1214501Srpaulo/* 2214501Srpaulo * AES (Rijndael) cipher - decrypt 3214501Srpaulo * 4214501Srpaulo * Modifications to public domain implementation: 5214501Srpaulo * - cleanup 6214501Srpaulo * - use C pre-processor to make it easier to change S table access 7214501Srpaulo * - added option (AES_SMALL_TABLES) for reducing code size by about 8 kB at 8214501Srpaulo * cost of reduced throughput (quite small difference on Pentium 4, 9214501Srpaulo * 10-25% when using -O1 or -O2 optimization) 10214501Srpaulo * 11252726Srpaulo * Copyright (c) 2003-2012, Jouni Malinen <j@w1.fi> 12214501Srpaulo * 13252726Srpaulo * This software may be distributed under the terms of the BSD license. 14252726Srpaulo * See README for more details. 15214501Srpaulo */ 16214501Srpaulo 17214501Srpaulo#include "includes.h" 18214501Srpaulo 19214501Srpaulo#include "common.h" 20214501Srpaulo#include "crypto.h" 21214501Srpaulo#include "aes_i.h" 22214501Srpaulo 23214501Srpaulo/** 24214501Srpaulo * Expand the cipher key into the decryption key schedule. 25214501Srpaulo * 26214501Srpaulo * @return the number of rounds for the given cipher key size. 27214501Srpaulo */ 28252726Srpaulostatic int rijndaelKeySetupDec(u32 rk[], const u8 cipherKey[], int keyBits) 29214501Srpaulo{ 30252726Srpaulo int Nr, i, j; 31214501Srpaulo u32 temp; 32214501Srpaulo 33214501Srpaulo /* expand the cipher key: */ 34252726Srpaulo Nr = rijndaelKeySetupEnc(rk, cipherKey, keyBits); 35252726Srpaulo if (Nr < 0) 36252726Srpaulo return Nr; 37214501Srpaulo /* invert the order of the round keys: */ 38214501Srpaulo for (i = 0, j = 4*Nr; i < j; i += 4, j -= 4) { 39214501Srpaulo temp = rk[i ]; rk[i ] = rk[j ]; rk[j ] = temp; 40214501Srpaulo temp = rk[i + 1]; rk[i + 1] = rk[j + 1]; rk[j + 1] = temp; 41214501Srpaulo temp = rk[i + 2]; rk[i + 2] = rk[j + 2]; rk[j + 2] = temp; 42214501Srpaulo temp = rk[i + 3]; rk[i + 3] = rk[j + 3]; rk[j + 3] = temp; 43214501Srpaulo } 44214501Srpaulo /* apply the inverse MixColumn transform to all round keys but the 45214501Srpaulo * first and the last: */ 46214501Srpaulo for (i = 1; i < Nr; i++) { 47214501Srpaulo rk += 4; 48214501Srpaulo for (j = 0; j < 4; j++) { 49214501Srpaulo rk[j] = TD0_(TE4((rk[j] >> 24) )) ^ 50214501Srpaulo TD1_(TE4((rk[j] >> 16) & 0xff)) ^ 51214501Srpaulo TD2_(TE4((rk[j] >> 8) & 0xff)) ^ 52214501Srpaulo TD3_(TE4((rk[j] ) & 0xff)); 53214501Srpaulo } 54214501Srpaulo } 55252726Srpaulo 56252726Srpaulo return Nr; 57214501Srpaulo} 58214501Srpaulo 59214501Srpaulovoid * aes_decrypt_init(const u8 *key, size_t len) 60214501Srpaulo{ 61214501Srpaulo u32 *rk; 62252726Srpaulo int res; 63214501Srpaulo rk = os_malloc(AES_PRIV_SIZE); 64214501Srpaulo if (rk == NULL) 65214501Srpaulo return NULL; 66252726Srpaulo res = rijndaelKeySetupDec(rk, key, len * 8); 67252726Srpaulo if (res < 0) { 68252726Srpaulo os_free(rk); 69252726Srpaulo return NULL; 70252726Srpaulo } 71252726Srpaulo rk[AES_PRIV_NR_POS] = res; 72214501Srpaulo return rk; 73214501Srpaulo} 74214501Srpaulo 75252726Srpaulostatic void rijndaelDecrypt(const u32 rk[/*44*/], int Nr, const u8 ct[16], 