aes_ct64.ha (18342B)
1 // SPDX-License-Identifier: MPL-2.0 2 // (c) Hare authors <https://harelang.org> 3 4 // Constant time aes implementation optimized for 64bit CPUs. 5 // The code was ported from BearSSL, which contained the following notice: 6 // 7 // Copyright (c) 2016 Thomas Pornin <pornin@bolet.org> 8 // 9 // Permission is hereby granted, free of charge, to any person obtaining 10 // a copy of this software and associated documentation files (the 11 // "Software"), to deal in the Software without restriction, including 12 // without limitation the rights to use, copy, modify, merge, publish, 13 // distribute, sublicense, and/or sell copies of the Software, and to 14 // permit persons to whom the Software is furnished to do so, subject to 15 // the following conditions: 16 // 17 // The above copyright notice and this permission notice shall be 18 // included in all copies or substantial portions of the Software. 19 // 20 // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 21 // EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF 22 // MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 23 // NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS 24 // BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN 25 // ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN 26 // CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 27 // SOFTWARE. 28 use crypto::cipher; 29 use crypto::cipher::{blocksz,nparallel}; 30 use crypto::math; 31 use endian; 32 33 def CT64_EXPKEYSZ: size = 960; 34 def CT64_NPARALLEL: size = 4; 35 36 // Returns an AES [[crypto::cipher::block]] cipher implementation optimized for 37 // constant time operation on 64-bit systems. 38 // 39 // The caller must call [[ct64_init]] to add a key to the cipher before using 40 // the cipher, and must call [[crypto::cipher::finish]] when they are finished 41 // using the cipher to securely erase any secret data stored in the cipher 42 // state. 43 fn ct64() block = block { 44 vtable = &ct64_vtable, 45 ... 46 }; 47 48 const ct64_vtable: cipher::blockvtable = cipher::blockvtable { 49 blocksz = BLOCKSZ, 50 nparallel = CT64_NPARALLEL, 51 encrypt = &aes_ct64_encrypt, 52 decrypt = &aes_ct64_decrypt, 53 finish = &block_finish, 54 }; 55 56 // Initializes the ct64 AES implementation with an encryption key. 57 fn ct64_init(cipher: *block, key: []u8) void = { 58 let comp_skey: [30]u64 = [0...]; 59 cipher.rounds = br_aes_ct64_keysched(comp_skey[..], key, len(key)); 60 br_aes_ct64_skey_expand(ct64_expkey(cipher), cipher.rounds, comp_skey[..]); 