hare

[hare] The Hare programming language
git clone https://git.torresjrjr.com/hare.git
Log | Files | Refs | README | LICENSE

aes_ct64.ha (18354B)


      1 // SPDX-License-Identifier: MPL-2.0
      2 // (c) Hare authors <https://harelang.org>
      3 
      4 // Constant time aes implementation optimized for 64bit CPUs.
      5 // The code was ported from BearSSL, which contained the following notice:
      6 //
      7 // Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
      8 //
      9 // Permission is hereby granted, free of charge, to any person obtaining
     10 // a copy of this software and associated documentation files (the
     11 // "Software"), to deal in the Software without restriction, including
     12 // without limitation the rights to use, copy, modify, merge, publish,
     13 // distribute, sublicense, and/or sell copies of the Software, and to
     14 // permit persons to whom the Software is furnished to do so, subject to
     15 // the following conditions:
     16 //
     17 // The above copyright notice and this permission notice shall be
     18 // included in all copies or substantial portions of the Software.
     19 //
     20 // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
     21 // EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
     22 // MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
     23 // NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
     24 // BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
     25 // ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
     26 // CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
     27 // SOFTWARE.
     28 use bytes;
     29 use crypto::cipher;
     30 use crypto::cipher::{blocksz,nparallel};
     31 use crypto::math;
     32 use endian;
     33 
     34 def CT64_EXPKEYSZ: size = 960;
     35 def CT64_NPARALLEL: size = 4;
     36 
     37 // Returns an AES [[crypto::cipher::block]] cipher implementation optimized for
     38 // constant time operation on 64-bit systems.
     39 //
     40 // The caller must call [[ct64_init]] to add a key to the cipher before using
     41 // the cipher, and must call [[crypto::cipher::finish]] when they are finished
     42 // using the cipher to securely erase any secret data stored in the cipher
     43 // state.
     44 fn ct64() block = block {
     45 	vtable = &ct64_vtable,
     46 	...
     47 };
     48 
     49 const ct64_vtable: cipher::blockvtable = cipher::blockvtable {
     50 	blocksz = BLOCKSZ,
     51 	nparallel = CT64_NPARALLEL,
     52 	encrypt = &aes_ct64_encrypt,
     53 	decrypt = &aes_ct64_decrypt,
     54 	finish = &block_finish,
     55 };
     56 
     57 // Initializes the ct64 AES implementation with an encryption key.
     58 fn ct64_init(cipher: *block, key: []u8) void = {
     59 	let comp_skey: [30]u64 = [0...];
     60 	cipher.rounds = br_aes_ct64_keysched(comp_skey[..], key, len(key));
     61 	br_aes_ct64_skey_expand(ct64_expkey(cipher), cipher.rounds, comp_skey[..]);
     62 };
     63 
     64 fn ct64_expkey(b: *block) []u64 = {
     65 	return (b.expkey[..]: *[*]u64)[..len(b.expkey)/size(u64)];
     66 };
     67 
     68 // Combines up to 4 blocks and encrypts them in one run
     69 fn aes_ct64_encrypt(b: *cipher::block, dest: []u8, src: []u8) void = {
     70 	let b = b: *block;
     71 
     72 	assert(len(src) % blocksz(b) == 0
     73 		&& (len(src) / blocksz(b)) <= nparallel(b),
     74 		"invalid block size");
     75 
     76 	let nblocks = len(src) / blocksz(b);
     77 
