git.zerfleddert.de Git - proxmark3-svn/blame_incremental

... / ...

Commit	Line	Data
	1	/*
	2	* FIPS-197 compliant AES implementation
	3	*
	4	* Copyright (C) 2006-2014, Brainspark B.V.
	5	*
	6	* This file is part of PolarSSL (http://www.polarssl.org)
	7	* Lead Maintainer: Paul Bakker <polarssl_maintainer at polarssl.org>
	8	*
	9	* All rights reserved.
	10	*
	11	* This program is free software; you can redistribute it and/or modify
	12	* it under the terms of the GNU General Public License as published by
	13	* the Free Software Foundation; either version 2 of the License, or
	14	* (at your option) any later version.
	15	*
	16	* This program is distributed in the hope that it will be useful,
	17	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	18	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	19	* GNU General Public License for more details.
	20	*
	21	* You should have received a copy of the GNU General Public License along
	22	* with this program; if not, write to the Free Software Foundation, Inc.,
	23	* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
	24	*/
	25	/*
	26	* The AES block cipher was designed by Vincent Rijmen and Joan Daemen.
	27	*
	28	* http://csrc.nist.gov/encryption/aes/rijndael/Rijndael.pdf
	29	* http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf
	30	*/
	31
	32	#if !defined(POLARSSL_CONFIG_FILE)
	33	#include "polarssl_config.h"
	34	#else
	35	#include POLARSSL_CONFIG_FILE
	36	#endif
	37
	38	#if defined(POLARSSL_AES_C)
	39
	40	#include "aes.h"
	41	#if defined(POLARSSL_PADLOCK_C)
	42	#include "polarssl/padlock.h"
	43	#endif
	44	#if defined(POLARSSL_AESNI_C)
	45	#include "polarssl/aesni.h"
	46	#endif
	47
	48	#if defined(POLARSSL_PLATFORM_C)
	49	#include "polarssl/platform.h"
	50	#else
	51	#define polarssl_printf printf
	52	#endif
	53
	54	#if !defined(POLARSSL_AES_ALT)
	55
	56	/* Implementation that should never be optimized out by the compiler */
	57	static void polarssl_zeroize( void *v, size_t n ) {
	58	volatile unsigned char p = v; while( n-- ) p++ = 0;
	59	}
	60
	61	/*
	62	* 32-bit integer manipulation macros (little endian)
	63	*/
	64	#ifndef GET_UINT32_LE
	65	#define GET_UINT32_LE(n,b,i) \
	66	{ \
	67	(n) = ( (uint32_t) (b)[(i) ] ) \
	68	\| ( (uint32_t) (b)[(i) + 1] << 8 ) \
	69	\| ( (uint32_t) (b)[(i) + 2] << 16 ) \
	70	\| ( (uint32_t) (b)[(i) + 3] << 24 ); \
	71	}
	72	#endif
	73
	74	#ifndef PUT_UINT32_LE
	75	#define PUT_UINT32_LE(n,b,i) \
	76	{ \
	77	(b)[(i) ] = (unsigned char) ( (n) ); \
	78	(b)[(i) + 1] = (unsigned char) ( (n) >> 8 ); \
	79	(b)[(i) + 2] = (unsigned char) ( (n) >> 16 ); \
	80	(b)[(i) + 3] = (unsigned char) ( (n) >> 24 ); \
	81	}
	82	#endif
	83
	84	#if defined(POLARSSL_PADLOCK_C) && \
	85	( defined(POLARSSL_HAVE_X86) \|\| defined(PADLOCK_ALIGN16) )
	86	static int aes_padlock_ace = -1;
	87	#endif
	88
	89	#if defined(POLARSSL_AES_ROM_TABLES)
	90	/*
	91	* Forward S-box
	92	*/
	93	static const unsigned char FSb[256] =
	94	{
	95	0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5,
	96	0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76,
	97	0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0,
	98	0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0,
	99	0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC,
	100	0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,
	101	0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A,
	102	0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75,
	103	0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0,
	104	0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84,
	105	0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B,
	106	0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,
	107	0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85,
	108	0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8,
	109	0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5,
	110	0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2,
	111	0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17,
	112	0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73,
	113	0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88,
	114	0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB,
	115	0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C,
	116	0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79,
	117	0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9,
	118	0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08,
	119	0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6,
	120	0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A,
	121	0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E,
	122	0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E,
	123	0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94,
	124	0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,
	125	0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68,
	126	0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16
	127	};
	128
	129	/*
	130	* Forward tables
	131	*/
	132	#define FT \
	133	\
	134	V(A5,63,63,C6), V(84,7C,7C,F8), V(99,77,77,EE), V(8D,7B,7B,F6), \
	135	V(0D,F2,F2,FF), V(BD,6B,6B,D6), V(B1,6F,6F,DE), V(54,C5,C5,91), \
	136	V(50,30,30,60), V(03,01,01,02), V(A9,67,67,CE), V(7D,2B,2B,56), \
	137	V(19,FE,FE,E7), V(62,D7,D7,B5), V(E6,AB,AB,4D), V(9A,76,76,EC), \
	138	V(45,CA,CA,8F), V(9D,82,82,1F), V(40,C9,C9,89), V(87,7D,7D,FA), \
	139	V(15,FA,FA,EF), V(EB,59,59,B2), V(C9,47,47,8E), V(0B,F0,F0,FB), \
	140	V(EC,AD,AD,41), V(67,D4,D4,B3), V(FD,A2,A2,5F), V(EA,AF,AF,45), \
	141	V(BF,9C,9C,23), V(F7,A4,A4,53), V(96,72,72,E4), V(5B,C0,C0,9B), \
	142	V(C2,B7,B7,75), V(1C,FD,FD,E1), V(AE,93,93,3D), V(6A,26,26,4C), \
	143	V(5A,36,36,6C), V(41,3F,3F,7E), V(02,F7,F7,F5), V(4F,CC,CC,83), \
	144	V(5C,34,34,68), V(F4,A5,A5,51), V(34,E5,E5,D1), V(08,F1,F1,F9), \
	145	V(93,71,71,E2), V(73,D8,D8,AB), V(53,31,31,62), V(3F,15,15,2A), \