61 }; 62 63 fn ct64_expkey(b: *block) []u64 = { 64 return (b.expkey[..]: *[*]u64)[..len(b.expkey)/size(u64)]; 65 }; 66 67 // Combines up to 4 blocks and encrypts them in one run 68 fn aes_ct64_encrypt(b: *cipher::block, dest: []u8, src: []u8) void = { 69 let b = b: *block; 70 71 assert(len(src) % blocksz(b) == 0 72 && (len(src) / blocksz(b)) <= nparallel(b), 73 "invalid block size"); 74 75 let nblocks = len(src) / blocksz(b); 76 77 let q: [8]u64 = [0...]; 78 let w: [16]u32 = [0...]; 79 80 br_range_dec32le(w, src); 81 for (let i = 0z; i < nblocks; i += 1) { 82 br_aes_ct64_interleave_in(q[i..], q[(i + 4)..], w[(i << 2)..]); 83 }; 84 85 br_aes_ct64_ortho(q); 86 br_aes_ct64_bitslice_encrypt(b.rounds, ct64_expkey(b), q); 87 br_aes_ct64_ortho(q); 88 89 for (let i = 0z; i < nblocks; i += 1) { 90 br_aes_ct64_interleave_out(w[(i << 2)..], q[i], q[i + 4]); 91 }; 92 93 br_range_enc32le(dest, w); 94 }; 95 96 // Combines up to 4 blocks and decrypts them in one run 97 fn aes_ct64_decrypt(b: *cipher::block, dest: []u8, src: []u8) void = { 98 let b = b: *block; 99 100 assert(len(src) % blocksz(b) == 0 101 && (len(src) / blocksz(b)) <= nparallel(b), 102 "invalid block size"); 103 104 const nblocks = len(src) / blocksz(b); 105 let q: [8]u64 = [0...]; 106 let w: [16]u32 = [0...]; 107 108 br_range_dec32le(w, src); 109 for (let i = 0z; i < nblocks; i += 1) { 110 br_aes_ct64_interleave_in(q[i..], q[(i + 4)..], w[(i << 2)..]); 111 }; 112 113 br_aes_ct64_ortho(q); 114 br_aes_ct64_bitslice_decrypt(b.rounds, ct64_expkey(b), q); 115 br_aes_ct64_ortho(q); 116 117 for (let i = 0z; i < nblocks; i += 1) { 118 br_aes_ct64_interleave_out(w[(i << 2)..], q[i], q[i + 4]); 119 }; 120 121 br_range_enc32le(dest, w); 122 }; 123 124 // see br_aes_ct64_ortho in src/inner.h of BearSSL 125 fn br_aes_ct64_ortho(q: []u64) void = { 126 swapn(0x5555555555555555, 0xAAAAAAAAAAAAAAAA, 1, &q[0], &q[1]); 127 swapn(0x5555555555555555, 0xAAAAAAAAAAAAAAAA, 1, &q[2], &q[3]); 128 swapn(0x5555555555555555, 0xAAAAAAAAAAAAAAAA, 1, &q[4], &q[5]); 129 swapn(0x5555555555555555, 0xAAAAAAAAAAAAAAAA, 1, &q[6], &q[7]); 130 131 swapn(0x3333333333333333, 0xCCCCCCCCCCCCCCCC, 2, &q[0], &q[2]); 132 swapn(0x3333333333333333, 0xCCCCCCCCCCCCCCCC, 2, &q[1], &q[3]); 133 swapn(0x3333333333333333, 0xCCCCCCCCCCCCCCCC, 2, &q[4], &q[6]); 134 swapn(0x3333333333333333, 0xCCCCCCCCCCCCCCCC, 2, &q[5], &q[7]); 135 136 swapn(0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 4, &q[0], &q[4]); 137 swapn(0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 4, &q[1], &q[5]); 138 swapn(0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 4, &q[2], &q[6]); 139 swapn(0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 4, &q[3], &q[7]); 140 }; 141 142 // This is a macro in the C version. 