2 * Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
11 * AES_encrypt/AES_decrypt are deprecated - but we need to use them to implement
14 #include "internal/deprecated.h"
16 #include "internal/cryptlib.h"
18 #include <openssl/aes.h>
19 #include "aes_local.h"
21 /* XXX: probably some better way to do this */
22 #if defined(__i386__) || defined(__x86_64__)
23 # define UNALIGNED_MEMOPS_ARE_FAST 1
25 # define UNALIGNED_MEMOPS_ARE_FAST 0
28 #define N_WORDS (AES_BLOCK_SIZE / sizeof(unsigned long))
30 unsigned long data[N_WORDS];
31 #if defined(__GNUC__) && UNALIGNED_MEMOPS_ARE_FAST
32 } aes_block_t __attribute((__aligned__(1)));
37 #if UNALIGNED_MEMOPS_ARE_FAST
38 # define load_block(d, s) (d) = *(const aes_block_t *)(s)
39 # define store_block(d, s) *(aes_block_t *)(d) = (s)
41 # define load_block(d, s) memcpy((d).data, (s), AES_BLOCK_SIZE)
42 # define store_block(d, s) memcpy((d), (s).data, AES_BLOCK_SIZE)
45 /* N.B. The IV for this mode is _twice_ the block size */
47 /* Use of this function is deprecated. */
48 void AES_ige_encrypt(const unsigned char *in, unsigned char *out,
49 size_t length, const AES_KEY *key,
50 unsigned char *ivec, const int enc)
58 OPENSSL_assert(in && out && key && ivec);
59 OPENSSL_assert((AES_ENCRYPT == enc) || (AES_DECRYPT == enc));
60 OPENSSL_assert((length % AES_BLOCK_SIZE) == 0);
62 len = length / AES_BLOCK_SIZE;
64 if (AES_ENCRYPT == enc) {
66 (UNALIGNED_MEMOPS_ARE_FAST
67 || ((size_t)in | (size_t)out | (size_t)ivec) % sizeof(long) ==
69 aes_block_t *ivp = (aes_block_t *) ivec;
70 aes_block_t *iv2p = (aes_block_t *) (ivec + AES_BLOCK_SIZE);
73 aes_block_t *inp = (aes_block_t *) in;
74 aes_block_t *outp = (aes_block_t *) out;
76 for (n = 0; n < N_WORDS; ++n)
77 outp->data[n] = inp->data[n] ^ ivp->data[n];
78 AES_encrypt((unsigned char *)outp->data,
79 (unsigned char *)outp->data, key);
80 for (n = 0; n < N_WORDS; ++n)
81 outp->data[n] ^= iv2p->data[n];
86 out += AES_BLOCK_SIZE;
88 memcpy(ivec, ivp->data, AES_BLOCK_SIZE);
89 memcpy(ivec + AES_BLOCK_SIZE, iv2p->data, AES_BLOCK_SIZE);
91 aes_block_t tmp, tmp2;
96 load_block(iv2, ivec + AES_BLOCK_SIZE);
100 for (n = 0; n < N_WORDS; ++n)
101 tmp2.data[n] = tmp.data[n] ^ iv.data[n];
102 AES_encrypt((unsigned char *)tmp2.data,
103 (unsigned char *)tmp2.data, key);
104 for (n = 0; n < N_WORDS; ++n)
105 tmp2.data[n] ^= iv2.data[n];
106 store_block(out, tmp2);
110 in += AES_BLOCK_SIZE;
111 out += AES_BLOCK_SIZE;
113 memcpy(ivec, iv.data, AES_BLOCK_SIZE);
114 memcpy(ivec + AES_BLOCK_SIZE, iv2.data, AES_BLOCK_SIZE);
118 (UNALIGNED_MEMOPS_ARE_FAST
119 || ((size_t)in | (size_t)out | (size_t)ivec) % sizeof(long) ==
121 aes_block_t *ivp = (aes_block_t *) ivec;
122 aes_block_t *iv2p = (aes_block_t *) (ivec + AES_BLOCK_SIZE);
126 aes_block_t *inp = (aes_block_t *) in;
127 aes_block_t *outp = (aes_block_t *) out;
129 for (n = 0; n < N_WORDS; ++n)
130 tmp.data[n] = inp->data[n] ^ iv2p->data[n];
131 AES_decrypt((unsigned char *)tmp.data,
132 (unsigned char *)outp->data, key);
133 for (n = 0; n < N_WORDS; ++n)
134 outp->data[n] ^= ivp->data[n];
138 in += AES_BLOCK_SIZE;
139 out += AES_BLOCK_SIZE;
141 memcpy(ivec, ivp->data, AES_BLOCK_SIZE);
142 memcpy(ivec + AES_BLOCK_SIZE, iv2p->data, AES_BLOCK_SIZE);
144 aes_block_t tmp, tmp2;
148 load_block(iv, ivec);
149 load_block(iv2, ivec + AES_BLOCK_SIZE);
154 for (n = 0; n < N_WORDS; ++n)
155 tmp.data[n] ^= iv2.data[n];
156 AES_decrypt((unsigned char *)tmp.data,
157 (unsigned char *)tmp.data, key);
158 for (n = 0; n < N_WORDS; ++n)
159 tmp.data[n] ^= iv.data[n];
160 store_block(out, tmp);
164 in += AES_BLOCK_SIZE;
165 out += AES_BLOCK_SIZE;
167 memcpy(ivec, iv.data, AES_BLOCK_SIZE);
168 memcpy(ivec + AES_BLOCK_SIZE, iv2.data, AES_BLOCK_SIZE);
174 * Note that its effectively impossible to do biIGE in anything other
175 * than a single pass, so no provision is made for chaining.
