aria.c 38 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079
  1. /*
  2. * ARIA implementation
  3. *
  4. * Copyright (C) 2006-2017, ARM Limited, All Rights Reserved
  5. * SPDX-License-Identifier: Apache-2.0
  6. *
  7. * Licensed under the Apache License, Version 2.0 (the "License"); you may
  8. * not use this file except in compliance with the License.
  9. * You may obtain a copy of the License at
  10. *
  11. * http://www.apache.org/licenses/LICENSE-2.0
  12. *
  13. * Unless required by applicable law or agreed to in writing, software
  14. * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  15. * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16. * See the License for the specific language governing permissions and
  17. * limitations under the License.
  18. *
  19. * This file is part of mbed TLS (https://tls.mbed.org)
  20. */
  21. /*
  22. * This implementation is based on the following standards:
  23. * [1] http://210.104.33.10/ARIA/doc/ARIA-specification-e.pdf
  24. * [2] https://tools.ietf.org/html/rfc5794
  25. */
  26. #if !defined(MBEDTLS_CONFIG_FILE)
  27. #include "mbedtls/config.h"
  28. #else
  29. #include MBEDTLS_CONFIG_FILE
  30. #endif
  31. #if defined(MBEDTLS_ARIA_C)
  32. #include "mbedtls/aria.h"
  33. #include <string.h>
  34. #if defined(MBEDTLS_SELF_TEST)
  35. #if defined(MBEDTLS_PLATFORM_C)
  36. #include "mbedtls/platform.h"
  37. #else
  38. #include <stdio.h>
  39. #define mbedtls_printf printf
  40. #endif /* MBEDTLS_PLATFORM_C */
  41. #endif /* MBEDTLS_SELF_TEST */
  42. #if !defined(MBEDTLS_ARIA_ALT)
  43. #include "mbedtls/platform_util.h"
  44. #if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \
  45. !defined(inline) && !defined(__cplusplus)
  46. #define inline __inline
  47. #endif
  48. /* Parameter validation macros */
  49. #define ARIA_VALIDATE_RET( cond ) \
  50. MBEDTLS_INTERNAL_VALIDATE_RET( cond, MBEDTLS_ERR_ARIA_BAD_INPUT_DATA )
  51. #define ARIA_VALIDATE( cond ) \
  52. MBEDTLS_INTERNAL_VALIDATE( cond )
  53. /*
  54. * 32-bit integer manipulation macros (little endian)
  55. */
  56. #ifndef GET_UINT32_LE
  57. #define GET_UINT32_LE( n, b, i ) \
  58. { \
  59. (n) = ( (uint32_t) (b)[(i) ] ) \
  60. | ( (uint32_t) (b)[(i) + 1] << 8 ) \
  61. | ( (uint32_t) (b)[(i) + 2] << 16 ) \
  62. | ( (uint32_t) (b)[(i) + 3] << 24 ); \
  63. }
  64. #endif
  65. #ifndef PUT_UINT32_LE
  66. #define PUT_UINT32_LE( n, b, i ) \
  67. { \
  68. (b)[(i) ] = (unsigned char) ( ( (n) ) & 0xFF ); \
  69. (b)[(i) + 1] = (unsigned char) ( ( (n) >> 8 ) & 0xFF ); \
  70. (b)[(i) + 2] = (unsigned char) ( ( (n) >> 16 ) & 0xFF ); \
  71. (b)[(i) + 3] = (unsigned char) ( ( (n) >> 24 ) & 0xFF ); \
  72. }
  73. #endif
  74. /*
  75. * modify byte order: ( A B C D ) -> ( B A D C ), i.e. swap pairs of bytes
  76. *
  77. * This is submatrix P1 in [1] Appendix B.1
  78. *
  79. * Common compilers fail to translate this to minimal number of instructions,
  80. * so let's provide asm versions for common platforms with C fallback.
  81. */
  82. #if defined(MBEDTLS_HAVE_ASM)
  83. #if defined(__arm__) /* rev16 available from v6 up */
  84. /* armcc5 --gnu defines __GNUC__ but doesn't support GNU's extended asm */
  85. #if defined(__GNUC__) && \
  86. ( !defined(__ARMCC_VERSION) || __ARMCC_VERSION >= 6000000 ) && \
  87. __ARM_ARCH >= 6
  88. static inline uint32_t aria_p1( uint32_t x )
  89. {
  90. uint32_t r;
  91. __asm( "rev16 %0, %1" : "=l" (r) : "l" (x) );
  92. return( r );
  93. }
  94. #define ARIA_P1 aria_p1
  95. #elif defined(__ARMCC_VERSION) && __ARMCC_VERSION < 6000000 && \
  96. ( __TARGET_ARCH_ARM >= 6 || __TARGET_ARCH_THUMB >= 3 )
  97. static inline uint32_t aria_p1( uint32_t x )
  98. {
  99. uint32_t r;
  100. __asm( "rev16 r, x" );
  101. return( r );
  102. }
  103. #define ARIA_P1 aria_p1
  104. #endif
  105. #endif /* arm */
  106. #if defined(__GNUC__) && \
  107. defined(__i386__) || defined(__amd64__) || defined( __x86_64__)
  108. /* I couldn't find an Intel equivalent of rev16, so two instructions */
  109. #define ARIA_P1(x) ARIA_P2( ARIA_P3( x ) )
  110. #endif /* x86 gnuc */
  111. #endif /* MBEDTLS_HAVE_ASM && GNUC */
  112. #if !defined(ARIA_P1)
  113. #define ARIA_P1(x) ((((x) >> 8) & 0x00FF00FF) ^ (((x) & 0x00FF00FF) << 8))
  114. #endif
  115. /*
  116. * modify byte order: ( A B C D ) -> ( C D A B ), i.e. rotate by 16 bits
  117. *
  118. * This is submatrix P2 in [1] Appendix B.1
  119. *
  120. * Common compilers will translate this to a single instruction.
  121. */
  122. #define ARIA_P2(x) (((x) >> 16) ^ ((x) << 16))
  123. /*
  124. * modify byte order: ( A B C D ) -> ( D C B A ), i.e. change endianness
  125. *
  126. * This is submatrix P3 in [1] Appendix B.1
  127. *
  128. * Some compilers fail to translate this to a single instruction,
  129. * so let's provide asm versions for common platforms with C fallback.
  130. */
  131. #if defined(MBEDTLS_HAVE_ASM)
  132. #if defined(__arm__) /* rev available from v6 up */
  133. /* armcc5 --gnu defines __GNUC__ but doesn't support GNU's extended asm */
  134. #if defined(__GNUC__) && \
  135. ( !defined(__ARMCC_VERSION) || __ARMCC_VERSION >= 6000000 ) && \
  136. __ARM_ARCH >= 6
  137. static inline uint32_t aria_p3( uint32_t x )
  138. {
  139. uint32_t r;
  140. __asm( "rev %0, %1" : "=l" (r) : "l" (x) );
  141. return( r );
  142. }
  143. #define ARIA_P3 aria_p3
  144. #elif defined(__ARMCC_VERSION) && __ARMCC_VERSION < 6000000 && \
  145. ( __TARGET_ARCH_ARM >= 6 || __TARGET_ARCH_THUMB >= 3 )
  146. static inline uint32_t aria_p3( uint32_t x )
  147. {
  148. uint32_t r;
  149. __asm( "rev r, x" );
  150. return( r );
  151. }
  152. #define ARIA_P3 aria_p3
  153. #endif
  154. #endif /* arm */
  155. #if defined(__GNUC__) && \
  156. defined(__i386__) || defined(__amd64__) || defined( __x86_64__)
  157. static inline uint32_t aria_p3( uint32_t x )
  158. {
  159. __asm( "bswap %0" : "=r" (x) : "0" (x) );
  160. return( x );
  161. }
  162. #define ARIA_P3 aria_p3
  163. #endif /* x86 gnuc */
  164. #endif /* MBEDTLS_HAVE_ASM && GNUC */
  165. #if !defined(ARIA_P3)
  166. #define ARIA_P3(x) ARIA_P2( ARIA_P1 ( x ) )
  167. #endif
  168. /*
  169. * ARIA Affine Transform
  170. * (a, b, c, d) = state in/out
  171. *
  172. * If we denote the first byte of input by 0, ..., the last byte by f,
  173. * then inputs are: a = 0123, b = 4567, c = 89ab, d = cdef.
