Remote Access Control

aes.c File Reference

---

Detailed Description

Source file for AES public and support functions.

This file contains the function implementation for the AES algorithm. Refer to the aes.h file for more details.

• File: aes.c
• Compiler: IAR EWAVR 4.11B
• Supported devices: ATtiny45/85
• AppNote: AVR411 - Secure Rolling Code Algorithm for Wireless Link

Author:

Atmel Corporation: http://www.atmel.com
Support email: avr@atmel.com

Name

Revision

4337

Date

2008-08-08 10:52:47 +0200 (fr, 08 aug 2008)

Copyright (c) 2006, Atmel Corporation All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

3. The name of ATMEL may not be used to endorse or promote products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY ATMEL ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE EXPRESSLY AND SPECIFICALLY DISCLAIMED. IN NO EVENT SHALL ATMEL BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Definition in file aes.c.

#include "aes.h"
#include "common.h"
#include "config.h"

Include dependency graph for aes.c:

Go to the source code of this file.

Defines
#define	BPOLY   0x1b
Functions
static void	addAndCopy (byte *buf1, byte *buf2, byte count)
static void	addConstantAndSubstitute (byte *bytes, const byte *constant, byte count)
static void	calcLastRoundKey (byte *scheduleBuffer)
void	cipher (byte *block, byte *scheduleBuffer, const byte *key)
static void	cycleLeft (byte *row)
void	invCipher (byte *block, byte *scheduleBuffer)
static void	invKeyExpansion (byte *scheduleBuffer, byte *roundConstant)
static void	invMixColumn (byte *column)
static void	invMixColumns (byte *state)
static void	invShiftRows (byte *state)
static void	invSubstituteAndAddConstant (byte *bytes, const byte *constant, byte count)
static void	keyExpansion (byte *scheduleBuffer, byte *roundConstant)
static void	mixColumn (byte *column)
static void	mixColumns (byte *state)
void	prepareInvCipher (byte *scheduleBuffer, const byte *key)
static void	shiftRows (byte *state)
static void	subBytes (byte *bytes, byte count)
Variables
const byte __flash	sBox [256]
const byte __flash	sBoxInv [256]

---

Define Documentation

#define BPOLY   0x1b

Lower 8 bits of AES polynomial (x^8+x^4+x^3+x+1), ie. (x^4+x^3+x+1).

Definition at line 55 of file aes.c.

Referenced by invCipher(), invKeyExpansion(), invMixColumn(), keyExpansion(), and mixColumn().

---

Function Documentation

static void addAndCopy	(	byte *	buf1,
		byte *	buf2,
		byte	count
	)			[static]

XOR 'count' bytes from 'buf1' and 'buf2' buffers and copy result to both buffers.

Definition at line 467 of file aes.c.

Referenced by keyExpansion().

{
        // Copy to temporary variables for optimization.
        byte * tempBuf1 = buf1;
        byte * tempBuf2 = buf2;
        byte tempCount = count;
        byte tempValue;

        do {
                 // Add in GF(2), ie. XOR.
                tempValue = *tempBuf1 ^ *tempBuf2;
                *tempBuf1++ = tempValue;
                *tempBuf2++ = tempValue;
        } while( --tempCount );
}

static void addConstantAndSubstitute	(	byte *	bytes,
		const byte *	constant,
		byte	count
	)			[static]

XOR 'count' bytes from 'constant' buffer into 'bytes' and substitute using S-Box.

Definition at line 508 of file aes.c.

References sBox.

Referenced by cipher().

{
        // Copy to temporary variables for optimization.
        byte * tempDestination = bytes;
        const byte * tempSource = constant;
        byte tempCount = count;
        byte tempValue;

        do {
                // Add in GF(2), ie. XOR.
                tempValue = *tempDestination ^ *tempSource++;
                *tempDestination++ = sBox[ tempValue ];
        } while( --tempCount );
}

static void calcLastRoundKey

(

byte *

scheduleBuffer

)

[static]

Prepare last round key in schedule given the initial key in 'scheduleBuffer' and 'roundConstant'.

