aria.c
Go to the documentation of this file.
1 /**
2  * @file aria.c
3  * @brief ARIA encryption algorithm
4  *
5  * @section License
6  *
7  * SPDX-License-Identifier: GPL-2.0-or-later
8  *
9  * Copyright (C) 2010-2025 Oryx Embedded SARL. All rights reserved.
10  *
11  * This file is part of CycloneCRYPTO Open.
12  *
13  * This program is free software; you can redistribute it and/or
14  * modify it under the terms of the GNU General Public License
15  * as published by the Free Software Foundation; either version 2
16  * of the License, or (at your option) any later version.
17  *
18  * This program is distributed in the hope that it will be useful,
19  * but WITHOUT ANY WARRANTY; without even the implied warranty of
20  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
21  * GNU General Public License for more details.
22  *
23  * You should have received a copy of the GNU General Public License
24  * along with this program; if not, write to the Free Software Foundation,
25  * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
26  *
27  * @section Description
28  *
29  * ARIA is a 128-bit block cipher with 128-, 192-, and 256-bit keys. The
30  * algorithm consists of a key scheduling part and data randomizing part.
31  * Refer to RFC 5794 for more details
32  *
33  * @author Oryx Embedded SARL (www.oryx-embedded.com)
34  * @version 2.5.0
35  **/
36 
37 //Switch to the appropriate trace level
38 #define TRACE_LEVEL CRYPTO_TRACE_LEVEL
39 
40 //Dependencies
41 #include "core/crypto.h"
42 #include "cipher/aria.h"
43 #include "debug.h"
44 
45 //Check crypto library configuration
46 #if (ARIA_SUPPORT == ENABLED)
47 
48 //Move operation
49 #define MOV128(b, a) \
50 { \
51  (b)[0] = (a)[0]; \
52  (b)[1] = (a)[1]; \
53  (b)[2] = (a)[2]; \
54  (b)[3] = (a)[3]; \
55 }
56 
57 //XOR operation
58 #define XOR128(b, a) \
59 { \
60  (b)[0] ^= (a)[0]; \
61  (b)[1] ^= (a)[1]; \
62  (b)[2] ^= (a)[2]; \
63  (b)[3] ^= (a)[3]; \
64 }
65 
66 //Rotate left operation
67 #define ROL128(b, a, n) \
68 { \
69  (b)[0] = ((a)[((n) / 32 + 0) % 4] << ((n) % 32)) | \
70  ((a)[((n) / 32 + 1) % 4] >> (32 - ((n) % 32))); \
71  (b)[1] = ((a)[((n) / 32 + 1) % 4] << ((n) % 32)) | \
72  ((a)[((n) / 32 + 2) % 4] >> (32 - ((n) % 32))); \
73  (b)[2] = ((a)[((n) / 32 + 2) % 4] << ((n) % 32)) | \
74  ((a)[((n) / 32 + 3) % 4] >> (32 - ((n) % 32))); \
75  (b)[3] = ((a)[((n) / 32 + 3) % 4] << ((n) % 32)) | \
76  ((a)[((n) / 32 + 0) % 4] >> (32 - ((n) % 32))); \
77 }
78 
79 //Byte access
80 #define X(n) ((x[(n) / 4] >> ((3 - ((n) % 4)) * 8)) & 0xFF)
81 
82 //Substitution layer SL1
83 #define SL1(b, a) \
84 { \
85  uint32_t *x = (uint32_t *) (a); \
86  uint32_t *y = (uint32_t *) (b); \
87  y[0] = (uint32_t) sb1[X(0)] << 24; \
88  y[0] |= (uint32_t) sb2[X(1)] << 16; \
89  y[0] |= (uint32_t) sb3[X(2)] << 8; \
90  y[0] |= (uint32_t) sb4[X(3)]; \
91  y[1] = (uint32_t) sb1[X(4)] << 24; \
92  y[1] |= (uint32_t) sb2[X(5)] << 16; \
93  y[1] |= (uint32_t) sb3[X(6)] << 8; \
94  y[1] |= (uint32_t) sb4[X(7)]; \
95  y[2] = (uint32_t) sb1[X(8)] << 24; \
96  y[2] |= (uint32_t) sb2[X(9)] << 16; \
97  y[2] |= (uint32_t) sb3[X(10)] << 8; \
98  y[2] |= (uint32_t) sb4[X(11)]; \
99  y[3] = (uint32_t) sb1[X(12)] << 24; \
100  y[3] |= (uint32_t) sb2[X(13)] << 16; \
101  y[3] |= (uint32_t) sb3[X(14)] << 8; \
102  y[3] |= (uint32_t) sb4[X(15)]; \
103 }
104 
105 //Substitution layer SL2
106 #define SL2(b, a) \
107 { \
108  uint32_t *x = (uint32_t *) (a); \