  174. *
  175. * Reading [1] 2.4 or [2] 2.4.3 in columns and performing simple
  176. * rearrangements on adjacent pairs, output is:
  177. *
  178. * a = 3210 + 4545 + 6767 + 88aa + 99bb + dccd + effe
  179. * = 3210 + 4567 + 6745 + 89ab + 98ba + dcfe + efcd
  180. * b = 0101 + 2323 + 5476 + 8998 + baab + eecc + ffdd
  181. * = 0123 + 2301 + 5476 + 89ab + ba98 + efcd + fedc
  182. * c = 0022 + 1133 + 4554 + 7667 + ab89 + dcdc + fefe
  183. * = 0123 + 1032 + 4567 + 7654 + ab89 + dcfe + fedc
  184. * d = 1001 + 2332 + 6644 + 7755 + 9898 + baba + cdef
  185. * = 1032 + 2301 + 6745 + 7654 + 98ba + ba98 + cdef
  186. *
  187. * Note: another presentation of the A transform can be found as the first
  188. * half of App. B.1 in [1] in terms of 4-byte operators P1, P2, P3 and P4.
  189. * The implementation below uses only P1 and P2 as they are sufficient.
  190. */
  191. static inline void aria_a( uint32_t *a, uint32_t *b,
  192. uint32_t *c, uint32_t *d )
  193. {
  194. uint32_t ta, tb, tc;
  195. ta = *b; // 4567
  196. *b = *a; // 0123
  197. *a = ARIA_P2( ta ); // 6745
  198. tb = ARIA_P2( *d ); // efcd
  199. *d = ARIA_P1( *c ); // 98ba
  200. *c = ARIA_P1( tb ); // fedc
  201. ta ^= *d; // 4567+98ba
  202. tc = ARIA_P2( *b ); // 2301
  203. ta = ARIA_P1( ta ) ^ tc ^ *c; // 2301+5476+89ab+fedc
  204. tb ^= ARIA_P2( *d ); // ba98+efcd
  205. tc ^= ARIA_P1( *a ); // 2301+7654
  206. *b ^= ta ^ tb; // 0123+2301+5476+89ab+ba98+efcd+fedc OUT
  207. tb = ARIA_P2( tb ) ^ ta; // 2301+5476+89ab+98ba+cdef+fedc
  208. *a ^= ARIA_P1( tb ); // 3210+4567+6745+89ab+98ba+dcfe+efcd OUT
  209. ta = ARIA_P2( ta ); // 0123+7654+ab89+dcfe
  210. *d ^= ARIA_P1( ta ) ^ tc; // 1032+2301+6745+7654+98ba+ba98+cdef OUT
  211. tc = ARIA_P2( tc ); // 0123+5476
  212. *c ^= ARIA_P1( tc ) ^ ta; // 0123+1032+4567+7654+ab89+dcfe+fedc OUT
  213. }
  214. /*
  215. * ARIA Substitution Layer SL1 / SL2
  216. * (a, b, c, d) = state in/out
  217. * (sa, sb, sc, sd) = 256 8-bit S-Boxes (see below)
  218. *
  219. * By passing sb1, sb2, is1, is2 as S-Boxes you get SL1
  220. * By passing is1, is2, sb1, sb2 as S-Boxes you get SL2
  221. */
  222. static inline void aria_sl( uint32_t *a, uint32_t *b,
  223. uint32_t *c, uint32_t *d,
  224. const uint8_t sa[256], const uint8_t sb[256],
  225. const uint8_t sc[256], const uint8_t sd[256] )
  226. {
  227. *a = ( (uint32_t) sa[ *a & 0xFF] ) ^
  228. (((uint32_t) sb[(*a >> 8) & 0xFF]) << 8) ^
  229. (((uint32_t) sc[(*a >> 16) & 0xFF]) << 16) ^
  230. (((uint32_t) sd[ *a >> 24 ]) << 24);
  231. *b = ( (uint32_t) sa[ *b & 0xFF] ) ^
  232. (((uint32_t) sb[(*b >> 8) & 0xFF]) << 8) ^
  233. (((uint32_t) sc[(*b >> 16) & 0xFF]) << 16) ^
  234. (((uint32_t) sd[ *b >> 24 ]) << 24);
  235. *c = ( (uint32_t) sa[ *c & 0xFF] ) ^
  236. (((uint32_t) sb[(*c >> 8) & 0xFF]) << 8) ^
  237. (((uint32_t) sc[(*c >> 16) & 0xFF]) << 16) ^
  238. (((uint32_t) sd[ *c >> 24 ]) << 24);
  239. *d = ( (uint32_t) sa[ *d & 0xFF] ) ^
  240. (((uint32_t) sb[(*d >> 8) & 0xFF]) << 8) ^
  241. (((uint32_t) sc[(*d >> 16) & 0xFF]) << 16) ^
  242. (((uint32_t) sd[ *d >> 24 ]) << 24);
  243. }
  244. /*
  245. * S-Boxes
  246. */
  247. static const uint8_t aria_sb1[256] =
  248. {
  249. 0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B,
  250. 0xFE, 0xD7, 0xAB, 0x76, 0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0,
  251. 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0, 0xB7, 0xFD, 0x93, 0x26,
  252. 0x36, 0x3F, 0xF7, 0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,
  253. 0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2,
  254. 0xEB, 0x27, 0xB2, 0x75, 0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0,
  255. 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84, 0x53, 0xD1, 0x00, 0xED,
  256. 0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,
  257. 0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 0x45, 0xF9, 0x02, 0x7F,
  258. 0x50, 0x3C, 0x9F, 0xA8, 0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5,
  259. 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2, 0xCD, 0x0C, 0x13, 0xEC,
  260. 0x5F, 0x97, 0x44, 0x17, 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73,
  261. 0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 0x46, 0xEE, 0xB8, 0x14,
  262. 0xDE, 0x5E, 0x0B, 0xDB, 0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C,
  263. 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79, 0xE7, 0xC8, 0x37, 0x6D,
  264. 0x8D, 0xD5, 0x4E, 0xA9, 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08,
  265. 0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 0xE8, 0xDD, 0x74, 0x1F,
  266. 0x4B, 0xBD, 0x8B, 0x8A, 0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E,
  267. 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E, 0xE1, 0xF8, 0x98, 0x11,
