visaljs 0.0.1 → 0.0.3

package/runtime/third_party/bearssl/src/symcipher/aes_big_enc.c

@@ -1,157 +0,0 @@
-/*
- * Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
- *
- * Permission is hereby granted, free of charge, to any person obtaining 
- * a copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, sublicense, and/or sell copies of the Software, and to
- * permit persons to whom the Software is furnished to do so, subject to
- * the following conditions:
- *
- * The above copyright notice and this permission notice shall be 
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
-
-#include "inner.h"
-
-#define S   br_aes_S
-
-static const uint32_t Ssm0[] = {
-	0xC66363A5, 0xF87C7C84, 0xEE777799, 0xF67B7B8D, 0xFFF2F20D, 0xD66B6BBD,
-	0xDE6F6FB1, 0x91C5C554, 0x60303050, 0x02010103, 0xCE6767A9, 0x562B2B7D,
-	0xE7FEFE19, 0xB5D7D762, 0x4DABABE6, 0xEC76769A, 0x8FCACA45, 0x1F82829D,
-	0x89C9C940, 0xFA7D7D87, 0xEFFAFA15, 0xB25959EB, 0x8E4747C9, 0xFBF0F00B,
-	0x41ADADEC, 0xB3D4D467, 0x5FA2A2FD, 0x45AFAFEA, 0x239C9CBF, 0x53A4A4F7,
-	0xE4727296, 0x9BC0C05B, 0x75B7B7C2, 0xE1FDFD1C, 0x3D9393AE, 0x4C26266A,
-	0x6C36365A, 0x7E3F3F41, 0xF5F7F702, 0x83CCCC4F, 0x6834345C, 0x51A5A5F4,
-	0xD1E5E534, 0xF9F1F108, 0xE2717193, 0xABD8D873, 0x62313153, 0x2A15153F,
-	0x0804040C, 0x95C7C752, 0x46232365, 0x9DC3C35E, 0x30181828, 0x379696A1,
-	0x0A05050F, 0x2F9A9AB5, 0x0E070709, 0x24121236, 0x1B80809B, 0xDFE2E23D,
-	0xCDEBEB26, 0x4E272769, 0x7FB2B2CD, 0xEA75759F, 0x1209091B, 0x1D83839E,
-	0x582C2C74, 0x341A1A2E, 0x361B1B2D, 0xDC6E6EB2, 0xB45A5AEE, 0x5BA0A0FB,
-	0xA45252F6, 0x763B3B4D, 0xB7D6D661, 0x7DB3B3CE, 0x5229297B, 0xDDE3E33E,
-	0x5E2F2F71, 0x13848497, 0xA65353F5, 0xB9D1D168, 0x00000000, 0xC1EDED2C,
-	0x40202060, 0xE3FCFC1F, 0x79B1B1C8, 0xB65B5BED, 0xD46A6ABE, 0x8DCBCB46,
-	0x67BEBED9, 0x7239394B, 0x944A4ADE, 0x984C4CD4, 0xB05858E8, 0x85CFCF4A,
-	0xBBD0D06B, 0xC5EFEF2A, 0x4FAAAAE5, 0xEDFBFB16, 0x864343C5, 0x9A4D4DD7,
-	0x66333355, 0x11858594, 0x8A4545CF, 0xE9F9F910, 0x04020206, 0xFE7F7F81,
-	0xA05050F0, 0x783C3C44, 0x259F9FBA, 0x4BA8A8E3, 0xA25151F3, 0x5DA3A3FE,
-	0x804040C0, 0x058F8F8A, 0x3F9292AD, 0x219D9DBC, 0x70383848, 0xF1F5F504,
-	0x63BCBCDF, 0x77B6B6C1, 0xAFDADA75, 0x42212163, 0x20101030, 0xE5FFFF1A,
-	0xFDF3F30E, 0xBFD2D26D, 0x81CDCD4C, 0x180C0C14, 0x26131335, 0xC3ECEC2F,
-	0xBE5F5FE1, 0x359797A2, 0x884444CC, 0x2E171739, 0x93C4C457, 0x55A7A7F2,
-	0xFC7E7E82, 0x7A3D3D47, 0xC86464AC, 0xBA5D5DE7, 0x3219192B, 0xE6737395,
-	0xC06060A0, 0x19818198, 0x9E4F4FD1, 0xA3DCDC7F, 0x44222266, 0x542A2A7E,
-	0x3B9090AB, 0x0B888883, 0x8C4646CA, 0xC7EEEE29, 0x6BB8B8D3, 0x2814143C,
-	0xA7DEDE79, 0xBC5E5EE2, 0x160B0B1D, 0xADDBDB76, 0xDBE0E03B, 0x64323256,
-	0x743A3A4E, 0x140A0A1E, 0x924949DB, 0x0C06060A, 0x4824246C, 0xB85C5CE4,
-	0x9FC2C25D, 0xBDD3D36E, 0x43ACACEF, 0xC46262A6, 0x399191A8, 0x319595A4,
-	0xD3E4E437, 0xF279798B, 0xD5E7E732, 0x8BC8C843, 0x6E373759, 0xDA6D6DB7,