Definition at line 817 of file aes.c.

References keyExpansion(), ROUNDS, and SCHEDULE_BLOCK_REPETITIONS.

Referenced by prepareInvCipher().

{
        byte roundConstant[ 4 ] = { 0x01, 0x00, 0x00, 0x00 };

#if SCHEDULE_KEY_REPETITIONS > 1
        initialKeyExpansion( scheduleBuffer, roundConstant );
#endif

        byte round;
        for( round = 1; round < ROUNDS+1; round += SCHEDULE_BLOCK_REPETITIONS ) {
                keyExpansion( scheduleBuffer, roundConstant );
        }
}

Here is the call graph for this function:

void cipher	(	byte *	block,
		byte *	scheduleBuffer,
		const byte *	key
	)

Encrypt data block with on-the-fly calculation of key schedule in 'scheduleBuffer'.

Definition at line 833 of file aes.c.

References addConstant(), addConstantAndSubstitute(), BLOCK_SIZE, copyBytes(), KEY_SIZE, keyExpansion(), mixColumns(), ROUNDS, and shiftRows().

Referenced by calcCMAC(), and calcCMACSubkey().

{
        byte roundConstant[4] = { 0x01, 0x00, 0x00, 0x00 };

        copyBytes( scheduleBuffer, key, KEY_SIZE );
#if SCHEDULE_KEY_REPETITIONS > 1
        initialKeyExpansion( scheduleBuffer, roundConstant );
#endif

#if KEY_SIZE == 16
        byte round;
        for( round = 0; round < ROUNDS-1; ++round ) {
                addConstantAndSubstitute( block, scheduleBuffer, BLOCK_SIZE );
                shiftRows( block );
                mixColumns( block );

                keyExpansion( scheduleBuffer, roundConstant );
        }

        addConstantAndSubstitute( block, scheduleBuffer, BLOCK_SIZE );
        shiftRows( block );

        keyExpansion( scheduleBuffer, roundConstant );
        addConstant( block, scheduleBuffer, BLOCK_SIZE );

#elif KEY_SIZE == 24
        byte round;
        for( round = 0; round < ROUNDS-3; round += 3 ) {
                addConstantAndSubstitute( block, scheduleBuffer + BLOCK_SIZE*0, BLOCK_SIZE );
                shiftRows( block );
                mixColumns( block );

                addConstantAndSubstitute( block, scheduleBuffer + BLOCK_SIZE*1, BLOCK_SIZE );
                shiftRows( block );
                mixColumns( block );

                addConstantAndSubstitute( block, scheduleBuffer + BLOCK_SIZE*2, BLOCK_SIZE );
                shiftRows( block );
                mixColumns( block );

                keyExpansion( scheduleBuffer, roundConstant );
        }

        addConstantAndSubstitute( block, scheduleBuffer + BLOCK_SIZE*0, BLOCK_SIZE );
        shiftRows( block );
        mixColumns( block );

        addConstantAndSubstitute( block, scheduleBuffer + BLOCK_SIZE*1, BLOCK_SIZE );
        shiftRows( block );
        mixColumns( block );

        addConstantAndSubstitute( block, scheduleBuffer + BLOCK_SIZE*2, BLOCK_SIZE );
        shiftRows( block );

        keyExpansion( scheduleBuffer, roundConstant );
        addConstant( block, scheduleBuffer, BLOCK_SIZE );

#elif KEY_SIZE == 32
        byte round;
        for( round = 0; round < ROUNDS-2; round += 2 ) {
                addConstantAndSubstitute( block, scheduleBuffer + BLOCK_SIZE*0, BLOCK_SIZE );
                shiftRows( block );
                mixColumns( block );

                addConstantAndSubstitute( block, scheduleBuffer + BLOCK_SIZE*1, BLOCK_SIZE );
                shiftRows( block );
                mixColumns( block );

                keyExpansion( scheduleBuffer, roundConstant );
        }

        addConstantAndSubstitute( block, scheduleBuffer + BLOCK_SIZE*0, BLOCK_SIZE );
        shiftRows( block );
        mixColumns( block );

        addConstantAndSubstitute( block, scheduleBuffer + BLOCK_SIZE*1, BLOCK_SIZE );
        shiftRows( block );

        keyExpansion( scheduleBuffer, roundConstant );
        addConstant( block, scheduleBuffer, BLOCK_SIZE );

#else
  #error Unsupported key size.
#endif
}

Here is the call graph for this function:

static void cycleLeft

(

byte *

row

)

[static]

Cycle a 4-byte array left once.

