git.zerfleddert.de Git - proxmark3-svn/blame_incremental

... / ...

Commit	Line	Data
	1	/*
	2	* FIPS-197 compliant AES implementation
	3	*
	4	* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
	5	* SPDX-License-Identifier: GPL-2.0
	6	*
	7	* This program is free software; you can redistribute it and/or modify
	8	* it under the terms of the GNU General Public License as published by
	9	* the Free Software Foundation; either version 2 of the License, or
	10	* (at your option) any later version.
	11	*
	12	* This program is distributed in the hope that it will be useful,
	13	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	14	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	15	* GNU General Public License for more details.
	16	*
	17	* You should have received a copy of the GNU General Public License along
	18	* with this program; if not, write to the Free Software Foundation, Inc.,
	19	* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* This file is part of mbed TLS (https://tls.mbed.org)
	22	*/
	23	/*
	24	* The AES block cipher was designed by Vincent Rijmen and Joan Daemen.
	25	*
	26	* http://csrc.nist.gov/encryption/aes/rijndael/Rijndael.pdf
	27	* http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf
	28	*/
	29
	30	#if !defined(MBEDTLS_CONFIG_FILE)
	31	#include "mbedtls/config.h"
	32	#else
	33	#include MBEDTLS_CONFIG_FILE
	34	#endif
	35
	36	#if defined(MBEDTLS_AES_C)
	37
	38	#include <string.h>
	39
	40	#include "mbedtls/aes.h"
	41	#include "mbedtls/platform_util.h"
	42	#if defined(MBEDTLS_PADLOCK_C)
	43	#include "mbedtls/padlock.h"
	44	#endif
	45	#if defined(MBEDTLS_AESNI_C)
	46	#include "mbedtls/aesni.h"
	47	#endif
	48
	49	#if defined(MBEDTLS_SELF_TEST)
	50	#if defined(MBEDTLS_PLATFORM_C)
	51	#include "mbedtls/platform.h"
	52	#else
	53	#include <stdio.h>
	54	#define mbedtls_printf printf
	55	#endif /* MBEDTLS_PLATFORM_C */
	56	#endif /* MBEDTLS_SELF_TEST */
	57
	58	#if !defined(MBEDTLS_AES_ALT)
	59
	60	/*
	61	* 32-bit integer manipulation macros (little endian)
	62	*/
	63	#ifndef GET_UINT32_LE
	64	#define GET_UINT32_LE(n,b,i) \
	65	{ \
	66	(n) = ( (uint32_t) (b)[(i) ] ) \
	67	\| ( (uint32_t) (b)[(i) + 1] << 8 ) \
	68	\| ( (uint32_t) (b)[(i) + 2] << 16 ) \
	69	\| ( (uint32_t) (b)[(i) + 3] << 24 ); \
	70	}
	71	#endif
	72
	73	#ifndef PUT_UINT32_LE
	74	#define PUT_UINT32_LE(n,b,i) \
	75	{ \
	76	(b)[(i) ] = (unsigned char) ( ( (n) ) & 0xFF ); \
	77	(b)[(i) + 1] = (unsigned char) ( ( (n) >> 8 ) & 0xFF ); \
	78	(b)[(i) + 2] = (unsigned char) ( ( (n) >> 16 ) & 0xFF ); \
	79	(b)[(i) + 3] = (unsigned char) ( ( (n) >> 24 ) & 0xFF ); \
	80	}
	81	#endif
	82
	83	#if defined(MBEDTLS_PADLOCK_C) && \
	84	( defined(MBEDTLS_HAVE_X86) \|\| defined(MBEDTLS_PADLOCK_ALIGN16) )
	85	static int aes_padlock_ace = -1;
	86	#endif
	87
	88	#if defined(MBEDTLS_AES_ROM_TABLES)
	89	/*
	90	* Forward S-box
	91	*/
	92	static const unsigned char FSb[256] =
	93	{
	94	0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5,
	95	0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76,
	96	0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0,
	97	0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0,
	98	0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC,
	99	0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,
	100	0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A,
	101	0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75,
	102	0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0,
	103	0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84,
	104	0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B,
	105	0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,
	106	0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85,
	107	0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8,
	108	0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5,
	109	0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2,
	110	0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17,
	111	0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73,
	112	0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88,
	113	0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB,
	114	0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C,
	115	0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79,
	116	0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9,
	117	0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08,
	118	0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6,
	119	0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A,
	120	0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E,
	121	0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E,
	122	0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94,
	123	0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,
	124	0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68,
	125	0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16
	126	};
	127
	128	/*
	129	* Forward tables
	130	*/
	131	#define FT \
	132	\
	133	V(A5,63,63,C6), V(84,7C,7C,F8), V(99,77,77,EE), V(8D,7B,7B,F6), \
	134	V(0D,F2,F2,FF), V(BD,6B,6B,D6), V(B1,6F,6F,DE), V(54,C5,C5,91), \
	135	V(50,30,30,60), V(03,01,01,02), V(A9,67,67,CE), V(7D,2B,2B,56), \
	136	V(19,FE,FE,E7), V(62,D7,D7,B5), V(E6,AB,AB,4D), V(9A,76,76,EC), \
	137	V(45,CA,CA,8F), V(9D,82,82,1F), V(40,C9,C9,89), V(87,7D,7D,FA), \
	138	V(15,FA,FA,EF), V(EB,59,59,B2), V(C9,47,47,8E), V(0B,F0,F0,FB), \
	139	V(EC,AD,AD,41), V(67,D4,D4,B3), V(FD,A2,A2,5F), V(EA,AF,AF,45), \
	140	V(BF,9C,9C,23), V(F7,A4,A4,53), V(96,72,72,E4), V(5B,C0,C0,9B), \
	141	V(C2,B7,B7,75), V(1C,FD,FD,E1), V(AE,93,93,3D), V(6A,26,26,4C), \
	142	V(5A,36,36,6C), V(41,3F,3F,7E), V(02,F7,F7,F5), V(4F,CC,CC,83), \
	143	V(5C,34,34,68), V(F4,A5,A5,51), V(34,E5,E5,D1), V(08,F1,F1,F9), \
	144	V(93,71,71,E2), V(73,D8,D8,AB), V(53,31,31,62), V(3F,15,15,2A), \
	145	V(0C,04,04,08), V(52,C7,C7,95), V(65,23,23,46), V(5E,C3,C3,9D), \
	146	V(28,18,18,30), V(A1,96,96,37), V(0F,05,05,0A), V(B5,9A,9A,2F), \
	147	V(09,07,07,0E), V(36,12,12,24), V(9B,80,80,1B), V(3D,E2,E2,DF), \
	148	V(26,EB,EB,CD), V(69,27,27,4E), V(CD,B2,B2,7F), V(9F,75,75,EA), \
	149	V(1B,09,09,12), V(9E,83,83,1D), V(74,2C,2C,58), V(2E,1A,1A,34), \
	150	V(2D,1B,1B,36), V(B2,6E,6E,DC), V(EE,5A,5A,B4), V(FB,A0,A0,5B), \
	151	V(F6,52,52,A4), V(4D,3B,3B,76), V(61,D6,D6,B7), V(CE,B3,B3,7D), \
	152	V(7B,29,29,52), V(3E,E3,E3,DD), V(71,2F,2F,5E), V(97,84,84,13), \
	153	V(F5,53,53,A6), V(68,D1,D1,B9), V(00,00,00,00), V(2C,ED,ED,C1), \
	154	V(60,20,20,40), V(1F,FC,FC,E3), V(C8,B1,B1,79), V(ED,5B,5B,B6), \
	155	V(BE,6A,6A,D4), V(46,CB,CB,8D), V(D9,BE,BE,67), V(4B,39,39,72), \
	156	V(DE,4A,4A,94), V(D4,4C,4C,98), V(E8,58,58,B0), V(4A,CF,CF,85), \
	157	V(6B,D0,D0,BB), V(2A,EF,EF,C5), V(E5,AA,AA,4F), V(16,FB,FB,ED), \
	158	V(C5,43,43,86), V(D7,4D,4D,9A), V(55,33,33,66), V(94,85,85,11), \
	159	V(CF,45,45,8A), V(10,F9,F9,E9), V(06,02,02,04), V(81,7F,7F,FE), \
	160	V(F0,50,50,A0), V(44,3C,3C,78), V(BA,9F,9F,25), V(E3,A8,A8,4B), \
	161	V(F3,51,51,A2), V(FE,A3,A3,5D), V(C0,40,40,80), V(8A,8F,8F,05), \
	162	V(AD,92,92,3F), V(BC,9D,9D,21), V(48,38,38,70), V(04,F5,F5,F1), \
	163	V(DF,BC,BC,63), V(C1,B6,B6,77), V(75,DA,DA,AF), V(63,21,21,42), \
	164	V(30,10,10,20), V(1A,FF,FF,E5), V(0E,F3,F3,FD), V(6D,D2,D2,BF), \
	165	V(4C,CD,CD,81), V(14,0C,0C,18), V(35,13,13,26), V(2F,EC,EC,C3), \
	166	V(E1,5F,5F,BE), V(A2,97,97,35), V(CC,44,44,88), V(39,17,17,2E), \
	167	V(57,C4,C4,93), V(F2,A7,A7,55), V(82,7E,7E,FC), V(47,3D,3D,7A), \
	168	V(AC,64,64,C8), V(E7,5D,5D,BA), V(2B,19,19,32), V(95,73,73,E6), \
	169	V(A0,60,60,C0), V(98,81,81,19), V(D1,4F,4F,9E), V(7F,DC,DC,A3), \
	170	V(66,22,22,44), V(7E,2A,2A,54), V(AB,90,90,3B), V(83,88,88,0B), \
	171	V(CA,46,46,8C), V(29,EE,EE,C7), V(D3,B8,B8,6B), V(3C,14,14,28), \
	172	V(79,DE,DE,A7), V(E2,5E,5E,BC), V(1D,0B,0B,16), V(76,DB,DB,AD), \
	173	V(3B,E0,E0,DB), V(56,32,32,64), V(4E,3A,3A,74), V(1E,0A,0A,14), \
	174	V(DB,49,49,92), V(0A,06,06,0C), V(6C,24,24,48), V(E4,5C,5C,B8), \
	175	V(5D,C2,C2,9F), V(6E,D3,D3,BD), V(EF,AC,AC,43), V(A6,62,62,C4), \
	176	V(A8,91,91,39), V(A4,95,95,31), V(37,E4,E4,D3), V(8B,79,79,F2), \
	177	V(32,E7,E7,D5), V(43,C8,C8,8B), V(59,37,37,6E), V(B7,6D,6D,DA), \
	178	V(8C,8D,8D,01), V(64,D5,D5,B1), V(D2,4E,4E,9C), V(E0,A9,A9,49), \
	179	V(B4,6C,6C,D8), V(FA,56,56,AC), V(07,F4,F4,F3), V(25,EA,EA,CF), \
	180	V(AF,65,65,CA), V(8E,7A,7A,F4), V(E9,AE,AE,47), V(18,08,08,10), \
	181	V(D5,BA,BA,6F), V(88,78,78,F0), V(6F,25,25,4A), V(72,2E,2E,5C), \
	182	V(24,1C,1C,38), V(F1,A6,A6,57), V(C7,B4,B4,73), V(51,C6,C6,97), \
	183	V(23,E8,E8,CB), V(7C,DD,DD,A1), V(9C,74,74,E8), V(21,1F,1F,3E), \
	184	V(DD,4B,4B,96), V(DC,BD,BD,61), V(86,8B,8B,0D), V(85,8A,8A,0F), \
	185	V(90,70,70,E0), V(42,3E,3E,7C), V(C4,B5,B5,71), V(AA,66,66,CC), \
