blob: e6b675a3d21b9d39e81733f9d15be6d91ec2ea4c [file] [log] [blame]
Jerry Yu49231312023-01-10 16:57:21 +08001/*
2 * Arm64 crypto engine support functions
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 */
19
20#include <string.h>
21#include "common.h"
22
23#if defined(MBEDTLS_AESCE_C)
24
25#include "aesce.h"
26
27#if defined(MBEDTLS_HAVE_ARM64)
28
29#if defined(__clang__)
30# if __clang_major__ < 4
31# error "A more recent Clang is required for MBEDTLS_AES_C"
32# endif
33#elif defined(__GNUC__)
34# if __GNUC__ < 6
35# error "A more recent GCC is required for MBEDTLS_AES_C"
36# endif
37#else
38# error "Only GCC and Clang supported for MBEDTLS_AES_C"
39#endif
40
41#if !defined(__ARM_FEATURE_CRYPTO)
42# error "`crypto` feature moddifier MUST be enabled for MBEDTLS_AESCE_C."
43# error "Typical option for GCC and Clang is `-march=armv8-a+crypto`."
44#endif /* !__ARM_FEATURE_CRYPTO */
45
46#include <arm_neon.h>
47
Jerry Yub95c7762023-01-10 16:59:51 +080048#if defined(__linux__)
49#include <asm/hwcap.h>
50#include <sys/auxv.h>
51#endif
52
53/*
54 * AES instruction support detection routine
55 */
56int mbedtls_aesce_has_support(void)
57{
58#if defined(__linux__)
59 unsigned long auxval = getauxval(AT_HWCAP);
60 return (auxval & (HWCAP_ASIMD | HWCAP_AES)) ==
61 (HWCAP_ASIMD | HWCAP_AES);
62#else
63 /* Suppose aes instructions are supported. */
64 return 1;
65#endif
66}
67
Jerry Yu2bb3d812023-01-10 17:38:26 +080068static uint8x16_t aesce_encrypt_block(uint8x16_t block,
69 unsigned char *keys,
70 int rounds)
71{
72 for (int i = 0; i < rounds - 1; i++) {
73 block = vaeseq_u8(block, vld1q_u8(keys + i * 16));
74 /* AES mix columns */
75 block = vaesmcq_u8(block);
76 }
77
78 /* AES single round encryption */
79 block = vaeseq_u8(block, vld1q_u8(keys + (rounds -1) * 16));
80
81 /* Final Add (bitwise Xor) */
82 block = veorq_u8(block, vld1q_u8(keys + rounds * 16));
83
84 return block;
85}
86
87static uint8x16_t aesce_decrypt_block(uint8x16_t block,
88 unsigned char *keys,
89 int rounds)
90{
91
92 for (int i = 0; i < rounds - 1; i++) {
93 block = vaesdq_u8(block, vld1q_u8(keys + i * 16));
94 /* AES inverse mix columns */
95 block = vaesimcq_u8(block);
96 }
97
98 /* AES single round encryption */
99 block = vaesdq_u8(block, vld1q_u8(keys + (rounds - 1) * 16));
100
101 /* Final Add (bitwise Xor) */
102 block = veorq_u8(block, vld1q_u8(keys + rounds * 16));
103
104 return block;
105}
106
107/*
108 * AES-ECB block en(de)cryption
109 */
110int mbedtls_aesce_crypt_ecb(mbedtls_aes_context *ctx,
111 int mode,
112 const unsigned char input[16],
113 unsigned char output[16])
114{
115 uint8x16_t block = vld1q_u8(&input[0]);
116 unsigned char *keys = (unsigned char *) (ctx->buf + ctx->rk_offset);
117
118 if (mode == MBEDTLS_AES_ENCRYPT) {
119 block = aesce_encrypt_block(block, keys, ctx->nr);
120 } else {
121 block = aesce_decrypt_block(block, keys, ctx->nr);
122 }
123 vst1q_u8(&output[0], block);
124
125 return 0;
126}
127
Jerry Yu3f2fb712023-01-10 17:05:42 +0800128
Jerry Yue096da12023-01-10 17:07:01 +0800129/*
130 * Compute decryption round keys from encryption round keys
131 */
132void mbedtls_aesce_inverse_key(unsigned char *invkey,
