f67a6c6013ca | 8000 | if (XMEMCMP(tmp, expIv, KEYWRAP_BLOCK_SIZE) != 0) |
wolfSSL | 13:f67a6c6013ca | 8001 | return BAD_KEYWRAP_IV_E; |
wolfSSL | 13:f67a6c6013ca | 8002 | |
wolfSSL | 13:f67a6c6013ca | 8003 | return inSz - KEYWRAP_BLOCK_SIZE; |
wolfSSL | 13:f67a6c6013ca | 8004 | } |
wolfSSL | 13:f67a6c6013ca | 8005 | |
wolfSSL | 13:f67a6c6013ca | 8006 | #endif /* HAVE_AES_KEYWRAP */ |
wolfSSL | 13:f67a6c6013ca | 8007 | |
wolfSSL | 13:f67a6c6013ca | 8008 | #endif /* HAVE_FIPS */ |
wolfSSL | 13:f67a6c6013ca | 8009 | #endif /* !NO_AES */ |
wolfSSL | 13:f67a6c6013ca | 8010 |