  268. 0x69, 0xD9, 0x8E, 0x94, 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,
  269. 0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 0x41, 0x99, 0x2D, 0x0F,
  270. 0xB0, 0x54, 0xBB, 0x16
  271. };
  272. static const uint8_t aria_sb2[256] =
  273. {
  274. 0xE2, 0x4E, 0x54, 0xFC, 0x94, 0xC2, 0x4A, 0xCC, 0x62, 0x0D, 0x6A, 0x46,
  275. 0x3C, 0x4D, 0x8B, 0xD1, 0x5E, 0xFA, 0x64, 0xCB, 0xB4, 0x97, 0xBE, 0x2B,
  276. 0xBC, 0x77, 0x2E, 0x03, 0xD3, 0x19, 0x59, 0xC1, 0x1D, 0x06, 0x41, 0x6B,
  277. 0x55, 0xF0, 0x99, 0x69, 0xEA, 0x9C, 0x18, 0xAE, 0x63, 0xDF, 0xE7, 0xBB,
  278. 0x00, 0x73, 0x66, 0xFB, 0x96, 0x4C, 0x85, 0xE4, 0x3A, 0x09, 0x45, 0xAA,
  279. 0x0F, 0xEE, 0x10, 0xEB, 0x2D, 0x7F, 0xF4, 0x29, 0xAC, 0xCF, 0xAD, 0x91,
  280. 0x8D, 0x78, 0xC8, 0x95, 0xF9, 0x2F, 0xCE, 0xCD, 0x08, 0x7A, 0x88, 0x38,
  281. 0x5C, 0x83, 0x2A, 0x28, 0x47, 0xDB, 0xB8, 0xC7, 0x93, 0xA4, 0x12, 0x53,
  282. 0xFF, 0x87, 0x0E, 0x31, 0x36, 0x21, 0x58, 0x48, 0x01, 0x8E, 0x37, 0x74,
  283. 0x32, 0xCA, 0xE9, 0xB1, 0xB7, 0xAB, 0x0C, 0xD7, 0xC4, 0x56, 0x42, 0x26,
  284. 0x07, 0x98, 0x60, 0xD9, 0xB6, 0xB9, 0x11, 0x40, 0xEC, 0x20, 0x8C, 0xBD,
  285. 0xA0, 0xC9, 0x84, 0x04, 0x49, 0x23, 0xF1, 0x4F, 0x50, 0x1F, 0x13, 0xDC,
  286. 0xD8, 0xC0, 0x9E, 0x57, 0xE3, 0xC3, 0x7B, 0x65, 0x3B, 0x02, 0x8F, 0x3E,
  287. 0xE8, 0x25, 0x92, 0xE5, 0x15, 0xDD, 0xFD, 0x17, 0xA9, 0xBF, 0xD4, 0x9A,
  288. 0x7E, 0xC5, 0x39, 0x67, 0xFE, 0x76, 0x9D, 0x43, 0xA7, 0xE1, 0xD0, 0xF5,
  289. 0x68, 0xF2, 0x1B, 0x34, 0x70, 0x05, 0xA3, 0x8A, 0xD5, 0x79, 0x86, 0xA8,
  290. 0x30, 0xC6, 0x51, 0x4B, 0x1E, 0xA6, 0x27, 0xF6, 0x35, 0xD2, 0x6E, 0x24,
  291. 0x16, 0x82, 0x5F, 0xDA, 0xE6, 0x75, 0xA2, 0xEF, 0x2C, 0xB2, 0x1C, 0x9F,
  292. 0x5D, 0x6F, 0x80, 0x0A, 0x72, 0x44, 0x9B, 0x6C, 0x90, 0x0B, 0x5B, 0x33,
  293. 0x7D, 0x5A, 0x52, 0xF3, 0x61, 0xA1, 0xF7, 0xB0, 0xD6, 0x3F, 0x7C, 0x6D,
  294. 0xED, 0x14, 0xE0, 0xA5, 0x3D, 0x22, 0xB3, 0xF8, 0x89, 0xDE, 0x71, 0x1A,
  295. 0xAF, 0xBA, 0xB5, 0x81
  296. };
  297. static const uint8_t aria_is1[256] =
  298. {
  299. 0x52, 0x09, 0x6A, 0xD5, 0x30, 0x36, 0xA5, 0x38, 0xBF, 0x40, 0xA3, 0x9E,
  300. 0x81, 0xF3, 0xD7, 0xFB, 0x7C, 0xE3, 0x39, 0x82, 0x9B, 0x2F, 0xFF, 0x87,
  301. 0x34, 0x8E, 0x43, 0x44, 0xC4, 0xDE, 0xE9, 0xCB, 0x54, 0x7B, 0x94, 0x32,
  302. 0xA6, 0xC2, 0x23, 0x3D, 0xEE, 0x4C, 0x95, 0x0B, 0x42, 0xFA, 0xC3, 0x4E,
  303. 0x08, 0x2E, 0xA1, 0x66, 0x28, 0xD9, 0x24, 0xB2, 0x76, 0x5B, 0xA2, 0x49,
  304. 0x6D, 0x8B, 0xD1, 0x25, 0x72, 0xF8, 0xF6, 0x64, 0x86, 0x68, 0x98, 0x16,
  305. 0xD4, 0xA4, 0x5C, 0xCC, 0x5D, 0x65, 0xB6, 0x92, 0x6C, 0x70, 0x48, 0x50,
  306. 0xFD, 0xED, 0xB9, 0xDA, 0x5E, 0x15, 0x46, 0x57, 0xA7, 0x8D, 0x9D, 0x84,
  307. 0x90, 0xD8, 0xAB, 0x00, 0x8C, 0xBC, 0xD3, 0x0A, 0xF7, 0xE4, 0x58, 0x05,
  308. 0xB8, 0xB3, 0x45, 0x06, 0xD0, 0x2C, 0x1E, 0x8F, 0xCA, 0x3F, 0x0F, 0x02,
  309. 0xC1, 0xAF, 0xBD, 0x03, 0x01, 0x13, 0x8A, 0x6B, 0x3A, 0x91, 0x11, 0x41,
  310. 0x4F, 0x67, 0xDC, 0xEA, 0x97, 0xF2, 0xCF, 0xCE, 0xF0, 0xB4, 0xE6, 0x73,
  311. 0x96, 0xAC, 0x74, 0x22, 0xE7, 0xAD, 0x35, 0x85, 0xE2, 0xF9, 0x37, 0xE8,
  312. 0x1C, 0x75, 0xDF, 0x6E, 0x47, 0xF1, 0x1A, 0x71, 0x1D, 0x29, 0xC5, 0x89,
  313. 0x6F, 0xB7, 0x62, 0x0E, 0xAA, 0x18, 0xBE, 0x1B, 0xFC, 0x56, 0x3E, 0x4B,
  314. 0xC6, 0xD2, 0x79, 0x20, 0x9A, 0xDB, 0xC0, 0xFE, 0x78, 0xCD, 0x5A, 0xF4,
  315. 0x1F, 0xDD, 0xA8, 0x33, 0x88, 0x07, 0xC7, 0x31, 0xB1, 0x12, 0x10, 0x59,
  316. 0x27, 0x80, 0xEC, 0x5F, 0x60, 0x51, 0x7F, 0xA9, 0x19, 0xB5, 0x4A, 0x0D,
  317. 0x2D, 0xE5, 0x7A, 0x9F, 0x93, 0xC9, 0x9C, 0xEF, 0xA0, 0xE0, 0x3B, 0x4D,
  318. 0xAE, 0x2A, 0xF5, 0xB0, 0xC8, 0xEB, 0xBB, 0x3C, 0x83, 0x53, 0x99, 0x61,
  319. 0x17, 0x2B, 0x04, 0x7E, 0xBA, 0x77, 0xD6, 0x26, 0xE1, 0x69, 0x14, 0x63,
  320. 0x55, 0x21, 0x0C, 0x7D
  321. };
  322. static const uint8_t aria_is2[256] =
  323. {
  324. 0x30, 0x68, 0x99, 0x1B, 0x87, 0xB9, 0x21, 0x78, 0x50, 0x39, 0xDB, 0xE1,
  325. 0x72, 0x09, 0x62, 0x3C, 0x3E, 0x7E, 0x5E, 0x8E, 0xF1, 0xA0, 0xCC, 0xA3,
  326. 0x2A, 0x1D, 0xFB, 0xB6, 0xD6, 0x20, 0xC4, 0x8D, 0x81, 0x65, 0xF5, 0x89,
  327. 0xCB, 0x9D, 0x77, 0xC6, 0x57, 0x43, 0x56, 0x17, 0xD4, 0x40, 0x1A, 0x4D,
  328. 0xC0, 0x63, 0x6C, 0xE3, 0xB7, 0xC8, 0x64, 0x6A, 0x53, 0xAA, 0x38, 0x98,
  329. 0x0C, 0xF4, 0x9B, 0xED, 0x7F, 0x22, 0x76, 0xAF, 0xDD, 0x3A, 0x0B, 0x58,
  330. 0x67, 0x88, 0x06, 0xC3, 0x35, 0x0D, 0x01, 0x8B, 0x8C, 0xC2, 0xE6, 0x5F,
  331. 0x02, 0x24, 0x75, 0x93, 0x66, 0x1E, 0xE5, 0xE2, 0x54, 0xD8, 0x10, 0xCE,
  332. 0x7A, 0xE8, 0x08, 0x2C, 0x12, 0x97, 0x32, 0xAB, 0xB4, 0x27, 0x0A, 0x23,
  333. 0xDF, 0xEF, 0xCA, 0xD9, 0xB8, 0xFA, 0xDC, 0x31, 0x6B, 0xD1, 0xAD, 0x19,
  334. 0x49, 0xBD, 0x51, 0x96, 0xEE, 0xE4, 0xA8, 0x41, 0xDA, 0xFF, 0xCD, 0x55,
  335. 0x86, 0x36, 0xBE, 0x61, 0x52, 0xF8, 0xBB, 0x0E, 0x82, 0x48, 0x69, 0x9A,
  336. 0xE0, 0x47, 0x9E, 0x5C, 0x04, 0x4B, 0x34, 0x15, 0x79, 0x26, 0xA7, 0xDE,