	186	V(D8,48,48,90), V(05,03,03,06), V(01,F6,F6,F7), V(12,0E,0E,1C), \
	187	V(A3,61,61,C2), V(5F,35,35,6A), V(F9,57,57,AE), V(D0,B9,B9,69), \
	188	V(91,86,86,17), V(58,C1,C1,99), V(27,1D,1D,3A), V(B9,9E,9E,27), \
	189	V(38,E1,E1,D9), V(13,F8,F8,EB), V(B3,98,98,2B), V(33,11,11,22), \
	190	V(BB,69,69,D2), V(70,D9,D9,A9), V(89,8E,8E,07), V(A7,94,94,33), \
	191	V(B6,9B,9B,2D), V(22,1E,1E,3C), V(92,87,87,15), V(20,E9,E9,C9), \
	192	V(49,CE,CE,87), V(FF,55,55,AA), V(78,28,28,50), V(7A,DF,DF,A5), \
	193	V(8F,8C,8C,03), V(F8,A1,A1,59), V(80,89,89,09), V(17,0D,0D,1A), \
	194	V(DA,BF,BF,65), V(31,E6,E6,D7), V(C6,42,42,84), V(B8,68,68,D0), \
	195	V(C3,41,41,82), V(B0,99,99,29), V(77,2D,2D,5A), V(11,0F,0F,1E), \
	196	V(CB,B0,B0,7B), V(FC,54,54,A8), V(D6,BB,BB,6D), V(3A,16,16,2C)
	197
	198	#define V(a,b,c,d) 0x##a##b##c##d
	199	static const uint32_t FT0[256] = { FT };
	200	#undef V
	201
	202	#if !defined(MBEDTLS_AES_FEWER_TABLES)
	203
	204	#define V(a,b,c,d) 0x##b##c##d##a
	205	static const uint32_t FT1[256] = { FT };
	206	#undef V
	207
	208	#define V(a,b,c,d) 0x##c##d##a##b
	209	static const uint32_t FT2[256] = { FT };
	210	#undef V
	211
	212	#define V(a,b,c,d) 0x##d##a##b##c
	213	static const uint32_t FT3[256] = { FT };
	214	#undef V
	215
	216	#endif /* !MBEDTLS_AES_FEWER_TABLES */
	217
	218	#undef FT
	219
	220	/*
	221	* Reverse S-box
	222	*/
	223	static const unsigned char RSb[256] =
	224	{
	225	0x52, 0x09, 0x6A, 0xD5, 0x30, 0x36, 0xA5, 0x38,
	226	0xBF, 0x40, 0xA3, 0x9E, 0x81, 0xF3, 0xD7, 0xFB,
	227	0x7C, 0xE3, 0x39, 0x82, 0x9B, 0x2F, 0xFF, 0x87,
	228	0x34, 0x8E, 0x43, 0x44, 0xC4, 0xDE, 0xE9, 0xCB,
	229	0x54, 0x7B, 0x94, 0x32, 0xA6, 0xC2, 0x23, 0x3D,
	230	0xEE, 0x4C, 0x95, 0x0B, 0x42, 0xFA, 0xC3, 0x4E,
	231	0x08, 0x2E, 0xA1, 0x66, 0x28, 0xD9, 0x24, 0xB2,
	232	0x76, 0x5B, 0xA2, 0x49, 0x6D, 0x8B, 0xD1, 0x25,
	233	0x72, 0xF8, 0xF6, 0x64, 0x86, 0x68, 0x98, 0x16,
	234	0xD4, 0xA4, 0x5C, 0xCC, 0x5D, 0x65, 0xB6, 0x92,
	235	0x6C, 0x70, 0x48, 0x50, 0xFD, 0xED, 0xB9, 0xDA,
	236	0x5E, 0x15, 0x46, 0x57, 0xA7, 0x8D, 0x9D, 0x84,
	237	0x90, 0xD8, 0xAB, 0x00, 0x8C, 0xBC, 0xD3, 0x0A,
	238	0xF7, 0xE4, 0x58, 0x05, 0xB8, 0xB3, 0x45, 0x06,
	239	0xD0, 0x2C, 0x1E, 0x8F, 0xCA, 0x3F, 0x0F, 0x02,
	240	0xC1, 0xAF, 0xBD, 0x03, 0x01, 0x13, 0x8A, 0x6B,
	241	0x3A, 0x91, 0x11, 0x41, 0x4F, 0x67, 0xDC, 0xEA,
	242	0x97, 0xF2, 0xCF, 0xCE, 0xF0, 0xB4, 0xE6, 0x73,
	243	0x96, 0xAC, 0x74, 0x22, 0xE7, 0xAD, 0x35, 0x85,
	244	0xE2, 0xF9, 0x37, 0xE8, 0x1C, 0x75, 0xDF, 0x6E,
	245	0x47, 0xF1, 0x1A, 0x71, 0x1D, 0x29, 0xC5, 0x89,
	246	0x6F, 0xB7, 0x62, 0x0E, 0xAA, 0x18, 0xBE, 0x1B,
	247	0xFC, 0x56, 0x3E, 0x4B, 0xC6, 0xD2, 0x79, 0x20,
	248	0x9A, 0xDB, 0xC0, 0xFE, 0x78, 0xCD, 0x5A, 0xF4,
	249	0x1F, 0xDD, 0xA8, 0x33, 0x88, 0x07, 0xC7, 0x31,
	250	0xB1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xEC, 0x5F,
	251	0x60, 0x51, 0x7F, 0xA9, 0x19, 0xB5, 0x4A, 0x0D,
	252	0x2D, 0xE5, 0x7A, 0x9F, 0x93, 0xC9, 0x9C, 0xEF,
	253	0xA0, 0xE0, 0x3B, 0x4D, 0xAE, 0x2A, 0xF5, 0xB0,
	254	0xC8, 0xEB, 0xBB, 0x3C, 0x83, 0x53, 0x99, 0x61,
	255	0x17, 0x2B, 0x04, 0x7E, 0xBA, 0x77, 0xD6, 0x26,
	256	0xE1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0C, 0x7D
	257	};
	258
	259	/*
	260	* Reverse tables
	261	*/
	262	#define RT \
	263	\
	264	V(50,A7,F4,51), V(53,65,41,7E), V(C3,A4,17,1A), V(96,5E,27,3A), \
	265	V(CB,6B,AB,3B), V(F1,45,9D,1F), V(AB,58,FA,AC), V(93,03,E3,4B), \
	266	V(55,FA,30,20), V(F6,6D,76,AD), V(91,76,CC,88), V(25,4C,02,F5), \
	267	V(FC,D7,E5,4F), V(D7,CB,2A,C5), V(80,44,35,26), V(8F,A3,62,B5), \
	268	V(49,5A,B1,DE), V(67,1B,BA,25), V(98,0E,EA,45), V(E1,C0,FE,5D), \
	269	V(02,75,2F,C3), V(12,F0,4C,81), V(A3,97,46,8D), V(C6,F9,D3,6B), \
	270	V(E7,5F,8F,03), V(95,9C,92,15), V(EB,7A,6D,BF), V(DA,59,52,95), \
	271	V(2D,83,BE,D4), V(D3,21,74,58), V(29,69,E0,49), V(44,C8,C9,8E), \
	272	V(6A,89,C2,75), V(78,79,8E,F4), V(6B,3E,58,99), V(DD,71,B9,27), \
	273	V(B6,4F,E1,BE), V(17,AD,88,F0), V(66,AC,20,C9), V(B4,3A,CE,7D), \
	274	V(18,4A,DF,63), V(82,31,1A,E5), V(60,33,51,97), V(45,7F,53,62), \
	275	V(E0,77,64,B1), V(84,AE,6B,BB), V(1C,A0,81,FE), V(94,2B,08,F9), \
	276	V(58,68,48,70), V(19,FD,45,8F), V(87,6C,DE,94), V(B7,F8,7B,52), \
	277	V(23,D3,73,AB), V(E2,02,4B,72), V(57,8F,1F,E3), V(2A,AB,55,66), \
	278	V(07,28,EB,B2), V(03,C2,B5,2F), V(9A,7B,C5,86), V(A5,08,37,D3), \
	279	V(F2,87,28,30), V(B2,A5,BF,23), V(BA,6A,03,02), V(5C,82,16,ED), \
	280	V(2B,1C,CF,8A), V(92,B4,79,A7), V(F0,F2,07,F3), V(A1,E2,69,4E), \
	281	V(CD,F4,DA,65), V(D5,BE,05,06), V(1F,62,34,D1), V(8A,FE,A6,C4), \
	282	V(9D,53,2E,34), V(A0,55,F3,A2), V(32,E1,8A,05), V(75,EB,F6,A4), \
	283	V(39,EC,83,0B), V(AA,EF,60,40), V(06,9F,71,5E), V(51,10,6E,BD), \
	284	V(F9,8A,21,3E), V(3D,06,DD,96), V(AE,05,3E,DD), V(46,BD,E6,4D), \
	285	V(B5,8D,54,91), V(05,5D,C4,71), V(6F,D4,06,04), V(FF,15,50,60), \
	286	V(24,FB,98,19), V(97,E9,BD,D6), V(CC,43,40,89), V(77,9E,D9,67), \
	287	V(BD,42,E8,B0), V(88,8B,89,07), V(38,5B,19,E7), V(DB,EE,C8,79), \
	288	V(47,0A,7C,A1), V(E9,0F,42,7C), V(C9,1E,84,F8), V(00,00,00,00), \
	289	V(83,86,80,09), V(48,ED,2B,32), V(AC,70,11,1E), V(4E,72,5A,6C), \
	290	V(FB,FF,0E,FD), V(56,38,85,0F), V(1E,D5,AE,3D), V(27,39,2D,36), \
	291	V(64,D9,0F,0A), V(21,A6,5C,68), V(D1,54,5B,9B), V(3A,2E,36,24), \
	292	V(B1,67,0A,0C), V(0F,E7,57,93), V(D2,96,EE,B4), V(9E,91,9B,1B), \
	293	V(4F,C5,C0,80), V(A2,20,DC,61), V(69,4B,77,5A), V(16,1A,12,1C), \
	294	V(0A,BA,93,E2), V(E5,2A,A0,C0), V(43,E0,22,3C), V(1D,17,1B,12), \
	295	V(0B,0D,09,0E), V(AD,C7,8B,F2), V(B9,A8,B6,2D), V(C8,A9,1E,14), \
	296	V(85,19,F1,57), V(4C,07,75,AF), V(BB,DD,99,EE), V(FD,60,7F,A3), \
	297	V(9F,26,01,F7), V(BC,F5,72,5C), V(C5,3B,66,44), V(34,7E,FB,5B), \
	298	V(76,29,43,8B), V(DC,C6,23,CB), V(68,FC,ED,B6), V(63,F1,E4,B8), \
	299	V(CA,DC,31,D7), V(10,85,63,42), V(40,22,97,13), V(20,11,C6,84), \
	300	V(7D,24,4A,85), V(F8,3D,BB,D2), V(11,32,F9,AE), V(6D,A1,29,C7), \
	301	V(4B,2F,9E,1D), V(F3,30,B2,DC), V(EC,52,86,0D), V(D0,E3,C1,77), \
	302	V(6C,16,B3,2B), V(99,B9,70,A9), V(FA,48,94,11), V(22,64,E9,47), \
	303	V(C4,8C,FC,A8), V(1A,3F,F0,A0), V(D8,2C,7D,56), V(EF,90,33,22), \
	304	V(C7,4E,49,87), V(C1,D1,38,D9), V(FE,A2,CA,8C), V(36,0B,D4,98), \
	305	V(CF,81,F5,A6), V(28,DE,7A,A5), V(26,8E,B7,DA), V(A4,BF,AD,3F), \
	306	V(E4,9D,3A,2C), V(0D,92,78,50), V(9B,CC,5F,6A), V(62,46,7E,54), \
	307	V(C2,13,8D,F6), V(E8,B8,D8,90), V(5E,F7,39,2E), V(F5,AF,C3,82), \
	308	V(BE,80,5D,9F), V(7C,93,D0,69), V(A9,2D,D5,6F), V(B3,12,25,CF), \
	309	V(3B,99,AC,C8), V(A7,7D,18,10), V(6E,63,9C,E8), V(7B,BB,3B,DB), \
	310	V(09,78,26,CD), V(F4,18,59,6E), V(01,B7,9A,EC), V(A8,9A,4F,83), \
	311	V(65,6E,95,E6), V(7E,E6,FF,AA), V(08,CF,BC,21), V(E6,E8,15,EF), \
	312	V(D9,9B,E7,BA), V(CE,36,6F,4A), V(D4,09,9F,EA), V(D6,7C,B0,29), \
	313	V(AF,B2,A4,31), V(31,23,3F,2A), V(30,94,A5,C6), V(C0,66,A2,35), \
	314	V(37,BC,4E,74), V(A6,CA,82,FC), V(B0,D0,90,E0), V(15,D8,A7,33), \
	315	V(4A,98,04,F1), V(F7,DA,EC,41), V(0E,50,CD,7F), V(2F,F6,91,17), \
	316	V(8D,D6,4D,76), V(4D,B0,EF,43), V(54,4D,AA,CC), V(DF,04,96,E4), \
	317	V(E3,B5,D1,9E), V(1B,88,6A,4C), V(B8,1F,2C,C1), V(7F,51,65,46), \
	318	V(04,EA,5E,9D), V(5D,35,8C,01), V(73,74,87,FA), V(2E,41,0B,FB), \
	319	V(5A,1D,67,B3), V(52,D2,DB,92), V(33,56,10,E9), V(13,47,D6,6D), \
	320	V(8C,61,D7,9A), V(7A,0C,A1,37), V(8E,14,F8,59), V(89,3C,13,EB), \
	321	V(EE,27,A9,CE), V(35,C9,61,B7), V(ED,E5,1C,E1), V(3C,B1,47,7A), \
	322	V(59,DF,D2,9C), V(3F,73,F2,55), V(79,CE,14,18), V(BF,37,C7,73), \
	323	V(EA,CD,F7,53), V(5B,AA,FD,5F), V(14,6F,3D,DF), V(86,DB,44,78), \
	324	V(81,F3,AF,CA), V(3E,C4,68,B9), V(2C,34,24,38), V(5F,40,A3,C2), \
	325	V(72,C3,1D,16), V(0C,25,E2,BC), V(8B,49,3C,28), V(41,95,0D,FF), \
	326	V(71,01,A8,39), V(DE,B3,0C,08), V(9C,E4,B4,D8), V(90,C1,56,64), \
	327	V(61,84,CB,7B), V(70,B6,32,D5), V(74,5C,6C,48), V(42,57,B8,D0)
	328
	329	#define V(a,b,c,d) 0x##a##b##c##d
	330	static const uint32_t RT0[256] = { RT };
	331	#undef V
	332
	333	#if !defined(MBEDTLS_AES_FEWER_TABLES)
	334
	335	#define V(a,b,c,d) 0x##b##c##d##a
	336	static const uint32_t RT1[256] = { RT };
	337	#undef V
	338
	339	#define V(a,b,c,d) 0x##c##d##a##b
	340	static const uint32_t RT2[256] = { RT };
	341	#undef V
	342
	343	#define V(a,b,c,d) 0x##d##a##b##c
	344	static const uint32_t RT3[256] = { RT };
	345	#undef V
	346
	347	#endif /* !MBEDTLS_AES_FEWER_TABLES */
	348
	349	#undef RT
	350
	351	/*
	352	* Round constants
	353	*/
	354	static const uint32_t RCON[10] =
	355	{
	356	0x00000001, 0x00000002, 0x00000004, 0x00000008,
	357	0x00000010, 0x00000020, 0x00000040, 0x00000080,
	358	0x0000001B, 0x00000036
	359	};
	360
	361	#else /* MBEDTLS_AES_ROM_TABLES */
	362
	363	/*
	364	* Forward S-box & tables
	365	*/
	366	static unsigned char FSb[256];
	367	static uint32_t FT0[256];
	368	#if !defined(MBEDTLS_AES_FEWER_TABLES)
	369	static uint32_t FT1[256];
	370	static uint32_t FT2[256];