143 fn swapn(cl: u64, ch: u64, s: u32, x: *u64, y: *u64) void = { 144 let a: u64 = *x, b: u64 = *y; 145 146 *x = (a & cl) | ((b & cl) << s); 147 *y = ((a & ch) >> s) | (b & ch); 148 }; 149 150 151 // see br_aes_ct64_interleave_in in src/inner.h of BearSSL 152 fn br_aes_ct64_interleave_in(q0: []u64, q1: []u64, w: const []u32) void = { 153 let x0 = 0u64, x1 = 0u64, x2 = 0u64, x3 = 0u64; 154 155 x0 = w[0]; 156 x1 = w[1]; 157 x2 = w[2]; 158 x3 = w[3]; 159 x0 |= (x0 << 16); 160 x1 |= (x1 << 16); 161 x2 |= (x2 << 16); 162 x3 |= (x3 << 16); 163 x0 &= 0x0000FFFF0000FFFF; 164 x1 &= 0x0000FFFF0000FFFF; 165 x2 &= 0x0000FFFF0000FFFF; 166 x3 &= 0x0000FFFF0000FFFF; 167 x0 |= (x0 << 8); 168 x1 |= (x1 << 8); 169 x2 |= (x2 << 8); 170 x3 |= (x3 << 8); 171 x0 &= 0x00FF00FF00FF00FF; 172 x1 &= 0x00FF00FF00FF00FF; 173 x2 &= 0x00FF00FF00FF00FF; 174 x3 &= 0x00FF00FF00FF00FF; 175 q0[0] = x0 | (x2 << 8); 176 q1[0] = x1 | (x3 << 8); 177 }; 178 179 // see br_aes_ct64_interleave_out in src/inner.h of BearSSL 180 fn br_aes_ct64_interleave_out(w: []u32, q0: u64, q1: u64) void = { 181 let x0 = 0u64, x1 = 0u64, x2 = 0u64, x3 = 0u64; 182 183 x0 = q0 & 0x00FF00FF00FF00FF; 184 x1 = q1 & 0x00FF00FF00FF00FF; 185 x2 = (q0 >> 8) & 0x00FF00FF00FF00FF; 186 x3 = (q1 >> 8) & 0x00FF00FF00FF00FF; 187 x0 |= (x0 >> 8); 188 x1 |= (x1 >> 8); 189 x2 |= (x2 >> 8); 190 x3 |= (x3 >> 8); 191 x0 &= 0x0000FFFF0000FFFF; 192 x1 &= 0x0000FFFF0000FFFF; 193 x2 &= 0x0000FFFF0000FFFF; 194 x3 &= 0x0000FFFF0000FFFF; 195 w[0] = (x0 | (x0 >> 16)): u32; 196 w[1] = (x1 | (x1 >> 16)): u32; 197 w[2] = (x2 | (x2 >> 16)): u32; 198 w[3] = (x3 | (x3 >> 16)): u32; 199 }; 200 201 // see br_aes_ct64_bitslice_Sbox in src/inner.h of BearSSL 202 fn br_aes_ct64_bitslice_Sbox(q: []u64) void = { 203 // This S-box implementation is a straightforward translation of 204 // the circuit described by Boyar and Peralta in "A new 205 // combinational logic minimization technique with applications 206 // to cryptology" (https://eprint.iacr.org/2009/191.pdf). 207 // 208 // Note that variables x* (input) and s* (output) are numbered 209 // in "reverse" order (x0 is the high bit, x7 is the low bit). 