2 * rijndael-alg-fst.c v2.4 April '2000
4 * Optimised ANSI C code
6 * authors: v1.0: Antoon Bosselaers
11 * This code is placed in the public domain.
19 #include "boxes-fst-corrected.dat"
21 int rijndaelKeySched(const word8 k[RIJNDAEL_MAXKC][4],
22 word8 W[RIJNDAEL_MAXROUNDS+1][4][4],int ROUNDS)
24 /* Calculate the necessary round keys
25 * The number of calculations depends on keyBits and blockBits
27 int j, r, t, rconpointer = 0;
28 word8 tk[RIJNDAEL_MAXKC][4];
31 for (j = KC-1; j >= 0; j--)
32 *((word32*)tk[j]) = *((word32*)k[j]);
35 /* copy values into round key array */
36 for (j = 0; (j < KC) && (r < ROUNDS + 1); )
38 for (; (j < KC) && (t < 4); j++, t++)
39 *((word32*)W[r][t]) = *((word32*)tk[j]);
47 while (r < ROUNDS + 1)
48 { /* while not enough round key material calculated */
49 /* calculate new values */
50 tk[0][0] ^= S[tk[KC-1][1]];
51 tk[0][1] ^= S[tk[KC-1][2]];
52 tk[0][2] ^= S[tk[KC-1][3]];
53 tk[0][3] ^= S[tk[KC-1][0]];
54 tk[0][0] ^= rcon[rconpointer++];
58 for (j = 1; j < KC; j++)
60 *((word32*)tk[j]) ^= *((word32*)tk[j-1]);
65 for (j = 1; j < KC/2; j++)
67 *((word32*)tk[j]) ^= *((word32*)tk[j-1]);
69 tk[KC/2][0] ^= S[tk[KC/2 - 1][0]];
70 tk[KC/2][1] ^= S[tk[KC/2 - 1][1]];
71 tk[KC/2][2] ^= S[tk[KC/2 - 1][2]];
72 tk[KC/2][3] ^= S[tk[KC/2 - 1][3]];
73 for (j = KC/2 + 1; j < KC; j++)
75 *((word32*)tk[j]) ^= *((word32*)tk[j-1]);
78 /* copy values into round key array */
79 for (j = 0; (j < KC) && (r < ROUNDS + 1); )
81 for (; (j < KC) && (t < 4); j++, t++)
83 *((word32*)W[r][t]) = *((word32*)tk[j]);
95 int rijndaelKeyEncToDec(word8 W[RIJNDAEL_MAXROUNDS+1][4][4], int ROUNDS)
100 for (r = 1; r < ROUNDS; r++)
105 ^ *((word32*)U2[w[1]])
106 ^ *((word32*)U3[w[2]])
107 ^ *((word32*)U4[w[3]]);
112 ^ *((word32*)U2[w[1]])
113 ^ *((word32*)U3[w[2]])
114 ^ *((word32*)U4[w[3]]);
119 ^ *((word32*)U2[w[1]])
120 ^ *((word32*)U3[w[2]])
121 ^ *((word32*)U4[w[3]]);
126 ^ *((word32*)U2[w[1]])
127 ^ *((word32*)U3[w[2]])
128 ^ *((word32*)U4[w[3]]);
134 * Encrypt a single block.
