Remote Access Control

aes.c File Reference

---

Detailed Description

Source file for AES public and support functions.

This file contains the function implementation for the AES algorithm. Refer to the aes.h file for more details.

• File: aes.c
• Compiler: IAR EWAVR 4.11B
• Supported devices: ATtiny45/85
• AppNote: AVR411 - Secure Rolling Code Algorithm for Wireless Link

Author:

Atmel Corporation: http://www.atmel.com
Support email: avr@atmel.com

Name

Revision

4331

Date

2008-08-07 16:44:55 +0200 (to, 07 aug 2008)

Copyright (c) 2006, Atmel Corporation All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

3. The name of ATMEL may not be used to endorse or promote products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY ATMEL ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE EXPRESSLY AND SPECIFICALLY DISCLAIMED. IN NO EVENT SHALL ATMEL BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Definition in file aes.c.

#include "aes.h"
#include "common.h"
#include "config.h"

Include dependency graph for aes.c:

Go to the source code of this file.

Defines
#define	BPOLY   0x1b
Functions
static void	addConstant (byte *bytes, const byte *constant, byte count)
static void	addConstantAndSubstitute (byte *bytes, const byte *constant, byte count)
static void	addConstantFromEEPROMAndSubstitute (byte *bytes, const byte __eeprom *constant, byte count)
void	calcKeySchedule (const byte __eeprom *key)
void	cipherLookup (byte *block)
static void	cycleLeft (byte *row)
static void	mixColumn (byte *column)
static void	mixColumns (byte *state)
static void	shiftRows (byte *state)
static void	subBytes (byte *bytes, byte count)
Variables
__no_init byte __eeprom	keyScheduleInEEPROM [SCHEDULE_EXTRA]
static byte	keyScheduleInSRAM [SCHEDULE_SPLIT]
static const byte __flash	sBox [256]

---

Define Documentation

#define BPOLY   0x1b

Lower 8 bits of AES polynomial (x^8+x^4+x^3+x+1), ie. (x^4+x^3+x+1).

Definition at line 55 of file aes.c.

Referenced by calcKeySchedule(), and mixColumn().

---

Function Documentation

static void addConstant	(	byte *	bytes,
		const byte *	constant,
		byte	count
	)			[static]

XOR 'count' bytes from 'constant' buffer into 'bytes' buffer in SRAM.

Definition at line 233 of file aes.c.

Referenced by calcKeySchedule(), and cipherLookup().

{
        // Copy to temporary variables for optimization.
        byte * tempDestination = bytes;
        const byte * tempSource = constant;
        byte tempCount = count;
        byte tempValue;

        do {
                 // Add in GF(2), ie. XOR.
                tempValue = *tempDestination ^ *tempSource++;
                *tempDestination++ = tempValue;
        } while( --tempCount );
}

static void addConstantAndSubstitute	(	byte *	bytes,
		const byte *	constant,
		byte	count
	)			[static]

XOR 'count' bytes from 'constant' buffer into 'bytes' and substitute using S-Box.

Definition at line 251 of file aes.c.

References sBox.

Referenced by cipherLookup().

{
        // Copy to temporary variables for optimization.
        byte * tempDestination = bytes;
        const byte * tempSource = constant;
        byte tempCount = count;
        byte tempValue;

        do {
                // Add in GF(2), ie. XOR.
                tempValue = *tempDestination ^ *tempSource++;
                *tempDestination++ = sBox[ tempValue ];
        } while( --tempCount );
}

static void addConstantFromEEPROMAndSubstitute	(	byte *	bytes,
		const byte __eeprom *	constant,
		byte	count
	)			[static]

XOR 'count' bytes from 'constant' buffer in EEPROM into 'bytes' and substitute using S-Box.

Definition at line 269 of file aes.c.

References sBox.

Referenced by cipherLookup().

{
        // Copy to temporary variables for optimization.
        byte * tempDestination = bytes;
        byte tempCount = count;
        byte tempValue;
        EEAR = (unsigned short int) constant;

        do {
                EECR |= (1<<EERE);
                ++EEAR;
                tempValue = *tempDestination ^ EEDR; // Add in GF(2), ie. XOR.
                *tempDestination++ = sBox[ tempValue ];
        } while( --tempCount );
}

void calcKeySchedule

(

const byte __eeprom *

key

)

Precalculate AES key schedule from given cipher key.

Definition at line 332 of file aes.c.

References addConstant(), addConstantFromEEPROM(), BLOCK_SIZE, BPOLY, copyBytes(), copyBytesFromEEPROM(), copyBytesToEEPROM(), cycleLeft(), KEY_SIZE, keyScheduleInEEPROM, keyScheduleInSRAM, SCHEDULE_SIZE, SCHEDULE_SPLIT, and subBytes().

Referenced by main(), and transmitTeachMessage().