109  uint32_t *y = (uint32_t *) (b); \
110  y[0] = (uint32_t) sb3[X(0)] << 24; \
111  y[0] |= (uint32_t) sb4[X(1)] << 16; \
112  y[0] |= (uint32_t) sb1[X(2)] << 8; \
113  y[0] |= (uint32_t) sb2[X(3)]; \
114  y[1] = (uint32_t) sb3[X(4)] << 24; \
115  y[1] |= (uint32_t) sb4[X(5)] << 16; \
116  y[1] |= (uint32_t) sb1[X(6)] << 8; \
117  y[1] |= (uint32_t) sb2[X(7)]; \
118  y[2] = (uint32_t) sb3[X(8)] << 24; \
119  y[2] |= (uint32_t) sb4[X(9)] << 16; \
120  y[2] |= (uint32_t) sb1[X(10)] << 8; \
121  y[2] |= (uint32_t) sb2[X(11)]; \
122  y[3] = (uint32_t) sb3[X(12)] << 24; \
123  y[3] |= (uint32_t) sb4[X(13)] << 16; \
124  y[3] |= (uint32_t) sb1[X(14)] << 8; \
125  y[3] |= (uint32_t) sb2[X(15)]; \
126 }
127 
128 //Diffusion layer
129 #define A(b, a) \
130 { \
131  uint32_t *x = (uint32_t *) (a); \
132  uint32_t *y = (uint32_t *) (b); \
133  y[0] = (X(3) ^ X(4) ^ X(6) ^ X(8) ^ X(9) ^ X(13) ^ X(14)) << 24; \
134  y[0] |= (X(2) ^ X(5) ^ X(7) ^ X(8) ^ X(9) ^ X(12) ^ X(15)) << 16; \
135  y[0] |= (X(1) ^ X(4) ^ X(6) ^ X(10) ^ X(11) ^ X(12) ^ X(15)) << 8; \
136  y[0] |= (X(0) ^ X(5) ^ X(7) ^ X(10) ^ X(11) ^ X(13) ^ X(14)); \
137  y[1] = (X(0) ^ X(2) ^ X(5) ^ X(8) ^ X(11) ^ X(14) ^ X(15)) << 24; \
138  y[1] |= (X(1) ^ X(3) ^ X(4) ^ X(9) ^ X(10) ^ X(14) ^ X(15)) << 16; \
139  y[1] |= (X(0) ^ X(2) ^ X(7) ^ X(9) ^ X(10) ^ X(12) ^ X(13)) << 8; \
140  y[1] |= (X(1) ^ X(3) ^ X(6) ^ X(8) ^ X(11) ^ X(12) ^ X(13)); \
141  y[2] = (X(0) ^ X(1) ^ X(4) ^ X(7) ^ X(10) ^ X(13) ^ X(15)) << 24; \
142  y[2] |= (X(0) ^ X(1) ^ X(5) ^ X(6) ^ X(11) ^ X(12) ^ X(14)) << 16; \
143  y[2] |= (X(2) ^ X(3) ^ X(5) ^ X(6) ^ X(8) ^ X(13) ^ X(15)) << 8; \
144  y[2] |= (X(2) ^ X(3) ^ X(4) ^ X(7) ^ X(9) ^ X(12) ^ X(14)); \
145  y[3] = (X(1) ^ X(2) ^ X(6) ^ X(7) ^ X(9) ^ X(11) ^ X(12)) << 24; \
146  y[3] |= (X(0) ^ X(3) ^ X(6) ^ X(7) ^ X(8) ^ X(10) ^ X(13)) << 16; \
147  y[3] |= (X(0) ^ X(3) ^ X(4) ^ X(5) ^ X(9) ^ X(11) ^ X(14)) << 8; \
148  y[3] |= (X(1) ^ X(2) ^ X(4) ^ X(5) ^ X(8) ^ X(10) ^ X(15)); \
149 }
150 
151 //S-box 1
152 static const uint8_t sb1[256] =
153 {
154  0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76,
155  0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0,
156  0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,
157  0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75,
158  0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84,
159  0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,
160  0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8,
161  0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5, 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2,
162  0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73,
163  0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB,
164  0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79,
165  0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9, 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08,
166  0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A,
167  0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E,
168  0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94, 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,
169  0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16
170 };
171 
172 //S-box 2
173 static const uint8_t sb2[256] =
174 {
175  0xE2, 0x4E, 0x54, 0xFC, 0x94, 0xC2, 0x4A, 0xCC, 0x62, 0x0D, 0x6A, 0x46, 0x3C, 0x4D, 0x8B, 0xD1,
176  0x5E, 0xFA, 0x64, 0xCB, 0xB4, 0x97, 0xBE, 0x2B, 0xBC, 0x77, 0x2E, 0x03, 0xD3, 0x19, 0x59, 0xC1,