136 int rijndaelEncrypt(const word8 a[16],word8 b[16],
137 word8 rk[RIJNDAEL_MAXROUNDS+1][4][4],
143 *((word32*)temp[0]) = *((word32*)(a )) ^ *((word32*)rk[0][0]);
144 *((word32*)temp[1]) = *((word32*)(a+ 4)) ^ *((word32*)rk[0][1]);
145 *((word32*)temp[2]) = *((word32*)(a+ 8)) ^ *((word32*)rk[0][2]);
146 *((word32*)temp[3]) = *((word32*)(a+12)) ^ *((word32*)rk[0][3]);
147 *((word32*)(b )) = *((word32*)T1[temp[0][0]])
148 ^ *((word32*)T2[temp[1][1]])
149 ^ *((word32*)T3[temp[2][2]])
150 ^ *((word32*)T4[temp[3][3]]);
151 *((word32*)(b + 4)) = *((word32*)T1[temp[1][0]])
152 ^ *((word32*)T2[temp[2][1]])
153 ^ *((word32*)T3[temp[3][2]])
154 ^ *((word32*)T4[temp[0][3]]);
155 *((word32*)(b + 8)) = *((word32*)T1[temp[2][0]])
156 ^ *((word32*)T2[temp[3][1]])
157 ^ *((word32*)T3[temp[0][2]])
158 ^ *((word32*)T4[temp[1][3]]);
159 *((word32*)(b +12)) = *((word32*)T1[temp[3][0]])
160 ^ *((word32*)T2[temp[0][1]])
161 ^ *((word32*)T3[temp[1][2]])
162 ^ *((word32*)T4[temp[2][3]]);
163 for (r = 1; r < ROUNDS-1; r++)
165 *((word32*)temp[0]) = *((word32*)(b )) ^ *((word32*)rk[r][0]);
166 *((word32*)temp[1]) = *((word32*)(b+ 4)) ^ *((word32*)rk[r][1]);
167 *((word32*)temp[2]) = *((word32*)(b+ 8)) ^ *((word32*)rk[r][2]);
168 *((word32*)temp[3]) = *((word32*)(b+12)) ^ *((word32*)rk[r][3]);
170 *((word32*)(b )) = *((word32*)T1[temp[0][0]])
171 ^ *((word32*)T2[temp[1][1]])
172 ^ *((word32*)T3[temp[2][2]])
173 ^ *((word32*)T4[temp[3][3]]);
174 *((word32*)(b + 4)) = *((word32*)T1[temp[1][0]])
175 ^ *((word32*)T2[temp[2][1]])
176 ^ *((word32*)T3[temp[3][2]])
177 ^ *((word32*)T4[temp[0][3]]);
178 *((word32*)(b + 8)) = *((word32*)T1[temp[2][0]])
179 ^ *((word32*)T2[temp[3][1]])
180 ^ *((word32*)T3[temp[0][2]])
181 ^ *((word32*)T4[temp[1][3]]);
182 *((word32*)(b +12)) = *((word32*)T1[temp[3][0]])
183 ^ *((word32*)T2[temp[0][1]])
184 ^ *((word32*)T3[temp[1][2]])
185 ^ *((word32*)T4[temp[2][3]]);
187 /* last round is special */
188 *((word32*)temp[0]) = *((word32*)(b )) ^ *((word32*)rk[ROUNDS-1][0]);
189 *((word32*)temp[1]) = *((word32*)(b+ 4)) ^ *((word32*)rk[ROUNDS-1][1]);
190 *((word32*)temp[2]) = *((word32*)(b+ 8)) ^ *((word32*)rk[ROUNDS-1][2]);
191 *((word32*)temp[3]) = *((word32*)(b+12)) ^ *((word32*)rk[ROUNDS-1][3]);
192 b[ 0] = T1[temp[0][0]][1];
193 b[ 1] = T1[temp[1][1]][1];
194 b[ 2] = T1[temp[2][2]][1];
195 b[ 3] = T1[temp[3][3]][1];
196 b[ 4] = T1[temp[1][0]][1];
197 b[ 5] = T1[temp[2][1]][1];
198 b[ 6] = T1[temp[3][2]][1];
199 b[ 7] = T1[temp[0][3]][1];
200 b[ 8] = T1[temp[2][0]][1];
201 b[ 9] = T1[temp[3][1]][1];
202 b[10] = T1[temp[0][2]][1];
203 b[11] = T1[temp[1][3]][1];
204 b[12] = T1[temp[3][0]][1];
205 b[13] = T1[temp[0][1]][1];
206 b[14] = T1[temp[1][2]][1];
207 b[15] = T1[temp[2][3]][1];
208 *((word32*)(b )) ^= *((word32*)rk[ROUNDS][0]);
209 *((word32*)(b+ 4)) ^= *((word32*)rk[ROUNDS][1]);
210 *((word32*)(b+ 8)) ^= *((word32*)rk[ROUNDS][2]);
211 *((word32*)(b+12)) ^= *((word32*)rk[ROUNDS][3]);
216 #ifdef INTERMEDIATE_VALUE_KAT
218 * Encrypt only a certain number of rounds.