     78 	let q: [8]u64 = [0...];
     79 	let w: [16]u32 = [0...];
     80 
     81 	br_range_dec32le(w, src);
     82 	for (let i = 0z; i < nblocks; i += 1) {
     83 		br_aes_ct64_interleave_in(q[i..], q[(i + 4)..], w[(i << 2)..]);
     84 	};
     85 
     86 	br_aes_ct64_ortho(q);
     87 	br_aes_ct64_bitslice_encrypt(b.rounds, ct64_expkey(b), q);
     88 	br_aes_ct64_ortho(q);
     89 
     90 	for (let i = 0z; i < nblocks; i += 1) {
     91 		br_aes_ct64_interleave_out(w[(i << 2)..], q[i], q[i + 4]);
     92 	};
     93 
     94 	br_range_enc32le(dest, w);
     95 };
     96 
     97 // Combines up to 4 blocks and decrypts them in one run
     98 fn aes_ct64_decrypt(b: *cipher::block, dest: []u8, src: []u8) void = {
     99 	let b = b: *block;
    100 
    101 	assert(len(src) % blocksz(b) == 0
    102 		&& (len(src) / blocksz(b)) <= nparallel(b),
    103 		"invalid block size");
    104 
    105 	const nblocks = len(src) / blocksz(b);
    106 	let q: [8]u64 = [0...];
    107 	let w: [16]u32 = [0...];
    108 
    109 	br_range_dec32le(w, src);
    110 	for (let i = 0z; i < nblocks; i += 1) {
    111 		br_aes_ct64_interleave_in(q[i..], q[(i + 4)..], w[(i << 2)..]);
    112 	};
    113 
    114 	br_aes_ct64_ortho(q);
    115 	br_aes_ct64_bitslice_decrypt(b.rounds, ct64_expkey(b), q);
    116 	br_aes_ct64_ortho(q);
    117 
    118 	for (let i = 0z; i < nblocks; i += 1) {
    119 		br_aes_ct64_interleave_out(w[(i << 2)..], q[i], q[i + 4]);
    120 	};
    121 
    122 	br_range_enc32le(dest, w);
    123 };
    124 
    125 // see br_aes_ct64_ortho in src/inner.h of BearSSL
    126 fn br_aes_ct64_ortho(q: []u64) void = {
    127 	swapn(0x5555555555555555, 0xAAAAAAAAAAAAAAAA, 1, &q[0], &q[1]);
    128 	swapn(0x5555555555555555, 0xAAAAAAAAAAAAAAAA, 1, &q[2], &q[3]);
    129 	swapn(0x5555555555555555, 0xAAAAAAAAAAAAAAAA, 1, &q[4], &q[5]);
    130 	swapn(0x5555555555555555, 0xAAAAAAAAAAAAAAAA, 1, &q[6], &q[7]);
    131 
    132 	swapn(0x3333333333333333, 0xCCCCCCCCCCCCCCCC, 2, &q[0], &q[2]);
    133 	swapn(0x3333333333333333, 0xCCCCCCCCCCCCCCCC, 2, &q[1], &q[3]);
    134 	swapn(0x3333333333333333, 0xCCCCCCCCCCCCCCCC, 2, &q[4], &q[6]);
    135 	swapn(0x3333333333333333, 0xCCCCCCCCCCCCCCCC, 2, &q[5], &q[7]);
    136 
    137 	swapn(0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 4, &q[0], &q[4]);
    138 	swapn(0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 4, &q[1], &q[5]);
    139 	swapn(0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 4, &q[2], &q[6]);
    140 	swapn(0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 4, &q[3], &q[7]);
    141 };
    142 
    143 // This is a macro in the C version.
    144 fn swapn(cl: u64, ch: u64, s: u32, x: *u64, y: *u64) void = {
    145 	let a: u64 = *x, b: u64 = *y;
    146 
    147 	*x = (a & cl) | ((b & cl) << s);
    148 	*y = ((a & ch) >> s) | (b & ch);
    149 };
    150 
    151 
    152 // see br_aes_ct64_interleave_in in src/inner.h of BearSSL
    153 fn br_aes_ct64_interleave_in(q0: []u64, q1: []u64, w: const []u32) void = {
    154 	let x0 = 0u64, x1 = 0u64, x2 = 0u64, x3 = 0u64;
    155 
    156 	x0 = w[0];
    157 	x1 = w[1];
    158 	x2 = w[2];
    159 	x3 = w[3];
    160 	x0 |= (x0 << 16);
    161 	x1 |= (x1 << 16);
    162 	x2 |= (x2 << 16);
    163 	x3 |= (x3 << 16);
    164 	x0 &= 0x0000FFFF0000FFFF;
    165 	x1 &= 0x0000FFFF0000FFFF;
    166 	x2 &= 0x0000FFFF0000FFFF;
    167 	x3 &= 0x0000FFFF0000FFFF;
    168 	x0 |= (x0 << 8);
    169 	x1 |= (x1 << 8);
    170 	x2 |= (x2 << 8);
    171 	x3 |= (x3 << 8);