177  0x1D, 0x06, 0x41, 0x6B, 0x55, 0xF0, 0x99, 0x69, 0xEA, 0x9C, 0x18, 0xAE, 0x63, 0xDF, 0xE7, 0xBB,
178  0x00, 0x73, 0x66, 0xFB, 0x96, 0x4C, 0x85, 0xE4, 0x3A, 0x09, 0x45, 0xAA, 0x0F, 0xEE, 0x10, 0xEB,
179  0x2D, 0x7F, 0xF4, 0x29, 0xAC, 0xCF, 0xAD, 0x91, 0x8D, 0x78, 0xC8, 0x95, 0xF9, 0x2F, 0xCE, 0xCD,
180  0x08, 0x7A, 0x88, 0x38, 0x5C, 0x83, 0x2A, 0x28, 0x47, 0xDB, 0xB8, 0xC7, 0x93, 0xA4, 0x12, 0x53,
181  0xFF, 0x87, 0x0E, 0x31, 0x36, 0x21, 0x58, 0x48, 0x01, 0x8E, 0x37, 0x74, 0x32, 0xCA, 0xE9, 0xB1,
182  0xB7, 0xAB, 0x0C, 0xD7, 0xC4, 0x56, 0x42, 0x26, 0x07, 0x98, 0x60, 0xD9, 0xB6, 0xB9, 0x11, 0x40,
183  0xEC, 0x20, 0x8C, 0xBD, 0xA0, 0xC9, 0x84, 0x04, 0x49, 0x23, 0xF1, 0x4F, 0x50, 0x1F, 0x13, 0xDC,
184  0xD8, 0xC0, 0x9E, 0x57, 0xE3, 0xC3, 0x7B, 0x65, 0x3B, 0x02, 0x8F, 0x3E, 0xE8, 0x25, 0x92, 0xE5,
185  0x15, 0xDD, 0xFD, 0x17, 0xA9, 0xBF, 0xD4, 0x9A, 0x7E, 0xC5, 0x39, 0x67, 0xFE, 0x76, 0x9D, 0x43,
186  0xA7, 0xE1, 0xD0, 0xF5, 0x68, 0xF2, 0x1B, 0x34, 0x70, 0x05, 0xA3, 0x8A, 0xD5, 0x79, 0x86, 0xA8,
187  0x30, 0xC6, 0x51, 0x4B, 0x1E, 0xA6, 0x27, 0xF6, 0x35, 0xD2, 0x6E, 0x24, 0x16, 0x82, 0x5F, 0xDA,
188  0xE6, 0x75, 0xA2, 0xEF, 0x2C, 0xB2, 0x1C, 0x9F, 0x5D, 0x6F, 0x80, 0x0A, 0x72, 0x44, 0x9B, 0x6C,
189  0x90, 0x0B, 0x5B, 0x33, 0x7D, 0x5A, 0x52, 0xF3, 0x61, 0xA1, 0xF7, 0xB0, 0xD6, 0x3F, 0x7C, 0x6D,
190  0xED, 0x14, 0xE0, 0xA5, 0x3D, 0x22, 0xB3, 0xF8, 0x89, 0xDE, 0x71, 0x1A, 0xAF, 0xBA, 0xB5, 0x81
191 };
192 
193 //S-box 3
194 static const uint8_t sb3[256] =
195 {
196  0x52, 0x09, 0x6A, 0xD5, 0x30, 0x36, 0xA5, 0x38, 0xBF, 0x40, 0xA3, 0x9E, 0x81, 0xF3, 0xD7, 0xFB,
197  0x7C, 0xE3, 0x39, 0x82, 0x9B, 0x2F, 0xFF, 0x87, 0x34, 0x8E, 0x43, 0x44, 0xC4, 0xDE, 0xE9, 0xCB,
198  0x54, 0x7B, 0x94, 0x32, 0xA6, 0xC2, 0x23, 0x3D, 0xEE, 0x4C, 0x95, 0x0B, 0x42, 0xFA, 0xC3, 0x4E,
199  0x08, 0x2E, 0xA1, 0x66, 0x28, 0xD9, 0x24, 0xB2, 0x76, 0x5B, 0xA2, 0x49, 0x6D, 0x8B, 0xD1, 0x25,
200  0x72, 0xF8, 0xF6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xD4, 0xA4, 0x5C, 0xCC, 0x5D, 0x65, 0xB6, 0x92,
201  0x6C, 0x70, 0x48, 0x50, 0xFD, 0xED, 0xB9, 0xDA, 0x5E, 0x15, 0x46, 0x57, 0xA7, 0x8D, 0x9D, 0x84,
202  0x90, 0xD8, 0xAB, 0x00, 0x8C, 0xBC, 0xD3, 0x0A, 0xF7, 0xE4, 0x58, 0x05, 0xB8, 0xB3, 0x45, 0x06,
203  0xD0, 0x2C, 0x1E, 0x8F, 0xCA, 0x3F, 0x0F, 0x02, 0xC1, 0xAF, 0xBD, 0x03, 0x01, 0x13, 0x8A, 0x6B,
204  0x3A, 0x91, 0x11, 0x41, 0x4F, 0x67, 0xDC, 0xEA, 0x97, 0xF2, 0xCF, 0xCE, 0xF0, 0xB4, 0xE6, 0x73,
205  0x96, 0xAC, 0x74, 0x22, 0xE7, 0xAD, 0x35, 0x85, 0xE2, 0xF9, 0x37, 0xE8, 0x1C, 0x75, 0xDF, 0x6E,
206  0x47, 0xF1, 0x1A, 0x71, 0x1D, 0x29, 0xC5, 0x89, 0x6F, 0xB7, 0x62, 0x0E, 0xAA, 0x18, 0xBE, 0x1B,
207  0xFC, 0x56, 0x3E, 0x4B, 0xC6, 0xD2, 0x79, 0x20, 0x9A, 0xDB, 0xC0, 0xFE, 0x78, 0xCD, 0x5A, 0xF4,
208  0x1F, 0xDD, 0xA8, 0x33, 0x88, 0x07, 0xC7, 0x31, 0xB1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xEC, 0x5F,
209  0x60, 0x51, 0x7F, 0xA9, 0x19, 0xB5, 0x4A, 0x0D, 0x2D, 0xE5, 0x7A, 0x9F, 0x93, 0xC9, 0x9C, 0xEF,
210  0xA0, 0xE0, 0x3B, 0x4D, 0xAE, 0x2A, 0xF5, 0xB0, 0xC8, 0xEB, 0xBB, 0x3C, 0x83, 0x53, 0x99, 0x61,
211  0x17, 0x2B, 0x04, 0x7E, 0xBA, 0x77, 0xD6, 0x26, 0xE1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0C, 0x7D
212 };
213 
214 //S-box 4
215 static const uint8_t sb4[256] =
216 {
217  0x30, 0x68, 0x99, 0x1B, 0x87, 0xB9, 0x21, 0x78, 0x50, 0x39, 0xDB, 0xE1, 0x72, 0x09, 0x62, 0x3C,
218  0x3E, 0x7E, 0x5E, 0x8E, 0xF1, 0xA0, 0xCC, 0xA3, 0x2A, 0x1D, 0xFB, 0xB6, 0xD6, 0x20, 0xC4, 0x8D,