210 211 let x0 = 0u64, x1 = 0u64, x2 = 0u64, x3 = 0u64, x4 = 0u64, x5 = 0u64, 212 x6 = 0u64, x7 = 0u64; 213 214 let y1 = 0u64, y2 = 0u64, y3 = 0u64, y4 = 0u64, y5 = 0u64, y6 = 0u64, 215 y7 = 0u64, y8 = 0u64, y9 = 0u64, y10 = 0u64, y11 = 0u64, 216 y12 = 0u64, y13 = 0u64, y14 = 0u64, y15 = 0u64, y16 = 0u64, 217 y17 = 0u64, y18 = 0u64, y19 = 0u64, y20 = 0u64, y21 = 0u64; 218 219 let z0 = 0u64, z1 = 0u64, z2 = 0u64, z3 = 0u64, z4 = 0u64, z5 = 0u64, 220 z6 = 0u64, z7 = 0u64, z8 = 0u64, z9 = 0u64, z10 = 0u64, 221 z11 = 0u64, z12 = 0u64, z13 = 0u64, z14 = 0u64, z15 = 0u64, 222 z16 = 0u64, z17 = 0u64; 223 224 let t0 = 0u64, t1 = 0u64, t2 = 0u64, t3 = 0u64, t4 = 0u64, 225 t5 = 0u64, t6 = 0u64, t7 = 0u64, t8 = 0u64, t9 = 0u64, 226 t10 = 0u64, t11 = 0u64, t12 = 0u64, t13 = 0u64, t14 = 0u64, 227 t15 = 0u64, t16 = 0u64, t17 = 0u64, t18 = 0u64, t19 = 0u64, 228 t20 = 0u64, t21 = 0u64, t22 = 0u64, t23 = 0u64, t24 = 0u64, 229 t25 = 0u64, t26 = 0u64, t27 = 0u64, t28 = 0u64, t29 = 0u64, 230 t30 = 0u64, t31 = 0u64, t32 = 0u64, t33 = 0u64, t34 = 0u64, 231 t35 = 0u64, t36 = 0u64, t37 = 0u64, t38 = 0u64, t39 = 0u64, 232 t40 = 0u64, t41 = 0u64, t42 = 0u64, t43 = 0u64, t44 = 0u64, 233 t45 = 0u64, t46 = 0u64, t47 = 0u64, t48 = 0u64, t49 = 0u64, 234 t50 = 0u64, t51 = 0u64, t52 = 0u64, t53 = 0u64, t54 = 0u64, 235 t55 = 0u64, t56 = 0u64, t57 = 0u64, t58 = 0u64, t59 = 0u64, 236 t60 = 0u64, t61 = 0u64, t62 = 0u64, t63 = 0u64, t64 = 0u64, 237 t65 = 0u64, t66 = 0u64, t67 = 0u64; 238 239 let s0 = 0u64, s1 = 0u64, s2 = 0u64, s3 = 0u64, s4 = 0u64, s5 = 0u64, 240 s6 = 0u64, s7 = 0u64; 241 242 x0 = q[7]; 243 x1 = q[6]; 244 x2 = q[5]; 245 x3 = q[4]; 246 x4 = q[3]; 247 x5 = q[2]; 248 x6 = q[1]; 249 x7 = q[0]; 250 251 // Top linear transformation. 252 y14 = x3 ^ x5; 253 y13 = x0 ^ x6; 254 y9 = x0 ^ x3; 255 y8 = x0 ^ x5; 256 t0 = x1 ^ x2; 257 y1 = t0 ^ x7; 258 y4 = y1 ^ x3; 259 y12 = y13 ^ y14; 260 y2 = y1 ^ x0; 261 y5 = y1 ^ x6; 262 y3 = y5 ^ y8; 263 t1 = x4 ^ y12; 264 y15 = t1 ^ x5; 265 y20 = t1 ^ x1; 266 y6 = y15 ^ x7; 267 y10 = y15 ^ t0; 268 y11 = y20 ^ y9; 269 y7 = x7 ^ y11; 270 y17 = y10 ^ y11; 271 y19 = y10 ^ y8; 272 y16 = t0 ^ y11; 273 y21 = y13 ^ y16; 274 y18 = x0 ^ y16; 275 276 // Non-linear section. 277 t2 = y12 & y15; 278 t3 = y3 & y6; 279 t4 = t3 ^ t2; 280 t5 = y4 & x7; 281 t6 = t5 ^ t2; 282 t7 = y13 & y16; 283 t8 = y5 & y1; 284 t9 = t8 ^ t7; 285 t10 = y2 & y7; 286 t11 = t10 ^ t7; 287 t12 = y9 & y11; 288 t13 = y14 & y17; 289 t14 = t13 ^ t12; 290 t15 = y8 & y10; 291 t16 = t15 ^ t12; 292 t17 = t4 ^ t14; 293 t18 = t6 ^ t16; 294 t19 = t9 ^ t14; 295 t20 = t11 ^ t16; 296 t21 = t17 ^ y20; 297 t22 = t18 ^ y19; 298 t23 = t19 ^ y21; 299 t24 = t20 ^ y18; 300 301 t25 = t21 ^ t22; 302 t26 = t21 & t23; 303 