{
        byte schedulePos; // Current position inside schedule.
        byte temp[4]; // Temporary word when expanding the key.
        byte roundConstant[4] = { 0x01, 0x00, 0x00, 0x00 };
        byte * keySchedule1 = keyScheduleInSRAM;
#if SCHEDULE_EXTRA > 0
        byte __eeprom * keySchedule2 = keyScheduleInEEPROM;
#endif

        // Copy entire key to start of schedule.
        copyBytesFromEEPROM( keySchedule1, key, KEY_SIZE );
        keySchedule1 += KEY_SIZE;
        // Copy last 4 bytes of key to temp word.
        copyBytes( temp, keySchedule1-4, 4 );

        // Expand key into schedule buffer 1 first.
        schedulePos = KEY_SIZE;
        while( schedulePos < SCHEDULE_SIZE ) {
                // Multiple of key size?
                if( (schedulePos % KEY_SIZE) == 0 ) {
                        cycleLeft( temp ); // Cycle left one byte.
                        subBytes( temp, 4 ); // Substitute each byte.
                        addConstant( temp, roundConstant, 4 ); // Add to temp.
                
                        // Modular doubling of round constant's first byte.
                        // This operation is done the following way to ensure cycle count
                        // independent from data contents. Take care when changing this code.
                        xor = 0;
                        if (roundConstant[0] & 0x80) {
                                xor = BPOLY;
                        }
                        roundConstant[0] <<= 1;
                        roundConstant[0]  ^= xor;
                }

#if KEY_SIZE > 24
                // Multiple of key size + block size, ie. block size into key.
                else if( (schedulePos % KEY_SIZE) == BLOCK_SIZE ) {
                        subBytes( temp, 4 ); // Substitute each byte.
                }
#endif

#if SCHEDULE_EXTRA > 0
                // Select correct source buffer for addition temp word.
                if( schedulePos <= SCHEDULE_SPLIT+KEY_SIZE-4 ) {
#endif
                        // Add with data KEY_SIZE backwards in schedule.
                        addConstant( temp, keySchedule1 - KEY_SIZE, 4 );

#if SCHEDULE_EXTRA > 0
                        // Copy temp word to currect destination buffer.
                        if( schedulePos <= SCHEDULE_SPLIT-4 ) {
#endif
                                copyBytes( keySchedule1, temp, 4 );
                                keySchedule1 += 4;
#if SCHEDULE_EXTRA > 0
                        } else {
                                copyBytesToEEPROM( keySchedule2, temp, 4 );
                                keySchedule1 += 4; // We need buffer 1 also.
                                keySchedule2 += 4;
                        }
                } else {
                        // Add with data KEY_SIZE backwards in schedule.
                        addConstantFromEEPROM( temp,
                                        keySchedule2 - KEY_SIZE, 4 );
                        copyBytesToEEPROM( keySchedule2, temp, 4 );
                        keySchedule2 += 4;
                }
#endif
                schedulePos += 4;
        }
}

Here is the call graph for this function:

void cipherLookup

(

byte *

block

)

Use precalculated key schedule to encrypt the given data block.

Definition at line 288 of file aes.c.

References addConstant(), addConstantAndSubstitute(), addConstantFromEEPROM(), addConstantFromEEPROMAndSubstitute(), BLOCK_SIZE, keyScheduleInEEPROM, keyScheduleInSRAM, mixColumns(), ROUNDS, SCHEDULE_SPLIT_BLOCKS, and shiftRows().

Referenced by calcCMAC(), calcCMACSubkey(), and transmitTeachMessage().

{
        byte * keySchedule1 = keyScheduleInSRAM;
        byte round = 0;

#if SCHEDULE_EXTRA > 0
        byte __eeprom * keySchedule2 = keyScheduleInEEPROM;

        for( ; round < SCHEDULE_SPLIT_BLOCKS; ++round ) {
                addConstantAndSubstitute( block, keySchedule1, BLOCK_SIZE );
                shiftRows( block );
                mixColumns( block );
                keySchedule1 += BLOCK_SIZE;
        }

        for( ; round < ROUNDS-1; ++round ) {
                addConstantFromEEPROMAndSubstitute( block,
                                keySchedule2, BLOCK_SIZE );
                shiftRows( block );
                mixColumns( block );
                keySchedule2 += BLOCK_SIZE;
        }

        addConstantFromEEPROMAndSubstitute( block, keySchedule2, BLOCK_SIZE );
        shiftRows( block );
        keySchedule2 += BLOCK_SIZE;
        addConstantFromEEPROM( block, keySchedule2, BLOCK_SIZE );
#else
        for( ; round < ROUNDS-1; ++round ) {
                addConstantAndSubstitute( block, keySchedule1, BLOCK_SIZE );
                shiftRows( block );
                mixColumns( block );
                keySchedule1 += BLOCK_SIZE;
        }

        addConstantAndSubstitute( block, keySchedule1, BLOCK_SIZE );
        shiftRows( block );
        keySchedule1 += BLOCK_SIZE;
        addConstant( block, keySchedule1, BLOCK_SIZE );
#endif
}

Here is the call graph for this function:

static void cycleLeft

(

byte *

row

)

[static]

Cycle a 4-byte array left once.