  337. 0x29, 0xAE, 0x92, 0xD7, 0x84, 0xE9, 0xD2, 0xBA, 0x5D, 0xF3, 0xC5, 0xB0,
  338. 0xBF, 0xA4, 0x3B, 0x71, 0x44, 0x46, 0x2B, 0xFC, 0xEB, 0x6F, 0xD5, 0xF6,
  339. 0x14, 0xFE, 0x7C, 0x70, 0x5A, 0x7D, 0xFD, 0x2F, 0x18, 0x83, 0x16, 0xA5,
  340. 0x91, 0x1F, 0x05, 0x95, 0x74, 0xA9, 0xC1, 0x5B, 0x4A, 0x85, 0x6D, 0x13,
  341. 0x07, 0x4F, 0x4E, 0x45, 0xB2, 0x0F, 0xC9, 0x1C, 0xA6, 0xBC, 0xEC, 0x73,
  342. 0x90, 0x7B, 0xCF, 0x59, 0x8F, 0xA1, 0xF9, 0x2D, 0xF2, 0xB1, 0x00, 0x94,
  343. 0x37, 0x9F, 0xD0, 0x2E, 0x9C, 0x6E, 0x28, 0x3F, 0x80, 0xF0, 0x3D, 0xD3,
  344. 0x25, 0x8A, 0xB5, 0xE7, 0x42, 0xB3, 0xC7, 0xEA, 0xF7, 0x4C, 0x11, 0x33,
  345. 0x03, 0xA2, 0xAC, 0x60
  346. };
  347. /*
  348. * Helper for key schedule: r = FO( p, k ) ^ x
  349. */
  350. static void aria_fo_xor( uint32_t r[4], const uint32_t p[4],
  351. const uint32_t k[4], const uint32_t x[4] )
  352. {
  353. uint32_t a, b, c, d;
  354. a = p[0] ^ k[0];
  355. b = p[1] ^ k[1];
  356. c = p[2] ^ k[2];
  357. d = p[3] ^ k[3];
  358. aria_sl( &a, &b, &c, &d, aria_sb1, aria_sb2, aria_is1, aria_is2 );
  359. aria_a( &a, &b, &c, &d );
  360. r[0] = a ^ x[0];
  361. r[1] = b ^ x[1];
  362. r[2] = c ^ x[2];
  363. r[3] = d ^ x[3];
  364. }
  365. /*
  366. * Helper for key schedule: r = FE( p, k ) ^ x
  367. */
  368. static void aria_fe_xor( uint32_t r[4], const uint32_t p[4],
  369. const uint32_t k[4], const uint32_t x[4] )
  370. {
  371. uint32_t a, b, c, d;
  372. a = p[0] ^ k[0];
  373. b = p[1] ^ k[1];
  374. c = p[2] ^ k[2];
  375. d = p[3] ^ k[3];
  376. aria_sl( &a, &b, &c, &d, aria_is1, aria_is2, aria_sb1, aria_sb2 );
  377. aria_a( &a, &b, &c, &d );
  378. r[0] = a ^ x[0];
  379. r[1] = b ^ x[1];
  380. r[2] = c ^ x[2];
  381. r[3] = d ^ x[3];
  382. }
  383. /*
  384. * Big endian 128-bit rotation: r = a ^ (b <<< n), used only in key setup.
  385. *
  386. * We chose to store bytes into 32-bit words in little-endian format (see
  387. * GET/PUT_UINT32_LE) so we need to reverse bytes here.
  388. */
  389. static void aria_rot128( uint32_t r[4], const uint32_t a[4],
  390. const uint32_t b[4], uint8_t n )
  391. {
  392. uint8_t i, j;
  393. uint32_t t, u;
  394. const uint8_t n1 = n % 32; // bit offset
  395. const uint8_t n2 = n1 ? 32 - n1 : 0; // reverse bit offset
  396. j = ( n / 32 ) % 4; // initial word offset
  397. t = ARIA_P3( b[j] ); // big endian
  398. for( i = 0; i < 4; i++ )
  399. {
  400. j = ( j + 1 ) % 4; // get next word, big endian
  401. u = ARIA_P3( b[j] );
  402. t <<= n1; // rotate
  403. t |= u >> n2;
  404. t = ARIA_P3( t ); // back to little endian
  405. r[i] = a[i] ^ t; // store
  406. t = u; // move to next word
  407. }
  408. }
  409. /*
  410. * Set encryption key
  411. */
  412. int mbedtls_aria_setkey_enc( mbedtls_aria_context *ctx,
  413. const unsigned char *key, unsigned int keybits )
  414. {
  415. /* round constant masks */
  416. const uint32_t rc[3][4] =
  417. {
  418. { 0xB7C17C51, 0x940A2227, 0xE8AB13FE, 0xE06E9AFA },
  419. { 0xCC4AB16D, 0x20C8219E, 0xD5B128FF, 0xB0E25DEF },
  420. { 0x1D3792DB, 0x70E92621, 0x75972403, 0x0EC9E804 }
  421. };
  422. int i;
  423. uint32_t w[4][4], *w2;
  424. ARIA_VALIDATE_RET( ctx != NULL );
  425. ARIA_VALIDATE_RET( key != NULL );
  426. if( keybits != 128 && keybits != 192 && keybits != 256 )
  427. return( MBEDTLS_ERR_ARIA_BAD_INPUT_DATA );
  428. /* Copy key to W0 (and potential remainder to W1) */
  429. GET_UINT32_LE( w[0][0], key, 0 );
  430. GET_UINT32_LE( w[0][1], key, 4 );
  431. GET_UINT32_LE( w[0][2], key, 8 );
  432. GET_UINT32_LE( w[0][3], key, 12 );
  433. memset( w[1], 0, 16 );
  434. if( keybits >= 192 )
  435. {
  436. GET_UINT32_LE( w[1][0], key, 16 ); // 192 bit key
  437. GET_UINT32_LE( w[1][1], key, 20 );
  438. }
  439. if( keybits == 256 )
  440. {
  441. GET_UINT32_LE( w[1][2], key, 24 ); // 256 bit key
  442. GET_UINT32_LE( w[1][3], key, 28 );
  443. }
  444. i = ( keybits - 128 ) >> 6; // index: 0, 1, 2
  445. ctx->nr = 12 + 2 * i; // no. rounds: 12, 14, 16
  446. aria_fo_xor( w[1], w[0], rc[i], w[1] ); // W1 = FO(W0, CK1) ^ KR
  447. i = i < 2 ? i + 1 : 0;
  448. aria_fe_xor( w[2], w[1], rc[i], w[0] ); // W2 = FE(W1, CK2) ^ W0
  449. i = i < 2 ? i + 1 : 0;
  450. aria_fo_xor( w[3], w[2], rc[i], w[1] ); // W3 = FO(W2, CK3) ^ W1
  451. for( i = 0; i < 4; i++ ) // create round keys
  452. {
  453. w2 = w[(i + 1) & 3];
  454. aria_rot128( ctx->rk[i ], w[i], w2, 128 - 19 );
  455. aria_rot128( ctx->rk[i + 4], w[i], w2, 128 - 31 );
  456. aria_rot128( ctx->rk[i + 8], w[i], w2, 61 );
  457. aria_rot128( ctx->rk[i + 12], w[i], w2, 31 );
  458. }
  459. aria_rot128( ctx->rk[16], w[0], w[1], 19 );
  460. /* w holds enough info to reconstruct the round keys */
  461. mbedtls_platform_zeroize( w, sizeof( w ) );