	371	static uint32_t FT3[256];
	372	#endif /* !MBEDTLS_AES_FEWER_TABLES */
	373
	374	/*
	375	* Reverse S-box & tables
	376	*/
	377	static unsigned char RSb[256];
	378	static uint32_t RT0[256];
	379	#if !defined(MBEDTLS_AES_FEWER_TABLES)
	380	static uint32_t RT1[256];
	381	static uint32_t RT2[256];
	382	static uint32_t RT3[256];
	383	#endif /* !MBEDTLS_AES_FEWER_TABLES */
	384
	385	/*
	386	* Round constants
	387	*/
	388	static uint32_t RCON[10];
	389
	390	/*
	391	* Tables generation code
	392	*/
	393	#define ROTL8(x) ( ( x << 8 ) & 0xFFFFFFFF ) \| ( x >> 24 )
	394	#define XTIME(x) ( ( x << 1 ) ^ ( ( x & 0x80 ) ? 0x1B : 0x00 ) )
	395	#define MUL(x,y) ( ( x && y ) ? pow[(log[x]+log[y]) % 255] : 0 )
	396
	397	static int aes_init_done = 0;
	398
	399	static void aes_gen_tables( void )
	400	{
	401	int i, x, y, z;
	402	int pow[256];
	403	int log[256];
	404
	405	/*
	406	* compute pow and log tables over GF(2^8)
	407	*/
	408	for( i = 0, x = 1; i < 256; i++ )
	409	{
	410	pow[i] = x;
	411	log[x] = i;
	412	x = ( x ^ XTIME( x ) ) & 0xFF;
	413	}
	414
	415	/*
	416	* calculate the round constants
	417	*/
	418	for( i = 0, x = 1; i < 10; i++ )
	419	{
	420	RCON[i] = (uint32_t) x;
	421	x = XTIME( x ) & 0xFF;
	422	}
	423
	424	/*
	425	* generate the forward and reverse S-boxes
	426	*/
	427	FSb[0x00] = 0x63;
	428	RSb[0x63] = 0x00;
	429
	430	for( i = 1; i < 256; i++ )
	431	{
	432	x = pow[255 - log[i]];
	433
	434	y = x; y = ( ( y << 1 ) \| ( y >> 7 ) ) & 0xFF;
	435	x ^= y; y = ( ( y << 1 ) \| ( y >> 7 ) ) & 0xFF;
	436	x ^= y; y = ( ( y << 1 ) \| ( y >> 7 ) ) & 0xFF;
	437	x ^= y; y = ( ( y << 1 ) \| ( y >> 7 ) ) & 0xFF;
	438	x ^= y ^ 0x63;
	439
	440	FSb[i] = (unsigned char) x;
	441	RSb[x] = (unsigned char) i;
	442	}
	443
	444	/*
	445	* generate the forward and reverse tables
	446	*/
	447	for( i = 0; i < 256; i++ )
	448	{
	449	x = FSb[i];
	450	y = XTIME( x ) & 0xFF;
	451	z = ( y ^ x ) & 0xFF;
	452
	453	FT0[i] = ( (uint32_t) y ) ^
	454	( (uint32_t) x << 8 ) ^
	455	( (uint32_t) x << 16 ) ^
	456	( (uint32_t) z << 24 );
	457
	458	#if !defined(MBEDTLS_AES_FEWER_TABLES)
	459	FT1[i] = ROTL8( FT0[i] );
	460	FT2[i] = ROTL8( FT1[i] );
	461	FT3[i] = ROTL8( FT2[i] );
	462	#endif /* !MBEDTLS_AES_FEWER_TABLES */
	463
	464	x = RSb[i];
	465
	466	RT0[i] = ( (uint32_t) MUL( 0x0E, x ) ) ^
	467	( (uint32_t) MUL( 0x09, x ) << 8 ) ^
	468	( (uint32_t) MUL( 0x0D, x ) << 16 ) ^
	469	( (uint32_t) MUL( 0x0B, x ) << 24 );
	470
	471	#if !defined(MBEDTLS_AES_FEWER_TABLES)
	472	RT1[i] = ROTL8( RT0[i] );
	473	RT2[i] = ROTL8( RT1[i] );
	474	RT3[i] = ROTL8( RT2[i] );
	475	#endif /* !MBEDTLS_AES_FEWER_TABLES */
	476	}
	477	}
	478
	479	#undef ROTL8
	480
	481	#endif /* MBEDTLS_AES_ROM_TABLES */
	482
	483	#if defined(MBEDTLS_AES_FEWER_TABLES)
	484
	485	#define ROTL8(x) ( (uint32_t)( ( x ) << 8 ) + (uint32_t)( ( x ) >> 24 ) )
	486	#define ROTL16(x) ( (uint32_t)( ( x ) << 16 ) + (uint32_t)( ( x ) >> 16 ) )
	487	#define ROTL24(x) ( (uint32_t)( ( x ) << 24 ) + (uint32_t)( ( x ) >> 8 ) )
	488
	489	#define AES_RT0(idx) RT0[idx]
	490	#define AES_RT1(idx) ROTL8( RT0[idx] )
	491	#define AES_RT2(idx) ROTL16( RT0[idx] )
	492	#define AES_RT3(idx) ROTL24( RT0[idx] )
	493
	494	#define AES_FT0(idx) FT0[idx]
	495	#define AES_FT1(idx) ROTL8( FT0[idx] )
	496	#define AES_FT2(idx) ROTL16( FT0[idx] )
	497	#define AES_FT3(idx) ROTL24( FT0[idx] )
	498
	499	#else /* MBEDTLS_AES_FEWER_TABLES */
	500
	501	#define AES_RT0(idx) RT0[idx]
	502	#define AES_RT1(idx) RT1[idx]
	503	#define AES_RT2(idx) RT2[idx]
	504	#define AES_RT3(idx) RT3[idx]
	505
	506	#define AES_FT0(idx) FT0[idx]
	507	#define AES_FT1(idx) FT1[idx]
	508	#define AES_FT2(idx) FT2[idx]
	509	#define AES_FT3(idx) FT3[idx]
	510
	511	#endif /* MBEDTLS_AES_FEWER_TABLES */
	512
	513	void mbedtls_aes_init( mbedtls_aes_context *ctx )
	514	{
	515	memset( ctx, 0, sizeof( mbedtls_aes_context ) );
	516	}
	517
	518	void mbedtls_aes_free( mbedtls_aes_context *ctx )
	519	{
	520	if( ctx == NULL )
	521	return;
	522
	523	mbedtls_platform_zeroize( ctx, sizeof( mbedtls_aes_context ) );
	524	}
	525
	526	#if defined(MBEDTLS_CIPHER_MODE_XTS)
	527	void mbedtls_aes_xts_init( mbedtls_aes_xts_context *ctx )
	528	{
	529	mbedtls_aes_init( &ctx->crypt );
	530	mbedtls_aes_init( &ctx->tweak );
	531	}
	532
	533	void mbedtls_aes_xts_free( mbedtls_aes_xts_context *ctx )
	534	{
	535	mbedtls_aes_free( &ctx->crypt );
	536	mbedtls_aes_free( &ctx->tweak );
	537	}
	538	#endif /* MBEDTLS_CIPHER_MODE_XTS */
	539
	540	/*
	541	* AES key schedule (encryption)
	542	*/
	543	#if !defined(MBEDTLS_AES_SETKEY_ENC_ALT)
	544	int mbedtls_aes_setkey_enc( mbedtls_aes_context ctx, const unsigned char key,
	545	unsigned int keybits )
	546	{
	547	unsigned int i;
	548	uint32_t *RK;
	549
	550	#if !defined(MBEDTLS_AES_ROM_TABLES)
	551	if( aes_init_done == 0 )
	552	{
	553	aes_gen_tables();
	554	aes_init_done = 1;
	555
	556	}
	557	#endif
	558
	559	switch( keybits )
	560	{
	561	case 128: ctx->nr = 10; break;
	562	case 192: ctx->nr = 12; break;
	563	case 256: ctx->nr = 14; break;
	564	default : return( MBEDTLS_ERR_AES_INVALID_KEY_LENGTH );
	565	}
	566
	567	#if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_PADLOCK_ALIGN16)
	568	if( aes_padlock_ace == -1 )
	569	aes_padlock_ace = mbedtls_padlock_has_support( MBEDTLS_PADLOCK_ACE );
	570
	571	if( aes_padlock_ace )
	572	ctx->rk = RK = MBEDTLS_PADLOCK_ALIGN16( ctx->buf );
	573	else
	574	#endif
	575	ctx->rk = RK = ctx->buf;
	576
	577	#if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64)
	578	if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) )
	579	return( mbedtls_aesni_setkey_enc( (unsigned char *) ctx->rk, key, keybits ) );
	580	#endif
	581
	582	for( i = 0; i < ( keybits >> 5 ); i++ )
	583	{
	584	GET_UINT32_LE( RK[i], key, i << 2 );
	585	}
	586
	587	switch( ctx->nr )
	588	{
	589	case 10:
	590
	591	for( i = 0; i < 10; i++, RK += 4 )
	592	{
	593	RK[4] = RK[0] ^ RCON[i] ^
	594	( (uint32_t) FSb[ ( RK[3] >> 8 ) & 0xFF ] ) ^
	595	( (uint32_t) FSb[ ( RK[3] >> 16 ) & 0xFF ] << 8 ) ^
	596	( (uint32_t) FSb[ ( RK[3] >> 24 ) & 0xFF ] << 16 ) ^
	597	( (uint32_t) FSb[ ( RK[3] ) & 0xFF ] << 24 );
	598
	599	RK[5] = RK[1] ^ RK[4];
	600	RK[6] = RK[2] ^ RK[5];
	601	RK[7] = RK[3] ^ RK[6];
	602	}
	603	break;
	604
	605	case 12:
	606
	607	for( i = 0; i < 8; i++, RK += 6 )
	608	{
	609	RK[6] = RK[0] ^ RCON[i] ^
	610	( (uint32_t) FSb[ ( RK[5] >> 8 ) & 0xFF ] ) ^
	611	( (uint32_t) FSb[ ( RK[5] >> 16 ) & 0xFF ] << 8 ) ^
	612	( (uint32_t) FSb[ ( RK[5] >> 24 ) & 0xFF ] << 16 ) ^
	613	( (uint32_t) FSb[ ( RK[5] ) & 0xFF ] << 24 );
	614
	615	RK[7] = RK[1] ^ RK[6];
	616	RK[8] = RK[2] ^ RK[7];
	617	RK[9] = RK[3] ^ RK[8];
	618	RK[10] = RK[4] ^ RK[9];
	619	RK[11] = RK[5] ^ RK[10];
	620	}
	621	break;
	622
	623	case 14:
	624
	625	for( i = 0; i < 7; i++, RK += 8 )
	626	{
	627	RK[8] = RK[0] ^ RCON[i] ^
	628	( (uint32_t) FSb[ ( RK[7] >> 8 ) & 0xFF ] ) ^
	629	( (uint32_t) FSb[ ( RK[7] >> 16 ) & 0xFF ] << 8 ) ^
	630	( (uint32_t) FSb[ ( RK[7] >> 24 ) & 0xFF ] << 16 ) ^
	631	( (uint32_t) FSb[ ( RK[7] ) & 0xFF ] << 24 );
	632
	633	RK[9] = RK[1] ^ RK[8];
	634	RK[10] = RK[2] ^ RK[9];
	635	RK[11] = RK[3] ^ RK[10];
	636
	637	RK[12] = RK[4] ^
	638	( (uint32_t) FSb[ ( RK[11] ) & 0xFF ] ) ^
	639	( (uint32_t) FSb[ ( RK[11] >> 8 ) & 0xFF ] << 8 ) ^
	640	( (uint32_t) FSb[ ( RK[11] >> 16 ) & 0xFF ] << 16 ) ^
	641	( (uint32_t) FSb[ ( RK[11] >> 24 ) & 0xFF ] << 24 );
	642
	643	RK[13] = RK[5] ^ RK[12];
	644	RK[14] = RK[6] ^ RK[13];
	645	RK[15] = RK[7] ^ RK[14];
	646	}
	647	break;
	648	}
	649
	650	return( 0 );
	651	}
	652	#endif /* !MBEDTLS_AES_SETKEY_ENC_ALT */
	653
	654	/*
	655	* AES key schedule (decryption)
	656	*/
	657	#if !defined(MBEDTLS_AES_SETKEY_DEC_ALT)
	658	int mbedtls_aes_setkey_dec( mbedtls_aes_context ctx, const unsigned char key,
	659	unsigned int keybits )
	660	{
	661	int i, j, ret;
	662	mbedtls_aes_context cty;
	663	uint32_t *RK;
	664	uint32_t *SK;
	665
	666	mbedtls_aes_init( &cty );
	667
	668	#if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_PADLOCK_ALIGN16)
	669	if( aes_padlock_ace == -1 )
	670	aes_padlock_ace = mbedtls_padlock_has_support( MBEDTLS_PADLOCK_ACE );
	671
	672	if( aes_padlock_ace )
	673	ctx->rk = RK = MBEDTLS_PADLOCK_ALIGN16( ctx->buf );
	674	else
	675	#endif
	676	ctx->rk = RK = ctx->buf;
	677
	678	/* Also checks keybits */
	679	if( ( ret = mbedtls_aes_setkey_enc( &cty, key, keybits ) ) != 0 )
	680	goto exit;
	681
	682	ctx->nr = cty.nr;
	683
	684	#if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64)
	685	if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) )
	686	{
	687	mbedtls_aesni_inverse_key( (unsigned char *) ctx->rk,
	688	(const unsigned char *) cty.rk, ctx->nr );
	689	goto exit;
	690	}
	691	#endif
	692
	693	SK = cty.rk + cty.nr * 4;
	694
	695	RK++ = SK++;
	696	RK++ = SK++;
	697	RK++ = SK++;
	698	RK++ = SK++;
	699
