aes_x86core.c

OpenSSL 0.9.8k 最新版OpenSSL

#else
	t[0] =	Te0[(s0      ) & 0xff] ^
		Te1[(s1 >>  8) & 0xff] ^
		Te2[(s2 >> 16) & 0xff] ^
		Te3[(s3 >> 24)       ] ^
		rk[4];
	t[1] =	Te0[(s1      ) & 0xff] ^
		Te1[(s2 >>  8) & 0xff] ^
		Te2[(s3 >> 16) & 0xff] ^
		Te3[(s0 >> 24)       ] ^
		rk[5];
	t[2] =	Te0[(s2      ) & 0xff] ^
		Te1[(s3 >>  8) & 0xff] ^
		Te2[(s0 >> 16) & 0xff] ^
		Te3[(s1 >> 24)       ] ^
		rk[6];
	t[3] =	Te0[(s3      ) & 0xff] ^
		Te1[(s0 >>  8) & 0xff] ^
		Te2[(s1 >> 16) & 0xff] ^
		Te3[(s2 >> 24)       ] ^
		rk[7];
#endif
	s0 = t[0]; s1 = t[1]; s2 = t[2]; s3 = t[3];

    /*
     * Nr - 2 full rounds:
     */
    for (rk+=8,r=key->rounds-2; r>0; rk+=4,r--) {
#if defined(AES_COMPACT_IN_INNER_ROUNDS)
	t[0] =	Te4[(s0      ) & 0xff]       ^
		Te4[(s1 >>  8) & 0xff] <<  8 ^
		Te4[(s2 >> 16) & 0xff] << 16 ^
		Te4[(s3 >> 24)       ] << 24;
	t[1] =	Te4[(s1      ) & 0xff]       ^
		Te4[(s2 >>  8) & 0xff] <<  8 ^
		Te4[(s3 >> 16) & 0xff] << 16 ^
		Te4[(s0 >> 24)       ] << 24;
	t[2] =	Te4[(s2      ) & 0xff]       ^
		Te4[(s3 >>  8) & 0xff] <<  8 ^
		Te4[(s0 >> 16) & 0xff] << 16 ^
		Te4[(s1 >> 24)       ] << 24;
	t[3] =	Te4[(s3      ) & 0xff]       ^
		Te4[(s0 >>  8) & 0xff] <<  8 ^
		Te4[(s1 >> 16) & 0xff] << 16 ^
		Te4[(s2 >> 24)       ] << 24;

	/* now do the linear transform using words */
	{	int i;
		u32 r0, r1, r2;

		for (i = 0; i < 4; i++) {
			r0 = t[i];
			r1 = r0 & 0x80808080;
			r2 = ((r0 & 0x7f7f7f7f) << 1) ^
				((r1 - (r1 >> 7)) & 0x1b1b1b1b);
#if defined(ROTATE)
			t[i] = r2 ^ ROTATE(r2,24) ^ ROTATE(r0,24) ^
				ROTATE(r0,16) ^ ROTATE(r0,8);
#else
			t[i] = r2 ^ ((r2 ^ r0) << 24) ^ ((r2 ^ r0) >> 8) ^
				(r0 << 16) ^ (r0 >> 16) ^
				(r0 << 8) ^ (r0 >> 24);
#endif
			t[i] ^= rk[i];
		}
	}
#else
	t[0] =	Te0[(s0      ) & 0xff] ^
		Te1[(s1 >>  8) & 0xff] ^
		Te2[(s2 >> 16) & 0xff] ^
		Te3[(s3 >> 24)       ] ^
		rk[0];
	t[1] =	Te0[(s1      ) & 0xff] ^
		Te1[(s2 >>  8) & 0xff] ^
		Te2[(s3 >> 16) & 0xff] ^
		Te3[(s0 >> 24)       ] ^
		rk[1];
	t[2] =	Te0[(s2      ) & 0xff] ^
		Te1[(s3 >>  8) & 0xff] ^
		Te2[(s0 >> 16) & 0xff] ^
		Te3[(s1 >> 24)       ] ^
		rk[2];
	t[3] =	Te0[(s3      ) & 0xff] ^
		Te1[(s0 >>  8) & 0xff] ^
		Te2[(s1 >> 16) & 0xff] ^
		Te3[(s2 >> 24)       ] ^
		rk[3];
#endif
	s0 = t[0]; s1 = t[1]; s2 = t[2]; s3 = t[3];
    }
    /*
	 * apply last round and
	 * map cipher state to byte array block:
	 */
#if defined(AES_COMPACT_IN_OUTER_ROUNDS)
	prefetch256(Te4);

