cvs.zerfleddert.de Git - proxmark3-svn/blob - common/polarssl/aes.c

   1 /*
   2  *  FIPS-197 compliant AES implementation
   3  *
   4  *  Copyright (C) 2006-2014, Brainspark B.V.
   5  *
   6  *  This file is part of PolarSSL (http://www.polarssl.org)
   7  *  Lead Maintainer: Paul Bakker <polarssl_maintainer at polarssl.org>
   8  *
   9  *  All rights reserved.
  10  *
  11  *  This program is free software; you can redistribute it and/or modify
  12  *  it under the terms of the GNU General Public License as published by
  13  *  the Free Software Foundation; either version 2 of the License, or
  14  *  (at your option) any later version.
  15  *
  16  *  This program is distributed in the hope that it will be useful,
  17  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  *  GNU General Public License for more details.
  20  *
  21  *  You should have received a copy of the GNU General Public License along
  22  *  with this program; if not, write to the Free Software Foundation, Inc.,
  23  *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  24  */
  25 /*
  26  *  The AES block cipher was designed by Vincent Rijmen and Joan Daemen.
  27  *
  28  *  http://csrc.nist.gov/encryption/aes/rijndael/Rijndael.pdf
  29  *  http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf
  30  */
  31
  32 #if !defined(POLARSSL_CONFIG_FILE)
  33 #include "polarssl_config.h"
  34 #else
  35 #include POLARSSL_CONFIG_FILE
  36 #endif
  37
  38 #if defined(POLARSSL_AES_C)
  39
  40 #include "aes.h"
  41 #if defined(POLARSSL_PADLOCK_C)
  42 #include "polarssl/padlock.h"
  43 #endif
  44 #if defined(POLARSSL_AESNI_C)
  45 #include "polarssl/aesni.h"
  46 #endif
  47
  48 #if defined(POLARSSL_PLATFORM_C)
  49 #include "polarssl/platform.h"
  50 #else
  51 #define polarssl_printf printf
  52 #endif
  53
  54 #if !defined(POLARSSL_AES_ALT)
  55
  56 /* Implementation that should never be optimized out by the compiler */
  57 static void polarssl_zeroize( void *v, size_t n ) {
  58     volatile unsigned char *p = v; while( n-- ) *p++ = 0;
  59 }
  60
  61 /*
  62  * 32-bit integer manipulation macros (little endian)
  63  */
  64 #ifndef GET_UINT32_LE
  65 #define GET_UINT32_LE(n,b,i)                            \
  66 {                                                       \
  67     (n) = ( (uint32_t) (b)[(i)    ]       )             \
  68         | ( (uint32_t) (b)[(i) + 1] <<  8 )             \
  69         | ( (uint32_t) (b)[(i) + 2] << 16 )             \
  70         | ( (uint32_t) (b)[(i) + 3] << 24 );            \
  71 }
  72 #endif
  73
  74 #ifndef PUT_UINT32_LE
  75 #define PUT_UINT32_LE(n,b,i)                            \
  76 {                                                       \
  77     (b)[(i)    ] = (unsigned char) ( (n)       );       \
  78     (b)[(i) + 1] = (unsigned char) ( (n) >>  8 );       \
  79     (b)[(i) + 2] = (unsigned char) ( (n) >> 16 );       \
  80     (b)[(i) + 3] = (unsigned char) ( (n) >> 24 );       \
  81 }
  82 #endif
  83
  84 #if defined(POLARSSL_PADLOCK_C) &&                      \
  85     ( defined(POLARSSL_HAVE_X86) || defined(PADLOCK_ALIGN16) )
  86 static int aes_padlock_ace = -1;
  87 #endif
  88
  89 #if defined(POLARSSL_AES_ROM_TABLES)
  90 /*
  91  * Forward S-box
  92  */
  93 static const unsigned char FSb[256] =
  94 {
  95     0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5,
  96     0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76,
  97     0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0,
  98     0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0,
  99     0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC,
 100     0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,
 101     0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A,
 102     0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75,
 103     0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0,
 104     0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84,
 105     0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B,
 106     0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,
 107     0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85,
 108     0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8,
 109     0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5,
 110     0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2,
 111     0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17,
 112     0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73,
 113     0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88,
 114     0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB,
 115     0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C,
 116     0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79,
 117     0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9,
 118     0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08,
 119     0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6,
 120     0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A,
 121     0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E,
 122     0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E,
 123     0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94,
 124     0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,
 125     0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68,
 126     0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16
 127 };
 128
 129 /*
 130  * Forward tables
 131  */
 132 #define FT \
 133 \
 134     V(A5,63,63,C6), V(84,7C,7C,F8), V(99,77,77,EE), V(8D,7B,7B,F6), \
 135     V(0D,F2,F2,FF), V(BD,6B,6B,D6), V(B1,6F,6F,DE), V(54,C5,C5,91), \
 136     V(50,30,30,60), V(03,01,01,02), V(A9,67,67,CE), V(7D,2B,2B,56), \
 137     V(19,FE,FE,E7), V(62,D7,D7,B5), V(E6,AB,AB,4D), V(9A,76,76,EC), \
 138     V(45,CA,CA,8F), V(9D,82,82,1F), V(40,C9,C9,89), V(87,7D,7D,FA), \
 139     V(15,FA,FA,EF), V(EB,59,59,B2), V(C9,47,47,8E), V(0B,F0,F0,FB), \
 140     V(EC,AD,AD,41), V(67,D4,D4,B3), V(FD,A2,A2,5F), V(EA,AF,AF,45), \
 141     V(BF,9C,9C,23), V(F7,A4,A4,53), V(96,72,72,E4), V(5B,C0,C0,9B), \
 142     V(C2,B7,B7,75), V(1C,FD,FD,E1), V(AE,93,93,3D), V(6A,26,26,4C), \
 143     V(5A,36,36,6C), V(41,3F,3F,7E), V(02,F7,F7,F5), V(4F,CC,CC,83), \
 144     V(5C,34,34,68), V(F4,A5,A5,51), V(34,E5,E5,D1), V(08,F1,F1,F9), \
 145     V(93,71,71,E2), V(73,D8,D8,AB), V(53,31,31,62), V(3F,15,15,2A), \
 146     V(0C,04,04,08), V(52,C7,C7,95), V(65,23,23,46), V(5E,C3,C3,9D), \
 147     V(28,18,18,30), V(A1,96,96,37), V(0F,05,05,0A), V(B5,9A,9A,2F), \
 148     V(09,07,07,0E), V(36,12,12,24), V(9B,80,80,1B), V(3D,E2,E2,DF), \
 149     V(26,EB,EB,CD), V(69,27,27,4E), V(CD,B2,B2,7F), V(9F,75,75,EA), \
 150     V(1B,09,09,12), V(9E,83,83,1D), V(74,2C,2C,58), V(2E,1A,1A,34), \
 151     V(2D,1B,1B,36), V(B2,6E,6E,DC), V(EE,5A,5A,B4), V(FB,A0,A0,5B), \
