visaljs 0.0.2 → 0.0.4

package/runtime/third_party/bearssl/src/symcipher/aes_ct_ctrcbc.c

@@ -1,422 +0,0 @@
-/*
- * Copyright (c) 2017 Thomas Pornin <pornin@bolet.org>
- *
- * Permission is hereby granted, free of charge, to any person obtaining 
- * a copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, sublicense, and/or sell copies of the Software, and to
- * permit persons to whom the Software is furnished to do so, subject to
- * the following conditions:
- *
- * The above copyright notice and this permission notice shall be 
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
-
-#include "inner.h"
-
-/* see bearssl_block.h */
-void
-br_aes_ct_ctrcbc_init(br_aes_ct_ctrcbc_keys *ctx,
-	const void *key, size_t len)
-{
-	ctx->vtable = &br_aes_ct_ctrcbc_vtable;
-	ctx->num_rounds = br_aes_ct_keysched(ctx->skey, key, len);
-}
-
-static void
-xorbuf(void *dst, const void *src, size_t len)
-{
-	unsigned char *d;
-	const unsigned char *s;
-
-	d = dst;
-	s = src;
-	while (len -- > 0) {
-		*d ++ ^= *s ++;
-	}
-}
-
-/* see bearssl_block.h */
-void
-br_aes_ct_ctrcbc_ctr(const br_aes_ct_ctrcbc_keys *ctx,
-	void *ctr, void *data, size_t len)
-{
-	unsigned char *buf;
-	unsigned char *ivbuf;
-	uint32_t iv0, iv1, iv2, iv3;
-	uint32_t sk_exp[120];
-
-	br_aes_ct_skey_expand(sk_exp, ctx->num_rounds, ctx->skey);
-
-	/*
-	 * We keep the counter as four 32-bit values, with big-endian
-	 * convention, because that's what is expected for purposes of
-	 * incrementing the counter value.
-	 */
-	ivbuf = ctr;
-	iv0 = br_dec32be(ivbuf +  0);
-	iv1 = br_dec32be(ivbuf +  4);
-	iv2 = br_dec32be(ivbuf +  8);
-	iv3 = br_dec32be(ivbuf + 12);
-
-	buf = data;
-	while (len > 0) {
-		uint32_t q[8], carry;
-		unsigned char tmp[32];
-
-		/*
-		 * The bitslice implementation expects values in
-		 * little-endian convention, so we have to byteswap them.
-		 */
-		q[0] = br_swap32(iv0);
-		q[2] = br_swap32(iv1);
-		q[4] = br_swap32(iv2);
-		q[6] = br_swap32(iv3);
-		iv3 ++;
-		carry = ~(iv3 | -iv3) >> 31;
-		iv2 += carry;
-		carry &= -(~(iv2 | -iv2) >> 31);
-		iv1 += carry;
-		carry &= -(~(iv1 | -iv1) >> 31);
-		iv0 += carry;
-		q[1] = br_swap32(iv0);
-		q[3] = br_swap32(iv1);
-		q[5] = br_swap32(iv2);
-		q[7] = br_swap32(iv3);
-		if (len > 16) {
-			iv3 ++;
-			carry = ~(iv3 | -iv3) >> 31;
-			iv2 += carry;
-			carry &= -(~(iv2 | -iv2) >> 31);
-			iv1 += carry;
-			carry &= -(~(iv1 | -iv1) >> 31);
-			iv0 += carry;
-		}
-
-		br_aes_ct_ortho(q);
-		br_aes_ct_bitslice_encrypt(ctx->num_rounds, sk_exp, q);
-		br_aes_ct_ortho(q);
-
-		br_enc32le(tmp, q[0]);