	*(u32*)(out+0) =
		Te4[(s0      ) & 0xff]       ^
		Te4[(s1 >>  8) & 0xff] <<  8 ^
		Te4[(s2 >> 16) & 0xff] << 16 ^
		Te4[(s3 >> 24)       ] << 24 ^
		rk[0];
	*(u32*)(out+4) =
		Te4[(s1      ) & 0xff]       ^
		Te4[(s2 >>  8) & 0xff] <<  8 ^
		Te4[(s3 >> 16) & 0xff] << 16 ^
		Te4[(s0 >> 24)       ] << 24 ^
		rk[1];
	*(u32*)(out+8) =
		Te4[(s2      ) & 0xff]       ^
		Te4[(s3 >>  8) & 0xff] <<  8 ^
		Te4[(s0 >> 16) & 0xff] << 16 ^
		Te4[(s1 >> 24)       ] << 24 ^
		rk[2];
	*(u32*)(out+12) =
		Te4[(s3      ) & 0xff]       ^
		Te4[(s0 >>  8) & 0xff] <<  8 ^
		Te4[(s1 >> 16) & 0xff] << 16 ^
		Te4[(s2 >> 24)       ] << 24 ^
		rk[3];
#else
	*(u32*)(out+0) =
		(Te2[(s0      ) & 0xff] & 0x000000ffU) ^
		(Te3[(s1 >>  8) & 0xff] & 0x0000ff00U) ^
		(Te0[(s2 >> 16) & 0xff] & 0x00ff0000U) ^
		(Te1[(s3 >> 24)       ] & 0xff000000U) ^
		rk[0];
	*(u32*)(out+4) =
		(Te2[(s1      ) & 0xff] & 0x000000ffU) ^
		(Te3[(s2 >>  8) & 0xff] & 0x0000ff00U) ^
		(Te0[(s3 >> 16) & 0xff] & 0x00ff0000U) ^
		(Te1[(s0 >> 24)       ] & 0xff000000U) ^
		rk[1];
	*(u32*)(out+8) =
		(Te2[(s2      ) & 0xff] & 0x000000ffU) ^
		(Te3[(s3 >>  8) & 0xff] & 0x0000ff00U) ^
		(Te0[(s0 >> 16) & 0xff] & 0x00ff0000U) ^
		(Te1[(s1 >> 24)       ] & 0xff000000U) ^
		rk[2];
	*(u32*)(out+12) =
		(Te2[(s3      ) & 0xff] & 0x000000ffU) ^
		(Te3[(s0 >>  8) & 0xff] & 0x0000ff00U) ^
		(Te0[(s1 >> 16) & 0xff] & 0x00ff0000U) ^
		(Te1[(s2 >> 24)       ] & 0xff000000U) ^
		rk[3];
#endif
}

/*
 * Decrypt a single block
 * in and out can overlap
 */
void AES_decrypt(const unsigned char *in, unsigned char *out,
		 const AES_KEY *key) {

	const u32 *rk;
	u32 s0, s1, s2, s3, t[4];
	int r;

	assert(in && out && key);
	rk = key->rd_key;

	/*
	 * map byte array block to cipher state
	 * and add initial round key:
	 */
	s0 = GETU32(in     ) ^ rk[0];
	s1 = GETU32(in +  4) ^ rk[1];
	s2 = GETU32(in +  8) ^ rk[2];
	s3 = GETU32(in + 12) ^ rk[3];

