rbnacl-libsodium 0.4.5a

data/vendor/libsodium/src/libsodium/crypto_stream/aes256estream/hongjun/aes-table.h

@@ -0,0 +1,56 @@
+
+#ifndef __AES_TABLE_H__
+#define __AES_TABLE_H__
+
+#ifdef NATIVE_LITTLE_ENDIAN
+# include "aes-table-le.h"
+#elif defined(NATIVE_BIG_ENDIAN)
+# include "aes-table-be.h"
+#else
+# error Unsupported byte ordering
+#endif
+
+static const unsigned char Rcon[31] =
+{
+        0x0, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20,
+        0x40, 0x80, 0x1b, 0x36, 0x6c, 0xc0,
+        0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc,
+        0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4,
+        0xb3, 0x7d, 0xfa, 0xef, 0xc5, 0x91
+};
+
+
+static const unsigned char Sbox[256] = {
+        0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5,
+        0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76,
+        0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0,
+        0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0,
+        0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc,
+        0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15,
+        0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a,
+        0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75,
+        0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0,
+        0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84,
+        0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b,
+        0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf,
+        0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85,
+        0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8,
+        0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5,
+        0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2,
+        0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17,
+        0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73,
+        0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88,
+        0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb,
+        0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c,
+        0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79,
+        0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9,
+        0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08,
+        0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6,
+        0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a,
+        0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e,
+        0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e,
+        0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94,
+        0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf,
+        0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68,
+        0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16};
+#endif

data/vendor/libsodium/src/libsodium/crypto_stream/aes256estream/hongjun/aes256-ctr.c

@@ -0,0 +1,238 @@
+/* aes-ctr.c               */
+/* AES in CTR mode.        */
+
+/* Hongjun Wu, January 2007*/
+
+
+/* ------------------------------------------------------------------------- */
+