  462. return( 0 );
  463. }
  464. /*
  465. * Set decryption key
  466. */
  467. int mbedtls_aria_setkey_dec( mbedtls_aria_context *ctx,
  468. const unsigned char *key, unsigned int keybits )
  469. {
  470. int i, j, k, ret;
  471. ARIA_VALIDATE_RET( ctx != NULL );
  472. ARIA_VALIDATE_RET( key != NULL );
  473. ret = mbedtls_aria_setkey_enc( ctx, key, keybits );
  474. if( ret != 0 )
  475. return( ret );
  476. /* flip the order of round keys */
  477. for( i = 0, j = ctx->nr; i < j; i++, j-- )
  478. {
  479. for( k = 0; k < 4; k++ )
  480. {
  481. uint32_t t = ctx->rk[i][k];
  482. ctx->rk[i][k] = ctx->rk[j][k];
  483. ctx->rk[j][k] = t;
  484. }
  485. }
  486. /* apply affine transform to middle keys */
  487. for( i = 1; i < ctx->nr; i++ )
  488. {
  489. aria_a( &ctx->rk[i][0], &ctx->rk[i][1],
  490. &ctx->rk[i][2], &ctx->rk[i][3] );
  491. }
  492. return( 0 );
  493. }
  494. /*
  495. * Encrypt a block
  496. */
  497. int mbedtls_aria_crypt_ecb( mbedtls_aria_context *ctx,
  498. const unsigned char input[MBEDTLS_ARIA_BLOCKSIZE],
  499. unsigned char output[MBEDTLS_ARIA_BLOCKSIZE] )
  500. {
  501. int i;
  502. uint32_t a, b, c, d;
  503. ARIA_VALIDATE_RET( ctx != NULL );
  504. ARIA_VALIDATE_RET( input != NULL );
  505. ARIA_VALIDATE_RET( output != NULL );
  506. GET_UINT32_LE( a, input, 0 );
  507. GET_UINT32_LE( b, input, 4 );
  508. GET_UINT32_LE( c, input, 8 );
  509. GET_UINT32_LE( d, input, 12 );
  510. i = 0;
  511. while( 1 )
  512. {
  513. a ^= ctx->rk[i][0];
  514. b ^= ctx->rk[i][1];
  515. c ^= ctx->rk[i][2];
  516. d ^= ctx->rk[i][3];
  517. i++;
  518. aria_sl( &a, &b, &c, &d, aria_sb1, aria_sb2, aria_is1, aria_is2 );
  519. aria_a( &a, &b, &c, &d );
  520. a ^= ctx->rk[i][0];
  521. b ^= ctx->rk[i][1];
  522. c ^= ctx->rk[i][2];
  523. d ^= ctx->rk[i][3];
  524. i++;
  525. aria_sl( &a, &b, &c, &d, aria_is1, aria_is2, aria_sb1, aria_sb2 );
  526. if( i >= ctx->nr )
  527. break;
  528. aria_a( &a, &b, &c, &d );
  529. }
  530. /* final key mixing */
  531. a ^= ctx->rk[i][0];
  532. b ^= ctx->rk[i][1];
  533. c ^= ctx->rk[i][2];
  534. d ^= ctx->rk[i][3];
  535. PUT_UINT32_LE( a, output, 0 );
  536. PUT_UINT32_LE( b, output, 4 );
  537. PUT_UINT32_LE( c, output, 8 );
  538. PUT_UINT32_LE( d, output, 12 );
  539. return( 0 );
  540. }
  541. /* Initialize context */
  542. void mbedtls_aria_init( mbedtls_aria_context *ctx )
  543. {
  544. ARIA_VALIDATE( ctx != NULL );
  545. memset( ctx, 0, sizeof( mbedtls_aria_context ) );
  546. }
  547. /* Clear context */
  548. void mbedtls_aria_free( mbedtls_aria_context *ctx )
  549. {
  550. if( ctx == NULL )
  551. return;
  552. mbedtls_platform_zeroize( ctx, sizeof( mbedtls_aria_context ) );
  553. }
  554. #if defined(MBEDTLS_CIPHER_MODE_CBC)
  555. /*
  556. * ARIA-CBC buffer encryption/decryption
  557. */
  558. int mbedtls_aria_crypt_cbc( mbedtls_aria_context *ctx,
  559. int mode,
  560. size_t length,
  561. unsigned char iv[MBEDTLS_ARIA_BLOCKSIZE],
  562. const unsigned char *input,
  563. unsigned char *output )
  564. {
  565. int i;
  566. unsigned char temp[MBEDTLS_ARIA_BLOCKSIZE];
  567. ARIA_VALIDATE_RET( ctx != NULL );
  568. ARIA_VALIDATE_RET( mode == MBEDTLS_ARIA_ENCRYPT ||
  569. mode == MBEDTLS_ARIA_DECRYPT );
  570. ARIA_VALIDATE_RET( length == 0 || input != NULL );
  571. ARIA_VALIDATE_RET( length == 0 || output != NULL );
  572. ARIA_VALIDATE_RET( iv != NULL );
  573. if( length % MBEDTLS_ARIA_BLOCKSIZE )
  574. return( MBEDTLS_ERR_ARIA_INVALID_INPUT_LENGTH );
  575. if( mode == MBEDTLS_ARIA_DECRYPT )
  576. {
  577. while( length > 0 )
  578. {
  579. memcpy( temp, input, MBEDTLS_ARIA_BLOCKSIZE );
  580. mbedtls_aria_crypt_ecb( ctx, input, output );
  581. for( i = 0; i < MBEDTLS_ARIA_BLOCKSIZE; i++ )
  582. output[i] = (unsigned char)( output[i] ^ iv[i] );
  583. memcpy( iv, temp, MBEDTLS_ARIA_BLOCKSIZE );
  584. input += MBEDTLS_ARIA_BLOCKSIZE;
  585. output += MBEDTLS_ARIA_BLOCKSIZE;
  586. length -= MBEDTLS_ARIA_BLOCKSIZE;
  587. }
  588. }
  589. else
  590. {
  591. while( length > 0 )
  592. {
  593. for( i = 0; i < MBEDTLS_ARIA_BLOCKSIZE; i++ )
  594. output[i] = (unsigned char)( input[i] ^ iv[i] );
  595. mbedtls_aria_crypt_ecb( ctx, output, output );
  596. memcpy( iv, output, MBEDTLS_ARIA_BLOCKSIZE );
  597. input += MBEDTLS_ARIA_BLOCKSIZE;
  598. output += MBEDTLS_ARIA_BLOCKSIZE;
  599. length -= MBEDTLS_ARIA_BLOCKSIZE;
  600. }
  601. }
  602. return( 0 );
  603. }
  604. #endif /* MBEDTLS_CIPHER_MODE_CBC */
  605. #if defined(MBEDTLS_CIPHER_MODE_CFB)
  606. /*
  607. * ARIA-CFB128 buffer encryption/decryption
  608. */
  609. int mbedtls_aria_crypt_cfb128( mbedtls_aria_context *ctx,
  610. int mode,
  611. size_t length,
  612. size_t *iv_off,
  613. unsigned char iv[MBEDTLS_ARIA_BLOCKSIZE],