	700	for( i = ctx->nr - 1, SK -= 8; i > 0; i--, SK -= 8 )
	701	{
	702	for( j = 0; j < 4; j++, SK++ )
	703	{
	704	RK++ = AES_RT0( FSb[ ( SK ) & 0xFF ] ) ^
	705	AES_RT1( FSb[ ( *SK >> 8 ) & 0xFF ] ) ^
	706	AES_RT2( FSb[ ( *SK >> 16 ) & 0xFF ] ) ^
	707	AES_RT3( FSb[ ( *SK >> 24 ) & 0xFF ] );
	708	}
	709	}
	710
	711	RK++ = SK++;
	712	RK++ = SK++;
	713	RK++ = SK++;
	714	RK++ = SK++;
	715
	716	exit:
	717	mbedtls_aes_free( &cty );
	718
	719	return( ret );
	720	}
	721
	722	#if defined(MBEDTLS_CIPHER_MODE_XTS)
	723	static int mbedtls_aes_xts_decode_keys( const unsigned char *key,
	724	unsigned int keybits,
	725	const unsigned char **key1,
	726	unsigned int *key1bits,
	727	const unsigned char **key2,
	728	unsigned int *key2bits )
	729	{
	730	const unsigned int half_keybits = keybits / 2;
	731	const unsigned int half_keybytes = half_keybits / 8;
	732
	733	switch( keybits )
	734	{
	735	case 256: break;
	736	case 512: break;
	737	default : return( MBEDTLS_ERR_AES_INVALID_KEY_LENGTH );
	738	}
	739
	740	*key1bits = half_keybits;
	741	*key2bits = half_keybits;
	742	*key1 = &key[0];
	743	*key2 = &key[half_keybytes];
	744
	745	return 0;
	746	}
	747
	748	int mbedtls_aes_xts_setkey_enc( mbedtls_aes_xts_context *ctx,
	749	const unsigned char *key,
	750	unsigned int keybits)
	751	{
	752	int ret;
	753	const unsigned char key1, key2;
	754	unsigned int key1bits, key2bits;
	755
	756	ret = mbedtls_aes_xts_decode_keys( key, keybits, &key1, &key1bits,
	757	&key2, &key2bits );
	758	if( ret != 0 )
	759	return( ret );
	760
	761	/* Set the tweak key. Always set tweak key for the encryption mode. */
	762	ret = mbedtls_aes_setkey_enc( &ctx->tweak, key2, key2bits );
	763	if( ret != 0 )
	764	return( ret );
	765
	766	/* Set crypt key for encryption. */
	767	return mbedtls_aes_setkey_enc( &ctx->crypt, key1, key1bits );
	768	}
	769
	770	int mbedtls_aes_xts_setkey_dec( mbedtls_aes_xts_context *ctx,
	771	const unsigned char *key,
	772	unsigned int keybits)
	773	{
	774	int ret;
	775	const unsigned char key1, key2;
	776	unsigned int key1bits, key2bits;
	777
	778	ret = mbedtls_aes_xts_decode_keys( key, keybits, &key1, &key1bits,
	779	&key2, &key2bits );
	780	if( ret != 0 )
	781	return( ret );
	782
	783	/* Set the tweak key. Always set tweak key for encryption. */
	784	ret = mbedtls_aes_setkey_enc( &ctx->tweak, key2, key2bits );
	785	if( ret != 0 )
	786	return( ret );
	787
	788	/* Set crypt key for decryption. */
	789	return mbedtls_aes_setkey_dec( &ctx->crypt, key1, key1bits );
	790	}
	791	#endif /* MBEDTLS_CIPHER_MODE_XTS */
	792
	793	#endif /* !MBEDTLS_AES_SETKEY_DEC_ALT */
	794
	795	#define AES_FROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3) \
	796	{ \
	797	X0 = *RK++ ^ AES_FT0( ( Y0 ) & 0xFF ) ^ \
	798	AES_FT1( ( Y1 >> 8 ) & 0xFF ) ^ \
	799	AES_FT2( ( Y2 >> 16 ) & 0xFF ) ^ \
	800	AES_FT3( ( Y3 >> 24 ) & 0xFF ); \
	801	\
	802	X1 = *RK++ ^ AES_FT0( ( Y1 ) & 0xFF ) ^ \
	803	AES_FT1( ( Y2 >> 8 ) & 0xFF ) ^ \
	804	AES_FT2( ( Y3 >> 16 ) & 0xFF ) ^ \
	805	AES_FT3( ( Y0 >> 24 ) & 0xFF ); \
	806	\
	807	X2 = *RK++ ^ AES_FT0( ( Y2 ) & 0xFF ) ^ \
	808	AES_FT1( ( Y3 >> 8 ) & 0xFF ) ^ \
	809	AES_FT2( ( Y0 >> 16 ) & 0xFF ) ^ \
	810	AES_FT3( ( Y1 >> 24 ) & 0xFF ); \
	811	\
	812	X3 = *RK++ ^ AES_FT0( ( Y3 ) & 0xFF ) ^ \
	813	AES_FT1( ( Y0 >> 8 ) & 0xFF ) ^ \
	814	AES_FT2( ( Y1 >> 16 ) & 0xFF ) ^ \
	815	AES_FT3( ( Y2 >> 24 ) & 0xFF ); \
	816	}
	817
	818	#define AES_RROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3) \
	819	{ \
	820	X0 = *RK++ ^ AES_RT0( ( Y0 ) & 0xFF ) ^ \
	821	AES_RT1( ( Y3 >> 8 ) & 0xFF ) ^ \
	822	AES_RT2( ( Y2 >> 16 ) & 0xFF ) ^ \
	823	AES_RT3( ( Y1 >> 24 ) & 0xFF ); \
	824	\
	825	X1 = *RK++ ^ AES_RT0( ( Y1 ) & 0xFF ) ^ \
	826	AES_RT1( ( Y0 >> 8 ) & 0xFF ) ^ \
	827	AES_RT2( ( Y3 >> 16 ) & 0xFF ) ^ \
	828	AES_RT3( ( Y2 >> 24 ) & 0xFF ); \
	829	\
	830	X2 = *RK++ ^ AES_RT0( ( Y2 ) & 0xFF ) ^ \
	831	AES_RT1( ( Y1 >> 8 ) & 0xFF ) ^ \
	832	AES_RT2( ( Y0 >> 16 ) & 0xFF ) ^ \
	833	AES_RT3( ( Y3 >> 24 ) & 0xFF ); \
	834	\
	835	X3 = *RK++ ^ AES_RT0( ( Y3 ) & 0xFF ) ^ \
	836	AES_RT1( ( Y2 >> 8 ) & 0xFF ) ^ \
	837	AES_RT2( ( Y1 >> 16 ) & 0xFF ) ^ \
	838	AES_RT3( ( Y0 >> 24 ) & 0xFF ); \
	839	}
	840
	841	/*
	842	* AES-ECB block encryption
	843	*/
	844	#if !defined(MBEDTLS_AES_ENCRYPT_ALT)
	845	int mbedtls_internal_aes_encrypt( mbedtls_aes_context *ctx,
	846	const unsigned char input[16],
	847	unsigned char output[16] )
	848	{
	849	int i;
	850	uint32_t *RK, X0, X1, X2, X3, Y0, Y1, Y2, Y3;
	851
	852	RK = ctx->rk;
	853
	854	GET_UINT32_LE( X0, input, 0 ); X0 ^= *RK++;
	855	GET_UINT32_LE( X1, input, 4 ); X1 ^= *RK++;
	856	GET_UINT32_LE( X2, input, 8 ); X2 ^= *RK++;
	857	GET_UINT32_LE( X3, input, 12 ); X3 ^= *RK++;
	858
	859	for( i = ( ctx->nr >> 1 ) - 1; i > 0; i-- )
	860	{
	861	AES_FROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 );
	862	AES_FROUND( X0, X1, X2, X3, Y0, Y1, Y2, Y3 );
	863	}
	864
	865	AES_FROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 );
	866
	867	X0 = *RK++ ^ \
	868	( (uint32_t) FSb[ ( Y0 ) & 0xFF ] ) ^
	869	( (uint32_t) FSb[ ( Y1 >> 8 ) & 0xFF ] << 8 ) ^
	870	( (uint32_t) FSb[ ( Y2 >> 16 ) & 0xFF ] << 16 ) ^
	871	( (uint32_t) FSb[ ( Y3 >> 24 ) & 0xFF ] << 24 );
	872
	873	X1 = *RK++ ^ \
	874	( (uint32_t) FSb[ ( Y1 ) & 0xFF ] ) ^
	875	( (uint32_t) FSb[ ( Y2 >> 8 ) & 0xFF ] << 8 ) ^
	876	( (uint32_t) FSb[ ( Y3 >> 16 ) & 0xFF ] << 16 ) ^
	877	( (uint32_t) FSb[ ( Y0 >> 24 ) & 0xFF ] << 24 );
	878
	879	X2 = *RK++ ^ \
	880	( (uint32_t) FSb[ ( Y2 ) & 0xFF ] ) ^
	881	( (uint32_t) FSb[ ( Y3 >> 8 ) & 0xFF ] << 8 ) ^
	882	( (uint32_t) FSb[ ( Y0 >> 16 ) & 0xFF ] << 16 ) ^
	883	( (uint32_t) FSb[ ( Y1 >> 24 ) & 0xFF ] << 24 );
	884
	885	X3 = *RK++ ^ \
	886	( (uint32_t) FSb[ ( Y3 ) & 0xFF ] ) ^
	887	( (uint32_t) FSb[ ( Y0 >> 8 ) & 0xFF ] << 8 ) ^
	888	( (uint32_t) FSb[ ( Y1 >> 16 ) & 0xFF ] << 16 ) ^
	889	( (uint32_t) FSb[ ( Y2 >> 24 ) & 0xFF ] << 24 );
	890
	891	PUT_UINT32_LE( X0, output, 0 );
	892	PUT_UINT32_LE( X1, output, 4 );
	893	PUT_UINT32_LE( X2, output, 8 );
	894	PUT_UINT32_LE( X3, output, 12 );
	895
	896	return( 0 );
	897	}
	898	#endif /* !MBEDTLS_AES_ENCRYPT_ALT */
	899
	900	#if !defined(MBEDTLS_DEPRECATED_REMOVED)
	901	void mbedtls_aes_encrypt( mbedtls_aes_context *ctx,
	902	const unsigned char input[16],
	903	unsigned char output[16] )
	904	{
	905	mbedtls_internal_aes_encrypt( ctx, input, output );
	906	}
	907	#endif /* !MBEDTLS_DEPRECATED_REMOVED */
	908
	909	/*
	910	* AES-ECB block decryption
	911	*/
	912	#if !defined(MBEDTLS_AES_DECRYPT_ALT)
	913	int mbedtls_internal_aes_decrypt( mbedtls_aes_context *ctx,
	914	const unsigned char input[16],
	915	unsigned char output[16] )
	916	{
	917	int i;
	918	uint32_t *RK, X0, X1, X2, X3, Y0, Y1, Y2, Y3;
	919
	920	RK = ctx->rk;
	921
	922	GET_UINT32_LE( X0, input, 0 ); X0 ^= *RK++;
	923	GET_UINT32_LE( X1, input, 4 ); X1 ^= *RK++;
	924	GET_UINT32_LE( X2, input, 8 ); X2 ^= *RK++;
	925	GET_UINT32_LE( X3, input, 12 ); X3 ^= *RK++;
	926
	927	for( i = ( ctx->nr >> 1 ) - 1; i > 0; i-- )
	928	{
	929	AES_RROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 );
	930	AES_RROUND( X0, X1, X2, X3, Y0, Y1, Y2, Y3 );
	931	}
	932
	933	AES_RROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 );
	934
	935	X0 = *RK++ ^ \
	936	( (uint32_t) RSb[ ( Y0 ) & 0xFF ] ) ^
	937	( (uint32_t) RSb[ ( Y3 >> 8 ) & 0xFF ] << 8 ) ^
	938	( (uint32_t) RSb[ ( Y2 >> 16 ) & 0xFF ] << 16 ) ^
	939	( (uint32_t) RSb[ ( Y1 >> 24 ) & 0xFF ] << 24 );
	940
	941	X1 = *RK++ ^ \
	942	( (uint32_t) RSb[ ( Y1 ) & 0xFF ] ) ^
	943	( (uint32_t) RSb[ ( Y0 >> 8 ) & 0xFF ] << 8 ) ^
	944	( (uint32_t) RSb[ ( Y3 >> 16 ) & 0xFF ] << 16 ) ^
	945	( (uint32_t) RSb[ ( Y2 >> 24 ) & 0xFF ] << 24 );
	946
	947	X2 = *RK++ ^ \
	948	( (uint32_t) RSb[ ( Y2 ) & 0xFF ] ) ^
	949	( (uint32_t) RSb[ ( Y1 >> 8 ) & 0xFF ] << 8 ) ^
	950	( (uint32_t) RSb[ ( Y0 >> 16 ) & 0xFF ] << 16 ) ^
	951	( (uint32_t) RSb[ ( Y3 >> 24 ) & 0xFF ] << 24 );
	952
	953	X3 = *RK++ ^ \
	954	( (uint32_t) RSb[ ( Y3 ) & 0xFF ] ) ^
	955	( (uint32_t) RSb[ ( Y2 >> 8 ) & 0xFF ] << 8 ) ^
	956	( (uint32_t) RSb[ ( Y1 >> 16 ) & 0xFF ] << 16 ) ^
	957	( (uint32_t) RSb[ ( Y0 >> 24 ) & 0xFF ] << 24 );
	958
	959	PUT_UINT32_LE( X0, output, 0 );
	960	PUT_UINT32_LE( X1, output, 4 );
	961	PUT_UINT32_LE( X2, output, 8 );
	962	PUT_UINT32_LE( X3, output, 12 );
	963
	964	return( 0 );
	965	}
	966	#endif /* !MBEDTLS_AES_DECRYPT_ALT */
	967
	968	#if !defined(MBEDTLS_DEPRECATED_REMOVED)
	969	void mbedtls_aes_decrypt( mbedtls_aes_context *ctx,
	970	const unsigned char input[16],
	971	unsigned char output[16] )
	972	{
	973	mbedtls_internal_aes_decrypt( ctx, input, output );
	974	}
	975	#endif /* !MBEDTLS_DEPRECATED_REMOVED */
	976
	977	/*
	978	* AES-ECB block encryption/decryption
	979	*/
	980	int mbedtls_aes_crypt_ecb( mbedtls_aes_context *ctx,
	981	int mode,
	982	const unsigned char input[16],
	983	unsigned char output[16] )