	146	V(0C,04,04,08), V(52,C7,C7,95), V(65,23,23,46), V(5E,C3,C3,9D), \
	147	V(28,18,18,30), V(A1,96,96,37), V(0F,05,05,0A), V(B5,9A,9A,2F), \
	148	V(09,07,07,0E), V(36,12,12,24), V(9B,80,80,1B), V(3D,E2,E2,DF), \
	149	V(26,EB,EB,CD), V(69,27,27,4E), V(CD,B2,B2,7F), V(9F,75,75,EA), \
	150	V(1B,09,09,12), V(9E,83,83,1D), V(74,2C,2C,58), V(2E,1A,1A,34), \
	151	V(2D,1B,1B,36), V(B2,6E,6E,DC), V(EE,5A,5A,B4), V(FB,A0,A0,5B), \
	152	V(F6,52,52,A4), V(4D,3B,3B,76), V(61,D6,D6,B7), V(CE,B3,B3,7D), \
	153	V(7B,29,29,52), V(3E,E3,E3,DD), V(71,2F,2F,5E), V(97,84,84,13), \
	154	V(F5,53,53,A6), V(68,D1,D1,B9), V(00,00,00,00), V(2C,ED,ED,C1), \
	155	V(60,20,20,40), V(1F,FC,FC,E3), V(C8,B1,B1,79), V(ED,5B,5B,B6), \
	156	V(BE,6A,6A,D4), V(46,CB,CB,8D), V(D9,BE,BE,67), V(4B,39,39,72), \
	157	V(DE,4A,4A,94), V(D4,4C,4C,98), V(E8,58,58,B0), V(4A,CF,CF,85), \
	158	V(6B,D0,D0,BB), V(2A,EF,EF,C5), V(E5,AA,AA,4F), V(16,FB,FB,ED), \
	159	V(C5,43,43,86), V(D7,4D,4D,9A), V(55,33,33,66), V(94,85,85,11), \
	160	V(CF,45,45,8A), V(10,F9,F9,E9), V(06,02,02,04), V(81,7F,7F,FE), \
	161	V(F0,50,50,A0), V(44,3C,3C,78), V(BA,9F,9F,25), V(E3,A8,A8,4B), \
	162	V(F3,51,51,A2), V(FE,A3,A3,5D), V(C0,40,40,80), V(8A,8F,8F,05), \
	163	V(AD,92,92,3F), V(BC,9D,9D,21), V(48,38,38,70), V(04,F5,F5,F1), \
	164	V(DF,BC,BC,63), V(C1,B6,B6,77), V(75,DA,DA,AF), V(63,21,21,42), \
	165	V(30,10,10,20), V(1A,FF,FF,E5), V(0E,F3,F3,FD), V(6D,D2,D2,BF), \
	166	V(4C,CD,CD,81), V(14,0C,0C,18), V(35,13,13,26), V(2F,EC,EC,C3), \
	167	V(E1,5F,5F,BE), V(A2,97,97,35), V(CC,44,44,88), V(39,17,17,2E), \
	168	V(57,C4,C4,93), V(F2,A7,A7,55), V(82,7E,7E,FC), V(47,3D,3D,7A), \
	169	V(AC,64,64,C8), V(E7,5D,5D,BA), V(2B,19,19,32), V(95,73,73,E6), \
	170	V(A0,60,60,C0), V(98,81,81,19), V(D1,4F,4F,9E), V(7F,DC,DC,A3), \
	171	V(66,22,22,44), V(7E,2A,2A,54), V(AB,90,90,3B), V(83,88,88,0B), \
	172	V(CA,46,46,8C), V(29,EE,EE,C7), V(D3,B8,B8,6B), V(3C,14,14,28), \
	173	V(79,DE,DE,A7), V(E2,5E,5E,BC), V(1D,0B,0B,16), V(76,DB,DB,AD), \
	174	V(3B,E0,E0,DB), V(56,32,32,64), V(4E,3A,3A,74), V(1E,0A,0A,14), \
	175	V(DB,49,49,92), V(0A,06,06,0C), V(6C,24,24,48), V(E4,5C,5C,B8), \
	176	V(5D,C2,C2,9F), V(6E,D3,D3,BD), V(EF,AC,AC,43), V(A6,62,62,C4), \
	177	V(A8,91,91,39), V(A4,95,95,31), V(37,E4,E4,D3), V(8B,79,79,F2), \
	178	V(32,E7,E7,D5), V(43,C8,C8,8B), V(59,37,37,6E), V(B7,6D,6D,DA), \
	179	V(8C,8D,8D,01), V(64,D5,D5,B1), V(D2,4E,4E,9C), V(E0,A9,A9,49), \
	180	V(B4,6C,6C,D8), V(FA,56,56,AC), V(07,F4,F4,F3), V(25,EA,EA,CF), \
	181	V(AF,65,65,CA), V(8E,7A,7A,F4), V(E9,AE,AE,47), V(18,08,08,10), \
	182	V(D5,BA,BA,6F), V(88,78,78,F0), V(6F,25,25,4A), V(72,2E,2E,5C), \
	183	V(24,1C,1C,38), V(F1,A6,A6,57), V(C7,B4,B4,73), V(51,C6,C6,97), \
	184	V(23,E8,E8,CB), V(7C,DD,DD,A1), V(9C,74,74,E8), V(21,1F,1F,3E), \
	185	V(DD,4B,4B,96), V(DC,BD,BD,61), V(86,8B,8B,0D), V(85,8A,8A,0F), \
	186	V(90,70,70,E0), V(42,3E,3E,7C), V(C4,B5,B5,71), V(AA,66,66,CC), \
	187	V(D8,48,48,90), V(05,03,03,06), V(01,F6,F6,F7), V(12,0E,0E,1C), \
	188	V(A3,61,61,C2), V(5F,35,35,6A), V(F9,57,57,AE), V(D0,B9,B9,69), \
	189	V(91,86,86,17), V(58,C1,C1,99), V(27,1D,1D,3A), V(B9,9E,9E,27), \
	190	V(38,E1,E1,D9), V(13,F8,F8,EB), V(B3,98,98,2B), V(33,11,11,22), \
	191	V(BB,69,69,D2), V(70,D9,D9,A9), V(89,8E,8E,07), V(A7,94,94,33), \
	192	V(B6,9B,9B,2D), V(22,1E,1E,3C), V(92,87,87,15), V(20,E9,E9,C9), \
	193	V(49,CE,CE,87), V(FF,55,55,AA), V(78,28,28,50), V(7A,DF,DF,A5), \
	194	V(8F,8C,8C,03), V(F8,A1,A1,59), V(80,89,89,09), V(17,0D,0D,1A), \
	195	V(DA,BF,BF,65), V(31,E6,E6,D7), V(C6,42,42,84), V(B8,68,68,D0), \
	196	V(C3,41,41,82), V(B0,99,99,29), V(77,2D,2D,5A), V(11,0F,0F,1E), \
	197	V(CB,B0,B0,7B), V(FC,54,54,A8), V(D6,BB,BB,6D), V(3A,16,16,2C)
	198
	199	#define V(a,b,c,d) 0x##a##b##c##d
	200	static const uint32_t FT0[256] = { FT };
	201	#undef V
	202
	203	#define V(a,b,c,d) 0x##b##c##d##a
	204	static const uint32_t FT1[256] = { FT };
	205	#undef V
	206
	207	#define V(a,b,c,d) 0x##c##d##a##b
	208	static const uint32_t FT2[256] = { FT };
	209	#undef V
	210
	211	#define V(a,b,c,d) 0x##d##a##b##c
	212	static const uint32_t FT3[256] = { FT };
	213	#undef V
	214
	215	#undef FT
	216
	217	/*
	218	* Reverse S-box
	219	*/
	220	static const unsigned char RSb[256] =
	221	{
	222	0x52, 0x09, 0x6A, 0xD5, 0x30, 0x36, 0xA5, 0x38,
	223	0xBF, 0x40, 0xA3, 0x9E, 0x81, 0xF3, 0xD7, 0xFB,
	224	0x7C, 0xE3, 0x39, 0x82, 0x9B, 0x2F, 0xFF, 0x87,
	225	0x34, 0x8E, 0x43, 0x44, 0xC4, 0xDE, 0xE9, 0xCB,
	226	0x54, 0x7B, 0x94, 0x32, 0xA6, 0xC2, 0x23, 0x3D,
	227	0xEE, 0x4C, 0x95, 0x0B, 0x42, 0xFA, 0xC3, 0x4E,
	228	0x08, 0x2E, 0xA1, 0x66, 0x28, 0xD9, 0x24, 0xB2,
	229	0x76, 0x5B, 0xA2, 0x49, 0x6D, 0x8B, 0xD1, 0x25,
	230	0x72, 0xF8, 0xF6, 0x64, 0x86, 0x68, 0x98, 0x16,
	231	0xD4, 0xA4, 0x5C, 0xCC, 0x5D, 0x65, 0xB6, 0x92,
	232	0x6C, 0x70, 0x48, 0x50, 0xFD, 0xED, 0xB9, 0xDA,
	233	0x5E, 0x15, 0x46, 0x57, 0xA7, 0x8D, 0x9D, 0x84,
	234	0x90, 0xD8, 0xAB, 0x00, 0x8C, 0xBC, 0xD3, 0x0A,
	235	0xF7, 0xE4, 0x58, 0x05, 0xB8, 0xB3, 0x45, 0x06,
	236	0xD0, 0x2C, 0x1E, 0x8F, 0xCA, 0x3F, 0x0F, 0x02,
	237	0xC1, 0xAF, 0xBD, 0x03, 0x01, 0x13, 0x8A, 0x6B,
	238	0x3A, 0x91, 0x11, 0x41, 0x4F, 0x67, 0xDC, 0xEA,
	239	0x97, 0xF2, 0xCF, 0xCE, 0xF0, 0xB4, 0xE6, 0x73,
	240	0x96, 0xAC, 0x74, 0x22, 0xE7, 0xAD, 0x35, 0x85,
	241	0xE2, 0xF9, 0x37, 0xE8, 0x1C, 0x75, 0xDF, 0x6E,
	242	0x47, 0xF1, 0x1A, 0x71, 0x1D, 0x29, 0xC5, 0x89,
	243	0x6F, 0xB7, 0x62, 0x0E, 0xAA, 0x18, 0xBE, 0x1B,
	244	0xFC, 0x56, 0x3E, 0x4B, 0xC6, 0xD2, 0x79, 0x20,
	245	0x9A, 0xDB, 0xC0, 0xFE, 0x78, 0xCD, 0x5A, 0xF4,
	246	0x1F, 0xDD, 0xA8, 0x33, 0x88, 0x07, 0xC7, 0x31,
	247	0xB1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xEC, 0x5F,
	248	0x60, 0x51, 0x7F, 0xA9, 0x19, 0xB5, 0x4A, 0x0D,
	249	0x2D, 0xE5, 0x7A, 0x9F, 0x93, 0xC9, 0x9C, 0xEF,
	250	0xA0, 0xE0, 0x3B, 0x4D, 0xAE, 0x2A, 0xF5, 0xB0,
	251	0xC8, 0xEB, 0xBB, 0x3C, 0x83, 0x53, 0x99, 0x61,