-	0x018D8D8C, 0xB1D5D564, 0x9C4E4ED2, 0x49A9A9E0, 0xD86C6CB4, 0xAC5656FA,
-	0xF3F4F407, 0xCFEAEA25, 0xCA6565AF, 0xF47A7A8E, 0x47AEAEE9, 0x10080818,
-	0x6FBABAD5, 0xF0787888, 0x4A25256F, 0x5C2E2E72, 0x381C1C24, 0x57A6A6F1,
-	0x73B4B4C7, 0x97C6C651, 0xCBE8E823, 0xA1DDDD7C, 0xE874749C, 0x3E1F1F21,
-	0x964B4BDD, 0x61BDBDDC, 0x0D8B8B86, 0x0F8A8A85, 0xE0707090, 0x7C3E3E42,
-	0x71B5B5C4, 0xCC6666AA, 0x904848D8, 0x06030305, 0xF7F6F601, 0x1C0E0E12,
-	0xC26161A3, 0x6A35355F, 0xAE5757F9, 0x69B9B9D0, 0x17868691, 0x99C1C158,
-	0x3A1D1D27, 0x279E9EB9, 0xD9E1E138, 0xEBF8F813, 0x2B9898B3, 0x22111133,
-	0xD26969BB, 0xA9D9D970, 0x078E8E89, 0x339494A7, 0x2D9B9BB6, 0x3C1E1E22,
-	0x15878792, 0xC9E9E920, 0x87CECE49, 0xAA5555FF, 0x50282878, 0xA5DFDF7A,
-	0x038C8C8F, 0x59A1A1F8, 0x09898980, 0x1A0D0D17, 0x65BFBFDA, 0xD7E6E631,
-	0x844242C6, 0xD06868B8, 0x824141C3, 0x299999B0, 0x5A2D2D77, 0x1E0F0F11,
-	0x7BB0B0CB, 0xA85454FC, 0x6DBBBBD6, 0x2C16163A
-};
-
-static inline uint32_t
-rotr(uint32_t x, int n)
-{
-	return (x << (32 - n)) | (x >> n);
-}
-
-#define SboxExt0(x)   (Ssm0[x])
-#define SboxExt1(x)   (rotr(Ssm0[x], 8))
-#define SboxExt2(x)   (rotr(Ssm0[x], 16))
-#define SboxExt3(x)   (rotr(Ssm0[x], 24))
-
-
-/* see bearssl.h */
-void
-br_aes_big_encrypt(unsigned num_rounds, const uint32_t *skey, void *data)
-{
-	unsigned char *buf;
-	uint32_t s0, s1, s2, s3;
-	uint32_t t0, t1, t2, t3;
-	unsigned u;
-
-	buf = data;
-	s0 = br_dec32be(buf);
-	s1 = br_dec32be(buf + 4);
-	s2 = br_dec32be(buf + 8);
-	s3 = br_dec32be(buf + 12);
-	s0 ^= skey[0];
-	s1 ^= skey[1];
-	s2 ^= skey[2];
-	s3 ^= skey[3];
-	for (u = 1; u < num_rounds; u ++) {
-		uint32_t v0, v1, v2, v3;
-
-		v0 = SboxExt0(s0 >> 24)
-			^ SboxExt1((s1 >> 16) & 0xFF)
-			^ SboxExt2((s2 >> 8) & 0xFF)
-			^ SboxExt3(s3 & 0xFF);
-		v1 = SboxExt0(s1 >> 24)
-			^ SboxExt1((s2 >> 16) & 0xFF)
-			^ SboxExt2((s3 >> 8) & 0xFF)
-			^ SboxExt3(s0 & 0xFF);
-		v2 = SboxExt0(s2 >> 24)
-			^ SboxExt1((s3 >> 16) & 0xFF)
-			^ SboxExt2((s0 >> 8) & 0xFF)
-			^ SboxExt3(s1 & 0xFF);
-		v3 = SboxExt0(s3 >> 24)
-			^ SboxExt1((s0 >> 16) & 0xFF)
-			^ SboxExt2((s1 >> 8) & 0xFF)
-			^ SboxExt3(s2 & 0xFF);
-		s0 = v0;
-		s1 = v1;
-		s2 = v2;
-		s3 = v3;
-		s0 ^= skey[u << 2];
-		s1 ^= skey[(u << 2) + 1];
-		s2 ^= skey[(u << 2) + 2];
-		s3 ^= skey[(u << 2) + 3];
-	}
-	t0 = ((uint32_t)S[s0 >> 24] << 24)
-		| ((uint32_t)S[(s1 >> 16) & 0xFF] << 16)
-		| ((uint32_t)S[(s2 >> 8) & 0xFF] << 8)
-		| (uint32_t)S[s3 & 0xFF];
-	t1 = ((uint32_t)S[s1 >> 24] << 24)
-		| ((uint32_t)S[(s2 >> 16) & 0xFF] << 16)
-		| ((uint32_t)S[(s3 >> 8) & 0xFF] << 8)
-		| (uint32_t)S[s0 & 0xFF];
-	t2 = ((uint32_t)S[s2 >> 24] << 24)
-		| ((uint32_t)S[(s3 >> 16) & 0xFF] << 16)
-		| ((uint32_t)S[(s0 >> 8) & 0xFF] << 8)
-		| (uint32_t)S[s1 & 0xFF];
-	t3 = ((uint32_t)S[s3 >> 24] << 24)
-		| ((uint32_t)S[(s0 >> 16) & 0xFF] << 16)
-		| ((uint32_t)S[(s1 >> 8) & 0xFF] << 8)