177 * NB: The implementation of AES_bi_ige_encrypt has a bug. It is supposed to use
178 * 2 AES keys, but in fact only one is ever used. This bug has been present
179 * since this code was first implemented. It is believed to have minimal
180 * security impact in practice and has therefore not been fixed for backwards
181 * compatibility reasons.
183 * Use of this function is deprecated.
186 /* N.B. The IV for this mode is _four times_ the block size */
188 void AES_bi_ige_encrypt(const unsigned char *in, unsigned char *out,
189 size_t length, const AES_KEY *key,
190 const AES_KEY *key2, const unsigned char *ivec,
195 unsigned char tmp[AES_BLOCK_SIZE];
196 unsigned char tmp2[AES_BLOCK_SIZE];
197 unsigned char tmp3[AES_BLOCK_SIZE];
198 unsigned char prev[AES_BLOCK_SIZE];
199 const unsigned char *iv;
200 const unsigned char *iv2;
202 OPENSSL_assert(in && out && key && ivec);
203 OPENSSL_assert((AES_ENCRYPT == enc) || (AES_DECRYPT == enc));
204 OPENSSL_assert((length % AES_BLOCK_SIZE) == 0);
206 if (AES_ENCRYPT == enc) {
208 * XXX: Do a separate case for when in != out (strictly should check
212 /* First the forward pass */
214 iv2 = ivec + AES_BLOCK_SIZE;
215 while (len >= AES_BLOCK_SIZE) {
216 for (n = 0; n < AES_BLOCK_SIZE; ++n)
217 out[n] = in[n] ^ iv[n];
218 AES_encrypt(out, out, key);
219 for (n = 0; n < AES_BLOCK_SIZE; ++n)
222 memcpy(prev, in, AES_BLOCK_SIZE);
224 len -= AES_BLOCK_SIZE;
225 in += AES_BLOCK_SIZE;
226 out += AES_BLOCK_SIZE;
229 /* And now backwards */
230 iv = ivec + AES_BLOCK_SIZE * 2;
231 iv2 = ivec + AES_BLOCK_SIZE * 3;
233 while (len >= AES_BLOCK_SIZE) {
234 out -= AES_BLOCK_SIZE;
236 * XXX: reduce copies by alternating between buffers
238 memcpy(tmp, out, AES_BLOCK_SIZE);
239 for (n = 0; n < AES_BLOCK_SIZE; ++n)
242 * hexdump(stdout, "out ^ iv", out, AES_BLOCK_SIZE);
244 AES_encrypt(out, out, key);
246 * hexdump(stdout,"enc", out, AES_BLOCK_SIZE);
249 * hexdump(stdout,"iv2", iv2, AES_BLOCK_SIZE);
251 for (n = 0; n < AES_BLOCK_SIZE; ++n)
254 * hexdump(stdout,"out", out, AES_BLOCK_SIZE);
257 memcpy(prev, tmp, AES_BLOCK_SIZE);
259 len -= AES_BLOCK_SIZE;
262 /* First backwards */
263 iv = ivec + AES_BLOCK_SIZE * 2;
264 iv2 = ivec + AES_BLOCK_SIZE * 3;
267 while (len >= AES_BLOCK_SIZE) {
268 in -= AES_BLOCK_SIZE;
269 out -= AES_BLOCK_SIZE;
270 memcpy(tmp, in, AES_BLOCK_SIZE);
271 memcpy(tmp2, in, AES_BLOCK_SIZE);
272 for (n = 0; n < AES_BLOCK_SIZE; ++n)
274 AES_decrypt(tmp, out, key);
275 for (n = 0; n < AES_BLOCK_SIZE; ++n)
277 memcpy(tmp3, tmp2, AES_BLOCK_SIZE);
280 len -= AES_BLOCK_SIZE;
283 /* And now forwards */
285 iv2 = ivec + AES_BLOCK_SIZE;
287 while (len >= AES_BLOCK_SIZE) {
288 memcpy(tmp, out, AES_BLOCK_SIZE);
289 memcpy(tmp2, out, AES_BLOCK_SIZE);
290 for (n = 0; n < AES_BLOCK_SIZE; ++n)
292 AES_decrypt(tmp, out, key);
293 for (n = 0; n < AES_BLOCK_SIZE; ++n)
295 memcpy(tmp3, tmp2, AES_BLOCK_SIZE);
298 len -= AES_BLOCK_SIZE;
299 in += AES_BLOCK_SIZE;
300 out += AES_BLOCK_SIZE;