	252	0x17, 0x2B, 0x04, 0x7E, 0xBA, 0x77, 0xD6, 0x26,
	253	0xE1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0C, 0x7D
	254	};
	255
	256	/*
	257	* Reverse tables
	258	*/
	259	#define RT \
	260	\
	261	V(50,A7,F4,51), V(53,65,41,7E), V(C3,A4,17,1A), V(96,5E,27,3A), \
	262	V(CB,6B,AB,3B), V(F1,45,9D,1F), V(AB,58,FA,AC), V(93,03,E3,4B), \
	263	V(55,FA,30,20), V(F6,6D,76,AD), V(91,76,CC,88), V(25,4C,02,F5), \
	264	V(FC,D7,E5,4F), V(D7,CB,2A,C5), V(80,44,35,26), V(8F,A3,62,B5), \
	265	V(49,5A,B1,DE), V(67,1B,BA,25), V(98,0E,EA,45), V(E1,C0,FE,5D), \
	266	V(02,75,2F,C3), V(12,F0,4C,81), V(A3,97,46,8D), V(C6,F9,D3,6B), \
	267	V(E7,5F,8F,03), V(95,9C,92,15), V(EB,7A,6D,BF), V(DA,59,52,95), \
	268	V(2D,83,BE,D4), V(D3,21,74,58), V(29,69,E0,49), V(44,C8,C9,8E), \
	269	V(6A,89,C2,75), V(78,79,8E,F4), V(6B,3E,58,99), V(DD,71,B9,27), \
	270	V(B6,4F,E1,BE), V(17,AD,88,F0), V(66,AC,20,C9), V(B4,3A,CE,7D), \
	271	V(18,4A,DF,63), V(82,31,1A,E5), V(60,33,51,97), V(45,7F,53,62), \
	272	V(E0,77,64,B1), V(84,AE,6B,BB), V(1C,A0,81,FE), V(94,2B,08,F9), \
	273	V(58,68,48,70), V(19,FD,45,8F), V(87,6C,DE,94), V(B7,F8,7B,52), \
	274	V(23,D3,73,AB), V(E2,02,4B,72), V(57,8F,1F,E3), V(2A,AB,55,66), \
	275	V(07,28,EB,B2), V(03,C2,B5,2F), V(9A,7B,C5,86), V(A5,08,37,D3), \
	276	V(F2,87,28,30), V(B2,A5,BF,23), V(BA,6A,03,02), V(5C,82,16,ED), \
	277	V(2B,1C,CF,8A), V(92,B4,79,A7), V(F0,F2,07,F3), V(A1,E2,69,4E), \
	278	V(CD,F4,DA,65), V(D5,BE,05,06), V(1F,62,34,D1), V(8A,FE,A6,C4), \
	279	V(9D,53,2E,34), V(A0,55,F3,A2), V(32,E1,8A,05), V(75,EB,F6,A4), \
	280	V(39,EC,83,0B), V(AA,EF,60,40), V(06,9F,71,5E), V(51,10,6E,BD), \
	281	V(F9,8A,21,3E), V(3D,06,DD,96), V(AE,05,3E,DD), V(46,BD,E6,4D), \
	282	V(B5,8D,54,91), V(05,5D,C4,71), V(6F,D4,06,04), V(FF,15,50,60), \
	283	V(24,FB,98,19), V(97,E9,BD,D6), V(CC,43,40,89), V(77,9E,D9,67), \
	284	V(BD,42,E8,B0), V(88,8B,89,07), V(38,5B,19,E7), V(DB,EE,C8,79), \
	285	V(47,0A,7C,A1), V(E9,0F,42,7C), V(C9,1E,84,F8), V(00,00,00,00), \
	286	V(83,86,80,09), V(48,ED,2B,32), V(AC,70,11,1E), V(4E,72,5A,6C), \
	287	V(FB,FF,0E,FD), V(56,38,85,0F), V(1E,D5,AE,3D), V(27,39,2D,36), \
	288	V(64,D9,0F,0A), V(21,A6,5C,68), V(D1,54,5B,9B), V(3A,2E,36,24), \
	289	V(B1,67,0A,0C), V(0F,E7,57,93), V(D2,96,EE,B4), V(9E,91,9B,1B), \
	290	V(4F,C5,C0,80), V(A2,20,DC,61), V(69,4B,77,5A), V(16,1A,12,1C), \
	291	V(0A,BA,93,E2), V(E5,2A,A0,C0), V(43,E0,22,3C), V(1D,17,1B,12), \
	292	V(0B,0D,09,0E), V(AD,C7,8B,F2), V(B9,A8,B6,2D), V(C8,A9,1E,14), \
	293	V(85,19,F1,57), V(4C,07,75,AF), V(BB,DD,99,EE), V(FD,60,7F,A3), \
	294	V(9F,26,01,F7), V(BC,F5,72,5C), V(C5,3B,66,44), V(34,7E,FB,5B), \
	295	V(76,29,43,8B), V(DC,C6,23,CB), V(68,FC,ED,B6), V(63,F1,E4,B8), \
	296	V(CA,DC,31,D7), V(10,85,63,42), V(40,22,97,13), V(20,11,C6,84), \
	297	V(7D,24,4A,85), V(F8,3D,BB,D2), V(11,32,F9,AE), V(6D,A1,29,C7), \
	298	V(4B,2F,9E,1D), V(F3,30,B2,DC), V(EC,52,86,0D), V(D0,E3,C1,77), \
	299	V(6C,16,B3,2B), V(99,B9,70,A9), V(FA,48,94,11), V(22,64,E9,47), \
	300	V(C4,8C,FC,A8), V(1A,3F,F0,A0), V(D8,2C,7D,56), V(EF,90,33,22), \
	301	V(C7,4E,49,87), V(C1,D1,38,D9), V(FE,A2,CA,8C), V(36,0B,D4,98), \
	302	V(CF,81,F5,A6), V(28,DE,7A,A5), V(26,8E,B7,DA), V(A4,BF,AD,3F), \
	303	V(E4,9D,3A,2C), V(0D,92,78,50), V(9B,CC,5F,6A), V(62,46,7E,54), \
	304	V(C2,13,8D,F6), V(E8,B8,D8,90), V(5E,F7,39,2E), V(F5,AF,C3,82), \
	305	V(BE,80,5D,9F), V(7C,93,D0,69), V(A9,2D,D5,6F), V(B3,12,25,CF), \
	306	V(3B,99,AC,C8), V(A7,7D,18,10), V(6E,63,9C,E8), V(7B,BB,3B,DB), \
	307	V(09,78,26,CD), V(F4,18,59,6E), V(01,B7,9A,EC), V(A8,9A,4F,83), \
	308	V(65,6E,95,E6), V(7E,E6,FF,AA), V(08,CF,BC,21), V(E6,E8,15,EF), \
	309	V(D9,9B,E7,BA), V(CE,36,6F,4A), V(D4,09,9F,EA), V(D6,7C,B0,29), \
	310	V(AF,B2,A4,31), V(31,23,3F,2A), V(30,94,A5,C6), V(C0,66,A2,35), \
	311	V(37,BC,4E,74), V(A6,CA,82,FC), V(B0,D0,90,E0), V(15,D8,A7,33), \
	312	V(4A,98,04,F1), V(F7,DA,EC,41), V(0E,50,CD,7F), V(2F,F6,91,17), \
	313	V(8D,D6,4D,76), V(4D,B0,EF,43), V(54,4D,AA,CC), V(DF,04,96,E4), \
	314	V(E3,B5,D1,9E), V(1B,88,6A,4C), V(B8,1F,2C,C1), V(7F,51,65,46), \
	315	V(04,EA,5E,9D), V(5D,35,8C,01), V(73,74,87,FA), V(2E,41,0B,FB), \
	316	V(5A,1D,67,B3), V(52,D2,DB,92), V(33,56,10,E9), V(13,47,D6,6D), \
	317	V(8C,61,D7,9A), V(7A,0C,A1,37), V(8E,14,F8,59), V(89,3C,13,EB), \
	318	V(EE,27,A9,CE), V(35,C9,61,B7), V(ED,E5,1C,E1), V(3C,B1,47,7A), \
	319	V(59,DF,D2,9C), V(3F,73,F2,55), V(79,CE,14,18), V(BF,37,C7,73), \
	320	V(EA,CD,F7,53), V(5B,AA,FD,5F), V(14,6F,3D,DF), V(86,DB,44,78), \
	321	V(81,F3,AF,CA), V(3E,C4,68,B9), V(2C,34,24,38), V(5F,40,A3,C2), \
	322	V(72,C3,1D,16), V(0C,25,E2,BC), V(8B,49,3C,28), V(41,95,0D,FF), \
	323	V(71,01,A8,39), V(DE,B3,0C,08), V(9C,E4,B4,D8), V(90,C1,56,64), \
	324	V(61,84,CB,7B), V(70,B6,32,D5), V(74,5C,6C,48), V(42,57,B8,D0)
	325
	326	#define V(a,b,c,d) 0x##a##b##c##d
	327	static const uint32_t RT0[256] = { RT };
	328	#undef V
	329
	330	#define V(a,b,c,d) 0x##b##c##d##a
	331	static const uint32_t RT1[256] = { RT };
	332	#undef V
	333
	334	#define V(a,b,c,d) 0x##c##d##a##b
	335	static const uint32_t RT2[256] = { RT };
	336	#undef V
	337
	338	#define V(a,b,c,d) 0x##d##a##b##c
	339	static const uint32_t RT3[256] = { RT };
	340	#undef V
	341
	342	#undef RT
	343
	344	/*
	345	* Round constants
	346	*/
	347	static const uint32_t RCON[10] =
	348	{
	349	0x00000001, 0x00000002, 0x00000004, 0x00000008,
	350	0x00000010, 0x00000020, 0x00000040, 0x00000080,
	351	0x0000001B, 0x00000036
	352	};
	353
	354	#else /* POLARSSL_AES_ROM_TABLES */
	355
	356	/*
	357	* Forward S-box & tables
	358	*/
	359	static unsigned char FSb[256];
	360	static uint32_t FT0[256];
	361	static uint32_t FT1[256];
	362	static uint32_t FT2[256];
	363	static uint32_t FT3[256];
	364
	365	/*
	366	* Reverse S-box & tables
	367	*/
	368	static unsigned char RSb[256];
	369	static uint32_t RT0[256];
	370	static uint32_t RT1[256];
	371	static uint32_t RT2[256];
	372	static uint32_t RT3[256];
