aes_ct64.ha (18353B)
1 // SPDX-License-Identifier: MPL-2.0 2 // (c) Hare authors <https://harelang.org> 3 4 // Constant time aes implementation optimized for 64bit CPUs. 5 // The code was ported from BearSSL, which contained the following notice: 6 // 7 // Copyright (c) 2016 Thomas Pornin <pornin@bolet.org> 8 // 9 // Permission is hereby granted, free of charge, to any person obtaining 10 // a copy of this software and associated documentation files (the 11 // "Software"), to deal in the Software without restriction, including 12 // without limitation the rights to use, copy, modify, merge, publish, 13 // distribute, sublicense, and/or sell copies of the Software, and to 14 // permit persons to whom the Software is furnished to do so, subject to 15 // the following conditions: 16 // 17 // The above copyright notice and this permission notice shall be 18 // included in all copies or substantial portions of the Software. 19 // 20 // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 21 // EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF 22 // MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 23 // NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS 24 // BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN 25 // ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN 26 // CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 27 // SOFTWARE. 28 use bytes; 29 use crypto::cipher; 30 use crypto::cipher::{blocksz,nparallel}; 31 use crypto::math; 32 use endian; 33 34 def CT64_EXPKEYSZ: size = 960; 35 def CT64_NPARALLEL: size = 4; 36 37 // Returns an AES [[crypto::cipher::block]] cipher implementation optimized for 38 // constant time operation on 64-bit systems. 39 // 40 // The caller must call [[ct64_init]] to add a key to the cipher before using 41 // the cipher, and must call [[crypto::cipher::finish]] when they are finished 42 // using the cipher to securely erase any secret data stored in the cipher 43 // state. 44 fn ct64() block = block { 45 vtable = &ct64_vtable, 46 ... 47 }; 48 49 const ct64_vtable: cipher::blockvtable = cipher::blockvtable { 50 blocksz = BLOCKSZ, 51 nparallel = CT64_NPARALLEL, 52 encrypt = &aes_ct64_encrypt, 53 decrypt = &aes_ct64_decrypt, 54 finish = &block_finish, 55 }; 56 57 // Initializes the ct64 AES implementation with an encryption key. 58 fn ct64_init(cipher: *block, key: []u8) void = { 59 let comp_skey: [30]u64 = [0...]; 60 cipher.rounds = br_aes_ct64_keysched(comp_skey[..], key, len(key)); 61 br_aes_ct64_skey_expand(ct64_expkey(cipher), cipher.rounds, comp_skey[..]); 