219  0x81, 0x65, 0xF5, 0x89, 0xCB, 0x9D, 0x77, 0xC6, 0x57, 0x43, 0x56, 0x17, 0xD4, 0x40, 0x1A, 0x4D,
220  0xC0, 0x63, 0x6C, 0xE3, 0xB7, 0xC8, 0x64, 0x6A, 0x53, 0xAA, 0x38, 0x98, 0x0C, 0xF4, 0x9B, 0xED,
221  0x7F, 0x22, 0x76, 0xAF, 0xDD, 0x3A, 0x0B, 0x58, 0x67, 0x88, 0x06, 0xC3, 0x35, 0x0D, 0x01, 0x8B,
222  0x8C, 0xC2, 0xE6, 0x5F, 0x02, 0x24, 0x75, 0x93, 0x66, 0x1E, 0xE5, 0xE2, 0x54, 0xD8, 0x10, 0xCE,
223  0x7A, 0xE8, 0x08, 0x2C, 0x12, 0x97, 0x32, 0xAB, 0xB4, 0x27, 0x0A, 0x23, 0xDF, 0xEF, 0xCA, 0xD9,
224  0xB8, 0xFA, 0xDC, 0x31, 0x6B, 0xD1, 0xAD, 0x19, 0x49, 0xBD, 0x51, 0x96, 0xEE, 0xE4, 0xA8, 0x41,
225  0xDA, 0xFF, 0xCD, 0x55, 0x86, 0x36, 0xBE, 0x61, 0x52, 0xF8, 0xBB, 0x0E, 0x82, 0x48, 0x69, 0x9A,
226  0xE0, 0x47, 0x9E, 0x5C, 0x04, 0x4B, 0x34, 0x15, 0x79, 0x26, 0xA7, 0xDE, 0x29, 0xAE, 0x92, 0xD7,
227  0x84, 0xE9, 0xD2, 0xBA, 0x5D, 0xF3, 0xC5, 0xB0, 0xBF, 0xA4, 0x3B, 0x71, 0x44, 0x46, 0x2B, 0xFC,
228  0xEB, 0x6F, 0xD5, 0xF6, 0x14, 0xFE, 0x7C, 0x70, 0x5A, 0x7D, 0xFD, 0x2F, 0x18, 0x83, 0x16, 0xA5,
229  0x91, 0x1F, 0x05, 0x95, 0x74, 0xA9, 0xC1, 0x5B, 0x4A, 0x85, 0x6D, 0x13, 0x07, 0x4F, 0x4E, 0x45,
230  0xB2, 0x0F, 0xC9, 0x1C, 0xA6, 0xBC, 0xEC, 0x73, 0x90, 0x7B, 0xCF, 0x59, 0x8F, 0xA1, 0xF9, 0x2D,
231  0xF2, 0xB1, 0x00, 0x94, 0x37, 0x9F, 0xD0, 0x2E, 0x9C, 0x6E, 0x28, 0x3F, 0x80, 0xF0, 0x3D, 0xD3,
232  0x25, 0x8A, 0xB5, 0xE7, 0x42, 0xB3, 0xC7, 0xEA, 0xF7, 0x4C, 0x11, 0x33, 0x03, 0xA2, 0xAC, 0x60
233 };
234 
235 //Key scheduling constants
236 static const uint32_t c[12] =
237 {
238  0x517CC1B7, 0x27220A94, 0xFE13ABE8, 0xFA9A6EE0, 0x6DB14ACC, 0x9E21C820,
239  0xFF28B1D5, 0xEF5DE2B0, 0xDB92371D, 0x2126E970, 0x03249775, 0x04E8C90E
240 };
241 
242 //ARIA128-ECB OID (1.2.410.200046.1.1.1)
243 const uint8_t ARIA128_ECB_OID[9] = {0x2A, 0x83, 0x1A, 0x8C, 0x9A, 0x6E, 0x01, 0x01, 0x01};
244 //ARIA128-CBC OID (1.2.410.200046.1.1.2)
245 const uint8_t ARIA128_CBC_OID[9] = {0x2A, 0x83, 0x1A, 0x8C, 0x9A, 0x6E, 0x01, 0x01, 0x02};
246 //ARIA128-CFB OID (1.2.410.200046.1.1.3)
247 const uint8_t ARIA128_CFB_OID[9] = {0x2A, 0x83, 0x1A, 0x8C, 0x9A, 0x6E, 0x01, 0x01, 0x03};
248 //ARIA128-OFB OID (1.2.410.200046.1.1.4)
249 const uint8_t ARIA128_OFB_OID[9] = {0x2A, 0x83, 0x1A, 0x8C, 0x9A, 0x6E, 0x01, 0x01, 0x04};
250 //ARIA128-CTR OID (1.2.410.200046.1.1.5)
251 const uint8_t ARIA128_CTR_OID[9] = {0x2A, 0x83, 0x1A, 0x8C, 0x9A, 0x6E, 0x01, 0x01, 0x05};
252 
253 //ARIA192-ECB OID (1.2.410.200046.1.1.6)
254 const uint8_t ARIA192_ECB_OID[9] = {0x2A, 0x83, 0x1A, 0x8C, 0x9A, 0x6E, 0x01, 0x01, 0x06};
255 //ARIA192-CBC OID (1.2.410.200046.1.1.7)
256 const uint8_t ARIA192_CBC_OID[9] = {0x2A, 0x83, 0x1A, 0x8C, 0x9A, 0x6E, 0x01, 0x01, 0x07};
257 //ARIA192-CFB OID (1.2.410.200046.1.1.8)
258 const uint8_t ARIA192_CFB_OID[9] = {0x2A, 0x83, 0x1A, 0x8C, 0x9A, 0x6E, 0x01, 0x01, 0x08};
259 //ARIA192-OFB OID (1.2.410.200046.1.1.9)
260 const uint8_t ARIA192_OFB_OID[9] = {0x2A, 0x83, 0x1A, 0x8C, 0x9A, 0x6E, 0x01, 0x01, 0x09};
261 //ARIA192-CTR OID (1.2.410.200046.1.1.10)
262 const uint8_t ARIA192_CTR_OID[9] = {0x2A, 0x83, 0x1A, 0x8C, 0x9A, 0x6E, 0x01, 0x01, 0x0A};
263 
264 //ARIA256-ECB OID (1.2.410.200046.1.1.11)
265 const uint8_t ARIA256_ECB_OID[9] = {0x2A, 0x83, 0x1A, 0x8C, 0x9A, 0x6E, 0x01, 0x01, 0x0B};
266 //ARIA256-CBC OID (1.2.410.200046.1.1.12)
267 const uint8_t ARIA256_CBC_OID[9] = {0x2A, 0x83, 0x1A, 0x8C, 0x9A, 0x6E, 0x01, 0x01, 0x0C};
268 //ARIA256-CFB OID (1.2.410.200046.1.1.13)