 152     V(F6,52,52,A4), V(4D,3B,3B,76), V(61,D6,D6,B7), V(CE,B3,B3,7D), \
 153     V(7B,29,29,52), V(3E,E3,E3,DD), V(71,2F,2F,5E), V(97,84,84,13), \
 154     V(F5,53,53,A6), V(68,D1,D1,B9), V(00,00,00,00), V(2C,ED,ED,C1), \
 155     V(60,20,20,40), V(1F,FC,FC,E3), V(C8,B1,B1,79), V(ED,5B,5B,B6), \
 156     V(BE,6A,6A,D4), V(46,CB,CB,8D), V(D9,BE,BE,67), V(4B,39,39,72), \
 157     V(DE,4A,4A,94), V(D4,4C,4C,98), V(E8,58,58,B0), V(4A,CF,CF,85), \
 158     V(6B,D0,D0,BB), V(2A,EF,EF,C5), V(E5,AA,AA,4F), V(16,FB,FB,ED), \
 159     V(C5,43,43,86), V(D7,4D,4D,9A), V(55,33,33,66), V(94,85,85,11), \
 160     V(CF,45,45,8A), V(10,F9,F9,E9), V(06,02,02,04), V(81,7F,7F,FE), \
 161     V(F0,50,50,A0), V(44,3C,3C,78), V(BA,9F,9F,25), V(E3,A8,A8,4B), \
 162     V(F3,51,51,A2), V(FE,A3,A3,5D), V(C0,40,40,80), V(8A,8F,8F,05), \
 163     V(AD,92,92,3F), V(BC,9D,9D,21), V(48,38,38,70), V(04,F5,F5,F1), \
 164     V(DF,BC,BC,63), V(C1,B6,B6,77), V(75,DA,DA,AF), V(63,21,21,42), \
 165     V(30,10,10,20), V(1A,FF,FF,E5), V(0E,F3,F3,FD), V(6D,D2,D2,BF), \
 166     V(4C,CD,CD,81), V(14,0C,0C,18), V(35,13,13,26), V(2F,EC,EC,C3), \
 167     V(E1,5F,5F,BE), V(A2,97,97,35), V(CC,44,44,88), V(39,17,17,2E), \
 168     V(57,C4,C4,93), V(F2,A7,A7,55), V(82,7E,7E,FC), V(47,3D,3D,7A), \
 169     V(AC,64,64,C8), V(E7,5D,5D,BA), V(2B,19,19,32), V(95,73,73,E6), \
 170     V(A0,60,60,C0), V(98,81,81,19), V(D1,4F,4F,9E), V(7F,DC,DC,A3), \
 171     V(66,22,22,44), V(7E,2A,2A,54), V(AB,90,90,3B), V(83,88,88,0B), \
 172     V(CA,46,46,8C), V(29,EE,EE,C7), V(D3,B8,B8,6B), V(3C,14,14,28), \
 173     V(79,DE,DE,A7), V(E2,5E,5E,BC), V(1D,0B,0B,16), V(76,DB,DB,AD), \
 174     V(3B,E0,E0,DB), V(56,32,32,64), V(4E,3A,3A,74), V(1E,0A,0A,14), \
 175     V(DB,49,49,92), V(0A,06,06,0C), V(6C,24,24,48), V(E4,5C,5C,B8), \
 176     V(5D,C2,C2,9F), V(6E,D3,D3,BD), V(EF,AC,AC,43), V(A6,62,62,C4), \
 177     V(A8,91,91,39), V(A4,95,95,31), V(37,E4,E4,D3), V(8B,79,79,F2), \
 178     V(32,E7,E7,D5), V(43,C8,C8,8B), V(59,37,37,6E), V(B7,6D,6D,DA), \
 179     V(8C,8D,8D,01), V(64,D5,D5,B1), V(D2,4E,4E,9C), V(E0,A9,A9,49), \
 180     V(B4,6C,6C,D8), V(FA,56,56,AC), V(07,F4,F4,F3), V(25,EA,EA,CF), \
 181     V(AF,65,65,CA), V(8E,7A,7A,F4), V(E9,AE,AE,47), V(18,08,08,10), \
 182     V(D5,BA,BA,6F), V(88,78,78,F0), V(6F,25,25,4A), V(72,2E,2E,5C), \
 183     V(24,1C,1C,38), V(F1,A6,A6,57), V(C7,B4,B4,73), V(51,C6,C6,97), \
 184     V(23,E8,E8,CB), V(7C,DD,DD,A1), V(9C,74,74,E8), V(21,1F,1F,3E), \
 185     V(DD,4B,4B,96), V(DC,BD,BD,61), V(86,8B,8B,0D), V(85,8A,8A,0F), \
 186     V(90,70,70,E0), V(42,3E,3E,7C), V(C4,B5,B5,71), V(AA,66,66,CC), \
 187     V(D8,48,48,90), V(05,03,03,06), V(01,F6,F6,F7), V(12,0E,0E,1C), \
 188     V(A3,61,61,C2), V(5F,35,35,6A), V(F9,57,57,AE), V(D0,B9,B9,69), \
 189     V(91,86,86,17), V(58,C1,C1,99), V(27,1D,1D,3A), V(B9,9E,9E,27), \
 190     V(38,E1,E1,D9), V(13,F8,F8,EB), V(B3,98,98,2B), V(33,11,11,22), \
 191     V(BB,69,69,D2), V(70,D9,D9,A9), V(89,8E,8E,07), V(A7,94,94,33), \
 192     V(B6,9B,9B,2D), V(22,1E,1E,3C), V(92,87,87,15), V(20,E9,E9,C9), \
 193     V(49,CE,CE,87), V(FF,55,55,AA), V(78,28,28,50), V(7A,DF,DF,A5), \
 194     V(8F,8C,8C,03), V(F8,A1,A1,59), V(80,89,89,09), V(17,0D,0D,1A), \
 195     V(DA,BF,BF,65), V(31,E6,E6,D7), V(C6,42,42,84), V(B8,68,68,D0), \
 196     V(C3,41,41,82), V(B0,99,99,29), V(77,2D,2D,5A), V(11,0F,0F,1E), \
 197     V(CB,B0,B0,7B), V(FC,54,54,A8), V(D6,BB,BB,6D), V(3A,16,16,2C)
 198
 199 #define V(a,b,c,d) 0x##a##b##c##d
 200 static const uint32_t FT0[256] = { FT };
 201 #undef V
 202
 203 #define V(a,b,c,d) 0x##b##c##d##a
 204 static const uint32_t FT1[256] = { FT };
 205 #undef V
 206
 207 #define V(a,b,c,d) 0x##c##d##a##b
 208 static const uint32_t FT2[256] = { FT };
 209 #undef V
 210
 211 #define V(a,b,c,d) 0x##d##a##b##c
 212 static const uint32_t FT3[256] = { FT };
 213 #undef V
 214
 215 #undef FT
 216
 217 /*
 218  * Reverse S-box
 219  */
 220 static const unsigned char RSb[256] =
 221 {
 222     0x52, 0x09, 0x6A, 0xD5, 0x30, 0x36, 0xA5, 0x38,
 223     0xBF, 0x40, 0xA3, 0x9E, 0x81, 0xF3, 0xD7, 0xFB,
 224     0x7C, 0xE3, 0x39, 0x82, 0x9B, 0x2F, 0xFF, 0x87,
 225     0x34, 0x8E, 0x43, 0x44, 0xC4, 0xDE, 0xE9, 0xCB,
 226     0x54, 0x7B, 0x94, 0x32, 0xA6, 0xC2, 0x23, 0x3D,
 227     0xEE, 0x4C, 0x95, 0x0B, 0x42, 0xFA, 0xC3, 0x4E,
 228     0x08, 0x2E, 0xA1, 0x66, 0x28, 0xD9, 0x24, 0xB2,
 229     0x76, 0x5B, 0xA2, 0x49, 0x6D, 0x8B, 0xD1, 0x25,
 230     0x72, 0xF8, 0xF6, 0x64, 0x86, 0x68, 0x98, 0x16,
 231     0xD4, 0xA4, 0x5C, 0xCC, 0x5D, 0x65, 0xB6, 0x92,
 232     0x6C, 0x70, 0x48, 0x50, 0xFD, 0xED, 0xB9, 0xDA,
 233     0x5E, 0x15, 0x46, 0x57, 0xA7, 0x8D, 0x9D, 0x84,
 234     0x90, 0xD8, 0xAB, 0x00, 0x8C, 0xBC, 0xD3, 0x0A,
 235     0xF7, 0xE4, 0x58, 0x05, 0xB8, 0xB3, 0x45, 0x06,
 236     0xD0, 0x2C, 0x1E, 0x8F, 0xCA, 0x3F, 0x0F, 0x02,
 237     0xC1, 0xAF, 0xBD, 0x03, 0x01, 0x13, 0x8A, 0x6B,
 238     0x3A, 0x91, 0x11, 0x41, 0x4F, 0x67, 0xDC, 0xEA,
 239     0x97, 0xF2, 0xCF, 0xCE, 0xF0, 0xB4, 0xE6, 0x73,
 240     0x96, 0xAC, 0x74, 0x22, 0xE7, 0xAD, 0x35, 0x85,
 241     0xE2, 0xF9, 0x37, 0xE8, 0x1C, 0x75, 0xDF, 0x6E,
 242     0x47, 0xF1, 0x1A, 0x71, 0x1D, 0x29, 0xC5, 0x89,
 243     0x6F, 0xB7, 0x62, 0x0E, 0xAA, 0x18, 0xBE, 0x1B,
 244     0xFC, 0x56, 0x3E, 0x4B, 0xC6, 0xD2, 0x79, 0x20,
 245     0x9A, 0xDB, 0xC0, 0xFE, 0x78, 0xCD, 0x5A, 0xF4,
 246     0x1F, 0xDD, 0xA8, 0x33, 0x88, 0x07, 0xC7, 0x31,
 247     0xB1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xEC, 0x5F,
 248     0x60, 0x51, 0x7F, 0xA9, 0x19, 0xB5, 0x4A, 0x0D,
 249     0x2D, 0xE5, 0x7A, 0x9F, 0x93, 0xC9, 0x9C, 0xEF,
 250     0xA0, 0xE0, 0x3B, 0x4D, 0xAE, 0x2A, 0xF5, 0xB0,
 251     0xC8, 0xEB, 0xBB, 0x3C, 0x83, 0x53, 0x99, 0x61,
 252     0x17, 0x2B, 0x04, 0x7E, 0xBA, 0x77, 0xD6, 0x26,
 253     0xE1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0C, 0x7D
 254 };
 255
 256 /*
 257  * Reverse tables
 258  */
 259 #define RT \
 260 \
 261     V(50,A7,F4,51), V(53,65,41,7E), V(C3,A4,17,1A), V(96,5E,27,3A), \
 262     V(CB,6B,AB,3B), V(F1,45,9D,1F), V(AB,58,FA,AC), V(93,03,E3,4B), \
 263     V(55,FA,30,20), V(F6,6D,76,AD), V(91,76,CC,88), V(25,4C,02,F5), \
 264     V(FC,D7,E5,4F), V(D7,CB,2A,C5), V(80,44,35,26), V(8F,A3,62,B5), \
 265     V(49,5A,B1,DE), V(67,1B,BA,25), V(98,0E,EA,45), V(E1,C0,FE,5D), \
 266     V(02,75,2F,C3), V(12,F0,4C,81), V(A3,97,46,8D), V(C6,F9,D3,6B), \
 267     V(E7,5F,8F,03), V(95,9C,92,15), V(EB,7A,6D,BF), V(DA,59,52,95), \
 268     V(2D,83,BE,D4), V(D3,21,74,58), V(29,69,E0,49), V(44,C8,C9,8E), \
 269     V(6A,89,C2,75), V(78,79,8E,F4), V(6B,3E,58,99), V(DD,71,B9,27), \
 270     V(B6,4F,E1,BE), V(17,AD,88,F0), V(66,AC,20,C9), V(B4,3A,CE,7D), \
 271     V(18,4A,DF,63), V(82,31,1A,E5), V(60,33,51,97), V(45,7F,53,62), \
 272     V(E0,77,64,B1), V(84,AE,6B,BB), V(1C,A0,81,FE), V(94,2B,08,F9), \
 273     V(58,68,48,70), V(19,FD,45,8F), V(87,6C,DE,94), V(B7,F8,7B,52), \
 274     V(23,D3,73,AB), V(E2,02,4B,72), V(57,8F,1F,E3), V(2A,AB,55,66), \