Definition at line 134 of file aes.c.

Referenced by invKeyExpansion(), and keyExpansion().

{
        // Cycle 4 bytes in an array left once.
        byte temp = row[0];
        row[0] = row[1];
        row[1] = row[2];
        row[2] = row[3];
        row[3] = temp;
}

void invCipher	(	byte *	block,
		byte *	scheduleBuffer
	)

Decrypt data block using prepared key schedule state from 'scheduleBuffer'.

Definition at line 929 of file aes.c.

References addConstant(), BLOCK_SIZE, BPOLY, invKeyExpansion(), invMixColumns(), invShiftRows(), invSubstituteAndAddConstant(), LAST_ROUND_CONSTANT, and ROUNDS.

Referenced by learnMode().

{
        byte roundConstant[4] = { LAST_ROUND_CONSTANT, 0x00, 0x00, 0x00 };

#if KEY_SIZE == 16
        addConstant( block, scheduleBuffer, BLOCK_SIZE );

        byte round;
        for( round = 0; round < ROUNDS-1; ++round ) {
                invKeyExpansion( scheduleBuffer, roundConstant );

                invShiftRows( block );
                invSubstituteAndAddConstant( block, scheduleBuffer, BLOCK_SIZE );
                invMixColumns( block );
        }

        invKeyExpansion( scheduleBuffer, roundConstant );

        invShiftRows( block );
        invSubstituteAndAddConstant( block, scheduleBuffer, BLOCK_SIZE );

#elif KEY_SIZE == 24
        // Backtrace last update of round constant, since it is never
        // used, due to the use of two KEY_SIZEs in schedule buffer.
        if( (roundConstant[0] ^ BPOLY) == 0 ) {
                roundConstant[0] = 0x80;
        } else {
                roundConstant[0] >>= 1;
        }

        addConstant( block, scheduleBuffer, BLOCK_SIZE );

        byte round;
        for( round = 0; round < ROUNDS-3; round += 3 ) {
                invKeyExpansion( scheduleBuffer, roundConstant );

                invShiftRows( block );
                invSubstituteAndAddConstant( block, scheduleBuffer + BLOCK_SIZE*2, BLOCK_SIZE );
                invMixColumns( block );

                invShiftRows( block );
                invSubstituteAndAddConstant( block, scheduleBuffer + BLOCK_SIZE*1, BLOCK_SIZE );
                invMixColumns( block );

                invShiftRows( block );
                invSubstituteAndAddConstant( block, scheduleBuffer + BLOCK_SIZE*0, BLOCK_SIZE );
                invMixColumns( block );
        }

        invKeyExpansion( scheduleBuffer, roundConstant );

        invShiftRows( block );
        invSubstituteAndAddConstant( block, scheduleBuffer + BLOCK_SIZE*2, BLOCK_SIZE );
        invMixColumns( block );

        invShiftRows( block );
        invSubstituteAndAddConstant( block, scheduleBuffer + BLOCK_SIZE*1, BLOCK_SIZE );
        invMixColumns( block );

        invShiftRows( block );
        invSubstituteAndAddConstant( block, scheduleBuffer + BLOCK_SIZE*0, BLOCK_SIZE );