-		br_enc32le(tmp + 4, q[2]);
-		br_enc32le(tmp + 8, q[4]);
-		br_enc32le(tmp + 12, q[6]);
-		br_enc32le(tmp + 16, q[1]);
-		br_enc32le(tmp + 20, q[3]);
-		br_enc32le(tmp + 24, q[5]);
-		br_enc32le(tmp + 28, q[7]);
-
-		if (len <= 32) {
-			xorbuf(buf, tmp, len);
-			break;
-		}
-		xorbuf(buf, tmp, 32);
-		buf += 32;
-		len -= 32;
-	}
-	br_enc32be(ivbuf +  0, iv0);
-	br_enc32be(ivbuf +  4, iv1);
-	br_enc32be(ivbuf +  8, iv2);
-	br_enc32be(ivbuf + 12, iv3);
-}
-
-/* see bearssl_block.h */
-void
-br_aes_ct_ctrcbc_mac(const br_aes_ct_ctrcbc_keys *ctx,
-	void *cbcmac, const void *data, size_t len)
-{
-	const unsigned char *buf;
-	uint32_t cm0, cm1, cm2, cm3;
-	uint32_t q[8];
-	uint32_t sk_exp[120];
-
-	br_aes_ct_skey_expand(sk_exp, ctx->num_rounds, ctx->skey);
-
-	buf = data;
-	cm0 = br_dec32le((unsigned char *)cbcmac +  0);
-	cm1 = br_dec32le((unsigned char *)cbcmac +  4);
-	cm2 = br_dec32le((unsigned char *)cbcmac +  8);
-	cm3 = br_dec32le((unsigned char *)cbcmac + 12);
-	q[1] = 0;
-	q[3] = 0;
-	q[5] = 0;
-	q[7] = 0;
-
-	while (len > 0) {
-		q[0] = cm0 ^ br_dec32le(buf +  0);
-		q[2] = cm1 ^ br_dec32le(buf +  4);
-		q[4] = cm2 ^ br_dec32le(buf +  8);
-		q[6] = cm3 ^ br_dec32le(buf + 12);
-
-		br_aes_ct_ortho(q);
-		br_aes_ct_bitslice_encrypt(ctx->num_rounds, sk_exp, q);
-		br_aes_ct_ortho(q);
-
-		cm0 = q[0];
-		cm1 = q[2];
-		cm2 = q[4];
-		cm3 = q[6];
-		buf += 16;
-		len -= 16;
-	}
-
-	br_enc32le((unsigned char *)cbcmac +  0, cm0);
-	br_enc32le((unsigned char *)cbcmac +  4, cm1);
-	br_enc32le((unsigned char *)cbcmac +  8, cm2);
-	br_enc32le((unsigned char *)cbcmac + 12, cm3);
-}
-
-/* see bearssl_block.h */
-void
-br_aes_ct_ctrcbc_encrypt(const br_aes_ct_ctrcbc_keys *ctx,
-	void *ctr, void *cbcmac, void *data, size_t len)
-{
-	/*
-	 * When encrypting, the CBC-MAC processing must be lagging by
-	 * one block, since it operates on the encrypted values, so
-	 * it must wait for that encryption to complete.
-	 */
-
-	unsigned char *buf;
-	unsigned char *ivbuf;
-	uint32_t iv0, iv1, iv2, iv3;
-	uint32_t cm0, cm1, cm2, cm3;
-	uint32_t sk_exp[120];
-	int first_iter;
-
-	br_aes_ct_skey_expand(sk_exp, ctx->num_rounds, ctx->skey);
-
-	/*
-	 * We keep the counter as four 32-bit values, with big-endian
-	 * convention, because that's what is expected for purposes of
-	 * incrementing the counter value.
-	 */
-	ivbuf = ctr;
-	iv0 = br_dec32be(ivbuf +  0);
-	iv1 = br_dec32be(ivbuf +  4);
-	iv2 = br_dec32be(ivbuf +  8);
-	iv3 = br_dec32be(ivbuf + 12);
-
-	/*
-	 * The current CBC-MAC value is kept in little-endian convention.