 275     V(07,28,EB,B2), V(03,C2,B5,2F), V(9A,7B,C5,86), V(A5,08,37,D3), \
 276     V(F2,87,28,30), V(B2,A5,BF,23), V(BA,6A,03,02), V(5C,82,16,ED), \
 277     V(2B,1C,CF,8A), V(92,B4,79,A7), V(F0,F2,07,F3), V(A1,E2,69,4E), \
 278     V(CD,F4,DA,65), V(D5,BE,05,06), V(1F,62,34,D1), V(8A,FE,A6,C4), \
 279     V(9D,53,2E,34), V(A0,55,F3,A2), V(32,E1,8A,05), V(75,EB,F6,A4), \
 280     V(39,EC,83,0B), V(AA,EF,60,40), V(06,9F,71,5E), V(51,10,6E,BD), \
 281     V(F9,8A,21,3E), V(3D,06,DD,96), V(AE,05,3E,DD), V(46,BD,E6,4D), \
 282     V(B5,8D,54,91), V(05,5D,C4,71), V(6F,D4,06,04), V(FF,15,50,60), \
 283     V(24,FB,98,19), V(97,E9,BD,D6), V(CC,43,40,89), V(77,9E,D9,67), \
 284     V(BD,42,E8,B0), V(88,8B,89,07), V(38,5B,19,E7), V(DB,EE,C8,79), \
 285     V(47,0A,7C,A1), V(E9,0F,42,7C), V(C9,1E,84,F8), V(00,00,00,00), \
 286     V(83,86,80,09), V(48,ED,2B,32), V(AC,70,11,1E), V(4E,72,5A,6C), \
 287     V(FB,FF,0E,FD), V(56,38,85,0F), V(1E,D5,AE,3D), V(27,39,2D,36), \
 288     V(64,D9,0F,0A), V(21,A6,5C,68), V(D1,54,5B,9B), V(3A,2E,36,24), \
 289     V(B1,67,0A,0C), V(0F,E7,57,93), V(D2,96,EE,B4), V(9E,91,9B,1B), \
 290     V(4F,C5,C0,80), V(A2,20,DC,61), V(69,4B,77,5A), V(16,1A,12,1C), \
 291     V(0A,BA,93,E2), V(E5,2A,A0,C0), V(43,E0,22,3C), V(1D,17,1B,12), \
 292     V(0B,0D,09,0E), V(AD,C7,8B,F2), V(B9,A8,B6,2D), V(C8,A9,1E,14), \
 293     V(85,19,F1,57), V(4C,07,75,AF), V(BB,DD,99,EE), V(FD,60,7F,A3), \
 294     V(9F,26,01,F7), V(BC,F5,72,5C), V(C5,3B,66,44), V(34,7E,FB,5B), \
 295     V(76,29,43,8B), V(DC,C6,23,CB), V(68,FC,ED,B6), V(63,F1,E4,B8), \
 296     V(CA,DC,31,D7), V(10,85,63,42), V(40,22,97,13), V(20,11,C6,84), \
 297     V(7D,24,4A,85), V(F8,3D,BB,D2), V(11,32,F9,AE), V(6D,A1,29,C7), \
 298     V(4B,2F,9E,1D), V(F3,30,B2,DC), V(EC,52,86,0D), V(D0,E3,C1,77), \
 299     V(6C,16,B3,2B), V(99,B9,70,A9), V(FA,48,94,11), V(22,64,E9,47), \
 300     V(C4,8C,FC,A8), V(1A,3F,F0,A0), V(D8,2C,7D,56), V(EF,90,33,22), \
 301     V(C7,4E,49,87), V(C1,D1,38,D9), V(FE,A2,CA,8C), V(36,0B,D4,98), \
 302     V(CF,81,F5,A6), V(28,DE,7A,A5), V(26,8E,B7,DA), V(A4,BF,AD,3F), \
 303     V(E4,9D,3A,2C), V(0D,92,78,50), V(9B,CC,5F,6A), V(62,46,7E,54), \
 304     V(C2,13,8D,F6), V(E8,B8,D8,90), V(5E,F7,39,2E), V(F5,AF,C3,82), \
 305     V(BE,80,5D,9F), V(7C,93,D0,69), V(A9,2D,D5,6F), V(B3,12,25,CF), \
 306     V(3B,99,AC,C8), V(A7,7D,18,10), V(6E,63,9C,E8), V(7B,BB,3B,DB), \
 307     V(09,78,26,CD), V(F4,18,59,6E), V(01,B7,9A,EC), V(A8,9A,4F,83), \
 308     V(65,6E,95,E6), V(7E,E6,FF,AA), V(08,CF,BC,21), V(E6,E8,15,EF), \
 309     V(D9,9B,E7,BA), V(CE,36,6F,4A), V(D4,09,9F,EA), V(D6,7C,B0,29), \
 310     V(AF,B2,A4,31), V(31,23,3F,2A), V(30,94,A5,C6), V(C0,66,A2,35), \
 311     V(37,BC,4E,74), V(A6,CA,82,FC), V(B0,D0,90,E0), V(15,D8,A7,33), \
 312     V(4A,98,04,F1), V(F7,DA,EC,41), V(0E,50,CD,7F), V(2F,F6,91,17), \
 313     V(8D,D6,4D,76), V(4D,B0,EF,43), V(54,4D,AA,CC), V(DF,04,96,E4), \
 314     V(E3,B5,D1,9E), V(1B,88,6A,4C), V(B8,1F,2C,C1), V(7F,51,65,46), \
 315     V(04,EA,5E,9D), V(5D,35,8C,01), V(73,74,87,FA), V(2E,41,0B,FB), \
 316     V(5A,1D,67,B3), V(52,D2,DB,92), V(33,56,10,E9), V(13,47,D6,6D), \
 317     V(8C,61,D7,9A), V(7A,0C,A1,37), V(8E,14,F8,59), V(89,3C,13,EB), \
 318     V(EE,27,A9,CE), V(35,C9,61,B7), V(ED,E5,1C,E1), V(3C,B1,47,7A), \
 319     V(59,DF,D2,9C), V(3F,73,F2,55), V(79,CE,14,18), V(BF,37,C7,73), \
 320     V(EA,CD,F7,53), V(5B,AA,FD,5F), V(14,6F,3D,DF), V(86,DB,44,78), \
 321     V(81,F3,AF,CA), V(3E,C4,68,B9), V(2C,34,24,38), V(5F,40,A3,C2), \
 322     V(72,C3,1D,16), V(0C,25,E2,BC), V(8B,49,3C,28), V(41,95,0D,FF), \
 323     V(71,01,A8,39), V(DE,B3,0C,08), V(9C,E4,B4,D8), V(90,C1,56,64), \
 324     V(61,84,CB,7B), V(70,B6,32,D5), V(74,5C,6C,48), V(42,57,B8,D0)
 325
 326 #define V(a,b,c,d) 0x##a##b##c##d
 327 static const uint32_t RT0[256] = { RT };
 328 #undef V
 329
 330 #define V(a,b,c,d) 0x##b##c##d##a
 331 static const uint32_t RT1[256] = { RT };
 332 #undef V
 333
 334 #define V(a,b,c,d) 0x##c##d##a##b
 335 static const uint32_t RT2[256] = { RT };
 336 #undef V
 337
 338 #define V(a,b,c,d) 0x##d##a##b##c
 339 static const uint32_t RT3[256] = { RT };
 340 #undef V
 341
 342 #undef RT
 343
 344 /*
 345  * Round constants
 346  */
 347 static const uint32_t RCON[10] =
 348 {
 349     0x00000001, 0x00000002, 0x00000004, 0x00000008,
 350     0x00000010, 0x00000020, 0x00000040, 0x00000080,
 351     0x0000001B, 0x00000036
 352 };
 353
 354 #else /* POLARSSL_AES_ROM_TABLES */
 355
 356 /*
 357  * Forward S-box & tables
 358  */
 359 static unsigned char FSb[256];
 360 static uint32_t FT0[256];
 361 static uint32_t FT1[256];
 362 static uint32_t FT2[256];
 363 static uint32_t FT3[256];
 364
 365 /*
 366  * Reverse S-box & tables
 367  */
 368 static unsigned char RSb[256];
 369 static uint32_t RT0[256];
 370 static uint32_t RT1[256];
 371 static uint32_t RT2[256];
 372 static uint32_t RT3[256];
 373
 374 /*
 375  * Round constants
 376  */
 377 static uint32_t RCON[10];
 378
 379 /*
 380  * Tables generation code
 381  */
 382 #define ROTL8(x) ( ( x << 8 ) & 0xFFFFFFFF ) | ( x >> 24 )
 383 #define XTIME(x) ( ( x << 1 ) ^ ( ( x & 0x80 ) ? 0x1B : 0x00 ) )
 384 #define MUL(x,y) ( ( x && y ) ? pow[(log[x]+log[y]) % 255] : 0 )
 385
 386 static int aes_init_done = 0;
 387
 388 static void aes_gen_tables( void )
 389 {
 390     int i, x, y, z;
 391     int pow[256];
 392     int log[256];
 393
 394     /*
 395      * compute pow and log tables over GF(2^8)
 396      */
 397     for( i = 0, x = 1; i < 256; i++ )
 398     {
 399         pow[i] = x;
 400         log[x] = i;
 401         x = ( x ^ XTIME( x ) ) & 0xFF;
 402     }
 403
 404     /*
 405      * calculate the round constants
 406      */
 407     for( i = 0, x = 1; i < 10; i++ )
 408     {
 409         RCON[i] = (uint32_t) x;
 410         x = XTIME( x ) & 0xFF;
 411     }
 412
 413     /*
 414      * generate the forward and reverse S-boxes
 415      */
 416     FSb[0x00] = 0x63;
 417     RSb[0x63] = 0x00;
 418
 419     for( i = 1; i < 256; i++ )
 420     {
 421         x = pow[255 - log[i]];
 422
 423         y  = x; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF;
 424         x ^= y; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF;
 425         x ^= y; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF;
 426         x ^= y; y = ( ( y << 1 ) | ( y >> 7 ) ) & 0xFF;
 427         x ^= y ^ 0x63;
 428
 429         FSb[i] = (unsigned char) x;
 430         RSb[x] = (unsigned char) i;
 431     }
 432
 433     /*
 434      * generate the forward and reverse tables
 435      */
 436     for( i = 0; i < 256; i++ )
 437     {
 438         x = FSb[i];
 439         y = XTIME( x ) & 0xFF;
 440         z =  ( y ^ x ) & 0xFF;
 441
 442         FT0[i] = ( (uint32_t) y       ) ^
 443                  ( (uint32_t) x <<  8 ) ^
 444                  ( (uint32_t) x << 16 ) ^
