Botan  2.6.0
Crypto and TLS for C++11
aes.cpp
Go to the documentation of this file.
1 /*
2 * AES
3 * (C) 1999-2010,2015,2017 Jack Lloyd
4 *
5 * Based on the public domain reference implementation by Paulo Baretto
6 *
7 * Botan is released under the Simplified BSD License (see license.txt)
8 */
9 
10 #include <botan/aes.h>
11 #include <botan/loadstor.h>
12 #include <botan/cpuid.h>
13 #include <type_traits>
14 
15 /*
16 * This implementation is based on table lookups which are known to be
17 * vulnerable to timing and cache based side channel attacks. Some
18 * countermeasures are used which may be helpful in some situations:
19 *
20 * - Only a single 256-word T-table is used, with rotations applied.
21 * Most implementations use 4 T-tables which leaks much more
22 * information via cache usage.
23 *
24 * - The TE and TD tables are computed at runtime to avoid flush+reload
25 * attacks using clflush. As different processes will not share the
26 * same underlying table data, an attacker can't manipulate another
27 * processes cache lines via their shared reference to the library
28 * read only segment.
29 *
30 * - Each cache line of the lookup tables is accessed at the beginning
31 * of each call to encrypt or decrypt. (See the Z variable below)
32 *
33 * If available SSSE3 or AES-NI are used instead of this version, as both
34 * are faster and immune to side channel attacks.
35 *
36 * Some AES cache timing papers for reference:
37 *
38 * "Software mitigations to hedge AES against cache-based software side
39 * channel vulnerabilities" https://eprint.iacr.org/2006/052.pdf
40 *
41 * "Cache Games - Bringing Access-Based Cache Attacks on AES to Practice"
42 * http://www.ieee-security.org/TC/SP2011/PAPERS/2011/paper031.pdf
43 *
44 * "Cache-Collision Timing Attacks Against AES" Bonneau, Mironov
45 * http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.88.4753
46 */
47 
48 namespace Botan {
49 
50 namespace {
51 
52 BOTAN_ALIGNAS(64)
53 const uint8_t SE[256] = {
54  0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B,
55  0xFE, 0xD7, 0xAB, 0x76, 0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0,
56  0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0, 0xB7, 0xFD, 0x93, 0x26,
57  0x36, 0x3F, 0xF7, 0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,
58  0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2,
59  0xEB, 0x27, 0xB2, 0x75, 0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0,
60  0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84, 0x53, 0xD1, 0x00, 0xED,
61  0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,
62  0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 0x45, 0xF9, 0x02, 0x7F,
63  0x50, 0x3C, 0x9F, 0xA8, 0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5,
64  0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2, 0xCD, 0x0C, 0x13, 0xEC,
65  0x5F, 0x97, 0x44, 0x17, 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73,
66  0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 0x46, 0xEE, 0xB8, 0x14,