+#include "api.h"
+#include "aes256.h"
+
+#include <string.h>
+
+/* ------------------------------------------------------------------------- */
+/* key setup for AES-256*/
+static void
+ECRYPT_keysetup(ECRYPT_ctx* ctx, const u8* key, u32 keysize, u32 ivsize)
+{
+    unsigned int w[Nk*(Nr+1)], temp;
+    int i, j;
+
+    (void) keysize;
+    (void) ivsize;
+    (void) sizeof(char[sizeof *ctx == crypto_stream_BEFORENMBYTES ? 1 : -1]);
+
+    for( i = 0; i < Nk; i++ ) {
+        w[i] =  key[(i << 2)];
+        w[i] |= key[(i << 2)+1] << 8;
+        w[i] |= key[(i << 2)+2] << 16;
+        w[i] |= key[(i << 2)+3] << 24;
+    }
+
+    i = Nk;
+
+    while( i < Nb*(Nr+1) ) {
+        temp = w[i-1];
+
+        temp = Sbox[ temp & 0xFF] <<  24 ^
+            Sbox[(temp >> 8) & 0xFF]  ^
+            (Sbox[(temp >> 16) & 0xFF] << 8 ) ^
+            (Sbox[(temp >> 24) & 0xFF] << 16) ^
+            Rcon[i/Nk];
+        w[i] = w[i-Nk] ^ temp;
+        i++;
+
+        temp = w[i-1];
+        w[i] = w[i-Nk] ^ temp;
+        i++;
+
+        temp = w[i-1];
+        w[i] = w[i-Nk] ^ temp;
+        i++;
+
+        temp = w[i-1];
+        w[i] = w[i-Nk] ^ temp;
+        i++;
+
+        temp = w[i-1];
+        temp = Sbox[ temp & 0xFF] ^
+            Sbox[(temp >> 8) & 0xFF] << 8 ^
+            (Sbox[(temp >> 16) & 0xFF] << 16 ) ^
+            (Sbox[(temp >> 24) & 0xFF] << 24);
+        w[i] = w[i-Nk] ^ temp;
+        i++;
+
+        temp = w[i-1];
+        w[i] = w[i-Nk] ^ temp;
+        i++;
+
+        temp = w[i-1];
+        w[i] = w[i-Nk] ^ temp;
+        i++;
+
+        temp = w[i-1];
+        w[i] = w[i-Nk] ^ temp;
+        i++;
+    }
+
+    for (i = 0; i <= Nr; i++) {
+        for (j = 0; j < Nb; j++) {
+            ctx->round_key[i][j] = SWP32(w[(i<<2)+j]);
+        }
+    }
+}
+
+/* ------------------------------------------------------------------------- */
+
+static void
+ECRYPT_ivsetup(ECRYPT_ctx* ctx, const u8* iv)
+{
+    (void) sizeof(char[(sizeof ctx->counter) == crypto_stream_NONCEBYTES ? 1 : -1]);
+    memcpy(ctx->counter, iv, crypto_stream_NONCEBYTES);
+}
+
+/* ------------------------------------------------------------------------- */
+
+/*compute the intermediate values for the first two rounds*/
+static void
+partial_precompute_tworounds(ECRYPT_ctx* ctx)
+{
+  u32 x0,x1,x2,x3,y0,y1,y2,y3;
+
+  x0 = ctx->counter[0] ^ ctx->round_key[0][0];
+  x1 = ctx->counter[1] ^ ctx->round_key[0][1];
+  x2 = ctx->counter[2] ^ ctx->round_key[0][2];
+  x3 = ctx->counter[3] ^ ctx->round_key[0][3];
+  x0 &= SWP32(0xffffff00);
+  round(ctx,x0,x1,x2,x3,y0,y1,y2,y3,1);
+  ctx->first_round_output_x0 = y0 ^ T0[0];
+  y0 = 0;
+  round(ctx,y0,y1,y2,y3,x0,x1,x2,x3,2);
+  ctx->second_round_output[0] = x0 ^ T0[0];
+  ctx->second_round_output[1] = x1 ^ T3[0];
+  ctx->second_round_output[2] = x2 ^ T2[0];
+  ctx->second_round_output[3] = x3 ^ T1[0];
+}
+
+/* ------------------------------------------------------------------------- */
+
+#ifndef CPU_ALIGNED_ACCESS_REQUIRED
+# define UNALIGNED_U32_READ(P, I) (((const u32 *)(const void *) (P))[(I)])
+#else
+static inline uint32_t
+UNALIGNED_U32_READ(const u8 * const p, const size_t i)
+{