t27 = t24 ^ t26; 304 t28 = t25 & t27; 305 t29 = t28 ^ t22; 306 t30 = t23 ^ t24; 307 t31 = t22 ^ t26; 308 t32 = t31 & t30; 309 t33 = t32 ^ t24; 310 t34 = t23 ^ t33; 311 t35 = t27 ^ t33; 312 t36 = t24 & t35; 313 t37 = t36 ^ t34; 314 t38 = t27 ^ t36; 315 t39 = t29 & t38; 316 t40 = t25 ^ t39; 317 318 t41 = t40 ^ t37; 319 t42 = t29 ^ t33; 320 t43 = t29 ^ t40; 321 t44 = t33 ^ t37; 322 t45 = t42 ^ t41; 323 z0 = t44 & y15; 324 z1 = t37 & y6; 325 z2 = t33 & x7; 326 z3 = t43 & y16; 327 z4 = t40 & y1; 328 z5 = t29 & y7; 329 z6 = t42 & y11; 330 z7 = t45 & y17; 331 z8 = t41 & y10; 332 z9 = t44 & y12; 333 z10 = t37 & y3; 334 z11 = t33 & y4; 335 z12 = t43 & y13; 336 z13 = t40 & y5; 337 z14 = t29 & y2; 338 z15 = t42 & y9; 339 z16 = t45 & y14; 340 z17 = t41 & y8; 341 342 // Bottom linear transformation. 343 t46 = z15 ^ z16; 344 t47 = z10 ^ z11; 345 t48 = z5 ^ z13; 346 t49 = z9 ^ z10; 347 t50 = z2 ^ z12; 348 t51 = z2 ^ z5; 349 t52 = z7 ^ z8; 350 t53 = z0 ^ z3; 351 t54 = z6 ^ z7; 352 t55 = z16 ^ z17; 353 t56 = z12 ^ t48; 354 t57 = t50 ^ t53; 355 t58 = z4 ^ t46; 356 t59 = z3 ^ t54; 357 t60 = t46 ^ t57; 358 t61 = z14 ^ t57; 359 t62 = t52 ^ t58; 360 t63 = t49 ^ t58; 361 t64 = z4 ^ t59; 362 t65 = t61 ^ t62; 363 t66 = z1 ^ t63; 364 s0 = t59 ^ t63; 365 s6 = t56 ^ ~t62; 366 s7 = t48 ^ ~t60; 367 t67 = t64 ^ t65; 368 s3 = t53 ^ t66; 369 s4 = t51 ^ t66; 370 s5 = t47 ^ t65; 371 s1 = t64 ^ ~s3; 372 s2 = t55 ^ ~t67; 373 374 q[7] = s0; 375 q[6] = s1; 376 q[5] = s2; 377 q[4] = s3; 378 q[3] = s4; 379 q[2] = s5; 380 q[1] = s6; 381 q[0] = s7; 382 }; 383 384 const rcon: []u8 = [ 385 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1B, 0x36 386 ]; 387 388 fn sub_word(x: u32) u32 = { 389 let q: [8]u64 = [x, 0...]; 390 br_aes_ct64_ortho(q); 391 br_aes_ct64_bitslice_Sbox(q); 392 br_aes_ct64_ortho(q); 393 return q[0]: u32; 394 }; 395 396 // see br_aes_ct64_keysched in src/inner.h of BearSSL 397 fn br_aes_ct64_keysched( 398 comp_skey: []u64, 399 key: const []u8, 400 key_len: size, 401 ) uint = { 402 let num_rounds: uint = 0; 403 let nk: int = 0, nkf: int = 0; 404 let tmp: u32 = 0; 405 let skey: [60]u32 = [0...]; 406 407 switch (key_len) { 408 case 16 => 409 num_rounds = 10; 410 case 24 => 411 num_rounds = 12; 412 case 32 => 413 num_rounds = 14; 414 case => 415 assert(false, "invalid key length"); 416 }; 417 418 nk = (key_len >> 2): int; 419 nkf = ((num_rounds + 1) << 2): int; 420 br_range_dec32le(skey, key); 421 tmp = skey[(key_len >> 2) - 1]; 422 for (let i = nk, j = 0, k = 0; i < nkf; i += 1) { 423 if (j == 0) { 424 tmp = (tmp << 