67  0xDE, 0x5E, 0x0B, 0xDB, 0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C,
68  0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79, 0xE7, 0xC8, 0x37, 0x6D,
69  0x8D, 0xD5, 0x4E, 0xA9, 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08,
70  0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 0xE8, 0xDD, 0x74, 0x1F,
71  0x4B, 0xBD, 0x8B, 0x8A, 0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E,
72  0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E, 0xE1, 0xF8, 0x98, 0x11,
73  0x69, 0xD9, 0x8E, 0x94, 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,
74  0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 0x41, 0x99, 0x2D, 0x0F,
75  0xB0, 0x54, 0xBB, 0x16 };
76 
77 BOTAN_ALIGNAS(64)
78 const uint8_t SD[256] = {
79  0x52, 0x09, 0x6A, 0xD5, 0x30, 0x36, 0xA5, 0x38, 0xBF, 0x40, 0xA3, 0x9E,
80  0x81, 0xF3, 0xD7, 0xFB, 0x7C, 0xE3, 0x39, 0x82, 0x9B, 0x2F, 0xFF, 0x87,
81  0x34, 0x8E, 0x43, 0x44, 0xC4, 0xDE, 0xE9, 0xCB, 0x54, 0x7B, 0x94, 0x32,
82  0xA6, 0xC2, 0x23, 0x3D, 0xEE, 0x4C, 0x95, 0x0B, 0x42, 0xFA, 0xC3, 0x4E,
83  0x08, 0x2E, 0xA1, 0x66, 0x28, 0xD9, 0x24, 0xB2, 0x76, 0x5B, 0xA2, 0x49,
84  0x6D, 0x8B, 0xD1, 0x25, 0x72, 0xF8, 0xF6, 0x64, 0x86, 0x68, 0x98, 0x16,
85  0xD4, 0xA4, 0x5C, 0xCC, 0x5D, 0x65, 0xB6, 0x92, 0x6C, 0x70, 0x48, 0x50,
86  0xFD, 0xED, 0xB9, 0xDA, 0x5E, 0x15, 0x46, 0x57, 0xA7, 0x8D, 0x9D, 0x84,
87  0x90, 0xD8, 0xAB, 0x00, 0x8C, 0xBC, 0xD3, 0x0A, 0xF7, 0xE4, 0x58, 0x05,
88  0xB8, 0xB3, 0x45, 0x06, 0xD0, 0x2C, 0x1E, 0x8F, 0xCA, 0x3F, 0x0F, 0x02,
89  0xC1, 0xAF, 0xBD, 0x03, 0x01, 0x13, 0x8A, 0x6B, 0x3A, 0x91, 0x11, 0x41,
90  0x4F, 0x67, 0xDC, 0xEA, 0x97, 0xF2, 0xCF, 0xCE, 0xF0, 0xB4, 0xE6, 0x73,
91  0x96, 0xAC, 0x74, 0x22, 0xE7, 0xAD, 0x35, 0x85, 0xE2, 0xF9, 0x37, 0xE8,
92  0x1C, 0x75, 0xDF, 0x6E, 0x47, 0xF1, 0x1A, 0x71, 0x1D, 0x29, 0xC5, 0x89,
93  0x6F, 0xB7, 0x62, 0x0E, 0xAA, 0x18, 0xBE, 0x1B, 0xFC, 0x56, 0x3E, 0x4B,
94  0xC6, 0xD2, 0x79, 0x20, 0x9A, 0xDB, 0xC0, 0xFE, 0x78, 0xCD, 0x5A, 0xF4,
95  0x1F, 0xDD, 0xA8, 0x33, 0x88, 0x07, 0xC7, 0x31, 0xB1, 0x12, 0x10, 0x59,
96  0x27, 0x80, 0xEC, 0x5F, 0x60, 0x51, 0x7F, 0xA9, 0x19, 0xB5, 0x4A, 0x0D,
97  0x2D, 0xE5, 0x7A, 0x9F, 0x93, 0xC9, 0x9C, 0xEF, 0xA0, 0xE0, 0x3B, 0x4D,
98  0xAE, 0x2A, 0xF5, 0xB0, 0xC8, 0xEB, 0xBB, 0x3C, 0x83, 0x53, 0x99, 0x61,
99  0x17, 0x2B, 0x04, 0x7E, 0xBA, 0x77, 0xD6, 0x26, 0xE1, 0x69, 0x14, 0x63,
100  0x55, 0x21, 0x0C, 0x7D };
101 
102 inline uint8_t xtime(uint8_t s) { return static_cast<uint8_t>(s << 1) ^ ((s >> 7) * 0x1B); }
103 inline uint8_t xtime4(uint8_t s) { return xtime(xtime(s)); }
104 inline uint8_t xtime8(uint8_t s) { return xtime(xtime(xtime(s))); }
105 
106 inline uint8_t xtime3(uint8_t s) { return xtime(s) ^ s; }
107 inline uint8_t xtime9(uint8_t s) { return xtime8(s) ^ s; }
108 inline uint8_t xtime11(uint8_t s) { return xtime8(s) ^ xtime(s) ^ s; }
109 inline uint8_t xtime13(uint8_t s) { return xtime8(s) ^ xtime4(s) ^ s; }
110 inline uint8_t xtime14(uint8_t s) { return xtime8(s) ^ xtime4(s) ^ xtime(s); }