-	 */
-	cm0 = br_dec32le((unsigned char *)cbcmac +  0);
-	cm1 = br_dec32le((unsigned char *)cbcmac +  4);
-	cm2 = br_dec32le((unsigned char *)cbcmac +  8);
-	cm3 = br_dec32le((unsigned char *)cbcmac + 12);
-
-	buf = data;
-	first_iter = 1;
-	while (len > 0) {
-		uint32_t q[8], carry;
-
-		/*
-		 * The bitslice implementation expects values in
-		 * little-endian convention, so we have to byteswap them.
-		 */
-		q[0] = br_swap32(iv0);
-		q[2] = br_swap32(iv1);
-		q[4] = br_swap32(iv2);
-		q[6] = br_swap32(iv3);
-		iv3 ++;
-		carry = ~(iv3 | -iv3) >> 31;
-		iv2 += carry;
-		carry &= -(~(iv2 | -iv2) >> 31);
-		iv1 += carry;
-		carry &= -(~(iv1 | -iv1) >> 31);
-		iv0 += carry;
-
-		/*
-		 * The odd values are used for CBC-MAC.
-		 */
-		q[1] = cm0;
-		q[3] = cm1;
-		q[5] = cm2;
-		q[7] = cm3;
-
-		br_aes_ct_ortho(q);
-		br_aes_ct_bitslice_encrypt(ctx->num_rounds, sk_exp, q);
-		br_aes_ct_ortho(q);
-
-		/*
-		 * We do the XOR with the plaintext in 32-bit registers,
-		 * so that the value are available for CBC-MAC processing
-		 * as well.
-		 */
-		q[0] ^= br_dec32le(buf +  0);
-		q[2] ^= br_dec32le(buf +  4);
-		q[4] ^= br_dec32le(buf +  8);
-		q[6] ^= br_dec32le(buf + 12);
-		br_enc32le(buf +  0, q[0]);
-		br_enc32le(buf +  4, q[2]);
-		br_enc32le(buf +  8, q[4]);
-		br_enc32le(buf + 12, q[6]);
-
-		buf += 16;
-		len -= 16;
-
-		/*
-		 * We set the cm* values to the block to encrypt in the
-		 * next iteration.
-		 */
-		if (first_iter) {
-			first_iter = 0;
-			cm0 ^= q[0];
-			cm1 ^= q[2];
-			cm2 ^= q[4];
-			cm3 ^= q[6];
-		} else {
-			cm0 = q[0] ^ q[1];
-			cm1 = q[2] ^ q[3];
-			cm2 = q[4] ^ q[5];
-			cm3 = q[6] ^ q[7];
-		}
-
-		/*
-		 * If this was the last iteration, then compute the
-		 * extra block encryption to complete CBC-MAC.
-		 */
-		if (len == 0) {
-			q[0] = cm0;
-			q[2] = cm1;
-			q[4] = cm2;
-			q[6] = cm3;
-			br_aes_ct_ortho(q);
-			br_aes_ct_bitslice_encrypt(ctx->num_rounds, sk_exp, q);
-			br_aes_ct_ortho(q);
-			cm0 = q[0];
-			cm1 = q[2];
-			cm2 = q[4];
-			cm3 = q[6];
-			break;
-		}
-	}
-
-	br_enc32be(ivbuf +  0, iv0);
-	br_enc32be(ivbuf +  4, iv1);
-	br_enc32be(ivbuf +  8, iv2);
-	br_enc32be(ivbuf + 12, iv3);
-	br_enc32le((unsigned char *)cbcmac +  0, cm0);
-	br_enc32le((unsigned char *)cbcmac +  4, cm1);
-	br_enc32le((unsigned char *)cbcmac +  8, cm2);
-	br_enc32le((unsigned char *)cbcmac + 12, cm3);
-}
-
-/* see bearssl_block.h */
-void
-br_aes_ct_ctrcbc_decrypt(const br_aes_ct_ctrcbc_keys *ctx,
-	void *ctr, void *cbcmac, void *data, size_t len)
-{
-	unsigned char *buf;
-	unsigned char *ivbuf;
-	uint32_t iv0, iv1, iv2, iv3;
-	uint32_t cm0, cm1, cm2, cm3;
-	uint32_t sk_exp[120];
-
-	br_aes_ct_skey_expand(sk_exp, ctx->num_rounds, ctx->skey);
-
-	/*
-	 * We keep the counter as four 32-bit values, with big-endian
-	 * convention, because that's what is expected for purposes of
-	 * incrementing the counter value.