-		| (uint32_t)S[s2 & 0xFF];
-	s0 = t0 ^ skey[num_rounds << 2];
-	s1 = t1 ^ skey[(num_rounds << 2) + 1];
-	s2 = t2 ^ skey[(num_rounds << 2) + 2];
-	s3 = t3 ^ skey[(num_rounds << 2) + 3];
-	br_enc32be(buf, s0);
-	br_enc32be(buf + 4, s1);
-	br_enc32be(buf + 8, s2);
-	br_enc32be(buf + 12, s3);
-}

package/runtime/third_party/bearssl/src/symcipher/aes_common.c

@@ -1,112 +0,0 @@
-/*
- * Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
- *
- * Permission is hereby granted, free of charge, to any person obtaining 
- * a copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, sublicense, and/or sell copies of the Software, and to
- * permit persons to whom the Software is furnished to do so, subject to
- * the following conditions:
- *
- * The above copyright notice and this permission notice shall be 
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
-
-#include "inner.h"
-
-static const uint32_t Rcon[] = {
-	0x01000000, 0x02000000, 0x04000000, 0x08000000, 0x10000000, 0x20000000,
-	0x40000000, 0x80000000, 0x1B000000, 0x36000000
-};
-
-#define S   br_aes_S
-
-/* see inner.h */
-const unsigned char br_aes_S[] = {
-	0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B,
-	0xFE, 0xD7, 0xAB, 0x76, 0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0,
-	0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0, 0xB7, 0xFD, 0x93, 0x26,
-	0x36, 0x3F, 0xF7, 0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,
-	0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2,
-	0xEB, 0x27, 0xB2, 0x75, 0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0,
-	0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84, 0x53, 0xD1, 0x00, 0xED,
-	0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,
-	0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 0x45, 0xF9, 0x02, 0x7F,
-	0x50, 0x3C, 0x9F, 0xA8, 0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5,
-	0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2, 0xCD, 0x0C, 0x13, 0xEC,
-	0x5F, 0x97, 0x44, 0x17, 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73,
-	0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 0x46, 0xEE, 0xB8, 0x14,
-	0xDE, 0x5E, 0x0B, 0xDB, 0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C,
-	0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79, 0xE7, 0xC8, 0x37, 0x6D,
-	0x8D, 0xD5, 0x4E, 0xA9, 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08,
-	0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 0xE8, 0xDD, 0x74, 0x1F,
-	0x4B, 0xBD, 0x8B, 0x8A, 0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E,
-	0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E, 0xE1, 0xF8, 0x98, 0x11,
-	0x69, 0xD9, 0x8E, 0x94, 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,
-	0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 0x41, 0x99, 0x2D, 0x0F,
-	0xB0, 0x54, 0xBB, 0x16
-};
-
-static uint32_t
-SubWord(uint32_t x)
-{
-	return ((uint32_t)S[x >> 24] << 24)