111 
112 inline uint32_t SE_word(uint32_t x)
113  {
114  return make_uint32(SE[get_byte(0, x)],
115  SE[get_byte(1, x)],
116  SE[get_byte(2, x)],
117  SE[get_byte(3, x)]);
118  }
119 
120 const uint32_t* AES_TE()
121  {
122  class TE_Table final
123  {
124  public:
125  TE_Table()
126  {
127  uint32_t* p = reinterpret_cast<uint32_t*>(&data);
128  for(size_t i = 0; i != 256; ++i)
129  {
130  const uint8_t s = SE[i];
131  p[i] = make_uint32(xtime(s), s, s, xtime3(s));
132  }
133  }
134 
135  const uint32_t* ptr() const
136  {
137  return reinterpret_cast<const uint32_t*>(&data);
138  }
139  private:
141  };
142 
143  static TE_Table table;
144  return table.ptr();
145  }
146 
147 const uint32_t* AES_TD()
148  {
149  class TD_Table final
150  {
151  public:
152  TD_Table()
153  {
154  uint32_t* p = reinterpret_cast<uint32_t*>(&data);
155  for(size_t i = 0; i != 256; ++i)
156  {
157  const uint8_t s = SD[i];
158  p[i] = make_uint32(xtime14(s), xtime9(s), xtime13(s), xtime11(s));
159  }
160  }
161 
162  const uint32_t* ptr() const
163  {
164  return reinterpret_cast<const uint32_t*>(&data);
165  }
166  private:
168  };
169 
170  static TD_Table table;
171  return table.ptr();
172  }
173 
174 #define AES_T(T, K, V0, V1, V2, V3) \
175  (K ^ T[get_byte(0, V0)] ^ \
176  rotr< 8>(T[get_byte(1, V1)]) ^ \
177  rotr<16>(T[get_byte(2, V2)]) ^ \
178  rotr<24>(T[get_byte(3, V3)]))
179 
180 /*
181 * AES Encryption
182 */
183 void aes_encrypt_n(const uint8_t in[], uint8_t out[],
184  size_t blocks,
185  const secure_vector<uint32_t>& EK,
186  const secure_vector<uint8_t>& ME)
187  {
188  BOTAN_ASSERT(EK.size() && ME.size() == 16, "Key was set");
189 
190  const size_t cache_line_size = CPUID::cache_line_size();
191 
192  const uint32_t* TE = AES_TE();
193 
194  // Hit every cache line of TE
195  volatile uint32_t Z = 0;
196  for(size_t i = 0; i < 256; i += cache_line_size / sizeof(uint32_t))
197  {
198  Z |= TE[i];
199  }
200  Z &= TE[82]; // this is zero, which hopefully the compiler cannot deduce
201 
202  for(size_t i = 0; i < blocks; ++i)
203  {
204  uint32_t T0, T1, T2, T3;
205  load_be(in + 16*i, T0, T1, T2, T3);
206 
207  T0 ^= EK[0];
208  T1 ^= EK[1];
209  T2 ^= EK[2];
210  T3 ^= EK[3];
211 
212  T0 ^= Z;
213 
214  uint32_t B0 = AES_T(TE, EK[4], T0, T1, T2, T3);
215  uint32_t B1 = AES_T(TE, EK[5], T1, T2, T3, T0);
216  uint32_t B2 = AES_T(TE, EK[6], T2, T3, T0, T1);
217  uint32_t B3 = AES_T(TE, EK[7], T3, T0, T1, T2);
218 
219  for(size_t r = 2*4; r < EK.size(); r += 2*4)
220  {
221  T0 = AES_T(TE, EK[r ], B0, B1, B2, B3);
222  T1 = AES_T(TE, EK[r+1], B1, B2, B3, B0);
223  T2 = AES_T(TE, EK[r+2], B2, B3, B0, B1);
224  T3 = AES_T(TE, EK[r+3], B3, B0, B1, B2);
225 
226  B0 = AES_T(TE, EK[r+4], T0, T1, T2, T3);
227  B1 = AES_T(TE, EK[r+5], T1, T2, T3, T0);
228  B2 = AES_T(TE, EK[r+6], T2, T3, T0, T1);
229  B3 = AES_T(TE, EK[r+7], T3, T0, T1, T2);
230  }
231 
232  /*
233  * Use TE[x] >> 8 instead of SE[] so encryption only references a single
234  * lookup table.