24) | (tmp >> 8); 425 tmp = sub_word(tmp) ^ rcon[k]; 426 } else if (nk > 6 && j == 4) { 427 tmp = sub_word(tmp); 428 }; 429 tmp ^= skey[i - nk]; 430 skey[i] = tmp; 431 j += 1; 432 if (j == nk) { 433 j = 0; 434 k += 1; 435 }; 436 }; 437 438 for (let i = 0, j = 0; i < nkf) { 439 let q: [8]u64 = [0...]; 440 441 br_aes_ct64_interleave_in(q[0..], q[4..], skey[i..]); 442 q[1] = q[0]; 443 q[2] = q[0]; 444 q[3] = q[0]; 445 q[5] = q[4]; 446 q[6] = q[4]; 447 q[7] = q[4]; 448 br_aes_ct64_ortho(q[..]); 449 comp_skey[j + 0] = (q[0] & 0x1111111111111111) 450 | (q[1] & 0x2222222222222222) 451 | (q[2] & 0x4444444444444444) 452 | (q[3] & 0x8888888888888888); 453 comp_skey[j + 1] = (q[4] & 0x1111111111111111) 454 | (q[5] & 0x2222222222222222) 455 | (q[6] & 0x4444444444444444) 456 | (q[7] & 0x8888888888888888); 457 458 i += 4; 459 j += 2; 460 }; 461 return num_rounds; 462 }; 463 464 fn br_range_dec32le(v: []u32, src: []u8) void = { 465 for (let i = 0z; len(src) > 0; i += 1) { 466 v[i] = endian::legetu32(src); 467 src = src[4..]; 468 }; 469 }; 470 471 fn br_range_enc32le(dest: []u8, w: []u32) void = { 472 for (let i = 0z; len(dest) > 0; i += 1) { 473 endian::leputu32(dest, w[i]); 474 dest = dest[4..]; 475 }; 476 }; 477 478 // see br_aes_ct64_skey_expand in src/inner.h of BearSSL 479 fn br_aes_ct64_skey_expand( 480 skey: []u64, 481 num_rounds: uint, 482 comp_skey: const []u64, 483 ) void = { 484 let n: uint = (num_rounds + 1) << 1; 485 for (let u = 0u, v = 0u; u < n) { 486 let x0 = 0u64, x1 = 0u64, x2 = 0u64, x3 = 0u64; 487 488 x0 = comp_skey[u]; 489 x1 = comp_skey[u]; 490 x2 = comp_skey[u]; 491 x3 = comp_skey[u]; 492 x0 &= 0x1111111111111111; 493 x1 &= 0x2222222222222222; 494 x2 &= 0x4444444444444444; 495 x3 &= 0x8888888888888888; 496 x1 >>= 1; 497 x2 >>= 2; 498 x3 >>= 3; 499 skey[v + 0] = (x0 << 4) - x0; 500 skey[v + 1] = (x1 << 4) - x1; 501 skey[v + 2] = (x2 << 4) - x2; 502 skey[v + 3] = (x3 << 4) - x3; 503 504 u += 1; 505 v += 4; 506 }; 507 }; 508 509 // aes_ct64_enc.c 510 511 fn add_round_key(q: []u64, sk: const []u64) void = { 512 q[0] ^= sk[0]; 513 q[1] ^= sk[1]; 514 q[2] ^= sk[2]; 515 q[3] ^= sk[3]; 516 q[4] ^= sk[4]; 517 q[5] ^= sk[5]; 518 q[6] ^= sk[6]; 519 q[7] ^= sk[7]; 520 }; 521 522 fn shift_rows(q: []u64) void = { 523 for (let i: int = 0; i < 8; i += 1) { 524 let x: u64 = q[i]; 525 q[i] = (x & 0x000000000000FFFF) 526 | ((x & 0x00000000FFF00000) >> 4) 527 | ((x & 0x00000000000F0000) << 12) 528 | ((x & 0x0000FF0000000000) >> 8) 529 | ((x & 0x000000FF00000000) << 8) 530 | ((x & 0xF000000000000000) >> 12) 