Definition at line 103 of file aes.c.

Referenced by calcKeySchedule().

{
        byte temp = row[0];
        row[0] = row[1];
        row[1] = row[2];
        row[2] = row[3];
        row[3] = temp;
}

static void mixColumn

(

byte *

column

)

[static]

Perform an AES column mix operation on the 4 bytes in 'column' buffer.

Definition at line 115 of file aes.c.

References BPOLY.

Referenced by mixColumns().

{
        byte result0, result1, result2, result3;
        byte column0, column1, column2, column3;
        byte xor;

        // This generates more effective code, at least
        // with the IAR C compiler.
        column0 = column[0];
        column1 = column[1];
        column2 = column[2];
        column3 = column[3];

        // Partial sums (modular addition using XOR).
        result0 = column1 ^ column2 ^ column3;
        result1 = column0 ^ column2 ^ column3;
        result2 = column0 ^ column1 ^ column3;
        result3 = column0 ^ column1 ^ column2;

        // Multiply column bytes by 2 modulo BPOLY.
        // This operation is done the following way to ensure cycle count
        // independent from data contents. Take care when changing this code.
        xor = 0;
        if (column0 & 0x80) {
                xor = BPOLY;
        }
        column0 <<= 1;
        column0  ^= xor;
        
        xor = 0;
        if (column1 & 0x80) {
                xor = BPOLY;
        }
        column1 <<= 1;
        column1  ^= xor;
        
        xor = 0;
        if (column2 & 0x80) {
                xor = BPOLY;
        }
        column2 <<= 1;
        column2  ^= xor;
        
        xor = 0;
        if (column3 & 0x80) {
                xor = BPOLY;
        }
        column3 <<= 1;
        column3  ^= xor;

        // Final sums stored into original column bytes.
        column[0] = result0 ^ column0 ^ column1;
        column[1] = result1 ^ column1 ^ column2;
        column[2] = result2 ^ column2 ^ column3;
        column[3] = result3 ^ column0 ^ column3;
}

static void mixColumns

(

byte *

state

)

[static]

Perform AES column mixing for the whole AES block/state.

Definition at line 175 of file aes.c.

References mixColumn().

Referenced by cipherLookup().

{
        mixColumn( state + 0*4 );
        mixColumn( state + 1*4 );
        mixColumn( state + 2*4 );
        mixColumn( state + 3*4 );
}

Here is the call graph for this function:

static void shiftRows

(

byte *

state

)

[static]

Perform AES shift rows operation for the whole AES block/state.

Definition at line 201 of file aes.c.

Referenced by cipherLookup().

{
        byte temp;

        // Note: State is arranged column by column.

        // Cycle second row left one time.
        temp = state[ 1 + 0*4 ];
        state[ 1 + 0*4 ] = state[ 1 + 1*4 ];
        state[ 1 + 1*4 ] = state[ 1 + 2*4 ];
        state[ 1 + 2*4 ] = state[ 1 + 3*4 ];
        state[ 1 + 3*4 ] = temp;

        // Cycle third row left two times.
        temp = state[ 2 + 0*4 ];
        state[ 2 + 0*4 ] = state[ 2 + 2*4 ];
        state[ 2 + 2*4 ] = temp;
        temp = state[ 2 + 1*4 ];
        state[ 2 + 1*4 ] = state[ 2 + 3*4 ];
        state[ 2 + 3*4 ] = temp;

        // Cycle fourth row left three times, ie. right once.
        temp = state[ 3 + 3*4 ];
        state[ 3 + 3*4 ] = state[ 3 + 2*4 ];
        state[ 3 + 2*4 ] = state[ 3 + 1*4 ];
        state[ 3 + 1*4 ] = state[ 3 + 0*4 ];
        state[ 3 + 0*4 ] = temp;
}

static void subBytes	(	byte *	bytes,
		byte	count
	)			[static]

Substitute 'count' bytes in the 'bytes' buffer in SRAM using the S-Box.

Definition at line 186 of file aes.c.

References sBox.

Referenced by calcKeySchedule().

{
        // Copy to temporary variables for optimization.
        byte * tempPtr = bytes;
        byte tempCount = count;

        do {
                *tempPtr = sBox[ *tempPtr ]; // Substitute every byte in state.
                ++tempPtr;
        } while( --tempCount );
}

---

Variable Documentation

__no_init byte __eeprom keyScheduleInEEPROM[SCHEDULE_EXTRA]

Definition at line 58 of file aes.c.

Referenced by calcKeySchedule(), and cipherLookup().

byte keyScheduleInSRAM[SCHEDULE_SPLIT] [static]

Primary (SRAM) storage for key schedule.

Definition at line 62 of file aes.c.

Referenced by calcKeySchedule(), and cipherLookup().

const byte __flash sBox[256] [static]

S-Box lookup table.

Definition at line 65 of file aes.c.

Referenced by addConstantAndSubstitute(), addConstantFromEEPROMAndSubstitute(), and subBytes().