+    uint32_t t;
+    (void) sizeof(int[sizeof(*p) == sizeof(char) ? 1 : -1]);
+    memcpy(&t, p + i * (sizeof t / sizeof *p), sizeof t);
+    return t;
+}
+#endif
+
+/* ------------------------------------------------------------------------- */
+
+static void
+ECRYPT_process_bytes(int action, ECRYPT_ctx* ctx, const u8* input, u8* output,
+                     u32 msglen)
+{
+    __attribute__((aligned(32))) u8 keystream[16];
+    u32 i;
+
+    (void) action;
+    memset(keystream, 0, sizeof keystream);
+    partial_precompute_tworounds(ctx);
+
+    for ( ; msglen >= 16; msglen -= 16, input += 16, output += 16) {
+        aes256_enc_block(ctx->counter, keystream, ctx);
+
+        ((u32*)output)[0] = UNALIGNED_U32_READ(input, 0) ^ ((u32*)keystream)[0] ^ ctx->round_key[Nr][0];
+        ((u32*)output)[1] = UNALIGNED_U32_READ(input, 1) ^ ((u32*)keystream)[1] ^ ctx->round_key[Nr][1];
+        ((u32*)output)[2] = UNALIGNED_U32_READ(input, 2) ^ ((u32*)keystream)[2] ^ ctx->round_key[Nr][2];
+        ((u32*)output)[3] = UNALIGNED_U32_READ(input, 3) ^ ((u32*)keystream)[3] ^ ctx->round_key[Nr][3];
+
+        ctx->counter[0] = SWP32(SWP32(ctx->counter[0]) + 1);
+
+        if ((ctx->counter[0] & SWP32(0xff))== 0) {
+            partial_precompute_tworounds(ctx);
+        }
+    }
+
+    if (msglen > 0) {
+        aes256_enc_block(ctx->counter, keystream, ctx);
+        ((u32*)keystream)[0] ^= ctx->round_key[Nr][0];
+        ((u32*)keystream)[1] ^= ctx->round_key[Nr][1];
+        ((u32*)keystream)[2] ^= ctx->round_key[Nr][2];
+        ((u32*)keystream)[3] ^= ctx->round_key[Nr][3];
+
+        for (i = 0; i < msglen; i ++) {
+            output[i] = input[i] ^ keystream[i];
+        }
+    }
+}
+
+/* ------------------------------------------------------------------------- */
+
+#include "ecrypt-sync.h"
+
+int
+crypto_stream_beforenm(unsigned char *c, const unsigned char *k)
+{
+    ECRYPT_ctx * const ctx = (ECRYPT_ctx *) c;
+
+    ECRYPT_keysetup(ctx, k, crypto_stream_KEYBYTES * 8,
+                    crypto_stream_NONCEBYTES * 8);
+    return 0;
+}
+
+int
+crypto_stream_afternm(unsigned char *outp, unsigned long long len,
+                      const unsigned char *noncep, const unsigned char *c)
+{
+    ECRYPT_ctx * const ctx = (ECRYPT_ctx *) c;
+    unsigned long long i;
+
+    ECRYPT_ivsetup(ctx, noncep);
+    for (i = 0U; i < len; ++i) {
+        outp[i] = 0U;
+    }
+    ECRYPT_encrypt_bytes(ctx, (u8 *) outp, (u8 *) outp, len);
+
+    return 0;
+}
+
+int
+crypto_stream_xor_afternm(unsigned char *outp, const unsigned char *inp,
+                          unsigned long long len, const unsigned char *noncep,
+                          const unsigned char *c)
+{
+    ECRYPT_ctx * const ctx = (ECRYPT_ctx *) c;
+
+    ECRYPT_ivsetup(ctx, noncep);
+    ECRYPT_encrypt_bytes(ctx, (const u8 *) inp, (u8 *) outp, len);
+
+    return 0;
+}
+
+int
+crypto_stream(unsigned char *out, unsigned long long outlen,
+              const unsigned char *n, const unsigned char *k)
+{
+    unsigned char d[crypto_stream_BEFORENMBYTES];
+    crypto_stream_beforenm(d, k);
+    crypto_stream_afternm(out, outlen, n, d);
+
+    return 0;
+}
+