62 }; 63 64 fn ct64_expkey(b: *block) []u64 = { 65 return (b.expkey[..]: *[*]u64)[..len(b.expkey)/size(u64)]; 66 }; 67 68 // Combines up to 4 blocks and encrypts them in one run 69 fn aes_ct64_encrypt(b: *cipher::block, dest: []u8, src: []u8) void = { 70 let b = b: *block; 71 72 assert(len(src) % blocksz(b) == 0 73 && (len(src) / blocksz(b)) <= nparallel(b), 74 "invalid block size"); 75 76 let nblocks = len(src) / blocksz(b); 77 78 let q: [8]u64 = [0...]; 79 let w: [16]u32 = [0...]; 80 81 br_range_dec32le(w, src); 82 for (let i = 0z; i < nblocks; i += 1) { 83 br_aes_ct64_interleave_in(q[i..], q[(i + 4)..], w[(i << 2)..]); 84 }; 85 86 br_aes_ct64_ortho(q); 87 br_aes_ct64_bitslice_encrypt(b.rounds, ct64_expkey(b), q); 88 br_aes_ct64_ortho(q); 89 90 for (let i = 0z; i < nblocks; i += 1) { 91 br_aes_ct64_interleave_out(w[(i << 2)..], q[i], q[i + 4]); 92 }; 93 94 br_range_enc32le(dest, w); 95 }; 96 97 // Combines up to 4 blocks and decrypts them in one run 98 fn aes_ct64_decrypt(b: *cipher::block, dest: []u8, src: []u8) void = { 99 let b = b: *block; 100 101 assert(len(src) % blocksz(b) == 0 102 && (len(src) / blocksz(b)) <= nparallel(b), 103 "invalid block size"); 104 105 const nblocks = len(src) / blocksz(b); 106 let q: [8]u64 = [0...]; 107 let w: [16]u32 = [0...]; 108 109 br_range_dec32le(w, src); 110 for (let i = 0z; i < nblocks; i += 1) { 111 br_aes_ct64_interleave_in(q[i..], q[(i + 4)..], w[(i << 2)..]); 112 }; 113 114 br_aes_ct64_ortho(q); 115 br_aes_ct64_bitslice_decrypt(b.rounds, ct64_expkey(b), q); 116 br_aes_ct64_ortho(q); 117 118 for (let i = 0z; i < nblocks; i += 1) { 119 br_aes_ct64_interleave_out(w[(i << 2)..], q[i], q[i + 4]); 120 }; 121 122 br_range_enc32le(dest, w); 123 }; 124 125 // see br_aes_ct64_ortho in src/inner.h of BearSSL 126 fn br_aes_ct64_ortho(q: []u64) void = { 127 swapn(0x5555555555555555, 0xAAAAAAAAAAAAAAAA, 1, &q[0], &q[1]); 128 swapn(0x5555555555555555, 0xAAAAAAAAAAAAAAAA, 1, &q[2], &q[3]); 129 swapn(0x5555555555555555, 0xAAAAAAAAAAAAAAAA, 1, &q[4], &q[5]); 130 swapn(0x5555555555555555, 0xAAAAAAAAAAAAAAAA, 1, &q[6], &q[7]); 131 132 swapn(0x3333333333333333, 0xCCCCCCCCCCCCCCCC, 2, &q[0], &q[2]); 133 swapn(0x3333333333333333, 0xCCCCCCCCCCCCCCCC, 2, &q[1], &q[3]); 134 swapn(0x3333333333333333, 0xCCCCCCCCCCCCCCCC, 2, &q[4], &q[6]); 135 swapn(0x3333333333333333, 0xCCCCCCCCCCCCCCCC, 2, &q[5], &q[7]); 136 137 swapn(0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 4, &q[0], &q[4]); 138 swapn(0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 4, &q[1], &q[5]); 139 swapn(0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 4, &q[2], &q[6]); 140 swapn(0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 4, &q[3], &q[7]); 141 }; 142 143 // This is a macro in the C version. 