 445                  ( (uint32_t) z << 24 );
 446
 447         FT1[i] = ROTL8( FT0[i] );
 448         FT2[i] = ROTL8( FT1[i] );
 449         FT3[i] = ROTL8( FT2[i] );
 450
 451         x = RSb[i];
 452
 453         RT0[i] = ( (uint32_t) MUL( 0x0E, x )       ) ^
 454                  ( (uint32_t) MUL( 0x09, x ) <<  8 ) ^
 455                  ( (uint32_t) MUL( 0x0D, x ) << 16 ) ^
 456                  ( (uint32_t) MUL( 0x0B, x ) << 24 );
 457
 458         RT1[i] = ROTL8( RT0[i] );
 459         RT2[i] = ROTL8( RT1[i] );
 460         RT3[i] = ROTL8( RT2[i] );
 461     }
 462 }
 463
 464 #endif /* POLARSSL_AES_ROM_TABLES */
 465
 466 void aes_init( aes_context *ctx )
 467 {
 468     memset( ctx, 0, sizeof( aes_context ) );
 469 }
 470
 471 void aes_free( aes_context *ctx )
 472 {
 473     if( ctx == NULL )
 474         return;
 475
 476     polarssl_zeroize( ctx, sizeof( aes_context ) );
 477 }
 478
 479 /*
 480  * AES key schedule (encryption)
 481  */
 482 int aes_setkey_enc( aes_context *ctx, const unsigned char *key,
 483                     unsigned int keysize )
 484 {
 485     unsigned int i;
 486     uint32_t *RK;
 487
 488 #if !defined(POLARSSL_AES_ROM_TABLES)
 489     if( aes_init_done == 0 )
 490     {
 491         aes_gen_tables();
 492         aes_init_done = 1;
 493
 494     }
 495 #endif
 496
 497     switch( keysize )
 498     {
 499         case 128: ctx->nr = 10; break;
 500         case 192: ctx->nr = 12; break;
 501         case 256: ctx->nr = 14; break;
 502         default : return( POLARSSL_ERR_AES_INVALID_KEY_LENGTH );
 503     }
 504
 505 #if defined(POLARSSL_PADLOCK_C) && defined(PADLOCK_ALIGN16)
 506     if( aes_padlock_ace == -1 )
 507         aes_padlock_ace = padlock_supports( PADLOCK_ACE );
 508
 509     if( aes_padlock_ace )
 510         ctx->rk = RK = PADLOCK_ALIGN16( ctx->buf );
 511     else
 512 #endif
 513     ctx->rk = RK = ctx->buf;
 514
 515 #if defined(POLARSSL_AESNI_C) && defined(POLARSSL_HAVE_X86_64)
 516     if( aesni_supports( POLARSSL_AESNI_AES ) )
 517         return( aesni_setkey_enc( (unsigned char *) ctx->rk, key, keysize ) );
 518 #endif
 519
 520     for( i = 0; i < ( keysize >> 5 ); i++ )
 521     {
 522         GET_UINT32_LE( RK[i], key, i << 2 );
 523     }
 524
 525     switch( ctx->nr )
 526     {
 527         case 10:
 528
 529             for( i = 0; i < 10; i++, RK += 4 )
 530             {
 531                 RK[4]  = RK[0] ^ RCON[i] ^
 532                 ( (uint32_t) FSb[ ( RK[3] >>  8 ) & 0xFF ]       ) ^
 533                 ( (uint32_t) FSb[ ( RK[3] >> 16 ) & 0xFF ] <<  8 ) ^
 534                 ( (uint32_t) FSb[ ( RK[3] >> 24 ) & 0xFF ] << 16 ) ^
 535                 ( (uint32_t) FSb[ ( RK[3]       ) & 0xFF ] << 24 );
 536
 537                 RK[5]  = RK[1] ^ RK[4];
 538                 RK[6]  = RK[2] ^ RK[5];
 539                 RK[7]  = RK[3] ^ RK[6];
 540             }
 541             break;
 542
 543         case 12:
 544
 545             for( i = 0; i < 8; i++, RK += 6 )
 546             {
 547                 RK[6]  = RK[0] ^ RCON[i] ^
 548                 ( (uint32_t) FSb[ ( RK[5] >>  8 ) & 0xFF ]       ) ^
 549                 ( (uint32_t) FSb[ ( RK[5] >> 16 ) & 0xFF ] <<  8 ) ^
 550                 ( (uint32_t) FSb[ ( RK[5] >> 24 ) & 0xFF ] << 16 ) ^
 551                 ( (uint32_t) FSb[ ( RK[5]       ) & 0xFF ] << 24 );
 552
 553                 RK[7]  = RK[1] ^ RK[6];
 554                 RK[8]  = RK[2] ^ RK[7];
 555                 RK[9]  = RK[3] ^ RK[8];
 556                 RK[10] = RK[4] ^ RK[9];
 557                 RK[11] = RK[5] ^ RK[10];
 558             }
 559             break;
 560
 561         case 14:
 562
 563             for( i = 0; i < 7; i++, RK += 8 )
 564             {
 565                 RK[8]  = RK[0] ^ RCON[i] ^
 566                 ( (uint32_t) FSb[ ( RK[7] >>  8 ) & 0xFF ]       ) ^
 567                 ( (uint32_t) FSb[ ( RK[7] >> 16 ) & 0xFF ] <<  8 ) ^
 568                 ( (uint32_t) FSb[ ( RK[7] >> 24 ) & 0xFF ] << 16 ) ^
 569                 ( (uint32_t) FSb[ ( RK[7]       ) & 0xFF ] << 24 );
 570
 571                 RK[9]  = RK[1] ^ RK[8];
 572                 RK[10] = RK[2] ^ RK[9];
 573                 RK[11] = RK[3] ^ RK[10];
 574
 575                 RK[12] = RK[4] ^
 576                 ( (uint32_t) FSb[ ( RK[11]       ) & 0xFF ]       ) ^
 577                 ( (uint32_t) FSb[ ( RK[11] >>  8 ) & 0xFF ] <<  8 ) ^
 578                 ( (uint32_t) FSb[ ( RK[11] >> 16 ) & 0xFF ] << 16 ) ^
 579                 ( (uint32_t) FSb[ ( RK[11] >> 24 ) & 0xFF ] << 24 );
 580
 581                 RK[13] = RK[5] ^ RK[12];
 582                 RK[14] = RK[6] ^ RK[13];
 583                 RK[15] = RK[7] ^ RK[14];
 584             }
 585             break;
 586     }
 587
 588     return( 0 );
 589 }
 590
 591 /*
 592  * AES key schedule (decryption)
 593  */
 594 int aes_setkey_dec( aes_context *ctx, const unsigned char *key,
 595                     unsigned int keysize )
 596 {
 597     int i, j, ret;
 598     aes_context cty;
 599     uint32_t *RK;
 600     uint32_t *SK;
 601
 602     aes_init( &cty );
 603
 604 #if defined(POLARSSL_PADLOCK_C) && defined(PADLOCK_ALIGN16)
 605     if( aes_padlock_ace == -1 )
 606         aes_padlock_ace = padlock_supports( PADLOCK_ACE );
 607
 608     if( aes_padlock_ace )
 609         ctx->rk = RK = PADLOCK_ALIGN16( ctx->buf );
 610     else
 611 #endif
 612     ctx->rk = RK = ctx->buf;
 613
 614     /* Also checks keysize */
 615     if( ( ret = aes_setkey_enc( &cty, key, keysize ) ) != 0 )
 616         goto exit;
 617
 618     ctx->nr = cty.nr;
 619
 620 #if defined(POLARSSL_AESNI_C) && defined(POLARSSL_HAVE_X86_64)
 621     if( aesni_supports( POLARSSL_AESNI_AES ) )
 622     {
 623         aesni_inverse_key( (unsigned char *) ctx->rk,
 624                            (const unsigned char *) cty.rk, ctx->nr );
 625         goto exit;
 626     }
 627 #endif
 628
 629     SK = cty.rk + cty.nr * 4;
 630
 631     *RK++ = *SK++;
 632     *RK++ = *SK++;
 633     *RK++ = *SK++;
 634     *RK++ = *SK++;
 635
 636     for( i = ctx->nr - 1, SK -= 8; i > 0; i--, SK -= 8 )
 637     {
 638         for( j = 0; j < 4; j++, SK++ )
 639         {
 640             *RK++ = RT0[ FSb[ ( *SK       ) & 0xFF ] ] ^
 641                     RT1[ FSb[ ( *SK >>  8 ) & 0xFF ] ] ^
 642                     RT2[ FSb[ ( *SK >> 16 ) & 0xFF ] ] ^
 643                     RT3[ FSb[ ( *SK >> 24 ) & 0xFF ] ];
 644         }
 645     }
 646
 647     *RK++ = *SK++;
 648     *RK++ = *SK++;
 649     *RK++ = *SK++;
 650     *RK++ = *SK++;
 651
 652 exit:
 653     aes_free( &cty );
 654
 655     return( ret );
 656 }
 657
 658 #define AES_FROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3)     \
 659 {                                               \
 660     X0 = *RK++ ^ FT0[ ( Y0       ) & 0xFF ] ^   \
 661                  FT1[ ( Y1 >>  8 ) & 0xFF ] ^   \