  614. const unsigned char *input,
  615. unsigned char *output )
  616. {
  617. unsigned char c;
  618. size_t n;
  619. ARIA_VALIDATE_RET( ctx != NULL );
  620. ARIA_VALIDATE_RET( mode == MBEDTLS_ARIA_ENCRYPT ||
  621. mode == MBEDTLS_ARIA_DECRYPT );
  622. ARIA_VALIDATE_RET( length == 0 || input != NULL );
  623. ARIA_VALIDATE_RET( length == 0 || output != NULL );
  624. ARIA_VALIDATE_RET( iv != NULL );
  625. ARIA_VALIDATE_RET( iv_off != NULL );
  626. n = *iv_off;
  627. /* An overly large value of n can lead to an unlimited
  628. * buffer overflow. Therefore, guard against this
  629. * outside of parameter validation. */
  630. if( n >= MBEDTLS_ARIA_BLOCKSIZE )
  631. return( MBEDTLS_ERR_ARIA_BAD_INPUT_DATA );
  632. if( mode == MBEDTLS_ARIA_DECRYPT )
  633. {
  634. while( length-- )
  635. {
  636. if( n == 0 )
  637. mbedtls_aria_crypt_ecb( ctx, iv, iv );
  638. c = *input++;
  639. *output++ = c ^ iv[n];
  640. iv[n] = c;
  641. n = ( n + 1 ) & 0x0F;
  642. }
  643. }
  644. else
  645. {
  646. while( length-- )
  647. {
  648. if( n == 0 )
  649. mbedtls_aria_crypt_ecb( ctx, iv, iv );
  650. iv[n] = *output++ = (unsigned char)( iv[n] ^ *input++ );
  651. n = ( n + 1 ) & 0x0F;
  652. }
  653. }
  654. *iv_off = n;
  655. return( 0 );
  656. }
  657. #endif /* MBEDTLS_CIPHER_MODE_CFB */
  658. #if defined(MBEDTLS_CIPHER_MODE_CTR)
  659. /*
  660. * ARIA-CTR buffer encryption/decryption
  661. */
  662. int mbedtls_aria_crypt_ctr( mbedtls_aria_context *ctx,
  663. size_t length,
  664. size_t *nc_off,
  665. unsigned char nonce_counter[MBEDTLS_ARIA_BLOCKSIZE],
  666. unsigned char stream_block[MBEDTLS_ARIA_BLOCKSIZE],
  667. const unsigned char *input,
  668. unsigned char *output )
  669. {
  670. int c, i;
  671. size_t n;
  672. ARIA_VALIDATE_RET( ctx != NULL );
  673. ARIA_VALIDATE_RET( length == 0 || input != NULL );
  674. ARIA_VALIDATE_RET( length == 0 || output != NULL );
  675. ARIA_VALIDATE_RET( nonce_counter != NULL );
  676. ARIA_VALIDATE_RET( stream_block != NULL );
  677. ARIA_VALIDATE_RET( nc_off != NULL );
  678. n = *nc_off;
  679. /* An overly large value of n can lead to an unlimited
  680. * buffer overflow. Therefore, guard against this
  681. * outside of parameter validation. */
  682. if( n >= MBEDTLS_ARIA_BLOCKSIZE )
  683. return( MBEDTLS_ERR_ARIA_BAD_INPUT_DATA );
  684. while( length-- )
  685. {
  686. if( n == 0 ) {
  687. mbedtls_aria_crypt_ecb( ctx, nonce_counter,
  688. stream_block );
  689. for( i = MBEDTLS_ARIA_BLOCKSIZE; i > 0; i-- )
  690. if( ++nonce_counter[i - 1] != 0 )
  691. break;
  692. }
  693. c = *input++;
  694. *output++ = (unsigned char)( c ^ stream_block[n] );
  695. n = ( n + 1 ) & 0x0F;
  696. }
  697. *nc_off = n;
  698. return( 0 );
  699. }
  700. #endif /* MBEDTLS_CIPHER_MODE_CTR */
  701. #endif /* !MBEDTLS_ARIA_ALT */
  702. #if defined(MBEDTLS_SELF_TEST)
  703. /*
  704. * Basic ARIA ECB test vectors from RFC 5794
  705. */
  706. static const uint8_t aria_test1_ecb_key[32] = // test key
  707. {
  708. 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, // 128 bit
  709. 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
  710. 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, // 192 bit
  711. 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F // 256 bit
  712. };
  713. static const uint8_t aria_test1_ecb_pt[MBEDTLS_ARIA_BLOCKSIZE] = // plaintext
  714. {
  715. 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, // same for all
  716. 0x88, 0x99, 0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF // key sizes
  717. };
  718. static const uint8_t aria_test1_ecb_ct[3][MBEDTLS_ARIA_BLOCKSIZE] = // ciphertext
  719. {
  720. { 0xD7, 0x18, 0xFB, 0xD6, 0xAB, 0x64, 0x4C, 0x73, // 128 bit
  721. 0x9D, 0xA9, 0x5F, 0x3B, 0xE6, 0x45, 0x17, 0x78 },
  722. { 0x26, 0x44, 0x9C, 0x18, 0x05, 0xDB, 0xE7, 0xAA, // 192 bit
  723. 0x25, 0xA4, 0x68, 0xCE, 0x26, 0x3A, 0x9E, 0x79 },
  724. { 0xF9, 0x2B, 0xD7, 0xC7, 0x9F, 0xB7, 0x2E, 0x2F, // 256 bit
  725. 0x2B, 0x8F, 0x80, 0xC1, 0x97, 0x2D, 0x24, 0xFC }
  726. };
  727. /*
  728. * Mode tests from "Test Vectors for ARIA" Version 1.0
  729. * http://210.104.33.10/ARIA/doc/ARIA-testvector-e.pdf
  730. */
  731. #if (defined(MBEDTLS_CIPHER_MODE_CBC) || defined(MBEDTLS_CIPHER_MODE_CFB) || \
  732. defined(MBEDTLS_CIPHER_MODE_CTR))
  733. static const uint8_t aria_test2_key[32] =
  734. {
  735. 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, // 128 bit
  736. 0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff,
  737. 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, // 192 bit
  738. 0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff // 256 bit
  739. };
  740. static const uint8_t aria_test2_pt[48] =
  741. {