144 fn swapn(cl: u64, ch: u64, s: u32, x: *u64, y: *u64) void = { 145 let a: u64 = *x, b: u64 = *y; 146 147 *x = (a & cl) | ((b & cl) << s); 148 *y = ((a & ch) >> s) | (b & ch); 149 }; 150 151 152 // see br_aes_ct64_interleave_in in src/inner.h of BearSSL 153 fn br_aes_ct64_interleave_in(q0: []u64, q1: []u64, w: const []u32) void = { 154 let x0 = 0u64, x1 = 0u64, x2 = 0u64, x3 = 0u64; 155 156 x0 = w[0]; 157 x1 = w[1]; 158 x2 = w[2]; 159 x3 = w[3]; 160 x0 |= (x0 << 16); 161 x1 |= (x1 << 16); 162 x2 |= (x2 << 16); 163 x3 |= (x3 << 16); 164 x0 &= 0x0000FFFF0000FFFF; 165 x1 &= 0x0000FFFF0000FFFF; 166 x2 &= 0x0000FFFF0000FFFF; 167 x3 &= 0x0000FFFF0000FFFF; 168 x0 |= (x0 << 8); 169 x1 |= (x1 << 8); 170 x2 |= (x2 << 8); 171 x3 |= (x3 << 8); 172 x0 &= 0x00FF00FF00FF00FF; 173 x1 &= 0x00FF00FF00FF00FF; 174 x2 &= 0x00FF00FF00FF00FF; 175 x3 &= 0x00FF00FF00FF00FF; 176 q0[0] = x0 | (x2 << 8); 177 q1[0] = x1 | (x3 << 8); 178 }; 179 180 // see br_aes_ct64_interleave_out in src/inner.h of BearSSL 181 fn br_aes_ct64_interleave_out(w: []u32, q0: u64, q1: u64) void = { 182 let x0 = 0u64, x1 = 0u64, x2 = 0u64, x3 = 0u64; 183 184 x0 = q0 & 0x00FF00FF00FF00FF; 185 x1 = q1 & 0x00FF00FF00FF00FF; 186 x2 = (q0 >> 8) & 0x00FF00FF00FF00FF; 187 x3 = (q1 >> 8) & 0x00FF00FF00FF00FF; 188 x0 |= (x0 >> 8); 189 x1 |= (x1 >> 8); 190 x2 |= (x2 >> 8); 191 x3 |= (x3 >> 8); 192 x0 &= 0x0000FFFF0000FFFF; 193 x1 &= 0x0000FFFF0000FFFF; 194 x2 &= 0x0000FFFF0000FFFF; 195 x3 &= 0x0000FFFF0000FFFF; 196 w[0] = (x0 | (x0 >> 16)): u32; 197 w[1] = (x1 | (x1 >> 16)): u32; 198 w[2] = (x2 | (x2 >> 16)): u32; 199 w[3] = (x3 | (x3 >> 16)): u32; 200 }; 201 202 // see br_aes_ct64_bitslice_Sbox in src/inner.h of BearSSL 203 fn br_aes_ct64_bitslice_Sbox(q: []u64) void = { 204 // This S-box implementation is a straightforward translation of 205 // the circuit described by Boyar and Peralta in "A new 206 // combinational logic minimization technique with applications 207 // to cryptology" (https://eprint.iacr.org/2009/191.pdf). 208 // 209 // Note that variables x* (input) and s* (output) are numbered 210 // in "reverse" order (x0 is the high bit, x7 is the low bit). 