235  */
236  out[16*i+ 0] = static_cast<uint8_t>(TE[get_byte(0, B0)] >> 8) ^ ME[0];
237  out[16*i+ 1] = static_cast<uint8_t>(TE[get_byte(1, B1)] >> 8) ^ ME[1];
238  out[16*i+ 2] = static_cast<uint8_t>(TE[get_byte(2, B2)] >> 8) ^ ME[2];
239  out[16*i+ 3] = static_cast<uint8_t>(TE[get_byte(3, B3)] >> 8) ^ ME[3];
240  out[16*i+ 4] = static_cast<uint8_t>(TE[get_byte(0, B1)] >> 8) ^ ME[4];
241  out[16*i+ 5] = static_cast<uint8_t>(TE[get_byte(1, B2)] >> 8) ^ ME[5];
242  out[16*i+ 6] = static_cast<uint8_t>(TE[get_byte(2, B3)] >> 8) ^ ME[6];
243  out[16*i+ 7] = static_cast<uint8_t>(TE[get_byte(3, B0)] >> 8) ^ ME[7];
244  out[16*i+ 8] = static_cast<uint8_t>(TE[get_byte(0, B2)] >> 8) ^ ME[8];
245  out[16*i+ 9] = static_cast<uint8_t>(TE[get_byte(1, B3)] >> 8) ^ ME[9];
246  out[16*i+10] = static_cast<uint8_t>(TE[get_byte(2, B0)] >> 8) ^ ME[10];
247  out[16*i+11] = static_cast<uint8_t>(TE[get_byte(3, B1)] >> 8) ^ ME[11];
248  out[16*i+12] = static_cast<uint8_t>(TE[get_byte(0, B3)] >> 8) ^ ME[12];
249  out[16*i+13] = static_cast<uint8_t>(TE[get_byte(1, B0)] >> 8) ^ ME[13];
250  out[16*i+14] = static_cast<uint8_t>(TE[get_byte(2, B1)] >> 8) ^ ME[14];
251  out[16*i+15] = static_cast<uint8_t>(TE[get_byte(3, B2)] >> 8) ^ ME[15];
252  }
253  }
254 
255 /*
256 * AES Decryption
257 */
258 void aes_decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks,
259  const secure_vector<uint32_t>& DK,
260  const secure_vector<uint8_t>& MD)
261  {
262  BOTAN_ASSERT(DK.size() && MD.size() == 16, "Key was set");
263 
264  const size_t cache_line_size = CPUID::cache_line_size();
265  const uint32_t* TD = AES_TD();
266 
267  volatile uint32_t Z = 0;
268  for(size_t i = 0; i < 256; i += cache_line_size / sizeof(uint32_t))
269  {
270  Z |= TD[i];
271  }
272  Z &= TD[99]; // this is zero, which hopefully the compiler cannot deduce
273 
274  for(size_t i = 0; i != blocks; ++i)
275  {
276  uint32_t T0 = load_be<uint32_t>(in, 0) ^ DK[0];
277  uint32_t T1 = load_be<uint32_t>(in, 1) ^ DK[1];
278  uint32_t T2 = load_be<uint32_t>(in, 2) ^ DK[2];
279  uint32_t T3 = load_be<uint32_t>(in, 3) ^ DK[3];
280 
281  T0 ^= Z;
282 
283  uint32_t B0 = AES_T(TD, DK[4], T0, T3, T2, T1);
284  uint32_t B1 = AES_T(TD, DK[5], T1, T0, T3, T2);
285  uint32_t B2 = AES_T(TD, DK[6], T2, T1, T0, T3);
286  uint32_t B3 = AES_T(TD, DK[7], T3, T2, T1, T0);
287 
288  for(size_t r = 2*4; r < DK.size(); r += 2*4)
289  {
290  T0 = AES_T(TD, DK[r ], B0, B3, B2, B1);
291  T1 = AES_T(TD, DK[r+1], B1, B0, B3, B2);
292  T2 = AES_T(TD, DK[r+2], B2, B1, B0, B3);
293  T3 = AES_T(TD, DK[r+3], B3, B2, B1, B0);
294 
295  B0 = AES_T(TD, DK[r+4], T0, T3, T2, T1);
296  B1 = AES_T(TD, DK[r+5], T1, T0, T3, T2);
297  B2 = AES_T(TD, DK[r+6], T2, T1, T0, T3);
298  B3 = AES_T(TD, DK[r+7], T3, T2, T1, T0);
299  }
300 
301  out[ 0] = SD[get_byte(0, B0)] ^ MD[0];
302  out[ 1] = SD[get_byte(1, B3)] ^ MD[1];
303  out[ 2] = SD[get_byte(2, B2)] ^ MD[2];
304  out[ 3] = SD[get_byte(3, B1)] ^ MD[3];
305  out[ 4] = SD[get_byte(0, B1)] ^ MD[4];