    172 	x0 &= 0x00FF00FF00FF00FF;
    173 	x1 &= 0x00FF00FF00FF00FF;
    174 	x2 &= 0x00FF00FF00FF00FF;
    175 	x3 &= 0x00FF00FF00FF00FF;
    176 	q0[0] = x0 | (x2 << 8);
    177 	q1[0] = x1 | (x3 << 8);
    178 };
    179 
    180 // see br_aes_ct64_interleave_out in src/inner.h of BearSSL
    181 fn br_aes_ct64_interleave_out(w: []u32, q0: u64, q1: u64) void = {
    182 	let x0 = 0u64, x1 = 0u64, x2 = 0u64, x3 = 0u64;
    183 
    184 	x0 = q0 & 0x00FF00FF00FF00FF;
    185 	x1 = q1 & 0x00FF00FF00FF00FF;
    186 	x2 = (q0 >> 8) & 0x00FF00FF00FF00FF;
    187 	x3 = (q1 >> 8) & 0x00FF00FF00FF00FF;
    188 	x0 |= (x0 >> 8);
    189 	x1 |= (x1 >> 8);
    190 	x2 |= (x2 >> 8);
    191 	x3 |= (x3 >> 8);
    192 	x0 &= 0x0000FFFF0000FFFF;
    193 	x1 &= 0x0000FFFF0000FFFF;
    194 	x2 &= 0x0000FFFF0000FFFF;
    195 	x3 &= 0x0000FFFF0000FFFF;
    196 	w[0] = (x0 | (x0 >> 16)): u32;
    197 	w[1] = (x1 | (x1 >> 16)): u32;
    198 	w[2] = (x2 | (x2 >> 16)): u32;
    199 	w[3] = (x3 | (x3 >> 16)): u32;
    200 };
    201 
    202 // see br_aes_ct64_bitslice_Sbox in src/inner.h of BearSSL
    203 fn br_aes_ct64_bitslice_Sbox(q: []u64) void = {
    204 	// This S-box implementation is a straightforward translation of
    205 	// the circuit described by Boyar and Peralta in "A new
    206 	// combinational logic minimization technique with applications
    207 	// to cryptology" (https://eprint.iacr.org/2009/191.pdf).
    208 	//
    209 	// Note that variables x* (input) and s* (output) are numbered
    210 	// in "reverse" order (x0 is the high bit, x7 is the low bit).
    211 
    212 	let x0 = 0u64, x1 = 0u64, x2 = 0u64, x3 = 0u64, x4 = 0u64, x5 = 0u64,
    213 		x6 = 0u64, x7 = 0u64;
    214 
    215 	let y1 = 0u64, y2 = 0u64, y3 = 0u64, y4 = 0u64, y5 = 0u64, y6 = 0u64,
    216 		y7 = 0u64, y8 = 0u64, y9 = 0u64, y10 = 0u64, y11 = 0u64,
    217 		y12 = 0u64, y13 = 0u64, y14 = 0u64, y15 = 0u64, y16 = 0u64,
    218 		y17 = 0u64, y18 = 0u64, y19 = 0u64, y20 = 0u64, y21 = 0u64;
    219 
    220 	let z0 = 0u64, z1 = 0u64, z2 = 0u64, z3 = 0u64, z4 = 0u64, z5 = 0u64,
    221 		z6 = 0u64, z7 = 0u64, z8 = 0u64, z9 = 0u64, z10 = 0u64,
    222 		z11 = 0u64, z12 = 0u64, z13 = 0u64, z14 = 0u64, z15 = 0u64,
    223 		z16 = 0u64, z17 = 0u64;
    224 
    225 	let t0 = 0u64, t1 = 0u64, t2 = 0u64, t3 = 0u64, t4 = 0u64,
    226 		t5 = 0u64, t6 = 0u64, t7 = 0u64, t8 = 0u64, t9 = 0u64,
    227 		t10 = 0u64, t11 = 0u64, t12 = 0u64, t13 = 0u64, t14 = 0u64,
    228 		t15 = 0u64, t16 = 0u64, t17 = 0u64, t18 = 0u64, t19 = 0u64,
    229 		t20 = 0u64, t21 = 0u64, t22 = 0u64, t23 = 0u64, t24 = 0u64,
    230 		t25 = 0u64, t26 = 0u64, t27 = 0u64, t28 = 0u64, t29 = 0u64,
    231 		t30 = 0u64, t31 = 0u64, t32 = 0u64, t33 = 0u64, t34 = 0u64,
    232 		t35 = 0u64, t36 = 0u64, t37 = 0u64, t38 = 0u64, t39 = 0u64,
    233 		t40 = 0u64, t41 = 0u64, t42 = 0u64, t43 = 0u64, t44 = 0u64,
    234 		t45 = 0u64, t46 = 0u64, t47 = 0u64, t48 = 0u64, t49 = 0u64,
    235 		t50 = 0u64, t51 = 0u64, t52 = 0u64, t53 = 0u64, t54 = 0u64,
    236 		t55 = 0u64, t56 = 0u64, t57 = 0u64, t58 = 0u64, t59 = 0u64,
    237 		t60 = 0u64, t61 = 0u64, t62 = 0u64, t63 = 0u64, t64 = 0u64,
    238 		t65 = 0u64, t66 = 0u64, t67 = 0u64;
    239 
    240 	let s0 = 0u64, s1 = 0u64, s2 = 0u64, s3 = 0u64, s4 = 0u64, s5 = 0u64,
    241 		s6 = 0u64, s7 = 0u64;
    242 
    243 	x0 = q[7];
    244 	x1 = q[6];
    245 	x2 = q[5];
    246 	x3 = q[4];
    247 	x4 = q[3];
    248 	x5 = q[2];
    249 	x6 = q[1];
    250 	x7 = q[0];
    251 
    252 	// Top linear transformation.