#elif KEY_SIZE == 32
        addConstant( block, scheduleBuffer, BLOCK_SIZE );

        byte round;
        for( round = 0; round < ROUNDS-2; round += 2 ) {
                invKeyExpansion( scheduleBuffer, roundConstant );

                invShiftRows( block );
                invSubstituteAndAddConstant( block, scheduleBuffer + BLOCK_SIZE, BLOCK_SIZE );
                invMixColumns( block );

                invShiftRows( block );
                invSubstituteAndAddConstant( block, scheduleBuffer, BLOCK_SIZE );
                invMixColumns( block );
        }

        invKeyExpansion( scheduleBuffer, roundConstant );

        invShiftRows( block );
        invSubstituteAndAddConstant( block, scheduleBuffer + BLOCK_SIZE, BLOCK_SIZE );
        invMixColumns( block );

        invShiftRows( block );
        invSubstituteAndAddConstant( block, scheduleBuffer, BLOCK_SIZE );

#else
  #error Unsupported key size.
#endif
}

Here is the call graph for this function:

static void invKeyExpansion	(	byte *	scheduleBuffer,
		byte *	roundConstant
	)			[static]

Calculate previous round key from current round key in 'scheduleBuffer' and 'roundConstant'.

Definition at line 683 of file aes.c.

References addConstant(), BLOCK_SIZE, BPOLY, copyBytes(), cycleLeft(), KEY_SIZE, SCHEDULE_BUFFER_SIZE, and subBytes().

Referenced by invCipher().

{
        byte tempWord[4];

#if KEY_SIZE == 16 || KEY_SIZE == 32
        byte schedulePos = SCHEDULE_BUFFER_SIZE - 4;
        scheduleBuffer += SCHEDULE_BUFFER_SIZE - 4;

  #if KEY_SIZE == 32
        do {
                // Add with previous word.
                addConstant( scheduleBuffer, scheduleBuffer - 4, 4 );

                // Move to previous word in schedule.
                scheduleBuffer -= 4;
                schedulePos -= 4;

        } while( schedulePos > BLOCK_SIZE );

        // Prepare substitution of previous word.
        copyBytes( tempWord, scheduleBuffer - 4, 4 );
        subBytes( tempWord, 4 );

        // Add substituted word to current word.
        addConstant( scheduleBuffer, tempWord, 4 );

        // Move to previous word in schedule.
        scheduleBuffer -= 4;
        schedulePos -= 4;
  #endif

        do {
                // Add with previous word.
                addConstant( scheduleBuffer, scheduleBuffer - 4, 4 );

                // Move to previous word in schedule.
                scheduleBuffer -= 4;
                schedulePos -= 4;

        } while( schedulePos > 0 );

        // Prepare round constant for transformation that follows.
        if( (roundConstant[0] ^ BPOLY) == 0 ) {
                roundConstant[0] = 0x80;
        } else {
                roundConstant[0] >>= 1;
        }

        // Prepare transformation of previous word (which is now at end of buffer).
        copyBytes( tempWord, scheduleBuffer + SCHEDULE_BUFFER_SIZE - 4, 4 );
        cycleLeft( tempWord );
        subBytes( tempWord, 4 );
        addConstant( tempWord, roundConstant, 4 );

        // Apply transformation result to current word.
        addConstant( scheduleBuffer, tempWord, 4 );

#elif KEY_SIZE == 24
        // Move to end of first KEY_SIZE in schedule.
        byte schedulePos = (SCHEDULE_BUFFER_SIZE/2) - 4;
        scheduleBuffer += (SCHEDULE_BUFFER_SIZE/2) - 4;

        do {
                // Get current word.
                // Add with previous word.
                // Store at position one KEY_SIZE backwards (wraps to end of buffer).
                addAndStore( scheduleBuffer, scheduleBuffer - 4, scheduleBuffer + KEY_SIZE, 4 );

                // Move to previous word in schedule.
                scheduleBuffer -= 4;
                schedulePos -= 4;

        } while( schedulePos > 0 );

        // Prepare round constant for transformation that follows.
        if( (roundConstant[0] ^ BPOLY) == 0 ) {
                roundConstant[0] = 0x80;
        } else {
                roundConstant[0] >>= 1;
        }

        // Prepare transformation of previous word (which is now at end of buffer).
        copyBytes( tempWord, scheduleBuffer + SCHEDULE_BUFFER_SIZE - 4, 4 );
        cycleLeft( tempWord );
        subBytes( tempWord, 4 );
        addConstant( tempWord, roundConstant, 4 );