219 * Only used in the Intermediate Value Known Answer Test.
221 int rijndaelEncryptRound(word8 a[4][4],word8 rk[RIJNDAEL_MAXROUNDS+1][4][4],
222 int ROUNDS, int rounds)
227 /* make number of rounds sane */
233 *((word32*)a[0]) = *((word32*)a[0]) ^ *((word32*)rk[0][0]);
234 *((word32*)a[1]) = *((word32*)a[1]) ^ *((word32*)rk[0][1]);
235 *((word32*)a[2]) = *((word32*)a[2]) ^ *((word32*)rk[0][2]);
236 *((word32*)a[3]) = *((word32*)a[3]) ^ *((word32*)rk[0][3]);
238 for (r = 1; (r <= rounds) && (r < ROUNDS); r++) {
239 *((word32*)temp[0]) = *((word32*)T1[a[0][0]])
240 ^ *((word32*)T2[a[1][1]])
241 ^ *((word32*)T3[a[2][2]])
242 ^ *((word32*)T4[a[3][3]]);
243 *((word32*)temp[1]) = *((word32*)T1[a[1][0]])
244 ^ *((word32*)T2[a[2][1]])
245 ^ *((word32*)T3[a[3][2]])
246 ^ *((word32*)T4[a[0][3]]);
247 *((word32*)temp[2]) = *((word32*)T1[a[2][0]])
248 ^ *((word32*)T2[a[3][1]])
249 ^ *((word32*)T3[a[0][2]])
250 ^ *((word32*)T4[a[1][3]]);
251 *((word32*)temp[3]) = *((word32*)T1[a[3][0]])
252 ^ *((word32*)T2[a[0][1]])
253 ^ *((word32*)T3[a[1][2]])
254 ^ *((word32*)T4[a[2][3]]);
255 *((word32*)a[0]) = *((word32*)temp[0]) ^ *((word32*)rk[r][0]);
256 *((word32*)a[1]) = *((word32*)temp[1]) ^ *((word32*)rk[r][1]);
257 *((word32*)a[2]) = *((word32*)temp[2]) ^ *((word32*)rk[r][2]);
258 *((word32*)a[3]) = *((word32*)temp[3]) ^ *((word32*)rk[r][3]);
260 if (rounds == ROUNDS)
262 /* last round is special */
263 temp[0][0] = T1[a[0][0]][1];
264 temp[0][1] = T1[a[1][1]][1];
265 temp[0][2] = T1[a[2][2]][1];
266 temp[0][3] = T1[a[3][3]][1];
267 temp[1][0] = T1[a[1][0]][1];
268 temp[1][1] = T1[a[2][1]][1];
269 temp[1][2] = T1[a[3][2]][1];
270 temp[1][3] = T1[a[0][3]][1];
271 temp[2][0] = T1[a[2][0]][1];
272 temp[2][1] = T1[a[3][1]][1];
273 temp[2][2] = T1[a[0][2]][1];
274 temp[2][3] = T1[a[1][3]][1];
275 temp[3][0] = T1[a[3][0]][1];
276 temp[3][1] = T1[a[0][1]][1];
277 temp[3][2] = T1[a[1][2]][1];
278 temp[3][3] = T1[a[2][3]][1];
279 *((word32*)a[0]) = *((word32*)temp[0]) ^ *((word32*)rk[ROUNDS][0]);
280 *((word32*)a[1]) = *((word32*)temp[1]) ^ *((word32*)rk[ROUNDS][1]);
281 *((word32*)a[2]) = *((word32*)temp[2]) ^ *((word32*)rk[ROUNDS][2]);
282 *((word32*)a[3]) = *((word32*)temp[3]) ^ *((word32*)rk[ROUNDS][3]);
287 #endif /* INTERMEDIATE_VALUE_KAT */
290 * Decrypt a single block.