	984	{
	985	#if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64)
	986	if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) )
	987	return( mbedtls_aesni_crypt_ecb( ctx, mode, input, output ) );
	988	#endif
	989
	990	#if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_HAVE_X86)
	991	if( aes_padlock_ace )
	992	{
	993	if( mbedtls_padlock_xcryptecb( ctx, mode, input, output ) == 0 )
	994	return( 0 );
	995
	996	// If padlock data misaligned, we just fall back to
	997	// unaccelerated mode
	998	//
	999	}
	1000	#endif
	1001
	1002	if( mode == MBEDTLS_AES_ENCRYPT )
	1003	return( mbedtls_internal_aes_encrypt( ctx, input, output ) );
	1004	else
	1005	return( mbedtls_internal_aes_decrypt( ctx, input, output ) );
	1006	}
	1007
	1008	#if defined(MBEDTLS_CIPHER_MODE_CBC)
	1009	/*
	1010	* AES-CBC buffer encryption/decryption
	1011	*/
	1012	int mbedtls_aes_crypt_cbc( mbedtls_aes_context *ctx,
	1013	int mode,
	1014	size_t length,
	1015	unsigned char iv[16],
	1016	const unsigned char *input,
	1017	unsigned char *output )
	1018	{
	1019	int i;
	1020	unsigned char temp[16];
	1021
	1022	if( length % 16 )
	1023	return( MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH );
	1024
	1025	#if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_HAVE_X86)
	1026	if( aes_padlock_ace )
	1027	{
	1028	if( mbedtls_padlock_xcryptcbc( ctx, mode, length, iv, input, output ) == 0 )
	1029	return( 0 );
	1030
	1031	// If padlock data misaligned, we just fall back to
	1032	// unaccelerated mode
	1033	//
	1034	}
	1035	#endif
	1036
	1037	if( mode == MBEDTLS_AES_DECRYPT )
	1038	{
	1039	while( length > 0 )
	1040	{
	1041	memcpy( temp, input, 16 );
	1042	mbedtls_aes_crypt_ecb( ctx, mode, input, output );
	1043
	1044	for( i = 0; i < 16; i++ )
	1045	output[i] = (unsigned char)( output[i] ^ iv[i] );
	1046
	1047	memcpy( iv, temp, 16 );
	1048
	1049	input += 16;
	1050	output += 16;
	1051	length -= 16;
	1052	}
	1053	}
	1054	else
	1055	{
	1056	while( length > 0 )
	1057	{
	1058	for( i = 0; i < 16; i++ )
	1059	output[i] = (unsigned char)( input[i] ^ iv[i] );
	1060
	1061	mbedtls_aes_crypt_ecb( ctx, mode, output, output );
	1062	memcpy( iv, output, 16 );
	1063
	1064	input += 16;
	1065	output += 16;
	1066	length -= 16;
	1067	}
	1068	}
	1069
	1070	return( 0 );
	1071	}
	1072	#endif /* MBEDTLS_CIPHER_MODE_CBC */
	1073
	1074	#if defined(MBEDTLS_CIPHER_MODE_XTS)
	1075
	1076	/* Endianess with 64 bits values */
	1077	#ifndef GET_UINT64_LE
	1078	#define GET_UINT64_LE(n,b,i) \
	1079	{ \
	1080	(n) = ( (uint64_t) (b)[(i) + 7] << 56 ) \
	1081	\| ( (uint64_t) (b)[(i) + 6] << 48 ) \
	1082	\| ( (uint64_t) (b)[(i) + 5] << 40 ) \
	1083	\| ( (uint64_t) (b)[(i) + 4] << 32 ) \
	1084	\| ( (uint64_t) (b)[(i) + 3] << 24 ) \
	1085	\| ( (uint64_t) (b)[(i) + 2] << 16 ) \
	1086	\| ( (uint64_t) (b)[(i) + 1] << 8 ) \
	1087	\| ( (uint64_t) (b)[(i) ] ); \
	1088	}
	1089	#endif
	1090
	1091	#ifndef PUT_UINT64_LE
	1092	#define PUT_UINT64_LE(n,b,i) \
	1093	{ \
	1094	(b)[(i) + 7] = (unsigned char) ( (n) >> 56 ); \
	1095	(b)[(i) + 6] = (unsigned char) ( (n) >> 48 ); \
	1096	(b)[(i) + 5] = (unsigned char) ( (n) >> 40 ); \
	1097	(b)[(i) + 4] = (unsigned char) ( (n) >> 32 ); \
	1098	(b)[(i) + 3] = (unsigned char) ( (n) >> 24 ); \
	1099	(b)[(i) + 2] = (unsigned char) ( (n) >> 16 ); \
	1100	(b)[(i) + 1] = (unsigned char) ( (n) >> 8 ); \
	1101	(b)[(i) ] = (unsigned char) ( (n) ); \
	1102	}
	1103	#endif
	1104
	1105	typedef unsigned char mbedtls_be128[16];
	1106
	1107	/*
	1108	* GF(2^128) multiplication function
	1109	*
	1110	* This function multiplies a field element by x in the polynomial field
	1111	* representation. It uses 64-bit word operations to gain speed but compensates
	1112	* for machine endianess and hence works correctly on both big and little
	1113	* endian machines.
	1114	*/
	1115	static void mbedtls_gf128mul_x_ble( unsigned char r[16],
	1116	const unsigned char x[16] )
	1117	{
	1118	uint64_t a, b, ra, rb;
	1119
	1120	GET_UINT64_LE( a, x, 0 );
	1121	GET_UINT64_LE( b, x, 8 );
	1122
	1123	ra = ( a << 1 ) ^ 0x0087 >> ( 8 - ( ( b >> 63 ) << 3 ) );
	1124	rb = ( a >> 63 ) \| ( b << 1 );
	1125
	1126	PUT_UINT64_LE( ra, r, 0 );
	1127	PUT_UINT64_LE( rb, r, 8 );
	1128	}
	1129
	1130	/*
	1131	* AES-XTS buffer encryption/decryption
	1132	*/
	1133	int mbedtls_aes_crypt_xts( mbedtls_aes_xts_context *ctx,
	1134	int mode,
	1135	size_t length,
	1136	const unsigned char data_unit[16],
	1137	const unsigned char *input,
	1138	unsigned char *output )
	1139	{
	1140	int ret;
	1141	size_t blocks = length / 16;
	1142	size_t leftover = length % 16;
	1143	unsigned char tweak[16];
	1144	unsigned char prev_tweak[16];
	1145	unsigned char tmp[16];
	1146
	1147	/* Sectors must be at least 16 bytes. */
	1148	if( length < 16 )
	1149	return MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH;
	1150
	1151	/* NIST SP 80-38E disallows data units larger than 2*20 blocks. /
	1152	if( length > ( 1 << 20 ) * 16 )
	1153	return MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH;
	1154
	1155	/* Compute the tweak. */
	1156	ret = mbedtls_aes_crypt_ecb( &ctx->tweak, MBEDTLS_AES_ENCRYPT,
	1157	data_unit, tweak );
	1158	if( ret != 0 )
	1159	return( ret );
	1160
	1161	while( blocks-- )
	1162	{
	1163	size_t i;
	1164
	1165	if( leftover && ( mode == MBEDTLS_AES_DECRYPT ) && blocks == 0 )
	1166	{
	1167	/* We are on the last block in a decrypt operation that has
	1168	* leftover bytes, so we need to use the next tweak for this block,
	1169	* and this tweak for the lefover bytes. Save the current tweak for
	1170	* the leftovers and then update the current tweak for use on this,
	1171	* the last full block. */
	1172	memcpy( prev_tweak, tweak, sizeof( tweak ) );
	1173	mbedtls_gf128mul_x_ble( tweak, tweak );
	1174	}
	1175
	1176	for( i = 0; i < 16; i++ )
	1177	tmp[i] = input[i] ^ tweak[i];
	1178
	1179	ret = mbedtls_aes_crypt_ecb( &ctx->crypt, mode, tmp, tmp );
	1180	if( ret != 0 )
	1181	return( ret );
	1182
	1183	for( i = 0; i < 16; i++ )
	1184	output[i] = tmp[i] ^ tweak[i];
	1185
	1186	/* Update the tweak for the next block. */
	1187	mbedtls_gf128mul_x_ble( tweak, tweak );
	1188
	1189	output += 16;
	1190	input += 16;
	1191	}
	1192
	1193	if( leftover )
	1194	{
	1195	/* If we are on the leftover bytes in a decrypt operation, we need to
	1196	* use the previous tweak for these bytes (as saved in prev_tweak). */
	1197	unsigned char *t = mode == MBEDTLS_AES_DECRYPT ? prev_tweak : tweak;
	1198
	1199	/* We are now on the final part of the data unit, which doesn't divide
	1200	* evenly by 16. It's time for ciphertext stealing. */
	1201	size_t i;
	1202	unsigned char *prev_output = output - 16;
	1203
	1204	/* Copy ciphertext bytes from the previous block to our output for each
	1205	* byte of cyphertext we won't steal. At the same time, copy the
	1206	* remainder of the input for this final round (since the loop bounds
	1207	* are the same). */
	1208	for( i = 0; i < leftover; i++ )
	1209	{
	1210	output[i] = prev_output[i];
	1211	tmp[i] = input[i] ^ t[i];
	1212	}
	1213
	1214	/* Copy ciphertext bytes from the previous block for input in this
	1215	* round. */
	1216	for( ; i < 16; i++ )
	1217	tmp[i] = prev_output[i] ^ t[i];
	1218
	1219	ret = mbedtls_aes_crypt_ecb( &ctx->crypt, mode, tmp, tmp );
	1220	if( ret != 0 )
	1221	return ret;
	1222
	1223	/* Write the result back to the previous block, overriding the previous
	1224	* output we copied. */
	1225	for( i = 0; i < 16; i++ )
	1226	prev_output[i] = tmp[i] ^ t[i];
	1227	}
	1228
	1229	return( 0 );
	1230	}
	1231	#endif /* MBEDTLS_CIPHER_MODE_XTS */
	1232
	1233	#if defined(MBEDTLS_CIPHER_MODE_CFB)
	1234	/*
	1235	* AES-CFB128 buffer encryption/decryption
	1236	*/
	1237	int mbedtls_aes_crypt_cfb128( mbedtls_aes_context *ctx,
	1238	int mode,
	1239	size_t length,
	1240	size_t *iv_off,
	1241	unsigned char iv[16],
	1242	const unsigned char *input,
	1243	unsigned char *output )
	1244	{
	1245	int c;
	1246	size_t n = *iv_off;
	1247
	1248	if( mode == MBEDTLS_AES_DECRYPT )
	1249	{
	1250	while( length-- )
	1251	{
	1252	if( n == 0 )
	1253	mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv );
	1254
	1255	c = *input++;
	1256	*output++ = (unsigned char)( c ^ iv[n] );
	1257	iv[n] = (unsigned char) c;
	1258
	1259	n = ( n + 1 ) & 0x0F;
	1260	}
	1261	}
	1262	else
	1263	{
	1264	while( length-- )
	1265	{
	1266	if( n == 0 )
	1267	mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv );
	1268
	1269	iv[n] = output++ = (unsigned char)( iv[n] ^ input++ );
	1270
	1271	n = ( n + 1 ) & 0x0F;
	1272	}
	1273	}
	1274
	1275	*iv_off = n;
	1276
	1277	return( 0 );
	1278	}
	1279
	1280	/*
	1281	* AES-CFB8 buffer encryption/decryption
	1282	*/
	1283	int mbedtls_aes_crypt_cfb8( mbedtls_aes_context *ctx,
	1284	int mode,
	1285	size_t length,
	1286	unsigned char iv[16],
	1287	const unsigned char *input,