269 const uint8_t ARIA256_CFB_OID[9] = {0x2A, 0x83, 0x1A, 0x8C, 0x9A, 0x6E, 0x01, 0x01, 0x0D};
270 //ARIA256-OFB OID (1.2.410.200046.1.1.14)
271 const uint8_t ARIA256_OFB_OID[9] = {0x2A, 0x83, 0x1A, 0x8C, 0x9A, 0x6E, 0x01, 0x01, 0x0E};
272 //ARIA256-CTR OID (1.2.410.200046.1.1.15)
273 const uint8_t ARIA256_CTR_OID[9] = {0x2A, 0x83, 0x1A, 0x8C, 0x9A, 0x6E, 0x01, 0x01, 0x0F};
274 
275 //ARIA128-GCM OID (1.2.410.200046.1.1.34)
276 const uint8_t ARIA128_GCM_OID[9] = {0x2A, 0x83, 0x1A, 0x8C, 0x9A, 0x6E, 0x01, 0x01, 0x22};
277 //ARIA192-GCM OID (1.2.410.200046.1.1.35)
278 const uint8_t ARIA192_GCM_OID[9] = {0x2A, 0x83, 0x1A, 0x8C, 0x9A, 0x6E, 0x01, 0x01, 0x23};
279 //ARIA256-GCM OID (1.2.410.200046.1.1.36)
280 const uint8_t ARIA256_GCM_OID[9] = {0x2A, 0x83, 0x1A, 0x8C, 0x9A, 0x6E, 0x01, 0x01, 0x24};
281 
282 //ARIA128-CCM OID (1.2.410.200046.1.1.37)
283 const uint8_t ARIA128_CCM_OID[9] = {0x2A, 0x83, 0x1A, 0x8C, 0x9A, 0x6E, 0x01, 0x01, 0x25};
284 //ARIA192-CCM OID (1.2.410.200046.1.1.38)
285 const uint8_t ARIA192_CCM_OID[9] = {0x2A, 0x83, 0x1A, 0x8C, 0x9A, 0x6E, 0x01, 0x01, 0x26};
286 //ARIA256-CCM OID (1.2.410.200046.1.1.39)
287 const uint8_t ARIA256_CCM_OID[9] = {0x2A, 0x83, 0x1A, 0x8C, 0x9A, 0x6E, 0x01, 0x01, 0x27};
288 
289 //Common interface for encryption algorithms
290 const CipherAlgo ariaCipherAlgo =
291 {
292  "ARIA",
293  sizeof(AriaContext),
294  CIPHER_ALGO_TYPE_BLOCK,
295  ARIA_BLOCK_SIZE,
296  (CipherAlgoInit) ariaInit,
297  NULL,
298  NULL,
299  (CipherAlgoEncryptBlock) ariaEncryptBlock,
300  (CipherAlgoDecryptBlock) ariaDecryptBlock,
301  (CipherAlgoDeinit) ariaDeinit
302 };
303 
304 
305 /**
306  * @brief Odd round function
307  * @param[in,out] d 128-bit string
308  * @param[in] rk 128-bit string
309  **/
310 
311 static void OF(uint32_t *d, const uint32_t *rk)
312 {
313  uint32_t t[4];
314 
315  //XOR D with RK
316  XOR128(d, rk);
317  //Substitution layer SL1
318  SL1(t, d);
319  //Diffusion layer
320  A(d, t);
321 }
322 
323 
324 /**
325  * @brief Even round function
326  * @param[in,out] d 128-bit string
327  * @param[in] rk 128-bit string
328  **/
329 
330 static void EF(uint32_t *d, const uint32_t *rk)
331 {
332  uint32_t t[4];
333 
334  //XOR D with RK
335  XOR128(d, rk);
336  //Substitution layer SL2
337  SL2(t, d);
338  //Diffusion layer
339  A(d, t);
340 }
341 
342 
343 /**
344  * @brief Initialize a ARIA context using the supplied key
345  * @param[in] context Pointer to the ARIA context to initialize
346  * @param[in] key Pointer to the key
347  * @param[in] keyLen Length of the key
348  * @return Error code
349  **/
350 
351 error_t ariaInit(AriaContext *context, const uint8_t *key, size_t keyLen)
352 {
353  uint_t i;
354  uint32_t *ek;
355  uint32_t *dk;
356  const uint32_t *ck1;
357  const uint32_t *ck2;
358  const uint32_t *ck3;
359  uint32_t w[16];
360 
361  //Check parameters
362  if(context == NULL || key == NULL)
363  return ERROR_INVALID_PARAMETER;
364 
365  //Check the length of the master key
366  if(keyLen == 16)
367  {
368  //128-bit master keys require a total of 12 rounds
369  context->nr = 12;
370 
371  //Select the relevant constants
372  ck1 = c + 0;
373  ck2 = c + 4;
374  ck3 = c + 8;
375  }
376  else if(keyLen == 24)
377  {
378  //192-bit master keys require a total of 14 rounds
379  context->nr = 14;
380 
381  //Select the relevant constants
382  ck1 = c + 4;
383  ck2 = c + 8;
384  ck3 = c + 0;
385  }
386  else if(keyLen == 32)
387  {