	373
	374	/*
	375	* Round constants
	376	*/
	377	static uint32_t RCON[10];
	378
	379	/*
	380	* Tables generation code
	381	*/
	382	#define ROTL8(x) ( ( x << 8 ) & 0xFFFFFFFF ) \| ( x >> 24 )
	383	#define XTIME(x) ( ( x << 1 ) ^ ( ( x & 0x80 ) ? 0x1B : 0x00 ) )
	384	#define MUL(x,y) ( ( x && y ) ? pow[(log[x]+log[y]) % 255] : 0 )
	385
	386	static int aes_init_done = 0;
	387
	388	static void aes_gen_tables( void )
	389	{
	390	int i, x, y, z;
	391	int pow[256];
	392	int log[256];
	393
	394	/*
	395	* compute pow and log tables over GF(2^8)
	396	*/
	397	for( i = 0, x = 1; i < 256; i++ )
	398	{
	399	pow[i] = x;
	400	log[x] = i;
	401	x = ( x ^ XTIME( x ) ) & 0xFF;
	402	}
	403
	404	/*
	405	* calculate the round constants
	406	*/
	407	for( i = 0, x = 1; i < 10; i++ )
	408	{
	409	RCON[i] = (uint32_t) x;
	410	x = XTIME( x ) & 0xFF;
	411	}
	412
	413	/*
	414	* generate the forward and reverse S-boxes
	415	*/
	416	FSb[0x00] = 0x63;
	417	RSb[0x63] = 0x00;
	418
	419	for( i = 1; i < 256; i++ )
	420	{
	421	x = pow[255 - log[i]];
	422
	423	y = x; y = ( ( y << 1 ) \| ( y >> 7 ) ) & 0xFF;
	424	x ^= y; y = ( ( y << 1 ) \| ( y >> 7 ) ) & 0xFF;
	425	x ^= y; y = ( ( y << 1 ) \| ( y >> 7 ) ) & 0xFF;
	426	x ^= y; y = ( ( y << 1 ) \| ( y >> 7 ) ) & 0xFF;
	427	x ^= y ^ 0x63;
	428
	429	FSb[i] = (unsigned char) x;
	430	RSb[x] = (unsigned char) i;
	431	}
	432
	433	/*
	434	* generate the forward and reverse tables
	435	*/
	436	for( i = 0; i < 256; i++ )
	437	{
	438	x = FSb[i];
	439	y = XTIME( x ) & 0xFF;
	440	z = ( y ^ x ) & 0xFF;
	441
	442	FT0[i] = ( (uint32_t) y ) ^
	443	( (uint32_t) x << 8 ) ^
	444	( (uint32_t) x << 16 ) ^
	445	( (uint32_t) z << 24 );
	446
	447	FT1[i] = ROTL8( FT0[i] );
	448	FT2[i] = ROTL8( FT1[i] );
	449	FT3[i] = ROTL8( FT2[i] );
	450
	451	x = RSb[i];
	452
	453	RT0[i] = ( (uint32_t) MUL( 0x0E, x ) ) ^
	454	( (uint32_t) MUL( 0x09, x ) << 8 ) ^
	455	( (uint32_t) MUL( 0x0D, x ) << 16 ) ^
	456	( (uint32_t) MUL( 0x0B, x ) << 24 );
	457
	458	RT1[i] = ROTL8( RT0[i] );
	459	RT2[i] = ROTL8( RT1[i] );
	460	RT3[i] = ROTL8( RT2[i] );
	461	}
	462	}
	463
	464	#endif /* POLARSSL_AES_ROM_TABLES */
	465
	466	void aes_init( aes_context *ctx )
	467	{
	468	memset( ctx, 0, sizeof( aes_context ) );
	469	}
	470
	471	void aes_free( aes_context *ctx )
	472	{
	473	if( ctx == NULL )
	474	return;
	475
	476	polarssl_zeroize( ctx, sizeof( aes_context ) );
	477	}
	478
	479	/*
	480	* AES key schedule (encryption)
	481	*/
	482	int aes_setkey_enc( aes_context ctx, const unsigned char key,
	483	unsigned int keysize )
	484	{
	485	unsigned int i;
	486	uint32_t *RK;
	487
	488	#if !defined(POLARSSL_AES_ROM_TABLES)
	489	if( aes_init_done == 0 )
	490	{
	491	aes_gen_tables();
	492	aes_init_done = 1;
	493
	494	}
	495	#endif
	496
	497	switch( keysize )
	498	{
	499	case 128: ctx->nr = 10; break;
	500	case 192: ctx->nr = 12; break;
	501	case 256: ctx->nr = 14; break;
	502	default : return( POLARSSL_ERR_AES_INVALID_KEY_LENGTH );
	503	}
	504
	505	#if defined(POLARSSL_PADLOCK_C) && defined(PADLOCK_ALIGN16)
	506	if( aes_padlock_ace == -1 )
	507	aes_padlock_ace = padlock_supports( PADLOCK_ACE );
	508
	509	if( aes_padlock_ace )
	510	ctx->rk = RK = PADLOCK_ALIGN16( ctx->buf );
	511	else
	512	#endif
	513	ctx->rk = RK = ctx->buf;
	514
	515	#if defined(POLARSSL_AESNI_C) && defined(POLARSSL_HAVE_X86_64)
	516	if( aesni_supports( POLARSSL_AESNI_AES ) )
	517	return( aesni_setkey_enc( (unsigned char *) ctx->rk, key, keysize ) );
	518	#endif
	519
	520	for( i = 0; i < ( keysize >> 5 ); i++ )
	521	{
	522	GET_UINT32_LE( RK[i], key, i << 2 );
	523	}
	524
	525	switch( ctx->nr )
	526	{
	527	case 10:
	528
	529	for( i = 0; i < 10; i++, RK += 4 )
	530	{
	531	RK[4] = RK[0] ^ RCON[i] ^
	532	( (uint32_t) FSb[ ( RK[3] >> 8 ) & 0xFF ] ) ^
	533	( (uint32_t) FSb[ ( RK[3] >> 16 ) & 0xFF ] << 8 ) ^
	534	( (uint32_t) FSb[ ( RK[3] >> 24 ) & 0xFF ] << 16 ) ^
	535	( (uint32_t) FSb[ ( RK[3] ) & 0xFF ] << 24 );
	536
	537	RK[5] = RK[1] ^ RK[4];
	538	RK[6] = RK[2] ^ RK[5];
	539	RK[7] = RK[3] ^ RK[6];
	540	}
	541	break;
	542
	543	case 12:
	544
	545	for( i = 0; i < 8; i++, RK += 6 )
	546	{
	547	RK[6] = RK[0] ^ RCON[i] ^
	548	( (uint32_t) FSb[ ( RK[5] >> 8 ) & 0xFF ] ) ^
	549	( (uint32_t) FSb[ ( RK[5] >> 16 ) & 0xFF ] << 8 ) ^
	550	( (uint32_t) FSb[ ( RK[5] >> 24 ) & 0xFF ] << 16 ) ^
	551	( (uint32_t) FSb[ ( RK[5] ) & 0xFF ] << 24 );
	552
	553	RK[7] = RK[1] ^ RK[6];
	554	RK[8] = RK[2] ^ RK[7];
	555	RK[9] = RK[3] ^ RK[8];
	556	RK[10] = RK[4] ^ RK[9];
	557	RK[11] = RK[5] ^ RK[10];
	558	}
	559	break;
	560
	561	case 14:
	562
	563	for( i = 0; i < 7; i++, RK += 8 )
	564	{
	565	RK[8] = RK[0] ^ RCON[i] ^
	566	( (uint32_t) FSb[ ( RK[7] >> 8 ) & 0xFF ] ) ^
	567	( (uint32_t) FSb[ ( RK[7] >> 16 ) & 0xFF ] << 8 ) ^
	568	( (uint32_t) FSb[ ( RK[7] >> 24 ) & 0xFF ] << 16 ) ^
	569	( (uint32_t) FSb[ ( RK[7] ) & 0xFF ] << 24 );
	570
	571	RK[9] = RK[1] ^ RK[8];
	572	RK[10] = RK[2] ^ RK[9];
	573	RK[11] = RK[3] ^ RK[10];
	574
	575	RK[12] = RK[4] ^
	576	( (uint32_t) FSb[ ( RK[11] ) & 0xFF ] ) ^
	577	( (uint32_t) FSb[ ( RK[11] >> 8 ) & 0xFF ] << 8 ) ^
	578	( (uint32_t) FSb[ ( RK[11] >> 16 ) & 0xFF ] << 16 ) ^
	579	( (uint32_t) FSb[ ( RK[11] >> 24 ) & 0xFF ] << 24 );
	580
	581	RK[13] = RK[5] ^ RK[12];
	582	RK[14] = RK[6] ^ RK[13];
	583	RK[15] = RK[7] ^ RK[14];
	584	}
	585	break;
	586	}
	587
	588	return( 0 );
	589	}
	590
	591	/*
	592	* AES key schedule (decryption)
	593	*/
	594	int aes_setkey_dec( aes_context ctx, const unsigned char key,
	595	unsigned int keysize )
	596	{
	597	int i, j, ret;
	598	aes_context cty;
	599	uint32_t *RK;
	600	uint32_t *SK;
	601
	602	aes_init( &cty );
	603
	604	#if defined(POLARSSL_PADLOCK_C) && defined(PADLOCK_ALIGN16)
	605	if( aes_padlock_ace == -1 )
	606	aes_padlock_ace = padlock_supports( PADLOCK_ACE );
	607
	608	if( aes_padlock_ace )
	609	ctx->rk = RK = PADLOCK_ALIGN16( ctx->buf );
	610	else
	611	#endif
	612	ctx->rk = RK = ctx->buf;