+int crypto_stream_xor(unsigned char *out, const unsigned char *in,
+                      unsigned long long inlen, const unsigned char *n,
+                      const unsigned char *k)
+{
+    unsigned char d[crypto_stream_BEFORENMBYTES];
+
+    crypto_stream_beforenm(d, k);
+    crypto_stream_xor_afternm(out, in, inlen, n, d);
+
+    return 0;
+}

data/vendor/libsodium/src/libsodium/crypto_stream/aes256estream/hongjun/aes256.h

@@ -0,0 +1,171 @@
+/* aes256.h */
+/* Hongjun Wu, January 2007*/
+
+
+#include "ecrypt-sync.h"
+#include "aes-table.h"
+
+#include <stdio.h>
+
+#ifdef NATIVE_LITTLE_ENDIAN
+# define LEROT(X, S) ((uint8_t) ((uint32_t)(X) >> (S)))
+# define SWP32(X)    (X)
+#elif defined(NATIVE_BIG_ENDIAN)
+# define LEROT(X, S) ((uint8_t) ((uint32_t)(X) >> (24 - (S))))
+# define SWP32(X)    ((uint32_t)((((uint32_t)(X) & 0xff000000) >> 24) | \
+                                 (((uint32_t)(X) & 0x00ff0000) >>  8) | \
+                                 (((uint32_t)(X) & 0x0000ff00) <<  8) | \
+                                 (((uint32_t)(X) & 0x000000ff) << 24)))
+#else
+# error Unsupported byte ordering
+#endif
+
+#define first_round(ctx,x0,y0) { \
+        u32 z0,t0,tem0;              \
+        z0 = (x0) ^ ctx->round_key[0][0];        \
+        t0 = LEROT(z0, 0);                       \
+        tem0 = T0[t0];               \
+        (y0) = tem0 ^ ctx->first_round_output_x0;       \
+}
+
+#define second_round(ctx,x0,y0,y1,y2,y3) { \
+        u32 t0,t7,t10,t13; \
+        u32 tem0,tem7,tem10,tem13;    \
+        t0 = LEROT(x0, 0);            \
+        tem0 = T0[t0];      \
+        (y0) = tem0 ^ ctx->second_round_output[0];   \
+        t7 = LEROT(x0, 24);                          \
+        tem7 = T3[t7];    \
+        (y1) = tem7 ^ ctx->second_round_output[1];   \
+        t10 = LEROT(x0, 16);                 \
+        tem10 = T2[t10]; \
+        (y2) = tem10 ^ ctx->second_round_output[2];  \
+        t13 = LEROT(x0, 8);                  \
+        tem13 = T1[t13];\
+        (y3) = tem13 ^ ctx->second_round_output[3];  \
+}
+
+#define round(ctx,x0,x1,x2,x3,y0,y1,y2,y3,r) { \
+        u32 t0,t1,t2,t3;    \
+        u32 t4,t5,t6,t7;    \
+        u32 t8,t9,t10,t11;  \
+        u32 t12,t13,t14,t15;\
+        u32 tem0,tem1,tem2,tem3;    \
+        u32 tem4,tem5,tem6,tem7;    \
+        u32 tem8,tem9,tem10,tem11;  \
+        u32 tem12,tem13,tem14,tem15;\
+        \
+        t0 = LEROT(x0, 0);                      \
+        tem0 = T0[t0];      \
+        t1 = LEROT(x1, 8);       \
+        tem1 = tem0 ^ T1[t1];    \
+        t2 = LEROT(x2, 16);      \
+        tem2 = tem1 ^ T2[t2];    \
+        t3 = LEROT(x3, 24);      \
+        tem3 = tem2 ^ T3[t3];    \
+        (y0) = tem3 ^ ctx->round_key[r][0];   \
+        \
+        t4 = LEROT(x1, 0);                      \
+        tem4 = T0[t4];      \
+        t5 = LEROT(x2, 8);       \
+        tem5 = tem4 ^ T1[t5];    \
+        t6 = LEROT(x3, 16);      \
+        tem6 = tem5 ^ T2[t6];    \
+        t7 = LEROT(x0, 24);      \
+        tem7 = tem6 ^ T3[t7];    \
+        (y1) = tem7 ^ ctx->round_key[r][1];   \
+        \
+        t8 = LEROT(x2, 0);      \