    253 	y14 = x3 ^ x5;
    254 	y13 = x0 ^ x6;
    255 	y9 = x0 ^ x3;
    256 	y8 = x0 ^ x5;
    257 	t0 = x1 ^ x2;
    258 	y1 = t0 ^ x7;
    259 	y4 = y1 ^ x3;
    260 	y12 = y13 ^ y14;
    261 	y2 = y1 ^ x0;
    262 	y5 = y1 ^ x6;
    263 	y3 = y5 ^ y8;
    264 	t1 = x4 ^ y12;
    265 	y15 = t1 ^ x5;
    266 	y20 = t1 ^ x1;
    267 	y6 = y15 ^ x7;
    268 	y10 = y15 ^ t0;
    269 	y11 = y20 ^ y9;
    270 	y7 = x7 ^ y11;
    271 	y17 = y10 ^ y11;
    272 	y19 = y10 ^ y8;
    273 	y16 = t0 ^ y11;
    274 	y21 = y13 ^ y16;
    275 	y18 = x0 ^ y16;
    276 
    277 	// Non-linear section.
    278 	t2 = y12 & y15;
    279 	t3 = y3 & y6;
    280 	t4 = t3 ^ t2;
    281 	t5 = y4 & x7;
    282 	t6 = t5 ^ t2;
    283 	t7 = y13 & y16;
    284 	t8 = y5 & y1;
    285 	t9 = t8 ^ t7;
    286 	t10 = y2 & y7;
    287 	t11 = t10 ^ t7;
    288 	t12 = y9 & y11;
    289 	t13 = y14 & y17;
    290 	t14 = t13 ^ t12;
    291 	t15 = y8 & y10;
    292 	t16 = t15 ^ t12;
    293 	t17 = t4 ^ t14;
    294 	t18 = t6 ^ t16;
    295 	t19 = t9 ^ t14;
    296 	t20 = t11 ^ t16;
    297 	t21 = t17 ^ y20;
    298 	t22 = t18 ^ y19;
    299 	t23 = t19 ^ y21;
    300 	t24 = t20 ^ y18;
    301 
    302 	t25 = t21 ^ t22;
    303 	t26 = t21 & t23;
    304 	t27 = t24 ^ t26;
    305 	t28 = t25 & t27;
    306 	t29 = t28 ^ t22;
    307 	t30 = t23 ^ t24;
    308 	t31 = t22 ^ t26;
    309 	t32 = t31 & t30;
    310 	t33 = t32 ^ t24;
    311 	t34 = t23 ^ t33;
    312 	t35 = t27 ^ t33;
    313 	t36 = t24 & t35;
    314 	t37 = t36 ^ t34;
    315 	t38 = t27 ^ t36;
    316 	t39 = t29 & t38;
    317 	t40 = t25 ^ t39;
    318 
    319 	t41 = t40 ^ t37;
    320 	t42 = t29 ^ t33;
    321 	t43 = t29 ^ t40;
    322 	t44 = t33 ^ t37;
    323 	t45 = t42 ^ t41;
    324 	z0 = t44 & y15;
    325 	z1 = t37 & y6;
    326 	z2 = t33 & x7;
    327 	z3 = t43 & y16;
    328 	z4 = t40 & y1;
    329 	z5 = t29 & y7;
    330 	z6 = t42 & y11;
    331 	z7 = t45 & y17;
    332 	z8 = t41 & y10;
    333 	z9 = t44 & y12;
    334 	z10 = t37 & y3;
    335 	z11 = t33 & y4;
    336 	z12 = t43 & y13;
    337 	z13 = t40 & y5;
    338 	z14 = t29 & y2;
    339 	z15 = t42 & y9;
    340 	z16 = t45 & y14;
    341 	z17 = t41 & y8;
    342 
    343 	// Bottom linear transformation.