388  //256-bit master keys require a total of 16 rounds
389  context->nr = 16;
390 
391  //Select the relevant constants
392  ck1 = c + 8;
393  ck2 = c + 0;
394  ck3 = c + 4;
395  }
396  else
397  {
398  //Report an error
399  return ERROR_INVALID_KEY_LENGTH;
400  }
401 
402  //Determine the number of 32-bit words in the key
403  keyLen /= 4;
404 
405  //Compute 128-bit values KL and KR
406  for(i = 0; i < 16; i++)
407  {
408  if(i < keyLen)
409  {
410  w[i] = LOAD32BE(key + i * 4);
411  }
412  else
413  {
414  w[i] = 0;
415  }
416  }
417 
418  //Save KR
419  MOV128(w + 8, w + 4);
420 
421  //Compute intermediate values W0, W1, W2, and W3
422  MOV128(w + 4, w + 0);
423  OF(w + 4, ck1);
424  XOR128(w + 4, w + 8);
425 
426  MOV128(w + 8, w + 4);
427  EF(w + 8, ck2);
428  XOR128(w + 8, w + 0);
429 
430  MOV128(w + 12, w + 8);
431  OF(w + 12, ck3);
432  XOR128(w + 12, w + 4);
433 
434  //Point to the encryption round keys
435  ek = context->ek;
436 
437  //Compute ek1, ..., ek17 as follow
438  ROL128(ek + 0, w + 4, 109);
439  XOR128(ek + 0, w + 0);
440  ROL128(ek + 4, w + 8, 109);
441  XOR128(ek + 4, w + 4);
442  ROL128(ek + 8, w + 12, 109);
443  XOR128(ek + 8, w + 8);
444  ROL128(ek + 12, w + 0, 109);
445  XOR128(ek + 12, w + 12);
446  ROL128(ek + 16, w + 4, 97);
447  XOR128(ek + 16, w + 0);
448  ROL128(ek + 20, w + 8, 97);
449  XOR128(ek + 20, w + 4);
450  ROL128(ek + 24, w + 12, 97);
451  XOR128(ek + 24, w + 8);
452  ROL128(ek + 28, w + 0, 97);
453  XOR128(ek + 28, w + 12);
454  ROL128(ek + 32, w + 4, 61);
455  XOR128(ek + 32, w + 0);
456  ROL128(ek + 36, w + 8, 61);
457  XOR128(ek + 36, w + 4);
458  ROL128(ek + 40, w + 12, 61);
459  XOR128(ek + 40, w + 8);
460  ROL128(ek + 44, w + 0, 61);
461  XOR128(ek + 44, w + 12);
462  ROL128(ek + 48, w + 4, 31);
463  XOR128(ek + 48, w + 0);
464  ROL128(ek + 52, w + 8, 31);
465  XOR128(ek + 52, w + 4);
466  ROL128(ek + 56, w + 12, 31);
467  XOR128(ek + 56, w + 8);
468  ROL128(ek + 60, w + 0, 31);
469  XOR128(ek + 60, w + 12);
470  ROL128(ek + 64, w + 4, 19);
471  XOR128(ek + 64, w + 0);
472 
473  //Decryption round keys are derived from the encryption round keys
474  dk = context->dk;
475  //Compute dk1
476  MOV128(dk + 0, ek + context->nr * 4);
477 
478  //Compute dk2, ..., dk(n)
479  for(i = 1; i < context->nr; i++)
480  {
481  A(dk + i * 4, ek + (context->nr - i) * 4);
482  }
483 
484  //Compute dk(n + 1)
485  MOV128(dk + i * 4, ek + 0);
486 
487  //Successful initialization
488  return NO_ERROR;
489 }
490 
491 
492 /**
493  * @brief Encrypt a 16-byte block using ARIA algorithm
494  * @param[in] context Pointer to the ARIA context
495  * @param[in] input Plaintext block to encrypt
496  * @param[out] output Ciphertext block resulting from encryption
497  **/
498 
499 void ariaEncryptBlock(AriaContext *context, const uint8_t *input,
500  uint8_t *output)
501 {
502  uint32_t *ek;
503  uint32_t p[4];
504  uint32_t q[4];
505 
506  //Copy the plaintext to the buffer
507  p[0] = LOAD32BE(input);
508  p[1] = LOAD32BE(input + 4);
509  p[2] = LOAD32BE(input + 8);
510  p[3] = LOAD32BE(input + 12);
511 
512  //Point to the encryption round keys
513  ek = context->ek;
514 
515  //Apply 11 rounds
516  OF(p, ek + 0);
517  EF(p, ek + 4);
518  OF(p, ek + 8);
519  EF(p, ek + 12);
520  OF(p, ek + 16);
521  EF(p, ek + 20);
522  OF(p, ek + 24);
523  EF(p, ek + 28);
524  OF(p, ek + 32);
525  EF(p, ek + 36);
526  OF(p, ek + 40);
527 
528  //The number of rounds depends on the length of the master key