531 | ((x & 0x0FFF000000000000) << 4); 532 }; 533 }; 534 535 fn mix_columns(q: []u64) void = { 536 let q0 = 0u64, q1 = 0u64, q2 = 0u64, q3 = 0u64, q4 = 0u64, q5 = 0u64, 537 q6 = 0u64, q7 = 0u64; 538 let r0 = 0u64, r1 = 0u64, r2 = 0u64, r3 = 0u64, r4 = 0u64, r5 = 0u64, 539 r6 = 0u64, r7 = 0u64; 540 541 q0 = q[0]; 542 q1 = q[1]; 543 q2 = q[2]; 544 q3 = q[3]; 545 q4 = q[4]; 546 q5 = q[5]; 547 q6 = q[6]; 548 q7 = q[7]; 549 r0 = (q0 >> 16) | (q0 << 48); 550 r1 = (q1 >> 16) | (q1 << 48); 551 r2 = (q2 >> 16) | (q2 << 48); 552 r3 = (q3 >> 16) | (q3 << 48); 553 r4 = (q4 >> 16) | (q4 << 48); 554 r5 = (q5 >> 16) | (q5 << 48); 555 r6 = (q6 >> 16) | (q6 << 48); 556 r7 = (q7 >> 16) | (q7 << 48); 557 558 q[0] = q7 ^ r7 ^ r0 ^ math::rotr64(q0 ^ r0, 32); 559 q[1] = q0 ^ r0 ^ q7 ^ r7 ^ r1 ^ math::rotr64(q1 ^ r1, 32); 560 q[2] = q1 ^ r1 ^ r2 ^ math::rotr64(q2 ^ r2, 32); 561 q[3] = q2 ^ r2 ^ q7 ^ r7 ^ r3 ^ math::rotr64(q3 ^ r3, 32); 562 q[4] = q3 ^ r3 ^ q7 ^ r7 ^ r4 ^ math::rotr64(q4 ^ r4, 32); 563 q[5] = q4 ^ r4 ^ r5 ^ math::rotr64(q5 ^ r5, 32); 564 q[6] = q5 ^ r5 ^ r6 ^ math::rotr64(q6 ^ r6, 32); 565 q[7] = q6 ^ r6 ^ r7 ^ math::rotr64(q7 ^ r7, 32); 566 }; 567 568 // see br_aes_ct64_bitslice_encrypt in src/inner.h of BearSSL 569 fn br_aes_ct64_bitslice_encrypt( 570 num_rounds: uint, 571 skey: const []u64, 572 q: []u64, 573 ) void = { 574 add_round_key(q, skey); 575 for (let u: uint = 1; u < num_rounds; u += 1) { 576 br_aes_ct64_bitslice_Sbox(q); 577 shift_rows(q); 578 mix_columns(q); 579 add_round_key(q, skey[(u << 3)..]); 580 }; 581 br_aes_ct64_bitslice_Sbox(q); 582 shift_rows(q); 583 add_round_key(q, skey[(num_rounds << 3)..]); 584 }; 585 586 // see br_aes_ct64_bitslice_invSbox in src/inner.h of BearSSL 587 fn br_aes_ct64_bitslice_invSbox(q: []u64) void = { 588 // See br_aes_ct_bitslice_invSbox(). This is the natural extension 589 // to 64-bit registers. 590 let q0 = 0u64, q1 = 0u64, q2 = 0u64, q3 = 0u64, q4 = 0u64, q5 = 0u64, 591 q6 = 0u64, q7 = 0u64; 592 593 q0 = ~q[0]; 594 q1 = ~q[1]; 595 q2 = q[2]; 596 q3 = q[3]; 597 q4 = q[4]; 598 q5 = ~q[5]; 599 q6 = ~q[6]; 600 q7 = q[7]; 601 q[7] = q1 ^ q4 ^ q6; 602 q[6] = q0 ^ q3 ^ q5; 603 q[5] = q7 ^ q2 ^ q4; 604 q[4] = q6 ^ q1 ^ q3; 605 q[3] = q5 ^ q0 ^ q2; 606 q[2] = q4 ^ q7 ^ q1; 607 q[1] = q3 ^ q6 ^ q0; 608 q[0] = q2 ^ q5 ^ q7; 609 610 br_aes_ct64_bitslice_Sbox(q); 611 612 q0 = ~q[0]; 613 q1 = ~q[1]; 614 q2 = q[2]; 615 q3 = q[3]; 616 q4 = q[4]; 617 q5 = ~q[5]; 618 q6 = ~q[6]; 619 q7 = q[7]; 620 q[7] = q1 ^ q4 ^ q6; 621 q[6] = q0 ^ q3 ^ q5; 622 q[5] = q7 ^ q2 ^ q4; 