| Line | Branch | Exec | Source |
|---|---|---|---|
| 1 | /* | ||
| 2 | * copyright (c) 2007 Michael Niedermayer <michaelni@gmx.at> | ||
| 3 | * | ||
| 4 | * some optimization ideas from aes128.c by Reimar Doeffinger | ||
| 5 | * | ||
| 6 | * This file is part of FFmpeg. | ||
| 7 | * | ||
| 8 | * FFmpeg is free software; you can redistribute it and/or | ||
| 9 | * modify it under the terms of the GNU Lesser General Public | ||
| 10 | * License as published by the Free Software Foundation; either | ||
| 11 | * version 2.1 of the License, or (at your option) any later version. | ||
| 12 | * | ||
| 13 | * FFmpeg is distributed in the hope that it will be useful, | ||
| 14 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
| 15 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | ||
| 16 | * Lesser General Public License for more details. | ||
| 17 | * | ||
| 18 | * You should have received a copy of the GNU Lesser General Public | ||
| 19 | * License along with FFmpeg; if not, write to the Free Software | ||
| 20 | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA | ||
| 21 | */ | ||
| 22 | |||
| 23 | #include <string.h> | ||
| 24 | |||
| 25 | #include "config.h" | ||
| 26 | #include "aes.h" | ||
| 27 | #include "aes_internal.h" | ||
| 28 | #include "error.h" | ||
| 29 | #include "intreadwrite.h" | ||
| 30 | #include "macros.h" | ||
| 31 | #include "mem.h" | ||
| 32 | |||
| 33 | const int av_aes_size= sizeof(AVAES); | ||
| 34 | |||
| 35 | 16 | struct AVAES *av_aes_alloc(void) | |
| 36 | { | ||
| 37 | 16 | return av_mallocz(sizeof(struct AVAES)); | |
| 38 | } | ||
| 39 | |||
| 40 | static const uint8_t rcon[10] = { | ||
| 41 | 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36 | ||
| 42 | }; | ||
| 43 | |||
| 44 | static uint8_t sbox[256]; | ||
| 45 | static uint8_t inv_sbox[256]; | ||
| 46 | #if CONFIG_SMALL | ||
| 47 | static uint32_t enc_multbl[1][256]; | ||
| 48 | static uint32_t dec_multbl[1][256]; | ||
| 49 | #else | ||
| 50 | static uint32_t enc_multbl[4][256]; | ||
| 51 | static uint32_t dec_multbl[4][256]; | ||
| 52 | #endif | ||
| 53 | |||
| 54 | #if HAVE_BIGENDIAN | ||
| 55 | # define ROT(x, s) (((x) >> (s)) | ((x) << (32-(s)))) | ||
| 56 | #else | ||
| 57 | # define ROT(x, s) (((x) << (s)) | ((x) >> (32-(s)))) | ||
| 58 | #endif | ||
| 59 | |||
| 60 | 47934 | static inline void addkey(av_aes_block *dst, const av_aes_block *src, | |
| 61 | const av_aes_block *round_key) | ||
| 62 | { | ||
| 63 | 47934 | dst->u64[0] = src->u64[0] ^ round_key->u64[0]; | |
| 64 | 47934 | dst->u64[1] = src->u64[1] ^ round_key->u64[1]; | |
| 65 | 47934 | } | |
| 66 | |||
| 67 | 5326 | static inline void addkey_s(av_aes_block *dst, const uint8_t *src, | |
| 68 | const av_aes_block *round_key) | ||
| 69 | { | ||
| 70 | 5326 | dst->u64[0] = AV_RN64(src) ^ round_key->u64[0]; | |
| 71 | 5326 | dst->u64[1] = AV_RN64(src + 8) ^ round_key->u64[1]; | |