	613
	614	/* Also checks keysize */
	615	if( ( ret = aes_setkey_enc( &cty, key, keysize ) ) != 0 )
	616	goto exit;
	617
	618	ctx->nr = cty.nr;
	619
	620	#if defined(POLARSSL_AESNI_C) && defined(POLARSSL_HAVE_X86_64)
	621	if( aesni_supports( POLARSSL_AESNI_AES ) )
	622	{
	623	aesni_inverse_key( (unsigned char *) ctx->rk,
	624	(const unsigned char *) cty.rk, ctx->nr );
	625	goto exit;
	626	}
	627	#endif
	628
	629	SK = cty.rk + cty.nr * 4;
	630
	631	RK++ = SK++;
	632	RK++ = SK++;
	633	RK++ = SK++;
	634	RK++ = SK++;
	635
	636	for( i = ctx->nr - 1, SK -= 8; i > 0; i--, SK -= 8 )
	637	{
	638	for( j = 0; j < 4; j++, SK++ )
	639	{
	640	RK++ = RT0[ FSb[ ( SK ) & 0xFF ] ] ^
	641	RT1[ FSb[ ( *SK >> 8 ) & 0xFF ] ] ^
	642	RT2[ FSb[ ( *SK >> 16 ) & 0xFF ] ] ^
	643	RT3[ FSb[ ( *SK >> 24 ) & 0xFF ] ];
	644	}
	645	}
	646
	647	RK++ = SK++;
	648	RK++ = SK++;
	649	RK++ = SK++;
	650	RK++ = SK++;
	651
	652	exit:
	653	aes_free( &cty );
	654
	655	return( ret );
	656	}
	657
	658	#define AES_FROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3) \
	659	{ \
	660	X0 = *RK++ ^ FT0[ ( Y0 ) & 0xFF ] ^ \
	661	FT1[ ( Y1 >> 8 ) & 0xFF ] ^ \
	662	FT2[ ( Y2 >> 16 ) & 0xFF ] ^ \
	663	FT3[ ( Y3 >> 24 ) & 0xFF ]; \
	664	\
	665	X1 = *RK++ ^ FT0[ ( Y1 ) & 0xFF ] ^ \
	666	FT1[ ( Y2 >> 8 ) & 0xFF ] ^ \
	667	FT2[ ( Y3 >> 16 ) & 0xFF ] ^ \
	668	FT3[ ( Y0 >> 24 ) & 0xFF ]; \
	669	\
	670	X2 = *RK++ ^ FT0[ ( Y2 ) & 0xFF ] ^ \
	671	FT1[ ( Y3 >> 8 ) & 0xFF ] ^ \
	672	FT2[ ( Y0 >> 16 ) & 0xFF ] ^ \
	673	FT3[ ( Y1 >> 24 ) & 0xFF ]; \
	674	\
	675	X3 = *RK++ ^ FT0[ ( Y3 ) & 0xFF ] ^ \
	676	FT1[ ( Y0 >> 8 ) & 0xFF ] ^ \
	677	FT2[ ( Y1 >> 16 ) & 0xFF ] ^ \
	678	FT3[ ( Y2 >> 24 ) & 0xFF ]; \
	679	}
	680
	681	#define AES_RROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3) \
	682	{ \
	683	X0 = *RK++ ^ RT0[ ( Y0 ) & 0xFF ] ^ \
	684	RT1[ ( Y3 >> 8 ) & 0xFF ] ^ \
	685	RT2[ ( Y2 >> 16 ) & 0xFF ] ^ \
	686	RT3[ ( Y1 >> 24 ) & 0xFF ]; \
	687	\
	688	X1 = *RK++ ^ RT0[ ( Y1 ) & 0xFF ] ^ \
	689	RT1[ ( Y0 >> 8 ) & 0xFF ] ^ \
	690	RT2[ ( Y3 >> 16 ) & 0xFF ] ^ \
	691	RT3[ ( Y2 >> 24 ) & 0xFF ]; \
	692	\
	693	X2 = *RK++ ^ RT0[ ( Y2 ) & 0xFF ] ^ \
	694	RT1[ ( Y1 >> 8 ) & 0xFF ] ^ \
	695	RT2[ ( Y0 >> 16 ) & 0xFF ] ^ \
	696	RT3[ ( Y3 >> 24 ) & 0xFF ]; \
	697	\
	698	X3 = *RK++ ^ RT0[ ( Y3 ) & 0xFF ] ^ \
	699	RT1[ ( Y2 >> 8 ) & 0xFF ] ^ \
	700	RT2[ ( Y1 >> 16 ) & 0xFF ] ^ \
	701	RT3[ ( Y0 >> 24 ) & 0xFF ]; \
	702	}
	703
	704	/*
	705	* AES-ECB block encryption/decryption
	706	*/
	707	int aes_crypt_ecb( aes_context *ctx,
	708	int mode,
	709	const unsigned char input[16],
	710	unsigned char output[16] )
	711	{
	712	int i;
	713	uint32_t *RK, X0, X1, X2, X3, Y0, Y1, Y2, Y3;
	714
	715	#if defined(POLARSSL_AESNI_C) && defined(POLARSSL_HAVE_X86_64)
	716	if( aesni_supports( POLARSSL_AESNI_AES ) )
	717	return( aesni_crypt_ecb( ctx, mode, input, output ) );
	718	#endif
	719
	720	#if defined(POLARSSL_PADLOCK_C) && defined(POLARSSL_HAVE_X86)
	721	if( aes_padlock_ace )
	722	{
	723	if( padlock_xcryptecb( ctx, mode, input, output ) == 0 )
	724	return( 0 );
	725
	726	// If padlock data misaligned, we just fall back to
	727	// unaccelerated mode
	728	//
	729	}
	730	#endif
	731
	732	RK = ctx->rk;
	733
	734	GET_UINT32_LE( X0, input, 0 ); X0 ^= *RK++;
	735	GET_UINT32_LE( X1, input, 4 ); X1 ^= *RK++;
	736	GET_UINT32_LE( X2, input, 8 ); X2 ^= *RK++;
	737	GET_UINT32_LE( X3, input, 12 ); X3 ^= *RK++;
	738
	739	if( mode == AES_DECRYPT )
	740	{
	741	for( i = ( ctx->nr >> 1 ) - 1; i > 0; i-- )
	742	{
	743	AES_RROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 );
	744	AES_RROUND( X0, X1, X2, X3, Y0, Y1, Y2, Y3 );
	745	}
	746
	747	AES_RROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 );
	748
	749	X0 = *RK++ ^ \
	750	( (uint32_t) RSb[ ( Y0 ) & 0xFF ] ) ^
	751	( (uint32_t) RSb[ ( Y3 >> 8 ) & 0xFF ] << 8 ) ^
	752	( (uint32_t) RSb[ ( Y2 >> 16 ) & 0xFF ] << 16 ) ^
	753	( (uint32_t) RSb[ ( Y1 >> 24 ) & 0xFF ] << 24 );
	754
	755	X1 = *RK++ ^ \
	756	( (uint32_t) RSb[ ( Y1 ) & 0xFF ] ) ^
	757	( (uint32_t) RSb[ ( Y0 >> 8 ) & 0xFF ] << 8 ) ^
	758	( (uint32_t) RSb[ ( Y3 >> 16 ) & 0xFF ] << 16 ) ^
	759	( (uint32_t) RSb[ ( Y2 >> 24 ) & 0xFF ] << 24 );
	760
	761	X2 = *RK++ ^ \
	762	( (uint32_t) RSb[ ( Y2 ) & 0xFF ] ) ^
	763	( (uint32_t) RSb[ ( Y1 >> 8 ) & 0xFF ] << 8 ) ^
	764	( (uint32_t) RSb[ ( Y0 >> 16 ) & 0xFF ] << 16 ) ^
	765	( (uint32_t) RSb[ ( Y3 >> 24 ) & 0xFF ] << 24 );
	766
	767	X3 = *RK++ ^ \
	768	( (uint32_t) RSb[ ( Y3 ) & 0xFF ] ) ^
	769	( (uint32_t) RSb[ ( Y2 >> 8 ) & 0xFF ] << 8 ) ^
	770	( (uint32_t) RSb[ ( Y1 >> 16 ) & 0xFF ] << 16 ) ^
	771	( (uint32_t) RSb[ ( Y0 >> 24 ) & 0xFF ] << 24 );
	772	}
	773	else /* AES_ENCRYPT */
	774	{
	775	for( i = ( ctx->nr >> 1 ) - 1; i > 0; i-- )
	776	{
	777	AES_FROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 );
	778	AES_FROUND( X0, X1, X2, X3, Y0, Y1, Y2, Y3 );
	779	}
	780
	781	AES_FROUND( Y0, Y1, Y2, Y3, X0, X1, X2, X3 );
	782
	783	X0 = *RK++ ^ \
	784	( (uint32_t) FSb[ ( Y0 ) & 0xFF ] ) ^
	785	( (uint32_t) FSb[ ( Y1 >> 8 ) & 0xFF ] << 8 ) ^
	786	( (uint32_t) FSb[ ( Y2 >> 16 ) & 0xFF ] << 16 ) ^
	787	( (uint32_t) FSb[ ( Y3 >> 24 ) & 0xFF ] << 24 );
	788
	789	X1 = *RK++ ^ \
	790	( (uint32_t) FSb[ ( Y1 ) & 0xFF ] ) ^
	791	( (uint32_t) FSb[ ( Y2 >> 8 ) & 0xFF ] << 8 ) ^
	792	( (uint32_t) FSb[ ( Y3 >> 16 ) & 0xFF ] << 16 ) ^
	793	( (uint32_t) FSb[ ( Y0 >> 24 ) & 0xFF ] << 24 );
	794
	795	X2 = *RK++ ^ \
	796	( (uint32_t) FSb[ ( Y2 ) & 0xFF ] ) ^
	797	( (uint32_t) FSb[ ( Y3 >> 8 ) & 0xFF ] << 8 ) ^
	798	( (uint32_t) FSb[ ( Y0 >> 16 ) & 0xFF ] << 16 ) ^
	799	( (uint32_t) FSb[ ( Y1 >> 24 ) & 0xFF ] << 24 );
	800
	801	X3 = *RK++ ^ \
	802	( (uint32_t) FSb[ ( Y3 ) & 0xFF ] ) ^
	803	( (uint32_t) FSb[ ( Y0 >> 8 ) & 0xFF ] << 8 ) ^
	804	( (uint32_t) FSb[ ( Y1 >> 16 ) & 0xFF ] << 16 ) ^
	805	( (uint32_t) FSb[ ( Y2 >> 24 ) & 0xFF ] << 24 );
	806	}
	807
	808	PUT_UINT32_LE( X0, output, 0 );