211 212 let x0 = 0u64, x1 = 0u64, x2 = 0u64, x3 = 0u64, x4 = 0u64, x5 = 0u64, 213 x6 = 0u64, x7 = 0u64; 214 215 let y1 = 0u64, y2 = 0u64, y3 = 0u64, y4 = 0u64, y5 = 0u64, y6 = 0u64, 216 y7 = 0u64, y8 = 0u64, y9 = 0u64, y10 = 0u64, y11 = 0u64, 217 y12 = 0u64, y13 = 0u64, y14 = 0u64, y15 = 0u64, y16 = 0u64, 218 y17 = 0u64, y18 = 0u64, y19 = 0u64, y20 = 0u64, y21 = 0u64; 219 220 let z0 = 0u64, z1 = 0u64, z2 = 0u64, z3 = 0u64, z4 = 0u64, z5 = 0u64, 221 z6 = 0u64, z7 = 0u64, z8 = 0u64, z9 = 0u64, z10 = 0u64, 222 z11 = 0u64, z12 = 0u64, z13 = 0u64, z14 = 0u64, z15 = 0u64, 223 z16 = 0u64, z17 = 0u64; 224 225 let t0 = 0u64, t1 = 0u64, t2 = 0u64, t3 = 0u64, t4 = 0u64, 226 t5 = 0u64, t6 = 0u64, t7 = 0u64, t8 = 0u64, t9 = 0u64, 227 t10 = 0u64, t11 = 0u64, t12 = 0u64, t13 = 0u64, t14 = 0u64, 228 t15 = 0u64, t16 = 0u64, t17 = 0u64, t18 = 0u64, t19 = 0u64, 229 t20 = 0u64, t21 = 0u64, t22 = 0u64, t23 = 0u64, t24 = 0u64, 230 t25 = 0u64, t26 = 0u64, t27 = 0u64, t28 = 0u64, t29 = 0u64, 231 t30 = 0u64, t31 = 0u64, t32 = 0u64, t33 = 0u64, t34 = 0u64, 232 t35 = 0u64, t36 = 0u64, t37 = 0u64, t38 = 0u64, t39 = 0u64, 233 t40 = 0u64, t41 = 0u64, t42 = 0u64, t43 = 0u64, t44 = 0u64, 234 t45 = 0u64, t46 = 0u64, t47 = 0u64, t48 = 0u64, t49 = 0u64, 235 t50 = 0u64, t51 = 0u64, t52 = 0u64, t53 = 0u64, t54 = 0u64, 236 t55 = 0u64, t56 = 0u64, t57 = 0u64, t58 = 0u64, t59 = 0u64, 237 t60 = 0u64, t61 = 0u64, t62 = 0u64, t63 = 0u64, t64 = 0u64, 238 t65 = 0u64, t66 = 0u64, t67 = 0u64; 239 240 let s0 = 0u64, s1 = 0u64, s2 = 0u64, s3 = 0u64, s4 = 0u64, s5 = 0u64, 241 s6 = 0u64, s7 = 0u64; 242 243 x0 = q[7]; 244 x1 = q[6]; 245 x2 = q[5]; 246 x3 = q[4]; 247 x4 = q[3]; 248 x5 = q[2]; 249 x6 = q[1]; 250 x7 = q[0]; 251 252 // Top linear transformation. 253 y14 = x3 ^ x5; 254 y13 = x0 ^ x6; 255 y9 = x0 ^ x3; 256 y8 = x0 ^ x5; 257 t0 = x1 ^ x2; 258 y1 = t0 ^ x7; 259 y4 = y1 ^ x3; 260 y12 = y13 ^ y14; 261 y2 = y1 ^ x0; 262 y5 = y1 ^ x6; 263 y3 = y5 ^ y8; 264 t1 = x4 ^ y12; 265 y15 = t1 ^ x5; 266 y20 = t1 ^ x1; 267 y6 = y15 ^ x7; 268 y10 = y15 ^ t0; 269 y11 = y20 ^ y9; 270 y7 = x7 ^ y11; 271 y17 = y10 ^ y11; 272 y19 = y10 ^ y8; 273 y16 = t0 ^ y11; 274 y21 = y13 ^ y16; 275 y18 = x0 ^ y16; 276 277 // Non-linear section. 278 t2 = y12 & y15; 279 t3 = y3 & y6; 280 t4 = t3 ^ t2; 281 t5 = y4 & x7; 282 t6 = t5 ^ t2; 283 t7 = y13 & y16; 284 t8 = y5 & y1; 285 t9 = t8 ^ t7; 286 t10 = y2 & y7; 287 t11 = t10 ^ t7; 288 t12 = y9 & y11; 289 t13 = y14 & y17; 290 t14 = t13 ^ t12; 291 t15 = y8 & y10; 292 t16 = t15 ^ t12; 293 t17 = t4 ^ t14; 294 t18 = t6 ^ t16; 295 t19 = t9 ^ t14; 296 t20 = t11 ^ t16; 297 t21 = t17 ^ y20; 298 t22 = t18 ^ y19; 299 t23 = t19 ^ y21; 300 t24 = t20 ^ y18; 301 302 t25 = t21 ^ t22; 303 t26 = t21 & t23; 304 t27 = t24 ^ t26; 305 t28 = t25 & t27; 306 t29 = t28 ^ t22; 307 t30 = t23 ^ t24; 308 t31 = t22 ^ t26; 309 t32 = t31 & t30; 310 t33 = t32 ^ t24; 311 t34 = t23 ^ t33; 312 t35 = t27 ^ t33; 313 t36 = t24 & t35; 314 t37 = t36 ^ t34; 315 t38 = t27 ^ t36; 316 t39 = t29 & t38; 317 t40 = t25 ^ t39; 318 319 t41 = t40 ^ t37; 320 t42 = t29 ^ t33; 321 t43 = t29 ^ t40; 322 t44 = t33 ^ t37; 323 t45 = t42 ^ t41; 324 z0 = t44 & y15; 325 z1 = t37 & y6; 326 z2 = t33 & x7; 327 z3 = t43 & y16; 328 z4 = t40 & y1; 329 z5 = t29 & y7; 330 z6 = t42 & y11; 331 z7 = t45 & y17; 332 z8 = t41 & y10; 333 z9 = t44 & y12; 334 z10 = t37 & y3; 335 z11 = t33 & y4; 336 z12 = t43 & y13; 337 z13 = t40 & y5; 338 z14 = t29 & y2; 339 z15 = t42 & y9; 340 z16 = t45 & y14; 341 z17 = t41 & y8; 342 343 // Bottom linear transformation. 344 t46 = z15 ^ z16; 345 t47 = z10 ^ z11; 346 t48 = z5 ^ z13; 347 t49 = z9 ^ z10; 348 t50 = z2 ^ z12; 349 t51 = z2 ^ z5; 350 t52 = z7 ^ z8; 351 t53 = z0 ^ z3; 352 t54 = z6 ^ z7; 353 t55 = z16 ^ z17; 354 t56 = z12 ^ t48; 355 t57 = t50 ^ t53; 356 t58 = z4 ^ t46; 357 t59 = z3 ^ t54; 358 t60 = t46 ^ t57; 359 t61 = z14 ^ t57; 360 t62 = t52 ^ t58; 361 t63 = t49 ^ t58; 362 t64 = z4 ^ t59; 363 t65 = t61 ^ t62; 364 t66 = z1 ^ t63; 365 s0 = t59 ^ t63; 366 s6 = t56 ^ ~t62; 367 s7 = t48 ^ ~t60; 368 t67 = t64 ^ t65; 369 s3 = t53 ^ t66; 370 s4 = t51 ^ t66; 371 s5 = t47 ^ t65; 372 s1 = t64 ^ ~s3; 373 s2 = t55 ^ ~t67; 374 375 q[7] = s0; 376 q[6] = s1; 377 q[5] = s2; 378 q[4] = s3; 379 q[3] = s4; 380 q[2] = s5; 381 q[1] = s6; 382 q[0] = s7; 383 }; 384 385 const rcon: []u8 = [ 386 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1B, 0x36 387 ]; 388 389 fn sub_word(x: u32) u32 = { 390 let q: [8]u64 = [x, 0...]; 391 br_aes_ct64_ortho(q); 392 br_aes_ct64_bitslice_Sbox(q); 393 br_aes_ct64_ortho(q); 394 return q[0]: u32; 395 }; 396 397 // see br_aes_ct64_keysched in src/inner.h of BearSSL 398 fn br_aes_ct64_keysched( 399 comp_skey: []u64, 400 key: const []u8, 401 key_len: size, 402 ) uint = { 403 let num_rounds: uint = 0; 404 let nk: int = 0, nkf: int = 0; 405 let tmp: u32 = 0; 406 let skey: [60]u32 = [0...]; 407 408 switch (key_len) { 409 case 16 => 410 num_rounds = 10; 411 case 24 => 412 num_rounds = 12; 413 case 32 => 414 num_rounds = 14; 415 case => 416 assert(false, "invalid key length"); 417 }; 418 419 nk = (key_len >> 2): int; 420 nkf = ((num_rounds + 1) << 2): int; 421 br_range_dec32le(skey, key); 422 tmp = skey[(key_len >> 2) - 1]; 423 for (let i = nk, j = 0, k = 0; i < nkf; i += 1) { 424 if (j == 0) { 425 tmp = (tmp << 24) | (tmp >> 8); 426 tmp = sub_word(tmp) ^ rcon[k]; 427 } else if (nk > 6 && j == 4) { 428 tmp = sub_word(tmp); 429 }; 430 tmp ^= skey[i - nk]; 431 skey[i] = tmp; 432 j += 1; 433 if (j == nk) { 434 j = 0; 435 k += 1; 436 }; 437 }; 438 439 for (let i = 0, j = 0; i < nkf) { 440 let q: [8]u64 = [0...]; 441 442 br_aes_ct64_interleave_in(q[0..], q[4..], skey[i..]); 443 q[1] = q[0]; 444 q[2] = q[0]; 445 q[3] = q[0]; 446 q[5] = q[4]; 447 q[6] = q[4]; 448 q[7] = q[4]; 449 br_aes_ct64_ortho(q[..]); 450 comp_skey[j + 0] = (q[0] & 0x1111111111111111) 451 | (q[1] & 0x2222222222222222) 452 | (q[2] & 0x4444444444444444) 453 | (q[3] & 0x8888888888888888); 454 comp_skey[j + 1] = (q[4] & 0x1111111111111111) 455 | (q[5] & 0x2222222222222222) 456 | (q[6] & 0x4444444444444444) 457 | (q[7] & 0x8888888888888888); 458 459 i += 4; 460 j += 2; 461 }; 462 return num_rounds; 463 }; 464 465 fn br_range_dec32le(v: []u32, src: []u8) void = { 466 for (let i = 0z; len(src) > 0; i += 1) { 467 v[i] = endian::legetu32(src); 468 src = src[4..]; 469 }; 470 }; 471 472 fn br_range_enc32le(dest: []u8, w: []u32) void = { 473 for (let i = 0z; len(dest) > 0; i += 1) { 474 endian::leputu32(dest, w[i]); 475 dest = dest[4..]; 476 }; 477 }; 478 479 // see br_aes_ct64_skey_expand in src/inner.h of BearSSL 480 fn br_aes_ct64_skey_expand( 481 skey: []u64, 482 num_rounds: uint, 483 comp_skey: const []u64, 484 ) void = { 485 let n: uint = (num_rounds + 1) << 1; 486 for (let u = 0u, v = 0u; u < n) { 487 let x0 = 0u64, x1 = 0u64, x2 = 0u64, x3 = 0u64; 488 489 x0 = comp_skey[u]; 490 x1 = comp_skey[u]; 491 x2 = comp_skey[u]; 492 x3 = comp_skey[u]; 493 x0 &= 0x1111111111111111; 494 x1 &= 0x2222222222222222; 495 x2 &= 0x4444444444444444; 496 x3 &= 0x8888888888888888; 497 x1 >>= 1; 498 x2 >>= 2; 499 x3 >>= 3; 500 skey[v + 0] = (x0 << 4) - x0; 501 skey[v + 1] = (x1 << 4) - x1; 502 skey[v + 2] = (x2 << 4) - x2; 503 skey[v + 3] = (x3 << 4) - x3; 504 505 u += 1; 506 v += 4; 507 }; 508 }; 509 510 // aes_ct64_enc.c 511 512 fn add_round_key(q: []u64, sk: const []u64) void = { 513 q[0] ^= sk[0]; 514 q[1] ^= sk[1]; 515 q[2] ^= sk[2]; 516 q[3] ^= sk[3]; 517 q[4] ^= sk[4]; 518 q[5] ^= sk[5]; 519 q[6] ^= sk[6]; 520 q[7] ^= sk[7]; 521 }; 522 523 fn shift_rows(q: []u64) void = { 524 for (let i: int = 0; i < 8; i += 1) { 525 let x: u64 = q[i]; 526 q[i] = (x & 0x000000000000FFFF) 527 | ((x & 0x00000000FFF00000) >> 4) 528 | ((x & 0x00000000000F0000) << 12) 529 | ((x & 0x0000FF0000000000) >> 8) 530 | ((x & 0x000000FF00000000) << 8) 531 | ((x & 0xF000000000000000) >> 