306  out[ 5] = SD[get_byte(1, B0)] ^ MD[5];
307  out[ 6] = SD[get_byte(2, B3)] ^ MD[6];
308  out[ 7] = SD[get_byte(3, B2)] ^ MD[7];
309  out[ 8] = SD[get_byte(0, B2)] ^ MD[8];
310  out[ 9] = SD[get_byte(1, B1)] ^ MD[9];
311  out[10] = SD[get_byte(2, B0)] ^ MD[10];
312  out[11] = SD[get_byte(3, B3)] ^ MD[11];
313  out[12] = SD[get_byte(0, B3)] ^ MD[12];
314  out[13] = SD[get_byte(1, B2)] ^ MD[13];
315  out[14] = SD[get_byte(2, B1)] ^ MD[14];
316  out[15] = SD[get_byte(3, B0)] ^ MD[15];
317 
318  in += 16;
319  out += 16;
320  }
321  }
322 
323 void aes_key_schedule(const uint8_t key[], size_t length,
324  secure_vector<uint32_t>& EK,
325  secure_vector<uint32_t>& DK,
326  secure_vector<uint8_t>& ME,
327  secure_vector<uint8_t>& MD)
328  {
329  static const uint32_t RC[10] = {
330  0x01000000, 0x02000000, 0x04000000, 0x08000000, 0x10000000,
331  0x20000000, 0x40000000, 0x80000000, 0x1B000000, 0x36000000 };
332 
333  const size_t rounds = (length / 4) + 6;
334 
335  secure_vector<uint32_t> XEK(length + 32), XDK(length + 32);
336 
337  const size_t X = length / 4;
338 
339  // Can't happen, but make static analyzers happy
340  if(X != 4 && X != 6 && X != 8)
341  throw Invalid_Argument("Invalid AES key size");
342 
343  for(size_t i = 0; i != X; ++i)
344  XEK[i] = load_be<uint32_t>(key, i);
345 
346  for(size_t i = X; i < 4*(rounds+1); i += X)
347  {
348  XEK[i] = XEK[i-X] ^ RC[(i-X)/X] ^ SE_word(rotl<8>(XEK[i-1]));
349 
350  for(size_t j = 1; j != X; ++j)
351  {
352  XEK[i+j] = XEK[i+j-X];
353 
354  if(X == 8 && j == 4)
355  XEK[i+j] ^= SE_word(XEK[i+j-1]);
356  else
357  XEK[i+j] ^= XEK[i+j-1];
358  }
359  }
360 
361  for(size_t i = 0; i != 4*(rounds+1); i += 4)
362  {
363  XDK[i ] = XEK[4*rounds-i ];
364  XDK[i+1] = XEK[4*rounds-i+1];
365  XDK[i+2] = XEK[4*rounds-i+2];
366  XDK[i+3] = XEK[4*rounds-i+3];
367  }
368 
369  for(size_t i = 4; i != length + 24; ++i)
370  {
371  XDK[i] = SE_word(XDK[i]);
372  XDK[i] = AES_T(AES_TD(), 0, XDK[i], XDK[i], XDK[i], XDK[i]);
373  }
374 
375  ME.resize(16);
376  MD.resize(16);
377 
378  for(size_t i = 0; i != 4; ++i)
379  {
380  store_be(XEK[i+4*rounds], &ME[4*i]);
381  store_be(XEK[i], &MD[4*i]);
382  }
383 
384  EK.resize(length + 24);
385  DK.resize(length + 24);
386  copy_mem(EK.data(), XEK.data(), EK.size());
387  copy_mem(DK.data(), XDK.data(), DK.size());
388 
389 #if defined(BOTAN_HAS_AES_ARMV8)
390  if(CPUID::has_arm_aes())
391  {
392  // ARM needs the subkeys to be byte reversed
393 
394  for(size_t i = 0; i != EK.size(); ++i)
395  EK[i] = reverse_bytes(EK[i]);
396  for(size_t i = 0; i != DK.size(); ++i)
397  DK[i] = reverse_bytes(DK[i]);
398  }
399 #endif
400 
401  }
402 
403 #undef AES_T
404 
405 size_t aes_parallelism()
406  {
407 #if defined(BOTAN_HAS_AES_NI)
408  if(CPUID::has_aes_ni())
409  {
410  return 4;
411  }
412 #endif
413 
414  return 1;
415  }
416 
417 const char* aes_provider()
418  {
419 #if defined(BOTAN_HAS_AES_NI)
420  if(CPUID::has_aes_ni())
421  {
422  return "aesni";
423  }
424 #endif
425 