	809	PUT_UINT32_LE( X1, output, 4 );
	810	PUT_UINT32_LE( X2, output, 8 );
	811	PUT_UINT32_LE( X3, output, 12 );
	812
	813	return( 0 );
	814	}
	815
	816	#if defined(POLARSSL_CIPHER_MODE_CBC)
	817	/*
	818	* AES-CBC buffer encryption/decryption
	819	*/
	820	int aes_crypt_cbc( aes_context *ctx,
	821	int mode,
	822	size_t length,
	823	unsigned char iv[16],
	824	const unsigned char *input,
	825	unsigned char *output )
	826	{
	827	int i;
	828	unsigned char temp[16];
	829
	830	if( length % 16 )
	831	return( POLARSSL_ERR_AES_INVALID_INPUT_LENGTH );
	832
	833	#if defined(POLARSSL_PADLOCK_C) && defined(POLARSSL_HAVE_X86)
	834	if( aes_padlock_ace )
	835	{
	836	if( padlock_xcryptcbc( ctx, mode, length, iv, input, output ) == 0 )
	837	return( 0 );
	838
	839	// If padlock data misaligned, we just fall back to
	840	// unaccelerated mode
	841	//
	842	}
	843	#endif
	844
	845	if( mode == AES_DECRYPT )
	846	{
	847	while( length > 0 )
	848	{
	849	memcpy( temp, input, 16 );
	850	aes_crypt_ecb( ctx, mode, input, output );
	851
	852	for( i = 0; i < 16; i++ )
	853	output[i] = (unsigned char)( output[i] ^ iv[i] );
	854
	855	memcpy( iv, temp, 16 );
	856
	857	input += 16;
	858	output += 16;
	859	length -= 16;
	860	}
	861	}
	862	else
	863	{
	864	while( length > 0 )
	865	{
	866	for( i = 0; i < 16; i++ )
	867	output[i] = (unsigned char)( input[i] ^ iv[i] );
	868
	869	aes_crypt_ecb( ctx, mode, output, output );
	870	memcpy( iv, output, 16 );
	871
	872	input += 16;
	873	output += 16;
	874	length -= 16;
	875	}
	876	}
	877
	878	return( 0 );
	879	}
	880	#endif /* POLARSSL_CIPHER_MODE_CBC */
	881
	882	#if defined(POLARSSL_CIPHER_MODE_CFB)
	883	/*
	884	* AES-CFB128 buffer encryption/decryption
	885	*/
	886	int aes_crypt_cfb128( aes_context *ctx,
	887	int mode,
	888	size_t length,
	889	size_t *iv_off,
	890	unsigned char iv[16],
	891	const unsigned char *input,
	892	unsigned char *output )
	893	{
	894	int c;
	895	size_t n = *iv_off;
	896
	897	if( mode == AES_DECRYPT )
	898	{
	899	while( length-- )
	900	{
	901	if( n == 0 )
	902	aes_crypt_ecb( ctx, AES_ENCRYPT, iv, iv );
	903
	904	c = *input++;
	905	*output++ = (unsigned char)( c ^ iv[n] );
	906	iv[n] = (unsigned char) c;
	907
	908	n = ( n + 1 ) & 0x0F;
	909	}
	910	}
	911	else
	912	{
	913	while( length-- )
	914	{
	915	if( n == 0 )
	916	aes_crypt_ecb( ctx, AES_ENCRYPT, iv, iv );
	917
	918	iv[n] = output++ = (unsigned char)( iv[n] ^ input++ );
	919
	920	n = ( n + 1 ) & 0x0F;
	921	}
	922	}
	923
	924	*iv_off = n;
	925
	926	return( 0 );
	927	}
	928
	929	/*
	930	* AES-CFB8 buffer encryption/decryption
	931	*/
	932	#include <stdio.h>
	933	int aes_crypt_cfb8( aes_context *ctx,
	934	int mode,
	935	size_t length,
	936	unsigned char iv[16],
	937	const unsigned char *input,
	938	unsigned char *output )
	939	{
	940	unsigned char c;
	941	unsigned char ov[17];
	942
	943	while( length-- )
	944	{
	945	memcpy( ov, iv, 16 );
	946	aes_crypt_ecb( ctx, AES_ENCRYPT, iv, iv );
	947
	948	if( mode == AES_DECRYPT )
	949	ov[16] = *input;
	950
	951	c = output++ = (unsigned char)( iv[0] ^ input++ );
	952
	953	if( mode == AES_ENCRYPT )
	954	ov[16] = c;
	955
	956	memcpy( iv, ov + 1, 16 );
	957	}
	958
	959	return( 0 );
	960	}
	961	#endif /POLARSSL_CIPHER_MODE_CFB /
	962
	963	#if defined(POLARSSL_CIPHER_MODE_CTR)
	964	/*
	965	* AES-CTR buffer encryption/decryption
	966	*/
	967	int aes_crypt_ctr( aes_context *ctx,
	968	size_t length,
	969	size_t *nc_off,
	970	unsigned char nonce_counter[16],
	971	unsigned char stream_block[16],
	972	const unsigned char *input,
	973	unsigned char *output )
	974	{
	975	int c, i;
	976	size_t n = *nc_off;
	977
	978	while( length-- )
	979	{
	980	if( n == 0 ) {
	981	aes_crypt_ecb( ctx, AES_ENCRYPT, nonce_counter, stream_block );
	982
	983	for( i = 16; i > 0; i-- )
	984	if( ++nonce_counter[i - 1] != 0 )
	985	break;
	986	}
	987	c = *input++;
	988	*output++ = (unsigned char)( c ^ stream_block[n] );
	989
	990	n = ( n + 1 ) & 0x0F;
	991	}
	992
	993	*nc_off = n;
	994
	995	return( 0 );
	996	}
	997	#endif /* POLARSSL_CIPHER_MODE_CTR */
	998
	999	#endif /* !POLARSSL_AES_ALT */
	1000
	1001	#if defined(POLARSSL_SELF_TEST)
	1002
	1003	#include <stdio.h>
	1004
	1005	/*
	1006	* AES test vectors from:
	1007	*
	1008	* http://csrc.nist.gov/archive/aes/rijndael/rijndael-vals.zip
	1009	*/
	1010	static const unsigned char aes_test_ecb_dec[3][16] =
	1011	{
	1012	{ 0x44, 0x41, 0x6A, 0xC2, 0xD1, 0xF5, 0x3C, 0x58,
	1013	0x33, 0x03, 0x91, 0x7E, 0x6B, 0xE9, 0xEB, 0xE0 },
	1014	{ 0x48, 0xE3, 0x1E, 0x9E, 0x25, 0x67, 0x18, 0xF2,
	1015	0x92, 0x29, 0x31, 0x9C, 0x19, 0xF1, 0x5B, 0xA4 },
	1016	{ 0x05, 0x8C, 0xCF, 0xFD, 0xBB, 0xCB, 0x38, 0x2D,
	1017	0x1F, 0x6F, 0x56, 0x58, 0x5D, 0x8A, 0x4A, 0xDE }
	1018	};
	1019
	1020	static const unsigned char aes_test_ecb_enc[3][16] =
	1021	{
	1022	{ 0xC3, 0x4C, 0x05, 0x2C, 0xC0, 0xDA, 0x8D, 0x73,
	1023	0x45, 0x1A, 0xFE, 0x5F, 0x03, 0xBE, 0x29, 0x7F },
	1024	{ 0xF3, 0xF6, 0x75, 0x2A, 0xE8, 0xD7, 0x83, 0x11,
	1025	0x38, 0xF0, 0x41, 0x56, 0x06, 0x31, 0xB1, 0x14 },
	1026	{ 0x8B, 0x79, 0xEE, 0xCC, 0x93, 0xA0, 0xEE, 0x5D,
	1027	0xFF, 0x30, 0xB4, 0xEA, 0x21, 0x63, 0x6D, 0xA4 }
	1028	};
	1029
	1030	#if defined(POLARSSL_CIPHER_MODE_CBC)
	1031	static const unsigned char aes_test_cbc_dec[3][16] =
	1032	{
	1033	{ 0xFA, 0xCA, 0x37, 0xE0, 0xB0, 0xC8, 0x53, 0x73,
	1034	0xDF, 0x70, 0x6E, 0x73, 0xF7, 0xC9, 0xAF, 0x86 },
	1035	{ 0x5D, 0xF6, 0x78, 0xDD, 0x17, 0xBA, 0x4E, 0x75,
	1036	0xB6, 0x17, 0x68, 0xC6, 0xAD, 0xEF, 0x7C, 0x7B },
	1037	{ 0x48, 0x04, 0xE1, 0x81, 0x8F, 0xE6, 0x29, 0x75,
	1038	0x19, 0xA3, 0xE8, 0x8C, 0x57, 0x31, 0x04, 0x13 }
	1039	};
	1040
	1041	static const unsigned char aes_test_cbc_enc[3][16] =
	1042	{
	1043	{ 0x8A, 0x05, 0xFC, 0x5E, 0x09, 0x5A, 0xF4, 0x84,
	1044	0x8A, 0x08, 0xD3, 0x28, 0xD3, 0x68, 0x8E, 0x3D },
	1045	{ 0x7B, 0xD9, 0x66, 0xD5, 0x3A, 0xD8, 0xC1, 0xBB,
	1046	0x85, 0xD2, 0xAD, 0xFA, 0xE8, 0x7B, 0xB1, 0x04 },