 662                  FT2[ ( Y2 >> 16 ) & 0xFF ] ^   \
 663                  FT3[ ( Y3 >> 24 ) & 0xFF ];    \
 664                                                 \
 665     X1 = *RK++ ^ FT0[ ( Y1       ) & 0xFF ] ^   \
 666                  FT1[ ( Y2 >>  8 ) & 0xFF ] ^   \
 667                  FT2[ ( Y3 >> 16 ) & 0xFF ] ^   \
 668                  FT3[ ( Y0 >> 24 ) & 0xFF ];    \
 669                                                 \
 670     X2 = *RK++ ^ FT0[ ( Y2       ) & 0xFF ] ^   \
 671                  FT1[ ( Y3 >>  8 ) & 0xFF ] ^   \
 672                  FT2[ ( Y0 >> 16 ) & 0xFF ] ^   \
 673                  FT3[ ( Y1 >> 24 ) & 0xFF ];    \
 674                                                 \
 675     X3 = *RK++ ^ FT0[ ( Y3       ) & 0xFF ] ^   \
 676                  FT1[ ( Y0 >>  8 ) & 0xFF ] ^   \
 677                  FT2[ ( Y1 >> 16 ) & 0xFF ] ^   \
 678                  FT3[ ( Y2 >> 24 ) & 0xFF ];    \
 679 }
 680
 681 #define AES_RROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3)     \
 682 {                                               \
 683     X0 = *RK++ ^ RT0[ ( Y0       ) & 0xFF ] ^   \
 684                  RT1[ ( Y3 >>  8 ) & 0xFF ] ^   \
 685                  RT2[ ( Y2 >> 16 ) & 0xFF ] ^   \
 686                  RT3[ ( Y1 >> 24 ) & 0xFF ];    \
 687                                                 \
 688     X1 = *RK++ ^ RT0[ ( Y1       ) & 0xFF ] ^   \
 689                  RT1[ ( Y0 >>  8 ) & 0xFF ] ^   \
 690                  RT2[ ( Y3 >> 16 ) & 0xFF ] ^   \
 691                  RT3[ ( Y2 >> 24 ) & 0xFF ];    \
 692                                                 \
 693     X2 = *RK++ ^ RT0[ ( Y2       ) & 0xFF ] ^   \
 694                  RT1[ ( Y1 >>  8 ) & 0xFF ] ^   \
 695                  RT2[ ( Y0 >> 16 ) & 0xFF ] ^   \
 696                  RT3[ ( Y3 >> 24 ) & 0xFF ];    \
 697                                                 \
 698     X3 = *RK++ ^ RT0[ ( Y3       ) & 0xFF ] ^   \
 699                  RT1[ ( Y2 >>  8 ) & 0xFF ] ^   \
 700                  RT2[ ( Y1 >> 16 ) & 0xFF ] ^   \
 701                  RT3[ ( Y0 >> 24 ) & 0xFF ];    \
 702 }
 703
 704 /*
 705  * AES-ECB block encryption/decryption
 706  */
 707 int aes_crypt_ecb( aes_context *ctx,
 708                     int mode,
 709                     const unsigned char input[16],
 710                     unsigned char output[16] )
 711 {
 712     int i;
 713     uint32_t *RK, X0, X1, X2, X3, Y0, Y1, Y2, Y3;
 714
 715 #if defined(POLARSSL_AESNI_C) && defined(POLARSSL_HAVE_X86_64)
 716     if( aesni_supports( POLARSSL_AESNI_AES ) )
 717         return( aesni_crypt_ecb( ctx, mode, input, output ) );
 718 #endif
 719
 720 #if defined(POLARSSL_PADLOCK_C) && defined(POLARSSL_HAVE_X86)
 721     if( aes_padlock_ace )
 722     {
 723         if( padlock_xcryptecb( ctx, mode, input, output ) == 0 )
 724             return( 0 );
 725
 726         // If padlock data misaligned, we just fall back to
 727         // unaccelerated mode
 728         //
 729     }
 730 #endif
 731
 732     RK = ctx->rk;
 733
 734     GET_UINT32_LE( X0, input,  0 ); X0 ^= *RK++;
 735     GET_UINT32_LE( X1, input,  4 ); X1 ^= *RK++;
 736     GET_UINT32_LE( X2, input,  8 ); X2 ^= *RK++;
 737     GET_UINT32_LE( X3, input, 12 ); X3 ^= *RK++;
 738
 739     if( mode == AES_DECRYPT )
 740     {
 741         for( i = ( ctx->nr >> 1 ) - 1; i > 0; i-- )
 742         {
 743             AES_RROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 );
 744             AES_RROUND( X0, X1, X2, X3, Y0, Y1, Y2, Y3 );
 745         }
 746
 747         AES_RROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 );
 748
 749         X0 = *RK++ ^ \
 750                 ( (uint32_t) RSb[ ( Y0       ) & 0xFF ]       ) ^
 751                 ( (uint32_t) RSb[ ( Y3 >>  8 ) & 0xFF ] <<  8 ) ^
 752                 ( (uint32_t) RSb[ ( Y2 >> 16 ) & 0xFF ] << 16 ) ^
 753                 ( (uint32_t) RSb[ ( Y1 >> 24 ) & 0xFF ] << 24 );
 754
 755         X1 = *RK++ ^ \
 756                 ( (uint32_t) RSb[ ( Y1       ) & 0xFF ]       ) ^
 757                 ( (uint32_t) RSb[ ( Y0 >>  8 ) & 0xFF ] <<  8 ) ^
 758                 ( (uint32_t) RSb[ ( Y3 >> 16 ) & 0xFF ] << 16 ) ^
 759                 ( (uint32_t) RSb[ ( Y2 >> 24 ) & 0xFF ] << 24 );
 760
 761         X2 = *RK++ ^ \
 762                 ( (uint32_t) RSb[ ( Y2       ) & 0xFF ]       ) ^
 763                 ( (uint32_t) RSb[ ( Y1 >>  8 ) & 0xFF ] <<  8 ) ^
 764                 ( (uint32_t) RSb[ ( Y0 >> 16 ) & 0xFF ] << 16 ) ^
 765                 ( (uint32_t) RSb[ ( Y3 >> 24 ) & 0xFF ] << 24 );
 766
 767         X3 = *RK++ ^ \
 768                 ( (uint32_t) RSb[ ( Y3       ) & 0xFF ]       ) ^
 769                 ( (uint32_t) RSb[ ( Y2 >>  8 ) & 0xFF ] <<  8 ) ^
 770                 ( (uint32_t) RSb[ ( Y1 >> 16 ) & 0xFF ] << 16 ) ^
 771                 ( (uint32_t) RSb[ ( Y0 >> 24 ) & 0xFF ] << 24 );
 772     }
 773     else /* AES_ENCRYPT */
 774     {
 775         for( i = ( ctx->nr >> 1 ) - 1; i > 0; i-- )
 776         {
 777             AES_FROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 );
 778             AES_FROUND( X0, X1, X2, X3, Y0, Y1, Y2, Y3 );
 779         }
 780
 781         AES_FROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 );
 782
 783         X0 = *RK++ ^ \
 784                 ( (uint32_t) FSb[ ( Y0       ) & 0xFF ]       ) ^
 785                 ( (uint32_t) FSb[ ( Y1 >>  8 ) & 0xFF ] <<  8 ) ^
 786                 ( (uint32_t) FSb[ ( Y2 >> 16 ) & 0xFF ] << 16 ) ^
 787                 ( (uint32_t) FSb[ ( Y3 >> 24 ) & 0xFF ] << 24 );
 788
 789         X1 = *RK++ ^ \
 790                 ( (uint32_t) FSb[ ( Y1       ) & 0xFF ]       ) ^
 791                 ( (uint32_t) FSb[ ( Y2 >>  8 ) & 0xFF ] <<  8 ) ^
 792                 ( (uint32_t) FSb[ ( Y3 >> 16 ) & 0xFF ] << 16 ) ^
 793                 ( (uint32_t) FSb[ ( Y0 >> 24 ) & 0xFF ] << 24 );
 794
 795         X2 = *RK++ ^ \
 796                 ( (uint32_t) FSb[ ( Y2       ) & 0xFF ]       ) ^
 797                 ( (uint32_t) FSb[ ( Y3 >>  8 ) & 0xFF ] <<  8 ) ^
 798                 ( (uint32_t) FSb[ ( Y0 >> 16 ) & 0xFF ] << 16 ) ^
 799                 ( (uint32_t) FSb[ ( Y1 >> 24 ) & 0xFF ] << 24 );
 800
 801         X3 = *RK++ ^ \
 802                 ( (uint32_t) FSb[ ( Y3       ) & 0xFF ]       ) ^
 803                 ( (uint32_t) FSb[ ( Y0 >>  8 ) & 0xFF ] <<  8 ) ^
 804                 ( (uint32_t) FSb[ ( Y1 >> 16 ) & 0xFF ] << 16 ) ^
 805                 ( (uint32_t) FSb[ ( Y2 >> 24 ) & 0xFF ] << 24 );
 806     }
 807
 808     PUT_UINT32_LE( X0, output,  0 );
 809     PUT_UINT32_LE( X1, output,  4 );
 810     PUT_UINT32_LE( X2, output,  8 );
 811     PUT_UINT32_LE( X3, output, 12 );
 812
 813     return( 0 );
 814 }
 815
 816 #if defined(POLARSSL_CIPHER_MODE_CBC)
 817 /*
 818  * AES-CBC buffer encryption/decryption
 819  */
 820 int aes_crypt_cbc( aes_context *ctx,
 821                     int mode,