292 int rijndaelDecrypt(const word8 a[16],word8 b[16],
293 word8 rk[RIJNDAEL_MAXROUNDS+1][4][4],int ROUNDS)
298 *((word32*)temp[0]) = *((word32*)(a )) ^ *((word32*)rk[ROUNDS][0]);
299 *((word32*)temp[1]) = *((word32*)(a+ 4)) ^ *((word32*)rk[ROUNDS][1]);
300 *((word32*)temp[2]) = *((word32*)(a+ 8)) ^ *((word32*)rk[ROUNDS][2]);
301 *((word32*)temp[3]) = *((word32*)(a+12)) ^ *((word32*)rk[ROUNDS][3]);
303 *((word32*)(b )) = *((word32*)T5[temp[0][0]])
304 ^ *((word32*)T6[temp[3][1]])
305 ^ *((word32*)T7[temp[2][2]])
306 ^ *((word32*)T8[temp[1][3]]);
307 *((word32*)(b+ 4)) = *((word32*)T5[temp[1][0]])
308 ^ *((word32*)T6[temp[0][1]])
309 ^ *((word32*)T7[temp[3][2]])
310 ^ *((word32*)T8[temp[2][3]]);
311 *((word32*)(b+ 8)) = *((word32*)T5[temp[2][0]])
312 ^ *((word32*)T6[temp[1][1]])
313 ^ *((word32*)T7[temp[0][2]])
314 ^ *((word32*)T8[temp[3][3]]);
315 *((word32*)(b+12)) = *((word32*)T5[temp[3][0]])
316 ^ *((word32*)T6[temp[2][1]])
317 ^ *((word32*)T7[temp[1][2]])
318 ^ *((word32*)T8[temp[0][3]]);
319 for (r = ROUNDS-1; r > 1; r--)
321 *((word32*)temp[0]) = *((word32*)(b )) ^ *((word32*)rk[r][0]);
322 *((word32*)temp[1]) = *((word32*)(b+ 4)) ^ *((word32*)rk[r][1]);
323 *((word32*)temp[2]) = *((word32*)(b+ 8)) ^ *((word32*)rk[r][2]);
324 *((word32*)temp[3]) = *((word32*)(b+12)) ^ *((word32*)rk[r][3]);
325 *((word32*)(b )) = *((word32*)T5[temp[0][0]])
326 ^ *((word32*)T6[temp[3][1]])
327 ^ *((word32*)T7[temp[2][2]])
328 ^ *((word32*)T8[temp[1][3]]);
329 *((word32*)(b+ 4)) = *((word32*)T5[temp[1][0]])
330 ^ *((word32*)T6[temp[0][1]])
331 ^ *((word32*)T7[temp[3][2]])
332 ^ *((word32*)T8[temp[2][3]]);
333 *((word32*)(b+ 8)) = *((word32*)T5[temp[2][0]])
334 ^ *((word32*)T6[temp[1][1]])
335 ^ *((word32*)T7[temp[0][2]])
336 ^ *((word32*)T8[temp[3][3]]);
337 *((word32*)(b+12)) = *((word32*)T5[temp[3][0]])
338 ^ *((word32*)T6[temp[2][1]])
339 ^ *((word32*)T7[temp[1][2]])
340 ^ *((word32*)T8[temp[0][3]]);
342 /* last round is special */
343 *((word32*)temp[0]) = *((word32*)(b )) ^ *((word32*)rk[1][0]);
344 *((word32*)temp[1]) = *((word32*)(b+ 4)) ^ *((word32*)rk[1][1]);
345 *((word32*)temp[2]) = *((word32*)(b+ 8)) ^ *((word32*)rk[1][2]);
346 *((word32*)temp[3]) = *((word32*)(b+12)) ^ *((word32*)rk[1][3]);
347 b[ 0] = S5[temp[0][0]];
348 b[ 1] = S5[temp[3][1]];
349 b[ 2] = S5[temp[2][2]];
350 b[ 3] = S5[temp[1][3]];
351 b[ 4] = S5[temp[1][0]];
352 b[ 5] = S5[temp[0][1]];
353 b[ 6] = S5[temp[3][2]];
354 b[ 7] = S5[temp[2][3]];
355 b[ 8] = S5[temp[2][0]];
356 b[ 9] = S5[temp[1][1]];
357 b[10] = S5[temp[0][2]];
358 b[11] = S5[temp[3][3]];
359 b[12] = S5[temp[3][0]];
360 b[13] = S5[temp[2][1]];
361 b[14] = S5[temp[1][2]];
362 b[15] = S5[temp[0][3]];
363 *((word32*)(b )) ^= *((word32*)rk[0][0]);
364 *((word32*)(b+ 4)) ^= *((word32*)rk[0][1]);
365 *((word32*)(b+ 8)) ^= *((word32*)rk[0][2]);
366 *((word32*)(b+12)) ^= *((word32*)rk[0][3]);
371 #ifdef INTERMEDIATE_VALUE_KAT
373 * Decrypt only a certain number of rounds.