        // Add current word to transformation result.
        addConstant( tempWord, scheduleBuffer, 4 );
        // Store at position one KEY_SIZE backwards (wraps to end of buffer).
        copyBytes( scheduleBuffer + KEY_SIZE, tempWord, 4 );

        // Move to last word in schedule.
        schedulePos = SCHEDULE_BUFFER_SIZE - 4;
        scheduleBuffer += SCHEDULE_BUFFER_SIZE - 4;

        do {
                // Get current word.
                // Add with previous word.
                // Store at position one KEY_SIZE backwards.
                addAndStore( scheduleBuffer, scheduleBuffer - 4, scheduleBuffer - KEY_SIZE, 4 );

                // Move to previous word in schedule.
                scheduleBuffer -= 4;
                schedulePos -= 4;

        } while( schedulePos > KEY_SIZE );

        // Prepare round constant for transformation that follows.
        if( (roundConstant[0] ^ BPOLY) == 0 ) {
                roundConstant[0] = 0x80;
        } else {
                roundConstant[0] >>= 1;
        }

        // Prepare transformation of previous word.
        copyBytes( tempWord, scheduleBuffer - 4, 4 );
        cycleLeft( tempWord );
        subBytes( tempWord, 4 );
        addConstant( tempWord, roundConstant, 4 );

        // Add current word to transformation result.
        addConstant( tempWord, scheduleBuffer, 4 );
        // Store at position one KEY_SIZE backwards.
        copyBytes( scheduleBuffer - KEY_SIZE, tempWord, 4 );

#else
  #error Unsupported key size.
#endif
}

Here is the call graph for this function:

static void invMixColumn

(

byte *

column

)

[static]

Perform an AES inverse column mix operation on the 4 bytes in 'column' buffer.

Definition at line 264 of file aes.c.

References BPOLY.

Referenced by invMixColumns().

{
        byte result0, result1, result2, result3;
        byte column0, column1, column2, column3;
        byte xor;

        // This generates more effective code, at least
        // with the IAR C compiler.
        column0 = column[0];
        column1 = column[1];
        column2 = column[2];
        column3 = column[3];

        // Partial sums (modular addition using XOR).
        result0 = column1 ^ column2 ^ column3;
        result1 = column0 ^ column2 ^ column3;
        result2 = column0 ^ column1 ^ column3;
        result3 = column0 ^ column1 ^ column2;

        // Multiply column bytes by 2 modulo BPOLY.
        // This operation is done the following way to ensure cycle count
        // independent from data contents. Take care when changing this code.
        xor = 0;
        if (column0 & 0x80) {
                xor = BPOLY;
        }
        column0 <<= 1;
        column0  ^= xor;
        
        xor = 0;
        if (column1 & 0x80) {
                xor = BPOLY;
        }
        column1 <<= 1;
        column1  ^= xor;
        
        xor = 0;
        if (column2 & 0x80) {
                xor = BPOLY;
        }
        column2 <<= 1;
        column2  ^= xor;
        
        xor = 0;
        if (column3 & 0x80) {
                xor = BPOLY;
        }
        column3 <<= 1;
        column3  ^= xor;

        // More partial sums.
        result0 ^= column0 ^ column1;
        result1 ^= column1 ^ column2;
        result2 ^= column2 ^ column3;
        result3 ^= column0 ^ column3;

        // Multiply column bytes by 2 modulo BPOLY.
        // This operation is done the following way to ensure cycle count
        // independent from data contents. Take care when changing this code.
        xor = 0;
        if (column0 & 0x80) {
                xor = BPOLY;
        }
        column0 <<= 1;
        column0  ^= xor;
        
        xor = 0;
        if (column1 & 0x80) {
                xor = BPOLY;
        }
        column1 <<= 1;
        column1  ^= xor;
        
        xor = 0;
        if (column2 & 0x80) {
                xor = BPOLY;
        }
        column2 <<= 1;
        column2  ^= xor;
        
        xor = 0;
        if (column3 & 0x80) {
                xor = BPOLY;
        }
        column3 <<= 1;
        column3  ^= xor;