	1288	unsigned char *output )
	1289	{
	1290	unsigned char c;
	1291	unsigned char ov[17];
	1292
	1293	while( length-- )
	1294	{
	1295	memcpy( ov, iv, 16 );
	1296	mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv );
	1297
	1298	if( mode == MBEDTLS_AES_DECRYPT )
	1299	ov[16] = *input;
	1300
	1301	c = output++ = (unsigned char)( iv[0] ^ input++ );
	1302
	1303	if( mode == MBEDTLS_AES_ENCRYPT )
	1304	ov[16] = c;
	1305
	1306	memcpy( iv, ov + 1, 16 );
	1307	}
	1308
	1309	return( 0 );
	1310	}
	1311	#endif /* MBEDTLS_CIPHER_MODE_CFB */
	1312
	1313	#if defined(MBEDTLS_CIPHER_MODE_OFB)
	1314	/*
	1315	* AES-OFB (Output Feedback Mode) buffer encryption/decryption
	1316	*/
	1317	int mbedtls_aes_crypt_ofb( mbedtls_aes_context *ctx,
	1318	size_t length,
	1319	size_t *iv_off,
	1320	unsigned char iv[16],
	1321	const unsigned char *input,
	1322	unsigned char *output )
	1323	{
	1324	int ret = 0;
	1325	size_t n = *iv_off;
	1326
	1327	while( length-- )
	1328	{
	1329	if( n == 0 )
	1330	{
	1331	ret = mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, iv, iv );
	1332	if( ret != 0 )
	1333	goto exit;
	1334	}
	1335	output++ = input++ ^ iv[n];
	1336
	1337	n = ( n + 1 ) & 0x0F;
	1338	}
	1339
	1340	*iv_off = n;
	1341
	1342	exit:
	1343	return( ret );
	1344	}
	1345	#endif /* MBEDTLS_CIPHER_MODE_OFB */
	1346
	1347	#if defined(MBEDTLS_CIPHER_MODE_CTR)
	1348	/*
	1349	* AES-CTR buffer encryption/decryption
	1350	*/
	1351	int mbedtls_aes_crypt_ctr( mbedtls_aes_context *ctx,
	1352	size_t length,
	1353	size_t *nc_off,
	1354	unsigned char nonce_counter[16],
	1355	unsigned char stream_block[16],
	1356	const unsigned char *input,
	1357	unsigned char *output )
	1358	{
	1359	int c, i;
	1360	size_t n = *nc_off;
	1361
	1362	if ( n > 0x0F )
	1363	return( MBEDTLS_ERR_AES_BAD_INPUT_DATA );
	1364
	1365	while( length-- )
	1366	{
	1367	if( n == 0 ) {
	1368	mbedtls_aes_crypt_ecb( ctx, MBEDTLS_AES_ENCRYPT, nonce_counter, stream_block );
	1369
	1370	for( i = 16; i > 0; i-- )
	1371	if( ++nonce_counter[i - 1] != 0 )
	1372	break;
	1373	}
	1374	c = *input++;
	1375	*output++ = (unsigned char)( c ^ stream_block[n] );
	1376
	1377	n = ( n + 1 ) & 0x0F;
	1378	}
	1379
	1380	*nc_off = n;
	1381
	1382	return( 0 );
	1383	}
	1384	#endif /* MBEDTLS_CIPHER_MODE_CTR */
	1385
	1386	#endif /* !MBEDTLS_AES_ALT */
	1387
	1388	#if defined(MBEDTLS_SELF_TEST)
	1389	/*
	1390	* AES test vectors from:
	1391	*
	1392	* http://csrc.nist.gov/archive/aes/rijndael/rijndael-vals.zip
	1393	*/
	1394	static const unsigned char aes_test_ecb_dec[3][16] =
	1395	{
	1396	{ 0x44, 0x41, 0x6A, 0xC2, 0xD1, 0xF5, 0x3C, 0x58,
	1397	0x33, 0x03, 0x91, 0x7E, 0x6B, 0xE9, 0xEB, 0xE0 },
	1398	{ 0x48, 0xE3, 0x1E, 0x9E, 0x25, 0x67, 0x18, 0xF2,
	1399	0x92, 0x29, 0x31, 0x9C, 0x19, 0xF1, 0x5B, 0xA4 },
	1400	{ 0x05, 0x8C, 0xCF, 0xFD, 0xBB, 0xCB, 0x38, 0x2D,
	1401	0x1F, 0x6F, 0x56, 0x58, 0x5D, 0x8A, 0x4A, 0xDE }
	1402	};
	1403
	1404	static const unsigned char aes_test_ecb_enc[3][16] =
	1405	{
	1406	{ 0xC3, 0x4C, 0x05, 0x2C, 0xC0, 0xDA, 0x8D, 0x73,
	1407	0x45, 0x1A, 0xFE, 0x5F, 0x03, 0xBE, 0x29, 0x7F },
	1408	{ 0xF3, 0xF6, 0x75, 0x2A, 0xE8, 0xD7, 0x83, 0x11,
	1409	0x38, 0xF0, 0x41, 0x56, 0x06, 0x31, 0xB1, 0x14 },
	1410	{ 0x8B, 0x79, 0xEE, 0xCC, 0x93, 0xA0, 0xEE, 0x5D,
	1411	0xFF, 0x30, 0xB4, 0xEA, 0x21, 0x63, 0x6D, 0xA4 }
	1412	};
	1413
	1414	#if defined(MBEDTLS_CIPHER_MODE_CBC)
	1415	static const unsigned char aes_test_cbc_dec[3][16] =
	1416	{
	1417	{ 0xFA, 0xCA, 0x37, 0xE0, 0xB0, 0xC8, 0x53, 0x73,
	1418	0xDF, 0x70, 0x6E, 0x73, 0xF7, 0xC9, 0xAF, 0x86 },
	1419	{ 0x5D, 0xF6, 0x78, 0xDD, 0x17, 0xBA, 0x4E, 0x75,
	1420	0xB6, 0x17, 0x68, 0xC6, 0xAD, 0xEF, 0x7C, 0x7B },
	1421	{ 0x48, 0x04, 0xE1, 0x81, 0x8F, 0xE6, 0x29, 0x75,
	1422	0x19, 0xA3, 0xE8, 0x8C, 0x57, 0x31, 0x04, 0x13 }
	1423	};
	1424
	1425	static const unsigned char aes_test_cbc_enc[3][16] =
	1426	{
	1427	{ 0x8A, 0x05, 0xFC, 0x5E, 0x09, 0x5A, 0xF4, 0x84,
	1428	0x8A, 0x08, 0xD3, 0x28, 0xD3, 0x68, 0x8E, 0x3D },
	1429	{ 0x7B, 0xD9, 0x66, 0xD5, 0x3A, 0xD8, 0xC1, 0xBB,
	1430	0x85, 0xD2, 0xAD, 0xFA, 0xE8, 0x7B, 0xB1, 0x04 },
	1431	{ 0xFE, 0x3C, 0x53, 0x65, 0x3E, 0x2F, 0x45, 0xB5,
	1432	0x6F, 0xCD, 0x88, 0xB2, 0xCC, 0x89, 0x8F, 0xF0 }
	1433	};
	1434	#endif /* MBEDTLS_CIPHER_MODE_CBC */
	1435
	1436	#if defined(MBEDTLS_CIPHER_MODE_CFB)
	1437	/*
	1438	* AES-CFB128 test vectors from:
	1439	*
	1440	* http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
	1441	*/
	1442	static const unsigned char aes_test_cfb128_key[3][32] =
	1443	{
	1444	{ 0x2B, 0x7E, 0x15, 0x16, 0x28, 0xAE, 0xD2, 0xA6,
	1445	0xAB, 0xF7, 0x15, 0x88, 0x09, 0xCF, 0x4F, 0x3C },
	1446	{ 0x8E, 0x73, 0xB0, 0xF7, 0xDA, 0x0E, 0x64, 0x52,
	1447	0xC8, 0x10, 0xF3, 0x2B, 0x80, 0x90, 0x79, 0xE5,
	1448	0x62, 0xF8, 0xEA, 0xD2, 0x52, 0x2C, 0x6B, 0x7B },
	1449	{ 0x60, 0x3D, 0xEB, 0x10, 0x15, 0xCA, 0x71, 0xBE,
	1450	0x2B, 0x73, 0xAE, 0xF0, 0x85, 0x7D, 0x77, 0x81,
	1451	0x1F, 0x35, 0x2C, 0x07, 0x3B, 0x61, 0x08, 0xD7,
	1452	0x2D, 0x98, 0x10, 0xA3, 0x09, 0x14, 0xDF, 0xF4 }
	1453	};
	1454
	1455	static const unsigned char aes_test_cfb128_iv[16] =
	1456	{
	1457	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
	1458	0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F
	1459	};
	1460
	1461	static const unsigned char aes_test_cfb128_pt[64] =
	1462	{
	1463	0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96,
	1464	0xE9, 0x3D, 0x7E, 0x11, 0x73, 0x93, 0x17, 0x2A,
	1465	0xAE, 0x2D, 0x8A, 0x57, 0x1E, 0x03, 0xAC, 0x9C,
	1466	0x9E, 0xB7, 0x6F, 0xAC, 0x45, 0xAF, 0x8E, 0x51,
	1467	0x30, 0xC8, 0x1C, 0x46, 0xA3, 0x5C, 0xE4, 0x11,
	1468	0xE5, 0xFB, 0xC1, 0x19, 0x1A, 0x0A, 0x52, 0xEF,
	1469	0xF6, 0x9F, 0x24, 0x45, 0xDF, 0x4F, 0x9B, 0x17,
	1470	0xAD, 0x2B, 0x41, 0x7B, 0xE6, 0x6C, 0x37, 0x10
	1471	};
	1472
	1473	static const unsigned char aes_test_cfb128_ct[3][64] =
	1474	{
	1475	{ 0x3B, 0x3F, 0xD9, 0x2E, 0xB7, 0x2D, 0xAD, 0x20,
	1476	0x33, 0x34, 0x49, 0xF8, 0xE8, 0x3C, 0xFB, 0x4A,
	1477	0xC8, 0xA6, 0x45, 0x37, 0xA0, 0xB3, 0xA9, 0x3F,
	1478	0xCD, 0xE3, 0xCD, 0xAD, 0x9F, 0x1C, 0xE5, 0x8B,
	1479	0x26, 0x75, 0x1F, 0x67, 0xA3, 0xCB, 0xB1, 0x40,
	1480	0xB1, 0x80, 0x8C, 0xF1, 0x87, 0xA4, 0xF4, 0xDF,
	1481	0xC0, 0x4B, 0x05, 0x35, 0x7C, 0x5D, 0x1C, 0x0E,
	1482	0xEA, 0xC4, 0xC6, 0x6F, 0x9F, 0xF7, 0xF2, 0xE6 },
	1483	{ 0xCD, 0xC8, 0x0D, 0x6F, 0xDD, 0xF1, 0x8C, 0xAB,
	1484	0x34, 0xC2, 0x59, 0x09, 0xC9, 0x9A, 0x41, 0x74,
	1485	0x67, 0xCE, 0x7F, 0x7F, 0x81, 0x17, 0x36, 0x21,
	1486	0x96, 0x1A, 0x2B, 0x70, 0x17, 0x1D, 0x3D, 0x7A,
	1487	0x2E, 0x1E, 0x8A, 0x1D, 0xD5, 0x9B, 0x88, 0xB1,
	1488	0xC8, 0xE6, 0x0F, 0xED, 0x1E, 0xFA, 0xC4, 0xC9,
	1489	0xC0, 0x5F, 0x9F, 0x9C, 0xA9, 0x83, 0x4F, 0xA0,
	1490	0x42, 0xAE, 0x8F, 0xBA, 0x58, 0x4B, 0x09, 0xFF },
	1491	{ 0xDC, 0x7E, 0x84, 0xBF, 0xDA, 0x79, 0x16, 0x4B,
	1492	0x7E, 0xCD, 0x84, 0x86, 0x98, 0x5D, 0x38, 0x60,
	1493	0x39, 0xFF, 0xED, 0x14, 0x3B, 0x28, 0xB1, 0xC8,
	1494	0x32, 0x11, 0x3C, 0x63, 0x31, 0xE5, 0x40, 0x7B,
	1495	0xDF, 0x10, 0x13, 0x24, 0x15, 0xE5, 0x4B, 0x92,
	1496	0xA1, 0x3E, 0xD0, 0xA8, 0x26, 0x7A, 0xE2, 0xF9,
	1497	0x75, 0xA3, 0x85, 0x74, 0x1A, 0xB9, 0xCE, 0xF8,
	1498	0x20, 0x31, 0x62, 0x3D, 0x55, 0xB1, 0xE4, 0x71 }
	1499	};
	1500	#endif /* MBEDTLS_CIPHER_MODE_CFB */
	1501
	1502	#if defined(MBEDTLS_CIPHER_MODE_OFB)
	1503	/*
	1504	* AES-OFB test vectors from:
	1505	*
	1506	* https://csrc.nist.gov/publications/detail/sp/800-38a/final
	1507	*/
	1508	static const unsigned char aes_test_ofb_key[3][32] =
	1509	{
	1510	{ 0x2B, 0x7E, 0x15, 0x16, 0x28, 0xAE, 0xD2, 0xA6,
	1511	0xAB, 0xF7, 0x15, 0x88, 0x09, 0xCF, 0x4F, 0x3C },
	1512	{ 0x8E, 0x73, 0xB0, 0xF7, 0xDA, 0x0E, 0x64, 0x52,
	1513	0xC8, 0x10, 0xF3, 0x2B, 0x80, 0x90, 0x79, 0xE5,
	1514	0x62, 0xF8, 0xEA, 0xD2, 0x52, 0x2C, 0x6B, 0x7B },
	1515	{ 0x60, 0x3D, 0xEB, 0x10, 0x15, 0xCA, 0x71, 0xBE,
	1516	0x2B, 0x73, 0xAE, 0xF0, 0x85, 0x7D, 0x77, 0x81,
	1517	0x1F, 0x35, 0x2C, 0x07, 0x3B, 0x61, 0x08, 0xD7,
	1518	0x2D, 0x98, 0x10, 0xA3, 0x09, 0x14, 0xDF, 0xF4 }
	1519	};
	1520
	1521	static const unsigned char aes_test_ofb_iv[16] =
	1522	{
	1523	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
	1524	0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F
	1525	};
	1526
	1527	static const unsigned char aes_test_ofb_pt[64] =
	1528	{
	1529	0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96,
	1530	0xE9, 0x3D, 0x7E, 0x11, 0x73, 0x93, 0x17, 0x2A,
	1531	0xAE, 0x2D, 0x8A, 0x57, 0x1E, 0x03, 0xAC, 0x9C,
	1532	0x9E, 0xB7, 0x6F, 0xAC, 0x45, 0xAF, 0x8E, 0x51,
	1533	0x30, 0xC8, 0x1C, 0x46, 0xA3, 0x5C, 0xE4, 0x11,
	1534	0xE5, 0xFB, 0xC1, 0x19, 0x1A, 0x0A, 0x52, 0xEF,
	1535	0xF6, 0x9F, 0x24, 0x45, 0xDF, 0x4F, 0x9B, 0x17,
	1536	0xAD, 0x2B, 0x41, 0x7B, 0xE6, 0x6C, 0x37, 0x10
	1537	};
	1538
	1539	static const unsigned char aes_test_ofb_ct[3][64] =
	1540	{
	1541	{ 0x3B, 0x3F, 0xD9, 0x2E, 0xB7, 0x2D, 0xAD, 0x20,
	1542	0x33, 0x34, 0x49, 0xF8, 0xE8, 0x3C, 0xFB, 0x4A,
