2023年7月15日土曜日

128bitAESをゼロ?から書く

128bitAESをゼロ?から書く

128bitのAES暗号化復号化をC言語で実装してみる。ちょっと理解を深めるためにできるだけ自分で記述する。そして、すべて8bit単位で計算するコードにする。とはいえこんなもの自分で実装する必要はない。が、勉強のためです。


参考サイト
  1. #include <stdio.h>
  2. #include <stdint.h>
  3. uint8_t S[16][16]={
  4. {0x63,0x7c,0x77,0x7b,0xf2,0x6b,0x6f,0xc5,0x30,0x01,0x67,0x2b,0xfe,0xd7,0xab,0x76},
  5. {0xca,0x82,0xc9,0x7d,0xfa,0x59,0x47,0xf0,0xad,0xd4,0xa2,0xaf,0x9c,0xa4,0x72,0xc0},
  6. {0xb7,0xfd,0x93,0x26,0x36,0x3f,0xf7,0xcc,0x34,0xa5,0xe5,0xf1,0x71,0xd8,0x31,0x15},
  7. {0x04,0xc7,0x23,0xc3,0x18,0x96,0x05,0x9a,0x07,0x12,0x80,0xe2,0xeb,0x27,0xb2,0x75},
  8. {0x09,0x83,0x2c,0x1a,0x1b,0x6e,0x5a,0xa0,0x52,0x3b,0xd6,0xb3,0x29,0xe3,0x2f,0x84},
  9. {0x53,0xd1,0x00,0xed,0x20,0xfc,0xb1,0x5b,0x6a,0xcb,0xbe,0x39,0x4a,0x4c,0x58,0xcf},
  10. {0xd0,0xef,0xaa,0xfb,0x43,0x4d,0x33,0x85,0x45,0xf9,0x02,0x7f,0x50,0x3c,0x9f,0xa8},
  11. {0x51,0xa3,0x40,0x8f,0x92,0x9d,0x38,0xf5,0xbc,0xb6,0xda,0x21,0x10,0xff,0xf3,0xd2},
  12. {0xcd,0x0c,0x13,0xec,0x5f,0x97,0x44,0x17,0xc4,0xa7,0x7e,0x3d,0x64,0x5d,0x19,0x73},
  13. {0x60,0x81,0x4f,0xdc,0x22,0x2a,0x90,0x88,0x46,0xee,0xb8,0x14,0xde,0x5e,0x0b,0xdb},
  14. {0xe0,0x32,0x3a,0x0a,0x49,0x06,0x24,0x5c,0xc2,0xd3,0xac,0x62,0x91,0x95,0xe4,0x79},
  15. {0xe7,0xc8,0x37,0x6d,0x8d,0xd5,0x4e,0xa9,0x6c,0x56,0xf4,0xea,0x65,0x7a,0xae,0x08},
  16. {0xba,0x78,0x25,0x2e,0x1c,0xa6,0xb4,0xc6,0xe8,0xdd,0x74,0x1f,0x4b,0xbd,0x8b,0x8a},
  17. {0x70,0x3e,0xb5,0x66,0x48,0x03,0xf6,0x0e,0x61,0x35,0x57,0xb9,0x86,0xc1,0x1d,0x9e},
  18. {0xe1,0xf8,0x98,0x11,0x69,0xd9,0x8e,0x94,0x9b,0x1e,0x87,0xe9,0xce,0x55,0x28,0xdf},
  19. {0x8c,0xa1,0x89,0x0d,0xbf,0xe6,0x42,0x68,0x41,0x99,0x2d,0x0f,0xb0,0x54,0xbb,0x16}
  20. };
  21. uint8_t invS[16][16]={
  22. {0x52,0x09,0x6a,0xd5,0x30,0x36,0xa5,0x38,0xbf,0x40,0xa3,0x9e,0x81,0xf3,0xd7,0xfb},
  23. {0x7c,0xe3,0x39,0x82,0x9b,0x2f,0xff,0x87,0x34,0x8e,0x43,0x44,0xc4,0xde,0xe9,0xcb},
  24. {0x54,0x7b,0x94,0x32,0xa6,0xc2,0x23,0x3d,0xee,0x4c,0x95,0x0b,0x42,0xfa,0xc3,0x4e},
  25. {0x08,0x2e,0xa1,0x66,0x28,0xd9,0x24,0xb2,0x76,0x5b,0xa2,0x49,0x6d,0x8b,0xd1,0x25},
  26. {0x72,0xf8,0xf6,0x64,0x86,0x68,0x98,0x16,0xd4,0xa4,0x5c,0xcc,0x5d,0x65,0xb6,0x92},
  27. {0x6c,0x70,0x48,0x50,0xfd,0xed,0xb9,0xda,0x5e,0x15,0x46,0x57,0xa7,0x8d,0x9d,0x84},
  28. {0x90,0xd8,0xab,0x00,0x8c,0xbc,0xd3,0x0a,0xf7,0xe4,0x58,0x05,0xb8,0xb3,0x45,0x06},
  29. {0xd0,0x2c,0x1e,0x8f,0xca,0x3f,0x0f,0x02,0xc1,0xaf,0xbd,0x03,0x01,0x13,0x8a,0x6b},
  30. {0x3a,0x91,0x11,0x41,0x4f,0x67,0xdc,0xea,0x97,0xf2,0xcf,0xce,0xf0,0xb4,0xe6,0x73},
  31. {0x96,0xac,0x74,0x22,0xe7,0xad,0x35,0x85,0xe2,0xf9,0x37,0xe8,0x1c,0x75,0xdf,0x6e},
  32. {0x47,0xf1,0x1a,0x71,0x1d,0x29,0xc5,0x89,0x6f,0xb7,0x62,0x0e,0xaa,0x18,0xbe,0x1b},
  33. {0xfc,0x56,0x3e,0x4b,0xc6,0xd2,0x79,0x20,0x9a,0xdb,0xc0,0xfe,0x78,0xcd,0x5a,0xf4},
  34. {0x1f,0xdd,0xa8,0x33,0x88,0x07,0xc7,0x31,0xb1,0x12,0x10,0x59,0x27,0x80,0xec,0x5f},