| 72 | 5326 | } | |
| 73 | |||
| 74 | 5326 | static inline void addkey_d(uint8_t *dst, const av_aes_block *src, | |
| 75 | const av_aes_block *round_key) | ||
| 76 | { | ||
| 77 | 5326 | AV_WN64(dst, src->u64[0] ^ round_key->u64[0]); | |
| 78 | 5326 | AV_WN64(dst + 8, src->u64[1] ^ round_key->u64[1]); | |
| 79 | 5326 | } | |
| 80 | |||
| 81 | 5344 | static void subshift(av_aes_block s0[2], int s, const uint8_t *box) | |
| 82 | { | ||
| 83 | 5344 | unsigned char *s1_dst = (unsigned char*)s0[0].u8 + 3 - s; | |
| 84 | 5344 | const unsigned char *s1_src = s1_dst + sizeof(*s0); | |
| 85 | 5344 | unsigned char *s3_dst = (unsigned char*)s0[0].u8 + s + 1; | |
| 86 | 5344 | const unsigned char *s3_src = s3_dst + sizeof(*s0); | |
| 87 | |||
| 88 | 5344 | s0[0].u8[ 0] = box[s0[1].u8[ 0]]; | |
| 89 | 5344 | s0[0].u8[ 4] = box[s0[1].u8[ 4]]; | |
| 90 | 5344 | s0[0].u8[ 8] = box[s0[1].u8[ 8]]; | |
| 91 | 5344 | s0[0].u8[12] = box[s0[1].u8[12]]; | |
| 92 | 5344 | s1_dst[ 0] = box[s1_src[ 4]]; | |
| 93 | 5344 | s1_dst[ 4] = box[s1_src[ 8]]; | |
| 94 | 5344 | s1_dst[ 8] = box[s1_src[12]]; | |
| 95 | 5344 | s1_dst[12] = box[s1_src[ 0]]; | |
| 96 | 5344 | s0[0].u8[ 2] = box[s0[1].u8[10]]; | |
| 97 | 5344 | s0[0].u8[10] = box[s0[1].u8[ 2]]; | |
| 98 | 5344 | s0[0].u8[ 6] = box[s0[1].u8[14]]; | |
| 99 | 5344 | s0[0].u8[14] = box[s0[1].u8[ 6]]; | |
| 100 | 5344 | s3_dst[ 0] = box[s3_src[12]]; | |
| 101 | 5344 | s3_dst[12] = box[s3_src[ 8]]; | |
| 102 | 5344 | s3_dst[ 8] = box[s3_src[ 4]]; | |
| 103 | 5344 | s3_dst[ 4] = box[s3_src[ 0]]; | |
| 104 | 5344 | } | |
| 105 | |||
| 106 | 191808 | static inline int mix_core(uint32_t multbl[][256], int a, int b, int c, int d) | |
| 107 | { | ||
| 108 | #if CONFIG_SMALL | ||
| 109 | return multbl[0][a] ^ ROT(multbl[0][b], 8) ^ ROT(multbl[0][c], 16) ^ ROT(multbl[0][d], 24); | ||
| 110 | #else | ||
| 111 | 191808 | return multbl[0][a] ^ multbl[1][b] ^ multbl[2][c] ^ multbl[3][d]; | |
| 112 | #endif | ||
| 113 | } | ||
| 114 | |||
| 115 | 47952 | static inline void mix(av_aes_block state[2], uint32_t multbl[][256], int s1, int s3) | |
| 116 | { | ||
| 117 | 47952 | uint8_t (*src)[4] = state[1].u8x4; | |
| 118 | 47952 | state[0].u32[0] = mix_core(multbl, src[0][0], src[s1 ][1], src[2][2], src[s3 ][3]); | |
| 119 | 47952 | state[0].u32[1] = mix_core(multbl, src[1][0], src[s3 - 1][1], src[3][2], src[s1 - 1][3]); | |
| 120 | 47952 | state[0].u32[2] = mix_core(multbl, src[2][0], src[s3 ][1], src[0][2], src[s1 ][3]); | |
| 121 | 47952 | state[0].u32[3] = mix_core(multbl, src[3][0], src[s1 - 1][1], src[1][2], src[s3 - 1][3]); | |
| 122 | 47952 | } | |
| 123 | |||
| 124 | 5326 | static inline void aes_crypt(AVAES *a, int s, const uint8_t *sbox, | |
| 125 | uint32_t multbl[][256]) | ||
| 126 | { | ||
| 127 | int r; | ||
| 128 | |||
| 129 |
2/2✓ Branch 0 taken 47934 times.