	1047	{ 0xFE, 0x3C, 0x53, 0x65, 0x3E, 0x2F, 0x45, 0xB5,
	1048	0x6F, 0xCD, 0x88, 0xB2, 0xCC, 0x89, 0x8F, 0xF0 }
	1049	};
	1050	#endif /* POLARSSL_CIPHER_MODE_CBC */
	1051
	1052	#if defined(POLARSSL_CIPHER_MODE_CFB)
	1053	/*
	1054	* AES-CFB128 test vectors from:
	1055	*
	1056	* http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
	1057	*/
	1058	static const unsigned char aes_test_cfb128_key[3][32] =
	1059	{
	1060	{ 0x2B, 0x7E, 0x15, 0x16, 0x28, 0xAE, 0xD2, 0xA6,
	1061	0xAB, 0xF7, 0x15, 0x88, 0x09, 0xCF, 0x4F, 0x3C },
	1062	{ 0x8E, 0x73, 0xB0, 0xF7, 0xDA, 0x0E, 0x64, 0x52,
	1063	0xC8, 0x10, 0xF3, 0x2B, 0x80, 0x90, 0x79, 0xE5,
	1064	0x62, 0xF8, 0xEA, 0xD2, 0x52, 0x2C, 0x6B, 0x7B },
	1065	{ 0x60, 0x3D, 0xEB, 0x10, 0x15, 0xCA, 0x71, 0xBE,
	1066	0x2B, 0x73, 0xAE, 0xF0, 0x85, 0x7D, 0x77, 0x81,
	1067	0x1F, 0x35, 0x2C, 0x07, 0x3B, 0x61, 0x08, 0xD7,
	1068	0x2D, 0x98, 0x10, 0xA3, 0x09, 0x14, 0xDF, 0xF4 }
	1069	};
	1070
	1071	static const unsigned char aes_test_cfb128_iv[16] =
	1072	{
	1073	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
	1074	0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F
	1075	};
	1076
	1077	static const unsigned char aes_test_cfb128_pt[64] =
	1078	{
	1079	0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96,
	1080	0xE9, 0x3D, 0x7E, 0x11, 0x73, 0x93, 0x17, 0x2A,
	1081	0xAE, 0x2D, 0x8A, 0x57, 0x1E, 0x03, 0xAC, 0x9C,
	1082	0x9E, 0xB7, 0x6F, 0xAC, 0x45, 0xAF, 0x8E, 0x51,
	1083	0x30, 0xC8, 0x1C, 0x46, 0xA3, 0x5C, 0xE4, 0x11,
	1084	0xE5, 0xFB, 0xC1, 0x19, 0x1A, 0x0A, 0x52, 0xEF,
	1085	0xF6, 0x9F, 0x24, 0x45, 0xDF, 0x4F, 0x9B, 0x17,
	1086	0xAD, 0x2B, 0x41, 0x7B, 0xE6, 0x6C, 0x37, 0x10
	1087	};
	1088
	1089	static const unsigned char aes_test_cfb128_ct[3][64] =
	1090	{
	1091	{ 0x3B, 0x3F, 0xD9, 0x2E, 0xB7, 0x2D, 0xAD, 0x20,
	1092	0x33, 0x34, 0x49, 0xF8, 0xE8, 0x3C, 0xFB, 0x4A,
	1093	0xC8, 0xA6, 0x45, 0x37, 0xA0, 0xB3, 0xA9, 0x3F,
	1094	0xCD, 0xE3, 0xCD, 0xAD, 0x9F, 0x1C, 0xE5, 0x8B,
	1095	0x26, 0x75, 0x1F, 0x67, 0xA3, 0xCB, 0xB1, 0x40,
	1096	0xB1, 0x80, 0x8C, 0xF1, 0x87, 0xA4, 0xF4, 0xDF,
	1097	0xC0, 0x4B, 0x05, 0x35, 0x7C, 0x5D, 0x1C, 0x0E,
	1098	0xEA, 0xC4, 0xC6, 0x6F, 0x9F, 0xF7, 0xF2, 0xE6 },
	1099	{ 0xCD, 0xC8, 0x0D, 0x6F, 0xDD, 0xF1, 0x8C, 0xAB,
	1100	0x34, 0xC2, 0x59, 0x09, 0xC9, 0x9A, 0x41, 0x74,
	1101	0x67, 0xCE, 0x7F, 0x7F, 0x81, 0x17, 0x36, 0x21,
	1102	0x96, 0x1A, 0x2B, 0x70, 0x17, 0x1D, 0x3D, 0x7A,
	1103	0x2E, 0x1E, 0x8A, 0x1D, 0xD5, 0x9B, 0x88, 0xB1,
	1104	0xC8, 0xE6, 0x0F, 0xED, 0x1E, 0xFA, 0xC4, 0xC9,
	1105	0xC0, 0x5F, 0x9F, 0x9C, 0xA9, 0x83, 0x4F, 0xA0,
	1106	0x42, 0xAE, 0x8F, 0xBA, 0x58, 0x4B, 0x09, 0xFF },
	1107	{ 0xDC, 0x7E, 0x84, 0xBF, 0xDA, 0x79, 0x16, 0x4B,
	1108	0x7E, 0xCD, 0x84, 0x86, 0x98, 0x5D, 0x38, 0x60,
	1109	0x39, 0xFF, 0xED, 0x14, 0x3B, 0x28, 0xB1, 0xC8,
	1110	0x32, 0x11, 0x3C, 0x63, 0x31, 0xE5, 0x40, 0x7B,
	1111	0xDF, 0x10, 0x13, 0x24, 0x15, 0xE5, 0x4B, 0x92,
	1112	0xA1, 0x3E, 0xD0, 0xA8, 0x26, 0x7A, 0xE2, 0xF9,
	1113	0x75, 0xA3, 0x85, 0x74, 0x1A, 0xB9, 0xCE, 0xF8,
	1114	0x20, 0x31, 0x62, 0x3D, 0x55, 0xB1, 0xE4, 0x71 }
	1115	};
	1116	#endif /* POLARSSL_CIPHER_MODE_CFB */
	1117
	1118	#if defined(POLARSSL_CIPHER_MODE_CTR)
	1119	/*
	1120	* AES-CTR test vectors from:
	1121	*
	1122	* http://www.faqs.org/rfcs/rfc3686.html
	1123	*/
	1124
	1125	static const unsigned char aes_test_ctr_key[3][16] =
	1126	{
	1127	{ 0xAE, 0x68, 0x52, 0xF8, 0x12, 0x10, 0x67, 0xCC,
	1128	0x4B, 0xF7, 0xA5, 0x76, 0x55, 0x77, 0xF3, 0x9E },
	1129	{ 0x7E, 0x24, 0x06, 0x78, 0x17, 0xFA, 0xE0, 0xD7,
	1130	0x43, 0xD6, 0xCE, 0x1F, 0x32, 0x53, 0x91, 0x63 },
	1131	{ 0x76, 0x91, 0xBE, 0x03, 0x5E, 0x50, 0x20, 0xA8,
	1132	0xAC, 0x6E, 0x61, 0x85, 0x29, 0xF9, 0xA0, 0xDC }
	1133	};
	1134
	1135	static const unsigned char aes_test_ctr_nonce_counter[3][16] =
	1136	{
	1137	{ 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x00,
	1138	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 },
	1139	{ 0x00, 0x6C, 0xB6, 0xDB, 0xC0, 0x54, 0x3B, 0x59,
	1140	0xDA, 0x48, 0xD9, 0x0B, 0x00, 0x00, 0x00, 0x01 },
	1141	{ 0x00, 0xE0, 0x01, 0x7B, 0x27, 0x77, 0x7F, 0x3F,
	1142	0x4A, 0x17, 0x86, 0xF0, 0x00, 0x00, 0x00, 0x01 }
	1143	};
	1144
	1145	static const unsigned char aes_test_ctr_pt[3][48] =
	1146	{
	1147	{ 0x53, 0x69, 0x6E, 0x67, 0x6C, 0x65, 0x20, 0x62,
	1148	0x6C, 0x6F, 0x63, 0x6B, 0x20, 0x6D, 0x73, 0x67 },
	1149
	1150	{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
	1151	0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
	1152	0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
	1153	0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F },
	1154
	1155	{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
	1156	0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
	1157	0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
	1158	0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F,
	1159	0x20, 0x21, 0x22, 0x23 }
	1160	};
	1161
	1162	static const unsigned char aes_test_ctr_ct[3][48] =
	1163	{
	1164	{ 0xE4, 0x09, 0x5D, 0x4F, 0xB7, 0xA7, 0xB3, 0x79,
	1165	0x2D, 0x61, 0x75, 0xA3, 0x26, 0x13, 0x11, 0xB8 },
	1166	{ 0x51, 0x04, 0xA1, 0x06, 0x16, 0x8A, 0x72, 0xD9,
	1167	0x79, 0x0D, 0x41, 0xEE, 0x8E, 0xDA, 0xD3, 0x88,
	1168	0xEB, 0x2E, 0x1E, 0xFC, 0x46, 0xDA, 0x57, 0xC8,
	1169	0xFC, 0xE6, 0x30, 0xDF, 0x91, 0x41, 0xBE, 0x28 },
	1170	{ 0xC1, 0xCF, 0x48, 0xA8, 0x9F, 0x2F, 0xFD, 0xD9,
	1171	0xCF, 0x46, 0x52, 0xE9, 0xEF, 0xDB, 0x72, 0xD7,
	1172	0x45, 0x40, 0xA4, 0x2B, 0xDE, 0x6D, 0x78, 0x36,
	1173	0xD5, 0x9A, 0x5C, 0xEA, 0xAE, 0xF3, 0x10, 0x53,
	1174	0x25, 0xB2, 0x07, 0x2F }
	1175	};
	1176
	1177	static const int aes_test_ctr_len[3] =
	1178	{ 16, 32, 36 };
	1179	#endif /* POLARSSL_CIPHER_MODE_CTR */
	1180
	1181	/*
	1182	* Checkup routine
	1183	*/
	1184	int aes_self_test( int verbose )
	1185	{
	1186	int ret = 0, i, j, u, v;
	1187	unsigned char key[32];
	1188	unsigned char buf[64];
	1189	unsigned char iv[16];
	1190	#if defined(POLARSSL_CIPHER_MODE_CBC)