 822                     size_t length,
 823                     unsigned char iv[16],
 824                     const unsigned char *input,
 825                     unsigned char *output )
 826 {
 827     int i;
 828     unsigned char temp[16];
 829
 830     if( length % 16 )
 831         return( POLARSSL_ERR_AES_INVALID_INPUT_LENGTH );
 832
 833 #if defined(POLARSSL_PADLOCK_C) && defined(POLARSSL_HAVE_X86)
 834     if( aes_padlock_ace )
 835     {
 836         if( padlock_xcryptcbc( ctx, mode, length, iv, input, output ) == 0 )
 837             return( 0 );
 838
 839         // If padlock data misaligned, we just fall back to
 840         // unaccelerated mode
 841         //
 842     }
 843 #endif
 844
 845     if( mode == AES_DECRYPT )
 846     {
 847         while( length > 0 )
 848         {
 849             memcpy( temp, input, 16 );
 850             aes_crypt_ecb( ctx, mode, input, output );
 851
 852             for( i = 0; i < 16; i++ )
 853                 output[i] = (unsigned char)( output[i] ^ iv[i] );
 854
 855             memcpy( iv, temp, 16 );
 856
 857             input  += 16;
 858             output += 16;
 859             length -= 16;
 860         }
 861     }
 862     else
 863     {
 864         while( length > 0 )
 865         {
 866             for( i = 0; i < 16; i++ )
 867                 output[i] = (unsigned char)( input[i] ^ iv[i] );
 868
 869             aes_crypt_ecb( ctx, mode, output, output );
 870             memcpy( iv, output, 16 );
 871
 872             input  += 16;
 873             output += 16;
 874             length -= 16;
 875         }
 876     }
 877
 878     return( 0 );
 879 }
 880 #endif /* POLARSSL_CIPHER_MODE_CBC */
 881
 882 #if defined(POLARSSL_CIPHER_MODE_CFB)
 883 /*
 884  * AES-CFB128 buffer encryption/decryption
 885  */
 886 int aes_crypt_cfb128( aes_context *ctx,
 887                        int mode,
 888                        size_t length,
 889                        size_t *iv_off,
 890                        unsigned char iv[16],
 891                        const unsigned char *input,
 892                        unsigned char *output )
 893 {
 894     int c;
 895     size_t n = *iv_off;
 896
 897     if( mode == AES_DECRYPT )
 898     {
 899         while( length-- )
 900         {
 901             if( n == 0 )
 902                 aes_crypt_ecb( ctx, AES_ENCRYPT, iv, iv );
 903
 904             c = *input++;
 905             *output++ = (unsigned char)( c ^ iv[n] );
 906             iv[n] = (unsigned char) c;
 907
 908             n = ( n + 1 ) & 0x0F;
 909         }
 910     }
 911     else
 912     {
 913         while( length-- )
 914         {
 915             if( n == 0 )
 916                 aes_crypt_ecb( ctx, AES_ENCRYPT, iv, iv );
 917
 918             iv[n] = *output++ = (unsigned char)( iv[n] ^ *input++ );
 919
 920             n = ( n + 1 ) & 0x0F;
 921         }
 922     }
 923
 924     *iv_off = n;
 925
 926     return( 0 );
 927 }
 928
 929 /*
 930  * AES-CFB8 buffer encryption/decryption
 931  */
 932 #include <stdio.h>
 933 int aes_crypt_cfb8( aes_context *ctx,
 934                        int mode,
 935                        size_t length,
 936                        unsigned char iv[16],
 937                        const unsigned char *input,
 938                        unsigned char *output )
 939 {
 940     unsigned char c;
 941     unsigned char ov[17];
 942
 943     while( length-- )
 944     {
 945         memcpy( ov, iv, 16 );
 946         aes_crypt_ecb( ctx, AES_ENCRYPT, iv, iv );
 947
 948         if( mode == AES_DECRYPT )
 949             ov[16] = *input;
 950
 951         c = *output++ = (unsigned char)( iv[0] ^ *input++ );
 952
 953         if( mode == AES_ENCRYPT )
 954             ov[16] = c;
 955
 956         memcpy( iv, ov + 1, 16 );
 957     }
 958
 959     return( 0 );
 960 }
 961 #endif /*POLARSSL_CIPHER_MODE_CFB */
 962
 963 #if defined(POLARSSL_CIPHER_MODE_CTR)
 964 /*
 965  * AES-CTR buffer encryption/decryption
 966  */
 967 int aes_crypt_ctr( aes_context *ctx,
 968                        size_t length,
 969                        size_t *nc_off,
 970                        unsigned char nonce_counter[16],
 971                        unsigned char stream_block[16],
 972                        const unsigned char *input,
 973                        unsigned char *output )
 974 {
 975     int c, i;
 976     size_t n = *nc_off;
 977
 978     while( length-- )
 979     {
 980         if( n == 0 ) {
 981             aes_crypt_ecb( ctx, AES_ENCRYPT, nonce_counter, stream_block );
 982
 983             for( i = 16; i > 0; i-- )
 984                 if( ++nonce_counter[i - 1] != 0 )
 985                     break;
 986         }
 987         c = *input++;
 988         *output++ = (unsigned char)( c ^ stream_block[n] );
 989
 990         n = ( n + 1 ) & 0x0F;
 991     }
 992
 993     *nc_off = n;
 994
 995     return( 0 );
 996 }
 997 #endif /* POLARSSL_CIPHER_MODE_CTR */
 998
 999 #endif /* !POLARSSL_AES_ALT */
1000
1001 #if defined(POLARSSL_SELF_TEST)
1002
1003 #include <stdio.h>
1004
1005 /*
1006  * AES test vectors from:
1007  *
1008  * http://csrc.nist.gov/archive/aes/rijndael/rijndael-vals.zip
1009  */
1010 static const unsigned char aes_test_ecb_dec[3][16] =
1011 {
1012     { 0x44, 0x41, 0x6A, 0xC2, 0xD1, 0xF5, 0x3C, 0x58,
1013       0x33, 0x03, 0x91, 0x7E, 0x6B, 0xE9, 0xEB, 0xE0 },
1014     { 0x48, 0xE3, 0x1E, 0x9E, 0x25, 0x67, 0x18, 0xF2,
1015       0x92, 0x29, 0x31, 0x9C, 0x19, 0xF1, 0x5B, 0xA4 },
1016     { 0x05, 0x8C, 0xCF, 0xFD, 0xBB, 0xCB, 0x38, 0x2D,
1017       0x1F, 0x6F, 0x56, 0x58, 0x5D, 0x8A, 0x4A, 0xDE }
1018 };
1019
1020 static const unsigned char aes_test_ecb_enc[3][16] =
1021 {
1022     { 0xC3, 0x4C, 0x05, 0x2C, 0xC0, 0xDA, 0x8D, 0x73,
1023       0x45, 0x1A, 0xFE, 0x5F, 0x03, 0xBE, 0x29, 0x7F },
1024     { 0xF3, 0xF6, 0x75, 0x2A, 0xE8, 0xD7, 0x83, 0x11,
1025       0x38, 0xF0, 0x41, 0x56, 0x06, 0x31, 0xB1, 0x14 },
1026     { 0x8B, 0x79, 0xEE, 0xCC, 0x93, 0xA0, 0xEE, 0x5D,
1027       0xFF, 0x30, 0xB4, 0xEA, 0x21, 0x63, 0x6D, 0xA4 }
1028 };
1029
1030 #if defined(POLARSSL_CIPHER_MODE_CBC)
1031 static const unsigned char aes_test_cbc_dec[3][16] =
1032 {
1033     { 0xFA, 0xCA, 0x37, 0xE0, 0xB0, 0xC8, 0x53, 0x73,
1034       0xDF, 0x70, 0x6E, 0x73, 0xF7, 0xC9, 0xAF, 0x86 },
1035     { 0x5D, 0xF6, 0x78, 0xDD, 0x17, 0xBA, 0x4E, 0x75,
1036       0xB6, 0x17, 0x68, 0xC6, 0xAD, 0xEF, 0x7C, 0x7B },
1037     { 0x48, 0x04, 0xE1, 0x81, 0x8F, 0xE6, 0x29, 0x75,
1038       0x19, 0xA3, 0xE8, 0x8C, 0x57, 0x31, 0x04, 0x13 }
1039 };
1040
1041 static const unsigned char aes_test_cbc_enc[3][16] =
1042 {
1043     { 0x8A, 0x05, 0xFC, 0x5E, 0x09, 0x5A, 0xF4, 0x84,
1044       0x8A, 0x08, 0xD3, 0x28, 0xD3, 0x68, 0x8E, 0x3D },
1045     { 0x7B, 0xD9, 0x66, 0xD5, 0x3A, 0xD8, 0xC1, 0xBB,
1046       0x85, 0xD2, 0xAD, 0xFA, 0xE8, 0x7B, 0xB1, 0x04 },
1047     { 0xFE, 0x3C, 0x53, 0x65, 0x3E, 0x2F, 0x45, 0xB5,