12) 532 | ((x & 0x0FFF000000000000) << 4); 533 }; 534 }; 535 536 fn mix_columns(q: []u64) void = { 537 let q0 = 0u64, q1 = 0u64, q2 = 0u64, q3 = 0u64, q4 = 0u64, q5 = 0u64, 538 q6 = 0u64, q7 = 0u64; 539 let r0 = 0u64, r1 = 0u64, r2 = 0u64, r3 = 0u64, r4 = 0u64, r5 = 0u64, 540 r6 = 0u64, r7 = 0u64; 541 542 q0 = q[0]; 543 q1 = q[1]; 544 q2 = q[2]; 545 q3 = q[3]; 546 q4 = q[4]; 547 q5 = q[5]; 548 q6 = q[6]; 549 q7 = q[7]; 550 r0 = (q0 >> 16) | (q0 << 48); 551 r1 = (q1 >> 16) | (q1 << 48); 552 r2 = (q2 >> 16) | (q2 << 48); 553 r3 = (q3 >> 16) | (q3 << 48); 554 r4 = (q4 >> 16) | (q4 << 48); 555 r5 = (q5 >> 16) | (q5 << 48); 556 r6 = (q6 >> 16) | (q6 << 48); 557 r7 = (q7 >> 16) | (q7 << 48); 558 559 q[0] = q7 ^ r7 ^ r0 ^ math::rotr64(q0 ^ r0, 32); 560 q[1] = q0 ^ r0 ^ q7 ^ r7 ^ r1 ^ math::rotr64(q1 ^ r1, 32); 561 q[2] = q1 ^ r1 ^ r2 ^ math::rotr64(q2 ^ r2, 32); 562 q[3] = q2 ^ r2 ^ q7 ^ r7 ^ r3 ^ math::rotr64(q3 ^ r3, 32); 563 q[4] = q3 ^ r3 ^ q7 ^ r7 ^ r4 ^ math::rotr64(q4 ^ r4, 32); 564 q[5] = q4 ^ r4 ^ r5 ^ math::rotr64(q5 ^ r5, 32); 565 q[6] = q5 ^ r5 ^ r6 ^ math::rotr64(q6 ^ r6, 32); 566 q[7] = q6 ^ r6 ^ r7 ^ math::rotr64(q7 ^ r7, 32); 567 }; 568 569 // see br_aes_ct64_bitslice_encrypt in src/inner.h of BearSSL 570 fn br_aes_ct64_bitslice_encrypt( 571 num_rounds: uint, 572 skey: const []u64, 573 q: []u64, 574 ) void = { 575 add_round_key(q, skey); 576 for (let u: uint = 1; u < num_rounds; u += 1) { 577 br_aes_ct64_bitslice_Sbox(q); 578 shift_rows(q); 579 mix_columns(q); 580 add_round_key(q, skey[(u << 3)..]); 581 }; 582 br_aes_ct64_bitslice_Sbox(q); 583 shift_rows(q); 584 add_round_key(q, skey[(num_rounds << 3)..]); 585 }; 586 587 // see br_aes_ct64_bitslice_invSbox in src/inner.h of BearSSL 588 fn br_aes_ct64_bitslice_invSbox(q: []u64) void = { 589 // See br_aes_ct_bitslice_invSbox(). This is the natural extension 590 // to 64-bit registers. 591 let q0 = 0u64, q1 = 0u64, q2 = 0u64, q3 = 0u64, q4 = 0u64, q5 = 0u64, 592 q6 = 0u64, q7 = 0u64; 593 594 q0 = ~q[0]; 595 q1 = ~q[1]; 596 q2 = q[2]; 597 q3 = q[3]; 598 q4 = q[4]; 599 q5 = ~q[5]; 600 q6 = ~q[6]; 601 q7 = q[7]; 602 q[7] = q1 ^ q4 ^ q6; 603 q[6] = q0 ^ q3 ^ q5; 604 q[5] = q7 ^ q2 ^ q4; 605 q[4] = q6 ^ q1 ^ q3; 606 q[3] = q5 ^ q0 ^ q2; 607 q[2] = q4 ^ q7 ^ q1; 608 q[1] = q3 ^ q6 ^ q0; 609 q[0] = q2 ^ q5 ^ q7; 610 611 br_aes_ct64_bitslice_Sbox(q); 612 613 q0 = ~q[0]; 614 q1 = ~q[1]; 615 q2 = q[2]; 616 q3 = q[3]; 617 q4 = q[4]; 618 q5 = ~q[5]; 619 q6 = ~q[6]; 620 q7 = q[7]; 621 q[7] = q1 ^ q4 ^ q6; 622 q[6] = q0 ^ q3 ^ q5; 623 q[5] = q7 ^ q2 ^ q4; 624 q[4] = q6 ^ q1 ^ q3; 625 q[3] = q5 ^ q0 ^ q2; 626 q[2] = q4 ^ q7 ^ q1; 627 q[1] = q3 ^ q6 ^ q0; 628 q[0] = q2 ^ q5 ^ q7; 629 }; 630 631 fn inv_shift_rows(q: []u64) void = { 632 for (let i: int = 0; i < 8; i += 1) { 633 let x: u64 = q[i]; 634 q[i] = (x & 0x000000000000FFFF) 635 | ((x & 0x000000000FFF0000) << 4) 636 | ((x & 0x00000000F0000000) >> 12) 637 | ((x & 0x000000FF00000000) << 8) 638 | ((x & 0x0000FF0000000000) >> 8) 639 | ((x & 0x000F000000000000) << 12) 640 | ((x & 0xFFF0000000000000) >> 4); 641 }; 642 }; 643 644 fn inv_mix_columns(q: []u64) void = { 645 let q0 = 0u64, q1 = 0u64, q2 = 0u64, q3 = 0u64, q4 = 0u64, q5 = 0u64, 646 q6 = 0u64, q7 = 0u64; 647 let r0 = 0u64, r1 = 0u64, r2 = 0u64, r3 = 0u64, r4 = 0u64, r5 = 0u64, 648 r6 = 0u64, r7 = 0u64; 649 650 q0 = q[0]; 651 q1 = q[1]; 652 q2 = q[2]; 653 q3 = q[3]; 654 q4 = q[4]; 655 q5 = q[5]; 656 q6 = q[6]; 657 q7 = q[7]; 658 r0 = (q0 >> 16) | (q0 << 48); 659 r1 = (q1 >> 16) | (q1 << 48); 660 r2 = (q2 >> 16) | (q2 << 48); 661 r3 = (q3 >> 16) | (q3 << 48); 662 r4 = (q4 >> 16) | (q4 << 48); 663 r5 = (q5 >> 16) | (q5 << 48); 664 r6 = (q6 >> 16) | (q6 << 48); 665 r7 = (q7 >> 16) | (q7 << 48); 666 667 q[0] = q5 ^ q6 ^ q7 ^ r0 ^ r5 ^ r7 668 ^ math::rotr64(q0 ^ q5 ^ q6 ^ r0 ^ r5, 32); 669 q[1] = q0 ^ q5 ^ r0 ^ r1 ^ r5 ^ r6 ^ r7 670 ^ math::rotr64(q1 ^ q5 ^ q7 ^ r1 ^ r5 ^ r6, 32); 671 q[2] = q0 ^ q1 ^ q6 ^ r1 ^ r2 ^ r6 ^ r7 672 ^ math::rotr64(q0 ^ q2 ^ q6 ^ r2 ^ r6 ^ r7, 32); 673 q[3] = q0 ^ q1 ^ q2 ^ q5 ^ q6 ^ r0 ^ r2 ^ r3 ^ r5 674 ^ math::rotr64(q0 ^ q1 ^ q3 ^ q5 ^ q6 ^ q7 ^ r0 ^ r3 ^ r5 ^ r7 675 , 32); 676 q[4] = q1 ^ q2 ^ q3 ^ q5 ^ r1 ^ r3 ^ r4 ^ r5 ^ r6 ^ r7 677 ^ math::rotr64(q1 ^ q2 ^ q4 ^ q5 ^ q7 ^ r1 ^ r4 ^ r5 ^ r6, 32); 678 q[5] = q2 ^ q3 ^ q4 ^ q6 ^ r2 ^ r4 ^ r5 ^ r6 ^ r7 679 ^ math::rotr64(q2 ^ q3 ^ q5 ^ q6 ^ r2 ^ r5 ^ r6 ^ r7, 32); 680 q[6] = q3 ^ q4 ^ q5 ^ q7 ^ r3 ^ r5 ^ r6 ^ r7 681 ^ math::rotr64(q3 ^ q4 ^ q6 ^ q7 ^ r3 ^ r6 ^ r7, 32); 682 q[7] = q4 ^ q5 ^ q6 ^ r4 ^ r6 ^ r7 683 ^ math::rotr64(q4 ^ q5 ^ q7 ^ r4 ^ r7, 32); 684 }; 685 686 // see br_aes_ct64_bitslice_decrypt in src/inner.h of BearSSL 687 fn br_aes_ct64_bitslice_decrypt( 688 num_rounds: size, 689 skey: const []u64, 690 q: []u64, 691 ) void = { 692 add_round_key(q, skey[(num_rounds << 3)..]); 693 for (let u: size = num_rounds - 1; u > 0; u -= 1) { 694 inv_shift_rows(q); 695 br_aes_ct64_bitslice_invSbox(q); 696 add_round_key(q, skey[(u << 3)..]); 697 inv_mix_columns(q); 698 }; 699 inv_shift_rows(q); 700 br_aes_ct64_bitslice_invSbox(q); 701 add_round_key(q, skey); 702 };