    344 	t46 = z15 ^ z16;
    345 	t47 = z10 ^ z11;
    346 	t48 = z5 ^ z13;
    347 	t49 = z9 ^ z10;
    348 	t50 = z2 ^ z12;
    349 	t51 = z2 ^ z5;
    350 	t52 = z7 ^ z8;
    351 	t53 = z0 ^ z3;
    352 	t54 = z6 ^ z7;
    353 	t55 = z16 ^ z17;
    354 	t56 = z12 ^ t48;
    355 	t57 = t50 ^ t53;
    356 	t58 = z4 ^ t46;
    357 	t59 = z3 ^ t54;
    358 	t60 = t46 ^ t57;
    359 	t61 = z14 ^ t57;
    360 	t62 = t52 ^ t58;
    361 	t63 = t49 ^ t58;
    362 	t64 = z4 ^ t59;
    363 	t65 = t61 ^ t62;
    364 	t66 = z1 ^ t63;
    365 	s0 = t59 ^ t63;
    366 	s6 = t56 ^ ~t62;
    367 	s7 = t48 ^ ~t60;
    368 	t67 = t64 ^ t65;
    369 	s3 = t53 ^ t66;
    370 	s4 = t51 ^ t66;
    371 	s5 = t47 ^ t65;
    372 	s1 = t64 ^ ~s3;
    373 	s2 = t55 ^ ~t67;
    374 
    375 	q[7] = s0;
    376 	q[6] = s1;
    377 	q[5] = s2;
    378 	q[4] = s3;
    379 	q[3] = s4;
    380 	q[2] = s5;
    381 	q[1] = s6;
    382 	q[0] = s7;
    383 };
    384 
    385 const rcon: []u8 = [
    386 	0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1B, 0x36
    387 ];
    388 
    389 fn sub_word(x: u32) u32 = {
    390 	let q: [8]u64 = [x, 0...];
    391 	br_aes_ct64_ortho(q);
    392 	br_aes_ct64_bitslice_Sbox(q);
    393 	br_aes_ct64_ortho(q);
    394 	return q[0]: u32;
    395 };
    396 
    397 // see br_aes_ct64_keysched in src/inner.h of BearSSL
    398 fn br_aes_ct64_keysched(
    399 	comp_skey: []u64,
    400 	key: const []u8,
    401 	key_len: size,
    402 ) uint = {
    403 	let num_rounds: uint = 0;
    404 	let nk: int = 0, nkf: int = 0;
    405 	let tmp: u32 = 0;
    406 	let skey: [60]u32 = [0...];
    407 
    408 	switch (key_len) {
    409 	case 16 =>
    410 		num_rounds = 10;
    411 	case 24 =>
    412 		num_rounds = 12;
    413 	case 32 =>
    414 		num_rounds = 14;
    415 	case =>
    416 		assert(false, "invalid key length");
    417 	};
    418 
    419 	nk = (key_len >> 2): int;
    420 	nkf = ((num_rounds + 1) << 2): int;
    421 	br_range_dec32le(skey, key);
    422 	tmp = skey[(key_len >> 2) - 1];
    423 	for (let i = nk, j = 0, k = 0; i < nkf; i += 1) {
    424 		if (j == 0) {
    425 			tmp = (tmp << 24) | (tmp >> 8);
    426 			tmp = sub_word(tmp) ^ rcon[k];
    427 		} else if (nk > 6 && j == 4) {
    428 			tmp = sub_word(tmp);
    429 		};
    430 		tmp ^= skey[i - nk];
    431 		skey[i] = tmp;
    432 		j += 1;
    433 		if (j == nk) {
    434 			j = 0;
    435 			k += 1;
    436 		};
    437 	};
    438 
    439 	for (let i = 0, j = 0; i < nkf) {
    440 		let q: [8]u64 = [0...];
    441 
    442 		br_aes_ct64_interleave_in(q[0..], q[4..], skey[i..]);
    443 		q[1] = q[0];
    444 		q[2] = q[0];
    445 		q[3] = q[0];
    446 		q[5] = q[4];
    447 		q[6] = q[4];
    448 		q[7] = q[4];
    449 		br_aes_ct64_ortho(q[..]);