	1191	unsigned char prv[16];
	1192	#endif
	1193	#if defined(POLARSSL_CIPHER_MODE_CTR) \|\| defined(POLARSSL_CIPHER_MODE_CFB)
	1194	size_t offset;
	1195	#endif
	1196	#if defined(POLARSSL_CIPHER_MODE_CTR)
	1197	int len;
	1198	unsigned char nonce_counter[16];
	1199	unsigned char stream_block[16];
	1200	#endif
	1201	aes_context ctx;
	1202
	1203	memset( key, 0, 32 );
	1204	aes_init( &ctx );
	1205
	1206	/*
	1207	* ECB mode
	1208	*/
	1209	for( i = 0; i < 6; i++ )
	1210	{
	1211	u = i >> 1;
	1212	v = i & 1;
	1213
	1214	if( verbose != 0 )
	1215	polarssl_printf( " AES-ECB-%3d (%s): ", 128 + u * 64,
	1216	( v == AES_DECRYPT ) ? "dec" : "enc" );
	1217
	1218	memset( buf, 0, 16 );
	1219
	1220	if( v == AES_DECRYPT )
	1221	{
	1222	aes_setkey_dec( &ctx, key, 128 + u * 64 );
	1223
	1224	for( j = 0; j < 10000; j++ )
	1225	aes_crypt_ecb( &ctx, v, buf, buf );
	1226
	1227	if( memcmp( buf, aes_test_ecb_dec[u], 16 ) != 0 )
	1228	{
	1229	if( verbose != 0 )
	1230	polarssl_printf( "failed\n" );
	1231
	1232	ret = 1;
	1233	goto exit;
	1234	}
	1235	}
	1236	else
	1237	{
	1238	aes_setkey_enc( &ctx, key, 128 + u * 64 );
	1239
	1240	for( j = 0; j < 10000; j++ )
	1241	aes_crypt_ecb( &ctx, v, buf, buf );
	1242
	1243	if( memcmp( buf, aes_test_ecb_enc[u], 16 ) != 0 )
	1244	{
	1245	if( verbose != 0 )
	1246	polarssl_printf( "failed\n" );
	1247
	1248	ret = 1;
	1249	goto exit;
	1250	}
	1251	}
	1252
	1253	if( verbose != 0 )
	1254	polarssl_printf( "passed\n" );
	1255	}
	1256
	1257	if( verbose != 0 )
	1258	polarssl_printf( "\n" );
	1259
	1260	#if defined(POLARSSL_CIPHER_MODE_CBC)
	1261	/*
	1262	* CBC mode
	1263	*/
	1264	for( i = 0; i < 6; i++ )
	1265	{
	1266	u = i >> 1;
	1267	v = i & 1;
	1268
	1269	if( verbose != 0 )
	1270	polarssl_printf( " AES-CBC-%3d (%s): ", 128 + u * 64,
	1271	( v == AES_DECRYPT ) ? "dec" : "enc" );
	1272
	1273	memset( iv , 0, 16 );
	1274	memset( prv, 0, 16 );
	1275	memset( buf, 0, 16 );
	1276
	1277	if( v == AES_DECRYPT )
	1278	{
	1279	aes_setkey_dec( &ctx, key, 128 + u * 64 );
	1280
	1281	for( j = 0; j < 10000; j++ )
	1282	aes_crypt_cbc( &ctx, v, 16, iv, buf, buf );
	1283
	1284	if( memcmp( buf, aes_test_cbc_dec[u], 16 ) != 0 )
	1285	{
	1286	if( verbose != 0 )
	1287	polarssl_printf( "failed\n" );
	1288
	1289	ret = 1;
	1290	goto exit;
	1291	}
	1292	}
	1293	else
	1294	{
	1295	aes_setkey_enc( &ctx, key, 128 + u * 64 );
	1296
	1297	for( j = 0; j < 10000; j++ )
	1298	{
	1299	unsigned char tmp[16];
	1300
	1301	aes_crypt_cbc( &ctx, v, 16, iv, buf, buf );
	1302
	1303	memcpy( tmp, prv, 16 );
	1304	memcpy( prv, buf, 16 );
	1305	memcpy( buf, tmp, 16 );
	1306	}
	1307
	1308	if( memcmp( prv, aes_test_cbc_enc[u], 16 ) != 0 )
	1309	{
	1310	if( verbose != 0 )
	1311	polarssl_printf( "failed\n" );
	1312
	1313	ret = 1;
	1314	goto exit;
	1315	}
	1316	}
	1317
	1318	if( verbose != 0 )
	1319	polarssl_printf( "passed\n" );
	1320	}
	1321
	1322	if( verbose != 0 )
	1323	polarssl_printf( "\n" );
	1324	#endif /* POLARSSL_CIPHER_MODE_CBC */
	1325
	1326	#if defined(POLARSSL_CIPHER_MODE_CFB)
	1327	/*
	1328	* CFB128 mode
	1329	*/
	1330	for( i = 0; i < 6; i++ )
	1331	{
	1332	u = i >> 1;
	1333	v = i & 1;
	1334
	1335	if( verbose != 0 )
	1336	polarssl_printf( " AES-CFB128-%3d (%s): ", 128 + u * 64,
	1337	( v == AES_DECRYPT ) ? "dec" : "enc" );
	1338
	1339	memcpy( iv, aes_test_cfb128_iv, 16 );
	1340	memcpy( key, aes_test_cfb128_key[u], 16 + u * 8 );
	1341
	1342	offset = 0;
	1343	aes_setkey_enc( &ctx, key, 128 + u * 64 );
	1344
	1345	if( v == AES_DECRYPT )
	1346	{
	1347	memcpy( buf, aes_test_cfb128_ct[u], 64 );
	1348	aes_crypt_cfb128( &ctx, v, 64, &offset, iv, buf, buf );
	1349
	1350	if( memcmp( buf, aes_test_cfb128_pt, 64 ) != 0 )
	1351	{
	1352	if( verbose != 0 )
	1353	polarssl_printf( "failed\n" );
	1354
	1355	ret = 1;
	1356	goto exit;
	1357	}
	1358	}
	1359	else
	1360	{
	1361	memcpy( buf, aes_test_cfb128_pt, 64 );
	1362	aes_crypt_cfb128( &ctx, v, 64, &offset, iv, buf, buf );
	1363
	1364	if( memcmp( buf, aes_test_cfb128_ct[u], 64 ) != 0 )
	1365	{
	1366	if( verbose != 0 )
	1367	polarssl_printf( "failed\n" );
	1368
	1369	ret = 1;
	1370	goto exit;
	1371	}
	1372	}
	1373
	1374	if( verbose != 0 )
	1375	polarssl_printf( "passed\n" );
	1376	}
	1377
	1378	if( verbose != 0 )
	1379	polarssl_printf( "\n" );
	1380	#endif /* POLARSSL_CIPHER_MODE_CFB */
	1381
	1382	#if defined(POLARSSL_CIPHER_MODE_CTR)
	1383	/*
	1384	* CTR mode
	1385	*/
	1386	for( i = 0; i < 6; i++ )
	1387	{
	1388	u = i >> 1;
	1389	v = i & 1;
	1390
	1391	if( verbose != 0 )
	1392	polarssl_printf( " AES-CTR-128 (%s): ",
	1393	( v == AES_DECRYPT ) ? "dec" : "enc" );
	1394
	1395	memcpy( nonce_counter, aes_test_ctr_nonce_counter[u], 16 );
	1396	memcpy( key, aes_test_ctr_key[u], 16 );
	1397
	1398	offset = 0;
	1399	aes_setkey_enc( &ctx, key, 128 );
	1400
	1401	if( v == AES_DECRYPT )
	1402	{
	1403	len = aes_test_ctr_len[u];
	1404	memcpy( buf, aes_test_ctr_ct[u], len );
	1405
	1406	aes_crypt_ctr( &ctx, len, &offset, nonce_counter, stream_block,
	1407	buf, buf );
	1408
	1409	if( memcmp( buf, aes_test_ctr_pt[u], len ) != 0 )
	1410	{
	1411	if( verbose != 0 )
	1412	polarssl_printf( "failed\n" );
	1413
	1414	ret = 1;
	1415	goto exit;
	1416	}
	1417	}
	1418	else
	1419	{
	1420	len = aes_test_ctr_len[u];
	1421	memcpy( buf, aes_test_ctr_pt[u], len );
	1422
	1423	aes_crypt_ctr( &ctx, len, &offset, nonce_counter, stream_block,
	1424	buf, buf );
	1425
	1426	if( memcmp( buf, aes_test_ctr_ct[u], len ) != 0 )
	1427	{
	1428	if( verbose != 0 )
	1429	polarssl_printf( "failed\n" );
	1430
	1431	ret = 1;
	1432	goto exit;
	1433	}
	1434	}
	1435
	1436	if( verbose != 0 )
	1437	polarssl_printf( "passed\n" );
	1438	}
	1439
	1440	if( verbose != 0 )
	1441	polarssl_printf( "\n" );
	1442	#endif /* POLARSSL_CIPHER_MODE_CTR */
	1443
	1444	ret = 0;
	1445
	1446	exit:
	1447	aes_free( &ctx );
	1448
	1449	return( ret );
	1450	}
	1451
	1452	#endif /* POLARSSL_SELF_TEST */
	1453
	1454	#endif /* POLARSSL_AES_C */