426 #if defined(BOTAN_HAS_AES_SSSE3)
427  if(CPUID::has_ssse3())
428  {
429  return "ssse3";
430  }
431 #endif
432 
433 #if defined(BOTAN_HAS_AES_POWER8)
434  if(CPUID::has_ppc_crypto())
435  {
436  return "power8";
437  }
438 #endif
439 
440 #if defined(BOTAN_HAS_AES_ARMV8)
441  if(CPUID::has_arm_aes())
442  {
443  return "armv8";
444  }
445 #endif
446 
447  return "base";
448  }
449 
450 }
451 
452 std::string AES_128::provider() const { return aes_provider(); }
453 std::string AES_192::provider() const { return aes_provider(); }
454 std::string AES_256::provider() const { return aes_provider(); }
455 
456 size_t AES_128::parallelism() const { return aes_parallelism(); }
457 size_t AES_192::parallelism() const { return aes_parallelism(); }
458 size_t AES_256::parallelism() const { return aes_parallelism(); }
459 
460 void AES_128::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
461  {
462  verify_key_set(m_EK.empty() == false);
463 
464 #if defined(BOTAN_HAS_AES_NI)
465  if(CPUID::has_aes_ni())
466  {
467  return aesni_encrypt_n(in, out, blocks);
468  }
469 #endif
470 
471 #if defined(BOTAN_HAS_AES_SSSE3)
472  if(CPUID::has_ssse3())
473  {
474  return ssse3_encrypt_n(in, out, blocks);
475  }
476 #endif
477 
478 #if defined(BOTAN_HAS_AES_ARMV8)
479  if(CPUID::has_arm_aes())
480  {
481  return armv8_encrypt_n(in, out, blocks);
482  }
483 #endif
484 
485 #if defined(BOTAN_HAS_AES_POWER8)
486  if(CPUID::has_ppc_crypto())
487  {
488  return power8_encrypt_n(in, out, blocks);
489  }
490 #endif
491 
492  aes_encrypt_n(in, out, blocks, m_EK, m_ME);
493  }
494 
495 void AES_128::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
496  {
497  verify_key_set(m_DK.empty() == false);
498 
499 #if defined(BOTAN_HAS_AES_NI)
500  if(CPUID::has_aes_ni())
501  {
502  return aesni_decrypt_n(in, out, blocks);
503  }
504 #endif
505 
506 #if defined(BOTAN_HAS_AES_SSSE3)
507  if(CPUID::has_ssse3())
508  {
509  return ssse3_decrypt_n(in, out, blocks);
510  }
511 #endif
512 
513 #if defined(BOTAN_HAS_AES_ARMV8)
514  if(CPUID::has_arm_aes())
515  {
516  return armv8_decrypt_n(in, out, blocks);
517  }
518 #endif
519 
520 #if defined(BOTAN_HAS_AES_POWER8)
521  if(CPUID::has_ppc_crypto())
522  {
523  return power8_decrypt_n(in, out, blocks);
524  }
525 #endif
526 
527  aes_decrypt_n(in, out, blocks, m_DK, m_MD);
528  }
529 
530 void AES_128::key_schedule(const uint8_t key[], size_t length)
531  {
532 #if defined(BOTAN_HAS_AES_NI)
533  if(CPUID::has_aes_ni())
534  {
535  return aesni_key_schedule(key, length);
536  }
537 #endif
538 
539 #if defined(BOTAN_HAS_AES_SSSE3)
540  if(CPUID::has_ssse3())
541  {
542  return ssse3_key_schedule(key, length);
543  }
544 #endif
545 
546  aes_key_schedule(key, length, m_EK, m_DK, m_ME, m_MD);
547  }
548 
550  {
551  zap(m_EK);
552  zap(m_DK);
553  zap(m_ME);
554  zap(m_MD);
555  }
556 
557 void AES_192::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
558  {
559  verify_key_set(m_EK.empty() == false);
560 
561 #if defined(BOTAN_HAS_AES_NI)