-	 */
-	ivbuf = ctr;
-	iv0 = br_dec32be(ivbuf +  0);
-	iv1 = br_dec32be(ivbuf +  4);
-	iv2 = br_dec32be(ivbuf +  8);
-	iv3 = br_dec32be(ivbuf + 12);
-
-	/*
-	 * The current CBC-MAC value is kept in little-endian convention.
-	 */
-	cm0 = br_dec32le((unsigned char *)cbcmac +  0);
-	cm1 = br_dec32le((unsigned char *)cbcmac +  4);
-	cm2 = br_dec32le((unsigned char *)cbcmac +  8);
-	cm3 = br_dec32le((unsigned char *)cbcmac + 12);
-
-	buf = data;
-	while (len > 0) {
-		uint32_t q[8], carry;
-		unsigned char tmp[16];
-
-		/*
-		 * The bitslice implementation expects values in
-		 * little-endian convention, so we have to byteswap them.
-		 */
-		q[0] = br_swap32(iv0);
-		q[2] = br_swap32(iv1);
-		q[4] = br_swap32(iv2);
-		q[6] = br_swap32(iv3);
-		iv3 ++;
-		carry = ~(iv3 | -iv3) >> 31;
-		iv2 += carry;
-		carry &= -(~(iv2 | -iv2) >> 31);
-		iv1 += carry;
-		carry &= -(~(iv1 | -iv1) >> 31);
-		iv0 += carry;
-
-		/*
-		 * The odd values are used for CBC-MAC.
-		 */
-		q[1] = cm0 ^ br_dec32le(buf +  0);
-		q[3] = cm1 ^ br_dec32le(buf +  4);
-		q[5] = cm2 ^ br_dec32le(buf +  8);
-		q[7] = cm3 ^ br_dec32le(buf + 12);
-
-		br_aes_ct_ortho(q);
-		br_aes_ct_bitslice_encrypt(ctx->num_rounds, sk_exp, q);
-		br_aes_ct_ortho(q);
-
-		br_enc32le(tmp +  0, q[0]);
-		br_enc32le(tmp +  4, q[2]);
-		br_enc32le(tmp +  8, q[4]);
-		br_enc32le(tmp + 12, q[6]);
-		xorbuf(buf, tmp, 16);
-		cm0 = q[1];
-		cm1 = q[3];
-		cm2 = q[5];
-		cm3 = q[7];
-		buf += 16;
-		len -= 16;
-	}
-
-	br_enc32be(ivbuf +  0, iv0);
-	br_enc32be(ivbuf +  4, iv1);
-	br_enc32be(ivbuf +  8, iv2);
-	br_enc32be(ivbuf + 12, iv3);
-	br_enc32le((unsigned char *)cbcmac +  0, cm0);
-	br_enc32le((unsigned char *)cbcmac +  4, cm1);
-	br_enc32le((unsigned char *)cbcmac +  8, cm2);
-	br_enc32le((unsigned char *)cbcmac + 12, cm3);
-}
-
-/* see bearssl_block.h */
-const br_block_ctrcbc_class br_aes_ct_ctrcbc_vtable = {
-	sizeof(br_aes_ct_ctrcbc_keys),
-	16,
-	4,
-	(void (*)(const br_block_ctrcbc_class **, const void *, size_t))
-		&br_aes_ct_ctrcbc_init,
-	(void (*)(const br_block_ctrcbc_class *const *,
-		void *, void *, void *, size_t))
-		&br_aes_ct_ctrcbc_encrypt,
-	(void (*)(const br_block_ctrcbc_class *const *,
-		void *, void *, void *, size_t))
-		&br_aes_ct_ctrcbc_decrypt,
-	(void (*)(const br_block_ctrcbc_class *const *,
-		void *, void *, size_t))
-		&br_aes_ct_ctrcbc_ctr,
-	(void (*)(const br_block_ctrcbc_class *const *,
-		void *, const void *, size_t))
-		&br_aes_ct_ctrcbc_mac
-};

package/runtime/third_party/bearssl/src/symcipher/aes_ct_dec.c

@@ -1,170 +0,0 @@
-/*
- * Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
- *
- * Permission is hereby granted, free of charge, to any person obtaining 
- * a copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, sublicense, and/or sell copies of the Software, and to
- * permit persons to whom the Software is furnished to do so, subject to
- * the following conditions:
- *
- * The above copyright notice and this permission notice shall be 
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
-
-#include "inner.h"
-
-/* see inner.h */
-void
-br_aes_ct_bitslice_invSbox(uint32_t *q)
-{
-	/*
-	 * AES S-box is:
-	 *   S(x) = A(I(x)) ^ 0x63
-	 * where I() is inversion in GF(256), and A() is a linear
-	 * transform (0 is formally defined to be its own inverse).