        // More partial sums.
        result0 ^= column0 ^ column2;
        result1 ^= column1 ^ column3;
        result2 ^= column0 ^ column2;
        result3 ^= column1 ^ column3;

        // Multiply column bytes by 2 modulo BPOLY.
        // This operation is done the following way to ensure cycle count
        // independent from data contents. Take care when changing this code.
        xor = 0;
        if (column0 & 0x80) {
                xor = BPOLY;
        }
        column0 <<= 1;
        column0  ^= xor;
        
        xor = 0;
        if (column1 & 0x80) {
                xor = BPOLY;
        }
        column1 <<= 1;
        column1  ^= xor;
        
        xor = 0;
        if (column2 & 0x80) {
                xor = BPOLY;
        }
        column2 <<= 1;
        column2  ^= xor;
        
        xor = 0;
        if (column3 & 0x80) {
                xor = BPOLY;
        }
        column3 <<= 1;
        column3  ^= xor;

        // Final partial sum.
        column0 ^= column1 ^ column2 ^ column3;

        // Final sums stored indto original column bytes.
        column[0] = result0 ^ column0;
        column[1] = result1 ^ column0;
        column[2] = result2 ^ column0;
        column[3] = result3 ^ column0;
}

static void invMixColumns

(

byte *

state

)

[static]

Perform AES inverse column mixing for the whole AES block/state.

Definition at line 401 of file aes.c.

References invMixColumn().

Referenced by invCipher().

{
        invMixColumn( state + 0*4 );
        invMixColumn( state + 1*4 );
        invMixColumn( state + 2*4 );
        invMixColumn( state + 3*4 );
}

Here is the call graph for this function:

static void invShiftRows

(

byte *

state

)

[static]

Perform AES inverse shift rows operation for the whole AES block/state.

Definition at line 412 of file aes.c.

Referenced by invCipher().

{
        byte temp;

        // Note: State is arranged column by column.

        // Cycle second row right one time.
        temp = state[ 1 + 3*4 ];
        state[ 1 + 3*4 ] = state[ 1 + 2*4 ];
        state[ 1 + 2*4 ] = state[ 1 + 1*4 ];
        state[ 1 + 1*4 ] = state[ 1 + 0*4 ];
        state[ 1 + 0*4 ] = temp;

        // Cycle third row right two times.
        temp = state[ 2 + 0*4 ];
        state[ 2 + 0*4 ] = state[ 2 + 2*4 ];
        state[ 2 + 2*4 ] = temp;
        temp = state[ 2 + 1*4 ];
        state[ 2 + 1*4 ] = state[ 2 + 3*4 ];
        state[ 2 + 3*4 ] = temp;

        // Cycle fourth row right three times, ie. left once.
        temp = state[ 3 + 0*4 ];
        state[ 3 + 0*4 ] = state[ 3 + 1*4 ];
        state[ 3 + 1*4 ] = state[ 3 + 2*4 ];
        state[ 3 + 2*4 ] = state[ 3 + 3*4 ];
        state[ 3 + 3*4 ] = temp;
}

static void invSubstituteAndAddConstant	(	byte *	bytes,
		const byte *	constant,
		byte	count
	)			[static]

Substitute 'count' bytes from 'bytes' using inverse S-Box, XOR with 'constant' and store in 'bytes'.

Definition at line 526 of file aes.c.

References sBoxInv.

Referenced by invCipher().

{
        // Copy to temporary variables for optimization.
        byte * tempDestination = bytes;
        const byte * tempSource = constant;
        byte tempCount = count;
        byte tempValue;

        do {
                // Add in GF(2), ie. XOR.
                tempValue = *tempDestination;
                *tempDestination++ = sBoxInv[ tempValue ] ^ *tempSource++;
        } while( --tempCount );
}

static void keyExpansion	(	byte *	scheduleBuffer,
		byte *	roundConstant
	)			[static]

Calculates next round key from current round key in 'scheduleBuffer' and 'roundConstant'.

Definition at line 544 of file aes.c.