-		| ((uint32_t)S[(x >> 16) & 0xFF] << 16)
-		| ((uint32_t)S[(x >> 8) & 0xFF] << 8)
-		| (uint32_t)S[x & 0xFF];
-}
-
-/* see inner.h */
-unsigned
-br_aes_keysched(uint32_t *skey, const void *key, size_t key_len)
-{
-	unsigned num_rounds;
-	int i, j, k, nk, nkf;
-
-	switch (key_len) {
-	case 16:
-		num_rounds = 10;
-		break;
-	case 24:
-		num_rounds = 12;
-		break;
-	case 32:
-		num_rounds = 14;
-		break;
-	default:
-		/* abort(); */
-		return 0;
-	}
-	nk = (int)(key_len >> 2);
-	nkf = (int)((num_rounds + 1) << 2);
-	for (i = 0; i < nk; i ++) {
-		skey[i] = br_dec32be((const unsigned char *)key + (i << 2));
-	}
-	for (i = nk, j = 0, k = 0; i < nkf; i ++) {
-		uint32_t tmp;
-
-		tmp = skey[i - 1];
-		if (j == 0) {
-			tmp = (tmp << 8) | (tmp >> 24);
-			tmp = SubWord(tmp) ^ Rcon[k];
-		} else if (nk > 6 && j == 4) {
-			tmp = SubWord(tmp);
-		}
-		skey[i] = skey[i - nk] ^ tmp;
-		if (++ j == nk) {
-			j = 0;
-			k ++;
-		}
-	}
-	return num_rounds;
-}

package/runtime/third_party/bearssl/src/symcipher/aes_ct.c

@@ -1,328 +0,0 @@
-/*
- * Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
- *
- * Permission is hereby granted, free of charge, to any person obtaining 
- * a copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, sublicense, and/or sell copies of the Software, and to
- * permit persons to whom the Software is furnished to do so, subject to
- * the following conditions:
- *
- * The above copyright notice and this permission notice shall be 
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
-
-#include "inner.h"
-
-/* see inner.h */
-void
-br_aes_ct_bitslice_Sbox(uint32_t *q)
-{
-	/*
-	 * This S-box implementation is a straightforward translation of
-	 * the circuit described by Boyar and Peralta in "A new
-	 * combinational logic minimization technique with applications
-	 * to cryptology" (https://eprint.iacr.org/2009/191.pdf).
-	 *
-	 * Note that variables x* (input) and s* (output) are numbered
-	 * in "reverse" order (x0 is the high bit, x7 is the low bit).
-	 */
-
-	uint32_t x0, x1, x2, x3, x4, x5, x6, x7;
-	uint32_t y1, y2, y3, y4, y5, y6, y7, y8, y9;
-	uint32_t y10, y11, y12, y13, y14, y15, y16, y17, y18, y19;
-	uint32_t y20, y21;
-	uint32_t z0, z1, z2, z3, z4, z5, z6, z7, z8, z9;
-	uint32_t z10, z11, z12, z13, z14, z15, z16, z17;
-	uint32_t t0, t1, t2, t3, t4, t5, t6, t7, t8, t9;
-	uint32_t t10, t11, t12, t13, t14, t15, t16, t17, t18, t19;
-	uint32_t t20, t21, t22, t23, t24, t25, t26, t27, t28, t29;
-	uint32_t t30, t31, t32, t33, t34, t35, t36, t37, t38, t39;
-	uint32_t t40, t41, t42, t43, t44, t45, t46, t47, t48, t49;
-	uint32_t t50, t51, t52, t53, t54, t55, t56, t57, t58, t59;
-	uint32_t t60, t61, t62, t63, t64, t65, t66, t67;
-	uint32_t s0, s1, s2, s3, s4, s5, s6, s7;
-
-	x0 = q[7];
-	x1 = q[6];
-	x2 = q[5];
-	x3 = q[4];
-	x4 = q[3];
-	x5 = q[2];
-	x6 = q[1];
-	x7 = q[0];
-
-	/*
-	 * Top linear transformation.