  742. 0x11, 0x11, 0x11, 0x11, 0xaa, 0xaa, 0xaa, 0xaa, // same for all
  743. 0x11, 0x11, 0x11, 0x11, 0xbb, 0xbb, 0xbb, 0xbb,
  744. 0x11, 0x11, 0x11, 0x11, 0xcc, 0xcc, 0xcc, 0xcc,
  745. 0x11, 0x11, 0x11, 0x11, 0xdd, 0xdd, 0xdd, 0xdd,
  746. 0x22, 0x22, 0x22, 0x22, 0xaa, 0xaa, 0xaa, 0xaa,
  747. 0x22, 0x22, 0x22, 0x22, 0xbb, 0xbb, 0xbb, 0xbb,
  748. };
  749. #endif
  750. #if (defined(MBEDTLS_CIPHER_MODE_CBC) || defined(MBEDTLS_CIPHER_MODE_CFB))
  751. static const uint8_t aria_test2_iv[MBEDTLS_ARIA_BLOCKSIZE] =
  752. {
  753. 0x0f, 0x1e, 0x2d, 0x3c, 0x4b, 0x5a, 0x69, 0x78, // same for CBC, CFB
  754. 0x87, 0x96, 0xa5, 0xb4, 0xc3, 0xd2, 0xe1, 0xf0 // CTR has zero IV
  755. };
  756. #endif
  757. #if defined(MBEDTLS_CIPHER_MODE_CBC)
  758. static const uint8_t aria_test2_cbc_ct[3][48] = // CBC ciphertext
  759. {
  760. { 0x49, 0xd6, 0x18, 0x60, 0xb1, 0x49, 0x09, 0x10, // 128-bit key
  761. 0x9c, 0xef, 0x0d, 0x22, 0xa9, 0x26, 0x81, 0x34,
  762. 0xfa, 0xdf, 0x9f, 0xb2, 0x31, 0x51, 0xe9, 0x64,
  763. 0x5f, 0xba, 0x75, 0x01, 0x8b, 0xdb, 0x15, 0x38,
  764. 0xb5, 0x33, 0x34, 0x63, 0x4b, 0xbf, 0x7d, 0x4c,
  765. 0xd4, 0xb5, 0x37, 0x70, 0x33, 0x06, 0x0c, 0x15 },
  766. { 0xaf, 0xe6, 0xcf, 0x23, 0x97, 0x4b, 0x53, 0x3c, // 192-bit key
  767. 0x67, 0x2a, 0x82, 0x62, 0x64, 0xea, 0x78, 0x5f,
  768. 0x4e, 0x4f, 0x7f, 0x78, 0x0d, 0xc7, 0xf3, 0xf1,
  769. 0xe0, 0x96, 0x2b, 0x80, 0x90, 0x23, 0x86, 0xd5,
  770. 0x14, 0xe9, 0xc3, 0xe7, 0x72, 0x59, 0xde, 0x92,
  771. 0xdd, 0x11, 0x02, 0xff, 0xab, 0x08, 0x6c, 0x1e },
  772. { 0x52, 0x3a, 0x8a, 0x80, 0x6a, 0xe6, 0x21, 0xf1, // 256-bit key
  773. 0x55, 0xfd, 0xd2, 0x8d, 0xbc, 0x34, 0xe1, 0xab,
  774. 0x7b, 0x9b, 0x42, 0x43, 0x2a, 0xd8, 0xb2, 0xef,
  775. 0xb9, 0x6e, 0x23, 0xb1, 0x3f, 0x0a, 0x6e, 0x52,
  776. 0xf3, 0x61, 0x85, 0xd5, 0x0a, 0xd0, 0x02, 0xc5,
  777. 0xf6, 0x01, 0xbe, 0xe5, 0x49, 0x3f, 0x11, 0x8b }
  778. };
  779. #endif /* MBEDTLS_CIPHER_MODE_CBC */
  780. #if defined(MBEDTLS_CIPHER_MODE_CFB)
  781. static const uint8_t aria_test2_cfb_ct[3][48] = // CFB ciphertext
  782. {
  783. { 0x37, 0x20, 0xe5, 0x3b, 0xa7, 0xd6, 0x15, 0x38, // 128-bit key
  784. 0x34, 0x06, 0xb0, 0x9f, 0x0a, 0x05, 0xa2, 0x00,
  785. 0xc0, 0x7c, 0x21, 0xe6, 0x37, 0x0f, 0x41, 0x3a,
  786. 0x5d, 0x13, 0x25, 0x00, 0xa6, 0x82, 0x85, 0x01,
  787. 0x7c, 0x61, 0xb4, 0x34, 0xc7, 0xb7, 0xca, 0x96,
  788. 0x85, 0xa5, 0x10, 0x71, 0x86, 0x1e, 0x4d, 0x4b },
  789. { 0x41, 0x71, 0xf7, 0x19, 0x2b, 0xf4, 0x49, 0x54, // 192-bit key
  790. 0x94, 0xd2, 0x73, 0x61, 0x29, 0x64, 0x0f, 0x5c,
  791. 0x4d, 0x87, 0xa9, 0xa2, 0x13, 0x66, 0x4c, 0x94,
  792. 0x48, 0x47, 0x7c, 0x6e, 0xcc, 0x20, 0x13, 0x59,
  793. 0x8d, 0x97, 0x66, 0x95, 0x2d, 0xd8, 0xc3, 0x86,
  794. 0x8f, 0x17, 0xe3, 0x6e, 0xf6, 0x6f, 0xd8, 0x4b },
  795. { 0x26, 0x83, 0x47, 0x05, 0xb0, 0xf2, 0xc0, 0xe2, // 256-bit key
  796. 0x58, 0x8d, 0x4a, 0x7f, 0x09, 0x00, 0x96, 0x35,
  797. 0xf2, 0x8b, 0xb9, 0x3d, 0x8c, 0x31, 0xf8, 0x70,
  798. 0xec, 0x1e, 0x0b, 0xdb, 0x08, 0x2b, 0x66, 0xfa,
  799. 0x40, 0x2d, 0xd9, 0xc2, 0x02, 0xbe, 0x30, 0x0c,
  800. 0x45, 0x17, 0xd1, 0x96, 0xb1, 0x4d, 0x4c, 0xe1 }
  801. };
  802. #endif /* MBEDTLS_CIPHER_MODE_CFB */
  803. #if defined(MBEDTLS_CIPHER_MODE_CTR)
  804. static const uint8_t aria_test2_ctr_ct[3][48] = // CTR ciphertext
  805. {
  806. { 0xac, 0x5d, 0x7d, 0xe8, 0x05, 0xa0, 0xbf, 0x1c, // 128-bit key
  807. 0x57, 0xc8, 0x54, 0x50, 0x1a, 0xf6, 0x0f, 0xa1,
  808. 0x14, 0x97, 0xe2, 0xa3, 0x45, 0x19, 0xde, 0xa1,
  809. 0x56, 0x9e, 0x91, 0xe5, 0xb5, 0xcc, 0xae, 0x2f,
  810. 0xf3, 0xbf, 0xa1, 0xbf, 0x97, 0x5f, 0x45, 0x71,
  811. 0xf4, 0x8b, 0xe1, 0x91, 0x61, 0x35, 0x46, 0xc3 },
  812. { 0x08, 0x62, 0x5c, 0xa8, 0xfe, 0x56, 0x9c, 0x19, // 192-bit key
  813. 0xba, 0x7a, 0xf3, 0x76, 0x0a, 0x6e, 0xd1, 0xce,
  814. 0xf4, 0xd1, 0x99, 0x26, 0x3e, 0x99, 0x9d, 0xde,
  815. 0x14, 0x08, 0x2d, 0xbb, 0xa7, 0x56, 0x0b, 0x79,
  816. 0xa4, 0xc6, 0xb4, 0x56, 0xb8, 0x70, 0x7d, 0xce,
  817. 0x75, 0x1f, 0x98, 0x54, 0xf1, 0x88, 0x93, 0xdf },
  818. { 0x30, 0x02, 0x6c, 0x32, 0x96, 0x66, 0x14, 0x17, // 256-bit key
  819. 0x21, 0x17, 0x8b, 0x99, 0xc0, 0xa1, 0xf1, 0xb2,
  820. 0xf0, 0x69, 0x40, 0x25, 0x3f, 0x7b, 0x30, 0x89,
  821. 0xe2, 0xa3, 0x0e, 0xa8, 0x6a, 0xa3, 0xc8, 0x8f,
  822. 0x59, 0x40, 0xf0, 0x5a, 0xd7, 0xee, 0x41, 0xd7,
  823. 0x13, 0x47, 0xbb, 0x72, 0x61, 0xe3, 0x48, 0xf1 }
  824. };
  825. #endif /* MBEDTLS_CIPHER_MODE_CFB */
  826. #define ARIA_SELF_TEST_IF_FAIL \
  827. { \
  828. if( verbose ) \
  829. mbedtls_printf( "failed\n" ); \
  830. return( 1 ); \
  831. } else { \
  832. if( verbose ) \
  833. mbedtls_printf( "passed\n" ); \
  834. }
  835. /*
  836. * Checkup routine
  837. */
  838. int mbedtls_aria_self_test( int verbose )
  839. {
  840. int i;
  841. uint8_t blk[MBEDTLS_ARIA_BLOCKSIZE];
  842. mbedtls_aria_context ctx;