References addAndCopy(), addConstant(), BLOCK_SIZE, BPOLY, copyBytes(), cycleLeft(), KEY_SIZE, SCHEDULE_BUFFER_SIZE, and subBytes().

Referenced by calcLastRoundKey(), and cipher().

{
        byte tempWord[4];
        byte schedulePos = 0;

        // Get last word from previous schedule buffer.
        copyBytes( tempWord, scheduleBuffer + SCHEDULE_BUFFER_SIZE - 4, 4 );

        // Transform it, since we are at a KEY_SIZE boundary in the schedule.
        cycleLeft( tempWord );
        subBytes( tempWord, 4 );
        addConstant( tempWord, roundConstant, 4 );

        // Update round constant.
        if( roundConstant[0] & 0x80 ) {
                roundConstant[0] <<= 1;
                roundConstant[0] ^= BPOLY;
        } else {
                roundConstant[0] <<= 1;
        }

#if KEY_SIZE == 16 || KEY_SIZE == 32

  #if KEY_SIZE == 32
        do {
                // Add value from one KEY_SIZE backwards, ie. in last schedule buffer.
                // Store in buffer, replacing old value, which was one KEY_SIZE backwards.
                addAndCopy( tempWord, scheduleBuffer, 4 );

                // Move to next word in schedule buffer.
                scheduleBuffer += 4;
                schedulePos += 4;

        } while( schedulePos < BLOCK_SIZE );

        // Substitute previous word when at BLOCK_SIZE boundary with 256 bit keys.
        subBytes( tempWord, 4 );
  #endif

        do {
                // Add value from one KEY_SIZE backwards, ie. in last schedule buffer.
                // Store in buffer, replacing old value, which was one KEY_SIZE backwards.
                addAndCopy( tempWord, scheduleBuffer, 4 );

                // Move to next word in schedule buffer.
                scheduleBuffer += 4;
                schedulePos += 4;

        } while( schedulePos < SCHEDULE_BUFFER_SIZE );

#elif KEY_SIZE == 24
        do {
                // Add value from one KEY_SIZE backwards (wraps to end of buffer).
                // Store in buffer, replacing old value.
                addConstantAndCopy( tempWord, scheduleBuffer + KEY_SIZE, scheduleBuffer, 4 );

                // Move to next word in schedule buffer.
                scheduleBuffer += 4;
                schedulePos += 4;

        } while( schedulePos < KEY_SIZE );

        // Transform previous word, since we are at a KEY_SIZE boundary in the schedule.
        cycleLeft( tempWord );
        subBytes( tempWord, 4 );
        addConstant( tempWord, roundConstant, 4 );

        // Update round constant.
        if( roundConstant[0] & 0x80 ) {
                roundConstant[0] <<= 1;
                roundConstant[0] ^= BPOLY;
        } else {
                roundConstant[0] <<= 1;
        }

        do {
                // Add value from one KEY_SIZE backwards.
                // Store in buffer, replacing old value.
                addConstantAndCopy( tempWord, scheduleBuffer - KEY_SIZE, scheduleBuffer, 4 );

                // Move to next word in schedule buffer.
                scheduleBuffer += 4;
                schedulePos += 4;

        } while( schedulePos < SCHEDULE_BUFFER_SIZE );

#else
  #error Unsupported key size.
#endif
}

Here is the call graph for this function:

static void mixColumn

(

byte *

column

)

[static]

Perform an AES column mix operation on the 4 bytes in 'column' buffer.

Definition at line 147 of file aes.c.

References BPOLY.

Referenced by mixColumns().