-	 */
-	y14 = x3 ^ x5;
-	y13 = x0 ^ x6;
-	y9 = x0 ^ x3;
-	y8 = x0 ^ x5;
-	t0 = x1 ^ x2;
-	y1 = t0 ^ x7;
-	y4 = y1 ^ x3;
-	y12 = y13 ^ y14;
-	y2 = y1 ^ x0;
-	y5 = y1 ^ x6;
-	y3 = y5 ^ y8;
-	t1 = x4 ^ y12;
-	y15 = t1 ^ x5;
-	y20 = t1 ^ x1;
-	y6 = y15 ^ x7;
-	y10 = y15 ^ t0;
-	y11 = y20 ^ y9;
-	y7 = x7 ^ y11;
-	y17 = y10 ^ y11;
-	y19 = y10 ^ y8;
-	y16 = t0 ^ y11;
-	y21 = y13 ^ y16;
-	y18 = x0 ^ y16;
-
-	/*
-	 * Non-linear section.
-	 */
-	t2 = y12 & y15;
-	t3 = y3 & y6;
-	t4 = t3 ^ t2;
-	t5 = y4 & x7;
-	t6 = t5 ^ t2;
-	t7 = y13 & y16;
-	t8 = y5 & y1;
-	t9 = t8 ^ t7;
-	t10 = y2 & y7;
-	t11 = t10 ^ t7;
-	t12 = y9 & y11;
-	t13 = y14 & y17;
-	t14 = t13 ^ t12;
-	t15 = y8 & y10;
-	t16 = t15 ^ t12;
-	t17 = t4 ^ t14;
-	t18 = t6 ^ t16;
-	t19 = t9 ^ t14;
-	t20 = t11 ^ t16;
-	t21 = t17 ^ y20;
-	t22 = t18 ^ y19;
-	t23 = t19 ^ y21;
-	t24 = t20 ^ y18;
-
-	t25 = t21 ^ t22;
-	t26 = t21 & t23;
-	t27 = t24 ^ t26;
-	t28 = t25 & t27;
-	t29 = t28 ^ t22;
-	t30 = t23 ^ t24;
-	t31 = t22 ^ t26;
-	t32 = t31 & t30;
-	t33 = t32 ^ t24;
-	t34 = t23 ^ t33;
-	t35 = t27 ^ t33;
-	t36 = t24 & t35;
-	t37 = t36 ^ t34;
-	t38 = t27 ^ t36;
-	t39 = t29 & t38;
-	t40 = t25 ^ t39;
-
-	t41 = t40 ^ t37;
-	t42 = t29 ^ t33;
-	t43 = t29 ^ t40;
-	t44 = t33 ^ t37;
-	t45 = t42 ^ t41;
-	z0 = t44 & y15;
-	z1 = t37 & y6;
-	z2 = t33 & x7;
-	z3 = t43 & y16;
-	z4 = t40 & y1;
-	z5 = t29 & y7;
-	z6 = t42 & y11;
-	z7 = t45 & y17;
-	z8 = t41 & y10;
-	z9 = t44 & y12;
-	z10 = t37 & y3;
-	z11 = t33 & y4;
-	z12 = t43 & y13;
-	z13 = t40 & y5;
-	z14 = t29 & y2;
-	z15 = t42 & y9;
-	z16 = t45 & y14;
-	z17 = t41 & y8;
-
-	/*
-	 * Bottom linear transformation.
-	 */
-	t46 = z15 ^ z16;
-	t47 = z10 ^ z11;
-	t48 = z5 ^ z13;
-	t49 = z9 ^ z10;
-	t50 = z2 ^ z12;
-	t51 = z2 ^ z5;
-	t52 = z7 ^ z8;
-	t53 = z0 ^ z3;
-	t54 = z6 ^ z7;
-	t55 = z16 ^ z17;
-	t56 = z12 ^ t48;
-	t57 = t50 ^ t53;
-	t58 = z4 ^ t46;
-	t59 = z3 ^ t54;
-	t60 = t46 ^ t57;
-	t61 = z14 ^ t57;
-	t62 = t52 ^ t58;
-	t63 = t49 ^ t58;
-	t64 = z4 ^ t59;
-	t65 = t61 ^ t62;
-	t66 = z1 ^ t63;
-	s0 = t59 ^ t63;
-	s6 = t56 ^ ~t62;
-	s7 = t48 ^ ~t60;
-	t67 = t64 ^ t65;
-	s3 = t53 ^ t66;
-	s4 = t51 ^ t66;
-	s5 = t47 ^ t65;
-	s1 = t64 ^ ~s3;
-	s2 = t55 ^ ~t67;
-
-	q[7] = s0;
-	q[6] = s1;
-	q[5] = s2;
-	q[4] = s3;
-	q[3] = s4;
-	q[2] = s5;
-	q[1] = s6;
-	q[0] = s7;
-}
-
-/* see inner.h */
-void
-br_aes_ct_ortho(uint32_t *q)
-{
-#define SWAPN(cl, ch, s, x, y)   do { \
-		uint32_t a, b; \
-		a = (x); \
-		b = (y); \