133 const unsigned char *fwdkey,
134 int nr)
135{
136 int i, j;
137 j = nr;
138 vst1q_u8(invkey, vld1q_u8(fwdkey + j * 16));
139 for (i = 1, j--; j > 0; i++, j--) {
140 vst1q_u8(invkey + i * 16,
141 vaesimcq_u8(vld1q_u8(fwdkey + j * 16)));
142 }
143 vst1q_u8(invkey + i * 16, vld1q_u8(fwdkey + j * 16));
144
145}
146
Jerry Yu3f2fb712023-01-10 17:05:42 +0800147static uint8_t const rcon[] = { 0x01, 0x02, 0x04, 0x08, 0x10,
148 0x20, 0x40, 0x80, 0x1b, 0x36 };
149
150static inline uint32_t ror32_8(uint32_t word)
151{
152 return (word << (32 - 8)) | (word >> 8);
153}
154
155static inline uint32_t aes_sub(uint32_t in)
156{
157 uint32x4_t _in = vdupq_n_u32(in);
158 uint32x4_t v;
159 uint8x16_t zero = vdupq_n_u8(0);
160 v = vreinterpretq_u32_u8(vaeseq_u8(zero, vreinterpretq_u8_u32(_in)));
161 return vgetq_lane_u32(v, 0);
162}
163
164/*
165 * Key expansion, 128-bit case
166 */
167static void aesce_setkey_enc_128(unsigned char *rk,
168 const unsigned char *key)
169{
170 uint32_t *rki;
171 uint32_t *rko;
172 uint32_t *rk_u32 = (uint32_t *) rk;
173 memcpy(rk, key, (128 / 8));
174
175 for (size_t i = 0; i < sizeof(rcon); i++) {
176 rki = rk_u32 + i * (128 / 32);
177 rko = rki + (128 / 32);
178 rko[0] = ror32_8(aes_sub(rki[(128 / 32) - 1])) ^ rcon[i] ^ rki[0];
179 rko[1] = rko[0] ^ rki[1];
180 rko[2] = rko[1] ^ rki[2];
181 rko[3] = rko[2] ^ rki[3];
182 }
183}
184
185/*
186 * Key expansion, 192-bit case
187 */
188static void aesce_setkey_enc_192(unsigned char *rk,
189 const unsigned char *key)
190{
191 uint32_t *rki;
192 uint32_t *rko;
193 uint32_t *rk_u32 = (uint32_t *) rk;
194 memcpy(rk, key, (192 / 8));
195
196 for (size_t i = 0; i < 8; i++) {
197 rki = rk_u32 + i * (192 / 32);
198 rko = rki + (192 / 32);
199 rko[0] = ror32_8(aes_sub(rki[(192 / 32) - 1])) ^ rcon[i] ^ rki[0];
200 rko[1] = rko[0] ^ rki[1];
201 rko[2] = rko[1] ^ rki[2];
202 rko[3] = rko[2] ^ rki[3];
203 if (i < 7) {
204 rko[4] = rko[3] ^ rki[4];
205 rko[5] = rko[4] ^ rki[5];
206 }
207 }
208}
209
210/*
211 * Key expansion, 256-bit case
212 */
213static void aesce_setkey_enc_256(unsigned char *rk,
214 const unsigned char *key)
215{
216 uint32_t *rki;
217 uint32_t *rko;
218 uint32_t *rk_u32 = (uint32_t *) rk;
219 memcpy(rk, key, (256 / 8));
220
221 for (size_t i = 0; i < 7; i++) {
222 rki = rk_u32 + i * (256 / 32);
223 rko = rki + (256 / 32);
224 rko[0] = ror32_8(aes_sub(rki[(256 / 32) - 1])) ^ rcon[i] ^ rki[0];
225 rko[1] = rko[0] ^ rki[1];
226 rko[2] = rko[1] ^ rki[2];
227 rko[3] = rko[2] ^ rki[3];
228 if (i < 6) {
229 rko[4] = aes_sub(rko[3]) ^ rki[4];
230 rko[5] = rko[4] ^ rki[5];
231 rko[6] = rko[5] ^ rki[6];
232 rko[7] = rko[6] ^ rki[7];
233 }
234 }
235}
236
237/*
238 * Key expansion, wrapper
239 */
240int mbedtls_aesce_setkey_enc(unsigned char *rk,
241 const unsigned char *key,
242 size_t bits)
243{
244 switch (bits) {
245 case 128: aesce_setkey_enc_128(rk, key); break;
246 case 192: aesce_setkey_enc_192(rk, key); break;
247 case 256: aesce_setkey_enc_256(rk, key); break;
248 default: return MBEDTLS_ERR_AES_INVALID_KEY_LENGTH;
249 }
250
251 return 0;
252}
253
Jerry Yu49231312023-01-10 16:57:21 +0800254#endif /* MBEDTLS_HAVE_ARM64 */
255
256#endif /* MBEDTLS_AESCE_C */