✓ Branch 1 taken 5326 times.
|
53260 | for (r = a->rounds - 1; r > 0; r--) { |
| 130 | 47934 | mix(a->state, multbl, 3 - s, 1 + s); | |
| 131 | 47934 | addkey(&a->state[1], &a->state[0], &a->round_key[r]); | |
| 132 | } | ||
| 133 | |||
| 134 | 5326 | subshift(&a->state[0], s, sbox); | |
| 135 | 5326 | } | |
| 136 | |||
| 137 | 5324 | static void aes_encrypt(AVAES *a, uint8_t *dst, const uint8_t *src, | |
| 138 | int count, uint8_t *iv, int rounds) | ||
| 139 | { | ||
| 140 |
2/2✓ Branch 0 taken 5324 times.
✓ Branch 1 taken 5324 times.
|
10648 | while (count--) { |
| 141 | 5324 | addkey_s(&a->state[1], src, &a->round_key[rounds]); | |
| 142 |
1/2✗ Branch 0 not taken.
✓ Branch 1 taken 5324 times.
|
5324 | if (iv) |
| 143 | ✗ | addkey_s(&a->state[1], iv, &a->state[1]); | |
| 144 | 5324 | aes_crypt(a, 2, sbox, enc_multbl); | |
| 145 | 5324 | addkey_d(dst, &a->state[0], &a->round_key[0]); | |
| 146 |
1/2✗ Branch 0 not taken.
✓ Branch 1 taken 5324 times.
|
5324 | if (iv) |
| 147 | ✗ | memcpy(iv, dst, 16); | |
| 148 | 5324 | src += 16; | |
| 149 | 5324 | dst += 16; | |
| 150 | } | ||
| 151 | 5324 | } | |
| 152 | |||
| 153 | 2 | static void aes_decrypt(AVAES *a, uint8_t *dst, const uint8_t *src, | |
| 154 | int count, uint8_t *iv, int rounds) | ||
| 155 | { | ||
| 156 |
2/2✓ Branch 0 taken 2 times.
✓ Branch 1 taken 2 times.
|
4 | while (count--) { |
| 157 | 2 | addkey_s(&a->state[1], src, &a->round_key[rounds]); | |
| 158 | 2 | aes_crypt(a, 0, inv_sbox, dec_multbl); | |
| 159 |
1/2✗ Branch 0 not taken.
✓ Branch 1 taken 2 times.
|
2 | if (iv) { |
| 160 | ✗ | addkey_s(&a->state[0], iv, &a->state[0]); | |
| 161 | ✗ | memcpy(iv, src, 16); | |
| 162 | } | ||
| 163 | 2 | addkey_d(dst, &a->state[0], &a->round_key[0]); | |
| 164 | 2 | src += 16; | |
| 165 | 2 | dst += 16; | |
| 166 | } | ||
| 167 | 2 | } | |
| 168 | |||
| 169 | 5326 | void av_aes_crypt(AVAES *a, uint8_t *dst, const uint8_t *src, | |
| 170 | int count, uint8_t *iv, int decrypt) | ||
| 171 | { | ||
| 172 | 5326 | a->crypt(a, dst, src, count, iv, a->rounds); | |
| 173 | 5326 | } | |
| 174 | |||
| 175 | 12 | static void init_multbl2(uint32_t tbl[][256], const int c[4], | |
| 176 | const uint8_t *log8, const uint8_t *alog8, | ||
| 177 | const uint8_t *sbox) | ||
| 178 | { | ||
| 179 | int i; | ||
| 180 | |||
| 181 |
2/2✓ Branch 0 taken 3072 times.