-	 * Since inversion is an involution, the inverse S-box can be
-	 * computed from the S-box as:
-	 *   iS(x) = B(S(B(x ^ 0x63)) ^ 0x63)
-	 * where B() is the inverse of A(). Indeed, for any y in GF(256):
-	 *   iS(S(y)) = B(A(I(B(A(I(y)) ^ 0x63 ^ 0x63))) ^ 0x63 ^ 0x63) = y
-	 *
-	 * Note: we reuse the implementation of the forward S-box,
-	 * instead of duplicating it here, so that total code size is
-	 * lower. By merging the B() transforms into the S-box circuit
-	 * we could make faster CBC decryption, but CBC decryption is
-	 * already quite faster than CBC encryption because we can
-	 * process two blocks in parallel.
-	 */
-	uint32_t q0, q1, q2, q3, q4, q5, q6, q7;
-
-	q0 = ~q[0];
-	q1 = ~q[1];
-	q2 = q[2];
-	q3 = q[3];
-	q4 = q[4];
-	q5 = ~q[5];
-	q6 = ~q[6];
-	q7 = q[7];
-	q[7] = q1 ^ q4 ^ q6;
-	q[6] = q0 ^ q3 ^ q5;
-	q[5] = q7 ^ q2 ^ q4;
-	q[4] = q6 ^ q1 ^ q3;
-	q[3] = q5 ^ q0 ^ q2;
-	q[2] = q4 ^ q7 ^ q1;
-	q[1] = q3 ^ q6 ^ q0;
-	q[0] = q2 ^ q5 ^ q7;
-
-	br_aes_ct_bitslice_Sbox(q);
-
-	q0 = ~q[0];
-	q1 = ~q[1];
-	q2 = q[2];
-	q3 = q[3];
-	q4 = q[4];
-	q5 = ~q[5];
-	q6 = ~q[6];
-	q7 = q[7];
-	q[7] = q1 ^ q4 ^ q6;
-	q[6] = q0 ^ q3 ^ q5;
-	q[5] = q7 ^ q2 ^ q4;
-	q[4] = q6 ^ q1 ^ q3;
-	q[3] = q5 ^ q0 ^ q2;
-	q[2] = q4 ^ q7 ^ q1;
-	q[1] = q3 ^ q6 ^ q0;
-	q[0] = q2 ^ q5 ^ q7;
-}
-
-static void
-add_round_key(uint32_t *q, const uint32_t *sk)
-{
-	int i;
-
-	for (i = 0; i < 8; i ++) {
-		q[i] ^= sk[i];
-	}
-}
-
-static void
-inv_shift_rows(uint32_t *q)
-{
-	int i;
-
-	for (i = 0; i < 8; i ++) {
-		uint32_t x;
-
-		x = q[i];
-		q[i] = (x & 0x000000FF)
-			| ((x & 0x00003F00) << 2) | ((x & 0x0000C000) >> 6)
-			| ((x & 0x000F0000) << 4) | ((x & 0x00F00000) >> 4)
-			| ((x & 0x03000000) << 6) | ((x & 0xFC000000) >> 2);
-	}
-}
-
-static inline uint32_t
-rotr16(uint32_t x)
-{
-	return (x << 16) | (x >> 16);
-}
-
-static void
-inv_mix_columns(uint32_t *q)
-{
-	uint32_t q0, q1, q2, q3, q4, q5, q6, q7;
-	uint32_t r0, r1, r2, r3, r4, r5, r6, r7;
-