1048       0x6F, 0xCD, 0x88, 0xB2, 0xCC, 0x89, 0x8F, 0xF0 }
1049 };
1050 #endif /* POLARSSL_CIPHER_MODE_CBC */
1051
1052 #if defined(POLARSSL_CIPHER_MODE_CFB)
1053 /*
1054  * AES-CFB128 test vectors from:
1055  *
1056  * http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
1057  */
1058 static const unsigned char aes_test_cfb128_key[3][32] =
1059 {
1060     { 0x2B, 0x7E, 0x15, 0x16, 0x28, 0xAE, 0xD2, 0xA6,
1061       0xAB, 0xF7, 0x15, 0x88, 0x09, 0xCF, 0x4F, 0x3C },
1062     { 0x8E, 0x73, 0xB0, 0xF7, 0xDA, 0x0E, 0x64, 0x52,
1063       0xC8, 0x10, 0xF3, 0x2B, 0x80, 0x90, 0x79, 0xE5,
1064       0x62, 0xF8, 0xEA, 0xD2, 0x52, 0x2C, 0x6B, 0x7B },
1065     { 0x60, 0x3D, 0xEB, 0x10, 0x15, 0xCA, 0x71, 0xBE,
1066       0x2B, 0x73, 0xAE, 0xF0, 0x85, 0x7D, 0x77, 0x81,
1067       0x1F, 0x35, 0x2C, 0x07, 0x3B, 0x61, 0x08, 0xD7,
1068       0x2D, 0x98, 0x10, 0xA3, 0x09, 0x14, 0xDF, 0xF4 }
1069 };
1070
1071 static const unsigned char aes_test_cfb128_iv[16] =
1072 {
1073     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
1074     0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F
1075 };
1076
1077 static const unsigned char aes_test_cfb128_pt[64] =
1078 {
1079     0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96,
1080     0xE9, 0x3D, 0x7E, 0x11, 0x73, 0x93, 0x17, 0x2A,
1081     0xAE, 0x2D, 0x8A, 0x57, 0x1E, 0x03, 0xAC, 0x9C,
1082     0x9E, 0xB7, 0x6F, 0xAC, 0x45, 0xAF, 0x8E, 0x51,
1083     0x30, 0xC8, 0x1C, 0x46, 0xA3, 0x5C, 0xE4, 0x11,
1084     0xE5, 0xFB, 0xC1, 0x19, 0x1A, 0x0A, 0x52, 0xEF,
1085     0xF6, 0x9F, 0x24, 0x45, 0xDF, 0x4F, 0x9B, 0x17,
1086     0xAD, 0x2B, 0x41, 0x7B, 0xE6, 0x6C, 0x37, 0x10
1087 };
1088
1089 static const unsigned char aes_test_cfb128_ct[3][64] =
1090 {
1091     { 0x3B, 0x3F, 0xD9, 0x2E, 0xB7, 0x2D, 0xAD, 0x20,
1092       0x33, 0x34, 0x49, 0xF8, 0xE8, 0x3C, 0xFB, 0x4A,
1093       0xC8, 0xA6, 0x45, 0x37, 0xA0, 0xB3, 0xA9, 0x3F,
1094       0xCD, 0xE3, 0xCD, 0xAD, 0x9F, 0x1C, 0xE5, 0x8B,
1095       0x26, 0x75, 0x1F, 0x67, 0xA3, 0xCB, 0xB1, 0x40,
1096       0xB1, 0x80, 0x8C, 0xF1, 0x87, 0xA4, 0xF4, 0xDF,
1097       0xC0, 0x4B, 0x05, 0x35, 0x7C, 0x5D, 0x1C, 0x0E,
1098       0xEA, 0xC4, 0xC6, 0x6F, 0x9F, 0xF7, 0xF2, 0xE6 },
1099     { 0xCD, 0xC8, 0x0D, 0x6F, 0xDD, 0xF1, 0x8C, 0xAB,
1100       0x34, 0xC2, 0x59, 0x09, 0xC9, 0x9A, 0x41, 0x74,
1101       0x67, 0xCE, 0x7F, 0x7F, 0x81, 0x17, 0x36, 0x21,
1102       0x96, 0x1A, 0x2B, 0x70, 0x17, 0x1D, 0x3D, 0x7A,
1103       0x2E, 0x1E, 0x8A, 0x1D, 0xD5, 0x9B, 0x88, 0xB1,
1104       0xC8, 0xE6, 0x0F, 0xED, 0x1E, 0xFA, 0xC4, 0xC9,
1105       0xC0, 0x5F, 0x9F, 0x9C, 0xA9, 0x83, 0x4F, 0xA0,
1106       0x42, 0xAE, 0x8F, 0xBA, 0x58, 0x4B, 0x09, 0xFF },
1107     { 0xDC, 0x7E, 0x84, 0xBF, 0xDA, 0x79, 0x16, 0x4B,
1108       0x7E, 0xCD, 0x84, 0x86, 0x98, 0x5D, 0x38, 0x60,
1109       0x39, 0xFF, 0xED, 0x14, 0x3B, 0x28, 0xB1, 0xC8,
1110       0x32, 0x11, 0x3C, 0x63, 0x31, 0xE5, 0x40, 0x7B,
1111       0xDF, 0x10, 0x13, 0x24, 0x15, 0xE5, 0x4B, 0x92,
1112       0xA1, 0x3E, 0xD0, 0xA8, 0x26, 0x7A, 0xE2, 0xF9,
1113       0x75, 0xA3, 0x85, 0x74, 0x1A, 0xB9, 0xCE, 0xF8,
1114       0x20, 0x31, 0x62, 0x3D, 0x55, 0xB1, 0xE4, 0x71 }
1115 };
1116 #endif /* POLARSSL_CIPHER_MODE_CFB */
1117
1118 #if defined(POLARSSL_CIPHER_MODE_CTR)
1119 /*
1120  * AES-CTR test vectors from:
1121  *
1122  * http://www.faqs.org/rfcs/rfc3686.html
1123  */
1124
1125 static const unsigned char aes_test_ctr_key[3][16] =
1126 {
1127     { 0xAE, 0x68, 0x52, 0xF8, 0x12, 0x10, 0x67, 0xCC,
1128       0x4B, 0xF7, 0xA5, 0x76, 0x55, 0x77, 0xF3, 0x9E },
1129     { 0x7E, 0x24, 0x06, 0x78, 0x17, 0xFA, 0xE0, 0xD7,
1130       0x43, 0xD6, 0xCE, 0x1F, 0x32, 0x53, 0x91, 0x63 },
1131     { 0x76, 0x91, 0xBE, 0x03, 0x5E, 0x50, 0x20, 0xA8,
1132       0xAC, 0x6E, 0x61, 0x85, 0x29, 0xF9, 0xA0, 0xDC }
1133 };
1134
1135 static const unsigned char aes_test_ctr_nonce_counter[3][16] =
1136 {
1137     { 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x00,
1138       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 },
1139     { 0x00, 0x6C, 0xB6, 0xDB, 0xC0, 0x54, 0x3B, 0x59,
1140       0xDA, 0x48, 0xD9, 0x0B, 0x00, 0x00, 0x00, 0x01 },
1141     { 0x00, 0xE0, 0x01, 0x7B, 0x27, 0x77, 0x7F, 0x3F,
1142       0x4A, 0x17, 0x86, 0xF0, 0x00, 0x00, 0x00, 0x01 }
1143 };
1144
1145 static const unsigned char aes_test_ctr_pt[3][48] =
1146 {
1147     { 0x53, 0x69, 0x6E, 0x67, 0x6C, 0x65, 0x20, 0x62,
1148       0x6C, 0x6F, 0x63, 0x6B, 0x20, 0x6D, 0x73, 0x67 },
1149
1150     { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
1151       0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
1152       0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
1153       0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F },
1154
1155     { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
1156       0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
1157       0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
1158       0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F,
1159       0x20, 0x21, 0x22, 0x23 }
1160 };
1161
1162 static const unsigned char aes_test_ctr_ct[3][48] =
1163 {
1164     { 0xE4, 0x09, 0x5D, 0x4F, 0xB7, 0xA7, 0xB3, 0x79,
1165       0x2D, 0x61, 0x75, 0xA3, 0x26, 0x13, 0x11, 0xB8 },
1166     { 0x51, 0x04, 0xA1, 0x06, 0x16, 0x8A, 0x72, 0xD9,
1167       0x79, 0x0D, 0x41, 0xEE, 0x8E, 0xDA, 0xD3, 0x88,
1168       0xEB, 0x2E, 0x1E, 0xFC, 0x46, 0xDA, 0x57, 0xC8,
1169       0xFC, 0xE6, 0x30, 0xDF, 0x91, 0x41, 0xBE, 0x28 },
1170     { 0xC1, 0xCF, 0x48, 0xA8, 0x9F, 0x2F, 0xFD, 0xD9,
1171       0xCF, 0x46, 0x52, 0xE9, 0xEF, 0xDB, 0x72, 0xD7,
1172       0x45, 0x40, 0xA4, 0x2B, 0xDE, 0x6D, 0x78, 0x36,
1173       0xD5, 0x9A, 0x5C, 0xEA, 0xAE, 0xF3, 0x10, 0x53,
1174       0x25, 0xB2, 0x07, 0x2F }
1175 };
1176
1177 static const int aes_test_ctr_len[3] =
1178     { 16, 32, 36 };
1179 #endif /* POLARSSL_CIPHER_MODE_CTR */
1180
1181 /*
1182  * Checkup routine
1183  */
1184 int aes_self_test( int verbose )
1185 {
1186     int ret = 0, i, j, u, v;
1187     unsigned char key[32];
1188     unsigned char buf[64];
1189     unsigned char iv[16];
1190 #if defined(POLARSSL_CIPHER_MODE_CBC)
1191     unsigned char prv[16];
1192 #endif
1193 #if defined(POLARSSL_CIPHER_MODE_CTR) || defined(POLARSSL_CIPHER_MODE_CFB)
1194     size_t offset;
1195 #endif
1196 #if defined(POLARSSL_CIPHER_MODE_CTR)
1197     int len;
1198     unsigned char nonce_counter[16];
1199     unsigned char stream_block[16];
1200 #endif
1201     aes_context ctx;
1202
1203     memset( key, 0, 32 );
1204     aes_init( &ctx );
1205
1206     /*
1207      * ECB mode
1208      */
1209     for( i = 0; i < 6; i++ )
1210     {
1211         u = i >> 1;
1212         v = i  & 1;
1213
1214         if( verbose != 0 )
1215             polarssl_printf( "  AES-ECB-%3d (%s): ", 128 + u * 64,
1216                              ( v == AES_DECRYPT ) ? "dec" : "enc" );
1217
1218         memset( buf, 0, 16 );
1219