  35. {0x60,0x51,0x7f,0xa9,0x19,0xb5,0x4a,0x0d,0x2d,0xe5,0x7a,0x9f,0x93,0xc9,0x9c,0xef},
  36. {0xa0,0xe0,0x3b,0x4d,0xae,0x2a,0xf5,0xb0,0xc8,0xeb,0xbb,0x3c,0x83,0x53,0x99,0x61},
  37. {0x17,0x2b,0x04,0x7e,0xba,0x77,0xd6,0x26,0xe1,0x69,0x14,0x63,0x55,0x21,0x0c,0x7d}
  38. };
  39. uint8_t w[11][16];
  40. uint8_t Rcon[10]={0x01,0x02,0x04,0x08,0x10,0x20,0x40,0x80,0x1b,0x36};
  41.  
  42. void SubWord(uint8_t* in){
  43.     int i;
  44.     for(i=0;i<4;i++){
  45.         in[i]=S[(in[i]>>4)&0x0F][(in[i]>>0)&0x0F];
  46.     }
  47. }
  48. void RotWord(uint8_t* in){
  49.     uint8_t tmp;
  50.     tmp=in[0];
  51.     in[0]=in[1];
  52.     in[1]=in[2];
  53.     in[2]=in[3];
  54.     in[3]=tmp;
  55. }
  56. void KeyExpansion_Single(uint8_t num){
  57.     uint8_t i,j;
  58.     for(i=0;i<4;i++){
  59.         w[num][i]=w[num-1][12+i];
  60.     }
  61.     RotWord(&(w[num][0]));
  62.     SubWord(&(w[num][0]));
  63.     w[num][0]^=Rcon[num-1];
  64.     for(i=0;i<4;i++){
  65.         w[num][i]^=w[num-1][i];
  66.         w[num][i+4]=w[num][i]^w[num-1][i+4];
  67.         w[num][i+8]=w[num][i+4]^w[num-1][i+8];
  68.         w[num][i+12]=w[num][i+8]^w[num-1][i+12];
  69.     }
  70. }
  71. void KeyExpansion(uint8_t *key){
  72.     uint8_t i;
  73.     for(i=0;i<16;i++){
  74.         w[0][i]=key[i];
  75.     }
  76.     for(i=1;i<11;i++){
  77.         KeyExpansion_Single(i);
  78.     }
  79. }
  80. void AddRoundKey(uint8_t* src,uint8_t nRound){
  81.     uint8_t i;
  82.     for(i=0;i<16;i++){
  83.         src[i]^=w[nRound][i];
  84.     }
  85. }
  86. void SubBytes(uint8_t* src){
  87.     uint8_t i;
  88.     for(i=0;i<16;i++){
  89.         src[i]=S[(src[i]>>4)&0x0F][(src[i]>>0)&0x0F];
  90.     }
  91. }
  92. void invSubBytes(uint8_t* src){
  93.     uint8_t i;
  94.     for(i=0;i<16;i++){
  95.         src[i]=invS[(src[i]>>4)&0x0F][(src[i]>>0)&0x0F];
  96.     }
  97. }
  98. void ShiftRows(uint8_t* src){
  99.     uint8_t temp[8];
  100.     uint8_t i,j;
  101.     for(i=0;i<4;i++){
  102.         for(j=0;j<4;j++){
  103.             temp[j]=src[j*4+i];
  104.             temp[j+4]=src[j*4+i];
  105.         }
  106.         for(j=0;j<4;j++){
  107.             src[j*4+i]=temp[j+i];
  108.         }
  109.     }
  110. }
  111. void invShiftRows(uint8_t* src){
  112.     uint8_t temp[8];
  113.     uint8_t i,j;
  114.     for(i=0;i<4;i++){
  115.         for(j=0;j<4;j++){
  116.             temp[j]=src[j*4+i];
  117.             temp[j+4]=src[j*4+i];
  118.         }
  119.         for(j=0;j<4;j++){
  120.             src[j*4+i]=temp[j+4-i];
  121.         }
  122.     }
  123. }
  124. uint8_t mul(uint8_t a,uint8_t b){
  125.     uint8_t x=0;
  126.     uint8_t i;
  127.     for(i=0x08;i>0;i>>=1){
  128.         if(x&0x80){
  129.             x<<=1;
  130.             x^=0x1b;
  131.         }else{
  132.             x<<=1;
  133.         }
  134.         if(b&i){