374 * Only used in the Intermediate Value Known Answer Test.
375 * Operations rearranged such that the intermediate values
376 * of decryption correspond with the intermediate values
379 int rijndaelDecryptRound(word8 a[4][4], word8 rk[RIJNDAEL_MAXROUNDS+1][4][4],
380 int ROUNDS, int rounds)
383 word8 temp[4], shift;
385 /* make number of rounds sane */
390 /* first round is special: */
391 *(word32 *)a[0] ^= *(word32 *)rk[ROUNDS][0];
392 *(word32 *)a[1] ^= *(word32 *)rk[ROUNDS][1];
393 *(word32 *)a[2] ^= *(word32 *)rk[ROUNDS][2];
394 *(word32 *)a[3] ^= *(word32 *)rk[ROUNDS][3];
395 for (i = 0; i < 4; i++)
397 a[i][0] = Si[a[i][0]];
398 a[i][1] = Si[a[i][1]];
399 a[i][2] = Si[a[i][2]];
400 a[i][3] = Si[a[i][3]];
402 for (i = 1; i < 4; i++)
405 temp[0] = a[(0 + shift) & 3][i];
406 temp[1] = a[(1 + shift) & 3][i];
407 temp[2] = a[(2 + shift) & 3][i];
408 temp[3] = a[(3 + shift) & 3][i];
414 /* ROUNDS-1 ordinary rounds */
415 for (r = ROUNDS-1; r > rounds; r--)
417 *(word32 *)a[0] ^= *(word32 *)rk[r][0];
418 *(word32 *)a[1] ^= *(word32 *)rk[r][1];
419 *(word32 *)a[2] ^= *(word32 *)rk[r][2];
420 *(word32 *)a[3] ^= *(word32 *)rk[r][3];
423 *((word32*)U1[a[0][0]])
424 ^ *((word32*)U2[a[0][1]])
425 ^ *((word32*)U3[a[0][2]])
426 ^ *((word32*)U4[a[0][3]]);
429 *((word32*)U1[a[1][0]])
430 ^ *((word32*)U2[a[1][1]])
431 ^ *((word32*)U3[a[1][2]])
432 ^ *((word32*)U4[a[1][3]]);
435 *((word32*)U1[a[2][0]])
436 ^ *((word32*)U2[a[2][1]])
437 ^ *((word32*)U3[a[2][2]])
438 ^ *((word32*)U4[a[2][3]]);
441 *((word32*)U1[a[3][0]])
442 ^ *((word32*)U2[a[3][1]])
443 ^ *((word32*)U3[a[3][2]])
444 ^ *((word32*)U4[a[3][3]]);
445 for (i = 0; i < 4; i++)
447 a[i][0] = Si[a[i][0]];
448 a[i][1] = Si[a[i][1]];
449 a[i][2] = Si[a[i][2]];
450 a[i][3] = Si[a[i][3]];
452 for (i = 1; i < 4; i++)
455 temp[0] = a[(0 + shift) & 3][i];
456 temp[1] = a[(1 + shift) & 3][i];
457 temp[2] = a[(2 + shift) & 3][i];
458 temp[3] = a[(3 + shift) & 3][i];
467 /* End with the extra key addition */
468 *(word32 *)a[0] ^= *(word32 *)rk[0][0];
469 *(word32 *)a[1] ^= *(word32 *)rk[0][1];
470 *(word32 *)a[2] ^= *(word32 *)rk[0][2];
471 *(word32 *)a[3] ^= *(word32 *)rk[0][3];
476 #endif /* INTERMEDIATE_VALUE_KAT */