529  if(context->nr == 12)
530  {
531  //128-bit master keys require a total of 12 rounds
532  XOR128(p, ek + 44);
533  SL2(q, p);
534  XOR128(q, ek + 48);
535  }
536  else if(context->nr == 14)
537  {
538  //192-bit master keys require a total of 14 rounds
539  EF(p, ek + 44);
540  OF(p, ek + 48);
541  XOR128(p, ek + 52);
542  SL2(q, p);
543  XOR128(q, ek + 56);
544  }
545  else
546  {
547  //256-bit master keys require a total of 16 rounds
548  EF(p, ek + 44);
549  OF(p, ek + 48);
550  EF(p, ek + 52);
551  OF(p, ek + 56);
552  XOR128(p, ek + 60);
553  SL2(q, p);
554  XOR128(q, ek + 64);
555  }
556 
557  //Copy the resulting ciphertext from the buffer
558  STORE32BE(q[0], output);
559  STORE32BE(q[1], output + 4);
560  STORE32BE(q[2], output + 8);
561  STORE32BE(q[3], output + 12);
562 }
563 
564 
565 /**
566  * @brief Decrypt a 16-byte block using ARIA algorithm
567  * @param[in] context Pointer to the ARIA context
568  * @param[in] input Ciphertext block to decrypt
569  * @param[out] output Plaintext block resulting from decryption
570  **/
571 
572 void ariaDecryptBlock(AriaContext *context, const uint8_t *input,
573  uint8_t *output)
574 {
575  uint32_t *dk;
576  uint32_t p[4];
577  uint32_t q[4];
578 
579  //Copy the ciphertext to the buffer
580  p[0] = LOAD32BE(input);
581  p[1] = LOAD32BE(input + 4);
582  p[2] = LOAD32BE(input + 8);
583  p[3] = LOAD32BE(input + 12);
584 
585  //Point to the decryption round keys
586  dk = context->dk;
587 
588  //Apply 11 rounds
589  OF(p, dk + 0);
590  EF(p, dk + 4);
591  OF(p, dk + 8);
592  EF(p, dk + 12);
593  OF(p, dk + 16);
594  EF(p, dk + 20);
595  OF(p, dk + 24);
596  EF(p, dk + 28);
597  OF(p, dk + 32);
598  EF(p, dk + 36);
599  OF(p, dk + 40);
600 
601  //The number of rounds depends on the length of the master key
602  if(context->nr == 12)
603  {
604  //128-bit master keys require a total of 12 rounds
605  XOR128(p, dk + 44);
606  SL2(q, p);
607  XOR128(q, dk + 48);
608  }
609  else if(context->nr == 14)
610  {
611  //192-bit master keys require a total of 14 rounds
612  EF(p, dk + 44);
613  OF(p, dk + 48);
614  XOR128(p, dk + 52);
615  SL2(q, p);
616  XOR128(q, dk + 56);
617  }
618  else
619  {
620  //256-bit master keys require a total of 16 rounds
621  EF(p, dk + 44);
622  OF(p, dk + 48);
623  EF(p, dk + 52);
624  OF(p, dk + 56);
625  XOR128(p, dk + 60);
626  SL2(q, p);
627  XOR128(q, dk + 64);
628  }
629 
630  //The resulting value is the plaintext
631  STORE32BE(q[0], output);
632  STORE32BE(q[1], output + 4);
633  STORE32BE(q[2], output + 8);
634  STORE32BE(q[3], output + 12);
635 }
636 
637 
638 /**
639  * @brief Release ARIA context
640  * @param[in] context Pointer to the ARIA context
641  **/
642 
643 void ariaDeinit(AriaContext *context)
644 {
645  //Clear ARIA context
646  osMemset(context, 0, sizeof(AriaContext));
647 }
648 
649 #endif
ARIA192_ECB_OID
const uint8_t ARIA192_ECB_OID[9]
Definition: aria.c:254
CipherAlgoEncryptBlock
void(* CipherAlgoEncryptBlock)(void *context, const uint8_t *input, uint8_t *output)
Definition: crypto.h:1045
LOAD32BE
#define LOAD32BE(p)
Definition: cpu_endian.h:210
ARIA_BLOCK_SIZE
#define ARIA_BLOCK_SIZE
Definition: aria.h:38
p
uint8_t p
Definition: ndp.h:300
CIPHER_ALGO_TYPE_BLOCK
@ CIPHER_ALGO_TYPE_BLOCK
Definition: crypto.h:988
t
uint8_t t
Definition: lldp_ext_med.h:212
ARIA256_CBC_OID
const uint8_t ARIA256_CBC_OID[9]
Definition: aria.c:267
aria.h
ARIA encryption algorithm.