	1543	0x77, 0x89, 0x50, 0x8d, 0x16, 0x91, 0x8f, 0x03,
	1544	0xf5, 0x3c, 0x52, 0xda, 0xc5, 0x4e, 0xd8, 0x25,
	1545	0x97, 0x40, 0x05, 0x1e, 0x9c, 0x5f, 0xec, 0xf6,
	1546	0x43, 0x44, 0xf7, 0xa8, 0x22, 0x60, 0xed, 0xcc,
	1547	0x30, 0x4c, 0x65, 0x28, 0xf6, 0x59, 0xc7, 0x78,
	1548	0x66, 0xa5, 0x10, 0xd9, 0xc1, 0xd6, 0xae, 0x5e },
	1549	{ 0xCD, 0xC8, 0x0D, 0x6F, 0xDD, 0xF1, 0x8C, 0xAB,
	1550	0x34, 0xC2, 0x59, 0x09, 0xC9, 0x9A, 0x41, 0x74,
	1551	0xfc, 0xc2, 0x8b, 0x8d, 0x4c, 0x63, 0x83, 0x7c,
	1552	0x09, 0xe8, 0x17, 0x00, 0xc1, 0x10, 0x04, 0x01,
	1553	0x8d, 0x9a, 0x9a, 0xea, 0xc0, 0xf6, 0x59, 0x6f,
	1554	0x55, 0x9c, 0x6d, 0x4d, 0xaf, 0x59, 0xa5, 0xf2,
	1555	0x6d, 0x9f, 0x20, 0x08, 0x57, 0xca, 0x6c, 0x3e,
	1556	0x9c, 0xac, 0x52, 0x4b, 0xd9, 0xac, 0xc9, 0x2a },
	1557	{ 0xDC, 0x7E, 0x84, 0xBF, 0xDA, 0x79, 0x16, 0x4B,
	1558	0x7E, 0xCD, 0x84, 0x86, 0x98, 0x5D, 0x38, 0x60,
	1559	0x4f, 0xeb, 0xdc, 0x67, 0x40, 0xd2, 0x0b, 0x3a,
	1560	0xc8, 0x8f, 0x6a, 0xd8, 0x2a, 0x4f, 0xb0, 0x8d,
	1561	0x71, 0xab, 0x47, 0xa0, 0x86, 0xe8, 0x6e, 0xed,
	1562	0xf3, 0x9d, 0x1c, 0x5b, 0xba, 0x97, 0xc4, 0x08,
	1563	0x01, 0x26, 0x14, 0x1d, 0x67, 0xf3, 0x7b, 0xe8,
	1564	0x53, 0x8f, 0x5a, 0x8b, 0xe7, 0x40, 0xe4, 0x84 }
	1565	};
	1566	#endif /* MBEDTLS_CIPHER_MODE_OFB */
	1567
	1568	#if defined(MBEDTLS_CIPHER_MODE_CTR)
	1569	/*
	1570	* AES-CTR test vectors from:
	1571	*
	1572	* http://www.faqs.org/rfcs/rfc3686.html
	1573	*/
	1574
	1575	static const unsigned char aes_test_ctr_key[3][16] =
	1576	{
	1577	{ 0xAE, 0x68, 0x52, 0xF8, 0x12, 0x10, 0x67, 0xCC,
	1578	0x4B, 0xF7, 0xA5, 0x76, 0x55, 0x77, 0xF3, 0x9E },
	1579	{ 0x7E, 0x24, 0x06, 0x78, 0x17, 0xFA, 0xE0, 0xD7,
	1580	0x43, 0xD6, 0xCE, 0x1F, 0x32, 0x53, 0x91, 0x63 },
	1581	{ 0x76, 0x91, 0xBE, 0x03, 0x5E, 0x50, 0x20, 0xA8,
	1582	0xAC, 0x6E, 0x61, 0x85, 0x29, 0xF9, 0xA0, 0xDC }
	1583	};
	1584
	1585	static const unsigned char aes_test_ctr_nonce_counter[3][16] =
	1586	{
	1587	{ 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x00,
	1588	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 },
	1589	{ 0x00, 0x6C, 0xB6, 0xDB, 0xC0, 0x54, 0x3B, 0x59,
	1590	0xDA, 0x48, 0xD9, 0x0B, 0x00, 0x00, 0x00, 0x01 },
	1591	{ 0x00, 0xE0, 0x01, 0x7B, 0x27, 0x77, 0x7F, 0x3F,
	1592	0x4A, 0x17, 0x86, 0xF0, 0x00, 0x00, 0x00, 0x01 }
	1593	};
	1594
	1595	static const unsigned char aes_test_ctr_pt[3][48] =
	1596	{
	1597	{ 0x53, 0x69, 0x6E, 0x67, 0x6C, 0x65, 0x20, 0x62,
	1598	0x6C, 0x6F, 0x63, 0x6B, 0x20, 0x6D, 0x73, 0x67 },
	1599
	1600	{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
	1601	0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
	1602	0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
	1603	0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F },
	1604
	1605	{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
	1606	0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
	1607	0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
	1608	0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F,
	1609	0x20, 0x21, 0x22, 0x23 }
	1610	};
	1611
	1612	static const unsigned char aes_test_ctr_ct[3][48] =
	1613	{
	1614	{ 0xE4, 0x09, 0x5D, 0x4F, 0xB7, 0xA7, 0xB3, 0x79,
	1615	0x2D, 0x61, 0x75, 0xA3, 0x26, 0x13, 0x11, 0xB8 },
	1616	{ 0x51, 0x04, 0xA1, 0x06, 0x16, 0x8A, 0x72, 0xD9,
	1617	0x79, 0x0D, 0x41, 0xEE, 0x8E, 0xDA, 0xD3, 0x88,
	1618	0xEB, 0x2E, 0x1E, 0xFC, 0x46, 0xDA, 0x57, 0xC8,
	1619	0xFC, 0xE6, 0x30, 0xDF, 0x91, 0x41, 0xBE, 0x28 },
	1620	{ 0xC1, 0xCF, 0x48, 0xA8, 0x9F, 0x2F, 0xFD, 0xD9,
	1621	0xCF, 0x46, 0x52, 0xE9, 0xEF, 0xDB, 0x72, 0xD7,
	1622	0x45, 0x40, 0xA4, 0x2B, 0xDE, 0x6D, 0x78, 0x36,
	1623	0xD5, 0x9A, 0x5C, 0xEA, 0xAE, 0xF3, 0x10, 0x53,
	1624	0x25, 0xB2, 0x07, 0x2F }
	1625	};
	1626
	1627	static const int aes_test_ctr_len[3] =
	1628	{ 16, 32, 36 };
	1629	#endif /* MBEDTLS_CIPHER_MODE_CTR */
	1630
	1631	#if defined(MBEDTLS_CIPHER_MODE_XTS)
	1632	/*
	1633	* AES-XTS test vectors from:
	1634	*
	1635	* IEEE P1619/D16 Annex B
	1636	* https://web.archive.org/web/20150629024421/http://grouper.ieee.org/groups/1619/email/pdf00086.pdf
	1637	* (Archived from original at http://grouper.ieee.org/groups/1619/email/pdf00086.pdf)
	1638	*/
	1639	static const unsigned char aes_test_xts_key[][32] =
	1640	{
	1641	{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	1642	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	1643	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	1644	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
	1645	{ 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11,
	1646	0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11,
	1647	0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22,
	1648	0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22 },
	1649	{ 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8,
	1650	0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
	1651	0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22,
	1652	0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22 },
	1653	};
	1654
	1655	static const unsigned char aes_test_xts_pt32[][32] =
	1656	{
	1657	{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	1658	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	1659	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	1660	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
	1661	{ 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
	1662	0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
	1663	0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
	1664	0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44 },
	1665	{ 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
	1666	0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
	1667	0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
	1668	0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44 },
	1669	};
	1670
	1671	static const unsigned char aes_test_xts_ct32[][32] =
	1672	{
	1673	{ 0x91, 0x7c, 0xf6, 0x9e, 0xbd, 0x68, 0xb2, 0xec,
	1674	0x9b, 0x9f, 0xe9, 0xa3, 0xea, 0xdd, 0xa6, 0x92,
	1675	0xcd, 0x43, 0xd2, 0xf5, 0x95, 0x98, 0xed, 0x85,
	1676	0x8c, 0x02, 0xc2, 0x65, 0x2f, 0xbf, 0x92, 0x2e },
	1677	{ 0xc4, 0x54, 0x18, 0x5e, 0x6a, 0x16, 0x93, 0x6e,
	1678	0x39, 0x33, 0x40, 0x38, 0xac, 0xef, 0x83, 0x8b,
	1679	0xfb, 0x18, 0x6f, 0xff, 0x74, 0x80, 0xad, 0xc4,
	1680	0x28, 0x93, 0x82, 0xec, 0xd6, 0xd3, 0x94, 0xf0 },
	1681	{ 0xaf, 0x85, 0x33, 0x6b, 0x59, 0x7a, 0xfc, 0x1a,
	1682	0x90, 0x0b, 0x2e, 0xb2, 0x1e, 0xc9, 0x49, 0xd2,
	1683	0x92, 0xdf, 0x4c, 0x04, 0x7e, 0x0b, 0x21, 0x53,
	1684	0x21, 0x86, 0xa5, 0x97, 0x1a, 0x22, 0x7a, 0x89 },
	1685	};
	1686
	1687	static const unsigned char aes_test_xts_data_unit[][16] =
	1688	{
	1689	{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	1690	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
	1691	{ 0x33, 0x33, 0x33, 0x33, 0x33, 0x00, 0x00, 0x00,
	1692	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
	1693	{ 0x33, 0x33, 0x33, 0x33, 0x33, 0x00, 0x00, 0x00,
	1694	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
	1695	};
	1696
	1697	#endif /* MBEDTLS_CIPHER_MODE_XTS */
	1698
	1699	/*
	1700	* Checkup routine
	1701	*/
	1702	int mbedtls_aes_self_test( int verbose )
	1703	{
	1704	int ret = 0, i, j, u, mode;
	1705	unsigned int keybits;
	1706	unsigned char key[32];
	1707	unsigned char buf[64];
	1708	const unsigned char *aes_tests;
	1709	#if defined(MBEDTLS_CIPHER_MODE_CBC) \|\| defined(MBEDTLS_CIPHER_MODE_CFB)
	1710	unsigned char iv[16];
	1711	#endif
	1712	#if defined(MBEDTLS_CIPHER_MODE_CBC)
	1713	unsigned char prv[16];
	1714	#endif
	1715	#if defined(MBEDTLS_CIPHER_MODE_CTR) \|\| defined(MBEDTLS_CIPHER_MODE_CFB) \|\| \
	1716	defined(MBEDTLS_CIPHER_MODE_OFB)
	1717	size_t offset;
	1718	#endif
	1719	#if defined(MBEDTLS_CIPHER_MODE_CTR) \|\| defined(MBEDTLS_CIPHER_MODE_XTS)
	1720	int len;
	1721	#endif
	1722	#if defined(MBEDTLS_CIPHER_MODE_CTR)
	1723	unsigned char nonce_counter[16];
	1724	unsigned char stream_block[16];
	1725	#endif
	1726	mbedtls_aes_context ctx;
	1727
	1728	memset( key, 0, 32 );
	1729	mbedtls_aes_init( &ctx );
	1730
	1731	/*
	1732	* ECB mode
	1733	*/
	1734	for( i = 0; i < 6; i++ )
	1735	{
	1736	u = i >> 1;
	1737	keybits = 128 + u * 64;
	1738	mode = i & 1;
	1739
	1740	if( verbose != 0 )
	1741	mbedtls_printf( " AES-ECB-%3d (%s): ", keybits,
	1742	( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" );
	1743
	1744	memset( buf, 0, 16 );
	1745
	1746	if( mode == MBEDTLS_AES_DECRYPT )
	1747	{
	1748	ret = mbedtls_aes_setkey_dec( &ctx, key, keybits );
	1749	aes_tests = aes_test_ecb_dec[u];
	1750	}
	1751	else
	1752	{
	1753	ret = mbedtls_aes_setkey_enc( &ctx, key, keybits );
	1754	aes_tests = aes_test_ecb_enc[u];
	1755	}
	1756
	1757	/*
	1758	* AES-192 is an optional feature that may be unavailable when
	1759	* there is an alternative underlying implementation i.e. when
	1760	* MBEDTLS_AES_ALT is defined.