  843. #if (defined(MBEDTLS_CIPHER_MODE_CFB) || defined(MBEDTLS_CIPHER_MODE_CTR))
  844. size_t j;
  845. #endif
  846. #if (defined(MBEDTLS_CIPHER_MODE_CBC) || \
  847. defined(MBEDTLS_CIPHER_MODE_CFB) || \
  848. defined(MBEDTLS_CIPHER_MODE_CTR))
  849. uint8_t buf[48], iv[MBEDTLS_ARIA_BLOCKSIZE];
  850. #endif
  851. /*
  852. * Test set 1
  853. */
  854. for( i = 0; i < 3; i++ )
  855. {
  856. /* test ECB encryption */
  857. if( verbose )
  858. mbedtls_printf( " ARIA-ECB-%d (enc): ", 128 + 64 * i );
  859. mbedtls_aria_setkey_enc( &ctx, aria_test1_ecb_key, 128 + 64 * i );
  860. mbedtls_aria_crypt_ecb( &ctx, aria_test1_ecb_pt, blk );
  861. if( memcmp( blk, aria_test1_ecb_ct[i], MBEDTLS_ARIA_BLOCKSIZE ) != 0 )
  862. ARIA_SELF_TEST_IF_FAIL;
  863. /* test ECB decryption */
  864. if( verbose )
  865. mbedtls_printf( " ARIA-ECB-%d (dec): ", 128 + 64 * i );
  866. mbedtls_aria_setkey_dec( &ctx, aria_test1_ecb_key, 128 + 64 * i );
  867. mbedtls_aria_crypt_ecb( &ctx, aria_test1_ecb_ct[i], blk );
  868. if( memcmp( blk, aria_test1_ecb_pt, MBEDTLS_ARIA_BLOCKSIZE ) != 0 )
  869. ARIA_SELF_TEST_IF_FAIL;
  870. }
  871. if( verbose )
  872. mbedtls_printf( "\n" );
  873. /*
  874. * Test set 2
  875. */
  876. #if defined(MBEDTLS_CIPHER_MODE_CBC)
  877. for( i = 0; i < 3; i++ )
  878. {
  879. /* Test CBC encryption */
  880. if( verbose )
  881. mbedtls_printf( " ARIA-CBC-%d (enc): ", 128 + 64 * i );
  882. mbedtls_aria_setkey_enc( &ctx, aria_test2_key, 128 + 64 * i );
  883. memcpy( iv, aria_test2_iv, MBEDTLS_ARIA_BLOCKSIZE );
  884. memset( buf, 0x55, sizeof( buf ) );
  885. mbedtls_aria_crypt_cbc( &ctx, MBEDTLS_ARIA_ENCRYPT, 48, iv,
  886. aria_test2_pt, buf );
  887. if( memcmp( buf, aria_test2_cbc_ct[i], 48 ) != 0 )
  888. ARIA_SELF_TEST_IF_FAIL;
  889. /* Test CBC decryption */
  890. if( verbose )
  891. mbedtls_printf( " ARIA-CBC-%d (dec): ", 128 + 64 * i );
  892. mbedtls_aria_setkey_dec( &ctx, aria_test2_key, 128 + 64 * i );
  893. memcpy( iv, aria_test2_iv, MBEDTLS_ARIA_BLOCKSIZE );
  894. memset( buf, 0xAA, sizeof( buf ) );
  895. mbedtls_aria_crypt_cbc( &ctx, MBEDTLS_ARIA_DECRYPT, 48, iv,
  896. aria_test2_cbc_ct[i], buf );
  897. if( memcmp( buf, aria_test2_pt, 48 ) != 0 )
  898. ARIA_SELF_TEST_IF_FAIL;
  899. }
  900. if( verbose )
  901. mbedtls_printf( "\n" );
  902. #endif /* MBEDTLS_CIPHER_MODE_CBC */
  903. #if defined(MBEDTLS_CIPHER_MODE_CFB)
  904. for( i = 0; i < 3; i++ )
  905. {
  906. /* Test CFB encryption */
  907. if( verbose )
  908. mbedtls_printf( " ARIA-CFB-%d (enc): ", 128 + 64 * i );
  909. mbedtls_aria_setkey_enc( &ctx, aria_test2_key, 128 + 64 * i );
  910. memcpy( iv, aria_test2_iv, MBEDTLS_ARIA_BLOCKSIZE );
  911. memset( buf, 0x55, sizeof( buf ) );
  912. j = 0;
  913. mbedtls_aria_crypt_cfb128( &ctx, MBEDTLS_ARIA_ENCRYPT, 48, &j, iv,
  914. aria_test2_pt, buf );
  915. if( memcmp( buf, aria_test2_cfb_ct[i], 48 ) != 0 )
  916. ARIA_SELF_TEST_IF_FAIL;
  917. /* Test CFB decryption */
  918. if( verbose )
  919. mbedtls_printf( " ARIA-CFB-%d (dec): ", 128 + 64 * i );
  920. mbedtls_aria_setkey_enc( &ctx, aria_test2_key, 128 + 64 * i );
  921. memcpy( iv, aria_test2_iv, MBEDTLS_ARIA_BLOCKSIZE );
  922. memset( buf, 0xAA, sizeof( buf ) );
  923. j = 0;
  924. mbedtls_aria_crypt_cfb128( &ctx, MBEDTLS_ARIA_DECRYPT, 48, &j,
  925. iv, aria_test2_cfb_ct[i], buf );
  926. if( memcmp( buf, aria_test2_pt, 48 ) != 0 )
  927. ARIA_SELF_TEST_IF_FAIL;
  928. }
  929. if( verbose )
  930. mbedtls_printf( "\n" );
  931. #endif /* MBEDTLS_CIPHER_MODE_CFB */
  932. #if defined(MBEDTLS_CIPHER_MODE_CTR)
  933. for( i = 0; i < 3; i++ )
  934. {
  935. /* Test CTR encryption */
  936. if( verbose )
  937. mbedtls_printf( " ARIA-CTR-%d (enc): ", 128 + 64 * i );
  938. mbedtls_aria_setkey_enc( &ctx, aria_test2_key, 128 + 64 * i );
  939. memset( iv, 0, MBEDTLS_ARIA_BLOCKSIZE ); // IV = 0
  940. memset( buf, 0x55, sizeof( buf ) );
  941. j = 0;
  942. mbedtls_aria_crypt_ctr( &ctx, 48, &j, iv, blk,
  943. aria_test2_pt, buf );
  944. if( memcmp( buf, aria_test2_ctr_ct[i], 48 ) != 0 )
  945. ARIA_SELF_TEST_IF_FAIL;
  946. /* Test CTR decryption */
  947. if( verbose )
  948. mbedtls_printf( " ARIA-CTR-%d (dec): ", 128 + 64 * i );
  949. mbedtls_aria_setkey_enc( &ctx, aria_test2_key, 128 + 64 * i );
  950. memset( iv, 0, MBEDTLS_ARIA_BLOCKSIZE ); // IV = 0
  951. memset( buf, 0xAA, sizeof( buf ) );
  952. j = 0;
  953. mbedtls_aria_crypt_ctr( &ctx, 48, &j, iv, blk,
  954. aria_test2_ctr_ct[i], buf );
  955. if( memcmp( buf, aria_test2_pt, 48 ) != 0 )
  956. ARIA_SELF_TEST_IF_FAIL;
  957. }
  958. if( verbose )
  959. mbedtls_printf( "\n" );
  960. #endif /* MBEDTLS_CIPHER_MODE_CTR */
  961. return( 0 );
  962. }
  963. #endif /* MBEDTLS_SELF_TEST */
  964. #endif /* MBEDTLS_ARIA_C */