#if defined(AES_COMPACT_IN_OUTER_ROUNDS)
	prefetch256(Td4);

        t[0] =	Td4[(s0      ) & 0xff]       ^
		Td4[(s3 >>  8) & 0xff] <<  8 ^
		Td4[(s2 >> 16) & 0xff] << 16 ^
		Td4[(s1 >> 24)       ] << 24;
        t[1] =	Td4[(s1      ) & 0xff]       ^
		Td4[(s0 >>  8) & 0xff] <<  8 ^
		Td4[(s3 >> 16) & 0xff] << 16 ^
		Td4[(s2 >> 24)       ] << 24;
        t[2] =	Td4[(s2      ) & 0xff]       ^
		Td4[(s1 >>  8) & 0xff] <<  8 ^
		Td4[(s0 >> 16) & 0xff] << 16 ^
		Td4[(s3 >> 24)       ] << 24;
        t[3] =	Td4[(s3      ) & 0xff]       ^
		Td4[(s2 >>  8) & 0xff] <<  8 ^
		Td4[(s1 >> 16) & 0xff] << 16 ^
		Td4[(s0 >> 24)       ] << 24;

	/* now do the linear transform using words */ 
	{	int i;
		u32 tp1, tp2, tp4, tp8, tp9, tpb, tpd, tpe, m;

		for (i = 0; i < 4; i++) {
			tp1 = t[i];
			m = tp1 & 0x80808080;
			tp2 = ((tp1 & 0x7f7f7f7f) << 1) ^
				((m - (m >> 7)) & 0x1b1b1b1b);
			m = tp2 & 0x80808080;
			tp4 = ((tp2 & 0x7f7f7f7f) << 1) ^
				((m - (m >> 7)) & 0x1b1b1b1b);
			m = tp4 & 0x80808080;
			tp8 = ((tp4 & 0x7f7f7f7f) << 1) ^
				((m - (m >> 7)) & 0x1b1b1b1b);
			tp9 = tp8 ^ tp1;
			tpb = tp9 ^ tp2;
			tpd = tp9 ^ tp4;
			tpe = tp8 ^ tp4 ^ tp2;
#if defined(ROTATE)
			t[i] = tpe ^ ROTATE(tpd,16) ^
				ROTATE(tp9,8) ^ ROTATE(tpb,24);
#else
			t[i] = tpe ^ (tpd >> 16) ^ (tpd << 16) ^ 
				(tp9 >> 24) ^ (tp9 << 8) ^
				(tpb >> 8) ^ (tpb << 24);
#endif
			t[i] ^= rk[4+i];
		}
	}
#else
	t[0] =	Td0[(s0      ) & 0xff] ^
		Td1[(s3 >>  8) & 0xff] ^
		Td2[(s2 >> 16) & 0xff] ^
		Td3[(s1 >> 24)       ] ^
		rk[4];
	t[1] =	Td0[(s1      ) & 0xff] ^
		Td1[(s0 >>  8) & 0xff] ^
		Td2[(s3 >> 16) & 0xff] ^
		Td3[(s2 >> 24)       ] ^
		rk[5];
	t[2] =	Td0[(s2      ) & 0xff] ^
		Td1[(s1 >>  8) & 0xff] ^
		Td2[(s0 >> 16) & 0xff] ^
		Td3[(s3 >> 24)       ] ^
		rk[6];
	t[3] =	Td0[(s3      ) & 0xff] ^
		Td1[(s2 >>  8) & 0xff] ^
		Td2[(s1 >> 16) & 0xff] ^
		Td3[(s0 >> 24)       ] ^
		rk[7];
#endif
	s0 = t[0]; s1 = t[1]; s2 = t[2]; s3 = t[3];

    /*
     * Nr - 2 full rounds:
     */
    for (rk+=8,r=key->rounds-2; r>0; rk+=4,r--) {
#if defined(AES_COMPACT_IN_INNER_ROUNDS)
        t[0] =	Td4[(s0      ) & 0xff]       ^
		Td4[(s3 >>  8) & 0xff] <<  8 ^
		Td4[(s2 >> 16) & 0xff] << 16 ^
		Td4[(s1 >> 24)       ] << 24;
        t[1] =	Td4[(s1      ) & 0xff]       ^
		Td4[(s0 >>  8) & 0xff] <<  8 ^
		Td4[(s3 >> 16) & 0xff] << 16 ^
		Td4[(s2 >> 24)       ] << 24;
        t[2] =	Td4[(s2      ) & 0xff]       ^
		Td4[(s1 >>  8) & 0xff] <<  8 ^
		Td4[(s0 >> 16) & 0xff] << 16 ^
		Td4[(s3 >> 24)       ] << 24;
        t[3] =	Td4[(s3      ) & 0xff]       ^
		Td4[(s2 >>  8) & 0xff] <<  8 ^
		Td4[(s1 >> 16) & 0xff] << 16 ^
		Td4[(s0 >> 24)       ] << 24;