	1761	*/
	1762	if( ret == MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE && keybits == 192 )
	1763	{
	1764	mbedtls_printf( "skipped\n" );
	1765	continue;
	1766	}
	1767	else if( ret != 0 )
	1768	{
	1769	goto exit;
	1770	}
	1771
	1772	for( j = 0; j < 10000; j++ )
	1773	{
	1774	ret = mbedtls_aes_crypt_ecb( &ctx, mode, buf, buf );
	1775	if( ret != 0 )
	1776	goto exit;
	1777	}
	1778
	1779	if( memcmp( buf, aes_tests, 16 ) != 0 )
	1780	{
	1781	ret = 1;
	1782	goto exit;
	1783	}
	1784
	1785	if( verbose != 0 )
	1786	mbedtls_printf( "passed\n" );
	1787	}
	1788
	1789	if( verbose != 0 )
	1790	mbedtls_printf( "\n" );
	1791
	1792	#if defined(MBEDTLS_CIPHER_MODE_CBC)
	1793	/*
	1794	* CBC mode
	1795	*/
	1796	for( i = 0; i < 6; i++ )
	1797	{
	1798	u = i >> 1;
	1799	keybits = 128 + u * 64;
	1800	mode = i & 1;
	1801
	1802	if( verbose != 0 )
	1803	mbedtls_printf( " AES-CBC-%3d (%s): ", keybits,
	1804	( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" );
	1805
	1806	memset( iv , 0, 16 );
	1807	memset( prv, 0, 16 );
	1808	memset( buf, 0, 16 );
	1809
	1810	if( mode == MBEDTLS_AES_DECRYPT )
	1811	{
	1812	ret = mbedtls_aes_setkey_dec( &ctx, key, keybits );
	1813	aes_tests = aes_test_cbc_dec[u];
	1814	}
	1815	else
	1816	{
	1817	ret = mbedtls_aes_setkey_enc( &ctx, key, keybits );
	1818	aes_tests = aes_test_cbc_enc[u];
	1819	}
	1820
	1821	/*
	1822	* AES-192 is an optional feature that may be unavailable when
	1823	* there is an alternative underlying implementation i.e. when
	1824	* MBEDTLS_AES_ALT is defined.
	1825	*/
	1826	if( ret == MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE && keybits == 192 )
	1827	{
	1828	mbedtls_printf( "skipped\n" );
	1829	continue;
	1830	}
	1831	else if( ret != 0 )
	1832	{
	1833	goto exit;
	1834	}
	1835
	1836	for( j = 0; j < 10000; j++ )
	1837	{
	1838	if( mode == MBEDTLS_AES_ENCRYPT )
	1839	{
	1840	unsigned char tmp[16];
	1841
	1842	memcpy( tmp, prv, 16 );
	1843	memcpy( prv, buf, 16 );
	1844	memcpy( buf, tmp, 16 );
	1845	}
	1846
	1847	ret = mbedtls_aes_crypt_cbc( &ctx, mode, 16, iv, buf, buf );
	1848	if( ret != 0 )
	1849	goto exit;
	1850
	1851	}
	1852
	1853	if( memcmp( buf, aes_tests, 16 ) != 0 )
	1854	{
	1855	ret = 1;
	1856	goto exit;
	1857	}
	1858
	1859	if( verbose != 0 )
	1860	mbedtls_printf( "passed\n" );
	1861	}
	1862
	1863	if( verbose != 0 )
	1864	mbedtls_printf( "\n" );
	1865	#endif /* MBEDTLS_CIPHER_MODE_CBC */
	1866
	1867	#if defined(MBEDTLS_CIPHER_MODE_CFB)
	1868	/*
	1869	* CFB128 mode
	1870	*/
	1871	for( i = 0; i < 6; i++ )
	1872	{
	1873	u = i >> 1;
	1874	keybits = 128 + u * 64;
	1875	mode = i & 1;
	1876
	1877	if( verbose != 0 )
	1878	mbedtls_printf( " AES-CFB128-%3d (%s): ", keybits,
	1879	( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" );
	1880
	1881	memcpy( iv, aes_test_cfb128_iv, 16 );
	1882	memcpy( key, aes_test_cfb128_key[u], keybits / 8 );
	1883
	1884	offset = 0;
	1885	ret = mbedtls_aes_setkey_enc( &ctx, key, keybits );
	1886	/*
	1887	* AES-192 is an optional feature that may be unavailable when
	1888	* there is an alternative underlying implementation i.e. when
	1889	* MBEDTLS_AES_ALT is defined.
	1890	*/
	1891	if( ret == MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE && keybits == 192 )
	1892	{
	1893	mbedtls_printf( "skipped\n" );
	1894	continue;
	1895	}
	1896	else if( ret != 0 )
	1897	{
	1898	goto exit;
	1899	}
	1900
	1901	if( mode == MBEDTLS_AES_DECRYPT )
	1902	{
	1903	memcpy( buf, aes_test_cfb128_ct[u], 64 );
	1904	aes_tests = aes_test_cfb128_pt;
	1905	}
	1906	else
	1907	{
	1908	memcpy( buf, aes_test_cfb128_pt, 64 );
	1909	aes_tests = aes_test_cfb128_ct[u];
	1910	}
	1911
	1912	ret = mbedtls_aes_crypt_cfb128( &ctx, mode, 64, &offset, iv, buf, buf );
	1913	if( ret != 0 )
	1914	goto exit;
	1915
	1916	if( memcmp( buf, aes_tests, 64 ) != 0 )
	1917	{
	1918	ret = 1;
	1919	goto exit;
	1920	}
	1921
	1922	if( verbose != 0 )
	1923	mbedtls_printf( "passed\n" );
	1924	}
	1925
	1926	if( verbose != 0 )
	1927	mbedtls_printf( "\n" );
	1928	#endif /* MBEDTLS_CIPHER_MODE_CFB */
	1929
	1930	#if defined(MBEDTLS_CIPHER_MODE_OFB)
	1931	/*
	1932	* OFB mode
	1933	*/
	1934	for( i = 0; i < 6; i++ )
	1935	{
	1936	u = i >> 1;
	1937	keybits = 128 + u * 64;
	1938	mode = i & 1;
	1939
	1940	if( verbose != 0 )
	1941	mbedtls_printf( " AES-OFB-%3d (%s): ", keybits,
	1942	( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" );
	1943
	1944	memcpy( iv, aes_test_ofb_iv, 16 );
	1945	memcpy( key, aes_test_ofb_key[u], keybits / 8 );
	1946
	1947	offset = 0;
	1948	ret = mbedtls_aes_setkey_enc( &ctx, key, keybits );
	1949	/*
	1950	* AES-192 is an optional feature that may be unavailable when
	1951	* there is an alternative underlying implementation i.e. when
	1952	* MBEDTLS_AES_ALT is defined.
	1953	*/
	1954	if( ret == MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE && keybits == 192 )
	1955	{
	1956	mbedtls_printf( "skipped\n" );
	1957	continue;
	1958	}
	1959	else if( ret != 0 )
	1960	{
	1961	goto exit;
	1962	}
	1963
	1964	if( mode == MBEDTLS_AES_DECRYPT )
	1965	{
	1966	memcpy( buf, aes_test_ofb_ct[u], 64 );
	1967	aes_tests = aes_test_ofb_pt;
	1968	}
	1969	else
	1970	{
	1971	memcpy( buf, aes_test_ofb_pt, 64 );
	1972	aes_tests = aes_test_ofb_ct[u];
	1973	}
	1974
	1975	ret = mbedtls_aes_crypt_ofb( &ctx, 64, &offset, iv, buf, buf );
	1976	if( ret != 0 )
	1977	goto exit;
	1978
	1979	if( memcmp( buf, aes_tests, 64 ) != 0 )
	1980	{
	1981	ret = 1;
	1982	goto exit;
	1983	}
	1984
	1985	if( verbose != 0 )
	1986	mbedtls_printf( "passed\n" );
	1987	}
	1988
	1989	if( verbose != 0 )
	1990	mbedtls_printf( "\n" );
	1991	#endif /* MBEDTLS_CIPHER_MODE_OFB */
	1992
	1993	#if defined(MBEDTLS_CIPHER_MODE_CTR)
	1994	/*
	1995	* CTR mode
	1996	*/
	1997	for( i = 0; i < 6; i++ )
	1998	{
	1999	u = i >> 1;
	2000	mode = i & 1;
	2001
	2002	if( verbose != 0 )
	2003	mbedtls_printf( " AES-CTR-128 (%s): ",
	2004	( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" );
	2005
	2006	memcpy( nonce_counter, aes_test_ctr_nonce_counter[u], 16 );
	2007	memcpy( key, aes_test_ctr_key[u], 16 );
	2008
	2009	offset = 0;
	2010	if( ( ret = mbedtls_aes_setkey_enc( &ctx, key, 128 ) ) != 0 )
	2011	goto exit;
	2012
	2013	len = aes_test_ctr_len[u];
	2014
	2015	if( mode == MBEDTLS_AES_DECRYPT )
	2016	{
	2017	memcpy( buf, aes_test_ctr_ct[u], len );
	2018	aes_tests = aes_test_ctr_pt[u];
	2019	}
	2020	else
	2021	{
	2022	memcpy( buf, aes_test_ctr_pt[u], len );
	2023	aes_tests = aes_test_ctr_ct[u];
	2024	}
	2025
	2026	ret = mbedtls_aes_crypt_ctr( &ctx, len, &offset, nonce_counter,
	2027	stream_block, buf, buf );
	2028	if( ret != 0 )
	2029	goto exit;
	2030
	2031	if( memcmp( buf, aes_tests, len ) != 0 )
	2032	{
	2033	ret = 1;
	2034	goto exit;
	2035	}
	2036
	2037	if( verbose != 0 )
	2038	mbedtls_printf( "passed\n" );
	2039	}
	2040
	2041	if( verbose != 0 )
	2042	mbedtls_printf( "\n" );
	2043	#endif /* MBEDTLS_CIPHER_MODE_CTR */
	2044
	2045	#if defined(MBEDTLS_CIPHER_MODE_XTS)
	2046	{
	2047	static const int num_tests =
	2048	sizeof(aes_test_xts_key) / sizeof(*aes_test_xts_key);
	2049	mbedtls_aes_xts_context ctx_xts;
	2050
	2051	/*
	2052	* XTS mode
	2053	*/
	2054	mbedtls_aes_xts_init( &ctx_xts );
	2055
	2056	for( i = 0; i < num_tests << 1; i++ )
	2057	{
	2058	const unsigned char *data_unit;
	2059	u = i >> 1;
	2060	mode = i & 1;
	2061
	2062	if( verbose != 0 )
	2063	mbedtls_printf( " AES-XTS-128 (%s): ",
	2064	( mode == MBEDTLS_AES_DECRYPT ) ? "dec" : "enc" );
	2065
	2066	memset( key, 0, sizeof( key ) );
	2067	memcpy( key, aes_test_xts_key[u], 32 );
	2068	data_unit = aes_test_xts_data_unit[u];
	2069
	2070	len = sizeof( *aes_test_xts_ct32 );
	2071
	2072	if( mode == MBEDTLS_AES_DECRYPT )
	2073	{
	2074	ret = mbedtls_aes_xts_setkey_dec( &ctx_xts, key, 256 );
	2075	if( ret != 0)
	2076	goto exit;
	2077	memcpy( buf, aes_test_xts_ct32[u], len );
	2078	aes_tests = aes_test_xts_pt32[u];
	2079	}
	2080	else
	2081	{
	2082	ret = mbedtls_aes_xts_setkey_enc( &ctx_xts, key, 256 );
	2083	if( ret != 0)
	2084	goto exit;
	2085	memcpy( buf, aes_test_xts_pt32[u], len );
	2086	aes_tests = aes_test_xts_ct32[u];
	2087	}
	2088
	2089
	2090	ret = mbedtls_aes_crypt_xts( &ctx_xts, mode, len, data_unit,
	2091	buf, buf );
	2092	if( ret != 0 )
	2093	goto exit;
	2094
	2095	if( memcmp( buf, aes_tests, len ) != 0 )
	2096	{
	2097	ret = 1;
	2098	goto exit;
	2099	}
	2100
	2101	if( verbose != 0 )
	2102	mbedtls_printf( "passed\n" );
	2103	}
	2104
	2105	if( verbose != 0 )
	2106	mbedtls_printf( "\n" );
	2107
	2108	mbedtls_aes_xts_free( &ctx_xts );
	2109	}
	2110	#endif /* MBEDTLS_CIPHER_MODE_XTS */
	2111
	2112	ret = 0;
	2113
	2114	exit:
	2115	if( ret != 0 && verbose != 0 )
	2116	mbedtls_printf( "failed\n" );
	2117
	2118	mbedtls_aes_free( &ctx );
	2119
	2120	return( ret );
	2121	}
	2122
	2123	#endif /* MBEDTLS_SELF_TEST */
	2124
	2125	#endif /* MBEDTLS_AES_C */