623 q[4] = q6 ^ q1 ^ q3; 624 q[3] = q5 ^ q0 ^ q2; 625 q[2] = q4 ^ q7 ^ q1; 626 q[1] = q3 ^ q6 ^ q0; 627 q[0] = q2 ^ q5 ^ q7; 628 }; 629 630 fn inv_shift_rows(q: []u64) void = { 631 for (let i: int = 0; i < 8; i += 1) { 632 let x: u64 = q[i]; 633 q[i] = (x & 0x000000000000FFFF) 634 | ((x & 0x000000000FFF0000) << 4) 635 | ((x & 0x00000000F0000000) >> 12) 636 | ((x & 0x000000FF00000000) << 8) 637 | ((x & 0x0000FF0000000000) >> 8) 638 | ((x & 0x000F000000000000) << 12) 639 | ((x & 0xFFF0000000000000) >> 4); 640 }; 641 }; 642 643 fn inv_mix_columns(q: []u64) void = { 644 let q0 = 0u64, q1 = 0u64, q2 = 0u64, q3 = 0u64, q4 = 0u64, q5 = 0u64, 645 q6 = 0u64, q7 = 0u64; 646 let r0 = 0u64, r1 = 0u64, r2 = 0u64, r3 = 0u64, r4 = 0u64, r5 = 0u64, 647 r6 = 0u64, r7 = 0u64; 648 649 q0 = q[0]; 650 q1 = q[1]; 651 q2 = q[2]; 652 q3 = q[3]; 653 q4 = q[4]; 654 q5 = q[5]; 655 q6 = q[6]; 656 q7 = q[7]; 657 r0 = (q0 >> 16) | (q0 << 48); 658 r1 = (q1 >> 16) | (q1 << 48); 659 r2 = (q2 >> 16) | (q2 << 48); 660 r3 = (q3 >> 16) | (q3 << 48); 661 r4 = (q4 >> 16) | (q4 << 48); 662 r5 = (q5 >> 16) | (q5 << 48); 663 r6 = (q6 >> 16) | (q6 << 48); 664 r7 = (q7 >> 16) | (q7 << 48); 665 666 q[0] = q5 ^ q6 ^ q7 ^ r0 ^ r5 ^ r7 667 ^ math::rotr64(q0 ^ q5 ^ q6 ^ r0 ^ r5, 32); 668 q[1] = q0 ^ q5 ^ r0 ^ r1 ^ r5 ^ r6 ^ r7 669 ^ math::rotr64(q1 ^ q5 ^ q7 ^ r1 ^ r5 ^ r6, 32); 670 q[2] = q0 ^ q1 ^ q6 ^ r1 ^ r2 ^ r6 ^ r7 671 ^ math::rotr64(q0 ^ q2 ^ q6 ^ r2 ^ r6 ^ r7, 32); 672 q[3] = q0 ^ q1 ^ q2 ^ q5 ^ q6 ^ r0 ^ r2 ^ r3 ^ r5 673 ^ math::rotr64(q0 ^ q1 ^ q3 ^ q5 ^ q6 ^ q7 ^ r0 ^ r3 ^ r5 ^ r7 674 , 32); 675 q[4] = q1 ^ q2 ^ q3 ^ q5 ^ r1 ^ r3 ^ r4 ^ r5 ^ r6 ^ r7 676 ^ math::rotr64(q1 ^ q2 ^ q4 ^ q5 ^ q7 ^ r1 ^ r4 ^ r5 ^ r6, 32); 677 q[5] = q2 ^ q3 ^ q4 ^ q6 ^ r2 ^ r4 ^ r5 ^ r6 ^ r7 678 ^ math::rotr64(q2 ^ q3 ^ q5 ^ q6 ^ r2 ^ r5 ^ r6 ^ r7, 32); 679 q[6] = q3 ^ q4 ^ q5 ^ q7 ^ r3 ^ r5 ^ r6 ^ r7 680 ^ math::rotr64(q3 ^ q4 ^ q6 ^ q7 ^ r3 ^ r6 ^ r7, 32); 681 q[7] = q4 ^ q5 ^ q6 ^ r4 ^ r6 ^ r7 682 ^ math::rotr64(q4 ^ q5 ^ q7 ^ r4 ^ r7, 32); 683 }; 684 685 // see br_aes_ct64_bitslice_decrypt in src/inner.h of BearSSL 686 fn br_aes_ct64_bitslice_decrypt( 687 num_rounds: size, 688 skey: const []u64, 689 q: []u64, 690 ) void = { 691 add_round_key(q, skey[(num_rounds << 3)..]); 692 for (let u: size = num_rounds - 1; u > 0; u -= 1) { 693 inv_shift_rows(q); 694 br_aes_ct64_bitslice_invSbox(q); 695 add_round_key(q, skey[(u << 3)..]); 696 inv_mix_columns(q); 697 }; 698 inv_shift_rows(q); 699 br_aes_ct64_bitslice_invSbox(q); 700 add_round_key(q, skey); 701 };