    450 		comp_skey[j + 0] = (q[0] & 0x1111111111111111)
    451 			| (q[1] & 0x2222222222222222)
    452 			| (q[2] & 0x4444444444444444)
    453 			| (q[3] & 0x8888888888888888);
    454 		comp_skey[j + 1] = (q[4] & 0x1111111111111111)
    455 			| (q[5] & 0x2222222222222222)
    456 			| (q[6] & 0x4444444444444444)
    457 			| (q[7] & 0x8888888888888888);
    458 
    459 		i += 4;
    460 		j += 2;
    461 	};
    462 	return num_rounds;
    463 };
    464 
    465 fn br_range_dec32le(v: []u32, src: []u8) void = {
    466 	for (let i = 0z; len(src) > 0; i += 1) {
    467 		v[i] = endian::legetu32(src);
    468 		src = src[4..];
    469 	};
    470 };
    471 
    472 fn br_range_enc32le(dest: []u8, w: []u32) void = {
    473 	for (let i = 0z; len(dest) > 0; i += 1) {
    474 		endian::leputu32(dest, w[i]);
    475 		dest = dest[4..];
    476 	};
    477 };
    478 
    479 // see br_aes_ct64_skey_expand in src/inner.h of BearSSL
    480 fn br_aes_ct64_skey_expand(
    481 	skey: []u64,
    482 	num_rounds: uint,
    483 	comp_skey: const []u64,
    484 ) void = {
    485 	let n: uint = (num_rounds + 1) << 1;
    486 	for (let u = 0u, v = 0u; u < n) {
    487 		let x0 = 0u64, x1 = 0u64, x2 = 0u64, x3 = 0u64;
    488 
    489 		x0 = comp_skey[u];
    490 		x1 = comp_skey[u];
    491 		x2 = comp_skey[u];
    492 		x3 = comp_skey[u];
    493 		x0 &= 0x1111111111111111;
    494 		x1 &= 0x2222222222222222;
    495 		x2 &= 0x4444444444444444;
    496 		x3 &= 0x8888888888888888;
    497 		x1 >>= 1;
    498 		x2 >>= 2;
    499 		x3 >>= 3;
    500 		skey[v + 0] = (x0 << 4) - x0;
    501 		skey[v + 1] = (x1 << 4) - x1;
    502 		skey[v + 2] = (x2 << 4) - x2;
    503 		skey[v + 3] = (x3 << 4) - x3;
    504 
    505 		u += 1;
    506 		v += 4;
    507 	};
    508 };
    509 
    510 // aes_ct64_enc.c
    511 
    512 fn add_round_key(q: []u64, sk: const []u64) void = {
    513 	q[0] ^= sk[0];
    514 	q[1] ^= sk[1];
    515 	q[2] ^= sk[2];
    516 	q[3] ^= sk[3];
    517 	q[4] ^= sk[4];
    518 	q[5] ^= sk[5];
    519 	q[6] ^= sk[6];
    520 	q[7] ^= sk[7];
    521 };
    522 
    523 fn shift_rows(q: []u64) void = {
    524 	for (let i: int = 0; i < 8; i += 1) {
    525 		let x: u64 = q[i];
    526 		q[i] = (x & 0x000000000000FFFF)
    527 			| ((x & 0x00000000FFF00000) >> 4)
    528 			| ((x & 0x00000000000F0000) << 12)
    529 			| ((x & 0x0000FF0000000000) >> 8)
    530 			| ((x & 0x000000FF00000000) << 8)
    531 			| ((x & 0xF000000000000000) >> 12)
    532 			| ((x & 0x0FFF000000000000) << 4);
    533 	};
    534 };
    535 
    536 fn mix_columns(q: []u64) void = {
    537 	let q0 = 0u64, q1 = 0u64, q2 = 0u64, q3 = 0u64, q4 = 0u64, q5 = 0u64,
    538 		q6 = 0u64, q7 = 0u64;
    539 	let r0 = 0u64, r1 = 0u64, r2 = 0u64, r3 = 0u64, r4 = 0u64, r5 = 0u64,
    540 		r6 = 0u64, r7 = 0u64;