{
        byte result0, result1, result2, result3;
        byte column0, column1, column2, column3;

        // This generates more effective code, at least
        // with the IAR C compiler.
        column0 = column[0];
        column1 = column[1];
        column2 = column[2];
        column3 = column[3];

        // Partial sums (modular addition using XOR).
        result0 = column1 ^ column2 ^ column3;
        result1 = column0 ^ column2 ^ column3;
        result2 = column0 ^ column1 ^ column3;
        result3 = column0 ^ column1 ^ column2;

        // Multiply column bytes by 2 modulo BPOLY.
        // This operation is done the following way to ensure cycle count
        // independent from data contents. Take care when changing this code.
        xor = 0;
        if (column0 & 0x80) {
                xor = BPOLY;
        }
        column0 <<= 1;
        column0  ^= xor;
        
        xor = 0;
        if (column1 & 0x80) {
                xor = BPOLY;
        }
        column1 <<= 1;
        column1  ^= xor;
        
        xor = 0;
        if (column2 & 0x80) {
                xor = BPOLY;
        }
        column2 <<= 1;
        column2  ^= xor;
        
        xor = 0;
        if (column3 & 0x80) {
                xor = BPOLY;
        }
        column3 <<= 1;
        column3  ^= xor;

        // Final sums stored into original column bytes.
        column[0] = result0 ^ column0 ^ column1;
        column[1] = result1 ^ column1 ^ column2;
        column[2] = result2 ^ column2 ^ column3;
        column[3] = result3 ^ column0 ^ column3;
}

static void mixColumns

(

byte *

state

)

[static]

Perform AES column mixing for the whole AES block/state.

Definition at line 206 of file aes.c.

References mixColumn().

Referenced by cipher().

{
        mixColumn( state + 0*4 );
        mixColumn( state + 1*4 );
        mixColumn( state + 2*4 );
        mixColumn( state + 3*4 );
}

Here is the call graph for this function:

void prepareInvCipher	(	byte *	scheduleBuffer,
		const byte *	key
	)

Calculate starting point for key schedule to be used for decryption.

Definition at line 921 of file aes.c.

References calcLastRoundKey(), copyBytes(), and KEY_SIZE.

Referenced by learnMode().

{
        copyBytes( scheduleBuffer, key, KEY_SIZE );
        calcLastRoundKey( scheduleBuffer );
}

Here is the call graph for this function:

static void shiftRows

(

byte *

state

)

[static]

Perform AES shift-rows operation for the whole AES block/state.

Definition at line 232 of file aes.c.

Referenced by cipher().

{
        byte temp;

        // Note: State is arranged column by column.

        // Cycle second row left one time.
        temp = state[ 1 + 0*4 ];
        state[ 1 + 0*4 ] = state[ 1 + 1*4 ];
        state[ 1 + 1*4 ] = state[ 1 + 2*4 ];
        state[ 1 + 2*4 ] = state[ 1 + 3*4 ];
        state[ 1 + 3*4 ] = temp;

        // Cycle third row left two times.
        temp = state[ 2 + 0*4 ];
        state[ 2 + 0*4 ] = state[ 2 + 2*4 ];
        state[ 2 + 2*4 ] = temp;
        temp = state[ 2 + 1*4 ];
        state[ 2 + 1*4 ] = state[ 2 + 3*4 ];
        state[ 2 + 3*4 ] = temp;

        // Cycle fourth row left three times, ie. right once.
        temp = state[ 3 + 3*4 ];
        state[ 3 + 3*4 ] = state[ 3 + 2*4 ];
        state[ 3 + 2*4 ] = state[ 3 + 1*4 ];
        state[ 3 + 1*4 ] = state[ 3 + 0*4 ];
        state[ 3 + 0*4 ] = temp;
}

static void subBytes	(	byte *	bytes,
		byte	count
	)			[static]

Substitute 'count' bytes in the 'bytes' buffer in SRAM using the S-Box.

Definition at line 217 of file aes.c.

References sBox.

Referenced by invKeyExpansion(), and keyExpansion().

{
        // Copy to temporary variables for optimization.
        byte * tempPtr = bytes;
        byte tempCount = count;

        do {
                *tempPtr = sBox[ *tempPtr ]; // Substitute every byte in state.
                ++tempPtr;
        } while( --tempCount );
}

---

Variable Documentation

const byte __flash sBox[256]

S-Box lookup table.

Definition at line 60 of file aes.c.

Referenced by addConstantAndSubstitute(), and subBytes().

const byte __flash sBoxInv[256]

Inverse S-Box lookup table.

Definition at line 96 of file aes.c.

Referenced by invSubstituteAndAddConstant().