-	q0 = q[0];
-	q1 = q[1];
-	q2 = q[2];
-	q3 = q[3];
-	q4 = q[4];
-	q5 = q[5];
-	q6 = q[6];
-	q7 = q[7];
-	r0 = (q0 >> 8) | (q0 << 24);
-	r1 = (q1 >> 8) | (q1 << 24);
-	r2 = (q2 >> 8) | (q2 << 24);
-	r3 = (q3 >> 8) | (q3 << 24);
-	r4 = (q4 >> 8) | (q4 << 24);
-	r5 = (q5 >> 8) | (q5 << 24);
-	r6 = (q6 >> 8) | (q6 << 24);
-	r7 = (q7 >> 8) | (q7 << 24);
-
-	q[0] = q5 ^ q6 ^ q7 ^ r0 ^ r5 ^ r7 ^ rotr16(q0 ^ q5 ^ q6 ^ r0 ^ r5);
-	q[1] = q0 ^ q5 ^ r0 ^ r1 ^ r5 ^ r6 ^ r7 ^ rotr16(q1 ^ q5 ^ q7 ^ r1 ^ r5 ^ r6);
-	q[2] = q0 ^ q1 ^ q6 ^ r1 ^ r2 ^ r6 ^ r7 ^ rotr16(q0 ^ q2 ^ q6 ^ r2 ^ r6 ^ r7);
-	q[3] = q0 ^ q1 ^ q2 ^ q5 ^ q6 ^ r0 ^ r2 ^ r3 ^ r5 ^ rotr16(q0 ^ q1 ^ q3 ^ q5 ^ q6 ^ q7 ^ r0 ^ r3 ^ r5 ^ r7);
-	q[4] = q1 ^ q2 ^ q3 ^ q5 ^ r1 ^ r3 ^ r4 ^ r5 ^ r6 ^ r7 ^ rotr16(q1 ^ q2 ^ q4 ^ q5 ^ q7 ^ r1 ^ r4 ^ r5 ^ r6);
-	q[5] = q2 ^ q3 ^ q4 ^ q6 ^ r2 ^ r4 ^ r5 ^ r6 ^ r7 ^ rotr16(q2 ^ q3 ^ q5 ^ q6 ^ r2 ^ r5 ^ r6 ^ r7);
-	q[6] = q3 ^ q4 ^ q5 ^ q7 ^ r3 ^ r5 ^ r6 ^ r7 ^ rotr16(q3 ^ q4 ^ q6 ^ q7 ^ r3 ^ r6 ^ r7);
-	q[7] = q4 ^ q5 ^ q6 ^ r4 ^ r6 ^ r7 ^ rotr16(q4 ^ q5 ^ q7 ^ r4 ^ r7);
-}
-
-/* see inner.h */
-void
-br_aes_ct_bitslice_decrypt(unsigned num_rounds,
-	const uint32_t *skey, uint32_t *q)
-{
-	unsigned u;
-
-	add_round_key(q, skey + (num_rounds << 3));
-	for (u = num_rounds - 1; u > 0; u --) {
-		inv_shift_rows(q);
-		br_aes_ct_bitslice_invSbox(q);
-		add_round_key(q, skey + (u << 3));
-		inv_mix_columns(q);
-	}
-	inv_shift_rows(q);
-	br_aes_ct_bitslice_invSbox(q);
-	add_round_key(q, skey);
-}

package/runtime/third_party/bearssl/src/symcipher/aes_ct_enc.c

@@ -1,112 +0,0 @@
-/*
- * Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
- *
- * Permission is hereby granted, free of charge, to any person obtaining 
- * a copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, sublicense, and/or sell copies of the Software, and to
- * permit persons to whom the Software is furnished to do so, subject to
- * the following conditions:
- *
- * The above copyright notice and this permission notice shall be 