    541 
    542 	q0 = q[0];
    543 	q1 = q[1];
    544 	q2 = q[2];
    545 	q3 = q[3];
    546 	q4 = q[4];
    547 	q5 = q[5];
    548 	q6 = q[6];
    549 	q7 = q[7];
    550 	r0 = (q0 >> 16) | (q0 << 48);
    551 	r1 = (q1 >> 16) | (q1 << 48);
    552 	r2 = (q2 >> 16) | (q2 << 48);
    553 	r3 = (q3 >> 16) | (q3 << 48);
    554 	r4 = (q4 >> 16) | (q4 << 48);
    555 	r5 = (q5 >> 16) | (q5 << 48);
    556 	r6 = (q6 >> 16) | (q6 << 48);
    557 	r7 = (q7 >> 16) | (q7 << 48);
    558 
    559 	q[0] = q7 ^ r7 ^ r0 ^ math::rotr64(q0 ^ r0, 32);
    560 	q[1] = q0 ^ r0 ^ q7 ^ r7 ^ r1 ^ math::rotr64(q1 ^ r1, 32);
    561 	q[2] = q1 ^ r1 ^ r2 ^ math::rotr64(q2 ^ r2, 32);
    562 	q[3] = q2 ^ r2 ^ q7 ^ r7 ^ r3 ^ math::rotr64(q3 ^ r3, 32);
    563 	q[4] = q3 ^ r3 ^ q7 ^ r7 ^ r4 ^ math::rotr64(q4 ^ r4, 32);
    564 	q[5] = q4 ^ r4 ^ r5 ^ math::rotr64(q5 ^ r5, 32);
    565 	q[6] = q5 ^ r5 ^ r6 ^ math::rotr64(q6 ^ r6, 32);
    566 	q[7] = q6 ^ r6 ^ r7 ^ math::rotr64(q7 ^ r7, 32);
    567 };
    568 
    569 // see br_aes_ct64_bitslice_encrypt in src/inner.h of BearSSL
    570 fn br_aes_ct64_bitslice_encrypt(
    571 	num_rounds: uint,
    572 	skey: const []u64,
    573 	q: []u64,
    574 ) void = {
    575 	add_round_key(q, skey);
    576 	for (let u: uint = 1; u < num_rounds; u += 1) {
    577 		br_aes_ct64_bitslice_Sbox(q);
    578 		shift_rows(q);
    579 		mix_columns(q);
    580 		add_round_key(q, skey[(u << 3)..]);
    581 	};
    582 	br_aes_ct64_bitslice_Sbox(q);
    583 	shift_rows(q);
    584 	add_round_key(q, skey[(num_rounds << 3)..]);
    585 };
    586 
    587 // see br_aes_ct64_bitslice_invSbox in src/inner.h of BearSSL
    588 fn br_aes_ct64_bitslice_invSbox(q: []u64) void = {
    589 	// See br_aes_ct_bitslice_invSbox(). This is the natural extension
    590 	// to 64-bit registers.
    591 	let q0 = 0u64, q1 = 0u64, q2 = 0u64, q3 = 0u64, q4 = 0u64, q5 = 0u64,
    592 		q6 = 0u64, q7 = 0u64;
    593 
    594 	q0 = ~q[0];
    595 	q1 = ~q[1];
    596 	q2 = q[2];
    597 	q3 = q[3];
    598 	q4 = q[4];
    599 	q5 = ~q[5];
    600 	q6 = ~q[6];
    601 	q7 = q[7];
    602 	q[7] = q1 ^ q4 ^ q6;
    603 	q[6] = q0 ^ q3 ^ q5;
    604 	q[5] = q7 ^ q2 ^ q4;
    605 	q[4] = q6 ^ q1 ^ q3;
    606 	q[3] = q5 ^ q0 ^ q2;
    607 	q[2] = q4 ^ q7 ^ q1;
    608 	q[1] = q3 ^ q6 ^ q0;
    609 	q[0] = q2 ^ q5 ^ q7;
    610 
    611 	br_aes_ct64_bitslice_Sbox(q);
    612 
    613 	q0 = ~q[0];
    614 	q1 = ~q[1];
    615 	q2 = q[2];
    616 	q3 = q[3];
    617 	q4 = q[4];
    618 	q5 = ~q[5];
    619 	q6 = ~q[6];
    620 	q7 = q[7];
    621 	q[7] = q1 ^ q4 ^ q6;
    622 	q[6] = q0 ^ q3 ^ q5;
    623 	q[5] = q7 ^ q2 ^ q4;
    624 	q[4] = q6 ^ q1 ^ q3;
    625 	q[3] = q5 ^ q0 ^ q2;
    626 	q[2] = q4 ^ q7 ^ q1;
    627 	q[1] = q3 ^ q6 ^ q0;
    628 	q[0] = q2 ^ q5 ^ q7;