  135.             x^=a;
  136.         }
  137.     }
  138.     return x;
  139. }
  140. void MixColumn_single(uint8_t *r) {
  141.     uint8_t t[4];
  142.     uint8_t i;
  143.     for(i=0;i<4;i++){
  144.         t[i]=r[i];
  145.     }
  146.     r[0]=mul(t[0],2)^mul(t[1],3)^mul(t[2],1)^mul(t[3],1);
  147.     r[1]=mul(t[1],2)^mul(t[2],3)^mul(t[3],1)^mul(t[0],1);
  148.     r[2]=mul(t[2],2)^mul(t[3],3)^mul(t[0],1)^mul(t[1],1);
  149.     r[3]=mul(t[3],2)^mul(t[0],3)^mul(t[1],1)^mul(t[2],1);
  150. }
  151. void MixColumns(uint8_t* src){
  152.     uint8_t i;
  153.     for(i=0;i<4;i++){
  154.         MixColumn_single(&(src[i*4]));
  155.     }
  156. }
  157. void invMixColumn_single(uint8_t *r) {
  158.     uint8_t t[4];
  159.     uint8_t i;
  160.     for(i=0;i<4;i++){
  161.         t[i]=r[i];
  162.     }
  163.     r[0]=mul(t[0],14)^mul(t[1],11)^mul(t[2],13)^mul(t[3],9);
  164.     r[1]=mul(t[1],14)^mul(t[2],11)^mul(t[3],13)^mul(t[0],9);
  165.     r[2]=mul(t[2],14)^mul(t[3],11)^mul(t[0],13)^mul(t[1],9);
  166.     r[3]=mul(t[3],14)^mul(t[0],11)^mul(t[1],13)^mul(t[2],9);
  167. }
  168. void invMixColumns(uint8_t* src){
  169.     uint8_t i;
  170.     for(i=0;i<4;i++){
  171.         invMixColumn_single(&(src[i*4]));
  172.     }
  173. }
  174. void Cipher(uint8_t* data,uint8_t* key){
  175.     int i;
  176.     AddRoundKey(data,0);
  177.     for(i=1;i<10;i++){
  178.         SubBytes(data);
  179.         ShiftRows(data);
  180.         MixColumns(data);
  181.         AddRoundKey(data,i);
  182.     }
  183.     SubBytes(data);
  184.     ShiftRows(data);
  185.     AddRoundKey(data,i);
  186. }
  187.  
  188. void invCipher(uint8_t* data,uint8_t* key){
  189.     int i;
  190.     AddRoundKey(data,10);
  191.     for(i=9;i>0;i--){
  192.         invShiftRows(data);
  193.         invSubBytes(data);
  194.         AddRoundKey(data,i);
  195.         invMixColumns(data);
  196.     }
  197.     invShiftRows(data);
  198.     invSubBytes(data);
  199.     AddRoundKey(data,0);
  200. }
  201.  
  202. int main(int argc,char** argv){
  203.     uint8_t key[]={0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c,0x0d,0x0e,0x0f};
  204.     uint8_t data[]={0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xaa,0xbb,0xcc,0xdd,0xee,0xff};
  205.     int i,j;
  206.  
  207.     KeyExpansion(key);
  208.     Cipher(data,key);
  209.     for(i=0;i<16;i++){
  210.         printf("%02X",data[i]);
  211.     }
  212.     printf("\n");
  213.  
  214.     invCipher(data,key);
  215.     for(i=0;i<16;i++){
  216.         printf("%02X",data[i]);
  217.     }
  218.     printf("\n");
  219. }

できた(๑•̀д•́๑)

相変わらずコメントなし。そして、MixColumnはまぁまぁピイジェイさんのパクリです。説明が異常に難しいんよ。どうするのか見当がつかなかったので。（検算のためテストベクタもピイジェイさんのコード内の値をパクッてます。）

全部8bit(1byte)単位での計算にしたので、まどろっこしいところもあるけど、とりあえずどういう仕組みなのかは見やすくできたと思う。

at
Labels:

0 件のコメント:

コメントを投稿

登録: コメントの投稿 (Atom)