ARIA192_GCM_OID
const uint8_t ARIA192_GCM_OID[9]
Definition: aria.c:278
ARIA192_CBC_OID
const uint8_t ARIA192_CBC_OID[9]
Definition: aria.c:256
ARIA128_CBC_OID
const uint8_t ARIA128_CBC_OID[9]
Definition: aria.c:245
SL1
#define SL1(b, a)
Definition: aria.c:83
ROL128
#define ROL128(b, a, n)
Definition: aria.c:67
AriaContext::ek
uint32_t ek[68]
Definition: aria.h:56
ariaDeinit
void ariaDeinit(AriaContext *context)
Release ARIA context.
Definition: aria.c:643
XOR128
#define XOR128(b, a)
Definition: aria.c:58
ARIA192_CFB_OID
const uint8_t ARIA192_CFB_OID[9]
Definition: aria.c:258
ariaInit
error_t ariaInit(AriaContext *context, const uint8_t *key, size_t keyLen)
Initialize a ARIA context using the supplied key.
Definition: aria.c:351
ERROR_INVALID_PARAMETER
@ ERROR_INVALID_PARAMETER
Invalid parameter.
Definition: error.h:47
error_t
error_t
Error codes.
Definition: error.h:43
MOV128
#define MOV128(b, a)
Definition: aria.c:49
ARIA256_CCM_OID
const uint8_t ARIA256_CCM_OID[9]
Definition: aria.c:287
CipherAlgoDecryptBlock
void(* CipherAlgoDecryptBlock)(void *context, const uint8_t *input, uint8_t *output)
Definition: crypto.h:1048
ARIA128_OFB_OID
const uint8_t ARIA128_OFB_OID[9]
Definition: aria.c:249
ARIA192_CCM_OID
const uint8_t ARIA192_CCM_OID[9]
Definition: aria.c:285
ERROR_INVALID_KEY_LENGTH
@ ERROR_INVALID_KEY_LENGTH
Definition: error.h:107
crypto.h
General definitions for cryptographic algorithms.
AriaContext::nr
uint_t nr
Definition: aria.h:54
AriaContext::dk
uint32_t dk[68]
Definition: aria.h:57
ARIA192_CTR_OID
const uint8_t ARIA192_CTR_OID[9]
Definition: aria.c:262
CipherAlgoInit
error_t(* CipherAlgoInit)(void *context, const uint8_t *key, size_t keyLen)
Definition: crypto.h:1036
ARIA256_CFB_OID
const uint8_t ARIA256_CFB_OID[9]
Definition: aria.c:269
ARIA128_CFB_OID
const uint8_t ARIA128_CFB_OID[9]
Definition: aria.c:247
ARIA128_CCM_OID
const uint8_t ARIA128_CCM_OID[9]
Definition: aria.c:283
ARIA256_GCM_OID
const uint8_t ARIA256_GCM_OID[9]
Definition: aria.c:280
CipherAlgo
Common interface for encryption algorithms.
Definition: crypto.h:1104
ARIA128_CTR_OID
const uint8_t ARIA128_CTR_OID[9]
Definition: aria.c:251
ARIA128_ECB_OID
const uint8_t ARIA128_ECB_OID[9]
Definition: aria.c:243
ARIA256_ECB_OID
const uint8_t ARIA256_ECB_OID[9]
Definition: aria.c:265
AriaContext
ARIA algorithm context.
Definition: aria.h:53
uint_t
unsigned int uint_t
Definition: compiler_port.h:57
osMemset
#define osMemset(p, value, length)
Definition: os_port.h:138
CipherAlgoDeinit
void(* CipherAlgoDeinit)(void *context)
Definition: crypto.h:1051
ARIA192_OFB_OID
const uint8_t ARIA192_OFB_OID[9]
Definition: aria.c:260
ARIA256_OFB_OID
const uint8_t ARIA256_OFB_OID[9]
Definition: aria.c:271
ariaEncryptBlock
void ariaEncryptBlock(AriaContext *context, const uint8_t *input, uint8_t *output)
Encrypt a 16-byte block using ARIA algorithm.
Definition: aria.c:499
ariaDecryptBlock
void ariaDecryptBlock(AriaContext *context, const uint8_t *input, uint8_t *output)
Decrypt a 16-byte block using ARIA algorithm.
Definition: aria.c:572
STORE32BE
#define STORE32BE(a, p)
Definition: cpu_endian.h:286
ARIA256_CTR_OID
const uint8_t ARIA256_CTR_OID[9]
Definition: aria.c:273
ariaCipherAlgo
const CipherAlgo ariaCipherAlgo
Definition: aria.c:290
ARIA128_GCM_OID
const uint8_t ARIA128_GCM_OID[9]
Definition: aria.c:276
NO_ERROR
@ NO_ERROR
Success.
Definition: error.h:44
c
uint8_t c
Definition: ndp.h:514
debug.h
Debugging facilities.
SL2
#define SL2(b, a)
Definition: aria.c:106
A
#define A(b, a)
Definition: aria.c:129