    629 };
    630 
    631 fn inv_shift_rows(q: []u64) void = {
    632 	for (let i: int = 0; i < 8; i += 1) {
    633 		let x: u64 = q[i];
    634 		q[i] = (x & 0x000000000000FFFF)
    635 			| ((x & 0x000000000FFF0000) << 4)
    636 			| ((x & 0x00000000F0000000) >> 12)
    637 			| ((x & 0x000000FF00000000) << 8)
    638 			| ((x & 0x0000FF0000000000) >> 8)
    639 			| ((x & 0x000F000000000000) << 12)
    640 			| ((x & 0xFFF0000000000000) >> 4);
    641 	};
    642 };
    643 
    644 fn inv_mix_columns(q: []u64) void = {
    645 	let q0 = 0u64, q1 = 0u64, q2 = 0u64, q3 = 0u64, q4 = 0u64, q5 = 0u64,
    646 		q6 = 0u64, q7 = 0u64;
    647 	let r0 = 0u64, r1 = 0u64, r2 = 0u64, r3 = 0u64, r4 = 0u64, r5 = 0u64,
    648 		r6 = 0u64, r7 = 0u64;
    649 
    650 	q0 = q[0];
    651 	q1 = q[1];
    652 	q2 = q[2];
    653 	q3 = q[3];
    654 	q4 = q[4];
    655 	q5 = q[5];
    656 	q6 = q[6];
    657 	q7 = q[7];
    658 	r0 = (q0 >> 16) | (q0 << 48);
    659 	r1 = (q1 >> 16) | (q1 << 48);
    660 	r2 = (q2 >> 16) | (q2 << 48);
    661 	r3 = (q3 >> 16) | (q3 << 48);
    662 	r4 = (q4 >> 16) | (q4 << 48);
    663 	r5 = (q5 >> 16) | (q5 << 48);
    664 	r6 = (q6 >> 16) | (q6 << 48);
    665 	r7 = (q7 >> 16) | (q7 << 48);
    666 
    667 	q[0] = q5 ^ q6 ^ q7 ^ r0 ^ r5 ^ r7
    668 		^ math::rotr64(q0 ^ q5 ^ q6 ^ r0 ^ r5, 32);
    669 	q[1] = q0 ^ q5 ^ r0 ^ r1 ^ r5 ^ r6 ^ r7
    670 		^ math::rotr64(q1 ^ q5 ^ q7 ^ r1 ^ r5 ^ r6, 32);
    671 	q[2] = q0 ^ q1 ^ q6 ^ r1 ^ r2 ^ r6 ^ r7
    672 		^ math::rotr64(q0 ^ q2 ^ q6 ^ r2 ^ r6 ^ r7, 32);
    673 	q[3] = q0 ^ q1 ^ q2 ^ q5 ^ q6 ^ r0 ^ r2 ^ r3 ^ r5
    674 		^ math::rotr64(q0 ^ q1 ^ q3 ^ q5 ^ q6 ^ q7 ^ r0 ^ r3 ^ r5 ^ r7
    675 			, 32);
    676 	q[4] = q1 ^ q2 ^ q3 ^ q5 ^ r1 ^ r3 ^ r4 ^ r5 ^ r6 ^ r7
    677 		^ math::rotr64(q1 ^ q2 ^ q4 ^ q5 ^ q7 ^ r1 ^ r4 ^ r5 ^ r6, 32);
    678 	q[5] = q2 ^ q3 ^ q4 ^ q6 ^ r2 ^ r4 ^ r5 ^ r6 ^ r7
    679 		^ math::rotr64(q2 ^ q3 ^ q5 ^ q6 ^ r2 ^ r5 ^ r6 ^ r7, 32);
    680 	q[6] = q3 ^ q4 ^ q5 ^ q7 ^ r3 ^ r5 ^ r6 ^ r7
    681 		^ math::rotr64(q3 ^ q4 ^ q6 ^ q7 ^ r3 ^ r6 ^ r7, 32);
    682 	q[7] = q4 ^ q5 ^ q6 ^ r4 ^ r6 ^ r7
    683 		^ math::rotr64(q4 ^ q5 ^ q7 ^ r4 ^ r7, 32);
    684 };
    685 
    686 // see br_aes_ct64_bitslice_decrypt in src/inner.h of BearSSL
    687 fn br_aes_ct64_bitslice_decrypt(
    688 	num_rounds: size,
    689 	skey: const []u64,
    690 	q: []u64,
    691 ) void = {
    692 	add_round_key(q, skey[(num_rounds << 3)..]);
    693 	for (let u: size = num_rounds - 1; u > 0; u -= 1) {
    694 		inv_shift_rows(q);
    695 		br_aes_ct64_bitslice_invSbox(q);
    696 		add_round_key(q, skey[(u << 3)..]);
    697 		inv_mix_columns(q);
    698 	};
    699 	inv_shift_rows(q);
    700 	br_aes_ct64_bitslice_invSbox(q);
    701 	add_round_key(q, skey);
    702 };
    703