	/* now do the linear transform using words */ 
	{	int i;
		u32 tp1, tp2, tp4, tp8, tp9, tpb, tpd, tpe, m;

		for (i = 0; i < 4; i++) {
			tp1 = t[i];
			m = tp1 & 0x80808080;
			tp2 = ((tp1 & 0x7f7f7f7f) << 1) ^
				((m - (m >> 7)) & 0x1b1b1b1b);
			m = tp2 & 0x80808080;
			tp4 = ((tp2 & 0x7f7f7f7f) << 1) ^
				((m - (m >> 7)) & 0x1b1b1b1b);
			m = tp4 & 0x80808080;
			tp8 = ((tp4 & 0x7f7f7f7f) << 1) ^
				((m - (m >> 7)) & 0x1b1b1b1b);
			tp9 = tp8 ^ tp1;
			tpb = tp9 ^ tp2;
			tpd = tp9 ^ tp4;
			tpe = tp8 ^ tp4 ^ tp2;
#if defined(ROTATE)
			t[i] = tpe ^ ROTATE(tpd,16) ^
				ROTATE(tp9,8) ^ ROTATE(tpb,24);
#else
			t[i] = tpe ^ (tpd >> 16) ^ (tpd << 16) ^ 
				(tp9 >> 24) ^ (tp9 << 8) ^
				(tpb >> 8) ^ (tpb << 24);
#endif
			t[i] ^= rk[i];
		}
	}
#else
	t[0] =	Td0[(s0      ) & 0xff] ^
		Td1[(s3 >>  8) & 0xff] ^
		Td2[(s2 >> 16) & 0xff] ^
		Td3[(s1 >> 24)       ] ^
		rk[0];
	t[1] =	Td0[(s1      ) & 0xff] ^
		Td1[(s0 >>  8) & 0xff] ^
		Td2[(s3 >> 16) & 0xff] ^
		Td3[(s2 >> 24)       ] ^
		rk[1];
	t[2] =	Td0[(s2      ) & 0xff] ^
		Td1[(s1 >>  8) & 0xff] ^
		Td2[(s0 >> 16) & 0xff] ^
		Td3[(s3 >> 24)       ] ^
		rk[2];
	t[3] =	Td0[(s3      ) & 0xff] ^
		Td1[(s2 >>  8) & 0xff] ^
		Td2[(s1 >> 16) & 0xff] ^
		Td3[(s0 >> 24)       ] ^
		rk[3];
#endif
	s0 = t[0]; s1 = t[1]; s2 = t[2]; s3 = t[3];
    }
    /*
	 * apply last round and
	 * map cipher state to byte array block:
	 */
	prefetch256(Td4);

	*(u32*)(out+0) =
		(Td4[(s0      ) & 0xff])	^
		(Td4[(s3 >>  8) & 0xff] <<  8) ^
		(Td4[(s2 >> 16) & 0xff] << 16) ^
		(Td4[(s1 >> 24)       ] << 24) ^
		rk[0];
	*(u32*)(out+4) =
		(Td4[(s1      ) & 0xff])	 ^
		(Td4[(s0 >>  8) & 0xff] <<  8) ^
		(Td4[(s3 >> 16) & 0xff] << 16) ^
		(Td4[(s2 >> 24)       ] << 24) ^
		rk[1];
	*(u32*)(out+8) =
		(Td4[(s2      ) & 0xff])	 ^
		(Td4[(s1 >>  8) & 0xff] <<  8) ^
		(Td4[(s0 >> 16) & 0xff] << 16) ^
		(Td4[(s3 >> 24)       ] << 24) ^
		rk[2];
	*(u32*)(out+12) =
		(Td4[(s3      ) & 0xff])	 ^
		(Td4[(s2 >>  8) & 0xff] <<  8) ^
		(Td4[(s1 >> 16) & 0xff] << 16) ^
		(Td4[(s0 >> 24)       ] << 24) ^
		rk[3];
}