1220         if( v == AES_DECRYPT )
1221         {
1222             aes_setkey_dec( &ctx, key, 128 + u * 64 );
1223
1224             for( j = 0; j < 10000; j++ )
1225                 aes_crypt_ecb( &ctx, v, buf, buf );
1226
1227             if( memcmp( buf, aes_test_ecb_dec[u], 16 ) != 0 )
1228             {
1229                 if( verbose != 0 )
1230                     polarssl_printf( "failed\n" );
1231
1232                 ret = 1;
1233                 goto exit;
1234             }
1235         }
1236         else
1237         {
1238             aes_setkey_enc( &ctx, key, 128 + u * 64 );
1239
1240             for( j = 0; j < 10000; j++ )
1241                 aes_crypt_ecb( &ctx, v, buf, buf );
1242
1243             if( memcmp( buf, aes_test_ecb_enc[u], 16 ) != 0 )
1244             {
1245                 if( verbose != 0 )
1246                     polarssl_printf( "failed\n" );
1247
1248                 ret = 1;
1249                 goto exit;
1250             }
1251         }
1252
1253         if( verbose != 0 )
1254             polarssl_printf( "passed\n" );
1255     }
1256
1257     if( verbose != 0 )
1258         polarssl_printf( "\n" );
1259
1260 #if defined(POLARSSL_CIPHER_MODE_CBC)
1261     /*
1262      * CBC mode
1263      */
1264     for( i = 0; i < 6; i++ )
1265     {
1266         u = i >> 1;
1267         v = i  & 1;
1268
1269         if( verbose != 0 )
1270             polarssl_printf( "  AES-CBC-%3d (%s): ", 128 + u * 64,
1271                              ( v == AES_DECRYPT ) ? "dec" : "enc" );
1272
1273         memset( iv , 0, 16 );
1274         memset( prv, 0, 16 );
1275         memset( buf, 0, 16 );
1276
1277         if( v == AES_DECRYPT )
1278         {
1279             aes_setkey_dec( &ctx, key, 128 + u * 64 );
1280
1281             for( j = 0; j < 10000; j++ )
1282                 aes_crypt_cbc( &ctx, v, 16, iv, buf, buf );
1283
1284             if( memcmp( buf, aes_test_cbc_dec[u], 16 ) != 0 )
1285             {
1286                 if( verbose != 0 )
1287                     polarssl_printf( "failed\n" );
1288
1289                 ret = 1;
1290                 goto exit;
1291             }
1292         }
1293         else
1294         {
1295             aes_setkey_enc( &ctx, key, 128 + u * 64 );
1296
1297             for( j = 0; j < 10000; j++ )
1298             {
1299                 unsigned char tmp[16];
1300
1301                 aes_crypt_cbc( &ctx, v, 16, iv, buf, buf );
1302
1303                 memcpy( tmp, prv, 16 );
1304                 memcpy( prv, buf, 16 );
1305                 memcpy( buf, tmp, 16 );
1306             }
1307
1308             if( memcmp( prv, aes_test_cbc_enc[u], 16 ) != 0 )
1309             {
1310                 if( verbose != 0 )
1311                     polarssl_printf( "failed\n" );
1312
1313                 ret = 1;
1314                 goto exit;
1315             }
1316         }
1317
1318         if( verbose != 0 )
1319             polarssl_printf( "passed\n" );
1320     }
1321
1322     if( verbose != 0 )
1323         polarssl_printf( "\n" );
1324 #endif /* POLARSSL_CIPHER_MODE_CBC */
1325
1326 #if defined(POLARSSL_CIPHER_MODE_CFB)
1327     /*
1328      * CFB128 mode
1329      */
1330     for( i = 0; i < 6; i++ )
1331     {
1332         u = i >> 1;
1333         v = i  & 1;
1334
1335         if( verbose != 0 )
1336             polarssl_printf( "  AES-CFB128-%3d (%s): ", 128 + u * 64,
1337                              ( v == AES_DECRYPT ) ? "dec" : "enc" );
1338
1339         memcpy( iv,  aes_test_cfb128_iv, 16 );
1340         memcpy( key, aes_test_cfb128_key[u], 16 + u * 8 );
1341
1342         offset = 0;
1343         aes_setkey_enc( &ctx, key, 128 + u * 64 );
1344
1345         if( v == AES_DECRYPT )
1346         {
1347             memcpy( buf, aes_test_cfb128_ct[u], 64 );
1348             aes_crypt_cfb128( &ctx, v, 64, &offset, iv, buf, buf );
1349
1350             if( memcmp( buf, aes_test_cfb128_pt, 64 ) != 0 )
1351             {
1352                 if( verbose != 0 )
1353                     polarssl_printf( "failed\n" );
1354
1355                 ret = 1;
1356                 goto exit;
1357             }
1358         }
1359         else
1360         {
1361             memcpy( buf, aes_test_cfb128_pt, 64 );
1362             aes_crypt_cfb128( &ctx, v, 64, &offset, iv, buf, buf );
1363
1364             if( memcmp( buf, aes_test_cfb128_ct[u], 64 ) != 0 )
1365             {
1366                 if( verbose != 0 )
1367                     polarssl_printf( "failed\n" );
1368
1369                 ret = 1;
1370                 goto exit;
1371             }
1372         }
1373
1374         if( verbose != 0 )
1375             polarssl_printf( "passed\n" );
1376     }
1377
1378     if( verbose != 0 )
1379         polarssl_printf( "\n" );
1380 #endif /* POLARSSL_CIPHER_MODE_CFB */
1381
1382 #if defined(POLARSSL_CIPHER_MODE_CTR)
1383     /*
1384      * CTR mode
1385      */
1386     for( i = 0; i < 6; i++ )
1387     {
1388         u = i >> 1;
1389         v = i  & 1;
1390
1391         if( verbose != 0 )
1392             polarssl_printf( "  AES-CTR-128 (%s): ",
1393                              ( v == AES_DECRYPT ) ? "dec" : "enc" );
1394
1395         memcpy( nonce_counter, aes_test_ctr_nonce_counter[u], 16 );
1396         memcpy( key, aes_test_ctr_key[u], 16 );
1397
1398         offset = 0;
1399         aes_setkey_enc( &ctx, key, 128 );
1400
1401         if( v == AES_DECRYPT )
1402         {
1403             len = aes_test_ctr_len[u];
1404             memcpy( buf, aes_test_ctr_ct[u], len );
1405
1406             aes_crypt_ctr( &ctx, len, &offset, nonce_counter, stream_block,
1407                            buf, buf );
1408
1409             if( memcmp( buf, aes_test_ctr_pt[u], len ) != 0 )
1410             {
1411                 if( verbose != 0 )
1412                     polarssl_printf( "failed\n" );
1413
1414                 ret = 1;
1415                 goto exit;
1416             }
1417         }
1418         else
1419         {
1420             len = aes_test_ctr_len[u];
1421             memcpy( buf, aes_test_ctr_pt[u], len );
1422
1423             aes_crypt_ctr( &ctx, len, &offset, nonce_counter, stream_block,
1424                            buf, buf );
1425
1426             if( memcmp( buf, aes_test_ctr_ct[u], len ) != 0 )
1427             {
1428                 if( verbose != 0 )
1429                     polarssl_printf( "failed\n" );
1430
1431                 ret = 1;
1432                 goto exit;
1433             }
1434         }
1435
1436         if( verbose != 0 )
1437             polarssl_printf( "passed\n" );
1438     }
1439
1440     if( verbose != 0 )
1441         polarssl_printf( "\n" );
1442 #endif /* POLARSSL_CIPHER_MODE_CTR */
1443
1444     ret = 0;
1445
1446 exit:
1447     aes_free( &ctx );
1448
1449     return( ret );
1450 }
1451
1452 #endif /* POLARSSL_SELF_TEST */
1453
1454 #endif /* POLARSSL_AES_C */