-		(x) = (a & (uint32_t)cl) | ((b & (uint32_t)cl) << (s)); \
-		(y) = ((a & (uint32_t)ch) >> (s)) | (b & (uint32_t)ch); \
-	} while (0)
-
-#define SWAP2(x, y)   SWAPN(0x55555555, 0xAAAAAAAA, 1, x, y)
-#define SWAP4(x, y)   SWAPN(0x33333333, 0xCCCCCCCC, 2, x, y)
-#define SWAP8(x, y)   SWAPN(0x0F0F0F0F, 0xF0F0F0F0, 4, x, y)
-
-	SWAP2(q[0], q[1]);
-	SWAP2(q[2], q[3]);
-	SWAP2(q[4], q[5]);
-	SWAP2(q[6], q[7]);
-
-	SWAP4(q[0], q[2]);
-	SWAP4(q[1], q[3]);
-	SWAP4(q[4], q[6]);
-	SWAP4(q[5], q[7]);
-
-	SWAP8(q[0], q[4]);
-	SWAP8(q[1], q[5]);
-	SWAP8(q[2], q[6]);
-	SWAP8(q[3], q[7]);
-}
-
-static const unsigned char Rcon[] = {
-	0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1B, 0x36
-};
-
-static uint32_t
-sub_word(uint32_t x)
-{
-	uint32_t q[8];
-	int i;
-
-	for (i = 0; i < 8; i ++) {
-		q[i] = x;
-	}
-	br_aes_ct_ortho(q);
-	br_aes_ct_bitslice_Sbox(q);
-	br_aes_ct_ortho(q);
-	return q[0];
-}
-
-/* see inner.h */
-unsigned
-br_aes_ct_keysched(uint32_t *comp_skey, const void *key, size_t key_len)
-{
-	unsigned num_rounds;
-	int i, j, k, nk, nkf;
-	uint32_t tmp;
-	uint32_t skey[120];
-
-	switch (key_len) {
-	case 16:
-		num_rounds = 10;
-		break;
-	case 24:
-		num_rounds = 12;
-		break;
-	case 32:
-		num_rounds = 14;
-		break;
-	default:
-		/* abort(); */
-		return 0;
-	}
-	nk = (int)(key_len >> 2);
-	nkf = (int)((num_rounds + 1) << 2);
-	tmp = 0;
-	for (i = 0; i < nk; i ++) {
-		tmp = br_dec32le((const unsigned char *)key + (i << 2));
-		skey[(i << 1) + 0] = tmp;
-		skey[(i << 1) + 1] = tmp;
-	}
-	for (i = nk, j = 0, k = 0; i < nkf; i ++) {
-		if (j == 0) {
-			tmp = (tmp << 24) | (tmp >> 8);
-			tmp = sub_word(tmp) ^ Rcon[k];
-		} else if (nk > 6 && j == 4) {
-			tmp = sub_word(tmp);
-		}
-		tmp ^= skey[(i - nk) << 1];
-		skey[(i << 1) + 0] = tmp;
-		skey[(i << 1) + 1] = tmp;
-		if (++ j == nk) {
-			j = 0;
-			k ++;
-		}
-	}
-	for (i = 0; i < nkf; i += 4) {
-		br_aes_ct_ortho(skey + (i << 1));
-	}
-	for (i = 0, j = 0; i < nkf; i ++, j += 2) {
-		comp_skey[i] = (skey[j + 0] & 0x55555555)
-			| (skey[j + 1] & 0xAAAAAAAA);
-	}
-	return num_rounds;
-}
-
-/* see inner.h */
-void
-br_aes_ct_skey_expand(uint32_t *skey,
-	unsigned num_rounds, const uint32_t *comp_skey)
-{
-	unsigned u, v, n;
-
-	n = (num_rounds + 1) << 2;
-	for (u = 0, v = 0; u < n; u ++, v += 2) {
-		uint32_t x, y;
-
-		x = y = comp_skey[u];
-		x &= 0x55555555;
-		skey[v + 0] = x | (x << 1);
-		y &= 0xAAAAAAAA;
-		skey[v + 1] = y | (y >> 1);
-	}
-}