✓ Branch 1 taken 12 times.
|
3084 | for (i = 0; i < 256; i++) { |
| 182 | 3072 | int x = sbox[i]; | |
| 183 |
2/2✓ Branch 0 taken 3060 times.
✓ Branch 1 taken 12 times.
|
3072 | if (x) { |
| 184 | int k, l, m, n; | ||
| 185 | 3060 | x = log8[x]; | |
| 186 | 3060 | k = alog8[x + log8[c[0]]]; | |
| 187 | 3060 | l = alog8[x + log8[c[1]]]; | |
| 188 | 3060 | m = alog8[x + log8[c[2]]]; | |
| 189 | 3060 | n = alog8[x + log8[c[3]]]; | |
| 190 | 3060 | tbl[0][i] = AV_NE(MKBETAG(k, l, m, n), MKTAG(k, l, m, n)); | |
| 191 | #if !CONFIG_SMALL | ||
| 192 | 3060 | tbl[1][i] = ROT(tbl[0][i], 8); | |
| 193 | 3060 | tbl[2][i] = ROT(tbl[0][i], 16); | |
| 194 | 3060 | tbl[3][i] = ROT(tbl[0][i], 24); | |
| 195 | #endif | ||
| 196 | } | ||
| 197 | } | ||
| 198 | 12 | } | |
| 199 | |||
| 200 | // this is based on the reference AES code by Paulo Barreto and Vincent Rijmen | ||
| 201 | 40 | int av_aes_init(AVAES *a, const uint8_t *key, int key_bits, int decrypt) | |
| 202 | { | ||
| 203 | 40 | int i, j, t, rconpointer = 0; | |
| 204 | uint8_t tk[8][4]; | ||
| 205 | 40 | int KC = key_bits >> 5; | |
| 206 | 40 | int rounds = KC + 6; | |
| 207 | uint8_t log8[256]; | ||
| 208 | uint8_t alog8[512]; | ||
| 209 | |||
| 210 |
2/2✓ Branch 0 taken 2 times.
✓ Branch 1 taken 38 times.
|
40 | a->crypt = decrypt ? aes_decrypt : aes_encrypt; |
| 211 | |||
| 212 |
2/2✓ Branch 0 taken 6 times.
✓ Branch 1 taken 34 times.
|
40 | if (!enc_multbl[FF_ARRAY_ELEMS(enc_multbl) - 1][FF_ARRAY_ELEMS(enc_multbl[0]) - 1]) { |
| 213 | 6 | j = 1; | |
| 214 |
2/2✓ Branch 0 taken 1530 times.
✓ Branch 1 taken 6 times.
|
1536 | for (i = 0; i < 255; i++) { |
| 215 | 1530 | alog8[i] = alog8[i + 255] = j; | |
| 216 | 1530 | log8[j] = i; | |
| 217 | 1530 | j ^= j + j; | |
| 218 |
2/2✓ Branch 0 taken 768 times.
✓ Branch 1 taken 762 times.
|
1530 | if (j > 255) |
| 219 | 768 | j ^= 0x11B; | |
| 220 | } | ||
| 221 |
2/2✓ Branch 0 taken 1536 times.
✓ Branch 1 taken 6 times.
|
1542 | for (i = 0; i < 256; i++) { |
| 222 |
2/2✓ Branch 0 taken 1530 times.