76252726Srpaulo u8 pt[16]) 77214501Srpaulo{ 78214501Srpaulo u32 s0, s1, s2, s3, t0, t1, t2, t3; 79214501Srpaulo#ifndef FULL_UNROLL 80214501Srpaulo int r; 81214501Srpaulo#endif /* ?FULL_UNROLL */ 82214501Srpaulo 83214501Srpaulo /* 84214501Srpaulo * map byte array block to cipher state 85214501Srpaulo * and add initial round key: 86214501Srpaulo */ 87214501Srpaulo s0 = GETU32(ct ) ^ rk[0]; 88214501Srpaulo s1 = GETU32(ct + 4) ^ rk[1]; 89214501Srpaulo s2 = GETU32(ct + 8) ^ rk[2]; 90214501Srpaulo s3 = GETU32(ct + 12) ^ rk[3]; 91214501Srpaulo 92214501Srpaulo#define ROUND(i,d,s) \ 93214501Srpaulod##0 = TD0(s##0) ^ TD1(s##3) ^ TD2(s##2) ^ TD3(s##1) ^ rk[4 * i]; \ 94214501Srpaulod##1 = TD0(s##1) ^ TD1(s##0) ^ TD2(s##3) ^ TD3(s##2) ^ rk[4 * i + 1]; \ 95214501Srpaulod##2 = TD0(s##2) ^ TD1(s##1) ^ TD2(s##0) ^ TD3(s##3) ^ rk[4 * i + 2]; \ 96214501Srpaulod##3 = TD0(s##3) ^ TD1(s##2) ^ TD2(s##1) ^ TD3(s##0) ^ rk[4 * i + 3] 97214501Srpaulo 98214501Srpaulo#ifdef FULL_UNROLL 99214501Srpaulo 100214501Srpaulo ROUND(1,t,s); 101214501Srpaulo ROUND(2,s,t); 102214501Srpaulo ROUND(3,t,s); 103214501Srpaulo ROUND(4,s,t); 104214501Srpaulo ROUND(5,t,s); 105214501Srpaulo ROUND(6,s,t); 106214501Srpaulo ROUND(7,t,s); 107214501Srpaulo ROUND(8,s,t); 108214501Srpaulo ROUND(9,t,s); 109252726Srpaulo if (Nr > 10) { 110252726Srpaulo ROUND(10,s,t); 111252726Srpaulo ROUND(11,t,s); 112252726Srpaulo if (Nr > 12) { 113252726Srpaulo ROUND(12,s,t); 114252726Srpaulo ROUND(13,t,s); 115252726Srpaulo } 116252726Srpaulo } 117214501Srpaulo 118214501Srpaulo rk += Nr << 2; 119214501Srpaulo 120214501Srpaulo#else /* !FULL_UNROLL */ 121214501Srpaulo 122214501Srpaulo /* Nr - 1 full rounds: */ 123214501Srpaulo r = Nr >> 1; 124214501Srpaulo for (;;) { 125214501Srpaulo ROUND(1,t,s); 126214501Srpaulo rk += 8; 127214501Srpaulo if (--r == 0) 128214501Srpaulo break; 129214501Srpaulo ROUND(0,s,t); 130214501Srpaulo } 131214501Srpaulo 132214501Srpaulo#endif /* ?FULL_UNROLL */ 133214501Srpaulo 134214501Srpaulo#undef ROUND 135214501Srpaulo 136214501Srpaulo /* 137214501Srpaulo * apply last round and 138214501Srpaulo * map cipher state to byte array block: 139214501Srpaulo */ 140214501Srpaulo s0 = TD41(t0) ^ TD42(t3) ^ TD43(t2) ^ TD44(t1) ^ rk[0]; 141214501Srpaulo PUTU32(pt , s0); 142214501Srpaulo s1 = TD41(t1) ^ TD42(t0) ^ TD43(t3) ^ TD44(t2) ^ rk[1]; 143214501Srpaulo PUTU32(pt + 4, s1); 144214501Srpaulo s2 = TD41(t2) ^ TD42(t1) ^ TD43(t0) ^ TD44(t3) ^ rk[2]; 145214501Srpaulo PUTU32(pt + 8, s2); 146214501Srpaulo s3 = TD41(t3) ^ TD42(t2) ^ TD43(t1) ^ TD44(t0) ^ rk[3]; 147214501Srpaulo PUTU32(pt + 12, s3); 148214501Srpaulo} 149214501Srpaulo 150346981Scy 151346981Scyint aes_decrypt(void *ctx, const u8 *crypt, u8 *plain) 152214501Srpaulo{ 153252726Srpaulo u32 *rk = ctx; 154252726Srpaulo rijndaelDecrypt(ctx, rk[AES_PRIV_NR_POS], crypt, plain); 155346981Scy return 0; 156214501Srpaulo} 157214501Srpaulo 158214501Srpaulo 159214501Srpaulovoid aes_decrypt_deinit(void *ctx) 160214501Srpaulo{ 161214501Srpaulo os_memset(ctx, 0, AES_PRIV_SIZE); 162214501Srpaulo os_free(ctx); 163214501Srpaulo} 164