562  if(CPUID::has_aes_ni())
563  {
564  return aesni_encrypt_n(in, out, blocks);
565  }
566 #endif
567 
568 #if defined(BOTAN_HAS_AES_SSSE3)
569  if(CPUID::has_ssse3())
570  {
571  return ssse3_encrypt_n(in, out, blocks);
572  }
573 #endif
574 
575 #if defined(BOTAN_HAS_AES_ARMV8)
576  if(CPUID::has_arm_aes())
577  {
578  return armv8_encrypt_n(in, out, blocks);
579  }
580 #endif
581 
582 #if defined(BOTAN_HAS_AES_POWER8)
583  if(CPUID::has_ppc_crypto())
584  {
585  return power8_encrypt_n(in, out, blocks);
586  }
587 #endif
588 
589  aes_encrypt_n(in, out, blocks, m_EK, m_ME);
590  }
591 
592 void AES_192::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
593  {
594  verify_key_set(m_DK.empty() == false);
595 
596 #if defined(BOTAN_HAS_AES_NI)
597  if(CPUID::has_aes_ni())
598  {
599  return aesni_decrypt_n(in, out, blocks);
600  }
601 #endif
602 
603 #if defined(BOTAN_HAS_AES_SSSE3)
604  if(CPUID::has_ssse3())
605  {
606  return ssse3_decrypt_n(in, out, blocks);
607  }
608 #endif
609 
610 #if defined(BOTAN_HAS_AES_ARMV8)
611  if(CPUID::has_arm_aes())
612  {
613  return armv8_decrypt_n(in, out, blocks);
614  }
615 #endif
616 
617 #if defined(BOTAN_HAS_AES_POWER8)
618  if(CPUID::has_ppc_crypto())
619  {
620  return power8_decrypt_n(in, out, blocks);
621  }
622 #endif
623 
624  aes_decrypt_n(in, out, blocks, m_DK, m_MD);
625  }
626 
627 void AES_192::key_schedule(const uint8_t key[], size_t length)
628  {
629 #if defined(BOTAN_HAS_AES_NI)
630  if(CPUID::has_aes_ni())
631  {
632  return aesni_key_schedule(key, length);
633  }
634 #endif
635 
636 #if defined(BOTAN_HAS_AES_SSSE3)
637  if(CPUID::has_ssse3())
638  {
639  return ssse3_key_schedule(key, length);
640  }
641 #endif
642 
643  aes_key_schedule(key, length, m_EK, m_DK, m_ME, m_MD);
644  }
645 
647  {
648  zap(m_EK);
649  zap(m_DK);
650  zap(m_ME);
651  zap(m_MD);
652  }
653 
654 void AES_256::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
655  {
656  verify_key_set(m_EK.empty() == false);
657 
658 #if defined(BOTAN_HAS_AES_NI)
659  if(CPUID::has_aes_ni())
660  {
661  return aesni_encrypt_n(in, out, blocks);
662  }
663 #endif
664 
665 #if defined(BOTAN_HAS_AES_SSSE3)
666  if(CPUID::has_ssse3())
667  {
668  return ssse3_encrypt_n(in, out, blocks);
669  }
670 #endif
671 
672 #if defined(BOTAN_HAS_AES_ARMV8)
673  if(CPUID::has_arm_aes())
674  {
675  return armv8_encrypt_n(in, out, blocks);
676  }
677 #endif
678 
679 #if defined(BOTAN_HAS_AES_POWER8)
680  if(CPUID::has_ppc_crypto())
681  {
682  return power8_encrypt_n(in, out, blocks);
683  }
684 #endif
685 
686  aes_encrypt_n(in, out, blocks, m_EK, m_ME);
687  }
688 
689 void AES_256::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const
690  {
691  verify_key_set(m_DK.empty() == false);
692 
693 #if defined(BOTAN_HAS_AES_NI)
694  if(CPUID::has_aes_ni())
695  {
696  return aesni_decrypt_n(in, out, blocks);
697  }
698 #endif
699 
700 #if defined(BOTAN_HAS_AES_SSSE3)
701  if(CPUID::has_ssse3())
702  {