+        tem8 = T0[t8];          \
+        t9 = LEROT(x3, 8);      \
+        tem9 = tem8 ^ T1[t9];   \
+        t10 = LEROT(x0, 16);            \
+        tem10 = tem9 ^ T2[t10]; \
+        t11 = LEROT(x1, 24);            \
+        tem11 = tem10 ^ T3[t11];\
+        (y2) = tem11 ^ ctx->round_key[r][2]; \
+        \
+        t12 = LEROT(x3, 0);     \
+        tem12 = T0[t12];        \
+        t13 = LEROT(x0, 8);                     \
+        tem13 = tem12 ^ T1[t13];\
+        t14 = LEROT(x1, 16);            \
+        tem14 = tem13 ^ T2[t14];\
+        t15 = LEROT(x2, 24);            \
+        tem15 = tem14 ^ T3[t15];\
+        (y3) = tem15 ^ ctx->round_key[r][3]; \
+}
+
+/* 22.14 cycles/byte*/
+#define last_round(ctx,x0,x1,x2,x3,output,r) { \
+        u32 t0,t1,t2,t3;    \
+        u32 t4,t5,t6,t7;    \
+        u32 t8,t9,t10,t11;  \
+        u32 t12,t13,t14,t15;\
+        \
+        t0 = LEROT(x0, 0); \
+        output[0] = Sbox[t0]; \
+        t7 = LEROT(x0, 24);                     \
+        output[7] = Sbox[t7]; \
+        t10 = LEROT(x0, 16);            \
+        output[10] = Sbox[t10]; \
+        t13 = LEROT(x0, 8);     \
+        output[13] = Sbox[t13]; \
+        \
+        t1 = LEROT(x1, 8);                      \
+        output[1] = Sbox[t1]; \
+        t4 = LEROT(x1, 0); \
+        output[4] = Sbox[t4]; \
+        t11 = LEROT(x1, 24);            \
+        output[11] = Sbox[t11]; \
+        t14 = LEROT(x1, 16);            \
+        output[14] = Sbox[t14]; \
+        \
+        t2 = LEROT(x2, 16);                     \
+        output[2] = Sbox[t2]; \
+        t5 = LEROT(x2, 8);                      \
+        output[5] = Sbox[t5]; \
+        t8 = LEROT(x2, 0);              \
+        output[8] = Sbox[t8]; \
+        t15 = LEROT(x2, 24);            \
+        output[15] = Sbox[t15]; \
+      \
+        t3 = LEROT(x3, 24);                     \
+        output[3] = Sbox[t3]; \
+        t6 = LEROT(x3, 16);                     \
+        output[6] = Sbox[t6]; \
+        t9 = LEROT(x3, 8);        \
+        output[9] = Sbox[t9];     \
+        t12 = LEROT(x3, 0);       \
+        output[12] = Sbox[t12];   \
+}
+
+#define aes256_enc_block(x,output,ctx) {\
+      u32 y0;\
+      u32 z0,z1,z2,z3;\
+      u32 a0,a1,a2,a3;\
+      u32 b0,b1,b2,b3;\
+      u32 c0,c1,c2,c3;\
+      u32 d0,d1,d2,d3;\
+      u32 e0,e1,e2,e3;\
+      u32 f0,f1,f2,f3;\
+      u32 g0,g1,g2,g3;\
+      u32 h0,h1,h2,h3;\
+      u32 i0,i1,i2,i3;\
+      u32 j0,j1,j2,j3;\
+      u32 k0,k1,k2,k3;\
+      first_round(ctx,x[0],y0);\
+      second_round(ctx,y0,z0,z1,z2,z3);\
+      round(ctx,z0,z1,z2,z3,a0,a1,a2,a3,3);\
+      round(ctx,a0,a1,a2,a3,b0,b1,b2,b3,4);\
+      round(ctx,b0,b1,b2,b3,c0,c1,c2,c3,5);\
+      round(ctx,c0,c1,c2,c3,d0,d1,d2,d3,6);\
+      round(ctx,d0,d1,d2,d3,e0,e1,e2,e3,7);\
+      round(ctx,e0,e1,e2,e3,f0,f1,f2,f3,8);\
+      round(ctx,f0,f1,f2,f3,g0,g1,g2,g3,9);\
+      round(ctx,g0,g1,g2,g3,h0,h1,h2,h3,10);\
+      round(ctx,h0,h1,h2,h3,i0,i1,i2,i3,11);\
+      round(ctx,i0,i1,i2,i3,j0,j1,j2,j3,12);\
+      round(ctx,j0,j1,j2,j3,k0,k1,k2,k3,13);\
+      last_round(ctx,k0,k1,k2,k3,(output),14);\
+}