✓ Branch 1 taken 6 times.
|
1536 | j = i ? alog8[255 - log8[i]] : 0; |
| 223 | 1536 | j ^= (j << 1) ^ (j << 2) ^ (j << 3) ^ (j << 4); | |
| 224 | 1536 | j = (j ^ (j >> 8) ^ 99) & 255; | |
| 225 | 1536 | inv_sbox[j] = i; | |
| 226 | 1536 | sbox[i] = j; | |
| 227 | } | ||
| 228 | 6 | init_multbl2(dec_multbl, (const int[4]) { 0xe, 0x9, 0xd, 0xb }, | |
| 229 | log8, alog8, inv_sbox); | ||
| 230 | 6 | init_multbl2(enc_multbl, (const int[4]) { 0x2, 0x1, 0x1, 0x3 }, | |
| 231 | log8, alog8, sbox); | ||
| 232 | } | ||
| 233 | |||
| 234 |
1/6✗ Branch 0 not taken.
✓ Branch 1 taken 40 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
✗ Branch 4 not taken.
✗ Branch 5 not taken.
|
40 | if (key_bits != 128 && key_bits != 192 && key_bits != 256) |
| 235 | ✗ | return AVERROR(EINVAL); | |
| 236 | |||
| 237 | 40 | a->rounds = rounds; | |
| 238 | |||
| 239 | 40 | memcpy(tk, key, KC * 4); | |
| 240 | 40 | memcpy(a->round_key[0].u8, key, KC * 4); | |
| 241 | |||
| 242 |
2/2✓ Branch 0 taken 400 times.
✓ Branch 1 taken 40 times.
|
440 | for (t = KC * 4; t < (rounds + 1) * 16; t += KC * 4) { |
| 243 |
2/2✓ Branch 0 taken 1600 times.
✓ Branch 1 taken 400 times.
|
2000 | for (i = 0; i < 4; i++) |
| 244 | 1600 | tk[0][i] ^= sbox[tk[KC - 1][(i + 1) & 3]]; | |
| 245 | 400 | tk[0][0] ^= rcon[rconpointer++]; | |
| 246 | |||
| 247 |
2/2✓ Branch 0 taken 1200 times.
✓ Branch 1 taken 400 times.
|
1600 | for (j = 1; j < KC; j++) { |
| 248 |
1/4✗ Branch 0 not taken.
✓ Branch 1 taken 1200 times.
✗ Branch 2 not taken.
✗ Branch 3 not taken.
|
1200 | if (KC != 8 || j != KC >> 1) |
| 249 |
2/2✓ Branch 0 taken 4800 times.
✓ Branch 1 taken 1200 times.
|
6000 | for (i = 0; i < 4; i++) |
| 250 | 4800 | tk[j][i] ^= tk[j - 1][i]; | |
| 251 | else | ||
| 252 | ✗ | for (i = 0; i < 4; i++) | |
| 253 | ✗ | tk[j][i] ^= sbox[tk[j - 1][i]]; | |
| 254 | } | ||
| 255 | |||
| 256 | 400 | memcpy((unsigned char*)a->round_key + t, tk, KC * 4); | |
| 257 | } | ||
| 258 | |||
| 259 |
2/2✓ Branch 0 taken 2 times.
✓ Branch 1 taken 38 times.
|
40 | if (decrypt) { |
| 260 |
2/2✓ Branch 0 taken 18 times.
✓ Branch 1 taken 2 times.
|
20 | for (i = 1; i < rounds; i++) { |
| 261 | av_aes_block tmp[3]; | ||
| 262 | 18 | tmp[2] = a->round_key[i]; | |
| 263 | 18 | subshift(&tmp[1], 0, sbox); | |
| 264 | 18 | mix(tmp, dec_multbl, 1, 3); | |
| 265 | 18 | a->round_key[i] = tmp[0]; | |
| 266 | } | ||
| 267 | } else { | ||
| 268 |
2/2✓ Branch 0 taken 190 times.
✓ Branch 1 taken 38 times.
|
228 | for (i = 0; i < (rounds + 1) >> 1; i++) |
| 269 | 190 | FFSWAP(av_aes_block, a->round_key[i], a->round_key[rounds - i]); | |
| 270 | } | ||
| 271 | |||
| 272 | 40 | return 0; | |
| 273 | } | ||
| 274 | |||
| 275 |