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
-
-#include "inner.h"
-
-static inline void
-add_round_key(uint32_t *q, const uint32_t *sk)
-{
-	q[0] ^= sk[0];
-	q[1] ^= sk[1];
-	q[2] ^= sk[2];
-	q[3] ^= sk[3];
-	q[4] ^= sk[4];
-	q[5] ^= sk[5];
-	q[6] ^= sk[6];
-	q[7] ^= sk[7];
-}
-
-static inline void
-shift_rows(uint32_t *q)
-{
-	int i;
-
-	for (i = 0; i < 8; i ++) {
-		uint32_t x;
-
-		x = q[i];
-		q[i] = (x & 0x000000FF)
-			| ((x & 0x0000FC00) >> 2) | ((x & 0x00000300) << 6)
-			| ((x & 0x00F00000) >> 4) | ((x & 0x000F0000) << 4)
-			| ((x & 0xC0000000) >> 6) | ((x & 0x3F000000) << 2);
-	}
-}
-
-static inline uint32_t
-rotr16(uint32_t x)
-{
-	return (x << 16) | (x >> 16);
-}
-
-static inline void
-mix_columns(uint32_t *q)
-{
-	uint32_t q0, q1, q2, q3, q4, q5, q6, q7;
-	uint32_t r0, r1, r2, r3, r4, r5, r6, r7;
-
-	q0 = q[0];
-	q1 = q[1];
-	q2 = q[2];
-	q3 = q[3];
-	q4 = q[4];
-	q5 = q[5];
-	q6 = q[6];
-	q7 = q[7];
-	r0 = (q0 >> 8) | (q0 << 24);
-	r1 = (q1 >> 8) | (q1 << 24);
-	r2 = (q2 >> 8) | (q2 << 24);
-	r3 = (q3 >> 8) | (q3 << 24);
-	r4 = (q4 >> 8) | (q4 << 24);
-	r5 = (q5 >> 8) | (q5 << 24);
-	r6 = (q6 >> 8) | (q6 << 24);
-	r7 = (q7 >> 8) | (q7 << 24);
-
-	q[0] = q7 ^ r7 ^ r0 ^ rotr16(q0 ^ r0);
-	q[1] = q0 ^ r0 ^ q7 ^ r7 ^ r1 ^ rotr16(q1 ^ r1);
-	q[2] = q1 ^ r1 ^ r2 ^ rotr16(q2 ^ r2);
-	q[3] = q2 ^ r2 ^ q7 ^ r7 ^ r3 ^ rotr16(q3 ^ r3);
-	q[4] = q3 ^ r3 ^ q7 ^ r7 ^ r4 ^ rotr16(q4 ^ r4);
-	q[5] = q4 ^ r4 ^ r5 ^ rotr16(q5 ^ r5);
-	q[6] = q5 ^ r5 ^ r6 ^ rotr16(q6 ^ r6);
-	q[7] = q6 ^ r6 ^ r7 ^ rotr16(q7 ^ r7);
-}
-
-/* see inner.h */
-void
-br_aes_ct_bitslice_encrypt(unsigned num_rounds,
-	const uint32_t *skey, uint32_t *q)
-{
-	unsigned u;
-
-	add_round_key(q, skey);
-	for (u = 1; u < num_rounds; u ++) {
-		br_aes_ct_bitslice_Sbox(q);
-		shift_rows(q);
-		mix_columns(q);
-		add_round_key(q, skey + (u << 3));
-	}
-	br_aes_ct_bitslice_Sbox(q);
-	shift_rows(q);
-	add_round_key(q, skey + (num_rounds << 3));
-}