703  return ssse3_decrypt_n(in, out, blocks);
704  }
705 #endif
706 
707 #if defined(BOTAN_HAS_AES_ARMV8)
708  if(CPUID::has_arm_aes())
709  {
710  return armv8_decrypt_n(in, out, blocks);
711  }
712 #endif
713 
714 #if defined(BOTAN_HAS_AES_POWER8)
715  if(CPUID::has_ppc_crypto())
716  {
717  return power8_decrypt_n(in, out, blocks);
718  }
719 #endif
720 
721  aes_decrypt_n(in, out, blocks, m_DK, m_MD);
722  }
723 
724 void AES_256::key_schedule(const uint8_t key[], size_t length)
725  {
726 #if defined(BOTAN_HAS_AES_NI)
727  if(CPUID::has_aes_ni())
728  {
729  return aesni_key_schedule(key, length);
730  }
731 #endif
732 
733 #if defined(BOTAN_HAS_AES_SSSE3)
734  if(CPUID::has_ssse3())
735  {
736  return ssse3_key_schedule(key, length);
737  }
738 #endif
739 
740  aes_key_schedule(key, length, m_EK, m_DK, m_ME, m_MD);
741  }
742 
744  {
745  zap(m_EK);
746  zap(m_DK);
747  zap(m_ME);
748  zap(m_MD);
749  }
750 
751 }
fe X
Definition: ge.cpp:27
void encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const override
Definition: aes.cpp:460
void verify_key_set(bool cond) const
Definition: sym_algo.h:95
void zap(std::vector< T, Alloc > &vec)
Definition: secmem.h:193
void store_be(uint16_t in, uint8_t out[2])
Definition: loadstor.h:434
void decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const override
Definition: aes.cpp:592
uint32_t load_be< uint32_t >(const uint8_t in[], size_t off)
Definition: loadstor.h:177
static size_t cache_line_size()
Definition: cpuid.h:66
void clear() override
Definition: aes.cpp:646
void clear() override
Definition: aes.cpp:549
MechanismType type
void clear() override
Definition: aes.cpp:743
size_t parallelism() const override
Definition: aes.cpp:457
#define BOTAN_ASSERT(expr, assertion_made)
Definition: assert.h:30
std::string provider() const override
Definition: aes.cpp:453
T load_be(const uint8_t in[], size_t off)
Definition: loadstor.h:105
std::string provider() const override
Definition: aes.cpp:452
#define BOTAN_ALIGNAS(n)
Definition: compiler.h:163
void decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const override
Definition: aes.cpp:495
void copy_mem(T *out, const T *in, size_t n)
Definition: mem_ops.h:108
Definition: alg_id.cpp:13
uint16_t reverse_bytes(uint16_t val)
Definition: bswap.h:24
#define AES_T(T, K, V0, V1, V2, V3)
Definition: aes.cpp:174
void encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const override
Definition: aes.cpp:557
size_t parallelism() const override
Definition: aes.cpp:458
std::string provider() const override
Definition: aes.cpp:454
void decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const override
Definition: aes.cpp:689
uint8_t get_byte(size_t byte_num, T input)
Definition: loadstor.h:39
void encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const override
Definition: aes.cpp:654
uint32_t make_uint32(uint8_t i0, uint8_t i1, uint8_t i2, uint8_t i3)
Definition: loadstor.h:65
fe Z
Definition: ge.cpp:29
size_t parallelism() const override
Definition: aes.cpp:456